fjall 14.0.0 → 14.1.0

package/bin/.build-source-hash

@@ -7,31 +7,31 @@
   "extraFiles": [
     "package.json"
   ],
-  "hash": "23ab4462dff52154ac7b4729cb1b2d557052db53b49edb9d7a23e687713eabc0",
+  "hash": "f30c2cd1e5df8318a5a92bad7886dc9b2c0a37cb5bfa90740c8153549d2ad47d",
   "files": {
     "scripts/build-bundle.mjs": "280e97c634f8f11a",
     "scripts/cli-dist-preflight.mjs": "c5e0a63f9e20dfcf",
     "scripts/externals-parity.mjs": "9eae70788a86bbcc",
-    "package.json": "5e8948da2ebfd71d"
+    "package.json": "94f481ac7841f734"
   },
-  "outputHash": "8c28c93a26892c4b2d3f159b59d117654b8b8bd7dace3e0cf1b547f4f9ed6738",
+  "outputHash": "740e4a3a31b9c526aa7409701d848f8ba400bf78c0a347bad516f124a946369e",
   "outputFileCount": 26,
   "chain": {
     "@fjall/cli": {
-      "hash": "5a169c74baa4878f77294349ff3eefabe6c6f667e0342e63afcb812a75d243d0",
-      "outputHash": "7b3e623249e0549c9a599f2742da585716965a89a8d7ff17d7d1942af121c2b5"
+      "hash": "cc21f1e1c47e2d67fc7ce9557882f79720e040ba814714935632dbe3ae793ff8",
+      "outputHash": "8e915f68ae7e6f5f1dd6036b4a17ad3514f9607680b989c6d8d67d1ea86d2e73"
     },
     "@fjall/deploy-core": {
-      "hash": "34c98837fffe6bc5850e1ab87bbd3a819ae9453a7a6a00a9429d12c8c3a69759",
-      "outputHash": "9fcba88e9201cb766d6f82fbce6e98b3d318407331da2b926633b89eea1a2f46"
+      "hash": "4b25041ecdb5c212268eb3baba19228be162db2414f049db3c164aa82ccc2716",
+      "outputHash": "38ea929d2c255e9dd58e4457048ec497008d08653c94d5f5e4a32fdb484b51f1"
     },
     "@fjall/generator": {
-      "hash": "fe228542c5effce565f86ec415ca4d58d80acec5ad591fe00d8609a9680acb88",
-      "outputHash": "6dfec0cd60c145edc1aa2657cabb603af9cd222546e37f6e82091457d0d3dc42"
+      "hash": "297a6c78a2367a9f5699e6a8403f8ecebdec5cae2296e6a76c477ea3f41823eb",
+      "outputHash": "f239c914eb6571c0854f15d2296c3483d5876eaffe7f062932377379a2328a3e"
     },
     "@fjall/util": {
-      "hash": "341946842f29ac978c5e64acaf6306bda9c2f241b9fe4ef46e3d72346dcd258c",
-      "outputHash": "7812b1a8244457a3088f8332173824606c745851d959f416339704edb74c9805"
+      "hash": "9ba5f8462c4c5f005ba61e0d6e5f8f1d5c4737b6b20f8f0e66ad1d5f6fcb9372",
+      "outputHash": "56ec5530931e99e606abcd810bb468f515fe1c94e836fa33623ba7c6d581e3b8"
     }
   }
 }

package/bin/.bundled

@@ -1,3 +1,3 @@
-bundled at 2026-08-17T02:04:54.537Z
-bundle size: 4823406 bytes
-cli version: 14.0.0
+bundled at 2026-08-17T10:22:55.477Z
+bundle size: 4823662 bytes
+cli version: 14.1.0

package/bin/.metafile.json

@@ -23418,7 +23418,7 @@
       "format": "esm"
     },
     "../../cli/dist/src/validation/commandSchemas.js": {
-      "bytes": 21925,
+      "bytes": 21994,
       "imports": [
         {
           "path": "../../node_modules/zod/index.js",
@@ -50892,13 +50892,23 @@
       "format": "esm"
     },
     "../../cli/dist/src/commands/registration/helpers.js": {
-      "bytes": 6698,
+      "bytes": 6825,
       "imports": [
+        {
+          "path": "../../node_modules/commander/index.js",
+          "kind": "import-statement",
+          "original": "commander"
+        },
         {
           "path": "../../deploy-core/dist/src/index.js",
           "kind": "import-statement",
           "original": "@fjall/deploy-core"
         },
+        {
+          "path": "../../cli/dist/src/validation/commandSchemas.js",
+          "kind": "import-statement",
+          "original": "../../validation/commandSchemas.js"
+        },
         {
           "path": "../../cli/dist/src/util/outputMode.js",
           "kind": "import-statement",
@@ -50918,8 +50928,18 @@
       "format": "esm"
     },
     "../../cli/dist/src/commands/registration/createCommands.js": {
-      "bytes": 2022,
+      "bytes": 2132,
       "imports": [
+        {
+          "path": "../../node_modules/commander/index.js",
+          "kind": "import-statement",
+          "original": "commander"
+        },
+        {
+          "path": "../../generator/dist/src/index.js",
+          "kind": "import-statement",
+          "original": "@fjall/generator"
+        },
         {
           "path": "../../cli/dist/src/commands/index.js",
           "kind": "import-statement",
@@ -51278,13 +51298,23 @@
       "format": "esm"
     },
     "../../cli/dist/src/commands/registration/infrastructureCommands.js": {
-      "bytes": 16126,
+      "bytes": 16337,
       "imports": [
+        {
+          "path": "../../node_modules/commander/index.js",
+          "kind": "import-statement",
+          "original": "commander"
+        },
         {
           "path": "../../deploy-core/dist/src/index.js",
           "kind": "import-statement",
           "original": "@fjall/deploy-core"
         },
+        {
+          "path": "../../cli/dist/src/validation/commandSchemas.js",
+          "kind": "import-statement",
+          "original": "../../validation/commandSchemas.js"
+        },
         {
           "path": "../../cli/dist/src/commands/index.js",
           "kind": "import-statement",
@@ -51445,13 +51475,28 @@
       "format": "esm"
     },
     "../../cli/dist/src/commands/registration/ciCommands.js": {
-      "bytes": 5635,
+      "bytes": 5900,
       "imports": [
+        {
+          "path": "../../node_modules/commander/index.js",
+          "kind": "import-statement",
+          "original": "commander"
+        },
         {
           "path": "../../deploy-core/dist/src/index.js",
           "kind": "import-statement",
           "original": "@fjall/deploy-core"
         },
+        {
+          "path": "../../cli/dist/src/operations/ci/ciConstants.js",
+          "kind": "import-statement",
+          "original": "../../operations/ci/ciConstants.js"
+        },
+        {
+          "path": "../../cli/dist/src/validation/commandSchemas.js",
+          "kind": "import-statement",
+          "original": "../../validation/commandSchemas.js"
+        },
         {
           "path": "../../cli/dist/src/commands/index.js",
           "kind": "import-statement",
@@ -51751,7 +51796,7 @@
       "imports": [],
       "exports": [],
       "inputs": {},
-      "bytes": 14259263
+      "bytes": 14260670
     },
     "bin/fjall.bundle.js": {
       "imports": [
@@ -59584,7 +59629,7 @@
           "bytesInOutput": 1717
         },
         "../../cli/dist/src/validation/commandSchemas.js": {
-          "bytesInOutput": 19371
+          "bytesInOutput": 19388
         },
         "../../cli/dist/src/aws/utils/ssoInstances.js": {
           "bytesInOutput": 341
@@ -61069,7 +61114,7 @@
           "bytesInOutput": 28
         },
         "../../node_modules/@anthropic-ai/sdk/internal/utils/log.mjs": {
-          "bytesInOutput": 1282
+          "bytesInOutput": 1286
         },
         "../../node_modules/@anthropic-ai/sdk/internal/utils.mjs": {
           "bytesInOutput": 55
@@ -61093,7 +61138,7 @@
           "bytesInOutput": 1343
         },
         "../../node_modules/@anthropic-ai/sdk/core/streaming.mjs": {
-          "bytesInOutput": 4981
+          "bytesInOutput": 4987
         },
         "../../node_modules/@anthropic-ai/sdk/internal/parse.mjs": {
           "bytesInOutput": 926
@@ -61324,7 +61369,7 @@
           "bytesInOutput": 47
         },
         "../../node_modules/@anthropic-ai/sdk/client.mjs": {
-          "bytesInOutput": 15430
+          "bytesInOutput": 15432
         },
         "../../node_modules/@anthropic-ai/sdk/lib/middleware.mjs": {
           "bytesInOutput": 78
@@ -61422,6 +61467,9 @@
         "../../cli/dist/src/util/commandErrorHandler.js": {
           "bytesInOutput": 264
         },
+        "../../cli/dist/src/commands/registration/createCommands.js": {
+          "bytesInOutput": 1847
+        },
         "../../cli/dist/src/commands/identity/agent.js": {
           "bytesInOutput": 630
         },
@@ -61864,16 +61912,13 @@
           "bytesInOutput": 661
         },
         "../../cli/dist/src/commands/ci/ciRunHandlers.js": {
-          "bytesInOutput": 4304
+          "bytesInOutput": 4300
         },
         "../../cli/dist/src/commands/deployment/tierDeployHandlers.js": {
           "bytesInOutput": 218
         },
-        "../../cli/dist/src/commands/registration/createCommands.js": {
-          "bytesInOutput": 1819
-        },
         "../../cli/dist/src/commands/registration/helpers.js": {
-          "bytesInOutput": 6111
+          "bytesInOutput": 6140
         },
         "../../cli/dist/src/commands/registration/secretCommands.js": {
           "bytesInOutput": 1875
@@ -61888,7 +61933,7 @@
           "bytesInOutput": 10237
         },
         "../../cli/dist/src/commands/registration/infrastructureCommands.js": {
-          "bytesInOutput": 14884
+          "bytesInOutput": 14978
         },
         "../../cli/dist/src/commands/deployment/deployDiffHandlers.js": {
           "bytesInOutput": 1298
@@ -61924,7 +61969,7 @@
           "bytesInOutput": 463
         },
         "../../cli/dist/src/commands/registration/ciCommands.js": {
-          "bytesInOutput": 5388
+          "bytesInOutput": 5468
         },
         "../../cli/dist/src/commands/registration/index.js": {
           "bytesInOutput": 254
@@ -61933,7 +61978,7 @@
           "bytesInOutput": 487
         }
       },
-      "bytes": 4823406
+      "bytes": 4823662
     }
   }
 }

package/bin/assets/generators/account/generator.js

@@ -128,7 +128,7 @@ Set the \`cycles\` parameter to \`"ref"\` to resolve cyclical schemas with defs.
 ${ar}`:"",A=[],M=0;for(let Vt=i-1;Vt>=g;Vt--){let Ne=o[Vt]??"",K=M+Ne.length+1;if((Vt>0?ar.length+1:0)+K+u.length+h.length>n)break;A.unshift(Ne),M=K}let C=i-A.length>0?`${ar}
 `:"",he=A.length>0?`${A.join(`
 `)}
-`:"";return C+he+u+h}Js(vE,"extractErrorWindow");var gk=Object.defineProperty,Un=(e,t)=>gk(e,"name",{value:t,configurable:!0});function hE(e){return e.success===!0}Un(hE,"isSuccess");function yE(e){return e.success===!1}Un(yE,"isFailure");function R(e){return{success:!0,data:e}}Un(R,"success");function T(e){return{success:!1,error:e}}Un(T,"failure");async function bE(e){try{let t=await e();return R(t)}catch(t){return T(Nr(t))}}Un(bE,"tryAsync");function SE(e){try{let t=e();return R(t)}catch(t){return T(Nr(t))}}Un(SE,"trySync");var vk=Object.defineProperty,hk=(e,t)=>vk(e,"name",{value:t,configurable:!0}),_E=/^[a-zA-Z][a-zA-Z0-9-]*$/,yk=Qa.source.replace(/^\^|\$$/g,""),z=Object.freeze({IDENTIFIER:_E,NEW_APP_NAME:/^[a-z][a-z0-9-]*$/,RESOURCE_NAME:/^[a-zA-Z][a-zA-Z0-9]*$/,ECS_SERVICE_NAME:_E,BUCKET_NAME:/^[a-z][a-z0-9-]*[a-z0-9]$|^[a-z][a-z0-9]*$/,DATABASE_NAME:/^[a-zA-Z][a-zA-Z0-9_]*$/,RESOURCE_TYPE:/^[a-z]+(:[a-z]+)?$/,SSM_PATH:new RegExp(`^(?:/${yk})+$`),SECRET_NAME:Ws,SSM_COMPONENT:Qa,EMAIL:/^[^\s@]+@[^\s@]+\.[^\s@]+$/,DOCKER_IMAGE:/^[a-z0-9][a-z0-9._-]*[a-z0-9](:[a-z0-9._-]+)?$/,DOMAIN:/^[a-z0-9]([a-z0-9-]*[a-z0-9])?(\.[a-z0-9]([a-z0-9-]*[a-z0-9])?)+$/i,HTTP_ORIGIN:/^https?:\/\/[a-z0-9.-]+(:\d+)?$/i,PASCAL_CASE:/^[A-Z][A-Za-z0-9]*$/,AWS_ACCOUNT_ID:/^\d{12}$/,VPC_ID:/^vpc-[a-z0-9]+$/,ROLE_ARN:/^arn:aws[a-zA-Z-]*:iam::\d{12}:role\/.+$/,CIDR:/^((25[0-5]|2[0-4]\d|1\d\d|[1-9]?\d)\.){3}(25[0-5]|2[0-4]\d|1\d\d|[1-9]?\d)\/(3[0-2]|[12]?\d)$/,SCHEDULE_EXPRESSION:/^(rate\(1 (?:minute|hour|day)\)|rate\((?:[2-9]|[1-9]\d+) (?:minutes|hours|days)\)|cron\([^\s()]+ [^\s()]+ [^\s()]+ [^\s()]+ [^\s()]+ [^\s()]+\))$/,LAMBDA_RUNTIME_IDENTIFIER:/^[A-Za-z0-9._-]+$/,ENV_VAR_NAME:/^[A-Za-z_][A-Za-z0-9_]*$/});function fg(e){let t=/^rate\((\d+) (minute|minutes|hour|hours|day|days)\)$/.exec(e);if(!t)return;let n=t[1],a=t[2];if(n===void 0||a===void 0)return;let r=parseInt(n,10);if(!Number.isFinite(r)||r<1)return;let o=a==="minute"||a==="hour"||a==="day";if(!(o&&r!==1)&&!(!o&&r===1))return a==="minute"||a==="minutes"?{everyMs:r*6e4}:a==="hour"||a==="hours"?{everyMs:r*60*6e4}:{everyMs:r*24*60*6e4}}hk(fg,"parseRateExpression");var m=Object.freeze({IDENTIFIER:"Must start with a letter, contain only letters, numbers, and hyphens",NEW_APP_NAME:"Must start with a lowercase letter and contain only lowercase letters, numbers, and hyphens",IDENTIFIER_MIN_LENGTH:"Must be at least 2 characters",IDENTIFIER_NO_TRAILING_HYPHEN:"Must not end with a hyphen",IDENTIFIER_NO_CONSECUTIVE_HYPHENS:"Must not contain consecutive hyphens",RESOURCE_NAME:"Must start with a letter and contain only letters and numbers (PascalCase recommended)",ECS_SERVICE_NAME:"Service name must start with a letter and contain only letters, numbers, and hyphens",BUCKET_NAME:"Bucket name must start with a lowercase letter and contain only lowercase letters, numbers, and hyphens",DATABASE_NAME:"Database name must start with a letter and contain only letters, numbers, and underscores",RESOURCE_TYPE:"Resource type must be in format 'category' or 'category:type'",SSM_PATH:"SSM path must start with / and contain valid namespace segments (e.g., /myapp/ApiCluster/service)",SECRET_NAME:Hf,SSM_COMPONENT:Hs,EMAIL:"Please enter a valid email address",DOMAIN:"Please enter a valid domain (e.g., cms.example.com)",DOCKER_IMAGE:"Invalid Docker image name format",REQUIRED:{APP_NAME:"Application name is required",RESOURCE_NAME:"Resource name is required",BUCKET_NAME:"Bucket name is required",SERVICE_NAME:"Service name is required",NETWORK_NAME:"Network name is required",DATABASE_NAME:"Database name is required",ORGANISATION_NAME:"Organisation name is required",EMAIL:"Email is required",NAME:"Name is required",USERNAME:"Username is required",CONTAINER_NAME:"Container name is required",GROUP:"Group is required",PATTERN_NAME:"Pattern name is required",SOURCE:"Source directory is required",BUILD_COMMAND:"Build command is required",OUTPUT_DIR:"Output directory is required",FORMS_TO:"Forms recipient address is required",ROUTING_PATH:"Routing path is required",RESOURCE_REFERENCE:"Resource reference is required",RESOURCE_TYPE:"Resource type is required",VARIANT:"Variant is required",SUBTYPE:"Subtype is required",DEPLOY_TARGET:"Deploy target is required",DESTROY_TARGET:"Destroy target is required"},MAX_LENGTH:{APP_NAME:"Application name must be 50 characters or less",RESOURCE_NAME:"Resource name must be 63 characters or less",BUCKET_NAME:"Bucket name must be 63 characters or less",SERVICE_NAME:"Service name must be 255 characters or less",NETWORK_NAME:"Network name must be 50 characters or less",DATABASE_NAME:"Database name must be 63 characters or less",ORGANISATION_NAME:"Organisation name must be 50 characters or less"},PORT:{INTEGER:"Port must be an integer",MIN:"Port must be at least 1",MAX:"Port cannot exceed 65535"},USERNAME:{MAX_LENGTH:"Username cannot exceed 63 characters"},LAMBDA:{MEMORY:{INTEGER:"Lambda memory must be an integer",MIN:"Memory must be at least 128 MB",MAX:"Memory cannot exceed 10240 MB",MULTIPLE:"Memory must be 128 MB or a multiple of 64 MB"},TIMEOUT:{INTEGER:"Timeout must be an integer",MIN:"Timeout must be at least 1 second",MAX:"Timeout cannot exceed 900 seconds"},RUNTIME:"Lambda runtime must contain only letters, digits, dots, underscores, or dashes (e.g. 'NODEJS_20_X' or 'nodejs20.x')"},ENV_VAR_NAME:"Environment variable names must start with a letter or underscore and contain only letters, digits, and underscores",PRIORITY:{INTEGER:"Priority must be an integer",MIN:"Priority must be at least 1",MAX:"Priority cannot exceed 50000"},CAPACITY:{MIN:{INTEGER:"Minimum capacity must be an integer",MIN_0:"Minimum capacity must be at least 0",MIN_1:"Minimum capacity must be at least 1",MAX:"Minimum capacity cannot exceed 100"},MAX:{INTEGER:"Maximum capacity must be an integer",MIN_0:"Maximum capacity must be at least 0",MIN_1:"Maximum capacity must be at least 1",MAX:"Maximum capacity cannot exceed 100"},DESIRED:{INTEGER:"Desired count must be an integer",MIN:"Desired count must be at least 0",MAX:"Desired count cannot exceed 100"},WARM_POOL_REQUIRED:"minCapacity 0 requires a warmPool \u2014 without it, new tasks wait 60-90s for a cold instance launch",WARM_POOL:{MIN_SIZE:{INTEGER:"Warm pool minSize must be an integer",MIN:"Warm pool minSize must be at least 0",MAX:"Warm pool minSize cannot exceed 100"},MIN_SIZE_EXCEEDS_MAX_CAPACITY:"warmPool.minSize cannot exceed maxCapacity \u2014 the warm pool cannot hold more instances than the ASG allows"}},MEMORY_LIMIT:{INTEGER:"Memory limit must be an integer",MIN_512:"Memory limit must be at least 512 MiB",MIN_128:"Memory limit must be at least 128 MiB",MAX:"Memory limit cannot exceed 30720 MiB"},DATABASE:{PORT:{INTEGER:"Database port must be an integer",MIN:"Database port must be at least 1024",MAX:"Database port cannot exceed 65535"},NAME:{REQUIRED:"Database name is required",MAX_LENGTH:"Database name must be 63 characters or less"}},BACKUP_RETENTION:{INTEGER:"Backup retention must be an integer",MIN:"Backup retention must be at least 1 day",MAX:"Backup retention cannot exceed 35 days"},SQS:{VISIBILITY_TIMEOUT:{INTEGER:"Visibility timeout must be an integer",MIN:"Visibility timeout must be at least 0 seconds",MAX:"Visibility timeout cannot exceed 43200 seconds (12 hours)"},RETENTION_PERIOD:{INTEGER:"Retention period must be an integer",MIN:"Retention period must be at least 60 seconds",MAX:"Retention period cannot exceed 1209600 seconds (14 days)"}},READER:{COUNT:{INTEGER:"Reader count must be an integer",MIN:"Reader count must be at least 0",MAX:"Reader count cannot exceed 15"}},IDENTIFIER_SUFFIX:{REQUIRED:"Identifier suffix is required when specified",MAX_LENGTH:"Identifier suffix cannot exceed 50 characters"},ROTATION:{INTEGER:"Rotation days must be an integer",MIN:"Rotation interval must be at least 1 day",MAX:"Rotation interval cannot exceed 365 days"},MAX_CONNECTIONS:{INTEGER:"Max connections must be an integer",MIN:"Max connections must be at least 1",MAX:"Max connections cannot exceed 100"},MONITORING_INTERVAL:{INTEGER:"Monitoring interval must be an integer",MIN:"Monitoring interval must be at least 0",MAX:"Monitoring interval cannot exceed 60 seconds",VALUES:"Monitoring interval must be 0, 1, 5, 10, 15, 30, or 60 seconds"},RETENTION_DAYS:{INTEGER:"Retention days must be an integer",MIN:"Retention days must be at least 1",MAX:"Retention days cannot exceed 365"},BATCH_SIZE:{INTEGER:"Batch size must be an integer",MIN:"Batch size must be at least 1",MAX:"Batch size cannot exceed 10000"},SERVICE:{UNIQUE_WITHIN_CLUSTER:"Service names must be unique within a cluster",MIN_REQUIRED:"At least one service is required",ROUTING_REQUIRED:"Multiple services with ports require routing config (path or host)"},PROXY_CONFIG:{MAX_IDLE_CONNECTIONS:{INTEGER:"Max idle connections must be an integer",MIN:"Max idle connections must be at least 0",MAX:"Max idle connections cannot exceed 100"},BORROW_TIMEOUT:{INTEGER:"Connection borrow timeout must be an integer",MIN:"Connection borrow timeout must be at least 1 second",MAX:"Connection borrow timeout cannot exceed 3600 seconds"}},MAX_AZS:{INTEGER:"Max AZs must be an integer",MIN:"Max AZs must be at least 1",MAX:"Max AZs cannot exceed 3"},BATCHING_WINDOW:{INTEGER:"Max batching window must be an integer",MIN:"Max batching window must be at least 0",MAX:"Max batching window cannot exceed 300 seconds"},HEALTH_CHECK:{INTERVAL:{INTEGER:"Health check interval must be an integer",MIN:"Health check interval must be at least 5 seconds",MAX:"Health check interval cannot exceed 300 seconds"},TIMEOUT:{INTEGER:"Health check timeout must be an integer",MIN:"Health check timeout must be at least 2 seconds",MAX:"Health check timeout cannot exceed 60 seconds"},RETRIES:{INTEGER:"Health check retries must be an integer",MIN:"Health check retries must be at least 1",MAX:"Health check retries cannot exceed 10"},START_PERIOD:{INTEGER:"Health check start period must be an integer",MIN:"Health check start period must be at least 0 seconds",MAX:"Health check start period cannot exceed 300 seconds"}},EPHEMERAL_STORAGE:{INTEGER:"Ephemeral storage size must be an integer",MIN:"Ephemeral storage size must be at least 512 MB",MAX:"Ephemeral storage size cannot exceed 10240 MB"},MAX_MESSAGE_SIZE:{INTEGER:"Max message size must be an integer",MIN:"Max message size must be at least 1024 bytes",MAX:"Max message size cannot exceed 262144 bytes (256 KB)"},CAPACITY_CONSTRAINT:{MIN_LTE_MAX:"minCapacity must be less than or equal to maxCapacity"},DIRECT_ACCESS:{NO_DOMAIN:"directAccess cannot be used with domain (no ALB for HTTPS)",NO_LOAD_BALANCER:"directAccess cannot be used with loadBalancer (mutually exclusive)"},GLOBAL_AURORA:{PRIMARY_REGION_REQUIRED:"primaryRegion is required for GlobalAurora databases"},NAT_GATEWAY:{INTEGER:"NAT gateway count must be an integer",MIN:"NAT gateway count must be at least 0",MAX:"NAT gateway count cannot exceed 3"},CIDR_MASK:{INTEGER:"CIDR mask must be an integer",MIN:"CIDR mask must be at least 16",MAX:"CIDR mask cannot exceed 28"},CPU:{INTEGER:"CPU must be an integer",MIN:"CPU must be at least 256 units",MAX:"CPU cannot exceed 4096 units"},KMS:{KEY_REQUIRED:"KMS key ARN is required when using KMS encryption"},READER_INSTANCES:{MAX:"Cannot have more than 15 reader instances",COUNT_OR_INSTANCES:"Cannot specify both 'count' and 'instances' - use one or the other"},GENERATOR_CAPACITY:{MIN:{MIN:"Minimum capacity must be at least 1",MAX:"Minimum capacity cannot exceed 1000"},MAX:{MIN:"Maximum capacity must be at least 1",MAX:"Maximum capacity cannot exceed 1000"}},INSTANCE_TYPE:"Unknown instance type. Common types include: t4g.micro, t4g.small, m5.large",ARCHITECTURE_MISMATCH:"Architecture mismatch between instance type and AMI",ALLOCATED_STORAGE:{INTEGER:"Allocated storage must be an integer",MIN:"Allocated storage must be at least 20 GB",MAX:"Allocated storage cannot exceed 65536 GB"},DLQ:{MAX_RECEIVE_COUNT:{INTEGER:"Max receive count must be an integer",MIN:"Max receive count must be at least 1",MAX:"Max receive count cannot exceed 1000"}},ALARM:{PERCENTAGE:{MIN:"Threshold must be at least 1%",MAX:"Threshold must be at most 100%"},FREE_STORAGE_GIB:{MIN:"Free storage threshold must be at least 1 GiB"}},REGION:"Invalid AWS region",PASCAL_CASE:"Resource name must start with an uppercase letter and contain only alphanumerics (PascalCase).",IMAGE_DOCKER_MUTEX:"image and docker are mutually exclusive",AWS_ACCOUNT_ID:"AWS account id must be exactly 12 digits (no hyphens)",VPC_ID:"VPC id must look like vpc-abc12345",ROLE_ARN:"Role ARN must have the form arn:aws:iam::<account-id>:role/<name>",CIDR:"CIDR must be in dotted-quad/prefix-length form (e.g. 10.0.0.0/16)",VPC_PEER:{MIN_REQUESTER_ACCOUNTS:"At least one requester account id is required",REGION_REQUIRED:"Peer region is required when specified",ROUTE_TABLE_ID_REQUIRED:"Route table id must not be empty"},SCHEDULE_EXPRESSION:"Schedule expression must be 'rate(N minute|minutes|hour|hours|day|days)' with N>=1, or 'cron(<6-field AWS expression>)'"});var bk=Object.defineProperty,tt=(e,t)=>bk(e,"name",{value:t,configurable:!0}),Sk=["us-east-2","us-west-2","us-east-1","eu-west-1","eu-central-1","ap-southeast-1"],_k=Object.freeze(Sk.flatMap(e=>{let t=kn(e);return t?[t]:[]})),gg=Object.freeze(["us-east-2","us-west-2","us-east-1","eu-west-1","ap-southeast-1"]);function qs(e){return e?e.split(",").map(t=>t.trim()).filter(Boolean):[]}tt(qs,"parseRegionList");function vg(e){return Ct.includes(e)}tt(vg,"isValidRegion");function hg(e){return/^[a-z]{2}-[a-z]+-[1-9]$/.test(e)}tt(hg,"isValidRegionFormat");function yg(e){if(!e)return gg.slice(0,3);let t=e.toLowerCase().split("-"),n=t[0],a=t.length>1?t[1]:"",r=[];return n&&a&&(r=Ct.filter(o=>o.startsWith(`${n}-${a}`))),r.length===0&&n&&(r=Ct.filter(o=>o.startsWith(`${n}-`))),r.length>0?r.slice(0,3):gg.slice(0,3)}tt(yg,"getSuggestions");function bg(e){if(vg(e))return!0;let t=yg(e);return hg(e)?`Unknown region. Try: ${t.join(", ")}`:`Invalid format. Try: ${t.join(", ")}`}tt(bg,"validateRegion");function EE(e){if(!e||e.trim()==="")return!0;let t=qs(e);for(let n of t){let a=bg(n);if(a!==!0)return a}return!0}tt(EE,"validateRegionList");function Sg(e,t){return e.filter(n=>n!==t)}tt(Sg,"filterDuplicateRegions");function _g(e){return{label:e.city,value:e.code,description:e.optIn?`${e.code} \u2014 opt-in required`:e.code}}tt(_g,"toRegionOption");function AE(){return et.map(_g)}tt(AE,"getRegionOptions");function xE(e){return et.filter(t=>t.code!==e).map(_g)}tt(xE,"getRegionOptionsExcluding");function IE(e){let t=et.find(n=>n.code===e);return t?t.city:e}tt(IE,"getRegionName");function $E(e){return t=>{let n=qs(t);return Sg(n,e)}}tt($E,"createRegionFormatter");var Qs="14.0.0";var ec=["Aurora","Instance","GlobalAurora","ClickHouse"],Ln=["FARGATE","FARGATE_SPOT","EC2"],mt=["standard","resilient","enterprise"],tc=["tinkerer","lightweight","standard","resilient","enterprise"],Eg="custom",no=[...tc,Eg];var Ek=Object.defineProperty,Ak=(e,t)=>Ek(e,"name",{value:t,configurable:!0}),m1=Object.freeze({RESOURCE_SUFFIXES:Object.freeze({storage:"Storage",database:"Database",cluster:"Cluster",function:"Function",instance:"Instance",compute:"Compute"})}),ao=["ecs","lambda","ec2"],Fn=Object.freeze({ECS:"ecs",LAMBDA:"lambda",EC2:"ec2"}),rc=["code","container"],oo=Object.freeze({CODE:"code",CONTAINER:"container"}),nc=["ARM_64","X86_64"],TE="ARM_64",io=["NONE","AWS_IAM"],ac=["public","internal"],oc=["CPU","MEMORY"],ic=["ARM","STANDARD"],Ag=["Instance","Aurora"],Zn=["postgresql","mysql"],so=["web","worker"],NE=["foundation","compliance","hardened"];var sc=["t3.nano","t3.micro","t3.small","t3.medium","t3.large","t3.xlarge","t3.2xlarge","t3a.nano","t3a.micro","t3a.small","t3a.medium","t3a.large","t3a.xlarge","t3a.2xlarge","t4g.nano","t4g.micro","t4g.small","t4g.medium","t4g.large","t4g.xlarge","t4g.2xlarge","c5.large","c5.xlarge","c5.2xlarge","c5.4xlarge","c5.9xlarge","c5.12xlarge","c5.18xlarge","c5.24xlarge","c5a.large","c5a.xlarge","c5a.2xlarge","c5a.4xlarge","c5a.8xlarge","c5a.12xlarge","c5a.16xlarge","c5a.24xlarge","c6g.medium","c6g.large","c6g.xlarge","c6g.2xlarge","c6g.4xlarge","c6g.8xlarge","c6g.12xlarge","c6g.16xlarge","r5.large","r5.xlarge","r5.2xlarge","r5.4xlarge","r5.8xlarge","r5.12xlarge","r5.16xlarge","r5.24xlarge","r5a.large","r5a.xlarge","r5a.2xlarge","r5a.4xlarge","r5a.8xlarge","r5a.12xlarge","r5a.16xlarge","r5a.24xlarge","r6g.medium","r6g.large","r6g.xlarge","r6g.2xlarge","r6g.4xlarge","r6g.8xlarge","r6g.12xlarge","r6g.16xlarge","i3.large","i3.xlarge","i3.2xlarge","i3.4xlarge","i3.8xlarge","i3.16xlarge","p3.2xlarge","p3.8xlarge","p3.16xlarge","g4dn.xlarge","g4dn.2xlarge","g4dn.4xlarge","g4dn.8xlarge","g4dn.12xlarge","g4dn.16xlarge","m5.large","m5.xlarge","m5.2xlarge","m5.4xlarge","m5.8xlarge","m5.12xlarge","m5.16xlarge","m5.24xlarge","m5a.large","m5a.xlarge","m5a.2xlarge","m5a.4xlarge","m5a.8xlarge","m5a.12xlarge","m5a.16xlarge","m5a.24xlarge"],RE=[0,1,5,10,15,30,60];function rt(e,t){return e.includes(t)}Ak(rt,"constIncludes");var PE=1,CE=65535,h1=Object.freeze({postgresql:5432,mysql:3306}),kE=128,DE=10240,cc=1,uc=900,xg=1,Ig=1e3,Vn=100,OE=100;var wE=3e3;var jE=["GET","POST","PUT","DELETE","HEAD","OPTIONS","PATCH"],ME=["standard","assets","upload","website"],Bn=["AES256","KMS"];var xk=Object.defineProperty,co=(e,t)=>xk(e,"name",{value:t,configurable:!0}),Le=co(e=>s.union([s.literal(!1),e]),"optionalOrDisabled"),Cr={check:co(e=>e.minCapacity!==void 0&&e.maxCapacity!==void 0?e.minCapacity<=e.maxCapacity:!0,"check"),params:{message:m.CAPACITY_CONSTRAINT.MIN_LTE_MAX,path:["maxCapacity"]}},uo=co(e=>s.number().int(m.MEMORY_LIMIT.INTEGER).min(e,e===128?m.MEMORY_LIMIT.MIN_128:m.MEMORY_LIMIT.MIN_512).max(30720,m.MEMORY_LIMIT.MAX),"memoryLimitMiBSchema"),F=s.string().min(1,m.REQUIRED.RESOURCE_NAME).max(63,m.MAX_LENGTH.RESOURCE_NAME).regex(z.RESOURCE_NAME,m.RESOURCE_NAME),UE=s.string().min(1,m.REQUIRED.BUCKET_NAME).max(63,m.MAX_LENGTH.BUCKET_NAME).regex(z.BUCKET_NAME,m.BUCKET_NAME),LE=s.string().min(1,m.REQUIRED.DATABASE_NAME).max(63,m.MAX_LENGTH.DATABASE_NAME).regex(z.DATABASE_NAME,m.DATABASE_NAME);function lc(e,t=z.IDENTIFIER,n=m.IDENTIFIER){return s.string().min(2,m.IDENTIFIER_MIN_LENGTH).max(50,e).regex(t,n).refine(a=>!a.endsWith("-"),{message:m.IDENTIFIER_NO_TRAILING_HYPHEN}).refine(a=>!a.includes("--"),{message:m.IDENTIFIER_NO_CONSECUTIVE_HYPHENS})}co(lc,"identifierSchema");var fe=lc(m.MAX_LENGTH.APP_NAME),x1=lc(m.MAX_LENGTH.APP_NAME,z.NEW_APP_NAME,m.NEW_APP_NAME),kr=s.number().int(m.PORT.INTEGER).min(PE,m.PORT.MIN).max(CE,m.PORT.MAX),xe=s.object({key:s.string(),sourceText:s.string()}).strict(),Ik=s.object({__identifier:s.string()}).strict(),$k=s.object({__expression:s.string()}).strict(),Tk=s.object({__call:s.string()}).strict(),Nk=s.union([Ik,$k,Tk]),Rk=s.union([s.string(),s.number(),s.boolean(),Nk]),Gn=s.record(s.string().regex(z.ENV_VAR_NAME,m.ENV_VAR_NAME),Rk),Pk=s.object({id:s.string(),name:s.string().optional(),arn:s.string().optional(),field:s.string().optional()}).strict().refine(e=>e.name!==void 0!=(e.arn!==void 0),{message:"secretsImport requires exactly one of `name` or `arn`."}),FE=s.record(s.string(),Pk),I1=s.record(s.string(),s.unknown()),$g=s.enum(no).describe(`Application type must be one of: ${no.join(", ")}`),Tg=s.enum(yt).describe(`OpenNext deployment pattern: ${yt.join(", ")}`),Ck=s.enum(["before-imports","after-imports","after-app-init","after-tags","after-resource","end-of-file"]),kk=s.enum(["import","app-init","tags","database","compute","storage","network","messaging","cdn","pattern","vpc-peer","vpc-peer-accepter","cross-plan-connection","custom"]),ZE=s.object({sourceText:s.string(),position:Ck,afterManagedResource:s.object({type:kk,name:s.string().optional()}).strict().optional(),originalLine:s.number().int().optional(),leadingComments:s.array(s.string()).optional(),orphaned:s.boolean().optional(),orphanedComment:s.string().optional()}).strict(),VE=s.union([s.object({tier:s.enum(mt)}).strict(),s.literal(!1)]),BE=s.union([s.object({instanceType:s.string().optional()}).strict(),s.literal(!1)]),Dk=lc(m.MAX_LENGTH.ORGANISATION_NAME),Ok=s.string().regex(z.EMAIL,m.EMAIL),zE=s.string().refine(e=>Ct.includes(e),{message:m.REGION}),$1=s.object({name:Dk,email:Ok,accountName:s.string().optional(),primaryRegion:zE.optional().default(tr),secondaryRegions:s.array(zE).optional(),security:s.enum(NE).optional(),force:s.boolean().optional()}).strict();function lo(e){return e.issues.map(t=>`${t.path.length>0?`${t.path.join(".")}: `:""}${t.message}`).join(`
+`:"";return C+he+u+h}Js(vE,"extractErrorWindow");var gk=Object.defineProperty,Un=(e,t)=>gk(e,"name",{value:t,configurable:!0});function hE(e){return e.success===!0}Un(hE,"isSuccess");function yE(e){return e.success===!1}Un(yE,"isFailure");function R(e){return{success:!0,data:e}}Un(R,"success");function T(e){return{success:!1,error:e}}Un(T,"failure");async function bE(e){try{let t=await e();return R(t)}catch(t){return T(Nr(t))}}Un(bE,"tryAsync");function SE(e){try{let t=e();return R(t)}catch(t){return T(Nr(t))}}Un(SE,"trySync");var vk=Object.defineProperty,hk=(e,t)=>vk(e,"name",{value:t,configurable:!0}),_E=/^[a-zA-Z][a-zA-Z0-9-]*$/,yk=Qa.source.replace(/^\^|\$$/g,""),z=Object.freeze({IDENTIFIER:_E,NEW_APP_NAME:/^[a-z][a-z0-9-]*$/,RESOURCE_NAME:/^[a-zA-Z][a-zA-Z0-9]*$/,ECS_SERVICE_NAME:_E,BUCKET_NAME:/^[a-z][a-z0-9-]*[a-z0-9]$|^[a-z][a-z0-9]*$/,DATABASE_NAME:/^[a-zA-Z][a-zA-Z0-9_]*$/,RESOURCE_TYPE:/^[a-z]+(:[a-z]+)?$/,SSM_PATH:new RegExp(`^(?:/${yk})+$`),SECRET_NAME:Ws,SSM_COMPONENT:Qa,EMAIL:/^[^\s@]+@[^\s@]+\.[^\s@]+$/,DOCKER_IMAGE:/^[a-z0-9][a-z0-9._-]*[a-z0-9](:[a-z0-9._-]+)?$/,DOMAIN:/^[a-z0-9]([a-z0-9-]*[a-z0-9])?(\.[a-z0-9]([a-z0-9-]*[a-z0-9])?)+$/i,HTTP_ORIGIN:/^https?:\/\/[a-z0-9.-]+(:\d+)?$/i,PASCAL_CASE:/^[A-Z][A-Za-z0-9]*$/,AWS_ACCOUNT_ID:/^\d{12}$/,VPC_ID:/^vpc-[a-z0-9]+$/,ROLE_ARN:/^arn:aws[a-zA-Z-]*:iam::\d{12}:role\/.+$/,CIDR:/^((25[0-5]|2[0-4]\d|1\d\d|[1-9]?\d)\.){3}(25[0-5]|2[0-4]\d|1\d\d|[1-9]?\d)\/(3[0-2]|[12]?\d)$/,SCHEDULE_EXPRESSION:/^(rate\(1 (?:minute|hour|day)\)|rate\((?:[2-9]|[1-9]\d+) (?:minutes|hours|days)\)|cron\([^\s()]+ [^\s()]+ [^\s()]+ [^\s()]+ [^\s()]+ [^\s()]+\))$/,LAMBDA_RUNTIME_IDENTIFIER:/^[A-Za-z0-9._-]+$/,ENV_VAR_NAME:/^[A-Za-z_][A-Za-z0-9_]*$/});function fg(e){let t=/^rate\((\d+) (minute|minutes|hour|hours|day|days)\)$/.exec(e);if(!t)return;let n=t[1],a=t[2];if(n===void 0||a===void 0)return;let r=parseInt(n,10);if(!Number.isFinite(r)||r<1)return;let o=a==="minute"||a==="hour"||a==="day";if(!(o&&r!==1)&&!(!o&&r===1))return a==="minute"||a==="minutes"?{everyMs:r*6e4}:a==="hour"||a==="hours"?{everyMs:r*60*6e4}:{everyMs:r*24*60*6e4}}hk(fg,"parseRateExpression");var m=Object.freeze({IDENTIFIER:"Must start with a letter, contain only letters, numbers, and hyphens",NEW_APP_NAME:"Must start with a lowercase letter and contain only lowercase letters, numbers, and hyphens",IDENTIFIER_MIN_LENGTH:"Must be at least 2 characters",IDENTIFIER_NO_TRAILING_HYPHEN:"Must not end with a hyphen",IDENTIFIER_NO_CONSECUTIVE_HYPHENS:"Must not contain consecutive hyphens",RESOURCE_NAME:"Must start with a letter and contain only letters and numbers (PascalCase recommended)",ECS_SERVICE_NAME:"Service name must start with a letter and contain only letters, numbers, and hyphens",BUCKET_NAME:"Bucket name must start with a lowercase letter and contain only lowercase letters, numbers, and hyphens",DATABASE_NAME:"Database name must start with a letter and contain only letters, numbers, and underscores",RESOURCE_TYPE:"Resource type must be in format 'category' or 'category:type'",SSM_PATH:"SSM path must start with / and contain valid namespace segments (e.g., /myapp/ApiCluster/service)",SECRET_NAME:Hf,SSM_COMPONENT:Hs,EMAIL:"Please enter a valid email address",DOMAIN:"Please enter a valid domain (e.g., cms.example.com)",DOCKER_IMAGE:"Invalid Docker image name format",REQUIRED:{APP_NAME:"Application name is required",RESOURCE_NAME:"Resource name is required",BUCKET_NAME:"Bucket name is required",SERVICE_NAME:"Service name is required",NETWORK_NAME:"Network name is required",DATABASE_NAME:"Database name is required",ORGANISATION_NAME:"Organisation name is required",EMAIL:"Email is required",NAME:"Name is required",USERNAME:"Username is required",CONTAINER_NAME:"Container name is required",GROUP:"Group is required",PATTERN_NAME:"Pattern name is required",SOURCE:"Source directory is required",BUILD_COMMAND:"Build command is required",OUTPUT_DIR:"Output directory is required",FORMS_TO:"Forms recipient address is required",ROUTING_PATH:"Routing path is required",RESOURCE_REFERENCE:"Resource reference is required",RESOURCE_TYPE:"Resource type is required",VARIANT:"Variant is required",SUBTYPE:"Subtype is required",DEPLOY_TARGET:"Deploy target is required",DESTROY_TARGET:"Destroy target is required"},MAX_LENGTH:{APP_NAME:"Application name must be 50 characters or less",RESOURCE_NAME:"Resource name must be 63 characters or less",BUCKET_NAME:"Bucket name must be 63 characters or less",SERVICE_NAME:"Service name must be 255 characters or less",NETWORK_NAME:"Network name must be 50 characters or less",DATABASE_NAME:"Database name must be 63 characters or less",ORGANISATION_NAME:"Organisation name must be 50 characters or less"},PORT:{INTEGER:"Port must be an integer",MIN:"Port must be at least 1",MAX:"Port cannot exceed 65535"},USERNAME:{MAX_LENGTH:"Username cannot exceed 63 characters"},LAMBDA:{MEMORY:{INTEGER:"Lambda memory must be an integer",MIN:"Memory must be at least 128 MB",MAX:"Memory cannot exceed 10240 MB",MULTIPLE:"Memory must be 128 MB or a multiple of 64 MB"},TIMEOUT:{INTEGER:"Timeout must be an integer",MIN:"Timeout must be at least 1 second",MAX:"Timeout cannot exceed 900 seconds"},RUNTIME:"Lambda runtime must contain only letters, digits, dots, underscores, or dashes (e.g. 'NODEJS_20_X' or 'nodejs20.x')"},ENV_VAR_NAME:"Environment variable names must start with a letter or underscore and contain only letters, digits, and underscores",PRIORITY:{INTEGER:"Priority must be an integer",MIN:"Priority must be at least 1",MAX:"Priority cannot exceed 50000"},CAPACITY:{MIN:{INTEGER:"Minimum capacity must be an integer",MIN_0:"Minimum capacity must be at least 0",MIN_1:"Minimum capacity must be at least 1",MAX:"Minimum capacity cannot exceed 100"},MAX:{INTEGER:"Maximum capacity must be an integer",MIN_0:"Maximum capacity must be at least 0",MIN_1:"Maximum capacity must be at least 1",MAX:"Maximum capacity cannot exceed 100"},DESIRED:{INTEGER:"Desired count must be an integer",MIN:"Desired count must be at least 0",MAX:"Desired count cannot exceed 100"},WARM_POOL_REQUIRED:"minCapacity 0 requires a warmPool \u2014 without it, new tasks wait 60-90s for a cold instance launch",WARM_POOL:{MIN_SIZE:{INTEGER:"Warm pool minSize must be an integer",MIN:"Warm pool minSize must be at least 0",MAX:"Warm pool minSize cannot exceed 100"},MIN_SIZE_EXCEEDS_MAX_CAPACITY:"warmPool.minSize cannot exceed maxCapacity \u2014 the warm pool cannot hold more instances than the ASG allows"}},MEMORY_LIMIT:{INTEGER:"Memory limit must be an integer",MIN_512:"Memory limit must be at least 512 MiB",MIN_128:"Memory limit must be at least 128 MiB",MAX:"Memory limit cannot exceed 30720 MiB"},DATABASE:{PORT:{INTEGER:"Database port must be an integer",MIN:"Database port must be at least 1024",MAX:"Database port cannot exceed 65535"},NAME:{REQUIRED:"Database name is required",MAX_LENGTH:"Database name must be 63 characters or less"}},BACKUP_RETENTION:{INTEGER:"Backup retention must be an integer",MIN:"Backup retention must be at least 1 day",MAX:"Backup retention cannot exceed 35 days"},SQS:{VISIBILITY_TIMEOUT:{INTEGER:"Visibility timeout must be an integer",MIN:"Visibility timeout must be at least 0 seconds",MAX:"Visibility timeout cannot exceed 43200 seconds (12 hours)"},RETENTION_PERIOD:{INTEGER:"Retention period must be an integer",MIN:"Retention period must be at least 60 seconds",MAX:"Retention period cannot exceed 1209600 seconds (14 days)"}},READER:{COUNT:{INTEGER:"Reader count must be an integer",MIN:"Reader count must be at least 0",MAX:"Reader count cannot exceed 15"}},IDENTIFIER_SUFFIX:{REQUIRED:"Identifier suffix is required when specified",MAX_LENGTH:"Identifier suffix cannot exceed 50 characters"},ROTATION:{INTEGER:"Rotation days must be an integer",MIN:"Rotation interval must be at least 1 day",MAX:"Rotation interval cannot exceed 365 days"},MAX_CONNECTIONS:{INTEGER:"Max connections must be an integer",MIN:"Max connections must be at least 1",MAX:"Max connections cannot exceed 100"},MONITORING_INTERVAL:{INTEGER:"Monitoring interval must be an integer",MIN:"Monitoring interval must be at least 0",MAX:"Monitoring interval cannot exceed 60 seconds",VALUES:"Monitoring interval must be 0, 1, 5, 10, 15, 30, or 60 seconds"},RETENTION_DAYS:{INTEGER:"Retention days must be an integer",MIN:"Retention days must be at least 1",MAX:"Retention days cannot exceed 365"},BATCH_SIZE:{INTEGER:"Batch size must be an integer",MIN:"Batch size must be at least 1",MAX:"Batch size cannot exceed 10000"},SERVICE:{UNIQUE_WITHIN_CLUSTER:"Service names must be unique within a cluster",MIN_REQUIRED:"At least one service is required",ROUTING_REQUIRED:"Multiple services with ports require routing config (path or host)"},PROXY_CONFIG:{MAX_IDLE_CONNECTIONS:{INTEGER:"Max idle connections must be an integer",MIN:"Max idle connections must be at least 0",MAX:"Max idle connections cannot exceed 100"},BORROW_TIMEOUT:{INTEGER:"Connection borrow timeout must be an integer",MIN:"Connection borrow timeout must be at least 1 second",MAX:"Connection borrow timeout cannot exceed 3600 seconds"}},MAX_AZS:{INTEGER:"Max AZs must be an integer",MIN:"Max AZs must be at least 1",MAX:"Max AZs cannot exceed 3"},BATCHING_WINDOW:{INTEGER:"Max batching window must be an integer",MIN:"Max batching window must be at least 0",MAX:"Max batching window cannot exceed 300 seconds"},HEALTH_CHECK:{INTERVAL:{INTEGER:"Health check interval must be an integer",MIN:"Health check interval must be at least 5 seconds",MAX:"Health check interval cannot exceed 300 seconds"},TIMEOUT:{INTEGER:"Health check timeout must be an integer",MIN:"Health check timeout must be at least 2 seconds",MAX:"Health check timeout cannot exceed 60 seconds"},RETRIES:{INTEGER:"Health check retries must be an integer",MIN:"Health check retries must be at least 1",MAX:"Health check retries cannot exceed 10"},START_PERIOD:{INTEGER:"Health check start period must be an integer",MIN:"Health check start period must be at least 0 seconds",MAX:"Health check start period cannot exceed 300 seconds"}},EPHEMERAL_STORAGE:{INTEGER:"Ephemeral storage size must be an integer",MIN:"Ephemeral storage size must be at least 512 MB",MAX:"Ephemeral storage size cannot exceed 10240 MB"},MAX_MESSAGE_SIZE:{INTEGER:"Max message size must be an integer",MIN:"Max message size must be at least 1024 bytes",MAX:"Max message size cannot exceed 262144 bytes (256 KB)"},CAPACITY_CONSTRAINT:{MIN_LTE_MAX:"minCapacity must be less than or equal to maxCapacity"},DIRECT_ACCESS:{NO_DOMAIN:"directAccess cannot be used with domain (no ALB for HTTPS)",NO_LOAD_BALANCER:"directAccess cannot be used with loadBalancer (mutually exclusive)"},GLOBAL_AURORA:{PRIMARY_REGION_REQUIRED:"primaryRegion is required for GlobalAurora databases"},NAT_GATEWAY:{INTEGER:"NAT gateway count must be an integer",MIN:"NAT gateway count must be at least 0",MAX:"NAT gateway count cannot exceed 3"},CIDR_MASK:{INTEGER:"CIDR mask must be an integer",MIN:"CIDR mask must be at least 16",MAX:"CIDR mask cannot exceed 28"},CPU:{INTEGER:"CPU must be an integer",MIN:"CPU must be at least 256 units",MAX:"CPU cannot exceed 4096 units"},KMS:{KEY_REQUIRED:"KMS key ARN is required when using KMS encryption"},READER_INSTANCES:{MAX:"Cannot have more than 15 reader instances",COUNT_OR_INSTANCES:"Cannot specify both 'count' and 'instances' - use one or the other"},GENERATOR_CAPACITY:{MIN:{MIN:"Minimum capacity must be at least 1",MAX:"Minimum capacity cannot exceed 1000"},MAX:{MIN:"Maximum capacity must be at least 1",MAX:"Maximum capacity cannot exceed 1000"}},INSTANCE_TYPE:"Unknown instance type. Common types include: t4g.micro, t4g.small, m5.large",ARCHITECTURE_MISMATCH:"Architecture mismatch between instance type and AMI",ALLOCATED_STORAGE:{INTEGER:"Allocated storage must be an integer",MIN:"Allocated storage must be at least 20 GB",MAX:"Allocated storage cannot exceed 65536 GB"},DLQ:{MAX_RECEIVE_COUNT:{INTEGER:"Max receive count must be an integer",MIN:"Max receive count must be at least 1",MAX:"Max receive count cannot exceed 1000"}},ALARM:{PERCENTAGE:{MIN:"Threshold must be at least 1%",MAX:"Threshold must be at most 100%"},FREE_STORAGE_GIB:{MIN:"Free storage threshold must be at least 1 GiB"}},REGION:"Invalid AWS region",PASCAL_CASE:"Resource name must start with an uppercase letter and contain only alphanumerics (PascalCase).",IMAGE_DOCKER_MUTEX:"image and docker are mutually exclusive",AWS_ACCOUNT_ID:"AWS account id must be exactly 12 digits (no hyphens)",VPC_ID:"VPC id must look like vpc-abc12345",ROLE_ARN:"Role ARN must have the form arn:aws:iam::<account-id>:role/<name>",CIDR:"CIDR must be in dotted-quad/prefix-length form (e.g. 10.0.0.0/16)",VPC_PEER:{MIN_REQUESTER_ACCOUNTS:"At least one requester account id is required",REGION_REQUIRED:"Peer region is required when specified",ROUTE_TABLE_ID_REQUIRED:"Route table id must not be empty"},SCHEDULE_EXPRESSION:"Schedule expression must be 'rate(N minute|minutes|hour|hours|day|days)' with N>=1, or 'cron(<6-field AWS expression>)'"});var bk=Object.defineProperty,tt=(e,t)=>bk(e,"name",{value:t,configurable:!0}),Sk=["us-east-2","us-west-2","us-east-1","eu-west-1","eu-central-1","ap-southeast-1"],_k=Object.freeze(Sk.flatMap(e=>{let t=kn(e);return t?[t]:[]})),gg=Object.freeze(["us-east-2","us-west-2","us-east-1","eu-west-1","ap-southeast-1"]);function qs(e){return e?e.split(",").map(t=>t.trim()).filter(Boolean):[]}tt(qs,"parseRegionList");function vg(e){return Ct.includes(e)}tt(vg,"isValidRegion");function hg(e){return/^[a-z]{2}-[a-z]+-[1-9]$/.test(e)}tt(hg,"isValidRegionFormat");function yg(e){if(!e)return gg.slice(0,3);let t=e.toLowerCase().split("-"),n=t[0],a=t.length>1?t[1]:"",r=[];return n&&a&&(r=Ct.filter(o=>o.startsWith(`${n}-${a}`))),r.length===0&&n&&(r=Ct.filter(o=>o.startsWith(`${n}-`))),r.length>0?r.slice(0,3):gg.slice(0,3)}tt(yg,"getSuggestions");function bg(e){if(vg(e))return!0;let t=yg(e);return hg(e)?`Unknown region. Try: ${t.join(", ")}`:`Invalid format. Try: ${t.join(", ")}`}tt(bg,"validateRegion");function EE(e){if(!e||e.trim()==="")return!0;let t=qs(e);for(let n of t){let a=bg(n);if(a!==!0)return a}return!0}tt(EE,"validateRegionList");function Sg(e,t){return e.filter(n=>n!==t)}tt(Sg,"filterDuplicateRegions");function _g(e){return{label:e.city,value:e.code,description:e.optIn?`${e.code} \u2014 opt-in required`:e.code}}tt(_g,"toRegionOption");function AE(){return et.map(_g)}tt(AE,"getRegionOptions");function xE(e){return et.filter(t=>t.code!==e).map(_g)}tt(xE,"getRegionOptionsExcluding");function IE(e){let t=et.find(n=>n.code===e);return t?t.city:e}tt(IE,"getRegionName");function $E(e){return t=>{let n=qs(t);return Sg(n,e)}}tt($E,"createRegionFormatter");var Qs="14.1.0";var ec=["Aurora","Instance","GlobalAurora","ClickHouse"],Ln=["FARGATE","FARGATE_SPOT","EC2"],mt=["standard","resilient","enterprise"],tc=["tinkerer","lightweight","standard","resilient","enterprise"],Eg="custom",no=[...tc,Eg];var Ek=Object.defineProperty,Ak=(e,t)=>Ek(e,"name",{value:t,configurable:!0}),m1=Object.freeze({RESOURCE_SUFFIXES:Object.freeze({storage:"Storage",database:"Database",cluster:"Cluster",function:"Function",instance:"Instance",compute:"Compute"})}),ao=["ecs","lambda","ec2"],Fn=Object.freeze({ECS:"ecs",LAMBDA:"lambda",EC2:"ec2"}),rc=["code","container"],oo=Object.freeze({CODE:"code",CONTAINER:"container"}),nc=["ARM_64","X86_64"],TE="ARM_64",io=["NONE","AWS_IAM"],ac=["public","internal"],oc=["CPU","MEMORY"],ic=["ARM","STANDARD"],Ag=["Instance","Aurora"],Zn=["postgresql","mysql"],so=["web","worker"],NE=["foundation","compliance","hardened"];var sc=["t3.nano","t3.micro","t3.small","t3.medium","t3.large","t3.xlarge","t3.2xlarge","t3a.nano","t3a.micro","t3a.small","t3a.medium","t3a.large","t3a.xlarge","t3a.2xlarge","t4g.nano","t4g.micro","t4g.small","t4g.medium","t4g.large","t4g.xlarge","t4g.2xlarge","c5.large","c5.xlarge","c5.2xlarge","c5.4xlarge","c5.9xlarge","c5.12xlarge","c5.18xlarge","c5.24xlarge","c5a.large","c5a.xlarge","c5a.2xlarge","c5a.4xlarge","c5a.8xlarge","c5a.12xlarge","c5a.16xlarge","c5a.24xlarge","c6g.medium","c6g.large","c6g.xlarge","c6g.2xlarge","c6g.4xlarge","c6g.8xlarge","c6g.12xlarge","c6g.16xlarge","r5.large","r5.xlarge","r5.2xlarge","r5.4xlarge","r5.8xlarge","r5.12xlarge","r5.16xlarge","r5.24xlarge","r5a.large","r5a.xlarge","r5a.2xlarge","r5a.4xlarge","r5a.8xlarge","r5a.12xlarge","r5a.16xlarge","r5a.24xlarge","r6g.medium","r6g.large","r6g.xlarge","r6g.2xlarge","r6g.4xlarge","r6g.8xlarge","r6g.12xlarge","r6g.16xlarge","i3.large","i3.xlarge","i3.2xlarge","i3.4xlarge","i3.8xlarge","i3.16xlarge","p3.2xlarge","p3.8xlarge","p3.16xlarge","g4dn.xlarge","g4dn.2xlarge","g4dn.4xlarge","g4dn.8xlarge","g4dn.12xlarge","g4dn.16xlarge","m5.large","m5.xlarge","m5.2xlarge","m5.4xlarge","m5.8xlarge","m5.12xlarge","m5.16xlarge","m5.24xlarge","m5a.large","m5a.xlarge","m5a.2xlarge","m5a.4xlarge","m5a.8xlarge","m5a.12xlarge","m5a.16xlarge","m5a.24xlarge"],RE=[0,1,5,10,15,30,60];function rt(e,t){return e.includes(t)}Ak(rt,"constIncludes");var PE=1,CE=65535,h1=Object.freeze({postgresql:5432,mysql:3306}),kE=128,DE=10240,cc=1,uc=900,xg=1,Ig=1e3,Vn=100,OE=100;var wE=3e3;var jE=["GET","POST","PUT","DELETE","HEAD","OPTIONS","PATCH"],ME=["standard","assets","upload","website"],Bn=["AES256","KMS"];var xk=Object.defineProperty,co=(e,t)=>xk(e,"name",{value:t,configurable:!0}),Le=co(e=>s.union([s.literal(!1),e]),"optionalOrDisabled"),Cr={check:co(e=>e.minCapacity!==void 0&&e.maxCapacity!==void 0?e.minCapacity<=e.maxCapacity:!0,"check"),params:{message:m.CAPACITY_CONSTRAINT.MIN_LTE_MAX,path:["maxCapacity"]}},uo=co(e=>s.number().int(m.MEMORY_LIMIT.INTEGER).min(e,e===128?m.MEMORY_LIMIT.MIN_128:m.MEMORY_LIMIT.MIN_512).max(30720,m.MEMORY_LIMIT.MAX),"memoryLimitMiBSchema"),F=s.string().min(1,m.REQUIRED.RESOURCE_NAME).max(63,m.MAX_LENGTH.RESOURCE_NAME).regex(z.RESOURCE_NAME,m.RESOURCE_NAME),UE=s.string().min(1,m.REQUIRED.BUCKET_NAME).max(63,m.MAX_LENGTH.BUCKET_NAME).regex(z.BUCKET_NAME,m.BUCKET_NAME),LE=s.string().min(1,m.REQUIRED.DATABASE_NAME).max(63,m.MAX_LENGTH.DATABASE_NAME).regex(z.DATABASE_NAME,m.DATABASE_NAME);function lc(e,t=z.IDENTIFIER,n=m.IDENTIFIER){return s.string().min(2,m.IDENTIFIER_MIN_LENGTH).max(50,e).regex(t,n).refine(a=>!a.endsWith("-"),{message:m.IDENTIFIER_NO_TRAILING_HYPHEN}).refine(a=>!a.includes("--"),{message:m.IDENTIFIER_NO_CONSECUTIVE_HYPHENS})}co(lc,"identifierSchema");var fe=lc(m.MAX_LENGTH.APP_NAME),x1=lc(m.MAX_LENGTH.APP_NAME,z.NEW_APP_NAME,m.NEW_APP_NAME),kr=s.number().int(m.PORT.INTEGER).min(PE,m.PORT.MIN).max(CE,m.PORT.MAX),xe=s.object({key:s.string(),sourceText:s.string()}).strict(),Ik=s.object({__identifier:s.string()}).strict(),$k=s.object({__expression:s.string()}).strict(),Tk=s.object({__call:s.string()}).strict(),Nk=s.union([Ik,$k,Tk]),Rk=s.union([s.string(),s.number(),s.boolean(),Nk]),Gn=s.record(s.string().regex(z.ENV_VAR_NAME,m.ENV_VAR_NAME),Rk),Pk=s.object({id:s.string(),name:s.string().optional(),arn:s.string().optional(),field:s.string().optional()}).strict().refine(e=>e.name!==void 0!=(e.arn!==void 0),{message:"secretsImport requires exactly one of `name` or `arn`."}),FE=s.record(s.string(),Pk),I1=s.record(s.string(),s.unknown()),$g=s.enum(no).describe(`Application type must be one of: ${no.join(", ")}`),Tg=s.enum(yt).describe(`OpenNext deployment pattern: ${yt.join(", ")}`),Ck=s.enum(["before-imports","after-imports","after-app-init","after-tags","after-resource","end-of-file"]),kk=s.enum(["import","app-init","tags","database","compute","storage","network","messaging","cdn","pattern","vpc-peer","vpc-peer-accepter","cross-plan-connection","custom"]),ZE=s.object({sourceText:s.string(),position:Ck,afterManagedResource:s.object({type:kk,name:s.string().optional()}).strict().optional(),originalLine:s.number().int().optional(),leadingComments:s.array(s.string()).optional(),orphaned:s.boolean().optional(),orphanedComment:s.string().optional()}).strict(),VE=s.union([s.object({tier:s.enum(mt)}).strict(),s.literal(!1)]),BE=s.union([s.object({instanceType:s.string().optional()}).strict(),s.literal(!1)]),Dk=lc(m.MAX_LENGTH.ORGANISATION_NAME),Ok=s.string().regex(z.EMAIL,m.EMAIL),zE=s.string().refine(e=>Ct.includes(e),{message:m.REGION}),$1=s.object({name:Dk,email:Ok,accountName:s.string().optional(),primaryRegion:zE.optional().default(tr),secondaryRegions:s.array(zE).optional(),security:s.enum(NE).optional(),force:s.boolean().optional()}).strict();function lo(e){return e.issues.map(t=>`${t.path.length>0?`${t.path.join(".")}: `:""}${t.message}`).join(`
 `)}co(lo,"getZodErrorMessage");var dc=s.number().min(1,m.ALARM.PERCENTAGE.MIN).max(100,m.ALARM.PERCENTAGE.MAX),Ng=s.union([dc,s.literal(!1)]),wk=s.number().min(1,m.ALARM.FREE_STORAGE_GIB.MIN),GE=s.union([s.literal(!1),s.object({cpuThreshold:Ng.optional(),memoryThreshold:Ng.optional(),runningTasksMinimum:s.number().int().min(0).optional(),http5xxThreshold:Ng.optional()}).strict()]),WE=s.union([s.literal(!1),s.object({cpuThreshold:dc.optional(),freeStorageThresholdGiB:wk.optional(),connectionsThreshold:s.number().int().min(1).optional()}).strict()]),HE=s.union([s.literal(!1),s.object({errorRateThreshold:dc.optional(),durationThresholdPercent:dc.optional()}).strict()]);var Dt=s.number().int(m.BACKUP_RETENTION.INTEGER).min(1,m.BACKUP_RETENTION.MIN).max(35,m.BACKUP_RETENTION.MAX),mo=s.number().int(m.MONITORING_INTERVAL.INTEGER).refine(e=>rt(RE,e),{message:m.MONITORING_INTERVAL.VALUES}),pc=s.number().int(m.DATABASE.PORT.INTEGER).min(1024,m.DATABASE.PORT.MIN).max(65535,m.DATABASE.PORT.MAX),jk=s.enum(ec).describe(`Database type must be one of: ${ec.join(", ")}`),Mk=s.object({maxConnections:s.number().int(m.MAX_CONNECTIONS.INTEGER).min(1,m.MAX_CONNECTIONS.MIN).max(100,m.MAX_CONNECTIONS.MAX).optional(),maxIdleConnections:s.number().int(m.PROXY_CONFIG.MAX_IDLE_CONNECTIONS.INTEGER).min(0,m.PROXY_CONFIG.MAX_IDLE_CONNECTIONS.MIN).max(100,m.PROXY_CONFIG.MAX_IDLE_CONNECTIONS.MAX).optional(),connectionBorrowTimeout:s.number().int(m.PROXY_CONFIG.BORROW_TIMEOUT.INTEGER).min(1,m.PROXY_CONFIG.BORROW_TIMEOUT.MIN).max(3600,m.PROXY_CONFIG.BORROW_TIMEOUT.MAX).optional(),requireTLS:s.boolean().optional()}).strict().describe("RDS Proxy configuration"),zk=s.object({instanceType:s.string().optional(),availabilityZone:s.string().optional()}).strict().describe("Read replica configuration"),Uk=s.object({automaticallyAfterDays:s.number().int(m.ROTATION.INTEGER).min(1,m.ROTATION.MIN).max(365,m.ROTATION.MAX).optional()}).strict().describe("Secret rotation configuration"),fc=s.object({username:s.string().min(1,m.REQUIRED.USERNAME).max(63,m.USERNAME.MAX_LENGTH).optional(),secretRotation:Uk.optional()}).strict().describe("Database credentials configuration"),gc=Le(Mk),vc=Le(zk),Lk=s.object({scaleWithWriter:s.boolean().optional(),enableDatabaseInsights:s.boolean().optional(),identifierSuffix:s.string().min(1,m.IDENTIFIER_SUFFIX.REQUIRED).max(50,m.IDENTIFIER_SUFFIX.MAX_LENGTH).optional(),availabilityZone:s.string().optional()}).strict().describe("Configuration for a single Aurora reader instance"),po=s.object({enableDatabaseInsights:s.boolean().optional(),identifierSuffix:s.string().min(1,m.IDENTIFIER_SUFFIX.REQUIRED).max(50,m.IDENTIFIER_SUFFIX.MAX_LENGTH).optional(),availabilityZone:s.string().optional()}).strict().describe("Configuration for Aurora writer instance"),Fk=s.object({count:s.number().int(m.READER.COUNT.INTEGER).min(0,m.READER.COUNT.MIN).max(15,m.READER.COUNT.MAX).optional(),instances:s.array(Lk).max(15,m.READER_INSTANCES.MAX).optional(),defaultEnableDatabaseInsights:s.boolean().optional()}).strict().refine(e=>!(e.count!==void 0&&e.instances!==void 0),{message:m.READER_INSTANCES.COUNT_OR_INSTANCES,path:["count"]}).describe("Aurora readers configuration"),fo=Le(Fk),Zk=s.object({awsManaged:s.literal(!0)}).strict(),Vk=s.object({useCMK:s.literal(!0)}).strict(),KE=s.union([Zk,Vk]),Bk=s.object({mode:s.enum(["standard","advanced"]).optional(),encryptionKey:KE.optional()}).strict().describe("Database Insights configuration"),hc=Le(Bk),yc=s.object({storageKey:KE.optional()}).strict().describe("Encryption configuration (DESTRUCTIVE to change storageKey)"),YE=s.object({name:F,type:jk,databaseName:s.string().min(1,m.REQUIRED.DATABASE_NAME),instanceType:s.string().optional(),allocatedStorage:s.number().optional(),multiAz:s.boolean().optional(),publiclyAccessible:s.boolean().optional(),databaseInsights:hc.optional(),port:pc.optional(),deletionProtection:s.boolean().optional(),proxy:gc.optional(),credentials:fc.optional(),readReplica:vc.optional(),encryption:yc.optional(),writer:po.optional(),readers:fo.optional(),backupRetention:Dt.optional(),preferredMaintenanceWindow:s.string().optional(),monitoringInterval:mo.optional(),primaryRegion:s.string().optional(),secondaryRegions:s.array(s.string()).optional(),globalClusterIdentifier:s.string().optional(),enableGlobalWriteForwarding:s.boolean().optional(),snapshotIdentifier:s.string().optional(),snapshotUsername:s.string().optional(),databaseEngine:s.enum(Zn).optional(),engineExpression:s.string().optional(),variableName:s.string().optional(),extraProperties:s.array(xe).optional(),alarms:WE.optional()}).strict(),bc=s.object({appName:fe,nameProvidedByFlag:s.boolean().optional(),databaseName:s.string().min(1,m.REQUIRED.DATABASE_NAME).max(63,m.MAX_LENGTH.DATABASE_NAME).regex(z.DATABASE_NAME,m.DATABASE_NAME),resourceName:F.optional(),connectionConfig:s.object({connectToCompute:s.array(s.string()).optional(),connectToServices:s.array(s.string()).optional()}).strict().optional(),databaseInsights:hc.optional(),port:pc.optional(),proxy:gc.optional(),credentials:fc.optional(),encryption:yc.optional(),deletionProtection:s.boolean().optional()}).strict(),XE={databaseType:s.literal("Instance"),instanceType:s.string().optional(),multiAz:s.boolean().optional(),readReplica:vc.optional(),publiclyAccessible:s.boolean().optional(),backupRetention:Dt.optional(),allocatedStorage:s.number().optional(),snapshotIdentifier:s.string().optional(),snapshotUsername:s.string().optional()},JE={databaseType:s.literal("Aurora"),writer:po.optional(),readers:fo.optional(),backupRetention:Dt.optional(),preferredMaintenanceWindow:s.string().optional(),monitoringInterval:mo.optional(),snapshotIdentifier:s.string().optional(),snapshotUsername:s.string().optional()},qE={databaseType:s.literal("GlobalAurora"),primaryRegion:s.string().min(1,m.GLOBAL_AURORA.PRIMARY_REGION_REQUIRED),secondaryRegions:s.array(s.string()).optional(),globalClusterIdentifier:s.string().optional(),enableGlobalWriteForwarding:s.boolean().optional(),writer:po.optional(),readers:fo.optional(),backupRetention:Dt.optional(),preferredMaintenanceWindow:s.string().optional(),monitoringInterval:mo.optional(),snapshotIdentifier:s.string().optional(),snapshotUsername:s.string().optional()},QE=s.object({appName:fe,nameProvidedByFlag:s.boolean().optional(),databaseName:s.string().min(1,m.REQUIRED.DATABASE_NAME).max(63,m.MAX_LENGTH.DATABASE_NAME).regex(z.DATABASE_NAME,m.DATABASE_NAME),resourceName:F.optional(),connectionConfig:s.object({connectToCompute:s.array(s.string()).optional(),connectToServices:s.array(s.string()).optional()}).strict().optional()}).strict(),eA={databaseType:s.literal("ClickHouse"),instanceType:s.string().optional(),coldTier:s.union([s.object({mode:s.literal("s3")}).strict(),s.literal(!1)]).optional(),optimiseSchedule:s.union([s.string(),s.literal(!1)]).optional(),backupSchedule:s.union([s.string(),s.literal(!1)]).optional(),backupRetentionDays:Dt.optional()},Gk=bc.extend(XE).strict(),Wk=bc.extend(JE).strict(),Hk=bc.extend(qE).strict(),Kk=QE.extend(eA).strict(),j1=s.discriminatedUnion("databaseType",[Gk,Wk,Hk,Kk]),Rg=bc.extend({resourceName:F}).strict(),Yk=Rg.extend(XE).strict(),Xk=Rg.extend(JE).strict(),Jk=Rg.extend(qE).strict(),qk=QE.extend({resourceName:F}).strict(),Qk=qk.extend(eA).strict(),M1=s.discriminatedUnion("databaseType",[Yk,Xk,Jk,Qk]),z1=s.object({appName:fe,databaseName:s.string().min(1,m.REQUIRED.DATABASE_NAME),maxConnections:s.number().int(m.MAX_CONNECTIONS.INTEGER).min(1,m.MAX_CONNECTIONS.MIN).max(100,m.MAX_CONNECTIONS.MAX).optional(),maxIdleConnections:s.number().int(m.PROXY_CONFIG.MAX_IDLE_CONNECTIONS.INTEGER).min(0,m.PROXY_CONFIG.MAX_IDLE_CONNECTIONS.MIN).max(100,m.PROXY_CONFIG.MAX_IDLE_CONNECTIONS.MAX).optional(),connectionBorrowTimeout:s.number().int(m.PROXY_CONFIG.BORROW_TIMEOUT.INTEGER).min(1,m.PROXY_CONFIG.BORROW_TIMEOUT.MIN).max(3600,m.PROXY_CONFIG.BORROW_TIMEOUT.MAX).optional(),requireTLS:s.boolean().optional(),nameProvidedByFlag:s.boolean().optional()}).strict(),eD=["S","N","B"],mc=s.object({name:s.string(),type:s.enum(eD)}).strict(),tA=s.object({name:F,partitionKey:mc,sortKey:mc.optional(),globalSecondaryIndexes:s.array(s.object({indexName:s.string(),partitionKey:mc,sortKey:mc.optional()}).strict()).optional(),ttlAttribute:s.string().optional(),stream:s.boolean().optional(),variableName:s.string().optional(),extraProperties:s.array(xe).optional()}).strict(),tD=s.object({mode:s.literal("s3")}).strict(),rA=s.object({name:F,type:s.literal("ClickHouse"),databaseName:LE,instanceType:s.string().optional(),coldTier:s.union([tD,s.literal(!1)]).optional(),optimiseSchedule:s.union([s.string(),s.literal(!1)]).optional(),backupSchedule:s.union([s.string(),s.literal(!1)]).optional(),backupRetentionDays:Dt.optional(),variableName:s.string().optional(),extraProperties:s.array(xe).optional()}).strict();var rD=s.object({count:s.number().int(m.NAT_GATEWAY.INTEGER).min(0,m.NAT_GATEWAY.MIN).max(3,m.NAT_GATEWAY.MAX).optional()}).strict().describe("NAT gateway configuration"),nA=Le(rD),Pg=s.enum(["cloudwatch","s3"]),nD=s.object({destination:Pg.optional(),retentionDays:s.number().int(m.RETENTION_DAYS.INTEGER).min(1,m.RETENTION_DAYS.MIN).max(365,m.RETENTION_DAYS.MAX).optional(),trafficType:s.enum(["ALL","ACCEPT","REJECT"]).optional()}).strict().describe("VPC flow log configuration"),aA=Le(nD),aD=s.object({s3:s.boolean().optional(),dynamodb:s.boolean().optional()}).strict().describe("Gateway VPC endpoints (FREE)"),oD=Le(aD),iD=s.object({ecr:s.boolean().optional(),secretsManager:s.boolean().optional(),kms:s.boolean().optional(),cloudwatchLogs:s.boolean().optional(),ssm:s.boolean().optional(),sts:s.boolean().optional()}).strict().describe("Interface VPC endpoints (cost per hour)"),sD=Le(iD),cD=s.object({gateway:oD.optional(),interface:sD.optional()}).strict().describe("VPC endpoints configuration"),oA=Le(cD),Sc=s.object({maxAzs:s.number().int(m.MAX_AZS.INTEGER).min(1,m.MAX_AZS.MIN).max(3,m.MAX_AZS.MAX).optional(),natGateways:nA.optional(),flowLogs:aA.optional(),vpcEndpoints:oA.optional(),cidrMask:s.number().int(m.CIDR_MASK.INTEGER).min(16,m.CIDR_MASK.MIN).max(28,m.CIDR_MASK.MAX).optional()}).strict(),iA=s.string().min(1,m.REQUIRED.NETWORK_NAME).max(50,m.MAX_LENGTH.NETWORK_NAME).regex(z.RESOURCE_NAME,m.RESOURCE_NAME),sA=Sc.extend({name:iA}).strict(),cA=Le(Sc),V1=s.object({appName:fe,networkName:iA.optional(),maxAzs:s.number().int(m.MAX_AZS.INTEGER).min(1,m.MAX_AZS.MIN).max(3,m.MAX_AZS.MAX).optional(),natGateways:nA.optional(),flowLogs:aA.optional(),vpcEndpoints:oA.optional()}).strict(),uD=z.CIDR,Cg=s.string().regex(uD,m.CIDR),lD=s.object({kind:s.literal("database"),resource:s.string().min(1,m.REQUIRED.RESOURCE_REFERENCE),name:F,allowedFromCidrs:s.array(Cg),access:s.enum(["read","write","readWrite"]).optional()}).strict(),dD=s.object({kind:s.literal("ecsService"),resource:s.string().min(1,m.REQUIRED.RESOURCE_REFERENCE),serviceName:s.string().min(1,m.REQUIRED.SERVICE_NAME),name:F,allowedFromCidrs:s.array(Cg),port:kr.optional()}).strict(),mD=s.discriminatedUnion("kind",[lD,dD]),B1=s.object({name:F,peerAppName:s.string().min(1,m.REQUIRED.APP_NAME),peerAccountId:s.string().regex(z.AWS_ACCOUNT_ID,m.AWS_ACCOUNT_ID),peerRegion:s.string().min(1,m.VPC_PEER.REGION_REQUIRED).optional(),peerVpcId:s.string().regex(z.VPC_ID,m.VPC_ID).optional(),peerVpcCidr:Cg.optional(),peerRoleArn:s.string().regex(z.ROLE_ARN,m.ROLE_ARN).optional(),peerRouteTableIds:s.array(s.string().min(1,m.VPC_PEER.ROUTE_TABLE_ID_REQUIRED)).optional(),localVpcName:s.string().min(1,m.REQUIRED.NETWORK_NAME).optional(),enableDnsResolution:s.boolean().optional()}).strict(),G1=s.object({name:F,requesterAccountIds:s.array(s.string().regex(z.AWS_ACCOUNT_ID,m.AWS_ACCOUNT_ID)).min(1,m.VPC_PEER.MIN_REQUESTER_ACCOUNTS),localVpcName:s.string().min(1,m.REQUIRED.NETWORK_NAME).optional(),publishToSsm:s.boolean().optional(),exposedResources:s.array(mD).optional()}).strict();var _c=["storage","cdn","compute"],pD=s.object({sid:s.string().optional(),effect:s.enum(["Allow","Deny"]),principals:s.array(s.string()),actions:s.array(s.string()),resources:s.array(s.string()).optional(),conditions:s.record(s.string(),s.record(s.string(),s.union([s.string(),s.array(s.string())]))).optional()}).strict(),uA=s.object({name:F,bucketName:s.string().optional(),publicReadAccess:s.boolean().optional(),websiteHosting:s.object({indexDocument:s.string(),errorDocument:s.string().optional()}).strict().optional(),backupVaultTier:s.enum(mt).optional(),versioned:s.boolean().optional(),encryption:s.enum(Bn).optional(),kmsKeyArn:s.string().optional(),cors:s.array(s.object({allowedOrigins:s.array(s.string()),allowedMethods:s.array(s.string()),allowedHeaders:s.array(s.string()).optional(),exposedHeaders:s.array(s.string()).optional(),maxAge:s.number().optional()}).strict()).optional(),deployment:s.object({source:s.string(),prune:s.boolean().optional(),cacheControl:s.object({maxAge:s.number().optional(),immutable:s.boolean().optional()}).strict().optional()}).strict().optional(),retain:s.boolean().optional(),resourcePolicyStatements:s.array(pD).optional(),stackPlacement:s.enum(_c).optional(),variableName:s.string().optional(),extraProperties:s.array(xe).optional()}).strict().refine(e=>e.encryption!=="KMS"||!!e.kmsKeyArn,{message:m.KMS.KEY_REQUIRED}),J1=s.object({appName:fe,bucketName:UE,nameProvidedByFlag:s.boolean().optional(),storagePreset:s.enum(ME).optional(),publicReadAccess:s.boolean().optional(),websiteHosting:s.object({indexDocument:s.string(),errorDocument:s.string().optional()}).strict().optional(),backupVaultTier:s.enum(mt).optional(),versioned:s.boolean().optional(),encryption:s.enum(Bn).optional(),kmsKeyArn:s.string().optional(),cors:s.array(s.object({allowedOrigins:s.array(s.string()),allowedMethods:s.array(s.string()),allowedHeaders:s.array(s.string()).optional(),exposedHeaders:s.array(s.string()).optional(),maxAge:s.number().optional()}).strict()).optional(),connectionConfig:s.object({connectToCompute:s.array(s.string()).optional(),connectToServices:s.array(s.string()).optional()}).strict().optional()}).strict().refine(e=>e.encryption!=="KMS"||!!e.kmsKeyArn,{message:m.KMS.KEY_REQUIRED,path:["kmsKeyArn"]});var kg=s.enum(["DESTROY","RETAIN"]),lA=s.object({name:F,queueType:s.enum(["standard","fifo"]).default("standard"),visibilityTimeout:s.number().int(m.SQS.VISIBILITY_TIMEOUT.INTEGER).min(0,m.SQS.VISIBILITY_TIMEOUT.MIN).max(43200,m.SQS.VISIBILITY_TIMEOUT.MAX).optional(),retentionPeriod:s.number().int(m.SQS.RETENTION_PERIOD.INTEGER).min(60,m.SQS.RETENTION_PERIOD.MIN).max(1209600,m.SQS.RETENTION_PERIOD.MAX).optional(),contentBasedDeduplication:s.boolean().optional(),removalPolicy:kg.optional(),variableName:s.string().optional(),extraProperties:s.array(xe).optional()}).strict();var dA=s.object({type:s.literal("basic-auth"),username:s.string().min(1),password:s.string().min(1)}).strict(),mA=s.object({name:F,defaultOriginRef:s.string(),behaviours:s.array(s.object({pathPattern:s.string(),originRef:s.string(),cachePolicy:s.enum(["CACHING_OPTIMIZED","CACHING_DISABLED"]).optional()}).strict()).optional(),customDomain:s.string().optional(),certificateArn:s.string().optional(),accessGate:s.union([s.literal(!1),dA]).optional(),extraProperties:s.array(xe).optional()}).strict(),o4=s.object({appName:s.string(),name:F.optional(),defaultOriginRef:s.string(),behaviours:s.array(s.object({pathPattern:s.string(),originRef:s.string(),cachePolicy:s.enum(["CACHING_OPTIMIZED","CACHING_DISABLED"]).optional()}).strict()).optional(),customDomain:s.string().optional(),certificateArn:s.string().optional(),accessGate:s.union([s.literal(!1),dA]).optional(),nameProvidedByFlag:s.boolean().optional()}).strict();var fD=Object.defineProperty,Dg=(e,t)=>fD(e,"name",{value:t,configurable:!0}),gD=new Set(["t4g","c6g","c6gd","c6gn","c7g","c7gd","c7gn","r6g","r6gd","r7g","r7gd","r8g","r8gd","c8g","c8gd","c8gn","m6g","m6gd","m7g","m7gd","m8g","m8gd","x8g","i8g","a1","x2gd","im4gn","is4gen","i4g","hpc7g"]);function Wn(e){let t=e.split(".")[0]??"";return gD.has(t)?"ARM":"STANDARD"}Dg(Wn,"getArchitectureForInstanceType");function Ec(e,t){let n=Wn(e);return n!==t?{valid:!1,message:`Instance type '${e}' requires ${n} architecture, but '${t}' AMI was specified. Use a ${n==="ARM"?"Graviton instance (t4g, c6g, r6g, m6g, etc.)":"Intel/AMD instance (t3, c5, r5, m5, etc.)"} instead.`}:{valid:!0}}Dg(Ec,"validateArchitectureMatch");function pA(e,t){return Wn(e)===t}Dg(pA,"isArchitectureCompatible");var vD=Object.defineProperty,Ac=(e,t)=>vD(e,"name",{value:t,configurable:!0});var hD=1;var yD=/^[A-Za-z0-9_.-]+$/,bD=s.object({id:s.string().min(1,"buildSecret id cannot be empty").regex(yD,"buildSecret id may contain only letters, digits, '_', '.', and '-' (no comma, '=', or whitespace, which would break the buildx --secret argv)"),ssm:s.string().min(1,"ssm parameter name cannot be empty").optional(),secretsManager:s.object({name:s.string().min(1,"secret name cannot be empty").optional(),arn:s.string().min(1,"secret arn cannot be empty").optional(),field:s.string().min(1,"secret field cannot be empty").optional()}).strict().refine(e=>e.name===void 0!=(e.arn===void 0),"secretsManager requires exactly one of name or arn").optional(),env:s.string().min(1,"env variable name cannot be empty").optional()}).strict().superRefine((e,t)=>{[e.ssm,e.secretsManager,e.env].filter(n=>n!==void 0).length!==1&&t.addIssue({code:s.ZodIssueCode.custom,message:"buildSecret requires exactly one source (ssm, secretsManager, or env)"})}),SD=s.union([s.string(),s.object({ssm:s.string().min(1,"ssm parameter name cannot be empty").optional(),secretsManager:s.object({name:s.string().min(1,"secret name cannot be empty").optional(),arn:s.string().min(1,"secret arn cannot be empty").optional(),field:s.string().min(1,"secret field cannot be empty").optional()}).strict().refine(e=>e.name===void 0!=(e.arn===void 0),"secretsManager requires exactly one of name or arn").optional(),env:s.string().min(1,"env variable name cannot be empty").optional(),acknowledgePublic:s.boolean().optional()}).strict().superRefine((e,t)=>{[e.ssm,e.secretsManager,e.env].filter(n=>n!==void 0).length!==1&&t.addIssue({code:s.ZodIssueCode.custom,message:"buildArg value requires exactly one source (ssm, secretsManager, or env)"})})]),bt=s.object({path:s.string(),context:s.string().min(1,"context cannot be empty").optional(),target:s.string().min(1,"target cannot be empty").optional(),buildArgs:s.record(s.string(),SD).optional(),buildSecrets:s.array(bD).optional()}).strict(),l4=bt.partial();function _D(e,t){if(t===void 0)return e;let n=t.context??e.context,a=t.target??e.target,r=t.buildArgs??e.buildArgs,o=t.buildSecrets??e.buildSecrets;return{path:t.path??e.path,...n!==void 0&&{context:n},...a!==void 0&&{target:a},...r!==void 0&&{buildArgs:r},...o!==void 0&&{buildSecrets:o}}}Ac(_D,"mergeDockerBuild");function Og(e){return typeof e=="object"&&e!==null&&!Array.isArray(e)}Ac(Og,"isRecord");function fA(e){if(!Og(e)||typeof e.path!="string"||e.path.length===0)return;let t=typeof e.context=="string"&&e.context.length>0?e.context:void 0,n=typeof e.target=="string"&&e.target.length>0?e.target:void 0,a=Og(e.buildArgs)&&Object.keys(e.buildArgs).length>0?e.buildArgs:void 0,r=Array.isArray(e.buildSecrets)&&e.buildSecrets.length>0?e.buildSecrets:void 0,o={path:e.path,...t!==void 0&&{context:t},...n!==void 0&&{target:n},...a!==void 0&&{buildArgs:a},...r!==void 0&&{buildSecrets:r}},i=bt.safeParse(o);return i.success?i.data:void 0}Ac(fA,"normaliseDockerBuild");function ED(e){if(e===void 0)return;let t=fA(e);return t===void 0?void 0:JSON.stringify(t)}Ac(ED,"dockerBuildFingerprint");var AD=s.object({name:s.string(),clusterName:s.string().optional(),docker:bt.optional(),containerPort:s.number().optional(),secrets:s.array(s.string()).optional(),ssmSecretsPath:s.string().optional(),importedSecretNames:s.array(s.string()).optional(),schemaGateImageTag:s.string().optional()}).strict(),xD=s.object({type:s.enum(yt),name:s.string(),source:s.string()}).strict(),ID=s.object({repositoryName:s.string()}).strict(),$D=["x86_64","arm64"],TD=s.object({name:s.string(),secrets:s.array(s.string()).optional(),ssmSecretsPath:s.string().optional(),importedSecretNames:s.array(s.string()).optional(),docker:bt.optional(),imageKey:s.string().optional(),architecture:s.enum($D).optional()}).strict(),ND=s.object({templateHash:s.string(),synthTimestamp:s.string()}).strict(),RD=s.object({constructPath:s.string().max(512),group:s.string().max(128),resourceType:s.string().max(256)}).strict(),PD=s.object({synthesisedBy:s.string().min(1).max(128),minimumEngineVersion:s.string().min(1).max(32),maximumEngineMajor:s.number().int().min(0).optional(),minimumAwsCdkCli:s.string().min(1).max(32).optional()}).strict(),CD=s.object({appName:s.string().min(1).max(128),slot:s.string().min(1).max(64),clusterName:s.string().min(1).max(128),anchor:s.string().min(1).max(128),pinned:s.boolean(),currentServiceName:s.string().min(1).max(256),legacyKey:s.string().min(1).max(256),legacyAnchor:s.string().min(1).max(256),legacyServiceName:s.string().min(1).max(512),legacyKeyFields:s.array(s.string().max(64)).max(32)}).strict(),kD=s.object({constructPath:s.string().min(1).max(512),resourceType:s.string().min(1).max(256),physicalNameHint:s.string().min(1).max(512),policy:s.enum(["retain","snapshot","adopted"]),destroyDisposition:s.enum(["survives","deleted-on-explicit-destroy"]),reason:s.string().min(1).max(1024),costClass:s.enum(["none","storage","fixed-monthly"]),cleanupHint:s.string().min(1).max(1024)}).strict(),d4=s.object({version:s.literal(hD),generatedAt:s.string(),appName:s.string(),services:s.array(AD),lambdas:s.array(TD),pattern:xD.optional(),ecr:ID.optional(),stacks:s.record(s.string(),ND),resourceMap:s.record(s.string(),RD).optional(),engineCompat:PD.optional(),identityAliases:s.array(CD).optional(),residuals:s.array(kD).optional()}).strict();var DD=Object.defineProperty,OD=(e,t)=>DD(e,"name",{value:t,configurable:!0});function vA(e){return!(e.image!==void 0&&e.docker!==void 0)}OD(vA,"imageDockerMutexCheck");var hA=s.number().int(m.CAPACITY.MIN.INTEGER).min(xg,m.GENERATOR_CAPACITY.MIN.MIN).max(Ig,m.GENERATOR_CAPACITY.MIN.MAX),yA=s.number().int(m.CAPACITY.MAX.INTEGER).min(xg,m.GENERATOR_CAPACITY.MAX.MIN).max(Ig,m.GENERATOR_CAPACITY.MAX.MAX),Hn=s.number().int(m.LAMBDA.MEMORY.INTEGER).min(kE,m.LAMBDA.MEMORY.MIN).max(DE,m.LAMBDA.MEMORY.MAX).refine(e=>e===128||e%64===0,m.LAMBDA.MEMORY.MULTIPLE),bA=s.string().regex(z.LAMBDA_RUNTIME_IDENTIFIER,m.LAMBDA.RUNTIME),wg=s.number().int(m.CPU.INTEGER).min(256,m.CPU.MIN).max(4096,m.CPU.MAX),Ic=s.number().int(m.CAPACITY.DESIRED.INTEGER).min(0,m.CAPACITY.DESIRED.MIN).max(Vn,m.CAPACITY.DESIRED.MAX),go=s.object({connectToDatabase:s.array(s.string()).optional()}).strict(),wD=s.object({minSize:s.number().int(m.CAPACITY.WARM_POOL.MIN_SIZE.INTEGER).min(0,m.CAPACITY.WARM_POOL.MIN_SIZE.MIN).max(OE,m.CAPACITY.WARM_POOL.MIN_SIZE.MAX).optional(),reuseOnScaleIn:s.boolean().optional()}).strict(),jg=s.object({instanceType:s.string().optional(),amiHardwareType:s.enum(ic).optional(),minCapacity:s.number().int(m.CAPACITY.MIN.INTEGER).min(0,m.CAPACITY.MIN.MIN_0).max(Vn,m.CAPACITY.MIN.MAX).optional(),maxCapacity:s.number().int(m.CAPACITY.MAX.INTEGER).min(1,m.CAPACITY.MAX.MIN_1).max(Vn,m.CAPACITY.MAX.MAX).optional(),memoryLimitMiB:uo(128).optional(),warmPool:wD.optional(),extraProperties:s.array(xe).optional()}).strict().superRefine((e,t)=>{if(!e.instanceType||!e.amiHardwareType)return;let n=Ec(e.instanceType,e.amiHardwareType);n.valid||t.addIssue({code:"custom",message:n.message??m.ARCHITECTURE_MISMATCH,path:["instanceType"]})}).superRefine((e,t)=>{e.minCapacity===0&&!e.warmPool&&t.addIssue({code:"custom",message:m.CAPACITY.WARM_POOL_REQUIRED,path:["minCapacity"]}),e.warmPool?.minSize!==void 0&&e.maxCapacity!==void 0&&e.warmPool.minSize>e.maxCapacity&&t.addIssue({code:"custom",message:m.CAPACITY.WARM_POOL.MIN_SIZE_EXCEEDS_MAX_CAPACITY,path:["warmPool","minSize"]})}),jD=s.enum(ao).describe(`Compute type must be one of: ${ao.join(", ")}`),Mg=s.enum(Ln).describe(`ECS capacity provider must be one of: ${Ln.join(", ")}`),zg=s.string().refine(e=>rt(sc,e),{message:m.INSTANCE_TYPE}),SA=s.object({sourceType:s.enum(["sqs","dynamodb","eventbridge"]),sourceRef:s.string().describe("Name of the source resource"),batchSize:s.number().int(m.BATCH_SIZE.INTEGER).min(1,m.BATCH_SIZE.MIN).max(1e4,m.BATCH_SIZE.MAX).optional(),startingPosition:s.enum(["TRIM_HORIZON","LATEST"]).optional(),maxBatchingWindow:s.number().int(m.BATCHING_WINDOW.INTEGER).min(0,m.BATCHING_WINDOW.MIN).max(300,m.BATCHING_WINDOW.MAX).optional(),reportBatchItemFailures:s.boolean().optional()}).strict(),MD=s.object({name:s.string().min(1,m.REQUIRED.CONTAINER_NAME).optional(),image:s.string().optional(),port:kr.optional(),environment:Gn.optional(),secretsImport:FE.optional(),command:s.array(s.string()).optional(),entryPoint:s.array(s.string()).optional(),essential:s.boolean().optional(),healthCheck:s.object({command:s.array(s.string()),interval:s.number().int(m.HEALTH_CHECK.INTERVAL.INTEGER).min(5,m.HEALTH_CHECK.INTERVAL.MIN).max(300,m.HEALTH_CHECK.INTERVAL.MAX).optional(),timeout:s.number().int(m.HEALTH_CHECK.TIMEOUT.INTEGER).min(2,m.HEALTH_CHECK.TIMEOUT.MIN).max(60,m.HEALTH_CHECK.TIMEOUT.MAX).optional(),retries:s.number().int(m.HEALTH_CHECK.RETRIES.INTEGER).min(1,m.HEALTH_CHECK.RETRIES.MIN).max(10,m.HEALTH_CHECK.RETRIES.MAX).optional(),startPeriod:s.number().int(m.HEALTH_CHECK.START_PERIOD.INTEGER).min(0,m.HEALTH_CHECK.START_PERIOD.MIN).max(300,m.HEALTH_CHECK.START_PERIOD.MAX).optional()}).strict().optional(),ssmSecrets:s.array(s.string().regex(z.SECRET_NAME,m.SECRET_NAME)).optional(),extraProperties:s.array(xe).optional()}).strict(),_A=s.string().min(1,m.REQUIRED.SERVICE_NAME).max(255,m.MAX_LENGTH.SERVICE_NAME).regex(z.ECS_SERVICE_NAME,m.ECS_SERVICE_NAME),EA=s.object({domain:s.string().optional(),loadBalancer:s.union([s.literal(!1),s.enum(ac)]).optional(),directAccess:s.boolean().optional(),extraProperties:s.array(xe).optional()}).strict().refine(e=>!(e.directAccess&&e.domain),{message:m.DIRECT_ACCESS.NO_DOMAIN,path:["directAccess"]}).refine(e=>!(e.directAccess&&typeof e.loadBalancer=="string"),{message:m.DIRECT_ACCESS.NO_LOAD_BALANCER}).describe("Cluster-level configuration"),xc=s.object({path:s.string().optional(),host:s.string().optional(),priority:s.number().int(m.PRIORITY.INTEGER).min(1,m.PRIORITY.MIN).max(5e4,m.PRIORITY.MAX).optional(),healthCheckPath:s.string().optional()}).strict().describe("Path/host-based routing configuration"),zD=s.object({desiredCount:Ic.optional(),minCapacity:s.number().int(m.CAPACITY.MIN.INTEGER).min(0,m.CAPACITY.MIN.MIN_0).max(Vn,m.CAPACITY.MIN.MAX).optional(),maxCapacity:s.number().int(m.CAPACITY.MAX.INTEGER).min(1,m.CAPACITY.MAX.MIN_1).max(Vn,m.CAPACITY.MAX.MAX).optional(),scalingType:s.enum(oc).optional()}).strict().refine(Cr.check,Cr.params).describe("ECS service scaling configuration"),AA=s.object({name:_A,docker:bt.optional(),needsDatabaseConnection:s.boolean().optional(),needsStorageConnection:s.boolean().optional(),needsMessagingConnection:s.boolean().optional(),image:s.string().optional(),containers:s.array(MD).optional(),routing:s.union([xc,s.array(xc).min(1)]).optional(),serviceType:s.enum(so).optional(),cpu:wg.optional(),memoryLimitMiB:uo(512).optional(),desiredCount:Ic.optional(),scaling:Le(zD).optional(),capacityProvider:Mg,ec2Config:jg.optional(),ssmSecretsPath:s.string().regex(z.SSM_PATH,m.SSM_PATH).optional(),extraProperties:s.array(xe).optional(),alarms:GE.optional()}).strict().superRefine((e,t)=>{vA(e)||t.addIssue({code:"custom",path:["docker"],message:m.IMAGE_DOCKER_MUTEX})}).describe("Configuration for a service in an ECS cluster"),xA=s.object({name:F,type:jD,needsConnection:s.boolean(),connectedDatabase:s.array(s.string()).optional(),connectedStorage:s.array(s.string()).optional(),connectedMessaging:s.array(s.string()).optional(),cluster:EA.optional(),services:s.array(AA).optional(),docker:bt.partial().optional(),deployment:s.enum(rc).optional(),codePath:s.string().optional(),timeout:s.number().int(m.LAMBDA.TIMEOUT.INTEGER).min(cc,m.LAMBDA.TIMEOUT.MIN).max(uc,m.LAMBDA.TIMEOUT.MAX).optional(),memory:Hn.optional(),handler:s.string().optional(),runtime:bA.optional(),environment:Gn.optional(),secrets:Gn.optional(),eventSources:s.array(SA).optional(),functionUrl:s.object({authType:s.enum(io)}).strict().optional(),description:s.string().optional(),scheduleExpression:s.string().optional(),architecture:s.enum(nc).optional(),ephemeralStorageSize:s.number().int(m.EPHEMERAL_STORAGE.INTEGER).min(512,m.EPHEMERAL_STORAGE.MIN).max(10240,m.EPHEMERAL_STORAGE.MAX).optional(),functionName:s.string().optional(),ssmSecrets:s.array(s.string()).optional(),ssmSecretsPath:s.string().optional(),alarms:HE.optional(),instanceType:zg.optional(),enableSSH:s.boolean().optional(),keyName:s.string().optional(),userData:s.string().optional(),securityGroups:s.array(s.string()).optional(),variableName:s.string().optional(),extraProperties:s.array(xe).optional()}).strict().superRefine((e,t)=>{if(e.type==="ecs"&&e.services)for(let n=0;n<e.services.length;n++){let a=e.services[n];a?.ec2Config?.instanceType&&!a.ec2Config.amiHardwareType&&Wn(a.ec2Config.instanceType)!=="ARM"&&t.addIssue({code:"custom",message:`Service '${a.name??n}' uses instance type '${a.ec2Config.instanceType}' (x86), which requires Docker images built for linux/amd64. The default build targets linux/arm64 (Graviton). Use a Graviton instance type (t4g, c6g, r6g, m6g, etc.) or set amiHardwareType: "STANDARD" to acknowledge x86.`,path:["services",n,"ec2Config","instanceType"]})}e.type==="lambda"&&e.deployment==="container"&&e.architecture==="X86_64"&&t.addIssue({code:"custom",message:"Lambda architecture 'X86_64' requires Docker images built for linux/amd64, but the default build targets linux/arm64. Use 'ARM_64' for Graviton Lambdas (recommended) or ensure your build pipeline targets linux/amd64.",path:["architecture"]})}),S4=s.object({appName:fe,clusterName:F,containerPort:kr,nameProvidedByFlag:s.boolean().optional(),ecrRepository:s.string().optional(),capacityProvider:Mg.optional(),useAppEcr:s.boolean().optional(),desiredCount:Ic.optional(),cpu:wg.optional(),memoryLimitMiB:uo(512).optional(),minCapacity:hA.optional(),maxCapacity:yA.optional(),ec2Config:jg.optional(),connectionConfig:go.optional()}).strict().refine(Cr.check,Cr.params),_4=s.object({appName:fe,functionName:F,nameProvidedByFlag:s.boolean().optional(),lambdaType:s.enum(["basic","web","custom"]).optional(),ecrRepository:s.string().optional(),timeout:s.number().int(m.LAMBDA.TIMEOUT.INTEGER).min(cc,m.LAMBDA.TIMEOUT.MIN).max(uc,m.LAMBDA.TIMEOUT.MAX).optional(),memory:Hn.optional(),enableFunctionUrl:s.boolean().optional(),description:s.string().optional(),enableCors:s.boolean().optional(),corsOrigins:s.string().optional(),corsHeaders:s.string().optional(),corsMethods:s.array(s.enum(jE)).optional(),corsCredentials:s.boolean().optional(),connectionConfig:go.optional()}).strict(),E4=s.object({appName:fe,instanceName:F,nameProvidedByFlag:s.boolean().optional(),instanceType:zg.optional(),enableSSH:s.boolean().optional(),minCapacity:hA.optional(),maxCapacity:yA.optional(),connectionConfig:go.optional()}).strict().refine(Cr.check,Cr.params),A4=s.object({appName:fe,clusterName:F,serviceName:_A,capacityProvider:Mg,containerPort:kr.optional(),cpu:wg.optional(),memoryLimitMiB:uo(512).optional(),desiredCount:Ic.optional(),ec2Config:jg.optional(),routing:s.union([xc,s.array(xc).min(1)]).optional(),docker:bt.partial().optional(),nameProvidedByFlag:s.boolean().optional(),connectionConfig:go.optional()}).strict(),Ug=s.object({appName:fe,computeName:F,nameProvidedByFlag:s.boolean().optional(),connectionConfig:go.optional()}).strict(),UD=Ug.extend({type:s.literal("ecs"),cluster:EA.optional(),services:s.array(AA).min(1,m.SERVICE.MIN_REQUIRED),docker:bt.partial().optional()}).strict().refine(e=>{let t=e.services.filter(n=>n.containers?.some(a=>a.port));return t.length>1?t.every(n=>(Array.isArray(n.routing)?n.routing:n.routing?[n.routing]:[]).some(a=>a.path||a.host)):!0},{message:m.SERVICE.ROUTING_REQUIRED}).refine(e=>{let t=e.services.map(n=>n.name);return new Set(t).size===t.length},{message:m.SERVICE.UNIQUE_WITHIN_CLUSTER}),LD=Ug.extend({type:s.literal("lambda"),timeout:s.number().int(m.LAMBDA.TIMEOUT.INTEGER).min(cc,m.LAMBDA.TIMEOUT.MIN).max(uc,m.LAMBDA.TIMEOUT.MAX).optional(),memory:Hn.optional(),handler:s.string().optional(),runtime:bA.optional(),environment:Gn.optional(),secrets:Gn.optional(),description:s.string().optional(),functionUrl:s.union([s.object({authType:s.enum(io).optional()}).strict(),s.literal(!1)]).optional(),eventSources:s.array(SA).optional()}).strict(),FD=Ug.extend({type:s.literal("ec2"),instanceType:zg.optional(),enableSSH:s.boolean().optional(),keyName:s.string().optional(),userData:s.string().optional(),securityGroups:s.array(s.string()).optional()}).strict(),x4=s.discriminatedUnion("type",[UD,LD,FD]),gA=s.object({path:s.string().min(1,m.REQUIRED.ROUTING_PATH),priority:s.number().int(m.PRIORITY.INTEGER).min(1,m.PRIORITY.MIN).max(5e4,m.PRIORITY.MAX).optional()}).strict(),IA=s.object({name:s.string().min(1,m.REQUIRED.SERVICE_NAME).max(255,m.MAX_LENGTH.SERVICE_NAME).regex(z.RESOURCE_NAME,m.RESOURCE_NAME),serviceType:s.enum(so).optional(),docker:bt.partial().optional(),containerPort:kr.optional(),needsDatabaseConnection:s.boolean().optional(),routing:s.union([gA,s.array(gA).min(1)]).optional()}).strict().superRefine((e,t)=>{e.serviceType==="worker"&&(e.containerPort!==void 0&&t.addIssue({code:"custom",path:["containerPort"],message:"Worker services are not reachable inbound; remove containerPort."}),e.routing!==void 0&&t.addIssue({code:"custom",path:["routing"],message:"Worker services have no ALB route; remove routing."}))}),I4=s.object({appName:fe,instanceType:s.string().optional()}).strict();var Lg=s.object({memorySize:Hn.optional(),timeout:s.number().int(m.LAMBDA.TIMEOUT.INTEGER).min(1,m.LAMBDA.TIMEOUT.MIN).max(900,m.LAMBDA.TIMEOUT.MAX).optional(),ephemeralStorageSize:s.number().int(m.EPHEMERAL_STORAGE.INTEGER).min(512,m.EPHEMERAL_STORAGE.MIN).max(10240,m.EPHEMERAL_STORAGE.MAX).optional()}).strict(),$A=s.object({type:s.enum(Ag).optional(),databaseName:s.string().optional(),databaseEngine:s.enum(Zn).optional(),deletionProtection:s.boolean().optional(),backupRetention:Dt.optional(),port:pc.optional(),publiclyAccessible:s.boolean().optional(),allowedIpCidr:s.string().optional(),instanceType:s.string().optional(),allocatedStorage:s.number().int(m.ALLOCATED_STORAGE.INTEGER).min(20,m.ALLOCATED_STORAGE.MIN).max(65536,m.ALLOCATED_STORAGE.MAX).optional(),multiAz:s.boolean().optional(),readReplica:vc.optional(),writer:po.optional(),readers:fo.optional(),allowVpcAccess:s.boolean().optional(),monitoringInterval:mo.optional(),preferredMaintenanceWindow:s.string().optional(),databaseInsights:hc.optional(),proxy:gc.optional(),credentials:fc.optional(),encryption:yc.optional(),snapshotIdentifier:s.string().optional(),snapshotUsername:s.string().optional()}).strict(),TA=s.object({server:Lg.optional(),imageOptimisation:Lg.optional(),revalidation:Lg.optional()}).strict(),Fg=s.object({versioned:s.boolean().optional()}).strict(),NA=s.object({assets:Fg.optional(),cache:Fg.optional(),media:Fg.optional()}).strict(),ZD=s.object({visibilityTimeout:s.number().int(m.SQS.VISIBILITY_TIMEOUT.INTEGER).min(0,m.SQS.VISIBILITY_TIMEOUT.MIN).max(43200,m.SQS.VISIBILITY_TIMEOUT.MAX).optional(),messageRetentionPeriod:s.number().int(m.SQS.RETENTION_PERIOD.INTEGER).min(60,m.SQS.RETENTION_PERIOD.MIN).max(1209600,m.SQS.RETENTION_PERIOD.MAX).optional(),maxMessageSize:s.number().int(m.MAX_MESSAGE_SIZE.INTEGER).min(1024,m.MAX_MESSAGE_SIZE.MIN).max(262144,m.MAX_MESSAGE_SIZE.MAX).optional(),deadLetterQueue:s.union([s.literal(!1),s.object({enabled:s.boolean().optional(),maxReceiveCount:s.number().int(m.DLQ.MAX_RECEIVE_COUNT.INTEGER).min(1,m.DLQ.MAX_RECEIVE_COUNT.MIN).max(1e3,m.DLQ.MAX_RECEIVE_COUNT.MAX).optional()}).strict()]).optional()}).strict(),RA=s.object({revalidationQueue:ZD.optional()}).strict(),PA=s.object({domainNames:s.array(s.string()).optional(),certificateArn:s.string().optional()}).strict(),CA=s.record(s.string().regex(z.ENV_VAR_NAME,m.ENV_VAR_NAME),s.string()).optional(),VD=s.object({type:s.literal("payload"),name:s.string().min(1,m.REQUIRED.PATTERN_NAME),domain:s.string().optional(),database:$A.optional(),compute:TA.optional(),storage:NA.optional(),messaging:RA.optional(),cdn:PA.optional(),environment:CA}).strict(),BD=s.object({type:s.literal("nextjs"),name:s.string().min(1,m.REQUIRED.PATTERN_NAME),domain:s.string().optional(),database:$A.optional(),compute:TA.optional(),storage:NA.optional(),messaging:RA.optional(),cdn:PA.optional(),environment:CA}).strict(),Zg=s.enum(ro),GD=s.object({command:s.string().min(1,m.REQUIRED.BUILD_COMMAND),outputDir:s.string().min(1,m.REQUIRED.OUTPUT_DIR)}).strict(),WD=s.object({headers:s.boolean().optional(),contentSecurityPolicy:s.string().optional()}).strict(),HD=s.object({to:s.string().min(1,m.REQUIRED.FORMS_TO).regex(z.EMAIL,m.EMAIL),from:s.string().regex(z.EMAIL,m.EMAIL).optional(),corsOrigin:s.string().regex(z.HTTP_ORIGIN,"corsOrigin must be an exact origin such as https://example.com (no path, no trailing slash)").optional(),maxConcurrency:s.number().int().min(1).max(100).optional()}).strict(),KD=s.object({behaviours:s.array(s.unknown()).optional()}).strict(),Vg=s.object({type:s.literal("staticsite"),name:s.string().min(1,m.REQUIRED.PATTERN_NAME),source:s.string().min(1,m.REQUIRED.SOURCE),build:GD,routing:Zg.optional(),security:WD.optional(),domain:s.string().optional(),forms:HD.optional(),cdn:KD.optional()}).strict().superRefine((e,t)=>{if(e.forms===void 0)return;let n=e.domain;if(n===void 0||n===""){t.addIssue({code:"custom",path:["domain"],message:"A domain is required when forms are enabled: SES sends only from a verified identity, and the site's domain is the identity the pattern verifies"});return}let a=e.forms.from;a!==void 0&&!Xs(a,n)&&t.addIssue({code:"custom",path:["forms","from"],message:`forms.from must be an address at ${n} (the verified SES identity) \u2014 for example noreply@${n}. Use forms.to for the recipient.`})}),vo=s.discriminatedUnion("type",[VD,BD,Vg]),kA=s.enum(["lightweight","standard","resilient","custom"]),DA=s.object({type:s.enum(Ag),instanceType:s.string().optional(),backupRetention:Dt.optional(),deletionProtection:s.boolean().optional(),encryption:s.union([s.object({useCMK:s.literal(!0)}).strict(),s.literal(!1)]).optional()}).strict(),OA=s.object({memorySize:Hn.optional(),timeout:s.number().int(m.LAMBDA.TIMEOUT.INTEGER).min(1,m.LAMBDA.TIMEOUT.MIN).max(900,m.LAMBDA.TIMEOUT.MAX).optional()}).strict();var wA=s.object({appName:fe,type:$g,pattern:Tg.optional(),patternConfig:vo.optional(),owner:s.string().optional(),tags:s.record(s.string(),s.string()).optional(),vpcId:s.string().optional(),network:Sc.optional(),backup:VE.optional(),tunnel:BE.optional(),additionalNetworks:s.array(sA).optional(),database:s.array(YE),s3:s.array(uA),compute:s.array(xA),dynamodb:s.array(tA).optional(),clickhouse:s.array(rA).optional(),sqs:s.array(lA).optional(),cdn:mA.optional(),customCodeBlocks:s.array(ZE).optional(),additionalManagedImports:s.array(s.object({moduleSpecifier:s.string(),namedImports:s.array(s.string()),defaultImport:s.string().optional()}).strict()).optional()}).strict(),G4=s.object({name:fe,type:$g,pattern:Tg.optional(),patternTier:kA.optional(),patternDomain:s.string().optional(),source:s.string().min(1,m.REQUIRED.SOURCE).optional(),buildCommand:s.string().min(1,m.REQUIRED.BUILD_COMMAND).optional(),outputDir:s.string().min(1,m.REQUIRED.OUTPUT_DIR).optional(),routing:Zg.optional(),formsTo:s.string().min(1,m.REQUIRED.FORMS_TO).regex(z.EMAIL,m.EMAIL).optional(),corsOrigin:s.string().regex(z.HTTP_ORIGIN,"corsOrigin must be an exact origin such as https://example.com (no path, no trailing slash)").optional(),customDatabase:DA.optional(),customCompute:OA.optional(),region:s.string().optional(),owner:s.string().optional(),includeDatabase:s.boolean().optional(),databaseName:s.string().min(1,m.DATABASE.NAME.REQUIRED).max(63,m.DATABASE.NAME.MAX_LENGTH).optional(),vpcId:s.string().optional(),network:cA.optional(),services:s.array(IA).optional(),snapshotIdentifier:s.string().optional(),snapshotUsername:s.string().optional()}).strict().superRefine((e,t)=>{e.formsTo!==void 0&&(e.patternDomain!==void 0&&e.patternDomain!==""||t.addIssue({code:"custom",path:["patternDomain"],message:"A domain is required when forms are enabled: SES sends only from a verified identity, and the site's domain is the identity the pattern verifies"}))}),W4=s.object({name:F,localResource:s.string().min(1),remoteApp:s.string().min(1),remoteResource:s.string().min(1),permission:s.enum(["read","write","read-write"]),remoteArn:s.string().optional()}).strict();var YD=["fjall-managed","external","external-manual"],J4=s.enum(YD);var jA=s.object({givenName:s.string().min(1),familyName:s.string().min(1),displayName:s.string().min(1).optional(),expires:s.string().min(1).optional()}).strict(),MA=s.object({name:s.string().min(1),path:s.string().min(1).optional()}).strict(),XD=s.union([s.object({managedPolicyArn:s.string().min(1)}).strict(),s.object({customerManagedPolicy:MA}).strict()]),JD=s.object({managedPolicies:s.array(s.string().min(1)).optional(),inlinePolicy:s.record(s.string(),s.unknown()).optional(),customerManagedPolicies:s.array(MA).optional(),permissionsBoundary:XD.optional(),sessionDuration:s.string().min(1).optional(),description:s.string().optional(),accounts:s.union([s.array(s.string().min(1)),s.literal("all")]).optional(),includeManagementAccount:s.boolean().optional(),groups:s.array(s.string().min(1)).optional()}).strict(),qD=s.object({description:s.string().optional()}).strict(),$c=s.string().regex(z.EMAIL,m.EMAIL),Bg={groups:s.record(s.string(),qD).optional(),permissionSets:s.record(s.string(),JD).optional(),memberships:s.record(s.string(),s.array($c)).optional(),resolutionVersion:s.number().int().min(1).optional(),defaultPermissionSets:s.boolean().optional()},QD=s.discriminatedUnion("source",[s.object({...Bg,source:s.literal("fjall-managed"),users:s.record($c,jA)}).strict(),s.object({...Bg,source:s.literal("external")}).strict(),s.object({...Bg,source:s.literal("external-manual"),users:s.record($c,jA).optional()}).strict()]),q4=s.object({name:F,type:s.literal("organisation").optional(),organisationName:s.string().min(1).optional(),orgEmail:$c.optional(),accounts:s.unknown().optional(),accountIds:s.record(s.string(),s.string()).optional(),identityCentre:s.union([QD,s.literal(!1)]).optional(),allowedRegions:s.array(s.string().min(1)).optional()}).strict();var eO=Object.defineProperty,tO=(e,t)=>eO(e,"name",{value:t,configurable:!0}),rO=[1,3,5,7,14,30,60,90,120,150,180,365,400,545,731,1827,3653],nO=s.object({buildkiteQueue:s.string().min(1,"buildkiteQueue cannot be empty").max(100).regex(/^[a-zA-Z0-9-_]+$/,"buildkiteQueue must be alphanumeric with hyphens/underscores"),buildkiteOrgSlug:s.string().min(1,"buildkiteOrgSlug cannot be empty").max(100).regex(/^[a-z0-9-]+$/,"buildkiteOrgSlug must be a lowercase Buildkite organisation slug"),agentTokenSsmParameterName:s.string().min(2).regex(/^\//,"agentTokenSsmParameterName must be a full path (leading /)").optional(),agentTokenKmsKeyArn:s.string().min(1).optional(),fjallApiKeySsmParameterName:s.string().min(2).regex(/^\//,"fjallApiKeySsmParameterName must be a full path (leading /)").optional(),instanceType:s.string().min(1).default("c8g.xlarge"),agentVolumeSizeGib:s.number().int().min(20).max(1e3).default(250),agentMinInstances:s.number().int().min(0).default(0),agentMaxInstances:s.number().int().min(1).default(2),agentsPerInstance:s.number().int().min(1).default(1),spotCapacityPercentage:s.number().int().min(0).max(100).default(0),scaleInIdlePeriodSeconds:s.number().int().min(60).default(600),disconnectAfterUptimeSeconds:s.number().int().min(3600).default(86400),maxInstanceLifetimeDays:s.number().int().min(1).max(365).default(7),terminateInstanceAfterJob:s.boolean().default(!1),purgeBuildsOnDiskFull:s.boolean().default(!0),terminateInstanceOnDiskFull:s.boolean().default(!1),logRetentionDays:s.number().int().min(1).default(30),agentLogRetentionDays:s.literal(rO).default(7),buildkiteAgentRelease:s.enum(["stable","beta","edge"]).default("stable"),buildkiteAgentTags:s.string().default(""),buildkiteAgentTimestampLines:s.boolean().default(!1),buildkiteAgentExperiments:s.string().default(""),buildkiteAgentTracingBackend:s.enum(["","datadog","opentelemetry"]).default(""),buildkiteAgentCancelGracePeriodSeconds:s.number().int().min(10).default(60),enableSecretsPlugin:s.boolean().default(!0),enableEcrPlugin:s.boolean().default(!1),enableDockerLoginPlugin:s.boolean().default(!1),enableDockerUserNamespaceRemap:s.boolean().default(!0),enableDockerExperimental:s.boolean().default(!1),dockerNetworkingProtocol:s.enum(["ipv4","dualstack"]).default("ipv4"),enableInstanceStorage:s.boolean().default(!1),mountTmpfsAtTmp:s.boolean().default(!0),buildkiteAgentEnableGitMirrors:s.boolean().default(!1),bootstrapScriptUrl:s.string().default(""),agentEnvFileUrl:s.string().default(""),scalerEventSchedulePeriod:s.string().min(1).default("1 minute"),scalerMinPollInterval:s.string().min(1).default("10s"),scaleOutFactor:s.string().min(1).default("1.0"),scaleOutWaitingForJobs:s.boolean().default(!1),rolePermissionsBoundaryArn:s.string().min(1).optional(),alarmSnsTopicArn:s.string().min(1).optional(),applicationId:s.string().min(1).optional(),costAllocationEnvironment:s.string().min(1).optional(),costAllocationOwner:s.string().min(1).optional()}).strict(),aO=nO.refine(e=>e.agentMinInstances<=e.agentMaxInstances,{message:"agentMinInstances must be <= agentMaxInstances"});function oO(e){let t=aO.safeParse(e);if(!t.success){let n=t.error.issues.map(a=>`  - ${a.path.join(".")||"(root)"}: ${a.message}`).join(`
 `);throw new Error(`Buildkite: invalid props:
 ${n}`)}return t.data}tO(oO,"validateBuildkiteProps");var iO=Object.defineProperty,sO=(e,t)=>iO(e,"name",{value:t,configurable:!0});function cO(e){return`FjallDeployBoundary${e}`}sO(cO,"deployBoundaryName");var Gg={Sid:"FjallInheritAdministratorAccess",Effect:"Allow",Action:"*",Resource:"*"},zA=[{Sid:"FjallDenyOrgAndAccountEscape",Effect:"Deny",Action:["organizations:LeaveOrganization","account:CloseAccount"],Resource:"*"},{Sid:"FjallDenyDisableAuditLogging",Effect:"Deny",Action:["cloudtrail:StopLogging"],Resource:"*"},{Sid:"FjallDenyBoundarySelfEscape",Effect:"Deny",Action:["iam:DeleteRolePermissionsBoundary"],Resource:"*"},{Sid:"FjallDenyDisableKmsKey",Effect:"Deny",Action:["kms:DisableKey"],Resource:"*"}],UA=[...zA,{Sid:"FjallDenyStandingHumanCredentials",Effect:"Deny",Action:["iam:CreateUser","iam:CreateLoginProfile","iam:CreateAccessKey","iam:CreateAccountAlias"],Resource:"*"},{Sid:"FjallDenyDisableConfigRecorder",Effect:"Deny",Action:["config:StopConfigurationRecorder"],Resource:"*"}],uO=[...UA,{Sid:"FjallDenyAccountPasswordPolicyTamper",Effect:"Deny",Action:["iam:UpdateAccountPasswordPolicy","iam:DeleteAccountPasswordPolicy"],Resource:"*"},{Sid:"FjallDenyDisableDefaultEbsEncryption",Effect:"Deny",Action:["ec2:DisableEbsEncryptionByDefault"],Resource:"*"}],fF={foundation:[Gg,...zA],compliance:[Gg,...UA],hardened:[Gg,...uO]};var lO=Object.defineProperty,ge=(e,t)=>lO(e,"name",{value:t,configurable:!0});var Kg="sts.amazonaws.com";function dO(e){return`FjallDevDeploy${e}`}ge(dO,"devDeployRoleName");function mO(e){return`FjallDevProvisioner${e}`}ge(mO,"devProvisionerRoleName");function pO(e){return`FjallDevSyncWriter${e}`}ge(pO,"devSyncWriterRoleName");var fO="FjallDevBoundary";function LA(e){return`arn:aws:iam::${e}:policy/${fO}`}ge(LA,"devBoundaryPolicyArn");function FA(e){return`org:${e}:dev-provisioner`}ge(FA,"devProvisionerSubject");function ZA(e){return`org:${e}:dev-sync`}ge(ZA,"devSyncSubject");function Wg(e,t){return`org:${e}:acct:${t}`}ge(Wg,"deployAccountSubject");function Hg(e){return`org:${e}:*`}ge(Hg,"genericMachineSubject");var gO=["discovery","connection","org-setup","dev-substrate-setup"];function VA(e,t){return`org:${e}:${t}`}ge(VA,"serviceSubject");function vO(e){let{fjallOrgId:t,providerArn:n,issuerDomain:a,accountTier:r,accountId:o}=e,i=e.machineTrustMode??"expanded",c={[`${a}:aud`]:Kg},u;if(i==="account-scoped"){if(r===void 0||!Bs(r)||o===void 0)throw new Error(`machineTrustMode "account-scoped" requires a governance accountTier and an accountId (got tier: ${String(r)}, accountId ${o===void 0?"absent":"present"}) \u2014 refusing to fall back to the generic machine subject: a silent fallback would re-widen the trust the \xA74.4a Step-3 contract removes`);u=[Wg(t,o)]}else o!==void 0?u=[Hg(t),Wg(t,o)]:u=Hg(t);return[{Sid:"FjallMachineSubject",Effect:"Allow",Principal:{Federated:n},Action:"sts:AssumeRoleWithWebIdentity",Condition:{StringEquals:{...c,[`${a}:sub`]:u}}},{Sid:"FjallUserSubjects",Effect:"Allow",Principal:{Federated:n},Action:"sts:AssumeRoleWithWebIdentity",Condition:{StringEquals:c,StringLike:{[`${a}:sub`]:`org:${t}:user:*`}}},{Sid:"FjallServiceSubjects",Effect:"Allow",Principal:{Federated:n},Action:"sts:AssumeRoleWithWebIdentity",Condition:{StringEquals:{...c,[`${a}:sub`]:gO.map(l=>VA(t,l))}}}]}ge(vO,"buildNarrowedDeployTrustStatements");function hO(e){let{fjallOrgId:t,providerArn:n,issuerDomain:a,accountId:r}=e;return[{Sid:"FjallDevSubjectsThisAccount",Effect:"Allow",Principal:{Federated:n},Action:"sts:AssumeRoleWithWebIdentity",Condition:{StringEquals:{[`${a}:aud`]:Kg},StringLike:{[`${a}:sub`]:`org:${t}:dev:${r}:*`}}}]}ge(hO,"buildDevDeployTrustStatements");function Yg(e){let{providerArn:t,issuerDomain:n,sid:a,subject:r}=e;return[{Sid:a,Effect:"Allow",Principal:{Federated:t},Action:"sts:AssumeRoleWithWebIdentity",Condition:{StringEquals:{[`${n}:aud`]:Kg,[`${n}:sub`]:r}}}]}ge(Yg,"buildServiceSubjectTrustStatements");function yO(e){return Yg({...e,sid:"FjallDevProvisionerSubject",subject:FA(e.fjallOrgId)})}ge(yO,"buildDevProvisionerTrustStatements");function bO(e){return Yg({...e,sid:"FjallDevSyncSubject",subject:ZA(e.fjallOrgId)})}ge(bO,"buildDevSyncWriterTrustStatements");function SO({accountId:e}){return[{Sid:"FjallDevEcsTaggedMutations",Effect:"Allow",Action:["ecs:UpdateService","ecs:DeleteService","ecs:RunTask","ecs:StopTask"],Resource:`arn:aws:ecs:*:${e}:*`,Condition:{StringEquals:{"aws:ResourceTag/fjall:dev":"true"}}},{Sid:"FjallDevEcsTaggedCreates",Effect:"Allow",Action:["ecs:RegisterTaskDefinition","ecs:CreateService"],Resource:"*",Condition:{StringEquals:{"aws:RequestTag/fjall:dev":"true"}}},{Sid:"FjallDevEcsTagOnCreate",Effect:"Allow",Action:["ecs:TagResource"],Resource:`arn:aws:ecs:*:${e}:*`,Condition:{StringEquals:{"ecs:CreateAction":["RegisterTaskDefinition","CreateService","RunTask"]}}},{Sid:"FjallDevEcsReads",Effect:"Allow",Action:["ecs:Describe*","ecs:List*"],Resource:"*"},{Sid:"FjallDevEcsDeregisterTaskDefinition",Effect:"Allow",Action:["ecs:DeregisterTaskDefinition"],Resource:`arn:aws:ecs:*:${e}:task-definition/fjall-dev-*`},{Sid:"FjallDevElbTaggedMutations",Effect:"Allow",Action:["elasticloadbalancing:ModifyRule","elasticloadbalancing:DeleteRule","elasticloadbalancing:ModifyTargetGroup","elasticloadbalancing:ModifyTargetGroupAttributes","elasticloadbalancing:DeleteTargetGroup","elasticloadbalancing:RegisterTargets","elasticloadbalancing:DeregisterTargets"],Resource:`arn:aws:elasticloadbalancing:*:${e}:*`,Condition:{StringEquals:{"aws:ResourceTag/fjall:dev":"true"}}},{Sid:"FjallDevElbTaggedCreates",Effect:"Allow",Action:["elasticloadbalancing:CreateTargetGroup","elasticloadbalancing:CreateRule"],Resource:`arn:aws:elasticloadbalancing:*:${e}:*`,Condition:{StringEquals:{"aws:RequestTag/fjall:dev":"true"}}},{Sid:"FjallDevElbTagOnCreate",Effect:"Allow",Action:["elasticloadbalancing:AddTags"],Resource:`arn:aws:elasticloadbalancing:*:${e}:*`,Condition:{StringEquals:{"elasticloadbalancing:CreateAction":["CreateTargetGroup","CreateRule"]}}},{Sid:"FjallDevElbReads",Effect:"Allow",Action:["elasticloadbalancing:Describe*"],Resource:"*"},{Sid:"FjallDevSsmDevTree",Effect:"Allow",Action:["ssm:GetParameter*","ssm:PutParameter","ssm:AddTagsToResource"],Resource:`arn:aws:ssm:*:${e}:parameter/fjall/dev/*`},{Sid:"FjallDevLogsMutations",Effect:"Allow",Action:["logs:PutRetentionPolicy","logs:DeleteLogGroup"],Resource:`arn:aws:logs:*:${e}:log-group:/fjall/dev/*`},{Sid:"FjallDevLogsTaggedCreate",Effect:"Allow",Action:["logs:CreateLogGroup","logs:TagResource"],Resource:`arn:aws:logs:*:${e}:log-group:/fjall/dev/*`,Condition:{StringEquals:{"aws:RequestTag/fjall:dev":"true"}}},{Sid:"FjallDevLogsRead",Effect:"Allow",Action:["logs:GetLogEvents","logs:DescribeLogStreams","logs:FilterLogEvents"],Resource:`arn:aws:logs:*:${e}:log-group:/fjall/dev/*`},{Sid:"FjallDevLogsDescribeGroups",Effect:"Allow",Action:["logs:DescribeLogGroups"],Resource:"*"},{Sid:"FjallDevKmsViaDevAlias",Effect:"Allow",Action:["kms:Encrypt","kms:Decrypt","kms:GenerateDataKey"],Resource:`arn:aws:kms:*:${e}:key/*`,Condition:{"ForAnyValue:StringLike":{"kms:ResourceAliases":"alias/fjall-dev-*"}}},{Sid:"FjallDevKmsSsmSecureString",Effect:"Allow",Action:["kms:Encrypt","kms:Decrypt","kms:GenerateDataKey"],Resource:`arn:aws:kms:*:${e}:key/*`,Condition:{StringLike:{"kms:ViaService":"ssm.*.amazonaws.com"}}},{Sid:"FjallDevEcrAuthToken",Effect:"Allow",Action:["ecr:GetAuthorizationToken"],Resource:"*"},{Sid:"FjallDevEcrPushPull",Effect:"Allow",Action:["ecr:PutImage","ecr:InitiateLayerUpload","ecr:UploadLayerPart","ecr:CompleteLayerUpload","ecr:BatchCheckLayerAvailability","ecr:BatchGetImage","ecr:GetDownloadUrlForLayer","ecr:DescribeImages"],Resource:`arn:aws:ecr:*:${e}:repository/*`},{Sid:"FjallDevPassDevPathRoles",Effect:"Allow",Action:["iam:PassRole"],Resource:`arn:aws:iam::${e}:role/fjall/dev/*`}]}ge(SO,"buildDevDeployPolicyStatements");function _O({accountId:e}){return[{Sid:"FjallDevProvisionerBoundedRoleWrites",Effect:"Allow",Action:["iam:CreateRole","iam:PutRolePolicy","iam:AttachRolePolicy"],Resource:`arn:aws:iam::${e}:role/fjall/dev/*`,Condition:{StringEquals:{"iam:PermissionsBoundary":LA(e)}}},{Sid:"FjallDevProvisionerPathRoleOps",Effect:"Allow",Action:["iam:DeleteRole","iam:DeleteRolePolicy","iam:DetachRolePolicy","iam:ListRolePolicies","iam:TagRole"],Resource:`arn:aws:iam::${e}:role/fjall/dev/*`},{Sid:"FjallDevProvisionerListRoles",Effect:"Allow",Action:["iam:ListRoles"],Resource:"*"},{Sid:"FjallDevProvisionerDevMasterSecrets",Effect:"Allow",Action:["secretsmanager:GetSecretValue"],Resource:`arn:aws:secretsmanager:*:${e}:secret:fjall-dev-*`},{Sid:"FjallDevProvisionerKmsDecryptViaSecretsManager",Effect:"Allow",Action:["kms:Decrypt"],Resource:`arn:aws:kms:*:${e}:key/*`,Condition:{StringLike:{"kms:ViaService":"secretsmanager.*.amazonaws.com"}}},{Sid:"FjallDevProvisionerDataApi",Effect:"Allow",Action:["rds-data:ExecuteStatement","rds-data:BatchExecuteStatement","rds-data:BeginTransaction","rds-data:CommitTransaction","rds-data:RollbackTransaction"],Resource:`arn:aws:rds:*:${e}:cluster:fjall-dev-*`},{Sid:"FjallDevProvisionerMetrics",Effect:"Allow",Action:["cloudwatch:GetMetricData"],Resource:"*"},{Sid:"FjallDevProvisionerOrphanDiscovery",Effect:"Allow",Action:["tag:GetResources"],Resource:"*"},{Sid:"FjallDevProvisionerSsmTeardown",Effect:"Allow",Action:["ssm:DeleteParameter*"],Resource:`arn:aws:ssm:*:${e}:parameter/fjall/dev/*`},{Sid:"FjallDevProvisionerLogsTeardown",Effect:"Allow",Action:["logs:DeleteLogGroup"],Resource:`arn:aws:logs:*:${e}:log-group:/fjall/dev/*`},{Sid:"FjallDevProvisionerTaggedTeardown",Effect:"Allow",Action:["ecs:UpdateService","ecs:StopTask","ecs:DeleteService","elasticloadbalancing:DeleteRule","elasticloadbalancing:DeleteTargetGroup","elasticloadbalancing:DeregisterTargets"],Resource:[`arn:aws:ecs:*:${e}:*`,`arn:aws:elasticloadbalancing:*:${e}:*`],Condition:{StringEquals:{"aws:ResourceTag/fjall:dev":"true"}}},{Sid:"FjallDevProvisionerTeardownReads",Effect:"Allow",Action:["ecs:Describe*","elasticloadbalancing:Describe*"],Resource:"*"},{Sid:"FjallDevProvisionerImageJanitor",Effect:"Allow",Action:["ecr:ListImages","ecr:DescribeImages","ecr:BatchDeleteImage"],Resource:`arn:aws:ecr:*:${e}:repository/*`},{Sid:"FjallDevProvisionerSsmReadAll",Effect:"Allow",Action:["ssm:GetParameter*"],Resource:`arn:aws:ssm:*:${e}:parameter/*`},{Sid:"FjallDevProvisionerKmsDecryptViaSsm",Effect:"Allow",Action:["kms:Decrypt"],Resource:`arn:aws:kms:*:${e}:key/*`,Condition:{StringLike:{"kms:ViaService":"ssm.*.amazonaws.com"}}}]}ge(_O,"buildDevProvisionerPolicyStatements");function EO({accountId:e}){return[{Sid:"FjallDevSyncPrefixReadWrite",Effect:"Allow",Action:["s3:GetObject","s3:PutObject"],Resource:`arn:aws:s3:::fjall-dev-sync-${e}-*/*`,Condition:{StringEquals:{"aws:ResourceAccount":e}}}]}ge(EO,"buildDevSyncWriterPolicyStatements");function AO({accountId:e}){return[{Sid:"FjallDevBoundarySsmDevRead",Effect:"Allow",Action:["ssm:GetParameter*"],Resource:`arn:aws:ssm:*:${e}:parameter/fjall/dev/*`},{Sid:"FjallDevBoundaryKmsDecryptDevAlias",Effect:"Allow",Action:["kms:Decrypt"],Resource:`arn:aws:kms:*:${e}:key/*`,Condition:{"ForAnyValue:StringLike":{"kms:ResourceAliases":"alias/fjall-dev-*"}}},{Sid:"FjallDevBoundarySyncPrefixReadWrite",Effect:"Allow",Action:["s3:GetObject","s3:PutObject"],Resource:`arn:aws:s3:::fjall-dev-sync-${e}-*/*`,Condition:{StringEquals:{"aws:ResourceAccount":e}}},{Sid:"FjallDevBoundarySlotLogs",Effect:"Allow",Action:["logs:CreateLogStream","logs:PutLogEvents"],Resource:`arn:aws:logs:*:${e}:log-group:/fjall/dev/*`},{Sid:"FjallDevBoundarySyncQueue",Effect:"Allow",Action:["sqs:ReceiveMessage","sqs:DeleteMessage","sqs:GetQueueUrl"],Resource:`arn:aws:sqs:*:${e}:fjall-dev-sync-${e}-*`}]}ge(AO,"buildDevBoundaryStatements");var xO=Object.defineProperty,Fe=(e,t)=>xO(e,"name",{value:t,configurable:!0});function I(e){return JSON.stringify(e)}Fe(I,"escapeStringLiteral");function Dr(e){return e.map(I).join(", ")}Fe(Dr,"formatStringArray");var IO="import:SharedAlarmTopicArn";function Or(e="    "){return`