@stacksjs/cloud 0.59.11 → 0.61.0

package/dist/index.js

@@ -5,13 +5,13 @@ import {CloudWatchLogsClient, DeleteLogGroupCommand, DescribeLogGroupsCommand} f
 import {EC2, _InstanceType as InstanceType} from "@aws-sdk/client-ec2";
 import {DescribeFileSystemsCommand, EFSClient} from "@aws-sdk/client-efs";
 import {IAM} from "@aws-sdk/client-iam";
-import {SSM} from "@aws-sdk/client-ssm";
 import {Lambda} from "@aws-sdk/client-lambda";
 import {ContactType, Route53Domains} from "@aws-sdk/client-route-53-domains";
 import {ListBucketsCommand, S3} from "@aws-sdk/client-s3";
+import {SSM} from "@aws-sdk/client-ssm";
+import {runCommand} from "@stacksjs/cli";
 import {config as config2} from "@stacksjs/config";
 import {err, handleError, ok} from "@stacksjs/error-handling";
-import {runCommand} from "@stacksjs/cli";
 import {log} from "@stacksjs/logging";
 import {path as p} from "@stacksjs/path";
 import {slug} from "@stacksjs/strings";
@@ -97,7 +97,7 @@ async function getJumpBoxInstanceId(name) {
       }
     ]
   });
-  if (data.Reservations && data.Reservations[0] && data.Reservations[0].Instances && data.Reservations[0].Instances[0])
+  if (data.Reservations?.[0].Instances?.[0])
     return data.Reservations[0].Instances[0].InstanceId;
   return;
 }
@@ -133,14 +133,20 @@ async function deleteIamUsers() {
     const userName = user.UserName || "";
     log.info(`Deleting IAM user: ${userName}`);
     const policies = await iam.listAttachedUserPolicies({ UserName: userName });
-    await Promise.all(policies.AttachedPolicies?.map((policy) => iam.detachUserPolicy({ UserName: userName, PolicyArn: policy.PolicyArn || "" })) || []);
+    await Promise.all(policies.AttachedPolicies?.map((policy) => iam.detachUserPolicy({
+      UserName: userName,
+      PolicyArn: policy.PolicyArn || ""
+    })) || []);
     const accessKeys = await iam.listAccessKeys({ UserName: userName });
-    await Promise.all(accessKeys.AccessKeyMetadata?.map((key) => iam.deleteAccessKey({ UserName: userName, AccessKeyId: key.AccessKeyId || "" })) || []);
+    await Promise.all(accessKeys.AccessKeyMetadata?.map((key) => iam.deleteAccessKey({
+      UserName: userName,
+      AccessKeyId: key.AccessKeyId || ""
+    })) || []);
     return iam.deleteUser({ UserName: userName });
   });
   await Promise.all(promises).catch((error) => {
-    console.error(`Error deleting user: ${error}`);
-    return err(handleError("Error deleting Stacks IAM users", error));
+    console.error(error);
+    return err(handleError("Error deleting Stacks IAM users"));
   });
   return ok(`Stacks IAM users deleted for team ${teamName}`);
 }
@@ -165,18 +171,30 @@ async function deleteStacksBuckets() {
       try {
         const versions = await s3.listObjectVersions({ Bucket: bucketName });
         if (versions.Versions) {
-          await Promise.all(versions.Versions.map((version) => s3.deleteObject({ Bucket: bucketName, Key: version.Key || "", VersionId: version.VersionId }))).catch((error) => handleError(error));
+          await Promise.all(versions.Versions.map((version) => s3.deleteObject({
+            Bucket: bucketName,
+            Key: version.Key || "",
+            VersionId: version.VersionId
+          }))).catch((error) => handleError(error));
           log.info(`Finished deleting versions from bucket ${bucketName}`);
         }
         log.info(`Deleting bucket ${bucketName} delete markers...`);
         if (versions.DeleteMarkers) {
-          await Promise.all(versions.DeleteMarkers.map((marker) => s3.deleteObject({ Bucket: bucketName, Key: marker.Key || "", VersionId: marker.VersionId }))).catch((error) => handleError(error));
+          await Promise.all(versions.DeleteMarkers.map((marker) => s3.deleteObject({
+            Bucket: bucketName,
+            Key: marker.Key || "",
+            VersionId: marker.VersionId
+          }))).catch((error) => handleError(error));
           log.info(`Finished deleting delete markers from bucket ${bucketName}`);
         }
         const uploads = await s3.listMultipartUploads({ Bucket: bucketName });
         if (uploads.Uploads) {
           log.info("Aborting bucket multipart uploads...");
-          await Promise.all(uploads.Uploads.map((upload) => s3.abortMultipartUpload({ Bucket: bucketName, Key: upload.Key || "", UploadId: upload.UploadId }))).catch((error) => handleError(error));
+          await Promise.all(uploads.Uploads.map((upload) => s3.abortMultipartUpload({
+            Bucket: bucketName,
+            Key: upload.Key || "",
+            UploadId: upload.UploadId
+          }))).catch((error) => handleError(error));
           log.info(`Finished aborting multipart uploads from bucket ${bucketName}`);
         }
         await s3.deleteBucket({ Bucket: bucketName }).catch((error) => handleError(error));
@@ -186,11 +204,13 @@ async function deleteStacksBuckets() {
       }
     });
     await Promise.all(promises).catch((error) => {
-      return err(handleError("Error deleting stacks buckets", error));
+      console.error(error);
+      return err(handleError("Error deleting stacks buckets"));
     });
     return ok("Stacks buckets deleted");
   } catch (error) {
-    return err(handleError("Error deleting stacks buckets", error));
+    console.error(error);
+    return err(handleError("Error deleting stacks buckets"));
   }
 }
 async function deleteStacksFunctions() {
@@ -205,7 +225,8 @@ async function deleteStacksFunctions() {
       log.info("Function is replicated, skipping...");
       return ok("CloudFront is still deleting the some functions. Try again later.");
     }
-    return err(handleError("Error deleting stacks functions", error));
+    console.error(error);
+    return err(handleError("Error deleting stacks functions"));
   });
   return ok("Stacks functions deleted");
 }
@@ -221,7 +242,8 @@ async function deleteLogGroups() {
     }
     return ok("Log groups deleted");
   } catch (error) {
-    return err(handleError("Error deleting log groups", error));
+    console.error(error);
+    return err(handleError("Error deleting log groups"));
   }
 }
 async function deleteParameterStore() {
@@ -234,7 +256,8 @@ async function deleteParameterStore() {
     return ok("No stacks parameters found");
   const promises = stacksParameters.map((param) => ssm.deleteParameter({ Name: param.Name || "" }));
   await Promise.all(promises).catch((error) => {
-    return err(handleError("Error deleting parameter store", error));
+    console.error(error);
+    return err(handleError("Error deleting parameter store"));
   });
   return ok("Parameter store deleted");
 }
@@ -242,7 +265,8 @@ async function deleteCdkRemnants() {
   try {
     return ok(await runCommand(`bunx rimraf ${p.cloudPath("cdk.out/")} ${p.cloudPath("cdk.context.json")}`));
   } catch (error) {
-    return err(handleError("Error deleting CDK remnants", error));
+    console.error(error);
+    return err(handleError("Error deleting CDK remnants"));
   }
 }
 async function hasBeenDeployed() {
@@ -251,7 +275,8 @@ async function hasBeenDeployed() {
     const response = await s3.send(new ListBucketsCommand({}));
     return ok(response.Buckets?.some((bucket) => bucket.Name?.includes(config2.app.name?.toLocaleLowerCase() || "stacks")) || false);
   } catch (error) {
-    return err(handleError("Error checking if the app has been deployed", error));
+    console.error(error);
+    return err(handleError("Error checking if the app has been deployed"));
   }
 }
 async function getJumpBoxInstanceProfileName() {
@@ -274,11 +299,9 @@ async function addJumpBox(stackName) {
   if (!r.value)
     return err("Security group not found when adding jump-box");
   const result = await getSecurityGroupId(r.value);
-  let sgId;
   if (result.isErr())
     return err(result.error);
-  else
-    sgId = result.value;
+  const sgId = result.value;
   if (!sgId)
     return err("Security group not found when adding jump-box");
   const client = new EFSClient({ region: "us-east-1" });
@@ -329,7 +352,7 @@ git clone https://github.com/stacksjs/stacks.git /mnt/efs
       Name: jumpBoxInstanceProfileName
     }
   });
-  return instance.Instances && instance.Instances[0] ? ok(`Jump-box created with id ${instance.Instances[0].InstanceId}`) : err("Jump-box creation failed");
+  return instance.Instances?.[0] ? ok(`Jump-box created with id ${instance.Instances[0].InstanceId}`) : err("Jump-box creation failed");
 }
 async function getJumpBoxSecurityGroupName() {
   const jumpBoxId = await getJumpBoxInstanceId();
@@ -337,10 +360,10 @@ async function getJumpBoxSecurityGroupName() {
     return err("Jump-box not found");
   const ec2 = new EC2({ region: "us-east-1" });
   const data = await ec2.describeInstances({ InstanceIds: [jumpBoxId] });
-  if (data.Reservations && data.Reservations[0] && data.Reservations[0].Instances && data.Reservations[0].Instances[0]) {
+  if (data.Reservations?.[0].Instances?.[0]) {
     const instance = data.Reservations[0].Instances[0];
     const securityGroups = instance.SecurityGroups;
-    if (securityGroups && securityGroups[0])
+    if (securityGroups?.[0])
       return ok(securityGroups[0].GroupName);
   }
   return err("Security group not found");
@@ -348,10 +371,10 @@ async function getJumpBoxSecurityGroupName() {
 async function getSecurityGroupFromInstanceId(instanceId) {
   const ec2 = new EC2({ region: "us-east-1" });
   const data = await ec2.describeInstances({ InstanceIds: [instanceId] });
-  if (data.Reservations && data.Reservations[0] && data.Reservations[0].Instances && data.Reservations[0].Instances[0]) {
+  if (data.Reservations?.[0].Instances?.[0]) {
     const instance = data.Reservations[0].Instances[0];
     const securityGroups = instance.SecurityGroups;
-    if (securityGroups && securityGroups[0])
+    if (securityGroups?.[0])
       return securityGroups[0].GroupId;
   }
   return;
@@ -359,13 +382,17 @@ async function getSecurityGroupFromInstanceId(instanceId) {
 async function isFirstDeployment() {
   const stackName = cloudName;
   const cloudFormation = new CloudFormation;
-  const data = await cloudFormation.listStacks({ StackStatusFilter: ["CREATE_COMPLETE", "UPDATE_COMPLETE"] });
+  const data = await cloudFormation.listStacks({
+    StackStatusFilter: ["CREATE_COMPLETE", "UPDATE_COMPLETE"]
+  });
   const isStacksCloudPresent = data.StackSummaries?.some((stack) => stack.StackName === stackName);
   return !isStacksCloudPresent;
 }
 async function isFailedState() {
   const cloudFormation = new CloudFormation;
-  const data = await cloudFormation.listStacks({ StackStatusFilter: ["CREATE_FAILED", "UPDATE_FAILED", "ROLLBACK_COMPLETE", "UPDATE_ROLLBACK_COMPLETE"] });
+  const data = await cloudFormation.listStacks({
+    StackStatusFilter: ["CREATE_FAILED", "UPDATE_FAILED", "ROLLBACK_COMPLETE", "UPDATE_ROLLBACK_COMPLETE"]
+  });
   const isStacksCloudPresent = data.StackSummaries?.some((stack) => stack.StackName === cloudName);
   return !isStacksCloudPresent;
 }
@@ -392,12 +419,12 @@ async function getOrCreateTimestamp() {
 var appEnv = config2.app.env === "local" ? "dev" : config2.app.env;
 var cloudName = `stacks-cloud-${appEnv}`;
 // src/cloud/index.ts
-import {Stack as Stack2} from "aws-cdk-lib";
 import {config as config20} from "@stacksjs/config";
+import {Stack as Stack2} from "aws-cdk-lib";
 
 // src/cloud/ai.ts
-import {Duration, CfnOutput as Output, aws_iam as iam, aws_lambda as lambda} from "aws-cdk-lib";
 import {config as config4} from "@stacksjs/config";
+import {Duration, CfnOutput as Output, aws_iam as iam, aws_lambda as lambda} from "aws-cdk-lib";
 
 class AiStack {
   askAiUrl;
@@ -410,17 +437,12 @@ class AiStack {
     });
     const bedrockAccessPolicy = new iam.PolicyStatement({
       effect: iam.Effect.ALLOW,
-      actions: [
-        "bedrock:InvokeModel",
-        "bedrock:InvokeModelWithResponseStream"
-      ],
+      actions: ["bedrock:InvokeModel", "bedrock:InvokeModelWithResponseStream"],
       resources: config4.ai.models?.map((model) => `arn:aws:bedrock:us-east-1::foundation-model/${model}`)
     });
     const bedrockAccessRole = new iam.Role(scope, "BedrockAccessRole", {
       assumedBy: new iam.ServicePrincipal("lambda.amazonaws.com"),
-      managedPolicies: [
-        iam.ManagedPolicy.fromAwsManagedPolicyName("service-role/AWSLambdaBasicExecutionRole")
-      ]
+      managedPolicies: [iam.ManagedPolicy.fromAwsManagedPolicyName("service-role/AWSLambdaBasicExecutionRole")]
     });
     bedrockAccessRole.addToPolicy(bedrockAccessPolicy);
     const askAi = new lambda.Function(scope, "AskAiFunction", {
@@ -473,11 +495,19 @@ class AiStack {
 }
 
 // src/cloud/cdn.ts
-import {Duration as Duration2, Fn, CfnOutput as Output2, aws_cloudfront as cloudfront, aws_cloudfront_origins as origins, aws_route53 as route53, aws_route53_targets as targets} from "aws-cdk-lib";
 import {config as config6} from "@stacksjs/config";
-import {hasFiles} from "@stacksjs/storage";
-import {path as p2} from "@stacksjs/path";
 import {env as env2} from "@stacksjs/env";
+import {path as p2} from "@stacksjs/path";
+import {hasFiles} from "@stacksjs/storage";
+import {
+Duration as Duration2,
+Fn,
+CfnOutput as Output2,
+aws_cloudfront as cloudfront,
+aws_cloudfront_origins as origins,
+aws_route53 as route53,
+aws_route53_targets as targets
+} from "aws-cdk-lib";
 import * as kinesis from "aws-cdk-lib/aws-kinesis";
 
 class CdnStack {
@@ -506,9 +536,7 @@ class CdnStack {
       encryption: kinesis.StreamEncryption.UNENCRYPTED
     });
     this.realtimeLogConfig = new cloudfront.RealtimeLogConfig(scope, "StacksRealTimeLogConfig", {
-      endPoints: [
-        cloudfront.Endpoint.fromKinesisStream(logStream)
-      ],
+      endPoints: [cloudfront.Endpoint.fromKinesisStream(logStream)],
       fields: [
         "timestamp",
         "c-ip",
@@ -640,7 +668,7 @@ class CdnStack {
     }
   }
   shouldDeployApi() {
-    return config6.cloud.api?.deploy;
+    return config6.api?.deploy;
   }
   apiBehaviorOptions(scope, props) {
     const hostname = `api.${props.domain}`;
@@ -770,7 +798,26 @@ class CdnStack {
   additionalBehaviors(scope, props) {
     let behaviorOptions = {};
     if (this.shouldDeployApi()) {
-      const keysToRemove = ["_HANDLER", "_X_AMZN_TRACE_ID", "AWS_REGION", "AWS_EXECUTION_ENV", "AWS_LAMBDA_FUNCTION_NAME", "AWS_LAMBDA_FUNCTION_MEMORY_SIZE", "AWS_LAMBDA_FUNCTION_VERSION", "AWS_LAMBDA_INITIALIZATION_TYPE", "AWS_LAMBDA_LOG_GROUP_NAME", "AWS_LAMBDA_LOG_STREAM_NAME", "AWS_ACCESS_KEY", "AWS_ACCESS_KEY_ID", "AWS_SECRET_ACCESS_KEY", "AWS_SESSION_TOKEN", "AWS_LAMBDA_RUNTIME_API", "LAMBDA_TASK_ROOT", "LAMBDA_RUNTIME_DIR", "_"];
+      const keysToRemove = [
+        "_HANDLER",
+        "_X_AMZN_TRACE_ID",
+        "AWS_REGION",
+        "AWS_EXECUTION_ENV",
+        "AWS_LAMBDA_FUNCTION_NAME",
+        "AWS_LAMBDA_FUNCTION_MEMORY_SIZE",
+        "AWS_LAMBDA_FUNCTION_VERSION",
+        "AWS_LAMBDA_INITIALIZATION_TYPE",
+        "AWS_LAMBDA_LOG_GROUP_NAME",
+        "AWS_LAMBDA_LOG_STREAM_NAME",
+        "AWS_ACCESS_KEY",
+        "AWS_ACCESS_KEY_ID",
+        "AWS_SECRET_ACCESS_KEY",
+        "AWS_SESSION_TOKEN",
+        "AWS_LAMBDA_RUNTIME_API",
+        "LAMBDA_TASK_ROOT",
+        "LAMBDA_RUNTIME_DIR",
+        "_"
+      ];
       keysToRemove.forEach((key) => delete env2[key]);
       behaviorOptions = this.apiBehaviorOptions(scope, props);
     }
@@ -840,13 +887,240 @@ class CliStack {
   }
 }
 
+// src/cloud/compute.ts
+import {env as env4} from "@stacksjs/env";
+import {path as p3} from "@stacksjs/path";
+import {
+Duration as Duration4,
+CfnOutput as Output4,
+RemovalPolicy,
+aws_ec2 as ec2,
+aws_ecs as ecs,
+aws_route53 as route532,
+aws_route53_targets as route53Targets,
+aws_secretsmanager as secretsmanager
+} from "aws-cdk-lib";
+import * as elbv2 from "aws-cdk-lib/aws-elasticloadbalancingv2";
+import {LogGroup} from "aws-cdk-lib/aws-logs";
+
+class ComputeStack {
+  lb;
+  cluster;
+  taskDefinition;
+  constructor(scope, props) {
+    const vpc = props.vpc;
+    const fileSystem = props.fileSystem;
+    if (!fileSystem)
+      throw new Error("The file system is missing. Please make sure it was created properly.");
+    this.cluster = new ecs.Cluster(scope, "StacksCluster", {
+      clusterName: `${props.slug}-${props.appEnv}-web-server-cluster`,
+      vpc
+    });
+    this.taskDefinition = new ecs.FargateTaskDefinition(scope, "TaskDefinition", {
+      family: `${props.appName}-${props.appEnv}-api`,
+      memoryLimitMiB: 512,
+      cpu: 256,
+      runtimePlatform: {
+        cpuArchitecture: ecs.CpuArchitecture.ARM64
+      }
+    });
+    const container = this.taskDefinition.addContainer("WebServerContainer", {
+      containerName: `${props.appName}-${props.appEnv}-api`,
+      image: ecs.ContainerImage.fromAsset(p3.frameworkPath("server")),
+      logging: new ecs.AwsLogDriver({
+        streamPrefix: `${props.appName}-${props.appEnv}-web-server-logs`,
+        logGroup: new LogGroup(scope, "StacksApiLogs", {
+          logGroupName: "/aws/ecs/stacks-api",
+          removalPolicy: RemovalPolicy.DESTROY
+        })
+      }),
+      healthCheck: {
+        command: ["CMD-SHELL", "curl -f http://localhost:3000/api/health || exit 1"],
+        interval: Duration4.seconds(10),
+        timeout: Duration4.seconds(5),
+        retries: 3,
+        startPeriod: Duration4.seconds(10)
+      }
+    });
+    container.addPortMappings({
+      containerPort: 3000,
+      hostPort: 3000
+    });
+    const serviceSecurityGroup = new ec2.SecurityGroup(scope, "ServiceSecurityGroup", {
+      securityGroupName: `${props.appName}-${props.appEnv}-api-service-sg`,
+      vpc,
+      description: "Stacks Security Group for API Service"
+    });
+    const publicLoadBalancerSG = new ec2.SecurityGroup(scope, "PublicLoadBalancerSG", {
+      securityGroupName: `${props.appName}-${props.appEnv}-public-load-balancer-sg`,
+      vpc,
+      description: "Access to the public facing load balancer"
+    });
+    serviceSecurityGroup.addIngressRule(publicLoadBalancerSG, ec2.Port.allTraffic(), "Ingress from the public ALB");
+    this.lb = new elbv2.ApplicationLoadBalancer(scope, "ApplicationLoadBalancer", {
+      http2Enabled: true,
+      loadBalancerName: `${props.appName}-${props.appEnv}-alb`,
+      vpc,
+      vpcSubnets: {
+        subnets: vpc.selectSubnets({
+          subnetType: ec2.SubnetType.PUBLIC,
+          onePerAz: true
+        }).subnets
+      },
+      internetFacing: true,
+      idleTimeout: Duration4.seconds(30),
+      securityGroup: publicLoadBalancerSG
+    });
+    new route532.ARecord(scope, "ApiDomainAliasRecord", {
+      zone: props.zone,
+      recordName: "api",
+      target: route532.RecordTarget.fromAlias(new route53Targets.LoadBalancerTarget(this.lb))
+    });
+    const serviceTargetGroup = new elbv2.ApplicationTargetGroup(scope, "ServiceTargetGroup", {
+      targetGroupName: `${props.appName}-${props.appEnv}-api-tg`,
+      vpc,
+      targetType: elbv2.TargetType.IP,
+      protocol: elbv2.ApplicationProtocol.HTTP,
+      port: 3000,
+      healthCheck: {
+        interval: Duration4.seconds(6),
+        path: "/api/health",
+        protocol: elbv2.Protocol.HTTP,
+        timeout: Duration4.seconds(5),
+        healthyThresholdCount: 2,
+        unhealthyThresholdCount: 10
+      }
+    });
+    const service = new ecs.FargateService(scope, "StacksApiService", {
+      serviceName: `${props.appName}-${props.appEnv}-api-service`,
+      cluster: this.cluster,
+      taskDefinition: this.taskDefinition,
+      desiredCount: 1,
+      assignPublicIp: true,
+      maxHealthyPercent: 200,
+      vpcSubnets: vpc.selectSubnets({
+        subnetType: ec2.SubnetType.PUBLIC,
+        onePerAz: true
+      }),
+      minHealthyPercent: 75,
+      securityGroups: [serviceSecurityGroup]
+    });
+    service.attachToApplicationTargetGroup(serviceTargetGroup);
+    publicLoadBalancerSG.addIngressRule(ec2.Peer.anyIpv4(), ec2.Port.allTraffic());
+    this.lb.addListener("HttpsListener", {
+      port: 443,
+      certificates: [props.certificate],
+      defaultAction: elbv2.ListenerAction.forward([serviceTargetGroup])
+    });
+    this.lb.addListener("HttpListener", {
+      port: 80,
+      defaultAction: elbv2.ListenerAction.forward([serviceTargetGroup])
+    });
+    props.fileSystem.connections.allowFromAnyIpv4(ec2.Port.tcp(2049));
+    const volumeName = `${props.slug}-${props.appEnv}-efs`;
+    this.taskDefinition.addVolume({
+      name: volumeName,
+      efsVolumeConfiguration: {
+        fileSystemId: props.fileSystem.fileSystemId
+      }
+    });
+    container.addMountPoints({
+      sourceVolume: volumeName,
+      containerPath: "/mnt/efs",
+      readOnly: false
+    });
+    const scaling = service.autoScaleTaskCount({ maxCapacity: 2 });
+    scaling.scaleOnCpuUtilization("CpuScaling", {
+      targetUtilizationPercent: 50,
+      scaleInCooldown: Duration4.seconds(60),
+      scaleOutCooldown: Duration4.seconds(60)
+    });
+    scaling.scaleOnMemoryUtilization("MemoryScaling", {
+      targetUtilizationPercent: 60,
+      scaleInCooldown: Duration4.seconds(60),
+      scaleOutCooldown: Duration4.seconds(60)
+    });
+    const keysToRemove = [
+      "_HANDLER",
+      "_X_AMZN_TRACE_ID",
+      "AWS_REGION",
+      "AWS_EXECUTION_ENV",
+      "AWS_LAMBDA_FUNCTION_NAME",
+      "AWS_LAMBDA_FUNCTION_MEMORY_SIZE",
+      "AWS_LAMBDA_FUNCTION_VERSION",
+      "AWS_LAMBDA_INITIALIZATION_TYPE",
+      "AWS_LAMBDA_LOG_GROUP_NAME",
+      "AWS_LAMBDA_LOG_STREAM_NAME",
+      "AWS_ACCESS_KEY",
+      "AWS_ACCESS_KEY_ID",
+      "AWS_SECRET_ACCESS_KEY",
+      "AWS_SESSION_TOKEN",
+      "AWS_LAMBDA_RUNTIME_API",
+      "LAMBDA_TASK_ROOT",
+      "LAMBDA_RUNTIME_DIR",
+      "_"
+    ];
+    keysToRemove.forEach((key) => delete env4[key]);
+    const secrets = new secretsmanager.Secret(scope, "StacksSecrets", {
+      secretName: `${props.slug}-${props.appEnv}-secrets`,
+      description: "Secrets for the Stacks application",
+      generateSecretString: {
+        secretStringTemplate: JSON.stringify(env4),
+        generateStringKey: Object.keys(env4).join(",").length.toString()
+      }
+    });
+    secrets.grantRead(service.taskDefinition.executionRole);
+    container.addEnvironment("SECRETS_ARN", secrets.secretArn);
+    const apiPrefix = "api";
+    new Output4(scope, "ApiUrl", {
+      value: `https://${props.domain}/${apiPrefix}`,
+      description: "The URL of the deployed application"
+    });
+    new Output4(scope, "ApiVanityUrl", {
+      value: `http://${this.lb.loadBalancerDnsName}`,
+      description: "The Vanity URL / DNS name of the load balancer"
+    });
+  }
+}
+
+// src/cloud/deployment.ts
+import {config as config8} from "@stacksjs/config";
+import {websiteSourceHash} from "@stacksjs/utils";
+import {AssetHashType, aws_s3_deployment as s3deploy} from "aws-cdk-lib";
+
+class DeploymentStack {
+  privateSource;
+  docsSource;
+  websiteSource;
+  constructor(scope, props) {
+    this.privateSource = "../../private";
+    this.docsSource = "../docs/dist/";
+    this.websiteSource = config8.app.docMode === true ? this.docsSource : "../views/dist/";
+    new s3deploy.BucketDeployment(scope, "Website", {
+      sources: [
+        s3deploy.Source.asset(this.websiteSource, {
+          assetHash: websiteSourceHash(),
+          assetHashType: AssetHashType.CUSTOM
+        })
+      ],
+      destinationBucket: props.publicBucket,
+      distribution: props.cdn,
+      distributionPaths: ["/*"]
+    });
+    new s3deploy.BucketDeployment(scope, "PrivateFiles", {
+      sources: [s3deploy.Source.asset(this.privateSource)],
+      destinationBucket: props.privateBucket
+    });
+  }
+}
+
 // src/cloud/dns.ts
-import {RemovalPolicy, aws_route53 as route532, aws_s3 as s3, aws_route53_targets as targets2} from "aws-cdk-lib";
+import {RemovalPolicy as RemovalPolicy2, aws_route53 as route533, aws_s3 as s3, aws_route53_targets as targets2} from "aws-cdk-lib";
 
 class DnsStack {
   zone;
   constructor(scope, props) {
-    this.zone = route532.PublicHostedZone.fromLookup(scope, "AppUrlHostedZone", {
+    this.zone = route533.PublicHostedZone.fromLookup(scope, "AppUrlHostedZone", {
       domainName: props.domain
     });
     const wwwBucket = new s3.Bucket(scope, "WwwBucket", {
@@ -855,47 +1129,47 @@ class DnsStack {
         hostName: props.domain,
         protocol: s3.RedirectProtocol.HTTPS
       },
-      removalPolicy: RemovalPolicy.DESTROY,
+      removalPolicy: RemovalPolicy2.DESTROY,
       autoDeleteObjects: true
     });
-    new route532.ARecord(scope, "WwwAliasRecord", {
+    new route533.ARecord(scope, "WwwAliasRecord", {
       recordName: `www.${props.domain}`,
       zone: this.zone,
-      target: route532.RecordTarget.fromAlias(new targets2.BucketWebsiteTarget(wwwBucket))
+      target: route533.RecordTarget.fromAlias(new targets2.BucketWebsiteTarget(wwwBucket))
     });
-    new route532.ARecord(scope, "StoreAliasRecord", {
+    new route533.ARecord(scope, "StoreAliasRecord", {
       recordName: `store.${props.domain}`,
       zone: this.zone,
-      target: route532.RecordTarget.fromIpAddresses("137.66.37.136")
+      target: route533.RecordTarget.fromIpAddresses("137.66.37.136")
     });
   }
 }
 
 // src/cloud/docs.ts
-import {AssetHashType, CfnOutput as Output4, RemovalPolicy as RemovalPolicy2, aws_lambda as lambda3} from "aws-cdk-lib";
-import {config as config8} from "@stacksjs/config";
-import {path as p3} from "@stacksjs/path";
+import {config as config10} from "@stacksjs/config";
+import {path as p4} from "@stacksjs/path";
 import {storage as storage3} from "@stacksjs/storage";
 import {originRequestFunctionHash} from "@stacksjs/utils";
+import {AssetHashType as AssetHashType2, CfnOutput as Output5, RemovalPolicy as RemovalPolicy3, aws_lambda as lambda3} from "aws-cdk-lib";
 
 class DocsStack {
   originRequestFunction;
   constructor(scope, props) {
-    const docsPrefix = config8.app.docMode ? "" : config8.docs.base;
+    const docsPrefix = config10.app.docMode ? "" : config10.docs.base;
     this.originRequestFunction = new lambda3.Function(scope, "OriginRequestFunction", {
       functionName: `${props.slug}-${props.appEnv}-origin-request-${props.timestamp}`,
       description: "The Stacks Origin Request function that prettifies URLs",
       runtime: lambda3.Runtime.NODEJS_18_X,
       handler: "dist/origin-request.handler",
-      code: lambda3.Code.fromAsset(p3.frameworkCloudPath("dist.zip"), {
+      code: lambda3.Code.fromAsset(p4.frameworkCloudPath("dist.zip"), {
         assetHash: originRequestFunctionHash(),
-        assetHashType: AssetHashType.CUSTOM
+        assetHashType: AssetHashType2.CUSTOM
       })
     });
     const cfnOriginRequestFunction = this.originRequestFunction.node.defaultChild;
-    cfnOriginRequestFunction.applyRemovalPolicy(RemovalPolicy2.RETAIN);
-    if (!config8.app.docMode && storage3.hasFiles(p3.projectPath("docs"))) {
-      new Output4(scope, "DocsUrl", {
+    cfnOriginRequestFunction.applyRemovalPolicy(RemovalPolicy3.RETAIN);
+    if (!config10.app.docMode && storage3.hasFiles(p4.projectPath("docs"))) {
+      new Output5(scope, "DocsUrl", {
         value: `https://${props.domain}/${docsPrefix}`,
         description: "The URL of the deployed documentation"
       });
@@ -903,479 +1177,76 @@ class DocsStack {
   }
 }
 
-// src/cloud/storage.ts
-import {RemovalPolicy as RemovalPolicy3, Tags, aws_backup as backup, aws_iam as iam2, aws_s3 as s32} from "aws-cdk-lib";
+// src/cloud/email.ts
+import {config as config12} from "@stacksjs/config";
+import {
+Duration as Duration5,
+RemovalPolicy as RemovalPolicy4,
+Stack,
+Tags,
+aws_iam as iam2,
+aws_lambda as lambda4,
+aws_route53 as route534,
+aws_s3 as s32,
+aws_s3_notifications as s3n,
+aws_ses as ses
+} from "aws-cdk-lib";
 
-class StorageStack {
-  publicBucket;
-  privateBucket;
-  logBucket;
-  bucketPrefix;
-  vault;
-  backupPlan;
-  backupRole;
+class EmailStack {
+  emailBucket;
   constructor(scope, props) {
-    this.bucketPrefix = `${props.slug}-${props.appEnv}`;
-    this.publicBucket = new s32.Bucket(scope, "PublicBucket", {
-      bucketName: `${this.bucketPrefix}-public-${props.timestamp}`,
-      versioned: true,
-      autoDeleteObjects: true,
-      removalPolicy: RemovalPolicy3.DESTROY,
-      encryption: s32.BucketEncryption.S3_MANAGED
-    });
-    Tags.of(this.publicBucket).add("daily-backup", "true");
-    this.privateBucket = new s32.Bucket(scope, "PrivateBucket", {
-      bucketName: `${this.bucketPrefix}-private-${props.timestamp}`,
+    const bucketPrefix = `${props.slug}-${props.appEnv}`;
+    this.emailBucket = new s32.Bucket(scope, "EmailBucket", {
+      bucketName: `${bucketPrefix}-email-${props.timestamp}`,
       versioned: true,
-      removalPolicy: RemovalPolicy3.DESTROY,
+      removalPolicy: RemovalPolicy4.DESTROY,
       autoDeleteObjects: true,
       encryption: s32.BucketEncryption.S3_MANAGED,
-      enforceSSL: true,
-      publicReadAccess: false,
-      blockPublicAccess: {
-        blockPublicAcls: true,
-        blockPublicPolicy: true,
-        ignorePublicAcls: true,
-        restrictPublicBuckets: true
-      }
-    });
-    Tags.of(this.privateBucket).add("daily-backup", "true");
-    this.logBucket = new s32.Bucket(scope, "LogsBucket", {
-      bucketName: `${this.bucketPrefix}-logs-${props.timestamp}`,
-      removalPolicy: RemovalPolicy3.RETAIN,
-      blockPublicAccess: new s32.BlockPublicAccess({
-        blockPublicAcls: false,
-        ignorePublicAcls: true,
-        blockPublicPolicy: true,
-        restrictPublicBuckets: true
-      }),
-      objectOwnership: s32.ObjectOwnership.BUCKET_OWNER_PREFERRED
+      lifecycleRules: [
+        {
+          id: "24h",
+          enabled: true,
+          expiration: Duration5.days(1),
+          noncurrentVersionExpiration: Duration5.days(1),
+          prefix: "today/"
+        },
+        {
+          id: "Intelligent transition for Inbox",
+          enabled: true,
+          prefix: "inbox/",
+          transitions: [
+            {
+              storageClass: s32.StorageClass.INTELLIGENT_TIERING,
+              transitionAfter: Duration5.days(0)
+            }
+          ]
+        },
+        {
+          id: "Intelligent transition for Sent",
+          enabled: true,
+          prefix: "sent/",
+          transitions: [
+            {
+              storageClass: s32.StorageClass.INTELLIGENT_TIERING,
+              transitionAfter: Duration5.days(0)
+            }
+          ]
+        }
+      ]
     });
-    Tags.of(this.logBucket).add("daily-backup", "true");
-    this.backupRole = this.createBackupRole(scope);
-    this.vault = new backup.BackupVault(scope, "BackupVault", {
-      backupVaultName: `${props.slug}-${props.appEnv}-daily-backup-vault`,
-      encryptionKey: props.kmsKey,
-      removalPolicy: RemovalPolicy3.DESTROY
-    });
-    this.backupPlan = backup.BackupPlan.daily35DayRetention(scope, "BackupPlan", this.vault);
-    this.backupPlan.addSelection("Selection", {
-      role: this.backupRole,
-      resources: [backup.BackupResource.fromTag("daily-backup", "true")]
-    });
-  }
-  createBackupRole(scope) {
-    const backupRole = new iam2.Role(scope, "BackupRole", {
-      assumedBy: new iam2.ServicePrincipal("backup.amazonaws.com")
-    });
-    backupRole.addToPolicy(new iam2.PolicyStatement({
-      actions: [
-        "s3:GetInventoryConfiguration",
-        "s3:PutInventoryConfiguration",
-        "s3:ListBucketVersions",
-        "s3:ListBucket",
-        "s3:GetBucketVersioning",
-        "s3:GetBucketNotification",
-        "s3:PutBucketNotification",
-        "s3:GetBucketLocation",
-        "s3:GetBucketTagging"
-      ],
-      resources: ["arn:aws:s3:::*"],
-      sid: "S3BucketBackupPermissions"
-    }));
-    backupRole.addToPolicy(new iam2.PolicyStatement({
-      actions: [
-        "s3:GetObjectAcl",
-        "s3:GetObject",
-        "s3:GetObjectVersionTagging",
-        "s3:GetObjectVersionAcl",
-        "s3:GetObjectTagging",
-        "s3:GetObjectVersion"
-      ],
-      resources: ["arn:aws:s3:::*/*"],
-      sid: "S3ObjectBackupPermissions"
-    }));
-    backupRole.addToPolicy(new iam2.PolicyStatement({
-      actions: ["s3:ListAllMyBuckets"],
-      resources: ["*"],
-      sid: "S3GlobalPermissions"
-    }));
-    backupRole.addToPolicy(new iam2.PolicyStatement({
-      actions: ["kms:Decrypt", "kms:DescribeKey"],
-      resources: ["*"],
-      sid: "KMSBackupPermissions",
-      conditions: {
-        StringLike: {
-          "kms:ViaService": "s3.*.amazonaws.com"
-        }
-      }
-    }));
-    backupRole.addToPolicy(new iam2.PolicyStatement({
-      actions: [
-        "events:DescribeRule",
-        "events:EnableRule",
-        "events:PutRule",
-        "events:DeleteRule",
-        "events:PutTargets",
-        "events:RemoveTargets",
-        "events:ListTargetsByRule",
-        "events:DisableRule"
-      ],
-      resources: ["arn:aws:events:*:*:rule/AwsBackupManagedRule*"],
-      sid: "EventsPermissions"
-    }));
-    backupRole.addToPolicy(new iam2.PolicyStatement({
-      actions: ["cloudwatch:GetMetricData", "events:ListRules"],
-      resources: ["*"],
-      sid: "EventsMetricsGlobalPermissions"
-    }));
-    return backupRole;
-  }
-}
-
-// src/cloud/security.ts
-import {config as config10} from "@stacksjs/config";
-import {Duration as Duration4, RemovalPolicy as RemovalPolicy4, Tags as Tags2, aws_certificatemanager as acm, aws_kms as kms, aws_wafv2 as wafv2} from "aws-cdk-lib";
-
-class SecurityStack {
-  firewall;
-  kmsKey;
-  certificate;
-  constructor(scope, props) {
-    const firewallOptions = config10.cloud.firewall;
-    if (!firewallOptions)
-      throw new Error("No firewall options found in config");
-    const options = {
-      defaultAction: { allow: {} },
-      scope: "CLOUDFRONT",
-      visibilityConfig: {
-        sampledRequestsEnabled: true,
-        cloudWatchMetricsEnabled: true,
-        metricName: "firewallMetric"
-      },
-      rules: this.getFirewallRules()
-    };
-    this.firewall = new wafv2.CfnWebACL(scope, "StacksWebFirewall", options);
-    Tags2.of(this.firewall).add("Name", "waf-cloudfront", { priority: 300 });
-    Tags2.of(this.firewall).add("Purpose", "CloudFront", { priority: 300 });
-    Tags2.of(this.firewall).add("CreatedBy", "CloudFormation", { priority: 300 });
-    this.kmsKey = new kms.Key(scope, "EncryptionKey", {
-      alias: "stacks-encryption-key",
-      description: "KMS key for Stacks Cloud",
-      enableKeyRotation: true,
-      removalPolicy: RemovalPolicy4.DESTROY,
-      pendingWindow: Duration4.days(30)
-    });
-    this.certificate = new acm.Certificate(scope, "Certificate", {
-      domainName: props.domain,
-      validation: acm.CertificateValidation.fromDns(props.zone),
-      subjectAlternativeNames: [`www.${props.domain}`, `api.${props.domain}`]
-    });
-  }
-  getFirewallRules() {
-    const rules = [];
-    const priorities = [];
-    if (config10.security.firewall?.countryCodes?.length) {
-      priorities.push(1);
-      rules.push({
-        name: "CountryRule",
-        priority: priorities.length,
-        statement: {
-          geoMatchStatement: {
-            countryCodes: config10.security.firewall.countryCodes
-          }
-        },
-        action: {
-          block: {}
-        },
-        visibilityConfig: {
-          sampledRequestsEnabled: true,
-          cloudWatchMetricsEnabled: true,
-          metricName: "CountryRule"
-        }
-      });
-    }
-    if (config10.security.firewall?.ipAddresses?.length) {
-      const ipSet = new wafv2.CfnIPSet(this, "IpSet", {
-        name: "IpSet",
-        description: "IP Set",
-        scope: "CLOUDFRONT",
-        addresses: config10.security.firewall.ipAddresses,
-        ipAddressVersion: "IPV4"
-      });
-      priorities.push(1);
-      rules.push({
-        name: "IpAddressRule",
-        priority: priorities.length,
-        statement: {
-          ipSetReferenceStatement: {
-            arn: ipSet.attrArn
-          }
-        },
-        action: {
-          block: {}
-        },
-        visibilityConfig: {
-          sampledRequestsEnabled: true,
-          cloudWatchMetricsEnabled: true,
-          metricName: "IpAddressRule"
-        }
-      });
-    }
-    if (config10.security.firewall?.httpHeaders?.length) {
-      config10.security.firewall.httpHeaders.forEach((header, index) => {
-        priorities.push(1);
-        rules.push({
-          name: `HttpHeaderRule${index}`,
-          priority: priorities.length,
-          statement: {
-            byteMatchStatement: {
-              fieldToMatch: {
-                singleHeader: {
-                  name: header
-                }
-              },
-              positionalConstraint: "EXACTLY",
-              searchString: "true",
-              textTransformations: [
-                {
-                  priority: index,
-                  type: "NONE"
-                }
-              ]
-            }
-          },
-          action: {
-            block: {}
-          },
-          visibilityConfig: {
-            sampledRequestsEnabled: true,
-            cloudWatchMetricsEnabled: true,
-            metricName: `HttpHeaderRule${index}`
-          }
-        });
-      });
-    }
-    return rules;
-  }
-}
-
-// src/cloud/deployment.ts
-import {AssetHashType as AssetHashType2, aws_s3_deployment as s3deploy} from "aws-cdk-lib";
-import {config as config12} from "@stacksjs/config";
-import {websiteSourceHash} from "@stacksjs/utils";
-
-class DeploymentStack {
-  privateSource;
-  docsSource;
-  websiteSource;
-  constructor(scope, props) {
-    this.privateSource = "../../private";
-    this.docsSource = "../docs/dist/";
-    this.websiteSource = config12.app.docMode === true ? this.docsSource : "../views/dist/";
-    new s3deploy.BucketDeployment(scope, "Website", {
-      sources: [s3deploy.Source.asset(this.websiteSource, {
-        assetHash: websiteSourceHash(),
-        assetHashType: AssetHashType2.CUSTOM
-      })],
-      destinationBucket: props.publicBucket,
-      distribution: props.cdn,
-      distributionPaths: ["/*"]
-    });
-    new s3deploy.BucketDeployment(scope, "PrivateFiles", {
-      sources: [s3deploy.Source.asset(this.privateSource)],
-      destinationBucket: props.privateBucket
-    });
-  }
-}
-
-// src/cloud/jump-box.ts
-import {CfnOutput as Output5, aws_ec2 as ec2, aws_iam as iam3} from "aws-cdk-lib";
-
-class JumpBoxStack {
-  jumpBox;
-  constructor(scope, props) {
-    const role = new iam3.Role(scope, "JumpBoxInstanceRole", {
-      assumedBy: new iam3.ServicePrincipal("ec2.amazonaws.com"),
-      managedPolicies: [
-        iam3.ManagedPolicy.fromAwsManagedPolicyName("AmazonSSMManagedInstanceCore"),
-        iam3.ManagedPolicy.fromAwsManagedPolicyName("CloudWatchAgentServerPolicy")
-      ]
-    });
-    this.jumpBox = new ec2.Instance(scope, "JumpBox", {
-      vpc: props.vpc,
-      instanceType: ec2.InstanceType.of(ec2.InstanceClass.T2, ec2.InstanceSize.MICRO),
-      machineImage: new ec2.AmazonLinuxImage,
-      role,
-      userData: ec2.UserData.custom(`
-      #!/bin/bash
-      yum update -y
-      yum install -y amazon-efs-utils
-      yum install -y git
-      yum install -y https://s3.us-east-1.amazonaws.com/amazon-ssm-us-east-1/latest/linux_amd64/amazon-ssm-agent.rpm
-      mkdir /mnt/efs
-      mount -t efs ${props.fileSystem.fileSystemId}:/ /mnt/efs
-      git clone https://github.com/stacksjs/stacks.git /mnt/efs
-    `)
-    });
-    new Output5(scope, "JumpBoxInstanceId", {
-      value: this.jumpBox.instanceId,
-      description: "The ID of the EC2 instance that can be used to SSH into the Stacks Cloud."
-    });
-  }
-}
-
-// src/cloud/file-system.ts
-import {RemovalPolicy as RemovalPolicy5, aws_efs as efs} from "aws-cdk-lib";
-
-class FileSystemStack {
-  fileSystem;
-  accessPoint;
-  constructor(scope, props) {
-    this.fileSystem = new efs.FileSystem(scope, "FileSystem", {
-      fileSystemName: `${props.slug}-${props.appEnv}-efs`,
-      vpc: props.vpc,
-      removalPolicy: RemovalPolicy5.DESTROY,
-      lifecyclePolicy: efs.LifecyclePolicy.AFTER_7_DAYS,
-      performanceMode: efs.PerformanceMode.GENERAL_PURPOSE,
-      throughputMode: efs.ThroughputMode.BURSTING,
-      enableAutomaticBackups: true,
-      encrypted: true
-    });
-    this.accessPoint = new efs.AccessPoint(scope, "FileSystemAccessPoint", {
-      fileSystem: this.fileSystem,
-      path: "/",
-      posixUser: {
-        uid: "1000",
-        gid: "1000"
-      }
-    });
-  }
-}
-
-// src/cloud/network.ts
-import {aws_ec2 as ec22} from "aws-cdk-lib";
-
-class NetworkStack {
-  vpc;
-  constructor(scope, props) {
-    this.vpc = new ec22.Vpc(scope, "Network", {
-      vpcName: `${props.slug}-${props.appEnv}-vpc`,
-      ipAddresses: ec22.IpAddresses.cidr("10.0.0.0/16"),
-      maxAzs: 3,
-      natGateways: 0,
-      subnetConfiguration: [
-        {
-          name: "public-subnet-1",
-          subnetType: ec22.SubnetType.PUBLIC,
-          cidrMask: 24
-        },
-        {
-          name: "private-subnet-1",
-          subnetType: ec22.SubnetType.PRIVATE_ISOLATED,
-          cidrMask: 28
-        }
-      ]
-    });
-  }
-}
-
-// src/cloud/redirects.ts
-import {config as config14} from "@stacksjs/config";
-import {RemovalPolicy as RemovalPolicy6, aws_route53 as route533, aws_s3 as s33} from "aws-cdk-lib";
-
-class RedirectsStack {
-  redirectZones = [];
-  constructor(scope, props) {
-    config14.dns.redirects?.forEach((redirect) => {
-      const slug2 = redirect.split(".").map((part, index) => index === 0 ? part : part.charAt(0).toUpperCase() + part.slice(1)).join("");
-      const hostedZone = route533.HostedZone.fromLookup(scope, "HostedZone", { domainName: redirect });
-      const redirectBucket = new s33.Bucket(scope, `RedirectBucket${slug2}`, {
-        bucketName: `${redirect}-redirect`,
-        websiteRedirect: {
-          hostName: props.domain,
-          protocol: s33.RedirectProtocol.HTTPS
-        },
-        removalPolicy: RemovalPolicy6.DESTROY,
-        autoDeleteObjects: true
-      });
-      new route533.CnameRecord(scope, `RedirectRecord${slug2}`, {
-        zone: hostedZone,
-        recordName: "redirect",
-        domainName: redirectBucket.bucketWebsiteDomainName
-      });
-    });
-    config14.dns.redirects?.forEach((redirect) => {
-      const slug2 = redirect.split(".").map((part, index) => index === 0 ? part : part.charAt(0).toUpperCase() + part.slice(1)).join("");
-      const hostedZone = route533.HostedZone.fromLookup(scope, `RedirectHostedZone${slug2}`, { domainName: redirect });
-      this.redirectZones.push(hostedZone);
-    });
-  }
-}
-
-// src/cloud/email.ts
-import {Duration as Duration5, RemovalPolicy as RemovalPolicy7, Stack, Tags as Tags3, aws_iam as iam4, aws_lambda as lambda4, aws_route53 as route534, aws_s3 as s34, aws_s3_notifications as s3n, aws_ses as ses} from "aws-cdk-lib";
-import {config as config16} from "@stacksjs/config";
-
-class EmailStack {
-  emailBucket;
-  constructor(scope, props) {
-    const bucketPrefix = `${props.slug}-${props.appEnv}`;
-    this.emailBucket = new s34.Bucket(scope, "EmailBucket", {
-      bucketName: `${bucketPrefix}-email-${props.timestamp}`,
-      versioned: true,
-      removalPolicy: RemovalPolicy7.DESTROY,
-      autoDeleteObjects: true,
-      encryption: s34.BucketEncryption.S3_MANAGED,
-      lifecycleRules: [
-        {
-          id: "24h",
-          enabled: true,
-          expiration: Duration5.days(1),
-          noncurrentVersionExpiration: Duration5.days(1),
-          prefix: "today/"
-        },
-        {
-          id: "Intelligent transition for Inbox",
-          enabled: true,
-          prefix: "inbox/",
-          transitions: [
-            {
-              storageClass: s34.StorageClass.INTELLIGENT_TIERING,
-              transitionAfter: Duration5.days(0)
-            }
-          ]
-        },
-        {
-          id: "Intelligent transition for Sent",
-          enabled: true,
-          prefix: "sent/",
-          transitions: [
-            {
-              storageClass: s34.StorageClass.INTELLIGENT_TIERING,
-              transitionAfter: Duration5.days(0)
-            }
-          ]
-        }
-      ]
-    });
-    Tags3.of(this.emailBucket).add("daily-backup", "true");
-    const sesPrincipal = new iam4.ServicePrincipal("ses.amazonaws.com");
+    Tags.of(this.emailBucket).add("daily-backup", "true");
+    const sesPrincipal = new iam2.ServicePrincipal("ses.amazonaws.com");
     const ruleSetName = `${props.slug}-${props.appEnv}-email-receipt-rule-set`;
     const receiptRuleName = `${props.slug}-${props.appEnv}-email-receipt-rule`;
     const ruleSet = new ses.CfnReceiptRuleSet(scope, "SESReceiptRuleSet", {
       ruleSetName
     });
-    this.emailBucket.addToResourcePolicy(new iam4.PolicyStatement({
+    this.emailBucket.addToResourcePolicy(new iam2.PolicyStatement({
       sid: "AllowSESPuts",
-      effect: iam4.Effect.ALLOW,
+      effect: iam2.Effect.ALLOW,
       principals: [sesPrincipal],
-      actions: [
-        "s3:PutObject"
-      ],
-      resources: [
-        `${this.emailBucket.bucketArn}/*`
-      ],
+      actions: ["s3:PutObject"],
+      resources: [`${this.emailBucket.bucketArn}/*`],
       conditions: {
         StringEquals: {
           "aws:SourceAccount": Stack.of(scope).account
@@ -1398,22 +1269,22 @@ class EmailStack {
             }
           }
         ],
-        recipients: config16.email.mailboxes || [],
-        scanEnabled: config16.email.server?.scan || true,
+        recipients: config12.email.mailboxes || [],
+        scanEnabled: config12.email.server?.scan || true,
         tlsPolicy: "Require"
       }
     });
     receiptRule.node.addDependency(this.emailBucket);
-    const iamGroup = new iam4.Group(scope, "IAMGroup", {
+    const iamGroup = new iam2.Group(scope, "IAMGroup", {
       groupName: `${props.slug}-${props.appEnv}-email-management-s3-group`
     });
-    const listBucketsPolicyStatement = new iam4.PolicyStatement({
-      effect: iam4.Effect.ALLOW,
+    const listBucketsPolicyStatement = new iam2.PolicyStatement({
+      effect: iam2.Effect.ALLOW,
       actions: ["s3:ListAllMyBuckets"],
       resources: ["*"]
     });
-    const policyStatement = new iam4.PolicyStatement({
-      effect: iam4.Effect.ALLOW,
+    const policyStatement = new iam2.PolicyStatement({
+      effect: iam2.Effect.ALLOW,
       actions: [
         "s3:ListBucket",
         "s3:GetObject",
@@ -1424,12 +1295,9 @@ class EmailStack {
         "s3:PutObjectAcl",
         "s3:PutObjectVersionAcl"
       ],
-      resources: [
-        this.emailBucket.bucketArn,
-        `${this.emailBucket.bucketArn}/*`
-      ]
+      resources: [this.emailBucket.bucketArn, `${this.emailBucket.bucketArn}/*`]
     });
-    const policy = new iam4.Policy(scope, "EmailAccessPolicy", {
+    const policy = new iam2.Policy(scope, "EmailAccessPolicy", {
       policyName: `${props.slug}-${props.appEnv}-email-management-s3-policy`,
       statements: [policyStatement, listBucketsPolicyStatement]
     });
@@ -1474,10 +1342,12 @@ class EmailStack {
     new route534.MxRecord(scope, "MxRecord", {
       zone: props.zone,
       recordName: "mail",
-      values: [{
-        priority: 10,
-        hostName: "feedback-smtp.us-east-1.amazonses.com"
-      }]
+      values: [
+        {
+          priority: 10,
+          hostName: "feedback-smtp.us-east-1.amazonses.com"
+        }
+      ]
     });
     new route534.TxtRecord(scope, "TxtSpfRecord", {
       zone: props.zone,
@@ -1489,12 +1359,10 @@ class EmailStack {
       recordName: "_dmarc",
       values: [`v=DMARC1;p=quarantine;pct=25;rua=mailto:dmarcreports@${props.domain}`]
     });
-    const lambdaEmailOutboundRole = new iam4.Role(scope, "LambdaEmailOutboundRole", {
+    const lambdaEmailOutboundRole = new iam2.Role(scope, "LambdaEmailOutboundRole", {
       roleName: `${props.slug}-${props.appEnv}-email-outbound`,
-      assumedBy: new iam4.ServicePrincipal("lambda.amazonaws.com"),
-      managedPolicies: [
-        iam4.ManagedPolicy.fromAwsManagedPolicyName("service-role/AWSLambdaBasicExecutionRole")
-      ]
+      assumedBy: new iam2.ServicePrincipal("lambda.amazonaws.com"),
+      managedPolicies: [iam2.ManagedPolicy.fromAwsManagedPolicyName("service-role/AWSLambdaBasicExecutionRole")]
     });
     const lambdaEmailOutbound = new lambda4.Function(scope, "LambdaEmailOutbound", {
       functionName: `${props.slug}-${props.appEnv}-email-outbound`,
@@ -1510,18 +1378,16 @@ class EmailStack {
       role: lambdaEmailOutboundRole
     });
     lambdaEmailOutboundRole.addToPolicy(policyStatement);
-    const sesPolicyStatement = new iam4.PolicyStatement({
-      effect: iam4.Effect.ALLOW,
+    const sesPolicyStatement = new iam2.PolicyStatement({
+      effect: iam2.Effect.ALLOW,
       actions: ["ses:SendRawEmail"],
       resources: ["*"]
     });
     lambdaEmailOutboundRole.addToPolicy(sesPolicyStatement);
-    const lambdaEmailInboundRole = new iam4.Role(scope, "LambdaEmailInboundRole", {
+    const lambdaEmailInboundRole = new iam2.Role(scope, "LambdaEmailInboundRole", {
       roleName: `${props.slug}-${props.appEnv}-email-inbound`,
-      assumedBy: new iam4.ServicePrincipal("lambda.amazonaws.com"),
-      managedPolicies: [
-        iam4.ManagedPolicy.fromAwsManagedPolicyName("service-role/AWSLambdaBasicExecutionRole")
-      ]
+      assumedBy: new iam2.ServicePrincipal("lambda.amazonaws.com"),
+      managedPolicies: [iam2.ManagedPolicy.fromAwsManagedPolicyName("service-role/AWSLambdaBasicExecutionRole")]
     });
     const lambdaEmailInbound = new lambda4.Function(scope, "LambdaEmailInbound", {
       functionName: `${props.slug}-${props.appEnv}-email-inbound`,
@@ -1541,27 +1407,22 @@ class EmailStack {
       functionName: lambdaEmailInbound.functionName,
       principal: "s3.amazonaws.com"
     });
-    const inboundS3PolicyStatement = new iam4.PolicyStatement({
-      effect: iam4.Effect.ALLOW,
+    const inboundS3PolicyStatement = new iam2.PolicyStatement({
+      effect: iam2.Effect.ALLOW,
       actions: ["s3:*"],
-      resources: [
-        this.emailBucket.bucketArn,
-        `${this.emailBucket.bucketArn}/*`
-      ]
+      resources: [this.emailBucket.bucketArn, `${this.emailBucket.bucketArn}/*`]
     });
     lambdaEmailInboundRole.addToPolicy(inboundS3PolicyStatement);
-    const sesInboundPolicyStatement = new iam4.PolicyStatement({
-      effect: iam4.Effect.ALLOW,
+    const sesInboundPolicyStatement = new iam2.PolicyStatement({
+      effect: iam2.Effect.ALLOW,
       actions: ["ses:ListIdentities"],
       resources: ["*"]
     });
     lambdaEmailInboundRole.addToPolicy(sesInboundPolicyStatement);
-    const lambdaEmailConverterRole = new iam4.Role(scope, "LambdaEmailConverterRole", {
+    const lambdaEmailConverterRole = new iam2.Role(scope, "LambdaEmailConverterRole", {
       roleName: `${props.slug}-${props.appEnv}-email-converter`,
-      assumedBy: new iam4.ServicePrincipal("lambda.amazonaws.com"),
-      managedPolicies: [
-        iam4.ManagedPolicy.fromAwsManagedPolicyName("service-role/AWSLambdaBasicExecutionRole")
-      ]
+      assumedBy: new iam2.ServicePrincipal("lambda.amazonaws.com"),
+      managedPolicies: [iam2.ManagedPolicy.fromAwsManagedPolicyName("service-role/AWSLambdaBasicExecutionRole")]
     });
     const lambdaEmailConverter = new lambda4.Function(scope, "LambdaEmailConverter", {
       functionName: `${props.slug}-${props.appEnv}-email-converter`,
@@ -1576,13 +1437,10 @@ class EmailStack {
         BUCKET: this.emailBucket.bucketName
       }
     });
-    const converterS3PolicyStatement = new iam4.PolicyStatement({
-      effect: iam4.Effect.ALLOW,
+    const converterS3PolicyStatement = new iam2.PolicyStatement({
+      effect: iam2.Effect.ALLOW,
       actions: ["s3:*"],
-      resources: [
-        this.emailBucket.bucketArn,
-        `${this.emailBucket.bucketArn}/*`
-      ]
+      resources: [this.emailBucket.bucketArn, `${this.emailBucket.bucketArn}/*`]
     });
     new lambda4.CfnPermission(scope, "S3ConverterPermission", {
       action: "lambda:InvokeFunction",
@@ -1590,211 +1448,134 @@ class EmailStack {
       principal: "s3.amazonaws.com"
     });
     lambdaEmailConverterRole.addToPolicy(converterS3PolicyStatement);
-    this.emailBucket.addEventNotification(s34.EventType.OBJECT_CREATED_PUT, new s3n.LambdaDestination(lambdaEmailInbound), { prefix: "tmp/email_in/" });
-    this.emailBucket.addEventNotification(s34.EventType.OBJECT_CREATED_PUT, new s3n.LambdaDestination(lambdaEmailOutbound), { prefix: "tmp/email_out/json/" });
-    this.emailBucket.addEventNotification(s34.EventType.OBJECT_CREATED_COPY, new s3n.LambdaDestination(lambdaEmailConverter), { prefix: "sent/" });
-    this.emailBucket.addEventNotification(s34.EventType.OBJECT_CREATED_COPY, new s3n.LambdaDestination(lambdaEmailConverter), { prefix: "inbox/" });
-    this.emailBucket.addEventNotification(s34.EventType.OBJECT_CREATED_COPY, new s3n.LambdaDestination(lambdaEmailConverter), { prefix: "today/" });
+    this.emailBucket.addEventNotification(s32.EventType.OBJECT_CREATED_PUT, new s3n.LambdaDestination(lambdaEmailInbound), { prefix: "tmp/email_in/" });
+    this.emailBucket.addEventNotification(s32.EventType.OBJECT_CREATED_PUT, new s3n.LambdaDestination(lambdaEmailOutbound), { prefix: "tmp/email_out/json/" });
+    this.emailBucket.addEventNotification(s32.EventType.OBJECT_CREATED_COPY, new s3n.LambdaDestination(lambdaEmailConverter), { prefix: "sent/" });
+    this.emailBucket.addEventNotification(s32.EventType.OBJECT_CREATED_COPY, new s3n.LambdaDestination(lambdaEmailConverter), { prefix: "inbox/" });
+    this.emailBucket.addEventNotification(s32.EventType.OBJECT_CREATED_COPY, new s3n.LambdaDestination(lambdaEmailConverter), { prefix: "today/" });
   }
 }
 
-// src/cloud/permissions.ts
-import {SecretValue, aws_iam as iam5} from "aws-cdk-lib";
-import {config as config18} from "@stacksjs/config";
-import {string} from "@stacksjs/strings";
-import {env as env4} from "@stacksjs/env";
+// src/cloud/file-system.ts
+import {RemovalPolicy as RemovalPolicy5, aws_efs as efs} from "aws-cdk-lib";
 
-class PermissionsStack {
-  constructor(scope) {
-    const teamName = config18.team.name;
-    const users = config18.team.members;
-    const password = env4.AWS_DEFAULT_PASSWORD || string.random();
-    for (const name in users) {
-      const id = `User${string.pascalCase(teamName)}${string.pascalCase(name)}`;
-      const userName = string.slug(`${teamName}-${name}`);
-      const user = new iam5.User(scope, id, {
-        userName,
-        password: SecretValue.unsafePlainText(password),
-        passwordResetRequired: true
-      });
-      user.addManagedPolicy(iam5.ManagedPolicy.fromAwsManagedPolicyName("AdministratorAccess"));
-    }
+class FileSystemStack {
+  fileSystem;
+  accessPoint;
+  constructor(scope, props) {
+    this.fileSystem = new efs.FileSystem(scope, "FileSystem", {
+      fileSystemName: `${props.slug}-${props.appEnv}-efs`,
+      vpc: props.vpc,
+      removalPolicy: RemovalPolicy5.DESTROY,
+      lifecyclePolicy: efs.LifecyclePolicy.AFTER_7_DAYS,
+      performanceMode: efs.PerformanceMode.GENERAL_PURPOSE,
+      throughputMode: efs.ThroughputMode.BURSTING,
+      enableAutomaticBackups: true,
+      encrypted: true
+    });
+    this.accessPoint = new efs.AccessPoint(scope, "FileSystemAccessPoint", {
+      fileSystem: this.fileSystem,
+      path: "/",
+      posixUser: {
+        uid: "1000",
+        gid: "1000"
+      }
+    });
   }
 }
 
-// src/cloud/compute.ts
-import {Duration as Duration6, CfnOutput as Output6, RemovalPolicy as RemovalPolicy8, aws_ec2 as ec23, aws_ecs as ecs, aws_route53 as route535, aws_route53_targets as route53Targets, aws_secretsmanager as secretsmanager} from "aws-cdk-lib";
-import {path as p4} from "@stacksjs/path";
-import {env as env6} from "@stacksjs/env";
-import {LogGroup} from "aws-cdk-lib/aws-logs";
-import * as elbv2 from "aws-cdk-lib/aws-elasticloadbalancingv2";
+// src/cloud/jump-box.ts
+import {CfnOutput as Output6, aws_ec2 as ec22, aws_iam as iam3} from "aws-cdk-lib";
 
-class ComputeStack {
-  lb;
-  cluster;
-  taskDefinition;
+class JumpBoxStack {
+  jumpBox;
   constructor(scope, props) {
-    const vpc = props.vpc;
-    const fileSystem = props.fileSystem;
-    if (!fileSystem)
-      throw new Error("The file system is missing. Please make sure it was created properly.");
-    this.cluster = new ecs.Cluster(scope, "StacksCluster", {
-      clusterName: `${props.slug}-${props.appEnv}-web-server-cluster`,
-      vpc
-    });
-    this.taskDefinition = new ecs.FargateTaskDefinition(scope, "TaskDefinition", {
-      family: `${props.appName}-${props.appEnv}-api`,
-      memoryLimitMiB: 512,
-      cpu: 256,
-      runtimePlatform: {
-        cpuArchitecture: ecs.CpuArchitecture.ARM64
-      }
-    });
-    const container = this.taskDefinition.addContainer("WebServerContainer", {
-      containerName: `${props.appName}-${props.appEnv}-api`,
-      image: ecs.ContainerImage.fromAsset(p4.frameworkPath("server")),
-      logging: new ecs.AwsLogDriver({
-        streamPrefix: `${props.appName}-${props.appEnv}-web-server-logs`,
-        logGroup: new LogGroup(scope, "StacksApiLogs", {
-          logGroupName: "/aws/ecs/stacks-api",
-          removalPolicy: RemovalPolicy8.DESTROY
-        })
-      }),
-      healthCheck: {
-        command: ["CMD-SHELL", "curl -f http://localhost:3000/api/health || exit 1"],
-        interval: Duration6.seconds(10),
-        timeout: Duration6.seconds(5),
-        retries: 3,
-        startPeriod: Duration6.seconds(10)
-      }
-    });
-    container.addPortMappings({
-      containerPort: 3000,
-      hostPort: 3000
+    const role = new iam3.Role(scope, "JumpBoxInstanceRole", {
+      assumedBy: new iam3.ServicePrincipal("ec2.amazonaws.com"),
+      managedPolicies: [
+        iam3.ManagedPolicy.fromAwsManagedPolicyName("AmazonSSMManagedInstanceCore"),
+        iam3.ManagedPolicy.fromAwsManagedPolicyName("CloudWatchAgentServerPolicy")
+      ]
     });
-    const serviceSecurityGroup = new ec23.SecurityGroup(scope, "ServiceSecurityGroup", {
-      securityGroupName: `${props.appName}-${props.appEnv}-api-service-sg`,
-      vpc,
-      description: "Stacks Security Group for API Service"
+    this.jumpBox = new ec22.Instance(scope, "JumpBox", {
+      vpc: props.vpc,
+      instanceType: ec22.InstanceType.of(ec22.InstanceClass.T2, ec22.InstanceSize.MICRO),
+      machineImage: new ec22.AmazonLinuxImage,
+      role,
+      userData: ec22.UserData.custom(`
+      #!/bin/bash
+      yum update -y
+      yum install -y amazon-efs-utils
+      yum install -y git
+      yum install -y https://s3.us-east-1.amazonaws.com/amazon-ssm-us-east-1/latest/linux_amd64/amazon-ssm-agent.rpm
+      mkdir /mnt/efs
+      mount -t efs ${props.fileSystem.fileSystemId}:/ /mnt/efs
+      git clone https://github.com/stacksjs/stacks.git /mnt/efs
+    `)
     });
-    const publicLoadBalancerSG = new ec23.SecurityGroup(scope, "PublicLoadBalancerSG", {
-      securityGroupName: `${props.appName}-${props.appEnv}-public-load-balancer-sg`,
-      vpc,
-      description: "Access to the public facing load balancer"
+    new Output6(scope, "JumpBoxInstanceId", {
+      value: this.jumpBox.instanceId,
+      description: "The ID of the EC2 instance that can be used to SSH into the Stacks Cloud."
     });
-    serviceSecurityGroup.addIngressRule(publicLoadBalancerSG, ec23.Port.allTraffic(), "Ingress from the public ALB");
-    this.lb = new elbv2.ApplicationLoadBalancer(scope, "ApplicationLoadBalancer", {
-      http2Enabled: true,
-      loadBalancerName: `${props.appName}-${props.appEnv}-alb`,
-      vpc,
-      vpcSubnets: {
-        subnets: vpc.selectSubnets({
+  }
+}
+
+// src/cloud/network.ts
+import {aws_ec2 as ec23} from "aws-cdk-lib";
+
+class NetworkStack {
+  vpc;
+  constructor(scope, props) {
+    this.vpc = new ec23.Vpc(scope, "Network", {
+      vpcName: `${props.slug}-${props.appEnv}-vpc`,
+      ipAddresses: ec23.IpAddresses.cidr("10.0.0.0/16"),
+      maxAzs: 3,
+      natGateways: 0,
+      subnetConfiguration: [
+        {
+          name: "public-subnet-1",
           subnetType: ec23.SubnetType.PUBLIC,
-          onePerAz: true
-        }).subnets
-      },
-      internetFacing: true,
-      idleTimeout: Duration6.seconds(30),
-      securityGroup: publicLoadBalancerSG
-    });
-    new route535.ARecord(scope, "ApiDomainAliasRecord", {
-      zone: props.zone,
-      recordName: "api",
-      target: route535.RecordTarget.fromAlias(new route53Targets.LoadBalancerTarget(this.lb))
-    });
-    const serviceTargetGroup = new elbv2.ApplicationTargetGroup(scope, "ServiceTargetGroup", {
-      targetGroupName: `${props.appName}-${props.appEnv}-api-tg`,
-      vpc,
-      targetType: elbv2.TargetType.IP,
-      protocol: elbv2.ApplicationProtocol.HTTP,
-      port: 3000,
-      healthCheck: {
-        interval: Duration6.seconds(6),
-        path: "/api/health",
-        protocol: elbv2.Protocol.HTTP,
-        timeout: Duration6.seconds(5),
-        healthyThresholdCount: 2,
-        unhealthyThresholdCount: 10
-      }
-    });
-    const service = new ecs.FargateService(scope, "StacksApiService", {
-      serviceName: `${props.appName}-${props.appEnv}-api-service`,
-      cluster: this.cluster,
-      taskDefinition: this.taskDefinition,
-      desiredCount: 1,
-      assignPublicIp: true,
-      maxHealthyPercent: 200,
-      vpcSubnets: vpc.selectSubnets({
-        subnetType: ec23.SubnetType.PUBLIC,
-        onePerAz: true
-      }),
-      minHealthyPercent: 75,
-      securityGroups: [serviceSecurityGroup]
-    });
-    service.attachToApplicationTargetGroup(serviceTargetGroup);
-    publicLoadBalancerSG.addIngressRule(ec23.Peer.anyIpv4(), ec23.Port.allTraffic());
-    this.lb.addListener("HttpsListener", {
-      port: 443,
-      certificates: [props.certificate],
-      defaultAction: elbv2.ListenerAction.forward([serviceTargetGroup])
-    });
-    this.lb.addListener("HttpListener", {
-      port: 80,
-      defaultAction: elbv2.ListenerAction.forward([serviceTargetGroup])
-    });
-    props.fileSystem.connections.allowFromAnyIpv4(ec23.Port.tcp(2049));
-    const volumeName = `${props.slug}-${props.appEnv}-efs`;
-    this.taskDefinition.addVolume({
-      name: volumeName,
-      efsVolumeConfiguration: {
-        fileSystemId: props.fileSystem.fileSystemId
-      }
-    });
-    container.addMountPoints({
-      sourceVolume: volumeName,
-      containerPath: "/mnt/efs",
-      readOnly: false
-    });
-    const scaling = service.autoScaleTaskCount({ maxCapacity: 2 });
-    scaling.scaleOnCpuUtilization("CpuScaling", {
-      targetUtilizationPercent: 50,
-      scaleInCooldown: Duration6.seconds(60),
-      scaleOutCooldown: Duration6.seconds(60)
-    });
-    scaling.scaleOnMemoryUtilization("MemoryScaling", {
-      targetUtilizationPercent: 60,
-      scaleInCooldown: Duration6.seconds(60),
-      scaleOutCooldown: Duration6.seconds(60)
-    });
-    const keysToRemove = ["_HANDLER", "_X_AMZN_TRACE_ID", "AWS_REGION", "AWS_EXECUTION_ENV", "AWS_LAMBDA_FUNCTION_NAME", "AWS_LAMBDA_FUNCTION_MEMORY_SIZE", "AWS_LAMBDA_FUNCTION_VERSION", "AWS_LAMBDA_INITIALIZATION_TYPE", "AWS_LAMBDA_LOG_GROUP_NAME", "AWS_LAMBDA_LOG_STREAM_NAME", "AWS_ACCESS_KEY", "AWS_ACCESS_KEY_ID", "AWS_SECRET_ACCESS_KEY", "AWS_SESSION_TOKEN", "AWS_LAMBDA_RUNTIME_API", "LAMBDA_TASK_ROOT", "LAMBDA_RUNTIME_DIR", "_"];
-    keysToRemove.forEach((key) => delete env6[key]);
-    const secrets = new secretsmanager.Secret(scope, "StacksSecrets", {
-      secretName: `${props.slug}-${props.appEnv}-secrets`,
-      description: "Secrets for the Stacks application",
-      generateSecretString: {
-        secretStringTemplate: JSON.stringify(env6),
-        generateStringKey: Object.keys(env6).join(",").length.toString()
-      }
-    });
-    secrets.grantRead(service.taskDefinition.executionRole);
-    container.addEnvironment("SECRETS_ARN", secrets.secretArn);
-    const apiPrefix = "api";
-    new Output6(scope, "ApiUrl", {
-      value: `https://${props.domain}/${apiPrefix}`,
-      description: "The URL of the deployed application"
-    });
-    new Output6(scope, "ApiVanityUrl", {
-      value: `http://${this.lb.loadBalancerDnsName}`,
-      description: "The Vanity URL / DNS name of the load balancer"
+          cidrMask: 24
+        },
+        {
+          name: "private-subnet-1",
+          subnetType: ec23.SubnetType.PRIVATE_ISOLATED,
+          cidrMask: 28
+        }
+      ]
     });
   }
 }
 
+// src/cloud/permissions.ts
+import {config as config14} from "@stacksjs/config";
+import {env as env6} from "@stacksjs/env";
+import {string} from "@stacksjs/strings";
+import {SecretValue, aws_iam as iam4} from "aws-cdk-lib";
+
+class PermissionsStack {
+  constructor(scope) {
+    const teamName = config14.team.name;
+    const users = config14.team.members;
+    const password = env6.AWS_DEFAULT_PASSWORD || string.random();
+    for (const name in users) {
+      const id = `User${string.pascalCase(teamName)}${string.pascalCase(name)}`;
+      const userName = string.slug(`${teamName}-${name}`);
+      const user = new iam4.User(scope, id, {
+        userName,
+        password: SecretValue.unsafePlainText(password),
+        passwordResetRequired: true
+      });
+      user.addManagedPolicy(iam4.ManagedPolicy.fromAwsManagedPolicyName("AdministratorAccess"));
+    }
+  }
+}
+
 // src/cloud/queue.ts
-import {aws_ec2 as ec24} from "aws-cdk-lib";
-import {pascalCase, slug as slug2} from "@stacksjs/strings";
-import {fs} from "@stacksjs/storage";
 import {path as path6} from "@stacksjs/path";
+import {fs} from "@stacksjs/storage";
+import {pascalCase, slug as slug2} from "@stacksjs/strings";
+import {aws_ec2 as ec24} from "aws-cdk-lib";
 import {Rule, Schedule} from "aws-cdk-lib/aws-events";
 import {EcsTask} from "aws-cdk-lib/aws-events-targets";
 
@@ -1808,8 +1589,10 @@ class QueueStack {
   async init() {
     const jobsDir = path6.jobsPath();
     const actionsDir = path6.appPath("Actions");
+    const ormActionDir = path6.projectStoragePath("framework/orm/Actions");
     const jobFiles = await fs.readdir(jobsDir);
     const actionFiles = await fs.readdir(actionsDir);
+    const ormActionFiles = await fs.readdir(ormActionDir);
     const jobs = [];
     for (const file of jobFiles) {
       if (!file.endsWith(".ts"))
@@ -1819,10 +1602,19 @@ class QueueStack {
       this.createQueueRule(job, file);
       jobs.push(job);
     }
+    for (const ormFile of ormActionFiles) {
+      if (!ormFile.endsWith(".ts"))
+        continue;
+      const ormActionPath = path6.projectStoragePath(`framework/orm/Actions/${ormFile}`);
+      const ormAction = await this.loadModule(ormActionPath);
+      this.createQueueRule(ormAction, ormFile);
+      jobs.push(ormAction);
+    }
     for (const file of actionFiles) {
       if (!file.endsWith(".ts"))
         continue;
       const actionPath = path6.appPath(`Actions/${file}`);
+      console.log(actionPath);
       const action = await this.loadModule(actionPath);
       this.createQueueRule(action, file);
       jobs.push(action);
@@ -1894,6 +1686,303 @@ class QueueStack {
   }
 }
 
+// src/cloud/redirects.ts
+import {config as config16} from "@stacksjs/config";
+import {RemovalPolicy as RemovalPolicy6, aws_route53 as route535, aws_s3 as s33} from "aws-cdk-lib";
+
+class RedirectsStack {
+  redirectZones = [];
+  constructor(scope, props) {
+    config16.dns.redirects?.forEach((redirect) => {
+      const slug3 = redirect.split(".").map((part, index) => index === 0 ? part : part.charAt(0).toUpperCase() + part.slice(1)).join("");
+      const hostedZone = route535.HostedZone.fromLookup(scope, "HostedZone", {
+        domainName: redirect
+      });
+      const redirectBucket = new s33.Bucket(scope, `RedirectBucket${slug3}`, {
+        bucketName: `${redirect}-redirect`,
+        websiteRedirect: {
+          hostName: props.domain,
+          protocol: s33.RedirectProtocol.HTTPS
+        },
+        removalPolicy: RemovalPolicy6.DESTROY,
+        autoDeleteObjects: true
+      });
+      new route535.CnameRecord(scope, `RedirectRecord${slug3}`, {
+        zone: hostedZone,
+        recordName: "redirect",
+        domainName: redirectBucket.bucketWebsiteDomainName
+      });
+    });
+    config16.dns.redirects?.forEach((redirect) => {
+      const slug3 = redirect.split(".").map((part, index) => index === 0 ? part : part.charAt(0).toUpperCase() + part.slice(1)).join("");
+      const hostedZone = route535.HostedZone.fromLookup(scope, `RedirectHostedZone${slug3}`, { domainName: redirect });
+      this.redirectZones.push(hostedZone);
+    });
+  }
+}
+
+// src/cloud/security.ts
+import {config as config18} from "@stacksjs/config";
+import {
+Duration as Duration6,
+RemovalPolicy as RemovalPolicy7,
+Tags as Tags2,
+aws_certificatemanager as acm,
+aws_kms as kms,
+aws_wafv2 as wafv2
+} from "aws-cdk-lib";
+
+class SecurityStack {
+  firewall;
+  kmsKey;
+  certificate;
+  constructor(scope, props) {
+    const firewallOptions = config18.cloud.firewall;
+    if (!firewallOptions)
+      throw new Error("No firewall options found in config");
+    const options = {
+      defaultAction: { allow: {} },
+      scope: "CLOUDFRONT",
+      visibilityConfig: {
+        sampledRequestsEnabled: true,
+        cloudWatchMetricsEnabled: true,
+        metricName: "firewallMetric"
+      },
+      rules: this.getFirewallRules(scope)
+    };
+    this.firewall = new wafv2.CfnWebACL(scope, "StacksWebFirewall", options);
+    Tags2.of(this.firewall).add("Name", "waf-cloudfront", { priority: 300 });
+    Tags2.of(this.firewall).add("Purpose", "CloudFront", { priority: 300 });
+    Tags2.of(this.firewall).add("CreatedBy", "CloudFormation", {
+      priority: 300
+    });
+    this.kmsKey = new kms.Key(scope, "EncryptionKey", {
+      alias: "stacks-encryption-key",
+      description: "KMS key for Stacks Cloud",
+      enableKeyRotation: true,
+      removalPolicy: RemovalPolicy7.DESTROY,
+      pendingWindow: Duration6.days(30)
+    });
+    this.certificate = new acm.Certificate(scope, "Certificate", {
+      domainName: props.domain,
+      validation: acm.CertificateValidation.fromDns(props.zone),
+      subjectAlternativeNames: [`www.${props.domain}`, `api.${props.domain}`]
+    });
+  }
+  getFirewallRules(scope) {
+    const rules = [];
+    const priorities = [];
+    if (config18.security.firewall?.countryCodes?.length) {
+      priorities.push(1);
+      rules.push({
+        name: "CountryRule",
+        priority: priorities.length,
+        statement: {},
+        action: {
+          block: {}
+        },
+        visibilityConfig: {
+          sampledRequestsEnabled: true,
+          cloudWatchMetricsEnabled: true,
+          metricName: "CountryRule"
+        }
+      });
+    }
+    if (config18.security.firewall?.ipAddresses?.length) {
+      const ipSet = new wafv2.CfnIPSet(scope, "IpSet", {
+        name: "IpSet",
+        description: "IP Set",
+        scope: "CLOUDFRONT",
+        addresses: config18.security.firewall.ipAddresses,
+        ipAddressVersion: "IPV4"
+      });
+      priorities.push(1);
+      rules.push({
+        name: "IpAddressRule",
+        priority: priorities.length,
+        statement: {
+          ipSetReferenceStatement: {
+            arn: ipSet.attrArn
+          }
+        },
+        action: {
+          block: {}
+        },
+        visibilityConfig: {
+          sampledRequestsEnabled: true,
+          cloudWatchMetricsEnabled: true,
+          metricName: "IpAddressRule"
+        }
+      });
+    }
+    if (config18.security.firewall?.httpHeaders?.length) {
+      config18.security.firewall.httpHeaders.forEach((header, index) => {
+        priorities.push(1);
+        rules.push({
+          name: `HttpHeaderRule${index}`,
+          priority: priorities.length,
+          statement: {
+            byteMatchStatement: {
+              fieldToMatch: {
+                singleHeader: {
+                  name: header
+                }
+              },
+              positionalConstraint: "EXACTLY",
+              searchString: "true",
+              textTransformations: [
+                {
+                  priority: index,
+                  type: "NONE"
+                }
+              ]
+            }
+          },
+          action: {
+            block: {}
+          },
+          visibilityConfig: {
+            sampledRequestsEnabled: true,
+            cloudWatchMetricsEnabled: true,
+            metricName: `HttpHeaderRule${index}`
+          }
+        });
+      });
+    }
+    return rules;
+  }
+}
+
+// src/cloud/storage.ts
+import {RemovalPolicy as RemovalPolicy8, Tags as Tags3, aws_backup as backup, aws_iam as iam5, aws_s3 as s34} from "aws-cdk-lib";
+
+class StorageStack {
+  publicBucket;
+  privateBucket;
+  logBucket;
+  bucketPrefix;
+  vault;
+  backupPlan;
+  backupRole;
+  constructor(scope, props) {
+    this.bucketPrefix = `${props.slug}-${props.appEnv}`;
+    this.publicBucket = new s34.Bucket(scope, "PublicBucket", {
+      bucketName: `${this.bucketPrefix}-public-${props.timestamp}`,
+      versioned: true,
+      autoDeleteObjects: true,
+      removalPolicy: RemovalPolicy8.DESTROY,
+      encryption: s34.BucketEncryption.S3_MANAGED
+    });
+    Tags3.of(this.publicBucket).add("daily-backup", "true");
+    this.privateBucket = new s34.Bucket(scope, "PrivateBucket", {
+      bucketName: `${this.bucketPrefix}-private-${props.timestamp}`,
+      versioned: true,
+      removalPolicy: RemovalPolicy8.DESTROY,
+      autoDeleteObjects: true,
+      encryption: s34.BucketEncryption.S3_MANAGED,
+      enforceSSL: true,
+      publicReadAccess: false,
+      blockPublicAccess: {
+        blockPublicAcls: true,
+        blockPublicPolicy: true,
+        ignorePublicAcls: true,
+        restrictPublicBuckets: true
+      }
+    });
+    Tags3.of(this.privateBucket).add("daily-backup", "true");
+    this.logBucket = new s34.Bucket(scope, "LogsBucket", {
+      bucketName: `${this.bucketPrefix}-logs-${props.timestamp}`,
+      removalPolicy: RemovalPolicy8.RETAIN,
+      blockPublicAccess: new s34.BlockPublicAccess({
+        blockPublicAcls: false,
+        ignorePublicAcls: true,
+        blockPublicPolicy: true,
+        restrictPublicBuckets: true
+      }),
+      objectOwnership: s34.ObjectOwnership.BUCKET_OWNER_PREFERRED
+    });
+    Tags3.of(this.logBucket).add("daily-backup", "true");
+    this.backupRole = this.createBackupRole(scope);
+    this.vault = new backup.BackupVault(scope, "BackupVault", {
+      backupVaultName: `${props.slug}-${props.appEnv}-daily-backup-vault`,
+      encryptionKey: props.kmsKey,
+      removalPolicy: RemovalPolicy8.DESTROY
+    });
+    this.backupPlan = backup.BackupPlan.daily35DayRetention(scope, "BackupPlan", this.vault);
+    this.backupPlan.addSelection("Selection", {
+      role: this.backupRole,
+      resources: [backup.BackupResource.fromTag("daily-backup", "true")]
+    });
+  }
+  createBackupRole(scope) {
+    const backupRole = new iam5.Role(scope, "BackupRole", {
+      assumedBy: new iam5.ServicePrincipal("backup.amazonaws.com")
+    });
+    backupRole.addToPolicy(new iam5.PolicyStatement({
+      actions: [
+        "s3:GetInventoryConfiguration",
+        "s3:PutInventoryConfiguration",
+        "s3:ListBucketVersions",
+        "s3:ListBucket",
+        "s3:GetBucketVersioning",
+        "s3:GetBucketNotification",
+        "s3:PutBucketNotification",
+        "s3:GetBucketLocation",
+        "s3:GetBucketTagging"
+      ],
+      resources: ["arn:aws:s3:::*"],
+      sid: "S3BucketBackupPermissions"
+    }));
+    backupRole.addToPolicy(new iam5.PolicyStatement({
+      actions: [
+        "s3:GetObjectAcl",
+        "s3:GetObject",
+        "s3:GetObjectVersionTagging",
+        "s3:GetObjectVersionAcl",
+        "s3:GetObjectTagging",
+        "s3:GetObjectVersion"
+      ],
+      resources: ["arn:aws:s3:::*/*"],
+      sid: "S3ObjectBackupPermissions"
+    }));
+    backupRole.addToPolicy(new iam5.PolicyStatement({
+      actions: ["s3:ListAllMyBuckets"],
+      resources: ["*"],
+      sid: "S3GlobalPermissions"
+    }));
+    backupRole.addToPolicy(new iam5.PolicyStatement({
+      actions: ["kms:Decrypt", "kms:DescribeKey"],
+      resources: ["*"],
+      sid: "KMSBackupPermissions",
+      conditions: {
+        StringLike: {
+          "kms:ViaService": "s3.*.amazonaws.com"
+        }
+      }
+    }));
+    backupRole.addToPolicy(new iam5.PolicyStatement({
+      actions: [
+        "events:DescribeRule",
+        "events:EnableRule",
+        "events:PutRule",
+        "events:DeleteRule",
+        "events:PutTargets",
+        "events:RemoveTargets",
+        "events:ListTargetsByRule",
+        "events:DisableRule"
+      ],
+      resources: ["arn:aws:events:*:*:rule/AwsBackupManagedRule*"],
+      sid: "EventsPermissions"
+    }));
+    backupRole.addToPolicy(new iam5.PolicyStatement({
+      actions: ["cloudwatch:GetMetricData", "events:ListRules"],
+      resources: ["*"],
+      sid: "EventsMetricsGlobalPermissions"
+    }));
+    return backupRole;
+  }
+}
+
 // src/cloud/index.ts
 class Cloud extends Stack2 {
   dns;
@@ -1948,7 +2037,7 @@ class Cloud extends Stack2 {
     this.cli = new CliStack(this, props);
   }
   async init() {
-    if (config20.cloud.api?.deploy) {
+    if (config20.api?.deploy) {
       const props = this.props;
       this.api = new ComputeStack(this, {
         ...props,