@stacksjs/cloud 0.58.28 → 0.58.43

package/dist/index.js

@@ -0,0 +1,3147 @@
+// @bun
+// src/helpers.ts
+import {CloudFormation} from "@aws-sdk/client-cloudformation";
+import {CloudWatchLogsClient, DeleteLogGroupCommand, DescribeLogGroupsCommand} from "@aws-sdk/client-cloudwatch-logs";
+import {EC2, _InstanceType as InstanceType} from "@aws-sdk/client-ec2";
+import {DescribeFileSystemsCommand, EFSClient} from "@aws-sdk/client-efs";
+import {IAM} from "@aws-sdk/client-iam";
+import {SSM} from "@aws-sdk/client-ssm";
+import {Lambda} from "@aws-sdk/client-lambda";
+import {ContactType, Route53Domains} from "@aws-sdk/client-route-53-domains";
+import {ListBucketsCommand, S3} from "@aws-sdk/client-s3";
+import {config as config2} from "@stacksjs/config";
+import {err, handleError as handleError2, ok} from "@stacksjs/error-handling";
+import {log} from "@stacksjs/logging";
+import {path as p} from "@stacksjs/path";
+import {rimraf} from "@stacksjs/utils";
+import {slug} from "@stacksjs/strings";
+async function getSecurityGroupId(securityGroupName) {
+  const ec2 = new EC2({ region: "us-east-1" });
+  const { SecurityGroups } = await ec2.describeSecurityGroups({
+    Filters: [{ Name: "group-name", Values: [securityGroupName] }]
+  });
+  if (!SecurityGroups)
+    return err(`Security group ${securityGroupName} not found`);
+  if (SecurityGroups[0])
+    return ok(SecurityGroups[0].GroupId);
+  return err(`Security group ${securityGroupName} not found`);
+}
+function purchaseDomain(domain, options) {
+  const route53domains = new Route53Domains({ region: "us-east-1" });
+  const contactType = options.contactType.toUpperCase();
+  const params = {
+    DomainName: domain,
+    DurationInYears: options.years || 1,
+    AutoRenew: options.autoRenew || true,
+    AdminContact: {
+      FirstName: options.adminFirstName,
+      LastName: options.adminLastName,
+      ContactType: contactType || ContactType.PERSON,
+      OrganizationName: options.adminOrganization,
+      AddressLine1: options.adminAddressLine1,
+      AddressLine2: options.adminAddressLine2,
+      City: options.adminCity,
+      State: options.adminState,
+      CountryCode: options.adminCountry,
+      ZipCode: options.adminZip.toString(),
+      PhoneNumber: options.adminPhone.toString().includes("+") ? options.adminPhone.toString() : `+${options.adminPhone.toString()}`,
+      Email: options.adminEmail
+    },
+    RegistrantContact: {
+      FirstName: options.registrantFirstName,
+      LastName: options.registrantLastName,
+      ContactType: contactType || ContactType.PERSON,
+      OrganizationName: options.registrantOrganization,
+      AddressLine1: options.registrantAddressLine1,
+      AddressLine2: options.registrantAddressLine2,
+      City: options.registrantCity,
+      State: options.registrantState,
+      CountryCode: options.registrantCountry,
+      ZipCode: options.registrantZip.toString(),
+      PhoneNumber: options.registrantPhone.toString().includes("+") ? options.registrantPhone.toString() : `+${options.registrantPhone.toString()}`,
+      Email: options.registrantEmail
+    },
+    TechContact: {
+      FirstName: options.techFirstName,
+      LastName: options.techLastName,
+      ContactType: contactType || ContactType.PERSON,
+      OrganizationName: options.techOrganization,
+      AddressLine1: options.techAddressLine1,
+      AddressLine2: options.techAddressLine2,
+      City: options.techCity,
+      State: options.techState,
+      CountryCode: options.techCountry,
+      ZipCode: options.techZip.toString(),
+      PhoneNumber: options.techPhone.toString().includes("+") ? options.techPhone.toString() : `+${options.techPhone.toString()}`,
+      Email: options.techEmail
+    },
+    PrivacyProtectAdminContact: options.privacyAdmin || options.privacy || true,
+    PrivacyProtectRegistrantContact: options.privacyRegistrant || options.privacy || true,
+    PrivacyProtectTechContact: options.privacyTech || options.privacy || true
+  };
+  try {
+    return ok(route53domains.registerDomain(params));
+  } catch (error) {
+    return err(error);
+  }
+}
+async function getJumpBoxInstanceId(name) {
+  if (!name)
+    name = `${cloudName}/JumpBox`;
+  const ec2 = new EC2({ region: "us-east-1" });
+  const data = await ec2.describeInstances({
+    Filters: [
+      {
+        Name: "tag:Name",
+        Values: [name]
+      }
+    ]
+  });
+  if (data.Reservations && data.Reservations[0] && data.Reservations[0].Instances && data.Reservations[0].Instances[0])
+    return data.Reservations[0].Instances[0].InstanceId;
+  return;
+}
+async function deleteEc2Instance(id, stackName) {
+  if (!stackName)
+    stackName = cloudName;
+  if (!id)
+    return err(`Instance ${id} not found`);
+  const ec2 = new EC2({ region: "us-east-1" });
+  await ec2.terminateInstances({ InstanceIds: [id] });
+  return ok(`Instance ${id} is being terminated`);
+}
+async function deleteJumpBox(stackName) {
+  if (!stackName)
+    stackName = cloudName;
+  const jumpBoxId = await getJumpBoxInstanceId();
+  if (!jumpBoxId)
+    return err("Jump-box not found");
+  return await deleteEc2Instance(jumpBoxId, stackName);
+}
+async function deleteIamUsers() {
+  const iam = new IAM({ region: "us-east-1" });
+  const data = await iam.listUsers({});
+  const teamName = slug(config2.team.name);
+  const users = data.Users?.filter((user) => {
+    const userNameLower = user.UserName?.toLowerCase();
+    return userNameLower !== "stacks" && userNameLower !== teamName.toLowerCase() && userNameLower?.includes(teamName.toLowerCase());
+  }) || [];
+  if (!users || users.length === 0)
+    return ok(`No Stacks IAM users found for team ${teamName}`);
+  const promises = users.map(async (user) => {
+    const userName = user.UserName || "";
+    log.info(`Deleting IAM user: ${userName}`);
+    const policies = await iam.listAttachedUserPolicies({ UserName: userName });
+    await Promise.all(policies.AttachedPolicies?.map((policy) => iam.detachUserPolicy({ UserName: userName, PolicyArn: policy.PolicyArn || "" })) || []);
+    const accessKeys = await iam.listAccessKeys({ UserName: userName });
+    await Promise.all(accessKeys.AccessKeyMetadata?.map((key) => iam.deleteAccessKey({ UserName: userName, AccessKeyId: key.AccessKeyId || "" })) || []);
+    return iam.deleteUser({ UserName: userName });
+  });
+  await Promise.all(promises).catch((error) => {
+    console.error(`Error deleting user: ${error}`);
+    return err(handleError2("Error deleting Stacks IAM users", error));
+  });
+  return ok(`Stacks IAM users deleted for team ${teamName}`);
+}
+async function deleteStacksBuckets() {
+  try {
+    const s3 = new S3({ region: "us-east-1" });
+    const data = await s3.listBuckets({});
+    const stacksBuckets = data.Buckets?.filter((bucket) => bucket.Name?.includes("stacks"));
+    if (!stacksBuckets)
+      return err("No stacks buckets found");
+    const promises = stacksBuckets.map(async (bucket) => {
+      const bucketName = bucket.Name || "";
+      log.info(`Deleting bucket ${bucketName}...`);
+      const objects = await s3.listObjectsV2({ Bucket: bucketName });
+      log.info(`Finished listing bucket ${bucketName} objects`);
+      if (objects.Contents) {
+        log.info("Deleting bucket objects...");
+        await Promise.all(objects.Contents.map((object) => s3.deleteObject({ Bucket: bucketName, Key: object.Key || "" }).catch((error) => handleError2(error))));
+        log.info(`Finished deleting objects from bucket ${bucketName}`);
+      }
+      log.info(`Deleting bucket ${bucketName} versions...`);
+      try {
+        const versions = await s3.listObjectVersions({ Bucket: bucketName });
+        if (versions.Versions) {
+          await Promise.all(versions.Versions.map((version) => s3.deleteObject({ Bucket: bucketName, Key: version.Key || "", VersionId: version.VersionId }))).catch((error) => handleError2(error));
+          log.info(`Finished deleting versions from bucket ${bucketName}`);
+        }
+        log.info(`Deleting bucket ${bucketName} delete markers...`);
+        if (versions.DeleteMarkers) {
+          await Promise.all(versions.DeleteMarkers.map((marker) => s3.deleteObject({ Bucket: bucketName, Key: marker.Key || "", VersionId: marker.VersionId }))).catch((error) => handleError2(error));
+          log.info(`Finished deleting delete markers from bucket ${bucketName}`);
+        }
+        const uploads = await s3.listMultipartUploads({ Bucket: bucketName });
+        if (uploads.Uploads) {
+          log.info("Aborting bucket multipart uploads...");
+          await Promise.all(uploads.Uploads.map((upload) => s3.abortMultipartUpload({ Bucket: bucketName, Key: upload.Key || "", UploadId: upload.UploadId }))).catch((error) => handleError2(error));
+          log.info(`Finished aborting multipart uploads from bucket ${bucketName}`);
+        }
+        await s3.deleteBucket({ Bucket: bucketName }).catch((error) => handleError2(error));
+        log.info(`Bucket ${bucketName} deleted`);
+      } catch (error) {
+        log.info(`Error listing bucket ${bucketName} versions`, error);
+      }
+    });
+    await Promise.all(promises).catch((error) => {
+      return err(handleError2("Error deleting stacks buckets", error));
+    });
+    return ok("Stacks buckets deleted");
+  } catch (error) {
+    return err(handleError2("Error deleting stacks buckets", error));
+  }
+}
+async function deleteStacksFunctions() {
+  const lambda = new Lambda({ region: "us-east-1" });
+  const data = await lambda.listFunctions({});
+  const stacksFunctions = data.Functions?.filter((func) => func.FunctionName?.includes("stacks")) || [];
+  if (!stacksFunctions || stacksFunctions.length === 0)
+    return ok("No stacks functions found");
+  const promises = stacksFunctions.map((func) => lambda.deleteFunction({ FunctionName: func.FunctionName || "" }));
+  await Promise.all(promises).catch((error) => {
+    if (error.message.includes("it is a replicated function")) {
+      log.info("Function is replicated, skipping...");
+      return ok("CloudFront is still deleting the some functions. Try again later.");
+    }
+    return err(handleError2("Error deleting stacks functions", error));
+  });
+  return ok("Stacks functions deleted");
+}
+async function deleteLogGroups() {
+  try {
+    const client = new CloudWatchLogsClient({ region: "us-east-1" });
+    const logGroups = await client.send(new DescribeLogGroupsCommand({}));
+    if (!logGroups?.logGroups)
+      return err("No log groups found");
+    for (const group of logGroups.logGroups) {
+      if (group.logGroupName?.includes("stacks"))
+        await client.send(new DeleteLogGroupCommand({ logGroupName: group.logGroupName }));
+    }
+    return ok("Log groups deleted");
+  } catch (error) {
+    return err(handleError2("Error deleting log groups", error));
+  }
+}
+async function deleteParameterStore() {
+  const ssm = new SSM({ region: "us-east-1" });
+  const data = await ssm.describeParameters({});
+  if (!data.Parameters)
+    return ok("No parameters found");
+  const stacksParameters = data.Parameters.filter((param) => param.Name?.includes("stacks")) || [];
+  if (!stacksParameters || stacksParameters.length === 0)
+    return ok("No stacks parameters found");
+  const promises = stacksParameters.map((param) => ssm.deleteParameter({ Name: param.Name || "" }));
+  await Promise.all(promises).catch((error) => {
+    return err(handleError2("Error deleting parameter store", error));
+  });
+  return ok("Parameter store deleted");
+}
+async function deleteCdkRemnants() {
+  try {
+    return ok(await rimraf([
+      p.cloudPath("cdk.out/"),
+      p.cloudPath("cdk.context.json")
+    ]));
+  } catch (error) {
+    return err(handleError2("Error deleting CDK remnants", error));
+  }
+}
+async function hasBeenDeployed() {
+  const s3 = new S3({ region: "us-east-1" });
+  try {
+    const response = await s3.send(new ListBucketsCommand({}));
+    return ok(response.Buckets?.some((bucket) => bucket.Name?.includes(config2.app.name?.toLocaleLowerCase() || "stacks")) || false);
+  } catch (error) {
+    return err(handleError2("Error checking if the app has been deployed", error));
+  }
+}
+async function getJumpBoxInstanceProfileName() {
+  const iam = new IAM({ region: "us-east-1" });
+  const data = await iam.listInstanceProfiles({});
+  const instanceProfile = data.InstanceProfiles?.find((profile) => profile.InstanceProfileName?.includes("JumpBox"));
+  if (!instanceProfile)
+    return err("Jump-box IAM instance profile not found");
+  return ok(instanceProfile?.InstanceProfileName);
+}
+async function addJumpBox(stackName) {
+  if (!stackName)
+    stackName = cloudName;
+  if (await getJumpBoxInstanceId())
+    return err("The jump\u2013box you are trying to add already exists. Please remove it & wait until it finished terminating.");
+  const ec2 = new EC2({ region: "us-east-1" });
+  const r = await getJumpBoxSecurityGroupName();
+  if (r.isErr())
+    return err(r.error);
+  if (!r.value)
+    return err("Security group not found when adding jump-box");
+  const result = await getSecurityGroupId(r.value);
+  let sgId;
+  if (result.isErr())
+    return err(result.error);
+  else
+    sgId = result.value;
+  if (!sgId)
+    return err("Security group not found when adding jump-box");
+  const client = new EFSClient({ region: "us-east-1" });
+  const command = new DescribeFileSystemsCommand({});
+  const data = await client.send(command);
+  const fileSystemName = `stacks-${config2.app.env}-efs`;
+  const fileSystem = data.FileSystems?.find((fs) => fs.Name === fileSystemName);
+  const fileSystemId = fileSystem?.FileSystemId;
+  if (!fileSystem || !fileSystemId)
+    return err(`EFS file system ${fileSystemName} not found`);
+  const userDataScript = `
+#!/bin/bash
+yum update -y
+yum install -y amazon-efs-utils
+yum install -y git
+yum install -y https://s3.us-east-1.amazonaws.com/amazon-ssm-us-east-1/latest/linux_amd64/amazon-ssm-agent.rpm
+mkdir /mnt/efs
+mount -t efs ${fileSystemId}:/ /mnt/efs
+git clone https://github.com/stacksjs/stacks.git /mnt/efs
+`;
+  const base64UserData = btoa(userDataScript);
+  const res = await getJumpBoxInstanceProfileName();
+  if (res.isErr())
+    return err(res.error);
+  const jumpBoxInstanceProfileName = res.value;
+  if (!jumpBoxInstanceProfileName)
+    return err("Jump-box IAM instance profile not found");
+  const instance = await ec2.runInstances({
+    ImageId: "ami-03a6eaae9938c858c",
+    InstanceType: InstanceType.t2_micro,
+    MaxCount: 1,
+    MinCount: 1,
+    SecurityGroupIds: [sgId],
+    SubnetId: "subnet-004c5f196358b00f0",
+    TagSpecifications: [
+      {
+        ResourceType: "instance",
+        Tags: [
+          {
+            Key: "Name",
+            Value: `${cloudName}-jump-box`
+          }
+        ]
+      }
+    ],
+    UserData: base64UserData,
+    IamInstanceProfile: {
+      Name: jumpBoxInstanceProfileName
+    }
+  });
+  return instance.Instances && instance.Instances[0] ? ok(`Jump-box created with id ${instance.Instances[0].InstanceId}`) : err("Jump-box creation failed");
+}
+async function getJumpBoxSecurityGroupName() {
+  const jumpBoxId = await getJumpBoxInstanceId();
+  if (!jumpBoxId)
+    return err("Jump-box not found");
+  const ec2 = new EC2({ region: "us-east-1" });
+  const data = await ec2.describeInstances({ InstanceIds: [jumpBoxId] });
+  if (data.Reservations && data.Reservations[0] && data.Reservations[0].Instances && data.Reservations[0].Instances[0]) {
+    const instance = data.Reservations[0].Instances[0];
+    const securityGroups = instance.SecurityGroups;
+    if (securityGroups && securityGroups[0])
+      return ok(securityGroups[0].GroupName);
+  }
+  return err("Security group not found");
+}
+async function getSecurityGroupFromInstanceId(instanceId) {
+  const ec2 = new EC2({ region: "us-east-1" });
+  const data = await ec2.describeInstances({ InstanceIds: [instanceId] });
+  if (data.Reservations && data.Reservations[0] && data.Reservations[0].Instances && data.Reservations[0].Instances[0]) {
+    const instance = data.Reservations[0].Instances[0];
+    const securityGroups = instance.SecurityGroups;
+    if (securityGroups && securityGroups[0])
+      return securityGroups[0].GroupId;
+  }
+  return;
+}
+async function isFirstDeployment() {
+  const stackName = cloudName;
+  const cloudFormation = new CloudFormation;
+  const data = await cloudFormation.listStacks({ StackStatusFilter: ["CREATE_COMPLETE", "UPDATE_COMPLETE"] });
+  const isStacksCloudPresent = data.StackSummaries?.some((stack) => stack.StackName === stackName);
+  return !isStacksCloudPresent;
+}
+async function isFailedState() {
+  const cloudFormation = new CloudFormation;
+  const data = await cloudFormation.listStacks({ StackStatusFilter: ["CREATE_FAILED", "UPDATE_FAILED", "ROLLBACK_COMPLETE", "UPDATE_ROLLBACK_COMPLETE"] });
+  const isStacksCloudPresent = data.StackSummaries?.some((stack) => stack.StackName === cloudName);
+  return !isStacksCloudPresent;
+}
+async function getOrCreateTimestamp() {
+  const parameterName = `/stacks/timestamp`;
+  const ssm = new SSM({ region: "us-east-1" });
+  try {
+    const response = await ssm.getParameter({ Name: parameterName });
+    const timestamp = response.Parameter ? response.Parameter.Value : undefined;
+    if (!timestamp)
+      throw new Error("Timestamp parameter not found");
+    return timestamp;
+  } catch (error) {
+    const timestamp = new Date().getTime().toString();
+    log.debug(`Creating timestamp parameter ${parameterName} with value ${timestamp}`);
+    await ssm.putParameter({
+      Name: parameterName,
+      Value: timestamp,
+      Type: "String"
+    });
+    return timestamp;
+  }
+}
+var appEnv = config2.app.env === "local" ? "dev" : config2.app.env;
+var cloudName = `stacks-cloud-${appEnv}`;
+// src/cloud/index.ts
+import {Stack as Stack2} from "aws-cdk-lib";
+
+// src/cloud/ai.ts
+import {Duration, CfnOutput as Output, aws_iam as iam, aws_lambda as lambda} from "aws-cdk-lib";
+import {config as config4} from "@stacksjs/config";
+
+class AiStack {
+  askAiUrl;
+  summarizeAiUrl;
+  constructor(scope, props) {
+    const awsSdkLayer = new lambda.LayerVersion(scope, "AwsSdkLayer", {
+      code: lambda.Code.fromAsset("src/cloud/aws-sdk-layer"),
+      compatibleRuntimes: [lambda.Runtime.NODEJS_20_X],
+      description: "Layer with aws-sdk"
+    });
+    const bedrockAccessPolicy = new iam.PolicyStatement({
+      effect: iam.Effect.ALLOW,
+      actions: [
+        "bedrock:InvokeModel",
+        "bedrock:InvokeModelWithResponseStream"
+      ],
+      resources: config4.ai.models?.map((model) => `arn:aws:bedrock:us-east-1::foundation-model/${model}`)
+    });
+    const bedrockAccessRole = new iam.Role(scope, "BedrockAccessRole", {
+      assumedBy: new iam.ServicePrincipal("lambda.amazonaws.com"),
+      managedPolicies: [
+        iam.ManagedPolicy.fromAwsManagedPolicyName("service-role/AWSLambdaBasicExecutionRole")
+      ]
+    });
+    bedrockAccessRole.addToPolicy(bedrockAccessPolicy);
+    const askAi = new lambda.Function(scope, "AskAiFunction", {
+      functionName: `${props.slug}-${props.appEnv}-ai-ask`,
+      description: "Lambda function to invoke the AI model",
+      runtime: lambda.Runtime.NODEJS_20_X,
+      handler: "index.handler",
+      code: lambda.Code.fromAsset("src/cloud/lambda/ask"),
+      layers: [awsSdkLayer],
+      role: bedrockAccessRole,
+      timeout: Duration.seconds(30)
+    });
+    this.askAiUrl = new lambda.FunctionUrl(scope, "AskAiFunctionUrl", {
+      function: askAi,
+      authType: lambda.FunctionUrlAuthType.NONE,
+      cors: {
+        allowedOrigins: ["*"]
+      }
+    });
+    const summarizeAi = new lambda.Function(scope, "SummarizeAiFunction", {
+      functionName: `${props.slug}-${props.appEnv}-ai-summarize`,
+      description: "Lambda function to summarize any given text",
+      runtime: lambda.Runtime.NODEJS_20_X,
+      handler: "index.handler",
+      code: lambda.Code.fromAsset("src/cloud/lambda/summarize"),
+      layers: [awsSdkLayer],
+      role: bedrockAccessRole,
+      timeout: Duration.seconds(30)
+    });
+    this.summarizeAiUrl = new lambda.FunctionUrl(scope, "SummarizeAiFunctionUrl", {
+      function: summarizeAi,
+      authType: lambda.FunctionUrlAuthType.NONE,
+      cors: {
+        allowedOrigins: ["*"]
+      }
+    });
+    new Output(scope, "AiVanityAskApiUrl", {
+      value: this.askAiUrl.url
+    });
+    new Output(scope, "AiVanitySummarizeApiUrl", {
+      value: this.summarizeAiUrl.url
+    });
+    new Output(scope, "AiAskApiUrl", {
+      value: `https://${props.domain}/ai/ask`
+    });
+    new Output(scope, "AiSummarizeApiUrl", {
+      value: `https://${props.domain}/ai/summary`
+    });
+  }
+}
+
+// src/cloud/cdn.ts
+import {Duration as Duration2, Fn, CfnOutput as Output2, aws_cloudfront as cloudfront, aws_cloudfront_origins as origins, aws_route53 as route53, aws_route53_targets as targets} from "aws-cdk-lib";
+import {config as config6} from "@stacksjs/config";
+
+// /Users/chrisbreuer/Code/stacks/storage/framework/core/storage/dist/index.js
+import {detectIndent, detectNewline} from "@stacksjs/strings";
+import {dirname, join as join2, path as p2} from "@stacksjs/path";
+
+// /Users/chrisbreuer/Code/stacks/storage/framework/core/arrays/dist/index.js
+import {clamp} from "@stacksjs/utils";
+var toArray = function(array) {
+  array = array ?? [];
+  return Array.isArray(array) ? array : [array];
+};
+var flatten = function(array) {
+  return toArray(array).flat(1);
+};
+var mergeArrayable = function(...args) {
+  return args.flatMap((i) => toArray(i));
+};
+var partition = function(array, ...filters) {
+  const result = Array.from({ length: filters.length + 1 }).fill(null).map(() => []);
+  array.forEach((e, idx, arr) => {
+    let i = 0;
+    for (const filter of filters) {
+      if (filter(e, idx, arr)) {
+        result[i].push(e);
+        return;
+      }
+      i += 1;
+    }
+    result[i].push(e);
+  });
+  return result;
+};
+var uniq = function(array) {
+  return Array.from(new Set(array));
+};
+var unique = function(array) {
+  return uniq(array);
+};
+var uniqueBy = function(array, equalFn) {
+  return array.reduce((acc, cur) => {
+    const index = acc.findIndex((item) => equalFn(cur, item));
+    if (index === -1)
+      acc.push(cur);
+    return acc;
+  }, []);
+};
+var last = function(array) {
+  return at(array, -1);
+};
+var remove = function(array, value) {
+  if (!array)
+    return false;
+  const index = array.indexOf(value);
+  if (index >= 0) {
+    array.splice(index, 1);
+    return true;
+  }
+  return false;
+};
+var at = function(array, index) {
+  const len = array.length;
+  if (!len)
+    return;
+  if (index < 0)
+    index += len;
+  return array[index];
+};
+var move = function(array, from, to) {
+  const len = array.length;
+  if (!len)
+    return [];
+  if (from < 0)
+    from += len;
+  if (to < 0)
+    to += len;
+  const item = array.splice(from, 1)[0];
+  array.splice(to, 0, item);
+  return array;
+};
+var clampArrayRange = function(arr, n) {
+  return clamp(n, 0, arr.length - 1);
+};
+var sample = function(arr, count) {
+  return Array.from({ length: count }, (_) => arr[Math.round(Math.random() * (arr.length - 1))]);
+};
+var shuffle = function(array) {
+  for (let i = array.length - 1;i > 0; i--) {
+    const j = Math.floor(Math.random() * (i + 1));
+    [array[i], array[j]] = [array[j], array[i]];
+  }
+  return array;
+};
+var average = function(arr) {
+  return sum(arr) / arr.length;
+};
+var avg = function(arr) {
+  return average(arr);
+};
+var median = function(arr) {
+  return arr[Math.floor(arr.length / 2)];
+};
+var mode = function(arr) {
+  return arr.sort((a, b) => arr.filter((v) => v === a).length - arr.filter((v) => v === b).length).pop();
+};
+var sum = function(array) {
+  return array.reduce((acc, cur) => acc + cur, 0);
+};
+var product = function(array) {
+  return array.reduce((acc, cur) => acc * cur, 1);
+};
+var min = function(array) {
+  return Math.min(...array);
+};
+var max = function(array) {
+  return Math.max(...array);
+};
+var range = function(array) {
+  return max(array) - min(array);
+};
+var variance = function(array) {
+  const mean = average(array);
+  return average(array.map((num) => (num - mean) ** 2));
+};
+var standardDeviation = function(array) {
+  return Math.sqrt(variance(array));
+};
+var zScore = function(array, num) {
+  return (num - average(array)) / standardDeviation(array);
+};
+var percentile = function(array, num) {
+  return array.filter((n) => n < num).length / array.length;
+};
+var interquartileRange = function(array) {
+  const q1 = median(array.slice(0, Math.floor(array.length / 2)));
+  const q3 = median(array.slice(Math.ceil(array.length / 2)));
+  return q3 - q1;
+};
+var covariance = function(array1, array2) {
+  const mean1 = average(array1);
+  const mean2 = average(array2);
+  return average(array1.map((num1, i) => (num1 - mean1) * (array2[i] - mean2)));
+};
+var contains = function(needle, haystack) {
+  return haystack.some((hay) => needle.includes(hay));
+};
+var containsAll = function(needles, haystack) {
+  return needles.every((needle) => contains(needle, haystack));
+};
+var containsAny = function(needles, haystack) {
+  return needles.some((needle) => contains(needle, haystack));
+};
+var containsNone = function(needles, haystack) {
+  return !containsAny(needles, haystack);
+};
+var containsOnly = function(needles, haystack) {
+  return containsAll(haystack, needles);
+};
+var doesNotContain = function(needle, haystack) {
+  return !contains(needle, haystack);
+};
+var __defProp = Object.defineProperty;
+var __export = (target, all) => {
+  for (var name in all)
+    __defProp(target, name, {
+      get: all[name],
+      enumerable: true,
+      configurable: true,
+      set: (newValue) => all[name] = () => newValue
+    });
+};
+var exports_arr = {};
+__export(exports_arr, {
+  zScore: () => {
+    {
+      return zScore;
+    }
+  },
+  variance: () => {
+    {
+      return variance;
+    }
+  },
+  uniqueBy: () => {
+    {
+      return uniqueBy;
+    }
+  },
+  unique: () => {
+    {
+      return unique;
+    }
+  },
+  uniq: () => {
+    {
+      return uniq;
+    }
+  },
+  toArray: () => {
+    {
+      return toArray;
+    }
+  },
+  sum: () => {
+    {
+      return sum;
+    }
+  },
+  standardDeviation: () => {
+    {
+      return standardDeviation;
+    }
+  },
+  shuffle: () => {
+    {
+      return shuffle;
+    }
+  },
+  sample: () => {
+    {
+      return sample;
+    }
+  },
+  remove: () => {
+    {
+      return remove;
+    }
+  },
+  range: () => {
+    {
+      return range;
+    }
+  },
+  product: () => {
+    {
+      return product;
+    }
+  },
+  percentile: () => {
+    {
+      return percentile;
+    }
+  },
+  partition: () => {
+    {
+      return partition;
+    }
+  },
+  move: () => {
+    {
+      return move;
+    }
+  },
+  mode: () => {
+    {
+      return mode;
+    }
+  },
+  min: () => {
+    {
+      return min;
+    }
+  },
+  mergeArrayable: () => {
+    {
+      return mergeArrayable;
+    }
+  },
+  median: () => {
+    {
+      return median;
+    }
+  },
+  max: () => {
+    {
+      return max;
+    }
+  },
+  last: () => {
+    {
+      return last;
+    }
+  },
+  interquartileRange: () => {
+    {
+      return interquartileRange;
+    }
+  },
+  flatten: () => {
+    {
+      return flatten;
+    }
+  },
+  doesNotContain: () => {
+    {
+      return doesNotContain;
+    }
+  },
+  covariance: () => {
+    {
+      return covariance;
+    }
+  },
+  containsOnly: () => {
+    {
+      return containsOnly;
+    }
+  },
+  containsNone: () => {
+    {
+      return containsNone;
+    }
+  },
+  containsAny: () => {
+    {
+      return containsAny;
+    }
+  },
+  containsAll: () => {
+    {
+      return containsAll;
+    }
+  },
+  contains: () => {
+    {
+      return contains;
+    }
+  },
+  clampArrayRange: () => {
+    {
+      return clampArrayRange;
+    }
+  },
+  avg: () => {
+    {
+      return avg;
+    }
+  },
+  average: () => {
+    {
+      return average;
+    }
+  },
+  at: () => {
+    {
+      return at;
+    }
+  }
+});
+
+// /Users/chrisbreuer/Code/stacks/storage/framework/core/storage/dist/index.js
+import {mkdirSync, writeFileSync} from "fs";
+import * as fs from "fs-extra";
+import {pathExists as existsSync2} from "fs-extra";
+async function exists(path3) {
+  return await existsSync2(path3);
+}
+async function readJsonFile(name, cwd) {
+  const file = await readTextFile(name, cwd);
+  const data = JSON.parse(file.data);
+  const indent = detectIndent(file.data).indent;
+  const newline = detectNewline(file.data);
+  return { ...file, data, indent, newline };
+}
+async function readPackageJson(name, cwd) {
+  const file = await readJsonFile(name, cwd);
+  return file.data;
+}
+async function writeFile(path22, data) {
+  if (typeof path22 === "string") {
+    const dirPath = dirname(path22);
+    if (!await existsSync2(dirPath))
+      await createFolder(dirPath);
+    return await Bun.write(Bun.file(path22), data);
+  }
+  return await Bun.write(path22, data);
+}
+async function writeJsonFile(file) {
+  let json = JSON.stringify(file.data, undefined, file.indent);
+  if (file.newline)
+    json += file.newline;
+  return writeTextFile({ ...file, data: json });
+}
+var readTextFile = function(name, cwd) {
+  return new Promise((resolve, reject) => {
+    let filePath;
+    if (cwd)
+      filePath = join2(cwd, name);
+    else
+      filePath = name;
+    fs.readFile(filePath, "utf8", (err2, text) => {
+      if (err2) {
+        reject(err2);
+      } else {
+        resolve({
+          path: filePath,
+          data: text
+        });
+      }
+    });
+  });
+};
+async function writeTextFile(file) {
+  return await Bun.write(file.path, file.data);
+}
+var isFile = function(path22) {
+  return fs.existsSync(path22);
+};
+var doesExist = function(path22) {
+  return !isFile(path22) || !isFolder(path22);
+};
+var doesNotExist = function(path22) {
+  return !isFile(path22) && !isFolder(path22);
+};
+var hasFiles = function(folder) {
+  try {
+    return fs.readdirSync(folder).length > 0;
+  } catch (err2) {
+    return false;
+  }
+};
+var hasComponents = function() {
+  return hasFiles(p2.componentsPath());
+};
+var hasFunctions = function() {
+  return hasFiles(p2.functionsPath());
+};
+var deleteFiles = function(dir, exclude = []) {
+  if (fs.existsSync(dir)) {
+    fs.readdirSync(dir).forEach((file) => {
+      const p22 = join2(dir, file);
+      if (fs.statSync(p22).isDirectory()) {
+        if (fs.readdirSync(p22).length === 0)
+          fs.rmSync(p22, { recursive: true, force: true });
+        else
+          deleteFiles(p22, exclude);
+      } else if (!contains(p22, exclude)) {
+        fs.rmSync(p22);
+      }
+    });
+  }
+};
+var getFiles = function(dir, exclude = []) {
+  let results = [];
+  const list = fs.readdirSync(dir);
+  list.forEach((file) => {
+    file = join2(dir, file);
+    const stat = fs.statSync(file);
+    if (stat && stat.isDirectory())
+      results = results.concat(getFiles(file, exclude));
+    else if (!contains(file, exclude))
+      results.push(file);
+  });
+  return results;
+};
+var put = function(path22, contents) {
+  const dirPath = dirname(path22);
+  if (!fs.existsSync(dirPath))
+    fs.mkdirSync(dirPath, { recursive: true });
+  fs.writeFileSync(path22, contents, "utf-8");
+};
+async function get(path22) {
+  return Bun.file(path22).text();
+}
+import {join as join3} from "@stacksjs/path";
+var isFolder2 = function(path32) {
+  try {
+    return fs.statSync(path32).isDirectory();
+  } catch {
+    return false;
+  }
+};
+var isDirectory = function(path32) {
+  return isFolder2(path32);
+};
+var isDir = function(path32) {
+  return isFolder2(path32);
+};
+var doesFolderExist = function(path32) {
+  return fs.existsSync(path32);
+};
+var createFolder2 = function(dir) {
+  return new Promise((resolve, reject) => {
+    fs.mkdirs(dir, (err2) => {
+      if (err2)
+        reject(err2);
+      else
+        resolve();
+    });
+  });
+};
+var getFolders = function(dir) {
+  return fs.readdirSync(dir).filter((file) => {
+    return fs.statSync(join3(dir, file)).isDirectory();
+  });
+};
+import {createHash} from "crypto";
+import {path as p22} from "@stacksjs/path";
+import {fileURLToPath} from "url";
+import {dirname as dirname2} from "@stacksjs/path";
+var updateConfigFile = function(filePath, newConfig) {
+  return new Promise((resolve, reject) => {
+    const config5 = JSON.parse(fs.readFileSync(filePath, "utf8"));
+    for (const key in newConfig)
+      config5[key] = newConfig[key];
+    try {
+      fs.writeFileSync(filePath, JSON.stringify(config5, null, 2));
+      resolve();
+    } catch (error) {
+      reject(error);
+    }
+  });
+};
+import {join as join4} from "@stacksjs/path";
+var copy = function(src, dest, exclude = []) {
+  if (Array.isArray(src)) {
+    src.forEach((file) => {
+      copy(file, dest, exclude);
+    });
+  } else {
+    if (fs.statSync(src).isDirectory())
+      copyFolder(src, dest, exclude);
+    else
+      copyFile(src, dest);
+  }
+};
+var copyFile = function(src, dest) {
+  fs.copyFileSync(src, dest);
+};
+var copyFolder = function(src, dest, exclude = []) {
+  if (!fs.existsSync(dest))
+    fs.mkdirSync(dest, { recursive: true });
+  if (fs.existsSync(src)) {
+    fs.readdirSync(src).forEach((file) => {
+      if (!contains(join4(src, file), exclude)) {
+        const srcPath = join4(src, file);
+        const destPath = join4(dest, file);
+        if (fs.statSync(srcPath).isDirectory())
+          copyFolder(srcPath, destPath, exclude);
+        else
+          fs.copyFileSync(srcPath, destPath);
+      }
+    });
+  }
+};
+import {default as default2} from "fast-glob";
+import {err as err2, ok as ok2} from "@stacksjs/error-handling";
+import {italic, log as log2} from "@stacksjs/cli";
+var deleteFolder = function(path62) {
+  return new Promise((resolve, reject) => {
+    try {
+      if (isFolder2(path62)) {
+        fs.rmSync(path62, { recursive: true, force: true });
+        return resolve(ok2(`Deleted ${path62}`));
+      }
+      return resolve(ok2(`Path ${path62} was not a directory`));
+    } catch (error) {
+      return reject(err2(error));
+    }
+  });
+};
+async function isDirectoryEmpty(path62) {
+  return new Promise((resolve, reject) => {
+    try {
+      if (fs.statSync(path62).isDirectory()) {
+        if (fs.readdirSync(path62).length === 0)
+          return resolve(ok2(true));
+        else
+          return resolve(ok2(false));
+      }
+      return resolve(ok2(false));
+    } catch (error) {
+      return reject(err2(error));
+    }
+  });
+}
+async function deleteEmptyFolder(path62) {
+  return new Promise((resolve, reject) => {
+    try {
+      if (fs.statSync(path62).isDirectory()) {
+        if (fs.readdirSync(path62).length === 0) {
+          fs.rmSync(path62, { recursive: true, force: true });
+          return resolve(ok2(`Deleted ${path62}`));
+        } else {
+          return resolve(ok2(`Path ${path62} was not empty`));
+        }
+      }
+      return resolve(ok2(`Path ${path62} was not a directory`));
+    } catch (error) {
+      return reject(err2(error));
+    }
+  });
+}
+async function deleteEmptyFolders(dir) {
+  try {
+    if (!fs.existsSync(dir))
+      return ok2(`Path ${dir} does not exist`);
+    const files3 = fs.readdirSync(dir);
+    for (const file of files3) {
+      const p3 = join(dir, file);
+      if (isFolder2(p3)) {
+        if (fs.readdirSync(p3).length === 0)
+          fs.rmSync(p3, { recursive: true, force: true });
+        else
+          await deleteEmptyFolders(p3);
+      }
+    }
+    return ok2(`Deleted empty folders located in ${dir}`);
+  } catch (error) {
+    return err2(error);
+  }
+}
+var deleteFile = function(path62) {
+  return new Promise((resolve, reject) => {
+    try {
+      if (isFile(path62)) {
+        fs.rmSync(path62, { recursive: true, force: true });
+        return resolve(ok2(`Deleted ${path62}`));
+      }
+      return resolve(ok2(`Path ${path62} was not a file`));
+    } catch (error) {
+      return reject(err2(error));
+    }
+  });
+};
+async function deleteGlob(path62) {
+  if (!path62.includes("*"))
+    return err2(handleError(`Path ${path62} does not contain a glob`));
+  const directories = await default2([path62], { onlyDirectories: true });
+  for (const directory of directories) {
+    const result = await deleteFolder(directory);
+    if (result.isErr()) {
+      log2.error(result.error);
+      return result;
+    }
+    log2.info(`Deleted ${italic(directory)}`);
+  }
+  return ok2(`Deleted ${directories.length} directories`);
+}
+async function del(path62) {
+  if (isFile(path62))
+    return await deleteFile(path62);
+  if (isFolder2(path62))
+    return await deleteFolder(path62);
+  if (path62.includes("*"))
+    return await deleteGlob(path62);
+  return err2(handleError(`Path ${path62} cannot be deleted due to an unhandled condition. Please report this issue.`));
+}
+import {runCommand} from "@stacksjs/cli";
+async function zip(from, to, options) {
+  const toPath = to || "archive.zip";
+  const fromPath = Array.isArray(from) ? from.join(" ") : from;
+  if (Array.isArray(from))
+    return runCommand(`zip -r ${toPath} ${fromPath}`, options);
+  return runCommand(`zip -r ${to} ${from}`, options);
+}
+async function unzip(paths) {
+  if (Array.isArray(paths))
+    return runCommand(`unzip ${paths.join(" ")}`);
+  return runCommand(`unzip ${paths}`);
+}
+var archive = function(paths) {
+  return zip(paths);
+};
+var unarchive = function(paths) {
+  return unzip(paths);
+};
+var compress = function(paths) {
+  return zip(paths);
+};
+var decompress = function(paths) {
+  return unzip(paths);
+};
+var gzipSync = function(data, options) {
+  return Bun.gzipSync(data, options);
+};
+var gunzipSync = function(data) {
+  return Bun.gunzipSync(data);
+};
+var deflateSync = function(data, options) {
+  return Bun.deflateSync(data, options);
+};
+var inflateSync = function(data) {
+  return Bun.inflateSync(data);
+};
+import {err as err22, ok as ok22} from "@stacksjs/error-handling";
+import {log as log22} from "@stacksjs/logging";
+import {path as path72} from "@stacksjs/path";
+async function move2(src, dest, options) {
+  try {
+    if (Array.isArray(src)) {
+      const operations = src.map(async (file) => {
+        const from2 = file;
+        const to2 = path72.resolve(dest, path72.basename(file));
+        const result2 = await rename(from2, to2, options);
+        if (result2.isErr()) {
+          log22.error(result2.error);
+          return err22(handleError(result2.error.message, result2.error));
+        }
+      });
+      await Promise.all(operations);
+      return ok22({ message: "Files moved successfully" });
+    }
+    const from = src;
+    const to = dest;
+    const result = await rename(from, to, options);
+    if (result.isErr()) {
+      log22.error(result.error);
+      return err22(handleError(result.error));
+    }
+    return ok22({ message: "File moved successfully" });
+  } catch (error) {
+    return err22(handleError(error));
+  }
+}
+async function rename(from, to, options) {
+  return new Promise((resolve, reject) => {
+    try {
+      const dir = path72.dirname(to);
+      if (!fs.existsSync(dir))
+        fs.mkdirSync(dir, { recursive: true });
+      if (!fs.existsSync(from))
+        return reject(err22(new Error(`File or directory does not exist: ${from}`)));
+      if (fs.existsSync(to)) {
+        if (!options?.overwrite)
+          return reject(err22(new Error(`File or directory already exists: ${to}`)));
+        fs.unlinkSync(to);
+      }
+      fs.renameSync(from, to);
+      return resolve(ok22({ message: "File moved successfully" }));
+    } catch (error) {
+      if (error.code === "ENOENT")
+        log22.error("File or directory does not exist\n\n", error);
+      else
+        log22.error(error);
+      return reject(err22(new Error(error)));
+    }
+  });
+}
+var setVisibility = function() {
+  return "wip";
+};
+var __defProp2 = Object.defineProperty;
+var __export2 = (target, all) => {
+  for (var name in all)
+    __defProp2(target, name, {
+      get: all[name],
+      enumerable: true,
+      configurable: true,
+      set: (newValue) => all[name] = () => newValue
+    });
+};
+var files = {
+  readJsonFile,
+  readPackageJson,
+  readTextFile,
+  writeJsonFile,
+  writeTextFile,
+  isFile,
+  hasFiles,
+  hasComponents,
+  hasFunctions,
+  deleteFiles,
+  getFiles,
+  put,
+  get
+};
+var folders = {
+  isFolder: isFolder2,
+  doesFolderExist,
+  createFolder: createFolder2,
+  getFolders
+};
+var __dirname2 = "/Users/chrisbreuer/Code/stacks/storage/framework/core/storage/src";
+var _dirname = typeof __dirname2 !== "undefined" ? __dirname2 : dirname2(fileURLToPath(import.meta.url));
+var helpers = {
+  _dirname,
+  updateConfigFile
+};
+var exports_storage = {};
+__export2(exports_storage, {
+  zip: () => {
+    {
+      return zip;
+    }
+  },
+  writeTextFile: () => {
+    {
+      return writeTextFile;
+    }
+  },
+  writeJsonFile: () => {
+    {
+      return writeJsonFile;
+    }
+  },
+  writeFileSync: () => {
+    {
+      return writeFileSync;
+    }
+  },
+  writeFile: () => {
+    {
+      return writeFile;
+    }
+  },
+  updateConfigFile: () => {
+    {
+      return updateConfigFile;
+    }
+  },
+  unzip: () => {
+    {
+      return unzip;
+    }
+  },
+  unarchive: () => {
+    {
+      return unarchive;
+    }
+  },
+  setVisibility: () => {
+    {
+      return setVisibility;
+    }
+  },
+  rename: () => {
+    {
+      return rename;
+    }
+  },
+  readTextFile: () => {
+    {
+      return readTextFile;
+    }
+  },
+  readPackageJson: () => {
+    {
+      return readPackageJson;
+    }
+  },
+  readJsonFile: () => {
+    {
+      return readJsonFile;
+    }
+  },
+  put: () => {
+    {
+      return put;
+    }
+  },
+  move: () => {
+    {
+      return move2;
+    }
+  },
+  mkdirSync: () => {
+    {
+      return mkdirSync;
+    }
+  },
+  isFolder: () => {
+    {
+      return isFolder2;
+    }
+  },
+  isFile: () => {
+    {
+      return isFile;
+    }
+  },
+  isDirectoryEmpty: () => {
+    {
+      return isDirectoryEmpty;
+    }
+  },
+  isDirectory: () => {
+    {
+      return isDirectory;
+    }
+  },
+  isDir: () => {
+    {
+      return isDir;
+    }
+  },
+  inflateSync: () => {
+    {
+      return inflateSync;
+    }
+  },
+  helpers: () => {
+    {
+      return helpers;
+    }
+  },
+  hasFunctions: () => {
+    {
+      return hasFunctions;
+    }
+  },
+  hasFiles: () => {
+    {
+      return hasFiles;
+    }
+  },
+  hasComponents: () => {
+    {
+      return hasComponents;
+    }
+  },
+  gzipSync: () => {
+    {
+      return gzipSync;
+    }
+  },
+  gunzipSync: () => {
+    {
+      return gunzipSync;
+    }
+  },
+  getFolders: () => {
+    {
+      return getFolders;
+    }
+  },
+  getFiles: () => {
+    {
+      return getFiles;
+    }
+  },
+  get: () => {
+    {
+      return get;
+    }
+  },
+  fs: () => {
+    {
+      return fs;
+    }
+  },
+  folders: () => {
+    {
+      return folders;
+    }
+  },
+  files: () => {
+    {
+      return files;
+    }
+  },
+  existsSync: () => {
+    {
+      return existsSync2;
+    }
+  },
+  exists: () => {
+    {
+      return exists;
+    }
+  },
+  doesNotExist: () => {
+    {
+      return doesNotExist;
+    }
+  },
+  doesFolderExist: () => {
+    {
+      return doesFolderExist;
+    }
+  },
+  doesExist: () => {
+    {
+      return doesExist;
+    }
+  },
+  deleteGlob: () => {
+    {
+      return deleteGlob;
+    }
+  },
+  deleteFolder: () => {
+    {
+      return deleteFolder;
+    }
+  },
+  deleteFiles: () => {
+    {
+      return deleteFiles;
+    }
+  },
+  deleteFile: () => {
+    {
+      return deleteFile;
+    }
+  },
+  deleteEmptyFolders: () => {
+    {
+      return deleteEmptyFolders;
+    }
+  },
+  deleteEmptyFolder: () => {
+    {
+      return deleteEmptyFolder;
+    }
+  },
+  del: () => {
+    {
+      return del;
+    }
+  },
+  deflateSync: () => {
+    {
+      return deflateSync;
+    }
+  },
+  decompress: () => {
+    {
+      return decompress;
+    }
+  },
+  createFolder: () => {
+    {
+      return createFolder2;
+    }
+  },
+  copyFolder: () => {
+    {
+      return copyFolder;
+    }
+  },
+  copyFile: () => {
+    {
+      return copyFile;
+    }
+  },
+  copy: () => {
+    {
+      return copy;
+    }
+  },
+  compress: () => {
+    {
+      return compress;
+    }
+  },
+  archive: () => {
+    {
+      return archive;
+    }
+  },
+  _dirname: () => {
+    {
+      return _dirname;
+    }
+  }
+});
+
+// src/cloud/cdn.ts
+import {path as p3} from "@stacksjs/path";
+import {env as env2} from "@stacksjs/env";
+
+class CdnStack {
+  distribution;
+  originAccessIdentity;
+  cdnCachePolicy;
+  apiCachePolicy;
+  vanityUrl;
+  props;
+  constructor(scope, props) {
+    this.props = props;
+    this.originAccessIdentity = new cloudfront.OriginAccessIdentity(scope, "OAI");
+    this.cdnCachePolicy = new cloudfront.CachePolicy(scope, "CdnCachePolicy", {
+      comment: "Stacks CDN Cache Policy",
+      cachePolicyName: `${props.slug}-${props.appEnv}-cdn-cache-policy`,
+      minTtl: config6.cloud.cdn?.minTtl ? Duration2.seconds(config6.cloud.cdn.minTtl) : undefined,
+      defaultTtl: config6.cloud.cdn?.defaultTtl ? Duration2.seconds(config6.cloud.cdn.defaultTtl) : undefined,
+      maxTtl: config6.cloud.cdn?.maxTtl ? Duration2.seconds(config6.cloud.cdn.maxTtl) : undefined,
+      cookieBehavior: this.getCookieBehavior(config6.cloud.cdn?.cookieBehavior)
+    });
+    this.distribution = new cloudfront.Distribution(scope, "Cdn", {
+      domainNames: [props.domain],
+      defaultRootObject: "index.html",
+      comment: `CDN for ${config6.app.url}`,
+      certificate: props.certificate,
+      enableLogging: true,
+      logBucket: props.logBucket,
+      httpVersion: cloudfront.HttpVersion.HTTP2_AND_3,
+      priceClass: cloudfront.PriceClass.PRICE_CLASS_ALL,
+      enabled: true,
+      minimumProtocolVersion: cloudfront.SecurityPolicyProtocol.TLS_V1_2_2021,
+      webAclId: props.firewall.attrArn,
+      enableIpv6: true,
+      defaultBehavior: {
+        origin: new origins.S3Origin(props.publicBucket, {
+          originAccessIdentity: this.originAccessIdentity
+        }),
+        edgeLambdas: [
+          {
+            eventType: cloudfront.LambdaEdgeEventType.ORIGIN_REQUEST,
+            functionVersion: props.originRequestFunction.currentVersion
+          }
+        ],
+        compress: config6.cloud.cdn?.compress,
+        allowedMethods: this.allowedMethods(),
+        cachedMethods: this.cachedMethods(),
+        viewerProtocolPolicy: cloudfront.ViewerProtocolPolicy.REDIRECT_TO_HTTPS,
+        cachePolicy: this.cdnCachePolicy
+      },
+      additionalBehaviors: this.additionalBehaviors(scope, props),
+      errorResponses: [
+        {
+          httpStatus: 403,
+          responsePagePath: "/index.html",
+          responseHttpStatus: 200,
+          ttl: Duration2.seconds(0)
+        }
+      ]
+    });
+    new route53.ARecord(scope, "AliasRecord", {
+      recordName: props.domain,
+      zone: props.zone,
+      target: route53.RecordTarget.fromAlias(new targets.CloudFrontTarget(this.distribution))
+    });
+    new Output2(scope, "DistributionId", {
+      value: this.distribution.distributionId
+    });
+    new Output2(scope, "AppUrl", {
+      value: `https://${props.domain}`,
+      description: "The URL of the deployed application"
+    });
+    this.vanityUrl = `https://${this.distribution.domainName}`;
+    new Output2(scope, "AppVanityUrl", {
+      value: this.vanityUrl,
+      description: "The vanity URL of the deployed application"
+    });
+  }
+  getCookieBehavior(behavior) {
+    switch (behavior) {
+      case "all":
+        return cloudfront.CacheCookieBehavior.all();
+      case "none":
+        return cloudfront.CacheCookieBehavior.none();
+      case "allowList":
+        return cloudfront.CacheCookieBehavior.allowList(...config6.cloud.cdn?.allowList.cookies || []);
+      default:
+        return;
+    }
+  }
+  allowedMethods() {
+    switch (config6.cloud.cdn?.allowedMethods) {
+      case "ALL":
+        return cloudfront.AllowedMethods.ALLOW_ALL;
+      case "GET_HEAD":
+        return cloudfront.AllowedMethods.ALLOW_GET_HEAD;
+      case "GET_HEAD_OPTIONS":
+        return cloudfront.AllowedMethods.ALLOW_GET_HEAD_OPTIONS;
+      default:
+        return cloudfront.AllowedMethods.ALLOW_ALL;
+    }
+  }
+  cachedMethods() {
+    switch (config6.cloud.cdn?.cachedMethods) {
+      case "GET_HEAD":
+        return cloudfront.CachedMethods.CACHE_GET_HEAD;
+      case "GET_HEAD_OPTIONS":
+        return cloudfront.CachedMethods.CACHE_GET_HEAD_OPTIONS;
+      default:
+        return cloudfront.CachedMethods.CACHE_GET_HEAD;
+    }
+  }
+  allowedMethodsFromString(methods) {
+    if (!methods)
+      return cloudfront.AllowedMethods.ALLOW_ALL;
+    switch (methods) {
+      case "ALL":
+        return cloudfront.AllowedMethods.ALLOW_ALL;
+      case "GET_HEAD":
+        return cloudfront.AllowedMethods.ALLOW_GET_HEAD;
+      case "GET_HEAD_OPTIONS":
+        return cloudfront.AllowedMethods.ALLOW_GET_HEAD_OPTIONS;
+      default:
+        return cloudfront.AllowedMethods.ALLOW_ALL;
+    }
+  }
+  cachedMethodsFromString(methods) {
+    if (!methods)
+      return cloudfront.CachedMethods.CACHE_GET_HEAD;
+    switch (methods) {
+      case "GET_HEAD":
+        return cloudfront.CachedMethods.CACHE_GET_HEAD;
+      case "GET_HEAD_OPTIONS":
+        return cloudfront.CachedMethods.CACHE_GET_HEAD_OPTIONS;
+      default:
+        return cloudfront.CachedMethods.CACHE_GET_HEAD;
+    }
+  }
+  shouldDeployApi() {
+    return config6.cloud.api;
+  }
+  apiBehaviorOptions(scope, props) {
+    const hostname = Fn.select(2, Fn.split("/", props.webServerUrl.url));
+    const origin = (path9 = "/api") => {
+      return new origins.HttpOrigin(hostname, {
+        originPath: path9,
+        protocolPolicy: cloudfront.OriginProtocolPolicy.HTTPS_ONLY
+      });
+    };
+    return {
+      "/api": {
+        origin: origin(),
+        compress: true,
+        allowedMethods: cloudfront.AllowedMethods.ALLOW_ALL,
+        cachedMethods: cloudfront.CachedMethods.CACHE_GET_HEAD_OPTIONS,
+        cachePolicy: this.setApiCachePolicy(scope),
+        viewerProtocolPolicy: cloudfront.ViewerProtocolPolicy.REDIRECT_TO_HTTPS
+      },
+      "/api/*": {
+        origin: origin("/api/*"),
+        compress: true,
+        allowedMethods: cloudfront.AllowedMethods.ALLOW_ALL,
+        cachedMethods: cloudfront.CachedMethods.CACHE_GET_HEAD_OPTIONS,
+        cachePolicy: this.apiCachePolicy,
+        viewerProtocolPolicy: cloudfront.ViewerProtocolPolicy.REDIRECT_TO_HTTPS
+      }
+    };
+  }
+  docsBehaviorOptions(props) {
+    return {
+      "/docs": {
+        origin: new origins.S3Origin(props.publicBucket, {
+          originAccessIdentity: this.originAccessIdentity,
+          originPath: "/docs"
+        }),
+        compress: true,
+        allowedMethods: this.allowedMethodsFromString(config6.cloud.cdn?.allowedMethods),
+        cachedMethods: this.cachedMethodsFromString(config6.cloud.cdn?.cachedMethods),
+        viewerProtocolPolicy: cloudfront.ViewerProtocolPolicy.REDIRECT_TO_HTTPS,
+        cachePolicy: cloudfront.CachePolicy.CACHING_OPTIMIZED
+      },
+      "/docs/*": {
+        origin: new origins.S3Origin(props.publicBucket, {
+          originAccessIdentity: this.originAccessIdentity,
+          originPath: "/docs"
+        }),
+        compress: true,
+        allowedMethods: this.allowedMethodsFromString(config6.cloud.cdn?.allowedMethods),
+        cachedMethods: this.cachedMethodsFromString(config6.cloud.cdn?.cachedMethods),
+        viewerProtocolPolicy: cloudfront.ViewerProtocolPolicy.REDIRECT_TO_HTTPS,
+        cachePolicy: cloudfront.CachePolicy.CACHING_OPTIMIZED
+      }
+    };
+  }
+  aiBehaviorOptions(scope, props) {
+    const hostname = Fn.select(2, Fn.split("/", props.askAiUrl.url));
+    const summaryHostname = Fn.select(2, Fn.split("/", props.summarizeAiUrl.url));
+    const aiCachePolicy = new cloudfront.CachePolicy(scope, "AiCachePolicy", {
+      comment: "Stacks AI Cache Policy",
+      cachePolicyName: `${this.props.slug}-${this.props.appEnv}-ai-cache-policy`,
+      defaultTtl: Duration2.seconds(0),
+      cookieBehavior: cloudfront.CacheCookieBehavior.none(),
+      headerBehavior: cloudfront.CacheHeaderBehavior.allowList("Accept", "x-api-key", "Authorization", "Content-Type"),
+      queryStringBehavior: cloudfront.CacheQueryStringBehavior.all()
+    });
+    return {
+      "/ai/ask": {
+        origin: new origins.HttpOrigin(hostname, {
+          originPath: "/ai",
+          protocolPolicy: cloudfront.OriginProtocolPolicy.HTTPS_ONLY
+        }),
+        compress: false,
+        allowedMethods: cloudfront.AllowedMethods.ALLOW_ALL,
+        viewerProtocolPolicy: cloudfront.ViewerProtocolPolicy.REDIRECT_TO_HTTPS,
+        cachePolicy: aiCachePolicy
+      },
+      "/ai/summary": {
+        origin: new origins.HttpOrigin(summaryHostname, {
+          originPath: "/ai",
+          protocolPolicy: cloudfront.OriginProtocolPolicy.HTTPS_ONLY
+        }),
+        compress: false,
+        allowedMethods: cloudfront.AllowedMethods.ALLOW_ALL,
+        viewerProtocolPolicy: cloudfront.ViewerProtocolPolicy.REDIRECT_TO_HTTPS,
+        cachePolicy: aiCachePolicy
+      }
+    };
+  }
+  cliSetupBehaviorOptions(scope, props) {
+    const hostname = Fn.select(2, Fn.split("/", props.cliSetupUrl.url));
+    return {
+      "/install": {
+        origin: new origins.HttpOrigin(hostname, {
+          originPath: "/cli-setup",
+          protocolPolicy: cloudfront.OriginProtocolPolicy.HTTPS_ONLY
+        }),
+        compress: false,
+        allowedMethods: cloudfront.AllowedMethods.ALLOW_ALL,
+        viewerProtocolPolicy: cloudfront.ViewerProtocolPolicy.REDIRECT_TO_HTTPS,
+        cachePolicy: new cloudfront.CachePolicy(scope, "CliSetupCachePolicy", {
+          comment: "Stacks CLI Setup Cache Policy",
+          cachePolicyName: `${this.props.slug}-${this.props.appEnv}-cli-setup-cache-policy`,
+          defaultTtl: Duration2.seconds(0),
+          cookieBehavior: cloudfront.CacheCookieBehavior.none(),
+          headerBehavior: cloudfront.CacheHeaderBehavior.none(),
+          queryStringBehavior: cloudfront.CacheQueryStringBehavior.none()
+        })
+      }
+    };
+  }
+  shouldDeployAiEndpoints() {
+    return config6.cloud.ai;
+  }
+  shouldDeployCliSetup() {
+    return config6.cloud.cli;
+  }
+  shouldDeployDocs() {
+    return hasFiles(p3.projectPath("docs"));
+  }
+  additionalBehaviors(scope, props) {
+    let behaviorOptions = {};
+    if (this.shouldDeployApi()) {
+      const keysToRemove = ["_HANDLER", "_X_AMZN_TRACE_ID", "AWS_REGION", "AWS_EXECUTION_ENV", "AWS_LAMBDA_FUNCTION_NAME", "AWS_LAMBDA_FUNCTION_MEMORY_SIZE", "AWS_LAMBDA_FUNCTION_VERSION", "AWS_LAMBDA_INITIALIZATION_TYPE", "AWS_LAMBDA_LOG_GROUP_NAME", "AWS_LAMBDA_LOG_STREAM_NAME", "AWS_ACCESS_KEY", "AWS_ACCESS_KEY_ID", "AWS_SECRET_ACCESS_KEY", "AWS_SESSION_TOKEN", "AWS_LAMBDA_RUNTIME_API", "LAMBDA_TASK_ROOT", "LAMBDA_RUNTIME_DIR", "_"];
+      keysToRemove.forEach((key) => delete env2[key]);
+      behaviorOptions = this.apiBehaviorOptions(scope, props);
+    }
+    if (this.shouldDeployDocs() && !config6.app.docMode) {
+      behaviorOptions = {
+        ...this.docsBehaviorOptions(props),
+        ...behaviorOptions
+      };
+    }
+    if (this.shouldDeployAiEndpoints()) {
+      behaviorOptions = {
+        ...this.aiBehaviorOptions(scope, props),
+        ...behaviorOptions
+      };
+    }
+    if (this.shouldDeployCliSetup()) {
+      behaviorOptions = {
+        ...this.cliSetupBehaviorOptions(scope, props),
+        ...behaviorOptions
+      };
+    }
+    return behaviorOptions;
+  }
+  setApiCachePolicy(scope) {
+    if (this.apiCachePolicy)
+      return this.apiCachePolicy;
+    this.apiCachePolicy = new cloudfront.CachePolicy(scope, "ApiCachePolicy", {
+      comment: "Stacks API Cache Policy",
+      cachePolicyName: `${this.props.slug}-${this.props.appEnv}-api-cache-policy`,
+      defaultTtl: Duration2.seconds(0),
+      cookieBehavior: cloudfront.CacheCookieBehavior.none(),
+      headerBehavior: cloudfront.CacheHeaderBehavior.allowList("Accept", "x-api-key", "Authorization", "Content-Type"),
+      queryStringBehavior: cloudfront.CacheQueryStringBehavior.none()
+    });
+    return this.apiCachePolicy;
+  }
+}
+
+// src/cloud/cli.ts
+import {Duration as Duration3, CfnOutput as Output3, aws_lambda as lambda2} from "aws-cdk-lib";
+
+class CliStack {
+  cliSetupUrl;
+  constructor(scope, props) {
+    const cliSetupFunc = new lambda2.Function(scope, "CliSetupFunction", {
+      functionName: `${props.slug}-${props.appEnv}-cli-setup`,
+      description: "Lambda function that triggers setup script for a Stacks project",
+      runtime: lambda2.Runtime.NODEJS_20_X,
+      handler: "index.handler",
+      code: lambda2.Code.fromAsset("src/cloud/lambda/cli-setup"),
+      timeout: Duration3.seconds(30)
+    });
+    this.cliSetupUrl = new lambda2.FunctionUrl(scope, "CliSetupFunctionUrl", {
+      function: cliSetupFunc,
+      authType: lambda2.FunctionUrlAuthType.NONE,
+      cors: {
+        allowedOrigins: ["*"]
+      }
+    });
+    new Output3(scope, "CliSetupVanityUrl", {
+      value: `${this.cliSetupUrl.url}cli-setup`
+    });
+    new Output3(scope, "CliSetupUrl", {
+      value: `https://${props.domain}/install`,
+      description: "URL to trigger the CLI setup function"
+    });
+  }
+}
+
+// src/cloud/dns.ts
+import {RemovalPolicy, aws_route53 as route532, aws_s3 as s3, aws_route53_targets as targets2} from "aws-cdk-lib";
+
+class DnsStack {
+  zone;
+  constructor(scope, props) {
+    this.zone = route532.PublicHostedZone.fromLookup(scope, "AppUrlHostedZone", {
+      domainName: props.domain
+    });
+    const wwwBucket = new s3.Bucket(scope, "WwwBucket", {
+      bucketName: `www.${props.domain}`,
+      websiteRedirect: {
+        hostName: props.domain,
+        protocol: s3.RedirectProtocol.HTTPS
+      },
+      removalPolicy: RemovalPolicy.DESTROY,
+      autoDeleteObjects: true
+    });
+    new route532.ARecord(scope, "WwwAliasRecord", {
+      recordName: `www.${props.domain}`,
+      zone: this.zone,
+      target: route532.RecordTarget.fromAlias(new targets2.BucketWebsiteTarget(wwwBucket))
+    });
+  }
+}
+
+// src/cloud/docs.ts
+import {AssetHashType, CfnOutput as Output4, RemovalPolicy as RemovalPolicy2, aws_lambda as lambda3} from "aws-cdk-lib";
+import {config as config8} from "@stacksjs/config";
+import {path as p4} from "@stacksjs/path";
+import {originRequestFunctionHash} from "@stacksjs/utils";
+
+class DocsStack {
+  originRequestFunction;
+  constructor(scope, props) {
+    const docsPrefix = config8.app.docMode ? "" : config8.docs.base;
+    this.originRequestFunction = new lambda3.Function(scope, "OriginRequestFunction", {
+      functionName: `${props.slug}-${props.appEnv}-origin-request-${props.timestamp}`,
+      description: "The Stacks Origin Request function that prettifies URLs",
+      runtime: lambda3.Runtime.NODEJS_18_X,
+      handler: "dist/origin-request.handler",
+      code: lambda3.Code.fromAsset(p4.corePath("cloud/dist.zip"), {
+        assetHash: originRequestFunctionHash,
+        assetHashType: AssetHashType.CUSTOM
+      })
+    });
+    const cfnOriginRequestFunction = this.originRequestFunction.node.defaultChild;
+    cfnOriginRequestFunction.applyRemovalPolicy(RemovalPolicy2.RETAIN);
+    if (!config8.app.docMode && exports_storage.hasFiles(p4.projectPath("docs"))) {
+      new Output4(scope, "DocsUrl", {
+        value: `https://${props.domain}/${docsPrefix}`,
+        description: "The URL of the deployed documentation"
+      });
+    }
+  }
+}
+
+// src/cloud/storage.ts
+import {RemovalPolicy as RemovalPolicy3, Tags, aws_backup as backup, aws_iam as iam2, aws_s3 as s32} from "aws-cdk-lib";
+
+class StorageStack {
+  publicBucket;
+  privateBucket;
+  logBucket;
+  bucketPrefix;
+  vault;
+  backupPlan;
+  backupRole;
+  constructor(scope, props) {
+    this.bucketPrefix = `${props.slug}-${props.appEnv}`;
+    this.publicBucket = new s32.Bucket(scope, "PublicBucket", {
+      bucketName: `${this.bucketPrefix}-public-${props.timestamp}`,
+      versioned: true,
+      autoDeleteObjects: true,
+      removalPolicy: RemovalPolicy3.DESTROY,
+      encryption: s32.BucketEncryption.S3_MANAGED
+    });
+    Tags.of(this.publicBucket).add("daily-backup", "true");
+    this.privateBucket = new s32.Bucket(scope, "PrivateBucket", {
+      bucketName: `${this.bucketPrefix}-private-${props.timestamp}`,
+      versioned: true,
+      removalPolicy: RemovalPolicy3.DESTROY,
+      autoDeleteObjects: true,
+      encryption: s32.BucketEncryption.S3_MANAGED,
+      enforceSSL: true,
+      publicReadAccess: false,
+      blockPublicAccess: {
+        blockPublicAcls: true,
+        blockPublicPolicy: true,
+        ignorePublicAcls: true,
+        restrictPublicBuckets: true
+      }
+    });
+    Tags.of(this.privateBucket).add("daily-backup", "true");
+    this.logBucket = new s32.Bucket(scope, "LogsBucket", {
+      bucketName: `${this.bucketPrefix}-logs-${props.timestamp}`,
+      removalPolicy: RemovalPolicy3.RETAIN,
+      blockPublicAccess: new s32.BlockPublicAccess({
+        blockPublicAcls: false,
+        ignorePublicAcls: true,
+        blockPublicPolicy: true,
+        restrictPublicBuckets: true
+      }),
+      objectOwnership: s32.ObjectOwnership.BUCKET_OWNER_PREFERRED
+    });
+    Tags.of(this.logBucket).add("daily-backup", "true");
+    this.backupRole = this.createBackupRole(scope);
+    this.vault = new backup.BackupVault(scope, "BackupVault", {
+      backupVaultName: `${props.slug}-${props.appEnv}-daily-backup-vault`,
+      encryptionKey: props.kmsKey,
+      removalPolicy: RemovalPolicy3.DESTROY
+    });
+    this.backupPlan = backup.BackupPlan.daily35DayRetention(scope, "BackupPlan", this.vault);
+    this.backupPlan.addSelection("Selection", {
+      role: this.backupRole,
+      resources: [backup.BackupResource.fromTag("daily-backup", "true")]
+    });
+  }
+  createBackupRole(scope) {
+    const backupRole = new iam2.Role(scope, "BackupRole", {
+      assumedBy: new iam2.ServicePrincipal("backup.amazonaws.com")
+    });
+    backupRole.addToPolicy(new iam2.PolicyStatement({
+      actions: [
+        "s3:GetInventoryConfiguration",
+        "s3:PutInventoryConfiguration",
+        "s3:ListBucketVersions",
+        "s3:ListBucket",
+        "s3:GetBucketVersioning",
+        "s3:GetBucketNotification",
+        "s3:PutBucketNotification",
+        "s3:GetBucketLocation",
+        "s3:GetBucketTagging"
+      ],
+      resources: ["arn:aws:s3:::*"],
+      sid: "S3BucketBackupPermissions"
+    }));
+    backupRole.addToPolicy(new iam2.PolicyStatement({
+      actions: [
+        "s3:GetObjectAcl",
+        "s3:GetObject",
+        "s3:GetObjectVersionTagging",
+        "s3:GetObjectVersionAcl",
+        "s3:GetObjectTagging",
+        "s3:GetObjectVersion"
+      ],
+      resources: ["arn:aws:s3:::*/*"],
+      sid: "S3ObjectBackupPermissions"
+    }));
+    backupRole.addToPolicy(new iam2.PolicyStatement({
+      actions: ["s3:ListAllMyBuckets"],
+      resources: ["*"],
+      sid: "S3GlobalPermissions"
+    }));
+    backupRole.addToPolicy(new iam2.PolicyStatement({
+      actions: ["kms:Decrypt", "kms:DescribeKey"],
+      resources: ["*"],
+      sid: "KMSBackupPermissions",
+      conditions: {
+        StringLike: {
+          "kms:ViaService": "s3.*.amazonaws.com"
+        }
+      }
+    }));
+    backupRole.addToPolicy(new iam2.PolicyStatement({
+      actions: [
+        "events:DescribeRule",
+        "events:EnableRule",
+        "events:PutRule",
+        "events:DeleteRule",
+        "events:PutTargets",
+        "events:RemoveTargets",
+        "events:ListTargetsByRule",
+        "events:DisableRule"
+      ],
+      resources: ["arn:aws:events:*:*:rule/AwsBackupManagedRule*"],
+      sid: "EventsPermissions"
+    }));
+    backupRole.addToPolicy(new iam2.PolicyStatement({
+      actions: ["cloudwatch:GetMetricData", "events:ListRules"],
+      resources: ["*"],
+      sid: "EventsMetricsGlobalPermissions"
+    }));
+    return backupRole;
+  }
+}
+
+// src/cloud/security.ts
+import {config as config10} from "@stacksjs/config";
+import {Duration as Duration4, RemovalPolicy as RemovalPolicy4, Tags as Tags2, aws_certificatemanager as acm, aws_kms as kms, aws_wafv2 as wafv2} from "aws-cdk-lib";
+
+class SecurityStack {
+  firewall;
+  kmsKey;
+  certificate;
+  constructor(scope, props) {
+    const firewallOptions = config10.cloud.firewall;
+    if (!firewallOptions)
+      throw new Error("No firewall options found in config");
+    const options = {
+      defaultAction: { allow: {} },
+      scope: "CLOUDFRONT",
+      visibilityConfig: {
+        sampledRequestsEnabled: true,
+        cloudWatchMetricsEnabled: true,
+        metricName: "firewallMetric"
+      },
+      rules: this.getFirewallRules()
+    };
+    this.firewall = new wafv2.CfnWebACL(scope, "WebFirewall", options);
+    Tags2.of(this.firewall).add("Name", "waf-cloudfront", { priority: 300 });
+    Tags2.of(this.firewall).add("Purpose", "CloudFront", { priority: 300 });
+    Tags2.of(this.firewall).add("CreatedBy", "CloudFormation", { priority: 300 });
+    this.kmsKey = new kms.Key(scope, "EncryptionKey", {
+      alias: "stacks-encryption-key",
+      description: "KMS key for Stacks Cloud",
+      enableKeyRotation: true,
+      removalPolicy: RemovalPolicy4.DESTROY,
+      pendingWindow: Duration4.days(30)
+    });
+    this.certificate = new acm.Certificate(scope, "Certificate", {
+      domainName: props.domain,
+      validation: acm.CertificateValidation.fromDns(props.zone),
+      subjectAlternativeNames: [`www.${props.domain}`, `api.${props.domain}`]
+    });
+  }
+  getFirewallRules() {
+    const rules = [];
+    const priorities = [];
+    if (config10.security.firewall?.countryCodes?.length) {
+      priorities.push(1);
+      rules.push({
+        name: "CountryRule",
+        priority: priorities.length,
+        statement: {
+          geoMatchStatement: {
+            countryCodes: config10.security.firewall.countryCodes
+          }
+        },
+        action: {
+          block: {}
+        },
+        visibilityConfig: {
+          sampledRequestsEnabled: true,
+          cloudWatchMetricsEnabled: true,
+          metricName: "CountryRule"
+        }
+      });
+    }
+    if (config10.security.firewall?.ipAddresses?.length) {
+      const ipSet = new wafv2.CfnIPSet(this, "IpSet", {
+        name: "IpSet",
+        description: "IP Set",
+        scope: "CLOUDFRONT",
+        addresses: config10.security.firewall.ipAddresses,
+        ipAddressVersion: "IPV4"
+      });
+      priorities.push(1);
+      rules.push({
+        name: "IpAddressRule",
+        priority: priorities.length,
+        statement: {
+          ipSetReferenceStatement: {
+            arn: ipSet.attrArn
+          }
+        },
+        action: {
+          block: {}
+        },
+        visibilityConfig: {
+          sampledRequestsEnabled: true,
+          cloudWatchMetricsEnabled: true,
+          metricName: "IpAddressRule"
+        }
+      });
+    }
+    if (config10.security.firewall?.httpHeaders?.length) {
+      config10.security.firewall.httpHeaders.forEach((header, index) => {
+        priorities.push(1);
+        rules.push({
+          name: `HttpHeaderRule${index}`,
+          priority: priorities.length,
+          statement: {
+            byteMatchStatement: {
+              fieldToMatch: {
+                singleHeader: {
+                  name: header
+                }
+              },
+              positionalConstraint: "EXACTLY",
+              searchString: "true",
+              textTransformations: [
+                {
+                  priority: index,
+                  type: "NONE"
+                }
+              ]
+            }
+          },
+          action: {
+            block: {}
+          },
+          visibilityConfig: {
+            sampledRequestsEnabled: true,
+            cloudWatchMetricsEnabled: true,
+            metricName: `HttpHeaderRule${index}`
+          }
+        });
+      });
+    }
+    return rules;
+  }
+}
+
+// src/cloud/deployment.ts
+import {AssetHashType as AssetHashType2, aws_s3_deployment as s3deploy} from "aws-cdk-lib";
+import {config as config12} from "@stacksjs/config";
+import {websiteSourceHash} from "@stacksjs/utils";
+
+class DeploymentStack {
+  privateSource;
+  docsSource;
+  websiteSource;
+  constructor(scope, props) {
+    this.privateSource = "../../../private";
+    this.docsSource = "../../docs/dist/";
+    this.websiteSource = config12.app.docMode === true ? this.docsSource : "../../views/dist/";
+    new s3deploy.BucketDeployment(scope, "Website", {
+      sources: [s3deploy.Source.asset(this.websiteSource, {
+        assetHash: websiteSourceHash,
+        assetHashType: AssetHashType2.CUSTOM
+      })],
+      destinationBucket: props.publicBucket,
+      distribution: props.cdn,
+      distributionPaths: ["/*"]
+    });
+    new s3deploy.BucketDeployment(scope, "PrivateFiles", {
+      sources: [s3deploy.Source.asset(this.privateSource)],
+      destinationBucket: props.privateBucket
+    });
+  }
+}
+
+// src/cloud/jump-box.ts
+import {CfnOutput as Output5, aws_ec2 as ec2, aws_iam as iam3} from "aws-cdk-lib";
+
+class JumpBoxStack {
+  jumpBox;
+  constructor(scope, props) {
+    const role = new iam3.Role(scope, "JumpBoxInstanceRole", {
+      assumedBy: new iam3.ServicePrincipal("ec2.amazonaws.com"),
+      managedPolicies: [
+        iam3.ManagedPolicy.fromAwsManagedPolicyName("AmazonSSMManagedInstanceCore"),
+        iam3.ManagedPolicy.fromAwsManagedPolicyName("CloudWatchAgentServerPolicy")
+      ]
+    });
+    this.jumpBox = new ec2.Instance(scope, "JumpBox", {
+      vpc: props.vpc,
+      instanceType: ec2.InstanceType.of(ec2.InstanceClass.T2, ec2.InstanceSize.MICRO),
+      machineImage: new ec2.AmazonLinuxImage,
+      role,
+      userData: ec2.UserData.custom(`
+      #!/bin/bash
+      yum update -y
+      yum install -y amazon-efs-utils
+      yum install -y git
+      yum install -y https://s3.us-east-1.amazonaws.com/amazon-ssm-us-east-1/latest/linux_amd64/amazon-ssm-agent.rpm
+      mkdir /mnt/efs
+      mount -t efs ${props.fileSystem.fileSystemId}:/ /mnt/efs
+      git clone https://github.com/stacksjs/stacks.git /mnt/efs
+    `)
+    });
+    new Output5(scope, "JumpBoxInstanceId", {
+      value: this.jumpBox.instanceId,
+      description: "The ID of the EC2 instance that can be used to SSH into the Stacks Cloud."
+    });
+  }
+}
+
+// src/cloud/file-system.ts
+import {RemovalPolicy as RemovalPolicy5, aws_efs as efs} from "aws-cdk-lib";
+
+class FileSystemStack {
+  fileSystem;
+  accessPoint;
+  constructor(scope, props) {
+    this.fileSystem = new efs.FileSystem(scope, "FileSystem", {
+      fileSystemName: `${props.slug}-${props.appEnv}-efs`,
+      vpc: props.vpc,
+      removalPolicy: RemovalPolicy5.DESTROY,
+      lifecyclePolicy: efs.LifecyclePolicy.AFTER_7_DAYS,
+      performanceMode: efs.PerformanceMode.GENERAL_PURPOSE,
+      throughputMode: efs.ThroughputMode.BURSTING,
+      enableAutomaticBackups: true,
+      encrypted: true
+    });
+    this.accessPoint = new efs.AccessPoint(scope, "FileSystemAccessPoint", {
+      fileSystem: this.fileSystem,
+      path: "/",
+      posixUser: {
+        uid: "1000",
+        gid: "1000"
+      }
+    });
+  }
+}
+
+// src/cloud/network.ts
+import {aws_ec2 as ec22} from "aws-cdk-lib";
+
+class NetworkStack {
+  vpc;
+  constructor(scope, props) {
+    this.vpc = new ec22.Vpc(scope, "Network", {
+      vpcName: `${props.slug}-${props.appEnv}-vpc`,
+      ipAddresses: ec22.IpAddresses.cidr("10.0.0.0/16"),
+      maxAzs: 3,
+      natGateways: 0,
+      subnetConfiguration: [
+        {
+          cidrMask: 21,
+          name: `${props.slug}-${props.appEnv}-public-subnet-1`,
+          subnetType: ec22.SubnetType.PUBLIC
+        },
+        {
+          cidrMask: 21,
+          name: `${props.slug}-${props.appEnv}-public-subnet-2`,
+          subnetType: ec22.SubnetType.PUBLIC
+        },
+        {
+          cidrMask: 21,
+          name: `${props.slug}-${props.appEnv}-public-subnet-3`,
+          subnetType: ec22.SubnetType.PUBLIC
+        },
+        {
+          cidrMask: 21,
+          name: `${props.slug}-${props.appEnv}-private-subnet-1`,
+          subnetType: ec22.SubnetType.PRIVATE_ISOLATED
+        },
+        {
+          cidrMask: 21,
+          name: `${props.slug}-${props.appEnv}-private-subnet-2`,
+          subnetType: ec22.SubnetType.PRIVATE_ISOLATED
+        },
+        {
+          cidrMask: 21,
+          name: `${props.slug}-${props.appEnv}-private-subnet-3`,
+          subnetType: ec22.SubnetType.PRIVATE_ISOLATED
+        }
+      ]
+    });
+  }
+}
+
+// src/cloud/redirects.ts
+import {config as config14} from "@stacksjs/config";
+import {RemovalPolicy as RemovalPolicy6, aws_route53 as route533, aws_s3 as s33} from "aws-cdk-lib";
+
+class RedirectsStack {
+  redirectZones = [];
+  constructor(scope, props) {
+    config14.dns.redirects?.forEach((redirect) => {
+      const slug2 = redirect.split(".").map((part, index) => index === 0 ? part : part.charAt(0).toUpperCase() + part.slice(1)).join("");
+      const hostedZone = route533.HostedZone.fromLookup(scope, "HostedZone", { domainName: redirect });
+      const redirectBucket = new s33.Bucket(scope, `RedirectBucket${slug2}`, {
+        bucketName: `${redirect}-redirect`,
+        websiteRedirect: {
+          hostName: props.domain,
+          protocol: s33.RedirectProtocol.HTTPS
+        },
+        removalPolicy: RemovalPolicy6.DESTROY,
+        autoDeleteObjects: true
+      });
+      new route533.CnameRecord(scope, `RedirectRecord${slug2}`, {
+        zone: hostedZone,
+        recordName: "redirect",
+        domainName: redirectBucket.bucketWebsiteDomainName
+      });
+    });
+    config14.dns.redirects?.forEach((redirect) => {
+      const slug2 = redirect.split(".").map((part, index) => index === 0 ? part : part.charAt(0).toUpperCase() + part.slice(1)).join("");
+      const hostedZone = route533.HostedZone.fromLookup(scope, `RedirectHostedZone${slug2}`, { domainName: redirect });
+      this.redirectZones.push(hostedZone);
+    });
+  }
+}
+
+// src/cloud/email.ts
+import {Duration as Duration5, RemovalPolicy as RemovalPolicy7, Stack, Tags as Tags3, aws_iam as iam4, aws_lambda as lambda4, aws_route53 as route534, aws_s3 as s34, aws_s3_notifications as s3n, aws_ses as ses} from "aws-cdk-lib";
+import {config as config16} from "@stacksjs/config";
+
+class EmailStack {
+  emailBucket;
+  constructor(scope, props) {
+    const bucketPrefix = `${props.slug}-${props.appEnv}`;
+    this.emailBucket = new s34.Bucket(scope, "EmailBucket", {
+      bucketName: `${bucketPrefix}-email-${props.timestamp}`,
+      versioned: true,
+      removalPolicy: RemovalPolicy7.DESTROY,
+      autoDeleteObjects: true,
+      encryption: s34.BucketEncryption.S3_MANAGED,
+      lifecycleRules: [
+        {
+          id: "24h",
+          enabled: true,
+          expiration: Duration5.days(1),
+          noncurrentVersionExpiration: Duration5.days(1),
+          prefix: "today/"
+        },
+        {
+          id: "Intelligent transition for Inbox",
+          enabled: true,
+          prefix: "inbox/",
+          transitions: [
+            {
+              storageClass: s34.StorageClass.INTELLIGENT_TIERING,
+              transitionAfter: Duration5.days(0)
+            }
+          ]
+        },
+        {
+          id: "Intelligent transition for Sent",
+          enabled: true,
+          prefix: "sent/",
+          transitions: [
+            {
+              storageClass: s34.StorageClass.INTELLIGENT_TIERING,
+              transitionAfter: Duration5.days(0)
+            }
+          ]
+        }
+      ]
+    });
+    Tags3.of(this.emailBucket).add("daily-backup", "true");
+    const sesPrincipal = new iam4.ServicePrincipal("ses.amazonaws.com");
+    const ruleSetName = `${props.slug}-${props.appEnv}-email-receipt-rule-set`;
+    const receiptRuleName = `${props.slug}-${props.appEnv}-email-receipt-rule`;
+    const ruleSet = new ses.CfnReceiptRuleSet(scope, "SESReceiptRuleSet", {
+      ruleSetName
+    });
+    this.emailBucket.addToResourcePolicy(new iam4.PolicyStatement({
+      sid: "AllowSESPuts",
+      effect: iam4.Effect.ALLOW,
+      principals: [sesPrincipal],
+      actions: [
+        "s3:PutObject"
+      ],
+      resources: [
+        `${this.emailBucket.bucketArn}/*`
+      ],
+      conditions: {
+        StringEquals: {
+          "aws:SourceAccount": Stack.of(scope).account
+        },
+        ArnLike: {
+          "aws:SourceArn": `arn:aws:ses:${Stack.of(scope).region}:${Stack.of(scope).account}:receipt-rule-set/${ruleSetName}:receipt-rule/${receiptRuleName}`
+        }
+      }
+    }));
+    const receiptRule = new ses.CfnReceiptRule(scope, "SESReceiptRule", {
+      ruleSetName: ruleSet.ref,
+      rule: {
+        name: receiptRuleName,
+        enabled: true,
+        actions: [
+          {
+            s3Action: {
+              bucketName: this.emailBucket.bucketName,
+              objectKeyPrefix: "tmp/email_in/"
+            }
+          }
+        ],
+        recipients: config16.email.mailboxes || [],
+        scanEnabled: config16.email.server?.scan || true,
+        tlsPolicy: "Require"
+      }
+    });
+    receiptRule.node.addDependency(this.emailBucket);
+    const iamGroup = new iam4.Group(scope, "IAMGroup", {
+      groupName: `${props.slug}-${props.appEnv}-email-management-s3-group`
+    });
+    const listBucketsPolicyStatement = new iam4.PolicyStatement({
+      effect: iam4.Effect.ALLOW,
+      actions: ["s3:ListAllMyBuckets"],
+      resources: ["*"]
+    });
+    const policyStatement = new iam4.PolicyStatement({
+      effect: iam4.Effect.ALLOW,
+      actions: [
+        "s3:ListBucket",
+        "s3:GetObject",
+        "s3:PutObject",
+        "s3:DeleteObject",
+        "s3:GetObjectAcl",
+        "s3:GetObjectVersionAcl",
+        "s3:PutObjectAcl",
+        "s3:PutObjectVersionAcl"
+      ],
+      resources: [
+        this.emailBucket.bucketArn,
+        `${this.emailBucket.bucketArn}/*`
+      ]
+    });
+    const policy = new iam4.Policy(scope, "EmailAccessPolicy", {
+      policyName: `${props.slug}-${props.appEnv}-email-management-s3-policy`,
+      statements: [policyStatement, listBucketsPolicyStatement]
+    });
+    iamGroup.attachInlinePolicy(policy);
+    const sesIdentity = new ses.CfnEmailIdentity(scope, "DomainIdentity", {
+      emailIdentity: props.domain,
+      dkimSigningAttributes: {
+        nextSigningKeyLength: "RSA_2048_BIT"
+      },
+      dkimAttributes: {
+        signingEnabled: true
+      },
+      mailFromAttributes: {
+        behaviorOnMxFailure: "USE_DEFAULT_VALUE",
+        mailFromDomain: `mail.${props.domain}`
+      },
+      feedbackAttributes: {
+        emailForwardingEnabled: true
+      }
+    });
+    new route534.CfnRecordSet(scope, "DkimRecord1", {
+      hostedZoneName: `${props.zone.zoneName}.`,
+      name: sesIdentity.attrDkimDnsTokenName1,
+      type: "CNAME",
+      resourceRecords: [sesIdentity.attrDkimDnsTokenValue1],
+      ttl: "1800"
+    });
+    new route534.CfnRecordSet(scope, "DkimRecord2", {
+      hostedZoneName: `${props.zone.zoneName}.`,
+      name: sesIdentity.attrDkimDnsTokenName2,
+      type: "CNAME",
+      resourceRecords: [sesIdentity.attrDkimDnsTokenValue2],
+      ttl: "1800"
+    });
+    new route534.CfnRecordSet(scope, "DkimRecord3", {
+      hostedZoneName: `${props.zone.zoneName}.`,
+      name: sesIdentity.attrDkimDnsTokenName3,
+      type: "CNAME",
+      resourceRecords: [sesIdentity.attrDkimDnsTokenValue3],
+      ttl: "1800"
+    });
+    new route534.MxRecord(scope, "MxRecord", {
+      zone: props.zone,
+      recordName: "mail",
+      values: [{
+        priority: 10,
+        hostName: "feedback-smtp.us-east-1.amazonses.com"
+      }]
+    });
+    new route534.TxtRecord(scope, "TxtSpfRecord", {
+      zone: props.zone,
+      recordName: "mail",
+      values: ["v=spf1 include:amazonses.com ~all"]
+    });
+    new route534.TxtRecord(scope, "TxtDmarcRecord", {
+      zone: props.zone,
+      recordName: "_dmarc",
+      values: [`v=DMARC1;p=quarantine;pct=25;rua=mailto:dmarcreports@${props.domain}`]
+    });
+    const lambdaEmailOutboundRole = new iam4.Role(scope, "LambdaEmailOutboundRole", {
+      roleName: `${props.slug}-${props.appEnv}-email-outbound`,
+      assumedBy: new iam4.ServicePrincipal("lambda.amazonaws.com"),
+      managedPolicies: [
+        iam4.ManagedPolicy.fromAwsManagedPolicyName("service-role/AWSLambdaBasicExecutionRole")
+      ]
+    });
+    const lambdaEmailOutbound = new lambda4.Function(scope, "LambdaEmailOutbound", {
+      functionName: `${props.slug}-${props.appEnv}-email-outbound`,
+      description: "Take the JSON and convert it in to an raw email.",
+      code: lambda4.Code.fromInline("exports.handler = async (event) => {return true;};"),
+      handler: "index.handler",
+      memorySize: 256,
+      runtime: lambda4.Runtime.NODEJS_18_X,
+      timeout: Duration5.seconds(60),
+      environment: {
+        BUCKET: this.emailBucket.bucketName
+      },
+      role: lambdaEmailOutboundRole
+    });
+    lambdaEmailOutboundRole.addToPolicy(policyStatement);
+    const sesPolicyStatement = new iam4.PolicyStatement({
+      effect: iam4.Effect.ALLOW,
+      actions: ["ses:SendRawEmail"],
+      resources: ["*"]
+    });
+    lambdaEmailOutboundRole.addToPolicy(sesPolicyStatement);
+    const lambdaEmailInboundRole = new iam4.Role(scope, "LambdaEmailInboundRole", {
+      roleName: `${props.slug}-${props.appEnv}-email-inbound`,
+      assumedBy: new iam4.ServicePrincipal("lambda.amazonaws.com"),
+      managedPolicies: [
+        iam4.ManagedPolicy.fromAwsManagedPolicyName("service-role/AWSLambdaBasicExecutionRole")
+      ]
+    });
+    const lambdaEmailInbound = new lambda4.Function(scope, "LambdaEmailInbound", {
+      functionName: `${props.slug}-${props.appEnv}-email-inbound`,
+      description: "This Lambda organizes all the incoming emails based on the From and To field.",
+      code: lambda4.Code.fromInline("exports.handler = async (event) => {return true;};"),
+      handler: "index.handler",
+      memorySize: 256,
+      role: lambdaEmailInboundRole,
+      runtime: lambda4.Runtime.NODEJS_18_X,
+      timeout: Duration5.seconds(60),
+      environment: {
+        BUCKET: this.emailBucket.bucketName
+      }
+    });
+    new lambda4.CfnPermission(scope, "S3InboundPermission", {
+      action: "lambda:InvokeFunction",
+      functionName: lambdaEmailInbound.functionName,
+      principal: "s3.amazonaws.com"
+    });
+    const inboundS3PolicyStatement = new iam4.PolicyStatement({
+      effect: iam4.Effect.ALLOW,
+      actions: ["s3:*"],
+      resources: [
+        this.emailBucket.bucketArn,
+        `${this.emailBucket.bucketArn}/*`
+      ]
+    });
+    lambdaEmailInboundRole.addToPolicy(inboundS3PolicyStatement);
+    const sesInboundPolicyStatement = new iam4.PolicyStatement({
+      effect: iam4.Effect.ALLOW,
+      actions: ["ses:ListIdentities"],
+      resources: ["*"]
+    });
+    lambdaEmailInboundRole.addToPolicy(sesInboundPolicyStatement);
+    const lambdaEmailConverterRole = new iam4.Role(scope, "LambdaEmailConverterRole", {
+      roleName: `${props.slug}-${props.appEnv}-email-converter`,
+      assumedBy: new iam4.ServicePrincipal("lambda.amazonaws.com"),
+      managedPolicies: [
+        iam4.ManagedPolicy.fromAwsManagedPolicyName("service-role/AWSLambdaBasicExecutionRole")
+      ]
+    });
+    const lambdaEmailConverter = new lambda4.Function(scope, "LambdaEmailConverter", {
+      functionName: `${props.slug}-${props.appEnv}-email-converter`,
+      description: "This Lambda converts raw emails files in to HTML and text.",
+      code: lambda4.Code.fromInline('exports.handler = async (event) => {console.log("hello world email converter");return true;};'),
+      handler: "index.handler",
+      memorySize: 256,
+      role: lambdaEmailConverterRole,
+      runtime: lambda4.Runtime.NODEJS_18_X,
+      timeout: Duration5.seconds(60),
+      environment: {
+        BUCKET: this.emailBucket.bucketName
+      }
+    });
+    const converterS3PolicyStatement = new iam4.PolicyStatement({
+      effect: iam4.Effect.ALLOW,
+      actions: ["s3:*"],
+      resources: [
+        this.emailBucket.bucketArn,
+        `${this.emailBucket.bucketArn}/*`
+      ]
+    });
+    new lambda4.CfnPermission(scope, "S3ConverterPermission", {
+      action: "lambda:InvokeFunction",
+      functionName: lambdaEmailConverter.functionName,
+      principal: "s3.amazonaws.com"
+    });
+    lambdaEmailConverterRole.addToPolicy(converterS3PolicyStatement);
+    this.emailBucket.addEventNotification(s34.EventType.OBJECT_CREATED_PUT, new s3n.LambdaDestination(lambdaEmailInbound), { prefix: "tmp/email_in/" });
+    this.emailBucket.addEventNotification(s34.EventType.OBJECT_CREATED_PUT, new s3n.LambdaDestination(lambdaEmailOutbound), { prefix: "tmp/email_out/json/" });
+    this.emailBucket.addEventNotification(s34.EventType.OBJECT_CREATED_COPY, new s3n.LambdaDestination(lambdaEmailConverter), { prefix: "sent/" });
+    this.emailBucket.addEventNotification(s34.EventType.OBJECT_CREATED_COPY, new s3n.LambdaDestination(lambdaEmailConverter), { prefix: "inbox/" });
+    this.emailBucket.addEventNotification(s34.EventType.OBJECT_CREATED_COPY, new s3n.LambdaDestination(lambdaEmailConverter), { prefix: "today/" });
+  }
+}
+
+// src/cloud/permissions.ts
+import {SecretValue, aws_iam as iam5} from "aws-cdk-lib";
+import {config as config18} from "@stacksjs/config";
+import {string} from "@stacksjs/strings";
+import {env as env4} from "@stacksjs/env";
+
+class PermissionsStack {
+  constructor(scope) {
+    const teamName = config18.team.name;
+    const users = config18.team.members;
+    const password = env4.AWS_DEFAULT_PASSWORD || string.random();
+    for (const name in users) {
+      const id = `User${string.pascalCase(teamName)}${string.pascalCase(name)}`;
+      const userName = string.slug(`${teamName}-${name}`);
+      const user = new iam5.User(scope, id, {
+        userName,
+        password: SecretValue.unsafePlainText(password),
+        passwordResetRequired: true
+      });
+      user.addManagedPolicy(iam5.ManagedPolicy.fromAwsManagedPolicyName("AdministratorAccess"));
+    }
+  }
+}
+
+// src/cloud/compute.ts
+import {Duration as Duration6, CfnOutput as Output6, aws_lambda as lambda5, aws_logs as logs, aws_secretsmanager as secretsmanager} from "aws-cdk-lib";
+import {path as p5} from "@stacksjs/path";
+import {env as env6} from "@stacksjs/env";
+
+class ComputeStack {
+  apiServer;
+  apiServerUrl;
+  constructor(scope, props) {
+    const vpc = props.vpc;
+    const fileSystem = props.fileSystem;
+    if (!fileSystem)
+      throw new Error("The file system is missing. Please make sure it was created properly.");
+    this.apiServer = new lambda5.Function(scope, "WebServer", {
+      functionName: `${props.slug}-${props.appEnv}-web-server`,
+      description: "The web server for the Stacks application",
+      code: lambda5.Code.fromAssetImage(p5.frameworkPath("server")),
+      handler: lambda5.Handler.FROM_IMAGE,
+      runtime: lambda5.Runtime.FROM_IMAGE,
+      vpc,
+      memorySize: 512,
+      timeout: Duration6.minutes(5),
+      logRetention: logs.RetentionDays.ONE_WEEK,
+      architecture: lambda5.Architecture.ARM_64
+    });
+    const keysToRemove = ["_HANDLER", "_X_AMZN_TRACE_ID", "AWS_REGION", "AWS_EXECUTION_ENV", "AWS_LAMBDA_FUNCTION_NAME", "AWS_LAMBDA_FUNCTION_MEMORY_SIZE", "AWS_LAMBDA_FUNCTION_VERSION", "AWS_LAMBDA_INITIALIZATION_TYPE", "AWS_LAMBDA_LOG_GROUP_NAME", "AWS_LAMBDA_LOG_STREAM_NAME", "AWS_ACCESS_KEY", "AWS_ACCESS_KEY_ID", "AWS_SECRET_ACCESS_KEY", "AWS_SESSION_TOKEN", "AWS_LAMBDA_RUNTIME_API", "LAMBDA_TASK_ROOT", "LAMBDA_RUNTIME_DIR", "_"];
+    keysToRemove.forEach((key) => delete env6[key]);
+    const secrets = new secretsmanager.Secret(scope, "StacksSecrets", {
+      secretName: `${props.slug}-${props.appEnv}-secrets`,
+      description: "Secrets for the Stacks application",
+      generateSecretString: {
+        secretStringTemplate: JSON.stringify(env6),
+        generateStringKey: Object.keys(env6).join(",").length.toString()
+      }
+    });
+    secrets.grantRead(this.apiServer);
+    this.apiServer.addEnvironment("SECRETS_ARN", secrets.secretArn);
+    this.apiServerUrl = new lambda5.FunctionUrl(scope, "StacksServerUrl", {
+      function: this.apiServer,
+      authType: lambda5.FunctionUrlAuthType.NONE,
+      cors: {
+        allowedOrigins: ["*"]
+      }
+    });
+    const apiPrefix = "api";
+    new Output6(scope, "ApiUrl", {
+      value: `https://${props.domain}/${apiPrefix}`,
+      description: "The URL of the deployed application"
+    });
+    new Output6(scope, "ApiVanityUrl", {
+      value: this.apiServerUrl.url,
+      description: "The Vanity URL of the deployed application"
+    });
+  }
+}
+
+// src/cloud/index.ts
+class Cloud extends Stack2 {
+  constructor(scope, id, props) {
+    super(scope, id, props);
+    const dns2 = new DnsStack(this, props);
+    const security2 = new SecurityStack(this, {
+      ...props,
+      zone: dns2.zone
+    });
+    const storage4 = new StorageStack(this, {
+      ...props,
+      kmsKey: security2.kmsKey
+    });
+    const network2 = new NetworkStack(this, props);
+    const fileSystem = new FileSystemStack(this, {
+      ...props,
+      vpc: network2.vpc
+    });
+    new JumpBoxStack(this, {
+      ...props,
+      vpc: network2.vpc,
+      fileSystem: fileSystem.fileSystem
+    });
+    const docs2 = new DocsStack(this, props);
+    new EmailStack(this, {
+      ...props,
+      zone: dns2.zone
+    });
+    new RedirectsStack(this, props);
+    new PermissionsStack(this);
+    const api = new ComputeStack(this, {
+      ...props,
+      vpc: network2.vpc,
+      fileSystem: fileSystem.fileSystem,
+      zone: dns2.zone,
+      certificate: security2.certificate
+    });
+    const ai2 = new AiStack(this, props);
+    const cli4 = new CliStack(this, props);
+    const cdn2 = new CdnStack(this, {
+      ...props,
+      publicBucket: storage4.publicBucket,
+      logBucket: storage4.logBucket,
+      certificate: security2.certificate,
+      firewall: security2.firewall,
+      originRequestFunction: docs2.originRequestFunction,
+      zone: dns2.zone,
+      webServer: api.apiServer,
+      webServerUrl: api.apiServerUrl,
+      cliSetupUrl: cli4.cliSetupUrl,
+      askAiUrl: ai2.askAiUrl,
+      summarizeAiUrl: ai2.summarizeAiUrl
+    });
+    new DeploymentStack(this, {
+      ...props,
+      publicBucket: storage4.publicBucket,
+      privateBucket: storage4.privateBucket,
+      cdn: cdn2.distribution
+    });
+  }
+}
+// /Users/chrisbreuer/Code/stacks/storage/framework/core/router/dist/index.js
+import process2 from "process";
+async function importMiddlewares(directory) {
+  return [directory];
+}
+import {extname as extname2} from "path";
+import {URL} from "url";
+import {localUrl} from "@stacksjs/config";
+async function serverResponse(req) {
+  console.log("serverResponse", req);
+  const routesList = await route.getRoutes();
+  const url = new URL(req.url);
+  const foundRoute = routesList.find((route2) => {
+    const pattern = new RegExp(`^${route2.uri.replace(/:\w+/g, "\\w+")}$`);
+    return pattern.test(url.pathname);
+  });
+  if (!foundRoute)
+    return new Response("Not found", { status: 404 });
+  addRouteParamsAndQuery(url, foundRoute);
+  executeMiddleware(foundRoute);
+  return execute(foundRoute, req, { statusCode: foundRoute?.statusCode });
+}
+var normalizeWindowsPath = function(input = "") {
+  if (!input) {
+    return input;
+  }
+  return input.replace(/\\/g, "/").replace(_DRIVE_LETTER_START_RE, (r) => r.toUpperCase());
+};
+var cwd = function() {
+  if (typeof process !== "undefined" && typeof process.cwd === "function") {
+    return process.cwd().replace(/\\/g, "/");
+  }
+  return "/";
+};
+var normalizeString = function(path11, allowAboveRoot) {
+  let res = "";
+  let lastSegmentLength = 0;
+  let lastSlash = -1;
+  let dots = 0;
+  let char = null;
+  for (let index = 0;index <= path11.length; ++index) {
+    if (index < path11.length) {
+      char = path11[index];
+    } else if (char === "/") {
+      break;
+    } else {
+      char = "/";
+    }
+    if (char === "/") {
+      if (lastSlash === index - 1 || dots === 1)
+        ;
+      else if (dots === 2) {
+        if (res.length < 2 || lastSegmentLength !== 2 || res[res.length - 1] !== "." || res[res.length - 2] !== ".") {
+          if (res.length > 2) {
+            const lastSlashIndex = res.lastIndexOf("/");
+            if (lastSlashIndex === -1) {
+              res = "";
+              lastSegmentLength = 0;
+            } else {
+              res = res.slice(0, lastSlashIndex);
+              lastSegmentLength = res.length - 1 - res.lastIndexOf("/");
+            }
+            lastSlash = index;
+            dots = 0;
+            continue;
+          } else if (res.length > 0) {
+            res = "";
+            lastSegmentLength = 0;
+            lastSlash = index;
+            dots = 0;
+            continue;
+          }
+        }
+        if (allowAboveRoot) {
+          res += res.length > 0 ? "/.." : "..";
+          lastSegmentLength = 2;
+        }
+      } else {
+        if (res.length > 0) {
+          res += `/${path11.slice(lastSlash + 1, index)}`;
+        } else {
+          res = path11.slice(lastSlash + 1, index);
+        }
+        lastSegmentLength = index - lastSlash - 1;
+      }
+      lastSlash = index;
+      dots = 0;
+    } else if (char === "." && dots !== -1) {
+      ++dots;
+    } else {
+      dots = -1;
+    }
+  }
+  return res;
+};
+var _DRIVE_LETTER_START_RE = /^[A-Za-z]:\//;
+var _IS_ABSOLUTE_RE = /^[/\\](?![/\\])|^[/\\]{2}(?!\.)|^[A-Za-z]:[/\\]/;
+var resolve = function(...arguments_) {
+  arguments_ = arguments_.map((argument) => normalizeWindowsPath(argument));
+  let resolvedPath = "";
+  let resolvedAbsolute = false;
+  for (let index = arguments_.length - 1;index >= -1 && !resolvedAbsolute; index--) {
+    const path11 = index >= 0 ? arguments_[index] : cwd();
+    if (!path11 || path11.length === 0) {
+      continue;
+    }
+    resolvedPath = `${path11}/${resolvedPath}`;
+    resolvedAbsolute = isAbsolute(path11);
+  }
+  resolvedPath = normalizeString(resolvedPath, !resolvedAbsolute);
+  if (resolvedAbsolute && !isAbsolute(resolvedPath)) {
+    return `/${resolvedPath}`;
+  }
+  return resolvedPath.length > 0 ? resolvedPath : ".";
+};
+var isAbsolute = function(p6) {
+  return _IS_ABSOLUTE_RE.test(p6);
+};
+var appPath = function(path22) {
+  return projectPath(`app/${path22 || ""}`);
+};
+var projectPath = function(filePath = "") {
+  let path22 = process2.cwd();
+  while (path22.includes("storage"))
+    path22 = resolve(path22, "..");
+  return resolve(path22, filePath);
+};
+var middlewares = await importMiddlewares(appPath("middleware"));
+
+class Request {
+  query = {};
+  params = null;
+  addQuery(url) {
+    this.query = Object.fromEntries(url.searchParams);
+  }
+  get(element) {
+    return this.query[element];
+  }
+  all() {
+    return this.query;
+  }
+  has(element) {
+    return element in this.query;
+  }
+  isEmpty() {
+    return Object.keys(this.query).length === 0;
+  }
+  extractParamsFromRoute(routePattern, pathname) {
+    const pattern = new RegExp(`^${routePattern.replace(/:(\w+)/g, (match2, paramName) => `(?<${paramName}>\\w+)`)}$`);
+    const match = pattern.exec(pathname);
+    if (match?.groups)
+      this.params = match?.groups;
+  }
+  getParams(key) {
+    return this.params ? this.params[key] || null : null;
+  }
+}
+var request = new Request;
+var addRouteParamsAndQuery = function(url, route2) {
+  if (!isObjectNotEmpty(url.searchParams))
+    request.addQuery(url);
+  request.extractParamsFromRoute(route2.uri, url.pathname);
+};
+var executeMiddleware = function(route2) {
+  const { middleware: middleware2 = null } = route2;
+  if (middleware2 && middlewares && isObjectNotEmpty(middlewares)) {
+    if (isString(middleware2)) {
+      const middlewareItem = middlewares.find((middlewareItem2) => {
+        return middlewareItem2.name === middleware2;
+      });
+      if (middlewareItem)
+        middlewareItem.handle();
+    } else {
+      middleware2.forEach((m) => {
+        const middlewareItem = middlewares.find((middlewareItem2) => {
+          return middlewareItem2.name === m;
+        });
+        if (middlewareItem)
+          middlewareItem.handle();
+      });
+    }
+  }
+};
+var execute = function(route2, request3, { statusCode }) {
+  if (!statusCode)
+    statusCode = 200;
+  if (route2?.method === "GET" && (statusCode === 301 || statusCode === 302)) {
+    const callback = String(route2.callback);
+    const response = Response.redirect(callback, statusCode);
+    return noCache(response);
+  }
+  if (route2?.method !== request3.method)
+    return new Response("Method not allowed", { status: 405 });
+  if (isString(route2.callback) && extname2(route2.callback) === ".html") {
+    try {
+      const fileContent = Bun.file(route2.callback);
+      return new Response(fileContent, { headers: { "Content-Type": "text/html" } });
+    } catch (error) {
+      return new Response("Error reading the HTML file", { status: 500 });
+    }
+  }
+  if (isString(route2.callback))
+    return new Response(route2.callback);
+  if (isFunction(route2.callback)) {
+    const result = route2.callback();
+    return new Response(JSON.stringify(result));
+  }
+  if (isObject(route2.callback))
+    return new Response(JSON.stringify(route2.callback));
+  return new Response("Unknown callback type.", { status: 500 });
+};
+var noCache = function(response) {
+  response.headers.set("Cache-Control", "no-store, no-cache, must-revalidate, proxy-revalidate");
+  response.headers.set("Pragma", "no-cache");
+  response.headers.set("Expires", "0");
+  return response;
+};
+var isString = function(val) {
+  return typeof val === "string";
+};
+var isObjectNotEmpty = function(obj) {
+  return Object.keys(obj).length > 0;
+};
+var isFunction = function(val) {
+  return typeof val === "function";
+};
+var isObject = function(val) {
+  return val !== null && typeof val === "object" && !Array.isArray(val);
+};
+
+class Router {
+  routes = [];
+  addRoute(method, uri, callback, statusCode) {
+    const name = uri.replace(/\//g, ".").replace(/:/g, "");
+    const pattern = new RegExp(`^${uri.replace(/:[a-zA-Z]+/g, (_match) => {
+      return "([a-zA-Z0-9-]+)";
+    })}$`);
+    let routeCallback;
+    if (typeof callback === "string" || typeof callback === "object") {
+      routeCallback = () => callback;
+    } else {
+      routeCallback = callback;
+    }
+    this.routes.push({
+      name,
+      method,
+      url: uri,
+      uri,
+      callback: routeCallback,
+      pattern,
+      statusCode,
+      paramNames: []
+    });
+  }
+  get(path42, callback) {
+    this.addRoute("GET", path42, callback, 200);
+    return this;
+  }
+  post(path42, callback) {
+    this.addRoute("POST", path42, callback, 201);
+    return this;
+  }
+  view(path42, callback) {
+    this.addRoute("GET", path42, callback, 200);
+    return this;
+  }
+  redirect(path42, callback, _status) {
+    this.addRoute("GET", path42, callback, 302);
+    return this;
+  }
+  delete(path42, callback) {
+    this.addRoute("DELETE", path42, callback, 204);
+    return this;
+  }
+  patch(path42, callback) {
+    this.addRoute("PATCH", path42, callback, 202);
+    return this;
+  }
+  put(path42, callback) {
+    this.addRoute("PUT", path42, callback, 202);
+    return this;
+  }
+  group(options, callback) {
+    let cb;
+    if (typeof options === "function") {
+      cb = options;
+      options = {};
+    } else {
+      if (!callback)
+        throw new Error("Missing callback function for route group.");
+      cb = callback;
+    }
+    const { prefix = "", middleware: middleware2 = [] } = options;
+    const originalRoutes = this.routes;
+    this.routes = [];
+    cb();
+    this.routes.forEach((r) => {
+      r.uri = `${prefix}${r.uri}`;
+      if (middleware2.length)
+        r.middleware = middleware2;
+      originalRoutes.push(r);
+      return this;
+    });
+    this.routes = originalRoutes;
+    return this;
+  }
+  name(name) {
+    this.routes[this.routes.length - 1].name = name;
+    return this;
+  }
+  middleware(middleware2) {
+    this.routes[this.routes.length - 1].middleware = middleware2;
+    return this;
+  }
+  prefix(prefix) {
+    this.routes[this.routes.length - 1].prefix = prefix;
+    return this;
+  }
+  async getRoutes() {
+    await import(projectPath("routes/api.ts"));
+    return this.routes;
+  }
+}
+var route = new Router;
+
+// src/runtime/server.ts
+var server_default = {
+  async fetch(request2, server) {
+    console.log("Request", {
+      url: request2.url,
+      method: request2.method,
+      headers: request2.headers.toJSON(),
+      body: request2.body ? await request2.text() : null
+    });
+    if (server.upgrade(request2)) {
+      console.log("WebSocket upgraded");
+      return;
+    }
+    return serverResponse(request2);
+  },
+  websocket: {}
+};
+export {
+  server_default as server,
+  purchaseDomain,
+  isFirstDeployment,
+  isFailedState,
+  hasBeenDeployed,
+  getSecurityGroupId,
+  getSecurityGroupFromInstanceId,
+  getOrCreateTimestamp,
+  getJumpBoxSecurityGroupName,
+  getJumpBoxInstanceProfileName,
+  getJumpBoxInstanceId,
+  deleteStacksFunctions,
+  deleteStacksBuckets,
+  deleteParameterStore,
+  deleteLogGroups,
+  deleteJumpBox,
+  deleteIamUsers,
+  deleteEc2Instance,
+  deleteCdkRemnants,
+  addJumpBox,
+  InstanceType,
+  Cloud
+};