@maestro-js/aws-cdk-recipes 1.0.0-alpha.0

package/dist/index.js

@@ -0,0 +1,2252 @@
+// src/bucket.ts
+import { Construct } from "constructs";
+import { Duration, RemovalPolicy } from "aws-cdk-lib";
+import * as s3 from "aws-cdk-lib/aws-s3";
+import * as iam from "aws-cdk-lib/aws-iam";
+var Bucket2 = class extends Construct {
+  bucket;
+  constructor(scope, id, props = {}) {
+    super(scope, id);
+    const cors = resolveCorsRules(props.cors);
+    let bucketProps = {
+      blockPublicAccess: props.access === "public" ? resolvePublicAccessBlock() : s3.BlockPublicAccess.BLOCK_ALL,
+      objectOwnership: props.access === "public" ? s3.ObjectOwnership.BUCKET_OWNER_ENFORCED : void 0,
+      removalPolicy: RemovalPolicy.RETAIN,
+      versioned: props.versioning ?? false,
+      cors,
+      lifecycleRules: props.lifecycle ? resolveLifecycleRules(props.lifecycle) : void 0
+    };
+    if (props.transform?.bucket) {
+      bucketProps = props.transform.bucket(bucketProps);
+    }
+    this.bucket = new s3.Bucket(this, "Bucket", bucketProps);
+    if (props.enforceHttps !== false) {
+      this.bucket.addToResourcePolicy(
+        new iam.PolicyStatement({
+          effect: iam.Effect.DENY,
+          principals: [new iam.AnyPrincipal()],
+          actions: ["s3:*"],
+          resources: [this.bucket.bucketArn, `${this.bucket.bucketArn}/*`],
+          conditions: { Bool: { "aws:SecureTransport": "false" } }
+        })
+      );
+    }
+    if (props.access === "public") {
+      this.bucket.addToResourcePolicy(
+        new iam.PolicyStatement({
+          effect: iam.Effect.ALLOW,
+          principals: [new iam.AnyPrincipal()],
+          actions: ["s3:GetObject"],
+          resources: [`${this.bucket.bucketArn}/*`]
+        })
+      );
+    }
+    if (props.policy) {
+      for (const stmt of props.policy) {
+        this.bucket.addToResourcePolicy(resolvePolicyStatement(this.bucket, stmt));
+      }
+    }
+  }
+};
+function resolvePublicAccessBlock() {
+  return new s3.BlockPublicAccess({
+    blockPublicAcls: true,
+    ignorePublicAcls: true,
+    blockPublicPolicy: false,
+    restrictPublicBuckets: false
+  });
+}
+function resolveCorsRules(cors) {
+  if (cors === false) return void 0;
+  if (cors === void 0) {
+    return [
+      {
+        allowedHeaders: ["*"],
+        allowedMethods: [
+          s3.HttpMethods.GET,
+          s3.HttpMethods.PUT,
+          s3.HttpMethods.POST,
+          s3.HttpMethods.DELETE,
+          s3.HttpMethods.HEAD
+        ],
+        allowedOrigins: ["*"]
+      }
+    ];
+  }
+  return [
+    {
+      allowedHeaders: cors.allowHeaders,
+      allowedMethods: (cors.allowMethods ?? ["GET"]).map(resolveCorsMethods),
+      allowedOrigins: cors.allowOrigins ?? ["*"],
+      exposedHeaders: cors.exposeHeaders,
+      maxAge: cors.maxAge
+    }
+  ];
+}
+function resolveCorsMethods(method) {
+  switch (method) {
+    case "GET":
+      return s3.HttpMethods.GET;
+    case "PUT":
+      return s3.HttpMethods.PUT;
+    case "POST":
+      return s3.HttpMethods.POST;
+    case "DELETE":
+      return s3.HttpMethods.DELETE;
+    case "HEAD":
+      return s3.HttpMethods.HEAD;
+  }
+}
+function resolveLifecycleRules(rules) {
+  return rules.map((rule) => {
+    if (!rule.expiresIn && !rule.expiresAt) {
+      throw new Error('LifecycleRule requires either "expiresIn" or "expiresAt"');
+    }
+    const expirationDate = rule.expiresAt ? new Date(rule.expiresAt) : void 0;
+    if (expirationDate && isNaN(expirationDate.getTime())) {
+      throw new Error(`Invalid "expiresAt" date: "${rule.expiresAt}"`);
+    }
+    return {
+      id: rule.id,
+      prefix: rule.prefix,
+      enabled: rule.enabled ?? true,
+      expiration: rule.expiresIn ? parseDurationDays(rule.expiresIn) : void 0,
+      expirationDate
+    };
+  });
+}
+function parseDurationDays(duration) {
+  const match = duration.match(/^(\d+)\s*days?$/);
+  if (!match) throw new Error(`Invalid duration: "${duration}". Expected format: "30 days"`);
+  return Duration.days(Number(match[1]));
+}
+function resolvePolicyStatement(bucket, stmt) {
+  const principals = resolvePrincipals(stmt.principals);
+  const resources = stmt.paths ? stmt.paths.map((r) => `${bucket.bucketArn}/${r}`) : [bucket.bucketArn, `${bucket.bucketArn}/*`];
+  return new iam.PolicyStatement({
+    effect: stmt.effect === "deny" ? iam.Effect.DENY : iam.Effect.ALLOW,
+    principals,
+    actions: stmt.actions,
+    resources,
+    conditions: stmt.conditions ? resolveConditions(stmt.conditions) : void 0
+  });
+}
+function resolvePrincipals(principals) {
+  if (principals === "*") return [new iam.AnyPrincipal()];
+  return principals.flatMap((p) => {
+    switch (p.type) {
+      case "aws":
+        return p.identifiers.map((id) => new iam.ArnPrincipal(id));
+      case "service":
+        return p.identifiers.map((id) => new iam.ServicePrincipal(id));
+      case "federated":
+        return p.identifiers.map((id) => new iam.FederatedPrincipal(id, {}));
+      case "canonical":
+        return p.identifiers.map((id) => new iam.CanonicalUserPrincipal(id));
+    }
+  });
+}
+function resolveConditions(conditions) {
+  const result = {};
+  for (const c of conditions) {
+    const test = result[c.test] ??= {};
+    const existing = test[c.variable];
+    test[c.variable] = existing ? [...existing, ...c.values] : c.values;
+  }
+  return result;
+}
+
+// src/vpc.ts
+import { Construct as Construct2 } from "constructs";
+import { Stack } from "aws-cdk-lib";
+import * as ec2 from "aws-cdk-lib/aws-ec2";
+import * as iam2 from "aws-cdk-lib/aws-iam";
+import * as logs from "aws-cdk-lib/aws-logs";
+var Vpc2 = class extends Construct2 {
+  vpc;
+  publicSubnets;
+  privateSubnets;
+  securityGroup;
+  wireguard;
+  wireguardPublicKeyParam;
+  constructor(scope, id, props = {}) {
+    super(scope, id);
+    const maxAzs = props.maxAzs ?? 2;
+    const natOption = props.natGateways ?? "single";
+    const { natGateways, natGatewayProvider } = resolveNat(natOption, maxAzs);
+    const hasEgress = natOption !== "none";
+    const defaultSubnets = [
+      { name: "Public", subnetType: ec2.SubnetType.PUBLIC, cidrMask: 24 },
+      {
+        name: "Private",
+        subnetType: hasEgress ? ec2.SubnetType.PRIVATE_WITH_EGRESS : ec2.SubnetType.PRIVATE_ISOLATED,
+        cidrMask: 24
+      }
+    ];
+    this.vpc = new ec2.Vpc(this, "Vpc", {
+      ipAddresses: ec2.IpAddresses.cidr(props.cidr ?? "10.0.0.0/16"),
+      maxAzs,
+      natGateways,
+      natGatewayProvider,
+      subnetConfiguration: props.subnetConfiguration ?? defaultSubnets
+    });
+    this.publicSubnets = this.vpc.publicSubnets;
+    this.privateSubnets = hasEgress ? this.vpc.privateSubnets : this.vpc.isolatedSubnets;
+    this.securityGroup = new ec2.SecurityGroup(this, "SecurityGroup", {
+      vpc: this.vpc,
+      description: `Default security group for ${id}`,
+      allowAllOutbound: true
+    });
+    if (props.wireguard) {
+      const region = Stack.of(this).region;
+      const privateKeyParam = `/wireguard/${id}/private-key`;
+      const publicKeyParam = `/wireguard/${id}/public-key`;
+      const peersParam = `/wireguard/${id}/peers`;
+      this.wireguardPublicKeyParam = publicKeyParam;
+      const wgSg = new ec2.SecurityGroup(this, "WireGuardSG", {
+        vpc: this.vpc,
+        description: "WireGuard VPN",
+        allowAllOutbound: true
+      });
+      wgSg.addIngressRule(ec2.Peer.anyIpv4(), ec2.Port.udp(51820), "WireGuard");
+      const vpcCidr = props.cidr ?? "10.0.0.0/16";
+      const userData = ec2.UserData.forLinux();
+      userData.addCommands(
+        // Install WireGuard
+        "dnf install -y wireguard-tools iptables-nft",
+        // Enable IP forwarding
+        "sysctl -w net.ipv4.ip_forward=1",
+        'echo "net.ipv4.ip_forward = 1" >> /etc/sysctl.d/99-wireguard.conf',
+        // Retrieve or generate server keys
+        "umask 077",
+        `if aws ssm get-parameter --name "${privateKeyParam}" --with-decryption --region ${region} --query "Parameter.Value" --output text > /etc/wireguard/server.key 2>/dev/null; then`,
+        "  wg pubkey < /etc/wireguard/server.key > /etc/wireguard/server.pub",
+        "else",
+        "  wg genkey | tee /etc/wireguard/server.key | wg pubkey > /etc/wireguard/server.pub",
+        `  aws ssm put-parameter --name "${privateKeyParam}" --type SecureString --value "$(cat /etc/wireguard/server.key)" --region ${region}`,
+        `  aws ssm put-parameter --name "${publicKeyParam}" --type String --value "$(cat /etc/wireguard/server.pub)" --region ${region}`,
+        "fi",
+        // Create wg0 config
+        "ENI=$(ip -4 route show default | awk '{print $5}')",
+        `cat > /etc/wireguard/wg0.conf << EOF`,
+        "[Interface]",
+        "Address = 10.100.0.1/24",
+        "ListenPort = 51820",
+        "PrivateKey = $(cat /etc/wireguard/server.key)",
+        "",
+        "PostUp = iptables -t nat -A POSTROUTING -s 10.100.0.0/24 -o $ENI -j MASQUERADE",
+        `PostUp = iptables -A FORWARD -s 10.100.0.0/24 -d ${vpcCidr} -j ACCEPT`,
+        "PostDown = iptables -t nat -D POSTROUTING -s 10.100.0.0/24 -o $ENI -j MASQUERADE",
+        `PostDown = iptables -D FORWARD -s 10.100.0.0/24 -d ${vpcCidr} -j ACCEPT`,
+        "EOF",
+        // Load persisted peers from SSM
+        `if aws ssm get-parameter --name "${peersParam}" --with-decryption --region ${region} --query "Parameter.Value" --output text >> /etc/wireguard/wg0.conf 2>/dev/null; then`,
+        '  echo "Loaded persisted peers"',
+        "fi",
+        // Enable and start WireGuard
+        "systemctl enable wg-quick@wg0",
+        "systemctl start wg-quick@wg0",
+        // Store metadata for CLI tooling
+        'TOKEN=$(curl -s -X PUT "http://169.254.169.254/latest/api/token" -H "X-aws-ec2-metadata-token-ttl-seconds: 21600")',
+        'PUBLIC_IP=$(curl -s -H "X-aws-ec2-metadata-token: $TOKEN" http://169.254.169.254/latest/meta-data/public-ipv4)',
+        'INSTANCE_ID=$(curl -s -H "X-aws-ec2-metadata-token: $TOKEN" http://169.254.169.254/latest/meta-data/instance-id)',
+        `aws ssm put-parameter --name "/wireguard/${id}/endpoint" --type String --value "$PUBLIC_IP" --overwrite --region ${region}`,
+        `aws ssm put-parameter --name "/wireguard/${id}/instance-id" --type String --value "$INSTANCE_ID" --overwrite --region ${region}`
+      );
+      this.wireguard = new ec2.Instance(this, "WireGuard", {
+        vpc: this.vpc,
+        instanceType: ec2.InstanceType.of(ec2.InstanceClass.T4G, ec2.InstanceSize.NANO),
+        machineImage: ec2.MachineImage.latestAmazonLinux2023({ cpuType: ec2.AmazonLinuxCpuType.ARM_64 }),
+        vpcSubnets: { subnetType: ec2.SubnetType.PUBLIC },
+        securityGroup: wgSg,
+        ssmSessionPermissions: true,
+        userData
+      });
+      this.wireguard.addSecurityGroup(this.securityGroup);
+      const ssmParamArn = Stack.of(this).formatArn({
+        service: "ssm",
+        resource: "parameter",
+        resourceName: `wireguard/${id}/*`
+      });
+      this.wireguard.role.addToPrincipalPolicy(
+        new iam2.PolicyStatement({
+          actions: ["ssm:GetParameter", "ssm:PutParameter"],
+          resources: [ssmParamArn]
+        })
+      );
+      const eip = new ec2.CfnEIP(this, "WireGuardEIP", {
+        instanceId: this.wireguard.instanceId
+      });
+      const gatewayAttachment = this.vpc.node.findChild("VPCGW");
+      eip.addDependency(gatewayAttachment);
+    }
+    if (props.flowLogs) {
+      const flowLogOpts = typeof props.flowLogs === "object" ? props.flowLogs : {};
+      const logGroup = new logs.LogGroup(this, "FlowLogGroup", {
+        retention: flowLogOpts.retention ?? logs.RetentionDays.ONE_MONTH
+      });
+      this.vpc.addFlowLog("FlowLog", {
+        destination: ec2.FlowLogDestination.toCloudWatchLogs(logGroup)
+      });
+    }
+  }
+};
+function resolveNat(option, maxAzs) {
+  switch (option) {
+    case "none":
+      return { natGateways: 0 };
+    case "ec2":
+      return {
+        natGateways: 1,
+        natGatewayProvider: ec2.NatProvider.instanceV2({
+          instanceType: ec2.InstanceType.of(ec2.InstanceClass.T4G, ec2.InstanceSize.NANO),
+          machineImage: new ec2.LookupMachineImage({
+            name: "fck-nat-al2023-*-arm64-ebs",
+            owners: ["568608671756"]
+          })
+        })
+      };
+    case "onePerAz":
+      return { natGateways: maxAzs };
+    case "single":
+    default:
+      return { natGateways: 1 };
+  }
+}
+
+// src/cluster.ts
+import { Construct as Construct3 } from "constructs";
+import * as ecs from "aws-cdk-lib/aws-ecs";
+var Cluster2 = class extends Construct3 {
+  cluster;
+  constructor(scope, id, props) {
+    super(scope, id);
+    let clusterProps = {
+      vpc: props.vpc,
+      enableFargateCapacityProviders: props.enableFargateCapacityProviders ?? false
+    };
+    if (props.transform?.cluster) {
+      clusterProps = props.transform.cluster(clusterProps);
+    }
+    this.cluster = new ecs.Cluster(this, "Cluster", clusterProps);
+  }
+};
+
+// src/static-site.ts
+import { Construct as Construct6 } from "constructs";
+import { RemovalPolicy as RemovalPolicy2 } from "aws-cdk-lib";
+import * as s33 from "aws-cdk-lib/aws-s3";
+import * as cloudfront2 from "aws-cdk-lib/aws-cloudfront";
+import * as origins from "aws-cdk-lib/aws-cloudfront-origins";
+
+// src/helpers/cloudfront.ts
+import "constructs";
+import "aws-cdk-lib/aws-s3";
+import * as s3deploy from "aws-cdk-lib/aws-s3-deployment";
+import * as cloudfront from "aws-cdk-lib/aws-cloudfront";
+import * as acm from "aws-cdk-lib/aws-certificatemanager";
+function resolveCachePolicy(policy) {
+  if (!policy) return cloudfront.CachePolicy.CACHING_OPTIMIZED;
+  if (typeof policy === "string") {
+    switch (policy) {
+      case "CACHING_OPTIMIZED":
+        return cloudfront.CachePolicy.CACHING_OPTIMIZED;
+      case "CACHING_DISABLED":
+        return cloudfront.CachePolicy.CACHING_DISABLED;
+    }
+  }
+  return policy;
+}
+function resolveInvalidation(invalidation) {
+  if (invalidation === false) {
+    return { enabled: false, paths: [], wait: false };
+  }
+  if (invalidation === void 0) {
+    return { enabled: true, paths: ["/*"], wait: true };
+  }
+  const paths = invalidation.paths === "all" || invalidation.paths === void 0 ? ["/*"] : invalidation.paths;
+  return { enabled: true, paths, wait: invalidation.wait ?? true };
+}
+function resolveAssetDeployment(scope, id, opts) {
+  const invalidation = resolveInvalidation(opts.invalidation);
+  const baseDeployment = new s3deploy.BucketDeployment(scope, `${id}AssetDeployment`, {
+    sources: [s3deploy.Source.asset(opts.path)],
+    destinationBucket: opts.bucket,
+    destinationKeyPrefix: opts.prefix,
+    prune: true
+  });
+  opts.fileOptions.forEach((option, i) => {
+    const files = Array.isArray(option.files) ? option.files : [option.files];
+    const ignore = option.ignore ? Array.isArray(option.ignore) ? option.ignore : [option.ignore] : void 0;
+    const isLast = i === opts.fileOptions.length - 1;
+    const cacheControl = option.cacheControl ? s3deploy.CacheControl.fromString(option.cacheControl) : void 0;
+    const overlay = new s3deploy.BucketDeployment(scope, `${id}AssetDeploymentOverlay${i}`, {
+      sources: [s3deploy.Source.asset(opts.path)],
+      destinationBucket: opts.bucket,
+      destinationKeyPrefix: opts.prefix,
+      exclude: ["*", ...ignore ?? []],
+      include: files,
+      prune: false,
+      cacheControl: cacheControl ? [cacheControl] : void 0,
+      contentType: option.contentType,
+      distribution: isLast && invalidation.enabled ? opts.distribution : void 0,
+      distributionPaths: isLast && invalidation.enabled ? invalidation.paths : void 0
+    });
+    overlay.node.addDependency(baseDeployment);
+  });
+}
+function resolveCertificate(scope, domain) {
+  const certificate = domain ? acm.Certificate.fromCertificateArn(scope, "Certificate", domain.certificateArn) : void 0;
+  const domainNames = domain ? [domain.name, ...domain.aliases ?? []] : void 0;
+  return { certificate, domainNames };
+}
+function resolveAdditionalBehaviors(s3Origin, behaviors) {
+  const additionalBehaviors = {};
+  for (const behavior of behaviors) {
+    additionalBehaviors[behavior.pathPattern] = {
+      origin: s3Origin,
+      viewerProtocolPolicy: cloudfront.ViewerProtocolPolicy.REDIRECT_TO_HTTPS,
+      cachePolicy: resolveCachePolicy(behavior.cachePolicy)
+    };
+  }
+  return additionalBehaviors;
+}
+function createViewerRequestFunction(scope, id) {
+  return new cloudfront.Function(scope, id, {
+    code: cloudfront.FunctionCode.fromInline(`
+function handler(event) {
+  var request = event.request;
+  var uri = request.uri;
+  var host = request.headers.host ? request.headers.host.value : '';
+  request.headers['x-forwarded-host'] = { value: host };
+  if (uri.length > 1 && uri.endsWith('/')) {
+    request.uri = uri.slice(0, -1);
+  }
+  return request;
+}`)
+  });
+}
+
+// src/helpers/ecs.ts
+import "constructs";
+import * as logs2 from "aws-cdk-lib/aws-logs";
+import * as ecs2 from "aws-cdk-lib/aws-ecs";
+import * as ssm from "aws-cdk-lib/aws-ssm";
+import * as secretsmanager from "aws-cdk-lib/aws-secretsmanager";
+function resolveLogRetention(retention) {
+  switch (retention) {
+    case "1 day":
+      return logs2.RetentionDays.ONE_DAY;
+    case "3 days":
+      return logs2.RetentionDays.THREE_DAYS;
+    case "5 days":
+      return logs2.RetentionDays.FIVE_DAYS;
+    case "1 week":
+      return logs2.RetentionDays.ONE_WEEK;
+    case "2 weeks":
+      return logs2.RetentionDays.TWO_WEEKS;
+    case "1 month":
+    case void 0:
+      return logs2.RetentionDays.ONE_MONTH;
+    case "3 months":
+      return logs2.RetentionDays.THREE_MONTHS;
+    case "6 months":
+      return logs2.RetentionDays.SIX_MONTHS;
+    case "1 year":
+      return logs2.RetentionDays.ONE_YEAR;
+    case "2 years":
+      return logs2.RetentionDays.TWO_YEARS;
+    case "forever":
+      return logs2.RetentionDays.INFINITE;
+  }
+}
+function resolveSecrets(scope, ssmEntries, explicitSecrets, prefix) {
+  const merged = {};
+  let hasEntries = false;
+  const p = prefix ? `${prefix}-` : "";
+  if (ssmEntries) {
+    let i = 0;
+    for (const [envVar, arn] of Object.entries(ssmEntries)) {
+      hasEntries = true;
+      if (arn.startsWith("arn:aws:secretsmanager:")) {
+        merged[envVar] = ecs2.Secret.fromSecretsManager(
+          secretsmanager.Secret.fromSecretCompleteArn(scope, `${p}Secret${i}`, arn)
+        );
+      } else {
+        merged[envVar] = ecs2.Secret.fromSsmParameter(
+          ssm.StringParameter.fromSecureStringParameterAttributes(scope, `${p}SsmParam${i}`, { parameterName: arn })
+        );
+      }
+      i++;
+    }
+  }
+  if (explicitSecrets) {
+    hasEntries = true;
+    Object.assign(merged, explicitSecrets);
+  }
+  return hasEntries ? merged : void 0;
+}
+
+// src/helpers/docker.ts
+import { execSync } from "child_process";
+import { cpSync, existsSync, mkdirSync, readFileSync, rmSync, writeFileSync } from "fs";
+import { dirname, relative, resolve } from "path";
+function findMonorepoRoot(startDir) {
+  let dir = startDir;
+  while (true) {
+    if (existsSync(resolve(dir, "pnpm-workspace.yaml"))) return dir;
+    const parent = dirname(dir);
+    if (parent === dir) return null;
+    dir = parent;
+  }
+}
+function readPackageName(appRoot) {
+  const raw = readFileSync(resolve(appRoot, "package.json"), "utf-8");
+  const pkg = JSON.parse(raw);
+  if (!pkg.name) {
+    throw new Error(`package.json at "${appRoot}" is missing a "name" field`);
+  }
+  return pkg.name;
+}
+function buildMonorepoDockerfile(buildDir, port) {
+  return `FROM node:22-slim
+WORKDIR /app
+ENV NODE_ENV=production
+COPY package.json .
+COPY node_modules/ ./node_modules/
+COPY ${buildDir}/server/ ./${buildDir}/server/
+EXPOSE ${port}
+CMD ["./node_modules/.bin/react-router-serve", "./${buildDir}/server/index.js"]
+`;
+}
+function resolveReactRouterDockerContext(opts) {
+  const { appRoot, buildDir, basePath, port, className } = opts;
+  const serverBuild = `${basePath}/server/index.js`;
+  if (!existsSync(serverBuild)) {
+    throw new Error(`${className}: "${serverBuild}" not found. Run "react-router build" before deploying.`);
+  }
+  if (existsSync(`${appRoot}/Dockerfile`)) {
+    return { context: appRoot };
+  }
+  const absAppRoot = resolve(appRoot);
+  const monorepoRoot = findMonorepoRoot(absAppRoot);
+  if (monorepoRoot) {
+    const packageName = readPackageName(absAppRoot);
+    const deployDir = resolve(absAppRoot, buildDir, "_deploy");
+    rmSync(deployDir, { recursive: true, force: true });
+    execSync(`pnpm --filter "${packageName}" deploy --prod ${deployDir}`, {
+      cwd: monorepoRoot,
+      stdio: "inherit"
+    });
+    const destBuildDir = resolve(deployDir, buildDir, "server");
+    mkdirSync(destBuildDir, { recursive: true });
+    cpSync(resolve(absAppRoot, buildDir, "server"), destBuildDir, { recursive: true });
+    writeFileSync(resolve(deployDir, "Dockerfile"), buildMonorepoDockerfile(buildDir, port));
+    return { context: relative(".", deployDir) || "." };
+  }
+  writeFileSync(`${basePath}/_Dockerfile`, buildStandaloneDockerfile(buildDir, port));
+  return { context: appRoot, dockerfile: `${buildDir}/_Dockerfile` };
+}
+function buildStandaloneDockerfile(buildDir, port) {
+  return `# syntax=docker/dockerfile:1.5
+
+FROM node:22-slim AS base
+WORKDIR /app
+ENV CI=true
+RUN corepack enable
+
+COPY package.json pnpm-lock.yaml ./
+RUN --mount=type=cache,id=pnpm,target=/pnpm/store pnpm install --frozen-lockfile --prod
+
+COPY ${buildDir}/ ./${buildDir}/
+
+ENV NODE_ENV=production
+EXPOSE ${port}
+CMD ["./node_modules/.bin/react-router-serve", "./${buildDir}/server/index.js"]
+`;
+}
+
+// src/static-site.ts
+var defaultFileOptions = [
+  { files: "**", cacheControl: "max-age=31536000,public,immutable" },
+  { files: "**/*.html", cacheControl: "max-age=0,no-cache,no-store,must-revalidate" }
+];
+var StaticSite = class extends Construct6 {
+  bucket;
+  distribution;
+  constructor(scope, id, props) {
+    super(scope, id);
+    const indexPage = props.indexPage ?? "index.html";
+    const errorPage = props.errorPage ?? indexPage;
+    const fileOptions = props.assets?.fileOptions ?? defaultFileOptions;
+    let bucketProps = {
+      blockPublicAccess: s33.BlockPublicAccess.BLOCK_ALL,
+      removalPolicy: RemovalPolicy2.RETAIN
+    };
+    if (props.transform?.bucket) {
+      bucketProps = props.transform.bucket(bucketProps);
+    }
+    this.bucket = new s33.Bucket(this, "Bucket", bucketProps);
+    const { certificate, domainNames } = resolveCertificate(this, props.domain);
+    const functionAssociations = [];
+    if (props.edge?.viewerRequest) {
+      functionAssociations.push({
+        function: props.edge.viewerRequest,
+        eventType: cloudfront2.FunctionEventType.VIEWER_REQUEST
+      });
+    }
+    if (props.edge?.viewerResponse) {
+      functionAssociations.push({
+        function: props.edge.viewerResponse,
+        eventType: cloudfront2.FunctionEventType.VIEWER_RESPONSE
+      });
+    }
+    let distributionProps = {
+      defaultBehavior: {
+        origin: origins.S3BucketOrigin.withOriginAccessControl(this.bucket),
+        viewerProtocolPolicy: cloudfront2.ViewerProtocolPolicy.REDIRECT_TO_HTTPS,
+        functionAssociations: functionAssociations.length > 0 ? functionAssociations : void 0
+      },
+      defaultRootObject: indexPage,
+      domainNames,
+      certificate,
+      errorResponses: [
+        { httpStatus: 403, responseHttpStatus: 200, responsePagePath: `/${errorPage}` },
+        { httpStatus: 404, responseHttpStatus: 200, responsePagePath: `/${errorPage}` }
+      ]
+    };
+    if (props.transform?.distribution) {
+      distributionProps = props.transform.distribution(distributionProps);
+    }
+    this.distribution = new cloudfront2.Distribution(this, "Distribution", distributionProps);
+    resolveAssetDeployment(this, "", {
+      path: props.path,
+      bucket: this.bucket,
+      fileOptions,
+      distribution: this.distribution,
+      invalidation: props.invalidation
+    });
+  }
+};
+
+// src/react-router-ssr-site-lambda.ts
+import { existsSync as existsSync2, writeFileSync as writeFileSync2 } from "fs";
+import { Construct as Construct9 } from "constructs";
+
+// src/helpers/ssr-site-lambda.ts
+import "constructs";
+import { Duration as Duration3, RemovalPolicy as RemovalPolicy3, Stack as Stack2, SymlinkFollowMode } from "aws-cdk-lib";
+import * as lambda2 from "aws-cdk-lib/aws-lambda";
+import * as s34 from "aws-cdk-lib/aws-s3";
+import * as cloudfront3 from "aws-cdk-lib/aws-cloudfront";
+import * as origins2 from "aws-cdk-lib/aws-cloudfront-origins";
+import * as iam4 from "aws-cdk-lib/aws-iam";
+
+// src/lambda-function.ts
+import { Construct as Construct7 } from "constructs";
+import { Duration as Duration2, Tags } from "aws-cdk-lib";
+import * as lambda from "aws-cdk-lib/aws-lambda";
+import * as lambdaNode from "aws-cdk-lib/aws-lambda-nodejs";
+import * as logs3 from "aws-cdk-lib/aws-logs";
+import * as iam3 from "aws-cdk-lib/aws-iam";
+var ESM_BANNER = [
+  'import { createRequire as __banner_require__ } from "module";',
+  'import { fileURLToPath as __banner_fileURLToPath__ } from "url";',
+  'import { dirname as __banner_dirname__ } from "path";',
+  "const require = __banner_require__(import.meta.url);",
+  "const __filename = __banner_fileURLToPath__(import.meta.url);",
+  "const __dirname = __banner_dirname__(__filename);"
+].join(" ");
+var LambdaFunction = class extends Construct7 {
+  function;
+  logGroup;
+  url;
+  version;
+  alias;
+  constructor(scope, id, props) {
+    super(scope, id);
+    if (props.bundle && props.code) {
+      throw new Error('Function: cannot set both "bundle" and "code" \u2014 use one or the other');
+    }
+    if (props.streaming && !props.url) {
+      throw new Error('Function: "streaming" requires "url" to be enabled');
+    }
+    const code = props.bundle ? lambda.Code.fromAsset(props.bundle) : props.code;
+    const runtime = props.runtime ?? lambda.Runtime.NODEJS_22_X;
+    const architecture = props.architecture ?? lambda.Architecture.ARM_64;
+    const memorySize = props.memory ?? 1024;
+    const timeout = props.timeout ?? Duration2.seconds(20);
+    const loggingFormat = props.logging?.format === "json" ? lambda.LoggingFormat.JSON : lambda.LoggingFormat.TEXT;
+    let logGroupProps = {
+      retention: resolveLogRetention(props.logging?.retention)
+    };
+    if (props.transform?.logGroup) {
+      logGroupProps = props.transform.logGroup(logGroupProps);
+    }
+    this.logGroup = new logs3.LogGroup(this, "LogGroup", logGroupProps);
+    const vpcConfig = resolveVpc(props.vpc);
+    if (code) {
+      let fnProps = {
+        code,
+        handler: props.handler,
+        runtime,
+        architecture,
+        memorySize,
+        timeout,
+        ephemeralStorageSize: props.storage,
+        description: props.description,
+        environment: props.environment,
+        layers: props.layers,
+        logGroup: this.logGroup,
+        loggingFormat,
+        vpc: vpcConfig.vpc,
+        vpcSubnets: vpcConfig.subnets,
+        securityGroups: vpcConfig.securityGroups
+      };
+      if (props.transform?.function) {
+        fnProps = props.transform.function(fnProps);
+      }
+      this.function = new lambda.Function(this, "Function", fnProps);
+    } else {
+      const parsed = parseHandler(props.handler);
+      const entry = resolveEntry(parsed.entry);
+      const nodejsOpts = props.nodejs ?? {};
+      const format = nodejsOpts.format ?? lambdaNode.OutputFormat.ESM;
+      const isEsm = format === lambdaNode.OutputFormat.ESM;
+      const banner = nodejsOpts.banner ?? (isEsm ? ESM_BANNER : void 0);
+      const defaultExclude = ["@aws-sdk/*"];
+      const exclude = nodejsOpts.exclude ?? defaultExclude;
+      const install = nodejsOpts.install ?? [];
+      const afterBundlingCommands = [];
+      if (nodejsOpts.copyFiles) {
+        afterBundlingCommands.push(...resolveCopyFiles(nodejsOpts.copyFiles));
+      }
+      const hasCommandHooks = afterBundlingCommands.length > 0 || props.hook?.postBuild;
+      let fnProps = {
+        entry,
+        handler: parsed.export,
+        runtime,
+        architecture,
+        memorySize,
+        timeout,
+        ephemeralStorageSize: props.storage,
+        description: props.description,
+        environment: props.environment,
+        layers: props.layers,
+        logGroup: this.logGroup,
+        loggingFormat,
+        vpc: vpcConfig.vpc,
+        vpcSubnets: vpcConfig.subnets,
+        securityGroups: vpcConfig.securityGroups,
+        bundling: {
+          minify: nodejsOpts.minify ?? true,
+          sourceMap: nodejsOpts.sourceMap ?? false,
+          format,
+          target: "es2023",
+          banner,
+          externalModules: [...exclude, ...install],
+          nodeModules: install.length > 0 ? install : void 0,
+          loader: nodejsOpts.loader,
+          esbuildArgs: nodejsOpts.esbuild,
+          commandHooks: hasCommandHooks ? {
+            beforeBundling: () => [],
+            beforeInstall: () => [],
+            afterBundling: (_inputDir, outputDir) => [
+              ...afterBundlingCommands.map((cmd) => cmd.replace("$out", outputDir)),
+              ...props.hook?.postBuild?.(outputDir) ?? []
+            ]
+          } : void 0
+        }
+      };
+      if (props.transform?.function) {
+        fnProps = props.transform.function(fnProps);
+      }
+      this.function = new lambdaNode.NodejsFunction(this, "Function", fnProps);
+    }
+    if (props.permissions) {
+      for (const perm of props.permissions) {
+        this.function.addToRolePolicy(new iam3.PolicyStatement({ actions: perm.actions, resources: perm.resources }));
+      }
+    }
+    if (props.policies) {
+      for (const arn of props.policies) {
+        this.function.role.addManagedPolicy(iam3.ManagedPolicy.fromManagedPolicyArn(this, `Policy-${arn}`, arn));
+      }
+    }
+    if (props.retries !== void 0) {
+      new lambda.EventInvokeConfig(this, "EventInvokeConfig", {
+        function: this.function,
+        retryAttempts: props.retries
+      });
+    }
+    if (props.versioning || props.concurrency?.provisioned) {
+      ;
+      this.version = this.function.currentVersion;
+    }
+    if (props.concurrency?.reserved !== void 0) {
+      const cfnFunction = this.function.node.defaultChild;
+      cfnFunction.addPropertyOverride("ReservedConcurrentExecutions", props.concurrency.reserved);
+    }
+    if (props.concurrency?.provisioned) {
+      const version = this.version ?? this.function.currentVersion;
+      const alias = new lambda.Alias(this, "Alias", {
+        aliasName: "live",
+        version,
+        provisionedConcurrentExecutions: props.concurrency.provisioned
+      });
+      this.version = version;
+      this.alias = alias;
+    }
+    if (props.tags) {
+      for (const [key, value] of Object.entries(props.tags)) {
+        Tags.of(this).add(key, value);
+      }
+    }
+    if (props.url) {
+      const urlOpts = resolveUrl(props.url);
+      this.url = this.function.addFunctionUrl({
+        authType: urlOpts.authorization === "iam" ? lambda.FunctionUrlAuthType.AWS_IAM : lambda.FunctionUrlAuthType.NONE,
+        cors: urlOpts.cors === true ? { allowedOrigins: ["*"], allowedMethods: [lambda.HttpMethod.ALL] } : urlOpts.cors,
+        invokeMode: props.streaming ? lambda.InvokeMode.RESPONSE_STREAM : void 0
+      });
+    }
+  }
+};
+function parseHandler(handler) {
+  const lastDot = handler.lastIndexOf(".");
+  if (lastDot === -1) {
+    throw new Error(
+      `Function: handler "${handler}" must contain a dot separating the file path from the export name (e.g. "src/api.handler")`
+    );
+  }
+  return {
+    entry: handler.slice(0, lastDot),
+    export: handler.slice(lastDot + 1)
+  };
+}
+function resolveEntry(filePath) {
+  const lastSlash = filePath.lastIndexOf("/");
+  const basename = lastSlash === -1 ? filePath : filePath.slice(lastSlash + 1);
+  if (basename.includes(".")) return filePath;
+  return filePath + ".ts";
+}
+function resolveVpc(vpc) {
+  if (!vpc) return {};
+  if ("vpc" in vpc) return vpc;
+  return { vpc };
+}
+function resolveUrl(url) {
+  if (url === true) return { authorization: "none" };
+  if (!url) return { authorization: "none" };
+  return {
+    authorization: url.authorization ?? "none",
+    cors: url.cors
+  };
+}
+function resolveCopyFiles(copyFiles) {
+  return copyFiles.map((f) => {
+    const dest = f.to ?? f.from;
+    return `cp -r ${f.from} $out/${dest}`;
+  });
+}
+
+// src/helpers/ssr-site-lambda.ts
+var defaultAssetBehaviors = [{ pathPattern: "/_assets/*", cachePolicy: "CACHING_OPTIMIZED" }];
+function createSsrSiteLambda(scope, props) {
+  if (props.server.nodejs && props.server.code) {
+    throw new Error("SsrSiteLambda: server.nodejs and server.code are mutually exclusive");
+  }
+  if (!props.server.code && !props.server.path) {
+    throw new Error("SsrSiteLambda: either server.code or server.path must be provided");
+  }
+  const useBundling = !!props.server.nodejs;
+  const assetBehaviors = props.assets?.behaviors ?? defaultAssetBehaviors;
+  const handler = props.server.handler ?? "index.handler";
+  const serverCode = useBundling ? void 0 : props.server.code ?? lambda2.Code.fromAsset(props.server.path, { followSymlinks: SymlinkFollowMode.ALWAYS });
+  const fn = new LambdaFunction(scope, "Server", {
+    code: serverCode,
+    handler: useBundling ? resolveBundlingHandler(handler, props.server.path) : handler,
+    nodejs: useBundling ? props.server.nodejs : void 0,
+    runtime: props.server.runtime ?? lambda2.Runtime.NODEJS_22_X,
+    memory: props.server.memory ?? 1024,
+    timeout: props.server.timeout ?? Duration3.seconds(30),
+    architecture: props.server.architecture ?? lambda2.Architecture.ARM_64,
+    environment: props.environment,
+    vpc: props.vpc,
+    permissions: props.permissions,
+    layers: props.server.layers,
+    streaming: props.streaming,
+    url: { authorization: "iam" },
+    transform: props.transform?.lambda ? { function: props.transform.lambda } : void 0
+  });
+  const fnResource = fn.function;
+  const functionUrl = fn.url;
+  let bucketProps = {
+    blockPublicAccess: s34.BlockPublicAccess.BLOCK_ALL,
+    removalPolicy: RemovalPolicy3.RETAIN
+  };
+  if (props.transform?.bucket) {
+    bucketProps = props.transform.bucket(bucketProps);
+  }
+  const bucket = new s34.Bucket(scope, "Bucket", bucketProps);
+  const cfFunction = props.edge?.viewerRequest ?? createViewerRequestFunction(scope, "ViewerRequestFn");
+  const defaultFunctionAssociations = [
+    { function: cfFunction, eventType: cloudfront3.FunctionEventType.VIEWER_REQUEST }
+  ];
+  if (props.edge?.viewerResponse) {
+    defaultFunctionAssociations.push({
+      function: props.edge.viewerResponse,
+      eventType: cloudfront3.FunctionEventType.VIEWER_RESPONSE
+    });
+  }
+  const { certificate, domainNames } = resolveCertificate(scope, props.domain);
+  const s3Origin = origins2.S3BucketOrigin.withOriginAccessControl(bucket);
+  const lambdaOrigin = origins2.FunctionUrlOrigin.withOriginAccessControl(functionUrl);
+  const additionalBehaviors = resolveAdditionalBehaviors(s3Origin, assetBehaviors);
+  let distributionProps = {
+    defaultBehavior: {
+      origin: lambdaOrigin,
+      viewerProtocolPolicy: cloudfront3.ViewerProtocolPolicy.REDIRECT_TO_HTTPS,
+      cachePolicy: cloudfront3.CachePolicy.CACHING_DISABLED,
+      originRequestPolicy: cloudfront3.OriginRequestPolicy.ALL_VIEWER_EXCEPT_HOST_HEADER,
+      allowedMethods: cloudfront3.AllowedMethods.ALLOW_ALL,
+      functionAssociations: defaultFunctionAssociations
+    },
+    additionalBehaviors,
+    domainNames,
+    certificate
+  };
+  if (props.transform?.distribution) {
+    distributionProps = props.transform.distribution(distributionProps);
+  }
+  const distribution = new cloudfront3.Distribution(scope, "Distribution", distributionProps);
+  fnResource.addPermission("CloudFrontInvokeFunction", {
+    principal: new iam4.ServicePrincipal("cloudfront.amazonaws.com"),
+    action: "lambda:InvokeFunction",
+    sourceArn: `arn:aws:cloudfront::${Stack2.of(scope).account}:distribution/${distribution.distributionId}`
+  });
+  bucket.grantRead(fnResource);
+  if (props.assets?.path) {
+    const fileOptions = props.assets.fileOptions ?? [{ files: "**", cacheControl: "max-age=31536000,public,immutable" }];
+    resolveAssetDeployment(scope, "", {
+      path: props.assets.path,
+      bucket,
+      prefix: props.assets.prefix,
+      fileOptions,
+      distribution,
+      invalidation: props.invalidation
+    });
+  }
+  return { lambda: fnResource, functionUrl, bucket, distribution };
+}
+function resolveBundlingHandler(handler, serverPath) {
+  const lastDot = handler.lastIndexOf(".");
+  if (lastDot === -1) return `${serverPath}/${handler}`;
+  const file = handler.slice(0, lastDot);
+  const exportName = handler.slice(lastDot + 1);
+  return `${serverPath}/${file}.js.${exportName}`;
+}
+
+// src/react-router-ssr-site-lambda.ts
+var ReactRouterSsrSiteLambda = class extends Construct9 {
+  lambda;
+  functionUrl;
+  bucket;
+  distribution;
+  constructor(scope, id, props) {
+    super(scope, id);
+    const basePath = !props.path || props.path === "." ? props.buildDirectory ?? "build" : `${props.path}/${props.buildDirectory ?? "build"}`;
+    const serverBuild = `${basePath}/server/index.js`;
+    if (!existsSync2(serverBuild)) {
+      throw new Error(`ReactRouterSsrSiteLambda: "${serverBuild}" not found. Run "react-router build" before deploying.`);
+    }
+    const mode = props.server?.mode ?? "streaming";
+    const handlerSource = buildHandlerSource("./server/index.js", mode);
+    writeFileSync2(`${basePath}/_lambda-handler.js`, handlerSource);
+    const external = props.server?.external ?? [];
+    const merged = {
+      streaming: mode === "streaming",
+      environment: props.environment,
+      vpc: props.vpc,
+      permissions: props.permissions,
+      domain: props.domain,
+      edge: props.edge,
+      invalidation: props.invalidation,
+      transform: props.transform,
+      server: {
+        path: basePath,
+        handler: "_lambda-handler.handler",
+        runtime: props.server?.runtime,
+        memory: props.server?.memory,
+        timeout: props.server?.timeout,
+        architecture: props.server?.architecture,
+        layers: props.server?.layers,
+        nodejs: {
+          install: props.server?.install,
+          exclude: ["@aws-sdk/*", ...external]
+        }
+      },
+      assets: {
+        ...props.assets,
+        path: props.assets?.path ?? `${basePath}/client`,
+        behaviors: props.assets?.behaviors ?? [{ pathPattern: "/assets/*", cachePolicy: "CACHING_OPTIMIZED" }],
+        fileOptions: props.assets?.fileOptions ?? [{ files: "**", cacheControl: "max-age=31536000,public,immutable" }]
+      }
+    };
+    const resources = createSsrSiteLambda(this, merged);
+    this.lambda = resources.lambda;
+    this.functionUrl = resources.functionUrl;
+    this.bucket = resources.bucket;
+    this.distribution = resources.distribution;
+  }
+};
+function buildHandlerSource(serverBuildPath, mode) {
+  const shared = `
+import { createRequestHandler } from 'react-router'
+import * as build from '${serverBuildPath}'
+
+const handleRequest = createRequestHandler(build, process.env.NODE_ENV)
+
+function createRequest(event) {
+  var host = event.headers['x-forwarded-host'] || event.headers.host
+  var search = event.rawQueryString.length ? '?' + event.rawQueryString : ''
+  var scheme = event.headers['x-forwarded-proto'] || 'http'
+  var url = new URL(event.rawPath + search, scheme + '://' + host)
+  var isFormData = event.headers['content-type']?.includes('multipart/form-data')
+
+  return new Request(url.href, {
+    method: event.requestContext.http.method,
+    headers: createHeaders(event.headers, event.cookies),
+    signal: new AbortController().signal,
+    body:
+      event.body && event.isBase64Encoded
+        ? isFormData
+          ? Buffer.from(event.body, 'base64')
+          : Buffer.from(event.body, 'base64').toString()
+        : event.body
+  })
+}
+
+function createHeaders(requestHeaders, requestCookies) {
+  var headers = new Headers()
+  for (var [header, value] of Object.entries(requestHeaders)) {
+    if (value) {
+      headers.append(header, value)
+    }
+  }
+  if (requestCookies) {
+    headers.append('Cookie', requestCookies.join('; '))
+  }
+  return headers
+}
+`;
+  if (mode === "streaming") {
+    return shared + `
+async function writeReadableStreamToWritable(readableStream, writable) {
+  var reader = readableStream.getReader()
+  try {
+    while (true) {
+      var { done, value } = await reader.read()
+      if (done) break
+      writable.write(value)
+    }
+  } finally {
+    reader.releaseLock()
+    writable.end()
+  }
+}
+
+async function sendResponse(response, responseStream) {
+  var cookies = response.headers.getSetCookie()
+  if (cookies.length) {
+    response.headers.delete('Set-Cookie')
+  }
+
+  var metadata = {
+    statusCode: response.status,
+    headers: Object.fromEntries(response.headers.entries()),
+    cookies: cookies
+  }
+
+  var body =
+    response.body ??
+    new ReadableStream({
+      start(controller) {
+        controller.enqueue(new Uint8Array(0))
+        controller.close()
+      }
+    })
+
+  var httpResponseStream = awslambda.HttpResponseStream.from(responseStream, metadata)
+  await writeReadableStreamToWritable(body, httpResponseStream)
+}
+
+export var handler = awslambda.streamifyResponse(async function(event, responseStream) {
+  var request
+  try {
+    request = createRequest(event)
+  } catch (e) {
+    return await sendResponse(
+      new Response('Bad Request: ' + (e instanceof Error ? e.message : e), { status: 400 }),
+      responseStream
+    )
+  }
+
+  var response = await handleRequest(request)
+  return await sendResponse(response, responseStream)
+})
+`;
+  }
+  return shared + `
+async function buildBufferedResponse(response) {
+  var cookies = response.headers.getSetCookie()
+  if (cookies.length) {
+    response.headers.delete('Set-Cookie')
+  }
+
+  var contentType = response.headers.get('Content-Type')
+  var isBinary = contentType && !contentType.startsWith('text/') && !contentType.includes('json')
+
+  var body
+  var isBase64Encoded = false
+
+  if (isBinary) {
+    var arrayBuffer = await response.arrayBuffer()
+    body = Buffer.from(arrayBuffer).toString('base64')
+    isBase64Encoded = true
+  } else {
+    body = await response.text()
+  }
+
+  return {
+    statusCode: response.status,
+    headers: Object.fromEntries(response.headers.entries()),
+    cookies: cookies,
+    body: body,
+    isBase64Encoded: isBase64Encoded
+  }
+}
+
+export async function handler(event) {
+  var request
+  try {
+    request = createRequest(event)
+  } catch (e) {
+    return buildBufferedResponse(
+      new Response('Bad Request: ' + (e instanceof Error ? e.message : e), { status: 400 })
+    )
+  }
+
+  var response = await handleRequest(request)
+  return buildBufferedResponse(response)
+}
+`;
+}
+
+// src/react-router-ssr-site-ecs-fargate-service.ts
+import { Construct as Construct12 } from "constructs";
+
+// src/helpers/ssr-site-ecs-service.ts
+import "constructs";
+import { RemovalPolicy as RemovalPolicy4 } from "aws-cdk-lib";
+import * as s35 from "aws-cdk-lib/aws-s3";
+import * as cloudfront4 from "aws-cdk-lib/aws-cloudfront";
+import * as origins3 from "aws-cdk-lib/aws-cloudfront-origins";
+import * as iam6 from "aws-cdk-lib/aws-iam";
+
+// src/ecs-fargate-service.ts
+import { Construct as Construct10 } from "constructs";
+import { Duration as Duration4 } from "aws-cdk-lib";
+import * as ec22 from "aws-cdk-lib/aws-ec2";
+import * as ecs3 from "aws-cdk-lib/aws-ecs";
+import * as ecrAssets from "aws-cdk-lib/aws-ecr-assets";
+import * as elbv2 from "aws-cdk-lib/aws-elasticloadbalancingv2";
+import * as logs4 from "aws-cdk-lib/aws-logs";
+import * as iam5 from "aws-cdk-lib/aws-iam";
+import * as acm2 from "aws-cdk-lib/aws-certificatemanager";
+var EcsFargateService = class extends Construct10 {
+  service;
+  taskDefinition;
+  containers;
+  logGroups;
+  securityGroup;
+  alb;
+  listener;
+  targetGroups;
+  constructor(scope, id, props) {
+    super(scope, id);
+    if (!props.containers.length) {
+      throw new Error("At least one container is required");
+    }
+    const cpu = props.cpu ?? 256;
+    const memoryLimitMiB = props.memoryLimitMiB ?? 512;
+    const arch = props.architecture ?? "X86_64";
+    const cpuArchitecture = arch === "ARM64" ? ecs3.CpuArchitecture.ARM64 : ecs3.CpuArchitecture.X86_64;
+    const platform = arch === "ARM64" ? ecrAssets.Platform.LINUX_ARM64 : ecrAssets.Platform.LINUX_AMD64;
+    let executionRoleProps = {
+      assumedBy: new iam5.ServicePrincipal("ecs-tasks.amazonaws.com"),
+      managedPolicies: [iam5.ManagedPolicy.fromAwsManagedPolicyName("service-role/AmazonECSTaskExecutionRolePolicy")]
+    };
+    if (props.transform?.executionRole) {
+      executionRoleProps = props.transform.executionRole(executionRoleProps);
+    }
+    const executionRole = new iam5.Role(this, "ExecutionRole", executionRoleProps);
+    let taskRoleProps = {
+      assumedBy: new iam5.ServicePrincipal("ecs-tasks.amazonaws.com")
+    };
+    if (props.transform?.taskRole) {
+      taskRoleProps = props.transform.taskRole(taskRoleProps);
+    }
+    const taskRole = new iam5.Role(this, "TaskRole", taskRoleProps);
+    let taskDefProps = {
+      cpu,
+      memoryLimitMiB,
+      executionRole,
+      taskRole,
+      runtimePlatform: {
+        cpuArchitecture,
+        operatingSystemFamily: ecs3.OperatingSystemFamily.LINUX
+      }
+    };
+    if (props.transform?.taskDefinition) {
+      taskDefProps = props.transform.taskDefinition(taskDefProps);
+    }
+    this.taskDefinition = new ecs3.FargateTaskDefinition(this, "TaskDefinition", taskDefProps);
+    if (props.permissions) {
+      for (const perm of props.permissions) {
+        this.taskDefinition.taskRole.addToPrincipalPolicy(
+          new iam5.PolicyStatement({
+            actions: perm.actions,
+            resources: perm.resources,
+            effect: perm.effect === "deny" ? iam5.Effect.DENY : iam5.Effect.ALLOW,
+            conditions: perm.conditions
+          })
+        );
+      }
+    }
+    this.containers = {};
+    this.logGroups = {};
+    for (const c of props.containers) {
+      const name = resolveContainerName(c, props.containers);
+      if (!name) {
+        throw new Error("All containers must have a name when multiple containers are defined");
+      }
+      const containerImage = resolveImage(this, c.image, platform, name);
+      const resolvedSecrets = resolveSecrets(this, c.ssm, c.secrets, `${name}`);
+      let logGroupProps = {
+        retention: resolveLogRetention(c.logging?.retention)
+      };
+      if (props.transform?.logGroup) {
+        logGroupProps = props.transform.logGroup(logGroupProps);
+      }
+      const logGroup = new logs4.LogGroup(this, `${name}LogGroup`, logGroupProps);
+      this.logGroups[name] = logGroup;
+      let containerProps = {
+        image: containerImage,
+        logging: ecs3.LogDrivers.awsLogs({ streamPrefix: `${id}-${name}`, logGroup }),
+        environment: c.environment,
+        secrets: resolvedSecrets,
+        command: c.command,
+        entryPoint: c.entrypoint,
+        portMappings: c.port ? [{ containerPort: c.port }] : void 0,
+        cpu: c.cpu,
+        memoryLimitMiB: c.memory,
+        healthCheck: c.health ? {
+          command: c.health.command,
+          interval: c.health.interval ? Duration4.seconds(c.health.interval) : void 0,
+          timeout: c.health.timeout ? Duration4.seconds(c.health.timeout) : void 0,
+          retries: c.health.retries,
+          startPeriod: c.health.startPeriod ? Duration4.seconds(c.health.startPeriod) : void 0
+        } : void 0
+      };
+      if (props.transform?.container) {
+        containerProps = props.transform.container(containerProps);
+      }
+      this.containers[name] = this.taskDefinition.addContainer(name, containerProps);
+    }
+    this.securityGroup = new ec22.SecurityGroup(this, "ServiceSecurityGroup", {
+      vpc: props.cluster.vpc,
+      description: `ECS Service SG for ${id}`,
+      allowAllOutbound: true
+    });
+    if (props.loadBalancer) {
+      const lb = props.loadBalancer;
+      const isPublic = lb.public !== false;
+      const rules = lb.rules ?? autoRules(props.containers, !!lb.domain);
+      const resolvedRules = rules.map((rule) => ({
+        ...rule,
+        container: rule.container ? rule.container : resolveDefaultContainerName(props.containers)
+      }));
+      for (const rule of resolvedRules) {
+        if (!rule.redirect && !this.containers[rule.container]) {
+          throw new Error(`Routing rule references unknown container '${rule.container}'`);
+        }
+      }
+      let albSgProps = {
+        vpc: props.cluster.vpc,
+        description: `ALB SG for ${id}`,
+        allowAllOutbound: true
+      };
+      if (props.transform?.albSecurityGroup) {
+        albSgProps = props.transform.albSecurityGroup(albSgProps);
+      }
+      const albSg = new ec22.SecurityGroup(this, "AlbSecurityGroup", albSgProps);
+      let albProps = {
+        vpc: props.cluster.vpc,
+        internetFacing: isPublic,
+        securityGroup: albSg
+      };
+      if (props.transform?.alb) {
+        albProps = props.transform.alb(albProps);
+      }
+      this.alb = new elbv2.ApplicationLoadBalancer(this, "Alb", albProps);
+      const tgMap = {};
+      for (const rule of resolvedRules) {
+        if (rule.redirect) continue;
+        const forwardPort = resolveForwardPort(rule, props.containers);
+        const tgKey = `${rule.container}:${forwardPort}`;
+        if (tgMap[tgKey]) continue;
+        const health = lb.health;
+        let targetGroupProps = {
+          vpc: props.cluster.vpc,
+          port: forwardPort,
+          protocol: elbv2.ApplicationProtocol.HTTP,
+          targetType: elbv2.TargetType.IP,
+          deregistrationDelay: Duration4.seconds(30),
+          ...health ? {
+            healthCheck: {
+              path: health.path ?? "/health",
+              interval: health.interval ? Duration4.seconds(health.interval) : void 0,
+              timeout: health.timeout ? Duration4.seconds(health.timeout) : void 0,
+              healthyThresholdCount: health.healthyThreshold,
+              unhealthyThresholdCount: health.unhealthyThreshold,
+              healthyHttpCodes: health.successCodes
+            }
+          } : {}
+        };
+        if (props.transform?.targetGroup) {
+          targetGroupProps = props.transform.targetGroup(targetGroupProps);
+        }
+        tgMap[tgKey] = new elbv2.ApplicationTargetGroup(this, `${rule.container}Port${forwardPort}Tg`, targetGroupProps);
+      }
+      this.targetGroups = tgMap;
+      const listenerGroups = /* @__PURE__ */ new Map();
+      for (const rule of resolvedRules) {
+        const { port, protocol } = parsePortProtocol(rule.listen);
+        if (!listenerGroups.has(port)) {
+          listenerGroups.set(port, { protocol, rules: [] });
+        }
+        listenerGroups.get(port).rules.push(rule);
+      }
+      const certificate = lb.domain ? acm2.Certificate.fromCertificateArn(this, "Certificate", lb.domain.certificateArn) : void 0;
+      let primaryListener;
+      for (const [listenPort, group] of listenerGroups) {
+        const isHttps = group.protocol === "https";
+        const defaultRedirect = group.rules.find((r) => r.redirect && !r.conditions);
+        const defaultForward = group.rules.find((r) => !r.redirect && !r.conditions);
+        const conditionalForwards = group.rules.filter((r) => !r.redirect && !!r.conditions);
+        let listener;
+        if (defaultRedirect) {
+          const target = parsePortProtocol(defaultRedirect.redirect);
+          let listenerProps = {
+            port: listenPort,
+            defaultAction: elbv2.ListenerAction.redirect({
+              protocol: target.protocol.toUpperCase(),
+              port: String(target.port),
+              permanent: true
+            })
+          };
+          if (props.transform?.listener) {
+            listenerProps = props.transform.listener(listenerProps);
+          }
+          listener = this.alb.addListener(`Listener${listenPort}`, listenerProps);
+        } else if (defaultForward) {
+          const forwardPort = resolveForwardPort(defaultForward, props.containers);
+          const tgKey = `${defaultForward.container}:${forwardPort}`;
+          let listenerProps = {
+            port: listenPort,
+            ...isHttps && certificate ? { certificates: [certificate] } : {},
+            defaultTargetGroups: [tgMap[tgKey]]
+          };
+          if (props.transform?.listener) {
+            listenerProps = props.transform.listener(listenerProps);
+          }
+          listener = this.alb.addListener(`Listener${listenPort}`, listenerProps);
+        } else {
+          throw new Error(`Listener on port ${listenPort} has no default rule (a rule without conditions is required)`);
+        }
+        if (!primaryListener && !defaultRedirect) {
+          primaryListener = listener;
+        }
+        let autoPriority = 1;
+        for (const rule of conditionalForwards) {
+          const forwardPort = resolveForwardPort(rule, props.containers);
+          const tgKey = `${rule.container}:${forwardPort}`;
+          const priority = autoPriority++;
+          const conditions = [];
+          if (rule.conditions.path) {
+            conditions.push(elbv2.ListenerCondition.pathPatterns([rule.conditions.path]));
+          }
+          if (rule.conditions.header) {
+            conditions.push(elbv2.ListenerCondition.httpHeader(rule.conditions.header.name, rule.conditions.header.values));
+          }
+          if (rule.conditions.query) {
+            conditions.push(elbv2.ListenerCondition.queryStrings(rule.conditions.query));
+          }
+          new elbv2.ApplicationListenerRule(this, `Listener${listenPort}Rule${priority}`, {
+            listener,
+            priority,
+            conditions,
+            targetGroups: [tgMap[tgKey]]
+          });
+        }
+        albSg.addIngressRule(ec22.Peer.anyIpv4(), ec22.Port.tcp(listenPort), `Port ${listenPort}`);
+      }
+      this.listener = primaryListener;
+      const forwardPorts = /* @__PURE__ */ new Set();
+      for (const rule of resolvedRules) {
+        if (rule.redirect) continue;
+        forwardPorts.add(resolveForwardPort(rule, props.containers));
+      }
+      for (const port of forwardPorts) {
+        this.securityGroup.addIngressRule(albSg, ec22.Port.tcp(port), `From ALB on port ${port}`);
+      }
+    }
+    const capacityProviderStrategies = resolveCapacity(props.capacity);
+    const desiredCount = props.scaling?.min ?? 1;
+    let serviceProps = {
+      cluster: props.cluster,
+      taskDefinition: this.taskDefinition,
+      desiredCount,
+      securityGroups: [this.securityGroup],
+      vpcSubnets: { subnetType: ec22.SubnetType.PRIVATE_WITH_EGRESS },
+      assignPublicIp: false,
+      circuitBreaker: { rollback: true },
+      ...capacityProviderStrategies ? { capacityProviderStrategies } : {}
+    };
+    if (props.transform?.service) {
+      serviceProps = props.transform.service(serviceProps);
+    }
+    this.service = new ecs3.FargateService(this, "Service", serviceProps);
+    if (this.targetGroups) {
+      for (const tg of Object.values(this.targetGroups)) {
+        this.service.attachToApplicationTargetGroup(tg);
+      }
+    }
+    if (props.scaling) {
+      let autoScalingProps = {
+        minCapacity: props.scaling.min ?? 1,
+        maxCapacity: props.scaling.max ?? 4
+      };
+      if (props.transform?.autoScalingTarget) {
+        autoScalingProps = props.transform.autoScalingTarget(autoScalingProps);
+      }
+      const scaling = this.service.autoScaleTaskCount(autoScalingProps);
+      scaling.scaleOnCpuUtilization("CpuScaling", {
+        targetUtilizationPercent: props.scaling.cpuTarget ?? 70,
+        scaleInCooldown: props.scaling.scaleInCooldown ? Duration4.seconds(props.scaling.scaleInCooldown) : void 0,
+        scaleOutCooldown: props.scaling.scaleOutCooldown ? Duration4.seconds(props.scaling.scaleOutCooldown) : void 0
+      });
+      if (props.scaling.memoryTarget) {
+        scaling.scaleOnMemoryUtilization("MemoryScaling", {
+          targetUtilizationPercent: props.scaling.memoryTarget,
+          scaleInCooldown: props.scaling.scaleInCooldown ? Duration4.seconds(props.scaling.scaleInCooldown) : void 0,
+          scaleOutCooldown: props.scaling.scaleOutCooldown ? Duration4.seconds(props.scaling.scaleOutCooldown) : void 0
+        });
+      }
+      if (props.scaling.requestsPerTarget && this.targetGroups) {
+        const targetGroup = Object.values(this.targetGroups)[0];
+        scaling.scaleOnRequestCount("RequestScaling", {
+          requestsPerTarget: props.scaling.requestsPerTarget,
+          targetGroup,
+          scaleInCooldown: props.scaling.scaleInCooldown ? Duration4.seconds(props.scaling.scaleInCooldown) : void 0,
+          scaleOutCooldown: props.scaling.scaleOutCooldown ? Duration4.seconds(props.scaling.scaleOutCooldown) : void 0
+        });
+      }
+    }
+  }
+};
+function resolveContainerName(c, containers) {
+  return c.name ?? (containers.length === 1 ? "Container" : void 0);
+}
+function parsePortProtocol(value) {
+  const parts = value.split("/");
+  return { port: Number(parts[0]), protocol: parts[1] ?? "http" };
+}
+function resolveDefaultContainerName(containers) {
+  if (containers.length === 1) return resolveContainerName(containers[0], containers);
+  throw new Error("container is required in routing rules when multiple containers are defined");
+}
+function resolveForwardPort(rule, containers) {
+  if (rule.forward !== void 0) return rule.forward;
+  const container = containers.find((c) => {
+    return resolveContainerName(c, containers) === rule.container;
+  });
+  if (!container?.port) {
+    throw new Error(`Container '${rule.container}' has no port and no forward specified in rule`);
+  }
+  return container.port;
+}
+function autoRules(containers, hasDomain) {
+  const withPorts = containers.filter((c) => c.port);
+  if (withPorts.length === 0) {
+    throw new Error("No container with a port found for load balancer");
+  }
+  if (withPorts.length > 1) {
+    throw new Error(
+      "Multiple containers have ports but no routing rules are defined. Add loadBalancer.rules to specify routing."
+    );
+  }
+  const name = resolveContainerName(withPorts[0], containers);
+  if (hasDomain) {
+    return [
+      { listen: "443/https", container: name },
+      { listen: "80/http", redirect: "443/https" }
+    ];
+  }
+  return [{ listen: "80/http", container: name }];
+}
+function resolveImage(scope, image, platform, id) {
+  if (image === void 0) {
+    return ecs3.ContainerImage.fromAsset(".", { platform });
+  }
+  if (typeof image === "string") {
+    return ecs3.ContainerImage.fromRegistry(image);
+  }
+  if (image instanceof ecrAssets.DockerImageAsset) {
+    return ecs3.ContainerImage.fromDockerImageAsset(image);
+  }
+  return ecs3.ContainerImage.fromAsset(image.context ?? ".", {
+    platform,
+    file: image.dockerfile,
+    buildArgs: image.args,
+    target: image.target,
+    exclude: image.exclude
+  });
+}
+function resolveCapacity(capacity) {
+  if (!capacity) return void 0;
+  if (capacity === "spot") {
+    return [{ capacityProvider: "FARGATE_SPOT", weight: 1 }];
+  }
+  const strategies = [];
+  if (capacity.fargate) {
+    strategies.push({
+      capacityProvider: "FARGATE",
+      weight: capacity.fargate.weight,
+      base: capacity.fargate.base
+    });
+  }
+  if (capacity.spot) {
+    strategies.push({
+      capacityProvider: "FARGATE_SPOT",
+      weight: capacity.spot.weight,
+      base: capacity.spot.base
+    });
+  }
+  return strategies.length > 0 ? strategies : void 0;
+}
+
+// src/helpers/ssr-site-ecs-service.ts
+function createSsrSiteEcsService(scope, props) {
+  const assetBehaviors = props.assets?.behaviors ?? [];
+  let bucketProps = {
+    blockPublicAccess: s35.BlockPublicAccess.BLOCK_ALL,
+    removalPolicy: RemovalPolicy4.RETAIN
+  };
+  if (props.transform?.bucket) {
+    bucketProps = props.transform.bucket(bucketProps);
+  }
+  const bucket = new s35.Bucket(scope, "Bucket", bucketProps);
+  const ecsService = new EcsFargateService(scope, "Ecs", {
+    cluster: props.cluster,
+    architecture: props.architecture,
+    cpu: props.cpu,
+    memoryLimitMiB: props.memoryLimitMiB,
+    capacity: props.capacity,
+    containers: [
+      {
+        image: props.image,
+        port: props.port ?? 3e3,
+        command: props.command,
+        entrypoint: props.entrypoint,
+        environment: props.environment,
+        ssm: props.ssm,
+        secrets: props.secrets
+      }
+    ],
+    loadBalancer: {
+      public: true,
+      health: props.healthCheck
+    },
+    scaling: props.scaling,
+    permissions: props.permissions,
+    transform: {
+      executionRole: props.transform?.executionRole,
+      taskRole: props.transform?.taskRole,
+      taskDefinition: props.transform?.taskDefinition,
+      container: props.transform?.container,
+      service: props.transform?.service,
+      autoScalingTarget: props.transform?.autoScalingTarget,
+      alb: props.transform?.alb,
+      albSecurityGroup: props.transform?.albSecurityGroup,
+      listener: props.transform?.listener,
+      targetGroup: props.transform?.targetGroup,
+      logGroup: props.transform?.logGroup
+    }
+  });
+  const alb = ecsService.alb;
+  const cfFunction = props.edge?.viewerRequest ?? createViewerRequestFunction(scope, "ViewerRequestFn");
+  const defaultFunctionAssociations = [
+    { function: cfFunction, eventType: cloudfront4.FunctionEventType.VIEWER_REQUEST }
+  ];
+  if (props.edge?.viewerResponse) {
+    defaultFunctionAssociations.push({
+      function: props.edge.viewerResponse,
+      eventType: cloudfront4.FunctionEventType.VIEWER_RESPONSE
+    });
+  }
+  const { certificate, domainNames } = resolveCertificate(scope, props.domain);
+  const s3Origin = origins3.S3BucketOrigin.withOriginAccessControl(bucket);
+  const albOrigin = new origins3.HttpOrigin(alb.loadBalancerDnsName, {
+    protocolPolicy: cloudfront4.OriginProtocolPolicy.HTTP_ONLY
+  });
+  const additionalBehaviors = resolveAdditionalBehaviors(s3Origin, assetBehaviors);
+  let distributionProps = {
+    defaultBehavior: {
+      origin: albOrigin,
+      viewerProtocolPolicy: cloudfront4.ViewerProtocolPolicy.REDIRECT_TO_HTTPS,
+      cachePolicy: cloudfront4.CachePolicy.CACHING_DISABLED,
+      originRequestPolicy: cloudfront4.OriginRequestPolicy.ALL_VIEWER_EXCEPT_HOST_HEADER,
+      allowedMethods: cloudfront4.AllowedMethods.ALLOW_ALL,
+      functionAssociations: defaultFunctionAssociations
+    },
+    additionalBehaviors,
+    domainNames,
+    certificate
+  };
+  if (props.transform?.distribution) {
+    distributionProps = props.transform.distribution(distributionProps);
+  }
+  const distribution = new cloudfront4.Distribution(scope, "Distribution", distributionProps);
+  bucket.grantReadWrite(ecsService.taskDefinition.taskRole);
+  ecsService.taskDefinition.taskRole.addToPrincipalPolicy(
+    new iam6.PolicyStatement({
+      actions: ["cloudfront:CreateInvalidation"],
+      resources: [`arn:aws:cloudfront::*:distribution/${distribution.distributionId}`]
+    })
+  );
+  ecsService.containers["Container"].addEnvironment("CLOUDFRONT_DISTRIBUTION_ID", distribution.distributionId);
+  ecsService.containers["Container"].addEnvironment("S3_BUCKET_NAME", bucket.bucketName);
+  if (props.assets?.path) {
+    const fileOptions = props.assets.fileOptions ?? [{ files: "**", cacheControl: "max-age=31536000,public,immutable" }];
+    resolveAssetDeployment(scope, "", {
+      path: props.assets.path,
+      bucket,
+      prefix: props.assets.prefix,
+      fileOptions,
+      distribution,
+      invalidation: props.invalidation
+    });
+  }
+  return { bucket, distribution, ecsService };
+}
+
+// src/react-router-ssr-site-ecs-fargate-service.ts
+var ReactRouterSsrSiteEcsFargateService = class extends Construct12 {
+  bucket;
+  distribution;
+  ecsService;
+  constructor(scope, id, props) {
+    super(scope, id);
+    const buildDir = props.buildDirectory ?? "build";
+    const appRoot = !props.path || props.path === "." ? "." : props.path;
+    const basePath = appRoot === "." ? buildDir : `${appRoot}/${buildDir}`;
+    const port = props.port ?? 3e3;
+    let image = props.image;
+    if (!image) {
+      image = resolveReactRouterDockerContext({
+        appRoot,
+        buildDir,
+        basePath,
+        port,
+        className: "ReactRouterSsrSiteEcsFargateService"
+      });
+    }
+    const merged = {
+      cluster: props.cluster,
+      image,
+      port,
+      command: props.command,
+      entrypoint: props.entrypoint,
+      environment: props.environment,
+      ssm: props.ssm,
+      secrets: props.secrets,
+      architecture: props.architecture,
+      cpu: props.cpu,
+      memoryLimitMiB: props.memoryLimitMiB,
+      capacity: props.capacity,
+      healthCheck: props.healthCheck,
+      scaling: props.scaling,
+      permissions: props.permissions,
+      domain: props.domain,
+      edge: props.edge,
+      invalidation: props.invalidation,
+      transform: props.transform,
+      assets: {
+        ...props.assets,
+        path: props.assets?.path ?? `${basePath}/client`,
+        behaviors: props.assets?.behaviors ?? [{ pathPattern: "/assets/*", cachePolicy: "CACHING_OPTIMIZED" }],
+        fileOptions: props.assets?.fileOptions ?? [{ files: "**", cacheControl: "max-age=31536000,public,immutable" }]
+      }
+    };
+    const resources = createSsrSiteEcsService(this, merged);
+    this.bucket = resources.bucket;
+    this.distribution = resources.distribution;
+    this.ecsService = resources.ecsService;
+  }
+};
+
+// src/react-router-ecr-image.ts
+import { Construct as Construct13 } from "constructs";
+import * as ecrAssets2 from "aws-cdk-lib/aws-ecr-assets";
+var ReactRouterEcrImage = class extends Construct13 {
+  asset;
+  constructor(scope, id, props = {}) {
+    super(scope, id);
+    const buildDir = props.buildDirectory ?? "build";
+    const appRoot = !props.path || props.path === "." ? "." : props.path;
+    const basePath = appRoot === "." ? buildDir : `${appRoot}/${buildDir}`;
+    const port = props.port ?? 3e3;
+    const arch = props.architecture ?? "X86_64";
+    const platform = props.platform ?? (arch === "ARM64" ? ecrAssets2.Platform.LINUX_ARM64 : ecrAssets2.Platform.LINUX_AMD64);
+    let context;
+    let dockerfile;
+    if (props.image) {
+      context = props.image.context ?? appRoot;
+      dockerfile = props.image.dockerfile;
+    } else {
+      const resolved = resolveReactRouterDockerContext({
+        appRoot,
+        buildDir,
+        basePath,
+        port,
+        className: "ReactRouterEcrImage"
+      });
+      context = resolved.context;
+      dockerfile = resolved.dockerfile;
+    }
+    this.asset = new ecrAssets2.DockerImageAsset(this, "Image", {
+      directory: context,
+      file: dockerfile,
+      platform,
+      buildArgs: props.image?.args,
+      target: props.image?.target,
+      exclude: props.image?.exclude
+    });
+  }
+};
+
+// src/mysql-database.ts
+import { Construct as Construct14 } from "constructs";
+import { Duration as Duration5, RemovalPolicy as RemovalPolicy5 } from "aws-cdk-lib";
+import * as ec23 from "aws-cdk-lib/aws-ec2";
+import * as rds from "aws-cdk-lib/aws-rds";
+var MySqlDatabase = class extends Construct14 {
+  instance;
+  securityGroup;
+  secret;
+  connections;
+  rdsProxy;
+  get host() {
+    return this.instance.dbInstanceEndpointAddress;
+  }
+  get port() {
+    return this.instance.dbInstanceEndpointPort;
+  }
+  get proxyEndpoint() {
+    return this.rdsProxy?.endpoint;
+  }
+  constructor(scope, id, props) {
+    super(scope, id);
+    const username = props.username ?? "root";
+    let instanceProps = {
+      engine: rds.DatabaseInstanceEngine.mysql({
+        version: props.version ?? rds.MysqlEngineVersion.VER_8_0
+      }),
+      instanceType: props.instance ?? ec23.InstanceType.of(ec23.InstanceClass.T3, ec23.InstanceSize.MICRO),
+      vpc: props.vpc,
+      vpcSubnets: { subnetType: resolvePrivateSubnetType(props.vpc) },
+      databaseName: props.database,
+      credentials: rds.Credentials.fromGeneratedSecret(username),
+      maxAllocatedStorage: props.storage ? Math.max(props.storage, 5e3) : 5e3,
+      allocatedStorage: props.storage ?? 20,
+      multiAz: props.multiAz ?? false,
+      backupRetention: Duration5.days(props.backupRetentionDays ?? 7),
+      deletionProtection: props.deletionProtection ?? true,
+      removalPolicy: RemovalPolicy5.SNAPSHOT,
+      storageEncrypted: true,
+      enablePerformanceInsights: props.performanceInsights ?? false,
+      port: 3306
+    };
+    if (props.transform?.instance) {
+      instanceProps = props.transform.instance(instanceProps);
+    }
+    this.instance = new rds.DatabaseInstance(this, "Instance", instanceProps);
+    this.securityGroup = this.instance.connections.securityGroups[0];
+    this.secret = this.instance.secret;
+    this.connections = this.instance.connections;
+    if (props.proxy) {
+      let proxyProps = {
+        proxyTarget: rds.ProxyTarget.fromInstance(this.instance),
+        secrets: [this.secret],
+        vpc: props.vpc,
+        securityGroups: [this.securityGroup],
+        requireTLS: false
+      };
+      if (props.transform?.proxy) {
+        proxyProps = props.transform.proxy(proxyProps);
+      }
+      this.rdsProxy = new rds.DatabaseProxy(this, "Proxy", proxyProps);
+    }
+  }
+};
+function resolvePrivateSubnetType(vpc) {
+  if (vpc instanceof ec23.Vpc && vpc.isolatedSubnets.length > 0) return ec23.SubnetType.PRIVATE_ISOLATED;
+  return ec23.SubnetType.PRIVATE_WITH_EGRESS;
+}
+
+// src/aurora-database.ts
+import { Construct as Construct15 } from "constructs";
+import { Duration as Duration6, RemovalPolicy as RemovalPolicy6 } from "aws-cdk-lib";
+import * as ec24 from "aws-cdk-lib/aws-ec2";
+import * as rds2 from "aws-cdk-lib/aws-rds";
+var AuroraDatabase = class extends Construct15 {
+  cluster;
+  securityGroup;
+  secret;
+  connections;
+  rdsProxy;
+  get host() {
+    return this.cluster.clusterEndpoint.hostname;
+  }
+  get port() {
+    return this.cluster.clusterEndpoint.port.toString();
+  }
+  get readerHost() {
+    return this.cluster.clusterReadEndpoint.hostname;
+  }
+  get proxyEndpoint() {
+    return this.rdsProxy?.endpoint;
+  }
+  constructor(scope, id, props) {
+    super(scope, id);
+    const engine = resolveEngine(props.engine, props.version);
+    const username = props.username ?? (props.engine === "postgres" ? "postgres" : "root");
+    const readers = Array.from(
+      { length: props.readers ?? 0 },
+      (_, i) => rds2.ClusterInstance.serverlessV2(`Reader${i + 1}`, { scaleWithWriter: true })
+    );
+    let clusterProps = {
+      engine,
+      port: props.port,
+      writer: rds2.ClusterInstance.serverlessV2("Writer"),
+      readers,
+      serverlessV2MinCapacity: props.scaling?.min ?? 0,
+      serverlessV2MaxCapacity: props.scaling?.max ?? 4,
+      serverlessV2AutoPauseDuration: props.scaling?.pauseAfter ? parseDuration(props.scaling.pauseAfter) : void 0,
+      vpc: props.vpc,
+      vpcSubnets: { subnetType: resolvePrivateSubnetType2(props.vpc) },
+      defaultDatabaseName: props.database,
+      credentials: rds2.Credentials.fromGeneratedSecret(username),
+      storageEncrypted: true,
+      deletionProtection: props.deletionProtection ?? true,
+      removalPolicy: RemovalPolicy6.SNAPSHOT,
+      backup: { retention: Duration6.days(props.backupRetentionDays ?? 7) },
+      enableDataApi: props.dataApi ?? false,
+      enablePerformanceInsights: props.performanceInsights ?? false
+    };
+    if (props.transform?.cluster) {
+      clusterProps = props.transform.cluster(clusterProps);
+    }
+    this.cluster = new rds2.DatabaseCluster(this, "Cluster", clusterProps);
+    if (!this.cluster.secret) {
+      throw new Error("AuroraDatabase: cluster secret is missing \u2014 ensure credentials are not overridden via transform");
+    }
+    this.securityGroup = this.cluster.connections.securityGroups[0];
+    this.secret = this.cluster.secret;
+    this.connections = this.cluster.connections;
+    if (props.proxy) {
+      let proxyProps = {
+        proxyTarget: rds2.ProxyTarget.fromCluster(this.cluster),
+        secrets: [this.secret],
+        vpc: props.vpc,
+        securityGroups: [this.securityGroup],
+        requireTLS: false
+      };
+      if (props.transform?.proxy) {
+        proxyProps = props.transform.proxy(proxyProps);
+      }
+      this.rdsProxy = new rds2.DatabaseProxy(this, "Proxy", proxyProps);
+    }
+  }
+};
+function parseDuration(value) {
+  const match = value.match(/^(\d+)\s+(second|seconds|minute|minutes|hour|hours)$/);
+  if (!match) throw new Error(`Invalid duration: ${value}`);
+  const amount = Number(match[1]);
+  const unit = match[2];
+  if (unit.startsWith("hour")) return Duration6.hours(amount);
+  if (unit.startsWith("minute")) return Duration6.minutes(amount);
+  return Duration6.seconds(amount);
+}
+function resolvePrivateSubnetType2(vpc) {
+  if (vpc instanceof ec24.Vpc && vpc.isolatedSubnets.length > 0) return ec24.SubnetType.PRIVATE_ISOLATED;
+  return ec24.SubnetType.PRIVATE_WITH_EGRESS;
+}
+function resolveEngine(engine, version) {
+  if (engine === "postgres") {
+    return rds2.DatabaseClusterEngine.auroraPostgres({
+      version
+    });
+  }
+  return rds2.DatabaseClusterEngine.auroraMysql({
+    version
+  });
+}
+
+// src/redis.ts
+import { Construct as Construct16 } from "constructs";
+import * as ec25 from "aws-cdk-lib/aws-ec2";
+import * as elasticache from "aws-cdk-lib/aws-elasticache";
+import * as secretsmanager2 from "aws-cdk-lib/aws-secretsmanager";
+var Redis = class extends Construct16 {
+  replicationGroup;
+  securityGroup;
+  subnetGroup;
+  parameterGroup;
+  secret;
+  get host() {
+    return this.replicationGroup.attrPrimaryEndPointAddress;
+  }
+  get port() {
+    return this.replicationGroup.attrPrimaryEndPointPort;
+  }
+  constructor(scope, id, props) {
+    super(scope, id);
+    const engine = props.engine ?? "redis";
+    const version = resolveVersion(engine, props.version);
+    const replicas = props.replicas ?? 0;
+    this.securityGroup = new ec25.SecurityGroup(this, "SecurityGroup", {
+      vpc: props.vpc,
+      description: `Security group for ${id} ElastiCache`
+    });
+    this.securityGroup.addIngressRule(ec25.Peer.ipv4(props.vpc.vpcCidrBlock), ec25.Port.tcp(6379), "Allow Redis access from VPC");
+    const subnetType = resolvePrivateSubnetType3(props.vpc);
+    const subnets = props.vpc.selectSubnets({ subnetType });
+    let subnetGroupProps = {
+      description: `Subnet group for ${id}`,
+      subnetIds: subnets.subnetIds
+    };
+    if (props.transform?.subnetGroup) {
+      subnetGroupProps = props.transform.subnetGroup(subnetGroupProps);
+    }
+    this.subnetGroup = new elasticache.CfnSubnetGroup(this, "SubnetGroup", subnetGroupProps);
+    if (props.parameters) {
+      let parameterGroupProps = {
+        cacheParameterGroupFamily: resolveParameterGroupFamily(engine, version),
+        description: `Parameter group for ${id}`,
+        properties: props.parameters
+      };
+      if (props.transform?.parameterGroup) {
+        parameterGroupProps = props.transform.parameterGroup(parameterGroupProps);
+      }
+      this.parameterGroup = new elasticache.CfnParameterGroup(this, "ParameterGroup", parameterGroupProps);
+    }
+    this.secret = new secretsmanager2.Secret(this, "AuthToken", {
+      description: `Auth token for ${id} ElastiCache`,
+      generateSecretString: {
+        excludePunctuation: true,
+        passwordLength: 64
+      }
+    });
+    let replicationGroupProps = {
+      replicationGroupDescription: `${id} replication group`,
+      engine,
+      engineVersion: version,
+      cacheNodeType: props.instance ?? "cache.t4g.micro",
+      numCacheClusters: replicas + 1,
+      port: 6379,
+      automaticFailoverEnabled: replicas >= 1,
+      multiAzEnabled: false,
+      cacheSubnetGroupName: this.subnetGroup.ref,
+      cacheParameterGroupName: this.parameterGroup?.ref,
+      securityGroupIds: [this.securityGroup.securityGroupId],
+      transitEncryptionEnabled: true,
+      atRestEncryptionEnabled: true,
+      authToken: this.secret.secretValue.unsafeUnwrap()
+    };
+    if (props.transform?.replicationGroup) {
+      replicationGroupProps = props.transform.replicationGroup(replicationGroupProps);
+    }
+    this.replicationGroup = new elasticache.CfnReplicationGroup(this, "ReplicationGroup", replicationGroupProps);
+  }
+};
+function resolvePrivateSubnetType3(vpc) {
+  if (vpc instanceof ec25.Vpc && vpc.isolatedSubnets.length > 0) return ec25.SubnetType.PRIVATE_ISOLATED;
+  return ec25.SubnetType.PRIVATE_WITH_EGRESS;
+}
+function resolveVersion(engine, version) {
+  if (version) return version;
+  return engine === "valkey" ? "7.2" : "7.1";
+}
+function resolveParameterGroupFamily(engine, version) {
+  const major = version.split(".")[0];
+  if (engine === "valkey") return `valkey${major}`;
+  return `redis${major}.x`;
+}
+
+// src/email.ts
+import { Construct as Construct17 } from "constructs";
+import * as ses from "aws-cdk-lib/aws-ses";
+import * as route53 from "aws-cdk-lib/aws-route53";
+var Email = class extends Construct17 {
+  identity;
+  configurationSet;
+  dmarcRecord;
+  _sender;
+  get sender() {
+    return this._sender;
+  }
+  get configSetName() {
+    return this.configurationSet.configurationSetName;
+  }
+  constructor(scope, id, props) {
+    super(scope, id);
+    this._sender = props.sender;
+    const senderType = resolveSenderType(props.sender);
+    if (senderType === "email" && props.dmarc !== void 0) {
+      throw new Error("DMARC records can only be configured for domain senders, not email addresses");
+    }
+    let configurationSetProps = {
+      reputationMetrics: true
+    };
+    if (props.transform?.configurationSet) {
+      configurationSetProps = props.transform.configurationSet(configurationSetProps);
+    }
+    this.configurationSet = new ses.ConfigurationSet(this, "ConfigurationSet", configurationSetProps);
+    const identity = resolveIdentity(senderType, props.sender, props.hostedZone);
+    let identityProps = {
+      identity,
+      configurationSet: this.configurationSet
+    };
+    if (props.transform?.identity) {
+      identityProps = props.transform.identity(identityProps);
+    }
+    this.identity = new ses.EmailIdentity(this, "Identity", identityProps);
+    if (senderType === "domain" && props.hostedZone) {
+      const dmarcValue = props.dmarc ?? "v=DMARC1; p=none;";
+      this.dmarcRecord = new route53.TxtRecord(this, "DmarcRecord", {
+        zone: props.hostedZone,
+        recordName: `_dmarc.${props.sender}`,
+        values: [dmarcValue]
+      });
+    }
+    if (props.events) {
+      for (const [i, event] of props.events.entries()) {
+        const types = event.types ? event.types.map(resolveEmailSendingEvent) : void 0;
+        const destination = resolveEventDestination(event);
+        this.configurationSet.addEventDestination(`EventDestination${i}`, {
+          destination,
+          enabled: event.enabled,
+          events: types
+        });
+      }
+    }
+  }
+};
+function resolveSenderType(sender) {
+  return sender.includes("@") ? "email" : "domain";
+}
+function resolveIdentity(senderType, sender, hostedZone) {
+  if (senderType === "email") return ses.Identity.email(sender);
+  if (hostedZone) return ses.Identity.publicHostedZone(hostedZone);
+  return ses.Identity.domain(sender);
+}
+function resolveEventDestination(event) {
+  if (event.snsTopic) return ses.EventDestination.snsTopic(event.snsTopic);
+  if (event.cloudWatchDimensions) {
+    return ses.EventDestination.cloudWatchDimensions(
+      event.cloudWatchDimensions.map((d) => ({
+        name: d.name,
+        source: d.source,
+        defaultValue: d.defaultValue
+      }))
+    );
+  }
+  throw new Error('Event destination must specify either "snsTopic" or "cloudWatchDimensions"');
+}
+function resolveEmailSendingEvent(type) {
+  switch (type) {
+    case "send":
+      return ses.EmailSendingEvent.SEND;
+    case "reject":
+      return ses.EmailSendingEvent.REJECT;
+    case "bounce":
+      return ses.EmailSendingEvent.BOUNCE;
+    case "complaint":
+      return ses.EmailSendingEvent.COMPLAINT;
+    case "delivery":
+      return ses.EmailSendingEvent.DELIVERY;
+    case "open":
+      return ses.EmailSendingEvent.OPEN;
+    case "click":
+      return ses.EmailSendingEvent.CLICK;
+    case "rendering-failure":
+      return ses.EmailSendingEvent.RENDERING_FAILURE;
+    case "delivery-delay":
+      return ses.EmailSendingEvent.DELIVERY_DELAY;
+    case "subscription":
+      return ses.EmailSendingEvent.SUBSCRIPTION;
+  }
+}
+
+// src/sns-topic.ts
+import { Construct as Construct18 } from "constructs";
+import * as sns from "aws-cdk-lib/aws-sns";
+import * as snsSubscriptions from "aws-cdk-lib/aws-sns-subscriptions";
+var SnsTopic = class extends Construct18 {
+  topic;
+  get arn() {
+    return this.topic.topicArn;
+  }
+  get topicName() {
+    return this.topic.topicName;
+  }
+  constructor(scope, id, props = {}) {
+    super(scope, id);
+    let topicProps = {
+      displayName: props.displayName,
+      fifo: props.fifo
+    };
+    if (props.transform?.topic) {
+      topicProps = props.transform.topic(topicProps);
+    }
+    this.topic = new sns.Topic(this, "Topic", topicProps);
+  }
+  /**
+   * Subscribe a Lambda function to this topic.
+   */
+  subscribe(name, fn, args) {
+    let subscriptionProps = {
+      filterPolicy: args?.filterPolicy,
+      filterPolicyWithMessageBody: args?.filterPolicyWithMessageBody,
+      deadLetterQueue: args?.deadLetterQueue
+    };
+    if (args?.transform?.subscription) {
+      subscriptionProps = args.transform.subscription(subscriptionProps);
+    }
+    this.topic.addSubscription(new snsSubscriptions.LambdaSubscription(fn, subscriptionProps));
+  }
+  /**
+   * Subscribe an SQS queue to this topic.
+   */
+  subscribeQueue(name, queue, args) {
+    let subscriptionProps = {
+      filterPolicy: args?.filterPolicy,
+      filterPolicyWithMessageBody: args?.filterPolicyWithMessageBody,
+      deadLetterQueue: args?.deadLetterQueue,
+      rawMessageDelivery: args?.rawMessageDelivery
+    };
+    if (args?.transform?.subscription) {
+      subscriptionProps = args.transform.subscription(subscriptionProps);
+    }
+    this.topic.addSubscription(new snsSubscriptions.SqsSubscription(queue, subscriptionProps));
+  }
+};
+
+// src/event-bus.ts
+import { Construct as Construct19 } from "constructs";
+import * as events from "aws-cdk-lib/aws-events";
+import * as targets from "aws-cdk-lib/aws-events-targets";
+var EventBus2 = class extends Construct19 {
+  bus;
+  get arn() {
+    return this.bus.eventBusArn;
+  }
+  get busName() {
+    return this.bus.eventBusName;
+  }
+  constructor(scope, id, props = {}) {
+    super(scope, id);
+    let busProps = {
+      eventBusName: props.eventBusName,
+      description: props.description
+    };
+    if (props.transform?.bus) {
+      busProps = props.transform.bus(busProps);
+    }
+    this.bus = new events.EventBus(this, "Bus", busProps);
+  }
+  /**
+   * Subscribe a Lambda function to events on this bus.
+   */
+  subscribe(name, fn, args) {
+    let ruleProps = {
+      eventBus: this.bus,
+      eventPattern: buildEventPattern(args?.pattern)
+    };
+    if (args?.transform?.rule) {
+      ruleProps = args.transform.rule(ruleProps);
+    }
+    const rule = new events.Rule(this, `${name}Rule`, ruleProps);
+    let targetProps = {};
+    if (args?.transform?.target) {
+      targetProps = args.transform.target(targetProps);
+    }
+    rule.addTarget(new targets.LambdaFunction(fn, targetProps));
+  }
+  /**
+   * Subscribe an SQS queue to events on this bus.
+   */
+  subscribeQueue(name, queue, args) {
+    let ruleProps = {
+      eventBus: this.bus,
+      eventPattern: buildEventPattern(args?.pattern)
+    };
+    if (args?.transform?.rule) {
+      ruleProps = args.transform.rule(ruleProps);
+    }
+    const rule = new events.Rule(this, `${name}Rule`, ruleProps);
+    let targetProps = {};
+    if (args?.transform?.target) {
+      targetProps = args.transform.target(targetProps);
+    }
+    rule.addTarget(new targets.SqsQueue(queue, targetProps));
+  }
+};
+function buildEventPattern(pattern) {
+  if (!pattern) return void 0;
+  return {
+    source: pattern.source,
+    detailType: pattern.detailType,
+    detail: pattern.detail
+  };
+}
+export {
+  AuroraDatabase,
+  Bucket2 as Bucket,
+  Cluster2 as Cluster,
+  EcsFargateService,
+  Email,
+  EventBus2 as EventBus,
+  LambdaFunction,
+  MySqlDatabase,
+  ReactRouterEcrImage,
+  ReactRouterSsrSiteEcsFargateService,
+  ReactRouterSsrSiteLambda,
+  Redis,
+  SnsTopic,
+  StaticSite,
+  Vpc2 as Vpc
+};