npm - fjall - Versions diffs - 11.0.0 → 12.0.0 - Mend

fjall 11.0.0 → 12.0.0

This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.

Files changed (17) hide show

package/bin/assets/generators/compute/service/generator.js CHANGED Viewed

@@ -74,7 +74,7 @@ Set the \`cycles\` parameter to \`"ref"\` to resolve cyclical schemas with defs.
 ${fr}`:"",x=[],Y=0;for(let Qt=a-1;Qt>=g;Qt--){let Ce=o[Qt]??"",X=Y+Ce.length+1;if((Qt>0?fr.length+1:0)+X+u.length+v.length>n)break;x.unshift(Ce),Y=X}let G=a-x.length>0?`${fr}
 `:"",Lt=x.length>0?`${x.join(`
 `)}
-`:"";return G+Lt+u+v}$c(IA,"extractErrorWindow");var Gk=Object.defineProperty,ti=(e,t)=>Gk(e,"name",{value:t,configurable:!0});function Yg(e){return e.success===!0}ti(Yg,"isSuccess");function Xg(e){return e.success===!1}ti(Xg,"isFailure");function C(e){return{success:!0,data:e}}ti(C,"success");function I(e){return{success:!1,error:e}}ti(I,"failure");async function Jg(e){try{let t=await e();return C(t)}catch(t){return I(vt(t))}}ti(Jg,"tryAsync");function qg(e){try{let t=e();return C(t)}catch(t){return I(vt(t))}}ti(qg,"trySync");var Zk=Object.defineProperty,Wk=(e,t)=>Zk(e,"name",{value:t,configurable:!0}),TA=/^[a-zA-Z][a-zA-Z0-9-]*$/,Hk=_o.source.replace(/^\^|\$$/g,""),j=Object.freeze({IDENTIFIER:TA,NEW_APP_NAME:/^[a-z][a-z0-9-]*$/,RESOURCE_NAME:/^[a-zA-Z][a-zA-Z0-9]*$/,ECS_SERVICE_NAME:TA,BUCKET_NAME:/^[a-z][a-z0-9-]*[a-z0-9]$|^[a-z][a-z0-9]*$/,DATABASE_NAME:/^[a-zA-Z][a-zA-Z0-9_]*$/,RESOURCE_TYPE:/^[a-z]+(:[a-z]+)?$/,SSM_PATH:new RegExp(`^(?:/${Hk})+$`),SECRET_NAME:Ac,SSM_COMPONENT:_o,EMAIL:/^[^\s@]+@[^\s@]+\.[^\s@]+$/,DOCKER_IMAGE:/^[a-z0-9][a-z0-9._-]*[a-z0-9](:[a-z0-9._-]+)?$/,DOMAIN:/^[a-z0-9]([a-z0-9-]*[a-z0-9])?(\.[a-z0-9]([a-z0-9-]*[a-z0-9])?)+$/i,HTTP_ORIGIN:/^https?:\/\/[a-z0-9.-]+(:\d+)?$/i,PASCAL_CASE:/^[A-Z][A-Za-z0-9]*$/,AWS_ACCOUNT_ID:/^\d{12}$/,VPC_ID:/^vpc-[a-z0-9]+$/,ROLE_ARN:/^arn:aws[a-zA-Z-]*:iam::\d{12}:role\/.+$/,CIDR:/^((25[0-5]|2[0-4]\d|1\d\d|[1-9]?\d)\.){3}(25[0-5]|2[0-4]\d|1\d\d|[1-9]?\d)\/(3[0-2]|[12]?\d)$/,SCHEDULE_EXPRESSION:/^(rate\(1 (?:minute|hour|day)\)|rate\((?:[2-9]|[1-9]\d+) (?:minutes|hours|days)\)|cron\([^\s()]+ [^\s()]+ [^\s()]+ [^\s()]+ [^\s()]+ [^\s()]+\))$/,LAMBDA_RUNTIME_IDENTIFIER:/^[A-Za-z0-9._-]+$/,ENV_VAR_NAME:/^[A-Za-z_][A-Za-z0-9_]*$/});function Qg(e){let t=/^rate\((\d+) (minute|minutes|hour|hours|day|days)\)$/.exec(e);if(!t)return;let n=t[1],i=t[2];if(n===void 0||i===void 0)return;let r=parseInt(n,10);if(!Number.isFinite(r)||r<1)return;let o=i==="minute"||i==="hour"||i==="day";if(!(o&&r!==1)&&!(!o&&r===1))return i==="minute"||i==="minutes"?{everyMs:r*6e4}:i==="hour"||i==="hours"?{everyMs:r*60*6e4}:{everyMs:r*24*60*6e4}}Wk(Qg,"parseRateExpression");var d=Object.freeze({IDENTIFIER:"Must start with a letter, contain only letters, numbers, and hyphens",NEW_APP_NAME:"Must start with a lowercase letter and contain only lowercase letters, numbers, and hyphens",IDENTIFIER_MIN_LENGTH:"Must be at least 2 characters",IDENTIFIER_NO_TRAILING_HYPHEN:"Must not end with a hyphen",IDENTIFIER_NO_CONSECUTIVE_HYPHENS:"Must not contain consecutive hyphens",RESOURCE_NAME:"Must start with a letter and contain only letters and numbers (PascalCase recommended)",ECS_SERVICE_NAME:"Service name must start with a letter and contain only letters, numbers, and hyphens",BUCKET_NAME:"Bucket name must start with a lowercase letter and contain only lowercase letters, numbers, and hyphens",DATABASE_NAME:"Database name must start with a letter and contain only letters, numbers, and underscores",RESOURCE_TYPE:"Resource type must be in format 'category' or 'category:type'",SSM_PATH:"SSM path must start with / and contain valid namespace segments (e.g., /myapp/ApiCluster/service)",SECRET_NAME:Ng,SSM_COMPONENT:xc,EMAIL:"Please enter a valid email address",DOMAIN:"Please enter a valid domain (e.g., cms.example.com)",DOCKER_IMAGE:"Invalid Docker image name format",REQUIRED:{APP_NAME:"Application name is required",RESOURCE_NAME:"Resource name is required",BUCKET_NAME:"Bucket name is required",SERVICE_NAME:"Service name is required",NETWORK_NAME:"Network name is required",DATABASE_NAME:"Database name is required",ORGANISATION_NAME:"Organisation name is required",EMAIL:"Email is required",NAME:"Name is required",USERNAME:"Username is required",CONTAINER_NAME:"Container name is required",GROUP:"Group is required",PATTERN_NAME:"Pattern name is required",SOURCE:"Source directory is required",BUILD_COMMAND:"Build command is required",OUTPUT_DIR:"Output directory is required",FORMS_TO:"Forms recipient address is required",ROUTING_PATH:"Routing path is required",RESOURCE_REFERENCE:"Resource reference is required",RESOURCE_TYPE:"Resource type is required",VARIANT:"Variant is required",SUBTYPE:"Subtype is required",DEPLOY_TARGET:"Deploy target is required",DESTROY_TARGET:"Destroy target is required"},MAX_LENGTH:{APP_NAME:"Application name must be 50 characters or less",RESOURCE_NAME:"Resource name must be 63 characters or less",BUCKET_NAME:"Bucket name must be 63 characters or less",SERVICE_NAME:"Service name must be 255 characters or less",NETWORK_NAME:"Network name must be 50 characters or less",DATABASE_NAME:"Database name must be 63 characters or less",ORGANISATION_NAME:"Organisation name must be 50 characters or less"},PORT:{INTEGER:"Port must be an integer",MIN:"Port must be at least 1",MAX:"Port cannot exceed 65535"},USERNAME:{MAX_LENGTH:"Username cannot exceed 63 characters"},LAMBDA:{MEMORY:{INTEGER:"Lambda memory must be an integer",MIN:"Memory must be at least 128 MB",MAX:"Memory cannot exceed 10240 MB",MULTIPLE:"Memory must be 128 MB or a multiple of 64 MB"},TIMEOUT:{INTEGER:"Timeout must be an integer",MIN:"Timeout must be at least 1 second",MAX:"Timeout cannot exceed 900 seconds"},RUNTIME:"Lambda runtime must contain only letters, digits, dots, underscores, or dashes (e.g. 'NODEJS_20_X' or 'nodejs20.x')"},ENV_VAR_NAME:"Environment variable names must start with a letter or underscore and contain only letters, digits, and underscores",PRIORITY:{INTEGER:"Priority must be an integer",MIN:"Priority must be at least 1",MAX:"Priority cannot exceed 50000"},CAPACITY:{MIN:{INTEGER:"Minimum capacity must be an integer",MIN_0:"Minimum capacity must be at least 0",MIN_1:"Minimum capacity must be at least 1",MAX:"Minimum capacity cannot exceed 100"},MAX:{INTEGER:"Maximum capacity must be an integer",MIN_0:"Maximum capacity must be at least 0",MIN_1:"Maximum capacity must be at least 1",MAX:"Maximum capacity cannot exceed 100"},DESIRED:{INTEGER:"Desired count must be an integer",MIN:"Desired count must be at least 0",MAX:"Desired count cannot exceed 100"},WARM_POOL_REQUIRED:"minCapacity 0 requires a warmPool \u2014 without it, new tasks wait 60-90s for a cold instance launch",WARM_POOL:{MIN_SIZE:{INTEGER:"Warm pool minSize must be an integer",MIN:"Warm pool minSize must be at least 0",MAX:"Warm pool minSize cannot exceed 100"},MIN_SIZE_EXCEEDS_MAX_CAPACITY:"warmPool.minSize cannot exceed maxCapacity \u2014 the warm pool cannot hold more instances than the ASG allows"}},MEMORY_LIMIT:{INTEGER:"Memory limit must be an integer",MIN_512:"Memory limit must be at least 512 MiB",MIN_128:"Memory limit must be at least 128 MiB",MAX:"Memory limit cannot exceed 30720 MiB"},DATABASE:{PORT:{INTEGER:"Database port must be an integer",MIN:"Database port must be at least 1024",MAX:"Database port cannot exceed 65535"},NAME:{REQUIRED:"Database name is required",MAX_LENGTH:"Database name must be 63 characters or less"}},BACKUP_RETENTION:{INTEGER:"Backup retention must be an integer",MIN:"Backup retention must be at least 1 day",MAX:"Backup retention cannot exceed 35 days"},SQS:{VISIBILITY_TIMEOUT:{INTEGER:"Visibility timeout must be an integer",MIN:"Visibility timeout must be at least 0 seconds",MAX:"Visibility timeout cannot exceed 43200 seconds (12 hours)"},RETENTION_PERIOD:{INTEGER:"Retention period must be an integer",MIN:"Retention period must be at least 60 seconds",MAX:"Retention period cannot exceed 1209600 seconds (14 days)"}},READER:{COUNT:{INTEGER:"Reader count must be an integer",MIN:"Reader count must be at least 0",MAX:"Reader count cannot exceed 15"}},IDENTIFIER_SUFFIX:{REQUIRED:"Identifier suffix is required when specified",MAX_LENGTH:"Identifier suffix cannot exceed 50 characters"},ROTATION:{INTEGER:"Rotation days must be an integer",MIN:"Rotation interval must be at least 1 day",MAX:"Rotation interval cannot exceed 365 days"},MAX_CONNECTIONS:{INTEGER:"Max connections must be an integer",MIN:"Max connections must be at least 1",MAX:"Max connections cannot exceed 100"},MONITORING_INTERVAL:{INTEGER:"Monitoring interval must be an integer",MIN:"Monitoring interval must be at least 0",MAX:"Monitoring interval cannot exceed 60 seconds",VALUES:"Monitoring interval must be 0, 1, 5, 10, 15, 30, or 60 seconds"},RETENTION_DAYS:{INTEGER:"Retention days must be an integer",MIN:"Retention days must be at least 1",MAX:"Retention days cannot exceed 365"},BATCH_SIZE:{INTEGER:"Batch size must be an integer",MIN:"Batch size must be at least 1",MAX:"Batch size cannot exceed 10000"},SERVICE:{UNIQUE_WITHIN_CLUSTER:"Service names must be unique within a cluster",MIN_REQUIRED:"At least one service is required",ROUTING_REQUIRED:"Multiple services with ports require routing config (path or host)"},PROXY_CONFIG:{MAX_IDLE_CONNECTIONS:{INTEGER:"Max idle connections must be an integer",MIN:"Max idle connections must be at least 0",MAX:"Max idle connections cannot exceed 100"},BORROW_TIMEOUT:{INTEGER:"Connection borrow timeout must be an integer",MIN:"Connection borrow timeout must be at least 1 second",MAX:"Connection borrow timeout cannot exceed 3600 seconds"}},MAX_AZS:{INTEGER:"Max AZs must be an integer",MIN:"Max AZs must be at least 1",MAX:"Max AZs cannot exceed 3"},BATCHING_WINDOW:{INTEGER:"Max batching window must be an integer",MIN:"Max batching window must be at least 0",MAX:"Max batching window cannot exceed 300 seconds"},HEALTH_CHECK:{INTERVAL:{INTEGER:"Health check interval must be an integer",MIN:"Health check interval must be at least 5 seconds",MAX:"Health check interval cannot exceed 300 seconds"},TIMEOUT:{INTEGER:"Health check timeout must be an integer",MIN:"Health check timeout must be at least 2 seconds",MAX:"Health check timeout cannot exceed 60 seconds"},RETRIES:{INTEGER:"Health check retries must be an integer",MIN:"Health check retries must be at least 1",MAX:"Health check retries cannot exceed 10"},START_PERIOD:{INTEGER:"Health check start period must be an integer",MIN:"Health check start period must be at least 0 seconds",MAX:"Health check start period cannot exceed 300 seconds"}},EPHEMERAL_STORAGE:{INTEGER:"Ephemeral storage size must be an integer",MIN:"Ephemeral storage size must be at least 512 MB",MAX:"Ephemeral storage size cannot exceed 10240 MB"},MAX_MESSAGE_SIZE:{INTEGER:"Max message size must be an integer",MIN:"Max message size must be at least 1024 bytes",MAX:"Max message size cannot exceed 262144 bytes (256 KB)"},CAPACITY_CONSTRAINT:{MIN_LTE_MAX:"minCapacity must be less than or equal to maxCapacity"},DIRECT_ACCESS:{NO_DOMAIN:"directAccess cannot be used with domain (no ALB for HTTPS)",NO_LOAD_BALANCER:"directAccess cannot be used with loadBalancer (mutually exclusive)"},GLOBAL_AURORA:{PRIMARY_REGION_REQUIRED:"primaryRegion is required for GlobalAurora databases"},NAT_GATEWAY:{INTEGER:"NAT gateway count must be an integer",MIN:"NAT gateway count must be at least 0",MAX:"NAT gateway count cannot exceed 3"},CIDR_MASK:{INTEGER:"CIDR mask must be an integer",MIN:"CIDR mask must be at least 16",MAX:"CIDR mask cannot exceed 28"},CPU:{INTEGER:"CPU must be an integer",MIN:"CPU must be at least 256 units",MAX:"CPU cannot exceed 4096 units"},KMS:{KEY_REQUIRED:"KMS key ARN is required when using KMS encryption"},READER_INSTANCES:{MAX:"Cannot have more than 15 reader instances",COUNT_OR_INSTANCES:"Cannot specify both 'count' and 'instances' - use one or the other"},GENERATOR_CAPACITY:{MIN:{MIN:"Minimum capacity must be at least 1",MAX:"Minimum capacity cannot exceed 1000"},MAX:{MIN:"Maximum capacity must be at least 1",MAX:"Maximum capacity cannot exceed 1000"}},INSTANCE_TYPE:"Unknown instance type. Common types include: t4g.micro, t4g.small, m5.large",ARCHITECTURE_MISMATCH:"Architecture mismatch between instance type and AMI",ALLOCATED_STORAGE:{INTEGER:"Allocated storage must be an integer",MIN:"Allocated storage must be at least 20 GB",MAX:"Allocated storage cannot exceed 65536 GB"},DLQ:{MAX_RECEIVE_COUNT:{INTEGER:"Max receive count must be an integer",MIN:"Max receive count must be at least 1",MAX:"Max receive count cannot exceed 1000"}},ALARM:{PERCENTAGE:{MIN:"Threshold must be at least 1%",MAX:"Threshold must be at most 100%"},FREE_STORAGE_GIB:{MIN:"Free storage threshold must be at least 1 GiB"}},REGION:"Invalid AWS region",PASCAL_CASE:"Resource name must start with an uppercase letter and contain only alphanumerics (PascalCase).",IMAGE_DOCKER_MUTEX:"image and docker are mutually exclusive",AWS_ACCOUNT_ID:"AWS account id must be exactly 12 digits (no hyphens)",VPC_ID:"VPC id must look like vpc-abc12345",ROLE_ARN:"Role ARN must have the form arn:aws:iam::<account-id>:role/<name>",CIDR:"CIDR must be in dotted-quad/prefix-length form (e.g. 10.0.0.0/16)",VPC_PEER:{MIN_REQUESTER_ACCOUNTS:"At least one requester account id is required",REGION_REQUIRED:"Peer region is required when specified",ROUTE_TABLE_ID_REQUIRED:"Route table id must not be empty"},SCHEDULE_EXPRESSION:"Schedule expression must be 'rate(N minute|minutes|hour|hours|day|days)' with N>=1, or 'cron(<6-field AWS expression>)'"});var Kk=Object.defineProperty,nt=(e,t)=>Kk(e,"name",{value:t,configurable:!0}),Yk=["us-east-2","us-west-2","us-east-1","eu-west-1","eu-central-1","ap-southeast-1"],Xk=Object.freeze(Yk.flatMap(e=>{let t=Hn(e);return t?[t]:[]})),eh=Object.freeze(["us-east-2","us-west-2","us-east-1","eu-west-1","ap-southeast-1"]);function Rc(e){return e?e.split(",").map(t=>t.trim()).filter(Boolean):[]}nt(Rc,"parseRegionList");function th(e){return Vt.includes(e)}nt(th,"isValidRegion");function rh(e){return/^[a-z]{2}-[a-z]+-[1-9]$/.test(e)}nt(rh,"isValidRegionFormat");function nh(e){if(!e)return eh.slice(0,3);let t=e.toLowerCase().split("-"),n=t[0],i=t.length>1?t[1]:"",r=[];return n&&i&&(r=Vt.filter(o=>o.startsWith(`${n}-${i}`))),r.length===0&&n&&(r=Vt.filter(o=>o.startsWith(`${n}-`))),r.length>0?r.slice(0,3):eh.slice(0,3)}nt(nh,"getSuggestions");function ih(e){if(th(e))return!0;let t=nh(e);return rh(e)?`Unknown region. Try: ${t.join(", ")}`:`Invalid format. Try: ${t.join(", ")}`}nt(ih,"validateRegion");function $A(e){if(!e||e.trim()==="")return!0;let t=Rc(e);for(let n of t){let i=ih(n);if(i!==!0)return i}return!0}nt($A,"validateRegionList");function oh(e,t){return e.filter(n=>n!==t)}nt(oh,"filterDuplicateRegions");function ah(e){return{label:e.city,value:e.code,description:e.optIn?`${e.code} \u2014 opt-in required`:e.code}}nt(ah,"toRegionOption");function RA(){return rt.map(ah)}nt(RA,"getRegionOptions");function NA(e){return rt.filter(t=>t.code!==e).map(ah)}nt(NA,"getRegionOptionsExcluding");function CA(e){let t=rt.find(n=>n.code===e);return t?t.city:e}nt(CA,"getRegionName");function PA(e){return t=>{let n=Rc(t);return oh(n,e)}}nt(PA,"createRegionFormatter");var Nc="11.0.0";var Cc=["Aurora","Instance","GlobalAurora","ClickHouse"],ri=["FARGATE","FARGATE_SPOT","EC2"],bt=["standard","resilient","enterprise"],Pc=["tinkerer","lightweight","standard","resilient","enterprise"],sh="custom",xo=[...Pc,sh];var Jk=Object.defineProperty,qk=(e,t)=>Jk(e,"name",{value:t,configurable:!0}),j2=Object.freeze({RESOURCE_SUFFIXES:Object.freeze({storage:"Storage",database:"Database",cluster:"Cluster",function:"Function",instance:"Instance",compute:"Compute"})}),Io=["ecs","lambda","ec2"],ni=Object.freeze({ECS:"ecs",LAMBDA:"lambda",EC2:"ec2"}),kc=["code","container"],To=Object.freeze({CODE:"code",CONTAINER:"container"}),Oc=["ARM_64","X86_64"],kA="ARM_64",$o=["NONE","AWS_IAM"],Dc=["public","internal"],wc=["CPU","MEMORY"],Mc=["ARM","STANDARD"],ch=["Instance","Aurora"],ii=["postgresql","mysql"],Ro=["web","worker"],OA=["foundation","compliance","hardened"];var jc=["t3.nano","t3.micro","t3.small","t3.medium","t3.large","t3.xlarge","t3.2xlarge","t3a.nano","t3a.micro","t3a.small","t3a.medium","t3a.large","t3a.xlarge","t3a.2xlarge","t4g.nano","t4g.micro","t4g.small","t4g.medium","t4g.large","t4g.xlarge","t4g.2xlarge","c5.large","c5.xlarge","c5.2xlarge","c5.4xlarge","c5.9xlarge","c5.12xlarge","c5.18xlarge","c5.24xlarge","c5a.large","c5a.xlarge","c5a.2xlarge","c5a.4xlarge","c5a.8xlarge","c5a.12xlarge","c5a.16xlarge","c5a.24xlarge","c6g.medium","c6g.large","c6g.xlarge","c6g.2xlarge","c6g.4xlarge","c6g.8xlarge","c6g.12xlarge","c6g.16xlarge","r5.large","r5.xlarge","r5.2xlarge","r5.4xlarge","r5.8xlarge","r5.12xlarge","r5.16xlarge","r5.24xlarge","r5a.large","r5a.xlarge","r5a.2xlarge","r5a.4xlarge","r5a.8xlarge","r5a.12xlarge","r5a.16xlarge","r5a.24xlarge","r6g.medium","r6g.large","r6g.xlarge","r6g.2xlarge","r6g.4xlarge","r6g.8xlarge","r6g.12xlarge","r6g.16xlarge","i3.large","i3.xlarge","i3.2xlarge","i3.4xlarge","i3.8xlarge","i3.16xlarge","p3.2xlarge","p3.8xlarge","p3.16xlarge","g4dn.xlarge","g4dn.2xlarge","g4dn.4xlarge","g4dn.8xlarge","g4dn.12xlarge","g4dn.16xlarge","m5.large","m5.xlarge","m5.2xlarge","m5.4xlarge","m5.8xlarge","m5.12xlarge","m5.16xlarge","m5.24xlarge","m5a.large","m5a.xlarge","m5a.2xlarge","m5a.4xlarge","m5a.8xlarge","m5a.12xlarge","m5a.16xlarge","m5a.24xlarge"],DA=[0,1,5,10,15,30,60];function it(e,t){return e.includes(t)}qk(it,"constIncludes");var wA=1,MA=65535,B2=Object.freeze({postgresql:5432,mysql:3306}),jA=128,zA=10240,zc=1,Lc=900,uh=1,lh=1e3,oi=100,LA=100;var UA=3e3;var FA=["GET","POST","PUT","DELETE","HEAD","OPTIONS","PATCH"],BA=["standard","assets","upload","website"],ai=["AES256","KMS"];var Qk=Object.defineProperty,No=(e,t)=>Qk(e,"name",{value:t,configurable:!0}),Be=No(e=>s.union([s.literal(!1),e]),"optionalOrDisabled"),Ur={check:No(e=>e.minCapacity!==void 0&&e.maxCapacity!==void 0?e.minCapacity<=e.maxCapacity:!0,"check"),params:{message:d.CAPACITY_CONSTRAINT.MIN_LTE_MAX,path:["maxCapacity"]}},Co=No(e=>s.number().int(d.MEMORY_LIMIT.INTEGER).min(e,e===128?d.MEMORY_LIMIT.MIN_128:d.MEMORY_LIMIT.MIN_512).max(30720,d.MEMORY_LIMIT.MAX),"memoryLimitMiBSchema"),F=s.string().min(1,d.REQUIRED.RESOURCE_NAME).max(63,d.MAX_LENGTH.RESOURCE_NAME).regex(j.RESOURCE_NAME,d.RESOURCE_NAME),GA=s.string().min(1,d.REQUIRED.BUCKET_NAME).max(63,d.MAX_LENGTH.BUCKET_NAME).regex(j.BUCKET_NAME,d.BUCKET_NAME),ZA=s.string().min(1,d.REQUIRED.DATABASE_NAME).max(63,d.MAX_LENGTH.DATABASE_NAME).regex(j.DATABASE_NAME,d.DATABASE_NAME);function Uc(e,t=j.IDENTIFIER,n=d.IDENTIFIER){return s.string().min(2,d.IDENTIFIER_MIN_LENGTH).max(50,e).regex(t,n).refine(i=>!i.endsWith("-"),{message:d.IDENTIFIER_NO_TRAILING_HYPHEN}).refine(i=>!i.includes("--"),{message:d.IDENTIFIER_NO_CONSECUTIVE_HYPHENS})}No(Uc,"identifierSchema");var ge=Uc(d.MAX_LENGTH.APP_NAME),Y2=Uc(d.MAX_LENGTH.APP_NAME,j.NEW_APP_NAME,d.NEW_APP_NAME),Fr=s.number().int(d.PORT.INTEGER).min(wA,d.PORT.MIN).max(MA,d.PORT.MAX),Ie=s.object({key:s.string(),sourceText:s.string()}).strict(),eO=s.object({__identifier:s.string()}).strict(),tO=s.object({__expression:s.string()}).strict(),rO=s.object({__call:s.string()}).strict(),nO=s.union([eO,tO,rO]),iO=s.union([s.string(),s.number(),s.boolean(),nO]),si=s.record(s.string().regex(j.ENV_VAR_NAME,d.ENV_VAR_NAME),iO),oO=s.object({id:s.string(),name:s.string().optional(),arn:s.string().optional(),field:s.string().optional()}).strict().refine(e=>e.name!==void 0!=(e.arn!==void 0),{message:"secretsImport requires exactly one of `name` or `arn`."}),WA=s.record(s.string(),oO),X2=s.record(s.string(),s.unknown()),dh=s.enum(xo).describe(`Application type must be one of: ${xo.join(", ")}`),mh=s.enum(Rt).describe(`OpenNext deployment pattern: ${Rt.join(", ")}`),aO=s.enum(["before-imports","after-imports","after-app-init","after-tags","after-resource","end-of-file"]),sO=s.enum(["import","app-init","tags","database","compute","storage","network","messaging","cdn","pattern","vpc-peer","vpc-peer-accepter","cross-plan-connection","custom"]),HA=s.object({sourceText:s.string(),position:aO,afterManagedResource:s.object({type:sO,name:s.string().optional()}).strict().optional(),originalLine:s.number().int().optional(),leadingComments:s.array(s.string()).optional(),orphaned:s.boolean().optional(),orphanedComment:s.string().optional()}).strict(),KA=s.union([s.object({tier:s.enum(bt)}).strict(),s.literal(!1)]),YA=s.union([s.object({instanceType:s.string().optional()}).strict(),s.literal(!1)]),cO=Uc(d.MAX_LENGTH.ORGANISATION_NAME),uO=s.string().regex(j.EMAIL,d.EMAIL),VA=s.string().refine(e=>Vt.includes(e),{message:d.REGION}),J2=s.object({name:cO,email:uO,accountName:s.string().optional(),primaryRegion:VA.optional().default(Wn),secondaryRegions:s.array(VA).optional(),security:s.enum(OA).optional(),force:s.boolean().optional()}).strict();function Po(e){return e.issues.map(t=>`${t.path.length>0?`${t.path.join(".")}: `:""}${t.message}`).join(`
+`:"";return G+Lt+u+v}$c(IA,"extractErrorWindow");var Gk=Object.defineProperty,ti=(e,t)=>Gk(e,"name",{value:t,configurable:!0});function Yg(e){return e.success===!0}ti(Yg,"isSuccess");function Xg(e){return e.success===!1}ti(Xg,"isFailure");function C(e){return{success:!0,data:e}}ti(C,"success");function I(e){return{success:!1,error:e}}ti(I,"failure");async function Jg(e){try{let t=await e();return C(t)}catch(t){return I(vt(t))}}ti(Jg,"tryAsync");function qg(e){try{let t=e();return C(t)}catch(t){return I(vt(t))}}ti(qg,"trySync");var Zk=Object.defineProperty,Wk=(e,t)=>Zk(e,"name",{value:t,configurable:!0}),TA=/^[a-zA-Z][a-zA-Z0-9-]*$/,Hk=_o.source.replace(/^\^|\$$/g,""),j=Object.freeze({IDENTIFIER:TA,NEW_APP_NAME:/^[a-z][a-z0-9-]*$/,RESOURCE_NAME:/^[a-zA-Z][a-zA-Z0-9]*$/,ECS_SERVICE_NAME:TA,BUCKET_NAME:/^[a-z][a-z0-9-]*[a-z0-9]$|^[a-z][a-z0-9]*$/,DATABASE_NAME:/^[a-zA-Z][a-zA-Z0-9_]*$/,RESOURCE_TYPE:/^[a-z]+(:[a-z]+)?$/,SSM_PATH:new RegExp(`^(?:/${Hk})+$`),SECRET_NAME:Ac,SSM_COMPONENT:_o,EMAIL:/^[^\s@]+@[^\s@]+\.[^\s@]+$/,DOCKER_IMAGE:/^[a-z0-9][a-z0-9._-]*[a-z0-9](:[a-z0-9._-]+)?$/,DOMAIN:/^[a-z0-9]([a-z0-9-]*[a-z0-9])?(\.[a-z0-9]([a-z0-9-]*[a-z0-9])?)+$/i,HTTP_ORIGIN:/^https?:\/\/[a-z0-9.-]+(:\d+)?$/i,PASCAL_CASE:/^[A-Z][A-Za-z0-9]*$/,AWS_ACCOUNT_ID:/^\d{12}$/,VPC_ID:/^vpc-[a-z0-9]+$/,ROLE_ARN:/^arn:aws[a-zA-Z-]*:iam::\d{12}:role\/.+$/,CIDR:/^((25[0-5]|2[0-4]\d|1\d\d|[1-9]?\d)\.){3}(25[0-5]|2[0-4]\d|1\d\d|[1-9]?\d)\/(3[0-2]|[12]?\d)$/,SCHEDULE_EXPRESSION:/^(rate\(1 (?:minute|hour|day)\)|rate\((?:[2-9]|[1-9]\d+) (?:minutes|hours|days)\)|cron\([^\s()]+ [^\s()]+ [^\s()]+ [^\s()]+ [^\s()]+ [^\s()]+\))$/,LAMBDA_RUNTIME_IDENTIFIER:/^[A-Za-z0-9._-]+$/,ENV_VAR_NAME:/^[A-Za-z_][A-Za-z0-9_]*$/});function Qg(e){let t=/^rate\((\d+) (minute|minutes|hour|hours|day|days)\)$/.exec(e);if(!t)return;let n=t[1],i=t[2];if(n===void 0||i===void 0)return;let r=parseInt(n,10);if(!Number.isFinite(r)||r<1)return;let o=i==="minute"||i==="hour"||i==="day";if(!(o&&r!==1)&&!(!o&&r===1))return i==="minute"||i==="minutes"?{everyMs:r*6e4}:i==="hour"||i==="hours"?{everyMs:r*60*6e4}:{everyMs:r*24*60*6e4}}Wk(Qg,"parseRateExpression");var d=Object.freeze({IDENTIFIER:"Must start with a letter, contain only letters, numbers, and hyphens",NEW_APP_NAME:"Must start with a lowercase letter and contain only lowercase letters, numbers, and hyphens",IDENTIFIER_MIN_LENGTH:"Must be at least 2 characters",IDENTIFIER_NO_TRAILING_HYPHEN:"Must not end with a hyphen",IDENTIFIER_NO_CONSECUTIVE_HYPHENS:"Must not contain consecutive hyphens",RESOURCE_NAME:"Must start with a letter and contain only letters and numbers (PascalCase recommended)",ECS_SERVICE_NAME:"Service name must start with a letter and contain only letters, numbers, and hyphens",BUCKET_NAME:"Bucket name must start with a lowercase letter and contain only lowercase letters, numbers, and hyphens",DATABASE_NAME:"Database name must start with a letter and contain only letters, numbers, and underscores",RESOURCE_TYPE:"Resource type must be in format 'category' or 'category:type'",SSM_PATH:"SSM path must start with / and contain valid namespace segments (e.g., /myapp/ApiCluster/service)",SECRET_NAME:Ng,SSM_COMPONENT:xc,EMAIL:"Please enter a valid email address",DOMAIN:"Please enter a valid domain (e.g., cms.example.com)",DOCKER_IMAGE:"Invalid Docker image name format",REQUIRED:{APP_NAME:"Application name is required",RESOURCE_NAME:"Resource name is required",BUCKET_NAME:"Bucket name is required",SERVICE_NAME:"Service name is required",NETWORK_NAME:"Network name is required",DATABASE_NAME:"Database name is required",ORGANISATION_NAME:"Organisation name is required",EMAIL:"Email is required",NAME:"Name is required",USERNAME:"Username is required",CONTAINER_NAME:"Container name is required",GROUP:"Group is required",PATTERN_NAME:"Pattern name is required",SOURCE:"Source directory is required",BUILD_COMMAND:"Build command is required",OUTPUT_DIR:"Output directory is required",FORMS_TO:"Forms recipient address is required",ROUTING_PATH:"Routing path is required",RESOURCE_REFERENCE:"Resource reference is required",RESOURCE_TYPE:"Resource type is required",VARIANT:"Variant is required",SUBTYPE:"Subtype is required",DEPLOY_TARGET:"Deploy target is required",DESTROY_TARGET:"Destroy target is required"},MAX_LENGTH:{APP_NAME:"Application name must be 50 characters or less",RESOURCE_NAME:"Resource name must be 63 characters or less",BUCKET_NAME:"Bucket name must be 63 characters or less",SERVICE_NAME:"Service name must be 255 characters or less",NETWORK_NAME:"Network name must be 50 characters or less",DATABASE_NAME:"Database name must be 63 characters or less",ORGANISATION_NAME:"Organisation name must be 50 characters or less"},PORT:{INTEGER:"Port must be an integer",MIN:"Port must be at least 1",MAX:"Port cannot exceed 65535"},USERNAME:{MAX_LENGTH:"Username cannot exceed 63 characters"},LAMBDA:{MEMORY:{INTEGER:"Lambda memory must be an integer",MIN:"Memory must be at least 128 MB",MAX:"Memory cannot exceed 10240 MB",MULTIPLE:"Memory must be 128 MB or a multiple of 64 MB"},TIMEOUT:{INTEGER:"Timeout must be an integer",MIN:"Timeout must be at least 1 second",MAX:"Timeout cannot exceed 900 seconds"},RUNTIME:"Lambda runtime must contain only letters, digits, dots, underscores, or dashes (e.g. 'NODEJS_20_X' or 'nodejs20.x')"},ENV_VAR_NAME:"Environment variable names must start with a letter or underscore and contain only letters, digits, and underscores",PRIORITY:{INTEGER:"Priority must be an integer",MIN:"Priority must be at least 1",MAX:"Priority cannot exceed 50000"},CAPACITY:{MIN:{INTEGER:"Minimum capacity must be an integer",MIN_0:"Minimum capacity must be at least 0",MIN_1:"Minimum capacity must be at least 1",MAX:"Minimum capacity cannot exceed 100"},MAX:{INTEGER:"Maximum capacity must be an integer",MIN_0:"Maximum capacity must be at least 0",MIN_1:"Maximum capacity must be at least 1",MAX:"Maximum capacity cannot exceed 100"},DESIRED:{INTEGER:"Desired count must be an integer",MIN:"Desired count must be at least 0",MAX:"Desired count cannot exceed 100"},WARM_POOL_REQUIRED:"minCapacity 0 requires a warmPool \u2014 without it, new tasks wait 60-90s for a cold instance launch",WARM_POOL:{MIN_SIZE:{INTEGER:"Warm pool minSize must be an integer",MIN:"Warm pool minSize must be at least 0",MAX:"Warm pool minSize cannot exceed 100"},MIN_SIZE_EXCEEDS_MAX_CAPACITY:"warmPool.minSize cannot exceed maxCapacity \u2014 the warm pool cannot hold more instances than the ASG allows"}},MEMORY_LIMIT:{INTEGER:"Memory limit must be an integer",MIN_512:"Memory limit must be at least 512 MiB",MIN_128:"Memory limit must be at least 128 MiB",MAX:"Memory limit cannot exceed 30720 MiB"},DATABASE:{PORT:{INTEGER:"Database port must be an integer",MIN:"Database port must be at least 1024",MAX:"Database port cannot exceed 65535"},NAME:{REQUIRED:"Database name is required",MAX_LENGTH:"Database name must be 63 characters or less"}},BACKUP_RETENTION:{INTEGER:"Backup retention must be an integer",MIN:"Backup retention must be at least 1 day",MAX:"Backup retention cannot exceed 35 days"},SQS:{VISIBILITY_TIMEOUT:{INTEGER:"Visibility timeout must be an integer",MIN:"Visibility timeout must be at least 0 seconds",MAX:"Visibility timeout cannot exceed 43200 seconds (12 hours)"},RETENTION_PERIOD:{INTEGER:"Retention period must be an integer",MIN:"Retention period must be at least 60 seconds",MAX:"Retention period cannot exceed 1209600 seconds (14 days)"}},READER:{COUNT:{INTEGER:"Reader count must be an integer",MIN:"Reader count must be at least 0",MAX:"Reader count cannot exceed 15"}},IDENTIFIER_SUFFIX:{REQUIRED:"Identifier suffix is required when specified",MAX_LENGTH:"Identifier suffix cannot exceed 50 characters"},ROTATION:{INTEGER:"Rotation days must be an integer",MIN:"Rotation interval must be at least 1 day",MAX:"Rotation interval cannot exceed 365 days"},MAX_CONNECTIONS:{INTEGER:"Max connections must be an integer",MIN:"Max connections must be at least 1",MAX:"Max connections cannot exceed 100"},MONITORING_INTERVAL:{INTEGER:"Monitoring interval must be an integer",MIN:"Monitoring interval must be at least 0",MAX:"Monitoring interval cannot exceed 60 seconds",VALUES:"Monitoring interval must be 0, 1, 5, 10, 15, 30, or 60 seconds"},RETENTION_DAYS:{INTEGER:"Retention days must be an integer",MIN:"Retention days must be at least 1",MAX:"Retention days cannot exceed 365"},BATCH_SIZE:{INTEGER:"Batch size must be an integer",MIN:"Batch size must be at least 1",MAX:"Batch size cannot exceed 10000"},SERVICE:{UNIQUE_WITHIN_CLUSTER:"Service names must be unique within a cluster",MIN_REQUIRED:"At least one service is required",ROUTING_REQUIRED:"Multiple services with ports require routing config (path or host)"},PROXY_CONFIG:{MAX_IDLE_CONNECTIONS:{INTEGER:"Max idle connections must be an integer",MIN:"Max idle connections must be at least 0",MAX:"Max idle connections cannot exceed 100"},BORROW_TIMEOUT:{INTEGER:"Connection borrow timeout must be an integer",MIN:"Connection borrow timeout must be at least 1 second",MAX:"Connection borrow timeout cannot exceed 3600 seconds"}},MAX_AZS:{INTEGER:"Max AZs must be an integer",MIN:"Max AZs must be at least 1",MAX:"Max AZs cannot exceed 3"},BATCHING_WINDOW:{INTEGER:"Max batching window must be an integer",MIN:"Max batching window must be at least 0",MAX:"Max batching window cannot exceed 300 seconds"},HEALTH_CHECK:{INTERVAL:{INTEGER:"Health check interval must be an integer",MIN:"Health check interval must be at least 5 seconds",MAX:"Health check interval cannot exceed 300 seconds"},TIMEOUT:{INTEGER:"Health check timeout must be an integer",MIN:"Health check timeout must be at least 2 seconds",MAX:"Health check timeout cannot exceed 60 seconds"},RETRIES:{INTEGER:"Health check retries must be an integer",MIN:"Health check retries must be at least 1",MAX:"Health check retries cannot exceed 10"},START_PERIOD:{INTEGER:"Health check start period must be an integer",MIN:"Health check start period must be at least 0 seconds",MAX:"Health check start period cannot exceed 300 seconds"}},EPHEMERAL_STORAGE:{INTEGER:"Ephemeral storage size must be an integer",MIN:"Ephemeral storage size must be at least 512 MB",MAX:"Ephemeral storage size cannot exceed 10240 MB"},MAX_MESSAGE_SIZE:{INTEGER:"Max message size must be an integer",MIN:"Max message size must be at least 1024 bytes",MAX:"Max message size cannot exceed 262144 bytes (256 KB)"},CAPACITY_CONSTRAINT:{MIN_LTE_MAX:"minCapacity must be less than or equal to maxCapacity"},DIRECT_ACCESS:{NO_DOMAIN:"directAccess cannot be used with domain (no ALB for HTTPS)",NO_LOAD_BALANCER:"directAccess cannot be used with loadBalancer (mutually exclusive)"},GLOBAL_AURORA:{PRIMARY_REGION_REQUIRED:"primaryRegion is required for GlobalAurora databases"},NAT_GATEWAY:{INTEGER:"NAT gateway count must be an integer",MIN:"NAT gateway count must be at least 0",MAX:"NAT gateway count cannot exceed 3"},CIDR_MASK:{INTEGER:"CIDR mask must be an integer",MIN:"CIDR mask must be at least 16",MAX:"CIDR mask cannot exceed 28"},CPU:{INTEGER:"CPU must be an integer",MIN:"CPU must be at least 256 units",MAX:"CPU cannot exceed 4096 units"},KMS:{KEY_REQUIRED:"KMS key ARN is required when using KMS encryption"},READER_INSTANCES:{MAX:"Cannot have more than 15 reader instances",COUNT_OR_INSTANCES:"Cannot specify both 'count' and 'instances' - use one or the other"},GENERATOR_CAPACITY:{MIN:{MIN:"Minimum capacity must be at least 1",MAX:"Minimum capacity cannot exceed 1000"},MAX:{MIN:"Maximum capacity must be at least 1",MAX:"Maximum capacity cannot exceed 1000"}},INSTANCE_TYPE:"Unknown instance type. Common types include: t4g.micro, t4g.small, m5.large",ARCHITECTURE_MISMATCH:"Architecture mismatch between instance type and AMI",ALLOCATED_STORAGE:{INTEGER:"Allocated storage must be an integer",MIN:"Allocated storage must be at least 20 GB",MAX:"Allocated storage cannot exceed 65536 GB"},DLQ:{MAX_RECEIVE_COUNT:{INTEGER:"Max receive count must be an integer",MIN:"Max receive count must be at least 1",MAX:"Max receive count cannot exceed 1000"}},ALARM:{PERCENTAGE:{MIN:"Threshold must be at least 1%",MAX:"Threshold must be at most 100%"},FREE_STORAGE_GIB:{MIN:"Free storage threshold must be at least 1 GiB"}},REGION:"Invalid AWS region",PASCAL_CASE:"Resource name must start with an uppercase letter and contain only alphanumerics (PascalCase).",IMAGE_DOCKER_MUTEX:"image and docker are mutually exclusive",AWS_ACCOUNT_ID:"AWS account id must be exactly 12 digits (no hyphens)",VPC_ID:"VPC id must look like vpc-abc12345",ROLE_ARN:"Role ARN must have the form arn:aws:iam::<account-id>:role/<name>",CIDR:"CIDR must be in dotted-quad/prefix-length form (e.g. 10.0.0.0/16)",VPC_PEER:{MIN_REQUESTER_ACCOUNTS:"At least one requester account id is required",REGION_REQUIRED:"Peer region is required when specified",ROUTE_TABLE_ID_REQUIRED:"Route table id must not be empty"},SCHEDULE_EXPRESSION:"Schedule expression must be 'rate(N minute|minutes|hour|hours|day|days)' with N>=1, or 'cron(<6-field AWS expression>)'"});var Kk=Object.defineProperty,nt=(e,t)=>Kk(e,"name",{value:t,configurable:!0}),Yk=["us-east-2","us-west-2","us-east-1","eu-west-1","eu-central-1","ap-southeast-1"],Xk=Object.freeze(Yk.flatMap(e=>{let t=Hn(e);return t?[t]:[]})),eh=Object.freeze(["us-east-2","us-west-2","us-east-1","eu-west-1","ap-southeast-1"]);function Rc(e){return e?e.split(",").map(t=>t.trim()).filter(Boolean):[]}nt(Rc,"parseRegionList");function th(e){return Vt.includes(e)}nt(th,"isValidRegion");function rh(e){return/^[a-z]{2}-[a-z]+-[1-9]$/.test(e)}nt(rh,"isValidRegionFormat");function nh(e){if(!e)return eh.slice(0,3);let t=e.toLowerCase().split("-"),n=t[0],i=t.length>1?t[1]:"",r=[];return n&&i&&(r=Vt.filter(o=>o.startsWith(`${n}-${i}`))),r.length===0&&n&&(r=Vt.filter(o=>o.startsWith(`${n}-`))),r.length>0?r.slice(0,3):eh.slice(0,3)}nt(nh,"getSuggestions");function ih(e){if(th(e))return!0;let t=nh(e);return rh(e)?`Unknown region. Try: ${t.join(", ")}`:`Invalid format. Try: ${t.join(", ")}`}nt(ih,"validateRegion");function $A(e){if(!e||e.trim()==="")return!0;let t=Rc(e);for(let n of t){let i=ih(n);if(i!==!0)return i}return!0}nt($A,"validateRegionList");function oh(e,t){return e.filter(n=>n!==t)}nt(oh,"filterDuplicateRegions");function ah(e){return{label:e.city,value:e.code,description:e.optIn?`${e.code} \u2014 opt-in required`:e.code}}nt(ah,"toRegionOption");function RA(){return rt.map(ah)}nt(RA,"getRegionOptions");function NA(e){return rt.filter(t=>t.code!==e).map(ah)}nt(NA,"getRegionOptionsExcluding");function CA(e){let t=rt.find(n=>n.code===e);return t?t.city:e}nt(CA,"getRegionName");function PA(e){return t=>{let n=Rc(t);return oh(n,e)}}nt(PA,"createRegionFormatter");var Nc="12.0.0";var Cc=["Aurora","Instance","GlobalAurora","ClickHouse"],ri=["FARGATE","FARGATE_SPOT","EC2"],bt=["standard","resilient","enterprise"],Pc=["tinkerer","lightweight","standard","resilient","enterprise"],sh="custom",xo=[...Pc,sh];var Jk=Object.defineProperty,qk=(e,t)=>Jk(e,"name",{value:t,configurable:!0}),j2=Object.freeze({RESOURCE_SUFFIXES:Object.freeze({storage:"Storage",database:"Database",cluster:"Cluster",function:"Function",instance:"Instance",compute:"Compute"})}),Io=["ecs","lambda","ec2"],ni=Object.freeze({ECS:"ecs",LAMBDA:"lambda",EC2:"ec2"}),kc=["code","container"],To=Object.freeze({CODE:"code",CONTAINER:"container"}),Oc=["ARM_64","X86_64"],kA="ARM_64",$o=["NONE","AWS_IAM"],Dc=["public","internal"],wc=["CPU","MEMORY"],Mc=["ARM","STANDARD"],ch=["Instance","Aurora"],ii=["postgresql","mysql"],Ro=["web","worker"],OA=["foundation","compliance","hardened"];var jc=["t3.nano","t3.micro","t3.small","t3.medium","t3.large","t3.xlarge","t3.2xlarge","t3a.nano","t3a.micro","t3a.small","t3a.medium","t3a.large","t3a.xlarge","t3a.2xlarge","t4g.nano","t4g.micro","t4g.small","t4g.medium","t4g.large","t4g.xlarge","t4g.2xlarge","c5.large","c5.xlarge","c5.2xlarge","c5.4xlarge","c5.9xlarge","c5.12xlarge","c5.18xlarge","c5.24xlarge","c5a.large","c5a.xlarge","c5a.2xlarge","c5a.4xlarge","c5a.8xlarge","c5a.12xlarge","c5a.16xlarge","c5a.24xlarge","c6g.medium","c6g.large","c6g.xlarge","c6g.2xlarge","c6g.4xlarge","c6g.8xlarge","c6g.12xlarge","c6g.16xlarge","r5.large","r5.xlarge","r5.2xlarge","r5.4xlarge","r5.8xlarge","r5.12xlarge","r5.16xlarge","r5.24xlarge","r5a.large","r5a.xlarge","r5a.2xlarge","r5a.4xlarge","r5a.8xlarge","r5a.12xlarge","r5a.16xlarge","r5a.24xlarge","r6g.medium","r6g.large","r6g.xlarge","r6g.2xlarge","r6g.4xlarge","r6g.8xlarge","r6g.12xlarge","r6g.16xlarge","i3.large","i3.xlarge","i3.2xlarge","i3.4xlarge","i3.8xlarge","i3.16xlarge","p3.2xlarge","p3.8xlarge","p3.16xlarge","g4dn.xlarge","g4dn.2xlarge","g4dn.4xlarge","g4dn.8xlarge","g4dn.12xlarge","g4dn.16xlarge","m5.large","m5.xlarge","m5.2xlarge","m5.4xlarge","m5.8xlarge","m5.12xlarge","m5.16xlarge","m5.24xlarge","m5a.large","m5a.xlarge","m5a.2xlarge","m5a.4xlarge","m5a.8xlarge","m5a.12xlarge","m5a.16xlarge","m5a.24xlarge"],DA=[0,1,5,10,15,30,60];function it(e,t){return e.includes(t)}qk(it,"constIncludes");var wA=1,MA=65535,B2=Object.freeze({postgresql:5432,mysql:3306}),jA=128,zA=10240,zc=1,Lc=900,uh=1,lh=1e3,oi=100,LA=100;var UA=3e3;var FA=["GET","POST","PUT","DELETE","HEAD","OPTIONS","PATCH"],BA=["standard","assets","upload","website"],ai=["AES256","KMS"];var Qk=Object.defineProperty,No=(e,t)=>Qk(e,"name",{value:t,configurable:!0}),Be=No(e=>s.union([s.literal(!1),e]),"optionalOrDisabled"),Ur={check:No(e=>e.minCapacity!==void 0&&e.maxCapacity!==void 0?e.minCapacity<=e.maxCapacity:!0,"check"),params:{message:d.CAPACITY_CONSTRAINT.MIN_LTE_MAX,path:["maxCapacity"]}},Co=No(e=>s.number().int(d.MEMORY_LIMIT.INTEGER).min(e,e===128?d.MEMORY_LIMIT.MIN_128:d.MEMORY_LIMIT.MIN_512).max(30720,d.MEMORY_LIMIT.MAX),"memoryLimitMiBSchema"),F=s.string().min(1,d.REQUIRED.RESOURCE_NAME).max(63,d.MAX_LENGTH.RESOURCE_NAME).regex(j.RESOURCE_NAME,d.RESOURCE_NAME),GA=s.string().min(1,d.REQUIRED.BUCKET_NAME).max(63,d.MAX_LENGTH.BUCKET_NAME).regex(j.BUCKET_NAME,d.BUCKET_NAME),ZA=s.string().min(1,d.REQUIRED.DATABASE_NAME).max(63,d.MAX_LENGTH.DATABASE_NAME).regex(j.DATABASE_NAME,d.DATABASE_NAME);function Uc(e,t=j.IDENTIFIER,n=d.IDENTIFIER){return s.string().min(2,d.IDENTIFIER_MIN_LENGTH).max(50,e).regex(t,n).refine(i=>!i.endsWith("-"),{message:d.IDENTIFIER_NO_TRAILING_HYPHEN}).refine(i=>!i.includes("--"),{message:d.IDENTIFIER_NO_CONSECUTIVE_HYPHENS})}No(Uc,"identifierSchema");var ge=Uc(d.MAX_LENGTH.APP_NAME),Y2=Uc(d.MAX_LENGTH.APP_NAME,j.NEW_APP_NAME,d.NEW_APP_NAME),Fr=s.number().int(d.PORT.INTEGER).min(wA,d.PORT.MIN).max(MA,d.PORT.MAX),Ie=s.object({key:s.string(),sourceText:s.string()}).strict(),eO=s.object({__identifier:s.string()}).strict(),tO=s.object({__expression:s.string()}).strict(),rO=s.object({__call:s.string()}).strict(),nO=s.union([eO,tO,rO]),iO=s.union([s.string(),s.number(),s.boolean(),nO]),si=s.record(s.string().regex(j.ENV_VAR_NAME,d.ENV_VAR_NAME),iO),oO=s.object({id:s.string(),name:s.string().optional(),arn:s.string().optional(),field:s.string().optional()}).strict().refine(e=>e.name!==void 0!=(e.arn!==void 0),{message:"secretsImport requires exactly one of `name` or `arn`."}),WA=s.record(s.string(),oO),X2=s.record(s.string(),s.unknown()),dh=s.enum(xo).describe(`Application type must be one of: ${xo.join(", ")}`),mh=s.enum(Rt).describe(`OpenNext deployment pattern: ${Rt.join(", ")}`),aO=s.enum(["before-imports","after-imports","after-app-init","after-tags","after-resource","end-of-file"]),sO=s.enum(["import","app-init","tags","database","compute","storage","network","messaging","cdn","pattern","vpc-peer","vpc-peer-accepter","cross-plan-connection","custom"]),HA=s.object({sourceText:s.string(),position:aO,afterManagedResource:s.object({type:sO,name:s.string().optional()}).strict().optional(),originalLine:s.number().int().optional(),leadingComments:s.array(s.string()).optional(),orphaned:s.boolean().optional(),orphanedComment:s.string().optional()}).strict(),KA=s.union([s.object({tier:s.enum(bt)}).strict(),s.literal(!1)]),YA=s.union([s.object({instanceType:s.string().optional()}).strict(),s.literal(!1)]),cO=Uc(d.MAX_LENGTH.ORGANISATION_NAME),uO=s.string().regex(j.EMAIL,d.EMAIL),VA=s.string().refine(e=>Vt.includes(e),{message:d.REGION}),J2=s.object({name:cO,email:uO,accountName:s.string().optional(),primaryRegion:VA.optional().default(Wn),secondaryRegions:s.array(VA).optional(),security:s.enum(OA).optional(),force:s.boolean().optional()}).strict();function Po(e){return e.issues.map(t=>`${t.path.length>0?`${t.path.join(".")}: `:""}${t.message}`).join(`
 `)}No(Po,"getZodErrorMessage");var ci=s.number().min(1,d.ALARM.PERCENTAGE.MIN).max(100,d.ALARM.PERCENTAGE.MAX),lO=s.number().min(1,d.ALARM.FREE_STORAGE_GIB.MIN),XA=s.union([s.literal(!1),s.object({cpuThreshold:ci.optional(),memoryThreshold:ci.optional(),runningTasksMinimum:s.number().int().min(0).optional(),http5xxThreshold:ci.optional()}).strict()]),JA=s.union([s.literal(!1),s.object({cpuThreshold:ci.optional(),freeStorageThresholdGiB:lO.optional(),connectionsThreshold:s.number().int().min(1).optional()}).strict()]),qA=s.union([s.literal(!1),s.object({errorRateThreshold:ci.optional(),durationThresholdPercent:ci.optional()}).strict()]);var Gt=s.number().int(d.BACKUP_RETENTION.INTEGER).min(1,d.BACKUP_RETENTION.MIN).max(35,d.BACKUP_RETENTION.MAX),ko=s.number().int(d.MONITORING_INTERVAL.INTEGER).refine(e=>it(DA,e),{message:d.MONITORING_INTERVAL.VALUES}),Bc=s.number().int(d.DATABASE.PORT.INTEGER).min(1024,d.DATABASE.PORT.MIN).max(65535,d.DATABASE.PORT.MAX),dO=s.enum(Cc).describe(`Database type must be one of: ${Cc.join(", ")}`),mO=s.object({maxConnections:s.number().int(d.MAX_CONNECTIONS.INTEGER).min(1,d.MAX_CONNECTIONS.MIN).max(100,d.MAX_CONNECTIONS.MAX).optional(),maxIdleConnections:s.number().int(d.PROXY_CONFIG.MAX_IDLE_CONNECTIONS.INTEGER).min(0,d.PROXY_CONFIG.MAX_IDLE_CONNECTIONS.MIN).max(100,d.PROXY_CONFIG.MAX_IDLE_CONNECTIONS.MAX).optional(),connectionBorrowTimeout:s.number().int(d.PROXY_CONFIG.BORROW_TIMEOUT.INTEGER).min(1,d.PROXY_CONFIG.BORROW_TIMEOUT.MIN).max(3600,d.PROXY_CONFIG.BORROW_TIMEOUT.MAX).optional(),requireTLS:s.boolean().optional()}).strict().describe("RDS Proxy configuration"),pO=s.object({instanceType:s.string().optional(),availabilityZone:s.string().optional()}).strict().describe("Read replica configuration"),fO=s.object({automaticallyAfterDays:s.number().int(d.ROTATION.INTEGER).min(1,d.ROTATION.MIN).max(365,d.ROTATION.MAX).optional()}).strict().describe("Secret rotation configuration"),Vc=s.object({username:s.string().min(1,d.REQUIRED.USERNAME).max(63,d.USERNAME.MAX_LENGTH).optional(),secretRotation:fO.optional()}).strict().describe("Database credentials configuration"),Gc=Be(mO),Zc=Be(pO),gO=s.object({scaleWithWriter:s.boolean().optional(),enableDatabaseInsights:s.boolean().optional(),identifierSuffix:s.string().min(1,d.IDENTIFIER_SUFFIX.REQUIRED).max(50,d.IDENTIFIER_SUFFIX.MAX_LENGTH).optional(),availabilityZone:s.string().optional()}).strict().describe("Configuration for a single Aurora reader instance"),Oo=s.object({enableDatabaseInsights:s.boolean().optional(),identifierSuffix:s.string().min(1,d.IDENTIFIER_SUFFIX.REQUIRED).max(50,d.IDENTIFIER_SUFFIX.MAX_LENGTH).optional(),availabilityZone:s.string().optional()}).strict().describe("Configuration for Aurora writer instance"),hO=s.object({count:s.number().int(d.READER.COUNT.INTEGER).min(0,d.READER.COUNT.MIN).max(15,d.READER.COUNT.MAX).optional(),instances:s.array(gO).max(15,d.READER_INSTANCES.MAX).optional(),defaultEnableDatabaseInsights:s.boolean().optional()}).strict().refine(e=>!(e.count!==void 0&&e.instances!==void 0),{message:d.READER_INSTANCES.COUNT_OR_INSTANCES,path:["count"]}).describe("Aurora readers configuration"),Do=Be(hO),vO=s.object({awsManaged:s.literal(!0)}).strict(),bO=s.object({useCMK:s.literal(!0)}).strict(),QA=s.union([vO,bO]),yO=s.object({mode:s.enum(["standard","advanced"]).optional(),encryptionKey:QA.optional()}).strict().describe("Database Insights configuration"),Wc=Be(yO),Hc=s.object({storageKey:QA.optional()}).strict().describe("Encryption configuration (DESTRUCTIVE to change storageKey)"),ex=s.object({name:F,type:dO,databaseName:s.string().min(1,d.REQUIRED.DATABASE_NAME),instanceType:s.string().optional(),allocatedStorage:s.number().optional(),multiAz:s.boolean().optional(),publiclyAccessible:s.boolean().optional(),databaseInsights:Wc.optional(),port:Bc.optional(),deletionProtection:s.boolean().optional(),proxy:Gc.optional(),credentials:Vc.optional(),readReplica:Zc.optional(),encryption:Hc.optional(),writer:Oo.optional(),readers:Do.optional(),backupRetention:Gt.optional(),preferredMaintenanceWindow:s.string().optional(),monitoringInterval:ko.optional(),primaryRegion:s.string().optional(),secondaryRegions:s.array(s.string()).optional(),globalClusterIdentifier:s.string().optional(),enableGlobalWriteForwarding:s.boolean().optional(),snapshotIdentifier:s.string().optional(),snapshotUsername:s.string().optional(),databaseEngine:s.enum(ii).optional(),engineExpression:s.string().optional(),variableName:s.string().optional(),extraProperties:s.array(Ie).optional(),alarms:JA.optional()}).strict(),Kc=s.object({appName:ge,nameProvidedByFlag:s.boolean().optional(),databaseName:s.string().min(1,d.REQUIRED.DATABASE_NAME).max(63,d.MAX_LENGTH.DATABASE_NAME).regex(j.DATABASE_NAME,d.DATABASE_NAME),resourceName:F.optional(),connectionConfig:s.object({connectToCompute:s.array(s.string()).optional(),connectToServices:s.array(s.string()).optional()}).strict().optional(),databaseInsights:Wc.optional(),port:Bc.optional(),proxy:Gc.optional(),credentials:Vc.optional(),encryption:Hc.optional(),deletionProtection:s.boolean().optional()}).strict(),tx={databaseType:s.literal("Instance"),instanceType:s.string().optional(),multiAz:s.boolean().optional(),readReplica:Zc.optional(),publiclyAccessible:s.boolean().optional(),backupRetention:Gt.optional(),allocatedStorage:s.number().optional(),snapshotIdentifier:s.string().optional(),snapshotUsername:s.string().optional()},rx={databaseType:s.literal("Aurora"),writer:Oo.optional(),readers:Do.optional(),backupRetention:Gt.optional(),preferredMaintenanceWindow:s.string().optional(),monitoringInterval:ko.optional(),snapshotIdentifier:s.string().optional(),snapshotUsername:s.string().optional()},nx={databaseType:s.literal("GlobalAurora"),primaryRegion:s.string().min(1,d.GLOBAL_AURORA.PRIMARY_REGION_REQUIRED),secondaryRegions:s.array(s.string()).optional(),globalClusterIdentifier:s.string().optional(),enableGlobalWriteForwarding:s.boolean().optional(),writer:Oo.optional(),readers:Do.optional(),backupRetention:Gt.optional(),preferredMaintenanceWindow:s.string().optional(),monitoringInterval:ko.optional(),snapshotIdentifier:s.string().optional(),snapshotUsername:s.string().optional()},ix=s.object({appName:ge,nameProvidedByFlag:s.boolean().optional(),databaseName:s.string().min(1,d.REQUIRED.DATABASE_NAME).max(63,d.MAX_LENGTH.DATABASE_NAME).regex(j.DATABASE_NAME,d.DATABASE_NAME),resourceName:F.optional(),connectionConfig:s.object({connectToCompute:s.array(s.string()).optional(),connectToServices:s.array(s.string()).optional()}).strict().optional()}).strict(),ox={databaseType:s.literal("ClickHouse"),instanceType:s.string().optional(),coldTier:s.union([s.object({mode:s.literal("s3")}).strict(),s.literal(!1)]).optional(),optimiseSchedule:s.union([s.string(),s.literal(!1)]).optional(),backupSchedule:s.union([s.string(),s.literal(!1)]).optional(),backupRetentionDays:Gt.optional()},SO=Kc.extend(tx).strict(),_O=Kc.extend(rx).strict(),EO=Kc.extend(nx).strict(),AO=ix.extend(ox).strict(),sF=s.discriminatedUnion("databaseType",[SO,_O,EO,AO]),ph=Kc.extend({resourceName:F}).strict(),xO=ph.extend(tx).strict(),IO=ph.extend(rx).strict(),TO=ph.extend(nx).strict(),$O=ix.extend({resourceName:F}).strict(),RO=$O.extend(ox).strict(),cF=s.discriminatedUnion("databaseType",[xO,IO,TO,RO]),uF=s.object({appName:ge,databaseName:s.string().min(1,d.REQUIRED.DATABASE_NAME),maxConnections:s.number().int(d.MAX_CONNECTIONS.INTEGER).min(1,d.MAX_CONNECTIONS.MIN).max(100,d.MAX_CONNECTIONS.MAX).optional(),maxIdleConnections:s.number().int(d.PROXY_CONFIG.MAX_IDLE_CONNECTIONS.INTEGER).min(0,d.PROXY_CONFIG.MAX_IDLE_CONNECTIONS.MIN).max(100,d.PROXY_CONFIG.MAX_IDLE_CONNECTIONS.MAX).optional(),connectionBorrowTimeout:s.number().int(d.PROXY_CONFIG.BORROW_TIMEOUT.INTEGER).min(1,d.PROXY_CONFIG.BORROW_TIMEOUT.MIN).max(3600,d.PROXY_CONFIG.BORROW_TIMEOUT.MAX).optional(),requireTLS:s.boolean().optional(),nameProvidedByFlag:s.boolean().optional()}).strict(),NO=["S","N","B"],Fc=s.object({name:s.string(),type:s.enum(NO)}).strict(),ax=s.object({name:F,partitionKey:Fc,sortKey:Fc.optional(),globalSecondaryIndexes:s.array(s.object({indexName:s.string(),partitionKey:Fc,sortKey:Fc.optional()}).strict()).optional(),ttlAttribute:s.string().optional(),stream:s.boolean().optional(),variableName:s.string().optional(),extraProperties:s.array(Ie).optional()}).strict(),CO=s.object({mode:s.literal("s3")}).strict(),sx=s.object({name:F,type:s.literal("ClickHouse"),databaseName:ZA,instanceType:s.string().optional(),coldTier:s.union([CO,s.literal(!1)]).optional(),optimiseSchedule:s.union([s.string(),s.literal(!1)]).optional(),backupSchedule:s.union([s.string(),s.literal(!1)]).optional(),backupRetentionDays:Gt.optional(),variableName:s.string().optional(),extraProperties:s.array(Ie).optional()}).strict();var PO=s.object({count:s.number().int(d.NAT_GATEWAY.INTEGER).min(0,d.NAT_GATEWAY.MIN).max(3,d.NAT_GATEWAY.MAX).optional()}).strict().describe("NAT gateway configuration"),cx=Be(PO),fh=s.enum(["cloudwatch","s3"]),kO=s.object({destination:fh.optional(),retentionDays:s.number().int(d.RETENTION_DAYS.INTEGER).min(1,d.RETENTION_DAYS.MIN).max(365,d.RETENTION_DAYS.MAX).optional(),trafficType:s.enum(["ALL","ACCEPT","REJECT"]).optional()}).strict().describe("VPC flow log configuration"),ux=Be(kO),OO=s.object({s3:s.boolean().optional(),dynamodb:s.boolean().optional()}).strict().describe("Gateway VPC endpoints (FREE)"),DO=Be(OO),wO=s.object({ecr:s.boolean().optional(),secretsManager:s.boolean().optional(),kms:s.boolean().optional(),cloudwatchLogs:s.boolean().optional(),ssm:s.boolean().optional(),sts:s.boolean().optional()}).strict().describe("Interface VPC endpoints (cost per hour)"),MO=Be(wO),jO=s.object({gateway:DO.optional(),interface:MO.optional()}).strict().describe("VPC endpoints configuration"),lx=Be(jO),Yc=s.object({maxAzs:s.number().int(d.MAX_AZS.INTEGER).min(1,d.MAX_AZS.MIN).max(3,d.MAX_AZS.MAX).optional(),natGateways:cx.optional(),flowLogs:ux.optional(),vpcEndpoints:lx.optional(),cidrMask:s.number().int(d.CIDR_MASK.INTEGER).min(16,d.CIDR_MASK.MIN).max(28,d.CIDR_MASK.MAX).optional()}).strict(),dx=s.string().min(1,d.REQUIRED.NETWORK_NAME).max(50,d.MAX_LENGTH.NETWORK_NAME).regex(j.RESOURCE_NAME,d.RESOURCE_NAME),mx=Yc.extend({name:dx}).strict(),px=Be(Yc),fF=s.object({appName:ge,networkName:dx.optional(),maxAzs:s.number().int(d.MAX_AZS.INTEGER).min(1,d.MAX_AZS.MIN).max(3,d.MAX_AZS.MAX).optional(),natGateways:cx.optional(),flowLogs:ux.optional(),vpcEndpoints:lx.optional()}).strict(),zO=j.CIDR,gh=s.string().regex(zO,d.CIDR),LO=s.object({kind:s.literal("database"),resource:s.string().min(1,d.REQUIRED.RESOURCE_REFERENCE),name:F,allowedFromCidrs:s.array(gh),access:s.enum(["read","write","readWrite"]).optional()}).strict(),UO=s.object({kind:s.literal("ecsService"),resource:s.string().min(1,d.REQUIRED.RESOURCE_REFERENCE),serviceName:s.string().min(1,d.REQUIRED.SERVICE_NAME),name:F,allowedFromCidrs:s.array(gh),port:Fr.optional()}).strict(),FO=s.discriminatedUnion("kind",[LO,UO]),gF=s.object({name:F,peerAppName:s.string().min(1,d.REQUIRED.APP_NAME),peerAccountId:s.string().regex(j.AWS_ACCOUNT_ID,d.AWS_ACCOUNT_ID),peerRegion:s.string().min(1,d.VPC_PEER.REGION_REQUIRED).optional(),peerVpcId:s.string().regex(j.VPC_ID,d.VPC_ID).optional(),peerVpcCidr:gh.optional(),peerRoleArn:s.string().regex(j.ROLE_ARN,d.ROLE_ARN).optional(),peerRouteTableIds:s.array(s.string().min(1,d.VPC_PEER.ROUTE_TABLE_ID_REQUIRED)).optional(),localVpcName:s.string().min(1,d.REQUIRED.NETWORK_NAME).optional(),enableDnsResolution:s.boolean().optional()}).strict(),hF=s.object({name:F,requesterAccountIds:s.array(s.string().regex(j.AWS_ACCOUNT_ID,d.AWS_ACCOUNT_ID)).min(1,d.VPC_PEER.MIN_REQUESTER_ACCOUNTS),localVpcName:s.string().min(1,d.REQUIRED.NETWORK_NAME).optional(),publishToSsm:s.boolean().optional(),exposedResources:s.array(FO).optional()}).strict();var Xc=["storage","cdn","compute"],BO=s.object({sid:s.string().optional(),effect:s.enum(["Allow","Deny"]),principals:s.array(s.string()),actions:s.array(s.string()),resources:s.array(s.string()).optional(),conditions:s.record(s.string(),s.record(s.string(),s.union([s.string(),s.array(s.string())]))).optional()}).strict(),fx=s.object({name:F,bucketName:s.string().optional(),publicReadAccess:s.boolean().optional(),websiteHosting:s.object({indexDocument:s.string(),errorDocument:s.string().optional()}).strict().optional(),backupVaultTier:s.enum(bt).optional(),versioned:s.boolean().optional(),encryption:s.enum(ai).optional(),kmsKeyArn:s.string().optional(),cors:s.array(s.object({allowedOrigins:s.array(s.string()),allowedMethods:s.array(s.string()),allowedHeaders:s.array(s.string()).optional(),exposedHeaders:s.array(s.string()).optional(),maxAge:s.number().optional()}).strict()).optional(),deployment:s.object({source:s.string(),prune:s.boolean().optional(),cacheControl:s.object({maxAge:s.number().optional(),immutable:s.boolean().optional()}).strict().optional()}).strict().optional(),retain:s.boolean().optional(),resourcePolicyStatements:s.array(BO).optional(),stackPlacement:s.enum(Xc).optional(),variableName:s.string().optional(),extraProperties:s.array(Ie).optional()}).strict().refine(e=>e.encryption!=="KMS"||!!e.kmsKeyArn,{message:d.KMS.KEY_REQUIRED}),EF=s.object({appName:ge,bucketName:GA,nameProvidedByFlag:s.boolean().optional(),storagePreset:s.enum(BA).optional(),publicReadAccess:s.boolean().optional(),websiteHosting:s.object({indexDocument:s.string(),errorDocument:s.string().optional()}).strict().optional(),backupVaultTier:s.enum(bt).optional(),versioned:s.boolean().optional(),encryption:s.enum(ai).optional(),kmsKeyArn:s.string().optional(),cors:s.array(s.object({allowedOrigins:s.array(s.string()),allowedMethods:s.array(s.string()),allowedHeaders:s.array(s.string()).optional(),exposedHeaders:s.array(s.string()).optional(),maxAge:s.number().optional()}).strict()).optional(),connectionConfig:s.object({connectToCompute:s.array(s.string()).optional(),connectToServices:s.array(s.string()).optional()}).strict().optional()}).strict().refine(e=>e.encryption!=="KMS"||!!e.kmsKeyArn,{message:d.KMS.KEY_REQUIRED,path:["kmsKeyArn"]});var hh=s.enum(["DESTROY","RETAIN"]),gx=s.object({name:F,queueType:s.enum(["standard","fifo"]).default("standard"),visibilityTimeout:s.number().int(d.SQS.VISIBILITY_TIMEOUT.INTEGER).min(0,d.SQS.VISIBILITY_TIMEOUT.MIN).max(43200,d.SQS.VISIBILITY_TIMEOUT.MAX).optional(),retentionPeriod:s.number().int(d.SQS.RETENTION_PERIOD.INTEGER).min(60,d.SQS.RETENTION_PERIOD.MIN).max(1209600,d.SQS.RETENTION_PERIOD.MAX).optional(),contentBasedDeduplication:s.boolean().optional(),removalPolicy:hh.optional(),variableName:s.string().optional(),extraProperties:s.array(Ie).optional()}).strict();var hx=s.object({type:s.literal("basic-auth"),username:s.string().min(1),password:s.string().min(1)}).strict(),vx=s.object({name:F,defaultOriginRef:s.string(),behaviours:s.array(s.object({pathPattern:s.string(),originRef:s.string(),cachePolicy:s.enum(["CACHING_OPTIMIZED","CACHING_DISABLED"]).optional()}).strict()).optional(),customDomain:s.string().optional(),certificateArn:s.string().optional(),accessGate:s.union([s.literal(!1),hx]).optional(),extraProperties:s.array(Ie).optional()}).strict(),CF=s.object({appName:s.string(),name:F.optional(),defaultOriginRef:s.string(),behaviours:s.array(s.object({pathPattern:s.string(),originRef:s.string(),cachePolicy:s.enum(["CACHING_OPTIMIZED","CACHING_DISABLED"]).optional()}).strict()).optional(),customDomain:s.string().optional(),certificateArn:s.string().optional(),accessGate:s.union([s.literal(!1),hx]).optional(),nameProvidedByFlag:s.boolean().optional()}).strict();var VO=Object.defineProperty,vh=(e,t)=>VO(e,"name",{value:t,configurable:!0}),GO=new Set(["t4g","c6g","c6gd","c6gn","c7g","c7gd","c7gn","r6g","r6gd","r7g","r7gd","r8g","r8gd","c8g","c8gd","c8gn","m6g","m6gd","m7g","m7gd","m8g","m8gd","x8g","i8g","a1","x2gd","im4gn","is4gen","i4g","hpc7g"]);function ui(e){let t=e.split(".")[0]??"";return GO.has(t)?"ARM":"STANDARD"}vh(ui,"getArchitectureForInstanceType");function Jc(e,t){let n=ui(e);return n!==t?{valid:!1,message:`Instance type '${e}' requires ${n} architecture, but '${t}' AMI was specified. Use a ${n==="ARM"?"Graviton instance (t4g, c6g, r6g, m6g, etc.)":"Intel/AMD instance (t3, c5, r5, m5, etc.)"} instead.`}:{valid:!0}}vh(Jc,"validateArchitectureMatch");function bx(e,t){return ui(e)===t}vh(bx,"isArchitectureCompatible");var ZO=Object.defineProperty,qc=(e,t)=>ZO(e,"name",{value:t,configurable:!0});var WO=1;var HO=/^[A-Za-z0-9_.-]+$/,KO=s.object({id:s.string().min(1,"buildSecret id cannot be empty").regex(HO,"buildSecret id may contain only letters, digits, '_', '.', and '-' (no comma, '=', or whitespace, which would break the buildx --secret argv)"),ssm:s.string().min(1,"ssm parameter name cannot be empty").optional(),secretsManager:s.object({name:s.string().min(1,"secret name cannot be empty").optional(),arn:s.string().min(1,"secret arn cannot be empty").optional(),field:s.string().min(1,"secret field cannot be empty").optional()}).strict().refine(e=>e.name===void 0!=(e.arn===void 0),"secretsManager requires exactly one of name or arn").optional(),env:s.string().min(1,"env variable name cannot be empty").optional()}).strict().superRefine((e,t)=>{[e.ssm,e.secretsManager,e.env].filter(n=>n!==void 0).length!==1&&t.addIssue({code:s.ZodIssueCode.custom,message:"buildSecret requires exactly one source (ssm, secretsManager, or env)"})}),YO=s.union([s.string(),s.object({ssm:s.string().min(1,"ssm parameter name cannot be empty").optional(),secretsManager:s.object({name:s.string().min(1,"secret name cannot be empty").optional(),arn:s.string().min(1,"secret arn cannot be empty").optional(),field:s.string().min(1,"secret field cannot be empty").optional()}).strict().refine(e=>e.name===void 0!=(e.arn===void 0),"secretsManager requires exactly one of name or arn").optional(),env:s.string().min(1,"env variable name cannot be empty").optional(),acknowledgePublic:s.boolean().optional()}).strict().superRefine((e,t)=>{[e.ssm,e.secretsManager,e.env].filter(n=>n!==void 0).length!==1&&t.addIssue({code:s.ZodIssueCode.custom,message:"buildArg value requires exactly one source (ssm, secretsManager, or env)"})})]),Nt=s.object({path:s.string(),context:s.string().min(1,"context cannot be empty").optional(),target:s.string().min(1,"target cannot be empty").optional(),buildArgs:s.record(s.string(),YO).optional(),buildSecrets:s.array(KO).optional()}).strict(),wF=Nt.partial();function XO(e,t){if(t===void 0)return e;let n=t.context??e.context,i=t.target??e.target,r=t.buildArgs??e.buildArgs,o=t.buildSecrets??e.buildSecrets;return{path:t.path??e.path,...n!==void 0&&{context:n},...i!==void 0&&{target:i},...r!==void 0&&{buildArgs:r},...o!==void 0&&{buildSecrets:o}}}qc(XO,"mergeDockerBuild");function bh(e){return typeof e=="object"&&e!==null&&!Array.isArray(e)}qc(bh,"isRecord");function yx(e){if(!bh(e)||typeof e.path!="string"||e.path.length===0)return;let t=typeof e.context=="string"&&e.context.length>0?e.context:void 0,n=typeof e.target=="string"&&e.target.length>0?e.target:void 0,i=bh(e.buildArgs)&&Object.keys(e.buildArgs).length>0?e.buildArgs:void 0,r=Array.isArray(e.buildSecrets)&&e.buildSecrets.length>0?e.buildSecrets:void 0,o={path:e.path,...t!==void 0&&{context:t},...n!==void 0&&{target:n},...i!==void 0&&{buildArgs:i},...r!==void 0&&{buildSecrets:r}},a=Nt.safeParse(o);return a.success?a.data:void 0}qc(yx,"normaliseDockerBuild");function JO(e){if(e===void 0)return;let t=yx(e);return t===void 0?void 0:JSON.stringify(t)}qc(JO,"dockerBuildFingerprint");var qO=s.object({name:s.string(),clusterName:s.string().optional(),docker:Nt.optional(),containerPort:s.number().optional(),secrets:s.array(s.string()).optional(),ssmSecretsPath:s.string().optional(),importedSecretNames:s.array(s.string()).optional(),schemaGateImageTag:s.string().optional()}).strict(),QO=s.object({type:s.enum(Rt),name:s.string(),source:s.string()}).strict(),eD=s.object({repositoryName:s.string()}).strict(),tD=["x86_64","arm64"],rD=s.object({name:s.string(),secrets:s.array(s.string()).optional(),ssmSecretsPath:s.string().optional(),importedSecretNames:s.array(s.string()).optional(),docker:Nt.optional(),imageKey:s.string().optional(),architecture:s.enum(tD).optional()}).strict(),nD=s.object({templateHash:s.string(),synthTimestamp:s.string()}).strict(),iD=s.object({constructPath:s.string().max(512),group:s.string().max(128),resourceType:s.string().max(256)}).strict(),oD=s.object({synthesisedBy:s.string().min(1).max(128),minimumEngineVersion:s.string().min(1).max(32),maximumEngineMajor:s.number().int().min(0).optional(),minimumAwsCdkCli:s.string().min(1).max(32).optional()}).strict(),aD=s.object({appName:s.string().min(1).max(128),slot:s.string().min(1).max(64),clusterName:s.string().min(1).max(128),anchor:s.string().min(1).max(128),pinned:s.boolean(),currentServiceName:s.string().min(1).max(256),legacyKey:s.string().min(1).max(256),legacyAnchor:s.string().min(1).max(256),legacyServiceName:s.string().min(1).max(512),legacyKeyFields:s.array(s.string().max(64)).max(32)}).strict(),sD=s.object({constructPath:s.string().min(1).max(512),resourceType:s.string().min(1).max(256),physicalNameHint:s.string().min(1).max(512),policy:s.enum(["retain","snapshot","adopted"]),destroyDisposition:s.enum(["survives","deleted-on-explicit-destroy"]),reason:s.string().min(1).max(1024),costClass:s.enum(["none","storage","fixed-monthly"]),cleanupHint:s.string().min(1).max(1024)}).strict(),MF=s.object({version:s.literal(WO),generatedAt:s.string(),appName:s.string(),services:s.array(qO),lambdas:s.array(rD),pattern:QO.optional(),ecr:eD.optional(),stacks:s.record(s.string(),nD),resourceMap:s.record(s.string(),iD).optional(),engineCompat:oD.optional(),identityAliases:s.array(aD).optional(),residuals:s.array(sD).optional()}).strict();var cD=Object.defineProperty,uD=(e,t)=>cD(e,"name",{value:t,configurable:!0});function _x(e){return!(e.image!==void 0&&e.docker!==void 0)}uD(_x,"imageDockerMutexCheck");var Ex=s.number().int(d.CAPACITY.MIN.INTEGER).min(uh,d.GENERATOR_CAPACITY.MIN.MIN).max(lh,d.GENERATOR_CAPACITY.MIN.MAX),Ax=s.number().int(d.CAPACITY.MAX.INTEGER).min(uh,d.GENERATOR_CAPACITY.MAX.MIN).max(lh,d.GENERATOR_CAPACITY.MAX.MAX),li=s.number().int(d.LAMBDA.MEMORY.INTEGER).min(jA,d.LAMBDA.MEMORY.MIN).max(zA,d.LAMBDA.MEMORY.MAX).refine(e=>e===128||e%64===0,d.LAMBDA.MEMORY.MULTIPLE),xx=s.string().regex(j.LAMBDA_RUNTIME_IDENTIFIER,d.LAMBDA.RUNTIME),yh=s.number().int(d.CPU.INTEGER).min(256,d.CPU.MIN).max(4096,d.CPU.MAX),eu=s.number().int(d.CAPACITY.DESIRED.INTEGER).min(0,d.CAPACITY.DESIRED.MIN).max(oi,d.CAPACITY.DESIRED.MAX),wo=s.object({connectToDatabase:s.array(s.string()).optional()}).strict(),lD=s.object({minSize:s.number().int(d.CAPACITY.WARM_POOL.MIN_SIZE.INTEGER).min(0,d.CAPACITY.WARM_POOL.MIN_SIZE.MIN).max(LA,d.CAPACITY.WARM_POOL.MIN_SIZE.MAX).optional(),reuseOnScaleIn:s.boolean().optional()}).strict(),Sh=s.object({instanceType:s.string().optional(),amiHardwareType:s.enum(Mc).optional(),minCapacity:s.number().int(d.CAPACITY.MIN.INTEGER).min(0,d.CAPACITY.MIN.MIN_0).max(oi,d.CAPACITY.MIN.MAX).optional(),maxCapacity:s.number().int(d.CAPACITY.MAX.INTEGER).min(1,d.CAPACITY.MAX.MIN_1).max(oi,d.CAPACITY.MAX.MAX).optional(),memoryLimitMiB:Co(128).optional(),warmPool:lD.optional(),extraProperties:s.array(Ie).optional()}).strict().superRefine((e,t)=>{if(!e.instanceType||!e.amiHardwareType)return;let n=Jc(e.instanceType,e.amiHardwareType);n.valid||t.addIssue({code:"custom",message:n.message??d.ARCHITECTURE_MISMATCH,path:["instanceType"]})}).superRefine((e,t)=>{e.minCapacity===0&&!e.warmPool&&t.addIssue({code:"custom",message:d.CAPACITY.WARM_POOL_REQUIRED,path:["minCapacity"]}),e.warmPool?.minSize!==void 0&&e.maxCapacity!==void 0&&e.warmPool.minSize>e.maxCapacity&&t.addIssue({code:"custom",message:d.CAPACITY.WARM_POOL.MIN_SIZE_EXCEEDS_MAX_CAPACITY,path:["warmPool","minSize"]})}),dD=s.enum(Io).describe(`Compute type must be one of: ${Io.join(", ")}`),_h=s.enum(ri).describe(`ECS capacity provider must be one of: ${ri.join(", ")}`),Eh=s.string().refine(e=>it(jc,e),{message:d.INSTANCE_TYPE}),Ix=s.object({sourceType:s.enum(["sqs","dynamodb","eventbridge"]),sourceRef:s.string().describe("Name of the source resource"),batchSize:s.number().int(d.BATCH_SIZE.INTEGER).min(1,d.BATCH_SIZE.MIN).max(1e4,d.BATCH_SIZE.MAX).optional(),startingPosition:s.enum(["TRIM_HORIZON","LATEST"]).optional(),maxBatchingWindow:s.number().int(d.BATCHING_WINDOW.INTEGER).min(0,d.BATCHING_WINDOW.MIN).max(300,d.BATCHING_WINDOW.MAX).optional(),reportBatchItemFailures:s.boolean().optional()}).strict(),mD=s.object({name:s.string().min(1,d.REQUIRED.CONTAINER_NAME).optional(),image:s.string().optional(),port:Fr.optional(),environment:si.optional(),secretsImport:WA.optional(),command:s.array(s.string()).optional(),entryPoint:s.array(s.string()).optional(),essential:s.boolean().optional(),healthCheck:s.object({command:s.array(s.string()),interval:s.number().int(d.HEALTH_CHECK.INTERVAL.INTEGER).min(5,d.HEALTH_CHECK.INTERVAL.MIN).max(300,d.HEALTH_CHECK.INTERVAL.MAX).optional(),timeout:s.number().int(d.HEALTH_CHECK.TIMEOUT.INTEGER).min(2,d.HEALTH_CHECK.TIMEOUT.MIN).max(60,d.HEALTH_CHECK.TIMEOUT.MAX).optional(),retries:s.number().int(d.HEALTH_CHECK.RETRIES.INTEGER).min(1,d.HEALTH_CHECK.RETRIES.MIN).max(10,d.HEALTH_CHECK.RETRIES.MAX).optional(),startPeriod:s.number().int(d.HEALTH_CHECK.START_PERIOD.INTEGER).min(0,d.HEALTH_CHECK.START_PERIOD.MIN).max(300,d.HEALTH_CHECK.START_PERIOD.MAX).optional()}).strict().optional(),ssmSecrets:s.array(s.string().regex(j.SECRET_NAME,d.SECRET_NAME)).optional(),extraProperties:s.array(Ie).optional()}).strict(),Tx=s.string().min(1,d.REQUIRED.SERVICE_NAME).max(255,d.MAX_LENGTH.SERVICE_NAME).regex(j.ECS_SERVICE_NAME,d.ECS_SERVICE_NAME),$x=s.object({domain:s.string().optional(),loadBalancer:s.union([s.literal(!1),s.enum(Dc)]).optional(),directAccess:s.boolean().optional(),extraProperties:s.array(Ie).optional()}).strict().refine(e=>!(e.directAccess&&e.domain),{message:d.DIRECT_ACCESS.NO_DOMAIN,path:["directAccess"]}).refine(e=>!(e.directAccess&&typeof e.loadBalancer=="string"),{message:d.DIRECT_ACCESS.NO_LOAD_BALANCER}).describe("Cluster-level configuration"),Qc=s.object({path:s.string().optional(),host:s.string().optional(),priority:s.number().int(d.PRIORITY.INTEGER).min(1,d.PRIORITY.MIN).max(5e4,d.PRIORITY.MAX).optional(),healthCheckPath:s.string().optional()}).strict().describe("Path/host-based routing configuration"),pD=s.object({desiredCount:eu.optional(),minCapacity:s.number().int(d.CAPACITY.MIN.INTEGER).min(0,d.CAPACITY.MIN.MIN_0).max(oi,d.CAPACITY.MIN.MAX).optional(),maxCapacity:s.number().int(d.CAPACITY.MAX.INTEGER).min(1,d.CAPACITY.MAX.MIN_1).max(oi,d.CAPACITY.MAX.MAX).optional(),scalingType:s.enum(wc).optional()}).strict().refine(Ur.check,Ur.params).describe("ECS service scaling configuration"),Rx=s.object({name:Tx,docker:Nt.optional(),needsDatabaseConnection:s.boolean().optional(),needsStorageConnection:s.boolean().optional(),needsMessagingConnection:s.boolean().optional(),image:s.string().optional(),containers:s.array(mD).optional(),routing:s.union([Qc,s.array(Qc).min(1)]).optional(),serviceType:s.enum(Ro).optional(),cpu:yh.optional(),memoryLimitMiB:Co(512).optional(),desiredCount:eu.optional(),scaling:Be(pD).optional(),capacityProvider:_h,ec2Config:Sh.optional(),ssmSecretsPath:s.string().regex(j.SSM_PATH,d.SSM_PATH).optional(),extraProperties:s.array(Ie).optional(),alarms:XA.optional()}).strict().superRefine((e,t)=>{_x(e)||t.addIssue({code:"custom",path:["docker"],message:d.IMAGE_DOCKER_MUTEX})}).describe("Configuration for a service in an ECS cluster"),Nx=s.object({name:F,type:dD,needsConnection:s.boolean(),connectedDatabase:s.array(s.string()).optional(),connectedStorage:s.array(s.string()).optional(),connectedMessaging:s.array(s.string()).optional(),cluster:$x.optional(),services:s.array(Rx).optional(),docker:Nt.partial().optional(),deployment:s.enum(kc).optional(),codePath:s.string().optional(),timeout:s.number().int(d.LAMBDA.TIMEOUT.INTEGER).min(zc,d.LAMBDA.TIMEOUT.MIN).max(Lc,d.LAMBDA.TIMEOUT.MAX).optional(),memory:li.optional(),handler:s.string().optional(),runtime:xx.optional(),environment:si.optional(),secrets:si.optional(),eventSources:s.array(Ix).optional(),functionUrl:s.object({authType:s.enum($o)}).strict().optional(),description:s.string().optional(),scheduleExpression:s.string().optional(),architecture:s.enum(Oc).optional(),ephemeralStorageSize:s.number().int(d.EPHEMERAL_STORAGE.INTEGER).min(512,d.EPHEMERAL_STORAGE.MIN).max(10240,d.EPHEMERAL_STORAGE.MAX).optional(),functionName:s.string().optional(),ssmSecrets:s.array(s.string()).optional(),ssmSecretsPath:s.string().optional(),alarms:qA.optional(),instanceType:Eh.optional(),enableSSH:s.boolean().optional(),keyName:s.string().optional(),userData:s.string().optional(),securityGroups:s.array(s.string()).optional(),variableName:s.string().optional(),extraProperties:s.array(Ie).optional()}).strict().superRefine((e,t)=>{if(e.type==="ecs"&&e.services)for(let n=0;n<e.services.length;n++){let i=e.services[n];i?.ec2Config?.instanceType&&!i.ec2Config.amiHardwareType&&ui(i.ec2Config.instanceType)!=="ARM"&&t.addIssue({code:"custom",message:`Service '${i.name??n}' uses instance type '${i.ec2Config.instanceType}' (x86), which requires Docker images built for linux/amd64. The default build targets linux/arm64 (Graviton). Use a Graviton instance type (t4g, c6g, r6g, m6g, etc.) or set amiHardwareType: "STANDARD" to acknowledge x86.`,path:["services",n,"ec2Config","instanceType"]})}e.type==="lambda"&&e.deployment==="container"&&e.architecture==="X86_64"&&t.addIssue({code:"custom",message:"Lambda architecture 'X86_64' requires Docker images built for linux/amd64, but the default build targets linux/arm64. Use 'ARM_64' for Graviton Lambdas (recommended) or ensure your build pipeline targets linux/amd64.",path:["architecture"]})}),ZF=s.object({appName:ge,clusterName:F,containerPort:Fr,nameProvidedByFlag:s.boolean().optional(),ecrRepository:s.string().optional(),capacityProvider:_h.optional(),useAppEcr:s.boolean().optional(),desiredCount:eu.optional(),cpu:yh.optional(),memoryLimitMiB:Co(512).optional(),minCapacity:Ex.optional(),maxCapacity:Ax.optional(),ec2Config:Sh.optional(),connectionConfig:wo.optional()}).strict().refine(Ur.check,Ur.params),WF=s.object({appName:ge,functionName:F,nameProvidedByFlag:s.boolean().optional(),lambdaType:s.enum(["basic","web","custom"]).optional(),ecrRepository:s.string().optional(),timeout:s.number().int(d.LAMBDA.TIMEOUT.INTEGER).min(zc,d.LAMBDA.TIMEOUT.MIN).max(Lc,d.LAMBDA.TIMEOUT.MAX).optional(),memory:li.optional(),enableFunctionUrl:s.boolean().optional(),description:s.string().optional(),enableCors:s.boolean().optional(),corsOrigins:s.string().optional(),corsHeaders:s.string().optional(),corsMethods:s.array(s.enum(FA)).optional(),corsCredentials:s.boolean().optional(),connectionConfig:wo.optional()}).strict(),HF=s.object({appName:ge,instanceName:F,nameProvidedByFlag:s.boolean().optional(),instanceType:Eh.optional(),enableSSH:s.boolean().optional(),minCapacity:Ex.optional(),maxCapacity:Ax.optional(),connectionConfig:wo.optional()}).strict().refine(Ur.check,Ur.params),Cx=s.object({appName:ge,clusterName:F,serviceName:Tx,capacityProvider:_h,containerPort:Fr.optional(),cpu:yh.optional(),memoryLimitMiB:Co(512).optional(),desiredCount:eu.optional(),ec2Config:Sh.optional(),routing:s.union([Qc,s.array(Qc).min(1)]).optional(),docker:Nt.partial().optional(),nameProvidedByFlag:s.boolean().optional(),connectionConfig:wo.optional()}).strict(),Ah=s.object({appName:ge,computeName:F,nameProvidedByFlag:s.boolean().optional(),connectionConfig:wo.optional()}).strict(),fD=Ah.extend({type:s.literal("ecs"),cluster:$x.optional(),services:s.array(Rx).min(1,d.SERVICE.MIN_REQUIRED),docker:Nt.partial().optional()}).strict().refine(e=>{let t=e.services.filter(n=>n.containers?.some(i=>i.port));return t.length>1?t.every(n=>(Array.isArray(n.routing)?n.routing:n.routing?[n.routing]:[]).some(i=>i.path||i.host)):!0},{message:d.SERVICE.ROUTING_REQUIRED}).refine(e=>{let t=e.services.map(n=>n.name);return new Set(t).size===t.length},{message:d.SERVICE.UNIQUE_WITHIN_CLUSTER}),gD=Ah.extend({type:s.literal("lambda"),timeout:s.number().int(d.LAMBDA.TIMEOUT.INTEGER).min(zc,d.LAMBDA.TIMEOUT.MIN).max(Lc,d.LAMBDA.TIMEOUT.MAX).optional(),memory:li.optional(),handler:s.string().optional(),runtime:xx.optional(),environment:si.optional(),secrets:si.optional(),description:s.string().optional(),functionUrl:s.union([s.object({authType:s.enum($o).optional()}).strict(),s.literal(!1)]).optional(),eventSources:s.array(Ix).optional()}).strict(),hD=Ah.extend({type:s.literal("ec2"),instanceType:Eh.optional(),enableSSH:s.boolean().optional(),keyName:s.string().optional(),userData:s.string().optional(),securityGroups:s.array(s.string()).optional()}).strict(),KF=s.discriminatedUnion("type",[fD,gD,hD]),Sx=s.object({path:s.string().min(1,d.REQUIRED.ROUTING_PATH),priority:s.number().int(d.PRIORITY.INTEGER).min(1,d.PRIORITY.MIN).max(5e4,d.PRIORITY.MAX).optional()}).strict(),Px=s.object({name:s.string().min(1,d.REQUIRED.SERVICE_NAME).max(255,d.MAX_LENGTH.SERVICE_NAME).regex(j.RESOURCE_NAME,d.RESOURCE_NAME),serviceType:s.enum(Ro).optional(),docker:Nt.partial().optional(),containerPort:Fr.optional(),needsDatabaseConnection:s.boolean().optional(),routing:s.union([Sx,s.array(Sx).min(1)]).optional()}).strict().superRefine((e,t)=>{e.serviceType==="worker"&&(e.containerPort!==void 0&&t.addIssue({code:"custom",path:["containerPort"],message:"Worker services are not reachable inbound; remove containerPort."}),e.routing!==void 0&&t.addIssue({code:"custom",path:["routing"],message:"Worker services have no ALB route; remove routing."}))}),YF=s.object({appName:ge,instanceType:s.string().optional()}).strict();var xh=s.object({memorySize:li.optional(),timeout:s.number().int(d.LAMBDA.TIMEOUT.INTEGER).min(1,d.LAMBDA.TIMEOUT.MIN).max(900,d.LAMBDA.TIMEOUT.MAX).optional(),ephemeralStorageSize:s.number().int(d.EPHEMERAL_STORAGE.INTEGER).min(512,d.EPHEMERAL_STORAGE.MIN).max(10240,d.EPHEMERAL_STORAGE.MAX).optional()}).strict(),kx=s.object({type:s.enum(ch).optional(),databaseName:s.string().optional(),databaseEngine:s.enum(ii).optional(),deletionProtection:s.boolean().optional(),backupRetention:Gt.optional(),port:Bc.optional(),publiclyAccessible:s.boolean().optional(),allowedIpCidr:s.string().optional(),instanceType:s.string().optional(),allocatedStorage:s.number().int(d.ALLOCATED_STORAGE.INTEGER).min(20,d.ALLOCATED_STORAGE.MIN).max(65536,d.ALLOCATED_STORAGE.MAX).optional(),multiAz:s.boolean().optional(),readReplica:Zc.optional(),writer:Oo.optional(),readers:Do.optional(),allowVpcAccess:s.boolean().optional(),monitoringInterval:ko.optional(),preferredMaintenanceWindow:s.string().optional(),databaseInsights:Wc.optional(),proxy:Gc.optional(),credentials:Vc.optional(),encryption:Hc.optional(),snapshotIdentifier:s.string().optional(),snapshotUsername:s.string().optional()}).strict(),Ox=s.object({server:xh.optional(),imageOptimisation:xh.optional(),revalidation:xh.optional()}).strict(),Ih=s.object({versioned:s.boolean().optional()}).strict(),Dx=s.object({assets:Ih.optional(),cache:Ih.optional(),media:Ih.optional()}).strict(),vD=s.object({visibilityTimeout:s.number().int(d.SQS.VISIBILITY_TIMEOUT.INTEGER).min(0,d.SQS.VISIBILITY_TIMEOUT.MIN).max(43200,d.SQS.VISIBILITY_TIMEOUT.MAX).optional(),messageRetentionPeriod:s.number().int(d.SQS.RETENTION_PERIOD.INTEGER).min(60,d.SQS.RETENTION_PERIOD.MIN).max(1209600,d.SQS.RETENTION_PERIOD.MAX).optional(),maxMessageSize:s.number().int(d.MAX_MESSAGE_SIZE.INTEGER).min(1024,d.MAX_MESSAGE_SIZE.MIN).max(262144,d.MAX_MESSAGE_SIZE.MAX).optional(),deadLetterQueue:s.union([s.literal(!1),s.object({enabled:s.boolean().optional(),maxReceiveCount:s.number().int(d.DLQ.MAX_RECEIVE_COUNT.INTEGER).min(1,d.DLQ.MAX_RECEIVE_COUNT.MIN).max(1e3,d.DLQ.MAX_RECEIVE_COUNT.MAX).optional()}).strict()]).optional()}).strict(),wx=s.object({revalidationQueue:vD.optional()}).strict(),Mx=s.object({domainNames:s.array(s.string()).optional(),certificateArn:s.string().optional()}).strict(),jx=s.record(s.string().regex(j.ENV_VAR_NAME,d.ENV_VAR_NAME),s.string()).optional(),bD=s.object({type:s.literal("payload"),name:s.string().min(1,d.REQUIRED.PATTERN_NAME),domain:s.string().optional(),database:kx.optional(),compute:Ox.optional(),storage:Dx.optional(),messaging:wx.optional(),cdn:Mx.optional(),environment:jx}).strict(),yD=s.object({type:s.literal("nextjs"),name:s.string().min(1,d.REQUIRED.PATTERN_NAME),domain:s.string().optional(),database:kx.optional(),compute:Ox.optional(),storage:Dx.optional(),messaging:wx.optional(),cdn:Mx.optional(),environment:jx}).strict(),Th=s.enum(Ao),SD=s.object({command:s.string().min(1,d.REQUIRED.BUILD_COMMAND),outputDir:s.string().min(1,d.REQUIRED.OUTPUT_DIR)}).strict(),_D=s.object({headers:s.boolean().optional(),contentSecurityPolicy:s.string().optional()}).strict(),ED=s.object({to:s.string().min(1,d.REQUIRED.FORMS_TO).regex(j.EMAIL,d.EMAIL),from:s.string().regex(j.EMAIL,d.EMAIL).optional(),corsOrigin:s.string().regex(j.HTTP_ORIGIN,"corsOrigin must be an exact origin such as https://example.com (no path, no trailing slash)").optional(),maxConcurrency:s.number().int().min(1).max(100).optional()}).strict(),AD=s.object({behaviours:s.array(s.unknown()).optional()}).strict(),$h=s.object({type:s.literal("staticsite"),name:s.string().min(1,d.REQUIRED.PATTERN_NAME),source:s.string().min(1,d.REQUIRED.SOURCE),build:SD,routing:Th.optional(),security:_D.optional(),domain:s.string().optional(),forms:ED.optional(),cdn:AD.optional()}).strict().superRefine((e,t)=>{if(e.forms===void 0)return;let n=e.domain;if(n===void 0||n===""){t.addIssue({code:"custom",path:["domain"],message:"A domain is required when forms are enabled: SES sends only from a verified identity, and the site's domain is the identity the pattern verifies"});return}let i=e.forms.from;i!==void 0&&!Tc(i,n)&&t.addIssue({code:"custom",path:["forms","from"],message:`forms.from must be an address at ${n} (the verified SES identity) \u2014 for example noreply@${n}. Use forms.to for the recipient.`})}),Mo=s.discriminatedUnion("type",[bD,yD,$h]),zx=s.enum(["lightweight","standard","resilient","custom"]),Lx=s.object({type:s.enum(ch),instanceType:s.string().optional(),backupRetention:Gt.optional(),deletionProtection:s.boolean().optional(),encryption:s.union([s.object({useCMK:s.literal(!0)}).strict(),s.literal(!1)]).optional()}).strict(),Ux=s.object({memorySize:li.optional(),timeout:s.number().int(d.LAMBDA.TIMEOUT.INTEGER).min(1,d.LAMBDA.TIMEOUT.MIN).max(900,d.LAMBDA.TIMEOUT.MAX).optional()}).strict();var Fx=s.object({appName:ge,type:dh,pattern:mh.optional(),patternConfig:Mo.optional(),owner:s.string().optional(),tags:s.record(s.string(),s.string()).optional(),vpcId:s.string().optional(),network:Yc.optional(),backup:KA.optional(),tunnel:YA.optional(),additionalNetworks:s.array(mx).optional(),database:s.array(ex),s3:s.array(fx),compute:s.array(Nx),dynamodb:s.array(ax).optional(),clickhouse:s.array(sx).optional(),sqs:s.array(gx).optional(),cdn:vx.optional(),customCodeBlocks:s.array(HA).optional(),additionalManagedImports:s.array(s.object({moduleSpecifier:s.string(),namedImports:s.array(s.string()),defaultImport:s.string().optional()}).strict()).optional()}).strict(),gB=s.object({name:ge,type:dh,pattern:mh.optional(),patternTier:zx.optional(),patternDomain:s.string().optional(),source:s.string().min(1,d.REQUIRED.SOURCE).optional(),buildCommand:s.string().min(1,d.REQUIRED.BUILD_COMMAND).optional(),outputDir:s.string().min(1,d.REQUIRED.OUTPUT_DIR).optional(),routing:Th.optional(),formsTo:s.string().min(1,d.REQUIRED.FORMS_TO).regex(j.EMAIL,d.EMAIL).optional(),corsOrigin:s.string().regex(j.HTTP_ORIGIN,"corsOrigin must be an exact origin such as https://example.com (no path, no trailing slash)").optional(),customDatabase:Lx.optional(),customCompute:Ux.optional(),region:s.string().optional(),owner:s.string().optional(),includeDatabase:s.boolean().optional(),databaseName:s.string().min(1,d.DATABASE.NAME.REQUIRED).max(63,d.DATABASE.NAME.MAX_LENGTH).optional(),vpcId:s.string().optional(),network:px.optional(),services:s.array(Px).optional(),snapshotIdentifier:s.string().optional(),snapshotUsername:s.string().optional()}).strict().superRefine((e,t)=>{e.formsTo!==void 0&&(e.patternDomain!==void 0&&e.patternDomain!==""||t.addIssue({code:"custom",path:["patternDomain"],message:"A domain is required when forms are enabled: SES sends only from a verified identity, and the site's domain is the identity the pattern verifies"}))}),hB=s.object({name:F,localResource:s.string().min(1),remoteApp:s.string().min(1),remoteResource:s.string().min(1),permission:s.enum(["read","write","read-write"]),remoteArn:s.string().optional()}).strict();var xD=["fjall-managed","external","external-manual"],_B=s.enum(xD);var Bx=s.object({givenName:s.string().min(1),familyName:s.string().min(1),displayName:s.string().min(1).optional(),expires:s.string().min(1).optional()}).strict(),Vx=s.object({name:s.string().min(1),path:s.string().min(1).optional()}).strict(),ID=s.union([s.object({managedPolicyArn:s.string().min(1)}).strict(),s.object({customerManagedPolicy:Vx}).strict()]),TD=s.object({managedPolicies:s.array(s.string().min(1)).optional(),inlinePolicy:s.record(s.string(),s.unknown()).optional(),customerManagedPolicies:s.array(Vx).optional(),permissionsBoundary:ID.optional(),sessionDuration:s.string().min(1).optional(),description:s.string().optional(),accounts:s.union([s.array(s.string().min(1)),s.literal("all")]).optional(),includeManagementAccount:s.boolean().optional(),groups:s.array(s.string().min(1)).optional()}).strict(),$D=s.object({description:s.string().optional()}).strict(),tu=s.string().regex(j.EMAIL,d.EMAIL),Rh={groups:s.record(s.string(),$D).optional(),permissionSets:s.record(s.string(),TD).optional(),memberships:s.record(s.string(),s.array(tu)).optional(),resolutionVersion:s.number().int().min(1).optional(),defaultPermissionSets:s.boolean().optional()},RD=s.discriminatedUnion("source",[s.object({...Rh,source:s.literal("fjall-managed"),users:s.record(tu,Bx)}).strict(),s.object({...Rh,source:s.literal("external")}).strict(),s.object({...Rh,source:s.literal("external-manual"),users:s.record(tu,Bx).optional()}).strict()]),EB=s.object({name:F,type:s.literal("organisation").optional(),organisationName:s.string().min(1).optional(),orgEmail:tu.optional(),accounts:s.unknown().optional(),accountIds:s.record(s.string(),s.string()).optional(),identityCentre:s.union([RD,s.literal(!1)]).optional(),allowedRegions:s.array(s.string().min(1)).optional()}).strict();var ND=Object.defineProperty,CD=(e,t)=>ND(e,"name",{value:t,configurable:!0}),PD=[1,3,5,7,14,30,60,90,120,150,180,365,400,545,731,1827,3653],kD=s.object({buildkiteQueue:s.string().min(1,"buildkiteQueue cannot be empty").max(100).regex(/^[a-zA-Z0-9-_]+$/,"buildkiteQueue must be alphanumeric with hyphens/underscores"),buildkiteOrgSlug:s.string().min(1,"buildkiteOrgSlug cannot be empty").max(100).regex(/^[a-z0-9-]+$/,"buildkiteOrgSlug must be a lowercase Buildkite organisation slug"),agentTokenSsmParameterName:s.string().min(2).regex(/^\//,"agentTokenSsmParameterName must be a full path (leading /)").optional(),agentTokenKmsKeyArn:s.string().min(1).optional(),fjallApiKeySsmParameterName:s.string().min(2).regex(/^\//,"fjallApiKeySsmParameterName must be a full path (leading /)").optional(),instanceType:s.string().min(1).default("c8g.xlarge"),agentVolumeSizeGib:s.number().int().min(20).max(1e3).default(250),agentMinInstances:s.number().int().min(0).default(0),agentMaxInstances:s.number().int().min(1).default(2),agentsPerInstance:s.number().int().min(1).default(1),spotCapacityPercentage:s.number().int().min(0).max(100).default(0),scaleInIdlePeriodSeconds:s.number().int().min(60).default(600),disconnectAfterUptimeSeconds:s.number().int().min(3600).default(86400),maxInstanceLifetimeDays:s.number().int().min(1).max(365).default(7),terminateInstanceAfterJob:s.boolean().default(!1),purgeBuildsOnDiskFull:s.boolean().default(!0),terminateInstanceOnDiskFull:s.boolean().default(!1),logRetentionDays:s.number().int().min(1).default(30),agentLogRetentionDays:s.literal(PD).default(7),buildkiteAgentRelease:s.enum(["stable","beta","edge"]).default("stable"),buildkiteAgentTags:s.string().default(""),buildkiteAgentTimestampLines:s.boolean().default(!1),buildkiteAgentExperiments:s.string().default(""),buildkiteAgentTracingBackend:s.enum(["","datadog","opentelemetry"]).default(""),buildkiteAgentCancelGracePeriodSeconds:s.number().int().min(10).default(60),enableSecretsPlugin:s.boolean().default(!0),enableEcrPlugin:s.boolean().default(!1),enableDockerLoginPlugin:s.boolean().default(!1),enableDockerUserNamespaceRemap:s.boolean().default(!0),enableDockerExperimental:s.boolean().default(!1),dockerNetworkingProtocol:s.enum(["ipv4","dualstack"]).default("ipv4"),enableInstanceStorage:s.boolean().default(!1),mountTmpfsAtTmp:s.boolean().default(!0),buildkiteAgentEnableGitMirrors:s.boolean().default(!1),bootstrapScriptUrl:s.string().default(""),agentEnvFileUrl:s.string().default(""),scalerEventSchedulePeriod:s.string().min(1).default("1 minute"),scalerMinPollInterval:s.string().min(1).default("10s"),scaleOutFactor:s.string().min(1).default("1.0"),scaleOutWaitingForJobs:s.boolean().default(!1),rolePermissionsBoundaryArn:s.string().min(1).optional(),alarmSnsTopicArn:s.string().min(1).optional(),applicationId:s.string().min(1).optional(),costAllocationEnvironment:s.string().min(1).optional(),costAllocationOwner:s.string().min(1).optional()}).strict(),OD=kD.refine(e=>e.agentMinInstances<=e.agentMaxInstances,{message:"agentMinInstances must be <= agentMaxInstances"});function DD(e){let t=OD.safeParse(e);if(!t.success){let n=t.error.issues.map(i=>`  - ${i.path.join(".")||"(root)"}: ${i.message}`).join(`
 `);throw new Error(`Buildkite: invalid props:
 ${n}`)}return t.data}CD(DD,"validateBuildkiteProps");var wD=Object.defineProperty,MD=(e,t)=>wD(e,"name",{value:t,configurable:!0});function jD(e){return`FjallDeployBoundary${e}`}MD(jD,"deployBoundaryName");var Nh={Sid:"FjallInheritAdministratorAccess",Effect:"Allow",Action:"*",Resource:"*"},Gx=[{Sid:"FjallDenyOrgAndAccountEscape",Effect:"Deny",Action:["organizations:LeaveOrganization","account:CloseAccount"],Resource:"*"},{Sid:"FjallDenyDisableAuditLogging",Effect:"Deny",Action:["cloudtrail:StopLogging"],Resource:"*"},{Sid:"FjallDenyBoundarySelfEscape",Effect:"Deny",Action:["iam:DeleteRolePermissionsBoundary"],Resource:"*"},{Sid:"FjallDenyDisableKmsKey",Effect:"Deny",Action:["kms:DisableKey"],Resource:"*"}],Zx=[...Gx,{Sid:"FjallDenyStandingHumanCredentials",Effect:"Deny",Action:["iam:CreateUser","iam:CreateLoginProfile","iam:CreateAccessKey","iam:CreateAccountAlias"],Resource:"*"},{Sid:"FjallDenyDisableConfigRecorder",Effect:"Deny",Action:["config:StopConfigurationRecorder"],Resource:"*"}],zD=[...Zx,{Sid:"FjallDenyAccountPasswordPolicyTamper",Effect:"Deny",Action:["iam:UpdateAccountPasswordPolicy","iam:DeleteAccountPasswordPolicy"],Resource:"*"},{Sid:"FjallDenyDisableDefaultEbsEncryption",Effect:"Deny",Action:["ec2:DisableEbsEncryptionByDefault"],Resource:"*"}],zB={foundation:[Nh,...Gx],compliance:[Nh,...Zx],hardened:[Nh,...zD]};var LD=Object.defineProperty,he=(e,t)=>LD(e,"name",{value:t,configurable:!0});var kh="sts.amazonaws.com";function UD(e){return`FjallDevDeploy${e}`}he(UD,"devDeployRoleName");function FD(e){return`FjallDevProvisioner${e}`}he(FD,"devProvisionerRoleName");function BD(e){return`FjallDevSyncWriter${e}`}he(BD,"devSyncWriterRoleName");var VD="FjallDevBoundary";function Wx(e){return`arn:aws:iam::${e}:policy/${VD}`}he(Wx,"devBoundaryPolicyArn");function Hx(e){return`org:${e}:dev-provisioner`}he(Hx,"devProvisionerSubject");function Kx(e){return`org:${e}:dev-sync`}he(Kx,"devSyncSubject");function Ch(e,t){return`org:${e}:acct:${t}`}he(Ch,"deployAccountSubject");function Ph(e){return`org:${e}:*`}he(Ph,"genericMachineSubject");var GD=["discovery","connection","org-setup","dev-substrate-setup"];function Yx(e,t){return`org:${e}:${t}`}he(Yx,"serviceSubject");function ZD(e){let{fjallOrgId:t,providerArn:n,issuerDomain:i,accountTier:r,accountId:o}=e,a=e.machineTrustMode??"expanded",c={[`${i}:aud`]:kh},u;if(a==="account-scoped"){if(r===void 0||!_c(r)||o===void 0)throw new Error(`machineTrustMode "account-scoped" requires a governance accountTier and an accountId (got tier: ${String(r)}, accountId ${o===void 0?"absent":"present"}) \u2014 refusing to fall back to the generic machine subject: a silent fallback would re-widen the trust the \xA74.4a Step-3 contract removes`);u=[Ch(t,o)]}else o!==void 0?u=[Ph(t),Ch(t,o)]:u=Ph(t);return[{Sid:"FjallMachineSubject",Effect:"Allow",Principal:{Federated:n},Action:"sts:AssumeRoleWithWebIdentity",Condition:{StringEquals:{...c,[`${i}:sub`]:u}}},{Sid:"FjallUserSubjects",Effect:"Allow",Principal:{Federated:n},Action:"sts:AssumeRoleWithWebIdentity",Condition:{StringEquals:c,StringLike:{[`${i}:sub`]:`org:${t}:user:*`}}},{Sid:"FjallServiceSubjects",Effect:"Allow",Principal:{Federated:n},Action:"sts:AssumeRoleWithWebIdentity",Condition:{StringEquals:{...c,[`${i}:sub`]:GD.map(l=>Yx(t,l))}}}]}he(ZD,"buildNarrowedDeployTrustStatements");function WD(e){let{fjallOrgId:t,providerArn:n,issuerDomain:i,accountId:r}=e;return[{Sid:"FjallDevSubjectsThisAccount",Effect:"Allow",Principal:{Federated:n},Action:"sts:AssumeRoleWithWebIdentity",Condition:{StringEquals:{[`${i}:aud`]:kh},StringLike:{[`${i}:sub`]:`org:${t}:dev:${r}:*`}}}]}he(WD,"buildDevDeployTrustStatements");function Oh(e){let{providerArn:t,issuerDomain:n,sid:i,subject:r}=e;return[{Sid:i,Effect:"Allow",Principal:{Federated:t},Action:"sts:AssumeRoleWithWebIdentity",Condition:{StringEquals:{[`${n}:aud`]:kh,[`${n}:sub`]:r}}}]}he(Oh,"buildServiceSubjectTrustStatements");function HD(e){return Oh({...e,sid:"FjallDevProvisionerSubject",subject:Hx(e.fjallOrgId)})}he(HD,"buildDevProvisionerTrustStatements");function KD(e){return Oh({...e,sid:"FjallDevSyncSubject",subject:Kx(e.fjallOrgId)})}he(KD,"buildDevSyncWriterTrustStatements");function YD({accountId:e}){return[{Sid:"FjallDevEcsTaggedMutations",Effect:"Allow",Action:["ecs:UpdateService","ecs:DeleteService","ecs:RunTask","ecs:StopTask"],Resource:`arn:aws:ecs:*:${e}:*`,Condition:{StringEquals:{"aws:ResourceTag/fjall:dev":"true"}}},{Sid:"FjallDevEcsTaggedCreates",Effect:"Allow",Action:["ecs:RegisterTaskDefinition","ecs:CreateService"],Resource:"*",Condition:{StringEquals:{"aws:RequestTag/fjall:dev":"true"}}},{Sid:"FjallDevEcsTagOnCreate",Effect:"Allow",Action:["ecs:TagResource"],Resource:`arn:aws:ecs:*:${e}:*`,Condition:{StringEquals:{"ecs:CreateAction":["RegisterTaskDefinition","CreateService","RunTask"]}}},{Sid:"FjallDevEcsReads",Effect:"Allow",Action:["ecs:Describe*","ecs:List*"],Resource:"*"},{Sid:"FjallDevEcsDeregisterTaskDefinition",Effect:"Allow",Action:["ecs:DeregisterTaskDefinition"],Resource:`arn:aws:ecs:*:${e}:task-definition/fjall-dev-*`},{Sid:"FjallDevElbTaggedMutations",Effect:"Allow",Action:["elasticloadbalancing:ModifyRule","elasticloadbalancing:DeleteRule","elasticloadbalancing:ModifyTargetGroup","elasticloadbalancing:ModifyTargetGroupAttributes","elasticloadbalancing:DeleteTargetGroup","elasticloadbalancing:RegisterTargets","elasticloadbalancing:DeregisterTargets"],Resource:`arn:aws:elasticloadbalancing:*:${e}:*`,Condition:{StringEquals:{"aws:ResourceTag/fjall:dev":"true"}}},{Sid:"FjallDevElbTaggedCreates",Effect:"Allow",Action:["elasticloadbalancing:CreateTargetGroup","elasticloadbalancing:CreateRule"],Resource:`arn:aws:elasticloadbalancing:*:${e}:*`,Condition:{StringEquals:{"aws:RequestTag/fjall:dev":"true"}}},{Sid:"FjallDevElbTagOnCreate",Effect:"Allow",Action:["elasticloadbalancing:AddTags"],Resource:`arn:aws:elasticloadbalancing:*:${e}:*`,Condition:{StringEquals:{"elasticloadbalancing:CreateAction":["CreateTargetGroup","CreateRule"]}}},{Sid:"FjallDevElbReads",Effect:"Allow",Action:["elasticloadbalancing:Describe*"],Resource:"*"},{Sid:"FjallDevSsmDevTree",Effect:"Allow",Action:["ssm:GetParameter*","ssm:PutParameter","ssm:AddTagsToResource"],Resource:`arn:aws:ssm:*:${e}:parameter/fjall/dev/*`},{Sid:"FjallDevLogsMutations",Effect:"Allow",Action:["logs:PutRetentionPolicy","logs:DeleteLogGroup"],Resource:`arn:aws:logs:*:${e}:log-group:/fjall/dev/*`},{Sid:"FjallDevLogsTaggedCreate",Effect:"Allow",Action:["logs:CreateLogGroup","logs:TagResource"],Resource:`arn:aws:logs:*:${e}:log-group:/fjall/dev/*`,Condition:{StringEquals:{"aws:RequestTag/fjall:dev":"true"}}},{Sid:"FjallDevLogsRead",Effect:"Allow",Action:["logs:GetLogEvents","logs:DescribeLogStreams","logs:FilterLogEvents"],Resource:`arn:aws:logs:*:${e}:log-group:/fjall/dev/*`},{Sid:"FjallDevLogsDescribeGroups",Effect:"Allow",Action:["logs:DescribeLogGroups"],Resource:"*"},{Sid:"FjallDevKmsViaDevAlias",Effect:"Allow",Action:["kms:Encrypt","kms:Decrypt","kms:GenerateDataKey"],Resource:`arn:aws:kms:*:${e}:key/*`,Condition:{"ForAnyValue:StringLike":{"kms:ResourceAliases":"alias/fjall-dev-*"}}},{Sid:"FjallDevKmsSsmSecureString",Effect:"Allow",Action:["kms:Encrypt","kms:Decrypt","kms:GenerateDataKey"],Resource:`arn:aws:kms:*:${e}:key/*`,Condition:{StringLike:{"kms:ViaService":"ssm.*.amazonaws.com"}}},{Sid:"FjallDevEcrAuthToken",Effect:"Allow",Action:["ecr:GetAuthorizationToken"],Resource:"*"},{Sid:"FjallDevEcrPushPull",Effect:"Allow",Action:["ecr:PutImage","ecr:InitiateLayerUpload","ecr:UploadLayerPart","ecr:CompleteLayerUpload","ecr:BatchCheckLayerAvailability","ecr:BatchGetImage","ecr:GetDownloadUrlForLayer","ecr:DescribeImages"],Resource:`arn:aws:ecr:*:${e}:repository/*`},{Sid:"FjallDevPassDevPathRoles",Effect:"Allow",Action:["iam:PassRole"],Resource:`arn:aws:iam::${e}:role/fjall/dev/*`}]}he(YD,"buildDevDeployPolicyStatements");function XD({accountId:e}){return[{Sid:"FjallDevProvisionerBoundedRoleWrites",Effect:"Allow",Action:["iam:CreateRole","iam:PutRolePolicy","iam:AttachRolePolicy"],Resource:`arn:aws:iam::${e}:role/fjall/dev/*`,Condition:{StringEquals:{"iam:PermissionsBoundary":Wx(e)}}},{Sid:"FjallDevProvisionerPathRoleOps",Effect:"Allow",Action:["iam:DeleteRole","iam:DeleteRolePolicy","iam:DetachRolePolicy","iam:ListRolePolicies","iam:TagRole"],Resource:`arn:aws:iam::${e}:role/fjall/dev/*`},{Sid:"FjallDevProvisionerListRoles",Effect:"Allow",Action:["iam:ListRoles"],Resource:"*"},{Sid:"FjallDevProvisionerDevMasterSecrets",Effect:"Allow",Action:["secretsmanager:GetSecretValue"],Resource:`arn:aws:secretsmanager:*:${e}:secret:fjall-dev-*`},{Sid:"FjallDevProvisionerKmsDecryptViaSecretsManager",Effect:"Allow",Action:["kms:Decrypt"],Resource:`arn:aws:kms:*:${e}:key/*`,Condition:{StringLike:{"kms:ViaService":"secretsmanager.*.amazonaws.com"}}},{Sid:"FjallDevProvisionerDataApi",Effect:"Allow",Action:["rds-data:ExecuteStatement","rds-data:BatchExecuteStatement","rds-data:BeginTransaction","rds-data:CommitTransaction","rds-data:RollbackTransaction"],Resource:`arn:aws:rds:*:${e}:cluster:fjall-dev-*`},{Sid:"FjallDevProvisionerMetrics",Effect:"Allow",Action:["cloudwatch:GetMetricData"],Resource:"*"},{Sid:"FjallDevProvisionerOrphanDiscovery",Effect:"Allow",Action:["tag:GetResources"],Resource:"*"},{Sid:"FjallDevProvisionerSsmTeardown",Effect:"Allow",Action:["ssm:DeleteParameter*"],Resource:`arn:aws:ssm:*:${e}:parameter/fjall/dev/*`},{Sid:"FjallDevProvisionerLogsTeardown",Effect:"Allow",Action:["logs:DeleteLogGroup"],Resource:`arn:aws:logs:*:${e}:log-group:/fjall/dev/*`},{Sid:"FjallDevProvisionerTaggedTeardown",Effect:"Allow",Action:["ecs:UpdateService","ecs:StopTask","ecs:DeleteService","elasticloadbalancing:DeleteRule","elasticloadbalancing:DeleteTargetGroup","elasticloadbalancing:DeregisterTargets"],Resource:[`arn:aws:ecs:*:${e}:*`,`arn:aws:elasticloadbalancing:*:${e}:*`],Condition:{StringEquals:{"aws:ResourceTag/fjall:dev":"true"}}},{Sid:"FjallDevProvisionerTeardownReads",Effect:"Allow",Action:["ecs:Describe*","elasticloadbalancing:Describe*"],Resource:"*"},{Sid:"FjallDevProvisionerImageJanitor",Effect:"Allow",Action:["ecr:ListImages","ecr:DescribeImages","ecr:BatchDeleteImage"],Resource:`arn:aws:ecr:*:${e}:repository/*`},{Sid:"FjallDevProvisionerSsmReadAll",Effect:"Allow",Action:["ssm:GetParameter*"],Resource:`arn:aws:ssm:*:${e}:parameter/*`},{Sid:"FjallDevProvisionerKmsDecryptViaSsm",Effect:"Allow",Action:["kms:Decrypt"],Resource:`arn:aws:kms:*:${e}:key/*`,Condition:{StringLike:{"kms:ViaService":"ssm.*.amazonaws.com"}}}]}he(XD,"buildDevProvisionerPolicyStatements");function JD({accountId:e}){return[{Sid:"FjallDevSyncPrefixReadWrite",Effect:"Allow",Action:["s3:GetObject","s3:PutObject"],Resource:`arn:aws:s3:::fjall-dev-sync-${e}-*/*`,Condition:{StringEquals:{"aws:ResourceAccount":e}}}]}he(JD,"buildDevSyncWriterPolicyStatements");function qD({accountId:e}){return[{Sid:"FjallDevBoundarySsmDevRead",Effect:"Allow",Action:["ssm:GetParameter*"],Resource:`arn:aws:ssm:*:${e}:parameter/fjall/dev/*`},{Sid:"FjallDevBoundaryKmsDecryptDevAlias",Effect:"Allow",Action:["kms:Decrypt"],Resource:`arn:aws:kms:*:${e}:key/*`,Condition:{"ForAnyValue:StringLike":{"kms:ResourceAliases":"alias/fjall-dev-*"}}},{Sid:"FjallDevBoundarySyncPrefixReadWrite",Effect:"Allow",Action:["s3:GetObject","s3:PutObject"],Resource:`arn:aws:s3:::fjall-dev-sync-${e}-*/*`,Condition:{StringEquals:{"aws:ResourceAccount":e}}},{Sid:"FjallDevBoundarySlotLogs",Effect:"Allow",Action:["logs:CreateLogStream","logs:PutLogEvents"],Resource:`arn:aws:logs:*:${e}:log-group:/fjall/dev/*`},{Sid:"FjallDevBoundarySyncQueue",Effect:"Allow",Action:["sqs:ReceiveMessage","sqs:DeleteMessage","sqs:GetQueueUrl"],Resource:`arn:aws:sqs:*:${e}:fjall-dev-sync-${e}-*`}]}he(qD,"buildDevBoundaryStatements");var QD=Object.defineProperty,Ve=(e,t)=>QD(e,"name",{value:t,configurable:!0});function $(e){return JSON.stringify(e)}Ve($,"escapeStringLiteral");function Br(e){return e.map($).join(", ")}Ve(Br,"formatStringArray");var ew="import:SharedAlarmTopicArn";function Vr(e="    "){return`

package/bin/assets/generators/database/generator.js CHANGED Viewed

@@ -195,7 +195,7 @@ ${Fe.hex("#D9622E").bold(`--- ${e} ---`)}`),F&&F.start())}Ye(GL,"step");function
 `);return{buffer:[],stream:r}}flush(){let t=this.flushBuffer(this.buffer,this.mainLogStream,this.mainLogPath);this.buffer=t.buffer,this.mainLogStream=t.stream;let n=this.flushBuffer(this.debugBuffer,this.debugLogStream,this.debugLogPath);this.debugBuffer=n.buffer,this.debugLogStream=n.stream}close(){this.isClosing=!0,this.flush(),this.flushInterval&&(clearInterval(this.flushInterval),this.flushInterval=null),this.mainLogStream&&(this.mainLogStream.end(),this.mainLogStream=null),this.debugLogStream&&(this.debugLogStream.end(),this.debugLogStream=null),this.buffer=[],this.debugBuffer=[],this.initialised=!1,this.isClosing=!1}async closeAndFlush(){this.isClosing=!0,this.flush(),this.flushInterval&&(clearInterval(this.flushInterval),this.flushInterval=null);let t=[];this.mainLogStream&&(t.push(this.mainLogStream),this.mainLogStream=null),this.debugLogStream&&(t.push(this.debugLogStream),this.debugLogStream=null),this.buffer=[],this.debugBuffer=[],this.initialised=!1,await Promise.all(t.map(n=>new Promise(i=>{n.end(()=>i())}))),this.isClosing=!1}};import{createWriteStream as lU,existsSync as dU,mkdirSync as mU}from"fs";import{join as f$}from"path";var yn={trace:0,debug:1,info:2,warn:3,error:4},Ke={MAX_FILE_SIZE:10*1024*1024,MAX_FILES:5,MAX_BUFFER_SIZE:100,FLUSH_INTERVAL_MS:500,LOG_FILENAME:"fjall.jsonl",DEBUG_LOG_FILENAME:"fjall-debug.jsonl"};import{join as aU}from"path";import{homedir as sU}from"os";var iU=Object.defineProperty,oU=(e,t)=>iU(e,"name",{value:t,configurable:!0});function zr(){let e=process.env.FJALL_LOG_DIR;return e!==void 0&&e!==""?e:aU(sU(),".fjall","logs")}oU(zr,"getDefaultLogDir");var cU=Object.defineProperty,uU=(e,t)=>cU(e,"name",{value:t,configurable:!0}),ya=class{static{uU(this,"DeploymentLoggerImpl")}mainLogger;appName;operationType;logStream=null;logPath;deploymentId;buffer=[];flushInterval=null;isClosing=!1;maxBufferSize=Ke.MAX_BUFFER_SIZE;constructor(t,n,i){this.mainLogger=t,this.appName=n,this.operationType=i,this.deploymentId=`${i}-${Date.now()}`;let r=zr(),o=f$(r,"deployments",n);dU(o)||mU(o,{recursive:!0});let a=new Date().toISOString().replace(/[:.]/g,"-"),c=`${i}-${a}.jsonl`;this.logPath=f$(o,c);try{this.logStream=lU(this.logPath,{flags:"a"}),this.flushInterval=setInterval(()=>this.flush(),Ke.FLUSH_INTERVAL_MS),this.info("DeploymentLogger","Deployment logging initialised",{appName:n,operationType:i,deploymentId:this.deploymentId,logPath:this.logPath})}catch{}}log(t,n,i,r,o,a){if(this.isClosing)return;let c={timestamp:new Date().toISOString(),level:t,component:n,message:i,correlationId:this.deploymentId,...r&&Object.keys(r).length>0&&{data:r},...o&&{stackName:o},...a&&{phase:a}};this.buffer.push(c),this.mainLogger.logWithCorrelation(t,n,i,this.deploymentId,r,o,a),this.buffer.length>=this.maxBufferSize&&this.flush()}flush(){if(!(this.buffer.length===0||!this.logStream)){for(let t of this.buffer)this.logStream.write(JSON.stringify(t)+`
 `);this.buffer=[]}}info(t,n,i){this.log("info",t,n,i)}warn(t,n,i){this.log("warn",t,n,i)}error(t,n,i){this.log("error",t,n,i)}debug(t,n,i){this.log("debug",t,n,i)}stackEvent(t,n,i,r){this.log("info","StackDeployment",i,r,t,n)}dockerEvent(t,n){this.log("info","DockerOperation",t,{percentage:n})}ecsEvent(t,n,i){this.log("info","ECSDeployment",t,{percentage:n,taskCount:i})}close(){this.isClosing=!0,this.flush(),this.flushInterval&&(clearInterval(this.flushInterval),this.flushInterval=null),this.logStream&&(this.logStream.end(),this.logStream=null),this.buffer=[],this.isClosing=!1}getLogPath(){return this.logPath}getDeploymentId(){return this.deploymentId}};var pU=Object.defineProperty,fU=(e,t)=>pU(e,"name",{value:t,configurable:!0}),Bu=class e{static{fU(this,"Logger")}static instance=null;config;debugEnabled;traceEnabled;minLevel;fileWriter;mainLogPath;debugLogPath;constructor(){let t=zr(),n=Hv(t,"debug"),i=this.parseEnvInt("FJALL_LOG_MAX_SIZE",Ke.MAX_FILE_SIZE),r=this.parseEnvInt("FJALL_LOG_MAX_FILES",Ke.MAX_FILES);this.config={logDir:t,debugLogDir:n,maxFileSize:i,maxFiles:r,maxBufferSize:Ke.MAX_BUFFER_SIZE,flushIntervalMs:Ke.FLUSH_INTERVAL_MS},this.mainLogPath=Hv(t,Ke.LOG_FILENAME),this.debugLogPath=Hv(n,Ke.DEBUG_LOG_FILENAME),this.debugEnabled=process.env.FJALL_DEBUG==="true"||process.env.FJALL_TRACE==="true"||process.argv.includes("--verbose")||process.argv.includes("-v"),this.traceEnabled=process.env.FJALL_TRACE==="true";let o=process.env.FJALL_LOG_LEVEL?.toLowerCase();o&&o in yn?this.minLevel=o:this.traceEnabled?this.minLevel="trace":this.debugEnabled?this.minLevel="debug":this.minLevel="info",this.fileWriter=new Fu(this.config,this.mainLogPath,this.debugLogPath,this.debugEnabled)}parseEnvInt(t,n){let i=process.env[t];if(i){let r=parseInt(i,10);if(!isNaN(r)&&r>0)return r}return n}static getInstance(){return e.instance||(e.instance=new e),e.instance}shouldLog(t){return yn[t]>=yn[this.minLevel]}createEntry(t,n,i,r,o,a,c){return{timestamp:new Date().toISOString(),level:t,component:n,message:i,...o&&{correlationId:o},...r&&Object.keys(r).length>0&&{data:r},...a&&{stackName:a},...c&&{phase:c}}}log(t,n,i,r,o,a,c){if(!this.shouldLog(t))return;let u=this.createEntry(t,n,i,r,o,a,c),l=t==="debug"||t==="trace";this.fileWriter.write(u,l),this.writeConsole(u)}writeConsole(t){if(Ee.shouldSuppressOutput||Ee.isNonInteractive){this.debugEnabled&&this.writeDebugMirror(t);return}let n=this.getConsolePrefix(t.level),i=`[${t.component}]`,r=`${n} ${i} ${t.message}`;t.level==="error"?console.error(r):t.level==="warn"?console.warn(r):console.log(r)}writeDebugMirror(t){let n=this.getConsolePrefix(t.level),i=`[${t.component}]`,r="";if(t.data&&Object.keys(t.data).length>0)try{r=` ${JSON.stringify(t.data)}`}catch{r=" [unserialisable data]"}let o=`${n} ${i} ${t.message}${r}`;process.stderr.write(`${Or(o)}
 `)}getConsolePrefix(t){switch(t){case"error":return"[ERROR]";case"warn":return"[WARN]";case"info":return"[INFO]";case"debug":return"[DEBUG]";case"trace":return"[TRACE]"}}error(t,n,i){this.log("error",t,n,i)}warn(t,n,i){this.log("warn",t,n,i)}info(t,n,i){this.log("info",t,n,i)}debug(t,n,i){this.log("debug",t,n,i)}trace(t,n,i){this.log("trace",t,n,i)}isDebugEnabled(){return this.debugEnabled}isTraceEnabled(){return this.traceEnabled}enableDebug(){this.debugEnabled=!0,yn[this.minLevel]>yn.debug&&(this.minLevel="debug"),this.fileWriter.setDebugEnabled(!0),this.fileWriter.isInitialised&&this.fileWriter.initialiseDebugStream()}withCorrelation(t){return new Di(this,t)}forDeployment(t,n="deploy"){return new ya(this,t,n)}close(){this.fileWriter.close()}async flushAndClose(){await this.fileWriter.closeAndFlush()}getLogPath(){return this.mainLogPath}getDebugLogPath(){return this.debugLogPath}getLogDir(){return this.config.logDir}logWithCorrelation(t,n,i,r,o,a,c){this.log(t,n,i,o,r,a,c)}static reset(){e.instance&&(e.instance.close(),e.instance=null)}};var gU=Object.defineProperty,hU=(e,t)=>gU(e,"name",{value:t,configurable:!0}),Uu=Bu.getInstance();function SU(e){let t=zr(),n=h$(t,"debug"),i=h$(n,Ke.DEBUG_LOG_FILENAME);try{g$(n)||vU(n,{recursive:!0}),g$(i)&&bU(i).size>Ke.MAX_FILE_SIZE&&new Mi({maxFiles:Ke.MAX_FILES}).rotate(i);let r={timestamp:new Date().toISOString(),level:"debug",component:"Emergency",message:e};yU(i,JSON.stringify(r)+`
-`)}catch{}}hU(SU,"writeDebugSync");var _U=Object.defineProperty,ji=(e,t)=>_U(e,"name",{value:t,configurable:!0});function Yv(e){return e.success===!0}ji(Yv,"isSuccess");function Kv(e){return e.success===!1}ji(Kv,"isFailure");function N(e){return{success:!0,data:e}}ji(N,"success");function T(e){return{success:!1,error:e}}ji(T,"failure");async function qv(e){try{let t=await e();return N(t)}catch(t){return T(Tt(t))}}ji(qv,"tryAsync");function Xv(e){try{let t=e();return N(t)}catch(t){return T(Tt(t))}}ji(Xv,"trySync");var EU=Object.defineProperty,xU=(e,t)=>EU(e,"name",{value:t,configurable:!0}),v$=/^[a-zA-Z][a-zA-Z0-9-]*$/,AU=na.source.replace(/^\^|\$$/g,""),L=Object.freeze({IDENTIFIER:v$,NEW_APP_NAME:/^[a-z][a-z0-9-]*$/,RESOURCE_NAME:/^[a-zA-Z][a-zA-Z0-9]*$/,ECS_SERVICE_NAME:v$,BUCKET_NAME:/^[a-z][a-z0-9-]*[a-z0-9]$|^[a-z][a-z0-9]*$/,DATABASE_NAME:/^[a-zA-Z][a-zA-Z0-9_]*$/,RESOURCE_TYPE:/^[a-z]+(:[a-z]+)?$/,SSM_PATH:new RegExp(`^(?:/${AU})+$`),SECRET_NAME:vu,SSM_COMPONENT:na,EMAIL:/^[^\s@]+@[^\s@]+\.[^\s@]+$/,DOCKER_IMAGE:/^[a-z0-9][a-z0-9._-]*[a-z0-9](:[a-z0-9._-]+)?$/,DOMAIN:/^[a-z0-9]([a-z0-9-]*[a-z0-9])?(\.[a-z0-9]([a-z0-9-]*[a-z0-9])?)+$/i,HTTP_ORIGIN:/^https?:\/\/[a-z0-9.-]+(:\d+)?$/i,PASCAL_CASE:/^[A-Z][A-Za-z0-9]*$/,AWS_ACCOUNT_ID:/^\d{12}$/,VPC_ID:/^vpc-[a-z0-9]+$/,ROLE_ARN:/^arn:aws[a-zA-Z-]*:iam::\d{12}:role\/.+$/,CIDR:/^((25[0-5]|2[0-4]\d|1\d\d|[1-9]?\d)\.){3}(25[0-5]|2[0-4]\d|1\d\d|[1-9]?\d)\/(3[0-2]|[12]?\d)$/,SCHEDULE_EXPRESSION:/^(rate\(1 (?:minute|hour|day)\)|rate\((?:[2-9]|[1-9]\d+) (?:minutes|hours|days)\)|cron\([^\s()]+ [^\s()]+ [^\s()]+ [^\s()]+ [^\s()]+ [^\s()]+\))$/,LAMBDA_RUNTIME_IDENTIFIER:/^[A-Za-z0-9._-]+$/,ENV_VAR_NAME:/^[A-Za-z_][A-Za-z0-9_]*$/});function Jv(e){let t=/^rate\((\d+) (minute|minutes|hour|hours|day|days)\)$/.exec(e);if(!t)return;let n=t[1],i=t[2];if(n===void 0||i===void 0)return;let r=parseInt(n,10);if(!Number.isFinite(r)||r<1)return;let o=i==="minute"||i==="hour"||i==="day";if(!(o&&r!==1)&&!(!o&&r===1))return i==="minute"||i==="minutes"?{everyMs:r*6e4}:i==="hour"||i==="hours"?{everyMs:r*60*6e4}:{everyMs:r*24*60*6e4}}xU(Jv,"parseRateExpression");var m=Object.freeze({IDENTIFIER:"Must start with a letter, contain only letters, numbers, and hyphens",NEW_APP_NAME:"Must start with a lowercase letter and contain only lowercase letters, numbers, and hyphens",IDENTIFIER_MIN_LENGTH:"Must be at least 2 characters",IDENTIFIER_NO_TRAILING_HYPHEN:"Must not end with a hyphen",IDENTIFIER_NO_CONSECUTIVE_HYPHENS:"Must not contain consecutive hyphens",RESOURCE_NAME:"Must start with a letter and contain only letters and numbers (PascalCase recommended)",ECS_SERVICE_NAME:"Service name must start with a letter and contain only letters, numbers, and hyphens",BUCKET_NAME:"Bucket name must start with a lowercase letter and contain only lowercase letters, numbers, and hyphens",DATABASE_NAME:"Database name must start with a letter and contain only letters, numbers, and underscores",RESOURCE_TYPE:"Resource type must be in format 'category' or 'category:type'",SSM_PATH:"SSM path must start with / and contain valid namespace segments (e.g., /myapp/ApiCluster/service)",SECRET_NAME:Hh,SSM_COMPONENT:bu,EMAIL:"Please enter a valid email address",DOMAIN:"Please enter a valid domain (e.g., cms.example.com)",DOCKER_IMAGE:"Invalid Docker image name format",REQUIRED:{APP_NAME:"Application name is required",RESOURCE_NAME:"Resource name is required",BUCKET_NAME:"Bucket name is required",SERVICE_NAME:"Service name is required",NETWORK_NAME:"Network name is required",DATABASE_NAME:"Database name is required",ORGANISATION_NAME:"Organisation name is required",EMAIL:"Email is required",NAME:"Name is required",USERNAME:"Username is required",CONTAINER_NAME:"Container name is required",GROUP:"Group is required",PATTERN_NAME:"Pattern name is required",SOURCE:"Source directory is required",BUILD_COMMAND:"Build command is required",OUTPUT_DIR:"Output directory is required",FORMS_TO:"Forms recipient address is required",ROUTING_PATH:"Routing path is required",RESOURCE_REFERENCE:"Resource reference is required",RESOURCE_TYPE:"Resource type is required",VARIANT:"Variant is required",SUBTYPE:"Subtype is required",DEPLOY_TARGET:"Deploy target is required",DESTROY_TARGET:"Destroy target is required"},MAX_LENGTH:{APP_NAME:"Application name must be 50 characters or less",RESOURCE_NAME:"Resource name must be 63 characters or less",BUCKET_NAME:"Bucket name must be 63 characters or less",SERVICE_NAME:"Service name must be 255 characters or less",NETWORK_NAME:"Network name must be 50 characters or less",DATABASE_NAME:"Database name must be 63 characters or less",ORGANISATION_NAME:"Organisation name must be 50 characters or less"},PORT:{INTEGER:"Port must be an integer",MIN:"Port must be at least 1",MAX:"Port cannot exceed 65535"},USERNAME:{MAX_LENGTH:"Username cannot exceed 63 characters"},LAMBDA:{MEMORY:{INTEGER:"Lambda memory must be an integer",MIN:"Memory must be at least 128 MB",MAX:"Memory cannot exceed 10240 MB",MULTIPLE:"Memory must be 128 MB or a multiple of 64 MB"},TIMEOUT:{INTEGER:"Timeout must be an integer",MIN:"Timeout must be at least 1 second",MAX:"Timeout cannot exceed 900 seconds"},RUNTIME:"Lambda runtime must contain only letters, digits, dots, underscores, or dashes (e.g. 'NODEJS_20_X' or 'nodejs20.x')"},ENV_VAR_NAME:"Environment variable names must start with a letter or underscore and contain only letters, digits, and underscores",PRIORITY:{INTEGER:"Priority must be an integer",MIN:"Priority must be at least 1",MAX:"Priority cannot exceed 50000"},CAPACITY:{MIN:{INTEGER:"Minimum capacity must be an integer",MIN_0:"Minimum capacity must be at least 0",MIN_1:"Minimum capacity must be at least 1",MAX:"Minimum capacity cannot exceed 100"},MAX:{INTEGER:"Maximum capacity must be an integer",MIN_0:"Maximum capacity must be at least 0",MIN_1:"Maximum capacity must be at least 1",MAX:"Maximum capacity cannot exceed 100"},DESIRED:{INTEGER:"Desired count must be an integer",MIN:"Desired count must be at least 0",MAX:"Desired count cannot exceed 100"},WARM_POOL_REQUIRED:"minCapacity 0 requires a warmPool \u2014 without it, new tasks wait 60-90s for a cold instance launch",WARM_POOL:{MIN_SIZE:{INTEGER:"Warm pool minSize must be an integer",MIN:"Warm pool minSize must be at least 0",MAX:"Warm pool minSize cannot exceed 100"},MIN_SIZE_EXCEEDS_MAX_CAPACITY:"warmPool.minSize cannot exceed maxCapacity \u2014 the warm pool cannot hold more instances than the ASG allows"}},MEMORY_LIMIT:{INTEGER:"Memory limit must be an integer",MIN_512:"Memory limit must be at least 512 MiB",MIN_128:"Memory limit must be at least 128 MiB",MAX:"Memory limit cannot exceed 30720 MiB"},DATABASE:{PORT:{INTEGER:"Database port must be an integer",MIN:"Database port must be at least 1024",MAX:"Database port cannot exceed 65535"},NAME:{REQUIRED:"Database name is required",MAX_LENGTH:"Database name must be 63 characters or less"}},BACKUP_RETENTION:{INTEGER:"Backup retention must be an integer",MIN:"Backup retention must be at least 1 day",MAX:"Backup retention cannot exceed 35 days"},SQS:{VISIBILITY_TIMEOUT:{INTEGER:"Visibility timeout must be an integer",MIN:"Visibility timeout must be at least 0 seconds",MAX:"Visibility timeout cannot exceed 43200 seconds (12 hours)"},RETENTION_PERIOD:{INTEGER:"Retention period must be an integer",MIN:"Retention period must be at least 60 seconds",MAX:"Retention period cannot exceed 1209600 seconds (14 days)"}},READER:{COUNT:{INTEGER:"Reader count must be an integer",MIN:"Reader count must be at least 0",MAX:"Reader count cannot exceed 15"}},IDENTIFIER_SUFFIX:{REQUIRED:"Identifier suffix is required when specified",MAX_LENGTH:"Identifier suffix cannot exceed 50 characters"},ROTATION:{INTEGER:"Rotation days must be an integer",MIN:"Rotation interval must be at least 1 day",MAX:"Rotation interval cannot exceed 365 days"},MAX_CONNECTIONS:{INTEGER:"Max connections must be an integer",MIN:"Max connections must be at least 1",MAX:"Max connections cannot exceed 100"},MONITORING_INTERVAL:{INTEGER:"Monitoring interval must be an integer",MIN:"Monitoring interval must be at least 0",MAX:"Monitoring interval cannot exceed 60 seconds",VALUES:"Monitoring interval must be 0, 1, 5, 10, 15, 30, or 60 seconds"},RETENTION_DAYS:{INTEGER:"Retention days must be an integer",MIN:"Retention days must be at least 1",MAX:"Retention days cannot exceed 365"},BATCH_SIZE:{INTEGER:"Batch size must be an integer",MIN:"Batch size must be at least 1",MAX:"Batch size cannot exceed 10000"},SERVICE:{UNIQUE_WITHIN_CLUSTER:"Service names must be unique within a cluster",MIN_REQUIRED:"At least one service is required",ROUTING_REQUIRED:"Multiple services with ports require routing config (path or host)"},PROXY_CONFIG:{MAX_IDLE_CONNECTIONS:{INTEGER:"Max idle connections must be an integer",MIN:"Max idle connections must be at least 0",MAX:"Max idle connections cannot exceed 100"},BORROW_TIMEOUT:{INTEGER:"Connection borrow timeout must be an integer",MIN:"Connection borrow timeout must be at least 1 second",MAX:"Connection borrow timeout cannot exceed 3600 seconds"}},MAX_AZS:{INTEGER:"Max AZs must be an integer",MIN:"Max AZs must be at least 1",MAX:"Max AZs cannot exceed 3"},BATCHING_WINDOW:{INTEGER:"Max batching window must be an integer",MIN:"Max batching window must be at least 0",MAX:"Max batching window cannot exceed 300 seconds"},HEALTH_CHECK:{INTERVAL:{INTEGER:"Health check interval must be an integer",MIN:"Health check interval must be at least 5 seconds",MAX:"Health check interval cannot exceed 300 seconds"},TIMEOUT:{INTEGER:"Health check timeout must be an integer",MIN:"Health check timeout must be at least 2 seconds",MAX:"Health check timeout cannot exceed 60 seconds"},RETRIES:{INTEGER:"Health check retries must be an integer",MIN:"Health check retries must be at least 1",MAX:"Health check retries cannot exceed 10"},START_PERIOD:{INTEGER:"Health check start period must be an integer",MIN:"Health check start period must be at least 0 seconds",MAX:"Health check start period cannot exceed 300 seconds"}},EPHEMERAL_STORAGE:{INTEGER:"Ephemeral storage size must be an integer",MIN:"Ephemeral storage size must be at least 512 MB",MAX:"Ephemeral storage size cannot exceed 10240 MB"},MAX_MESSAGE_SIZE:{INTEGER:"Max message size must be an integer",MIN:"Max message size must be at least 1024 bytes",MAX:"Max message size cannot exceed 262144 bytes (256 KB)"},CAPACITY_CONSTRAINT:{MIN_LTE_MAX:"minCapacity must be less than or equal to maxCapacity"},DIRECT_ACCESS:{NO_DOMAIN:"directAccess cannot be used with domain (no ALB for HTTPS)",NO_LOAD_BALANCER:"directAccess cannot be used with loadBalancer (mutually exclusive)"},GLOBAL_AURORA:{PRIMARY_REGION_REQUIRED:"primaryRegion is required for GlobalAurora databases"},NAT_GATEWAY:{INTEGER:"NAT gateway count must be an integer",MIN:"NAT gateway count must be at least 0",MAX:"NAT gateway count cannot exceed 3"},CIDR_MASK:{INTEGER:"CIDR mask must be an integer",MIN:"CIDR mask must be at least 16",MAX:"CIDR mask cannot exceed 28"},CPU:{INTEGER:"CPU must be an integer",MIN:"CPU must be at least 256 units",MAX:"CPU cannot exceed 4096 units"},KMS:{KEY_REQUIRED:"KMS key ARN is required when using KMS encryption"},READER_INSTANCES:{MAX:"Cannot have more than 15 reader instances",COUNT_OR_INSTANCES:"Cannot specify both 'count' and 'instances' - use one or the other"},GENERATOR_CAPACITY:{MIN:{MIN:"Minimum capacity must be at least 1",MAX:"Minimum capacity cannot exceed 1000"},MAX:{MIN:"Maximum capacity must be at least 1",MAX:"Maximum capacity cannot exceed 1000"}},INSTANCE_TYPE:"Unknown instance type. Common types include: t4g.micro, t4g.small, m5.large",ARCHITECTURE_MISMATCH:"Architecture mismatch between instance type and AMI",ALLOCATED_STORAGE:{INTEGER:"Allocated storage must be an integer",MIN:"Allocated storage must be at least 20 GB",MAX:"Allocated storage cannot exceed 65536 GB"},DLQ:{MAX_RECEIVE_COUNT:{INTEGER:"Max receive count must be an integer",MIN:"Max receive count must be at least 1",MAX:"Max receive count cannot exceed 1000"}},ALARM:{PERCENTAGE:{MIN:"Threshold must be at least 1%",MAX:"Threshold must be at most 100%"},FREE_STORAGE_GIB:{MIN:"Free storage threshold must be at least 1 GiB"}},REGION:"Invalid AWS region",PASCAL_CASE:"Resource name must start with an uppercase letter and contain only alphanumerics (PascalCase).",IMAGE_DOCKER_MUTEX:"image and docker are mutually exclusive",AWS_ACCOUNT_ID:"AWS account id must be exactly 12 digits (no hyphens)",VPC_ID:"VPC id must look like vpc-abc12345",ROLE_ARN:"Role ARN must have the form arn:aws:iam::<account-id>:role/<name>",CIDR:"CIDR must be in dotted-quad/prefix-length form (e.g. 10.0.0.0/16)",VPC_PEER:{MIN_REQUESTER_ACCOUNTS:"At least one requester account id is required",REGION_REQUIRED:"Peer region is required when specified",ROUTE_TABLE_ID_REQUIRED:"Route table id must not be empty"},SCHEDULE_EXPRESSION:"Schedule expression must be 'rate(N minute|minutes|hour|hours|day|days)' with N>=1, or 'cron(<6-field AWS expression>)'"});var IU=Object.defineProperty,gt=(e,t)=>IU(e,"name",{value:t,configurable:!0}),TU=["us-east-2","us-west-2","us-east-1","eu-west-1","eu-central-1","ap-southeast-1"],$U=Object.freeze(TU.flatMap(e=>{let t=Ai(e);return t?[t]:[]})),Qv=Object.freeze(["us-east-2","us-west-2","us-east-1","eu-west-1","ap-southeast-1"]);function Vu(e){return e?e.split(",").map(t=>t.trim()).filter(Boolean):[]}gt(Vu,"parseRegionList");function eb(e){return ar.includes(e)}gt(eb,"isValidRegion");function tb(e){return/^[a-z]{2}-[a-z]+-[1-9]$/.test(e)}gt(tb,"isValidRegionFormat");function rb(e){if(!e)return Qv.slice(0,3);let t=e.toLowerCase().split("-"),n=t[0],i=t.length>1?t[1]:"",r=[];return n&&i&&(r=ar.filter(o=>o.startsWith(`${n}-${i}`))),r.length===0&&n&&(r=ar.filter(o=>o.startsWith(`${n}-`))),r.length>0?r.slice(0,3):Qv.slice(0,3)}gt(rb,"getSuggestions");function nb(e){if(eb(e))return!0;let t=rb(e);return tb(e)?`Unknown region. Try: ${t.join(", ")}`:`Invalid format. Try: ${t.join(", ")}`}gt(nb,"validateRegion");function b$(e){if(!e||e.trim()==="")return!0;let t=Vu(e);for(let n of t){let i=nb(n);if(i!==!0)return i}return!0}gt(b$,"validateRegionList");function ib(e,t){return e.filter(n=>n!==t)}gt(ib,"filterDuplicateRegions");function ob(e){return{label:e.city,value:e.code,description:e.optIn?`${e.code} \u2014 opt-in required`:e.code}}gt(ob,"toRegionOption");function y$(){return mt.map(ob)}gt(y$,"getRegionOptions");function S$(e){return mt.filter(t=>t.code!==e).map(ob)}gt(S$,"getRegionOptionsExcluding");function _$(e){let t=mt.find(n=>n.code===e);return t?t.city:e}gt(_$,"getRegionName");function E$(e){return t=>{let n=Vu(t);return ib(n,e)}}gt(E$,"createRegionFormatter");var Gu="11.0.0";var Zu=["Aurora","Instance","GlobalAurora","ClickHouse"],zi=["FARGATE","FARGATE_SPOT","EC2"],Rt=["standard","resilient","enterprise"],Wu=["tinkerer","lightweight","standard","resilient","enterprise"],ab="custom",Sa=[...Wu,ab];var RU=Object.defineProperty,CU=(e,t)=>RU(e,"name",{value:t,configurable:!0}),VK=Object.freeze({RESOURCE_SUFFIXES:Object.freeze({storage:"Storage",database:"Database",cluster:"Cluster",function:"Function",instance:"Instance",compute:"Compute"})}),_a=["ecs","lambda","ec2"],Li=Object.freeze({ECS:"ecs",LAMBDA:"lambda",EC2:"ec2"}),Hu=["code","container"],Ea=Object.freeze({CODE:"code",CONTAINER:"container"}),Yu=["ARM_64","X86_64"],x$="ARM_64",xa=["NONE","AWS_IAM"],Ku=["public","internal"],qu=["CPU","MEMORY"],Xu=["ARM","STANDARD"],sb=["Instance","Aurora"],Ui=["postgresql","mysql"],Aa=["web","worker"],A$=["foundation","compliance","hardened"];var Ju=["t3.nano","t3.micro","t3.small","t3.medium","t3.large","t3.xlarge","t3.2xlarge","t3a.nano","t3a.micro","t3a.small","t3a.medium","t3a.large","t3a.xlarge","t3a.2xlarge","t4g.nano","t4g.micro","t4g.small","t4g.medium","t4g.large","t4g.xlarge","t4g.2xlarge","c5.large","c5.xlarge","c5.2xlarge","c5.4xlarge","c5.9xlarge","c5.12xlarge","c5.18xlarge","c5.24xlarge","c5a.large","c5a.xlarge","c5a.2xlarge","c5a.4xlarge","c5a.8xlarge","c5a.12xlarge","c5a.16xlarge","c5a.24xlarge","c6g.medium","c6g.large","c6g.xlarge","c6g.2xlarge","c6g.4xlarge","c6g.8xlarge","c6g.12xlarge","c6g.16xlarge","r5.large","r5.xlarge","r5.2xlarge","r5.4xlarge","r5.8xlarge","r5.12xlarge","r5.16xlarge","r5.24xlarge","r5a.large","r5a.xlarge","r5a.2xlarge","r5a.4xlarge","r5a.8xlarge","r5a.12xlarge","r5a.16xlarge","r5a.24xlarge","r6g.medium","r6g.large","r6g.xlarge","r6g.2xlarge","r6g.4xlarge","r6g.8xlarge","r6g.12xlarge","r6g.16xlarge","i3.large","i3.xlarge","i3.2xlarge","i3.4xlarge","i3.8xlarge","i3.16xlarge","p3.2xlarge","p3.8xlarge","p3.16xlarge","g4dn.xlarge","g4dn.2xlarge","g4dn.4xlarge","g4dn.8xlarge","g4dn.12xlarge","g4dn.16xlarge","m5.large","m5.xlarge","m5.2xlarge","m5.4xlarge","m5.8xlarge","m5.12xlarge","m5.16xlarge","m5.24xlarge","m5a.large","m5a.xlarge","m5a.2xlarge","m5a.4xlarge","m5a.8xlarge","m5a.12xlarge","m5a.16xlarge","m5a.24xlarge"],I$=[0,1,5,10,15,30,60];function ht(e,t){return e.includes(t)}CU(ht,"constIncludes");var T$=1,$$=65535,YK=Object.freeze({postgresql:5432,mysql:3306}),R$=128,C$=10240,Qu=1,el=900,cb=1,ub=1e3,Fi=100,P$=100;var N$=3e3;var w$=["GET","POST","PUT","DELETE","HEAD","OPTIONS","PATCH"],k$=["standard","assets","upload","website"],Bi=["AES256","KMS"];var PU=Object.defineProperty,Ia=(e,t)=>PU(e,"name",{value:t,configurable:!0}),qe=Ia(e=>s.union([s.literal(!1),e]),"optionalOrDisabled"),Sn={check:Ia(e=>e.minCapacity!==void 0&&e.maxCapacity!==void 0?e.minCapacity<=e.maxCapacity:!0,"check"),params:{message:m.CAPACITY_CONSTRAINT.MIN_LTE_MAX,path:["maxCapacity"]}},Ta=Ia(e=>s.number().int(m.MEMORY_LIMIT.INTEGER).min(e,e===128?m.MEMORY_LIMIT.MIN_128:m.MEMORY_LIMIT.MIN_512).max(30720,m.MEMORY_LIMIT.MAX),"memoryLimitMiBSchema"),V=s.string().min(1,m.REQUIRED.RESOURCE_NAME).max(63,m.MAX_LENGTH.RESOURCE_NAME).regex(L.RESOURCE_NAME,m.RESOURCE_NAME),D$=s.string().min(1,m.REQUIRED.BUCKET_NAME).max(63,m.MAX_LENGTH.BUCKET_NAME).regex(L.BUCKET_NAME,m.BUCKET_NAME),M$=s.string().min(1,m.REQUIRED.DATABASE_NAME).max(63,m.MAX_LENGTH.DATABASE_NAME).regex(L.DATABASE_NAME,m.DATABASE_NAME);function tl(e,t=L.IDENTIFIER,n=m.IDENTIFIER){return s.string().min(2,m.IDENTIFIER_MIN_LENGTH).max(50,e).regex(t,n).refine(i=>!i.endsWith("-"),{message:m.IDENTIFIER_NO_TRAILING_HYPHEN}).refine(i=>!i.includes("--"),{message:m.IDENTIFIER_NO_CONSECUTIVE_HYPHENS})}Ia(tl,"identifierSchema");var xe=tl(m.MAX_LENGTH.APP_NAME),tq=tl(m.MAX_LENGTH.APP_NAME,L.NEW_APP_NAME,m.NEW_APP_NAME),_n=s.number().int(m.PORT.INTEGER).min(T$,m.PORT.MIN).max($$,m.PORT.MAX),ke=s.object({key:s.string(),sourceText:s.string()}).strict(),NU=s.object({__identifier:s.string()}).strict(),wU=s.object({__expression:s.string()}).strict(),kU=s.object({__call:s.string()}).strict(),OU=s.union([NU,wU,kU]),DU=s.union([s.string(),s.number(),s.boolean(),OU]),Vi=s.record(s.string().regex(L.ENV_VAR_NAME,m.ENV_VAR_NAME),DU),MU=s.object({id:s.string(),name:s.string().optional(),arn:s.string().optional(),field:s.string().optional()}).strict().refine(e=>e.name!==void 0!=(e.arn!==void 0),{message:"secretsImport requires exactly one of `name` or `arn`."}),j$=s.record(s.string(),MU),rq=s.record(s.string(),s.unknown()),lb=s.enum(Sa).describe(`Application type must be one of: ${Sa.join(", ")}`),db=s.enum(Lt).describe(`OpenNext deployment pattern: ${Lt.join(", ")}`),jU=s.enum(["before-imports","after-imports","after-app-init","after-tags","after-resource","end-of-file"]),zU=s.enum(["import","app-init","tags","database","compute","storage","network","messaging","cdn","pattern","vpc-peer","vpc-peer-accepter","cross-plan-connection","custom"]),z$=s.object({sourceText:s.string(),position:jU,afterManagedResource:s.object({type:zU,name:s.string().optional()}).strict().optional(),originalLine:s.number().int().optional(),leadingComments:s.array(s.string()).optional(),orphaned:s.boolean().optional(),orphanedComment:s.string().optional()}).strict(),L$=s.union([s.object({tier:s.enum(Rt)}).strict(),s.literal(!1)]),U$=s.union([s.object({instanceType:s.string().optional()}).strict(),s.literal(!1)]),LU=tl(m.MAX_LENGTH.ORGANISATION_NAME),UU=s.string().regex(L.EMAIL,m.EMAIL),O$=s.string().refine(e=>ar.includes(e),{message:m.REGION}),nq=s.object({name:LU,email:UU,accountName:s.string().optional(),primaryRegion:O$.optional().default(xi),secondaryRegions:s.array(O$).optional(),security:s.enum(A$).optional(),force:s.boolean().optional()}).strict();function $a(e){return e.issues.map(t=>`${t.path.length>0?`${t.path.join(".")}: `:""}${t.message}`).join(`
+`)}catch{}}hU(SU,"writeDebugSync");var _U=Object.defineProperty,ji=(e,t)=>_U(e,"name",{value:t,configurable:!0});function Yv(e){return e.success===!0}ji(Yv,"isSuccess");function Kv(e){return e.success===!1}ji(Kv,"isFailure");function N(e){return{success:!0,data:e}}ji(N,"success");function T(e){return{success:!1,error:e}}ji(T,"failure");async function qv(e){try{let t=await e();return N(t)}catch(t){return T(Tt(t))}}ji(qv,"tryAsync");function Xv(e){try{let t=e();return N(t)}catch(t){return T(Tt(t))}}ji(Xv,"trySync");var EU=Object.defineProperty,xU=(e,t)=>EU(e,"name",{value:t,configurable:!0}),v$=/^[a-zA-Z][a-zA-Z0-9-]*$/,AU=na.source.replace(/^\^|\$$/g,""),L=Object.freeze({IDENTIFIER:v$,NEW_APP_NAME:/^[a-z][a-z0-9-]*$/,RESOURCE_NAME:/^[a-zA-Z][a-zA-Z0-9]*$/,ECS_SERVICE_NAME:v$,BUCKET_NAME:/^[a-z][a-z0-9-]*[a-z0-9]$|^[a-z][a-z0-9]*$/,DATABASE_NAME:/^[a-zA-Z][a-zA-Z0-9_]*$/,RESOURCE_TYPE:/^[a-z]+(:[a-z]+)?$/,SSM_PATH:new RegExp(`^(?:/${AU})+$`),SECRET_NAME:vu,SSM_COMPONENT:na,EMAIL:/^[^\s@]+@[^\s@]+\.[^\s@]+$/,DOCKER_IMAGE:/^[a-z0-9][a-z0-9._-]*[a-z0-9](:[a-z0-9._-]+)?$/,DOMAIN:/^[a-z0-9]([a-z0-9-]*[a-z0-9])?(\.[a-z0-9]([a-z0-9-]*[a-z0-9])?)+$/i,HTTP_ORIGIN:/^https?:\/\/[a-z0-9.-]+(:\d+)?$/i,PASCAL_CASE:/^[A-Z][A-Za-z0-9]*$/,AWS_ACCOUNT_ID:/^\d{12}$/,VPC_ID:/^vpc-[a-z0-9]+$/,ROLE_ARN:/^arn:aws[a-zA-Z-]*:iam::\d{12}:role\/.+$/,CIDR:/^((25[0-5]|2[0-4]\d|1\d\d|[1-9]?\d)\.){3}(25[0-5]|2[0-4]\d|1\d\d|[1-9]?\d)\/(3[0-2]|[12]?\d)$/,SCHEDULE_EXPRESSION:/^(rate\(1 (?:minute|hour|day)\)|rate\((?:[2-9]|[1-9]\d+) (?:minutes|hours|days)\)|cron\([^\s()]+ [^\s()]+ [^\s()]+ [^\s()]+ [^\s()]+ [^\s()]+\))$/,LAMBDA_RUNTIME_IDENTIFIER:/^[A-Za-z0-9._-]+$/,ENV_VAR_NAME:/^[A-Za-z_][A-Za-z0-9_]*$/});function Jv(e){let t=/^rate\((\d+) (minute|minutes|hour|hours|day|days)\)$/.exec(e);if(!t)return;let n=t[1],i=t[2];if(n===void 0||i===void 0)return;let r=parseInt(n,10);if(!Number.isFinite(r)||r<1)return;let o=i==="minute"||i==="hour"||i==="day";if(!(o&&r!==1)&&!(!o&&r===1))return i==="minute"||i==="minutes"?{everyMs:r*6e4}:i==="hour"||i==="hours"?{everyMs:r*60*6e4}:{everyMs:r*24*60*6e4}}xU(Jv,"parseRateExpression");var m=Object.freeze({IDENTIFIER:"Must start with a letter, contain only letters, numbers, and hyphens",NEW_APP_NAME:"Must start with a lowercase letter and contain only lowercase letters, numbers, and hyphens",IDENTIFIER_MIN_LENGTH:"Must be at least 2 characters",IDENTIFIER_NO_TRAILING_HYPHEN:"Must not end with a hyphen",IDENTIFIER_NO_CONSECUTIVE_HYPHENS:"Must not contain consecutive hyphens",RESOURCE_NAME:"Must start with a letter and contain only letters and numbers (PascalCase recommended)",ECS_SERVICE_NAME:"Service name must start with a letter and contain only letters, numbers, and hyphens",BUCKET_NAME:"Bucket name must start with a lowercase letter and contain only lowercase letters, numbers, and hyphens",DATABASE_NAME:"Database name must start with a letter and contain only letters, numbers, and underscores",RESOURCE_TYPE:"Resource type must be in format 'category' or 'category:type'",SSM_PATH:"SSM path must start with / and contain valid namespace segments (e.g., /myapp/ApiCluster/service)",SECRET_NAME:Hh,SSM_COMPONENT:bu,EMAIL:"Please enter a valid email address",DOMAIN:"Please enter a valid domain (e.g., cms.example.com)",DOCKER_IMAGE:"Invalid Docker image name format",REQUIRED:{APP_NAME:"Application name is required",RESOURCE_NAME:"Resource name is required",BUCKET_NAME:"Bucket name is required",SERVICE_NAME:"Service name is required",NETWORK_NAME:"Network name is required",DATABASE_NAME:"Database name is required",ORGANISATION_NAME:"Organisation name is required",EMAIL:"Email is required",NAME:"Name is required",USERNAME:"Username is required",CONTAINER_NAME:"Container name is required",GROUP:"Group is required",PATTERN_NAME:"Pattern name is required",SOURCE:"Source directory is required",BUILD_COMMAND:"Build command is required",OUTPUT_DIR:"Output directory is required",FORMS_TO:"Forms recipient address is required",ROUTING_PATH:"Routing path is required",RESOURCE_REFERENCE:"Resource reference is required",RESOURCE_TYPE:"Resource type is required",VARIANT:"Variant is required",SUBTYPE:"Subtype is required",DEPLOY_TARGET:"Deploy target is required",DESTROY_TARGET:"Destroy target is required"},MAX_LENGTH:{APP_NAME:"Application name must be 50 characters or less",RESOURCE_NAME:"Resource name must be 63 characters or less",BUCKET_NAME:"Bucket name must be 63 characters or less",SERVICE_NAME:"Service name must be 255 characters or less",NETWORK_NAME:"Network name must be 50 characters or less",DATABASE_NAME:"Database name must be 63 characters or less",ORGANISATION_NAME:"Organisation name must be 50 characters or less"},PORT:{INTEGER:"Port must be an integer",MIN:"Port must be at least 1",MAX:"Port cannot exceed 65535"},USERNAME:{MAX_LENGTH:"Username cannot exceed 63 characters"},LAMBDA:{MEMORY:{INTEGER:"Lambda memory must be an integer",MIN:"Memory must be at least 128 MB",MAX:"Memory cannot exceed 10240 MB",MULTIPLE:"Memory must be 128 MB or a multiple of 64 MB"},TIMEOUT:{INTEGER:"Timeout must be an integer",MIN:"Timeout must be at least 1 second",MAX:"Timeout cannot exceed 900 seconds"},RUNTIME:"Lambda runtime must contain only letters, digits, dots, underscores, or dashes (e.g. 'NODEJS_20_X' or 'nodejs20.x')"},ENV_VAR_NAME:"Environment variable names must start with a letter or underscore and contain only letters, digits, and underscores",PRIORITY:{INTEGER:"Priority must be an integer",MIN:"Priority must be at least 1",MAX:"Priority cannot exceed 50000"},CAPACITY:{MIN:{INTEGER:"Minimum capacity must be an integer",MIN_0:"Minimum capacity must be at least 0",MIN_1:"Minimum capacity must be at least 1",MAX:"Minimum capacity cannot exceed 100"},MAX:{INTEGER:"Maximum capacity must be an integer",MIN_0:"Maximum capacity must be at least 0",MIN_1:"Maximum capacity must be at least 1",MAX:"Maximum capacity cannot exceed 100"},DESIRED:{INTEGER:"Desired count must be an integer",MIN:"Desired count must be at least 0",MAX:"Desired count cannot exceed 100"},WARM_POOL_REQUIRED:"minCapacity 0 requires a warmPool \u2014 without it, new tasks wait 60-90s for a cold instance launch",WARM_POOL:{MIN_SIZE:{INTEGER:"Warm pool minSize must be an integer",MIN:"Warm pool minSize must be at least 0",MAX:"Warm pool minSize cannot exceed 100"},MIN_SIZE_EXCEEDS_MAX_CAPACITY:"warmPool.minSize cannot exceed maxCapacity \u2014 the warm pool cannot hold more instances than the ASG allows"}},MEMORY_LIMIT:{INTEGER:"Memory limit must be an integer",MIN_512:"Memory limit must be at least 512 MiB",MIN_128:"Memory limit must be at least 128 MiB",MAX:"Memory limit cannot exceed 30720 MiB"},DATABASE:{PORT:{INTEGER:"Database port must be an integer",MIN:"Database port must be at least 1024",MAX:"Database port cannot exceed 65535"},NAME:{REQUIRED:"Database name is required",MAX_LENGTH:"Database name must be 63 characters or less"}},BACKUP_RETENTION:{INTEGER:"Backup retention must be an integer",MIN:"Backup retention must be at least 1 day",MAX:"Backup retention cannot exceed 35 days"},SQS:{VISIBILITY_TIMEOUT:{INTEGER:"Visibility timeout must be an integer",MIN:"Visibility timeout must be at least 0 seconds",MAX:"Visibility timeout cannot exceed 43200 seconds (12 hours)"},RETENTION_PERIOD:{INTEGER:"Retention period must be an integer",MIN:"Retention period must be at least 60 seconds",MAX:"Retention period cannot exceed 1209600 seconds (14 days)"}},READER:{COUNT:{INTEGER:"Reader count must be an integer",MIN:"Reader count must be at least 0",MAX:"Reader count cannot exceed 15"}},IDENTIFIER_SUFFIX:{REQUIRED:"Identifier suffix is required when specified",MAX_LENGTH:"Identifier suffix cannot exceed 50 characters"},ROTATION:{INTEGER:"Rotation days must be an integer",MIN:"Rotation interval must be at least 1 day",MAX:"Rotation interval cannot exceed 365 days"},MAX_CONNECTIONS:{INTEGER:"Max connections must be an integer",MIN:"Max connections must be at least 1",MAX:"Max connections cannot exceed 100"},MONITORING_INTERVAL:{INTEGER:"Monitoring interval must be an integer",MIN:"Monitoring interval must be at least 0",MAX:"Monitoring interval cannot exceed 60 seconds",VALUES:"Monitoring interval must be 0, 1, 5, 10, 15, 30, or 60 seconds"},RETENTION_DAYS:{INTEGER:"Retention days must be an integer",MIN:"Retention days must be at least 1",MAX:"Retention days cannot exceed 365"},BATCH_SIZE:{INTEGER:"Batch size must be an integer",MIN:"Batch size must be at least 1",MAX:"Batch size cannot exceed 10000"},SERVICE:{UNIQUE_WITHIN_CLUSTER:"Service names must be unique within a cluster",MIN_REQUIRED:"At least one service is required",ROUTING_REQUIRED:"Multiple services with ports require routing config (path or host)"},PROXY_CONFIG:{MAX_IDLE_CONNECTIONS:{INTEGER:"Max idle connections must be an integer",MIN:"Max idle connections must be at least 0",MAX:"Max idle connections cannot exceed 100"},BORROW_TIMEOUT:{INTEGER:"Connection borrow timeout must be an integer",MIN:"Connection borrow timeout must be at least 1 second",MAX:"Connection borrow timeout cannot exceed 3600 seconds"}},MAX_AZS:{INTEGER:"Max AZs must be an integer",MIN:"Max AZs must be at least 1",MAX:"Max AZs cannot exceed 3"},BATCHING_WINDOW:{INTEGER:"Max batching window must be an integer",MIN:"Max batching window must be at least 0",MAX:"Max batching window cannot exceed 300 seconds"},HEALTH_CHECK:{INTERVAL:{INTEGER:"Health check interval must be an integer",MIN:"Health check interval must be at least 5 seconds",MAX:"Health check interval cannot exceed 300 seconds"},TIMEOUT:{INTEGER:"Health check timeout must be an integer",MIN:"Health check timeout must be at least 2 seconds",MAX:"Health check timeout cannot exceed 60 seconds"},RETRIES:{INTEGER:"Health check retries must be an integer",MIN:"Health check retries must be at least 1",MAX:"Health check retries cannot exceed 10"},START_PERIOD:{INTEGER:"Health check start period must be an integer",MIN:"Health check start period must be at least 0 seconds",MAX:"Health check start period cannot exceed 300 seconds"}},EPHEMERAL_STORAGE:{INTEGER:"Ephemeral storage size must be an integer",MIN:"Ephemeral storage size must be at least 512 MB",MAX:"Ephemeral storage size cannot exceed 10240 MB"},MAX_MESSAGE_SIZE:{INTEGER:"Max message size must be an integer",MIN:"Max message size must be at least 1024 bytes",MAX:"Max message size cannot exceed 262144 bytes (256 KB)"},CAPACITY_CONSTRAINT:{MIN_LTE_MAX:"minCapacity must be less than or equal to maxCapacity"},DIRECT_ACCESS:{NO_DOMAIN:"directAccess cannot be used with domain (no ALB for HTTPS)",NO_LOAD_BALANCER:"directAccess cannot be used with loadBalancer (mutually exclusive)"},GLOBAL_AURORA:{PRIMARY_REGION_REQUIRED:"primaryRegion is required for GlobalAurora databases"},NAT_GATEWAY:{INTEGER:"NAT gateway count must be an integer",MIN:"NAT gateway count must be at least 0",MAX:"NAT gateway count cannot exceed 3"},CIDR_MASK:{INTEGER:"CIDR mask must be an integer",MIN:"CIDR mask must be at least 16",MAX:"CIDR mask cannot exceed 28"},CPU:{INTEGER:"CPU must be an integer",MIN:"CPU must be at least 256 units",MAX:"CPU cannot exceed 4096 units"},KMS:{KEY_REQUIRED:"KMS key ARN is required when using KMS encryption"},READER_INSTANCES:{MAX:"Cannot have more than 15 reader instances",COUNT_OR_INSTANCES:"Cannot specify both 'count' and 'instances' - use one or the other"},GENERATOR_CAPACITY:{MIN:{MIN:"Minimum capacity must be at least 1",MAX:"Minimum capacity cannot exceed 1000"},MAX:{MIN:"Maximum capacity must be at least 1",MAX:"Maximum capacity cannot exceed 1000"}},INSTANCE_TYPE:"Unknown instance type. Common types include: t4g.micro, t4g.small, m5.large",ARCHITECTURE_MISMATCH:"Architecture mismatch between instance type and AMI",ALLOCATED_STORAGE:{INTEGER:"Allocated storage must be an integer",MIN:"Allocated storage must be at least 20 GB",MAX:"Allocated storage cannot exceed 65536 GB"},DLQ:{MAX_RECEIVE_COUNT:{INTEGER:"Max receive count must be an integer",MIN:"Max receive count must be at least 1",MAX:"Max receive count cannot exceed 1000"}},ALARM:{PERCENTAGE:{MIN:"Threshold must be at least 1%",MAX:"Threshold must be at most 100%"},FREE_STORAGE_GIB:{MIN:"Free storage threshold must be at least 1 GiB"}},REGION:"Invalid AWS region",PASCAL_CASE:"Resource name must start with an uppercase letter and contain only alphanumerics (PascalCase).",IMAGE_DOCKER_MUTEX:"image and docker are mutually exclusive",AWS_ACCOUNT_ID:"AWS account id must be exactly 12 digits (no hyphens)",VPC_ID:"VPC id must look like vpc-abc12345",ROLE_ARN:"Role ARN must have the form arn:aws:iam::<account-id>:role/<name>",CIDR:"CIDR must be in dotted-quad/prefix-length form (e.g. 10.0.0.0/16)",VPC_PEER:{MIN_REQUESTER_ACCOUNTS:"At least one requester account id is required",REGION_REQUIRED:"Peer region is required when specified",ROUTE_TABLE_ID_REQUIRED:"Route table id must not be empty"},SCHEDULE_EXPRESSION:"Schedule expression must be 'rate(N minute|minutes|hour|hours|day|days)' with N>=1, or 'cron(<6-field AWS expression>)'"});var IU=Object.defineProperty,gt=(e,t)=>IU(e,"name",{value:t,configurable:!0}),TU=["us-east-2","us-west-2","us-east-1","eu-west-1","eu-central-1","ap-southeast-1"],$U=Object.freeze(TU.flatMap(e=>{let t=Ai(e);return t?[t]:[]})),Qv=Object.freeze(["us-east-2","us-west-2","us-east-1","eu-west-1","ap-southeast-1"]);function Vu(e){return e?e.split(",").map(t=>t.trim()).filter(Boolean):[]}gt(Vu,"parseRegionList");function eb(e){return ar.includes(e)}gt(eb,"isValidRegion");function tb(e){return/^[a-z]{2}-[a-z]+-[1-9]$/.test(e)}gt(tb,"isValidRegionFormat");function rb(e){if(!e)return Qv.slice(0,3);let t=e.toLowerCase().split("-"),n=t[0],i=t.length>1?t[1]:"",r=[];return n&&i&&(r=ar.filter(o=>o.startsWith(`${n}-${i}`))),r.length===0&&n&&(r=ar.filter(o=>o.startsWith(`${n}-`))),r.length>0?r.slice(0,3):Qv.slice(0,3)}gt(rb,"getSuggestions");function nb(e){if(eb(e))return!0;let t=rb(e);return tb(e)?`Unknown region. Try: ${t.join(", ")}`:`Invalid format. Try: ${t.join(", ")}`}gt(nb,"validateRegion");function b$(e){if(!e||e.trim()==="")return!0;let t=Vu(e);for(let n of t){let i=nb(n);if(i!==!0)return i}return!0}gt(b$,"validateRegionList");function ib(e,t){return e.filter(n=>n!==t)}gt(ib,"filterDuplicateRegions");function ob(e){return{label:e.city,value:e.code,description:e.optIn?`${e.code} \u2014 opt-in required`:e.code}}gt(ob,"toRegionOption");function y$(){return mt.map(ob)}gt(y$,"getRegionOptions");function S$(e){return mt.filter(t=>t.code!==e).map(ob)}gt(S$,"getRegionOptionsExcluding");function _$(e){let t=mt.find(n=>n.code===e);return t?t.city:e}gt(_$,"getRegionName");function E$(e){return t=>{let n=Vu(t);return ib(n,e)}}gt(E$,"createRegionFormatter");var Gu="12.0.0";var Zu=["Aurora","Instance","GlobalAurora","ClickHouse"],zi=["FARGATE","FARGATE_SPOT","EC2"],Rt=["standard","resilient","enterprise"],Wu=["tinkerer","lightweight","standard","resilient","enterprise"],ab="custom",Sa=[...Wu,ab];var RU=Object.defineProperty,CU=(e,t)=>RU(e,"name",{value:t,configurable:!0}),VK=Object.freeze({RESOURCE_SUFFIXES:Object.freeze({storage:"Storage",database:"Database",cluster:"Cluster",function:"Function",instance:"Instance",compute:"Compute"})}),_a=["ecs","lambda","ec2"],Li=Object.freeze({ECS:"ecs",LAMBDA:"lambda",EC2:"ec2"}),Hu=["code","container"],Ea=Object.freeze({CODE:"code",CONTAINER:"container"}),Yu=["ARM_64","X86_64"],x$="ARM_64",xa=["NONE","AWS_IAM"],Ku=["public","internal"],qu=["CPU","MEMORY"],Xu=["ARM","STANDARD"],sb=["Instance","Aurora"],Ui=["postgresql","mysql"],Aa=["web","worker"],A$=["foundation","compliance","hardened"];var Ju=["t3.nano","t3.micro","t3.small","t3.medium","t3.large","t3.xlarge","t3.2xlarge","t3a.nano","t3a.micro","t3a.small","t3a.medium","t3a.large","t3a.xlarge","t3a.2xlarge","t4g.nano","t4g.micro","t4g.small","t4g.medium","t4g.large","t4g.xlarge","t4g.2xlarge","c5.large","c5.xlarge","c5.2xlarge","c5.4xlarge","c5.9xlarge","c5.12xlarge","c5.18xlarge","c5.24xlarge","c5a.large","c5a.xlarge","c5a.2xlarge","c5a.4xlarge","c5a.8xlarge","c5a.12xlarge","c5a.16xlarge","c5a.24xlarge","c6g.medium","c6g.large","c6g.xlarge","c6g.2xlarge","c6g.4xlarge","c6g.8xlarge","c6g.12xlarge","c6g.16xlarge","r5.large","r5.xlarge","r5.2xlarge","r5.4xlarge","r5.8xlarge","r5.12xlarge","r5.16xlarge","r5.24xlarge","r5a.large","r5a.xlarge","r5a.2xlarge","r5a.4xlarge","r5a.8xlarge","r5a.12xlarge","r5a.16xlarge","r5a.24xlarge","r6g.medium","r6g.large","r6g.xlarge","r6g.2xlarge","r6g.4xlarge","r6g.8xlarge","r6g.12xlarge","r6g.16xlarge","i3.large","i3.xlarge","i3.2xlarge","i3.4xlarge","i3.8xlarge","i3.16xlarge","p3.2xlarge","p3.8xlarge","p3.16xlarge","g4dn.xlarge","g4dn.2xlarge","g4dn.4xlarge","g4dn.8xlarge","g4dn.12xlarge","g4dn.16xlarge","m5.large","m5.xlarge","m5.2xlarge","m5.4xlarge","m5.8xlarge","m5.12xlarge","m5.16xlarge","m5.24xlarge","m5a.large","m5a.xlarge","m5a.2xlarge","m5a.4xlarge","m5a.8xlarge","m5a.12xlarge","m5a.16xlarge","m5a.24xlarge"],I$=[0,1,5,10,15,30,60];function ht(e,t){return e.includes(t)}CU(ht,"constIncludes");var T$=1,$$=65535,YK=Object.freeze({postgresql:5432,mysql:3306}),R$=128,C$=10240,Qu=1,el=900,cb=1,ub=1e3,Fi=100,P$=100;var N$=3e3;var w$=["GET","POST","PUT","DELETE","HEAD","OPTIONS","PATCH"],k$=["standard","assets","upload","website"],Bi=["AES256","KMS"];var PU=Object.defineProperty,Ia=(e,t)=>PU(e,"name",{value:t,configurable:!0}),qe=Ia(e=>s.union([s.literal(!1),e]),"optionalOrDisabled"),Sn={check:Ia(e=>e.minCapacity!==void 0&&e.maxCapacity!==void 0?e.minCapacity<=e.maxCapacity:!0,"check"),params:{message:m.CAPACITY_CONSTRAINT.MIN_LTE_MAX,path:["maxCapacity"]}},Ta=Ia(e=>s.number().int(m.MEMORY_LIMIT.INTEGER).min(e,e===128?m.MEMORY_LIMIT.MIN_128:m.MEMORY_LIMIT.MIN_512).max(30720,m.MEMORY_LIMIT.MAX),"memoryLimitMiBSchema"),V=s.string().min(1,m.REQUIRED.RESOURCE_NAME).max(63,m.MAX_LENGTH.RESOURCE_NAME).regex(L.RESOURCE_NAME,m.RESOURCE_NAME),D$=s.string().min(1,m.REQUIRED.BUCKET_NAME).max(63,m.MAX_LENGTH.BUCKET_NAME).regex(L.BUCKET_NAME,m.BUCKET_NAME),M$=s.string().min(1,m.REQUIRED.DATABASE_NAME).max(63,m.MAX_LENGTH.DATABASE_NAME).regex(L.DATABASE_NAME,m.DATABASE_NAME);function tl(e,t=L.IDENTIFIER,n=m.IDENTIFIER){return s.string().min(2,m.IDENTIFIER_MIN_LENGTH).max(50,e).regex(t,n).refine(i=>!i.endsWith("-"),{message:m.IDENTIFIER_NO_TRAILING_HYPHEN}).refine(i=>!i.includes("--"),{message:m.IDENTIFIER_NO_CONSECUTIVE_HYPHENS})}Ia(tl,"identifierSchema");var xe=tl(m.MAX_LENGTH.APP_NAME),tq=tl(m.MAX_LENGTH.APP_NAME,L.NEW_APP_NAME,m.NEW_APP_NAME),_n=s.number().int(m.PORT.INTEGER).min(T$,m.PORT.MIN).max($$,m.PORT.MAX),ke=s.object({key:s.string(),sourceText:s.string()}).strict(),NU=s.object({__identifier:s.string()}).strict(),wU=s.object({__expression:s.string()}).strict(),kU=s.object({__call:s.string()}).strict(),OU=s.union([NU,wU,kU]),DU=s.union([s.string(),s.number(),s.boolean(),OU]),Vi=s.record(s.string().regex(L.ENV_VAR_NAME,m.ENV_VAR_NAME),DU),MU=s.object({id:s.string(),name:s.string().optional(),arn:s.string().optional(),field:s.string().optional()}).strict().refine(e=>e.name!==void 0!=(e.arn!==void 0),{message:"secretsImport requires exactly one of `name` or `arn`."}),j$=s.record(s.string(),MU),rq=s.record(s.string(),s.unknown()),lb=s.enum(Sa).describe(`Application type must be one of: ${Sa.join(", ")}`),db=s.enum(Lt).describe(`OpenNext deployment pattern: ${Lt.join(", ")}`),jU=s.enum(["before-imports","after-imports","after-app-init","after-tags","after-resource","end-of-file"]),zU=s.enum(["import","app-init","tags","database","compute","storage","network","messaging","cdn","pattern","vpc-peer","vpc-peer-accepter","cross-plan-connection","custom"]),z$=s.object({sourceText:s.string(),position:jU,afterManagedResource:s.object({type:zU,name:s.string().optional()}).strict().optional(),originalLine:s.number().int().optional(),leadingComments:s.array(s.string()).optional(),orphaned:s.boolean().optional(),orphanedComment:s.string().optional()}).strict(),L$=s.union([s.object({tier:s.enum(Rt)}).strict(),s.literal(!1)]),U$=s.union([s.object({instanceType:s.string().optional()}).strict(),s.literal(!1)]),LU=tl(m.MAX_LENGTH.ORGANISATION_NAME),UU=s.string().regex(L.EMAIL,m.EMAIL),O$=s.string().refine(e=>ar.includes(e),{message:m.REGION}),nq=s.object({name:LU,email:UU,accountName:s.string().optional(),primaryRegion:O$.optional().default(xi),secondaryRegions:s.array(O$).optional(),security:s.enum(A$).optional(),force:s.boolean().optional()}).strict();function $a(e){return e.issues.map(t=>`${t.path.length>0?`${t.path.join(".")}: `:""}${t.message}`).join(`
 `)}Ia($a,"getZodErrorMessage");var Gi=s.number().min(1,m.ALARM.PERCENTAGE.MIN).max(100,m.ALARM.PERCENTAGE.MAX),FU=s.number().min(1,m.ALARM.FREE_STORAGE_GIB.MIN),F$=s.union([s.literal(!1),s.object({cpuThreshold:Gi.optional(),memoryThreshold:Gi.optional(),runningTasksMinimum:s.number().int().min(0).optional(),http5xxThreshold:Gi.optional()}).strict()]),B$=s.union([s.literal(!1),s.object({cpuThreshold:Gi.optional(),freeStorageThresholdGiB:FU.optional(),connectionsThreshold:s.number().int().min(1).optional()}).strict()]),V$=s.union([s.literal(!1),s.object({errorRateThreshold:Gi.optional(),durationThresholdPercent:Gi.optional()}).strict()]);var sr=s.number().int(m.BACKUP_RETENTION.INTEGER).min(1,m.BACKUP_RETENTION.MIN).max(35,m.BACKUP_RETENTION.MAX),Ra=s.number().int(m.MONITORING_INTERVAL.INTEGER).refine(e=>ht(I$,e),{message:m.MONITORING_INTERVAL.VALUES}),nl=s.number().int(m.DATABASE.PORT.INTEGER).min(1024,m.DATABASE.PORT.MIN).max(65535,m.DATABASE.PORT.MAX),BU=s.enum(Zu).describe(`Database type must be one of: ${Zu.join(", ")}`),VU=s.object({maxConnections:s.number().int(m.MAX_CONNECTIONS.INTEGER).min(1,m.MAX_CONNECTIONS.MIN).max(100,m.MAX_CONNECTIONS.MAX).optional(),maxIdleConnections:s.number().int(m.PROXY_CONFIG.MAX_IDLE_CONNECTIONS.INTEGER).min(0,m.PROXY_CONFIG.MAX_IDLE_CONNECTIONS.MIN).max(100,m.PROXY_CONFIG.MAX_IDLE_CONNECTIONS.MAX).optional(),connectionBorrowTimeout:s.number().int(m.PROXY_CONFIG.BORROW_TIMEOUT.INTEGER).min(1,m.PROXY_CONFIG.BORROW_TIMEOUT.MIN).max(3600,m.PROXY_CONFIG.BORROW_TIMEOUT.MAX).optional(),requireTLS:s.boolean().optional()}).strict().describe("RDS Proxy configuration"),GU=s.object({instanceType:s.string().optional(),availabilityZone:s.string().optional()}).strict().describe("Read replica configuration"),ZU=s.object({automaticallyAfterDays:s.number().int(m.ROTATION.INTEGER).min(1,m.ROTATION.MIN).max(365,m.ROTATION.MAX).optional()}).strict().describe("Secret rotation configuration"),il=s.object({username:s.string().min(1,m.REQUIRED.USERNAME).max(63,m.USERNAME.MAX_LENGTH).optional(),secretRotation:ZU.optional()}).strict().describe("Database credentials configuration"),ol=qe(VU),al=qe(GU),WU=s.object({scaleWithWriter:s.boolean().optional(),enableDatabaseInsights:s.boolean().optional(),identifierSuffix:s.string().min(1,m.IDENTIFIER_SUFFIX.REQUIRED).max(50,m.IDENTIFIER_SUFFIX.MAX_LENGTH).optional(),availabilityZone:s.string().optional()}).strict().describe("Configuration for a single Aurora reader instance"),Ca=s.object({enableDatabaseInsights:s.boolean().optional(),identifierSuffix:s.string().min(1,m.IDENTIFIER_SUFFIX.REQUIRED).max(50,m.IDENTIFIER_SUFFIX.MAX_LENGTH).optional(),availabilityZone:s.string().optional()}).strict().describe("Configuration for Aurora writer instance"),HU=s.object({count:s.number().int(m.READER.COUNT.INTEGER).min(0,m.READER.COUNT.MIN).max(15,m.READER.COUNT.MAX).optional(),instances:s.array(WU).max(15,m.READER_INSTANCES.MAX).optional(),defaultEnableDatabaseInsights:s.boolean().optional()}).strict().refine(e=>!(e.count!==void 0&&e.instances!==void 0),{message:m.READER_INSTANCES.COUNT_OR_INSTANCES,path:["count"]}).describe("Aurora readers configuration"),Pa=qe(HU),YU=s.object({awsManaged:s.literal(!0)}).strict(),KU=s.object({useCMK:s.literal(!0)}).strict(),G$=s.union([YU,KU]),qU=s.object({mode:s.enum(["standard","advanced"]).optional(),encryptionKey:G$.optional()}).strict().describe("Database Insights configuration"),sl=qe(qU),cl=s.object({storageKey:G$.optional()}).strict().describe("Encryption configuration (DESTRUCTIVE to change storageKey)"),Z$=s.object({name:V,type:BU,databaseName:s.string().min(1,m.REQUIRED.DATABASE_NAME),instanceType:s.string().optional(),allocatedStorage:s.number().optional(),multiAz:s.boolean().optional(),publiclyAccessible:s.boolean().optional(),databaseInsights:sl.optional(),port:nl.optional(),deletionProtection:s.boolean().optional(),proxy:ol.optional(),credentials:il.optional(),readReplica:al.optional(),encryption:cl.optional(),writer:Ca.optional(),readers:Pa.optional(),backupRetention:sr.optional(),preferredMaintenanceWindow:s.string().optional(),monitoringInterval:Ra.optional(),primaryRegion:s.string().optional(),secondaryRegions:s.array(s.string()).optional(),globalClusterIdentifier:s.string().optional(),enableGlobalWriteForwarding:s.boolean().optional(),snapshotIdentifier:s.string().optional(),snapshotUsername:s.string().optional(),databaseEngine:s.enum(Ui).optional(),engineExpression:s.string().optional(),variableName:s.string().optional(),extraProperties:s.array(ke).optional(),alarms:B$.optional()}).strict(),ul=s.object({appName:xe,nameProvidedByFlag:s.boolean().optional(),databaseName:s.string().min(1,m.REQUIRED.DATABASE_NAME).max(63,m.MAX_LENGTH.DATABASE_NAME).regex(L.DATABASE_NAME,m.DATABASE_NAME),resourceName:V.optional(),connectionConfig:s.object({connectToCompute:s.array(s.string()).optional(),connectToServices:s.array(s.string()).optional()}).strict().optional(),databaseInsights:sl.optional(),port:nl.optional(),proxy:ol.optional(),credentials:il.optional(),encryption:cl.optional(),deletionProtection:s.boolean().optional()}).strict(),W$={databaseType:s.literal("Instance"),instanceType:s.string().optional(),multiAz:s.boolean().optional(),readReplica:al.optional(),publiclyAccessible:s.boolean().optional(),backupRetention:sr.optional(),allocatedStorage:s.number().optional(),snapshotIdentifier:s.string().optional(),snapshotUsername:s.string().optional()},H$={databaseType:s.literal("Aurora"),writer:Ca.optional(),readers:Pa.optional(),backupRetention:sr.optional(),preferredMaintenanceWindow:s.string().optional(),monitoringInterval:Ra.optional(),snapshotIdentifier:s.string().optional(),snapshotUsername:s.string().optional()},Y$={databaseType:s.literal("GlobalAurora"),primaryRegion:s.string().min(1,m.GLOBAL_AURORA.PRIMARY_REGION_REQUIRED),secondaryRegions:s.array(s.string()).optional(),globalClusterIdentifier:s.string().optional(),enableGlobalWriteForwarding:s.boolean().optional(),writer:Ca.optional(),readers:Pa.optional(),backupRetention:sr.optional(),preferredMaintenanceWindow:s.string().optional(),monitoringInterval:Ra.optional(),snapshotIdentifier:s.string().optional(),snapshotUsername:s.string().optional()},K$=s.object({appName:xe,nameProvidedByFlag:s.boolean().optional(),databaseName:s.string().min(1,m.REQUIRED.DATABASE_NAME).max(63,m.MAX_LENGTH.DATABASE_NAME).regex(L.DATABASE_NAME,m.DATABASE_NAME),resourceName:V.optional(),connectionConfig:s.object({connectToCompute:s.array(s.string()).optional(),connectToServices:s.array(s.string()).optional()}).strict().optional()}).strict(),q$={databaseType:s.literal("ClickHouse"),instanceType:s.string().optional(),coldTier:s.union([s.object({mode:s.literal("s3")}).strict(),s.literal(!1)]).optional(),optimiseSchedule:s.union([s.string(),s.literal(!1)]).optional(),backupSchedule:s.union([s.string(),s.literal(!1)]).optional(),backupRetentionDays:sr.optional()},XU=ul.extend(W$).strict(),JU=ul.extend(H$).strict(),QU=ul.extend(Y$).strict(),e4=K$.extend(q$).strict(),X$=s.discriminatedUnion("databaseType",[XU,JU,QU,e4]),mb=ul.extend({resourceName:V}).strict(),t4=mb.extend(W$).strict(),r4=mb.extend(H$).strict(),n4=mb.extend(Y$).strict(),i4=K$.extend({resourceName:V}).strict(),o4=i4.extend(q$).strict(),pq=s.discriminatedUnion("databaseType",[t4,r4,n4,o4]),fq=s.object({appName:xe,databaseName:s.string().min(1,m.REQUIRED.DATABASE_NAME),maxConnections:s.number().int(m.MAX_CONNECTIONS.INTEGER).min(1,m.MAX_CONNECTIONS.MIN).max(100,m.MAX_CONNECTIONS.MAX).optional(),maxIdleConnections:s.number().int(m.PROXY_CONFIG.MAX_IDLE_CONNECTIONS.INTEGER).min(0,m.PROXY_CONFIG.MAX_IDLE_CONNECTIONS.MIN).max(100,m.PROXY_CONFIG.MAX_IDLE_CONNECTIONS.MAX).optional(),connectionBorrowTimeout:s.number().int(m.PROXY_CONFIG.BORROW_TIMEOUT.INTEGER).min(1,m.PROXY_CONFIG.BORROW_TIMEOUT.MIN).max(3600,m.PROXY_CONFIG.BORROW_TIMEOUT.MAX).optional(),requireTLS:s.boolean().optional(),nameProvidedByFlag:s.boolean().optional()}).strict(),a4=["S","N","B"],rl=s.object({name:s.string(),type:s.enum(a4)}).strict(),J$=s.object({name:V,partitionKey:rl,sortKey:rl.optional(),globalSecondaryIndexes:s.array(s.object({indexName:s.string(),partitionKey:rl,sortKey:rl.optional()}).strict()).optional(),ttlAttribute:s.string().optional(),stream:s.boolean().optional(),variableName:s.string().optional(),extraProperties:s.array(ke).optional()}).strict(),s4=s.object({mode:s.literal("s3")}).strict(),Q$=s.object({name:V,type:s.literal("ClickHouse"),databaseName:M$,instanceType:s.string().optional(),coldTier:s.union([s4,s.literal(!1)]).optional(),optimiseSchedule:s.union([s.string(),s.literal(!1)]).optional(),backupSchedule:s.union([s.string(),s.literal(!1)]).optional(),backupRetentionDays:sr.optional(),variableName:s.string().optional(),extraProperties:s.array(ke).optional()}).strict();var c4=s.object({count:s.number().int(m.NAT_GATEWAY.INTEGER).min(0,m.NAT_GATEWAY.MIN).max(3,m.NAT_GATEWAY.MAX).optional()}).strict().describe("NAT gateway configuration"),eR=qe(c4),pb=s.enum(["cloudwatch","s3"]),u4=s.object({destination:pb.optional(),retentionDays:s.number().int(m.RETENTION_DAYS.INTEGER).min(1,m.RETENTION_DAYS.MIN).max(365,m.RETENTION_DAYS.MAX).optional(),trafficType:s.enum(["ALL","ACCEPT","REJECT"]).optional()}).strict().describe("VPC flow log configuration"),tR=qe(u4),l4=s.object({s3:s.boolean().optional(),dynamodb:s.boolean().optional()}).strict().describe("Gateway VPC endpoints (FREE)"),d4=qe(l4),m4=s.object({ecr:s.boolean().optional(),secretsManager:s.boolean().optional(),kms:s.boolean().optional(),cloudwatchLogs:s.boolean().optional(),ssm:s.boolean().optional(),sts:s.boolean().optional()}).strict().describe("Interface VPC endpoints (cost per hour)"),p4=qe(m4),f4=s.object({gateway:d4.optional(),interface:p4.optional()}).strict().describe("VPC endpoints configuration"),rR=qe(f4),ll=s.object({maxAzs:s.number().int(m.MAX_AZS.INTEGER).min(1,m.MAX_AZS.MIN).max(3,m.MAX_AZS.MAX).optional(),natGateways:eR.optional(),flowLogs:tR.optional(),vpcEndpoints:rR.optional(),cidrMask:s.number().int(m.CIDR_MASK.INTEGER).min(16,m.CIDR_MASK.MIN).max(28,m.CIDR_MASK.MAX).optional()}).strict(),nR=s.string().min(1,m.REQUIRED.NETWORK_NAME).max(50,m.MAX_LENGTH.NETWORK_NAME).regex(L.RESOURCE_NAME,m.RESOURCE_NAME),iR=ll.extend({name:nR}).strict(),oR=qe(ll),yq=s.object({appName:xe,networkName:nR.optional(),maxAzs:s.number().int(m.MAX_AZS.INTEGER).min(1,m.MAX_AZS.MIN).max(3,m.MAX_AZS.MAX).optional(),natGateways:eR.optional(),flowLogs:tR.optional(),vpcEndpoints:rR.optional()}).strict(),g4=L.CIDR,fb=s.string().regex(g4,m.CIDR),h4=s.object({kind:s.literal("database"),resource:s.string().min(1,m.REQUIRED.RESOURCE_REFERENCE),name:V,allowedFromCidrs:s.array(fb),access:s.enum(["read","write","readWrite"]).optional()}).strict(),v4=s.object({kind:s.literal("ecsService"),resource:s.string().min(1,m.REQUIRED.RESOURCE_REFERENCE),serviceName:s.string().min(1,m.REQUIRED.SERVICE_NAME),name:V,allowedFromCidrs:s.array(fb),port:_n.optional()}).strict(),b4=s.discriminatedUnion("kind",[h4,v4]),Sq=s.object({name:V,peerAppName:s.string().min(1,m.REQUIRED.APP_NAME),peerAccountId:s.string().regex(L.AWS_ACCOUNT_ID,m.AWS_ACCOUNT_ID),peerRegion:s.string().min(1,m.VPC_PEER.REGION_REQUIRED).optional(),peerVpcId:s.string().regex(L.VPC_ID,m.VPC_ID).optional(),peerVpcCidr:fb.optional(),peerRoleArn:s.string().regex(L.ROLE_ARN,m.ROLE_ARN).optional(),peerRouteTableIds:s.array(s.string().min(1,m.VPC_PEER.ROUTE_TABLE_ID_REQUIRED)).optional(),localVpcName:s.string().min(1,m.REQUIRED.NETWORK_NAME).optional(),enableDnsResolution:s.boolean().optional()}).strict(),_q=s.object({name:V,requesterAccountIds:s.array(s.string().regex(L.AWS_ACCOUNT_ID,m.AWS_ACCOUNT_ID)).min(1,m.VPC_PEER.MIN_REQUESTER_ACCOUNTS),localVpcName:s.string().min(1,m.REQUIRED.NETWORK_NAME).optional(),publishToSsm:s.boolean().optional(),exposedResources:s.array(b4).optional()}).strict();var dl=["storage","cdn","compute"],y4=s.object({sid:s.string().optional(),effect:s.enum(["Allow","Deny"]),principals:s.array(s.string()),actions:s.array(s.string()),resources:s.array(s.string()).optional(),conditions:s.record(s.string(),s.record(s.string(),s.union([s.string(),s.array(s.string())]))).optional()}).strict(),aR=s.object({name:V,bucketName:s.string().optional(),publicReadAccess:s.boolean().optional(),websiteHosting:s.object({indexDocument:s.string(),errorDocument:s.string().optional()}).strict().optional(),backupVaultTier:s.enum(Rt).optional(),versioned:s.boolean().optional(),encryption:s.enum(Bi).optional(),kmsKeyArn:s.string().optional(),cors:s.array(s.object({allowedOrigins:s.array(s.string()),allowedMethods:s.array(s.string()),allowedHeaders:s.array(s.string()).optional(),exposedHeaders:s.array(s.string()).optional(),maxAge:s.number().optional()}).strict()).optional(),deployment:s.object({source:s.string(),prune:s.boolean().optional(),cacheControl:s.object({maxAge:s.number().optional(),immutable:s.boolean().optional()}).strict().optional()}).strict().optional(),retain:s.boolean().optional(),resourcePolicyStatements:s.array(y4).optional(),stackPlacement:s.enum(dl).optional(),variableName:s.string().optional(),extraProperties:s.array(ke).optional()}).strict().refine(e=>e.encryption!=="KMS"||!!e.kmsKeyArn,{message:m.KMS.KEY_REQUIRED}),$q=s.object({appName:xe,bucketName:D$,nameProvidedByFlag:s.boolean().optional(),storagePreset:s.enum(k$).optional(),publicReadAccess:s.boolean().optional(),websiteHosting:s.object({indexDocument:s.string(),errorDocument:s.string().optional()}).strict().optional(),backupVaultTier:s.enum(Rt).optional(),versioned:s.boolean().optional(),encryption:s.enum(Bi).optional(),kmsKeyArn:s.string().optional(),cors:s.array(s.object({allowedOrigins:s.array(s.string()),allowedMethods:s.array(s.string()),allowedHeaders:s.array(s.string()).optional(),exposedHeaders:s.array(s.string()).optional(),maxAge:s.number().optional()}).strict()).optional(),connectionConfig:s.object({connectToCompute:s.array(s.string()).optional(),connectToServices:s.array(s.string()).optional()}).strict().optional()}).strict().refine(e=>e.encryption!=="KMS"||!!e.kmsKeyArn,{message:m.KMS.KEY_REQUIRED,path:["kmsKeyArn"]});var gb=s.enum(["DESTROY","RETAIN"]),sR=s.object({name:V,queueType:s.enum(["standard","fifo"]).default("standard"),visibilityTimeout:s.number().int(m.SQS.VISIBILITY_TIMEOUT.INTEGER).min(0,m.SQS.VISIBILITY_TIMEOUT.MIN).max(43200,m.SQS.VISIBILITY_TIMEOUT.MAX).optional(),retentionPeriod:s.number().int(m.SQS.RETENTION_PERIOD.INTEGER).min(60,m.SQS.RETENTION_PERIOD.MIN).max(1209600,m.SQS.RETENTION_PERIOD.MAX).optional(),contentBasedDeduplication:s.boolean().optional(),removalPolicy:gb.optional(),variableName:s.string().optional(),extraProperties:s.array(ke).optional()}).strict();var cR=s.object({type:s.literal("basic-auth"),username:s.string().min(1),password:s.string().min(1)}).strict(),uR=s.object({name:V,defaultOriginRef:s.string(),behaviours:s.array(s.object({pathPattern:s.string(),originRef:s.string(),cachePolicy:s.enum(["CACHING_OPTIMIZED","CACHING_DISABLED"]).optional()}).strict()).optional(),customDomain:s.string().optional(),certificateArn:s.string().optional(),accessGate:s.union([s.literal(!1),cR]).optional(),extraProperties:s.array(ke).optional()}).strict(),Dq=s.object({appName:s.string(),name:V.optional(),defaultOriginRef:s.string(),behaviours:s.array(s.object({pathPattern:s.string(),originRef:s.string(),cachePolicy:s.enum(["CACHING_OPTIMIZED","CACHING_DISABLED"]).optional()}).strict()).optional(),customDomain:s.string().optional(),certificateArn:s.string().optional(),accessGate:s.union([s.literal(!1),cR]).optional(),nameProvidedByFlag:s.boolean().optional()}).strict();var S4=Object.defineProperty,hb=(e,t)=>S4(e,"name",{value:t,configurable:!0}),_4=new Set(["t4g","c6g","c6gd","c6gn","c7g","c7gd","c7gn","r6g","r6gd","r7g","r7gd","r8g","r8gd","c8g","c8gd","c8gn","m6g","m6gd","m7g","m7gd","m8g","m8gd","x8g","i8g","a1","x2gd","im4gn","is4gen","i4g","hpc7g"]);function Zi(e){let t=e.split(".")[0]??"";return _4.has(t)?"ARM":"STANDARD"}hb(Zi,"getArchitectureForInstanceType");function ml(e,t){let n=Zi(e);return n!==t?{valid:!1,message:`Instance type '${e}' requires ${n} architecture, but '${t}' AMI was specified. Use a ${n==="ARM"?"Graviton instance (t4g, c6g, r6g, m6g, etc.)":"Intel/AMD instance (t3, c5, r5, m5, etc.)"} instead.`}:{valid:!0}}hb(ml,"validateArchitectureMatch");function lR(e,t){return Zi(e)===t}hb(lR,"isArchitectureCompatible");var E4=Object.defineProperty,pl=(e,t)=>E4(e,"name",{value:t,configurable:!0});var x4=1;var A4=/^[A-Za-z0-9_.-]+$/,I4=s.object({id:s.string().min(1,"buildSecret id cannot be empty").regex(A4,"buildSecret id may contain only letters, digits, '_', '.', and '-' (no comma, '=', or whitespace, which would break the buildx --secret argv)"),ssm:s.string().min(1,"ssm parameter name cannot be empty").optional(),secretsManager:s.object({name:s.string().min(1,"secret name cannot be empty").optional(),arn:s.string().min(1,"secret arn cannot be empty").optional(),field:s.string().min(1,"secret field cannot be empty").optional()}).strict().refine(e=>e.name===void 0!=(e.arn===void 0),"secretsManager requires exactly one of name or arn").optional(),env:s.string().min(1,"env variable name cannot be empty").optional()}).strict().superRefine((e,t)=>{[e.ssm,e.secretsManager,e.env].filter(n=>n!==void 0).length!==1&&t.addIssue({code:s.ZodIssueCode.custom,message:"buildSecret requires exactly one source (ssm, secretsManager, or env)"})}),T4=s.union([s.string(),s.object({ssm:s.string().min(1,"ssm parameter name cannot be empty").optional(),secretsManager:s.object({name:s.string().min(1,"secret name cannot be empty").optional(),arn:s.string().min(1,"secret arn cannot be empty").optional(),field:s.string().min(1,"secret field cannot be empty").optional()}).strict().refine(e=>e.name===void 0!=(e.arn===void 0),"secretsManager requires exactly one of name or arn").optional(),env:s.string().min(1,"env variable name cannot be empty").optional(),acknowledgePublic:s.boolean().optional()}).strict().superRefine((e,t)=>{[e.ssm,e.secretsManager,e.env].filter(n=>n!==void 0).length!==1&&t.addIssue({code:s.ZodIssueCode.custom,message:"buildArg value requires exactly one source (ssm, secretsManager, or env)"})})]),Ft=s.object({path:s.string(),context:s.string().min(1,"context cannot be empty").optional(),target:s.string().min(1,"target cannot be empty").optional(),buildArgs:s.record(s.string(),T4).optional(),buildSecrets:s.array(I4).optional()}).strict(),Uq=Ft.partial();function $4(e,t){if(t===void 0)return e;let n=t.context??e.context,i=t.target??e.target,r=t.buildArgs??e.buildArgs,o=t.buildSecrets??e.buildSecrets;return{path:t.path??e.path,...n!==void 0&&{context:n},...i!==void 0&&{target:i},...r!==void 0&&{buildArgs:r},...o!==void 0&&{buildSecrets:o}}}pl($4,"mergeDockerBuild");function vb(e){return typeof e=="object"&&e!==null&&!Array.isArray(e)}pl(vb,"isRecord");function dR(e){if(!vb(e)||typeof e.path!="string"||e.path.length===0)return;let t=typeof e.context=="string"&&e.context.length>0?e.context:void 0,n=typeof e.target=="string"&&e.target.length>0?e.target:void 0,i=vb(e.buildArgs)&&Object.keys(e.buildArgs).length>0?e.buildArgs:void 0,r=Array.isArray(e.buildSecrets)&&e.buildSecrets.length>0?e.buildSecrets:void 0,o={path:e.path,...t!==void 0&&{context:t},...n!==void 0&&{target:n},...i!==void 0&&{buildArgs:i},...r!==void 0&&{buildSecrets:r}},a=Ft.safeParse(o);return a.success?a.data:void 0}pl(dR,"normaliseDockerBuild");function R4(e){if(e===void 0)return;let t=dR(e);return t===void 0?void 0:JSON.stringify(t)}pl(R4,"dockerBuildFingerprint");var C4=s.object({name:s.string(),clusterName:s.string().optional(),docker:Ft.optional(),containerPort:s.number().optional(),secrets:s.array(s.string()).optional(),ssmSecretsPath:s.string().optional(),importedSecretNames:s.array(s.string()).optional(),schemaGateImageTag:s.string().optional()}).strict(),P4=s.object({type:s.enum(Lt),name:s.string(),source:s.string()}).strict(),N4=s.object({repositoryName:s.string()}).strict(),w4=["x86_64","arm64"],k4=s.object({name:s.string(),secrets:s.array(s.string()).optional(),ssmSecretsPath:s.string().optional(),importedSecretNames:s.array(s.string()).optional(),docker:Ft.optional(),imageKey:s.string().optional(),architecture:s.enum(w4).optional()}).strict(),O4=s.object({templateHash:s.string(),synthTimestamp:s.string()}).strict(),D4=s.object({constructPath:s.string().max(512),group:s.string().max(128),resourceType:s.string().max(256)}).strict(),M4=s.object({synthesisedBy:s.string().min(1).max(128),minimumEngineVersion:s.string().min(1).max(32),maximumEngineMajor:s.number().int().min(0).optional(),minimumAwsCdkCli:s.string().min(1).max(32).optional()}).strict(),j4=s.object({appName:s.string().min(1).max(128),slot:s.string().min(1).max(64),clusterName:s.string().min(1).max(128),anchor:s.string().min(1).max(128),pinned:s.boolean(),currentServiceName:s.string().min(1).max(256),legacyKey:s.string().min(1).max(256),legacyAnchor:s.string().min(1).max(256),legacyServiceName:s.string().min(1).max(512),legacyKeyFields:s.array(s.string().max(64)).max(32)}).strict(),z4=s.object({constructPath:s.string().min(1).max(512),resourceType:s.string().min(1).max(256),physicalNameHint:s.string().min(1).max(512),policy:s.enum(["retain","snapshot","adopted"]),destroyDisposition:s.enum(["survives","deleted-on-explicit-destroy"]),reason:s.string().min(1).max(1024),costClass:s.enum(["none","storage","fixed-monthly"]),cleanupHint:s.string().min(1).max(1024)}).strict(),Fq=s.object({version:s.literal(x4),generatedAt:s.string(),appName:s.string(),services:s.array(C4),lambdas:s.array(k4),pattern:P4.optional(),ecr:N4.optional(),stacks:s.record(s.string(),O4),resourceMap:s.record(s.string(),D4).optional(),engineCompat:M4.optional(),identityAliases:s.array(j4).optional(),residuals:s.array(z4).optional()}).strict();var L4=Object.defineProperty,U4=(e,t)=>L4(e,"name",{value:t,configurable:!0});function pR(e){return!(e.image!==void 0&&e.docker!==void 0)}U4(pR,"imageDockerMutexCheck");var fR=s.number().int(m.CAPACITY.MIN.INTEGER).min(cb,m.GENERATOR_CAPACITY.MIN.MIN).max(ub,m.GENERATOR_CAPACITY.MIN.MAX),gR=s.number().int(m.CAPACITY.MAX.INTEGER).min(cb,m.GENERATOR_CAPACITY.MAX.MIN).max(ub,m.GENERATOR_CAPACITY.MAX.MAX),Wi=s.number().int(m.LAMBDA.MEMORY.INTEGER).min(R$,m.LAMBDA.MEMORY.MIN).max(C$,m.LAMBDA.MEMORY.MAX).refine(e=>e===128||e%64===0,m.LAMBDA.MEMORY.MULTIPLE),hR=s.string().regex(L.LAMBDA_RUNTIME_IDENTIFIER,m.LAMBDA.RUNTIME),bb=s.number().int(m.CPU.INTEGER).min(256,m.CPU.MIN).max(4096,m.CPU.MAX),gl=s.number().int(m.CAPACITY.DESIRED.INTEGER).min(0,m.CAPACITY.DESIRED.MIN).max(Fi,m.CAPACITY.DESIRED.MAX),Na=s.object({connectToDatabase:s.array(s.string()).optional()}).strict(),F4=s.object({minSize:s.number().int(m.CAPACITY.WARM_POOL.MIN_SIZE.INTEGER).min(0,m.CAPACITY.WARM_POOL.MIN_SIZE.MIN).max(P$,m.CAPACITY.WARM_POOL.MIN_SIZE.MAX).optional(),reuseOnScaleIn:s.boolean().optional()}).strict(),yb=s.object({instanceType:s.string().optional(),amiHardwareType:s.enum(Xu).optional(),minCapacity:s.number().int(m.CAPACITY.MIN.INTEGER).min(0,m.CAPACITY.MIN.MIN_0).max(Fi,m.CAPACITY.MIN.MAX).optional(),maxCapacity:s.number().int(m.CAPACITY.MAX.INTEGER).min(1,m.CAPACITY.MAX.MIN_1).max(Fi,m.CAPACITY.MAX.MAX).optional(),memoryLimitMiB:Ta(128).optional(),warmPool:F4.optional(),extraProperties:s.array(ke).optional()}).strict().superRefine((e,t)=>{if(!e.instanceType||!e.amiHardwareType)return;let n=ml(e.instanceType,e.amiHardwareType);n.valid||t.addIssue({code:"custom",message:n.message??m.ARCHITECTURE_MISMATCH,path:["instanceType"]})}).superRefine((e,t)=>{e.minCapacity===0&&!e.warmPool&&t.addIssue({code:"custom",message:m.CAPACITY.WARM_POOL_REQUIRED,path:["minCapacity"]}),e.warmPool?.minSize!==void 0&&e.maxCapacity!==void 0&&e.warmPool.minSize>e.maxCapacity&&t.addIssue({code:"custom",message:m.CAPACITY.WARM_POOL.MIN_SIZE_EXCEEDS_MAX_CAPACITY,path:["warmPool","minSize"]})}),B4=s.enum(_a).describe(`Compute type must be one of: ${_a.join(", ")}`),Sb=s.enum(zi).describe(`ECS capacity provider must be one of: ${zi.join(", ")}`),_b=s.string().refine(e=>ht(Ju,e),{message:m.INSTANCE_TYPE}),vR=s.object({sourceType:s.enum(["sqs","dynamodb","eventbridge"]),sourceRef:s.string().describe("Name of the source resource"),batchSize:s.number().int(m.BATCH_SIZE.INTEGER).min(1,m.BATCH_SIZE.MIN).max(1e4,m.BATCH_SIZE.MAX).optional(),startingPosition:s.enum(["TRIM_HORIZON","LATEST"]).optional(),maxBatchingWindow:s.number().int(m.BATCHING_WINDOW.INTEGER).min(0,m.BATCHING_WINDOW.MIN).max(300,m.BATCHING_WINDOW.MAX).optional(),reportBatchItemFailures:s.boolean().optional()}).strict(),V4=s.object({name:s.string().min(1,m.REQUIRED.CONTAINER_NAME).optional(),image:s.string().optional(),port:_n.optional(),environment:Vi.optional(),secretsImport:j$.optional(),command:s.array(s.string()).optional(),entryPoint:s.array(s.string()).optional(),essential:s.boolean().optional(),healthCheck:s.object({command:s.array(s.string()),interval:s.number().int(m.HEALTH_CHECK.INTERVAL.INTEGER).min(5,m.HEALTH_CHECK.INTERVAL.MIN).max(300,m.HEALTH_CHECK.INTERVAL.MAX).optional(),timeout:s.number().int(m.HEALTH_CHECK.TIMEOUT.INTEGER).min(2,m.HEALTH_CHECK.TIMEOUT.MIN).max(60,m.HEALTH_CHECK.TIMEOUT.MAX).optional(),retries:s.number().int(m.HEALTH_CHECK.RETRIES.INTEGER).min(1,m.HEALTH_CHECK.RETRIES.MIN).max(10,m.HEALTH_CHECK.RETRIES.MAX).optional(),startPeriod:s.number().int(m.HEALTH_CHECK.START_PERIOD.INTEGER).min(0,m.HEALTH_CHECK.START_PERIOD.MIN).max(300,m.HEALTH_CHECK.START_PERIOD.MAX).optional()}).strict().optional(),ssmSecrets:s.array(s.string().regex(L.SECRET_NAME,m.SECRET_NAME)).optional(),extraProperties:s.array(ke).optional()}).strict(),bR=s.string().min(1,m.REQUIRED.SERVICE_NAME).max(255,m.MAX_LENGTH.SERVICE_NAME).regex(L.ECS_SERVICE_NAME,m.ECS_SERVICE_NAME),yR=s.object({domain:s.string().optional(),loadBalancer:s.union([s.literal(!1),s.enum(Ku)]).optional(),directAccess:s.boolean().optional(),extraProperties:s.array(ke).optional()}).strict().refine(e=>!(e.directAccess&&e.domain),{message:m.DIRECT_ACCESS.NO_DOMAIN,path:["directAccess"]}).refine(e=>!(e.directAccess&&typeof e.loadBalancer=="string"),{message:m.DIRECT_ACCESS.NO_LOAD_BALANCER}).describe("Cluster-level configuration"),fl=s.object({path:s.string().optional(),host:s.string().optional(),priority:s.number().int(m.PRIORITY.INTEGER).min(1,m.PRIORITY.MIN).max(5e4,m.PRIORITY.MAX).optional(),healthCheckPath:s.string().optional()}).strict().describe("Path/host-based routing configuration"),G4=s.object({desiredCount:gl.optional(),minCapacity:s.number().int(m.CAPACITY.MIN.INTEGER).min(0,m.CAPACITY.MIN.MIN_0).max(Fi,m.CAPACITY.MIN.MAX).optional(),maxCapacity:s.number().int(m.CAPACITY.MAX.INTEGER).min(1,m.CAPACITY.MAX.MIN_1).max(Fi,m.CAPACITY.MAX.MAX).optional(),scalingType:s.enum(qu).optional()}).strict().refine(Sn.check,Sn.params).describe("ECS service scaling configuration"),SR=s.object({name:bR,docker:Ft.optional(),needsDatabaseConnection:s.boolean().optional(),needsStorageConnection:s.boolean().optional(),needsMessagingConnection:s.boolean().optional(),image:s.string().optional(),containers:s.array(V4).optional(),routing:s.union([fl,s.array(fl).min(1)]).optional(),serviceType:s.enum(Aa).optional(),cpu:bb.optional(),memoryLimitMiB:Ta(512).optional(),desiredCount:gl.optional(),scaling:qe(G4).optional(),capacityProvider:Sb,ec2Config:yb.optional(),ssmSecretsPath:s.string().regex(L.SSM_PATH,m.SSM_PATH).optional(),extraProperties:s.array(ke).optional(),alarms:F$.optional()}).strict().superRefine((e,t)=>{pR(e)||t.addIssue({code:"custom",path:["docker"],message:m.IMAGE_DOCKER_MUTEX})}).describe("Configuration for a service in an ECS cluster"),_R=s.object({name:V,type:B4,needsConnection:s.boolean(),connectedDatabase:s.array(s.string()).optional(),connectedStorage:s.array(s.string()).optional(),connectedMessaging:s.array(s.string()).optional(),cluster:yR.optional(),services:s.array(SR).optional(),docker:Ft.partial().optional(),deployment:s.enum(Hu).optional(),codePath:s.string().optional(),timeout:s.number().int(m.LAMBDA.TIMEOUT.INTEGER).min(Qu,m.LAMBDA.TIMEOUT.MIN).max(el,m.LAMBDA.TIMEOUT.MAX).optional(),memory:Wi.optional(),handler:s.string().optional(),runtime:hR.optional(),environment:Vi.optional(),secrets:Vi.optional(),eventSources:s.array(vR).optional(),functionUrl:s.object({authType:s.enum(xa)}).strict().optional(),description:s.string().optional(),scheduleExpression:s.string().optional(),architecture:s.enum(Yu).optional(),ephemeralStorageSize:s.number().int(m.EPHEMERAL_STORAGE.INTEGER).min(512,m.EPHEMERAL_STORAGE.MIN).max(10240,m.EPHEMERAL_STORAGE.MAX).optional(),functionName:s.string().optional(),ssmSecrets:s.array(s.string()).optional(),ssmSecretsPath:s.string().optional(),alarms:V$.optional(),instanceType:_b.optional(),enableSSH:s.boolean().optional(),keyName:s.string().optional(),userData:s.string().optional(),securityGroups:s.array(s.string()).optional(),variableName:s.string().optional(),extraProperties:s.array(ke).optional()}).strict().superRefine((e,t)=>{if(e.type==="ecs"&&e.services)for(let n=0;n<e.services.length;n++){let i=e.services[n];i?.ec2Config?.instanceType&&!i.ec2Config.amiHardwareType&&Zi(i.ec2Config.instanceType)!=="ARM"&&t.addIssue({code:"custom",message:`Service '${i.name??n}' uses instance type '${i.ec2Config.instanceType}' (x86), which requires Docker images built for linux/amd64. The default build targets linux/arm64 (Graviton). Use a Graviton instance type (t4g, c6g, r6g, m6g, etc.) or set amiHardwareType: "STANDARD" to acknowledge x86.`,path:["services",n,"ec2Config","instanceType"]})}e.type==="lambda"&&e.deployment==="container"&&e.architecture==="X86_64"&&t.addIssue({code:"custom",message:"Lambda architecture 'X86_64' requires Docker images built for linux/amd64, but the default build targets linux/arm64. Use 'ARM_64' for Graviton Lambdas (recommended) or ensure your build pipeline targets linux/amd64.",path:["architecture"]})}),qq=s.object({appName:xe,clusterName:V,containerPort:_n,nameProvidedByFlag:s.boolean().optional(),ecrRepository:s.string().optional(),capacityProvider:Sb.optional(),useAppEcr:s.boolean().optional(),desiredCount:gl.optional(),cpu:bb.optional(),memoryLimitMiB:Ta(512).optional(),minCapacity:fR.optional(),maxCapacity:gR.optional(),ec2Config:yb.optional(),connectionConfig:Na.optional()}).strict().refine(Sn.check,Sn.params),Xq=s.object({appName:xe,functionName:V,nameProvidedByFlag:s.boolean().optional(),lambdaType:s.enum(["basic","web","custom"]).optional(),ecrRepository:s.string().optional(),timeout:s.number().int(m.LAMBDA.TIMEOUT.INTEGER).min(Qu,m.LAMBDA.TIMEOUT.MIN).max(el,m.LAMBDA.TIMEOUT.MAX).optional(),memory:Wi.optional(),enableFunctionUrl:s.boolean().optional(),description:s.string().optional(),enableCors:s.boolean().optional(),corsOrigins:s.string().optional(),corsHeaders:s.string().optional(),corsMethods:s.array(s.enum(w$)).optional(),corsCredentials:s.boolean().optional(),connectionConfig:Na.optional()}).strict(),Jq=s.object({appName:xe,instanceName:V,nameProvidedByFlag:s.boolean().optional(),instanceType:_b.optional(),enableSSH:s.boolean().optional(),minCapacity:fR.optional(),maxCapacity:gR.optional(),connectionConfig:Na.optional()}).strict().refine(Sn.check,Sn.params),Qq=s.object({appName:xe,clusterName:V,serviceName:bR,capacityProvider:Sb,containerPort:_n.optional(),cpu:bb.optional(),memoryLimitMiB:Ta(512).optional(),desiredCount:gl.optional(),ec2Config:yb.optional(),routing:s.union([fl,s.array(fl).min(1)]).optional(),docker:Ft.partial().optional(),nameProvidedByFlag:s.boolean().optional(),connectionConfig:Na.optional()}).strict(),Eb=s.object({appName:xe,computeName:V,nameProvidedByFlag:s.boolean().optional(),connectionConfig:Na.optional()}).strict(),Z4=Eb.extend({type:s.literal("ecs"),cluster:yR.optional(),services:s.array(SR).min(1,m.SERVICE.MIN_REQUIRED),docker:Ft.partial().optional()}).strict().refine(e=>{let t=e.services.filter(n=>n.containers?.some(i=>i.port));return t.length>1?t.every(n=>(Array.isArray(n.routing)?n.routing:n.routing?[n.routing]:[]).some(i=>i.path||i.host)):!0},{message:m.SERVICE.ROUTING_REQUIRED}).refine(e=>{let t=e.services.map(n=>n.name);return new Set(t).size===t.length},{message:m.SERVICE.UNIQUE_WITHIN_CLUSTER}),W4=Eb.extend({type:s.literal("lambda"),timeout:s.number().int(m.LAMBDA.TIMEOUT.INTEGER).min(Qu,m.LAMBDA.TIMEOUT.MIN).max(el,m.LAMBDA.TIMEOUT.MAX).optional(),memory:Wi.optional(),handler:s.string().optional(),runtime:hR.optional(),environment:Vi.optional(),secrets:Vi.optional(),description:s.string().optional(),functionUrl:s.union([s.object({authType:s.enum(xa).optional()}).strict(),s.literal(!1)]).optional(),eventSources:s.array(vR).optional()}).strict(),H4=Eb.extend({type:s.literal("ec2"),instanceType:_b.optional(),enableSSH:s.boolean().optional(),keyName:s.string().optional(),userData:s.string().optional(),securityGroups:s.array(s.string()).optional()}).strict(),e7=s.discriminatedUnion("type",[Z4,W4,H4]),mR=s.object({path:s.string().min(1,m.REQUIRED.ROUTING_PATH),priority:s.number().int(m.PRIORITY.INTEGER).min(1,m.PRIORITY.MIN).max(5e4,m.PRIORITY.MAX).optional()}).strict(),ER=s.object({name:s.string().min(1,m.REQUIRED.SERVICE_NAME).max(255,m.MAX_LENGTH.SERVICE_NAME).regex(L.RESOURCE_NAME,m.RESOURCE_NAME),serviceType:s.enum(Aa).optional(),docker:Ft.partial().optional(),containerPort:_n.optional(),needsDatabaseConnection:s.boolean().optional(),routing:s.union([mR,s.array(mR).min(1)]).optional()}).strict().superRefine((e,t)=>{e.serviceType==="worker"&&(e.containerPort!==void 0&&t.addIssue({code:"custom",path:["containerPort"],message:"Worker services are not reachable inbound; remove containerPort."}),e.routing!==void 0&&t.addIssue({code:"custom",path:["routing"],message:"Worker services have no ALB route; remove routing."}))}),t7=s.object({appName:xe,instanceType:s.string().optional()}).strict();var xb=s.object({memorySize:Wi.optional(),timeout:s.number().int(m.LAMBDA.TIMEOUT.INTEGER).min(1,m.LAMBDA.TIMEOUT.MIN).max(900,m.LAMBDA.TIMEOUT.MAX).optional(),ephemeralStorageSize:s.number().int(m.EPHEMERAL_STORAGE.INTEGER).min(512,m.EPHEMERAL_STORAGE.MIN).max(10240,m.EPHEMERAL_STORAGE.MAX).optional()}).strict(),xR=s.object({type:s.enum(sb).optional(),databaseName:s.string().optional(),databaseEngine:s.enum(Ui).optional(),deletionProtection:s.boolean().optional(),backupRetention:sr.optional(),port:nl.optional(),publiclyAccessible:s.boolean().optional(),allowedIpCidr:s.string().optional(),instanceType:s.string().optional(),allocatedStorage:s.number().int(m.ALLOCATED_STORAGE.INTEGER).min(20,m.ALLOCATED_STORAGE.MIN).max(65536,m.ALLOCATED_STORAGE.MAX).optional(),multiAz:s.boolean().optional(),readReplica:al.optional(),writer:Ca.optional(),readers:Pa.optional(),allowVpcAccess:s.boolean().optional(),monitoringInterval:Ra.optional(),preferredMaintenanceWindow:s.string().optional(),databaseInsights:sl.optional(),proxy:ol.optional(),credentials:il.optional(),encryption:cl.optional(),snapshotIdentifier:s.string().optional(),snapshotUsername:s.string().optional()}).strict(),AR=s.object({server:xb.optional(),imageOptimisation:xb.optional(),revalidation:xb.optional()}).strict(),Ab=s.object({versioned:s.boolean().optional()}).strict(),IR=s.object({assets:Ab.optional(),cache:Ab.optional(),media:Ab.optional()}).strict(),Y4=s.object({visibilityTimeout:s.number().int(m.SQS.VISIBILITY_TIMEOUT.INTEGER).min(0,m.SQS.VISIBILITY_TIMEOUT.MIN).max(43200,m.SQS.VISIBILITY_TIMEOUT.MAX).optional(),messageRetentionPeriod:s.number().int(m.SQS.RETENTION_PERIOD.INTEGER).min(60,m.SQS.RETENTION_PERIOD.MIN).max(1209600,m.SQS.RETENTION_PERIOD.MAX).optional(),maxMessageSize:s.number().int(m.MAX_MESSAGE_SIZE.INTEGER).min(1024,m.MAX_MESSAGE_SIZE.MIN).max(262144,m.MAX_MESSAGE_SIZE.MAX).optional(),deadLetterQueue:s.union([s.literal(!1),s.object({enabled:s.boolean().optional(),maxReceiveCount:s.number().int(m.DLQ.MAX_RECEIVE_COUNT.INTEGER).min(1,m.DLQ.MAX_RECEIVE_COUNT.MIN).max(1e3,m.DLQ.MAX_RECEIVE_COUNT.MAX).optional()}).strict()]).optional()}).strict(),TR=s.object({revalidationQueue:Y4.optional()}).strict(),$R=s.object({domainNames:s.array(s.string()).optional(),certificateArn:s.string().optional()}).strict(),RR=s.record(s.string().regex(L.ENV_VAR_NAME,m.ENV_VAR_NAME),s.string()).optional(),K4=s.object({type:s.literal("payload"),name:s.string().min(1,m.REQUIRED.PATTERN_NAME),domain:s.string().optional(),database:xR.optional(),compute:AR.optional(),storage:IR.optional(),messaging:TR.optional(),cdn:$R.optional(),environment:RR}).strict(),q4=s.object({type:s.literal("nextjs"),name:s.string().min(1,m.REQUIRED.PATTERN_NAME),domain:s.string().optional(),database:xR.optional(),compute:AR.optional(),storage:IR.optional(),messaging:TR.optional(),cdn:$R.optional(),environment:RR}).strict(),Ib=s.enum(oa),X4=s.object({command:s.string().min(1,m.REQUIRED.BUILD_COMMAND),outputDir:s.string().min(1,m.REQUIRED.OUTPUT_DIR)}).strict(),J4=s.object({headers:s.boolean().optional(),contentSecurityPolicy:s.string().optional()}).strict(),Q4=s.object({to:s.string().min(1,m.REQUIRED.FORMS_TO).regex(L.EMAIL,m.EMAIL),from:s.string().regex(L.EMAIL,m.EMAIL).optional(),corsOrigin:s.string().regex(L.HTTP_ORIGIN,"corsOrigin must be an exact origin such as https://example.com (no path, no trailing slash)").optional(),maxConcurrency:s.number().int().min(1).max(100).optional()}).strict(),e2=s.object({behaviours:s.array(s.unknown()).optional()}).strict(),Tb=s.object({type:s.literal("staticsite"),name:s.string().min(1,m.REQUIRED.PATTERN_NAME),source:s.string().min(1,m.REQUIRED.SOURCE),build:X4,routing:Ib.optional(),security:J4.optional(),domain:s.string().optional(),forms:Q4.optional(),cdn:e2.optional()}).strict().superRefine((e,t)=>{if(e.forms===void 0)return;let n=e.domain;if(n===void 0||n===""){t.addIssue({code:"custom",path:["domain"],message:"A domain is required when forms are enabled: SES sends only from a verified identity, and the site's domain is the identity the pattern verifies"});return}let i=e.forms.from;i!==void 0&&!Su(i,n)&&t.addIssue({code:"custom",path:["forms","from"],message:`forms.from must be an address at ${n} (the verified SES identity) \u2014 for example noreply@${n}. Use forms.to for the recipient.`})}),wa=s.discriminatedUnion("type",[K4,q4,Tb]),CR=s.enum(["lightweight","standard","resilient","custom"]),PR=s.object({type:s.enum(sb),instanceType:s.string().optional(),backupRetention:sr.optional(),deletionProtection:s.boolean().optional(),encryption:s.union([s.object({useCMK:s.literal(!0)}).strict(),s.literal(!1)]).optional()}).strict(),NR=s.object({memorySize:Wi.optional(),timeout:s.number().int(m.LAMBDA.TIMEOUT.INTEGER).min(1,m.LAMBDA.TIMEOUT.MIN).max(900,m.LAMBDA.TIMEOUT.MAX).optional()}).strict();var wR=s.object({appName:xe,type:lb,pattern:db.optional(),patternConfig:wa.optional(),owner:s.string().optional(),tags:s.record(s.string(),s.string()).optional(),vpcId:s.string().optional(),network:ll.optional(),backup:L$.optional(),tunnel:U$.optional(),additionalNetworks:s.array(iR).optional(),database:s.array(Z$),s3:s.array(aR),compute:s.array(_R),dynamodb:s.array(J$).optional(),clickhouse:s.array(Q$).optional(),sqs:s.array(sR).optional(),cdn:uR.optional(),customCodeBlocks:s.array(z$).optional(),additionalManagedImports:s.array(s.object({moduleSpecifier:s.string(),namedImports:s.array(s.string()),defaultImport:s.string().optional()}).strict()).optional()}).strict(),_7=s.object({name:xe,type:lb,pattern:db.optional(),patternTier:CR.optional(),patternDomain:s.string().optional(),source:s.string().min(1,m.REQUIRED.SOURCE).optional(),buildCommand:s.string().min(1,m.REQUIRED.BUILD_COMMAND).optional(),outputDir:s.string().min(1,m.REQUIRED.OUTPUT_DIR).optional(),routing:Ib.optional(),formsTo:s.string().min(1,m.REQUIRED.FORMS_TO).regex(L.EMAIL,m.EMAIL).optional(),corsOrigin:s.string().regex(L.HTTP_ORIGIN,"corsOrigin must be an exact origin such as https://example.com (no path, no trailing slash)").optional(),customDatabase:PR.optional(),customCompute:NR.optional(),region:s.string().optional(),owner:s.string().optional(),includeDatabase:s.boolean().optional(),databaseName:s.string().min(1,m.DATABASE.NAME.REQUIRED).max(63,m.DATABASE.NAME.MAX_LENGTH).optional(),vpcId:s.string().optional(),network:oR.optional(),services:s.array(ER).optional(),snapshotIdentifier:s.string().optional(),snapshotUsername:s.string().optional()}).strict().superRefine((e,t)=>{e.formsTo!==void 0&&(e.patternDomain!==void 0&&e.patternDomain!==""||t.addIssue({code:"custom",path:["patternDomain"],message:"A domain is required when forms are enabled: SES sends only from a verified identity, and the site's domain is the identity the pattern verifies"}))}),E7=s.object({name:V,localResource:s.string().min(1),remoteApp:s.string().min(1),remoteResource:s.string().min(1),permission:s.enum(["read","write","read-write"]),remoteArn:s.string().optional()}).strict();var t2=["fjall-managed","external","external-manual"],$7=s.enum(t2);var kR=s.object({givenName:s.string().min(1),familyName:s.string().min(1),displayName:s.string().min(1).optional(),expires:s.string().min(1).optional()}).strict(),OR=s.object({name:s.string().min(1),path:s.string().min(1).optional()}).strict(),r2=s.union([s.object({managedPolicyArn:s.string().min(1)}).strict(),s.object({customerManagedPolicy:OR}).strict()]),n2=s.object({managedPolicies:s.array(s.string().min(1)).optional(),inlinePolicy:s.record(s.string(),s.unknown()).optional(),customerManagedPolicies:s.array(OR).optional(),permissionsBoundary:r2.optional(),sessionDuration:s.string().min(1).optional(),description:s.string().optional(),accounts:s.union([s.array(s.string().min(1)),s.literal("all")]).optional(),includeManagementAccount:s.boolean().optional(),groups:s.array(s.string().min(1)).optional()}).strict(),i2=s.object({description:s.string().optional()}).strict(),hl=s.string().regex(L.EMAIL,m.EMAIL),$b={groups:s.record(s.string(),i2).optional(),permissionSets:s.record(s.string(),n2).optional(),memberships:s.record(s.string(),s.array(hl)).optional(),resolutionVersion:s.number().int().min(1).optional(),defaultPermissionSets:s.boolean().optional()},o2=s.discriminatedUnion("source",[s.object({...$b,source:s.literal("fjall-managed"),users:s.record(hl,kR)}).strict(),s.object({...$b,source:s.literal("external")}).strict(),s.object({...$b,source:s.literal("external-manual"),users:s.record(hl,kR).optional()}).strict()]),R7=s.object({name:V,type:s.literal("organisation").optional(),organisationName:s.string().min(1).optional(),orgEmail:hl.optional(),accounts:s.unknown().optional(),accountIds:s.record(s.string(),s.string()).optional(),identityCentre:s.union([o2,s.literal(!1)]).optional(),allowedRegions:s.array(s.string().min(1)).optional()}).strict();var a2=Object.defineProperty,s2=(e,t)=>a2(e,"name",{value:t,configurable:!0}),c2=[1,3,5,7,14,30,60,90,120,150,180,365,400,545,731,1827,3653],u2=s.object({buildkiteQueue:s.string().min(1,"buildkiteQueue cannot be empty").max(100).regex(/^[a-zA-Z0-9-_]+$/,"buildkiteQueue must be alphanumeric with hyphens/underscores"),buildkiteOrgSlug:s.string().min(1,"buildkiteOrgSlug cannot be empty").max(100).regex(/^[a-z0-9-]+$/,"buildkiteOrgSlug must be a lowercase Buildkite organisation slug"),agentTokenSsmParameterName:s.string().min(2).regex(/^\//,"agentTokenSsmParameterName must be a full path (leading /)").optional(),agentTokenKmsKeyArn:s.string().min(1).optional(),fjallApiKeySsmParameterName:s.string().min(2).regex(/^\//,"fjallApiKeySsmParameterName must be a full path (leading /)").optional(),instanceType:s.string().min(1).default("c8g.xlarge"),agentVolumeSizeGib:s.number().int().min(20).max(1e3).default(250),agentMinInstances:s.number().int().min(0).default(0),agentMaxInstances:s.number().int().min(1).default(2),agentsPerInstance:s.number().int().min(1).default(1),spotCapacityPercentage:s.number().int().min(0).max(100).default(0),scaleInIdlePeriodSeconds:s.number().int().min(60).default(600),disconnectAfterUptimeSeconds:s.number().int().min(3600).default(86400),maxInstanceLifetimeDays:s.number().int().min(1).max(365).default(7),terminateInstanceAfterJob:s.boolean().default(!1),purgeBuildsOnDiskFull:s.boolean().default(!0),terminateInstanceOnDiskFull:s.boolean().default(!1),logRetentionDays:s.number().int().min(1).default(30),agentLogRetentionDays:s.literal(c2).default(7),buildkiteAgentRelease:s.enum(["stable","beta","edge"]).default("stable"),buildkiteAgentTags:s.string().default(""),buildkiteAgentTimestampLines:s.boolean().default(!1),buildkiteAgentExperiments:s.string().default(""),buildkiteAgentTracingBackend:s.enum(["","datadog","opentelemetry"]).default(""),buildkiteAgentCancelGracePeriodSeconds:s.number().int().min(10).default(60),enableSecretsPlugin:s.boolean().default(!0),enableEcrPlugin:s.boolean().default(!1),enableDockerLoginPlugin:s.boolean().default(!1),enableDockerUserNamespaceRemap:s.boolean().default(!0),enableDockerExperimental:s.boolean().default(!1),dockerNetworkingProtocol:s.enum(["ipv4","dualstack"]).default("ipv4"),enableInstanceStorage:s.boolean().default(!1),mountTmpfsAtTmp:s.boolean().default(!0),buildkiteAgentEnableGitMirrors:s.boolean().default(!1),bootstrapScriptUrl:s.string().default(""),agentEnvFileUrl:s.string().default(""),scalerEventSchedulePeriod:s.string().min(1).default("1 minute"),scalerMinPollInterval:s.string().min(1).default("10s"),scaleOutFactor:s.string().min(1).default("1.0"),scaleOutWaitingForJobs:s.boolean().default(!1),rolePermissionsBoundaryArn:s.string().min(1).optional(),alarmSnsTopicArn:s.string().min(1).optional(),applicationId:s.string().min(1).optional(),costAllocationEnvironment:s.string().min(1).optional(),costAllocationOwner:s.string().min(1).optional()}).strict(),l2=u2.refine(e=>e.agentMinInstances<=e.agentMaxInstances,{message:"agentMinInstances must be <= agentMaxInstances"});function d2(e){let t=l2.safeParse(e);if(!t.success){let n=t.error.issues.map(i=>`  - ${i.path.join(".")||"(root)"}: ${i.message}`).join(`
 `);throw new Error(`Buildkite: invalid props:
 ${n}`)}return t.data}s2(d2,"validateBuildkiteProps");var m2=Object.defineProperty,p2=(e,t)=>m2(e,"name",{value:t,configurable:!0});function f2(e){return`FjallDeployBoundary${e}`}p2(f2,"deployBoundaryName");var Rb={Sid:"FjallInheritAdministratorAccess",Effect:"Allow",Action:"*",Resource:"*"},DR=[{Sid:"FjallDenyOrgAndAccountEscape",Effect:"Deny",Action:["organizations:LeaveOrganization","account:CloseAccount"],Resource:"*"},{Sid:"FjallDenyDisableAuditLogging",Effect:"Deny",Action:["cloudtrail:StopLogging"],Resource:"*"},{Sid:"FjallDenyBoundarySelfEscape",Effect:"Deny",Action:["iam:DeleteRolePermissionsBoundary"],Resource:"*"},{Sid:"FjallDenyDisableKmsKey",Effect:"Deny",Action:["kms:DisableKey"],Resource:"*"}],MR=[...DR,{Sid:"FjallDenyStandingHumanCredentials",Effect:"Deny",Action:["iam:CreateUser","iam:CreateLoginProfile","iam:CreateAccessKey","iam:CreateAccountAlias"],Resource:"*"},{Sid:"FjallDenyDisableConfigRecorder",Effect:"Deny",Action:["config:StopConfigurationRecorder"],Resource:"*"}],g2=[...MR,{Sid:"FjallDenyAccountPasswordPolicyTamper",Effect:"Deny",Action:["iam:UpdateAccountPasswordPolicy","iam:DeleteAccountPasswordPolicy"],Resource:"*"},{Sid:"FjallDenyDisableDefaultEbsEncryption",Effect:"Deny",Action:["ec2:DisableEbsEncryptionByDefault"],Resource:"*"}],G7={foundation:[Rb,...DR],compliance:[Rb,...MR],hardened:[Rb,...g2]};var h2=Object.defineProperty,Ae=(e,t)=>h2(e,"name",{value:t,configurable:!0});var Nb="sts.amazonaws.com";function v2(e){return`FjallDevDeploy${e}`}Ae(v2,"devDeployRoleName");function b2(e){return`FjallDevProvisioner${e}`}Ae(b2,"devProvisionerRoleName");function y2(e){return`FjallDevSyncWriter${e}`}Ae(y2,"devSyncWriterRoleName");var S2="FjallDevBoundary";function jR(e){return`arn:aws:iam::${e}:policy/${S2}`}Ae(jR,"devBoundaryPolicyArn");function zR(e){return`org:${e}:dev-provisioner`}Ae(zR,"devProvisionerSubject");function LR(e){return`org:${e}:dev-sync`}Ae(LR,"devSyncSubject");function Cb(e,t){return`org:${e}:acct:${t}`}Ae(Cb,"deployAccountSubject");function Pb(e){return`org:${e}:*`}Ae(Pb,"genericMachineSubject");var _2=["discovery","connection","org-setup","dev-substrate-setup"];function UR(e,t){return`org:${e}:${t}`}Ae(UR,"serviceSubject");function E2(e){let{fjallOrgId:t,providerArn:n,issuerDomain:i,accountTier:r,accountId:o}=e,a=e.machineTrustMode??"expanded",c={[`${i}:aud`]:Nb},u;if(a==="account-scoped"){if(r===void 0||!gu(r)||o===void 0)throw new Error(`machineTrustMode "account-scoped" requires a governance accountTier and an accountId (got tier: ${String(r)}, accountId ${o===void 0?"absent":"present"}) \u2014 refusing to fall back to the generic machine subject: a silent fallback would re-widen the trust the \xA74.4a Step-3 contract removes`);u=[Cb(t,o)]}else o!==void 0?u=[Pb(t),Cb(t,o)]:u=Pb(t);return[{Sid:"FjallMachineSubject",Effect:"Allow",Principal:{Federated:n},Action:"sts:AssumeRoleWithWebIdentity",Condition:{StringEquals:{...c,[`${i}:sub`]:u}}},{Sid:"FjallUserSubjects",Effect:"Allow",Principal:{Federated:n},Action:"sts:AssumeRoleWithWebIdentity",Condition:{StringEquals:c,StringLike:{[`${i}:sub`]:`org:${t}:user:*`}}},{Sid:"FjallServiceSubjects",Effect:"Allow",Principal:{Federated:n},Action:"sts:AssumeRoleWithWebIdentity",Condition:{StringEquals:{...c,[`${i}:sub`]:_2.map(l=>UR(t,l))}}}]}Ae(E2,"buildNarrowedDeployTrustStatements");function x2(e){let{fjallOrgId:t,providerArn:n,issuerDomain:i,accountId:r}=e;return[{Sid:"FjallDevSubjectsThisAccount",Effect:"Allow",Principal:{Federated:n},Action:"sts:AssumeRoleWithWebIdentity",Condition:{StringEquals:{[`${i}:aud`]:Nb},StringLike:{[`${i}:sub`]:`org:${t}:dev:${r}:*`}}}]}Ae(x2,"buildDevDeployTrustStatements");function wb(e){let{providerArn:t,issuerDomain:n,sid:i,subject:r}=e;return[{Sid:i,Effect:"Allow",Principal:{Federated:t},Action:"sts:AssumeRoleWithWebIdentity",Condition:{StringEquals:{[`${n}:aud`]:Nb,[`${n}:sub`]:r}}}]}Ae(wb,"buildServiceSubjectTrustStatements");function A2(e){return wb({...e,sid:"FjallDevProvisionerSubject",subject:zR(e.fjallOrgId)})}Ae(A2,"buildDevProvisionerTrustStatements");function I2(e){return wb({...e,sid:"FjallDevSyncSubject",subject:LR(e.fjallOrgId)})}Ae(I2,"buildDevSyncWriterTrustStatements");function T2({accountId:e}){return[{Sid:"FjallDevEcsTaggedMutations",Effect:"Allow",Action:["ecs:UpdateService","ecs:DeleteService","ecs:RunTask","ecs:StopTask"],Resource:`arn:aws:ecs:*:${e}:*`,Condition:{StringEquals:{"aws:ResourceTag/fjall:dev":"true"}}},{Sid:"FjallDevEcsTaggedCreates",Effect:"Allow",Action:["ecs:RegisterTaskDefinition","ecs:CreateService"],Resource:"*",Condition:{StringEquals:{"aws:RequestTag/fjall:dev":"true"}}},{Sid:"FjallDevEcsTagOnCreate",Effect:"Allow",Action:["ecs:TagResource"],Resource:`arn:aws:ecs:*:${e}:*`,Condition:{StringEquals:{"ecs:CreateAction":["RegisterTaskDefinition","CreateService","RunTask"]}}},{Sid:"FjallDevEcsReads",Effect:"Allow",Action:["ecs:Describe*","ecs:List*"],Resource:"*"},{Sid:"FjallDevEcsDeregisterTaskDefinition",Effect:"Allow",Action:["ecs:DeregisterTaskDefinition"],Resource:`arn:aws:ecs:*:${e}:task-definition/fjall-dev-*`},{Sid:"FjallDevElbTaggedMutations",Effect:"Allow",Action:["elasticloadbalancing:ModifyRule","elasticloadbalancing:DeleteRule","elasticloadbalancing:ModifyTargetGroup","elasticloadbalancing:ModifyTargetGroupAttributes","elasticloadbalancing:DeleteTargetGroup","elasticloadbalancing:RegisterTargets","elasticloadbalancing:DeregisterTargets"],Resource:`arn:aws:elasticloadbalancing:*:${e}:*`,Condition:{StringEquals:{"aws:ResourceTag/fjall:dev":"true"}}},{Sid:"FjallDevElbTaggedCreates",Effect:"Allow",Action:["elasticloadbalancing:CreateTargetGroup","elasticloadbalancing:CreateRule"],Resource:`arn:aws:elasticloadbalancing:*:${e}:*`,Condition:{StringEquals:{"aws:RequestTag/fjall:dev":"true"}}},{Sid:"FjallDevElbTagOnCreate",Effect:"Allow",Action:["elasticloadbalancing:AddTags"],Resource:`arn:aws:elasticloadbalancing:*:${e}:*`,Condition:{StringEquals:{"elasticloadbalancing:CreateAction":["CreateTargetGroup","CreateRule"]}}},{Sid:"FjallDevElbReads",Effect:"Allow",Action:["elasticloadbalancing:Describe*"],Resource:"*"},{Sid:"FjallDevSsmDevTree",Effect:"Allow",Action:["ssm:GetParameter*","ssm:PutParameter","ssm:AddTagsToResource"],Resource:`arn:aws:ssm:*:${e}:parameter/fjall/dev/*`},{Sid:"FjallDevLogsMutations",Effect:"Allow",Action:["logs:PutRetentionPolicy","logs:DeleteLogGroup"],Resource:`arn:aws:logs:*:${e}:log-group:/fjall/dev/*`},{Sid:"FjallDevLogsTaggedCreate",Effect:"Allow",Action:["logs:CreateLogGroup","logs:TagResource"],Resource:`arn:aws:logs:*:${e}:log-group:/fjall/dev/*`,Condition:{StringEquals:{"aws:RequestTag/fjall:dev":"true"}}},{Sid:"FjallDevLogsRead",Effect:"Allow",Action:["logs:GetLogEvents","logs:DescribeLogStreams","logs:FilterLogEvents"],Resource:`arn:aws:logs:*:${e}:log-group:/fjall/dev/*`},{Sid:"FjallDevLogsDescribeGroups",Effect:"Allow",Action:["logs:DescribeLogGroups"],Resource:"*"},{Sid:"FjallDevKmsViaDevAlias",Effect:"Allow",Action:["kms:Encrypt","kms:Decrypt","kms:GenerateDataKey"],Resource:`arn:aws:kms:*:${e}:key/*`,Condition:{"ForAnyValue:StringLike":{"kms:ResourceAliases":"alias/fjall-dev-*"}}},{Sid:"FjallDevKmsSsmSecureString",Effect:"Allow",Action:["kms:Encrypt","kms:Decrypt","kms:GenerateDataKey"],Resource:`arn:aws:kms:*:${e}:key/*`,Condition:{StringLike:{"kms:ViaService":"ssm.*.amazonaws.com"}}},{Sid:"FjallDevEcrAuthToken",Effect:"Allow",Action:["ecr:GetAuthorizationToken"],Resource:"*"},{Sid:"FjallDevEcrPushPull",Effect:"Allow",Action:["ecr:PutImage","ecr:InitiateLayerUpload","ecr:UploadLayerPart","ecr:CompleteLayerUpload","ecr:BatchCheckLayerAvailability","ecr:BatchGetImage","ecr:GetDownloadUrlForLayer","ecr:DescribeImages"],Resource:`arn:aws:ecr:*:${e}:repository/*`},{Sid:"FjallDevPassDevPathRoles",Effect:"Allow",Action:["iam:PassRole"],Resource:`arn:aws:iam::${e}:role/fjall/dev/*`}]}Ae(T2,"buildDevDeployPolicyStatements");function $2({accountId:e}){return[{Sid:"FjallDevProvisionerBoundedRoleWrites",Effect:"Allow",Action:["iam:CreateRole","iam:PutRolePolicy","iam:AttachRolePolicy"],Resource:`arn:aws:iam::${e}:role/fjall/dev/*`,Condition:{StringEquals:{"iam:PermissionsBoundary":jR(e)}}},{Sid:"FjallDevProvisionerPathRoleOps",Effect:"Allow",Action:["iam:DeleteRole","iam:DeleteRolePolicy","iam:DetachRolePolicy","iam:ListRolePolicies","iam:TagRole"],Resource:`arn:aws:iam::${e}:role/fjall/dev/*`},{Sid:"FjallDevProvisionerListRoles",Effect:"Allow",Action:["iam:ListRoles"],Resource:"*"},{Sid:"FjallDevProvisionerDevMasterSecrets",Effect:"Allow",Action:["secretsmanager:GetSecretValue"],Resource:`arn:aws:secretsmanager:*:${e}:secret:fjall-dev-*`},{Sid:"FjallDevProvisionerKmsDecryptViaSecretsManager",Effect:"Allow",Action:["kms:Decrypt"],Resource:`arn:aws:kms:*:${e}:key/*`,Condition:{StringLike:{"kms:ViaService":"secretsmanager.*.amazonaws.com"}}},{Sid:"FjallDevProvisionerDataApi",Effect:"Allow",Action:["rds-data:ExecuteStatement","rds-data:BatchExecuteStatement","rds-data:BeginTransaction","rds-data:CommitTransaction","rds-data:RollbackTransaction"],Resource:`arn:aws:rds:*:${e}:cluster:fjall-dev-*`},{Sid:"FjallDevProvisionerMetrics",Effect:"Allow",Action:["cloudwatch:GetMetricData"],Resource:"*"},{Sid:"FjallDevProvisionerOrphanDiscovery",Effect:"Allow",Action:["tag:GetResources"],Resource:"*"},{Sid:"FjallDevProvisionerSsmTeardown",Effect:"Allow",Action:["ssm:DeleteParameter*"],Resource:`arn:aws:ssm:*:${e}:parameter/fjall/dev/*`},{Sid:"FjallDevProvisionerLogsTeardown",Effect:"Allow",Action:["logs:DeleteLogGroup"],Resource:`arn:aws:logs:*:${e}:log-group:/fjall/dev/*`},{Sid:"FjallDevProvisionerTaggedTeardown",Effect:"Allow",Action:["ecs:UpdateService","ecs:StopTask","ecs:DeleteService","elasticloadbalancing:DeleteRule","elasticloadbalancing:DeleteTargetGroup","elasticloadbalancing:DeregisterTargets"],Resource:[`arn:aws:ecs:*:${e}:*`,`arn:aws:elasticloadbalancing:*:${e}:*`],Condition:{StringEquals:{"aws:ResourceTag/fjall:dev":"true"}}},{Sid:"FjallDevProvisionerTeardownReads",Effect:"Allow",Action:["ecs:Describe*","elasticloadbalancing:Describe*"],Resource:"*"},{Sid:"FjallDevProvisionerImageJanitor",Effect:"Allow",Action:["ecr:ListImages","ecr:DescribeImages","ecr:BatchDeleteImage"],Resource:`arn:aws:ecr:*:${e}:repository/*`},{Sid:"FjallDevProvisionerSsmReadAll",Effect:"Allow",Action:["ssm:GetParameter*"],Resource:`arn:aws:ssm:*:${e}:parameter/*`},{Sid:"FjallDevProvisionerKmsDecryptViaSsm",Effect:"Allow",Action:["kms:Decrypt"],Resource:`arn:aws:kms:*:${e}:key/*`,Condition:{StringLike:{"kms:ViaService":"ssm.*.amazonaws.com"}}}]}Ae($2,"buildDevProvisionerPolicyStatements");function R2({accountId:e}){return[{Sid:"FjallDevSyncPrefixReadWrite",Effect:"Allow",Action:["s3:GetObject","s3:PutObject"],Resource:`arn:aws:s3:::fjall-dev-sync-${e}-*/*`,Condition:{StringEquals:{"aws:ResourceAccount":e}}}]}Ae(R2,"buildDevSyncWriterPolicyStatements");function C2({accountId:e}){return[{Sid:"FjallDevBoundarySsmDevRead",Effect:"Allow",Action:["ssm:GetParameter*"],Resource:`arn:aws:ssm:*:${e}:parameter/fjall/dev/*`},{Sid:"FjallDevBoundaryKmsDecryptDevAlias",Effect:"Allow",Action:["kms:Decrypt"],Resource:`arn:aws:kms:*:${e}:key/*`,Condition:{"ForAnyValue:StringLike":{"kms:ResourceAliases":"alias/fjall-dev-*"}}},{Sid:"FjallDevBoundarySyncPrefixReadWrite",Effect:"Allow",Action:["s3:GetObject","s3:PutObject"],Resource:`arn:aws:s3:::fjall-dev-sync-${e}-*/*`,Condition:{StringEquals:{"aws:ResourceAccount":e}}},{Sid:"FjallDevBoundarySlotLogs",Effect:"Allow",Action:["logs:CreateLogStream","logs:PutLogEvents"],Resource:`arn:aws:logs:*:${e}:log-group:/fjall/dev/*`},{Sid:"FjallDevBoundarySyncQueue",Effect:"Allow",Action:["sqs:ReceiveMessage","sqs:DeleteMessage","sqs:GetQueueUrl"],Resource:`arn:aws:sqs:*:${e}:fjall-dev-sync-${e}-*`}]}Ae(C2,"buildDevBoundaryStatements");var P2=Object.defineProperty,Xe=(e,t)=>P2(e,"name",{value:t,configurable:!0});function R(e){return JSON.stringify(e)}Xe(R,"escapeStringLiteral");function En(e){return e.map(R).join(", ")}Xe(En,"formatStringArray");var N2="import:SharedAlarmTopicArn";function xn(e="    "){return`