@stacksjs/ts-cloud 0.7.56 → 0.7.58

package/dist/index.js

@@ -1,22 +1,330 @@
+import {
+  API_IDEMPOTENCY_TTL_MS,
+  API_TOKEN_DEFAULT_TTL_MS,
+  API_TOKEN_MAX_TTL_MS,
+  API_VERSION,
+  AUTHORIZATION_CAPABILITIES,
+  AUTH_ACTION_TOKEN_TTL_MS,
+  AUTH_ENCRYPTION_KEY_FILE,
+  AUTH_MFA_CHALLENGE_TTL_MS,
+  AUTH_OIDC_TRANSACTION_TTL_MS,
+  AUTH_SESSION_ABSOLUTE_TTL_MS,
+  AUTH_SESSION_IDLE_TTL_MS,
+  AlertEvaluator,
+  AlertStore,
+  ApiServiceError,
+  AuthenticationStore,
+  AutomationApiService,
+  AutomationIdentityStore,
+  AwsAuroraDataAdapter,
+  AwsAuroraTransport,
+  AwsDatabaseBackupSource,
+  AwsElastiCacheDataAdapter,
+  AwsElastiCacheTransport,
+  AwsIamCapabilityScanner,
+  AwsInfrastructureBackupSource,
+  AwsRdsDataAdapter,
+  AwsRdsTransport,
+  AwsRegionalDriver,
+  AwsSecretsManagerConfigurationBackend,
+  AwsSsmConfigurationBackend,
+  BackupCoordinator,
+  BackupStore,
+  BitbucketSourceAdapter,
+  BunDockerRuntime,
+  BunDockerVolumeRuntime,
+  BunFilesystemArchiveRuntime,
+  CONTROL_PLANE_DATABASE_FILE,
+  CONTROL_PLANE_SCHEMA_VERSION,
+  CloudBlockVolumeDriver,
+  ComposeApplicationService,
+  ComposeApplicationStore,
+  ConfigurationService,
+  ConfigurationStore,
+  ContainerDataAdapter,
+  ControlPlaneBackupSource,
+  ControlPlaneCleanupDriver,
+  ControlPlaneStore,
+  DEFAULT_TELEMETRY_POLICY,
+  DEPLOYMENT_QUEUE_KINDS,
+  DIAGNOSTIC_PRESETS,
+  DataServiceLifecycle,
+  DataServiceStore,
+  DockerDataTransport,
+  DockerDiscoveryAdapter,
+  DockerNamedVolumeDriver,
+  DockerVolumeBackupSource,
+  DurableOperationQueue,
+  DurableQueueWorker,
+  EcsRuntimeAdapter,
+  EncryptedDataSecretStore,
+  EventBridgeJobAdapter,
+  ExternalConfigurationBackend,
+  FilesystemBackupSource,
+  FleetService,
+  FleetStore,
+  GiteaSourceAdapter,
+  GithubSourceAdapter,
+  GitlabSourceAdapter,
+  HealthCheckRunner,
+  InvalidOperationTransitionError,
+  JobProviderReconciler,
+  JobService,
+  JobStore,
+  LambdaRuntimeAdapter,
+  LocalEncryptedConfigurationBackend,
+  LogicalDatabaseBackupSource,
+  MAX_CONTROL_PLANE_ERROR_BYTES,
+  MAX_CONTROL_PLANE_JSON_BYTES,
+  MaintenanceService,
+  MaintenanceStore,
+  NotificationRouter,
+  OptimisticConcurrencyError,
+  PlacementService,
+  PlacementStore,
+  PreDeployScanner,
+  PreviewEnvironmentService,
+  PreviewEnvironmentStore,
+  QueueCancellationError,
+  QueueTimeoutError,
+  RELEASE_QUEUE_KINDS,
+  RegionService,
+  RegionStore,
+  ReleaseService,
+  ReleaseStore,
+  RemoteBuildService,
+  RetryableOperationError,
+  RuntimeOperationService,
+  RuntimeStreamRegistry,
+  S3BackupDestinationAdapter,
+  SECRET_PATTERNS,
+  SecretFindingScanner,
+  SecurityPostureStore,
+  SecurityScannerRunner,
+  ServerCronJobAdapter,
+  ServerDataAdapter,
+  ServerPathVolumeDriver,
+  SourceConnectionStore,
+  SourceProviderError,
+  SshFleetDriver,
+  SystemFleetSshTransport,
+  SystemdDiscoveryAdapter,
+  TelemetryStore,
+  TransportDisasterRecoveryDriver,
+  TransportPlatformMaintenanceDriver,
+  TransportRemoteBuildDriver,
+  TrivyImageScanner,
+  TsCloudApiError,
+  TsCloudClient,
+  UnavailableRegionalDriver,
+  UnsupportedSchemaVersionError,
+  VolumeService,
+  VolumeStore,
+  activateImmutableRelease,
+  ageSeconds,
+  assertReleaseStrategy,
+  attachProvenanceToRelease,
+  attachSbomToRelease,
+  attachVulnerabilitySummary,
+  authorizeOrganization,
+  authorizeRuntimePath,
+  backupCredentialStatus,
+  beginOidcAuthorization,
+  buildComposeLogsCommand,
+  buildComposeRuntimeCommand,
+  buildComposeScaleCommand,
+  buildComposeShellCommand,
+  buildFunctionEnv,
+  bytes,
+  canonicalJson,
+  capabilities,
+  capacity,
+  cloneSourceBinding,
+  collectServerDnsDomains,
+  completeComposeVolumeDeletion,
+  completeOidcAuthorization,
+  composeProjectName,
+  compressBackup,
+  config,
+  connectionGuidance,
+  controlPlaneMigrations,
+  createApiV1Handler,
+  createAsgBuildDriver,
+  createBackupQueueHandlers,
+  createDataServiceQueueHandlers,
+  createDeploymentQueueHandlers,
+  createEcsBuildDriver,
+  createFleetQueueHandlers,
+  createJobQueueHandlers,
+  createMaintenanceQueueHandlers,
+  createRegionQueueHandlers,
+  createReleaseProvenance,
+  createReleaseQueueHandlers,
+  createRemoteBuildQueueHandlers,
+  createRuntimeAdapters,
+  createServerBuildDriver,
+  createSourceAdapter,
+  createVolumeQueueHandlers,
+  dashboardActions,
+  dataServiceCapabilities,
+  decodeBase32,
+  decompressBackup,
+  decryptBackup,
+  defaultConfig,
+  deployServerlessApp,
+  deploySite,
+  desiredState,
+  diffCompose,
+  discoverGitRefs,
+  discoverOidcProvider,
+  discoverRuntimeInventory,
+  dockerWorkloads,
+  documentDigest,
+  ecsWorkloads,
+  effectiveCapabilities,
+  encodeBase32,
+  encryptBackup,
+  ensureDefaultSecurityPolicies,
+  evaluateTelemetryAlertRules,
+  eventBridgeScheduleInput,
+  exportCompose,
+  formatScanResults,
+  generateCycloneDxSbom,
+  generateImageSbom,
+  getComposeTemplate,
+  getConfig,
+  hotp,
+  infraEnvFromOutputs,
+  isQuietHours,
+  jobProviderCapability,
+  lambdaWorkloads,
+  listComposeTemplates,
+  listSourceReferences,
+  loadCloudConfig,
+  loadTelemetryPolicy,
+  maintenanceWindowOpen,
+  manifestDigest,
+  matchTotpCounter,
+  nextScheduleRuns,
+  normalizeRuntimeStatus,
+  normalizeScheduleExpression,
+  normalizeSourceEvent,
+  normalizeTelemetryPolicy,
+  openApiDocument,
+  parseCompose,
+  parseComposeCatalog,
+  parseDockerInspect,
+  parseDotenv,
+  parseSystemdRecords,
+  pathTemplate,
+  planComposeTemplateUpgrade,
+  previewSchedule,
+  processSourceWebhook,
+  productionChangeReview,
+  publicKeyFingerprint,
+  reconcileJobObservation,
+  reconcileSourceWebhook,
+  recordDashboardHostPosture,
+  recordPreDeploySecretScan,
+  recordSkippedSecretScan,
+  redactRuntimeConfig,
+  redactTelemetryText,
+  redactTelemetryValue,
+  redeployServerlessApp,
+  releaseStrategyCapabilities,
+  releaseTrafficPlan,
+  removeSourceWebhook,
+  removeStaleServerAddressRecords,
+  renderComposeTemplate,
+  renderServerCron,
+  requestHash,
+  resolveAuthEncryptionKey,
+  resolveDashboardAction,
+  resolveQueuedDeploymentCommand,
+  resolveRuntimeInventory,
+  roleCapabilities,
+  rollbackImmutableRelease,
+  rollbackServerlessApp,
+  runRemoteCommand,
+  runtimeId,
+  sanitizeCloudConfig,
+  sanitizeControlPlaneValue,
+  sanitizeOidcReturnPath,
+  saveTelemetryPolicy,
+  scanForSecrets,
+  scopeContains,
+  searchControlPlane,
+  secureContainerRelease,
+  securityScope,
+  sendAuthenticationEmail,
+  serializeDotenv,
+  setMaintenance,
+  startLocalDashboardServer,
+  syncSourceRepositories,
+  synchronizeComposeVolumes,
+  synchronizeConfiguredConfiguration,
+  synchronizeConfiguredJobs,
+  systemdWorkloads,
+  telemetryBucketLabel,
+  telemetryCursor,
+  telemetryEstimatedMonthlyCost,
+  telemetryPercentile,
+  telemetryPolicyKey,
+  testSourceConnection,
+  totp,
+  totpUri,
+  unsupportedCapabilities,
+  unsupportedVolumeCapabilities,
+  updateCompatibility,
+  validateAttachment,
+  validateBackupDestination,
+  validateMountPath,
+  verifyArtifactSignature,
+  verifyTotp,
+  verifyUpdateSignature,
+  volumeCapabilities,
+  webhookEndpoint,
+  zeroCapacity
+} from "./chunk-fw3q88wk.js";
+import {
+  deleteStaticSite,
+  deployStaticSite,
+  deployStaticSiteFull,
+  deployStaticSiteWithExternalDns,
+  deployStaticSiteWithExternalDnsFull,
+  generateExternalDnsStaticSiteTemplate,
+  generateStaticSiteTemplate,
+  invalidateCache,
+  uploadStaticFiles
+} from "./chunk-vvkd46k1.js";
+import {
+  buildAndPushServerlessImage
+} from "./chunk-exbcsab2.js";
 import {
   ApplicationAutoScalingClient,
   BedrockClient,
   BedrockRuntimeClient,
+  CloudWatchLogsClient,
   ComprehendClient,
   ConnectClient,
   DynamoDBClient,
   ECSClient,
+  EFSClient,
   ELBv2Client,
   ElastiCacheClient,
+  EventBridgeClient,
   KendraClient,
+  LambdaClient,
   OpenSearchClient,
   PersonalizeClient,
   PollyClient,
   RekognitionClient,
   Route53DomainsClient,
   SNSClient,
+  SQSClient,
   STSClient,
   SchedulerClient,
+  SecretsManagerClient,
   SmsClient,
   SupportClient,
   TextractClient,
@@ -29,49 +337,31 @@ import {
   providerEndpoint,
   remapKey,
   resolveObjectStorage
-} from "./chunk-3rsfns7x.js";
-import {
-  RDSClient
-} from "./chunk-3knnr7wh.js";
-import {
-  EmailClient,
-  IAMClient,
-  SESClient
-} from "./chunk-zn0nxxa8.js";
+} from "./chunk-ybcz6sxc.js";
 import {
-  buildFunctionEnv,
-  collectServerDnsDomains,
-  config,
-  dashboardActions,
-  defaultConfig,
-  deployServerlessApp,
-  deploySite,
-  getConfig,
-  infraEnvFromOutputs,
-  loadCloudConfig,
-  redeployServerlessApp,
-  removeStaleServerAddressRecords,
-  resolveDashboardAction,
-  rollbackServerlessApp,
-  runRemoteCommand,
-  sanitizeCloudConfig,
-  setMaintenance,
-  startLocalDashboardServer
-} from "./chunk-b17vf1g1.js";
+  CloudFrontClient
+} from "./chunk-01d86gt1.js";
 import {
-  buildAndPushServerlessImage
-} from "./chunk-f29w04w5.js";
+  ECRClient
+} from "./chunk-50jpda9q.js";
 import {
-  CloudWatchLogsClient,
-  EFSClient,
-  EventBridgeClient,
-  LambdaClient,
-  SQSClient,
-  SecretsManagerClient
-} from "./chunk-b82pbxyp.js";
+  RDSClient
+} from "./chunk-he9a874b.js";
 import {
-  ECRClient
-} from "./chunk-hsk6fe6x.js";
+  ACMClient,
+  ACMDnsValidator,
+  DnsProviderFactory,
+  GoDaddyProvider,
+  PorkbunProvider,
+  Route53Provider,
+  UnifiedDnsValidator,
+  createDnsProvider,
+  createGoDaddyValidator,
+  createPorkbunValidator,
+  createRoute53Validator,
+  detectDnsProvider,
+  dnsProviders
+} from "./chunk-fv1bj3yt.js";
 import {
   AwsDriver,
   CloudDriverFactory,
@@ -108,7 +398,7 @@ import {
   waitForCloudInit,
   waitForSsh,
   wrapCloudInitUserData
-} from "./chunk-d5vqwj8s.js";
+} from "./chunk-9m6b4m74.js";
 import {
   ABTestManager,
   AI,
@@ -279,6 +569,7 @@ import {
   createDashboardSite,
   createDataPipelinePreset,
   createError,
+  createExistingStaticFullStackPreset,
   createFullStackAppPreset,
   createHandlers,
   createHttpHandler,
@@ -514,55 +805,169 @@ import {
   withSecurity,
   withTimeout,
   xrayManager
-} from "./chunk-r16e02bc.js";
+} from "./chunk-vdk53yyq.js";
 import {
   EC2Client,
   SSMClient
-} from "./chunk-93hjhs78.js";
-import {
-  deleteStaticSite,
-  deployStaticSite,
-  deployStaticSiteFull,
-  deployStaticSiteWithExternalDns,
-  deployStaticSiteWithExternalDnsFull,
-  generateExternalDnsStaticSiteTemplate,
-  generateStaticSiteTemplate,
-  invalidateCache,
-  uploadStaticFiles
-} from "./chunk-jp2a8yad.js";
+} from "./chunk-703nkybg.js";
 import {
-  CloudFrontClient
-} from "./chunk-tjjgajbh.js";
+  CloudFormationClient
+} from "./chunk-4cjrg98a.js";
 import {
-  ACMClient,
-  ACMDnsValidator,
-  DnsProviderFactory,
-  GoDaddyProvider,
-  PorkbunProvider,
-  Route53Provider,
-  UnifiedDnsValidator,
-  createDnsProvider,
-  createGoDaddyValidator,
-  createPorkbunValidator,
-  createRoute53Validator,
-  detectDnsProvider,
-  dnsProviders
-} from "./chunk-3bfv1z4v.js";
+  EmailClient,
+  IAMClient,
+  SESClient
+} from "./chunk-hpv68b4a.js";
 import {
   Route53Client
-} from "./chunk-tnztxpcb.js";
-import {
-  CloudFormationClient
-} from "./chunk-qpj3edwz.js";
+} from "./chunk-32e7ya18.js";
 import {
   S3Client
-} from "./chunk-vd87cpvn.js";
+} from "./chunk-wj3s95p9.js";
 import {
   AWSClient
-} from "./chunk-arsh1g5h.js";
+} from "./chunk-zqtpg06c.js";
 import {
   __require
 } from "./chunk-v0bahtg2.js";
+// src/media.ts
+import { createHmac, createSign, timingSafeEqual } from "node:crypto";
+function epochSeconds(value) {
+  const milliseconds = value instanceof Date ? value.getTime() : value;
+  if (!Number.isFinite(milliseconds))
+    throw new TypeError("Media access timestamp must be finite");
+  return Math.floor(milliseconds / 1000);
+}
+function cloudFrontBase64(value) {
+  return Buffer.from(value).toString("base64").replaceAll("+", "-").replaceAll("=", "_").replaceAll("/", "~");
+}
+function regularBase64Url(value) {
+  return Buffer.from(value).toString("base64url");
+}
+function assertHttpResource(resource, allowWildcard = false) {
+  if (!resource || /[\r\n]/.test(resource))
+    throw new TypeError("Media resource is invalid");
+  const candidate = allowWildcard ? resource.replaceAll("*", "wildcard") : resource;
+  const url = new URL(candidate);
+  if (!["http:", "https:"].includes(url.protocol))
+    throw new TypeError("Media resource must use HTTP or HTTPS");
+  if (!allowWildcard && resource.includes("*"))
+    throw new TypeError("Canned policies cannot contain wildcards");
+}
+function signCloudFrontValue(value, privateKey) {
+  const signer = createSign("RSA-SHA1");
+  signer.update(value);
+  signer.end();
+  return cloudFrontBase64(signer.sign(privateKey));
+}
+function createCloudFrontPolicy(options) {
+  assertHttpResource(options.resource, true);
+  const expiresAt = epochSeconds(options.expiresAt);
+  const condition = {
+    DateLessThan: { "AWS:EpochTime": expiresAt }
+  };
+  if (options.activeAt !== undefined)
+    condition.DateGreaterThan = { "AWS:EpochTime": epochSeconds(options.activeAt) };
+  if (options.ipAddress)
+    condition.IpAddress = { "AWS:SourceIp": options.ipAddress };
+  return JSON.stringify({ Statement: [{ Resource: options.resource, Condition: condition }] });
+}
+function signCloudFrontUrl(resource, expiresAt, signer) {
+  assertHttpResource(resource);
+  const expires = epochSeconds(expiresAt);
+  const separator = resource.includes("?") ? "&" : "?";
+  const policy = createCloudFrontPolicy({ resource, expiresAt });
+  const signature = signCloudFrontValue(policy, signer.privateKey);
+  return `${resource}${separator}Expires=${expires}&Signature=${encodeURIComponent(signature)}&Key-Pair-Id=${encodeURIComponent(signer.keyPairId)}`;
+}
+function signCloudFrontCookies(policyOptions, signer) {
+  const policy = createCloudFrontPolicy(policyOptions);
+  return {
+    "CloudFront-Key-Pair-Id": signer.keyPairId,
+    "CloudFront-Policy": cloudFrontBase64(Buffer.from(policy)),
+    "CloudFront-Signature": signCloudFrontValue(policy, signer.privateKey)
+  };
+}
+function createMediaAccessToken(options) {
+  if (!options.resource || /[\r\n]/.test(options.resource))
+    throw new TypeError("Media resource is invalid");
+  const payload = regularBase64Url(Buffer.from(JSON.stringify({
+    resource: options.resource,
+    expiresAt: epochSeconds(options.expiresAt),
+    ...options.keyId ? { keyId: options.keyId } : {},
+    ...options.audience ? { audience: options.audience } : {}
+  })));
+  const signature = createHmac("sha256", options.secret).update(payload).digest("base64url");
+  return `${payload}.${signature}`;
+}
+function verifyMediaAccessToken(token, options) {
+  const [payload, signature, extra] = token.split(".");
+  if (!payload || !signature || extra)
+    return null;
+  const expected = createHmac("sha256", options.secret).update(payload).digest();
+  let actual;
+  try {
+    actual = Buffer.from(signature, "base64url");
+  } catch {
+    return null;
+  }
+  if (expected.length !== actual.length || !timingSafeEqual(expected, actual))
+    return null;
+  try {
+    const value = JSON.parse(Buffer.from(payload, "base64url").toString("utf8"));
+    const now = epochSeconds(options.now ?? Date.now());
+    if (!value.resource || !Number.isSafeInteger(value.expiresAt) || value.expiresAt <= now)
+      return null;
+    if (options.resource && value.resource !== options.resource)
+      return null;
+    if (options.audience && value.audience !== options.audience)
+      return null;
+    return value;
+  } catch {
+    return null;
+  }
+}
+function mediaObjectHeaders(path, protectedMedia = false) {
+  const pathname = new URL(path, "https://media.invalid").pathname.toLowerCase();
+  const isManifest = /\.(?:m3u8|mpd|vtt|json)$/.test(pathname);
+  const isKey = /\.(?:key|license)$/.test(pathname) || pathname.includes("/keys/") || pathname.includes("/licenses/");
+  const cacheControl = protectedMedia && (isManifest || isKey) ? "private, no-store" : isManifest ? "public, max-age=5, s-maxage=30, stale-while-revalidate=30" : "public, max-age=31536000, immutable";
+  return {
+    "Accept-Ranges": "bytes",
+    "Cache-Control": cacheControl,
+    "Cross-Origin-Resource-Policy": "cross-origin",
+    "X-Content-Type-Options": "nosniff"
+  };
+}
+function buildMediaCdnPlan(options) {
+  if (!/^[a-z0-9][a-z0-9.-]{1,61}[a-z0-9]$/.test(options.bucket))
+    throw new TypeError("Media bucket is invalid");
+  if (!/^[a-z0-9-]+$/.test(options.region))
+    throw new TypeError("Media bucket region is invalid");
+  const prefix = options.prefix ? `/${options.prefix.replace(/^\/+|\/+$/g, "")}` : "";
+  const signed = options.protected ?? false;
+  const immutable = "public, max-age=31536000, immutable";
+  const manifests = signed ? "private, no-store" : "public, max-age=5, s-maxage=30, stale-while-revalidate=30";
+  return {
+    originDomain: `${options.bucket}.s3.${options.region}.amazonaws.com`,
+    originPath: prefix,
+    domain: options.domain,
+    trustedKeyGroupIds: [...new Set(options.trustedKeyGroupIds ?? [])],
+    behaviors: [
+      { pathPattern: "*.m3u8", cacheControl: manifests, compress: true, signed },
+      { pathPattern: "*.mpd", cacheControl: manifests, compress: true, signed },
+      { pathPattern: "*.vtt", cacheControl: manifests, compress: true, signed },
+      { pathPattern: "*", cacheControl: immutable, compress: false, signed }
+    ],
+    responseHeaders: {
+      "Access-Control-Allow-Headers": "Range, If-Range",
+      "Access-Control-Allow-Methods": "GET, HEAD, OPTIONS",
+      "Access-Control-Allow-Origin": "*",
+      "Access-Control-Expose-Headers": "Accept-Ranges, Content-Length, Content-Range, ETag",
+      "X-Content-Type-Options": "nosniff"
+    }
+  };
+}
 // src/generators/infrastructure.ts
 class InfrastructureGenerator {
   builder;
@@ -687,11 +1092,7 @@ class InfrastructureGenerator {
     const serverRegion = this.mergedConfig.infrastructure?.servers?.app?.region || this.mergedConfig.project?.region || "us-east-1";
     const dnsSuffix = serverRegion === "us-east-1" ? ".compute-1.amazonaws.com" : `.${serverRegion}.compute.amazonaws.com`;
     const originDomainName = {
-      "Fn::Join": ["", [
-        "ec2-",
-        { "Fn::Join": ["-", { "Fn::Split": [".", { Ref: appEipId }] }] },
-        dnsSuffix
-      ]]
+      "Fn::Join": ["", ["ec2-", { "Fn::Join": ["-", { "Fn::Split": [".", { Ref: appEipId }] }] }, dnsSuffix]]
     };
     const apiOriginPort = this.resolveApiOriginPort();
     origins.push({
@@ -907,9 +1308,7 @@ ${handles.join(`
       Type: "AWS::ECS::Cluster",
       Properties: {
         ClusterName: `${slug}-${env}`,
-        ClusterSettings: [
-          { Name: "containerInsights", Value: "enabled" }
-        ],
+        ClusterSettings: [{ Name: "containerInsights", Value: "enabled" }],
         Tags: [
           { Key: "Name", Value: `${slug}-${env}` },
           { Key: "Environment", Value: env }
@@ -926,9 +1325,7 @@ ${handles.join(`
           { IpProtocol: "tcp", FromPort: 80, ToPort: 80, CidrIp: "0.0.0.0/0", Description: "HTTP" },
           { IpProtocol: "tcp", FromPort: 443, ToPort: 443, CidrIp: "0.0.0.0/0", Description: "HTTPS" }
         ],
-        SecurityGroupEgress: [
-          { IpProtocol: "-1", CidrIp: "0.0.0.0/0", Description: "Allow all outbound" }
-        ],
+        SecurityGroupEgress: [{ IpProtocol: "-1", CidrIp: "0.0.0.0/0", Description: "Allow all outbound" }],
         Tags: [
           { Key: "Name", Value: `${slug}-${env}-alb-sg` },
           { Key: "Environment", Value: env }
@@ -952,9 +1349,7 @@ ${handles.join(`
               Description: "Allow traffic from ALB"
             }
           ],
-          SecurityGroupEgress: [
-            { IpProtocol: "-1", CidrIp: "0.0.0.0/0", Description: "Allow all outbound" }
-          ],
+          SecurityGroupEgress: [{ IpProtocol: "-1", CidrIp: "0.0.0.0/0", Description: "Allow all outbound" }],
           Tags: [
             { Key: "Name", Value: `${slug}-${env}-ecs-sg` },
             { Key: "Environment", Value: env }
@@ -968,33 +1363,37 @@ ${handles.join(`
           RoleName: `${slug}-${env}-ecs-exec-role`,
           AssumeRolePolicyDocument: {
             Version: "2012-10-17",
-            Statement: [{
-              Effect: "Allow",
-              Principal: { Service: "ecs-tasks.amazonaws.com" },
-              Action: "sts:AssumeRole"
-            }]
-          },
-          ManagedPolicyArns: [
-            "arn:aws:iam::aws:policy/service-role/AmazonECSTaskExecutionRolePolicy"
-          ],
-          Policies: [{
-            PolicyName: "ECRPullPolicy",
-            PolicyDocument: {
-              Version: "2012-10-17",
-              Statement: [{
+            Statement: [
+              {
                 Effect: "Allow",
-                Action: [
-                  "ecr:GetAuthorizationToken",
-                  "ecr:BatchCheckLayerAvailability",
-                  "ecr:GetDownloadUrlForLayer",
-                  "ecr:BatchGetImage",
-                  "logs:CreateLogStream",
-                  "logs:PutLogEvents"
-                ],
-                Resource: "*"
-              }]
+                Principal: { Service: "ecs-tasks.amazonaws.com" },
+                Action: "sts:AssumeRole"
+              }
+            ]
+          },
+          ManagedPolicyArns: ["arn:aws:iam::aws:policy/service-role/AmazonECSTaskExecutionRolePolicy"],
+          Policies: [
+            {
+              PolicyName: "ECRPullPolicy",
+              PolicyDocument: {
+                Version: "2012-10-17",
+                Statement: [
+                  {
+                    Effect: "Allow",
+                    Action: [
+                      "ecr:GetAuthorizationToken",
+                      "ecr:BatchCheckLayerAvailability",
+                      "ecr:GetDownloadUrlForLayer",
+                      "ecr:BatchGetImage",
+                      "logs:CreateLogStream",
+                      "logs:PutLogEvents"
+                    ],
+                    Resource: "*"
+                  }
+                ]
+              }
             }
-          }]
+          ]
         }
       });
       const taskRoleId = `${slug}${env}TaskRole`.replace(/[^a-zA-Z0-9]/g, "");
@@ -1004,37 +1403,34 @@ ${handles.join(`
           RoleName: `${slug}-${env}-ecs-task-role`,
           AssumeRolePolicyDocument: {
             Version: "2012-10-17",
-            Statement: [{
-              Effect: "Allow",
-              Principal: { Service: "ecs-tasks.amazonaws.com" },
-              Action: "sts:AssumeRole"
-            }]
+            Statement: [
+              {
+                Effect: "Allow",
+                Principal: { Service: "ecs-tasks.amazonaws.com" },
+                Action: "sts:AssumeRole"
+              }
+            ]
           },
-          Policies: [{
-            PolicyName: "TaskPolicy",
-            PolicyDocument: {
-              Version: "2012-10-17",
-              Statement: [
-                {
-                  Effect: "Allow",
-                  Action: [
-                    "logs:CreateLogStream",
-                    "logs:PutLogEvents"
-                  ],
-                  Resource: "*"
-                },
-                {
-                  Effect: "Allow",
-                  Action: [
-                    "s3:GetObject",
-                    "s3:PutObject",
-                    "s3:ListBucket"
-                  ],
-                  Resource: "*"
-                }
-              ]
+          Policies: [
+            {
+              PolicyName: "TaskPolicy",
+              PolicyDocument: {
+                Version: "2012-10-17",
+                Statement: [
+                  {
+                    Effect: "Allow",
+                    Action: ["logs:CreateLogStream", "logs:PutLogEvents"],
+                    Resource: "*"
+                  },
+                  {
+                    Effect: "Allow",
+                    Action: ["s3:GetObject", "s3:PutObject", "s3:ListBucket"],
+                    Resource: "*"
+                  }
+                ]
+              }
             }
-          }]
+          ]
         }
       });
       const logGroupId = `${slug}${env}${name}LogGroup`.replace(/[^a-zA-Z0-9]/g, "");
@@ -1059,30 +1455,37 @@ ${handles.join(`
           Memory: memory,
           ExecutionRoleArn: { "Fn::GetAtt": [execRoleId, "Arn"] },
           TaskRoleArn: { "Fn::GetAtt": [taskRoleId, "Arn"] },
-          ContainerDefinitions: [{
-            Name: name,
-            Image: { "Fn::Sub": `\${AWS::AccountId}.dkr.ecr.\${AWS::Region}.amazonaws.com/${slug}:latest` },
-            Essential: true,
-            PortMappings: [{
-              ContainerPort: port,
-              Protocol: "tcp"
-            }],
-            LogConfiguration: {
-              LogDriver: "awslogs",
-              Options: {
-                "awslogs-group": logGroupName,
-                "awslogs-region": { Ref: "AWS::Region" },
-                "awslogs-stream-prefix": name
+          ContainerDefinitions: [
+            {
+              Name: name,
+              Image: { "Fn::Sub": `\${AWS::AccountId}.dkr.ecr.\${AWS::Region}.amazonaws.com/${slug}:latest` },
+              Essential: true,
+              PortMappings: [
+                {
+                  ContainerPort: port,
+                  Protocol: "tcp"
+                }
+              ],
+              LogConfiguration: {
+                LogDriver: "awslogs",
+                Options: {
+                  "awslogs-group": logGroupName,
+                  "awslogs-region": { Ref: "AWS::Region" },
+                  "awslogs-stream-prefix": name
+                }
+              },
+              HealthCheck: {
+                Command: [
+                  "CMD-SHELL",
+                  `curl -f http://localhost:${port}${containerConfig.healthCheck || "/health"} || exit 1`
+                ],
+                Interval: 30,
+                Timeout: 5,
+                Retries: 3,
+                StartPeriod: 60
               }
-            },
-            HealthCheck: {
-              Command: ["CMD-SHELL", `curl -f http://localhost:${port}${containerConfig.healthCheck || "/health"} || exit 1`],
-              Interval: 30,
-              Timeout: 5,
-              Retries: 3,
-              StartPeriod: 60
             }
-          }],
+          ],
           Tags: [
             { Key: "Name", Value: `${slug}-${env}-${name}` },
             { Key: "Environment", Value: env }
@@ -1135,14 +1538,16 @@ ${handles.join(`
               LoadBalancerArn: { Ref: albId },
               Port: 80,
               Protocol: "HTTP",
-              DefaultActions: [{
-                Type: "redirect",
-                RedirectConfig: {
-                  Protocol: "HTTPS",
-                  Port: "443",
-                  StatusCode: "HTTP_301"
+              DefaultActions: [
+                {
+                  Type: "redirect",
+                  RedirectConfig: {
+                    Protocol: "HTTPS",
+                    Port: "443",
+                    StatusCode: "HTTP_301"
+                  }
                 }
-              }]
+              ]
             }
           });
         } else {
@@ -1152,10 +1557,12 @@ ${handles.join(`
               LoadBalancerArn: { Ref: albId },
               Port: 80,
               Protocol: "HTTP",
-              DefaultActions: [{
-                Type: "forward",
-                TargetGroupArn: { Ref: tgId }
-              }]
+              DefaultActions: [
+                {
+                  Type: "forward",
+                  TargetGroupArn: { Ref: tgId }
+                }
+              ]
             }
           });
         }
@@ -1170,10 +1577,12 @@ ${handles.join(`
                 Port: 443,
                 Protocol: "HTTPS",
                 Certificates: [{ CertificateArn: certArn }],
-                DefaultActions: [{
-                  Type: "forward",
-                  TargetGroupArn: { Ref: tgId }
-                }],
+                DefaultActions: [
+                  {
+                    Type: "forward",
+                    TargetGroupArn: { Ref: tgId }
+                  }
+                ],
                 SslPolicy: "ELBSecurityPolicy-TLS13-1-2-2021-06"
               }
             });
@@ -1196,11 +1605,13 @@ ${handles.join(`
                 Subnets: [{ Ref: "PublicSubnet1" }, { Ref: "PublicSubnet2" }]
               }
             },
-            LoadBalancers: [{
-              ContainerName: name,
-              ContainerPort: port,
-              TargetGroupArn: { Ref: tgId }
-            }],
+            LoadBalancers: [
+              {
+                ContainerName: name,
+                ContainerPort: port,
+                TargetGroupArn: { Ref: tgId }
+              }
+            ],
             HealthCheckGracePeriodSeconds: 120,
             Tags: [
               { Key: "Name", Value: `${slug}-${env}-${name}` },
@@ -1220,7 +1631,9 @@ ${handles.join(`
               ResourceId: { "Fn::Sub": `service/\${${clusterLogicalId}}/${slug}-${env}-${name}` },
               ScalableDimension: "ecs:service:DesiredCount",
               ServiceNamespace: "ecs",
-              RoleARN: { "Fn::Sub": "arn:aws:iam::${AWS::AccountId}:role/aws-service-role/ecs.application-autoscaling.amazonaws.com/AWSServiceRoleForApplicationAutoScaling_ECSService" }
+              RoleARN: {
+                "Fn::Sub": "arn:aws:iam::${AWS::AccountId}:role/aws-service-role/ecs.application-autoscaling.amazonaws.com/AWSServiceRoleForApplicationAutoScaling_ECSService"
+              }
             },
             DependsOn: serviceId
           });
@@ -1329,9 +1742,7 @@ ${handles.join(`
           environment: env,
           roleName: `${slug}-${env}-${name}-role`,
           servicePrincipal: "lambda.amazonaws.com",
-          managedPolicyArns: [
-            "arn:aws:iam::aws:policy/service-role/AWSLambdaBasicExecutionRole"
-          ]
+          managedPolicyArns: ["arn:aws:iam::aws:policy/service-role/AWSLambdaBasicExecutionRole"]
         });
         this.builder.addResource(roleLogicalId, role);
         const { lambdaFunction, logicalId } = Compute.createLambdaFunction({
@@ -1461,12 +1872,14 @@ ${handles.join(`
           RestrictPublicBuckets: true
         },
         LifecycleConfiguration: {
-          Rules: [{
-            Id: "expire-old-releases",
-            Status: "Enabled",
-            ExpirationInDays: 7,
-            Prefix: "releases/"
-          }]
+          Rules: [
+            {
+              Id: "expire-old-releases",
+              Status: "Enabled",
+              ExpirationInDays: 7,
+              Prefix: "releases/"
+            }
+          ]
         },
         Tags: [
           { Key: "Project", Value: slug },
@@ -1486,13 +1899,7 @@ ${handles.join(`
       userData,
       volumeSize: compute.disk?.size || 20,
       imageId: compute.image,
-      allowedPorts: [
-        ...compute.allowSsh ? [22] : [],
-        80,
-        443,
-        apiOriginPort,
-        ...sitePorts
-      ]
+      allowedPorts: [...compute.allowSsh ? [22] : [], 80, 443, apiOriginPort, ...sitePorts]
     });
     const instance = stack.resources[stack.outputs.instanceLogicalId];
     if (instance?.Properties) {
@@ -1512,14 +1919,13 @@ ${handles.join(`
         PolicyName: "DeployBucketRead",
         PolicyDocument: {
           Version: "2012-10-17",
-          Statement: [{
-            Effect: "Allow",
-            Action: ["s3:GetObject", "s3:ListBucket"],
-            Resource: [
-              `arn:aws:s3:::${deployBucketName}`,
-              `arn:aws:s3:::${deployBucketName}/*`
-            ]
-          }]
+          Statement: [
+            {
+              Effect: "Allow",
+              Action: ["s3:GetObject", "s3:ListBucket"],
+              Resource: [`arn:aws:s3:::${deployBucketName}`, `arn:aws:s3:::${deployBucketName}/*`]
+            }
+          ]
         }
       });
     }
@@ -1735,15 +2141,17 @@ else if (!uri.includes('.')) { request.uri += '.html'; } return request; }`
               }
             });
           }
-          const origins = [{
-            Id: originId,
-            DomainName: { "Fn::Sub": `\${${logicalId}}.s3.${region}.amazonaws.com` },
-            OriginPath: "",
-            S3OriginConfig: {
-              OriginAccessIdentity: ""
-            },
-            OriginAccessControlId: { Ref: sharedOacLogicalId }
-          }];
+          const origins = [
+            {
+              Id: originId,
+              DomainName: { "Fn::Sub": `\${${logicalId}}.s3.${region}.amazonaws.com` },
+              OriginPath: "",
+              S3OriginConfig: {
+                OriginAccessIdentity: ""
+              },
+              OriginAccessControlId: { Ref: sharedOacLogicalId }
+            }
+          ];
           const cacheBehaviors = [];
           const extraDependsOn = [];
           if (this.shouldRouteStorageBucketToCompute(name, storageConfig)) {
@@ -1782,17 +2190,24 @@ else if (!uri.includes('.')) { request.uri += '.html'; } return request; }`
                   CachedMethods: ["GET", "HEAD", "OPTIONS"],
                   Compress: true,
                   CachePolicyId: "4135ea2d-6df8-44a3-9df3-4b5a84be39ad",
-                  FunctionAssociations: [{
-                    EventType: "viewer-request",
-                    FunctionARN: { "Fn::GetAtt": [mountedFunctionLogicalId, "FunctionARN"] }
-                  }]
+                  FunctionAssociations: [
+                    {
+                      EventType: "viewer-request",
+                      FunctionARN: { "Fn::GetAtt": [mountedFunctionLogicalId, "FunctionARN"] }
+                    }
+                  ]
                 });
               }
             }
           }
           const distribution = {
             Type: "AWS::CloudFront::Distribution",
-            DependsOn: [logicalId, sharedOacLogicalId, ...cfFunctionLogicalId ? [cfFunctionLogicalId] : [], ...extraDependsOn],
+            DependsOn: [
+              logicalId,
+              sharedOacLogicalId,
+              ...cfFunctionLogicalId ? [cfFunctionLogicalId] : [],
+              ...extraDependsOn
+            ],
             Properties: {
               DistributionConfig: {
                 Enabled: true,
@@ -1807,10 +2222,12 @@ else if (!uri.includes('.')) { request.uri += '.html'; } return request; }`
                   Compress: true,
                   CachePolicyId: "658327ea-f89d-4fab-a63d-7e88639e58f6",
                   ...cfFunctionLogicalId ? {
-                    FunctionAssociations: [{
-                      EventType: "viewer-request",
-                      FunctionARN: { "Fn::GetAtt": [cfFunctionLogicalId, "FunctionARN"] }
-                    }]
+                    FunctionAssociations: [
+                      {
+                        EventType: "viewer-request",
+                        FunctionARN: { "Fn::GetAtt": [cfFunctionLogicalId, "FunctionARN"] }
+                      }
+                    ]
                   } : {}
                 },
                 ...cacheBehaviors.length > 0 ? { CacheBehaviors: cacheBehaviors } : {},
@@ -1835,20 +2252,24 @@ else if (!uri.includes('.')) { request.uri += '.html'; } return request; }`
               Bucket: { Ref: logicalId },
               PolicyDocument: {
                 Version: "2012-10-17",
-                Statement: [{
-                  Sid: "AllowCloudFrontServicePrincipal",
-                  Effect: "Allow",
-                  Principal: {
-                    Service: "cloudfront.amazonaws.com"
-                  },
-                  Action: "s3:GetObject",
-                  Resource: { "Fn::Sub": `arn:aws:s3:::\${${logicalId}}/*` },
-                  Condition: {
-                    StringEquals: {
-                      "AWS:SourceArn": { "Fn::Sub": `arn:aws:cloudfront::\${AWS::AccountId}:distribution/\${${distLogicalId}}` }
+                Statement: [
+                  {
+                    Sid: "AllowCloudFrontServicePrincipal",
+                    Effect: "Allow",
+                    Principal: {
+                      Service: "cloudfront.amazonaws.com"
+                    },
+                    Action: "s3:GetObject",
+                    Resource: { "Fn::Sub": `arn:aws:s3:::\${${logicalId}}/*` },
+                    Condition: {
+                      StringEquals: {
+                        "AWS:SourceArn": {
+                          "Fn::Sub": `arn:aws:cloudfront::\${AWS::AccountId}:distribution/\${${distLogicalId}}`
+                        }
+                      }
                     }
                   }
-                }]
+                ]
               }
             }
           });
@@ -1862,20 +2283,24 @@ else if (!uri.includes('.')) { request.uri += '.html'; } return request; }`
                   Bucket: { Ref: mountedBucket.logicalId },
                   PolicyDocument: {
                     Version: "2012-10-17",
-                    Statement: [{
-                      Sid: "AllowCloudFrontServicePrincipal",
-                      Effect: "Allow",
-                      Principal: {
-                        Service: "cloudfront.amazonaws.com"
-                      },
-                      Action: "s3:GetObject",
-                      Resource: { "Fn::Sub": `arn:aws:s3:::\${${mountedBucket.logicalId}}/*` },
-                      Condition: {
-                        StringEquals: {
-                          "AWS:SourceArn": { "Fn::Sub": `arn:aws:cloudfront::\${AWS::AccountId}:distribution/\${${distLogicalId}}` }
+                    Statement: [
+                      {
+                        Sid: "AllowCloudFrontServicePrincipal",
+                        Effect: "Allow",
+                        Principal: {
+                          Service: "cloudfront.amazonaws.com"
+                        },
+                        Action: "s3:GetObject",
+                        Resource: { "Fn::Sub": `arn:aws:s3:::\${${mountedBucket.logicalId}}/*` },
+                        Condition: {
+                          StringEquals: {
+                            "AWS:SourceArn": {
+                              "Fn::Sub": `arn:aws:cloudfront::\${AWS::AccountId}:distribution/\${${distLogicalId}}`
+                            }
+                          }
                         }
                       }
-                    }]
+                    ]
                   }
                 }
               });
@@ -2021,18 +2446,20 @@ else if (!uri.includes('.')) { request.uri += '.html'; } return request; }`
         const resolvedCertArn = explicitCertificateArn || cfCertificateArn;
         const distLogicalId = `${slug}${env}${name}CDN`.replace(/[^a-zA-Z0-9]/g, "");
         const originId = `S3-${slug}-${env}-${name}-cdn`;
-        const origins = [{
-          Id: originId,
-          DomainName: cdnConfig.origin,
-          OriginPath: "",
-          S3OriginConfig: {
-            OriginAccessIdentity: ""
-          },
-          OriginShield: cdnConfig.originShield ? {
-            Enabled: true,
-            OriginShieldRegion: cdnConfig.originShieldRegion || this.mergedConfig.environments[env]?.region || this.mergedConfig.project.region || "us-east-1"
-          } : { Enabled: false }
-        }];
+        const origins = [
+          {
+            Id: originId,
+            DomainName: cdnConfig.origin,
+            OriginPath: "",
+            S3OriginConfig: {
+              OriginAccessIdentity: ""
+            },
+            OriginShield: cdnConfig.originShield ? {
+              Enabled: true,
+              OriginShieldRegion: cdnConfig.originShieldRegion || this.mergedConfig.environments[env]?.region || this.mergedConfig.project.region || "us-east-1"
+            } : { Enabled: false }
+          }
+        ];
         const cacheBehaviors = [];
         const extraDependsOn = [];
         if (cdnConfig.routeCompute) {
@@ -2077,7 +2504,10 @@ else if (!uri.includes('.')) { request.uri += '.html'; } return request; }`
           const safeName = customDomain.replace(/\./g, "").replace(/[^a-zA-Z0-9]/g, "");
           this.builder.addResource(`${safeName}CdnARecord`, {
             Type: "AWS::Route53::RecordSet",
-            DependsOn: [distLogicalId, ...cfCertificateLogicalId && !explicitCertificateArn ? [cfCertificateLogicalId] : []],
+            DependsOn: [
+              distLogicalId,
+              ...cfCertificateLogicalId && !explicitCertificateArn ? [cfCertificateLogicalId] : []
+            ],
             Properties: {
               HostedZoneId: hostedZoneId,
               Name: customDomain,
@@ -2113,11 +2543,7 @@ else if (!uri.includes('.')) { request.uri += '.html'; } return request; }`
         this.builder.addResource(logicalId, queue);
         let dlqLogicalId;
         if (queueConfig.deadLetterQueue) {
-          const {
-            deadLetterQueue,
-            updatedSourceQueue,
-            deadLetterLogicalId
-          } = Queue.createDeadLetterQueue(logicalId, {
+          const { deadLetterQueue, updatedSourceQueue, deadLetterLogicalId } = Queue.createDeadLetterQueue(logicalId, {
             slug,
             environment: env,
             maxReceiveCount: queueConfig.maxReceiveCount
@@ -2249,15 +2675,17 @@ else if (!uri.includes('.')) { request.uri += '.html'; } return request; }`
                 Queues: [{ Ref: logicalId }],
                 PolicyDocument: {
                   Version: "2012-10-17",
-                  Statement: [{
-                    Effect: "Allow",
-                    Principal: { Service: "sns.amazonaws.com" },
-                    Action: "sqs:SendMessage",
-                    Resource: { "Fn::GetAtt": [logicalId, "Arn"] },
-                    Condition: {
-                      ArnEquals: { "aws:SourceArn": topicArn }
+                  Statement: [
+                    {
+                      Effect: "Allow",
+                      Principal: { Service: "sns.amazonaws.com" },
+                      Action: "sqs:SendMessage",
+                      Resource: { "Fn::GetAtt": [logicalId, "Arn"] },
+                      Condition: {
+                        ArnEquals: { "aws:SourceArn": topicArn }
+                      }
                     }
-                  }]
+                  ]
                 }
               }
             });
@@ -2349,10 +2777,7 @@ else if (!uri.includes('.')) { request.uri += '.html'; } return request; }`
           transitEncryption: true,
           snapshotRetentionDays: redisConfig.snapshotRetentionLimit || 7,
           snapshotWindow: redisConfig.snapshotWindow,
-          subnetIds: [
-            { Ref: "PublicSubnet1" },
-            { Ref: "PublicSubnet2" }
-          ]
+          subnetIds: [{ Ref: "PublicSubnet1" }, { Ref: "PublicSubnet2" }]
         });
         this.builder.addResource(logicalId, replicationGroup);
         if (subnetGroup && subnetGroupId) {
@@ -2375,10 +2800,7 @@ else if (!uri.includes('.')) { request.uri += '.html'; } return request; }`
           nodeType: mcConfig.nodeType || cacheConfig.nodeType || "cache.t3.micro",
           engineVersion: mcConfig.engineVersion || "1.6.22",
           numCacheNodes: mcConfig.numCacheNodes || 2,
-          subnetIds: [
-            { Ref: "PublicSubnet1" },
-            { Ref: "PublicSubnet2" }
-          ]
+          subnetIds: [{ Ref: "PublicSubnet1" }, { Ref: "PublicSubnet2" }]
         });
         this.builder.addResource(logicalId, cluster);
         if (subnetGroup && subnetGroupId) {
@@ -2571,10 +2993,7 @@ else if (!uri.includes('.')) { request.uri += '.html'; } return request; }`
         const { mountTargets, logicalIds: mtLogicalIds } = FileSystem.createMultiAzMountTargets(fsLogicalId, {
           slug: `${slug}-${name}`,
           environment: env,
-          subnetIds: [
-            { Ref: "PublicSubnet1" },
-            { Ref: "PublicSubnet2" }
-          ],
+          subnetIds: [{ Ref: "PublicSubnet1" }, { Ref: "PublicSubnet2" }],
           securityGroupId: { Ref: sgLogicalId }
         });
         for (let i = 0;i < mountTargets.length; i++) {
@@ -2661,15 +3080,11 @@ else if (!uri.includes('.')) { request.uri += '.html'; } return request; }`
             { AttributeName: "connectionId", AttributeType: "S" },
             { AttributeName: "userId", AttributeType: "S" }
           ],
-          KeySchema: [
-            { AttributeName: "connectionId", KeyType: "HASH" }
-          ],
+          KeySchema: [{ AttributeName: "connectionId", KeyType: "HASH" }],
           GlobalSecondaryIndexes: [
             {
               IndexName: "userId-index",
-              KeySchema: [
-                { AttributeName: "userId", KeyType: "HASH" }
-              ],
+              KeySchema: [{ AttributeName: "userId", KeyType: "HASH" }],
               Projection: { ProjectionType: "ALL" },
               ...billingMode === "PROVISIONED" && {
                 ProvisionedThroughput: {
@@ -2714,9 +3129,7 @@ else if (!uri.includes('.')) { request.uri += '.html'; } return request; }`
           GlobalSecondaryIndexes: [
             {
               IndexName: "connectionId-index",
-              KeySchema: [
-                { AttributeName: "connectionId", KeyType: "HASH" }
-              ],
+              KeySchema: [{ AttributeName: "connectionId", KeyType: "HASH" }],
               Projection: { ProjectionType: "ALL" },
               ...billingMode === "PROVISIONED" && {
                 ProvisionedThroughput: {
@@ -2750,45 +3163,47 @@ else if (!uri.includes('.')) { request.uri += '.html'; } return request; }`
         RoleName: `${slug}-${env}-realtime-handler-role`,
         AssumeRolePolicyDocument: {
           Version: "2012-10-17",
-          Statement: [{
-            Effect: "Allow",
-            Principal: { Service: "lambda.amazonaws.com" },
-            Action: "sts:AssumeRole"
-          }]
+          Statement: [
+            {
+              Effect: "Allow",
+              Principal: { Service: "lambda.amazonaws.com" },
+              Action: "sts:AssumeRole"
+            }
+          ]
         },
-        ManagedPolicyArns: [
-          "arn:aws:iam::aws:policy/service-role/AWSLambdaBasicExecutionRole"
-        ],
-        Policies: [{
-          PolicyName: "RealtimeHandlerPolicy",
-          PolicyDocument: {
-            Version: "2012-10-17",
-            Statement: [
-              {
-                Effect: "Allow",
-                Action: [
-                  "dynamodb:GetItem",
-                  "dynamodb:PutItem",
-                  "dynamodb:DeleteItem",
-                  "dynamodb:Query",
-                  "dynamodb:Scan",
-                  "dynamodb:UpdateItem"
-                ],
-                Resource: [
-                  { "Fn::GetAtt": [connectionsTableId, "Arn"] },
-                  { "Fn::Sub": `\${${connectionsTableId}.Arn}/index/*` },
-                  { "Fn::GetAtt": [channelsTableId, "Arn"] },
-                  { "Fn::Sub": `\${${channelsTableId}.Arn}/index/*` }
-                ]
-              },
-              {
-                Effect: "Allow",
-                Action: "execute-api:ManageConnections",
-                Resource: { "Fn::Sub": "arn:aws:execute-api:${AWS::Region}:${AWS::AccountId}:*/*" }
-              }
-            ]
+        ManagedPolicyArns: ["arn:aws:iam::aws:policy/service-role/AWSLambdaBasicExecutionRole"],
+        Policies: [
+          {
+            PolicyName: "RealtimeHandlerPolicy",
+            PolicyDocument: {
+              Version: "2012-10-17",
+              Statement: [
+                {
+                  Effect: "Allow",
+                  Action: [
+                    "dynamodb:GetItem",
+                    "dynamodb:PutItem",
+                    "dynamodb:DeleteItem",
+                    "dynamodb:Query",
+                    "dynamodb:Scan",
+                    "dynamodb:UpdateItem"
+                  ],
+                  Resource: [
+                    { "Fn::GetAtt": [connectionsTableId, "Arn"] },
+                    { "Fn::Sub": `\${${connectionsTableId}.Arn}/index/*` },
+                    { "Fn::GetAtt": [channelsTableId, "Arn"] },
+                    { "Fn::Sub": `\${${channelsTableId}.Arn}/index/*` }
+                  ]
+                },
+                {
+                  Effect: "Allow",
+                  Action: "execute-api:ManageConnections",
+                  Resource: { "Fn::Sub": "arn:aws:execute-api:${AWS::Region}:${AWS::AccountId}:*/*" }
+                }
+              ]
+            }
           }
-        }]
+        ]
       }
     });
     const connectHandlerId = `${slug}${env}RealtimeConnect`.replace(/[^a-zA-Z0-9]/g, "");
@@ -2911,7 +3326,9 @@ else if (!uri.includes('.')) { request.uri += '.html'; } return request; }`
       Properties: {
         ApiId: { Ref: apiId },
         IntegrationType: "AWS_PROXY",
-        IntegrationUri: { "Fn::Sub": `arn:aws:apigateway:\${AWS::Region}:lambda:path/2015-03-31/functions/\${${connectHandlerId}.Arn}/invocations` }
+        IntegrationUri: {
+          "Fn::Sub": `arn:aws:apigateway:\${AWS::Region}:lambda:path/2015-03-31/functions/\${${connectHandlerId}.Arn}/invocations`
+        }
       }
     });
     this.builder.addResource(disconnectIntegId, {
@@ -2919,7 +3336,9 @@ else if (!uri.includes('.')) { request.uri += '.html'; } return request; }`
       Properties: {
         ApiId: { Ref: apiId },
         IntegrationType: "AWS_PROXY",
-        IntegrationUri: { "Fn::Sub": `arn:aws:apigateway:\${AWS::Region}:lambda:path/2015-03-31/functions/\${${disconnectHandlerId}.Arn}/invocations` }
+        IntegrationUri: {
+          "Fn::Sub": `arn:aws:apigateway:\${AWS::Region}:lambda:path/2015-03-31/functions/\${${disconnectHandlerId}.Arn}/invocations`
+        }
       }
     });
     this.builder.addResource(messageIntegId, {
@@ -2927,7 +3346,9 @@ else if (!uri.includes('.')) { request.uri += '.html'; } return request; }`
       Properties: {
         ApiId: { Ref: apiId },
         IntegrationType: "AWS_PROXY",
-        IntegrationUri: { "Fn::Sub": `arn:aws:apigateway:\${AWS::Region}:lambda:path/2015-03-31/functions/\${${messageHandlerId}.Arn}/invocations` }
+        IntegrationUri: {
+          "Fn::Sub": `arn:aws:apigateway:\${AWS::Region}:lambda:path/2015-03-31/functions/\${${messageHandlerId}.Arn}/invocations`
+        }
       }
     });
     this.builder.addResource(`${apiId}ConnectRoute`, {
@@ -3260,15 +3681,15 @@ catch (error) {
         RoleName: `${slug}-${env}-realtime-exec-role`,
         AssumeRolePolicyDocument: {
           Version: "2012-10-17",
-          Statement: [{
-            Effect: "Allow",
-            Principal: { Service: "ecs-tasks.amazonaws.com" },
-            Action: "sts:AssumeRole"
-          }]
+          Statement: [
+            {
+              Effect: "Allow",
+              Principal: { Service: "ecs-tasks.amazonaws.com" },
+              Action: "sts:AssumeRole"
+            }
+          ]
         },
-        ManagedPolicyArns: [
-          "arn:aws:iam::aws:policy/service-role/AmazonECSTaskExecutionRolePolicy"
-        ]
+        ManagedPolicyArns: ["arn:aws:iam::aws:policy/service-role/AmazonECSTaskExecutionRolePolicy"]
       }
     });
     this.builder.addResource(taskRoleId, {
@@ -3277,36 +3698,36 @@ catch (error) {
         RoleName: `${slug}-${env}-realtime-task-role`,
         AssumeRolePolicyDocument: {
           Version: "2012-10-17",
-          Statement: [{
-            Effect: "Allow",
-            Principal: { Service: "ecs-tasks.amazonaws.com" },
-            Action: "sts:AssumeRole"
-          }]
+          Statement: [
+            {
+              Effect: "Allow",
+              Principal: { Service: "ecs-tasks.amazonaws.com" },
+              Action: "sts:AssumeRole"
+            }
+          ]
         },
-        Policies: [{
-          PolicyName: "RealtimeTaskPolicy",
-          PolicyDocument: {
-            Version: "2012-10-17",
-            Statement: [
-              {
-                Effect: "Allow",
-                Action: [
-                  "logs:CreateLogStream",
-                  "logs:PutLogEvents"
-                ],
-                Resource: "*"
-              },
-              ...serverConfig.redis?.enabled ? [{
-                Effect: "Allow",
-                Action: [
-                  "elasticache:DescribeCacheClusters",
-                  "elasticache:DescribeReplicationGroups"
-                ],
-                Resource: "*"
-              }] : []
-            ]
+        Policies: [
+          {
+            PolicyName: "RealtimeTaskPolicy",
+            PolicyDocument: {
+              Version: "2012-10-17",
+              Statement: [
+                {
+                  Effect: "Allow",
+                  Action: ["logs:CreateLogStream", "logs:PutLogEvents"],
+                  Resource: "*"
+                },
+                ...serverConfig.redis?.enabled ? [
+                  {
+                    Effect: "Allow",
+                    Action: ["elasticache:DescribeCacheClusters", "elasticache:DescribeReplicationGroups"],
+                    Resource: "*"
+                  }
+                ] : []
+              ]
+            }
           }
-        }]
+        ]
       }
     });
     const envVars = [
@@ -3336,31 +3757,38 @@ catch (error) {
         Memory: "1024",
         ExecutionRoleArn: { "Fn::GetAtt": [execRoleId, "Arn"] },
         TaskRoleArn: { "Fn::GetAtt": [taskRoleId, "Arn"] },
-        ContainerDefinitions: [{
-          Name: "realtime",
-          Image: { "Fn::Sub": `\${AWS::AccountId}.dkr.ecr.\${AWS::Region}.amazonaws.com/${slug}-realtime:latest` },
-          Essential: true,
-          PortMappings: [{
-            ContainerPort: port,
-            Protocol: "tcp"
-          }],
-          Environment: envVars,
-          LogConfiguration: {
-            LogDriver: "awslogs",
-            Options: {
-              "awslogs-group": `/ecs/${slug}-${env}-realtime`,
-              "awslogs-region": { Ref: "AWS::Region" },
-              "awslogs-stream-prefix": "realtime"
+        ContainerDefinitions: [
+          {
+            Name: "realtime",
+            Image: { "Fn::Sub": `\${AWS::AccountId}.dkr.ecr.\${AWS::Region}.amazonaws.com/${slug}-realtime:latest` },
+            Essential: true,
+            PortMappings: [
+              {
+                ContainerPort: port,
+                Protocol: "tcp"
+              }
+            ],
+            Environment: envVars,
+            LogConfiguration: {
+              LogDriver: "awslogs",
+              Options: {
+                "awslogs-group": `/ecs/${slug}-${env}-realtime`,
+                "awslogs-region": { Ref: "AWS::Region" },
+                "awslogs-stream-prefix": "realtime"
+              }
+            },
+            HealthCheck: {
+              Command: [
+                "CMD-SHELL",
+                `curl -f http://localhost:${port}${serverConfig.healthCheckPath || "/health"} || exit 1`
+              ],
+              Interval: 30,
+              Timeout: 5,
+              Retries: 3,
+              StartPeriod: 60
             }
-          },
-          HealthCheck: {
-            Command: ["CMD-SHELL", `curl -f http://localhost:${port}${serverConfig.healthCheckPath || "/health"} || exit 1`],
-            Interval: 30,
-            Timeout: 5,
-            Retries: 3,
-            StartPeriod: 60
           }
-        }],
+        ],
         Tags: [
           { Key: "Name", Value: `${slug}-${env}-realtime` },
           { Key: "Environment", Value: env }
@@ -3409,7 +3837,9 @@ catch (error) {
           MaxCapacity: scalingConfig.max || 10,
           MinCapacity: scalingConfig.min || 1,
           ResourceId: { "Fn::Sub": `service/\${ECSCluster}/${slug}-${env}-realtime` },
-          RoleARN: { "Fn::Sub": "arn:aws:iam::${AWS::AccountId}:role/aws-service-role/ecs.application-autoscaling.amazonaws.com/AWSServiceRoleForApplicationAutoScaling_ECSService" },
+          RoleARN: {
+            "Fn::Sub": "arn:aws:iam::${AWS::AccountId}:role/aws-service-role/ecs.application-autoscaling.amazonaws.com/AWSServiceRoleForApplicationAutoScaling_ECSService"
+          },
           ScalableDimension: "ecs:service:DesiredCount",
           ServiceNamespace: "ecs"
         },
@@ -4240,12 +4670,7 @@ echo "Certificate auto-renewal configured"
 `;
 }
 function generateHttpsServerCode(options) {
-  const {
-    httpPort = 80,
-    httpsPort = 443,
-    certPath = "/etc/ssl/stacks",
-    redirectHttp = true
-  } = options;
+  const { httpPort = 80, httpsPort = 443, certPath = "/etc/ssl/stacks", redirectHttp = true } = options;
   return `
 // HTTPS Server with Let's Encrypt certificates
 import { readFileSync, existsSync } from 'node:fs'
@@ -4355,15 +4780,17 @@ async function setupDns01Challenge(options) {
       HostedZoneId: hostedZoneId,
       ChangeBatch: {
         Comment: "ACME DNS-01 challenge",
-        Changes: [{
-          Action: "UPSERT",
-          ResourceRecordSet: {
-            Name: `_acme-challenge.${domain}`,
-            Type: "TXT",
-            TTL: 60,
-            ResourceRecords: [{ Value: `"${challengeValue}"` }]
+        Changes: [
+          {
+            Action: "UPSERT",
+            ResourceRecordSet: {
+              Name: `_acme-challenge.${domain}`,
+              Type: "TXT",
+              TTL: 60,
+              ResourceRecords: [{ Value: `"${challengeValue}"` }]
+            }
           }
-        }]
+        ]
       }
     });
     return;
@@ -4390,15 +4817,17 @@ async function cleanupDns01Challenge(options) {
       HostedZoneId: hostedZoneId,
       ChangeBatch: {
         Comment: "Remove ACME DNS-01 challenge",
-        Changes: [{
-          Action: "DELETE",
-          ResourceRecordSet: {
-            Name: `_acme-challenge.${domain}`,
-            Type: "TXT",
-            TTL: 60,
-            ResourceRecords: [{ Value: `"${challengeValue}"` }]
+        Changes: [
+          {
+            Action: "DELETE",
+            ResourceRecordSet: {
+              Name: `_acme-challenge.${domain}`,
+              Type: "TXT",
+              TTL: 60,
+              ResourceRecords: [{ Value: `"${challengeValue}"` }]
+            }
           }
-        }]
+        ]
       }
     });
     return;
@@ -4408,14 +4837,17 @@ async function cleanupDns01Challenge(options) {
 function needsRenewal(certPath) {
   try {
     const { execSync } = __require("node:child_process");
-    const _result = execSync(`openssl x509 -checkend 2592000 -noout -in ${certPath}/cert.pem`, { encoding: "utf-8", stdio: ["pipe", "pipe", "pipe"] });
+    const _result = execSync(`openssl x509 -checkend 2592000 -noout -in ${certPath}/cert.pem`, {
+      encoding: "utf-8",
+      stdio: ["pipe", "pipe", "pipe"]
+    });
     return false;
   } catch {
     return true;
   }
 }
 // src/ssl/acme-client.ts
-import { createHash, createSign, generateKeyPairSync } from "node:crypto";
+import { createHash, createSign as createSign2, generateKeyPairSync } from "node:crypto";
 var ACME_DIRECTORIES = {
   production: "https://acme-v02.api.letsencrypt.org/directory",
   staging: "https://acme-staging-v02.api.letsencrypt.org/directory"
@@ -4508,7 +4940,7 @@ class AcmeClient {
     const protectedB64 = this.base64UrlEncode(JSON.stringify(protectedHeader));
     const payloadB64 = payload === "" ? "" : this.base64UrlEncode(JSON.stringify(payload));
     const signatureInput = `${protectedB64}.${payloadB64}`;
-    const sign = createSign("SHA256");
+    const sign = createSign2("SHA256");
     sign.update(signatureInput);
     const signature = sign.sign(this.accountKey);
     const r = signature.subarray(4, 4 + signature[3]);
@@ -4667,6 +5099,7 @@ class AcmeClient {
   }
 }
 export {
+  zeroCapacity,
   xrayManager,
   wrapCloudInitUserData,
   withTimeout,
@@ -4676,20 +5109,45 @@ export {
   withDatabase,
   withCache,
   withCDN,
+  webhookEndpoint,
   waitForSsh,
   waitForCloudInit,
+  volumeCapabilities,
+  verifyUpdateSignature,
+  verifyTotp,
+  verifyMediaAccessToken,
+  verifyArtifactSignature,
   validateTemplateSize,
   validateTemplate,
   validateResourceLimits,
+  validateMountPath,
   validateDeploymentConfig,
   validateCredentials,
   validateConfiguration,
   validateCommand,
+  validateBackupDestination,
+  validateAttachment,
   validateAgainstSchema,
   validateAccountStructure,
   uploadStaticFiles,
+  updateCompatibility,
+  unsupportedVolumeCapabilities,
+  unsupportedCapabilities,
+  totpUri,
+  totp,
+  testSourceConnection,
   templateCache,
+  telemetryPolicyKey,
+  telemetryPercentile,
+  telemetryEstimatedMonthlyCost,
+  telemetryCursor,
+  telemetryBucketLabel,
+  systemdWorkloads,
   syntheticsManager,
+  synchronizeConfiguredJobs,
+  synchronizeConfiguredConfiguration,
+  synchronizeComposeVolumes,
+  syncSourceRepositories,
   suggestRegions,
   suggestRegionPairs,
   suggestQuotaIncrease,
@@ -4704,28 +5162,43 @@ export {
   sshExec,
   signRequestAsync,
   signRequest,
+  signCloudFrontUrl,
+  signCloudFrontCookies,
   sharedRuntimeLoop,
   sha256,
   setupDns01Challenge,
   setMaintenance,
   serviceMeshManager,
   serverPublicIpv4,
+  serializeDotenv,
   sequence,
   senderReputationManager,
+  sendAuthenticationEmail,
+  securityScope,
   securityScanningManager,
   securityHubManager,
+  secureContainerRelease,
   secretsRotationManager,
   secretsManager,
+  searchControlPlane,
   searchCommands,
   scpUpload,
+  scopeContains,
+  scanForSecrets,
+  saveTelemetryPolicy,
+  sanitizeOidcReturnPath,
   sanitizeName,
+  sanitizeControlPlaneValue,
   sanitizeCloudConfig,
+  runtimeId,
   runRemoteCommand,
   runPhpBuildHooks,
   runBuildHooks,
   route53RoutingManager,
   route53ResolverManager,
   rollbackServerlessApp,
+  rollbackImmutableRelease,
+  roleCapabilities,
   responseToResult,
   resourceManagementManager,
   resolveUiSource,
@@ -4739,8 +5212,10 @@ export {
   resolveServerlessAssetBucketName,
   resolveServerlessArtifactBucketName,
   resolveServerlessAppStackName,
+  resolveRuntimeInventory,
   resolveRegion,
   resolveQueues,
+  resolveQueuedDeploymentCommand,
   resolveQueueNames,
   resolveProjectStackName,
   resolveObjectStorage,
@@ -4756,34 +5231,66 @@ export {
   resolveDashboardAction,
   resolveCredentials,
   resolveCloudProvider,
+  resolveAuthEncryptionKey,
   resolveAppDatabase,
   resolveApp,
   requiresReplacement,
+  requestHash,
   replicaManager,
+  renderServerCron,
+  renderComposeTemplate,
   removeStaleServerAddressRecords,
+  removeSourceWebhook,
   remapKey,
+  releaseTrafficPlan,
+  releaseStrategyCapabilities,
   regionPairManager,
   redeployServerlessApp,
+  redactTelemetryValue,
+  redactTelemetryText,
+  redactRuntimeConfig,
+  recordSkippedSecretScan,
+  recordPreDeploySecretScan,
+  recordDashboardHostPosture,
+  reconcileSourceWebhook,
+  reconcileJobObservation,
   quickHash,
   queueManagementManager,
+  publicKeyFingerprint,
   providerEndpoint,
   progressiveDeploymentManager,
+  productionChangeReview,
+  processSourceWebhook,
   processInChunks,
+  previewSchedule,
   previewNotifications,
   previewManager,
+  planComposeTemplateUpgrade,
   phpRuntimeLayerAssets,
   phpLayerPackages,
   phpLayerBuildStage,
   performanceManager,
+  pathTemplate,
   parseXMLResponse,
+  parseSystemdRecords,
   parseJSONResponse,
+  parseDotenv,
+  parseDockerInspect,
+  parseComposeCatalog,
+  parseCompose,
   parallelWithRetry,
   parallelMap,
   parallel,
   packageServerlessApp,
   packagePhpApp,
   organizationManager,
+  openApiDocument,
+  normalizeTelemetryPolicy,
   normalizeSshPublicKey,
+  normalizeSourceEvent,
+  normalizeScheduleExpression,
+  normalizeRuntimeStatus,
+  nextScheduleRuns,
   networkSecurityManager,
   needsRenewal,
   multiRegionManager,
@@ -4792,13 +5299,21 @@ export {
   migrateObjectStorage,
   metricsManager,
   mergeInfrastructure,
+  mediaObjectHeaders,
+  matchTotpCounter,
+  manifestDigest,
   managementDashboardSiteName,
   makeAWSRequestOnce,
   makeAWSRequestAsync,
   makeAWSRequest,
+  maintenanceWindowOpen,
   logsManager,
+  loadTelemetryPolicy,
   loadCloudConfig,
+  listSourceReferences,
+  listComposeTemplates,
   laravelServerlessEnvDefaults,
+  lambdaWorkloads,
   lambdaVersionsManager,
   lambdaVPCManager,
   lambdaLayersManager,
@@ -4806,8 +5321,10 @@ export {
   lambdaDLQManager,
   lambdaConcurrencyManager,
   keyMatchesFilters,
+  jobProviderCapability,
   isWebCryptoAvailable,
   isValidRegion,
+  isQuietHours,
   isNodeCryptoAvailable,
   isManagementDashboardSiteName,
   isLocalDevelopment,
@@ -4815,6 +5332,7 @@ export {
   invalidateCache,
   infraEnvFromOutputs,
   imageScanningManager,
+  hotp,
   healthCheckManager,
   hashString,
   hashManifest,
@@ -4845,6 +5363,7 @@ export {
   getCredentials,
   getContextualHelp,
   getConfig,
+  getComposeTemplate,
   getCommandUsage,
   getClosestRegion,
   getAllRegions,
@@ -4868,11 +5387,13 @@ export {
   generateManualPipeline,
   generateLogicalId,
   generateLetsEncryptUserData,
+  generateImageSbom,
   generateHttpsServerCode,
   generateExternalDnsStaticSiteTemplate,
   generateDeploymentWorkflow,
   generateDeploymentPipeline,
   generateDeploymentConfig,
+  generateCycloneDxSbom,
   generateCrossAccountRoleCF,
   generateCostReportWorkflow,
   generateCleanupWorkflow,
@@ -4887,6 +5408,7 @@ export {
   formatTree,
   formatTable,
   formatSuggestion,
+  formatScanResults,
   formatRegionList,
   formatRegion,
   formatProgressBar,
@@ -4902,22 +5424,37 @@ export {
   findChangedFiles,
   fifoQueueManager,
   extendPreset,
+  exportCompose,
   eventToRequest,
+  eventBridgeScheduleInput,
+  evaluateTelemetryAlertRules,
   ensureSshKey,
   ensureServer,
   ensureManagementDashboard,
   ensureFirewall,
+  ensureDefaultSecurityPolicies,
+  encryptBackup,
+  encodeBase32,
   emailTemplateManager,
   emailAnalyticsManager,
+  effectiveCapabilities,
+  ecsWorkloads,
   drManager,
+  documentDigest,
+  dockerWorkloads,
   dnssecManager,
   dnsProviders,
   dlqMonitoringManager,
+  discoverRuntimeInventory,
+  discoverOidcProvider,
+  discoverGitRefs,
   diffTemplates,
+  diffCompose,
   detectServiceRegion,
   detectMisconfigurations,
   detectDnsProvider,
   detectDeploymentTargets,
+  desiredState as desiredJobProviderState,
   deriveManagementDashboardPort,
   deploymentCoexistenceError,
   deployStaticSiteWithExternalDnsFull,
@@ -4931,17 +5468,29 @@ export {
   deleteStaticSite,
   defaultLocalConfig,
   defaultConfig,
+  decryptBackup,
+  decompressBackup,
+  decodeBase32,
   databaseUserManager,
+  dataServiceCapabilities,
   dashboardActions,
   crossRegionReferenceManager,
   createZip,
   createWordPressPreset,
+  createVolumeQueueHandlers,
   createTraditionalWebAppPreset,
   createStaticSitePreset,
+  createSourceAdapter,
   createServerlessNodePreset,
   createServerlessLaravelPreset,
+  createServerBuildDriver,
   createS3Client,
+  createRuntimeAdapters,
   createRoute53Validator,
+  createRemoteBuildQueueHandlers,
+  createReleaseQueueHandlers,
+  createReleaseProvenance,
+  createRegionQueueHandlers,
   createRealtimeAppPreset,
   createQueueHandler,
   createPresignedUrlAsync,
@@ -4953,30 +5502,49 @@ export {
   createNodeJsServerPreset,
   createMockAWS,
   createMicroservicesPreset,
+  createMediaAccessToken,
+  createMaintenanceQueueHandlers,
   createMLApiPreset,
   createLaravelPreset,
+  createJobQueueHandlers,
   createJamstackPreset,
   createHttpHandler,
   createHandlers,
   createGoDaddyValidator,
   createFullStackAppPreset,
+  createFleetQueueHandlers,
+  createExistingStaticFullStackPreset,
   createError,
+  createEcsBuildDriver,
   createDnsProvider,
+  createDeploymentQueueHandlers,
+  createDataServiceQueueHandlers,
   createDataPipelinePreset,
   createDashboardSite,
   createCredentialProvider,
+  createCloudFrontPolicy,
   createCloudDriver,
   createCliHandler,
+  createBackupQueueHandlers,
+  createAsgBuildDriver,
+  createApiV1Handler,
   createApiBackendPreset,
+  controlPlaneMigrations,
   containerRegistryManager,
+  connectionGuidance,
   config,
+  compressBackup,
   composeServerlessAppTemplate,
+  composeProjectName,
   composePresets,
+  completeOidcAuthorization,
+  completeComposeVolumeDeletion,
   collectServerDnsDomains,
   collectPhpAppEntries,
   cloudTrailManager,
   cloudDrivers,
   cloud_config_schema_default as cloudConfigSchema,
+  cloneSourceBinding,
   clearSigningKeyCache,
   cleanupDns01Challenge,
   chunk,
@@ -4984,40 +5552,72 @@ export {
   checkIAMPermissions,
   certificateManager,
   categorizeChanges,
+  capacity,
+  capabilities,
+  canonicalJson,
   canaryManager,
+  bytes,
   buildStaticSiteDeployScript,
   buildSshArgs,
   buildSiteDeployScript,
   buildPhpRuntimeLayerZip,
   buildOptimizationManager,
   buildNodeRuntimeLayerZip,
+  buildMediaCdnPlan,
   buildManagementDashboardArtifact,
   buildHostCleanupScript,
   buildFunctionEnv,
+  buildComposeShellCommand,
+  buildComposeScaleCommand,
+  buildComposeRuntimeCommand,
+  buildComposeLogsCommand,
   buildCloudFormationTemplate,
   buildBunRuntimeLayerZip,
   buildAndPushServerlessImage,
   bounceComplaintHandler,
   blueGreenManager,
+  beginOidcAuthorization,
   batchProcessingManager,
   batch,
   backupManager,
+  backupCredentialStatus,
   awsConfigManager,
   autocomplete,
+  authorizeRuntimePath,
+  authorizeOrganization,
+  attachVulnerabilitySummary,
+  attachSbomToRelease,
+  attachProvenanceToRelease,
+  assertReleaseStrategy,
   artifactKey,
   analyzeStackDiff,
+  ageSeconds,
+  activateImmutableRelease,
   abTestManager,
   XRayManager,
   Workflow,
+  VolumeStore,
+  VolumeService,
   VoiceClient,
   ValidationError,
+  UnsupportedSchemaVersionError,
   UnifiedDnsValidator,
+  UnavailableRegionalDriver,
+  TsCloudClient,
+  TsCloudApiError,
+  TrivyImageScanner,
+  TransportRemoteBuildDriver,
+  TransportPlatformMaintenanceDriver,
+  TransportDisasterRecoveryDriver,
   TranslateClient,
   TranscribeClient,
   TextractClient,
   TemplateCache,
   TemplateBuilder,
+  TelemetryStore,
   TaskList,
+  SystemdDiscoveryAdapter,
+  SystemFleetSshTransport,
   SyntheticsManager,
   SupportClient,
   StorageAdvancedManager,
@@ -5025,20 +5625,29 @@ export {
   StaticSiteManager,
   StacksIntegration,
   StackDependencyManager,
+  SshFleetDriver,
   Spinner,
+  SourceProviderError,
+  SourceConnectionStore,
   exports_send as SmsHandlers,
   SmsClient,
   exports_advanced3 as SmsAdvanced,
   Sftp,
   ServiceMeshManager,
+  ServerPathVolumeDriver,
+  ServerDataAdapter,
+  ServerCronJobAdapter,
   SenderReputationManager,
   SecurityScanningManager,
+  SecurityScannerRunner,
+  SecurityPostureStore,
   SecurityHubManager,
   Security,
   SecretsRotationManager,
   SecretsManagerClient,
   SecretsManager,
   Secrets,
+  SecretFindingScanner,
   Search,
   SchedulerClient,
   STSClient,
@@ -5047,17 +5656,27 @@ export {
   SNSClient,
   SMS,
   SESClient,
+  SECRET_PATTERNS,
   S3Error,
   S3Client,
+  S3BackupDestinationAdapter,
+  RuntimeStreamRegistry,
+  RuntimeOperationService,
   Route53RoutingManager,
   Route53ResolverManager,
   Route53Provider,
   Route53DomainsClient,
   Route53Client,
+  RetryableOperationError,
   ResourceManagementManager,
   ReplicaManager,
+  RemoteBuildService,
+  ReleaseStore,
+  ReleaseService,
   RekognitionClient,
   Registry,
+  RegionStore,
+  RegionService,
   RegionPairManager,
   Redirects,
   RealtimePresets,
@@ -5065,19 +5684,27 @@ export {
   REPLContext,
   REPLCommandBuilder,
   REPL,
+  RELEASE_QUEUE_KINDS,
   RECOMMENDED_SCPS,
   RECOMMENDED_ACCOUNT_STRUCTURES,
   RDSClient,
+  QueueTimeoutError,
   QueuePresets,
   QueueManagementManager,
+  QueueCancellationError,
   Queue,
   Pseudo,
   ProgressiveDeploymentManager,
   ProgressBar,
   PreviewNotificationService,
+  PreviewEnvironmentStore,
+  PreviewEnvironmentService,
   PreviewEnvironmentManager,
+  PreDeployScanner,
   PorkbunProvider,
   PollyClient,
+  PlacementStore,
+  PlacementService,
   exports_incoming_call as PhoneHandlers,
   exports_advanced2 as PhoneAdvanced,
   Phone,
@@ -5088,7 +5715,9 @@ export {
   PHP_LAYER_EXTENSIONS,
   PHP_DEFAULT_EXCLUDES,
   OrganizationManager,
+  OptimisticConcurrencyError,
   OpenSearchClient,
+  NotificationRouter,
   NetworkSecurityManager,
   Network,
   MultiStepProgress,
@@ -5101,12 +5730,19 @@ export {
   MigrationManager,
   MetricsManager,
   Messaging,
+  MaintenanceStore,
+  MaintenanceService,
+  MAX_CONTROL_PLANE_JSON_BYTES,
+  MAX_CONTROL_PLANE_ERROR_BYTES,
   MANAGEMENT_DASHBOARD_SITE_PREFIX,
   MANAGEMENT_DASHBOARD_SITE,
   MANAGED_NODE_VERSIONS,
   LogsManager,
+  LogicalDatabaseBackupSource,
+  LocalEncryptedConfigurationBackend,
   LambdaVersionsManager,
   LambdaVPCManager,
+  LambdaRuntimeAdapter,
   LambdaLayersManager,
   LambdaDestinationsManager,
   LambdaDLQManager,
@@ -5114,23 +5750,37 @@ export {
   LambdaClient,
   LARAVEL_SERVERLESS_BUILD_STEPS,
   KendraClient,
+  JobStore,
+  JobService,
+  JobProviderReconciler,
   JobLoader,
+  InvalidOperationTransitionError,
   InfrastructureGenerator,
   ImageScanningManager,
   IAMClient,
   HetznerDriver,
   HetznerClient,
+  HealthCheckRunner,
   HealthCheckManager,
   HashCache,
   GuardDutyManager,
   GoDaddyProvider,
   GlobalResourceManager,
+  GitlabSourceAdapter,
+  GithubSourceAdapter,
+  GiteaSourceAdapter,
   Fn2 as Fn,
+  FleetStore,
+  FleetService,
+  FilesystemBackupSource,
   FileSystem,
   FileCache,
   FIFOQueueManager,
+  ExternalConfigurationBackend,
+  EventBridgeJobAdapter,
   EventBridgeClient,
   ErrorCodes,
+  EncryptedDataSecretStore,
   EmailTemplateManager,
   exports_inbound as EmailHandlers,
   EmailClient,
@@ -5138,12 +5788,19 @@ export {
   exports_advanced as EmailAdvanced,
   Email,
   ElastiCacheClient,
+  EcsRuntimeAdapter,
   ELBv2Client,
   EFSClient,
   ECSClient,
   ECRClient,
   EC2Client,
   DynamoDBClient,
+  DurableQueueWorker,
+  DurableOperationQueue,
+  DockerVolumeBackupSource,
+  DockerNamedVolumeDriver,
+  DockerDiscoveryAdapter,
+  DockerDataTransport,
   DnsProviderFactory,
   DisasterRecoveryManager,
   DeploymentError,
@@ -5152,9 +5809,14 @@ export {
   DebugLogger,
   DatabaseUserManager,
   Database,
+  DataServiceStore,
+  DataServiceLifecycle,
   DNSSECManager,
   DNS,
   DLQMonitoringManager,
+  DIAGNOSTIC_PRESETS,
+  DEPLOYMENT_QUEUE_KINDS,
+  DEFAULT_TELEMETRY_POLICY,
   DEFAULT_SERVICE_LIMITS,
   DASHBOARD_STATE_DIR,
   DASHBOARD_PORT_SPAN,
@@ -5163,11 +5825,19 @@ export {
   DASHBOARD_CREDENTIALS_FILE,
   CrossRegionReferenceManager,
   CredentialError,
+  ControlPlaneStore,
+  ControlPlaneCleanupDriver,
+  ControlPlaneBackupSource,
   ContainerRegistryManager,
+  ContainerDataAdapter,
   ConnectClient,
+  ConfigurationStore,
+  ConfigurationService,
   ConfigurationError,
   Compute,
   ComprehendClient,
+  ComposeApplicationStore,
+  ComposeApplicationService,
   Communication,
   CommandHistory,
   CloudWatchLogsClient,
@@ -5177,24 +5847,51 @@ export {
   CloudFormationBuilder,
   CloudError,
   CloudDriverFactory,
+  CloudBlockVolumeDriver,
   CertificateManager,
   CanaryManager,
   Cache,
+  CONTROL_PLANE_SCHEMA_VERSION,
+  CONTROL_PLANE_DATABASE_FILE,
   COMMON_CROSS_ACCOUNT_ROLES,
   CDN,
+  BunFilesystemArchiveRuntime,
+  BunDockerVolumeRuntime,
+  BunDockerRuntime,
   BuildOptimizationManager,
   BounceComplaintHandler,
   BlueGreenManager,
+  BitbucketSourceAdapter,
   BedrockRuntimeClient,
   BedrockClient,
   BatchProcessingManager,
+  BackupStore,
   BackupManager,
+  BackupCoordinator,
+  AwsSsmConfigurationBackend,
+  AwsSecretsManagerConfigurationBackend,
+  AwsRegionalDriver,
+  AwsRdsTransport,
+  AwsRdsDataAdapter,
+  AwsInfrastructureBackupSource,
+  AwsIamCapabilityScanner,
+  AwsElastiCacheTransport,
+  AwsElastiCacheDataAdapter,
   AwsDriver,
+  AwsDatabaseBackupSource,
+  AwsAuroraTransport,
+  AwsAuroraDataAdapter,
+  AutomationIdentityStore,
+  AutomationApiService,
+  AuthenticationStore,
   Auth,
   AssetHasher,
   Arn,
   ApplicationAutoScalingClient,
+  ApiServiceError,
   ApiGateway,
+  AlertStore,
+  AlertEvaluator,
   AcmeClient,
   AWS_REGIONS,
   AWS_PSEUDO_PARAMETERS,
@@ -5203,6 +5900,17 @@ export {
   CloudFormationClient as AWSCloudFormationClient,
   AWSClient,
   AWSAPIError,
+  AUTH_SESSION_IDLE_TTL_MS,
+  AUTH_SESSION_ABSOLUTE_TTL_MS,
+  AUTH_OIDC_TRANSACTION_TTL_MS,
+  AUTH_MFA_CHALLENGE_TTL_MS,
+  AUTH_ENCRYPTION_KEY_FILE,
+  AUTH_ACTION_TOKEN_TTL_MS,
+  AUTHORIZATION_CAPABILITIES,
+  API_VERSION,
+  API_TOKEN_MAX_TTL_MS,
+  API_TOKEN_DEFAULT_TTL_MS,
+  API_IDEMPOTENCY_TTL_MS,
   AI,
   ACME_DIRECTORIES,
   ACMDnsValidator,