@stacksjs/ts-cloud 0.16.83 → 0.16.85

package/dist/{chunk-q61qcpp4.js → chunk-3bvhthfb.js}

@@ -1,4 +1,4 @@
-import{k,na}from"./chunk-928z0h9b.js";import{An,st}from"./chunk-9pwvnh3f.js";var Nm={};An(Nm,{default:()=>Rr,handler:()=>At});var Bm={};An(Bm,{default:()=>Pr,handler:()=>Ct});var Ef={};An(Ef,{EmailAnalyticsModule:()=>Ye,EmailRules:()=>Ut,EmailScheduling:()=>Wt,EmailSearch:()=>Gt,EmailTemplates:()=>ke,EmailThreading:()=>_t,SharedMailboxes:()=>Vt});var vf={};An(vf,{default:()=>ki,handler:()=>xi});var Tf={};An(Tf,{CallAnalytics:()=>jt,CallRecording:()=>Ht,Callbacks:()=>mt,IVRBuilder:()=>Be});var wf={};An(wf,{AbTesting:()=>Ee,LinkTracking:()=>Jt,MmsSupport:()=>zt,SmsAnalytics:()=>qt,SmsCampaigns:()=>Kt,SmsChatbot:()=>Qt});var $I={backgroundJobs:{visibilityTimeout:120,messageRetentionPeriod:604800,deadLetterQueue:!0,maxReceiveCount:3,encrypted:!0},fifo:{fifo:!0,contentBasedDeduplication:!0,visibilityTimeout:30,encrypted:!0},highThroughput:{visibilityTimeout:30,receiveMessageWaitTime:20,encrypted:!0},delayed:{delaySeconds:60,visibilityTimeout:60,encrypted:!0},longRunning:{visibilityTimeout:900,messageRetentionPeriod:1209600,deadLetterQueue:!0,maxReceiveCount:2,encrypted:!0},monitored:{visibilityTimeout:60,messageRetentionPeriod:604800,deadLetterQueue:!0,maxReceiveCount:3,encrypted:!0,alarms:{enabled:!0,queueDepthThreshold:1000,messageAgeThreshold:3600,dlqAlarm:!0}},lambdaOptimized:{visibilityTimeout:360,receiveMessageWaitTime:20,deadLetterQueue:!0,maxReceiveCount:3,encrypted:!0},fanOut:{visibilityTimeout:30,receiveMessageWaitTime:20,encrypted:!0}},MI={serverless:{development:{enabled:!0,mode:"serverless",channels:{public:!0,private:!0,presence:!0},storage:{type:"dynamodb",dynamodb:{billingMode:"PAY_PER_REQUEST"}},scaling:{maxConnections:1000,handlerMemory:128}},production:{enabled:!0,mode:"serverless",channels:{public:!0,private:!0,presence:{enabled:!0,maxMembers:100,heartbeatInterval:30,inactivityTimeout:60}},storage:{type:"dynamodb",dynamodb:{billingMode:"PAY_PER_REQUEST",pointInTimeRecovery:!0,connectionTTL:86400}},scaling:{maxConnections:50000,messagesPerSecond:5000,handlerMemory:256,handlerTimeout:30},monitoring:{enabled:!0,connectionThreshold:40000,errorThreshold:100,latencyThreshold:500},keepAlive:!0,keepAliveInterval:30,idleTimeout:600},notifications:{enabled:!0,mode:"serverless",channels:{public:!1,private:!0,presence:!1},storage:{type:"dynamodb",dynamodb:{billingMode:"PAY_PER_REQUEST"}},scaling:{maxConnections:50000,messagesPerSecond:2000,handlerMemory:128},keepAlive:!0,keepAliveInterval:60,idleTimeout:1800}},server:{development:{enabled:!0,mode:"server",channels:{public:!0,private:!0,presence:!0},server:{host:"0.0.0.0",port:6001,scheme:"ws",driver:"bun",idleTimeout:120,perMessageDeflate:!1,metrics:!1}},production:{enabled:!0,mode:"server",channels:{public:!0,private:!0,presence:!0},server:{host:"0.0.0.0",port:6001,scheme:"wss",driver:"bun",idleTimeout:120,maxPayloadLength:16777216,backpressureLimit:1048576,sendPings:!0,perMessageDeflate:!0,instances:2,redis:{enabled:!0,keyPrefix:"broadcasting:"},rateLimit:{enabled:!0,max:100,window:60000,perChannel:!0,perUser:!0},loadManagement:{enabled:!0,maxConnections:1e4,maxSubscriptionsPerConnection:100,shedLoadThreshold:0.8},metrics:!0,autoScaling:{min:2,max:10,targetCPU:70}},monitoring:{enabled:!0,connectionThreshold:8000,errorThreshold:100}},highPerformance:{enabled:!0,mode:"server",channels:{public:!0,private:!0,presence:!0},server:{host:"0.0.0.0",port:6001,scheme:"wss",driver:"bun",idleTimeout:60,maxPayloadLength:8388608,backpressureLimit:2097152,closeOnBackpressureLimit:!0,sendPings:!0,perMessageDeflate:!0,instances:4,redis:{enabled:!0,useElastiCache:!0,keyPrefix:"rt:"},rateLimit:{enabled:!0,max:200,window:60000,perChannel:!0},loadManagement:{enabled:!0,maxConnections:25000,maxSubscriptionsPerConnection:50,shedLoadThreshold:0.7},metrics:{enabled:!0,path:"/metrics"},autoScaling:{min:4,max:20,targetCPU:60,targetConnections:20000}},monitoring:{enabled:!0,connectionThreshold:80000,errorThreshold:50,latencyThreshold:50}},chat:{enabled:!0,mode:"server",channels:{public:!0,private:!0,presence:{enabled:!0,maxMembers:200,heartbeatInterval:20,inactivityTimeout:60}},server:{host:"0.0.0.0",port:6001,scheme:"wss",driver:"bun",idleTimeout:300,maxPayloadLength:1048576,sendPings:!0,perMessageDeflate:!0,instances:2,redis:{enabled:!0,keyPrefix:"chat:"},rateLimit:{enabled:!0,max:60,window:60000,perChannel:!0},loadManagement:{enabled:!0,maxConnections:15000,maxSubscriptionsPerConnection:20},metrics:!0},keepAlive:!0,keepAliveInterval:25,idleTimeout:900},gaming:{enabled:!0,mode:"server",channels:{public:!0,private:!0,presence:{enabled:!0,maxMembers:100,heartbeatInterval:10,inactivityTimeout:30}},server:{host:"0.0.0.0",port:6001,scheme:"wss",driver:"bun",idleTimeout:30,maxPayloadLength:65536,backpressureLimit:524288,closeOnBackpressureLimit:!0,sendPings:!0,perMessageDeflate:!1,instances:4,redis:{enabled:!0,useElastiCache:!0},rateLimit:{enabled:!0,max:120,window:60000},loadManagement:{enabled:!0,maxConnections:5000,maxSubscriptionsPerConnection:10,shedLoadThreshold:0.6},metrics:!0,autoScaling:{min:4,max:16,targetCPU:50}},keepAlive:!0,keepAliveInterval:10,idleTimeout:60},single:{enabled:!0,mode:"server",channels:{public:!0,private:!0,presence:!0},server:{host:"0.0.0.0",port:6001,scheme:"wss",driver:"bun",idleTimeout:120,sendPings:!0,perMessageDeflate:!0,instances:1,rateLimit:{enabled:!0,max:100,window:60000},loadManagement:{enabled:!0,maxConnections:1e4},metrics:!0}}}};import{isAbsolute as bt,join as Xe,relative as ar}from"node:path";var rl=".ts-cloud",Sm="TS_CLOUD_STATE_DIR",St=null;function nl(n){St=n?.trim()||null}function il(){return Boolean(process.env[Sm]?.trim()||St)}function dn(){return process.env[Sm]?.trim()||St||rl}function Q(...n){return Xe(dn(),...n)}function l(n,...i){let s=dn();return bt(s)?Xe(s,...i):Xe(n,s,...i)}function sl(n,i=process.cwd()){let s=(c,u)=>{let d=ar(c,u);return d===""||!d.startsWith("..")&&!bt(d)},o=bt(n)?n:Xe(i,n);return s(l(i),o)}function Im(n){let i=n.infrastructure?.compute!=null,s=Object.values(n.environments??{}).some((o)=>o?.app!=null);return{server:i,serverless:s}}function K(n){if(n.mode==="server"||n.mode==="serverless")return n.mode;let{serverless:i}=Im(n);return i?"serverless":"server"}function ol(n){let{server:i,serverless:s}=Im(n);if(i&&s)return"A project cannot be both a server and a serverless deployment. Found `infrastructure.compute` (server) AND `environments.<env>.app` (serverless Lambda). Keep one: remove `infrastructure.compute` for a serverless app, or remove `environments.<env>.app` for a server.";if(n.mode==="server"&&s&&!i)return"Config sets `mode: 'server'` but declares a serverless app (`environments.<env>.app`). Remove the app or change the mode.";if(n.mode==="serverless"&&i&&!s)return"Config sets `mode: 'serverless'` but declares a server (`infrastructure.compute`). Remove the compute block or change the mode.";return null}function p(n){return n.infrastructure?.appDatabase??n.infrastructure?.compute?.database}function or(n){return typeof n==="object"&&n!==null?n:{}}function ry(n){return n===!0||typeof n==="object"&&n!==null}function cr(n,i){let s=i?n.environments?.[i]:void 0;if(s?.domain)return s.domain;let o=Object.values(n.sites??{}),c=n.sites?.main?.domain??o.find((u)=>u.domain)?.domain;if(c)return c;return`${n.project?.slug??"app"}.local`}function dr(n){let i=n.indexOf(".");return i>0?n.slice(i+1):void 0}function b(n,i={}){let s=n.infrastructure?.compute?.managedServices?.mail,o=or(s),c=i.environmentType??(i.environment?n.environments?.[i.environment]?.type:void 0),u=o.mode??(c==="production"?"server":"catcher"),d=u==="server",g=cr(n,i.environment),y=o.hostname??(d?`mail.${g}`:"localhost"),h=o.ports??{},A=d?{smtp:h.smtp??25,submission:h.submission??587,submissions:h.submissions??465,imap:h.imap??143,imaps:h.imaps??993,webmail:h.webmail??8080,managesieve:h.managesieve}:{smtp:h.smtp??1025,submission:h.submission,submissions:h.submissions,imap:h.imap,imaps:h.imaps,webmail:h.webmail??8025,managesieve:h.managesieve},C=o.tls??{},v=C.enabled??d,T=!!(C.systemCredentials||C.certPath&&C.keyPath);if(C.systemCredentials&&Object.values(C.systemCredentials).some((me)=>!/^\/[a-z0-9_./-]+$/i.test(me)||me.includes("/../")))throw Error("Mail system credentials require absolute certificate paths");let R=(o.accounts??[]).map((me)=>({address:me.address,password:me.password,passwordPolicy:me.passwordPolicy??"initial"})),P=typeof o.dkim==="object"&&o.dkim!==null?o.dkim:{},I=o.dkim===!1?!1:o.dkim===!0||d,M=typeof o.webmail==="object"&&o.webmail!==null?o.webmail:{},L=o.webmail===!1?!1:M.enabled??!0,N=y.includes(".")&&!y.endsWith(".local")&&!/^\d+\.\d+\.\d+\.\d+$/.test(y),O=M.domain===!1?void 0:M.domain??(d&&N?y:void 0),B=M.tls??(O?!1:v),F=[...new Set(M.aliases??[])].filter((me)=>me!==O),U=o.spam??{},j=o.delivery??(d?"direct":"none"),H=o.expose??d,z=dr(y),se=[...new Set([y,...z?[z]:[],...o.domains??[]])],Te=M.attachments?.maxFileBytes??20971520,oe=M.attachments?.maxTotalBytes??20971520,ge=M.attachments?.maxCount??20,ae=M.undoSendSeconds??10;for(let[me,Ie,Le]of[["maxFileBytes",Te,104857600],["maxTotalBytes",oe,104857600],["maxCount",ge,100],["undoSendSeconds",ae,30]])if(!Number.isInteger(Ie)||Ie<0||Ie>Le)throw Error(`Mail webmail ${me} must be an integer from 0 to ${Le}`);return{enabled:ry(s),mode:u,version:o.version,hostname:y,domains:se,ports:A,tls:{enabled:v,acme:v&&!T&&(C.acme??!0),certPath:C.systemCredentials?"/run/credentials/mail.service/server.crt":C.certPath,keyPath:C.systemCredentials?"/run/credentials/mail.service/server.key":C.keyPath,systemCredentials:C.systemCredentials,requireForAuth:C.requireForAuth??(v&&d),acmeEmail:C.acmeEmail??R[0]?.address},dkim:{enabled:I,selector:P.selector??"default",rotate:P.rotate??!1,rotateIntervalDays:P.rotateIntervalDays??90},webmail:{enabled:L,port:M.port??A.webmail,domain:O,aliases:F,tls:B,secureCookies:M.secureCookies??(!!O||B),attachmentMaxFileBytes:Te,attachmentMaxTotalBytes:oe,attachmentMaxCount:ge,undoSendSeconds:ae},delivery:j,sesRegion:o.sesRegion??"us-east-1",accounts:R,storagePath:o.storagePath??"/var/lib/mail",maxMessageSize:o.maxMessageSize??26214400,spam:{enabled:U.enabled??d,enforce:U.enforce??!1,junkScore:U.junkScore??5,rejectScore:U.rejectScore??12,dnsbl:U.dnsbl??d,dnsblReject:U.dnsblReject??!1,greylist:U.greylist??!1},webhookUrl:o.webhookUrl,expose:H,bindAddress:H?"0.0.0.0":"127.0.0.1"}}function Ze(n){if(!n.enabled||!n.expose)return[];let i=[n.ports.smtp,n.ports.submission,n.ports.submissions,n.ports.imap,n.ports.imaps,n.ports.managesieve].filter((s)=>typeof s==="number");if(n.webmail.enabled&&!n.webmail.domain)i.push(n.webmail.port);return[...new Set(i)].sort((s,o)=>s-o)}function Ji(n){if(!n.enabled)return{};let i=n.ports.submission??n.ports.smtp,s={MAIL_MAILER:"smtp",MAIL_HOST:"127.0.0.1",MAIL_PORT:String(i)};if(n.mode==="server"){s.MAIL_ENCRYPTION=n.tls.enabled?"tls":"null";let o=n.accounts[0];if(o)s.MAIL_USERNAME=o.address,s.MAIL_PASSWORD=o.password}else s.MAIL_ENCRYPTION="null",s.MAIL_USERNAME="null",s.MAIL_PASSWORD="null";return s}function ln(n){if(!n.enabled||!n.webmail.enabled||!n.webmail.domain)return{};let i=[n.webmail.domain,...n.webmail.aliases];if(!Number.isInteger(n.webmail.port)||n.webmail.port<1||n.webmail.port>65535)throw Error("Mail webmail port must be between 1 and 65535");return Object.fromEntries(i.map((s,o)=>{if(!/^(?:[a-z0-9](?:[a-z0-9-]{0,61}[a-z0-9])?\.)+[a-z0-9](?:[a-z0-9-]{0,61}[a-z0-9])?$/i.test(s))throw Error(`Invalid mail webmail hostname: ${s}`);return[`__mail_webmail_${o}`,{domain:s,proxyTo:`localhost:${n.webmail.port}`}]}))}function w(n,i={}){let s=n.infrastructure?.compute?.proxy,o=b(n,i);if(!o.enabled||!o.webmail.enabled||!o.webmail.domain)return s;return{engine:"rpx",onDemandTls:!0,onDemandTlsEmail:o.tls.acmeEmail??`webmaster@${o.webmail.domain}`,...s}}function ce(n){if(n.cloud?.provider)return n.cloud.provider;if(n.ssh?.hosts?.length)return"ssh";if(n.hetzner?.apiToken)return"hetzner";return"aws"}class al{template;constructor(n){this.template={AWSTemplateFormatVersion:"2010-09-09",Description:n,Resources:{}}}addResource(n,i){return this.template.Resources[n]=i,this}addResources(n){return Object.assign(this.template.Resources,n),this}addParameter(n,i){if(!this.template.Parameters)this.template.Parameters={};return this.template.Parameters[n]=i,this}addOutput(n,i){if(!this.template.Outputs)this.template.Outputs={};return this.template.Outputs[n]=i,this}addMetadata(n,i){if(!this.template.Metadata)this.template.Metadata={};return this.template.Metadata[n]=i,this}hasResource(n){return n in this.template.Resources}getResources(){return this.template.Resources}build(){return this.template}toJSON(n=!0){return JSON.stringify(this.template,null,n?2:0)}toYAML(){return this.convertToYAML(this.template)}convertToYAML(n,i=0){let s="  ".repeat(i),o="";for(let[c,u]of Object.entries(n)){if(u===null||u===void 0)continue;if(typeof u==="object"&&!Array.isArray(u))o+=`${s}${c}:
+import{k,na}from"./chunk-928z0h9b.js";import{An,st}from"./chunk-9pwvnh3f.js";var Nm={};An(Nm,{default:()=>Rr,handler:()=>At});var Bm={};An(Bm,{default:()=>Pr,handler:()=>Ct});var Ef={};An(Ef,{EmailAnalyticsModule:()=>Ye,EmailRules:()=>Ut,EmailScheduling:()=>Wt,EmailSearch:()=>Gt,EmailTemplates:()=>ke,EmailThreading:()=>_t,SharedMailboxes:()=>Vt});var vf={};An(vf,{default:()=>ki,handler:()=>xi});var Tf={};An(Tf,{CallAnalytics:()=>jt,CallRecording:()=>Ht,Callbacks:()=>mt,IVRBuilder:()=>Be});var wf={};An(wf,{AbTesting:()=>Pe,LinkTracking:()=>Jt,MmsSupport:()=>zt,SmsAnalytics:()=>qt,SmsCampaigns:()=>Kt,SmsChatbot:()=>Qt});var $I={backgroundJobs:{visibilityTimeout:120,messageRetentionPeriod:604800,deadLetterQueue:!0,maxReceiveCount:3,encrypted:!0},fifo:{fifo:!0,contentBasedDeduplication:!0,visibilityTimeout:30,encrypted:!0},highThroughput:{visibilityTimeout:30,receiveMessageWaitTime:20,encrypted:!0},delayed:{delaySeconds:60,visibilityTimeout:60,encrypted:!0},longRunning:{visibilityTimeout:900,messageRetentionPeriod:1209600,deadLetterQueue:!0,maxReceiveCount:2,encrypted:!0},monitored:{visibilityTimeout:60,messageRetentionPeriod:604800,deadLetterQueue:!0,maxReceiveCount:3,encrypted:!0,alarms:{enabled:!0,queueDepthThreshold:1000,messageAgeThreshold:3600,dlqAlarm:!0}},lambdaOptimized:{visibilityTimeout:360,receiveMessageWaitTime:20,deadLetterQueue:!0,maxReceiveCount:3,encrypted:!0},fanOut:{visibilityTimeout:30,receiveMessageWaitTime:20,encrypted:!0}},MI={serverless:{development:{enabled:!0,mode:"serverless",channels:{public:!0,private:!0,presence:!0},storage:{type:"dynamodb",dynamodb:{billingMode:"PAY_PER_REQUEST"}},scaling:{maxConnections:1000,handlerMemory:128}},production:{enabled:!0,mode:"serverless",channels:{public:!0,private:!0,presence:{enabled:!0,maxMembers:100,heartbeatInterval:30,inactivityTimeout:60}},storage:{type:"dynamodb",dynamodb:{billingMode:"PAY_PER_REQUEST",pointInTimeRecovery:!0,connectionTTL:86400}},scaling:{maxConnections:50000,messagesPerSecond:5000,handlerMemory:256,handlerTimeout:30},monitoring:{enabled:!0,connectionThreshold:40000,errorThreshold:100,latencyThreshold:500},keepAlive:!0,keepAliveInterval:30,idleTimeout:600},notifications:{enabled:!0,mode:"serverless",channels:{public:!1,private:!0,presence:!1},storage:{type:"dynamodb",dynamodb:{billingMode:"PAY_PER_REQUEST"}},scaling:{maxConnections:50000,messagesPerSecond:2000,handlerMemory:128},keepAlive:!0,keepAliveInterval:60,idleTimeout:1800}},server:{development:{enabled:!0,mode:"server",channels:{public:!0,private:!0,presence:!0},server:{host:"0.0.0.0",port:6001,scheme:"ws",driver:"bun",idleTimeout:120,perMessageDeflate:!1,metrics:!1}},production:{enabled:!0,mode:"server",channels:{public:!0,private:!0,presence:!0},server:{host:"0.0.0.0",port:6001,scheme:"wss",driver:"bun",idleTimeout:120,maxPayloadLength:16777216,backpressureLimit:1048576,sendPings:!0,perMessageDeflate:!0,instances:2,redis:{enabled:!0,keyPrefix:"broadcasting:"},rateLimit:{enabled:!0,max:100,window:60000,perChannel:!0,perUser:!0},loadManagement:{enabled:!0,maxConnections:1e4,maxSubscriptionsPerConnection:100,shedLoadThreshold:0.8},metrics:!0,autoScaling:{min:2,max:10,targetCPU:70}},monitoring:{enabled:!0,connectionThreshold:8000,errorThreshold:100}},highPerformance:{enabled:!0,mode:"server",channels:{public:!0,private:!0,presence:!0},server:{host:"0.0.0.0",port:6001,scheme:"wss",driver:"bun",idleTimeout:60,maxPayloadLength:8388608,backpressureLimit:2097152,closeOnBackpressureLimit:!0,sendPings:!0,perMessageDeflate:!0,instances:4,redis:{enabled:!0,useElastiCache:!0,keyPrefix:"rt:"},rateLimit:{enabled:!0,max:200,window:60000,perChannel:!0},loadManagement:{enabled:!0,maxConnections:25000,maxSubscriptionsPerConnection:50,shedLoadThreshold:0.7},metrics:{enabled:!0,path:"/metrics"},autoScaling:{min:4,max:20,targetCPU:60,targetConnections:20000}},monitoring:{enabled:!0,connectionThreshold:80000,errorThreshold:50,latencyThreshold:50}},chat:{enabled:!0,mode:"server",channels:{public:!0,private:!0,presence:{enabled:!0,maxMembers:200,heartbeatInterval:20,inactivityTimeout:60}},server:{host:"0.0.0.0",port:6001,scheme:"wss",driver:"bun",idleTimeout:300,maxPayloadLength:1048576,sendPings:!0,perMessageDeflate:!0,instances:2,redis:{enabled:!0,keyPrefix:"chat:"},rateLimit:{enabled:!0,max:60,window:60000,perChannel:!0},loadManagement:{enabled:!0,maxConnections:15000,maxSubscriptionsPerConnection:20},metrics:!0},keepAlive:!0,keepAliveInterval:25,idleTimeout:900},gaming:{enabled:!0,mode:"server",channels:{public:!0,private:!0,presence:{enabled:!0,maxMembers:100,heartbeatInterval:10,inactivityTimeout:30}},server:{host:"0.0.0.0",port:6001,scheme:"wss",driver:"bun",idleTimeout:30,maxPayloadLength:65536,backpressureLimit:524288,closeOnBackpressureLimit:!0,sendPings:!0,perMessageDeflate:!1,instances:4,redis:{enabled:!0,useElastiCache:!0},rateLimit:{enabled:!0,max:120,window:60000},loadManagement:{enabled:!0,maxConnections:5000,maxSubscriptionsPerConnection:10,shedLoadThreshold:0.6},metrics:!0,autoScaling:{min:4,max:16,targetCPU:50}},keepAlive:!0,keepAliveInterval:10,idleTimeout:60},single:{enabled:!0,mode:"server",channels:{public:!0,private:!0,presence:!0},server:{host:"0.0.0.0",port:6001,scheme:"wss",driver:"bun",idleTimeout:120,sendPings:!0,perMessageDeflate:!0,instances:1,rateLimit:{enabled:!0,max:100,window:60000},loadManagement:{enabled:!0,maxConnections:1e4},metrics:!0}}}};import{isAbsolute as bt,join as Xe,relative as ar}from"node:path";var rl=".ts-cloud",Sm="TS_CLOUD_STATE_DIR",St=null;function nl(n){St=n?.trim()||null}function il(){return Boolean(process.env[Sm]?.trim()||St)}function dn(){return process.env[Sm]?.trim()||St||rl}function Q(...n){return Xe(dn(),...n)}function l(n,...i){let s=dn();return bt(s)?Xe(s,...i):Xe(n,s,...i)}function sl(n,i=process.cwd()){let s=(c,u)=>{let d=ar(c,u);return d===""||!d.startsWith("..")&&!bt(d)},o=bt(n)?n:Xe(i,n);return s(l(i),o)}function Im(n){let i=n.infrastructure?.compute!=null,s=Object.values(n.environments??{}).some((o)=>o?.app!=null);return{server:i,serverless:s}}function K(n){if(n.mode==="server"||n.mode==="serverless")return n.mode;let{serverless:i}=Im(n);return i?"serverless":"server"}function ol(n){let{server:i,serverless:s}=Im(n);if(i&&s)return"A project cannot be both a server and a serverless deployment. Found `infrastructure.compute` (server) AND `environments.<env>.app` (serverless Lambda). Keep one: remove `infrastructure.compute` for a serverless app, or remove `environments.<env>.app` for a server.";if(n.mode==="server"&&s&&!i)return"Config sets `mode: 'server'` but declares a serverless app (`environments.<env>.app`). Remove the app or change the mode.";if(n.mode==="serverless"&&i&&!s)return"Config sets `mode: 'serverless'` but declares a server (`infrastructure.compute`). Remove the compute block or change the mode.";return null}function p(n){return n.infrastructure?.appDatabase??n.infrastructure?.compute?.database}function or(n){return typeof n==="object"&&n!==null?n:{}}function ry(n){return n===!0||typeof n==="object"&&n!==null}function cr(n,i){let s=i?n.environments?.[i]:void 0;if(s?.domain)return s.domain;let o=Object.values(n.sites??{}),c=n.sites?.main?.domain??o.find((u)=>u.domain)?.domain;if(c)return c;return`${n.project?.slug??"app"}.local`}function dr(n){let i=n.indexOf(".");return i>0?n.slice(i+1):void 0}function b(n,i={}){let s=n.infrastructure?.compute?.managedServices?.mail,o=or(s),c=i.environmentType??(i.environment?n.environments?.[i.environment]?.type:void 0),u=o.mode??(c==="production"?"server":"catcher"),d=u==="server",g=cr(n,i.environment),y=o.hostname??(d?`mail.${g}`:"localhost"),h=o.ports??{},A=d?{smtp:h.smtp??25,submission:h.submission??587,submissions:h.submissions??465,imap:h.imap??143,imaps:h.imaps??993,webmail:h.webmail??8080,managesieve:h.managesieve}:{smtp:h.smtp??1025,submission:h.submission,submissions:h.submissions,imap:h.imap,imaps:h.imaps,webmail:h.webmail??8025,managesieve:h.managesieve},C=o.tls??{},v=C.enabled??d,T=!!(C.systemCredentials||C.certPath&&C.keyPath);if(C.systemCredentials&&Object.values(C.systemCredentials).some((ce)=>!/^\/[a-z0-9_./-]+$/i.test(ce)||ce.includes("/../")))throw Error("Mail system credentials require absolute certificate paths");let R=(o.accounts??[]).map((ce)=>({address:ce.address,password:ce.password,passwordPolicy:ce.passwordPolicy??"initial"})),P=typeof o.dkim==="object"&&o.dkim!==null?o.dkim:{},I=o.dkim===!1?!1:o.dkim===!0||d,M=typeof o.webmail==="object"&&o.webmail!==null?o.webmail:{},L=o.webmail===!1?!1:M.enabled??!0,N=y.includes(".")&&!y.endsWith(".local")&&!/^\d+\.\d+\.\d+\.\d+$/.test(y),O=M.domain===!1?void 0:M.domain??(d&&N?y:void 0),B=M.tls??(O?!1:v),F=[...new Set(M.aliases??[])].filter((ce)=>ce!==O),U=o.spam??{},j=o.delivery??(d?"direct":"none"),H=o.expose??d,z=dr(y),se=[...new Set([y,...z?[z]:[],...o.domains??[]])],ve=M.attachments?.maxFileBytes??20971520,oe=M.attachments?.maxTotalBytes??20971520,pe=M.attachments?.maxCount??20,ae=M.undoSendSeconds??10;for(let[ce,Ie,Le]of[["maxFileBytes",ve,104857600],["maxTotalBytes",oe,104857600],["maxCount",pe,100],["undoSendSeconds",ae,30]])if(!Number.isInteger(Ie)||Ie<0||Ie>Le)throw Error(`Mail webmail ${ce} must be an integer from 0 to ${Le}`);return{enabled:ry(s),mode:u,version:o.version,hostname:y,domains:se,ports:A,tls:{enabled:v,acme:v&&!T&&(C.acme??!0),certPath:C.systemCredentials?"/run/credentials/mail.service/server.crt":C.certPath,keyPath:C.systemCredentials?"/run/credentials/mail.service/server.key":C.keyPath,systemCredentials:C.systemCredentials,requireForAuth:C.requireForAuth??(v&&d),acmeEmail:C.acmeEmail??R[0]?.address},dkim:{enabled:I,selector:P.selector??"default",rotate:P.rotate??!1,rotateIntervalDays:P.rotateIntervalDays??90},webmail:{enabled:L,port:M.port??A.webmail,domain:O,aliases:F,tls:B,secureCookies:M.secureCookies??(!!O||B),attachmentMaxFileBytes:ve,attachmentMaxTotalBytes:oe,attachmentMaxCount:pe,undoSendSeconds:ae},delivery:j,sesRegion:o.sesRegion??"us-east-1",accounts:R,storagePath:o.storagePath??"/var/lib/mail",maxMessageSize:o.maxMessageSize??26214400,spam:{enabled:U.enabled??d,enforce:U.enforce??!1,junkScore:U.junkScore??5,rejectScore:U.rejectScore??12,dnsbl:U.dnsbl??d,dnsblReject:U.dnsblReject??!1,greylist:U.greylist??!1},webhookUrl:o.webhookUrl,expose:H,bindAddress:H?"0.0.0.0":"127.0.0.1"}}function Ze(n){if(!n.enabled||!n.expose)return[];let i=[n.ports.smtp,n.ports.submission,n.ports.submissions,n.ports.imap,n.ports.imaps,n.ports.managesieve].filter((s)=>typeof s==="number");if(n.webmail.enabled&&!n.webmail.domain)i.push(n.webmail.port);return[...new Set(i)].sort((s,o)=>s-o)}function Ji(n){if(!n.enabled)return{};let i=n.ports.submission??n.ports.smtp,s={MAIL_MAILER:"smtp",MAIL_HOST:"127.0.0.1",MAIL_PORT:String(i)};if(n.mode==="server"){s.MAIL_ENCRYPTION=n.tls.enabled?"tls":"null";let o=n.accounts[0];if(o)s.MAIL_USERNAME=o.address,s.MAIL_PASSWORD=o.password}else s.MAIL_ENCRYPTION="null",s.MAIL_USERNAME="null",s.MAIL_PASSWORD="null";return s}function ln(n){if(!n.enabled||!n.webmail.enabled||!n.webmail.domain)return{};let i=[n.webmail.domain,...n.webmail.aliases];if(!Number.isInteger(n.webmail.port)||n.webmail.port<1||n.webmail.port>65535)throw Error("Mail webmail port must be between 1 and 65535");return Object.fromEntries(i.map((s,o)=>{if(!/^(?:[a-z0-9](?:[a-z0-9-]{0,61}[a-z0-9])?\.)+[a-z0-9](?:[a-z0-9-]{0,61}[a-z0-9])?$/i.test(s))throw Error(`Invalid mail webmail hostname: ${s}`);return[`__mail_webmail_${o}`,{domain:s,proxyTo:`localhost:${n.webmail.port}`}]}))}function w(n,i={}){let s=n.infrastructure?.compute?.proxy,o=b(n,i);if(!o.enabled||!o.webmail.enabled||!o.webmail.domain)return s;return{engine:"rpx",onDemandTls:!0,onDemandTlsEmail:o.tls.acmeEmail??`webmaster@${o.webmail.domain}`,...s}}function de(n){if(n.cloud?.provider)return n.cloud.provider;if(n.ssh?.hosts?.length)return"ssh";if(n.hetzner?.apiToken)return"hetzner";return"aws"}class al{template;constructor(n){this.template={AWSTemplateFormatVersion:"2010-09-09",Description:n,Resources:{}}}addResource(n,i){return this.template.Resources[n]=i,this}addResources(n){return Object.assign(this.template.Resources,n),this}addParameter(n,i){if(!this.template.Parameters)this.template.Parameters={};return this.template.Parameters[n]=i,this}addOutput(n,i){if(!this.template.Outputs)this.template.Outputs={};return this.template.Outputs[n]=i,this}addMetadata(n,i){if(!this.template.Metadata)this.template.Metadata={};return this.template.Metadata[n]=i,this}hasResource(n){return n in this.template.Resources}getResources(){return this.template.Resources}build(){return this.template}toJSON(n=!0){return JSON.stringify(this.template,null,n?2:0)}toYAML(){return this.convertToYAML(this.template)}convertToYAML(n,i=0){let s="  ".repeat(i),o="";for(let[c,u]of Object.entries(n)){if(u===null||u===void 0)continue;if(typeof u==="object"&&!Array.isArray(u))o+=`${s}${c}:
 ${this.convertToYAML(u,i+1)}`;else if(Array.isArray(u)){o+=`${s}${c}:
 `;for(let d of u)if(typeof d==="object")o+=`${s}  -
 ${this.convertToYAML(d,i+2)}`;else o+=`${s}  - ${d}
@@ -8,7 +8,7 @@ ${this.convertToYAML(d,i+2)}`;else o+=`${s}  - ${d}
 `),i.join(`
 `);if(i.push(`Total changes: ${n.summary.totalChanges}`),i.push(`Requires replacement: ${n.summary.requiresReplacement?"Yes":"No"}
 `),n.summary.dangerousChanges.length>0){i.push("⚠️  DANGEROUS CHANGES DETECTED:");for(let s of n.summary.dangerousChanges)i.push(`  • ${s}`);i.push("")}if(n.added.length>0){i.push(`✅ Resources to Add (${n.added.length}):`);for(let s of n.added)i.push(`  + ${s.logicalId} (${s.resourceType})`);i.push("")}if(n.removed.length>0){i.push(`❌ Resources to Remove (${n.removed.length}):`);for(let s of n.removed)i.push(`  - ${s.logicalId} (${s.resourceType})`);i.push("")}if(n.replaced.length>0){i.push(`\uD83D\uDD04 Resources to Replace (${n.replaced.length}):`);for(let s of n.replaced){if(i.push(`  ~ ${s.logicalId} (${s.resourceType})`),s.reason)i.push(`    Reason: ${s.reason}`);if(s.changes){for(let o of s.changes.slice(0,3))i.push(`    • ${o.path}: ${JSON.stringify(o.oldValue)} → ${JSON.stringify(o.newValue)}`);if(s.changes.length>3)i.push(`    ... and ${s.changes.length-3} more changes`)}}i.push("")}if(n.updated.length>0){i.push(`\uD83D\uDCDD Resources to Update (${n.updated.length}):`);for(let s of n.updated)if(i.push(`  ~ ${s.logicalId} (${s.resourceType})`),s.changes){for(let o of s.changes.slice(0,3))i.push(`    • ${o.path}: ${JSON.stringify(o.oldValue)} → ${JSON.stringify(o.newValue)}`);if(s.changes.length>3)i.push(`    ... and ${s.changes.length-3} more changes`)}i.push("")}if(n.unchanged.length>0)i.push(`⚪ Unchanged Resources (${n.unchanged.length})`);return i.join(`
-`)}import{existsSync as He,readdirSync as Sr}from"node:fs";import{join as Pe}from"node:path";class xe{static createBucket(n){let{name:i,bucketName:s,slug:o,environment:c,public:u=!1,versioning:d=!1,website:g=!1,encryption:y=!0,intelligentTiering:h=!1,cors:A,lifecycleRules:C}=n,v=s??r({slug:o,environment:c,resourceType:"s3",suffix:i}),T=t(v),R={Type:"AWS::S3::Bucket",Properties:{BucketName:v}};if(y)R.Properties.BucketEncryption={ServerSideEncryptionConfiguration:[{ServerSideEncryptionByDefault:{SSEAlgorithm:"AES256"}}]};if(d)R.Properties.VersioningConfiguration={Status:"Enabled"};if(g)R.Properties.WebsiteConfiguration={IndexDocument:"index.html",ErrorDocument:"error.html"};if(!u)R.Properties.PublicAccessBlockConfiguration={BlockPublicAcls:!0,BlockPublicPolicy:!0,IgnorePublicAcls:!0,RestrictPublicBuckets:!0};if(A&&A.length>0)R.Properties.CorsConfiguration={CorsRules:A.map((I)=>({AllowedOrigins:I.allowedOrigins,AllowedMethods:I.allowedMethods,AllowedHeaders:I.allowedHeaders,MaxAge:I.maxAge}))};if(C&&C.length>0)R.Properties.LifecycleConfiguration={Rules:C.map((I)=>({Id:I.id,Status:I.enabled?"Enabled":"Disabled",ExpirationInDays:I.expirationDays,Transitions:I.transitions?.map((M)=>({TransitionInDays:M.days,StorageClass:M.storageClass}))}))};if(h&&C){let I={id:"IntelligentTieringRule",enabled:!0,transitions:[{days:0,storageClass:"INTELLIGENT_TIERING"}]};if(!R.Properties.LifecycleConfiguration)R.Properties.LifecycleConfiguration={Rules:[]};R.Properties.LifecycleConfiguration.Rules.push({Id:I.id,Status:"Enabled",Transitions:I.transitions?.map((M)=>({TransitionInDays:M.days,StorageClass:M.storageClass}))})}let P;if(u)P={Type:"AWS::S3::BucketPolicy",Properties:{Bucket:x.Ref(T),PolicyDocument:{Version:"2012-10-17",Statement:[{Sid:"PublicReadGetObject",Effect:"Allow",Principal:"*",Action:["s3:GetObject"],Resource:[x.Join("",[x.GetAtt(T,"Arn"),"/*"])]}]}}};return{bucket:R,bucketPolicy:P,logicalId:T}}static enableVersioning(n){if(!n.Properties)n.Properties={};return n.Properties.VersioningConfiguration={Status:"Enabled"},n}static enableWebsiteHosting(n,i="index.html",s="error.html"){if(!n.Properties)n.Properties={};return n.Properties.WebsiteConfiguration={IndexDocument:i,ErrorDocument:s},n}static setLifecycleRules(n,i){if(!n.Properties)n.Properties={};return n.Properties.LifecycleConfiguration={Rules:i.map((s)=>({Id:s.id,Status:s.enabled?"Enabled":"Disabled",ExpirationInDays:s.expirationDays,Transitions:s.transitions?.map((o)=>({TransitionInDays:o.days,StorageClass:o.storageClass}))}))},n}static enableIntelligentTiering(n){if(!n.Properties)n.Properties={};if(!n.Properties.LifecycleConfiguration)n.Properties.LifecycleConfiguration={Rules:[]};return n.Properties.LifecycleConfiguration.Rules.push({Id:"IntelligentTieringRule",Status:"Enabled",Transitions:[{TransitionInDays:0,StorageClass:"INTELLIGENT_TIERING"}]}),n}static addLambdaNotification(n,i){if(!n.Properties)n.Properties={};if(!n.Properties.NotificationConfiguration)n.Properties.NotificationConfiguration={};if(!n.Properties.NotificationConfiguration.LambdaConfigurations)n.Properties.NotificationConfiguration.LambdaConfigurations=[];let s={Event:i.events[0],Function:i.functionArn};if(i.filter)s.Filter={S3Key:{Rules:[...i.filter.prefix?[{Name:"prefix",Value:i.filter.prefix}]:[],...i.filter.suffix?[{Name:"suffix",Value:i.filter.suffix}]:[]]}};for(let o of i.events){let c={...s,Event:o};n.Properties.NotificationConfiguration.LambdaConfigurations.push(c)}return n}static Notifications={onObjectCreated:(n)=>({functionArn:n,events:["s3:ObjectCreated:*"]}),onObjectRemoved:(n)=>({functionArn:n,events:["s3:ObjectRemoved:*"]}),onImageUpload:(n,i)=>({functionArn:n,events:["s3:ObjectCreated:*"],filter:{prefix:i,suffix:".jpg"}}),onFileType:(n,i,s)=>({functionArn:n,events:["s3:ObjectCreated:*"],filter:{prefix:s,suffix:i}}),onFolderUpload:(n,i)=>({functionArn:n,events:["s3:ObjectCreated:*"],filter:{prefix:i.endsWith("/")?i:`${i}/`}})};static createBackupPlan(n){let{name:i,slug:s,environment:o,bucketLogicalIds:c,retentionDays:u,schedule:d="cron(0 5 * * ? *)",vaultName:g,enableContinuousBackup:y=!1,moveToColdStorageAfterDays:h}=n,A=g||r({slug:s,environment:o,resourceType:"backup-vault",suffix:i}),C=t(A),v={Type:"AWS::Backup::BackupVault",Properties:{BackupVaultName:A}},T=r({slug:s,environment:o,resourceType:"backup-role",suffix:i}),R=t(T),P={Type:"AWS::IAM::Role",Properties:{RoleName:T,AssumeRolePolicyDocument:{Version:"2012-10-17",Statement:[{Effect:"Allow",Principal:{Service:"backup.amazonaws.com"},Action:"sts:AssumeRole"}]},ManagedPolicyArns:["arn:aws:iam::aws:policy/service-role/AWSBackupServiceRolePolicyForBackup","arn:aws:iam::aws:policy/service-role/AWSBackupServiceRolePolicyForRestores"]}},I=r({slug:s,environment:o,resourceType:"backup-plan",suffix:i}),M=t(I),L={DeleteAfterDays:u};if(h&&h<u)L.MoveToColdStorageAfterDays=h;let N={Type:"AWS::Backup::BackupPlan",Properties:{BackupPlan:{BackupPlanName:I,BackupPlanRule:[{RuleName:`${i}-daily-backup`,TargetBackupVault:x.Ref(C),ScheduleExpression:d,StartWindowMinutes:60,CompletionWindowMinutes:120,Lifecycle:L,EnableContinuousBackup:y}]}}},O=r({slug:s,environment:o,resourceType:"backup-selection",suffix:i}),B=t(O),F=c.map((j)=>x.GetAtt(j,"Arn")),U={Type:"AWS::Backup::BackupSelection",Properties:{BackupPlanId:x.Ref(M),BackupSelection:{SelectionName:O,IamRoleArn:x.GetAtt(R,"Arn"),Resources:F}}};return{vault:v,plan:N,selection:U,role:P,vaultLogicalId:C,planLogicalId:M,selectionLogicalId:B,roleLogicalId:R}}static BackupSchedules={HOURLY:"cron(0 * * * ? *)",DAILY_5AM:"cron(0 5 * * ? *)",DAILY_MIDNIGHT:"cron(0 0 * * ? *)",WEEKLY_SUNDAY:"cron(0 5 ? * SUN *)",WEEKLY_SATURDAY:"cron(0 5 ? * SAT *)",MONTHLY_FIRST:"cron(0 5 1 * ? *)",EVERY_12_HOURS:"cron(0 */12 * * ? *)",EVERY_6_HOURS:"cron(0 */6 * * ? *)"};static BackupRetention={ONE_DAY:1,ONE_WEEK:7,TWO_WEEKS:14,ONE_MONTH:30,THREE_MONTHS:90,SIX_MONTHS:180,ONE_YEAR:365,TWO_YEARS:730,FIVE_YEARS:1825,SEVEN_YEARS:2555};static createWwwRedirectBucket(n){let{slug:i,environment:s,sourceDomain:o,targetDomain:c,protocol:u="https"}=n,d=r({slug:i,environment:s,resourceType:"s3",suffix:"www-redirect"}),g=t(d),y={Type:"AWS::S3::Bucket",Properties:{BucketName:o,WebsiteConfiguration:{RedirectAllRequestsTo:{HostName:c,Protocol:u}},PublicAccessBlockConfiguration:{BlockPublicAcls:!1,BlockPublicPolicy:!1,IgnorePublicAcls:!1,RestrictPublicBuckets:!1}}},h={Type:"AWS::S3::BucketPolicy",Properties:{Bucket:x.Ref(g),PolicyDocument:{Version:"2012-10-17",Statement:[{Sid:"PublicReadForRedirect",Effect:"Allow",Principal:"*",Action:["s3:GetObject"],Resource:[x.Join("",[x.GetAtt(g,"Arn"),"/*"])]}]}}};return{bucket:y,bucketPolicy:h,logicalId:g}}static createDocsBucket(n){let{slug:i,environment:s,domain:o}=n,c=o||r({slug:i,environment:s,resourceType:"s3",suffix:"docs"}),u=t(c);return{bucket:{Type:"AWS::S3::Bucket",Properties:{BucketName:c,BucketEncryption:{ServerSideEncryptionConfiguration:[{ServerSideEncryptionByDefault:{SSEAlgorithm:"AES256"}}]},PublicAccessBlockConfiguration:{BlockPublicAcls:!0,BlockPublicPolicy:!0,IgnorePublicAcls:!0,RestrictPublicBuckets:!0},Tags:[{Key:"backup",Value:"weekly"}]}},logicalId:u}}static createEmailBucket(n){let{slug:i,environment:s}=n,o=r({slug:i,environment:s,resourceType:"s3",suffix:"email"}),c=t(o),u={Type:"AWS::S3::Bucket",Properties:{BucketName:o,BucketEncryption:{ServerSideEncryptionConfiguration:[{ServerSideEncryptionByDefault:{SSEAlgorithm:"AES256"}}]},PublicAccessBlockConfiguration:{BlockPublicAcls:!0,BlockPublicPolicy:!0,IgnorePublicAcls:!0,RestrictPublicBuckets:!0},LifecycleConfiguration:{Rules:[{Id:"EmailRetention",Status:"Enabled",ExpirationInDays:90,Transitions:[{TransitionInDays:30,StorageClass:"STANDARD_IA"}]}]}}},d={Type:"AWS::S3::BucketPolicy",Properties:{Bucket:x.Ref(c),PolicyDocument:{Version:"2012-10-17",Statement:[{Sid:"AllowSESPuts",Effect:"Allow",Principal:{Service:"ses.amazonaws.com"},Action:"s3:PutObject",Resource:x.Join("",[x.GetAtt(c,"Arn"),"/*"]),Condition:{StringEquals:{"AWS:SourceAccount":x.Ref("AWS::AccountId")}}}]}}};return{bucket:u,bucketPolicy:d,logicalId:c}}static docsExist(n={}){let{projectRoot:i=process.cwd(),docsPaths:s=["docs","documentation","doc"]}=n;for(let o of s){let c=Pe(i,o);if(He(c)){let u=["dist","build",".bunpress/dist","_site","out","public"];for(let d of u){let g=Pe(c,d);if(He(g))try{if(Sr(g).length>0)return{exists:!0,path:c,hasDistFolder:!0,distPath:g}}catch{}}return{exists:!0,path:c,hasDistFolder:!1,distPath:null}}}return{exists:!1,path:null,hasDistFolder:!1,distPath:null}}static createDocsBucketIfExists(n){let i=xe.docsExist({projectRoot:n.projectRoot,docsPaths:n.docsPaths});if(!i.exists)return{bucket:null,logicalId:null,docsInfo:i};let s=xe.createDocsBucket({slug:n.slug,environment:n.environment,domain:n.domain});return{bucket:s.bucket,bucketPolicy:s.bucketPolicy,logicalId:s.logicalId,docsInfo:i}}static createPrivateBucket(n){let{slug:i,environment:s,enableVersioning:o=!0,retentionDays:c,encryptionKeyArn:u}=n,d=r({slug:i,environment:s,resourceType:"s3",suffix:"private"}),g=t(d);return{bucket:{Type:"AWS::S3::Bucket",Properties:{BucketName:d,BucketEncryption:{ServerSideEncryptionConfiguration:[{ServerSideEncryptionByDefault:u?{SSEAlgorithm:"aws:kms",KMSMasterKeyID:u}:{SSEAlgorithm:"AES256"}}]},PublicAccessBlockConfiguration:{BlockPublicAcls:!0,BlockPublicPolicy:!0,IgnorePublicAcls:!0,RestrictPublicBuckets:!0},VersioningConfiguration:o?{Status:"Enabled"}:void 0,LifecycleConfiguration:c?{Rules:[{Id:"RetentionPolicy",Status:"Enabled",ExpirationInDays:c}]}:void 0,Tags:[{Key:"backup",Value:"daily"}]}},logicalId:g}}static checkSourcePaths(n={}){let{projectRoot:i=process.cwd(),paths:s={}}=n,o=s.web||"views/web/dist",c=s.docs||"docs/dist",u=s.private||"private";return{web:{exists:He(Pe(i,o)),path:Pe(i,o)},docs:{exists:He(Pe(i,c)),path:Pe(i,c)},private:{exists:He(Pe(i,u)),path:Pe(i,u)}}}static createDeploymentBuckets(n){let{slug:i,environment:s,domain:o,projectRoot:c,paths:u}=n,d=xe.checkSourcePaths({projectRoot:c,paths:u}),g={},y={web:!1,docs:!1,private:!1},h=xe.createBucket({name:"web",slug:i,environment:s,public:!1,versioning:!1,encryption:!0});if(g[h.logicalId]=h.bucket,y.web=!0,d.docs.exists){let A=xe.createDocsBucket({slug:i,environment:s,domain:o?`docs.${o}`:void 0});if(g[A.logicalId]=A.bucket,A.bucketPolicy)g[`${A.logicalId}Policy`]=A.bucketPolicy;y.docs=!0}if(d.private.exists){let A=xe.createPrivateBucket({slug:i,environment:s,enableVersioning:!0});g[A.logicalId]=A.bucket,y.private=!0}return{resources:g,created:y,sourcePaths:d}}}class et{static createRepository(n){let{name:i,slug:s,environment:o,scanOnPush:c=!0,imageMutability:u="MUTABLE",encryption:d="AES256",kmsKey:g,lifecyclePolicy:y,tags:h}=n,A=r({slug:s,environment:o,resourceType:"ecr",suffix:i}),C=t(A),v={Type:"AWS::ECR::Repository",Properties:{RepositoryName:A,ImageTagMutability:u,ImageScanningConfiguration:{ScanOnPush:c},EncryptionConfiguration:{EncryptionType:d,...g&&d==="KMS"?{KmsKey:g}:{}}}};if(y)v.Properties.LifecyclePolicy={LifecyclePolicyText:JSON.stringify(et.generateLifecyclePolicy(y))};if(h)v.Properties.Tags=Object.entries(h).map(([T,R])=>({Key:T,Value:R}));return{repository:v,logicalId:C}}static generateLifecyclePolicy(n){let i=[];if(n.untaggedImageExpireDays!==void 0)i.push({rulePriority:1,description:"Delete untagged images",selection:{tagStatus:"untagged",countType:"sinceImagePushed",countNumber:n.untaggedImageExpireDays,countUnit:"days"},action:{type:"expire"}});if(n.maxImageCount!==void 0)i.push({rulePriority:i.length+1,description:"Keep only most recent images",selection:{tagStatus:"any",countType:"imageCountMoreThan",countNumber:n.maxImageCount},action:{type:"expire"}});if(n.maxImageAgeDays!==void 0)i.push({rulePriority:i.length+1,description:"Delete images older than specified days",selection:{tagStatus:"any",countType:"sinceImagePushed",countNumber:n.maxImageAgeDays,countUnit:"days"},action:{type:"expire"}});return{rules:i}}static LifecyclePolicies={production:{maxImageCount:10,untaggedImageExpireDays:7},development:{maxImageCount:5,untaggedImageExpireDays:3},minimal:{maxImageCount:3,untaggedImageExpireDays:1},archive:{maxImageCount:50,untaggedImageExpireDays:30}};static enableImmutableTags(n){if(!n.Properties)n.Properties={};return n.Properties.ImageTagMutability="IMMUTABLE",n}static enableScanOnPush(n){if(!n.Properties)n.Properties={};return n.Properties.ImageScanningConfiguration={ScanOnPush:!0},n}static setLifecyclePolicy(n,i){if(!n.Properties)n.Properties={};return n.Properties.LifecyclePolicy={LifecyclePolicyText:JSON.stringify(et.generateLifecyclePolicy(i))},n}static addCrossAccountAccess(n,i){if(!n.Properties)n.Properties={};return n.Properties.RepositoryPolicyText={Version:"2012-10-17",Statement:[{Sid:"CrossAccountPull",Effect:"Allow",Principal:{AWS:i.map((s)=>`arn:aws:iam::${s}:root`)},Action:["ecr:GetDownloadUrlForLayer","ecr:BatchGetImage","ecr:BatchCheckLayerAvailability"]}]},n}static addLambdaAccess(n){if(!n.Properties)n.Properties={};return n.Properties.RepositoryPolicyText={Version:"2012-10-17",Statement:[{Sid:"LambdaECRImageRetrievalPolicy",Effect:"Allow",Principal:{Service:"lambda.amazonaws.com"},Action:["ecr:GetDownloadUrlForLayer","ecr:BatchGetImage"]}]},n}static generateBunDockerfile(n){let{baseImage:i="oven/bun:1-debian",serverPath:s,port:o=3000,additionalDirs:c=[],healthCheckEndpoint:u="/health",nodeCompatible:d=!1,envVars:g={},buildCommands:y=[],runCommand:h}=n,A=["app","config",...c],C=h||`bun run ${s}`,v=`# Multi-stage build for Bun application
+`)}import{existsSync as He,readdirSync as Sr}from"node:fs";import{join as Re}from"node:path";class xe{static createBucket(n){let{name:i,bucketName:s,slug:o,environment:c,public:u=!1,versioning:d=!1,website:g=!1,encryption:y=!0,intelligentTiering:h=!1,cors:A,lifecycleRules:C}=n,v=s??r({slug:o,environment:c,resourceType:"s3",suffix:i}),T=t(v),R={Type:"AWS::S3::Bucket",Properties:{BucketName:v}};if(y)R.Properties.BucketEncryption={ServerSideEncryptionConfiguration:[{ServerSideEncryptionByDefault:{SSEAlgorithm:"AES256"}}]};if(d)R.Properties.VersioningConfiguration={Status:"Enabled"};if(g)R.Properties.WebsiteConfiguration={IndexDocument:"index.html",ErrorDocument:"error.html"};if(!u)R.Properties.PublicAccessBlockConfiguration={BlockPublicAcls:!0,BlockPublicPolicy:!0,IgnorePublicAcls:!0,RestrictPublicBuckets:!0};if(A&&A.length>0)R.Properties.CorsConfiguration={CorsRules:A.map((I)=>({AllowedOrigins:I.allowedOrigins,AllowedMethods:I.allowedMethods,AllowedHeaders:I.allowedHeaders,MaxAge:I.maxAge}))};if(C&&C.length>0)R.Properties.LifecycleConfiguration={Rules:C.map((I)=>({Id:I.id,Status:I.enabled?"Enabled":"Disabled",ExpirationInDays:I.expirationDays,Transitions:I.transitions?.map((M)=>({TransitionInDays:M.days,StorageClass:M.storageClass}))}))};if(h&&C){let I={id:"IntelligentTieringRule",enabled:!0,transitions:[{days:0,storageClass:"INTELLIGENT_TIERING"}]};if(!R.Properties.LifecycleConfiguration)R.Properties.LifecycleConfiguration={Rules:[]};R.Properties.LifecycleConfiguration.Rules.push({Id:I.id,Status:"Enabled",Transitions:I.transitions?.map((M)=>({TransitionInDays:M.days,StorageClass:M.storageClass}))})}let P;if(u)P={Type:"AWS::S3::BucketPolicy",Properties:{Bucket:x.Ref(T),PolicyDocument:{Version:"2012-10-17",Statement:[{Sid:"PublicReadGetObject",Effect:"Allow",Principal:"*",Action:["s3:GetObject"],Resource:[x.Join("",[x.GetAtt(T,"Arn"),"/*"])]}]}}};return{bucket:R,bucketPolicy:P,logicalId:T}}static enableVersioning(n){if(!n.Properties)n.Properties={};return n.Properties.VersioningConfiguration={Status:"Enabled"},n}static enableWebsiteHosting(n,i="index.html",s="error.html"){if(!n.Properties)n.Properties={};return n.Properties.WebsiteConfiguration={IndexDocument:i,ErrorDocument:s},n}static setLifecycleRules(n,i){if(!n.Properties)n.Properties={};return n.Properties.LifecycleConfiguration={Rules:i.map((s)=>({Id:s.id,Status:s.enabled?"Enabled":"Disabled",ExpirationInDays:s.expirationDays,Transitions:s.transitions?.map((o)=>({TransitionInDays:o.days,StorageClass:o.storageClass}))}))},n}static enableIntelligentTiering(n){if(!n.Properties)n.Properties={};if(!n.Properties.LifecycleConfiguration)n.Properties.LifecycleConfiguration={Rules:[]};return n.Properties.LifecycleConfiguration.Rules.push({Id:"IntelligentTieringRule",Status:"Enabled",Transitions:[{TransitionInDays:0,StorageClass:"INTELLIGENT_TIERING"}]}),n}static addLambdaNotification(n,i){if(!n.Properties)n.Properties={};if(!n.Properties.NotificationConfiguration)n.Properties.NotificationConfiguration={};if(!n.Properties.NotificationConfiguration.LambdaConfigurations)n.Properties.NotificationConfiguration.LambdaConfigurations=[];let s={Event:i.events[0],Function:i.functionArn};if(i.filter)s.Filter={S3Key:{Rules:[...i.filter.prefix?[{Name:"prefix",Value:i.filter.prefix}]:[],...i.filter.suffix?[{Name:"suffix",Value:i.filter.suffix}]:[]]}};for(let o of i.events){let c={...s,Event:o};n.Properties.NotificationConfiguration.LambdaConfigurations.push(c)}return n}static Notifications={onObjectCreated:(n)=>({functionArn:n,events:["s3:ObjectCreated:*"]}),onObjectRemoved:(n)=>({functionArn:n,events:["s3:ObjectRemoved:*"]}),onImageUpload:(n,i)=>({functionArn:n,events:["s3:ObjectCreated:*"],filter:{prefix:i,suffix:".jpg"}}),onFileType:(n,i,s)=>({functionArn:n,events:["s3:ObjectCreated:*"],filter:{prefix:s,suffix:i}}),onFolderUpload:(n,i)=>({functionArn:n,events:["s3:ObjectCreated:*"],filter:{prefix:i.endsWith("/")?i:`${i}/`}})};static createBackupPlan(n){let{name:i,slug:s,environment:o,bucketLogicalIds:c,retentionDays:u,schedule:d="cron(0 5 * * ? *)",vaultName:g,enableContinuousBackup:y=!1,moveToColdStorageAfterDays:h}=n,A=g||r({slug:s,environment:o,resourceType:"backup-vault",suffix:i}),C=t(A),v={Type:"AWS::Backup::BackupVault",Properties:{BackupVaultName:A}},T=r({slug:s,environment:o,resourceType:"backup-role",suffix:i}),R=t(T),P={Type:"AWS::IAM::Role",Properties:{RoleName:T,AssumeRolePolicyDocument:{Version:"2012-10-17",Statement:[{Effect:"Allow",Principal:{Service:"backup.amazonaws.com"},Action:"sts:AssumeRole"}]},ManagedPolicyArns:["arn:aws:iam::aws:policy/service-role/AWSBackupServiceRolePolicyForBackup","arn:aws:iam::aws:policy/service-role/AWSBackupServiceRolePolicyForRestores"]}},I=r({slug:s,environment:o,resourceType:"backup-plan",suffix:i}),M=t(I),L={DeleteAfterDays:u};if(h&&h<u)L.MoveToColdStorageAfterDays=h;let N={Type:"AWS::Backup::BackupPlan",Properties:{BackupPlan:{BackupPlanName:I,BackupPlanRule:[{RuleName:`${i}-daily-backup`,TargetBackupVault:x.Ref(C),ScheduleExpression:d,StartWindowMinutes:60,CompletionWindowMinutes:120,Lifecycle:L,EnableContinuousBackup:y}]}}},O=r({slug:s,environment:o,resourceType:"backup-selection",suffix:i}),B=t(O),F=c.map((j)=>x.GetAtt(j,"Arn")),U={Type:"AWS::Backup::BackupSelection",Properties:{BackupPlanId:x.Ref(M),BackupSelection:{SelectionName:O,IamRoleArn:x.GetAtt(R,"Arn"),Resources:F}}};return{vault:v,plan:N,selection:U,role:P,vaultLogicalId:C,planLogicalId:M,selectionLogicalId:B,roleLogicalId:R}}static BackupSchedules={HOURLY:"cron(0 * * * ? *)",DAILY_5AM:"cron(0 5 * * ? *)",DAILY_MIDNIGHT:"cron(0 0 * * ? *)",WEEKLY_SUNDAY:"cron(0 5 ? * SUN *)",WEEKLY_SATURDAY:"cron(0 5 ? * SAT *)",MONTHLY_FIRST:"cron(0 5 1 * ? *)",EVERY_12_HOURS:"cron(0 */12 * * ? *)",EVERY_6_HOURS:"cron(0 */6 * * ? *)"};static BackupRetention={ONE_DAY:1,ONE_WEEK:7,TWO_WEEKS:14,ONE_MONTH:30,THREE_MONTHS:90,SIX_MONTHS:180,ONE_YEAR:365,TWO_YEARS:730,FIVE_YEARS:1825,SEVEN_YEARS:2555};static createWwwRedirectBucket(n){let{slug:i,environment:s,sourceDomain:o,targetDomain:c,protocol:u="https"}=n,d=r({slug:i,environment:s,resourceType:"s3",suffix:"www-redirect"}),g=t(d),y={Type:"AWS::S3::Bucket",Properties:{BucketName:o,WebsiteConfiguration:{RedirectAllRequestsTo:{HostName:c,Protocol:u}},PublicAccessBlockConfiguration:{BlockPublicAcls:!1,BlockPublicPolicy:!1,IgnorePublicAcls:!1,RestrictPublicBuckets:!1}}},h={Type:"AWS::S3::BucketPolicy",Properties:{Bucket:x.Ref(g),PolicyDocument:{Version:"2012-10-17",Statement:[{Sid:"PublicReadForRedirect",Effect:"Allow",Principal:"*",Action:["s3:GetObject"],Resource:[x.Join("",[x.GetAtt(g,"Arn"),"/*"])]}]}}};return{bucket:y,bucketPolicy:h,logicalId:g}}static createDocsBucket(n){let{slug:i,environment:s,domain:o}=n,c=o||r({slug:i,environment:s,resourceType:"s3",suffix:"docs"}),u=t(c);return{bucket:{Type:"AWS::S3::Bucket",Properties:{BucketName:c,BucketEncryption:{ServerSideEncryptionConfiguration:[{ServerSideEncryptionByDefault:{SSEAlgorithm:"AES256"}}]},PublicAccessBlockConfiguration:{BlockPublicAcls:!0,BlockPublicPolicy:!0,IgnorePublicAcls:!0,RestrictPublicBuckets:!0},Tags:[{Key:"backup",Value:"weekly"}]}},logicalId:u}}static createEmailBucket(n){let{slug:i,environment:s}=n,o=r({slug:i,environment:s,resourceType:"s3",suffix:"email"}),c=t(o),u={Type:"AWS::S3::Bucket",Properties:{BucketName:o,BucketEncryption:{ServerSideEncryptionConfiguration:[{ServerSideEncryptionByDefault:{SSEAlgorithm:"AES256"}}]},PublicAccessBlockConfiguration:{BlockPublicAcls:!0,BlockPublicPolicy:!0,IgnorePublicAcls:!0,RestrictPublicBuckets:!0},LifecycleConfiguration:{Rules:[{Id:"EmailRetention",Status:"Enabled",ExpirationInDays:90,Transitions:[{TransitionInDays:30,StorageClass:"STANDARD_IA"}]}]}}},d={Type:"AWS::S3::BucketPolicy",Properties:{Bucket:x.Ref(c),PolicyDocument:{Version:"2012-10-17",Statement:[{Sid:"AllowSESPuts",Effect:"Allow",Principal:{Service:"ses.amazonaws.com"},Action:"s3:PutObject",Resource:x.Join("",[x.GetAtt(c,"Arn"),"/*"]),Condition:{StringEquals:{"AWS:SourceAccount":x.Ref("AWS::AccountId")}}}]}}};return{bucket:u,bucketPolicy:d,logicalId:c}}static docsExist(n={}){let{projectRoot:i=process.cwd(),docsPaths:s=["docs","documentation","doc"]}=n;for(let o of s){let c=Re(i,o);if(He(c)){let u=["dist","build",".bunpress/dist","_site","out","public"];for(let d of u){let g=Re(c,d);if(He(g))try{if(Sr(g).length>0)return{exists:!0,path:c,hasDistFolder:!0,distPath:g}}catch{}}return{exists:!0,path:c,hasDistFolder:!1,distPath:null}}}return{exists:!1,path:null,hasDistFolder:!1,distPath:null}}static createDocsBucketIfExists(n){let i=xe.docsExist({projectRoot:n.projectRoot,docsPaths:n.docsPaths});if(!i.exists)return{bucket:null,logicalId:null,docsInfo:i};let s=xe.createDocsBucket({slug:n.slug,environment:n.environment,domain:n.domain});return{bucket:s.bucket,bucketPolicy:s.bucketPolicy,logicalId:s.logicalId,docsInfo:i}}static createPrivateBucket(n){let{slug:i,environment:s,enableVersioning:o=!0,retentionDays:c,encryptionKeyArn:u}=n,d=r({slug:i,environment:s,resourceType:"s3",suffix:"private"}),g=t(d);return{bucket:{Type:"AWS::S3::Bucket",Properties:{BucketName:d,BucketEncryption:{ServerSideEncryptionConfiguration:[{ServerSideEncryptionByDefault:u?{SSEAlgorithm:"aws:kms",KMSMasterKeyID:u}:{SSEAlgorithm:"AES256"}}]},PublicAccessBlockConfiguration:{BlockPublicAcls:!0,BlockPublicPolicy:!0,IgnorePublicAcls:!0,RestrictPublicBuckets:!0},VersioningConfiguration:o?{Status:"Enabled"}:void 0,LifecycleConfiguration:c?{Rules:[{Id:"RetentionPolicy",Status:"Enabled",ExpirationInDays:c}]}:void 0,Tags:[{Key:"backup",Value:"daily"}]}},logicalId:g}}static checkSourcePaths(n={}){let{projectRoot:i=process.cwd(),paths:s={}}=n,o=s.web||"views/web/dist",c=s.docs||"docs/dist",u=s.private||"private";return{web:{exists:He(Re(i,o)),path:Re(i,o)},docs:{exists:He(Re(i,c)),path:Re(i,c)},private:{exists:He(Re(i,u)),path:Re(i,u)}}}static createDeploymentBuckets(n){let{slug:i,environment:s,domain:o,projectRoot:c,paths:u}=n,d=xe.checkSourcePaths({projectRoot:c,paths:u}),g={},y={web:!1,docs:!1,private:!1},h=xe.createBucket({name:"web",slug:i,environment:s,public:!1,versioning:!1,encryption:!0});if(g[h.logicalId]=h.bucket,y.web=!0,d.docs.exists){let A=xe.createDocsBucket({slug:i,environment:s,domain:o?`docs.${o}`:void 0});if(g[A.logicalId]=A.bucket,A.bucketPolicy)g[`${A.logicalId}Policy`]=A.bucketPolicy;y.docs=!0}if(d.private.exists){let A=xe.createPrivateBucket({slug:i,environment:s,enableVersioning:!0});g[A.logicalId]=A.bucket,y.private=!0}return{resources:g,created:y,sourcePaths:d}}}class et{static createRepository(n){let{name:i,slug:s,environment:o,scanOnPush:c=!0,imageMutability:u="MUTABLE",encryption:d="AES256",kmsKey:g,lifecyclePolicy:y,tags:h}=n,A=r({slug:s,environment:o,resourceType:"ecr",suffix:i}),C=t(A),v={Type:"AWS::ECR::Repository",Properties:{RepositoryName:A,ImageTagMutability:u,ImageScanningConfiguration:{ScanOnPush:c},EncryptionConfiguration:{EncryptionType:d,...g&&d==="KMS"?{KmsKey:g}:{}}}};if(y)v.Properties.LifecyclePolicy={LifecyclePolicyText:JSON.stringify(et.generateLifecyclePolicy(y))};if(h)v.Properties.Tags=Object.entries(h).map(([T,R])=>({Key:T,Value:R}));return{repository:v,logicalId:C}}static generateLifecyclePolicy(n){let i=[];if(n.untaggedImageExpireDays!==void 0)i.push({rulePriority:1,description:"Delete untagged images",selection:{tagStatus:"untagged",countType:"sinceImagePushed",countNumber:n.untaggedImageExpireDays,countUnit:"days"},action:{type:"expire"}});if(n.maxImageCount!==void 0)i.push({rulePriority:i.length+1,description:"Keep only most recent images",selection:{tagStatus:"any",countType:"imageCountMoreThan",countNumber:n.maxImageCount},action:{type:"expire"}});if(n.maxImageAgeDays!==void 0)i.push({rulePriority:i.length+1,description:"Delete images older than specified days",selection:{tagStatus:"any",countType:"sinceImagePushed",countNumber:n.maxImageAgeDays,countUnit:"days"},action:{type:"expire"}});return{rules:i}}static LifecyclePolicies={production:{maxImageCount:10,untaggedImageExpireDays:7},development:{maxImageCount:5,untaggedImageExpireDays:3},minimal:{maxImageCount:3,untaggedImageExpireDays:1},archive:{maxImageCount:50,untaggedImageExpireDays:30}};static enableImmutableTags(n){if(!n.Properties)n.Properties={};return n.Properties.ImageTagMutability="IMMUTABLE",n}static enableScanOnPush(n){if(!n.Properties)n.Properties={};return n.Properties.ImageScanningConfiguration={ScanOnPush:!0},n}static setLifecyclePolicy(n,i){if(!n.Properties)n.Properties={};return n.Properties.LifecyclePolicy={LifecyclePolicyText:JSON.stringify(et.generateLifecyclePolicy(i))},n}static addCrossAccountAccess(n,i){if(!n.Properties)n.Properties={};return n.Properties.RepositoryPolicyText={Version:"2012-10-17",Statement:[{Sid:"CrossAccountPull",Effect:"Allow",Principal:{AWS:i.map((s)=>`arn:aws:iam::${s}:root`)},Action:["ecr:GetDownloadUrlForLayer","ecr:BatchGetImage","ecr:BatchCheckLayerAvailability"]}]},n}static addLambdaAccess(n){if(!n.Properties)n.Properties={};return n.Properties.RepositoryPolicyText={Version:"2012-10-17",Statement:[{Sid:"LambdaECRImageRetrievalPolicy",Effect:"Allow",Principal:{Service:"lambda.amazonaws.com"},Action:["ecr:GetDownloadUrlForLayer","ecr:BatchGetImage"]}]},n}static generateBunDockerfile(n){let{baseImage:i="oven/bun:1-debian",serverPath:s,port:o=3000,additionalDirs:c=[],healthCheckEndpoint:u="/health",nodeCompatible:d=!1,envVars:g={},buildCommands:y=[],runCommand:h}=n,A=["app","config",...c],C=h||`bun run ${s}`,v=`# Multi-stage build for Bun application
 # Generated by ts-cloud
 
 # Builder stage
@@ -91,7 +91,7 @@ echo "Image: $IMAGE_URI:${o}"
 docker push $ECR_REGISTRY/$ECR_REPOSITORY:$IMAGE_TAG
 docker push $ECR_REGISTRY/$ECR_REPOSITORY:latest`},...n.ecsCluster&&n.ecsService?[{name:"Deploy to ECS",run:`aws ecs update-service --cluster ${n.ecsCluster} --service ${n.ecsService} --force-new-deployment`}]:[]]}}};return`# Generated by ts-cloud
 ${JSON.stringify(i,null,2).replace(/"/g,"").replace(/,\n/g,`
-`)}`}};static DockerfileTemplates={bunServer:(n,i=3000)=>et.generateBunDockerfile({serverPath:n,port:i}),bunWithBuild:(n,i,s=3000)=>et.generateBunDockerfile({serverPath:n,port:s,buildCommands:[i]}),bunFullStack:(n,i=3000)=>et.generateBunDockerfile({serverPath:n,port:i,additionalDirs:["public","views","dist"],buildCommands:["bun run build"]}),bunApi:(n,i=3000)=>et.generateBunDockerfile({serverPath:n,port:i,healthCheckEndpoint:"/api/health"})}}var dl=[400,403,404,416,429,500,502,503,504],bm=[500,502,503,504],Cm=["GET","HEAD","OPTIONS"],KI="-failover-group",Em=["default","media-quality-based"],vm={min:1,max:3},Tm={min:1,max:10};function Ho(n){if(n===void 0)return[...bm];if(n.length===0)throw Error(`CloudFront origin failover: statusCodes must list at least one code (allowed: ${dl.join(", ")}). Omit it to use the default ${bm.join(", ")}.`);let i=n.filter((s)=>!dl.includes(s));if(i.length>0)throw Error(`CloudFront origin failover: ${i.join(", ")} ${i.length===1?"is not a status code":"are not status codes"} CloudFront can fail over on. Allowed: ${dl.join(", ")}.`);return[...new Set(n)].sort((s,o)=>s-o)}function ll(n){let{primaryOriginId:i,secondaryOriginId:s}=n;if(!i||!s)throw Error("CloudFront origin failover: both a primary and a secondary origin id are required");if(i===s)throw Error(`CloudFront origin failover: the secondary origin must differ from the primary (both are "${i}")`);let o=Ho(n.statusCodes);return nn(n.selectionCriteria),{Id:n.groupId??`${i}-failover-group`,FailoverCriteria:{StatusCodes:{Quantity:o.length,Items:o}},Members:{Quantity:2,Items:[{OriginId:i},{OriginId:s}]},...n.selectionCriteria?{SelectionCriteria:n.selectionCriteria}:{}}}function nn(n,i="the origin group"){if(n===void 0)return;if(!Em.includes(n))throw Error(`CloudFront origin failover: ${i} has selection criteria ${JSON.stringify(n)}. Allowed: ${Em.join(", ")}.`)}function at(n,i,s){if(typeof n!=="number"||!Number.isInteger(n)||n<i.min||n>i.max)throw Error(`CloudFront origin: ${s} must be a whole number from ${i.min} to ${i.max}, got ${JSON.stringify(n)}.`)}function de(n,i="the origin"){let s={};if(n?.connectionAttempts!==void 0)at(n.connectionAttempts,vm,`${i} connectionAttempts`),s.ConnectionAttempts=n.connectionAttempts;if(n?.connectionTimeout!==void 0)at(n.connectionTimeout,Tm,`${i} connectionTimeout (seconds)`),s.ConnectionTimeout=n.connectionTimeout;return s}function un(n){return{Quantity:1,Items:[ll(n)]}}function kt(n,i="the cache behavior"){let o=(Array.isArray(n)?n:n?.Items??[]).filter((c)=>!Cm.includes(c.toUpperCase()));if(o.length>0)throw Error(`CloudFront origin failover: ${i} allows ${o.join(", ")}, but a cache behavior that targets an origin group may only allow ${Cm.join(", ")}. CloudFront never fails over a write, so point the write paths at a single origin in their own cache behavior.`)}function Go(n){return/\.s3[.-](?:[a-z0-9-]+\.)?amazonaws\.com(?:\.cn)?$/i.test(n)&&!/s3-website/i.test(n)}function je(n){if(!n)return[];if(Array.isArray(n))return n;return n.Items??[]}function Ae(n){return typeof n==="string"?n:void 0}var Cr=/\.mediapackagev2\.[a-z0-9-]+\.amazonaws\.com$/i;function Nt(n,i="the distribution"){let s=je(n.Origins),o=new Set(s.map((A)=>Ae(A.Id)).filter((A)=>!!A)),c=new Map(s.map((A)=>[Ae(A.Id)??"",A.DomainName])),u=s.some((A)=>Ae(A.Id)===void 0);for(let A of s){let C=Ae(A.Id)??"(unnamed origin)";if(A.ConnectionAttempts!==void 0)at(A.ConnectionAttempts,vm,`${i} origin "${C}" ConnectionAttempts`);if(A.ConnectionTimeout!==void 0)at(A.ConnectionTimeout,Tm,`${i} origin "${C}" ConnectionTimeout (seconds)`)}let d=n.OriginGroups,g=je(d);if(d&&!Array.isArray(d)&&d.Quantity!==void 0&&d.Quantity!==g.length)throw Error(`CloudFront origin failover: ${i} OriginGroups.Quantity is ${d.Quantity} but it lists ${g.length} group(s).`);let y=new Set;for(let A of g){let C=Ae(A.Id);if(A.Id===void 0||A.Id==="")throw Error(`CloudFront origin failover: ${i} has an origin group without an Id.`);let v=`${i} origin group "${C??"(intrinsic id)"}"`;if(C){if(y.has(C))throw Error(`CloudFront origin failover: ${i} declares origin group "${C}" twice.`);if(o.has(C))throw Error(`CloudFront origin failover: ${v} has the same id as an origin. Cache behaviors target groups and origins by id, so the two must differ.`);y.add(C)}let T=A.Members,R=je(T);if(R.length!==2||T?.Quantity!==void 0&&T.Quantity!==R.length)throw Error(`CloudFront origin failover: ${v} must have exactly 2 members (a primary and a secondary), it has ${R.length}${T?.Quantity!==void 0&&T.Quantity!==R.length?` with Quantity ${T.Quantity}`:""}.`);let P=R.map((L)=>Ae(L.OriginId));for(let L of P)if(L&&!o.has(L)&&!u)throw Error(`CloudFront origin failover: ${v} lists member "${L}", which is not an origin of this distribution. Origins: ${[...o].join(", ")||"(none)"}.`);if(P[0]&&P[0]===P[1])throw Error(`CloudFront origin failover: ${v} lists "${P[0]}" as both primary and secondary.`);let I=A.FailoverCriteria?.StatusCodes,M=je(I);if(Ho(M),I?.Quantity!==void 0&&I.Quantity!==M.length)throw Error(`CloudFront origin failover: ${v} FailoverCriteria.StatusCodes.Quantity is ${I.Quantity} but it lists ${M.length} code(s).`);if(nn(A.SelectionCriteria,v),A.SelectionCriteria==="media-quality-based")for(let L of P){let N=L?Ae(c.get(L)):void 0;if(N&&!Cr.test(N))throw Error(`CloudFront origin failover: ${v} uses media-quality-based selection, which only works between AWS Elemental MediaPackage v2 origins, but member "${L}" is ${N}. Use 'default'.`)}}let h=[];if(n.DefaultCacheBehavior)h.push({behavior:n.DefaultCacheBehavior,name:"the default cache behavior"});for(let A of je(n.CacheBehaviors))h.push({behavior:A,name:`the cache behavior for ${JSON.stringify(A.PathPattern)}`});for(let{behavior:A,name:C}of h){let v=Ae(A.TargetOriginId);if(!v)continue;if(y.has(v))kt(A.AllowedMethods??["GET","HEAD"],`${C} of ${i} (origin group "${v}")`);else if(!o.has(v)&&!u&&g.every((T)=>Ae(T.Id)!==void 0))throw Error(`CloudFront: ${C} of ${i} targets "${v}", which is neither an origin nor an origin group of this distribution.`)}}class Ce{static createDistribution(n){let{slug:i,environment:s,origin:o,customDomain:c,certificateArn:u,errorPages:d,cachePolicy:g,edgeFunctions:y,http3:h=!1,comment:A,failoverOrigin:C}=n,v=r({slug:i,environment:s,resourceType:"cdn"}),T=t(v),R={Id:"DefaultOrigin",DomainName:o.domainName,OriginPath:o.originPath||"",...de(o,"the CDN origin")},P;if(o.type==="s3"){let M=`${T}OAC`;P={Type:"AWS::CloudFront::OriginAccessControl",Properties:{OriginAccessControlConfig:{Name:`${v}-oac`,Description:`Origin Access Control for ${v}`,OriginAccessControlOriginType:"s3",SigningBehavior:"always",SigningProtocol:"sigv4"}}},R.OriginAccessControlId=x.Ref(M)}else if(o.type==="alb"||o.type==="custom")R.CustomOriginConfig={HTTPPort:80,HTTPSPort:443,OriginProtocolPolicy:"https-only"};let I={Type:"AWS::CloudFront::Distribution",Properties:{DistributionConfig:{Enabled:!0,Comment:A||`CDN for ${v}`,DefaultRootObject:"index.html",Origins:[R],DefaultCacheBehavior:{TargetOriginId:"DefaultOrigin",ViewerProtocolPolicy:"redirect-to-https",AllowedMethods:["GET","HEAD","OPTIONS"],CachedMethods:["GET","HEAD","OPTIONS"],Compress:!0},PriceClass:"PriceClass_100",HttpVersion:h?"http2and3":"http2"}}};if(c&&u)I.Properties.DistributionConfig.Aliases=[c],I.Properties.DistributionConfig.ViewerCertificate={AcmCertificateArn:u,SslSupportMethod:"sni-only",MinimumProtocolVersion:"TLSv1.2_2021"};if(d&&d.length>0)I.Properties.DistributionConfig.CustomErrorResponses=d.map((M)=>({ErrorCode:M.errorCode,ResponseCode:M.responseCode,ResponsePagePath:M.responsePagePath}));if(y&&y.length>0)I.Properties.DistributionConfig.DefaultCacheBehavior.LambdaFunctionAssociations=y.map((M)=>({EventType:M.event,LambdaFunctionARN:M.functionArn}));if(C)Ce.addOriginFailover(I,C);return{distribution:I,originAccessControl:P,logicalId:T}}static addOriginFailover(n,i){let s=n.Properties.DistributionConfig,o=s.DefaultCacheBehavior,c=o.TargetOriginId,u=i.id??"FailoverOrigin";if(s.OriginGroups&&s.OriginGroups.Quantity>0)throw Error("CloudFront origin failover: this distribution already has an origin group");if(kt(o.AllowedMethods??["GET","HEAD"],"the default cache behavior"),s.Origins.some((A)=>A.Id===u))throw Error(`CloudFront origin failover: an origin with id "${u}" already exists`);let d=ll({primaryOriginId:c,secondaryOriginId:u,statusCodes:i.statusCodes,selectionCriteria:i.selectionCriteria}),g=i.type??(Go(i.domainName)?"s3":"custom"),y={Id:u,DomainName:i.domainName,OriginPath:i.originPath||"",...de(i,"the failover origin")},h=de(i.primary,"the primary origin");if(Object.keys(h).length>0){let A=s.Origins.find((C)=>C.Id===c);if(A)Object.assign(A,h)}if(g==="s3"){let A=s.Origins.find((C)=>C.Id===c);if(y.S3OriginConfig={OriginAccessIdentity:""},A?.OriginAccessControlId)y.OriginAccessControlId=A.OriginAccessControlId}else y.CustomOriginConfig={HTTPPort:80,HTTPSPort:443,OriginProtocolPolicy:"https-only"};return s.Origins.push(y),s.OriginGroups={Quantity:1,Items:[d]},o.TargetOriginId=d.Id,Nt(s),n}static setCustomDomain(n,i,s){return n.Properties.DistributionConfig.Aliases=[i],n.Properties.DistributionConfig.ViewerCertificate={AcmCertificateArn:s,SslSupportMethod:"sni-only",MinimumProtocolVersion:"TLSv1.2_2021"},n}static setErrorPages(n,i){return n.Properties.DistributionConfig.CustomErrorResponses=i.map((s)=>({ErrorCode:s.errorCode,ResponseCode:s.responseCode,ResponsePagePath:s.responsePagePath})),n}static enableHttp3(n){return n.Properties.DistributionConfig.HttpVersion="http2and3",n}static addEdgeFunction(n,i,s){if(!n.Properties.DistributionConfig.DefaultCacheBehavior.LambdaFunctionAssociations)n.Properties.DistributionConfig.DefaultCacheBehavior.LambdaFunctionAssociations=[];return n.Properties.DistributionConfig.DefaultCacheBehavior.LambdaFunctionAssociations.push({EventType:i,LambdaFunctionARN:s}),n}static setCachePolicy(n,i){return n.Properties.DistributionConfig.Comment=`${n.Properties.DistributionConfig.Comment||""} (TTL: ${i.default||86400}s)`,n}static createSpaDistribution(n){return Ce.createDistribution({...n,errorPages:[{errorCode:404,responseCode:200,responsePagePath:"/index.html"},{errorCode:403,responseCode:200,responsePagePath:"/index.html"}]})}static createDocsOriginRequestFunction(n){let{slug:i,environment:s}=n,o=r({slug:i,environment:s,resourceType:"edge-docs"}),c=t(o),u=t(`${o}-role`),d=t(`${o}-version`),g={Type:"AWS::IAM::Role",Properties:{RoleName:`${o}-role`,AssumeRolePolicyDocument:{Version:"2012-10-17",Statement:[{Effect:"Allow",Principal:{Service:["lambda.amazonaws.com","edgelambda.amazonaws.com"]},Action:"sts:AssumeRole"}]},ManagedPolicyArns:["arn:aws:iam::aws:policy/service-role/AWSLambdaBasicExecutionRole"]}},y=`
+`)}`}};static DockerfileTemplates={bunServer:(n,i=3000)=>et.generateBunDockerfile({serverPath:n,port:i}),bunWithBuild:(n,i,s=3000)=>et.generateBunDockerfile({serverPath:n,port:s,buildCommands:[i]}),bunFullStack:(n,i=3000)=>et.generateBunDockerfile({serverPath:n,port:i,additionalDirs:["public","views","dist"],buildCommands:["bun run build"]}),bunApi:(n,i=3000)=>et.generateBunDockerfile({serverPath:n,port:i,healthCheckEndpoint:"/api/health"})}}var dl=[400,403,404,416,429,500,502,503,504],bm=[500,502,503,504],Cm=["GET","HEAD","OPTIONS"],KI="-failover-group",Em=["default","media-quality-based"],vm={min:1,max:3},Tm={min:1,max:10};function Ho(n){if(n===void 0)return[...bm];if(n.length===0)throw Error(`CloudFront origin failover: statusCodes must list at least one code (allowed: ${dl.join(", ")}). Omit it to use the default ${bm.join(", ")}.`);let i=n.filter((s)=>!dl.includes(s));if(i.length>0)throw Error(`CloudFront origin failover: ${i.join(", ")} ${i.length===1?"is not a status code":"are not status codes"} CloudFront can fail over on. Allowed: ${dl.join(", ")}.`);return[...new Set(n)].sort((s,o)=>s-o)}function ll(n){let{primaryOriginId:i,secondaryOriginId:s}=n;if(!i||!s)throw Error("CloudFront origin failover: both a primary and a secondary origin id are required");if(i===s)throw Error(`CloudFront origin failover: the secondary origin must differ from the primary (both are "${i}")`);let o=Ho(n.statusCodes);return nn(n.selectionCriteria),{Id:n.groupId??`${i}-failover-group`,FailoverCriteria:{StatusCodes:{Quantity:o.length,Items:o}},Members:{Quantity:2,Items:[{OriginId:i},{OriginId:s}]},...n.selectionCriteria?{SelectionCriteria:n.selectionCriteria}:{}}}function nn(n,i="the origin group"){if(n===void 0)return;if(!Em.includes(n))throw Error(`CloudFront origin failover: ${i} has selection criteria ${JSON.stringify(n)}. Allowed: ${Em.join(", ")}.`)}function at(n,i,s){if(typeof n!=="number"||!Number.isInteger(n)||n<i.min||n>i.max)throw Error(`CloudFront origin: ${s} must be a whole number from ${i.min} to ${i.max}, got ${JSON.stringify(n)}.`)}function le(n,i="the origin"){let s={};if(n?.connectionAttempts!==void 0)at(n.connectionAttempts,vm,`${i} connectionAttempts`),s.ConnectionAttempts=n.connectionAttempts;if(n?.connectionTimeout!==void 0)at(n.connectionTimeout,Tm,`${i} connectionTimeout (seconds)`),s.ConnectionTimeout=n.connectionTimeout;return s}function un(n){return{Quantity:1,Items:[ll(n)]}}function kt(n,i="the cache behavior"){let o=(Array.isArray(n)?n:n?.Items??[]).filter((c)=>!Cm.includes(c.toUpperCase()));if(o.length>0)throw Error(`CloudFront origin failover: ${i} allows ${o.join(", ")}, but a cache behavior that targets an origin group may only allow ${Cm.join(", ")}. CloudFront never fails over a write, so point the write paths at a single origin in their own cache behavior.`)}function Go(n){return/\.s3[.-](?:[a-z0-9-]+\.)?amazonaws\.com(?:\.cn)?$/i.test(n)&&!/s3-website/i.test(n)}function je(n){if(!n)return[];if(Array.isArray(n))return n;return n.Items??[]}function Ae(n){return typeof n==="string"?n:void 0}var Cr=/\.mediapackagev2\.[a-z0-9-]+\.amazonaws\.com$/i;function Nt(n,i="the distribution"){let s=je(n.Origins),o=new Set(s.map((A)=>Ae(A.Id)).filter((A)=>!!A)),c=new Map(s.map((A)=>[Ae(A.Id)??"",A.DomainName])),u=s.some((A)=>Ae(A.Id)===void 0);for(let A of s){let C=Ae(A.Id)??"(unnamed origin)";if(A.ConnectionAttempts!==void 0)at(A.ConnectionAttempts,vm,`${i} origin "${C}" ConnectionAttempts`);if(A.ConnectionTimeout!==void 0)at(A.ConnectionTimeout,Tm,`${i} origin "${C}" ConnectionTimeout (seconds)`)}let d=n.OriginGroups,g=je(d);if(d&&!Array.isArray(d)&&d.Quantity!==void 0&&d.Quantity!==g.length)throw Error(`CloudFront origin failover: ${i} OriginGroups.Quantity is ${d.Quantity} but it lists ${g.length} group(s).`);let y=new Set;for(let A of g){let C=Ae(A.Id);if(A.Id===void 0||A.Id==="")throw Error(`CloudFront origin failover: ${i} has an origin group without an Id.`);let v=`${i} origin group "${C??"(intrinsic id)"}"`;if(C){if(y.has(C))throw Error(`CloudFront origin failover: ${i} declares origin group "${C}" twice.`);if(o.has(C))throw Error(`CloudFront origin failover: ${v} has the same id as an origin. Cache behaviors target groups and origins by id, so the two must differ.`);y.add(C)}let T=A.Members,R=je(T);if(R.length!==2||T?.Quantity!==void 0&&T.Quantity!==R.length)throw Error(`CloudFront origin failover: ${v} must have exactly 2 members (a primary and a secondary), it has ${R.length}${T?.Quantity!==void 0&&T.Quantity!==R.length?` with Quantity ${T.Quantity}`:""}.`);let P=R.map((L)=>Ae(L.OriginId));for(let L of P)if(L&&!o.has(L)&&!u)throw Error(`CloudFront origin failover: ${v} lists member "${L}", which is not an origin of this distribution. Origins: ${[...o].join(", ")||"(none)"}.`);if(P[0]&&P[0]===P[1])throw Error(`CloudFront origin failover: ${v} lists "${P[0]}" as both primary and secondary.`);let I=A.FailoverCriteria?.StatusCodes,M=je(I);if(Ho(M),I?.Quantity!==void 0&&I.Quantity!==M.length)throw Error(`CloudFront origin failover: ${v} FailoverCriteria.StatusCodes.Quantity is ${I.Quantity} but it lists ${M.length} code(s).`);if(nn(A.SelectionCriteria,v),A.SelectionCriteria==="media-quality-based")for(let L of P){let N=L?Ae(c.get(L)):void 0;if(N&&!Cr.test(N))throw Error(`CloudFront origin failover: ${v} uses media-quality-based selection, which only works between AWS Elemental MediaPackage v2 origins, but member "${L}" is ${N}. Use 'default'.`)}}let h=[];if(n.DefaultCacheBehavior)h.push({behavior:n.DefaultCacheBehavior,name:"the default cache behavior"});for(let A of je(n.CacheBehaviors))h.push({behavior:A,name:`the cache behavior for ${JSON.stringify(A.PathPattern)}`});for(let{behavior:A,name:C}of h){let v=Ae(A.TargetOriginId);if(!v)continue;if(y.has(v))kt(A.AllowedMethods??["GET","HEAD"],`${C} of ${i} (origin group "${v}")`);else if(!o.has(v)&&!u&&g.every((T)=>Ae(T.Id)!==void 0))throw Error(`CloudFront: ${C} of ${i} targets "${v}", which is neither an origin nor an origin group of this distribution.`)}}class Ee{static createDistribution(n){let{slug:i,environment:s,origin:o,customDomain:c,certificateArn:u,errorPages:d,cachePolicy:g,edgeFunctions:y,http3:h=!1,comment:A,failoverOrigin:C}=n,v=r({slug:i,environment:s,resourceType:"cdn"}),T=t(v),R={Id:"DefaultOrigin",DomainName:o.domainName,OriginPath:o.originPath||"",...le(o,"the CDN origin")},P;if(o.type==="s3"){let M=`${T}OAC`;P={Type:"AWS::CloudFront::OriginAccessControl",Properties:{OriginAccessControlConfig:{Name:`${v}-oac`,Description:`Origin Access Control for ${v}`,OriginAccessControlOriginType:"s3",SigningBehavior:"always",SigningProtocol:"sigv4"}}},R.OriginAccessControlId=x.Ref(M)}else if(o.type==="alb"||o.type==="custom")R.CustomOriginConfig={HTTPPort:80,HTTPSPort:443,OriginProtocolPolicy:"https-only"};let I={Type:"AWS::CloudFront::Distribution",Properties:{DistributionConfig:{Enabled:!0,Comment:A||`CDN for ${v}`,DefaultRootObject:"index.html",Origins:[R],DefaultCacheBehavior:{TargetOriginId:"DefaultOrigin",ViewerProtocolPolicy:"redirect-to-https",AllowedMethods:["GET","HEAD","OPTIONS"],CachedMethods:["GET","HEAD","OPTIONS"],Compress:!0},PriceClass:"PriceClass_100",HttpVersion:h?"http2and3":"http2"}}};if(c&&u)I.Properties.DistributionConfig.Aliases=[c],I.Properties.DistributionConfig.ViewerCertificate={AcmCertificateArn:u,SslSupportMethod:"sni-only",MinimumProtocolVersion:"TLSv1.2_2021"};if(d&&d.length>0)I.Properties.DistributionConfig.CustomErrorResponses=d.map((M)=>({ErrorCode:M.errorCode,ResponseCode:M.responseCode,ResponsePagePath:M.responsePagePath}));if(y&&y.length>0)I.Properties.DistributionConfig.DefaultCacheBehavior.LambdaFunctionAssociations=y.map((M)=>({EventType:M.event,LambdaFunctionARN:M.functionArn}));if(C)Ee.addOriginFailover(I,C);return{distribution:I,originAccessControl:P,logicalId:T}}static addOriginFailover(n,i){let s=n.Properties.DistributionConfig,o=s.DefaultCacheBehavior,c=o.TargetOriginId,u=i.id??"FailoverOrigin";if(s.OriginGroups&&s.OriginGroups.Quantity>0)throw Error("CloudFront origin failover: this distribution already has an origin group");if(kt(o.AllowedMethods??["GET","HEAD"],"the default cache behavior"),s.Origins.some((A)=>A.Id===u))throw Error(`CloudFront origin failover: an origin with id "${u}" already exists`);let d=ll({primaryOriginId:c,secondaryOriginId:u,statusCodes:i.statusCodes,selectionCriteria:i.selectionCriteria}),g=i.type??(Go(i.domainName)?"s3":"custom"),y={Id:u,DomainName:i.domainName,OriginPath:i.originPath||"",...le(i,"the failover origin")},h=le(i.primary,"the primary origin");if(Object.keys(h).length>0){let A=s.Origins.find((C)=>C.Id===c);if(A)Object.assign(A,h)}if(g==="s3"){let A=s.Origins.find((C)=>C.Id===c);if(y.S3OriginConfig={OriginAccessIdentity:""},A?.OriginAccessControlId)y.OriginAccessControlId=A.OriginAccessControlId}else y.CustomOriginConfig={HTTPPort:80,HTTPSPort:443,OriginProtocolPolicy:"https-only"};return s.Origins.push(y),s.OriginGroups={Quantity:1,Items:[d]},o.TargetOriginId=d.Id,Nt(s),n}static setCustomDomain(n,i,s){return n.Properties.DistributionConfig.Aliases=[i],n.Properties.DistributionConfig.ViewerCertificate={AcmCertificateArn:s,SslSupportMethod:"sni-only",MinimumProtocolVersion:"TLSv1.2_2021"},n}static setErrorPages(n,i){return n.Properties.DistributionConfig.CustomErrorResponses=i.map((s)=>({ErrorCode:s.errorCode,ResponseCode:s.responseCode,ResponsePagePath:s.responsePagePath})),n}static enableHttp3(n){return n.Properties.DistributionConfig.HttpVersion="http2and3",n}static addEdgeFunction(n,i,s){if(!n.Properties.DistributionConfig.DefaultCacheBehavior.LambdaFunctionAssociations)n.Properties.DistributionConfig.DefaultCacheBehavior.LambdaFunctionAssociations=[];return n.Properties.DistributionConfig.DefaultCacheBehavior.LambdaFunctionAssociations.push({EventType:i,LambdaFunctionARN:s}),n}static setCachePolicy(n,i){return n.Properties.DistributionConfig.Comment=`${n.Properties.DistributionConfig.Comment||""} (TTL: ${i.default||86400}s)`,n}static createSpaDistribution(n){return Ee.createDistribution({...n,errorPages:[{errorCode:404,responseCode:200,responsePagePath:"/index.html"},{errorCode:403,responseCode:200,responsePagePath:"/index.html"}]})}static createDocsOriginRequestFunction(n){let{slug:i,environment:s}=n,o=r({slug:i,environment:s,resourceType:"edge-docs"}),c=t(o),u=t(`${o}-role`),d=t(`${o}-version`),g={Type:"AWS::IAM::Role",Properties:{RoleName:`${o}-role`,AssumeRolePolicyDocument:{Version:"2012-10-17",Statement:[{Effect:"Allow",Principal:{Service:["lambda.amazonaws.com","edgelambda.amazonaws.com"]},Action:"sts:AssumeRole"}]},ManagedPolicyArns:["arn:aws:iam::aws:policy/service-role/AWSLambdaBasicExecutionRole"]}},y=`
 'use strict';
 
 exports.handler = async (event) => {
@@ -124,7 +124,7 @@ exports.handler = async (event) => {
 
   return request;
 };
-`.trim();return{lambdaFunction:{Type:"AWS::Lambda::Function",Properties:{FunctionName:o,Description:"Lambda@Edge origin request handler for docs routing",Runtime:"nodejs20.x",Handler:"index.handler",Role:x.GetAtt(u,"Arn"),Code:{ZipFile:y},MemorySize:128,Timeout:5}},role:g,functionLogicalId:c,roleLogicalId:u,versionLogicalId:d}}static createDocsDistribution(n){let{slug:i,environment:s,origin:o,customDomain:c,certificateArn:u,lambdaEdgeFunctionArn:d}=n,g=Ce.createDistribution({slug:i,environment:s,origin:o,customDomain:c,certificateArn:u,comment:`Docs CDN for ${i}`,errorPages:[{errorCode:404,responseCode:404,responsePagePath:"/404.html"},{errorCode:403,responseCode:403,responsePagePath:"/404.html"}]});if(d)Ce.addEdgeFunction(g.distribution,"origin-request",d);return g.distribution.Properties.DistributionConfig.DefaultCacheBehavior.DefaultTTL=86400,g.distribution.Properties.DistributionConfig.DefaultCacheBehavior.MaxTTL=604800,g.distribution.Properties.DistributionConfig.DefaultCacheBehavior.MinTTL=0,g}static createApiDistribution(n){let{slug:i,environment:s,albDomainName:o,customDomain:c,certificateArn:u,pathPattern:d="/api/*",forwardHeaders:g=["Host","Origin","Authorization","Content-Type","Accept"],forwardCookies:y="all",whitelistedCookies:h,customOriginHeaders:A={}}=n,C=r({slug:i,environment:s,resourceType:"cdn-api"}),v=t(C),T=Object.entries(A).map(([M,L])=>({HeaderName:M,HeaderValue:L})),R={Id:"ALBOrigin",DomainName:o,CustomOriginConfig:{HTTPPort:80,HTTPSPort:443,OriginProtocolPolicy:"https-only",OriginSSLProtocols:["TLSv1.2"],OriginReadTimeout:60,OriginKeepaliveTimeout:60}};if(T.length>0)R.OriginCustomHeaders=T;let P={Forward:y};if(y==="whitelist"&&h)P.WhitelistedNames=h;let I={Type:"AWS::CloudFront::Distribution",Properties:{DistributionConfig:{Enabled:!0,Comment:`API CDN for ${C}`,Origins:[R],DefaultCacheBehavior:{TargetOriginId:"ALBOrigin",ViewerProtocolPolicy:"https-only",AllowedMethods:["GET","HEAD","OPTIONS","PUT","POST","PATCH","DELETE"],CachedMethods:["GET","HEAD","OPTIONS"],Compress:!0,DefaultTTL:0,MaxTTL:0,MinTTL:0,ForwardedValues:{QueryString:!0,Headers:g,Cookies:P}},PriceClass:"PriceClass_100",HttpVersion:"http2"}}};if(c&&u)I.Properties.DistributionConfig.Aliases=[c],I.Properties.DistributionConfig.ViewerCertificate={AcmCertificateArn:u,SslSupportMethod:"sni-only",MinimumProtocolVersion:"TLSv1.2_2021"};return{distribution:I,logicalId:v}}static createMultiOriginDistribution(n){let{slug:i,environment:s,s3BucketDomainName:o,albDomainName:c,apiPathPattern:u="/api/*",customDomain:d,certificateArn:g,customOriginHeaders:y={}}=n,h=r({slug:i,environment:s,resourceType:"cdn"}),A=t(h),C=`${A}OAC`,v={Type:"AWS::CloudFront::OriginAccessControl",Properties:{OriginAccessControlConfig:{Name:`${h}-oac`,Description:`Origin Access Control for ${h}`,OriginAccessControlOriginType:"s3",SigningBehavior:"always",SigningProtocol:"sigv4"}}},T=Object.entries(y).map(([M,L])=>({HeaderName:M,HeaderValue:L})),R={Id:"S3Origin",DomainName:o,OriginAccessControlId:x.Ref(C)},P={Id:"ALBOrigin",DomainName:c,CustomOriginConfig:{HTTPPort:80,HTTPSPort:443,OriginProtocolPolicy:"https-only",OriginSSLProtocols:["TLSv1.2"],OriginReadTimeout:60,OriginKeepaliveTimeout:60}};if(T.length>0)P.OriginCustomHeaders=T;let I={Type:"AWS::CloudFront::Distribution",Properties:{DistributionConfig:{Enabled:!0,Comment:`Multi-origin CDN for ${h}`,DefaultRootObject:"index.html",Origins:[R,P],DefaultCacheBehavior:{TargetOriginId:"S3Origin",ViewerProtocolPolicy:"redirect-to-https",AllowedMethods:["GET","HEAD","OPTIONS"],CachedMethods:["GET","HEAD","OPTIONS"],Compress:!0},CacheBehaviors:[{PathPattern:u,TargetOriginId:"ALBOrigin",ViewerProtocolPolicy:"https-only",AllowedMethods:["GET","HEAD","OPTIONS","PUT","POST","PATCH","DELETE"],CachedMethods:["GET","HEAD","OPTIONS"],Compress:!0,DefaultTTL:0,MaxTTL:0,MinTTL:0,ForwardedValues:{QueryString:!0,Headers:["Host","Origin","Authorization","Content-Type","Accept"],Cookies:{Forward:"all"}}}],PriceClass:"PriceClass_100",HttpVersion:"http2",CustomErrorResponses:[{ErrorCode:404,ResponseCode:200,ResponsePagePath:"/index.html"},{ErrorCode:403,ResponseCode:200,ResponsePagePath:"/index.html"}]}}};if(d&&g)I.Properties.DistributionConfig.Aliases=[d],I.Properties.DistributionConfig.ViewerCertificate={AcmCertificateArn:g,SslSupportMethod:"sni-only",MinimumProtocolVersion:"TLSv1.2_2021"};return{distribution:I,originAccessControl:v,logicalId:A,oacLogicalId:C}}static addAlbOrigin(n,i){let{originId:s,domainName:o,pathPattern:c,customHeaders:u={},forwardHeaders:d=["Host","Origin","Authorization","Content-Type","Accept"],cacheTtl:g={default:0,max:0,min:0}}=i,y=Object.entries(u).map(([A,C])=>({HeaderName:A,HeaderValue:C})),h={Id:s,DomainName:o,CustomOriginConfig:{HTTPPort:80,HTTPSPort:443,OriginProtocolPolicy:"https-only",OriginSSLProtocols:["TLSv1.2"],OriginReadTimeout:60,OriginKeepaliveTimeout:60}};if(y.length>0)h.OriginCustomHeaders=y;if(!n.Properties.DistributionConfig.Origins)n.Properties.DistributionConfig.Origins=[];if(n.Properties.DistributionConfig.Origins.push(h),!n.Properties.DistributionConfig.CacheBehaviors)n.Properties.DistributionConfig.CacheBehaviors=[];return n.Properties.DistributionConfig.CacheBehaviors.push({PathPattern:c,TargetOriginId:s,ViewerProtocolPolicy:"https-only",AllowedMethods:["GET","HEAD","OPTIONS","PUT","POST","PATCH","DELETE"],CachedMethods:["GET","HEAD","OPTIONS"],Compress:!0,DefaultTTL:g.default,MaxTTL:g.max,MinTTL:g.min,ForwardedValues:{QueryString:!0,Headers:d,Cookies:{Forward:"all"}}}),n}static addOriginHeader(n,i,s,o){let c=n.Properties.DistributionConfig.Origins?.find((u)=>u.Id===i);if(c){if(!c.OriginCustomHeaders)c.OriginCustomHeaders=[];c.OriginCustomHeaders.push({HeaderName:s,HeaderValue:o})}return n}static EdgeFunctionTemplates={docsOriginRequest:`
+`.trim();return{lambdaFunction:{Type:"AWS::Lambda::Function",Properties:{FunctionName:o,Description:"Lambda@Edge origin request handler for docs routing",Runtime:"nodejs20.x",Handler:"index.handler",Role:x.GetAtt(u,"Arn"),Code:{ZipFile:y},MemorySize:128,Timeout:5}},role:g,functionLogicalId:c,roleLogicalId:u,versionLogicalId:d}}static createDocsDistribution(n){let{slug:i,environment:s,origin:o,customDomain:c,certificateArn:u,lambdaEdgeFunctionArn:d}=n,g=Ee.createDistribution({slug:i,environment:s,origin:o,customDomain:c,certificateArn:u,comment:`Docs CDN for ${i}`,errorPages:[{errorCode:404,responseCode:404,responsePagePath:"/404.html"},{errorCode:403,responseCode:403,responsePagePath:"/404.html"}]});if(d)Ee.addEdgeFunction(g.distribution,"origin-request",d);return g.distribution.Properties.DistributionConfig.DefaultCacheBehavior.DefaultTTL=86400,g.distribution.Properties.DistributionConfig.DefaultCacheBehavior.MaxTTL=604800,g.distribution.Properties.DistributionConfig.DefaultCacheBehavior.MinTTL=0,g}static createApiDistribution(n){let{slug:i,environment:s,albDomainName:o,customDomain:c,certificateArn:u,pathPattern:d="/api/*",forwardHeaders:g=["Host","Origin","Authorization","Content-Type","Accept"],forwardCookies:y="all",whitelistedCookies:h,customOriginHeaders:A={}}=n,C=r({slug:i,environment:s,resourceType:"cdn-api"}),v=t(C),T=Object.entries(A).map(([M,L])=>({HeaderName:M,HeaderValue:L})),R={Id:"ALBOrigin",DomainName:o,CustomOriginConfig:{HTTPPort:80,HTTPSPort:443,OriginProtocolPolicy:"https-only",OriginSSLProtocols:["TLSv1.2"],OriginReadTimeout:60,OriginKeepaliveTimeout:60}};if(T.length>0)R.OriginCustomHeaders=T;let P={Forward:y};if(y==="whitelist"&&h)P.WhitelistedNames=h;let I={Type:"AWS::CloudFront::Distribution",Properties:{DistributionConfig:{Enabled:!0,Comment:`API CDN for ${C}`,Origins:[R],DefaultCacheBehavior:{TargetOriginId:"ALBOrigin",ViewerProtocolPolicy:"https-only",AllowedMethods:["GET","HEAD","OPTIONS","PUT","POST","PATCH","DELETE"],CachedMethods:["GET","HEAD","OPTIONS"],Compress:!0,DefaultTTL:0,MaxTTL:0,MinTTL:0,ForwardedValues:{QueryString:!0,Headers:g,Cookies:P}},PriceClass:"PriceClass_100",HttpVersion:"http2"}}};if(c&&u)I.Properties.DistributionConfig.Aliases=[c],I.Properties.DistributionConfig.ViewerCertificate={AcmCertificateArn:u,SslSupportMethod:"sni-only",MinimumProtocolVersion:"TLSv1.2_2021"};return{distribution:I,logicalId:v}}static createMultiOriginDistribution(n){let{slug:i,environment:s,s3BucketDomainName:o,albDomainName:c,apiPathPattern:u="/api/*",customDomain:d,certificateArn:g,customOriginHeaders:y={}}=n,h=r({slug:i,environment:s,resourceType:"cdn"}),A=t(h),C=`${A}OAC`,v={Type:"AWS::CloudFront::OriginAccessControl",Properties:{OriginAccessControlConfig:{Name:`${h}-oac`,Description:`Origin Access Control for ${h}`,OriginAccessControlOriginType:"s3",SigningBehavior:"always",SigningProtocol:"sigv4"}}},T=Object.entries(y).map(([M,L])=>({HeaderName:M,HeaderValue:L})),R={Id:"S3Origin",DomainName:o,OriginAccessControlId:x.Ref(C)},P={Id:"ALBOrigin",DomainName:c,CustomOriginConfig:{HTTPPort:80,HTTPSPort:443,OriginProtocolPolicy:"https-only",OriginSSLProtocols:["TLSv1.2"],OriginReadTimeout:60,OriginKeepaliveTimeout:60}};if(T.length>0)P.OriginCustomHeaders=T;let I={Type:"AWS::CloudFront::Distribution",Properties:{DistributionConfig:{Enabled:!0,Comment:`Multi-origin CDN for ${h}`,DefaultRootObject:"index.html",Origins:[R,P],DefaultCacheBehavior:{TargetOriginId:"S3Origin",ViewerProtocolPolicy:"redirect-to-https",AllowedMethods:["GET","HEAD","OPTIONS"],CachedMethods:["GET","HEAD","OPTIONS"],Compress:!0},CacheBehaviors:[{PathPattern:u,TargetOriginId:"ALBOrigin",ViewerProtocolPolicy:"https-only",AllowedMethods:["GET","HEAD","OPTIONS","PUT","POST","PATCH","DELETE"],CachedMethods:["GET","HEAD","OPTIONS"],Compress:!0,DefaultTTL:0,MaxTTL:0,MinTTL:0,ForwardedValues:{QueryString:!0,Headers:["Host","Origin","Authorization","Content-Type","Accept"],Cookies:{Forward:"all"}}}],PriceClass:"PriceClass_100",HttpVersion:"http2",CustomErrorResponses:[{ErrorCode:404,ResponseCode:200,ResponsePagePath:"/index.html"},{ErrorCode:403,ResponseCode:200,ResponsePagePath:"/index.html"}]}}};if(d&&g)I.Properties.DistributionConfig.Aliases=[d],I.Properties.DistributionConfig.ViewerCertificate={AcmCertificateArn:g,SslSupportMethod:"sni-only",MinimumProtocolVersion:"TLSv1.2_2021"};return{distribution:I,originAccessControl:v,logicalId:A,oacLogicalId:C}}static addAlbOrigin(n,i){let{originId:s,domainName:o,pathPattern:c,customHeaders:u={},forwardHeaders:d=["Host","Origin","Authorization","Content-Type","Accept"],cacheTtl:g={default:0,max:0,min:0}}=i,y=Object.entries(u).map(([A,C])=>({HeaderName:A,HeaderValue:C})),h={Id:s,DomainName:o,CustomOriginConfig:{HTTPPort:80,HTTPSPort:443,OriginProtocolPolicy:"https-only",OriginSSLProtocols:["TLSv1.2"],OriginReadTimeout:60,OriginKeepaliveTimeout:60}};if(y.length>0)h.OriginCustomHeaders=y;if(!n.Properties.DistributionConfig.Origins)n.Properties.DistributionConfig.Origins=[];if(n.Properties.DistributionConfig.Origins.push(h),!n.Properties.DistributionConfig.CacheBehaviors)n.Properties.DistributionConfig.CacheBehaviors=[];return n.Properties.DistributionConfig.CacheBehaviors.push({PathPattern:c,TargetOriginId:s,ViewerProtocolPolicy:"https-only",AllowedMethods:["GET","HEAD","OPTIONS","PUT","POST","PATCH","DELETE"],CachedMethods:["GET","HEAD","OPTIONS"],Compress:!0,DefaultTTL:g.default,MaxTTL:g.max,MinTTL:g.min,ForwardedValues:{QueryString:!0,Headers:d,Cookies:{Forward:"all"}}}),n}static addOriginHeader(n,i,s,o){let c=n.Properties.DistributionConfig.Origins?.find((u)=>u.Id===i);if(c){if(!c.OriginCustomHeaders)c.OriginCustomHeaders=[];c.OriginCustomHeaders.push({HeaderName:s,HeaderValue:o})}return n}static EdgeFunctionTemplates={docsOriginRequest:`
 'use strict';
 exports.handler = async (event) => {
   const request = event.Records[0].cf.request;
@@ -197,7 +197,7 @@ exports.handler = async (event) => {
 
   return request;
 };
-`.trim()};static Config={ttl:(n)=>{let{min:i=0,max:s=86400,default:o=86400}=n;return{MinTTL:i,MaxTTL:s,DefaultTTL:o}},cookies:(n,i)=>{let s={Forward:n==="allowList"?"whitelist":n};if(n==="allowList"&&i)s.WhitelistedNames=i;return s},allowedMethods:(n)=>{let i={ALL:["GET","HEAD","OPTIONS","PUT","POST","PATCH","DELETE"],GET_HEAD:["GET","HEAD"],GET_HEAD_OPTIONS:["GET","HEAD","OPTIONS"]};return i[n]||i.GET_HEAD},cachedMethods:(n)=>{let i={GET_HEAD:["GET","HEAD"],GET_HEAD_OPTIONS:["GET","HEAD","OPTIONS"]};return i[n]||i.GET_HEAD},ttlPresets:{static:{min:0,max:31536000,default:31536000},dynamic:{min:0,max:0,default:0},api:{min:0,max:3600,default:60},html:{min:0,max:86400,default:86400},images:{min:0,max:604800,default:604800}},cacheBehavior:(n)=>{let{ttl:i={min:0,max:86400,default:86400},cookies:s="none",allowedCookies:o,allowedMethods:c="GET_HEAD",cachedMethods:u="GET_HEAD",compress:d=!0,forwardQueryString:g=!0,forwardHeaders:y=[]}=n;return{MinTTL:i.min,MaxTTL:i.max,DefaultTTL:i.default,Compress:d,AllowedMethods:Ce.Config.allowedMethods(c),CachedMethods:Ce.Config.cachedMethods(u),ForwardedValues:{QueryString:g,Headers:y,Cookies:Ce.Config.cookies(s,o)}}}};static applyConfig(n,i){let s=n.Properties.DistributionConfig.DefaultCacheBehavior;if(i.ttl)s.MinTTL=i.ttl.min,s.MaxTTL=i.ttl.max,s.DefaultTTL=i.ttl.default;if(i.compress!==void 0)s.Compress=i.compress;if(i.allowedMethods)s.AllowedMethods=Ce.Config.allowedMethods(i.allowedMethods);if(i.cachedMethods)s.CachedMethods=Ce.Config.cachedMethods(i.cachedMethods);if(i.cookies){if(!s.ForwardedValues)s.ForwardedValues={QueryString:!0};s.ForwardedValues.Cookies=Ce.Config.cookies(i.cookies,i.allowedCookies)}return n}}var sy=[403,404,500,502,503,504],ul="TsCloud::StorageFailover",Vo="AllowCloudFrontFailoverRead",vr=/^[a-z]{2}(?:-gov)?-[a-z]+-\d$/,Tr=/^[a-z0-9][a-z0-9.-]{1,61}[a-z0-9]$/;function wm(n){let{failover:i,primaryBucket:s,primaryRegion:o}=n,c=n.where??"storage failover";if(!i||typeof i!=="object")throw Error(`${c}.failover must be an object such as { region: 'us-west-2' }.`);if(!i.region||!vr.test(i.region))throw Error(`${c}.failover.region must be an AWS region such as 'us-west-2', got ${JSON.stringify(i.region)}.`);if(i.region===o)throw Error(`${c}.failover.region is ${i.region}, the same region as the primary bucket. Failover only helps when the replica is in another region.`);let u=i.bucket??`${s}-${i.region}`;if(!Tr.test(u)||u.includes("..")){let d=i.bucket===void 0&&u.length>63?` The default name (<primary bucket>-<region>) is ${u.length} characters; S3 allows 63. Set ${c}.failover.bucket.`:"";throw Error(`${c}.failover: "${u}" is not a valid S3 bucket name.${d}`)}if(u===s)throw Error(`${c}.failover.bucket must differ from the primary bucket "${s}".`);return{replicaBucket:u,replicaRegion:i.region,replicate:i.replicate!==!1,statusCodes:Ho(i.statusCodes??sy),primaryConnection:de(i,`${c}.failover`)}}function Rm(n,i){return`${n}.s3.${i}.amazonaws.com`}function Dm(n){let i=`arn:aws:s3:::${n.primaryBucket}`,s=`arn:aws:s3:::${n.replicaBucket}`;return{Type:"AWS::IAM::Role",Properties:{...n.roleName?{RoleName:n.roleName}:{},AssumeRolePolicyDocument:{Version:"2012-10-17",Statement:[{Effect:"Allow",Principal:{Service:"s3.amazonaws.com"},Action:"sts:AssumeRole"}]},Policies:[{PolicyName:"failover-replication",PolicyDocument:{Version:"2012-10-17",Statement:[{Effect:"Allow",Action:["s3:GetReplicationConfiguration","s3:ListBucket"],Resource:i},{Effect:"Allow",Action:["s3:GetObjectVersionForReplication","s3:GetObjectVersionAcl","s3:GetObjectVersionTagging"],Resource:`${i}/*`},{Effect:"Allow",Action:["s3:ReplicateObject","s3:ReplicateDelete","s3:ReplicateTags"],Resource:`${s}/*`}]}}]}}}function Pm(n){return{Role:n.roleArn,Rules:[{Id:"cloudfront-failover-replica",Status:"Enabled",Priority:1,Filter:{Prefix:""},DeleteMarkerReplication:{Status:"Enabled"},Destination:{Bucket:`arn:aws:s3:::${n.replicaBucket}`}}]}}function gl(n){return{Sid:Vo,Effect:"Allow",Principal:{Service:"cloudfront.amazonaws.com"},Action:"s3:GetObject",Resource:`arn:aws:s3:::${n.replicaBucket}/*`,Condition:{StringEquals:{"AWS:SourceArn":n.distributionArn}}}}function WI(n){let s=(typeof n==="string"?JSON.parse(n):n)?.Metadata?.[ul];return Array.isArray(s)?s:[]}class W{static createHostedZone(n){let{domain:i,slug:s,environment:o,comment:c}=n,u=r({slug:s,environment:o,resourceType:"hostedzone"}),d=t(`${u}-${i.replace(/\./g,"")}`);return{zone:{Type:"AWS::Route53::HostedZone",Properties:{Name:i,HostedZoneConfig:{Comment:c||`Hosted zone for ${i}`}}},logicalId:d}}static createRecord(n){let{hostedZoneId:i,hostedZoneName:s,name:o,type:c,ttl:u,values:d,aliasTarget:g}=n,y=t(`record-${o.replace(/\./g,"")}-${c}`),h={Type:"AWS::Route53::RecordSet",Properties:{Name:o,Type:c}};if(i)h.Properties.HostedZoneId=i;else if(s)h.Properties.HostedZoneName=s;if(g)h.Properties.AliasTarget={DNSName:g.dnsName,HostedZoneId:g.hostedZoneId,EvaluateTargetHealth:g.evaluateTargetHealth??!1};else h.Properties.TTL=u||300,h.Properties.ResourceRecords=d||[];return{record:h,logicalId:y}}static createCloudFrontAlias(n,i,s){return W.createRecord({hostedZoneId:s,name:n,type:"A",aliasTarget:{dnsName:i,hostedZoneId:"Z2FDTNDATAQYW2",evaluateTargetHealth:!1}})}static createAlbAlias(n,i,s,o){return W.createRecord({hostedZoneId:o,name:n,type:"A",aliasTarget:{dnsName:i,hostedZoneId:s,evaluateTargetHealth:!0}})}static createCname(n,i,s,o=300){return W.createRecord({hostedZoneId:s,name:n,type:"CNAME",ttl:o,values:[i]})}static createWwwRedirect(n,i){return W.createRecord({hostedZoneId:i,name:`www.${n}`,type:"CNAME",ttl:300,values:[n]})}static createMxRecords(n,i,s,o=300){return W.createRecord({hostedZoneId:s,name:n,type:"MX",ttl:o,values:i.map((c)=>`${c.priority} ${c.server}`)})}static createTxtRecord(n,i,s,o=300){return W.createRecord({hostedZoneId:s,name:n,type:"TXT",ttl:o,values:[`"${i}"`]})}static createSpfRecord(n,i,s){return W.createTxtRecord(n,i,s)}static createDmarcRecord(n,i,s,o){let c=`v=DMARC1; p=${i}; rua=mailto:${s}`;return W.createTxtRecord(`_dmarc.${n}`,c,o)}static createS3WebsiteAlias(n,i,s,o){return W.createRecord({hostedZoneId:o,name:n,type:"A",aliasTarget:{dnsName:i,hostedZoneId:s,evaluateTargetHealth:!1}})}static S3WebsiteHostedZoneIds={"us-east-1":"Z3AQBSTGFYJSTF","us-east-2":"Z2O1EMRO9K5GLX","us-west-1":"Z2F56UZL2M1ACD","us-west-2":"Z3BJ6K6RIION7M","af-south-1":"Z83WF9RJE8B12","ap-east-1":"ZNB98KWMFR0R6","ap-south-1":"Z11RGJOFQNVJUP","ap-south-2":"Z02976202B4EZMXIPMXF7","ap-northeast-1":"Z2M4EHUR26P7ZW","ap-northeast-2":"Z3W03O7B5YMIYP","ap-northeast-3":"Z2YQB5RD63NC85","ap-southeast-1":"Z3O0J2DXBE1FTB","ap-southeast-2":"Z1WCIBER6CPFUU","ap-southeast-3":"Z01613992JD795ZI93075","ca-central-1":"Z1QDHH18159H29","eu-central-1":"Z21DNDUVLTQW6Q","eu-central-2":"Z030506016YDQGETNASS","eu-west-1":"Z1BKCTXD74EZPE","eu-west-2":"Z3GKZC51ZF0DB4","eu-west-3":"Z3R1K369G5AVDG","eu-north-1":"Z3BAZG2TWCNX0D","eu-south-1":"Z30OZKI7KPW7MI","eu-south-2":"Z0081959F7139GRJC19J","me-south-1":"Z1MPMWCPA7YB62","me-central-1":"Z06143092I8HRBER9VXCO","sa-east-1":"Z7KQH4QJS55SO"};static getS3WebsiteEndpoint(n,i){return`${n}.s3-website-${i}.amazonaws.com`}static createStoreRecord(n,i,s){return W.createCname(`store.${n}`,i,s)}static createApiRecord(n,i,s){return W.createCname(`api.${n}`,i,s)}static createDocsRecord(n,i,s){return W.createCname(`docs.${n}`,i,s)}static CloudFrontHostedZoneId="Z2FDTNDATAQYW2"}class E{static createCertificate(n){let{domain:i,subdomains:s=[],slug:o,environment:c,validationMethod:u="DNS",hostedZoneId:d}=n,g=r({slug:o,environment:c,resourceType:"acm"}),y=t(`${g}-${i.replace(/\./g,"")}`),h=[i];for(let C of s)if(C==="*")h.push(`*.${i}`);else h.push(`${C}.${i}`);let A={Type:"AWS::CertificateManager::Certificate",Properties:{DomainName:i,SubjectAlternativeNames:h,ValidationMethod:u}};if(u==="DNS"&&d)A.Properties.DomainValidationOptions=h.map((C)=>({DomainName:C,HostedZoneId:d}));return{certificate:A,logicalId:y}}static createKmsKey(n){let{description:i,slug:s,environment:o,enableRotation:c=!0,multiRegion:u=!1}=n,d=r({slug:s,environment:o,resourceType:"kms"}),g=t(d),y={Version:"2012-10-17",Statement:[{Sid:"Enable IAM User Permissions",Effect:"Allow",Principal:{AWS:x.Sub("arn:aws:iam::${AWS::AccountId}:root")},Action:"kms:*",Resource:"*"},{Sid:"Allow services to use the key",Effect:"Allow",Principal:{Service:["s3.amazonaws.com","cloudfront.amazonaws.com","logs.amazonaws.com","secretsmanager.amazonaws.com"]},Action:["kms:Decrypt","kms:GenerateDataKey"],Resource:"*"}]},h={Type:"AWS::KMS::Key",Properties:{Description:i,Enabled:!0,EnableKeyRotation:c,KeyPolicy:y,KeySpec:"SYMMETRIC_DEFAULT",KeyUsage:"ENCRYPT_DECRYPT",MultiRegion:u}},A=t(`${d}-alias`),C={Type:"AWS::KMS::Alias",Properties:{AliasName:`alias/${s}-${o}`,TargetKeyId:x.Ref(g)}};return{key:h,alias:C,logicalId:g,aliasId:A}}static createFirewall(n){let{slug:i,environment:s,scope:o="CLOUDFRONT",defaultAction:c="allow"}=n,u=r({slug:i,environment:s,resourceType:"waf"}),d=t(u);return{webAcl:{Type:"AWS::WAFv2::WebACL",Properties:{Name:u,Scope:o,DefaultAction:c==="allow"?{Allow:{}}:{Block:{}},Description:`WAF for ${i} ${s}`,Rules:[],VisibilityConfig:{SampledRequestsEnabled:!0,CloudWatchMetricsEnabled:!0,MetricName:`${u}-metric`}}},logicalId:d}}static setRateLimit(n,i){if(!n.Properties.Rules)n.Properties.Rules=[];return n.Properties.Rules.push({Name:i.name,Priority:i.priority,Statement:{RateBasedStatement:{Limit:i.requestsPerWindow,AggregateKeyType:i.aggregateKeyType||"IP"}},Action:{Block:{}},VisibilityConfig:{SampledRequestsEnabled:!0,CloudWatchMetricsEnabled:!0,MetricName:`${i.name}-metric`}}),n}static blockCountries(n,i){if(!n.Properties.Rules)n.Properties.Rules=[];return n.Properties.Rules.push({Name:i.name,Priority:i.priority,Statement:{GeoMatchStatement:{CountryCodes:i.countryCodes}},Action:{Block:{}},VisibilityConfig:{SampledRequestsEnabled:!0,CloudWatchMetricsEnabled:!0,MetricName:`${i.name}-metric`}}),n}static blockIpAddresses(n,i,s,o){let c=r({slug:s,environment:o,resourceType:"ipset"}),u=t(`${c}-${i.name}`),d={Type:"AWS::WAFv2::IPSet",Properties:{Name:`${c}-${i.name}`,Scope:n.Properties.Scope,IPAddressVersion:i.ipVersion||"IPV4",Addresses:i.ipAddresses,Description:`Blocked IPs for ${i.name}`}};if(!n.Properties.Rules)n.Properties.Rules=[];return n.Properties.Rules.push({Name:i.name,Priority:i.priority,Statement:{IPSetReferenceStatement:{Arn:x.GetAtt(u,"Arn")}},Action:{Block:{}},VisibilityConfig:{SampledRequestsEnabled:!0,CloudWatchMetricsEnabled:!0,MetricName:`${i.name}-metric`}}),{webAcl:n,ipSet:d,ipSetLogicalId:u}}static addManagedRules(n,i){if(!n.Properties.Rules)n.Properties.Rules=[];let s={ManagedRuleGroupStatement:{VendorName:i.vendorName,Name:i.ruleName}};if(i.excludedRules&&i.excludedRules.length>0)s.ManagedRuleGroupStatement.ExcludedRules=i.excludedRules.map((o)=>({Name:o}));return n.Properties.Rules.push({Name:i.name,Priority:i.priority,Statement:s,VisibilityConfig:{SampledRequestsEnabled:!0,CloudWatchMetricsEnabled:!0,MetricName:`${i.name}-metric`}}),n}static ManagedRuleGroups={CoreRuleSet:{vendorName:"AWS",ruleName:"AWSManagedRulesCommonRuleSet"},KnownBadInputs:{vendorName:"AWS",ruleName:"AWSManagedRulesKnownBadInputsRuleSet"},SqlDatabase:{vendorName:"AWS",ruleName:"AWSManagedRulesSQLiRuleSet"},LinuxOS:{vendorName:"AWS",ruleName:"AWSManagedRulesLinuxRuleSet"},PosixOS:{vendorName:"AWS",ruleName:"AWSManagedRulesUnixRuleSet"},AmazonIpReputation:{vendorName:"AWS",ruleName:"AWSManagedRulesAmazonIpReputationList"},AnonymousIpList:{vendorName:"AWS",ruleName:"AWSManagedRulesAnonymousIpList"},BotControl:{vendorName:"AWS",ruleName:"AWSManagedRulesBotControlRuleSet"}};static setPathRateLimit(n,i){if(!n.Properties.Rules)n.Properties.Rules=[];let s=i.paths.map((o)=>({SearchString:o,FieldToMatch:{UriPath:{}},TextTransformation:[{Priority:0,Type:"LOWERCASE"}],PositionalConstraint:"STARTS_WITH"}));return n.Properties.Rules.push({Name:i.name,Priority:i.priority,Statement:{RateBasedStatement:{Limit:i.requestsPerWindow,AggregateKeyType:i.aggregateKeyType||"IP",ScopeDownStatement:{OrStatement:{Statements:s.map((o)=>({ByteMatchStatement:o}))}}}},Action:{Block:{}},VisibilityConfig:{SampledRequestsEnabled:!0,CloudWatchMetricsEnabled:!0,MetricName:`${i.name}-metric`}}),n}static setHeaderRateLimit(n,i){if(!n.Properties.Rules)n.Properties.Rules=[];let s={RateBasedStatement:{Limit:i.requestsPerWindow,AggregateKeyType:"CUSTOM_KEYS",CustomKeys:[{Header:{Name:i.headerName,TextTransformations:[{Priority:0,Type:"NONE"}]}}]}};if(i.headerValue)s.RateBasedStatement.ScopeDownStatement={ByteMatchStatement:{SearchString:i.headerValue,FieldToMatch:{SingleHeader:{Name:i.headerName}},TextTransformation:[{Priority:0,Type:"NONE"}],PositionalConstraint:"EXACTLY"}};return n.Properties.Rules.push({Name:i.name,Priority:i.priority,Statement:s,Action:{Block:{}},VisibilityConfig:{SampledRequestsEnabled:!0,CloudWatchMetricsEnabled:!0,MetricName:`${i.name}-metric`}}),n}static protectLoginEndpoint(n,i){let{loginPaths:s,priority:o,requestsPerMinute:c=10}=i;return E.setPathRateLimit(n,{name:"LoginRateLimit",priority:o,requestsPerWindow:c*5,paths:s}),n}static protectApiEndpoints(n,i){let{apiPaths:s,priority:o,requestsPerMinute:c=100}=i;return E.setPathRateLimit(n,{name:"ApiRateLimit",priority:o,requestsPerWindow:c*5,paths:s}),n}static createProtectedFirewall(n){let{slug:i,environment:s,scope:o="CLOUDFRONT",enableBotControl:c=!1,enableRateLimiting:u=!0,rateLimitPerMinute:d=2000}=n,{webAcl:g,logicalId:y}=E.createFirewall({slug:i,environment:s,scope:o,defaultAction:"allow"}),h=0;if(g=E.addManagedRules(g,{name:"AWSIPReputationList",priority:h++,...E.ManagedRuleGroups.AmazonIpReputation}),g=E.addManagedRules(g,{name:"AWSAnonymousIPList",priority:h++,...E.ManagedRuleGroups.AnonymousIpList}),g=E.addManagedRules(g,{name:"AWSCoreRuleSet",priority:h++,...E.ManagedRuleGroups.CoreRuleSet}),g=E.addManagedRules(g,{name:"AWSKnownBadInputs",priority:h++,...E.ManagedRuleGroups.KnownBadInputs}),g=E.addManagedRules(g,{name:"AWSSQLi",priority:h++,...E.ManagedRuleGroups.SqlDatabase}),c)g=E.addManagedRules(g,{name:"AWSBotControl",priority:h++,...E.ManagedRuleGroups.BotControl});if(u)g=E.setRateLimit(g,{name:"GlobalRateLimit",priority:h++,requestsPerWindow:d*5});return{webAcl:g,logicalId:y}}static RateLimitPresets={STANDARD:2000,HIGH_TRAFFIC:1e4,STRICT:100,LOGIN:10,API:100}}function oy(n){let i=n.split(".")[0]??"";return i==="a1"||/^[a-z]+\d+g[a-z]*$/.test(i)}function ay(n="t3.micro"){return`/aws/service/ami-amazon-linux-latest/al2023-ami-kernel-default-${oy(n)?"arm64":"x86_64"}`}function km(n="t3.micro"){return`{{resolve:ssm:${ay(n)}}}`}class a{static createServer(n){let{slug:i,environment:s,instanceType:o="t3.micro",imageId:c=km(o),keyName:u,securityGroupIds:d,subnetId:g,userData:y,volumeSize:h=20,volumeType:A="gp3",encrypted:C=!0}=n,v=r({slug:i,environment:s,resourceType:"ec2"}),T=t(v),R={Type:"AWS::EC2::Instance",Properties:{ImageId:c,InstanceType:o,Tags:[{Key:"Name",Value:v},{Key:"Environment",Value:s}]}};if(u)R.Properties.KeyName=u;if(d)R.Properties.SecurityGroupIds=d;if(g)R.Properties.SubnetId=g;if(y)R.Properties.UserData=x.Base64(y);return R.Properties.BlockDeviceMappings=[{DeviceName:"/dev/xvda",Ebs:{VolumeSize:h,VolumeType:A,Encrypted:C,DeleteOnTermination:!0}}],{instance:R,logicalId:T}}static createSecurityGroup(n){let{slug:i,environment:s,vpcId:o,description:c,ingress:u=[],egress:d=[]}=n,g=r({slug:i,environment:s,resourceType:"sg"}),y=t(g),h={Type:"AWS::EC2::SecurityGroup",Properties:{GroupDescription:c||`Security group for ${i} ${s}`,Tags:[{Key:"Name",Value:g},{Key:"Environment",Value:s}]}};if(o)h.Properties.VpcId=o;if(u.length>0)h.Properties.SecurityGroupIngress=u.map((A)=>({IpProtocol:A.protocol,FromPort:A.fromPort,ToPort:A.toPort,CidrIp:A.cidr,SourceSecurityGroupId:A.sourceSecurityGroupId}));if(d.length>0)h.Properties.SecurityGroupEgress=d.map((A)=>({IpProtocol:A.protocol,FromPort:A.fromPort,ToPort:A.toPort,CidrIp:A.cidr,DestinationSecurityGroupId:A.sourceSecurityGroupId}));return{securityGroup:h,logicalId:y}}static createWebServerSecurityGroup(n,i,s){return a.createSecurityGroup({slug:n,environment:i,vpcId:s,description:"Security group for web servers - HTTP, HTTPS, SSH",ingress:[{protocol:"tcp",fromPort:80,toPort:80,cidr:"0.0.0.0/0"},{protocol:"tcp",fromPort:443,toPort:443,cidr:"0.0.0.0/0"},{protocol:"tcp",fromPort:22,toPort:22,cidr:"0.0.0.0/0"}],egress:[{protocol:"-1",fromPort:0,toPort:0,cidr:"0.0.0.0/0"}]})}static createLoadBalancer(n){let{slug:i,environment:s,scheme:o="internet-facing",subnets:c,securityGroups:u,type:d="application"}=n,g=r({slug:i,environment:s,resourceType:"alb"}),y=t(g),h={Type:"AWS::ElasticLoadBalancingV2::LoadBalancer",Properties:{Name:g,Scheme:o,Type:d,Subnets:c,Tags:[{Key:"Name",Value:g},{Key:"Environment",Value:s}]}};if(u)h.Properties.SecurityGroups=u;return{loadBalancer:h,logicalId:y}}static createTargetGroup(n){let{slug:i,environment:s,port:o,protocol:c="HTTP",vpcId:u,targetType:d="ip",healthCheckPath:g="/",healthCheckInterval:y=30,healthCheckTimeout:h=5,healthyThreshold:A=2,unhealthyThreshold:C=3}=n,v=r({slug:i,environment:s,resourceType:"tg"}),T=t(v);return{targetGroup:{Type:"AWS::ElasticLoadBalancingV2::TargetGroup",Properties:{Name:v,Port:o,Protocol:c,VpcId:u,TargetType:d,HealthCheckEnabled:!0,HealthCheckProtocol:c,HealthCheckPath:g,HealthCheckIntervalSeconds:y,HealthCheckTimeoutSeconds:h,HealthyThresholdCount:A,UnhealthyThresholdCount:C,Tags:[{Key:"Name",Value:v},{Key:"Environment",Value:s}]}},logicalId:T}}static createListener(n,i){let{port:s,protocol:o="HTTP",certificateArn:c,defaultTargetGroupArn:u}=i,d=t(`listener-${n}-${s}`),g={Type:"AWS::ElasticLoadBalancingV2::Listener",Properties:{LoadBalancerArn:x.Ref(n),Port:s,Protocol:o,DefaultActions:[{Type:"forward",TargetGroupArn:u}]}};if(o==="HTTPS"&&c)g.Properties.Certificates=[{CertificateArn:c}],g.Properties.SslPolicy="ELBSecurityPolicy-TLS13-1-2-2021-06";return{listener:g,logicalId:d}}static createEcsCluster(n,i){let s=r({slug:n,environment:i,resourceType:"ecs-cluster"}),o=t(s);return{cluster:{Type:"AWS::ECS::Cluster",Properties:{ClusterName:s,Tags:[{Key:"Name",Value:s},{Key:"Environment",Value:i}]}},logicalId:o}}static createFargateService(n){let{slug:i,environment:s,image:o,cpu:c="256",memory:u="512",desiredCount:d=1,containerPort:g=8080,environmentVariables:y={},secrets:h=[],healthCheck:A,logGroup:C,subnets:v,securityGroups:T,targetGroupArn:R}=n,{cluster:P,logicalId:I}=a.createEcsCluster(i,s),M=r({slug:i,environment:s,resourceType:"fargate"}),L=t(`${M}-execution-role`),N={Type:"AWS::IAM::Role",Properties:{AssumeRolePolicyDocument:{Version:"2012-10-17",Statement:[{Effect:"Allow",Principal:{Service:"ecs-tasks.amazonaws.com"},Action:"sts:AssumeRole"}]},ManagedPolicyArns:["arn:aws:iam::aws:policy/service-role/AmazonECSTaskExecutionRolePolicy"]}},O=t(`${M}-task-role`),B={Type:"AWS::IAM::Role",Properties:{AssumeRolePolicyDocument:{Version:"2012-10-17",Statement:[{Effect:"Allow",Principal:{Service:"ecs-tasks.amazonaws.com"},Action:"sts:AssumeRole"}]}}},F=t(`${M}-task`),U={Type:"AWS::ECS::TaskDefinition",Properties:{Family:M,TaskRoleArn:x.GetAtt(O,"Arn"),ExecutionRoleArn:x.GetAtt(L,"Arn"),NetworkMode:"awsvpc",RequiresCompatibilities:["FARGATE"],Cpu:c,Memory:u,ContainerDefinitions:[{Name:i,Image:o,Essential:!0,PortMappings:[{ContainerPort:g,Protocol:"tcp"}],Environment:Object.entries(y).map(([z,se])=>({Name:z,Value:se})),Secrets:h.map((z)=>({Name:z.name,ValueFrom:z.valueFrom}))}],Tags:[{Key:"Name",Value:M},{Key:"Environment",Value:s}]}};if(A)U.Properties.ContainerDefinitions[0].HealthCheck={Command:A.command,Interval:A.interval||30,Timeout:A.timeout||5,Retries:A.retries||3,StartPeriod:60};if(C)U.Properties.ContainerDefinitions[0].LogConfiguration={LogDriver:"awslogs",Options:{"awslogs-group":C,"awslogs-region":x.Ref("AWS::Region"),"awslogs-stream-prefix":i}};let j=t(`${M}-service`),H={Type:"AWS::ECS::Service",Properties:{ServiceName:M,Cluster:x.Ref(I),TaskDefinition:x.Ref(F),DesiredCount:d,LaunchType:"FARGATE",NetworkConfiguration:{AwsvpcConfiguration:{Subnets:v,SecurityGroups:T,AssignPublicIp:"ENABLED"}},Tags:[{Key:"Name",Value:M},{Key:"Environment",Value:s}]}};if(R)H.Properties.LoadBalancers=[{TargetGroupArn:R,ContainerName:i,ContainerPort:g}];return{cluster:P,taskDefinition:U,service:H,taskRole:B,executionRole:N,clusterLogicalId:I,taskDefinitionLogicalId:F,serviceLogicalId:j,taskRoleLogicalId:O,executionRoleLogicalId:L}}static createLambdaFunction(n){let{slug:i,environment:s,runtime:o,handler:c,code:u,timeout:d=30,memorySize:g=128,environmentVariables:y={},vpcConfig:h}=n,A=r({slug:i,environment:s,resourceType:"lambda"}),C=t(A),v=t(`${A}-role`),T={Type:"AWS::IAM::Role",Properties:{AssumeRolePolicyDocument:{Version:"2012-10-17",Statement:[{Effect:"Allow",Principal:{Service:"lambda.amazonaws.com"},Action:"sts:AssumeRole"}]},ManagedPolicyArns:["arn:aws:iam::aws:policy/service-role/AWSLambdaBasicExecutionRole"]}};if(h)T.Properties.ManagedPolicyArns.push("arn:aws:iam::aws:policy/service-role/AWSLambdaVPCAccessExecutionRole");let R={Type:"AWS::Lambda::Function",Properties:{FunctionName:A,Runtime:o,Role:x.GetAtt(v,"Arn"),Handler:c,Code:{...u.s3Bucket&&{S3Bucket:u.s3Bucket},...u.s3Key&&{S3Key:u.s3Key},...u.zipFile&&{ZipFile:u.zipFile}},Timeout:d,MemorySize:g,Tags:[{Key:"Name",Value:A},{Key:"Environment",Value:s}]}};if(Object.keys(y).length>0)R.Properties.Environment={Variables:y};if(h)R.Properties.VpcConfig={SecurityGroupIds:h.securityGroupIds,SubnetIds:h.subnetIds};return{lambdaFunction:R,role:T,logicalId:C,roleLogicalId:v}}static generateNodeServerUserData(n={}){let{nodeVersion:i="20",appRepo:s,environment:o={}}=n,c=Object.entries(o).map(([u,d])=>`echo "export ${u}='${d}'" >> /etc/environment`).join(`
+`.trim()};static Config={ttl:(n)=>{let{min:i=0,max:s=86400,default:o=86400}=n;return{MinTTL:i,MaxTTL:s,DefaultTTL:o}},cookies:(n,i)=>{let s={Forward:n==="allowList"?"whitelist":n};if(n==="allowList"&&i)s.WhitelistedNames=i;return s},allowedMethods:(n)=>{let i={ALL:["GET","HEAD","OPTIONS","PUT","POST","PATCH","DELETE"],GET_HEAD:["GET","HEAD"],GET_HEAD_OPTIONS:["GET","HEAD","OPTIONS"]};return i[n]||i.GET_HEAD},cachedMethods:(n)=>{let i={GET_HEAD:["GET","HEAD"],GET_HEAD_OPTIONS:["GET","HEAD","OPTIONS"]};return i[n]||i.GET_HEAD},ttlPresets:{static:{min:0,max:31536000,default:31536000},dynamic:{min:0,max:0,default:0},api:{min:0,max:3600,default:60},html:{min:0,max:86400,default:86400},images:{min:0,max:604800,default:604800}},cacheBehavior:(n)=>{let{ttl:i={min:0,max:86400,default:86400},cookies:s="none",allowedCookies:o,allowedMethods:c="GET_HEAD",cachedMethods:u="GET_HEAD",compress:d=!0,forwardQueryString:g=!0,forwardHeaders:y=[]}=n;return{MinTTL:i.min,MaxTTL:i.max,DefaultTTL:i.default,Compress:d,AllowedMethods:Ee.Config.allowedMethods(c),CachedMethods:Ee.Config.cachedMethods(u),ForwardedValues:{QueryString:g,Headers:y,Cookies:Ee.Config.cookies(s,o)}}}};static applyConfig(n,i){let s=n.Properties.DistributionConfig.DefaultCacheBehavior;if(i.ttl)s.MinTTL=i.ttl.min,s.MaxTTL=i.ttl.max,s.DefaultTTL=i.ttl.default;if(i.compress!==void 0)s.Compress=i.compress;if(i.allowedMethods)s.AllowedMethods=Ee.Config.allowedMethods(i.allowedMethods);if(i.cachedMethods)s.CachedMethods=Ee.Config.cachedMethods(i.cachedMethods);if(i.cookies){if(!s.ForwardedValues)s.ForwardedValues={QueryString:!0};s.ForwardedValues.Cookies=Ee.Config.cookies(i.cookies,i.allowedCookies)}return n}}var sy=[403,404,500,502,503,504],ul="TsCloud::StorageFailover",Vo="AllowCloudFrontFailoverRead",vr=/^[a-z]{2}(?:-gov)?-[a-z]+-\d$/,Tr=/^[a-z0-9][a-z0-9.-]{1,61}[a-z0-9]$/;function wm(n){let{failover:i,primaryBucket:s,primaryRegion:o}=n,c=n.where??"storage failover";if(!i||typeof i!=="object")throw Error(`${c}.failover must be an object such as { region: 'us-west-2' }.`);if(!i.region||!vr.test(i.region))throw Error(`${c}.failover.region must be an AWS region such as 'us-west-2', got ${JSON.stringify(i.region)}.`);if(i.region===o)throw Error(`${c}.failover.region is ${i.region}, the same region as the primary bucket. Failover only helps when the replica is in another region.`);let u=i.bucket??`${s}-${i.region}`;if(!Tr.test(u)||u.includes("..")){let d=i.bucket===void 0&&u.length>63?` The default name (<primary bucket>-<region>) is ${u.length} characters; S3 allows 63. Set ${c}.failover.bucket.`:"";throw Error(`${c}.failover: "${u}" is not a valid S3 bucket name.${d}`)}if(u===s)throw Error(`${c}.failover.bucket must differ from the primary bucket "${s}".`);return{replicaBucket:u,replicaRegion:i.region,replicate:i.replicate!==!1,statusCodes:Ho(i.statusCodes??sy),primaryConnection:le(i,`${c}.failover`)}}function Rm(n,i){return`${n}.s3.${i}.amazonaws.com`}function Dm(n){let i=`arn:aws:s3:::${n.primaryBucket}`,s=`arn:aws:s3:::${n.replicaBucket}`;return{Type:"AWS::IAM::Role",Properties:{...n.roleName?{RoleName:n.roleName}:{},AssumeRolePolicyDocument:{Version:"2012-10-17",Statement:[{Effect:"Allow",Principal:{Service:"s3.amazonaws.com"},Action:"sts:AssumeRole"}]},Policies:[{PolicyName:"failover-replication",PolicyDocument:{Version:"2012-10-17",Statement:[{Effect:"Allow",Action:["s3:GetReplicationConfiguration","s3:ListBucket"],Resource:i},{Effect:"Allow",Action:["s3:GetObjectVersionForReplication","s3:GetObjectVersionAcl","s3:GetObjectVersionTagging"],Resource:`${i}/*`},{Effect:"Allow",Action:["s3:ReplicateObject","s3:ReplicateDelete","s3:ReplicateTags"],Resource:`${s}/*`}]}}]}}}function Pm(n){return{Role:n.roleArn,Rules:[{Id:"cloudfront-failover-replica",Status:"Enabled",Priority:1,Filter:{Prefix:""},DeleteMarkerReplication:{Status:"Enabled"},Destination:{Bucket:`arn:aws:s3:::${n.replicaBucket}`}}]}}function gl(n){return{Sid:Vo,Effect:"Allow",Principal:{Service:"cloudfront.amazonaws.com"},Action:"s3:GetObject",Resource:`arn:aws:s3:::${n.replicaBucket}/*`,Condition:{StringEquals:{"AWS:SourceArn":n.distributionArn}}}}function WI(n){let s=(typeof n==="string"?JSON.parse(n):n)?.Metadata?.[ul];return Array.isArray(s)?s:[]}class W{static createHostedZone(n){let{domain:i,slug:s,environment:o,comment:c}=n,u=r({slug:s,environment:o,resourceType:"hostedzone"}),d=t(`${u}-${i.replace(/\./g,"")}`);return{zone:{Type:"AWS::Route53::HostedZone",Properties:{Name:i,HostedZoneConfig:{Comment:c||`Hosted zone for ${i}`}}},logicalId:d}}static createRecord(n){let{hostedZoneId:i,hostedZoneName:s,name:o,type:c,ttl:u,values:d,aliasTarget:g}=n,y=t(`record-${o.replace(/\./g,"")}-${c}`),h={Type:"AWS::Route53::RecordSet",Properties:{Name:o,Type:c}};if(i)h.Properties.HostedZoneId=i;else if(s)h.Properties.HostedZoneName=s;if(g)h.Properties.AliasTarget={DNSName:g.dnsName,HostedZoneId:g.hostedZoneId,EvaluateTargetHealth:g.evaluateTargetHealth??!1};else h.Properties.TTL=u||300,h.Properties.ResourceRecords=d||[];return{record:h,logicalId:y}}static createCloudFrontAlias(n,i,s){return W.createRecord({hostedZoneId:s,name:n,type:"A",aliasTarget:{dnsName:i,hostedZoneId:"Z2FDTNDATAQYW2",evaluateTargetHealth:!1}})}static createAlbAlias(n,i,s,o){return W.createRecord({hostedZoneId:o,name:n,type:"A",aliasTarget:{dnsName:i,hostedZoneId:s,evaluateTargetHealth:!0}})}static createCname(n,i,s,o=300){return W.createRecord({hostedZoneId:s,name:n,type:"CNAME",ttl:o,values:[i]})}static createWwwRedirect(n,i){return W.createRecord({hostedZoneId:i,name:`www.${n}`,type:"CNAME",ttl:300,values:[n]})}static createMxRecords(n,i,s,o=300){return W.createRecord({hostedZoneId:s,name:n,type:"MX",ttl:o,values:i.map((c)=>`${c.priority} ${c.server}`)})}static createTxtRecord(n,i,s,o=300){return W.createRecord({hostedZoneId:s,name:n,type:"TXT",ttl:o,values:[`"${i}"`]})}static createSpfRecord(n,i,s){return W.createTxtRecord(n,i,s)}static createDmarcRecord(n,i,s,o){let c=`v=DMARC1; p=${i}; rua=mailto:${s}`;return W.createTxtRecord(`_dmarc.${n}`,c,o)}static createS3WebsiteAlias(n,i,s,o){return W.createRecord({hostedZoneId:o,name:n,type:"A",aliasTarget:{dnsName:i,hostedZoneId:s,evaluateTargetHealth:!1}})}static S3WebsiteHostedZoneIds={"us-east-1":"Z3AQBSTGFYJSTF","us-east-2":"Z2O1EMRO9K5GLX","us-west-1":"Z2F56UZL2M1ACD","us-west-2":"Z3BJ6K6RIION7M","af-south-1":"Z83WF9RJE8B12","ap-east-1":"ZNB98KWMFR0R6","ap-south-1":"Z11RGJOFQNVJUP","ap-south-2":"Z02976202B4EZMXIPMXF7","ap-northeast-1":"Z2M4EHUR26P7ZW","ap-northeast-2":"Z3W03O7B5YMIYP","ap-northeast-3":"Z2YQB5RD63NC85","ap-southeast-1":"Z3O0J2DXBE1FTB","ap-southeast-2":"Z1WCIBER6CPFUU","ap-southeast-3":"Z01613992JD795ZI93075","ca-central-1":"Z1QDHH18159H29","eu-central-1":"Z21DNDUVLTQW6Q","eu-central-2":"Z030506016YDQGETNASS","eu-west-1":"Z1BKCTXD74EZPE","eu-west-2":"Z3GKZC51ZF0DB4","eu-west-3":"Z3R1K369G5AVDG","eu-north-1":"Z3BAZG2TWCNX0D","eu-south-1":"Z30OZKI7KPW7MI","eu-south-2":"Z0081959F7139GRJC19J","me-south-1":"Z1MPMWCPA7YB62","me-central-1":"Z06143092I8HRBER9VXCO","sa-east-1":"Z7KQH4QJS55SO"};static getS3WebsiteEndpoint(n,i){return`${n}.s3-website-${i}.amazonaws.com`}static createStoreRecord(n,i,s){return W.createCname(`store.${n}`,i,s)}static createApiRecord(n,i,s){return W.createCname(`api.${n}`,i,s)}static createDocsRecord(n,i,s){return W.createCname(`docs.${n}`,i,s)}static CloudFrontHostedZoneId="Z2FDTNDATAQYW2"}class E{static createCertificate(n){let{domain:i,subdomains:s=[],slug:o,environment:c,validationMethod:u="DNS",hostedZoneId:d}=n,g=r({slug:o,environment:c,resourceType:"acm"}),y=t(`${g}-${i.replace(/\./g,"")}`),h=[i];for(let C of s)if(C==="*")h.push(`*.${i}`);else h.push(`${C}.${i}`);let A={Type:"AWS::CertificateManager::Certificate",Properties:{DomainName:i,SubjectAlternativeNames:h,ValidationMethod:u}};if(u==="DNS"&&d)A.Properties.DomainValidationOptions=h.map((C)=>({DomainName:C,HostedZoneId:d}));return{certificate:A,logicalId:y}}static createKmsKey(n){let{description:i,slug:s,environment:o,enableRotation:c=!0,multiRegion:u=!1}=n,d=r({slug:s,environment:o,resourceType:"kms"}),g=t(d),y={Version:"2012-10-17",Statement:[{Sid:"Enable IAM User Permissions",Effect:"Allow",Principal:{AWS:x.Sub("arn:aws:iam::${AWS::AccountId}:root")},Action:"kms:*",Resource:"*"},{Sid:"Allow services to use the key",Effect:"Allow",Principal:{Service:["s3.amazonaws.com","cloudfront.amazonaws.com","logs.amazonaws.com","secretsmanager.amazonaws.com"]},Action:["kms:Decrypt","kms:GenerateDataKey"],Resource:"*"}]},h={Type:"AWS::KMS::Key",Properties:{Description:i,Enabled:!0,EnableKeyRotation:c,KeyPolicy:y,KeySpec:"SYMMETRIC_DEFAULT",KeyUsage:"ENCRYPT_DECRYPT",MultiRegion:u}},A=t(`${d}-alias`),C={Type:"AWS::KMS::Alias",Properties:{AliasName:`alias/${s}-${o}`,TargetKeyId:x.Ref(g)}};return{key:h,alias:C,logicalId:g,aliasId:A}}static createFirewall(n){let{slug:i,environment:s,scope:o="CLOUDFRONT",defaultAction:c="allow"}=n,u=r({slug:i,environment:s,resourceType:"waf"}),d=t(u);return{webAcl:{Type:"AWS::WAFv2::WebACL",Properties:{Name:u,Scope:o,DefaultAction:c==="allow"?{Allow:{}}:{Block:{}},Description:`WAF for ${i} ${s}`,Rules:[],VisibilityConfig:{SampledRequestsEnabled:!0,CloudWatchMetricsEnabled:!0,MetricName:`${u}-metric`}}},logicalId:d}}static setRateLimit(n,i){if(!n.Properties.Rules)n.Properties.Rules=[];return n.Properties.Rules.push({Name:i.name,Priority:i.priority,Statement:{RateBasedStatement:{Limit:i.requestsPerWindow,AggregateKeyType:i.aggregateKeyType||"IP"}},Action:{Block:{}},VisibilityConfig:{SampledRequestsEnabled:!0,CloudWatchMetricsEnabled:!0,MetricName:`${i.name}-metric`}}),n}static blockCountries(n,i){if(!n.Properties.Rules)n.Properties.Rules=[];return n.Properties.Rules.push({Name:i.name,Priority:i.priority,Statement:{GeoMatchStatement:{CountryCodes:i.countryCodes}},Action:{Block:{}},VisibilityConfig:{SampledRequestsEnabled:!0,CloudWatchMetricsEnabled:!0,MetricName:`${i.name}-metric`}}),n}static blockIpAddresses(n,i,s,o){let c=r({slug:s,environment:o,resourceType:"ipset"}),u=t(`${c}-${i.name}`),d={Type:"AWS::WAFv2::IPSet",Properties:{Name:`${c}-${i.name}`,Scope:n.Properties.Scope,IPAddressVersion:i.ipVersion||"IPV4",Addresses:i.ipAddresses,Description:`Blocked IPs for ${i.name}`}};if(!n.Properties.Rules)n.Properties.Rules=[];return n.Properties.Rules.push({Name:i.name,Priority:i.priority,Statement:{IPSetReferenceStatement:{Arn:x.GetAtt(u,"Arn")}},Action:{Block:{}},VisibilityConfig:{SampledRequestsEnabled:!0,CloudWatchMetricsEnabled:!0,MetricName:`${i.name}-metric`}}),{webAcl:n,ipSet:d,ipSetLogicalId:u}}static addManagedRules(n,i){if(!n.Properties.Rules)n.Properties.Rules=[];let s={ManagedRuleGroupStatement:{VendorName:i.vendorName,Name:i.ruleName}};if(i.excludedRules&&i.excludedRules.length>0)s.ManagedRuleGroupStatement.ExcludedRules=i.excludedRules.map((o)=>({Name:o}));return n.Properties.Rules.push({Name:i.name,Priority:i.priority,Statement:s,VisibilityConfig:{SampledRequestsEnabled:!0,CloudWatchMetricsEnabled:!0,MetricName:`${i.name}-metric`}}),n}static ManagedRuleGroups={CoreRuleSet:{vendorName:"AWS",ruleName:"AWSManagedRulesCommonRuleSet"},KnownBadInputs:{vendorName:"AWS",ruleName:"AWSManagedRulesKnownBadInputsRuleSet"},SqlDatabase:{vendorName:"AWS",ruleName:"AWSManagedRulesSQLiRuleSet"},LinuxOS:{vendorName:"AWS",ruleName:"AWSManagedRulesLinuxRuleSet"},PosixOS:{vendorName:"AWS",ruleName:"AWSManagedRulesUnixRuleSet"},AmazonIpReputation:{vendorName:"AWS",ruleName:"AWSManagedRulesAmazonIpReputationList"},AnonymousIpList:{vendorName:"AWS",ruleName:"AWSManagedRulesAnonymousIpList"},BotControl:{vendorName:"AWS",ruleName:"AWSManagedRulesBotControlRuleSet"}};static setPathRateLimit(n,i){if(!n.Properties.Rules)n.Properties.Rules=[];let s=i.paths.map((o)=>({SearchString:o,FieldToMatch:{UriPath:{}},TextTransformation:[{Priority:0,Type:"LOWERCASE"}],PositionalConstraint:"STARTS_WITH"}));return n.Properties.Rules.push({Name:i.name,Priority:i.priority,Statement:{RateBasedStatement:{Limit:i.requestsPerWindow,AggregateKeyType:i.aggregateKeyType||"IP",ScopeDownStatement:{OrStatement:{Statements:s.map((o)=>({ByteMatchStatement:o}))}}}},Action:{Block:{}},VisibilityConfig:{SampledRequestsEnabled:!0,CloudWatchMetricsEnabled:!0,MetricName:`${i.name}-metric`}}),n}static setHeaderRateLimit(n,i){if(!n.Properties.Rules)n.Properties.Rules=[];let s={RateBasedStatement:{Limit:i.requestsPerWindow,AggregateKeyType:"CUSTOM_KEYS",CustomKeys:[{Header:{Name:i.headerName,TextTransformations:[{Priority:0,Type:"NONE"}]}}]}};if(i.headerValue)s.RateBasedStatement.ScopeDownStatement={ByteMatchStatement:{SearchString:i.headerValue,FieldToMatch:{SingleHeader:{Name:i.headerName}},TextTransformation:[{Priority:0,Type:"NONE"}],PositionalConstraint:"EXACTLY"}};return n.Properties.Rules.push({Name:i.name,Priority:i.priority,Statement:s,Action:{Block:{}},VisibilityConfig:{SampledRequestsEnabled:!0,CloudWatchMetricsEnabled:!0,MetricName:`${i.name}-metric`}}),n}static protectLoginEndpoint(n,i){let{loginPaths:s,priority:o,requestsPerMinute:c=10}=i;return E.setPathRateLimit(n,{name:"LoginRateLimit",priority:o,requestsPerWindow:c*5,paths:s}),n}static protectApiEndpoints(n,i){let{apiPaths:s,priority:o,requestsPerMinute:c=100}=i;return E.setPathRateLimit(n,{name:"ApiRateLimit",priority:o,requestsPerWindow:c*5,paths:s}),n}static createProtectedFirewall(n){let{slug:i,environment:s,scope:o="CLOUDFRONT",enableBotControl:c=!1,enableRateLimiting:u=!0,rateLimitPerMinute:d=2000}=n,{webAcl:g,logicalId:y}=E.createFirewall({slug:i,environment:s,scope:o,defaultAction:"allow"}),h=0;if(g=E.addManagedRules(g,{name:"AWSIPReputationList",priority:h++,...E.ManagedRuleGroups.AmazonIpReputation}),g=E.addManagedRules(g,{name:"AWSAnonymousIPList",priority:h++,...E.ManagedRuleGroups.AnonymousIpList}),g=E.addManagedRules(g,{name:"AWSCoreRuleSet",priority:h++,...E.ManagedRuleGroups.CoreRuleSet}),g=E.addManagedRules(g,{name:"AWSKnownBadInputs",priority:h++,...E.ManagedRuleGroups.KnownBadInputs}),g=E.addManagedRules(g,{name:"AWSSQLi",priority:h++,...E.ManagedRuleGroups.SqlDatabase}),c)g=E.addManagedRules(g,{name:"AWSBotControl",priority:h++,...E.ManagedRuleGroups.BotControl});if(u)g=E.setRateLimit(g,{name:"GlobalRateLimit",priority:h++,requestsPerWindow:d*5});return{webAcl:g,logicalId:y}}static RateLimitPresets={STANDARD:2000,HIGH_TRAFFIC:1e4,STRICT:100,LOGIN:10,API:100}}function oy(n){let i=n.split(".")[0]??"";return i==="a1"||/^[a-z]+\d+g[a-z]*$/.test(i)}function ay(n="t3.micro"){return`/aws/service/ami-amazon-linux-latest/al2023-ami-kernel-default-${oy(n)?"arm64":"x86_64"}`}function km(n="t3.micro"){return`{{resolve:ssm:${ay(n)}}}`}class a{static createServer(n){let{slug:i,environment:s,instanceType:o="t3.micro",imageId:c=km(o),keyName:u,securityGroupIds:d,subnetId:g,userData:y,volumeSize:h=20,volumeType:A="gp3",encrypted:C=!0}=n,v=r({slug:i,environment:s,resourceType:"ec2"}),T=t(v),R={Type:"AWS::EC2::Instance",Properties:{ImageId:c,InstanceType:o,Tags:[{Key:"Name",Value:v},{Key:"Environment",Value:s}]}};if(u)R.Properties.KeyName=u;if(d)R.Properties.SecurityGroupIds=d;if(g)R.Properties.SubnetId=g;if(y)R.Properties.UserData=x.Base64(y);return R.Properties.BlockDeviceMappings=[{DeviceName:"/dev/xvda",Ebs:{VolumeSize:h,VolumeType:A,Encrypted:C,DeleteOnTermination:!0}}],{instance:R,logicalId:T}}static createSecurityGroup(n){let{slug:i,environment:s,vpcId:o,description:c,ingress:u=[],egress:d=[]}=n,g=r({slug:i,environment:s,resourceType:"sg"}),y=t(g),h={Type:"AWS::EC2::SecurityGroup",Properties:{GroupDescription:c||`Security group for ${i} ${s}`,Tags:[{Key:"Name",Value:g},{Key:"Environment",Value:s}]}};if(o)h.Properties.VpcId=o;if(u.length>0)h.Properties.SecurityGroupIngress=u.map((A)=>({IpProtocol:A.protocol,FromPort:A.fromPort,ToPort:A.toPort,CidrIp:A.cidr,SourceSecurityGroupId:A.sourceSecurityGroupId}));if(d.length>0)h.Properties.SecurityGroupEgress=d.map((A)=>({IpProtocol:A.protocol,FromPort:A.fromPort,ToPort:A.toPort,CidrIp:A.cidr,DestinationSecurityGroupId:A.sourceSecurityGroupId}));return{securityGroup:h,logicalId:y}}static createWebServerSecurityGroup(n,i,s){return a.createSecurityGroup({slug:n,environment:i,vpcId:s,description:"Security group for web servers - HTTP, HTTPS, SSH",ingress:[{protocol:"tcp",fromPort:80,toPort:80,cidr:"0.0.0.0/0"},{protocol:"tcp",fromPort:443,toPort:443,cidr:"0.0.0.0/0"},{protocol:"tcp",fromPort:22,toPort:22,cidr:"0.0.0.0/0"}],egress:[{protocol:"-1",fromPort:0,toPort:0,cidr:"0.0.0.0/0"}]})}static createLoadBalancer(n){let{slug:i,environment:s,scheme:o="internet-facing",subnets:c,securityGroups:u,type:d="application"}=n,g=r({slug:i,environment:s,resourceType:"alb"}),y=t(g),h={Type:"AWS::ElasticLoadBalancingV2::LoadBalancer",Properties:{Name:g,Scheme:o,Type:d,Subnets:c,Tags:[{Key:"Name",Value:g},{Key:"Environment",Value:s}]}};if(u)h.Properties.SecurityGroups=u;return{loadBalancer:h,logicalId:y}}static createTargetGroup(n){let{slug:i,environment:s,port:o,protocol:c="HTTP",vpcId:u,targetType:d="ip",healthCheckPath:g="/",healthCheckInterval:y=30,healthCheckTimeout:h=5,healthyThreshold:A=2,unhealthyThreshold:C=3}=n,v=r({slug:i,environment:s,resourceType:"tg"}),T=t(v);return{targetGroup:{Type:"AWS::ElasticLoadBalancingV2::TargetGroup",Properties:{Name:v,Port:o,Protocol:c,VpcId:u,TargetType:d,HealthCheckEnabled:!0,HealthCheckProtocol:c,HealthCheckPath:g,HealthCheckIntervalSeconds:y,HealthCheckTimeoutSeconds:h,HealthyThresholdCount:A,UnhealthyThresholdCount:C,Tags:[{Key:"Name",Value:v},{Key:"Environment",Value:s}]}},logicalId:T}}static createListener(n,i){let{port:s,protocol:o="HTTP",certificateArn:c,defaultTargetGroupArn:u}=i,d=t(`listener-${n}-${s}`),g={Type:"AWS::ElasticLoadBalancingV2::Listener",Properties:{LoadBalancerArn:x.Ref(n),Port:s,Protocol:o,DefaultActions:[{Type:"forward",TargetGroupArn:u}]}};if(o==="HTTPS"&&c)g.Properties.Certificates=[{CertificateArn:c}],g.Properties.SslPolicy="ELBSecurityPolicy-TLS13-1-2-2021-06";return{listener:g,logicalId:d}}static createEcsCluster(n,i){let s=r({slug:n,environment:i,resourceType:"ecs-cluster"}),o=t(s);return{cluster:{Type:"AWS::ECS::Cluster",Properties:{ClusterName:s,Tags:[{Key:"Name",Value:s},{Key:"Environment",Value:i}]}},logicalId:o}}static createFargateService(n){let{slug:i,environment:s,image:o,cpu:c="256",memory:u="512",desiredCount:d=1,containerPort:g=8080,environmentVariables:y={},secrets:h=[],healthCheck:A,logGroup:C,subnets:v,securityGroups:T,targetGroupArn:R}=n,{cluster:P,logicalId:I}=a.createEcsCluster(i,s),M=r({slug:i,environment:s,resourceType:"fargate"}),L=t(`${M}-execution-role`),N={Type:"AWS::IAM::Role",Properties:{AssumeRolePolicyDocument:{Version:"2012-10-17",Statement:[{Effect:"Allow",Principal:{Service:"ecs-tasks.amazonaws.com"},Action:"sts:AssumeRole"}]},ManagedPolicyArns:["arn:aws:iam::aws:policy/service-role/AmazonECSTaskExecutionRolePolicy"]}},O=t(`${M}-task-role`),B={Type:"AWS::IAM::Role",Properties:{AssumeRolePolicyDocument:{Version:"2012-10-17",Statement:[{Effect:"Allow",Principal:{Service:"ecs-tasks.amazonaws.com"},Action:"sts:AssumeRole"}]}}},F=t(`${M}-task`),U={Type:"AWS::ECS::TaskDefinition",Properties:{Family:M,TaskRoleArn:x.GetAtt(O,"Arn"),ExecutionRoleArn:x.GetAtt(L,"Arn"),NetworkMode:"awsvpc",RequiresCompatibilities:["FARGATE"],Cpu:c,Memory:u,ContainerDefinitions:[{Name:i,Image:o,Essential:!0,PortMappings:[{ContainerPort:g,Protocol:"tcp"}],Environment:Object.entries(y).map(([z,se])=>({Name:z,Value:se})),Secrets:h.map((z)=>({Name:z.name,ValueFrom:z.valueFrom}))}],Tags:[{Key:"Name",Value:M},{Key:"Environment",Value:s}]}};if(A)U.Properties.ContainerDefinitions[0].HealthCheck={Command:A.command,Interval:A.interval||30,Timeout:A.timeout||5,Retries:A.retries||3,StartPeriod:60};if(C)U.Properties.ContainerDefinitions[0].LogConfiguration={LogDriver:"awslogs",Options:{"awslogs-group":C,"awslogs-region":x.Ref("AWS::Region"),"awslogs-stream-prefix":i}};let j=t(`${M}-service`),H={Type:"AWS::ECS::Service",Properties:{ServiceName:M,Cluster:x.Ref(I),TaskDefinition:x.Ref(F),DesiredCount:d,LaunchType:"FARGATE",NetworkConfiguration:{AwsvpcConfiguration:{Subnets:v,SecurityGroups:T,AssignPublicIp:"ENABLED"}},Tags:[{Key:"Name",Value:M},{Key:"Environment",Value:s}]}};if(R)H.Properties.LoadBalancers=[{TargetGroupArn:R,ContainerName:i,ContainerPort:g}];return{cluster:P,taskDefinition:U,service:H,taskRole:B,executionRole:N,clusterLogicalId:I,taskDefinitionLogicalId:F,serviceLogicalId:j,taskRoleLogicalId:O,executionRoleLogicalId:L}}static createLambdaFunction(n){let{slug:i,environment:s,runtime:o,handler:c,code:u,timeout:d=30,memorySize:g=128,environmentVariables:y={},vpcConfig:h}=n,A=r({slug:i,environment:s,resourceType:"lambda"}),C=t(A),v=t(`${A}-role`),T={Type:"AWS::IAM::Role",Properties:{AssumeRolePolicyDocument:{Version:"2012-10-17",Statement:[{Effect:"Allow",Principal:{Service:"lambda.amazonaws.com"},Action:"sts:AssumeRole"}]},ManagedPolicyArns:["arn:aws:iam::aws:policy/service-role/AWSLambdaBasicExecutionRole"]}};if(h)T.Properties.ManagedPolicyArns.push("arn:aws:iam::aws:policy/service-role/AWSLambdaVPCAccessExecutionRole");let R={Type:"AWS::Lambda::Function",Properties:{FunctionName:A,Runtime:o,Role:x.GetAtt(v,"Arn"),Handler:c,Code:{...u.s3Bucket&&{S3Bucket:u.s3Bucket},...u.s3Key&&{S3Key:u.s3Key},...u.zipFile&&{ZipFile:u.zipFile}},Timeout:d,MemorySize:g,Tags:[{Key:"Name",Value:A},{Key:"Environment",Value:s}]}};if(Object.keys(y).length>0)R.Properties.Environment={Variables:y};if(h)R.Properties.VpcConfig={SecurityGroupIds:h.securityGroupIds,SubnetIds:h.subnetIds};return{lambdaFunction:R,role:T,logicalId:C,roleLogicalId:v}}static generateNodeServerUserData(n={}){let{nodeVersion:i="20",appRepo:s,environment:o={}}=n,c=Object.entries(o).map(([u,d])=>`echo "export ${u}='${d}'" >> /etc/environment`).join(`
 `);return`#!/bin/bash
 # Update system
 yum update -y
@@ -569,7 +569,7 @@ ufw default allow outgoing
 ${n.map((i)=>`ufw allow ${i}`).join(`
 `)}
 ufw --force enable
-`},Presets:{bunWithNginx:(n,i=3000)=>a.UserData.generateAppServerScript({runtime:"bun",webServer:"nginx",processManager:"systemd",domain:n,appPort:i,enableSsl:!0}),bunWithCaddy:(n,i=3000)=>a.UserData.generateAppServerScript({runtime:"bun",webServer:"caddy",processManager:"systemd",domain:n,appPort:i,enableSsl:!1}),nodeWithPm2:(n,i=3000)=>a.UserData.generateAppServerScript({runtime:"node",webServer:"nginx",processManager:"pm2",domain:n,appPort:i,enableSsl:!0}),worker:(n="bun")=>a.UserData.generateAppServerScript({runtime:n,webServer:"none",processManager:"systemd",enableSsl:!1})}};static createElasticIp(n){let{slug:i,environment:s,domain:o,instanceLogicalId:c}=n,u=r({slug:i,environment:s,resourceType:"eip"}),d=t(u),g={Type:"AWS::EC2::EIP",Properties:{Domain:"vpc",Tags:[{Key:"Name",Value:u},{Key:"Environment",Value:s},...o?[{Key:"Domain",Value:o}]:[]]}},y={[d]:g},h,A;if(c)A=t(`${u}-assoc`),h={Type:"AWS::EC2::EIPAssociation",Properties:{AllocationId:x.GetAtt(d,"AllocationId"),InstanceId:x.Ref(c)}},y[A]=h;return{eip:g,eipAssociation:h,eipLogicalId:d,associationLogicalId:A,resources:y}}static createServerModeStack(n){let{slug:i,environment:s,vpcId:o,subnetId:c,instanceType:u="t3.small",imageId:d="ami-0f3caa1cf4417e51b",keyName:g,domain:y,userData:h,allowedPorts:A=[22,80,443],volumeSize:C=20,volumeType:v="gp3"}=n,T={},R=r({slug:i,environment:s,resourceType:"server-sg"}),P=t(R),I={Type:"AWS::EC2::SecurityGroup",Properties:{GroupName:R,GroupDescription:`Security group for ${i} server`,VpcId:o,SecurityGroupIngress:A.map((ae)=>({IpProtocol:"tcp",FromPort:ae,ToPort:ae,CidrIp:"0.0.0.0/0",Description:`Port ${ae}`})),SecurityGroupEgress:[{IpProtocol:"-1",CidrIp:"0.0.0.0/0",Description:"Allow all outbound"}],Tags:[{Key:"Name",Value:R},{Key:"Environment",Value:s}]}};T[P]=I;let M=r({slug:i,environment:s,resourceType:"server-role"}),L=t(M),N={Type:"AWS::IAM::Role",Properties:{RoleName:M,AssumeRolePolicyDocument:{Version:"2012-10-17",Statement:[{Effect:"Allow",Principal:{Service:"ec2.amazonaws.com"},Action:"sts:AssumeRole"}]},ManagedPolicyArns:["arn:aws:iam::aws:policy/AmazonSSMManagedInstanceCore","arn:aws:iam::aws:policy/CloudWatchAgentServerPolicy"],Policies:[{PolicyName:"StacksServerPermissions",PolicyDocument:{Version:"2012-10-17",Statement:[{Effect:"Allow",Action:["ses:SendEmail","ses:SendRawEmail","ses:SendBulkEmail","ses:VerifyDomainIdentity","ses:VerifyDomainDkim","ses:GetIdentityDkimAttributes","ses:GetIdentityVerificationAttributes"],Resource:"*"},{Effect:"Allow",Action:["s3:GetObject","s3:PutObject","s3:ListBucket"],Resource:"*"},{Effect:"Allow",Action:["route53:ChangeResourceRecordSets","route53:ListResourceRecordSets","route53:GetHostedZone"],Resource:"*"},{Effect:"Allow",Action:["ssm:GetParameter","ssm:GetParameters"],Resource:"*"}]}}]}};T[L]=N;let O=r({slug:i,environment:s,resourceType:"server-profile"}),B=t(O),F={Type:"AWS::IAM::InstanceProfile",Properties:{InstanceProfileName:O,Roles:[x.Ref(L)]}};T[B]=F;let U=r({slug:i,environment:s,resourceType:"server"}),j=t(U),H={Type:"AWS::EC2::Instance",DependsOn:[B],Properties:{ImageId:d,InstanceType:u,KeyName:g,SubnetId:c,SecurityGroupIds:[x.Ref(P)],IamInstanceProfile:x.Ref(B),BlockDeviceMappings:[{DeviceName:"/dev/xvda",Ebs:{VolumeSize:C,VolumeType:v,Encrypted:!0,DeleteOnTermination:!0}}],Tags:[{Key:"Name",Value:U},{Key:"Environment",Value:s},...y?[{Key:"Domain",Value:y}]:[]]}};if(h)H.Properties.UserData=x.Base64(h);T[j]=H;let{eip:z,eipAssociation:se,eipLogicalId:Te,associationLogicalId:oe,resources:ge}=a.createElasticIp({slug:i,environment:s,domain:y,instanceLogicalId:j});return Object.assign(T,ge),{instance:H,securityGroup:I,eip:z,eipAssociation:se,instanceRole:N,instanceProfile:F,resources:T,outputs:{instanceLogicalId:j,securityGroupLogicalId:P,eipLogicalId:Te,associationLogicalId:oe,roleLogicalId:L,profileLogicalId:B}}}static ServerMode={webServer:(n)=>{let i=a.UserData.generateAppServerScript({runtime:n.runtime||"bun",webServer:n.webServer||"nginx",domain:n.domain,enableSsl:!0});return a.createServerModeStack({...n,userData:i,instanceType:"t3.small",allowedPorts:[22,80,443]})},workerServer:(n)=>{let i=a.UserData.generateAppServerScript({runtime:n.runtime||"bun",webServer:"none",installRedis:n.installRedis});return a.createServerModeStack({...n,userData:i,instanceType:"t3.medium",allowedPorts:[22]})},cacheServer:(n)=>a.createServerModeStack({...n,userData:`#!/bin/bash
+`},Presets:{bunWithNginx:(n,i=3000)=>a.UserData.generateAppServerScript({runtime:"bun",webServer:"nginx",processManager:"systemd",domain:n,appPort:i,enableSsl:!0}),bunWithCaddy:(n,i=3000)=>a.UserData.generateAppServerScript({runtime:"bun",webServer:"caddy",processManager:"systemd",domain:n,appPort:i,enableSsl:!1}),nodeWithPm2:(n,i=3000)=>a.UserData.generateAppServerScript({runtime:"node",webServer:"nginx",processManager:"pm2",domain:n,appPort:i,enableSsl:!0}),worker:(n="bun")=>a.UserData.generateAppServerScript({runtime:n,webServer:"none",processManager:"systemd",enableSsl:!1})}};static createElasticIp(n){let{slug:i,environment:s,domain:o,instanceLogicalId:c}=n,u=r({slug:i,environment:s,resourceType:"eip"}),d=t(u),g={Type:"AWS::EC2::EIP",Properties:{Domain:"vpc",Tags:[{Key:"Name",Value:u},{Key:"Environment",Value:s},...o?[{Key:"Domain",Value:o}]:[]]}},y={[d]:g},h,A;if(c)A=t(`${u}-assoc`),h={Type:"AWS::EC2::EIPAssociation",Properties:{AllocationId:x.GetAtt(d,"AllocationId"),InstanceId:x.Ref(c)}},y[A]=h;return{eip:g,eipAssociation:h,eipLogicalId:d,associationLogicalId:A,resources:y}}static createServerModeStack(n){let{slug:i,environment:s,vpcId:o,subnetId:c,instanceType:u="t3.small",imageId:d="ami-0f3caa1cf4417e51b",keyName:g,domain:y,userData:h,allowedPorts:A=[22,80,443],volumeSize:C=20,volumeType:v="gp3"}=n,T={},R=r({slug:i,environment:s,resourceType:"server-sg"}),P=t(R),I={Type:"AWS::EC2::SecurityGroup",Properties:{GroupName:R,GroupDescription:`Security group for ${i} server`,VpcId:o,SecurityGroupIngress:A.map((ae)=>({IpProtocol:"tcp",FromPort:ae,ToPort:ae,CidrIp:"0.0.0.0/0",Description:`Port ${ae}`})),SecurityGroupEgress:[{IpProtocol:"-1",CidrIp:"0.0.0.0/0",Description:"Allow all outbound"}],Tags:[{Key:"Name",Value:R},{Key:"Environment",Value:s}]}};T[P]=I;let M=r({slug:i,environment:s,resourceType:"server-role"}),L=t(M),N={Type:"AWS::IAM::Role",Properties:{RoleName:M,AssumeRolePolicyDocument:{Version:"2012-10-17",Statement:[{Effect:"Allow",Principal:{Service:"ec2.amazonaws.com"},Action:"sts:AssumeRole"}]},ManagedPolicyArns:["arn:aws:iam::aws:policy/AmazonSSMManagedInstanceCore","arn:aws:iam::aws:policy/CloudWatchAgentServerPolicy"],Policies:[{PolicyName:"StacksServerPermissions",PolicyDocument:{Version:"2012-10-17",Statement:[{Effect:"Allow",Action:["ses:SendEmail","ses:SendRawEmail","ses:SendBulkEmail","ses:VerifyDomainIdentity","ses:VerifyDomainDkim","ses:GetIdentityDkimAttributes","ses:GetIdentityVerificationAttributes"],Resource:"*"},{Effect:"Allow",Action:["s3:GetObject","s3:PutObject","s3:ListBucket"],Resource:"*"},{Effect:"Allow",Action:["route53:ChangeResourceRecordSets","route53:ListResourceRecordSets","route53:GetHostedZone"],Resource:"*"},{Effect:"Allow",Action:["ssm:GetParameter","ssm:GetParameters"],Resource:"*"}]}}]}};T[L]=N;let O=r({slug:i,environment:s,resourceType:"server-profile"}),B=t(O),F={Type:"AWS::IAM::InstanceProfile",Properties:{InstanceProfileName:O,Roles:[x.Ref(L)]}};T[B]=F;let U=r({slug:i,environment:s,resourceType:"server"}),j=t(U),H={Type:"AWS::EC2::Instance",DependsOn:[B],Properties:{ImageId:d,InstanceType:u,KeyName:g,SubnetId:c,SecurityGroupIds:[x.Ref(P)],IamInstanceProfile:x.Ref(B),BlockDeviceMappings:[{DeviceName:"/dev/xvda",Ebs:{VolumeSize:C,VolumeType:v,Encrypted:!0,DeleteOnTermination:!0}}],Tags:[{Key:"Name",Value:U},{Key:"Environment",Value:s},...y?[{Key:"Domain",Value:y}]:[]]}};if(h)H.Properties.UserData=x.Base64(h);T[j]=H;let{eip:z,eipAssociation:se,eipLogicalId:ve,associationLogicalId:oe,resources:pe}=a.createElasticIp({slug:i,environment:s,domain:y,instanceLogicalId:j});return Object.assign(T,pe),{instance:H,securityGroup:I,eip:z,eipAssociation:se,instanceRole:N,instanceProfile:F,resources:T,outputs:{instanceLogicalId:j,securityGroupLogicalId:P,eipLogicalId:ve,associationLogicalId:oe,roleLogicalId:L,profileLogicalId:B}}}static ServerMode={webServer:(n)=>{let i=a.UserData.generateAppServerScript({runtime:n.runtime||"bun",webServer:n.webServer||"nginx",domain:n.domain,enableSsl:!0});return a.createServerModeStack({...n,userData:i,instanceType:"t3.small",allowedPorts:[22,80,443]})},workerServer:(n)=>{let i=a.UserData.generateAppServerScript({runtime:n.runtime||"bun",webServer:"none",installRedis:n.installRedis});return a.createServerModeStack({...n,userData:i,instanceType:"t3.medium",allowedPorts:[22]})},cacheServer:(n)=>a.createServerModeStack({...n,userData:`#!/bin/bash
 set -e
 apt-get update && apt-get upgrade -y
 apt-get install -y redis-server
@@ -577,7 +577,7 @@ sed -i 's/bind 127.0.0.1/bind 0.0.0.0/' /etc/redis/redis.conf
 systemctl enable redis-server
 systemctl restart redis-server
 echo "Redis server setup complete!"
-`,instanceType:"t3.medium",allowedPorts:[22,6379]})}}class S{static createVpc(n){let{slug:i,environment:s,cidr:o="10.0.0.0/16",enableDnsHostnames:c=!0,enableDnsSupport:u=!0}=n,d=r({slug:i,environment:s,resourceType:"vpc"}),g=t(d);return{vpc:{Type:"AWS::EC2::VPC",Properties:{CidrBlock:o,EnableDnsHostnames:c,EnableDnsSupport:u,Tags:[{Key:"Name",Value:d},{Key:"Environment",Value:s}]}},logicalId:g}}static createSubnet(n){let{slug:i,environment:s,vpcId:o,type:c,cidr:u,availabilityZone:d,mapPublicIp:g=c==="public"}=n,y=r({slug:i,environment:s,resourceType:`subnet-${c}`}),h=t(`${y}-${d}`);return{subnet:{Type:"AWS::EC2::Subnet",Properties:{VpcId:o,CidrBlock:u,AvailabilityZone:d,MapPublicIpOnLaunch:g,Tags:[{Key:"Name",Value:`${y}-${d}`},{Key:"Environment",Value:s},{Key:"Type",Value:c}]}},logicalId:h}}static createInternetGateway(n,i){let s=r({slug:n,environment:i,resourceType:"igw"}),o=t(s);return{internetGateway:{Type:"AWS::EC2::InternetGateway",Properties:{Tags:[{Key:"Name",Value:s},{Key:"Environment",Value:i}]}},logicalId:o}}static attachInternetGateway(n,i){let s=t(`${n}-igw-attachment`);return{attachment:{Type:"AWS::EC2::VPCGatewayAttachment",Properties:{VpcId:x.Ref(n),InternetGatewayId:x.Ref(i)}},logicalId:s}}static createEip(n,i){let s=r({slug:n,environment:i,resourceType:"eip"}),o=t(s);return{eip:{Type:"AWS::EC2::EIP",Properties:{Domain:"vpc",Tags:[{Key:"Name",Value:s},{Key:"Environment",Value:i}]}},logicalId:o}}static createNatGateway(n,i){let{slug:s,environment:o,subnetId:c}=n,u=r({slug:s,environment:o,resourceType:"nat"}),d=t(u);return{natGateway:{Type:"AWS::EC2::NatGateway",Properties:{AllocationId:x.GetAtt(i,"AllocationId"),SubnetId:c,Tags:[{Key:"Name",Value:u},{Key:"Environment",Value:o},{Key:"Warning",Value:"NAT Gateway incurs hourly charges"}]}},logicalId:d}}static createRouteTable(n,i,s,o){let c=r({slug:n,environment:i,resourceType:`rt-${o}`}),u=t(c);return{routeTable:{Type:"AWS::EC2::RouteTable",Properties:{VpcId:x.Ref(s),Tags:[{Key:"Name",Value:c},{Key:"Environment",Value:i},{Key:"Type",Value:o}]}},logicalId:u}}static createRoute(n,i,s){let o=t(`${n}-route-${s.type}`),c={Type:"AWS::EC2::Route",Properties:{RouteTableId:x.Ref(n),DestinationCidrBlock:i}};if(s.type==="igw")c.Properties.GatewayId=x.Ref(s.logicalId);else if(s.type==="nat")c.Properties.NatGatewayId=x.Ref(s.logicalId);else if(s.type==="instance")c.Properties.InstanceId=x.Ref(s.logicalId);return{route:c,logicalId:o}}static associateSubnetWithRouteTable(n,i){let s=t(`${n}-rt-assoc`);return{association:{Type:"AWS::EC2::SubnetRouteTableAssociation",Properties:{SubnetId:x.Ref(n),RouteTableId:x.Ref(i)}},logicalId:s}}static enableFlowLogs(n){let{slug:i,environment:s,resourceId:o,resourceType:c,trafficType:u="ALL",logGroupName:d}=n,g=r({slug:i,environment:s,resourceType:"flowlog"}),y=t(g);return{flowLog:{Type:"AWS::EC2::FlowLog",Properties:{ResourceType:c,ResourceIds:[o],TrafficType:u,LogDestinationType:"cloud-watch-logs",LogGroupName:d||`/aws/vpc/${i}-${s}`,Tags:[{Key:"Name",Value:g},{Key:"Environment",Value:s}]}},logicalId:y}}static calculateSubnetCidrs(n,i,s=3){let[o,c]=n.split("/"),u=Number.parseInt(c,10),d=Math.ceil(Math.log2(i*s)),g=u+d;if(g>28)throw Error("VPC CIDR is too small to accommodate requested subnets");let[y,h,A,C]=o.split(".").map(Number),v=(y<<24)+(h<<16)+(A<<8)+C,T=2**(32-g),R=[];for(let P=0;P<i*s;P++){let I=v+P*T,M=[I>>>24&255,I>>>16&255,I>>>8&255,I&255].join(".");R.push(`${M}/${g}`)}return R}static getAvailabilityZones(n,i){return["a","b","c","d","e","f"].slice(0,i).map((o)=>`${n}${o}`)}static createMultiAzNetwork(n){let{slug:i,environment:s,region:o,cidr:c="10.0.0.0/16",zones:u=3,enableNatGateway:d=!1,singleNatGateway:g=!1,enableFlowLogs:y=!1}=n,h={},A=[],C=[],v=[],{vpc:T,logicalId:R}=S.createVpc({slug:i,environment:s,cidr:c});h[R]=T;let{internetGateway:P,logicalId:I}=S.createInternetGateway(i,s);h[I]=P;let{attachment:M,logicalId:L}=S.attachInternetGateway(R,I);h[L]=M;let{routeTable:N,logicalId:O}=S.createRouteTable(i,s,R,"public");h[O]=N;let{route:B,logicalId:F}=S.createRoute(O,"0.0.0.0/0",{type:"igw",logicalId:I});B.DependsOn=L,h[F]=B;let U=S.calculateSubnetCidrs(c,u,2),j=S.getAvailabilityZones(o,u),H=[];for(let z=0;z<u;z++){let se=j[z],Te=U[z*2],oe=U[z*2+1],{subnet:ge,logicalId:ae}=S.createSubnet({slug:i,environment:s,vpcId:x.Ref(R),type:"public",cidr:Te,availabilityZone:se});h[ae]=ge,A.push(ae);let{association:me,logicalId:Ie}=S.associateSubnetWithRouteTable(ae,O);h[Ie]=me;let{subnet:Le,logicalId:he}=S.createSubnet({slug:i,environment:s,vpcId:x.Ref(R),type:"private",cidr:oe,availabilityZone:se});if(h[he]=Le,C.push(he),d&&(!g||z===0)){let{eip:ye,logicalId:be}=S.createEip(`${i}-${se}`,s);h[be]=ye;let{natGateway:De,logicalId:Se}=S.createNatGateway({slug:`${i}-${se}`,environment:s,subnetId:x.Ref(ae)},be);De.DependsOn=L,h[Se]=De,v.push(Se);let{routeTable:Re,logicalId:$e}=S.createRouteTable(`${i}-${se}`,s,R,"private");h[$e]=Re,H.push($e);let{route:We,logicalId:G}=S.createRoute($e,"0.0.0.0/0",{type:"nat",logicalId:Se});h[G]=We;let{association:ne,logicalId:ie}=S.associateSubnetWithRouteTable(he,$e);h[ie]=ne}else if(d&&g&&z>0){let{association:ye,logicalId:be}=S.associateSubnetWithRouteTable(he,H[0]);h[be]=ye}else{let{routeTable:ye,logicalId:be}=S.createRouteTable(`${i}-${se}-isolated`,s,R,"private");h[be]=ye;let{association:De,logicalId:Se}=S.associateSubnetWithRouteTable(he,be);h[Se]=De}}if(y){let{flowLog:z,logicalId:se}=S.enableFlowLogs({slug:i,environment:s,resourceId:x.Ref(R),resourceType:"VPC"});h[se]=z}return{resources:h,outputs:{vpcId:R,publicSubnetIds:A,privateSubnetIds:C,natGatewayIds:v.length>0?v:void 0}}}static NatGatewayCostWarning=`
+`,instanceType:"t3.medium",allowedPorts:[22,6379]})}}class S{static createVpc(n){let{slug:i,environment:s,cidr:o="10.0.0.0/16",enableDnsHostnames:c=!0,enableDnsSupport:u=!0}=n,d=r({slug:i,environment:s,resourceType:"vpc"}),g=t(d);return{vpc:{Type:"AWS::EC2::VPC",Properties:{CidrBlock:o,EnableDnsHostnames:c,EnableDnsSupport:u,Tags:[{Key:"Name",Value:d},{Key:"Environment",Value:s}]}},logicalId:g}}static createSubnet(n){let{slug:i,environment:s,vpcId:o,type:c,cidr:u,availabilityZone:d,mapPublicIp:g=c==="public"}=n,y=r({slug:i,environment:s,resourceType:`subnet-${c}`}),h=t(`${y}-${d}`);return{subnet:{Type:"AWS::EC2::Subnet",Properties:{VpcId:o,CidrBlock:u,AvailabilityZone:d,MapPublicIpOnLaunch:g,Tags:[{Key:"Name",Value:`${y}-${d}`},{Key:"Environment",Value:s},{Key:"Type",Value:c}]}},logicalId:h}}static createInternetGateway(n,i){let s=r({slug:n,environment:i,resourceType:"igw"}),o=t(s);return{internetGateway:{Type:"AWS::EC2::InternetGateway",Properties:{Tags:[{Key:"Name",Value:s},{Key:"Environment",Value:i}]}},logicalId:o}}static attachInternetGateway(n,i){let s=t(`${n}-igw-attachment`);return{attachment:{Type:"AWS::EC2::VPCGatewayAttachment",Properties:{VpcId:x.Ref(n),InternetGatewayId:x.Ref(i)}},logicalId:s}}static createEip(n,i){let s=r({slug:n,environment:i,resourceType:"eip"}),o=t(s);return{eip:{Type:"AWS::EC2::EIP",Properties:{Domain:"vpc",Tags:[{Key:"Name",Value:s},{Key:"Environment",Value:i}]}},logicalId:o}}static createNatGateway(n,i){let{slug:s,environment:o,subnetId:c}=n,u=r({slug:s,environment:o,resourceType:"nat"}),d=t(u);return{natGateway:{Type:"AWS::EC2::NatGateway",Properties:{AllocationId:x.GetAtt(i,"AllocationId"),SubnetId:c,Tags:[{Key:"Name",Value:u},{Key:"Environment",Value:o},{Key:"Warning",Value:"NAT Gateway incurs hourly charges"}]}},logicalId:d}}static createRouteTable(n,i,s,o){let c=r({slug:n,environment:i,resourceType:`rt-${o}`}),u=t(c);return{routeTable:{Type:"AWS::EC2::RouteTable",Properties:{VpcId:x.Ref(s),Tags:[{Key:"Name",Value:c},{Key:"Environment",Value:i},{Key:"Type",Value:o}]}},logicalId:u}}static createRoute(n,i,s){let o=t(`${n}-route-${s.type}`),c={Type:"AWS::EC2::Route",Properties:{RouteTableId:x.Ref(n),DestinationCidrBlock:i}};if(s.type==="igw")c.Properties.GatewayId=x.Ref(s.logicalId);else if(s.type==="nat")c.Properties.NatGatewayId=x.Ref(s.logicalId);else if(s.type==="instance")c.Properties.InstanceId=x.Ref(s.logicalId);return{route:c,logicalId:o}}static associateSubnetWithRouteTable(n,i){let s=t(`${n}-rt-assoc`);return{association:{Type:"AWS::EC2::SubnetRouteTableAssociation",Properties:{SubnetId:x.Ref(n),RouteTableId:x.Ref(i)}},logicalId:s}}static enableFlowLogs(n){let{slug:i,environment:s,resourceId:o,resourceType:c,trafficType:u="ALL",logGroupName:d}=n,g=r({slug:i,environment:s,resourceType:"flowlog"}),y=t(g);return{flowLog:{Type:"AWS::EC2::FlowLog",Properties:{ResourceType:c,ResourceIds:[o],TrafficType:u,LogDestinationType:"cloud-watch-logs",LogGroupName:d||`/aws/vpc/${i}-${s}`,Tags:[{Key:"Name",Value:g},{Key:"Environment",Value:s}]}},logicalId:y}}static calculateSubnetCidrs(n,i,s=3){let[o,c]=n.split("/"),u=Number.parseInt(c,10),d=Math.ceil(Math.log2(i*s)),g=u+d;if(g>28)throw Error("VPC CIDR is too small to accommodate requested subnets");let[y,h,A,C]=o.split(".").map(Number),v=(y<<24)+(h<<16)+(A<<8)+C,T=2**(32-g),R=[];for(let P=0;P<i*s;P++){let I=v+P*T,M=[I>>>24&255,I>>>16&255,I>>>8&255,I&255].join(".");R.push(`${M}/${g}`)}return R}static getAvailabilityZones(n,i){return["a","b","c","d","e","f"].slice(0,i).map((o)=>`${n}${o}`)}static createMultiAzNetwork(n){let{slug:i,environment:s,region:o,cidr:c="10.0.0.0/16",zones:u=3,enableNatGateway:d=!1,singleNatGateway:g=!1,enableFlowLogs:y=!1}=n,h={},A=[],C=[],v=[],{vpc:T,logicalId:R}=S.createVpc({slug:i,environment:s,cidr:c});h[R]=T;let{internetGateway:P,logicalId:I}=S.createInternetGateway(i,s);h[I]=P;let{attachment:M,logicalId:L}=S.attachInternetGateway(R,I);h[L]=M;let{routeTable:N,logicalId:O}=S.createRouteTable(i,s,R,"public");h[O]=N;let{route:B,logicalId:F}=S.createRoute(O,"0.0.0.0/0",{type:"igw",logicalId:I});B.DependsOn=L,h[F]=B;let U=S.calculateSubnetCidrs(c,u,2),j=S.getAvailabilityZones(o,u),H=[];for(let z=0;z<u;z++){let se=j[z],ve=U[z*2],oe=U[z*2+1],{subnet:pe,logicalId:ae}=S.createSubnet({slug:i,environment:s,vpcId:x.Ref(R),type:"public",cidr:ve,availabilityZone:se});h[ae]=pe,A.push(ae);let{association:ce,logicalId:Ie}=S.associateSubnetWithRouteTable(ae,O);h[Ie]=ce;let{subnet:Le,logicalId:he}=S.createSubnet({slug:i,environment:s,vpcId:x.Ref(R),type:"private",cidr:oe,availabilityZone:se});if(h[he]=Le,C.push(he),d&&(!g||z===0)){let{eip:ye,logicalId:be}=S.createEip(`${i}-${se}`,s);h[be]=ye;let{natGateway:De,logicalId:Se}=S.createNatGateway({slug:`${i}-${se}`,environment:s,subnetId:x.Ref(ae)},be);De.DependsOn=L,h[Se]=De,v.push(Se);let{routeTable:Te,logicalId:$e}=S.createRouteTable(`${i}-${se}`,s,R,"private");h[$e]=Te,H.push($e);let{route:We,logicalId:G}=S.createRoute($e,"0.0.0.0/0",{type:"nat",logicalId:Se});h[G]=We;let{association:ne,logicalId:ie}=S.associateSubnetWithRouteTable(he,$e);h[ie]=ne}else if(d&&g&&z>0){let{association:ye,logicalId:be}=S.associateSubnetWithRouteTable(he,H[0]);h[be]=ye}else{let{routeTable:ye,logicalId:be}=S.createRouteTable(`${i}-${se}-isolated`,s,R,"private");h[be]=ye;let{association:De,logicalId:Se}=S.associateSubnetWithRouteTable(he,be);h[Se]=De}}if(y){let{flowLog:z,logicalId:se}=S.enableFlowLogs({slug:i,environment:s,resourceId:x.Ref(R),resourceType:"VPC"});h[se]=z}return{resources:h,outputs:{vpcId:R,publicSubnetIds:A,privateSubnetIds:C,natGatewayIds:v.length>0?v:void 0}}}static NatGatewayCostWarning=`
 ⚠️ NAT Gateway Cost Warning:
 - Each NAT Gateway costs approximately $32-45/month (hourly charges)
 - Data processing charges: $0.045/GB processed
@@ -2271,7 +2271,7 @@ function resolveTemplate(template, data) {
   }
   return result;
 }
-`;class X{static LambdaCode={send:Ct,receive:on,deliveryStatus:an};static createPinpointApp(n){return{[`${n.slug}PinpointApp`]:{Type:"AWS::Pinpoint::App",Properties:{Name:n.name||`${n.slug}-sms`}}}}static createSmsChannel(n){let i={ApplicationId:n.applicationId,Enabled:n.enabled!==!1};if(n.senderId)i.SenderId=n.senderId;if(n.shortCode)i.ShortCode=n.shortCode;return{[`${n.slug}SmsChannel`]:{Type:"AWS::Pinpoint::SMSChannel",Properties:i}}}static createSmsLambdaRole(n){return{[`${n.slug}SmsLambdaRole`]:{Type:"AWS::IAM::Role",Properties:{RoleName:`${n.slug}-sms-lambda-role`,AssumeRolePolicyDocument:{Version:"2012-10-17",Statement:[{Effect:"Allow",Principal:{Service:"lambda.amazonaws.com"},Action:"sts:AssumeRole"}]},ManagedPolicyArns:["arn:aws:iam::aws:policy/service-role/AWSLambdaBasicExecutionRole"],Policies:[{PolicyName:"SmsLambdaPolicy",PolicyDocument:{Version:"2012-10-17",Statement:[{Effect:"Allow",Action:["mobiletargeting:SendMessages","mobiletargeting:GetSmsChannel"],Resource:"*"},{Effect:"Allow",Action:["sns:Publish"],Resource:"*"},{Effect:"Allow",Action:["dynamodb:PutItem","dynamodb:UpdateItem","dynamodb:GetItem","dynamodb:DeleteItem"],Resource:"*"}]}}]}}}}static createSendLambda(n){return{[`${n.slug}SmsSendLambda`]:{Type:"AWS::Lambda::Function",Properties:{FunctionName:`${n.slug}-sms-send`,Runtime:"nodejs20.x",Handler:"index.handler",Role:n.roleArn,Timeout:30,MemorySize:256,Code:{ZipFile:X.LambdaCode.send},Environment:{Variables:{PINPOINT_APP_ID:n.pinpointAppId,MESSAGE_LOG_TABLE:n.messageLogTable||"",SMS_SENDER_ID:n.senderId||"",SMS_ORIGINATION_NUMBER:n.originationNumber||""}}}}}}static createReceiveLambda(n){return{[`${n.slug}SmsReceiveLambda`]:{Type:"AWS::Lambda::Function",Properties:{FunctionName:`${n.slug}-sms-receive`,Runtime:"nodejs20.x",Handler:"index.handler",Role:n.roleArn,Timeout:30,MemorySize:256,Code:{ZipFile:X.LambdaCode.receive},Environment:{Variables:{OPT_OUT_TABLE:n.optOutTable||"",MESSAGE_LOG_TABLE:n.messageLogTable||"",NOTIFICATION_TOPIC_ARN:n.notificationTopicArn||"",WEBHOOK_URL:n.webhookUrl||""}}}}}}static createDeliveryStatusLambda(n){return{[`${n.slug}SmsDeliveryStatusLambda`]:{Type:"AWS::Lambda::Function",Properties:{FunctionName:`${n.slug}-sms-delivery-status`,Runtime:"nodejs20.x",Handler:"index.handler",Role:n.roleArn,Timeout:30,MemorySize:256,Code:{ZipFile:X.LambdaCode.deliveryStatus},Environment:{Variables:{MESSAGE_LOG_TABLE:n.messageLogTable||"",NOTIFICATION_TOPIC_ARN:n.notificationTopicArn||"",WEBHOOK_URL:n.webhookUrl||""}}}}}}static createMessageLogTable(n){return{[`${n.slug}SmsMessageLogTable`]:{Type:"AWS::DynamoDB::Table",Properties:{TableName:`${n.slug}-sms-messages`,BillingMode:"PAY_PER_REQUEST",AttributeDefinitions:[{AttributeName:"messageId",AttributeType:"S"}],KeySchema:[{AttributeName:"messageId",KeyType:"HASH"}],TimeToLiveSpecification:{AttributeName:"ttl",Enabled:!0}}}}}static createOptOutTable(n){return{[`${n.slug}SmsOptOutTable`]:{Type:"AWS::DynamoDB::Table",Properties:{TableName:`${n.slug}-sms-optouts`,BillingMode:"PAY_PER_REQUEST",AttributeDefinitions:[{AttributeName:"phoneNumber",AttributeType:"S"}],KeySchema:[{AttributeName:"phoneNumber",KeyType:"HASH"}]}}}}static createNotificationTopic(n){return{[`${n.slug}SmsNotificationTopic`]:{Type:"AWS::SNS::Topic",Properties:{TopicName:`${n.slug}-sms-notifications`}}}}static createCompleteSetup(n){let i={},s={};Object.assign(i,X.createPinpointApp({slug:n.slug})),Object.assign(i,X.createSmsChannel({slug:n.slug,applicationId:{Ref:`${n.slug}PinpointApp`},senderId:n.senderId})),Object.assign(i,X.createSmsLambdaRole({slug:n.slug})),Object.assign(i,X.createMessageLogTable({slug:n.slug})),Object.assign(i,X.createOptOutTable({slug:n.slug})),Object.assign(i,X.createNotificationTopic({slug:n.slug}));let o={"Fn::GetAtt":[`${n.slug}SmsLambdaRole`,"Arn"]},c={Ref:`${n.slug}PinpointApp`},u={Ref:`${n.slug}SmsMessageLogTable`},d={Ref:`${n.slug}SmsOptOutTable`},g={Ref:`${n.slug}SmsNotificationTopic`};if(Object.assign(i,X.createSendLambda({slug:n.slug,roleArn:o,pinpointAppId:c,messageLogTable:u,senderId:n.senderId,originationNumber:n.originationNumber})),n.twoWayEnabled)Object.assign(i,X.createReceiveLambda({slug:n.slug,roleArn:o,optOutTable:d,messageLogTable:u,notificationTopicArn:g,webhookUrl:n.webhookUrl}));return Object.assign(i,X.createDeliveryStatusLambda({slug:n.slug,roleArn:o,messageLogTable:u,notificationTopicArn:g,webhookUrl:n.webhookUrl})),s[`${n.slug}PinpointAppId`]={Description:"Pinpoint application ID",Value:{Ref:`${n.slug}PinpointApp`}},s[`${n.slug}SmsSendLambdaArn`]={Description:"SMS send Lambda ARN",Value:{"Fn::GetAtt":[`${n.slug}SmsSendLambda`,"Arn"]}},s[`${n.slug}SmsNotificationTopicArn`]={Description:"SMS notification topic ARN",Value:{Ref:`${n.slug}SmsNotificationTopic`}},s[`${n.slug}SmsMessageLogTableName`]={Description:"SMS message log table name",Value:{Ref:`${n.slug}SmsMessageLogTable`}},{resources:i,outputs:s}}}function vt(n){return n.replace(/[^a-zA-Z0-9]/g," ").trim().split(/\s+/).map((o)=>o.charAt(0).toUpperCase()+o.slice(1)).join("")||"User"}function Er(n,i){let s=(n||i).replace(/^\/+|\/+$/g,"");if(!s||s.split("/").includes(".."))throw Error(`sftp: invalid homeDirectory for user ${i}`);return s}function wr(n){let i=n.storage;if(i?.type==="efs"){let o="fileSystemId"in i?i.fileSystemId:void 0;if(!o||typeof o==="string"&&!o.trim())throw Error("sftp: EFS storage requires fileSystemId, or a fileSystem name defined in infrastructure.fileSystem");return{type:"efs",fileSystemId:o,posixProfile:i.posixProfile}}let s=(i?.type==="s3"?i.bucket??n.bucket:n.bucket)?.trim();if(!s)throw Error("sftp: S3 storage requires bucket, or a storageBucket name defined in infrastructure.storage");return{type:"s3",bucket:s}}function Ir(n,i,s){let o=i.posixProfile??s;if(!o)throw Error(`sftp: user ${n} requires a posixProfile (uid/gid) on an EFS-backed server`);for(let c of[o.uid,o.gid,...o.secondaryGids??[]])if(!Number.isInteger(c)||c<0||c>4294967295)throw Error(`sftp: user ${n} has an invalid posixProfile id ${c}`);return{Uid:o.uid,Gid:o.gid,...o.secondaryGids?.length?{SecondaryGids:o.secondaryGids}:{}}}function Dr(n,i){return typeof n==="string"?`/${n}/${i}`:{"Fn::Sub":[`/\${FileSystemId}/${i}`,{FileSystemId:n}]}}function Nr(n){return typeof n==="string"?{"Fn::Sub":"arn:aws:elasticfilesystem:${AWS::Region}:${AWS::AccountId}:file-system/${FileSystemId}".replace("${FileSystemId}",n)}:{"Fn::Sub":["arn:aws:elasticfilesystem:${AWS::Region}:${AWS::AccountId}:file-system/${FileSystemId}",{FileSystemId:n}]}}class pl{static create(n){let i=wr(n),s=i.type==="efs"?"EFS":"S3",o=n.endpointType??"PUBLIC";if(o==="VPC"&&(!n.endpointDetails?.vpcId||!n.endpointDetails.subnetIds.length))throw Error("sftp: VPC endpoints require endpointDetails.vpcId and at least one subnet");let c=`${vt(n.slug)}${vt(n.environment)}Sftp`,u=`${c}Server`,d={},g;if(n.logging!==!1){let y=`${c}LoggingRole`;d[y]={Type:"AWS::IAM::Role",Properties:{AssumeRolePolicyDocument:{Version:"2012-10-17",Statement:[{Effect:"Allow",Principal:{Service:"transfer.amazonaws.com"},Action:"sts:AssumeRole"}]},Policies:[{PolicyName:"TransferLogging",PolicyDocument:{Version:"2012-10-17",Statement:[{Effect:"Allow",Action:["logs:CreateLogGroup","logs:CreateLogStream","logs:DescribeLogStreams","logs:PutLogEvents"],Resource:"arn:aws:logs:*:*:log-group:/aws/transfer/*"}]}}]}},g={"Fn::GetAtt":[y,"Arn"]}}d[u]={Type:"AWS::Transfer::Server",Properties:{Domain:s,EndpointType:o,IdentityProviderType:"SERVICE_MANAGED",Protocols:["SFTP"],...o==="VPC"?{EndpointDetails:{VpcId:n.endpointDetails.vpcId,SubnetIds:n.endpointDetails.subnetIds,...n.endpointDetails.securityGroupIds?.length?{SecurityGroupIds:n.endpointDetails.securityGroupIds}:{},...n.endpointDetails.addressAllocationIds?.length?{AddressAllocationIds:n.endpointDetails.addressAllocationIds}:{}}}:{},...n.securityPolicyName?{SecurityPolicyName:n.securityPolicyName}:{},...g?{LoggingRole:g}:{},Tags:[{Key:"Project",Value:n.slug},{Key:"Environment",Value:n.environment},{Key:"ManagedBy",Value:"ts-cloud"}]}};for(let[y,h]of Object.entries(n.users)){if(!/^[a-zA-Z0-9_.@-]{3,100}$/.test(y))throw Error(`sftp: invalid username ${y}`);if(!h.sshPublicKeys.length)throw Error(`sftp: user ${y} requires at least one SSH public key`);let A=vt(y),C=Er(h.homeDirectory,y),v=`${c}${A}User`,T=h.roleArn;if(!T){let R=`${c}${A}Role`,P;if(i.type==="efs")P=[{Effect:"Allow",Action:["elasticfilesystem:ClientMount","elasticfilesystem:ClientWrite","elasticfilesystem:DescribeMountTargets"],Resource:Nr(i.fileSystemId)}];else{let I=`arn:aws:s3:::${i.bucket}`;P=[{Effect:"Allow",Action:["s3:ListBucket","s3:GetBucketLocation"],Resource:I,Condition:{StringLike:{"s3:prefix":[C,`${C}/*`]}}},{Effect:"Allow",Action:["s3:GetObject","s3:PutObject","s3:DeleteObject","s3:GetObjectVersion"],Resource:`${I}/${C}/*`}]}d[R]={Type:"AWS::IAM::Role",Properties:{AssumeRolePolicyDocument:{Version:"2012-10-17",Statement:[{Effect:"Allow",Principal:{Service:"transfer.amazonaws.com"},Action:"sts:AssumeRole"}]},Policies:[{PolicyName:"SftpHomeDirectory",PolicyDocument:{Version:"2012-10-17",Statement:P}}]}},T={"Fn::GetAtt":[R,"Arn"]}}d[v]={Type:"AWS::Transfer::User",DependsOn:[u],Properties:{ServerId:{Ref:u},UserName:y,Role:T,HomeDirectoryType:"PATH",HomeDirectory:i.type==="efs"?Dr(i.fileSystemId,C):`/${i.bucket}/${C}`,...i.type==="efs"?{PosixProfile:Ir(y,h,i.posixProfile)}:{},SshPublicKeys:h.sshPublicKeys}}}return{resources:d,serverLogicalId:u,domain:s}}}class Oe{static createBedrockRole(n,i){let{slug:s,environment:o,name:c,models:u=["*"],allowStreaming:d=!0}=i,g=c||r({slug:s,environment:o,resourceType:"bedrock-role"}),y=t(g),h=["bedrock:InvokeModel"];if(d)h.push("bedrock:InvokeModelWithResponseStream");let A=u.map((v)=>v==="*"?"arn:aws:bedrock:*::foundation-model/*":`arn:aws:bedrock:*::foundation-model/${v}`);return{role:{Type:"AWS::IAM::Role",Properties:{RoleName:g,AssumeRolePolicyDocument:{Version:"2012-10-17",Statement:[{Effect:"Allow",Principal:{Service:n},Action:"sts:AssumeRole"}]},Policies:[{PolicyName:`${g}-policy`,PolicyDocument:{Version:"2012-10-17",Statement:[{Effect:"Allow",Action:h,Resource:A}]}}],Tags:[{Key:"Name",Value:g},{Key:"Environment",Value:o}]}},logicalId:y}}static createBedrockPolicy(n){let{slug:i,environment:s,name:o,models:c=["*"],allowInvoke:u=!0,allowStreaming:d=!0,allowAsync:g=!1}=n,y=o||r({slug:i,environment:s,resourceType:"bedrock-policy"}),h=t(y),A=[];if(u)A.push("bedrock:InvokeModel");if(d)A.push("bedrock:InvokeModelWithResponseStream");if(g)A.push("bedrock:InvokeModelAsync");let C=c.map((T)=>T==="*"?"arn:aws:bedrock:*::foundation-model/*":`arn:aws:bedrock:*::foundation-model/${T}`);return{policy:{Type:"AWS::IAM::ManagedPolicy",Properties:{ManagedPolicyName:y,PolicyDocument:{Version:"2012-10-17",Statement:[{Sid:"BedrockModelInvocation",Effect:"Allow",Action:A,Resource:C}]}}},logicalId:h}}static enableBedrockForLambda(n){return Oe.createBedrockRole("lambda.amazonaws.com",n)}static enableBedrockForEcs(n){return Oe.createBedrockRole("ecs-tasks.amazonaws.com",n)}static enableBedrockForEc2(n){return Oe.createBedrockRole("ec2.amazonaws.com",n)}static addBedrockPermissions(n,i=["*"],s=!0){let o=["bedrock:InvokeModel"];if(s)o.push("bedrock:InvokeModelWithResponseStream");let c=i.map((u)=>u==="*"?"arn:aws:bedrock:*::foundation-model/*":`arn:aws:bedrock:*::foundation-model/${u}`);if(!n.Properties.Policies)n.Properties.Policies=[];return n.Properties.Policies.push({PolicyName:"bedrock-permissions",PolicyDocument:{Version:"2012-10-17",Statement:[{Effect:"Allow",Action:o,Resource:c}]}}),n}static Models={Claude3_5_Sonnet:"anthropic.claude-3-5-sonnet-20241022-v2:0",Claude3_5_Haiku:"anthropic.claude-3-5-haiku-20241022-v1:0",Claude3_Opus:"anthropic.claude-3-opus-20240229-v1:0",Claude3_Sonnet:"anthropic.claude-3-sonnet-20240229-v1:0",Claude3_Haiku:"anthropic.claude-3-haiku-20240307-v1:0",TitanTextG1Express:"amazon.titan-text-express-v1",TitanTextG1Lite:"amazon.titan-text-lite-v1",TitanEmbedG1Text:"amazon.titan-embed-text-v1",TitanImageG1:"amazon.titan-image-generator-v1",JurassicUltra:"ai21.j2-ultra-v1",JurassicMid:"ai21.j2-mid-v1",CommandText:"cohere.command-text-v14",CommandLight:"cohere.command-light-text-v14",EmbedEnglish:"cohere.embed-english-v3",EmbedMultilingual:"cohere.embed-multilingual-v3",Llama3_2_1B:"meta.llama3-2-1b-instruct-v1:0",Llama3_2_3B:"meta.llama3-2-3b-instruct-v1:0",Llama3_2_11B:"meta.llama3-2-11b-instruct-v1:0",Llama3_2_90B:"meta.llama3-2-90b-instruct-v1:0",Llama3_1_8B:"meta.llama3-1-8b-instruct-v1:0",Llama3_1_70B:"meta.llama3-1-70b-instruct-v1:0",Llama3_1_405B:"meta.llama3-1-405b-instruct-v1:0",Mistral7B:"mistral.mistral-7b-instruct-v0:2",Mixtral8x7B:"mistral.mixtral-8x7b-instruct-v0:1",MistralLarge:"mistral.mistral-large-2402-v1:0",StableDiffusionXL:"stability.stable-diffusion-xl-v1"};static ModelGroups={AllClaude:["anthropic.claude-3-5-sonnet-20241022-v2:0","anthropic.claude-3-5-haiku-20241022-v1:0","anthropic.claude-3-opus-20240229-v1:0","anthropic.claude-3-sonnet-20240229-v1:0","anthropic.claude-3-haiku-20240307-v1:0"],AllTitan:["amazon.titan-text-express-v1","amazon.titan-text-lite-v1","amazon.titan-embed-text-v1","amazon.titan-image-generator-v1"],AllLlama:["meta.llama3-2-1b-instruct-v1:0","meta.llama3-2-3b-instruct-v1:0","meta.llama3-2-11b-instruct-v1:0","meta.llama3-2-90b-instruct-v1:0","meta.llama3-1-8b-instruct-v1:0","meta.llama3-1-70b-instruct-v1:0","meta.llama3-1-405b-instruct-v1:0"],TextModels:["anthropic.claude-3-5-sonnet-20241022-v2:0","anthropic.claude-3-5-haiku-20241022-v1:0","amazon.titan-text-express-v1","meta.llama3-2-11b-instruct-v1:0","mistral.mistral-7b-instruct-v0:2"],EmbeddingModels:["amazon.titan-embed-text-v1","cohere.embed-english-v3","cohere.embed-multilingual-v3"],ImageModels:["amazon.titan-image-generator-v1","stability.stable-diffusion-xl-v1"]}}class ur{static createPostgres(n){return ur.createRDSInstance("postgres","16.2",n)}static createMysql(n){return ur.createRDSInstance("mysql","8.0.35",n)}static createRDSInstance(n,i,s){let{slug:o,environment:c,instanceClass:u="db.t3.micro",allocatedStorage:d=20,storageType:g="gp3",masterUsername:y="admin",masterPassword:h,databaseName:A,subnetIds:C,securityGroupIds:v,encrypted:T=!0,kmsKeyId:R,multiAz:P=!1,backupRetentionDays:I=7,publiclyAccessible:M=!1,enableCloudwatchLogs:L=!0,deletionProtection:N=!0}=s,O=r({slug:o,environment:c,resourceType:`${n}-db`}),B=t(O),F,U;if(C&&C.length>0){let H=r({slug:o,environment:c,resourceType:"db-subnet-group"});U=t(H),F={Type:"AWS::RDS::DBSubnetGroup",Properties:{DBSubnetGroupName:H,DBSubnetGroupDescription:`Subnet group for ${O}`,SubnetIds:C,Tags:[{Key:"Name",Value:H},{Key:"Environment",Value:c}]}}}let j={Type:"AWS::RDS::DBInstance",Properties:{DBInstanceIdentifier:O,DBInstanceClass:u,Engine:n,EngineVersion:i,MasterUsername:y,MasterUserPassword:h,AllocatedStorage:d,StorageType:g,StorageEncrypted:T,MultiAZ:P,BackupRetentionPeriod:I,PubliclyAccessible:M,DeletionProtection:N,Tags:[{Key:"Name",Value:O},{Key:"Environment",Value:c}]}};if(A)j.Properties.DBName=A;if(R)j.Properties.KmsKeyId=R;if(U)j.Properties.DBSubnetGroupName=x.Ref(U);if(v&&v.length>0)j.Properties.VPCSecurityGroups=v;if(L)j.Properties.EnableCloudwatchLogsExports=n==="postgres"?["postgresql"]:["error","general","slowquery"];return{dbInstance:j,subnetGroup:F,logicalId:B,subnetGroupId:U}}static createReadReplica(n,i){let{slug:s,environment:o,instanceClass:c="db.t3.micro",securityGroupIds:u,publiclyAccessible:d=!1}=i,g=r({slug:s,environment:o,resourceType:"db-replica"}),y=t(g),h={Type:"AWS::RDS::DBInstance",Properties:{DBInstanceIdentifier:g,DBInstanceClass:c,SourceDBInstanceIdentifier:x.Ref(n),PubliclyAccessible:d,Tags:[{Key:"Name",Value:g},{Key:"Environment",Value:o},{Key:"Type",Value:"ReadReplica"}]}};if(u&&u.length>0)h.Properties.VPCSecurityGroups=u;return{replica:h,logicalId:y}}static createParameterGroup(n,i,s){let{slug:o,environment:c,parameters:u={}}=s,d=r({slug:o,environment:c,resourceType:"db-params"}),g=t(d),y=n==="postgres"?`postgres${i.split(".")[0]}`:`mysql${i.split(".")[0]}.${i.split(".")[1]}`;return{parameterGroup:{Type:"AWS::RDS::DBParameterGroup",Properties:{DBParameterGroupName:d,Description:`Parameter group for ${d}`,Family:y,Parameters:u,Tags:[{Key:"Name",Value:d},{Key:"Environment",Value:c}]}},logicalId:g}}static enableBackup(n,i=7){return n.Properties.BackupRetentionPeriod=i,n}static createTable(n){let{slug:i,environment:s,tableName:o,partitionKey:c,sortKey:u,billingMode:d="PAY_PER_REQUEST",readCapacity:g=5,writeCapacity:y=5,streamEnabled:h=!1,streamViewType:A="NEW_AND_OLD_IMAGES",encrypted:C=!0,kmsKeyId:v,pointInTimeRecovery:T=!0,ttlAttribute:R}=n,P=o||r({slug:i,environment:s,resourceType:"table"}),I=t(P),M=[{AttributeName:c.name,AttributeType:c.type}];if(u)M.push({AttributeName:u.name,AttributeType:u.type});let L=[{AttributeName:c.name,KeyType:"HASH"}];if(u)L.push({AttributeName:u.name,KeyType:"RANGE"});let N={Type:"AWS::DynamoDB::Table",Properties:{TableName:P,BillingMode:d,AttributeDefinitions:M,KeySchema:L,Tags:[{Key:"Name",Value:P},{Key:"Environment",Value:s}]}};if(d==="PROVISIONED")N.Properties.ProvisionedThroughput={ReadCapacityUnits:g,WriteCapacityUnits:y};if(h)N.Properties.StreamSpecification={StreamViewType:A};if(C)N.Properties.SSESpecification={SSEEnabled:!0,SSEType:v?"KMS":"AES256",KMSMasterKeyId:v};if(T)N.Properties.PointInTimeRecoverySpecification={PointInTimeRecoveryEnabled:!0};if(R)N.Properties.TimeToLiveSpecification={AttributeName:R,Enabled:!0};return{table:N,logicalId:I}}static addGlobalSecondaryIndex(n,i){let{indexName:s,partitionKey:o,sortKey:c,projectionType:u="ALL",nonKeyAttributes:d,readCapacity:g=5,writeCapacity:y=5}=i;if(!n.Properties.AttributeDefinitions.some((C)=>C.AttributeName===o.name))n.Properties.AttributeDefinitions.push({AttributeName:o.name,AttributeType:o.type});if(c&&!n.Properties.AttributeDefinitions.some((C)=>C.AttributeName===c.name))n.Properties.AttributeDefinitions.push({AttributeName:c.name,AttributeType:c.type});let h=[{AttributeName:o.name,KeyType:"HASH"}];if(c)h.push({AttributeName:c.name,KeyType:"RANGE"});let A={IndexName:s,KeySchema:h,Projection:{ProjectionType:u,NonKeyAttributes:u==="INCLUDE"?d:void 0},ProvisionedThroughput:void 0};if(n.Properties.BillingMode==="PROVISIONED")A.ProvisionedThroughput={ReadCapacityUnits:g,WriteCapacityUnits:y};if(!n.Properties.GlobalSecondaryIndexes)n.Properties.GlobalSecondaryIndexes=[];return n.Properties.GlobalSecondaryIndexes.push(A),n}static enableStreams(n,i="NEW_AND_OLD_IMAGES"){return n.Properties.StreamSpecification={StreamViewType:i},n}static InstanceClasses={T3_Micro:"db.t3.micro",T3_Small:"db.t3.small",T3_Medium:"db.t3.medium",T3_Large:"db.t3.large",T4g_Micro:"db.t4g.micro",T4g_Small:"db.t4g.small",T4g_Medium:"db.t4g.medium",M5_Large:"db.m5.large",M5_XLarge:"db.m5.xlarge",M5_2XLarge:"db.m5.2xlarge",R5_Large:"db.r5.large",R5_XLarge:"db.r5.xlarge",R5_2XLarge:"db.r5.2xlarge"}}class qo{static createRedis(n){let{slug:i,environment:s,nodeType:o="cache.t3.micro",engineVersion:c="7.1",port:u=6379,subnetIds:d,securityGroupIds:g,numCacheClusters:y=2,automaticFailover:h=!0,multiAz:A=!0,clusterMode:C=!1,numNodeGroups:v=1,replicasPerNodeGroup:T=1,atRestEncryption:R=!0,transitEncryption:P=!0,authToken:I,kmsKeyId:M,snapshotRetentionDays:L=7,snapshotWindow:N,maintenanceWindow:O}=n,B=r({slug:i,environment:s,resourceType:"redis"}),F=t(B),U,j;if(d&&d.length>0){let z=r({slug:i,environment:s,resourceType:"cache-subnet-group"});j=t(z),U={Type:"AWS::ElastiCache::SubnetGroup",Properties:{CacheSubnetGroupName:z,Description:`Subnet group for ${B}`,SubnetIds:d,Tags:[{Key:"Name",Value:z},{Key:"Environment",Value:s}]}}}let H={Type:"AWS::ElastiCache::ReplicationGroup",Properties:{ReplicationGroupId:B,ReplicationGroupDescription:`Redis cluster for ${i} ${s}`,Engine:"redis",EngineVersion:c,CacheNodeType:o,Port:u,AutomaticFailoverEnabled:h,MultiAZEnabled:A,AtRestEncryptionEnabled:R,TransitEncryptionEnabled:P,SnapshotRetentionLimit:L,AutoMinorVersionUpgrade:!0,Tags:[{Key:"Name",Value:B},{Key:"Environment",Value:s}]}};if(C)H.Properties.NumNodeGroups=v,H.Properties.ReplicasPerNodeGroup=T;else H.Properties.NumCacheClusters=y;if(I)H.Properties.AuthToken=I;if(M)H.Properties.KmsKeyId=M;if(j)H.Properties.CacheSubnetGroupName=x.Ref(j);if(g&&g.length>0)H.Properties.SecurityGroupIds=g;if(N)H.Properties.SnapshotWindow=N;if(O)H.Properties.PreferredMaintenanceWindow=O;return{replicationGroup:H,subnetGroup:U,logicalId:F,subnetGroupId:j}}static createMemcached(n){let{slug:i,environment:s,nodeType:o="cache.t3.micro",engineVersion:c="1.6.22",port:u=11211,numCacheNodes:d=2,subnetIds:g,securityGroupIds:y,azMode:h="cross-az",preferredAzs:A,maintenanceWindow:C}=n,v=r({slug:i,environment:s,resourceType:"memcached"}),T=t(v),R,P;if(g&&g.length>0){let M=r({slug:i,environment:s,resourceType:"cache-subnet-group"});P=t(M),R={Type:"AWS::ElastiCache::SubnetGroup",Properties:{CacheSubnetGroupName:M,Description:`Subnet group for ${v}`,SubnetIds:g,Tags:[{Key:"Name",Value:M},{Key:"Environment",Value:s}]}}}let I={Type:"AWS::ElastiCache::CacheCluster",Properties:{ClusterName:v,CacheNodeType:o,Engine:"memcached",EngineVersion:c,NumCacheNodes:d,Port:u,AZMode:h,AutoMinorVersionUpgrade:!0,Tags:[{Key:"Name",Value:v},{Key:"Environment",Value:s}]}};if(P)I.Properties.CacheSubnetGroupName=x.Ref(P);if(y&&y.length>0)I.Properties.VpcSecurityGroupIds=y;if(A&&A.length>0)I.Properties.PreferredAvailabilityZones=A;if(C)I.Properties.PreferredMaintenanceWindow=C;return{cluster:I,subnetGroup:R,logicalId:T,subnetGroupId:P}}static enableClusterMode(n,i=3,s=2){return delete n.Properties.NumCacheClusters,n.Properties.NumNodeGroups=i,n.Properties.ReplicasPerNodeGroup=s,n}static createRedisParameterGroup(n,i){let{slug:s,environment:o,parameters:c={}}=i,u=r({slug:s,environment:o,resourceType:"redis-params"}),d=t(u);return{parameterGroup:{Type:"AWS::ElastiCache::ParameterGroup",Properties:{CacheParameterGroupFamily:`redis${n.split(".")[0]}.x`,Description:`Parameter group for ${u}`,Properties:c,Tags:[{Key:"Name",Value:u},{Key:"Environment",Value:o}]}},logicalId:d}}static createMemcachedParameterGroup(n,i){let{slug:s,environment:o,parameters:c={}}=i,u=r({slug:s,environment:o,resourceType:"memcached-params"}),d=t(u);return{parameterGroup:{Type:"AWS::ElastiCache::ParameterGroup",Properties:{CacheParameterGroupFamily:`memcached${n.split(".")[0]}.${n.split(".")[1]}`,Description:`Parameter group for ${u}`,Properties:c,Tags:[{Key:"Name",Value:u},{Key:"Environment",Value:o}]}},logicalId:d}}static NodeTypes={T3_Micro:"cache.t3.micro",T3_Small:"cache.t3.small",T3_Medium:"cache.t3.medium",T4g_Micro:"cache.t4g.micro",T4g_Small:"cache.t4g.small",T4g_Medium:"cache.t4g.medium",M5_Large:"cache.m5.large",M5_XLarge:"cache.m5.xlarge",M5_2XLarge:"cache.m5.2xlarge",R5_Large:"cache.r5.large",R5_XLarge:"cache.r5.xlarge",R5_2XLarge:"cache.r5.2xlarge",R5_4XLarge:"cache.r5.4xlarge",R6g_Large:"cache.r6g.large",R6g_XLarge:"cache.r6g.xlarge",R6g_2XLarge:"cache.r6g.2xlarge"}}class le{static createUser(n){let{slug:i,environment:s,userName:o,groups:c,managedPolicyArns:u}=n,d=o||r({slug:i,environment:s,resourceType:"user"}),g=t(d),y={Type:"AWS::IAM::User",Properties:{UserName:d,Tags:[{Key:"Name",Value:d},{Key:"Environment",Value:s}]}};if(c&&c.length>0)y.Properties.Groups=c;if(u&&u.length>0)y.Properties.ManagedPolicyArns=u;return{user:y,logicalId:g}}static createRole(n){let{slug:i,environment:s,roleName:o,servicePrincipal:c,awsPrincipal:u,managedPolicyArns:d}=n,g=o||r({slug:i,environment:s,resourceType:"role"}),y=t(g),h={};if(c)h.Service=c;if(u)h.AWS=u;let A={Type:"AWS::IAM::Role",Properties:{RoleName:g,AssumeRolePolicyDocument:{Version:"2012-10-17",Statement:[{Effect:"Allow",Principal:h,Action:"sts:AssumeRole"}]},Tags:[{Key:"Name",Value:g},{Key:"Environment",Value:s}]}};if(d&&d.length>0)A.Properties.ManagedPolicyArns=d;return{role:A,logicalId:y}}static createGroup(n){let{slug:i,environment:s,groupName:o,managedPolicyArns:c}=n,u=o||r({slug:i,environment:s,resourceType:"group"}),d=t(u),g={Type:"AWS::IAM::Group",Properties:{GroupName:u}};if(c&&c.length>0)g.Properties.ManagedPolicyArns=c;return{group:g,logicalId:d}}static createPolicy(n){let{slug:i,environment:s,policyName:o,description:c,statements:u}=n,d=o||r({slug:i,environment:s,resourceType:"policy"}),g=t(d),y=u.map((A)=>({Sid:A.sid,Effect:A.effect||"Allow",Action:A.actions,Resource:A.resources,Condition:A.conditions}));return{policy:{Type:"AWS::IAM::ManagedPolicy",Properties:{ManagedPolicyName:d,Description:c||`Managed policy for ${d}`,PolicyDocument:{Version:"2012-10-17",Statement:y}}},logicalId:g}}static attachPolicyToRole(n,i){if(!n.Properties.ManagedPolicyArns)n.Properties.ManagedPolicyArns=[];if(!n.Properties.ManagedPolicyArns.includes(i))n.Properties.ManagedPolicyArns.push(i);return n}static attachPolicyToUser(n,i){if(!n.Properties.ManagedPolicyArns)n.Properties.ManagedPolicyArns=[];if(!n.Properties.ManagedPolicyArns.includes(i))n.Properties.ManagedPolicyArns.push(i);return n}static attachPolicyToGroup(n,i){if(!n.Properties.ManagedPolicyArns)n.Properties.ManagedPolicyArns=[];if(!n.Properties.ManagedPolicyArns.includes(i))n.Properties.ManagedPolicyArns.push(i);return n}static addInlinePolicyToRole(n,i,s){if(!n.Properties.Policies)n.Properties.Policies=[];let o=s.map((c)=>({Effect:c.effect||"Allow",Action:c.actions,Resource:c.resources}));return n.Properties.Policies.push({PolicyName:i,PolicyDocument:{Version:"2012-10-17",Statement:o}}),n}static addInlinePolicyToUser(n,i,s){if(!n.Properties.Policies)n.Properties.Policies=[];let o=s.map((c)=>({Effect:c.effect||"Allow",Action:c.actions,Resource:c.resources}));return n.Properties.Policies.push({PolicyName:i,PolicyDocument:{Version:"2012-10-17",Statement:o}}),n}static createAccessKey(n,i){let{slug:s,environment:o,status:c="Active"}=i,u=r({slug:s,environment:o,resourceType:"access-key"}),d=t(u);return{accessKey:{Type:"AWS::IAM::AccessKey",Properties:{UserName:x.Ref(n),Status:c}},logicalId:d}}static createInstanceProfile(n,i){let{slug:s,environment:o,profileName:c}=i,u=c||r({slug:s,environment:o,resourceType:"instance-profile"}),d=t(u);return{instanceProfile:{Type:"AWS::IAM::InstanceProfile",Properties:{InstanceProfileName:u,Roles:[x.Ref(n)]}},logicalId:d}}static ManagedPolicies={AdministratorAccess:"arn:aws:iam::aws:policy/AdministratorAccess",PowerUserAccess:"arn:aws:iam::aws:policy/PowerUserAccess",ReadOnlyAccess:"arn:aws:iam::aws:policy/ReadOnlyAccess",S3FullAccess:"arn:aws:iam::aws:policy/AmazonS3FullAccess",S3ReadOnlyAccess:"arn:aws:iam::aws:policy/AmazonS3ReadOnlyAccess",DynamoDBFullAccess:"arn:aws:iam::aws:policy/AmazonDynamoDBFullAccess",DynamoDBReadOnlyAccess:"arn:aws:iam::aws:policy/AmazonDynamoDBReadOnlyAccess",RDSFullAccess:"arn:aws:iam::aws:policy/AmazonRDSFullAccess",RDSReadOnlyAccess:"arn:aws:iam::aws:policy/AmazonRDSReadOnlyAccess",LambdaFullAccess:"arn:aws:iam::aws:policy/AWSLambda_FullAccess",LambdaReadOnlyAccess:"arn:aws:iam::aws:policy/AWSLambda_ReadOnlyAccess",LambdaBasicExecutionRole:"arn:aws:iam::aws:policy/service-role/AWSLambdaBasicExecutionRole",LambdaVPCAccessExecutionRole:"arn:aws:iam::aws:policy/service-role/AWSLambdaVPCAccessExecutionRole",EC2FullAccess:"arn:aws:iam::aws:policy/AmazonEC2FullAccess",EC2ReadOnlyAccess:"arn:aws:iam::aws:policy/AmazonEC2ReadOnlyAccess",EC2ContainerRegistryReadOnly:"arn:aws:iam::aws:policy/AmazonEC2ContainerRegistryReadOnly",EC2ContainerRegistryPowerUser:"arn:aws:iam::aws:policy/AmazonEC2ContainerRegistryPowerUser",ECSTaskExecutionRole:"arn:aws:iam::aws:policy/service-role/AmazonECSTaskExecutionRolePolicy",ECSFullAccess:"arn:aws:iam::aws:policy/AmazonECS_FullAccess",CloudWatchFullAccess:"arn:aws:iam::aws:policy/CloudWatchFullAccess",CloudWatchLogsFullAccess:"arn:aws:iam::aws:policy/CloudWatchLogsFullAccess",SESFullAccess:"arn:aws:iam::aws:policy/AmazonSESFullAccess",SNSFullAccess:"arn:aws:iam::aws:policy/AmazonSNSFullAccess",SQSFullAccess:"arn:aws:iam::aws:policy/AmazonSQSFullAccess",SecretsManagerReadWrite:"arn:aws:iam::aws:policy/SecretsManagerReadWrite"};static ServicePrincipals={Lambda:"lambda.amazonaws.com",EC2:"ec2.amazonaws.com",ECS:"ecs.amazonaws.com",ECSTaskExecution:"ecs-tasks.amazonaws.com",APIGateway:"apigateway.amazonaws.com",Events:"events.amazonaws.com",States:"states.amazonaws.com",CodeBuild:"codebuild.amazonaws.com",CodeDeploy:"codedeploy.amazonaws.com",CloudFormation:"cloudformation.amazonaws.com"};static createCiCdUser(n){let{slug:i,environment:s,permissions:o,createAccessKey:c=!0}=n,u={},d=[];if(o.s3Buckets&&o.s3Buckets.length>0)d.push({sid:"S3Access",actions:["s3:GetBucketLocation","s3:ListBucket","s3:GetObject","s3:PutObject","s3:DeleteObject","s3:ListBucketMultipartUploads","s3:AbortMultipartUpload"],resources:[...o.s3Buckets,...o.s3Buckets.map((T)=>`${T}/*`)]});if(o.cloudFrontDistributions&&o.cloudFrontDistributions.length>0)d.push({sid:"CloudFrontAccess",actions:["cloudfront:CreateInvalidation","cloudfront:GetInvalidation","cloudfront:ListInvalidations","cloudfront:GetDistribution"],resources:o.cloudFrontDistributions});if(o.ecrRepositories&&o.ecrRepositories.length>0)d.push({sid:"ECRAccess",actions:["ecr:GetAuthorizationToken","ecr:BatchCheckLayerAvailability","ecr:GetDownloadUrlForLayer","ecr:GetRepositoryPolicy","ecr:DescribeRepositories","ecr:ListImages","ecr:DescribeImages","ecr:BatchGetImage","ecr:InitiateLayerUpload","ecr:UploadLayerPart","ecr:CompleteLayerUpload","ecr:PutImage"],resources:o.ecrRepositories}),d.push({sid:"ECRLogin",actions:["ecr:GetAuthorizationToken"],resources:"*"});if(o.ecsServices&&o.ecsServices.length>0)d.push({sid:"ECSAccess",actions:["ecs:DescribeServices","ecs:DescribeTaskDefinition","ecs:DescribeTasks","ecs:ListTasks","ecs:RegisterTaskDefinition","ecs:UpdateService","ecs:RunTask","ecs:StopTask"],resources:o.ecsServices}),d.push({sid:"ECSTaskDefinitions",actions:["ecs:RegisterTaskDefinition","ecs:DeregisterTaskDefinition"],resources:"*"}),d.push({sid:"ECSPassRole",actions:["iam:PassRole"],resources:"*",conditions:{StringLike:{"iam:PassedToService":"ecs-tasks.amazonaws.com"}}});if(o.cloudFormationStacks&&o.cloudFormationStacks.length>0)d.push({sid:"CloudFormationAccess",actions:["cloudformation:CreateStack","cloudformation:UpdateStack","cloudformation:DeleteStack","cloudformation:DescribeStacks","cloudformation:DescribeStackEvents","cloudformation:DescribeStackResources","cloudformation:GetTemplate","cloudformation:ListStackResources","cloudformation:ValidateTemplate"],resources:o.cloudFormationStacks});if(o.lambdaFunctions&&o.lambdaFunctions.length>0)d.push({sid:"LambdaAccess",actions:["lambda:GetFunction","lambda:UpdateFunctionCode","lambda:UpdateFunctionConfiguration","lambda:PublishVersion","lambda:UpdateAlias","lambda:CreateAlias"],resources:o.lambdaFunctions});if(o.secretsManagerSecrets&&o.secretsManagerSecrets.length>0)d.push({sid:"SecretsManagerAccess",actions:["secretsmanager:GetSecretValue","secretsmanager:DescribeSecret"],resources:o.secretsManagerSecrets});let{policy:g,logicalId:y}=le.createPolicy({slug:i,environment:s,policyName:r({slug:i,environment:s,resourceType:"cicd-policy"}),description:`CI/CD deployment policy for ${i} (${s})`,statements:d});u[y]=g;let{user:h,logicalId:A}=le.createUser({slug:i,environment:s,userName:r({slug:i,environment:s,resourceType:"cicd-user"}),managedPolicyArns:[x.Ref(y)]});u[A]=h;let C,v;if(c){let T=le.createAccessKey(A,{slug:i,environment:s});C=T.accessKey,v=T.logicalId,u[v]=C}return{user:h,accessKey:C,policy:g,userLogicalId:A,accessKeyLogicalId:v,policyLogicalId:y,resources:u}}static createCrossAccountRole(n){let{slug:i,environment:s,trustedAccountIds:o,externalId:c,permissions:u,maxSessionDuration:d=3600}=n,g={},{policy:y,logicalId:h}=le.createPolicy({slug:i,environment:s,policyName:r({slug:i,environment:s,resourceType:"cross-account-policy"}),description:`Cross-account access policy for ${i} (${s})`,statements:u});g[h]=y;let A=r({slug:i,environment:s,resourceType:"cross-account-role"}),C=t(A),v={};if(c)v.StringEquals={"sts:ExternalId":c};let T={Type:"AWS::IAM::Role",Properties:{RoleName:A,MaxSessionDuration:d,AssumeRolePolicyDocument:{Version:"2012-10-17",Statement:[{Effect:"Allow",Principal:{AWS:o.map((R)=>`arn:aws:iam::${R}:root`)},Action:"sts:AssumeRole",...Object.keys(v).length>0?{Condition:v}:{}}]},ManagedPolicyArns:[x.Ref(h)],Tags:[{Key:"Name",Value:A},{Key:"Environment",Value:s},{Key:"Purpose",Value:"Cross-Account Access"}]}};return g[C]=T,{role:T,policy:y,roleLogicalId:C,policyLogicalId:h,resources:g}}static createCliUser(n){let{slug:i,environment:s,permissions:o="readonly"}=n,c={},u=[],d=[];switch(o){case"readonly":d=[le.ManagedPolicies.ReadOnlyAccess];break;case"deploy":u=[{sid:"S3Deploy",actions:["s3:*"],resources:"*"},{sid:"CloudFrontDeploy",actions:["cloudfront:*"],resources:"*"},{sid:"ECSDeploy",actions:["ecs:*"],resources:"*"},{sid:"ECRDeploy",actions:["ecr:*"],resources:"*"},{sid:"LambdaDeploy",actions:["lambda:*"],resources:"*"},{sid:"CloudFormationDeploy",actions:["cloudformation:*"],resources:"*"},{sid:"IAMPassRole",actions:["iam:PassRole"],resources:"*"}];break;case"admin":d=[le.ManagedPolicies.AdministratorAccess];break}let g,y;if(u.length>0){let T=le.createPolicy({slug:i,environment:s,policyName:r({slug:i,environment:s,resourceType:"cli-policy"}),description:`CLI access policy for ${i} (${s})`,statements:u});g=T.policy,y=T.logicalId,c[y]=g,d=[x.Ref(y)]}let{user:h,logicalId:A}=le.createUser({slug:i,environment:s,userName:r({slug:i,environment:s,resourceType:"cli-user"}),managedPolicyArns:d});c[A]=h;let{accessKey:C,logicalId:v}=le.createAccessKey(A,{slug:i,environment:s});return c[v]=C,{user:h,accessKey:C,policy:g,userLogicalId:A,accessKeyLogicalId:v,policyLogicalId:y,resources:c}}static CiCdPolicies={s3Deployment:(n)=>[{sid:"S3ListBuckets",actions:["s3:ListBucket","s3:GetBucketLocation"],resources:n},{sid:"S3Objects",actions:["s3:GetObject","s3:PutObject","s3:DeleteObject"],resources:n.map((i)=>`${i}/*`)}],cloudFrontInvalidation:(n)=>[{sid:"CloudFrontInvalidation",actions:["cloudfront:CreateInvalidation","cloudfront:GetInvalidation","cloudfront:ListInvalidations"],resources:n}],ecsDeployment:()=>[{sid:"ECSServices",actions:["ecs:DescribeServices","ecs:UpdateService","ecs:DescribeTaskDefinition","ecs:RegisterTaskDefinition"],resources:"*"},{sid:"ECSPassRole",actions:["iam:PassRole"],resources:"*",conditions:{StringLike:{"iam:PassedToService":"ecs-tasks.amazonaws.com"}}}],ecrPush:(n)=>[{sid:"ECRAuth",actions:["ecr:GetAuthorizationToken"],resources:"*"},{sid:"ECRPush",actions:["ecr:BatchCheckLayerAvailability","ecr:GetDownloadUrlForLayer","ecr:BatchGetImage","ecr:InitiateLayerUpload","ecr:UploadLayerPart","ecr:CompleteLayerUpload","ecr:PutImage"],resources:n}],lambdaDeployment:(n)=>[{sid:"LambdaDeploy",actions:["lambda:GetFunction","lambda:UpdateFunctionCode","lambda:UpdateFunctionConfiguration","lambda:PublishVersion"],resources:n}],cloudFormationDeployment:(n)=>[{sid:"CloudFormationDeploy",actions:["cloudformation:CreateStack","cloudformation:UpdateStack","cloudformation:DescribeStacks","cloudformation:DescribeStackEvents","cloudformation:GetTemplate"],resources:n}]}}class ml{static createRestApi(n){let{slug:i,environment:s,name:o,description:c,endpointType:u="REGIONAL",binaryMediaTypes:d,compressionSize:g}=n,y=o||r({slug:i,environment:s,resourceType:"rest-api"}),h=t(y),A={Type:"AWS::ApiGateway::RestApi",Properties:{Name:y,Description:c||`REST API for ${i} ${s}`,EndpointConfiguration:{Types:[u]},Tags:[{Key:"Name",Value:y},{Key:"Environment",Value:s}]}};if(d&&d.length>0)A.Properties.BinaryMediaTypes=d;if(g!==void 0)A.Properties.MinimumCompressionSize=g;return{restApi:A,logicalId:h}}static createHttpApi(n){let{slug:i,environment:s,name:o,description:c,corsEnabled:u=!0,corsOrigins:d=["*"],corsMethods:g=["GET","POST","PUT","PATCH","DELETE","OPTIONS"],corsHeaders:y=["*"],corsMaxAge:h=86400,corsAllowCredentials:A=!1}=n,C=o||r({slug:i,environment:s,resourceType:"http-api"}),v=t(C),T={Type:"AWS::ApiGatewayV2::Api",Properties:{Name:C,Description:c||`HTTP API for ${i} ${s}`,ProtocolType:"HTTP",Tags:{Name:C,Environment:s}}};if(u)T.Properties.CorsConfiguration={AllowOrigins:d,AllowMethods:g,AllowHeaders:y,MaxAge:h,AllowCredentials:A};return{httpApi:T,logicalId:v}}static createWebSocketApi(n){let{slug:i,environment:s,name:o,description:c}=n,u=o||r({slug:i,environment:s,resourceType:"ws-api"}),d=t(u);return{webSocketApi:{Type:"AWS::ApiGatewayV2::Api",Properties:{Name:u,Description:c||`WebSocket API for ${i} ${s}`,ProtocolType:"WEBSOCKET",Tags:{Name:u,Environment:s}}},logicalId:d}}static createDeployment(n,i){let{slug:s,environment:o,description:c}=i,u=r({slug:s,environment:o,resourceType:"api-deployment"}),d=t(u);return{deployment:{Type:"AWS::ApiGateway::Deployment",Properties:{RestApiId:x.Ref(n),Description:c||`Deployment for ${u}`}},logicalId:d}}static createStage(n,i,s){let{slug:o,environment:c,stageName:u,description:d,cacheEnabled:g=!1,cacheSize:y="0.5",variables:h,throttling:A}=s,C=r({slug:o,environment:c,resourceType:"api-stage"}),v=t(C),T={Type:"AWS::ApiGateway::Stage",Properties:{StageName:u||c,RestApiId:x.Ref(n),DeploymentId:x.Ref(i),Description:d,CacheClusterEnabled:g,Tags:[{Key:"Name",Value:C},{Key:"Environment",Value:c}]}};if(g)T.Properties.CacheClusterSize=y;if(h)T.Properties.Variables=h;if(A)T.Properties.MethodSettings=[{HttpMethod:"*",ResourcePath:"/*",ThrottlingBurstLimit:A.burstLimit,ThrottlingRateLimit:A.rateLimit}];return{stage:T,logicalId:v}}static createAuthorizer(n,i){let{slug:s,environment:o,name:c,type:u,functionArn:d,identitySource:g,userPoolArns:y,ttl:h=300}=i,A=c||r({slug:s,environment:o,resourceType:"api-authorizer"}),C=t(A),v={Type:"AWS::ApiGateway::Authorizer",Properties:{Name:A,Type:u,RestApiId:x.Ref(n),AuthorizerResultTtlInSeconds:h}};if(u==="TOKEN"||u==="REQUEST"){if(!d)throw Error("Lambda authorizer requires functionArn");v.Properties.AuthorizerUri=d,v.Properties.IdentitySource=g||"method.request.header.Authorization"}if(u==="COGNITO_USER_POOLS"){if(!y||y.length===0)throw Error("Cognito authorizer requires userPoolArns");v.Properties.ProviderARNs=y,v.Properties.IdentitySource=g||"method.request.header.Authorization"}return{authorizer:v,logicalId:C}}static setCors(n,i={}){let{origins:s=["*"],methods:o=["GET","POST","PUT","PATCH","DELETE","OPTIONS"],headers:c=["*"],maxAge:u=86400,allowCredentials:d=!1}=i;return n.Properties.CorsConfiguration={AllowOrigins:s,AllowMethods:o,AllowHeaders:c,MaxAge:u,AllowCredentials:d},n}static addThrottling(n,i=5000,s=1e4){if(!n.Properties.MethodSettings)n.Properties.MethodSettings=[];return n.Properties.MethodSettings.push({HttpMethod:"*",ResourcePath:"/*",ThrottlingBurstLimit:i,ThrottlingRateLimit:s}),n}static enableCaching(n,i="0.5",s=300){if(n.Properties.CacheClusterEnabled=!0,n.Properties.CacheClusterSize=i,!n.Properties.MethodSettings)n.Properties.MethodSettings=[];return n.Properties.MethodSettings.push({HttpMethod:"*",ResourcePath:"/*",CachingEnabled:!0,CacheTtlInSeconds:s}),n}static CacheSizes={Small:"0.5",Medium:"1.6",Large:"6.1",XLarge:"13.5",XXLarge:"28.4",XXXLarge:"58.2",Huge:"118",Massive:"237"};static ThrottlingPresets={Light:{burstLimit:100,rateLimit:50},Medium:{burstLimit:500,rateLimit:250},Heavy:{burstLimit:2000,rateLimit:1000},Default:{burstLimit:5000,rateLimit:1e4}}}class ue{static createTopic(n){let{slug:i,environment:s,topicName:o,displayName:c,encrypted:u=!1,kmsKeyId:d}=n,g=o||r({slug:i,environment:s,resourceType:"topic"}),y=t(g),h={Type:"AWS::SNS::Topic",Properties:{TopicName:g,DisplayName:c||g,Tags:[{Key:"Name",Value:g},{Key:"Environment",Value:s}]}};if(u&&d)h.Properties.KmsMasterKeyId=d;return{topic:h,logicalId:y}}static subscribe(n,i){let{slug:s,environment:o,protocol:c,endpoint:u,filterPolicy:d,rawMessageDelivery:g=!1}=i,y=r({slug:s,environment:o,resourceType:"subscription"}),h=u.replace(/[^a-zA-Z0-9]/g,""),A=h.length>12?h.slice(-12):h,C=t(`${y}-${c}-${A}`),v={Type:"AWS::SNS::Subscription",Properties:{TopicArn:x.Ref(n),Protocol:c,Endpoint:u,RawMessageDelivery:g}};if(d)v.Properties.FilterPolicy=d;return{subscription:v,logicalId:C}}static subscribeEmail(n,i,s){return ue.subscribe(n,{...s,protocol:"email",endpoint:i})}static subscribeLambda(n,i,s){return ue.subscribe(n,{...s,protocol:"lambda",endpoint:i,rawMessageDelivery:!0})}static subscribeSqs(n,i,s){return ue.subscribe(n,{...s,protocol:"sqs",endpoint:i})}static subscribeHttp(n,i,s){let o=i.startsWith("https://")?"https":"http";return ue.subscribe(n,{...s,protocol:o,endpoint:i})}static subscribeSms(n,i,s){return ue.subscribe(n,{...s,protocol:"sms",endpoint:i})}static setTopicPolicy(n,i){let{slug:s,environment:o,allowedPrincipals:c,allowedServices:u,actions:d="SNS:Publish"}=i,g=r({slug:s,environment:o,resourceType:"topic-policy"}),y=t(g),h={};if(c)h.AWS=c;if(u)h.Service=u;return{policy:{Type:"AWS::SNS::TopicPolicy",Properties:{Topics:[x.Ref(n)],PolicyDocument:{Version:"2012-10-17",Statement:[{Effect:"Allow",Principal:h,Action:d,Resource:x.Ref(n)}]}}},logicalId:y}}static allowCloudWatchAlarms(n,i){return ue.setTopicPolicy(n,{...i,allowedServices:"cloudwatch.amazonaws.com",actions:"SNS:Publish"})}static allowEventBridge(n,i){return ue.setTopicPolicy(n,{...i,allowedServices:"events.amazonaws.com",actions:"SNS:Publish"})}static allowS3(n,i){return ue.setTopicPolicy(n,{...i,allowedServices:"s3.amazonaws.com",actions:"SNS:Publish"})}static enableEncryption(n,i){if(!n.Properties)n.Properties={};return n.Properties.KmsMasterKeyId=i,n}static addInlineSubscription(n,i,s){if(!n.Properties)n.Properties={};if(!n.Properties.Subscription)n.Properties.Subscription=[];return n.Properties.Subscription.push({Protocol:i,Endpoint:s}),n}static FilterPolicies={eventType:(n)=>({eventType:n}),status:(n)=>({status:n}),numericRange:(n,i,s)=>({[n]:[{numeric:[">=",i,"<=",s]}]}),prefix:(n,i)=>({[n]:[{prefix:i}]}),and:(...n)=>Object.assign({},...n),exists:(n,i)=>({[n]:[{exists:i}]})};static UseCases={createAlertTopic:(n)=>ue.createTopic({...n,topicName:n.topicName||`${n.slug}-${n.environment}-alerts`,displayName:n.displayName||"Alert Notifications"}),createEventFanout:(n)=>ue.createTopic({...n,topicName:n.topicName||`${n.slug}-${n.environment}-events`,displayName:n.displayName||"Event Fanout"}),createNotificationTopic:(n)=>ue.createTopic({...n,topicName:n.topicName||`${n.slug}-${n.environment}-notifications`,displayName:n.displayName||"User Notifications"})}}class cy{static createStateMachine(n){let{slug:i,environment:s,stateMachineName:o,type:c="STANDARD",definition:u,roleArn:d,loggingConfiguration:g,tracingConfiguration:y}=n,h=o||r({slug:i,environment:s,resourceType:"state-machine"}),A=t(h),C,v,T;if(d)T=d;else{let P=r({slug:i,environment:s,resourceType:"state-machine-role"});v=t(P),C={Type:"AWS::IAM::Role",Properties:{RoleName:P,AssumeRolePolicyDocument:{Version:"2012-10-17",Statement:[{Effect:"Allow",Principal:{Service:"states.amazonaws.com"},Action:"sts:AssumeRole"}]},ManagedPolicyArns:["arn:aws:iam::aws:policy/CloudWatchLogsFullAccess"],Tags:[{Key:"Name",Value:P},{Key:"Environment",Value:s}]}},T=x.GetAtt(v,"Arn")}let R={Type:"AWS::StepFunctions::StateMachine",Properties:{StateMachineName:h,StateMachineType:c,DefinitionString:JSON.stringify(u),RoleArn:T,Tags:[{Key:"Name",Value:h},{Key:"Environment",Value:s}]}};if(g)R.Properties.LoggingConfiguration={Level:g.level,IncludeExecutionData:g.includeExecutionData,Destinations:g.destinations?.map((P)=>({CloudWatchLogsLogGroup:{LogGroupArn:P}}))};if(y)R.Properties.TracingConfiguration={Enabled:y.enabled};return{stateMachine:R,logicalId:A,role:C,roleLogicalId:v}}static createLambdaTask(n,i){return{Type:"Task",Resource:"arn:aws:states:::lambda:invoke",Parameters:{FunctionName:n,Payload:i?.parameters||{"Input.$":"$"}},ResultPath:i?.resultPath,Retry:i?.retry,Catch:i?.catch,Next:i?.next,End:i?.end}}static createDynamoDBTask(n,i,s,o){return{Type:"Task",Resource:{GetItem:"arn:aws:states:::dynamodb:getItem",PutItem:"arn:aws:states:::dynamodb:putItem",UpdateItem:"arn:aws:states:::dynamodb:updateItem",DeleteItem:"arn:aws:states:::dynamodb:deleteItem"}[n],Parameters:{TableName:i,...s},ResultPath:o?.resultPath,Retry:o?.retry,Catch:o?.catch,Next:o?.next,End:o?.end}}static createSNSPublishTask(n,i,s){return{Type:"Task",Resource:"arn:aws:states:::sns:publish",Parameters:{TopicArn:n,Message:i},ResultPath:s?.resultPath,Retry:s?.retry,Catch:s?.catch,Next:s?.next,End:s?.end}}static createSQSSendMessageTask(n,i,s){return{Type:"Task",Resource:"arn:aws:states:::sqs:sendMessage",Parameters:{QueueUrl:n,MessageBody:i},ResultPath:s?.resultPath,Retry:s?.retry,Catch:s?.catch,Next:s?.next,End:s?.end}}static createPassState(n){return{Type:"Pass",Result:n?.result,ResultPath:n?.resultPath,Parameters:n?.parameters,Next:n?.next,End:n?.end}}static createWaitState(n){return{Type:"Wait",Seconds:n.seconds,Timestamp:n.timestamp,SecondsPath:n.secondsPath,TimestampPath:n.timestampPath,Next:n.next,End:n.end}}static createChoiceState(n,i){return{Type:"Choice",Choices:n,Default:i}}static createParallelState(n,i){return{Type:"Parallel",Branches:n,ResultPath:i?.resultPath,Retry:i?.retry,Catch:i?.catch,Next:i?.next,End:i?.end}}static createMapState(n,i){return{Type:"Map",ItemsPath:i?.itemsPath||"$.items",Iterator:n,MaxConcurrency:i?.maxConcurrency,ResultPath:i?.resultPath,Retry:i?.retry,Catch:i?.catch,Next:i?.next,End:i?.end}}static createSucceedState(){return{Type:"Succeed"}}static createFailState(n,i){return{Type:"Fail",Error:n,Cause:i}}static RetryPolicies={standard:()=>({ErrorEquals:["States.ALL"],IntervalSeconds:2,MaxAttempts:3,BackoffRate:2}),aggressive:()=>({ErrorEquals:["States.TaskFailed","States.Timeout"],IntervalSeconds:1,MaxAttempts:5,BackoffRate:1.5}),custom:(n,i,s,o)=>({ErrorEquals:n,IntervalSeconds:i,MaxAttempts:s,BackoffRate:o})};static CatchPolicies={all:(n,i)=>({ErrorEquals:["States.ALL"],Next:n,ResultPath:i||"$.error"}),specific:(n,i,s)=>({ErrorEquals:n,Next:i,ResultPath:s||"$.error"})};static Patterns={sequential:(n,i,s)=>{let o={};return s.forEach((c,u)=>{let d=u===s.length-1;o[c.name]={...c.state,Next:d?void 0:s[u+1].name,End:d}}),{Comment:"Sequential workflow",StartAt:s[0].name,States:o}},fanout:(n,i,s)=>({Comment:"Fan-out workflow",StartAt:"Parallel",States:{Parallel:{Type:"Parallel",Branches:s.map((o)=>o.definition),End:!0}}}),map:(n,i,s,o)=>({Comment:"Map workflow",StartAt:"Map",States:{Map:{Type:"Map",ItemsPath:"$.items",Iterator:s,MaxConcurrency:o,End:!0}}}),withErrorHandling:(n,i,s,o)=>({Comment:"Workflow with error handling",StartAt:"Main",States:{Main:{...s,Catch:[{ErrorEquals:["States.ALL"],Next:"ErrorHandler"}],Next:"Success"},ErrorHandler:o,Success:{Type:"Succeed"}}})}}class jo{static createAlarm(n){let{slug:i,environment:s,alarmName:o,metricName:c,namespace:u,statistic:d="Average",period:g=300,evaluationPeriods:y=1,threshold:h,comparisonOperator:A,treatMissingData:C="notBreaching",actionsEnabled:v=!0,alarmActions:T,okActions:R,insufficientDataActions:P,dimensions:I,unit:M,datapointsToAlarm:L}=n,N=o||r({slug:i,environment:s,resourceType:"alarm"}),O=t(N),B={Type:"AWS::CloudWatch::Alarm",Properties:{AlarmName:N,MetricName:c,Namespace:u,Statistic:d,Period:g,EvaluationPeriods:y,Threshold:h,ComparisonOperator:A,TreatMissingData:C,ActionsEnabled:v}};if(T&&T.length>0)B.Properties.AlarmActions=T;if(R&&R.length>0)B.Properties.OKActions=R;if(P&&P.length>0)B.Properties.InsufficientDataActions=P;if(I)B.Properties.Dimensions=Object.entries(I).map(([F,U])=>({Name:F,Value:U}));if(M)B.Properties.Unit=M;if(L!==void 0)B.Properties.DatapointsToAlarm=L;return{alarm:B,logicalId:O}}static createCompositeAlarm(n){let{slug:i,environment:s,alarmName:o,alarmRule:c,actionsEnabled:u=!0,alarmActions:d,okActions:g,insufficientDataActions:y}=n,h=o||r({slug:i,environment:s,resourceType:"composite-alarm"}),A=t(h),C={Type:"AWS::CloudWatch::CompositeAlarm",Properties:{AlarmName:h,AlarmRule:c,ActionsEnabled:u}};if(d&&d.length>0)C.Properties.AlarmActions=d;if(g&&g.length>0)C.Properties.OKActions=g;if(y&&y.length>0)C.Properties.InsufficientDataActions=y;return{alarm:C,logicalId:A}}static createDashboard(n){let{slug:i,environment:s,dashboardName:o,widgets:c}=n,u=o||r({slug:i,environment:s,resourceType:"dashboard"}),d=t(u),g={widgets:c.map((h)=>({type:h.type,x:h.x,y:h.y,width:h.width,height:h.height,properties:h.properties}))};return{dashboard:{Type:"AWS::CloudWatch::Dashboard",Properties:{DashboardName:u,DashboardBody:JSON.stringify(g)}},logicalId:d}}static createLogGroup(n){let{slug:i,environment:s,logGroupName:o,retentionInDays:c,kmsKeyId:u}=n,d=o||r({slug:i,environment:s,resourceType:"log-group"}),g=t(d),y={Type:"AWS::Logs::LogGroup",Properties:{LogGroupName:d}};if(c!==void 0)y.Properties.RetentionInDays=c;if(u)y.Properties.KmsKeyId=u;return{logGroup:y,logicalId:g}}static createLogStream(n,i){let{slug:s,environment:o,logStreamName:c}=i,u=c||r({slug:s,environment:o,resourceType:"log-stream"}),d=t(u);return{logStream:{Type:"AWS::Logs::LogStream",Properties:{LogGroupName:x.Ref(n),LogStreamName:u}},logicalId:d}}static createMetricFilter(n,i){let{slug:s,environment:o,filterName:c,filterPattern:u,metricTransformations:d}=i,g=c||r({slug:s,environment:o,resourceType:"metric-filter"}),y=t(g);return{metricFilter:{Type:"AWS::Logs::MetricFilter",Properties:{LogGroupName:x.Ref(n),FilterPattern:u,MetricTransformations:d.map((A)=>({MetricName:A.metricName,MetricNamespace:A.metricNamespace,MetricValue:A.metricValue,DefaultValue:A.defaultValue,Unit:A.unit}))}},logicalId:y}}static AlarmTypes={highCpu:(n,i,s,o=80,c)=>({slug:n,environment:i,alarmName:`${n}-${i}-high-cpu`,metricName:"CPUUtilization",namespace:"AWS/EC2",statistic:"Average",period:300,evaluationPeriods:2,threshold:o,comparisonOperator:"GreaterThanThreshold",dimensions:{InstanceId:s},alarmActions:c?[c]:void 0}),highMemory:(n,i,s,o=80,c)=>({slug:n,environment:i,alarmName:`${n}-${i}-high-memory`,metricName:"MemoryUtilization",namespace:"System/Linux",statistic:"Average",period:300,evaluationPeriods:2,threshold:o,comparisonOperator:"GreaterThanThreshold",dimensions:{InstanceId:s},alarmActions:c?[c]:void 0}),highDisk:(n,i,s,o=80,c)=>({slug:n,environment:i,alarmName:`${n}-${i}-high-disk`,metricName:"DiskSpaceUtilization",namespace:"System/Linux",statistic:"Average",period:300,evaluationPeriods:2,threshold:o,comparisonOperator:"GreaterThanThreshold",dimensions:{InstanceId:s,Filesystem:"/dev/xvda1",MountPath:"/"},alarmActions:c?[c]:void 0}),lambdaErrors:(n,i,s,o=5,c)=>({slug:n,environment:i,alarmName:`${n}-${i}-lambda-errors`,metricName:"Errors",namespace:"AWS/Lambda",statistic:"Sum",period:300,evaluationPeriods:1,threshold:o,comparisonOperator:"GreaterThanThreshold",dimensions:{FunctionName:s},alarmActions:c?[c]:void 0}),lambdaThrottles:(n,i,s,o=10,c)=>({slug:n,environment:i,alarmName:`${n}-${i}-lambda-throttles`,metricName:"Throttles",namespace:"AWS/Lambda",statistic:"Sum",period:300,evaluationPeriods:1,threshold:o,comparisonOperator:"GreaterThanThreshold",dimensions:{FunctionName:s},alarmActions:c?[c]:void 0}),apiGateway5xxErrors:(n,i,s,o=10,c)=>({slug:n,environment:i,alarmName:`${n}-${i}-api-5xx-errors`,metricName:"5XXError",namespace:"AWS/ApiGateway",statistic:"Sum",period:300,evaluationPeriods:1,threshold:o,comparisonOperator:"GreaterThanThreshold",dimensions:{ApiName:s},alarmActions:c?[c]:void 0}),apiGateway4xxErrors:(n,i,s,o=50,c)=>({slug:n,environment:i,alarmName:`${n}-${i}-api-4xx-errors`,metricName:"4XXError",namespace:"AWS/ApiGateway",statistic:"Sum",period:300,evaluationPeriods:2,threshold:o,comparisonOperator:"GreaterThanThreshold",dimensions:{ApiName:s},alarmActions:c?[c]:void 0}),dynamoDBThrottles:(n,i,s,o=5,c)=>({slug:n,environment:i,alarmName:`${n}-${i}-dynamodb-throttles`,metricName:"UserErrors",namespace:"AWS/DynamoDB",statistic:"Sum",period:300,evaluationPeriods:1,threshold:o,comparisonOperator:"GreaterThanThreshold",dimensions:{TableName:s},alarmActions:c?[c]:void 0}),rdsCpu:(n,i,s,o=80,c)=>({slug:n,environment:i,alarmName:`${n}-${i}-rds-cpu`,metricName:"CPUUtilization",namespace:"AWS/RDS",statistic:"Average",period:300,evaluationPeriods:2,threshold:o,comparisonOperator:"GreaterThanThreshold",dimensions:{DBInstanceIdentifier:s},alarmActions:c?[c]:void 0}),rdsFreeStorage:(n,i,s,o=5368709120,c)=>({slug:n,environment:i,alarmName:`${n}-${i}-rds-storage`,metricName:"FreeStorageSpace",namespace:"AWS/RDS",statistic:"Average",period:300,evaluationPeriods:1,threshold:o,comparisonOperator:"LessThanThreshold",dimensions:{DBInstanceIdentifier:s},alarmActions:c?[c]:void 0,unit:"Bytes"}),sqsQueueDepth:(n,i,s,o=100,c)=>({slug:n,environment:i,alarmName:`${n}-${i}-sqs-depth`,metricName:"ApproximateNumberOfMessagesVisible",namespace:"AWS/SQS",statistic:"Average",period:300,evaluationPeriods:2,threshold:o,comparisonOperator:"GreaterThanThreshold",dimensions:{QueueName:s},alarmActions:c?[c]:void 0}),albUnhealthyTargets:(n,i,s,o,c=1,u)=>({slug:n,environment:i,alarmName:`${n}-${i}-alb-unhealthy`,metricName:"UnHealthyHostCount",namespace:"AWS/ApplicationELB",statistic:"Average",period:300,evaluationPeriods:2,threshold:c,comparisonOperator:"GreaterThanThreshold",dimensions:{LoadBalancer:s,TargetGroup:o},alarmActions:u?[u]:void 0}),sesBounceRate:(n,i,s=5,o)=>({slug:n,environment:i,alarmName:`${n}-${i}-ses-bounce-rate`,metricName:"Reputation.BounceRate",namespace:"AWS/SES",statistic:"Average",period:3600,evaluationPeriods:1,threshold:s/100,comparisonOperator:"GreaterThanThreshold",alarmActions:o?[o]:void 0}),sesComplaintRate:(n,i,s=0.1,o)=>({slug:n,environment:i,alarmName:`${n}-${i}-ses-complaint-rate`,metricName:"Reputation.ComplaintRate",namespace:"AWS/SES",statistic:"Average",period:3600,evaluationPeriods:1,threshold:s/100,comparisonOperator:"GreaterThanThreshold",alarmActions:o?[o]:void 0}),smsDeliveryFailure:(n,i,s,o=10,c)=>({slug:n,environment:i,alarmName:`${n}-${i}-sms-delivery-failure`,metricName:"DirectSendMessagePermanentFailure",namespace:"AWS/Pinpoint",statistic:"Sum",period:300,evaluationPeriods:1,threshold:o,comparisonOperator:"GreaterThanThreshold",dimensions:{ApplicationId:s},alarmActions:c?[c]:void 0}),smsSpendLimit:(n,i,s=100,o)=>({slug:n,environment:i,alarmName:`${n}-${i}-sms-spend-limit`,metricName:"DirectSendMessageSpend",namespace:"AWS/Pinpoint",statistic:"Sum",period:86400,evaluationPeriods:1,threshold:s,comparisonOperator:"GreaterThanThreshold",alarmActions:o?[o]:void 0}),connectMissedCalls:(n,i,s,o=5,c)=>({slug:n,environment:i,alarmName:`${n}-${i}-connect-missed-calls`,metricName:"MissedCalls",namespace:"AWS/Connect",statistic:"Sum",period:3600,evaluationPeriods:1,threshold:o,comparisonOperator:"GreaterThanThreshold",dimensions:{InstanceId:s},alarmActions:c?[c]:void 0})};static DashboardWidgets={metric:(n,i,s,o,c,u)=>({type:"metric",x:n,y:i,width:s,height:o,properties:{metrics:c,title:u||"Metrics",region:"us-east-1",period:300}}),text:(n,i,s,o,c)=>({type:"text",x:n,y:i,width:s,height:o,properties:{markdown:c}}),log:(n,i,s,o,c,u)=>({type:"log",x:n,y:i,width:s,height:o,properties:{query:`SOURCE '${c.join("' | SOURCE '")}'
+`;class X{static LambdaCode={send:Ct,receive:on,deliveryStatus:an};static createPinpointApp(n){return{[`${n.slug}PinpointApp`]:{Type:"AWS::Pinpoint::App",Properties:{Name:n.name||`${n.slug}-sms`}}}}static createSmsChannel(n){let i={ApplicationId:n.applicationId,Enabled:n.enabled!==!1};if(n.senderId)i.SenderId=n.senderId;if(n.shortCode)i.ShortCode=n.shortCode;return{[`${n.slug}SmsChannel`]:{Type:"AWS::Pinpoint::SMSChannel",Properties:i}}}static createSmsLambdaRole(n){return{[`${n.slug}SmsLambdaRole`]:{Type:"AWS::IAM::Role",Properties:{RoleName:`${n.slug}-sms-lambda-role`,AssumeRolePolicyDocument:{Version:"2012-10-17",Statement:[{Effect:"Allow",Principal:{Service:"lambda.amazonaws.com"},Action:"sts:AssumeRole"}]},ManagedPolicyArns:["arn:aws:iam::aws:policy/service-role/AWSLambdaBasicExecutionRole"],Policies:[{PolicyName:"SmsLambdaPolicy",PolicyDocument:{Version:"2012-10-17",Statement:[{Effect:"Allow",Action:["mobiletargeting:SendMessages","mobiletargeting:GetSmsChannel"],Resource:"*"},{Effect:"Allow",Action:["sns:Publish"],Resource:"*"},{Effect:"Allow",Action:["dynamodb:PutItem","dynamodb:UpdateItem","dynamodb:GetItem","dynamodb:DeleteItem"],Resource:"*"}]}}]}}}}static createSendLambda(n){return{[`${n.slug}SmsSendLambda`]:{Type:"AWS::Lambda::Function",Properties:{FunctionName:`${n.slug}-sms-send`,Runtime:"nodejs20.x",Handler:"index.handler",Role:n.roleArn,Timeout:30,MemorySize:256,Code:{ZipFile:X.LambdaCode.send},Environment:{Variables:{PINPOINT_APP_ID:n.pinpointAppId,MESSAGE_LOG_TABLE:n.messageLogTable||"",SMS_SENDER_ID:n.senderId||"",SMS_ORIGINATION_NUMBER:n.originationNumber||""}}}}}}static createReceiveLambda(n){return{[`${n.slug}SmsReceiveLambda`]:{Type:"AWS::Lambda::Function",Properties:{FunctionName:`${n.slug}-sms-receive`,Runtime:"nodejs20.x",Handler:"index.handler",Role:n.roleArn,Timeout:30,MemorySize:256,Code:{ZipFile:X.LambdaCode.receive},Environment:{Variables:{OPT_OUT_TABLE:n.optOutTable||"",MESSAGE_LOG_TABLE:n.messageLogTable||"",NOTIFICATION_TOPIC_ARN:n.notificationTopicArn||"",WEBHOOK_URL:n.webhookUrl||""}}}}}}static createDeliveryStatusLambda(n){return{[`${n.slug}SmsDeliveryStatusLambda`]:{Type:"AWS::Lambda::Function",Properties:{FunctionName:`${n.slug}-sms-delivery-status`,Runtime:"nodejs20.x",Handler:"index.handler",Role:n.roleArn,Timeout:30,MemorySize:256,Code:{ZipFile:X.LambdaCode.deliveryStatus},Environment:{Variables:{MESSAGE_LOG_TABLE:n.messageLogTable||"",NOTIFICATION_TOPIC_ARN:n.notificationTopicArn||"",WEBHOOK_URL:n.webhookUrl||""}}}}}}static createMessageLogTable(n){return{[`${n.slug}SmsMessageLogTable`]:{Type:"AWS::DynamoDB::Table",Properties:{TableName:`${n.slug}-sms-messages`,BillingMode:"PAY_PER_REQUEST",AttributeDefinitions:[{AttributeName:"messageId",AttributeType:"S"}],KeySchema:[{AttributeName:"messageId",KeyType:"HASH"}],TimeToLiveSpecification:{AttributeName:"ttl",Enabled:!0}}}}}static createOptOutTable(n){return{[`${n.slug}SmsOptOutTable`]:{Type:"AWS::DynamoDB::Table",Properties:{TableName:`${n.slug}-sms-optouts`,BillingMode:"PAY_PER_REQUEST",AttributeDefinitions:[{AttributeName:"phoneNumber",AttributeType:"S"}],KeySchema:[{AttributeName:"phoneNumber",KeyType:"HASH"}]}}}}static createNotificationTopic(n){return{[`${n.slug}SmsNotificationTopic`]:{Type:"AWS::SNS::Topic",Properties:{TopicName:`${n.slug}-sms-notifications`}}}}static createCompleteSetup(n){let i={},s={};Object.assign(i,X.createPinpointApp({slug:n.slug})),Object.assign(i,X.createSmsChannel({slug:n.slug,applicationId:{Ref:`${n.slug}PinpointApp`},senderId:n.senderId})),Object.assign(i,X.createSmsLambdaRole({slug:n.slug})),Object.assign(i,X.createMessageLogTable({slug:n.slug})),Object.assign(i,X.createOptOutTable({slug:n.slug})),Object.assign(i,X.createNotificationTopic({slug:n.slug}));let o={"Fn::GetAtt":[`${n.slug}SmsLambdaRole`,"Arn"]},c={Ref:`${n.slug}PinpointApp`},u={Ref:`${n.slug}SmsMessageLogTable`},d={Ref:`${n.slug}SmsOptOutTable`},g={Ref:`${n.slug}SmsNotificationTopic`};if(Object.assign(i,X.createSendLambda({slug:n.slug,roleArn:o,pinpointAppId:c,messageLogTable:u,senderId:n.senderId,originationNumber:n.originationNumber})),n.twoWayEnabled)Object.assign(i,X.createReceiveLambda({slug:n.slug,roleArn:o,optOutTable:d,messageLogTable:u,notificationTopicArn:g,webhookUrl:n.webhookUrl}));return Object.assign(i,X.createDeliveryStatusLambda({slug:n.slug,roleArn:o,messageLogTable:u,notificationTopicArn:g,webhookUrl:n.webhookUrl})),s[`${n.slug}PinpointAppId`]={Description:"Pinpoint application ID",Value:{Ref:`${n.slug}PinpointApp`}},s[`${n.slug}SmsSendLambdaArn`]={Description:"SMS send Lambda ARN",Value:{"Fn::GetAtt":[`${n.slug}SmsSendLambda`,"Arn"]}},s[`${n.slug}SmsNotificationTopicArn`]={Description:"SMS notification topic ARN",Value:{Ref:`${n.slug}SmsNotificationTopic`}},s[`${n.slug}SmsMessageLogTableName`]={Description:"SMS message log table name",Value:{Ref:`${n.slug}SmsMessageLogTable`}},{resources:i,outputs:s}}}function vt(n){return n.replace(/[^a-zA-Z0-9]/g," ").trim().split(/\s+/).map((o)=>o.charAt(0).toUpperCase()+o.slice(1)).join("")||"User"}function Er(n,i){let s=(n||i).replace(/^\/+|\/+$/g,"");if(!s||s.split("/").includes(".."))throw Error(`sftp: invalid homeDirectory for user ${i}`);return s}function wr(n){let i=n.storage;if(i?.type==="efs"){let o="fileSystemId"in i?i.fileSystemId:void 0;if(!o||typeof o==="string"&&!o.trim())throw Error("sftp: EFS storage requires fileSystemId, or a fileSystem name defined in infrastructure.fileSystem");return{type:"efs",fileSystemId:o,posixProfile:i.posixProfile}}let s=(i?.type==="s3"?i.bucket??n.bucket:n.bucket)?.trim();if(!s)throw Error("sftp: S3 storage requires bucket, or a storageBucket name defined in infrastructure.storage");return{type:"s3",bucket:s}}function Ir(n,i,s){let o=i.posixProfile??s;if(!o)throw Error(`sftp: user ${n} requires a posixProfile (uid/gid) on an EFS-backed server`);for(let c of[o.uid,o.gid,...o.secondaryGids??[]])if(!Number.isInteger(c)||c<0||c>4294967295)throw Error(`sftp: user ${n} has an invalid posixProfile id ${c}`);return{Uid:o.uid,Gid:o.gid,...o.secondaryGids?.length?{SecondaryGids:o.secondaryGids}:{}}}function Dr(n,i){return typeof n==="string"?`/${n}/${i}`:{"Fn::Sub":[`/\${FileSystemId}/${i}`,{FileSystemId:n}]}}function Nr(n){return typeof n==="string"?{"Fn::Sub":"arn:aws:elasticfilesystem:${AWS::Region}:${AWS::AccountId}:file-system/${FileSystemId}".replace("${FileSystemId}",n)}:{"Fn::Sub":["arn:aws:elasticfilesystem:${AWS::Region}:${AWS::AccountId}:file-system/${FileSystemId}",{FileSystemId:n}]}}class pl{static create(n){let i=wr(n),s=i.type==="efs"?"EFS":"S3",o=n.endpointType??"PUBLIC";if(o==="VPC"&&(!n.endpointDetails?.vpcId||!n.endpointDetails.subnetIds.length))throw Error("sftp: VPC endpoints require endpointDetails.vpcId and at least one subnet");let c=`${vt(n.slug)}${vt(n.environment)}Sftp`,u=`${c}Server`,d={},g;if(n.logging!==!1){let y=`${c}LoggingRole`;d[y]={Type:"AWS::IAM::Role",Properties:{AssumeRolePolicyDocument:{Version:"2012-10-17",Statement:[{Effect:"Allow",Principal:{Service:"transfer.amazonaws.com"},Action:"sts:AssumeRole"}]},Policies:[{PolicyName:"TransferLogging",PolicyDocument:{Version:"2012-10-17",Statement:[{Effect:"Allow",Action:["logs:CreateLogGroup","logs:CreateLogStream","logs:DescribeLogStreams","logs:PutLogEvents"],Resource:"arn:aws:logs:*:*:log-group:/aws/transfer/*"}]}}]}},g={"Fn::GetAtt":[y,"Arn"]}}d[u]={Type:"AWS::Transfer::Server",Properties:{Domain:s,EndpointType:o,IdentityProviderType:"SERVICE_MANAGED",Protocols:["SFTP"],...o==="VPC"?{EndpointDetails:{VpcId:n.endpointDetails.vpcId,SubnetIds:n.endpointDetails.subnetIds,...n.endpointDetails.securityGroupIds?.length?{SecurityGroupIds:n.endpointDetails.securityGroupIds}:{},...n.endpointDetails.addressAllocationIds?.length?{AddressAllocationIds:n.endpointDetails.addressAllocationIds}:{}}}:{},...n.securityPolicyName?{SecurityPolicyName:n.securityPolicyName}:{},...g?{LoggingRole:g}:{},Tags:[{Key:"Project",Value:n.slug},{Key:"Environment",Value:n.environment},{Key:"ManagedBy",Value:"ts-cloud"}]}};for(let[y,h]of Object.entries(n.users)){if(!/^[a-zA-Z0-9_.@-]{3,100}$/.test(y))throw Error(`sftp: invalid username ${y}`);if(!h.sshPublicKeys.length)throw Error(`sftp: user ${y} requires at least one SSH public key`);let A=vt(y),C=Er(h.homeDirectory,y),v=`${c}${A}User`,T=h.roleArn;if(!T){let R=`${c}${A}Role`,P;if(i.type==="efs")P=[{Effect:"Allow",Action:["elasticfilesystem:ClientMount","elasticfilesystem:ClientWrite","elasticfilesystem:DescribeMountTargets"],Resource:Nr(i.fileSystemId)}];else{let I=`arn:aws:s3:::${i.bucket}`;P=[{Effect:"Allow",Action:["s3:ListBucket","s3:GetBucketLocation"],Resource:I,Condition:{StringLike:{"s3:prefix":[C,`${C}/*`]}}},{Effect:"Allow",Action:["s3:GetObject","s3:PutObject","s3:DeleteObject","s3:GetObjectVersion"],Resource:`${I}/${C}/*`}]}d[R]={Type:"AWS::IAM::Role",Properties:{AssumeRolePolicyDocument:{Version:"2012-10-17",Statement:[{Effect:"Allow",Principal:{Service:"transfer.amazonaws.com"},Action:"sts:AssumeRole"}]},Policies:[{PolicyName:"SftpHomeDirectory",PolicyDocument:{Version:"2012-10-17",Statement:P}}]}},T={"Fn::GetAtt":[R,"Arn"]}}d[v]={Type:"AWS::Transfer::User",DependsOn:[u],Properties:{ServerId:{Ref:u},UserName:y,Role:T,HomeDirectoryType:"PATH",HomeDirectory:i.type==="efs"?Dr(i.fileSystemId,C):`/${i.bucket}/${C}`,...i.type==="efs"?{PosixProfile:Ir(y,h,i.posixProfile)}:{},SshPublicKeys:h.sshPublicKeys}}}return{resources:d,serverLogicalId:u,domain:s}}}class Oe{static createBedrockRole(n,i){let{slug:s,environment:o,name:c,models:u=["*"],allowStreaming:d=!0}=i,g=c||r({slug:s,environment:o,resourceType:"bedrock-role"}),y=t(g),h=["bedrock:InvokeModel"];if(d)h.push("bedrock:InvokeModelWithResponseStream");let A=u.map((v)=>v==="*"?"arn:aws:bedrock:*::foundation-model/*":`arn:aws:bedrock:*::foundation-model/${v}`);return{role:{Type:"AWS::IAM::Role",Properties:{RoleName:g,AssumeRolePolicyDocument:{Version:"2012-10-17",Statement:[{Effect:"Allow",Principal:{Service:n},Action:"sts:AssumeRole"}]},Policies:[{PolicyName:`${g}-policy`,PolicyDocument:{Version:"2012-10-17",Statement:[{Effect:"Allow",Action:h,Resource:A}]}}],Tags:[{Key:"Name",Value:g},{Key:"Environment",Value:o}]}},logicalId:y}}static createBedrockPolicy(n){let{slug:i,environment:s,name:o,models:c=["*"],allowInvoke:u=!0,allowStreaming:d=!0,allowAsync:g=!1}=n,y=o||r({slug:i,environment:s,resourceType:"bedrock-policy"}),h=t(y),A=[];if(u)A.push("bedrock:InvokeModel");if(d)A.push("bedrock:InvokeModelWithResponseStream");if(g)A.push("bedrock:InvokeModelAsync");let C=c.map((T)=>T==="*"?"arn:aws:bedrock:*::foundation-model/*":`arn:aws:bedrock:*::foundation-model/${T}`);return{policy:{Type:"AWS::IAM::ManagedPolicy",Properties:{ManagedPolicyName:y,PolicyDocument:{Version:"2012-10-17",Statement:[{Sid:"BedrockModelInvocation",Effect:"Allow",Action:A,Resource:C}]}}},logicalId:h}}static enableBedrockForLambda(n){return Oe.createBedrockRole("lambda.amazonaws.com",n)}static enableBedrockForEcs(n){return Oe.createBedrockRole("ecs-tasks.amazonaws.com",n)}static enableBedrockForEc2(n){return Oe.createBedrockRole("ec2.amazonaws.com",n)}static addBedrockPermissions(n,i=["*"],s=!0){let o=["bedrock:InvokeModel"];if(s)o.push("bedrock:InvokeModelWithResponseStream");let c=i.map((u)=>u==="*"?"arn:aws:bedrock:*::foundation-model/*":`arn:aws:bedrock:*::foundation-model/${u}`);if(!n.Properties.Policies)n.Properties.Policies=[];return n.Properties.Policies.push({PolicyName:"bedrock-permissions",PolicyDocument:{Version:"2012-10-17",Statement:[{Effect:"Allow",Action:o,Resource:c}]}}),n}static Models={Claude3_5_Sonnet:"anthropic.claude-3-5-sonnet-20241022-v2:0",Claude3_5_Haiku:"anthropic.claude-3-5-haiku-20241022-v1:0",Claude3_Opus:"anthropic.claude-3-opus-20240229-v1:0",Claude3_Sonnet:"anthropic.claude-3-sonnet-20240229-v1:0",Claude3_Haiku:"anthropic.claude-3-haiku-20240307-v1:0",TitanTextG1Express:"amazon.titan-text-express-v1",TitanTextG1Lite:"amazon.titan-text-lite-v1",TitanEmbedG1Text:"amazon.titan-embed-text-v1",TitanImageG1:"amazon.titan-image-generator-v1",JurassicUltra:"ai21.j2-ultra-v1",JurassicMid:"ai21.j2-mid-v1",CommandText:"cohere.command-text-v14",CommandLight:"cohere.command-light-text-v14",EmbedEnglish:"cohere.embed-english-v3",EmbedMultilingual:"cohere.embed-multilingual-v3",Llama3_2_1B:"meta.llama3-2-1b-instruct-v1:0",Llama3_2_3B:"meta.llama3-2-3b-instruct-v1:0",Llama3_2_11B:"meta.llama3-2-11b-instruct-v1:0",Llama3_2_90B:"meta.llama3-2-90b-instruct-v1:0",Llama3_1_8B:"meta.llama3-1-8b-instruct-v1:0",Llama3_1_70B:"meta.llama3-1-70b-instruct-v1:0",Llama3_1_405B:"meta.llama3-1-405b-instruct-v1:0",Mistral7B:"mistral.mistral-7b-instruct-v0:2",Mixtral8x7B:"mistral.mixtral-8x7b-instruct-v0:1",MistralLarge:"mistral.mistral-large-2402-v1:0",StableDiffusionXL:"stability.stable-diffusion-xl-v1"};static ModelGroups={AllClaude:["anthropic.claude-3-5-sonnet-20241022-v2:0","anthropic.claude-3-5-haiku-20241022-v1:0","anthropic.claude-3-opus-20240229-v1:0","anthropic.claude-3-sonnet-20240229-v1:0","anthropic.claude-3-haiku-20240307-v1:0"],AllTitan:["amazon.titan-text-express-v1","amazon.titan-text-lite-v1","amazon.titan-embed-text-v1","amazon.titan-image-generator-v1"],AllLlama:["meta.llama3-2-1b-instruct-v1:0","meta.llama3-2-3b-instruct-v1:0","meta.llama3-2-11b-instruct-v1:0","meta.llama3-2-90b-instruct-v1:0","meta.llama3-1-8b-instruct-v1:0","meta.llama3-1-70b-instruct-v1:0","meta.llama3-1-405b-instruct-v1:0"],TextModels:["anthropic.claude-3-5-sonnet-20241022-v2:0","anthropic.claude-3-5-haiku-20241022-v1:0","amazon.titan-text-express-v1","meta.llama3-2-11b-instruct-v1:0","mistral.mistral-7b-instruct-v0:2"],EmbeddingModels:["amazon.titan-embed-text-v1","cohere.embed-english-v3","cohere.embed-multilingual-v3"],ImageModels:["amazon.titan-image-generator-v1","stability.stable-diffusion-xl-v1"]}}class ur{static createPostgres(n){return ur.createRDSInstance("postgres","16.2",n)}static createMysql(n){return ur.createRDSInstance("mysql","8.0.35",n)}static createRDSInstance(n,i,s){let{slug:o,environment:c,instanceClass:u="db.t3.micro",allocatedStorage:d=20,storageType:g="gp3",masterUsername:y="admin",masterPassword:h,databaseName:A,subnetIds:C,securityGroupIds:v,encrypted:T=!0,kmsKeyId:R,multiAz:P=!1,backupRetentionDays:I=7,publiclyAccessible:M=!1,enableCloudwatchLogs:L=!0,deletionProtection:N=!0}=s,O=r({slug:o,environment:c,resourceType:`${n}-db`}),B=t(O),F,U;if(C&&C.length>0){let H=r({slug:o,environment:c,resourceType:"db-subnet-group"});U=t(H),F={Type:"AWS::RDS::DBSubnetGroup",Properties:{DBSubnetGroupName:H,DBSubnetGroupDescription:`Subnet group for ${O}`,SubnetIds:C,Tags:[{Key:"Name",Value:H},{Key:"Environment",Value:c}]}}}let j={Type:"AWS::RDS::DBInstance",Properties:{DBInstanceIdentifier:O,DBInstanceClass:u,Engine:n,EngineVersion:i,MasterUsername:y,MasterUserPassword:h,AllocatedStorage:d,StorageType:g,StorageEncrypted:T,MultiAZ:P,BackupRetentionPeriod:I,PubliclyAccessible:M,DeletionProtection:N,Tags:[{Key:"Name",Value:O},{Key:"Environment",Value:c}]}};if(A)j.Properties.DBName=A;if(R)j.Properties.KmsKeyId=R;if(U)j.Properties.DBSubnetGroupName=x.Ref(U);if(v&&v.length>0)j.Properties.VPCSecurityGroups=v;if(L)j.Properties.EnableCloudwatchLogsExports=n==="postgres"?["postgresql"]:["error","general","slowquery"];return{dbInstance:j,subnetGroup:F,logicalId:B,subnetGroupId:U}}static createReadReplica(n,i){let{slug:s,environment:o,instanceClass:c="db.t3.micro",securityGroupIds:u,publiclyAccessible:d=!1}=i,g=r({slug:s,environment:o,resourceType:"db-replica"}),y=t(g),h={Type:"AWS::RDS::DBInstance",Properties:{DBInstanceIdentifier:g,DBInstanceClass:c,SourceDBInstanceIdentifier:x.Ref(n),PubliclyAccessible:d,Tags:[{Key:"Name",Value:g},{Key:"Environment",Value:o},{Key:"Type",Value:"ReadReplica"}]}};if(u&&u.length>0)h.Properties.VPCSecurityGroups=u;return{replica:h,logicalId:y}}static createParameterGroup(n,i,s){let{slug:o,environment:c,parameters:u={}}=s,d=r({slug:o,environment:c,resourceType:"db-params"}),g=t(d),y=n==="postgres"?`postgres${i.split(".")[0]}`:`mysql${i.split(".")[0]}.${i.split(".")[1]}`;return{parameterGroup:{Type:"AWS::RDS::DBParameterGroup",Properties:{DBParameterGroupName:d,Description:`Parameter group for ${d}`,Family:y,Parameters:u,Tags:[{Key:"Name",Value:d},{Key:"Environment",Value:c}]}},logicalId:g}}static enableBackup(n,i=7){return n.Properties.BackupRetentionPeriod=i,n}static createTable(n){let{slug:i,environment:s,tableName:o,partitionKey:c,sortKey:u,billingMode:d="PAY_PER_REQUEST",readCapacity:g=5,writeCapacity:y=5,streamEnabled:h=!1,streamViewType:A="NEW_AND_OLD_IMAGES",encrypted:C=!0,kmsKeyId:v,pointInTimeRecovery:T=!0,ttlAttribute:R}=n,P=o||r({slug:i,environment:s,resourceType:"table"}),I=t(P),M=[{AttributeName:c.name,AttributeType:c.type}];if(u)M.push({AttributeName:u.name,AttributeType:u.type});let L=[{AttributeName:c.name,KeyType:"HASH"}];if(u)L.push({AttributeName:u.name,KeyType:"RANGE"});let N={Type:"AWS::DynamoDB::Table",Properties:{TableName:P,BillingMode:d,AttributeDefinitions:M,KeySchema:L,Tags:[{Key:"Name",Value:P},{Key:"Environment",Value:s}]}};if(d==="PROVISIONED")N.Properties.ProvisionedThroughput={ReadCapacityUnits:g,WriteCapacityUnits:y};if(h)N.Properties.StreamSpecification={StreamViewType:A};if(C)N.Properties.SSESpecification={SSEEnabled:!0,SSEType:v?"KMS":"AES256",KMSMasterKeyId:v};if(T)N.Properties.PointInTimeRecoverySpecification={PointInTimeRecoveryEnabled:!0};if(R)N.Properties.TimeToLiveSpecification={AttributeName:R,Enabled:!0};return{table:N,logicalId:I}}static addGlobalSecondaryIndex(n,i){let{indexName:s,partitionKey:o,sortKey:c,projectionType:u="ALL",nonKeyAttributes:d,readCapacity:g=5,writeCapacity:y=5}=i;if(!n.Properties.AttributeDefinitions.some((C)=>C.AttributeName===o.name))n.Properties.AttributeDefinitions.push({AttributeName:o.name,AttributeType:o.type});if(c&&!n.Properties.AttributeDefinitions.some((C)=>C.AttributeName===c.name))n.Properties.AttributeDefinitions.push({AttributeName:c.name,AttributeType:c.type});let h=[{AttributeName:o.name,KeyType:"HASH"}];if(c)h.push({AttributeName:c.name,KeyType:"RANGE"});let A={IndexName:s,KeySchema:h,Projection:{ProjectionType:u,NonKeyAttributes:u==="INCLUDE"?d:void 0},ProvisionedThroughput:void 0};if(n.Properties.BillingMode==="PROVISIONED")A.ProvisionedThroughput={ReadCapacityUnits:g,WriteCapacityUnits:y};if(!n.Properties.GlobalSecondaryIndexes)n.Properties.GlobalSecondaryIndexes=[];return n.Properties.GlobalSecondaryIndexes.push(A),n}static enableStreams(n,i="NEW_AND_OLD_IMAGES"){return n.Properties.StreamSpecification={StreamViewType:i},n}static InstanceClasses={T3_Micro:"db.t3.micro",T3_Small:"db.t3.small",T3_Medium:"db.t3.medium",T3_Large:"db.t3.large",T4g_Micro:"db.t4g.micro",T4g_Small:"db.t4g.small",T4g_Medium:"db.t4g.medium",M5_Large:"db.m5.large",M5_XLarge:"db.m5.xlarge",M5_2XLarge:"db.m5.2xlarge",R5_Large:"db.r5.large",R5_XLarge:"db.r5.xlarge",R5_2XLarge:"db.r5.2xlarge"}}class qo{static createRedis(n){let{slug:i,environment:s,nodeType:o="cache.t3.micro",engineVersion:c="7.1",port:u=6379,subnetIds:d,securityGroupIds:g,numCacheClusters:y=2,automaticFailover:h=!0,multiAz:A=!0,clusterMode:C=!1,numNodeGroups:v=1,replicasPerNodeGroup:T=1,atRestEncryption:R=!0,transitEncryption:P=!0,authToken:I,kmsKeyId:M,snapshotRetentionDays:L=7,snapshotWindow:N,maintenanceWindow:O}=n,B=r({slug:i,environment:s,resourceType:"redis"}),F=t(B),U,j;if(d&&d.length>0){let z=r({slug:i,environment:s,resourceType:"cache-subnet-group"});j=t(z),U={Type:"AWS::ElastiCache::SubnetGroup",Properties:{CacheSubnetGroupName:z,Description:`Subnet group for ${B}`,SubnetIds:d,Tags:[{Key:"Name",Value:z},{Key:"Environment",Value:s}]}}}let H={Type:"AWS::ElastiCache::ReplicationGroup",Properties:{ReplicationGroupId:B,ReplicationGroupDescription:`Redis cluster for ${i} ${s}`,Engine:"redis",EngineVersion:c,CacheNodeType:o,Port:u,AutomaticFailoverEnabled:h,MultiAZEnabled:A,AtRestEncryptionEnabled:R,TransitEncryptionEnabled:P,SnapshotRetentionLimit:L,AutoMinorVersionUpgrade:!0,Tags:[{Key:"Name",Value:B},{Key:"Environment",Value:s}]}};if(C)H.Properties.NumNodeGroups=v,H.Properties.ReplicasPerNodeGroup=T;else H.Properties.NumCacheClusters=y;if(I)H.Properties.AuthToken=I;if(M)H.Properties.KmsKeyId=M;if(j)H.Properties.CacheSubnetGroupName=x.Ref(j);if(g&&g.length>0)H.Properties.SecurityGroupIds=g;if(N)H.Properties.SnapshotWindow=N;if(O)H.Properties.PreferredMaintenanceWindow=O;return{replicationGroup:H,subnetGroup:U,logicalId:F,subnetGroupId:j}}static createMemcached(n){let{slug:i,environment:s,nodeType:o="cache.t3.micro",engineVersion:c="1.6.22",port:u=11211,numCacheNodes:d=2,subnetIds:g,securityGroupIds:y,azMode:h="cross-az",preferredAzs:A,maintenanceWindow:C}=n,v=r({slug:i,environment:s,resourceType:"memcached"}),T=t(v),R,P;if(g&&g.length>0){let M=r({slug:i,environment:s,resourceType:"cache-subnet-group"});P=t(M),R={Type:"AWS::ElastiCache::SubnetGroup",Properties:{CacheSubnetGroupName:M,Description:`Subnet group for ${v}`,SubnetIds:g,Tags:[{Key:"Name",Value:M},{Key:"Environment",Value:s}]}}}let I={Type:"AWS::ElastiCache::CacheCluster",Properties:{ClusterName:v,CacheNodeType:o,Engine:"memcached",EngineVersion:c,NumCacheNodes:d,Port:u,AZMode:h,AutoMinorVersionUpgrade:!0,Tags:[{Key:"Name",Value:v},{Key:"Environment",Value:s}]}};if(P)I.Properties.CacheSubnetGroupName=x.Ref(P);if(y&&y.length>0)I.Properties.VpcSecurityGroupIds=y;if(A&&A.length>0)I.Properties.PreferredAvailabilityZones=A;if(C)I.Properties.PreferredMaintenanceWindow=C;return{cluster:I,subnetGroup:R,logicalId:T,subnetGroupId:P}}static enableClusterMode(n,i=3,s=2){return delete n.Properties.NumCacheClusters,n.Properties.NumNodeGroups=i,n.Properties.ReplicasPerNodeGroup=s,n}static createRedisParameterGroup(n,i){let{slug:s,environment:o,parameters:c={}}=i,u=r({slug:s,environment:o,resourceType:"redis-params"}),d=t(u);return{parameterGroup:{Type:"AWS::ElastiCache::ParameterGroup",Properties:{CacheParameterGroupFamily:`redis${n.split(".")[0]}.x`,Description:`Parameter group for ${u}`,Properties:c,Tags:[{Key:"Name",Value:u},{Key:"Environment",Value:o}]}},logicalId:d}}static createMemcachedParameterGroup(n,i){let{slug:s,environment:o,parameters:c={}}=i,u=r({slug:s,environment:o,resourceType:"memcached-params"}),d=t(u);return{parameterGroup:{Type:"AWS::ElastiCache::ParameterGroup",Properties:{CacheParameterGroupFamily:`memcached${n.split(".")[0]}.${n.split(".")[1]}`,Description:`Parameter group for ${u}`,Properties:c,Tags:[{Key:"Name",Value:u},{Key:"Environment",Value:o}]}},logicalId:d}}static NodeTypes={T3_Micro:"cache.t3.micro",T3_Small:"cache.t3.small",T3_Medium:"cache.t3.medium",T4g_Micro:"cache.t4g.micro",T4g_Small:"cache.t4g.small",T4g_Medium:"cache.t4g.medium",M5_Large:"cache.m5.large",M5_XLarge:"cache.m5.xlarge",M5_2XLarge:"cache.m5.2xlarge",R5_Large:"cache.r5.large",R5_XLarge:"cache.r5.xlarge",R5_2XLarge:"cache.r5.2xlarge",R5_4XLarge:"cache.r5.4xlarge",R6g_Large:"cache.r6g.large",R6g_XLarge:"cache.r6g.xlarge",R6g_2XLarge:"cache.r6g.2xlarge"}}class ue{static createUser(n){let{slug:i,environment:s,userName:o,groups:c,managedPolicyArns:u}=n,d=o||r({slug:i,environment:s,resourceType:"user"}),g=t(d),y={Type:"AWS::IAM::User",Properties:{UserName:d,Tags:[{Key:"Name",Value:d},{Key:"Environment",Value:s}]}};if(c&&c.length>0)y.Properties.Groups=c;if(u&&u.length>0)y.Properties.ManagedPolicyArns=u;return{user:y,logicalId:g}}static createRole(n){let{slug:i,environment:s,roleName:o,servicePrincipal:c,awsPrincipal:u,managedPolicyArns:d}=n,g=o||r({slug:i,environment:s,resourceType:"role"}),y=t(g),h={};if(c)h.Service=c;if(u)h.AWS=u;let A={Type:"AWS::IAM::Role",Properties:{RoleName:g,AssumeRolePolicyDocument:{Version:"2012-10-17",Statement:[{Effect:"Allow",Principal:h,Action:"sts:AssumeRole"}]},Tags:[{Key:"Name",Value:g},{Key:"Environment",Value:s}]}};if(d&&d.length>0)A.Properties.ManagedPolicyArns=d;return{role:A,logicalId:y}}static createGroup(n){let{slug:i,environment:s,groupName:o,managedPolicyArns:c}=n,u=o||r({slug:i,environment:s,resourceType:"group"}),d=t(u),g={Type:"AWS::IAM::Group",Properties:{GroupName:u}};if(c&&c.length>0)g.Properties.ManagedPolicyArns=c;return{group:g,logicalId:d}}static createPolicy(n){let{slug:i,environment:s,policyName:o,description:c,statements:u}=n,d=o||r({slug:i,environment:s,resourceType:"policy"}),g=t(d),y=u.map((A)=>({Sid:A.sid,Effect:A.effect||"Allow",Action:A.actions,Resource:A.resources,Condition:A.conditions}));return{policy:{Type:"AWS::IAM::ManagedPolicy",Properties:{ManagedPolicyName:d,Description:c||`Managed policy for ${d}`,PolicyDocument:{Version:"2012-10-17",Statement:y}}},logicalId:g}}static attachPolicyToRole(n,i){if(!n.Properties.ManagedPolicyArns)n.Properties.ManagedPolicyArns=[];if(!n.Properties.ManagedPolicyArns.includes(i))n.Properties.ManagedPolicyArns.push(i);return n}static attachPolicyToUser(n,i){if(!n.Properties.ManagedPolicyArns)n.Properties.ManagedPolicyArns=[];if(!n.Properties.ManagedPolicyArns.includes(i))n.Properties.ManagedPolicyArns.push(i);return n}static attachPolicyToGroup(n,i){if(!n.Properties.ManagedPolicyArns)n.Properties.ManagedPolicyArns=[];if(!n.Properties.ManagedPolicyArns.includes(i))n.Properties.ManagedPolicyArns.push(i);return n}static addInlinePolicyToRole(n,i,s){if(!n.Properties.Policies)n.Properties.Policies=[];let o=s.map((c)=>({Effect:c.effect||"Allow",Action:c.actions,Resource:c.resources}));return n.Properties.Policies.push({PolicyName:i,PolicyDocument:{Version:"2012-10-17",Statement:o}}),n}static addInlinePolicyToUser(n,i,s){if(!n.Properties.Policies)n.Properties.Policies=[];let o=s.map((c)=>({Effect:c.effect||"Allow",Action:c.actions,Resource:c.resources}));return n.Properties.Policies.push({PolicyName:i,PolicyDocument:{Version:"2012-10-17",Statement:o}}),n}static createAccessKey(n,i){let{slug:s,environment:o,status:c="Active"}=i,u=r({slug:s,environment:o,resourceType:"access-key"}),d=t(u);return{accessKey:{Type:"AWS::IAM::AccessKey",Properties:{UserName:x.Ref(n),Status:c}},logicalId:d}}static createInstanceProfile(n,i){let{slug:s,environment:o,profileName:c}=i,u=c||r({slug:s,environment:o,resourceType:"instance-profile"}),d=t(u);return{instanceProfile:{Type:"AWS::IAM::InstanceProfile",Properties:{InstanceProfileName:u,Roles:[x.Ref(n)]}},logicalId:d}}static ManagedPolicies={AdministratorAccess:"arn:aws:iam::aws:policy/AdministratorAccess",PowerUserAccess:"arn:aws:iam::aws:policy/PowerUserAccess",ReadOnlyAccess:"arn:aws:iam::aws:policy/ReadOnlyAccess",S3FullAccess:"arn:aws:iam::aws:policy/AmazonS3FullAccess",S3ReadOnlyAccess:"arn:aws:iam::aws:policy/AmazonS3ReadOnlyAccess",DynamoDBFullAccess:"arn:aws:iam::aws:policy/AmazonDynamoDBFullAccess",DynamoDBReadOnlyAccess:"arn:aws:iam::aws:policy/AmazonDynamoDBReadOnlyAccess",RDSFullAccess:"arn:aws:iam::aws:policy/AmazonRDSFullAccess",RDSReadOnlyAccess:"arn:aws:iam::aws:policy/AmazonRDSReadOnlyAccess",LambdaFullAccess:"arn:aws:iam::aws:policy/AWSLambda_FullAccess",LambdaReadOnlyAccess:"arn:aws:iam::aws:policy/AWSLambda_ReadOnlyAccess",LambdaBasicExecutionRole:"arn:aws:iam::aws:policy/service-role/AWSLambdaBasicExecutionRole",LambdaVPCAccessExecutionRole:"arn:aws:iam::aws:policy/service-role/AWSLambdaVPCAccessExecutionRole",EC2FullAccess:"arn:aws:iam::aws:policy/AmazonEC2FullAccess",EC2ReadOnlyAccess:"arn:aws:iam::aws:policy/AmazonEC2ReadOnlyAccess",EC2ContainerRegistryReadOnly:"arn:aws:iam::aws:policy/AmazonEC2ContainerRegistryReadOnly",EC2ContainerRegistryPowerUser:"arn:aws:iam::aws:policy/AmazonEC2ContainerRegistryPowerUser",ECSTaskExecutionRole:"arn:aws:iam::aws:policy/service-role/AmazonECSTaskExecutionRolePolicy",ECSFullAccess:"arn:aws:iam::aws:policy/AmazonECS_FullAccess",CloudWatchFullAccess:"arn:aws:iam::aws:policy/CloudWatchFullAccess",CloudWatchLogsFullAccess:"arn:aws:iam::aws:policy/CloudWatchLogsFullAccess",SESFullAccess:"arn:aws:iam::aws:policy/AmazonSESFullAccess",SNSFullAccess:"arn:aws:iam::aws:policy/AmazonSNSFullAccess",SQSFullAccess:"arn:aws:iam::aws:policy/AmazonSQSFullAccess",SecretsManagerReadWrite:"arn:aws:iam::aws:policy/SecretsManagerReadWrite"};static ServicePrincipals={Lambda:"lambda.amazonaws.com",EC2:"ec2.amazonaws.com",ECS:"ecs.amazonaws.com",ECSTaskExecution:"ecs-tasks.amazonaws.com",APIGateway:"apigateway.amazonaws.com",Events:"events.amazonaws.com",States:"states.amazonaws.com",CodeBuild:"codebuild.amazonaws.com",CodeDeploy:"codedeploy.amazonaws.com",CloudFormation:"cloudformation.amazonaws.com"};static createCiCdUser(n){let{slug:i,environment:s,permissions:o,createAccessKey:c=!0}=n,u={},d=[];if(o.s3Buckets&&o.s3Buckets.length>0)d.push({sid:"S3Access",actions:["s3:GetBucketLocation","s3:ListBucket","s3:GetObject","s3:PutObject","s3:DeleteObject","s3:ListBucketMultipartUploads","s3:AbortMultipartUpload"],resources:[...o.s3Buckets,...o.s3Buckets.map((T)=>`${T}/*`)]});if(o.cloudFrontDistributions&&o.cloudFrontDistributions.length>0)d.push({sid:"CloudFrontAccess",actions:["cloudfront:CreateInvalidation","cloudfront:GetInvalidation","cloudfront:ListInvalidations","cloudfront:GetDistribution"],resources:o.cloudFrontDistributions});if(o.ecrRepositories&&o.ecrRepositories.length>0)d.push({sid:"ECRAccess",actions:["ecr:GetAuthorizationToken","ecr:BatchCheckLayerAvailability","ecr:GetDownloadUrlForLayer","ecr:GetRepositoryPolicy","ecr:DescribeRepositories","ecr:ListImages","ecr:DescribeImages","ecr:BatchGetImage","ecr:InitiateLayerUpload","ecr:UploadLayerPart","ecr:CompleteLayerUpload","ecr:PutImage"],resources:o.ecrRepositories}),d.push({sid:"ECRLogin",actions:["ecr:GetAuthorizationToken"],resources:"*"});if(o.ecsServices&&o.ecsServices.length>0)d.push({sid:"ECSAccess",actions:["ecs:DescribeServices","ecs:DescribeTaskDefinition","ecs:DescribeTasks","ecs:ListTasks","ecs:RegisterTaskDefinition","ecs:UpdateService","ecs:RunTask","ecs:StopTask"],resources:o.ecsServices}),d.push({sid:"ECSTaskDefinitions",actions:["ecs:RegisterTaskDefinition","ecs:DeregisterTaskDefinition"],resources:"*"}),d.push({sid:"ECSPassRole",actions:["iam:PassRole"],resources:"*",conditions:{StringLike:{"iam:PassedToService":"ecs-tasks.amazonaws.com"}}});if(o.cloudFormationStacks&&o.cloudFormationStacks.length>0)d.push({sid:"CloudFormationAccess",actions:["cloudformation:CreateStack","cloudformation:UpdateStack","cloudformation:DeleteStack","cloudformation:DescribeStacks","cloudformation:DescribeStackEvents","cloudformation:DescribeStackResources","cloudformation:GetTemplate","cloudformation:ListStackResources","cloudformation:ValidateTemplate"],resources:o.cloudFormationStacks});if(o.lambdaFunctions&&o.lambdaFunctions.length>0)d.push({sid:"LambdaAccess",actions:["lambda:GetFunction","lambda:UpdateFunctionCode","lambda:UpdateFunctionConfiguration","lambda:PublishVersion","lambda:UpdateAlias","lambda:CreateAlias"],resources:o.lambdaFunctions});if(o.secretsManagerSecrets&&o.secretsManagerSecrets.length>0)d.push({sid:"SecretsManagerAccess",actions:["secretsmanager:GetSecretValue","secretsmanager:DescribeSecret"],resources:o.secretsManagerSecrets});let{policy:g,logicalId:y}=ue.createPolicy({slug:i,environment:s,policyName:r({slug:i,environment:s,resourceType:"cicd-policy"}),description:`CI/CD deployment policy for ${i} (${s})`,statements:d});u[y]=g;let{user:h,logicalId:A}=ue.createUser({slug:i,environment:s,userName:r({slug:i,environment:s,resourceType:"cicd-user"}),managedPolicyArns:[x.Ref(y)]});u[A]=h;let C,v;if(c){let T=ue.createAccessKey(A,{slug:i,environment:s});C=T.accessKey,v=T.logicalId,u[v]=C}return{user:h,accessKey:C,policy:g,userLogicalId:A,accessKeyLogicalId:v,policyLogicalId:y,resources:u}}static createCrossAccountRole(n){let{slug:i,environment:s,trustedAccountIds:o,externalId:c,permissions:u,maxSessionDuration:d=3600}=n,g={},{policy:y,logicalId:h}=ue.createPolicy({slug:i,environment:s,policyName:r({slug:i,environment:s,resourceType:"cross-account-policy"}),description:`Cross-account access policy for ${i} (${s})`,statements:u});g[h]=y;let A=r({slug:i,environment:s,resourceType:"cross-account-role"}),C=t(A),v={};if(c)v.StringEquals={"sts:ExternalId":c};let T={Type:"AWS::IAM::Role",Properties:{RoleName:A,MaxSessionDuration:d,AssumeRolePolicyDocument:{Version:"2012-10-17",Statement:[{Effect:"Allow",Principal:{AWS:o.map((R)=>`arn:aws:iam::${R}:root`)},Action:"sts:AssumeRole",...Object.keys(v).length>0?{Condition:v}:{}}]},ManagedPolicyArns:[x.Ref(h)],Tags:[{Key:"Name",Value:A},{Key:"Environment",Value:s},{Key:"Purpose",Value:"Cross-Account Access"}]}};return g[C]=T,{role:T,policy:y,roleLogicalId:C,policyLogicalId:h,resources:g}}static createCliUser(n){let{slug:i,environment:s,permissions:o="readonly"}=n,c={},u=[],d=[];switch(o){case"readonly":d=[ue.ManagedPolicies.ReadOnlyAccess];break;case"deploy":u=[{sid:"S3Deploy",actions:["s3:*"],resources:"*"},{sid:"CloudFrontDeploy",actions:["cloudfront:*"],resources:"*"},{sid:"ECSDeploy",actions:["ecs:*"],resources:"*"},{sid:"ECRDeploy",actions:["ecr:*"],resources:"*"},{sid:"LambdaDeploy",actions:["lambda:*"],resources:"*"},{sid:"CloudFormationDeploy",actions:["cloudformation:*"],resources:"*"},{sid:"IAMPassRole",actions:["iam:PassRole"],resources:"*"}];break;case"admin":d=[ue.ManagedPolicies.AdministratorAccess];break}let g,y;if(u.length>0){let T=ue.createPolicy({slug:i,environment:s,policyName:r({slug:i,environment:s,resourceType:"cli-policy"}),description:`CLI access policy for ${i} (${s})`,statements:u});g=T.policy,y=T.logicalId,c[y]=g,d=[x.Ref(y)]}let{user:h,logicalId:A}=ue.createUser({slug:i,environment:s,userName:r({slug:i,environment:s,resourceType:"cli-user"}),managedPolicyArns:d});c[A]=h;let{accessKey:C,logicalId:v}=ue.createAccessKey(A,{slug:i,environment:s});return c[v]=C,{user:h,accessKey:C,policy:g,userLogicalId:A,accessKeyLogicalId:v,policyLogicalId:y,resources:c}}static CiCdPolicies={s3Deployment:(n)=>[{sid:"S3ListBuckets",actions:["s3:ListBucket","s3:GetBucketLocation"],resources:n},{sid:"S3Objects",actions:["s3:GetObject","s3:PutObject","s3:DeleteObject"],resources:n.map((i)=>`${i}/*`)}],cloudFrontInvalidation:(n)=>[{sid:"CloudFrontInvalidation",actions:["cloudfront:CreateInvalidation","cloudfront:GetInvalidation","cloudfront:ListInvalidations"],resources:n}],ecsDeployment:()=>[{sid:"ECSServices",actions:["ecs:DescribeServices","ecs:UpdateService","ecs:DescribeTaskDefinition","ecs:RegisterTaskDefinition"],resources:"*"},{sid:"ECSPassRole",actions:["iam:PassRole"],resources:"*",conditions:{StringLike:{"iam:PassedToService":"ecs-tasks.amazonaws.com"}}}],ecrPush:(n)=>[{sid:"ECRAuth",actions:["ecr:GetAuthorizationToken"],resources:"*"},{sid:"ECRPush",actions:["ecr:BatchCheckLayerAvailability","ecr:GetDownloadUrlForLayer","ecr:BatchGetImage","ecr:InitiateLayerUpload","ecr:UploadLayerPart","ecr:CompleteLayerUpload","ecr:PutImage"],resources:n}],lambdaDeployment:(n)=>[{sid:"LambdaDeploy",actions:["lambda:GetFunction","lambda:UpdateFunctionCode","lambda:UpdateFunctionConfiguration","lambda:PublishVersion"],resources:n}],cloudFormationDeployment:(n)=>[{sid:"CloudFormationDeploy",actions:["cloudformation:CreateStack","cloudformation:UpdateStack","cloudformation:DescribeStacks","cloudformation:DescribeStackEvents","cloudformation:GetTemplate"],resources:n}]}}class ml{static createRestApi(n){let{slug:i,environment:s,name:o,description:c,endpointType:u="REGIONAL",binaryMediaTypes:d,compressionSize:g}=n,y=o||r({slug:i,environment:s,resourceType:"rest-api"}),h=t(y),A={Type:"AWS::ApiGateway::RestApi",Properties:{Name:y,Description:c||`REST API for ${i} ${s}`,EndpointConfiguration:{Types:[u]},Tags:[{Key:"Name",Value:y},{Key:"Environment",Value:s}]}};if(d&&d.length>0)A.Properties.BinaryMediaTypes=d;if(g!==void 0)A.Properties.MinimumCompressionSize=g;return{restApi:A,logicalId:h}}static createHttpApi(n){let{slug:i,environment:s,name:o,description:c,corsEnabled:u=!0,corsOrigins:d=["*"],corsMethods:g=["GET","POST","PUT","PATCH","DELETE","OPTIONS"],corsHeaders:y=["*"],corsMaxAge:h=86400,corsAllowCredentials:A=!1}=n,C=o||r({slug:i,environment:s,resourceType:"http-api"}),v=t(C),T={Type:"AWS::ApiGatewayV2::Api",Properties:{Name:C,Description:c||`HTTP API for ${i} ${s}`,ProtocolType:"HTTP",Tags:{Name:C,Environment:s}}};if(u)T.Properties.CorsConfiguration={AllowOrigins:d,AllowMethods:g,AllowHeaders:y,MaxAge:h,AllowCredentials:A};return{httpApi:T,logicalId:v}}static createWebSocketApi(n){let{slug:i,environment:s,name:o,description:c}=n,u=o||r({slug:i,environment:s,resourceType:"ws-api"}),d=t(u);return{webSocketApi:{Type:"AWS::ApiGatewayV2::Api",Properties:{Name:u,Description:c||`WebSocket API for ${i} ${s}`,ProtocolType:"WEBSOCKET",Tags:{Name:u,Environment:s}}},logicalId:d}}static createDeployment(n,i){let{slug:s,environment:o,description:c}=i,u=r({slug:s,environment:o,resourceType:"api-deployment"}),d=t(u);return{deployment:{Type:"AWS::ApiGateway::Deployment",Properties:{RestApiId:x.Ref(n),Description:c||`Deployment for ${u}`}},logicalId:d}}static createStage(n,i,s){let{slug:o,environment:c,stageName:u,description:d,cacheEnabled:g=!1,cacheSize:y="0.5",variables:h,throttling:A}=s,C=r({slug:o,environment:c,resourceType:"api-stage"}),v=t(C),T={Type:"AWS::ApiGateway::Stage",Properties:{StageName:u||c,RestApiId:x.Ref(n),DeploymentId:x.Ref(i),Description:d,CacheClusterEnabled:g,Tags:[{Key:"Name",Value:C},{Key:"Environment",Value:c}]}};if(g)T.Properties.CacheClusterSize=y;if(h)T.Properties.Variables=h;if(A)T.Properties.MethodSettings=[{HttpMethod:"*",ResourcePath:"/*",ThrottlingBurstLimit:A.burstLimit,ThrottlingRateLimit:A.rateLimit}];return{stage:T,logicalId:v}}static createAuthorizer(n,i){let{slug:s,environment:o,name:c,type:u,functionArn:d,identitySource:g,userPoolArns:y,ttl:h=300}=i,A=c||r({slug:s,environment:o,resourceType:"api-authorizer"}),C=t(A),v={Type:"AWS::ApiGateway::Authorizer",Properties:{Name:A,Type:u,RestApiId:x.Ref(n),AuthorizerResultTtlInSeconds:h}};if(u==="TOKEN"||u==="REQUEST"){if(!d)throw Error("Lambda authorizer requires functionArn");v.Properties.AuthorizerUri=d,v.Properties.IdentitySource=g||"method.request.header.Authorization"}if(u==="COGNITO_USER_POOLS"){if(!y||y.length===0)throw Error("Cognito authorizer requires userPoolArns");v.Properties.ProviderARNs=y,v.Properties.IdentitySource=g||"method.request.header.Authorization"}return{authorizer:v,logicalId:C}}static setCors(n,i={}){let{origins:s=["*"],methods:o=["GET","POST","PUT","PATCH","DELETE","OPTIONS"],headers:c=["*"],maxAge:u=86400,allowCredentials:d=!1}=i;return n.Properties.CorsConfiguration={AllowOrigins:s,AllowMethods:o,AllowHeaders:c,MaxAge:u,AllowCredentials:d},n}static addThrottling(n,i=5000,s=1e4){if(!n.Properties.MethodSettings)n.Properties.MethodSettings=[];return n.Properties.MethodSettings.push({HttpMethod:"*",ResourcePath:"/*",ThrottlingBurstLimit:i,ThrottlingRateLimit:s}),n}static enableCaching(n,i="0.5",s=300){if(n.Properties.CacheClusterEnabled=!0,n.Properties.CacheClusterSize=i,!n.Properties.MethodSettings)n.Properties.MethodSettings=[];return n.Properties.MethodSettings.push({HttpMethod:"*",ResourcePath:"/*",CachingEnabled:!0,CacheTtlInSeconds:s}),n}static CacheSizes={Small:"0.5",Medium:"1.6",Large:"6.1",XLarge:"13.5",XXLarge:"28.4",XXXLarge:"58.2",Huge:"118",Massive:"237"};static ThrottlingPresets={Light:{burstLimit:100,rateLimit:50},Medium:{burstLimit:500,rateLimit:250},Heavy:{burstLimit:2000,rateLimit:1000},Default:{burstLimit:5000,rateLimit:1e4}}}class ge{static createTopic(n){let{slug:i,environment:s,topicName:o,displayName:c,encrypted:u=!1,kmsKeyId:d}=n,g=o||r({slug:i,environment:s,resourceType:"topic"}),y=t(g),h={Type:"AWS::SNS::Topic",Properties:{TopicName:g,DisplayName:c||g,Tags:[{Key:"Name",Value:g},{Key:"Environment",Value:s}]}};if(u&&d)h.Properties.KmsMasterKeyId=d;return{topic:h,logicalId:y}}static subscribe(n,i){let{slug:s,environment:o,protocol:c,endpoint:u,filterPolicy:d,rawMessageDelivery:g=!1}=i,y=r({slug:s,environment:o,resourceType:"subscription"}),h=u.replace(/[^a-zA-Z0-9]/g,""),A=h.length>12?h.slice(-12):h,C=t(`${y}-${c}-${A}`),v={Type:"AWS::SNS::Subscription",Properties:{TopicArn:x.Ref(n),Protocol:c,Endpoint:u,RawMessageDelivery:g}};if(d)v.Properties.FilterPolicy=d;return{subscription:v,logicalId:C}}static subscribeEmail(n,i,s){return ge.subscribe(n,{...s,protocol:"email",endpoint:i})}static subscribeLambda(n,i,s){return ge.subscribe(n,{...s,protocol:"lambda",endpoint:i,rawMessageDelivery:!0})}static subscribeSqs(n,i,s){return ge.subscribe(n,{...s,protocol:"sqs",endpoint:i})}static subscribeHttp(n,i,s){let o=i.startsWith("https://")?"https":"http";return ge.subscribe(n,{...s,protocol:o,endpoint:i})}static subscribeSms(n,i,s){return ge.subscribe(n,{...s,protocol:"sms",endpoint:i})}static setTopicPolicy(n,i){let{slug:s,environment:o,allowedPrincipals:c,allowedServices:u,actions:d="SNS:Publish"}=i,g=r({slug:s,environment:o,resourceType:"topic-policy"}),y=t(g),h={};if(c)h.AWS=c;if(u)h.Service=u;return{policy:{Type:"AWS::SNS::TopicPolicy",Properties:{Topics:[x.Ref(n)],PolicyDocument:{Version:"2012-10-17",Statement:[{Effect:"Allow",Principal:h,Action:d,Resource:x.Ref(n)}]}}},logicalId:y}}static allowCloudWatchAlarms(n,i){return ge.setTopicPolicy(n,{...i,allowedServices:"cloudwatch.amazonaws.com",actions:"SNS:Publish"})}static allowEventBridge(n,i){return ge.setTopicPolicy(n,{...i,allowedServices:"events.amazonaws.com",actions:"SNS:Publish"})}static allowS3(n,i){return ge.setTopicPolicy(n,{...i,allowedServices:"s3.amazonaws.com",actions:"SNS:Publish"})}static enableEncryption(n,i){if(!n.Properties)n.Properties={};return n.Properties.KmsMasterKeyId=i,n}static addInlineSubscription(n,i,s){if(!n.Properties)n.Properties={};if(!n.Properties.Subscription)n.Properties.Subscription=[];return n.Properties.Subscription.push({Protocol:i,Endpoint:s}),n}static FilterPolicies={eventType:(n)=>({eventType:n}),status:(n)=>({status:n}),numericRange:(n,i,s)=>({[n]:[{numeric:[">=",i,"<=",s]}]}),prefix:(n,i)=>({[n]:[{prefix:i}]}),and:(...n)=>Object.assign({},...n),exists:(n,i)=>({[n]:[{exists:i}]})};static UseCases={createAlertTopic:(n)=>ge.createTopic({...n,topicName:n.topicName||`${n.slug}-${n.environment}-alerts`,displayName:n.displayName||"Alert Notifications"}),createEventFanout:(n)=>ge.createTopic({...n,topicName:n.topicName||`${n.slug}-${n.environment}-events`,displayName:n.displayName||"Event Fanout"}),createNotificationTopic:(n)=>ge.createTopic({...n,topicName:n.topicName||`${n.slug}-${n.environment}-notifications`,displayName:n.displayName||"User Notifications"})}}class cy{static createStateMachine(n){let{slug:i,environment:s,stateMachineName:o,type:c="STANDARD",definition:u,roleArn:d,loggingConfiguration:g,tracingConfiguration:y}=n,h=o||r({slug:i,environment:s,resourceType:"state-machine"}),A=t(h),C,v,T;if(d)T=d;else{let P=r({slug:i,environment:s,resourceType:"state-machine-role"});v=t(P),C={Type:"AWS::IAM::Role",Properties:{RoleName:P,AssumeRolePolicyDocument:{Version:"2012-10-17",Statement:[{Effect:"Allow",Principal:{Service:"states.amazonaws.com"},Action:"sts:AssumeRole"}]},ManagedPolicyArns:["arn:aws:iam::aws:policy/CloudWatchLogsFullAccess"],Tags:[{Key:"Name",Value:P},{Key:"Environment",Value:s}]}},T=x.GetAtt(v,"Arn")}let R={Type:"AWS::StepFunctions::StateMachine",Properties:{StateMachineName:h,StateMachineType:c,DefinitionString:JSON.stringify(u),RoleArn:T,Tags:[{Key:"Name",Value:h},{Key:"Environment",Value:s}]}};if(g)R.Properties.LoggingConfiguration={Level:g.level,IncludeExecutionData:g.includeExecutionData,Destinations:g.destinations?.map((P)=>({CloudWatchLogsLogGroup:{LogGroupArn:P}}))};if(y)R.Properties.TracingConfiguration={Enabled:y.enabled};return{stateMachine:R,logicalId:A,role:C,roleLogicalId:v}}static createLambdaTask(n,i){return{Type:"Task",Resource:"arn:aws:states:::lambda:invoke",Parameters:{FunctionName:n,Payload:i?.parameters||{"Input.$":"$"}},ResultPath:i?.resultPath,Retry:i?.retry,Catch:i?.catch,Next:i?.next,End:i?.end}}static createDynamoDBTask(n,i,s,o){return{Type:"Task",Resource:{GetItem:"arn:aws:states:::dynamodb:getItem",PutItem:"arn:aws:states:::dynamodb:putItem",UpdateItem:"arn:aws:states:::dynamodb:updateItem",DeleteItem:"arn:aws:states:::dynamodb:deleteItem"}[n],Parameters:{TableName:i,...s},ResultPath:o?.resultPath,Retry:o?.retry,Catch:o?.catch,Next:o?.next,End:o?.end}}static createSNSPublishTask(n,i,s){return{Type:"Task",Resource:"arn:aws:states:::sns:publish",Parameters:{TopicArn:n,Message:i},ResultPath:s?.resultPath,Retry:s?.retry,Catch:s?.catch,Next:s?.next,End:s?.end}}static createSQSSendMessageTask(n,i,s){return{Type:"Task",Resource:"arn:aws:states:::sqs:sendMessage",Parameters:{QueueUrl:n,MessageBody:i},ResultPath:s?.resultPath,Retry:s?.retry,Catch:s?.catch,Next:s?.next,End:s?.end}}static createPassState(n){return{Type:"Pass",Result:n?.result,ResultPath:n?.resultPath,Parameters:n?.parameters,Next:n?.next,End:n?.end}}static createWaitState(n){return{Type:"Wait",Seconds:n.seconds,Timestamp:n.timestamp,SecondsPath:n.secondsPath,TimestampPath:n.timestampPath,Next:n.next,End:n.end}}static createChoiceState(n,i){return{Type:"Choice",Choices:n,Default:i}}static createParallelState(n,i){return{Type:"Parallel",Branches:n,ResultPath:i?.resultPath,Retry:i?.retry,Catch:i?.catch,Next:i?.next,End:i?.end}}static createMapState(n,i){return{Type:"Map",ItemsPath:i?.itemsPath||"$.items",Iterator:n,MaxConcurrency:i?.maxConcurrency,ResultPath:i?.resultPath,Retry:i?.retry,Catch:i?.catch,Next:i?.next,End:i?.end}}static createSucceedState(){return{Type:"Succeed"}}static createFailState(n,i){return{Type:"Fail",Error:n,Cause:i}}static RetryPolicies={standard:()=>({ErrorEquals:["States.ALL"],IntervalSeconds:2,MaxAttempts:3,BackoffRate:2}),aggressive:()=>({ErrorEquals:["States.TaskFailed","States.Timeout"],IntervalSeconds:1,MaxAttempts:5,BackoffRate:1.5}),custom:(n,i,s,o)=>({ErrorEquals:n,IntervalSeconds:i,MaxAttempts:s,BackoffRate:o})};static CatchPolicies={all:(n,i)=>({ErrorEquals:["States.ALL"],Next:n,ResultPath:i||"$.error"}),specific:(n,i,s)=>({ErrorEquals:n,Next:i,ResultPath:s||"$.error"})};static Patterns={sequential:(n,i,s)=>{let o={};return s.forEach((c,u)=>{let d=u===s.length-1;o[c.name]={...c.state,Next:d?void 0:s[u+1].name,End:d}}),{Comment:"Sequential workflow",StartAt:s[0].name,States:o}},fanout:(n,i,s)=>({Comment:"Fan-out workflow",StartAt:"Parallel",States:{Parallel:{Type:"Parallel",Branches:s.map((o)=>o.definition),End:!0}}}),map:(n,i,s,o)=>({Comment:"Map workflow",StartAt:"Map",States:{Map:{Type:"Map",ItemsPath:"$.items",Iterator:s,MaxConcurrency:o,End:!0}}}),withErrorHandling:(n,i,s,o)=>({Comment:"Workflow with error handling",StartAt:"Main",States:{Main:{...s,Catch:[{ErrorEquals:["States.ALL"],Next:"ErrorHandler"}],Next:"Success"},ErrorHandler:o,Success:{Type:"Succeed"}}})}}class jo{static createAlarm(n){let{slug:i,environment:s,alarmName:o,metricName:c,namespace:u,statistic:d="Average",period:g=300,evaluationPeriods:y=1,threshold:h,comparisonOperator:A,treatMissingData:C="notBreaching",actionsEnabled:v=!0,alarmActions:T,okActions:R,insufficientDataActions:P,dimensions:I,unit:M,datapointsToAlarm:L}=n,N=o||r({slug:i,environment:s,resourceType:"alarm"}),O=t(N),B={Type:"AWS::CloudWatch::Alarm",Properties:{AlarmName:N,MetricName:c,Namespace:u,Statistic:d,Period:g,EvaluationPeriods:y,Threshold:h,ComparisonOperator:A,TreatMissingData:C,ActionsEnabled:v}};if(T&&T.length>0)B.Properties.AlarmActions=T;if(R&&R.length>0)B.Properties.OKActions=R;if(P&&P.length>0)B.Properties.InsufficientDataActions=P;if(I)B.Properties.Dimensions=Object.entries(I).map(([F,U])=>({Name:F,Value:U}));if(M)B.Properties.Unit=M;if(L!==void 0)B.Properties.DatapointsToAlarm=L;return{alarm:B,logicalId:O}}static createCompositeAlarm(n){let{slug:i,environment:s,alarmName:o,alarmRule:c,actionsEnabled:u=!0,alarmActions:d,okActions:g,insufficientDataActions:y}=n,h=o||r({slug:i,environment:s,resourceType:"composite-alarm"}),A=t(h),C={Type:"AWS::CloudWatch::CompositeAlarm",Properties:{AlarmName:h,AlarmRule:c,ActionsEnabled:u}};if(d&&d.length>0)C.Properties.AlarmActions=d;if(g&&g.length>0)C.Properties.OKActions=g;if(y&&y.length>0)C.Properties.InsufficientDataActions=y;return{alarm:C,logicalId:A}}static createDashboard(n){let{slug:i,environment:s,dashboardName:o,widgets:c}=n,u=o||r({slug:i,environment:s,resourceType:"dashboard"}),d=t(u),g={widgets:c.map((h)=>({type:h.type,x:h.x,y:h.y,width:h.width,height:h.height,properties:h.properties}))};return{dashboard:{Type:"AWS::CloudWatch::Dashboard",Properties:{DashboardName:u,DashboardBody:JSON.stringify(g)}},logicalId:d}}static createLogGroup(n){let{slug:i,environment:s,logGroupName:o,retentionInDays:c,kmsKeyId:u}=n,d=o||r({slug:i,environment:s,resourceType:"log-group"}),g=t(d),y={Type:"AWS::Logs::LogGroup",Properties:{LogGroupName:d}};if(c!==void 0)y.Properties.RetentionInDays=c;if(u)y.Properties.KmsKeyId=u;return{logGroup:y,logicalId:g}}static createLogStream(n,i){let{slug:s,environment:o,logStreamName:c}=i,u=c||r({slug:s,environment:o,resourceType:"log-stream"}),d=t(u);return{logStream:{Type:"AWS::Logs::LogStream",Properties:{LogGroupName:x.Ref(n),LogStreamName:u}},logicalId:d}}static createMetricFilter(n,i){let{slug:s,environment:o,filterName:c,filterPattern:u,metricTransformations:d}=i,g=c||r({slug:s,environment:o,resourceType:"metric-filter"}),y=t(g);return{metricFilter:{Type:"AWS::Logs::MetricFilter",Properties:{LogGroupName:x.Ref(n),FilterPattern:u,MetricTransformations:d.map((A)=>({MetricName:A.metricName,MetricNamespace:A.metricNamespace,MetricValue:A.metricValue,DefaultValue:A.defaultValue,Unit:A.unit}))}},logicalId:y}}static AlarmTypes={highCpu:(n,i,s,o=80,c)=>({slug:n,environment:i,alarmName:`${n}-${i}-high-cpu`,metricName:"CPUUtilization",namespace:"AWS/EC2",statistic:"Average",period:300,evaluationPeriods:2,threshold:o,comparisonOperator:"GreaterThanThreshold",dimensions:{InstanceId:s},alarmActions:c?[c]:void 0}),highMemory:(n,i,s,o=80,c)=>({slug:n,environment:i,alarmName:`${n}-${i}-high-memory`,metricName:"MemoryUtilization",namespace:"System/Linux",statistic:"Average",period:300,evaluationPeriods:2,threshold:o,comparisonOperator:"GreaterThanThreshold",dimensions:{InstanceId:s},alarmActions:c?[c]:void 0}),highDisk:(n,i,s,o=80,c)=>({slug:n,environment:i,alarmName:`${n}-${i}-high-disk`,metricName:"DiskSpaceUtilization",namespace:"System/Linux",statistic:"Average",period:300,evaluationPeriods:2,threshold:o,comparisonOperator:"GreaterThanThreshold",dimensions:{InstanceId:s,Filesystem:"/dev/xvda1",MountPath:"/"},alarmActions:c?[c]:void 0}),lambdaErrors:(n,i,s,o=5,c)=>({slug:n,environment:i,alarmName:`${n}-${i}-lambda-errors`,metricName:"Errors",namespace:"AWS/Lambda",statistic:"Sum",period:300,evaluationPeriods:1,threshold:o,comparisonOperator:"GreaterThanThreshold",dimensions:{FunctionName:s},alarmActions:c?[c]:void 0}),lambdaThrottles:(n,i,s,o=10,c)=>({slug:n,environment:i,alarmName:`${n}-${i}-lambda-throttles`,metricName:"Throttles",namespace:"AWS/Lambda",statistic:"Sum",period:300,evaluationPeriods:1,threshold:o,comparisonOperator:"GreaterThanThreshold",dimensions:{FunctionName:s},alarmActions:c?[c]:void 0}),apiGateway5xxErrors:(n,i,s,o=10,c)=>({slug:n,environment:i,alarmName:`${n}-${i}-api-5xx-errors`,metricName:"5XXError",namespace:"AWS/ApiGateway",statistic:"Sum",period:300,evaluationPeriods:1,threshold:o,comparisonOperator:"GreaterThanThreshold",dimensions:{ApiName:s},alarmActions:c?[c]:void 0}),apiGateway4xxErrors:(n,i,s,o=50,c)=>({slug:n,environment:i,alarmName:`${n}-${i}-api-4xx-errors`,metricName:"4XXError",namespace:"AWS/ApiGateway",statistic:"Sum",period:300,evaluationPeriods:2,threshold:o,comparisonOperator:"GreaterThanThreshold",dimensions:{ApiName:s},alarmActions:c?[c]:void 0}),dynamoDBThrottles:(n,i,s,o=5,c)=>({slug:n,environment:i,alarmName:`${n}-${i}-dynamodb-throttles`,metricName:"UserErrors",namespace:"AWS/DynamoDB",statistic:"Sum",period:300,evaluationPeriods:1,threshold:o,comparisonOperator:"GreaterThanThreshold",dimensions:{TableName:s},alarmActions:c?[c]:void 0}),rdsCpu:(n,i,s,o=80,c)=>({slug:n,environment:i,alarmName:`${n}-${i}-rds-cpu`,metricName:"CPUUtilization",namespace:"AWS/RDS",statistic:"Average",period:300,evaluationPeriods:2,threshold:o,comparisonOperator:"GreaterThanThreshold",dimensions:{DBInstanceIdentifier:s},alarmActions:c?[c]:void 0}),rdsFreeStorage:(n,i,s,o=5368709120,c)=>({slug:n,environment:i,alarmName:`${n}-${i}-rds-storage`,metricName:"FreeStorageSpace",namespace:"AWS/RDS",statistic:"Average",period:300,evaluationPeriods:1,threshold:o,comparisonOperator:"LessThanThreshold",dimensions:{DBInstanceIdentifier:s},alarmActions:c?[c]:void 0,unit:"Bytes"}),sqsQueueDepth:(n,i,s,o=100,c)=>({slug:n,environment:i,alarmName:`${n}-${i}-sqs-depth`,metricName:"ApproximateNumberOfMessagesVisible",namespace:"AWS/SQS",statistic:"Average",period:300,evaluationPeriods:2,threshold:o,comparisonOperator:"GreaterThanThreshold",dimensions:{QueueName:s},alarmActions:c?[c]:void 0}),albUnhealthyTargets:(n,i,s,o,c=1,u)=>({slug:n,environment:i,alarmName:`${n}-${i}-alb-unhealthy`,metricName:"UnHealthyHostCount",namespace:"AWS/ApplicationELB",statistic:"Average",period:300,evaluationPeriods:2,threshold:c,comparisonOperator:"GreaterThanThreshold",dimensions:{LoadBalancer:s,TargetGroup:o},alarmActions:u?[u]:void 0}),sesBounceRate:(n,i,s=5,o)=>({slug:n,environment:i,alarmName:`${n}-${i}-ses-bounce-rate`,metricName:"Reputation.BounceRate",namespace:"AWS/SES",statistic:"Average",period:3600,evaluationPeriods:1,threshold:s/100,comparisonOperator:"GreaterThanThreshold",alarmActions:o?[o]:void 0}),sesComplaintRate:(n,i,s=0.1,o)=>({slug:n,environment:i,alarmName:`${n}-${i}-ses-complaint-rate`,metricName:"Reputation.ComplaintRate",namespace:"AWS/SES",statistic:"Average",period:3600,evaluationPeriods:1,threshold:s/100,comparisonOperator:"GreaterThanThreshold",alarmActions:o?[o]:void 0}),smsDeliveryFailure:(n,i,s,o=10,c)=>({slug:n,environment:i,alarmName:`${n}-${i}-sms-delivery-failure`,metricName:"DirectSendMessagePermanentFailure",namespace:"AWS/Pinpoint",statistic:"Sum",period:300,evaluationPeriods:1,threshold:o,comparisonOperator:"GreaterThanThreshold",dimensions:{ApplicationId:s},alarmActions:c?[c]:void 0}),smsSpendLimit:(n,i,s=100,o)=>({slug:n,environment:i,alarmName:`${n}-${i}-sms-spend-limit`,metricName:"DirectSendMessageSpend",namespace:"AWS/Pinpoint",statistic:"Sum",period:86400,evaluationPeriods:1,threshold:s,comparisonOperator:"GreaterThanThreshold",alarmActions:o?[o]:void 0}),connectMissedCalls:(n,i,s,o=5,c)=>({slug:n,environment:i,alarmName:`${n}-${i}-connect-missed-calls`,metricName:"MissedCalls",namespace:"AWS/Connect",statistic:"Sum",period:3600,evaluationPeriods:1,threshold:o,comparisonOperator:"GreaterThanThreshold",dimensions:{InstanceId:s},alarmActions:c?[c]:void 0})};static DashboardWidgets={metric:(n,i,s,o,c,u)=>({type:"metric",x:n,y:i,width:s,height:o,properties:{metrics:c,title:u||"Metrics",region:"us-east-1",period:300}}),text:(n,i,s,o,c)=>({type:"text",x:n,y:i,width:s,height:o,properties:{markdown:c}}),log:(n,i,s,o,c,u)=>({type:"log",x:n,y:i,width:s,height:o,properties:{query:`SOURCE '${c.join("' | SOURCE '")}'
 | fields @timestamp, @message
 | sort @timestamp desc
 | limit 20`,region:"us-east-1",title:u||"Logs"}})};static RetentionPeriods={ONE_DAY:1,THREE_DAYS:3,FIVE_DAYS:5,ONE_WEEK:7,TWO_WEEKS:14,ONE_MONTH:30,TWO_MONTHS:60,THREE_MONTHS:90,FOUR_MONTHS:120,FIVE_MONTHS:150,SIX_MONTHS:180,ONE_YEAR:365,THIRTEEN_MONTHS:400,EIGHTEEN_MONTHS:545,TWO_YEARS:731,FIVE_YEARS:1827,TEN_YEARS:3653,NEVER_EXPIRE:void 0};static FilterPatterns={errors:"[time, request_id, event_type = ERROR*, ...]",all:"",jsonField:(n,i)=>`{ $.${n} = "${i}" }`,httpStatus:(n)=>`[..., status_code = ${n}, ...]`,http4xx:"[..., status_code = 4*, ...]",http5xx:"[..., status_code = 5*, ...]"};static createApplicationDashboard(n){let{slug:i,environment:s,region:o="us-east-1",components:c={}}=n,u=[],d=0;if(u.push({type:"text",x:0,y:d,width:24,height:1,properties:{markdown:`# ${i.toUpperCase()} Dashboard (${s})`}}),d+=1,c.ec2InstanceIds&&c.ec2InstanceIds.length>0)u.push({type:"text",x:0,y:d,width:24,height:1,properties:{markdown:"## EC2 Instances"}}),d+=1,u.push({type:"metric",x:0,y:d,width:8,height:6,properties:{title:"CPU Utilization",region:o,metrics:c.ec2InstanceIds.map((g)=>["AWS/EC2","CPUUtilization","InstanceId",g]),period:300,stat:"Average"}}),u.push({type:"metric",x:8,y:d,width:8,height:6,properties:{title:"Network Traffic",region:o,metrics:[...c.ec2InstanceIds.flatMap((g)=>[["AWS/EC2","NetworkIn","InstanceId",g,{label:`${g} In`}],["AWS/EC2","NetworkOut","InstanceId",g,{label:`${g} Out`}]])],period:300,stat:"Sum"}}),u.push({type:"metric",x:16,y:d,width:8,height:6,properties:{title:"Status Checks",region:o,metrics:c.ec2InstanceIds.map((g)=>["AWS/EC2","StatusCheckFailed","InstanceId",g]),period:60,stat:"Maximum"}}),d+=6;if(c.lambdaFunctionNames&&c.lambdaFunctionNames.length>0)u.push({type:"text",x:0,y:d,width:24,height:1,properties:{markdown:"## Lambda Functions"}}),d+=1,u.push({type:"metric",x:0,y:d,width:8,height:6,properties:{title:"Invocations",region:o,metrics:c.lambdaFunctionNames.map((g)=>["AWS/Lambda","Invocations","FunctionName",g]),period:300,stat:"Sum"}}),u.push({type:"metric",x:8,y:d,width:8,height:6,properties:{title:"Duration",region:o,metrics:c.lambdaFunctionNames.map((g)=>["AWS/Lambda","Duration","FunctionName",g]),period:300,stat:"Average"}}),u.push({type:"metric",x:16,y:d,width:8,height:6,properties:{title:"Errors",region:o,metrics:c.lambdaFunctionNames.map((g)=>["AWS/Lambda","Errors","FunctionName",g]),period:300,stat:"Sum"}}),d+=6;if(c.ecsClusterName&&c.ecsServiceName)u.push({type:"text",x:0,y:d,width:24,height:1,properties:{markdown:"## ECS Service"}}),d+=1,u.push({type:"metric",x:0,y:d,width:8,height:6,properties:{title:"CPU Utilization",region:o,metrics:[["AWS/ECS","CPUUtilization","ClusterName",c.ecsClusterName,"ServiceName",c.ecsServiceName]],period:300,stat:"Average"}}),u.push({type:"metric",x:8,y:d,width:8,height:6,properties:{title:"Memory Utilization",region:o,metrics:[["AWS/ECS","MemoryUtilization","ClusterName",c.ecsClusterName,"ServiceName",c.ecsServiceName]],period:300,stat:"Average"}}),u.push({type:"metric",x:16,y:d,width:8,height:6,properties:{title:"Running Tasks",region:o,metrics:[["ECS/ContainerInsights","RunningTaskCount","ClusterName",c.ecsClusterName,"ServiceName",c.ecsServiceName]],period:60,stat:"Average"}}),d+=6;if(c.albName)u.push({type:"text",x:0,y:d,width:24,height:1,properties:{markdown:"## Application Load Balancer"}}),d+=1,u.push({type:"metric",x:0,y:d,width:8,height:6,properties:{title:"Request Count",region:o,metrics:[["AWS/ApplicationELB","RequestCount","LoadBalancer",c.albName]],period:60,stat:"Sum"}}),u.push({type:"metric",x:8,y:d,width:8,height:6,properties:{title:"Response Time",region:o,metrics:[["AWS/ApplicationELB","TargetResponseTime","LoadBalancer",c.albName]],period:60,stat:"Average"}}),u.push({type:"metric",x:16,y:d,width:8,height:6,properties:{title:"HTTP Errors",region:o,metrics:[["AWS/ApplicationELB","HTTPCode_Target_4XX_Count","LoadBalancer",c.albName,{label:"4XX"}],["AWS/ApplicationELB","HTTPCode_Target_5XX_Count","LoadBalancer",c.albName,{label:"5XX"}]],period:60,stat:"Sum"}}),d+=6;if(c.rdsInstanceId)u.push({type:"text",x:0,y:d,width:24,height:1,properties:{markdown:"## RDS Database"}}),d+=1,u.push({type:"metric",x:0,y:d,width:8,height:6,properties:{title:"CPU Utilization",region:o,metrics:[["AWS/RDS","CPUUtilization","DBInstanceIdentifier",c.rdsInstanceId]],period:300,stat:"Average"}}),u.push({type:"metric",x:8,y:d,width:8,height:6,properties:{title:"Database Connections",region:o,metrics:[["AWS/RDS","DatabaseConnections","DBInstanceIdentifier",c.rdsInstanceId]],period:60,stat:"Sum"}}),u.push({type:"metric",x:16,y:d,width:8,height:6,properties:{title:"Free Storage Space",region:o,metrics:[["AWS/RDS","FreeStorageSpace","DBInstanceIdentifier",c.rdsInstanceId]],period:300,stat:"Average"}}),d+=6;if(c.sqsQueueNames&&c.sqsQueueNames.length>0)u.push({type:"text",x:0,y:d,width:24,height:1,properties:{markdown:"## SQS Queues"}}),d+=1,u.push({type:"metric",x:0,y:d,width:12,height:6,properties:{title:"Messages Visible",region:o,metrics:c.sqsQueueNames.map((g)=>["AWS/SQS","ApproximateNumberOfMessagesVisible","QueueName",g]),period:60,stat:"Sum"}}),u.push({type:"metric",x:12,y:d,width:12,height:6,properties:{title:"Message Age",region:o,metrics:c.sqsQueueNames.map((g)=>["AWS/SQS","ApproximateAgeOfOldestMessage","QueueName",g]),period:60,stat:"Maximum"}}),d+=6;if(c.logGroupNames&&c.logGroupNames.length>0)u.push({type:"text",x:0,y:d,width:24,height:1,properties:{markdown:"## Application Logs"}}),d+=1,u.push({type:"log",x:0,y:d,width:24,height:6,properties:{query:`SOURCE '${c.logGroupNames.join("' | SOURCE '")}'
@@ -2457,7 +2457,7 @@ rpm -U ./amazon-cloudwatch-agent.rpm || true
 # Mount EFS for shared file storage
 `}},storage:{uploads:{type:"efs",performanceMode:"generalPurpose",throughputMode:"bursting",encrypted:!0,lifecyclePolicy:{transitionToIA:30}},backups:{public:!1,versioning:!0,encryption:!0,lifecycleRules:[{id:"ArchiveOldBackups",enabled:!0,transitions:[{days:90,storageClass:"GLACIER"}]}]},static:{public:!0,versioning:!1,encryption:!1,cors:[{allowedOrigins:[o||"*"],allowedMethods:["GET","HEAD"]}]}},cdn:{enabled:!0,origins:[{originId:"static-assets",domainName:`${s}-static.s3.amazonaws.com`,pathPattern:"/static/*"}],customDomain:o?{domain:o,certificateArn:"TO_BE_GENERATED"}:void 0,cachePolicy:{minTTL:0,defaultTTL:86400,maxTTL:31536000},compress:!0,http3:!0},databases:g==="mysql"?{mysql:{engine:"mysql",version:"8.0",instanceClass:"db.t3.medium",allocatedStorage:100,maxAllocatedStorage:500,multiAZ:!0,backupRetentionDays:14,preferredBackupWindow:"03:00-04:00",preferredMaintenanceWindow:"sun:04:00-sun:05:00",enablePerformanceInsights:!0,performanceInsightsRetention:7,deletionProtection:!0,parameters:{max_connections:"500",innodb_buffer_pool_size:"{DBInstanceClassMemory*3/4}",slow_query_log:"1",long_query_time:"2"}}}:{postgres:{engine:"postgres",version:"15",instanceClass:"db.t3.medium",allocatedStorage:100,maxAllocatedStorage:500,multiAZ:!0,backupRetentionDays:14,preferredBackupWindow:"03:00-04:00",preferredMaintenanceWindow:"sun:04:00-sun:05:00",enablePerformanceInsights:!0,performanceInsightsRetention:7,deletionProtection:!0,parameters:{max_connections:"500",shared_buffers:"{DBInstanceClassMemory/4}",log_min_duration_statement:"2000"}}},cache:y==="redis"?{redis:{nodeType:"cache.t3.medium",numCacheNodes:2,engine:"redis",engineVersion:"7.0",port:6379,parameterGroup:{maxmemoryPolicy:"allkeys-lru",timeout:"300"},snapshotRetentionLimit:5,snapshotWindow:"03:00-05:00",automaticFailoverEnabled:!0}}:void 0,queues:{jobs:{fifo:!1,visibilityTimeout:900,messageRetentionPeriod:345600,receiveMessageWaitTime:20,deadLetterQueue:!0,maxReceiveCount:3},emails:{fifo:!1,visibilityTimeout:300,messageRetentionPeriod:86400,deadLetterQueue:!0}},functions:{"job-worker":{runtime:"nodejs20.x",handler:"dist/workers/jobs.handler",memory:2048,timeout:900,events:[{type:"sqs",queueName:`${s}-jobs`,batchSize:10}]},"email-sender":{runtime:"nodejs20.x",handler:"dist/workers/email.handler",memory:512,timeout:60,events:[{type:"sqs",queueName:`${s}-emails`,batchSize:10}]},cleanup:{runtime:"nodejs20.x",handler:"dist/tasks/cleanup.handler",memory:512,timeout:300,events:[{type:"schedule",expression:"cron(0 2 * * ? *)"}]}},monitoring:{dashboard:{name:`${s}-web-app`,widgets:[{type:"metric",metrics:["EC2CPUUtilization","ALBRequestCount","ALBTargetResponseTime","RDSCPUUtilization","RDSDatabaseConnections","RDSReadLatency","RDSWriteLatency"]}]},alarms:[{metric:"EC2CPUUtilization",threshold:80,evaluationPeriods:2},{metric:"RDSCPUUtilization",threshold:80,evaluationPeriods:2},{metric:"RDSDatabaseConnections",threshold:400,evaluationPeriods:1},{metric:"ALBTargetResponseTime",threshold:2000,evaluationPeriods:2},{metric:"ALBUnhealthyHostCount",threshold:1,evaluationPeriods:1}],logs:{retention:14,groups:[`${s}-app`,`${s}-nginx`,`${s}-workers`]}},security:{certificate:o?{domain:o,validationMethod:"DNS"}:void 0,waf:{enabled:!0,rules:["rateLimit","sqlInjection","xss","knownBadInputs"]},securityGroups:{alb:{ingress:[{port:80,protocol:"tcp",cidr:"0.0.0.0/0"},{port:443,protocol:"tcp",cidr:"0.0.0.0/0"}]},app:{ingress:[{port:3000,protocol:"tcp",source:"alb-sg"}]},database:{ingress:[{port:g==="mysql"?3306:5432,protocol:"tcp",source:"app-sg"}]},...y==="redis"&&{cache:{ingress:[{port:6379,protocol:"tcp",source:"app-sg"}]}}}}}}}function ub(n){let{name:i,slug:s,domain:o,repository:c,phpVersion:u="8.3",size:d="small",database:g=s.replace(/-/g,"_"),databasePassword:y,sslEmail:h,deployStrategy:A="push",provider:C="hetzner"}=n;return{project:{name:i,slug:s,region:"us-east-1"},mode:"server",cloud:{provider:C},environments:{production:{type:"production",domain:o}},infrastructure:{compute:{mode:"server",size:d,runtime:"php",webServer:"nginx",php:{versions:[u],default:u},managedServices:{mysql:!0,redis:!0},firewall:{enabled:!0},autoUpdates:!0,monitoring:!0,backups:{enabled:!0,schedule:"0 2 * * *",retentionCount:7}},appDatabase:{engine:"mysql",name:g,username:g,password:y}},sites:{main:{root:".",type:"laravel",domain:o,phpVersion:u,repository:{...c,strategy:A},scheduler:!0,queues:[{connection:"redis",queue:"default",processes:1}],ssl:{provider:"letsencrypt",email:h}}}}}function gb(n){let{name:i,slug:s,domain:o,layers:c,phpVersion:u="8.3",architecture:d="x86_64",memory:g=1024,build:y,deploy:h=["migrate --force"],cache:A="dynamodb",scheduler:C="on",region:v="us-east-1"}=n;return{project:{name:i,slug:s,region:v},mode:"serverless",environments:{production:{type:"production",domain:o,app:{kind:"php",runtime:"provided.al2023",phpVersion:u,architecture:d,layers:c,memory:g,build:y,deploy:h,assets:"public",queues:!0,scheduler:C,cache:{driver:A},domain:o}}}}}function pb(n){return{root:n.root??"packages/ui/dist",deploy:"server",type:"static",domain:n.domain,build:n.build??"cd packages/ui && bun install && bun run build",ssl:{provider:"letsencrypt"},auth:{username:n.username??"admin",password:n.password}}}var dy=rl,ly="./node_modules/@stacksjs/ts-cloud/dist/bin/dashboard-server.js";function ci(n){let i=n.split(".").filter(Boolean);return i.length<=2?n:i.slice(-2).join(".")}function li(n){let i=2166136261;for(let s=0;s<n.length;s++)i^=n.charCodeAt(s),i=Math.imul(i,16777619);return i>>>0}var uy=20000,gy=12000;function py(n){return uy+li(n)%gy}function Mn(n,i){let s=ci(n);if(s===n)return`dashboard.${s}`;for(let o of i)if(o===s)return`dashboard.${s}`;return`dashboard.${n}`}function Ln(n,i){let s=[],o=n.infrastructure?.dns?.domain;if(o&&!n.cloud?.attachTo)s.push(o);if(i&&n.environments?.[i]?.domain)s.push(n.environments[i].domain);for(let c of Object.values(n.sites??{})){let u=c;if(!u||u.redirect)continue;let d=u.domain;if(typeof d==="string")s.push(d);else if(Array.isArray(d))s.push(...d.filter((g)=>typeof g==="string"))}return s.filter((c)=>c&&!c.startsWith("dashboard."))}function my(n,i,s){if(s)return s;let o=Ln(n,i),c=o[0];if(!c)return null;return Mn(c,o)}function fy(n,i,s){if(s)return[s];let o=Ln(n,i),c=[];for(let u of o){let d=Mn(u,o);if(!c.includes(d))c.push(d)}return c}function pr(n){return Object.entries(n.sites??{}).some(([i,s])=>{if(!s)return!1;let o=s.root??"";return mr(i)||o==="ui/dist"||o.endsWith("/ui/dist")||o.endsWith("/dist/ui")})}var Om="dashboard-";function _m(n){return Om+n.replace(/^dashboard\./,"").replace(/\./g,"-")}function mr(n){return n==="dashboard"||n.startsWith(Om)}function Zi(n,i,s){if(pr(n))return[];if(n.cloud?.attachTo)return[];let o=s.password?{auth:{username:s.username||"admin",password:s.password,realm:s.realm}}:{},c=s.build===!1||s.build===void 0?{}:{build:s.build};if(s.live!==!1){let d=my(n,i,s.domain);if(!d)return[];let g=s.port??py(d),y=n.infrastructure?.appDatabase??n.infrastructure?.compute?.database,h={root:s.uiRoot,deploy:"server",domain:d,preStart:["bun install --production --no-save"],start:`bun ${ly} --box --host 127.0.0.1 --port ${g}`,port:g,cpuWeight:10,ioWeight:10,tasksMax:128,env:{APP_ENV:"production",NODE_ENV:"production",TS_CLOUD_DASHBOARD_TELEMETRY:"1",...y?.password?{TS_CLOUD_DASHBOARD_DB_PASSWORD:y.password}:{}},zeroDowntime:!1,sharedPaths:[dy],healthCheck:{path:"/login"},ssl:{provider:"letsencrypt"}};return[{name:_m(d),site:h}]}return fy(n,i,s.domain).map((d)=>({name:_m(d),site:{root:s.uiRoot,deploy:"server",type:"static",domain:d,ssl:{provider:"letsencrypt"},...c,...o}}))}function mb(n,i,s){return Zi(n,i,s)[0]??null}function Et(n,i){let s={...n};for(let o in i){let c=i[o],u=s[o];if(c===void 0)continue;if(Array.isArray(c)&&Array.isArray(u))s[o]=[...u,...c];else if(typeof c==="object"&&c!==null&&!Array.isArray(c)&&typeof u==="object"&&u!==null&&!Array.isArray(u))s[o]=Et(u,c);else s[o]=c}return s}function Lm(n,i){return Et(n,i)}function fb(...n){return n.reduce((i,s)=>Et(i,s),{})}function hb(n,i){return(s)=>{let o=n(s);if(typeof i==="function")return Lm(o,i(o,s));return Lm(o,i)}}function pn(n){return{infrastructure:n}}function Ab(n){return pn({monitoring:n})}function yb(n){return pn({security:n})}function Sb(n){return pn({databases:n})}function Ib(n){return pn({cache:n})}function bb(n){return pn({cdn:n})}function Cb(n){return pn({queues:n})}import{existsSync as On,readFileSync as wt}from"node:fs";import{homedir as $n}from"node:os";import{join as Bn}from"node:path";function hy(){let n=process.env.AWS_ACCESS_KEY_ID,i=process.env.AWS_SECRET_ACCESS_KEY;if(!n||!i)return null;return{accessKeyId:n,secretAccessKey:i,sessionToken:process.env.AWS_SESSION_TOKEN}}function Ay(n){let i=n?.profile||process.env.AWS_PROFILE||"default",s=n?.credentialsFile||Bn($n(),".aws","credentials");if(!On(s))return null;try{let o=wt(s,"utf-8");return ui(o,i)}catch{return null}}function ui(n,i){let s=n.split(`
 `),o=null,c,u,d;for(let g of s){let y=g.trim();if(!y||y.startsWith("#")||y.startsWith(";"))continue;let h=y.match(/^\[([^\]]+)\]$/);if(h){if(o===i&&c&&u)return{accessKeyId:c,secretAccessKey:u,sessionToken:d};o=h[1],c=void 0,u=void 0,d=void 0;continue}if(o===i){let[A,...C]=y.split("="),v=C.join("=").trim();switch(A.trim().toLowerCase()){case"aws_access_key_id":c=v;break;case"aws_secret_access_key":u=v;break;case"aws_session_token":d=v;break}}}if(o===i&&c&&u)return{accessKeyId:c,secretAccessKey:u,sessionToken:d};return null}async function yy(n){let i=n?.timeout??1000,s="http://169.254.169.254";try{let o=await ze("http://169.254.169.254/latest/api/token",{method:"PUT",headers:{"X-aws-ec2-metadata-token-ttl-seconds":"21600"}},i);if(!o.ok)return null;let c=await o.text(),u=await ze("http://169.254.169.254/latest/meta-data/iam/security-credentials/",{headers:{"X-aws-ec2-metadata-token":c}},i);if(!u.ok)return null;let d=(await u.text()).trim(),g=await ze(`http://169.254.169.254/latest/meta-data/iam/security-credentials/${d}`,{headers:{"X-aws-ec2-metadata-token":c}},i);if(!g.ok)return null;let y=await g.json();return{accessKeyId:y.AccessKeyId,secretAccessKey:y.SecretAccessKey,sessionToken:y.Token,expiration:new Date(y.Expiration)}}catch{return null}}async function Sy(n){let i=n?.timeout??1000,s=process.env.AWS_CONTAINER_CREDENTIALS_RELATIVE_URI,o=process.env.AWS_CONTAINER_CREDENTIALS_FULL_URI,c=null;if(s)c=`http://169.254.170.2${s}`;else if(o)c=o;if(!c)return null;try{let u={},d=process.env.AWS_CONTAINER_AUTHORIZATION_TOKEN;if(d)u.Authorization=d;let g=await ze(c,{headers:u},i);if(!g.ok)return null;let y=await g.json();return{accessKeyId:y.AccessKeyId,secretAccessKey:y.SecretAccessKey,sessionToken:y.Token,expiration:new Date(y.Expiration)}}catch{return null}}async function Iy(n){let i=n?.timeout??5000,s=process.env.AWS_WEB_IDENTITY_TOKEN_FILE,o=process.env.AWS_ROLE_ARN,c=process.env.AWS_ROLE_SESSION_NAME||"ts-cloud-session";if(!s||!o)return null;try{let u=wt(s,"utf-8").trim(),d=process.env.AWS_REGION||process.env.AWS_DEFAULT_REGION||"us-east-1",g=d.startsWith("us-gov")?`https://sts.${d}.amazonaws.com`:d==="us-east-1"?"https://sts.amazonaws.com":`https://sts.${d}.amazonaws.com`,y=new URLSearchParams({Action:"AssumeRoleWithWebIdentity",Version:"2011-06-15",RoleArn:o,RoleSessionName:c,WebIdentityToken:u}),h=await ze(`${g}/?${y.toString()}`,{method:"POST"},i);if(!h.ok)return null;let A=await h.text(),C=qe(A,"AccessKeyId"),v=qe(A,"SecretAccessKey"),T=qe(A,"SessionToken"),R=qe(A,"Expiration");if(!C||!v)return null;return{accessKeyId:C,secretAccessKey:v,sessionToken:T??void 0,expiration:R?new Date(R):void 0}}catch{return null}}async function es(n){let i=hy();if(i)return i;let s=Ay(n);if(s)return s;let o=await Iy(n);if(o)return o;let c=await Sy(n);if(c)return c;let u=await yy(n);if(u)return u;throw Error("Could not find AWS credentials. Set AWS_ACCESS_KEY_ID and AWS_SECRET_ACCESS_KEY environment variables, or configure ~/.aws/credentials, or run on an EC2 instance with an IAM role.")}function Eb(n){let i=null,s=null;return async()=>{if(i){if(!i.expiration)return i;let o=300000;if(i.expiration.getTime()-Date.now()>o)return i}if(s)return s;return s=es(n).then((o)=>(i=o,s=null,o)).catch((o)=>{throw s=null,o}),s}}async function ze(n,i,s){let o=new AbortController,c=setTimeout(()=>o.abort(),s);try{let u=await fetch(n,{...i,signal:o.signal});return clearTimeout(c),u}catch(u){throw clearTimeout(c),u}}function qe(n,i){let s=new RegExp(`<${i}>([^<]+)</${i}>`),o=n.match(s);return o?o[1]:null}async function zo(n){return es({profile:n})}function by(n){let i=process.env.AWS_REGION||process.env.AWS_DEFAULT_REGION;if(i)return i;let s=Bn($n(),".aws","config");if(On(s))try{let o=wt(s,"utf-8"),c=n||process.env.AWS_PROFILE||"default",u=c==="default"?"[default]":`[profile ${c}]`,d=o.split(`
-`),g=!1;for(let y of d){let h=y.trim();if(h.startsWith("[")){g=h===u;continue}if(g&&h.startsWith("region")){let[,A]=h.split("=");if(A)return A.trim()}}}catch{}return"us-east-1"}async function $m(n){let i=n||await es(),s=by(),{signRequest:o}=await import("./chunk-ypsfkgme.js"),c=s.startsWith("us-gov")?`https://sts.${s}.amazonaws.com`:s==="us-east-1"?"https://sts.amazonaws.com":`https://sts.${s}.amazonaws.com`,u="Action=GetCallerIdentity&Version=2011-06-15",d=o({method:"POST",url:c,body:"Action=GetCallerIdentity&Version=2011-06-15",headers:{"Content-Type":"application/x-www-form-urlencoded"},...i,service:"sts",region:s}),g=await fetch(d.url,{method:d.method,headers:d.headers,body:d.body});if(!g.ok)throw Error(`Failed to get account ID: ${await g.text()}`);let y=await g.text(),h=qe(y,"Account");if(!h)throw Error("Failed to parse account ID from response");return h}var mi=5242880,It=5242880;var pi=5242880;class Dt{region;endpoint;forcePathStyle;credentials;credentialOptions;retryOptions;constructor(n={}){this.region=n.region||process.env.AWS_REGION||"us-east-1",this.endpoint=n.endpoint||`https://s3.${this.region}.amazonaws.com`,this.forcePathStyle=n.forcePathStyle||!1,this.credentials=n.credentials,this.credentialOptions=n.credentialOptions,this.retryOptions=n.retryOptions||{}}async getCredentials(){if(this.credentials)return this.credentials;return es(this.credentialOptions)}buildUrl(n,i){let s=i?encodeURIComponent(i).replace(/%2F/g,"/"):"";if(this.forcePathStyle)return i?`${this.endpoint}/${n}/${s}`:`${this.endpoint}/${n}`;let o=new URL(this.endpoint);return o.hostname=`${n}.${o.hostname}`,i?`${o.origin}/${s}`:o.origin}async get(n,i,s={}){let o=await this.getCredentials(),c=this.buildUrl(n,i),u={};if(s.range)u.Range=s.range;if(s.ifModifiedSince)u["If-Modified-Since"]=s.ifModifiedSince.toUTCString();if(s.ifMatch)u["If-Match"]=s.ifMatch;if(s.ifNoneMatch)u["If-None-Match"]=s.ifNoneMatch;let d=new URL(c);if(s.responseContentType)d.searchParams.set("response-content-type",s.responseContentType);if(s.responseContentDisposition)d.searchParams.set("response-content-disposition",s.responseContentDisposition);let g=k({method:"GET",url:d.toString(),headers:u,...o,service:"s3",region:this.region}),y=await fetch(g.url,{method:g.method,headers:g.headers});if(!y.ok&&y.status!==304){let h=await y.text();throw new V(`Failed to get object: ${h}`,y.status,n,i)}return y}async getText(n,i,s={}){return(await this.get(n,i,s)).text()}async getJSON(n,i,s={}){return(await this.get(n,i,s)).json()}async getBuffer(n,i,s={}){return(await this.get(n,i,s)).arrayBuffer()}async put(n,i,s,o={}){let c,u;if(typeof s==="string")c=new TextEncoder().encode(s).length,u=s;else if(s instanceof ArrayBuffer)c=s.byteLength,u=s;else if(s instanceof Uint8Array)c=s.byteLength,u=s;else if(s instanceof Blob)c=s.size,u=s;else return this.uploadMultipart(n,i,s,{...o,partSize:It});if(c>pi){let d=fi(u).stream();return this.uploadMultipart(n,i,d,{...o,partSize:It})}return this.putSimple(n,i,u,c,o)}async putSimple(n,i,s,o,c){let u=await this.getCredentials(),d=this.buildUrl(n,i),g={"Content-Length":String(o),"Content-Type":c.contentType||Fn(i)};if(c.contentEncoding)g["Content-Encoding"]=c.contentEncoding;if(c.cacheControl)g["Cache-Control"]=c.cacheControl;if(c.contentDisposition)g["Content-Disposition"]=c.contentDisposition;if(c.storageClass)g["x-amz-storage-class"]=c.storageClass;if(c.serverSideEncryption)g["x-amz-server-side-encryption"]=c.serverSideEncryption;if(c.acl)g["x-amz-acl"]=c.acl;if(c.tagging)g["x-amz-tagging"]=c.tagging;if(c.metadata)for(let[v,T]of Object.entries(c.metadata))g[`x-amz-meta-${v.toLowerCase()}`]=T;let y;if(typeof s==="string")y=s;else if(s instanceof Blob)y=await s.text();else y=new TextDecoder().decode(s instanceof ArrayBuffer?new Uint8Array(s):s);let h=k({method:"PUT",url:d,headers:g,body:y,...u,service:"s3",region:this.region}),A=await fetch(h.url,{method:h.method,headers:h.headers,body:s});if(!A.ok){let v=await A.text();throw new V(`Failed to put object: ${v}`,A.status,n,i)}return{etag:(A.headers.get("ETag")||"").replace(/"/g,"")}}async delete(n,i){let s=await this.getCredentials(),o=this.buildUrl(n,i),c=k({method:"DELETE",url:o,...s,service:"s3",region:this.region}),u=await fetch(c.url,{method:c.method,headers:c.headers});if(!u.ok&&u.status!==204){let d=await u.text();throw new V(`Failed to delete object: ${d}`,u.status,n,i)}}async deleteMany(n,i){let s=await this.getCredentials(),o=`${this.buildUrl(n)}?delete`,u=`<?xml version="1.0" encoding="UTF-8"?><Delete><Quiet>false</Quiet>${i.map((R)=>`<Object><Key>${yi(R)}</Key></Object>`).join("")}</Delete>`,d=k({method:"POST",url:o,headers:{"Content-Type":"application/xml"},body:u,...s,service:"s3",region:this.region}),g=await fetch(d.url,{method:d.method,headers:d.headers,body:u});if(!g.ok){let R=await g.text();throw new V(`Failed to delete objects: ${R}`,g.status,n)}let y=await g.text(),h=[],A=[],C=/<Deleted><Key>([^<]+)<\/Key>/g,v;while((v=C.exec(y))!==null)h.push(v[1]);let T=/<Error><Key>([^<]+)<\/Key><Code>([^<]+)<\/Code><Message>([^<]+)<\/Message>/g;while((v=T.exec(y))!==null)A.push({key:v[1],error:`${v[2]}: ${v[3]}`});return{deleted:h,errors:A}}async list(n,i={}){let s=await this.getCredentials(),o=new URL(this.buildUrl(n));if(o.searchParams.set("list-type","2"),i.prefix)o.searchParams.set("prefix",i.prefix);if(i.delimiter)o.searchParams.set("delimiter",i.delimiter);if(i.maxKeys)o.searchParams.set("max-keys",String(i.maxKeys));if(i.continuationToken)o.searchParams.set("continuation-token",i.continuationToken);if(i.startAfter)o.searchParams.set("start-after",i.startAfter);let c=k({method:"GET",url:o.toString(),...s,service:"s3",region:this.region}),u=await fetch(c.url,{method:c.method,headers:c.headers});if(!u.ok){let g=await u.text();throw new V(`Failed to list objects: ${g}`,u.status,n)}let d=await u.text();return gi(d)}async*listAll(n,i={}){let s;do{let o=await this.list(n,{...i,continuationToken:s});for(let c of o.contents)yield c;s=o.nextContinuationToken}while(s)}async head(n,i){let s=await this.getCredentials(),o=this.buildUrl(n,i),c=k({method:"HEAD",url:o,...s,service:"s3",region:this.region}),u=await fetch(c.url,{method:c.method,headers:c.headers});if(u.status===404)return null;if(!u.ok){let g=await u.text();throw new V(`Failed to head object: ${g}`,u.status,n,i)}let d={};return u.headers.forEach((g,y)=>{if(y.toLowerCase().startsWith("x-amz-meta-"))d[y.slice(11)]=g}),{contentLength:Number(u.headers.get("Content-Length")||0),contentType:u.headers.get("Content-Type")||"application/octet-stream",etag:(u.headers.get("ETag")||"").replace(/"/g,""),lastModified:new Date(u.headers.get("Last-Modified")||0),metadata:d,storageClass:u.headers.get("x-amz-storage-class")||void 0,serverSideEncryption:u.headers.get("x-amz-server-side-encryption")||void 0}}async exists(n,i){return await this.head(n,i)!==null}async copy(n,i,s,o,c={}){let u=await this.getCredentials(),d=this.buildUrl(s,o),g={"x-amz-copy-source":`/${n}/${encodeURIComponent(i)}`};if(c.metadataDirective)g["x-amz-metadata-directive"]=c.metadataDirective;if(c.contentType)g["Content-Type"]=c.contentType;if(c.storageClass)g["x-amz-storage-class"]=c.storageClass;if(c.acl)g["x-amz-acl"]=c.acl;if(c.metadata)for(let[T,R]of Object.entries(c.metadata))g[`x-amz-meta-${T.toLowerCase()}`]=R;let y=k({method:"PUT",url:d,headers:g,...u,service:"s3",region:this.region}),h=await fetch(y.url,{method:y.method,headers:y.headers});if(!h.ok){let T=await h.text();throw new V(`Failed to copy object: ${T}`,h.status,s,o)}let C=(await h.text()).match(/<ETag>"?([^"<]+)"?<\/ETag>/);return{etag:C?C[1]:""}}async getPresignedUrl(n,i,s={}){let o=await this.getCredentials(),c=this.buildUrl(n,i);return na({url:c,method:s.method||"GET",expiresIn:s.expiresIn||3600,...o,service:"s3",region:this.region})}async uploadMultipart(n,i,s,o={}){let c=await this.getCredentials(),u=Math.max(o.partSize||It,mi),d,g;if(s instanceof ReadableStream)d=s;else if(s instanceof Blob)d=s.stream(),g=s.size;else{let A=new Blob([s]);d=A.stream(),g=A.size}let{uploadId:y,baseUrl:h}=await this.initiateMultipartUpload(n,i,o);try{let A=await this.uploadParts(n,i,h,y,d,u,c,g,o.concurrency||4,o.onProgress);return await this.completeMultipartUpload(n,i,h,y,A)}catch(A){throw await this.abortMultipartUpload(n,i,y,h).catch(()=>{}),A}}async initiateMultipartUpload(n,i,s){let o=await this.getCredentials(),c=this.buildUrl(n,i),u=`${c}?uploads`,d={"Content-Type":s.contentType||Fn(i)};if(s.storageClass)d["x-amz-storage-class"]=s.storageClass;if(s.serverSideEncryption)d["x-amz-server-side-encryption"]=s.serverSideEncryption;if(s.acl)d["x-amz-acl"]=s.acl;if(s.metadata)for(let[v,T]of Object.entries(s.metadata))d[`x-amz-meta-${v.toLowerCase()}`]=T;let g=k({method:"POST",url:u,headers:d,...o,service:"s3",region:this.region}),y=await fetch(g.url,{method:g.method,headers:g.headers});if(!y.ok){let v=await y.text();throw new V(`Failed to initiate multipart upload: ${v}`,y.status,n,i)}let A=(await y.text()).match(/<UploadId>([^<]+)<\/UploadId>/);if(!A)throw new V("Failed to parse upload ID from response",0,n,i);let C=c;if(y.url)try{let v=new URL(y.url);v.search="",C=v.toString()}catch{}return{uploadId:A[1],baseUrl:C}}async uploadParts(n,i,s,o,c,u,d,g,y,h){let A=[],C=c.getReader(),v=1,T=new Uint8Array(0),R=0,P=g?Math.ceil(g/u):void 0,I=new Map,M=async(N,O)=>{let B=`${s}?partNumber=${O}&uploadId=${encodeURIComponent(o)}`,F={"Content-Length":String(N.byteLength),"x-amz-content-sha256":"UNSIGNED-PAYLOAD"},U=k({method:"PUT",url:B,headers:F,...d,service:"s3",region:this.region}),j=await fetch(U.url,{method:U.method,headers:U.headers,body:N,redirect:"error"});if(!j.ok){let z=await j.text();throw new V(`Failed to upload part ${O}: ${z}`,j.status,n,i)}let H=(j.headers.get("ETag")||"").replace(/"/g,"");if(!H)throw new V(`Missing ETag for part ${O}`,j.status,n,i);return{partNumber:O,etag:H}},L=async()=>{let N=await Promise.race(I.values());I.delete(N.partNumber),A.push(N)};while(!0){let{done:N,value:O}=await C.read();if(O){let B=new Uint8Array(T.length+O.length);B.set(T),B.set(O,T.length),T=B}while(T.length>=u||N&&T.length>0){let B=T.slice(0,u);T=T.slice(u);let F=v++;if(I.size>=y)await L();if(I.set(F,M(B,F)),R+=B.byteLength,h)h({loaded:R,total:g||R,part:F,totalParts:P||F})}if(N)break}while(I.size>0)await L();return A.sort((N,O)=>N.partNumber-O.partNumber),A}async completeMultipartUpload(n,i,s,o,c){let u=await this.getCredentials(),d=`${s}?uploadId=${encodeURIComponent(o)}`,y=`<?xml version="1.0" encoding="UTF-8"?><CompleteMultipartUpload>${c.map((R)=>`<Part><PartNumber>${R.partNumber}</PartNumber><ETag>"${R.etag}"</ETag></Part>`).join("")}</CompleteMultipartUpload>`,h=k({method:"POST",url:d,headers:{"Content-Type":"application/xml"},body:y,...u,service:"s3",region:this.region}),A=await fetch(h.url,{method:h.method,headers:h.headers,body:y});if(!A.ok){let R=await A.text();throw new V(`Failed to complete multipart upload: ${R}`,A.status,n,i)}let v=(await A.text()).match(/<ETag>"?([^"<]+)"?<\/ETag>/);return{etag:v?v[1]:""}}async abortMultipartUpload(n,i,s,o){let c=await this.getCredentials(),u=`${o??this.buildUrl(n,i)}?uploadId=${encodeURIComponent(s)}`,d=k({method:"DELETE",url:u,...c,service:"s3",region:this.region});await fetch(d.url,{method:d.method,headers:d.headers})}async emptyAndDeleteBucket(n){let s=[];for await(let d of this.listAll(n,{}))if(s.push(d.key),s.length>=1000)await this.deleteMany(n,s),s=[];if(s.length>0)await this.deleteMany(n,s);let o=await this.getCredentials(),c=this.buildUrl(n),u=k({method:"DELETE",url:c,...o,service:"s3",region:this.region});await fetch(u.url,{method:u.method,headers:u.headers})}}class V extends Error{statusCode;bucket;key;constructor(n,i,s,o){super(n);this.statusCode=i;this.bucket=s;this.key=o;this.name="S3Error"}}function gi(n){let i=[],s=[],o=/<Contents>([\s\S]*?)<\/Contents>/g,c;while((c=o.exec(n))!==null){let d=c[1];i.push({key:pe(d,"Key")||"",lastModified:new Date(pe(d,"LastModified")||0),etag:(pe(d,"ETag")||"").replace(/"/g,""),size:Number(pe(d,"Size")||0),storageClass:pe(d,"StorageClass")||"STANDARD"})}let u=/<CommonPrefixes><Prefix>([^<]+)<\/Prefix><\/CommonPrefixes>/g;while((c=u.exec(n))!==null)s.push(c[1]);return{contents:i,commonPrefixes:s,isTruncated:pe(n,"IsTruncated")==="true",continuationToken:pe(n,"ContinuationToken")||void 0,nextContinuationToken:pe(n,"NextContinuationToken")||void 0,keyCount:Number(pe(n,"KeyCount")||0),maxKeys:Number(pe(n,"MaxKeys")||1000),prefix:pe(n,"Prefix")||void 0,delimiter:pe(n,"Delimiter")||void 0}}function pe(n,i){let s=new RegExp(`<${i}>([^<]*)</${i}>`),o=n.match(s);return o?o[1]:null}function yi(n){return n.replace(/&/g,"&amp;").replace(/</g,"&lt;").replace(/>/g,"&gt;").replace(/"/g,"&quot;").replace(/'/g,"&apos;")}function Fn(n){let i=n.split(".").pop()?.toLowerCase();return{html:"text/html",htm:"text/html",css:"text/css",js:"application/javascript",mjs:"application/javascript",json:"application/json",xml:"application/xml",txt:"text/plain",md:"text/markdown",csv:"text/csv",jpg:"image/jpeg",jpeg:"image/jpeg",png:"image/png",gif:"image/gif",webp:"image/webp",svg:"image/svg+xml",ico:"image/x-icon",avif:"image/avif",mp4:"video/mp4",webm:"video/webm",mov:"video/quicktime",avi:"video/x-msvideo",mp3:"audio/mpeg",wav:"audio/wav",ogg:"audio/ogg",pdf:"application/pdf",doc:"application/msword",docx:"application/vnd.openxmlformats-officedocument.wordprocessingml.document",xls:"application/vnd.ms-excel",xlsx:"application/vnd.openxmlformats-officedocument.spreadsheetml.sheet",ppt:"application/vnd.ms-powerpoint",pptx:"application/vnd.openxmlformats-officedocument.presentationml.presentation",zip:"application/zip",gz:"application/gzip",tar:"application/x-tar",rar:"application/vnd.rar","7z":"application/x-7z-compressed",woff:"font/woff",woff2:"font/woff2",ttf:"font/ttf",otf:"font/otf",eot:"application/vnd.ms-fontobject",wasm:"application/wasm"}[i||""]||"application/octet-stream"}function fi(n){if(n instanceof Blob)return n;if(typeof n==="string")return new Blob([n],{type:"text/plain"});return new Blob([n])}function Cy(n){return new Dt(n)}class nt extends Error{code;solution;details;constructor(n,i,s,o){super(n);this.code=i;this.solution=s;this.details=o;this.name="CloudError",Error.captureStackTrace?.(this,nt)}toString(){let n=`${this.name} [${this.code}]: ${this.message}`;if(this.solution)n+=`
+`),g=!1;for(let y of d){let h=y.trim();if(h.startsWith("[")){g=h===u;continue}if(g&&h.startsWith("region")){let[,A]=h.split("=");if(A)return A.trim()}}}catch{}return"us-east-1"}async function $m(n){let i=n||await es(),s=by(),{signRequest:o}=await import("./chunk-ypsfkgme.js"),c=s.startsWith("us-gov")?`https://sts.${s}.amazonaws.com`:s==="us-east-1"?"https://sts.amazonaws.com":`https://sts.${s}.amazonaws.com`,u="Action=GetCallerIdentity&Version=2011-06-15",d=o({method:"POST",url:c,body:"Action=GetCallerIdentity&Version=2011-06-15",headers:{"Content-Type":"application/x-www-form-urlencoded"},...i,service:"sts",region:s}),g=await fetch(d.url,{method:d.method,headers:d.headers,body:d.body});if(!g.ok)throw Error(`Failed to get account ID: ${await g.text()}`);let y=await g.text(),h=qe(y,"Account");if(!h)throw Error("Failed to parse account ID from response");return h}var mi=5242880,It=5242880;var pi=5242880;class Dt{region;endpoint;forcePathStyle;credentials;credentialOptions;retryOptions;constructor(n={}){this.region=n.region||process.env.AWS_REGION||"us-east-1",this.endpoint=n.endpoint||`https://s3.${this.region}.amazonaws.com`,this.forcePathStyle=n.forcePathStyle||!1,this.credentials=n.credentials,this.credentialOptions=n.credentialOptions,this.retryOptions=n.retryOptions||{}}async getCredentials(){if(this.credentials)return this.credentials;return es(this.credentialOptions)}buildUrl(n,i){let s=i?encodeURIComponent(i).replace(/%2F/g,"/"):"";if(this.forcePathStyle)return i?`${this.endpoint}/${n}/${s}`:`${this.endpoint}/${n}`;let o=new URL(this.endpoint);return o.hostname=`${n}.${o.hostname}`,i?`${o.origin}/${s}`:o.origin}async get(n,i,s={}){let o=await this.getCredentials(),c=this.buildUrl(n,i),u={};if(s.range)u.Range=s.range;if(s.ifModifiedSince)u["If-Modified-Since"]=s.ifModifiedSince.toUTCString();if(s.ifMatch)u["If-Match"]=s.ifMatch;if(s.ifNoneMatch)u["If-None-Match"]=s.ifNoneMatch;let d=new URL(c);if(s.responseContentType)d.searchParams.set("response-content-type",s.responseContentType);if(s.responseContentDisposition)d.searchParams.set("response-content-disposition",s.responseContentDisposition);let g=k({method:"GET",url:d.toString(),headers:u,...o,service:"s3",region:this.region}),y=await fetch(g.url,{method:g.method,headers:g.headers});if(!y.ok&&y.status!==304){let h=await y.text();throw new V(`Failed to get object: ${h}`,y.status,n,i)}return y}async getText(n,i,s={}){return(await this.get(n,i,s)).text()}async getJSON(n,i,s={}){return(await this.get(n,i,s)).json()}async getBuffer(n,i,s={}){return(await this.get(n,i,s)).arrayBuffer()}async put(n,i,s,o={}){let c,u;if(typeof s==="string")c=new TextEncoder().encode(s).length,u=s;else if(s instanceof ArrayBuffer)c=s.byteLength,u=s;else if(s instanceof Uint8Array)c=s.byteLength,u=s;else if(s instanceof Blob)c=s.size,u=s;else return this.uploadMultipart(n,i,s,{...o,partSize:It});if(c>pi){let d=fi(u).stream();return this.uploadMultipart(n,i,d,{...o,partSize:It})}return this.putSimple(n,i,u,c,o)}async putSimple(n,i,s,o,c){let u=await this.getCredentials(),d=this.buildUrl(n,i),g={"Content-Length":String(o),"Content-Type":c.contentType||Fn(i)};if(c.contentEncoding)g["Content-Encoding"]=c.contentEncoding;if(c.cacheControl)g["Cache-Control"]=c.cacheControl;if(c.contentDisposition)g["Content-Disposition"]=c.contentDisposition;if(c.storageClass)g["x-amz-storage-class"]=c.storageClass;if(c.serverSideEncryption)g["x-amz-server-side-encryption"]=c.serverSideEncryption;if(c.acl)g["x-amz-acl"]=c.acl;if(c.tagging)g["x-amz-tagging"]=c.tagging;if(c.metadata)for(let[v,T]of Object.entries(c.metadata))g[`x-amz-meta-${v.toLowerCase()}`]=T;let y;if(typeof s==="string")y=s;else if(s instanceof Blob)y=await s.text();else y=new TextDecoder().decode(s instanceof ArrayBuffer?new Uint8Array(s):s);let h=k({method:"PUT",url:d,headers:g,body:y,...u,service:"s3",region:this.region}),A=await fetch(h.url,{method:h.method,headers:h.headers,body:s});if(!A.ok){let v=await A.text();throw new V(`Failed to put object: ${v}`,A.status,n,i)}return{etag:(A.headers.get("ETag")||"").replace(/"/g,"")}}async delete(n,i){let s=await this.getCredentials(),o=this.buildUrl(n,i),c=k({method:"DELETE",url:o,...s,service:"s3",region:this.region}),u=await fetch(c.url,{method:c.method,headers:c.headers});if(!u.ok&&u.status!==204){let d=await u.text();throw new V(`Failed to delete object: ${d}`,u.status,n,i)}}async deleteMany(n,i){let s=await this.getCredentials(),o=`${this.buildUrl(n)}?delete`,u=`<?xml version="1.0" encoding="UTF-8"?><Delete><Quiet>false</Quiet>${i.map((R)=>`<Object><Key>${yi(R)}</Key></Object>`).join("")}</Delete>`,d=k({method:"POST",url:o,headers:{"Content-Type":"application/xml"},body:u,...s,service:"s3",region:this.region}),g=await fetch(d.url,{method:d.method,headers:d.headers,body:u});if(!g.ok){let R=await g.text();throw new V(`Failed to delete objects: ${R}`,g.status,n)}let y=await g.text(),h=[],A=[],C=/<Deleted><Key>([^<]+)<\/Key>/g,v;while((v=C.exec(y))!==null)h.push(v[1]);let T=/<Error><Key>([^<]+)<\/Key><Code>([^<]+)<\/Code><Message>([^<]+)<\/Message>/g;while((v=T.exec(y))!==null)A.push({key:v[1],error:`${v[2]}: ${v[3]}`});return{deleted:h,errors:A}}async list(n,i={}){let s=await this.getCredentials(),o=new URL(this.buildUrl(n));if(o.searchParams.set("list-type","2"),i.prefix)o.searchParams.set("prefix",i.prefix);if(i.delimiter)o.searchParams.set("delimiter",i.delimiter);if(i.maxKeys)o.searchParams.set("max-keys",String(i.maxKeys));if(i.continuationToken)o.searchParams.set("continuation-token",i.continuationToken);if(i.startAfter)o.searchParams.set("start-after",i.startAfter);let c=k({method:"GET",url:o.toString(),...s,service:"s3",region:this.region}),u=await fetch(c.url,{method:c.method,headers:c.headers});if(!u.ok){let g=await u.text();throw new V(`Failed to list objects: ${g}`,u.status,n)}let d=await u.text();return gi(d)}async*listAll(n,i={}){let s;do{let o=await this.list(n,{...i,continuationToken:s});for(let c of o.contents)yield c;s=o.nextContinuationToken}while(s)}async head(n,i){let s=await this.getCredentials(),o=this.buildUrl(n,i),c=k({method:"HEAD",url:o,...s,service:"s3",region:this.region}),u=await fetch(c.url,{method:c.method,headers:c.headers});if(u.status===404)return null;if(!u.ok){let g=await u.text();throw new V(`Failed to head object: ${g}`,u.status,n,i)}let d={};return u.headers.forEach((g,y)=>{if(y.toLowerCase().startsWith("x-amz-meta-"))d[y.slice(11)]=g}),{contentLength:Number(u.headers.get("Content-Length")||0),contentType:u.headers.get("Content-Type")||"application/octet-stream",etag:(u.headers.get("ETag")||"").replace(/"/g,""),lastModified:new Date(u.headers.get("Last-Modified")||0),metadata:d,storageClass:u.headers.get("x-amz-storage-class")||void 0,serverSideEncryption:u.headers.get("x-amz-server-side-encryption")||void 0}}async exists(n,i){return await this.head(n,i)!==null}async copy(n,i,s,o,c={}){let u=await this.getCredentials(),d=this.buildUrl(s,o),g={"x-amz-copy-source":`/${n}/${encodeURIComponent(i)}`};if(c.metadataDirective)g["x-amz-metadata-directive"]=c.metadataDirective;if(c.contentType)g["Content-Type"]=c.contentType;if(c.storageClass)g["x-amz-storage-class"]=c.storageClass;if(c.acl)g["x-amz-acl"]=c.acl;if(c.metadata)for(let[T,R]of Object.entries(c.metadata))g[`x-amz-meta-${T.toLowerCase()}`]=R;let y=k({method:"PUT",url:d,headers:g,...u,service:"s3",region:this.region}),h=await fetch(y.url,{method:y.method,headers:y.headers});if(!h.ok){let T=await h.text();throw new V(`Failed to copy object: ${T}`,h.status,s,o)}let C=(await h.text()).match(/<ETag>"?([^"<]+)"?<\/ETag>/);return{etag:C?C[1]:""}}async getPresignedUrl(n,i,s={}){let o=await this.getCredentials(),c=this.buildUrl(n,i);return na({url:c,method:s.method||"GET",expiresIn:s.expiresIn||3600,...o,service:"s3",region:this.region})}async uploadMultipart(n,i,s,o={}){let c=await this.getCredentials(),u=Math.max(o.partSize||It,mi),d,g;if(s instanceof ReadableStream)d=s;else if(s instanceof Blob)d=s.stream(),g=s.size;else{let A=new Blob([s]);d=A.stream(),g=A.size}let{uploadId:y,baseUrl:h}=await this.initiateMultipartUpload(n,i,o);try{let A=await this.uploadParts(n,i,h,y,d,u,c,g,o.concurrency||4,o.onProgress);return await this.completeMultipartUpload(n,i,h,y,A)}catch(A){throw await this.abortMultipartUpload(n,i,y,h).catch(()=>{}),A}}async initiateMultipartUpload(n,i,s){let o=await this.getCredentials(),c=this.buildUrl(n,i),u=`${c}?uploads`,d={"Content-Type":s.contentType||Fn(i)};if(s.storageClass)d["x-amz-storage-class"]=s.storageClass;if(s.serverSideEncryption)d["x-amz-server-side-encryption"]=s.serverSideEncryption;if(s.acl)d["x-amz-acl"]=s.acl;if(s.metadata)for(let[v,T]of Object.entries(s.metadata))d[`x-amz-meta-${v.toLowerCase()}`]=T;let g=k({method:"POST",url:u,headers:d,...o,service:"s3",region:this.region}),y=await fetch(g.url,{method:g.method,headers:g.headers});if(!y.ok){let v=await y.text();throw new V(`Failed to initiate multipart upload: ${v}`,y.status,n,i)}let A=(await y.text()).match(/<UploadId>([^<]+)<\/UploadId>/);if(!A)throw new V("Failed to parse upload ID from response",0,n,i);let C=c;if(y.url)try{let v=new URL(y.url);v.search="",C=v.toString()}catch{}return{uploadId:A[1],baseUrl:C}}async uploadParts(n,i,s,o,c,u,d,g,y,h){let A=[],C=c.getReader(),v=1,T=new Uint8Array(0),R=0,P=g?Math.ceil(g/u):void 0,I=new Map,M=async(N,O)=>{let B=`${s}?partNumber=${O}&uploadId=${encodeURIComponent(o)}`,F={"Content-Length":String(N.byteLength),"x-amz-content-sha256":"UNSIGNED-PAYLOAD"},U=k({method:"PUT",url:B,headers:F,...d,service:"s3",region:this.region}),j=await fetch(U.url,{method:U.method,headers:U.headers,body:N,redirect:"error"});if(!j.ok){let z=await j.text();throw new V(`Failed to upload part ${O}: ${z}`,j.status,n,i)}let H=(j.headers.get("ETag")||"").replace(/"/g,"");if(!H)throw new V(`Missing ETag for part ${O}`,j.status,n,i);return{partNumber:O,etag:H}},L=async()=>{let N=await Promise.race(I.values());I.delete(N.partNumber),A.push(N)};while(!0){let{done:N,value:O}=await C.read();if(O){let B=new Uint8Array(T.length+O.length);B.set(T),B.set(O,T.length),T=B}while(T.length>=u||N&&T.length>0){let B=T.slice(0,u);T=T.slice(u);let F=v++;if(I.size>=y)await L();if(I.set(F,M(B,F)),R+=B.byteLength,h)h({loaded:R,total:g||R,part:F,totalParts:P||F})}if(N)break}while(I.size>0)await L();return A.sort((N,O)=>N.partNumber-O.partNumber),A}async completeMultipartUpload(n,i,s,o,c){let u=await this.getCredentials(),d=`${s}?uploadId=${encodeURIComponent(o)}`,y=`<?xml version="1.0" encoding="UTF-8"?><CompleteMultipartUpload>${c.map((R)=>`<Part><PartNumber>${R.partNumber}</PartNumber><ETag>"${R.etag}"</ETag></Part>`).join("")}</CompleteMultipartUpload>`,h=k({method:"POST",url:d,headers:{"Content-Type":"application/xml"},body:y,...u,service:"s3",region:this.region}),A=await fetch(h.url,{method:h.method,headers:h.headers,body:y});if(!A.ok){let R=await A.text();throw new V(`Failed to complete multipart upload: ${R}`,A.status,n,i)}let v=(await A.text()).match(/<ETag>"?([^"<]+)"?<\/ETag>/);return{etag:v?v[1]:""}}async abortMultipartUpload(n,i,s,o){let c=await this.getCredentials(),u=`${o??this.buildUrl(n,i)}?uploadId=${encodeURIComponent(s)}`,d=k({method:"DELETE",url:u,...c,service:"s3",region:this.region});await fetch(d.url,{method:d.method,headers:d.headers})}async emptyAndDeleteBucket(n){let s=[];for await(let d of this.listAll(n,{}))if(s.push(d.key),s.length>=1000)await this.deleteMany(n,s),s=[];if(s.length>0)await this.deleteMany(n,s);let o=await this.getCredentials(),c=this.buildUrl(n),u=k({method:"DELETE",url:c,...o,service:"s3",region:this.region});await fetch(u.url,{method:u.method,headers:u.headers})}}class V extends Error{statusCode;bucket;key;constructor(n,i,s,o){super(n);this.statusCode=i;this.bucket=s;this.key=o;this.name="S3Error"}}function gi(n){let i=[],s=[],o=/<Contents>([\s\S]*?)<\/Contents>/g,c;while((c=o.exec(n))!==null){let d=c[1];i.push({key:me(d,"Key")||"",lastModified:new Date(me(d,"LastModified")||0),etag:(me(d,"ETag")||"").replace(/"/g,""),size:Number(me(d,"Size")||0),storageClass:me(d,"StorageClass")||"STANDARD"})}let u=/<CommonPrefixes><Prefix>([^<]+)<\/Prefix><\/CommonPrefixes>/g;while((c=u.exec(n))!==null)s.push(c[1]);return{contents:i,commonPrefixes:s,isTruncated:me(n,"IsTruncated")==="true",continuationToken:me(n,"ContinuationToken")||void 0,nextContinuationToken:me(n,"NextContinuationToken")||void 0,keyCount:Number(me(n,"KeyCount")||0),maxKeys:Number(me(n,"MaxKeys")||1000),prefix:me(n,"Prefix")||void 0,delimiter:me(n,"Delimiter")||void 0}}function me(n,i){let s=new RegExp(`<${i}>([^<]*)</${i}>`),o=n.match(s);return o?o[1]:null}function yi(n){return n.replace(/&/g,"&amp;").replace(/</g,"&lt;").replace(/>/g,"&gt;").replace(/"/g,"&quot;").replace(/'/g,"&apos;")}function Fn(n){let i=n.split(".").pop()?.toLowerCase();return{html:"text/html",htm:"text/html",css:"text/css",js:"application/javascript",mjs:"application/javascript",json:"application/json",xml:"application/xml",txt:"text/plain",md:"text/markdown",csv:"text/csv",jpg:"image/jpeg",jpeg:"image/jpeg",png:"image/png",gif:"image/gif",webp:"image/webp",svg:"image/svg+xml",ico:"image/x-icon",avif:"image/avif",mp4:"video/mp4",webm:"video/webm",mov:"video/quicktime",avi:"video/x-msvideo",mp3:"audio/mpeg",wav:"audio/wav",ogg:"audio/ogg",pdf:"application/pdf",doc:"application/msword",docx:"application/vnd.openxmlformats-officedocument.wordprocessingml.document",xls:"application/vnd.ms-excel",xlsx:"application/vnd.openxmlformats-officedocument.spreadsheetml.sheet",ppt:"application/vnd.ms-powerpoint",pptx:"application/vnd.openxmlformats-officedocument.presentationml.presentation",zip:"application/zip",gz:"application/gzip",tar:"application/x-tar",rar:"application/vnd.rar","7z":"application/x-7z-compressed",woff:"font/woff",woff2:"font/woff2",ttf:"font/ttf",otf:"font/otf",eot:"application/vnd.ms-fontobject",wasm:"application/wasm"}[i||""]||"application/octet-stream"}function fi(n){if(n instanceof Blob)return n;if(typeof n==="string")return new Blob([n],{type:"text/plain"});return new Blob([n])}function Cy(n){return new Dt(n)}class nt extends Error{code;solution;details;constructor(n,i,s,o){super(n);this.code=i;this.solution=s;this.details=o;this.name="CloudError",Error.captureStackTrace?.(this,nt)}toString(){let n=`${this.name} [${this.code}]: ${this.message}`;if(this.solution)n+=`
 
 \uD83D\uDCA1 Solution: ${this.solution}`;if(this.details&&Object.keys(this.details).length>0){n+=`
 
@@ -7032,7 +7032,7 @@ function generateShortId() {
   }
   return id;
 }
-`;static createLinksTable(n){return{[`${n.slug}ShortLinksTable`]:{Type:"AWS::DynamoDB::Table",Properties:{TableName:`${n.slug}-short-links`,BillingMode:"PAY_PER_REQUEST",AttributeDefinitions:[{AttributeName:"id",AttributeType:"S"}],KeySchema:[{AttributeName:"id",KeyType:"HASH"}],TimeToLiveSpecification:{AttributeName:"ttl",Enabled:!0}}}}}static createLinkShortenerLambda(n){return{[`${n.slug}LinkShortenerLambda`]:{Type:"AWS::Lambda::Function",Properties:{FunctionName:`${n.slug}-link-shortener`,Runtime:"nodejs20.x",Handler:"index.handler",Role:n.roleArn,Timeout:10,MemorySize:128,Code:{ZipFile:Jt.LinkShortenerCode},Environment:{Variables:{LINKS_TABLE:n.linksTable,SHORT_DOMAIN:n.shortDomain||""}}}}}}static shortenUrlsInMessage(n,i,s){let o=/(https?:\/\/[^\s]+)/g,c=[],u=0;return{message:n.replace(o,(g)=>{let y=`${s}-${u++}`,h=`https://${i}/l/${y}`;return c.push({original:g,short:h,id:y}),h}),links:c}}}class Ee{static AbTestManagerCode=`
+`;static createLinksTable(n){return{[`${n.slug}ShortLinksTable`]:{Type:"AWS::DynamoDB::Table",Properties:{TableName:`${n.slug}-short-links`,BillingMode:"PAY_PER_REQUEST",AttributeDefinitions:[{AttributeName:"id",AttributeType:"S"}],KeySchema:[{AttributeName:"id",KeyType:"HASH"}],TimeToLiveSpecification:{AttributeName:"ttl",Enabled:!0}}}}}static createLinkShortenerLambda(n){return{[`${n.slug}LinkShortenerLambda`]:{Type:"AWS::Lambda::Function",Properties:{FunctionName:`${n.slug}-link-shortener`,Runtime:"nodejs20.x",Handler:"index.handler",Role:n.roleArn,Timeout:10,MemorySize:128,Code:{ZipFile:Jt.LinkShortenerCode},Environment:{Variables:{LINKS_TABLE:n.linksTable,SHORT_DOMAIN:n.shortDomain||""}}}}}}static shortenUrlsInMessage(n,i,s){let o=/(https?:\/\/[^\s]+)/g,c=[],u=0;return{message:n.replace(o,(g)=>{let y=`${s}-${u++}`,h=`https://${i}/l/${y}`;return c.push({original:g,short:h,id:y}),h}),links:c}}}class Pe{static AbTestManagerCode=`
 const { DynamoDBClient, PutItemCommand, GetItemCommand, UpdateItemCommand, ScanCommand } = require('@aws-sdk/client-dynamodb');
 
 const dynamodb = new DynamoDBClient({});
@@ -7226,7 +7226,7 @@ function unmarshallTest(item) {
 
   return test;
 }
-`;static createAbTestsTable(n){return{[`${n.slug}AbTestsTable`]:{Type:"AWS::DynamoDB::Table",Properties:{TableName:`${n.slug}-ab-tests`,BillingMode:"PAY_PER_REQUEST",AttributeDefinitions:[{AttributeName:"id",AttributeType:"S"}],KeySchema:[{AttributeName:"id",KeyType:"HASH"}]}}}}static createAbTestManagerLambda(n){return{[`${n.slug}AbTestManagerLambda`]:{Type:"AWS::Lambda::Function",Properties:{FunctionName:`${n.slug}-ab-test-manager`,Runtime:"nodejs20.x",Handler:"index.handler",Role:n.roleArn,Timeout:30,MemorySize:256,Code:{ZipFile:Ee.AbTestManagerCode},Environment:{Variables:{AB_TESTS_TABLE:n.abTestsTable}}}}}}static selectVariant(n,i){let o=Ee.hashString(i+n.id)%100,c=0;for(let u=0;u<n.variants.length;u++)if(c+=n.trafficSplit[u],o<c)return n.variants[u];return n.variants[n.variants.length-1]}static determineWinner(n){if(n.variants.length===0)return null;let i=n.winningCriteria,s=n.variants[0],o=Ee.getMetricValue(s,i);for(let c of n.variants.slice(1)){let u=Ee.getMetricValue(c,i);if(u>o)o=u,s=c}return s}static calculateSignificance(n,i,s){let o=n.stats.sent,c=i.stats.sent;if(o<30||c<30)return 0;let u=Ee.getMetricValue(n,s)/100,d=Ee.getMetricValue(i,s)/100,g=(u*o+d*c)/(o+c),y=Math.sqrt(g*(1-g)*(1/o+1/c));if(y===0)return 0;let h=Math.abs(u-d)/y;if(h>=2.576)return 99;if(h>=1.96)return 95;if(h>=1.645)return 90;if(h>=1.28)return 80;return Math.round(h*30)}static getMetricValue(n,i){switch(i){case"delivery_rate":return n.stats.deliveryRate;case"click_rate":return n.stats.clickRate;case"reply_rate":return n.stats.replyRate;case"conversion_rate":return n.stats.conversionRate;default:return n.stats.deliveryRate}}static hashString(n){let i=0;for(let s=0;s<n.length;s++){let o=n.charCodeAt(s);i=(i<<5)-i+o,i=i&i}return Math.abs(i)}}class Rf{queues=new Map;messageGroups=new Map;deduplicationConfigs=new Map;messages=new Map;queueCounter=0;groupCounter=0;deduplicationCounter=0;messageCounter=0;sequenceCounter=0;createFIFOQueue(n){let i=`fifo-queue-${Date.now()}-${this.queueCounter++}`,s=n.name.endsWith(".fifo")?n.name:`${n.name}.fifo`,{name:o,...c}=n,u={id:i,name:s,queueUrl:`https://sqs.us-east-1.amazonaws.com/123456789012/${s}`,...c};return this.queues.set(i,u),this.createDeduplicationConfig({queueId:i,contentBasedDeduplication:n.contentBasedDeduplication,deduplicationInterval:300}),u}createHighThroughputFIFO(n){return this.createFIFOQueue({name:n.name,contentBasedDeduplication:n.contentBasedDeduplication??!0,deduplicationScope:"messageGroup",fifoThroughputLimit:"perMessageGroupId",messageRetentionPeriod:345600,visibilityTimeout:30,receiveMessageWaitTime:0})}createStandardFIFO(n){return this.createFIFOQueue({name:n.name,contentBasedDeduplication:n.contentBasedDeduplication??!1,deduplicationScope:"queue",fifoThroughputLimit:"perQueue",messageRetentionPeriod:345600,visibilityTimeout:30,receiveMessageWaitTime:0})}createDeduplicationConfig(n){let s={id:`dedup-${Date.now()}-${this.deduplicationCounter++}`,deduplicationHashes:new Map,...n};return this.deduplicationConfigs.set(n.queueId,s),s}sendMessage(n){let i=this.queues.get(n.queueId);if(!i)throw Error(`Queue not found: ${n.queueId}`);let s=this.deduplicationConfigs.get(n.queueId);if(s){let d=n.messageDeduplicationId||(i.contentBasedDeduplication?this.generateHash(n.messageBody):void 0);if(d&&this.isDuplicate(s,d))return null;if(d)s.deduplicationHashes.set(d,new Date)}let o=`msg-${Date.now()}-${this.messageCounter++}`,c=this.generateSequenceNumber(),u={id:o,messageId:o,messageGroupId:n.messageGroupId,messageDeduplicationId:n.messageDeduplicationId,body:n.messageBody,attributes:n.messageAttributes||{},sentTimestamp:new Date,sequenceNumber:c};return this.messages.set(o,u),this.updateMessageGroup(n.queueId,n.messageGroupId),u}isDuplicate(n,i){let s=n.deduplicationHashes.get(i);if(!s)return!1;if((Date.now()-s.getTime())/1000>n.deduplicationInterval)return n.deduplicationHashes.delete(i),!1;return!0}generateHash(n){let i=0;for(let s=0;s<n.length;s++){let o=n.charCodeAt(s);i=(i<<5)-i+o,i=i&i}return Math.abs(i).toString(36)}generateSequenceNumber(){return`${Date.now()}${this.sequenceCounter++}`.padStart(20,"0")}updateMessageGroup(n,i){let s=`${n}-${i}`,o=this.messageGroups.get(s);if(!o)o={id:`group-${Date.now()}-${this.groupCounter++}`,messageGroupId:i,queueId:n,messagesInFlight:0},this.messageGroups.set(s,o);o.messagesInFlight++,o.lastMessageTimestamp=new Date}getMessageGroups(n){return Array.from(this.messageGroups.values()).filter((i)=>i.queueId===n)}getQueue(n){return this.queues.get(n)}listQueues(){return Array.from(this.queues.values())}getMessages(n,i){let s=Array.from(this.messages.values());if(i)s=s.filter((o)=>o.messageGroupId===i);return s.sort((o,c)=>o.sequenceNumber.localeCompare(c.sequenceNumber))}generateFIFOQueueCF(n){return{Type:"AWS::SQS::Queue",Properties:{QueueName:n.name,FifoQueue:!0,ContentBasedDeduplication:n.contentBasedDeduplication,DeduplicationScope:n.deduplicationScope,FifoThroughputLimit:n.fifoThroughputLimit,MessageRetentionPeriod:n.messageRetentionPeriod,VisibilityTimeout:n.visibilityTimeout,ReceiveMessageWaitTimeSeconds:n.receiveMessageWaitTime,...n.deadLetterTargetArn&&{RedrivePolicy:{deadLetterTargetArn:n.deadLetterTargetArn,maxReceiveCount:n.maxReceiveCount||3}}}}}clear(){this.queues.clear(),this.messageGroups.clear(),this.deduplicationConfigs.clear(),this.messages.clear(),this.queueCounter=0,this.groupCounter=0,this.deduplicationCounter=0,this.messageCounter=0,this.sequenceCounter=0}}var TE=new Rf;class Df{monitors=new Map;metrics=new Map;alerts=new Map;reprocessJobs=new Map;monitorCounter=0;metricsCounter=0;alertCounter=0;jobCounter=0;createDLQMonitor(n){let i=`dlq-monitor-${Date.now()}-${this.monitorCounter++}`,s={id:i,...n};return this.monitors.set(i,s),s}createAutomatedMonitor(n){return this.createDLQMonitor({name:n.name,queueUrl:n.queueUrl,sourceQueues:n.sourceQueues,maxReceiveCount:3,alarmThreshold:10,autoReprocess:!0,reprocessStrategy:"scheduled",notificationTopicArn:n.notificationTopicArn})}collectMetrics(n){let s={id:`metrics-${Date.now()}-${this.metricsCounter++}`,queueUrl:n,timestamp:new Date,approximateNumberOfMessages:Math.floor(Math.random()*100),approximateAgeOfOldestMessage:Math.floor(Math.random()*86400),messagesReceived:Math.floor(Math.random()*50),messagesDeleted:Math.floor(Math.random()*30),messagesReprocessed:Math.floor(Math.random()*20)},o=this.metrics.get(n)||[];return o.push(s),this.metrics.set(n,o),this.checkForAlerts(n,s),s}checkForAlerts(n,i){let s=Array.from(this.monitors.values()).find((c)=>c.queueUrl===n);if(!s)return;if(i.approximateNumberOfMessages>=s.alarmThreshold)this.createAlert({monitorId:s.id,alertType:"threshold_exceeded",severity:"high",message:`DLQ ${s.name} has ${i.approximateNumberOfMessages} messages (threshold: ${s.alarmThreshold})`});let o=3600;if(i.approximateAgeOfOldestMessage>o)this.createAlert({monitorId:s.id,alertType:"old_message",severity:"medium",message:`DLQ ${s.name} has messages older than ${o} seconds`})}createAlert(n){let i=`alert-${Date.now()}-${this.alertCounter++}`,s={id:i,timestamp:new Date,acknowledged:!1,...n};return this.alerts.set(i,s),s}acknowledgeAlert(n){let i=this.alerts.get(n);if(!i)throw Error(`Alert not found: ${n}`);return i.acknowledged=!0,i}createReprocessJob(n){let i=`reprocess-${Date.now()}-${this.jobCounter++}`,s={id:i,queueUrl:n.queueUrl,messageId:n.messageId,attempts:0,status:"pending"};return this.reprocessJobs.set(i,s),s}async executeReprocessJob(n){let i=this.reprocessJobs.get(n);if(!i)throw Error(`Reprocess job not found: ${n}`);i.status="processing",i.startedAt=new Date,i.attempts++,await new Promise((o)=>setTimeout(o,100));let s=Math.random()>0.3;if(i.status=s?"success":"failed",i.completedAt=new Date,!s)i.error="Reprocessing failed - original error still present";return i}async batchReprocess(n){let i=[];for(let s=0;s<n.maxMessages;s++){let o=this.createReprocessJob({queueUrl:n.queueUrl,messageId:`msg-${s}`});await this.executeReprocessJob(o.id),i.push(o)}return i}getDLQStatistics(n,i=24){let s=new Date(Date.now()-i*60*60*1000),o=(this.metrics.get(n)||[]).filter((A)=>A.timestamp>=s);if(o.length===0)return{totalMessages:0,avgAge:0,messagesReceived:0,messagesDeleted:0,messagesReprocessed:0,successRate:0};let c=o[o.length-1],u=o.reduce((A,C)=>A+C.messagesReceived,0),d=o.reduce((A,C)=>A+C.messagesDeleted,0),g=o.reduce((A,C)=>A+C.messagesReprocessed,0),y=o.reduce((A,C)=>A+C.approximateAgeOfOldestMessage,0)/o.length,h=g>0?d/g*100:0;return{totalMessages:c.approximateNumberOfMessages,avgAge:y,messagesReceived:u,messagesDeleted:d,messagesReprocessed:g,successRate:h}}getMonitor(n){return this.monitors.get(n)}listMonitors(){return Array.from(this.monitors.values())}getAlerts(n,i){let s=Array.from(this.alerts.values());if(n)s=s.filter((o)=>o.monitorId===n);if(i!==void 0)s=s.filter((o)=>o.acknowledged===i);return s.sort((o,c)=>c.timestamp.getTime()-o.timestamp.getTime())}getReprocessJobs(n){let i=Array.from(this.reprocessJobs.values());if(n)i=i.filter((s)=>s.queueUrl===n);return i}generateDLQAlarmCF(n){return{Type:"AWS::CloudWatch::Alarm",Properties:{AlarmName:`${n.name}-messages-alarm`,AlarmDescription:`Alert when DLQ ${n.name} exceeds threshold`,MetricName:"ApproximateNumberOfMessagesVisible",Namespace:"AWS/SQS",Statistic:"Average",Period:300,EvaluationPeriods:1,Threshold:n.alarmThreshold,ComparisonOperator:"GreaterThanThreshold",Dimensions:[{Name:"QueueName",Value:n.queueUrl.split("/").pop()}],...n.notificationTopicArn&&{AlarmActions:[n.notificationTopicArn]}}}}clear(){this.monitors.clear(),this.metrics.clear(),this.alerts.clear(),this.reprocessJobs.clear(),this.monitorCounter=0,this.metricsCounter=0,this.alertCounter=0,this.jobCounter=0}}var wE=new Df;class Pf{configs=new Map;jobs=new Map;metrics=new Map;configCounter=0;jobCounter=0;metricsCounter=0;createBatchConfig(n){let i=`batch-config-${Date.now()}-${this.configCounter++}`,s={id:i,...n};return this.configs.set(i,s),s}createHighThroughputConfig(n){return this.createBatchConfig({queueUrl:n.queueUrl,batchSize:10,maxWaitTime:100,parallelProcessors:10,retryAttempts:3,visibilityTimeout:30})}createLowLatencyConfig(n){return this.createBatchConfig({queueUrl:n.queueUrl,batchSize:1,maxWaitTime:0,parallelProcessors:5,retryAttempts:2,visibilityTimeout:10})}createBatchJob(n){let i=`batch-job-${Date.now()}-${this.jobCounter++}`;if(!this.configs.get(n.configId))throw Error(`Batch config not found: ${n.configId}`);let o=[];for(let u=0;u<n.messageCount;u++)o.push({id:`msg-${i}-${u}`,messageId:`${i}-${u}`,body:`Message ${u}`,receiptHandle:`receipt-${i}-${u}`,attributes:{},status:"pending"});let c={id:i,configId:n.configId,messages:o,status:"pending",processedCount:0,failedCount:0};return this.jobs.set(i,c),c}async processBatchJob(n){let i=this.jobs.get(n);if(!i)throw Error(`Batch job not found: ${n}`);let s=this.configs.get(i.configId);if(!s)throw Error(`Batch config not found: ${i.configId}`);i.status="processing",i.startedAt=new Date;let o=this.chunkArray(i.messages,s.batchSize);for(let c of o)await this.processBatch(c,s);return i.processedCount=i.messages.filter((c)=>c.status==="success").length,i.failedCount=i.messages.filter((c)=>c.status==="failed").length,i.status=i.failedCount===0?"completed":"failed",i.completedAt=new Date,this.collectProcessorMetrics(s.id,i),i}async processBatch(n,i){let s=n.map((o)=>this.processMessage(o,i));await Promise.all(s)}async processMessage(n,i){n.status="processing";let s=Date.now();await new Promise((u)=>setTimeout(u,Math.random()*100));let o=Date.now()-s;if(n.processingTime=o,Math.random()>0.1)n.status="success";else n.status="failed",n.error="Processing error"}chunkArray(n,i){let s=[];for(let o=0;o<n.length;o+=i)s.push(n.slice(o,o+i));return s}collectProcessorMetrics(n,i){let s=`metrics-${Date.now()}-${this.metricsCounter++}`,c=i.messages.filter((C)=>C.status==="success").map((C)=>C.processingTime||0).filter((C)=>C>0),u=c.length>0?c.reduce((C,v)=>C+v,0)/c.length:0,d=i.completedAt&&i.startedAt?(i.completedAt.getTime()-i.startedAt.getTime())/1000:1,g=i.processedCount/d,y=i.messages.length>0?i.failedCount/i.messages.length*100:0,h={id:s,configId:n,timestamp:new Date,messagesProcessed:i.processedCount,averageProcessingTime:u,throughput:g,errorRate:y},A=this.metrics.get(n)||[];A.push(h),this.metrics.set(n,A)}getBatchStatistics(n){let i=this.metrics.get(n)||[];if(i.length===0)return{totalJobsProcessed:0,totalMessagesProcessed:0,averageThroughput:0,averageErrorRate:0,averageProcessingTime:0};let s=i.reduce((d,g)=>d+g.messagesProcessed,0),o=i.reduce((d,g)=>d+g.throughput,0)/i.length,c=i.reduce((d,g)=>d+g.errorRate,0)/i.length,u=i.reduce((d,g)=>d+g.averageProcessingTime,0)/i.length;return{totalJobsProcessed:i.length,totalMessagesProcessed:s,averageThroughput:o,averageErrorRate:c,averageProcessingTime:u}}optimizeBatchConfig(n){let i=this.configs.get(n);if(!i)throw Error(`Batch config not found: ${n}`);let s=this.getBatchStatistics(n);if(s.averageErrorRate<5&&i.batchSize<10)i.batchSize=Math.min(10,i.batchSize+1);if(s.averageErrorRate>20&&i.batchSize>1)i.batchSize=Math.max(1,i.batchSize-1);if(s.averageThroughput<5&&i.parallelProcessors<20)i.parallelProcessors++;return i}getConfig(n){return this.configs.get(n)}listConfigs(){return Array.from(this.configs.values())}getJob(n){return this.jobs.get(n)}listJobs(n){let i=Array.from(this.jobs.values());if(n)i=i.filter((s)=>s.configId===n);return i}generateBatchProcessorCF(n){return{Type:"AWS::Lambda::EventSourceMapping",Properties:{EventSourceArn:`arn:aws:sqs:us-east-1:123456789012:${n.queueUrl.split("/").pop()}`,FunctionName:"batch-processor-function",BatchSize:n.batchSize,MaximumBatchingWindowInSeconds:n.maxWaitTime/1000,FunctionResponseTypes:["ReportBatchItemFailures"]}}}clear(){this.configs.clear(),this.jobs.clear(),this.metrics.clear(),this.configCounter=0,this.jobCounter=0,this.metricsCounter=0}}var RE=new Pf;class kf{queues=new Map;retentionPolicies=new Map;delayQueues=new Map;purgeOperations=new Map;metrics=new Map;queueCounter=0;retentionCounter=0;delayCounter=0;purgeCounter=0;metricsCounter=0;createQueue(n){let i=`queue-${Date.now()}-${this.queueCounter++}`,s={id:i,purgeInProgress:!1,...n};return this.queues.set(i,s),s}createStandardQueue(n){return this.createQueue({queueUrl:`https://sqs.us-east-1.amazonaws.com/123456789012/${n.queueName}`,queueName:n.queueName,messageRetentionPeriod:(n.messageRetentionDays||4)*24*60*60,delaySeconds:0,maximumMessageSize:262144,receiveMessageWaitTime:0})}createLongPollingQueue(n){return this.createQueue({queueUrl:`https://sqs.us-east-1.amazonaws.com/123456789012/${n.queueName}`,queueName:n.queueName,messageRetentionPeriod:345600,delaySeconds:0,maximumMessageSize:262144,receiveMessageWaitTime:n.waitTimeSeconds||20})}createRetentionPolicy(n){let i=`retention-${Date.now()}-${this.retentionCounter++}`,s={id:i,...n};this.retentionPolicies.set(i,s);let o=this.queues.get(n.queueId);if(o)o.messageRetentionPeriod=n.retentionPeriod;return s}createShortRetentionPolicy(n){return this.createRetentionPolicy({queueId:n.queueId,retentionPeriod:n.retentionHours*60*60,autoCleanup:!0,archiveExpiredMessages:!1})}createArchivalRetentionPolicy(n){return this.createRetentionPolicy({queueId:n.queueId,retentionPeriod:n.retentionDays*24*60*60,autoCleanup:!0,cleanupSchedule:"cron(0 0 * * ? *)",archiveExpiredMessages:!0,archiveS3Bucket:n.s3Bucket})}createDelayQueue(n){let i=`delay-${Date.now()}-${this.delayCounter++}`,s={id:i,...n};this.delayQueues.set(i,s);let o=Array.from(this.queues.values()).find((c)=>c.queueUrl===n.queueUrl);if(o)o.delaySeconds=n.defaultDelay;return s}createScheduledDelayQueue(n){return this.createDelayQueue({queueUrl:n.queueUrl,defaultDelay:n.delayMinutes*60,perMessageDelay:!1,maxDelay:900})}async purgeQueue(n){let i=this.queues.get(n);if(!i)throw Error(`Queue not found: ${n}`);if(i.purgeInProgress)throw Error("Purge already in progress for this queue");let s=`purge-${Date.now()}-${this.purgeCounter++}`,o={id:s,queueUrl:i.queueUrl,status:"in_progress",startedAt:new Date};return this.purgeOperations.set(s,o),i.purgeInProgress=!0,setTimeout(()=>{o.status="completed",o.completedAt=new Date,o.messagesPurged=Math.floor(Math.random()*1000),i.purgeInProgress=!1},100),o}collectQueueMetrics(n){let s={id:`metrics-${Date.now()}-${this.metricsCounter++}`,queueUrl:n,timestamp:new Date,approximateNumberOfMessages:Math.floor(Math.random()*1000),approximateNumberOfMessagesNotVisible:Math.floor(Math.random()*100),approximateNumberOfMessagesDelayed:Math.floor(Math.random()*50),oldestMessageAge:Math.floor(Math.random()*86400)},o=this.metrics.get(n)||[];return o.push(s),this.metrics.set(n,o),s}getQueueHealth(n){let i=this.metrics.get(n)||[];if(i.length===0)return{status:"healthy",issues:[],recommendations:[]};let s=i[i.length-1],o=[],c=[],u="healthy";if(s.approximateNumberOfMessages>1e4)u="critical",o.push("Large message backlog detected"),c.push("Increase consumer capacity");else if(s.approximateNumberOfMessages>1000)u="warning",o.push("Growing message backlog"),c.push("Monitor consumer performance");if(s.oldestMessageAge&&s.oldestMessageAge>3600){if(u!=="critical")u="warning";o.push("Old messages in queue"),c.push("Review message processing")}if(s.approximateNumberOfMessagesDelayed>100){if(u!=="critical")u="warning";o.push("High number of delayed messages")}return{status:u,issues:o,recommendations:c}}getQueue(n){return this.queues.get(n)}listQueues(){return Array.from(this.queues.values())}getRetentionPolicy(n){return this.retentionPolicies.get(n)}listRetentionPolicies(){return Array.from(this.retentionPolicies.values())}getPurgeOperations(n){let i=Array.from(this.purgeOperations.values());if(n)i=i.filter((s)=>s.queueUrl===n);return i}generateQueueCF(n){return{Type:"AWS::SQS::Queue",Properties:{QueueName:n.queueName,MessageRetentionPeriod:n.messageRetentionPeriod,DelaySeconds:n.delaySeconds,MaximumMessageSize:n.maximumMessageSize,ReceiveMessageWaitTimeSeconds:n.receiveMessageWaitTime}}}generateCleanupRuleCF(n){return{Type:"AWS::Events::Rule",Properties:{Name:`${n.id}-cleanup`,Description:"Automated queue cleanup",ScheduleExpression:n.cleanupSchedule||"cron(0 0 * * ? *)",State:"ENABLED",Targets:[{Arn:"arn:aws:lambda:us-east-1:123456789012:function:queue-cleanup",Id:n.id,Input:JSON.stringify({queueId:n.queueId,archiveBucket:n.archiveS3Bucket})}]}}}clear(){this.queues.clear(),this.retentionPolicies.clear(),this.delayQueues.clear(),this.purgeOperations.clear(),this.metrics.clear(),this.queueCounter=0,this.retentionCounter=0,this.delayCounter=0,this.purgeCounter=0,this.metricsCounter=0}}var DE=new kf;import{deflateRawSync as Mi}from"node:zlib";var Li=(()=>{let n=[];for(let i=0;i<256;i++){let s=i;for(let o=0;o<8;o++)s=s&1?3988292384^s>>>1:s>>>1;n[i]=s>>>0}return n})();function Oi(n){let i=4294967295;for(let s=0;s<n.length;s++)i=Li[(i^n[s])&255]^i>>>8;return(i^4294967295)>>>0}function $i(n){if(typeof n==="string")return Buffer.from(n,"utf-8");if(Buffer.isBuffer(n))return n;return Buffer.from(n)}function Bi(n){let i=Math.max(1980,n.getFullYear()),s=(n.getHours()<<11|n.getMinutes()<<5|n.getSeconds()>>1)&65535,o=(i-1980<<9|n.getMonth()+1<<5|n.getDate())&65535;return{time:s,date:o}}function it(n){let i=[],s=[],o=0;for(let d of n){let g=$i(d.data),y=Mi(g),h=Oi(g),A=Buffer.from(d.name.replace(/\\/g,"/"),"utf-8"),{time:C,date:v}=Bi(d.date??new Date(0)),T=d.mode??420,R=Buffer.alloc(30+A.length);R.writeUInt32LE(67324752,0),R.writeUInt16LE(20,4),R.writeUInt16LE(0,6),R.writeUInt16LE(8,8),R.writeUInt16LE(C,10),R.writeUInt16LE(v,12),R.writeUInt32LE(h,14),R.writeUInt32LE(y.length,18),R.writeUInt32LE(g.length,22),R.writeUInt16LE(A.length,26),R.writeUInt16LE(0,28),A.copy(R,30);let P=Buffer.alloc(46+A.length);P.writeUInt32LE(33639248,0),P.writeUInt16LE(798,4),P.writeUInt16LE(20,6),P.writeUInt16LE(0,8),P.writeUInt16LE(8,10),P.writeUInt16LE(C,12),P.writeUInt16LE(v,14),P.writeUInt32LE(h,16),P.writeUInt32LE(y.length,20),P.writeUInt32LE(g.length,24),P.writeUInt16LE(A.length,28),P.writeUInt16LE(0,30),P.writeUInt16LE(0,32),P.writeUInt16LE(0,34),P.writeUInt16LE(0,36),P.writeUInt32LE((T&65535)<<16,38),P.writeUInt32LE(o,42),A.copy(P,46),i.push(R,y),s.push(P),o+=R.length+y.length}let c=Buffer.concat(s),u=Buffer.alloc(22);return u.writeUInt32LE(101010256,0),u.writeUInt16LE(0,4),u.writeUInt16LE(0,6),u.writeUInt16LE(n.length,8),u.writeUInt16LE(n.length,10),u.writeUInt32LE(c.length,12),u.writeUInt32LE(o,16),u.writeUInt16LE(0,20),Buffer.concat([...i,c,u])}function Nf(n){let i=n.adapterImport??"./adapter",s=n.entryImport.replace(/\\/g,"/");return`// Generated by ts-cloud — serverless app bootstrap. Do not edit.
+`;static createAbTestsTable(n){return{[`${n.slug}AbTestsTable`]:{Type:"AWS::DynamoDB::Table",Properties:{TableName:`${n.slug}-ab-tests`,BillingMode:"PAY_PER_REQUEST",AttributeDefinitions:[{AttributeName:"id",AttributeType:"S"}],KeySchema:[{AttributeName:"id",KeyType:"HASH"}]}}}}static createAbTestManagerLambda(n){return{[`${n.slug}AbTestManagerLambda`]:{Type:"AWS::Lambda::Function",Properties:{FunctionName:`${n.slug}-ab-test-manager`,Runtime:"nodejs20.x",Handler:"index.handler",Role:n.roleArn,Timeout:30,MemorySize:256,Code:{ZipFile:Pe.AbTestManagerCode},Environment:{Variables:{AB_TESTS_TABLE:n.abTestsTable}}}}}}static selectVariant(n,i){let o=Pe.hashString(i+n.id)%100,c=0;for(let u=0;u<n.variants.length;u++)if(c+=n.trafficSplit[u],o<c)return n.variants[u];return n.variants[n.variants.length-1]}static determineWinner(n){if(n.variants.length===0)return null;let i=n.winningCriteria,s=n.variants[0],o=Pe.getMetricValue(s,i);for(let c of n.variants.slice(1)){let u=Pe.getMetricValue(c,i);if(u>o)o=u,s=c}return s}static calculateSignificance(n,i,s){let o=n.stats.sent,c=i.stats.sent;if(o<30||c<30)return 0;let u=Pe.getMetricValue(n,s)/100,d=Pe.getMetricValue(i,s)/100,g=(u*o+d*c)/(o+c),y=Math.sqrt(g*(1-g)*(1/o+1/c));if(y===0)return 0;let h=Math.abs(u-d)/y;if(h>=2.576)return 99;if(h>=1.96)return 95;if(h>=1.645)return 90;if(h>=1.28)return 80;return Math.round(h*30)}static getMetricValue(n,i){switch(i){case"delivery_rate":return n.stats.deliveryRate;case"click_rate":return n.stats.clickRate;case"reply_rate":return n.stats.replyRate;case"conversion_rate":return n.stats.conversionRate;default:return n.stats.deliveryRate}}static hashString(n){let i=0;for(let s=0;s<n.length;s++){let o=n.charCodeAt(s);i=(i<<5)-i+o,i=i&i}return Math.abs(i)}}class Rf{queues=new Map;messageGroups=new Map;deduplicationConfigs=new Map;messages=new Map;queueCounter=0;groupCounter=0;deduplicationCounter=0;messageCounter=0;sequenceCounter=0;createFIFOQueue(n){let i=`fifo-queue-${Date.now()}-${this.queueCounter++}`,s=n.name.endsWith(".fifo")?n.name:`${n.name}.fifo`,{name:o,...c}=n,u={id:i,name:s,queueUrl:`https://sqs.us-east-1.amazonaws.com/123456789012/${s}`,...c};return this.queues.set(i,u),this.createDeduplicationConfig({queueId:i,contentBasedDeduplication:n.contentBasedDeduplication,deduplicationInterval:300}),u}createHighThroughputFIFO(n){return this.createFIFOQueue({name:n.name,contentBasedDeduplication:n.contentBasedDeduplication??!0,deduplicationScope:"messageGroup",fifoThroughputLimit:"perMessageGroupId",messageRetentionPeriod:345600,visibilityTimeout:30,receiveMessageWaitTime:0})}createStandardFIFO(n){return this.createFIFOQueue({name:n.name,contentBasedDeduplication:n.contentBasedDeduplication??!1,deduplicationScope:"queue",fifoThroughputLimit:"perQueue",messageRetentionPeriod:345600,visibilityTimeout:30,receiveMessageWaitTime:0})}createDeduplicationConfig(n){let s={id:`dedup-${Date.now()}-${this.deduplicationCounter++}`,deduplicationHashes:new Map,...n};return this.deduplicationConfigs.set(n.queueId,s),s}sendMessage(n){let i=this.queues.get(n.queueId);if(!i)throw Error(`Queue not found: ${n.queueId}`);let s=this.deduplicationConfigs.get(n.queueId);if(s){let d=n.messageDeduplicationId||(i.contentBasedDeduplication?this.generateHash(n.messageBody):void 0);if(d&&this.isDuplicate(s,d))return null;if(d)s.deduplicationHashes.set(d,new Date)}let o=`msg-${Date.now()}-${this.messageCounter++}`,c=this.generateSequenceNumber(),u={id:o,messageId:o,messageGroupId:n.messageGroupId,messageDeduplicationId:n.messageDeduplicationId,body:n.messageBody,attributes:n.messageAttributes||{},sentTimestamp:new Date,sequenceNumber:c};return this.messages.set(o,u),this.updateMessageGroup(n.queueId,n.messageGroupId),u}isDuplicate(n,i){let s=n.deduplicationHashes.get(i);if(!s)return!1;if((Date.now()-s.getTime())/1000>n.deduplicationInterval)return n.deduplicationHashes.delete(i),!1;return!0}generateHash(n){let i=0;for(let s=0;s<n.length;s++){let o=n.charCodeAt(s);i=(i<<5)-i+o,i=i&i}return Math.abs(i).toString(36)}generateSequenceNumber(){return`${Date.now()}${this.sequenceCounter++}`.padStart(20,"0")}updateMessageGroup(n,i){let s=`${n}-${i}`,o=this.messageGroups.get(s);if(!o)o={id:`group-${Date.now()}-${this.groupCounter++}`,messageGroupId:i,queueId:n,messagesInFlight:0},this.messageGroups.set(s,o);o.messagesInFlight++,o.lastMessageTimestamp=new Date}getMessageGroups(n){return Array.from(this.messageGroups.values()).filter((i)=>i.queueId===n)}getQueue(n){return this.queues.get(n)}listQueues(){return Array.from(this.queues.values())}getMessages(n,i){let s=Array.from(this.messages.values());if(i)s=s.filter((o)=>o.messageGroupId===i);return s.sort((o,c)=>o.sequenceNumber.localeCompare(c.sequenceNumber))}generateFIFOQueueCF(n){return{Type:"AWS::SQS::Queue",Properties:{QueueName:n.name,FifoQueue:!0,ContentBasedDeduplication:n.contentBasedDeduplication,DeduplicationScope:n.deduplicationScope,FifoThroughputLimit:n.fifoThroughputLimit,MessageRetentionPeriod:n.messageRetentionPeriod,VisibilityTimeout:n.visibilityTimeout,ReceiveMessageWaitTimeSeconds:n.receiveMessageWaitTime,...n.deadLetterTargetArn&&{RedrivePolicy:{deadLetterTargetArn:n.deadLetterTargetArn,maxReceiveCount:n.maxReceiveCount||3}}}}}clear(){this.queues.clear(),this.messageGroups.clear(),this.deduplicationConfigs.clear(),this.messages.clear(),this.queueCounter=0,this.groupCounter=0,this.deduplicationCounter=0,this.messageCounter=0,this.sequenceCounter=0}}var TE=new Rf;class Df{monitors=new Map;metrics=new Map;alerts=new Map;reprocessJobs=new Map;monitorCounter=0;metricsCounter=0;alertCounter=0;jobCounter=0;createDLQMonitor(n){let i=`dlq-monitor-${Date.now()}-${this.monitorCounter++}`,s={id:i,...n};return this.monitors.set(i,s),s}createAutomatedMonitor(n){return this.createDLQMonitor({name:n.name,queueUrl:n.queueUrl,sourceQueues:n.sourceQueues,maxReceiveCount:3,alarmThreshold:10,autoReprocess:!0,reprocessStrategy:"scheduled",notificationTopicArn:n.notificationTopicArn})}collectMetrics(n){let s={id:`metrics-${Date.now()}-${this.metricsCounter++}`,queueUrl:n,timestamp:new Date,approximateNumberOfMessages:Math.floor(Math.random()*100),approximateAgeOfOldestMessage:Math.floor(Math.random()*86400),messagesReceived:Math.floor(Math.random()*50),messagesDeleted:Math.floor(Math.random()*30),messagesReprocessed:Math.floor(Math.random()*20)},o=this.metrics.get(n)||[];return o.push(s),this.metrics.set(n,o),this.checkForAlerts(n,s),s}checkForAlerts(n,i){let s=Array.from(this.monitors.values()).find((c)=>c.queueUrl===n);if(!s)return;if(i.approximateNumberOfMessages>=s.alarmThreshold)this.createAlert({monitorId:s.id,alertType:"threshold_exceeded",severity:"high",message:`DLQ ${s.name} has ${i.approximateNumberOfMessages} messages (threshold: ${s.alarmThreshold})`});let o=3600;if(i.approximateAgeOfOldestMessage>o)this.createAlert({monitorId:s.id,alertType:"old_message",severity:"medium",message:`DLQ ${s.name} has messages older than ${o} seconds`})}createAlert(n){let i=`alert-${Date.now()}-${this.alertCounter++}`,s={id:i,timestamp:new Date,acknowledged:!1,...n};return this.alerts.set(i,s),s}acknowledgeAlert(n){let i=this.alerts.get(n);if(!i)throw Error(`Alert not found: ${n}`);return i.acknowledged=!0,i}createReprocessJob(n){let i=`reprocess-${Date.now()}-${this.jobCounter++}`,s={id:i,queueUrl:n.queueUrl,messageId:n.messageId,attempts:0,status:"pending"};return this.reprocessJobs.set(i,s),s}async executeReprocessJob(n){let i=this.reprocessJobs.get(n);if(!i)throw Error(`Reprocess job not found: ${n}`);i.status="processing",i.startedAt=new Date,i.attempts++,await new Promise((o)=>setTimeout(o,100));let s=Math.random()>0.3;if(i.status=s?"success":"failed",i.completedAt=new Date,!s)i.error="Reprocessing failed - original error still present";return i}async batchReprocess(n){let i=[];for(let s=0;s<n.maxMessages;s++){let o=this.createReprocessJob({queueUrl:n.queueUrl,messageId:`msg-${s}`});await this.executeReprocessJob(o.id),i.push(o)}return i}getDLQStatistics(n,i=24){let s=new Date(Date.now()-i*60*60*1000),o=(this.metrics.get(n)||[]).filter((A)=>A.timestamp>=s);if(o.length===0)return{totalMessages:0,avgAge:0,messagesReceived:0,messagesDeleted:0,messagesReprocessed:0,successRate:0};let c=o[o.length-1],u=o.reduce((A,C)=>A+C.messagesReceived,0),d=o.reduce((A,C)=>A+C.messagesDeleted,0),g=o.reduce((A,C)=>A+C.messagesReprocessed,0),y=o.reduce((A,C)=>A+C.approximateAgeOfOldestMessage,0)/o.length,h=g>0?d/g*100:0;return{totalMessages:c.approximateNumberOfMessages,avgAge:y,messagesReceived:u,messagesDeleted:d,messagesReprocessed:g,successRate:h}}getMonitor(n){return this.monitors.get(n)}listMonitors(){return Array.from(this.monitors.values())}getAlerts(n,i){let s=Array.from(this.alerts.values());if(n)s=s.filter((o)=>o.monitorId===n);if(i!==void 0)s=s.filter((o)=>o.acknowledged===i);return s.sort((o,c)=>c.timestamp.getTime()-o.timestamp.getTime())}getReprocessJobs(n){let i=Array.from(this.reprocessJobs.values());if(n)i=i.filter((s)=>s.queueUrl===n);return i}generateDLQAlarmCF(n){return{Type:"AWS::CloudWatch::Alarm",Properties:{AlarmName:`${n.name}-messages-alarm`,AlarmDescription:`Alert when DLQ ${n.name} exceeds threshold`,MetricName:"ApproximateNumberOfMessagesVisible",Namespace:"AWS/SQS",Statistic:"Average",Period:300,EvaluationPeriods:1,Threshold:n.alarmThreshold,ComparisonOperator:"GreaterThanThreshold",Dimensions:[{Name:"QueueName",Value:n.queueUrl.split("/").pop()}],...n.notificationTopicArn&&{AlarmActions:[n.notificationTopicArn]}}}}clear(){this.monitors.clear(),this.metrics.clear(),this.alerts.clear(),this.reprocessJobs.clear(),this.monitorCounter=0,this.metricsCounter=0,this.alertCounter=0,this.jobCounter=0}}var wE=new Df;class Pf{configs=new Map;jobs=new Map;metrics=new Map;configCounter=0;jobCounter=0;metricsCounter=0;createBatchConfig(n){let i=`batch-config-${Date.now()}-${this.configCounter++}`,s={id:i,...n};return this.configs.set(i,s),s}createHighThroughputConfig(n){return this.createBatchConfig({queueUrl:n.queueUrl,batchSize:10,maxWaitTime:100,parallelProcessors:10,retryAttempts:3,visibilityTimeout:30})}createLowLatencyConfig(n){return this.createBatchConfig({queueUrl:n.queueUrl,batchSize:1,maxWaitTime:0,parallelProcessors:5,retryAttempts:2,visibilityTimeout:10})}createBatchJob(n){let i=`batch-job-${Date.now()}-${this.jobCounter++}`;if(!this.configs.get(n.configId))throw Error(`Batch config not found: ${n.configId}`);let o=[];for(let u=0;u<n.messageCount;u++)o.push({id:`msg-${i}-${u}`,messageId:`${i}-${u}`,body:`Message ${u}`,receiptHandle:`receipt-${i}-${u}`,attributes:{},status:"pending"});let c={id:i,configId:n.configId,messages:o,status:"pending",processedCount:0,failedCount:0};return this.jobs.set(i,c),c}async processBatchJob(n){let i=this.jobs.get(n);if(!i)throw Error(`Batch job not found: ${n}`);let s=this.configs.get(i.configId);if(!s)throw Error(`Batch config not found: ${i.configId}`);i.status="processing",i.startedAt=new Date;let o=this.chunkArray(i.messages,s.batchSize);for(let c of o)await this.processBatch(c,s);return i.processedCount=i.messages.filter((c)=>c.status==="success").length,i.failedCount=i.messages.filter((c)=>c.status==="failed").length,i.status=i.failedCount===0?"completed":"failed",i.completedAt=new Date,this.collectProcessorMetrics(s.id,i),i}async processBatch(n,i){let s=n.map((o)=>this.processMessage(o,i));await Promise.all(s)}async processMessage(n,i){n.status="processing";let s=Date.now();await new Promise((u)=>setTimeout(u,Math.random()*100));let o=Date.now()-s;if(n.processingTime=o,Math.random()>0.1)n.status="success";else n.status="failed",n.error="Processing error"}chunkArray(n,i){let s=[];for(let o=0;o<n.length;o+=i)s.push(n.slice(o,o+i));return s}collectProcessorMetrics(n,i){let s=`metrics-${Date.now()}-${this.metricsCounter++}`,c=i.messages.filter((C)=>C.status==="success").map((C)=>C.processingTime||0).filter((C)=>C>0),u=c.length>0?c.reduce((C,v)=>C+v,0)/c.length:0,d=i.completedAt&&i.startedAt?(i.completedAt.getTime()-i.startedAt.getTime())/1000:1,g=i.processedCount/d,y=i.messages.length>0?i.failedCount/i.messages.length*100:0,h={id:s,configId:n,timestamp:new Date,messagesProcessed:i.processedCount,averageProcessingTime:u,throughput:g,errorRate:y},A=this.metrics.get(n)||[];A.push(h),this.metrics.set(n,A)}getBatchStatistics(n){let i=this.metrics.get(n)||[];if(i.length===0)return{totalJobsProcessed:0,totalMessagesProcessed:0,averageThroughput:0,averageErrorRate:0,averageProcessingTime:0};let s=i.reduce((d,g)=>d+g.messagesProcessed,0),o=i.reduce((d,g)=>d+g.throughput,0)/i.length,c=i.reduce((d,g)=>d+g.errorRate,0)/i.length,u=i.reduce((d,g)=>d+g.averageProcessingTime,0)/i.length;return{totalJobsProcessed:i.length,totalMessagesProcessed:s,averageThroughput:o,averageErrorRate:c,averageProcessingTime:u}}optimizeBatchConfig(n){let i=this.configs.get(n);if(!i)throw Error(`Batch config not found: ${n}`);let s=this.getBatchStatistics(n);if(s.averageErrorRate<5&&i.batchSize<10)i.batchSize=Math.min(10,i.batchSize+1);if(s.averageErrorRate>20&&i.batchSize>1)i.batchSize=Math.max(1,i.batchSize-1);if(s.averageThroughput<5&&i.parallelProcessors<20)i.parallelProcessors++;return i}getConfig(n){return this.configs.get(n)}listConfigs(){return Array.from(this.configs.values())}getJob(n){return this.jobs.get(n)}listJobs(n){let i=Array.from(this.jobs.values());if(n)i=i.filter((s)=>s.configId===n);return i}generateBatchProcessorCF(n){return{Type:"AWS::Lambda::EventSourceMapping",Properties:{EventSourceArn:`arn:aws:sqs:us-east-1:123456789012:${n.queueUrl.split("/").pop()}`,FunctionName:"batch-processor-function",BatchSize:n.batchSize,MaximumBatchingWindowInSeconds:n.maxWaitTime/1000,FunctionResponseTypes:["ReportBatchItemFailures"]}}}clear(){this.configs.clear(),this.jobs.clear(),this.metrics.clear(),this.configCounter=0,this.jobCounter=0,this.metricsCounter=0}}var RE=new Pf;class kf{queues=new Map;retentionPolicies=new Map;delayQueues=new Map;purgeOperations=new Map;metrics=new Map;queueCounter=0;retentionCounter=0;delayCounter=0;purgeCounter=0;metricsCounter=0;createQueue(n){let i=`queue-${Date.now()}-${this.queueCounter++}`,s={id:i,purgeInProgress:!1,...n};return this.queues.set(i,s),s}createStandardQueue(n){return this.createQueue({queueUrl:`https://sqs.us-east-1.amazonaws.com/123456789012/${n.queueName}`,queueName:n.queueName,messageRetentionPeriod:(n.messageRetentionDays||4)*24*60*60,delaySeconds:0,maximumMessageSize:262144,receiveMessageWaitTime:0})}createLongPollingQueue(n){return this.createQueue({queueUrl:`https://sqs.us-east-1.amazonaws.com/123456789012/${n.queueName}`,queueName:n.queueName,messageRetentionPeriod:345600,delaySeconds:0,maximumMessageSize:262144,receiveMessageWaitTime:n.waitTimeSeconds||20})}createRetentionPolicy(n){let i=`retention-${Date.now()}-${this.retentionCounter++}`,s={id:i,...n};this.retentionPolicies.set(i,s);let o=this.queues.get(n.queueId);if(o)o.messageRetentionPeriod=n.retentionPeriod;return s}createShortRetentionPolicy(n){return this.createRetentionPolicy({queueId:n.queueId,retentionPeriod:n.retentionHours*60*60,autoCleanup:!0,archiveExpiredMessages:!1})}createArchivalRetentionPolicy(n){return this.createRetentionPolicy({queueId:n.queueId,retentionPeriod:n.retentionDays*24*60*60,autoCleanup:!0,cleanupSchedule:"cron(0 0 * * ? *)",archiveExpiredMessages:!0,archiveS3Bucket:n.s3Bucket})}createDelayQueue(n){let i=`delay-${Date.now()}-${this.delayCounter++}`,s={id:i,...n};this.delayQueues.set(i,s);let o=Array.from(this.queues.values()).find((c)=>c.queueUrl===n.queueUrl);if(o)o.delaySeconds=n.defaultDelay;return s}createScheduledDelayQueue(n){return this.createDelayQueue({queueUrl:n.queueUrl,defaultDelay:n.delayMinutes*60,perMessageDelay:!1,maxDelay:900})}async purgeQueue(n){let i=this.queues.get(n);if(!i)throw Error(`Queue not found: ${n}`);if(i.purgeInProgress)throw Error("Purge already in progress for this queue");let s=`purge-${Date.now()}-${this.purgeCounter++}`,o={id:s,queueUrl:i.queueUrl,status:"in_progress",startedAt:new Date};return this.purgeOperations.set(s,o),i.purgeInProgress=!0,setTimeout(()=>{o.status="completed",o.completedAt=new Date,o.messagesPurged=Math.floor(Math.random()*1000),i.purgeInProgress=!1},100),o}collectQueueMetrics(n){let s={id:`metrics-${Date.now()}-${this.metricsCounter++}`,queueUrl:n,timestamp:new Date,approximateNumberOfMessages:Math.floor(Math.random()*1000),approximateNumberOfMessagesNotVisible:Math.floor(Math.random()*100),approximateNumberOfMessagesDelayed:Math.floor(Math.random()*50),oldestMessageAge:Math.floor(Math.random()*86400)},o=this.metrics.get(n)||[];return o.push(s),this.metrics.set(n,o),s}getQueueHealth(n){let i=this.metrics.get(n)||[];if(i.length===0)return{status:"healthy",issues:[],recommendations:[]};let s=i[i.length-1],o=[],c=[],u="healthy";if(s.approximateNumberOfMessages>1e4)u="critical",o.push("Large message backlog detected"),c.push("Increase consumer capacity");else if(s.approximateNumberOfMessages>1000)u="warning",o.push("Growing message backlog"),c.push("Monitor consumer performance");if(s.oldestMessageAge&&s.oldestMessageAge>3600){if(u!=="critical")u="warning";o.push("Old messages in queue"),c.push("Review message processing")}if(s.approximateNumberOfMessagesDelayed>100){if(u!=="critical")u="warning";o.push("High number of delayed messages")}return{status:u,issues:o,recommendations:c}}getQueue(n){return this.queues.get(n)}listQueues(){return Array.from(this.queues.values())}getRetentionPolicy(n){return this.retentionPolicies.get(n)}listRetentionPolicies(){return Array.from(this.retentionPolicies.values())}getPurgeOperations(n){let i=Array.from(this.purgeOperations.values());if(n)i=i.filter((s)=>s.queueUrl===n);return i}generateQueueCF(n){return{Type:"AWS::SQS::Queue",Properties:{QueueName:n.queueName,MessageRetentionPeriod:n.messageRetentionPeriod,DelaySeconds:n.delaySeconds,MaximumMessageSize:n.maximumMessageSize,ReceiveMessageWaitTimeSeconds:n.receiveMessageWaitTime}}}generateCleanupRuleCF(n){return{Type:"AWS::Events::Rule",Properties:{Name:`${n.id}-cleanup`,Description:"Automated queue cleanup",ScheduleExpression:n.cleanupSchedule||"cron(0 0 * * ? *)",State:"ENABLED",Targets:[{Arn:"arn:aws:lambda:us-east-1:123456789012:function:queue-cleanup",Id:n.id,Input:JSON.stringify({queueId:n.queueId,archiveBucket:n.archiveS3Bucket})}]}}}clear(){this.queues.clear(),this.retentionPolicies.clear(),this.delayQueues.clear(),this.purgeOperations.clear(),this.metrics.clear(),this.queueCounter=0,this.retentionCounter=0,this.delayCounter=0,this.purgeCounter=0,this.metricsCounter=0}}var DE=new kf;import{deflateRawSync as Mi}from"node:zlib";var Li=(()=>{let n=[];for(let i=0;i<256;i++){let s=i;for(let o=0;o<8;o++)s=s&1?3988292384^s>>>1:s>>>1;n[i]=s>>>0}return n})();function Oi(n){let i=4294967295;for(let s=0;s<n.length;s++)i=Li[(i^n[s])&255]^i>>>8;return(i^4294967295)>>>0}function $i(n){if(typeof n==="string")return Buffer.from(n,"utf-8");if(Buffer.isBuffer(n))return n;return Buffer.from(n)}function Bi(n){let i=Math.max(1980,n.getFullYear()),s=(n.getHours()<<11|n.getMinutes()<<5|n.getSeconds()>>1)&65535,o=(i-1980<<9|n.getMonth()+1<<5|n.getDate())&65535;return{time:s,date:o}}function it(n){let i=[],s=[],o=0;for(let d of n){let g=$i(d.data),y=Mi(g),h=Oi(g),A=Buffer.from(d.name.replace(/\\/g,"/"),"utf-8"),{time:C,date:v}=Bi(d.date??new Date(0)),T=d.mode??420,R=Buffer.alloc(30+A.length);R.writeUInt32LE(67324752,0),R.writeUInt16LE(20,4),R.writeUInt16LE(0,6),R.writeUInt16LE(8,8),R.writeUInt16LE(C,10),R.writeUInt16LE(v,12),R.writeUInt32LE(h,14),R.writeUInt32LE(y.length,18),R.writeUInt32LE(g.length,22),R.writeUInt16LE(A.length,26),R.writeUInt16LE(0,28),A.copy(R,30);let P=Buffer.alloc(46+A.length);P.writeUInt32LE(33639248,0),P.writeUInt16LE(798,4),P.writeUInt16LE(20,6),P.writeUInt16LE(0,8),P.writeUInt16LE(8,10),P.writeUInt16LE(C,12),P.writeUInt16LE(v,14),P.writeUInt32LE(h,16),P.writeUInt32LE(y.length,20),P.writeUInt32LE(g.length,24),P.writeUInt16LE(A.length,28),P.writeUInt16LE(0,30),P.writeUInt16LE(0,32),P.writeUInt16LE(0,34),P.writeUInt16LE(0,36),P.writeUInt32LE((T&65535)<<16,38),P.writeUInt32LE(o,42),A.copy(P,46),i.push(R,y),s.push(P),o+=R.length+y.length}let c=Buffer.concat(s),u=Buffer.alloc(22);return u.writeUInt32LE(101010256,0),u.writeUInt16LE(0,4),u.writeUInt16LE(0,6),u.writeUInt16LE(n.length,8),u.writeUInt16LE(n.length,10),u.writeUInt32LE(c.length,12),u.writeUInt32LE(o,16),u.writeUInt16LE(0,20),Buffer.concat([...i,c,u])}function Nf(n){let i=n.adapterImport??"./adapter",s=n.entryImport.replace(/\\/g,"/");return`// Generated by ts-cloud — serverless app bootstrap. Do not edit.
 import * as __userModule from ${JSON.stringify(s)}
 import { resolveApp, createHandlers } from ${JSON.stringify(i)}
 
@@ -7238,7 +7238,7 @@ export const queue = __handlers.queue
 export const cli = __handlers.cli
 `}import{execSync as Fi}from"node:child_process";import{createHash as Gi}from"node:crypto";import{cpSync as _i,mkdtempSync as Wi,rmSync as Vi,writeFileSync as Ui}from"node:fs";import{tmpdir as Hi}from"node:os";import{dirname as ji,isAbsolute as Ki,join as Fe,resolve as qi}from"node:path";import{fileURLToPath as zi}from"node:url";var Qi=["adapter.ts","recursion.ts","auto-recursion.ts"];function ss(){return Fe(ji(zi(import.meta.url)),"runtime")}function uS(n,i,s){for(let o of n??[])s?.(`build: ${o}`),Fi(o,{stdio:"inherit",cwd:i})}function Wo(n){return Gi("sha256").update(n).digest("hex")}function $l(n,i,s){return`deployments/${n}/${i}/${s}.zip`}async function mn(n){let i=qi(n.projectRoot??process.cwd()),{app:s}=n;if(!n.skipBuild)uS(s.build,i,n.onStep);let o=s.entry;if(!o)throw Error("serverless app: `entry` is required to package a Node/Bun application");let c=Ki(o)?o:Fe(i,o),u=Wi(Fe(Hi(),"tscloud-pkg-"));try{for(let v of Qi)_i(Fe(ss(),v),Fe(u,v));let d=Fe(u,"bootstrap.ts");Ui(d,Nf({entryImport:c,adapterImport:"./adapter"})),n.onStep?.("bundling application");let g=await Bun.build({entrypoints:[d],target:s.kind==="bun"?"bun":"node",format:"esm",minify:!1,sourcemap:"none"});if(!g.success){let v=g.logs.map((T)=>String(T)).join(`
 `);throw Error(`serverless app bundle failed:
-${v}`)}let y=g.outputs[0],h=Buffer.from(await y.arrayBuffer()),A="index",C=it([{name:`${A}.mjs`,data:h}]);return{zip:C,bundle:h,sha256:Wo(C),handlerFile:A,handlers:{http:s.handlers?.http??`${A}.http`,queue:s.handlers?.queue??`${A}.queue`,cli:s.handlers?.cli??`${A}.cli`},bundleBytes:h.length}}finally{Vi(u,{recursive:!0,force:!0})}}var gS=["18","20","22"];function as(n){if(!n)return"22";let i=String(n).match(/(\d+)/);return i?i[1]:"22"}function ns(n){let i=n.kind??"node";if(i==="php")return{lambdaRuntime:"provided.al2023",kind:"php",version:n.phpVersion??"8.3",usesLayer:!0,layerKind:"php",layerEnvVar:"TSCLOUD_PHP_LAYER_ARN"};if(i==="bun")return{lambdaRuntime:"provided.al2023",kind:"bun",version:n.runtimeVersion??"latest",usesLayer:!0,layerKind:"bun",layerEnvVar:"TSCLOUD_BUN_LAYER_ARN"};let s=as(n.runtimeVersion);if(n.runtime!=="provided.al2023"&&gS.includes(s))return{lambdaRuntime:n.runtime&&n.runtime.startsWith("nodejs")?n.runtime:`nodejs${s}.x`,kind:"node",version:s,usesLayer:!1};return{lambdaRuntime:"provided.al2023",kind:"node",version:s,usesLayer:!0,layerKind:"node",layerEnvVar:"TSCLOUD_NODE_LAYER_ARN"}}function Ar(n,i,s){if(n.queues===!1)return[];if(n.queues===void 0||n.queues===!0)return[{name:`${i}-${s}-default`}];return n.queues.map((o)=>{if(typeof o==="string")return{name:`${i}-${s}-${o}`};let[c,u]=Object.entries(o)[0];return{name:`${i}-${s}-${c}`,concurrency:u}})}function Ml(n,i,s){return Ar(n,i,s).map((o)=>o.name)}function Fl(n){let{app:i,environment:s,handlers:o}=n,c=n.config.project.slug,u=ns(i).lambdaRuntime,d=i.architecture??"x86_64",g=n.config.project.region,y={http:`${c}-${s}-http`,queue:`${c}-${s}-queue`,cli:`${c}-${s}-cli`};if(i.gatewayVersion===1)throw Error("serverless app: `gatewayVersion: 1` (REST API) is not supported — ts-cloud uses API Gateway HTTP API (v2). Remove `gatewayVersion` or set it to 2.");let h=Ar(i,c,s),A=h.map((G)=>G.name),C=A.length>0,v=i.logRetention??14,T=i.packaging==="image";if(T&&i.lambdaInsights)throw Error("serverless app: `lambdaInsights` layer attachment is only supported for zip packaging. Container images must install the Lambda Insights extension in the image.");let R=(i.scheduler??"on")!=="off",P=(i.cache?.driver??"dynamodb")==="dynamodb",I=Boolean(i.assets),M=Xi(c,s),L=i.tmpStorage??512,N={},O={},B=[{PolicyName:"tscloud-serverless-app",PolicyDocument:{Version:"2012-10-17",Statement:[{Effect:"Allow",Action:["logs:CreateLogGroup","logs:CreateLogStream","logs:PutLogEvents"],Resource:e.sub("arn:aws:logs:${AWS::Region}:${AWS::AccountId}:log-group:/aws/lambda/*")},{Effect:"Allow",Action:["lambda:InvokeFunction"],Resource:e.sub(`arn:aws:lambda:\${AWS::Region}:\${AWS::AccountId}:function:${c}-${s}-*`)},{Effect:"Allow",Action:["secretsmanager:GetSecretValue","ssm:GetParameter","ssm:GetParameters","ssm:GetParametersByPath"],Resource:[e.sub(`arn:aws:secretsmanager:\${AWS::Region}:\${AWS::AccountId}:secret:${c}/${s}/*`),e.sub(`arn:aws:ssm:\${AWS::Region}:\${AWS::AccountId}:parameter/${c}/${s}/*`)]},{Effect:"Allow",Action:["s3:GetObject","s3:PutObject","s3:DeleteObject","s3:ListBucket"],Resource:[e.sub(`arn:aws:s3:::${M}`),e.sub(`arn:aws:s3:::${M}/*`),...i.storage?.bucket?[e.sub(`arn:aws:s3:::${i.storage.bucket}`),e.sub(`arn:aws:s3:::${i.storage.bucket}/*`)]:[]]}]}}];if(C)B[0].PolicyDocument.Statement.push({Effect:"Allow",Action:["sqs:SendMessage","sqs:ReceiveMessage","sqs:DeleteMessage","sqs:GetQueueAttributes","sqs:GetQueueUrl"],Resource:e.sub(`arn:aws:sqs:\${AWS::Region}:\${AWS::AccountId}:${c}-${s}-*`)});if(P)B[0].PolicyDocument.Statement.push({Effect:"Allow",Action:["dynamodb:GetItem","dynamodb:PutItem","dynamodb:UpdateItem","dynamodb:DeleteItem","dynamodb:Query","dynamodb:Scan","dynamodb:BatchGetItem","dynamodb:BatchWriteItem"],Resource:e.sub(`arn:aws:dynamodb:\${AWS::Region}:\${AWS::AccountId}:table/${c}-${s}-cache*`)});let F=["arn:aws:iam::aws:policy/service-role/AWSLambdaBasicExecutionRole"];if(i.vpc?.subnets?.length)F.push("arn:aws:iam::aws:policy/service-role/AWSLambdaVPCAccessExecutionRole");if(i.lambdaInsights)F.push("arn:aws:iam::aws:policy/CloudWatchLambdaInsightsExecutionRolePolicy");N.AppRole={Type:"AWS::IAM::Role",Properties:{RoleName:`${c}-${s}-app-role`,AssumeRolePolicyDocument:{Version:"2012-10-17",Statement:[{Effect:"Allow",Principal:{Service:"lambda.amazonaws.com"},Action:"sts:AssumeRole"}]},ManagedPolicyArns:F,Policies:B}};let U=(G)=>({TSCLOUD_LAMBDA_MODE:G,TSCLOUD_ENV:s,...i.octane?{TSCLOUD_OCTANE:"1"}:{},...i.scheduler==="sub-minute"?{TSCLOUD_SCHEDULER:"sub-minute"}:{},...P?{TSCLOUD_CACHE_TABLE:`${c}-${s}-cache`}:{},...C?{TSCLOUD_QUEUE:A[0]}:{},...i.env??{}}),j=Boolean(i.efs),H=typeof i.efs==="object"?i.efs:{},z=H.mountPath??"/mnt/local",se=j&&!H.accessPointArn,Te=H.accessPointArn??(se?e.getAtt("EfsAccessPoint","Arn"):void 0),oe=i.vpc?.subnets??[],ge=oe.length>0,ae=i.cache?.driver==="elasticache"||i.database?.connection==="aurora-serverless"||Boolean(i.rdsProxy)||j;if(ae&&!ge)throw Error("serverless app: elasticache / aurora-serverless / rdsProxy / efs require app.vpc.subnets (private subnets) to be set.");let me=ge?{VpcConfig:{SubnetIds:oe,SecurityGroupIds:[...i.vpc?.securityGroups??[],...ae?[e.getAtt("DataSecurityGroup","GroupId")]:[]]}}:{},Ie=se?oe.map((G,ne)=>`EfsMountTarget${ne}`):[],Le=j?{FileSystemConfigs:[{Arn:Te,LocalMountPath:z}]}:{};if(j)B[0].PolicyDocument.Statement.push({Effect:"Allow",Action:["elasticfilesystem:ClientMount","elasticfilesystem:ClientWrite","elasticfilesystem:ClientRootAccess","elasticfilesystem:DescribeMountTargets"],Resource:"*"});function he(G,ne,ie,re,fe,ht,Ve,Ne=L){N[`${G}LogGroup`]={Type:"AWS::Logs::LogGroup",Properties:{LogGroupName:`/aws/lambda/${ne}`,RetentionInDays:v}};let Ue=[...n.runtimeLayers??[],...i.lambdaInsights?[i.lambdaInsights.layerArn]:[]],en=T?{PackageType:"Image",Code:{ImageUri:e.ref("ImageUri")},...i.kind==="php"?{}:{ImageConfig:{Command:[ie]}}}:{Runtime:u,Handler:ie,Code:{S3Bucket:e.ref("ArtifactBucket"),S3Key:e.ref("ArtifactKey")},...Ue.length?{Layers:[...new Set(Ue)]}:{}};N[G]={Type:"AWS::Lambda::Function",DependsOn:[`${G}LogGroup`,...Ie],Properties:{FunctionName:ne,Architectures:[d],MemorySize:fe,Timeout:ht,Role:e.getAtt("AppRole","Arn"),Environment:{Variables:U(re)},EphemeralStorage:{Size:Ne},...en,...Ve!==void 0?{ReservedConcurrentExecutions:Ve}:{},...me,...Le}}}if(he("HttpFunction",y.http,o.http,"http",i.memory??1024,i.timeout??28,i.concurrency,L),he("CliFunction",y.cli,o.cli,"cli",i.cliMemory??1024,i.cliTimeout??900,void 0,i.cliTmpStorage??L),C)he("QueueFunction",y.queue,o.queue,"queue",i.queueMemory??1024,i.queueTimeout??120,void 0,i.queueTmpStorage??L);let ye=(i.provisionedConcurrency??0)>0?i.provisionedConcurrency:0,be=["HttpFunction","CliFunction",...C?["QueueFunction"]:[]];if(ye)for(let G of be)N[`${G}Version`]={Type:"AWS::Lambda::Version",DeletionPolicy:"Retain",Properties:{FunctionName:e.ref(G)}},N[`${G}Alias`]={Type:"AWS::Lambda::Alias",Properties:{FunctionName:e.ref(G),Name:"live",FunctionVersion:e.getAtt(`${G}Version`,"Version"),ProvisionedConcurrencyConfig:{ProvisionedConcurrentExecutions:ye}}};let De=(G)=>ye?e.ref(`${G}Alias`):e.getAtt(G,"Arn"),Se=(G)=>ye?e.ref(`${G}Alias`):e.ref(G);N.HttpApi={Type:"AWS::ApiGatewayV2::Api",Properties:{Name:`${c}-${s}`,ProtocolType:"HTTP"}},N.HttpIntegration={Type:"AWS::ApiGatewayV2::Integration",Properties:{ApiId:e.ref("HttpApi"),IntegrationType:"AWS_PROXY",IntegrationUri:De("HttpFunction"),PayloadFormatVersion:"2.0"}},N.HttpRoute={Type:"AWS::ApiGatewayV2::Route",Properties:{ApiId:e.ref("HttpApi"),RouteKey:"$default",Target:e.join("/",["integrations",e.ref("HttpIntegration")])}},N.HttpStage={Type:"AWS::ApiGatewayV2::Stage",Properties:{ApiId:e.ref("HttpApi"),StageName:"$default",AutoDeploy:!0}},N.HttpPermission={Type:"AWS::Lambda::Permission",Properties:{FunctionName:Se("HttpFunction"),Action:"lambda:InvokeFunction",Principal:"apigateway.amazonaws.com",SourceArn:e.sub("arn:aws:execute-api:${AWS::Region}:${AWS::AccountId}:${HttpApi}/*/*")}},O.HttpApiEndpoint={Description:"HTTP API endpoint",Value:e.getAtt("HttpApi","ApiEndpoint")},O.HttpApiId={Description:"HTTP API id",Value:e.ref("HttpApi")};let Re=(Array.isArray(i.domain)?i.domain:i.domain?[i.domain]:[]).filter(Boolean);if(Re.length){if(!i.certificateArn&&!i.hostedZoneId)throw Error("serverless app: a custom `domain` needs either `certificateArn` (pre-issued, regional) or `hostedZoneId` (to auto-issue + validate an ACM cert).");let G=i.certificateArn;if(!G)N.HttpCertificate={Type:"AWS::CertificateManager::Certificate",Properties:{DomainName:Re[0],...Re.length>1?{SubjectAlternativeNames:Re.slice(1)}:{},ValidationMethod:"DNS",DomainValidationOptions:Re.map((ne)=>({DomainName:ne,HostedZoneId:i.hostedZoneId}))}},G=e.ref("HttpCertificate");Re.forEach((ne,ie)=>{let re=`HttpDomain${ie}`;if(N[re]={Type:"AWS::ApiGatewayV2::DomainName",Properties:{DomainName:ne,DomainNameConfigurations:[{CertificateArn:G,EndpointType:"REGIONAL"}]}},N[`HttpApiMapping${ie}`]={Type:"AWS::ApiGatewayV2::ApiMapping",DependsOn:["HttpStage"],Properties:{ApiId:e.ref("HttpApi"),DomainName:e.ref(re),Stage:"$default"}},i.hostedZoneId)N[`HttpDomainRecord${ie}`]={Type:"AWS::Route53::RecordSet",Properties:{HostedZoneId:i.hostedZoneId,Name:ne,Type:"A",AliasTarget:{DNSName:e.getAtt(re,"RegionalDomainName"),HostedZoneId:e.getAtt(re,"RegionalHostedZoneId")}}};O[`CustomDomain${ie}`]={Description:`Custom domain ${ne}`,Value:ne},O[`CustomDomainTarget${ie}`]={Description:`Point ${ne} (CNAME/alias) at this APIGW regional domain`,Value:e.getAtt(re,"RegionalDomainName")}})}if(C)N.AppQueueDlq={Type:"AWS::SQS::Queue",Properties:{QueueName:`${c}-${s}-dlq`,MessageRetentionPeriod:1209600}},h.forEach((G,ne)=>{let ie=`AppQueue${ne}`,re=i.queueTimeout??120;N[ie]={Type:"AWS::SQS::Queue",Properties:{QueueName:G.name,VisibilityTimeout:Math.min(43200,re*6),RedrivePolicy:{deadLetterTargetArn:e.getAtt("AppQueueDlq","Arn"),maxReceiveCount:i.queueTries??3}}};let fe=G.concurrency??i.queueConcurrency;N[`${ie}Mapping`]={Type:"AWS::Lambda::EventSourceMapping",Properties:{EventSourceArn:e.getAtt(ie,"Arn"),FunctionName:Se("QueueFunction"),BatchSize:1,FunctionResponseTypes:["ReportBatchItemFailures"],...fe?{ScalingConfig:{MaximumConcurrency:Math.max(2,fe)}}:{}}},O[`QueueUrl${ne}`]={Description:`Queue URL: ${G.name}`,Value:e.ref(ie)}});if(R)N.SchedulerRule={Type:"AWS::Events::Rule",Properties:{Name:`${c}-${s}-scheduler`,ScheduleExpression:"rate(1 minute)",State:"ENABLED",Targets:[{Id:"cli",Arn:De("CliFunction"),Input:JSON.stringify({command:"schedule:run"})}]}},N.SchedulerPermission={Type:"AWS::Lambda::Permission",Properties:{FunctionName:Se("CliFunction"),Action:"lambda:InvokeFunction",Principal:"events.amazonaws.com",SourceArn:e.getAtt("SchedulerRule","Arn")}};if(i.warm&&i.warm>0){let ne={http:"HttpFunction",queue:"QueueFunction",cli:"CliFunction"},ie=(i.warmFunctions??["http"]).filter((re)=>re!=="queue"||C);for(let re of ie){let fe=re.charAt(0).toUpperCase()+re.slice(1),ht=Math.ceil(i.warm/5),Ve=0;for(let Ne=0;Ne<ht;Ne++){let Ue=Math.min(5,i.warm-Ve);N[`Warmer${fe}Rule${Ne}`]={Type:"AWS::Events::Rule",Properties:{Name:`${c}-${s}-warmer-${re}-${Ne}`,ScheduleExpression:"rate(5 minutes)",State:"ENABLED",Targets:Array.from({length:Ue},(en,sr)=>({Id:`warm-${re}-${Ne}-${sr}`,Arn:e.getAtt(ne[re],"Arn"),Input:JSON.stringify({warmer:!0})}))}},Ve+=Ue}N[`Warmer${fe}Permission`]={Type:"AWS::Lambda::Permission",Properties:{FunctionName:e.ref(ne[re]),Action:"lambda:InvokeFunction",Principal:"events.amazonaws.com",SourceArn:e.sub(`arn:aws:events:\${AWS::Region}:\${AWS::AccountId}:rule/${c}-${s}-warmer-${re}-*`)}}}}if(P)N.CacheTable={Type:"AWS::DynamoDB::Table",Properties:{TableName:`${c}-${s}-cache`,BillingMode:"PAY_PER_REQUEST",AttributeDefinitions:[{AttributeName:"key",AttributeType:"S"}],KeySchema:[{AttributeName:"key",KeyType:"HASH"}],TimeToLiveSpecification:{AttributeName:"expires_at",Enabled:!0}}},O.CacheTableName={Description:"DynamoDB cache table",Value:e.ref("CacheTable")};if(I){if(N.AssetsBucket={Type:"AWS::S3::Bucket",Properties:{BucketName:M,PublicAccessBlockConfiguration:{BlockPublicAcls:!0,BlockPublicPolicy:!0,IgnorePublicAcls:!0,RestrictPublicBuckets:!0}}},N.AssetsOAC={Type:"AWS::CloudFront::OriginAccessControl",Properties:{OriginAccessControlConfig:{Name:`${c}-${s}-assets-oac`,OriginAccessControlOriginType:"s3",SigningBehavior:"always",SigningProtocol:"sigv4"}}},N.AssetsDistribution={Type:"AWS::CloudFront::Distribution",Properties:{DistributionConfig:{Enabled:!0,DefaultCacheBehavior:{TargetOriginId:"assets",ViewerProtocolPolicy:"redirect-to-https",Compress:!0,CachePolicyId:"658327ea-f89d-4fab-a63d-7e88639e58f6"},Origins:[{Id:"assets",DomainName:e.getAtt("AssetsBucket","RegionalDomainName"),OriginAccessControlId:e.ref("AssetsOAC"),S3OriginConfig:{OriginAccessIdentity:""}}],...i.assetDomain?{Aliases:[i.assetDomain],ViewerCertificate:{AcmCertificateArn:i.assetCertificateArn??e.ref("AssetsCertificate"),SslSupportMethod:"sni-only",MinimumProtocolVersion:"TLSv1.2_2021"}}:{}}}},i.assetDomain){if(!i.assetCertificateArn){if(!i.hostedZoneId)throw Error("serverless app: `assetDomain` requires either `assetCertificateArn` (a us-east-1 ACM cert) or `hostedZoneId` (to auto-issue + validate one). CloudFront only accepts certs from us-east-1.");if(g!=="us-east-1")throw Error(`serverless app: auto-issuing an asset-domain cert needs a us-east-1 app (CloudFront certs must be us-east-1); this app is in ${g}. Supply a pre-issued us-east-1 \`assetCertificateArn\` instead.`);N.AssetsCertificate={Type:"AWS::CertificateManager::Certificate",Properties:{DomainName:i.assetDomain,ValidationMethod:"DNS",DomainValidationOptions:[{DomainName:i.assetDomain,HostedZoneId:i.hostedZoneId}]}}}if(i.hostedZoneId)N.AssetsDomainRecord={Type:"AWS::Route53::RecordSet",Properties:{HostedZoneId:i.hostedZoneId,Name:i.assetDomain,Type:"A",AliasTarget:{DNSName:e.getAtt("AssetsDistribution","DomainName"),HostedZoneId:"Z2FDTNDATAQYW2"}}};O.AssetDomain={Description:"Custom asset CDN host",Value:i.assetDomain}}N.AssetsBucketPolicy={Type:"AWS::S3::BucketPolicy",Properties:{Bucket:e.ref("AssetsBucket"),PolicyDocument:{Version:"2012-10-17",Statement:[{Effect:"Allow",Principal:{Service:"cloudfront.amazonaws.com"},Action:"s3:GetObject",Resource:e.sub(`arn:aws:s3:::${M}/*`),Condition:{StringEquals:{"AWS:SourceArn":e.sub("arn:aws:cloudfront::${AWS::AccountId}:distribution/${AssetsDistribution}")}}}]}}},O.AssetsBucketName={Description:"Assets bucket",Value:e.ref("AssetsBucket")},O.AssetsCdnDomain={Description:"Assets CloudFront domain",Value:e.getAtt("AssetsDistribution","DomainName")}}if(i.firewall?.enabled){let G=[],ne=0;if(i.firewall.rateLimit)G.push({Name:"rate-limit",Priority:ne++,Action:{Block:{}},Statement:{RateBasedStatement:{Limit:i.firewall.rateLimit,AggregateKeyType:"IP"}},VisibilityConfig:{SampledRequestsEnabled:!0,CloudWatchMetricsEnabled:!0,MetricName:`${c}-${s}-rate`}});let ie={sqlInjection:"AWSManagedRulesSQLiRuleSet",xss:"AWSManagedRulesCommonRuleSet",common:"AWSManagedRulesCommonRuleSet",botControl:"AWSManagedRulesBotControlRuleSet",ipReputation:"AWSManagedRulesAmazonIpReputationList"};for(let re of i.firewall.rules??[]){let fe=ie[re];if(!fe)continue;G.push({Name:`managed-${re}`,Priority:ne++,OverrideAction:{None:{}},Statement:{ManagedRuleGroupStatement:{VendorName:"AWS",Name:fe}},VisibilityConfig:{SampledRequestsEnabled:!0,CloudWatchMetricsEnabled:!0,MetricName:`${c}-${s}-${re}`}})}N.WebAcl={Type:"AWS::WAFv2::WebACL",Properties:{Name:`${c}-${s}-waf`,Scope:"REGIONAL",DefaultAction:{Allow:{}},Rules:G,VisibilityConfig:{SampledRequestsEnabled:!0,CloudWatchMetricsEnabled:!0,MetricName:`${c}-${s}-waf`}}},O.WafAclArn={Description:"WAF web ACL ARN. Attach to a CloudFront distribution fronting the API to enforce (HTTP API v2 stages do not support direct WAF association).",Value:e.getAtt("WebAcl","Arn")}}if(ge&&ae){if(!i.vpc?.id)throw Error("serverless app: data services (elasticache / aurora-serverless / rdsProxy / efs) need app.vpc.id (the VPC id) so the managed security group is created in the right VPC.");N.DataSecurityGroup={Type:"AWS::EC2::SecurityGroup",Properties:{VpcId:i.vpc.id,GroupDescription:`${c}-${s} serverless data access`,SecurityGroupIngress:[{IpProtocol:"-1",CidrIp:"10.0.0.0/8"}]}}}if(se)N.EfsFileSystem={Type:"AWS::EFS::FileSystem",Properties:{Encrypted:!0,FileSystemTags:[{Key:"Name",Value:`${c}-${s}-efs`}]}},oe.forEach((G,ne)=>{N[`EfsMountTarget${ne}`]={Type:"AWS::EFS::MountTarget",Properties:{FileSystemId:e.ref("EfsFileSystem"),SubnetId:G,SecurityGroups:[e.getAtt("DataSecurityGroup","GroupId")]}}}),N.EfsAccessPoint={Type:"AWS::EFS::AccessPoint",Properties:{FileSystemId:e.ref("EfsFileSystem"),PosixUser:{Uid:1001,Gid:1001},RootDirectory:{Path:"/lambda",CreationInfo:{OwnerUid:1001,OwnerGid:1001,Permissions:"0755"}}}},O.EfsFileSystemId={Description:"EFS file system id",Value:e.ref("EfsFileSystem")};if(i.cache?.driver==="elasticache")N.CacheSubnetGroup={Type:"AWS::ElastiCache::SubnetGroup",Properties:{Description:`${c}-${s} cache subnets`,SubnetIds:oe}},N.CacheCluster={Type:"AWS::ElastiCache::ReplicationGroup",Properties:{ReplicationGroupId:`${c}-${s}-cache`,ReplicationGroupDescription:`${c}-${s} redis`,Engine:"redis",CacheNodeType:"cache.t4g.micro",NumCacheClusters:1,AutomaticFailoverEnabled:!1,CacheSubnetGroupName:e.ref("CacheSubnetGroup"),SecurityGroupIds:[e.getAtt("DataSecurityGroup","GroupId")],TransitEncryptionEnabled:!1}},O.CacheEndpoint={Description:"Redis primary endpoint",Value:e.getAtt("CacheCluster","PrimaryEndPoint.Address")};if(i.database?.connection==="aurora-serverless")N.DbSubnetGroup={Type:"AWS::RDS::DBSubnetGroup",Properties:{DBSubnetGroupDescription:`${c}-${s} db subnets`,SubnetIds:oe}},N.DbSecret={Type:"AWS::SecretsManager::Secret",Properties:{Name:`${c}/${s}/db`,GenerateSecretString:{SecretStringTemplate:JSON.stringify({username:"app"}),GenerateStringKey:"password",PasswordLength:32,ExcludePunctuation:!0}}},N.DbCluster={Type:"AWS::RDS::DBCluster",Properties:{Engine:"aurora-mysql",EngineMode:"provisioned",DBClusterIdentifier:`${c}-${s}-db`,DatabaseName:"app",MasterUsername:e.sub("{{resolve:secretsmanager:${DbSecret}:SecretString:username}}"),MasterUserPassword:e.sub("{{resolve:secretsmanager:${DbSecret}:SecretString:password}}"),ServerlessV2ScalingConfiguration:{MinCapacity:i.database?.minCapacity??0.5,MaxCapacity:i.database?.maxCapacity??4},DBSubnetGroupName:e.ref("DbSubnetGroup"),VpcSecurityGroupIds:[e.getAtt("DataSecurityGroup","GroupId")]}},N.DbInstance={Type:"AWS::RDS::DBInstance",Properties:{Engine:"aurora-mysql",DBInstanceClass:"db.serverless",DBClusterIdentifier:e.ref("DbCluster")}},O.DbEndpoint={Description:"Aurora cluster endpoint",Value:e.getAtt("DbCluster","Endpoint.Address")};if(i.rdsProxy&&i.database?.connection==="aurora-serverless")N.DbProxyRole={Type:"AWS::IAM::Role",Properties:{AssumeRolePolicyDocument:{Version:"2012-10-17",Statement:[{Effect:"Allow",Principal:{Service:"rds.amazonaws.com"},Action:"sts:AssumeRole"}]},Policies:[{PolicyName:"read-db-secret",PolicyDocument:{Version:"2012-10-17",Statement:[{Effect:"Allow",Action:["secretsmanager:GetSecretValue"],Resource:e.ref("DbSecret")}]}}]}},N.DbProxy={Type:"AWS::RDS::DBProxy",Properties:{DBProxyName:typeof i.rdsProxy==="object"&&i.rdsProxy.name?i.rdsProxy.name:`${c}-${s}-proxy`,EngineFamily:"MYSQL",RoleArn:e.getAtt("DbProxyRole","Arn"),Auth:[{AuthScheme:"SECRETS",SecretArn:e.ref("DbSecret"),IAMAuth:"DISABLED"}],VpcSubnetIds:oe,VpcSecurityGroupIds:[e.getAtt("DataSecurityGroup","GroupId")],RequireTLS:!1}},N.DbProxyTargetGroup={Type:"AWS::RDS::DBProxyTargetGroup",DependsOn:["DbInstance"],Properties:{DBProxyName:e.ref("DbProxy"),TargetGroupName:"default",DBClusterIdentifiers:[e.ref("DbCluster")]}},O.DbProxyEndpoint={Description:"RDS Proxy endpoint",Value:e.getAtt("DbProxy","Endpoint")};if(O.HttpFunctionName={Description:"HTTP function name",Value:e.ref("HttpFunction")},O.CliFunctionName={Description:"CLI function name",Value:e.ref("CliFunction")},C)O.QueueFunctionName={Description:"Queue function name",Value:e.ref("QueueFunction")};let $e={AWSTemplateFormatVersion:"2010-09-09",Description:`Serverless application for ${n.config.project.name} (${c}-${s})`,Parameters:T?{ImageUri:{Type:"String",Description:"ECR image URI of the deployment artifact"}}:{ArtifactBucket:{Type:"String",Description:"S3 bucket holding the deployment artifact"},ArtifactKey:{Type:"String",Description:"S3 key of the deployment artifact (zip)"}},Resources:N,Outputs:O},We={};for(let G of Object.values(N))We[G.Type]=(We[G.Type]??0)+1;return{template:$e,functionNames:y,queueNames:A,resourceSummary:We}}var pS=["cli","fpm","curl","mbstring","xml","pdo","mysqlnd","gd","bcmath","intl","opcache","sodium","process","pecl-redis6","pecl-apcu","pgsql"];function mS(n){let i=`php${n.replace(".","")}`;return pS.map((s)=>`${i}-php-${s}`)}function Ul(n,i){let s=`php${n.replace(".","")}`,o=mS(n).join(" \\\n      "),c=`/opt/remi/${s}/root`,u=`/etc/opt/remi/${s}`;return`${i?`FROM almalinux:9 AS ${i}`:"FROM almalinux:9"}
+${v}`)}let y=g.outputs[0],h=Buffer.from(await y.arrayBuffer()),A="index",C=it([{name:`${A}.mjs`,data:h}]);return{zip:C,bundle:h,sha256:Wo(C),handlerFile:A,handlers:{http:s.handlers?.http??`${A}.http`,queue:s.handlers?.queue??`${A}.queue`,cli:s.handlers?.cli??`${A}.cli`},bundleBytes:h.length}}finally{Vi(u,{recursive:!0,force:!0})}}var gS=["18","20","22"];function as(n){if(!n)return"22";let i=String(n).match(/(\d+)/);return i?i[1]:"22"}function ns(n){let i=n.kind??"node";if(i==="php")return{lambdaRuntime:"provided.al2023",kind:"php",version:n.phpVersion??"8.3",usesLayer:!0,layerKind:"php",layerEnvVar:"TSCLOUD_PHP_LAYER_ARN"};if(i==="bun")return{lambdaRuntime:"provided.al2023",kind:"bun",version:n.runtimeVersion??"latest",usesLayer:!0,layerKind:"bun",layerEnvVar:"TSCLOUD_BUN_LAYER_ARN"};let s=as(n.runtimeVersion);if(n.runtime!=="provided.al2023"&&gS.includes(s))return{lambdaRuntime:n.runtime&&n.runtime.startsWith("nodejs")?n.runtime:`nodejs${s}.x`,kind:"node",version:s,usesLayer:!1};return{lambdaRuntime:"provided.al2023",kind:"node",version:s,usesLayer:!0,layerKind:"node",layerEnvVar:"TSCLOUD_NODE_LAYER_ARN"}}function Ar(n,i,s){if(n.queues===!1)return[];if(n.queues===void 0||n.queues===!0)return[{name:`${i}-${s}-default`}];return n.queues.map((o)=>{if(typeof o==="string")return{name:`${i}-${s}-${o}`};let[c,u]=Object.entries(o)[0];return{name:`${i}-${s}-${c}`,concurrency:u}})}function Ml(n,i,s){return Ar(n,i,s).map((o)=>o.name)}function Fl(n){let{app:i,environment:s,handlers:o}=n,c=n.config.project.slug,u=ns(i).lambdaRuntime,d=i.architecture??"x86_64",g=n.config.project.region,y={http:`${c}-${s}-http`,queue:`${c}-${s}-queue`,cli:`${c}-${s}-cli`};if(i.gatewayVersion===1)throw Error("serverless app: `gatewayVersion: 1` (REST API) is not supported — ts-cloud uses API Gateway HTTP API (v2). Remove `gatewayVersion` or set it to 2.");let h=Ar(i,c,s),A=h.map((G)=>G.name),C=A.length>0,v=i.logRetention??14,T=i.packaging==="image";if(T&&i.lambdaInsights)throw Error("serverless app: `lambdaInsights` layer attachment is only supported for zip packaging. Container images must install the Lambda Insights extension in the image.");let R=(i.scheduler??"on")!=="off",P=(i.cache?.driver??"dynamodb")==="dynamodb",I=Boolean(i.assets),M=Xi(c,s),L=i.tmpStorage??512,N={},O={},B=[{PolicyName:"tscloud-serverless-app",PolicyDocument:{Version:"2012-10-17",Statement:[{Effect:"Allow",Action:["logs:CreateLogGroup","logs:CreateLogStream","logs:PutLogEvents"],Resource:e.sub("arn:aws:logs:${AWS::Region}:${AWS::AccountId}:log-group:/aws/lambda/*")},{Effect:"Allow",Action:["lambda:InvokeFunction"],Resource:e.sub(`arn:aws:lambda:\${AWS::Region}:\${AWS::AccountId}:function:${c}-${s}-*`)},{Effect:"Allow",Action:["secretsmanager:GetSecretValue","ssm:GetParameter","ssm:GetParameters","ssm:GetParametersByPath"],Resource:[e.sub(`arn:aws:secretsmanager:\${AWS::Region}:\${AWS::AccountId}:secret:${c}/${s}/*`),e.sub(`arn:aws:ssm:\${AWS::Region}:\${AWS::AccountId}:parameter/${c}/${s}/*`)]},{Effect:"Allow",Action:["s3:GetObject","s3:PutObject","s3:DeleteObject","s3:ListBucket"],Resource:[e.sub(`arn:aws:s3:::${M}`),e.sub(`arn:aws:s3:::${M}/*`),...i.storage?.bucket?[e.sub(`arn:aws:s3:::${i.storage.bucket}`),e.sub(`arn:aws:s3:::${i.storage.bucket}/*`)]:[]]}]}}];if(C)B[0].PolicyDocument.Statement.push({Effect:"Allow",Action:["sqs:SendMessage","sqs:ReceiveMessage","sqs:DeleteMessage","sqs:GetQueueAttributes","sqs:GetQueueUrl"],Resource:e.sub(`arn:aws:sqs:\${AWS::Region}:\${AWS::AccountId}:${c}-${s}-*`)});if(P)B[0].PolicyDocument.Statement.push({Effect:"Allow",Action:["dynamodb:GetItem","dynamodb:PutItem","dynamodb:UpdateItem","dynamodb:DeleteItem","dynamodb:Query","dynamodb:Scan","dynamodb:BatchGetItem","dynamodb:BatchWriteItem"],Resource:e.sub(`arn:aws:dynamodb:\${AWS::Region}:\${AWS::AccountId}:table/${c}-${s}-cache*`)});let F=["arn:aws:iam::aws:policy/service-role/AWSLambdaBasicExecutionRole"];if(i.vpc?.subnets?.length)F.push("arn:aws:iam::aws:policy/service-role/AWSLambdaVPCAccessExecutionRole");if(i.lambdaInsights)F.push("arn:aws:iam::aws:policy/CloudWatchLambdaInsightsExecutionRolePolicy");N.AppRole={Type:"AWS::IAM::Role",Properties:{RoleName:`${c}-${s}-app-role`,AssumeRolePolicyDocument:{Version:"2012-10-17",Statement:[{Effect:"Allow",Principal:{Service:"lambda.amazonaws.com"},Action:"sts:AssumeRole"}]},ManagedPolicyArns:F,Policies:B}};let U=(G)=>({TSCLOUD_LAMBDA_MODE:G,TSCLOUD_ENV:s,...i.octane?{TSCLOUD_OCTANE:"1"}:{},...i.scheduler==="sub-minute"?{TSCLOUD_SCHEDULER:"sub-minute"}:{},...P?{TSCLOUD_CACHE_TABLE:`${c}-${s}-cache`}:{},...C?{TSCLOUD_QUEUE:A[0]}:{},...i.env??{}}),j=Boolean(i.efs),H=typeof i.efs==="object"?i.efs:{},z=H.mountPath??"/mnt/local",se=j&&!H.accessPointArn,ve=H.accessPointArn??(se?e.getAtt("EfsAccessPoint","Arn"):void 0),oe=i.vpc?.subnets??[],pe=oe.length>0,ae=i.cache?.driver==="elasticache"||i.database?.connection==="aurora-serverless"||Boolean(i.rdsProxy)||j;if(ae&&!pe)throw Error("serverless app: elasticache / aurora-serverless / rdsProxy / efs require app.vpc.subnets (private subnets) to be set.");let ce=pe?{VpcConfig:{SubnetIds:oe,SecurityGroupIds:[...i.vpc?.securityGroups??[],...ae?[e.getAtt("DataSecurityGroup","GroupId")]:[]]}}:{},Ie=se?oe.map((G,ne)=>`EfsMountTarget${ne}`):[],Le=j?{FileSystemConfigs:[{Arn:ve,LocalMountPath:z}]}:{};if(j)B[0].PolicyDocument.Statement.push({Effect:"Allow",Action:["elasticfilesystem:ClientMount","elasticfilesystem:ClientWrite","elasticfilesystem:ClientRootAccess","elasticfilesystem:DescribeMountTargets"],Resource:"*"});function he(G,ne,ie,re,fe,ht,Ve,Ne=L){N[`${G}LogGroup`]={Type:"AWS::Logs::LogGroup",Properties:{LogGroupName:`/aws/lambda/${ne}`,RetentionInDays:v}};let Ue=[...n.runtimeLayers??[],...i.lambdaInsights?[i.lambdaInsights.layerArn]:[]],en=T?{PackageType:"Image",Code:{ImageUri:e.ref("ImageUri")},...i.kind==="php"?{}:{ImageConfig:{Command:[ie]}}}:{Runtime:u,Handler:ie,Code:{S3Bucket:e.ref("ArtifactBucket"),S3Key:e.ref("ArtifactKey")},...Ue.length?{Layers:[...new Set(Ue)]}:{}};N[G]={Type:"AWS::Lambda::Function",DependsOn:[`${G}LogGroup`,...Ie],Properties:{FunctionName:ne,Architectures:[d],MemorySize:fe,Timeout:ht,Role:e.getAtt("AppRole","Arn"),Environment:{Variables:U(re)},EphemeralStorage:{Size:Ne},...en,...Ve!==void 0?{ReservedConcurrentExecutions:Ve}:{},...ce,...Le}}}if(he("HttpFunction",y.http,o.http,"http",i.memory??1024,i.timeout??28,i.concurrency,L),he("CliFunction",y.cli,o.cli,"cli",i.cliMemory??1024,i.cliTimeout??900,void 0,i.cliTmpStorage??L),C)he("QueueFunction",y.queue,o.queue,"queue",i.queueMemory??1024,i.queueTimeout??120,void 0,i.queueTmpStorage??L);let ye=(i.provisionedConcurrency??0)>0?i.provisionedConcurrency:0,be=["HttpFunction","CliFunction",...C?["QueueFunction"]:[]];if(ye)for(let G of be)N[`${G}Version`]={Type:"AWS::Lambda::Version",DeletionPolicy:"Retain",Properties:{FunctionName:e.ref(G)}},N[`${G}Alias`]={Type:"AWS::Lambda::Alias",Properties:{FunctionName:e.ref(G),Name:"live",FunctionVersion:e.getAtt(`${G}Version`,"Version"),ProvisionedConcurrencyConfig:{ProvisionedConcurrentExecutions:ye}}};let De=(G)=>ye?e.ref(`${G}Alias`):e.getAtt(G,"Arn"),Se=(G)=>ye?e.ref(`${G}Alias`):e.ref(G);N.HttpApi={Type:"AWS::ApiGatewayV2::Api",Properties:{Name:`${c}-${s}`,ProtocolType:"HTTP"}},N.HttpIntegration={Type:"AWS::ApiGatewayV2::Integration",Properties:{ApiId:e.ref("HttpApi"),IntegrationType:"AWS_PROXY",IntegrationUri:De("HttpFunction"),PayloadFormatVersion:"2.0"}},N.HttpRoute={Type:"AWS::ApiGatewayV2::Route",Properties:{ApiId:e.ref("HttpApi"),RouteKey:"$default",Target:e.join("/",["integrations",e.ref("HttpIntegration")])}},N.HttpStage={Type:"AWS::ApiGatewayV2::Stage",Properties:{ApiId:e.ref("HttpApi"),StageName:"$default",AutoDeploy:!0}},N.HttpPermission={Type:"AWS::Lambda::Permission",Properties:{FunctionName:Se("HttpFunction"),Action:"lambda:InvokeFunction",Principal:"apigateway.amazonaws.com",SourceArn:e.sub("arn:aws:execute-api:${AWS::Region}:${AWS::AccountId}:${HttpApi}/*/*")}},O.HttpApiEndpoint={Description:"HTTP API endpoint",Value:e.getAtt("HttpApi","ApiEndpoint")},O.HttpApiId={Description:"HTTP API id",Value:e.ref("HttpApi")};let Te=(Array.isArray(i.domain)?i.domain:i.domain?[i.domain]:[]).filter(Boolean);if(Te.length){if(!i.certificateArn&&!i.hostedZoneId)throw Error("serverless app: a custom `domain` needs either `certificateArn` (pre-issued, regional) or `hostedZoneId` (to auto-issue + validate an ACM cert).");let G=i.certificateArn;if(!G)N.HttpCertificate={Type:"AWS::CertificateManager::Certificate",Properties:{DomainName:Te[0],...Te.length>1?{SubjectAlternativeNames:Te.slice(1)}:{},ValidationMethod:"DNS",DomainValidationOptions:Te.map((ne)=>({DomainName:ne,HostedZoneId:i.hostedZoneId}))}},G=e.ref("HttpCertificate");Te.forEach((ne,ie)=>{let re=`HttpDomain${ie}`;if(N[re]={Type:"AWS::ApiGatewayV2::DomainName",Properties:{DomainName:ne,DomainNameConfigurations:[{CertificateArn:G,EndpointType:"REGIONAL"}]}},N[`HttpApiMapping${ie}`]={Type:"AWS::ApiGatewayV2::ApiMapping",DependsOn:["HttpStage"],Properties:{ApiId:e.ref("HttpApi"),DomainName:e.ref(re),Stage:"$default"}},i.hostedZoneId)N[`HttpDomainRecord${ie}`]={Type:"AWS::Route53::RecordSet",Properties:{HostedZoneId:i.hostedZoneId,Name:ne,Type:"A",AliasTarget:{DNSName:e.getAtt(re,"RegionalDomainName"),HostedZoneId:e.getAtt(re,"RegionalHostedZoneId")}}};O[`CustomDomain${ie}`]={Description:`Custom domain ${ne}`,Value:ne},O[`CustomDomainTarget${ie}`]={Description:`Point ${ne} (CNAME/alias) at this APIGW regional domain`,Value:e.getAtt(re,"RegionalDomainName")}})}if(C)N.AppQueueDlq={Type:"AWS::SQS::Queue",Properties:{QueueName:`${c}-${s}-dlq`,MessageRetentionPeriod:1209600}},h.forEach((G,ne)=>{let ie=`AppQueue${ne}`,re=i.queueTimeout??120;N[ie]={Type:"AWS::SQS::Queue",Properties:{QueueName:G.name,VisibilityTimeout:Math.min(43200,re*6),RedrivePolicy:{deadLetterTargetArn:e.getAtt("AppQueueDlq","Arn"),maxReceiveCount:i.queueTries??3}}};let fe=G.concurrency??i.queueConcurrency;N[`${ie}Mapping`]={Type:"AWS::Lambda::EventSourceMapping",Properties:{EventSourceArn:e.getAtt(ie,"Arn"),FunctionName:Se("QueueFunction"),BatchSize:1,FunctionResponseTypes:["ReportBatchItemFailures"],...fe?{ScalingConfig:{MaximumConcurrency:Math.max(2,fe)}}:{}}},O[`QueueUrl${ne}`]={Description:`Queue URL: ${G.name}`,Value:e.ref(ie)}});if(R)N.SchedulerRule={Type:"AWS::Events::Rule",Properties:{Name:`${c}-${s}-scheduler`,ScheduleExpression:"rate(1 minute)",State:"ENABLED",Targets:[{Id:"cli",Arn:De("CliFunction"),Input:JSON.stringify({command:"schedule:run"})}]}},N.SchedulerPermission={Type:"AWS::Lambda::Permission",Properties:{FunctionName:Se("CliFunction"),Action:"lambda:InvokeFunction",Principal:"events.amazonaws.com",SourceArn:e.getAtt("SchedulerRule","Arn")}};if(i.warm&&i.warm>0){let ne={http:"HttpFunction",queue:"QueueFunction",cli:"CliFunction"},ie=(i.warmFunctions??["http"]).filter((re)=>re!=="queue"||C);for(let re of ie){let fe=re.charAt(0).toUpperCase()+re.slice(1),ht=Math.ceil(i.warm/5),Ve=0;for(let Ne=0;Ne<ht;Ne++){let Ue=Math.min(5,i.warm-Ve);N[`Warmer${fe}Rule${Ne}`]={Type:"AWS::Events::Rule",Properties:{Name:`${c}-${s}-warmer-${re}-${Ne}`,ScheduleExpression:"rate(5 minutes)",State:"ENABLED",Targets:Array.from({length:Ue},(en,sr)=>({Id:`warm-${re}-${Ne}-${sr}`,Arn:e.getAtt(ne[re],"Arn"),Input:JSON.stringify({warmer:!0})}))}},Ve+=Ue}N[`Warmer${fe}Permission`]={Type:"AWS::Lambda::Permission",Properties:{FunctionName:e.ref(ne[re]),Action:"lambda:InvokeFunction",Principal:"events.amazonaws.com",SourceArn:e.sub(`arn:aws:events:\${AWS::Region}:\${AWS::AccountId}:rule/${c}-${s}-warmer-${re}-*`)}}}}if(P)N.CacheTable={Type:"AWS::DynamoDB::Table",Properties:{TableName:`${c}-${s}-cache`,BillingMode:"PAY_PER_REQUEST",AttributeDefinitions:[{AttributeName:"key",AttributeType:"S"}],KeySchema:[{AttributeName:"key",KeyType:"HASH"}],TimeToLiveSpecification:{AttributeName:"expires_at",Enabled:!0}}},O.CacheTableName={Description:"DynamoDB cache table",Value:e.ref("CacheTable")};if(I){if(N.AssetsBucket={Type:"AWS::S3::Bucket",Properties:{BucketName:M,PublicAccessBlockConfiguration:{BlockPublicAcls:!0,BlockPublicPolicy:!0,IgnorePublicAcls:!0,RestrictPublicBuckets:!0}}},N.AssetsOAC={Type:"AWS::CloudFront::OriginAccessControl",Properties:{OriginAccessControlConfig:{Name:`${c}-${s}-assets-oac`,OriginAccessControlOriginType:"s3",SigningBehavior:"always",SigningProtocol:"sigv4"}}},N.AssetsDistribution={Type:"AWS::CloudFront::Distribution",Properties:{DistributionConfig:{Enabled:!0,DefaultCacheBehavior:{TargetOriginId:"assets",ViewerProtocolPolicy:"redirect-to-https",Compress:!0,CachePolicyId:"658327ea-f89d-4fab-a63d-7e88639e58f6"},Origins:[{Id:"assets",DomainName:e.getAtt("AssetsBucket","RegionalDomainName"),OriginAccessControlId:e.ref("AssetsOAC"),S3OriginConfig:{OriginAccessIdentity:""}}],...i.assetDomain?{Aliases:[i.assetDomain],ViewerCertificate:{AcmCertificateArn:i.assetCertificateArn??e.ref("AssetsCertificate"),SslSupportMethod:"sni-only",MinimumProtocolVersion:"TLSv1.2_2021"}}:{}}}},i.assetDomain){if(!i.assetCertificateArn){if(!i.hostedZoneId)throw Error("serverless app: `assetDomain` requires either `assetCertificateArn` (a us-east-1 ACM cert) or `hostedZoneId` (to auto-issue + validate one). CloudFront only accepts certs from us-east-1.");if(g!=="us-east-1")throw Error(`serverless app: auto-issuing an asset-domain cert needs a us-east-1 app (CloudFront certs must be us-east-1); this app is in ${g}. Supply a pre-issued us-east-1 \`assetCertificateArn\` instead.`);N.AssetsCertificate={Type:"AWS::CertificateManager::Certificate",Properties:{DomainName:i.assetDomain,ValidationMethod:"DNS",DomainValidationOptions:[{DomainName:i.assetDomain,HostedZoneId:i.hostedZoneId}]}}}if(i.hostedZoneId)N.AssetsDomainRecord={Type:"AWS::Route53::RecordSet",Properties:{HostedZoneId:i.hostedZoneId,Name:i.assetDomain,Type:"A",AliasTarget:{DNSName:e.getAtt("AssetsDistribution","DomainName"),HostedZoneId:"Z2FDTNDATAQYW2"}}};O.AssetDomain={Description:"Custom asset CDN host",Value:i.assetDomain}}N.AssetsBucketPolicy={Type:"AWS::S3::BucketPolicy",Properties:{Bucket:e.ref("AssetsBucket"),PolicyDocument:{Version:"2012-10-17",Statement:[{Effect:"Allow",Principal:{Service:"cloudfront.amazonaws.com"},Action:"s3:GetObject",Resource:e.sub(`arn:aws:s3:::${M}/*`),Condition:{StringEquals:{"AWS:SourceArn":e.sub("arn:aws:cloudfront::${AWS::AccountId}:distribution/${AssetsDistribution}")}}}]}}},O.AssetsBucketName={Description:"Assets bucket",Value:e.ref("AssetsBucket")},O.AssetsCdnDomain={Description:"Assets CloudFront domain",Value:e.getAtt("AssetsDistribution","DomainName")}}if(i.firewall?.enabled){let G=[],ne=0;if(i.firewall.rateLimit)G.push({Name:"rate-limit",Priority:ne++,Action:{Block:{}},Statement:{RateBasedStatement:{Limit:i.firewall.rateLimit,AggregateKeyType:"IP"}},VisibilityConfig:{SampledRequestsEnabled:!0,CloudWatchMetricsEnabled:!0,MetricName:`${c}-${s}-rate`}});let ie={sqlInjection:"AWSManagedRulesSQLiRuleSet",xss:"AWSManagedRulesCommonRuleSet",common:"AWSManagedRulesCommonRuleSet",botControl:"AWSManagedRulesBotControlRuleSet",ipReputation:"AWSManagedRulesAmazonIpReputationList"};for(let re of i.firewall.rules??[]){let fe=ie[re];if(!fe)continue;G.push({Name:`managed-${re}`,Priority:ne++,OverrideAction:{None:{}},Statement:{ManagedRuleGroupStatement:{VendorName:"AWS",Name:fe}},VisibilityConfig:{SampledRequestsEnabled:!0,CloudWatchMetricsEnabled:!0,MetricName:`${c}-${s}-${re}`}})}N.WebAcl={Type:"AWS::WAFv2::WebACL",Properties:{Name:`${c}-${s}-waf`,Scope:"REGIONAL",DefaultAction:{Allow:{}},Rules:G,VisibilityConfig:{SampledRequestsEnabled:!0,CloudWatchMetricsEnabled:!0,MetricName:`${c}-${s}-waf`}}},O.WafAclArn={Description:"WAF web ACL ARN. Attach to a CloudFront distribution fronting the API to enforce (HTTP API v2 stages do not support direct WAF association).",Value:e.getAtt("WebAcl","Arn")}}if(pe&&ae){if(!i.vpc?.id)throw Error("serverless app: data services (elasticache / aurora-serverless / rdsProxy / efs) need app.vpc.id (the VPC id) so the managed security group is created in the right VPC.");N.DataSecurityGroup={Type:"AWS::EC2::SecurityGroup",Properties:{VpcId:i.vpc.id,GroupDescription:`${c}-${s} serverless data access`,SecurityGroupIngress:[{IpProtocol:"-1",CidrIp:"10.0.0.0/8"}]}}}if(se)N.EfsFileSystem={Type:"AWS::EFS::FileSystem",Properties:{Encrypted:!0,FileSystemTags:[{Key:"Name",Value:`${c}-${s}-efs`}]}},oe.forEach((G,ne)=>{N[`EfsMountTarget${ne}`]={Type:"AWS::EFS::MountTarget",Properties:{FileSystemId:e.ref("EfsFileSystem"),SubnetId:G,SecurityGroups:[e.getAtt("DataSecurityGroup","GroupId")]}}}),N.EfsAccessPoint={Type:"AWS::EFS::AccessPoint",Properties:{FileSystemId:e.ref("EfsFileSystem"),PosixUser:{Uid:1001,Gid:1001},RootDirectory:{Path:"/lambda",CreationInfo:{OwnerUid:1001,OwnerGid:1001,Permissions:"0755"}}}},O.EfsFileSystemId={Description:"EFS file system id",Value:e.ref("EfsFileSystem")};if(i.cache?.driver==="elasticache")N.CacheSubnetGroup={Type:"AWS::ElastiCache::SubnetGroup",Properties:{Description:`${c}-${s} cache subnets`,SubnetIds:oe}},N.CacheCluster={Type:"AWS::ElastiCache::ReplicationGroup",Properties:{ReplicationGroupId:`${c}-${s}-cache`,ReplicationGroupDescription:`${c}-${s} redis`,Engine:"redis",CacheNodeType:"cache.t4g.micro",NumCacheClusters:1,AutomaticFailoverEnabled:!1,CacheSubnetGroupName:e.ref("CacheSubnetGroup"),SecurityGroupIds:[e.getAtt("DataSecurityGroup","GroupId")],TransitEncryptionEnabled:!1}},O.CacheEndpoint={Description:"Redis primary endpoint",Value:e.getAtt("CacheCluster","PrimaryEndPoint.Address")};if(i.database?.connection==="aurora-serverless")N.DbSubnetGroup={Type:"AWS::RDS::DBSubnetGroup",Properties:{DBSubnetGroupDescription:`${c}-${s} db subnets`,SubnetIds:oe}},N.DbSecret={Type:"AWS::SecretsManager::Secret",Properties:{Name:`${c}/${s}/db`,GenerateSecretString:{SecretStringTemplate:JSON.stringify({username:"app"}),GenerateStringKey:"password",PasswordLength:32,ExcludePunctuation:!0}}},N.DbCluster={Type:"AWS::RDS::DBCluster",Properties:{Engine:"aurora-mysql",EngineMode:"provisioned",DBClusterIdentifier:`${c}-${s}-db`,DatabaseName:"app",MasterUsername:e.sub("{{resolve:secretsmanager:${DbSecret}:SecretString:username}}"),MasterUserPassword:e.sub("{{resolve:secretsmanager:${DbSecret}:SecretString:password}}"),ServerlessV2ScalingConfiguration:{MinCapacity:i.database?.minCapacity??0.5,MaxCapacity:i.database?.maxCapacity??4},DBSubnetGroupName:e.ref("DbSubnetGroup"),VpcSecurityGroupIds:[e.getAtt("DataSecurityGroup","GroupId")]}},N.DbInstance={Type:"AWS::RDS::DBInstance",Properties:{Engine:"aurora-mysql",DBInstanceClass:"db.serverless",DBClusterIdentifier:e.ref("DbCluster")}},O.DbEndpoint={Description:"Aurora cluster endpoint",Value:e.getAtt("DbCluster","Endpoint.Address")};if(i.rdsProxy&&i.database?.connection==="aurora-serverless")N.DbProxyRole={Type:"AWS::IAM::Role",Properties:{AssumeRolePolicyDocument:{Version:"2012-10-17",Statement:[{Effect:"Allow",Principal:{Service:"rds.amazonaws.com"},Action:"sts:AssumeRole"}]},Policies:[{PolicyName:"read-db-secret",PolicyDocument:{Version:"2012-10-17",Statement:[{Effect:"Allow",Action:["secretsmanager:GetSecretValue"],Resource:e.ref("DbSecret")}]}}]}},N.DbProxy={Type:"AWS::RDS::DBProxy",Properties:{DBProxyName:typeof i.rdsProxy==="object"&&i.rdsProxy.name?i.rdsProxy.name:`${c}-${s}-proxy`,EngineFamily:"MYSQL",RoleArn:e.getAtt("DbProxyRole","Arn"),Auth:[{AuthScheme:"SECRETS",SecretArn:e.ref("DbSecret"),IAMAuth:"DISABLED"}],VpcSubnetIds:oe,VpcSecurityGroupIds:[e.getAtt("DataSecurityGroup","GroupId")],RequireTLS:!1}},N.DbProxyTargetGroup={Type:"AWS::RDS::DBProxyTargetGroup",DependsOn:["DbInstance"],Properties:{DBProxyName:e.ref("DbProxy"),TargetGroupName:"default",DBClusterIdentifiers:[e.ref("DbCluster")]}},O.DbProxyEndpoint={Description:"RDS Proxy endpoint",Value:e.getAtt("DbProxy","Endpoint")};if(O.HttpFunctionName={Description:"HTTP function name",Value:e.ref("HttpFunction")},O.CliFunctionName={Description:"CLI function name",Value:e.ref("CliFunction")},C)O.QueueFunctionName={Description:"Queue function name",Value:e.ref("QueueFunction")};let $e={AWSTemplateFormatVersion:"2010-09-09",Description:`Serverless application for ${n.config.project.name} (${c}-${s})`,Parameters:T?{ImageUri:{Type:"String",Description:"ECR image URI of the deployment artifact"}}:{ArtifactBucket:{Type:"String",Description:"S3 bucket holding the deployment artifact"},ArtifactKey:{Type:"String",Description:"S3 key of the deployment artifact (zip)"}},Resources:N,Outputs:O},We={};for(let G of Object.values(N))We[G.Type]=(We[G.Type]??0)+1;return{template:$e,functionNames:y,queueNames:A,resourceSummary:We}}var pS=["cli","fpm","curl","mbstring","xml","pdo","mysqlnd","gd","bcmath","intl","opcache","sodium","process","pecl-redis6","pecl-apcu","pgsql"];function mS(n){let i=`php${n.replace(".","")}`;return pS.map((s)=>`${i}-php-${s}`)}function Ul(n,i){let s=`php${n.replace(".","")}`,o=mS(n).join(" \\\n      "),c=`/opt/remi/${s}/root`,u=`/etc/opt/remi/${s}`;return`${i?`FROM almalinux:9 AS ${i}`:"FROM almalinux:9"}
 
 # Build PHP on AlmaLinux 9 (where Remi's version-isolated SCL packages install
 # cleanly — Remi's release RPM rejects Amazon Linux 2023). AlmaLinux 9 shares
@@ -7299,7 +7299,7 @@ COPY app/ \${LAMBDA_TASK_ROOT}/
 
 # Per-function CMD (e.g. index.http) is supplied via ImageConfig.Command.
 CMD [ "index.http" ]
-`}import{execFileSync as pt}from"node:child_process";import{mkdtempSync as jn,readFileSync as gt,rmSync as Kn}from"node:fs";import{tmpdir as qn}from"node:os";import{dirname as os,join as we}from"node:path";import{fileURLToPath as cs}from"node:url";function zn(){return os(cs(import.meta.url))}function xf(){return gt(we(zn(),"runtime.mjs"),"utf-8")}function Qn(n){return gt(we(zn(),`${n}-bootstrap`),"utf-8")}function PE(n){let i=n.architecture??"x86_64",s=i==="arm64"?"arm64":"x64",o=n.version.replace(/^v/,""),c=n.onStep??(()=>{}),u=jn(we(qn(),"tscloud-node-layer-"));try{let d=o.includes(".")?o:ls(o),g=`node-v${d}-linux-${s}`,y=`https://nodejs.org/dist/v${d}/${g}.tar.xz`;c(`downloading Node ${d} (${i})`);let h=we(u,"node.tar.xz");Jn(y,h),c("extracting node binary"),pt("tar",["-xf",h,"-C",u,`${g}/bin/node`],{stdio:"inherit"});let A=gt(we(u,g,"bin","node"));c("packaging layer");let C=[{name:"bootstrap",data:Qn("node"),mode:493},{name:"runtime.mjs",data:xf(),mode:420},{name:"bin/node",data:A,mode:493}];return{zip:it(C),architecture:i,version:d,fileCount:C.length}}finally{Kn(u,{recursive:!0,force:!0})}}function kE(n){let i=n.architecture??"x86_64",s=i==="arm64"?"bun-linux-aarch64":"bun-linux-x64",o=n.version==="latest"?"":n.version.replace(/^v/,""),c=n.onStep??(()=>{}),u=jn(we(qn(),"tscloud-bun-layer-"));try{let d=o?`https://github.com/oven-sh/bun/releases/download/bun-v${o}/${s}.zip`:`https://github.com/oven-sh/bun/releases/latest/download/${s}.zip`;c(`downloading Bun ${o||"latest"} (${i})`);let g=we(u,"bun.zip");Jn(d,g),c("extracting bun binary"),pt("unzip",["-o","-q",g,"-d",u],{stdio:"inherit"});let y=gt(we(u,s,"bun"));c("packaging layer");let h=[{name:"bootstrap",data:Qn("bun"),mode:493},{name:"runtime.mjs",data:xf(),mode:420},{name:"bin/bun",data:y,mode:493}];return{zip:it(h),architecture:i,version:o||"latest",fileCount:h.length}}finally{Kn(u,{recursive:!0,force:!0})}}function Jn(n,i){pt("curl",["-fsSL","-o",i,n],{stdio:["ignore","ignore","inherit"]})}function ls(n){let i=pt("curl",["-fsSL","https://nodejs.org/dist/index.json"],{encoding:"utf-8"}),o=JSON.parse(i).find((c)=>c.version.startsWith(`v${n}.`));if(!o)throw Error(`No Node release found for major version ${n}`);return o.version.replace(/^v/,"")}import{AsyncLocalStorage as ds}from"node:async_hooks";import{createHash as us}from"node:crypto";var Jo="x-ts-cloud-invoke-depth",Xo="x-ts-cloud-invoke-chain",Yo="x-ts-cloud-trace-id";function Hl(n){return us("sha256").update(n).digest("hex").slice(0,8)}var fn={maxDepth:10,maxRepeats:3,maxInvocationsPerTrace:100,traceWindowMs:60000,breakerThreshold:5,breakerCooldownMs:60000};function Yt(n,i){if(typeof n.get==="function")return n.get(i)??void 0;let s=n;return s[i]??s[i.toLowerCase()]??s[i.toUpperCase()]}function Gl(n,i=64){if(!n)return[];return n.split(".").map((s)=>s.trim()).filter((s)=>/^[0-9a-f]{8}$/.test(s)).slice(-i)}function Vl(n,i=fn){let s=Hl(n.functionId),o=Gl(Yt(n.headers,Xo)),c=n.traceId??Yt(n.headers,Yo)??crypto.randomUUID(),u=[...o,s],d=o.filter((C)=>C===s).length,g=o[o.length-1]===s,y=Number.parseInt(Yt(n.headers,Jo)??"",10),h=Math.max(u.length,Number.isFinite(y)?y+1:0),A="ok";if(h>i.maxDepth)A="depth_exceeded";else if(d>=i.maxRepeats)A="cycle_detected";else if(g&&i.maxRepeats<=1)A="self_invocation";return{reason:A,depth:h,chain:u,traceId:c,selfInvocation:g,repeats:d,propagate:{[Jo]:String(h),[Xo]:u.join("."),[Yo]:c}}}var Yn={ok:"",depth_exceeded:"Invocation chain is deeper than the configured limit; the call was refused to stop a runaway loop.",cycle_detected:"This function already appears in the invocation chain; the call was refused as a recursion loop.",self_invocation:"This function invoked itself directly; the call was refused.",trace_budget_exceeded:"This request has already made more invocations than its budget allows.",breaker_open:"Recursion protection is open for this function after repeated loop detections."};class is{limits;clock;traces=new Map;breakers=new Map;constructor(n=fn,i=()=>Date.now()){this.limits=n;this.clock=i}check(n){let i=this.clock();this.expireTraces(i);let s=Vl(n,this.limits),o=this.breakers.get(n.functionId);if(o?.openUntil!=null&&o.openUntil>i)return this.deny(n.functionId,s,"breaker_open",i,!1);if(s.reason!=="ok")return this.deny(n.functionId,s,s.reason,i,!0);let c=this.traces.get(s.traceId)??{count:0,firstAt:i};if(c.count>=this.limits.maxInvocationsPerTrace)return this.traces.set(s.traceId,c),this.deny(n.functionId,s,"trace_budget_exceeded",i,!0);if(this.traces.set(s.traceId,{count:c.count+1,firstAt:c.firstAt}),o)this.breakers.set(n.functionId,{consecutiveBlocks:0});return{...s,allowed:!0,reason:"ok",propagate:s.propagate}}deny(n,i,s,o,c){if(c){let u=this.breakers.get(n)??{consecutiveBlocks:0},d=u.consecutiveBlocks+1;this.breakers.set(n,{consecutiveBlocks:d,openUntil:d>=this.limits.breakerThreshold?o+this.limits.breakerCooldownMs:u.openUntil})}return{...i,allowed:!1,reason:s,message:Yn[s]}}breakerOpen(n){let i=this.breakers.get(n);return i?.openUntil!=null&&i.openUntil>this.clock()}reset(n){if(n){this.breakers.delete(n);return}this.breakers.clear(),this.traces.clear()}expireTraces(n){if(this.traces.size===0)return;for(let[i,s]of this.traces)if(n-s.firstAt>this.limits.traceWindowMs)this.traces.delete(i)}get trackedTraces(){return this.traces.size}}function Zo(n){return{...n.propagate}}function ea(n){return{status:508,headers:{"content-type":"application/json","x-ts-cloud-recursion-blocked":n.reason},body:{error:"recursion_blocked",reason:n.reason,message:n.message??Yn[n.reason],depth:n.depth,traceId:n.traceId}}}var Of=new ds;function Zn(n){let i=globalThis.process?.env?.[n];if(i==null||i==="")return;return i!=="0"&&i.toLowerCase()!=="false"}function ms(){let n=globalThis.process?.env??{};return n.TS_CLOUD_FUNCTION_ID||n.AWS_LAMBDA_FUNCTION_NAME||n.FUNCTION_NAME||"function"}function fS(n){let i=n===!1?{enabled:!1}:n??{},s=Zn("TS_CLOUD_RECURSION_PROTECTION"),o=Zn("TS_CLOUD_RECURSION_DETECTION_ONLY");return{enabled:s??i.enabled??!0,detectionOnly:o??i.detectionOnly??!1,limits:{...fn,...i.limits},functionId:i.functionId??ms()}}var Me,ve;function hS(){let n=globalThis.fetch;if(!n||Me===n)return()=>{};ve=n;let i=async(s,o)=>{let c=Of.getStore();if(!c)return ve(s,o);let u=new Headers(o?.headers??(s instanceof Request?s.headers:void 0));for(let[d,g]of Object.entries(Zo(c)))u.set(d,g);if(s instanceof Request)return ve(new Request(s,{headers:u}),o);return ve(s,{...o,headers:u})};return Object.assign(i,n),globalThis.fetch=i,Me=i,()=>{if(globalThis.fetch===Me&&ve)globalThis.fetch=ve;Me=void 0}}var yt,Zt;function AS(n){if(!yt||JSON.stringify(Zt)!==JSON.stringify(n))yt=new is(n),Zt=n;return yt}function NE(){if(yt=void 0,Zt=void 0,Me&&ve&&globalThis.fetch===Me)globalThis.fetch=ve;Me=void 0,ve=void 0}function _f(n,i){let s=fS(i);if(!s.enabled)return;let o=AS(s.limits),c={functionId:s.functionId,headers:n},u=o.check(c);return{verdict:u,blocked:!u.allowed&&!s.detectionOnly,observed:!u.allowed&&s.detectionOnly}}function Lf(n,i){return hS(),Of.run(n,i)}function BE(n){let i=n,s=i?.default??i;if(typeof s==="function")return{fetch:s};return{fetch:s?.fetch??i?.fetch,queue:s?.queue??i?.queue,cli:s?.cli??i?.cli}}var ps=/^(?:text\/|application\/(?:json|xml|javascript|graphql|x-www-form-urlencoded|.*\+json|.*\+xml)|image\/svg)/i;function gs(n){if(!n)return!0;return ps.test(n)}function ys(n){if(n?.maintenance)return n.maintenance;let i=globalThis.process?.env??{};return{enabled:i.MAINTENANCE_MODE==="1"||i.MAINTENANCE_MODE==="true",bypassSecret:i.MAINTENANCE_BYPASS_SECRET}}function yS(n){let i=n.requestContext?.domainName??"localhost",s=n.rawQueryString?`?${n.rawQueryString}`:"",o=`https://${i}${n.rawPath||"/"}${s}`,c=new Headers;for(let[g,y]of Object.entries(n.headers??{}))if(y!==void 0)c.set(g,y);if(n.cookies?.length)c.set("cookie",n.cookies.join("; "));let u=n.requestContext.http.method,d;if(n.body!==void 0&&u!=="GET"&&u!=="HEAD")d=n.isBase64Encoded?new Uint8Array(Buffer.from(n.body,"base64")):new TextEncoder().encode(n.body);return new Request(o,{method:u,headers:c,body:d})}async function $f(n){let i={},s=[],o=typeof n.headers.getSetCookie==="function"?n.headers.getSetCookie():[];for(let d of o)s.push(d);n.headers.forEach((d,g)=>{if(g.toLowerCase()==="set-cookie")return;i[g]=d});let c=Buffer.from(await n.arrayBuffer()),u=gs(n.headers.get("content-type"));return{statusCode:n.status,headers:i,...s.length?{cookies:s}:{},body:u?c.toString("utf-8"):c.toString("base64"),isBase64Encoded:!u}}function SS(n,i){return async(s)=>{if(s.warmer)return{statusCode:200,headers:{"content-type":"text/plain"},body:"warm",isBase64Encoded:!1};if(!n)return{statusCode:501,headers:{"content-type":"text/plain"},body:"No HTTP handler configured",isBase64Encoded:!1};let o=ys(i);if(o.enabled){let d=s.headers?.["x-maintenance-bypass"]??s.cookies?.find((g)=>g.startsWith("tscloud_bypass="))?.split("=")[1];if(!o.bypassSecret||d!==o.bypassSecret)return{statusCode:503,headers:{"content-type":"text/plain","retry-after":"120"},body:"Service temporarily unavailable (maintenance mode)",isBase64Encoded:!1}}let c=_f(s.headers??{},i?.recursionProtection);if(c?.blocked){let d=ea(c.verdict);return{statusCode:d.status,headers:{...d.headers,"retry-after":"60"},body:JSON.stringify(d.body),isBase64Encoded:!1}}let u=yS(s);if(!c){let d=await n(u);return $f(d)}if(c.observed)console.warn(`[ts-cloud] recursion detected (${c.verdict.reason}) at depth ${c.verdict.depth}; detection-only mode let it run`);return Lf(c.verdict,async()=>$f(await n(u)))}}function fs(n){try{return JSON.parse(n)}catch{return n}}function IS(n){return async(i)=>{let s=[];if(i.warmer)return{batchItemFailures:s};if(!n)return{batchItemFailures:s};for(let o of i.Records??[])try{await n(fs(o.body),o)}catch{s.push({itemIdentifier:o.messageId})}return{batchItemFailures:s}}}function bS(n){return async(i)=>{if(i.warmer)return{statusCode:0,output:"warm"};if(!n)return{statusCode:501,output:"No CLI handler configured"};return n(i)}}function xE(n,i){return{http:SS(n.fetch,i),queue:IS(n.queue),cli:bS(n.cli)}}function Mf(n={}){let i=n.socketPath??"/tmp/.tscloud-fpm.sock",s=n.maxChildren??1;return`; ts-cloud php-fpm configuration (generated) — AWS Lambda custom runtime.
+`}import{execFileSync as pt}from"node:child_process";import{mkdtempSync as jn,readFileSync as gt,rmSync as Kn}from"node:fs";import{tmpdir as qn}from"node:os";import{dirname as os,join as we}from"node:path";import{fileURLToPath as cs}from"node:url";function zn(){return os(cs(import.meta.url))}function xf(){return gt(we(zn(),"runtime.mjs"),"utf-8")}function Qn(n){return gt(we(zn(),`${n}-bootstrap`),"utf-8")}function PE(n){let i=n.architecture??"x86_64",s=i==="arm64"?"arm64":"x64",o=n.version.replace(/^v/,""),c=n.onStep??(()=>{}),u=jn(we(qn(),"tscloud-node-layer-"));try{let d=o.includes(".")?o:ls(o),g=`node-v${d}-linux-${s}`,y=`https://nodejs.org/dist/v${d}/${g}.tar.xz`;c(`downloading Node ${d} (${i})`);let h=we(u,"node.tar.xz");Jn(y,h),c("extracting node binary"),pt("tar",["-xf",h,"-C",u,`${g}/bin/node`],{stdio:"inherit"});let A=gt(we(u,g,"bin","node"));c("packaging layer");let C=[{name:"bootstrap",data:Qn("node"),mode:493},{name:"runtime.mjs",data:xf(),mode:420},{name:"bin/node",data:A,mode:493}];return{zip:it(C),architecture:i,version:d,fileCount:C.length}}finally{Kn(u,{recursive:!0,force:!0})}}function kE(n){let i=n.architecture??"x86_64",s=i==="arm64"?"bun-linux-aarch64":"bun-linux-x64",o=n.version==="latest"?"":n.version.replace(/^v/,""),c=n.onStep??(()=>{}),u=jn(we(qn(),"tscloud-bun-layer-"));try{let d=o?`https://github.com/oven-sh/bun/releases/download/bun-v${o}/${s}.zip`:`https://github.com/oven-sh/bun/releases/latest/download/${s}.zip`;c(`downloading Bun ${o||"latest"} (${i})`);let g=we(u,"bun.zip");Jn(d,g),c("extracting bun binary"),pt("unzip",["-o","-q",g,"-d",u],{stdio:"inherit"});let y=gt(we(u,s,"bun"));c("packaging layer");let h=[{name:"bootstrap",data:Qn("bun"),mode:493},{name:"runtime.mjs",data:xf(),mode:420},{name:"bin/bun",data:y,mode:493}];return{zip:it(h),architecture:i,version:o||"latest",fileCount:h.length}}finally{Kn(u,{recursive:!0,force:!0})}}function Jn(n,i){pt("curl",["-fsSL","-o",i,n],{stdio:["ignore","ignore","inherit"]})}function ls(n){let i=pt("curl",["-fsSL","https://nodejs.org/dist/index.json"],{encoding:"utf-8"}),o=JSON.parse(i).find((c)=>c.version.startsWith(`v${n}.`));if(!o)throw Error(`No Node release found for major version ${n}`);return o.version.replace(/^v/,"")}import{AsyncLocalStorage as ds}from"node:async_hooks";import{createHash as us}from"node:crypto";var Jo="x-ts-cloud-invoke-depth",Xo="x-ts-cloud-invoke-chain",Yo="x-ts-cloud-trace-id";function Hl(n){return us("sha256").update(n).digest("hex").slice(0,8)}var fn={maxDepth:10,maxRepeats:3,maxInvocationsPerTrace:100,traceWindowMs:60000,breakerThreshold:5,breakerCooldownMs:60000};function Yt(n,i){if(typeof n.get==="function")return n.get(i)??void 0;let s=n;return s[i]??s[i.toLowerCase()]??s[i.toUpperCase()]}function Gl(n,i=64){if(!n)return[];return n.split(".").map((s)=>s.trim()).filter((s)=>/^[0-9a-f]{8}$/.test(s)).slice(-i)}function Vl(n,i=fn){let s=Hl(n.functionId),o=Gl(Yt(n.headers,Xo)),c=n.traceId??Yt(n.headers,Yo)??crypto.randomUUID(),u=[...o,s],d=o.filter((C)=>C===s).length,g=o[o.length-1]===s,y=Number.parseInt(Yt(n.headers,Jo)??"",10),h=Math.max(u.length,Number.isFinite(y)?y+1:0),A="ok";if(h>i.maxDepth)A="depth_exceeded";else if(d>=i.maxRepeats)A="cycle_detected";else if(g&&i.maxRepeats<=1)A="self_invocation";return{reason:A,depth:h,chain:u,traceId:c,selfInvocation:g,repeats:d,propagate:{[Jo]:String(h),[Xo]:u.join("."),[Yo]:c}}}var Yn={ok:"",depth_exceeded:"Invocation chain is deeper than the configured limit; the call was refused to stop a runaway loop.",cycle_detected:"This function already appears in the invocation chain; the call was refused as a recursion loop.",self_invocation:"This function invoked itself directly; the call was refused.",trace_budget_exceeded:"This request has already made more invocations than its budget allows.",breaker_open:"Recursion protection is open for this function after repeated loop detections."};class is{limits;clock;traces=new Map;breakers=new Map;constructor(n=fn,i=()=>Date.now()){this.limits=n;this.clock=i}check(n){let i=this.clock();this.expireTraces(i);let s=Vl(n,this.limits),o=this.breakers.get(n.functionId);if(o?.openUntil!=null&&o.openUntil>i)return this.deny(n.functionId,s,"breaker_open",i,!1);if(s.reason!=="ok")return this.deny(n.functionId,s,s.reason,i,!0);let c=this.traces.get(s.traceId)??{count:0,firstAt:i};if(c.count>=this.limits.maxInvocationsPerTrace)return this.traces.set(s.traceId,c),this.deny(n.functionId,s,"trace_budget_exceeded",i,!0);if(this.traces.set(s.traceId,{count:c.count+1,firstAt:c.firstAt}),o)this.breakers.set(n.functionId,{consecutiveBlocks:0});return{...s,allowed:!0,reason:"ok",propagate:s.propagate}}deny(n,i,s,o,c){if(c){let u=this.breakers.get(n)??{consecutiveBlocks:0},d=u.consecutiveBlocks+1;this.breakers.set(n,{consecutiveBlocks:d,openUntil:d>=this.limits.breakerThreshold?o+this.limits.breakerCooldownMs:u.openUntil})}return{...i,allowed:!1,reason:s,message:Yn[s]}}breakerOpen(n){let i=this.breakers.get(n);return i?.openUntil!=null&&i.openUntil>this.clock()}reset(n){if(n){this.breakers.delete(n);return}this.breakers.clear(),this.traces.clear()}expireTraces(n){if(this.traces.size===0)return;for(let[i,s]of this.traces)if(n-s.firstAt>this.limits.traceWindowMs)this.traces.delete(i)}get trackedTraces(){return this.traces.size}}function Zo(n){return{...n.propagate}}function ea(n){return{status:508,headers:{"content-type":"application/json","x-ts-cloud-recursion-blocked":n.reason},body:{error:"recursion_blocked",reason:n.reason,message:n.message??Yn[n.reason],depth:n.depth,traceId:n.traceId}}}var Of=new ds;function Zn(n){let i=globalThis.process?.env?.[n];if(i==null||i==="")return;return i!=="0"&&i.toLowerCase()!=="false"}function ms(){let n=globalThis.process?.env??{};return n.TS_CLOUD_FUNCTION_ID||n.AWS_LAMBDA_FUNCTION_NAME||n.FUNCTION_NAME||"function"}function fS(n){let i=n===!1?{enabled:!1}:n??{},s=Zn("TS_CLOUD_RECURSION_PROTECTION"),o=Zn("TS_CLOUD_RECURSION_DETECTION_ONLY");return{enabled:s??i.enabled??!0,detectionOnly:o??i.detectionOnly??!1,limits:{...fn,...i.limits},functionId:i.functionId??ms()}}var Me,Ce;function hS(){let n=globalThis.fetch;if(!n||Me===n)return()=>{};Ce=n;let i=async(s,o)=>{let c=Of.getStore();if(!c)return Ce(s,o);let u=new Headers(o?.headers??(s instanceof Request?s.headers:void 0));for(let[d,g]of Object.entries(Zo(c)))u.set(d,g);if(s instanceof Request)return Ce(new Request(s,{headers:u}),o);return Ce(s,{...o,headers:u})};return Object.assign(i,n),globalThis.fetch=i,Me=i,()=>{if(globalThis.fetch===Me&&Ce)globalThis.fetch=Ce;Me=void 0}}var yt,Zt;function AS(n){if(!yt||JSON.stringify(Zt)!==JSON.stringify(n))yt=new is(n),Zt=n;return yt}function NE(){if(yt=void 0,Zt=void 0,Me&&Ce&&globalThis.fetch===Me)globalThis.fetch=Ce;Me=void 0,Ce=void 0}function _f(n,i){let s=fS(i);if(!s.enabled)return;let o=AS(s.limits),c={functionId:s.functionId,headers:n},u=o.check(c);return{verdict:u,blocked:!u.allowed&&!s.detectionOnly,observed:!u.allowed&&s.detectionOnly}}function Lf(n,i){return hS(),Of.run(n,i)}function BE(n){let i=n,s=i?.default??i;if(typeof s==="function")return{fetch:s};return{fetch:s?.fetch??i?.fetch,queue:s?.queue??i?.queue,cli:s?.cli??i?.cli}}var ps=/^(?:text\/|application\/(?:json|xml|javascript|graphql|x-www-form-urlencoded|.*\+json|.*\+xml)|image\/svg)/i;function gs(n){if(!n)return!0;return ps.test(n)}function ys(n){if(n?.maintenance)return n.maintenance;let i=globalThis.process?.env??{};return{enabled:i.MAINTENANCE_MODE==="1"||i.MAINTENANCE_MODE==="true",bypassSecret:i.MAINTENANCE_BYPASS_SECRET}}function yS(n){let i=n.requestContext?.domainName??"localhost",s=n.rawQueryString?`?${n.rawQueryString}`:"",o=`https://${i}${n.rawPath||"/"}${s}`,c=new Headers;for(let[g,y]of Object.entries(n.headers??{}))if(y!==void 0)c.set(g,y);if(n.cookies?.length)c.set("cookie",n.cookies.join("; "));let u=n.requestContext.http.method,d;if(n.body!==void 0&&u!=="GET"&&u!=="HEAD")d=n.isBase64Encoded?new Uint8Array(Buffer.from(n.body,"base64")):new TextEncoder().encode(n.body);return new Request(o,{method:u,headers:c,body:d})}async function $f(n){let i={},s=[],o=typeof n.headers.getSetCookie==="function"?n.headers.getSetCookie():[];for(let d of o)s.push(d);n.headers.forEach((d,g)=>{if(g.toLowerCase()==="set-cookie")return;i[g]=d});let c=Buffer.from(await n.arrayBuffer()),u=gs(n.headers.get("content-type"));return{statusCode:n.status,headers:i,...s.length?{cookies:s}:{},body:u?c.toString("utf-8"):c.toString("base64"),isBase64Encoded:!u}}function SS(n,i){return async(s)=>{if(s.warmer)return{statusCode:200,headers:{"content-type":"text/plain"},body:"warm",isBase64Encoded:!1};if(!n)return{statusCode:501,headers:{"content-type":"text/plain"},body:"No HTTP handler configured",isBase64Encoded:!1};let o=ys(i);if(o.enabled){let d=s.headers?.["x-maintenance-bypass"]??s.cookies?.find((g)=>g.startsWith("tscloud_bypass="))?.split("=")[1];if(!o.bypassSecret||d!==o.bypassSecret)return{statusCode:503,headers:{"content-type":"text/plain","retry-after":"120"},body:"Service temporarily unavailable (maintenance mode)",isBase64Encoded:!1}}let c=_f(s.headers??{},i?.recursionProtection);if(c?.blocked){let d=ea(c.verdict);return{statusCode:d.status,headers:{...d.headers,"retry-after":"60"},body:JSON.stringify(d.body),isBase64Encoded:!1}}let u=yS(s);if(!c){let d=await n(u);return $f(d)}if(c.observed)console.warn(`[ts-cloud] recursion detected (${c.verdict.reason}) at depth ${c.verdict.depth}; detection-only mode let it run`);return Lf(c.verdict,async()=>$f(await n(u)))}}function fs(n){try{return JSON.parse(n)}catch{return n}}function IS(n){return async(i)=>{let s=[];if(i.warmer)return{batchItemFailures:s};if(!n)return{batchItemFailures:s};for(let o of i.Records??[])try{await n(fs(o.body),o)}catch{s.push({itemIdentifier:o.messageId})}return{batchItemFailures:s}}}function bS(n){return async(i)=>{if(i.warmer)return{statusCode:0,output:"warm"};if(!n)return{statusCode:501,output:"No CLI handler configured"};return n(i)}}function xE(n,i){return{http:SS(n.fetch,i),queue:IS(n.queue),cli:bS(n.cli)}}function Mf(n={}){let i=n.socketPath??"/tmp/.tscloud-fpm.sock",s=n.maxChildren??1;return`; ts-cloud php-fpm configuration (generated) — AWS Lambda custom runtime.
 [global]
 daemonize = no
 error_log = ${n.errorLog??"/tmp/storage/logs/php-fpm.log"}
@@ -7316,4 +7316,4 @@ decorate_workers_output = no
 php_admin_value[error_log] = /dev/stderr
 php_admin_flag[log_errors] = on
 clear_env = no
-`}import{readFileSync as hs}from"node:fs";import{dirname as bs,join as Xn}from"node:path";import{fileURLToPath as Ss}from"node:url";function As(){return Xn(bs(Ss(import.meta.url)),"runtime-assets")}function hn(){let n=As(),i=(s)=>hs(Xn(n,s),"utf-8");return[{path:"bootstrap",contents:i("bootstrap"),mode:493},{path:"tscloud/runtime.php",contents:i("runtime.php"),mode:420},{path:"tscloud/octane-runtime.php",contents:i("octane-runtime.php"),mode:420},{path:"tscloud/cli-runtime.php",contents:i("cli-runtime.php"),mode:420},{path:"tscloud/fastcgi-client.php",contents:i("fastcgi-client.php"),mode:420},{path:"tscloud/php-fpm.conf",contents:Mf(),mode:420}]}function ql(n={}){let i=n.cacheDriver??"dynamodb";return{APP_ENV:"production",LOG_CHANNEL:"stderr",CACHE_STORE:i,CACHE_DRIVER:i,SESSION_DRIVER:i,QUEUE_CONNECTION:"sqs",FILESYSTEM_DISK:"s3",VIEW_COMPILED_PATH:"/tmp/storage/framework/views",APP_SERVICES_CACHE:"/tmp/bootstrap/cache/services.php",APP_PACKAGES_CACHE:"/tmp/bootstrap/cache/packages.php",APP_CONFIG_CACHE:"/tmp/bootstrap/cache/config.php",APP_ROUTES_CACHE:"/tmp/bootstrap/cache/routes.php",APP_EVENTS_CACHE:"/tmp/bootstrap/cache/events.php"}}var Ff=["composer install --no-dev --optimize-autoloader --no-interaction","php artisan config:cache","php artisan route:cache","php artisan event:cache","php artisan view:cache"];import{execFileSync as ft}from"node:child_process";import{existsSync as Cs,mkdirSync as vs,mkdtempSync as Ts,readdirSync as Rs,readFileSync as Ps,rmSync as Es,statSync as er,writeFileSync as ws}from"node:fs";import{tmpdir as Is}from"node:os";import{join as Ge,relative as Ds}from"node:path";function*tr(n){for(let i of Rs(n)){let s=Ge(n,i);if(er(s).isDirectory())yield*tr(s);else yield s}}function OE(n={}){let i=n.architecture??"x86_64",s=n.platform??(i==="arm64"?"linux/arm64":"linux/amd64"),o=n.onStep??(()=>{}),c=Ts(Ge(Is(),"tscloud-php-layer-")),u="tscloud-php-layer:build";try{ws(Ge(c,"Dockerfile"),Bf(n)),o("Building PHP runtime image (docker)"),ft("docker",["build","--platform",s,"-t","tscloud-php-layer:build",c],{stdio:"inherit"}),o("Extracting /opt/php from image");let d=ft("docker",["create","--platform",s,"tscloud-php-layer:build"],{encoding:"utf-8"}).trim(),g=Ge(c,"opt");vs(g,{recursive:!0});try{ft("docker",["cp",`${d}:/opt/php`,Ge(g,"php")],{stdio:"inherit"})}finally{ft("docker",["rm",d],{stdio:"ignore"})}if(!Cs(Ge(g,"php","bin","php")))throw Error("layer build produced no /opt/php/bin/php");let y=[];for(let v of tr(g)){let T=Ds(g,v).replace(/\\/g,"/"),R=er(v).mode&73?493:420;y.push({name:T,data:Ps(v),mode:R})}o("Injecting runtime assets");let h=new Set(hn().map((v)=>v.path)),A=y.filter((v)=>!h.has(v.name));for(let v of hn())A.push({name:v.path,data:v.contents,mode:v.mode});return o("Packaging layer ZIP"),{zip:it(A),architecture:i,fileCount:A.length}}finally{Es(c,{recursive:!0,force:!0})}}import{execSync as Ns}from"node:child_process";import{createHash as xs}from"node:crypto";import{readdirSync as ks,readFileSync as Ms,statSync as nr}from"node:fs";import{join as Ls,relative as rr,resolve as Xt}from"node:path";var CS=[".git",".github","node_modules","tests","storage/logs","storage/framework/cache","storage/framework/sessions","storage/framework/views",".env",".env.local",".vapor",".ts-cloud","dist-lambda"];function Os(n,i){return i.some((s)=>n===s||n.startsWith(`${s}/`))}function*ir(n,i,s){for(let o of ks(n)){let c=Ls(n,o),u=rr(i,c).replace(/\\/g,"/");if(Os(u,s))continue;if(nr(c).isDirectory())yield*ir(c,i,s);else yield c}}function ta(n){if(n.skipBuild)return;let i=Xt(n.projectRoot??process.cwd()),s=n.app.build??Ff;for(let o of s)n.onStep?.(`build: ${o}`),Ns(o,{stdio:"inherit",cwd:i})}function ra(n,i=[]){let s=Xt(n),o=[...CS,dn(),...i],c=[];for(let u of ir(s,s,o)){let d=rr(s,u).replace(/\\/g,"/"),g=(nr(u).mode&73)!==0;c.push({name:d,data:Ms(u),mode:g?493:420})}return c}function jl(n){let i=Xt(n.projectRoot??process.cwd());ta(n),n.onStep?.("packaging application tree");let s=ra(i,n.exclude);if(!s.length)throw Error(`No files to package under ${i}`);let o=it(s),c=n.app.handlers?.http??"public/index.php";return{zip:o,sha256:xs("sha256").update(o).digest("hex"),handlers:{http:c,queue:n.app.handlers?.queue??c,cli:n.app.handlers?.cli??c},fileCount:s.length}}class Uf{optimizations=new Map;imageConfigs=new Map;ssgConfigs=new Map;prerenderConfigs=new Map;counter=0;createAssetOptimization(n){let i=`asset-opt-${Date.now()}-${this.counter++}`,s={id:i,...n};return this.optimizations.set(i,s),s}createImageOptimization(n){let i=`image-opt-${Date.now()}-${this.counter++}`,s={id:i,...n};return this.imageConfigs.set(i,s),s}createSSGConfig(n){let i=`ssg-${Date.now()}-${this.counter++}`,s={id:i,...n};return this.ssgConfigs.set(i,s),s}createPrerenderConfig(n){let i=`prerender-${Date.now()}-${this.counter++}`,s={id:i,...n};return this.prerenderConfigs.set(i,s),s}listOptimizations(){return Array.from(this.optimizations.values())}listImageConfigs(){return Array.from(this.imageConfigs.values())}clear(){this.optimizations.clear(),this.imageConfigs.clear(),this.ssgConfigs.clear(),this.prerenderConfigs.clear()}}var _E=new Uf;class zl{policies=new Map;versioningConfigs=new Map;replicationRules=new Map;tieringConfigs=new Map;objectLocks=new Map;transferAcceleration=new Map;accessPoints=new Map;glacierConfigs=new Map;inventories=new Map;batchOps=new Map;eventNotifications=new Map;counter=0;createLifecyclePolicy(n,i){let s=`lifecycle-${Date.now()}-${this.counter++}`,o={id:s,transitions:n,expiration:i};return this.policies.set(s,o),o}enableVersioning(n=!1){let i=`versioning-${Date.now()}-${this.counter++}`,s={id:i,enabled:!0,mfaDelete:n};return this.versioningConfigs.set(i,s),s}createReplicationRule(n,i,s){let o=`replication-${Date.now()}-${this.counter++}`,c={id:o,sourceRegion:n,destRegion:i,destBucket:s};return this.replicationRules.set(o,c),c}createIntelligentTiering(n,i){let s=`tiering-${Date.now()}-${this.counter++}`,o={id:s,archiveDays:n,deepArchiveDays:i};return this.tieringConfigs.set(s,o),o}enableObjectLock(n){let i=`object-lock-${Date.now()}-${this.counter++}`,s={id:i,bucketName:n.bucketName,mode:n.mode||"COMPLIANCE",retentionDays:n.retentionDays,retentionYears:n.retentionYears,legalHoldEnabled:n.legalHoldEnabled||!1};return this.objectLocks.set(i,s),s}enableTransferAcceleration(n){let i=`transfer-accel-${Date.now()}-${this.counter++}`,s={id:i,bucketName:n,enabled:!0,endpoint:`${n}.s3-accelerate.amazonaws.com`};return this.transferAcceleration.set(i,s),s}createAccessPoint(n){let i=`access-point-${Date.now()}-${this.counter++}`,s={id:i,name:n.name,bucketName:n.bucketName,vpcId:n.vpcId,publicAccessBlock:n.publicAccessBlock!==!1,policy:n.policy};return this.accessPoints.set(i,s),s}createGlacierArchive(n){let i=`glacier-${Date.now()}-${this.counter++}`,s={id:i,bucketName:n.bucketName,archiveType:n.archiveType,transitionDays:n.transitionDays,restoreConfig:n.restoreTier?{tier:n.restoreTier,days:n.restoreDays||7}:void 0};return this.glacierConfigs.set(i,s),s}createInventory(n){let i=`inventory-${Date.now()}-${this.counter++}`,s={id:i,sourceBucket:n.sourceBucket,destinationBucket:n.destinationBucket,schedule:n.schedule||"Daily",format:n.format||"CSV",includedFields:n.includedFields||["Size","LastModifiedDate","StorageClass","ETag"],prefix:n.prefix};return this.inventories.set(i,s),s}createBatchOperation(n){let i=`batch-op-${Date.now()}-${this.counter++}`,s={id:i,operation:n.operation,manifestBucket:n.manifestBucket,manifestKey:n.manifestKey,priority:n.priority||10,status:"pending"};return this.batchOps.set(i,s),s}executeBatchOperation(n){let i=this.batchOps.get(n);if(!i)throw Error(`Batch operation not found: ${n}`);return i.status="in_progress",i.totalObjects=1000,i.processedObjects=0,i}getBatchOperationStatus(n){return this.batchOps.get(n)}createLambdaNotification(n){let i=`event-${Date.now()}-${this.counter++}`,s={id:i,bucketName:n.bucketName,events:n.events,destination:{type:"Lambda",arn:n.lambdaArn},filter:n.prefix||n.suffix?{prefix:n.prefix,suffix:n.suffix}:void 0};return this.eventNotifications.set(i,s),s}createSQSNotification(n){let i=`event-${Date.now()}-${this.counter++}`,s={id:i,bucketName:n.bucketName,events:n.events,destination:{type:"SQS",arn:n.queueArn},filter:n.prefix||n.suffix?{prefix:n.prefix,suffix:n.suffix}:void 0};return this.eventNotifications.set(i,s),s}createSNSNotification(n){let i=`event-${Date.now()}-${this.counter++}`,s={id:i,bucketName:n.bucketName,events:n.events,destination:{type:"SNS",arn:n.topicArn},filter:n.prefix||n.suffix?{prefix:n.prefix,suffix:n.suffix}:void 0};return this.eventNotifications.set(i,s),s}generateObjectLockCF(n){let i={ObjectLockEnabled:"Enabled",ObjectLockConfiguration:{ObjectLockEnabled:"Enabled",Rule:{DefaultRetention:{Mode:n.mode}}}};if(n.retentionDays)i.ObjectLockConfiguration.Rule.DefaultRetention.Days=n.retentionDays;if(n.retentionYears)i.ObjectLockConfiguration.Rule.DefaultRetention.Years=n.retentionYears;return i}generateTransferAccelerationCF(n){return{AccelerateConfiguration:{AccelerationStatus:n.enabled?"Enabled":"Suspended"}}}generateAccessPointCF(n){return{Type:"AWS::S3::AccessPoint",Properties:{Name:n.name,Bucket:n.bucketName,...n.vpcId&&{VpcConfiguration:{VpcId:n.vpcId}},PublicAccessBlockConfiguration:n.publicAccessBlock?{BlockPublicAcls:!0,BlockPublicPolicy:!0,IgnorePublicAcls:!0,RestrictPublicBuckets:!0}:void 0,...n.policy&&{Policy:n.policy}}}}generateInventoryCF(n){return{Type:"AWS::S3::Bucket",Properties:{InventoryConfigurations:[{Id:n.id,Destination:{BucketArn:`arn:aws:s3:::${n.destinationBucket}`,Format:n.format},Enabled:!0,IncludedObjectVersions:"Current",OptionalFields:n.includedFields,ScheduleFrequency:n.schedule,...n.prefix&&{Prefix:n.prefix}}]}}}generateEventNotificationCF(n){let i=n.destination.type==="Lambda"?"LambdaConfigurations":n.destination.type==="SQS"?"QueueConfigurations":"TopicConfigurations",s=n.destination.type==="Lambda"?"Function":n.destination.type==="SQS"?"Queue":"Topic",o={Event:n.events[0],[s]:n.destination.arn};if(n.filter)o.Filter={S3Key:{Rules:[...n.filter.prefix?[{Name:"prefix",Value:n.filter.prefix}]:[],...n.filter.suffix?[{Name:"suffix",Value:n.filter.suffix}]:[]]}};return{NotificationConfiguration:{[i]:[o]}}}clear(){this.policies.clear(),this.versioningConfigs.clear(),this.replicationRules.clear(),this.tieringConfigs.clear(),this.objectLocks.clear(),this.transferAcceleration.clear(),this.accessPoints.clear(),this.glacierConfigs.clear(),this.inventories.clear(),this.batchOps.clear(),this.eventNotifications.clear()}}var ES=new zl;class Qf{checks=new Map;synthetics=new Map;uptimeTrackers=new Map;counter=0;createHealthCheck(n,i=30,s=10){let o=`health-${Date.now()}-${this.counter++}`,c={id:o,url:n,interval:i,timeout:s,status:"healthy"};return this.checks.set(o,c),c}createSyntheticMonitor(n,i,s,o){let c=`synthetic-${Date.now()}-${this.counter++}`,u={id:c,name:n,script:i,frequency:s,locations:o};return this.synthetics.set(c,u),u}trackUptime(n,i,s){let o=`uptime-${Date.now()}-${this.counter++}`,c=i/(i+s)*100,u={id:o,resource:n,uptime:i,downtime:s,availability:c};return this.uptimeTrackers.set(o,u),u}clear(){this.checks.clear(),this.synthetics.clear(),this.uptimeTrackers.clear()}}var LE=new Qf;class Hf{wafRules=new Map;shieldProtections=new Map;securityGroups=new Map;nacls=new Map;counter=0;createWAFRule(n,i,s,o){let c=`waf-${Date.now()}-${this.counter++}`,u={id:c,name:n,priority:i,action:s,conditions:o};return this.wafRules.set(c,u),u}enableShield(n,i="standard"){let s=`shield-${Date.now()}-${this.counter++}`,o={id:s,resourceArn:n,protectionType:i};return this.shieldProtections.set(s,o),o}createSecurityGroup(n,i,s){let o=`sg-${Date.now()}-${this.counter++}`,c={id:o,name:n,vpcId:i,rules:s};return this.securityGroups.set(o,c),c}createNACL(n,i){let s=`nacl-${Date.now()}-${this.counter++}`,o={id:s,vpcId:n,rules:i};return this.nacls.set(s,o),o}clear(){this.wafRules.clear(),this.shieldProtections.clear(),this.securityGroups.clear(),this.nacls.clear()}}var $E=new Hf;class Gf{strategies=new Map;allocations=new Map;groups=new Map;counter=0;createTaggingStrategy(n,i){let s=`tagging-${Date.now()}-${this.counter++}`,o={id:s,tags:n,resources:i};return this.strategies.set(s,o),o}createCostAllocation(n,i){let s=`cost-${Date.now()}-${this.counter++}`,o={id:s,tagKey:n,allocations:i};return this.allocations.set(s,o),o}createResourceGroup(n,i,s){let o=`group-${Date.now()}-${this.counter++}`,c={id:o,name:n,query:{resourceTypeFilters:i,tagFilters:s}};return this.groups.set(o,c),c}clear(){this.strategies.clear(),this.allocations.clear(),this.groups.clear()}}var ME=new Gf;export{$I,MI,rl,Sm,nl,il,dn,Q,l,sl,Im,K,ol,p,ry,b,Ze,Ji,ln,w,ce,al,ny,r,t,FI,UI,m,QI,HI,GI,VI,qI,lr,cl,Xi,iy,jI,zI,xe,et,dl,bm,Cm,KI,Em,vm,Tm,Ho,ll,de,un,kt,Go,Nt,Ce,sy,ul,Vo,wm,Rm,Dm,Pm,gl,WI,W,E,oy,ay,km,a,S,tt,f,Nm,rt,J,Bt,JI,Bm,X,pl,Oe,ur,qo,le,ml,ue,cy,jo,Y,Z,_,Yi,D,gr,xt,ee,e,gn,XI,xm,fl,YI,ZI,eb,tb,hl,rb,nb,ib,sb,ob,ab,cb,db,lb,ub,gb,pb,dy,ly,uy,gy,py,my,fy,pr,Om,_m,mr,Zi,mb,Lm,fb,hb,pn,Ab,yb,Sb,Ib,bb,Cb,hy,Ay,yy,Sy,Iy,es,Eb,zo,by,$m,V,Cy,nt,Ko,Ot,Ey,Mm,vy,Ty,wy,Fm,q,vb,Tb,wb,Rb,Ry,Db,te,Pb,kb,Nb,Al,yl,Dy,Um,Qm,Bb,xb,Ob,_b,Lb,Py,Sl,$b,Mb,Fb,Ub,Qb,ky,Ny,Hb,Gb,Vb,qb,jb,zb,Kb,By,Wb,Hm,Il,Jb,Xb,Yb,Zb,Gm,Vm,qm,eC,bl,xy,Oy,_y,Ly,Cl,$y,tC,rC,nC,iC,sC,oC,aC,My,Fy,Uy,Qy,jm,cC,dC,lC,uC,gC,pC,mC,fC,hC,Hy,Gy,Vy,qy,AC,yC,zm,SC,Km,Wm,Jm,Xm,IC,bC,CC,EC,_e,ts,vC,TC,wC,RC,DC,PC,kC,NC,jy,BC,xC,Ym,Zm,OC,_C,zy,LC,$C,MC,FC,UC,QC,HC,GC,VC,qC,jC,zC,KC,WC,JC,XC,YC,ZC,eE,tE,rE,El,Ky,vl,Wy,Tl,Jy,wl,Xy,Rl,Yy,fr,Zy,Dl,eS,rs,tS,Pl,rS,kl,nS,ef,nE,tf,iE,Nl,iS,hr,sS,rf,sE,Bl,oS,nf,oE,sf,aE,of,cE,xl,aS,af,dE,cf,lE,df,uE,lf,gE,Ol,cS,_l,dS,uf,pE,gf,mE,pf,fE,mf,hE,ff,AE,hf,yE,Ll,lS,Af,SE,yf,IE,Sf,bE,If,CE,bf,EE,Cf,vE,Ef,vf,Tf,wf,Rf,TE,Df,wE,Pf,RE,kf,DE,it,Nf,uS,Wo,$l,mn,gS,ns,Ar,Ml,Fl,pS,mS,Ul,Bf,Ql,xf,PE,kE,Jo,Xo,Yo,Hl,fn,Gl,Vl,is,Zo,ea,Of,fS,hS,AS,NE,_f,Lf,BE,yS,$f,SS,IS,bS,xE,Mf,hn,ql,Ff,OE,CS,ta,ra,jl,Uf,_E,zl,ES,Qf,LE,Hf,$E,Gf,ME};
+`}import{readFileSync as hs}from"node:fs";import{dirname as bs,join as Xn}from"node:path";import{fileURLToPath as Ss}from"node:url";function As(){return Xn(bs(Ss(import.meta.url)),"runtime-assets")}function hn(){let n=As(),i=(s)=>hs(Xn(n,s),"utf-8");return[{path:"bootstrap",contents:i("bootstrap"),mode:493},{path:"tscloud/runtime.php",contents:i("runtime.php"),mode:420},{path:"tscloud/octane-runtime.php",contents:i("octane-runtime.php"),mode:420},{path:"tscloud/cli-runtime.php",contents:i("cli-runtime.php"),mode:420},{path:"tscloud/fastcgi-client.php",contents:i("fastcgi-client.php"),mode:420},{path:"tscloud/php-fpm.conf",contents:Mf(),mode:420}]}function ql(n={}){let i=n.cacheDriver??"dynamodb";return{APP_ENV:"production",LOG_CHANNEL:"stderr",CACHE_STORE:i,CACHE_DRIVER:i,SESSION_DRIVER:i,QUEUE_CONNECTION:"sqs",FILESYSTEM_DISK:"s3",VIEW_COMPILED_PATH:"/tmp/storage/framework/views",APP_SERVICES_CACHE:"/tmp/bootstrap/cache/services.php",APP_PACKAGES_CACHE:"/tmp/bootstrap/cache/packages.php",APP_CONFIG_CACHE:"/tmp/bootstrap/cache/config.php",APP_ROUTES_CACHE:"/tmp/bootstrap/cache/routes.php",APP_EVENTS_CACHE:"/tmp/bootstrap/cache/events.php"}}var Ff=["composer install --no-dev --optimize-autoloader --no-interaction","php artisan config:cache","php artisan route:cache","php artisan event:cache","php artisan view:cache"];import{execFileSync as ft}from"node:child_process";import{existsSync as Cs,mkdirSync as vs,mkdtempSync as Ts,readdirSync as Rs,readFileSync as Ps,rmSync as Es,statSync as er,writeFileSync as ws}from"node:fs";import{tmpdir as Is}from"node:os";import{join as Ge,relative as Ds}from"node:path";function*tr(n){for(let i of Rs(n)){let s=Ge(n,i);if(er(s).isDirectory())yield*tr(s);else yield s}}function OE(n={}){let i=n.architecture??"x86_64",s=n.platform??(i==="arm64"?"linux/arm64":"linux/amd64"),o=n.onStep??(()=>{}),c=Ts(Ge(Is(),"tscloud-php-layer-")),u="tscloud-php-layer:build";try{ws(Ge(c,"Dockerfile"),Bf(n)),o("Building PHP runtime image (docker)"),ft("docker",["build","--platform",s,"-t","tscloud-php-layer:build",c],{stdio:"inherit"}),o("Extracting /opt/php from image");let d=ft("docker",["create","--platform",s,"tscloud-php-layer:build"],{encoding:"utf-8"}).trim(),g=Ge(c,"opt");vs(g,{recursive:!0});try{ft("docker",["cp",`${d}:/opt/php`,Ge(g,"php")],{stdio:"inherit"})}finally{ft("docker",["rm",d],{stdio:"ignore"})}if(!Cs(Ge(g,"php","bin","php")))throw Error("layer build produced no /opt/php/bin/php");let y=[];for(let v of tr(g)){let T=Ds(g,v).replace(/\\/g,"/"),R=er(v).mode&73?493:420;y.push({name:T,data:Ps(v),mode:R})}o("Injecting runtime assets");let h=new Set(hn().map((v)=>v.path)),A=y.filter((v)=>!h.has(v.name));for(let v of hn())A.push({name:v.path,data:v.contents,mode:v.mode});return o("Packaging layer ZIP"),{zip:it(A),architecture:i,fileCount:A.length}}finally{Es(c,{recursive:!0,force:!0})}}import{execSync as Ns}from"node:child_process";import{createHash as xs}from"node:crypto";import{readdirSync as ks,readFileSync as Ms,statSync as nr}from"node:fs";import{join as Ls,relative as rr,resolve as Xt}from"node:path";var CS=[".git",".github","node_modules","tests","storage/logs","storage/framework/cache","storage/framework/sessions","storage/framework/views",".env",".env.local",".vapor",".ts-cloud","dist-lambda"];function Os(n,i){return i.some((s)=>n===s||n.startsWith(`${s}/`))}function*ir(n,i,s){for(let o of ks(n)){let c=Ls(n,o),u=rr(i,c).replace(/\\/g,"/");if(Os(u,s))continue;if(nr(c).isDirectory())yield*ir(c,i,s);else yield c}}function ta(n){if(n.skipBuild)return;let i=Xt(n.projectRoot??process.cwd()),s=n.app.build??Ff;for(let o of s)n.onStep?.(`build: ${o}`),Ns(o,{stdio:"inherit",cwd:i})}function ra(n,i=[]){let s=Xt(n),o=[...CS,dn(),...i],c=[];for(let u of ir(s,s,o)){let d=rr(s,u).replace(/\\/g,"/"),g=(nr(u).mode&73)!==0;c.push({name:d,data:Ms(u),mode:g?493:420})}return c}function jl(n){let i=Xt(n.projectRoot??process.cwd());ta(n),n.onStep?.("packaging application tree");let s=ra(i,n.exclude);if(!s.length)throw Error(`No files to package under ${i}`);let o=it(s),c=n.app.handlers?.http??"public/index.php";return{zip:o,sha256:xs("sha256").update(o).digest("hex"),handlers:{http:c,queue:n.app.handlers?.queue??c,cli:n.app.handlers?.cli??c},fileCount:s.length}}class Uf{optimizations=new Map;imageConfigs=new Map;ssgConfigs=new Map;prerenderConfigs=new Map;counter=0;createAssetOptimization(n){let i=`asset-opt-${Date.now()}-${this.counter++}`,s={id:i,...n};return this.optimizations.set(i,s),s}createImageOptimization(n){let i=`image-opt-${Date.now()}-${this.counter++}`,s={id:i,...n};return this.imageConfigs.set(i,s),s}createSSGConfig(n){let i=`ssg-${Date.now()}-${this.counter++}`,s={id:i,...n};return this.ssgConfigs.set(i,s),s}createPrerenderConfig(n){let i=`prerender-${Date.now()}-${this.counter++}`,s={id:i,...n};return this.prerenderConfigs.set(i,s),s}listOptimizations(){return Array.from(this.optimizations.values())}listImageConfigs(){return Array.from(this.imageConfigs.values())}clear(){this.optimizations.clear(),this.imageConfigs.clear(),this.ssgConfigs.clear(),this.prerenderConfigs.clear()}}var _E=new Uf;class zl{policies=new Map;versioningConfigs=new Map;replicationRules=new Map;tieringConfigs=new Map;objectLocks=new Map;transferAcceleration=new Map;accessPoints=new Map;glacierConfigs=new Map;inventories=new Map;batchOps=new Map;eventNotifications=new Map;counter=0;createLifecyclePolicy(n,i){let s=`lifecycle-${Date.now()}-${this.counter++}`,o={id:s,transitions:n,expiration:i};return this.policies.set(s,o),o}enableVersioning(n=!1){let i=`versioning-${Date.now()}-${this.counter++}`,s={id:i,enabled:!0,mfaDelete:n};return this.versioningConfigs.set(i,s),s}createReplicationRule(n,i,s){let o=`replication-${Date.now()}-${this.counter++}`,c={id:o,sourceRegion:n,destRegion:i,destBucket:s};return this.replicationRules.set(o,c),c}createIntelligentTiering(n,i){let s=`tiering-${Date.now()}-${this.counter++}`,o={id:s,archiveDays:n,deepArchiveDays:i};return this.tieringConfigs.set(s,o),o}enableObjectLock(n){let i=`object-lock-${Date.now()}-${this.counter++}`,s={id:i,bucketName:n.bucketName,mode:n.mode||"COMPLIANCE",retentionDays:n.retentionDays,retentionYears:n.retentionYears,legalHoldEnabled:n.legalHoldEnabled||!1};return this.objectLocks.set(i,s),s}enableTransferAcceleration(n){let i=`transfer-accel-${Date.now()}-${this.counter++}`,s={id:i,bucketName:n,enabled:!0,endpoint:`${n}.s3-accelerate.amazonaws.com`};return this.transferAcceleration.set(i,s),s}createAccessPoint(n){let i=`access-point-${Date.now()}-${this.counter++}`,s={id:i,name:n.name,bucketName:n.bucketName,vpcId:n.vpcId,publicAccessBlock:n.publicAccessBlock!==!1,policy:n.policy};return this.accessPoints.set(i,s),s}createGlacierArchive(n){let i=`glacier-${Date.now()}-${this.counter++}`,s={id:i,bucketName:n.bucketName,archiveType:n.archiveType,transitionDays:n.transitionDays,restoreConfig:n.restoreTier?{tier:n.restoreTier,days:n.restoreDays||7}:void 0};return this.glacierConfigs.set(i,s),s}createInventory(n){let i=`inventory-${Date.now()}-${this.counter++}`,s={id:i,sourceBucket:n.sourceBucket,destinationBucket:n.destinationBucket,schedule:n.schedule||"Daily",format:n.format||"CSV",includedFields:n.includedFields||["Size","LastModifiedDate","StorageClass","ETag"],prefix:n.prefix};return this.inventories.set(i,s),s}createBatchOperation(n){let i=`batch-op-${Date.now()}-${this.counter++}`,s={id:i,operation:n.operation,manifestBucket:n.manifestBucket,manifestKey:n.manifestKey,priority:n.priority||10,status:"pending"};return this.batchOps.set(i,s),s}executeBatchOperation(n){let i=this.batchOps.get(n);if(!i)throw Error(`Batch operation not found: ${n}`);return i.status="in_progress",i.totalObjects=1000,i.processedObjects=0,i}getBatchOperationStatus(n){return this.batchOps.get(n)}createLambdaNotification(n){let i=`event-${Date.now()}-${this.counter++}`,s={id:i,bucketName:n.bucketName,events:n.events,destination:{type:"Lambda",arn:n.lambdaArn},filter:n.prefix||n.suffix?{prefix:n.prefix,suffix:n.suffix}:void 0};return this.eventNotifications.set(i,s),s}createSQSNotification(n){let i=`event-${Date.now()}-${this.counter++}`,s={id:i,bucketName:n.bucketName,events:n.events,destination:{type:"SQS",arn:n.queueArn},filter:n.prefix||n.suffix?{prefix:n.prefix,suffix:n.suffix}:void 0};return this.eventNotifications.set(i,s),s}createSNSNotification(n){let i=`event-${Date.now()}-${this.counter++}`,s={id:i,bucketName:n.bucketName,events:n.events,destination:{type:"SNS",arn:n.topicArn},filter:n.prefix||n.suffix?{prefix:n.prefix,suffix:n.suffix}:void 0};return this.eventNotifications.set(i,s),s}generateObjectLockCF(n){let i={ObjectLockEnabled:"Enabled",ObjectLockConfiguration:{ObjectLockEnabled:"Enabled",Rule:{DefaultRetention:{Mode:n.mode}}}};if(n.retentionDays)i.ObjectLockConfiguration.Rule.DefaultRetention.Days=n.retentionDays;if(n.retentionYears)i.ObjectLockConfiguration.Rule.DefaultRetention.Years=n.retentionYears;return i}generateTransferAccelerationCF(n){return{AccelerateConfiguration:{AccelerationStatus:n.enabled?"Enabled":"Suspended"}}}generateAccessPointCF(n){return{Type:"AWS::S3::AccessPoint",Properties:{Name:n.name,Bucket:n.bucketName,...n.vpcId&&{VpcConfiguration:{VpcId:n.vpcId}},PublicAccessBlockConfiguration:n.publicAccessBlock?{BlockPublicAcls:!0,BlockPublicPolicy:!0,IgnorePublicAcls:!0,RestrictPublicBuckets:!0}:void 0,...n.policy&&{Policy:n.policy}}}}generateInventoryCF(n){return{Type:"AWS::S3::Bucket",Properties:{InventoryConfigurations:[{Id:n.id,Destination:{BucketArn:`arn:aws:s3:::${n.destinationBucket}`,Format:n.format},Enabled:!0,IncludedObjectVersions:"Current",OptionalFields:n.includedFields,ScheduleFrequency:n.schedule,...n.prefix&&{Prefix:n.prefix}}]}}}generateEventNotificationCF(n){let i=n.destination.type==="Lambda"?"LambdaConfigurations":n.destination.type==="SQS"?"QueueConfigurations":"TopicConfigurations",s=n.destination.type==="Lambda"?"Function":n.destination.type==="SQS"?"Queue":"Topic",o={Event:n.events[0],[s]:n.destination.arn};if(n.filter)o.Filter={S3Key:{Rules:[...n.filter.prefix?[{Name:"prefix",Value:n.filter.prefix}]:[],...n.filter.suffix?[{Name:"suffix",Value:n.filter.suffix}]:[]]}};return{NotificationConfiguration:{[i]:[o]}}}clear(){this.policies.clear(),this.versioningConfigs.clear(),this.replicationRules.clear(),this.tieringConfigs.clear(),this.objectLocks.clear(),this.transferAcceleration.clear(),this.accessPoints.clear(),this.glacierConfigs.clear(),this.inventories.clear(),this.batchOps.clear(),this.eventNotifications.clear()}}var ES=new zl;class Qf{checks=new Map;synthetics=new Map;uptimeTrackers=new Map;counter=0;createHealthCheck(n,i=30,s=10){let o=`health-${Date.now()}-${this.counter++}`,c={id:o,url:n,interval:i,timeout:s,status:"healthy"};return this.checks.set(o,c),c}createSyntheticMonitor(n,i,s,o){let c=`synthetic-${Date.now()}-${this.counter++}`,u={id:c,name:n,script:i,frequency:s,locations:o};return this.synthetics.set(c,u),u}trackUptime(n,i,s){let o=`uptime-${Date.now()}-${this.counter++}`,c=i/(i+s)*100,u={id:o,resource:n,uptime:i,downtime:s,availability:c};return this.uptimeTrackers.set(o,u),u}clear(){this.checks.clear(),this.synthetics.clear(),this.uptimeTrackers.clear()}}var LE=new Qf;class Hf{wafRules=new Map;shieldProtections=new Map;securityGroups=new Map;nacls=new Map;counter=0;createWAFRule(n,i,s,o){let c=`waf-${Date.now()}-${this.counter++}`,u={id:c,name:n,priority:i,action:s,conditions:o};return this.wafRules.set(c,u),u}enableShield(n,i="standard"){let s=`shield-${Date.now()}-${this.counter++}`,o={id:s,resourceArn:n,protectionType:i};return this.shieldProtections.set(s,o),o}createSecurityGroup(n,i,s){let o=`sg-${Date.now()}-${this.counter++}`,c={id:o,name:n,vpcId:i,rules:s};return this.securityGroups.set(o,c),c}createNACL(n,i){let s=`nacl-${Date.now()}-${this.counter++}`,o={id:s,vpcId:n,rules:i};return this.nacls.set(s,o),o}clear(){this.wafRules.clear(),this.shieldProtections.clear(),this.securityGroups.clear(),this.nacls.clear()}}var $E=new Hf;class Gf{strategies=new Map;allocations=new Map;groups=new Map;counter=0;createTaggingStrategy(n,i){let s=`tagging-${Date.now()}-${this.counter++}`,o={id:s,tags:n,resources:i};return this.strategies.set(s,o),o}createCostAllocation(n,i){let s=`cost-${Date.now()}-${this.counter++}`,o={id:s,tagKey:n,allocations:i};return this.allocations.set(s,o),o}createResourceGroup(n,i,s){let o=`group-${Date.now()}-${this.counter++}`,c={id:o,name:n,query:{resourceTypeFilters:i,tagFilters:s}};return this.groups.set(o,c),c}clear(){this.strategies.clear(),this.allocations.clear(),this.groups.clear()}}var ME=new Gf;export{$I,MI,rl,Sm,nl,il,dn,Q,l,sl,Im,K,ol,p,ry,b,Ze,Ji,ln,w,de,al,ny,r,t,FI,UI,m,QI,HI,GI,VI,qI,lr,cl,Xi,iy,jI,zI,xe,et,dl,bm,Cm,KI,Em,vm,Tm,Ho,ll,le,un,kt,Go,Nt,Ee,sy,ul,Vo,wm,Rm,Dm,Pm,gl,WI,W,E,oy,ay,km,a,S,tt,f,Nm,rt,J,Bt,JI,Bm,X,pl,Oe,ur,qo,ue,ml,ge,cy,jo,Y,Z,_,Yi,D,gr,xt,ee,e,gn,XI,xm,fl,YI,ZI,eb,tb,hl,rb,nb,ib,sb,ob,ab,cb,db,lb,ub,gb,pb,dy,ly,uy,gy,py,my,fy,pr,Om,_m,mr,Zi,mb,Lm,fb,hb,pn,Ab,yb,Sb,Ib,bb,Cb,hy,Ay,yy,Sy,Iy,es,Eb,zo,by,$m,V,Cy,nt,Ko,Ot,Ey,Mm,vy,Ty,wy,Fm,q,vb,Tb,wb,Rb,Ry,Db,te,Pb,kb,Nb,Al,yl,Dy,Um,Qm,Bb,xb,Ob,_b,Lb,Py,Sl,$b,Mb,Fb,Ub,Qb,ky,Ny,Hb,Gb,Vb,qb,jb,zb,Kb,By,Wb,Hm,Il,Jb,Xb,Yb,Zb,Gm,Vm,qm,eC,bl,xy,Oy,_y,Ly,Cl,$y,tC,rC,nC,iC,sC,oC,aC,My,Fy,Uy,Qy,jm,cC,dC,lC,uC,gC,pC,mC,fC,hC,Hy,Gy,Vy,qy,AC,yC,zm,SC,Km,Wm,Jm,Xm,IC,bC,CC,EC,_e,ts,vC,TC,wC,RC,DC,PC,kC,NC,jy,BC,xC,Ym,Zm,OC,_C,zy,LC,$C,MC,FC,UC,QC,HC,GC,VC,qC,jC,zC,KC,WC,JC,XC,YC,ZC,eE,tE,rE,El,Ky,vl,Wy,Tl,Jy,wl,Xy,Rl,Yy,fr,Zy,Dl,eS,rs,tS,Pl,rS,kl,nS,ef,nE,tf,iE,Nl,iS,hr,sS,rf,sE,Bl,oS,nf,oE,sf,aE,of,cE,xl,aS,af,dE,cf,lE,df,uE,lf,gE,Ol,cS,_l,dS,uf,pE,gf,mE,pf,fE,mf,hE,ff,AE,hf,yE,Ll,lS,Af,SE,yf,IE,Sf,bE,If,CE,bf,EE,Cf,vE,Ef,vf,Tf,wf,Rf,TE,Df,wE,Pf,RE,kf,DE,it,Nf,uS,Wo,$l,mn,gS,ns,Ar,Ml,Fl,pS,mS,Ul,Bf,Ql,xf,PE,kE,Jo,Xo,Yo,Hl,fn,Gl,Vl,is,Zo,ea,Of,fS,hS,AS,NE,_f,Lf,BE,yS,$f,SS,IS,bS,xE,Mf,hn,ql,Ff,OE,CS,ta,ra,jl,Uf,_E,zl,ES,Qf,LE,Hf,$E,Gf,ME};