@ts-cloud/core 0.16.82 → 0.16.83

package/dist/app-mail.d.ts

@@ -37,6 +37,10 @@ export interface ResolvedMailService {
         keyPath?: string;
         requireForAuth: boolean;
         acmeEmail?: string;
+        systemCredentials?: {
+            certPath: string;
+            keyPath: string;
+        };
     };
     /** DKIM, resolved. Off means the server signs nothing. */
     dkim: {

package/dist/index.js

@@ -1,16 +1,16 @@
-import{createRequire as Bs}from"node:module";var Ms=Object.defineProperty;var Ls=(e)=>e;function Os(e,t){this[e]=Ls.bind(null,t)}var Be=(e,t)=>{for(var n in t)Ms(e,n,{get:t[n],enumerable:!0,configurable:!0,set:Os.bind(t,n)})};var $s=(e,t,n)=>()=>{if(e)try{t=e(e=0)}catch(r){n=[r]}if(n)throw n[0];return t};var Fs=Bs(import.meta.url);function _r(e){let t=typeof e==="string"?new URL(e):e,{hostname:n,pathname:r}=t;if(n.endsWith(".on.aws")){let o=n.match(/^[^.]+\.lambda-url\.([^.]+)\.on\.aws$/);if(o)return{service:"lambda",region:o[1]};return{service:"",region:""}}if(n.endsWith(".r2.cloudflarestorage.com"))return{service:"s3",region:"auto"};if(n.endsWith(".backblazeb2.com")){let o=n.match(/^(?:[^.]+\.)?s3\.([^.]+)\.backblazeb2\.com$/);if(o)return{service:"s3",region:o[1]};return{service:"",region:""}}let i=n.replace("dualstack.","").match(/([^.]+)\.(?:([^.]+)\.)?amazonaws\.com(?:\.cn)?$/);if(!i)return{service:"",region:""};let s=i[1],a=i[2]||"";if(a==="us-gov")a="us-gov-west-1";else if(a==="s3"||a==="s3-accelerate")a="us-east-1",s="s3";else if(s==="iot")if(n.startsWith("iot."))s="execute-api";else if(n.startsWith("data.jobs.iot."))s="iot-jobs-data";else s=r==="/mqtt"?"iotdevicegateway":"iotdata";else if(s==="autoscaling");else if(!a&&s.startsWith("s3-"))a=s.slice(3).replace(/^fips-|^external-1/,""),s="s3";else if(s.endsWith("-fips"))s=s.slice(0,-5);else if(a&&/-\d$/.test(s)&&!/-\d$/.test(a))[s,a]=[a,s];return s=So[s]||s,{service:s,region:a||"us-east-1"}}function H(e){let{method:t,url:n,body:r="",accessKeyId:i,secretAccessKey:s,sessionToken:a,signQuery:o=!1,expiresIn:c=86400,datetime:l}=e,u=new URL(n),m=u.hostname,p=_r(u),g=e.service||p.service,y=e.region||p.region;if(!g)throw Error("Could not detect service from URL. Please provide service explicitly.");if(!y)throw Error("Could not detect region from URL. Please provide region explicitly.");let h=l||new Date().toISOString().replace(/[:-]|\.\d{3}/g,""),b=h.substring(0,8),C=[b,y,g,"aws4_request"].join("/"),T="AWS4-HMAC-SHA256";if(o)return Ao({urlObj:u,method:t,body:r,accessKeyId:i,secretAccessKey:s,sessionToken:a,service:g,region:y,timestamp:h,date:b,credentialScope:C,algorithm:T,expiresIn:c,cache:e.cache});let A=u.pathname||"/",R=Et(u.searchParams),P={host:m,"x-amz-date":h,...e.headers};if(a)P["x-amz-security-token"]=a;let E=Object.keys(P).some((K)=>K.toLowerCase()==="content-type");if(r&&!E)P["content-type"]="application/x-amz-json-1.0";if(g==="s3"&&!P["x-amz-content-sha256"])P["x-amz-content-sha256"]=at(r);let w=Ur(P),I=Hr(P),D=P["x-amz-content-sha256"]||at(r),k=[t,wt(A),R,w,I,D].join(`
+import{createRequire as Bs}from"node:module";var Ms=Object.defineProperty;var Ls=(e)=>e;function Os(e,t){this[e]=Ls.bind(null,t)}var Be=(e,t)=>{for(var n in t)Ms(e,n,{get:t[n],enumerable:!0,configurable:!0,set:Os.bind(t,n)})};var $s=(e,t,n)=>()=>{if(e)try{t=e(e=0)}catch(r){n=[r]}if(n)throw n[0];return t};var Fs=Bs(import.meta.url);function _r(e){let t=typeof e==="string"?new URL(e):e,{hostname:n,pathname:r}=t;if(n.endsWith(".on.aws")){let o=n.match(/^[^.]+\.lambda-url\.([^.]+)\.on\.aws$/);if(o)return{service:"lambda",region:o[1]};return{service:"",region:""}}if(n.endsWith(".r2.cloudflarestorage.com"))return{service:"s3",region:"auto"};if(n.endsWith(".backblazeb2.com")){let o=n.match(/^(?:[^.]+\.)?s3\.([^.]+)\.backblazeb2\.com$/);if(o)return{service:"s3",region:o[1]};return{service:"",region:""}}let i=n.replace("dualstack.","").match(/([^.]+)\.(?:([^.]+)\.)?amazonaws\.com(?:\.cn)?$/);if(!i)return{service:"",region:""};let s=i[1],a=i[2]||"";if(a==="us-gov")a="us-gov-west-1";else if(a==="s3"||a==="s3-accelerate")a="us-east-1",s="s3";else if(s==="iot")if(n.startsWith("iot."))s="execute-api";else if(n.startsWith("data.jobs.iot."))s="iot-jobs-data";else s=r==="/mqtt"?"iotdevicegateway":"iotdata";else if(s==="autoscaling");else if(!a&&s.startsWith("s3-"))a=s.slice(3).replace(/^fips-|^external-1/,""),s="s3";else if(s.endsWith("-fips"))s=s.slice(0,-5);else if(a&&/-\d$/.test(s)&&!/-\d$/.test(a))[s,a]=[a,s];return s=So[s]||s,{service:s,region:a||"us-east-1"}}function j(e){let{method:t,url:n,body:r="",accessKeyId:i,secretAccessKey:s,sessionToken:a,signQuery:o=!1,expiresIn:c=86400,datetime:l}=e,u=new URL(n),m=u.hostname,p=_r(u),g=e.service||p.service,y=e.region||p.region;if(!g)throw Error("Could not detect service from URL. Please provide service explicitly.");if(!y)throw Error("Could not detect region from URL. Please provide region explicitly.");let h=l||new Date().toISOString().replace(/[:-]|\.\d{3}/g,""),b=h.substring(0,8),C=[b,y,g,"aws4_request"].join("/"),T="AWS4-HMAC-SHA256";if(o)return Ao({urlObj:u,method:t,body:r,accessKeyId:i,secretAccessKey:s,sessionToken:a,service:g,region:y,timestamp:h,date:b,credentialScope:C,algorithm:T,expiresIn:c,cache:e.cache});let A=u.pathname||"/",R=Et(u.searchParams),P={host:m,"x-amz-date":h,...e.headers};if(a)P["x-amz-security-token"]=a;let E=Object.keys(P).some((W)=>W.toLowerCase()==="content-type");if(r&&!E)P["content-type"]="application/x-amz-json-1.0";if(g==="s3"&&!P["x-amz-content-sha256"])P["x-amz-content-sha256"]=at(r);let w=Ur(P),I=Hr(P),D=P["x-amz-content-sha256"]||at(r),k=[t,wt(A),R,w,I,D].join(`
 `),O=at(k),ne=[T,h,C,O].join(`
 `),_=e.cache??Ue,q=Kr(s,b,y,g,ne,_),F=[`${T} Credential=${i}/${C}`,`SignedHeaders=${I}`,`Signature=${q}`].join(", ");return P.authorization=F,{url:n,method:t,headers:P,body:r||void 0}}async function Wr(e){let{method:t,url:n,body:r="",accessKeyId:i,secretAccessKey:s,sessionToken:a,signQuery:o=!1,expiresIn:c=86400,datetime:l}=e,u=new URL(n),m=u.hostname,p=_r(u),g=e.service||p.service,y=e.region||p.region;if(!g)throw Error("Could not detect service from URL. Please provide service explicitly.");if(!y)throw Error("Could not detect region from URL. Please provide region explicitly.");let h=l||new Date().toISOString().replace(/[:-]|\.\d{3}/g,""),b=h.substring(0,8),C=[b,y,g,"aws4_request"].join("/"),T="AWS4-HMAC-SHA256";if(o)return Co({urlObj:u,method:t,body:r,accessKeyId:i,secretAccessKey:s,sessionToken:a,service:g,region:y,timestamp:h,date:b,credentialScope:C,algorithm:T,expiresIn:c,cache:e.cache});let A=u.pathname||"/",R=Et(u.searchParams),P={host:m,"x-amz-date":h,...e.headers};if(a)P["x-amz-security-token"]=a;let E=Object.keys(P).some((de)=>de.toLowerCase()==="content-type");if(r&&!E)P["content-type"]="application/x-amz-json-1.0";let w=await Tt(r);if(g==="s3"&&!P["x-amz-content-sha256"])P["x-amz-content-sha256"]=w;let I=Ur(P),D=Hr(P),k=P["x-amz-content-sha256"]||w,O=[t,wt(A),R,I,D,k].join(`
 `),ne=await Tt(O),_=[T,h,C,ne].join(`
-`),q=e.cache??Ue,F=await qr(s,b,y,g,_,q),K=[`${T} Credential=${i}/${C}`,`SignedHeaders=${D}`,`Signature=${F}`].join(", ");return P.authorization=K,{url:n,method:t,headers:P,body:r||void 0}}function Ao(e){let{urlObj:t,method:n,body:r,accessKeyId:i,secretAccessKey:s,sessionToken:a,service:o,region:c,timestamp:l,date:u,credentialScope:m,algorithm:p,expiresIn:g,cache:y}=e,h=new URL(t.toString());h.searchParams.set("X-Amz-Algorithm",p),h.searchParams.set("X-Amz-Credential",`${i}/${m}`),h.searchParams.set("X-Amz-Date",l),h.searchParams.set("X-Amz-Expires",String(g));let b=o==="s3"?"UNSIGNED-PAYLOAD":at(r);if(o==="s3")h.searchParams.set("X-Amz-Content-Sha256",b);let C="host";if(h.searchParams.set("X-Amz-SignedHeaders",C),a)h.searchParams.set("X-Amz-Security-Token",a);let T=wt(h.pathname||"/"),A=`host:${h.hostname}
+`),q=e.cache??Ue,F=await qr(s,b,y,g,_,q),W=[`${T} Credential=${i}/${C}`,`SignedHeaders=${D}`,`Signature=${F}`].join(", ");return P.authorization=W,{url:n,method:t,headers:P,body:r||void 0}}function Ao(e){let{urlObj:t,method:n,body:r,accessKeyId:i,secretAccessKey:s,sessionToken:a,service:o,region:c,timestamp:l,date:u,credentialScope:m,algorithm:p,expiresIn:g,cache:y}=e,h=new URL(t.toString());h.searchParams.set("X-Amz-Algorithm",p),h.searchParams.set("X-Amz-Credential",`${i}/${m}`),h.searchParams.set("X-Amz-Date",l),h.searchParams.set("X-Amz-Expires",String(g));let b=o==="s3"?"UNSIGNED-PAYLOAD":at(r);if(o==="s3")h.searchParams.set("X-Amz-Content-Sha256",b);let C="host";if(h.searchParams.set("X-Amz-SignedHeaders",C),a)h.searchParams.set("X-Amz-Security-Token",a);let T=wt(h.pathname||"/"),A=`host:${h.hostname}
 `,R=Et(h.searchParams),P=[n,T,R,A,C,b].join(`
 `),E=[p,l,m,at(P)].join(`
 `),I=Kr(s,u,c,o,E,y??Ue);return h.searchParams.set("X-Amz-Signature",I),{url:h.toString(),method:n,headers:{},body:r||void 0}}async function Co(e){let{urlObj:t,method:n,body:r,accessKeyId:i,secretAccessKey:s,sessionToken:a,service:o,region:c,timestamp:l,date:u,credentialScope:m,algorithm:p,expiresIn:g,cache:y}=e,h=new URL(t.toString());h.searchParams.set("X-Amz-Algorithm",p),h.searchParams.set("X-Amz-Credential",`${i}/${m}`),h.searchParams.set("X-Amz-Date",l),h.searchParams.set("X-Amz-Expires",String(g));let b=o==="s3"?"UNSIGNED-PAYLOAD":await Tt(r);if(o==="s3")h.searchParams.set("X-Amz-Content-Sha256",b);let C="host";if(h.searchParams.set("X-Amz-SignedHeaders",C),a)h.searchParams.set("X-Amz-Security-Token",a);let T=wt(h.pathname||"/"),A=`host:${h.hostname}
 `,R=Et(h.searchParams),P=[n,T,R,A,C,b].join(`
 `),E=[p,l,m,await Tt(P)].join(`
-`),I=await qr(s,u,c,o,E,y??Ue);return h.searchParams.set("X-Amz-Signature",I),{url:h.toString(),method:n,headers:{},body:r||void 0}}function Vr(e){let{url:t,method:n="GET",expiresIn:r=3600,...i}=e,s=Math.min(r,604800);return H({...i,url:t,method:n,signQuery:!0,expiresIn:s}).url}async function Qg(e){let{url:t,method:n="GET",expiresIn:r=3600,...i}=e,s=Math.min(r,604800);return(await Wr({...i,url:t,method:n,signQuery:!0,expiresIn:s})).url}function Ur(e){return Object.keys(e).sort().map((t)=>`${t.toLowerCase()}:${e[t].trim().replace(/\s+/g," ")}`).join(`
+`),I=await qr(s,u,c,o,E,y??Ue);return h.searchParams.set("X-Amz-Signature",I),{url:h.toString(),method:n,headers:{},body:r||void 0}}function Vr(e){let{url:t,method:n="GET",expiresIn:r=3600,...i}=e,s=Math.min(r,604800);return j({...i,url:t,method:n,signQuery:!0,expiresIn:s}).url}async function Qg(e){let{url:t,method:n="GET",expiresIn:r=3600,...i}=e,s=Math.min(r,604800);return(await Wr({...i,url:t,method:n,signQuery:!0,expiresIn:s})).url}function Ur(e){return Object.keys(e).sort().map((t)=>`${t.toLowerCase()}:${e[t].trim().replace(/\s+/g," ")}`).join(`
 `)+`
-`}function Hr(e){return Object.keys(e).sort().map((t)=>t.toLowerCase()).join(";")}function Et(e){let t=[];return e.forEach((n,r)=>{t.push([Xt(r),Xt(n)])}),t.sort((n,r)=>{if(n[0]<r[0])return-1;if(n[0]>r[0])return 1;if(n[1]<r[1])return-1;if(n[1]>r[1])return 1;return 0}),t.map(([n,r])=>`${n}=${r}`).join("&")}function wt(e){return e.split("/").map((t)=>Xt(t)).join("/")}function Xt(e){return encodeURIComponent(e).replace(/[!'()*]/g,(t)=>`%${t.charCodeAt(0).toString(16).toUpperCase()}`)}function at(e){if(!Ve)throw Error("Synchronous hash not available in browser. Use signRequestAsync() instead.");return Ve.createHash("sha256").update(e,"utf8").digest("hex")}function it(e,t){if(!Ve)throw Error("Synchronous hmac not available in browser. Use signRequestAsync() instead.");return Ve.createHmac("sha256",e).update(t,"utf8").digest()}async function Tt(e){let n=new TextEncoder().encode(e),r=await crypto.subtle.digest("SHA-256",n);return jr(new Uint8Array(r))}async function st(e,t){let n=new TextEncoder,r=typeof e==="string"?n.encode(e):e,i=n.encode(t),s=await crypto.subtle.importKey("raw",r.buffer,{name:"HMAC",hash:"SHA-256"},!1,["sign"]),a=await crypto.subtle.sign("HMAC",s,i.buffer);return new Uint8Array(a)}function jr(e){return Array.from(e).map((t)=>t.toString(16).padStart(2,"0")).join("")}function Kr(e,t,n,r,i,s){let a=`${e}:${t}:${n}:${r}`,o=s.get(a);if(!o){let c=it(`AWS4${e}`,t),l=it(c,n),u=it(l,r);if(o=it(u,"aws4_request"),s.size>=Gr){let m=s.keys().next().value;if(m)s.delete(m)}s.set(a,o)}return it(o,i).toString("hex")}async function qr(e,t,n,r,i,s){let a=`${e}:${t}:${n}:${r}`,o=s.get(a);if(!o){let l=await st(`AWS4${e}`,t),u=await st(l,n),m=await st(u,r);if(o=await st(m,"aws4_request"),s.size>=Gr){let p=s.keys().next().value;if(p)s.delete(p)}s.set(a,o)}let c=await st(o,i);return jr(c)}function zr(e,t){return t.includes(e)}function Rt(e,t,n){let r=t*Math.pow(2,e),i=Math.random()*0.3*r;return Math.min(r+i,n)}function Pt(e){return new Promise((t)=>setTimeout(t,e))}async function Ne(e,t){let{maxRetries:n=3,initialDelayMs:r=100,maxDelayMs:i=5000,retryableStatusCodes:s=[429,500,502,503,504],timeoutMs:a=30000}=t??{},o,c;for(let l=0;l<=n;l++){let u=H(e),m={method:u.method,headers:u.headers};if(u.body)m.body=u.body;let p=new AbortController,g=setTimeout(()=>p.abort(),a);m.signal=p.signal;try{let y=await fetch(u.url,m);if(clearTimeout(g),c=y,y.ok)return y;if(l<n&&zr(y.status,s)){let b=Rt(l,r,i);await Pt(b);continue}let h=await y.text();throw Error(`AWS API request failed (${y.status}): ${h}`)}catch(y){if(clearTimeout(g),o=y,y instanceof Error&&y.name==="AbortError")o=Error(`Request timed out after ${a}ms`);if(l<n&&!(y instanceof Error&&y.message.includes("AWS API request failed"))){let h=Rt(l,r,i);await Pt(h);continue}throw o}}throw o??Error("Request failed after retries")}async function Jg(e){return Ne(e,{maxRetries:0})}async function Yg(e,t){let{maxRetries:n=3,initialDelayMs:r=100,maxDelayMs:i=5000,retryableStatusCodes:s=[429,500,502,503,504],timeoutMs:a=30000}=t??{},o;for(let c=0;c<=n;c++){let l=await Wr(e),u={method:l.method,headers:l.headers};if(l.body)u.body=l.body;let m=new AbortController,p=setTimeout(()=>m.abort(),a);u.signal=m.signal;try{let g=await fetch(l.url,u);if(clearTimeout(p),g.ok)return g;if(c<n&&zr(g.status,s)){let h=Rt(c,r,i);await Pt(h);continue}let y=await g.text();throw Error(`AWS API request failed (${g.status}): ${y}`)}catch(g){if(clearTimeout(p),o=g,g instanceof Error&&g.name==="AbortError")o=Error(`Request timed out after ${a}ms`);if(c<n&&!(g instanceof Error&&g.message.includes("AWS API request failed"))){let y=Rt(c,r,i);await Pt(y);continue}throw o}}throw o??Error("Request failed after retries")}async function It(e){let t=await e.text(),n={},r=/<(\w+)>([^<]+)<\/\1>/g,i;while((i=r.exec(t))!==null){let[,s,a]=i;n[s]=a}return n}async function Zg(e){return await e.json()}function Xg(){Ue.clear()}function ey(){return Ue.size}function ty(){return Ve!==void 0}function ny(){return typeof crypto<"u"&&typeof crypto.subtle<"u"}var Ve,Ue,Gr=100,So;var He=$s(async()=>{try{Ve=await import("node:crypto")}catch{}Ue=new Map,So={appstream2:"appstream",cloudhsmv2:"cloudhsm",email:"ses",marketplace:"aws-marketplace",mobile:"AWSMobileHubService",pinpoint:"mobiletargeting",queue:"sqs","git-codecommit":"codecommit","mturk-requester-sandbox":"mturk-requester","personalize-runtime":"personalize"}});var ur={};Be(ur,{default:()=>ba,handler:()=>jt});var yr={};Be(yr,{default:()=>Sa,handler:()=>Kt});var Hi={};Be(Hi,{EmailAnalyticsModule:()=>gt,EmailRules:()=>Mn,EmailScheduling:()=>xn,EmailSearch:()=>Dn,EmailTemplates:()=>Me,EmailThreading:()=>Nn,SharedMailboxes:()=>kn});var ji={};Be(ji,{default:()=>Hc,handler:()=>Uc});var Ki={};Be(Ki,{CallAnalytics:()=>On,CallRecording:()=>Ln,Callbacks:()=>kt,IVRBuilder:()=>Ke});var qi={};Be(qi,{AbTesting:()=>Pe,LinkTracking:()=>_n,MmsSupport:()=>Fn,SmsAnalytics:()=>Bn,SmsCampaigns:()=>$n,SmsChatbot:()=>Gn});var au={backgroundJobs:{visibilityTimeout:120,messageRetentionPeriod:604800,deadLetterQueue:!0,maxReceiveCount:3,encrypted:!0},fifo:{fifo:!0,contentBasedDeduplication:!0,visibilityTimeout:30,encrypted:!0},highThroughput:{visibilityTimeout:30,receiveMessageWaitTime:20,encrypted:!0},delayed:{delaySeconds:60,visibilityTimeout:60,encrypted:!0},longRunning:{visibilityTimeout:900,messageRetentionPeriod:1209600,deadLetterQueue:!0,maxReceiveCount:2,encrypted:!0},monitored:{visibilityTimeout:60,messageRetentionPeriod:604800,deadLetterQueue:!0,maxReceiveCount:3,encrypted:!0,alarms:{enabled:!0,queueDepthThreshold:1000,messageAgeThreshold:3600,dlqAlarm:!0}},lambdaOptimized:{visibilityTimeout:360,receiveMessageWaitTime:20,deadLetterQueue:!0,maxReceiveCount:3,encrypted:!0},fanOut:{visibilityTimeout:30,receiveMessageWaitTime:20,encrypted:!0}},ou={serverless:{development:{enabled:!0,mode:"serverless",channels:{public:!0,private:!0,presence:!0},storage:{type:"dynamodb",dynamodb:{billingMode:"PAY_PER_REQUEST"}},scaling:{maxConnections:1000,handlerMemory:128}},production:{enabled:!0,mode:"serverless",channels:{public:!0,private:!0,presence:{enabled:!0,maxMembers:100,heartbeatInterval:30,inactivityTimeout:60}},storage:{type:"dynamodb",dynamodb:{billingMode:"PAY_PER_REQUEST",pointInTimeRecovery:!0,connectionTTL:86400}},scaling:{maxConnections:50000,messagesPerSecond:5000,handlerMemory:256,handlerTimeout:30},monitoring:{enabled:!0,connectionThreshold:40000,errorThreshold:100,latencyThreshold:500},keepAlive:!0,keepAliveInterval:30,idleTimeout:600},notifications:{enabled:!0,mode:"serverless",channels:{public:!1,private:!0,presence:!1},storage:{type:"dynamodb",dynamodb:{billingMode:"PAY_PER_REQUEST"}},scaling:{maxConnections:50000,messagesPerSecond:2000,handlerMemory:128},keepAlive:!0,keepAliveInterval:60,idleTimeout:1800}},server:{development:{enabled:!0,mode:"server",channels:{public:!0,private:!0,presence:!0},server:{host:"0.0.0.0",port:6001,scheme:"ws",driver:"bun",idleTimeout:120,perMessageDeflate:!1,metrics:!1}},production:{enabled:!0,mode:"server",channels:{public:!0,private:!0,presence:!0},server:{host:"0.0.0.0",port:6001,scheme:"wss",driver:"bun",idleTimeout:120,maxPayloadLength:16777216,backpressureLimit:1048576,sendPings:!0,perMessageDeflate:!0,instances:2,redis:{enabled:!0,keyPrefix:"broadcasting:"},rateLimit:{enabled:!0,max:100,window:60000,perChannel:!0,perUser:!0},loadManagement:{enabled:!0,maxConnections:1e4,maxSubscriptionsPerConnection:100,shedLoadThreshold:0.8},metrics:!0,autoScaling:{min:2,max:10,targetCPU:70}},monitoring:{enabled:!0,connectionThreshold:8000,errorThreshold:100}},highPerformance:{enabled:!0,mode:"server",channels:{public:!0,private:!0,presence:!0},server:{host:"0.0.0.0",port:6001,scheme:"wss",driver:"bun",idleTimeout:60,maxPayloadLength:8388608,backpressureLimit:2097152,closeOnBackpressureLimit:!0,sendPings:!0,perMessageDeflate:!0,instances:4,redis:{enabled:!0,useElastiCache:!0,keyPrefix:"rt:"},rateLimit:{enabled:!0,max:200,window:60000,perChannel:!0},loadManagement:{enabled:!0,maxConnections:25000,maxSubscriptionsPerConnection:50,shedLoadThreshold:0.7},metrics:{enabled:!0,path:"/metrics"},autoScaling:{min:4,max:20,targetCPU:60,targetConnections:20000}},monitoring:{enabled:!0,connectionThreshold:80000,errorThreshold:50,latencyThreshold:50}},chat:{enabled:!0,mode:"server",channels:{public:!0,private:!0,presence:{enabled:!0,maxMembers:200,heartbeatInterval:20,inactivityTimeout:60}},server:{host:"0.0.0.0",port:6001,scheme:"wss",driver:"bun",idleTimeout:300,maxPayloadLength:1048576,sendPings:!0,perMessageDeflate:!0,instances:2,redis:{enabled:!0,keyPrefix:"chat:"},rateLimit:{enabled:!0,max:60,window:60000,perChannel:!0},loadManagement:{enabled:!0,maxConnections:15000,maxSubscriptionsPerConnection:20},metrics:!0},keepAlive:!0,keepAliveInterval:25,idleTimeout:900},gaming:{enabled:!0,mode:"server",channels:{public:!0,private:!0,presence:{enabled:!0,maxMembers:100,heartbeatInterval:10,inactivityTimeout:30}},server:{host:"0.0.0.0",port:6001,scheme:"wss",driver:"bun",idleTimeout:30,maxPayloadLength:65536,backpressureLimit:524288,closeOnBackpressureLimit:!0,sendPings:!0,perMessageDeflate:!1,instances:4,redis:{enabled:!0,useElastiCache:!0},rateLimit:{enabled:!0,max:120,window:60000},loadManagement:{enabled:!0,maxConnections:5000,maxSubscriptionsPerConnection:10,shedLoadThreshold:0.6},metrics:!0,autoScaling:{min:4,max:16,targetCPU:50}},keepAlive:!0,keepAliveInterval:10,idleTimeout:60},single:{enabled:!0,mode:"server",channels:{public:!0,private:!0,presence:!0},server:{host:"0.0.0.0",port:6001,scheme:"wss",driver:"bun",idleTimeout:120,sendPings:!0,perMessageDeflate:!0,instances:1,rateLimit:{enabled:!0,max:100,window:60000},loadManagement:{enabled:!0,maxConnections:1e4},metrics:!0}}}};import{isAbsolute as Gt,join as yt,relative as Gs}from"node:path";var _t=".ts-cloud",Qn="TS_CLOUD_STATE_DIR",Wt=null;function uu(e){Wt=e?.trim()||null}function du(){return Boolean(process.env[Qn]?.trim()||Wt)}function Fe(){return process.env[Qn]?.trim()||Wt||_t}function Jn(...e){return yt(Fe(),...e)}function _s(e,...t){let n=Fe();return Gt(n)?yt(n,...t):yt(e,n,...t)}function mu(e,t=process.cwd()){let n=(i,s)=>{let a=Gs(i,s);return a===""||!a.startsWith("..")&&!Gt(a)},r=Gt(e)?e:yt(t,e);return n(_s(t),r)}function Yn(e){let t=e.infrastructure?.compute!=null,n=Object.values(e.environments??{}).some((r)=>r?.app!=null);return{server:t,serverless:n}}function gu(e){if(e.mode==="server"||e.mode==="serverless")return e.mode;let{serverless:t}=Yn(e);return t?"serverless":"server"}function yu(e){let{server:t,serverless:n}=Yn(e);if(t&&n)return"A project cannot be both a server and a serverless deployment. Found `infrastructure.compute` (server) AND `environments.<env>.app` (serverless Lambda). Keep one: remove `infrastructure.compute` for a serverless app, or remove `environments.<env>.app` for a server.";if(e.mode==="server"&&n&&!t)return"Config sets `mode: 'server'` but declares a serverless app (`environments.<env>.app`). Remove the app or change the mode.";if(e.mode==="serverless"&&t&&!n)return"Config sets `mode: 'serverless'` but declares a server (`infrastructure.compute`). Remove the compute block or change the mode.";return null}function hu(e){return e.infrastructure?.appDatabase??e.infrastructure?.compute?.database}function Ws(e){return typeof e==="object"&&e!==null?e:{}}function Vs(e){return e===!0||typeof e==="object"&&e!==null}function Us(e,t){let n=t?e.environments?.[t]:void 0;if(n?.domain)return n.domain;let r=Object.values(e.sites??{}),i=e.sites?.main?.domain??r.find((s)=>s.domain)?.domain;if(i)return i;return`${e.project?.slug??"app"}.local`}function Hs(e){let t=e.indexOf(".");return t>0?e.slice(t+1):void 0}function js(e,t={}){let n=e.infrastructure?.compute?.managedServices?.mail,r=Ws(n),i=t.environmentType??(t.environment?e.environments?.[t.environment]?.type:void 0),s=r.mode??(i==="production"?"server":"catcher"),a=s==="server",o=Us(e,t.environment),c=r.hostname??(a?`mail.${o}`:"localhost"),l=r.ports??{},u=a?{smtp:l.smtp??25,submission:l.submission??587,submissions:l.submissions??465,imap:l.imap??143,imaps:l.imaps??993,webmail:l.webmail??8080,managesieve:l.managesieve}:{smtp:l.smtp??1025,submission:l.submission,submissions:l.submissions,imap:l.imap,imaps:l.imaps,webmail:l.webmail??8025,managesieve:l.managesieve},m=r.tls??{},p=m.enabled??a,g=!!(m.certPath&&m.keyPath),y=(r.accounts??[]).map((K)=>({address:K.address,password:K.password,passwordPolicy:K.passwordPolicy??"initial"})),h=typeof r.dkim==="object"&&r.dkim!==null?r.dkim:{},b=r.dkim===!1?!1:r.dkim===!0||a,C=typeof r.webmail==="object"&&r.webmail!==null?r.webmail:{},T=r.webmail===!1?!1:C.enabled??!0,A=c.includes(".")&&!c.endsWith(".local")&&!/^\d+\.\d+\.\d+\.\d+$/.test(c),R=C.domain===!1?void 0:C.domain??(a&&A?c:void 0),P=C.tls??(R?!1:p),E=[...new Set(C.aliases??[])].filter((K)=>K!==R),w=r.spam??{},I=r.delivery??(a?"direct":"none"),D=r.expose??a,k=Hs(c),O=[...new Set([c,...k?[k]:[],...r.domains??[]])],ne=C.attachments?.maxFileBytes??20971520,_=C.attachments?.maxTotalBytes??20971520,q=C.attachments?.maxCount??20,F=C.undoSendSeconds??10;for(let[K,de,Oe]of[["maxFileBytes",ne,104857600],["maxTotalBytes",_,104857600],["maxCount",q,100],["undoSendSeconds",F,30]])if(!Number.isInteger(de)||de<0||de>Oe)throw Error(`Mail webmail ${K} must be an integer from 0 to ${Oe}`);return{enabled:Vs(n),mode:s,version:r.version,hostname:c,domains:O,ports:u,tls:{enabled:p,acme:p&&!g&&(m.acme??!0),certPath:m.certPath,keyPath:m.keyPath,requireForAuth:m.requireForAuth??(p&&a),acmeEmail:m.acmeEmail??y[0]?.address},dkim:{enabled:b,selector:h.selector??"default",rotate:h.rotate??!1,rotateIntervalDays:h.rotateIntervalDays??90},webmail:{enabled:T,port:C.port??u.webmail,domain:R,aliases:E,tls:P,secureCookies:C.secureCookies??(!!R||P),attachmentMaxFileBytes:ne,attachmentMaxTotalBytes:_,attachmentMaxCount:q,undoSendSeconds:F},delivery:I,sesRegion:r.sesRegion??"us-east-1",accounts:y,storagePath:r.storagePath??"/var/lib/mail",maxMessageSize:r.maxMessageSize??26214400,spam:{enabled:w.enabled??a,enforce:w.enforce??!1,junkScore:w.junkScore??5,rejectScore:w.rejectScore??12,dnsbl:w.dnsbl??a,dnsblReject:w.dnsblReject??!1,greylist:w.greylist??!1},webhookUrl:r.webhookUrl,expose:D,bindAddress:D?"0.0.0.0":"127.0.0.1"}}function Su(e){if(!e.enabled||!e.expose)return[];let t=[e.ports.smtp,e.ports.submission,e.ports.submissions,e.ports.imap,e.ports.imaps,e.ports.managesieve].filter((n)=>typeof n==="number");if(e.webmail.enabled&&!e.webmail.domain)t.push(e.webmail.port);return[...new Set(t)].sort((n,r)=>n-r)}function Au(e){if(!e.enabled)return{};let t=e.ports.submission??e.ports.smtp,n={MAIL_MAILER:"smtp",MAIL_HOST:"127.0.0.1",MAIL_PORT:String(t)};if(e.mode==="server"){n.MAIL_ENCRYPTION=e.tls.enabled?"tls":"null";let r=e.accounts[0];if(r)n.MAIL_USERNAME=r.address,n.MAIL_PASSWORD=r.password}else n.MAIL_ENCRYPTION="null",n.MAIL_USERNAME="null",n.MAIL_PASSWORD="null";return n}function Cu(e){if(!e.enabled||!e.webmail.enabled||!e.webmail.domain)return{};let t=[e.webmail.domain,...e.webmail.aliases];if(!Number.isInteger(e.webmail.port)||e.webmail.port<1||e.webmail.port>65535)throw Error("Mail webmail port must be between 1 and 65535");return Object.fromEntries(t.map((n,r)=>{if(!/^(?:[a-z0-9](?:[a-z0-9-]{0,61}[a-z0-9])?\.)+[a-z0-9](?:[a-z0-9-]{0,61}[a-z0-9])?$/i.test(n))throw Error(`Invalid mail webmail hostname: ${n}`);return[`__mail_webmail_${r}`,{domain:n,proxyTo:`localhost:${e.webmail.port}`}]}))}function vu(e,t={}){let n=e.infrastructure?.compute?.proxy,r=js(e,t);if(!r.enabled||!r.webmail.enabled||!r.webmail.domain)return n;return{engine:"rpx",onDemandTls:!0,onDemandTlsEmail:r.tls.acmeEmail??`webmaster@${r.webmail.domain}`,...n}}function Ru(e){if(e.cloud?.provider)return e.cloud.provider;if(e.ssh?.hosts?.length)return"ssh";if(e.hetzner?.apiToken)return"hetzner";return"aws"}class Ks{template;constructor(e){this.template={AWSTemplateFormatVersion:"2010-09-09",Description:e,Resources:{}}}addResource(e,t){return this.template.Resources[e]=t,this}addResources(e){return Object.assign(this.template.Resources,e),this}addParameter(e,t){if(!this.template.Parameters)this.template.Parameters={};return this.template.Parameters[e]=t,this}addOutput(e,t){if(!this.template.Outputs)this.template.Outputs={};return this.template.Outputs[e]=t,this}addMetadata(e,t){if(!this.template.Metadata)this.template.Metadata={};return this.template.Metadata[e]=t,this}hasResource(e){return e in this.template.Resources}getResources(){return this.template.Resources}build(){return this.template}toJSON(e=!0){return JSON.stringify(this.template,null,e?2:0)}toYAML(){return this.convertToYAML(this.template)}convertToYAML(e,t=0){let n="  ".repeat(t),r="";for(let[i,s]of Object.entries(e)){if(s===null||s===void 0)continue;if(typeof s==="object"&&!Array.isArray(s))r+=`${n}${i}:
+`}function Hr(e){return Object.keys(e).sort().map((t)=>t.toLowerCase()).join(";")}function Et(e){let t=[];return e.forEach((n,r)=>{t.push([Xt(r),Xt(n)])}),t.sort((n,r)=>{if(n[0]<r[0])return-1;if(n[0]>r[0])return 1;if(n[1]<r[1])return-1;if(n[1]>r[1])return 1;return 0}),t.map(([n,r])=>`${n}=${r}`).join("&")}function wt(e){return e.split("/").map((t)=>Xt(t)).join("/")}function Xt(e){return encodeURIComponent(e).replace(/[!'()*]/g,(t)=>`%${t.charCodeAt(0).toString(16).toUpperCase()}`)}function at(e){if(!Ve)throw Error("Synchronous hash not available in browser. Use signRequestAsync() instead.");return Ve.createHash("sha256").update(e,"utf8").digest("hex")}function it(e,t){if(!Ve)throw Error("Synchronous hmac not available in browser. Use signRequestAsync() instead.");return Ve.createHmac("sha256",e).update(t,"utf8").digest()}async function Tt(e){let n=new TextEncoder().encode(e),r=await crypto.subtle.digest("SHA-256",n);return jr(new Uint8Array(r))}async function st(e,t){let n=new TextEncoder,r=typeof e==="string"?n.encode(e):e,i=n.encode(t),s=await crypto.subtle.importKey("raw",r.buffer,{name:"HMAC",hash:"SHA-256"},!1,["sign"]),a=await crypto.subtle.sign("HMAC",s,i.buffer);return new Uint8Array(a)}function jr(e){return Array.from(e).map((t)=>t.toString(16).padStart(2,"0")).join("")}function Kr(e,t,n,r,i,s){let a=`${e}:${t}:${n}:${r}`,o=s.get(a);if(!o){let c=it(`AWS4${e}`,t),l=it(c,n),u=it(l,r);if(o=it(u,"aws4_request"),s.size>=Gr){let m=s.keys().next().value;if(m)s.delete(m)}s.set(a,o)}return it(o,i).toString("hex")}async function qr(e,t,n,r,i,s){let a=`${e}:${t}:${n}:${r}`,o=s.get(a);if(!o){let l=await st(`AWS4${e}`,t),u=await st(l,n),m=await st(u,r);if(o=await st(m,"aws4_request"),s.size>=Gr){let p=s.keys().next().value;if(p)s.delete(p)}s.set(a,o)}let c=await st(o,i);return jr(c)}function zr(e,t){return t.includes(e)}function Rt(e,t,n){let r=t*Math.pow(2,e),i=Math.random()*0.3*r;return Math.min(r+i,n)}function Pt(e){return new Promise((t)=>setTimeout(t,e))}async function Ne(e,t){let{maxRetries:n=3,initialDelayMs:r=100,maxDelayMs:i=5000,retryableStatusCodes:s=[429,500,502,503,504],timeoutMs:a=30000}=t??{},o,c;for(let l=0;l<=n;l++){let u=j(e),m={method:u.method,headers:u.headers};if(u.body)m.body=u.body;let p=new AbortController,g=setTimeout(()=>p.abort(),a);m.signal=p.signal;try{let y=await fetch(u.url,m);if(clearTimeout(g),c=y,y.ok)return y;if(l<n&&zr(y.status,s)){let b=Rt(l,r,i);await Pt(b);continue}let h=await y.text();throw Error(`AWS API request failed (${y.status}): ${h}`)}catch(y){if(clearTimeout(g),o=y,y instanceof Error&&y.name==="AbortError")o=Error(`Request timed out after ${a}ms`);if(l<n&&!(y instanceof Error&&y.message.includes("AWS API request failed"))){let h=Rt(l,r,i);await Pt(h);continue}throw o}}throw o??Error("Request failed after retries")}async function Jg(e){return Ne(e,{maxRetries:0})}async function Yg(e,t){let{maxRetries:n=3,initialDelayMs:r=100,maxDelayMs:i=5000,retryableStatusCodes:s=[429,500,502,503,504],timeoutMs:a=30000}=t??{},o;for(let c=0;c<=n;c++){let l=await Wr(e),u={method:l.method,headers:l.headers};if(l.body)u.body=l.body;let m=new AbortController,p=setTimeout(()=>m.abort(),a);u.signal=m.signal;try{let g=await fetch(l.url,u);if(clearTimeout(p),g.ok)return g;if(c<n&&zr(g.status,s)){let h=Rt(c,r,i);await Pt(h);continue}let y=await g.text();throw Error(`AWS API request failed (${g.status}): ${y}`)}catch(g){if(clearTimeout(p),o=g,g instanceof Error&&g.name==="AbortError")o=Error(`Request timed out after ${a}ms`);if(c<n&&!(g instanceof Error&&g.message.includes("AWS API request failed"))){let y=Rt(c,r,i);await Pt(y);continue}throw o}}throw o??Error("Request failed after retries")}async function It(e){let t=await e.text(),n={},r=/<(\w+)>([^<]+)<\/\1>/g,i;while((i=r.exec(t))!==null){let[,s,a]=i;n[s]=a}return n}async function Zg(e){return await e.json()}function Xg(){Ue.clear()}function ey(){return Ue.size}function ty(){return Ve!==void 0}function ny(){return typeof crypto<"u"&&typeof crypto.subtle<"u"}var Ve,Ue,Gr=100,So;var He=$s(async()=>{try{Ve=await import("node:crypto")}catch{}Ue=new Map,So={appstream2:"appstream",cloudhsmv2:"cloudhsm",email:"ses",marketplace:"aws-marketplace",mobile:"AWSMobileHubService",pinpoint:"mobiletargeting",queue:"sqs","git-codecommit":"codecommit","mturk-requester-sandbox":"mturk-requester","personalize-runtime":"personalize"}});var ur={};Be(ur,{default:()=>ba,handler:()=>jt});var yr={};Be(yr,{default:()=>Sa,handler:()=>Kt});var Hi={};Be(Hi,{EmailAnalyticsModule:()=>gt,EmailRules:()=>Mn,EmailScheduling:()=>xn,EmailSearch:()=>Dn,EmailTemplates:()=>Me,EmailThreading:()=>Nn,SharedMailboxes:()=>kn});var ji={};Be(ji,{default:()=>Hc,handler:()=>Uc});var Ki={};Be(Ki,{CallAnalytics:()=>On,CallRecording:()=>Ln,Callbacks:()=>kt,IVRBuilder:()=>Ke});var qi={};Be(qi,{AbTesting:()=>Pe,LinkTracking:()=>_n,MmsSupport:()=>Fn,SmsAnalytics:()=>Bn,SmsCampaigns:()=>$n,SmsChatbot:()=>Gn});var au={backgroundJobs:{visibilityTimeout:120,messageRetentionPeriod:604800,deadLetterQueue:!0,maxReceiveCount:3,encrypted:!0},fifo:{fifo:!0,contentBasedDeduplication:!0,visibilityTimeout:30,encrypted:!0},highThroughput:{visibilityTimeout:30,receiveMessageWaitTime:20,encrypted:!0},delayed:{delaySeconds:60,visibilityTimeout:60,encrypted:!0},longRunning:{visibilityTimeout:900,messageRetentionPeriod:1209600,deadLetterQueue:!0,maxReceiveCount:2,encrypted:!0},monitored:{visibilityTimeout:60,messageRetentionPeriod:604800,deadLetterQueue:!0,maxReceiveCount:3,encrypted:!0,alarms:{enabled:!0,queueDepthThreshold:1000,messageAgeThreshold:3600,dlqAlarm:!0}},lambdaOptimized:{visibilityTimeout:360,receiveMessageWaitTime:20,deadLetterQueue:!0,maxReceiveCount:3,encrypted:!0},fanOut:{visibilityTimeout:30,receiveMessageWaitTime:20,encrypted:!0}},ou={serverless:{development:{enabled:!0,mode:"serverless",channels:{public:!0,private:!0,presence:!0},storage:{type:"dynamodb",dynamodb:{billingMode:"PAY_PER_REQUEST"}},scaling:{maxConnections:1000,handlerMemory:128}},production:{enabled:!0,mode:"serverless",channels:{public:!0,private:!0,presence:{enabled:!0,maxMembers:100,heartbeatInterval:30,inactivityTimeout:60}},storage:{type:"dynamodb",dynamodb:{billingMode:"PAY_PER_REQUEST",pointInTimeRecovery:!0,connectionTTL:86400}},scaling:{maxConnections:50000,messagesPerSecond:5000,handlerMemory:256,handlerTimeout:30},monitoring:{enabled:!0,connectionThreshold:40000,errorThreshold:100,latencyThreshold:500},keepAlive:!0,keepAliveInterval:30,idleTimeout:600},notifications:{enabled:!0,mode:"serverless",channels:{public:!1,private:!0,presence:!1},storage:{type:"dynamodb",dynamodb:{billingMode:"PAY_PER_REQUEST"}},scaling:{maxConnections:50000,messagesPerSecond:2000,handlerMemory:128},keepAlive:!0,keepAliveInterval:60,idleTimeout:1800}},server:{development:{enabled:!0,mode:"server",channels:{public:!0,private:!0,presence:!0},server:{host:"0.0.0.0",port:6001,scheme:"ws",driver:"bun",idleTimeout:120,perMessageDeflate:!1,metrics:!1}},production:{enabled:!0,mode:"server",channels:{public:!0,private:!0,presence:!0},server:{host:"0.0.0.0",port:6001,scheme:"wss",driver:"bun",idleTimeout:120,maxPayloadLength:16777216,backpressureLimit:1048576,sendPings:!0,perMessageDeflate:!0,instances:2,redis:{enabled:!0,keyPrefix:"broadcasting:"},rateLimit:{enabled:!0,max:100,window:60000,perChannel:!0,perUser:!0},loadManagement:{enabled:!0,maxConnections:1e4,maxSubscriptionsPerConnection:100,shedLoadThreshold:0.8},metrics:!0,autoScaling:{min:2,max:10,targetCPU:70}},monitoring:{enabled:!0,connectionThreshold:8000,errorThreshold:100}},highPerformance:{enabled:!0,mode:"server",channels:{public:!0,private:!0,presence:!0},server:{host:"0.0.0.0",port:6001,scheme:"wss",driver:"bun",idleTimeout:60,maxPayloadLength:8388608,backpressureLimit:2097152,closeOnBackpressureLimit:!0,sendPings:!0,perMessageDeflate:!0,instances:4,redis:{enabled:!0,useElastiCache:!0,keyPrefix:"rt:"},rateLimit:{enabled:!0,max:200,window:60000,perChannel:!0},loadManagement:{enabled:!0,maxConnections:25000,maxSubscriptionsPerConnection:50,shedLoadThreshold:0.7},metrics:{enabled:!0,path:"/metrics"},autoScaling:{min:4,max:20,targetCPU:60,targetConnections:20000}},monitoring:{enabled:!0,connectionThreshold:80000,errorThreshold:50,latencyThreshold:50}},chat:{enabled:!0,mode:"server",channels:{public:!0,private:!0,presence:{enabled:!0,maxMembers:200,heartbeatInterval:20,inactivityTimeout:60}},server:{host:"0.0.0.0",port:6001,scheme:"wss",driver:"bun",idleTimeout:300,maxPayloadLength:1048576,sendPings:!0,perMessageDeflate:!0,instances:2,redis:{enabled:!0,keyPrefix:"chat:"},rateLimit:{enabled:!0,max:60,window:60000,perChannel:!0},loadManagement:{enabled:!0,maxConnections:15000,maxSubscriptionsPerConnection:20},metrics:!0},keepAlive:!0,keepAliveInterval:25,idleTimeout:900},gaming:{enabled:!0,mode:"server",channels:{public:!0,private:!0,presence:{enabled:!0,maxMembers:100,heartbeatInterval:10,inactivityTimeout:30}},server:{host:"0.0.0.0",port:6001,scheme:"wss",driver:"bun",idleTimeout:30,maxPayloadLength:65536,backpressureLimit:524288,closeOnBackpressureLimit:!0,sendPings:!0,perMessageDeflate:!1,instances:4,redis:{enabled:!0,useElastiCache:!0},rateLimit:{enabled:!0,max:120,window:60000},loadManagement:{enabled:!0,maxConnections:5000,maxSubscriptionsPerConnection:10,shedLoadThreshold:0.6},metrics:!0,autoScaling:{min:4,max:16,targetCPU:50}},keepAlive:!0,keepAliveInterval:10,idleTimeout:60},single:{enabled:!0,mode:"server",channels:{public:!0,private:!0,presence:!0},server:{host:"0.0.0.0",port:6001,scheme:"wss",driver:"bun",idleTimeout:120,sendPings:!0,perMessageDeflate:!0,instances:1,rateLimit:{enabled:!0,max:100,window:60000},loadManagement:{enabled:!0,maxConnections:1e4},metrics:!0}}}};import{isAbsolute as Gt,join as yt,relative as Gs}from"node:path";var _t=".ts-cloud",Qn="TS_CLOUD_STATE_DIR",Wt=null;function uu(e){Wt=e?.trim()||null}function du(){return Boolean(process.env[Qn]?.trim()||Wt)}function Fe(){return process.env[Qn]?.trim()||Wt||_t}function Jn(...e){return yt(Fe(),...e)}function _s(e,...t){let n=Fe();return Gt(n)?yt(n,...t):yt(e,n,...t)}function mu(e,t=process.cwd()){let n=(i,s)=>{let a=Gs(i,s);return a===""||!a.startsWith("..")&&!Gt(a)},r=Gt(e)?e:yt(t,e);return n(_s(t),r)}function Yn(e){let t=e.infrastructure?.compute!=null,n=Object.values(e.environments??{}).some((r)=>r?.app!=null);return{server:t,serverless:n}}function gu(e){if(e.mode==="server"||e.mode==="serverless")return e.mode;let{serverless:t}=Yn(e);return t?"serverless":"server"}function yu(e){let{server:t,serverless:n}=Yn(e);if(t&&n)return"A project cannot be both a server and a serverless deployment. Found `infrastructure.compute` (server) AND `environments.<env>.app` (serverless Lambda). Keep one: remove `infrastructure.compute` for a serverless app, or remove `environments.<env>.app` for a server.";if(e.mode==="server"&&n&&!t)return"Config sets `mode: 'server'` but declares a serverless app (`environments.<env>.app`). Remove the app or change the mode.";if(e.mode==="serverless"&&t&&!n)return"Config sets `mode: 'serverless'` but declares a server (`infrastructure.compute`). Remove the compute block or change the mode.";return null}function hu(e){return e.infrastructure?.appDatabase??e.infrastructure?.compute?.database}function Ws(e){return typeof e==="object"&&e!==null?e:{}}function Vs(e){return e===!0||typeof e==="object"&&e!==null}function Us(e,t){let n=t?e.environments?.[t]:void 0;if(n?.domain)return n.domain;let r=Object.values(e.sites??{}),i=e.sites?.main?.domain??r.find((s)=>s.domain)?.domain;if(i)return i;return`${e.project?.slug??"app"}.local`}function Hs(e){let t=e.indexOf(".");return t>0?e.slice(t+1):void 0}function js(e,t={}){let n=e.infrastructure?.compute?.managedServices?.mail,r=Ws(n),i=t.environmentType??(t.environment?e.environments?.[t.environment]?.type:void 0),s=r.mode??(i==="production"?"server":"catcher"),a=s==="server",o=Us(e,t.environment),c=r.hostname??(a?`mail.${o}`:"localhost"),l=r.ports??{},u=a?{smtp:l.smtp??25,submission:l.submission??587,submissions:l.submissions??465,imap:l.imap??143,imaps:l.imaps??993,webmail:l.webmail??8080,managesieve:l.managesieve}:{smtp:l.smtp??1025,submission:l.submission,submissions:l.submissions,imap:l.imap,imaps:l.imaps,webmail:l.webmail??8025,managesieve:l.managesieve},m=r.tls??{},p=m.enabled??a,g=!!(m.systemCredentials||m.certPath&&m.keyPath);if(m.systemCredentials&&Object.values(m.systemCredentials).some((W)=>!/^\/[a-z0-9_./-]+$/i.test(W)||W.includes("/../")))throw Error("Mail system credentials require absolute certificate paths");let y=(r.accounts??[]).map((W)=>({address:W.address,password:W.password,passwordPolicy:W.passwordPolicy??"initial"})),h=typeof r.dkim==="object"&&r.dkim!==null?r.dkim:{},b=r.dkim===!1?!1:r.dkim===!0||a,C=typeof r.webmail==="object"&&r.webmail!==null?r.webmail:{},T=r.webmail===!1?!1:C.enabled??!0,A=c.includes(".")&&!c.endsWith(".local")&&!/^\d+\.\d+\.\d+\.\d+$/.test(c),R=C.domain===!1?void 0:C.domain??(a&&A?c:void 0),P=C.tls??(R?!1:p),E=[...new Set(C.aliases??[])].filter((W)=>W!==R),w=r.spam??{},I=r.delivery??(a?"direct":"none"),D=r.expose??a,k=Hs(c),O=[...new Set([c,...k?[k]:[],...r.domains??[]])],ne=C.attachments?.maxFileBytes??20971520,_=C.attachments?.maxTotalBytes??20971520,q=C.attachments?.maxCount??20,F=C.undoSendSeconds??10;for(let[W,de,Oe]of[["maxFileBytes",ne,104857600],["maxTotalBytes",_,104857600],["maxCount",q,100],["undoSendSeconds",F,30]])if(!Number.isInteger(de)||de<0||de>Oe)throw Error(`Mail webmail ${W} must be an integer from 0 to ${Oe}`);return{enabled:Vs(n),mode:s,version:r.version,hostname:c,domains:O,ports:u,tls:{enabled:p,acme:p&&!g&&(m.acme??!0),certPath:m.systemCredentials?"/run/credentials/mail.service/server.crt":m.certPath,keyPath:m.systemCredentials?"/run/credentials/mail.service/server.key":m.keyPath,systemCredentials:m.systemCredentials,requireForAuth:m.requireForAuth??(p&&a),acmeEmail:m.acmeEmail??y[0]?.address},dkim:{enabled:b,selector:h.selector??"default",rotate:h.rotate??!1,rotateIntervalDays:h.rotateIntervalDays??90},webmail:{enabled:T,port:C.port??u.webmail,domain:R,aliases:E,tls:P,secureCookies:C.secureCookies??(!!R||P),attachmentMaxFileBytes:ne,attachmentMaxTotalBytes:_,attachmentMaxCount:q,undoSendSeconds:F},delivery:I,sesRegion:r.sesRegion??"us-east-1",accounts:y,storagePath:r.storagePath??"/var/lib/mail",maxMessageSize:r.maxMessageSize??26214400,spam:{enabled:w.enabled??a,enforce:w.enforce??!1,junkScore:w.junkScore??5,rejectScore:w.rejectScore??12,dnsbl:w.dnsbl??a,dnsblReject:w.dnsblReject??!1,greylist:w.greylist??!1},webhookUrl:r.webhookUrl,expose:D,bindAddress:D?"0.0.0.0":"127.0.0.1"}}function Su(e){if(!e.enabled||!e.expose)return[];let t=[e.ports.smtp,e.ports.submission,e.ports.submissions,e.ports.imap,e.ports.imaps,e.ports.managesieve].filter((n)=>typeof n==="number");if(e.webmail.enabled&&!e.webmail.domain)t.push(e.webmail.port);return[...new Set(t)].sort((n,r)=>n-r)}function Au(e){if(!e.enabled)return{};let t=e.ports.submission??e.ports.smtp,n={MAIL_MAILER:"smtp",MAIL_HOST:"127.0.0.1",MAIL_PORT:String(t)};if(e.mode==="server"){n.MAIL_ENCRYPTION=e.tls.enabled?"tls":"null";let r=e.accounts[0];if(r)n.MAIL_USERNAME=r.address,n.MAIL_PASSWORD=r.password}else n.MAIL_ENCRYPTION="null",n.MAIL_USERNAME="null",n.MAIL_PASSWORD="null";return n}function Cu(e){if(!e.enabled||!e.webmail.enabled||!e.webmail.domain)return{};let t=[e.webmail.domain,...e.webmail.aliases];if(!Number.isInteger(e.webmail.port)||e.webmail.port<1||e.webmail.port>65535)throw Error("Mail webmail port must be between 1 and 65535");return Object.fromEntries(t.map((n,r)=>{if(!/^(?:[a-z0-9](?:[a-z0-9-]{0,61}[a-z0-9])?\.)+[a-z0-9](?:[a-z0-9-]{0,61}[a-z0-9])?$/i.test(n))throw Error(`Invalid mail webmail hostname: ${n}`);return[`__mail_webmail_${r}`,{domain:n,proxyTo:`localhost:${e.webmail.port}`}]}))}function vu(e,t={}){let n=e.infrastructure?.compute?.proxy,r=js(e,t);if(!r.enabled||!r.webmail.enabled||!r.webmail.domain)return n;return{engine:"rpx",onDemandTls:!0,onDemandTlsEmail:r.tls.acmeEmail??`webmaster@${r.webmail.domain}`,...n}}function Ru(e){if(e.cloud?.provider)return e.cloud.provider;if(e.ssh?.hosts?.length)return"ssh";if(e.hetzner?.apiToken)return"hetzner";return"aws"}class Ks{template;constructor(e){this.template={AWSTemplateFormatVersion:"2010-09-09",Description:e,Resources:{}}}addResource(e,t){return this.template.Resources[e]=t,this}addResources(e){return Object.assign(this.template.Resources,e),this}addParameter(e,t){if(!this.template.Parameters)this.template.Parameters={};return this.template.Parameters[e]=t,this}addOutput(e,t){if(!this.template.Outputs)this.template.Outputs={};return this.template.Outputs[e]=t,this}addMetadata(e,t){if(!this.template.Metadata)this.template.Metadata={};return this.template.Metadata[e]=t,this}hasResource(e){return e in this.template.Resources}getResources(){return this.template.Resources}build(){return this.template}toJSON(e=!0){return JSON.stringify(this.template,null,e?2:0)}toYAML(){return this.convertToYAML(this.template)}convertToYAML(e,t=0){let n="  ".repeat(t),r="";for(let[i,s]of Object.entries(e)){if(s===null||s===void 0)continue;if(typeof s==="object"&&!Array.isArray(s))r+=`${n}${i}:
 ${this.convertToYAML(s,t+1)}`;else if(Array.isArray(s)){r+=`${n}${i}:
 `;for(let a of s)if(typeof a==="object")r+=`${n}  -
 ${this.convertToYAML(a,t+2)}`;else r+=`${n}  - ${a}
@@ -209,7 +209,7 @@ exports.handler = async (event) => {
 
   return request;
 };
-`.trim()};static Config={ttl:(e)=>{let{min:t=0,max:n=86400,default:r=86400}=e;return{MinTTL:t,MaxTTL:n,DefaultTTL:r}},cookies:(e,t)=>{let n={Forward:e==="allowList"?"whitelist":e};if(e==="allowList"&&t)n.WhitelistedNames=t;return n},allowedMethods:(e)=>{let t={ALL:["GET","HEAD","OPTIONS","PUT","POST","PATCH","DELETE"],GET_HEAD:["GET","HEAD"],GET_HEAD_OPTIONS:["GET","HEAD","OPTIONS"]};return t[e]||t.GET_HEAD},cachedMethods:(e)=>{let t={GET_HEAD:["GET","HEAD"],GET_HEAD_OPTIONS:["GET","HEAD","OPTIONS"]};return t[e]||t.GET_HEAD},ttlPresets:{static:{min:0,max:31536000,default:31536000},dynamic:{min:0,max:0,default:0},api:{min:0,max:3600,default:60},html:{min:0,max:86400,default:86400},images:{min:0,max:604800,default:604800}},cacheBehavior:(e)=>{let{ttl:t={min:0,max:86400,default:86400},cookies:n="none",allowedCookies:r,allowedMethods:i="GET_HEAD",cachedMethods:s="GET_HEAD",compress:a=!0,forwardQueryString:o=!0,forwardHeaders:c=[]}=e;return{MinTTL:t.min,MaxTTL:t.max,DefaultTTL:t.default,Compress:a,AllowedMethods:se.Config.allowedMethods(i),CachedMethods:se.Config.cachedMethods(s),ForwardedValues:{QueryString:o,Headers:c,Cookies:se.Config.cookies(n,r)}}}};static applyConfig(e,t){let n=e.Properties.DistributionConfig.DefaultCacheBehavior;if(t.ttl)n.MinTTL=t.ttl.min,n.MaxTTL=t.ttl.max,n.DefaultTTL=t.ttl.default;if(t.compress!==void 0)n.Compress=t.compress;if(t.allowedMethods)n.AllowedMethods=se.Config.allowedMethods(t.allowedMethods);if(t.cachedMethods)n.CachedMethods=se.Config.cachedMethods(t.cachedMethods);if(t.cookies){if(!n.ForwardedValues)n.ForwardedValues={QueryString:!0};n.ForwardedValues.Cookies=se.Config.cookies(t.cookies,t.allowedCookies)}return e}}var da=[403,404,500,502,503,504],ma="TsCloud::StorageFailover",pa="AllowCloudFrontFailoverRead",ga=/^[a-z]{2}(?:-gov)?-[a-z]+-\d$/,ya=/^[a-z0-9][a-z0-9.-]{1,61}[a-z0-9]$/;function cd(e){let{failover:t,primaryBucket:n,primaryRegion:r}=e,i=e.where??"storage failover";if(!t||typeof t!=="object")throw Error(`${i}.failover must be an object such as { region: 'us-west-2' }.`);if(!t.region||!ga.test(t.region))throw Error(`${i}.failover.region must be an AWS region such as 'us-west-2', got ${JSON.stringify(t.region)}.`);if(t.region===r)throw Error(`${i}.failover.region is ${t.region}, the same region as the primary bucket. Failover only helps when the replica is in another region.`);let s=t.bucket??`${n}-${t.region}`;if(!ya.test(s)||s.includes("..")){let a=t.bucket===void 0&&s.length>63?` The default name (<primary bucket>-<region>) is ${s.length} characters; S3 allows 63. Set ${i}.failover.bucket.`:"";throw Error(`${i}.failover: "${s}" is not a valid S3 bucket name.${a}`)}if(s===n)throw Error(`${i}.failover.bucket must differ from the primary bucket "${n}".`);return{replicaBucket:s,replicaRegion:t.region,replicate:t.replicate!==!1,statusCodes:ht(t.statusCodes??da),primaryConnection:Ge(t,`${i}.failover`)}}function ld(e,t){return`${e}.s3.${t}.amazonaws.com`}function ud(e){let t=`arn:aws:s3:::${e.primaryBucket}`,n=`arn:aws:s3:::${e.replicaBucket}`;return{Type:"AWS::IAM::Role",Properties:{...e.roleName?{RoleName:e.roleName}:{},AssumeRolePolicyDocument:{Version:"2012-10-17",Statement:[{Effect:"Allow",Principal:{Service:"s3.amazonaws.com"},Action:"sts:AssumeRole"}]},Policies:[{PolicyName:"failover-replication",PolicyDocument:{Version:"2012-10-17",Statement:[{Effect:"Allow",Action:["s3:GetReplicationConfiguration","s3:ListBucket"],Resource:t},{Effect:"Allow",Action:["s3:GetObjectVersionForReplication","s3:GetObjectVersionAcl","s3:GetObjectVersionTagging"],Resource:`${t}/*`},{Effect:"Allow",Action:["s3:ReplicateObject","s3:ReplicateDelete","s3:ReplicateTags"],Resource:`${n}/*`}]}}]}}}function dd(e){return{Role:e.roleArn,Rules:[{Id:"cloudfront-failover-replica",Status:"Enabled",Priority:1,Filter:{Prefix:""},DeleteMarkerReplication:{Status:"Enabled"},Destination:{Bucket:`arn:aws:s3:::${e.replicaBucket}`}}]}}function md(e){return{Sid:pa,Effect:"Allow",Principal:{Service:"cloudfront.amazonaws.com"},Action:"s3:GetObject",Resource:`arn:aws:s3:::${e.replicaBucket}/*`,Condition:{StringEquals:{"AWS:SourceArn":e.distributionArn}}}}function pd(e){let n=(typeof e==="string"?JSON.parse(e):e)?.Metadata?.[ma];return Array.isArray(n)?n:[]}class J{static createHostedZone(e){let{domain:t,slug:n,environment:r,comment:i}=e,s=S({slug:n,environment:r,resourceType:"hostedzone"}),a=f(`${s}-${t.replace(/\./g,"")}`);return{zone:{Type:"AWS::Route53::HostedZone",Properties:{Name:t,HostedZoneConfig:{Comment:i||`Hosted zone for ${t}`}}},logicalId:a}}static createRecord(e){let{hostedZoneId:t,hostedZoneName:n,name:r,type:i,ttl:s,values:a,aliasTarget:o}=e,c=f(`record-${r.replace(/\./g,"")}-${i}`),l={Type:"AWS::Route53::RecordSet",Properties:{Name:r,Type:i}};if(t)l.Properties.HostedZoneId=t;else if(n)l.Properties.HostedZoneName=n;if(o)l.Properties.AliasTarget={DNSName:o.dnsName,HostedZoneId:o.hostedZoneId,EvaluateTargetHealth:o.evaluateTargetHealth??!1};else l.Properties.TTL=s||300,l.Properties.ResourceRecords=a||[];return{record:l,logicalId:c}}static createCloudFrontAlias(e,t,n){return J.createRecord({hostedZoneId:n,name:e,type:"A",aliasTarget:{dnsName:t,hostedZoneId:"Z2FDTNDATAQYW2",evaluateTargetHealth:!1}})}static createAlbAlias(e,t,n,r){return J.createRecord({hostedZoneId:r,name:e,type:"A",aliasTarget:{dnsName:t,hostedZoneId:n,evaluateTargetHealth:!0}})}static createCname(e,t,n,r=300){return J.createRecord({hostedZoneId:n,name:e,type:"CNAME",ttl:r,values:[t]})}static createWwwRedirect(e,t){return J.createRecord({hostedZoneId:t,name:`www.${e}`,type:"CNAME",ttl:300,values:[e]})}static createMxRecords(e,t,n,r=300){return J.createRecord({hostedZoneId:n,name:e,type:"MX",ttl:r,values:t.map((i)=>`${i.priority} ${i.server}`)})}static createTxtRecord(e,t,n,r=300){return J.createRecord({hostedZoneId:n,name:e,type:"TXT",ttl:r,values:[`"${t}"`]})}static createSpfRecord(e,t,n){return J.createTxtRecord(e,t,n)}static createDmarcRecord(e,t,n,r){let i=`v=DMARC1; p=${t}; rua=mailto:${n}`;return J.createTxtRecord(`_dmarc.${e}`,i,r)}static createS3WebsiteAlias(e,t,n,r){return J.createRecord({hostedZoneId:r,name:e,type:"A",aliasTarget:{dnsName:t,hostedZoneId:n,evaluateTargetHealth:!1}})}static S3WebsiteHostedZoneIds={"us-east-1":"Z3AQBSTGFYJSTF","us-east-2":"Z2O1EMRO9K5GLX","us-west-1":"Z2F56UZL2M1ACD","us-west-2":"Z3BJ6K6RIION7M","af-south-1":"Z83WF9RJE8B12","ap-east-1":"ZNB98KWMFR0R6","ap-south-1":"Z11RGJOFQNVJUP","ap-south-2":"Z02976202B4EZMXIPMXF7","ap-northeast-1":"Z2M4EHUR26P7ZW","ap-northeast-2":"Z3W03O7B5YMIYP","ap-northeast-3":"Z2YQB5RD63NC85","ap-southeast-1":"Z3O0J2DXBE1FTB","ap-southeast-2":"Z1WCIBER6CPFUU","ap-southeast-3":"Z01613992JD795ZI93075","ca-central-1":"Z1QDHH18159H29","eu-central-1":"Z21DNDUVLTQW6Q","eu-central-2":"Z030506016YDQGETNASS","eu-west-1":"Z1BKCTXD74EZPE","eu-west-2":"Z3GKZC51ZF0DB4","eu-west-3":"Z3R1K369G5AVDG","eu-north-1":"Z3BAZG2TWCNX0D","eu-south-1":"Z30OZKI7KPW7MI","eu-south-2":"Z0081959F7139GRJC19J","me-south-1":"Z1MPMWCPA7YB62","me-central-1":"Z06143092I8HRBER9VXCO","sa-east-1":"Z7KQH4QJS55SO"};static getS3WebsiteEndpoint(e,t){return`${e}.s3-website-${t}.amazonaws.com`}static createStoreRecord(e,t,n){return J.createCname(`store.${e}`,t,n)}static createApiRecord(e,t,n){return J.createCname(`api.${e}`,t,n)}static createDocsRecord(e,t,n){return J.createCname(`docs.${e}`,t,n)}static CloudFrontHostedZoneId="Z2FDTNDATAQYW2"}class U{static createCertificate(e){let{domain:t,subdomains:n=[],slug:r,environment:i,validationMethod:s="DNS",hostedZoneId:a}=e,o=S({slug:r,environment:i,resourceType:"acm"}),c=f(`${o}-${t.replace(/\./g,"")}`),l=[t];for(let m of n)if(m==="*")l.push(`*.${t}`);else l.push(`${m}.${t}`);let u={Type:"AWS::CertificateManager::Certificate",Properties:{DomainName:t,SubjectAlternativeNames:l,ValidationMethod:s}};if(s==="DNS"&&a)u.Properties.DomainValidationOptions=l.map((m)=>({DomainName:m,HostedZoneId:a}));return{certificate:u,logicalId:c}}static createKmsKey(e){let{description:t,slug:n,environment:r,enableRotation:i=!0,multiRegion:s=!1}=e,a=S({slug:n,environment:r,resourceType:"kms"}),o=f(a),c={Version:"2012-10-17",Statement:[{Sid:"Enable IAM User Permissions",Effect:"Allow",Principal:{AWS:v.Sub("arn:aws:iam::${AWS::AccountId}:root")},Action:"kms:*",Resource:"*"},{Sid:"Allow services to use the key",Effect:"Allow",Principal:{Service:["s3.amazonaws.com","cloudfront.amazonaws.com","logs.amazonaws.com","secretsmanager.amazonaws.com"]},Action:["kms:Decrypt","kms:GenerateDataKey"],Resource:"*"}]},l={Type:"AWS::KMS::Key",Properties:{Description:t,Enabled:!0,EnableKeyRotation:i,KeyPolicy:c,KeySpec:"SYMMETRIC_DEFAULT",KeyUsage:"ENCRYPT_DECRYPT",MultiRegion:s}},u=f(`${a}-alias`),m={Type:"AWS::KMS::Alias",Properties:{AliasName:`alias/${n}-${r}`,TargetKeyId:v.Ref(o)}};return{key:l,alias:m,logicalId:o,aliasId:u}}static createFirewall(e){let{slug:t,environment:n,scope:r="CLOUDFRONT",defaultAction:i="allow"}=e,s=S({slug:t,environment:n,resourceType:"waf"}),a=f(s);return{webAcl:{Type:"AWS::WAFv2::WebACL",Properties:{Name:s,Scope:r,DefaultAction:i==="allow"?{Allow:{}}:{Block:{}},Description:`WAF for ${t} ${n}`,Rules:[],VisibilityConfig:{SampledRequestsEnabled:!0,CloudWatchMetricsEnabled:!0,MetricName:`${s}-metric`}}},logicalId:a}}static setRateLimit(e,t){if(!e.Properties.Rules)e.Properties.Rules=[];return e.Properties.Rules.push({Name:t.name,Priority:t.priority,Statement:{RateBasedStatement:{Limit:t.requestsPerWindow,AggregateKeyType:t.aggregateKeyType||"IP"}},Action:{Block:{}},VisibilityConfig:{SampledRequestsEnabled:!0,CloudWatchMetricsEnabled:!0,MetricName:`${t.name}-metric`}}),e}static blockCountries(e,t){if(!e.Properties.Rules)e.Properties.Rules=[];return e.Properties.Rules.push({Name:t.name,Priority:t.priority,Statement:{GeoMatchStatement:{CountryCodes:t.countryCodes}},Action:{Block:{}},VisibilityConfig:{SampledRequestsEnabled:!0,CloudWatchMetricsEnabled:!0,MetricName:`${t.name}-metric`}}),e}static blockIpAddresses(e,t,n,r){let i=S({slug:n,environment:r,resourceType:"ipset"}),s=f(`${i}-${t.name}`),a={Type:"AWS::WAFv2::IPSet",Properties:{Name:`${i}-${t.name}`,Scope:e.Properties.Scope,IPAddressVersion:t.ipVersion||"IPV4",Addresses:t.ipAddresses,Description:`Blocked IPs for ${t.name}`}};if(!e.Properties.Rules)e.Properties.Rules=[];return e.Properties.Rules.push({Name:t.name,Priority:t.priority,Statement:{IPSetReferenceStatement:{Arn:v.GetAtt(s,"Arn")}},Action:{Block:{}},VisibilityConfig:{SampledRequestsEnabled:!0,CloudWatchMetricsEnabled:!0,MetricName:`${t.name}-metric`}}),{webAcl:e,ipSet:a,ipSetLogicalId:s}}static addManagedRules(e,t){if(!e.Properties.Rules)e.Properties.Rules=[];let n={ManagedRuleGroupStatement:{VendorName:t.vendorName,Name:t.ruleName}};if(t.excludedRules&&t.excludedRules.length>0)n.ManagedRuleGroupStatement.ExcludedRules=t.excludedRules.map((r)=>({Name:r}));return e.Properties.Rules.push({Name:t.name,Priority:t.priority,Statement:n,VisibilityConfig:{SampledRequestsEnabled:!0,CloudWatchMetricsEnabled:!0,MetricName:`${t.name}-metric`}}),e}static ManagedRuleGroups={CoreRuleSet:{vendorName:"AWS",ruleName:"AWSManagedRulesCommonRuleSet"},KnownBadInputs:{vendorName:"AWS",ruleName:"AWSManagedRulesKnownBadInputsRuleSet"},SqlDatabase:{vendorName:"AWS",ruleName:"AWSManagedRulesSQLiRuleSet"},LinuxOS:{vendorName:"AWS",ruleName:"AWSManagedRulesLinuxRuleSet"},PosixOS:{vendorName:"AWS",ruleName:"AWSManagedRulesUnixRuleSet"},AmazonIpReputation:{vendorName:"AWS",ruleName:"AWSManagedRulesAmazonIpReputationList"},AnonymousIpList:{vendorName:"AWS",ruleName:"AWSManagedRulesAnonymousIpList"},BotControl:{vendorName:"AWS",ruleName:"AWSManagedRulesBotControlRuleSet"}};static setPathRateLimit(e,t){if(!e.Properties.Rules)e.Properties.Rules=[];let n=t.paths.map((r)=>({SearchString:r,FieldToMatch:{UriPath:{}},TextTransformation:[{Priority:0,Type:"LOWERCASE"}],PositionalConstraint:"STARTS_WITH"}));return e.Properties.Rules.push({Name:t.name,Priority:t.priority,Statement:{RateBasedStatement:{Limit:t.requestsPerWindow,AggregateKeyType:t.aggregateKeyType||"IP",ScopeDownStatement:{OrStatement:{Statements:n.map((r)=>({ByteMatchStatement:r}))}}}},Action:{Block:{}},VisibilityConfig:{SampledRequestsEnabled:!0,CloudWatchMetricsEnabled:!0,MetricName:`${t.name}-metric`}}),e}static setHeaderRateLimit(e,t){if(!e.Properties.Rules)e.Properties.Rules=[];let n={RateBasedStatement:{Limit:t.requestsPerWindow,AggregateKeyType:"CUSTOM_KEYS",CustomKeys:[{Header:{Name:t.headerName,TextTransformations:[{Priority:0,Type:"NONE"}]}}]}};if(t.headerValue)n.RateBasedStatement.ScopeDownStatement={ByteMatchStatement:{SearchString:t.headerValue,FieldToMatch:{SingleHeader:{Name:t.headerName}},TextTransformation:[{Priority:0,Type:"NONE"}],PositionalConstraint:"EXACTLY"}};return e.Properties.Rules.push({Name:t.name,Priority:t.priority,Statement:n,Action:{Block:{}},VisibilityConfig:{SampledRequestsEnabled:!0,CloudWatchMetricsEnabled:!0,MetricName:`${t.name}-metric`}}),e}static protectLoginEndpoint(e,t){let{loginPaths:n,priority:r,requestsPerMinute:i=10}=t;return U.setPathRateLimit(e,{name:"LoginRateLimit",priority:r,requestsPerWindow:i*5,paths:n}),e}static protectApiEndpoints(e,t){let{apiPaths:n,priority:r,requestsPerMinute:i=100}=t;return U.setPathRateLimit(e,{name:"ApiRateLimit",priority:r,requestsPerWindow:i*5,paths:n}),e}static createProtectedFirewall(e){let{slug:t,environment:n,scope:r="CLOUDFRONT",enableBotControl:i=!1,enableRateLimiting:s=!0,rateLimitPerMinute:a=2000}=e,{webAcl:o,logicalId:c}=U.createFirewall({slug:t,environment:n,scope:r,defaultAction:"allow"}),l=0;if(o=U.addManagedRules(o,{name:"AWSIPReputationList",priority:l++,...U.ManagedRuleGroups.AmazonIpReputation}),o=U.addManagedRules(o,{name:"AWSAnonymousIPList",priority:l++,...U.ManagedRuleGroups.AnonymousIpList}),o=U.addManagedRules(o,{name:"AWSCoreRuleSet",priority:l++,...U.ManagedRuleGroups.CoreRuleSet}),o=U.addManagedRules(o,{name:"AWSKnownBadInputs",priority:l++,...U.ManagedRuleGroups.KnownBadInputs}),o=U.addManagedRules(o,{name:"AWSSQLi",priority:l++,...U.ManagedRuleGroups.SqlDatabase}),i)o=U.addManagedRules(o,{name:"AWSBotControl",priority:l++,...U.ManagedRuleGroups.BotControl});if(s)o=U.setRateLimit(o,{name:"GlobalRateLimit",priority:l++,requestsPerWindow:a*5});return{webAcl:o,logicalId:c}}static RateLimitPresets={STANDARD:2000,HIGH_TRAFFIC:1e4,STRICT:100,LOGIN:10,API:100}}function fa(e){let t=e.split(".")[0]??"";return t==="a1"||/^[a-z]+\d+g[a-z]*$/.test(t)}function ha(e="t3.micro"){return`/aws/service/ami-amazon-linux-latest/al2023-ami-kernel-default-${fa(e)?"arm64":"x86_64"}`}function lr(e="t3.micro"){return`{{resolve:ssm:${ha(e)}}}`}class x{static createServer(e){let{slug:t,environment:n,instanceType:r="t3.micro",imageId:i=lr(r),keyName:s,securityGroupIds:a,subnetId:o,userData:c,volumeSize:l=20,volumeType:u="gp3",encrypted:m=!0}=e,p=S({slug:t,environment:n,resourceType:"ec2"}),g=f(p),y={Type:"AWS::EC2::Instance",Properties:{ImageId:i,InstanceType:r,Tags:[{Key:"Name",Value:p},{Key:"Environment",Value:n}]}};if(s)y.Properties.KeyName=s;if(a)y.Properties.SecurityGroupIds=a;if(o)y.Properties.SubnetId=o;if(c)y.Properties.UserData=v.Base64(c);return y.Properties.BlockDeviceMappings=[{DeviceName:"/dev/xvda",Ebs:{VolumeSize:l,VolumeType:u,Encrypted:m,DeleteOnTermination:!0}}],{instance:y,logicalId:g}}static createSecurityGroup(e){let{slug:t,environment:n,vpcId:r,description:i,ingress:s=[],egress:a=[]}=e,o=S({slug:t,environment:n,resourceType:"sg"}),c=f(o),l={Type:"AWS::EC2::SecurityGroup",Properties:{GroupDescription:i||`Security group for ${t} ${n}`,Tags:[{Key:"Name",Value:o},{Key:"Environment",Value:n}]}};if(r)l.Properties.VpcId=r;if(s.length>0)l.Properties.SecurityGroupIngress=s.map((u)=>({IpProtocol:u.protocol,FromPort:u.fromPort,ToPort:u.toPort,CidrIp:u.cidr,SourceSecurityGroupId:u.sourceSecurityGroupId}));if(a.length>0)l.Properties.SecurityGroupEgress=a.map((u)=>({IpProtocol:u.protocol,FromPort:u.fromPort,ToPort:u.toPort,CidrIp:u.cidr,DestinationSecurityGroupId:u.sourceSecurityGroupId}));return{securityGroup:l,logicalId:c}}static createWebServerSecurityGroup(e,t,n){return x.createSecurityGroup({slug:e,environment:t,vpcId:n,description:"Security group for web servers - HTTP, HTTPS, SSH",ingress:[{protocol:"tcp",fromPort:80,toPort:80,cidr:"0.0.0.0/0"},{protocol:"tcp",fromPort:443,toPort:443,cidr:"0.0.0.0/0"},{protocol:"tcp",fromPort:22,toPort:22,cidr:"0.0.0.0/0"}],egress:[{protocol:"-1",fromPort:0,toPort:0,cidr:"0.0.0.0/0"}]})}static createLoadBalancer(e){let{slug:t,environment:n,scheme:r="internet-facing",subnets:i,securityGroups:s,type:a="application"}=e,o=S({slug:t,environment:n,resourceType:"alb"}),c=f(o),l={Type:"AWS::ElasticLoadBalancingV2::LoadBalancer",Properties:{Name:o,Scheme:r,Type:a,Subnets:i,Tags:[{Key:"Name",Value:o},{Key:"Environment",Value:n}]}};if(s)l.Properties.SecurityGroups=s;return{loadBalancer:l,logicalId:c}}static createTargetGroup(e){let{slug:t,environment:n,port:r,protocol:i="HTTP",vpcId:s,targetType:a="ip",healthCheckPath:o="/",healthCheckInterval:c=30,healthCheckTimeout:l=5,healthyThreshold:u=2,unhealthyThreshold:m=3}=e,p=S({slug:t,environment:n,resourceType:"tg"}),g=f(p);return{targetGroup:{Type:"AWS::ElasticLoadBalancingV2::TargetGroup",Properties:{Name:p,Port:r,Protocol:i,VpcId:s,TargetType:a,HealthCheckEnabled:!0,HealthCheckProtocol:i,HealthCheckPath:o,HealthCheckIntervalSeconds:c,HealthCheckTimeoutSeconds:l,HealthyThresholdCount:u,UnhealthyThresholdCount:m,Tags:[{Key:"Name",Value:p},{Key:"Environment",Value:n}]}},logicalId:g}}static createListener(e,t){let{port:n,protocol:r="HTTP",certificateArn:i,defaultTargetGroupArn:s}=t,a=f(`listener-${e}-${n}`),o={Type:"AWS::ElasticLoadBalancingV2::Listener",Properties:{LoadBalancerArn:v.Ref(e),Port:n,Protocol:r,DefaultActions:[{Type:"forward",TargetGroupArn:s}]}};if(r==="HTTPS"&&i)o.Properties.Certificates=[{CertificateArn:i}],o.Properties.SslPolicy="ELBSecurityPolicy-TLS13-1-2-2021-06";return{listener:o,logicalId:a}}static createEcsCluster(e,t){let n=S({slug:e,environment:t,resourceType:"ecs-cluster"}),r=f(n);return{cluster:{Type:"AWS::ECS::Cluster",Properties:{ClusterName:n,Tags:[{Key:"Name",Value:n},{Key:"Environment",Value:t}]}},logicalId:r}}static createFargateService(e){let{slug:t,environment:n,image:r,cpu:i="256",memory:s="512",desiredCount:a=1,containerPort:o=8080,environmentVariables:c={},secrets:l=[],healthCheck:u,logGroup:m,subnets:p,securityGroups:g,targetGroupArn:y}=e,{cluster:h,logicalId:b}=x.createEcsCluster(t,n),C=S({slug:t,environment:n,resourceType:"fargate"}),T=f(`${C}-execution-role`),A={Type:"AWS::IAM::Role",Properties:{AssumeRolePolicyDocument:{Version:"2012-10-17",Statement:[{Effect:"Allow",Principal:{Service:"ecs-tasks.amazonaws.com"},Action:"sts:AssumeRole"}]},ManagedPolicyArns:["arn:aws:iam::aws:policy/service-role/AmazonECSTaskExecutionRolePolicy"]}},R=f(`${C}-task-role`),P={Type:"AWS::IAM::Role",Properties:{AssumeRolePolicyDocument:{Version:"2012-10-17",Statement:[{Effect:"Allow",Principal:{Service:"ecs-tasks.amazonaws.com"},Action:"sts:AssumeRole"}]}}},E=f(`${C}-task`),w={Type:"AWS::ECS::TaskDefinition",Properties:{Family:C,TaskRoleArn:v.GetAtt(R,"Arn"),ExecutionRoleArn:v.GetAtt(T,"Arn"),NetworkMode:"awsvpc",RequiresCompatibilities:["FARGATE"],Cpu:i,Memory:s,ContainerDefinitions:[{Name:t,Image:r,Essential:!0,PortMappings:[{ContainerPort:o,Protocol:"tcp"}],Environment:Object.entries(c).map(([k,O])=>({Name:k,Value:O})),Secrets:l.map((k)=>({Name:k.name,ValueFrom:k.valueFrom}))}],Tags:[{Key:"Name",Value:C},{Key:"Environment",Value:n}]}};if(u)w.Properties.ContainerDefinitions[0].HealthCheck={Command:u.command,Interval:u.interval||30,Timeout:u.timeout||5,Retries:u.retries||3,StartPeriod:60};if(m)w.Properties.ContainerDefinitions[0].LogConfiguration={LogDriver:"awslogs",Options:{"awslogs-group":m,"awslogs-region":v.Ref("AWS::Region"),"awslogs-stream-prefix":t}};let I=f(`${C}-service`),D={Type:"AWS::ECS::Service",Properties:{ServiceName:C,Cluster:v.Ref(b),TaskDefinition:v.Ref(E),DesiredCount:a,LaunchType:"FARGATE",NetworkConfiguration:{AwsvpcConfiguration:{Subnets:p,SecurityGroups:g,AssignPublicIp:"ENABLED"}},Tags:[{Key:"Name",Value:C},{Key:"Environment",Value:n}]}};if(y)D.Properties.LoadBalancers=[{TargetGroupArn:y,ContainerName:t,ContainerPort:o}];return{cluster:h,taskDefinition:w,service:D,taskRole:P,executionRole:A,clusterLogicalId:b,taskDefinitionLogicalId:E,serviceLogicalId:I,taskRoleLogicalId:R,executionRoleLogicalId:T}}static createLambdaFunction(e){let{slug:t,environment:n,runtime:r,handler:i,code:s,timeout:a=30,memorySize:o=128,environmentVariables:c={},vpcConfig:l}=e,u=S({slug:t,environment:n,resourceType:"lambda"}),m=f(u),p=f(`${u}-role`),g={Type:"AWS::IAM::Role",Properties:{AssumeRolePolicyDocument:{Version:"2012-10-17",Statement:[{Effect:"Allow",Principal:{Service:"lambda.amazonaws.com"},Action:"sts:AssumeRole"}]},ManagedPolicyArns:["arn:aws:iam::aws:policy/service-role/AWSLambdaBasicExecutionRole"]}};if(l)g.Properties.ManagedPolicyArns.push("arn:aws:iam::aws:policy/service-role/AWSLambdaVPCAccessExecutionRole");let y={Type:"AWS::Lambda::Function",Properties:{FunctionName:u,Runtime:r,Role:v.GetAtt(p,"Arn"),Handler:i,Code:{...s.s3Bucket&&{S3Bucket:s.s3Bucket},...s.s3Key&&{S3Key:s.s3Key},...s.zipFile&&{ZipFile:s.zipFile}},Timeout:a,MemorySize:o,Tags:[{Key:"Name",Value:u},{Key:"Environment",Value:n}]}};if(Object.keys(c).length>0)y.Properties.Environment={Variables:c};if(l)y.Properties.VpcConfig={SecurityGroupIds:l.securityGroupIds,SubnetIds:l.subnetIds};return{lambdaFunction:y,role:g,logicalId:m,roleLogicalId:p}}static generateNodeServerUserData(e={}){let{nodeVersion:t="20",appRepo:n,environment:r={}}=e,i=Object.entries(r).map(([s,a])=>`echo "export ${s}='${a}'" >> /etc/environment`).join(`
+`.trim()};static Config={ttl:(e)=>{let{min:t=0,max:n=86400,default:r=86400}=e;return{MinTTL:t,MaxTTL:n,DefaultTTL:r}},cookies:(e,t)=>{let n={Forward:e==="allowList"?"whitelist":e};if(e==="allowList"&&t)n.WhitelistedNames=t;return n},allowedMethods:(e)=>{let t={ALL:["GET","HEAD","OPTIONS","PUT","POST","PATCH","DELETE"],GET_HEAD:["GET","HEAD"],GET_HEAD_OPTIONS:["GET","HEAD","OPTIONS"]};return t[e]||t.GET_HEAD},cachedMethods:(e)=>{let t={GET_HEAD:["GET","HEAD"],GET_HEAD_OPTIONS:["GET","HEAD","OPTIONS"]};return t[e]||t.GET_HEAD},ttlPresets:{static:{min:0,max:31536000,default:31536000},dynamic:{min:0,max:0,default:0},api:{min:0,max:3600,default:60},html:{min:0,max:86400,default:86400},images:{min:0,max:604800,default:604800}},cacheBehavior:(e)=>{let{ttl:t={min:0,max:86400,default:86400},cookies:n="none",allowedCookies:r,allowedMethods:i="GET_HEAD",cachedMethods:s="GET_HEAD",compress:a=!0,forwardQueryString:o=!0,forwardHeaders:c=[]}=e;return{MinTTL:t.min,MaxTTL:t.max,DefaultTTL:t.default,Compress:a,AllowedMethods:se.Config.allowedMethods(i),CachedMethods:se.Config.cachedMethods(s),ForwardedValues:{QueryString:o,Headers:c,Cookies:se.Config.cookies(n,r)}}}};static applyConfig(e,t){let n=e.Properties.DistributionConfig.DefaultCacheBehavior;if(t.ttl)n.MinTTL=t.ttl.min,n.MaxTTL=t.ttl.max,n.DefaultTTL=t.ttl.default;if(t.compress!==void 0)n.Compress=t.compress;if(t.allowedMethods)n.AllowedMethods=se.Config.allowedMethods(t.allowedMethods);if(t.cachedMethods)n.CachedMethods=se.Config.cachedMethods(t.cachedMethods);if(t.cookies){if(!n.ForwardedValues)n.ForwardedValues={QueryString:!0};n.ForwardedValues.Cookies=se.Config.cookies(t.cookies,t.allowedCookies)}return e}}var da=[403,404,500,502,503,504],ma="TsCloud::StorageFailover",pa="AllowCloudFrontFailoverRead",ga=/^[a-z]{2}(?:-gov)?-[a-z]+-\d$/,ya=/^[a-z0-9][a-z0-9.-]{1,61}[a-z0-9]$/;function cd(e){let{failover:t,primaryBucket:n,primaryRegion:r}=e,i=e.where??"storage failover";if(!t||typeof t!=="object")throw Error(`${i}.failover must be an object such as { region: 'us-west-2' }.`);if(!t.region||!ga.test(t.region))throw Error(`${i}.failover.region must be an AWS region such as 'us-west-2', got ${JSON.stringify(t.region)}.`);if(t.region===r)throw Error(`${i}.failover.region is ${t.region}, the same region as the primary bucket. Failover only helps when the replica is in another region.`);let s=t.bucket??`${n}-${t.region}`;if(!ya.test(s)||s.includes("..")){let a=t.bucket===void 0&&s.length>63?` The default name (<primary bucket>-<region>) is ${s.length} characters; S3 allows 63. Set ${i}.failover.bucket.`:"";throw Error(`${i}.failover: "${s}" is not a valid S3 bucket name.${a}`)}if(s===n)throw Error(`${i}.failover.bucket must differ from the primary bucket "${n}".`);return{replicaBucket:s,replicaRegion:t.region,replicate:t.replicate!==!1,statusCodes:ht(t.statusCodes??da),primaryConnection:Ge(t,`${i}.failover`)}}function ld(e,t){return`${e}.s3.${t}.amazonaws.com`}function ud(e){let t=`arn:aws:s3:::${e.primaryBucket}`,n=`arn:aws:s3:::${e.replicaBucket}`;return{Type:"AWS::IAM::Role",Properties:{...e.roleName?{RoleName:e.roleName}:{},AssumeRolePolicyDocument:{Version:"2012-10-17",Statement:[{Effect:"Allow",Principal:{Service:"s3.amazonaws.com"},Action:"sts:AssumeRole"}]},Policies:[{PolicyName:"failover-replication",PolicyDocument:{Version:"2012-10-17",Statement:[{Effect:"Allow",Action:["s3:GetReplicationConfiguration","s3:ListBucket"],Resource:t},{Effect:"Allow",Action:["s3:GetObjectVersionForReplication","s3:GetObjectVersionAcl","s3:GetObjectVersionTagging"],Resource:`${t}/*`},{Effect:"Allow",Action:["s3:ReplicateObject","s3:ReplicateDelete","s3:ReplicateTags"],Resource:`${n}/*`}]}}]}}}function dd(e){return{Role:e.roleArn,Rules:[{Id:"cloudfront-failover-replica",Status:"Enabled",Priority:1,Filter:{Prefix:""},DeleteMarkerReplication:{Status:"Enabled"},Destination:{Bucket:`arn:aws:s3:::${e.replicaBucket}`}}]}}function md(e){return{Sid:pa,Effect:"Allow",Principal:{Service:"cloudfront.amazonaws.com"},Action:"s3:GetObject",Resource:`arn:aws:s3:::${e.replicaBucket}/*`,Condition:{StringEquals:{"AWS:SourceArn":e.distributionArn}}}}function pd(e){let n=(typeof e==="string"?JSON.parse(e):e)?.Metadata?.[ma];return Array.isArray(n)?n:[]}class J{static createHostedZone(e){let{domain:t,slug:n,environment:r,comment:i}=e,s=S({slug:n,environment:r,resourceType:"hostedzone"}),a=f(`${s}-${t.replace(/\./g,"")}`);return{zone:{Type:"AWS::Route53::HostedZone",Properties:{Name:t,HostedZoneConfig:{Comment:i||`Hosted zone for ${t}`}}},logicalId:a}}static createRecord(e){let{hostedZoneId:t,hostedZoneName:n,name:r,type:i,ttl:s,values:a,aliasTarget:o}=e,c=f(`record-${r.replace(/\./g,"")}-${i}`),l={Type:"AWS::Route53::RecordSet",Properties:{Name:r,Type:i}};if(t)l.Properties.HostedZoneId=t;else if(n)l.Properties.HostedZoneName=n;if(o)l.Properties.AliasTarget={DNSName:o.dnsName,HostedZoneId:o.hostedZoneId,EvaluateTargetHealth:o.evaluateTargetHealth??!1};else l.Properties.TTL=s||300,l.Properties.ResourceRecords=a||[];return{record:l,logicalId:c}}static createCloudFrontAlias(e,t,n){return J.createRecord({hostedZoneId:n,name:e,type:"A",aliasTarget:{dnsName:t,hostedZoneId:"Z2FDTNDATAQYW2",evaluateTargetHealth:!1}})}static createAlbAlias(e,t,n,r){return J.createRecord({hostedZoneId:r,name:e,type:"A",aliasTarget:{dnsName:t,hostedZoneId:n,evaluateTargetHealth:!0}})}static createCname(e,t,n,r=300){return J.createRecord({hostedZoneId:n,name:e,type:"CNAME",ttl:r,values:[t]})}static createWwwRedirect(e,t){return J.createRecord({hostedZoneId:t,name:`www.${e}`,type:"CNAME",ttl:300,values:[e]})}static createMxRecords(e,t,n,r=300){return J.createRecord({hostedZoneId:n,name:e,type:"MX",ttl:r,values:t.map((i)=>`${i.priority} ${i.server}`)})}static createTxtRecord(e,t,n,r=300){return J.createRecord({hostedZoneId:n,name:e,type:"TXT",ttl:r,values:[`"${t}"`]})}static createSpfRecord(e,t,n){return J.createTxtRecord(e,t,n)}static createDmarcRecord(e,t,n,r){let i=`v=DMARC1; p=${t}; rua=mailto:${n}`;return J.createTxtRecord(`_dmarc.${e}`,i,r)}static createS3WebsiteAlias(e,t,n,r){return J.createRecord({hostedZoneId:r,name:e,type:"A",aliasTarget:{dnsName:t,hostedZoneId:n,evaluateTargetHealth:!1}})}static S3WebsiteHostedZoneIds={"us-east-1":"Z3AQBSTGFYJSTF","us-east-2":"Z2O1EMRO9K5GLX","us-west-1":"Z2F56UZL2M1ACD","us-west-2":"Z3BJ6K6RIION7M","af-south-1":"Z83WF9RJE8B12","ap-east-1":"ZNB98KWMFR0R6","ap-south-1":"Z11RGJOFQNVJUP","ap-south-2":"Z02976202B4EZMXIPMXF7","ap-northeast-1":"Z2M4EHUR26P7ZW","ap-northeast-2":"Z3W03O7B5YMIYP","ap-northeast-3":"Z2YQB5RD63NC85","ap-southeast-1":"Z3O0J2DXBE1FTB","ap-southeast-2":"Z1WCIBER6CPFUU","ap-southeast-3":"Z01613992JD795ZI93075","ca-central-1":"Z1QDHH18159H29","eu-central-1":"Z21DNDUVLTQW6Q","eu-central-2":"Z030506016YDQGETNASS","eu-west-1":"Z1BKCTXD74EZPE","eu-west-2":"Z3GKZC51ZF0DB4","eu-west-3":"Z3R1K369G5AVDG","eu-north-1":"Z3BAZG2TWCNX0D","eu-south-1":"Z30OZKI7KPW7MI","eu-south-2":"Z0081959F7139GRJC19J","me-south-1":"Z1MPMWCPA7YB62","me-central-1":"Z06143092I8HRBER9VXCO","sa-east-1":"Z7KQH4QJS55SO"};static getS3WebsiteEndpoint(e,t){return`${e}.s3-website-${t}.amazonaws.com`}static createStoreRecord(e,t,n){return J.createCname(`store.${e}`,t,n)}static createApiRecord(e,t,n){return J.createCname(`api.${e}`,t,n)}static createDocsRecord(e,t,n){return J.createCname(`docs.${e}`,t,n)}static CloudFrontHostedZoneId="Z2FDTNDATAQYW2"}class H{static createCertificate(e){let{domain:t,subdomains:n=[],slug:r,environment:i,validationMethod:s="DNS",hostedZoneId:a}=e,o=S({slug:r,environment:i,resourceType:"acm"}),c=f(`${o}-${t.replace(/\./g,"")}`),l=[t];for(let m of n)if(m==="*")l.push(`*.${t}`);else l.push(`${m}.${t}`);let u={Type:"AWS::CertificateManager::Certificate",Properties:{DomainName:t,SubjectAlternativeNames:l,ValidationMethod:s}};if(s==="DNS"&&a)u.Properties.DomainValidationOptions=l.map((m)=>({DomainName:m,HostedZoneId:a}));return{certificate:u,logicalId:c}}static createKmsKey(e){let{description:t,slug:n,environment:r,enableRotation:i=!0,multiRegion:s=!1}=e,a=S({slug:n,environment:r,resourceType:"kms"}),o=f(a),c={Version:"2012-10-17",Statement:[{Sid:"Enable IAM User Permissions",Effect:"Allow",Principal:{AWS:v.Sub("arn:aws:iam::${AWS::AccountId}:root")},Action:"kms:*",Resource:"*"},{Sid:"Allow services to use the key",Effect:"Allow",Principal:{Service:["s3.amazonaws.com","cloudfront.amazonaws.com","logs.amazonaws.com","secretsmanager.amazonaws.com"]},Action:["kms:Decrypt","kms:GenerateDataKey"],Resource:"*"}]},l={Type:"AWS::KMS::Key",Properties:{Description:t,Enabled:!0,EnableKeyRotation:i,KeyPolicy:c,KeySpec:"SYMMETRIC_DEFAULT",KeyUsage:"ENCRYPT_DECRYPT",MultiRegion:s}},u=f(`${a}-alias`),m={Type:"AWS::KMS::Alias",Properties:{AliasName:`alias/${n}-${r}`,TargetKeyId:v.Ref(o)}};return{key:l,alias:m,logicalId:o,aliasId:u}}static createFirewall(e){let{slug:t,environment:n,scope:r="CLOUDFRONT",defaultAction:i="allow"}=e,s=S({slug:t,environment:n,resourceType:"waf"}),a=f(s);return{webAcl:{Type:"AWS::WAFv2::WebACL",Properties:{Name:s,Scope:r,DefaultAction:i==="allow"?{Allow:{}}:{Block:{}},Description:`WAF for ${t} ${n}`,Rules:[],VisibilityConfig:{SampledRequestsEnabled:!0,CloudWatchMetricsEnabled:!0,MetricName:`${s}-metric`}}},logicalId:a}}static setRateLimit(e,t){if(!e.Properties.Rules)e.Properties.Rules=[];return e.Properties.Rules.push({Name:t.name,Priority:t.priority,Statement:{RateBasedStatement:{Limit:t.requestsPerWindow,AggregateKeyType:t.aggregateKeyType||"IP"}},Action:{Block:{}},VisibilityConfig:{SampledRequestsEnabled:!0,CloudWatchMetricsEnabled:!0,MetricName:`${t.name}-metric`}}),e}static blockCountries(e,t){if(!e.Properties.Rules)e.Properties.Rules=[];return e.Properties.Rules.push({Name:t.name,Priority:t.priority,Statement:{GeoMatchStatement:{CountryCodes:t.countryCodes}},Action:{Block:{}},VisibilityConfig:{SampledRequestsEnabled:!0,CloudWatchMetricsEnabled:!0,MetricName:`${t.name}-metric`}}),e}static blockIpAddresses(e,t,n,r){let i=S({slug:n,environment:r,resourceType:"ipset"}),s=f(`${i}-${t.name}`),a={Type:"AWS::WAFv2::IPSet",Properties:{Name:`${i}-${t.name}`,Scope:e.Properties.Scope,IPAddressVersion:t.ipVersion||"IPV4",Addresses:t.ipAddresses,Description:`Blocked IPs for ${t.name}`}};if(!e.Properties.Rules)e.Properties.Rules=[];return e.Properties.Rules.push({Name:t.name,Priority:t.priority,Statement:{IPSetReferenceStatement:{Arn:v.GetAtt(s,"Arn")}},Action:{Block:{}},VisibilityConfig:{SampledRequestsEnabled:!0,CloudWatchMetricsEnabled:!0,MetricName:`${t.name}-metric`}}),{webAcl:e,ipSet:a,ipSetLogicalId:s}}static addManagedRules(e,t){if(!e.Properties.Rules)e.Properties.Rules=[];let n={ManagedRuleGroupStatement:{VendorName:t.vendorName,Name:t.ruleName}};if(t.excludedRules&&t.excludedRules.length>0)n.ManagedRuleGroupStatement.ExcludedRules=t.excludedRules.map((r)=>({Name:r}));return e.Properties.Rules.push({Name:t.name,Priority:t.priority,Statement:n,VisibilityConfig:{SampledRequestsEnabled:!0,CloudWatchMetricsEnabled:!0,MetricName:`${t.name}-metric`}}),e}static ManagedRuleGroups={CoreRuleSet:{vendorName:"AWS",ruleName:"AWSManagedRulesCommonRuleSet"},KnownBadInputs:{vendorName:"AWS",ruleName:"AWSManagedRulesKnownBadInputsRuleSet"},SqlDatabase:{vendorName:"AWS",ruleName:"AWSManagedRulesSQLiRuleSet"},LinuxOS:{vendorName:"AWS",ruleName:"AWSManagedRulesLinuxRuleSet"},PosixOS:{vendorName:"AWS",ruleName:"AWSManagedRulesUnixRuleSet"},AmazonIpReputation:{vendorName:"AWS",ruleName:"AWSManagedRulesAmazonIpReputationList"},AnonymousIpList:{vendorName:"AWS",ruleName:"AWSManagedRulesAnonymousIpList"},BotControl:{vendorName:"AWS",ruleName:"AWSManagedRulesBotControlRuleSet"}};static setPathRateLimit(e,t){if(!e.Properties.Rules)e.Properties.Rules=[];let n=t.paths.map((r)=>({SearchString:r,FieldToMatch:{UriPath:{}},TextTransformation:[{Priority:0,Type:"LOWERCASE"}],PositionalConstraint:"STARTS_WITH"}));return e.Properties.Rules.push({Name:t.name,Priority:t.priority,Statement:{RateBasedStatement:{Limit:t.requestsPerWindow,AggregateKeyType:t.aggregateKeyType||"IP",ScopeDownStatement:{OrStatement:{Statements:n.map((r)=>({ByteMatchStatement:r}))}}}},Action:{Block:{}},VisibilityConfig:{SampledRequestsEnabled:!0,CloudWatchMetricsEnabled:!0,MetricName:`${t.name}-metric`}}),e}static setHeaderRateLimit(e,t){if(!e.Properties.Rules)e.Properties.Rules=[];let n={RateBasedStatement:{Limit:t.requestsPerWindow,AggregateKeyType:"CUSTOM_KEYS",CustomKeys:[{Header:{Name:t.headerName,TextTransformations:[{Priority:0,Type:"NONE"}]}}]}};if(t.headerValue)n.RateBasedStatement.ScopeDownStatement={ByteMatchStatement:{SearchString:t.headerValue,FieldToMatch:{SingleHeader:{Name:t.headerName}},TextTransformation:[{Priority:0,Type:"NONE"}],PositionalConstraint:"EXACTLY"}};return e.Properties.Rules.push({Name:t.name,Priority:t.priority,Statement:n,Action:{Block:{}},VisibilityConfig:{SampledRequestsEnabled:!0,CloudWatchMetricsEnabled:!0,MetricName:`${t.name}-metric`}}),e}static protectLoginEndpoint(e,t){let{loginPaths:n,priority:r,requestsPerMinute:i=10}=t;return H.setPathRateLimit(e,{name:"LoginRateLimit",priority:r,requestsPerWindow:i*5,paths:n}),e}static protectApiEndpoints(e,t){let{apiPaths:n,priority:r,requestsPerMinute:i=100}=t;return H.setPathRateLimit(e,{name:"ApiRateLimit",priority:r,requestsPerWindow:i*5,paths:n}),e}static createProtectedFirewall(e){let{slug:t,environment:n,scope:r="CLOUDFRONT",enableBotControl:i=!1,enableRateLimiting:s=!0,rateLimitPerMinute:a=2000}=e,{webAcl:o,logicalId:c}=H.createFirewall({slug:t,environment:n,scope:r,defaultAction:"allow"}),l=0;if(o=H.addManagedRules(o,{name:"AWSIPReputationList",priority:l++,...H.ManagedRuleGroups.AmazonIpReputation}),o=H.addManagedRules(o,{name:"AWSAnonymousIPList",priority:l++,...H.ManagedRuleGroups.AnonymousIpList}),o=H.addManagedRules(o,{name:"AWSCoreRuleSet",priority:l++,...H.ManagedRuleGroups.CoreRuleSet}),o=H.addManagedRules(o,{name:"AWSKnownBadInputs",priority:l++,...H.ManagedRuleGroups.KnownBadInputs}),o=H.addManagedRules(o,{name:"AWSSQLi",priority:l++,...H.ManagedRuleGroups.SqlDatabase}),i)o=H.addManagedRules(o,{name:"AWSBotControl",priority:l++,...H.ManagedRuleGroups.BotControl});if(s)o=H.setRateLimit(o,{name:"GlobalRateLimit",priority:l++,requestsPerWindow:a*5});return{webAcl:o,logicalId:c}}static RateLimitPresets={STANDARD:2000,HIGH_TRAFFIC:1e4,STRICT:100,LOGIN:10,API:100}}function fa(e){let t=e.split(".")[0]??"";return t==="a1"||/^[a-z]+\d+g[a-z]*$/.test(t)}function ha(e="t3.micro"){return`/aws/service/ami-amazon-linux-latest/al2023-ami-kernel-default-${fa(e)?"arm64":"x86_64"}`}function lr(e="t3.micro"){return`{{resolve:ssm:${ha(e)}}}`}class x{static createServer(e){let{slug:t,environment:n,instanceType:r="t3.micro",imageId:i=lr(r),keyName:s,securityGroupIds:a,subnetId:o,userData:c,volumeSize:l=20,volumeType:u="gp3",encrypted:m=!0}=e,p=S({slug:t,environment:n,resourceType:"ec2"}),g=f(p),y={Type:"AWS::EC2::Instance",Properties:{ImageId:i,InstanceType:r,Tags:[{Key:"Name",Value:p},{Key:"Environment",Value:n}]}};if(s)y.Properties.KeyName=s;if(a)y.Properties.SecurityGroupIds=a;if(o)y.Properties.SubnetId=o;if(c)y.Properties.UserData=v.Base64(c);return y.Properties.BlockDeviceMappings=[{DeviceName:"/dev/xvda",Ebs:{VolumeSize:l,VolumeType:u,Encrypted:m,DeleteOnTermination:!0}}],{instance:y,logicalId:g}}static createSecurityGroup(e){let{slug:t,environment:n,vpcId:r,description:i,ingress:s=[],egress:a=[]}=e,o=S({slug:t,environment:n,resourceType:"sg"}),c=f(o),l={Type:"AWS::EC2::SecurityGroup",Properties:{GroupDescription:i||`Security group for ${t} ${n}`,Tags:[{Key:"Name",Value:o},{Key:"Environment",Value:n}]}};if(r)l.Properties.VpcId=r;if(s.length>0)l.Properties.SecurityGroupIngress=s.map((u)=>({IpProtocol:u.protocol,FromPort:u.fromPort,ToPort:u.toPort,CidrIp:u.cidr,SourceSecurityGroupId:u.sourceSecurityGroupId}));if(a.length>0)l.Properties.SecurityGroupEgress=a.map((u)=>({IpProtocol:u.protocol,FromPort:u.fromPort,ToPort:u.toPort,CidrIp:u.cidr,DestinationSecurityGroupId:u.sourceSecurityGroupId}));return{securityGroup:l,logicalId:c}}static createWebServerSecurityGroup(e,t,n){return x.createSecurityGroup({slug:e,environment:t,vpcId:n,description:"Security group for web servers - HTTP, HTTPS, SSH",ingress:[{protocol:"tcp",fromPort:80,toPort:80,cidr:"0.0.0.0/0"},{protocol:"tcp",fromPort:443,toPort:443,cidr:"0.0.0.0/0"},{protocol:"tcp",fromPort:22,toPort:22,cidr:"0.0.0.0/0"}],egress:[{protocol:"-1",fromPort:0,toPort:0,cidr:"0.0.0.0/0"}]})}static createLoadBalancer(e){let{slug:t,environment:n,scheme:r="internet-facing",subnets:i,securityGroups:s,type:a="application"}=e,o=S({slug:t,environment:n,resourceType:"alb"}),c=f(o),l={Type:"AWS::ElasticLoadBalancingV2::LoadBalancer",Properties:{Name:o,Scheme:r,Type:a,Subnets:i,Tags:[{Key:"Name",Value:o},{Key:"Environment",Value:n}]}};if(s)l.Properties.SecurityGroups=s;return{loadBalancer:l,logicalId:c}}static createTargetGroup(e){let{slug:t,environment:n,port:r,protocol:i="HTTP",vpcId:s,targetType:a="ip",healthCheckPath:o="/",healthCheckInterval:c=30,healthCheckTimeout:l=5,healthyThreshold:u=2,unhealthyThreshold:m=3}=e,p=S({slug:t,environment:n,resourceType:"tg"}),g=f(p);return{targetGroup:{Type:"AWS::ElasticLoadBalancingV2::TargetGroup",Properties:{Name:p,Port:r,Protocol:i,VpcId:s,TargetType:a,HealthCheckEnabled:!0,HealthCheckProtocol:i,HealthCheckPath:o,HealthCheckIntervalSeconds:c,HealthCheckTimeoutSeconds:l,HealthyThresholdCount:u,UnhealthyThresholdCount:m,Tags:[{Key:"Name",Value:p},{Key:"Environment",Value:n}]}},logicalId:g}}static createListener(e,t){let{port:n,protocol:r="HTTP",certificateArn:i,defaultTargetGroupArn:s}=t,a=f(`listener-${e}-${n}`),o={Type:"AWS::ElasticLoadBalancingV2::Listener",Properties:{LoadBalancerArn:v.Ref(e),Port:n,Protocol:r,DefaultActions:[{Type:"forward",TargetGroupArn:s}]}};if(r==="HTTPS"&&i)o.Properties.Certificates=[{CertificateArn:i}],o.Properties.SslPolicy="ELBSecurityPolicy-TLS13-1-2-2021-06";return{listener:o,logicalId:a}}static createEcsCluster(e,t){let n=S({slug:e,environment:t,resourceType:"ecs-cluster"}),r=f(n);return{cluster:{Type:"AWS::ECS::Cluster",Properties:{ClusterName:n,Tags:[{Key:"Name",Value:n},{Key:"Environment",Value:t}]}},logicalId:r}}static createFargateService(e){let{slug:t,environment:n,image:r,cpu:i="256",memory:s="512",desiredCount:a=1,containerPort:o=8080,environmentVariables:c={},secrets:l=[],healthCheck:u,logGroup:m,subnets:p,securityGroups:g,targetGroupArn:y}=e,{cluster:h,logicalId:b}=x.createEcsCluster(t,n),C=S({slug:t,environment:n,resourceType:"fargate"}),T=f(`${C}-execution-role`),A={Type:"AWS::IAM::Role",Properties:{AssumeRolePolicyDocument:{Version:"2012-10-17",Statement:[{Effect:"Allow",Principal:{Service:"ecs-tasks.amazonaws.com"},Action:"sts:AssumeRole"}]},ManagedPolicyArns:["arn:aws:iam::aws:policy/service-role/AmazonECSTaskExecutionRolePolicy"]}},R=f(`${C}-task-role`),P={Type:"AWS::IAM::Role",Properties:{AssumeRolePolicyDocument:{Version:"2012-10-17",Statement:[{Effect:"Allow",Principal:{Service:"ecs-tasks.amazonaws.com"},Action:"sts:AssumeRole"}]}}},E=f(`${C}-task`),w={Type:"AWS::ECS::TaskDefinition",Properties:{Family:C,TaskRoleArn:v.GetAtt(R,"Arn"),ExecutionRoleArn:v.GetAtt(T,"Arn"),NetworkMode:"awsvpc",RequiresCompatibilities:["FARGATE"],Cpu:i,Memory:s,ContainerDefinitions:[{Name:t,Image:r,Essential:!0,PortMappings:[{ContainerPort:o,Protocol:"tcp"}],Environment:Object.entries(c).map(([k,O])=>({Name:k,Value:O})),Secrets:l.map((k)=>({Name:k.name,ValueFrom:k.valueFrom}))}],Tags:[{Key:"Name",Value:C},{Key:"Environment",Value:n}]}};if(u)w.Properties.ContainerDefinitions[0].HealthCheck={Command:u.command,Interval:u.interval||30,Timeout:u.timeout||5,Retries:u.retries||3,StartPeriod:60};if(m)w.Properties.ContainerDefinitions[0].LogConfiguration={LogDriver:"awslogs",Options:{"awslogs-group":m,"awslogs-region":v.Ref("AWS::Region"),"awslogs-stream-prefix":t}};let I=f(`${C}-service`),D={Type:"AWS::ECS::Service",Properties:{ServiceName:C,Cluster:v.Ref(b),TaskDefinition:v.Ref(E),DesiredCount:a,LaunchType:"FARGATE",NetworkConfiguration:{AwsvpcConfiguration:{Subnets:p,SecurityGroups:g,AssignPublicIp:"ENABLED"}},Tags:[{Key:"Name",Value:C},{Key:"Environment",Value:n}]}};if(y)D.Properties.LoadBalancers=[{TargetGroupArn:y,ContainerName:t,ContainerPort:o}];return{cluster:h,taskDefinition:w,service:D,taskRole:P,executionRole:A,clusterLogicalId:b,taskDefinitionLogicalId:E,serviceLogicalId:I,taskRoleLogicalId:R,executionRoleLogicalId:T}}static createLambdaFunction(e){let{slug:t,environment:n,runtime:r,handler:i,code:s,timeout:a=30,memorySize:o=128,environmentVariables:c={},vpcConfig:l}=e,u=S({slug:t,environment:n,resourceType:"lambda"}),m=f(u),p=f(`${u}-role`),g={Type:"AWS::IAM::Role",Properties:{AssumeRolePolicyDocument:{Version:"2012-10-17",Statement:[{Effect:"Allow",Principal:{Service:"lambda.amazonaws.com"},Action:"sts:AssumeRole"}]},ManagedPolicyArns:["arn:aws:iam::aws:policy/service-role/AWSLambdaBasicExecutionRole"]}};if(l)g.Properties.ManagedPolicyArns.push("arn:aws:iam::aws:policy/service-role/AWSLambdaVPCAccessExecutionRole");let y={Type:"AWS::Lambda::Function",Properties:{FunctionName:u,Runtime:r,Role:v.GetAtt(p,"Arn"),Handler:i,Code:{...s.s3Bucket&&{S3Bucket:s.s3Bucket},...s.s3Key&&{S3Key:s.s3Key},...s.zipFile&&{ZipFile:s.zipFile}},Timeout:a,MemorySize:o,Tags:[{Key:"Name",Value:u},{Key:"Environment",Value:n}]}};if(Object.keys(c).length>0)y.Properties.Environment={Variables:c};if(l)y.Properties.VpcConfig={SecurityGroupIds:l.securityGroupIds,SubnetIds:l.subnetIds};return{lambdaFunction:y,role:g,logicalId:m,roleLogicalId:p}}static generateNodeServerUserData(e={}){let{nodeVersion:t="20",appRepo:n,environment:r={}}=e,i=Object.entries(r).map(([s,a])=>`echo "export ${s}='${a}'" >> /etc/environment`).join(`
 `);return`#!/bin/bash
 # Update system
 yum update -y
@@ -589,7 +589,7 @@ sed -i 's/bind 127.0.0.1/bind 0.0.0.0/' /etc/redis/redis.conf
 systemctl enable redis-server
 systemctl restart redis-server
 echo "Redis server setup complete!"
-`,instanceType:"t3.medium",allowedPorts:[22,6379]})}}class B{static createVpc(e){let{slug:t,environment:n,cidr:r="10.0.0.0/16",enableDnsHostnames:i=!0,enableDnsSupport:s=!0}=e,a=S({slug:t,environment:n,resourceType:"vpc"}),o=f(a);return{vpc:{Type:"AWS::EC2::VPC",Properties:{CidrBlock:r,EnableDnsHostnames:i,EnableDnsSupport:s,Tags:[{Key:"Name",Value:a},{Key:"Environment",Value:n}]}},logicalId:o}}static createSubnet(e){let{slug:t,environment:n,vpcId:r,type:i,cidr:s,availabilityZone:a,mapPublicIp:o=i==="public"}=e,c=S({slug:t,environment:n,resourceType:`subnet-${i}`}),l=f(`${c}-${a}`);return{subnet:{Type:"AWS::EC2::Subnet",Properties:{VpcId:r,CidrBlock:s,AvailabilityZone:a,MapPublicIpOnLaunch:o,Tags:[{Key:"Name",Value:`${c}-${a}`},{Key:"Environment",Value:n},{Key:"Type",Value:i}]}},logicalId:l}}static createInternetGateway(e,t){let n=S({slug:e,environment:t,resourceType:"igw"}),r=f(n);return{internetGateway:{Type:"AWS::EC2::InternetGateway",Properties:{Tags:[{Key:"Name",Value:n},{Key:"Environment",Value:t}]}},logicalId:r}}static attachInternetGateway(e,t){let n=f(`${e}-igw-attachment`);return{attachment:{Type:"AWS::EC2::VPCGatewayAttachment",Properties:{VpcId:v.Ref(e),InternetGatewayId:v.Ref(t)}},logicalId:n}}static createEip(e,t){let n=S({slug:e,environment:t,resourceType:"eip"}),r=f(n);return{eip:{Type:"AWS::EC2::EIP",Properties:{Domain:"vpc",Tags:[{Key:"Name",Value:n},{Key:"Environment",Value:t}]}},logicalId:r}}static createNatGateway(e,t){let{slug:n,environment:r,subnetId:i}=e,s=S({slug:n,environment:r,resourceType:"nat"}),a=f(s);return{natGateway:{Type:"AWS::EC2::NatGateway",Properties:{AllocationId:v.GetAtt(t,"AllocationId"),SubnetId:i,Tags:[{Key:"Name",Value:s},{Key:"Environment",Value:r},{Key:"Warning",Value:"NAT Gateway incurs hourly charges"}]}},logicalId:a}}static createRouteTable(e,t,n,r){let i=S({slug:e,environment:t,resourceType:`rt-${r}`}),s=f(i);return{routeTable:{Type:"AWS::EC2::RouteTable",Properties:{VpcId:v.Ref(n),Tags:[{Key:"Name",Value:i},{Key:"Environment",Value:t},{Key:"Type",Value:r}]}},logicalId:s}}static createRoute(e,t,n){let r=f(`${e}-route-${n.type}`),i={Type:"AWS::EC2::Route",Properties:{RouteTableId:v.Ref(e),DestinationCidrBlock:t}};if(n.type==="igw")i.Properties.GatewayId=v.Ref(n.logicalId);else if(n.type==="nat")i.Properties.NatGatewayId=v.Ref(n.logicalId);else if(n.type==="instance")i.Properties.InstanceId=v.Ref(n.logicalId);return{route:i,logicalId:r}}static associateSubnetWithRouteTable(e,t){let n=f(`${e}-rt-assoc`);return{association:{Type:"AWS::EC2::SubnetRouteTableAssociation",Properties:{SubnetId:v.Ref(e),RouteTableId:v.Ref(t)}},logicalId:n}}static enableFlowLogs(e){let{slug:t,environment:n,resourceId:r,resourceType:i,trafficType:s="ALL",logGroupName:a}=e,o=S({slug:t,environment:n,resourceType:"flowlog"}),c=f(o);return{flowLog:{Type:"AWS::EC2::FlowLog",Properties:{ResourceType:i,ResourceIds:[r],TrafficType:s,LogDestinationType:"cloud-watch-logs",LogGroupName:a||`/aws/vpc/${t}-${n}`,Tags:[{Key:"Name",Value:o},{Key:"Environment",Value:n}]}},logicalId:c}}static calculateSubnetCidrs(e,t,n=3){let[r,i]=e.split("/"),s=Number.parseInt(i,10),a=Math.ceil(Math.log2(t*n)),o=s+a;if(o>28)throw Error("VPC CIDR is too small to accommodate requested subnets");let[c,l,u,m]=r.split(".").map(Number),p=(c<<24)+(l<<16)+(u<<8)+m,g=2**(32-o),y=[];for(let h=0;h<t*n;h++){let b=p+h*g,C=[b>>>24&255,b>>>16&255,b>>>8&255,b&255].join(".");y.push(`${C}/${o}`)}return y}static getAvailabilityZones(e,t){return["a","b","c","d","e","f"].slice(0,t).map((r)=>`${e}${r}`)}static createMultiAzNetwork(e){let{slug:t,environment:n,region:r,cidr:i="10.0.0.0/16",zones:s=3,enableNatGateway:a=!1,singleNatGateway:o=!1,enableFlowLogs:c=!1}=e,l={},u=[],m=[],p=[],{vpc:g,logicalId:y}=B.createVpc({slug:t,environment:n,cidr:i});l[y]=g;let{internetGateway:h,logicalId:b}=B.createInternetGateway(t,n);l[b]=h;let{attachment:C,logicalId:T}=B.attachInternetGateway(y,b);l[T]=C;let{routeTable:A,logicalId:R}=B.createRouteTable(t,n,y,"public");l[R]=A;let{route:P,logicalId:E}=B.createRoute(R,"0.0.0.0/0",{type:"igw",logicalId:b});P.DependsOn=T,l[E]=P;let w=B.calculateSubnetCidrs(i,s,2),I=B.getAvailabilityZones(r,s),D=[];for(let k=0;k<s;k++){let O=I[k],ne=w[k*2],_=w[k*2+1],{subnet:q,logicalId:F}=B.createSubnet({slug:t,environment:n,vpcId:v.Ref(y),type:"public",cidr:ne,availabilityZone:O});l[F]=q,u.push(F);let{association:K,logicalId:de}=B.associateSubnetWithRouteTable(F,R);l[de]=K;let{subnet:Oe,logicalId:me}=B.createSubnet({slug:t,environment:n,vpcId:v.Ref(y),type:"private",cidr:_,availabilityZone:O});if(l[me]=Oe,m.push(me),a&&(!o||k===0)){let{eip:ae,logicalId:pe}=B.createEip(`${t}-${O}`,n);l[pe]=ae;let{natGateway:we,logicalId:ge}=B.createNatGateway({slug:`${t}-${O}`,environment:n,subnetId:v.Ref(F)},pe);we.DependsOn=T,l[ge]=we,p.push(ge);let{routeTable:Ce,logicalId:$e}=B.createRouteTable(`${t}-${O}`,n,y,"private");l[$e]=Ce,D.push($e);let{route:Qe,logicalId:N}=B.createRoute($e,"0.0.0.0/0",{type:"nat",logicalId:ge});l[N]=Qe;let{association:M,logicalId:G}=B.associateSubnetWithRouteTable(me,$e);l[G]=M}else if(a&&o&&k>0){let{association:ae,logicalId:pe}=B.associateSubnetWithRouteTable(me,D[0]);l[pe]=ae}else{let{routeTable:ae,logicalId:pe}=B.createRouteTable(`${t}-${O}-isolated`,n,y,"private");l[pe]=ae;let{association:we,logicalId:ge}=B.associateSubnetWithRouteTable(me,pe);l[ge]=we}}if(c){let{flowLog:k,logicalId:O}=B.enableFlowLogs({slug:t,environment:n,resourceId:v.Ref(y),resourceType:"VPC"});l[O]=k}return{resources:l,outputs:{vpcId:y,publicSubnetIds:u,privateSubnetIds:m,natGatewayIds:p.length>0?p:void 0}}}static NatGatewayCostWarning=`
+`,instanceType:"t3.medium",allowedPorts:[22,6379]})}}class B{static createVpc(e){let{slug:t,environment:n,cidr:r="10.0.0.0/16",enableDnsHostnames:i=!0,enableDnsSupport:s=!0}=e,a=S({slug:t,environment:n,resourceType:"vpc"}),o=f(a);return{vpc:{Type:"AWS::EC2::VPC",Properties:{CidrBlock:r,EnableDnsHostnames:i,EnableDnsSupport:s,Tags:[{Key:"Name",Value:a},{Key:"Environment",Value:n}]}},logicalId:o}}static createSubnet(e){let{slug:t,environment:n,vpcId:r,type:i,cidr:s,availabilityZone:a,mapPublicIp:o=i==="public"}=e,c=S({slug:t,environment:n,resourceType:`subnet-${i}`}),l=f(`${c}-${a}`);return{subnet:{Type:"AWS::EC2::Subnet",Properties:{VpcId:r,CidrBlock:s,AvailabilityZone:a,MapPublicIpOnLaunch:o,Tags:[{Key:"Name",Value:`${c}-${a}`},{Key:"Environment",Value:n},{Key:"Type",Value:i}]}},logicalId:l}}static createInternetGateway(e,t){let n=S({slug:e,environment:t,resourceType:"igw"}),r=f(n);return{internetGateway:{Type:"AWS::EC2::InternetGateway",Properties:{Tags:[{Key:"Name",Value:n},{Key:"Environment",Value:t}]}},logicalId:r}}static attachInternetGateway(e,t){let n=f(`${e}-igw-attachment`);return{attachment:{Type:"AWS::EC2::VPCGatewayAttachment",Properties:{VpcId:v.Ref(e),InternetGatewayId:v.Ref(t)}},logicalId:n}}static createEip(e,t){let n=S({slug:e,environment:t,resourceType:"eip"}),r=f(n);return{eip:{Type:"AWS::EC2::EIP",Properties:{Domain:"vpc",Tags:[{Key:"Name",Value:n},{Key:"Environment",Value:t}]}},logicalId:r}}static createNatGateway(e,t){let{slug:n,environment:r,subnetId:i}=e,s=S({slug:n,environment:r,resourceType:"nat"}),a=f(s);return{natGateway:{Type:"AWS::EC2::NatGateway",Properties:{AllocationId:v.GetAtt(t,"AllocationId"),SubnetId:i,Tags:[{Key:"Name",Value:s},{Key:"Environment",Value:r},{Key:"Warning",Value:"NAT Gateway incurs hourly charges"}]}},logicalId:a}}static createRouteTable(e,t,n,r){let i=S({slug:e,environment:t,resourceType:`rt-${r}`}),s=f(i);return{routeTable:{Type:"AWS::EC2::RouteTable",Properties:{VpcId:v.Ref(n),Tags:[{Key:"Name",Value:i},{Key:"Environment",Value:t},{Key:"Type",Value:r}]}},logicalId:s}}static createRoute(e,t,n){let r=f(`${e}-route-${n.type}`),i={Type:"AWS::EC2::Route",Properties:{RouteTableId:v.Ref(e),DestinationCidrBlock:t}};if(n.type==="igw")i.Properties.GatewayId=v.Ref(n.logicalId);else if(n.type==="nat")i.Properties.NatGatewayId=v.Ref(n.logicalId);else if(n.type==="instance")i.Properties.InstanceId=v.Ref(n.logicalId);return{route:i,logicalId:r}}static associateSubnetWithRouteTable(e,t){let n=f(`${e}-rt-assoc`);return{association:{Type:"AWS::EC2::SubnetRouteTableAssociation",Properties:{SubnetId:v.Ref(e),RouteTableId:v.Ref(t)}},logicalId:n}}static enableFlowLogs(e){let{slug:t,environment:n,resourceId:r,resourceType:i,trafficType:s="ALL",logGroupName:a}=e,o=S({slug:t,environment:n,resourceType:"flowlog"}),c=f(o);return{flowLog:{Type:"AWS::EC2::FlowLog",Properties:{ResourceType:i,ResourceIds:[r],TrafficType:s,LogDestinationType:"cloud-watch-logs",LogGroupName:a||`/aws/vpc/${t}-${n}`,Tags:[{Key:"Name",Value:o},{Key:"Environment",Value:n}]}},logicalId:c}}static calculateSubnetCidrs(e,t,n=3){let[r,i]=e.split("/"),s=Number.parseInt(i,10),a=Math.ceil(Math.log2(t*n)),o=s+a;if(o>28)throw Error("VPC CIDR is too small to accommodate requested subnets");let[c,l,u,m]=r.split(".").map(Number),p=(c<<24)+(l<<16)+(u<<8)+m,g=2**(32-o),y=[];for(let h=0;h<t*n;h++){let b=p+h*g,C=[b>>>24&255,b>>>16&255,b>>>8&255,b&255].join(".");y.push(`${C}/${o}`)}return y}static getAvailabilityZones(e,t){return["a","b","c","d","e","f"].slice(0,t).map((r)=>`${e}${r}`)}static createMultiAzNetwork(e){let{slug:t,environment:n,region:r,cidr:i="10.0.0.0/16",zones:s=3,enableNatGateway:a=!1,singleNatGateway:o=!1,enableFlowLogs:c=!1}=e,l={},u=[],m=[],p=[],{vpc:g,logicalId:y}=B.createVpc({slug:t,environment:n,cidr:i});l[y]=g;let{internetGateway:h,logicalId:b}=B.createInternetGateway(t,n);l[b]=h;let{attachment:C,logicalId:T}=B.attachInternetGateway(y,b);l[T]=C;let{routeTable:A,logicalId:R}=B.createRouteTable(t,n,y,"public");l[R]=A;let{route:P,logicalId:E}=B.createRoute(R,"0.0.0.0/0",{type:"igw",logicalId:b});P.DependsOn=T,l[E]=P;let w=B.calculateSubnetCidrs(i,s,2),I=B.getAvailabilityZones(r,s),D=[];for(let k=0;k<s;k++){let O=I[k],ne=w[k*2],_=w[k*2+1],{subnet:q,logicalId:F}=B.createSubnet({slug:t,environment:n,vpcId:v.Ref(y),type:"public",cidr:ne,availabilityZone:O});l[F]=q,u.push(F);let{association:W,logicalId:de}=B.associateSubnetWithRouteTable(F,R);l[de]=W;let{subnet:Oe,logicalId:me}=B.createSubnet({slug:t,environment:n,vpcId:v.Ref(y),type:"private",cidr:_,availabilityZone:O});if(l[me]=Oe,m.push(me),a&&(!o||k===0)){let{eip:ae,logicalId:pe}=B.createEip(`${t}-${O}`,n);l[pe]=ae;let{natGateway:we,logicalId:ge}=B.createNatGateway({slug:`${t}-${O}`,environment:n,subnetId:v.Ref(F)},pe);we.DependsOn=T,l[ge]=we,p.push(ge);let{routeTable:Ce,logicalId:$e}=B.createRouteTable(`${t}-${O}`,n,y,"private");l[$e]=Ce,D.push($e);let{route:Qe,logicalId:N}=B.createRoute($e,"0.0.0.0/0",{type:"nat",logicalId:ge});l[N]=Qe;let{association:M,logicalId:G}=B.associateSubnetWithRouteTable(me,$e);l[G]=M}else if(a&&o&&k>0){let{association:ae,logicalId:pe}=B.associateSubnetWithRouteTable(me,D[0]);l[pe]=ae}else{let{routeTable:ae,logicalId:pe}=B.createRouteTable(`${t}-${O}-isolated`,n,y,"private");l[pe]=ae;let{association:we,logicalId:ge}=B.associateSubnetWithRouteTable(me,pe);l[ge]=we}}if(c){let{flowLog:k,logicalId:O}=B.enableFlowLogs({slug:t,environment:n,resourceId:v.Ref(y),resourceType:"VPC"});l[O]=k}return{resources:l,outputs:{vpcId:y,publicSubnetIds:u,privateSubnetIds:m,natGatewayIds:p.length>0?p:void 0}}}static NatGatewayCostWarning=`
 ⚠️ NAT Gateway Cost Warning:
 - Each NAT Gateway costs approximately $32-45/month (hourly charges)
 - Data processing charges: $0.045/GB processed
@@ -597,7 +597,7 @@ echo "Redis server setup complete!"
   - Using a single NAT Gateway (singleNatGateway: true)
   - Using NAT Instances instead (cheaper but requires management)
   - Disabling NAT entirely for isolated private subnets
-`}class et{static createFileSystem(e){let{slug:t,environment:n,encrypted:r=!0,kmsKeyId:i,performanceMode:s="generalPurpose",throughputMode:a="bursting",provisionedThroughput:o,enableBackup:c=!0}=e,l=S({slug:t,environment:n,resourceType:"efs"}),u=f(l),m={Type:"AWS::EFS::FileSystem",Properties:{Encrypted:r,PerformanceMode:s,ThroughputMode:a,FileSystemTags:[{Key:"Name",Value:l},{Key:"Environment",Value:n}]}};if(i)m.Properties.KmsKeyId=i;if(a==="provisioned"&&o)m.Properties.ProvisionedThroughputInMibps=o;if(c)m.Properties.BackupPolicy={Status:"ENABLED"};return{fileSystem:m,logicalId:u}}static createMountTarget(e,t){let{slug:n,environment:r,subnetId:i,securityGroups:s,ipAddress:a}=t,o=S({slug:n,environment:r,resourceType:"efs-mt"}),c=f(`${o}-${i}`),l={Type:"AWS::EFS::MountTarget",Properties:{FileSystemId:v.Ref(e),SubnetId:i,SecurityGroups:s}};if(a)l.Properties.IpAddress=a;return{mountTarget:l,logicalId:c}}static createAccessPoint(e,t){let{slug:n,environment:r,path:i="/",uid:s="1000",gid:a="1000",permissions:o="755"}=t,c=S({slug:n,environment:r,resourceType:"efs-ap"}),l=f(`${c}-${i.replace(/\//g,"-")}`);return{accessPoint:{Type:"AWS::EFS::AccessPoint",Properties:{FileSystemId:v.Ref(e),PosixUser:{Uid:s,Gid:a},RootDirectory:{Path:i,CreationInfo:{OwnerUid:s,OwnerGid:a,Permissions:o}},AccessPointTags:[{Key:"Name",Value:`${c}-${i}`},{Key:"Environment",Value:r}]}},logicalId:l}}static setLifecyclePolicy(e,t){let{transitionToIA:n,transitionToPrimary:r=!1}=t;if(!e.Properties)e.Properties={};if(e.Properties.LifecyclePolicies=[],n){let i=`AFTER_${n}_DAYS`;e.Properties.LifecyclePolicies.push({TransitionToIA:i})}if(r)e.Properties.LifecyclePolicies.push({TransitionToPrimaryStorageClass:"AFTER_1_ACCESS"});return e}static enableBackup(e){if(!e.Properties)e.Properties={};return e.Properties.BackupPolicy={Status:"ENABLED"},e}static disableBackup(e){if(!e.Properties)e.Properties={};return e.Properties.BackupPolicy={Status:"DISABLED"},e}static setProvisionedThroughput(e,t){if(!e.Properties)e.Properties={};return e.Properties.ThroughputMode="provisioned",e.Properties.ProvisionedThroughputInMibps=t,e}static setElasticThroughput(e){if(!e.Properties)e.Properties={};return e.Properties.ThroughputMode="elastic",e}static enableMaxIO(e){if(!e.Properties)e.Properties={};return e.Properties.PerformanceMode="maxIO",e}static createEfsSecurityGroup(e){let{slug:t,environment:n,vpcId:r,sourceSecurityGroupIds:i=[],sourceCidrBlocks:s=[],description:a}=e,o=S({slug:t,environment:n,resourceType:"efs-sg"}),c=f(o),l=[];for(let m of i)l.push({IpProtocol:"tcp",FromPort:2049,ToPort:2049,SourceSecurityGroupId:m,Description:"NFS from security group"});for(let m of s)l.push({IpProtocol:"tcp",FromPort:2049,ToPort:2049,CidrIp:m,Description:"NFS from CIDR block"});return{securityGroup:{Type:"AWS::EC2::SecurityGroup",Properties:{GroupName:o,GroupDescription:a||`Security group for EFS mount targets - ${t} ${n}`,VpcId:r,SecurityGroupIngress:l,Tags:[{Key:"Name",Value:o},{Key:"Environment",Value:n}]}},logicalId:c}}static createMultiAzMountTargets(e,t){let{slug:n,environment:r,subnetIds:i,securityGroupId:s}=t,a=[],o=[];for(let c=0;c<i.length;c++){let l=i[c],u=S({slug:n,environment:r,resourceType:"efs-mt"}),m=f(`${u}-az${c+1}`),p={Type:"AWS::EFS::MountTarget",Properties:{FileSystemId:v.Ref(e),SubnetId:l,SecurityGroups:[s]}};a.push(p),o.push(m)}return{mountTargets:a,logicalIds:o}}static createCompleteFileSystem(e){let{slug:t,environment:n,vpcId:r,subnetIds:i,sourceSecurityGroupIds:s=[],encrypted:a=!0,performanceMode:o="generalPurpose",throughputMode:c="elastic",enableBackup:l=!0,transitionToIA:u}=e,m={},{fileSystem:p,logicalId:g}=et.createFileSystem({slug:t,environment:n,encrypted:a,performanceMode:o,throughputMode:c,enableBackup:l});if(u)et.setLifecyclePolicy(p,{transitionToIA:u,transitionToPrimary:!0});m[g]=p;let{securityGroup:y,logicalId:h}=et.createEfsSecurityGroup({slug:t,environment:n,vpcId:r,sourceSecurityGroupIds:s});m[h]=y;let{mountTargets:b,logicalIds:C}=et.createMultiAzMountTargets(g,{slug:t,environment:n,subnetIds:i,securityGroupId:v.Ref(h)});for(let T=0;T<b.length;T++)m[C[T]]=b[T];return{resources:m,outputs:{fileSystemId:g,securityGroupId:h,mountTargetIds:C}}}}class W{static verifyDomain(e){let{domain:t,slug:n,environment:r,enableDkim:i=!0,dkimKeyLength:s="RSA_2048_BIT"}=e,a=S({slug:n,environment:r,resourceType:"ses-identity"}),o=f(`${a}-${t.replace(/\./g,"")}`),c={Type:"AWS::SES::EmailIdentity",Properties:{EmailIdentity:t,FeedbackAttributes:{EmailForwardingEnabled:!0}}};if(i)c.Properties.DkimSigningAttributes={NextSigningKeyLength:s};return{emailIdentity:c,logicalId:o}}static createDkimRecords(e,t,n){let r=[];for(let i=0;i<t.length;i++){let s=t[i],a=f(`dkim-${e.replace(/\./g,"")}-${i+1}`),o={Type:"AWS::Route53::RecordSet",Properties:{HostedZoneId:n,Name:`${s}._domainkey.${e}`,Type:"CNAME",TTL:1800,ResourceRecords:[`${s}.dkim.amazonses.com`]}};r.push({record:o,logicalId:a})}return r}static createConfigurationSet(e){let{slug:t,environment:n,name:r,reputationMetrics:i=!0,sendingEnabled:s=!0,suppressBounces:a=!0,suppressComplaints:o=!0}=e,c=r||S({slug:t,environment:n,resourceType:"ses-config"}),l=f(c),u=[];if(a)u.push("BOUNCE");if(o)u.push("COMPLAINT");return{configurationSet:{Type:"AWS::SES::ConfigurationSet",Properties:{Name:c,ReputationOptions:{ReputationMetricsEnabled:i},SendingOptions:{SendingEnabled:s},SuppressionOptions:{SuppressedReasons:u}}},logicalId:l}}static createReceiptRuleSet(e){let{slug:t,environment:n,name:r}=e,i=r||S({slug:t,environment:n,resourceType:"ses-ruleset"}),s=f(i);return{ruleSet:{Type:"AWS::SES::ReceiptRuleSet",Properties:{RuleSetName:i}},logicalId:s}}static createReceiptRule(e,t){let{slug:n,environment:r,ruleSetName:i,recipients:s,enabled:a=!0,scanEnabled:o=!0,tlsPolicy:c="Require",s3Action:l,lambdaAction:u,snsAction:m}=t,p=S({slug:n,environment:r,resourceType:"ses-rule"}),g=f(p),y=[];if(l)y.push({S3Action:{BucketName:l.bucketName,ObjectKeyPrefix:l.prefix,KmsKeyArn:l.kmsKeyArn}});if(u)y.push({LambdaAction:{FunctionArn:u.functionArn,InvocationType:u.invocationType||"Event"}});if(m)y.push({SNSAction:{TopicArn:m.topicArn,Encoding:m.encoding||"UTF-8"}});return{receiptRule:{Type:"AWS::SES::ReceiptRule",Properties:{RuleSetName:i,Rule:{Name:p,Enabled:a,ScanEnabled:o,TlsPolicy:c,Recipients:s,Actions:y.length>0?y:void 0}}},logicalId:g}}static createMxRecord(e,t,n){let r=f(`mx-${e.replace(/\./g,"")}`);return{record:{Type:"AWS::Route53::RecordSet",Properties:{HostedZoneId:t,Name:e,Type:"MX",TTL:300,ResourceRecords:[`10 inbound-smtp.${n}.amazonaws.com`]}},logicalId:r}}static createVerificationRecord(e,t,n){let r=f(`verification-${e.replace(/\./g,"")}`);return{record:{Type:"AWS::Route53::RecordSet",Properties:{HostedZoneId:n,Name:`_amazonses.${e}`,Type:"TXT",TTL:1800,ResourceRecords:[`"${t}"`]}},logicalId:r}}static getSmtpEndpoint(e){return`email-smtp.${e}.amazonaws.com`}static SmtpPorts={TLS:587,SSL:465,Unencrypted:25};static createSpfRecord(e,t,n){let{includeDomains:r=[],softFail:i=!1}=n||{},s=f(`spf-${e.replace(/\./g,"")}`),a="v=spf1 include:amazonses.com";for(let c of r)a+=` include:${c}`;return a+=i?" ~all":" -all",{record:{Type:"AWS::Route53::RecordSet",Properties:{HostedZoneId:t,Name:e,Type:"TXT",TTL:300,ResourceRecords:[`"${a}"`]}},logicalId:s}}static createDmarcRecord(e,t,n){let{policy:r="none",subdomainPolicy:i,percentage:s=100,reportingEmail:a,forensicEmail:o}=n||{},c=f(`dmarc-${e.replace(/\./g,"")}`),l=`v=DMARC1; p=${r}; pct=${s}`;if(i)l+=`; sp=${i}`;if(a)l+=`; rua=mailto:${a}`;if(o)l+=`; ruf=mailto:${o}`;return{record:{Type:"AWS::Route53::RecordSet",Properties:{HostedZoneId:t,Name:`_dmarc.${e}`,Type:"TXT",TTL:300,ResourceRecords:[`"${l}"`]}},logicalId:c}}static createInboundEmailSetup(e){let{slug:t,environment:n,domain:r,s3BucketName:i,s3KeyPrefix:s="inbound/",region:a,hostedZoneId:o,lambdaFunctionArn:c,snsTopicArn:l}=e,u={},{ruleSet:m,logicalId:p}=W.createReceiptRuleSet({slug:t,environment:n});u[p]=m;let{receiptRule:g,logicalId:y}=W.createReceiptRule(p,{slug:t,environment:n,ruleSetName:m.Properties.RuleSetName||`${t}-${n}-receipt-rule-set`,recipients:[r],s3Action:{bucketName:i,prefix:s},lambdaAction:c?{functionArn:c,invocationType:"Event"}:void 0,snsAction:l?{topicArn:l}:void 0});u[y]=g;let{record:h,logicalId:b}=W.createMxRecord(r,o,a);return u[b]=h,{resources:u,outputs:{ruleSetLogicalId:p,ruleLogicalId:y,mxRecordLogicalId:b}}}static createCompleteDomainSetup(e){let{slug:t,environment:n,domain:r,hostedZoneId:i,region:s,enableInbound:a=!1,inboundS3Bucket:o,dmarcReportingEmail:c}=e,l={},{emailIdentity:u,logicalId:m}=W.verifyDomain({domain:r,slug:t,environment:n});l[m]=u;let{configurationSet:p,logicalId:g}=W.createConfigurationSet({slug:t,environment:n});l[g]=p;let{record:y,logicalId:h}=W.createSpfRecord(r,i);l[h]=y;let{record:b,logicalId:C}=W.createDmarcRecord(r,i,{policy:"none",reportingEmail:c||`dmarc-reports@${r}`});if(l[C]=b,a&&o){let T=W.createInboundEmailSetup({slug:t,environment:n,domain:r,s3BucketName:o,region:s,hostedZoneId:i});Object.assign(l,T.resources)}return{resources:l,outputs:{identityLogicalId:m,configSetLogicalId:g}}}static InboundSmtpEndpoints={"us-east-1":"inbound-smtp.us-east-1.amazonaws.com","us-west-2":"inbound-smtp.us-west-2.amazonaws.com","eu-west-1":"inbound-smtp.eu-west-1.amazonaws.com"};static supportsInboundEmail(e){return e in W.InboundSmtpEndpoints}static createEmailLambdaRole(e){let{slug:t,environment:n,s3BucketArn:r,sesIdentityArn:i}=e,s=S({slug:t,environment:n,resourceType:"email-lambda-role"}),a=f(s),o=f(`${s}-policy`),c={Type:"AWS::IAM::Role",Properties:{RoleName:s,AssumeRolePolicyDocument:{Version:"2012-10-17",Statement:[{Effect:"Allow",Principal:{Service:"lambda.amazonaws.com"},Action:"sts:AssumeRole"}]},ManagedPolicyArns:["arn:aws:iam::aws:policy/service-role/AWSLambdaBasicExecutionRole"],Tags:[{Key:"Name",Value:s},{Key:"Environment",Value:n}]}},l=[{Effect:"Allow",Action:["s3:GetObject","s3:PutObject","s3:DeleteObject","s3:ListBucket"],Resource:[r,`${r}/*`]}];if(i)l.push({Effect:"Allow",Action:["ses:SendEmail","ses:SendRawEmail"],Resource:i});let u={Type:"AWS::IAM::Policy",Properties:{PolicyName:`${s}-policy`,PolicyDocument:{Version:"2012-10-17",Statement:l},Roles:[v.Ref(a)]}};return{role:c,policy:u,roleLogicalId:a,policyLogicalId:o}}static createOutboundEmailLambda(e){let{slug:t,environment:n,roleArn:r,domain:i,configurationSetName:s,timeout:a=30,memorySize:o=256}=e,c=S({slug:t,environment:n,resourceType:"outbound-email"}),l=f(c);return{function:{Type:"AWS::Lambda::Function",Properties:{FunctionName:c,Runtime:"nodejs20.x",Handler:"index.handler",Role:r,Timeout:a,MemorySize:o,Environment:{Variables:{DOMAIN:i,CONFIGURATION_SET:s||""}},Code:{ZipFile:W.LambdaCode.outboundEmail},Tags:[{Key:"Name",Value:c},{Key:"Environment",Value:n},{Key:"Purpose",Value:"OutboundEmail"}]}},logicalId:l}}static createInboundEmailLambda(e){let{slug:t,environment:n,roleArn:r,s3BucketName:i,organizedPrefix:s="organized/",timeout:a=60,memorySize:o=512}=e,c=S({slug:t,environment:n,resourceType:"inbound-email"}),l=f(c),u=f(`${c}-permission`),m={Type:"AWS::Lambda::Function",Properties:{FunctionName:c,Runtime:"nodejs20.x",Handler:"index.handler",Role:r,Timeout:a,MemorySize:o,Environment:{Variables:{S3_BUCKET:i,ORGANIZED_PREFIX:s}},Code:{ZipFile:W.LambdaCode.inboundEmail},Tags:[{Key:"Name",Value:c},{Key:"Environment",Value:n},{Key:"Purpose",Value:"InboundEmail"}]}},p={Type:"AWS::Lambda::Permission",Properties:{FunctionName:v.Ref(l),Action:"lambda:InvokeFunction",Principal:"ses.amazonaws.com",SourceAccount:v.Ref("AWS::AccountId")}};return{function:m,permission:p,logicalId:l,permissionLogicalId:u}}static createEmailConversionLambda(e){let{slug:t,environment:n,roleArn:r,s3BucketName:i,convertedPrefix:s="converted/",timeout:a=60,memorySize:o=512}=e,c=S({slug:t,environment:n,resourceType:"email-conversion"}),l=f(c);return{function:{Type:"AWS::Lambda::Function",Properties:{FunctionName:c,Runtime:"nodejs20.x",Handler:"index.handler",Role:r,Timeout:a,MemorySize:o,Environment:{Variables:{S3_BUCKET:i,CONVERTED_PREFIX:s}},Code:{ZipFile:W.LambdaCode.emailConversion},Tags:[{Key:"Name",Value:c},{Key:"Environment",Value:n},{Key:"Purpose",Value:"EmailConversion"}]}},logicalId:l}}static createEmailBucketNotification(e){let{lambdaArn:t,prefix:n="inbound/",suffix:r,events:i}=e,s=i??["s3:ObjectCreated:*"],a={};if(n||r){if(a.S3Key={Rules:[]},n)a.S3Key.Rules.push({Name:"prefix",Value:n});if(r)a.S3Key.Rules.push({Name:"suffix",Value:r})}return{notificationConfiguration:{LambdaConfigurations:[{Event:s[0],Function:t,Filter:Object.keys(a).length>0?a:void 0}]}}}static createS3LambdaPermission(e){let{slug:t,environment:n,lambdaLogicalId:r,s3BucketArn:i}=e,s=S({slug:t,environment:n,resourceType:"s3-lambda-permission"}),a=f(s);return{permission:{Type:"AWS::Lambda::Permission",Properties:{FunctionName:v.Ref(r),Action:"lambda:InvokeFunction",Principal:"s3.amazonaws.com",SourceArn:i}},logicalId:a}}static createEmailProcessingStack(e){let{slug:t,environment:n,domain:r,s3BucketName:i,s3BucketArn:s,configurationSetName:a,enableInbound:o=!0,enableConversion:c=!0}=e,l={},{role:u,policy:m,roleLogicalId:p,policyLogicalId:g}=W.createEmailLambdaRole({slug:t,environment:n,s3BucketArn:s,sesIdentityArn:`arn:aws:ses:*:*:identity/${r}`});l[p]=u,l[g]=m;let{function:y,logicalId:h}=W.createOutboundEmailLambda({slug:t,environment:n,roleArn:v.GetAtt(p,"Arn"),domain:r,configurationSetName:a});l[h]=y;let b={roleLogicalId:p,outboundLambdaLogicalId:h};if(o){let{function:C,permission:T,logicalId:A,permissionLogicalId:R}=W.createInboundEmailLambda({slug:t,environment:n,roleArn:v.GetAtt(p,"Arn"),s3BucketName:i});l[A]=C,l[R]=T;let{permission:P,logicalId:E}=W.createS3LambdaPermission({slug:t,environment:n,lambdaLogicalId:A,s3BucketArn:s});l[E]=P,b.inboundLambdaLogicalId=A}if(c){let{function:C,logicalId:T}=W.createEmailConversionLambda({slug:t,environment:n,roleArn:v.GetAtt(p,"Arn"),s3BucketName:i});l[T]=C,b.conversionLambdaLogicalId=T}return{resources:l,outputs:b}}static LambdaCode={outboundEmail:`
+`}class et{static createFileSystem(e){let{slug:t,environment:n,encrypted:r=!0,kmsKeyId:i,performanceMode:s="generalPurpose",throughputMode:a="bursting",provisionedThroughput:o,enableBackup:c=!0}=e,l=S({slug:t,environment:n,resourceType:"efs"}),u=f(l),m={Type:"AWS::EFS::FileSystem",Properties:{Encrypted:r,PerformanceMode:s,ThroughputMode:a,FileSystemTags:[{Key:"Name",Value:l},{Key:"Environment",Value:n}]}};if(i)m.Properties.KmsKeyId=i;if(a==="provisioned"&&o)m.Properties.ProvisionedThroughputInMibps=o;if(c)m.Properties.BackupPolicy={Status:"ENABLED"};return{fileSystem:m,logicalId:u}}static createMountTarget(e,t){let{slug:n,environment:r,subnetId:i,securityGroups:s,ipAddress:a}=t,o=S({slug:n,environment:r,resourceType:"efs-mt"}),c=f(`${o}-${i}`),l={Type:"AWS::EFS::MountTarget",Properties:{FileSystemId:v.Ref(e),SubnetId:i,SecurityGroups:s}};if(a)l.Properties.IpAddress=a;return{mountTarget:l,logicalId:c}}static createAccessPoint(e,t){let{slug:n,environment:r,path:i="/",uid:s="1000",gid:a="1000",permissions:o="755"}=t,c=S({slug:n,environment:r,resourceType:"efs-ap"}),l=f(`${c}-${i.replace(/\//g,"-")}`);return{accessPoint:{Type:"AWS::EFS::AccessPoint",Properties:{FileSystemId:v.Ref(e),PosixUser:{Uid:s,Gid:a},RootDirectory:{Path:i,CreationInfo:{OwnerUid:s,OwnerGid:a,Permissions:o}},AccessPointTags:[{Key:"Name",Value:`${c}-${i}`},{Key:"Environment",Value:r}]}},logicalId:l}}static setLifecyclePolicy(e,t){let{transitionToIA:n,transitionToPrimary:r=!1}=t;if(!e.Properties)e.Properties={};if(e.Properties.LifecyclePolicies=[],n){let i=`AFTER_${n}_DAYS`;e.Properties.LifecyclePolicies.push({TransitionToIA:i})}if(r)e.Properties.LifecyclePolicies.push({TransitionToPrimaryStorageClass:"AFTER_1_ACCESS"});return e}static enableBackup(e){if(!e.Properties)e.Properties={};return e.Properties.BackupPolicy={Status:"ENABLED"},e}static disableBackup(e){if(!e.Properties)e.Properties={};return e.Properties.BackupPolicy={Status:"DISABLED"},e}static setProvisionedThroughput(e,t){if(!e.Properties)e.Properties={};return e.Properties.ThroughputMode="provisioned",e.Properties.ProvisionedThroughputInMibps=t,e}static setElasticThroughput(e){if(!e.Properties)e.Properties={};return e.Properties.ThroughputMode="elastic",e}static enableMaxIO(e){if(!e.Properties)e.Properties={};return e.Properties.PerformanceMode="maxIO",e}static createEfsSecurityGroup(e){let{slug:t,environment:n,vpcId:r,sourceSecurityGroupIds:i=[],sourceCidrBlocks:s=[],description:a}=e,o=S({slug:t,environment:n,resourceType:"efs-sg"}),c=f(o),l=[];for(let m of i)l.push({IpProtocol:"tcp",FromPort:2049,ToPort:2049,SourceSecurityGroupId:m,Description:"NFS from security group"});for(let m of s)l.push({IpProtocol:"tcp",FromPort:2049,ToPort:2049,CidrIp:m,Description:"NFS from CIDR block"});return{securityGroup:{Type:"AWS::EC2::SecurityGroup",Properties:{GroupName:o,GroupDescription:a||`Security group for EFS mount targets - ${t} ${n}`,VpcId:r,SecurityGroupIngress:l,Tags:[{Key:"Name",Value:o},{Key:"Environment",Value:n}]}},logicalId:c}}static createMultiAzMountTargets(e,t){let{slug:n,environment:r,subnetIds:i,securityGroupId:s}=t,a=[],o=[];for(let c=0;c<i.length;c++){let l=i[c],u=S({slug:n,environment:r,resourceType:"efs-mt"}),m=f(`${u}-az${c+1}`),p={Type:"AWS::EFS::MountTarget",Properties:{FileSystemId:v.Ref(e),SubnetId:l,SecurityGroups:[s]}};a.push(p),o.push(m)}return{mountTargets:a,logicalIds:o}}static createCompleteFileSystem(e){let{slug:t,environment:n,vpcId:r,subnetIds:i,sourceSecurityGroupIds:s=[],encrypted:a=!0,performanceMode:o="generalPurpose",throughputMode:c="elastic",enableBackup:l=!0,transitionToIA:u}=e,m={},{fileSystem:p,logicalId:g}=et.createFileSystem({slug:t,environment:n,encrypted:a,performanceMode:o,throughputMode:c,enableBackup:l});if(u)et.setLifecyclePolicy(p,{transitionToIA:u,transitionToPrimary:!0});m[g]=p;let{securityGroup:y,logicalId:h}=et.createEfsSecurityGroup({slug:t,environment:n,vpcId:r,sourceSecurityGroupIds:s});m[h]=y;let{mountTargets:b,logicalIds:C}=et.createMultiAzMountTargets(g,{slug:t,environment:n,subnetIds:i,securityGroupId:v.Ref(h)});for(let T=0;T<b.length;T++)m[C[T]]=b[T];return{resources:m,outputs:{fileSystemId:g,securityGroupId:h,mountTargetIds:C}}}}class V{static verifyDomain(e){let{domain:t,slug:n,environment:r,enableDkim:i=!0,dkimKeyLength:s="RSA_2048_BIT"}=e,a=S({slug:n,environment:r,resourceType:"ses-identity"}),o=f(`${a}-${t.replace(/\./g,"")}`),c={Type:"AWS::SES::EmailIdentity",Properties:{EmailIdentity:t,FeedbackAttributes:{EmailForwardingEnabled:!0}}};if(i)c.Properties.DkimSigningAttributes={NextSigningKeyLength:s};return{emailIdentity:c,logicalId:o}}static createDkimRecords(e,t,n){let r=[];for(let i=0;i<t.length;i++){let s=t[i],a=f(`dkim-${e.replace(/\./g,"")}-${i+1}`),o={Type:"AWS::Route53::RecordSet",Properties:{HostedZoneId:n,Name:`${s}._domainkey.${e}`,Type:"CNAME",TTL:1800,ResourceRecords:[`${s}.dkim.amazonses.com`]}};r.push({record:o,logicalId:a})}return r}static createConfigurationSet(e){let{slug:t,environment:n,name:r,reputationMetrics:i=!0,sendingEnabled:s=!0,suppressBounces:a=!0,suppressComplaints:o=!0}=e,c=r||S({slug:t,environment:n,resourceType:"ses-config"}),l=f(c),u=[];if(a)u.push("BOUNCE");if(o)u.push("COMPLAINT");return{configurationSet:{Type:"AWS::SES::ConfigurationSet",Properties:{Name:c,ReputationOptions:{ReputationMetricsEnabled:i},SendingOptions:{SendingEnabled:s},SuppressionOptions:{SuppressedReasons:u}}},logicalId:l}}static createReceiptRuleSet(e){let{slug:t,environment:n,name:r}=e,i=r||S({slug:t,environment:n,resourceType:"ses-ruleset"}),s=f(i);return{ruleSet:{Type:"AWS::SES::ReceiptRuleSet",Properties:{RuleSetName:i}},logicalId:s}}static createReceiptRule(e,t){let{slug:n,environment:r,ruleSetName:i,recipients:s,enabled:a=!0,scanEnabled:o=!0,tlsPolicy:c="Require",s3Action:l,lambdaAction:u,snsAction:m}=t,p=S({slug:n,environment:r,resourceType:"ses-rule"}),g=f(p),y=[];if(l)y.push({S3Action:{BucketName:l.bucketName,ObjectKeyPrefix:l.prefix,KmsKeyArn:l.kmsKeyArn}});if(u)y.push({LambdaAction:{FunctionArn:u.functionArn,InvocationType:u.invocationType||"Event"}});if(m)y.push({SNSAction:{TopicArn:m.topicArn,Encoding:m.encoding||"UTF-8"}});return{receiptRule:{Type:"AWS::SES::ReceiptRule",Properties:{RuleSetName:i,Rule:{Name:p,Enabled:a,ScanEnabled:o,TlsPolicy:c,Recipients:s,Actions:y.length>0?y:void 0}}},logicalId:g}}static createMxRecord(e,t,n){let r=f(`mx-${e.replace(/\./g,"")}`);return{record:{Type:"AWS::Route53::RecordSet",Properties:{HostedZoneId:t,Name:e,Type:"MX",TTL:300,ResourceRecords:[`10 inbound-smtp.${n}.amazonaws.com`]}},logicalId:r}}static createVerificationRecord(e,t,n){let r=f(`verification-${e.replace(/\./g,"")}`);return{record:{Type:"AWS::Route53::RecordSet",Properties:{HostedZoneId:n,Name:`_amazonses.${e}`,Type:"TXT",TTL:1800,ResourceRecords:[`"${t}"`]}},logicalId:r}}static getSmtpEndpoint(e){return`email-smtp.${e}.amazonaws.com`}static SmtpPorts={TLS:587,SSL:465,Unencrypted:25};static createSpfRecord(e,t,n){let{includeDomains:r=[],softFail:i=!1}=n||{},s=f(`spf-${e.replace(/\./g,"")}`),a="v=spf1 include:amazonses.com";for(let c of r)a+=` include:${c}`;return a+=i?" ~all":" -all",{record:{Type:"AWS::Route53::RecordSet",Properties:{HostedZoneId:t,Name:e,Type:"TXT",TTL:300,ResourceRecords:[`"${a}"`]}},logicalId:s}}static createDmarcRecord(e,t,n){let{policy:r="none",subdomainPolicy:i,percentage:s=100,reportingEmail:a,forensicEmail:o}=n||{},c=f(`dmarc-${e.replace(/\./g,"")}`),l=`v=DMARC1; p=${r}; pct=${s}`;if(i)l+=`; sp=${i}`;if(a)l+=`; rua=mailto:${a}`;if(o)l+=`; ruf=mailto:${o}`;return{record:{Type:"AWS::Route53::RecordSet",Properties:{HostedZoneId:t,Name:`_dmarc.${e}`,Type:"TXT",TTL:300,ResourceRecords:[`"${l}"`]}},logicalId:c}}static createInboundEmailSetup(e){let{slug:t,environment:n,domain:r,s3BucketName:i,s3KeyPrefix:s="inbound/",region:a,hostedZoneId:o,lambdaFunctionArn:c,snsTopicArn:l}=e,u={},{ruleSet:m,logicalId:p}=V.createReceiptRuleSet({slug:t,environment:n});u[p]=m;let{receiptRule:g,logicalId:y}=V.createReceiptRule(p,{slug:t,environment:n,ruleSetName:m.Properties.RuleSetName||`${t}-${n}-receipt-rule-set`,recipients:[r],s3Action:{bucketName:i,prefix:s},lambdaAction:c?{functionArn:c,invocationType:"Event"}:void 0,snsAction:l?{topicArn:l}:void 0});u[y]=g;let{record:h,logicalId:b}=V.createMxRecord(r,o,a);return u[b]=h,{resources:u,outputs:{ruleSetLogicalId:p,ruleLogicalId:y,mxRecordLogicalId:b}}}static createCompleteDomainSetup(e){let{slug:t,environment:n,domain:r,hostedZoneId:i,region:s,enableInbound:a=!1,inboundS3Bucket:o,dmarcReportingEmail:c}=e,l={},{emailIdentity:u,logicalId:m}=V.verifyDomain({domain:r,slug:t,environment:n});l[m]=u;let{configurationSet:p,logicalId:g}=V.createConfigurationSet({slug:t,environment:n});l[g]=p;let{record:y,logicalId:h}=V.createSpfRecord(r,i);l[h]=y;let{record:b,logicalId:C}=V.createDmarcRecord(r,i,{policy:"none",reportingEmail:c||`dmarc-reports@${r}`});if(l[C]=b,a&&o){let T=V.createInboundEmailSetup({slug:t,environment:n,domain:r,s3BucketName:o,region:s,hostedZoneId:i});Object.assign(l,T.resources)}return{resources:l,outputs:{identityLogicalId:m,configSetLogicalId:g}}}static InboundSmtpEndpoints={"us-east-1":"inbound-smtp.us-east-1.amazonaws.com","us-west-2":"inbound-smtp.us-west-2.amazonaws.com","eu-west-1":"inbound-smtp.eu-west-1.amazonaws.com"};static supportsInboundEmail(e){return e in V.InboundSmtpEndpoints}static createEmailLambdaRole(e){let{slug:t,environment:n,s3BucketArn:r,sesIdentityArn:i}=e,s=S({slug:t,environment:n,resourceType:"email-lambda-role"}),a=f(s),o=f(`${s}-policy`),c={Type:"AWS::IAM::Role",Properties:{RoleName:s,AssumeRolePolicyDocument:{Version:"2012-10-17",Statement:[{Effect:"Allow",Principal:{Service:"lambda.amazonaws.com"},Action:"sts:AssumeRole"}]},ManagedPolicyArns:["arn:aws:iam::aws:policy/service-role/AWSLambdaBasicExecutionRole"],Tags:[{Key:"Name",Value:s},{Key:"Environment",Value:n}]}},l=[{Effect:"Allow",Action:["s3:GetObject","s3:PutObject","s3:DeleteObject","s3:ListBucket"],Resource:[r,`${r}/*`]}];if(i)l.push({Effect:"Allow",Action:["ses:SendEmail","ses:SendRawEmail"],Resource:i});let u={Type:"AWS::IAM::Policy",Properties:{PolicyName:`${s}-policy`,PolicyDocument:{Version:"2012-10-17",Statement:l},Roles:[v.Ref(a)]}};return{role:c,policy:u,roleLogicalId:a,policyLogicalId:o}}static createOutboundEmailLambda(e){let{slug:t,environment:n,roleArn:r,domain:i,configurationSetName:s,timeout:a=30,memorySize:o=256}=e,c=S({slug:t,environment:n,resourceType:"outbound-email"}),l=f(c);return{function:{Type:"AWS::Lambda::Function",Properties:{FunctionName:c,Runtime:"nodejs20.x",Handler:"index.handler",Role:r,Timeout:a,MemorySize:o,Environment:{Variables:{DOMAIN:i,CONFIGURATION_SET:s||""}},Code:{ZipFile:V.LambdaCode.outboundEmail},Tags:[{Key:"Name",Value:c},{Key:"Environment",Value:n},{Key:"Purpose",Value:"OutboundEmail"}]}},logicalId:l}}static createInboundEmailLambda(e){let{slug:t,environment:n,roleArn:r,s3BucketName:i,organizedPrefix:s="organized/",timeout:a=60,memorySize:o=512}=e,c=S({slug:t,environment:n,resourceType:"inbound-email"}),l=f(c),u=f(`${c}-permission`),m={Type:"AWS::Lambda::Function",Properties:{FunctionName:c,Runtime:"nodejs20.x",Handler:"index.handler",Role:r,Timeout:a,MemorySize:o,Environment:{Variables:{S3_BUCKET:i,ORGANIZED_PREFIX:s}},Code:{ZipFile:V.LambdaCode.inboundEmail},Tags:[{Key:"Name",Value:c},{Key:"Environment",Value:n},{Key:"Purpose",Value:"InboundEmail"}]}},p={Type:"AWS::Lambda::Permission",Properties:{FunctionName:v.Ref(l),Action:"lambda:InvokeFunction",Principal:"ses.amazonaws.com",SourceAccount:v.Ref("AWS::AccountId")}};return{function:m,permission:p,logicalId:l,permissionLogicalId:u}}static createEmailConversionLambda(e){let{slug:t,environment:n,roleArn:r,s3BucketName:i,convertedPrefix:s="converted/",timeout:a=60,memorySize:o=512}=e,c=S({slug:t,environment:n,resourceType:"email-conversion"}),l=f(c);return{function:{Type:"AWS::Lambda::Function",Properties:{FunctionName:c,Runtime:"nodejs20.x",Handler:"index.handler",Role:r,Timeout:a,MemorySize:o,Environment:{Variables:{S3_BUCKET:i,CONVERTED_PREFIX:s}},Code:{ZipFile:V.LambdaCode.emailConversion},Tags:[{Key:"Name",Value:c},{Key:"Environment",Value:n},{Key:"Purpose",Value:"EmailConversion"}]}},logicalId:l}}static createEmailBucketNotification(e){let{lambdaArn:t,prefix:n="inbound/",suffix:r,events:i}=e,s=i??["s3:ObjectCreated:*"],a={};if(n||r){if(a.S3Key={Rules:[]},n)a.S3Key.Rules.push({Name:"prefix",Value:n});if(r)a.S3Key.Rules.push({Name:"suffix",Value:r})}return{notificationConfiguration:{LambdaConfigurations:[{Event:s[0],Function:t,Filter:Object.keys(a).length>0?a:void 0}]}}}static createS3LambdaPermission(e){let{slug:t,environment:n,lambdaLogicalId:r,s3BucketArn:i}=e,s=S({slug:t,environment:n,resourceType:"s3-lambda-permission"}),a=f(s);return{permission:{Type:"AWS::Lambda::Permission",Properties:{FunctionName:v.Ref(r),Action:"lambda:InvokeFunction",Principal:"s3.amazonaws.com",SourceArn:i}},logicalId:a}}static createEmailProcessingStack(e){let{slug:t,environment:n,domain:r,s3BucketName:i,s3BucketArn:s,configurationSetName:a,enableInbound:o=!0,enableConversion:c=!0}=e,l={},{role:u,policy:m,roleLogicalId:p,policyLogicalId:g}=V.createEmailLambdaRole({slug:t,environment:n,s3BucketArn:s,sesIdentityArn:`arn:aws:ses:*:*:identity/${r}`});l[p]=u,l[g]=m;let{function:y,logicalId:h}=V.createOutboundEmailLambda({slug:t,environment:n,roleArn:v.GetAtt(p,"Arn"),domain:r,configurationSetName:a});l[h]=y;let b={roleLogicalId:p,outboundLambdaLogicalId:h};if(o){let{function:C,permission:T,logicalId:A,permissionLogicalId:R}=V.createInboundEmailLambda({slug:t,environment:n,roleArn:v.GetAtt(p,"Arn"),s3BucketName:i});l[A]=C,l[R]=T;let{permission:P,logicalId:E}=V.createS3LambdaPermission({slug:t,environment:n,lambdaLogicalId:A,s3BucketArn:s});l[E]=P,b.inboundLambdaLogicalId=A}if(c){let{function:C,logicalId:T}=V.createEmailConversionLambda({slug:t,environment:n,roleArn:v.GetAtt(p,"Arn"),s3BucketName:i});l[T]=C,b.conversionLambdaLogicalId=T}return{resources:l,outputs:b}}static LambdaCode={outboundEmail:`
 const { SESClient, SendRawEmailCommand } = require('@aws-sdk/client-ses');
 const ses = new SESClient({});
 
@@ -2290,7 +2290,7 @@ function resolveTemplate(template, data) {
 | fields @timestamp, @message
 | filter @message like /ERROR|WARN|Exception/
 | sort @timestamp desc
-| limit 50`,region:r,title:"Recent Errors and Warnings"}}),a+=6;return fr.createDashboard({slug:t,environment:n,widgets:s})}static DashboardTemplates={staticWebsite:(e)=>({slug:e.slug,environment:e.environment,widgets:[{type:"text",x:0,y:0,width:24,height:1,properties:{markdown:`# ${e.slug.toUpperCase()} Static Website Dashboard`}},{type:"metric",x:0,y:1,width:8,height:6,properties:{title:"CloudFront Requests",region:"us-east-1",metrics:[["AWS/CloudFront","Requests","DistributionId",e.cloudFrontDistributionId,"Region","Global"]],period:300,stat:"Sum"}},{type:"metric",x:8,y:1,width:8,height:6,properties:{title:"Error Rate",region:"us-east-1",metrics:[["AWS/CloudFront","4xxErrorRate","DistributionId",e.cloudFrontDistributionId,"Region","Global",{label:"4XX"}],["AWS/CloudFront","5xxErrorRate","DistributionId",e.cloudFrontDistributionId,"Region","Global",{label:"5XX"}]],period:300,stat:"Average"}},{type:"metric",x:16,y:1,width:8,height:6,properties:{title:"Bytes Downloaded",region:"us-east-1",metrics:[["AWS/CloudFront","BytesDownloaded","DistributionId",e.cloudFrontDistributionId,"Region","Global"]],period:300,stat:"Sum"}},{type:"metric",x:0,y:7,width:12,height:6,properties:{title:"S3 Bucket Size",region:e.region||"us-east-1",metrics:[["AWS/S3","BucketSizeBytes","BucketName",e.s3BucketName,"StorageType","StandardStorage"]],period:86400,stat:"Average"}},{type:"metric",x:12,y:7,width:12,height:6,properties:{title:"S3 Number of Objects",region:e.region||"us-east-1",metrics:[["AWS/S3","NumberOfObjects","BucketName",e.s3BucketName,"StorageType","AllStorageTypes"]],period:86400,stat:"Average"}}]}),serverlessApi:(e)=>({slug:e.slug,environment:e.environment,widgets:[{type:"text",x:0,y:0,width:24,height:1,properties:{markdown:`# ${e.slug.toUpperCase()} Serverless API Dashboard`}},{type:"metric",x:0,y:1,width:8,height:6,properties:{title:"API Requests",region:e.region||"us-east-1",metrics:[["AWS/ApiGateway","Count","ApiName",e.apiGatewayName]],period:60,stat:"Sum"}},{type:"metric",x:8,y:1,width:8,height:6,properties:{title:"API Latency",region:e.region||"us-east-1",metrics:[["AWS/ApiGateway","Latency","ApiName",e.apiGatewayName]],period:60,stat:"Average"}},{type:"metric",x:16,y:1,width:8,height:6,properties:{title:"API Errors",region:e.region||"us-east-1",metrics:[["AWS/ApiGateway","4XXError","ApiName",e.apiGatewayName,{label:"4XX"}],["AWS/ApiGateway","5XXError","ApiName",e.apiGatewayName,{label:"5XX"}]],period:60,stat:"Sum"}},...e.lambdaFunctionNames.map((t,n)=>({type:"metric",x:n%3*8,y:7+Math.floor(n/3)*6,width:8,height:6,properties:{title:`${t} Metrics`,region:e.region||"us-east-1",metrics:[["AWS/Lambda","Invocations","FunctionName",t],["AWS/Lambda","Duration","FunctionName",t],["AWS/Lambda","Errors","FunctionName",t]],period:300,stat:"Sum"}}))]}),containerService:(e)=>({slug:e.slug,environment:e.environment,widgets:[{type:"text",x:0,y:0,width:24,height:1,properties:{markdown:`# ${e.slug.toUpperCase()} Container Service Dashboard`}},{type:"metric",x:0,y:1,width:8,height:6,properties:{title:"ECS CPU",region:e.region||"us-east-1",metrics:[["AWS/ECS","CPUUtilization","ClusterName",e.ecsClusterName,"ServiceName",e.ecsServiceName]],period:60,stat:"Average"}},{type:"metric",x:8,y:1,width:8,height:6,properties:{title:"ECS Memory",region:e.region||"us-east-1",metrics:[["AWS/ECS","MemoryUtilization","ClusterName",e.ecsClusterName,"ServiceName",e.ecsServiceName]],period:60,stat:"Average"}},{type:"metric",x:16,y:1,width:8,height:6,properties:{title:"Running Tasks",region:e.region||"us-east-1",metrics:[["ECS/ContainerInsights","RunningTaskCount","ClusterName",e.ecsClusterName,"ServiceName",e.ecsServiceName]],period:60,stat:"Average"}},{type:"metric",x:0,y:7,width:8,height:6,properties:{title:"ALB Requests",region:e.region||"us-east-1",metrics:[["AWS/ApplicationELB","RequestCount","LoadBalancer",e.albName]],period:60,stat:"Sum"}},{type:"metric",x:8,y:7,width:8,height:6,properties:{title:"Response Time",region:e.region||"us-east-1",metrics:[["AWS/ApplicationELB","TargetResponseTime","LoadBalancer",e.albName]],period:60,stat:"Average"}},{type:"metric",x:16,y:7,width:8,height:6,properties:{title:"Healthy Hosts",region:e.region||"us-east-1",metrics:[["AWS/ApplicationELB","HealthyHostCount","LoadBalancer",e.albName]],period:60,stat:"Average"}},...e.rdsInstanceId?[{type:"metric",x:0,y:13,width:12,height:6,properties:{title:"RDS CPU",region:e.region||"us-east-1",metrics:[["AWS/RDS","CPUUtilization","DBInstanceIdentifier",e.rdsInstanceId]],period:300,stat:"Average"}},{type:"metric",x:12,y:13,width:12,height:6,properties:{title:"RDS Connections",region:e.region||"us-east-1",metrics:[["AWS/RDS","DatabaseConnections","DBInstanceIdentifier",e.rdsInstanceId]],period:60,stat:"Sum"}}]:[]]})};static Config={createAlarmConfig:(e)=>{let{metricName:t,namespace:n,threshold:r,comparisonOperator:i="GreaterThanThreshold",evaluationPeriods:s=1,period:a=300,statistic:o="Average",treatMissingData:c="missing"}=e;return{MetricName:t,Namespace:n,Threshold:r,ComparisonOperator:i,EvaluationPeriods:s,Period:a,Statistic:o,TreatMissingData:c}},namespaces:{ec2:"AWS/EC2",ecs:"AWS/ECS",lambda:"AWS/Lambda",rds:"AWS/RDS",sqs:"AWS/SQS",sns:"AWS/SNS",s3:"AWS/S3",cloudfront:"AWS/CloudFront",alb:"AWS/ApplicationELB",nlb:"AWS/NetworkELB",apiGateway:"AWS/ApiGateway",dynamodb:"AWS/DynamoDB",elasticache:"AWS/ElastiCache"},comparisonOperators:{greaterThan:"GreaterThanThreshold",greaterOrEqual:"GreaterThanOrEqualToThreshold",lessThan:"LessThanThreshold",lessOrEqual:"LessThanOrEqualToThreshold"},metrics:{ec2:{cpu:{metricName:"CPUUtilization",namespace:"AWS/EC2"},networkIn:{metricName:"NetworkIn",namespace:"AWS/EC2"},networkOut:{metricName:"NetworkOut",namespace:"AWS/EC2"},statusCheck:{metricName:"StatusCheckFailed",namespace:"AWS/EC2"}},ecs:{cpu:{metricName:"CPUUtilization",namespace:"AWS/ECS"},memory:{metricName:"MemoryUtilization",namespace:"AWS/ECS"}},lambda:{invocations:{metricName:"Invocations",namespace:"AWS/Lambda"},errors:{metricName:"Errors",namespace:"AWS/Lambda"},duration:{metricName:"Duration",namespace:"AWS/Lambda"},throttles:{metricName:"Throttles",namespace:"AWS/Lambda"},concurrentExecutions:{metricName:"ConcurrentExecutions",namespace:"AWS/Lambda"}},rds:{cpu:{metricName:"CPUUtilization",namespace:"AWS/RDS"},connections:{metricName:"DatabaseConnections",namespace:"AWS/RDS"},freeStorage:{metricName:"FreeStorageSpace",namespace:"AWS/RDS"},readLatency:{metricName:"ReadLatency",namespace:"AWS/RDS"},writeLatency:{metricName:"WriteLatency",namespace:"AWS/RDS"}},alb:{requestCount:{metricName:"RequestCount",namespace:"AWS/ApplicationELB"},responseTime:{metricName:"TargetResponseTime",namespace:"AWS/ApplicationELB"},httpCode4xx:{metricName:"HTTPCode_Target_4XX_Count",namespace:"AWS/ApplicationELB"},httpCode5xx:{metricName:"HTTPCode_Target_5XX_Count",namespace:"AWS/ApplicationELB"},healthyHosts:{metricName:"HealthyHostCount",namespace:"AWS/ApplicationELB"}},sqs:{messagesVisible:{metricName:"ApproximateNumberOfMessagesVisible",namespace:"AWS/SQS"},messagesDelayed:{metricName:"ApproximateNumberOfMessagesDelayed",namespace:"AWS/SQS"},messageAge:{metricName:"ApproximateAgeOfOldestMessage",namespace:"AWS/SQS"}}},presets:{highCpu:(e=80)=>({metricName:"CPUUtilization",threshold:e,comparisonOperator:"GreaterThanThreshold",evaluationPeriods:3,period:300,statistic:"Average"}),highMemory:(e=80)=>({metricName:"MemoryUtilization",threshold:e,comparisonOperator:"GreaterThanThreshold",evaluationPeriods:3,period:300,statistic:"Average"}),highErrors:(e=10)=>({metricName:"Errors",threshold:e,comparisonOperator:"GreaterThanThreshold",evaluationPeriods:1,period:60,statistic:"Sum"}),highLatency:(e=5000)=>({metricName:"Duration",threshold:e,comparisonOperator:"GreaterThanThreshold",evaluationPeriods:3,period:300,statistic:"Average"}),lowHealthyHosts:(e=1)=>({metricName:"HealthyHostCount",namespace:"AWS/ApplicationELB",threshold:e,comparisonOperator:"LessThanThreshold",evaluationPeriods:2,period:60,statistic:"Minimum"}),queueDepth:(e=1000)=>({metricName:"ApproximateNumberOfMessagesVisible",namespace:"AWS/SQS",threshold:e,comparisonOperator:"GreaterThanThreshold",evaluationPeriods:3,period:300,statistic:"Average"}),lowStorage:(e=10737418240)=>({metricName:"FreeStorageSpace",namespace:"AWS/RDS",threshold:e,comparisonOperator:"LessThanThreshold",evaluationPeriods:1,period:300,statistic:"Average"})}}}class Z{static createUserPool(e){let{slug:t,environment:n,userPoolName:r,aliasAttributes:i,autoVerifiedAttributes:s,passwordPolicy:a,mfaConfiguration:o,emailConfiguration:c,smsConfiguration:l,lambdaTriggers:u,userPoolAddOns:m,accountRecoverySetting:p}=e,g=r||S({slug:t,environment:n,resourceType:"user-pool"}),y=f(g),h={Type:"AWS::Cognito::UserPool",Properties:{UserPoolName:g,Policies:a?{PasswordPolicy:{MinimumLength:a.minimumLength,RequireLowercase:a.requireLowercase,RequireUppercase:a.requireUppercase,RequireNumbers:a.requireNumbers,RequireSymbols:a.requireSymbols,TemporaryPasswordValidityDays:a.temporaryPasswordValidityDays}}:void 0,MfaConfiguration:o,Schema:[{Name:"email",AttributeDataType:"String",Required:!0,Mutable:!1}]}};if(i&&i.length>0)h.Properties.UsernameAttributes=i;if(s&&s.length>0)h.Properties.AutoVerifiedAttributes=s;if(c)h.Properties.EmailConfiguration={EmailSendingAccount:c.emailSendingAccount,From:c.from,ReplyToEmailAddress:c.replyToEmailAddress,SourceArn:c.sourceArn,ConfigurationSet:c.configurationSet};if(l)h.Properties.SmsConfiguration={ExternalId:l.externalId,SnsCallerArn:l.snsCallerArn};if(u)h.Properties.LambdaConfig={PreSignUp:u.preSignUp,PostConfirmation:u.postConfirmation,PreAuthentication:u.preAuthentication,PostAuthentication:u.postAuthentication,CustomMessage:u.customMessage,DefineAuthChallenge:u.defineAuthChallenge,CreateAuthChallenge:u.createAuthChallenge,VerifyAuthChallengeResponse:u.verifyAuthChallengeResponse,PreTokenGeneration:u.preTokenGeneration,UserMigration:u.userMigration};if(m)h.Properties.UserPoolAddOns={AdvancedSecurityMode:m.advancedSecurityMode};if(p)h.Properties.AccountRecoverySetting={RecoveryMechanisms:p.recoveryMechanisms};return{userPool:h,logicalId:y}}static createUserPoolClient(e,t){let{slug:n,environment:r,clientName:i,generateSecret:s=!1,refreshTokenValidity:a,accessTokenValidity:o,idTokenValidity:c,tokenValidityUnits:l,readAttributes:u,writeAttributes:m,explicitAuthFlows:p,preventUserExistenceErrors:g,enableTokenRevocation:y,callbackURLs:h,logoutURLs:b,allowedOAuthFlows:C,allowedOAuthScopes:T,allowedOAuthFlowsUserPoolClient:A,supportedIdentityProviders:R}=t,P=i||S({slug:n,environment:r,resourceType:"user-pool-client"}),E=f(P);return{client:{Type:"AWS::Cognito::UserPoolClient",Properties:{ClientName:P,UserPoolId:v.Ref(e),GenerateSecret:s,RefreshTokenValidity:a,AccessTokenValidity:o,IdTokenValidity:c,TokenValidityUnits:l,ReadAttributes:u,WriteAttributes:m,ExplicitAuthFlows:p,PreventUserExistenceErrors:g,EnableTokenRevocation:y,CallbackURLs:h,LogoutURLs:b,AllowedOAuthFlows:C,AllowedOAuthScopes:T,AllowedOAuthFlowsUserPoolClient:A,SupportedIdentityProviders:R}},logicalId:E}}static createUserPoolDomain(e,t){let{slug:n,environment:r,domain:i,customDomainConfig:s}=t,a=S({slug:n,environment:r,resourceType:"user-pool-domain"}),o=f(a);return{domain:{Type:"AWS::Cognito::UserPoolDomain",Properties:{Domain:i,UserPoolId:v.Ref(e),CustomDomainConfig:s}},logicalId:o}}static createIdentityPool(e){let{slug:t,environment:n,identityPoolName:r,allowUnauthenticatedIdentities:i=!1,cognitoIdentityProviders:s,supportedLoginProviders:a,samlProviderARNs:o,openIdConnectProviderARNs:c}=e,l=r||S({slug:t,environment:n,resourceType:"identity-pool"}),u=f(l);return{identityPool:{Type:"AWS::Cognito::IdentityPool",Properties:{IdentityPoolName:l,AllowUnauthenticatedIdentities:i,CognitoIdentityProviders:s,SupportedLoginProviders:a,SamlProviderARNs:o,OpenIdConnectProviderARNs:c}},logicalId:u}}static createIdentityPoolRoleAttachment(e,t){let{slug:n,environment:r,authenticatedRole:i,unauthenticatedRole:s,roleMappings:a}=t,o=S({slug:n,environment:r,resourceType:"identity-pool-role-attachment"}),c=f(o),l={authenticated:i};if(s)l.unauthenticated=s;return{attachment:{Type:"AWS::Cognito::IdentityPoolRoleAttachment",Properties:{IdentityPoolId:v.Ref(e),Roles:l,RoleMappings:a}},logicalId:c}}static createAuthenticatedRole(e){let{slug:t,environment:n,identityPoolLogicalId:r}=e,i=S({slug:t,environment:n,resourceType:"cognito-authenticated-role"}),s=f(i);return{role:{Type:"AWS::IAM::Role",Properties:{RoleName:i,AssumeRolePolicyDocument:{Version:"2012-10-17",Statement:[{Effect:"Allow",Principal:{Federated:"cognito-identity.amazonaws.com"},Action:"sts:AssumeRoleWithWebIdentity",Condition:{StringEquals:{"cognito-identity.amazonaws.com:aud":v.Ref(r)},"ForAnyValue:StringLike":{"cognito-identity.amazonaws.com:amr":"authenticated"}}}]},Policies:[{PolicyName:"CognitoAuthenticatedPolicy",PolicyDocument:{Version:"2012-10-17",Statement:[{Effect:"Allow",Action:["cognito-sync:*","cognito-identity:*"],Resource:"*"}]}}],Tags:[{Key:"Name",Value:i},{Key:"Environment",Value:n}]}},logicalId:s}}static createUnauthenticatedRole(e){let{slug:t,environment:n,identityPoolLogicalId:r}=e,i=S({slug:t,environment:n,resourceType:"cognito-unauthenticated-role"}),s=f(i);return{role:{Type:"AWS::IAM::Role",Properties:{RoleName:i,AssumeRolePolicyDocument:{Version:"2012-10-17",Statement:[{Effect:"Allow",Principal:{Federated:"cognito-identity.amazonaws.com"},Action:"sts:AssumeRoleWithWebIdentity",Condition:{StringEquals:{"cognito-identity.amazonaws.com:aud":v.Ref(r)},"ForAnyValue:StringLike":{"cognito-identity.amazonaws.com:amr":"unauthenticated"}}}]},Policies:[{PolicyName:"CognitoUnauthenticatedPolicy",PolicyDocument:{Version:"2012-10-17",Statement:[{Effect:"Allow",Action:["cognito-sync:*"],Resource:"*"}]}}],Tags:[{Key:"Name",Value:i},{Key:"Environment",Value:n}]}},logicalId:s}}static PasswordPolicies={relaxed:()=>({minimumLength:8,requireLowercase:!1,requireUppercase:!1,requireNumbers:!1,requireSymbols:!1,temporaryPasswordValidityDays:7}),standard:()=>({minimumLength:8,requireLowercase:!0,requireUppercase:!0,requireNumbers:!0,requireSymbols:!1,temporaryPasswordValidityDays:3}),strict:()=>({minimumLength:12,requireLowercase:!0,requireUppercase:!0,requireNumbers:!0,requireSymbols:!0,temporaryPasswordValidityDays:1})};static AuthFlows={standard:["ALLOW_USER_SRP_AUTH","ALLOW_REFRESH_TOKEN_AUTH"],admin:["ALLOW_ADMIN_USER_PASSWORD_AUTH","ALLOW_REFRESH_TOKEN_AUTH"],custom:["ALLOW_CUSTOM_AUTH","ALLOW_REFRESH_TOKEN_AUTH"],all:["ALLOW_USER_SRP_AUTH","ALLOW_USER_PASSWORD_AUTH","ALLOW_ADMIN_USER_PASSWORD_AUTH","ALLOW_CUSTOM_AUTH","ALLOW_REFRESH_TOKEN_AUTH"]};static OAuthScopes={basic:["openid","email","profile"],all:["openid","email","profile","phone","aws.cognito.signin.user.admin"]};static UseCases={webApp:(e,t,n)=>{let{userPool:r,logicalId:i}=Z.createUserPool({slug:e,environment:t,aliasAttributes:["email"],autoVerifiedAttributes:["email"],passwordPolicy:Z.PasswordPolicies.standard(),mfaConfiguration:"OPTIONAL"}),{client:s,logicalId:a}=Z.createUserPoolClient(i,{slug:e,environment:t,explicitAuthFlows:[...Z.AuthFlows.standard],callbackURLs:[n],allowedOAuthFlows:["code"],allowedOAuthScopes:[...Z.OAuthScopes.basic],allowedOAuthFlowsUserPoolClient:!0});return{userPool:r,poolId:i,client:s,clientId:a}},mobileApp:(e,t)=>{let{userPool:n,logicalId:r}=Z.createUserPool({slug:e,environment:t,aliasAttributes:["email"],autoVerifiedAttributes:["email"],passwordPolicy:Z.PasswordPolicies.standard(),mfaConfiguration:"OPTIONAL"}),{client:i,logicalId:s}=Z.createUserPoolClient(r,{slug:e,environment:t,explicitAuthFlows:[...Z.AuthFlows.standard]}),{identityPool:a,logicalId:o}=Z.createIdentityPool({slug:e,environment:t,allowUnauthenticatedIdentities:!1,cognitoIdentityProviders:[{ClientId:v.Ref(s),ProviderName:v.GetAtt(r,"ProviderName")}]}),{role:c,logicalId:l}=Z.createAuthenticatedRole({slug:e,environment:t,identityPoolLogicalId:o}),{attachment:u,logicalId:m}=Z.createIdentityPoolRoleAttachment(o,{slug:e,environment:t,authenticatedRole:v.GetAtt(l,"Arn")});return{userPool:n,poolId:r,client:i,clientId:s,identityPool:a,identityPoolId:o,authRole:c,authRoleId:l,attachment:u,attachmentId:m}}}}import{createHash as Da}from"node:crypto";import{copyFileSync as Na,existsSync as Qt,readdirSync as xa,readFileSync as St,statSync as ka,writeFileSync as At}from"node:fs";import{basename as Ma,dirname as hr,extname as br,join as tt}from"node:path";class X{static createApplication(e){let{slug:t,environment:n,applicationName:r,computePlatform:i}=e,s=r||S({slug:t,environment:n,resourceType:"deploy-app"}),a=f(s);return{application:{Type:"AWS::CodeDeploy::Application",Properties:{ApplicationName:s,ComputePlatform:i,Tags:[{Key:"Name",Value:s},{Key:"Environment",Value:n}]}},logicalId:a}}static createDeploymentGroup(e,t){let{slug:n,environment:r,deploymentGroupName:i,serviceRoleArn:s,autoScalingGroups:a,ec2TagFilters:o,deploymentConfigName:c,autoRollbackConfiguration:l,alarmConfiguration:u,loadBalancerInfo:m,blueGreenDeploymentConfiguration:p}=t,g=i||S({slug:n,environment:r,resourceType:"deploy-group"}),y=f(g);return{deploymentGroup:{Type:"AWS::CodeDeploy::DeploymentGroup",Properties:{ApplicationName:v.Ref(e),DeploymentGroupName:g,ServiceRoleArn:s,AutoScalingGroups:a,Ec2TagFilters:o?.map((b)=>({Key:b.key,Value:b.value,Type:b.type})),DeploymentConfigName:c,AutoRollbackConfiguration:l?{Enabled:l.enabled,Events:l.events}:void 0,AlarmConfiguration:u?{Enabled:u.enabled,Alarms:u.alarms?.map((b)=>({Name:b.name})),IgnorePollAlarmFailure:u.ignorePollAlarmFailure}:void 0,LoadBalancerInfo:m?{TargetGroupInfoList:m.targetGroupInfoList?.map((b)=>({Name:b.name})),ElbInfoList:m.elbInfoList?.map((b)=>({Name:b.name}))}:void 0,BlueGreenDeploymentConfiguration:p?{TerminateBlueInstancesOnDeploymentSuccess:p.terminateBlueInstancesOnDeploymentSuccess?{Action:p.terminateBlueInstancesOnDeploymentSuccess.action,TerminationWaitTimeInMinutes:p.terminateBlueInstancesOnDeploymentSuccess.terminationWaitTimeInMinutes}:void 0,DeploymentReadyOption:p.deploymentReadyOption?{ActionOnTimeout:p.deploymentReadyOption.actionOnTimeout,WaitTimeInMinutes:p.deploymentReadyOption.waitTimeInMinutes}:void 0,GreenFleetProvisioningOption:p.greenFleetProvisioningOption?{Action:p.greenFleetProvisioningOption.action}:void 0}:void 0,Tags:[{Key:"Name",Value:g},{Key:"Environment",Value:r}]}},logicalId:y}}static createDeploymentConfig(e){let{slug:t,environment:n,deploymentConfigName:r,minimumHealthyHosts:i,trafficRoutingConfig:s}=e,a=r||S({slug:t,environment:n,resourceType:"deploy-config"}),o=f(a);return{deploymentConfig:{Type:"AWS::CodeDeploy::DeploymentConfig",Properties:{DeploymentConfigName:a,MinimumHealthyHosts:i?{Type:i.type,Value:i.value}:void 0,TrafficRoutingConfig:s?{Type:s.type,TimeBasedCanary:s.timeBasedCanary?{CanaryPercentage:s.timeBasedCanary.canaryPercentage,CanaryInterval:s.timeBasedCanary.canaryInterval}:void 0,TimeBasedLinear:s.timeBasedLinear?{LinearPercentage:s.timeBasedLinear.linearPercentage,LinearInterval:s.timeBasedLinear.linearInterval}:void 0}:void 0}},logicalId:o}}static DeploymentConfigs={allAtOnce:()=>({type:"FLEET_PERCENT",value:0}),halfAtATime:()=>({type:"FLEET_PERCENT",value:50}),oneAtATime:()=>({type:"HOST_COUNT",value:1}),custom:(e,t)=>({type:e,value:t})};static TrafficRouting={allAtOnce:()=>({type:"AllAtOnce"}),canary:(e,t)=>({type:"TimeBasedCanary",timeBasedCanary:{canaryPercentage:e,canaryInterval:t}}),linear:(e,t)=>({type:"TimeBasedLinear",timeBasedLinear:{linearPercentage:e,linearInterval:t}})};static RollbackConfigs={onFailure:()=>({enabled:!0,events:["DEPLOYMENT_FAILURE"]}),onAlarmOrFailure:()=>({enabled:!0,events:["DEPLOYMENT_FAILURE","DEPLOYMENT_STOP_ON_ALARM"]}),onAllEvents:()=>({enabled:!0,events:["DEPLOYMENT_FAILURE","DEPLOYMENT_STOP_ON_ALARM","DEPLOYMENT_STOP_ON_REQUEST"]}),disabled:()=>({enabled:!1})};static BlueGreenConfigs={standard:()=>({terminateBlueInstancesOnDeploymentSuccess:{action:"TERMINATE",terminationWaitTimeInMinutes:5},deploymentReadyOption:{actionOnTimeout:"CONTINUE_DEPLOYMENT",waitTimeInMinutes:0},greenFleetProvisioningOption:{action:"COPY_AUTO_SCALING_GROUP"}}),withDelay:(e)=>({terminateBlueInstancesOnDeploymentSuccess:{action:"TERMINATE",terminationWaitTimeInMinutes:e},deploymentReadyOption:{actionOnTimeout:"CONTINUE_DEPLOYMENT",waitTimeInMinutes:0},greenFleetProvisioningOption:{action:"COPY_AUTO_SCALING_GROUP"}}),withManualApproval:(e)=>({terminateBlueInstancesOnDeploymentSuccess:{action:"TERMINATE",terminationWaitTimeInMinutes:5},deploymentReadyOption:{actionOnTimeout:"STOP_DEPLOYMENT",waitTimeInMinutes:e},greenFleetProvisioningOption:{action:"COPY_AUTO_SCALING_GROUP"}}),keepBlue:()=>({terminateBlueInstancesOnDeploymentSuccess:{action:"KEEP_ALIVE"},deploymentReadyOption:{actionOnTimeout:"CONTINUE_DEPLOYMENT",waitTimeInMinutes:0},greenFleetProvisioningOption:{action:"COPY_AUTO_SCALING_GROUP"}})};static UseCases={ec2Deployment:(e,t,n,r)=>{let{application:i,logicalId:s}=X.createApplication({slug:e,environment:t,computePlatform:"Server"}),{deploymentGroup:a,logicalId:o}=X.createDeploymentGroup(s,{slug:e,environment:t,serviceRoleArn:n,autoScalingGroups:r,deploymentConfigName:"CodeDeployDefault.OneAtATime",autoRollbackConfiguration:X.RollbackConfigs.onFailure()});return{application:i,appId:s,deploymentGroup:a,groupId:o}},lambdaCanaryDeployment:(e,t,n,r=10,i=5)=>{let{application:s,logicalId:a}=X.createApplication({slug:e,environment:t,computePlatform:"Lambda"}),{deploymentConfig:o,logicalId:c}=X.createDeploymentConfig({slug:e,environment:t,trafficRoutingConfig:X.TrafficRouting.canary(r,i)}),{deploymentGroup:l,logicalId:u}=X.createDeploymentGroup(a,{slug:e,environment:t,serviceRoleArn:n,deploymentConfigName:v.Ref(c),autoRollbackConfiguration:X.RollbackConfigs.onAlarmOrFailure()});return{application:s,appId:a,deploymentConfig:o,configId:c,deploymentGroup:l,groupId:u}},ecsBlueGreenDeployment:(e,t,n,r)=>{let{application:i,logicalId:s}=X.createApplication({slug:e,environment:t,computePlatform:"ECS"}),{deploymentGroup:a,logicalId:o}=X.createDeploymentGroup(s,{slug:e,environment:t,serviceRoleArn:n,loadBalancerInfo:{targetGroupInfoList:[{name:r}]},blueGreenDeploymentConfiguration:X.BlueGreenConfigs.standard(),autoRollbackConfiguration:X.RollbackConfigs.onFailure()});return{application:i,appId:s,deploymentGroup:a,groupId:o}}};static Strategies={rolling:(e=25)=>({type:"rolling",batchPercentage:e}),blueGreen:()=>({type:"blue-green"}),canary:(e=10,t=5)=>({type:"canary",canaryPercentage:e,canaryInterval:t}),allAtOnce:()=>({type:"all-at-once"})}}class j{static ContentTypes={".html":"text/html",".htm":"text/html",".css":"text/css",".js":"application/javascript",".mjs":"application/javascript",".json":"application/json",".xml":"application/xml",".svg":"image/svg+xml",".png":"image/png",".jpg":"image/jpeg",".jpeg":"image/jpeg",".gif":"image/gif",".webp":"image/webp",".avif":"image/avif",".ico":"image/x-icon",".woff":"font/woff",".woff2":"font/woff2",".ttf":"font/ttf",".otf":"font/otf",".eot":"application/vnd.ms-fontobject",".pdf":"application/pdf",".txt":"text/plain",".md":"text/markdown",".map":"application/json"};static NoHashPatterns=[/^index\.html$/,/^favicon\.ico$/,/^robots\.txt$/,/^sitemap\.xml$/,/^manifest\.json$/,/^\.well-known\//,/^_redirects$/,/^_headers$/];static computeFileHash(e,t="md5"){let n=St(e);return Da(t).update(n).digest("hex")}static computeShortHash(e){return j.computeFileHash(e).slice(0,8)}static getContentType(e){let t=br(e).toLowerCase();return j.ContentTypes[t]||"application/octet-stream"}static shouldHashFile(e,t){return![...j.NoHashPatterns,...t||[]].some((r)=>r.test(e))}static generateHashedFilename(e,t){let n=br(e),r=Ma(e,n),i=hr(e);if(i===".")return`${r}.${t}${n}`;return tt(i,`${r}.${t}${n}`)}static collectFiles(e,t){let n=[],r=t||e;if(!Qt(e))return n;let i=xa(e,{withFileTypes:!0});for(let s of i){let a=tt(e,s.name);if(s.isDirectory())n.push(...j.collectFiles(a,r));else if(s.isFile())n.push(a)}return n}static hashDirectory(e){let{sourceDir:t,outputDir:n,excludePatterns:r=[],hashAlgorithm:i="md5",copyUnhashed:s=!0}=e,a=j.collectFiles(t),o=[],c={};for(let u of a){let m=u.replace(t,"").replace(/^[/\\]/,""),p=j.shouldHashFile(m,r),g=ka(u),y=p?j.computeFileHash(u,i).slice(0,8):"",h=p?j.generateHashedFilename(m,y):m,b={originalPath:m,hashedPath:h,hash:y,size:g.size,contentType:j.getContentType(u)};if(o.push(b),c[m]=h,n){let C=tt(n,h),T=hr(C);if(!Qt(T)){let{mkdirSync:A}=Fs("node:fs");A(T,{recursive:!0})}if(p||s)Na(u,C)}}let l={version:"1.0",timestamp:new Date().toISOString(),assets:o,hashMap:c};if(n){let u=tt(n,"asset-manifest.json");At(u,JSON.stringify(l,null,2))}return l}static getInvalidationPaths(e,t){let n=[];if(!e)return["/*"];let r=e.hashMap,i=t.hashMap;for(let[s,a]of Object.entries(i)){let o=r[s];if(!o||o!==a){if(n.push(`/${s}`),o&&o!==a)n.push(`/${o}`)}}for(let[s,a]of Object.entries(r))if(!i[s])n.push(`/${s}`),n.push(`/${a}`);if(n.length>100)return["/*"];return[...new Set(n)]}static updateHtmlReferences(e){let{htmlDir:t,manifest:n,basePath:r=""}=e,i=j.collectFiles(t).filter((s)=>s.endsWith(".html")||s.endsWith(".htm"));for(let s of i){let a=St(s,"utf-8");for(let[o,c]of Object.entries(n.hashMap)){if(o===c)continue;let l=[new RegExp(`(src|href)=["']${r}/?${j.escapeRegExp(o)}["']`,"g"),new RegExp(`url\\(["']?${r}/?${j.escapeRegExp(o)}["']?\\)`,"g")];for(let u of l)a=a.replace(u,(m)=>m.replace(o,c))}At(s,a)}}static updateCssReferences(e){let{cssDir:t,manifest:n,basePath:r=""}=e,i=j.collectFiles(t).filter((s)=>s.endsWith(".css"));for(let s of i){let a=St(s,"utf-8");for(let[o,c]of Object.entries(n.hashMap)){if(o===c)continue;let l=new RegExp(`url\\(["']?${r}/?${j.escapeRegExp(o)}["']?\\)`,"g");a=a.replace(l,`url(${r}/${c})`)}At(s,a)}}static escapeRegExp(e){return e.replace(/[.*+?^${}()|[\]\\]/g,"\\$&")}static generateS3DeploymentManifest(e){let{sourceDir:t,keyPrefix:n="",excludePatterns:r=[],cacheControl:i={hashed:"public, max-age=31536000, immutable",unhashed:"public, max-age=3600",html:"public, max-age=0, must-revalidate"}}=e;return j.hashDirectory({sourceDir:t,excludePatterns:r}).assets.map((a)=>{let o=a.hash!=="",c=a.contentType==="text/html",l=i.unhashed||"public, max-age=3600";if(c)l=i.html||"public, max-age=0, must-revalidate";else if(o)l=i.hashed||"public, max-age=31536000, immutable";return{localPath:tt(t,a.originalPath),s3Key:n?`${n}/${a.hashedPath}`:a.hashedPath,contentType:a.contentType,cacheControl:l,hash:a.hash}})}static compareManifests(e,t){let n={added:[],removed:[],changed:[],unchanged:[]},r=new Set(Object.keys(e.hashMap)),i=new Set(Object.keys(t.hashMap));for(let s of i)if(!r.has(s))n.added.push(s);for(let s of r)if(!i.has(s))n.removed.push(s);for(let s of i)if(r.has(s))if(e.hashMap[s]!==t.hashMap[s])n.changed.push(s);else n.unchanged.push(s);return n}static loadManifest(e){if(!Qt(e))return null;try{let t=St(e,"utf-8");return JSON.parse(t)}catch{return null}}static saveManifest(e,t){At(t,JSON.stringify(e,null,2))}}class nt{static createSecret(e){let{slug:t,environment:n,secretName:r,description:i,secretString:s,kmsKeyId:a,tags:o}=e,c=r||S({slug:t,environment:n,resourceType:"secret"}),l=f(c),u={Type:"AWS::SecretsManager::Secret",Properties:{Name:c,Description:i,SecretString:s,Tags:[{Key:"Name",Value:c},{Key:"Environment",Value:n},...o?Object.entries(o).map(([m,p])=>({Key:m,Value:p})):[]]}};if(a)u.Properties.KmsKeyId=a;return{secret:u,logicalId:l}}static createGeneratedSecret(e){let{slug:t,environment:n,secretName:r,description:i,excludeCharacters:s,excludeLowercase:a,excludeNumbers:o,excludePunctuation:c,excludeUppercase:l,passwordLength:u,requireEachIncludedType:m,kmsKeyId:p,tags:g}=e,y=r||S({slug:t,environment:n,resourceType:"secret"}),h=f(y),b={Type:"AWS::SecretsManager::Secret",Properties:{Name:y,Description:i,GenerateSecretString:{ExcludeCharacters:s,ExcludeLowercase:a,ExcludeNumbers:o,ExcludePunctuation:c,ExcludeUppercase:l,PasswordLength:u||32,RequireEachIncludedType:m!==!1},Tags:[{Key:"Name",Value:y},{Key:"Environment",Value:n},...g?Object.entries(g).map(([C,T])=>({Key:C,Value:T})):[]]}};if(p)b.Properties.KmsKeyId=p;return{secret:b,logicalId:h}}static createDatabaseSecret(e){let{slug:t,environment:n,secretName:r,username:i,dbname:s,engine:a,host:o,port:c,kmsKeyId:l}=e,u=r||S({slug:t,environment:n,resourceType:"db-secret"}),m=f(u),p={username:i};if(s)p.dbname=s;if(a)p.engine=a;if(o)p.host=o;if(c)p.port=c;let g={Type:"AWS::SecretsManager::Secret",Properties:{Name:u,Description:`Database credentials for ${i}`,GenerateSecretString:{SecretStringTemplate:JSON.stringify(p),GenerateStringKey:"password",PasswordLength:32,ExcludeCharacters:'"@/\\',RequireEachIncludedType:!0},Tags:[{Key:"Name",Value:u},{Key:"Environment",Value:n},{Key:"Type",Value:"database"}]}};if(l)g.Properties.KmsKeyId=l;return{secret:g,logicalId:m}}static attachToDatabase(e){let{slug:t,environment:n,secretId:r,targetId:i,targetType:s}=e,a=S({slug:t,environment:n,resourceType:"secret-attachment"}),o=f(a);return{attachment:{Type:"AWS::SecretsManager::SecretTargetAttachment",Properties:{SecretId:r,TargetId:i,TargetType:s}},logicalId:o}}static enableRotation(e){let{slug:t,environment:n,secretId:r,rotationLambdaArn:i,automaticallyAfterDays:s,rotationType:a,kmsKeyArn:o,vpcSecurityGroupIds:c,vpcSubnetIds:l}=e,u=S({slug:t,environment:n,resourceType:"secret-rotation"}),m=f(u),p={Type:"AWS::SecretsManager::RotationSchedule",Properties:{SecretId:r,RotationRules:{AutomaticallyAfterDays:s||30}}};if(i)p.Properties.RotationLambdaARN=i;else if(a)p.Properties.HostedRotationLambda={RotationType:a,KmsKeyArn:o,VpcSecurityGroupIds:c,VpcSubnetIds:l};return{rotation:p,logicalId:m}}static SecretTypes={apiKey:(e,t,n)=>nt.createGeneratedSecret({slug:e,environment:t,secretName:`${e}-${t}-${n}-api-key`,description:`API key for ${n}`,passwordLength:32,excludePunctuation:!0,excludeLowercase:!1,excludeUppercase:!1,excludeNumbers:!1}),oauthClientSecret:(e,t,n)=>nt.createGeneratedSecret({slug:e,environment:t,secretName:`${e}-${t}-${n}-oauth-secret`,description:`OAuth client secret for ${n}`,passwordLength:64,excludeCharacters:"\"'`\\/@",requireEachIncludedType:!0}),jwtSecret:(e,t)=>nt.createGeneratedSecret({slug:e,environment:t,secretName:`${e}-${t}-jwt-secret`,description:"JWT signing secret",passwordLength:64,excludePunctuation:!0}),encryptionKey:(e,t)=>nt.createGeneratedSecret({slug:e,environment:t,secretName:`${e}-${t}-encryption-key`,description:"Data encryption key",passwordLength:64,excludeCharacters:"+/=",excludePunctuation:!0})};static RotationTypes={MySQLSingleUser:"MySQLSingleUser",MySQLMultiUser:"MySQLMultiUser",PostgreSQLSingleUser:"PostgreSQLSingleUser",PostgreSQLMultiUser:"PostgreSQLMultiUser",OracleSingleUser:"OracleSingleUser",OracleMultiUser:"OracleMultiUser",MariaDBSingleUser:"MariaDBSingleUser",MariaDBMultiUser:"MariaDBMultiUser",SQLServerSingleUser:"SQLServerSingleUser",SQLServerMultiUser:"SQLServerMultiUser",RedshiftSingleUser:"RedshiftSingleUser",RedshiftMultiUser:"RedshiftMultiUser",MongoDBSingleUser:"MongoDBSingleUser",MongoDBMultiUser:"MongoDBMultiUser"}}class V{static createParameter(e){let{slug:t,environment:n,parameterName:r,value:i,type:s="String",description:a,tier:o="Standard",tags:c}=e,l=r||S({slug:t,environment:n,resourceType:"parameter"}),u=f(l);return{parameter:{Type:"AWS::SSM::Parameter",Properties:{Name:`/${t}/${n}/${l}`,Type:s,Value:i,Description:a,Tier:o,Tags:{Name:l,Environment:n,...c}}},logicalId:u}}static createString(e,t,n,r,i){return V.createParameter({slug:e,environment:t,parameterName:n,value:r,type:"String",description:i})}static createSecureString(e,t,n,r,i){return V.createParameter({slug:e,environment:t,parameterName:n,value:r,type:"SecureString",description:i})}static createStringList(e,t,n,r,i){return V.createParameter({slug:e,environment:t,parameterName:n,value:r.join(","),type:"StringList",description:i})}static Parameters={databaseUrl:(e,t,n)=>V.createSecureString(e,t,"database-url",n,"Database connection URL"),apiEndpoint:(e,t,n)=>V.createString(e,t,"api-endpoint",n,"API endpoint URL"),appVersion:(e,t,n)=>V.createString(e,t,"app-version",n,"Application version"),featureFlags:(e,t,n)=>V.createStringList(e,t,"feature-flags",n,"Enabled feature flags"),apiKey:(e,t,n,r)=>V.createSecureString(e,t,`${n}-api-key`,r,`API key for ${n}`),oauthCredentials:(e,t,n,r)=>{let i=V.createString(e,t,"oauth-client-id",n,"OAuth client ID"),s=V.createSecureString(e,t,"oauth-client-secret",r,"OAuth client secret");return{clientId:i,clientSecret:s}},smtpCredentials:(e,t,n,r,i,s)=>{let a=V.createString(e,t,"smtp-username",n,"SMTP username"),o=V.createSecureString(e,t,"smtp-password",r,"SMTP password"),c=V.createString(e,t,"smtp-host",i,"SMTP host"),l=V.createString(e,t,"smtp-port",s.toString(),"SMTP port");return{username:a,password:o,host:c,port:l}},redisUrl:(e,t,n)=>V.createSecureString(e,t,"redis-url",n,"Redis connection URL"),s3Bucket:(e,t,n)=>V.createString(e,t,"s3-bucket",n,"S3 bucket name"),cloudFrontDistribution:(e,t,n)=>V.createString(e,t,"cloudfront-distribution-id",n,"CloudFront distribution ID")}}class rt{static createDomain(e){let{slug:t,environment:n,domainName:r,engineVersion:i="OpenSearch_2.11",instanceType:s="t3.small.search",instanceCount:a=1,volumeSize:o=10,volumeType:c="gp3",dedicatedMaster:l=!1,dedicatedMasterType:u,dedicatedMasterCount:m=3,multiAz:p=!1,availabilityZoneCount:g=2,vpc:y,encryption:h,enforceHttps:b=!0,tlsSecurityPolicy:C="Policy-Min-TLS-1-2-2019-07",advancedSecurity:T,autoSnapshotHour:A=0,autoTune:R=!0,tags:P={}}=e,E=r||S({slug:t,environment:n,resourceType:"search"}),w=f(E);return{domain:{Type:"AWS::OpenSearchService::Domain",Properties:{DomainName:E,EngineVersion:i,ClusterConfig:{InstanceType:s,InstanceCount:a,DedicatedMasterEnabled:l,...l&&{DedicatedMasterType:u||s,DedicatedMasterCount:m},ZoneAwarenessEnabled:p,...p&&{ZoneAwarenessConfig:{AvailabilityZoneCount:g}}},EBSOptions:{EBSEnabled:!0,VolumeType:c,VolumeSize:o},DomainEndpointOptions:{EnforceHTTPS:b,TLSSecurityPolicy:C},SnapshotOptions:{AutomatedSnapshotStartHour:A},...y&&{VPCOptions:{SubnetIds:y.subnetIds,SecurityGroupIds:y.securityGroupIds}},...h&&{EncryptionAtRestOptions:{Enabled:h.atRest??!0,...h.kmsKeyId&&{KmsKeyId:h.kmsKeyId}},NodeToNodeEncryptionOptions:{Enabled:h.nodeToNode??!0}},...T&&{AdvancedSecurityOptions:{Enabled:T.enabled,InternalUserDatabaseEnabled:T.internalUserDatabase??!0,...T.masterUserName&&T.masterUserPassword&&{MasterUserOptions:{MasterUserName:T.masterUserName,MasterUserPassword:T.masterUserPassword}},...T.masterUserArn&&{MasterUserOptions:{MasterUserARN:T.masterUserArn}}}},...R&&{AutoTuneOptions:{DesiredState:"ENABLED"}},Tags:[{Key:"Name",Value:E},{Key:"Environment",Value:n},...Object.entries(P).map(([D,k])=>({Key:D,Value:k}))]}},logicalId:w}}static createAccessPolicy(e,t){let{ipAddresses:n,iamPrincipalArns:r,allowAll:i,vpcEndpoint:s}=t;if(i)return{Version:"2012-10-17",Statement:[{Effect:"Allow",Principal:{AWS:"*"},Action:"es:*",Resource:e}]};let a=[];if(r&&r.length>0)a.push({Effect:"Allow",Principal:{AWS:r},Action:"es:*",Resource:e});if(n&&n.length>0)a.push({Effect:"Allow",Principal:{AWS:"*"},Action:"es:*",Resource:e,Condition:{IpAddress:{"aws:SourceIp":n}}});if(s)return{Version:"2012-10-17",Statement:[{Effect:"Allow",Principal:{AWS:"*"},Action:"es:*",Resource:e}]};return{Version:"2012-10-17",Statement:a}}static DomainPresets={development:(e,t)=>rt.createDomain({slug:e,environment:t,instanceType:"t3.small.search",instanceCount:1,volumeSize:10,multiAz:!1,dedicatedMaster:!1,encryption:{atRest:!0,nodeToNode:!0},autoTune:!1}),production:(e,t,n)=>rt.createDomain({slug:e,environment:t,instanceType:"m6g.large.search",instanceCount:3,volumeSize:100,volumeType:"gp3",multiAz:!0,availabilityZoneCount:3,dedicatedMaster:!0,dedicatedMasterType:"m6g.large.search",dedicatedMasterCount:3,vpc:n,encryption:{atRest:!0,nodeToNode:!0},advancedSecurity:{enabled:!0,internalUserDatabase:!0},autoTune:!0}),costOptimized:(e,t)=>rt.createDomain({slug:e,environment:t,instanceType:"t3.medium.search",instanceCount:2,volumeSize:20,volumeType:"gp3",multiAz:!0,dedicatedMaster:!1,encryption:{atRest:!0,nodeToNode:!0},autoTune:!0}),highPerformance:(e,t,n)=>rt.createDomain({slug:e,environment:t,instanceType:"r6g.2xlarge.search",instanceCount:6,volumeSize:500,volumeType:"gp3",multiAz:!0,availabilityZoneCount:3,dedicatedMaster:!0,dedicatedMasterType:"c6g.xlarge.search",dedicatedMasterCount:3,vpc:n,encryption:{atRest:!0,nodeToNode:!0},advancedSecurity:{enabled:!0,internalUserDatabase:!1},autoTune:!0})};static InstanceTypes={"t3.small.search":"t3.small.search","t3.medium.search":"t3.medium.search","m6g.large.search":"m6g.large.search","m6g.xlarge.search":"m6g.xlarge.search","m6g.2xlarge.search":"m6g.2xlarge.search","r6g.large.search":"r6g.large.search","r6g.xlarge.search":"r6g.xlarge.search","r6g.2xlarge.search":"r6g.2xlarge.search","r6g.4xlarge.search":"r6g.4xlarge.search","c6g.large.search":"c6g.large.search","c6g.xlarge.search":"c6g.xlarge.search","c6g.2xlarge.search":"c6g.2xlarge.search"};static EngineVersions={"OpenSearch_2.11":"OpenSearch_2.11","OpenSearch_2.9":"OpenSearch_2.9","OpenSearch_2.7":"OpenSearch_2.7","OpenSearch_1.3":"OpenSearch_1.3","Elasticsearch_7.10":"Elasticsearch_7.10"}}class Ct{static createDomainRedirectBucket(e){let{slug:t,environment:n,sourceDomain:r,targetDomain:i,protocol:s="https"}=e,a=S({slug:t,environment:n,resourceType:"s3",suffix:"redirect"}),o=f(a),c=f(`${a}-policy`),l={Type:"AWS::S3::Bucket",Properties:{BucketName:r,WebsiteConfiguration:{RedirectAllRequestsTo:{HostName:i,Protocol:s}},PublicAccessBlockConfiguration:{BlockPublicAcls:!1,BlockPublicPolicy:!1,IgnorePublicAcls:!1,RestrictPublicBuckets:!1},Tags:[{Key:"Name",Value:a},{Key:"Environment",Value:n},{Key:"Purpose",Value:"Domain Redirect"}]}},u={Type:"AWS::S3::BucketPolicy",Properties:{Bucket:v.Ref(o),PolicyDocument:{Version:"2012-10-17",Statement:[{Sid:"PublicReadForRedirect",Effect:"Allow",Principal:"*",Action:["s3:GetObject"],Resource:[v.Join("",[v.GetAtt(o,"Arn"),"/*"])]}]}}};return{bucket:l,bucketPolicy:u,logicalId:o,policyLogicalId:c}}static createPathRedirectFunction(e){let{slug:t,environment:n,rules:r}=e,i=S({slug:t,environment:n,resourceType:"cf-redirect"}),s=f(i),a=Ct.generateRedirectFunctionCode(r);return{function:{Type:"AWS::CloudFront::Function",Properties:{Name:i,AutoPublish:!0,FunctionConfig:{Comment:`Path redirect function for ${t} (${n})`,Runtime:"cloudfront-js-2.0"},FunctionCode:a}},logicalId:s,functionCode:a}}static generateRedirectFunctionCode(e){return`function handler(event) {
+| limit 50`,region:r,title:"Recent Errors and Warnings"}}),a+=6;return fr.createDashboard({slug:t,environment:n,widgets:s})}static DashboardTemplates={staticWebsite:(e)=>({slug:e.slug,environment:e.environment,widgets:[{type:"text",x:0,y:0,width:24,height:1,properties:{markdown:`# ${e.slug.toUpperCase()} Static Website Dashboard`}},{type:"metric",x:0,y:1,width:8,height:6,properties:{title:"CloudFront Requests",region:"us-east-1",metrics:[["AWS/CloudFront","Requests","DistributionId",e.cloudFrontDistributionId,"Region","Global"]],period:300,stat:"Sum"}},{type:"metric",x:8,y:1,width:8,height:6,properties:{title:"Error Rate",region:"us-east-1",metrics:[["AWS/CloudFront","4xxErrorRate","DistributionId",e.cloudFrontDistributionId,"Region","Global",{label:"4XX"}],["AWS/CloudFront","5xxErrorRate","DistributionId",e.cloudFrontDistributionId,"Region","Global",{label:"5XX"}]],period:300,stat:"Average"}},{type:"metric",x:16,y:1,width:8,height:6,properties:{title:"Bytes Downloaded",region:"us-east-1",metrics:[["AWS/CloudFront","BytesDownloaded","DistributionId",e.cloudFrontDistributionId,"Region","Global"]],period:300,stat:"Sum"}},{type:"metric",x:0,y:7,width:12,height:6,properties:{title:"S3 Bucket Size",region:e.region||"us-east-1",metrics:[["AWS/S3","BucketSizeBytes","BucketName",e.s3BucketName,"StorageType","StandardStorage"]],period:86400,stat:"Average"}},{type:"metric",x:12,y:7,width:12,height:6,properties:{title:"S3 Number of Objects",region:e.region||"us-east-1",metrics:[["AWS/S3","NumberOfObjects","BucketName",e.s3BucketName,"StorageType","AllStorageTypes"]],period:86400,stat:"Average"}}]}),serverlessApi:(e)=>({slug:e.slug,environment:e.environment,widgets:[{type:"text",x:0,y:0,width:24,height:1,properties:{markdown:`# ${e.slug.toUpperCase()} Serverless API Dashboard`}},{type:"metric",x:0,y:1,width:8,height:6,properties:{title:"API Requests",region:e.region||"us-east-1",metrics:[["AWS/ApiGateway","Count","ApiName",e.apiGatewayName]],period:60,stat:"Sum"}},{type:"metric",x:8,y:1,width:8,height:6,properties:{title:"API Latency",region:e.region||"us-east-1",metrics:[["AWS/ApiGateway","Latency","ApiName",e.apiGatewayName]],period:60,stat:"Average"}},{type:"metric",x:16,y:1,width:8,height:6,properties:{title:"API Errors",region:e.region||"us-east-1",metrics:[["AWS/ApiGateway","4XXError","ApiName",e.apiGatewayName,{label:"4XX"}],["AWS/ApiGateway","5XXError","ApiName",e.apiGatewayName,{label:"5XX"}]],period:60,stat:"Sum"}},...e.lambdaFunctionNames.map((t,n)=>({type:"metric",x:n%3*8,y:7+Math.floor(n/3)*6,width:8,height:6,properties:{title:`${t} Metrics`,region:e.region||"us-east-1",metrics:[["AWS/Lambda","Invocations","FunctionName",t],["AWS/Lambda","Duration","FunctionName",t],["AWS/Lambda","Errors","FunctionName",t]],period:300,stat:"Sum"}}))]}),containerService:(e)=>({slug:e.slug,environment:e.environment,widgets:[{type:"text",x:0,y:0,width:24,height:1,properties:{markdown:`# ${e.slug.toUpperCase()} Container Service Dashboard`}},{type:"metric",x:0,y:1,width:8,height:6,properties:{title:"ECS CPU",region:e.region||"us-east-1",metrics:[["AWS/ECS","CPUUtilization","ClusterName",e.ecsClusterName,"ServiceName",e.ecsServiceName]],period:60,stat:"Average"}},{type:"metric",x:8,y:1,width:8,height:6,properties:{title:"ECS Memory",region:e.region||"us-east-1",metrics:[["AWS/ECS","MemoryUtilization","ClusterName",e.ecsClusterName,"ServiceName",e.ecsServiceName]],period:60,stat:"Average"}},{type:"metric",x:16,y:1,width:8,height:6,properties:{title:"Running Tasks",region:e.region||"us-east-1",metrics:[["ECS/ContainerInsights","RunningTaskCount","ClusterName",e.ecsClusterName,"ServiceName",e.ecsServiceName]],period:60,stat:"Average"}},{type:"metric",x:0,y:7,width:8,height:6,properties:{title:"ALB Requests",region:e.region||"us-east-1",metrics:[["AWS/ApplicationELB","RequestCount","LoadBalancer",e.albName]],period:60,stat:"Sum"}},{type:"metric",x:8,y:7,width:8,height:6,properties:{title:"Response Time",region:e.region||"us-east-1",metrics:[["AWS/ApplicationELB","TargetResponseTime","LoadBalancer",e.albName]],period:60,stat:"Average"}},{type:"metric",x:16,y:7,width:8,height:6,properties:{title:"Healthy Hosts",region:e.region||"us-east-1",metrics:[["AWS/ApplicationELB","HealthyHostCount","LoadBalancer",e.albName]],period:60,stat:"Average"}},...e.rdsInstanceId?[{type:"metric",x:0,y:13,width:12,height:6,properties:{title:"RDS CPU",region:e.region||"us-east-1",metrics:[["AWS/RDS","CPUUtilization","DBInstanceIdentifier",e.rdsInstanceId]],period:300,stat:"Average"}},{type:"metric",x:12,y:13,width:12,height:6,properties:{title:"RDS Connections",region:e.region||"us-east-1",metrics:[["AWS/RDS","DatabaseConnections","DBInstanceIdentifier",e.rdsInstanceId]],period:60,stat:"Sum"}}]:[]]})};static Config={createAlarmConfig:(e)=>{let{metricName:t,namespace:n,threshold:r,comparisonOperator:i="GreaterThanThreshold",evaluationPeriods:s=1,period:a=300,statistic:o="Average",treatMissingData:c="missing"}=e;return{MetricName:t,Namespace:n,Threshold:r,ComparisonOperator:i,EvaluationPeriods:s,Period:a,Statistic:o,TreatMissingData:c}},namespaces:{ec2:"AWS/EC2",ecs:"AWS/ECS",lambda:"AWS/Lambda",rds:"AWS/RDS",sqs:"AWS/SQS",sns:"AWS/SNS",s3:"AWS/S3",cloudfront:"AWS/CloudFront",alb:"AWS/ApplicationELB",nlb:"AWS/NetworkELB",apiGateway:"AWS/ApiGateway",dynamodb:"AWS/DynamoDB",elasticache:"AWS/ElastiCache"},comparisonOperators:{greaterThan:"GreaterThanThreshold",greaterOrEqual:"GreaterThanOrEqualToThreshold",lessThan:"LessThanThreshold",lessOrEqual:"LessThanOrEqualToThreshold"},metrics:{ec2:{cpu:{metricName:"CPUUtilization",namespace:"AWS/EC2"},networkIn:{metricName:"NetworkIn",namespace:"AWS/EC2"},networkOut:{metricName:"NetworkOut",namespace:"AWS/EC2"},statusCheck:{metricName:"StatusCheckFailed",namespace:"AWS/EC2"}},ecs:{cpu:{metricName:"CPUUtilization",namespace:"AWS/ECS"},memory:{metricName:"MemoryUtilization",namespace:"AWS/ECS"}},lambda:{invocations:{metricName:"Invocations",namespace:"AWS/Lambda"},errors:{metricName:"Errors",namespace:"AWS/Lambda"},duration:{metricName:"Duration",namespace:"AWS/Lambda"},throttles:{metricName:"Throttles",namespace:"AWS/Lambda"},concurrentExecutions:{metricName:"ConcurrentExecutions",namespace:"AWS/Lambda"}},rds:{cpu:{metricName:"CPUUtilization",namespace:"AWS/RDS"},connections:{metricName:"DatabaseConnections",namespace:"AWS/RDS"},freeStorage:{metricName:"FreeStorageSpace",namespace:"AWS/RDS"},readLatency:{metricName:"ReadLatency",namespace:"AWS/RDS"},writeLatency:{metricName:"WriteLatency",namespace:"AWS/RDS"}},alb:{requestCount:{metricName:"RequestCount",namespace:"AWS/ApplicationELB"},responseTime:{metricName:"TargetResponseTime",namespace:"AWS/ApplicationELB"},httpCode4xx:{metricName:"HTTPCode_Target_4XX_Count",namespace:"AWS/ApplicationELB"},httpCode5xx:{metricName:"HTTPCode_Target_5XX_Count",namespace:"AWS/ApplicationELB"},healthyHosts:{metricName:"HealthyHostCount",namespace:"AWS/ApplicationELB"}},sqs:{messagesVisible:{metricName:"ApproximateNumberOfMessagesVisible",namespace:"AWS/SQS"},messagesDelayed:{metricName:"ApproximateNumberOfMessagesDelayed",namespace:"AWS/SQS"},messageAge:{metricName:"ApproximateAgeOfOldestMessage",namespace:"AWS/SQS"}}},presets:{highCpu:(e=80)=>({metricName:"CPUUtilization",threshold:e,comparisonOperator:"GreaterThanThreshold",evaluationPeriods:3,period:300,statistic:"Average"}),highMemory:(e=80)=>({metricName:"MemoryUtilization",threshold:e,comparisonOperator:"GreaterThanThreshold",evaluationPeriods:3,period:300,statistic:"Average"}),highErrors:(e=10)=>({metricName:"Errors",threshold:e,comparisonOperator:"GreaterThanThreshold",evaluationPeriods:1,period:60,statistic:"Sum"}),highLatency:(e=5000)=>({metricName:"Duration",threshold:e,comparisonOperator:"GreaterThanThreshold",evaluationPeriods:3,period:300,statistic:"Average"}),lowHealthyHosts:(e=1)=>({metricName:"HealthyHostCount",namespace:"AWS/ApplicationELB",threshold:e,comparisonOperator:"LessThanThreshold",evaluationPeriods:2,period:60,statistic:"Minimum"}),queueDepth:(e=1000)=>({metricName:"ApproximateNumberOfMessagesVisible",namespace:"AWS/SQS",threshold:e,comparisonOperator:"GreaterThanThreshold",evaluationPeriods:3,period:300,statistic:"Average"}),lowStorage:(e=10737418240)=>({metricName:"FreeStorageSpace",namespace:"AWS/RDS",threshold:e,comparisonOperator:"LessThanThreshold",evaluationPeriods:1,period:300,statistic:"Average"})}}}class Z{static createUserPool(e){let{slug:t,environment:n,userPoolName:r,aliasAttributes:i,autoVerifiedAttributes:s,passwordPolicy:a,mfaConfiguration:o,emailConfiguration:c,smsConfiguration:l,lambdaTriggers:u,userPoolAddOns:m,accountRecoverySetting:p}=e,g=r||S({slug:t,environment:n,resourceType:"user-pool"}),y=f(g),h={Type:"AWS::Cognito::UserPool",Properties:{UserPoolName:g,Policies:a?{PasswordPolicy:{MinimumLength:a.minimumLength,RequireLowercase:a.requireLowercase,RequireUppercase:a.requireUppercase,RequireNumbers:a.requireNumbers,RequireSymbols:a.requireSymbols,TemporaryPasswordValidityDays:a.temporaryPasswordValidityDays}}:void 0,MfaConfiguration:o,Schema:[{Name:"email",AttributeDataType:"String",Required:!0,Mutable:!1}]}};if(i&&i.length>0)h.Properties.UsernameAttributes=i;if(s&&s.length>0)h.Properties.AutoVerifiedAttributes=s;if(c)h.Properties.EmailConfiguration={EmailSendingAccount:c.emailSendingAccount,From:c.from,ReplyToEmailAddress:c.replyToEmailAddress,SourceArn:c.sourceArn,ConfigurationSet:c.configurationSet};if(l)h.Properties.SmsConfiguration={ExternalId:l.externalId,SnsCallerArn:l.snsCallerArn};if(u)h.Properties.LambdaConfig={PreSignUp:u.preSignUp,PostConfirmation:u.postConfirmation,PreAuthentication:u.preAuthentication,PostAuthentication:u.postAuthentication,CustomMessage:u.customMessage,DefineAuthChallenge:u.defineAuthChallenge,CreateAuthChallenge:u.createAuthChallenge,VerifyAuthChallengeResponse:u.verifyAuthChallengeResponse,PreTokenGeneration:u.preTokenGeneration,UserMigration:u.userMigration};if(m)h.Properties.UserPoolAddOns={AdvancedSecurityMode:m.advancedSecurityMode};if(p)h.Properties.AccountRecoverySetting={RecoveryMechanisms:p.recoveryMechanisms};return{userPool:h,logicalId:y}}static createUserPoolClient(e,t){let{slug:n,environment:r,clientName:i,generateSecret:s=!1,refreshTokenValidity:a,accessTokenValidity:o,idTokenValidity:c,tokenValidityUnits:l,readAttributes:u,writeAttributes:m,explicitAuthFlows:p,preventUserExistenceErrors:g,enableTokenRevocation:y,callbackURLs:h,logoutURLs:b,allowedOAuthFlows:C,allowedOAuthScopes:T,allowedOAuthFlowsUserPoolClient:A,supportedIdentityProviders:R}=t,P=i||S({slug:n,environment:r,resourceType:"user-pool-client"}),E=f(P);return{client:{Type:"AWS::Cognito::UserPoolClient",Properties:{ClientName:P,UserPoolId:v.Ref(e),GenerateSecret:s,RefreshTokenValidity:a,AccessTokenValidity:o,IdTokenValidity:c,TokenValidityUnits:l,ReadAttributes:u,WriteAttributes:m,ExplicitAuthFlows:p,PreventUserExistenceErrors:g,EnableTokenRevocation:y,CallbackURLs:h,LogoutURLs:b,AllowedOAuthFlows:C,AllowedOAuthScopes:T,AllowedOAuthFlowsUserPoolClient:A,SupportedIdentityProviders:R}},logicalId:E}}static createUserPoolDomain(e,t){let{slug:n,environment:r,domain:i,customDomainConfig:s}=t,a=S({slug:n,environment:r,resourceType:"user-pool-domain"}),o=f(a);return{domain:{Type:"AWS::Cognito::UserPoolDomain",Properties:{Domain:i,UserPoolId:v.Ref(e),CustomDomainConfig:s}},logicalId:o}}static createIdentityPool(e){let{slug:t,environment:n,identityPoolName:r,allowUnauthenticatedIdentities:i=!1,cognitoIdentityProviders:s,supportedLoginProviders:a,samlProviderARNs:o,openIdConnectProviderARNs:c}=e,l=r||S({slug:t,environment:n,resourceType:"identity-pool"}),u=f(l);return{identityPool:{Type:"AWS::Cognito::IdentityPool",Properties:{IdentityPoolName:l,AllowUnauthenticatedIdentities:i,CognitoIdentityProviders:s,SupportedLoginProviders:a,SamlProviderARNs:o,OpenIdConnectProviderARNs:c}},logicalId:u}}static createIdentityPoolRoleAttachment(e,t){let{slug:n,environment:r,authenticatedRole:i,unauthenticatedRole:s,roleMappings:a}=t,o=S({slug:n,environment:r,resourceType:"identity-pool-role-attachment"}),c=f(o),l={authenticated:i};if(s)l.unauthenticated=s;return{attachment:{Type:"AWS::Cognito::IdentityPoolRoleAttachment",Properties:{IdentityPoolId:v.Ref(e),Roles:l,RoleMappings:a}},logicalId:c}}static createAuthenticatedRole(e){let{slug:t,environment:n,identityPoolLogicalId:r}=e,i=S({slug:t,environment:n,resourceType:"cognito-authenticated-role"}),s=f(i);return{role:{Type:"AWS::IAM::Role",Properties:{RoleName:i,AssumeRolePolicyDocument:{Version:"2012-10-17",Statement:[{Effect:"Allow",Principal:{Federated:"cognito-identity.amazonaws.com"},Action:"sts:AssumeRoleWithWebIdentity",Condition:{StringEquals:{"cognito-identity.amazonaws.com:aud":v.Ref(r)},"ForAnyValue:StringLike":{"cognito-identity.amazonaws.com:amr":"authenticated"}}}]},Policies:[{PolicyName:"CognitoAuthenticatedPolicy",PolicyDocument:{Version:"2012-10-17",Statement:[{Effect:"Allow",Action:["cognito-sync:*","cognito-identity:*"],Resource:"*"}]}}],Tags:[{Key:"Name",Value:i},{Key:"Environment",Value:n}]}},logicalId:s}}static createUnauthenticatedRole(e){let{slug:t,environment:n,identityPoolLogicalId:r}=e,i=S({slug:t,environment:n,resourceType:"cognito-unauthenticated-role"}),s=f(i);return{role:{Type:"AWS::IAM::Role",Properties:{RoleName:i,AssumeRolePolicyDocument:{Version:"2012-10-17",Statement:[{Effect:"Allow",Principal:{Federated:"cognito-identity.amazonaws.com"},Action:"sts:AssumeRoleWithWebIdentity",Condition:{StringEquals:{"cognito-identity.amazonaws.com:aud":v.Ref(r)},"ForAnyValue:StringLike":{"cognito-identity.amazonaws.com:amr":"unauthenticated"}}}]},Policies:[{PolicyName:"CognitoUnauthenticatedPolicy",PolicyDocument:{Version:"2012-10-17",Statement:[{Effect:"Allow",Action:["cognito-sync:*"],Resource:"*"}]}}],Tags:[{Key:"Name",Value:i},{Key:"Environment",Value:n}]}},logicalId:s}}static PasswordPolicies={relaxed:()=>({minimumLength:8,requireLowercase:!1,requireUppercase:!1,requireNumbers:!1,requireSymbols:!1,temporaryPasswordValidityDays:7}),standard:()=>({minimumLength:8,requireLowercase:!0,requireUppercase:!0,requireNumbers:!0,requireSymbols:!1,temporaryPasswordValidityDays:3}),strict:()=>({minimumLength:12,requireLowercase:!0,requireUppercase:!0,requireNumbers:!0,requireSymbols:!0,temporaryPasswordValidityDays:1})};static AuthFlows={standard:["ALLOW_USER_SRP_AUTH","ALLOW_REFRESH_TOKEN_AUTH"],admin:["ALLOW_ADMIN_USER_PASSWORD_AUTH","ALLOW_REFRESH_TOKEN_AUTH"],custom:["ALLOW_CUSTOM_AUTH","ALLOW_REFRESH_TOKEN_AUTH"],all:["ALLOW_USER_SRP_AUTH","ALLOW_USER_PASSWORD_AUTH","ALLOW_ADMIN_USER_PASSWORD_AUTH","ALLOW_CUSTOM_AUTH","ALLOW_REFRESH_TOKEN_AUTH"]};static OAuthScopes={basic:["openid","email","profile"],all:["openid","email","profile","phone","aws.cognito.signin.user.admin"]};static UseCases={webApp:(e,t,n)=>{let{userPool:r,logicalId:i}=Z.createUserPool({slug:e,environment:t,aliasAttributes:["email"],autoVerifiedAttributes:["email"],passwordPolicy:Z.PasswordPolicies.standard(),mfaConfiguration:"OPTIONAL"}),{client:s,logicalId:a}=Z.createUserPoolClient(i,{slug:e,environment:t,explicitAuthFlows:[...Z.AuthFlows.standard],callbackURLs:[n],allowedOAuthFlows:["code"],allowedOAuthScopes:[...Z.OAuthScopes.basic],allowedOAuthFlowsUserPoolClient:!0});return{userPool:r,poolId:i,client:s,clientId:a}},mobileApp:(e,t)=>{let{userPool:n,logicalId:r}=Z.createUserPool({slug:e,environment:t,aliasAttributes:["email"],autoVerifiedAttributes:["email"],passwordPolicy:Z.PasswordPolicies.standard(),mfaConfiguration:"OPTIONAL"}),{client:i,logicalId:s}=Z.createUserPoolClient(r,{slug:e,environment:t,explicitAuthFlows:[...Z.AuthFlows.standard]}),{identityPool:a,logicalId:o}=Z.createIdentityPool({slug:e,environment:t,allowUnauthenticatedIdentities:!1,cognitoIdentityProviders:[{ClientId:v.Ref(s),ProviderName:v.GetAtt(r,"ProviderName")}]}),{role:c,logicalId:l}=Z.createAuthenticatedRole({slug:e,environment:t,identityPoolLogicalId:o}),{attachment:u,logicalId:m}=Z.createIdentityPoolRoleAttachment(o,{slug:e,environment:t,authenticatedRole:v.GetAtt(l,"Arn")});return{userPool:n,poolId:r,client:i,clientId:s,identityPool:a,identityPoolId:o,authRole:c,authRoleId:l,attachment:u,attachmentId:m}}}}import{createHash as Da}from"node:crypto";import{copyFileSync as Na,existsSync as Qt,readdirSync as xa,readFileSync as St,statSync as ka,writeFileSync as At}from"node:fs";import{basename as Ma,dirname as hr,extname as br,join as tt}from"node:path";class X{static createApplication(e){let{slug:t,environment:n,applicationName:r,computePlatform:i}=e,s=r||S({slug:t,environment:n,resourceType:"deploy-app"}),a=f(s);return{application:{Type:"AWS::CodeDeploy::Application",Properties:{ApplicationName:s,ComputePlatform:i,Tags:[{Key:"Name",Value:s},{Key:"Environment",Value:n}]}},logicalId:a}}static createDeploymentGroup(e,t){let{slug:n,environment:r,deploymentGroupName:i,serviceRoleArn:s,autoScalingGroups:a,ec2TagFilters:o,deploymentConfigName:c,autoRollbackConfiguration:l,alarmConfiguration:u,loadBalancerInfo:m,blueGreenDeploymentConfiguration:p}=t,g=i||S({slug:n,environment:r,resourceType:"deploy-group"}),y=f(g);return{deploymentGroup:{Type:"AWS::CodeDeploy::DeploymentGroup",Properties:{ApplicationName:v.Ref(e),DeploymentGroupName:g,ServiceRoleArn:s,AutoScalingGroups:a,Ec2TagFilters:o?.map((b)=>({Key:b.key,Value:b.value,Type:b.type})),DeploymentConfigName:c,AutoRollbackConfiguration:l?{Enabled:l.enabled,Events:l.events}:void 0,AlarmConfiguration:u?{Enabled:u.enabled,Alarms:u.alarms?.map((b)=>({Name:b.name})),IgnorePollAlarmFailure:u.ignorePollAlarmFailure}:void 0,LoadBalancerInfo:m?{TargetGroupInfoList:m.targetGroupInfoList?.map((b)=>({Name:b.name})),ElbInfoList:m.elbInfoList?.map((b)=>({Name:b.name}))}:void 0,BlueGreenDeploymentConfiguration:p?{TerminateBlueInstancesOnDeploymentSuccess:p.terminateBlueInstancesOnDeploymentSuccess?{Action:p.terminateBlueInstancesOnDeploymentSuccess.action,TerminationWaitTimeInMinutes:p.terminateBlueInstancesOnDeploymentSuccess.terminationWaitTimeInMinutes}:void 0,DeploymentReadyOption:p.deploymentReadyOption?{ActionOnTimeout:p.deploymentReadyOption.actionOnTimeout,WaitTimeInMinutes:p.deploymentReadyOption.waitTimeInMinutes}:void 0,GreenFleetProvisioningOption:p.greenFleetProvisioningOption?{Action:p.greenFleetProvisioningOption.action}:void 0}:void 0,Tags:[{Key:"Name",Value:g},{Key:"Environment",Value:r}]}},logicalId:y}}static createDeploymentConfig(e){let{slug:t,environment:n,deploymentConfigName:r,minimumHealthyHosts:i,trafficRoutingConfig:s}=e,a=r||S({slug:t,environment:n,resourceType:"deploy-config"}),o=f(a);return{deploymentConfig:{Type:"AWS::CodeDeploy::DeploymentConfig",Properties:{DeploymentConfigName:a,MinimumHealthyHosts:i?{Type:i.type,Value:i.value}:void 0,TrafficRoutingConfig:s?{Type:s.type,TimeBasedCanary:s.timeBasedCanary?{CanaryPercentage:s.timeBasedCanary.canaryPercentage,CanaryInterval:s.timeBasedCanary.canaryInterval}:void 0,TimeBasedLinear:s.timeBasedLinear?{LinearPercentage:s.timeBasedLinear.linearPercentage,LinearInterval:s.timeBasedLinear.linearInterval}:void 0}:void 0}},logicalId:o}}static DeploymentConfigs={allAtOnce:()=>({type:"FLEET_PERCENT",value:0}),halfAtATime:()=>({type:"FLEET_PERCENT",value:50}),oneAtATime:()=>({type:"HOST_COUNT",value:1}),custom:(e,t)=>({type:e,value:t})};static TrafficRouting={allAtOnce:()=>({type:"AllAtOnce"}),canary:(e,t)=>({type:"TimeBasedCanary",timeBasedCanary:{canaryPercentage:e,canaryInterval:t}}),linear:(e,t)=>({type:"TimeBasedLinear",timeBasedLinear:{linearPercentage:e,linearInterval:t}})};static RollbackConfigs={onFailure:()=>({enabled:!0,events:["DEPLOYMENT_FAILURE"]}),onAlarmOrFailure:()=>({enabled:!0,events:["DEPLOYMENT_FAILURE","DEPLOYMENT_STOP_ON_ALARM"]}),onAllEvents:()=>({enabled:!0,events:["DEPLOYMENT_FAILURE","DEPLOYMENT_STOP_ON_ALARM","DEPLOYMENT_STOP_ON_REQUEST"]}),disabled:()=>({enabled:!1})};static BlueGreenConfigs={standard:()=>({terminateBlueInstancesOnDeploymentSuccess:{action:"TERMINATE",terminationWaitTimeInMinutes:5},deploymentReadyOption:{actionOnTimeout:"CONTINUE_DEPLOYMENT",waitTimeInMinutes:0},greenFleetProvisioningOption:{action:"COPY_AUTO_SCALING_GROUP"}}),withDelay:(e)=>({terminateBlueInstancesOnDeploymentSuccess:{action:"TERMINATE",terminationWaitTimeInMinutes:e},deploymentReadyOption:{actionOnTimeout:"CONTINUE_DEPLOYMENT",waitTimeInMinutes:0},greenFleetProvisioningOption:{action:"COPY_AUTO_SCALING_GROUP"}}),withManualApproval:(e)=>({terminateBlueInstancesOnDeploymentSuccess:{action:"TERMINATE",terminationWaitTimeInMinutes:5},deploymentReadyOption:{actionOnTimeout:"STOP_DEPLOYMENT",waitTimeInMinutes:e},greenFleetProvisioningOption:{action:"COPY_AUTO_SCALING_GROUP"}}),keepBlue:()=>({terminateBlueInstancesOnDeploymentSuccess:{action:"KEEP_ALIVE"},deploymentReadyOption:{actionOnTimeout:"CONTINUE_DEPLOYMENT",waitTimeInMinutes:0},greenFleetProvisioningOption:{action:"COPY_AUTO_SCALING_GROUP"}})};static UseCases={ec2Deployment:(e,t,n,r)=>{let{application:i,logicalId:s}=X.createApplication({slug:e,environment:t,computePlatform:"Server"}),{deploymentGroup:a,logicalId:o}=X.createDeploymentGroup(s,{slug:e,environment:t,serviceRoleArn:n,autoScalingGroups:r,deploymentConfigName:"CodeDeployDefault.OneAtATime",autoRollbackConfiguration:X.RollbackConfigs.onFailure()});return{application:i,appId:s,deploymentGroup:a,groupId:o}},lambdaCanaryDeployment:(e,t,n,r=10,i=5)=>{let{application:s,logicalId:a}=X.createApplication({slug:e,environment:t,computePlatform:"Lambda"}),{deploymentConfig:o,logicalId:c}=X.createDeploymentConfig({slug:e,environment:t,trafficRoutingConfig:X.TrafficRouting.canary(r,i)}),{deploymentGroup:l,logicalId:u}=X.createDeploymentGroup(a,{slug:e,environment:t,serviceRoleArn:n,deploymentConfigName:v.Ref(c),autoRollbackConfiguration:X.RollbackConfigs.onAlarmOrFailure()});return{application:s,appId:a,deploymentConfig:o,configId:c,deploymentGroup:l,groupId:u}},ecsBlueGreenDeployment:(e,t,n,r)=>{let{application:i,logicalId:s}=X.createApplication({slug:e,environment:t,computePlatform:"ECS"}),{deploymentGroup:a,logicalId:o}=X.createDeploymentGroup(s,{slug:e,environment:t,serviceRoleArn:n,loadBalancerInfo:{targetGroupInfoList:[{name:r}]},blueGreenDeploymentConfiguration:X.BlueGreenConfigs.standard(),autoRollbackConfiguration:X.RollbackConfigs.onFailure()});return{application:i,appId:s,deploymentGroup:a,groupId:o}}};static Strategies={rolling:(e=25)=>({type:"rolling",batchPercentage:e}),blueGreen:()=>({type:"blue-green"}),canary:(e=10,t=5)=>({type:"canary",canaryPercentage:e,canaryInterval:t}),allAtOnce:()=>({type:"all-at-once"})}}class K{static ContentTypes={".html":"text/html",".htm":"text/html",".css":"text/css",".js":"application/javascript",".mjs":"application/javascript",".json":"application/json",".xml":"application/xml",".svg":"image/svg+xml",".png":"image/png",".jpg":"image/jpeg",".jpeg":"image/jpeg",".gif":"image/gif",".webp":"image/webp",".avif":"image/avif",".ico":"image/x-icon",".woff":"font/woff",".woff2":"font/woff2",".ttf":"font/ttf",".otf":"font/otf",".eot":"application/vnd.ms-fontobject",".pdf":"application/pdf",".txt":"text/plain",".md":"text/markdown",".map":"application/json"};static NoHashPatterns=[/^index\.html$/,/^favicon\.ico$/,/^robots\.txt$/,/^sitemap\.xml$/,/^manifest\.json$/,/^\.well-known\//,/^_redirects$/,/^_headers$/];static computeFileHash(e,t="md5"){let n=St(e);return Da(t).update(n).digest("hex")}static computeShortHash(e){return K.computeFileHash(e).slice(0,8)}static getContentType(e){let t=br(e).toLowerCase();return K.ContentTypes[t]||"application/octet-stream"}static shouldHashFile(e,t){return![...K.NoHashPatterns,...t||[]].some((r)=>r.test(e))}static generateHashedFilename(e,t){let n=br(e),r=Ma(e,n),i=hr(e);if(i===".")return`${r}.${t}${n}`;return tt(i,`${r}.${t}${n}`)}static collectFiles(e,t){let n=[],r=t||e;if(!Qt(e))return n;let i=xa(e,{withFileTypes:!0});for(let s of i){let a=tt(e,s.name);if(s.isDirectory())n.push(...K.collectFiles(a,r));else if(s.isFile())n.push(a)}return n}static hashDirectory(e){let{sourceDir:t,outputDir:n,excludePatterns:r=[],hashAlgorithm:i="md5",copyUnhashed:s=!0}=e,a=K.collectFiles(t),o=[],c={};for(let u of a){let m=u.replace(t,"").replace(/^[/\\]/,""),p=K.shouldHashFile(m,r),g=ka(u),y=p?K.computeFileHash(u,i).slice(0,8):"",h=p?K.generateHashedFilename(m,y):m,b={originalPath:m,hashedPath:h,hash:y,size:g.size,contentType:K.getContentType(u)};if(o.push(b),c[m]=h,n){let C=tt(n,h),T=hr(C);if(!Qt(T)){let{mkdirSync:A}=Fs("node:fs");A(T,{recursive:!0})}if(p||s)Na(u,C)}}let l={version:"1.0",timestamp:new Date().toISOString(),assets:o,hashMap:c};if(n){let u=tt(n,"asset-manifest.json");At(u,JSON.stringify(l,null,2))}return l}static getInvalidationPaths(e,t){let n=[];if(!e)return["/*"];let r=e.hashMap,i=t.hashMap;for(let[s,a]of Object.entries(i)){let o=r[s];if(!o||o!==a){if(n.push(`/${s}`),o&&o!==a)n.push(`/${o}`)}}for(let[s,a]of Object.entries(r))if(!i[s])n.push(`/${s}`),n.push(`/${a}`);if(n.length>100)return["/*"];return[...new Set(n)]}static updateHtmlReferences(e){let{htmlDir:t,manifest:n,basePath:r=""}=e,i=K.collectFiles(t).filter((s)=>s.endsWith(".html")||s.endsWith(".htm"));for(let s of i){let a=St(s,"utf-8");for(let[o,c]of Object.entries(n.hashMap)){if(o===c)continue;let l=[new RegExp(`(src|href)=["']${r}/?${K.escapeRegExp(o)}["']`,"g"),new RegExp(`url\\(["']?${r}/?${K.escapeRegExp(o)}["']?\\)`,"g")];for(let u of l)a=a.replace(u,(m)=>m.replace(o,c))}At(s,a)}}static updateCssReferences(e){let{cssDir:t,manifest:n,basePath:r=""}=e,i=K.collectFiles(t).filter((s)=>s.endsWith(".css"));for(let s of i){let a=St(s,"utf-8");for(let[o,c]of Object.entries(n.hashMap)){if(o===c)continue;let l=new RegExp(`url\\(["']?${r}/?${K.escapeRegExp(o)}["']?\\)`,"g");a=a.replace(l,`url(${r}/${c})`)}At(s,a)}}static escapeRegExp(e){return e.replace(/[.*+?^${}()|[\]\\]/g,"\\$&")}static generateS3DeploymentManifest(e){let{sourceDir:t,keyPrefix:n="",excludePatterns:r=[],cacheControl:i={hashed:"public, max-age=31536000, immutable",unhashed:"public, max-age=3600",html:"public, max-age=0, must-revalidate"}}=e;return K.hashDirectory({sourceDir:t,excludePatterns:r}).assets.map((a)=>{let o=a.hash!=="",c=a.contentType==="text/html",l=i.unhashed||"public, max-age=3600";if(c)l=i.html||"public, max-age=0, must-revalidate";else if(o)l=i.hashed||"public, max-age=31536000, immutable";return{localPath:tt(t,a.originalPath),s3Key:n?`${n}/${a.hashedPath}`:a.hashedPath,contentType:a.contentType,cacheControl:l,hash:a.hash}})}static compareManifests(e,t){let n={added:[],removed:[],changed:[],unchanged:[]},r=new Set(Object.keys(e.hashMap)),i=new Set(Object.keys(t.hashMap));for(let s of i)if(!r.has(s))n.added.push(s);for(let s of r)if(!i.has(s))n.removed.push(s);for(let s of i)if(r.has(s))if(e.hashMap[s]!==t.hashMap[s])n.changed.push(s);else n.unchanged.push(s);return n}static loadManifest(e){if(!Qt(e))return null;try{let t=St(e,"utf-8");return JSON.parse(t)}catch{return null}}static saveManifest(e,t){At(t,JSON.stringify(e,null,2))}}class nt{static createSecret(e){let{slug:t,environment:n,secretName:r,description:i,secretString:s,kmsKeyId:a,tags:o}=e,c=r||S({slug:t,environment:n,resourceType:"secret"}),l=f(c),u={Type:"AWS::SecretsManager::Secret",Properties:{Name:c,Description:i,SecretString:s,Tags:[{Key:"Name",Value:c},{Key:"Environment",Value:n},...o?Object.entries(o).map(([m,p])=>({Key:m,Value:p})):[]]}};if(a)u.Properties.KmsKeyId=a;return{secret:u,logicalId:l}}static createGeneratedSecret(e){let{slug:t,environment:n,secretName:r,description:i,excludeCharacters:s,excludeLowercase:a,excludeNumbers:o,excludePunctuation:c,excludeUppercase:l,passwordLength:u,requireEachIncludedType:m,kmsKeyId:p,tags:g}=e,y=r||S({slug:t,environment:n,resourceType:"secret"}),h=f(y),b={Type:"AWS::SecretsManager::Secret",Properties:{Name:y,Description:i,GenerateSecretString:{ExcludeCharacters:s,ExcludeLowercase:a,ExcludeNumbers:o,ExcludePunctuation:c,ExcludeUppercase:l,PasswordLength:u||32,RequireEachIncludedType:m!==!1},Tags:[{Key:"Name",Value:y},{Key:"Environment",Value:n},...g?Object.entries(g).map(([C,T])=>({Key:C,Value:T})):[]]}};if(p)b.Properties.KmsKeyId=p;return{secret:b,logicalId:h}}static createDatabaseSecret(e){let{slug:t,environment:n,secretName:r,username:i,dbname:s,engine:a,host:o,port:c,kmsKeyId:l}=e,u=r||S({slug:t,environment:n,resourceType:"db-secret"}),m=f(u),p={username:i};if(s)p.dbname=s;if(a)p.engine=a;if(o)p.host=o;if(c)p.port=c;let g={Type:"AWS::SecretsManager::Secret",Properties:{Name:u,Description:`Database credentials for ${i}`,GenerateSecretString:{SecretStringTemplate:JSON.stringify(p),GenerateStringKey:"password",PasswordLength:32,ExcludeCharacters:'"@/\\',RequireEachIncludedType:!0},Tags:[{Key:"Name",Value:u},{Key:"Environment",Value:n},{Key:"Type",Value:"database"}]}};if(l)g.Properties.KmsKeyId=l;return{secret:g,logicalId:m}}static attachToDatabase(e){let{slug:t,environment:n,secretId:r,targetId:i,targetType:s}=e,a=S({slug:t,environment:n,resourceType:"secret-attachment"}),o=f(a);return{attachment:{Type:"AWS::SecretsManager::SecretTargetAttachment",Properties:{SecretId:r,TargetId:i,TargetType:s}},logicalId:o}}static enableRotation(e){let{slug:t,environment:n,secretId:r,rotationLambdaArn:i,automaticallyAfterDays:s,rotationType:a,kmsKeyArn:o,vpcSecurityGroupIds:c,vpcSubnetIds:l}=e,u=S({slug:t,environment:n,resourceType:"secret-rotation"}),m=f(u),p={Type:"AWS::SecretsManager::RotationSchedule",Properties:{SecretId:r,RotationRules:{AutomaticallyAfterDays:s||30}}};if(i)p.Properties.RotationLambdaARN=i;else if(a)p.Properties.HostedRotationLambda={RotationType:a,KmsKeyArn:o,VpcSecurityGroupIds:c,VpcSubnetIds:l};return{rotation:p,logicalId:m}}static SecretTypes={apiKey:(e,t,n)=>nt.createGeneratedSecret({slug:e,environment:t,secretName:`${e}-${t}-${n}-api-key`,description:`API key for ${n}`,passwordLength:32,excludePunctuation:!0,excludeLowercase:!1,excludeUppercase:!1,excludeNumbers:!1}),oauthClientSecret:(e,t,n)=>nt.createGeneratedSecret({slug:e,environment:t,secretName:`${e}-${t}-${n}-oauth-secret`,description:`OAuth client secret for ${n}`,passwordLength:64,excludeCharacters:"\"'`\\/@",requireEachIncludedType:!0}),jwtSecret:(e,t)=>nt.createGeneratedSecret({slug:e,environment:t,secretName:`${e}-${t}-jwt-secret`,description:"JWT signing secret",passwordLength:64,excludePunctuation:!0}),encryptionKey:(e,t)=>nt.createGeneratedSecret({slug:e,environment:t,secretName:`${e}-${t}-encryption-key`,description:"Data encryption key",passwordLength:64,excludeCharacters:"+/=",excludePunctuation:!0})};static RotationTypes={MySQLSingleUser:"MySQLSingleUser",MySQLMultiUser:"MySQLMultiUser",PostgreSQLSingleUser:"PostgreSQLSingleUser",PostgreSQLMultiUser:"PostgreSQLMultiUser",OracleSingleUser:"OracleSingleUser",OracleMultiUser:"OracleMultiUser",MariaDBSingleUser:"MariaDBSingleUser",MariaDBMultiUser:"MariaDBMultiUser",SQLServerSingleUser:"SQLServerSingleUser",SQLServerMultiUser:"SQLServerMultiUser",RedshiftSingleUser:"RedshiftSingleUser",RedshiftMultiUser:"RedshiftMultiUser",MongoDBSingleUser:"MongoDBSingleUser",MongoDBMultiUser:"MongoDBMultiUser"}}class U{static createParameter(e){let{slug:t,environment:n,parameterName:r,value:i,type:s="String",description:a,tier:o="Standard",tags:c}=e,l=r||S({slug:t,environment:n,resourceType:"parameter"}),u=f(l);return{parameter:{Type:"AWS::SSM::Parameter",Properties:{Name:`/${t}/${n}/${l}`,Type:s,Value:i,Description:a,Tier:o,Tags:{Name:l,Environment:n,...c}}},logicalId:u}}static createString(e,t,n,r,i){return U.createParameter({slug:e,environment:t,parameterName:n,value:r,type:"String",description:i})}static createSecureString(e,t,n,r,i){return U.createParameter({slug:e,environment:t,parameterName:n,value:r,type:"SecureString",description:i})}static createStringList(e,t,n,r,i){return U.createParameter({slug:e,environment:t,parameterName:n,value:r.join(","),type:"StringList",description:i})}static Parameters={databaseUrl:(e,t,n)=>U.createSecureString(e,t,"database-url",n,"Database connection URL"),apiEndpoint:(e,t,n)=>U.createString(e,t,"api-endpoint",n,"API endpoint URL"),appVersion:(e,t,n)=>U.createString(e,t,"app-version",n,"Application version"),featureFlags:(e,t,n)=>U.createStringList(e,t,"feature-flags",n,"Enabled feature flags"),apiKey:(e,t,n,r)=>U.createSecureString(e,t,`${n}-api-key`,r,`API key for ${n}`),oauthCredentials:(e,t,n,r)=>{let i=U.createString(e,t,"oauth-client-id",n,"OAuth client ID"),s=U.createSecureString(e,t,"oauth-client-secret",r,"OAuth client secret");return{clientId:i,clientSecret:s}},smtpCredentials:(e,t,n,r,i,s)=>{let a=U.createString(e,t,"smtp-username",n,"SMTP username"),o=U.createSecureString(e,t,"smtp-password",r,"SMTP password"),c=U.createString(e,t,"smtp-host",i,"SMTP host"),l=U.createString(e,t,"smtp-port",s.toString(),"SMTP port");return{username:a,password:o,host:c,port:l}},redisUrl:(e,t,n)=>U.createSecureString(e,t,"redis-url",n,"Redis connection URL"),s3Bucket:(e,t,n)=>U.createString(e,t,"s3-bucket",n,"S3 bucket name"),cloudFrontDistribution:(e,t,n)=>U.createString(e,t,"cloudfront-distribution-id",n,"CloudFront distribution ID")}}class rt{static createDomain(e){let{slug:t,environment:n,domainName:r,engineVersion:i="OpenSearch_2.11",instanceType:s="t3.small.search",instanceCount:a=1,volumeSize:o=10,volumeType:c="gp3",dedicatedMaster:l=!1,dedicatedMasterType:u,dedicatedMasterCount:m=3,multiAz:p=!1,availabilityZoneCount:g=2,vpc:y,encryption:h,enforceHttps:b=!0,tlsSecurityPolicy:C="Policy-Min-TLS-1-2-2019-07",advancedSecurity:T,autoSnapshotHour:A=0,autoTune:R=!0,tags:P={}}=e,E=r||S({slug:t,environment:n,resourceType:"search"}),w=f(E);return{domain:{Type:"AWS::OpenSearchService::Domain",Properties:{DomainName:E,EngineVersion:i,ClusterConfig:{InstanceType:s,InstanceCount:a,DedicatedMasterEnabled:l,...l&&{DedicatedMasterType:u||s,DedicatedMasterCount:m},ZoneAwarenessEnabled:p,...p&&{ZoneAwarenessConfig:{AvailabilityZoneCount:g}}},EBSOptions:{EBSEnabled:!0,VolumeType:c,VolumeSize:o},DomainEndpointOptions:{EnforceHTTPS:b,TLSSecurityPolicy:C},SnapshotOptions:{AutomatedSnapshotStartHour:A},...y&&{VPCOptions:{SubnetIds:y.subnetIds,SecurityGroupIds:y.securityGroupIds}},...h&&{EncryptionAtRestOptions:{Enabled:h.atRest??!0,...h.kmsKeyId&&{KmsKeyId:h.kmsKeyId}},NodeToNodeEncryptionOptions:{Enabled:h.nodeToNode??!0}},...T&&{AdvancedSecurityOptions:{Enabled:T.enabled,InternalUserDatabaseEnabled:T.internalUserDatabase??!0,...T.masterUserName&&T.masterUserPassword&&{MasterUserOptions:{MasterUserName:T.masterUserName,MasterUserPassword:T.masterUserPassword}},...T.masterUserArn&&{MasterUserOptions:{MasterUserARN:T.masterUserArn}}}},...R&&{AutoTuneOptions:{DesiredState:"ENABLED"}},Tags:[{Key:"Name",Value:E},{Key:"Environment",Value:n},...Object.entries(P).map(([D,k])=>({Key:D,Value:k}))]}},logicalId:w}}static createAccessPolicy(e,t){let{ipAddresses:n,iamPrincipalArns:r,allowAll:i,vpcEndpoint:s}=t;if(i)return{Version:"2012-10-17",Statement:[{Effect:"Allow",Principal:{AWS:"*"},Action:"es:*",Resource:e}]};let a=[];if(r&&r.length>0)a.push({Effect:"Allow",Principal:{AWS:r},Action:"es:*",Resource:e});if(n&&n.length>0)a.push({Effect:"Allow",Principal:{AWS:"*"},Action:"es:*",Resource:e,Condition:{IpAddress:{"aws:SourceIp":n}}});if(s)return{Version:"2012-10-17",Statement:[{Effect:"Allow",Principal:{AWS:"*"},Action:"es:*",Resource:e}]};return{Version:"2012-10-17",Statement:a}}static DomainPresets={development:(e,t)=>rt.createDomain({slug:e,environment:t,instanceType:"t3.small.search",instanceCount:1,volumeSize:10,multiAz:!1,dedicatedMaster:!1,encryption:{atRest:!0,nodeToNode:!0},autoTune:!1}),production:(e,t,n)=>rt.createDomain({slug:e,environment:t,instanceType:"m6g.large.search",instanceCount:3,volumeSize:100,volumeType:"gp3",multiAz:!0,availabilityZoneCount:3,dedicatedMaster:!0,dedicatedMasterType:"m6g.large.search",dedicatedMasterCount:3,vpc:n,encryption:{atRest:!0,nodeToNode:!0},advancedSecurity:{enabled:!0,internalUserDatabase:!0},autoTune:!0}),costOptimized:(e,t)=>rt.createDomain({slug:e,environment:t,instanceType:"t3.medium.search",instanceCount:2,volumeSize:20,volumeType:"gp3",multiAz:!0,dedicatedMaster:!1,encryption:{atRest:!0,nodeToNode:!0},autoTune:!0}),highPerformance:(e,t,n)=>rt.createDomain({slug:e,environment:t,instanceType:"r6g.2xlarge.search",instanceCount:6,volumeSize:500,volumeType:"gp3",multiAz:!0,availabilityZoneCount:3,dedicatedMaster:!0,dedicatedMasterType:"c6g.xlarge.search",dedicatedMasterCount:3,vpc:n,encryption:{atRest:!0,nodeToNode:!0},advancedSecurity:{enabled:!0,internalUserDatabase:!1},autoTune:!0})};static InstanceTypes={"t3.small.search":"t3.small.search","t3.medium.search":"t3.medium.search","m6g.large.search":"m6g.large.search","m6g.xlarge.search":"m6g.xlarge.search","m6g.2xlarge.search":"m6g.2xlarge.search","r6g.large.search":"r6g.large.search","r6g.xlarge.search":"r6g.xlarge.search","r6g.2xlarge.search":"r6g.2xlarge.search","r6g.4xlarge.search":"r6g.4xlarge.search","c6g.large.search":"c6g.large.search","c6g.xlarge.search":"c6g.xlarge.search","c6g.2xlarge.search":"c6g.2xlarge.search"};static EngineVersions={"OpenSearch_2.11":"OpenSearch_2.11","OpenSearch_2.9":"OpenSearch_2.9","OpenSearch_2.7":"OpenSearch_2.7","OpenSearch_1.3":"OpenSearch_1.3","Elasticsearch_7.10":"Elasticsearch_7.10"}}class Ct{static createDomainRedirectBucket(e){let{slug:t,environment:n,sourceDomain:r,targetDomain:i,protocol:s="https"}=e,a=S({slug:t,environment:n,resourceType:"s3",suffix:"redirect"}),o=f(a),c=f(`${a}-policy`),l={Type:"AWS::S3::Bucket",Properties:{BucketName:r,WebsiteConfiguration:{RedirectAllRequestsTo:{HostName:i,Protocol:s}},PublicAccessBlockConfiguration:{BlockPublicAcls:!1,BlockPublicPolicy:!1,IgnorePublicAcls:!1,RestrictPublicBuckets:!1},Tags:[{Key:"Name",Value:a},{Key:"Environment",Value:n},{Key:"Purpose",Value:"Domain Redirect"}]}},u={Type:"AWS::S3::BucketPolicy",Properties:{Bucket:v.Ref(o),PolicyDocument:{Version:"2012-10-17",Statement:[{Sid:"PublicReadForRedirect",Effect:"Allow",Principal:"*",Action:["s3:GetObject"],Resource:[v.Join("",[v.GetAtt(o,"Arn"),"/*"])]}]}}};return{bucket:l,bucketPolicy:u,logicalId:o,policyLogicalId:c}}static createPathRedirectFunction(e){let{slug:t,environment:n,rules:r}=e,i=S({slug:t,environment:n,resourceType:"cf-redirect"}),s=f(i),a=Ct.generateRedirectFunctionCode(r);return{function:{Type:"AWS::CloudFront::Function",Properties:{Name:i,AutoPublish:!0,FunctionConfig:{Comment:`Path redirect function for ${t} (${n})`,Runtime:"cloudfront-js-2.0"},FunctionCode:a}},logicalId:s,functionCode:a}}static generateRedirectFunctionCode(e){return`function handler(event) {
   const request = event.request;
   const uri = request.uri;
   const querystring = request.querystring;
@@ -2469,8 +2469,8 @@ rpm -U ./amazon-cloudwatch-agent.rpm || true
 # Mount EFS for shared file storage
 `}},storage:{uploads:{type:"efs",performanceMode:"generalPurpose",throughputMode:"bursting",encrypted:!0,lifecyclePolicy:{transitionToIA:30}},backups:{public:!1,versioning:!0,encryption:!0,lifecycleRules:[{id:"ArchiveOldBackups",enabled:!0,transitions:[{days:90,storageClass:"GLACIER"}]}]},static:{public:!0,versioning:!1,encryption:!1,cors:[{allowedOrigins:[r||"*"],allowedMethods:["GET","HEAD"]}]}},cdn:{enabled:!0,origins:[{originId:"static-assets",domainName:`${n}-static.s3.amazonaws.com`,pathPattern:"/static/*"}],customDomain:r?{domain:r,certificateArn:"TO_BE_GENERATED"}:void 0,cachePolicy:{minTTL:0,defaultTTL:86400,maxTTL:31536000},compress:!0,http3:!0},databases:o==="mysql"?{mysql:{engine:"mysql",version:"8.0",instanceClass:"db.t3.medium",allocatedStorage:100,maxAllocatedStorage:500,multiAZ:!0,backupRetentionDays:14,preferredBackupWindow:"03:00-04:00",preferredMaintenanceWindow:"sun:04:00-sun:05:00",enablePerformanceInsights:!0,performanceInsightsRetention:7,deletionProtection:!0,parameters:{max_connections:"500",innodb_buffer_pool_size:"{DBInstanceClassMemory*3/4}",slow_query_log:"1",long_query_time:"2"}}}:{postgres:{engine:"postgres",version:"15",instanceClass:"db.t3.medium",allocatedStorage:100,maxAllocatedStorage:500,multiAZ:!0,backupRetentionDays:14,preferredBackupWindow:"03:00-04:00",preferredMaintenanceWindow:"sun:04:00-sun:05:00",enablePerformanceInsights:!0,performanceInsightsRetention:7,deletionProtection:!0,parameters:{max_connections:"500",shared_buffers:"{DBInstanceClassMemory/4}",log_min_duration_statement:"2000"}}},cache:c==="redis"?{redis:{nodeType:"cache.t3.medium",numCacheNodes:2,engine:"redis",engineVersion:"7.0",port:6379,parameterGroup:{maxmemoryPolicy:"allkeys-lru",timeout:"300"},snapshotRetentionLimit:5,snapshotWindow:"03:00-05:00",automaticFailoverEnabled:!0}}:void 0,queues:{jobs:{fifo:!1,visibilityTimeout:900,messageRetentionPeriod:345600,receiveMessageWaitTime:20,deadLetterQueue:!0,maxReceiveCount:3},emails:{fifo:!1,visibilityTimeout:300,messageRetentionPeriod:86400,deadLetterQueue:!0}},functions:{"job-worker":{runtime:"nodejs20.x",handler:"dist/workers/jobs.handler",memory:2048,timeout:900,events:[{type:"sqs",queueName:`${n}-jobs`,batchSize:10}]},"email-sender":{runtime:"nodejs20.x",handler:"dist/workers/email.handler",memory:512,timeout:60,events:[{type:"sqs",queueName:`${n}-emails`,batchSize:10}]},cleanup:{runtime:"nodejs20.x",handler:"dist/tasks/cleanup.handler",memory:512,timeout:300,events:[{type:"schedule",expression:"cron(0 2 * * ? *)"}]}},monitoring:{dashboard:{name:`${n}-web-app`,widgets:[{type:"metric",metrics:["EC2CPUUtilization","ALBRequestCount","ALBTargetResponseTime","RDSCPUUtilization","RDSDatabaseConnections","RDSReadLatency","RDSWriteLatency"]}]},alarms:[{metric:"EC2CPUUtilization",threshold:80,evaluationPeriods:2},{metric:"RDSCPUUtilization",threshold:80,evaluationPeriods:2},{metric:"RDSDatabaseConnections",threshold:400,evaluationPeriods:1},{metric:"ALBTargetResponseTime",threshold:2000,evaluationPeriods:2},{metric:"ALBUnhealthyHostCount",threshold:1,evaluationPeriods:1}],logs:{retention:14,groups:[`${n}-app`,`${n}-nginx`,`${n}-workers`]}},security:{certificate:r?{domain:r,validationMethod:"DNS"}:void 0,waf:{enabled:!0,rules:["rateLimit","sqlInjection","xss","knownBadInputs"]},securityGroups:{alb:{ingress:[{port:80,protocol:"tcp",cidr:"0.0.0.0/0"},{port:443,protocol:"tcp",cidr:"0.0.0.0/0"}]},app:{ingress:[{port:3000,protocol:"tcp",source:"alb-sg"}]},database:{ingress:[{port:o==="mysql"?3306:5432,protocol:"tcp",source:"app-sg"}]},...c==="redis"&&{cache:{ingress:[{port:6379,protocol:"tcp",source:"app-sg"}]}}}}}}}function xg(e){let{name:t,slug:n,domain:r,repository:i,phpVersion:s="8.3",size:a="small",database:o=n.replace(/-/g,"_"),databasePassword:c,sslEmail:l,deployStrategy:u="push",provider:m="hetzner"}=e;return{project:{name:t,slug:n,region:"us-east-1"},mode:"server",cloud:{provider:m},environments:{production:{type:"production",domain:r}},infrastructure:{compute:{mode:"server",size:a,runtime:"php",webServer:"nginx",php:{versions:[s],default:s},managedServices:{mysql:!0,redis:!0},firewall:{enabled:!0},autoUpdates:!0,monitoring:!0,backups:{enabled:!0,schedule:"0 2 * * *",retentionCount:7}},appDatabase:{engine:"mysql",name:o,username:o,password:c}},sites:{main:{root:".",type:"laravel",domain:r,phpVersion:s,repository:{...i,strategy:u},scheduler:!0,queues:[{connection:"redis",queue:"default",processes:1}],ssl:{provider:"letsencrypt",email:l}}}}}function Mg(e){let{name:t,slug:n,domain:r,layers:i,phpVersion:s="8.3",architecture:a="x86_64",memory:o=1024,build:c,deploy:l=["migrate --force"],cache:u="dynamodb",scheduler:m="on",region:p="us-east-1"}=e;return{project:{name:t,slug:n,region:p},mode:"serverless",environments:{production:{type:"production",domain:r,app:{kind:"php",runtime:"provided.al2023",phpVersion:s,architecture:a,layers:i,memory:o,build:c,deploy:l,assets:"public",queues:!0,scheduler:m,cache:{driver:u},domain:r}}}}}function Og(e){return{root:e.root??"packages/ui/dist",deploy:"server",type:"static",domain:e.domain,build:e.build??"cd packages/ui && bun install && bun run build",ssl:{provider:"letsencrypt"},auth:{username:e.username??"admin",password:e.password}}}var ao=_t,oo="./node_modules/@stacksjs/ts-cloud/dist/bin/dashboard-server.js";function co(e){let t=e.split(".").filter(Boolean);return t.length<=2?e:t.slice(-2).join(".")}function lo(e){let t=2166136261;for(let n=0;n<e.length;n++)t^=e.charCodeAt(n),t=Math.imul(t,16777619);return t>>>0}var uo=20000,mo=12000;function po(e){return uo+lo(e)%mo}function Or(e,t){let n=co(e);if(n===e)return`dashboard.${n}`;for(let r of t)if(r===n)return`dashboard.${n}`;return`dashboard.${e}`}function $r(e,t){let n=[],r=e.infrastructure?.dns?.domain;if(r&&!e.cloud?.attachTo)n.push(r);if(t&&e.environments?.[t]?.domain)n.push(e.environments[t].domain);for(let i of Object.values(e.sites??{})){let s=i;if(!s||s.redirect)continue;let a=s.domain;if(typeof a==="string")n.push(a);else if(Array.isArray(a))n.push(...a.filter((o)=>typeof o==="string"))}return n.filter((i)=>i&&!i.startsWith("dashboard."))}function go(e,t,n){if(n)return n;let r=$r(e,t),i=r[0];if(!i)return null;return Or(i,r)}function yo(e,t,n){if(n)return[n];let r=$r(e,t),i=[];for(let s of r){let a=Or(s,r);if(!i.includes(a))i.push(a)}return i}function fo(e){return Object.entries(e.sites??{}).some(([t,n])=>{if(!n)return!1;let r=n.root??"";return ho(t)||r==="ui/dist"||r.endsWith("/ui/dist")||r.endsWith("/dist/ui")})}var Br="dashboard-";function Lr(e){return Br+e.replace(/^dashboard\./,"").replace(/\./g,"-")}function ho(e){return e==="dashboard"||e.startsWith(Br)}function bo(e,t,n){if(fo(e))return[];if(e.cloud?.attachTo)return[];let r=n.password?{auth:{username:n.username||"admin",password:n.password,realm:n.realm}}:{},i=n.build===!1||n.build===void 0?{}:{build:n.build};if(n.live!==!1){let a=go(e,t,n.domain);if(!a)return[];let o=n.port??po(a),c=e.infrastructure?.appDatabase??e.infrastructure?.compute?.database,l={root:n.uiRoot,deploy:"server",domain:a,preStart:["bun install --production --no-save"],start:`bun ${oo} --box --host 127.0.0.1 --port ${o}`,port:o,cpuWeight:10,ioWeight:10,tasksMax:128,env:{APP_ENV:"production",NODE_ENV:"production",TS_CLOUD_DASHBOARD_TELEMETRY:"1",...c?.password?{TS_CLOUD_DASHBOARD_DB_PASSWORD:c.password}:{}},zeroDowntime:!1,sharedPaths:[ao],healthCheck:{path:"/login"},ssl:{provider:"letsencrypt"}};return[{name:Lr(a),site:l}]}return yo(e,t,n.domain).map((a)=>({name:Lr(a),site:{root:n.uiRoot,deploy:"server",type:"static",domain:a,ssl:{provider:"letsencrypt"},...i,...r}}))}function Fg(e,t,n){return bo(e,t,n)[0]??null}function Zt(e,t){let n={...e};for(let r in t){let i=t[r],s=n[r];if(i===void 0)continue;if(Array.isArray(i)&&Array.isArray(s))n[r]=[...s,...i];else if(typeof i==="object"&&i!==null&&!Array.isArray(i)&&typeof s==="object"&&s!==null&&!Array.isArray(s))n[r]=Zt(s,i);else n[r]=i}return n}function Fr(e,t){return Zt(e,t)}function _g(...e){return e.reduce((t,n)=>Zt(t,n),{})}function Wg(e,t){return(n)=>{let r=e(n);if(typeof t==="function")return Fr(r,t(r,n));return Fr(r,t)}}function We(e){return{infrastructure:e}}function Vg(e){return We({monitoring:e})}function Ug(e){return We({security:e})}function Hg(e){return We({databases:e})}function jg(e){return We({cache:e})}function Kg(e){return We({cdn:e})}function qg(e){return We({queues:e})}He();import{existsSync as Qr,readFileSync as en}from"node:fs";import{homedir as Jr}from"node:os";import{join as Yr}from"node:path";function vo(){let e=process.env.AWS_ACCESS_KEY_ID,t=process.env.AWS_SECRET_ACCESS_KEY;if(!e||!t)return null;return{accessKeyId:e,secretAccessKey:t,sessionToken:process.env.AWS_SESSION_TOKEN}}function To(e){let t=e?.profile||process.env.AWS_PROFILE||"default",n=e?.credentialsFile||Yr(Jr(),".aws","credentials");if(!Qr(n))return null;try{let r=en(n,"utf-8");return Ro(r,t)}catch{return null}}function Ro(e,t){let n=e.split(`
 `),r=null,i,s,a;for(let o of n){let c=o.trim();if(!c||c.startsWith("#")||c.startsWith(";"))continue;let l=c.match(/^\[([^\]]+)\]$/);if(l){if(r===t&&i&&s)return{accessKeyId:i,secretAccessKey:s,sessionToken:a};r=l[1],i=void 0,s=void 0,a=void 0;continue}if(r===t){let[u,...m]=c.split("="),p=m.join("=").trim();switch(u.trim().toLowerCase()){case"aws_access_key_id":i=p;break;case"aws_secret_access_key":s=p;break;case"aws_session_token":a=p;break}}}if(r===t&&i&&s)return{accessKeyId:i,secretAccessKey:s,sessionToken:a};return null}async function Po(e){let t=e?.timeout??1000,n="http://169.254.169.254";try{let r=await ct("http://169.254.169.254/latest/api/token",{method:"PUT",headers:{"X-aws-ec2-metadata-token-ttl-seconds":"21600"}},t);if(!r.ok)return null;let i=await r.text(),s=await ct("http://169.254.169.254/latest/meta-data/iam/security-credentials/",{headers:{"X-aws-ec2-metadata-token":i}},t);if(!s.ok)return null;let a=(await s.text()).trim(),o=await ct(`http://169.254.169.254/latest/meta-data/iam/security-credentials/${a}`,{headers:{"X-aws-ec2-metadata-token":i}},t);if(!o.ok)return null;let c=await o.json();return{accessKeyId:c.AccessKeyId,secretAccessKey:c.SecretAccessKey,sessionToken:c.Token,expiration:new Date(c.Expiration)}}catch{return null}}async function Eo(e){let t=e?.timeout??1000,n=process.env.AWS_CONTAINER_CREDENTIALS_RELATIVE_URI,r=process.env.AWS_CONTAINER_CREDENTIALS_FULL_URI,i=null;if(n)i=`http://169.254.170.2${n}`;else if(r)i=r;if(!i)return null;try{let s={},a=process.env.AWS_CONTAINER_AUTHORIZATION_TOKEN;if(a)s.Authorization=a;let o=await ct(i,{headers:s},t);if(!o.ok)return null;let c=await o.json();return{accessKeyId:c.AccessKeyId,secretAccessKey:c.SecretAccessKey,sessionToken:c.Token,expiration:new Date(c.Expiration)}}catch{return null}}async function wo(e){let t=e?.timeout??5000,n=process.env.AWS_WEB_IDENTITY_TOKEN_FILE,r=process.env.AWS_ROLE_ARN,i=process.env.AWS_ROLE_SESSION_NAME||"ts-cloud-session";if(!n||!r)return null;try{let s=en(n,"utf-8").trim(),a=process.env.AWS_REGION||process.env.AWS_DEFAULT_REGION||"us-east-1",o=a.startsWith("us-gov")?`https://sts.${a}.amazonaws.com`:a==="us-east-1"?"https://sts.amazonaws.com":`https://sts.${a}.amazonaws.com`,c=new URLSearchParams({Action:"AssumeRoleWithWebIdentity",Version:"2011-06-15",RoleArn:r,RoleSessionName:i,WebIdentityToken:s}),l=await ct(`${o}/?${c.toString()}`,{method:"POST"},t);if(!l.ok)return null;let u=await l.text(),m=ot(u,"AccessKeyId"),p=ot(u,"SecretAccessKey"),g=ot(u,"SessionToken"),y=ot(u,"Expiration");if(!m||!p)return null;return{accessKeyId:m,secretAccessKey:p,sessionToken:g??void 0,expiration:y?new Date(y):void 0}}catch{return null}}async function lt(e){let t=vo();if(t)return t;let n=To(e);if(n)return n;let r=await wo(e);if(r)return r;let i=await Eo(e);if(i)return i;let s=await Po(e);if(s)return s;throw Error("Could not find AWS credentials. Set AWS_ACCESS_KEY_ID and AWS_SECRET_ACCESS_KEY environment variables, or configure ~/.aws/credentials, or run on an EC2 instance with an IAM role.")}function oy(e){let t=null,n=null;return async()=>{if(t){if(!t.expiration)return t;let r=300000;if(t.expiration.getTime()-Date.now()>r)return t}if(n)return n;return n=lt(e).then((r)=>(t=r,n=null,r)).catch((r)=>{throw n=null,r}),n}}async function ct(e,t,n){let r=new AbortController,i=setTimeout(()=>r.abort(),n);try{let s=await fetch(e,{...t,signal:r.signal});return clearTimeout(i),s}catch(s){throw clearTimeout(i),s}}function ot(e,t){let n=new RegExp(`<${t}>([^<]+)</${t}>`),r=e.match(n);return r?r[1]:null}async function je(e){return lt({profile:e})}function Io(e){let t=process.env.AWS_REGION||process.env.AWS_DEFAULT_REGION;if(t)return t;let n=Yr(Jr(),".aws","config");if(Qr(n))try{let r=en(n,"utf-8"),i=e||process.env.AWS_PROFILE||"default",s=i==="default"?"[default]":`[profile ${i}]`,a=r.split(`
-`),o=!1;for(let c of a){let l=c.trim();if(l.startsWith("[")){o=l===s;continue}if(o&&l.startsWith("region")){let[,u]=l.split("=");if(u)return u.trim()}}}catch{}return"us-east-1"}async function Zr(e){let t=e||await lt(),n=Io();await He();let i=n.startsWith("us-gov")?`https://sts.${n}.amazonaws.com`:n==="us-east-1"?"https://sts.amazonaws.com":`https://sts.${n}.amazonaws.com`,s="Action=GetCallerIdentity&Version=2011-06-15",a=H({method:"POST",url:i,body:"Action=GetCallerIdentity&Version=2011-06-15",headers:{"Content-Type":"application/x-www-form-urlencoded"},...t,service:"sts",region:n}),o=await fetch(a.url,{method:a.method,headers:a.headers,body:a.body});if(!o.ok)throw Error(`Failed to get account ID: ${await o.text()}`);let c=await o.text(),l=ot(c,"Account");if(!l)throw Error("Failed to parse account ID from response");return l}await He();class Do{profile;credentials=null;region;constructor(e="us-east-1",t="default"){this.profile=t;this.region=e}async init(){if(this.credentials=await je(this.profile),this.credentials.region)this.region=this.credentials.region}async ensureCredentials(){if(!this.credentials)await this.init();return this.credentials}async request(e,t){let n=await this.ensureCredentials(),r={Action:e,Version:"2010-05-15",...tn(t)},i=new URLSearchParams(r).toString(),a=await(await Ne({method:"POST",url:`https://cloudformation.${this.region}.amazonaws.com/`,service:"cloudformation",region:this.region,headers:{"Content-Type":"application/x-www-form-urlencoded"},body:i,accessKeyId:n.accessKeyId,secretAccessKey:n.secretAccessKey,sessionToken:n.sessionToken})).text();return No(a)}async createStack(e){let t={StackName:e.stackName};if(e.templateBody)t.TemplateBody=e.templateBody;else if(e.templateURL)t.TemplateURL=e.templateURL;else throw Error("Either templateBody or templateURL must be provided");if(e.parameters)for(let[i,[s,a]]of Object.entries(e.parameters).entries())t[`Parameters.member.${i+1}.ParameterKey`]=s,t[`Parameters.member.${i+1}.ParameterValue`]=a;if(e.capabilities)for(let[i,s]of e.capabilities.entries())t[`Capabilities.member.${i+1}`]=s;if(e.tags)for(let[i,[s,a]]of Object.entries(e.tags).entries())t[`Tags.member.${i+1}.Key`]=s,t[`Tags.member.${i+1}.Value`]=a;if(e.timeoutInMinutes)t.TimeoutInMinutes=e.timeoutInMinutes;if(e.onFailure)t.OnFailure=e.onFailure;let n=await this.request("CreateStack",t);return(n?.CreateStackResult||n?.CreateStackResponse?.CreateStackResult||n)?.StackId}async updateStack(e){let t={StackName:e.stackName};if(e.templateBody)t.TemplateBody=e.templateBody;else if(e.templateURL)t.TemplateURL=e.templateURL;if(e.parameters)for(let[i,[s,a]]of Object.entries(e.parameters).entries())t[`Parameters.member.${i+1}.ParameterKey`]=s,t[`Parameters.member.${i+1}.ParameterValue`]=a;if(e.capabilities)for(let[i,s]of e.capabilities.entries())t[`Capabilities.member.${i+1}`]=s;if(e.tags)for(let[i,[s,a]]of Object.entries(e.tags).entries())t[`Tags.member.${i+1}.Key`]=s,t[`Tags.member.${i+1}.Value`]=a;let n=await this.request("UpdateStack",t);return(n?.UpdateStackResult||n?.UpdateStackResponse?.UpdateStackResult||n)?.StackId}async deleteStack(e){await this.request("DeleteStack",{StackName:e})}async describeStack(e){let t=await this.request("DescribeStacks",{StackName:e}),r=(t?.DescribeStacksResult||t?.DescribeStacksResponse?.DescribeStacksResult||t)?.Stacks?.member,i=Array.isArray(r)?r[0]:r;if(!i)throw Error(`Stack ${e} not found`);return xo(i)}async listStacks(e){let t={};if(e)for(let[r,i]of e.entries())t[`StackStatusFilter.member.${r+1}`]=i;let n=await this.request("ListStacks",t);return ko(n)}async describeStackEvents(e){let t=await this.request("DescribeStackEvents",{StackName:e});return Mo(t)}async waitForStack(e,t,n){let s=0,a=null;while(s<360){s++;let o=await this.describeStack(e);if(n)try{let c=await this.describeStackEvents(e),l=[];if(a){for(let u of c){if(u.EventId===a)break;l.push(u)}l.reverse()}else if(c.length>0)l=[c[0]];for(let u of l)n(u);if(c.length>0)a=c[0].EventId}catch{}if(o.StackStatus&&t.includes(o.StackStatus))return o;if(o.StackStatus?.includes("FAILED")||o.StackStatus?.includes("ROLLBACK"))throw Error(`Stack reached failed state: ${o.StackStatus}
-Reason: ${o.StackStatusReason||"Unknown"}`);await new Promise((c)=>setTimeout(c,5000))}throw Error(`Timeout waiting for stack ${e} to complete`)}async waitForStackWithProgress(e,t,n){let i={"stack-create-complete":["CREATE_COMPLETE"],"stack-update-complete":["UPDATE_COMPLETE"],"stack-delete-complete":["DELETE_COMPLETE"]}[t];if(!i)throw Error(`Unknown waiter: ${t}`);return this.waitForStack(e,i,n)}async createChangeSet(e){let t={StackName:e.stackName,ChangeSetName:e.changeSetName,ChangeSetType:"UPDATE"};if(e.templateBody)t.TemplateBody=e.templateBody;else if(e.templateURL)t.TemplateURL=e.templateURL;if(e.parameters)for(let[r,[i,s]]of Object.entries(e.parameters).entries())t[`Parameters.member.${r+1}.ParameterKey`]=i,t[`Parameters.member.${r+1}.ParameterValue`]=s;if(e.capabilities)for(let[r,i]of e.capabilities.entries())t[`Capabilities.member.${r+1}`]=i;return(await this.request("CreateChangeSet",t)).ChangeSetId}async executeChangeSet(e,t){await this.request("ExecuteChangeSet",{ChangeSetName:e,StackName:t})}async describeStacks(e){let t=typeof e==="string"?e:e.stackName;try{return{Stacks:[await this.describeStack(t)]}}catch{return{Stacks:[]}}}async getStackOutputs(e){let t=await this.request("DescribeStacks",{StackName:e}),r=(t?.DescribeStacksResult||t?.DescribeStacksResponse?.DescribeStacksResult||t)?.Stacks?.member,i=Array.isArray(r)?r[0]:r;if(!i)return{};let s={},a=i.Outputs?.member;if(a){let o=Array.isArray(a)?a:[a];for(let c of o)if(c.OutputKey&&c.OutputValue)s[c.OutputKey]=c.OutputValue}return s}}function tn(e,t=""){let n={};for(let[r,i]of Object.entries(e)){let s=t?`${t}.${r}`:r;if(Array.isArray(i))i.forEach((a,o)=>{if(typeof a==="object")Object.assign(n,tn(a,`${s}.${o+1}`));else n[`${s}.${o+1}`]=String(a)});else if(typeof i==="object"&&i!==null)Object.assign(n,tn(i,s));else if(i!==void 0&&i!==null)n[s]=String(i)}return n}function No(e){e=e.replace(/<\?xml[^?]*\?>\s*/,"").trim();function t(i,s,a){let o=1,c=a,l=`<${s}`,u=`</${s}>`;while(c<i.length&&o>0){let m=i.indexOf(l,c),p=i.indexOf(u,c);if(p===-1)return-1;if(m!==-1&&m<p){let g=i[m+l.length];if(g===">"||g===" "||g==="/"){let y=i.indexOf(">",m);if(y!==-1&&i[y-1]==="/")c=y+1;else o++,c=y+1}else c=m+l.length}else{if(o--,o===0)return p;c=p+u.length}}return-1}function n(i,s){while(s<i.length&&/\s/.test(i[s]))s++;if(s>=i.length||i[s]!=="<"){let h=i.indexOf("<",s);if(h===-1)return{value:i.slice(s).trim(),end:i.length};return{value:i.slice(s,h).trim(),end:h}}if(i[s+1]==="/")return{value:void 0,end:s};let a=i.slice(s).match(/^<(\w+)([^>]*?)\/?>/);if(!a)return{value:void 0,end:s+1};let o=a[1];if(a[0].endsWith("/>"))return{value:"",end:s+a[0].length};let l=s+a[0].length,u=`</${o}>`,m=t(i,o,l);if(m===-1)return{value:void 0,end:s+a[0].length};let p=i.slice(l,m).trim();if(!p.includes("<"))return{value:p,end:m+u.length};let g={},y=l;while(y<m){while(y<m&&/\s/.test(i[y]))y++;if(y>=m)break;if(i[y]!=="<"||i[y+1]==="/")break;let h=i.slice(y).match(/^<(\w+)/);if(!h)break;let b=h[1],C=n(i,y);if(C.value===void 0){y++;continue}if(b==="member"||g[b]!==void 0){if(!Array.isArray(g[b]))g[b]=g[b]!==void 0?[g[b]]:[];g[b].push(C.value)}else g[b]=C.value;y=C.end}return{value:g,end:m+u.length}}return n(e,0).value||{}}function xo(e){return{StackName:e.StackName||"",StackId:e.StackId,StackStatus:e.StackStatus,CreationTime:e.CreationTime,LastUpdatedTime:e.LastUpdatedTime,StackStatusReason:e.StackStatusReason,Description:e.Description}}function ko(e){let n=(e?.ListStacksResult||e?.ListStacksResponse?.ListStacksResult||e)?.StackSummaries?.member;if(!n)return[];return(Array.isArray(n)?n:[n]).map((i)=>({StackName:i.StackName||"",StackId:i.StackId,StackStatus:i.StackStatus,CreationTime:i.CreationTime,LastUpdatedTime:i.LastUpdatedTime,StackStatusReason:i.StackStatusReason,Description:i.Description}))}function Mo(e){let n=(e?.DescribeStackEventsResult||e?.DescribeStackEventsResponse?.DescribeStackEventsResult||e)?.StackEvents?.member;if(!n)return[];return(Array.isArray(n)?n:[n]).map((i)=>({StackId:i.StackId||"",EventId:i.EventId||"",StackName:i.StackName||"",LogicalResourceId:i.LogicalResourceId||"",PhysicalResourceId:i.PhysicalResourceId,ResourceType:i.ResourceType||"",Timestamp:i.Timestamp||"",ResourceStatus:i.ResourceStatus||"",ResourceStatusReason:i.ResourceStatusReason}))}await He();var Lo=5242880,nn=5242880;var Oo=5242880;class rn{region;endpoint;forcePathStyle;credentials;credentialOptions;retryOptions;constructor(e={}){this.region=e.region||process.env.AWS_REGION||"us-east-1",this.endpoint=e.endpoint||`https://s3.${this.region}.amazonaws.com`,this.forcePathStyle=e.forcePathStyle||!1,this.credentials=e.credentials,this.credentialOptions=e.credentialOptions,this.retryOptions=e.retryOptions||{}}async getCredentials(){if(this.credentials)return this.credentials;return lt(this.credentialOptions)}buildUrl(e,t){let n=t?encodeURIComponent(t).replace(/%2F/g,"/"):"";if(this.forcePathStyle)return t?`${this.endpoint}/${e}/${n}`:`${this.endpoint}/${e}`;let r=new URL(this.endpoint);return r.hostname=`${e}.${r.hostname}`,t?`${r.origin}/${n}`:r.origin}async get(e,t,n={}){let r=await this.getCredentials(),i=this.buildUrl(e,t),s={};if(n.range)s.Range=n.range;if(n.ifModifiedSince)s["If-Modified-Since"]=n.ifModifiedSince.toUTCString();if(n.ifMatch)s["If-Match"]=n.ifMatch;if(n.ifNoneMatch)s["If-None-Match"]=n.ifNoneMatch;let a=new URL(i);if(n.responseContentType)a.searchParams.set("response-content-type",n.responseContentType);if(n.responseContentDisposition)a.searchParams.set("response-content-disposition",n.responseContentDisposition);let o=H({method:"GET",url:a.toString(),headers:s,...r,service:"s3",region:this.region}),c=await fetch(o.url,{method:o.method,headers:o.headers});if(!c.ok&&c.status!==304){let l=await c.text();throw new z(`Failed to get object: ${l}`,c.status,e,t)}return c}async getText(e,t,n={}){return(await this.get(e,t,n)).text()}async getJSON(e,t,n={}){return(await this.get(e,t,n)).json()}async getBuffer(e,t,n={}){return(await this.get(e,t,n)).arrayBuffer()}async put(e,t,n,r={}){let i,s;if(typeof n==="string")i=new TextEncoder().encode(n).length,s=n;else if(n instanceof ArrayBuffer)i=n.byteLength,s=n;else if(n instanceof Uint8Array)i=n.byteLength,s=n;else if(n instanceof Blob)i=n.size,s=n;else return this.uploadMultipart(e,t,n,{...r,partSize:nn});if(i>Oo){let a=Fo(s).stream();return this.uploadMultipart(e,t,a,{...r,partSize:nn})}return this.putSimple(e,t,s,i,r)}async putSimple(e,t,n,r,i){let s=await this.getCredentials(),a=this.buildUrl(e,t),o={"Content-Length":String(r),"Content-Type":i.contentType||Xr(t)};if(i.contentEncoding)o["Content-Encoding"]=i.contentEncoding;if(i.cacheControl)o["Cache-Control"]=i.cacheControl;if(i.contentDisposition)o["Content-Disposition"]=i.contentDisposition;if(i.storageClass)o["x-amz-storage-class"]=i.storageClass;if(i.serverSideEncryption)o["x-amz-server-side-encryption"]=i.serverSideEncryption;if(i.acl)o["x-amz-acl"]=i.acl;if(i.tagging)o["x-amz-tagging"]=i.tagging;if(i.metadata)for(let[p,g]of Object.entries(i.metadata))o[`x-amz-meta-${p.toLowerCase()}`]=g;let c;if(typeof n==="string")c=n;else if(n instanceof Blob)c=await n.text();else c=new TextDecoder().decode(n instanceof ArrayBuffer?new Uint8Array(n):n);let l=H({method:"PUT",url:a,headers:o,body:c,...s,service:"s3",region:this.region}),u=await fetch(l.url,{method:l.method,headers:l.headers,body:n});if(!u.ok){let p=await u.text();throw new z(`Failed to put object: ${p}`,u.status,e,t)}return{etag:(u.headers.get("ETag")||"").replace(/"/g,"")}}async delete(e,t){let n=await this.getCredentials(),r=this.buildUrl(e,t),i=H({method:"DELETE",url:r,...n,service:"s3",region:this.region}),s=await fetch(i.url,{method:i.method,headers:i.headers});if(!s.ok&&s.status!==204){let a=await s.text();throw new z(`Failed to delete object: ${a}`,s.status,e,t)}}async deleteMany(e,t){let n=await this.getCredentials(),r=`${this.buildUrl(e)}?delete`,s=`<?xml version="1.0" encoding="UTF-8"?><Delete><Quiet>false</Quiet>${t.map((y)=>`<Object><Key>${Bo(y)}</Key></Object>`).join("")}</Delete>`,a=H({method:"POST",url:r,headers:{"Content-Type":"application/xml"},body:s,...n,service:"s3",region:this.region}),o=await fetch(a.url,{method:a.method,headers:a.headers,body:s});if(!o.ok){let y=await o.text();throw new z(`Failed to delete objects: ${y}`,o.status,e)}let c=await o.text(),l=[],u=[],m=/<Deleted><Key>([^<]+)<\/Key>/g,p;while((p=m.exec(c))!==null)l.push(p[1]);let g=/<Error><Key>([^<]+)<\/Key><Code>([^<]+)<\/Code><Message>([^<]+)<\/Message>/g;while((p=g.exec(c))!==null)u.push({key:p[1],error:`${p[2]}: ${p[3]}`});return{deleted:l,errors:u}}async list(e,t={}){let n=await this.getCredentials(),r=new URL(this.buildUrl(e));if(r.searchParams.set("list-type","2"),t.prefix)r.searchParams.set("prefix",t.prefix);if(t.delimiter)r.searchParams.set("delimiter",t.delimiter);if(t.maxKeys)r.searchParams.set("max-keys",String(t.maxKeys));if(t.continuationToken)r.searchParams.set("continuation-token",t.continuationToken);if(t.startAfter)r.searchParams.set("start-after",t.startAfter);let i=H({method:"GET",url:r.toString(),...n,service:"s3",region:this.region}),s=await fetch(i.url,{method:i.method,headers:i.headers});if(!s.ok){let o=await s.text();throw new z(`Failed to list objects: ${o}`,s.status,e)}let a=await s.text();return $o(a)}async*listAll(e,t={}){let n;do{let r=await this.list(e,{...t,continuationToken:n});for(let i of r.contents)yield i;n=r.nextContinuationToken}while(n)}async head(e,t){let n=await this.getCredentials(),r=this.buildUrl(e,t),i=H({method:"HEAD",url:r,...n,service:"s3",region:this.region}),s=await fetch(i.url,{method:i.method,headers:i.headers});if(s.status===404)return null;if(!s.ok){let o=await s.text();throw new z(`Failed to head object: ${o}`,s.status,e,t)}let a={};return s.headers.forEach((o,c)=>{if(c.toLowerCase().startsWith("x-amz-meta-"))a[c.slice(11)]=o}),{contentLength:Number(s.headers.get("Content-Length")||0),contentType:s.headers.get("Content-Type")||"application/octet-stream",etag:(s.headers.get("ETag")||"").replace(/"/g,""),lastModified:new Date(s.headers.get("Last-Modified")||0),metadata:a,storageClass:s.headers.get("x-amz-storage-class")||void 0,serverSideEncryption:s.headers.get("x-amz-server-side-encryption")||void 0}}async exists(e,t){return await this.head(e,t)!==null}async copy(e,t,n,r,i={}){let s=await this.getCredentials(),a=this.buildUrl(n,r),o={"x-amz-copy-source":`/${e}/${encodeURIComponent(t)}`};if(i.metadataDirective)o["x-amz-metadata-directive"]=i.metadataDirective;if(i.contentType)o["Content-Type"]=i.contentType;if(i.storageClass)o["x-amz-storage-class"]=i.storageClass;if(i.acl)o["x-amz-acl"]=i.acl;if(i.metadata)for(let[g,y]of Object.entries(i.metadata))o[`x-amz-meta-${g.toLowerCase()}`]=y;let c=H({method:"PUT",url:a,headers:o,...s,service:"s3",region:this.region}),l=await fetch(c.url,{method:c.method,headers:c.headers});if(!l.ok){let g=await l.text();throw new z(`Failed to copy object: ${g}`,l.status,n,r)}let m=(await l.text()).match(/<ETag>"?([^"<]+)"?<\/ETag>/);return{etag:m?m[1]:""}}async getPresignedUrl(e,t,n={}){let r=await this.getCredentials(),i=this.buildUrl(e,t);return Vr({url:i,method:n.method||"GET",expiresIn:n.expiresIn||3600,...r,service:"s3",region:this.region})}async uploadMultipart(e,t,n,r={}){let i=await this.getCredentials(),s=Math.max(r.partSize||nn,Lo),a,o;if(n instanceof ReadableStream)a=n;else if(n instanceof Blob)a=n.stream(),o=n.size;else{let u=new Blob([n]);a=u.stream(),o=u.size}let{uploadId:c,baseUrl:l}=await this.initiateMultipartUpload(e,t,r);try{let u=await this.uploadParts(e,t,l,c,a,s,i,o,r.concurrency||4,r.onProgress);return await this.completeMultipartUpload(e,t,l,c,u)}catch(u){throw await this.abortMultipartUpload(e,t,c,l).catch(()=>{}),u}}async initiateMultipartUpload(e,t,n){let r=await this.getCredentials(),i=this.buildUrl(e,t),s=`${i}?uploads`,a={"Content-Type":n.contentType||Xr(t)};if(n.storageClass)a["x-amz-storage-class"]=n.storageClass;if(n.serverSideEncryption)a["x-amz-server-side-encryption"]=n.serverSideEncryption;if(n.acl)a["x-amz-acl"]=n.acl;if(n.metadata)for(let[p,g]of Object.entries(n.metadata))a[`x-amz-meta-${p.toLowerCase()}`]=g;let o=H({method:"POST",url:s,headers:a,...r,service:"s3",region:this.region}),c=await fetch(o.url,{method:o.method,headers:o.headers});if(!c.ok){let p=await c.text();throw new z(`Failed to initiate multipart upload: ${p}`,c.status,e,t)}let u=(await c.text()).match(/<UploadId>([^<]+)<\/UploadId>/);if(!u)throw new z("Failed to parse upload ID from response",0,e,t);let m=i;if(c.url)try{let p=new URL(c.url);p.search="",m=p.toString()}catch{}return{uploadId:u[1],baseUrl:m}}async uploadParts(e,t,n,r,i,s,a,o,c,l){let u=[],m=i.getReader(),p=1,g=new Uint8Array(0),y=0,h=o?Math.ceil(o/s):void 0,b=new Map,C=async(A,R)=>{let P=`${n}?partNumber=${R}&uploadId=${encodeURIComponent(r)}`,E={"Content-Length":String(A.byteLength),"x-amz-content-sha256":"UNSIGNED-PAYLOAD"},w=H({method:"PUT",url:P,headers:E,...a,service:"s3",region:this.region}),I=await fetch(w.url,{method:w.method,headers:w.headers,body:A,redirect:"error"});if(!I.ok){let k=await I.text();throw new z(`Failed to upload part ${R}: ${k}`,I.status,e,t)}let D=(I.headers.get("ETag")||"").replace(/"/g,"");if(!D)throw new z(`Missing ETag for part ${R}`,I.status,e,t);return{partNumber:R,etag:D}},T=async()=>{let A=await Promise.race(b.values());b.delete(A.partNumber),u.push(A)};while(!0){let{done:A,value:R}=await m.read();if(R){let P=new Uint8Array(g.length+R.length);P.set(g),P.set(R,g.length),g=P}while(g.length>=s||A&&g.length>0){let P=g.slice(0,s);g=g.slice(s);let E=p++;if(b.size>=c)await T();if(b.set(E,C(P,E)),y+=P.byteLength,l)l({loaded:y,total:o||y,part:E,totalParts:h||E})}if(A)break}while(b.size>0)await T();return u.sort((A,R)=>A.partNumber-R.partNumber),u}async completeMultipartUpload(e,t,n,r,i){let s=await this.getCredentials(),a=`${n}?uploadId=${encodeURIComponent(r)}`,c=`<?xml version="1.0" encoding="UTF-8"?><CompleteMultipartUpload>${i.map((y)=>`<Part><PartNumber>${y.partNumber}</PartNumber><ETag>"${y.etag}"</ETag></Part>`).join("")}</CompleteMultipartUpload>`,l=H({method:"POST",url:a,headers:{"Content-Type":"application/xml"},body:c,...s,service:"s3",region:this.region}),u=await fetch(l.url,{method:l.method,headers:l.headers,body:c});if(!u.ok){let y=await u.text();throw new z(`Failed to complete multipart upload: ${y}`,u.status,e,t)}let p=(await u.text()).match(/<ETag>"?([^"<]+)"?<\/ETag>/);return{etag:p?p[1]:""}}async abortMultipartUpload(e,t,n,r){let i=await this.getCredentials(),s=`${r??this.buildUrl(e,t)}?uploadId=${encodeURIComponent(n)}`,a=H({method:"DELETE",url:s,...i,service:"s3",region:this.region});await fetch(a.url,{method:a.method,headers:a.headers})}async emptyAndDeleteBucket(e){let n=[];for await(let a of this.listAll(e,{}))if(n.push(a.key),n.length>=1000)await this.deleteMany(e,n),n=[];if(n.length>0)await this.deleteMany(e,n);let r=await this.getCredentials(),i=this.buildUrl(e),s=H({method:"DELETE",url:i,...r,service:"s3",region:this.region});await fetch(s.url,{method:s.method,headers:s.headers})}}class z extends Error{statusCode;bucket;key;constructor(e,t,n,r){super(e);this.statusCode=t;this.bucket=n;this.key=r;this.name="S3Error"}}function $o(e){let t=[],n=[],r=/<Contents>([\s\S]*?)<\/Contents>/g,i;while((i=r.exec(e))!==null){let a=i[1];t.push({key:ie(a,"Key")||"",lastModified:new Date(ie(a,"LastModified")||0),etag:(ie(a,"ETag")||"").replace(/"/g,""),size:Number(ie(a,"Size")||0),storageClass:ie(a,"StorageClass")||"STANDARD"})}let s=/<CommonPrefixes><Prefix>([^<]+)<\/Prefix><\/CommonPrefixes>/g;while((i=s.exec(e))!==null)n.push(i[1]);return{contents:t,commonPrefixes:n,isTruncated:ie(e,"IsTruncated")==="true",continuationToken:ie(e,"ContinuationToken")||void 0,nextContinuationToken:ie(e,"NextContinuationToken")||void 0,keyCount:Number(ie(e,"KeyCount")||0),maxKeys:Number(ie(e,"MaxKeys")||1000),prefix:ie(e,"Prefix")||void 0,delimiter:ie(e,"Delimiter")||void 0}}function ie(e,t){let n=new RegExp(`<${t}>([^<]*)</${t}>`),r=e.match(n);return r?r[1]:null}function Bo(e){return e.replace(/&/g,"&amp;").replace(/</g,"&lt;").replace(/>/g,"&gt;").replace(/"/g,"&quot;").replace(/'/g,"&apos;")}function Xr(e){let t=e.split(".").pop()?.toLowerCase();return{html:"text/html",htm:"text/html",css:"text/css",js:"application/javascript",mjs:"application/javascript",json:"application/json",xml:"application/xml",txt:"text/plain",md:"text/markdown",csv:"text/csv",jpg:"image/jpeg",jpeg:"image/jpeg",png:"image/png",gif:"image/gif",webp:"image/webp",svg:"image/svg+xml",ico:"image/x-icon",avif:"image/avif",mp4:"video/mp4",webm:"video/webm",mov:"video/quicktime",avi:"video/x-msvideo",mp3:"audio/mpeg",wav:"audio/wav",ogg:"audio/ogg",pdf:"application/pdf",doc:"application/msword",docx:"application/vnd.openxmlformats-officedocument.wordprocessingml.document",xls:"application/vnd.ms-excel",xlsx:"application/vnd.openxmlformats-officedocument.spreadsheetml.sheet",ppt:"application/vnd.ms-powerpoint",pptx:"application/vnd.openxmlformats-officedocument.presentationml.presentation",zip:"application/zip",gz:"application/gzip",tar:"application/x-tar",rar:"application/vnd.rar","7z":"application/x-7z-compressed",woff:"font/woff",woff2:"font/woff2",ttf:"font/ttf",otf:"font/otf",eot:"application/vnd.ms-fontobject",wasm:"application/wasm"}[t||""]||"application/octet-stream"}function Fo(e){if(e instanceof Blob)return e;if(typeof e==="string")return new Blob([e],{type:"text/plain"});return new Blob([e])}function Go(e){return new rn(e)}await He();class _o{profile;credentials=null;constructor(e="default"){this.profile=e}async init(){this.credentials=await je(this.profile)}async ensureCredentials(){if(!this.credentials)await this.init();return this.credentials}async createInvalidation(e){let t=await this.ensureCredentials(),n=e.callerReference||`invalidation-${Date.now()}`,r=`<?xml version="1.0" encoding="UTF-8"?>
+`),o=!1;for(let c of a){let l=c.trim();if(l.startsWith("[")){o=l===s;continue}if(o&&l.startsWith("region")){let[,u]=l.split("=");if(u)return u.trim()}}}catch{}return"us-east-1"}async function Zr(e){let t=e||await lt(),n=Io();await He();let i=n.startsWith("us-gov")?`https://sts.${n}.amazonaws.com`:n==="us-east-1"?"https://sts.amazonaws.com":`https://sts.${n}.amazonaws.com`,s="Action=GetCallerIdentity&Version=2011-06-15",a=j({method:"POST",url:i,body:"Action=GetCallerIdentity&Version=2011-06-15",headers:{"Content-Type":"application/x-www-form-urlencoded"},...t,service:"sts",region:n}),o=await fetch(a.url,{method:a.method,headers:a.headers,body:a.body});if(!o.ok)throw Error(`Failed to get account ID: ${await o.text()}`);let c=await o.text(),l=ot(c,"Account");if(!l)throw Error("Failed to parse account ID from response");return l}await He();class Do{profile;credentials=null;region;constructor(e="us-east-1",t="default"){this.profile=t;this.region=e}async init(){if(this.credentials=await je(this.profile),this.credentials.region)this.region=this.credentials.region}async ensureCredentials(){if(!this.credentials)await this.init();return this.credentials}async request(e,t){let n=await this.ensureCredentials(),r={Action:e,Version:"2010-05-15",...tn(t)},i=new URLSearchParams(r).toString(),a=await(await Ne({method:"POST",url:`https://cloudformation.${this.region}.amazonaws.com/`,service:"cloudformation",region:this.region,headers:{"Content-Type":"application/x-www-form-urlencoded"},body:i,accessKeyId:n.accessKeyId,secretAccessKey:n.secretAccessKey,sessionToken:n.sessionToken})).text();return No(a)}async createStack(e){let t={StackName:e.stackName};if(e.templateBody)t.TemplateBody=e.templateBody;else if(e.templateURL)t.TemplateURL=e.templateURL;else throw Error("Either templateBody or templateURL must be provided");if(e.parameters)for(let[i,[s,a]]of Object.entries(e.parameters).entries())t[`Parameters.member.${i+1}.ParameterKey`]=s,t[`Parameters.member.${i+1}.ParameterValue`]=a;if(e.capabilities)for(let[i,s]of e.capabilities.entries())t[`Capabilities.member.${i+1}`]=s;if(e.tags)for(let[i,[s,a]]of Object.entries(e.tags).entries())t[`Tags.member.${i+1}.Key`]=s,t[`Tags.member.${i+1}.Value`]=a;if(e.timeoutInMinutes)t.TimeoutInMinutes=e.timeoutInMinutes;if(e.onFailure)t.OnFailure=e.onFailure;let n=await this.request("CreateStack",t);return(n?.CreateStackResult||n?.CreateStackResponse?.CreateStackResult||n)?.StackId}async updateStack(e){let t={StackName:e.stackName};if(e.templateBody)t.TemplateBody=e.templateBody;else if(e.templateURL)t.TemplateURL=e.templateURL;if(e.parameters)for(let[i,[s,a]]of Object.entries(e.parameters).entries())t[`Parameters.member.${i+1}.ParameterKey`]=s,t[`Parameters.member.${i+1}.ParameterValue`]=a;if(e.capabilities)for(let[i,s]of e.capabilities.entries())t[`Capabilities.member.${i+1}`]=s;if(e.tags)for(let[i,[s,a]]of Object.entries(e.tags).entries())t[`Tags.member.${i+1}.Key`]=s,t[`Tags.member.${i+1}.Value`]=a;let n=await this.request("UpdateStack",t);return(n?.UpdateStackResult||n?.UpdateStackResponse?.UpdateStackResult||n)?.StackId}async deleteStack(e){await this.request("DeleteStack",{StackName:e})}async describeStack(e){let t=await this.request("DescribeStacks",{StackName:e}),r=(t?.DescribeStacksResult||t?.DescribeStacksResponse?.DescribeStacksResult||t)?.Stacks?.member,i=Array.isArray(r)?r[0]:r;if(!i)throw Error(`Stack ${e} not found`);return xo(i)}async listStacks(e){let t={};if(e)for(let[r,i]of e.entries())t[`StackStatusFilter.member.${r+1}`]=i;let n=await this.request("ListStacks",t);return ko(n)}async describeStackEvents(e){let t=await this.request("DescribeStackEvents",{StackName:e});return Mo(t)}async waitForStack(e,t,n){let s=0,a=null;while(s<360){s++;let o=await this.describeStack(e);if(n)try{let c=await this.describeStackEvents(e),l=[];if(a){for(let u of c){if(u.EventId===a)break;l.push(u)}l.reverse()}else if(c.length>0)l=[c[0]];for(let u of l)n(u);if(c.length>0)a=c[0].EventId}catch{}if(o.StackStatus&&t.includes(o.StackStatus))return o;if(o.StackStatus?.includes("FAILED")||o.StackStatus?.includes("ROLLBACK"))throw Error(`Stack reached failed state: ${o.StackStatus}
+Reason: ${o.StackStatusReason||"Unknown"}`);await new Promise((c)=>setTimeout(c,5000))}throw Error(`Timeout waiting for stack ${e} to complete`)}async waitForStackWithProgress(e,t,n){let i={"stack-create-complete":["CREATE_COMPLETE"],"stack-update-complete":["UPDATE_COMPLETE"],"stack-delete-complete":["DELETE_COMPLETE"]}[t];if(!i)throw Error(`Unknown waiter: ${t}`);return this.waitForStack(e,i,n)}async createChangeSet(e){let t={StackName:e.stackName,ChangeSetName:e.changeSetName,ChangeSetType:"UPDATE"};if(e.templateBody)t.TemplateBody=e.templateBody;else if(e.templateURL)t.TemplateURL=e.templateURL;if(e.parameters)for(let[r,[i,s]]of Object.entries(e.parameters).entries())t[`Parameters.member.${r+1}.ParameterKey`]=i,t[`Parameters.member.${r+1}.ParameterValue`]=s;if(e.capabilities)for(let[r,i]of e.capabilities.entries())t[`Capabilities.member.${r+1}`]=i;return(await this.request("CreateChangeSet",t)).ChangeSetId}async executeChangeSet(e,t){await this.request("ExecuteChangeSet",{ChangeSetName:e,StackName:t})}async describeStacks(e){let t=typeof e==="string"?e:e.stackName;try{return{Stacks:[await this.describeStack(t)]}}catch{return{Stacks:[]}}}async getStackOutputs(e){let t=await this.request("DescribeStacks",{StackName:e}),r=(t?.DescribeStacksResult||t?.DescribeStacksResponse?.DescribeStacksResult||t)?.Stacks?.member,i=Array.isArray(r)?r[0]:r;if(!i)return{};let s={},a=i.Outputs?.member;if(a){let o=Array.isArray(a)?a:[a];for(let c of o)if(c.OutputKey&&c.OutputValue)s[c.OutputKey]=c.OutputValue}return s}}function tn(e,t=""){let n={};for(let[r,i]of Object.entries(e)){let s=t?`${t}.${r}`:r;if(Array.isArray(i))i.forEach((a,o)=>{if(typeof a==="object")Object.assign(n,tn(a,`${s}.${o+1}`));else n[`${s}.${o+1}`]=String(a)});else if(typeof i==="object"&&i!==null)Object.assign(n,tn(i,s));else if(i!==void 0&&i!==null)n[s]=String(i)}return n}function No(e){e=e.replace(/<\?xml[^?]*\?>\s*/,"").trim();function t(i,s,a){let o=1,c=a,l=`<${s}`,u=`</${s}>`;while(c<i.length&&o>0){let m=i.indexOf(l,c),p=i.indexOf(u,c);if(p===-1)return-1;if(m!==-1&&m<p){let g=i[m+l.length];if(g===">"||g===" "||g==="/"){let y=i.indexOf(">",m);if(y!==-1&&i[y-1]==="/")c=y+1;else o++,c=y+1}else c=m+l.length}else{if(o--,o===0)return p;c=p+u.length}}return-1}function n(i,s){while(s<i.length&&/\s/.test(i[s]))s++;if(s>=i.length||i[s]!=="<"){let h=i.indexOf("<",s);if(h===-1)return{value:i.slice(s).trim(),end:i.length};return{value:i.slice(s,h).trim(),end:h}}if(i[s+1]==="/")return{value:void 0,end:s};let a=i.slice(s).match(/^<(\w+)([^>]*?)\/?>/);if(!a)return{value:void 0,end:s+1};let o=a[1];if(a[0].endsWith("/>"))return{value:"",end:s+a[0].length};let l=s+a[0].length,u=`</${o}>`,m=t(i,o,l);if(m===-1)return{value:void 0,end:s+a[0].length};let p=i.slice(l,m).trim();if(!p.includes("<"))return{value:p,end:m+u.length};let g={},y=l;while(y<m){while(y<m&&/\s/.test(i[y]))y++;if(y>=m)break;if(i[y]!=="<"||i[y+1]==="/")break;let h=i.slice(y).match(/^<(\w+)/);if(!h)break;let b=h[1],C=n(i,y);if(C.value===void 0){y++;continue}if(b==="member"||g[b]!==void 0){if(!Array.isArray(g[b]))g[b]=g[b]!==void 0?[g[b]]:[];g[b].push(C.value)}else g[b]=C.value;y=C.end}return{value:g,end:m+u.length}}return n(e,0).value||{}}function xo(e){return{StackName:e.StackName||"",StackId:e.StackId,StackStatus:e.StackStatus,CreationTime:e.CreationTime,LastUpdatedTime:e.LastUpdatedTime,StackStatusReason:e.StackStatusReason,Description:e.Description}}function ko(e){let n=(e?.ListStacksResult||e?.ListStacksResponse?.ListStacksResult||e)?.StackSummaries?.member;if(!n)return[];return(Array.isArray(n)?n:[n]).map((i)=>({StackName:i.StackName||"",StackId:i.StackId,StackStatus:i.StackStatus,CreationTime:i.CreationTime,LastUpdatedTime:i.LastUpdatedTime,StackStatusReason:i.StackStatusReason,Description:i.Description}))}function Mo(e){let n=(e?.DescribeStackEventsResult||e?.DescribeStackEventsResponse?.DescribeStackEventsResult||e)?.StackEvents?.member;if(!n)return[];return(Array.isArray(n)?n:[n]).map((i)=>({StackId:i.StackId||"",EventId:i.EventId||"",StackName:i.StackName||"",LogicalResourceId:i.LogicalResourceId||"",PhysicalResourceId:i.PhysicalResourceId,ResourceType:i.ResourceType||"",Timestamp:i.Timestamp||"",ResourceStatus:i.ResourceStatus||"",ResourceStatusReason:i.ResourceStatusReason}))}await He();var Lo=5242880,nn=5242880;var Oo=5242880;class rn{region;endpoint;forcePathStyle;credentials;credentialOptions;retryOptions;constructor(e={}){this.region=e.region||process.env.AWS_REGION||"us-east-1",this.endpoint=e.endpoint||`https://s3.${this.region}.amazonaws.com`,this.forcePathStyle=e.forcePathStyle||!1,this.credentials=e.credentials,this.credentialOptions=e.credentialOptions,this.retryOptions=e.retryOptions||{}}async getCredentials(){if(this.credentials)return this.credentials;return lt(this.credentialOptions)}buildUrl(e,t){let n=t?encodeURIComponent(t).replace(/%2F/g,"/"):"";if(this.forcePathStyle)return t?`${this.endpoint}/${e}/${n}`:`${this.endpoint}/${e}`;let r=new URL(this.endpoint);return r.hostname=`${e}.${r.hostname}`,t?`${r.origin}/${n}`:r.origin}async get(e,t,n={}){let r=await this.getCredentials(),i=this.buildUrl(e,t),s={};if(n.range)s.Range=n.range;if(n.ifModifiedSince)s["If-Modified-Since"]=n.ifModifiedSince.toUTCString();if(n.ifMatch)s["If-Match"]=n.ifMatch;if(n.ifNoneMatch)s["If-None-Match"]=n.ifNoneMatch;let a=new URL(i);if(n.responseContentType)a.searchParams.set("response-content-type",n.responseContentType);if(n.responseContentDisposition)a.searchParams.set("response-content-disposition",n.responseContentDisposition);let o=j({method:"GET",url:a.toString(),headers:s,...r,service:"s3",region:this.region}),c=await fetch(o.url,{method:o.method,headers:o.headers});if(!c.ok&&c.status!==304){let l=await c.text();throw new z(`Failed to get object: ${l}`,c.status,e,t)}return c}async getText(e,t,n={}){return(await this.get(e,t,n)).text()}async getJSON(e,t,n={}){return(await this.get(e,t,n)).json()}async getBuffer(e,t,n={}){return(await this.get(e,t,n)).arrayBuffer()}async put(e,t,n,r={}){let i,s;if(typeof n==="string")i=new TextEncoder().encode(n).length,s=n;else if(n instanceof ArrayBuffer)i=n.byteLength,s=n;else if(n instanceof Uint8Array)i=n.byteLength,s=n;else if(n instanceof Blob)i=n.size,s=n;else return this.uploadMultipart(e,t,n,{...r,partSize:nn});if(i>Oo){let a=Fo(s).stream();return this.uploadMultipart(e,t,a,{...r,partSize:nn})}return this.putSimple(e,t,s,i,r)}async putSimple(e,t,n,r,i){let s=await this.getCredentials(),a=this.buildUrl(e,t),o={"Content-Length":String(r),"Content-Type":i.contentType||Xr(t)};if(i.contentEncoding)o["Content-Encoding"]=i.contentEncoding;if(i.cacheControl)o["Cache-Control"]=i.cacheControl;if(i.contentDisposition)o["Content-Disposition"]=i.contentDisposition;if(i.storageClass)o["x-amz-storage-class"]=i.storageClass;if(i.serverSideEncryption)o["x-amz-server-side-encryption"]=i.serverSideEncryption;if(i.acl)o["x-amz-acl"]=i.acl;if(i.tagging)o["x-amz-tagging"]=i.tagging;if(i.metadata)for(let[p,g]of Object.entries(i.metadata))o[`x-amz-meta-${p.toLowerCase()}`]=g;let c;if(typeof n==="string")c=n;else if(n instanceof Blob)c=await n.text();else c=new TextDecoder().decode(n instanceof ArrayBuffer?new Uint8Array(n):n);let l=j({method:"PUT",url:a,headers:o,body:c,...s,service:"s3",region:this.region}),u=await fetch(l.url,{method:l.method,headers:l.headers,body:n});if(!u.ok){let p=await u.text();throw new z(`Failed to put object: ${p}`,u.status,e,t)}return{etag:(u.headers.get("ETag")||"").replace(/"/g,"")}}async delete(e,t){let n=await this.getCredentials(),r=this.buildUrl(e,t),i=j({method:"DELETE",url:r,...n,service:"s3",region:this.region}),s=await fetch(i.url,{method:i.method,headers:i.headers});if(!s.ok&&s.status!==204){let a=await s.text();throw new z(`Failed to delete object: ${a}`,s.status,e,t)}}async deleteMany(e,t){let n=await this.getCredentials(),r=`${this.buildUrl(e)}?delete`,s=`<?xml version="1.0" encoding="UTF-8"?><Delete><Quiet>false</Quiet>${t.map((y)=>`<Object><Key>${Bo(y)}</Key></Object>`).join("")}</Delete>`,a=j({method:"POST",url:r,headers:{"Content-Type":"application/xml"},body:s,...n,service:"s3",region:this.region}),o=await fetch(a.url,{method:a.method,headers:a.headers,body:s});if(!o.ok){let y=await o.text();throw new z(`Failed to delete objects: ${y}`,o.status,e)}let c=await o.text(),l=[],u=[],m=/<Deleted><Key>([^<]+)<\/Key>/g,p;while((p=m.exec(c))!==null)l.push(p[1]);let g=/<Error><Key>([^<]+)<\/Key><Code>([^<]+)<\/Code><Message>([^<]+)<\/Message>/g;while((p=g.exec(c))!==null)u.push({key:p[1],error:`${p[2]}: ${p[3]}`});return{deleted:l,errors:u}}async list(e,t={}){let n=await this.getCredentials(),r=new URL(this.buildUrl(e));if(r.searchParams.set("list-type","2"),t.prefix)r.searchParams.set("prefix",t.prefix);if(t.delimiter)r.searchParams.set("delimiter",t.delimiter);if(t.maxKeys)r.searchParams.set("max-keys",String(t.maxKeys));if(t.continuationToken)r.searchParams.set("continuation-token",t.continuationToken);if(t.startAfter)r.searchParams.set("start-after",t.startAfter);let i=j({method:"GET",url:r.toString(),...n,service:"s3",region:this.region}),s=await fetch(i.url,{method:i.method,headers:i.headers});if(!s.ok){let o=await s.text();throw new z(`Failed to list objects: ${o}`,s.status,e)}let a=await s.text();return $o(a)}async*listAll(e,t={}){let n;do{let r=await this.list(e,{...t,continuationToken:n});for(let i of r.contents)yield i;n=r.nextContinuationToken}while(n)}async head(e,t){let n=await this.getCredentials(),r=this.buildUrl(e,t),i=j({method:"HEAD",url:r,...n,service:"s3",region:this.region}),s=await fetch(i.url,{method:i.method,headers:i.headers});if(s.status===404)return null;if(!s.ok){let o=await s.text();throw new z(`Failed to head object: ${o}`,s.status,e,t)}let a={};return s.headers.forEach((o,c)=>{if(c.toLowerCase().startsWith("x-amz-meta-"))a[c.slice(11)]=o}),{contentLength:Number(s.headers.get("Content-Length")||0),contentType:s.headers.get("Content-Type")||"application/octet-stream",etag:(s.headers.get("ETag")||"").replace(/"/g,""),lastModified:new Date(s.headers.get("Last-Modified")||0),metadata:a,storageClass:s.headers.get("x-amz-storage-class")||void 0,serverSideEncryption:s.headers.get("x-amz-server-side-encryption")||void 0}}async exists(e,t){return await this.head(e,t)!==null}async copy(e,t,n,r,i={}){let s=await this.getCredentials(),a=this.buildUrl(n,r),o={"x-amz-copy-source":`/${e}/${encodeURIComponent(t)}`};if(i.metadataDirective)o["x-amz-metadata-directive"]=i.metadataDirective;if(i.contentType)o["Content-Type"]=i.contentType;if(i.storageClass)o["x-amz-storage-class"]=i.storageClass;if(i.acl)o["x-amz-acl"]=i.acl;if(i.metadata)for(let[g,y]of Object.entries(i.metadata))o[`x-amz-meta-${g.toLowerCase()}`]=y;let c=j({method:"PUT",url:a,headers:o,...s,service:"s3",region:this.region}),l=await fetch(c.url,{method:c.method,headers:c.headers});if(!l.ok){let g=await l.text();throw new z(`Failed to copy object: ${g}`,l.status,n,r)}let m=(await l.text()).match(/<ETag>"?([^"<]+)"?<\/ETag>/);return{etag:m?m[1]:""}}async getPresignedUrl(e,t,n={}){let r=await this.getCredentials(),i=this.buildUrl(e,t);return Vr({url:i,method:n.method||"GET",expiresIn:n.expiresIn||3600,...r,service:"s3",region:this.region})}async uploadMultipart(e,t,n,r={}){let i=await this.getCredentials(),s=Math.max(r.partSize||nn,Lo),a,o;if(n instanceof ReadableStream)a=n;else if(n instanceof Blob)a=n.stream(),o=n.size;else{let u=new Blob([n]);a=u.stream(),o=u.size}let{uploadId:c,baseUrl:l}=await this.initiateMultipartUpload(e,t,r);try{let u=await this.uploadParts(e,t,l,c,a,s,i,o,r.concurrency||4,r.onProgress);return await this.completeMultipartUpload(e,t,l,c,u)}catch(u){throw await this.abortMultipartUpload(e,t,c,l).catch(()=>{}),u}}async initiateMultipartUpload(e,t,n){let r=await this.getCredentials(),i=this.buildUrl(e,t),s=`${i}?uploads`,a={"Content-Type":n.contentType||Xr(t)};if(n.storageClass)a["x-amz-storage-class"]=n.storageClass;if(n.serverSideEncryption)a["x-amz-server-side-encryption"]=n.serverSideEncryption;if(n.acl)a["x-amz-acl"]=n.acl;if(n.metadata)for(let[p,g]of Object.entries(n.metadata))a[`x-amz-meta-${p.toLowerCase()}`]=g;let o=j({method:"POST",url:s,headers:a,...r,service:"s3",region:this.region}),c=await fetch(o.url,{method:o.method,headers:o.headers});if(!c.ok){let p=await c.text();throw new z(`Failed to initiate multipart upload: ${p}`,c.status,e,t)}let u=(await c.text()).match(/<UploadId>([^<]+)<\/UploadId>/);if(!u)throw new z("Failed to parse upload ID from response",0,e,t);let m=i;if(c.url)try{let p=new URL(c.url);p.search="",m=p.toString()}catch{}return{uploadId:u[1],baseUrl:m}}async uploadParts(e,t,n,r,i,s,a,o,c,l){let u=[],m=i.getReader(),p=1,g=new Uint8Array(0),y=0,h=o?Math.ceil(o/s):void 0,b=new Map,C=async(A,R)=>{let P=`${n}?partNumber=${R}&uploadId=${encodeURIComponent(r)}`,E={"Content-Length":String(A.byteLength),"x-amz-content-sha256":"UNSIGNED-PAYLOAD"},w=j({method:"PUT",url:P,headers:E,...a,service:"s3",region:this.region}),I=await fetch(w.url,{method:w.method,headers:w.headers,body:A,redirect:"error"});if(!I.ok){let k=await I.text();throw new z(`Failed to upload part ${R}: ${k}`,I.status,e,t)}let D=(I.headers.get("ETag")||"").replace(/"/g,"");if(!D)throw new z(`Missing ETag for part ${R}`,I.status,e,t);return{partNumber:R,etag:D}},T=async()=>{let A=await Promise.race(b.values());b.delete(A.partNumber),u.push(A)};while(!0){let{done:A,value:R}=await m.read();if(R){let P=new Uint8Array(g.length+R.length);P.set(g),P.set(R,g.length),g=P}while(g.length>=s||A&&g.length>0){let P=g.slice(0,s);g=g.slice(s);let E=p++;if(b.size>=c)await T();if(b.set(E,C(P,E)),y+=P.byteLength,l)l({loaded:y,total:o||y,part:E,totalParts:h||E})}if(A)break}while(b.size>0)await T();return u.sort((A,R)=>A.partNumber-R.partNumber),u}async completeMultipartUpload(e,t,n,r,i){let s=await this.getCredentials(),a=`${n}?uploadId=${encodeURIComponent(r)}`,c=`<?xml version="1.0" encoding="UTF-8"?><CompleteMultipartUpload>${i.map((y)=>`<Part><PartNumber>${y.partNumber}</PartNumber><ETag>"${y.etag}"</ETag></Part>`).join("")}</CompleteMultipartUpload>`,l=j({method:"POST",url:a,headers:{"Content-Type":"application/xml"},body:c,...s,service:"s3",region:this.region}),u=await fetch(l.url,{method:l.method,headers:l.headers,body:c});if(!u.ok){let y=await u.text();throw new z(`Failed to complete multipart upload: ${y}`,u.status,e,t)}let p=(await u.text()).match(/<ETag>"?([^"<]+)"?<\/ETag>/);return{etag:p?p[1]:""}}async abortMultipartUpload(e,t,n,r){let i=await this.getCredentials(),s=`${r??this.buildUrl(e,t)}?uploadId=${encodeURIComponent(n)}`,a=j({method:"DELETE",url:s,...i,service:"s3",region:this.region});await fetch(a.url,{method:a.method,headers:a.headers})}async emptyAndDeleteBucket(e){let n=[];for await(let a of this.listAll(e,{}))if(n.push(a.key),n.length>=1000)await this.deleteMany(e,n),n=[];if(n.length>0)await this.deleteMany(e,n);let r=await this.getCredentials(),i=this.buildUrl(e),s=j({method:"DELETE",url:i,...r,service:"s3",region:this.region});await fetch(s.url,{method:s.method,headers:s.headers})}}class z extends Error{statusCode;bucket;key;constructor(e,t,n,r){super(e);this.statusCode=t;this.bucket=n;this.key=r;this.name="S3Error"}}function $o(e){let t=[],n=[],r=/<Contents>([\s\S]*?)<\/Contents>/g,i;while((i=r.exec(e))!==null){let a=i[1];t.push({key:ie(a,"Key")||"",lastModified:new Date(ie(a,"LastModified")||0),etag:(ie(a,"ETag")||"").replace(/"/g,""),size:Number(ie(a,"Size")||0),storageClass:ie(a,"StorageClass")||"STANDARD"})}let s=/<CommonPrefixes><Prefix>([^<]+)<\/Prefix><\/CommonPrefixes>/g;while((i=s.exec(e))!==null)n.push(i[1]);return{contents:t,commonPrefixes:n,isTruncated:ie(e,"IsTruncated")==="true",continuationToken:ie(e,"ContinuationToken")||void 0,nextContinuationToken:ie(e,"NextContinuationToken")||void 0,keyCount:Number(ie(e,"KeyCount")||0),maxKeys:Number(ie(e,"MaxKeys")||1000),prefix:ie(e,"Prefix")||void 0,delimiter:ie(e,"Delimiter")||void 0}}function ie(e,t){let n=new RegExp(`<${t}>([^<]*)</${t}>`),r=e.match(n);return r?r[1]:null}function Bo(e){return e.replace(/&/g,"&amp;").replace(/</g,"&lt;").replace(/>/g,"&gt;").replace(/"/g,"&quot;").replace(/'/g,"&apos;")}function Xr(e){let t=e.split(".").pop()?.toLowerCase();return{html:"text/html",htm:"text/html",css:"text/css",js:"application/javascript",mjs:"application/javascript",json:"application/json",xml:"application/xml",txt:"text/plain",md:"text/markdown",csv:"text/csv",jpg:"image/jpeg",jpeg:"image/jpeg",png:"image/png",gif:"image/gif",webp:"image/webp",svg:"image/svg+xml",ico:"image/x-icon",avif:"image/avif",mp4:"video/mp4",webm:"video/webm",mov:"video/quicktime",avi:"video/x-msvideo",mp3:"audio/mpeg",wav:"audio/wav",ogg:"audio/ogg",pdf:"application/pdf",doc:"application/msword",docx:"application/vnd.openxmlformats-officedocument.wordprocessingml.document",xls:"application/vnd.ms-excel",xlsx:"application/vnd.openxmlformats-officedocument.spreadsheetml.sheet",ppt:"application/vnd.ms-powerpoint",pptx:"application/vnd.openxmlformats-officedocument.presentationml.presentation",zip:"application/zip",gz:"application/gzip",tar:"application/x-tar",rar:"application/vnd.rar","7z":"application/x-7z-compressed",woff:"font/woff",woff2:"font/woff2",ttf:"font/ttf",otf:"font/otf",eot:"application/vnd.ms-fontobject",wasm:"application/wasm"}[t||""]||"application/octet-stream"}function Fo(e){if(e instanceof Blob)return e;if(typeof e==="string")return new Blob([e],{type:"text/plain"});return new Blob([e])}function Go(e){return new rn(e)}await He();class _o{profile;credentials=null;constructor(e="default"){this.profile=e}async init(){this.credentials=await je(this.profile)}async ensureCredentials(){if(!this.credentials)await this.init();return this.credentials}async createInvalidation(e){let t=await this.ensureCredentials(),n=e.callerReference||`invalidation-${Date.now()}`,r=`<?xml version="1.0" encoding="UTF-8"?>
 <InvalidationBatch>
   <Paths>
     <Quantity>${e.paths.length}</Quantity>
@@ -7260,7 +7260,7 @@ export const queue = __handlers.queue
 export const cli = __handlers.cli
 `}import{execSync as Jc}from"node:child_process";import{createHash as Yc}from"node:crypto";import{cpSync as Zc,mkdtempSync as Xc,rmSync as el,writeFileSync as tl}from"node:fs";import{tmpdir as nl}from"node:os";import{dirname as rl,isAbsolute as il,join as qe,resolve as sl}from"node:path";import{fileURLToPath as al}from"node:url";var ol=["adapter.ts","recursion.ts","auto-recursion.ts"];function cl(){return qe(rl(al(import.meta.url)),"runtime")}function ll(e,t,n){for(let r of e??[])n?.(`build: ${r}`),Jc(r,{stdio:"inherit",cwd:t})}function ul(e){return Yc("sha256").update(e).digest("hex")}function NA(e,t,n){return`deployments/${e}/${t}/${n}.zip`}async function xA(e){let t=sl(e.projectRoot??process.cwd()),{app:n}=e;if(!e.skipBuild)ll(n.build,t,e.onStep);let r=n.entry;if(!r)throw Error("serverless app: `entry` is required to package a Node/Bun application");let i=il(r)?r:qe(t,r),s=Xc(qe(nl(),"tscloud-pkg-"));try{for(let p of ol)Zc(qe(cl(),p),qe(s,p));let a=qe(s,"bootstrap.ts");tl(a,Zi({entryImport:i,adapterImport:"./adapter"})),e.onStep?.("bundling application");let o=await Bun.build({entrypoints:[a],target:n.kind==="bun"?"bun":"node",format:"esm",minify:!1,sourcemap:"none"});if(!o.success){let p=o.logs.map((g)=>String(g)).join(`
 `);throw Error(`serverless app bundle failed:
-${p}`)}let c=o.outputs[0],l=Buffer.from(await c.arrayBuffer()),u="index",m=Se([{name:`${u}.mjs`,data:l}]);return{zip:m,bundle:l,sha256:ul(m),handlerFile:u,handlers:{http:n.handlers?.http??`${u}.http`,queue:n.handlers?.queue??`${u}.queue`,cli:n.handlers?.cli??`${u}.cli`},bundleBytes:l.length}}finally{el(s,{recursive:!0,force:!0})}}var dl=["18","20","22"];function ml(e){if(!e)return"22";let t=String(e).match(/(\d+)/);return t?t[1]:"22"}function Xi(e){let t=e.kind??"node";if(t==="php")return{lambdaRuntime:"provided.al2023",kind:"php",version:e.phpVersion??"8.3",usesLayer:!0,layerKind:"php",layerEnvVar:"TSCLOUD_PHP_LAYER_ARN"};if(t==="bun")return{lambdaRuntime:"provided.al2023",kind:"bun",version:e.runtimeVersion??"latest",usesLayer:!0,layerKind:"bun",layerEnvVar:"TSCLOUD_BUN_LAYER_ARN"};let n=ml(e.runtimeVersion);if(e.runtime!=="provided.al2023"&&dl.includes(n))return{lambdaRuntime:e.runtime&&e.runtime.startsWith("nodejs")?e.runtime:`nodejs${n}.x`,kind:"node",version:n,usesLayer:!1};return{lambdaRuntime:"provided.al2023",kind:"node",version:n,usesLayer:!0,layerKind:"node",layerEnvVar:"TSCLOUD_NODE_LAYER_ARN"}}function es(e,t,n){if(e.queues===!1)return[];if(e.queues===void 0||e.queues===!0)return[{name:`${t}-${n}-default`}];return e.queues.map((r)=>{if(typeof r==="string")return{name:`${t}-${n}-${r}`};let[i,s]=Object.entries(r)[0];return{name:`${t}-${n}-${i}`,concurrency:s}})}function BA(e,t,n){return es(e,t,n).map((r)=>r.name)}function FA(e){let{app:t,environment:n,handlers:r}=e,i=e.config.project.slug,s=Xi(t).lambdaRuntime,a=t.architecture??"x86_64",o=e.config.project.region,c={http:`${i}-${n}-http`,queue:`${i}-${n}-queue`,cli:`${i}-${n}-cli`};if(t.gatewayVersion===1)throw Error("serverless app: `gatewayVersion: 1` (REST API) is not supported — ts-cloud uses API Gateway HTTP API (v2). Remove `gatewayVersion` or set it to 2.");let l=es(t,i,n),u=l.map((N)=>N.name),m=u.length>0,p=t.logRetention??14,g=t.packaging==="image";if(g&&t.lambdaInsights)throw Error("serverless app: `lambdaInsights` layer attachment is only supported for zip packaging. Container images must install the Lambda Insights extension in the image.");let y=(t.scheduler??"on")!=="off",h=(t.cache?.driver??"dynamodb")==="dynamodb",b=Boolean(t.assets),C=Xn(i,n),T=t.tmpStorage??512,A={},R={},P=[{PolicyName:"tscloud-serverless-app",PolicyDocument:{Version:"2012-10-17",Statement:[{Effect:"Allow",Action:["logs:CreateLogGroup","logs:CreateLogStream","logs:PutLogEvents"],Resource:d.sub("arn:aws:logs:${AWS::Region}:${AWS::AccountId}:log-group:/aws/lambda/*")},{Effect:"Allow",Action:["lambda:InvokeFunction"],Resource:d.sub(`arn:aws:lambda:\${AWS::Region}:\${AWS::AccountId}:function:${i}-${n}-*`)},{Effect:"Allow",Action:["secretsmanager:GetSecretValue","ssm:GetParameter","ssm:GetParameters","ssm:GetParametersByPath"],Resource:[d.sub(`arn:aws:secretsmanager:\${AWS::Region}:\${AWS::AccountId}:secret:${i}/${n}/*`),d.sub(`arn:aws:ssm:\${AWS::Region}:\${AWS::AccountId}:parameter/${i}/${n}/*`)]},{Effect:"Allow",Action:["s3:GetObject","s3:PutObject","s3:DeleteObject","s3:ListBucket"],Resource:[d.sub(`arn:aws:s3:::${C}`),d.sub(`arn:aws:s3:::${C}/*`),...t.storage?.bucket?[d.sub(`arn:aws:s3:::${t.storage.bucket}`),d.sub(`arn:aws:s3:::${t.storage.bucket}/*`)]:[]]}]}}];if(m)P[0].PolicyDocument.Statement.push({Effect:"Allow",Action:["sqs:SendMessage","sqs:ReceiveMessage","sqs:DeleteMessage","sqs:GetQueueAttributes","sqs:GetQueueUrl"],Resource:d.sub(`arn:aws:sqs:\${AWS::Region}:\${AWS::AccountId}:${i}-${n}-*`)});if(h)P[0].PolicyDocument.Statement.push({Effect:"Allow",Action:["dynamodb:GetItem","dynamodb:PutItem","dynamodb:UpdateItem","dynamodb:DeleteItem","dynamodb:Query","dynamodb:Scan","dynamodb:BatchGetItem","dynamodb:BatchWriteItem"],Resource:d.sub(`arn:aws:dynamodb:\${AWS::Region}:\${AWS::AccountId}:table/${i}-${n}-cache*`)});let E=["arn:aws:iam::aws:policy/service-role/AWSLambdaBasicExecutionRole"];if(t.vpc?.subnets?.length)E.push("arn:aws:iam::aws:policy/service-role/AWSLambdaVPCAccessExecutionRole");if(t.lambdaInsights)E.push("arn:aws:iam::aws:policy/CloudWatchLambdaInsightsExecutionRolePolicy");A.AppRole={Type:"AWS::IAM::Role",Properties:{RoleName:`${i}-${n}-app-role`,AssumeRolePolicyDocument:{Version:"2012-10-17",Statement:[{Effect:"Allow",Principal:{Service:"lambda.amazonaws.com"},Action:"sts:AssumeRole"}]},ManagedPolicyArns:E,Policies:P}};let w=(N)=>({TSCLOUD_LAMBDA_MODE:N,TSCLOUD_ENV:n,...t.octane?{TSCLOUD_OCTANE:"1"}:{},...t.scheduler==="sub-minute"?{TSCLOUD_SCHEDULER:"sub-minute"}:{},...h?{TSCLOUD_CACHE_TABLE:`${i}-${n}-cache`}:{},...m?{TSCLOUD_QUEUE:u[0]}:{},...t.env??{}}),I=Boolean(t.efs),D=typeof t.efs==="object"?t.efs:{},k=D.mountPath??"/mnt/local",O=I&&!D.accessPointArn,ne=D.accessPointArn??(O?d.getAtt("EfsAccessPoint","Arn"):void 0),_=t.vpc?.subnets??[],q=_.length>0,F=t.cache?.driver==="elasticache"||t.database?.connection==="aurora-serverless"||Boolean(t.rdsProxy)||I;if(F&&!q)throw Error("serverless app: elasticache / aurora-serverless / rdsProxy / efs require app.vpc.subnets (private subnets) to be set.");let K=q?{VpcConfig:{SubnetIds:_,SecurityGroupIds:[...t.vpc?.securityGroups??[],...F?[d.getAtt("DataSecurityGroup","GroupId")]:[]]}}:{},de=O?_.map((N,M)=>`EfsMountTarget${M}`):[],Oe=I?{FileSystemConfigs:[{Arn:ne,LocalMountPath:k}]}:{};if(I)P[0].PolicyDocument.Statement.push({Effect:"Allow",Action:["elasticfilesystem:ClientMount","elasticfilesystem:ClientWrite","elasticfilesystem:ClientRootAccess","elasticfilesystem:DescribeMountTargets"],Resource:"*"});function me(N,M,G,L,oe,Ft,Je,Ie=T){A[`${N}LogGroup`]={Type:"AWS::Logs::LogGroup",Properties:{LogGroupName:`/aws/lambda/${M}`,RetentionInDays:p}};let Ye=[...e.runtimeLayers??[],...t.lambdaInsights?[t.lambdaInsights.layerArn]:[]],zn=g?{PackageType:"Image",Code:{ImageUri:d.ref("ImageUri")},...t.kind==="php"?{}:{ImageConfig:{Command:[G]}}}:{Runtime:s,Handler:G,Code:{S3Bucket:d.ref("ArtifactBucket"),S3Key:d.ref("ArtifactKey")},...Ye.length?{Layers:[...new Set(Ye)]}:{}};A[N]={Type:"AWS::Lambda::Function",DependsOn:[`${N}LogGroup`,...de],Properties:{FunctionName:M,Architectures:[a],MemorySize:oe,Timeout:Ft,Role:d.getAtt("AppRole","Arn"),Environment:{Variables:w(L)},EphemeralStorage:{Size:Ie},...zn,...Je!==void 0?{ReservedConcurrentExecutions:Je}:{},...K,...Oe}}}if(me("HttpFunction",c.http,r.http,"http",t.memory??1024,t.timeout??28,t.concurrency,T),me("CliFunction",c.cli,r.cli,"cli",t.cliMemory??1024,t.cliTimeout??900,void 0,t.cliTmpStorage??T),m)me("QueueFunction",c.queue,r.queue,"queue",t.queueMemory??1024,t.queueTimeout??120,void 0,t.queueTmpStorage??T);let ae=(t.provisionedConcurrency??0)>0?t.provisionedConcurrency:0,pe=["HttpFunction","CliFunction",...m?["QueueFunction"]:[]];if(ae)for(let N of pe)A[`${N}Version`]={Type:"AWS::Lambda::Version",DeletionPolicy:"Retain",Properties:{FunctionName:d.ref(N)}},A[`${N}Alias`]={Type:"AWS::Lambda::Alias",Properties:{FunctionName:d.ref(N),Name:"live",FunctionVersion:d.getAtt(`${N}Version`,"Version"),ProvisionedConcurrencyConfig:{ProvisionedConcurrentExecutions:ae}}};let we=(N)=>ae?d.ref(`${N}Alias`):d.getAtt(N,"Arn"),ge=(N)=>ae?d.ref(`${N}Alias`):d.ref(N);A.HttpApi={Type:"AWS::ApiGatewayV2::Api",Properties:{Name:`${i}-${n}`,ProtocolType:"HTTP"}},A.HttpIntegration={Type:"AWS::ApiGatewayV2::Integration",Properties:{ApiId:d.ref("HttpApi"),IntegrationType:"AWS_PROXY",IntegrationUri:we("HttpFunction"),PayloadFormatVersion:"2.0"}},A.HttpRoute={Type:"AWS::ApiGatewayV2::Route",Properties:{ApiId:d.ref("HttpApi"),RouteKey:"$default",Target:d.join("/",["integrations",d.ref("HttpIntegration")])}},A.HttpStage={Type:"AWS::ApiGatewayV2::Stage",Properties:{ApiId:d.ref("HttpApi"),StageName:"$default",AutoDeploy:!0}},A.HttpPermission={Type:"AWS::Lambda::Permission",Properties:{FunctionName:ge("HttpFunction"),Action:"lambda:InvokeFunction",Principal:"apigateway.amazonaws.com",SourceArn:d.sub("arn:aws:execute-api:${AWS::Region}:${AWS::AccountId}:${HttpApi}/*/*")}},R.HttpApiEndpoint={Description:"HTTP API endpoint",Value:d.getAtt("HttpApi","ApiEndpoint")},R.HttpApiId={Description:"HTTP API id",Value:d.ref("HttpApi")};let Ce=(Array.isArray(t.domain)?t.domain:t.domain?[t.domain]:[]).filter(Boolean);if(Ce.length){if(!t.certificateArn&&!t.hostedZoneId)throw Error("serverless app: a custom `domain` needs either `certificateArn` (pre-issued, regional) or `hostedZoneId` (to auto-issue + validate an ACM cert).");let N=t.certificateArn;if(!N)A.HttpCertificate={Type:"AWS::CertificateManager::Certificate",Properties:{DomainName:Ce[0],...Ce.length>1?{SubjectAlternativeNames:Ce.slice(1)}:{},ValidationMethod:"DNS",DomainValidationOptions:Ce.map((M)=>({DomainName:M,HostedZoneId:t.hostedZoneId}))}},N=d.ref("HttpCertificate");Ce.forEach((M,G)=>{let L=`HttpDomain${G}`;if(A[L]={Type:"AWS::ApiGatewayV2::DomainName",Properties:{DomainName:M,DomainNameConfigurations:[{CertificateArn:N,EndpointType:"REGIONAL"}]}},A[`HttpApiMapping${G}`]={Type:"AWS::ApiGatewayV2::ApiMapping",DependsOn:["HttpStage"],Properties:{ApiId:d.ref("HttpApi"),DomainName:d.ref(L),Stage:"$default"}},t.hostedZoneId)A[`HttpDomainRecord${G}`]={Type:"AWS::Route53::RecordSet",Properties:{HostedZoneId:t.hostedZoneId,Name:M,Type:"A",AliasTarget:{DNSName:d.getAtt(L,"RegionalDomainName"),HostedZoneId:d.getAtt(L,"RegionalHostedZoneId")}}};R[`CustomDomain${G}`]={Description:`Custom domain ${M}`,Value:M},R[`CustomDomainTarget${G}`]={Description:`Point ${M} (CNAME/alias) at this APIGW regional domain`,Value:d.getAtt(L,"RegionalDomainName")}})}if(m)A.AppQueueDlq={Type:"AWS::SQS::Queue",Properties:{QueueName:`${i}-${n}-dlq`,MessageRetentionPeriod:1209600}},l.forEach((N,M)=>{let G=`AppQueue${M}`,L=t.queueTimeout??120;A[G]={Type:"AWS::SQS::Queue",Properties:{QueueName:N.name,VisibilityTimeout:Math.min(43200,L*6),RedrivePolicy:{deadLetterTargetArn:d.getAtt("AppQueueDlq","Arn"),maxReceiveCount:t.queueTries??3}}};let oe=N.concurrency??t.queueConcurrency;A[`${G}Mapping`]={Type:"AWS::Lambda::EventSourceMapping",Properties:{EventSourceArn:d.getAtt(G,"Arn"),FunctionName:ge("QueueFunction"),BatchSize:1,FunctionResponseTypes:["ReportBatchItemFailures"],...oe?{ScalingConfig:{MaximumConcurrency:Math.max(2,oe)}}:{}}},R[`QueueUrl${M}`]={Description:`Queue URL: ${N.name}`,Value:d.ref(G)}});if(y)A.SchedulerRule={Type:"AWS::Events::Rule",Properties:{Name:`${i}-${n}-scheduler`,ScheduleExpression:"rate(1 minute)",State:"ENABLED",Targets:[{Id:"cli",Arn:we("CliFunction"),Input:JSON.stringify({command:"schedule:run"})}]}},A.SchedulerPermission={Type:"AWS::Lambda::Permission",Properties:{FunctionName:ge("CliFunction"),Action:"lambda:InvokeFunction",Principal:"events.amazonaws.com",SourceArn:d.getAtt("SchedulerRule","Arn")}};if(t.warm&&t.warm>0){let M={http:"HttpFunction",queue:"QueueFunction",cli:"CliFunction"},G=(t.warmFunctions??["http"]).filter((L)=>L!=="queue"||m);for(let L of G){let oe=L.charAt(0).toUpperCase()+L.slice(1),Ft=Math.ceil(t.warm/5),Je=0;for(let Ie=0;Ie<Ft;Ie++){let Ye=Math.min(5,t.warm-Je);A[`Warmer${oe}Rule${Ie}`]={Type:"AWS::Events::Rule",Properties:{Name:`${i}-${n}-warmer-${L}-${Ie}`,ScheduleExpression:"rate(5 minutes)",State:"ENABLED",Targets:Array.from({length:Ye},(zn,ks)=>({Id:`warm-${L}-${Ie}-${ks}`,Arn:d.getAtt(M[L],"Arn"),Input:JSON.stringify({warmer:!0})}))}},Je+=Ye}A[`Warmer${oe}Permission`]={Type:"AWS::Lambda::Permission",Properties:{FunctionName:d.ref(M[L]),Action:"lambda:InvokeFunction",Principal:"events.amazonaws.com",SourceArn:d.sub(`arn:aws:events:\${AWS::Region}:\${AWS::AccountId}:rule/${i}-${n}-warmer-${L}-*`)}}}}if(h)A.CacheTable={Type:"AWS::DynamoDB::Table",Properties:{TableName:`${i}-${n}-cache`,BillingMode:"PAY_PER_REQUEST",AttributeDefinitions:[{AttributeName:"key",AttributeType:"S"}],KeySchema:[{AttributeName:"key",KeyType:"HASH"}],TimeToLiveSpecification:{AttributeName:"expires_at",Enabled:!0}}},R.CacheTableName={Description:"DynamoDB cache table",Value:d.ref("CacheTable")};if(b){if(A.AssetsBucket={Type:"AWS::S3::Bucket",Properties:{BucketName:C,PublicAccessBlockConfiguration:{BlockPublicAcls:!0,BlockPublicPolicy:!0,IgnorePublicAcls:!0,RestrictPublicBuckets:!0}}},A.AssetsOAC={Type:"AWS::CloudFront::OriginAccessControl",Properties:{OriginAccessControlConfig:{Name:`${i}-${n}-assets-oac`,OriginAccessControlOriginType:"s3",SigningBehavior:"always",SigningProtocol:"sigv4"}}},A.AssetsDistribution={Type:"AWS::CloudFront::Distribution",Properties:{DistributionConfig:{Enabled:!0,DefaultCacheBehavior:{TargetOriginId:"assets",ViewerProtocolPolicy:"redirect-to-https",Compress:!0,CachePolicyId:"658327ea-f89d-4fab-a63d-7e88639e58f6"},Origins:[{Id:"assets",DomainName:d.getAtt("AssetsBucket","RegionalDomainName"),OriginAccessControlId:d.ref("AssetsOAC"),S3OriginConfig:{OriginAccessIdentity:""}}],...t.assetDomain?{Aliases:[t.assetDomain],ViewerCertificate:{AcmCertificateArn:t.assetCertificateArn??d.ref("AssetsCertificate"),SslSupportMethod:"sni-only",MinimumProtocolVersion:"TLSv1.2_2021"}}:{}}}},t.assetDomain){if(!t.assetCertificateArn){if(!t.hostedZoneId)throw Error("serverless app: `assetDomain` requires either `assetCertificateArn` (a us-east-1 ACM cert) or `hostedZoneId` (to auto-issue + validate one). CloudFront only accepts certs from us-east-1.");if(o!=="us-east-1")throw Error(`serverless app: auto-issuing an asset-domain cert needs a us-east-1 app (CloudFront certs must be us-east-1); this app is in ${o}. Supply a pre-issued us-east-1 \`assetCertificateArn\` instead.`);A.AssetsCertificate={Type:"AWS::CertificateManager::Certificate",Properties:{DomainName:t.assetDomain,ValidationMethod:"DNS",DomainValidationOptions:[{DomainName:t.assetDomain,HostedZoneId:t.hostedZoneId}]}}}if(t.hostedZoneId)A.AssetsDomainRecord={Type:"AWS::Route53::RecordSet",Properties:{HostedZoneId:t.hostedZoneId,Name:t.assetDomain,Type:"A",AliasTarget:{DNSName:d.getAtt("AssetsDistribution","DomainName"),HostedZoneId:"Z2FDTNDATAQYW2"}}};R.AssetDomain={Description:"Custom asset CDN host",Value:t.assetDomain}}A.AssetsBucketPolicy={Type:"AWS::S3::BucketPolicy",Properties:{Bucket:d.ref("AssetsBucket"),PolicyDocument:{Version:"2012-10-17",Statement:[{Effect:"Allow",Principal:{Service:"cloudfront.amazonaws.com"},Action:"s3:GetObject",Resource:d.sub(`arn:aws:s3:::${C}/*`),Condition:{StringEquals:{"AWS:SourceArn":d.sub("arn:aws:cloudfront::${AWS::AccountId}:distribution/${AssetsDistribution}")}}}]}}},R.AssetsBucketName={Description:"Assets bucket",Value:d.ref("AssetsBucket")},R.AssetsCdnDomain={Description:"Assets CloudFront domain",Value:d.getAtt("AssetsDistribution","DomainName")}}if(t.firewall?.enabled){let N=[],M=0;if(t.firewall.rateLimit)N.push({Name:"rate-limit",Priority:M++,Action:{Block:{}},Statement:{RateBasedStatement:{Limit:t.firewall.rateLimit,AggregateKeyType:"IP"}},VisibilityConfig:{SampledRequestsEnabled:!0,CloudWatchMetricsEnabled:!0,MetricName:`${i}-${n}-rate`}});let G={sqlInjection:"AWSManagedRulesSQLiRuleSet",xss:"AWSManagedRulesCommonRuleSet",common:"AWSManagedRulesCommonRuleSet",botControl:"AWSManagedRulesBotControlRuleSet",ipReputation:"AWSManagedRulesAmazonIpReputationList"};for(let L of t.firewall.rules??[]){let oe=G[L];if(!oe)continue;N.push({Name:`managed-${L}`,Priority:M++,OverrideAction:{None:{}},Statement:{ManagedRuleGroupStatement:{VendorName:"AWS",Name:oe}},VisibilityConfig:{SampledRequestsEnabled:!0,CloudWatchMetricsEnabled:!0,MetricName:`${i}-${n}-${L}`}})}A.WebAcl={Type:"AWS::WAFv2::WebACL",Properties:{Name:`${i}-${n}-waf`,Scope:"REGIONAL",DefaultAction:{Allow:{}},Rules:N,VisibilityConfig:{SampledRequestsEnabled:!0,CloudWatchMetricsEnabled:!0,MetricName:`${i}-${n}-waf`}}},R.WafAclArn={Description:"WAF web ACL ARN. Attach to a CloudFront distribution fronting the API to enforce (HTTP API v2 stages do not support direct WAF association).",Value:d.getAtt("WebAcl","Arn")}}if(q&&F){if(!t.vpc?.id)throw Error("serverless app: data services (elasticache / aurora-serverless / rdsProxy / efs) need app.vpc.id (the VPC id) so the managed security group is created in the right VPC.");A.DataSecurityGroup={Type:"AWS::EC2::SecurityGroup",Properties:{VpcId:t.vpc.id,GroupDescription:`${i}-${n} serverless data access`,SecurityGroupIngress:[{IpProtocol:"-1",CidrIp:"10.0.0.0/8"}]}}}if(O)A.EfsFileSystem={Type:"AWS::EFS::FileSystem",Properties:{Encrypted:!0,FileSystemTags:[{Key:"Name",Value:`${i}-${n}-efs`}]}},_.forEach((N,M)=>{A[`EfsMountTarget${M}`]={Type:"AWS::EFS::MountTarget",Properties:{FileSystemId:d.ref("EfsFileSystem"),SubnetId:N,SecurityGroups:[d.getAtt("DataSecurityGroup","GroupId")]}}}),A.EfsAccessPoint={Type:"AWS::EFS::AccessPoint",Properties:{FileSystemId:d.ref("EfsFileSystem"),PosixUser:{Uid:1001,Gid:1001},RootDirectory:{Path:"/lambda",CreationInfo:{OwnerUid:1001,OwnerGid:1001,Permissions:"0755"}}}},R.EfsFileSystemId={Description:"EFS file system id",Value:d.ref("EfsFileSystem")};if(t.cache?.driver==="elasticache")A.CacheSubnetGroup={Type:"AWS::ElastiCache::SubnetGroup",Properties:{Description:`${i}-${n} cache subnets`,SubnetIds:_}},A.CacheCluster={Type:"AWS::ElastiCache::ReplicationGroup",Properties:{ReplicationGroupId:`${i}-${n}-cache`,ReplicationGroupDescription:`${i}-${n} redis`,Engine:"redis",CacheNodeType:"cache.t4g.micro",NumCacheClusters:1,AutomaticFailoverEnabled:!1,CacheSubnetGroupName:d.ref("CacheSubnetGroup"),SecurityGroupIds:[d.getAtt("DataSecurityGroup","GroupId")],TransitEncryptionEnabled:!1}},R.CacheEndpoint={Description:"Redis primary endpoint",Value:d.getAtt("CacheCluster","PrimaryEndPoint.Address")};if(t.database?.connection==="aurora-serverless")A.DbSubnetGroup={Type:"AWS::RDS::DBSubnetGroup",Properties:{DBSubnetGroupDescription:`${i}-${n} db subnets`,SubnetIds:_}},A.DbSecret={Type:"AWS::SecretsManager::Secret",Properties:{Name:`${i}/${n}/db`,GenerateSecretString:{SecretStringTemplate:JSON.stringify({username:"app"}),GenerateStringKey:"password",PasswordLength:32,ExcludePunctuation:!0}}},A.DbCluster={Type:"AWS::RDS::DBCluster",Properties:{Engine:"aurora-mysql",EngineMode:"provisioned",DBClusterIdentifier:`${i}-${n}-db`,DatabaseName:"app",MasterUsername:d.sub("{{resolve:secretsmanager:${DbSecret}:SecretString:username}}"),MasterUserPassword:d.sub("{{resolve:secretsmanager:${DbSecret}:SecretString:password}}"),ServerlessV2ScalingConfiguration:{MinCapacity:t.database?.minCapacity??0.5,MaxCapacity:t.database?.maxCapacity??4},DBSubnetGroupName:d.ref("DbSubnetGroup"),VpcSecurityGroupIds:[d.getAtt("DataSecurityGroup","GroupId")]}},A.DbInstance={Type:"AWS::RDS::DBInstance",Properties:{Engine:"aurora-mysql",DBInstanceClass:"db.serverless",DBClusterIdentifier:d.ref("DbCluster")}},R.DbEndpoint={Description:"Aurora cluster endpoint",Value:d.getAtt("DbCluster","Endpoint.Address")};if(t.rdsProxy&&t.database?.connection==="aurora-serverless")A.DbProxyRole={Type:"AWS::IAM::Role",Properties:{AssumeRolePolicyDocument:{Version:"2012-10-17",Statement:[{Effect:"Allow",Principal:{Service:"rds.amazonaws.com"},Action:"sts:AssumeRole"}]},Policies:[{PolicyName:"read-db-secret",PolicyDocument:{Version:"2012-10-17",Statement:[{Effect:"Allow",Action:["secretsmanager:GetSecretValue"],Resource:d.ref("DbSecret")}]}}]}},A.DbProxy={Type:"AWS::RDS::DBProxy",Properties:{DBProxyName:typeof t.rdsProxy==="object"&&t.rdsProxy.name?t.rdsProxy.name:`${i}-${n}-proxy`,EngineFamily:"MYSQL",RoleArn:d.getAtt("DbProxyRole","Arn"),Auth:[{AuthScheme:"SECRETS",SecretArn:d.ref("DbSecret"),IAMAuth:"DISABLED"}],VpcSubnetIds:_,VpcSecurityGroupIds:[d.getAtt("DataSecurityGroup","GroupId")],RequireTLS:!1}},A.DbProxyTargetGroup={Type:"AWS::RDS::DBProxyTargetGroup",DependsOn:["DbInstance"],Properties:{DBProxyName:d.ref("DbProxy"),TargetGroupName:"default",DBClusterIdentifiers:[d.ref("DbCluster")]}},R.DbProxyEndpoint={Description:"RDS Proxy endpoint",Value:d.getAtt("DbProxy","Endpoint")};if(R.HttpFunctionName={Description:"HTTP function name",Value:d.ref("HttpFunction")},R.CliFunctionName={Description:"CLI function name",Value:d.ref("CliFunction")},m)R.QueueFunctionName={Description:"Queue function name",Value:d.ref("QueueFunction")};let $e={AWSTemplateFormatVersion:"2010-09-09",Description:`Serverless application for ${e.config.project.name} (${i}-${n})`,Parameters:g?{ImageUri:{Type:"String",Description:"ECR image URI of the deployment artifact"}}:{ArtifactBucket:{Type:"String",Description:"S3 bucket holding the deployment artifact"},ArtifactKey:{Type:"String",Description:"S3 key of the deployment artifact (zip)"}},Resources:A,Outputs:R},Qe={};for(let N of Object.values(A))Qe[N.Type]=(Qe[N.Type]??0)+1;return{template:$e,functionNames:c,queueNames:u,resourceSummary:Qe}}var pl=["cli","fpm","curl","mbstring","xml","pdo","mysqlnd","gd","bcmath","intl","opcache","sodium","process","pecl-redis6","pecl-apcu","pgsql"];function gl(e){let t=`php${e.replace(".","")}`;return pl.map((n)=>`${t}-php-${n}`)}function Wn(e,t){let n=`php${e.replace(".","")}`,r=gl(e).join(" \\\n      "),i=`/opt/remi/${n}/root`,s=`/etc/opt/remi/${n}`;return`${t?`FROM almalinux:9 AS ${t}`:"FROM almalinux:9"}
+${p}`)}let c=o.outputs[0],l=Buffer.from(await c.arrayBuffer()),u="index",m=Se([{name:`${u}.mjs`,data:l}]);return{zip:m,bundle:l,sha256:ul(m),handlerFile:u,handlers:{http:n.handlers?.http??`${u}.http`,queue:n.handlers?.queue??`${u}.queue`,cli:n.handlers?.cli??`${u}.cli`},bundleBytes:l.length}}finally{el(s,{recursive:!0,force:!0})}}var dl=["18","20","22"];function ml(e){if(!e)return"22";let t=String(e).match(/(\d+)/);return t?t[1]:"22"}function Xi(e){let t=e.kind??"node";if(t==="php")return{lambdaRuntime:"provided.al2023",kind:"php",version:e.phpVersion??"8.3",usesLayer:!0,layerKind:"php",layerEnvVar:"TSCLOUD_PHP_LAYER_ARN"};if(t==="bun")return{lambdaRuntime:"provided.al2023",kind:"bun",version:e.runtimeVersion??"latest",usesLayer:!0,layerKind:"bun",layerEnvVar:"TSCLOUD_BUN_LAYER_ARN"};let n=ml(e.runtimeVersion);if(e.runtime!=="provided.al2023"&&dl.includes(n))return{lambdaRuntime:e.runtime&&e.runtime.startsWith("nodejs")?e.runtime:`nodejs${n}.x`,kind:"node",version:n,usesLayer:!1};return{lambdaRuntime:"provided.al2023",kind:"node",version:n,usesLayer:!0,layerKind:"node",layerEnvVar:"TSCLOUD_NODE_LAYER_ARN"}}function es(e,t,n){if(e.queues===!1)return[];if(e.queues===void 0||e.queues===!0)return[{name:`${t}-${n}-default`}];return e.queues.map((r)=>{if(typeof r==="string")return{name:`${t}-${n}-${r}`};let[i,s]=Object.entries(r)[0];return{name:`${t}-${n}-${i}`,concurrency:s}})}function BA(e,t,n){return es(e,t,n).map((r)=>r.name)}function FA(e){let{app:t,environment:n,handlers:r}=e,i=e.config.project.slug,s=Xi(t).lambdaRuntime,a=t.architecture??"x86_64",o=e.config.project.region,c={http:`${i}-${n}-http`,queue:`${i}-${n}-queue`,cli:`${i}-${n}-cli`};if(t.gatewayVersion===1)throw Error("serverless app: `gatewayVersion: 1` (REST API) is not supported — ts-cloud uses API Gateway HTTP API (v2). Remove `gatewayVersion` or set it to 2.");let l=es(t,i,n),u=l.map((N)=>N.name),m=u.length>0,p=t.logRetention??14,g=t.packaging==="image";if(g&&t.lambdaInsights)throw Error("serverless app: `lambdaInsights` layer attachment is only supported for zip packaging. Container images must install the Lambda Insights extension in the image.");let y=(t.scheduler??"on")!=="off",h=(t.cache?.driver??"dynamodb")==="dynamodb",b=Boolean(t.assets),C=Xn(i,n),T=t.tmpStorage??512,A={},R={},P=[{PolicyName:"tscloud-serverless-app",PolicyDocument:{Version:"2012-10-17",Statement:[{Effect:"Allow",Action:["logs:CreateLogGroup","logs:CreateLogStream","logs:PutLogEvents"],Resource:d.sub("arn:aws:logs:${AWS::Region}:${AWS::AccountId}:log-group:/aws/lambda/*")},{Effect:"Allow",Action:["lambda:InvokeFunction"],Resource:d.sub(`arn:aws:lambda:\${AWS::Region}:\${AWS::AccountId}:function:${i}-${n}-*`)},{Effect:"Allow",Action:["secretsmanager:GetSecretValue","ssm:GetParameter","ssm:GetParameters","ssm:GetParametersByPath"],Resource:[d.sub(`arn:aws:secretsmanager:\${AWS::Region}:\${AWS::AccountId}:secret:${i}/${n}/*`),d.sub(`arn:aws:ssm:\${AWS::Region}:\${AWS::AccountId}:parameter/${i}/${n}/*`)]},{Effect:"Allow",Action:["s3:GetObject","s3:PutObject","s3:DeleteObject","s3:ListBucket"],Resource:[d.sub(`arn:aws:s3:::${C}`),d.sub(`arn:aws:s3:::${C}/*`),...t.storage?.bucket?[d.sub(`arn:aws:s3:::${t.storage.bucket}`),d.sub(`arn:aws:s3:::${t.storage.bucket}/*`)]:[]]}]}}];if(m)P[0].PolicyDocument.Statement.push({Effect:"Allow",Action:["sqs:SendMessage","sqs:ReceiveMessage","sqs:DeleteMessage","sqs:GetQueueAttributes","sqs:GetQueueUrl"],Resource:d.sub(`arn:aws:sqs:\${AWS::Region}:\${AWS::AccountId}:${i}-${n}-*`)});if(h)P[0].PolicyDocument.Statement.push({Effect:"Allow",Action:["dynamodb:GetItem","dynamodb:PutItem","dynamodb:UpdateItem","dynamodb:DeleteItem","dynamodb:Query","dynamodb:Scan","dynamodb:BatchGetItem","dynamodb:BatchWriteItem"],Resource:d.sub(`arn:aws:dynamodb:\${AWS::Region}:\${AWS::AccountId}:table/${i}-${n}-cache*`)});let E=["arn:aws:iam::aws:policy/service-role/AWSLambdaBasicExecutionRole"];if(t.vpc?.subnets?.length)E.push("arn:aws:iam::aws:policy/service-role/AWSLambdaVPCAccessExecutionRole");if(t.lambdaInsights)E.push("arn:aws:iam::aws:policy/CloudWatchLambdaInsightsExecutionRolePolicy");A.AppRole={Type:"AWS::IAM::Role",Properties:{RoleName:`${i}-${n}-app-role`,AssumeRolePolicyDocument:{Version:"2012-10-17",Statement:[{Effect:"Allow",Principal:{Service:"lambda.amazonaws.com"},Action:"sts:AssumeRole"}]},ManagedPolicyArns:E,Policies:P}};let w=(N)=>({TSCLOUD_LAMBDA_MODE:N,TSCLOUD_ENV:n,...t.octane?{TSCLOUD_OCTANE:"1"}:{},...t.scheduler==="sub-minute"?{TSCLOUD_SCHEDULER:"sub-minute"}:{},...h?{TSCLOUD_CACHE_TABLE:`${i}-${n}-cache`}:{},...m?{TSCLOUD_QUEUE:u[0]}:{},...t.env??{}}),I=Boolean(t.efs),D=typeof t.efs==="object"?t.efs:{},k=D.mountPath??"/mnt/local",O=I&&!D.accessPointArn,ne=D.accessPointArn??(O?d.getAtt("EfsAccessPoint","Arn"):void 0),_=t.vpc?.subnets??[],q=_.length>0,F=t.cache?.driver==="elasticache"||t.database?.connection==="aurora-serverless"||Boolean(t.rdsProxy)||I;if(F&&!q)throw Error("serverless app: elasticache / aurora-serverless / rdsProxy / efs require app.vpc.subnets (private subnets) to be set.");let W=q?{VpcConfig:{SubnetIds:_,SecurityGroupIds:[...t.vpc?.securityGroups??[],...F?[d.getAtt("DataSecurityGroup","GroupId")]:[]]}}:{},de=O?_.map((N,M)=>`EfsMountTarget${M}`):[],Oe=I?{FileSystemConfigs:[{Arn:ne,LocalMountPath:k}]}:{};if(I)P[0].PolicyDocument.Statement.push({Effect:"Allow",Action:["elasticfilesystem:ClientMount","elasticfilesystem:ClientWrite","elasticfilesystem:ClientRootAccess","elasticfilesystem:DescribeMountTargets"],Resource:"*"});function me(N,M,G,L,oe,Ft,Je,Ie=T){A[`${N}LogGroup`]={Type:"AWS::Logs::LogGroup",Properties:{LogGroupName:`/aws/lambda/${M}`,RetentionInDays:p}};let Ye=[...e.runtimeLayers??[],...t.lambdaInsights?[t.lambdaInsights.layerArn]:[]],zn=g?{PackageType:"Image",Code:{ImageUri:d.ref("ImageUri")},...t.kind==="php"?{}:{ImageConfig:{Command:[G]}}}:{Runtime:s,Handler:G,Code:{S3Bucket:d.ref("ArtifactBucket"),S3Key:d.ref("ArtifactKey")},...Ye.length?{Layers:[...new Set(Ye)]}:{}};A[N]={Type:"AWS::Lambda::Function",DependsOn:[`${N}LogGroup`,...de],Properties:{FunctionName:M,Architectures:[a],MemorySize:oe,Timeout:Ft,Role:d.getAtt("AppRole","Arn"),Environment:{Variables:w(L)},EphemeralStorage:{Size:Ie},...zn,...Je!==void 0?{ReservedConcurrentExecutions:Je}:{},...W,...Oe}}}if(me("HttpFunction",c.http,r.http,"http",t.memory??1024,t.timeout??28,t.concurrency,T),me("CliFunction",c.cli,r.cli,"cli",t.cliMemory??1024,t.cliTimeout??900,void 0,t.cliTmpStorage??T),m)me("QueueFunction",c.queue,r.queue,"queue",t.queueMemory??1024,t.queueTimeout??120,void 0,t.queueTmpStorage??T);let ae=(t.provisionedConcurrency??0)>0?t.provisionedConcurrency:0,pe=["HttpFunction","CliFunction",...m?["QueueFunction"]:[]];if(ae)for(let N of pe)A[`${N}Version`]={Type:"AWS::Lambda::Version",DeletionPolicy:"Retain",Properties:{FunctionName:d.ref(N)}},A[`${N}Alias`]={Type:"AWS::Lambda::Alias",Properties:{FunctionName:d.ref(N),Name:"live",FunctionVersion:d.getAtt(`${N}Version`,"Version"),ProvisionedConcurrencyConfig:{ProvisionedConcurrentExecutions:ae}}};let we=(N)=>ae?d.ref(`${N}Alias`):d.getAtt(N,"Arn"),ge=(N)=>ae?d.ref(`${N}Alias`):d.ref(N);A.HttpApi={Type:"AWS::ApiGatewayV2::Api",Properties:{Name:`${i}-${n}`,ProtocolType:"HTTP"}},A.HttpIntegration={Type:"AWS::ApiGatewayV2::Integration",Properties:{ApiId:d.ref("HttpApi"),IntegrationType:"AWS_PROXY",IntegrationUri:we("HttpFunction"),PayloadFormatVersion:"2.0"}},A.HttpRoute={Type:"AWS::ApiGatewayV2::Route",Properties:{ApiId:d.ref("HttpApi"),RouteKey:"$default",Target:d.join("/",["integrations",d.ref("HttpIntegration")])}},A.HttpStage={Type:"AWS::ApiGatewayV2::Stage",Properties:{ApiId:d.ref("HttpApi"),StageName:"$default",AutoDeploy:!0}},A.HttpPermission={Type:"AWS::Lambda::Permission",Properties:{FunctionName:ge("HttpFunction"),Action:"lambda:InvokeFunction",Principal:"apigateway.amazonaws.com",SourceArn:d.sub("arn:aws:execute-api:${AWS::Region}:${AWS::AccountId}:${HttpApi}/*/*")}},R.HttpApiEndpoint={Description:"HTTP API endpoint",Value:d.getAtt("HttpApi","ApiEndpoint")},R.HttpApiId={Description:"HTTP API id",Value:d.ref("HttpApi")};let Ce=(Array.isArray(t.domain)?t.domain:t.domain?[t.domain]:[]).filter(Boolean);if(Ce.length){if(!t.certificateArn&&!t.hostedZoneId)throw Error("serverless app: a custom `domain` needs either `certificateArn` (pre-issued, regional) or `hostedZoneId` (to auto-issue + validate an ACM cert).");let N=t.certificateArn;if(!N)A.HttpCertificate={Type:"AWS::CertificateManager::Certificate",Properties:{DomainName:Ce[0],...Ce.length>1?{SubjectAlternativeNames:Ce.slice(1)}:{},ValidationMethod:"DNS",DomainValidationOptions:Ce.map((M)=>({DomainName:M,HostedZoneId:t.hostedZoneId}))}},N=d.ref("HttpCertificate");Ce.forEach((M,G)=>{let L=`HttpDomain${G}`;if(A[L]={Type:"AWS::ApiGatewayV2::DomainName",Properties:{DomainName:M,DomainNameConfigurations:[{CertificateArn:N,EndpointType:"REGIONAL"}]}},A[`HttpApiMapping${G}`]={Type:"AWS::ApiGatewayV2::ApiMapping",DependsOn:["HttpStage"],Properties:{ApiId:d.ref("HttpApi"),DomainName:d.ref(L),Stage:"$default"}},t.hostedZoneId)A[`HttpDomainRecord${G}`]={Type:"AWS::Route53::RecordSet",Properties:{HostedZoneId:t.hostedZoneId,Name:M,Type:"A",AliasTarget:{DNSName:d.getAtt(L,"RegionalDomainName"),HostedZoneId:d.getAtt(L,"RegionalHostedZoneId")}}};R[`CustomDomain${G}`]={Description:`Custom domain ${M}`,Value:M},R[`CustomDomainTarget${G}`]={Description:`Point ${M} (CNAME/alias) at this APIGW regional domain`,Value:d.getAtt(L,"RegionalDomainName")}})}if(m)A.AppQueueDlq={Type:"AWS::SQS::Queue",Properties:{QueueName:`${i}-${n}-dlq`,MessageRetentionPeriod:1209600}},l.forEach((N,M)=>{let G=`AppQueue${M}`,L=t.queueTimeout??120;A[G]={Type:"AWS::SQS::Queue",Properties:{QueueName:N.name,VisibilityTimeout:Math.min(43200,L*6),RedrivePolicy:{deadLetterTargetArn:d.getAtt("AppQueueDlq","Arn"),maxReceiveCount:t.queueTries??3}}};let oe=N.concurrency??t.queueConcurrency;A[`${G}Mapping`]={Type:"AWS::Lambda::EventSourceMapping",Properties:{EventSourceArn:d.getAtt(G,"Arn"),FunctionName:ge("QueueFunction"),BatchSize:1,FunctionResponseTypes:["ReportBatchItemFailures"],...oe?{ScalingConfig:{MaximumConcurrency:Math.max(2,oe)}}:{}}},R[`QueueUrl${M}`]={Description:`Queue URL: ${N.name}`,Value:d.ref(G)}});if(y)A.SchedulerRule={Type:"AWS::Events::Rule",Properties:{Name:`${i}-${n}-scheduler`,ScheduleExpression:"rate(1 minute)",State:"ENABLED",Targets:[{Id:"cli",Arn:we("CliFunction"),Input:JSON.stringify({command:"schedule:run"})}]}},A.SchedulerPermission={Type:"AWS::Lambda::Permission",Properties:{FunctionName:ge("CliFunction"),Action:"lambda:InvokeFunction",Principal:"events.amazonaws.com",SourceArn:d.getAtt("SchedulerRule","Arn")}};if(t.warm&&t.warm>0){let M={http:"HttpFunction",queue:"QueueFunction",cli:"CliFunction"},G=(t.warmFunctions??["http"]).filter((L)=>L!=="queue"||m);for(let L of G){let oe=L.charAt(0).toUpperCase()+L.slice(1),Ft=Math.ceil(t.warm/5),Je=0;for(let Ie=0;Ie<Ft;Ie++){let Ye=Math.min(5,t.warm-Je);A[`Warmer${oe}Rule${Ie}`]={Type:"AWS::Events::Rule",Properties:{Name:`${i}-${n}-warmer-${L}-${Ie}`,ScheduleExpression:"rate(5 minutes)",State:"ENABLED",Targets:Array.from({length:Ye},(zn,ks)=>({Id:`warm-${L}-${Ie}-${ks}`,Arn:d.getAtt(M[L],"Arn"),Input:JSON.stringify({warmer:!0})}))}},Je+=Ye}A[`Warmer${oe}Permission`]={Type:"AWS::Lambda::Permission",Properties:{FunctionName:d.ref(M[L]),Action:"lambda:InvokeFunction",Principal:"events.amazonaws.com",SourceArn:d.sub(`arn:aws:events:\${AWS::Region}:\${AWS::AccountId}:rule/${i}-${n}-warmer-${L}-*`)}}}}if(h)A.CacheTable={Type:"AWS::DynamoDB::Table",Properties:{TableName:`${i}-${n}-cache`,BillingMode:"PAY_PER_REQUEST",AttributeDefinitions:[{AttributeName:"key",AttributeType:"S"}],KeySchema:[{AttributeName:"key",KeyType:"HASH"}],TimeToLiveSpecification:{AttributeName:"expires_at",Enabled:!0}}},R.CacheTableName={Description:"DynamoDB cache table",Value:d.ref("CacheTable")};if(b){if(A.AssetsBucket={Type:"AWS::S3::Bucket",Properties:{BucketName:C,PublicAccessBlockConfiguration:{BlockPublicAcls:!0,BlockPublicPolicy:!0,IgnorePublicAcls:!0,RestrictPublicBuckets:!0}}},A.AssetsOAC={Type:"AWS::CloudFront::OriginAccessControl",Properties:{OriginAccessControlConfig:{Name:`${i}-${n}-assets-oac`,OriginAccessControlOriginType:"s3",SigningBehavior:"always",SigningProtocol:"sigv4"}}},A.AssetsDistribution={Type:"AWS::CloudFront::Distribution",Properties:{DistributionConfig:{Enabled:!0,DefaultCacheBehavior:{TargetOriginId:"assets",ViewerProtocolPolicy:"redirect-to-https",Compress:!0,CachePolicyId:"658327ea-f89d-4fab-a63d-7e88639e58f6"},Origins:[{Id:"assets",DomainName:d.getAtt("AssetsBucket","RegionalDomainName"),OriginAccessControlId:d.ref("AssetsOAC"),S3OriginConfig:{OriginAccessIdentity:""}}],...t.assetDomain?{Aliases:[t.assetDomain],ViewerCertificate:{AcmCertificateArn:t.assetCertificateArn??d.ref("AssetsCertificate"),SslSupportMethod:"sni-only",MinimumProtocolVersion:"TLSv1.2_2021"}}:{}}}},t.assetDomain){if(!t.assetCertificateArn){if(!t.hostedZoneId)throw Error("serverless app: `assetDomain` requires either `assetCertificateArn` (a us-east-1 ACM cert) or `hostedZoneId` (to auto-issue + validate one). CloudFront only accepts certs from us-east-1.");if(o!=="us-east-1")throw Error(`serverless app: auto-issuing an asset-domain cert needs a us-east-1 app (CloudFront certs must be us-east-1); this app is in ${o}. Supply a pre-issued us-east-1 \`assetCertificateArn\` instead.`);A.AssetsCertificate={Type:"AWS::CertificateManager::Certificate",Properties:{DomainName:t.assetDomain,ValidationMethod:"DNS",DomainValidationOptions:[{DomainName:t.assetDomain,HostedZoneId:t.hostedZoneId}]}}}if(t.hostedZoneId)A.AssetsDomainRecord={Type:"AWS::Route53::RecordSet",Properties:{HostedZoneId:t.hostedZoneId,Name:t.assetDomain,Type:"A",AliasTarget:{DNSName:d.getAtt("AssetsDistribution","DomainName"),HostedZoneId:"Z2FDTNDATAQYW2"}}};R.AssetDomain={Description:"Custom asset CDN host",Value:t.assetDomain}}A.AssetsBucketPolicy={Type:"AWS::S3::BucketPolicy",Properties:{Bucket:d.ref("AssetsBucket"),PolicyDocument:{Version:"2012-10-17",Statement:[{Effect:"Allow",Principal:{Service:"cloudfront.amazonaws.com"},Action:"s3:GetObject",Resource:d.sub(`arn:aws:s3:::${C}/*`),Condition:{StringEquals:{"AWS:SourceArn":d.sub("arn:aws:cloudfront::${AWS::AccountId}:distribution/${AssetsDistribution}")}}}]}}},R.AssetsBucketName={Description:"Assets bucket",Value:d.ref("AssetsBucket")},R.AssetsCdnDomain={Description:"Assets CloudFront domain",Value:d.getAtt("AssetsDistribution","DomainName")}}if(t.firewall?.enabled){let N=[],M=0;if(t.firewall.rateLimit)N.push({Name:"rate-limit",Priority:M++,Action:{Block:{}},Statement:{RateBasedStatement:{Limit:t.firewall.rateLimit,AggregateKeyType:"IP"}},VisibilityConfig:{SampledRequestsEnabled:!0,CloudWatchMetricsEnabled:!0,MetricName:`${i}-${n}-rate`}});let G={sqlInjection:"AWSManagedRulesSQLiRuleSet",xss:"AWSManagedRulesCommonRuleSet",common:"AWSManagedRulesCommonRuleSet",botControl:"AWSManagedRulesBotControlRuleSet",ipReputation:"AWSManagedRulesAmazonIpReputationList"};for(let L of t.firewall.rules??[]){let oe=G[L];if(!oe)continue;N.push({Name:`managed-${L}`,Priority:M++,OverrideAction:{None:{}},Statement:{ManagedRuleGroupStatement:{VendorName:"AWS",Name:oe}},VisibilityConfig:{SampledRequestsEnabled:!0,CloudWatchMetricsEnabled:!0,MetricName:`${i}-${n}-${L}`}})}A.WebAcl={Type:"AWS::WAFv2::WebACL",Properties:{Name:`${i}-${n}-waf`,Scope:"REGIONAL",DefaultAction:{Allow:{}},Rules:N,VisibilityConfig:{SampledRequestsEnabled:!0,CloudWatchMetricsEnabled:!0,MetricName:`${i}-${n}-waf`}}},R.WafAclArn={Description:"WAF web ACL ARN. Attach to a CloudFront distribution fronting the API to enforce (HTTP API v2 stages do not support direct WAF association).",Value:d.getAtt("WebAcl","Arn")}}if(q&&F){if(!t.vpc?.id)throw Error("serverless app: data services (elasticache / aurora-serverless / rdsProxy / efs) need app.vpc.id (the VPC id) so the managed security group is created in the right VPC.");A.DataSecurityGroup={Type:"AWS::EC2::SecurityGroup",Properties:{VpcId:t.vpc.id,GroupDescription:`${i}-${n} serverless data access`,SecurityGroupIngress:[{IpProtocol:"-1",CidrIp:"10.0.0.0/8"}]}}}if(O)A.EfsFileSystem={Type:"AWS::EFS::FileSystem",Properties:{Encrypted:!0,FileSystemTags:[{Key:"Name",Value:`${i}-${n}-efs`}]}},_.forEach((N,M)=>{A[`EfsMountTarget${M}`]={Type:"AWS::EFS::MountTarget",Properties:{FileSystemId:d.ref("EfsFileSystem"),SubnetId:N,SecurityGroups:[d.getAtt("DataSecurityGroup","GroupId")]}}}),A.EfsAccessPoint={Type:"AWS::EFS::AccessPoint",Properties:{FileSystemId:d.ref("EfsFileSystem"),PosixUser:{Uid:1001,Gid:1001},RootDirectory:{Path:"/lambda",CreationInfo:{OwnerUid:1001,OwnerGid:1001,Permissions:"0755"}}}},R.EfsFileSystemId={Description:"EFS file system id",Value:d.ref("EfsFileSystem")};if(t.cache?.driver==="elasticache")A.CacheSubnetGroup={Type:"AWS::ElastiCache::SubnetGroup",Properties:{Description:`${i}-${n} cache subnets`,SubnetIds:_}},A.CacheCluster={Type:"AWS::ElastiCache::ReplicationGroup",Properties:{ReplicationGroupId:`${i}-${n}-cache`,ReplicationGroupDescription:`${i}-${n} redis`,Engine:"redis",CacheNodeType:"cache.t4g.micro",NumCacheClusters:1,AutomaticFailoverEnabled:!1,CacheSubnetGroupName:d.ref("CacheSubnetGroup"),SecurityGroupIds:[d.getAtt("DataSecurityGroup","GroupId")],TransitEncryptionEnabled:!1}},R.CacheEndpoint={Description:"Redis primary endpoint",Value:d.getAtt("CacheCluster","PrimaryEndPoint.Address")};if(t.database?.connection==="aurora-serverless")A.DbSubnetGroup={Type:"AWS::RDS::DBSubnetGroup",Properties:{DBSubnetGroupDescription:`${i}-${n} db subnets`,SubnetIds:_}},A.DbSecret={Type:"AWS::SecretsManager::Secret",Properties:{Name:`${i}/${n}/db`,GenerateSecretString:{SecretStringTemplate:JSON.stringify({username:"app"}),GenerateStringKey:"password",PasswordLength:32,ExcludePunctuation:!0}}},A.DbCluster={Type:"AWS::RDS::DBCluster",Properties:{Engine:"aurora-mysql",EngineMode:"provisioned",DBClusterIdentifier:`${i}-${n}-db`,DatabaseName:"app",MasterUsername:d.sub("{{resolve:secretsmanager:${DbSecret}:SecretString:username}}"),MasterUserPassword:d.sub("{{resolve:secretsmanager:${DbSecret}:SecretString:password}}"),ServerlessV2ScalingConfiguration:{MinCapacity:t.database?.minCapacity??0.5,MaxCapacity:t.database?.maxCapacity??4},DBSubnetGroupName:d.ref("DbSubnetGroup"),VpcSecurityGroupIds:[d.getAtt("DataSecurityGroup","GroupId")]}},A.DbInstance={Type:"AWS::RDS::DBInstance",Properties:{Engine:"aurora-mysql",DBInstanceClass:"db.serverless",DBClusterIdentifier:d.ref("DbCluster")}},R.DbEndpoint={Description:"Aurora cluster endpoint",Value:d.getAtt("DbCluster","Endpoint.Address")};if(t.rdsProxy&&t.database?.connection==="aurora-serverless")A.DbProxyRole={Type:"AWS::IAM::Role",Properties:{AssumeRolePolicyDocument:{Version:"2012-10-17",Statement:[{Effect:"Allow",Principal:{Service:"rds.amazonaws.com"},Action:"sts:AssumeRole"}]},Policies:[{PolicyName:"read-db-secret",PolicyDocument:{Version:"2012-10-17",Statement:[{Effect:"Allow",Action:["secretsmanager:GetSecretValue"],Resource:d.ref("DbSecret")}]}}]}},A.DbProxy={Type:"AWS::RDS::DBProxy",Properties:{DBProxyName:typeof t.rdsProxy==="object"&&t.rdsProxy.name?t.rdsProxy.name:`${i}-${n}-proxy`,EngineFamily:"MYSQL",RoleArn:d.getAtt("DbProxyRole","Arn"),Auth:[{AuthScheme:"SECRETS",SecretArn:d.ref("DbSecret"),IAMAuth:"DISABLED"}],VpcSubnetIds:_,VpcSecurityGroupIds:[d.getAtt("DataSecurityGroup","GroupId")],RequireTLS:!1}},A.DbProxyTargetGroup={Type:"AWS::RDS::DBProxyTargetGroup",DependsOn:["DbInstance"],Properties:{DBProxyName:d.ref("DbProxy"),TargetGroupName:"default",DBClusterIdentifiers:[d.ref("DbCluster")]}},R.DbProxyEndpoint={Description:"RDS Proxy endpoint",Value:d.getAtt("DbProxy","Endpoint")};if(R.HttpFunctionName={Description:"HTTP function name",Value:d.ref("HttpFunction")},R.CliFunctionName={Description:"CLI function name",Value:d.ref("CliFunction")},m)R.QueueFunctionName={Description:"Queue function name",Value:d.ref("QueueFunction")};let $e={AWSTemplateFormatVersion:"2010-09-09",Description:`Serverless application for ${e.config.project.name} (${i}-${n})`,Parameters:g?{ImageUri:{Type:"String",Description:"ECR image URI of the deployment artifact"}}:{ArtifactBucket:{Type:"String",Description:"S3 bucket holding the deployment artifact"},ArtifactKey:{Type:"String",Description:"S3 key of the deployment artifact (zip)"}},Resources:A,Outputs:R},Qe={};for(let N of Object.values(A))Qe[N.Type]=(Qe[N.Type]??0)+1;return{template:$e,functionNames:c,queueNames:u,resourceSummary:Qe}}var pl=["cli","fpm","curl","mbstring","xml","pdo","mysqlnd","gd","bcmath","intl","opcache","sodium","process","pecl-redis6","pecl-apcu","pgsql"];function gl(e){let t=`php${e.replace(".","")}`;return pl.map((n)=>`${t}-php-${n}`)}function Wn(e,t){let n=`php${e.replace(".","")}`,r=gl(e).join(" \\\n      "),i=`/opt/remi/${n}/root`,s=`/etc/opt/remi/${n}`;return`${t?`FROM almalinux:9 AS ${t}`:"FROM almalinux:9"}
 
 # Build PHP on AlmaLinux 9 (where Remi's version-isolated SCL packages install
 # cleanly — Remi's release RPM rejects Amazon Linux 2023). AlmaLinux 9 shares
@@ -7338,4 +7338,4 @@ decorate_workers_output = no
 php_admin_value[error_log] = /dev/stderr
 php_admin_flag[log_errors] = on
 clear_env = no
-`}import{readFileSync as Ol}from"node:fs";import{dirname as $l,join as Cs}from"node:path";import{fileURLToPath as Bl}from"node:url";function Fl(){return Cs($l(Bl(import.meta.url)),"runtime-assets")}function jn(){let e=Fl(),t=(n)=>Ol(Cs(e,n),"utf-8");return[{path:"bootstrap",contents:t("bootstrap"),mode:493},{path:"tscloud/runtime.php",contents:t("runtime.php"),mode:420},{path:"tscloud/octane-runtime.php",contents:t("octane-runtime.php"),mode:420},{path:"tscloud/cli-runtime.php",contents:t("cli-runtime.php"),mode:420},{path:"tscloud/fastcgi-client.php",contents:t("fastcgi-client.php"),mode:420},{path:"tscloud/php-fpm.conf",contents:As(),mode:420}]}function EC(e={}){let t=e.cacheDriver??"dynamodb";return{APP_ENV:"production",LOG_CHANNEL:"stderr",CACHE_STORE:t,CACHE_DRIVER:t,SESSION_DRIVER:t,QUEUE_CONNECTION:"sqs",FILESYSTEM_DISK:"s3",VIEW_COMPILED_PATH:"/tmp/storage/framework/views",APP_SERVICES_CACHE:"/tmp/bootstrap/cache/services.php",APP_PACKAGES_CACHE:"/tmp/bootstrap/cache/packages.php",APP_CONFIG_CACHE:"/tmp/bootstrap/cache/config.php",APP_ROUTES_CACHE:"/tmp/bootstrap/cache/routes.php",APP_EVENTS_CACHE:"/tmp/bootstrap/cache/events.php"}}var vs=["composer install --no-dev --optimize-autoloader --no-interaction","php artisan config:cache","php artisan route:cache","php artisan event:cache","php artisan view:cache"];import{execFileSync as Bt}from"node:child_process";import{existsSync as Gl,mkdirSync as _l,mkdtempSync as Wl,readdirSync as Vl,readFileSync as Ul,rmSync as Hl,statSync as Ts,writeFileSync as jl}from"node:fs";import{tmpdir as Kl}from"node:os";import{join as ze,relative as ql}from"node:path";function*Rs(e){for(let t of Vl(e)){let n=ze(e,t);if(Ts(n).isDirectory())yield*Rs(n);else yield n}}function OC(e={}){let t=e.architecture??"x86_64",n=e.platform??(t==="arm64"?"linux/arm64":"linux/amd64"),r=e.onStep??(()=>{}),i=Wl(ze(Kl(),"tscloud-php-layer-")),s="tscloud-php-layer:build";try{jl(ze(i,"Dockerfile"),ts(e)),r("Building PHP runtime image (docker)"),Bt("docker",["build","--platform",n,"-t","tscloud-php-layer:build",i],{stdio:"inherit"}),r("Extracting /opt/php from image");let a=Bt("docker",["create","--platform",n,"tscloud-php-layer:build"],{encoding:"utf-8"}).trim(),o=ze(i,"opt");_l(o,{recursive:!0});try{Bt("docker",["cp",`${a}:/opt/php`,ze(o,"php")],{stdio:"inherit"})}finally{Bt("docker",["rm",a],{stdio:"ignore"})}if(!Gl(ze(o,"php","bin","php")))throw Error("layer build produced no /opt/php/bin/php");let c=[];for(let p of Rs(o)){let g=ql(o,p).replace(/\\/g,"/"),y=Ts(p).mode&73?493:420;c.push({name:g,data:Ul(p),mode:y})}r("Injecting runtime assets");let l=new Set(jn().map((p)=>p.path)),u=c.filter((p)=>!l.has(p.name));for(let p of jn())u.push({name:p.path,data:p.contents,mode:p.mode});return r("Packaging layer ZIP"),{zip:Se(u),architecture:t,fileCount:u.length}}finally{Hl(i,{recursive:!0,force:!0})}}import{execSync as zl}from"node:child_process";import{createHash as Ql}from"node:crypto";import{readdirSync as Jl,readFileSync as Yl,statSync as Ps}from"node:fs";import{join as Zl,relative as Es,resolve as Kn}from"node:path";var Xl=[".git",".github","node_modules","tests","storage/logs","storage/framework/cache","storage/framework/sessions","storage/framework/views",".env",".env.local",".vapor",".ts-cloud","dist-lambda"];function eu(e,t){return t.some((n)=>e===n||e.startsWith(`${n}/`))}function*ws(e,t,n){for(let r of Jl(e)){let i=Zl(e,r),s=Es(t,i).replace(/\\/g,"/");if(eu(s,n))continue;if(Ps(i).isDirectory())yield*ws(i,t,n);else yield i}}function tu(e){if(e.skipBuild)return;let t=Kn(e.projectRoot??process.cwd()),n=e.app.build??vs;for(let r of n)e.onStep?.(`build: ${r}`),zl(r,{stdio:"inherit",cwd:t})}function nu(e,t=[]){let n=Kn(e),r=[...Xl,Fe(),...t],i=[];for(let s of ws(n,n,r)){let a=Es(n,s).replace(/\\/g,"/"),o=(Ps(s).mode&73)!==0;i.push({name:a,data:Yl(s),mode:o?493:420})}return i}function HC(e){let t=Kn(e.projectRoot??process.cwd());tu(e),e.onStep?.("packaging application tree");let n=nu(t,e.exclude);if(!n.length)throw Error(`No files to package under ${t}`);let r=Se(n),i=e.app.handlers?.http??"public/index.php";return{zip:r,sha256:Ql("sha256").update(r).digest("hex"),handlers:{http:i,queue:e.app.handlers?.queue??i,cli:e.app.handlers?.cli??i},fileCount:n.length}}class Is{optimizations=new Map;imageConfigs=new Map;ssgConfigs=new Map;prerenderConfigs=new Map;counter=0;createAssetOptimization(e){let t=`asset-opt-${Date.now()}-${this.counter++}`,n={id:t,...e};return this.optimizations.set(t,n),n}createImageOptimization(e){let t=`image-opt-${Date.now()}-${this.counter++}`,n={id:t,...e};return this.imageConfigs.set(t,n),n}createSSGConfig(e){let t=`ssg-${Date.now()}-${this.counter++}`,n={id:t,...e};return this.ssgConfigs.set(t,n),n}createPrerenderConfig(e){let t=`prerender-${Date.now()}-${this.counter++}`,n={id:t,...e};return this.prerenderConfigs.set(t,n),n}listOptimizations(){return Array.from(this.optimizations.values())}listImageConfigs(){return Array.from(this.imageConfigs.values())}clear(){this.optimizations.clear(),this.imageConfigs.clear(),this.ssgConfigs.clear(),this.prerenderConfigs.clear()}}var ZC=new Is;class qn{policies=new Map;versioningConfigs=new Map;replicationRules=new Map;tieringConfigs=new Map;objectLocks=new Map;transferAcceleration=new Map;accessPoints=new Map;glacierConfigs=new Map;inventories=new Map;batchOps=new Map;eventNotifications=new Map;counter=0;createLifecyclePolicy(e,t){let n=`lifecycle-${Date.now()}-${this.counter++}`,r={id:n,transitions:e,expiration:t};return this.policies.set(n,r),r}enableVersioning(e=!1){let t=`versioning-${Date.now()}-${this.counter++}`,n={id:t,enabled:!0,mfaDelete:e};return this.versioningConfigs.set(t,n),n}createReplicationRule(e,t,n){let r=`replication-${Date.now()}-${this.counter++}`,i={id:r,sourceRegion:e,destRegion:t,destBucket:n};return this.replicationRules.set(r,i),i}createIntelligentTiering(e,t){let n=`tiering-${Date.now()}-${this.counter++}`,r={id:n,archiveDays:e,deepArchiveDays:t};return this.tieringConfigs.set(n,r),r}enableObjectLock(e){let t=`object-lock-${Date.now()}-${this.counter++}`,n={id:t,bucketName:e.bucketName,mode:e.mode||"COMPLIANCE",retentionDays:e.retentionDays,retentionYears:e.retentionYears,legalHoldEnabled:e.legalHoldEnabled||!1};return this.objectLocks.set(t,n),n}enableTransferAcceleration(e){let t=`transfer-accel-${Date.now()}-${this.counter++}`,n={id:t,bucketName:e,enabled:!0,endpoint:`${e}.s3-accelerate.amazonaws.com`};return this.transferAcceleration.set(t,n),n}createAccessPoint(e){let t=`access-point-${Date.now()}-${this.counter++}`,n={id:t,name:e.name,bucketName:e.bucketName,vpcId:e.vpcId,publicAccessBlock:e.publicAccessBlock!==!1,policy:e.policy};return this.accessPoints.set(t,n),n}createGlacierArchive(e){let t=`glacier-${Date.now()}-${this.counter++}`,n={id:t,bucketName:e.bucketName,archiveType:e.archiveType,transitionDays:e.transitionDays,restoreConfig:e.restoreTier?{tier:e.restoreTier,days:e.restoreDays||7}:void 0};return this.glacierConfigs.set(t,n),n}createInventory(e){let t=`inventory-${Date.now()}-${this.counter++}`,n={id:t,sourceBucket:e.sourceBucket,destinationBucket:e.destinationBucket,schedule:e.schedule||"Daily",format:e.format||"CSV",includedFields:e.includedFields||["Size","LastModifiedDate","StorageClass","ETag"],prefix:e.prefix};return this.inventories.set(t,n),n}createBatchOperation(e){let t=`batch-op-${Date.now()}-${this.counter++}`,n={id:t,operation:e.operation,manifestBucket:e.manifestBucket,manifestKey:e.manifestKey,priority:e.priority||10,status:"pending"};return this.batchOps.set(t,n),n}executeBatchOperation(e){let t=this.batchOps.get(e);if(!t)throw Error(`Batch operation not found: ${e}`);return t.status="in_progress",t.totalObjects=1000,t.processedObjects=0,t}getBatchOperationStatus(e){return this.batchOps.get(e)}createLambdaNotification(e){let t=`event-${Date.now()}-${this.counter++}`,n={id:t,bucketName:e.bucketName,events:e.events,destination:{type:"Lambda",arn:e.lambdaArn},filter:e.prefix||e.suffix?{prefix:e.prefix,suffix:e.suffix}:void 0};return this.eventNotifications.set(t,n),n}createSQSNotification(e){let t=`event-${Date.now()}-${this.counter++}`,n={id:t,bucketName:e.bucketName,events:e.events,destination:{type:"SQS",arn:e.queueArn},filter:e.prefix||e.suffix?{prefix:e.prefix,suffix:e.suffix}:void 0};return this.eventNotifications.set(t,n),n}createSNSNotification(e){let t=`event-${Date.now()}-${this.counter++}`,n={id:t,bucketName:e.bucketName,events:e.events,destination:{type:"SNS",arn:e.topicArn},filter:e.prefix||e.suffix?{prefix:e.prefix,suffix:e.suffix}:void 0};return this.eventNotifications.set(t,n),n}generateObjectLockCF(e){let t={ObjectLockEnabled:"Enabled",ObjectLockConfiguration:{ObjectLockEnabled:"Enabled",Rule:{DefaultRetention:{Mode:e.mode}}}};if(e.retentionDays)t.ObjectLockConfiguration.Rule.DefaultRetention.Days=e.retentionDays;if(e.retentionYears)t.ObjectLockConfiguration.Rule.DefaultRetention.Years=e.retentionYears;return t}generateTransferAccelerationCF(e){return{AccelerateConfiguration:{AccelerationStatus:e.enabled?"Enabled":"Suspended"}}}generateAccessPointCF(e){return{Type:"AWS::S3::AccessPoint",Properties:{Name:e.name,Bucket:e.bucketName,...e.vpcId&&{VpcConfiguration:{VpcId:e.vpcId}},PublicAccessBlockConfiguration:e.publicAccessBlock?{BlockPublicAcls:!0,BlockPublicPolicy:!0,IgnorePublicAcls:!0,RestrictPublicBuckets:!0}:void 0,...e.policy&&{Policy:e.policy}}}}generateInventoryCF(e){return{Type:"AWS::S3::Bucket",Properties:{InventoryConfigurations:[{Id:e.id,Destination:{BucketArn:`arn:aws:s3:::${e.destinationBucket}`,Format:e.format},Enabled:!0,IncludedObjectVersions:"Current",OptionalFields:e.includedFields,ScheduleFrequency:e.schedule,...e.prefix&&{Prefix:e.prefix}}]}}}generateEventNotificationCF(e){let t=e.destination.type==="Lambda"?"LambdaConfigurations":e.destination.type==="SQS"?"QueueConfigurations":"TopicConfigurations",n=e.destination.type==="Lambda"?"Function":e.destination.type==="SQS"?"Queue":"Topic",r={Event:e.events[0],[n]:e.destination.arn};if(e.filter)r.Filter={S3Key:{Rules:[...e.filter.prefix?[{Name:"prefix",Value:e.filter.prefix}]:[],...e.filter.suffix?[{Name:"suffix",Value:e.filter.suffix}]:[]]}};return{NotificationConfiguration:{[t]:[r]}}}clear(){this.policies.clear(),this.versioningConfigs.clear(),this.replicationRules.clear(),this.tieringConfigs.clear(),this.objectLocks.clear(),this.transferAcceleration.clear(),this.accessPoints.clear(),this.glacierConfigs.clear(),this.inventories.clear(),this.batchOps.clear(),this.eventNotifications.clear()}}var ru=new qn;class Ds{checks=new Map;synthetics=new Map;uptimeTrackers=new Map;counter=0;createHealthCheck(e,t=30,n=10){let r=`health-${Date.now()}-${this.counter++}`,i={id:r,url:e,interval:t,timeout:n,status:"healthy"};return this.checks.set(r,i),i}createSyntheticMonitor(e,t,n,r){let i=`synthetic-${Date.now()}-${this.counter++}`,s={id:i,name:e,script:t,frequency:n,locations:r};return this.synthetics.set(i,s),s}trackUptime(e,t,n){let r=`uptime-${Date.now()}-${this.counter++}`,i=t/(t+n)*100,s={id:r,resource:e,uptime:t,downtime:n,availability:i};return this.uptimeTrackers.set(r,s),s}clear(){this.checks.clear(),this.synthetics.clear(),this.uptimeTrackers.clear()}}var tv=new Ds;class Ns{wafRules=new Map;shieldProtections=new Map;securityGroups=new Map;nacls=new Map;counter=0;createWAFRule(e,t,n,r){let i=`waf-${Date.now()}-${this.counter++}`,s={id:i,name:e,priority:t,action:n,conditions:r};return this.wafRules.set(i,s),s}enableShield(e,t="standard"){let n=`shield-${Date.now()}-${this.counter++}`,r={id:n,resourceArn:e,protectionType:t};return this.shieldProtections.set(n,r),r}createSecurityGroup(e,t,n){let r=`sg-${Date.now()}-${this.counter++}`,i={id:r,name:e,vpcId:t,rules:n};return this.securityGroups.set(r,i),i}createNACL(e,t){let n=`nacl-${Date.now()}-${this.counter++}`,r={id:n,vpcId:e,rules:t};return this.nacls.set(n,r),r}clear(){this.wafRules.clear(),this.shieldProtections.clear(),this.securityGroups.clear(),this.nacls.clear()}}var rv=new Ns;class xs{strategies=new Map;allocations=new Map;groups=new Map;counter=0;createTaggingStrategy(e,t){let n=`tagging-${Date.now()}-${this.counter++}`,r={id:n,tags:e,resources:t};return this.strategies.set(n,r),r}createCostAllocation(e,t){let n=`cost-${Date.now()}-${this.counter++}`,r={id:n,tagKey:e,allocations:t};return this.allocations.set(n,r),r}createResourceGroup(e,t,n){let r=`group-${Date.now()}-${this.counter++}`,i={id:r,name:e,query:{resourceTypeFilters:t,tagFilters:n}};return this.groups.set(r,i),i}clear(){this.strategies.clear(),this.allocations.clear(),this.groups.clear()}}var sv=new xs;export{Cn as ABTestManager,bt as AI,Vo as AWSAPIError,hn as AWSConfigManager,fp as AWS_PSEUDO_PARAMETERS,ue as AWS_REGIONS,wa as ApiGateway,_e as Arn,j as AssetHasher,Z as Auth,yn as BackupManager,Ji as BatchProcessingManager,An as BlueGreenManager,_i as BounceComplaintHandler,xi as BuildOptimizationManager,se as CDN,us as CHAIN_HEADER,Vt as CLOUDFRONT_FAILOVER_STATUS_CODES,wh as COMMON_CROSS_ACCOUNT_ROLES,Ea as Cache,pt as CanaryManager,Ii as CertificateManager,be as CloudError,Mr as CloudFormationBuilder,Do as CloudFormationClient,_o as CloudFrontClient,bn as CloudTrailManager,Cc as CommandHistory,ee as Communication,x as Compute,Dt as ConfigurationError,En as ContainerRegistryManager,Re as CredentialError,fi as CrossRegionReferenceManager,oo as DASHBOARD_ENTRY,uo as DASHBOARD_PORT_BASE,mo as DASHBOARD_PORT_SPAN,ao as DASHBOARD_STATE_DIR,tr as DEFAULT_FAILOVER_STATUS_CODES,Ot as DEFAULT_RECURSION_LIMITS,te as DEFAULT_SERVICE_LIMITS,_t as DEFAULT_STATE_DIR,da as DEFAULT_STORAGE_FAILOVER_STATUS_CODES,ls as DEPTH_HEADER,Qi as DLQMonitoringManager,J as DNS,Fi as DNSSECManager,zt as Database,Ei as DatabaseUserManager,Q as DebugLogger,aa as DependencyGraph,X as Deployment,Wo as DeploymentError,fn as DisasterRecoveryManager,W as Email,Hi as EmailAdvanced,Wi as EmailAnalyticsManager,ji as EmailHandlers,Ui as EmailTemplateManager,Uo as ErrorCodes,pa as FAILOVER_REPLICA_POLICY_SID,zi as FIFOQueueManager,on as FileCache,et as FileSystem,d as Fn,hi as GlobalResourceManager,Sn as GuardDutyManager,Xo as HashCache,Ds as HealthCheckManager,Ni as ImageScanningManager,Te as JobLoader,vs as LARAVEL_SERVERLESS_BUILD_STEPS,Li as LambdaConcurrencyManager,Bi as LambdaDLQManager,Oi as LambdaDestinationsManager,ki as LambdaLayersManager,$i as LambdaVPCManager,Mi as LambdaVersionsManager,Tn as LogsManager,dl as MANAGED_NODE_VERSIONS,Br as MANAGEMENT_DASHBOARD_SITE_PREFIX,re as Messaging,Ti as MetricsManager,Ri as MigrationManager,li as MockCloudFormation,di as MockDynamoDB,ui as MockS3,fr as Monitoring,Ai as MultiAccountManager,yi as MultiRegionManager,pc as MultiStepProgress,B as Network,Ns as NetworkSecurityManager,ir as ORIGIN_CONNECTION_ATTEMPTS,sr as ORIGIN_CONNECTION_TIMEOUT,nr as ORIGIN_GROUP_ALLOWED_METHODS,ed as ORIGIN_GROUP_ID_SUFFIX,rr as ORIGIN_GROUP_SELECTION_CRITERIA,Ci as OrganizationManager,Xl as PHP_DEFAULT_EXCLUDES,pl as PHP_LAYER_EXTENSIONS,V as ParameterStore,Pi as PerformanceManager,le as Permissions,he as Phone,Ki as PhoneAdvanced,ur as PhoneHandlers,mn as PreviewEnvironmentManager,pn as PreviewNotificationService,mc as ProgressBar,vn as ProgressiveDeploymentManager,sa as Pseudo,ce as Queue,Yi as QueueManagementManager,au as QueuePresets,Pc as RECOMMENDED_ACCOUNT_STRUCTURES,Eh as RECOMMENDED_SCPS,bc as REPL,Ac as REPLCommandBuilder,Sc as REPLContext,ec as RateLimiter,ou as RealtimePresets,Un as RecursionGuard,Ct as Redirects,bi as RegionPairManager,ye as Registry,Rn as ReplicaManager,xs as ResourceManagementManager,Gi as Route53ResolverManager,In as Route53RoutingManager,rn as S3Client,z as S3Error,Y as SMS,Qn as STATE_DIR_ENV_VAR,ma as STORAGE_FAILOVER_METADATA_KEY,rt as Search,nt as Secrets,Pn as SecretsManager,wi as SecretsRotationManager,U as Security,xe as SecurityHubManager,Di as SecurityScanningManager,Vi as SenderReputationManager,wn as ServiceMeshManager,Pa as Sftp,qi as SmsAdvanced,yr as SmsHandlers,gc as Spinner,Si as StackDependencyManager,_d as StacksIntegration,Is as StaticSiteManager,De as Storage,qn as StorageAdvancedManager,ke as SyntheticsManager,ds as TRACE_HEADER,yc as TaskList,Ks as TemplateBuilder,cn as TemplateCache,ti as ValidationError,Ia as Workflow,vi as XRayManager,Lc as abTestManager,lr as amazonLinuxImageId,ha as amazonLinuxImageParameter,Hu as analyzeStackDiff,NA as artifactKey,Ht as assertOriginGroupMethods,Gf as autocomplete,Ic as awsConfigManager,Ec as backupManager,qy as batch,uA as batchProcessingManager,kc as blueGreenManager,dS as bounceComplaintHandler,YA as buildBunRuntimeLayerZip,tg as buildCloudFormationTemplate,md as buildFailoverReplicaPolicyStatement,Au as buildMailEnv,JA as buildNodeRuntimeLayerZip,Hb as buildOptimizationManager,Ut as buildOriginGroup,td as buildOriginGroups,OC as buildPhpRuntimeLayerZip,dd as buildReplicationConfiguration,ud as buildReplicationRole,Mc as canaryManager,rf as categorizeChanges,Fb as certificateManager,Ry as checkIAMPermissions,hs as checkInvocation,Iy as checkServiceQuotas,tc as chunk,Xg as clearSigningKeyCache,ic as cloudConfigSchema,Dc as cloudTrailManager,nu as collectPhpAppEntries,_g as composePresets,FA as composeServerlessAppTemplate,_c as containerRegistryManager,yg as createApiBackendPreset,Ll as createCliHandler,oy as createCredentialProvider,Og as createDashboardSite,Pg as createDataPipelinePreset,ei as createError,mg as createExistingStaticFullStackPreset,pg as createFullStackAppPreset,cC as createHandlers,xl as createHttpHandler,Sg as createJamstackPreset,xg as createLaravelPreset,wg as createMLApiPreset,Cg as createMicroservicesPreset,hf as createMockAWS,sg as createNodeJsServerPreset,og as createNodeJsServerlessPreset,Wg as createPreset,Vr as createPresignedUrl,Qg as createPresignedUrlAsync,Ml as createQueueHandler,Tg as createRealtimeAppPreset,Go as createS3Client,Mg as createServerlessLaravelPreset,lg as createServerlessNodePreset,rg as createStaticSitePreset,Dg as createTraditionalWebAppPreset,hg as createWordPressPreset,Se as createZip,rh as crossRegionReferenceManager,Mb as databaseUserManager,ci as defaultLocalConfig,yu as deploymentCoexistenceError,po as deriveManagementDashboardPort,Yn as detectDeploymentTargets,Sy as detectMisconfigurations,_r as detectServiceRegion,ef as diffTemplates,cA as dlqMonitoringManager,oS as dnssecManager,wc as drManager,pS as emailAnalyticsManager,hS as emailTemplateManager,Nl as eventToRequest,Fr as extendPreset,aA as fifoQueueManager,jy as findChangedFiles,xh as formatAccountStructure,Df as formatBytes,ju as formatDiff,Nf as formatDuration,Wf as formatFlagSuggestions,Kf as formatHistory,qf as formatHistoryStats,kf as formatKeyValue,xf as formatList,If as formatProgressBar,Rc as formatRegion,fh as formatRegionList,Of as formatSuggestion,Ef as formatTable,wf as formatTree,Po as fromEC2Metadata,Eo as fromECSMetadata,vo as fromEnvironment,To as fromSharedCredentials,wo as fromWebIdentity,Sl as functionFingerprint,VA as generateAppImageDockerfile,Yh as generateApprovalConfig,Zi as generateBootstrap,oc as generateCleanupWorkflow,cc as generateCostReportWorkflow,Dh as generateCrossAccountRoleCF,zh as generateDeploymentConfig,Vh as generateDeploymentPipeline,$h as generateDeploymentWorkflow,f as generateLogicalId,Kh as generateManualPipeline,_h as generateMatrixWorkflow,Qh as generateMultiEnvConfig,Uh as generateMultiEnvPipeline,Bh as generateMultiEnvWorkflow,Fh as generatePRPreviewWorkflow,Zh as generateParallelConfig,As as generatePhpFpmConfig,ts as generatePhpLayerDockerfile,Hh as generatePreviewPipeline,ac as generatePreviewWorkflow,S as generateResourceName,Jh as generateScheduledConfig,jh as generateScheduledPipeline,Gh as generateScheduledWorkflow,Zr as getAccountId,ch as getAllRegions,ph as getClosestRegion,Vf as getCommandUsage,Bf as getContextualHelp,lt as getCredentials,sf as getDeploymentStrategy,af as getDiffStats,tf as getDiffSummary,Ho as getErrorDetails,dn as getLocalConfig,gf as getLocalCredentials,pf as getLocalEndpoint,yf as getLocalEnvVars,Dy as getQuotaUsageSummary,Ih as getRecommendedStructure,dt as getRegion,hh as getRegionStats,uh as getRegionsByCompliance,lh as getRegionsByLocation,dh as getRegionsByPricingTier,jo as getRequiredPermissions,ey as getSigningKeyCacheSize,xu as getTimestamp,ih as globalResourceManager,Nc as guardDutyManager,fo as hasManagementDashboardSite,Wy as hashBuffer,Vy as hashDirectory,si as hashFile,Uy as hashManifest,ai as hashString,tv as healthCheckManager,Vb as imageScanningManager,Cl as inspectInvocation,Pl as installRecursionFetch,fs as invocationContext,fa as isArmInstanceType,$f as isLikelyTypo,mf as isLocalDevelopment,ho as isManagementDashboardSiteName,ty as isNodeCryptoAvailable,or as isS3RestEndpoint,du as isStateDirConfigured,mu as isStatePath,mh as isValidRegion,ny as isWebCryptoAvailable,Zb as lambdaConcurrencyManager,iS as lambdaDLQManager,eS as lambdaDestinationsManager,zb as lambdaLayersManager,nS as lambdaVPCManager,Jb as lambdaVersionsManager,EC as laravelServerlessEnvDefaults,$c as logsManager,Vs as mailEnabled,Su as mailFirewallPorts,Cu as mailWebmailSites,Ne as makeAWSRequest,Yg as makeAWSRequestAsync,Jg as makeAWSRequestOnce,Lr as managementDashboardSiteName,We as mergeInfrastructure,Rb as metricsManager,Ib as migrationManager,Th as multiAccountManager,th as multiRegionManager,rv as networkSecurityManager,Rh as organizationManager,HC as packagePhpApp,xA as packageServerlessApp,un as parallel,zy as parallelMap,Qy as parallelWithRetry,Al as parseChain,Zg as parseJSONResponse,It as parseXMLResponse,xb as performanceManager,Wn as phpLayerBuildStage,gl as phpLayerPackages,jn as phpRuntimeLayerAssets,sc as previewManager,lc as previewNotifications,Zy as processInChunks,Oc as progressiveDeploymentManager,ps as propagationHeaders,mA as queueManagementManager,Hy as quickHash,gs as recursionBlockedResponse,sh as regionPairManager,Fc as replicaManager,nf as requiresReplacement,rC as resetRecursionRuntime,oC as resolveApp,hu as resolveAppDatabase,Ru as resolveCloudProvider,je as resolveCredentials,go as resolveDashboardDomain,yo as resolveDashboardDomains,Gu as resolveDeployBucketName,gu as resolveDeploymentMode,ht as resolveFailoverStatusCodes,vu as resolveMailProxy,js as resolveMailService,Fg as resolveManagementDashboardSite,bo as resolveManagementDashboardSites,Ge as resolveOriginConnection,Lu as resolveProjectStackName,BA as resolveQueueNames,es as resolveQueues,Rl as resolveRecursionConfig,Io as resolveRegion,_u as resolveServerlessAppStackName,Wu as resolveServerlessArtifactBucketName,Xn as resolveServerlessAssetBucketName,Xi as resolveServerlessRuntime,Bu as resolveSiteBucketName,$u as resolveSiteResourceName,Ou as resolveSiteStackName,_s as resolveStatePath,Fu as resolveStorageBucketName,cd as resolveStorageFailover,sv as resourceManagementManager,Ss as responseToResult,lS as route53ResolverManager,Vc as route53RoutingManager,ll as runBuildHooks,tu as runPhpBuildHooks,ld as s3RegionalDomain,ku as sanitizeName,Ff as searchCommands,Gc as secretsManager,Ob as secretsRotationManager,xc as securityHubManager,_b as securityScanningManager,yS as senderReputationManager,Jy as sequence,Wc as serviceMeshManager,uu as setStateDir,ul as sha256,El as sharedRecursionGuard,as as sharedRuntimeLoop,H as signRequest,Wr as signRequestAsync,ah as stackDependencyManager,Fe as stateDir,Jn as statePath,ZC as staticSiteManager,ru as storageAdvancedManager,pd as storageFailoverReplicasFromTemplate,gi as suggestCommand,_f as suggestFlags,Py as suggestIAMPolicy,Ny as suggestQuotaIncrease,yh as suggestRegionPairs,gh as suggestRegions,Bc as syntheticsManager,zo as templateCache,Nh as validateAccountStructure,uf as validateAgainstSchema,Uf as validateCommand,by as validateConfiguration,Ty as validateCredentials,cr as validateOriginGroups,ia as validateResourceLimits,qs as validateTemplate,ra as validateTemplateSize,Kg as withCDN,jg as withCache,Hg as withDatabase,bs as withInvocation,Vg as withMonitoring,qg as withQueue,Ug as withSecurity,Yy as withTimeout,vb as xrayManager};
+`}import{readFileSync as Ol}from"node:fs";import{dirname as $l,join as Cs}from"node:path";import{fileURLToPath as Bl}from"node:url";function Fl(){return Cs($l(Bl(import.meta.url)),"runtime-assets")}function jn(){let e=Fl(),t=(n)=>Ol(Cs(e,n),"utf-8");return[{path:"bootstrap",contents:t("bootstrap"),mode:493},{path:"tscloud/runtime.php",contents:t("runtime.php"),mode:420},{path:"tscloud/octane-runtime.php",contents:t("octane-runtime.php"),mode:420},{path:"tscloud/cli-runtime.php",contents:t("cli-runtime.php"),mode:420},{path:"tscloud/fastcgi-client.php",contents:t("fastcgi-client.php"),mode:420},{path:"tscloud/php-fpm.conf",contents:As(),mode:420}]}function EC(e={}){let t=e.cacheDriver??"dynamodb";return{APP_ENV:"production",LOG_CHANNEL:"stderr",CACHE_STORE:t,CACHE_DRIVER:t,SESSION_DRIVER:t,QUEUE_CONNECTION:"sqs",FILESYSTEM_DISK:"s3",VIEW_COMPILED_PATH:"/tmp/storage/framework/views",APP_SERVICES_CACHE:"/tmp/bootstrap/cache/services.php",APP_PACKAGES_CACHE:"/tmp/bootstrap/cache/packages.php",APP_CONFIG_CACHE:"/tmp/bootstrap/cache/config.php",APP_ROUTES_CACHE:"/tmp/bootstrap/cache/routes.php",APP_EVENTS_CACHE:"/tmp/bootstrap/cache/events.php"}}var vs=["composer install --no-dev --optimize-autoloader --no-interaction","php artisan config:cache","php artisan route:cache","php artisan event:cache","php artisan view:cache"];import{execFileSync as Bt}from"node:child_process";import{existsSync as Gl,mkdirSync as _l,mkdtempSync as Wl,readdirSync as Vl,readFileSync as Ul,rmSync as Hl,statSync as Ts,writeFileSync as jl}from"node:fs";import{tmpdir as Kl}from"node:os";import{join as ze,relative as ql}from"node:path";function*Rs(e){for(let t of Vl(e)){let n=ze(e,t);if(Ts(n).isDirectory())yield*Rs(n);else yield n}}function OC(e={}){let t=e.architecture??"x86_64",n=e.platform??(t==="arm64"?"linux/arm64":"linux/amd64"),r=e.onStep??(()=>{}),i=Wl(ze(Kl(),"tscloud-php-layer-")),s="tscloud-php-layer:build";try{jl(ze(i,"Dockerfile"),ts(e)),r("Building PHP runtime image (docker)"),Bt("docker",["build","--platform",n,"-t","tscloud-php-layer:build",i],{stdio:"inherit"}),r("Extracting /opt/php from image");let a=Bt("docker",["create","--platform",n,"tscloud-php-layer:build"],{encoding:"utf-8"}).trim(),o=ze(i,"opt");_l(o,{recursive:!0});try{Bt("docker",["cp",`${a}:/opt/php`,ze(o,"php")],{stdio:"inherit"})}finally{Bt("docker",["rm",a],{stdio:"ignore"})}if(!Gl(ze(o,"php","bin","php")))throw Error("layer build produced no /opt/php/bin/php");let c=[];for(let p of Rs(o)){let g=ql(o,p).replace(/\\/g,"/"),y=Ts(p).mode&73?493:420;c.push({name:g,data:Ul(p),mode:y})}r("Injecting runtime assets");let l=new Set(jn().map((p)=>p.path)),u=c.filter((p)=>!l.has(p.name));for(let p of jn())u.push({name:p.path,data:p.contents,mode:p.mode});return r("Packaging layer ZIP"),{zip:Se(u),architecture:t,fileCount:u.length}}finally{Hl(i,{recursive:!0,force:!0})}}import{execSync as zl}from"node:child_process";import{createHash as Ql}from"node:crypto";import{readdirSync as Jl,readFileSync as Yl,statSync as Ps}from"node:fs";import{join as Zl,relative as Es,resolve as Kn}from"node:path";var Xl=[".git",".github","node_modules","tests","storage/logs","storage/framework/cache","storage/framework/sessions","storage/framework/views",".env",".env.local",".vapor",".ts-cloud","dist-lambda"];function eu(e,t){return t.some((n)=>e===n||e.startsWith(`${n}/`))}function*ws(e,t,n){for(let r of Jl(e)){let i=Zl(e,r),s=Es(t,i).replace(/\\/g,"/");if(eu(s,n))continue;if(Ps(i).isDirectory())yield*ws(i,t,n);else yield i}}function tu(e){if(e.skipBuild)return;let t=Kn(e.projectRoot??process.cwd()),n=e.app.build??vs;for(let r of n)e.onStep?.(`build: ${r}`),zl(r,{stdio:"inherit",cwd:t})}function nu(e,t=[]){let n=Kn(e),r=[...Xl,Fe(),...t],i=[];for(let s of ws(n,n,r)){let a=Es(n,s).replace(/\\/g,"/"),o=(Ps(s).mode&73)!==0;i.push({name:a,data:Yl(s),mode:o?493:420})}return i}function HC(e){let t=Kn(e.projectRoot??process.cwd());tu(e),e.onStep?.("packaging application tree");let n=nu(t,e.exclude);if(!n.length)throw Error(`No files to package under ${t}`);let r=Se(n),i=e.app.handlers?.http??"public/index.php";return{zip:r,sha256:Ql("sha256").update(r).digest("hex"),handlers:{http:i,queue:e.app.handlers?.queue??i,cli:e.app.handlers?.cli??i},fileCount:n.length}}class Is{optimizations=new Map;imageConfigs=new Map;ssgConfigs=new Map;prerenderConfigs=new Map;counter=0;createAssetOptimization(e){let t=`asset-opt-${Date.now()}-${this.counter++}`,n={id:t,...e};return this.optimizations.set(t,n),n}createImageOptimization(e){let t=`image-opt-${Date.now()}-${this.counter++}`,n={id:t,...e};return this.imageConfigs.set(t,n),n}createSSGConfig(e){let t=`ssg-${Date.now()}-${this.counter++}`,n={id:t,...e};return this.ssgConfigs.set(t,n),n}createPrerenderConfig(e){let t=`prerender-${Date.now()}-${this.counter++}`,n={id:t,...e};return this.prerenderConfigs.set(t,n),n}listOptimizations(){return Array.from(this.optimizations.values())}listImageConfigs(){return Array.from(this.imageConfigs.values())}clear(){this.optimizations.clear(),this.imageConfigs.clear(),this.ssgConfigs.clear(),this.prerenderConfigs.clear()}}var ZC=new Is;class qn{policies=new Map;versioningConfigs=new Map;replicationRules=new Map;tieringConfigs=new Map;objectLocks=new Map;transferAcceleration=new Map;accessPoints=new Map;glacierConfigs=new Map;inventories=new Map;batchOps=new Map;eventNotifications=new Map;counter=0;createLifecyclePolicy(e,t){let n=`lifecycle-${Date.now()}-${this.counter++}`,r={id:n,transitions:e,expiration:t};return this.policies.set(n,r),r}enableVersioning(e=!1){let t=`versioning-${Date.now()}-${this.counter++}`,n={id:t,enabled:!0,mfaDelete:e};return this.versioningConfigs.set(t,n),n}createReplicationRule(e,t,n){let r=`replication-${Date.now()}-${this.counter++}`,i={id:r,sourceRegion:e,destRegion:t,destBucket:n};return this.replicationRules.set(r,i),i}createIntelligentTiering(e,t){let n=`tiering-${Date.now()}-${this.counter++}`,r={id:n,archiveDays:e,deepArchiveDays:t};return this.tieringConfigs.set(n,r),r}enableObjectLock(e){let t=`object-lock-${Date.now()}-${this.counter++}`,n={id:t,bucketName:e.bucketName,mode:e.mode||"COMPLIANCE",retentionDays:e.retentionDays,retentionYears:e.retentionYears,legalHoldEnabled:e.legalHoldEnabled||!1};return this.objectLocks.set(t,n),n}enableTransferAcceleration(e){let t=`transfer-accel-${Date.now()}-${this.counter++}`,n={id:t,bucketName:e,enabled:!0,endpoint:`${e}.s3-accelerate.amazonaws.com`};return this.transferAcceleration.set(t,n),n}createAccessPoint(e){let t=`access-point-${Date.now()}-${this.counter++}`,n={id:t,name:e.name,bucketName:e.bucketName,vpcId:e.vpcId,publicAccessBlock:e.publicAccessBlock!==!1,policy:e.policy};return this.accessPoints.set(t,n),n}createGlacierArchive(e){let t=`glacier-${Date.now()}-${this.counter++}`,n={id:t,bucketName:e.bucketName,archiveType:e.archiveType,transitionDays:e.transitionDays,restoreConfig:e.restoreTier?{tier:e.restoreTier,days:e.restoreDays||7}:void 0};return this.glacierConfigs.set(t,n),n}createInventory(e){let t=`inventory-${Date.now()}-${this.counter++}`,n={id:t,sourceBucket:e.sourceBucket,destinationBucket:e.destinationBucket,schedule:e.schedule||"Daily",format:e.format||"CSV",includedFields:e.includedFields||["Size","LastModifiedDate","StorageClass","ETag"],prefix:e.prefix};return this.inventories.set(t,n),n}createBatchOperation(e){let t=`batch-op-${Date.now()}-${this.counter++}`,n={id:t,operation:e.operation,manifestBucket:e.manifestBucket,manifestKey:e.manifestKey,priority:e.priority||10,status:"pending"};return this.batchOps.set(t,n),n}executeBatchOperation(e){let t=this.batchOps.get(e);if(!t)throw Error(`Batch operation not found: ${e}`);return t.status="in_progress",t.totalObjects=1000,t.processedObjects=0,t}getBatchOperationStatus(e){return this.batchOps.get(e)}createLambdaNotification(e){let t=`event-${Date.now()}-${this.counter++}`,n={id:t,bucketName:e.bucketName,events:e.events,destination:{type:"Lambda",arn:e.lambdaArn},filter:e.prefix||e.suffix?{prefix:e.prefix,suffix:e.suffix}:void 0};return this.eventNotifications.set(t,n),n}createSQSNotification(e){let t=`event-${Date.now()}-${this.counter++}`,n={id:t,bucketName:e.bucketName,events:e.events,destination:{type:"SQS",arn:e.queueArn},filter:e.prefix||e.suffix?{prefix:e.prefix,suffix:e.suffix}:void 0};return this.eventNotifications.set(t,n),n}createSNSNotification(e){let t=`event-${Date.now()}-${this.counter++}`,n={id:t,bucketName:e.bucketName,events:e.events,destination:{type:"SNS",arn:e.topicArn},filter:e.prefix||e.suffix?{prefix:e.prefix,suffix:e.suffix}:void 0};return this.eventNotifications.set(t,n),n}generateObjectLockCF(e){let t={ObjectLockEnabled:"Enabled",ObjectLockConfiguration:{ObjectLockEnabled:"Enabled",Rule:{DefaultRetention:{Mode:e.mode}}}};if(e.retentionDays)t.ObjectLockConfiguration.Rule.DefaultRetention.Days=e.retentionDays;if(e.retentionYears)t.ObjectLockConfiguration.Rule.DefaultRetention.Years=e.retentionYears;return t}generateTransferAccelerationCF(e){return{AccelerateConfiguration:{AccelerationStatus:e.enabled?"Enabled":"Suspended"}}}generateAccessPointCF(e){return{Type:"AWS::S3::AccessPoint",Properties:{Name:e.name,Bucket:e.bucketName,...e.vpcId&&{VpcConfiguration:{VpcId:e.vpcId}},PublicAccessBlockConfiguration:e.publicAccessBlock?{BlockPublicAcls:!0,BlockPublicPolicy:!0,IgnorePublicAcls:!0,RestrictPublicBuckets:!0}:void 0,...e.policy&&{Policy:e.policy}}}}generateInventoryCF(e){return{Type:"AWS::S3::Bucket",Properties:{InventoryConfigurations:[{Id:e.id,Destination:{BucketArn:`arn:aws:s3:::${e.destinationBucket}`,Format:e.format},Enabled:!0,IncludedObjectVersions:"Current",OptionalFields:e.includedFields,ScheduleFrequency:e.schedule,...e.prefix&&{Prefix:e.prefix}}]}}}generateEventNotificationCF(e){let t=e.destination.type==="Lambda"?"LambdaConfigurations":e.destination.type==="SQS"?"QueueConfigurations":"TopicConfigurations",n=e.destination.type==="Lambda"?"Function":e.destination.type==="SQS"?"Queue":"Topic",r={Event:e.events[0],[n]:e.destination.arn};if(e.filter)r.Filter={S3Key:{Rules:[...e.filter.prefix?[{Name:"prefix",Value:e.filter.prefix}]:[],...e.filter.suffix?[{Name:"suffix",Value:e.filter.suffix}]:[]]}};return{NotificationConfiguration:{[t]:[r]}}}clear(){this.policies.clear(),this.versioningConfigs.clear(),this.replicationRules.clear(),this.tieringConfigs.clear(),this.objectLocks.clear(),this.transferAcceleration.clear(),this.accessPoints.clear(),this.glacierConfigs.clear(),this.inventories.clear(),this.batchOps.clear(),this.eventNotifications.clear()}}var ru=new qn;class Ds{checks=new Map;synthetics=new Map;uptimeTrackers=new Map;counter=0;createHealthCheck(e,t=30,n=10){let r=`health-${Date.now()}-${this.counter++}`,i={id:r,url:e,interval:t,timeout:n,status:"healthy"};return this.checks.set(r,i),i}createSyntheticMonitor(e,t,n,r){let i=`synthetic-${Date.now()}-${this.counter++}`,s={id:i,name:e,script:t,frequency:n,locations:r};return this.synthetics.set(i,s),s}trackUptime(e,t,n){let r=`uptime-${Date.now()}-${this.counter++}`,i=t/(t+n)*100,s={id:r,resource:e,uptime:t,downtime:n,availability:i};return this.uptimeTrackers.set(r,s),s}clear(){this.checks.clear(),this.synthetics.clear(),this.uptimeTrackers.clear()}}var tv=new Ds;class Ns{wafRules=new Map;shieldProtections=new Map;securityGroups=new Map;nacls=new Map;counter=0;createWAFRule(e,t,n,r){let i=`waf-${Date.now()}-${this.counter++}`,s={id:i,name:e,priority:t,action:n,conditions:r};return this.wafRules.set(i,s),s}enableShield(e,t="standard"){let n=`shield-${Date.now()}-${this.counter++}`,r={id:n,resourceArn:e,protectionType:t};return this.shieldProtections.set(n,r),r}createSecurityGroup(e,t,n){let r=`sg-${Date.now()}-${this.counter++}`,i={id:r,name:e,vpcId:t,rules:n};return this.securityGroups.set(r,i),i}createNACL(e,t){let n=`nacl-${Date.now()}-${this.counter++}`,r={id:n,vpcId:e,rules:t};return this.nacls.set(n,r),r}clear(){this.wafRules.clear(),this.shieldProtections.clear(),this.securityGroups.clear(),this.nacls.clear()}}var rv=new Ns;class xs{strategies=new Map;allocations=new Map;groups=new Map;counter=0;createTaggingStrategy(e,t){let n=`tagging-${Date.now()}-${this.counter++}`,r={id:n,tags:e,resources:t};return this.strategies.set(n,r),r}createCostAllocation(e,t){let n=`cost-${Date.now()}-${this.counter++}`,r={id:n,tagKey:e,allocations:t};return this.allocations.set(n,r),r}createResourceGroup(e,t,n){let r=`group-${Date.now()}-${this.counter++}`,i={id:r,name:e,query:{resourceTypeFilters:t,tagFilters:n}};return this.groups.set(r,i),i}clear(){this.strategies.clear(),this.allocations.clear(),this.groups.clear()}}var sv=new xs;export{Cn as ABTestManager,bt as AI,Vo as AWSAPIError,hn as AWSConfigManager,fp as AWS_PSEUDO_PARAMETERS,ue as AWS_REGIONS,wa as ApiGateway,_e as Arn,K as AssetHasher,Z as Auth,yn as BackupManager,Ji as BatchProcessingManager,An as BlueGreenManager,_i as BounceComplaintHandler,xi as BuildOptimizationManager,se as CDN,us as CHAIN_HEADER,Vt as CLOUDFRONT_FAILOVER_STATUS_CODES,wh as COMMON_CROSS_ACCOUNT_ROLES,Ea as Cache,pt as CanaryManager,Ii as CertificateManager,be as CloudError,Mr as CloudFormationBuilder,Do as CloudFormationClient,_o as CloudFrontClient,bn as CloudTrailManager,Cc as CommandHistory,ee as Communication,x as Compute,Dt as ConfigurationError,En as ContainerRegistryManager,Re as CredentialError,fi as CrossRegionReferenceManager,oo as DASHBOARD_ENTRY,uo as DASHBOARD_PORT_BASE,mo as DASHBOARD_PORT_SPAN,ao as DASHBOARD_STATE_DIR,tr as DEFAULT_FAILOVER_STATUS_CODES,Ot as DEFAULT_RECURSION_LIMITS,te as DEFAULT_SERVICE_LIMITS,_t as DEFAULT_STATE_DIR,da as DEFAULT_STORAGE_FAILOVER_STATUS_CODES,ls as DEPTH_HEADER,Qi as DLQMonitoringManager,J as DNS,Fi as DNSSECManager,zt as Database,Ei as DatabaseUserManager,Q as DebugLogger,aa as DependencyGraph,X as Deployment,Wo as DeploymentError,fn as DisasterRecoveryManager,V as Email,Hi as EmailAdvanced,Wi as EmailAnalyticsManager,ji as EmailHandlers,Ui as EmailTemplateManager,Uo as ErrorCodes,pa as FAILOVER_REPLICA_POLICY_SID,zi as FIFOQueueManager,on as FileCache,et as FileSystem,d as Fn,hi as GlobalResourceManager,Sn as GuardDutyManager,Xo as HashCache,Ds as HealthCheckManager,Ni as ImageScanningManager,Te as JobLoader,vs as LARAVEL_SERVERLESS_BUILD_STEPS,Li as LambdaConcurrencyManager,Bi as LambdaDLQManager,Oi as LambdaDestinationsManager,ki as LambdaLayersManager,$i as LambdaVPCManager,Mi as LambdaVersionsManager,Tn as LogsManager,dl as MANAGED_NODE_VERSIONS,Br as MANAGEMENT_DASHBOARD_SITE_PREFIX,re as Messaging,Ti as MetricsManager,Ri as MigrationManager,li as MockCloudFormation,di as MockDynamoDB,ui as MockS3,fr as Monitoring,Ai as MultiAccountManager,yi as MultiRegionManager,pc as MultiStepProgress,B as Network,Ns as NetworkSecurityManager,ir as ORIGIN_CONNECTION_ATTEMPTS,sr as ORIGIN_CONNECTION_TIMEOUT,nr as ORIGIN_GROUP_ALLOWED_METHODS,ed as ORIGIN_GROUP_ID_SUFFIX,rr as ORIGIN_GROUP_SELECTION_CRITERIA,Ci as OrganizationManager,Xl as PHP_DEFAULT_EXCLUDES,pl as PHP_LAYER_EXTENSIONS,U as ParameterStore,Pi as PerformanceManager,le as Permissions,he as Phone,Ki as PhoneAdvanced,ur as PhoneHandlers,mn as PreviewEnvironmentManager,pn as PreviewNotificationService,mc as ProgressBar,vn as ProgressiveDeploymentManager,sa as Pseudo,ce as Queue,Yi as QueueManagementManager,au as QueuePresets,Pc as RECOMMENDED_ACCOUNT_STRUCTURES,Eh as RECOMMENDED_SCPS,bc as REPL,Ac as REPLCommandBuilder,Sc as REPLContext,ec as RateLimiter,ou as RealtimePresets,Un as RecursionGuard,Ct as Redirects,bi as RegionPairManager,ye as Registry,Rn as ReplicaManager,xs as ResourceManagementManager,Gi as Route53ResolverManager,In as Route53RoutingManager,rn as S3Client,z as S3Error,Y as SMS,Qn as STATE_DIR_ENV_VAR,ma as STORAGE_FAILOVER_METADATA_KEY,rt as Search,nt as Secrets,Pn as SecretsManager,wi as SecretsRotationManager,H as Security,xe as SecurityHubManager,Di as SecurityScanningManager,Vi as SenderReputationManager,wn as ServiceMeshManager,Pa as Sftp,qi as SmsAdvanced,yr as SmsHandlers,gc as Spinner,Si as StackDependencyManager,_d as StacksIntegration,Is as StaticSiteManager,De as Storage,qn as StorageAdvancedManager,ke as SyntheticsManager,ds as TRACE_HEADER,yc as TaskList,Ks as TemplateBuilder,cn as TemplateCache,ti as ValidationError,Ia as Workflow,vi as XRayManager,Lc as abTestManager,lr as amazonLinuxImageId,ha as amazonLinuxImageParameter,Hu as analyzeStackDiff,NA as artifactKey,Ht as assertOriginGroupMethods,Gf as autocomplete,Ic as awsConfigManager,Ec as backupManager,qy as batch,uA as batchProcessingManager,kc as blueGreenManager,dS as bounceComplaintHandler,YA as buildBunRuntimeLayerZip,tg as buildCloudFormationTemplate,md as buildFailoverReplicaPolicyStatement,Au as buildMailEnv,JA as buildNodeRuntimeLayerZip,Hb as buildOptimizationManager,Ut as buildOriginGroup,td as buildOriginGroups,OC as buildPhpRuntimeLayerZip,dd as buildReplicationConfiguration,ud as buildReplicationRole,Mc as canaryManager,rf as categorizeChanges,Fb as certificateManager,Ry as checkIAMPermissions,hs as checkInvocation,Iy as checkServiceQuotas,tc as chunk,Xg as clearSigningKeyCache,ic as cloudConfigSchema,Dc as cloudTrailManager,nu as collectPhpAppEntries,_g as composePresets,FA as composeServerlessAppTemplate,_c as containerRegistryManager,yg as createApiBackendPreset,Ll as createCliHandler,oy as createCredentialProvider,Og as createDashboardSite,Pg as createDataPipelinePreset,ei as createError,mg as createExistingStaticFullStackPreset,pg as createFullStackAppPreset,cC as createHandlers,xl as createHttpHandler,Sg as createJamstackPreset,xg as createLaravelPreset,wg as createMLApiPreset,Cg as createMicroservicesPreset,hf as createMockAWS,sg as createNodeJsServerPreset,og as createNodeJsServerlessPreset,Wg as createPreset,Vr as createPresignedUrl,Qg as createPresignedUrlAsync,Ml as createQueueHandler,Tg as createRealtimeAppPreset,Go as createS3Client,Mg as createServerlessLaravelPreset,lg as createServerlessNodePreset,rg as createStaticSitePreset,Dg as createTraditionalWebAppPreset,hg as createWordPressPreset,Se as createZip,rh as crossRegionReferenceManager,Mb as databaseUserManager,ci as defaultLocalConfig,yu as deploymentCoexistenceError,po as deriveManagementDashboardPort,Yn as detectDeploymentTargets,Sy as detectMisconfigurations,_r as detectServiceRegion,ef as diffTemplates,cA as dlqMonitoringManager,oS as dnssecManager,wc as drManager,pS as emailAnalyticsManager,hS as emailTemplateManager,Nl as eventToRequest,Fr as extendPreset,aA as fifoQueueManager,jy as findChangedFiles,xh as formatAccountStructure,Df as formatBytes,ju as formatDiff,Nf as formatDuration,Wf as formatFlagSuggestions,Kf as formatHistory,qf as formatHistoryStats,kf as formatKeyValue,xf as formatList,If as formatProgressBar,Rc as formatRegion,fh as formatRegionList,Of as formatSuggestion,Ef as formatTable,wf as formatTree,Po as fromEC2Metadata,Eo as fromECSMetadata,vo as fromEnvironment,To as fromSharedCredentials,wo as fromWebIdentity,Sl as functionFingerprint,VA as generateAppImageDockerfile,Yh as generateApprovalConfig,Zi as generateBootstrap,oc as generateCleanupWorkflow,cc as generateCostReportWorkflow,Dh as generateCrossAccountRoleCF,zh as generateDeploymentConfig,Vh as generateDeploymentPipeline,$h as generateDeploymentWorkflow,f as generateLogicalId,Kh as generateManualPipeline,_h as generateMatrixWorkflow,Qh as generateMultiEnvConfig,Uh as generateMultiEnvPipeline,Bh as generateMultiEnvWorkflow,Fh as generatePRPreviewWorkflow,Zh as generateParallelConfig,As as generatePhpFpmConfig,ts as generatePhpLayerDockerfile,Hh as generatePreviewPipeline,ac as generatePreviewWorkflow,S as generateResourceName,Jh as generateScheduledConfig,jh as generateScheduledPipeline,Gh as generateScheduledWorkflow,Zr as getAccountId,ch as getAllRegions,ph as getClosestRegion,Vf as getCommandUsage,Bf as getContextualHelp,lt as getCredentials,sf as getDeploymentStrategy,af as getDiffStats,tf as getDiffSummary,Ho as getErrorDetails,dn as getLocalConfig,gf as getLocalCredentials,pf as getLocalEndpoint,yf as getLocalEnvVars,Dy as getQuotaUsageSummary,Ih as getRecommendedStructure,dt as getRegion,hh as getRegionStats,uh as getRegionsByCompliance,lh as getRegionsByLocation,dh as getRegionsByPricingTier,jo as getRequiredPermissions,ey as getSigningKeyCacheSize,xu as getTimestamp,ih as globalResourceManager,Nc as guardDutyManager,fo as hasManagementDashboardSite,Wy as hashBuffer,Vy as hashDirectory,si as hashFile,Uy as hashManifest,ai as hashString,tv as healthCheckManager,Vb as imageScanningManager,Cl as inspectInvocation,Pl as installRecursionFetch,fs as invocationContext,fa as isArmInstanceType,$f as isLikelyTypo,mf as isLocalDevelopment,ho as isManagementDashboardSiteName,ty as isNodeCryptoAvailable,or as isS3RestEndpoint,du as isStateDirConfigured,mu as isStatePath,mh as isValidRegion,ny as isWebCryptoAvailable,Zb as lambdaConcurrencyManager,iS as lambdaDLQManager,eS as lambdaDestinationsManager,zb as lambdaLayersManager,nS as lambdaVPCManager,Jb as lambdaVersionsManager,EC as laravelServerlessEnvDefaults,$c as logsManager,Vs as mailEnabled,Su as mailFirewallPorts,Cu as mailWebmailSites,Ne as makeAWSRequest,Yg as makeAWSRequestAsync,Jg as makeAWSRequestOnce,Lr as managementDashboardSiteName,We as mergeInfrastructure,Rb as metricsManager,Ib as migrationManager,Th as multiAccountManager,th as multiRegionManager,rv as networkSecurityManager,Rh as organizationManager,HC as packagePhpApp,xA as packageServerlessApp,un as parallel,zy as parallelMap,Qy as parallelWithRetry,Al as parseChain,Zg as parseJSONResponse,It as parseXMLResponse,xb as performanceManager,Wn as phpLayerBuildStage,gl as phpLayerPackages,jn as phpRuntimeLayerAssets,sc as previewManager,lc as previewNotifications,Zy as processInChunks,Oc as progressiveDeploymentManager,ps as propagationHeaders,mA as queueManagementManager,Hy as quickHash,gs as recursionBlockedResponse,sh as regionPairManager,Fc as replicaManager,nf as requiresReplacement,rC as resetRecursionRuntime,oC as resolveApp,hu as resolveAppDatabase,Ru as resolveCloudProvider,je as resolveCredentials,go as resolveDashboardDomain,yo as resolveDashboardDomains,Gu as resolveDeployBucketName,gu as resolveDeploymentMode,ht as resolveFailoverStatusCodes,vu as resolveMailProxy,js as resolveMailService,Fg as resolveManagementDashboardSite,bo as resolveManagementDashboardSites,Ge as resolveOriginConnection,Lu as resolveProjectStackName,BA as resolveQueueNames,es as resolveQueues,Rl as resolveRecursionConfig,Io as resolveRegion,_u as resolveServerlessAppStackName,Wu as resolveServerlessArtifactBucketName,Xn as resolveServerlessAssetBucketName,Xi as resolveServerlessRuntime,Bu as resolveSiteBucketName,$u as resolveSiteResourceName,Ou as resolveSiteStackName,_s as resolveStatePath,Fu as resolveStorageBucketName,cd as resolveStorageFailover,sv as resourceManagementManager,Ss as responseToResult,lS as route53ResolverManager,Vc as route53RoutingManager,ll as runBuildHooks,tu as runPhpBuildHooks,ld as s3RegionalDomain,ku as sanitizeName,Ff as searchCommands,Gc as secretsManager,Ob as secretsRotationManager,xc as securityHubManager,_b as securityScanningManager,yS as senderReputationManager,Jy as sequence,Wc as serviceMeshManager,uu as setStateDir,ul as sha256,El as sharedRecursionGuard,as as sharedRuntimeLoop,j as signRequest,Wr as signRequestAsync,ah as stackDependencyManager,Fe as stateDir,Jn as statePath,ZC as staticSiteManager,ru as storageAdvancedManager,pd as storageFailoverReplicasFromTemplate,gi as suggestCommand,_f as suggestFlags,Py as suggestIAMPolicy,Ny as suggestQuotaIncrease,yh as suggestRegionPairs,gh as suggestRegions,Bc as syntheticsManager,zo as templateCache,Nh as validateAccountStructure,uf as validateAgainstSchema,Uf as validateCommand,by as validateConfiguration,Ty as validateCredentials,cr as validateOriginGroups,ia as validateResourceLimits,qs as validateTemplate,ra as validateTemplateSize,Kg as withCDN,jg as withCache,Hg as withDatabase,bs as withInvocation,Vg as withMonitoring,qg as withQueue,Ug as withSecurity,Yy as withTimeout,vb as xrayManager};

package/dist/types.d.ts

@@ -4244,6 +4244,11 @@ export interface MailPortsConfig {
 }
 /** TLS for the mail server's SMTP/IMAP listeners. */
 export interface MailTlsConfig {
+    /** Root-owned gateway certificate sources delivered through systemd credentials. */
+    systemCredentials?: {
+        certPath: string;
+        keyPath: string;
+    };
     /** Serve TLS at all. @default true for a server, false for a catcher. */
     enabled?: boolean;
     /**

package/package.json

@@ -1,7 +1,7 @@
 {
   "name": "@ts-cloud/core",
   "type": "module",
-  "version": "0.16.82",
+  "version": "0.16.83",
   "description": "Core CloudFormation generation library for ts-cloud",
   "author": "Chris Breuer <chris@stacksjs.com>",
   "license": "MIT",
@@ -31,7 +31,7 @@
     "typecheck": "tsc --noEmit"
   },
   "dependencies": {
-    "@ts-cloud/aws-types": "0.16.82"
+    "@ts-cloud/aws-types": "0.16.83"
   },
   "devDependencies": {
     "typescript": "^7.0.2"