@stacksjs/ts-cloud 0.16.24 → 0.16.25

package/dist/bin/{chunk-jdfbahjb.js → chunk-t5gkbppg.js}

@@ -1,8 +1,8 @@
-import{createRequire as vr}from"node:module";import{isAbsolute as Ot,join as mt,relative as Lr}from"node:path";import{existsSync as Ge,readdirSync as zr}from"node:fs";import{join as le}from"node:path";import{createHash as gn}from"node:crypto";import{copyFileSync as hn,existsSync as Rt,readdirSync as yn,readFileSync as at,statSync as fn,writeFileSync as nt}from"node:fs";import{basename as Sn,dirname as La,extname as Ma,join as je}from"node:path";import{existsSync as rr,readFileSync as Kt}from"node:fs";import{homedir as nr}from"node:os";import{join as ir}from"node:path";import{createHash as sr}from"node:crypto";import{existsSync as st,mkdirSync as Pi,readdirSync as _a,readFileSync as Wa,unlinkSync as Ke,writeFileSync as Ii}from"node:fs";import{join as Dt}from"node:path";import{createHash as Qt}from"node:crypto";import{createReadStream as Ri,readdirSync as Ni,statSync as gt}from"node:fs";import{join as Di,relative as ki}from"node:path";import{deflateRawSync as Fi}from"node:zlib";import{execSync as qi}from"node:child_process";import{createHash as Hi}from"node:crypto";import{cpSync as zi,mkdtempSync as Qi,rmSync as Ji,writeFileSync as Yi}from"node:fs";import{tmpdir as Zi}from"node:os";import{dirname as Xi,isAbsolute as es,join as be,resolve as ts}from"node:path";import{fileURLToPath as as}from"node:url";import{execFileSync as St}from"node:child_process";import{mkdtempSync as lr,readFileSync as bt,rmSync as ur}from"node:fs";import{tmpdir as dr}from"node:os";import{dirname as ss,join as de}from"node:path";import{fileURLToPath as os}from"node:url";import{AsyncLocalStorage as ls}from"node:async_hooks";import{createHash as us}from"node:crypto";import{readFileSync as ys}from"node:fs";import{dirname as fs,join as yr}from"node:path";import{fileURLToPath as Ss}from"node:url";import{execFileSync as ot}from"node:child_process";import{existsSync as As,mkdirSync as Cs,mkdtempSync as vs,readdirSync as Ts,readFileSync as ws,rmSync as Es,statSync as fr,writeFileSync as Ps}from"node:fs";import{tmpdir as Is}from"node:os";import{join as Pe,relative as Rs}from"node:path";import{execSync as Ns}from"node:child_process";import{createHash as Ds}from"node:crypto";import{readdirSync as ks,readFileSync as $s,statSync as br}from"node:fs";import{join as Ls,relative as Ar,resolve as $a}from"node:path";var Tr=Object.defineProperty,wr=(e)=>e;function Er(e,a){this[e]=wr.bind(null,a)}var Le=(e,a)=>{for(var r in a)Tr(e,r,{get:a[r],enumerable:!0,configurable:!0,set:Er.bind(a,r)})},Ir=(e,a,r)=>()=>{if(e)try{a=e(e=0)}catch(n){r=[n]}if(r)throw r[0];return a},Dr=vr(import.meta.url);function fc(e){let a=typeof e==="string"?new URL(e):e,{hostname:r,pathname:n}=a;if(r.endsWith(".on.aws")){let u=r.match(/^[^.]+\.lambda-url\.([^.]+)\.on\.aws$/);if(u)return{service:"lambda",region:u[1]};return{service:"",region:""}}if(r.endsWith(".r2.cloudflarestorage.com"))return{service:"s3",region:"auto"};if(r.endsWith(".backblazeb2.com")){let u=r.match(/^(?:[^.]+\.)?s3\.([^.]+)\.backblazeb2\.com$/);if(u)return{service:"s3",region:u[1]};return{service:"",region:""}}let i=r.replace("dualstack.","").match(/([^.]+)\.(?:([^.]+)\.)?amazonaws\.com(?:\.cn)?$/);if(!i)return{service:"",region:""};let o=i[1],c=i[2]||"";if(c==="us-gov")c="us-gov-west-1";else if(c==="s3"||c==="s3-accelerate")c="us-east-1",o="s3";else if(o==="iot")if(r.startsWith("iot."))o="execute-api";else if(r.startsWith("data.jobs.iot."))o="iot-jobs-data";else o=n==="/mqtt"?"iotdevicegateway":"iotdata";else if(o==="autoscaling");else if(!c&&o.startsWith("s3-"))c=o.slice(3).replace(/^fips-|^external-1/,""),o="s3";else if(o.endsWith("-fips"))o=o.slice(0,-5);else if(c&&/-\d$/.test(o)&&!/-\d$/.test(c))[o,c]=[c,o];return o=Qa[o]||o,{service:o,region:c||"us-east-1"}}function ae(e){let{method:a,url:r,body:n="",accessKeyId:i,secretAccessKey:o,sessionToken:c,signQuery:u=!1,expiresIn:d=86400,datetime:m}=e,p=new URL(r),g=p.hostname,h=fc(p),y=e.service||h.service,f=e.region||h.region;if(!y)throw Error("Could not detect service from URL. Please provide service explicitly.");if(!f)throw Error("Could not detect region from URL. Please provide region explicitly.");let b=m||new Date().toISOString().replace(/[:-]|\.\d{3}/g,""),T=b.substring(0,8),w=[T,f,y,"aws4_request"].join("/"),I="AWS4-HMAC-SHA256";if(u)return kr({urlObj:p,method:a,body:n,accessKeyId:i,secretAccessKey:o,sessionToken:c,service:y,region:f,timestamp:b,date:T,credentialScope:w,algorithm:I,expiresIn:d,cache:e.cache});let v=p.pathname||"/",N=yt(p.searchParams),R={host:g,"x-amz-date":b,...e.headers};if(c)R["x-amz-security-token"]=c;let k=Object.keys(R).some((me)=>me.toLowerCase()==="content-type");if(n&&!k)R["content-type"]="application/x-amz-json-1.0";if(y==="s3"&&!R["x-amz-content-sha256"])R["x-amz-content-sha256"]=He(n);let x=Ua(R),L=Va(R),_=R["x-amz-content-sha256"]||He(n),W=[a,ft(v),N,x,L,_].join(`
-`),V=He(W),Z=[I,b,w,V].join(`
-`),q=e.cache??fe,Q=Ka(o,T,f,y,Z,q),j=[`${I} Credential=${i}/${w}`,`SignedHeaders=${L}`,`Signature=${Q}`].join(", ");return R.authorization=j,{url:r,method:a,headers:R,body:n||void 0}}async function hc(e){let{method:a,url:r,body:n="",accessKeyId:i,secretAccessKey:o,sessionToken:c,signQuery:u=!1,expiresIn:d=86400,datetime:m}=e,p=new URL(r),g=p.hostname,h=fc(p),y=e.service||h.service,f=e.region||h.region;if(!y)throw Error("Could not detect service from URL. Please provide service explicitly.");if(!f)throw Error("Could not detect region from URL. Please provide region explicitly.");let b=m||new Date().toISOString().replace(/[:-]|\.\d{3}/g,""),T=b.substring(0,8),w=[T,f,y,"aws4_request"].join("/"),I="AWS4-HMAC-SHA256";if(u)return $r({urlObj:p,method:a,body:n,accessKeyId:i,secretAccessKey:o,sessionToken:c,service:y,region:f,timestamp:b,date:T,credentialScope:w,algorithm:I,expiresIn:d,cache:e.cache});let v=p.pathname||"/",N=yt(p.searchParams),R={host:g,"x-amz-date":b,...e.headers};if(c)R["x-amz-security-token"]=c;let k=Object.keys(R).some((Me)=>Me.toLowerCase()==="content-type");if(n&&!k)R["content-type"]="application/x-amz-json-1.0";let x=await lt(n);if(y==="s3"&&!R["x-amz-content-sha256"])R["x-amz-content-sha256"]=x;let L=Ua(R),_=Va(R),W=R["x-amz-content-sha256"]||x,V=[a,ft(v),N,L,_,W].join(`
-`),Z=await lt(V),q=[I,b,w,Z].join(`
-`),Q=e.cache??fe,j=await qa(o,T,f,y,q,Q),me=[`${I} Credential=${i}/${w}`,`SignedHeaders=${_}`,`Signature=${j}`].join(", ");return R.authorization=me,{url:r,method:a,headers:R,body:n||void 0}}function kr(e){let{urlObj:a,method:r,body:n,accessKeyId:i,secretAccessKey:o,sessionToken:c,service:u,region:d,timestamp:m,date:p,credentialScope:g,algorithm:h,expiresIn:y,cache:f}=e,b=new URL(a.toString());b.searchParams.set("X-Amz-Algorithm",h),b.searchParams.set("X-Amz-Credential",`${i}/${g}`),b.searchParams.set("X-Amz-Date",m),b.searchParams.set("X-Amz-Expires",String(y));let T=u==="s3"?"UNSIGNED-PAYLOAD":He(n);if(u==="s3")b.searchParams.set("X-Amz-Content-Sha256",T);let w="host";if(b.searchParams.set("X-Amz-SignedHeaders",w),c)b.searchParams.set("X-Amz-Security-Token",c);let I=ft(b.pathname||"/"),v=`host:${b.hostname}
+import{createRequire as vr}from"node:module";import{isAbsolute as Ot,join as mt,relative as Lr}from"node:path";import{existsSync as Ge,readdirSync as zr}from"node:fs";import{join as le}from"node:path";import{createHash as gn}from"node:crypto";import{copyFileSync as hn,existsSync as Rt,readdirSync as yn,readFileSync as at,statSync as fn,writeFileSync as nt}from"node:fs";import{basename as Sn,dirname as La,extname as Ma,join as je}from"node:path";import{existsSync as rr,readFileSync as Kt}from"node:fs";import{homedir as nr}from"node:os";import{join as ir}from"node:path";import{createHash as sr}from"node:crypto";import{existsSync as st,mkdirSync as Pi,readdirSync as _a,readFileSync as Wa,unlinkSync as Ke,writeFileSync as Ii}from"node:fs";import{join as Dt}from"node:path";import{createHash as Qt}from"node:crypto";import{createReadStream as Ri,readdirSync as Ni,statSync as gt}from"node:fs";import{join as Di,relative as ki}from"node:path";import{deflateRawSync as Fi}from"node:zlib";import{execSync as qi}from"node:child_process";import{createHash as Hi}from"node:crypto";import{cpSync as zi,mkdtempSync as Qi,rmSync as Ji,writeFileSync as Yi}from"node:fs";import{tmpdir as Zi}from"node:os";import{dirname as Xi,isAbsolute as es,join as be,resolve as ts}from"node:path";import{fileURLToPath as as}from"node:url";import{execFileSync as St}from"node:child_process";import{mkdtempSync as lr,readFileSync as bt,rmSync as ur}from"node:fs";import{tmpdir as dr}from"node:os";import{dirname as ss,join as de}from"node:path";import{fileURLToPath as os}from"node:url";import{AsyncLocalStorage as ls}from"node:async_hooks";import{createHash as us}from"node:crypto";import{readFileSync as ys}from"node:fs";import{dirname as fs,join as yr}from"node:path";import{fileURLToPath as Ss}from"node:url";import{execFileSync as ot}from"node:child_process";import{existsSync as As,mkdirSync as Cs,mkdtempSync as vs,readdirSync as Ts,readFileSync as ws,rmSync as Es,statSync as fr,writeFileSync as Ps}from"node:fs";import{tmpdir as Is}from"node:os";import{join as Pe,relative as Rs}from"node:path";import{execSync as Ns}from"node:child_process";import{createHash as Ds}from"node:crypto";import{readdirSync as ks,readFileSync as $s,statSync as br}from"node:fs";import{join as Ls,relative as Ar,resolve as $a}from"node:path";var Tr=Object.defineProperty,wr=(e)=>e;function Er(e,a){this[e]=wr.bind(null,a)}var Le=(e,a)=>{for(var r in a)Tr(e,r,{get:a[r],enumerable:!0,configurable:!0,set:Er.bind(a,r)})},Ir=(e,a,r)=>()=>{if(e)try{a=e(e=0)}catch(n){r=[n]}if(r)throw r[0];return a},Dr=vr(import.meta.url);function fc(e){let a=typeof e==="string"?new URL(e):e,{hostname:r,pathname:n}=a;if(r.endsWith(".on.aws")){let u=r.match(/^[^.]+\.lambda-url\.([^.]+)\.on\.aws$/);if(u)return{service:"lambda",region:u[1]};return{service:"",region:""}}if(r.endsWith(".r2.cloudflarestorage.com"))return{service:"s3",region:"auto"};if(r.endsWith(".backblazeb2.com")){let u=r.match(/^(?:[^.]+\.)?s3\.([^.]+)\.backblazeb2\.com$/);if(u)return{service:"s3",region:u[1]};return{service:"",region:""}}let i=r.replace("dualstack.","").match(/([^.]+)\.(?:([^.]+)\.)?amazonaws\.com(?:\.cn)?$/);if(!i)return{service:"",region:""};let o=i[1],c=i[2]||"";if(c==="us-gov")c="us-gov-west-1";else if(c==="s3"||c==="s3-accelerate")c="us-east-1",o="s3";else if(o==="iot")if(r.startsWith("iot."))o="execute-api";else if(r.startsWith("data.jobs.iot."))o="iot-jobs-data";else o=n==="/mqtt"?"iotdevicegateway":"iotdata";else if(o==="autoscaling");else if(!c&&o.startsWith("s3-"))c=o.slice(3).replace(/^fips-|^external-1/,""),o="s3";else if(o.endsWith("-fips"))o=o.slice(0,-5);else if(c&&/-\d$/.test(o)&&!/-\d$/.test(c))[o,c]=[c,o];return o=Qa[o]||o,{service:o,region:c||"us-east-1"}}function ae(e){let{method:a,url:r,body:n="",accessKeyId:i,secretAccessKey:o,sessionToken:c,signQuery:u=!1,expiresIn:d=86400,datetime:m}=e,p=new URL(r),g=p.hostname,h=fc(p),y=e.service||h.service,f=e.region||h.region;if(!y)throw Error("Could not detect service from URL. Please provide service explicitly.");if(!f)throw Error("Could not detect region from URL. Please provide region explicitly.");let b=m||new Date().toISOString().replace(/[:-]|\.\d{3}/g,""),T=b.substring(0,8),w=[T,f,y,"aws4_request"].join("/"),I="AWS4-HMAC-SHA256";if(u)return kr({urlObj:p,method:a,body:n,accessKeyId:i,secretAccessKey:o,sessionToken:c,service:y,region:f,timestamp:b,date:T,credentialScope:w,algorithm:I,expiresIn:d,cache:e.cache});let v=p.pathname||"/",N=yt(p.searchParams),R={host:g,"x-amz-date":b,...e.headers};if(c)R["x-amz-security-token"]=c;let k=Object.keys(R).some((me)=>me.toLowerCase()==="content-type");if(n&&!k)R["content-type"]="application/x-amz-json-1.0";if(y==="s3"&&!R["x-amz-content-sha256"])R["x-amz-content-sha256"]=He(n);let x=Ua(R),L=Va(R),B=R["x-amz-content-sha256"]||He(n),_=[a,ft(v),N,x,L,B].join(`
+`),U=He(_),Y=[I,b,w,U].join(`
+`),q=e.cache??fe,Q=Ka(o,T,f,y,Y,q),V=[`${I} Credential=${i}/${w}`,`SignedHeaders=${L}`,`Signature=${Q}`].join(", ");return R.authorization=V,{url:r,method:a,headers:R,body:n||void 0}}async function hc(e){let{method:a,url:r,body:n="",accessKeyId:i,secretAccessKey:o,sessionToken:c,signQuery:u=!1,expiresIn:d=86400,datetime:m}=e,p=new URL(r),g=p.hostname,h=fc(p),y=e.service||h.service,f=e.region||h.region;if(!y)throw Error("Could not detect service from URL. Please provide service explicitly.");if(!f)throw Error("Could not detect region from URL. Please provide region explicitly.");let b=m||new Date().toISOString().replace(/[:-]|\.\d{3}/g,""),T=b.substring(0,8),w=[T,f,y,"aws4_request"].join("/"),I="AWS4-HMAC-SHA256";if(u)return $r({urlObj:p,method:a,body:n,accessKeyId:i,secretAccessKey:o,sessionToken:c,service:y,region:f,timestamp:b,date:T,credentialScope:w,algorithm:I,expiresIn:d,cache:e.cache});let v=p.pathname||"/",N=yt(p.searchParams),R={host:g,"x-amz-date":b,...e.headers};if(c)R["x-amz-security-token"]=c;let k=Object.keys(R).some((Me)=>Me.toLowerCase()==="content-type");if(n&&!k)R["content-type"]="application/x-amz-json-1.0";let x=await lt(n);if(y==="s3"&&!R["x-amz-content-sha256"])R["x-amz-content-sha256"]=x;let L=Ua(R),B=Va(R),_=R["x-amz-content-sha256"]||x,U=[a,ft(v),N,L,B,_].join(`
+`),Y=await lt(U),q=[I,b,w,Y].join(`
+`),Q=e.cache??fe,V=await qa(o,T,f,y,q,Q),me=[`${I} Credential=${i}/${w}`,`SignedHeaders=${B}`,`Signature=${V}`].join(", ");return R.authorization=me,{url:r,method:a,headers:R,body:n||void 0}}function kr(e){let{urlObj:a,method:r,body:n,accessKeyId:i,secretAccessKey:o,sessionToken:c,service:u,region:d,timestamp:m,date:p,credentialScope:g,algorithm:h,expiresIn:y,cache:f}=e,b=new URL(a.toString());b.searchParams.set("X-Amz-Algorithm",h),b.searchParams.set("X-Amz-Credential",`${i}/${g}`),b.searchParams.set("X-Amz-Date",m),b.searchParams.set("X-Amz-Expires",String(y));let T=u==="s3"?"UNSIGNED-PAYLOAD":He(n);if(u==="s3")b.searchParams.set("X-Amz-Content-Sha256",T);let w="host";if(b.searchParams.set("X-Amz-SignedHeaders",w),c)b.searchParams.set("X-Amz-Security-Token",c);let I=ft(b.pathname||"/"),v=`host:${b.hostname}
 `,N=yt(b.searchParams),R=[r,I,N,v,w,T].join(`
 `),k=[h,m,g,He(R)].join(`
 `),x=Ka(o,p,d,u,k,f??fe);return b.searchParams.set("X-Amz-Signature",x),{url:b.toString(),method:r,headers:{},body:n||void 0}}async function $r(e){let{urlObj:a,method:r,body:n,accessKeyId:i,secretAccessKey:o,sessionToken:c,service:u,region:d,timestamp:m,date:p,credentialScope:g,algorithm:h,expiresIn:y,cache:f}=e,b=new URL(a.toString());b.searchParams.set("X-Amz-Algorithm",h),b.searchParams.set("X-Amz-Credential",`${i}/${g}`),b.searchParams.set("X-Amz-Date",m),b.searchParams.set("X-Amz-Expires",String(y));let T=u==="s3"?"UNSIGNED-PAYLOAD":await lt(n);if(u==="s3")b.searchParams.set("X-Amz-Content-Sha256",T);let w="host";if(b.searchParams.set("X-Amz-SignedHeaders",w),c)b.searchParams.set("X-Amz-Security-Token",c);let I=ft(b.pathname||"/"),v=`host:${b.hostname}
@@ -10,7 +10,7 @@ import{createRequire as vr}from"node:module";import{isAbsolute as Ot,join as mt,
 `),k=[h,m,g,await lt(R)].join(`
 `),x=await qa(o,p,d,u,k,f??fe);return b.searchParams.set("X-Amz-Signature",x),{url:b.toString(),method:r,headers:{},body:n||void 0}}function Rd(e){let{url:a,method:r="GET",expiresIn:n=3600,...i}=e,o=Math.min(n,604800);return ae({...i,url:a,method:r,signQuery:!0,expiresIn:o}).url}async function yp(e){let{url:a,method:r="GET",expiresIn:n=3600,...i}=e,o=Math.min(n,604800);return(await hc({...i,url:a,method:r,signQuery:!0,expiresIn:o})).url}function Ua(e){return Object.keys(e).sort().map((a)=>`${a.toLowerCase()}:${e[a].trim().replace(/\s+/g," ")}`).join(`
 `)+`
-`}function Va(e){return Object.keys(e).sort().map((a)=>a.toLowerCase()).join(";")}function yt(e){let a=[];return e.forEach((r,n)=>{a.push([Mt(n),Mt(r)])}),a.sort((r,n)=>{if(r[0]<n[0])return-1;if(r[0]>n[0])return 1;if(r[1]<n[1])return-1;if(r[1]>n[1])return 1;return 0}),a.map(([r,n])=>`${r}=${n}`).join("&")}function ft(e){return e.split("/").map((a)=>Mt(a)).join("/")}function Mt(e){return encodeURIComponent(e).replace(/[!'()*]/g,(a)=>`%${a.charCodeAt(0).toString(16).toUpperCase()}`)}function He(e){if(!$e)throw Error("Synchronous hash not available in browser. Use signRequestAsync() instead.");return $e.createHash("sha256").update(e,"utf8").digest("hex")}function xe(e,a){if(!$e)throw Error("Synchronous hmac not available in browser. Use signRequestAsync() instead.");return $e.createHmac("sha256",e).update(a,"utf8").digest()}async function lt(e){let a=new TextEncoder().encode(e),r=await crypto.subtle.digest("SHA-256",a);return ja(new Uint8Array(r))}async function We(e,a){let r=new TextEncoder,n=typeof e==="string"?r.encode(e):e,i=r.encode(a),o=await crypto.subtle.importKey("raw",n.buffer,{name:"HMAC",hash:"SHA-256"},!1,["sign"]),c=await crypto.subtle.sign("HMAC",o,i.buffer);return new Uint8Array(c)}function ja(e){return Array.from(e).map((a)=>a.toString(16).padStart(2,"0")).join("")}function Ka(e,a,r,n,i,o){let c=`${e}:${a}:${r}:${n}`,u=o.get(c);if(!u){let d=xe(`AWS4${e}`,a),m=xe(d,r),p=xe(m,n);if(u=xe(p,"aws4_request"),o.size>=za){let g=o.keys().next().value;if(g)o.delete(g)}o.set(c,u)}return xe(u,i).toString("hex")}async function qa(e,a,r,n,i,o){let c=`${e}:${a}:${r}:${n}`,u=o.get(c);if(!u){let m=await We(`AWS4${e}`,a),p=await We(m,r),g=await We(p,n);if(u=await We(g,"aws4_request"),o.size>=za){let h=o.keys().next().value;if(h)o.delete(h)}o.set(c,u)}let d=await We(u,i);return ja(d)}function Ha(e,a){return a.includes(e)}function ut(e,a,r){let n=a*Math.pow(2,e),i=Math.random()*0.3*n;return Math.min(n+i,r)}function dt(e){return new Promise((a)=>setTimeout(a,e))}async function fi(e,a){let{maxRetries:r=3,initialDelayMs:n=100,maxDelayMs:i=5000,retryableStatusCodes:o=[429,500,502,503,504],timeoutMs:c=30000}=a??{},u,d;for(let m=0;m<=r;m++){let p=ae(e),g={method:p.method,headers:p.headers};if(p.body)g.body=p.body;let h=new AbortController,y=setTimeout(()=>h.abort(),c);g.signal=h.signal;try{let f=await fetch(p.url,g);if(clearTimeout(y),d=f,f.ok)return f;if(m<r&&Ha(f.status,o)){let T=ut(m,n,i);await dt(T);continue}let b=await f.text();throw Error(`AWS API request failed (${f.status}): ${b}`)}catch(f){if(clearTimeout(y),u=f,f instanceof Error&&f.name==="AbortError")u=Error(`Request timed out after ${c}ms`);if(m<r&&!(f instanceof Error&&f.message.includes("AWS API request failed"))){let b=ut(m,n,i);await dt(b);continue}throw u}}throw u??Error("Request failed after retries")}async function Sp(e){return fi(e,{maxRetries:0})}async function bp(e,a){let{maxRetries:r=3,initialDelayMs:n=100,maxDelayMs:i=5000,retryableStatusCodes:o=[429,500,502,503,504],timeoutMs:c=30000}=a??{},u;for(let d=0;d<=r;d++){let m=await hc(e),p={method:m.method,headers:m.headers};if(m.body)p.body=m.body;let g=new AbortController,h=setTimeout(()=>g.abort(),c);p.signal=g.signal;try{let y=await fetch(m.url,p);if(clearTimeout(h),y.ok)return y;if(d<r&&Ha(y.status,o)){let b=ut(d,n,i);await dt(b);continue}let f=await y.text();throw Error(`AWS API request failed (${y.status}): ${f}`)}catch(y){if(clearTimeout(h),u=y,y instanceof Error&&y.name==="AbortError")u=Error(`Request timed out after ${c}ms`);if(d<r&&!(y instanceof Error&&y.message.includes("AWS API request failed"))){let f=ut(d,n,i);await dt(f);continue}throw u}}throw u??Error("Request failed after retries")}async function qs(e){let a=await e.text(),r={},n=/<(\w+)>([^<]+)<\/\1>/g,i;while((i=n.exec(a))!==null){let[,o,c]=i;r[o]=c}return r}async function vp(e){return await e.json()}function Tp(){fe.clear()}function Ep(){return fe.size}function wp(){return $e!==void 0}function Cp(){return typeof crypto<"u"&&typeof crypto.subtle<"u"}var $e,fe,za=100,Qa,Ye=Ir(async()=>{try{$e=await import("node:crypto")}catch{}fe=new Map,Qa={appstream2:"appstream",cloudhsmv2:"cloudhsm",email:"ses",marketplace:"aws-marketplace",mobile:"AWSMobileHubService",pinpoint:"mobiletargeting",queue:"sqs","git-codecommit":"codecommit","mturk-requester-sandbox":"mturk-requester","personalize-runtime":"personalize"}}),Ap={backgroundJobs:{visibilityTimeout:120,messageRetentionPeriod:604800,deadLetterQueue:!0,maxReceiveCount:3,encrypted:!0},fifo:{fifo:!0,contentBasedDeduplication:!0,visibilityTimeout:30,encrypted:!0},highThroughput:{visibilityTimeout:30,receiveMessageWaitTime:20,encrypted:!0},delayed:{delaySeconds:60,visibilityTimeout:60,encrypted:!0},longRunning:{visibilityTimeout:900,messageRetentionPeriod:1209600,deadLetterQueue:!0,maxReceiveCount:2,encrypted:!0},monitored:{visibilityTimeout:60,messageRetentionPeriod:604800,deadLetterQueue:!0,maxReceiveCount:3,encrypted:!0,alarms:{enabled:!0,queueDepthThreshold:1000,messageAgeThreshold:3600,dlqAlarm:!0}},lambdaOptimized:{visibilityTimeout:360,receiveMessageWaitTime:20,deadLetterQueue:!0,maxReceiveCount:3,encrypted:!0},fanOut:{visibilityTimeout:30,receiveMessageWaitTime:20,encrypted:!0}},Ip={serverless:{development:{enabled:!0,mode:"serverless",channels:{public:!0,private:!0,presence:!0},storage:{type:"dynamodb",dynamodb:{billingMode:"PAY_PER_REQUEST"}},scaling:{maxConnections:1000,handlerMemory:128}},production:{enabled:!0,mode:"serverless",channels:{public:!0,private:!0,presence:{enabled:!0,maxMembers:100,heartbeatInterval:30,inactivityTimeout:60}},storage:{type:"dynamodb",dynamodb:{billingMode:"PAY_PER_REQUEST",pointInTimeRecovery:!0,connectionTTL:86400}},scaling:{maxConnections:50000,messagesPerSecond:5000,handlerMemory:256,handlerTimeout:30},monitoring:{enabled:!0,connectionThreshold:40000,errorThreshold:100,latencyThreshold:500},keepAlive:!0,keepAliveInterval:30,idleTimeout:600},notifications:{enabled:!0,mode:"serverless",channels:{public:!1,private:!0,presence:!1},storage:{type:"dynamodb",dynamodb:{billingMode:"PAY_PER_REQUEST"}},scaling:{maxConnections:50000,messagesPerSecond:2000,handlerMemory:128},keepAlive:!0,keepAliveInterval:60,idleTimeout:1800}},server:{development:{enabled:!0,mode:"server",channels:{public:!0,private:!0,presence:!0},server:{host:"0.0.0.0",port:6001,scheme:"ws",driver:"bun",idleTimeout:120,perMessageDeflate:!1,metrics:!1}},production:{enabled:!0,mode:"server",channels:{public:!0,private:!0,presence:!0},server:{host:"0.0.0.0",port:6001,scheme:"wss",driver:"bun",idleTimeout:120,maxPayloadLength:16777216,backpressureLimit:1048576,sendPings:!0,perMessageDeflate:!0,instances:2,redis:{enabled:!0,keyPrefix:"broadcasting:"},rateLimit:{enabled:!0,max:100,window:60000,perChannel:!0,perUser:!0},loadManagement:{enabled:!0,maxConnections:1e4,maxSubscriptionsPerConnection:100,shedLoadThreshold:0.8},metrics:!0,autoScaling:{min:2,max:10,targetCPU:70}},monitoring:{enabled:!0,connectionThreshold:8000,errorThreshold:100}},highPerformance:{enabled:!0,mode:"server",channels:{public:!0,private:!0,presence:!0},server:{host:"0.0.0.0",port:6001,scheme:"wss",driver:"bun",idleTimeout:60,maxPayloadLength:8388608,backpressureLimit:2097152,closeOnBackpressureLimit:!0,sendPings:!0,perMessageDeflate:!0,instances:4,redis:{enabled:!0,useElastiCache:!0,keyPrefix:"rt:"},rateLimit:{enabled:!0,max:200,window:60000,perChannel:!0},loadManagement:{enabled:!0,maxConnections:25000,maxSubscriptionsPerConnection:50,shedLoadThreshold:0.7},metrics:{enabled:!0,path:"/metrics"},autoScaling:{min:4,max:20,targetCPU:60,targetConnections:20000}},monitoring:{enabled:!0,connectionThreshold:80000,errorThreshold:50,latencyThreshold:50}},chat:{enabled:!0,mode:"server",channels:{public:!0,private:!0,presence:{enabled:!0,maxMembers:200,heartbeatInterval:20,inactivityTimeout:60}},server:{host:"0.0.0.0",port:6001,scheme:"wss",driver:"bun",idleTimeout:300,maxPayloadLength:1048576,sendPings:!0,perMessageDeflate:!0,instances:2,redis:{enabled:!0,keyPrefix:"chat:"},rateLimit:{enabled:!0,max:60,window:60000,perChannel:!0},loadManagement:{enabled:!0,maxConnections:15000,maxSubscriptionsPerConnection:20},metrics:!0},keepAlive:!0,keepAliveInterval:25,idleTimeout:900},gaming:{enabled:!0,mode:"server",channels:{public:!0,private:!0,presence:{enabled:!0,maxMembers:100,heartbeatInterval:10,inactivityTimeout:30}},server:{host:"0.0.0.0",port:6001,scheme:"wss",driver:"bun",idleTimeout:30,maxPayloadLength:65536,backpressureLimit:524288,closeOnBackpressureLimit:!0,sendPings:!0,perMessageDeflate:!1,instances:4,redis:{enabled:!0,useElastiCache:!0},rateLimit:{enabled:!0,max:120,window:60000},loadManagement:{enabled:!0,maxConnections:5000,maxSubscriptionsPerConnection:10,shedLoadThreshold:0.6},metrics:!0,autoScaling:{min:4,max:16,targetCPU:50}},keepAlive:!0,keepAliveInterval:10,idleTimeout:60},single:{enabled:!0,mode:"server",channels:{public:!0,private:!0,presence:!0},server:{host:"0.0.0.0",port:6001,scheme:"wss",driver:"bun",idleTimeout:120,sendPings:!0,perMessageDeflate:!0,instances:1,rateLimit:{enabled:!0,max:100,window:60000},loadManagement:{enabled:!0,maxConnections:1e4},metrics:!0}}}},yc=".ts-cloud",Sc="TS_CLOUD_STATE_DIR",Gt=null;function Ws(e){Gt=e?.trim()||null}function Gs(){return Boolean(process.env[Sc]?.trim()||Gt)}function Co(){return process.env[Sc]?.trim()||Gt||yc}function et(...e){return mt(Co(),...e)}function A(e,...a){let r=Co();return Ot(r)?mt(r,...a):mt(e,r,...a)}function Ks(e,a=process.cwd()){let r=(i,o)=>{let c=Lr(i,o);return c===""||!c.startsWith("..")&&!Ot(c)},n=Ot(e)?e:mt(a,e);return r(A(a),n)}function bc(e){let a=e.infrastructure?.compute!=null,r=Object.values(e.environments??{}).some((n)=>n?.app!=null);return{server:a,serverless:r}}function z(e){if(e.mode==="server"||e.mode==="serverless")return e.mode;let{serverless:a}=bc(e);return a?"serverless":"server"}function Rr(e){let{server:a,serverless:r}=bc(e);if(a&&r)return"A project cannot be both a server and a serverless deployment. Found `infrastructure.compute` (server) AND `environments.<env>.app` (serverless Lambda). Keep one: remove `infrastructure.compute` for a serverless app, or remove `environments.<env>.app` for a server.";if(e.mode==="server"&&r&&!a)return"Config sets `mode: 'server'` but declares a serverless app (`environments.<env>.app`). Remove the app or change the mode.";if(e.mode==="serverless"&&a&&!r)return"Config sets `mode: 'serverless'` but declares a server (`infrastructure.compute`). Remove the compute block or change the mode.";return null}function C(e){return e.infrastructure?.appDatabase??e.infrastructure?.compute?.database}function Mr(e){return typeof e==="object"&&e!==null?e:{}}function Pd(e){return e===!0||typeof e==="object"&&e!==null}function Or(e,a){let r=a?e.environments?.[a]:void 0;if(r?.domain)return r.domain;let n=Object.values(e.sites??{}),i=e.sites?.main?.domain??n.find((o)=>o.domain)?.domain;if(i)return i;return`${e.project?.slug??"app"}.local`}function xr(e){let a=e.indexOf(".");return a>0?e.slice(a+1):void 0}function hi(e,a={}){let r=e.infrastructure?.compute?.managedServices?.mail,n=Mr(r),i=a.environmentType??(a.environment?e.environments?.[a.environment]?.type:void 0),o=n.mode??(i==="production"?"server":"catcher"),c=o==="server",u=Or(e,a.environment),d=n.hostname??(c?`mail.${u}`:"localhost"),m=n.ports??{},p=c?{smtp:m.smtp??25,submission:m.submission??587,submissions:m.submissions??465,imap:m.imap??143,imaps:m.imaps??993,webmail:m.webmail??8080,managesieve:m.managesieve}:{smtp:m.smtp??1025,submission:m.submission,submissions:m.submissions,imap:m.imap,imaps:m.imaps,webmail:m.webmail??8025,managesieve:m.managesieve},g=n.tls??{},h=g.enabled??c,y=!!(g.certPath&&g.keyPath),f=(n.accounts??[]).map((L)=>({address:L.address,password:L.password})),b=typeof n.dkim==="object"&&n.dkim!==null?n.dkim:{},T=n.dkim===!1?!1:n.dkim===!0||c,w=typeof n.webmail==="object"&&n.webmail!==null?n.webmail:{},I=n.webmail===!1?!1:w.enabled??!0,v=n.spam??{},N=n.delivery??(c?"direct":"none"),R=n.expose??c,k=xr(d),x=[...new Set([d,...k?[k]:[],...n.domains??[]])];return{enabled:Pd(r),mode:o,version:n.version,hostname:d,domains:x,ports:p,tls:{enabled:h,acme:h&&!y&&(g.acme??!0),certPath:g.certPath,keyPath:g.keyPath,requireForAuth:g.requireForAuth??(h&&c),acmeEmail:g.acmeEmail??f[0]?.address},dkim:{enabled:T,selector:b.selector??"default",rotate:b.rotate??!1,rotateIntervalDays:b.rotateIntervalDays??90},webmail:{enabled:I,port:w.port??p.webmail,domain:w.domain},delivery:N,sesRegion:n.sesRegion??"us-east-1",accounts:f,storagePath:n.storagePath??"/var/lib/mail",maxMessageSize:n.maxMessageSize??26214400,spam:{enabled:v.enabled??c,enforce:v.enforce??!1,junkScore:v.junkScore??5,rejectScore:v.rejectScore??12,dnsbl:v.dnsbl??c,greylist:v.greylist??!1},webhookUrl:n.webhookUrl,expose:R,bindAddress:R?"0.0.0.0":"127.0.0.1"}}function Js(e){if(!e.enabled||!e.expose)return[];let a=[e.ports.smtp,e.ports.submission,e.ports.submissions,e.ports.imap,e.ports.imaps,e.ports.managesieve].filter((r)=>typeof r==="number");if(e.webmail.enabled&&!e.webmail.domain)a.push(e.webmail.port);return[...new Set(a)].sort((r,n)=>r-n)}function Xs(e){if(!e.enabled)return{};let a=e.ports.submission??e.ports.smtp,r={MAIL_MAILER:"smtp",MAIL_HOST:"127.0.0.1",MAIL_PORT:String(a)};if(e.mode==="server"){r.MAIL_ENCRYPTION=e.tls.enabled?"tls":"null";let n=e.accounts[0];if(n)r.MAIL_USERNAME=n.address,r.MAIL_PASSWORD=n.password}else r.MAIL_ENCRYPTION="null",r.MAIL_USERNAME="null",r.MAIL_PASSWORD="null";return r}function B(e){if(e.cloud?.provider)return e.cloud.provider;if(e.ssh?.hosts?.length)return"ssh";if(e.hetzner?.apiToken)return"hetzner";return"aws"}class Ao{template;constructor(e){this.template={AWSTemplateFormatVersion:"2010-09-09",Description:e,Resources:{}}}addResource(e,a){return this.template.Resources[e]=a,this}addResources(e){return Object.assign(this.template.Resources,e),this}addParameter(e,a){if(!this.template.Parameters)this.template.Parameters={};return this.template.Parameters[e]=a,this}addOutput(e,a){if(!this.template.Outputs)this.template.Outputs={};return this.template.Outputs[e]=a,this}addMetadata(e,a){if(!this.template.Metadata)this.template.Metadata={};return this.template.Metadata[e]=a,this}hasResource(e){return e in this.template.Resources}getResources(){return this.template.Resources}build(){return this.template}toJSON(e=!0){return JSON.stringify(this.template,null,e?2:0)}toYAML(){return this.convertToYAML(this.template)}convertToYAML(e,a=0){let r="  ".repeat(a),n="";for(let[i,o]of Object.entries(e)){if(o===null||o===void 0)continue;if(typeof o==="object"&&!Array.isArray(o))n+=`${r}${i}:
+`}function Va(e){return Object.keys(e).sort().map((a)=>a.toLowerCase()).join(";")}function yt(e){let a=[];return e.forEach((r,n)=>{a.push([Mt(n),Mt(r)])}),a.sort((r,n)=>{if(r[0]<n[0])return-1;if(r[0]>n[0])return 1;if(r[1]<n[1])return-1;if(r[1]>n[1])return 1;return 0}),a.map(([r,n])=>`${r}=${n}`).join("&")}function ft(e){return e.split("/").map((a)=>Mt(a)).join("/")}function Mt(e){return encodeURIComponent(e).replace(/[!'()*]/g,(a)=>`%${a.charCodeAt(0).toString(16).toUpperCase()}`)}function He(e){if(!$e)throw Error("Synchronous hash not available in browser. Use signRequestAsync() instead.");return $e.createHash("sha256").update(e,"utf8").digest("hex")}function xe(e,a){if(!$e)throw Error("Synchronous hmac not available in browser. Use signRequestAsync() instead.");return $e.createHmac("sha256",e).update(a,"utf8").digest()}async function lt(e){let a=new TextEncoder().encode(e),r=await crypto.subtle.digest("SHA-256",a);return ja(new Uint8Array(r))}async function We(e,a){let r=new TextEncoder,n=typeof e==="string"?r.encode(e):e,i=r.encode(a),o=await crypto.subtle.importKey("raw",n.buffer,{name:"HMAC",hash:"SHA-256"},!1,["sign"]),c=await crypto.subtle.sign("HMAC",o,i.buffer);return new Uint8Array(c)}function ja(e){return Array.from(e).map((a)=>a.toString(16).padStart(2,"0")).join("")}function Ka(e,a,r,n,i,o){let c=`${e}:${a}:${r}:${n}`,u=o.get(c);if(!u){let d=xe(`AWS4${e}`,a),m=xe(d,r),p=xe(m,n);if(u=xe(p,"aws4_request"),o.size>=za){let g=o.keys().next().value;if(g)o.delete(g)}o.set(c,u)}return xe(u,i).toString("hex")}async function qa(e,a,r,n,i,o){let c=`${e}:${a}:${r}:${n}`,u=o.get(c);if(!u){let m=await We(`AWS4${e}`,a),p=await We(m,r),g=await We(p,n);if(u=await We(g,"aws4_request"),o.size>=za){let h=o.keys().next().value;if(h)o.delete(h)}o.set(c,u)}let d=await We(u,i);return ja(d)}function Ha(e,a){return a.includes(e)}function ut(e,a,r){let n=a*Math.pow(2,e),i=Math.random()*0.3*n;return Math.min(n+i,r)}function dt(e){return new Promise((a)=>setTimeout(a,e))}async function fi(e,a){let{maxRetries:r=3,initialDelayMs:n=100,maxDelayMs:i=5000,retryableStatusCodes:o=[429,500,502,503,504],timeoutMs:c=30000}=a??{},u,d;for(let m=0;m<=r;m++){let p=ae(e),g={method:p.method,headers:p.headers};if(p.body)g.body=p.body;let h=new AbortController,y=setTimeout(()=>h.abort(),c);g.signal=h.signal;try{let f=await fetch(p.url,g);if(clearTimeout(y),d=f,f.ok)return f;if(m<r&&Ha(f.status,o)){let T=ut(m,n,i);await dt(T);continue}let b=await f.text();throw Error(`AWS API request failed (${f.status}): ${b}`)}catch(f){if(clearTimeout(y),u=f,f instanceof Error&&f.name==="AbortError")u=Error(`Request timed out after ${c}ms`);if(m<r&&!(f instanceof Error&&f.message.includes("AWS API request failed"))){let b=ut(m,n,i);await dt(b);continue}throw u}}throw u??Error("Request failed after retries")}async function Sp(e){return fi(e,{maxRetries:0})}async function bp(e,a){let{maxRetries:r=3,initialDelayMs:n=100,maxDelayMs:i=5000,retryableStatusCodes:o=[429,500,502,503,504],timeoutMs:c=30000}=a??{},u;for(let d=0;d<=r;d++){let m=await hc(e),p={method:m.method,headers:m.headers};if(m.body)p.body=m.body;let g=new AbortController,h=setTimeout(()=>g.abort(),c);p.signal=g.signal;try{let y=await fetch(m.url,p);if(clearTimeout(h),y.ok)return y;if(d<r&&Ha(y.status,o)){let b=ut(d,n,i);await dt(b);continue}let f=await y.text();throw Error(`AWS API request failed (${y.status}): ${f}`)}catch(y){if(clearTimeout(h),u=y,y instanceof Error&&y.name==="AbortError")u=Error(`Request timed out after ${c}ms`);if(d<r&&!(y instanceof Error&&y.message.includes("AWS API request failed"))){let f=ut(d,n,i);await dt(f);continue}throw u}}throw u??Error("Request failed after retries")}async function qs(e){let a=await e.text(),r={},n=/<(\w+)>([^<]+)<\/\1>/g,i;while((i=n.exec(a))!==null){let[,o,c]=i;r[o]=c}return r}async function vp(e){return await e.json()}function Tp(){fe.clear()}function Ep(){return fe.size}function wp(){return $e!==void 0}function Cp(){return typeof crypto<"u"&&typeof crypto.subtle<"u"}var $e,fe,za=100,Qa,Ye=Ir(async()=>{try{$e=await import("node:crypto")}catch{}fe=new Map,Qa={appstream2:"appstream",cloudhsmv2:"cloudhsm",email:"ses",marketplace:"aws-marketplace",mobile:"AWSMobileHubService",pinpoint:"mobiletargeting",queue:"sqs","git-codecommit":"codecommit","mturk-requester-sandbox":"mturk-requester","personalize-runtime":"personalize"}}),Ap={backgroundJobs:{visibilityTimeout:120,messageRetentionPeriod:604800,deadLetterQueue:!0,maxReceiveCount:3,encrypted:!0},fifo:{fifo:!0,contentBasedDeduplication:!0,visibilityTimeout:30,encrypted:!0},highThroughput:{visibilityTimeout:30,receiveMessageWaitTime:20,encrypted:!0},delayed:{delaySeconds:60,visibilityTimeout:60,encrypted:!0},longRunning:{visibilityTimeout:900,messageRetentionPeriod:1209600,deadLetterQueue:!0,maxReceiveCount:2,encrypted:!0},monitored:{visibilityTimeout:60,messageRetentionPeriod:604800,deadLetterQueue:!0,maxReceiveCount:3,encrypted:!0,alarms:{enabled:!0,queueDepthThreshold:1000,messageAgeThreshold:3600,dlqAlarm:!0}},lambdaOptimized:{visibilityTimeout:360,receiveMessageWaitTime:20,deadLetterQueue:!0,maxReceiveCount:3,encrypted:!0},fanOut:{visibilityTimeout:30,receiveMessageWaitTime:20,encrypted:!0}},Ip={serverless:{development:{enabled:!0,mode:"serverless",channels:{public:!0,private:!0,presence:!0},storage:{type:"dynamodb",dynamodb:{billingMode:"PAY_PER_REQUEST"}},scaling:{maxConnections:1000,handlerMemory:128}},production:{enabled:!0,mode:"serverless",channels:{public:!0,private:!0,presence:{enabled:!0,maxMembers:100,heartbeatInterval:30,inactivityTimeout:60}},storage:{type:"dynamodb",dynamodb:{billingMode:"PAY_PER_REQUEST",pointInTimeRecovery:!0,connectionTTL:86400}},scaling:{maxConnections:50000,messagesPerSecond:5000,handlerMemory:256,handlerTimeout:30},monitoring:{enabled:!0,connectionThreshold:40000,errorThreshold:100,latencyThreshold:500},keepAlive:!0,keepAliveInterval:30,idleTimeout:600},notifications:{enabled:!0,mode:"serverless",channels:{public:!1,private:!0,presence:!1},storage:{type:"dynamodb",dynamodb:{billingMode:"PAY_PER_REQUEST"}},scaling:{maxConnections:50000,messagesPerSecond:2000,handlerMemory:128},keepAlive:!0,keepAliveInterval:60,idleTimeout:1800}},server:{development:{enabled:!0,mode:"server",channels:{public:!0,private:!0,presence:!0},server:{host:"0.0.0.0",port:6001,scheme:"ws",driver:"bun",idleTimeout:120,perMessageDeflate:!1,metrics:!1}},production:{enabled:!0,mode:"server",channels:{public:!0,private:!0,presence:!0},server:{host:"0.0.0.0",port:6001,scheme:"wss",driver:"bun",idleTimeout:120,maxPayloadLength:16777216,backpressureLimit:1048576,sendPings:!0,perMessageDeflate:!0,instances:2,redis:{enabled:!0,keyPrefix:"broadcasting:"},rateLimit:{enabled:!0,max:100,window:60000,perChannel:!0,perUser:!0},loadManagement:{enabled:!0,maxConnections:1e4,maxSubscriptionsPerConnection:100,shedLoadThreshold:0.8},metrics:!0,autoScaling:{min:2,max:10,targetCPU:70}},monitoring:{enabled:!0,connectionThreshold:8000,errorThreshold:100}},highPerformance:{enabled:!0,mode:"server",channels:{public:!0,private:!0,presence:!0},server:{host:"0.0.0.0",port:6001,scheme:"wss",driver:"bun",idleTimeout:60,maxPayloadLength:8388608,backpressureLimit:2097152,closeOnBackpressureLimit:!0,sendPings:!0,perMessageDeflate:!0,instances:4,redis:{enabled:!0,useElastiCache:!0,keyPrefix:"rt:"},rateLimit:{enabled:!0,max:200,window:60000,perChannel:!0},loadManagement:{enabled:!0,maxConnections:25000,maxSubscriptionsPerConnection:50,shedLoadThreshold:0.7},metrics:{enabled:!0,path:"/metrics"},autoScaling:{min:4,max:20,targetCPU:60,targetConnections:20000}},monitoring:{enabled:!0,connectionThreshold:80000,errorThreshold:50,latencyThreshold:50}},chat:{enabled:!0,mode:"server",channels:{public:!0,private:!0,presence:{enabled:!0,maxMembers:200,heartbeatInterval:20,inactivityTimeout:60}},server:{host:"0.0.0.0",port:6001,scheme:"wss",driver:"bun",idleTimeout:300,maxPayloadLength:1048576,sendPings:!0,perMessageDeflate:!0,instances:2,redis:{enabled:!0,keyPrefix:"chat:"},rateLimit:{enabled:!0,max:60,window:60000,perChannel:!0},loadManagement:{enabled:!0,maxConnections:15000,maxSubscriptionsPerConnection:20},metrics:!0},keepAlive:!0,keepAliveInterval:25,idleTimeout:900},gaming:{enabled:!0,mode:"server",channels:{public:!0,private:!0,presence:{enabled:!0,maxMembers:100,heartbeatInterval:10,inactivityTimeout:30}},server:{host:"0.0.0.0",port:6001,scheme:"wss",driver:"bun",idleTimeout:30,maxPayloadLength:65536,backpressureLimit:524288,closeOnBackpressureLimit:!0,sendPings:!0,perMessageDeflate:!1,instances:4,redis:{enabled:!0,useElastiCache:!0},rateLimit:{enabled:!0,max:120,window:60000},loadManagement:{enabled:!0,maxConnections:5000,maxSubscriptionsPerConnection:10,shedLoadThreshold:0.6},metrics:!0,autoScaling:{min:4,max:16,targetCPU:50}},keepAlive:!0,keepAliveInterval:10,idleTimeout:60},single:{enabled:!0,mode:"server",channels:{public:!0,private:!0,presence:!0},server:{host:"0.0.0.0",port:6001,scheme:"wss",driver:"bun",idleTimeout:120,sendPings:!0,perMessageDeflate:!0,instances:1,rateLimit:{enabled:!0,max:100,window:60000},loadManagement:{enabled:!0,maxConnections:1e4},metrics:!0}}}},yc=".ts-cloud",Sc="TS_CLOUD_STATE_DIR",Gt=null;function Ws(e){Gt=e?.trim()||null}function Gs(){return Boolean(process.env[Sc]?.trim()||Gt)}function Co(){return process.env[Sc]?.trim()||Gt||yc}function et(...e){return mt(Co(),...e)}function A(e,...a){let r=Co();return Ot(r)?mt(r,...a):mt(e,r,...a)}function Ks(e,a=process.cwd()){let r=(i,o)=>{let c=Lr(i,o);return c===""||!c.startsWith("..")&&!Ot(c)},n=Ot(e)?e:mt(a,e);return r(A(a),n)}function bc(e){let a=e.infrastructure?.compute!=null,r=Object.values(e.environments??{}).some((n)=>n?.app!=null);return{server:a,serverless:r}}function H(e){if(e.mode==="server"||e.mode==="serverless")return e.mode;let{serverless:a}=bc(e);return a?"serverless":"server"}function Rr(e){let{server:a,serverless:r}=bc(e);if(a&&r)return"A project cannot be both a server and a serverless deployment. Found `infrastructure.compute` (server) AND `environments.<env>.app` (serverless Lambda). Keep one: remove `infrastructure.compute` for a serverless app, or remove `environments.<env>.app` for a server.";if(e.mode==="server"&&r&&!a)return"Config sets `mode: 'server'` but declares a serverless app (`environments.<env>.app`). Remove the app or change the mode.";if(e.mode==="serverless"&&a&&!r)return"Config sets `mode: 'serverless'` but declares a server (`infrastructure.compute`). Remove the compute block or change the mode.";return null}function C(e){return e.infrastructure?.appDatabase??e.infrastructure?.compute?.database}function Mr(e){return typeof e==="object"&&e!==null?e:{}}function Pd(e){return e===!0||typeof e==="object"&&e!==null}function Or(e,a){let r=a?e.environments?.[a]:void 0;if(r?.domain)return r.domain;let n=Object.values(e.sites??{}),i=e.sites?.main?.domain??n.find((o)=>o.domain)?.domain;if(i)return i;return`${e.project?.slug??"app"}.local`}function xr(e){let a=e.indexOf(".");return a>0?e.slice(a+1):void 0}function hi(e,a={}){let r=e.infrastructure?.compute?.managedServices?.mail,n=Mr(r),i=a.environmentType??(a.environment?e.environments?.[a.environment]?.type:void 0),o=n.mode??(i==="production"?"server":"catcher"),c=o==="server",u=Or(e,a.environment),d=n.hostname??(c?`mail.${u}`:"localhost"),m=n.ports??{},p=c?{smtp:m.smtp??25,submission:m.submission??587,submissions:m.submissions??465,imap:m.imap??143,imaps:m.imaps??993,webmail:m.webmail??8080,managesieve:m.managesieve}:{smtp:m.smtp??1025,submission:m.submission,submissions:m.submissions,imap:m.imap,imaps:m.imaps,webmail:m.webmail??8025,managesieve:m.managesieve},g=n.tls??{},h=g.enabled??c,y=!!(g.certPath&&g.keyPath),f=(n.accounts??[]).map((L)=>({address:L.address,password:L.password})),b=typeof n.dkim==="object"&&n.dkim!==null?n.dkim:{},T=n.dkim===!1?!1:n.dkim===!0||c,w=typeof n.webmail==="object"&&n.webmail!==null?n.webmail:{},I=n.webmail===!1?!1:w.enabled??!0,v=n.spam??{},N=n.delivery??(c?"direct":"none"),R=n.expose??c,k=xr(d),x=[...new Set([d,...k?[k]:[],...n.domains??[]])];return{enabled:Pd(r),mode:o,version:n.version,hostname:d,domains:x,ports:p,tls:{enabled:h,acme:h&&!y&&(g.acme??!0),certPath:g.certPath,keyPath:g.keyPath,requireForAuth:g.requireForAuth??(h&&c),acmeEmail:g.acmeEmail??f[0]?.address},dkim:{enabled:T,selector:b.selector??"default",rotate:b.rotate??!1,rotateIntervalDays:b.rotateIntervalDays??90},webmail:{enabled:I,port:w.port??p.webmail,domain:w.domain},delivery:N,sesRegion:n.sesRegion??"us-east-1",accounts:f,storagePath:n.storagePath??"/var/lib/mail",maxMessageSize:n.maxMessageSize??26214400,spam:{enabled:v.enabled??c,enforce:v.enforce??!1,junkScore:v.junkScore??5,rejectScore:v.rejectScore??12,dnsbl:v.dnsbl??c,greylist:v.greylist??!1},webhookUrl:n.webhookUrl,expose:R,bindAddress:R?"0.0.0.0":"127.0.0.1"}}function Js(e){if(!e.enabled||!e.expose)return[];let a=[e.ports.smtp,e.ports.submission,e.ports.submissions,e.ports.imap,e.ports.imaps,e.ports.managesieve].filter((r)=>typeof r==="number");if(e.webmail.enabled&&!e.webmail.domain)a.push(e.webmail.port);return[...new Set(a)].sort((r,n)=>r-n)}function Xs(e){if(!e.enabled)return{};let a=e.ports.submission??e.ports.smtp,r={MAIL_MAILER:"smtp",MAIL_HOST:"127.0.0.1",MAIL_PORT:String(a)};if(e.mode==="server"){r.MAIL_ENCRYPTION=e.tls.enabled?"tls":"null";let n=e.accounts[0];if(n)r.MAIL_USERNAME=n.address,r.MAIL_PASSWORD=n.password}else r.MAIL_ENCRYPTION="null",r.MAIL_USERNAME="null",r.MAIL_PASSWORD="null";return r}function F(e){if(e.cloud?.provider)return e.cloud.provider;if(e.ssh?.hosts?.length)return"ssh";if(e.hetzner?.apiToken)return"hetzner";return"aws"}class Ao{template;constructor(e){this.template={AWSTemplateFormatVersion:"2010-09-09",Description:e,Resources:{}}}addResource(e,a){return this.template.Resources[e]=a,this}addResources(e){return Object.assign(this.template.Resources,e),this}addParameter(e,a){if(!this.template.Parameters)this.template.Parameters={};return this.template.Parameters[e]=a,this}addOutput(e,a){if(!this.template.Outputs)this.template.Outputs={};return this.template.Outputs[e]=a,this}addMetadata(e,a){if(!this.template.Metadata)this.template.Metadata={};return this.template.Metadata[e]=a,this}hasResource(e){return e in this.template.Resources}getResources(){return this.template.Resources}build(){return this.template}toJSON(e=!0){return JSON.stringify(this.template,null,e?2:0)}toYAML(){return this.convertToYAML(this.template)}convertToYAML(e,a=0){let r="  ".repeat(a),n="";for(let[i,o]of Object.entries(e)){if(o===null||o===void 0)continue;if(typeof o==="object"&&!Array.isArray(o))n+=`${r}${i}:
 ${this.convertToYAML(o,a+1)}`;else if(Array.isArray(o)){n+=`${r}${i}:
 `;for(let c of o)if(typeof c==="object")n+=`${r}  -
 ${this.convertToYAML(c,a+2)}`;else n+=`${r}  - ${c}
@@ -209,7 +209,7 @@ exports.handler = async (event) => {
 
   return request;
 };
-`.trim()};static Config={ttl:(e)=>{let{min:a=0,max:r=86400,default:n=86400}=e;return{MinTTL:a,MaxTTL:r,DefaultTTL:n}},cookies:(e,a)=>{let r={Forward:e==="allowList"?"whitelist":e};if(e==="allowList"&&a)r.WhitelistedNames=a;return r},allowedMethods:(e)=>{let a={ALL:["GET","HEAD","OPTIONS","PUT","POST","PATCH","DELETE"],GET_HEAD:["GET","HEAD"],GET_HEAD_OPTIONS:["GET","HEAD","OPTIONS"]};return a[e]||a.GET_HEAD},cachedMethods:(e)=>{let a={GET_HEAD:["GET","HEAD"],GET_HEAD_OPTIONS:["GET","HEAD","OPTIONS"]};return a[e]||a.GET_HEAD},ttlPresets:{static:{min:0,max:31536000,default:31536000},dynamic:{min:0,max:0,default:0},api:{min:0,max:3600,default:60},html:{min:0,max:86400,default:86400},images:{min:0,max:604800,default:604800}},cacheBehavior:(e)=>{let{ttl:a={min:0,max:86400,default:86400},cookies:r="none",allowedCookies:n,allowedMethods:i="GET_HEAD",cachedMethods:o="GET_HEAD",compress:c=!0,forwardQueryString:u=!0,forwardHeaders:d=[]}=e;return{MinTTL:a.min,MaxTTL:a.max,DefaultTTL:a.default,Compress:c,AllowedMethods:Be.Config.allowedMethods(i),CachedMethods:Be.Config.cachedMethods(o),ForwardedValues:{QueryString:u,Headers:d,Cookies:Be.Config.cookies(r,n)}}}};static applyConfig(e,a){let r=e.Properties.DistributionConfig.DefaultCacheBehavior;if(a.ttl)r.MinTTL=a.ttl.min,r.MaxTTL=a.ttl.max,r.DefaultTTL=a.ttl.default;if(a.compress!==void 0)r.Compress=a.compress;if(a.allowedMethods)r.AllowedMethods=Be.Config.allowedMethods(a.allowedMethods);if(a.cachedMethods)r.CachedMethods=Be.Config.cachedMethods(a.cachedMethods);if(a.cookies){if(!r.ForwardedValues)r.ForwardedValues={QueryString:!0};r.ForwardedValues.Cookies=Be.Config.cookies(a.cookies,a.allowedCookies)}return e}}var Dd=[403,404,500,502,503,504],No="TsCloud::StorageFailover",Do="AllowCloudFrontFailoverRead",Jr=/^[a-z]{2}(?:-gov)?-[a-z]+-\d$/,Yr=/^[a-z0-9][a-z0-9.-]{1,61}[a-z0-9]$/;function na(e){let{failover:a,primaryBucket:r,primaryRegion:n}=e,i=e.where??"storage failover";if(!a||typeof a!=="object")throw Error(`${i}.failover must be an object such as { region: 'us-west-2' }.`);if(!a.region||!Jr.test(a.region))throw Error(`${i}.failover.region must be an AWS region such as 'us-west-2', got ${JSON.stringify(a.region)}.`);if(a.region===n)throw Error(`${i}.failover.region is ${a.region}, the same region as the primary bucket. Failover only helps when the replica is in another region.`);let o=a.bucket??`${r}-${a.region}`;if(!Yr.test(o)||o.includes("..")){let c=a.bucket===void 0&&o.length>63?` The default name (<primary bucket>-<region>) is ${o.length} characters; S3 allows 63. Set ${i}.failover.bucket.`:"";throw Error(`${i}.failover: "${o}" is not a valid S3 bucket name.${c}`)}if(o===r)throw Error(`${i}.failover.bucket must differ from the primary bucket "${r}".`);return{replicaBucket:o,replicaRegion:a.region,replicate:a.replicate!==!1,statusCodes:ra(a.statusCodes??Dd),primaryConnection:jt(a,`${i}.failover`)}}function ia(e,a){return`${e}.s3.${a}.amazonaws.com`}function oa(e){let a=`arn:aws:s3:::${e.primaryBucket}`,r=`arn:aws:s3:::${e.replicaBucket}`;return{Type:"AWS::IAM::Role",Properties:{...e.roleName?{RoleName:e.roleName}:{},AssumeRolePolicyDocument:{Version:"2012-10-17",Statement:[{Effect:"Allow",Principal:{Service:"s3.amazonaws.com"},Action:"sts:AssumeRole"}]},Policies:[{PolicyName:"failover-replication",PolicyDocument:{Version:"2012-10-17",Statement:[{Effect:"Allow",Action:["s3:GetReplicationConfiguration","s3:ListBucket"],Resource:a},{Effect:"Allow",Action:["s3:GetObjectVersionForReplication","s3:GetObjectVersionAcl","s3:GetObjectVersionTagging"],Resource:`${a}/*`},{Effect:"Allow",Action:["s3:ReplicateObject","s3:ReplicateDelete","s3:ReplicateTags"],Resource:`${r}/*`}]}}]}}}function sa(e){return{Role:e.roleArn,Rules:[{Id:"cloudfront-failover-replica",Status:"Enabled",Priority:1,Filter:{Prefix:""},DeleteMarkerReplication:{Status:"Enabled"},Destination:{Bucket:`arn:aws:s3:::${e.replicaBucket}`}}]}}function aa(e){return{Sid:Do,Effect:"Allow",Principal:{Service:"cloudfront.amazonaws.com"},Action:"s3:GetObject",Resource:`arn:aws:s3:::${e.replicaBucket}/*`,Condition:{StringEquals:{"AWS:SourceArn":e.distributionArn}}}}function ca(e){let a=(typeof e==="string"?JSON.parse(e):e)?.Metadata?.[No];return Array.isArray(a)?a:[]}class ve{static createHostedZone(e){let{domain:a,slug:r,environment:n,comment:i}=e,o=l({slug:r,environment:n,resourceType:"hostedzone"}),c=s(`${o}-${a.replace(/\./g,"")}`);return{zone:{Type:"AWS::Route53::HostedZone",Properties:{Name:a,HostedZoneConfig:{Comment:i||`Hosted zone for ${a}`}}},logicalId:c}}static createRecord(e){let{hostedZoneId:a,hostedZoneName:r,name:n,type:i,ttl:o,values:c,aliasTarget:u}=e,d=s(`record-${n.replace(/\./g,"")}-${i}`),m={Type:"AWS::Route53::RecordSet",Properties:{Name:n,Type:i}};if(a)m.Properties.HostedZoneId=a;else if(r)m.Properties.HostedZoneName=r;if(u)m.Properties.AliasTarget={DNSName:u.dnsName,HostedZoneId:u.hostedZoneId,EvaluateTargetHealth:u.evaluateTargetHealth??!1};else m.Properties.TTL=o||300,m.Properties.ResourceRecords=c||[];return{record:m,logicalId:d}}static createCloudFrontAlias(e,a,r){return ve.createRecord({hostedZoneId:r,name:e,type:"A",aliasTarget:{dnsName:a,hostedZoneId:"Z2FDTNDATAQYW2",evaluateTargetHealth:!1}})}static createAlbAlias(e,a,r,n){return ve.createRecord({hostedZoneId:n,name:e,type:"A",aliasTarget:{dnsName:a,hostedZoneId:r,evaluateTargetHealth:!0}})}static createCname(e,a,r,n=300){return ve.createRecord({hostedZoneId:r,name:e,type:"CNAME",ttl:n,values:[a]})}static createWwwRedirect(e,a){return ve.createRecord({hostedZoneId:a,name:`www.${e}`,type:"CNAME",ttl:300,values:[e]})}static createMxRecords(e,a,r,n=300){return ve.createRecord({hostedZoneId:r,name:e,type:"MX",ttl:n,values:a.map((i)=>`${i.priority} ${i.server}`)})}static createTxtRecord(e,a,r,n=300){return ve.createRecord({hostedZoneId:r,name:e,type:"TXT",ttl:n,values:[`"${a}"`]})}static createSpfRecord(e,a,r){return ve.createTxtRecord(e,a,r)}static createDmarcRecord(e,a,r,n){let i=`v=DMARC1; p=${a}; rua=mailto:${r}`;return ve.createTxtRecord(`_dmarc.${e}`,i,n)}static createS3WebsiteAlias(e,a,r,n){return ve.createRecord({hostedZoneId:n,name:e,type:"A",aliasTarget:{dnsName:a,hostedZoneId:r,evaluateTargetHealth:!1}})}static S3WebsiteHostedZoneIds={"us-east-1":"Z3AQBSTGFYJSTF","us-east-2":"Z2O1EMRO9K5GLX","us-west-1":"Z2F56UZL2M1ACD","us-west-2":"Z3BJ6K6RIION7M","af-south-1":"Z83WF9RJE8B12","ap-east-1":"ZNB98KWMFR0R6","ap-south-1":"Z11RGJOFQNVJUP","ap-south-2":"Z02976202B4EZMXIPMXF7","ap-northeast-1":"Z2M4EHUR26P7ZW","ap-northeast-2":"Z3W03O7B5YMIYP","ap-northeast-3":"Z2YQB5RD63NC85","ap-southeast-1":"Z3O0J2DXBE1FTB","ap-southeast-2":"Z1WCIBER6CPFUU","ap-southeast-3":"Z01613992JD795ZI93075","ca-central-1":"Z1QDHH18159H29","eu-central-1":"Z21DNDUVLTQW6Q","eu-central-2":"Z030506016YDQGETNASS","eu-west-1":"Z1BKCTXD74EZPE","eu-west-2":"Z3GKZC51ZF0DB4","eu-west-3":"Z3R1K369G5AVDG","eu-north-1":"Z3BAZG2TWCNX0D","eu-south-1":"Z30OZKI7KPW7MI","eu-south-2":"Z0081959F7139GRJC19J","me-south-1":"Z1MPMWCPA7YB62","me-central-1":"Z06143092I8HRBER9VXCO","sa-east-1":"Z7KQH4QJS55SO"};static getS3WebsiteEndpoint(e,a){return`${e}.s3-website-${a}.amazonaws.com`}static createStoreRecord(e,a,r){return ve.createCname(`store.${e}`,a,r)}static createApiRecord(e,a,r){return ve.createCname(`api.${e}`,a,r)}static createDocsRecord(e,a,r){return ve.createCname(`docs.${e}`,a,r)}static CloudFrontHostedZoneId="Z2FDTNDATAQYW2"}class F{static createCertificate(e){let{domain:a,subdomains:r=[],slug:n,environment:i,validationMethod:o="DNS",hostedZoneId:c}=e,u=l({slug:n,environment:i,resourceType:"acm"}),d=s(`${u}-${a.replace(/\./g,"")}`),m=[a];for(let g of r)if(g==="*")m.push(`*.${a}`);else m.push(`${g}.${a}`);let p={Type:"AWS::CertificateManager::Certificate",Properties:{DomainName:a,SubjectAlternativeNames:m,ValidationMethod:o}};if(o==="DNS"&&c)p.Properties.DomainValidationOptions=m.map((g)=>({DomainName:g,HostedZoneId:c}));return{certificate:p,logicalId:d}}static createKmsKey(e){let{description:a,slug:r,environment:n,enableRotation:i=!0,multiRegion:o=!1}=e,c=l({slug:r,environment:n,resourceType:"kms"}),u=s(c),d={Version:"2012-10-17",Statement:[{Sid:"Enable IAM User Permissions",Effect:"Allow",Principal:{AWS:P.Sub("arn:aws:iam::${AWS::AccountId}:root")},Action:"kms:*",Resource:"*"},{Sid:"Allow services to use the key",Effect:"Allow",Principal:{Service:["s3.amazonaws.com","cloudfront.amazonaws.com","logs.amazonaws.com","secretsmanager.amazonaws.com"]},Action:["kms:Decrypt","kms:GenerateDataKey"],Resource:"*"}]},m={Type:"AWS::KMS::Key",Properties:{Description:a,Enabled:!0,EnableKeyRotation:i,KeyPolicy:d,KeySpec:"SYMMETRIC_DEFAULT",KeyUsage:"ENCRYPT_DECRYPT",MultiRegion:o}},p=s(`${c}-alias`),g={Type:"AWS::KMS::Alias",Properties:{AliasName:`alias/${r}-${n}`,TargetKeyId:P.Ref(u)}};return{key:m,alias:g,logicalId:u,aliasId:p}}static createFirewall(e){let{slug:a,environment:r,scope:n="CLOUDFRONT",defaultAction:i="allow"}=e,o=l({slug:a,environment:r,resourceType:"waf"}),c=s(o);return{webAcl:{Type:"AWS::WAFv2::WebACL",Properties:{Name:o,Scope:n,DefaultAction:i==="allow"?{Allow:{}}:{Block:{}},Description:`WAF for ${a} ${r}`,Rules:[],VisibilityConfig:{SampledRequestsEnabled:!0,CloudWatchMetricsEnabled:!0,MetricName:`${o}-metric`}}},logicalId:c}}static setRateLimit(e,a){if(!e.Properties.Rules)e.Properties.Rules=[];return e.Properties.Rules.push({Name:a.name,Priority:a.priority,Statement:{RateBasedStatement:{Limit:a.requestsPerWindow,AggregateKeyType:a.aggregateKeyType||"IP"}},Action:{Block:{}},VisibilityConfig:{SampledRequestsEnabled:!0,CloudWatchMetricsEnabled:!0,MetricName:`${a.name}-metric`}}),e}static blockCountries(e,a){if(!e.Properties.Rules)e.Properties.Rules=[];return e.Properties.Rules.push({Name:a.name,Priority:a.priority,Statement:{GeoMatchStatement:{CountryCodes:a.countryCodes}},Action:{Block:{}},VisibilityConfig:{SampledRequestsEnabled:!0,CloudWatchMetricsEnabled:!0,MetricName:`${a.name}-metric`}}),e}static blockIpAddresses(e,a,r,n){let i=l({slug:r,environment:n,resourceType:"ipset"}),o=s(`${i}-${a.name}`),c={Type:"AWS::WAFv2::IPSet",Properties:{Name:`${i}-${a.name}`,Scope:e.Properties.Scope,IPAddressVersion:a.ipVersion||"IPV4",Addresses:a.ipAddresses,Description:`Blocked IPs for ${a.name}`}};if(!e.Properties.Rules)e.Properties.Rules=[];return e.Properties.Rules.push({Name:a.name,Priority:a.priority,Statement:{IPSetReferenceStatement:{Arn:P.GetAtt(o,"Arn")}},Action:{Block:{}},VisibilityConfig:{SampledRequestsEnabled:!0,CloudWatchMetricsEnabled:!0,MetricName:`${a.name}-metric`}}),{webAcl:e,ipSet:c,ipSetLogicalId:o}}static addManagedRules(e,a){if(!e.Properties.Rules)e.Properties.Rules=[];let r={ManagedRuleGroupStatement:{VendorName:a.vendorName,Name:a.ruleName}};if(a.excludedRules&&a.excludedRules.length>0)r.ManagedRuleGroupStatement.ExcludedRules=a.excludedRules.map((n)=>({Name:n}));return e.Properties.Rules.push({Name:a.name,Priority:a.priority,Statement:r,VisibilityConfig:{SampledRequestsEnabled:!0,CloudWatchMetricsEnabled:!0,MetricName:`${a.name}-metric`}}),e}static ManagedRuleGroups={CoreRuleSet:{vendorName:"AWS",ruleName:"AWSManagedRulesCommonRuleSet"},KnownBadInputs:{vendorName:"AWS",ruleName:"AWSManagedRulesKnownBadInputsRuleSet"},SqlDatabase:{vendorName:"AWS",ruleName:"AWSManagedRulesSQLiRuleSet"},LinuxOS:{vendorName:"AWS",ruleName:"AWSManagedRulesLinuxRuleSet"},PosixOS:{vendorName:"AWS",ruleName:"AWSManagedRulesUnixRuleSet"},AmazonIpReputation:{vendorName:"AWS",ruleName:"AWSManagedRulesAmazonIpReputationList"},AnonymousIpList:{vendorName:"AWS",ruleName:"AWSManagedRulesAnonymousIpList"},BotControl:{vendorName:"AWS",ruleName:"AWSManagedRulesBotControlRuleSet"}};static setPathRateLimit(e,a){if(!e.Properties.Rules)e.Properties.Rules=[];let r=a.paths.map((n)=>({SearchString:n,FieldToMatch:{UriPath:{}},TextTransformation:[{Priority:0,Type:"LOWERCASE"}],PositionalConstraint:"STARTS_WITH"}));return e.Properties.Rules.push({Name:a.name,Priority:a.priority,Statement:{RateBasedStatement:{Limit:a.requestsPerWindow,AggregateKeyType:a.aggregateKeyType||"IP",ScopeDownStatement:{OrStatement:{Statements:r.map((n)=>({ByteMatchStatement:n}))}}}},Action:{Block:{}},VisibilityConfig:{SampledRequestsEnabled:!0,CloudWatchMetricsEnabled:!0,MetricName:`${a.name}-metric`}}),e}static setHeaderRateLimit(e,a){if(!e.Properties.Rules)e.Properties.Rules=[];let r={RateBasedStatement:{Limit:a.requestsPerWindow,AggregateKeyType:"CUSTOM_KEYS",CustomKeys:[{Header:{Name:a.headerName,TextTransformations:[{Priority:0,Type:"NONE"}]}}]}};if(a.headerValue)r.RateBasedStatement.ScopeDownStatement={ByteMatchStatement:{SearchString:a.headerValue,FieldToMatch:{SingleHeader:{Name:a.headerName}},TextTransformation:[{Priority:0,Type:"NONE"}],PositionalConstraint:"EXACTLY"}};return e.Properties.Rules.push({Name:a.name,Priority:a.priority,Statement:r,Action:{Block:{}},VisibilityConfig:{SampledRequestsEnabled:!0,CloudWatchMetricsEnabled:!0,MetricName:`${a.name}-metric`}}),e}static protectLoginEndpoint(e,a){let{loginPaths:r,priority:n,requestsPerMinute:i=10}=a;return F.setPathRateLimit(e,{name:"LoginRateLimit",priority:n,requestsPerWindow:i*5,paths:r}),e}static protectApiEndpoints(e,a){let{apiPaths:r,priority:n,requestsPerMinute:i=100}=a;return F.setPathRateLimit(e,{name:"ApiRateLimit",priority:n,requestsPerWindow:i*5,paths:r}),e}static createProtectedFirewall(e){let{slug:a,environment:r,scope:n="CLOUDFRONT",enableBotControl:i=!1,enableRateLimiting:o=!0,rateLimitPerMinute:c=2000}=e,{webAcl:u,logicalId:d}=F.createFirewall({slug:a,environment:r,scope:n,defaultAction:"allow"}),m=0;if(u=F.addManagedRules(u,{name:"AWSIPReputationList",priority:m++,...F.ManagedRuleGroups.AmazonIpReputation}),u=F.addManagedRules(u,{name:"AWSAnonymousIPList",priority:m++,...F.ManagedRuleGroups.AnonymousIpList}),u=F.addManagedRules(u,{name:"AWSCoreRuleSet",priority:m++,...F.ManagedRuleGroups.CoreRuleSet}),u=F.addManagedRules(u,{name:"AWSKnownBadInputs",priority:m++,...F.ManagedRuleGroups.KnownBadInputs}),u=F.addManagedRules(u,{name:"AWSSQLi",priority:m++,...F.ManagedRuleGroups.SqlDatabase}),i)u=F.addManagedRules(u,{name:"AWSBotControl",priority:m++,...F.ManagedRuleGroups.BotControl});if(o)u=F.setRateLimit(u,{name:"GlobalRateLimit",priority:m++,requestsPerWindow:c*5});return{webAcl:u,logicalId:d}}static RateLimitPresets={STANDARD:2000,HIGH_TRAFFIC:1e4,STRICT:100,LOGIN:10,API:100}}class S{static createServer(e){let{slug:a,environment:r,instanceType:n="t3.micro",imageId:i="ami-0f3caa1cf4417e51b",keyName:o,securityGroupIds:c,subnetId:u,userData:d,volumeSize:m=20,volumeType:p="gp3",encrypted:g=!0}=e,h=l({slug:a,environment:r,resourceType:"ec2"}),y=s(h),f={Type:"AWS::EC2::Instance",Properties:{ImageId:i,InstanceType:n,Tags:[{Key:"Name",Value:h},{Key:"Environment",Value:r}]}};if(o)f.Properties.KeyName=o;if(c)f.Properties.SecurityGroupIds=c;if(u)f.Properties.SubnetId=u;if(d)f.Properties.UserData=P.Base64(d);return f.Properties.BlockDeviceMappings=[{DeviceName:"/dev/xvda",Ebs:{VolumeSize:m,VolumeType:p,Encrypted:g,DeleteOnTermination:!0}}],{instance:f,logicalId:y}}static createSecurityGroup(e){let{slug:a,environment:r,vpcId:n,description:i,ingress:o=[],egress:c=[]}=e,u=l({slug:a,environment:r,resourceType:"sg"}),d=s(u),m={Type:"AWS::EC2::SecurityGroup",Properties:{GroupDescription:i||`Security group for ${a} ${r}`,Tags:[{Key:"Name",Value:u},{Key:"Environment",Value:r}]}};if(n)m.Properties.VpcId=n;if(o.length>0)m.Properties.SecurityGroupIngress=o.map((p)=>({IpProtocol:p.protocol,FromPort:p.fromPort,ToPort:p.toPort,CidrIp:p.cidr,SourceSecurityGroupId:p.sourceSecurityGroupId}));if(c.length>0)m.Properties.SecurityGroupEgress=c.map((p)=>({IpProtocol:p.protocol,FromPort:p.fromPort,ToPort:p.toPort,CidrIp:p.cidr,DestinationSecurityGroupId:p.sourceSecurityGroupId}));return{securityGroup:m,logicalId:d}}static createWebServerSecurityGroup(e,a,r){return S.createSecurityGroup({slug:e,environment:a,vpcId:r,description:"Security group for web servers - HTTP, HTTPS, SSH",ingress:[{protocol:"tcp",fromPort:80,toPort:80,cidr:"0.0.0.0/0"},{protocol:"tcp",fromPort:443,toPort:443,cidr:"0.0.0.0/0"},{protocol:"tcp",fromPort:22,toPort:22,cidr:"0.0.0.0/0"}],egress:[{protocol:"-1",fromPort:0,toPort:0,cidr:"0.0.0.0/0"}]})}static createLoadBalancer(e){let{slug:a,environment:r,scheme:n="internet-facing",subnets:i,securityGroups:o,type:c="application"}=e,u=l({slug:a,environment:r,resourceType:"alb"}),d=s(u),m={Type:"AWS::ElasticLoadBalancingV2::LoadBalancer",Properties:{Name:u,Scheme:n,Type:c,Subnets:i,Tags:[{Key:"Name",Value:u},{Key:"Environment",Value:r}]}};if(o)m.Properties.SecurityGroups=o;return{loadBalancer:m,logicalId:d}}static createTargetGroup(e){let{slug:a,environment:r,port:n,protocol:i="HTTP",vpcId:o,targetType:c="ip",healthCheckPath:u="/",healthCheckInterval:d=30,healthCheckTimeout:m=5,healthyThreshold:p=2,unhealthyThreshold:g=3}=e,h=l({slug:a,environment:r,resourceType:"tg"}),y=s(h);return{targetGroup:{Type:"AWS::ElasticLoadBalancingV2::TargetGroup",Properties:{Name:h,Port:n,Protocol:i,VpcId:o,TargetType:c,HealthCheckEnabled:!0,HealthCheckProtocol:i,HealthCheckPath:u,HealthCheckIntervalSeconds:d,HealthCheckTimeoutSeconds:m,HealthyThresholdCount:p,UnhealthyThresholdCount:g,Tags:[{Key:"Name",Value:h},{Key:"Environment",Value:r}]}},logicalId:y}}static createListener(e,a){let{port:r,protocol:n="HTTP",certificateArn:i,defaultTargetGroupArn:o}=a,c=s(`listener-${e}-${r}`),u={Type:"AWS::ElasticLoadBalancingV2::Listener",Properties:{LoadBalancerArn:P.Ref(e),Port:r,Protocol:n,DefaultActions:[{Type:"forward",TargetGroupArn:o}]}};if(n==="HTTPS"&&i)u.Properties.Certificates=[{CertificateArn:i}],u.Properties.SslPolicy="ELBSecurityPolicy-TLS13-1-2-2021-06";return{listener:u,logicalId:c}}static createEcsCluster(e,a){let r=l({slug:e,environment:a,resourceType:"ecs-cluster"}),n=s(r);return{cluster:{Type:"AWS::ECS::Cluster",Properties:{ClusterName:r,Tags:[{Key:"Name",Value:r},{Key:"Environment",Value:a}]}},logicalId:n}}static createFargateService(e){let{slug:a,environment:r,image:n,cpu:i="256",memory:o="512",desiredCount:c=1,containerPort:u=8080,environmentVariables:d={},secrets:m=[],healthCheck:p,logGroup:g,subnets:h,securityGroups:y,targetGroupArn:f}=e,{cluster:b,logicalId:T}=S.createEcsCluster(a,r),w=l({slug:a,environment:r,resourceType:"fargate"}),I=s(`${w}-execution-role`),v={Type:"AWS::IAM::Role",Properties:{AssumeRolePolicyDocument:{Version:"2012-10-17",Statement:[{Effect:"Allow",Principal:{Service:"ecs-tasks.amazonaws.com"},Action:"sts:AssumeRole"}]},ManagedPolicyArns:["arn:aws:iam::aws:policy/service-role/AmazonECSTaskExecutionRolePolicy"]}},N=s(`${w}-task-role`),R={Type:"AWS::IAM::Role",Properties:{AssumeRolePolicyDocument:{Version:"2012-10-17",Statement:[{Effect:"Allow",Principal:{Service:"ecs-tasks.amazonaws.com"},Action:"sts:AssumeRole"}]}}},k=s(`${w}-task`),x={Type:"AWS::ECS::TaskDefinition",Properties:{Family:w,TaskRoleArn:P.GetAtt(N,"Arn"),ExecutionRoleArn:P.GetAtt(I,"Arn"),NetworkMode:"awsvpc",RequiresCompatibilities:["FARGATE"],Cpu:i,Memory:o,ContainerDefinitions:[{Name:a,Image:n,Essential:!0,PortMappings:[{ContainerPort:u,Protocol:"tcp"}],Environment:Object.entries(d).map(([W,V])=>({Name:W,Value:V})),Secrets:m.map((W)=>({Name:W.name,ValueFrom:W.valueFrom}))}],Tags:[{Key:"Name",Value:w},{Key:"Environment",Value:r}]}};if(p)x.Properties.ContainerDefinitions[0].HealthCheck={Command:p.command,Interval:p.interval||30,Timeout:p.timeout||5,Retries:p.retries||3,StartPeriod:60};if(g)x.Properties.ContainerDefinitions[0].LogConfiguration={LogDriver:"awslogs",Options:{"awslogs-group":g,"awslogs-region":P.Ref("AWS::Region"),"awslogs-stream-prefix":a}};let L=s(`${w}-service`),_={Type:"AWS::ECS::Service",Properties:{ServiceName:w,Cluster:P.Ref(T),TaskDefinition:P.Ref(k),DesiredCount:c,LaunchType:"FARGATE",NetworkConfiguration:{AwsvpcConfiguration:{Subnets:h,SecurityGroups:y,AssignPublicIp:"ENABLED"}},Tags:[{Key:"Name",Value:w},{Key:"Environment",Value:r}]}};if(f)_.Properties.LoadBalancers=[{TargetGroupArn:f,ContainerName:a,ContainerPort:u}];return{cluster:b,taskDefinition:x,service:_,taskRole:R,executionRole:v,clusterLogicalId:T,taskDefinitionLogicalId:k,serviceLogicalId:L,taskRoleLogicalId:N,executionRoleLogicalId:I}}static createLambdaFunction(e){let{slug:a,environment:r,runtime:n,handler:i,code:o,timeout:c=30,memorySize:u=128,environmentVariables:d={},vpcConfig:m}=e,p=l({slug:a,environment:r,resourceType:"lambda"}),g=s(p),h=s(`${p}-role`),y={Type:"AWS::IAM::Role",Properties:{AssumeRolePolicyDocument:{Version:"2012-10-17",Statement:[{Effect:"Allow",Principal:{Service:"lambda.amazonaws.com"},Action:"sts:AssumeRole"}]},ManagedPolicyArns:["arn:aws:iam::aws:policy/service-role/AWSLambdaBasicExecutionRole"]}};if(m)y.Properties.ManagedPolicyArns.push("arn:aws:iam::aws:policy/service-role/AWSLambdaVPCAccessExecutionRole");let f={Type:"AWS::Lambda::Function",Properties:{FunctionName:p,Runtime:n,Role:P.GetAtt(h,"Arn"),Handler:i,Code:{...o.s3Bucket&&{S3Bucket:o.s3Bucket},...o.s3Key&&{S3Key:o.s3Key},...o.zipFile&&{ZipFile:o.zipFile}},Timeout:c,MemorySize:u,Tags:[{Key:"Name",Value:p},{Key:"Environment",Value:r}]}};if(Object.keys(d).length>0)f.Properties.Environment={Variables:d};if(m)f.Properties.VpcConfig={SecurityGroupIds:m.securityGroupIds,SubnetIds:m.subnetIds};return{lambdaFunction:f,role:y,logicalId:g,roleLogicalId:h}}static generateNodeServerUserData(e={}){let{nodeVersion:a="20",appRepo:r,environment:n={}}=e,i=Object.entries(n).map(([o,c])=>`echo "export ${o}='${c}'" >> /etc/environment`).join(`
+`.trim()};static Config={ttl:(e)=>{let{min:a=0,max:r=86400,default:n=86400}=e;return{MinTTL:a,MaxTTL:r,DefaultTTL:n}},cookies:(e,a)=>{let r={Forward:e==="allowList"?"whitelist":e};if(e==="allowList"&&a)r.WhitelistedNames=a;return r},allowedMethods:(e)=>{let a={ALL:["GET","HEAD","OPTIONS","PUT","POST","PATCH","DELETE"],GET_HEAD:["GET","HEAD"],GET_HEAD_OPTIONS:["GET","HEAD","OPTIONS"]};return a[e]||a.GET_HEAD},cachedMethods:(e)=>{let a={GET_HEAD:["GET","HEAD"],GET_HEAD_OPTIONS:["GET","HEAD","OPTIONS"]};return a[e]||a.GET_HEAD},ttlPresets:{static:{min:0,max:31536000,default:31536000},dynamic:{min:0,max:0,default:0},api:{min:0,max:3600,default:60},html:{min:0,max:86400,default:86400},images:{min:0,max:604800,default:604800}},cacheBehavior:(e)=>{let{ttl:a={min:0,max:86400,default:86400},cookies:r="none",allowedCookies:n,allowedMethods:i="GET_HEAD",cachedMethods:o="GET_HEAD",compress:c=!0,forwardQueryString:u=!0,forwardHeaders:d=[]}=e;return{MinTTL:a.min,MaxTTL:a.max,DefaultTTL:a.default,Compress:c,AllowedMethods:Be.Config.allowedMethods(i),CachedMethods:Be.Config.cachedMethods(o),ForwardedValues:{QueryString:u,Headers:d,Cookies:Be.Config.cookies(r,n)}}}};static applyConfig(e,a){let r=e.Properties.DistributionConfig.DefaultCacheBehavior;if(a.ttl)r.MinTTL=a.ttl.min,r.MaxTTL=a.ttl.max,r.DefaultTTL=a.ttl.default;if(a.compress!==void 0)r.Compress=a.compress;if(a.allowedMethods)r.AllowedMethods=Be.Config.allowedMethods(a.allowedMethods);if(a.cachedMethods)r.CachedMethods=Be.Config.cachedMethods(a.cachedMethods);if(a.cookies){if(!r.ForwardedValues)r.ForwardedValues={QueryString:!0};r.ForwardedValues.Cookies=Be.Config.cookies(a.cookies,a.allowedCookies)}return e}}var Dd=[403,404,500,502,503,504],No="TsCloud::StorageFailover",Do="AllowCloudFrontFailoverRead",Jr=/^[a-z]{2}(?:-gov)?-[a-z]+-\d$/,Yr=/^[a-z0-9][a-z0-9.-]{1,61}[a-z0-9]$/;function na(e){let{failover:a,primaryBucket:r,primaryRegion:n}=e,i=e.where??"storage failover";if(!a||typeof a!=="object")throw Error(`${i}.failover must be an object such as { region: 'us-west-2' }.`);if(!a.region||!Jr.test(a.region))throw Error(`${i}.failover.region must be an AWS region such as 'us-west-2', got ${JSON.stringify(a.region)}.`);if(a.region===n)throw Error(`${i}.failover.region is ${a.region}, the same region as the primary bucket. Failover only helps when the replica is in another region.`);let o=a.bucket??`${r}-${a.region}`;if(!Yr.test(o)||o.includes("..")){let c=a.bucket===void 0&&o.length>63?` The default name (<primary bucket>-<region>) is ${o.length} characters; S3 allows 63. Set ${i}.failover.bucket.`:"";throw Error(`${i}.failover: "${o}" is not a valid S3 bucket name.${c}`)}if(o===r)throw Error(`${i}.failover.bucket must differ from the primary bucket "${r}".`);return{replicaBucket:o,replicaRegion:a.region,replicate:a.replicate!==!1,statusCodes:ra(a.statusCodes??Dd),primaryConnection:jt(a,`${i}.failover`)}}function ia(e,a){return`${e}.s3.${a}.amazonaws.com`}function oa(e){let a=`arn:aws:s3:::${e.primaryBucket}`,r=`arn:aws:s3:::${e.replicaBucket}`;return{Type:"AWS::IAM::Role",Properties:{...e.roleName?{RoleName:e.roleName}:{},AssumeRolePolicyDocument:{Version:"2012-10-17",Statement:[{Effect:"Allow",Principal:{Service:"s3.amazonaws.com"},Action:"sts:AssumeRole"}]},Policies:[{PolicyName:"failover-replication",PolicyDocument:{Version:"2012-10-17",Statement:[{Effect:"Allow",Action:["s3:GetReplicationConfiguration","s3:ListBucket"],Resource:a},{Effect:"Allow",Action:["s3:GetObjectVersionForReplication","s3:GetObjectVersionAcl","s3:GetObjectVersionTagging"],Resource:`${a}/*`},{Effect:"Allow",Action:["s3:ReplicateObject","s3:ReplicateDelete","s3:ReplicateTags"],Resource:`${r}/*`}]}}]}}}function sa(e){return{Role:e.roleArn,Rules:[{Id:"cloudfront-failover-replica",Status:"Enabled",Priority:1,Filter:{Prefix:""},DeleteMarkerReplication:{Status:"Enabled"},Destination:{Bucket:`arn:aws:s3:::${e.replicaBucket}`}}]}}function aa(e){return{Sid:Do,Effect:"Allow",Principal:{Service:"cloudfront.amazonaws.com"},Action:"s3:GetObject",Resource:`arn:aws:s3:::${e.replicaBucket}/*`,Condition:{StringEquals:{"AWS:SourceArn":e.distributionArn}}}}function ca(e){let a=(typeof e==="string"?JSON.parse(e):e)?.Metadata?.[No];return Array.isArray(a)?a:[]}class ve{static createHostedZone(e){let{domain:a,slug:r,environment:n,comment:i}=e,o=l({slug:r,environment:n,resourceType:"hostedzone"}),c=s(`${o}-${a.replace(/\./g,"")}`);return{zone:{Type:"AWS::Route53::HostedZone",Properties:{Name:a,HostedZoneConfig:{Comment:i||`Hosted zone for ${a}`}}},logicalId:c}}static createRecord(e){let{hostedZoneId:a,hostedZoneName:r,name:n,type:i,ttl:o,values:c,aliasTarget:u}=e,d=s(`record-${n.replace(/\./g,"")}-${i}`),m={Type:"AWS::Route53::RecordSet",Properties:{Name:n,Type:i}};if(a)m.Properties.HostedZoneId=a;else if(r)m.Properties.HostedZoneName=r;if(u)m.Properties.AliasTarget={DNSName:u.dnsName,HostedZoneId:u.hostedZoneId,EvaluateTargetHealth:u.evaluateTargetHealth??!1};else m.Properties.TTL=o||300,m.Properties.ResourceRecords=c||[];return{record:m,logicalId:d}}static createCloudFrontAlias(e,a,r){return ve.createRecord({hostedZoneId:r,name:e,type:"A",aliasTarget:{dnsName:a,hostedZoneId:"Z2FDTNDATAQYW2",evaluateTargetHealth:!1}})}static createAlbAlias(e,a,r,n){return ve.createRecord({hostedZoneId:n,name:e,type:"A",aliasTarget:{dnsName:a,hostedZoneId:r,evaluateTargetHealth:!0}})}static createCname(e,a,r,n=300){return ve.createRecord({hostedZoneId:r,name:e,type:"CNAME",ttl:n,values:[a]})}static createWwwRedirect(e,a){return ve.createRecord({hostedZoneId:a,name:`www.${e}`,type:"CNAME",ttl:300,values:[e]})}static createMxRecords(e,a,r,n=300){return ve.createRecord({hostedZoneId:r,name:e,type:"MX",ttl:n,values:a.map((i)=>`${i.priority} ${i.server}`)})}static createTxtRecord(e,a,r,n=300){return ve.createRecord({hostedZoneId:r,name:e,type:"TXT",ttl:n,values:[`"${a}"`]})}static createSpfRecord(e,a,r){return ve.createTxtRecord(e,a,r)}static createDmarcRecord(e,a,r,n){let i=`v=DMARC1; p=${a}; rua=mailto:${r}`;return ve.createTxtRecord(`_dmarc.${e}`,i,n)}static createS3WebsiteAlias(e,a,r,n){return ve.createRecord({hostedZoneId:n,name:e,type:"A",aliasTarget:{dnsName:a,hostedZoneId:r,evaluateTargetHealth:!1}})}static S3WebsiteHostedZoneIds={"us-east-1":"Z3AQBSTGFYJSTF","us-east-2":"Z2O1EMRO9K5GLX","us-west-1":"Z2F56UZL2M1ACD","us-west-2":"Z3BJ6K6RIION7M","af-south-1":"Z83WF9RJE8B12","ap-east-1":"ZNB98KWMFR0R6","ap-south-1":"Z11RGJOFQNVJUP","ap-south-2":"Z02976202B4EZMXIPMXF7","ap-northeast-1":"Z2M4EHUR26P7ZW","ap-northeast-2":"Z3W03O7B5YMIYP","ap-northeast-3":"Z2YQB5RD63NC85","ap-southeast-1":"Z3O0J2DXBE1FTB","ap-southeast-2":"Z1WCIBER6CPFUU","ap-southeast-3":"Z01613992JD795ZI93075","ca-central-1":"Z1QDHH18159H29","eu-central-1":"Z21DNDUVLTQW6Q","eu-central-2":"Z030506016YDQGETNASS","eu-west-1":"Z1BKCTXD74EZPE","eu-west-2":"Z3GKZC51ZF0DB4","eu-west-3":"Z3R1K369G5AVDG","eu-north-1":"Z3BAZG2TWCNX0D","eu-south-1":"Z30OZKI7KPW7MI","eu-south-2":"Z0081959F7139GRJC19J","me-south-1":"Z1MPMWCPA7YB62","me-central-1":"Z06143092I8HRBER9VXCO","sa-east-1":"Z7KQH4QJS55SO"};static getS3WebsiteEndpoint(e,a){return`${e}.s3-website-${a}.amazonaws.com`}static createStoreRecord(e,a,r){return ve.createCname(`store.${e}`,a,r)}static createApiRecord(e,a,r){return ve.createCname(`api.${e}`,a,r)}static createDocsRecord(e,a,r){return ve.createCname(`docs.${e}`,a,r)}static CloudFrontHostedZoneId="Z2FDTNDATAQYW2"}class j{static createCertificate(e){let{domain:a,subdomains:r=[],slug:n,environment:i,validationMethod:o="DNS",hostedZoneId:c}=e,u=l({slug:n,environment:i,resourceType:"acm"}),d=s(`${u}-${a.replace(/\./g,"")}`),m=[a];for(let g of r)if(g==="*")m.push(`*.${a}`);else m.push(`${g}.${a}`);let p={Type:"AWS::CertificateManager::Certificate",Properties:{DomainName:a,SubjectAlternativeNames:m,ValidationMethod:o}};if(o==="DNS"&&c)p.Properties.DomainValidationOptions=m.map((g)=>({DomainName:g,HostedZoneId:c}));return{certificate:p,logicalId:d}}static createKmsKey(e){let{description:a,slug:r,environment:n,enableRotation:i=!0,multiRegion:o=!1}=e,c=l({slug:r,environment:n,resourceType:"kms"}),u=s(c),d={Version:"2012-10-17",Statement:[{Sid:"Enable IAM User Permissions",Effect:"Allow",Principal:{AWS:P.Sub("arn:aws:iam::${AWS::AccountId}:root")},Action:"kms:*",Resource:"*"},{Sid:"Allow services to use the key",Effect:"Allow",Principal:{Service:["s3.amazonaws.com","cloudfront.amazonaws.com","logs.amazonaws.com","secretsmanager.amazonaws.com"]},Action:["kms:Decrypt","kms:GenerateDataKey"],Resource:"*"}]},m={Type:"AWS::KMS::Key",Properties:{Description:a,Enabled:!0,EnableKeyRotation:i,KeyPolicy:d,KeySpec:"SYMMETRIC_DEFAULT",KeyUsage:"ENCRYPT_DECRYPT",MultiRegion:o}},p=s(`${c}-alias`),g={Type:"AWS::KMS::Alias",Properties:{AliasName:`alias/${r}-${n}`,TargetKeyId:P.Ref(u)}};return{key:m,alias:g,logicalId:u,aliasId:p}}static createFirewall(e){let{slug:a,environment:r,scope:n="CLOUDFRONT",defaultAction:i="allow"}=e,o=l({slug:a,environment:r,resourceType:"waf"}),c=s(o);return{webAcl:{Type:"AWS::WAFv2::WebACL",Properties:{Name:o,Scope:n,DefaultAction:i==="allow"?{Allow:{}}:{Block:{}},Description:`WAF for ${a} ${r}`,Rules:[],VisibilityConfig:{SampledRequestsEnabled:!0,CloudWatchMetricsEnabled:!0,MetricName:`${o}-metric`}}},logicalId:c}}static setRateLimit(e,a){if(!e.Properties.Rules)e.Properties.Rules=[];return e.Properties.Rules.push({Name:a.name,Priority:a.priority,Statement:{RateBasedStatement:{Limit:a.requestsPerWindow,AggregateKeyType:a.aggregateKeyType||"IP"}},Action:{Block:{}},VisibilityConfig:{SampledRequestsEnabled:!0,CloudWatchMetricsEnabled:!0,MetricName:`${a.name}-metric`}}),e}static blockCountries(e,a){if(!e.Properties.Rules)e.Properties.Rules=[];return e.Properties.Rules.push({Name:a.name,Priority:a.priority,Statement:{GeoMatchStatement:{CountryCodes:a.countryCodes}},Action:{Block:{}},VisibilityConfig:{SampledRequestsEnabled:!0,CloudWatchMetricsEnabled:!0,MetricName:`${a.name}-metric`}}),e}static blockIpAddresses(e,a,r,n){let i=l({slug:r,environment:n,resourceType:"ipset"}),o=s(`${i}-${a.name}`),c={Type:"AWS::WAFv2::IPSet",Properties:{Name:`${i}-${a.name}`,Scope:e.Properties.Scope,IPAddressVersion:a.ipVersion||"IPV4",Addresses:a.ipAddresses,Description:`Blocked IPs for ${a.name}`}};if(!e.Properties.Rules)e.Properties.Rules=[];return e.Properties.Rules.push({Name:a.name,Priority:a.priority,Statement:{IPSetReferenceStatement:{Arn:P.GetAtt(o,"Arn")}},Action:{Block:{}},VisibilityConfig:{SampledRequestsEnabled:!0,CloudWatchMetricsEnabled:!0,MetricName:`${a.name}-metric`}}),{webAcl:e,ipSet:c,ipSetLogicalId:o}}static addManagedRules(e,a){if(!e.Properties.Rules)e.Properties.Rules=[];let r={ManagedRuleGroupStatement:{VendorName:a.vendorName,Name:a.ruleName}};if(a.excludedRules&&a.excludedRules.length>0)r.ManagedRuleGroupStatement.ExcludedRules=a.excludedRules.map((n)=>({Name:n}));return e.Properties.Rules.push({Name:a.name,Priority:a.priority,Statement:r,VisibilityConfig:{SampledRequestsEnabled:!0,CloudWatchMetricsEnabled:!0,MetricName:`${a.name}-metric`}}),e}static ManagedRuleGroups={CoreRuleSet:{vendorName:"AWS",ruleName:"AWSManagedRulesCommonRuleSet"},KnownBadInputs:{vendorName:"AWS",ruleName:"AWSManagedRulesKnownBadInputsRuleSet"},SqlDatabase:{vendorName:"AWS",ruleName:"AWSManagedRulesSQLiRuleSet"},LinuxOS:{vendorName:"AWS",ruleName:"AWSManagedRulesLinuxRuleSet"},PosixOS:{vendorName:"AWS",ruleName:"AWSManagedRulesUnixRuleSet"},AmazonIpReputation:{vendorName:"AWS",ruleName:"AWSManagedRulesAmazonIpReputationList"},AnonymousIpList:{vendorName:"AWS",ruleName:"AWSManagedRulesAnonymousIpList"},BotControl:{vendorName:"AWS",ruleName:"AWSManagedRulesBotControlRuleSet"}};static setPathRateLimit(e,a){if(!e.Properties.Rules)e.Properties.Rules=[];let r=a.paths.map((n)=>({SearchString:n,FieldToMatch:{UriPath:{}},TextTransformation:[{Priority:0,Type:"LOWERCASE"}],PositionalConstraint:"STARTS_WITH"}));return e.Properties.Rules.push({Name:a.name,Priority:a.priority,Statement:{RateBasedStatement:{Limit:a.requestsPerWindow,AggregateKeyType:a.aggregateKeyType||"IP",ScopeDownStatement:{OrStatement:{Statements:r.map((n)=>({ByteMatchStatement:n}))}}}},Action:{Block:{}},VisibilityConfig:{SampledRequestsEnabled:!0,CloudWatchMetricsEnabled:!0,MetricName:`${a.name}-metric`}}),e}static setHeaderRateLimit(e,a){if(!e.Properties.Rules)e.Properties.Rules=[];let r={RateBasedStatement:{Limit:a.requestsPerWindow,AggregateKeyType:"CUSTOM_KEYS",CustomKeys:[{Header:{Name:a.headerName,TextTransformations:[{Priority:0,Type:"NONE"}]}}]}};if(a.headerValue)r.RateBasedStatement.ScopeDownStatement={ByteMatchStatement:{SearchString:a.headerValue,FieldToMatch:{SingleHeader:{Name:a.headerName}},TextTransformation:[{Priority:0,Type:"NONE"}],PositionalConstraint:"EXACTLY"}};return e.Properties.Rules.push({Name:a.name,Priority:a.priority,Statement:r,Action:{Block:{}},VisibilityConfig:{SampledRequestsEnabled:!0,CloudWatchMetricsEnabled:!0,MetricName:`${a.name}-metric`}}),e}static protectLoginEndpoint(e,a){let{loginPaths:r,priority:n,requestsPerMinute:i=10}=a;return j.setPathRateLimit(e,{name:"LoginRateLimit",priority:n,requestsPerWindow:i*5,paths:r}),e}static protectApiEndpoints(e,a){let{apiPaths:r,priority:n,requestsPerMinute:i=100}=a;return j.setPathRateLimit(e,{name:"ApiRateLimit",priority:n,requestsPerWindow:i*5,paths:r}),e}static createProtectedFirewall(e){let{slug:a,environment:r,scope:n="CLOUDFRONT",enableBotControl:i=!1,enableRateLimiting:o=!0,rateLimitPerMinute:c=2000}=e,{webAcl:u,logicalId:d}=j.createFirewall({slug:a,environment:r,scope:n,defaultAction:"allow"}),m=0;if(u=j.addManagedRules(u,{name:"AWSIPReputationList",priority:m++,...j.ManagedRuleGroups.AmazonIpReputation}),u=j.addManagedRules(u,{name:"AWSAnonymousIPList",priority:m++,...j.ManagedRuleGroups.AnonymousIpList}),u=j.addManagedRules(u,{name:"AWSCoreRuleSet",priority:m++,...j.ManagedRuleGroups.CoreRuleSet}),u=j.addManagedRules(u,{name:"AWSKnownBadInputs",priority:m++,...j.ManagedRuleGroups.KnownBadInputs}),u=j.addManagedRules(u,{name:"AWSSQLi",priority:m++,...j.ManagedRuleGroups.SqlDatabase}),i)u=j.addManagedRules(u,{name:"AWSBotControl",priority:m++,...j.ManagedRuleGroups.BotControl});if(o)u=j.setRateLimit(u,{name:"GlobalRateLimit",priority:m++,requestsPerWindow:c*5});return{webAcl:u,logicalId:d}}static RateLimitPresets={STANDARD:2000,HIGH_TRAFFIC:1e4,STRICT:100,LOGIN:10,API:100}}class S{static createServer(e){let{slug:a,environment:r,instanceType:n="t3.micro",imageId:i="ami-0f3caa1cf4417e51b",keyName:o,securityGroupIds:c,subnetId:u,userData:d,volumeSize:m=20,volumeType:p="gp3",encrypted:g=!0}=e,h=l({slug:a,environment:r,resourceType:"ec2"}),y=s(h),f={Type:"AWS::EC2::Instance",Properties:{ImageId:i,InstanceType:n,Tags:[{Key:"Name",Value:h},{Key:"Environment",Value:r}]}};if(o)f.Properties.KeyName=o;if(c)f.Properties.SecurityGroupIds=c;if(u)f.Properties.SubnetId=u;if(d)f.Properties.UserData=P.Base64(d);return f.Properties.BlockDeviceMappings=[{DeviceName:"/dev/xvda",Ebs:{VolumeSize:m,VolumeType:p,Encrypted:g,DeleteOnTermination:!0}}],{instance:f,logicalId:y}}static createSecurityGroup(e){let{slug:a,environment:r,vpcId:n,description:i,ingress:o=[],egress:c=[]}=e,u=l({slug:a,environment:r,resourceType:"sg"}),d=s(u),m={Type:"AWS::EC2::SecurityGroup",Properties:{GroupDescription:i||`Security group for ${a} ${r}`,Tags:[{Key:"Name",Value:u},{Key:"Environment",Value:r}]}};if(n)m.Properties.VpcId=n;if(o.length>0)m.Properties.SecurityGroupIngress=o.map((p)=>({IpProtocol:p.protocol,FromPort:p.fromPort,ToPort:p.toPort,CidrIp:p.cidr,SourceSecurityGroupId:p.sourceSecurityGroupId}));if(c.length>0)m.Properties.SecurityGroupEgress=c.map((p)=>({IpProtocol:p.protocol,FromPort:p.fromPort,ToPort:p.toPort,CidrIp:p.cidr,DestinationSecurityGroupId:p.sourceSecurityGroupId}));return{securityGroup:m,logicalId:d}}static createWebServerSecurityGroup(e,a,r){return S.createSecurityGroup({slug:e,environment:a,vpcId:r,description:"Security group for web servers - HTTP, HTTPS, SSH",ingress:[{protocol:"tcp",fromPort:80,toPort:80,cidr:"0.0.0.0/0"},{protocol:"tcp",fromPort:443,toPort:443,cidr:"0.0.0.0/0"},{protocol:"tcp",fromPort:22,toPort:22,cidr:"0.0.0.0/0"}],egress:[{protocol:"-1",fromPort:0,toPort:0,cidr:"0.0.0.0/0"}]})}static createLoadBalancer(e){let{slug:a,environment:r,scheme:n="internet-facing",subnets:i,securityGroups:o,type:c="application"}=e,u=l({slug:a,environment:r,resourceType:"alb"}),d=s(u),m={Type:"AWS::ElasticLoadBalancingV2::LoadBalancer",Properties:{Name:u,Scheme:n,Type:c,Subnets:i,Tags:[{Key:"Name",Value:u},{Key:"Environment",Value:r}]}};if(o)m.Properties.SecurityGroups=o;return{loadBalancer:m,logicalId:d}}static createTargetGroup(e){let{slug:a,environment:r,port:n,protocol:i="HTTP",vpcId:o,targetType:c="ip",healthCheckPath:u="/",healthCheckInterval:d=30,healthCheckTimeout:m=5,healthyThreshold:p=2,unhealthyThreshold:g=3}=e,h=l({slug:a,environment:r,resourceType:"tg"}),y=s(h);return{targetGroup:{Type:"AWS::ElasticLoadBalancingV2::TargetGroup",Properties:{Name:h,Port:n,Protocol:i,VpcId:o,TargetType:c,HealthCheckEnabled:!0,HealthCheckProtocol:i,HealthCheckPath:u,HealthCheckIntervalSeconds:d,HealthCheckTimeoutSeconds:m,HealthyThresholdCount:p,UnhealthyThresholdCount:g,Tags:[{Key:"Name",Value:h},{Key:"Environment",Value:r}]}},logicalId:y}}static createListener(e,a){let{port:r,protocol:n="HTTP",certificateArn:i,defaultTargetGroupArn:o}=a,c=s(`listener-${e}-${r}`),u={Type:"AWS::ElasticLoadBalancingV2::Listener",Properties:{LoadBalancerArn:P.Ref(e),Port:r,Protocol:n,DefaultActions:[{Type:"forward",TargetGroupArn:o}]}};if(n==="HTTPS"&&i)u.Properties.Certificates=[{CertificateArn:i}],u.Properties.SslPolicy="ELBSecurityPolicy-TLS13-1-2-2021-06";return{listener:u,logicalId:c}}static createEcsCluster(e,a){let r=l({slug:e,environment:a,resourceType:"ecs-cluster"}),n=s(r);return{cluster:{Type:"AWS::ECS::Cluster",Properties:{ClusterName:r,Tags:[{Key:"Name",Value:r},{Key:"Environment",Value:a}]}},logicalId:n}}static createFargateService(e){let{slug:a,environment:r,image:n,cpu:i="256",memory:o="512",desiredCount:c=1,containerPort:u=8080,environmentVariables:d={},secrets:m=[],healthCheck:p,logGroup:g,subnets:h,securityGroups:y,targetGroupArn:f}=e,{cluster:b,logicalId:T}=S.createEcsCluster(a,r),w=l({slug:a,environment:r,resourceType:"fargate"}),I=s(`${w}-execution-role`),v={Type:"AWS::IAM::Role",Properties:{AssumeRolePolicyDocument:{Version:"2012-10-17",Statement:[{Effect:"Allow",Principal:{Service:"ecs-tasks.amazonaws.com"},Action:"sts:AssumeRole"}]},ManagedPolicyArns:["arn:aws:iam::aws:policy/service-role/AmazonECSTaskExecutionRolePolicy"]}},N=s(`${w}-task-role`),R={Type:"AWS::IAM::Role",Properties:{AssumeRolePolicyDocument:{Version:"2012-10-17",Statement:[{Effect:"Allow",Principal:{Service:"ecs-tasks.amazonaws.com"},Action:"sts:AssumeRole"}]}}},k=s(`${w}-task`),x={Type:"AWS::ECS::TaskDefinition",Properties:{Family:w,TaskRoleArn:P.GetAtt(N,"Arn"),ExecutionRoleArn:P.GetAtt(I,"Arn"),NetworkMode:"awsvpc",RequiresCompatibilities:["FARGATE"],Cpu:i,Memory:o,ContainerDefinitions:[{Name:a,Image:n,Essential:!0,PortMappings:[{ContainerPort:u,Protocol:"tcp"}],Environment:Object.entries(d).map(([_,U])=>({Name:_,Value:U})),Secrets:m.map((_)=>({Name:_.name,ValueFrom:_.valueFrom}))}],Tags:[{Key:"Name",Value:w},{Key:"Environment",Value:r}]}};if(p)x.Properties.ContainerDefinitions[0].HealthCheck={Command:p.command,Interval:p.interval||30,Timeout:p.timeout||5,Retries:p.retries||3,StartPeriod:60};if(g)x.Properties.ContainerDefinitions[0].LogConfiguration={LogDriver:"awslogs",Options:{"awslogs-group":g,"awslogs-region":P.Ref("AWS::Region"),"awslogs-stream-prefix":a}};let L=s(`${w}-service`),B={Type:"AWS::ECS::Service",Properties:{ServiceName:w,Cluster:P.Ref(T),TaskDefinition:P.Ref(k),DesiredCount:c,LaunchType:"FARGATE",NetworkConfiguration:{AwsvpcConfiguration:{Subnets:h,SecurityGroups:y,AssignPublicIp:"ENABLED"}},Tags:[{Key:"Name",Value:w},{Key:"Environment",Value:r}]}};if(f)B.Properties.LoadBalancers=[{TargetGroupArn:f,ContainerName:a,ContainerPort:u}];return{cluster:b,taskDefinition:x,service:B,taskRole:R,executionRole:v,clusterLogicalId:T,taskDefinitionLogicalId:k,serviceLogicalId:L,taskRoleLogicalId:N,executionRoleLogicalId:I}}static createLambdaFunction(e){let{slug:a,environment:r,runtime:n,handler:i,code:o,timeout:c=30,memorySize:u=128,environmentVariables:d={},vpcConfig:m}=e,p=l({slug:a,environment:r,resourceType:"lambda"}),g=s(p),h=s(`${p}-role`),y={Type:"AWS::IAM::Role",Properties:{AssumeRolePolicyDocument:{Version:"2012-10-17",Statement:[{Effect:"Allow",Principal:{Service:"lambda.amazonaws.com"},Action:"sts:AssumeRole"}]},ManagedPolicyArns:["arn:aws:iam::aws:policy/service-role/AWSLambdaBasicExecutionRole"]}};if(m)y.Properties.ManagedPolicyArns.push("arn:aws:iam::aws:policy/service-role/AWSLambdaVPCAccessExecutionRole");let f={Type:"AWS::Lambda::Function",Properties:{FunctionName:p,Runtime:n,Role:P.GetAtt(h,"Arn"),Handler:i,Code:{...o.s3Bucket&&{S3Bucket:o.s3Bucket},...o.s3Key&&{S3Key:o.s3Key},...o.zipFile&&{ZipFile:o.zipFile}},Timeout:c,MemorySize:u,Tags:[{Key:"Name",Value:p},{Key:"Environment",Value:r}]}};if(Object.keys(d).length>0)f.Properties.Environment={Variables:d};if(m)f.Properties.VpcConfig={SecurityGroupIds:m.securityGroupIds,SubnetIds:m.subnetIds};return{lambdaFunction:f,role:y,logicalId:g,roleLogicalId:h}}static generateNodeServerUserData(e={}){let{nodeVersion:a="20",appRepo:r,environment:n={}}=e,i=Object.entries(n).map(([o,c])=>`echo "export ${o}='${c}'" >> /etc/environment`).join(`
 `);return`#!/bin/bash
 # Update system
 yum update -y
@@ -604,7 +604,7 @@ ufw default allow outgoing
 ${e.map((a)=>`ufw allow ${a}`).join(`
 `)}
 ufw --force enable
-`},Presets:{bunWithNginx:(e,a=3000)=>S.UserData.generateAppServerScript({runtime:"bun",webServer:"nginx",processManager:"systemd",domain:e,appPort:a,enableSsl:!0}),bunWithCaddy:(e,a=3000)=>S.UserData.generateAppServerScript({runtime:"bun",webServer:"caddy",processManager:"systemd",domain:e,appPort:a,enableSsl:!1}),nodeWithPm2:(e,a=3000)=>S.UserData.generateAppServerScript({runtime:"node",webServer:"nginx",processManager:"pm2",domain:e,appPort:a,enableSsl:!0}),worker:(e="bun")=>S.UserData.generateAppServerScript({runtime:e,webServer:"none",processManager:"systemd",enableSsl:!1})}};static createElasticIp(e){let{slug:a,environment:r,domain:n,instanceLogicalId:i}=e,o=l({slug:a,environment:r,resourceType:"eip"}),c=s(o),u={Type:"AWS::EC2::EIP",Properties:{Domain:"vpc",Tags:[{Key:"Name",Value:o},{Key:"Environment",Value:r},...n?[{Key:"Domain",Value:n}]:[]]}},d={[c]:u},m,p;if(i)p=s(`${o}-assoc`),m={Type:"AWS::EC2::EIPAssociation",Properties:{AllocationId:P.GetAtt(c,"AllocationId"),InstanceId:P.Ref(i)}},d[p]=m;return{eip:u,eipAssociation:m,eipLogicalId:c,associationLogicalId:p,resources:d}}static createServerModeStack(e){let{slug:a,environment:r,vpcId:n,subnetId:i,instanceType:o="t3.small",imageId:c="ami-0f3caa1cf4417e51b",keyName:u,domain:d,userData:m,allowedPorts:p=[22,80,443],volumeSize:g=20,volumeType:h="gp3"}=e,y={},f=l({slug:a,environment:r,resourceType:"server-sg"}),b=s(f),T={Type:"AWS::EC2::SecurityGroup",Properties:{GroupName:f,GroupDescription:`Security group for ${a} server`,VpcId:n,SecurityGroupIngress:p.map((j)=>({IpProtocol:"tcp",FromPort:j,ToPort:j,CidrIp:"0.0.0.0/0",Description:`Port ${j}`})),SecurityGroupEgress:[{IpProtocol:"-1",CidrIp:"0.0.0.0/0",Description:"Allow all outbound"}],Tags:[{Key:"Name",Value:f},{Key:"Environment",Value:r}]}};y[b]=T;let w=l({slug:a,environment:r,resourceType:"server-role"}),I=s(w),v={Type:"AWS::IAM::Role",Properties:{RoleName:w,AssumeRolePolicyDocument:{Version:"2012-10-17",Statement:[{Effect:"Allow",Principal:{Service:"ec2.amazonaws.com"},Action:"sts:AssumeRole"}]},ManagedPolicyArns:["arn:aws:iam::aws:policy/AmazonSSMManagedInstanceCore","arn:aws:iam::aws:policy/CloudWatchAgentServerPolicy"],Policies:[{PolicyName:"StacksServerPermissions",PolicyDocument:{Version:"2012-10-17",Statement:[{Effect:"Allow",Action:["ses:SendEmail","ses:SendRawEmail","ses:SendBulkEmail","ses:VerifyDomainIdentity","ses:VerifyDomainDkim","ses:GetIdentityDkimAttributes","ses:GetIdentityVerificationAttributes"],Resource:"*"},{Effect:"Allow",Action:["s3:GetObject","s3:PutObject","s3:ListBucket"],Resource:"*"},{Effect:"Allow",Action:["route53:ChangeResourceRecordSets","route53:ListResourceRecordSets","route53:GetHostedZone"],Resource:"*"},{Effect:"Allow",Action:["ssm:GetParameter","ssm:GetParameters"],Resource:"*"}]}}]}};y[I]=v;let N=l({slug:a,environment:r,resourceType:"server-profile"}),R=s(N),k={Type:"AWS::IAM::InstanceProfile",Properties:{InstanceProfileName:N,Roles:[P.Ref(I)]}};y[R]=k;let x=l({slug:a,environment:r,resourceType:"server"}),L=s(x),_={Type:"AWS::EC2::Instance",DependsOn:[R],Properties:{ImageId:c,InstanceType:o,KeyName:u,SubnetId:i,SecurityGroupIds:[P.Ref(b)],IamInstanceProfile:P.Ref(R),BlockDeviceMappings:[{DeviceName:"/dev/xvda",Ebs:{VolumeSize:g,VolumeType:h,Encrypted:!0,DeleteOnTermination:!0}}],Tags:[{Key:"Name",Value:x},{Key:"Environment",Value:r},...d?[{Key:"Domain",Value:d}]:[]]}};if(m)_.Properties.UserData=P.Base64(m);y[L]=_;let{eip:W,eipAssociation:V,eipLogicalId:Z,associationLogicalId:q,resources:Q}=S.createElasticIp({slug:a,environment:r,domain:d,instanceLogicalId:L});return Object.assign(y,Q),{instance:_,securityGroup:T,eip:W,eipAssociation:V,instanceRole:v,instanceProfile:k,resources:y,outputs:{instanceLogicalId:L,securityGroupLogicalId:b,eipLogicalId:Z,associationLogicalId:q,roleLogicalId:I,profileLogicalId:R}}}static ServerMode={webServer:(e)=>{let a=S.UserData.generateAppServerScript({runtime:e.runtime||"bun",webServer:e.webServer||"nginx",domain:e.domain,enableSsl:!0});return S.createServerModeStack({...e,userData:a,instanceType:"t3.small",allowedPorts:[22,80,443]})},workerServer:(e)=>{let a=S.UserData.generateAppServerScript({runtime:e.runtime||"bun",webServer:"none",installRedis:e.installRedis});return S.createServerModeStack({...e,userData:a,instanceType:"t3.medium",allowedPorts:[22]})},cacheServer:(e)=>S.createServerModeStack({...e,userData:`#!/bin/bash
+`},Presets:{bunWithNginx:(e,a=3000)=>S.UserData.generateAppServerScript({runtime:"bun",webServer:"nginx",processManager:"systemd",domain:e,appPort:a,enableSsl:!0}),bunWithCaddy:(e,a=3000)=>S.UserData.generateAppServerScript({runtime:"bun",webServer:"caddy",processManager:"systemd",domain:e,appPort:a,enableSsl:!1}),nodeWithPm2:(e,a=3000)=>S.UserData.generateAppServerScript({runtime:"node",webServer:"nginx",processManager:"pm2",domain:e,appPort:a,enableSsl:!0}),worker:(e="bun")=>S.UserData.generateAppServerScript({runtime:e,webServer:"none",processManager:"systemd",enableSsl:!1})}};static createElasticIp(e){let{slug:a,environment:r,domain:n,instanceLogicalId:i}=e,o=l({slug:a,environment:r,resourceType:"eip"}),c=s(o),u={Type:"AWS::EC2::EIP",Properties:{Domain:"vpc",Tags:[{Key:"Name",Value:o},{Key:"Environment",Value:r},...n?[{Key:"Domain",Value:n}]:[]]}},d={[c]:u},m,p;if(i)p=s(`${o}-assoc`),m={Type:"AWS::EC2::EIPAssociation",Properties:{AllocationId:P.GetAtt(c,"AllocationId"),InstanceId:P.Ref(i)}},d[p]=m;return{eip:u,eipAssociation:m,eipLogicalId:c,associationLogicalId:p,resources:d}}static createServerModeStack(e){let{slug:a,environment:r,vpcId:n,subnetId:i,instanceType:o="t3.small",imageId:c="ami-0f3caa1cf4417e51b",keyName:u,domain:d,userData:m,allowedPorts:p=[22,80,443],volumeSize:g=20,volumeType:h="gp3"}=e,y={},f=l({slug:a,environment:r,resourceType:"server-sg"}),b=s(f),T={Type:"AWS::EC2::SecurityGroup",Properties:{GroupName:f,GroupDescription:`Security group for ${a} server`,VpcId:n,SecurityGroupIngress:p.map((V)=>({IpProtocol:"tcp",FromPort:V,ToPort:V,CidrIp:"0.0.0.0/0",Description:`Port ${V}`})),SecurityGroupEgress:[{IpProtocol:"-1",CidrIp:"0.0.0.0/0",Description:"Allow all outbound"}],Tags:[{Key:"Name",Value:f},{Key:"Environment",Value:r}]}};y[b]=T;let w=l({slug:a,environment:r,resourceType:"server-role"}),I=s(w),v={Type:"AWS::IAM::Role",Properties:{RoleName:w,AssumeRolePolicyDocument:{Version:"2012-10-17",Statement:[{Effect:"Allow",Principal:{Service:"ec2.amazonaws.com"},Action:"sts:AssumeRole"}]},ManagedPolicyArns:["arn:aws:iam::aws:policy/AmazonSSMManagedInstanceCore","arn:aws:iam::aws:policy/CloudWatchAgentServerPolicy"],Policies:[{PolicyName:"StacksServerPermissions",PolicyDocument:{Version:"2012-10-17",Statement:[{Effect:"Allow",Action:["ses:SendEmail","ses:SendRawEmail","ses:SendBulkEmail","ses:VerifyDomainIdentity","ses:VerifyDomainDkim","ses:GetIdentityDkimAttributes","ses:GetIdentityVerificationAttributes"],Resource:"*"},{Effect:"Allow",Action:["s3:GetObject","s3:PutObject","s3:ListBucket"],Resource:"*"},{Effect:"Allow",Action:["route53:ChangeResourceRecordSets","route53:ListResourceRecordSets","route53:GetHostedZone"],Resource:"*"},{Effect:"Allow",Action:["ssm:GetParameter","ssm:GetParameters"],Resource:"*"}]}}]}};y[I]=v;let N=l({slug:a,environment:r,resourceType:"server-profile"}),R=s(N),k={Type:"AWS::IAM::InstanceProfile",Properties:{InstanceProfileName:N,Roles:[P.Ref(I)]}};y[R]=k;let x=l({slug:a,environment:r,resourceType:"server"}),L=s(x),B={Type:"AWS::EC2::Instance",DependsOn:[R],Properties:{ImageId:c,InstanceType:o,KeyName:u,SubnetId:i,SecurityGroupIds:[P.Ref(b)],IamInstanceProfile:P.Ref(R),BlockDeviceMappings:[{DeviceName:"/dev/xvda",Ebs:{VolumeSize:g,VolumeType:h,Encrypted:!0,DeleteOnTermination:!0}}],Tags:[{Key:"Name",Value:x},{Key:"Environment",Value:r},...d?[{Key:"Domain",Value:d}]:[]]}};if(m)B.Properties.UserData=P.Base64(m);y[L]=B;let{eip:_,eipAssociation:U,eipLogicalId:Y,associationLogicalId:q,resources:Q}=S.createElasticIp({slug:a,environment:r,domain:d,instanceLogicalId:L});return Object.assign(y,Q),{instance:B,securityGroup:T,eip:_,eipAssociation:U,instanceRole:v,instanceProfile:k,resources:y,outputs:{instanceLogicalId:L,securityGroupLogicalId:b,eipLogicalId:Y,associationLogicalId:q,roleLogicalId:I,profileLogicalId:R}}}static ServerMode={webServer:(e)=>{let a=S.UserData.generateAppServerScript({runtime:e.runtime||"bun",webServer:e.webServer||"nginx",domain:e.domain,enableSsl:!0});return S.createServerModeStack({...e,userData:a,instanceType:"t3.small",allowedPorts:[22,80,443]})},workerServer:(e)=>{let a=S.UserData.generateAppServerScript({runtime:e.runtime||"bun",webServer:"none",installRedis:e.installRedis});return S.createServerModeStack({...e,userData:a,instanceType:"t3.medium",allowedPorts:[22]})},cacheServer:(e)=>S.createServerModeStack({...e,userData:`#!/bin/bash
 set -e
 apt-get update && apt-get upgrade -y
 apt-get install -y redis-server
@@ -612,7 +612,7 @@ sed -i 's/bind 127.0.0.1/bind 0.0.0.0/' /etc/redis/redis.conf
 systemctl enable redis-server
 systemctl restart redis-server
 echo "Redis server setup complete!"
-`,instanceType:"t3.medium",allowedPorts:[22,6379]})}}class O{static createVpc(e){let{slug:a,environment:r,cidr:n="10.0.0.0/16",enableDnsHostnames:i=!0,enableDnsSupport:o=!0}=e,c=l({slug:a,environment:r,resourceType:"vpc"}),u=s(c);return{vpc:{Type:"AWS::EC2::VPC",Properties:{CidrBlock:n,EnableDnsHostnames:i,EnableDnsSupport:o,Tags:[{Key:"Name",Value:c},{Key:"Environment",Value:r}]}},logicalId:u}}static createSubnet(e){let{slug:a,environment:r,vpcId:n,type:i,cidr:o,availabilityZone:c,mapPublicIp:u=i==="public"}=e,d=l({slug:a,environment:r,resourceType:`subnet-${i}`}),m=s(`${d}-${c}`);return{subnet:{Type:"AWS::EC2::Subnet",Properties:{VpcId:n,CidrBlock:o,AvailabilityZone:c,MapPublicIpOnLaunch:u,Tags:[{Key:"Name",Value:`${d}-${c}`},{Key:"Environment",Value:r},{Key:"Type",Value:i}]}},logicalId:m}}static createInternetGateway(e,a){let r=l({slug:e,environment:a,resourceType:"igw"}),n=s(r);return{internetGateway:{Type:"AWS::EC2::InternetGateway",Properties:{Tags:[{Key:"Name",Value:r},{Key:"Environment",Value:a}]}},logicalId:n}}static attachInternetGateway(e,a){let r=s(`${e}-igw-attachment`);return{attachment:{Type:"AWS::EC2::VPCGatewayAttachment",Properties:{VpcId:P.Ref(e),InternetGatewayId:P.Ref(a)}},logicalId:r}}static createEip(e,a){let r=l({slug:e,environment:a,resourceType:"eip"}),n=s(r);return{eip:{Type:"AWS::EC2::EIP",Properties:{Domain:"vpc",Tags:[{Key:"Name",Value:r},{Key:"Environment",Value:a}]}},logicalId:n}}static createNatGateway(e,a){let{slug:r,environment:n,subnetId:i}=e,o=l({slug:r,environment:n,resourceType:"nat"}),c=s(o);return{natGateway:{Type:"AWS::EC2::NatGateway",Properties:{AllocationId:P.GetAtt(a,"AllocationId"),SubnetId:i,Tags:[{Key:"Name",Value:o},{Key:"Environment",Value:n},{Key:"Warning",Value:"NAT Gateway incurs hourly charges"}]}},logicalId:c}}static createRouteTable(e,a,r,n){let i=l({slug:e,environment:a,resourceType:`rt-${n}`}),o=s(i);return{routeTable:{Type:"AWS::EC2::RouteTable",Properties:{VpcId:P.Ref(r),Tags:[{Key:"Name",Value:i},{Key:"Environment",Value:a},{Key:"Type",Value:n}]}},logicalId:o}}static createRoute(e,a,r){let n=s(`${e}-route-${r.type}`),i={Type:"AWS::EC2::Route",Properties:{RouteTableId:P.Ref(e),DestinationCidrBlock:a}};if(r.type==="igw")i.Properties.GatewayId=P.Ref(r.logicalId);else if(r.type==="nat")i.Properties.NatGatewayId=P.Ref(r.logicalId);else if(r.type==="instance")i.Properties.InstanceId=P.Ref(r.logicalId);return{route:i,logicalId:n}}static associateSubnetWithRouteTable(e,a){let r=s(`${e}-rt-assoc`);return{association:{Type:"AWS::EC2::SubnetRouteTableAssociation",Properties:{SubnetId:P.Ref(e),RouteTableId:P.Ref(a)}},logicalId:r}}static enableFlowLogs(e){let{slug:a,environment:r,resourceId:n,resourceType:i,trafficType:o="ALL",logGroupName:c}=e,u=l({slug:a,environment:r,resourceType:"flowlog"}),d=s(u);return{flowLog:{Type:"AWS::EC2::FlowLog",Properties:{ResourceType:i,ResourceIds:[n],TrafficType:o,LogDestinationType:"cloud-watch-logs",LogGroupName:c||`/aws/vpc/${a}-${r}`,Tags:[{Key:"Name",Value:u},{Key:"Environment",Value:r}]}},logicalId:d}}static calculateSubnetCidrs(e,a,r=3){let[n,i]=e.split("/"),o=Number.parseInt(i,10),c=Math.ceil(Math.log2(a*r)),u=o+c;if(u>28)throw Error("VPC CIDR is too small to accommodate requested subnets");let[d,m,p,g]=n.split(".").map(Number),h=(d<<24)+(m<<16)+(p<<8)+g,y=2**(32-u),f=[];for(let b=0;b<a*r;b++){let T=h+b*y,w=[T>>>24&255,T>>>16&255,T>>>8&255,T&255].join(".");f.push(`${w}/${u}`)}return f}static getAvailabilityZones(e,a){return["a","b","c","d","e","f"].slice(0,a).map((r)=>`${e}${r}`)}static createMultiAzNetwork(e){let{slug:a,environment:r,region:n,cidr:i="10.0.0.0/16",zones:o=3,enableNatGateway:c=!1,singleNatGateway:u=!1,enableFlowLogs:d=!1}=e,m={},p=[],g=[],h=[],{vpc:y,logicalId:f}=O.createVpc({slug:a,environment:r,cidr:i});m[f]=y;let{internetGateway:b,logicalId:T}=O.createInternetGateway(a,r);m[T]=b;let{attachment:w,logicalId:I}=O.attachInternetGateway(f,T);m[I]=w;let{routeTable:v,logicalId:N}=O.createRouteTable(a,r,f,"public");m[N]=v;let{route:R,logicalId:k}=O.createRoute(N,"0.0.0.0/0",{type:"igw",logicalId:T});R.DependsOn=I,m[k]=R;let x=O.calculateSubnetCidrs(i,o,2),L=O.getAvailabilityZones(n,o),_=[];for(let W=0;W<o;W++){let V=L[W],Z=x[W*2],q=x[W*2+1],{subnet:Q,logicalId:j}=O.createSubnet({slug:a,environment:r,vpcId:P.Ref(f),type:"public",cidr:Z,availabilityZone:V});m[j]=Q,p.push(j);let{association:me,logicalId:Me}=O.associateSubnetWithRouteTable(j,N);m[Me]=me;let{subnet:vt,logicalId:X}=O.createSubnet({slug:a,environment:r,vpcId:P.Ref(f),type:"private",cidr:q,availabilityZone:V});if(m[X]=vt,g.push(X),c&&(!u||W===0)){let{eip:Y,logicalId:ee}=O.createEip(`${a}-${V}`,r);m[ee]=Y;let{natGateway:pe,logicalId:te}=O.createNatGateway({slug:`${a}-${V}`,environment:r,subnetId:P.Ref(j)},ee);pe.DependsOn=I,m[te]=pe,h.push(te);let{routeTable:oe,logicalId:Se}=O.createRouteTable(`${a}-${V}`,r,f,"private");m[Se]=oe,_.push(Se);let{route:Oe,logicalId:M}=O.createRoute(Se,"0.0.0.0/0",{type:"nat",logicalId:te});m[M]=Oe;let{association:U,logicalId:G}=O.associateSubnetWithRouteTable(X,Se);m[G]=U}else if(c&&u&&W>0){let{association:Y,logicalId:ee}=O.associateSubnetWithRouteTable(X,_[0]);m[ee]=Y}else{let{routeTable:Y,logicalId:ee}=O.createRouteTable(`${a}-${V}-isolated`,r,f,"private");m[ee]=Y;let{association:pe,logicalId:te}=O.associateSubnetWithRouteTable(X,ee);m[te]=pe}}if(d){let{flowLog:W,logicalId:V}=O.enableFlowLogs({slug:a,environment:r,resourceId:P.Ref(f),resourceType:"VPC"});m[V]=W}return{resources:m,outputs:{vpcId:f,publicSubnetIds:p,privateSubnetIds:g,natGatewayIds:h.length>0?h:void 0}}}static NatGatewayCostWarning=`
+`,instanceType:"t3.medium",allowedPorts:[22,6379]})}}class O{static createVpc(e){let{slug:a,environment:r,cidr:n="10.0.0.0/16",enableDnsHostnames:i=!0,enableDnsSupport:o=!0}=e,c=l({slug:a,environment:r,resourceType:"vpc"}),u=s(c);return{vpc:{Type:"AWS::EC2::VPC",Properties:{CidrBlock:n,EnableDnsHostnames:i,EnableDnsSupport:o,Tags:[{Key:"Name",Value:c},{Key:"Environment",Value:r}]}},logicalId:u}}static createSubnet(e){let{slug:a,environment:r,vpcId:n,type:i,cidr:o,availabilityZone:c,mapPublicIp:u=i==="public"}=e,d=l({slug:a,environment:r,resourceType:`subnet-${i}`}),m=s(`${d}-${c}`);return{subnet:{Type:"AWS::EC2::Subnet",Properties:{VpcId:n,CidrBlock:o,AvailabilityZone:c,MapPublicIpOnLaunch:u,Tags:[{Key:"Name",Value:`${d}-${c}`},{Key:"Environment",Value:r},{Key:"Type",Value:i}]}},logicalId:m}}static createInternetGateway(e,a){let r=l({slug:e,environment:a,resourceType:"igw"}),n=s(r);return{internetGateway:{Type:"AWS::EC2::InternetGateway",Properties:{Tags:[{Key:"Name",Value:r},{Key:"Environment",Value:a}]}},logicalId:n}}static attachInternetGateway(e,a){let r=s(`${e}-igw-attachment`);return{attachment:{Type:"AWS::EC2::VPCGatewayAttachment",Properties:{VpcId:P.Ref(e),InternetGatewayId:P.Ref(a)}},logicalId:r}}static createEip(e,a){let r=l({slug:e,environment:a,resourceType:"eip"}),n=s(r);return{eip:{Type:"AWS::EC2::EIP",Properties:{Domain:"vpc",Tags:[{Key:"Name",Value:r},{Key:"Environment",Value:a}]}},logicalId:n}}static createNatGateway(e,a){let{slug:r,environment:n,subnetId:i}=e,o=l({slug:r,environment:n,resourceType:"nat"}),c=s(o);return{natGateway:{Type:"AWS::EC2::NatGateway",Properties:{AllocationId:P.GetAtt(a,"AllocationId"),SubnetId:i,Tags:[{Key:"Name",Value:o},{Key:"Environment",Value:n},{Key:"Warning",Value:"NAT Gateway incurs hourly charges"}]}},logicalId:c}}static createRouteTable(e,a,r,n){let i=l({slug:e,environment:a,resourceType:`rt-${n}`}),o=s(i);return{routeTable:{Type:"AWS::EC2::RouteTable",Properties:{VpcId:P.Ref(r),Tags:[{Key:"Name",Value:i},{Key:"Environment",Value:a},{Key:"Type",Value:n}]}},logicalId:o}}static createRoute(e,a,r){let n=s(`${e}-route-${r.type}`),i={Type:"AWS::EC2::Route",Properties:{RouteTableId:P.Ref(e),DestinationCidrBlock:a}};if(r.type==="igw")i.Properties.GatewayId=P.Ref(r.logicalId);else if(r.type==="nat")i.Properties.NatGatewayId=P.Ref(r.logicalId);else if(r.type==="instance")i.Properties.InstanceId=P.Ref(r.logicalId);return{route:i,logicalId:n}}static associateSubnetWithRouteTable(e,a){let r=s(`${e}-rt-assoc`);return{association:{Type:"AWS::EC2::SubnetRouteTableAssociation",Properties:{SubnetId:P.Ref(e),RouteTableId:P.Ref(a)}},logicalId:r}}static enableFlowLogs(e){let{slug:a,environment:r,resourceId:n,resourceType:i,trafficType:o="ALL",logGroupName:c}=e,u=l({slug:a,environment:r,resourceType:"flowlog"}),d=s(u);return{flowLog:{Type:"AWS::EC2::FlowLog",Properties:{ResourceType:i,ResourceIds:[n],TrafficType:o,LogDestinationType:"cloud-watch-logs",LogGroupName:c||`/aws/vpc/${a}-${r}`,Tags:[{Key:"Name",Value:u},{Key:"Environment",Value:r}]}},logicalId:d}}static calculateSubnetCidrs(e,a,r=3){let[n,i]=e.split("/"),o=Number.parseInt(i,10),c=Math.ceil(Math.log2(a*r)),u=o+c;if(u>28)throw Error("VPC CIDR is too small to accommodate requested subnets");let[d,m,p,g]=n.split(".").map(Number),h=(d<<24)+(m<<16)+(p<<8)+g,y=2**(32-u),f=[];for(let b=0;b<a*r;b++){let T=h+b*y,w=[T>>>24&255,T>>>16&255,T>>>8&255,T&255].join(".");f.push(`${w}/${u}`)}return f}static getAvailabilityZones(e,a){return["a","b","c","d","e","f"].slice(0,a).map((r)=>`${e}${r}`)}static createMultiAzNetwork(e){let{slug:a,environment:r,region:n,cidr:i="10.0.0.0/16",zones:o=3,enableNatGateway:c=!1,singleNatGateway:u=!1,enableFlowLogs:d=!1}=e,m={},p=[],g=[],h=[],{vpc:y,logicalId:f}=O.createVpc({slug:a,environment:r,cidr:i});m[f]=y;let{internetGateway:b,logicalId:T}=O.createInternetGateway(a,r);m[T]=b;let{attachment:w,logicalId:I}=O.attachInternetGateway(f,T);m[I]=w;let{routeTable:v,logicalId:N}=O.createRouteTable(a,r,f,"public");m[N]=v;let{route:R,logicalId:k}=O.createRoute(N,"0.0.0.0/0",{type:"igw",logicalId:T});R.DependsOn=I,m[k]=R;let x=O.calculateSubnetCidrs(i,o,2),L=O.getAvailabilityZones(n,o),B=[];for(let _=0;_<o;_++){let U=L[_],Y=x[_*2],q=x[_*2+1],{subnet:Q,logicalId:V}=O.createSubnet({slug:a,environment:r,vpcId:P.Ref(f),type:"public",cidr:Y,availabilityZone:U});m[V]=Q,p.push(V);let{association:me,logicalId:Me}=O.associateSubnetWithRouteTable(V,N);m[Me]=me;let{subnet:vt,logicalId:Z}=O.createSubnet({slug:a,environment:r,vpcId:P.Ref(f),type:"private",cidr:q,availabilityZone:U});if(m[Z]=vt,g.push(Z),c&&(!u||_===0)){let{eip:J,logicalId:ee}=O.createEip(`${a}-${U}`,r);m[ee]=J;let{natGateway:pe,logicalId:te}=O.createNatGateway({slug:`${a}-${U}`,environment:r,subnetId:P.Ref(V)},ee);pe.DependsOn=I,m[te]=pe,h.push(te);let{routeTable:oe,logicalId:Se}=O.createRouteTable(`${a}-${U}`,r,f,"private");m[Se]=oe,B.push(Se);let{route:Oe,logicalId:M}=O.createRoute(Se,"0.0.0.0/0",{type:"nat",logicalId:te});m[M]=Oe;let{association:G,logicalId:W}=O.associateSubnetWithRouteTable(Z,Se);m[W]=G}else if(c&&u&&_>0){let{association:J,logicalId:ee}=O.associateSubnetWithRouteTable(Z,B[0]);m[ee]=J}else{let{routeTable:J,logicalId:ee}=O.createRouteTable(`${a}-${U}-isolated`,r,f,"private");m[ee]=J;let{association:pe,logicalId:te}=O.associateSubnetWithRouteTable(Z,ee);m[te]=pe}}if(d){let{flowLog:_,logicalId:U}=O.enableFlowLogs({slug:a,environment:r,resourceId:P.Ref(f),resourceType:"VPC"});m[U]=_}return{resources:m,outputs:{vpcId:f,publicSubnetIds:p,privateSubnetIds:g,natGatewayIds:h.length>0?h:void 0}}}static NatGatewayCostWarning=`
 ⚠️ NAT Gateway Cost Warning:
 - Each NAT Gateway costs approximately $32-45/month (hourly charges)
 - Data processing charges: $0.045/GB processed
@@ -2306,14 +2306,14 @@ function resolveTemplate(template, data) {
   }
   return result;
 }
-`;class Te{static LambdaCode={send:er,receive:rn,deliveryStatus:tn};static createPinpointApp(e){return{[`${e.slug}PinpointApp`]:{Type:"AWS::Pinpoint::App",Properties:{Name:e.name||`${e.slug}-sms`}}}}static createSmsChannel(e){let a={ApplicationId:e.applicationId,Enabled:e.enabled!==!1};if(e.senderId)a.SenderId=e.senderId;if(e.shortCode)a.ShortCode=e.shortCode;return{[`${e.slug}SmsChannel`]:{Type:"AWS::Pinpoint::SMSChannel",Properties:a}}}static createSmsLambdaRole(e){return{[`${e.slug}SmsLambdaRole`]:{Type:"AWS::IAM::Role",Properties:{RoleName:`${e.slug}-sms-lambda-role`,AssumeRolePolicyDocument:{Version:"2012-10-17",Statement:[{Effect:"Allow",Principal:{Service:"lambda.amazonaws.com"},Action:"sts:AssumeRole"}]},ManagedPolicyArns:["arn:aws:iam::aws:policy/service-role/AWSLambdaBasicExecutionRole"],Policies:[{PolicyName:"SmsLambdaPolicy",PolicyDocument:{Version:"2012-10-17",Statement:[{Effect:"Allow",Action:["mobiletargeting:SendMessages","mobiletargeting:GetSmsChannel"],Resource:"*"},{Effect:"Allow",Action:["sns:Publish"],Resource:"*"},{Effect:"Allow",Action:["dynamodb:PutItem","dynamodb:UpdateItem","dynamodb:GetItem","dynamodb:DeleteItem"],Resource:"*"}]}}]}}}}static createSendLambda(e){return{[`${e.slug}SmsSendLambda`]:{Type:"AWS::Lambda::Function",Properties:{FunctionName:`${e.slug}-sms-send`,Runtime:"nodejs20.x",Handler:"index.handler",Role:e.roleArn,Timeout:30,MemorySize:256,Code:{ZipFile:Te.LambdaCode.send},Environment:{Variables:{PINPOINT_APP_ID:e.pinpointAppId,MESSAGE_LOG_TABLE:e.messageLogTable||"",SMS_SENDER_ID:e.senderId||"",SMS_ORIGINATION_NUMBER:e.originationNumber||""}}}}}}static createReceiveLambda(e){return{[`${e.slug}SmsReceiveLambda`]:{Type:"AWS::Lambda::Function",Properties:{FunctionName:`${e.slug}-sms-receive`,Runtime:"nodejs20.x",Handler:"index.handler",Role:e.roleArn,Timeout:30,MemorySize:256,Code:{ZipFile:Te.LambdaCode.receive},Environment:{Variables:{OPT_OUT_TABLE:e.optOutTable||"",MESSAGE_LOG_TABLE:e.messageLogTable||"",NOTIFICATION_TOPIC_ARN:e.notificationTopicArn||"",WEBHOOK_URL:e.webhookUrl||""}}}}}}static createDeliveryStatusLambda(e){return{[`${e.slug}SmsDeliveryStatusLambda`]:{Type:"AWS::Lambda::Function",Properties:{FunctionName:`${e.slug}-sms-delivery-status`,Runtime:"nodejs20.x",Handler:"index.handler",Role:e.roleArn,Timeout:30,MemorySize:256,Code:{ZipFile:Te.LambdaCode.deliveryStatus},Environment:{Variables:{MESSAGE_LOG_TABLE:e.messageLogTable||"",NOTIFICATION_TOPIC_ARN:e.notificationTopicArn||"",WEBHOOK_URL:e.webhookUrl||""}}}}}}static createMessageLogTable(e){return{[`${e.slug}SmsMessageLogTable`]:{Type:"AWS::DynamoDB::Table",Properties:{TableName:`${e.slug}-sms-messages`,BillingMode:"PAY_PER_REQUEST",AttributeDefinitions:[{AttributeName:"messageId",AttributeType:"S"}],KeySchema:[{AttributeName:"messageId",KeyType:"HASH"}],TimeToLiveSpecification:{AttributeName:"ttl",Enabled:!0}}}}}static createOptOutTable(e){return{[`${e.slug}SmsOptOutTable`]:{Type:"AWS::DynamoDB::Table",Properties:{TableName:`${e.slug}-sms-optouts`,BillingMode:"PAY_PER_REQUEST",AttributeDefinitions:[{AttributeName:"phoneNumber",AttributeType:"S"}],KeySchema:[{AttributeName:"phoneNumber",KeyType:"HASH"}]}}}}static createNotificationTopic(e){return{[`${e.slug}SmsNotificationTopic`]:{Type:"AWS::SNS::Topic",Properties:{TopicName:`${e.slug}-sms-notifications`}}}}static createCompleteSetup(e){let a={},r={};Object.assign(a,Te.createPinpointApp({slug:e.slug})),Object.assign(a,Te.createSmsChannel({slug:e.slug,applicationId:{Ref:`${e.slug}PinpointApp`},senderId:e.senderId})),Object.assign(a,Te.createSmsLambdaRole({slug:e.slug})),Object.assign(a,Te.createMessageLogTable({slug:e.slug})),Object.assign(a,Te.createOptOutTable({slug:e.slug})),Object.assign(a,Te.createNotificationTopic({slug:e.slug}));let n={"Fn::GetAtt":[`${e.slug}SmsLambdaRole`,"Arn"]},i={Ref:`${e.slug}PinpointApp`},o={Ref:`${e.slug}SmsMessageLogTable`},c={Ref:`${e.slug}SmsOptOutTable`},u={Ref:`${e.slug}SmsNotificationTopic`};if(Object.assign(a,Te.createSendLambda({slug:e.slug,roleArn:n,pinpointAppId:i,messageLogTable:o,senderId:e.senderId,originationNumber:e.originationNumber})),e.twoWayEnabled)Object.assign(a,Te.createReceiveLambda({slug:e.slug,roleArn:n,optOutTable:c,messageLogTable:o,notificationTopicArn:u,webhookUrl:e.webhookUrl}));return Object.assign(a,Te.createDeliveryStatusLambda({slug:e.slug,roleArn:n,messageLogTable:o,notificationTopicArn:u,webhookUrl:e.webhookUrl})),r[`${e.slug}PinpointAppId`]={Description:"Pinpoint application ID",Value:{Ref:`${e.slug}PinpointApp`}},r[`${e.slug}SmsSendLambdaArn`]={Description:"SMS send Lambda ARN",Value:{"Fn::GetAtt":[`${e.slug}SmsSendLambda`,"Arn"]}},r[`${e.slug}SmsNotificationTopicArn`]={Description:"SMS notification topic ARN",Value:{Ref:`${e.slug}SmsNotificationTopic`}},r[`${e.slug}SmsMessageLogTableName`]={Description:"SMS message log table name",Value:{Ref:`${e.slug}SmsMessageLogTable`}},{resources:a,outputs:r}}}function It(e){return e.replace(/[^a-zA-Z0-9]/g," ").trim().split(/\s+/).map((a)=>a.charAt(0).toUpperCase()+a.slice(1)).join("")||"User"}function sn(e,a){let r=(e||a).replace(/^\/+|\/+$/g,"");if(!r||r.split("/").includes(".."))throw Error(`sftp: invalid homeDirectory for user ${a}`);return r}function on(e){let a=e.storage;if(a?.type==="efs"){let n="fileSystemId"in a?a.fileSystemId:void 0;if(!n||typeof n==="string"&&!n.trim())throw Error("sftp: EFS storage requires fileSystemId, or a fileSystem name defined in infrastructure.fileSystem");return{type:"efs",fileSystemId:n,posixProfile:a.posixProfile}}let r=(a?.type==="s3"?a.bucket??e.bucket:e.bucket)?.trim();if(!r)throw Error("sftp: S3 storage requires bucket, or a storageBucket name defined in infrastructure.storage");return{type:"s3",bucket:r}}function un(e,a,r){let n=a.posixProfile??r;if(!n)throw Error(`sftp: user ${e} requires a posixProfile (uid/gid) on an EFS-backed server`);for(let i of[n.uid,n.gid,...n.secondaryGids??[]])if(!Number.isInteger(i)||i<0||i>4294967295)throw Error(`sftp: user ${e} has an invalid posixProfile id ${i}`);return{Uid:n.uid,Gid:n.gid,...n.secondaryGids?.length?{SecondaryGids:n.secondaryGids}:{}}}function mn(e,a){return typeof e==="string"?`/${e}/${a}`:{"Fn::Sub":[`/\${FileSystemId}/${a}`,{FileSystemId:e}]}}function pn(e){return typeof e==="string"?{"Fn::Sub":"arn:aws:elasticfilesystem:${AWS::Region}:${AWS::AccountId}:file-system/${FileSystemId}".replace("${FileSystemId}",e)}:{"Fn::Sub":["arn:aws:elasticfilesystem:${AWS::Region}:${AWS::AccountId}:file-system/${FileSystemId}",{FileSystemId:e}]}}class ko{static create(e){let a=on(e),r=a.type==="efs"?"EFS":"S3",n=e.endpointType??"PUBLIC";if(n==="VPC"&&(!e.endpointDetails?.vpcId||!e.endpointDetails.subnetIds.length))throw Error("sftp: VPC endpoints require endpointDetails.vpcId and at least one subnet");let i=`${It(e.slug)}${It(e.environment)}Sftp`,o=`${i}Server`,c={},u;if(e.logging!==!1){let d=`${i}LoggingRole`;c[d]={Type:"AWS::IAM::Role",Properties:{AssumeRolePolicyDocument:{Version:"2012-10-17",Statement:[{Effect:"Allow",Principal:{Service:"transfer.amazonaws.com"},Action:"sts:AssumeRole"}]},Policies:[{PolicyName:"TransferLogging",PolicyDocument:{Version:"2012-10-17",Statement:[{Effect:"Allow",Action:["logs:CreateLogGroup","logs:CreateLogStream","logs:DescribeLogStreams","logs:PutLogEvents"],Resource:"arn:aws:logs:*:*:log-group:/aws/transfer/*"}]}}]}},u={"Fn::GetAtt":[d,"Arn"]}}c[o]={Type:"AWS::Transfer::Server",Properties:{Domain:r,EndpointType:n,IdentityProviderType:"SERVICE_MANAGED",Protocols:["SFTP"],...n==="VPC"?{EndpointDetails:{VpcId:e.endpointDetails.vpcId,SubnetIds:e.endpointDetails.subnetIds,...e.endpointDetails.securityGroupIds?.length?{SecurityGroupIds:e.endpointDetails.securityGroupIds}:{},...e.endpointDetails.addressAllocationIds?.length?{AddressAllocationIds:e.endpointDetails.addressAllocationIds}:{}}}:{},...e.securityPolicyName?{SecurityPolicyName:e.securityPolicyName}:{},...u?{LoggingRole:u}:{},Tags:[{Key:"Project",Value:e.slug},{Key:"Environment",Value:e.environment},{Key:"ManagedBy",Value:"ts-cloud"}]}};for(let[d,m]of Object.entries(e.users)){if(!/^[a-zA-Z0-9_.@-]{3,100}$/.test(d))throw Error(`sftp: invalid username ${d}`);if(!m.sshPublicKeys.length)throw Error(`sftp: user ${d} requires at least one SSH public key`);let p=It(d),g=sn(m.homeDirectory,d),h=`${i}${p}User`,y=m.roleArn;if(!y){let f=`${i}${p}Role`,b;if(a.type==="efs")b=[{Effect:"Allow",Action:["elasticfilesystem:ClientMount","elasticfilesystem:ClientWrite","elasticfilesystem:DescribeMountTargets"],Resource:pn(a.fileSystemId)}];else{let T=`arn:aws:s3:::${a.bucket}`;b=[{Effect:"Allow",Action:["s3:ListBucket","s3:GetBucketLocation"],Resource:T,Condition:{StringLike:{"s3:prefix":[g,`${g}/*`]}}},{Effect:"Allow",Action:["s3:GetObject","s3:PutObject","s3:DeleteObject","s3:GetObjectVersion"],Resource:`${T}/${g}/*`}]}c[f]={Type:"AWS::IAM::Role",Properties:{AssumeRolePolicyDocument:{Version:"2012-10-17",Statement:[{Effect:"Allow",Principal:{Service:"transfer.amazonaws.com"},Action:"sts:AssumeRole"}]},Policies:[{PolicyName:"SftpHomeDirectory",PolicyDocument:{Version:"2012-10-17",Statement:b}}]}},y={"Fn::GetAtt":[f,"Arn"]}}c[h]={Type:"AWS::Transfer::User",DependsOn:[o],Properties:{ServerId:{Ref:o},UserName:d,Role:y,HomeDirectoryType:"PATH",HomeDirectory:a.type==="efs"?mn(a.fileSystemId,g):`/${a.bucket}/${g}`,...a.type==="efs"?{PosixProfile:un(d,m,a.posixProfile)}:{},SshPublicKeys:m.sshPublicKeys}}}return{resources:c,serverLogicalId:o,domain:r}}}class Fe{static createBedrockRole(e,a){let{slug:r,environment:n,name:i,models:o=["*"],allowStreaming:c=!0}=a,u=i||l({slug:r,environment:n,resourceType:"bedrock-role"}),d=s(u),m=["bedrock:InvokeModel"];if(c)m.push("bedrock:InvokeModelWithResponseStream");let p=o.map((g)=>g==="*"?"arn:aws:bedrock:*::foundation-model/*":`arn:aws:bedrock:*::foundation-model/${g}`);return{role:{Type:"AWS::IAM::Role",Properties:{RoleName:u,AssumeRolePolicyDocument:{Version:"2012-10-17",Statement:[{Effect:"Allow",Principal:{Service:e},Action:"sts:AssumeRole"}]},Policies:[{PolicyName:`${u}-policy`,PolicyDocument:{Version:"2012-10-17",Statement:[{Effect:"Allow",Action:m,Resource:p}]}}],Tags:[{Key:"Name",Value:u},{Key:"Environment",Value:n}]}},logicalId:d}}static createBedrockPolicy(e){let{slug:a,environment:r,name:n,models:i=["*"],allowInvoke:o=!0,allowStreaming:c=!0,allowAsync:u=!1}=e,d=n||l({slug:a,environment:r,resourceType:"bedrock-policy"}),m=s(d),p=[];if(o)p.push("bedrock:InvokeModel");if(c)p.push("bedrock:InvokeModelWithResponseStream");if(u)p.push("bedrock:InvokeModelAsync");let g=i.map((h)=>h==="*"?"arn:aws:bedrock:*::foundation-model/*":`arn:aws:bedrock:*::foundation-model/${h}`);return{policy:{Type:"AWS::IAM::ManagedPolicy",Properties:{ManagedPolicyName:d,PolicyDocument:{Version:"2012-10-17",Statement:[{Sid:"BedrockModelInvocation",Effect:"Allow",Action:p,Resource:g}]}}},logicalId:m}}static enableBedrockForLambda(e){return Fe.createBedrockRole("lambda.amazonaws.com",e)}static enableBedrockForEcs(e){return Fe.createBedrockRole("ecs-tasks.amazonaws.com",e)}static enableBedrockForEc2(e){return Fe.createBedrockRole("ec2.amazonaws.com",e)}static addBedrockPermissions(e,a=["*"],r=!0){let n=["bedrock:InvokeModel"];if(r)n.push("bedrock:InvokeModelWithResponseStream");let i=a.map((o)=>o==="*"?"arn:aws:bedrock:*::foundation-model/*":`arn:aws:bedrock:*::foundation-model/${o}`);if(!e.Properties.Policies)e.Properties.Policies=[];return e.Properties.Policies.push({PolicyName:"bedrock-permissions",PolicyDocument:{Version:"2012-10-17",Statement:[{Effect:"Allow",Action:n,Resource:i}]}}),e}static Models={Claude3_5_Sonnet:"anthropic.claude-3-5-sonnet-20241022-v2:0",Claude3_5_Haiku:"anthropic.claude-3-5-haiku-20241022-v1:0",Claude3_Opus:"anthropic.claude-3-opus-20240229-v1:0",Claude3_Sonnet:"anthropic.claude-3-sonnet-20240229-v1:0",Claude3_Haiku:"anthropic.claude-3-haiku-20240307-v1:0",TitanTextG1Express:"amazon.titan-text-express-v1",TitanTextG1Lite:"amazon.titan-text-lite-v1",TitanEmbedG1Text:"amazon.titan-embed-text-v1",TitanImageG1:"amazon.titan-image-generator-v1",JurassicUltra:"ai21.j2-ultra-v1",JurassicMid:"ai21.j2-mid-v1",CommandText:"cohere.command-text-v14",CommandLight:"cohere.command-light-text-v14",EmbedEnglish:"cohere.embed-english-v3",EmbedMultilingual:"cohere.embed-multilingual-v3",Llama3_2_1B:"meta.llama3-2-1b-instruct-v1:0",Llama3_2_3B:"meta.llama3-2-3b-instruct-v1:0",Llama3_2_11B:"meta.llama3-2-11b-instruct-v1:0",Llama3_2_90B:"meta.llama3-2-90b-instruct-v1:0",Llama3_1_8B:"meta.llama3-1-8b-instruct-v1:0",Llama3_1_70B:"meta.llama3-1-70b-instruct-v1:0",Llama3_1_405B:"meta.llama3-1-405b-instruct-v1:0",Mistral7B:"mistral.mistral-7b-instruct-v0:2",Mixtral8x7B:"mistral.mixtral-8x7b-instruct-v0:1",MistralLarge:"mistral.mistral-large-2402-v1:0",StableDiffusionXL:"stability.stable-diffusion-xl-v1"};static ModelGroups={AllClaude:["anthropic.claude-3-5-sonnet-20241022-v2:0","anthropic.claude-3-5-haiku-20241022-v1:0","anthropic.claude-3-opus-20240229-v1:0","anthropic.claude-3-sonnet-20240229-v1:0","anthropic.claude-3-haiku-20240307-v1:0"],AllTitan:["amazon.titan-text-express-v1","amazon.titan-text-lite-v1","amazon.titan-embed-text-v1","amazon.titan-image-generator-v1"],AllLlama:["meta.llama3-2-1b-instruct-v1:0","meta.llama3-2-3b-instruct-v1:0","meta.llama3-2-11b-instruct-v1:0","meta.llama3-2-90b-instruct-v1:0","meta.llama3-1-8b-instruct-v1:0","meta.llama3-1-70b-instruct-v1:0","meta.llama3-1-405b-instruct-v1:0"],TextModels:["anthropic.claude-3-5-sonnet-20241022-v2:0","anthropic.claude-3-5-haiku-20241022-v1:0","amazon.titan-text-express-v1","meta.llama3-2-11b-instruct-v1:0","mistral.mistral-7b-instruct-v0:2"],EmbeddingModels:["amazon.titan-embed-text-v1","cohere.embed-english-v3","cohere.embed-multilingual-v3"],ImageModels:["amazon.titan-image-generator-v1","stability.stable-diffusion-xl-v1"]}}class zt{static createPostgres(e){return zt.createRDSInstance("postgres","16.2",e)}static createMysql(e){return zt.createRDSInstance("mysql","8.0.35",e)}static createRDSInstance(e,a,r){let{slug:n,environment:i,instanceClass:o="db.t3.micro",allocatedStorage:c=20,storageType:u="gp3",masterUsername:d="admin",masterPassword:m,databaseName:p,subnetIds:g,securityGroupIds:h,encrypted:y=!0,kmsKeyId:f,multiAz:b=!1,backupRetentionDays:T=7,publiclyAccessible:w=!1,enableCloudwatchLogs:I=!0,deletionProtection:v=!0}=r,N=l({slug:n,environment:i,resourceType:`${e}-db`}),R=s(N),k,x;if(g&&g.length>0){let _=l({slug:n,environment:i,resourceType:"db-subnet-group"});x=s(_),k={Type:"AWS::RDS::DBSubnetGroup",Properties:{DBSubnetGroupName:_,DBSubnetGroupDescription:`Subnet group for ${N}`,SubnetIds:g,Tags:[{Key:"Name",Value:_},{Key:"Environment",Value:i}]}}}let L={Type:"AWS::RDS::DBInstance",Properties:{DBInstanceIdentifier:N,DBInstanceClass:o,Engine:e,EngineVersion:a,MasterUsername:d,MasterUserPassword:m,AllocatedStorage:c,StorageType:u,StorageEncrypted:y,MultiAZ:b,BackupRetentionPeriod:T,PubliclyAccessible:w,DeletionProtection:v,Tags:[{Key:"Name",Value:N},{Key:"Environment",Value:i}]}};if(p)L.Properties.DBName=p;if(f)L.Properties.KmsKeyId=f;if(x)L.Properties.DBSubnetGroupName=P.Ref(x);if(h&&h.length>0)L.Properties.VPCSecurityGroups=h;if(I)L.Properties.EnableCloudwatchLogsExports=e==="postgres"?["postgresql"]:["error","general","slowquery"];return{dbInstance:L,subnetGroup:k,logicalId:R,subnetGroupId:x}}static createReadReplica(e,a){let{slug:r,environment:n,instanceClass:i="db.t3.micro",securityGroupIds:o,publiclyAccessible:c=!1}=a,u=l({slug:r,environment:n,resourceType:"db-replica"}),d=s(u),m={Type:"AWS::RDS::DBInstance",Properties:{DBInstanceIdentifier:u,DBInstanceClass:i,SourceDBInstanceIdentifier:P.Ref(e),PubliclyAccessible:c,Tags:[{Key:"Name",Value:u},{Key:"Environment",Value:n},{Key:"Type",Value:"ReadReplica"}]}};if(o&&o.length>0)m.Properties.VPCSecurityGroups=o;return{replica:m,logicalId:d}}static createParameterGroup(e,a,r){let{slug:n,environment:i,parameters:o={}}=r,c=l({slug:n,environment:i,resourceType:"db-params"}),u=s(c),d=e==="postgres"?`postgres${a.split(".")[0]}`:`mysql${a.split(".")[0]}.${a.split(".")[1]}`;return{parameterGroup:{Type:"AWS::RDS::DBParameterGroup",Properties:{DBParameterGroupName:c,Description:`Parameter group for ${c}`,Family:d,Parameters:o,Tags:[{Key:"Name",Value:c},{Key:"Environment",Value:i}]}},logicalId:u}}static enableBackup(e,a=7){return e.Properties.BackupRetentionPeriod=a,e}static createTable(e){let{slug:a,environment:r,tableName:n,partitionKey:i,sortKey:o,billingMode:c="PAY_PER_REQUEST",readCapacity:u=5,writeCapacity:d=5,streamEnabled:m=!1,streamViewType:p="NEW_AND_OLD_IMAGES",encrypted:g=!0,kmsKeyId:h,pointInTimeRecovery:y=!0,ttlAttribute:f}=e,b=n||l({slug:a,environment:r,resourceType:"table"}),T=s(b),w=[{AttributeName:i.name,AttributeType:i.type}];if(o)w.push({AttributeName:o.name,AttributeType:o.type});let I=[{AttributeName:i.name,KeyType:"HASH"}];if(o)I.push({AttributeName:o.name,KeyType:"RANGE"});let v={Type:"AWS::DynamoDB::Table",Properties:{TableName:b,BillingMode:c,AttributeDefinitions:w,KeySchema:I,Tags:[{Key:"Name",Value:b},{Key:"Environment",Value:r}]}};if(c==="PROVISIONED")v.Properties.ProvisionedThroughput={ReadCapacityUnits:u,WriteCapacityUnits:d};if(m)v.Properties.StreamSpecification={StreamViewType:p};if(g)v.Properties.SSESpecification={SSEEnabled:!0,SSEType:h?"KMS":"AES256",KMSMasterKeyId:h};if(y)v.Properties.PointInTimeRecoverySpecification={PointInTimeRecoveryEnabled:!0};if(f)v.Properties.TimeToLiveSpecification={AttributeName:f,Enabled:!0};return{table:v,logicalId:T}}static addGlobalSecondaryIndex(e,a){let{indexName:r,partitionKey:n,sortKey:i,projectionType:o="ALL",nonKeyAttributes:c,readCapacity:u=5,writeCapacity:d=5}=a;if(!e.Properties.AttributeDefinitions.some((g)=>g.AttributeName===n.name))e.Properties.AttributeDefinitions.push({AttributeName:n.name,AttributeType:n.type});if(i&&!e.Properties.AttributeDefinitions.some((g)=>g.AttributeName===i.name))e.Properties.AttributeDefinitions.push({AttributeName:i.name,AttributeType:i.type});let m=[{AttributeName:n.name,KeyType:"HASH"}];if(i)m.push({AttributeName:i.name,KeyType:"RANGE"});let p={IndexName:r,KeySchema:m,Projection:{ProjectionType:o,NonKeyAttributes:o==="INCLUDE"?c:void 0},ProvisionedThroughput:void 0};if(e.Properties.BillingMode==="PROVISIONED")p.ProvisionedThroughput={ReadCapacityUnits:u,WriteCapacityUnits:d};if(!e.Properties.GlobalSecondaryIndexes)e.Properties.GlobalSecondaryIndexes=[];return e.Properties.GlobalSecondaryIndexes.push(p),e}static enableStreams(e,a="NEW_AND_OLD_IMAGES"){return e.Properties.StreamSpecification={StreamViewType:a},e}static InstanceClasses={T3_Micro:"db.t3.micro",T3_Small:"db.t3.small",T3_Medium:"db.t3.medium",T3_Large:"db.t3.large",T4g_Micro:"db.t4g.micro",T4g_Small:"db.t4g.small",T4g_Medium:"db.t4g.medium",M5_Large:"db.m5.large",M5_XLarge:"db.m5.xlarge",M5_2XLarge:"db.m5.2xlarge",R5_Large:"db.r5.large",R5_XLarge:"db.r5.xlarge",R5_2XLarge:"db.r5.2xlarge"}}class bi{static createRedis(e){let{slug:a,environment:r,nodeType:n="cache.t3.micro",engineVersion:i="7.1",port:o=6379,subnetIds:c,securityGroupIds:u,numCacheClusters:d=2,automaticFailover:m=!0,multiAz:p=!0,clusterMode:g=!1,numNodeGroups:h=1,replicasPerNodeGroup:y=1,atRestEncryption:f=!0,transitEncryption:b=!0,authToken:T,kmsKeyId:w,snapshotRetentionDays:I=7,snapshotWindow:v,maintenanceWindow:N}=e,R=l({slug:a,environment:r,resourceType:"redis"}),k=s(R),x,L;if(c&&c.length>0){let W=l({slug:a,environment:r,resourceType:"cache-subnet-group"});L=s(W),x={Type:"AWS::ElastiCache::SubnetGroup",Properties:{CacheSubnetGroupName:W,Description:`Subnet group for ${R}`,SubnetIds:c,Tags:[{Key:"Name",Value:W},{Key:"Environment",Value:r}]}}}let _={Type:"AWS::ElastiCache::ReplicationGroup",Properties:{ReplicationGroupId:R,ReplicationGroupDescription:`Redis cluster for ${a} ${r}`,Engine:"redis",EngineVersion:i,CacheNodeType:n,Port:o,AutomaticFailoverEnabled:m,MultiAZEnabled:p,AtRestEncryptionEnabled:f,TransitEncryptionEnabled:b,SnapshotRetentionLimit:I,AutoMinorVersionUpgrade:!0,Tags:[{Key:"Name",Value:R},{Key:"Environment",Value:r}]}};if(g)_.Properties.NumNodeGroups=h,_.Properties.ReplicasPerNodeGroup=y;else _.Properties.NumCacheClusters=d;if(T)_.Properties.AuthToken=T;if(w)_.Properties.KmsKeyId=w;if(L)_.Properties.CacheSubnetGroupName=P.Ref(L);if(u&&u.length>0)_.Properties.SecurityGroupIds=u;if(v)_.Properties.SnapshotWindow=v;if(N)_.Properties.PreferredMaintenanceWindow=N;return{replicationGroup:_,subnetGroup:x,logicalId:k,subnetGroupId:L}}static createMemcached(e){let{slug:a,environment:r,nodeType:n="cache.t3.micro",engineVersion:i="1.6.22",port:o=11211,numCacheNodes:c=2,subnetIds:u,securityGroupIds:d,azMode:m="cross-az",preferredAzs:p,maintenanceWindow:g}=e,h=l({slug:a,environment:r,resourceType:"memcached"}),y=s(h),f,b;if(u&&u.length>0){let w=l({slug:a,environment:r,resourceType:"cache-subnet-group"});b=s(w),f={Type:"AWS::ElastiCache::SubnetGroup",Properties:{CacheSubnetGroupName:w,Description:`Subnet group for ${h}`,SubnetIds:u,Tags:[{Key:"Name",Value:w},{Key:"Environment",Value:r}]}}}let T={Type:"AWS::ElastiCache::CacheCluster",Properties:{ClusterName:h,CacheNodeType:n,Engine:"memcached",EngineVersion:i,NumCacheNodes:c,Port:o,AZMode:m,AutoMinorVersionUpgrade:!0,Tags:[{Key:"Name",Value:h},{Key:"Environment",Value:r}]}};if(b)T.Properties.CacheSubnetGroupName=P.Ref(b);if(d&&d.length>0)T.Properties.VpcSecurityGroupIds=d;if(p&&p.length>0)T.Properties.PreferredAvailabilityZones=p;if(g)T.Properties.PreferredMaintenanceWindow=g;return{cluster:T,subnetGroup:f,logicalId:y,subnetGroupId:b}}static enableClusterMode(e,a=3,r=2){return delete e.Properties.NumCacheClusters,e.Properties.NumNodeGroups=a,e.Properties.ReplicasPerNodeGroup=r,e}static createRedisParameterGroup(e,a){let{slug:r,environment:n,parameters:i={}}=a,o=l({slug:r,environment:n,resourceType:"redis-params"}),c=s(o);return{parameterGroup:{Type:"AWS::ElastiCache::ParameterGroup",Properties:{CacheParameterGroupFamily:`redis${e.split(".")[0]}.x`,Description:`Parameter group for ${o}`,Properties:i,Tags:[{Key:"Name",Value:o},{Key:"Environment",Value:n}]}},logicalId:c}}static createMemcachedParameterGroup(e,a){let{slug:r,environment:n,parameters:i={}}=a,o=l({slug:r,environment:n,resourceType:"memcached-params"}),c=s(o);return{parameterGroup:{Type:"AWS::ElastiCache::ParameterGroup",Properties:{CacheParameterGroupFamily:`memcached${e.split(".")[0]}.${e.split(".")[1]}`,Description:`Parameter group for ${o}`,Properties:i,Tags:[{Key:"Name",Value:o},{Key:"Environment",Value:n}]}},logicalId:c}}static NodeTypes={T3_Micro:"cache.t3.micro",T3_Small:"cache.t3.small",T3_Medium:"cache.t3.medium",T4g_Micro:"cache.t4g.micro",T4g_Small:"cache.t4g.small",T4g_Medium:"cache.t4g.medium",M5_Large:"cache.m5.large",M5_XLarge:"cache.m5.xlarge",M5_2XLarge:"cache.m5.2xlarge",R5_Large:"cache.r5.large",R5_XLarge:"cache.r5.xlarge",R5_2XLarge:"cache.r5.2xlarge",R5_4XLarge:"cache.r5.4xlarge",R6g_Large:"cache.r6g.large",R6g_XLarge:"cache.r6g.xlarge",R6g_2XLarge:"cache.r6g.2xlarge"}}class Ee{static createUser(e){let{slug:a,environment:r,userName:n,groups:i,managedPolicyArns:o}=e,c=n||l({slug:a,environment:r,resourceType:"user"}),u=s(c),d={Type:"AWS::IAM::User",Properties:{UserName:c,Tags:[{Key:"Name",Value:c},{Key:"Environment",Value:r}]}};if(i&&i.length>0)d.Properties.Groups=i;if(o&&o.length>0)d.Properties.ManagedPolicyArns=o;return{user:d,logicalId:u}}static createRole(e){let{slug:a,environment:r,roleName:n,servicePrincipal:i,awsPrincipal:o,managedPolicyArns:c}=e,u=n||l({slug:a,environment:r,resourceType:"role"}),d=s(u),m={};if(i)m.Service=i;if(o)m.AWS=o;let p={Type:"AWS::IAM::Role",Properties:{RoleName:u,AssumeRolePolicyDocument:{Version:"2012-10-17",Statement:[{Effect:"Allow",Principal:m,Action:"sts:AssumeRole"}]},Tags:[{Key:"Name",Value:u},{Key:"Environment",Value:r}]}};if(c&&c.length>0)p.Properties.ManagedPolicyArns=c;return{role:p,logicalId:d}}static createGroup(e){let{slug:a,environment:r,groupName:n,managedPolicyArns:i}=e,o=n||l({slug:a,environment:r,resourceType:"group"}),c=s(o),u={Type:"AWS::IAM::Group",Properties:{GroupName:o}};if(i&&i.length>0)u.Properties.ManagedPolicyArns=i;return{group:u,logicalId:c}}static createPolicy(e){let{slug:a,environment:r,policyName:n,description:i,statements:o}=e,c=n||l({slug:a,environment:r,resourceType:"policy"}),u=s(c),d=o.map((m)=>({Sid:m.sid,Effect:m.effect||"Allow",Action:m.actions,Resource:m.resources,Condition:m.conditions}));return{policy:{Type:"AWS::IAM::ManagedPolicy",Properties:{ManagedPolicyName:c,Description:i||`Managed policy for ${c}`,PolicyDocument:{Version:"2012-10-17",Statement:d}}},logicalId:u}}static attachPolicyToRole(e,a){if(!e.Properties.ManagedPolicyArns)e.Properties.ManagedPolicyArns=[];if(!e.Properties.ManagedPolicyArns.includes(a))e.Properties.ManagedPolicyArns.push(a);return e}static attachPolicyToUser(e,a){if(!e.Properties.ManagedPolicyArns)e.Properties.ManagedPolicyArns=[];if(!e.Properties.ManagedPolicyArns.includes(a))e.Properties.ManagedPolicyArns.push(a);return e}static attachPolicyToGroup(e,a){if(!e.Properties.ManagedPolicyArns)e.Properties.ManagedPolicyArns=[];if(!e.Properties.ManagedPolicyArns.includes(a))e.Properties.ManagedPolicyArns.push(a);return e}static addInlinePolicyToRole(e,a,r){if(!e.Properties.Policies)e.Properties.Policies=[];let n=r.map((i)=>({Effect:i.effect||"Allow",Action:i.actions,Resource:i.resources}));return e.Properties.Policies.push({PolicyName:a,PolicyDocument:{Version:"2012-10-17",Statement:n}}),e}static addInlinePolicyToUser(e,a,r){if(!e.Properties.Policies)e.Properties.Policies=[];let n=r.map((i)=>({Effect:i.effect||"Allow",Action:i.actions,Resource:i.resources}));return e.Properties.Policies.push({PolicyName:a,PolicyDocument:{Version:"2012-10-17",Statement:n}}),e}static createAccessKey(e,a){let{slug:r,environment:n,status:i="Active"}=a,o=l({slug:r,environment:n,resourceType:"access-key"}),c=s(o);return{accessKey:{Type:"AWS::IAM::AccessKey",Properties:{UserName:P.Ref(e),Status:i}},logicalId:c}}static createInstanceProfile(e,a){let{slug:r,environment:n,profileName:i}=a,o=i||l({slug:r,environment:n,resourceType:"instance-profile"}),c=s(o);return{instanceProfile:{Type:"AWS::IAM::InstanceProfile",Properties:{InstanceProfileName:o,Roles:[P.Ref(e)]}},logicalId:c}}static ManagedPolicies={AdministratorAccess:"arn:aws:iam::aws:policy/AdministratorAccess",PowerUserAccess:"arn:aws:iam::aws:policy/PowerUserAccess",ReadOnlyAccess:"arn:aws:iam::aws:policy/ReadOnlyAccess",S3FullAccess:"arn:aws:iam::aws:policy/AmazonS3FullAccess",S3ReadOnlyAccess:"arn:aws:iam::aws:policy/AmazonS3ReadOnlyAccess",DynamoDBFullAccess:"arn:aws:iam::aws:policy/AmazonDynamoDBFullAccess",DynamoDBReadOnlyAccess:"arn:aws:iam::aws:policy/AmazonDynamoDBReadOnlyAccess",RDSFullAccess:"arn:aws:iam::aws:policy/AmazonRDSFullAccess",RDSReadOnlyAccess:"arn:aws:iam::aws:policy/AmazonRDSReadOnlyAccess",LambdaFullAccess:"arn:aws:iam::aws:policy/AWSLambda_FullAccess",LambdaReadOnlyAccess:"arn:aws:iam::aws:policy/AWSLambda_ReadOnlyAccess",LambdaBasicExecutionRole:"arn:aws:iam::aws:policy/service-role/AWSLambdaBasicExecutionRole",LambdaVPCAccessExecutionRole:"arn:aws:iam::aws:policy/service-role/AWSLambdaVPCAccessExecutionRole",EC2FullAccess:"arn:aws:iam::aws:policy/AmazonEC2FullAccess",EC2ReadOnlyAccess:"arn:aws:iam::aws:policy/AmazonEC2ReadOnlyAccess",EC2ContainerRegistryReadOnly:"arn:aws:iam::aws:policy/AmazonEC2ContainerRegistryReadOnly",EC2ContainerRegistryPowerUser:"arn:aws:iam::aws:policy/AmazonEC2ContainerRegistryPowerUser",ECSTaskExecutionRole:"arn:aws:iam::aws:policy/service-role/AmazonECSTaskExecutionRolePolicy",ECSFullAccess:"arn:aws:iam::aws:policy/AmazonECS_FullAccess",CloudWatchFullAccess:"arn:aws:iam::aws:policy/CloudWatchFullAccess",CloudWatchLogsFullAccess:"arn:aws:iam::aws:policy/CloudWatchLogsFullAccess",SESFullAccess:"arn:aws:iam::aws:policy/AmazonSESFullAccess",SNSFullAccess:"arn:aws:iam::aws:policy/AmazonSNSFullAccess",SQSFullAccess:"arn:aws:iam::aws:policy/AmazonSQSFullAccess",SecretsManagerReadWrite:"arn:aws:iam::aws:policy/SecretsManagerReadWrite"};static ServicePrincipals={Lambda:"lambda.amazonaws.com",EC2:"ec2.amazonaws.com",ECS:"ecs.amazonaws.com",ECSTaskExecution:"ecs-tasks.amazonaws.com",APIGateway:"apigateway.amazonaws.com",Events:"events.amazonaws.com",States:"states.amazonaws.com",CodeBuild:"codebuild.amazonaws.com",CodeDeploy:"codedeploy.amazonaws.com",CloudFormation:"cloudformation.amazonaws.com"};static createCiCdUser(e){let{slug:a,environment:r,permissions:n,createAccessKey:i=!0}=e,o={},c=[];if(n.s3Buckets&&n.s3Buckets.length>0)c.push({sid:"S3Access",actions:["s3:GetBucketLocation","s3:ListBucket","s3:GetObject","s3:PutObject","s3:DeleteObject","s3:ListBucketMultipartUploads","s3:AbortMultipartUpload"],resources:[...n.s3Buckets,...n.s3Buckets.map((y)=>`${y}/*`)]});if(n.cloudFrontDistributions&&n.cloudFrontDistributions.length>0)c.push({sid:"CloudFrontAccess",actions:["cloudfront:CreateInvalidation","cloudfront:GetInvalidation","cloudfront:ListInvalidations","cloudfront:GetDistribution"],resources:n.cloudFrontDistributions});if(n.ecrRepositories&&n.ecrRepositories.length>0)c.push({sid:"ECRAccess",actions:["ecr:GetAuthorizationToken","ecr:BatchCheckLayerAvailability","ecr:GetDownloadUrlForLayer","ecr:GetRepositoryPolicy","ecr:DescribeRepositories","ecr:ListImages","ecr:DescribeImages","ecr:BatchGetImage","ecr:InitiateLayerUpload","ecr:UploadLayerPart","ecr:CompleteLayerUpload","ecr:PutImage"],resources:n.ecrRepositories}),c.push({sid:"ECRLogin",actions:["ecr:GetAuthorizationToken"],resources:"*"});if(n.ecsServices&&n.ecsServices.length>0)c.push({sid:"ECSAccess",actions:["ecs:DescribeServices","ecs:DescribeTaskDefinition","ecs:DescribeTasks","ecs:ListTasks","ecs:RegisterTaskDefinition","ecs:UpdateService","ecs:RunTask","ecs:StopTask"],resources:n.ecsServices}),c.push({sid:"ECSTaskDefinitions",actions:["ecs:RegisterTaskDefinition","ecs:DeregisterTaskDefinition"],resources:"*"}),c.push({sid:"ECSPassRole",actions:["iam:PassRole"],resources:"*",conditions:{StringLike:{"iam:PassedToService":"ecs-tasks.amazonaws.com"}}});if(n.cloudFormationStacks&&n.cloudFormationStacks.length>0)c.push({sid:"CloudFormationAccess",actions:["cloudformation:CreateStack","cloudformation:UpdateStack","cloudformation:DeleteStack","cloudformation:DescribeStacks","cloudformation:DescribeStackEvents","cloudformation:DescribeStackResources","cloudformation:GetTemplate","cloudformation:ListStackResources","cloudformation:ValidateTemplate"],resources:n.cloudFormationStacks});if(n.lambdaFunctions&&n.lambdaFunctions.length>0)c.push({sid:"LambdaAccess",actions:["lambda:GetFunction","lambda:UpdateFunctionCode","lambda:UpdateFunctionConfiguration","lambda:PublishVersion","lambda:UpdateAlias","lambda:CreateAlias"],resources:n.lambdaFunctions});if(n.secretsManagerSecrets&&n.secretsManagerSecrets.length>0)c.push({sid:"SecretsManagerAccess",actions:["secretsmanager:GetSecretValue","secretsmanager:DescribeSecret"],resources:n.secretsManagerSecrets});let{policy:u,logicalId:d}=Ee.createPolicy({slug:a,environment:r,policyName:l({slug:a,environment:r,resourceType:"cicd-policy"}),description:`CI/CD deployment policy for ${a} (${r})`,statements:c});o[d]=u;let{user:m,logicalId:p}=Ee.createUser({slug:a,environment:r,userName:l({slug:a,environment:r,resourceType:"cicd-user"}),managedPolicyArns:[P.Ref(d)]});o[p]=m;let g,h;if(i){let y=Ee.createAccessKey(p,{slug:a,environment:r});g=y.accessKey,h=y.logicalId,o[h]=g}return{user:m,accessKey:g,policy:u,userLogicalId:p,accessKeyLogicalId:h,policyLogicalId:d,resources:o}}static createCrossAccountRole(e){let{slug:a,environment:r,trustedAccountIds:n,externalId:i,permissions:o,maxSessionDuration:c=3600}=e,u={},{policy:d,logicalId:m}=Ee.createPolicy({slug:a,environment:r,policyName:l({slug:a,environment:r,resourceType:"cross-account-policy"}),description:`Cross-account access policy for ${a} (${r})`,statements:o});u[m]=d;let p=l({slug:a,environment:r,resourceType:"cross-account-role"}),g=s(p),h={};if(i)h.StringEquals={"sts:ExternalId":i};let y={Type:"AWS::IAM::Role",Properties:{RoleName:p,MaxSessionDuration:c,AssumeRolePolicyDocument:{Version:"2012-10-17",Statement:[{Effect:"Allow",Principal:{AWS:n.map((f)=>`arn:aws:iam::${f}:root`)},Action:"sts:AssumeRole",...Object.keys(h).length>0?{Condition:h}:{}}]},ManagedPolicyArns:[P.Ref(m)],Tags:[{Key:"Name",Value:p},{Key:"Environment",Value:r},{Key:"Purpose",Value:"Cross-Account Access"}]}};return u[g]=y,{role:y,policy:d,roleLogicalId:g,policyLogicalId:m,resources:u}}static createCliUser(e){let{slug:a,environment:r,permissions:n="readonly"}=e,i={},o=[],c=[];switch(n){case"readonly":c=[Ee.ManagedPolicies.ReadOnlyAccess];break;case"deploy":o=[{sid:"S3Deploy",actions:["s3:*"],resources:"*"},{sid:"CloudFrontDeploy",actions:["cloudfront:*"],resources:"*"},{sid:"ECSDeploy",actions:["ecs:*"],resources:"*"},{sid:"ECRDeploy",actions:["ecr:*"],resources:"*"},{sid:"LambdaDeploy",actions:["lambda:*"],resources:"*"},{sid:"CloudFormationDeploy",actions:["cloudformation:*"],resources:"*"},{sid:"IAMPassRole",actions:["iam:PassRole"],resources:"*"}];break;case"admin":c=[Ee.ManagedPolicies.AdministratorAccess];break}let u,d;if(o.length>0){let y=Ee.createPolicy({slug:a,environment:r,policyName:l({slug:a,environment:r,resourceType:"cli-policy"}),description:`CLI access policy for ${a} (${r})`,statements:o});u=y.policy,d=y.logicalId,i[d]=u,c=[P.Ref(d)]}let{user:m,logicalId:p}=Ee.createUser({slug:a,environment:r,userName:l({slug:a,environment:r,resourceType:"cli-user"}),managedPolicyArns:c});i[p]=m;let{accessKey:g,logicalId:h}=Ee.createAccessKey(p,{slug:a,environment:r});return i[h]=g,{user:m,accessKey:g,policy:u,userLogicalId:p,accessKeyLogicalId:h,policyLogicalId:d,resources:i}}static CiCdPolicies={s3Deployment:(e)=>[{sid:"S3ListBuckets",actions:["s3:ListBucket","s3:GetBucketLocation"],resources:e},{sid:"S3Objects",actions:["s3:GetObject","s3:PutObject","s3:DeleteObject"],resources:e.map((a)=>`${a}/*`)}],cloudFrontInvalidation:(e)=>[{sid:"CloudFrontInvalidation",actions:["cloudfront:CreateInvalidation","cloudfront:GetInvalidation","cloudfront:ListInvalidations"],resources:e}],ecsDeployment:()=>[{sid:"ECSServices",actions:["ecs:DescribeServices","ecs:UpdateService","ecs:DescribeTaskDefinition","ecs:RegisterTaskDefinition"],resources:"*"},{sid:"ECSPassRole",actions:["iam:PassRole"],resources:"*",conditions:{StringLike:{"iam:PassedToService":"ecs-tasks.amazonaws.com"}}}],ecrPush:(e)=>[{sid:"ECRAuth",actions:["ecr:GetAuthorizationToken"],resources:"*"},{sid:"ECRPush",actions:["ecr:BatchCheckLayerAvailability","ecr:GetDownloadUrlForLayer","ecr:BatchGetImage","ecr:InitiateLayerUpload","ecr:UploadLayerPart","ecr:CompleteLayerUpload","ecr:PutImage"],resources:e}],lambdaDeployment:(e)=>[{sid:"LambdaDeploy",actions:["lambda:GetFunction","lambda:UpdateFunctionCode","lambda:UpdateFunctionConfiguration","lambda:PublishVersion"],resources:e}],cloudFormationDeployment:(e)=>[{sid:"CloudFormationDeploy",actions:["cloudformation:CreateStack","cloudformation:UpdateStack","cloudformation:DescribeStacks","cloudformation:DescribeStackEvents","cloudformation:GetTemplate"],resources:e}]}}class _o{static createRestApi(e){let{slug:a,environment:r,name:n,description:i,endpointType:o="REGIONAL",binaryMediaTypes:c,compressionSize:u}=e,d=n||l({slug:a,environment:r,resourceType:"rest-api"}),m=s(d),p={Type:"AWS::ApiGateway::RestApi",Properties:{Name:d,Description:i||`REST API for ${a} ${r}`,EndpointConfiguration:{Types:[o]},Tags:[{Key:"Name",Value:d},{Key:"Environment",Value:r}]}};if(c&&c.length>0)p.Properties.BinaryMediaTypes=c;if(u!==void 0)p.Properties.MinimumCompressionSize=u;return{restApi:p,logicalId:m}}static createHttpApi(e){let{slug:a,environment:r,name:n,description:i,corsEnabled:o=!0,corsOrigins:c=["*"],corsMethods:u=["GET","POST","PUT","PATCH","DELETE","OPTIONS"],corsHeaders:d=["*"],corsMaxAge:m=86400,corsAllowCredentials:p=!1}=e,g=n||l({slug:a,environment:r,resourceType:"http-api"}),h=s(g),y={Type:"AWS::ApiGatewayV2::Api",Properties:{Name:g,Description:i||`HTTP API for ${a} ${r}`,ProtocolType:"HTTP",Tags:{Name:g,Environment:r}}};if(o)y.Properties.CorsConfiguration={AllowOrigins:c,AllowMethods:u,AllowHeaders:d,MaxAge:m,AllowCredentials:p};return{httpApi:y,logicalId:h}}static createWebSocketApi(e){let{slug:a,environment:r,name:n,description:i}=e,o=n||l({slug:a,environment:r,resourceType:"ws-api"}),c=s(o);return{webSocketApi:{Type:"AWS::ApiGatewayV2::Api",Properties:{Name:o,Description:i||`WebSocket API for ${a} ${r}`,ProtocolType:"WEBSOCKET",Tags:{Name:o,Environment:r}}},logicalId:c}}static createDeployment(e,a){let{slug:r,environment:n,description:i}=a,o=l({slug:r,environment:n,resourceType:"api-deployment"}),c=s(o);return{deployment:{Type:"AWS::ApiGateway::Deployment",Properties:{RestApiId:P.Ref(e),Description:i||`Deployment for ${o}`}},logicalId:c}}static createStage(e,a,r){let{slug:n,environment:i,stageName:o,description:c,cacheEnabled:u=!1,cacheSize:d="0.5",variables:m,throttling:p}=r,g=l({slug:n,environment:i,resourceType:"api-stage"}),h=s(g),y={Type:"AWS::ApiGateway::Stage",Properties:{StageName:o||i,RestApiId:P.Ref(e),DeploymentId:P.Ref(a),Description:c,CacheClusterEnabled:u,Tags:[{Key:"Name",Value:g},{Key:"Environment",Value:i}]}};if(u)y.Properties.CacheClusterSize=d;if(m)y.Properties.Variables=m;if(p)y.Properties.MethodSettings=[{HttpMethod:"*",ResourcePath:"/*",ThrottlingBurstLimit:p.burstLimit,ThrottlingRateLimit:p.rateLimit}];return{stage:y,logicalId:h}}static createAuthorizer(e,a){let{slug:r,environment:n,name:i,type:o,functionArn:c,identitySource:u,userPoolArns:d,ttl:m=300}=a,p=i||l({slug:r,environment:n,resourceType:"api-authorizer"}),g=s(p),h={Type:"AWS::ApiGateway::Authorizer",Properties:{Name:p,Type:o,RestApiId:P.Ref(e),AuthorizerResultTtlInSeconds:m}};if(o==="TOKEN"||o==="REQUEST"){if(!c)throw Error("Lambda authorizer requires functionArn");h.Properties.AuthorizerUri=c,h.Properties.IdentitySource=u||"method.request.header.Authorization"}if(o==="COGNITO_USER_POOLS"){if(!d||d.length===0)throw Error("Cognito authorizer requires userPoolArns");h.Properties.ProviderARNs=d,h.Properties.IdentitySource=u||"method.request.header.Authorization"}return{authorizer:h,logicalId:g}}static setCors(e,a={}){let{origins:r=["*"],methods:n=["GET","POST","PUT","PATCH","DELETE","OPTIONS"],headers:i=["*"],maxAge:o=86400,allowCredentials:c=!1}=a;return e.Properties.CorsConfiguration={AllowOrigins:r,AllowMethods:n,AllowHeaders:i,MaxAge:o,AllowCredentials:c},e}static addThrottling(e,a=5000,r=1e4){if(!e.Properties.MethodSettings)e.Properties.MethodSettings=[];return e.Properties.MethodSettings.push({HttpMethod:"*",ResourcePath:"/*",ThrottlingBurstLimit:a,ThrottlingRateLimit:r}),e}static enableCaching(e,a="0.5",r=300){if(e.Properties.CacheClusterEnabled=!0,e.Properties.CacheClusterSize=a,!e.Properties.MethodSettings)e.Properties.MethodSettings=[];return e.Properties.MethodSettings.push({HttpMethod:"*",ResourcePath:"/*",CachingEnabled:!0,CacheTtlInSeconds:r}),e}static CacheSizes={Small:"0.5",Medium:"1.6",Large:"6.1",XLarge:"13.5",XXLarge:"28.4",XXXLarge:"58.2",Huge:"118",Massive:"237"};static ThrottlingPresets={Light:{burstLimit:100,rateLimit:50},Medium:{burstLimit:500,rateLimit:250},Heavy:{burstLimit:2000,rateLimit:1000},Default:{burstLimit:5000,rateLimit:1e4}}}class ke{static createTopic(e){let{slug:a,environment:r,topicName:n,displayName:i,encrypted:o=!1,kmsKeyId:c}=e,u=n||l({slug:a,environment:r,resourceType:"topic"}),d=s(u),m={Type:"AWS::SNS::Topic",Properties:{TopicName:u,DisplayName:i||u,Tags:[{Key:"Name",Value:u},{Key:"Environment",Value:r}]}};if(o&&c)m.Properties.KmsMasterKeyId=c;return{topic:m,logicalId:d}}static subscribe(e,a){let{slug:r,environment:n,protocol:i,endpoint:o,filterPolicy:c,rawMessageDelivery:u=!1}=a,d=l({slug:r,environment:n,resourceType:"subscription"}),m=o.replace(/[^a-zA-Z0-9]/g,""),p=m.length>12?m.slice(-12):m,g=s(`${d}-${i}-${p}`),h={Type:"AWS::SNS::Subscription",Properties:{TopicArn:P.Ref(e),Protocol:i,Endpoint:o,RawMessageDelivery:u}};if(c)h.Properties.FilterPolicy=c;return{subscription:h,logicalId:g}}static subscribeEmail(e,a,r){return ke.subscribe(e,{...r,protocol:"email",endpoint:a})}static subscribeLambda(e,a,r){return ke.subscribe(e,{...r,protocol:"lambda",endpoint:a,rawMessageDelivery:!0})}static subscribeSqs(e,a,r){return ke.subscribe(e,{...r,protocol:"sqs",endpoint:a})}static subscribeHttp(e,a,r){let n=a.startsWith("https://")?"https":"http";return ke.subscribe(e,{...r,protocol:n,endpoint:a})}static subscribeSms(e,a,r){return ke.subscribe(e,{...r,protocol:"sms",endpoint:a})}static setTopicPolicy(e,a){let{slug:r,environment:n,allowedPrincipals:i,allowedServices:o,actions:c="SNS:Publish"}=a,u=l({slug:r,environment:n,resourceType:"topic-policy"}),d=s(u),m={};if(i)m.AWS=i;if(o)m.Service=o;return{policy:{Type:"AWS::SNS::TopicPolicy",Properties:{Topics:[P.Ref(e)],PolicyDocument:{Version:"2012-10-17",Statement:[{Effect:"Allow",Principal:m,Action:c,Resource:P.Ref(e)}]}}},logicalId:d}}static allowCloudWatchAlarms(e,a){return ke.setTopicPolicy(e,{...a,allowedServices:"cloudwatch.amazonaws.com",actions:"SNS:Publish"})}static allowEventBridge(e,a){return ke.setTopicPolicy(e,{...a,allowedServices:"events.amazonaws.com",actions:"SNS:Publish"})}static allowS3(e,a){return ke.setTopicPolicy(e,{...a,allowedServices:"s3.amazonaws.com",actions:"SNS:Publish"})}static enableEncryption(e,a){if(!e.Properties)e.Properties={};return e.Properties.KmsMasterKeyId=a,e}static addInlineSubscription(e,a,r){if(!e.Properties)e.Properties={};if(!e.Properties.Subscription)e.Properties.Subscription=[];return e.Properties.Subscription.push({Protocol:a,Endpoint:r}),e}static FilterPolicies={eventType:(e)=>({eventType:e}),status:(e)=>({status:e}),numericRange:(e,a,r)=>({[e]:[{numeric:[">=",a,"<=",r]}]}),prefix:(e,a)=>({[e]:[{prefix:a}]}),and:(...e)=>Object.assign({},...e),exists:(e,a)=>({[e]:[{exists:a}]})};static UseCases={createAlertTopic:(e)=>ke.createTopic({...e,topicName:e.topicName||`${e.slug}-${e.environment}-alerts`,displayName:e.displayName||"Alert Notifications"}),createEventFanout:(e)=>ke.createTopic({...e,topicName:e.topicName||`${e.slug}-${e.environment}-events`,displayName:e.displayName||"Event Fanout"}),createNotificationTopic:(e)=>ke.createTopic({...e,topicName:e.topicName||`${e.slug}-${e.environment}-notifications`,displayName:e.displayName||"User Notifications"})}}class xd{static createStateMachine(e){let{slug:a,environment:r,stateMachineName:n,type:i="STANDARD",definition:o,roleArn:c,loggingConfiguration:u,tracingConfiguration:d}=e,m=n||l({slug:a,environment:r,resourceType:"state-machine"}),p=s(m),g,h,y;if(c)y=c;else{let b=l({slug:a,environment:r,resourceType:"state-machine-role"});h=s(b),g={Type:"AWS::IAM::Role",Properties:{RoleName:b,AssumeRolePolicyDocument:{Version:"2012-10-17",Statement:[{Effect:"Allow",Principal:{Service:"states.amazonaws.com"},Action:"sts:AssumeRole"}]},ManagedPolicyArns:["arn:aws:iam::aws:policy/CloudWatchLogsFullAccess"],Tags:[{Key:"Name",Value:b},{Key:"Environment",Value:r}]}},y=P.GetAtt(h,"Arn")}let f={Type:"AWS::StepFunctions::StateMachine",Properties:{StateMachineName:m,StateMachineType:i,DefinitionString:JSON.stringify(o),RoleArn:y,Tags:[{Key:"Name",Value:m},{Key:"Environment",Value:r}]}};if(u)f.Properties.LoggingConfiguration={Level:u.level,IncludeExecutionData:u.includeExecutionData,Destinations:u.destinations?.map((b)=>({CloudWatchLogsLogGroup:{LogGroupArn:b}}))};if(d)f.Properties.TracingConfiguration={Enabled:d.enabled};return{stateMachine:f,logicalId:p,role:g,roleLogicalId:h}}static createLambdaTask(e,a){return{Type:"Task",Resource:"arn:aws:states:::lambda:invoke",Parameters:{FunctionName:e,Payload:a?.parameters||{"Input.$":"$"}},ResultPath:a?.resultPath,Retry:a?.retry,Catch:a?.catch,Next:a?.next,End:a?.end}}static createDynamoDBTask(e,a,r,n){return{Type:"Task",Resource:{GetItem:"arn:aws:states:::dynamodb:getItem",PutItem:"arn:aws:states:::dynamodb:putItem",UpdateItem:"arn:aws:states:::dynamodb:updateItem",DeleteItem:"arn:aws:states:::dynamodb:deleteItem"}[e],Parameters:{TableName:a,...r},ResultPath:n?.resultPath,Retry:n?.retry,Catch:n?.catch,Next:n?.next,End:n?.end}}static createSNSPublishTask(e,a,r){return{Type:"Task",Resource:"arn:aws:states:::sns:publish",Parameters:{TopicArn:e,Message:a},ResultPath:r?.resultPath,Retry:r?.retry,Catch:r?.catch,Next:r?.next,End:r?.end}}static createSQSSendMessageTask(e,a,r){return{Type:"Task",Resource:"arn:aws:states:::sqs:sendMessage",Parameters:{QueueUrl:e,MessageBody:a},ResultPath:r?.resultPath,Retry:r?.retry,Catch:r?.catch,Next:r?.next,End:r?.end}}static createPassState(e){return{Type:"Pass",Result:e?.result,ResultPath:e?.resultPath,Parameters:e?.parameters,Next:e?.next,End:e?.end}}static createWaitState(e){return{Type:"Wait",Seconds:e.seconds,Timestamp:e.timestamp,SecondsPath:e.secondsPath,TimestampPath:e.timestampPath,Next:e.next,End:e.end}}static createChoiceState(e,a){return{Type:"Choice",Choices:e,Default:a}}static createParallelState(e,a){return{Type:"Parallel",Branches:e,ResultPath:a?.resultPath,Retry:a?.retry,Catch:a?.catch,Next:a?.next,End:a?.end}}static createMapState(e,a){return{Type:"Map",ItemsPath:a?.itemsPath||"$.items",Iterator:e,MaxConcurrency:a?.maxConcurrency,ResultPath:a?.resultPath,Retry:a?.retry,Catch:a?.catch,Next:a?.next,End:a?.end}}static createSucceedState(){return{Type:"Succeed"}}static createFailState(e,a){return{Type:"Fail",Error:e,Cause:a}}static RetryPolicies={standard:()=>({ErrorEquals:["States.ALL"],IntervalSeconds:2,MaxAttempts:3,BackoffRate:2}),aggressive:()=>({ErrorEquals:["States.TaskFailed","States.Timeout"],IntervalSeconds:1,MaxAttempts:5,BackoffRate:1.5}),custom:(e,a,r,n)=>({ErrorEquals:e,IntervalSeconds:a,MaxAttempts:r,BackoffRate:n})};static CatchPolicies={all:(e,a)=>({ErrorEquals:["States.ALL"],Next:e,ResultPath:a||"$.error"}),specific:(e,a,r)=>({ErrorEquals:e,Next:a,ResultPath:r||"$.error"})};static Patterns={sequential:(e,a,r)=>{let n={};return r.forEach((i,o)=>{let c=o===r.length-1;n[i.name]={...i.state,Next:c?void 0:r[o+1].name,End:c}}),{Comment:"Sequential workflow",StartAt:r[0].name,States:n}},fanout:(e,a,r)=>({Comment:"Fan-out workflow",StartAt:"Parallel",States:{Parallel:{Type:"Parallel",Branches:r.map((n)=>n.definition),End:!0}}}),map:(e,a,r,n)=>({Comment:"Map workflow",StartAt:"Map",States:{Map:{Type:"Map",ItemsPath:"$.items",Iterator:r,MaxConcurrency:n,End:!0}}}),withErrorHandling:(e,a,r,n)=>({Comment:"Workflow with error handling",StartAt:"Main",States:{Main:{...r,Catch:[{ErrorEquals:["States.ALL"],Next:"ErrorHandler"}],Next:"Success"},ErrorHandler:n,Success:{Type:"Succeed"}}})}}class vi{static createAlarm(e){let{slug:a,environment:r,alarmName:n,metricName:i,namespace:o,statistic:c="Average",period:u=300,evaluationPeriods:d=1,threshold:m,comparisonOperator:p,treatMissingData:g="notBreaching",actionsEnabled:h=!0,alarmActions:y,okActions:f,insufficientDataActions:b,dimensions:T,unit:w,datapointsToAlarm:I}=e,v=n||l({slug:a,environment:r,resourceType:"alarm"}),N=s(v),R={Type:"AWS::CloudWatch::Alarm",Properties:{AlarmName:v,MetricName:i,Namespace:o,Statistic:c,Period:u,EvaluationPeriods:d,Threshold:m,ComparisonOperator:p,TreatMissingData:g,ActionsEnabled:h}};if(y&&y.length>0)R.Properties.AlarmActions=y;if(f&&f.length>0)R.Properties.OKActions=f;if(b&&b.length>0)R.Properties.InsufficientDataActions=b;if(T)R.Properties.Dimensions=Object.entries(T).map(([k,x])=>({Name:k,Value:x}));if(w)R.Properties.Unit=w;if(I!==void 0)R.Properties.DatapointsToAlarm=I;return{alarm:R,logicalId:N}}static createCompositeAlarm(e){let{slug:a,environment:r,alarmName:n,alarmRule:i,actionsEnabled:o=!0,alarmActions:c,okActions:u,insufficientDataActions:d}=e,m=n||l({slug:a,environment:r,resourceType:"composite-alarm"}),p=s(m),g={Type:"AWS::CloudWatch::CompositeAlarm",Properties:{AlarmName:m,AlarmRule:i,ActionsEnabled:o}};if(c&&c.length>0)g.Properties.AlarmActions=c;if(u&&u.length>0)g.Properties.OKActions=u;if(d&&d.length>0)g.Properties.InsufficientDataActions=d;return{alarm:g,logicalId:p}}static createDashboard(e){let{slug:a,environment:r,dashboardName:n,widgets:i}=e,o=n||l({slug:a,environment:r,resourceType:"dashboard"}),c=s(o),u={widgets:i.map((d)=>({type:d.type,x:d.x,y:d.y,width:d.width,height:d.height,properties:d.properties}))};return{dashboard:{Type:"AWS::CloudWatch::Dashboard",Properties:{DashboardName:o,DashboardBody:JSON.stringify(u)}},logicalId:c}}static createLogGroup(e){let{slug:a,environment:r,logGroupName:n,retentionInDays:i,kmsKeyId:o}=e,c=n||l({slug:a,environment:r,resourceType:"log-group"}),u=s(c),d={Type:"AWS::Logs::LogGroup",Properties:{LogGroupName:c}};if(i!==void 0)d.Properties.RetentionInDays=i;if(o)d.Properties.KmsKeyId=o;return{logGroup:d,logicalId:u}}static createLogStream(e,a){let{slug:r,environment:n,logStreamName:i}=a,o=i||l({slug:r,environment:n,resourceType:"log-stream"}),c=s(o);return{logStream:{Type:"AWS::Logs::LogStream",Properties:{LogGroupName:P.Ref(e),LogStreamName:o}},logicalId:c}}static createMetricFilter(e,a){let{slug:r,environment:n,filterName:i,filterPattern:o,metricTransformations:c}=a,u=i||l({slug:r,environment:n,resourceType:"metric-filter"}),d=s(u);return{metricFilter:{Type:"AWS::Logs::MetricFilter",Properties:{LogGroupName:P.Ref(e),FilterPattern:o,MetricTransformations:c.map((m)=>({MetricName:m.metricName,MetricNamespace:m.metricNamespace,MetricValue:m.metricValue,DefaultValue:m.defaultValue,Unit:m.unit}))}},logicalId:d}}static AlarmTypes={highCpu:(e,a,r,n=80,i)=>({slug:e,environment:a,alarmName:`${e}-${a}-high-cpu`,metricName:"CPUUtilization",namespace:"AWS/EC2",statistic:"Average",period:300,evaluationPeriods:2,threshold:n,comparisonOperator:"GreaterThanThreshold",dimensions:{InstanceId:r},alarmActions:i?[i]:void 0}),highMemory:(e,a,r,n=80,i)=>({slug:e,environment:a,alarmName:`${e}-${a}-high-memory`,metricName:"MemoryUtilization",namespace:"System/Linux",statistic:"Average",period:300,evaluationPeriods:2,threshold:n,comparisonOperator:"GreaterThanThreshold",dimensions:{InstanceId:r},alarmActions:i?[i]:void 0}),highDisk:(e,a,r,n=80,i)=>({slug:e,environment:a,alarmName:`${e}-${a}-high-disk`,metricName:"DiskSpaceUtilization",namespace:"System/Linux",statistic:"Average",period:300,evaluationPeriods:2,threshold:n,comparisonOperator:"GreaterThanThreshold",dimensions:{InstanceId:r,Filesystem:"/dev/xvda1",MountPath:"/"},alarmActions:i?[i]:void 0}),lambdaErrors:(e,a,r,n=5,i)=>({slug:e,environment:a,alarmName:`${e}-${a}-lambda-errors`,metricName:"Errors",namespace:"AWS/Lambda",statistic:"Sum",period:300,evaluationPeriods:1,threshold:n,comparisonOperator:"GreaterThanThreshold",dimensions:{FunctionName:r},alarmActions:i?[i]:void 0}),lambdaThrottles:(e,a,r,n=10,i)=>({slug:e,environment:a,alarmName:`${e}-${a}-lambda-throttles`,metricName:"Throttles",namespace:"AWS/Lambda",statistic:"Sum",period:300,evaluationPeriods:1,threshold:n,comparisonOperator:"GreaterThanThreshold",dimensions:{FunctionName:r},alarmActions:i?[i]:void 0}),apiGateway5xxErrors:(e,a,r,n=10,i)=>({slug:e,environment:a,alarmName:`${e}-${a}-api-5xx-errors`,metricName:"5XXError",namespace:"AWS/ApiGateway",statistic:"Sum",period:300,evaluationPeriods:1,threshold:n,comparisonOperator:"GreaterThanThreshold",dimensions:{ApiName:r},alarmActions:i?[i]:void 0}),apiGateway4xxErrors:(e,a,r,n=50,i)=>({slug:e,environment:a,alarmName:`${e}-${a}-api-4xx-errors`,metricName:"4XXError",namespace:"AWS/ApiGateway",statistic:"Sum",period:300,evaluationPeriods:2,threshold:n,comparisonOperator:"GreaterThanThreshold",dimensions:{ApiName:r},alarmActions:i?[i]:void 0}),dynamoDBThrottles:(e,a,r,n=5,i)=>({slug:e,environment:a,alarmName:`${e}-${a}-dynamodb-throttles`,metricName:"UserErrors",namespace:"AWS/DynamoDB",statistic:"Sum",period:300,evaluationPeriods:1,threshold:n,comparisonOperator:"GreaterThanThreshold",dimensions:{TableName:r},alarmActions:i?[i]:void 0}),rdsCpu:(e,a,r,n=80,i)=>({slug:e,environment:a,alarmName:`${e}-${a}-rds-cpu`,metricName:"CPUUtilization",namespace:"AWS/RDS",statistic:"Average",period:300,evaluationPeriods:2,threshold:n,comparisonOperator:"GreaterThanThreshold",dimensions:{DBInstanceIdentifier:r},alarmActions:i?[i]:void 0}),rdsFreeStorage:(e,a,r,n=5368709120,i)=>({slug:e,environment:a,alarmName:`${e}-${a}-rds-storage`,metricName:"FreeStorageSpace",namespace:"AWS/RDS",statistic:"Average",period:300,evaluationPeriods:1,threshold:n,comparisonOperator:"LessThanThreshold",dimensions:{DBInstanceIdentifier:r},alarmActions:i?[i]:void 0,unit:"Bytes"}),sqsQueueDepth:(e,a,r,n=100,i)=>({slug:e,environment:a,alarmName:`${e}-${a}-sqs-depth`,metricName:"ApproximateNumberOfMessagesVisible",namespace:"AWS/SQS",statistic:"Average",period:300,evaluationPeriods:2,threshold:n,comparisonOperator:"GreaterThanThreshold",dimensions:{QueueName:r},alarmActions:i?[i]:void 0}),albUnhealthyTargets:(e,a,r,n,i=1,o)=>({slug:e,environment:a,alarmName:`${e}-${a}-alb-unhealthy`,metricName:"UnHealthyHostCount",namespace:"AWS/ApplicationELB",statistic:"Average",period:300,evaluationPeriods:2,threshold:i,comparisonOperator:"GreaterThanThreshold",dimensions:{LoadBalancer:r,TargetGroup:n},alarmActions:o?[o]:void 0}),sesBounceRate:(e,a,r=5,n)=>({slug:e,environment:a,alarmName:`${e}-${a}-ses-bounce-rate`,metricName:"Reputation.BounceRate",namespace:"AWS/SES",statistic:"Average",period:3600,evaluationPeriods:1,threshold:r/100,comparisonOperator:"GreaterThanThreshold",alarmActions:n?[n]:void 0}),sesComplaintRate:(e,a,r=0.1,n)=>({slug:e,environment:a,alarmName:`${e}-${a}-ses-complaint-rate`,metricName:"Reputation.ComplaintRate",namespace:"AWS/SES",statistic:"Average",period:3600,evaluationPeriods:1,threshold:r/100,comparisonOperator:"GreaterThanThreshold",alarmActions:n?[n]:void 0}),smsDeliveryFailure:(e,a,r,n=10,i)=>({slug:e,environment:a,alarmName:`${e}-${a}-sms-delivery-failure`,metricName:"DirectSendMessagePermanentFailure",namespace:"AWS/Pinpoint",statistic:"Sum",period:300,evaluationPeriods:1,threshold:n,comparisonOperator:"GreaterThanThreshold",dimensions:{ApplicationId:r},alarmActions:i?[i]:void 0}),smsSpendLimit:(e,a,r=100,n)=>({slug:e,environment:a,alarmName:`${e}-${a}-sms-spend-limit`,metricName:"DirectSendMessageSpend",namespace:"AWS/Pinpoint",statistic:"Sum",period:86400,evaluationPeriods:1,threshold:r,comparisonOperator:"GreaterThanThreshold",alarmActions:n?[n]:void 0}),connectMissedCalls:(e,a,r,n=5,i)=>({slug:e,environment:a,alarmName:`${e}-${a}-connect-missed-calls`,metricName:"MissedCalls",namespace:"AWS/Connect",statistic:"Sum",period:3600,evaluationPeriods:1,threshold:n,comparisonOperator:"GreaterThanThreshold",dimensions:{InstanceId:r},alarmActions:i?[i]:void 0})};static DashboardWidgets={metric:(e,a,r,n,i,o)=>({type:"metric",x:e,y:a,width:r,height:n,properties:{metrics:i,title:o||"Metrics",region:"us-east-1",period:300}}),text:(e,a,r,n,i)=>({type:"text",x:e,y:a,width:r,height:n,properties:{markdown:i}}),log:(e,a,r,n,i,o)=>({type:"log",x:e,y:a,width:r,height:n,properties:{query:`SOURCE '${i.join("' | SOURCE '")}'
+`;class Te{static LambdaCode={send:er,receive:rn,deliveryStatus:tn};static createPinpointApp(e){return{[`${e.slug}PinpointApp`]:{Type:"AWS::Pinpoint::App",Properties:{Name:e.name||`${e.slug}-sms`}}}}static createSmsChannel(e){let a={ApplicationId:e.applicationId,Enabled:e.enabled!==!1};if(e.senderId)a.SenderId=e.senderId;if(e.shortCode)a.ShortCode=e.shortCode;return{[`${e.slug}SmsChannel`]:{Type:"AWS::Pinpoint::SMSChannel",Properties:a}}}static createSmsLambdaRole(e){return{[`${e.slug}SmsLambdaRole`]:{Type:"AWS::IAM::Role",Properties:{RoleName:`${e.slug}-sms-lambda-role`,AssumeRolePolicyDocument:{Version:"2012-10-17",Statement:[{Effect:"Allow",Principal:{Service:"lambda.amazonaws.com"},Action:"sts:AssumeRole"}]},ManagedPolicyArns:["arn:aws:iam::aws:policy/service-role/AWSLambdaBasicExecutionRole"],Policies:[{PolicyName:"SmsLambdaPolicy",PolicyDocument:{Version:"2012-10-17",Statement:[{Effect:"Allow",Action:["mobiletargeting:SendMessages","mobiletargeting:GetSmsChannel"],Resource:"*"},{Effect:"Allow",Action:["sns:Publish"],Resource:"*"},{Effect:"Allow",Action:["dynamodb:PutItem","dynamodb:UpdateItem","dynamodb:GetItem","dynamodb:DeleteItem"],Resource:"*"}]}}]}}}}static createSendLambda(e){return{[`${e.slug}SmsSendLambda`]:{Type:"AWS::Lambda::Function",Properties:{FunctionName:`${e.slug}-sms-send`,Runtime:"nodejs20.x",Handler:"index.handler",Role:e.roleArn,Timeout:30,MemorySize:256,Code:{ZipFile:Te.LambdaCode.send},Environment:{Variables:{PINPOINT_APP_ID:e.pinpointAppId,MESSAGE_LOG_TABLE:e.messageLogTable||"",SMS_SENDER_ID:e.senderId||"",SMS_ORIGINATION_NUMBER:e.originationNumber||""}}}}}}static createReceiveLambda(e){return{[`${e.slug}SmsReceiveLambda`]:{Type:"AWS::Lambda::Function",Properties:{FunctionName:`${e.slug}-sms-receive`,Runtime:"nodejs20.x",Handler:"index.handler",Role:e.roleArn,Timeout:30,MemorySize:256,Code:{ZipFile:Te.LambdaCode.receive},Environment:{Variables:{OPT_OUT_TABLE:e.optOutTable||"",MESSAGE_LOG_TABLE:e.messageLogTable||"",NOTIFICATION_TOPIC_ARN:e.notificationTopicArn||"",WEBHOOK_URL:e.webhookUrl||""}}}}}}static createDeliveryStatusLambda(e){return{[`${e.slug}SmsDeliveryStatusLambda`]:{Type:"AWS::Lambda::Function",Properties:{FunctionName:`${e.slug}-sms-delivery-status`,Runtime:"nodejs20.x",Handler:"index.handler",Role:e.roleArn,Timeout:30,MemorySize:256,Code:{ZipFile:Te.LambdaCode.deliveryStatus},Environment:{Variables:{MESSAGE_LOG_TABLE:e.messageLogTable||"",NOTIFICATION_TOPIC_ARN:e.notificationTopicArn||"",WEBHOOK_URL:e.webhookUrl||""}}}}}}static createMessageLogTable(e){return{[`${e.slug}SmsMessageLogTable`]:{Type:"AWS::DynamoDB::Table",Properties:{TableName:`${e.slug}-sms-messages`,BillingMode:"PAY_PER_REQUEST",AttributeDefinitions:[{AttributeName:"messageId",AttributeType:"S"}],KeySchema:[{AttributeName:"messageId",KeyType:"HASH"}],TimeToLiveSpecification:{AttributeName:"ttl",Enabled:!0}}}}}static createOptOutTable(e){return{[`${e.slug}SmsOptOutTable`]:{Type:"AWS::DynamoDB::Table",Properties:{TableName:`${e.slug}-sms-optouts`,BillingMode:"PAY_PER_REQUEST",AttributeDefinitions:[{AttributeName:"phoneNumber",AttributeType:"S"}],KeySchema:[{AttributeName:"phoneNumber",KeyType:"HASH"}]}}}}static createNotificationTopic(e){return{[`${e.slug}SmsNotificationTopic`]:{Type:"AWS::SNS::Topic",Properties:{TopicName:`${e.slug}-sms-notifications`}}}}static createCompleteSetup(e){let a={},r={};Object.assign(a,Te.createPinpointApp({slug:e.slug})),Object.assign(a,Te.createSmsChannel({slug:e.slug,applicationId:{Ref:`${e.slug}PinpointApp`},senderId:e.senderId})),Object.assign(a,Te.createSmsLambdaRole({slug:e.slug})),Object.assign(a,Te.createMessageLogTable({slug:e.slug})),Object.assign(a,Te.createOptOutTable({slug:e.slug})),Object.assign(a,Te.createNotificationTopic({slug:e.slug}));let n={"Fn::GetAtt":[`${e.slug}SmsLambdaRole`,"Arn"]},i={Ref:`${e.slug}PinpointApp`},o={Ref:`${e.slug}SmsMessageLogTable`},c={Ref:`${e.slug}SmsOptOutTable`},u={Ref:`${e.slug}SmsNotificationTopic`};if(Object.assign(a,Te.createSendLambda({slug:e.slug,roleArn:n,pinpointAppId:i,messageLogTable:o,senderId:e.senderId,originationNumber:e.originationNumber})),e.twoWayEnabled)Object.assign(a,Te.createReceiveLambda({slug:e.slug,roleArn:n,optOutTable:c,messageLogTable:o,notificationTopicArn:u,webhookUrl:e.webhookUrl}));return Object.assign(a,Te.createDeliveryStatusLambda({slug:e.slug,roleArn:n,messageLogTable:o,notificationTopicArn:u,webhookUrl:e.webhookUrl})),r[`${e.slug}PinpointAppId`]={Description:"Pinpoint application ID",Value:{Ref:`${e.slug}PinpointApp`}},r[`${e.slug}SmsSendLambdaArn`]={Description:"SMS send Lambda ARN",Value:{"Fn::GetAtt":[`${e.slug}SmsSendLambda`,"Arn"]}},r[`${e.slug}SmsNotificationTopicArn`]={Description:"SMS notification topic ARN",Value:{Ref:`${e.slug}SmsNotificationTopic`}},r[`${e.slug}SmsMessageLogTableName`]={Description:"SMS message log table name",Value:{Ref:`${e.slug}SmsMessageLogTable`}},{resources:a,outputs:r}}}function It(e){return e.replace(/[^a-zA-Z0-9]/g," ").trim().split(/\s+/).map((a)=>a.charAt(0).toUpperCase()+a.slice(1)).join("")||"User"}function sn(e,a){let r=(e||a).replace(/^\/+|\/+$/g,"");if(!r||r.split("/").includes(".."))throw Error(`sftp: invalid homeDirectory for user ${a}`);return r}function on(e){let a=e.storage;if(a?.type==="efs"){let n="fileSystemId"in a?a.fileSystemId:void 0;if(!n||typeof n==="string"&&!n.trim())throw Error("sftp: EFS storage requires fileSystemId, or a fileSystem name defined in infrastructure.fileSystem");return{type:"efs",fileSystemId:n,posixProfile:a.posixProfile}}let r=(a?.type==="s3"?a.bucket??e.bucket:e.bucket)?.trim();if(!r)throw Error("sftp: S3 storage requires bucket, or a storageBucket name defined in infrastructure.storage");return{type:"s3",bucket:r}}function un(e,a,r){let n=a.posixProfile??r;if(!n)throw Error(`sftp: user ${e} requires a posixProfile (uid/gid) on an EFS-backed server`);for(let i of[n.uid,n.gid,...n.secondaryGids??[]])if(!Number.isInteger(i)||i<0||i>4294967295)throw Error(`sftp: user ${e} has an invalid posixProfile id ${i}`);return{Uid:n.uid,Gid:n.gid,...n.secondaryGids?.length?{SecondaryGids:n.secondaryGids}:{}}}function mn(e,a){return typeof e==="string"?`/${e}/${a}`:{"Fn::Sub":[`/\${FileSystemId}/${a}`,{FileSystemId:e}]}}function pn(e){return typeof e==="string"?{"Fn::Sub":"arn:aws:elasticfilesystem:${AWS::Region}:${AWS::AccountId}:file-system/${FileSystemId}".replace("${FileSystemId}",e)}:{"Fn::Sub":["arn:aws:elasticfilesystem:${AWS::Region}:${AWS::AccountId}:file-system/${FileSystemId}",{FileSystemId:e}]}}class ko{static create(e){let a=on(e),r=a.type==="efs"?"EFS":"S3",n=e.endpointType??"PUBLIC";if(n==="VPC"&&(!e.endpointDetails?.vpcId||!e.endpointDetails.subnetIds.length))throw Error("sftp: VPC endpoints require endpointDetails.vpcId and at least one subnet");let i=`${It(e.slug)}${It(e.environment)}Sftp`,o=`${i}Server`,c={},u;if(e.logging!==!1){let d=`${i}LoggingRole`;c[d]={Type:"AWS::IAM::Role",Properties:{AssumeRolePolicyDocument:{Version:"2012-10-17",Statement:[{Effect:"Allow",Principal:{Service:"transfer.amazonaws.com"},Action:"sts:AssumeRole"}]},Policies:[{PolicyName:"TransferLogging",PolicyDocument:{Version:"2012-10-17",Statement:[{Effect:"Allow",Action:["logs:CreateLogGroup","logs:CreateLogStream","logs:DescribeLogStreams","logs:PutLogEvents"],Resource:"arn:aws:logs:*:*:log-group:/aws/transfer/*"}]}}]}},u={"Fn::GetAtt":[d,"Arn"]}}c[o]={Type:"AWS::Transfer::Server",Properties:{Domain:r,EndpointType:n,IdentityProviderType:"SERVICE_MANAGED",Protocols:["SFTP"],...n==="VPC"?{EndpointDetails:{VpcId:e.endpointDetails.vpcId,SubnetIds:e.endpointDetails.subnetIds,...e.endpointDetails.securityGroupIds?.length?{SecurityGroupIds:e.endpointDetails.securityGroupIds}:{},...e.endpointDetails.addressAllocationIds?.length?{AddressAllocationIds:e.endpointDetails.addressAllocationIds}:{}}}:{},...e.securityPolicyName?{SecurityPolicyName:e.securityPolicyName}:{},...u?{LoggingRole:u}:{},Tags:[{Key:"Project",Value:e.slug},{Key:"Environment",Value:e.environment},{Key:"ManagedBy",Value:"ts-cloud"}]}};for(let[d,m]of Object.entries(e.users)){if(!/^[a-zA-Z0-9_.@-]{3,100}$/.test(d))throw Error(`sftp: invalid username ${d}`);if(!m.sshPublicKeys.length)throw Error(`sftp: user ${d} requires at least one SSH public key`);let p=It(d),g=sn(m.homeDirectory,d),h=`${i}${p}User`,y=m.roleArn;if(!y){let f=`${i}${p}Role`,b;if(a.type==="efs")b=[{Effect:"Allow",Action:["elasticfilesystem:ClientMount","elasticfilesystem:ClientWrite","elasticfilesystem:DescribeMountTargets"],Resource:pn(a.fileSystemId)}];else{let T=`arn:aws:s3:::${a.bucket}`;b=[{Effect:"Allow",Action:["s3:ListBucket","s3:GetBucketLocation"],Resource:T,Condition:{StringLike:{"s3:prefix":[g,`${g}/*`]}}},{Effect:"Allow",Action:["s3:GetObject","s3:PutObject","s3:DeleteObject","s3:GetObjectVersion"],Resource:`${T}/${g}/*`}]}c[f]={Type:"AWS::IAM::Role",Properties:{AssumeRolePolicyDocument:{Version:"2012-10-17",Statement:[{Effect:"Allow",Principal:{Service:"transfer.amazonaws.com"},Action:"sts:AssumeRole"}]},Policies:[{PolicyName:"SftpHomeDirectory",PolicyDocument:{Version:"2012-10-17",Statement:b}}]}},y={"Fn::GetAtt":[f,"Arn"]}}c[h]={Type:"AWS::Transfer::User",DependsOn:[o],Properties:{ServerId:{Ref:o},UserName:d,Role:y,HomeDirectoryType:"PATH",HomeDirectory:a.type==="efs"?mn(a.fileSystemId,g):`/${a.bucket}/${g}`,...a.type==="efs"?{PosixProfile:un(d,m,a.posixProfile)}:{},SshPublicKeys:m.sshPublicKeys}}}return{resources:c,serverLogicalId:o,domain:r}}}class Fe{static createBedrockRole(e,a){let{slug:r,environment:n,name:i,models:o=["*"],allowStreaming:c=!0}=a,u=i||l({slug:r,environment:n,resourceType:"bedrock-role"}),d=s(u),m=["bedrock:InvokeModel"];if(c)m.push("bedrock:InvokeModelWithResponseStream");let p=o.map((g)=>g==="*"?"arn:aws:bedrock:*::foundation-model/*":`arn:aws:bedrock:*::foundation-model/${g}`);return{role:{Type:"AWS::IAM::Role",Properties:{RoleName:u,AssumeRolePolicyDocument:{Version:"2012-10-17",Statement:[{Effect:"Allow",Principal:{Service:e},Action:"sts:AssumeRole"}]},Policies:[{PolicyName:`${u}-policy`,PolicyDocument:{Version:"2012-10-17",Statement:[{Effect:"Allow",Action:m,Resource:p}]}}],Tags:[{Key:"Name",Value:u},{Key:"Environment",Value:n}]}},logicalId:d}}static createBedrockPolicy(e){let{slug:a,environment:r,name:n,models:i=["*"],allowInvoke:o=!0,allowStreaming:c=!0,allowAsync:u=!1}=e,d=n||l({slug:a,environment:r,resourceType:"bedrock-policy"}),m=s(d),p=[];if(o)p.push("bedrock:InvokeModel");if(c)p.push("bedrock:InvokeModelWithResponseStream");if(u)p.push("bedrock:InvokeModelAsync");let g=i.map((h)=>h==="*"?"arn:aws:bedrock:*::foundation-model/*":`arn:aws:bedrock:*::foundation-model/${h}`);return{policy:{Type:"AWS::IAM::ManagedPolicy",Properties:{ManagedPolicyName:d,PolicyDocument:{Version:"2012-10-17",Statement:[{Sid:"BedrockModelInvocation",Effect:"Allow",Action:p,Resource:g}]}}},logicalId:m}}static enableBedrockForLambda(e){return Fe.createBedrockRole("lambda.amazonaws.com",e)}static enableBedrockForEcs(e){return Fe.createBedrockRole("ecs-tasks.amazonaws.com",e)}static enableBedrockForEc2(e){return Fe.createBedrockRole("ec2.amazonaws.com",e)}static addBedrockPermissions(e,a=["*"],r=!0){let n=["bedrock:InvokeModel"];if(r)n.push("bedrock:InvokeModelWithResponseStream");let i=a.map((o)=>o==="*"?"arn:aws:bedrock:*::foundation-model/*":`arn:aws:bedrock:*::foundation-model/${o}`);if(!e.Properties.Policies)e.Properties.Policies=[];return e.Properties.Policies.push({PolicyName:"bedrock-permissions",PolicyDocument:{Version:"2012-10-17",Statement:[{Effect:"Allow",Action:n,Resource:i}]}}),e}static Models={Claude3_5_Sonnet:"anthropic.claude-3-5-sonnet-20241022-v2:0",Claude3_5_Haiku:"anthropic.claude-3-5-haiku-20241022-v1:0",Claude3_Opus:"anthropic.claude-3-opus-20240229-v1:0",Claude3_Sonnet:"anthropic.claude-3-sonnet-20240229-v1:0",Claude3_Haiku:"anthropic.claude-3-haiku-20240307-v1:0",TitanTextG1Express:"amazon.titan-text-express-v1",TitanTextG1Lite:"amazon.titan-text-lite-v1",TitanEmbedG1Text:"amazon.titan-embed-text-v1",TitanImageG1:"amazon.titan-image-generator-v1",JurassicUltra:"ai21.j2-ultra-v1",JurassicMid:"ai21.j2-mid-v1",CommandText:"cohere.command-text-v14",CommandLight:"cohere.command-light-text-v14",EmbedEnglish:"cohere.embed-english-v3",EmbedMultilingual:"cohere.embed-multilingual-v3",Llama3_2_1B:"meta.llama3-2-1b-instruct-v1:0",Llama3_2_3B:"meta.llama3-2-3b-instruct-v1:0",Llama3_2_11B:"meta.llama3-2-11b-instruct-v1:0",Llama3_2_90B:"meta.llama3-2-90b-instruct-v1:0",Llama3_1_8B:"meta.llama3-1-8b-instruct-v1:0",Llama3_1_70B:"meta.llama3-1-70b-instruct-v1:0",Llama3_1_405B:"meta.llama3-1-405b-instruct-v1:0",Mistral7B:"mistral.mistral-7b-instruct-v0:2",Mixtral8x7B:"mistral.mixtral-8x7b-instruct-v0:1",MistralLarge:"mistral.mistral-large-2402-v1:0",StableDiffusionXL:"stability.stable-diffusion-xl-v1"};static ModelGroups={AllClaude:["anthropic.claude-3-5-sonnet-20241022-v2:0","anthropic.claude-3-5-haiku-20241022-v1:0","anthropic.claude-3-opus-20240229-v1:0","anthropic.claude-3-sonnet-20240229-v1:0","anthropic.claude-3-haiku-20240307-v1:0"],AllTitan:["amazon.titan-text-express-v1","amazon.titan-text-lite-v1","amazon.titan-embed-text-v1","amazon.titan-image-generator-v1"],AllLlama:["meta.llama3-2-1b-instruct-v1:0","meta.llama3-2-3b-instruct-v1:0","meta.llama3-2-11b-instruct-v1:0","meta.llama3-2-90b-instruct-v1:0","meta.llama3-1-8b-instruct-v1:0","meta.llama3-1-70b-instruct-v1:0","meta.llama3-1-405b-instruct-v1:0"],TextModels:["anthropic.claude-3-5-sonnet-20241022-v2:0","anthropic.claude-3-5-haiku-20241022-v1:0","amazon.titan-text-express-v1","meta.llama3-2-11b-instruct-v1:0","mistral.mistral-7b-instruct-v0:2"],EmbeddingModels:["amazon.titan-embed-text-v1","cohere.embed-english-v3","cohere.embed-multilingual-v3"],ImageModels:["amazon.titan-image-generator-v1","stability.stable-diffusion-xl-v1"]}}class zt{static createPostgres(e){return zt.createRDSInstance("postgres","16.2",e)}static createMysql(e){return zt.createRDSInstance("mysql","8.0.35",e)}static createRDSInstance(e,a,r){let{slug:n,environment:i,instanceClass:o="db.t3.micro",allocatedStorage:c=20,storageType:u="gp3",masterUsername:d="admin",masterPassword:m,databaseName:p,subnetIds:g,securityGroupIds:h,encrypted:y=!0,kmsKeyId:f,multiAz:b=!1,backupRetentionDays:T=7,publiclyAccessible:w=!1,enableCloudwatchLogs:I=!0,deletionProtection:v=!0}=r,N=l({slug:n,environment:i,resourceType:`${e}-db`}),R=s(N),k,x;if(g&&g.length>0){let B=l({slug:n,environment:i,resourceType:"db-subnet-group"});x=s(B),k={Type:"AWS::RDS::DBSubnetGroup",Properties:{DBSubnetGroupName:B,DBSubnetGroupDescription:`Subnet group for ${N}`,SubnetIds:g,Tags:[{Key:"Name",Value:B},{Key:"Environment",Value:i}]}}}let L={Type:"AWS::RDS::DBInstance",Properties:{DBInstanceIdentifier:N,DBInstanceClass:o,Engine:e,EngineVersion:a,MasterUsername:d,MasterUserPassword:m,AllocatedStorage:c,StorageType:u,StorageEncrypted:y,MultiAZ:b,BackupRetentionPeriod:T,PubliclyAccessible:w,DeletionProtection:v,Tags:[{Key:"Name",Value:N},{Key:"Environment",Value:i}]}};if(p)L.Properties.DBName=p;if(f)L.Properties.KmsKeyId=f;if(x)L.Properties.DBSubnetGroupName=P.Ref(x);if(h&&h.length>0)L.Properties.VPCSecurityGroups=h;if(I)L.Properties.EnableCloudwatchLogsExports=e==="postgres"?["postgresql"]:["error","general","slowquery"];return{dbInstance:L,subnetGroup:k,logicalId:R,subnetGroupId:x}}static createReadReplica(e,a){let{slug:r,environment:n,instanceClass:i="db.t3.micro",securityGroupIds:o,publiclyAccessible:c=!1}=a,u=l({slug:r,environment:n,resourceType:"db-replica"}),d=s(u),m={Type:"AWS::RDS::DBInstance",Properties:{DBInstanceIdentifier:u,DBInstanceClass:i,SourceDBInstanceIdentifier:P.Ref(e),PubliclyAccessible:c,Tags:[{Key:"Name",Value:u},{Key:"Environment",Value:n},{Key:"Type",Value:"ReadReplica"}]}};if(o&&o.length>0)m.Properties.VPCSecurityGroups=o;return{replica:m,logicalId:d}}static createParameterGroup(e,a,r){let{slug:n,environment:i,parameters:o={}}=r,c=l({slug:n,environment:i,resourceType:"db-params"}),u=s(c),d=e==="postgres"?`postgres${a.split(".")[0]}`:`mysql${a.split(".")[0]}.${a.split(".")[1]}`;return{parameterGroup:{Type:"AWS::RDS::DBParameterGroup",Properties:{DBParameterGroupName:c,Description:`Parameter group for ${c}`,Family:d,Parameters:o,Tags:[{Key:"Name",Value:c},{Key:"Environment",Value:i}]}},logicalId:u}}static enableBackup(e,a=7){return e.Properties.BackupRetentionPeriod=a,e}static createTable(e){let{slug:a,environment:r,tableName:n,partitionKey:i,sortKey:o,billingMode:c="PAY_PER_REQUEST",readCapacity:u=5,writeCapacity:d=5,streamEnabled:m=!1,streamViewType:p="NEW_AND_OLD_IMAGES",encrypted:g=!0,kmsKeyId:h,pointInTimeRecovery:y=!0,ttlAttribute:f}=e,b=n||l({slug:a,environment:r,resourceType:"table"}),T=s(b),w=[{AttributeName:i.name,AttributeType:i.type}];if(o)w.push({AttributeName:o.name,AttributeType:o.type});let I=[{AttributeName:i.name,KeyType:"HASH"}];if(o)I.push({AttributeName:o.name,KeyType:"RANGE"});let v={Type:"AWS::DynamoDB::Table",Properties:{TableName:b,BillingMode:c,AttributeDefinitions:w,KeySchema:I,Tags:[{Key:"Name",Value:b},{Key:"Environment",Value:r}]}};if(c==="PROVISIONED")v.Properties.ProvisionedThroughput={ReadCapacityUnits:u,WriteCapacityUnits:d};if(m)v.Properties.StreamSpecification={StreamViewType:p};if(g)v.Properties.SSESpecification={SSEEnabled:!0,SSEType:h?"KMS":"AES256",KMSMasterKeyId:h};if(y)v.Properties.PointInTimeRecoverySpecification={PointInTimeRecoveryEnabled:!0};if(f)v.Properties.TimeToLiveSpecification={AttributeName:f,Enabled:!0};return{table:v,logicalId:T}}static addGlobalSecondaryIndex(e,a){let{indexName:r,partitionKey:n,sortKey:i,projectionType:o="ALL",nonKeyAttributes:c,readCapacity:u=5,writeCapacity:d=5}=a;if(!e.Properties.AttributeDefinitions.some((g)=>g.AttributeName===n.name))e.Properties.AttributeDefinitions.push({AttributeName:n.name,AttributeType:n.type});if(i&&!e.Properties.AttributeDefinitions.some((g)=>g.AttributeName===i.name))e.Properties.AttributeDefinitions.push({AttributeName:i.name,AttributeType:i.type});let m=[{AttributeName:n.name,KeyType:"HASH"}];if(i)m.push({AttributeName:i.name,KeyType:"RANGE"});let p={IndexName:r,KeySchema:m,Projection:{ProjectionType:o,NonKeyAttributes:o==="INCLUDE"?c:void 0},ProvisionedThroughput:void 0};if(e.Properties.BillingMode==="PROVISIONED")p.ProvisionedThroughput={ReadCapacityUnits:u,WriteCapacityUnits:d};if(!e.Properties.GlobalSecondaryIndexes)e.Properties.GlobalSecondaryIndexes=[];return e.Properties.GlobalSecondaryIndexes.push(p),e}static enableStreams(e,a="NEW_AND_OLD_IMAGES"){return e.Properties.StreamSpecification={StreamViewType:a},e}static InstanceClasses={T3_Micro:"db.t3.micro",T3_Small:"db.t3.small",T3_Medium:"db.t3.medium",T3_Large:"db.t3.large",T4g_Micro:"db.t4g.micro",T4g_Small:"db.t4g.small",T4g_Medium:"db.t4g.medium",M5_Large:"db.m5.large",M5_XLarge:"db.m5.xlarge",M5_2XLarge:"db.m5.2xlarge",R5_Large:"db.r5.large",R5_XLarge:"db.r5.xlarge",R5_2XLarge:"db.r5.2xlarge"}}class bi{static createRedis(e){let{slug:a,environment:r,nodeType:n="cache.t3.micro",engineVersion:i="7.1",port:o=6379,subnetIds:c,securityGroupIds:u,numCacheClusters:d=2,automaticFailover:m=!0,multiAz:p=!0,clusterMode:g=!1,numNodeGroups:h=1,replicasPerNodeGroup:y=1,atRestEncryption:f=!0,transitEncryption:b=!0,authToken:T,kmsKeyId:w,snapshotRetentionDays:I=7,snapshotWindow:v,maintenanceWindow:N}=e,R=l({slug:a,environment:r,resourceType:"redis"}),k=s(R),x,L;if(c&&c.length>0){let _=l({slug:a,environment:r,resourceType:"cache-subnet-group"});L=s(_),x={Type:"AWS::ElastiCache::SubnetGroup",Properties:{CacheSubnetGroupName:_,Description:`Subnet group for ${R}`,SubnetIds:c,Tags:[{Key:"Name",Value:_},{Key:"Environment",Value:r}]}}}let B={Type:"AWS::ElastiCache::ReplicationGroup",Properties:{ReplicationGroupId:R,ReplicationGroupDescription:`Redis cluster for ${a} ${r}`,Engine:"redis",EngineVersion:i,CacheNodeType:n,Port:o,AutomaticFailoverEnabled:m,MultiAZEnabled:p,AtRestEncryptionEnabled:f,TransitEncryptionEnabled:b,SnapshotRetentionLimit:I,AutoMinorVersionUpgrade:!0,Tags:[{Key:"Name",Value:R},{Key:"Environment",Value:r}]}};if(g)B.Properties.NumNodeGroups=h,B.Properties.ReplicasPerNodeGroup=y;else B.Properties.NumCacheClusters=d;if(T)B.Properties.AuthToken=T;if(w)B.Properties.KmsKeyId=w;if(L)B.Properties.CacheSubnetGroupName=P.Ref(L);if(u&&u.length>0)B.Properties.SecurityGroupIds=u;if(v)B.Properties.SnapshotWindow=v;if(N)B.Properties.PreferredMaintenanceWindow=N;return{replicationGroup:B,subnetGroup:x,logicalId:k,subnetGroupId:L}}static createMemcached(e){let{slug:a,environment:r,nodeType:n="cache.t3.micro",engineVersion:i="1.6.22",port:o=11211,numCacheNodes:c=2,subnetIds:u,securityGroupIds:d,azMode:m="cross-az",preferredAzs:p,maintenanceWindow:g}=e,h=l({slug:a,environment:r,resourceType:"memcached"}),y=s(h),f,b;if(u&&u.length>0){let w=l({slug:a,environment:r,resourceType:"cache-subnet-group"});b=s(w),f={Type:"AWS::ElastiCache::SubnetGroup",Properties:{CacheSubnetGroupName:w,Description:`Subnet group for ${h}`,SubnetIds:u,Tags:[{Key:"Name",Value:w},{Key:"Environment",Value:r}]}}}let T={Type:"AWS::ElastiCache::CacheCluster",Properties:{ClusterName:h,CacheNodeType:n,Engine:"memcached",EngineVersion:i,NumCacheNodes:c,Port:o,AZMode:m,AutoMinorVersionUpgrade:!0,Tags:[{Key:"Name",Value:h},{Key:"Environment",Value:r}]}};if(b)T.Properties.CacheSubnetGroupName=P.Ref(b);if(d&&d.length>0)T.Properties.VpcSecurityGroupIds=d;if(p&&p.length>0)T.Properties.PreferredAvailabilityZones=p;if(g)T.Properties.PreferredMaintenanceWindow=g;return{cluster:T,subnetGroup:f,logicalId:y,subnetGroupId:b}}static enableClusterMode(e,a=3,r=2){return delete e.Properties.NumCacheClusters,e.Properties.NumNodeGroups=a,e.Properties.ReplicasPerNodeGroup=r,e}static createRedisParameterGroup(e,a){let{slug:r,environment:n,parameters:i={}}=a,o=l({slug:r,environment:n,resourceType:"redis-params"}),c=s(o);return{parameterGroup:{Type:"AWS::ElastiCache::ParameterGroup",Properties:{CacheParameterGroupFamily:`redis${e.split(".")[0]}.x`,Description:`Parameter group for ${o}`,Properties:i,Tags:[{Key:"Name",Value:o},{Key:"Environment",Value:n}]}},logicalId:c}}static createMemcachedParameterGroup(e,a){let{slug:r,environment:n,parameters:i={}}=a,o=l({slug:r,environment:n,resourceType:"memcached-params"}),c=s(o);return{parameterGroup:{Type:"AWS::ElastiCache::ParameterGroup",Properties:{CacheParameterGroupFamily:`memcached${e.split(".")[0]}.${e.split(".")[1]}`,Description:`Parameter group for ${o}`,Properties:i,Tags:[{Key:"Name",Value:o},{Key:"Environment",Value:n}]}},logicalId:c}}static NodeTypes={T3_Micro:"cache.t3.micro",T3_Small:"cache.t3.small",T3_Medium:"cache.t3.medium",T4g_Micro:"cache.t4g.micro",T4g_Small:"cache.t4g.small",T4g_Medium:"cache.t4g.medium",M5_Large:"cache.m5.large",M5_XLarge:"cache.m5.xlarge",M5_2XLarge:"cache.m5.2xlarge",R5_Large:"cache.r5.large",R5_XLarge:"cache.r5.xlarge",R5_2XLarge:"cache.r5.2xlarge",R5_4XLarge:"cache.r5.4xlarge",R6g_Large:"cache.r6g.large",R6g_XLarge:"cache.r6g.xlarge",R6g_2XLarge:"cache.r6g.2xlarge"}}class Ee{static createUser(e){let{slug:a,environment:r,userName:n,groups:i,managedPolicyArns:o}=e,c=n||l({slug:a,environment:r,resourceType:"user"}),u=s(c),d={Type:"AWS::IAM::User",Properties:{UserName:c,Tags:[{Key:"Name",Value:c},{Key:"Environment",Value:r}]}};if(i&&i.length>0)d.Properties.Groups=i;if(o&&o.length>0)d.Properties.ManagedPolicyArns=o;return{user:d,logicalId:u}}static createRole(e){let{slug:a,environment:r,roleName:n,servicePrincipal:i,awsPrincipal:o,managedPolicyArns:c}=e,u=n||l({slug:a,environment:r,resourceType:"role"}),d=s(u),m={};if(i)m.Service=i;if(o)m.AWS=o;let p={Type:"AWS::IAM::Role",Properties:{RoleName:u,AssumeRolePolicyDocument:{Version:"2012-10-17",Statement:[{Effect:"Allow",Principal:m,Action:"sts:AssumeRole"}]},Tags:[{Key:"Name",Value:u},{Key:"Environment",Value:r}]}};if(c&&c.length>0)p.Properties.ManagedPolicyArns=c;return{role:p,logicalId:d}}static createGroup(e){let{slug:a,environment:r,groupName:n,managedPolicyArns:i}=e,o=n||l({slug:a,environment:r,resourceType:"group"}),c=s(o),u={Type:"AWS::IAM::Group",Properties:{GroupName:o}};if(i&&i.length>0)u.Properties.ManagedPolicyArns=i;return{group:u,logicalId:c}}static createPolicy(e){let{slug:a,environment:r,policyName:n,description:i,statements:o}=e,c=n||l({slug:a,environment:r,resourceType:"policy"}),u=s(c),d=o.map((m)=>({Sid:m.sid,Effect:m.effect||"Allow",Action:m.actions,Resource:m.resources,Condition:m.conditions}));return{policy:{Type:"AWS::IAM::ManagedPolicy",Properties:{ManagedPolicyName:c,Description:i||`Managed policy for ${c}`,PolicyDocument:{Version:"2012-10-17",Statement:d}}},logicalId:u}}static attachPolicyToRole(e,a){if(!e.Properties.ManagedPolicyArns)e.Properties.ManagedPolicyArns=[];if(!e.Properties.ManagedPolicyArns.includes(a))e.Properties.ManagedPolicyArns.push(a);return e}static attachPolicyToUser(e,a){if(!e.Properties.ManagedPolicyArns)e.Properties.ManagedPolicyArns=[];if(!e.Properties.ManagedPolicyArns.includes(a))e.Properties.ManagedPolicyArns.push(a);return e}static attachPolicyToGroup(e,a){if(!e.Properties.ManagedPolicyArns)e.Properties.ManagedPolicyArns=[];if(!e.Properties.ManagedPolicyArns.includes(a))e.Properties.ManagedPolicyArns.push(a);return e}static addInlinePolicyToRole(e,a,r){if(!e.Properties.Policies)e.Properties.Policies=[];let n=r.map((i)=>({Effect:i.effect||"Allow",Action:i.actions,Resource:i.resources}));return e.Properties.Policies.push({PolicyName:a,PolicyDocument:{Version:"2012-10-17",Statement:n}}),e}static addInlinePolicyToUser(e,a,r){if(!e.Properties.Policies)e.Properties.Policies=[];let n=r.map((i)=>({Effect:i.effect||"Allow",Action:i.actions,Resource:i.resources}));return e.Properties.Policies.push({PolicyName:a,PolicyDocument:{Version:"2012-10-17",Statement:n}}),e}static createAccessKey(e,a){let{slug:r,environment:n,status:i="Active"}=a,o=l({slug:r,environment:n,resourceType:"access-key"}),c=s(o);return{accessKey:{Type:"AWS::IAM::AccessKey",Properties:{UserName:P.Ref(e),Status:i}},logicalId:c}}static createInstanceProfile(e,a){let{slug:r,environment:n,profileName:i}=a,o=i||l({slug:r,environment:n,resourceType:"instance-profile"}),c=s(o);return{instanceProfile:{Type:"AWS::IAM::InstanceProfile",Properties:{InstanceProfileName:o,Roles:[P.Ref(e)]}},logicalId:c}}static ManagedPolicies={AdministratorAccess:"arn:aws:iam::aws:policy/AdministratorAccess",PowerUserAccess:"arn:aws:iam::aws:policy/PowerUserAccess",ReadOnlyAccess:"arn:aws:iam::aws:policy/ReadOnlyAccess",S3FullAccess:"arn:aws:iam::aws:policy/AmazonS3FullAccess",S3ReadOnlyAccess:"arn:aws:iam::aws:policy/AmazonS3ReadOnlyAccess",DynamoDBFullAccess:"arn:aws:iam::aws:policy/AmazonDynamoDBFullAccess",DynamoDBReadOnlyAccess:"arn:aws:iam::aws:policy/AmazonDynamoDBReadOnlyAccess",RDSFullAccess:"arn:aws:iam::aws:policy/AmazonRDSFullAccess",RDSReadOnlyAccess:"arn:aws:iam::aws:policy/AmazonRDSReadOnlyAccess",LambdaFullAccess:"arn:aws:iam::aws:policy/AWSLambda_FullAccess",LambdaReadOnlyAccess:"arn:aws:iam::aws:policy/AWSLambda_ReadOnlyAccess",LambdaBasicExecutionRole:"arn:aws:iam::aws:policy/service-role/AWSLambdaBasicExecutionRole",LambdaVPCAccessExecutionRole:"arn:aws:iam::aws:policy/service-role/AWSLambdaVPCAccessExecutionRole",EC2FullAccess:"arn:aws:iam::aws:policy/AmazonEC2FullAccess",EC2ReadOnlyAccess:"arn:aws:iam::aws:policy/AmazonEC2ReadOnlyAccess",EC2ContainerRegistryReadOnly:"arn:aws:iam::aws:policy/AmazonEC2ContainerRegistryReadOnly",EC2ContainerRegistryPowerUser:"arn:aws:iam::aws:policy/AmazonEC2ContainerRegistryPowerUser",ECSTaskExecutionRole:"arn:aws:iam::aws:policy/service-role/AmazonECSTaskExecutionRolePolicy",ECSFullAccess:"arn:aws:iam::aws:policy/AmazonECS_FullAccess",CloudWatchFullAccess:"arn:aws:iam::aws:policy/CloudWatchFullAccess",CloudWatchLogsFullAccess:"arn:aws:iam::aws:policy/CloudWatchLogsFullAccess",SESFullAccess:"arn:aws:iam::aws:policy/AmazonSESFullAccess",SNSFullAccess:"arn:aws:iam::aws:policy/AmazonSNSFullAccess",SQSFullAccess:"arn:aws:iam::aws:policy/AmazonSQSFullAccess",SecretsManagerReadWrite:"arn:aws:iam::aws:policy/SecretsManagerReadWrite"};static ServicePrincipals={Lambda:"lambda.amazonaws.com",EC2:"ec2.amazonaws.com",ECS:"ecs.amazonaws.com",ECSTaskExecution:"ecs-tasks.amazonaws.com",APIGateway:"apigateway.amazonaws.com",Events:"events.amazonaws.com",States:"states.amazonaws.com",CodeBuild:"codebuild.amazonaws.com",CodeDeploy:"codedeploy.amazonaws.com",CloudFormation:"cloudformation.amazonaws.com"};static createCiCdUser(e){let{slug:a,environment:r,permissions:n,createAccessKey:i=!0}=e,o={},c=[];if(n.s3Buckets&&n.s3Buckets.length>0)c.push({sid:"S3Access",actions:["s3:GetBucketLocation","s3:ListBucket","s3:GetObject","s3:PutObject","s3:DeleteObject","s3:ListBucketMultipartUploads","s3:AbortMultipartUpload"],resources:[...n.s3Buckets,...n.s3Buckets.map((y)=>`${y}/*`)]});if(n.cloudFrontDistributions&&n.cloudFrontDistributions.length>0)c.push({sid:"CloudFrontAccess",actions:["cloudfront:CreateInvalidation","cloudfront:GetInvalidation","cloudfront:ListInvalidations","cloudfront:GetDistribution"],resources:n.cloudFrontDistributions});if(n.ecrRepositories&&n.ecrRepositories.length>0)c.push({sid:"ECRAccess",actions:["ecr:GetAuthorizationToken","ecr:BatchCheckLayerAvailability","ecr:GetDownloadUrlForLayer","ecr:GetRepositoryPolicy","ecr:DescribeRepositories","ecr:ListImages","ecr:DescribeImages","ecr:BatchGetImage","ecr:InitiateLayerUpload","ecr:UploadLayerPart","ecr:CompleteLayerUpload","ecr:PutImage"],resources:n.ecrRepositories}),c.push({sid:"ECRLogin",actions:["ecr:GetAuthorizationToken"],resources:"*"});if(n.ecsServices&&n.ecsServices.length>0)c.push({sid:"ECSAccess",actions:["ecs:DescribeServices","ecs:DescribeTaskDefinition","ecs:DescribeTasks","ecs:ListTasks","ecs:RegisterTaskDefinition","ecs:UpdateService","ecs:RunTask","ecs:StopTask"],resources:n.ecsServices}),c.push({sid:"ECSTaskDefinitions",actions:["ecs:RegisterTaskDefinition","ecs:DeregisterTaskDefinition"],resources:"*"}),c.push({sid:"ECSPassRole",actions:["iam:PassRole"],resources:"*",conditions:{StringLike:{"iam:PassedToService":"ecs-tasks.amazonaws.com"}}});if(n.cloudFormationStacks&&n.cloudFormationStacks.length>0)c.push({sid:"CloudFormationAccess",actions:["cloudformation:CreateStack","cloudformation:UpdateStack","cloudformation:DeleteStack","cloudformation:DescribeStacks","cloudformation:DescribeStackEvents","cloudformation:DescribeStackResources","cloudformation:GetTemplate","cloudformation:ListStackResources","cloudformation:ValidateTemplate"],resources:n.cloudFormationStacks});if(n.lambdaFunctions&&n.lambdaFunctions.length>0)c.push({sid:"LambdaAccess",actions:["lambda:GetFunction","lambda:UpdateFunctionCode","lambda:UpdateFunctionConfiguration","lambda:PublishVersion","lambda:UpdateAlias","lambda:CreateAlias"],resources:n.lambdaFunctions});if(n.secretsManagerSecrets&&n.secretsManagerSecrets.length>0)c.push({sid:"SecretsManagerAccess",actions:["secretsmanager:GetSecretValue","secretsmanager:DescribeSecret"],resources:n.secretsManagerSecrets});let{policy:u,logicalId:d}=Ee.createPolicy({slug:a,environment:r,policyName:l({slug:a,environment:r,resourceType:"cicd-policy"}),description:`CI/CD deployment policy for ${a} (${r})`,statements:c});o[d]=u;let{user:m,logicalId:p}=Ee.createUser({slug:a,environment:r,userName:l({slug:a,environment:r,resourceType:"cicd-user"}),managedPolicyArns:[P.Ref(d)]});o[p]=m;let g,h;if(i){let y=Ee.createAccessKey(p,{slug:a,environment:r});g=y.accessKey,h=y.logicalId,o[h]=g}return{user:m,accessKey:g,policy:u,userLogicalId:p,accessKeyLogicalId:h,policyLogicalId:d,resources:o}}static createCrossAccountRole(e){let{slug:a,environment:r,trustedAccountIds:n,externalId:i,permissions:o,maxSessionDuration:c=3600}=e,u={},{policy:d,logicalId:m}=Ee.createPolicy({slug:a,environment:r,policyName:l({slug:a,environment:r,resourceType:"cross-account-policy"}),description:`Cross-account access policy for ${a} (${r})`,statements:o});u[m]=d;let p=l({slug:a,environment:r,resourceType:"cross-account-role"}),g=s(p),h={};if(i)h.StringEquals={"sts:ExternalId":i};let y={Type:"AWS::IAM::Role",Properties:{RoleName:p,MaxSessionDuration:c,AssumeRolePolicyDocument:{Version:"2012-10-17",Statement:[{Effect:"Allow",Principal:{AWS:n.map((f)=>`arn:aws:iam::${f}:root`)},Action:"sts:AssumeRole",...Object.keys(h).length>0?{Condition:h}:{}}]},ManagedPolicyArns:[P.Ref(m)],Tags:[{Key:"Name",Value:p},{Key:"Environment",Value:r},{Key:"Purpose",Value:"Cross-Account Access"}]}};return u[g]=y,{role:y,policy:d,roleLogicalId:g,policyLogicalId:m,resources:u}}static createCliUser(e){let{slug:a,environment:r,permissions:n="readonly"}=e,i={},o=[],c=[];switch(n){case"readonly":c=[Ee.ManagedPolicies.ReadOnlyAccess];break;case"deploy":o=[{sid:"S3Deploy",actions:["s3:*"],resources:"*"},{sid:"CloudFrontDeploy",actions:["cloudfront:*"],resources:"*"},{sid:"ECSDeploy",actions:["ecs:*"],resources:"*"},{sid:"ECRDeploy",actions:["ecr:*"],resources:"*"},{sid:"LambdaDeploy",actions:["lambda:*"],resources:"*"},{sid:"CloudFormationDeploy",actions:["cloudformation:*"],resources:"*"},{sid:"IAMPassRole",actions:["iam:PassRole"],resources:"*"}];break;case"admin":c=[Ee.ManagedPolicies.AdministratorAccess];break}let u,d;if(o.length>0){let y=Ee.createPolicy({slug:a,environment:r,policyName:l({slug:a,environment:r,resourceType:"cli-policy"}),description:`CLI access policy for ${a} (${r})`,statements:o});u=y.policy,d=y.logicalId,i[d]=u,c=[P.Ref(d)]}let{user:m,logicalId:p}=Ee.createUser({slug:a,environment:r,userName:l({slug:a,environment:r,resourceType:"cli-user"}),managedPolicyArns:c});i[p]=m;let{accessKey:g,logicalId:h}=Ee.createAccessKey(p,{slug:a,environment:r});return i[h]=g,{user:m,accessKey:g,policy:u,userLogicalId:p,accessKeyLogicalId:h,policyLogicalId:d,resources:i}}static CiCdPolicies={s3Deployment:(e)=>[{sid:"S3ListBuckets",actions:["s3:ListBucket","s3:GetBucketLocation"],resources:e},{sid:"S3Objects",actions:["s3:GetObject","s3:PutObject","s3:DeleteObject"],resources:e.map((a)=>`${a}/*`)}],cloudFrontInvalidation:(e)=>[{sid:"CloudFrontInvalidation",actions:["cloudfront:CreateInvalidation","cloudfront:GetInvalidation","cloudfront:ListInvalidations"],resources:e}],ecsDeployment:()=>[{sid:"ECSServices",actions:["ecs:DescribeServices","ecs:UpdateService","ecs:DescribeTaskDefinition","ecs:RegisterTaskDefinition"],resources:"*"},{sid:"ECSPassRole",actions:["iam:PassRole"],resources:"*",conditions:{StringLike:{"iam:PassedToService":"ecs-tasks.amazonaws.com"}}}],ecrPush:(e)=>[{sid:"ECRAuth",actions:["ecr:GetAuthorizationToken"],resources:"*"},{sid:"ECRPush",actions:["ecr:BatchCheckLayerAvailability","ecr:GetDownloadUrlForLayer","ecr:BatchGetImage","ecr:InitiateLayerUpload","ecr:UploadLayerPart","ecr:CompleteLayerUpload","ecr:PutImage"],resources:e}],lambdaDeployment:(e)=>[{sid:"LambdaDeploy",actions:["lambda:GetFunction","lambda:UpdateFunctionCode","lambda:UpdateFunctionConfiguration","lambda:PublishVersion"],resources:e}],cloudFormationDeployment:(e)=>[{sid:"CloudFormationDeploy",actions:["cloudformation:CreateStack","cloudformation:UpdateStack","cloudformation:DescribeStacks","cloudformation:DescribeStackEvents","cloudformation:GetTemplate"],resources:e}]}}class _o{static createRestApi(e){let{slug:a,environment:r,name:n,description:i,endpointType:o="REGIONAL",binaryMediaTypes:c,compressionSize:u}=e,d=n||l({slug:a,environment:r,resourceType:"rest-api"}),m=s(d),p={Type:"AWS::ApiGateway::RestApi",Properties:{Name:d,Description:i||`REST API for ${a} ${r}`,EndpointConfiguration:{Types:[o]},Tags:[{Key:"Name",Value:d},{Key:"Environment",Value:r}]}};if(c&&c.length>0)p.Properties.BinaryMediaTypes=c;if(u!==void 0)p.Properties.MinimumCompressionSize=u;return{restApi:p,logicalId:m}}static createHttpApi(e){let{slug:a,environment:r,name:n,description:i,corsEnabled:o=!0,corsOrigins:c=["*"],corsMethods:u=["GET","POST","PUT","PATCH","DELETE","OPTIONS"],corsHeaders:d=["*"],corsMaxAge:m=86400,corsAllowCredentials:p=!1}=e,g=n||l({slug:a,environment:r,resourceType:"http-api"}),h=s(g),y={Type:"AWS::ApiGatewayV2::Api",Properties:{Name:g,Description:i||`HTTP API for ${a} ${r}`,ProtocolType:"HTTP",Tags:{Name:g,Environment:r}}};if(o)y.Properties.CorsConfiguration={AllowOrigins:c,AllowMethods:u,AllowHeaders:d,MaxAge:m,AllowCredentials:p};return{httpApi:y,logicalId:h}}static createWebSocketApi(e){let{slug:a,environment:r,name:n,description:i}=e,o=n||l({slug:a,environment:r,resourceType:"ws-api"}),c=s(o);return{webSocketApi:{Type:"AWS::ApiGatewayV2::Api",Properties:{Name:o,Description:i||`WebSocket API for ${a} ${r}`,ProtocolType:"WEBSOCKET",Tags:{Name:o,Environment:r}}},logicalId:c}}static createDeployment(e,a){let{slug:r,environment:n,description:i}=a,o=l({slug:r,environment:n,resourceType:"api-deployment"}),c=s(o);return{deployment:{Type:"AWS::ApiGateway::Deployment",Properties:{RestApiId:P.Ref(e),Description:i||`Deployment for ${o}`}},logicalId:c}}static createStage(e,a,r){let{slug:n,environment:i,stageName:o,description:c,cacheEnabled:u=!1,cacheSize:d="0.5",variables:m,throttling:p}=r,g=l({slug:n,environment:i,resourceType:"api-stage"}),h=s(g),y={Type:"AWS::ApiGateway::Stage",Properties:{StageName:o||i,RestApiId:P.Ref(e),DeploymentId:P.Ref(a),Description:c,CacheClusterEnabled:u,Tags:[{Key:"Name",Value:g},{Key:"Environment",Value:i}]}};if(u)y.Properties.CacheClusterSize=d;if(m)y.Properties.Variables=m;if(p)y.Properties.MethodSettings=[{HttpMethod:"*",ResourcePath:"/*",ThrottlingBurstLimit:p.burstLimit,ThrottlingRateLimit:p.rateLimit}];return{stage:y,logicalId:h}}static createAuthorizer(e,a){let{slug:r,environment:n,name:i,type:o,functionArn:c,identitySource:u,userPoolArns:d,ttl:m=300}=a,p=i||l({slug:r,environment:n,resourceType:"api-authorizer"}),g=s(p),h={Type:"AWS::ApiGateway::Authorizer",Properties:{Name:p,Type:o,RestApiId:P.Ref(e),AuthorizerResultTtlInSeconds:m}};if(o==="TOKEN"||o==="REQUEST"){if(!c)throw Error("Lambda authorizer requires functionArn");h.Properties.AuthorizerUri=c,h.Properties.IdentitySource=u||"method.request.header.Authorization"}if(o==="COGNITO_USER_POOLS"){if(!d||d.length===0)throw Error("Cognito authorizer requires userPoolArns");h.Properties.ProviderARNs=d,h.Properties.IdentitySource=u||"method.request.header.Authorization"}return{authorizer:h,logicalId:g}}static setCors(e,a={}){let{origins:r=["*"],methods:n=["GET","POST","PUT","PATCH","DELETE","OPTIONS"],headers:i=["*"],maxAge:o=86400,allowCredentials:c=!1}=a;return e.Properties.CorsConfiguration={AllowOrigins:r,AllowMethods:n,AllowHeaders:i,MaxAge:o,AllowCredentials:c},e}static addThrottling(e,a=5000,r=1e4){if(!e.Properties.MethodSettings)e.Properties.MethodSettings=[];return e.Properties.MethodSettings.push({HttpMethod:"*",ResourcePath:"/*",ThrottlingBurstLimit:a,ThrottlingRateLimit:r}),e}static enableCaching(e,a="0.5",r=300){if(e.Properties.CacheClusterEnabled=!0,e.Properties.CacheClusterSize=a,!e.Properties.MethodSettings)e.Properties.MethodSettings=[];return e.Properties.MethodSettings.push({HttpMethod:"*",ResourcePath:"/*",CachingEnabled:!0,CacheTtlInSeconds:r}),e}static CacheSizes={Small:"0.5",Medium:"1.6",Large:"6.1",XLarge:"13.5",XXLarge:"28.4",XXXLarge:"58.2",Huge:"118",Massive:"237"};static ThrottlingPresets={Light:{burstLimit:100,rateLimit:50},Medium:{burstLimit:500,rateLimit:250},Heavy:{burstLimit:2000,rateLimit:1000},Default:{burstLimit:5000,rateLimit:1e4}}}class ke{static createTopic(e){let{slug:a,environment:r,topicName:n,displayName:i,encrypted:o=!1,kmsKeyId:c}=e,u=n||l({slug:a,environment:r,resourceType:"topic"}),d=s(u),m={Type:"AWS::SNS::Topic",Properties:{TopicName:u,DisplayName:i||u,Tags:[{Key:"Name",Value:u},{Key:"Environment",Value:r}]}};if(o&&c)m.Properties.KmsMasterKeyId=c;return{topic:m,logicalId:d}}static subscribe(e,a){let{slug:r,environment:n,protocol:i,endpoint:o,filterPolicy:c,rawMessageDelivery:u=!1}=a,d=l({slug:r,environment:n,resourceType:"subscription"}),m=o.replace(/[^a-zA-Z0-9]/g,""),p=m.length>12?m.slice(-12):m,g=s(`${d}-${i}-${p}`),h={Type:"AWS::SNS::Subscription",Properties:{TopicArn:P.Ref(e),Protocol:i,Endpoint:o,RawMessageDelivery:u}};if(c)h.Properties.FilterPolicy=c;return{subscription:h,logicalId:g}}static subscribeEmail(e,a,r){return ke.subscribe(e,{...r,protocol:"email",endpoint:a})}static subscribeLambda(e,a,r){return ke.subscribe(e,{...r,protocol:"lambda",endpoint:a,rawMessageDelivery:!0})}static subscribeSqs(e,a,r){return ke.subscribe(e,{...r,protocol:"sqs",endpoint:a})}static subscribeHttp(e,a,r){let n=a.startsWith("https://")?"https":"http";return ke.subscribe(e,{...r,protocol:n,endpoint:a})}static subscribeSms(e,a,r){return ke.subscribe(e,{...r,protocol:"sms",endpoint:a})}static setTopicPolicy(e,a){let{slug:r,environment:n,allowedPrincipals:i,allowedServices:o,actions:c="SNS:Publish"}=a,u=l({slug:r,environment:n,resourceType:"topic-policy"}),d=s(u),m={};if(i)m.AWS=i;if(o)m.Service=o;return{policy:{Type:"AWS::SNS::TopicPolicy",Properties:{Topics:[P.Ref(e)],PolicyDocument:{Version:"2012-10-17",Statement:[{Effect:"Allow",Principal:m,Action:c,Resource:P.Ref(e)}]}}},logicalId:d}}static allowCloudWatchAlarms(e,a){return ke.setTopicPolicy(e,{...a,allowedServices:"cloudwatch.amazonaws.com",actions:"SNS:Publish"})}static allowEventBridge(e,a){return ke.setTopicPolicy(e,{...a,allowedServices:"events.amazonaws.com",actions:"SNS:Publish"})}static allowS3(e,a){return ke.setTopicPolicy(e,{...a,allowedServices:"s3.amazonaws.com",actions:"SNS:Publish"})}static enableEncryption(e,a){if(!e.Properties)e.Properties={};return e.Properties.KmsMasterKeyId=a,e}static addInlineSubscription(e,a,r){if(!e.Properties)e.Properties={};if(!e.Properties.Subscription)e.Properties.Subscription=[];return e.Properties.Subscription.push({Protocol:a,Endpoint:r}),e}static FilterPolicies={eventType:(e)=>({eventType:e}),status:(e)=>({status:e}),numericRange:(e,a,r)=>({[e]:[{numeric:[">=",a,"<=",r]}]}),prefix:(e,a)=>({[e]:[{prefix:a}]}),and:(...e)=>Object.assign({},...e),exists:(e,a)=>({[e]:[{exists:a}]})};static UseCases={createAlertTopic:(e)=>ke.createTopic({...e,topicName:e.topicName||`${e.slug}-${e.environment}-alerts`,displayName:e.displayName||"Alert Notifications"}),createEventFanout:(e)=>ke.createTopic({...e,topicName:e.topicName||`${e.slug}-${e.environment}-events`,displayName:e.displayName||"Event Fanout"}),createNotificationTopic:(e)=>ke.createTopic({...e,topicName:e.topicName||`${e.slug}-${e.environment}-notifications`,displayName:e.displayName||"User Notifications"})}}class xd{static createStateMachine(e){let{slug:a,environment:r,stateMachineName:n,type:i="STANDARD",definition:o,roleArn:c,loggingConfiguration:u,tracingConfiguration:d}=e,m=n||l({slug:a,environment:r,resourceType:"state-machine"}),p=s(m),g,h,y;if(c)y=c;else{let b=l({slug:a,environment:r,resourceType:"state-machine-role"});h=s(b),g={Type:"AWS::IAM::Role",Properties:{RoleName:b,AssumeRolePolicyDocument:{Version:"2012-10-17",Statement:[{Effect:"Allow",Principal:{Service:"states.amazonaws.com"},Action:"sts:AssumeRole"}]},ManagedPolicyArns:["arn:aws:iam::aws:policy/CloudWatchLogsFullAccess"],Tags:[{Key:"Name",Value:b},{Key:"Environment",Value:r}]}},y=P.GetAtt(h,"Arn")}let f={Type:"AWS::StepFunctions::StateMachine",Properties:{StateMachineName:m,StateMachineType:i,DefinitionString:JSON.stringify(o),RoleArn:y,Tags:[{Key:"Name",Value:m},{Key:"Environment",Value:r}]}};if(u)f.Properties.LoggingConfiguration={Level:u.level,IncludeExecutionData:u.includeExecutionData,Destinations:u.destinations?.map((b)=>({CloudWatchLogsLogGroup:{LogGroupArn:b}}))};if(d)f.Properties.TracingConfiguration={Enabled:d.enabled};return{stateMachine:f,logicalId:p,role:g,roleLogicalId:h}}static createLambdaTask(e,a){return{Type:"Task",Resource:"arn:aws:states:::lambda:invoke",Parameters:{FunctionName:e,Payload:a?.parameters||{"Input.$":"$"}},ResultPath:a?.resultPath,Retry:a?.retry,Catch:a?.catch,Next:a?.next,End:a?.end}}static createDynamoDBTask(e,a,r,n){return{Type:"Task",Resource:{GetItem:"arn:aws:states:::dynamodb:getItem",PutItem:"arn:aws:states:::dynamodb:putItem",UpdateItem:"arn:aws:states:::dynamodb:updateItem",DeleteItem:"arn:aws:states:::dynamodb:deleteItem"}[e],Parameters:{TableName:a,...r},ResultPath:n?.resultPath,Retry:n?.retry,Catch:n?.catch,Next:n?.next,End:n?.end}}static createSNSPublishTask(e,a,r){return{Type:"Task",Resource:"arn:aws:states:::sns:publish",Parameters:{TopicArn:e,Message:a},ResultPath:r?.resultPath,Retry:r?.retry,Catch:r?.catch,Next:r?.next,End:r?.end}}static createSQSSendMessageTask(e,a,r){return{Type:"Task",Resource:"arn:aws:states:::sqs:sendMessage",Parameters:{QueueUrl:e,MessageBody:a},ResultPath:r?.resultPath,Retry:r?.retry,Catch:r?.catch,Next:r?.next,End:r?.end}}static createPassState(e){return{Type:"Pass",Result:e?.result,ResultPath:e?.resultPath,Parameters:e?.parameters,Next:e?.next,End:e?.end}}static createWaitState(e){return{Type:"Wait",Seconds:e.seconds,Timestamp:e.timestamp,SecondsPath:e.secondsPath,TimestampPath:e.timestampPath,Next:e.next,End:e.end}}static createChoiceState(e,a){return{Type:"Choice",Choices:e,Default:a}}static createParallelState(e,a){return{Type:"Parallel",Branches:e,ResultPath:a?.resultPath,Retry:a?.retry,Catch:a?.catch,Next:a?.next,End:a?.end}}static createMapState(e,a){return{Type:"Map",ItemsPath:a?.itemsPath||"$.items",Iterator:e,MaxConcurrency:a?.maxConcurrency,ResultPath:a?.resultPath,Retry:a?.retry,Catch:a?.catch,Next:a?.next,End:a?.end}}static createSucceedState(){return{Type:"Succeed"}}static createFailState(e,a){return{Type:"Fail",Error:e,Cause:a}}static RetryPolicies={standard:()=>({ErrorEquals:["States.ALL"],IntervalSeconds:2,MaxAttempts:3,BackoffRate:2}),aggressive:()=>({ErrorEquals:["States.TaskFailed","States.Timeout"],IntervalSeconds:1,MaxAttempts:5,BackoffRate:1.5}),custom:(e,a,r,n)=>({ErrorEquals:e,IntervalSeconds:a,MaxAttempts:r,BackoffRate:n})};static CatchPolicies={all:(e,a)=>({ErrorEquals:["States.ALL"],Next:e,ResultPath:a||"$.error"}),specific:(e,a,r)=>({ErrorEquals:e,Next:a,ResultPath:r||"$.error"})};static Patterns={sequential:(e,a,r)=>{let n={};return r.forEach((i,o)=>{let c=o===r.length-1;n[i.name]={...i.state,Next:c?void 0:r[o+1].name,End:c}}),{Comment:"Sequential workflow",StartAt:r[0].name,States:n}},fanout:(e,a,r)=>({Comment:"Fan-out workflow",StartAt:"Parallel",States:{Parallel:{Type:"Parallel",Branches:r.map((n)=>n.definition),End:!0}}}),map:(e,a,r,n)=>({Comment:"Map workflow",StartAt:"Map",States:{Map:{Type:"Map",ItemsPath:"$.items",Iterator:r,MaxConcurrency:n,End:!0}}}),withErrorHandling:(e,a,r,n)=>({Comment:"Workflow with error handling",StartAt:"Main",States:{Main:{...r,Catch:[{ErrorEquals:["States.ALL"],Next:"ErrorHandler"}],Next:"Success"},ErrorHandler:n,Success:{Type:"Succeed"}}})}}class vi{static createAlarm(e){let{slug:a,environment:r,alarmName:n,metricName:i,namespace:o,statistic:c="Average",period:u=300,evaluationPeriods:d=1,threshold:m,comparisonOperator:p,treatMissingData:g="notBreaching",actionsEnabled:h=!0,alarmActions:y,okActions:f,insufficientDataActions:b,dimensions:T,unit:w,datapointsToAlarm:I}=e,v=n||l({slug:a,environment:r,resourceType:"alarm"}),N=s(v),R={Type:"AWS::CloudWatch::Alarm",Properties:{AlarmName:v,MetricName:i,Namespace:o,Statistic:c,Period:u,EvaluationPeriods:d,Threshold:m,ComparisonOperator:p,TreatMissingData:g,ActionsEnabled:h}};if(y&&y.length>0)R.Properties.AlarmActions=y;if(f&&f.length>0)R.Properties.OKActions=f;if(b&&b.length>0)R.Properties.InsufficientDataActions=b;if(T)R.Properties.Dimensions=Object.entries(T).map(([k,x])=>({Name:k,Value:x}));if(w)R.Properties.Unit=w;if(I!==void 0)R.Properties.DatapointsToAlarm=I;return{alarm:R,logicalId:N}}static createCompositeAlarm(e){let{slug:a,environment:r,alarmName:n,alarmRule:i,actionsEnabled:o=!0,alarmActions:c,okActions:u,insufficientDataActions:d}=e,m=n||l({slug:a,environment:r,resourceType:"composite-alarm"}),p=s(m),g={Type:"AWS::CloudWatch::CompositeAlarm",Properties:{AlarmName:m,AlarmRule:i,ActionsEnabled:o}};if(c&&c.length>0)g.Properties.AlarmActions=c;if(u&&u.length>0)g.Properties.OKActions=u;if(d&&d.length>0)g.Properties.InsufficientDataActions=d;return{alarm:g,logicalId:p}}static createDashboard(e){let{slug:a,environment:r,dashboardName:n,widgets:i}=e,o=n||l({slug:a,environment:r,resourceType:"dashboard"}),c=s(o),u={widgets:i.map((d)=>({type:d.type,x:d.x,y:d.y,width:d.width,height:d.height,properties:d.properties}))};return{dashboard:{Type:"AWS::CloudWatch::Dashboard",Properties:{DashboardName:o,DashboardBody:JSON.stringify(u)}},logicalId:c}}static createLogGroup(e){let{slug:a,environment:r,logGroupName:n,retentionInDays:i,kmsKeyId:o}=e,c=n||l({slug:a,environment:r,resourceType:"log-group"}),u=s(c),d={Type:"AWS::Logs::LogGroup",Properties:{LogGroupName:c}};if(i!==void 0)d.Properties.RetentionInDays=i;if(o)d.Properties.KmsKeyId=o;return{logGroup:d,logicalId:u}}static createLogStream(e,a){let{slug:r,environment:n,logStreamName:i}=a,o=i||l({slug:r,environment:n,resourceType:"log-stream"}),c=s(o);return{logStream:{Type:"AWS::Logs::LogStream",Properties:{LogGroupName:P.Ref(e),LogStreamName:o}},logicalId:c}}static createMetricFilter(e,a){let{slug:r,environment:n,filterName:i,filterPattern:o,metricTransformations:c}=a,u=i||l({slug:r,environment:n,resourceType:"metric-filter"}),d=s(u);return{metricFilter:{Type:"AWS::Logs::MetricFilter",Properties:{LogGroupName:P.Ref(e),FilterPattern:o,MetricTransformations:c.map((m)=>({MetricName:m.metricName,MetricNamespace:m.metricNamespace,MetricValue:m.metricValue,DefaultValue:m.defaultValue,Unit:m.unit}))}},logicalId:d}}static AlarmTypes={highCpu:(e,a,r,n=80,i)=>({slug:e,environment:a,alarmName:`${e}-${a}-high-cpu`,metricName:"CPUUtilization",namespace:"AWS/EC2",statistic:"Average",period:300,evaluationPeriods:2,threshold:n,comparisonOperator:"GreaterThanThreshold",dimensions:{InstanceId:r},alarmActions:i?[i]:void 0}),highMemory:(e,a,r,n=80,i)=>({slug:e,environment:a,alarmName:`${e}-${a}-high-memory`,metricName:"MemoryUtilization",namespace:"System/Linux",statistic:"Average",period:300,evaluationPeriods:2,threshold:n,comparisonOperator:"GreaterThanThreshold",dimensions:{InstanceId:r},alarmActions:i?[i]:void 0}),highDisk:(e,a,r,n=80,i)=>({slug:e,environment:a,alarmName:`${e}-${a}-high-disk`,metricName:"DiskSpaceUtilization",namespace:"System/Linux",statistic:"Average",period:300,evaluationPeriods:2,threshold:n,comparisonOperator:"GreaterThanThreshold",dimensions:{InstanceId:r,Filesystem:"/dev/xvda1",MountPath:"/"},alarmActions:i?[i]:void 0}),lambdaErrors:(e,a,r,n=5,i)=>({slug:e,environment:a,alarmName:`${e}-${a}-lambda-errors`,metricName:"Errors",namespace:"AWS/Lambda",statistic:"Sum",period:300,evaluationPeriods:1,threshold:n,comparisonOperator:"GreaterThanThreshold",dimensions:{FunctionName:r},alarmActions:i?[i]:void 0}),lambdaThrottles:(e,a,r,n=10,i)=>({slug:e,environment:a,alarmName:`${e}-${a}-lambda-throttles`,metricName:"Throttles",namespace:"AWS/Lambda",statistic:"Sum",period:300,evaluationPeriods:1,threshold:n,comparisonOperator:"GreaterThanThreshold",dimensions:{FunctionName:r},alarmActions:i?[i]:void 0}),apiGateway5xxErrors:(e,a,r,n=10,i)=>({slug:e,environment:a,alarmName:`${e}-${a}-api-5xx-errors`,metricName:"5XXError",namespace:"AWS/ApiGateway",statistic:"Sum",period:300,evaluationPeriods:1,threshold:n,comparisonOperator:"GreaterThanThreshold",dimensions:{ApiName:r},alarmActions:i?[i]:void 0}),apiGateway4xxErrors:(e,a,r,n=50,i)=>({slug:e,environment:a,alarmName:`${e}-${a}-api-4xx-errors`,metricName:"4XXError",namespace:"AWS/ApiGateway",statistic:"Sum",period:300,evaluationPeriods:2,threshold:n,comparisonOperator:"GreaterThanThreshold",dimensions:{ApiName:r},alarmActions:i?[i]:void 0}),dynamoDBThrottles:(e,a,r,n=5,i)=>({slug:e,environment:a,alarmName:`${e}-${a}-dynamodb-throttles`,metricName:"UserErrors",namespace:"AWS/DynamoDB",statistic:"Sum",period:300,evaluationPeriods:1,threshold:n,comparisonOperator:"GreaterThanThreshold",dimensions:{TableName:r},alarmActions:i?[i]:void 0}),rdsCpu:(e,a,r,n=80,i)=>({slug:e,environment:a,alarmName:`${e}-${a}-rds-cpu`,metricName:"CPUUtilization",namespace:"AWS/RDS",statistic:"Average",period:300,evaluationPeriods:2,threshold:n,comparisonOperator:"GreaterThanThreshold",dimensions:{DBInstanceIdentifier:r},alarmActions:i?[i]:void 0}),rdsFreeStorage:(e,a,r,n=5368709120,i)=>({slug:e,environment:a,alarmName:`${e}-${a}-rds-storage`,metricName:"FreeStorageSpace",namespace:"AWS/RDS",statistic:"Average",period:300,evaluationPeriods:1,threshold:n,comparisonOperator:"LessThanThreshold",dimensions:{DBInstanceIdentifier:r},alarmActions:i?[i]:void 0,unit:"Bytes"}),sqsQueueDepth:(e,a,r,n=100,i)=>({slug:e,environment:a,alarmName:`${e}-${a}-sqs-depth`,metricName:"ApproximateNumberOfMessagesVisible",namespace:"AWS/SQS",statistic:"Average",period:300,evaluationPeriods:2,threshold:n,comparisonOperator:"GreaterThanThreshold",dimensions:{QueueName:r},alarmActions:i?[i]:void 0}),albUnhealthyTargets:(e,a,r,n,i=1,o)=>({slug:e,environment:a,alarmName:`${e}-${a}-alb-unhealthy`,metricName:"UnHealthyHostCount",namespace:"AWS/ApplicationELB",statistic:"Average",period:300,evaluationPeriods:2,threshold:i,comparisonOperator:"GreaterThanThreshold",dimensions:{LoadBalancer:r,TargetGroup:n},alarmActions:o?[o]:void 0}),sesBounceRate:(e,a,r=5,n)=>({slug:e,environment:a,alarmName:`${e}-${a}-ses-bounce-rate`,metricName:"Reputation.BounceRate",namespace:"AWS/SES",statistic:"Average",period:3600,evaluationPeriods:1,threshold:r/100,comparisonOperator:"GreaterThanThreshold",alarmActions:n?[n]:void 0}),sesComplaintRate:(e,a,r=0.1,n)=>({slug:e,environment:a,alarmName:`${e}-${a}-ses-complaint-rate`,metricName:"Reputation.ComplaintRate",namespace:"AWS/SES",statistic:"Average",period:3600,evaluationPeriods:1,threshold:r/100,comparisonOperator:"GreaterThanThreshold",alarmActions:n?[n]:void 0}),smsDeliveryFailure:(e,a,r,n=10,i)=>({slug:e,environment:a,alarmName:`${e}-${a}-sms-delivery-failure`,metricName:"DirectSendMessagePermanentFailure",namespace:"AWS/Pinpoint",statistic:"Sum",period:300,evaluationPeriods:1,threshold:n,comparisonOperator:"GreaterThanThreshold",dimensions:{ApplicationId:r},alarmActions:i?[i]:void 0}),smsSpendLimit:(e,a,r=100,n)=>({slug:e,environment:a,alarmName:`${e}-${a}-sms-spend-limit`,metricName:"DirectSendMessageSpend",namespace:"AWS/Pinpoint",statistic:"Sum",period:86400,evaluationPeriods:1,threshold:r,comparisonOperator:"GreaterThanThreshold",alarmActions:n?[n]:void 0}),connectMissedCalls:(e,a,r,n=5,i)=>({slug:e,environment:a,alarmName:`${e}-${a}-connect-missed-calls`,metricName:"MissedCalls",namespace:"AWS/Connect",statistic:"Sum",period:3600,evaluationPeriods:1,threshold:n,comparisonOperator:"GreaterThanThreshold",dimensions:{InstanceId:r},alarmActions:i?[i]:void 0})};static DashboardWidgets={metric:(e,a,r,n,i,o)=>({type:"metric",x:e,y:a,width:r,height:n,properties:{metrics:i,title:o||"Metrics",region:"us-east-1",period:300}}),text:(e,a,r,n,i)=>({type:"text",x:e,y:a,width:r,height:n,properties:{markdown:i}}),log:(e,a,r,n,i,o)=>({type:"log",x:e,y:a,width:r,height:n,properties:{query:`SOURCE '${i.join("' | SOURCE '")}'
 | fields @timestamp, @message
 | sort @timestamp desc
 | limit 20`,region:"us-east-1",title:o||"Logs"}})};static RetentionPeriods={ONE_DAY:1,THREE_DAYS:3,FIVE_DAYS:5,ONE_WEEK:7,TWO_WEEKS:14,ONE_MONTH:30,TWO_MONTHS:60,THREE_MONTHS:90,FOUR_MONTHS:120,FIVE_MONTHS:150,SIX_MONTHS:180,ONE_YEAR:365,THIRTEEN_MONTHS:400,EIGHTEEN_MONTHS:545,TWO_YEARS:731,FIVE_YEARS:1827,TEN_YEARS:3653,NEVER_EXPIRE:void 0};static FilterPatterns={errors:"[time, request_id, event_type = ERROR*, ...]",all:"",jsonField:(e,a)=>`{ $.${e} = "${a}" }`,httpStatus:(e)=>`[..., status_code = ${e}, ...]`,http4xx:"[..., status_code = 4*, ...]",http5xx:"[..., status_code = 5*, ...]"};static createApplicationDashboard(e){let{slug:a,environment:r,region:n="us-east-1",components:i={}}=e,o=[],c=0;if(o.push({type:"text",x:0,y:c,width:24,height:1,properties:{markdown:`# ${a.toUpperCase()} Dashboard (${r})`}}),c+=1,i.ec2InstanceIds&&i.ec2InstanceIds.length>0)o.push({type:"text",x:0,y:c,width:24,height:1,properties:{markdown:"## EC2 Instances"}}),c+=1,o.push({type:"metric",x:0,y:c,width:8,height:6,properties:{title:"CPU Utilization",region:n,metrics:i.ec2InstanceIds.map((u)=>["AWS/EC2","CPUUtilization","InstanceId",u]),period:300,stat:"Average"}}),o.push({type:"metric",x:8,y:c,width:8,height:6,properties:{title:"Network Traffic",region:n,metrics:[...i.ec2InstanceIds.flatMap((u)=>[["AWS/EC2","NetworkIn","InstanceId",u,{label:`${u} In`}],["AWS/EC2","NetworkOut","InstanceId",u,{label:`${u} Out`}]])],period:300,stat:"Sum"}}),o.push({type:"metric",x:16,y:c,width:8,height:6,properties:{title:"Status Checks",region:n,metrics:i.ec2InstanceIds.map((u)=>["AWS/EC2","StatusCheckFailed","InstanceId",u]),period:60,stat:"Maximum"}}),c+=6;if(i.lambdaFunctionNames&&i.lambdaFunctionNames.length>0)o.push({type:"text",x:0,y:c,width:24,height:1,properties:{markdown:"## Lambda Functions"}}),c+=1,o.push({type:"metric",x:0,y:c,width:8,height:6,properties:{title:"Invocations",region:n,metrics:i.lambdaFunctionNames.map((u)=>["AWS/Lambda","Invocations","FunctionName",u]),period:300,stat:"Sum"}}),o.push({type:"metric",x:8,y:c,width:8,height:6,properties:{title:"Duration",region:n,metrics:i.lambdaFunctionNames.map((u)=>["AWS/Lambda","Duration","FunctionName",u]),period:300,stat:"Average"}}),o.push({type:"metric",x:16,y:c,width:8,height:6,properties:{title:"Errors",region:n,metrics:i.lambdaFunctionNames.map((u)=>["AWS/Lambda","Errors","FunctionName",u]),period:300,stat:"Sum"}}),c+=6;if(i.ecsClusterName&&i.ecsServiceName)o.push({type:"text",x:0,y:c,width:24,height:1,properties:{markdown:"## ECS Service"}}),c+=1,o.push({type:"metric",x:0,y:c,width:8,height:6,properties:{title:"CPU Utilization",region:n,metrics:[["AWS/ECS","CPUUtilization","ClusterName",i.ecsClusterName,"ServiceName",i.ecsServiceName]],period:300,stat:"Average"}}),o.push({type:"metric",x:8,y:c,width:8,height:6,properties:{title:"Memory Utilization",region:n,metrics:[["AWS/ECS","MemoryUtilization","ClusterName",i.ecsClusterName,"ServiceName",i.ecsServiceName]],period:300,stat:"Average"}}),o.push({type:"metric",x:16,y:c,width:8,height:6,properties:{title:"Running Tasks",region:n,metrics:[["ECS/ContainerInsights","RunningTaskCount","ClusterName",i.ecsClusterName,"ServiceName",i.ecsServiceName]],period:60,stat:"Average"}}),c+=6;if(i.albName)o.push({type:"text",x:0,y:c,width:24,height:1,properties:{markdown:"## Application Load Balancer"}}),c+=1,o.push({type:"metric",x:0,y:c,width:8,height:6,properties:{title:"Request Count",region:n,metrics:[["AWS/ApplicationELB","RequestCount","LoadBalancer",i.albName]],period:60,stat:"Sum"}}),o.push({type:"metric",x:8,y:c,width:8,height:6,properties:{title:"Response Time",region:n,metrics:[["AWS/ApplicationELB","TargetResponseTime","LoadBalancer",i.albName]],period:60,stat:"Average"}}),o.push({type:"metric",x:16,y:c,width:8,height:6,properties:{title:"HTTP Errors",region:n,metrics:[["AWS/ApplicationELB","HTTPCode_Target_4XX_Count","LoadBalancer",i.albName,{label:"4XX"}],["AWS/ApplicationELB","HTTPCode_Target_5XX_Count","LoadBalancer",i.albName,{label:"5XX"}]],period:60,stat:"Sum"}}),c+=6;if(i.rdsInstanceId)o.push({type:"text",x:0,y:c,width:24,height:1,properties:{markdown:"## RDS Database"}}),c+=1,o.push({type:"metric",x:0,y:c,width:8,height:6,properties:{title:"CPU Utilization",region:n,metrics:[["AWS/RDS","CPUUtilization","DBInstanceIdentifier",i.rdsInstanceId]],period:300,stat:"Average"}}),o.push({type:"metric",x:8,y:c,width:8,height:6,properties:{title:"Database Connections",region:n,metrics:[["AWS/RDS","DatabaseConnections","DBInstanceIdentifier",i.rdsInstanceId]],period:60,stat:"Sum"}}),o.push({type:"metric",x:16,y:c,width:8,height:6,properties:{title:"Free Storage Space",region:n,metrics:[["AWS/RDS","FreeStorageSpace","DBInstanceIdentifier",i.rdsInstanceId]],period:300,stat:"Average"}}),c+=6;if(i.sqsQueueNames&&i.sqsQueueNames.length>0)o.push({type:"text",x:0,y:c,width:24,height:1,properties:{markdown:"## SQS Queues"}}),c+=1,o.push({type:"metric",x:0,y:c,width:12,height:6,properties:{title:"Messages Visible",region:n,metrics:i.sqsQueueNames.map((u)=>["AWS/SQS","ApproximateNumberOfMessagesVisible","QueueName",u]),period:60,stat:"Sum"}}),o.push({type:"metric",x:12,y:c,width:12,height:6,properties:{title:"Message Age",region:n,metrics:i.sqsQueueNames.map((u)=>["AWS/SQS","ApproximateAgeOfOldestMessage","QueueName",u]),period:60,stat:"Maximum"}}),c+=6;if(i.logGroupNames&&i.logGroupNames.length>0)o.push({type:"text",x:0,y:c,width:24,height:1,properties:{markdown:"## Application Logs"}}),c+=1,o.push({type:"log",x:0,y:c,width:24,height:6,properties:{query:`SOURCE '${i.logGroupNames.join("' | SOURCE '")}'
 | fields @timestamp, @message
 | filter @message like /ERROR|WARN|Exception/
 | sort @timestamp desc
-| limit 50`,region:n,title:"Recent Errors and Warnings"}}),c+=6;return vi.createDashboard({slug:a,environment:r,widgets:o})}static DashboardTemplates={staticWebsite:(e)=>({slug:e.slug,environment:e.environment,widgets:[{type:"text",x:0,y:0,width:24,height:1,properties:{markdown:`# ${e.slug.toUpperCase()} Static Website Dashboard`}},{type:"metric",x:0,y:1,width:8,height:6,properties:{title:"CloudFront Requests",region:"us-east-1",metrics:[["AWS/CloudFront","Requests","DistributionId",e.cloudFrontDistributionId,"Region","Global"]],period:300,stat:"Sum"}},{type:"metric",x:8,y:1,width:8,height:6,properties:{title:"Error Rate",region:"us-east-1",metrics:[["AWS/CloudFront","4xxErrorRate","DistributionId",e.cloudFrontDistributionId,"Region","Global",{label:"4XX"}],["AWS/CloudFront","5xxErrorRate","DistributionId",e.cloudFrontDistributionId,"Region","Global",{label:"5XX"}]],period:300,stat:"Average"}},{type:"metric",x:16,y:1,width:8,height:6,properties:{title:"Bytes Downloaded",region:"us-east-1",metrics:[["AWS/CloudFront","BytesDownloaded","DistributionId",e.cloudFrontDistributionId,"Region","Global"]],period:300,stat:"Sum"}},{type:"metric",x:0,y:7,width:12,height:6,properties:{title:"S3 Bucket Size",region:e.region||"us-east-1",metrics:[["AWS/S3","BucketSizeBytes","BucketName",e.s3BucketName,"StorageType","StandardStorage"]],period:86400,stat:"Average"}},{type:"metric",x:12,y:7,width:12,height:6,properties:{title:"S3 Number of Objects",region:e.region||"us-east-1",metrics:[["AWS/S3","NumberOfObjects","BucketName",e.s3BucketName,"StorageType","AllStorageTypes"]],period:86400,stat:"Average"}}]}),serverlessApi:(e)=>({slug:e.slug,environment:e.environment,widgets:[{type:"text",x:0,y:0,width:24,height:1,properties:{markdown:`# ${e.slug.toUpperCase()} Serverless API Dashboard`}},{type:"metric",x:0,y:1,width:8,height:6,properties:{title:"API Requests",region:e.region||"us-east-1",metrics:[["AWS/ApiGateway","Count","ApiName",e.apiGatewayName]],period:60,stat:"Sum"}},{type:"metric",x:8,y:1,width:8,height:6,properties:{title:"API Latency",region:e.region||"us-east-1",metrics:[["AWS/ApiGateway","Latency","ApiName",e.apiGatewayName]],period:60,stat:"Average"}},{type:"metric",x:16,y:1,width:8,height:6,properties:{title:"API Errors",region:e.region||"us-east-1",metrics:[["AWS/ApiGateway","4XXError","ApiName",e.apiGatewayName,{label:"4XX"}],["AWS/ApiGateway","5XXError","ApiName",e.apiGatewayName,{label:"5XX"}]],period:60,stat:"Sum"}},...e.lambdaFunctionNames.map((a,r)=>({type:"metric",x:r%3*8,y:7+Math.floor(r/3)*6,width:8,height:6,properties:{title:`${a} Metrics`,region:e.region||"us-east-1",metrics:[["AWS/Lambda","Invocations","FunctionName",a],["AWS/Lambda","Duration","FunctionName",a],["AWS/Lambda","Errors","FunctionName",a]],period:300,stat:"Sum"}}))]}),containerService:(e)=>({slug:e.slug,environment:e.environment,widgets:[{type:"text",x:0,y:0,width:24,height:1,properties:{markdown:`# ${e.slug.toUpperCase()} Container Service Dashboard`}},{type:"metric",x:0,y:1,width:8,height:6,properties:{title:"ECS CPU",region:e.region||"us-east-1",metrics:[["AWS/ECS","CPUUtilization","ClusterName",e.ecsClusterName,"ServiceName",e.ecsServiceName]],period:60,stat:"Average"}},{type:"metric",x:8,y:1,width:8,height:6,properties:{title:"ECS Memory",region:e.region||"us-east-1",metrics:[["AWS/ECS","MemoryUtilization","ClusterName",e.ecsClusterName,"ServiceName",e.ecsServiceName]],period:60,stat:"Average"}},{type:"metric",x:16,y:1,width:8,height:6,properties:{title:"Running Tasks",region:e.region||"us-east-1",metrics:[["ECS/ContainerInsights","RunningTaskCount","ClusterName",e.ecsClusterName,"ServiceName",e.ecsServiceName]],period:60,stat:"Average"}},{type:"metric",x:0,y:7,width:8,height:6,properties:{title:"ALB Requests",region:e.region||"us-east-1",metrics:[["AWS/ApplicationELB","RequestCount","LoadBalancer",e.albName]],period:60,stat:"Sum"}},{type:"metric",x:8,y:7,width:8,height:6,properties:{title:"Response Time",region:e.region||"us-east-1",metrics:[["AWS/ApplicationELB","TargetResponseTime","LoadBalancer",e.albName]],period:60,stat:"Average"}},{type:"metric",x:16,y:7,width:8,height:6,properties:{title:"Healthy Hosts",region:e.region||"us-east-1",metrics:[["AWS/ApplicationELB","HealthyHostCount","LoadBalancer",e.albName]],period:60,stat:"Average"}},...e.rdsInstanceId?[{type:"metric",x:0,y:13,width:12,height:6,properties:{title:"RDS CPU",region:e.region||"us-east-1",metrics:[["AWS/RDS","CPUUtilization","DBInstanceIdentifier",e.rdsInstanceId]],period:300,stat:"Average"}},{type:"metric",x:12,y:13,width:12,height:6,properties:{title:"RDS Connections",region:e.region||"us-east-1",metrics:[["AWS/RDS","DatabaseConnections","DBInstanceIdentifier",e.rdsInstanceId]],period:60,stat:"Sum"}}]:[]]})};static Config={createAlarmConfig:(e)=>{let{metricName:a,namespace:r,threshold:n,comparisonOperator:i="GreaterThanThreshold",evaluationPeriods:o=1,period:c=300,statistic:u="Average",treatMissingData:d="missing"}=e;return{MetricName:a,Namespace:r,Threshold:n,ComparisonOperator:i,EvaluationPeriods:o,Period:c,Statistic:u,TreatMissingData:d}},namespaces:{ec2:"AWS/EC2",ecs:"AWS/ECS",lambda:"AWS/Lambda",rds:"AWS/RDS",sqs:"AWS/SQS",sns:"AWS/SNS",s3:"AWS/S3",cloudfront:"AWS/CloudFront",alb:"AWS/ApplicationELB",nlb:"AWS/NetworkELB",apiGateway:"AWS/ApiGateway",dynamodb:"AWS/DynamoDB",elasticache:"AWS/ElastiCache"},comparisonOperators:{greaterThan:"GreaterThanThreshold",greaterOrEqual:"GreaterThanOrEqualToThreshold",lessThan:"LessThanThreshold",lessOrEqual:"LessThanOrEqualToThreshold"},metrics:{ec2:{cpu:{metricName:"CPUUtilization",namespace:"AWS/EC2"},networkIn:{metricName:"NetworkIn",namespace:"AWS/EC2"},networkOut:{metricName:"NetworkOut",namespace:"AWS/EC2"},statusCheck:{metricName:"StatusCheckFailed",namespace:"AWS/EC2"}},ecs:{cpu:{metricName:"CPUUtilization",namespace:"AWS/ECS"},memory:{metricName:"MemoryUtilization",namespace:"AWS/ECS"}},lambda:{invocations:{metricName:"Invocations",namespace:"AWS/Lambda"},errors:{metricName:"Errors",namespace:"AWS/Lambda"},duration:{metricName:"Duration",namespace:"AWS/Lambda"},throttles:{metricName:"Throttles",namespace:"AWS/Lambda"},concurrentExecutions:{metricName:"ConcurrentExecutions",namespace:"AWS/Lambda"}},rds:{cpu:{metricName:"CPUUtilization",namespace:"AWS/RDS"},connections:{metricName:"DatabaseConnections",namespace:"AWS/RDS"},freeStorage:{metricName:"FreeStorageSpace",namespace:"AWS/RDS"},readLatency:{metricName:"ReadLatency",namespace:"AWS/RDS"},writeLatency:{metricName:"WriteLatency",namespace:"AWS/RDS"}},alb:{requestCount:{metricName:"RequestCount",namespace:"AWS/ApplicationELB"},responseTime:{metricName:"TargetResponseTime",namespace:"AWS/ApplicationELB"},httpCode4xx:{metricName:"HTTPCode_Target_4XX_Count",namespace:"AWS/ApplicationELB"},httpCode5xx:{metricName:"HTTPCode_Target_5XX_Count",namespace:"AWS/ApplicationELB"},healthyHosts:{metricName:"HealthyHostCount",namespace:"AWS/ApplicationELB"}},sqs:{messagesVisible:{metricName:"ApproximateNumberOfMessagesVisible",namespace:"AWS/SQS"},messagesDelayed:{metricName:"ApproximateNumberOfMessagesDelayed",namespace:"AWS/SQS"},messageAge:{metricName:"ApproximateAgeOfOldestMessage",namespace:"AWS/SQS"}}},presets:{highCpu:(e=80)=>({metricName:"CPUUtilization",threshold:e,comparisonOperator:"GreaterThanThreshold",evaluationPeriods:3,period:300,statistic:"Average"}),highMemory:(e=80)=>({metricName:"MemoryUtilization",threshold:e,comparisonOperator:"GreaterThanThreshold",evaluationPeriods:3,period:300,statistic:"Average"}),highErrors:(e=10)=>({metricName:"Errors",threshold:e,comparisonOperator:"GreaterThanThreshold",evaluationPeriods:1,period:60,statistic:"Sum"}),highLatency:(e=5000)=>({metricName:"Duration",threshold:e,comparisonOperator:"GreaterThanThreshold",evaluationPeriods:3,period:300,statistic:"Average"}),lowHealthyHosts:(e=1)=>({metricName:"HealthyHostCount",namespace:"AWS/ApplicationELB",threshold:e,comparisonOperator:"LessThanThreshold",evaluationPeriods:2,period:60,statistic:"Minimum"}),queueDepth:(e=1000)=>({metricName:"ApproximateNumberOfMessagesVisible",namespace:"AWS/SQS",threshold:e,comparisonOperator:"GreaterThanThreshold",evaluationPeriods:3,period:300,statistic:"Average"}),lowStorage:(e=10737418240)=>({metricName:"FreeStorageSpace",namespace:"AWS/RDS",threshold:e,comparisonOperator:"LessThanThreshold",evaluationPeriods:1,period:300,statistic:"Average"})}}}class we{static createUserPool(e){let{slug:a,environment:r,userPoolName:n,aliasAttributes:i,autoVerifiedAttributes:o,passwordPolicy:c,mfaConfiguration:u,emailConfiguration:d,smsConfiguration:m,lambdaTriggers:p,userPoolAddOns:g,accountRecoverySetting:h}=e,y=n||l({slug:a,environment:r,resourceType:"user-pool"}),f=s(y),b={Type:"AWS::Cognito::UserPool",Properties:{UserPoolName:y,Policies:c?{PasswordPolicy:{MinimumLength:c.minimumLength,RequireLowercase:c.requireLowercase,RequireUppercase:c.requireUppercase,RequireNumbers:c.requireNumbers,RequireSymbols:c.requireSymbols,TemporaryPasswordValidityDays:c.temporaryPasswordValidityDays}}:void 0,MfaConfiguration:u,Schema:[{Name:"email",AttributeDataType:"String",Required:!0,Mutable:!1}]}};if(i&&i.length>0)b.Properties.UsernameAttributes=i;if(o&&o.length>0)b.Properties.AutoVerifiedAttributes=o;if(d)b.Properties.EmailConfiguration={EmailSendingAccount:d.emailSendingAccount,From:d.from,ReplyToEmailAddress:d.replyToEmailAddress,SourceArn:d.sourceArn,ConfigurationSet:d.configurationSet};if(m)b.Properties.SmsConfiguration={ExternalId:m.externalId,SnsCallerArn:m.snsCallerArn};if(p)b.Properties.LambdaConfig={PreSignUp:p.preSignUp,PostConfirmation:p.postConfirmation,PreAuthentication:p.preAuthentication,PostAuthentication:p.postAuthentication,CustomMessage:p.customMessage,DefineAuthChallenge:p.defineAuthChallenge,CreateAuthChallenge:p.createAuthChallenge,VerifyAuthChallengeResponse:p.verifyAuthChallengeResponse,PreTokenGeneration:p.preTokenGeneration,UserMigration:p.userMigration};if(g)b.Properties.UserPoolAddOns={AdvancedSecurityMode:g.advancedSecurityMode};if(h)b.Properties.AccountRecoverySetting={RecoveryMechanisms:h.recoveryMechanisms};return{userPool:b,logicalId:f}}static createUserPoolClient(e,a){let{slug:r,environment:n,clientName:i,generateSecret:o=!1,refreshTokenValidity:c,accessTokenValidity:u,idTokenValidity:d,tokenValidityUnits:m,readAttributes:p,writeAttributes:g,explicitAuthFlows:h,preventUserExistenceErrors:y,enableTokenRevocation:f,callbackURLs:b,logoutURLs:T,allowedOAuthFlows:w,allowedOAuthScopes:I,allowedOAuthFlowsUserPoolClient:v,supportedIdentityProviders:N}=a,R=i||l({slug:r,environment:n,resourceType:"user-pool-client"}),k=s(R);return{client:{Type:"AWS::Cognito::UserPoolClient",Properties:{ClientName:R,UserPoolId:P.Ref(e),GenerateSecret:o,RefreshTokenValidity:c,AccessTokenValidity:u,IdTokenValidity:d,TokenValidityUnits:m,ReadAttributes:p,WriteAttributes:g,ExplicitAuthFlows:h,PreventUserExistenceErrors:y,EnableTokenRevocation:f,CallbackURLs:b,LogoutURLs:T,AllowedOAuthFlows:w,AllowedOAuthScopes:I,AllowedOAuthFlowsUserPoolClient:v,SupportedIdentityProviders:N}},logicalId:k}}static createUserPoolDomain(e,a){let{slug:r,environment:n,domain:i,customDomainConfig:o}=a,c=l({slug:r,environment:n,resourceType:"user-pool-domain"}),u=s(c);return{domain:{Type:"AWS::Cognito::UserPoolDomain",Properties:{Domain:i,UserPoolId:P.Ref(e),CustomDomainConfig:o}},logicalId:u}}static createIdentityPool(e){let{slug:a,environment:r,identityPoolName:n,allowUnauthenticatedIdentities:i=!1,cognitoIdentityProviders:o,supportedLoginProviders:c,samlProviderARNs:u,openIdConnectProviderARNs:d}=e,m=n||l({slug:a,environment:r,resourceType:"identity-pool"}),p=s(m);return{identityPool:{Type:"AWS::Cognito::IdentityPool",Properties:{IdentityPoolName:m,AllowUnauthenticatedIdentities:i,CognitoIdentityProviders:o,SupportedLoginProviders:c,SamlProviderARNs:u,OpenIdConnectProviderARNs:d}},logicalId:p}}static createIdentityPoolRoleAttachment(e,a){let{slug:r,environment:n,authenticatedRole:i,unauthenticatedRole:o,roleMappings:c}=a,u=l({slug:r,environment:n,resourceType:"identity-pool-role-attachment"}),d=s(u),m={authenticated:i};if(o)m.unauthenticated=o;return{attachment:{Type:"AWS::Cognito::IdentityPoolRoleAttachment",Properties:{IdentityPoolId:P.Ref(e),Roles:m,RoleMappings:c}},logicalId:d}}static createAuthenticatedRole(e){let{slug:a,environment:r,identityPoolLogicalId:n}=e,i=l({slug:a,environment:r,resourceType:"cognito-authenticated-role"}),o=s(i);return{role:{Type:"AWS::IAM::Role",Properties:{RoleName:i,AssumeRolePolicyDocument:{Version:"2012-10-17",Statement:[{Effect:"Allow",Principal:{Federated:"cognito-identity.amazonaws.com"},Action:"sts:AssumeRoleWithWebIdentity",Condition:{StringEquals:{"cognito-identity.amazonaws.com:aud":P.Ref(n)},"ForAnyValue:StringLike":{"cognito-identity.amazonaws.com:amr":"authenticated"}}}]},Policies:[{PolicyName:"CognitoAuthenticatedPolicy",PolicyDocument:{Version:"2012-10-17",Statement:[{Effect:"Allow",Action:["cognito-sync:*","cognito-identity:*"],Resource:"*"}]}}],Tags:[{Key:"Name",Value:i},{Key:"Environment",Value:r}]}},logicalId:o}}static createUnauthenticatedRole(e){let{slug:a,environment:r,identityPoolLogicalId:n}=e,i=l({slug:a,environment:r,resourceType:"cognito-unauthenticated-role"}),o=s(i);return{role:{Type:"AWS::IAM::Role",Properties:{RoleName:i,AssumeRolePolicyDocument:{Version:"2012-10-17",Statement:[{Effect:"Allow",Principal:{Federated:"cognito-identity.amazonaws.com"},Action:"sts:AssumeRoleWithWebIdentity",Condition:{StringEquals:{"cognito-identity.amazonaws.com:aud":P.Ref(n)},"ForAnyValue:StringLike":{"cognito-identity.amazonaws.com:amr":"unauthenticated"}}}]},Policies:[{PolicyName:"CognitoUnauthenticatedPolicy",PolicyDocument:{Version:"2012-10-17",Statement:[{Effect:"Allow",Action:["cognito-sync:*"],Resource:"*"}]}}],Tags:[{Key:"Name",Value:i},{Key:"Environment",Value:r}]}},logicalId:o}}static PasswordPolicies={relaxed:()=>({minimumLength:8,requireLowercase:!1,requireUppercase:!1,requireNumbers:!1,requireSymbols:!1,temporaryPasswordValidityDays:7}),standard:()=>({minimumLength:8,requireLowercase:!0,requireUppercase:!0,requireNumbers:!0,requireSymbols:!1,temporaryPasswordValidityDays:3}),strict:()=>({minimumLength:12,requireLowercase:!0,requireUppercase:!0,requireNumbers:!0,requireSymbols:!0,temporaryPasswordValidityDays:1})};static AuthFlows={standard:["ALLOW_USER_SRP_AUTH","ALLOW_REFRESH_TOKEN_AUTH"],admin:["ALLOW_ADMIN_USER_PASSWORD_AUTH","ALLOW_REFRESH_TOKEN_AUTH"],custom:["ALLOW_CUSTOM_AUTH","ALLOW_REFRESH_TOKEN_AUTH"],all:["ALLOW_USER_SRP_AUTH","ALLOW_USER_PASSWORD_AUTH","ALLOW_ADMIN_USER_PASSWORD_AUTH","ALLOW_CUSTOM_AUTH","ALLOW_REFRESH_TOKEN_AUTH"]};static OAuthScopes={basic:["openid","email","profile"],all:["openid","email","profile","phone","aws.cognito.signin.user.admin"]};static UseCases={webApp:(e,a,r)=>{let{userPool:n,logicalId:i}=we.createUserPool({slug:e,environment:a,aliasAttributes:["email"],autoVerifiedAttributes:["email"],passwordPolicy:we.PasswordPolicies.standard(),mfaConfiguration:"OPTIONAL"}),{client:o,logicalId:c}=we.createUserPoolClient(i,{slug:e,environment:a,explicitAuthFlows:[...we.AuthFlows.standard],callbackURLs:[r],allowedOAuthFlows:["code"],allowedOAuthScopes:[...we.OAuthScopes.basic],allowedOAuthFlowsUserPoolClient:!0});return{userPool:n,poolId:i,client:o,clientId:c}},mobileApp:(e,a)=>{let{userPool:r,logicalId:n}=we.createUserPool({slug:e,environment:a,aliasAttributes:["email"],autoVerifiedAttributes:["email"],passwordPolicy:we.PasswordPolicies.standard(),mfaConfiguration:"OPTIONAL"}),{client:i,logicalId:o}=we.createUserPoolClient(n,{slug:e,environment:a,explicitAuthFlows:[...we.AuthFlows.standard]}),{identityPool:c,logicalId:u}=we.createIdentityPool({slug:e,environment:a,allowUnauthenticatedIdentities:!1,cognitoIdentityProviders:[{ClientId:P.Ref(o),ProviderName:P.GetAtt(n,"ProviderName")}]}),{role:d,logicalId:m}=we.createAuthenticatedRole({slug:e,environment:a,identityPoolLogicalId:u}),{attachment:p,logicalId:g}=we.createIdentityPoolRoleAttachment(u,{slug:e,environment:a,authenticatedRole:P.GetAtt(m,"Arn")});return{userPool:r,poolId:n,client:i,clientId:o,identityPool:c,identityPoolId:u,authRole:d,authRoleId:m,attachment:p,attachmentId:g}}}}class Ce{static createApplication(e){let{slug:a,environment:r,applicationName:n,computePlatform:i}=e,o=n||l({slug:a,environment:r,resourceType:"deploy-app"}),c=s(o);return{application:{Type:"AWS::CodeDeploy::Application",Properties:{ApplicationName:o,ComputePlatform:i,Tags:[{Key:"Name",Value:o},{Key:"Environment",Value:r}]}},logicalId:c}}static createDeploymentGroup(e,a){let{slug:r,environment:n,deploymentGroupName:i,serviceRoleArn:o,autoScalingGroups:c,ec2TagFilters:u,deploymentConfigName:d,autoRollbackConfiguration:m,alarmConfiguration:p,loadBalancerInfo:g,blueGreenDeploymentConfiguration:h}=a,y=i||l({slug:r,environment:n,resourceType:"deploy-group"}),f=s(y);return{deploymentGroup:{Type:"AWS::CodeDeploy::DeploymentGroup",Properties:{ApplicationName:P.Ref(e),DeploymentGroupName:y,ServiceRoleArn:o,AutoScalingGroups:c,Ec2TagFilters:u?.map((b)=>({Key:b.key,Value:b.value,Type:b.type})),DeploymentConfigName:d,AutoRollbackConfiguration:m?{Enabled:m.enabled,Events:m.events}:void 0,AlarmConfiguration:p?{Enabled:p.enabled,Alarms:p.alarms?.map((b)=>({Name:b.name})),IgnorePollAlarmFailure:p.ignorePollAlarmFailure}:void 0,LoadBalancerInfo:g?{TargetGroupInfoList:g.targetGroupInfoList?.map((b)=>({Name:b.name})),ElbInfoList:g.elbInfoList?.map((b)=>({Name:b.name}))}:void 0,BlueGreenDeploymentConfiguration:h?{TerminateBlueInstancesOnDeploymentSuccess:h.terminateBlueInstancesOnDeploymentSuccess?{Action:h.terminateBlueInstancesOnDeploymentSuccess.action,TerminationWaitTimeInMinutes:h.terminateBlueInstancesOnDeploymentSuccess.terminationWaitTimeInMinutes}:void 0,DeploymentReadyOption:h.deploymentReadyOption?{ActionOnTimeout:h.deploymentReadyOption.actionOnTimeout,WaitTimeInMinutes:h.deploymentReadyOption.waitTimeInMinutes}:void 0,GreenFleetProvisioningOption:h.greenFleetProvisioningOption?{Action:h.greenFleetProvisioningOption.action}:void 0}:void 0,Tags:[{Key:"Name",Value:y},{Key:"Environment",Value:n}]}},logicalId:f}}static createDeploymentConfig(e){let{slug:a,environment:r,deploymentConfigName:n,minimumHealthyHosts:i,trafficRoutingConfig:o}=e,c=n||l({slug:a,environment:r,resourceType:"deploy-config"}),u=s(c);return{deploymentConfig:{Type:"AWS::CodeDeploy::DeploymentConfig",Properties:{DeploymentConfigName:c,MinimumHealthyHosts:i?{Type:i.type,Value:i.value}:void 0,TrafficRoutingConfig:o?{Type:o.type,TimeBasedCanary:o.timeBasedCanary?{CanaryPercentage:o.timeBasedCanary.canaryPercentage,CanaryInterval:o.timeBasedCanary.canaryInterval}:void 0,TimeBasedLinear:o.timeBasedLinear?{LinearPercentage:o.timeBasedLinear.linearPercentage,LinearInterval:o.timeBasedLinear.linearInterval}:void 0}:void 0}},logicalId:u}}static DeploymentConfigs={allAtOnce:()=>({type:"FLEET_PERCENT",value:0}),halfAtATime:()=>({type:"FLEET_PERCENT",value:50}),oneAtATime:()=>({type:"HOST_COUNT",value:1}),custom:(e,a)=>({type:e,value:a})};static TrafficRouting={allAtOnce:()=>({type:"AllAtOnce"}),canary:(e,a)=>({type:"TimeBasedCanary",timeBasedCanary:{canaryPercentage:e,canaryInterval:a}}),linear:(e,a)=>({type:"TimeBasedLinear",timeBasedLinear:{linearPercentage:e,linearInterval:a}})};static RollbackConfigs={onFailure:()=>({enabled:!0,events:["DEPLOYMENT_FAILURE"]}),onAlarmOrFailure:()=>({enabled:!0,events:["DEPLOYMENT_FAILURE","DEPLOYMENT_STOP_ON_ALARM"]}),onAllEvents:()=>({enabled:!0,events:["DEPLOYMENT_FAILURE","DEPLOYMENT_STOP_ON_ALARM","DEPLOYMENT_STOP_ON_REQUEST"]}),disabled:()=>({enabled:!1})};static BlueGreenConfigs={standard:()=>({terminateBlueInstancesOnDeploymentSuccess:{action:"TERMINATE",terminationWaitTimeInMinutes:5},deploymentReadyOption:{actionOnTimeout:"CONTINUE_DEPLOYMENT",waitTimeInMinutes:0},greenFleetProvisioningOption:{action:"COPY_AUTO_SCALING_GROUP"}}),withDelay:(e)=>({terminateBlueInstancesOnDeploymentSuccess:{action:"TERMINATE",terminationWaitTimeInMinutes:e},deploymentReadyOption:{actionOnTimeout:"CONTINUE_DEPLOYMENT",waitTimeInMinutes:0},greenFleetProvisioningOption:{action:"COPY_AUTO_SCALING_GROUP"}}),withManualApproval:(e)=>({terminateBlueInstancesOnDeploymentSuccess:{action:"TERMINATE",terminationWaitTimeInMinutes:5},deploymentReadyOption:{actionOnTimeout:"STOP_DEPLOYMENT",waitTimeInMinutes:e},greenFleetProvisioningOption:{action:"COPY_AUTO_SCALING_GROUP"}}),keepBlue:()=>({terminateBlueInstancesOnDeploymentSuccess:{action:"KEEP_ALIVE"},deploymentReadyOption:{actionOnTimeout:"CONTINUE_DEPLOYMENT",waitTimeInMinutes:0},greenFleetProvisioningOption:{action:"COPY_AUTO_SCALING_GROUP"}})};static UseCases={ec2Deployment:(e,a,r,n)=>{let{application:i,logicalId:o}=Ce.createApplication({slug:e,environment:a,computePlatform:"Server"}),{deploymentGroup:c,logicalId:u}=Ce.createDeploymentGroup(o,{slug:e,environment:a,serviceRoleArn:r,autoScalingGroups:n,deploymentConfigName:"CodeDeployDefault.OneAtATime",autoRollbackConfiguration:Ce.RollbackConfigs.onFailure()});return{application:i,appId:o,deploymentGroup:c,groupId:u}},lambdaCanaryDeployment:(e,a,r,n=10,i=5)=>{let{application:o,logicalId:c}=Ce.createApplication({slug:e,environment:a,computePlatform:"Lambda"}),{deploymentConfig:u,logicalId:d}=Ce.createDeploymentConfig({slug:e,environment:a,trafficRoutingConfig:Ce.TrafficRouting.canary(n,i)}),{deploymentGroup:m,logicalId:p}=Ce.createDeploymentGroup(c,{slug:e,environment:a,serviceRoleArn:r,deploymentConfigName:P.Ref(d),autoRollbackConfiguration:Ce.RollbackConfigs.onAlarmOrFailure()});return{application:o,appId:c,deploymentConfig:u,configId:d,deploymentGroup:m,groupId:p}},ecsBlueGreenDeployment:(e,a,r,n)=>{let{application:i,logicalId:o}=Ce.createApplication({slug:e,environment:a,computePlatform:"ECS"}),{deploymentGroup:c,logicalId:u}=Ce.createDeploymentGroup(o,{slug:e,environment:a,serviceRoleArn:r,loadBalancerInfo:{targetGroupInfoList:[{name:n}]},blueGreenDeploymentConfiguration:Ce.BlueGreenConfigs.standard(),autoRollbackConfiguration:Ce.RollbackConfigs.onFailure()});return{application:i,appId:o,deploymentGroup:c,groupId:u}}};static Strategies={rolling:(e=25)=>({type:"rolling",batchPercentage:e}),blueGreen:()=>({type:"blue-green"}),canary:(e=10,a=5)=>({type:"canary",canaryPercentage:e,canaryInterval:a}),allAtOnce:()=>({type:"all-at-once"})}}class re{static ContentTypes={".html":"text/html",".htm":"text/html",".css":"text/css",".js":"application/javascript",".mjs":"application/javascript",".json":"application/json",".xml":"application/xml",".svg":"image/svg+xml",".png":"image/png",".jpg":"image/jpeg",".jpeg":"image/jpeg",".gif":"image/gif",".webp":"image/webp",".avif":"image/avif",".ico":"image/x-icon",".woff":"font/woff",".woff2":"font/woff2",".ttf":"font/ttf",".otf":"font/otf",".eot":"application/vnd.ms-fontobject",".pdf":"application/pdf",".txt":"text/plain",".md":"text/markdown",".map":"application/json"};static NoHashPatterns=[/^index\.html$/,/^favicon\.ico$/,/^robots\.txt$/,/^sitemap\.xml$/,/^manifest\.json$/,/^\.well-known\//,/^_redirects$/,/^_headers$/];static computeFileHash(e,a="md5"){let r=at(e);return gn(a).update(r).digest("hex")}static computeShortHash(e){return re.computeFileHash(e).slice(0,8)}static getContentType(e){let a=Ma(e).toLowerCase();return re.ContentTypes[a]||"application/octet-stream"}static shouldHashFile(e,a){return![...re.NoHashPatterns,...a||[]].some((r)=>r.test(e))}static generateHashedFilename(e,a){let r=Ma(e),n=Sn(e,r),i=La(e);if(i===".")return`${n}.${a}${r}`;return je(i,`${n}.${a}${r}`)}static collectFiles(e,a){let r=[],n=a||e;if(!Rt(e))return r;let i=yn(e,{withFileTypes:!0});for(let o of i){let c=je(e,o.name);if(o.isDirectory())r.push(...re.collectFiles(c,n));else if(o.isFile())r.push(c)}return r}static hashDirectory(e){let{sourceDir:a,outputDir:r,excludePatterns:n=[],hashAlgorithm:i="md5",copyUnhashed:o=!0}=e,c=re.collectFiles(a),u=[],d={};for(let p of c){let g=p.replace(a,"").replace(/^[/\\]/,""),h=re.shouldHashFile(g,n),y=fn(p),f=h?re.computeFileHash(p,i).slice(0,8):"",b=h?re.generateHashedFilename(g,f):g,T={originalPath:g,hashedPath:b,hash:f,size:y.size,contentType:re.getContentType(p)};if(u.push(T),d[g]=b,r){let w=je(r,b),I=La(w);if(!Rt(I)){let{mkdirSync:v}=Dr("node:fs");v(I,{recursive:!0})}if(h||o)hn(p,w)}}let m={version:"1.0",timestamp:new Date().toISOString(),assets:u,hashMap:d};if(r){let p=je(r,"asset-manifest.json");nt(p,JSON.stringify(m,null,2))}return m}static getInvalidationPaths(e,a){let r=[];if(!e)return["/*"];let n=e.hashMap,i=a.hashMap;for(let[o,c]of Object.entries(i)){let u=n[o];if(!u||u!==c){if(r.push(`/${o}`),u&&u!==c)r.push(`/${u}`)}}for(let[o,c]of Object.entries(n))if(!i[o])r.push(`/${o}`),r.push(`/${c}`);if(r.length>100)return["/*"];return[...new Set(r)]}static updateHtmlReferences(e){let{htmlDir:a,manifest:r,basePath:n=""}=e,i=re.collectFiles(a).filter((o)=>o.endsWith(".html")||o.endsWith(".htm"));for(let o of i){let c=at(o,"utf-8");for(let[u,d]of Object.entries(r.hashMap)){if(u===d)continue;let m=[new RegExp(`(src|href)=["']${n}/?${re.escapeRegExp(u)}["']`,"g"),new RegExp(`url\\(["']?${n}/?${re.escapeRegExp(u)}["']?\\)`,"g")];for(let p of m)c=c.replace(p,(g)=>g.replace(u,d))}nt(o,c)}}static updateCssReferences(e){let{cssDir:a,manifest:r,basePath:n=""}=e,i=re.collectFiles(a).filter((o)=>o.endsWith(".css"));for(let o of i){let c=at(o,"utf-8");for(let[u,d]of Object.entries(r.hashMap)){if(u===d)continue;let m=new RegExp(`url\\(["']?${n}/?${re.escapeRegExp(u)}["']?\\)`,"g");c=c.replace(m,`url(${n}/${d})`)}nt(o,c)}}static escapeRegExp(e){return e.replace(/[.*+?^${}()|[\]\\]/g,"\\$&")}static generateS3DeploymentManifest(e){let{sourceDir:a,keyPrefix:r="",excludePatterns:n=[],cacheControl:i={hashed:"public, max-age=31536000, immutable",unhashed:"public, max-age=3600",html:"public, max-age=0, must-revalidate"}}=e;return re.hashDirectory({sourceDir:a,excludePatterns:n}).assets.map((o)=>{let c=o.hash!=="",u=o.contentType==="text/html",d=i.unhashed||"public, max-age=3600";if(u)d=i.html||"public, max-age=0, must-revalidate";else if(c)d=i.hashed||"public, max-age=31536000, immutable";return{localPath:je(a,o.originalPath),s3Key:r?`${r}/${o.hashedPath}`:o.hashedPath,contentType:o.contentType,cacheControl:d,hash:o.hash}})}static compareManifests(e,a){let r={added:[],removed:[],changed:[],unchanged:[]},n=new Set(Object.keys(e.hashMap)),i=new Set(Object.keys(a.hashMap));for(let o of i)if(!n.has(o))r.added.push(o);for(let o of n)if(!i.has(o))r.removed.push(o);for(let o of i)if(n.has(o))if(e.hashMap[o]!==a.hashMap[o])r.changed.push(o);else r.unchanged.push(o);return r}static loadManifest(e){if(!Rt(e))return null;try{let a=at(e,"utf-8");return JSON.parse(a)}catch{return null}}static saveManifest(e,a){nt(a,JSON.stringify(e,null,2))}}class Ti{static createSecret(e){let{slug:a,environment:r,secretName:n,description:i,secretString:o,kmsKeyId:c,tags:u}=e,d=n||l({slug:a,environment:r,resourceType:"secret"}),m=s(d),p={Type:"AWS::SecretsManager::Secret",Properties:{Name:d,Description:i,SecretString:o,Tags:[{Key:"Name",Value:d},{Key:"Environment",Value:r},...u?Object.entries(u).map(([g,h])=>({Key:g,Value:h})):[]]}};if(c)p.Properties.KmsKeyId=c;return{secret:p,logicalId:m}}static createGeneratedSecret(e){let{slug:a,environment:r,secretName:n,description:i,excludeCharacters:o,excludeLowercase:c,excludeNumbers:u,excludePunctuation:d,excludeUppercase:m,passwordLength:p,requireEachIncludedType:g,kmsKeyId:h,tags:y}=e,f=n||l({slug:a,environment:r,resourceType:"secret"}),b=s(f),T={Type:"AWS::SecretsManager::Secret",Properties:{Name:f,Description:i,GenerateSecretString:{ExcludeCharacters:o,ExcludeLowercase:c,ExcludeNumbers:u,ExcludePunctuation:d,ExcludeUppercase:m,PasswordLength:p||32,RequireEachIncludedType:g!==!1},Tags:[{Key:"Name",Value:f},{Key:"Environment",Value:r},...y?Object.entries(y).map(([w,I])=>({Key:w,Value:I})):[]]}};if(h)T.Properties.KmsKeyId=h;return{secret:T,logicalId:b}}static createDatabaseSecret(e){let{slug:a,environment:r,secretName:n,username:i,dbname:o,engine:c,host:u,port:d,kmsKeyId:m}=e,p=n||l({slug:a,environment:r,resourceType:"db-secret"}),g=s(p),h={username:i};if(o)h.dbname=o;if(c)h.engine=c;if(u)h.host=u;if(d)h.port=d;let y={Type:"AWS::SecretsManager::Secret",Properties:{Name:p,Description:`Database credentials for ${i}`,GenerateSecretString:{SecretStringTemplate:JSON.stringify(h),GenerateStringKey:"password",PasswordLength:32,ExcludeCharacters:'"@/\\',RequireEachIncludedType:!0},Tags:[{Key:"Name",Value:p},{Key:"Environment",Value:r},{Key:"Type",Value:"database"}]}};if(m)y.Properties.KmsKeyId=m;return{secret:y,logicalId:g}}static attachToDatabase(e){let{slug:a,environment:r,secretId:n,targetId:i,targetType:o}=e,c=l({slug:a,environment:r,resourceType:"secret-attachment"}),u=s(c);return{attachment:{Type:"AWS::SecretsManager::SecretTargetAttachment",Properties:{SecretId:n,TargetId:i,TargetType:o}},logicalId:u}}static enableRotation(e){let{slug:a,environment:r,secretId:n,rotationLambdaArn:i,automaticallyAfterDays:o,rotationType:c,kmsKeyArn:u,vpcSecurityGroupIds:d,vpcSubnetIds:m}=e,p=l({slug:a,environment:r,resourceType:"secret-rotation"}),g=s(p),h={Type:"AWS::SecretsManager::RotationSchedule",Properties:{SecretId:n,RotationRules:{AutomaticallyAfterDays:o||30}}};if(i)h.Properties.RotationLambdaARN=i;else if(c)h.Properties.HostedRotationLambda={RotationType:c,KmsKeyArn:u,VpcSecurityGroupIds:d,VpcSubnetIds:m};return{rotation:h,logicalId:g}}static SecretTypes={apiKey:(e,a,r)=>Ti.createGeneratedSecret({slug:e,environment:a,secretName:`${e}-${a}-${r}-api-key`,description:`API key for ${r}`,passwordLength:32,excludePunctuation:!0,excludeLowercase:!1,excludeUppercase:!1,excludeNumbers:!1}),oauthClientSecret:(e,a,r)=>Ti.createGeneratedSecret({slug:e,environment:a,secretName:`${e}-${a}-${r}-oauth-secret`,description:`OAuth client secret for ${r}`,passwordLength:64,excludeCharacters:"\"'`\\/@",requireEachIncludedType:!0}),jwtSecret:(e,a)=>Ti.createGeneratedSecret({slug:e,environment:a,secretName:`${e}-${a}-jwt-secret`,description:"JWT signing secret",passwordLength:64,excludePunctuation:!0}),encryptionKey:(e,a)=>Ti.createGeneratedSecret({slug:e,environment:a,secretName:`${e}-${a}-encryption-key`,description:"Data encryption key",passwordLength:64,excludeCharacters:"+/=",excludePunctuation:!0})};static RotationTypes={MySQLSingleUser:"MySQLSingleUser",MySQLMultiUser:"MySQLMultiUser",PostgreSQLSingleUser:"PostgreSQLSingleUser",PostgreSQLMultiUser:"PostgreSQLMultiUser",OracleSingleUser:"OracleSingleUser",OracleMultiUser:"OracleMultiUser",MariaDBSingleUser:"MariaDBSingleUser",MariaDBMultiUser:"MariaDBMultiUser",SQLServerSingleUser:"SQLServerSingleUser",SQLServerMultiUser:"SQLServerMultiUser",RedshiftSingleUser:"RedshiftSingleUser",RedshiftMultiUser:"RedshiftMultiUser",MongoDBSingleUser:"MongoDBSingleUser",MongoDBMultiUser:"MongoDBMultiUser"}}class J{static createParameter(e){let{slug:a,environment:r,parameterName:n,value:i,type:o="String",description:c,tier:u="Standard",tags:d}=e,m=n||l({slug:a,environment:r,resourceType:"parameter"}),p=s(m);return{parameter:{Type:"AWS::SSM::Parameter",Properties:{Name:`/${a}/${r}/${m}`,Type:o,Value:i,Description:c,Tier:u,Tags:{Name:m,Environment:r,...d}}},logicalId:p}}static createString(e,a,r,n,i){return J.createParameter({slug:e,environment:a,parameterName:r,value:n,type:"String",description:i})}static createSecureString(e,a,r,n,i){return J.createParameter({slug:e,environment:a,parameterName:r,value:n,type:"SecureString",description:i})}static createStringList(e,a,r,n,i){return J.createParameter({slug:e,environment:a,parameterName:r,value:n.join(","),type:"StringList",description:i})}static Parameters={databaseUrl:(e,a,r)=>J.createSecureString(e,a,"database-url",r,"Database connection URL"),apiEndpoint:(e,a,r)=>J.createString(e,a,"api-endpoint",r,"API endpoint URL"),appVersion:(e,a,r)=>J.createString(e,a,"app-version",r,"Application version"),featureFlags:(e,a,r)=>J.createStringList(e,a,"feature-flags",r,"Enabled feature flags"),apiKey:(e,a,r,n)=>J.createSecureString(e,a,`${r}-api-key`,n,`API key for ${r}`),oauthCredentials:(e,a,r,n)=>{let i=J.createString(e,a,"oauth-client-id",r,"OAuth client ID"),o=J.createSecureString(e,a,"oauth-client-secret",n,"OAuth client secret");return{clientId:i,clientSecret:o}},smtpCredentials:(e,a,r,n,i,o)=>{let c=J.createString(e,a,"smtp-username",r,"SMTP username"),u=J.createSecureString(e,a,"smtp-password",n,"SMTP password"),d=J.createString(e,a,"smtp-host",i,"SMTP host"),m=J.createString(e,a,"smtp-port",o.toString(),"SMTP port");return{username:c,password:u,host:d,port:m}},redisUrl:(e,a,r)=>J.createSecureString(e,a,"redis-url",r,"Redis connection URL"),s3Bucket:(e,a,r)=>J.createString(e,a,"s3-bucket",r,"S3 bucket name"),cloudFrontDistribution:(e,a,r)=>J.createString(e,a,"cloudfront-distribution-id",r,"CloudFront distribution ID")}}class Ht{static createDomain(e){let{slug:a,environment:r,domainName:n,engineVersion:i="OpenSearch_2.11",instanceType:o="t3.small.search",instanceCount:c=1,volumeSize:u=10,volumeType:d="gp3",dedicatedMaster:m=!1,dedicatedMasterType:p,dedicatedMasterCount:g=3,multiAz:h=!1,availabilityZoneCount:y=2,vpc:f,encryption:b,enforceHttps:T=!0,tlsSecurityPolicy:w="Policy-Min-TLS-1-2-2019-07",advancedSecurity:I,autoSnapshotHour:v=0,autoTune:N=!0,tags:R={}}=e,k=n||l({slug:a,environment:r,resourceType:"search"}),x=s(k);return{domain:{Type:"AWS::OpenSearchService::Domain",Properties:{DomainName:k,EngineVersion:i,ClusterConfig:{InstanceType:o,InstanceCount:c,DedicatedMasterEnabled:m,...m&&{DedicatedMasterType:p||o,DedicatedMasterCount:g},ZoneAwarenessEnabled:h,...h&&{ZoneAwarenessConfig:{AvailabilityZoneCount:y}}},EBSOptions:{EBSEnabled:!0,VolumeType:d,VolumeSize:u},DomainEndpointOptions:{EnforceHTTPS:T,TLSSecurityPolicy:w},SnapshotOptions:{AutomatedSnapshotStartHour:v},...f&&{VPCOptions:{SubnetIds:f.subnetIds,SecurityGroupIds:f.securityGroupIds}},...b&&{EncryptionAtRestOptions:{Enabled:b.atRest??!0,...b.kmsKeyId&&{KmsKeyId:b.kmsKeyId}},NodeToNodeEncryptionOptions:{Enabled:b.nodeToNode??!0}},...I&&{AdvancedSecurityOptions:{Enabled:I.enabled,InternalUserDatabaseEnabled:I.internalUserDatabase??!0,...I.masterUserName&&I.masterUserPassword&&{MasterUserOptions:{MasterUserName:I.masterUserName,MasterUserPassword:I.masterUserPassword}},...I.masterUserArn&&{MasterUserOptions:{MasterUserARN:I.masterUserArn}}}},...N&&{AutoTuneOptions:{DesiredState:"ENABLED"}},Tags:[{Key:"Name",Value:k},{Key:"Environment",Value:r},...Object.entries(R).map(([L,_])=>({Key:L,Value:_}))]}},logicalId:x}}static createAccessPolicy(e,a){let{ipAddresses:r,iamPrincipalArns:n,allowAll:i,vpcEndpoint:o}=a;if(i)return{Version:"2012-10-17",Statement:[{Effect:"Allow",Principal:{AWS:"*"},Action:"es:*",Resource:e}]};let c=[];if(n&&n.length>0)c.push({Effect:"Allow",Principal:{AWS:n},Action:"es:*",Resource:e});if(r&&r.length>0)c.push({Effect:"Allow",Principal:{AWS:"*"},Action:"es:*",Resource:e,Condition:{IpAddress:{"aws:SourceIp":r}}});if(o)return{Version:"2012-10-17",Statement:[{Effect:"Allow",Principal:{AWS:"*"},Action:"es:*",Resource:e}]};return{Version:"2012-10-17",Statement:c}}static DomainPresets={development:(e,a)=>Ht.createDomain({slug:e,environment:a,instanceType:"t3.small.search",instanceCount:1,volumeSize:10,multiAz:!1,dedicatedMaster:!1,encryption:{atRest:!0,nodeToNode:!0},autoTune:!1}),production:(e,a,r)=>Ht.createDomain({slug:e,environment:a,instanceType:"m6g.large.search",instanceCount:3,volumeSize:100,volumeType:"gp3",multiAz:!0,availabilityZoneCount:3,dedicatedMaster:!0,dedicatedMasterType:"m6g.large.search",dedicatedMasterCount:3,vpc:r,encryption:{atRest:!0,nodeToNode:!0},advancedSecurity:{enabled:!0,internalUserDatabase:!0},autoTune:!0}),costOptimized:(e,a)=>Ht.createDomain({slug:e,environment:a,instanceType:"t3.medium.search",instanceCount:2,volumeSize:20,volumeType:"gp3",multiAz:!0,dedicatedMaster:!1,encryption:{atRest:!0,nodeToNode:!0},autoTune:!0}),highPerformance:(e,a,r)=>Ht.createDomain({slug:e,environment:a,instanceType:"r6g.2xlarge.search",instanceCount:6,volumeSize:500,volumeType:"gp3",multiAz:!0,availabilityZoneCount:3,dedicatedMaster:!0,dedicatedMasterType:"c6g.xlarge.search",dedicatedMasterCount:3,vpc:r,encryption:{atRest:!0,nodeToNode:!0},advancedSecurity:{enabled:!0,internalUserDatabase:!1},autoTune:!0})};static InstanceTypes={"t3.small.search":"t3.small.search","t3.medium.search":"t3.medium.search","m6g.large.search":"m6g.large.search","m6g.xlarge.search":"m6g.xlarge.search","m6g.2xlarge.search":"m6g.2xlarge.search","r6g.large.search":"r6g.large.search","r6g.xlarge.search":"r6g.xlarge.search","r6g.2xlarge.search":"r6g.2xlarge.search","r6g.4xlarge.search":"r6g.4xlarge.search","c6g.large.search":"c6g.large.search","c6g.xlarge.search":"c6g.xlarge.search","c6g.2xlarge.search":"c6g.2xlarge.search"};static EngineVersions={"OpenSearch_2.11":"OpenSearch_2.11","OpenSearch_2.9":"OpenSearch_2.9","OpenSearch_2.7":"OpenSearch_2.7","OpenSearch_1.3":"OpenSearch_1.3","Elasticsearch_7.10":"Elasticsearch_7.10"}}class Ct{static createDomainRedirectBucket(e){let{slug:a,environment:r,sourceDomain:n,targetDomain:i,protocol:o="https"}=e,c=l({slug:a,environment:r,resourceType:"s3",suffix:"redirect"}),u=s(c),d=s(`${c}-policy`),m={Type:"AWS::S3::Bucket",Properties:{BucketName:n,WebsiteConfiguration:{RedirectAllRequestsTo:{HostName:i,Protocol:o}},PublicAccessBlockConfiguration:{BlockPublicAcls:!1,BlockPublicPolicy:!1,IgnorePublicAcls:!1,RestrictPublicBuckets:!1},Tags:[{Key:"Name",Value:c},{Key:"Environment",Value:r},{Key:"Purpose",Value:"Domain Redirect"}]}},p={Type:"AWS::S3::BucketPolicy",Properties:{Bucket:P.Ref(u),PolicyDocument:{Version:"2012-10-17",Statement:[{Sid:"PublicReadForRedirect",Effect:"Allow",Principal:"*",Action:["s3:GetObject"],Resource:[P.Join("",[P.GetAtt(u,"Arn"),"/*"])]}]}}};return{bucket:m,bucketPolicy:p,logicalId:u,policyLogicalId:d}}static createPathRedirectFunction(e){let{slug:a,environment:r,rules:n}=e,i=l({slug:a,environment:r,resourceType:"cf-redirect"}),o=s(i),c=Ct.generateRedirectFunctionCode(n);return{function:{Type:"AWS::CloudFront::Function",Properties:{Name:i,AutoPublish:!0,FunctionConfig:{Comment:`Path redirect function for ${a} (${r})`,Runtime:"cloudfront-js-2.0"},FunctionCode:c}},logicalId:o,functionCode:c}}static generateRedirectFunctionCode(e){return`function handler(event) {
+| limit 50`,region:n,title:"Recent Errors and Warnings"}}),c+=6;return vi.createDashboard({slug:a,environment:r,widgets:o})}static DashboardTemplates={staticWebsite:(e)=>({slug:e.slug,environment:e.environment,widgets:[{type:"text",x:0,y:0,width:24,height:1,properties:{markdown:`# ${e.slug.toUpperCase()} Static Website Dashboard`}},{type:"metric",x:0,y:1,width:8,height:6,properties:{title:"CloudFront Requests",region:"us-east-1",metrics:[["AWS/CloudFront","Requests","DistributionId",e.cloudFrontDistributionId,"Region","Global"]],period:300,stat:"Sum"}},{type:"metric",x:8,y:1,width:8,height:6,properties:{title:"Error Rate",region:"us-east-1",metrics:[["AWS/CloudFront","4xxErrorRate","DistributionId",e.cloudFrontDistributionId,"Region","Global",{label:"4XX"}],["AWS/CloudFront","5xxErrorRate","DistributionId",e.cloudFrontDistributionId,"Region","Global",{label:"5XX"}]],period:300,stat:"Average"}},{type:"metric",x:16,y:1,width:8,height:6,properties:{title:"Bytes Downloaded",region:"us-east-1",metrics:[["AWS/CloudFront","BytesDownloaded","DistributionId",e.cloudFrontDistributionId,"Region","Global"]],period:300,stat:"Sum"}},{type:"metric",x:0,y:7,width:12,height:6,properties:{title:"S3 Bucket Size",region:e.region||"us-east-1",metrics:[["AWS/S3","BucketSizeBytes","BucketName",e.s3BucketName,"StorageType","StandardStorage"]],period:86400,stat:"Average"}},{type:"metric",x:12,y:7,width:12,height:6,properties:{title:"S3 Number of Objects",region:e.region||"us-east-1",metrics:[["AWS/S3","NumberOfObjects","BucketName",e.s3BucketName,"StorageType","AllStorageTypes"]],period:86400,stat:"Average"}}]}),serverlessApi:(e)=>({slug:e.slug,environment:e.environment,widgets:[{type:"text",x:0,y:0,width:24,height:1,properties:{markdown:`# ${e.slug.toUpperCase()} Serverless API Dashboard`}},{type:"metric",x:0,y:1,width:8,height:6,properties:{title:"API Requests",region:e.region||"us-east-1",metrics:[["AWS/ApiGateway","Count","ApiName",e.apiGatewayName]],period:60,stat:"Sum"}},{type:"metric",x:8,y:1,width:8,height:6,properties:{title:"API Latency",region:e.region||"us-east-1",metrics:[["AWS/ApiGateway","Latency","ApiName",e.apiGatewayName]],period:60,stat:"Average"}},{type:"metric",x:16,y:1,width:8,height:6,properties:{title:"API Errors",region:e.region||"us-east-1",metrics:[["AWS/ApiGateway","4XXError","ApiName",e.apiGatewayName,{label:"4XX"}],["AWS/ApiGateway","5XXError","ApiName",e.apiGatewayName,{label:"5XX"}]],period:60,stat:"Sum"}},...e.lambdaFunctionNames.map((a,r)=>({type:"metric",x:r%3*8,y:7+Math.floor(r/3)*6,width:8,height:6,properties:{title:`${a} Metrics`,region:e.region||"us-east-1",metrics:[["AWS/Lambda","Invocations","FunctionName",a],["AWS/Lambda","Duration","FunctionName",a],["AWS/Lambda","Errors","FunctionName",a]],period:300,stat:"Sum"}}))]}),containerService:(e)=>({slug:e.slug,environment:e.environment,widgets:[{type:"text",x:0,y:0,width:24,height:1,properties:{markdown:`# ${e.slug.toUpperCase()} Container Service Dashboard`}},{type:"metric",x:0,y:1,width:8,height:6,properties:{title:"ECS CPU",region:e.region||"us-east-1",metrics:[["AWS/ECS","CPUUtilization","ClusterName",e.ecsClusterName,"ServiceName",e.ecsServiceName]],period:60,stat:"Average"}},{type:"metric",x:8,y:1,width:8,height:6,properties:{title:"ECS Memory",region:e.region||"us-east-1",metrics:[["AWS/ECS","MemoryUtilization","ClusterName",e.ecsClusterName,"ServiceName",e.ecsServiceName]],period:60,stat:"Average"}},{type:"metric",x:16,y:1,width:8,height:6,properties:{title:"Running Tasks",region:e.region||"us-east-1",metrics:[["ECS/ContainerInsights","RunningTaskCount","ClusterName",e.ecsClusterName,"ServiceName",e.ecsServiceName]],period:60,stat:"Average"}},{type:"metric",x:0,y:7,width:8,height:6,properties:{title:"ALB Requests",region:e.region||"us-east-1",metrics:[["AWS/ApplicationELB","RequestCount","LoadBalancer",e.albName]],period:60,stat:"Sum"}},{type:"metric",x:8,y:7,width:8,height:6,properties:{title:"Response Time",region:e.region||"us-east-1",metrics:[["AWS/ApplicationELB","TargetResponseTime","LoadBalancer",e.albName]],period:60,stat:"Average"}},{type:"metric",x:16,y:7,width:8,height:6,properties:{title:"Healthy Hosts",region:e.region||"us-east-1",metrics:[["AWS/ApplicationELB","HealthyHostCount","LoadBalancer",e.albName]],period:60,stat:"Average"}},...e.rdsInstanceId?[{type:"metric",x:0,y:13,width:12,height:6,properties:{title:"RDS CPU",region:e.region||"us-east-1",metrics:[["AWS/RDS","CPUUtilization","DBInstanceIdentifier",e.rdsInstanceId]],period:300,stat:"Average"}},{type:"metric",x:12,y:13,width:12,height:6,properties:{title:"RDS Connections",region:e.region||"us-east-1",metrics:[["AWS/RDS","DatabaseConnections","DBInstanceIdentifier",e.rdsInstanceId]],period:60,stat:"Sum"}}]:[]]})};static Config={createAlarmConfig:(e)=>{let{metricName:a,namespace:r,threshold:n,comparisonOperator:i="GreaterThanThreshold",evaluationPeriods:o=1,period:c=300,statistic:u="Average",treatMissingData:d="missing"}=e;return{MetricName:a,Namespace:r,Threshold:n,ComparisonOperator:i,EvaluationPeriods:o,Period:c,Statistic:u,TreatMissingData:d}},namespaces:{ec2:"AWS/EC2",ecs:"AWS/ECS",lambda:"AWS/Lambda",rds:"AWS/RDS",sqs:"AWS/SQS",sns:"AWS/SNS",s3:"AWS/S3",cloudfront:"AWS/CloudFront",alb:"AWS/ApplicationELB",nlb:"AWS/NetworkELB",apiGateway:"AWS/ApiGateway",dynamodb:"AWS/DynamoDB",elasticache:"AWS/ElastiCache"},comparisonOperators:{greaterThan:"GreaterThanThreshold",greaterOrEqual:"GreaterThanOrEqualToThreshold",lessThan:"LessThanThreshold",lessOrEqual:"LessThanOrEqualToThreshold"},metrics:{ec2:{cpu:{metricName:"CPUUtilization",namespace:"AWS/EC2"},networkIn:{metricName:"NetworkIn",namespace:"AWS/EC2"},networkOut:{metricName:"NetworkOut",namespace:"AWS/EC2"},statusCheck:{metricName:"StatusCheckFailed",namespace:"AWS/EC2"}},ecs:{cpu:{metricName:"CPUUtilization",namespace:"AWS/ECS"},memory:{metricName:"MemoryUtilization",namespace:"AWS/ECS"}},lambda:{invocations:{metricName:"Invocations",namespace:"AWS/Lambda"},errors:{metricName:"Errors",namespace:"AWS/Lambda"},duration:{metricName:"Duration",namespace:"AWS/Lambda"},throttles:{metricName:"Throttles",namespace:"AWS/Lambda"},concurrentExecutions:{metricName:"ConcurrentExecutions",namespace:"AWS/Lambda"}},rds:{cpu:{metricName:"CPUUtilization",namespace:"AWS/RDS"},connections:{metricName:"DatabaseConnections",namespace:"AWS/RDS"},freeStorage:{metricName:"FreeStorageSpace",namespace:"AWS/RDS"},readLatency:{metricName:"ReadLatency",namespace:"AWS/RDS"},writeLatency:{metricName:"WriteLatency",namespace:"AWS/RDS"}},alb:{requestCount:{metricName:"RequestCount",namespace:"AWS/ApplicationELB"},responseTime:{metricName:"TargetResponseTime",namespace:"AWS/ApplicationELB"},httpCode4xx:{metricName:"HTTPCode_Target_4XX_Count",namespace:"AWS/ApplicationELB"},httpCode5xx:{metricName:"HTTPCode_Target_5XX_Count",namespace:"AWS/ApplicationELB"},healthyHosts:{metricName:"HealthyHostCount",namespace:"AWS/ApplicationELB"}},sqs:{messagesVisible:{metricName:"ApproximateNumberOfMessagesVisible",namespace:"AWS/SQS"},messagesDelayed:{metricName:"ApproximateNumberOfMessagesDelayed",namespace:"AWS/SQS"},messageAge:{metricName:"ApproximateAgeOfOldestMessage",namespace:"AWS/SQS"}}},presets:{highCpu:(e=80)=>({metricName:"CPUUtilization",threshold:e,comparisonOperator:"GreaterThanThreshold",evaluationPeriods:3,period:300,statistic:"Average"}),highMemory:(e=80)=>({metricName:"MemoryUtilization",threshold:e,comparisonOperator:"GreaterThanThreshold",evaluationPeriods:3,period:300,statistic:"Average"}),highErrors:(e=10)=>({metricName:"Errors",threshold:e,comparisonOperator:"GreaterThanThreshold",evaluationPeriods:1,period:60,statistic:"Sum"}),highLatency:(e=5000)=>({metricName:"Duration",threshold:e,comparisonOperator:"GreaterThanThreshold",evaluationPeriods:3,period:300,statistic:"Average"}),lowHealthyHosts:(e=1)=>({metricName:"HealthyHostCount",namespace:"AWS/ApplicationELB",threshold:e,comparisonOperator:"LessThanThreshold",evaluationPeriods:2,period:60,statistic:"Minimum"}),queueDepth:(e=1000)=>({metricName:"ApproximateNumberOfMessagesVisible",namespace:"AWS/SQS",threshold:e,comparisonOperator:"GreaterThanThreshold",evaluationPeriods:3,period:300,statistic:"Average"}),lowStorage:(e=10737418240)=>({metricName:"FreeStorageSpace",namespace:"AWS/RDS",threshold:e,comparisonOperator:"LessThanThreshold",evaluationPeriods:1,period:300,statistic:"Average"})}}}class we{static createUserPool(e){let{slug:a,environment:r,userPoolName:n,aliasAttributes:i,autoVerifiedAttributes:o,passwordPolicy:c,mfaConfiguration:u,emailConfiguration:d,smsConfiguration:m,lambdaTriggers:p,userPoolAddOns:g,accountRecoverySetting:h}=e,y=n||l({slug:a,environment:r,resourceType:"user-pool"}),f=s(y),b={Type:"AWS::Cognito::UserPool",Properties:{UserPoolName:y,Policies:c?{PasswordPolicy:{MinimumLength:c.minimumLength,RequireLowercase:c.requireLowercase,RequireUppercase:c.requireUppercase,RequireNumbers:c.requireNumbers,RequireSymbols:c.requireSymbols,TemporaryPasswordValidityDays:c.temporaryPasswordValidityDays}}:void 0,MfaConfiguration:u,Schema:[{Name:"email",AttributeDataType:"String",Required:!0,Mutable:!1}]}};if(i&&i.length>0)b.Properties.UsernameAttributes=i;if(o&&o.length>0)b.Properties.AutoVerifiedAttributes=o;if(d)b.Properties.EmailConfiguration={EmailSendingAccount:d.emailSendingAccount,From:d.from,ReplyToEmailAddress:d.replyToEmailAddress,SourceArn:d.sourceArn,ConfigurationSet:d.configurationSet};if(m)b.Properties.SmsConfiguration={ExternalId:m.externalId,SnsCallerArn:m.snsCallerArn};if(p)b.Properties.LambdaConfig={PreSignUp:p.preSignUp,PostConfirmation:p.postConfirmation,PreAuthentication:p.preAuthentication,PostAuthentication:p.postAuthentication,CustomMessage:p.customMessage,DefineAuthChallenge:p.defineAuthChallenge,CreateAuthChallenge:p.createAuthChallenge,VerifyAuthChallengeResponse:p.verifyAuthChallengeResponse,PreTokenGeneration:p.preTokenGeneration,UserMigration:p.userMigration};if(g)b.Properties.UserPoolAddOns={AdvancedSecurityMode:g.advancedSecurityMode};if(h)b.Properties.AccountRecoverySetting={RecoveryMechanisms:h.recoveryMechanisms};return{userPool:b,logicalId:f}}static createUserPoolClient(e,a){let{slug:r,environment:n,clientName:i,generateSecret:o=!1,refreshTokenValidity:c,accessTokenValidity:u,idTokenValidity:d,tokenValidityUnits:m,readAttributes:p,writeAttributes:g,explicitAuthFlows:h,preventUserExistenceErrors:y,enableTokenRevocation:f,callbackURLs:b,logoutURLs:T,allowedOAuthFlows:w,allowedOAuthScopes:I,allowedOAuthFlowsUserPoolClient:v,supportedIdentityProviders:N}=a,R=i||l({slug:r,environment:n,resourceType:"user-pool-client"}),k=s(R);return{client:{Type:"AWS::Cognito::UserPoolClient",Properties:{ClientName:R,UserPoolId:P.Ref(e),GenerateSecret:o,RefreshTokenValidity:c,AccessTokenValidity:u,IdTokenValidity:d,TokenValidityUnits:m,ReadAttributes:p,WriteAttributes:g,ExplicitAuthFlows:h,PreventUserExistenceErrors:y,EnableTokenRevocation:f,CallbackURLs:b,LogoutURLs:T,AllowedOAuthFlows:w,AllowedOAuthScopes:I,AllowedOAuthFlowsUserPoolClient:v,SupportedIdentityProviders:N}},logicalId:k}}static createUserPoolDomain(e,a){let{slug:r,environment:n,domain:i,customDomainConfig:o}=a,c=l({slug:r,environment:n,resourceType:"user-pool-domain"}),u=s(c);return{domain:{Type:"AWS::Cognito::UserPoolDomain",Properties:{Domain:i,UserPoolId:P.Ref(e),CustomDomainConfig:o}},logicalId:u}}static createIdentityPool(e){let{slug:a,environment:r,identityPoolName:n,allowUnauthenticatedIdentities:i=!1,cognitoIdentityProviders:o,supportedLoginProviders:c,samlProviderARNs:u,openIdConnectProviderARNs:d}=e,m=n||l({slug:a,environment:r,resourceType:"identity-pool"}),p=s(m);return{identityPool:{Type:"AWS::Cognito::IdentityPool",Properties:{IdentityPoolName:m,AllowUnauthenticatedIdentities:i,CognitoIdentityProviders:o,SupportedLoginProviders:c,SamlProviderARNs:u,OpenIdConnectProviderARNs:d}},logicalId:p}}static createIdentityPoolRoleAttachment(e,a){let{slug:r,environment:n,authenticatedRole:i,unauthenticatedRole:o,roleMappings:c}=a,u=l({slug:r,environment:n,resourceType:"identity-pool-role-attachment"}),d=s(u),m={authenticated:i};if(o)m.unauthenticated=o;return{attachment:{Type:"AWS::Cognito::IdentityPoolRoleAttachment",Properties:{IdentityPoolId:P.Ref(e),Roles:m,RoleMappings:c}},logicalId:d}}static createAuthenticatedRole(e){let{slug:a,environment:r,identityPoolLogicalId:n}=e,i=l({slug:a,environment:r,resourceType:"cognito-authenticated-role"}),o=s(i);return{role:{Type:"AWS::IAM::Role",Properties:{RoleName:i,AssumeRolePolicyDocument:{Version:"2012-10-17",Statement:[{Effect:"Allow",Principal:{Federated:"cognito-identity.amazonaws.com"},Action:"sts:AssumeRoleWithWebIdentity",Condition:{StringEquals:{"cognito-identity.amazonaws.com:aud":P.Ref(n)},"ForAnyValue:StringLike":{"cognito-identity.amazonaws.com:amr":"authenticated"}}}]},Policies:[{PolicyName:"CognitoAuthenticatedPolicy",PolicyDocument:{Version:"2012-10-17",Statement:[{Effect:"Allow",Action:["cognito-sync:*","cognito-identity:*"],Resource:"*"}]}}],Tags:[{Key:"Name",Value:i},{Key:"Environment",Value:r}]}},logicalId:o}}static createUnauthenticatedRole(e){let{slug:a,environment:r,identityPoolLogicalId:n}=e,i=l({slug:a,environment:r,resourceType:"cognito-unauthenticated-role"}),o=s(i);return{role:{Type:"AWS::IAM::Role",Properties:{RoleName:i,AssumeRolePolicyDocument:{Version:"2012-10-17",Statement:[{Effect:"Allow",Principal:{Federated:"cognito-identity.amazonaws.com"},Action:"sts:AssumeRoleWithWebIdentity",Condition:{StringEquals:{"cognito-identity.amazonaws.com:aud":P.Ref(n)},"ForAnyValue:StringLike":{"cognito-identity.amazonaws.com:amr":"unauthenticated"}}}]},Policies:[{PolicyName:"CognitoUnauthenticatedPolicy",PolicyDocument:{Version:"2012-10-17",Statement:[{Effect:"Allow",Action:["cognito-sync:*"],Resource:"*"}]}}],Tags:[{Key:"Name",Value:i},{Key:"Environment",Value:r}]}},logicalId:o}}static PasswordPolicies={relaxed:()=>({minimumLength:8,requireLowercase:!1,requireUppercase:!1,requireNumbers:!1,requireSymbols:!1,temporaryPasswordValidityDays:7}),standard:()=>({minimumLength:8,requireLowercase:!0,requireUppercase:!0,requireNumbers:!0,requireSymbols:!1,temporaryPasswordValidityDays:3}),strict:()=>({minimumLength:12,requireLowercase:!0,requireUppercase:!0,requireNumbers:!0,requireSymbols:!0,temporaryPasswordValidityDays:1})};static AuthFlows={standard:["ALLOW_USER_SRP_AUTH","ALLOW_REFRESH_TOKEN_AUTH"],admin:["ALLOW_ADMIN_USER_PASSWORD_AUTH","ALLOW_REFRESH_TOKEN_AUTH"],custom:["ALLOW_CUSTOM_AUTH","ALLOW_REFRESH_TOKEN_AUTH"],all:["ALLOW_USER_SRP_AUTH","ALLOW_USER_PASSWORD_AUTH","ALLOW_ADMIN_USER_PASSWORD_AUTH","ALLOW_CUSTOM_AUTH","ALLOW_REFRESH_TOKEN_AUTH"]};static OAuthScopes={basic:["openid","email","profile"],all:["openid","email","profile","phone","aws.cognito.signin.user.admin"]};static UseCases={webApp:(e,a,r)=>{let{userPool:n,logicalId:i}=we.createUserPool({slug:e,environment:a,aliasAttributes:["email"],autoVerifiedAttributes:["email"],passwordPolicy:we.PasswordPolicies.standard(),mfaConfiguration:"OPTIONAL"}),{client:o,logicalId:c}=we.createUserPoolClient(i,{slug:e,environment:a,explicitAuthFlows:[...we.AuthFlows.standard],callbackURLs:[r],allowedOAuthFlows:["code"],allowedOAuthScopes:[...we.OAuthScopes.basic],allowedOAuthFlowsUserPoolClient:!0});return{userPool:n,poolId:i,client:o,clientId:c}},mobileApp:(e,a)=>{let{userPool:r,logicalId:n}=we.createUserPool({slug:e,environment:a,aliasAttributes:["email"],autoVerifiedAttributes:["email"],passwordPolicy:we.PasswordPolicies.standard(),mfaConfiguration:"OPTIONAL"}),{client:i,logicalId:o}=we.createUserPoolClient(n,{slug:e,environment:a,explicitAuthFlows:[...we.AuthFlows.standard]}),{identityPool:c,logicalId:u}=we.createIdentityPool({slug:e,environment:a,allowUnauthenticatedIdentities:!1,cognitoIdentityProviders:[{ClientId:P.Ref(o),ProviderName:P.GetAtt(n,"ProviderName")}]}),{role:d,logicalId:m}=we.createAuthenticatedRole({slug:e,environment:a,identityPoolLogicalId:u}),{attachment:p,logicalId:g}=we.createIdentityPoolRoleAttachment(u,{slug:e,environment:a,authenticatedRole:P.GetAtt(m,"Arn")});return{userPool:r,poolId:n,client:i,clientId:o,identityPool:c,identityPoolId:u,authRole:d,authRoleId:m,attachment:p,attachmentId:g}}}}class Ce{static createApplication(e){let{slug:a,environment:r,applicationName:n,computePlatform:i}=e,o=n||l({slug:a,environment:r,resourceType:"deploy-app"}),c=s(o);return{application:{Type:"AWS::CodeDeploy::Application",Properties:{ApplicationName:o,ComputePlatform:i,Tags:[{Key:"Name",Value:o},{Key:"Environment",Value:r}]}},logicalId:c}}static createDeploymentGroup(e,a){let{slug:r,environment:n,deploymentGroupName:i,serviceRoleArn:o,autoScalingGroups:c,ec2TagFilters:u,deploymentConfigName:d,autoRollbackConfiguration:m,alarmConfiguration:p,loadBalancerInfo:g,blueGreenDeploymentConfiguration:h}=a,y=i||l({slug:r,environment:n,resourceType:"deploy-group"}),f=s(y);return{deploymentGroup:{Type:"AWS::CodeDeploy::DeploymentGroup",Properties:{ApplicationName:P.Ref(e),DeploymentGroupName:y,ServiceRoleArn:o,AutoScalingGroups:c,Ec2TagFilters:u?.map((b)=>({Key:b.key,Value:b.value,Type:b.type})),DeploymentConfigName:d,AutoRollbackConfiguration:m?{Enabled:m.enabled,Events:m.events}:void 0,AlarmConfiguration:p?{Enabled:p.enabled,Alarms:p.alarms?.map((b)=>({Name:b.name})),IgnorePollAlarmFailure:p.ignorePollAlarmFailure}:void 0,LoadBalancerInfo:g?{TargetGroupInfoList:g.targetGroupInfoList?.map((b)=>({Name:b.name})),ElbInfoList:g.elbInfoList?.map((b)=>({Name:b.name}))}:void 0,BlueGreenDeploymentConfiguration:h?{TerminateBlueInstancesOnDeploymentSuccess:h.terminateBlueInstancesOnDeploymentSuccess?{Action:h.terminateBlueInstancesOnDeploymentSuccess.action,TerminationWaitTimeInMinutes:h.terminateBlueInstancesOnDeploymentSuccess.terminationWaitTimeInMinutes}:void 0,DeploymentReadyOption:h.deploymentReadyOption?{ActionOnTimeout:h.deploymentReadyOption.actionOnTimeout,WaitTimeInMinutes:h.deploymentReadyOption.waitTimeInMinutes}:void 0,GreenFleetProvisioningOption:h.greenFleetProvisioningOption?{Action:h.greenFleetProvisioningOption.action}:void 0}:void 0,Tags:[{Key:"Name",Value:y},{Key:"Environment",Value:n}]}},logicalId:f}}static createDeploymentConfig(e){let{slug:a,environment:r,deploymentConfigName:n,minimumHealthyHosts:i,trafficRoutingConfig:o}=e,c=n||l({slug:a,environment:r,resourceType:"deploy-config"}),u=s(c);return{deploymentConfig:{Type:"AWS::CodeDeploy::DeploymentConfig",Properties:{DeploymentConfigName:c,MinimumHealthyHosts:i?{Type:i.type,Value:i.value}:void 0,TrafficRoutingConfig:o?{Type:o.type,TimeBasedCanary:o.timeBasedCanary?{CanaryPercentage:o.timeBasedCanary.canaryPercentage,CanaryInterval:o.timeBasedCanary.canaryInterval}:void 0,TimeBasedLinear:o.timeBasedLinear?{LinearPercentage:o.timeBasedLinear.linearPercentage,LinearInterval:o.timeBasedLinear.linearInterval}:void 0}:void 0}},logicalId:u}}static DeploymentConfigs={allAtOnce:()=>({type:"FLEET_PERCENT",value:0}),halfAtATime:()=>({type:"FLEET_PERCENT",value:50}),oneAtATime:()=>({type:"HOST_COUNT",value:1}),custom:(e,a)=>({type:e,value:a})};static TrafficRouting={allAtOnce:()=>({type:"AllAtOnce"}),canary:(e,a)=>({type:"TimeBasedCanary",timeBasedCanary:{canaryPercentage:e,canaryInterval:a}}),linear:(e,a)=>({type:"TimeBasedLinear",timeBasedLinear:{linearPercentage:e,linearInterval:a}})};static RollbackConfigs={onFailure:()=>({enabled:!0,events:["DEPLOYMENT_FAILURE"]}),onAlarmOrFailure:()=>({enabled:!0,events:["DEPLOYMENT_FAILURE","DEPLOYMENT_STOP_ON_ALARM"]}),onAllEvents:()=>({enabled:!0,events:["DEPLOYMENT_FAILURE","DEPLOYMENT_STOP_ON_ALARM","DEPLOYMENT_STOP_ON_REQUEST"]}),disabled:()=>({enabled:!1})};static BlueGreenConfigs={standard:()=>({terminateBlueInstancesOnDeploymentSuccess:{action:"TERMINATE",terminationWaitTimeInMinutes:5},deploymentReadyOption:{actionOnTimeout:"CONTINUE_DEPLOYMENT",waitTimeInMinutes:0},greenFleetProvisioningOption:{action:"COPY_AUTO_SCALING_GROUP"}}),withDelay:(e)=>({terminateBlueInstancesOnDeploymentSuccess:{action:"TERMINATE",terminationWaitTimeInMinutes:e},deploymentReadyOption:{actionOnTimeout:"CONTINUE_DEPLOYMENT",waitTimeInMinutes:0},greenFleetProvisioningOption:{action:"COPY_AUTO_SCALING_GROUP"}}),withManualApproval:(e)=>({terminateBlueInstancesOnDeploymentSuccess:{action:"TERMINATE",terminationWaitTimeInMinutes:5},deploymentReadyOption:{actionOnTimeout:"STOP_DEPLOYMENT",waitTimeInMinutes:e},greenFleetProvisioningOption:{action:"COPY_AUTO_SCALING_GROUP"}}),keepBlue:()=>({terminateBlueInstancesOnDeploymentSuccess:{action:"KEEP_ALIVE"},deploymentReadyOption:{actionOnTimeout:"CONTINUE_DEPLOYMENT",waitTimeInMinutes:0},greenFleetProvisioningOption:{action:"COPY_AUTO_SCALING_GROUP"}})};static UseCases={ec2Deployment:(e,a,r,n)=>{let{application:i,logicalId:o}=Ce.createApplication({slug:e,environment:a,computePlatform:"Server"}),{deploymentGroup:c,logicalId:u}=Ce.createDeploymentGroup(o,{slug:e,environment:a,serviceRoleArn:r,autoScalingGroups:n,deploymentConfigName:"CodeDeployDefault.OneAtATime",autoRollbackConfiguration:Ce.RollbackConfigs.onFailure()});return{application:i,appId:o,deploymentGroup:c,groupId:u}},lambdaCanaryDeployment:(e,a,r,n=10,i=5)=>{let{application:o,logicalId:c}=Ce.createApplication({slug:e,environment:a,computePlatform:"Lambda"}),{deploymentConfig:u,logicalId:d}=Ce.createDeploymentConfig({slug:e,environment:a,trafficRoutingConfig:Ce.TrafficRouting.canary(n,i)}),{deploymentGroup:m,logicalId:p}=Ce.createDeploymentGroup(c,{slug:e,environment:a,serviceRoleArn:r,deploymentConfigName:P.Ref(d),autoRollbackConfiguration:Ce.RollbackConfigs.onAlarmOrFailure()});return{application:o,appId:c,deploymentConfig:u,configId:d,deploymentGroup:m,groupId:p}},ecsBlueGreenDeployment:(e,a,r,n)=>{let{application:i,logicalId:o}=Ce.createApplication({slug:e,environment:a,computePlatform:"ECS"}),{deploymentGroup:c,logicalId:u}=Ce.createDeploymentGroup(o,{slug:e,environment:a,serviceRoleArn:r,loadBalancerInfo:{targetGroupInfoList:[{name:n}]},blueGreenDeploymentConfiguration:Ce.BlueGreenConfigs.standard(),autoRollbackConfiguration:Ce.RollbackConfigs.onFailure()});return{application:i,appId:o,deploymentGroup:c,groupId:u}}};static Strategies={rolling:(e=25)=>({type:"rolling",batchPercentage:e}),blueGreen:()=>({type:"blue-green"}),canary:(e=10,a=5)=>({type:"canary",canaryPercentage:e,canaryInterval:a}),allAtOnce:()=>({type:"all-at-once"})}}class re{static ContentTypes={".html":"text/html",".htm":"text/html",".css":"text/css",".js":"application/javascript",".mjs":"application/javascript",".json":"application/json",".xml":"application/xml",".svg":"image/svg+xml",".png":"image/png",".jpg":"image/jpeg",".jpeg":"image/jpeg",".gif":"image/gif",".webp":"image/webp",".avif":"image/avif",".ico":"image/x-icon",".woff":"font/woff",".woff2":"font/woff2",".ttf":"font/ttf",".otf":"font/otf",".eot":"application/vnd.ms-fontobject",".pdf":"application/pdf",".txt":"text/plain",".md":"text/markdown",".map":"application/json"};static NoHashPatterns=[/^index\.html$/,/^favicon\.ico$/,/^robots\.txt$/,/^sitemap\.xml$/,/^manifest\.json$/,/^\.well-known\//,/^_redirects$/,/^_headers$/];static computeFileHash(e,a="md5"){let r=at(e);return gn(a).update(r).digest("hex")}static computeShortHash(e){return re.computeFileHash(e).slice(0,8)}static getContentType(e){let a=Ma(e).toLowerCase();return re.ContentTypes[a]||"application/octet-stream"}static shouldHashFile(e,a){return![...re.NoHashPatterns,...a||[]].some((r)=>r.test(e))}static generateHashedFilename(e,a){let r=Ma(e),n=Sn(e,r),i=La(e);if(i===".")return`${n}.${a}${r}`;return je(i,`${n}.${a}${r}`)}static collectFiles(e,a){let r=[],n=a||e;if(!Rt(e))return r;let i=yn(e,{withFileTypes:!0});for(let o of i){let c=je(e,o.name);if(o.isDirectory())r.push(...re.collectFiles(c,n));else if(o.isFile())r.push(c)}return r}static hashDirectory(e){let{sourceDir:a,outputDir:r,excludePatterns:n=[],hashAlgorithm:i="md5",copyUnhashed:o=!0}=e,c=re.collectFiles(a),u=[],d={};for(let p of c){let g=p.replace(a,"").replace(/^[/\\]/,""),h=re.shouldHashFile(g,n),y=fn(p),f=h?re.computeFileHash(p,i).slice(0,8):"",b=h?re.generateHashedFilename(g,f):g,T={originalPath:g,hashedPath:b,hash:f,size:y.size,contentType:re.getContentType(p)};if(u.push(T),d[g]=b,r){let w=je(r,b),I=La(w);if(!Rt(I)){let{mkdirSync:v}=Dr("node:fs");v(I,{recursive:!0})}if(h||o)hn(p,w)}}let m={version:"1.0",timestamp:new Date().toISOString(),assets:u,hashMap:d};if(r){let p=je(r,"asset-manifest.json");nt(p,JSON.stringify(m,null,2))}return m}static getInvalidationPaths(e,a){let r=[];if(!e)return["/*"];let n=e.hashMap,i=a.hashMap;for(let[o,c]of Object.entries(i)){let u=n[o];if(!u||u!==c){if(r.push(`/${o}`),u&&u!==c)r.push(`/${u}`)}}for(let[o,c]of Object.entries(n))if(!i[o])r.push(`/${o}`),r.push(`/${c}`);if(r.length>100)return["/*"];return[...new Set(r)]}static updateHtmlReferences(e){let{htmlDir:a,manifest:r,basePath:n=""}=e,i=re.collectFiles(a).filter((o)=>o.endsWith(".html")||o.endsWith(".htm"));for(let o of i){let c=at(o,"utf-8");for(let[u,d]of Object.entries(r.hashMap)){if(u===d)continue;let m=[new RegExp(`(src|href)=["']${n}/?${re.escapeRegExp(u)}["']`,"g"),new RegExp(`url\\(["']?${n}/?${re.escapeRegExp(u)}["']?\\)`,"g")];for(let p of m)c=c.replace(p,(g)=>g.replace(u,d))}nt(o,c)}}static updateCssReferences(e){let{cssDir:a,manifest:r,basePath:n=""}=e,i=re.collectFiles(a).filter((o)=>o.endsWith(".css"));for(let o of i){let c=at(o,"utf-8");for(let[u,d]of Object.entries(r.hashMap)){if(u===d)continue;let m=new RegExp(`url\\(["']?${n}/?${re.escapeRegExp(u)}["']?\\)`,"g");c=c.replace(m,`url(${n}/${d})`)}nt(o,c)}}static escapeRegExp(e){return e.replace(/[.*+?^${}()|[\]\\]/g,"\\$&")}static generateS3DeploymentManifest(e){let{sourceDir:a,keyPrefix:r="",excludePatterns:n=[],cacheControl:i={hashed:"public, max-age=31536000, immutable",unhashed:"public, max-age=3600",html:"public, max-age=0, must-revalidate"}}=e;return re.hashDirectory({sourceDir:a,excludePatterns:n}).assets.map((o)=>{let c=o.hash!=="",u=o.contentType==="text/html",d=i.unhashed||"public, max-age=3600";if(u)d=i.html||"public, max-age=0, must-revalidate";else if(c)d=i.hashed||"public, max-age=31536000, immutable";return{localPath:je(a,o.originalPath),s3Key:r?`${r}/${o.hashedPath}`:o.hashedPath,contentType:o.contentType,cacheControl:d,hash:o.hash}})}static compareManifests(e,a){let r={added:[],removed:[],changed:[],unchanged:[]},n=new Set(Object.keys(e.hashMap)),i=new Set(Object.keys(a.hashMap));for(let o of i)if(!n.has(o))r.added.push(o);for(let o of n)if(!i.has(o))r.removed.push(o);for(let o of i)if(n.has(o))if(e.hashMap[o]!==a.hashMap[o])r.changed.push(o);else r.unchanged.push(o);return r}static loadManifest(e){if(!Rt(e))return null;try{let a=at(e,"utf-8");return JSON.parse(a)}catch{return null}}static saveManifest(e,a){nt(a,JSON.stringify(e,null,2))}}class Ti{static createSecret(e){let{slug:a,environment:r,secretName:n,description:i,secretString:o,kmsKeyId:c,tags:u}=e,d=n||l({slug:a,environment:r,resourceType:"secret"}),m=s(d),p={Type:"AWS::SecretsManager::Secret",Properties:{Name:d,Description:i,SecretString:o,Tags:[{Key:"Name",Value:d},{Key:"Environment",Value:r},...u?Object.entries(u).map(([g,h])=>({Key:g,Value:h})):[]]}};if(c)p.Properties.KmsKeyId=c;return{secret:p,logicalId:m}}static createGeneratedSecret(e){let{slug:a,environment:r,secretName:n,description:i,excludeCharacters:o,excludeLowercase:c,excludeNumbers:u,excludePunctuation:d,excludeUppercase:m,passwordLength:p,requireEachIncludedType:g,kmsKeyId:h,tags:y}=e,f=n||l({slug:a,environment:r,resourceType:"secret"}),b=s(f),T={Type:"AWS::SecretsManager::Secret",Properties:{Name:f,Description:i,GenerateSecretString:{ExcludeCharacters:o,ExcludeLowercase:c,ExcludeNumbers:u,ExcludePunctuation:d,ExcludeUppercase:m,PasswordLength:p||32,RequireEachIncludedType:g!==!1},Tags:[{Key:"Name",Value:f},{Key:"Environment",Value:r},...y?Object.entries(y).map(([w,I])=>({Key:w,Value:I})):[]]}};if(h)T.Properties.KmsKeyId=h;return{secret:T,logicalId:b}}static createDatabaseSecret(e){let{slug:a,environment:r,secretName:n,username:i,dbname:o,engine:c,host:u,port:d,kmsKeyId:m}=e,p=n||l({slug:a,environment:r,resourceType:"db-secret"}),g=s(p),h={username:i};if(o)h.dbname=o;if(c)h.engine=c;if(u)h.host=u;if(d)h.port=d;let y={Type:"AWS::SecretsManager::Secret",Properties:{Name:p,Description:`Database credentials for ${i}`,GenerateSecretString:{SecretStringTemplate:JSON.stringify(h),GenerateStringKey:"password",PasswordLength:32,ExcludeCharacters:'"@/\\',RequireEachIncludedType:!0},Tags:[{Key:"Name",Value:p},{Key:"Environment",Value:r},{Key:"Type",Value:"database"}]}};if(m)y.Properties.KmsKeyId=m;return{secret:y,logicalId:g}}static attachToDatabase(e){let{slug:a,environment:r,secretId:n,targetId:i,targetType:o}=e,c=l({slug:a,environment:r,resourceType:"secret-attachment"}),u=s(c);return{attachment:{Type:"AWS::SecretsManager::SecretTargetAttachment",Properties:{SecretId:n,TargetId:i,TargetType:o}},logicalId:u}}static enableRotation(e){let{slug:a,environment:r,secretId:n,rotationLambdaArn:i,automaticallyAfterDays:o,rotationType:c,kmsKeyArn:u,vpcSecurityGroupIds:d,vpcSubnetIds:m}=e,p=l({slug:a,environment:r,resourceType:"secret-rotation"}),g=s(p),h={Type:"AWS::SecretsManager::RotationSchedule",Properties:{SecretId:n,RotationRules:{AutomaticallyAfterDays:o||30}}};if(i)h.Properties.RotationLambdaARN=i;else if(c)h.Properties.HostedRotationLambda={RotationType:c,KmsKeyArn:u,VpcSecurityGroupIds:d,VpcSubnetIds:m};return{rotation:h,logicalId:g}}static SecretTypes={apiKey:(e,a,r)=>Ti.createGeneratedSecret({slug:e,environment:a,secretName:`${e}-${a}-${r}-api-key`,description:`API key for ${r}`,passwordLength:32,excludePunctuation:!0,excludeLowercase:!1,excludeUppercase:!1,excludeNumbers:!1}),oauthClientSecret:(e,a,r)=>Ti.createGeneratedSecret({slug:e,environment:a,secretName:`${e}-${a}-${r}-oauth-secret`,description:`OAuth client secret for ${r}`,passwordLength:64,excludeCharacters:"\"'`\\/@",requireEachIncludedType:!0}),jwtSecret:(e,a)=>Ti.createGeneratedSecret({slug:e,environment:a,secretName:`${e}-${a}-jwt-secret`,description:"JWT signing secret",passwordLength:64,excludePunctuation:!0}),encryptionKey:(e,a)=>Ti.createGeneratedSecret({slug:e,environment:a,secretName:`${e}-${a}-encryption-key`,description:"Data encryption key",passwordLength:64,excludeCharacters:"+/=",excludePunctuation:!0})};static RotationTypes={MySQLSingleUser:"MySQLSingleUser",MySQLMultiUser:"MySQLMultiUser",PostgreSQLSingleUser:"PostgreSQLSingleUser",PostgreSQLMultiUser:"PostgreSQLMultiUser",OracleSingleUser:"OracleSingleUser",OracleMultiUser:"OracleMultiUser",MariaDBSingleUser:"MariaDBSingleUser",MariaDBMultiUser:"MariaDBMultiUser",SQLServerSingleUser:"SQLServerSingleUser",SQLServerMultiUser:"SQLServerMultiUser",RedshiftSingleUser:"RedshiftSingleUser",RedshiftMultiUser:"RedshiftMultiUser",MongoDBSingleUser:"MongoDBSingleUser",MongoDBMultiUser:"MongoDBMultiUser"}}class X{static createParameter(e){let{slug:a,environment:r,parameterName:n,value:i,type:o="String",description:c,tier:u="Standard",tags:d}=e,m=n||l({slug:a,environment:r,resourceType:"parameter"}),p=s(m);return{parameter:{Type:"AWS::SSM::Parameter",Properties:{Name:`/${a}/${r}/${m}`,Type:o,Value:i,Description:c,Tier:u,Tags:{Name:m,Environment:r,...d}}},logicalId:p}}static createString(e,a,r,n,i){return X.createParameter({slug:e,environment:a,parameterName:r,value:n,type:"String",description:i})}static createSecureString(e,a,r,n,i){return X.createParameter({slug:e,environment:a,parameterName:r,value:n,type:"SecureString",description:i})}static createStringList(e,a,r,n,i){return X.createParameter({slug:e,environment:a,parameterName:r,value:n.join(","),type:"StringList",description:i})}static Parameters={databaseUrl:(e,a,r)=>X.createSecureString(e,a,"database-url",r,"Database connection URL"),apiEndpoint:(e,a,r)=>X.createString(e,a,"api-endpoint",r,"API endpoint URL"),appVersion:(e,a,r)=>X.createString(e,a,"app-version",r,"Application version"),featureFlags:(e,a,r)=>X.createStringList(e,a,"feature-flags",r,"Enabled feature flags"),apiKey:(e,a,r,n)=>X.createSecureString(e,a,`${r}-api-key`,n,`API key for ${r}`),oauthCredentials:(e,a,r,n)=>{let i=X.createString(e,a,"oauth-client-id",r,"OAuth client ID"),o=X.createSecureString(e,a,"oauth-client-secret",n,"OAuth client secret");return{clientId:i,clientSecret:o}},smtpCredentials:(e,a,r,n,i,o)=>{let c=X.createString(e,a,"smtp-username",r,"SMTP username"),u=X.createSecureString(e,a,"smtp-password",n,"SMTP password"),d=X.createString(e,a,"smtp-host",i,"SMTP host"),m=X.createString(e,a,"smtp-port",o.toString(),"SMTP port");return{username:c,password:u,host:d,port:m}},redisUrl:(e,a,r)=>X.createSecureString(e,a,"redis-url",r,"Redis connection URL"),s3Bucket:(e,a,r)=>X.createString(e,a,"s3-bucket",r,"S3 bucket name"),cloudFrontDistribution:(e,a,r)=>X.createString(e,a,"cloudfront-distribution-id",r,"CloudFront distribution ID")}}class Ht{static createDomain(e){let{slug:a,environment:r,domainName:n,engineVersion:i="OpenSearch_2.11",instanceType:o="t3.small.search",instanceCount:c=1,volumeSize:u=10,volumeType:d="gp3",dedicatedMaster:m=!1,dedicatedMasterType:p,dedicatedMasterCount:g=3,multiAz:h=!1,availabilityZoneCount:y=2,vpc:f,encryption:b,enforceHttps:T=!0,tlsSecurityPolicy:w="Policy-Min-TLS-1-2-2019-07",advancedSecurity:I,autoSnapshotHour:v=0,autoTune:N=!0,tags:R={}}=e,k=n||l({slug:a,environment:r,resourceType:"search"}),x=s(k);return{domain:{Type:"AWS::OpenSearchService::Domain",Properties:{DomainName:k,EngineVersion:i,ClusterConfig:{InstanceType:o,InstanceCount:c,DedicatedMasterEnabled:m,...m&&{DedicatedMasterType:p||o,DedicatedMasterCount:g},ZoneAwarenessEnabled:h,...h&&{ZoneAwarenessConfig:{AvailabilityZoneCount:y}}},EBSOptions:{EBSEnabled:!0,VolumeType:d,VolumeSize:u},DomainEndpointOptions:{EnforceHTTPS:T,TLSSecurityPolicy:w},SnapshotOptions:{AutomatedSnapshotStartHour:v},...f&&{VPCOptions:{SubnetIds:f.subnetIds,SecurityGroupIds:f.securityGroupIds}},...b&&{EncryptionAtRestOptions:{Enabled:b.atRest??!0,...b.kmsKeyId&&{KmsKeyId:b.kmsKeyId}},NodeToNodeEncryptionOptions:{Enabled:b.nodeToNode??!0}},...I&&{AdvancedSecurityOptions:{Enabled:I.enabled,InternalUserDatabaseEnabled:I.internalUserDatabase??!0,...I.masterUserName&&I.masterUserPassword&&{MasterUserOptions:{MasterUserName:I.masterUserName,MasterUserPassword:I.masterUserPassword}},...I.masterUserArn&&{MasterUserOptions:{MasterUserARN:I.masterUserArn}}}},...N&&{AutoTuneOptions:{DesiredState:"ENABLED"}},Tags:[{Key:"Name",Value:k},{Key:"Environment",Value:r},...Object.entries(R).map(([L,B])=>({Key:L,Value:B}))]}},logicalId:x}}static createAccessPolicy(e,a){let{ipAddresses:r,iamPrincipalArns:n,allowAll:i,vpcEndpoint:o}=a;if(i)return{Version:"2012-10-17",Statement:[{Effect:"Allow",Principal:{AWS:"*"},Action:"es:*",Resource:e}]};let c=[];if(n&&n.length>0)c.push({Effect:"Allow",Principal:{AWS:n},Action:"es:*",Resource:e});if(r&&r.length>0)c.push({Effect:"Allow",Principal:{AWS:"*"},Action:"es:*",Resource:e,Condition:{IpAddress:{"aws:SourceIp":r}}});if(o)return{Version:"2012-10-17",Statement:[{Effect:"Allow",Principal:{AWS:"*"},Action:"es:*",Resource:e}]};return{Version:"2012-10-17",Statement:c}}static DomainPresets={development:(e,a)=>Ht.createDomain({slug:e,environment:a,instanceType:"t3.small.search",instanceCount:1,volumeSize:10,multiAz:!1,dedicatedMaster:!1,encryption:{atRest:!0,nodeToNode:!0},autoTune:!1}),production:(e,a,r)=>Ht.createDomain({slug:e,environment:a,instanceType:"m6g.large.search",instanceCount:3,volumeSize:100,volumeType:"gp3",multiAz:!0,availabilityZoneCount:3,dedicatedMaster:!0,dedicatedMasterType:"m6g.large.search",dedicatedMasterCount:3,vpc:r,encryption:{atRest:!0,nodeToNode:!0},advancedSecurity:{enabled:!0,internalUserDatabase:!0},autoTune:!0}),costOptimized:(e,a)=>Ht.createDomain({slug:e,environment:a,instanceType:"t3.medium.search",instanceCount:2,volumeSize:20,volumeType:"gp3",multiAz:!0,dedicatedMaster:!1,encryption:{atRest:!0,nodeToNode:!0},autoTune:!0}),highPerformance:(e,a,r)=>Ht.createDomain({slug:e,environment:a,instanceType:"r6g.2xlarge.search",instanceCount:6,volumeSize:500,volumeType:"gp3",multiAz:!0,availabilityZoneCount:3,dedicatedMaster:!0,dedicatedMasterType:"c6g.xlarge.search",dedicatedMasterCount:3,vpc:r,encryption:{atRest:!0,nodeToNode:!0},advancedSecurity:{enabled:!0,internalUserDatabase:!1},autoTune:!0})};static InstanceTypes={"t3.small.search":"t3.small.search","t3.medium.search":"t3.medium.search","m6g.large.search":"m6g.large.search","m6g.xlarge.search":"m6g.xlarge.search","m6g.2xlarge.search":"m6g.2xlarge.search","r6g.large.search":"r6g.large.search","r6g.xlarge.search":"r6g.xlarge.search","r6g.2xlarge.search":"r6g.2xlarge.search","r6g.4xlarge.search":"r6g.4xlarge.search","c6g.large.search":"c6g.large.search","c6g.xlarge.search":"c6g.xlarge.search","c6g.2xlarge.search":"c6g.2xlarge.search"};static EngineVersions={"OpenSearch_2.11":"OpenSearch_2.11","OpenSearch_2.9":"OpenSearch_2.9","OpenSearch_2.7":"OpenSearch_2.7","OpenSearch_1.3":"OpenSearch_1.3","Elasticsearch_7.10":"Elasticsearch_7.10"}}class Ct{static createDomainRedirectBucket(e){let{slug:a,environment:r,sourceDomain:n,targetDomain:i,protocol:o="https"}=e,c=l({slug:a,environment:r,resourceType:"s3",suffix:"redirect"}),u=s(c),d=s(`${c}-policy`),m={Type:"AWS::S3::Bucket",Properties:{BucketName:n,WebsiteConfiguration:{RedirectAllRequestsTo:{HostName:i,Protocol:o}},PublicAccessBlockConfiguration:{BlockPublicAcls:!1,BlockPublicPolicy:!1,IgnorePublicAcls:!1,RestrictPublicBuckets:!1},Tags:[{Key:"Name",Value:c},{Key:"Environment",Value:r},{Key:"Purpose",Value:"Domain Redirect"}]}},p={Type:"AWS::S3::BucketPolicy",Properties:{Bucket:P.Ref(u),PolicyDocument:{Version:"2012-10-17",Statement:[{Sid:"PublicReadForRedirect",Effect:"Allow",Principal:"*",Action:["s3:GetObject"],Resource:[P.Join("",[P.GetAtt(u,"Arn"),"/*"])]}]}}};return{bucket:m,bucketPolicy:p,logicalId:u,policyLogicalId:d}}static createPathRedirectFunction(e){let{slug:a,environment:r,rules:n}=e,i=l({slug:a,environment:r,resourceType:"cf-redirect"}),o=s(i),c=Ct.generateRedirectFunctionCode(n);return{function:{Type:"AWS::CloudFront::Function",Properties:{Name:i,AutoPublish:!0,FunctionConfig:{Comment:`Path redirect function for ${a} (${r})`,Runtime:"cloudfront-js-2.0"},FunctionCode:c}},logicalId:o,functionCode:c}}static generateRedirectFunctionCode(e){return`function handler(event) {
   const request = event.request;
   const uri = request.uri;
   const querystring = request.querystring;
@@ -2493,7 +2493,7 @@ rpm -U ./amazon-cloudwatch-agent.rpm || true
 `}},storage:{uploads:{type:"efs",performanceMode:"generalPurpose",throughputMode:"bursting",encrypted:!0,lifecyclePolicy:{transitionToIA:30}},backups:{public:!1,versioning:!0,encryption:!0,lifecycleRules:[{id:"ArchiveOldBackups",enabled:!0,transitions:[{days:90,storageClass:"GLACIER"}]}]},static:{public:!0,versioning:!1,encryption:!1,cors:[{allowedOrigins:[n||"*"],allowedMethods:["GET","HEAD"]}]}},cdn:{enabled:!0,origins:[{originId:"static-assets",domainName:`${r}-static.s3.amazonaws.com`,pathPattern:"/static/*"}],customDomain:n?{domain:n,certificateArn:"TO_BE_GENERATED"}:void 0,cachePolicy:{minTTL:0,defaultTTL:86400,maxTTL:31536000},compress:!0,http3:!0},databases:u==="mysql"?{mysql:{engine:"mysql",version:"8.0",instanceClass:"db.t3.medium",allocatedStorage:100,maxAllocatedStorage:500,multiAZ:!0,backupRetentionDays:14,preferredBackupWindow:"03:00-04:00",preferredMaintenanceWindow:"sun:04:00-sun:05:00",enablePerformanceInsights:!0,performanceInsightsRetention:7,deletionProtection:!0,parameters:{max_connections:"500",innodb_buffer_pool_size:"{DBInstanceClassMemory*3/4}",slow_query_log:"1",long_query_time:"2"}}}:{postgres:{engine:"postgres",version:"15",instanceClass:"db.t3.medium",allocatedStorage:100,maxAllocatedStorage:500,multiAZ:!0,backupRetentionDays:14,preferredBackupWindow:"03:00-04:00",preferredMaintenanceWindow:"sun:04:00-sun:05:00",enablePerformanceInsights:!0,performanceInsightsRetention:7,deletionProtection:!0,parameters:{max_connections:"500",shared_buffers:"{DBInstanceClassMemory/4}",log_min_duration_statement:"2000"}}},cache:d==="redis"?{redis:{nodeType:"cache.t3.medium",numCacheNodes:2,engine:"redis",engineVersion:"7.0",port:6379,parameterGroup:{maxmemoryPolicy:"allkeys-lru",timeout:"300"},snapshotRetentionLimit:5,snapshotWindow:"03:00-05:00",automaticFailoverEnabled:!0}}:void 0,queues:{jobs:{fifo:!1,visibilityTimeout:900,messageRetentionPeriod:345600,receiveMessageWaitTime:20,deadLetterQueue:!0,maxReceiveCount:3},emails:{fifo:!1,visibilityTimeout:300,messageRetentionPeriod:86400,deadLetterQueue:!0}},functions:{"job-worker":{runtime:"nodejs20.x",handler:"dist/workers/jobs.handler",memory:2048,timeout:900,events:[{type:"sqs",queueName:`${r}-jobs`,batchSize:10}]},"email-sender":{runtime:"nodejs20.x",handler:"dist/workers/email.handler",memory:512,timeout:60,events:[{type:"sqs",queueName:`${r}-emails`,batchSize:10}]},cleanup:{runtime:"nodejs20.x",handler:"dist/tasks/cleanup.handler",memory:512,timeout:300,events:[{type:"schedule",expression:"cron(0 2 * * ? *)"}]}},monitoring:{dashboard:{name:`${r}-web-app`,widgets:[{type:"metric",metrics:["EC2CPUUtilization","ALBRequestCount","ALBTargetResponseTime","RDSCPUUtilization","RDSDatabaseConnections","RDSReadLatency","RDSWriteLatency"]}]},alarms:[{metric:"EC2CPUUtilization",threshold:80,evaluationPeriods:2},{metric:"RDSCPUUtilization",threshold:80,evaluationPeriods:2},{metric:"RDSDatabaseConnections",threshold:400,evaluationPeriods:1},{metric:"ALBTargetResponseTime",threshold:2000,evaluationPeriods:2},{metric:"ALBUnhealthyHostCount",threshold:1,evaluationPeriods:1}],logs:{retention:14,groups:[`${r}-app`,`${r}-nginx`,`${r}-workers`]}},security:{certificate:n?{domain:n,validationMethod:"DNS"}:void 0,waf:{enabled:!0,rules:["rateLimit","sqlInjection","xss","knownBadInputs"]},securityGroups:{alb:{ingress:[{port:80,protocol:"tcp",cidr:"0.0.0.0/0"},{port:443,protocol:"tcp",cidr:"0.0.0.0/0"}]},app:{ingress:[{port:3000,protocol:"tcp",source:"alb-sg"}]},database:{ingress:[{port:u==="mysql"?3306:5432,protocol:"tcp",source:"app-sg"}]},...d==="redis"&&{cache:{ingress:[{port:6379,protocol:"tcp",source:"app-sg"}]}}}}}}}function Zp(e){let{name:a,slug:r,domain:n,repository:i,phpVersion:o="8.3",size:c="small",database:u=r.replace(/-/g,"_"),databasePassword:d,sslEmail:m,deployStrategy:p="push",provider:g="hetzner"}=e;return{project:{name:a,slug:r,region:"us-east-1"},mode:"server",cloud:{provider:g},environments:{production:{type:"production",domain:n}},infrastructure:{compute:{mode:"server",size:c,runtime:"php",webServer:"nginx",php:{versions:[o],default:o},managedServices:{mysql:!0,redis:!0},firewall:{enabled:!0},autoUpdates:!0,monitoring:!0,backups:{enabled:!0,schedule:"0 2 * * *",retentionCount:7}},appDatabase:{engine:"mysql",name:u,username:u,password:d}},sites:{main:{root:".",type:"laravel",domain:n,phpVersion:o,repository:{...i,strategy:p},scheduler:!0,queues:[{connection:"redis",queue:"default",processes:1}],ssl:{provider:"letsencrypt",email:m}}}}}function em(e){let{name:a,slug:r,domain:n,layers:i,phpVersion:o="8.3",architecture:c="x86_64",memory:u=1024,build:d,deploy:m=["migrate --force"],cache:p="dynamodb",scheduler:g="on",region:h="us-east-1"}=e;return{project:{name:a,slug:r,region:h},mode:"serverless",environments:{production:{type:"production",domain:n,app:{kind:"php",runtime:"provided.al2023",phpVersion:o,architecture:c,layers:i,memory:u,build:d,deploy:m,assets:"public",queues:!0,scheduler:g,cache:{driver:p},domain:n}}}}}function tm(e){return{root:e.root??"packages/ui/dist",deploy:"server",type:"static",domain:e.domain,build:e.build??"cd packages/ui && bun install && bun run build",ssl:{provider:"letsencrypt"},auth:{username:e.username??"admin",password:e.password}}}var $d=yc,Od="./node_modules/@stacksjs/ts-cloud/dist/bin/dashboard-server.js";function ri(e){let a=e.split(".").filter(Boolean);return a.length<=2?e:a.slice(-2).join(".")}function ni(e){let a=2166136261;for(let r=0;r<e.length;r++)a^=e.charCodeAt(r),a=Math.imul(a,16777619);return a>>>0}var Ld=20000,Md=12000;function Ud(e){return Ld+ni(e)%Md}function tr(e,a){let r=ri(e);if(r===e)return`dashboard.${r}`;for(let n of a)if(n===r)return`dashboard.${r}`;return`dashboard.${e}`}function ar(e,a){let r=[],n=e.infrastructure?.dns?.domain;if(n&&!e.cloud?.attachTo)r.push(n);if(a&&e.environments?.[a]?.domain)r.push(e.environments[a].domain);for(let i of Object.values(e.sites??{})){let o=i;if(!o||o.redirect)continue;let c=o.domain;if(typeof c==="string")r.push(c);else if(Array.isArray(c))r.push(...c.filter((u)=>typeof u==="string"))}return r.filter((i)=>i&&!i.startsWith("dashboard."))}function Bd(e,a,r){if(r)return r;let n=ar(e,a),i=n[0];if(!i)return null;return tr(i,n)}function Fd(e,a,r){if(r)return[r];let n=ar(e,a),i=[];for(let o of n){let c=tr(o,n);if(!i.includes(c))i.push(c)}return i}function qt(e){return Object.entries(e.sites??{}).some(([a,r])=>{if(!r)return!1;let n=r.root??"";return Pr(a)||n==="ui/dist"||n.endsWith("/ui/dist")||n.endsWith("/dist/ui")})}var Rc="dashboard-";function Pc(e){return Rc+e.replace(/^dashboard\./,"").replace(/\./g,"-")}function Pr(e){return e==="dashboard"||e.startsWith(Rc)}function Ei(e,a,r){if(qt(e))return[];if(e.cloud?.attachTo)return[];let n=r.password?{auth:{username:r.username||"admin",password:r.password,realm:r.realm}}:{},i=r.build===!1||r.build===void 0?{}:{build:r.build};if(r.live!==!1){let o=Bd(e,a,r.domain);if(!o)return[];let c=r.port??Ud(o),u=e.infrastructure?.appDatabase??e.infrastructure?.compute?.database,d={root:r.uiRoot,deploy:"server",domain:o,preStart:["bun install --production --no-save"],start:`bun ${Od} --box --host 127.0.0.1 --port ${c}`,port:c,cpuWeight:10,ioWeight:10,tasksMax:128,env:{APP_ENV:"production",NODE_ENV:"production",TS_CLOUD_DASHBOARD_TELEMETRY:"1",...u?.password?{TS_CLOUD_DASHBOARD_DB_PASSWORD:u.password}:{}},zeroDowntime:!1,sharedPaths:[$d],healthCheck:{path:"/login"},ssl:{provider:"letsencrypt"}};return[{name:Pc(o),site:d}]}return Fd(e,a,r.domain).map((o)=>({name:Pc(o),site:{root:r.uiRoot,deploy:"server",type:"static",domain:o,ssl:{provider:"letsencrypt"},...i,...n}}))}function rm(e,a,r){return Ei(e,a,r)[0]??null}function Ut(e,a){let r={...e};for(let n in a){let i=a[n],o=r[n];if(i===void 0)continue;if(Array.isArray(i)&&Array.isArray(o))r[n]=[...o,...i];else if(typeof i==="object"&&i!==null&&!Array.isArray(i)&&typeof o==="object"&&o!==null&&!Array.isArray(o))r[n]=Ut(o,i);else r[n]=i}return r}function Nc(e,a){return Ut(e,a)}function nm(...e){return e.reduce((a,r)=>Ut(a,r),{})}function im(e,a){return(r)=>{let n=e(r);if(typeof a==="function")return Nc(n,a(n,r));return Nc(n,a)}}function an(e){return{infrastructure:e}}function om(e){return an({monitoring:e})}function sm(e){return an({security:e})}function am(e){return an({databases:e})}function cm(e){return an({cache:e})}function lm(e){return an({cdn:e})}function dm(e){return an({queues:e})}Ye();function jd(){let e=process.env.AWS_ACCESS_KEY_ID,a=process.env.AWS_SECRET_ACCESS_KEY;if(!e||!a)return null;return{accessKeyId:e,secretAccessKey:a,sessionToken:process.env.AWS_SESSION_TOKEN}}function Vd(e){let a=e?.profile||process.env.AWS_PROFILE||"default",r=e?.credentialsFile||ir(nr(),".aws","credentials");if(!rr(r))return null;try{let n=Kt(r,"utf-8");return ii(n,a)}catch{return null}}function ii(e,a){let r=e.split(`
 `),n=null,i,o,c;for(let u of r){let d=u.trim();if(!d||d.startsWith("#")||d.startsWith(";"))continue;let m=d.match(/^\[([^\]]+)\]$/);if(m){if(n===a&&i&&o)return{accessKeyId:i,secretAccessKey:o,sessionToken:c};n=m[1],i=void 0,o=void 0,c=void 0;continue}if(n===a){let[p,...g]=d.split("="),h=g.join("=").trim();switch(p.trim().toLowerCase()){case"aws_access_key_id":i=h;break;case"aws_secret_access_key":o=h;break;case"aws_session_token":c=h;break}}}if(n===a&&i&&o)return{accessKeyId:i,secretAccessKey:o,sessionToken:c};return null}async function zd(e){let a=e?.timeout??1000,r="http://169.254.169.254";try{let n=await ze("http://169.254.169.254/latest/api/token",{method:"PUT",headers:{"X-aws-ec2-metadata-token-ttl-seconds":"21600"}},a);if(!n.ok)return null;let i=await n.text(),o=await ze("http://169.254.169.254/latest/meta-data/iam/security-credentials/",{headers:{"X-aws-ec2-metadata-token":i}},a);if(!o.ok)return null;let c=(await o.text()).trim(),u=await ze(`http://169.254.169.254/latest/meta-data/iam/security-credentials/${c}`,{headers:{"X-aws-ec2-metadata-token":i}},a);if(!u.ok)return null;let d=await u.json();return{accessKeyId:d.AccessKeyId,secretAccessKey:d.SecretAccessKey,sessionToken:d.Token,expiration:new Date(d.Expiration)}}catch{return null}}async function Hd(e){let a=e?.timeout??1000,r=process.env.AWS_CONTAINER_CREDENTIALS_RELATIVE_URI,n=process.env.AWS_CONTAINER_CREDENTIALS_FULL_URI,i=null;if(r)i=`http://169.254.170.2${r}`;else if(n)i=n;if(!i)return null;try{let o={},c=process.env.AWS_CONTAINER_AUTHORIZATION_TOKEN;if(c)o.Authorization=c;let u=await ze(i,{headers:o},a);if(!u.ok)return null;let d=await u.json();return{accessKeyId:d.AccessKeyId,secretAccessKey:d.SecretAccessKey,sessionToken:d.Token,expiration:new Date(d.Expiration)}}catch{return null}}async function qd(e){let a=e?.timeout??5000,r=process.env.AWS_WEB_IDENTITY_TOKEN_FILE,n=process.env.AWS_ROLE_ARN,i=process.env.AWS_ROLE_SESSION_NAME||"ts-cloud-session";if(!r||!n)return null;try{let o=Kt(r,"utf-8").trim(),c=process.env.AWS_REGION||process.env.AWS_DEFAULT_REGION||"us-east-1",u=c.startsWith("us-gov")?`https://sts.${c}.amazonaws.com`:c==="us-east-1"?"https://sts.amazonaws.com":`https://sts.${c}.amazonaws.com`,d=new URLSearchParams({Action:"AssumeRoleWithWebIdentity",Version:"2011-06-15",RoleArn:n,RoleSessionName:i,WebIdentityToken:o}),m=await ze(`${u}/?${d.toString()}`,{method:"POST"},a);if(!m.ok)return null;let p=await m.text(),g=qe(p,"AccessKeyId"),h=qe(p,"SecretAccessKey"),y=qe(p,"SessionToken"),f=qe(p,"Expiration");if(!g||!h)return null;return{accessKeyId:g,secretAccessKey:h,sessionToken:y??void 0,expiration:f?new Date(f):void 0}}catch{return null}}async function $o(e){let a=jd();if(a)return a;let r=Vd(e);if(r)return r;let n=await qd(e);if(n)return n;let i=await Hd(e);if(i)return i;let o=await zd(e);if(o)return o;throw Error("Could not find AWS credentials. Set AWS_ACCESS_KEY_ID and AWS_SECRET_ACCESS_KEY environment variables, or configure ~/.aws/credentials, or run on an EC2 instance with an IAM role.")}function um(e){let a=null,r=null;return async()=>{if(a){if(!a.expiration)return a;let n=300000;if(a.expiration.getTime()-Date.now()>n)return a}if(r)return r;return r=$o(e).then((n)=>(a=n,r=null,n)).catch((n)=>{throw r=null,n}),r}}async function ze(e,a,r){let n=new AbortController,i=setTimeout(()=>n.abort(),r);try{let o=await fetch(e,{...a,signal:n.signal});return clearTimeout(i),o}catch(o){throw clearTimeout(i),o}}function qe(e,a){let r=new RegExp(`<${a}>([^<]+)</${a}>`),n=e.match(r);return n?n[1]:null}async function ua(e){return $o({profile:e})}function Wd(e){let a=process.env.AWS_REGION||process.env.AWS_DEFAULT_REGION;if(a)return a;let r=ir(nr(),".aws","config");if(rr(r))try{let n=Kt(r,"utf-8"),i=e||process.env.AWS_PROFILE||"default",o=i==="default"?"[default]":`[profile ${i}]`,c=n.split(`
 `),u=!1;for(let d of c){let m=d.trim();if(m.startsWith("[")){u=m===o;continue}if(u&&m.startsWith("region")){let[,p]=m.split("=");if(p)return p.trim()}}}catch{}return"us-east-1"}async function Gd(e){let a=e||await $o(),r=Wd();await Ye();let n=r.startsWith("us-gov")?`https://sts.${r}.amazonaws.com`:r==="us-east-1"?"https://sts.amazonaws.com":`https://sts.${r}.amazonaws.com`,i="Action=GetCallerIdentity&Version=2011-06-15",o=ae({method:"POST",url:n,body:"Action=GetCallerIdentity&Version=2011-06-15",headers:{"Content-Type":"application/x-www-form-urlencoded"},...a,service:"sts",region:r}),c=await fetch(o.url,{method:o.method,headers:o.headers,body:o.body});if(!c.ok)throw Error(`Failed to get account ID: ${await c.text()}`);let u=await c.text(),d=qe(u,"Account");if(!d)throw Error("Failed to parse account ID from response");return d}await Ye();class Kd{profile;credentials=null;region;constructor(e="us-east-1",a="default"){this.profile=a,this.region=e}async init(){if(this.credentials=await ua(this.profile),this.credentials.region)this.region=this.credentials.region}async ensureCredentials(){if(!this.credentials)await this.init();return this.credentials}async request(e,a){let r=await this.ensureCredentials(),n={Action:e,Version:"2010-05-15",...Bt(a)},i=new URLSearchParams(n).toString(),o=await(await fi({method:"POST",url:`https://cloudformation.${this.region}.amazonaws.com/`,service:"cloudformation",region:this.region,headers:{"Content-Type":"application/x-www-form-urlencoded"},body:i,accessKeyId:r.accessKeyId,secretAccessKey:r.secretAccessKey,sessionToken:r.sessionToken})).text();return si(o)}async createStack(e){let a={StackName:e.stackName};if(e.templateBody)a.TemplateBody=e.templateBody;else if(e.templateURL)a.TemplateURL=e.templateURL;else throw Error("Either templateBody or templateURL must be provided");if(e.parameters)for(let[n,[i,o]]of Object.entries(e.parameters).entries())a[`Parameters.member.${n+1}.ParameterKey`]=i,a[`Parameters.member.${n+1}.ParameterValue`]=o;if(e.capabilities)for(let[n,i]of e.capabilities.entries())a[`Capabilities.member.${n+1}`]=i;if(e.tags)for(let[n,[i,o]]of Object.entries(e.tags).entries())a[`Tags.member.${n+1}.Key`]=i,a[`Tags.member.${n+1}.Value`]=o;if(e.timeoutInMinutes)a.TimeoutInMinutes=e.timeoutInMinutes;if(e.onFailure)a.OnFailure=e.onFailure;let r=await this.request("CreateStack",a);return(r?.CreateStackResult||r?.CreateStackResponse?.CreateStackResult||r)?.StackId}async updateStack(e){let a={StackName:e.stackName};if(e.templateBody)a.TemplateBody=e.templateBody;else if(e.templateURL)a.TemplateURL=e.templateURL;if(e.parameters)for(let[n,[i,o]]of Object.entries(e.parameters).entries())a[`Parameters.member.${n+1}.ParameterKey`]=i,a[`Parameters.member.${n+1}.ParameterValue`]=o;if(e.capabilities)for(let[n,i]of e.capabilities.entries())a[`Capabilities.member.${n+1}`]=i;if(e.tags)for(let[n,[i,o]]of Object.entries(e.tags).entries())a[`Tags.member.${n+1}.Key`]=i,a[`Tags.member.${n+1}.Value`]=o;let r=await this.request("UpdateStack",a);return(r?.UpdateStackResult||r?.UpdateStackResponse?.UpdateStackResult||r)?.StackId}async deleteStack(e){await this.request("DeleteStack",{StackName:e})}async describeStack(e){let a=await this.request("DescribeStacks",{StackName:e}),r=(a?.DescribeStacksResult||a?.DescribeStacksResponse?.DescribeStacksResult||a)?.Stacks?.member,n=Array.isArray(r)?r[0]:r;if(!n)throw Error(`Stack ${e} not found`);return oi(n)}async listStacks(e){let a={};if(e)for(let[n,i]of e.entries())a[`StackStatusFilter.member.${n+1}`]=i;let r=await this.request("ListStacks",a);return ci(r)}async describeStackEvents(e){let a=await this.request("DescribeStackEvents",{StackName:e});return li(a)}async waitForStack(e,a,r){let n=0,i=null;while(n<360){n++;let o=await this.describeStack(e);if(r)try{let c=await this.describeStackEvents(e),u=[];if(i){for(let d of c){if(d.EventId===i)break;u.push(d)}u.reverse()}else if(c.length>0)u=[c[0]];for(let d of u)r(d);if(c.length>0)i=c[0].EventId}catch{}if(o.StackStatus&&a.includes(o.StackStatus))return o;if(o.StackStatus?.includes("FAILED")||o.StackStatus?.includes("ROLLBACK"))throw Error(`Stack reached failed state: ${o.StackStatus}
-Reason: ${o.StackStatusReason||"Unknown"}`);await new Promise((c)=>setTimeout(c,5000))}throw Error(`Timeout waiting for stack ${e} to complete`)}async waitForStackWithProgress(e,a,r){let n={"stack-create-complete":["CREATE_COMPLETE"],"stack-update-complete":["UPDATE_COMPLETE"],"stack-delete-complete":["DELETE_COMPLETE"]}[a];if(!n)throw Error(`Unknown waiter: ${a}`);return this.waitForStack(e,n,r)}async createChangeSet(e){let a={StackName:e.stackName,ChangeSetName:e.changeSetName,ChangeSetType:"UPDATE"};if(e.templateBody)a.TemplateBody=e.templateBody;else if(e.templateURL)a.TemplateURL=e.templateURL;if(e.parameters)for(let[r,[n,i]]of Object.entries(e.parameters).entries())a[`Parameters.member.${r+1}.ParameterKey`]=n,a[`Parameters.member.${r+1}.ParameterValue`]=i;if(e.capabilities)for(let[r,n]of e.capabilities.entries())a[`Capabilities.member.${r+1}`]=n;return(await this.request("CreateChangeSet",a)).ChangeSetId}async executeChangeSet(e,a){await this.request("ExecuteChangeSet",{ChangeSetName:e,StackName:a})}async describeStacks(e){let a=typeof e==="string"?e:e.stackName;try{return{Stacks:[await this.describeStack(a)]}}catch{return{Stacks:[]}}}async getStackOutputs(e){let a=await this.request("DescribeStacks",{StackName:e}),r=(a?.DescribeStacksResult||a?.DescribeStacksResponse?.DescribeStacksResult||a)?.Stacks?.member,n=Array.isArray(r)?r[0]:r;if(!n)return{};let i={},o=n.Outputs?.member;if(o){let c=Array.isArray(o)?o:[o];for(let u of c)if(u.OutputKey&&u.OutputValue)i[u.OutputKey]=u.OutputValue}return i}}function Bt(e,a=""){let r={};for(let[n,i]of Object.entries(e)){let o=a?`${a}.${n}`:n;if(Array.isArray(i))i.forEach((c,u)=>{if(typeof c==="object")Object.assign(r,Bt(c,`${o}.${u+1}`));else r[`${o}.${u+1}`]=String(c)});else if(typeof i==="object"&&i!==null)Object.assign(r,Bt(i,o));else if(i!==void 0&&i!==null)r[o]=String(i)}return r}function si(e){e=e.replace(/<\?xml[^?]*\?>\s*/,"").trim();function a(n,i,o){let c=1,u=o,d=`<${i}`,m=`</${i}>`;while(u<n.length&&c>0){let p=n.indexOf(d,u),g=n.indexOf(m,u);if(g===-1)return-1;if(p!==-1&&p<g){let h=n[p+d.length];if(h===">"||h===" "||h==="/"){let y=n.indexOf(">",p);if(y!==-1&&n[y-1]==="/")u=y+1;else c++,u=y+1}else u=p+d.length}else{if(c--,c===0)return g;u=g+m.length}}return-1}function r(n,i){while(i<n.length&&/\s/.test(n[i]))i++;if(i>=n.length||n[i]!=="<"){let y=n.indexOf("<",i);if(y===-1)return{value:n.slice(i).trim(),end:n.length};return{value:n.slice(i,y).trim(),end:y}}if(n[i+1]==="/")return{value:void 0,end:i};let o=n.slice(i).match(/^<(\w+)([^>]*?)\/?>/);if(!o)return{value:void 0,end:i+1};let c=o[1];if(o[0].endsWith("/>"))return{value:"",end:i+o[0].length};let u=i+o[0].length,d=`</${c}>`,m=a(n,c,u);if(m===-1)return{value:void 0,end:i+o[0].length};let p=n.slice(u,m).trim();if(!p.includes("<"))return{value:p,end:m+d.length};let g={},h=u;while(h<m){while(h<m&&/\s/.test(n[h]))h++;if(h>=m)break;if(n[h]!=="<"||n[h+1]==="/")break;let y=n.slice(h).match(/^<(\w+)/);if(!y)break;let f=y[1],b=r(n,h);if(b.value===void 0){h++;continue}if(f==="member"||g[f]!==void 0){if(!Array.isArray(g[f]))g[f]=g[f]!==void 0?[g[f]]:[];g[f].push(b.value)}else g[f]=b.value;h=b.end}return{value:g,end:m+d.length}}return r(e,0).value||{}}function oi(e){return{StackName:e.StackName||"",StackId:e.StackId,StackStatus:e.StackStatus,CreationTime:e.CreationTime,LastUpdatedTime:e.LastUpdatedTime,StackStatusReason:e.StackStatusReason,Description:e.Description}}function ci(e){let a=(e?.ListStacksResult||e?.ListStacksResponse?.ListStacksResult||e)?.StackSummaries?.member;if(!a)return[];return(Array.isArray(a)?a:[a]).map((r)=>({StackName:r.StackName||"",StackId:r.StackId,StackStatus:r.StackStatus,CreationTime:r.CreationTime,LastUpdatedTime:r.LastUpdatedTime,StackStatusReason:r.StackStatusReason,Description:r.Description}))}function li(e){let a=(e?.DescribeStackEventsResult||e?.DescribeStackEventsResponse?.DescribeStackEventsResult||e)?.StackEvents?.member;if(!a)return[];return(Array.isArray(a)?a:[a]).map((r)=>({StackId:r.StackId||"",EventId:r.EventId||"",StackName:r.StackName||"",LogicalResourceId:r.LogicalResourceId||"",PhysicalResourceId:r.PhysicalResourceId,ResourceType:r.ResourceType||"",Timestamp:r.Timestamp||"",ResourceStatus:r.ResourceStatus||"",ResourceStatusReason:r.ResourceStatusReason}))}await Ye();var ui=5242880,Nt=5242880,di=5242880;class Dc{region;endpoint;forcePathStyle;credentials;credentialOptions;retryOptions;constructor(e={}){this.region=e.region||process.env.AWS_REGION||"us-east-1",this.endpoint=e.endpoint||`https://s3.${this.region}.amazonaws.com`,this.forcePathStyle=e.forcePathStyle||!1,this.credentials=e.credentials,this.credentialOptions=e.credentialOptions,this.retryOptions=e.retryOptions||{}}async getCredentials(){if(this.credentials)return this.credentials;return $o(this.credentialOptions)}buildUrl(e,a){let r=a?encodeURIComponent(a).replace(/%2F/g,"/"):"";if(this.forcePathStyle)return a?`${this.endpoint}/${e}/${r}`:`${this.endpoint}/${e}`;let n=new URL(this.endpoint);return n.hostname=`${e}.${n.hostname}`,a?`${n.origin}/${r}`:n.origin}async get(e,a,r={}){let n=await this.getCredentials(),i=this.buildUrl(e,a),o={};if(r.range)o.Range=r.range;if(r.ifModifiedSince)o["If-Modified-Since"]=r.ifModifiedSince.toUTCString();if(r.ifMatch)o["If-Match"]=r.ifMatch;if(r.ifNoneMatch)o["If-None-Match"]=r.ifNoneMatch;let c=new URL(i);if(r.responseContentType)c.searchParams.set("response-content-type",r.responseContentType);if(r.responseContentDisposition)c.searchParams.set("response-content-disposition",r.responseContentDisposition);let u=ae({method:"GET",url:c.toString(),headers:o,...n,service:"s3",region:this.region}),d=await fetch(u.url,{method:u.method,headers:u.headers});if(!d.ok&&d.status!==304){let m=await d.text();throw new Ie(`Failed to get object: ${m}`,d.status,e,a)}return d}async getText(e,a,r={}){return(await this.get(e,a,r)).text()}async getJSON(e,a,r={}){return(await this.get(e,a,r)).json()}async getBuffer(e,a,r={}){return(await this.get(e,a,r)).arrayBuffer()}async put(e,a,r,n={}){let i,o;if(typeof r==="string")i=new TextEncoder().encode(r).length,o=r;else if(r instanceof ArrayBuffer)i=r.byteLength,o=r;else if(r instanceof Uint8Array)i=r.byteLength,o=r;else if(r instanceof Blob)i=r.size,o=r;else return this.uploadMultipart(e,a,r,{...n,partSize:Nt});if(i>di){let c=gi(o).stream();return this.uploadMultipart(e,a,c,{...n,partSize:Nt})}return this.putSimple(e,a,o,i,n)}async putSimple(e,a,r,n,i){let o=await this.getCredentials(),c=this.buildUrl(e,a),u={"Content-Length":String(n),"Content-Type":i.contentType||Ba(a)};if(i.contentEncoding)u["Content-Encoding"]=i.contentEncoding;if(i.cacheControl)u["Cache-Control"]=i.cacheControl;if(i.contentDisposition)u["Content-Disposition"]=i.contentDisposition;if(i.storageClass)u["x-amz-storage-class"]=i.storageClass;if(i.serverSideEncryption)u["x-amz-server-side-encryption"]=i.serverSideEncryption;if(i.acl)u["x-amz-acl"]=i.acl;if(i.tagging)u["x-amz-tagging"]=i.tagging;if(i.metadata)for(let[g,h]of Object.entries(i.metadata))u[`x-amz-meta-${g.toLowerCase()}`]=h;let d;if(typeof r==="string")d=r;else if(r instanceof Blob)d=await r.text();else d=new TextDecoder().decode(r instanceof ArrayBuffer?new Uint8Array(r):r);let m=ae({method:"PUT",url:c,headers:u,body:d,...o,service:"s3",region:this.region}),p=await fetch(m.url,{method:m.method,headers:m.headers,body:r});if(!p.ok){let g=await p.text();throw new Ie(`Failed to put object: ${g}`,p.status,e,a)}return{etag:(p.headers.get("ETag")||"").replace(/"/g,"")}}async delete(e,a){let r=await this.getCredentials(),n=this.buildUrl(e,a),i=ae({method:"DELETE",url:n,...r,service:"s3",region:this.region}),o=await fetch(i.url,{method:i.method,headers:i.headers});if(!o.ok&&o.status!==204){let c=await o.text();throw new Ie(`Failed to delete object: ${c}`,o.status,e,a)}}async deleteMany(e,a){let r=await this.getCredentials(),n=`${this.buildUrl(e)}?delete`,i=`<?xml version="1.0" encoding="UTF-8"?><Delete><Quiet>false</Quiet>${a.map((y)=>`<Object><Key>${pi(y)}</Key></Object>`).join("")}</Delete>`,o=ae({method:"POST",url:n,headers:{"Content-Type":"application/xml"},body:i,...r,service:"s3",region:this.region}),c=await fetch(o.url,{method:o.method,headers:o.headers,body:i});if(!c.ok){let y=await c.text();throw new Ie(`Failed to delete objects: ${y}`,c.status,e)}let u=await c.text(),d=[],m=[],p=/<Deleted><Key>([^<]+)<\/Key>/g,g;while((g=p.exec(u))!==null)d.push(g[1]);let h=/<Error><Key>([^<]+)<\/Key><Code>([^<]+)<\/Code><Message>([^<]+)<\/Message>/g;while((g=h.exec(u))!==null)m.push({key:g[1],error:`${g[2]}: ${g[3]}`});return{deleted:d,errors:m}}async list(e,a={}){let r=await this.getCredentials(),n=new URL(this.buildUrl(e));if(n.searchParams.set("list-type","2"),a.prefix)n.searchParams.set("prefix",a.prefix);if(a.delimiter)n.searchParams.set("delimiter",a.delimiter);if(a.maxKeys)n.searchParams.set("max-keys",String(a.maxKeys));if(a.continuationToken)n.searchParams.set("continuation-token",a.continuationToken);if(a.startAfter)n.searchParams.set("start-after",a.startAfter);let i=ae({method:"GET",url:n.toString(),...r,service:"s3",region:this.region}),o=await fetch(i.url,{method:i.method,headers:i.headers});if(!o.ok){let u=await o.text();throw new Ie(`Failed to list objects: ${u}`,o.status,e)}let c=await o.text();return mi(c)}async*listAll(e,a={}){let r;do{let n=await this.list(e,{...a,continuationToken:r});for(let i of n.contents)yield i;r=n.nextContinuationToken}while(r)}async head(e,a){let r=await this.getCredentials(),n=this.buildUrl(e,a),i=ae({method:"HEAD",url:n,...r,service:"s3",region:this.region}),o=await fetch(i.url,{method:i.method,headers:i.headers});if(o.status===404)return null;if(!o.ok){let u=await o.text();throw new Ie(`Failed to head object: ${u}`,o.status,e,a)}let c={};return o.headers.forEach((u,d)=>{if(d.toLowerCase().startsWith("x-amz-meta-"))c[d.slice(11)]=u}),{contentLength:Number(o.headers.get("Content-Length")||0),contentType:o.headers.get("Content-Type")||"application/octet-stream",etag:(o.headers.get("ETag")||"").replace(/"/g,""),lastModified:new Date(o.headers.get("Last-Modified")||0),metadata:c,storageClass:o.headers.get("x-amz-storage-class")||void 0,serverSideEncryption:o.headers.get("x-amz-server-side-encryption")||void 0}}async exists(e,a){return await this.head(e,a)!==null}async copy(e,a,r,n,i={}){let o=await this.getCredentials(),c=this.buildUrl(r,n),u={"x-amz-copy-source":`/${e}/${encodeURIComponent(a)}`};if(i.metadataDirective)u["x-amz-metadata-directive"]=i.metadataDirective;if(i.contentType)u["Content-Type"]=i.contentType;if(i.storageClass)u["x-amz-storage-class"]=i.storageClass;if(i.acl)u["x-amz-acl"]=i.acl;if(i.metadata)for(let[g,h]of Object.entries(i.metadata))u[`x-amz-meta-${g.toLowerCase()}`]=h;let d=ae({method:"PUT",url:c,headers:u,...o,service:"s3",region:this.region}),m=await fetch(d.url,{method:d.method,headers:d.headers});if(!m.ok){let g=await m.text();throw new Ie(`Failed to copy object: ${g}`,m.status,r,n)}let p=(await m.text()).match(/<ETag>"?([^"<]+)"?<\/ETag>/);return{etag:p?p[1]:""}}async getPresignedUrl(e,a,r={}){let n=await this.getCredentials(),i=this.buildUrl(e,a);return Rd({url:i,method:r.method||"GET",expiresIn:r.expiresIn||3600,...n,service:"s3",region:this.region})}async uploadMultipart(e,a,r,n={}){let i=await this.getCredentials(),o=Math.max(n.partSize||Nt,ui),c,u;if(r instanceof ReadableStream)c=r;else if(r instanceof Blob)c=r.stream(),u=r.size;else{let p=new Blob([r]);c=p.stream(),u=p.size}let{uploadId:d,baseUrl:m}=await this.initiateMultipartUpload(e,a,n);try{let p=await this.uploadParts(e,a,m,d,c,o,i,u,n.concurrency||4,n.onProgress);return await this.completeMultipartUpload(e,a,m,d,p)}catch(p){throw await this.abortMultipartUpload(e,a,d,m).catch(()=>{}),p}}async initiateMultipartUpload(e,a,r){let n=await this.getCredentials(),i=this.buildUrl(e,a),o=`${i}?uploads`,c={"Content-Type":r.contentType||Ba(a)};if(r.storageClass)c["x-amz-storage-class"]=r.storageClass;if(r.serverSideEncryption)c["x-amz-server-side-encryption"]=r.serverSideEncryption;if(r.acl)c["x-amz-acl"]=r.acl;if(r.metadata)for(let[g,h]of Object.entries(r.metadata))c[`x-amz-meta-${g.toLowerCase()}`]=h;let u=ae({method:"POST",url:o,headers:c,...n,service:"s3",region:this.region}),d=await fetch(u.url,{method:u.method,headers:u.headers});if(!d.ok){let g=await d.text();throw new Ie(`Failed to initiate multipart upload: ${g}`,d.status,e,a)}let m=(await d.text()).match(/<UploadId>([^<]+)<\/UploadId>/);if(!m)throw new Ie("Failed to parse upload ID from response",0,e,a);let p=i;if(d.url)try{let g=new URL(d.url);g.search="",p=g.toString()}catch{}return{uploadId:m[1],baseUrl:p}}async uploadParts(e,a,r,n,i,o,c,u,d,m){let p=[],g=i.getReader(),h=1,y=new Uint8Array(0),f=0,b=u?Math.ceil(u/o):void 0,T=new Map,w=async(v,N)=>{let R=`${r}?partNumber=${N}&uploadId=${encodeURIComponent(n)}`,k={"Content-Length":String(v.byteLength),"x-amz-content-sha256":"UNSIGNED-PAYLOAD"},x=ae({method:"PUT",url:R,headers:k,...c,service:"s3",region:this.region}),L=await fetch(x.url,{method:x.method,headers:x.headers,body:v,redirect:"error"});if(!L.ok){let W=await L.text();throw new Ie(`Failed to upload part ${N}: ${W}`,L.status,e,a)}let _=(L.headers.get("ETag")||"").replace(/"/g,"");if(!_)throw new Ie(`Missing ETag for part ${N}`,L.status,e,a);return{partNumber:N,etag:_}},I=async()=>{let v=await Promise.race(T.values());T.delete(v.partNumber),p.push(v)};while(!0){let{done:v,value:N}=await g.read();if(N){let R=new Uint8Array(y.length+N.length);R.set(y),R.set(N,y.length),y=R}while(y.length>=o||v&&y.length>0){let R=y.slice(0,o);y=y.slice(o);let k=h++;if(T.size>=d)await I();if(T.set(k,w(R,k)),f+=R.byteLength,m)m({loaded:f,total:u||f,part:k,totalParts:b||k})}if(v)break}while(T.size>0)await I();return p.sort((v,N)=>v.partNumber-N.partNumber),p}async completeMultipartUpload(e,a,r,n,i){let o=await this.getCredentials(),c=`${r}?uploadId=${encodeURIComponent(n)}`,u=`<?xml version="1.0" encoding="UTF-8"?><CompleteMultipartUpload>${i.map((g)=>`<Part><PartNumber>${g.partNumber}</PartNumber><ETag>"${g.etag}"</ETag></Part>`).join("")}</CompleteMultipartUpload>`,d=ae({method:"POST",url:c,headers:{"Content-Type":"application/xml"},body:u,...o,service:"s3",region:this.region}),m=await fetch(d.url,{method:d.method,headers:d.headers,body:u});if(!m.ok){let g=await m.text();throw new Ie(`Failed to complete multipart upload: ${g}`,m.status,e,a)}let p=(await m.text()).match(/<ETag>"?([^"<]+)"?<\/ETag>/);return{etag:p?p[1]:""}}async abortMultipartUpload(e,a,r,n){let i=await this.getCredentials(),o=`${n??this.buildUrl(e,a)}?uploadId=${encodeURIComponent(r)}`,c=ae({method:"DELETE",url:o,...i,service:"s3",region:this.region});await fetch(c.url,{method:c.method,headers:c.headers})}async emptyAndDeleteBucket(e){let a=[];for await(let o of this.listAll(e,{}))if(a.push(o.key),a.length>=1000)await this.deleteMany(e,a),a=[];if(a.length>0)await this.deleteMany(e,a);let r=await this.getCredentials(),n=this.buildUrl(e),i=ae({method:"DELETE",url:n,...r,service:"s3",region:this.region});await fetch(i.url,{method:i.method,headers:i.headers})}}class Ie extends Error{statusCode;bucket;key;constructor(e,a,r,n){super(e);this.statusCode=a,this.bucket=r,this.key=n,this.name="S3Error"}}function mi(e){let a=[],r=[],n=/<Contents>([\s\S]*?)<\/Contents>/g,i;while((i=n.exec(e))!==null){let c=i[1];a.push({key:H(c,"Key")||"",lastModified:new Date(H(c,"LastModified")||0),etag:(H(c,"ETag")||"").replace(/"/g,""),size:Number(H(c,"Size")||0),storageClass:H(c,"StorageClass")||"STANDARD"})}let o=/<CommonPrefixes><Prefix>([^<]+)<\/Prefix><\/CommonPrefixes>/g;while((i=o.exec(e))!==null)r.push(i[1]);return{contents:a,commonPrefixes:r,isTruncated:H(e,"IsTruncated")==="true",continuationToken:H(e,"ContinuationToken")||void 0,nextContinuationToken:H(e,"NextContinuationToken")||void 0,keyCount:Number(H(e,"KeyCount")||0),maxKeys:Number(H(e,"MaxKeys")||1000),prefix:H(e,"Prefix")||void 0,delimiter:H(e,"Delimiter")||void 0}}function H(e,a){let r=new RegExp(`<${a}>([^<]*)</${a}>`),n=e.match(r);return n?n[1]:null}function pi(e){return e.replace(/&/g,"&amp;").replace(/</g,"&lt;").replace(/>/g,"&gt;").replace(/"/g,"&quot;").replace(/'/g,"&apos;")}function Ba(e){let a=e.split(".").pop()?.toLowerCase();return{html:"text/html",htm:"text/html",css:"text/css",js:"application/javascript",mjs:"application/javascript",json:"application/json",xml:"application/xml",txt:"text/plain",md:"text/markdown",csv:"text/csv",jpg:"image/jpeg",jpeg:"image/jpeg",png:"image/png",gif:"image/gif",webp:"image/webp",svg:"image/svg+xml",ico:"image/x-icon",avif:"image/avif",mp4:"video/mp4",webm:"video/webm",mov:"video/quicktime",avi:"video/x-msvideo",mp3:"audio/mpeg",wav:"audio/wav",ogg:"audio/ogg",pdf:"application/pdf",doc:"application/msword",docx:"application/vnd.openxmlformats-officedocument.wordprocessingml.document",xls:"application/vnd.ms-excel",xlsx:"application/vnd.openxmlformats-officedocument.spreadsheetml.sheet",ppt:"application/vnd.ms-powerpoint",pptx:"application/vnd.openxmlformats-officedocument.presentationml.presentation",zip:"application/zip",gz:"application/gzip",tar:"application/x-tar",rar:"application/vnd.rar","7z":"application/x-7z-compressed",woff:"font/woff",woff2:"font/woff2",ttf:"font/ttf",otf:"font/otf",eot:"application/vnd.ms-fontobject",wasm:"application/wasm"}[a||""]||"application/octet-stream"}function gi(e){if(e instanceof Blob)return e;if(typeof e==="string")return new Blob([e],{type:"text/plain"});return new Blob([e])}function pm(e){return new Dc(e)}await Ye();class Jd{profile;credentials=null;constructor(e="default"){this.profile=e}async init(){this.credentials=await ua(this.profile)}async ensureCredentials(){if(!this.credentials)await this.init();return this.credentials}async createInvalidation(e){let a=await this.ensureCredentials(),r=e.callerReference||`invalidation-${Date.now()}`,n=`<?xml version="1.0" encoding="UTF-8"?>
+Reason: ${o.StackStatusReason||"Unknown"}`);await new Promise((c)=>setTimeout(c,5000))}throw Error(`Timeout waiting for stack ${e} to complete`)}async waitForStackWithProgress(e,a,r){let n={"stack-create-complete":["CREATE_COMPLETE"],"stack-update-complete":["UPDATE_COMPLETE"],"stack-delete-complete":["DELETE_COMPLETE"]}[a];if(!n)throw Error(`Unknown waiter: ${a}`);return this.waitForStack(e,n,r)}async createChangeSet(e){let a={StackName:e.stackName,ChangeSetName:e.changeSetName,ChangeSetType:"UPDATE"};if(e.templateBody)a.TemplateBody=e.templateBody;else if(e.templateURL)a.TemplateURL=e.templateURL;if(e.parameters)for(let[r,[n,i]]of Object.entries(e.parameters).entries())a[`Parameters.member.${r+1}.ParameterKey`]=n,a[`Parameters.member.${r+1}.ParameterValue`]=i;if(e.capabilities)for(let[r,n]of e.capabilities.entries())a[`Capabilities.member.${r+1}`]=n;return(await this.request("CreateChangeSet",a)).ChangeSetId}async executeChangeSet(e,a){await this.request("ExecuteChangeSet",{ChangeSetName:e,StackName:a})}async describeStacks(e){let a=typeof e==="string"?e:e.stackName;try{return{Stacks:[await this.describeStack(a)]}}catch{return{Stacks:[]}}}async getStackOutputs(e){let a=await this.request("DescribeStacks",{StackName:e}),r=(a?.DescribeStacksResult||a?.DescribeStacksResponse?.DescribeStacksResult||a)?.Stacks?.member,n=Array.isArray(r)?r[0]:r;if(!n)return{};let i={},o=n.Outputs?.member;if(o){let c=Array.isArray(o)?o:[o];for(let u of c)if(u.OutputKey&&u.OutputValue)i[u.OutputKey]=u.OutputValue}return i}}function Bt(e,a=""){let r={};for(let[n,i]of Object.entries(e)){let o=a?`${a}.${n}`:n;if(Array.isArray(i))i.forEach((c,u)=>{if(typeof c==="object")Object.assign(r,Bt(c,`${o}.${u+1}`));else r[`${o}.${u+1}`]=String(c)});else if(typeof i==="object"&&i!==null)Object.assign(r,Bt(i,o));else if(i!==void 0&&i!==null)r[o]=String(i)}return r}function si(e){e=e.replace(/<\?xml[^?]*\?>\s*/,"").trim();function a(n,i,o){let c=1,u=o,d=`<${i}`,m=`</${i}>`;while(u<n.length&&c>0){let p=n.indexOf(d,u),g=n.indexOf(m,u);if(g===-1)return-1;if(p!==-1&&p<g){let h=n[p+d.length];if(h===">"||h===" "||h==="/"){let y=n.indexOf(">",p);if(y!==-1&&n[y-1]==="/")u=y+1;else c++,u=y+1}else u=p+d.length}else{if(c--,c===0)return g;u=g+m.length}}return-1}function r(n,i){while(i<n.length&&/\s/.test(n[i]))i++;if(i>=n.length||n[i]!=="<"){let y=n.indexOf("<",i);if(y===-1)return{value:n.slice(i).trim(),end:n.length};return{value:n.slice(i,y).trim(),end:y}}if(n[i+1]==="/")return{value:void 0,end:i};let o=n.slice(i).match(/^<(\w+)([^>]*?)\/?>/);if(!o)return{value:void 0,end:i+1};let c=o[1];if(o[0].endsWith("/>"))return{value:"",end:i+o[0].length};let u=i+o[0].length,d=`</${c}>`,m=a(n,c,u);if(m===-1)return{value:void 0,end:i+o[0].length};let p=n.slice(u,m).trim();if(!p.includes("<"))return{value:p,end:m+d.length};let g={},h=u;while(h<m){while(h<m&&/\s/.test(n[h]))h++;if(h>=m)break;if(n[h]!=="<"||n[h+1]==="/")break;let y=n.slice(h).match(/^<(\w+)/);if(!y)break;let f=y[1],b=r(n,h);if(b.value===void 0){h++;continue}if(f==="member"||g[f]!==void 0){if(!Array.isArray(g[f]))g[f]=g[f]!==void 0?[g[f]]:[];g[f].push(b.value)}else g[f]=b.value;h=b.end}return{value:g,end:m+d.length}}return r(e,0).value||{}}function oi(e){return{StackName:e.StackName||"",StackId:e.StackId,StackStatus:e.StackStatus,CreationTime:e.CreationTime,LastUpdatedTime:e.LastUpdatedTime,StackStatusReason:e.StackStatusReason,Description:e.Description}}function ci(e){let a=(e?.ListStacksResult||e?.ListStacksResponse?.ListStacksResult||e)?.StackSummaries?.member;if(!a)return[];return(Array.isArray(a)?a:[a]).map((r)=>({StackName:r.StackName||"",StackId:r.StackId,StackStatus:r.StackStatus,CreationTime:r.CreationTime,LastUpdatedTime:r.LastUpdatedTime,StackStatusReason:r.StackStatusReason,Description:r.Description}))}function li(e){let a=(e?.DescribeStackEventsResult||e?.DescribeStackEventsResponse?.DescribeStackEventsResult||e)?.StackEvents?.member;if(!a)return[];return(Array.isArray(a)?a:[a]).map((r)=>({StackId:r.StackId||"",EventId:r.EventId||"",StackName:r.StackName||"",LogicalResourceId:r.LogicalResourceId||"",PhysicalResourceId:r.PhysicalResourceId,ResourceType:r.ResourceType||"",Timestamp:r.Timestamp||"",ResourceStatus:r.ResourceStatus||"",ResourceStatusReason:r.ResourceStatusReason}))}await Ye();var ui=5242880,Nt=5242880,di=5242880;class Dc{region;endpoint;forcePathStyle;credentials;credentialOptions;retryOptions;constructor(e={}){this.region=e.region||process.env.AWS_REGION||"us-east-1",this.endpoint=e.endpoint||`https://s3.${this.region}.amazonaws.com`,this.forcePathStyle=e.forcePathStyle||!1,this.credentials=e.credentials,this.credentialOptions=e.credentialOptions,this.retryOptions=e.retryOptions||{}}async getCredentials(){if(this.credentials)return this.credentials;return $o(this.credentialOptions)}buildUrl(e,a){let r=a?encodeURIComponent(a).replace(/%2F/g,"/"):"";if(this.forcePathStyle)return a?`${this.endpoint}/${e}/${r}`:`${this.endpoint}/${e}`;let n=new URL(this.endpoint);return n.hostname=`${e}.${n.hostname}`,a?`${n.origin}/${r}`:n.origin}async get(e,a,r={}){let n=await this.getCredentials(),i=this.buildUrl(e,a),o={};if(r.range)o.Range=r.range;if(r.ifModifiedSince)o["If-Modified-Since"]=r.ifModifiedSince.toUTCString();if(r.ifMatch)o["If-Match"]=r.ifMatch;if(r.ifNoneMatch)o["If-None-Match"]=r.ifNoneMatch;let c=new URL(i);if(r.responseContentType)c.searchParams.set("response-content-type",r.responseContentType);if(r.responseContentDisposition)c.searchParams.set("response-content-disposition",r.responseContentDisposition);let u=ae({method:"GET",url:c.toString(),headers:o,...n,service:"s3",region:this.region}),d=await fetch(u.url,{method:u.method,headers:u.headers});if(!d.ok&&d.status!==304){let m=await d.text();throw new Ie(`Failed to get object: ${m}`,d.status,e,a)}return d}async getText(e,a,r={}){return(await this.get(e,a,r)).text()}async getJSON(e,a,r={}){return(await this.get(e,a,r)).json()}async getBuffer(e,a,r={}){return(await this.get(e,a,r)).arrayBuffer()}async put(e,a,r,n={}){let i,o;if(typeof r==="string")i=new TextEncoder().encode(r).length,o=r;else if(r instanceof ArrayBuffer)i=r.byteLength,o=r;else if(r instanceof Uint8Array)i=r.byteLength,o=r;else if(r instanceof Blob)i=r.size,o=r;else return this.uploadMultipart(e,a,r,{...n,partSize:Nt});if(i>di){let c=gi(o).stream();return this.uploadMultipart(e,a,c,{...n,partSize:Nt})}return this.putSimple(e,a,o,i,n)}async putSimple(e,a,r,n,i){let o=await this.getCredentials(),c=this.buildUrl(e,a),u={"Content-Length":String(n),"Content-Type":i.contentType||Ba(a)};if(i.contentEncoding)u["Content-Encoding"]=i.contentEncoding;if(i.cacheControl)u["Cache-Control"]=i.cacheControl;if(i.contentDisposition)u["Content-Disposition"]=i.contentDisposition;if(i.storageClass)u["x-amz-storage-class"]=i.storageClass;if(i.serverSideEncryption)u["x-amz-server-side-encryption"]=i.serverSideEncryption;if(i.acl)u["x-amz-acl"]=i.acl;if(i.tagging)u["x-amz-tagging"]=i.tagging;if(i.metadata)for(let[g,h]of Object.entries(i.metadata))u[`x-amz-meta-${g.toLowerCase()}`]=h;let d;if(typeof r==="string")d=r;else if(r instanceof Blob)d=await r.text();else d=new TextDecoder().decode(r instanceof ArrayBuffer?new Uint8Array(r):r);let m=ae({method:"PUT",url:c,headers:u,body:d,...o,service:"s3",region:this.region}),p=await fetch(m.url,{method:m.method,headers:m.headers,body:r});if(!p.ok){let g=await p.text();throw new Ie(`Failed to put object: ${g}`,p.status,e,a)}return{etag:(p.headers.get("ETag")||"").replace(/"/g,"")}}async delete(e,a){let r=await this.getCredentials(),n=this.buildUrl(e,a),i=ae({method:"DELETE",url:n,...r,service:"s3",region:this.region}),o=await fetch(i.url,{method:i.method,headers:i.headers});if(!o.ok&&o.status!==204){let c=await o.text();throw new Ie(`Failed to delete object: ${c}`,o.status,e,a)}}async deleteMany(e,a){let r=await this.getCredentials(),n=`${this.buildUrl(e)}?delete`,i=`<?xml version="1.0" encoding="UTF-8"?><Delete><Quiet>false</Quiet>${a.map((y)=>`<Object><Key>${pi(y)}</Key></Object>`).join("")}</Delete>`,o=ae({method:"POST",url:n,headers:{"Content-Type":"application/xml"},body:i,...r,service:"s3",region:this.region}),c=await fetch(o.url,{method:o.method,headers:o.headers,body:i});if(!c.ok){let y=await c.text();throw new Ie(`Failed to delete objects: ${y}`,c.status,e)}let u=await c.text(),d=[],m=[],p=/<Deleted><Key>([^<]+)<\/Key>/g,g;while((g=p.exec(u))!==null)d.push(g[1]);let h=/<Error><Key>([^<]+)<\/Key><Code>([^<]+)<\/Code><Message>([^<]+)<\/Message>/g;while((g=h.exec(u))!==null)m.push({key:g[1],error:`${g[2]}: ${g[3]}`});return{deleted:d,errors:m}}async list(e,a={}){let r=await this.getCredentials(),n=new URL(this.buildUrl(e));if(n.searchParams.set("list-type","2"),a.prefix)n.searchParams.set("prefix",a.prefix);if(a.delimiter)n.searchParams.set("delimiter",a.delimiter);if(a.maxKeys)n.searchParams.set("max-keys",String(a.maxKeys));if(a.continuationToken)n.searchParams.set("continuation-token",a.continuationToken);if(a.startAfter)n.searchParams.set("start-after",a.startAfter);let i=ae({method:"GET",url:n.toString(),...r,service:"s3",region:this.region}),o=await fetch(i.url,{method:i.method,headers:i.headers});if(!o.ok){let u=await o.text();throw new Ie(`Failed to list objects: ${u}`,o.status,e)}let c=await o.text();return mi(c)}async*listAll(e,a={}){let r;do{let n=await this.list(e,{...a,continuationToken:r});for(let i of n.contents)yield i;r=n.nextContinuationToken}while(r)}async head(e,a){let r=await this.getCredentials(),n=this.buildUrl(e,a),i=ae({method:"HEAD",url:n,...r,service:"s3",region:this.region}),o=await fetch(i.url,{method:i.method,headers:i.headers});if(o.status===404)return null;if(!o.ok){let u=await o.text();throw new Ie(`Failed to head object: ${u}`,o.status,e,a)}let c={};return o.headers.forEach((u,d)=>{if(d.toLowerCase().startsWith("x-amz-meta-"))c[d.slice(11)]=u}),{contentLength:Number(o.headers.get("Content-Length")||0),contentType:o.headers.get("Content-Type")||"application/octet-stream",etag:(o.headers.get("ETag")||"").replace(/"/g,""),lastModified:new Date(o.headers.get("Last-Modified")||0),metadata:c,storageClass:o.headers.get("x-amz-storage-class")||void 0,serverSideEncryption:o.headers.get("x-amz-server-side-encryption")||void 0}}async exists(e,a){return await this.head(e,a)!==null}async copy(e,a,r,n,i={}){let o=await this.getCredentials(),c=this.buildUrl(r,n),u={"x-amz-copy-source":`/${e}/${encodeURIComponent(a)}`};if(i.metadataDirective)u["x-amz-metadata-directive"]=i.metadataDirective;if(i.contentType)u["Content-Type"]=i.contentType;if(i.storageClass)u["x-amz-storage-class"]=i.storageClass;if(i.acl)u["x-amz-acl"]=i.acl;if(i.metadata)for(let[g,h]of Object.entries(i.metadata))u[`x-amz-meta-${g.toLowerCase()}`]=h;let d=ae({method:"PUT",url:c,headers:u,...o,service:"s3",region:this.region}),m=await fetch(d.url,{method:d.method,headers:d.headers});if(!m.ok){let g=await m.text();throw new Ie(`Failed to copy object: ${g}`,m.status,r,n)}let p=(await m.text()).match(/<ETag>"?([^"<]+)"?<\/ETag>/);return{etag:p?p[1]:""}}async getPresignedUrl(e,a,r={}){let n=await this.getCredentials(),i=this.buildUrl(e,a);return Rd({url:i,method:r.method||"GET",expiresIn:r.expiresIn||3600,...n,service:"s3",region:this.region})}async uploadMultipart(e,a,r,n={}){let i=await this.getCredentials(),o=Math.max(n.partSize||Nt,ui),c,u;if(r instanceof ReadableStream)c=r;else if(r instanceof Blob)c=r.stream(),u=r.size;else{let p=new Blob([r]);c=p.stream(),u=p.size}let{uploadId:d,baseUrl:m}=await this.initiateMultipartUpload(e,a,n);try{let p=await this.uploadParts(e,a,m,d,c,o,i,u,n.concurrency||4,n.onProgress);return await this.completeMultipartUpload(e,a,m,d,p)}catch(p){throw await this.abortMultipartUpload(e,a,d,m).catch(()=>{}),p}}async initiateMultipartUpload(e,a,r){let n=await this.getCredentials(),i=this.buildUrl(e,a),o=`${i}?uploads`,c={"Content-Type":r.contentType||Ba(a)};if(r.storageClass)c["x-amz-storage-class"]=r.storageClass;if(r.serverSideEncryption)c["x-amz-server-side-encryption"]=r.serverSideEncryption;if(r.acl)c["x-amz-acl"]=r.acl;if(r.metadata)for(let[g,h]of Object.entries(r.metadata))c[`x-amz-meta-${g.toLowerCase()}`]=h;let u=ae({method:"POST",url:o,headers:c,...n,service:"s3",region:this.region}),d=await fetch(u.url,{method:u.method,headers:u.headers});if(!d.ok){let g=await d.text();throw new Ie(`Failed to initiate multipart upload: ${g}`,d.status,e,a)}let m=(await d.text()).match(/<UploadId>([^<]+)<\/UploadId>/);if(!m)throw new Ie("Failed to parse upload ID from response",0,e,a);let p=i;if(d.url)try{let g=new URL(d.url);g.search="",p=g.toString()}catch{}return{uploadId:m[1],baseUrl:p}}async uploadParts(e,a,r,n,i,o,c,u,d,m){let p=[],g=i.getReader(),h=1,y=new Uint8Array(0),f=0,b=u?Math.ceil(u/o):void 0,T=new Map,w=async(v,N)=>{let R=`${r}?partNumber=${N}&uploadId=${encodeURIComponent(n)}`,k={"Content-Length":String(v.byteLength),"x-amz-content-sha256":"UNSIGNED-PAYLOAD"},x=ae({method:"PUT",url:R,headers:k,...c,service:"s3",region:this.region}),L=await fetch(x.url,{method:x.method,headers:x.headers,body:v,redirect:"error"});if(!L.ok){let _=await L.text();throw new Ie(`Failed to upload part ${N}: ${_}`,L.status,e,a)}let B=(L.headers.get("ETag")||"").replace(/"/g,"");if(!B)throw new Ie(`Missing ETag for part ${N}`,L.status,e,a);return{partNumber:N,etag:B}},I=async()=>{let v=await Promise.race(T.values());T.delete(v.partNumber),p.push(v)};while(!0){let{done:v,value:N}=await g.read();if(N){let R=new Uint8Array(y.length+N.length);R.set(y),R.set(N,y.length),y=R}while(y.length>=o||v&&y.length>0){let R=y.slice(0,o);y=y.slice(o);let k=h++;if(T.size>=d)await I();if(T.set(k,w(R,k)),f+=R.byteLength,m)m({loaded:f,total:u||f,part:k,totalParts:b||k})}if(v)break}while(T.size>0)await I();return p.sort((v,N)=>v.partNumber-N.partNumber),p}async completeMultipartUpload(e,a,r,n,i){let o=await this.getCredentials(),c=`${r}?uploadId=${encodeURIComponent(n)}`,u=`<?xml version="1.0" encoding="UTF-8"?><CompleteMultipartUpload>${i.map((g)=>`<Part><PartNumber>${g.partNumber}</PartNumber><ETag>"${g.etag}"</ETag></Part>`).join("")}</CompleteMultipartUpload>`,d=ae({method:"POST",url:c,headers:{"Content-Type":"application/xml"},body:u,...o,service:"s3",region:this.region}),m=await fetch(d.url,{method:d.method,headers:d.headers,body:u});if(!m.ok){let g=await m.text();throw new Ie(`Failed to complete multipart upload: ${g}`,m.status,e,a)}let p=(await m.text()).match(/<ETag>"?([^"<]+)"?<\/ETag>/);return{etag:p?p[1]:""}}async abortMultipartUpload(e,a,r,n){let i=await this.getCredentials(),o=`${n??this.buildUrl(e,a)}?uploadId=${encodeURIComponent(r)}`,c=ae({method:"DELETE",url:o,...i,service:"s3",region:this.region});await fetch(c.url,{method:c.method,headers:c.headers})}async emptyAndDeleteBucket(e){let a=[];for await(let o of this.listAll(e,{}))if(a.push(o.key),a.length>=1000)await this.deleteMany(e,a),a=[];if(a.length>0)await this.deleteMany(e,a);let r=await this.getCredentials(),n=this.buildUrl(e),i=ae({method:"DELETE",url:n,...r,service:"s3",region:this.region});await fetch(i.url,{method:i.method,headers:i.headers})}}class Ie extends Error{statusCode;bucket;key;constructor(e,a,r,n){super(e);this.statusCode=a,this.bucket=r,this.key=n,this.name="S3Error"}}function mi(e){let a=[],r=[],n=/<Contents>([\s\S]*?)<\/Contents>/g,i;while((i=n.exec(e))!==null){let c=i[1];a.push({key:z(c,"Key")||"",lastModified:new Date(z(c,"LastModified")||0),etag:(z(c,"ETag")||"").replace(/"/g,""),size:Number(z(c,"Size")||0),storageClass:z(c,"StorageClass")||"STANDARD"})}let o=/<CommonPrefixes><Prefix>([^<]+)<\/Prefix><\/CommonPrefixes>/g;while((i=o.exec(e))!==null)r.push(i[1]);return{contents:a,commonPrefixes:r,isTruncated:z(e,"IsTruncated")==="true",continuationToken:z(e,"ContinuationToken")||void 0,nextContinuationToken:z(e,"NextContinuationToken")||void 0,keyCount:Number(z(e,"KeyCount")||0),maxKeys:Number(z(e,"MaxKeys")||1000),prefix:z(e,"Prefix")||void 0,delimiter:z(e,"Delimiter")||void 0}}function z(e,a){let r=new RegExp(`<${a}>([^<]*)</${a}>`),n=e.match(r);return n?n[1]:null}function pi(e){return e.replace(/&/g,"&amp;").replace(/</g,"&lt;").replace(/>/g,"&gt;").replace(/"/g,"&quot;").replace(/'/g,"&apos;")}function Ba(e){let a=e.split(".").pop()?.toLowerCase();return{html:"text/html",htm:"text/html",css:"text/css",js:"application/javascript",mjs:"application/javascript",json:"application/json",xml:"application/xml",txt:"text/plain",md:"text/markdown",csv:"text/csv",jpg:"image/jpeg",jpeg:"image/jpeg",png:"image/png",gif:"image/gif",webp:"image/webp",svg:"image/svg+xml",ico:"image/x-icon",avif:"image/avif",mp4:"video/mp4",webm:"video/webm",mov:"video/quicktime",avi:"video/x-msvideo",mp3:"audio/mpeg",wav:"audio/wav",ogg:"audio/ogg",pdf:"application/pdf",doc:"application/msword",docx:"application/vnd.openxmlformats-officedocument.wordprocessingml.document",xls:"application/vnd.ms-excel",xlsx:"application/vnd.openxmlformats-officedocument.spreadsheetml.sheet",ppt:"application/vnd.ms-powerpoint",pptx:"application/vnd.openxmlformats-officedocument.presentationml.presentation",zip:"application/zip",gz:"application/gzip",tar:"application/x-tar",rar:"application/vnd.rar","7z":"application/x-7z-compressed",woff:"font/woff",woff2:"font/woff2",ttf:"font/ttf",otf:"font/otf",eot:"application/vnd.ms-fontobject",wasm:"application/wasm"}[a||""]||"application/octet-stream"}function gi(e){if(e instanceof Blob)return e;if(typeof e==="string")return new Blob([e],{type:"text/plain"});return new Blob([e])}function pm(e){return new Dc(e)}await Ye();class Jd{profile;credentials=null;constructor(e="default"){this.profile=e}async init(){this.credentials=await ua(this.profile)}async ensureCredentials(){if(!this.credentials)await this.init();return this.credentials}async createInvalidation(e){let a=await this.ensureCredentials(),r=e.callerReference||`invalidation-${Date.now()}`,n=`<?xml version="1.0" encoding="UTF-8"?>
 <InvalidationBatch>
   <Paths>
     <Quantity>${e.paths.length}</Quantity>
@@ -7283,7 +7283,7 @@ export const queue = __handlers.queue
 export const cli = __handlers.cli
 `}var rs=["adapter.ts","recursion.ts","auto-recursion.ts"];function ns(){return be(Xi(as(import.meta.url)),"runtime")}function bu(e,a,r){for(let n of e??[])r?.(`build: ${n}`),qi(n,{stdio:"inherit",cwd:a})}function Mo(e){return Hi("sha256").update(e).digest("hex")}function ga(e,a,r){return`deployments/${e}/${a}/${r}.zip`}async function dn(e){let a=ts(e.projectRoot??process.cwd()),{app:r}=e;if(!e.skipBuild)bu(r.build,a,e.onStep);let n=r.entry;if(!n)throw Error("serverless app: `entry` is required to package a Node/Bun application");let i=es(n)?n:be(a,n),o=Qi(be(Zi(),"tscloud-pkg-"));try{for(let h of rs)zi(be(ns(),h),be(o,h));let c=be(o,"bootstrap.ts");Yi(c,Su({entryImport:i,adapterImport:"./adapter"})),e.onStep?.("bundling application");let u=await Bun.build({entrypoints:[c],target:r.kind==="bun"?"bun":"node",format:"esm",minify:!1,sourcemap:"none"});if(!u.success){let h=u.logs.map((y)=>String(y)).join(`
 `);throw Error(`serverless app bundle failed:
-${h}`)}let d=u.outputs[0],m=Buffer.from(await d.arrayBuffer()),p="index",g=Ci([{name:`${p}.mjs`,data:m}]);return{zip:g,bundle:m,sha256:Mo(g),handlerFile:p,handlers:{http:r.handlers?.http??`${p}.http`,queue:r.handlers?.queue??`${p}.queue`,cli:r.handlers?.cli??`${p}.cli`},bundleBytes:m.length}}finally{Ji(o,{recursive:!0,force:!0})}}var vu=["18","20","22"];function is(e){if(!e)return"22";let a=String(e).match(/(\d+)/);return a?a[1]:"22"}function Uo(e){let a=e.kind??"node";if(a==="php")return{lambdaRuntime:"provided.al2023",kind:"php",version:e.phpVersion??"8.3",usesLayer:!0,layerKind:"php",layerEnvVar:"TSCLOUD_PHP_LAYER_ARN"};if(a==="bun")return{lambdaRuntime:"provided.al2023",kind:"bun",version:e.runtimeVersion??"latest",usesLayer:!0,layerKind:"bun",layerEnvVar:"TSCLOUD_BUN_LAYER_ARN"};let r=is(e.runtimeVersion);if(e.runtime!=="provided.al2023"&&vu.includes(r))return{lambdaRuntime:e.runtime&&e.runtime.startsWith("nodejs")?e.runtime:`nodejs${r}.x`,kind:"node",version:r,usesLayer:!1};return{lambdaRuntime:"provided.al2023",kind:"node",version:r,usesLayer:!0,layerKind:"node",layerEnvVar:"TSCLOUD_NODE_LAYER_ARN"}}function Wt(e,a,r){if(e.queues===!1)return[];if(e.queues===void 0||e.queues===!0)return[{name:`${a}-${r}-default`}];return e.queues.map((n)=>{if(typeof n==="string")return{name:`${a}-${r}-${n}`};let[i,o]=Object.entries(n)[0];return{name:`${a}-${r}-${i}`,concurrency:o}})}function fa(e,a,r){return Wt(e,a,r).map((n)=>n.name)}function ha(e){let{app:a,environment:r,handlers:n}=e,i=e.config.project.slug,o=Uo(a).lambdaRuntime,c=a.architecture??"x86_64",u=e.config.project.region,d={http:`${i}-${r}-http`,queue:`${i}-${r}-queue`,cli:`${i}-${r}-cli`};if(a.gatewayVersion===1)throw Error("serverless app: `gatewayVersion: 1` (REST API) is not supported — ts-cloud uses API Gateway HTTP API (v2). Remove `gatewayVersion` or set it to 2.");let m=Wt(a,i,r),p=m.map((M)=>M.name),g=p.length>0,h=a.logRetention??14,y=a.packaging==="image";if(y&&a.lambdaInsights)throw Error("serverless app: `lambdaInsights` layer attachment is only supported for zip packaging. Container images must install the Lambda Insights extension in the image.");let f=(a.scheduler??"on")!=="off",b=(a.cache?.driver??"dynamodb")==="dynamodb",T=Boolean(a.assets),w=Io(i,r),I=a.tmpStorage??512,v={},N={},R=[{PolicyName:"tscloud-serverless-app",PolicyDocument:{Version:"2012-10-17",Statement:[{Effect:"Allow",Action:["logs:CreateLogGroup","logs:CreateLogStream","logs:PutLogEvents"],Resource:t.sub("arn:aws:logs:${AWS::Region}:${AWS::AccountId}:log-group:/aws/lambda/*")},{Effect:"Allow",Action:["lambda:InvokeFunction"],Resource:t.sub(`arn:aws:lambda:\${AWS::Region}:\${AWS::AccountId}:function:${i}-${r}-*`)},{Effect:"Allow",Action:["secretsmanager:GetSecretValue","ssm:GetParameter","ssm:GetParameters","ssm:GetParametersByPath"],Resource:[t.sub(`arn:aws:secretsmanager:\${AWS::Region}:\${AWS::AccountId}:secret:${i}/${r}/*`),t.sub(`arn:aws:ssm:\${AWS::Region}:\${AWS::AccountId}:parameter/${i}/${r}/*`)]},{Effect:"Allow",Action:["s3:GetObject","s3:PutObject","s3:DeleteObject","s3:ListBucket"],Resource:[t.sub(`arn:aws:s3:::${w}`),t.sub(`arn:aws:s3:::${w}/*`),...a.storage?.bucket?[t.sub(`arn:aws:s3:::${a.storage.bucket}`),t.sub(`arn:aws:s3:::${a.storage.bucket}/*`)]:[]]}]}}];if(g)R[0].PolicyDocument.Statement.push({Effect:"Allow",Action:["sqs:SendMessage","sqs:ReceiveMessage","sqs:DeleteMessage","sqs:GetQueueAttributes","sqs:GetQueueUrl"],Resource:t.sub(`arn:aws:sqs:\${AWS::Region}:\${AWS::AccountId}:${i}-${r}-*`)});if(b)R[0].PolicyDocument.Statement.push({Effect:"Allow",Action:["dynamodb:GetItem","dynamodb:PutItem","dynamodb:UpdateItem","dynamodb:DeleteItem","dynamodb:Query","dynamodb:Scan","dynamodb:BatchGetItem","dynamodb:BatchWriteItem"],Resource:t.sub(`arn:aws:dynamodb:\${AWS::Region}:\${AWS::AccountId}:table/${i}-${r}-cache*`)});let k=["arn:aws:iam::aws:policy/service-role/AWSLambdaBasicExecutionRole"];if(a.vpc?.subnets?.length)k.push("arn:aws:iam::aws:policy/service-role/AWSLambdaVPCAccessExecutionRole");if(a.lambdaInsights)k.push("arn:aws:iam::aws:policy/CloudWatchLambdaInsightsExecutionRolePolicy");v.AppRole={Type:"AWS::IAM::Role",Properties:{RoleName:`${i}-${r}-app-role`,AssumeRolePolicyDocument:{Version:"2012-10-17",Statement:[{Effect:"Allow",Principal:{Service:"lambda.amazonaws.com"},Action:"sts:AssumeRole"}]},ManagedPolicyArns:k,Policies:R}};let x=(M)=>({TSCLOUD_LAMBDA_MODE:M,TSCLOUD_ENV:r,...a.octane?{TSCLOUD_OCTANE:"1"}:{},...a.scheduler==="sub-minute"?{TSCLOUD_SCHEDULER:"sub-minute"}:{},...b?{TSCLOUD_CACHE_TABLE:`${i}-${r}-cache`}:{},...g?{TSCLOUD_QUEUE:p[0]}:{},...a.env??{}}),L=Boolean(a.efs),_=typeof a.efs==="object"?a.efs:{},W=_.mountPath??"/mnt/local",V=L&&!_.accessPointArn,Z=_.accessPointArn??(V?t.getAtt("EfsAccessPoint","Arn"):void 0),q=a.vpc?.subnets??[],Q=q.length>0,j=a.cache?.driver==="elasticache"||a.database?.connection==="aurora-serverless"||Boolean(a.rdsProxy)||L;if(j&&!Q)throw Error("serverless app: elasticache / aurora-serverless / rdsProxy / efs require app.vpc.subnets (private subnets) to be set.");let me=Q?{VpcConfig:{SubnetIds:q,SecurityGroupIds:[...a.vpc?.securityGroups??[],...j?[t.getAtt("DataSecurityGroup","GroupId")]:[]]}}:{},Me=V?q.map((M,U)=>`EfsMountTarget${U}`):[],vt=L?{FileSystemConfigs:[{Arn:Z,LocalMountPath:W}]}:{};if(L)R[0].PolicyDocument.Statement.push({Effect:"Allow",Action:["elasticfilesystem:ClientMount","elasticfilesystem:ClientWrite","elasticfilesystem:ClientRootAccess","elasticfilesystem:DescribeMountTargets"],Resource:"*"});function X(M,U,G,K,ne,Ze,ce,Xe=I){v[`${M}LogGroup`]={Type:"AWS::Logs::LogGroup",Properties:{LogGroupName:`/aws/lambda/${U}`,RetentionInDays:h}};let Tt=[...e.runtimeLayers??[],...a.lambdaInsights?[a.lambdaInsights.layerArn]:[]],Pt=y?{PackageType:"Image",Code:{ImageUri:t.ref("ImageUri")},...a.kind==="php"?{}:{ImageConfig:{Command:[G]}}}:{Runtime:o,Handler:G,Code:{S3Bucket:t.ref("ArtifactBucket"),S3Key:t.ref("ArtifactKey")},...Tt.length?{Layers:[...new Set(Tt)]}:{}};v[M]={Type:"AWS::Lambda::Function",DependsOn:[`${M}LogGroup`,...Me],Properties:{FunctionName:U,Architectures:[c],MemorySize:ne,Timeout:Ze,Role:t.getAtt("AppRole","Arn"),Environment:{Variables:x(K)},EphemeralStorage:{Size:Xe},...Pt,...ce!==void 0?{ReservedConcurrentExecutions:ce}:{},...me,...vt}}}if(X("HttpFunction",d.http,n.http,"http",a.memory??1024,a.timeout??28,a.concurrency,I),X("CliFunction",d.cli,n.cli,"cli",a.cliMemory??1024,a.cliTimeout??900,void 0,a.cliTmpStorage??I),g)X("QueueFunction",d.queue,n.queue,"queue",a.queueMemory??1024,a.queueTimeout??120,void 0,a.queueTmpStorage??I);let Y=(a.provisionedConcurrency??0)>0?a.provisionedConcurrency:0,ee=["HttpFunction","CliFunction",...g?["QueueFunction"]:[]];if(Y)for(let M of ee)v[`${M}Version`]={Type:"AWS::Lambda::Version",DeletionPolicy:"Retain",Properties:{FunctionName:t.ref(M)}},v[`${M}Alias`]={Type:"AWS::Lambda::Alias",Properties:{FunctionName:t.ref(M),Name:"live",FunctionVersion:t.getAtt(`${M}Version`,"Version"),ProvisionedConcurrencyConfig:{ProvisionedConcurrentExecutions:Y}}};let pe=(M)=>Y?t.ref(`${M}Alias`):t.getAtt(M,"Arn"),te=(M)=>Y?t.ref(`${M}Alias`):t.ref(M);v.HttpApi={Type:"AWS::ApiGatewayV2::Api",Properties:{Name:`${i}-${r}`,ProtocolType:"HTTP"}},v.HttpIntegration={Type:"AWS::ApiGatewayV2::Integration",Properties:{ApiId:t.ref("HttpApi"),IntegrationType:"AWS_PROXY",IntegrationUri:pe("HttpFunction"),PayloadFormatVersion:"2.0"}},v.HttpRoute={Type:"AWS::ApiGatewayV2::Route",Properties:{ApiId:t.ref("HttpApi"),RouteKey:"$default",Target:t.join("/",["integrations",t.ref("HttpIntegration")])}},v.HttpStage={Type:"AWS::ApiGatewayV2::Stage",Properties:{ApiId:t.ref("HttpApi"),StageName:"$default",AutoDeploy:!0}},v.HttpPermission={Type:"AWS::Lambda::Permission",Properties:{FunctionName:te("HttpFunction"),Action:"lambda:InvokeFunction",Principal:"apigateway.amazonaws.com",SourceArn:t.sub("arn:aws:execute-api:${AWS::Region}:${AWS::AccountId}:${HttpApi}/*/*")}},N.HttpApiEndpoint={Description:"HTTP API endpoint",Value:t.getAtt("HttpApi","ApiEndpoint")},N.HttpApiId={Description:"HTTP API id",Value:t.ref("HttpApi")};let oe=(Array.isArray(a.domain)?a.domain:a.domain?[a.domain]:[]).filter(Boolean);if(oe.length){if(!a.certificateArn&&!a.hostedZoneId)throw Error("serverless app: a custom `domain` needs either `certificateArn` (pre-issued, regional) or `hostedZoneId` (to auto-issue + validate an ACM cert).");let M=a.certificateArn;if(!M)v.HttpCertificate={Type:"AWS::CertificateManager::Certificate",Properties:{DomainName:oe[0],...oe.length>1?{SubjectAlternativeNames:oe.slice(1)}:{},ValidationMethod:"DNS",DomainValidationOptions:oe.map((U)=>({DomainName:U,HostedZoneId:a.hostedZoneId}))}},M=t.ref("HttpCertificate");oe.forEach((U,G)=>{let K=`HttpDomain${G}`;if(v[K]={Type:"AWS::ApiGatewayV2::DomainName",Properties:{DomainName:U,DomainNameConfigurations:[{CertificateArn:M,EndpointType:"REGIONAL"}]}},v[`HttpApiMapping${G}`]={Type:"AWS::ApiGatewayV2::ApiMapping",DependsOn:["HttpStage"],Properties:{ApiId:t.ref("HttpApi"),DomainName:t.ref(K),Stage:"$default"}},a.hostedZoneId)v[`HttpDomainRecord${G}`]={Type:"AWS::Route53::RecordSet",Properties:{HostedZoneId:a.hostedZoneId,Name:U,Type:"A",AliasTarget:{DNSName:t.getAtt(K,"RegionalDomainName"),HostedZoneId:t.getAtt(K,"RegionalHostedZoneId")}}};N[`CustomDomain${G}`]={Description:`Custom domain ${U}`,Value:U},N[`CustomDomainTarget${G}`]={Description:`Point ${U} (CNAME/alias) at this APIGW regional domain`,Value:t.getAtt(K,"RegionalDomainName")}})}if(g)v.AppQueueDlq={Type:"AWS::SQS::Queue",Properties:{QueueName:`${i}-${r}-dlq`,MessageRetentionPeriod:1209600}},m.forEach((M,U)=>{let G=`AppQueue${U}`,K=a.queueTimeout??120;v[G]={Type:"AWS::SQS::Queue",Properties:{QueueName:M.name,VisibilityTimeout:Math.min(43200,K*6),RedrivePolicy:{deadLetterTargetArn:t.getAtt("AppQueueDlq","Arn"),maxReceiveCount:a.queueTries??3}}};let ne=M.concurrency??a.queueConcurrency;v[`${G}Mapping`]={Type:"AWS::Lambda::EventSourceMapping",Properties:{EventSourceArn:t.getAtt(G,"Arn"),FunctionName:te("QueueFunction"),BatchSize:1,FunctionResponseTypes:["ReportBatchItemFailures"],...ne?{ScalingConfig:{MaximumConcurrency:Math.max(2,ne)}}:{}}},N[`QueueUrl${U}`]={Description:`Queue URL: ${M.name}`,Value:t.ref(G)}});if(f)v.SchedulerRule={Type:"AWS::Events::Rule",Properties:{Name:`${i}-${r}-scheduler`,ScheduleExpression:"rate(1 minute)",State:"ENABLED",Targets:[{Id:"cli",Arn:pe("CliFunction"),Input:JSON.stringify({command:"schedule:run"})}]}},v.SchedulerPermission={Type:"AWS::Lambda::Permission",Properties:{FunctionName:te("CliFunction"),Action:"lambda:InvokeFunction",Principal:"events.amazonaws.com",SourceArn:t.getAtt("SchedulerRule","Arn")}};if(a.warm&&a.warm>0){let M={http:"HttpFunction",queue:"QueueFunction",cli:"CliFunction"},U=(a.warmFunctions??["http"]).filter((G)=>G!=="queue"||g);for(let G of U){let K=G.charAt(0).toUpperCase()+G.slice(1),ne=Math.ceil(a.warm/5),Ze=0;for(let ce=0;ce<ne;ce++){let Xe=Math.min(5,a.warm-Ze);v[`Warmer${K}Rule${ce}`]={Type:"AWS::Events::Rule",Properties:{Name:`${i}-${r}-warmer-${G}-${ce}`,ScheduleExpression:"rate(5 minutes)",State:"ENABLED",Targets:Array.from({length:Xe},(Tt,Pt)=>({Id:`warm-${G}-${ce}-${Pt}`,Arn:t.getAtt(M[G],"Arn"),Input:JSON.stringify({warmer:!0})}))}},Ze+=Xe}v[`Warmer${K}Permission`]={Type:"AWS::Lambda::Permission",Properties:{FunctionName:t.ref(M[G]),Action:"lambda:InvokeFunction",Principal:"events.amazonaws.com",SourceArn:t.sub(`arn:aws:events:\${AWS::Region}:\${AWS::AccountId}:rule/${i}-${r}-warmer-${G}-*`)}}}}if(b)v.CacheTable={Type:"AWS::DynamoDB::Table",Properties:{TableName:`${i}-${r}-cache`,BillingMode:"PAY_PER_REQUEST",AttributeDefinitions:[{AttributeName:"key",AttributeType:"S"}],KeySchema:[{AttributeName:"key",KeyType:"HASH"}],TimeToLiveSpecification:{AttributeName:"expires_at",Enabled:!0}}},N.CacheTableName={Description:"DynamoDB cache table",Value:t.ref("CacheTable")};if(T){if(v.AssetsBucket={Type:"AWS::S3::Bucket",Properties:{BucketName:w,PublicAccessBlockConfiguration:{BlockPublicAcls:!0,BlockPublicPolicy:!0,IgnorePublicAcls:!0,RestrictPublicBuckets:!0}}},v.AssetsOAC={Type:"AWS::CloudFront::OriginAccessControl",Properties:{OriginAccessControlConfig:{Name:`${i}-${r}-assets-oac`,OriginAccessControlOriginType:"s3",SigningBehavior:"always",SigningProtocol:"sigv4"}}},v.AssetsDistribution={Type:"AWS::CloudFront::Distribution",Properties:{DistributionConfig:{Enabled:!0,DefaultCacheBehavior:{TargetOriginId:"assets",ViewerProtocolPolicy:"redirect-to-https",Compress:!0,CachePolicyId:"658327ea-f89d-4fab-a63d-7e88639e58f6"},Origins:[{Id:"assets",DomainName:t.getAtt("AssetsBucket","RegionalDomainName"),OriginAccessControlId:t.ref("AssetsOAC"),S3OriginConfig:{OriginAccessIdentity:""}}],...a.assetDomain?{Aliases:[a.assetDomain],ViewerCertificate:{AcmCertificateArn:a.assetCertificateArn??t.ref("AssetsCertificate"),SslSupportMethod:"sni-only",MinimumProtocolVersion:"TLSv1.2_2021"}}:{}}}},a.assetDomain){if(!a.assetCertificateArn){if(!a.hostedZoneId)throw Error("serverless app: `assetDomain` requires either `assetCertificateArn` (a us-east-1 ACM cert) or `hostedZoneId` (to auto-issue + validate one). CloudFront only accepts certs from us-east-1.");if(u!=="us-east-1")throw Error(`serverless app: auto-issuing an asset-domain cert needs a us-east-1 app (CloudFront certs must be us-east-1); this app is in ${u}. Supply a pre-issued us-east-1 \`assetCertificateArn\` instead.`);v.AssetsCertificate={Type:"AWS::CertificateManager::Certificate",Properties:{DomainName:a.assetDomain,ValidationMethod:"DNS",DomainValidationOptions:[{DomainName:a.assetDomain,HostedZoneId:a.hostedZoneId}]}}}if(a.hostedZoneId)v.AssetsDomainRecord={Type:"AWS::Route53::RecordSet",Properties:{HostedZoneId:a.hostedZoneId,Name:a.assetDomain,Type:"A",AliasTarget:{DNSName:t.getAtt("AssetsDistribution","DomainName"),HostedZoneId:"Z2FDTNDATAQYW2"}}};N.AssetDomain={Description:"Custom asset CDN host",Value:a.assetDomain}}v.AssetsBucketPolicy={Type:"AWS::S3::BucketPolicy",Properties:{Bucket:t.ref("AssetsBucket"),PolicyDocument:{Version:"2012-10-17",Statement:[{Effect:"Allow",Principal:{Service:"cloudfront.amazonaws.com"},Action:"s3:GetObject",Resource:t.sub(`arn:aws:s3:::${w}/*`),Condition:{StringEquals:{"AWS:SourceArn":t.sub("arn:aws:cloudfront::${AWS::AccountId}:distribution/${AssetsDistribution}")}}}]}}},N.AssetsBucketName={Description:"Assets bucket",Value:t.ref("AssetsBucket")},N.AssetsCdnDomain={Description:"Assets CloudFront domain",Value:t.getAtt("AssetsDistribution","DomainName")}}if(a.firewall?.enabled){let M=[],U=0;if(a.firewall.rateLimit)M.push({Name:"rate-limit",Priority:U++,Action:{Block:{}},Statement:{RateBasedStatement:{Limit:a.firewall.rateLimit,AggregateKeyType:"IP"}},VisibilityConfig:{SampledRequestsEnabled:!0,CloudWatchMetricsEnabled:!0,MetricName:`${i}-${r}-rate`}});let G={sqlInjection:"AWSManagedRulesSQLiRuleSet",xss:"AWSManagedRulesCommonRuleSet",common:"AWSManagedRulesCommonRuleSet",botControl:"AWSManagedRulesBotControlRuleSet",ipReputation:"AWSManagedRulesAmazonIpReputationList"};for(let K of a.firewall.rules??[]){let ne=G[K];if(!ne)continue;M.push({Name:`managed-${K}`,Priority:U++,OverrideAction:{None:{}},Statement:{ManagedRuleGroupStatement:{VendorName:"AWS",Name:ne}},VisibilityConfig:{SampledRequestsEnabled:!0,CloudWatchMetricsEnabled:!0,MetricName:`${i}-${r}-${K}`}})}v.WebAcl={Type:"AWS::WAFv2::WebACL",Properties:{Name:`${i}-${r}-waf`,Scope:"REGIONAL",DefaultAction:{Allow:{}},Rules:M,VisibilityConfig:{SampledRequestsEnabled:!0,CloudWatchMetricsEnabled:!0,MetricName:`${i}-${r}-waf`}}},N.WafAclArn={Description:"WAF web ACL ARN. Attach to a CloudFront distribution fronting the API to enforce (HTTP API v2 stages do not support direct WAF association).",Value:t.getAtt("WebAcl","Arn")}}if(Q&&j){if(!a.vpc?.id)throw Error("serverless app: data services (elasticache / aurora-serverless / rdsProxy / efs) need app.vpc.id (the VPC id) so the managed security group is created in the right VPC.");v.DataSecurityGroup={Type:"AWS::EC2::SecurityGroup",Properties:{VpcId:a.vpc.id,GroupDescription:`${i}-${r} serverless data access`,SecurityGroupIngress:[{IpProtocol:"-1",CidrIp:"10.0.0.0/8"}]}}}if(V)v.EfsFileSystem={Type:"AWS::EFS::FileSystem",Properties:{Encrypted:!0,FileSystemTags:[{Key:"Name",Value:`${i}-${r}-efs`}]}},q.forEach((M,U)=>{v[`EfsMountTarget${U}`]={Type:"AWS::EFS::MountTarget",Properties:{FileSystemId:t.ref("EfsFileSystem"),SubnetId:M,SecurityGroups:[t.getAtt("DataSecurityGroup","GroupId")]}}}),v.EfsAccessPoint={Type:"AWS::EFS::AccessPoint",Properties:{FileSystemId:t.ref("EfsFileSystem"),PosixUser:{Uid:1001,Gid:1001},RootDirectory:{Path:"/lambda",CreationInfo:{OwnerUid:1001,OwnerGid:1001,Permissions:"0755"}}}},N.EfsFileSystemId={Description:"EFS file system id",Value:t.ref("EfsFileSystem")};if(a.cache?.driver==="elasticache")v.CacheSubnetGroup={Type:"AWS::ElastiCache::SubnetGroup",Properties:{Description:`${i}-${r} cache subnets`,SubnetIds:q}},v.CacheCluster={Type:"AWS::ElastiCache::ReplicationGroup",Properties:{ReplicationGroupId:`${i}-${r}-cache`,ReplicationGroupDescription:`${i}-${r} redis`,Engine:"redis",CacheNodeType:"cache.t4g.micro",NumCacheClusters:1,AutomaticFailoverEnabled:!1,CacheSubnetGroupName:t.ref("CacheSubnetGroup"),SecurityGroupIds:[t.getAtt("DataSecurityGroup","GroupId")],TransitEncryptionEnabled:!1}},N.CacheEndpoint={Description:"Redis primary endpoint",Value:t.getAtt("CacheCluster","PrimaryEndPoint.Address")};if(a.database?.connection==="aurora-serverless")v.DbSubnetGroup={Type:"AWS::RDS::DBSubnetGroup",Properties:{DBSubnetGroupDescription:`${i}-${r} db subnets`,SubnetIds:q}},v.DbSecret={Type:"AWS::SecretsManager::Secret",Properties:{Name:`${i}/${r}/db`,GenerateSecretString:{SecretStringTemplate:JSON.stringify({username:"app"}),GenerateStringKey:"password",PasswordLength:32,ExcludePunctuation:!0}}},v.DbCluster={Type:"AWS::RDS::DBCluster",Properties:{Engine:"aurora-mysql",EngineMode:"provisioned",DBClusterIdentifier:`${i}-${r}-db`,DatabaseName:"app",MasterUsername:t.sub("{{resolve:secretsmanager:${DbSecret}:SecretString:username}}"),MasterUserPassword:t.sub("{{resolve:secretsmanager:${DbSecret}:SecretString:password}}"),ServerlessV2ScalingConfiguration:{MinCapacity:a.database?.minCapacity??0.5,MaxCapacity:a.database?.maxCapacity??4},DBSubnetGroupName:t.ref("DbSubnetGroup"),VpcSecurityGroupIds:[t.getAtt("DataSecurityGroup","GroupId")]}},v.DbInstance={Type:"AWS::RDS::DBInstance",Properties:{Engine:"aurora-mysql",DBInstanceClass:"db.serverless",DBClusterIdentifier:t.ref("DbCluster")}},N.DbEndpoint={Description:"Aurora cluster endpoint",Value:t.getAtt("DbCluster","Endpoint.Address")};if(a.rdsProxy&&a.database?.connection==="aurora-serverless")v.DbProxyRole={Type:"AWS::IAM::Role",Properties:{AssumeRolePolicyDocument:{Version:"2012-10-17",Statement:[{Effect:"Allow",Principal:{Service:"rds.amazonaws.com"},Action:"sts:AssumeRole"}]},Policies:[{PolicyName:"read-db-secret",PolicyDocument:{Version:"2012-10-17",Statement:[{Effect:"Allow",Action:["secretsmanager:GetSecretValue"],Resource:t.ref("DbSecret")}]}}]}},v.DbProxy={Type:"AWS::RDS::DBProxy",Properties:{DBProxyName:typeof a.rdsProxy==="object"&&a.rdsProxy.name?a.rdsProxy.name:`${i}-${r}-proxy`,EngineFamily:"MYSQL",RoleArn:t.getAtt("DbProxyRole","Arn"),Auth:[{AuthScheme:"SECRETS",SecretArn:t.ref("DbSecret"),IAMAuth:"DISABLED"}],VpcSubnetIds:q,VpcSecurityGroupIds:[t.getAtt("DataSecurityGroup","GroupId")],RequireTLS:!1}},v.DbProxyTargetGroup={Type:"AWS::RDS::DBProxyTargetGroup",DependsOn:["DbInstance"],Properties:{DBProxyName:t.ref("DbProxy"),TargetGroupName:"default",DBClusterIdentifiers:[t.ref("DbCluster")]}},N.DbProxyEndpoint={Description:"RDS Proxy endpoint",Value:t.getAtt("DbProxy","Endpoint")};if(N.HttpFunctionName={Description:"HTTP function name",Value:t.ref("HttpFunction")},N.CliFunctionName={Description:"CLI function name",Value:t.ref("CliFunction")},g)N.QueueFunctionName={Description:"Queue function name",Value:t.ref("QueueFunction")};let Se={AWSTemplateFormatVersion:"2010-09-09",Description:`Serverless application for ${e.config.project.name} (${i}-${r})`,Parameters:y?{ImageUri:{Type:"String",Description:"ECR image URI of the deployment artifact"}}:{ArtifactBucket:{Type:"String",Description:"S3 bucket holding the deployment artifact"},ArtifactKey:{Type:"String",Description:"S3 key of the deployment artifact (zip)"}},Resources:v,Outputs:N},Oe={};for(let M of Object.values(v))Oe[M.Type]=(Oe[M.Type]??0)+1;return{template:Se,functionNames:d,queueNames:p,resourceSummary:Oe}}var Tu=["cli","fpm","curl","mbstring","xml","pdo","mysqlnd","gd","bcmath","intl","opcache","sodium","process","pecl-redis6","pecl-apcu","pgsql"];function Eu(e){let a=`php${e.replace(".","")}`;return Tu.map((r)=>`${a}-php-${r}`)}function Ml(e,a){let r=`php${e.replace(".","")}`,n=Eu(e).join(" \\\n      "),i=`/opt/remi/${r}/root`,o=`/etc/opt/remi/${r}`;return`${a?`FROM almalinux:9 AS ${a}`:"FROM almalinux:9"}
+${h}`)}let d=u.outputs[0],m=Buffer.from(await d.arrayBuffer()),p="index",g=Ci([{name:`${p}.mjs`,data:m}]);return{zip:g,bundle:m,sha256:Mo(g),handlerFile:p,handlers:{http:r.handlers?.http??`${p}.http`,queue:r.handlers?.queue??`${p}.queue`,cli:r.handlers?.cli??`${p}.cli`},bundleBytes:m.length}}finally{Ji(o,{recursive:!0,force:!0})}}var vu=["18","20","22"];function is(e){if(!e)return"22";let a=String(e).match(/(\d+)/);return a?a[1]:"22"}function Uo(e){let a=e.kind??"node";if(a==="php")return{lambdaRuntime:"provided.al2023",kind:"php",version:e.phpVersion??"8.3",usesLayer:!0,layerKind:"php",layerEnvVar:"TSCLOUD_PHP_LAYER_ARN"};if(a==="bun")return{lambdaRuntime:"provided.al2023",kind:"bun",version:e.runtimeVersion??"latest",usesLayer:!0,layerKind:"bun",layerEnvVar:"TSCLOUD_BUN_LAYER_ARN"};let r=is(e.runtimeVersion);if(e.runtime!=="provided.al2023"&&vu.includes(r))return{lambdaRuntime:e.runtime&&e.runtime.startsWith("nodejs")?e.runtime:`nodejs${r}.x`,kind:"node",version:r,usesLayer:!1};return{lambdaRuntime:"provided.al2023",kind:"node",version:r,usesLayer:!0,layerKind:"node",layerEnvVar:"TSCLOUD_NODE_LAYER_ARN"}}function Wt(e,a,r){if(e.queues===!1)return[];if(e.queues===void 0||e.queues===!0)return[{name:`${a}-${r}-default`}];return e.queues.map((n)=>{if(typeof n==="string")return{name:`${a}-${r}-${n}`};let[i,o]=Object.entries(n)[0];return{name:`${a}-${r}-${i}`,concurrency:o}})}function fa(e,a,r){return Wt(e,a,r).map((n)=>n.name)}function ha(e){let{app:a,environment:r,handlers:n}=e,i=e.config.project.slug,o=Uo(a).lambdaRuntime,c=a.architecture??"x86_64",u=e.config.project.region,d={http:`${i}-${r}-http`,queue:`${i}-${r}-queue`,cli:`${i}-${r}-cli`};if(a.gatewayVersion===1)throw Error("serverless app: `gatewayVersion: 1` (REST API) is not supported — ts-cloud uses API Gateway HTTP API (v2). Remove `gatewayVersion` or set it to 2.");let m=Wt(a,i,r),p=m.map((M)=>M.name),g=p.length>0,h=a.logRetention??14,y=a.packaging==="image";if(y&&a.lambdaInsights)throw Error("serverless app: `lambdaInsights` layer attachment is only supported for zip packaging. Container images must install the Lambda Insights extension in the image.");let f=(a.scheduler??"on")!=="off",b=(a.cache?.driver??"dynamodb")==="dynamodb",T=Boolean(a.assets),w=Io(i,r),I=a.tmpStorage??512,v={},N={},R=[{PolicyName:"tscloud-serverless-app",PolicyDocument:{Version:"2012-10-17",Statement:[{Effect:"Allow",Action:["logs:CreateLogGroup","logs:CreateLogStream","logs:PutLogEvents"],Resource:t.sub("arn:aws:logs:${AWS::Region}:${AWS::AccountId}:log-group:/aws/lambda/*")},{Effect:"Allow",Action:["lambda:InvokeFunction"],Resource:t.sub(`arn:aws:lambda:\${AWS::Region}:\${AWS::AccountId}:function:${i}-${r}-*`)},{Effect:"Allow",Action:["secretsmanager:GetSecretValue","ssm:GetParameter","ssm:GetParameters","ssm:GetParametersByPath"],Resource:[t.sub(`arn:aws:secretsmanager:\${AWS::Region}:\${AWS::AccountId}:secret:${i}/${r}/*`),t.sub(`arn:aws:ssm:\${AWS::Region}:\${AWS::AccountId}:parameter/${i}/${r}/*`)]},{Effect:"Allow",Action:["s3:GetObject","s3:PutObject","s3:DeleteObject","s3:ListBucket"],Resource:[t.sub(`arn:aws:s3:::${w}`),t.sub(`arn:aws:s3:::${w}/*`),...a.storage?.bucket?[t.sub(`arn:aws:s3:::${a.storage.bucket}`),t.sub(`arn:aws:s3:::${a.storage.bucket}/*`)]:[]]}]}}];if(g)R[0].PolicyDocument.Statement.push({Effect:"Allow",Action:["sqs:SendMessage","sqs:ReceiveMessage","sqs:DeleteMessage","sqs:GetQueueAttributes","sqs:GetQueueUrl"],Resource:t.sub(`arn:aws:sqs:\${AWS::Region}:\${AWS::AccountId}:${i}-${r}-*`)});if(b)R[0].PolicyDocument.Statement.push({Effect:"Allow",Action:["dynamodb:GetItem","dynamodb:PutItem","dynamodb:UpdateItem","dynamodb:DeleteItem","dynamodb:Query","dynamodb:Scan","dynamodb:BatchGetItem","dynamodb:BatchWriteItem"],Resource:t.sub(`arn:aws:dynamodb:\${AWS::Region}:\${AWS::AccountId}:table/${i}-${r}-cache*`)});let k=["arn:aws:iam::aws:policy/service-role/AWSLambdaBasicExecutionRole"];if(a.vpc?.subnets?.length)k.push("arn:aws:iam::aws:policy/service-role/AWSLambdaVPCAccessExecutionRole");if(a.lambdaInsights)k.push("arn:aws:iam::aws:policy/CloudWatchLambdaInsightsExecutionRolePolicy");v.AppRole={Type:"AWS::IAM::Role",Properties:{RoleName:`${i}-${r}-app-role`,AssumeRolePolicyDocument:{Version:"2012-10-17",Statement:[{Effect:"Allow",Principal:{Service:"lambda.amazonaws.com"},Action:"sts:AssumeRole"}]},ManagedPolicyArns:k,Policies:R}};let x=(M)=>({TSCLOUD_LAMBDA_MODE:M,TSCLOUD_ENV:r,...a.octane?{TSCLOUD_OCTANE:"1"}:{},...a.scheduler==="sub-minute"?{TSCLOUD_SCHEDULER:"sub-minute"}:{},...b?{TSCLOUD_CACHE_TABLE:`${i}-${r}-cache`}:{},...g?{TSCLOUD_QUEUE:p[0]}:{},...a.env??{}}),L=Boolean(a.efs),B=typeof a.efs==="object"?a.efs:{},_=B.mountPath??"/mnt/local",U=L&&!B.accessPointArn,Y=B.accessPointArn??(U?t.getAtt("EfsAccessPoint","Arn"):void 0),q=a.vpc?.subnets??[],Q=q.length>0,V=a.cache?.driver==="elasticache"||a.database?.connection==="aurora-serverless"||Boolean(a.rdsProxy)||L;if(V&&!Q)throw Error("serverless app: elasticache / aurora-serverless / rdsProxy / efs require app.vpc.subnets (private subnets) to be set.");let me=Q?{VpcConfig:{SubnetIds:q,SecurityGroupIds:[...a.vpc?.securityGroups??[],...V?[t.getAtt("DataSecurityGroup","GroupId")]:[]]}}:{},Me=U?q.map((M,G)=>`EfsMountTarget${G}`):[],vt=L?{FileSystemConfigs:[{Arn:Y,LocalMountPath:_}]}:{};if(L)R[0].PolicyDocument.Statement.push({Effect:"Allow",Action:["elasticfilesystem:ClientMount","elasticfilesystem:ClientWrite","elasticfilesystem:ClientRootAccess","elasticfilesystem:DescribeMountTargets"],Resource:"*"});function Z(M,G,W,K,ne,Ze,ce,Xe=I){v[`${M}LogGroup`]={Type:"AWS::Logs::LogGroup",Properties:{LogGroupName:`/aws/lambda/${G}`,RetentionInDays:h}};let Tt=[...e.runtimeLayers??[],...a.lambdaInsights?[a.lambdaInsights.layerArn]:[]],Pt=y?{PackageType:"Image",Code:{ImageUri:t.ref("ImageUri")},...a.kind==="php"?{}:{ImageConfig:{Command:[W]}}}:{Runtime:o,Handler:W,Code:{S3Bucket:t.ref("ArtifactBucket"),S3Key:t.ref("ArtifactKey")},...Tt.length?{Layers:[...new Set(Tt)]}:{}};v[M]={Type:"AWS::Lambda::Function",DependsOn:[`${M}LogGroup`,...Me],Properties:{FunctionName:G,Architectures:[c],MemorySize:ne,Timeout:Ze,Role:t.getAtt("AppRole","Arn"),Environment:{Variables:x(K)},EphemeralStorage:{Size:Xe},...Pt,...ce!==void 0?{ReservedConcurrentExecutions:ce}:{},...me,...vt}}}if(Z("HttpFunction",d.http,n.http,"http",a.memory??1024,a.timeout??28,a.concurrency,I),Z("CliFunction",d.cli,n.cli,"cli",a.cliMemory??1024,a.cliTimeout??900,void 0,a.cliTmpStorage??I),g)Z("QueueFunction",d.queue,n.queue,"queue",a.queueMemory??1024,a.queueTimeout??120,void 0,a.queueTmpStorage??I);let J=(a.provisionedConcurrency??0)>0?a.provisionedConcurrency:0,ee=["HttpFunction","CliFunction",...g?["QueueFunction"]:[]];if(J)for(let M of ee)v[`${M}Version`]={Type:"AWS::Lambda::Version",DeletionPolicy:"Retain",Properties:{FunctionName:t.ref(M)}},v[`${M}Alias`]={Type:"AWS::Lambda::Alias",Properties:{FunctionName:t.ref(M),Name:"live",FunctionVersion:t.getAtt(`${M}Version`,"Version"),ProvisionedConcurrencyConfig:{ProvisionedConcurrentExecutions:J}}};let pe=(M)=>J?t.ref(`${M}Alias`):t.getAtt(M,"Arn"),te=(M)=>J?t.ref(`${M}Alias`):t.ref(M);v.HttpApi={Type:"AWS::ApiGatewayV2::Api",Properties:{Name:`${i}-${r}`,ProtocolType:"HTTP"}},v.HttpIntegration={Type:"AWS::ApiGatewayV2::Integration",Properties:{ApiId:t.ref("HttpApi"),IntegrationType:"AWS_PROXY",IntegrationUri:pe("HttpFunction"),PayloadFormatVersion:"2.0"}},v.HttpRoute={Type:"AWS::ApiGatewayV2::Route",Properties:{ApiId:t.ref("HttpApi"),RouteKey:"$default",Target:t.join("/",["integrations",t.ref("HttpIntegration")])}},v.HttpStage={Type:"AWS::ApiGatewayV2::Stage",Properties:{ApiId:t.ref("HttpApi"),StageName:"$default",AutoDeploy:!0}},v.HttpPermission={Type:"AWS::Lambda::Permission",Properties:{FunctionName:te("HttpFunction"),Action:"lambda:InvokeFunction",Principal:"apigateway.amazonaws.com",SourceArn:t.sub("arn:aws:execute-api:${AWS::Region}:${AWS::AccountId}:${HttpApi}/*/*")}},N.HttpApiEndpoint={Description:"HTTP API endpoint",Value:t.getAtt("HttpApi","ApiEndpoint")},N.HttpApiId={Description:"HTTP API id",Value:t.ref("HttpApi")};let oe=(Array.isArray(a.domain)?a.domain:a.domain?[a.domain]:[]).filter(Boolean);if(oe.length){if(!a.certificateArn&&!a.hostedZoneId)throw Error("serverless app: a custom `domain` needs either `certificateArn` (pre-issued, regional) or `hostedZoneId` (to auto-issue + validate an ACM cert).");let M=a.certificateArn;if(!M)v.HttpCertificate={Type:"AWS::CertificateManager::Certificate",Properties:{DomainName:oe[0],...oe.length>1?{SubjectAlternativeNames:oe.slice(1)}:{},ValidationMethod:"DNS",DomainValidationOptions:oe.map((G)=>({DomainName:G,HostedZoneId:a.hostedZoneId}))}},M=t.ref("HttpCertificate");oe.forEach((G,W)=>{let K=`HttpDomain${W}`;if(v[K]={Type:"AWS::ApiGatewayV2::DomainName",Properties:{DomainName:G,DomainNameConfigurations:[{CertificateArn:M,EndpointType:"REGIONAL"}]}},v[`HttpApiMapping${W}`]={Type:"AWS::ApiGatewayV2::ApiMapping",DependsOn:["HttpStage"],Properties:{ApiId:t.ref("HttpApi"),DomainName:t.ref(K),Stage:"$default"}},a.hostedZoneId)v[`HttpDomainRecord${W}`]={Type:"AWS::Route53::RecordSet",Properties:{HostedZoneId:a.hostedZoneId,Name:G,Type:"A",AliasTarget:{DNSName:t.getAtt(K,"RegionalDomainName"),HostedZoneId:t.getAtt(K,"RegionalHostedZoneId")}}};N[`CustomDomain${W}`]={Description:`Custom domain ${G}`,Value:G},N[`CustomDomainTarget${W}`]={Description:`Point ${G} (CNAME/alias) at this APIGW regional domain`,Value:t.getAtt(K,"RegionalDomainName")}})}if(g)v.AppQueueDlq={Type:"AWS::SQS::Queue",Properties:{QueueName:`${i}-${r}-dlq`,MessageRetentionPeriod:1209600}},m.forEach((M,G)=>{let W=`AppQueue${G}`,K=a.queueTimeout??120;v[W]={Type:"AWS::SQS::Queue",Properties:{QueueName:M.name,VisibilityTimeout:Math.min(43200,K*6),RedrivePolicy:{deadLetterTargetArn:t.getAtt("AppQueueDlq","Arn"),maxReceiveCount:a.queueTries??3}}};let ne=M.concurrency??a.queueConcurrency;v[`${W}Mapping`]={Type:"AWS::Lambda::EventSourceMapping",Properties:{EventSourceArn:t.getAtt(W,"Arn"),FunctionName:te("QueueFunction"),BatchSize:1,FunctionResponseTypes:["ReportBatchItemFailures"],...ne?{ScalingConfig:{MaximumConcurrency:Math.max(2,ne)}}:{}}},N[`QueueUrl${G}`]={Description:`Queue URL: ${M.name}`,Value:t.ref(W)}});if(f)v.SchedulerRule={Type:"AWS::Events::Rule",Properties:{Name:`${i}-${r}-scheduler`,ScheduleExpression:"rate(1 minute)",State:"ENABLED",Targets:[{Id:"cli",Arn:pe("CliFunction"),Input:JSON.stringify({command:"schedule:run"})}]}},v.SchedulerPermission={Type:"AWS::Lambda::Permission",Properties:{FunctionName:te("CliFunction"),Action:"lambda:InvokeFunction",Principal:"events.amazonaws.com",SourceArn:t.getAtt("SchedulerRule","Arn")}};if(a.warm&&a.warm>0){let M={http:"HttpFunction",queue:"QueueFunction",cli:"CliFunction"},G=(a.warmFunctions??["http"]).filter((W)=>W!=="queue"||g);for(let W of G){let K=W.charAt(0).toUpperCase()+W.slice(1),ne=Math.ceil(a.warm/5),Ze=0;for(let ce=0;ce<ne;ce++){let Xe=Math.min(5,a.warm-Ze);v[`Warmer${K}Rule${ce}`]={Type:"AWS::Events::Rule",Properties:{Name:`${i}-${r}-warmer-${W}-${ce}`,ScheduleExpression:"rate(5 minutes)",State:"ENABLED",Targets:Array.from({length:Xe},(Tt,Pt)=>({Id:`warm-${W}-${ce}-${Pt}`,Arn:t.getAtt(M[W],"Arn"),Input:JSON.stringify({warmer:!0})}))}},Ze+=Xe}v[`Warmer${K}Permission`]={Type:"AWS::Lambda::Permission",Properties:{FunctionName:t.ref(M[W]),Action:"lambda:InvokeFunction",Principal:"events.amazonaws.com",SourceArn:t.sub(`arn:aws:events:\${AWS::Region}:\${AWS::AccountId}:rule/${i}-${r}-warmer-${W}-*`)}}}}if(b)v.CacheTable={Type:"AWS::DynamoDB::Table",Properties:{TableName:`${i}-${r}-cache`,BillingMode:"PAY_PER_REQUEST",AttributeDefinitions:[{AttributeName:"key",AttributeType:"S"}],KeySchema:[{AttributeName:"key",KeyType:"HASH"}],TimeToLiveSpecification:{AttributeName:"expires_at",Enabled:!0}}},N.CacheTableName={Description:"DynamoDB cache table",Value:t.ref("CacheTable")};if(T){if(v.AssetsBucket={Type:"AWS::S3::Bucket",Properties:{BucketName:w,PublicAccessBlockConfiguration:{BlockPublicAcls:!0,BlockPublicPolicy:!0,IgnorePublicAcls:!0,RestrictPublicBuckets:!0}}},v.AssetsOAC={Type:"AWS::CloudFront::OriginAccessControl",Properties:{OriginAccessControlConfig:{Name:`${i}-${r}-assets-oac`,OriginAccessControlOriginType:"s3",SigningBehavior:"always",SigningProtocol:"sigv4"}}},v.AssetsDistribution={Type:"AWS::CloudFront::Distribution",Properties:{DistributionConfig:{Enabled:!0,DefaultCacheBehavior:{TargetOriginId:"assets",ViewerProtocolPolicy:"redirect-to-https",Compress:!0,CachePolicyId:"658327ea-f89d-4fab-a63d-7e88639e58f6"},Origins:[{Id:"assets",DomainName:t.getAtt("AssetsBucket","RegionalDomainName"),OriginAccessControlId:t.ref("AssetsOAC"),S3OriginConfig:{OriginAccessIdentity:""}}],...a.assetDomain?{Aliases:[a.assetDomain],ViewerCertificate:{AcmCertificateArn:a.assetCertificateArn??t.ref("AssetsCertificate"),SslSupportMethod:"sni-only",MinimumProtocolVersion:"TLSv1.2_2021"}}:{}}}},a.assetDomain){if(!a.assetCertificateArn){if(!a.hostedZoneId)throw Error("serverless app: `assetDomain` requires either `assetCertificateArn` (a us-east-1 ACM cert) or `hostedZoneId` (to auto-issue + validate one). CloudFront only accepts certs from us-east-1.");if(u!=="us-east-1")throw Error(`serverless app: auto-issuing an asset-domain cert needs a us-east-1 app (CloudFront certs must be us-east-1); this app is in ${u}. Supply a pre-issued us-east-1 \`assetCertificateArn\` instead.`);v.AssetsCertificate={Type:"AWS::CertificateManager::Certificate",Properties:{DomainName:a.assetDomain,ValidationMethod:"DNS",DomainValidationOptions:[{DomainName:a.assetDomain,HostedZoneId:a.hostedZoneId}]}}}if(a.hostedZoneId)v.AssetsDomainRecord={Type:"AWS::Route53::RecordSet",Properties:{HostedZoneId:a.hostedZoneId,Name:a.assetDomain,Type:"A",AliasTarget:{DNSName:t.getAtt("AssetsDistribution","DomainName"),HostedZoneId:"Z2FDTNDATAQYW2"}}};N.AssetDomain={Description:"Custom asset CDN host",Value:a.assetDomain}}v.AssetsBucketPolicy={Type:"AWS::S3::BucketPolicy",Properties:{Bucket:t.ref("AssetsBucket"),PolicyDocument:{Version:"2012-10-17",Statement:[{Effect:"Allow",Principal:{Service:"cloudfront.amazonaws.com"},Action:"s3:GetObject",Resource:t.sub(`arn:aws:s3:::${w}/*`),Condition:{StringEquals:{"AWS:SourceArn":t.sub("arn:aws:cloudfront::${AWS::AccountId}:distribution/${AssetsDistribution}")}}}]}}},N.AssetsBucketName={Description:"Assets bucket",Value:t.ref("AssetsBucket")},N.AssetsCdnDomain={Description:"Assets CloudFront domain",Value:t.getAtt("AssetsDistribution","DomainName")}}if(a.firewall?.enabled){let M=[],G=0;if(a.firewall.rateLimit)M.push({Name:"rate-limit",Priority:G++,Action:{Block:{}},Statement:{RateBasedStatement:{Limit:a.firewall.rateLimit,AggregateKeyType:"IP"}},VisibilityConfig:{SampledRequestsEnabled:!0,CloudWatchMetricsEnabled:!0,MetricName:`${i}-${r}-rate`}});let W={sqlInjection:"AWSManagedRulesSQLiRuleSet",xss:"AWSManagedRulesCommonRuleSet",common:"AWSManagedRulesCommonRuleSet",botControl:"AWSManagedRulesBotControlRuleSet",ipReputation:"AWSManagedRulesAmazonIpReputationList"};for(let K of a.firewall.rules??[]){let ne=W[K];if(!ne)continue;M.push({Name:`managed-${K}`,Priority:G++,OverrideAction:{None:{}},Statement:{ManagedRuleGroupStatement:{VendorName:"AWS",Name:ne}},VisibilityConfig:{SampledRequestsEnabled:!0,CloudWatchMetricsEnabled:!0,MetricName:`${i}-${r}-${K}`}})}v.WebAcl={Type:"AWS::WAFv2::WebACL",Properties:{Name:`${i}-${r}-waf`,Scope:"REGIONAL",DefaultAction:{Allow:{}},Rules:M,VisibilityConfig:{SampledRequestsEnabled:!0,CloudWatchMetricsEnabled:!0,MetricName:`${i}-${r}-waf`}}},N.WafAclArn={Description:"WAF web ACL ARN. Attach to a CloudFront distribution fronting the API to enforce (HTTP API v2 stages do not support direct WAF association).",Value:t.getAtt("WebAcl","Arn")}}if(Q&&V){if(!a.vpc?.id)throw Error("serverless app: data services (elasticache / aurora-serverless / rdsProxy / efs) need app.vpc.id (the VPC id) so the managed security group is created in the right VPC.");v.DataSecurityGroup={Type:"AWS::EC2::SecurityGroup",Properties:{VpcId:a.vpc.id,GroupDescription:`${i}-${r} serverless data access`,SecurityGroupIngress:[{IpProtocol:"-1",CidrIp:"10.0.0.0/8"}]}}}if(U)v.EfsFileSystem={Type:"AWS::EFS::FileSystem",Properties:{Encrypted:!0,FileSystemTags:[{Key:"Name",Value:`${i}-${r}-efs`}]}},q.forEach((M,G)=>{v[`EfsMountTarget${G}`]={Type:"AWS::EFS::MountTarget",Properties:{FileSystemId:t.ref("EfsFileSystem"),SubnetId:M,SecurityGroups:[t.getAtt("DataSecurityGroup","GroupId")]}}}),v.EfsAccessPoint={Type:"AWS::EFS::AccessPoint",Properties:{FileSystemId:t.ref("EfsFileSystem"),PosixUser:{Uid:1001,Gid:1001},RootDirectory:{Path:"/lambda",CreationInfo:{OwnerUid:1001,OwnerGid:1001,Permissions:"0755"}}}},N.EfsFileSystemId={Description:"EFS file system id",Value:t.ref("EfsFileSystem")};if(a.cache?.driver==="elasticache")v.CacheSubnetGroup={Type:"AWS::ElastiCache::SubnetGroup",Properties:{Description:`${i}-${r} cache subnets`,SubnetIds:q}},v.CacheCluster={Type:"AWS::ElastiCache::ReplicationGroup",Properties:{ReplicationGroupId:`${i}-${r}-cache`,ReplicationGroupDescription:`${i}-${r} redis`,Engine:"redis",CacheNodeType:"cache.t4g.micro",NumCacheClusters:1,AutomaticFailoverEnabled:!1,CacheSubnetGroupName:t.ref("CacheSubnetGroup"),SecurityGroupIds:[t.getAtt("DataSecurityGroup","GroupId")],TransitEncryptionEnabled:!1}},N.CacheEndpoint={Description:"Redis primary endpoint",Value:t.getAtt("CacheCluster","PrimaryEndPoint.Address")};if(a.database?.connection==="aurora-serverless")v.DbSubnetGroup={Type:"AWS::RDS::DBSubnetGroup",Properties:{DBSubnetGroupDescription:`${i}-${r} db subnets`,SubnetIds:q}},v.DbSecret={Type:"AWS::SecretsManager::Secret",Properties:{Name:`${i}/${r}/db`,GenerateSecretString:{SecretStringTemplate:JSON.stringify({username:"app"}),GenerateStringKey:"password",PasswordLength:32,ExcludePunctuation:!0}}},v.DbCluster={Type:"AWS::RDS::DBCluster",Properties:{Engine:"aurora-mysql",EngineMode:"provisioned",DBClusterIdentifier:`${i}-${r}-db`,DatabaseName:"app",MasterUsername:t.sub("{{resolve:secretsmanager:${DbSecret}:SecretString:username}}"),MasterUserPassword:t.sub("{{resolve:secretsmanager:${DbSecret}:SecretString:password}}"),ServerlessV2ScalingConfiguration:{MinCapacity:a.database?.minCapacity??0.5,MaxCapacity:a.database?.maxCapacity??4},DBSubnetGroupName:t.ref("DbSubnetGroup"),VpcSecurityGroupIds:[t.getAtt("DataSecurityGroup","GroupId")]}},v.DbInstance={Type:"AWS::RDS::DBInstance",Properties:{Engine:"aurora-mysql",DBInstanceClass:"db.serverless",DBClusterIdentifier:t.ref("DbCluster")}},N.DbEndpoint={Description:"Aurora cluster endpoint",Value:t.getAtt("DbCluster","Endpoint.Address")};if(a.rdsProxy&&a.database?.connection==="aurora-serverless")v.DbProxyRole={Type:"AWS::IAM::Role",Properties:{AssumeRolePolicyDocument:{Version:"2012-10-17",Statement:[{Effect:"Allow",Principal:{Service:"rds.amazonaws.com"},Action:"sts:AssumeRole"}]},Policies:[{PolicyName:"read-db-secret",PolicyDocument:{Version:"2012-10-17",Statement:[{Effect:"Allow",Action:["secretsmanager:GetSecretValue"],Resource:t.ref("DbSecret")}]}}]}},v.DbProxy={Type:"AWS::RDS::DBProxy",Properties:{DBProxyName:typeof a.rdsProxy==="object"&&a.rdsProxy.name?a.rdsProxy.name:`${i}-${r}-proxy`,EngineFamily:"MYSQL",RoleArn:t.getAtt("DbProxyRole","Arn"),Auth:[{AuthScheme:"SECRETS",SecretArn:t.ref("DbSecret"),IAMAuth:"DISABLED"}],VpcSubnetIds:q,VpcSecurityGroupIds:[t.getAtt("DataSecurityGroup","GroupId")],RequireTLS:!1}},v.DbProxyTargetGroup={Type:"AWS::RDS::DBProxyTargetGroup",DependsOn:["DbInstance"],Properties:{DBProxyName:t.ref("DbProxy"),TargetGroupName:"default",DBClusterIdentifiers:[t.ref("DbCluster")]}},N.DbProxyEndpoint={Description:"RDS Proxy endpoint",Value:t.getAtt("DbProxy","Endpoint")};if(N.HttpFunctionName={Description:"HTTP function name",Value:t.ref("HttpFunction")},N.CliFunctionName={Description:"CLI function name",Value:t.ref("CliFunction")},g)N.QueueFunctionName={Description:"Queue function name",Value:t.ref("QueueFunction")};let Se={AWSTemplateFormatVersion:"2010-09-09",Description:`Serverless application for ${e.config.project.name} (${i}-${r})`,Parameters:y?{ImageUri:{Type:"String",Description:"ECR image URI of the deployment artifact"}}:{ArtifactBucket:{Type:"String",Description:"S3 bucket holding the deployment artifact"},ArtifactKey:{Type:"String",Description:"S3 key of the deployment artifact (zip)"}},Resources:v,Outputs:N},Oe={};for(let M of Object.values(v))Oe[M.Type]=(Oe[M.Type]??0)+1;return{template:Se,functionNames:d,queueNames:p,resourceSummary:Oe}}var Tu=["cli","fpm","curl","mbstring","xml","pdo","mysqlnd","gd","bcmath","intl","opcache","sodium","process","pecl-redis6","pecl-apcu","pgsql"];function Eu(e){let a=`php${e.replace(".","")}`;return Tu.map((r)=>`${a}-php-${r}`)}function Ml(e,a){let r=`php${e.replace(".","")}`,n=Eu(e).join(" \\\n      "),i=`/opt/remi/${r}/root`,o=`/etc/opt/remi/${r}`;return`${a?`FROM almalinux:9 AS ${a}`:"FROM almalinux:9"}
 
 # Build PHP on AlmaLinux 9 (where Remi's version-isolated SCL packages install
 # cleanly — Remi's release RPM rejects Amazon Linux 2023). AlmaLinux 9 shares
@@ -7361,4 +7361,4 @@ decorate_workers_output = no
 php_admin_value[error_log] = /dev/stderr
 php_admin_flag[log_errors] = on
 clear_env = no
-`}function bs(){return yr(fs(Ss(import.meta.url)),"runtime-assets")}function Ai(){let e=bs(),a=(r)=>ys(yr(e,r),"utf-8");return[{path:"bootstrap",contents:a("bootstrap"),mode:493},{path:"tscloud/runtime.php",contents:a("runtime.php"),mode:420},{path:"tscloud/octane-runtime.php",contents:a("octane-runtime.php"),mode:420},{path:"tscloud/cli-runtime.php",contents:a("cli-runtime.php"),mode:420},{path:"tscloud/fastcgi-client.php",contents:a("fastcgi-client.php"),mode:420},{path:"tscloud/php-fpm.conf",contents:xu(),mode:420}]}function Ea(e={}){let a=e.cacheDriver??"dynamodb";return{APP_ENV:"production",LOG_CHANNEL:"stderr",CACHE_STORE:a,CACHE_DRIVER:a,SESSION_DRIVER:a,QUEUE_CONNECTION:"sqs",FILESYSTEM_DISK:"s3",VIEW_COMPILED_PATH:"/tmp/storage/framework/views",APP_SERVICES_CACHE:"/tmp/bootstrap/cache/services.php",APP_PACKAGES_CACHE:"/tmp/bootstrap/cache/packages.php",APP_CONFIG_CACHE:"/tmp/bootstrap/cache/config.php",APP_ROUTES_CACHE:"/tmp/bootstrap/cache/routes.php",APP_EVENTS_CACHE:"/tmp/bootstrap/cache/events.php"}}var $u=["composer install --no-dev --optimize-autoloader --no-interaction","php artisan config:cache","php artisan route:cache","php artisan event:cache","php artisan view:cache"];function*Sr(e){for(let a of Ts(e)){let r=Pe(e,a);if(fr(r).isDirectory())yield*Sr(r);else yield r}}function Kf(e={}){let a=e.architecture??"x86_64",r=e.platform??(a==="arm64"?"linux/arm64":"linux/amd64"),n=e.onStep??(()=>{}),i=vs(Pe(Is(),"tscloud-php-layer-")),o="tscloud-php-layer:build";try{Ps(Pe(i,"Dockerfile"),wu(e)),n("Building PHP runtime image (docker)"),ot("docker",["build","--platform",r,"-t","tscloud-php-layer:build",i],{stdio:"inherit"}),n("Extracting /opt/php from image");let c=ot("docker",["create","--platform",r,"tscloud-php-layer:build"],{encoding:"utf-8"}).trim(),u=Pe(i,"opt");Cs(u,{recursive:!0});try{ot("docker",["cp",`${c}:/opt/php`,Pe(u,"php")],{stdio:"inherit"})}finally{ot("docker",["rm",c],{stdio:"ignore"})}if(!As(Pe(u,"php","bin","php")))throw Error("layer build produced no /opt/php/bin/php");let d=[];for(let g of Sr(u)){let h=Rs(u,g).replace(/\\/g,"/"),y=fr(g).mode&73?493:420;d.push({name:h,data:ws(g),mode:y})}n("Injecting runtime assets");let m=new Set(Ai().map((g)=>g.path)),p=d.filter((g)=>!m.has(g.name));for(let g of Ai())p.push({name:g.path,data:g.contents,mode:g.mode});return n("Packaging layer ZIP"),{zip:Ci(p),architecture:a,fileCount:p.length}}finally{Es(i,{recursive:!0,force:!0})}}var Ou=[".git",".github","node_modules","tests","storage/logs","storage/framework/cache","storage/framework/sessions","storage/framework/views",".env",".env.local",".vapor",".ts-cloud","dist-lambda"];function Ms(e,a){return a.some((r)=>e===r||e.startsWith(`${r}/`))}function*Cr(e,a,r){for(let n of ks(e)){let i=Ls(e,n),o=Ar(a,i).replace(/\\/g,"/");if(Ms(o,r))continue;if(br(i).isDirectory())yield*Cr(i,a,r);else yield i}}function Fo(e){if(e.skipBuild)return;let a=$a(e.projectRoot??process.cwd()),r=e.app.build??$u;for(let n of r)e.onStep?.(`build: ${n}`),Ns(n,{stdio:"inherit",cwd:a})}function jo(e,a=[]){let r=$a(e),n=[...Ou,Co(),...a],i=[];for(let o of Cr(r,r,n)){let c=Ar(r,o).replace(/\\/g,"/"),u=(br(o).mode&73)!==0;i.push({name:c,data:$s(o),mode:u?493:420})}return i}function wa(e){let a=$a(e.projectRoot??process.cwd());Fo(e),e.onStep?.("packaging application tree");let r=jo(a,e.exclude);if(!r.length)throw Error(`No files to package under ${a}`);let n=Ci(r),i=e.app.handlers?.http??"public/index.php";return{zip:n,sha256:Ds("sha256").update(n).digest("hex"),handlers:{http:i,queue:e.app.handlers?.queue??i,cli:e.app.handlers?.cli??i},fileCount:r.length}}class Wl{optimizations=new Map;imageConfigs=new Map;ssgConfigs=new Map;prerenderConfigs=new Map;counter=0;createAssetOptimization(e){let a=`asset-opt-${Date.now()}-${this.counter++}`,r={id:a,...e};return this.optimizations.set(a,r),r}createImageOptimization(e){let a=`image-opt-${Date.now()}-${this.counter++}`,r={id:a,...e};return this.imageConfigs.set(a,r),r}createSSGConfig(e){let a=`ssg-${Date.now()}-${this.counter++}`,r={id:a,...e};return this.ssgConfigs.set(a,r),r}createPrerenderConfig(e){let a=`prerender-${Date.now()}-${this.counter++}`,r={id:a,...e};return this.prerenderConfigs.set(a,r),r}listOptimizations(){return Array.from(this.optimizations.values())}listImageConfigs(){return Array.from(this.imageConfigs.values())}clear(){this.optimizations.clear(),this.imageConfigs.clear(),this.ssgConfigs.clear(),this.prerenderConfigs.clear()}}var Jf=new Wl;class Gl{policies=new Map;versioningConfigs=new Map;replicationRules=new Map;tieringConfigs=new Map;objectLocks=new Map;transferAcceleration=new Map;accessPoints=new Map;glacierConfigs=new Map;inventories=new Map;batchOps=new Map;eventNotifications=new Map;counter=0;createLifecyclePolicy(e,a){let r=`lifecycle-${Date.now()}-${this.counter++}`,n={id:r,transitions:e,expiration:a};return this.policies.set(r,n),n}enableVersioning(e=!1){let a=`versioning-${Date.now()}-${this.counter++}`,r={id:a,enabled:!0,mfaDelete:e};return this.versioningConfigs.set(a,r),r}createReplicationRule(e,a,r){let n=`replication-${Date.now()}-${this.counter++}`,i={id:n,sourceRegion:e,destRegion:a,destBucket:r};return this.replicationRules.set(n,i),i}createIntelligentTiering(e,a){let r=`tiering-${Date.now()}-${this.counter++}`,n={id:r,archiveDays:e,deepArchiveDays:a};return this.tieringConfigs.set(r,n),n}enableObjectLock(e){let a=`object-lock-${Date.now()}-${this.counter++}`,r={id:a,bucketName:e.bucketName,mode:e.mode||"COMPLIANCE",retentionDays:e.retentionDays,retentionYears:e.retentionYears,legalHoldEnabled:e.legalHoldEnabled||!1};return this.objectLocks.set(a,r),r}enableTransferAcceleration(e){let a=`transfer-accel-${Date.now()}-${this.counter++}`,r={id:a,bucketName:e,enabled:!0,endpoint:`${e}.s3-accelerate.amazonaws.com`};return this.transferAcceleration.set(a,r),r}createAccessPoint(e){let a=`access-point-${Date.now()}-${this.counter++}`,r={id:a,name:e.name,bucketName:e.bucketName,vpcId:e.vpcId,publicAccessBlock:e.publicAccessBlock!==!1,policy:e.policy};return this.accessPoints.set(a,r),r}createGlacierArchive(e){let a=`glacier-${Date.now()}-${this.counter++}`,r={id:a,bucketName:e.bucketName,archiveType:e.archiveType,transitionDays:e.transitionDays,restoreConfig:e.restoreTier?{tier:e.restoreTier,days:e.restoreDays||7}:void 0};return this.glacierConfigs.set(a,r),r}createInventory(e){let a=`inventory-${Date.now()}-${this.counter++}`,r={id:a,sourceBucket:e.sourceBucket,destinationBucket:e.destinationBucket,schedule:e.schedule||"Daily",format:e.format||"CSV",includedFields:e.includedFields||["Size","LastModifiedDate","StorageClass","ETag"],prefix:e.prefix};return this.inventories.set(a,r),r}createBatchOperation(e){let a=`batch-op-${Date.now()}-${this.counter++}`,r={id:a,operation:e.operation,manifestBucket:e.manifestBucket,manifestKey:e.manifestKey,priority:e.priority||10,status:"pending"};return this.batchOps.set(a,r),r}executeBatchOperation(e){let a=this.batchOps.get(e);if(!a)throw Error(`Batch operation not found: ${e}`);return a.status="in_progress",a.totalObjects=1000,a.processedObjects=0,a}getBatchOperationStatus(e){return this.batchOps.get(e)}createLambdaNotification(e){let a=`event-${Date.now()}-${this.counter++}`,r={id:a,bucketName:e.bucketName,events:e.events,destination:{type:"Lambda",arn:e.lambdaArn},filter:e.prefix||e.suffix?{prefix:e.prefix,suffix:e.suffix}:void 0};return this.eventNotifications.set(a,r),r}createSQSNotification(e){let a=`event-${Date.now()}-${this.counter++}`,r={id:a,bucketName:e.bucketName,events:e.events,destination:{type:"SQS",arn:e.queueArn},filter:e.prefix||e.suffix?{prefix:e.prefix,suffix:e.suffix}:void 0};return this.eventNotifications.set(a,r),r}createSNSNotification(e){let a=`event-${Date.now()}-${this.counter++}`,r={id:a,bucketName:e.bucketName,events:e.events,destination:{type:"SNS",arn:e.topicArn},filter:e.prefix||e.suffix?{prefix:e.prefix,suffix:e.suffix}:void 0};return this.eventNotifications.set(a,r),r}generateObjectLockCF(e){let a={ObjectLockEnabled:"Enabled",ObjectLockConfiguration:{ObjectLockEnabled:"Enabled",Rule:{DefaultRetention:{Mode:e.mode}}}};if(e.retentionDays)a.ObjectLockConfiguration.Rule.DefaultRetention.Days=e.retentionDays;if(e.retentionYears)a.ObjectLockConfiguration.Rule.DefaultRetention.Years=e.retentionYears;return a}generateTransferAccelerationCF(e){return{AccelerateConfiguration:{AccelerationStatus:e.enabled?"Enabled":"Suspended"}}}generateAccessPointCF(e){return{Type:"AWS::S3::AccessPoint",Properties:{Name:e.name,Bucket:e.bucketName,...e.vpcId&&{VpcConfiguration:{VpcId:e.vpcId}},PublicAccessBlockConfiguration:e.publicAccessBlock?{BlockPublicAcls:!0,BlockPublicPolicy:!0,IgnorePublicAcls:!0,RestrictPublicBuckets:!0}:void 0,...e.policy&&{Policy:e.policy}}}}generateInventoryCF(e){return{Type:"AWS::S3::Bucket",Properties:{InventoryConfigurations:[{Id:e.id,Destination:{BucketArn:`arn:aws:s3:::${e.destinationBucket}`,Format:e.format},Enabled:!0,IncludedObjectVersions:"Current",OptionalFields:e.includedFields,ScheduleFrequency:e.schedule,...e.prefix&&{Prefix:e.prefix}}]}}}generateEventNotificationCF(e){let a=e.destination.type==="Lambda"?"LambdaConfigurations":e.destination.type==="SQS"?"QueueConfigurations":"TopicConfigurations",r=e.destination.type==="Lambda"?"Function":e.destination.type==="SQS"?"Queue":"Topic",n={Event:e.events[0],[r]:e.destination.arn};if(e.filter)n.Filter={S3Key:{Rules:[...e.filter.prefix?[{Name:"prefix",Value:e.filter.prefix}]:[],...e.filter.suffix?[{Name:"suffix",Value:e.filter.suffix}]:[]]}};return{NotificationConfiguration:{[a]:[n]}}}clear(){this.policies.clear(),this.versioningConfigs.clear(),this.replicationRules.clear(),this.tieringConfigs.clear(),this.objectLocks.clear(),this.transferAcceleration.clear(),this.accessPoints.clear(),this.glacierConfigs.clear(),this.inventories.clear(),this.batchOps.clear(),this.eventNotifications.clear()}}var Xf=new Gl;class Kl{checks=new Map;synthetics=new Map;uptimeTrackers=new Map;counter=0;createHealthCheck(e,a=30,r=10){let n=`health-${Date.now()}-${this.counter++}`,i={id:n,url:e,interval:a,timeout:r,status:"healthy"};return this.checks.set(n,i),i}createSyntheticMonitor(e,a,r,n){let i=`synthetic-${Date.now()}-${this.counter++}`,o={id:i,name:e,script:a,frequency:r,locations:n};return this.synthetics.set(i,o),o}trackUptime(e,a,r){let n=`uptime-${Date.now()}-${this.counter++}`,i=a/(a+r)*100,o={id:n,resource:e,uptime:a,downtime:r,availability:i};return this.uptimeTrackers.set(n,o),o}clear(){this.checks.clear(),this.synthetics.clear(),this.uptimeTrackers.clear()}}var Qf=new Kl;class Jl{wafRules=new Map;shieldProtections=new Map;securityGroups=new Map;nacls=new Map;counter=0;createWAFRule(e,a,r,n){let i=`waf-${Date.now()}-${this.counter++}`,o={id:i,name:e,priority:a,action:r,conditions:n};return this.wafRules.set(i,o),o}enableShield(e,a="standard"){let r=`shield-${Date.now()}-${this.counter++}`,n={id:r,resourceArn:e,protectionType:a};return this.shieldProtections.set(r,n),n}createSecurityGroup(e,a,r){let n=`sg-${Date.now()}-${this.counter++}`,i={id:n,name:e,vpcId:a,rules:r};return this.securityGroups.set(n,i),i}createNACL(e,a){let r=`nacl-${Date.now()}-${this.counter++}`,n={id:r,vpcId:e,rules:a};return this.nacls.set(r,n),n}clear(){this.wafRules.clear(),this.shieldProtections.clear(),this.securityGroups.clear(),this.nacls.clear()}}var Yf=new Jl;class Xl{strategies=new Map;allocations=new Map;groups=new Map;counter=0;createTaggingStrategy(e,a){let r=`tagging-${Date.now()}-${this.counter++}`,n={id:r,tags:e,resources:a};return this.strategies.set(r,n),n}createCostAllocation(e,a){let r=`cost-${Date.now()}-${this.counter++}`,n={id:r,tagKey:e,allocations:a};return this.allocations.set(r,n),n}createResourceGroup(e,a,r){let n=`group-${Date.now()}-${this.counter++}`,i={id:n,name:e,query:{resourceTypeFilters:a,tagFilters:r}};return this.groups.set(n,i),i}clear(){this.strategies.clear(),this.allocations.clear(),this.groups.clear()}}var Zf=new Xl;export{fc,ae,hc,Rd,yp,fi,Sp,bp,qs,vp,Tp,Ep,wp,Cp,Ap,Ip,yc,Sc,Ws,Gs,Co,et,A,Ks,bc,z,Rr,C,Pd,hi,Js,Xs,B,Ao,Rp,Pp,Np,Dp,l,s,kp,_p,E,Qs,Ys,Zs,xp,$p,De,ea,Io,Nd,Op,Lp,Ue,Et,ta,vc,Tc,Mp,Ec,wc,Cc,ra,Ac,jt,Ro,yi,Po,Si,Be,Dd,No,Do,na,ia,oa,sa,aa,ca,ve,F,S,O,tt,D,kd,wt,ge,Vt,Up,_d,Te,ko,Fe,zt,bi,Ee,_o,ke,xd,vi,we,Ce,re,Ti,J,Ht,Ct,Ae,t,xo,Bp,Ic,la,Fp,jp,Vp,zp,da,Hp,qp,Wp,Gp,Kp,Jp,Xp,Qp,Yp,Zp,em,tm,$d,Od,Ld,Md,Ud,Bd,Fd,qt,Rc,Pc,Pr,Ei,rm,Nc,nm,im,an,om,sm,am,cm,lm,dm,jd,Vd,zd,Hd,qd,$o,um,ua,Wd,Gd,Kd,Dc,Ie,pm,Jd,At,Oo,Nr,Xd,kc,Qd,Yd,Zd,_c,_e,mm,gm,fm,hm,eu,ym,Re,Sm,bm,vm,xc,$c,Tm,Oc,Lc,Em,wm,Cm,Am,Im,tu,pa,Rm,Pm,Nm,Dm,km,ru,nu,_m,xm,$m,Om,Lm,Mm,Um,Bm,Fm,Mc,ma,jm,Vm,zm,Hm,Uc,Bc,Fc,qm,jc,Wm,Gm,Km,Jm,Vc,Xm,Qm,Ym,Zm,eg,tg,rg,ng,iu,ou,su,au,zc,ig,og,sg,ag,cg,lg,dg,ug,pg,cu,lu,du,uu,mg,gg,Hc,fg,qc,Wc,Gc,Kc,hg,yg,Sg,bg,rt,wi,vg,Tg,Eg,wg,Cg,Ag,Ig,Rg,pu,Pg,Ng,Jc,Xc,Dg,kg,mu,_g,xg,$g,Og,Lg,Mg,Ug,Bg,Fg,jg,Vg,zg,Hg,qg,Wg,Gg,Kg,Jg,Xg,Qg,Yg,Qc,Zg,Yc,ef,Zc,tf,el,rf,tl,nf,cn,of,rl,sf,Lo,af,nl,cf,il,lf,ol,df,sl,uf,al,pf,ln,mf,cl,gf,ll,ff,dl,hf,ul,yf,pl,Sf,ml,bf,gl,vf,fl,Tf,hl,Ef,yl,wf,Sl,Cf,bl,Af,vl,If,Tl,Rf,El,Pf,wl,Nf,Cl,Df,Al,kf,Il,_f,Rl,xf,Pl,$f,Nl,Of,Dl,Lf,kl,Mf,_l,Uf,gu,fu,hu,yu,xl,Bf,$l,Ff,Ol,jf,Ll,Vf,Ci,Su,bu,Mo,ga,dn,vu,Uo,Wt,fa,ha,Tu,Eu,Ml,wu,ya,Ul,zf,Hf,Sa,ba,va,Bl,Bo,Fl,jl,Ta,Vl,zl,Hl,Cu,Au,Iu,qf,Ru,Pu,Wf,Nu,ql,Du,ku,_u,Gf,xu,Ai,Ea,$u,Kf,Ou,Fo,jo,wa,Wl,Jf,Gl,Xf,Kl,Qf,Jl,Yf,Xl,Zf};
+`}function bs(){return yr(fs(Ss(import.meta.url)),"runtime-assets")}function Ai(){let e=bs(),a=(r)=>ys(yr(e,r),"utf-8");return[{path:"bootstrap",contents:a("bootstrap"),mode:493},{path:"tscloud/runtime.php",contents:a("runtime.php"),mode:420},{path:"tscloud/octane-runtime.php",contents:a("octane-runtime.php"),mode:420},{path:"tscloud/cli-runtime.php",contents:a("cli-runtime.php"),mode:420},{path:"tscloud/fastcgi-client.php",contents:a("fastcgi-client.php"),mode:420},{path:"tscloud/php-fpm.conf",contents:xu(),mode:420}]}function Ea(e={}){let a=e.cacheDriver??"dynamodb";return{APP_ENV:"production",LOG_CHANNEL:"stderr",CACHE_STORE:a,CACHE_DRIVER:a,SESSION_DRIVER:a,QUEUE_CONNECTION:"sqs",FILESYSTEM_DISK:"s3",VIEW_COMPILED_PATH:"/tmp/storage/framework/views",APP_SERVICES_CACHE:"/tmp/bootstrap/cache/services.php",APP_PACKAGES_CACHE:"/tmp/bootstrap/cache/packages.php",APP_CONFIG_CACHE:"/tmp/bootstrap/cache/config.php",APP_ROUTES_CACHE:"/tmp/bootstrap/cache/routes.php",APP_EVENTS_CACHE:"/tmp/bootstrap/cache/events.php"}}var $u=["composer install --no-dev --optimize-autoloader --no-interaction","php artisan config:cache","php artisan route:cache","php artisan event:cache","php artisan view:cache"];function*Sr(e){for(let a of Ts(e)){let r=Pe(e,a);if(fr(r).isDirectory())yield*Sr(r);else yield r}}function Kf(e={}){let a=e.architecture??"x86_64",r=e.platform??(a==="arm64"?"linux/arm64":"linux/amd64"),n=e.onStep??(()=>{}),i=vs(Pe(Is(),"tscloud-php-layer-")),o="tscloud-php-layer:build";try{Ps(Pe(i,"Dockerfile"),wu(e)),n("Building PHP runtime image (docker)"),ot("docker",["build","--platform",r,"-t","tscloud-php-layer:build",i],{stdio:"inherit"}),n("Extracting /opt/php from image");let c=ot("docker",["create","--platform",r,"tscloud-php-layer:build"],{encoding:"utf-8"}).trim(),u=Pe(i,"opt");Cs(u,{recursive:!0});try{ot("docker",["cp",`${c}:/opt/php`,Pe(u,"php")],{stdio:"inherit"})}finally{ot("docker",["rm",c],{stdio:"ignore"})}if(!As(Pe(u,"php","bin","php")))throw Error("layer build produced no /opt/php/bin/php");let d=[];for(let g of Sr(u)){let h=Rs(u,g).replace(/\\/g,"/"),y=fr(g).mode&73?493:420;d.push({name:h,data:ws(g),mode:y})}n("Injecting runtime assets");let m=new Set(Ai().map((g)=>g.path)),p=d.filter((g)=>!m.has(g.name));for(let g of Ai())p.push({name:g.path,data:g.contents,mode:g.mode});return n("Packaging layer ZIP"),{zip:Ci(p),architecture:a,fileCount:p.length}}finally{Es(i,{recursive:!0,force:!0})}}var Ou=[".git",".github","node_modules","tests","storage/logs","storage/framework/cache","storage/framework/sessions","storage/framework/views",".env",".env.local",".vapor",".ts-cloud","dist-lambda"];function Ms(e,a){return a.some((r)=>e===r||e.startsWith(`${r}/`))}function*Cr(e,a,r){for(let n of ks(e)){let i=Ls(e,n),o=Ar(a,i).replace(/\\/g,"/");if(Ms(o,r))continue;if(br(i).isDirectory())yield*Cr(i,a,r);else yield i}}function Fo(e){if(e.skipBuild)return;let a=$a(e.projectRoot??process.cwd()),r=e.app.build??$u;for(let n of r)e.onStep?.(`build: ${n}`),Ns(n,{stdio:"inherit",cwd:a})}function jo(e,a=[]){let r=$a(e),n=[...Ou,Co(),...a],i=[];for(let o of Cr(r,r,n)){let c=Ar(r,o).replace(/\\/g,"/"),u=(br(o).mode&73)!==0;i.push({name:c,data:$s(o),mode:u?493:420})}return i}function wa(e){let a=$a(e.projectRoot??process.cwd());Fo(e),e.onStep?.("packaging application tree");let r=jo(a,e.exclude);if(!r.length)throw Error(`No files to package under ${a}`);let n=Ci(r),i=e.app.handlers?.http??"public/index.php";return{zip:n,sha256:Ds("sha256").update(n).digest("hex"),handlers:{http:i,queue:e.app.handlers?.queue??i,cli:e.app.handlers?.cli??i},fileCount:r.length}}class Wl{optimizations=new Map;imageConfigs=new Map;ssgConfigs=new Map;prerenderConfigs=new Map;counter=0;createAssetOptimization(e){let a=`asset-opt-${Date.now()}-${this.counter++}`,r={id:a,...e};return this.optimizations.set(a,r),r}createImageOptimization(e){let a=`image-opt-${Date.now()}-${this.counter++}`,r={id:a,...e};return this.imageConfigs.set(a,r),r}createSSGConfig(e){let a=`ssg-${Date.now()}-${this.counter++}`,r={id:a,...e};return this.ssgConfigs.set(a,r),r}createPrerenderConfig(e){let a=`prerender-${Date.now()}-${this.counter++}`,r={id:a,...e};return this.prerenderConfigs.set(a,r),r}listOptimizations(){return Array.from(this.optimizations.values())}listImageConfigs(){return Array.from(this.imageConfigs.values())}clear(){this.optimizations.clear(),this.imageConfigs.clear(),this.ssgConfigs.clear(),this.prerenderConfigs.clear()}}var Jf=new Wl;class Gl{policies=new Map;versioningConfigs=new Map;replicationRules=new Map;tieringConfigs=new Map;objectLocks=new Map;transferAcceleration=new Map;accessPoints=new Map;glacierConfigs=new Map;inventories=new Map;batchOps=new Map;eventNotifications=new Map;counter=0;createLifecyclePolicy(e,a){let r=`lifecycle-${Date.now()}-${this.counter++}`,n={id:r,transitions:e,expiration:a};return this.policies.set(r,n),n}enableVersioning(e=!1){let a=`versioning-${Date.now()}-${this.counter++}`,r={id:a,enabled:!0,mfaDelete:e};return this.versioningConfigs.set(a,r),r}createReplicationRule(e,a,r){let n=`replication-${Date.now()}-${this.counter++}`,i={id:n,sourceRegion:e,destRegion:a,destBucket:r};return this.replicationRules.set(n,i),i}createIntelligentTiering(e,a){let r=`tiering-${Date.now()}-${this.counter++}`,n={id:r,archiveDays:e,deepArchiveDays:a};return this.tieringConfigs.set(r,n),n}enableObjectLock(e){let a=`object-lock-${Date.now()}-${this.counter++}`,r={id:a,bucketName:e.bucketName,mode:e.mode||"COMPLIANCE",retentionDays:e.retentionDays,retentionYears:e.retentionYears,legalHoldEnabled:e.legalHoldEnabled||!1};return this.objectLocks.set(a,r),r}enableTransferAcceleration(e){let a=`transfer-accel-${Date.now()}-${this.counter++}`,r={id:a,bucketName:e,enabled:!0,endpoint:`${e}.s3-accelerate.amazonaws.com`};return this.transferAcceleration.set(a,r),r}createAccessPoint(e){let a=`access-point-${Date.now()}-${this.counter++}`,r={id:a,name:e.name,bucketName:e.bucketName,vpcId:e.vpcId,publicAccessBlock:e.publicAccessBlock!==!1,policy:e.policy};return this.accessPoints.set(a,r),r}createGlacierArchive(e){let a=`glacier-${Date.now()}-${this.counter++}`,r={id:a,bucketName:e.bucketName,archiveType:e.archiveType,transitionDays:e.transitionDays,restoreConfig:e.restoreTier?{tier:e.restoreTier,days:e.restoreDays||7}:void 0};return this.glacierConfigs.set(a,r),r}createInventory(e){let a=`inventory-${Date.now()}-${this.counter++}`,r={id:a,sourceBucket:e.sourceBucket,destinationBucket:e.destinationBucket,schedule:e.schedule||"Daily",format:e.format||"CSV",includedFields:e.includedFields||["Size","LastModifiedDate","StorageClass","ETag"],prefix:e.prefix};return this.inventories.set(a,r),r}createBatchOperation(e){let a=`batch-op-${Date.now()}-${this.counter++}`,r={id:a,operation:e.operation,manifestBucket:e.manifestBucket,manifestKey:e.manifestKey,priority:e.priority||10,status:"pending"};return this.batchOps.set(a,r),r}executeBatchOperation(e){let a=this.batchOps.get(e);if(!a)throw Error(`Batch operation not found: ${e}`);return a.status="in_progress",a.totalObjects=1000,a.processedObjects=0,a}getBatchOperationStatus(e){return this.batchOps.get(e)}createLambdaNotification(e){let a=`event-${Date.now()}-${this.counter++}`,r={id:a,bucketName:e.bucketName,events:e.events,destination:{type:"Lambda",arn:e.lambdaArn},filter:e.prefix||e.suffix?{prefix:e.prefix,suffix:e.suffix}:void 0};return this.eventNotifications.set(a,r),r}createSQSNotification(e){let a=`event-${Date.now()}-${this.counter++}`,r={id:a,bucketName:e.bucketName,events:e.events,destination:{type:"SQS",arn:e.queueArn},filter:e.prefix||e.suffix?{prefix:e.prefix,suffix:e.suffix}:void 0};return this.eventNotifications.set(a,r),r}createSNSNotification(e){let a=`event-${Date.now()}-${this.counter++}`,r={id:a,bucketName:e.bucketName,events:e.events,destination:{type:"SNS",arn:e.topicArn},filter:e.prefix||e.suffix?{prefix:e.prefix,suffix:e.suffix}:void 0};return this.eventNotifications.set(a,r),r}generateObjectLockCF(e){let a={ObjectLockEnabled:"Enabled",ObjectLockConfiguration:{ObjectLockEnabled:"Enabled",Rule:{DefaultRetention:{Mode:e.mode}}}};if(e.retentionDays)a.ObjectLockConfiguration.Rule.DefaultRetention.Days=e.retentionDays;if(e.retentionYears)a.ObjectLockConfiguration.Rule.DefaultRetention.Years=e.retentionYears;return a}generateTransferAccelerationCF(e){return{AccelerateConfiguration:{AccelerationStatus:e.enabled?"Enabled":"Suspended"}}}generateAccessPointCF(e){return{Type:"AWS::S3::AccessPoint",Properties:{Name:e.name,Bucket:e.bucketName,...e.vpcId&&{VpcConfiguration:{VpcId:e.vpcId}},PublicAccessBlockConfiguration:e.publicAccessBlock?{BlockPublicAcls:!0,BlockPublicPolicy:!0,IgnorePublicAcls:!0,RestrictPublicBuckets:!0}:void 0,...e.policy&&{Policy:e.policy}}}}generateInventoryCF(e){return{Type:"AWS::S3::Bucket",Properties:{InventoryConfigurations:[{Id:e.id,Destination:{BucketArn:`arn:aws:s3:::${e.destinationBucket}`,Format:e.format},Enabled:!0,IncludedObjectVersions:"Current",OptionalFields:e.includedFields,ScheduleFrequency:e.schedule,...e.prefix&&{Prefix:e.prefix}}]}}}generateEventNotificationCF(e){let a=e.destination.type==="Lambda"?"LambdaConfigurations":e.destination.type==="SQS"?"QueueConfigurations":"TopicConfigurations",r=e.destination.type==="Lambda"?"Function":e.destination.type==="SQS"?"Queue":"Topic",n={Event:e.events[0],[r]:e.destination.arn};if(e.filter)n.Filter={S3Key:{Rules:[...e.filter.prefix?[{Name:"prefix",Value:e.filter.prefix}]:[],...e.filter.suffix?[{Name:"suffix",Value:e.filter.suffix}]:[]]}};return{NotificationConfiguration:{[a]:[n]}}}clear(){this.policies.clear(),this.versioningConfigs.clear(),this.replicationRules.clear(),this.tieringConfigs.clear(),this.objectLocks.clear(),this.transferAcceleration.clear(),this.accessPoints.clear(),this.glacierConfigs.clear(),this.inventories.clear(),this.batchOps.clear(),this.eventNotifications.clear()}}var Xf=new Gl;class Kl{checks=new Map;synthetics=new Map;uptimeTrackers=new Map;counter=0;createHealthCheck(e,a=30,r=10){let n=`health-${Date.now()}-${this.counter++}`,i={id:n,url:e,interval:a,timeout:r,status:"healthy"};return this.checks.set(n,i),i}createSyntheticMonitor(e,a,r,n){let i=`synthetic-${Date.now()}-${this.counter++}`,o={id:i,name:e,script:a,frequency:r,locations:n};return this.synthetics.set(i,o),o}trackUptime(e,a,r){let n=`uptime-${Date.now()}-${this.counter++}`,i=a/(a+r)*100,o={id:n,resource:e,uptime:a,downtime:r,availability:i};return this.uptimeTrackers.set(n,o),o}clear(){this.checks.clear(),this.synthetics.clear(),this.uptimeTrackers.clear()}}var Qf=new Kl;class Jl{wafRules=new Map;shieldProtections=new Map;securityGroups=new Map;nacls=new Map;counter=0;createWAFRule(e,a,r,n){let i=`waf-${Date.now()}-${this.counter++}`,o={id:i,name:e,priority:a,action:r,conditions:n};return this.wafRules.set(i,o),o}enableShield(e,a="standard"){let r=`shield-${Date.now()}-${this.counter++}`,n={id:r,resourceArn:e,protectionType:a};return this.shieldProtections.set(r,n),n}createSecurityGroup(e,a,r){let n=`sg-${Date.now()}-${this.counter++}`,i={id:n,name:e,vpcId:a,rules:r};return this.securityGroups.set(n,i),i}createNACL(e,a){let r=`nacl-${Date.now()}-${this.counter++}`,n={id:r,vpcId:e,rules:a};return this.nacls.set(r,n),n}clear(){this.wafRules.clear(),this.shieldProtections.clear(),this.securityGroups.clear(),this.nacls.clear()}}var Yf=new Jl;class Xl{strategies=new Map;allocations=new Map;groups=new Map;counter=0;createTaggingStrategy(e,a){let r=`tagging-${Date.now()}-${this.counter++}`,n={id:r,tags:e,resources:a};return this.strategies.set(r,n),n}createCostAllocation(e,a){let r=`cost-${Date.now()}-${this.counter++}`,n={id:r,tagKey:e,allocations:a};return this.allocations.set(r,n),n}createResourceGroup(e,a,r){let n=`group-${Date.now()}-${this.counter++}`,i={id:n,name:e,query:{resourceTypeFilters:a,tagFilters:r}};return this.groups.set(n,i),i}clear(){this.strategies.clear(),this.allocations.clear(),this.groups.clear()}}var Zf=new Xl;export{fc,ae,hc,Rd,yp,fi,Sp,bp,qs,vp,Tp,Ep,wp,Cp,Ap,Ip,yc,Sc,Ws,Gs,Co,et,A,Ks,bc,H,Rr,C,Pd,hi,Js,Xs,F,Ao,Rp,Pp,Np,Dp,l,s,kp,_p,E,Qs,Ys,Zs,xp,$p,De,ea,Io,Nd,Op,Lp,Ue,Et,ta,vc,Tc,Mp,Ec,wc,Cc,ra,Ac,jt,Ro,yi,Po,Si,Be,Dd,No,Do,na,ia,oa,sa,aa,ca,ve,j,S,O,tt,D,kd,wt,ge,Vt,Up,_d,Te,ko,Fe,zt,bi,Ee,_o,ke,xd,vi,we,Ce,re,Ti,X,Ht,Ct,Ae,t,xo,Bp,Ic,la,Fp,jp,Vp,zp,da,Hp,qp,Wp,Gp,Kp,Jp,Xp,Qp,Yp,Zp,em,tm,$d,Od,Ld,Md,Ud,Bd,Fd,qt,Rc,Pc,Pr,Ei,rm,Nc,nm,im,an,om,sm,am,cm,lm,dm,jd,Vd,zd,Hd,qd,$o,um,ua,Wd,Gd,Kd,Dc,Ie,pm,Jd,At,Oo,Nr,Xd,kc,Qd,Yd,Zd,_c,_e,mm,gm,fm,hm,eu,ym,Re,Sm,bm,vm,xc,$c,Tm,Oc,Lc,Em,wm,Cm,Am,Im,tu,pa,Rm,Pm,Nm,Dm,km,ru,nu,_m,xm,$m,Om,Lm,Mm,Um,Bm,Fm,Mc,ma,jm,Vm,zm,Hm,Uc,Bc,Fc,qm,jc,Wm,Gm,Km,Jm,Vc,Xm,Qm,Ym,Zm,eg,tg,rg,ng,iu,ou,su,au,zc,ig,og,sg,ag,cg,lg,dg,ug,pg,cu,lu,du,uu,mg,gg,Hc,fg,qc,Wc,Gc,Kc,hg,yg,Sg,bg,rt,wi,vg,Tg,Eg,wg,Cg,Ag,Ig,Rg,pu,Pg,Ng,Jc,Xc,Dg,kg,mu,_g,xg,$g,Og,Lg,Mg,Ug,Bg,Fg,jg,Vg,zg,Hg,qg,Wg,Gg,Kg,Jg,Xg,Qg,Yg,Qc,Zg,Yc,ef,Zc,tf,el,rf,tl,nf,cn,of,rl,sf,Lo,af,nl,cf,il,lf,ol,df,sl,uf,al,pf,ln,mf,cl,gf,ll,ff,dl,hf,ul,yf,pl,Sf,ml,bf,gl,vf,fl,Tf,hl,Ef,yl,wf,Sl,Cf,bl,Af,vl,If,Tl,Rf,El,Pf,wl,Nf,Cl,Df,Al,kf,Il,_f,Rl,xf,Pl,$f,Nl,Of,Dl,Lf,kl,Mf,_l,Uf,gu,fu,hu,yu,xl,Bf,$l,Ff,Ol,jf,Ll,Vf,Ci,Su,bu,Mo,ga,dn,vu,Uo,Wt,fa,ha,Tu,Eu,Ml,wu,ya,Ul,zf,Hf,Sa,ba,va,Bl,Bo,Fl,jl,Ta,Vl,zl,Hl,Cu,Au,Iu,qf,Ru,Pu,Wf,Nu,ql,Du,ku,_u,Gf,xu,Ai,Ea,$u,Kf,Ou,Fo,jo,wa,Wl,Jf,Gl,Xf,Kl,Qf,Jl,Yf,Xl,Zf};