@ts-cloud/core 0.2.2 → 0.2.4

package/dist/modules/compute.d.ts

@@ -0,0 +1,1376 @@
+import type { ApplicationLoadBalancer, AutoScalingGroup, AutoScalingLaunchConfiguration, AutoScalingScalingPolicy, EC2Instance, EC2SecurityGroup, ECSCluster, ECSService, ECSTaskDefinition, IAMRole, LambdaFunction, Listener, TargetGroup } from '@ts-cloud/aws-types';
+import type { EnvironmentType } from '../types';
+export interface ServerOptions {
+    slug: string;
+    environment: EnvironmentType;
+    instanceType?: string;
+    imageId?: string;
+    keyName?: string;
+    securityGroupIds?: string[];
+    subnetId?: string;
+    userData?: string;
+    volumeSize?: number;
+    volumeType?: 'gp2' | 'gp3' | 'io1' | 'io2';
+    encrypted?: boolean;
+}
+export interface SecurityGroupOptions {
+    slug: string;
+    environment: EnvironmentType;
+    vpcId?: string;
+    description?: string;
+    ingress?: SecurityGroupRule[];
+    egress?: SecurityGroupRule[];
+}
+export interface SecurityGroupRule {
+    protocol: string;
+    fromPort?: number;
+    toPort?: number;
+    cidr?: string;
+    sourceSecurityGroupId?: string;
+}
+export interface LoadBalancerOptions {
+    slug: string;
+    environment: EnvironmentType;
+    scheme?: 'internet-facing' | 'internal';
+    subnets: string[];
+    securityGroups?: string[];
+    type?: 'application' | 'network';
+}
+export interface TargetGroupOptions {
+    slug: string;
+    environment: EnvironmentType;
+    port: number;
+    protocol?: 'HTTP' | 'HTTPS' | 'TCP';
+    vpcId: string;
+    targetType?: 'instance' | 'ip' | 'lambda';
+    healthCheckPath?: string;
+    healthCheckInterval?: number;
+    healthCheckTimeout?: number;
+    healthyThreshold?: number;
+    unhealthyThreshold?: number;
+}
+export interface ListenerOptions {
+    port: number;
+    protocol?: 'HTTP' | 'HTTPS';
+    certificateArn?: string;
+    defaultTargetGroupArn: string;
+}
+export interface FargateServiceOptions {
+    slug: string;
+    environment: EnvironmentType;
+    image: string;
+    cpu?: string;
+    memory?: string;
+    desiredCount?: number;
+    containerPort?: number;
+    environmentVariables?: Record<string, string>;
+    secrets?: Array<{
+        name: string;
+        valueFrom: string;
+    }>;
+    healthCheck?: {
+        command: string[];
+        interval?: number;
+        timeout?: number;
+        retries?: number;
+    };
+    logGroup?: string;
+    subnets: string[];
+    securityGroups: string[];
+    targetGroupArn?: string;
+}
+export interface LambdaFunctionOptions {
+    slug: string;
+    environment: EnvironmentType;
+    functionName?: string;
+    runtime: string;
+    handler: string;
+    code: {
+        s3Bucket?: string;
+        s3Key?: string;
+        zipFile?: string;
+    };
+    role?: string;
+    timeout?: number;
+    memorySize?: number;
+    environmentVariables?: Record<string, string>;
+    vpcConfig?: {
+        securityGroupIds: string[];
+        subnetIds: string[];
+    };
+}
+export interface LaunchConfigurationOptions {
+    slug: string;
+    environment: EnvironmentType;
+    imageId: string;
+    instanceType: string;
+    keyName?: string;
+    securityGroups?: Array<string | {
+        Ref: string;
+    }>;
+    userData?: string;
+    volumeSize?: number;
+    volumeType?: 'gp2' | 'gp3' | 'io1' | 'io2';
+    encrypted?: boolean;
+    iamInstanceProfile?: string | {
+        Ref: string;
+    };
+}
+export interface AutoScalingGroupOptions {
+    slug: string;
+    environment: EnvironmentType;
+    launchConfigurationName: string | {
+        Ref: string;
+    };
+    minSize: number;
+    maxSize: number;
+    desiredCapacity?: number;
+    vpcZoneIdentifier?: string[] | {
+        Ref: string;
+    };
+    targetGroupArns?: Array<string | {
+        Ref: string;
+    }>;
+    healthCheckType?: 'EC2' | 'ELB';
+    healthCheckGracePeriod?: number;
+    cooldown?: number;
+    tags?: Record<string, string>;
+}
+export interface ScalingPolicyOptions {
+    slug: string;
+    environment: EnvironmentType;
+    autoScalingGroupName: string | {
+        Ref: string;
+    };
+    policyType?: 'TargetTrackingScaling' | 'StepScaling' | 'SimpleScaling';
+    targetValue?: number;
+    predefinedMetricType?: 'ASGAverageCPUUtilization' | 'ASGAverageNetworkIn' | 'ASGAverageNetworkOut' | 'ALBRequestCountPerTarget';
+    scaleInCooldown?: number;
+    scaleOutCooldown?: number;
+}
+/**
+ * Compute Module - EC2, ECS, Lambda Management
+ * Provides clean API for both server (Forge-style) and serverless (Vapor-style) deployments
+ */
+export declare class Compute {
+    /**
+     * Create an EC2 server instance (Server Mode - Forge-style)
+     */
+    static createServer(options: ServerOptions): {
+        instance: EC2Instance;
+        logicalId: string;
+    };
+    /**
+     * Create a security group
+     */
+    static createSecurityGroup(options: SecurityGroupOptions): {
+        securityGroup: EC2SecurityGroup;
+        logicalId: string;
+    };
+    /**
+     * Create common security group rules for web servers
+     */
+    static createWebServerSecurityGroup(slug: string, environment: EnvironmentType, vpcId?: string): {
+        securityGroup: EC2SecurityGroup;
+        logicalId: string;
+    };
+    /**
+     * Create an Application Load Balancer
+     */
+    static createLoadBalancer(options: LoadBalancerOptions): {
+        loadBalancer: ApplicationLoadBalancer;
+        logicalId: string;
+    };
+    /**
+     * Create a target group
+     */
+    static createTargetGroup(options: TargetGroupOptions): {
+        targetGroup: TargetGroup;
+        logicalId: string;
+    };
+    /**
+     * Create an ALB listener
+     */
+    static createListener(loadBalancerLogicalId: string, options: ListenerOptions): {
+        listener: Listener;
+        logicalId: string;
+    };
+    /**
+     * Create ECS cluster for Fargate (Serverless Mode - Vapor-style)
+     */
+    static createEcsCluster(slug: string, environment: EnvironmentType): {
+        cluster: ECSCluster;
+        logicalId: string;
+    };
+    /**
+     * Create ECS Fargate task definition and service
+     */
+    static createFargateService(options: FargateServiceOptions): {
+        cluster: ECSCluster;
+        taskDefinition: ECSTaskDefinition;
+        service: ECSService;
+        taskRole: IAMRole;
+        executionRole: IAMRole;
+        clusterLogicalId: string;
+        taskDefinitionLogicalId: string;
+        serviceLogicalId: string;
+        taskRoleLogicalId: string;
+        executionRoleLogicalId: string;
+    };
+    /**
+     * Create a Lambda function
+     */
+    static createLambdaFunction(options: LambdaFunctionOptions): {
+        lambdaFunction: LambdaFunction;
+        role: IAMRole;
+        logicalId: string;
+        roleLogicalId: string;
+    };
+    /**
+     * Generate Node.js server user data script
+     */
+    static generateNodeServerUserData(options?: {
+        nodeVersion?: string;
+        appRepo?: string;
+        environment?: Record<string, string>;
+    }): string;
+    /**
+     * Generate Bun server user data script
+     */
+    static generateBunServerUserData(options?: {
+        appRepo?: string;
+        environment?: Record<string, string>;
+    }): string;
+    /**
+     * Create a Launch Configuration for Auto Scaling
+     */
+    static createLaunchConfiguration(options: LaunchConfigurationOptions): {
+        launchConfiguration: AutoScalingLaunchConfiguration;
+        logicalId: string;
+    };
+    /**
+     * Create an Auto Scaling Group
+     */
+    static createAutoScalingGroup(options: AutoScalingGroupOptions): {
+        autoScalingGroup: AutoScalingGroup;
+        logicalId: string;
+    };
+    /**
+     * Create a Target Tracking Scaling Policy (CPU-based by default)
+     */
+    static createScalingPolicy(options: ScalingPolicyOptions): {
+        scalingPolicy: AutoScalingScalingPolicy;
+        logicalId: string;
+    };
+    /**
+     * Common Auto Scaling configurations
+     */
+    static readonly AutoScaling: {
+        /**
+         * Small web server auto scaling (2-4 instances)
+         */
+        smallWebServer: (slug: string, environment: EnvironmentType, launchConfigRef: string | {
+            Ref: string;
+        }, subnetIds: string[], targetGroupArns?: Array<string | {
+            Ref: string;
+        }>) => {
+            autoScalingGroup: AutoScalingGroup;
+            logicalId: string;
+        };
+        /**
+         * Medium web server auto scaling (3-10 instances)
+         */
+        mediumWebServer: (slug: string, environment: EnvironmentType, launchConfigRef: string | {
+            Ref: string;
+        }, subnetIds: string[], targetGroupArns?: Array<string | {
+            Ref: string;
+        }>) => {
+            autoScalingGroup: AutoScalingGroup;
+            logicalId: string;
+        };
+        /**
+         * Large web server auto scaling (5-20 instances)
+         */
+        largeWebServer: (slug: string, environment: EnvironmentType, launchConfigRef: string | {
+            Ref: string;
+        }, subnetIds: string[], targetGroupArns?: Array<string | {
+            Ref: string;
+        }>) => {
+            autoScalingGroup: AutoScalingGroup;
+            logicalId: string;
+        };
+        /**
+         * CPU-based scaling policy (default 70%)
+         */
+        cpuScaling: (slug: string, environment: EnvironmentType, asgName: string | {
+            Ref: string;
+        }, targetCpu?: number) => {
+            scalingPolicy: AutoScalingScalingPolicy;
+            logicalId: string;
+        };
+        /**
+         * Request count scaling policy (ALB)
+         */
+        requestCountScaling: (slug: string, environment: EnvironmentType, asgName: string | {
+            Ref: string;
+        }, targetRequestCount?: number) => {
+            scalingPolicy: AutoScalingScalingPolicy;
+            logicalId: string;
+        };
+    };
+    /**
+     * Secrets Manager integration utilities
+     */
+    static readonly Secrets: {
+        /**
+         * Convert environment variables to ECS secrets configuration
+         * This takes environment variable names and their corresponding Secrets Manager ARNs
+         */
+        fromSecretsManager: (secrets: Record<string, string>) => Array<{
+            name: string;
+            valueFrom: string;
+        }>;
+        /**
+         * Reference a specific key from a JSON secret
+         * Format: arn:aws:secretsmanager:region:account:secret:name:json-key::
+         */
+        fromJsonSecret: (secretArn: string, jsonKey: string) => string;
+        /**
+         * Reference a specific version of a secret
+         * Format: arn:aws:secretsmanager:region:account:secret:name::version-id:
+         */
+        fromSecretVersion: (secretArn: string, versionId: string) => string;
+        /**
+         * Reference a specific version stage of a secret
+         * Format: arn:aws:secretsmanager:region:account:secret:name:::version-stage
+         */
+        fromSecretVersionStage: (secretArn: string, versionStage: string) => string;
+        /**
+         * Create IAM policy for Secrets Manager access
+         */
+        createAccessPolicy: (secretArns: string[]) => {
+            PolicyName: string;
+            PolicyDocument: {
+                Version: "2012-10-17";
+                Statement: Array<{
+                    Effect: "Allow" | "Deny";
+                    Action: string[];
+                    Resource: string[];
+                }>;
+            };
+        };
+        /**
+         * Create IAM policy for KMS decryption (when secrets are encrypted with KMS)
+         */
+        createKmsPolicy: (kmsKeyArns: string[]) => {
+            PolicyName: string;
+            PolicyDocument: {
+                Version: "2012-10-17";
+                Statement: Array<{
+                    Effect: "Allow" | "Deny";
+                    Action: string[];
+                    Resource: string[];
+                }>;
+            };
+        };
+        /**
+         * Build secret ARN from components
+         */
+        buildSecretArn: (params: {
+            region: string;
+            accountId: string;
+            secretName: string;
+        }) => string;
+        /**
+         * Build secret ARN pattern for wildcard matching
+         * Useful for IAM policies
+         */
+        buildSecretArnPattern: (params: {
+            region?: string;
+            accountId?: string;
+            secretNamePrefix: string;
+        }) => string;
+        /**
+         * Common environment secrets mapping
+         * Maps common application environment variable names to secrets
+         */
+        commonAppSecrets: (secretPrefix: string) => Record<string, string>;
+    };
+    /**
+     * Create ECS Fargate service with full Secrets Manager integration
+     */
+    static createFargateServiceWithSecrets(options: FargateServiceOptions & {
+        secretArns?: string[];
+        kmsKeyArns?: string[];
+    }): {
+        cluster: ECSCluster;
+        taskDefinition: ECSTaskDefinition;
+        service: ECSService;
+        taskRole: IAMRole;
+        executionRole: IAMRole;
+        clusterLogicalId: string;
+        taskDefinitionLogicalId: string;
+        serviceLogicalId: string;
+        taskRoleLogicalId: string;
+        executionRoleLogicalId: string;
+    };
+    /**
+     * Generate secret references for container environment
+     * This is a helper to convert secret names to full ARN references
+     */
+    static generateSecretReferences(params: {
+        region: string;
+        accountId: string;
+        secretPrefix: string;
+        secrets: string[];
+    }): Array<{
+        name: string;
+        valueFrom: string;
+    }>;
+    /**
+     * Create environment secrets configuration for common patterns
+     */
+    static readonly EnvSecrets: {
+        /**
+         * Database credentials as secrets
+         */
+        database: (secretArn: string) => Array<{
+            name: string;
+            valueFrom: string;
+        }>;
+        /**
+         * Redis credentials as secrets
+         */
+        redis: (secretArn: string) => Array<{
+            name: string;
+            valueFrom: string;
+        }>;
+        /**
+         * API credentials as secrets
+         */
+        apiCredentials: (secretArn: string) => Array<{
+            name: string;
+            valueFrom: string;
+        }>;
+        /**
+         * Mail credentials as secrets
+         */
+        mail: (secretArn: string) => Array<{
+            name: string;
+            valueFrom: string;
+        }>;
+        /**
+         * AWS credentials as secrets (for cross-account access)
+         */
+        awsCredentials: (secretArn: string) => Array<{
+            name: string;
+            valueFrom: string;
+        }>;
+    };
+    /**
+     * Create a JumpBox (Bastion Host) for SSH access to private resources
+     */
+    static createJumpBox(options: {
+        slug: string;
+        environment: EnvironmentType;
+        vpcId: string;
+        subnetId: string;
+        keyName: string;
+        instanceType?: string;
+        imageId?: string;
+        allowedCidrs?: string[];
+        mountEfs?: {
+            fileSystemId: string;
+            mountPath?: string;
+        };
+    }): {
+        instance: EC2Instance;
+        securityGroup: EC2SecurityGroup;
+        instanceProfile: any;
+        instanceRole: IAMRole;
+        instanceLogicalId: string;
+        securityGroupLogicalId: string;
+        instanceProfileLogicalId: string;
+        instanceRoleLogicalId: string;
+        resources: Record<string, any>;
+    };
+    /**
+     * JumpBox helper configurations
+     */
+    static readonly JumpBox: {
+        /**
+         * Create JumpBox with EFS mount for file access
+         */
+        withEfsMount: (params: {
+            slug: string;
+            environment: EnvironmentType;
+            vpcId: string;
+            subnetId: string;
+            keyName: string;
+            fileSystemId: string;
+            mountPath?: string;
+            allowedCidrs?: string[];
+        }) => {
+            instance: EC2Instance;
+            securityGroup: EC2SecurityGroup;
+            instanceProfile: any;
+            instanceRole: IAMRole;
+            instanceLogicalId: string;
+            securityGroupLogicalId: string;
+            instanceProfileLogicalId: string;
+            instanceRoleLogicalId: string;
+            resources: Record<string, any>;
+        };
+        /**
+         * Create minimal JumpBox (SSH only)
+         */
+        minimal: (params: {
+            slug: string;
+            environment: EnvironmentType;
+            vpcId: string;
+            subnetId: string;
+            keyName: string;
+            allowedCidrs?: string[];
+        }) => {
+            instance: EC2Instance;
+            securityGroup: EC2SecurityGroup;
+            instanceProfile: any;
+            instanceRole: IAMRole;
+            instanceLogicalId: string;
+            securityGroupLogicalId: string;
+            instanceProfileLogicalId: string;
+            instanceRoleLogicalId: string;
+            resources: Record<string, any>;
+        };
+        /**
+         * Create JumpBox with database tools
+         */
+        withDatabaseTools: (params: {
+            slug: string;
+            environment: EnvironmentType;
+            vpcId: string;
+            subnetId: string;
+            keyName: string;
+            allowedCidrs?: string[];
+        }) => {
+            instance: EC2Instance;
+            securityGroup: EC2SecurityGroup;
+            instanceProfile: any;
+            instanceRole: IAMRole;
+            instanceLogicalId: string;
+            securityGroupLogicalId: string;
+            instanceProfileLogicalId: string;
+            instanceRoleLogicalId: string;
+            resources: Record<string, any>;
+        };
+        /**
+         * Allowed CIDRs for corporate VPNs (common patterns)
+         */
+        commonCidrs: {
+            any: readonly ["0.0.0.0/0"];
+            privateOnly: readonly ["10.0.0.0/8", "172.16.0.0/12", "192.168.0.0/16"];
+        };
+    };
+    /**
+     * Instance size mapping - human-readable sizes to AWS instance types
+     * Provides Stacks configuration parity for "size" configuration option
+     */
+    static readonly InstanceSize: {
+        /**
+         * Map human-readable size to EC2 instance type
+         */
+        toInstanceType: (size: "nano" | "micro" | "small" | "medium" | "large" | "xlarge" | "2xlarge" | "4xlarge" | "8xlarge", family?: "t3" | "t3a" | "m6i" | "c6i" | "r6i") => string;
+        /**
+         * Size configurations with CPU and memory specs
+         */
+        specs: {
+            readonly nano: {
+                readonly vcpu: 2;
+                readonly memory: 0.5;
+                readonly instanceType: "t3.nano";
+            };
+            readonly micro: {
+                readonly vcpu: 2;
+                readonly memory: 1;
+                readonly instanceType: "t3.micro";
+            };
+            readonly small: {
+                readonly vcpu: 2;
+                readonly memory: 2;
+                readonly instanceType: "t3.small";
+            };
+            readonly medium: {
+                readonly vcpu: 2;
+                readonly memory: 4;
+                readonly instanceType: "t3.medium";
+            };
+            readonly large: {
+                readonly vcpu: 2;
+                readonly memory: 8;
+                readonly instanceType: "t3.large";
+            };
+            readonly xlarge: {
+                readonly vcpu: 4;
+                readonly memory: 16;
+                readonly instanceType: "t3.xlarge";
+            };
+            readonly '2xlarge': {
+                readonly vcpu: 8;
+                readonly memory: 32;
+                readonly instanceType: "t3.2xlarge";
+            };
+        };
+        /**
+         * Get Fargate CPU/memory from size
+         */
+        toFargateSpecs: (size: "nano" | "micro" | "small" | "medium" | "large" | "xlarge" | "2xlarge") => {
+            cpu: string;
+            memory: string;
+        };
+        /**
+         * Get Lambda memory from size
+         */
+        toLambdaMemory: (size: "nano" | "micro" | "small" | "medium" | "large" | "xlarge" | "2xlarge") => number;
+        /**
+         * Presets for common workloads
+         */
+        presets: {
+            readonly webServer: "t3.small";
+            readonly apiServer: "t3.medium";
+            readonly worker: "t3.medium";
+            readonly database: "r6i.large";
+            readonly cache: "r6i.medium";
+            readonly compute: "c6i.large";
+            readonly general: "m6i.medium";
+        };
+    };
+    /**
+     * Disk configuration helpers
+     * Provides Stacks configuration parity for disk options
+     */
+    static readonly DiskConfig: {
+        /**
+         * Create EBS volume configuration
+         */
+        create: (options: {
+            size: number;
+            type?: "standard" | "ssd" | "premium" | "gp2" | "gp3" | "io1" | "io2";
+            encrypted?: boolean;
+            iops?: number;
+            throughput?: number;
+            deleteOnTermination?: boolean;
+        }) => {
+            VolumeSize: number;
+            VolumeType: string;
+            Encrypted: boolean;
+            Iops?: number;
+            Throughput?: number;
+            DeleteOnTermination: boolean;
+        };
+        /**
+         * Common disk configurations
+         */
+        presets: {
+            /**
+             * Standard SSD (20GB gp3)
+             */
+            standard: {
+                VolumeSize: number;
+                VolumeType: string;
+                Encrypted: boolean;
+                DeleteOnTermination: boolean;
+            };
+            /**
+             * Large storage (100GB gp3)
+             */
+            large: {
+                VolumeSize: number;
+                VolumeType: string;
+                Encrypted: boolean;
+                DeleteOnTermination: boolean;
+            };
+            /**
+             * High performance (50GB io2)
+             */
+            highPerformance: {
+                VolumeSize: number;
+                VolumeType: string;
+                Iops: number;
+                Encrypted: boolean;
+                DeleteOnTermination: boolean;
+            };
+            /**
+             * Database optimized (100GB io2 with high IOPS)
+             */
+            database: {
+                VolumeSize: number;
+                VolumeType: string;
+                Iops: number;
+                Encrypted: boolean;
+                DeleteOnTermination: boolean;
+            };
+        };
+    };
+    /**
+     * Spot instance configuration
+     * Provides Stacks configuration parity for spot instances
+     */
+    static readonly SpotConfig: {
+        /**
+         * Create spot instance specification for Launch Template
+         */
+        create: (options: {
+            maxPrice?: string;
+            spotInstanceType?: "one-time" | "persistent";
+            interruptionBehavior?: "hibernate" | "stop" | "terminate";
+            blockDurationMinutes?: number;
+        }) => {
+            SpotOptions: {
+                MaxPrice?: string;
+                SpotInstanceType?: string;
+                InstanceInterruptionBehavior?: string;
+                BlockDurationMinutes?: number;
+            };
+        };
+        /**
+         * Common spot instance configurations
+         */
+        presets: {
+            /**
+             * Standard spot (80% on-demand price)
+             */
+            standard: {
+                spotInstanceType: string;
+                interruptionBehavior: string;
+            };
+            /**
+             * Persistent spot (for long-running workloads)
+             */
+            persistent: {
+                spotInstanceType: string;
+                interruptionBehavior: string;
+            };
+            /**
+             * Cost-optimized (lower max price)
+             */
+            costOptimized: {
+                maxPrice: string;
+                spotInstanceType: string;
+                interruptionBehavior: string;
+            };
+        };
+    };
+    /**
+     * Mixed instances configuration for Auto Scaling Groups
+     * Provides Stacks configuration parity for mixed instance fleets
+     */
+    static readonly MixedInstances: {
+        /**
+         * Create mixed instances policy for ASG
+         */
+        create: (options: {
+            instanceTypes: Array<{
+                size: string;
+                weight?: number;
+            }>;
+            baseCapacity?: number;
+            onDemandPercentage?: number;
+            spotAllocationStrategy?: "lowest-price" | "capacity-optimized" | "capacity-optimized-prioritized";
+            spotMaxPrice?: string;
+        }) => {
+            MixedInstancesPolicy: {
+                InstancesDistribution: {
+                    OnDemandBaseCapacity: number;
+                    OnDemandPercentageAboveBaseCapacity: number;
+                    SpotAllocationStrategy: string;
+                    SpotMaxPrice?: string;
+                };
+                LaunchTemplate: {
+                    Overrides: Array<{
+                        InstanceType: string;
+                        WeightedCapacity?: string;
+                    }>;
+                };
+            };
+        };
+        /**
+         * Common mixed instance configurations
+         */
+        presets: {
+            /**
+             * Cost-optimized (80% spot)
+             */
+            costOptimized: {
+                baseCapacity: number;
+                onDemandPercentage: number;
+                spotAllocationStrategy: string;
+                instanceTypes: readonly [{
+                    readonly size: "small";
+                    readonly weight: 1;
+                }, {
+                    readonly size: "medium";
+                    readonly weight: 2;
+                }];
+            };
+            /**
+             * Balanced (50% spot)
+             */
+            balanced: {
+                baseCapacity: number;
+                onDemandPercentage: number;
+                spotAllocationStrategy: string;
+                instanceTypes: readonly [{
+                    readonly size: "medium";
+                    readonly weight: 1;
+                }, {
+                    readonly size: "large";
+                    readonly weight: 2;
+                }];
+            };
+            /**
+             * High availability (20% spot)
+             */
+            highAvailability: {
+                baseCapacity: number;
+                onDemandPercentage: number;
+                spotAllocationStrategy: string;
+                instanceTypes: readonly [{
+                    readonly size: "medium";
+                    readonly weight: 1;
+                }];
+            };
+        };
+    };
+    /**
+     * Auto-scaling configuration helpers
+     * Provides Stacks configuration parity for auto-scaling options
+     */
+    static readonly AutoScalingConfig: {
+        /**
+         * Create auto-scaling configuration
+         */
+        create: (options: {
+            min: number;
+            max: number;
+            desired?: number;
+            scaleUpThreshold?: number;
+            scaleDownThreshold?: number;
+            cooldownSeconds?: number;
+            targetMetric?: "cpu" | "memory" | "requests";
+        }) => {
+            minSize: number;
+            maxSize: number;
+            desiredCapacity: number;
+            scalingPolicies: Array<{
+                policyType: string;
+                targetValue: number;
+                predefinedMetricType: string;
+                scaleInCooldown: number;
+                scaleOutCooldown: number;
+            }>;
+        };
+        /**
+         * ECS auto-scaling configuration
+         */
+        forEcs: (options: {
+            min: number;
+            max: number;
+            cpuTarget?: number;
+            memoryTarget?: number;
+        }) => {
+            minCapacity: number;
+            maxCapacity: number;
+            targetTrackingPolicies: Array<{
+                predefinedMetricType: string;
+                targetValue: number;
+            }>;
+        };
+        /**
+         * Common auto-scaling configurations
+         */
+        presets: {
+            /**
+             * Small service (1-3 instances)
+             */
+            small: {
+                min: number;
+                max: number;
+                scaleUpThreshold: number;
+                scaleDownThreshold: number;
+            };
+            /**
+             * Medium service (2-10 instances)
+             */
+            medium: {
+                min: number;
+                max: number;
+                scaleUpThreshold: number;
+                scaleDownThreshold: number;
+            };
+            /**
+             * Large service (3-50 instances)
+             */
+            large: {
+                min: number;
+                max: number;
+                scaleUpThreshold: number;
+                scaleDownThreshold: number;
+            };
+            /**
+             * High availability (always 2+ instances)
+             */
+            highAvailability: {
+                min: number;
+                max: number;
+                scaleUpThreshold: number;
+                scaleDownThreshold: number;
+            };
+        };
+    };
+    /**
+     * Load balancer configuration helpers
+     * Provides Stacks configuration parity for load balancer options
+     */
+    static readonly LoadBalancerConfig: {
+        /**
+         * Create load balancer health check configuration
+         */
+        healthCheck: (options: {
+            path?: string;
+            interval?: number;
+            timeout?: number;
+            healthyThreshold?: number;
+            unhealthyThreshold?: number;
+            protocol?: "HTTP" | "HTTPS" | "TCP";
+        }) => {
+            HealthCheckPath?: string;
+            HealthCheckIntervalSeconds: number;
+            HealthCheckTimeoutSeconds: number;
+            HealthyThresholdCount: number;
+            UnhealthyThresholdCount: number;
+            HealthCheckProtocol?: string;
+        };
+        /**
+         * Common health check configurations
+         */
+        presets: {
+            /**
+             * Standard HTTP health check
+             */
+            standard: {
+                path: string;
+                interval: number;
+                timeout: number;
+                healthyThreshold: number;
+                unhealthyThreshold: number;
+            };
+            /**
+             * Fast health check (for quick failover)
+             */
+            fast: {
+                path: string;
+                interval: number;
+                timeout: number;
+                healthyThreshold: number;
+                unhealthyThreshold: number;
+            };
+            /**
+             * Relaxed health check (for slow-starting apps)
+             */
+            relaxed: {
+                path: string;
+                interval: number;
+                timeout: number;
+                healthyThreshold: number;
+                unhealthyThreshold: number;
+            };
+        };
+    };
+    /**
+     * SSL configuration helpers
+     * Provides Stacks configuration parity for SSL options
+     */
+    static readonly SslConfig: {
+        /**
+         * Create SSL listener configuration
+         */
+        httpsListener: (options: {
+            certificateArn: string;
+            targetGroupArn: string;
+            port?: number;
+            sslPolicy?: string;
+        }) => {
+            Port: number;
+            Protocol: string;
+            Certificates: Array<{
+                CertificateArn: string;
+            }>;
+            SslPolicy: string;
+            DefaultActions: Array<{
+                Type: string;
+                TargetGroupArn: string;
+            }>;
+        };
+        /**
+         * Create HTTP to HTTPS redirect listener
+         */
+        httpRedirectListener: (port?: number) => {
+            Port: number;
+            Protocol: string;
+            DefaultActions: Array<{
+                Type: string;
+                RedirectConfig: {
+                    Protocol: string;
+                    Port: string;
+                    StatusCode: string;
+                };
+            }>;
+        };
+        /**
+         * SSL policies (TLS versions)
+         */
+        policies: {
+            readonly tls13: "ELBSecurityPolicy-TLS13-1-2-2021-06";
+            readonly tls12: "ELBSecurityPolicy-TLS-1-2-Ext-2018-06";
+            readonly tls11: "ELBSecurityPolicy-TLS-1-1-2017-01";
+            readonly fips: "ELBSecurityPolicy-TLS-1-2-Ext-FIPS-2022-05";
+        };
+    };
+    /**
+     * Functions configuration helpers (Lambda)
+     * Provides Stacks configuration parity for functions configuration
+     */
+    static readonly FunctionConfig: {
+        /**
+         * Create Lambda function configuration
+         */
+        create: (options: {
+            handler: string;
+            runtime?: string;
+            timeout?: number;
+            memorySize?: number;
+            environmentVariables?: Record<string, string>;
+            reservedConcurrency?: number;
+        }) => {
+            Handler: string;
+            Runtime: string;
+            Timeout: number;
+            MemorySize: number;
+            Environment?: {
+                Variables: Record<string, string>;
+            };
+            ReservedConcurrentExecutions?: number;
+        };
+        /**
+         * Runtime options
+         */
+        runtimes: {
+            readonly nodejs20: "nodejs20.x";
+            readonly nodejs18: "nodejs18.x";
+            readonly python312: "python3.12";
+            readonly python311: "python3.11";
+            readonly java21: "java21";
+            readonly java17: "java17";
+            readonly go: "provided.al2023";
+            readonly rust: "provided.al2023";
+        };
+        /**
+         * Common function configurations
+         */
+        presets: {
+            /**
+             * API handler (fast response)
+             */
+            api: {
+                runtime: string;
+                timeout: number;
+                memorySize: number;
+            };
+            /**
+             * Worker (background processing)
+             */
+            worker: {
+                runtime: string;
+                timeout: number;
+                memorySize: number;
+            };
+            /**
+             * Cron job (scheduled task)
+             */
+            cron: {
+                runtime: string;
+                timeout: number;
+                memorySize: number;
+            };
+            /**
+             * Data processing (high memory)
+             */
+            dataProcessing: {
+                runtime: string;
+                timeout: number;
+                memorySize: number;
+            };
+        };
+    };
+    /**
+     * User data scripts for EC2 Server Mode (Forge-style)
+     * Provides installation scripts for Bun, Node.js, Nginx, Caddy, PM2, etc.
+     */
+    static readonly UserData: {
+        /**
+         * Generate complete user data script for app server
+         */
+        generateAppServerScript: (options: {
+            runtime?: "bun" | "node";
+            runtimeVersion?: string;
+            webServer?: "nginx" | "caddy" | "none";
+            processManager?: "pm2" | "systemd";
+            enableSsl?: boolean;
+            sslEmail?: string;
+            domain?: string;
+            appPort?: number;
+            installDatabaseClients?: boolean;
+            installRedis?: boolean;
+            extraPackages?: string[];
+        }) => string;
+        /**
+         * Generate a minimal app-agnostic bootstrap script for Amazon Linux 2023.
+         *
+         * The instance is left in a "ready for deploys" state — runtime + tools +
+         * `/var/www` exist, but no app-specific systemd services are created here.
+         * Per-site systemd services (`<slug>-<site>.service`) are written by the
+         * deploy command at `cloud deploy` time, since:
+         *  - Sites can be added/removed without re-bootstrapping
+         *  - Each site has its own dir, port, env, and ExecStart
+         *  - Multiple sites can share one EC2 instance
+         */
+        generateBunAppScript: (options: {
+            runtime?: "bun" | "node" | "deno";
+            runtimeVersion?: string;
+            systemPackages?: string[];
+            database?: "sqlite" | "mysql" | "postgres";
+        }) => string;
+        /**
+         * Individual installation scripts
+         */
+        Scripts: {
+            /**
+             * Install Bun
+             */
+            bun: (version?: string) => string;
+            /**
+             * Install Node.js via nvm
+             */
+            nodeJs: (version?: string) => string;
+            /**
+             * Install Nginx
+             */
+            nginx: () => string;
+            /**
+             * Configure Nginx as reverse proxy
+             */
+            nginxProxy: (domain: string, port?: number) => string;
+            /**
+             * Install Caddy
+             */
+            caddy: () => string;
+            /**
+             * Configure Caddy as reverse proxy
+             */
+            caddyProxy: (domain: string, port?: number) => string;
+            /**
+             * Install PM2
+             */
+            pm2: () => string;
+            /**
+             * Install Let's Encrypt (certbot)
+             */
+            letsEncrypt: (domain: string, email: string, staging?: boolean) => string;
+            /**
+             * Install database clients
+             */
+            databaseClients: () => string;
+            /**
+             * Install Redis (server and cli)
+             */
+            redis: () => string;
+            /**
+             * Create systemd service for app
+             */
+            systemdService: (options: {
+                serviceName: string;
+                description: string;
+                workingDirectory: string;
+                execStart: string;
+                user?: string;
+                environmentVars?: Record<string, string>;
+            }) => string;
+            /**
+             * Setup swap file
+             */
+            swapFile: (sizeGb?: number) => string;
+            /**
+             * Setup firewall (ufw)
+             */
+            firewall: (allowPorts?: number[]) => string;
+        };
+        /**
+         * Preset user data configurations
+         */
+        Presets: {
+            /**
+             * Bun app server with Nginx
+             */
+            bunWithNginx: (domain: string, appPort?: number) => string;
+            /**
+             * Bun app server with Caddy (auto SSL)
+             */
+            bunWithCaddy: (domain: string, appPort?: number) => string;
+            /**
+             * Node.js app server with PM2 and Nginx
+             */
+            nodeWithPm2: (domain: string, appPort?: number) => string;
+            /**
+             * Minimal worker server (no web server)
+             */
+            worker: (runtime?: "bun" | "node") => string;
+        };
+    };
+    /**
+     * Create Elastic IP allocation
+     */
+    static createElasticIp(options: {
+        slug: string;
+        environment: EnvironmentType;
+        domain?: string;
+        instanceLogicalId?: string;
+    }): {
+        eip: any;
+        eipAssociation?: any;
+        eipLogicalId: string;
+        associationLogicalId?: string;
+        resources: Record<string, any>;
+    };
+    /**
+     * Create complete Server Mode stack (Forge-style)
+     * Creates EC2 instance with Elastic IP, security group, and IAM role
+     */
+    static createServerModeStack(options: {
+        slug: string;
+        environment: EnvironmentType;
+        vpcId: string;
+        subnetId: string;
+        instanceType?: string;
+        imageId?: string;
+        keyName: string;
+        domain?: string;
+        userData?: string;
+        allowedPorts?: number[];
+        volumeSize?: number;
+        volumeType?: 'gp2' | 'gp3' | 'io1' | 'io2';
+    }): {
+        instance: EC2Instance;
+        securityGroup: EC2SecurityGroup;
+        eip: any;
+        eipAssociation: any;
+        instanceRole: IAMRole;
+        instanceProfile: any;
+        resources: Record<string, any>;
+        outputs: {
+            instanceLogicalId: string;
+            securityGroupLogicalId: string;
+            eipLogicalId: string;
+            associationLogicalId: string;
+            roleLogicalId: string;
+            profileLogicalId: string;
+        };
+    };
+    /**
+     * Server Mode presets for common server types
+     */
+    static readonly ServerMode: {
+        /**
+         * Create web/app server
+         */
+        webServer: (options: {
+            slug: string;
+            environment: EnvironmentType;
+            vpcId: string;
+            subnetId: string;
+            keyName: string;
+            domain: string;
+            runtime?: "bun" | "node";
+            webServer?: "nginx" | "caddy";
+        }) => {
+            instance: EC2Instance;
+            securityGroup: EC2SecurityGroup;
+            eip: any;
+            eipAssociation: any;
+            instanceRole: IAMRole;
+            instanceProfile: any;
+            resources: Record<string, any>;
+            outputs: {
+                instanceLogicalId: string;
+                securityGroupLogicalId: string;
+                eipLogicalId: string;
+                associationLogicalId: string;
+                roleLogicalId: string;
+                profileLogicalId: string;
+            };
+        };
+        /**
+         * Create worker server (no web server)
+         */
+        workerServer: (options: {
+            slug: string;
+            environment: EnvironmentType;
+            vpcId: string;
+            subnetId: string;
+            keyName: string;
+            runtime?: "bun" | "node";
+            installRedis?: boolean;
+        }) => {
+            instance: EC2Instance;
+            securityGroup: EC2SecurityGroup;
+            eip: any;
+            eipAssociation: any;
+            instanceRole: IAMRole;
+            instanceProfile: any;
+            resources: Record<string, any>;
+            outputs: {
+                instanceLogicalId: string;
+                securityGroupLogicalId: string;
+                eipLogicalId: string;
+                associationLogicalId: string;
+                roleLogicalId: string;
+                profileLogicalId: string;
+            };
+        };
+        /**
+         * Create cache server (Redis)
+         */
+        cacheServer: (options: {
+            slug: string;
+            environment: EnvironmentType;
+            vpcId: string;
+            subnetId: string;
+            keyName: string;
+        }) => {
+            instance: EC2Instance;
+            securityGroup: EC2SecurityGroup;
+            eip: any;
+            eipAssociation: any;
+            instanceRole: IAMRole;
+            instanceProfile: any;
+            resources: Record<string, any>;
+            outputs: {
+                instanceLogicalId: string;
+                securityGroupLogicalId: string;
+                eipLogicalId: string;
+                associationLogicalId: string;
+                roleLogicalId: string;
+                profileLogicalId: string;
+            };
+        };
+    };
+}