fjall 14.0.0 → 14.1.0

package/bin/assets/generators/compute/generator.js

@@ -202,7 +202,7 @@ ${xv}
 `);return{buffer:[],stream:n}}flush(){let t=this.flushBuffer(this.buffer,this.mainLogStream,this.mainLogPath);this.buffer=t.buffer,this.mainLogStream=t.stream;let r=this.flushBuffer(this.debugBuffer,this.debugLogStream,this.debugLogPath);this.debugBuffer=r.buffer,this.debugLogStream=r.stream}close(){this.isClosing=!0,this.flush(),this.flushInterval&&(clearInterval(this.flushInterval),this.flushInterval=null),this.mainLogStream&&(this.mainLogStream.end(),this.mainLogStream=null),this.debugLogStream&&(this.debugLogStream.end(),this.debugLogStream=null),this.buffer=[],this.debugBuffer=[],this.initialised=!1,this.isClosing=!1}async closeAndFlush(){this.isClosing=!0,this.flush(),this.flushInterval&&(clearInterval(this.flushInterval),this.flushInterval=null);let t=[];this.mainLogStream&&(t.push(this.mainLogStream),this.mainLogStream=null),this.debugLogStream&&(t.push(this.debugLogStream),this.debugLogStream=null),this.buffer=[],this.debugBuffer=[],this.initialised=!1,await Promise.all(t.map(r=>new Promise(i=>{r.end(()=>i())}))),this.isClosing=!1}};import{createWriteStream as lU,existsSync as uU,mkdirSync as dU}from"fs";import{join as tT}from"path";var xn={trace:0,debug:1,info:2,warn:3,error:4},We={MAX_FILE_SIZE:10*1024*1024,MAX_FILES:5,MAX_BUFFER_SIZE:100,FLUSH_INTERVAL_MS:500,LOG_FILENAME:"fjall.jsonl",DEBUG_LOG_FILENAME:"fjall-debug.jsonl"};import{join as oU}from"path";import{homedir as aU}from"os";var nU=Object.defineProperty,iU=(e,t)=>nU(e,"name",{value:t,configurable:!0});function zr(){let e=process.env.FJALL_LOG_DIR;return e!==void 0&&e!==""?e:oU(aU(),".fjall","logs")}iU(zr,"getDefaultLogDir");var sU=Object.defineProperty,cU=(e,t)=>sU(e,"name",{value:t,configurable:!0}),Ra=class{static{cU(this,"DeploymentLoggerImpl")}mainLogger;appName;operationType;logStream=null;logPath;deploymentId;buffer=[];flushInterval=null;isClosing=!1;maxBufferSize=We.MAX_BUFFER_SIZE;constructor(t,r,i){this.mainLogger=t,this.appName=r,this.operationType=i,this.deploymentId=`${i}-${Date.now()}`;let n=zr(),o=tT(n,"deployments",r);uU(o)||dU(o,{recursive:!0});let a=new Date().toISOString().replace(/[:.]/g,"-"),c=`${i}-${a}.jsonl`;this.logPath=tT(o,c);try{this.logStream=lU(this.logPath,{flags:"a"}),this.flushInterval=setInterval(()=>this.flush(),We.FLUSH_INTERVAL_MS),this.info("DeploymentLogger","Deployment logging initialised",{appName:r,operationType:i,deploymentId:this.deploymentId,logPath:this.logPath})}catch{}}log(t,r,i,n,o,a){if(this.isClosing)return;let c={timestamp:new Date().toISOString(),level:t,component:r,message:i,correlationId:this.deploymentId,...n&&Object.keys(n).length>0&&{data:n},...o&&{stackName:o},...a&&{phase:a}};this.buffer.push(c),this.mainLogger.logWithCorrelation(t,r,i,this.deploymentId,n,o,a),this.buffer.length>=this.maxBufferSize&&this.flush()}flush(){if(!(this.buffer.length===0||!this.logStream)){for(let t of this.buffer)this.logStream.write(JSON.stringify(t)+`
 `);this.buffer=[]}}info(t,r,i){this.log("info",t,r,i)}warn(t,r,i){this.log("warn",t,r,i)}error(t,r,i){this.log("error",t,r,i)}debug(t,r,i){this.log("debug",t,r,i)}stackEvent(t,r,i,n){this.log("info","StackDeployment",i,n,t,r)}dockerEvent(t,r){this.log("info","DockerOperation",t,{percentage:r})}ecsEvent(t,r,i){this.log("info","ECSDeployment",t,{percentage:r,taskCount:i})}close(){this.isClosing=!0,this.flush(),this.flushInterval&&(clearInterval(this.flushInterval),this.flushInterval=null),this.logStream&&(this.logStream.end(),this.logStream=null),this.buffer=[],this.isClosing=!1}getLogPath(){return this.logPath}getDeploymentId(){return this.deploymentId}};var mU=Object.defineProperty,pU=(e,t)=>mU(e,"name",{value:t,configurable:!0}),Gl=class e{static{pU(this,"Logger")}static instance=null;config;debugEnabled;traceEnabled;minLevel;fileWriter;mainLogPath;debugLogPath;constructor(){let t=zr(),r=Bv(t,"debug"),i=this.parseEnvInt("FJALL_LOG_MAX_SIZE",We.MAX_FILE_SIZE),n=this.parseEnvInt("FJALL_LOG_MAX_FILES",We.MAX_FILES);this.config={logDir:t,debugLogDir:r,maxFileSize:i,maxFiles:n,maxBufferSize:We.MAX_BUFFER_SIZE,flushIntervalMs:We.FLUSH_INTERVAL_MS},this.mainLogPath=Bv(t,We.LOG_FILENAME),this.debugLogPath=Bv(r,We.DEBUG_LOG_FILENAME),this.debugEnabled=process.env.FJALL_DEBUG==="true"||process.env.FJALL_TRACE==="true"||process.argv.includes("--verbose")||process.argv.includes("-v"),this.traceEnabled=process.env.FJALL_TRACE==="true";let o=process.env.FJALL_LOG_LEVEL?.toLowerCase();o&&o in xn?this.minLevel=o:this.traceEnabled?this.minLevel="trace":this.debugEnabled?this.minLevel="debug":this.minLevel="info",this.fileWriter=new Zl(this.config,this.mainLogPath,this.debugLogPath,this.debugEnabled)}parseEnvInt(t,r){let i=process.env[t];if(i){let n=parseInt(i,10);if(!isNaN(n)&&n>0)return n}return r}static getInstance(){return e.instance||(e.instance=new e),e.instance}shouldLog(t){return xn[t]>=xn[this.minLevel]}createEntry(t,r,i,n,o,a,c){return{timestamp:new Date().toISOString(),level:t,component:r,message:i,...o&&{correlationId:o},...n&&Object.keys(n).length>0&&{data:n},...a&&{stackName:a},...c&&{phase:c}}}log(t,r,i,n,o,a,c){if(!this.shouldLog(t))return;let l=this.createEntry(t,r,i,n,o,a,c),u=t==="debug"||t==="trace";this.fileWriter.write(l,u),this.writeConsole(l)}writeConsole(t){let r=Vv();if(ji.isUIMode||ji.isNonInteractive||r==="agent"||r==="mcp"){this.debugEnabled&&this.writeDebugMirror(t);return}let i=this.getConsolePrefix(t.level),n=`[${t.component}]`,o=`${i} ${n} ${t.message}`;t.level==="error"?console.error(o):t.level==="warn"?console.warn(o):console.log(o)}writeDebugMirror(t){let r=this.getConsolePrefix(t.level),i=`[${t.component}]`,n="";if(t.data&&Object.keys(t.data).length>0)try{n=` ${JSON.stringify(t.data)}`}catch{n=" [unserialisable data]"}let o=`${r} ${i} ${t.message}${n}`;process.stderr.write(`${pe(o)}
 `)}getConsolePrefix(t){switch(t){case"error":return"[ERROR]";case"warn":return"[WARN]";case"info":return"[INFO]";case"debug":return"[DEBUG]";case"trace":return"[TRACE]"}}error(t,r,i){this.log("error",t,r,i)}warn(t,r,i){this.log("warn",t,r,i)}info(t,r,i){this.log("info",t,r,i)}debug(t,r,i){this.log("debug",t,r,i)}trace(t,r,i){this.log("trace",t,r,i)}isDebugEnabled(){return this.debugEnabled}isTraceEnabled(){return this.traceEnabled}enableDebug(){this.debugEnabled=!0,xn[this.minLevel]>xn.debug&&(this.minLevel="debug"),this.fileWriter.setDebugEnabled(!0),this.fileWriter.isInitialised&&this.fileWriter.initialiseDebugStream()}withCorrelation(t){return new Bi(this,t)}forDeployment(t,r="deploy"){return new Ra(this,t,r)}close(){this.fileWriter.close()}async flushAndClose(){await this.fileWriter.closeAndFlush()}getLogPath(){return this.mainLogPath}getDebugLogPath(){return this.debugLogPath}getLogDir(){return this.config.logDir}logWithCorrelation(t,r,i,n,o,a,c){this.log(t,r,i,o,n,a,c)}static reset(){e.instance&&(e.instance.close(),e.instance=null)}};var fU=Object.defineProperty,gU=(e,t)=>fU(e,"name",{value:t,configurable:!0}),ir=Gl.getInstance();function bU(e){let t=zr(),r=nT(t,"debug"),i=nT(r,We.DEBUG_LOG_FILENAME);try{rT(r)||hU(r,{recursive:!0}),rT(i)&&vU(i).size>We.MAX_FILE_SIZE&&new Zi({maxFiles:We.MAX_FILES}).rotate(i);let n={timestamp:new Date().toISOString(),level:"debug",component:"Emergency",message:e};yU(i,JSON.stringify(n)+`
-`)}catch{}}gU(bU,"writeDebugSync");var SU=Object.defineProperty,Gi=(e,t)=>SU(e,"name",{value:t,configurable:!0});function Zv(e){return e.success===!0}Gi(Zv,"isSuccess");function Gv(e){return e.success===!1}Gi(Gv,"isFailure");function k(e){return{success:!0,data:e}}Gi(k,"success");function T(e){return{success:!1,error:e}}Gi(T,"failure");async function Wv(e){try{let t=await e();return k(t)}catch(t){return T(_t(t))}}Gi(Wv,"tryAsync");function Hv(e){try{let t=e();return k(t)}catch(t){return T(_t(t))}}Gi(Hv,"trySync");var EU=Object.defineProperty,_U=(e,t)=>EU(e,"name",{value:t,configurable:!0}),iT=/^[a-zA-Z][a-zA-Z0-9-]*$/,AU=da.source.replace(/^\^|\$$/g,""),L=Object.freeze({IDENTIFIER:iT,NEW_APP_NAME:/^[a-z][a-z0-9-]*$/,RESOURCE_NAME:/^[a-zA-Z][a-zA-Z0-9]*$/,ECS_SERVICE_NAME:iT,BUCKET_NAME:/^[a-z][a-z0-9-]*[a-z0-9]$|^[a-z][a-z0-9]*$/,DATABASE_NAME:/^[a-zA-Z][a-zA-Z0-9_]*$/,RESOURCE_TYPE:/^[a-z]+(:[a-z]+)?$/,SSM_PATH:new RegExp(`^(?:/${AU})+$`),SECRET_NAME:Il,SSM_COMPONENT:da,EMAIL:/^[^\s@]+@[^\s@]+\.[^\s@]+$/,DOCKER_IMAGE:/^[a-z0-9][a-z0-9._-]*[a-z0-9](:[a-z0-9._-]+)?$/,DOMAIN:/^[a-z0-9]([a-z0-9-]*[a-z0-9])?(\.[a-z0-9]([a-z0-9-]*[a-z0-9])?)+$/i,HTTP_ORIGIN:/^https?:\/\/[a-z0-9.-]+(:\d+)?$/i,PASCAL_CASE:/^[A-Z][A-Za-z0-9]*$/,AWS_ACCOUNT_ID:/^\d{12}$/,VPC_ID:/^vpc-[a-z0-9]+$/,ROLE_ARN:/^arn:aws[a-zA-Z-]*:iam::\d{12}:role\/.+$/,CIDR:/^((25[0-5]|2[0-4]\d|1\d\d|[1-9]?\d)\.){3}(25[0-5]|2[0-4]\d|1\d\d|[1-9]?\d)\/(3[0-2]|[12]?\d)$/,SCHEDULE_EXPRESSION:/^(rate\(1 (?:minute|hour|day)\)|rate\((?:[2-9]|[1-9]\d+) (?:minutes|hours|days)\)|cron\([^\s()]+ [^\s()]+ [^\s()]+ [^\s()]+ [^\s()]+ [^\s()]+\))$/,LAMBDA_RUNTIME_IDENTIFIER:/^[A-Za-z0-9._-]+$/,ENV_VAR_NAME:/^[A-Za-z_][A-Za-z0-9_]*$/});function Kv(e){let t=/^rate\((\d+) (minute|minutes|hour|hours|day|days)\)$/.exec(e);if(!t)return;let r=t[1],i=t[2];if(r===void 0||i===void 0)return;let n=parseInt(r,10);if(!Number.isFinite(n)||n<1)return;let o=i==="minute"||i==="hour"||i==="day";if(!(o&&n!==1)&&!(!o&&n===1))return i==="minute"||i==="minutes"?{everyMs:n*6e4}:i==="hour"||i==="hours"?{everyMs:n*60*6e4}:{everyMs:n*24*60*6e4}}_U(Kv,"parseRateExpression");var m=Object.freeze({IDENTIFIER:"Must start with a letter, contain only letters, numbers, and hyphens",NEW_APP_NAME:"Must start with a lowercase letter and contain only lowercase letters, numbers, and hyphens",IDENTIFIER_MIN_LENGTH:"Must be at least 2 characters",IDENTIFIER_NO_TRAILING_HYPHEN:"Must not end with a hyphen",IDENTIFIER_NO_CONSECUTIVE_HYPHENS:"Must not contain consecutive hyphens",RESOURCE_NAME:"Must start with a letter and contain only letters and numbers (PascalCase recommended)",ECS_SERVICE_NAME:"Service name must start with a letter and contain only letters, numbers, and hyphens",BUCKET_NAME:"Bucket name must start with a lowercase letter and contain only lowercase letters, numbers, and hyphens",DATABASE_NAME:"Database name must start with a letter and contain only letters, numbers, and underscores",RESOURCE_TYPE:"Resource type must be in format 'category' or 'category:type'",SSM_PATH:"SSM path must start with / and contain valid namespace segments (e.g., /myapp/ApiCluster/service)",SECRET_NAME:Yh,SSM_COMPONENT:$l,EMAIL:"Please enter a valid email address",DOMAIN:"Please enter a valid domain (e.g., cms.example.com)",DOCKER_IMAGE:"Invalid Docker image name format",REQUIRED:{APP_NAME:"Application name is required",RESOURCE_NAME:"Resource name is required",BUCKET_NAME:"Bucket name is required",SERVICE_NAME:"Service name is required",NETWORK_NAME:"Network name is required",DATABASE_NAME:"Database name is required",ORGANISATION_NAME:"Organisation name is required",EMAIL:"Email is required",NAME:"Name is required",USERNAME:"Username is required",CONTAINER_NAME:"Container name is required",GROUP:"Group is required",PATTERN_NAME:"Pattern name is required",SOURCE:"Source directory is required",BUILD_COMMAND:"Build command is required",OUTPUT_DIR:"Output directory is required",FORMS_TO:"Forms recipient address is required",ROUTING_PATH:"Routing path is required",RESOURCE_REFERENCE:"Resource reference is required",RESOURCE_TYPE:"Resource type is required",VARIANT:"Variant is required",SUBTYPE:"Subtype is required",DEPLOY_TARGET:"Deploy target is required",DESTROY_TARGET:"Destroy target is required"},MAX_LENGTH:{APP_NAME:"Application name must be 50 characters or less",RESOURCE_NAME:"Resource name must be 63 characters or less",BUCKET_NAME:"Bucket name must be 63 characters or less",SERVICE_NAME:"Service name must be 255 characters or less",NETWORK_NAME:"Network name must be 50 characters or less",DATABASE_NAME:"Database name must be 63 characters or less",ORGANISATION_NAME:"Organisation name must be 50 characters or less"},PORT:{INTEGER:"Port must be an integer",MIN:"Port must be at least 1",MAX:"Port cannot exceed 65535"},USERNAME:{MAX_LENGTH:"Username cannot exceed 63 characters"},LAMBDA:{MEMORY:{INTEGER:"Lambda memory must be an integer",MIN:"Memory must be at least 128 MB",MAX:"Memory cannot exceed 10240 MB",MULTIPLE:"Memory must be 128 MB or a multiple of 64 MB"},TIMEOUT:{INTEGER:"Timeout must be an integer",MIN:"Timeout must be at least 1 second",MAX:"Timeout cannot exceed 900 seconds"},RUNTIME:"Lambda runtime must contain only letters, digits, dots, underscores, or dashes (e.g. 'NODEJS_20_X' or 'nodejs20.x')"},ENV_VAR_NAME:"Environment variable names must start with a letter or underscore and contain only letters, digits, and underscores",PRIORITY:{INTEGER:"Priority must be an integer",MIN:"Priority must be at least 1",MAX:"Priority cannot exceed 50000"},CAPACITY:{MIN:{INTEGER:"Minimum capacity must be an integer",MIN_0:"Minimum capacity must be at least 0",MIN_1:"Minimum capacity must be at least 1",MAX:"Minimum capacity cannot exceed 100"},MAX:{INTEGER:"Maximum capacity must be an integer",MIN_0:"Maximum capacity must be at least 0",MIN_1:"Maximum capacity must be at least 1",MAX:"Maximum capacity cannot exceed 100"},DESIRED:{INTEGER:"Desired count must be an integer",MIN:"Desired count must be at least 0",MAX:"Desired count cannot exceed 100"},WARM_POOL_REQUIRED:"minCapacity 0 requires a warmPool \u2014 without it, new tasks wait 60-90s for a cold instance launch",WARM_POOL:{MIN_SIZE:{INTEGER:"Warm pool minSize must be an integer",MIN:"Warm pool minSize must be at least 0",MAX:"Warm pool minSize cannot exceed 100"},MIN_SIZE_EXCEEDS_MAX_CAPACITY:"warmPool.minSize cannot exceed maxCapacity \u2014 the warm pool cannot hold more instances than the ASG allows"}},MEMORY_LIMIT:{INTEGER:"Memory limit must be an integer",MIN_512:"Memory limit must be at least 512 MiB",MIN_128:"Memory limit must be at least 128 MiB",MAX:"Memory limit cannot exceed 30720 MiB"},DATABASE:{PORT:{INTEGER:"Database port must be an integer",MIN:"Database port must be at least 1024",MAX:"Database port cannot exceed 65535"},NAME:{REQUIRED:"Database name is required",MAX_LENGTH:"Database name must be 63 characters or less"}},BACKUP_RETENTION:{INTEGER:"Backup retention must be an integer",MIN:"Backup retention must be at least 1 day",MAX:"Backup retention cannot exceed 35 days"},SQS:{VISIBILITY_TIMEOUT:{INTEGER:"Visibility timeout must be an integer",MIN:"Visibility timeout must be at least 0 seconds",MAX:"Visibility timeout cannot exceed 43200 seconds (12 hours)"},RETENTION_PERIOD:{INTEGER:"Retention period must be an integer",MIN:"Retention period must be at least 60 seconds",MAX:"Retention period cannot exceed 1209600 seconds (14 days)"}},READER:{COUNT:{INTEGER:"Reader count must be an integer",MIN:"Reader count must be at least 0",MAX:"Reader count cannot exceed 15"}},IDENTIFIER_SUFFIX:{REQUIRED:"Identifier suffix is required when specified",MAX_LENGTH:"Identifier suffix cannot exceed 50 characters"},ROTATION:{INTEGER:"Rotation days must be an integer",MIN:"Rotation interval must be at least 1 day",MAX:"Rotation interval cannot exceed 365 days"},MAX_CONNECTIONS:{INTEGER:"Max connections must be an integer",MIN:"Max connections must be at least 1",MAX:"Max connections cannot exceed 100"},MONITORING_INTERVAL:{INTEGER:"Monitoring interval must be an integer",MIN:"Monitoring interval must be at least 0",MAX:"Monitoring interval cannot exceed 60 seconds",VALUES:"Monitoring interval must be 0, 1, 5, 10, 15, 30, or 60 seconds"},RETENTION_DAYS:{INTEGER:"Retention days must be an integer",MIN:"Retention days must be at least 1",MAX:"Retention days cannot exceed 365"},BATCH_SIZE:{INTEGER:"Batch size must be an integer",MIN:"Batch size must be at least 1",MAX:"Batch size cannot exceed 10000"},SERVICE:{UNIQUE_WITHIN_CLUSTER:"Service names must be unique within a cluster",MIN_REQUIRED:"At least one service is required",ROUTING_REQUIRED:"Multiple services with ports require routing config (path or host)"},PROXY_CONFIG:{MAX_IDLE_CONNECTIONS:{INTEGER:"Max idle connections must be an integer",MIN:"Max idle connections must be at least 0",MAX:"Max idle connections cannot exceed 100"},BORROW_TIMEOUT:{INTEGER:"Connection borrow timeout must be an integer",MIN:"Connection borrow timeout must be at least 1 second",MAX:"Connection borrow timeout cannot exceed 3600 seconds"}},MAX_AZS:{INTEGER:"Max AZs must be an integer",MIN:"Max AZs must be at least 1",MAX:"Max AZs cannot exceed 3"},BATCHING_WINDOW:{INTEGER:"Max batching window must be an integer",MIN:"Max batching window must be at least 0",MAX:"Max batching window cannot exceed 300 seconds"},HEALTH_CHECK:{INTERVAL:{INTEGER:"Health check interval must be an integer",MIN:"Health check interval must be at least 5 seconds",MAX:"Health check interval cannot exceed 300 seconds"},TIMEOUT:{INTEGER:"Health check timeout must be an integer",MIN:"Health check timeout must be at least 2 seconds",MAX:"Health check timeout cannot exceed 60 seconds"},RETRIES:{INTEGER:"Health check retries must be an integer",MIN:"Health check retries must be at least 1",MAX:"Health check retries cannot exceed 10"},START_PERIOD:{INTEGER:"Health check start period must be an integer",MIN:"Health check start period must be at least 0 seconds",MAX:"Health check start period cannot exceed 300 seconds"}},EPHEMERAL_STORAGE:{INTEGER:"Ephemeral storage size must be an integer",MIN:"Ephemeral storage size must be at least 512 MB",MAX:"Ephemeral storage size cannot exceed 10240 MB"},MAX_MESSAGE_SIZE:{INTEGER:"Max message size must be an integer",MIN:"Max message size must be at least 1024 bytes",MAX:"Max message size cannot exceed 262144 bytes (256 KB)"},CAPACITY_CONSTRAINT:{MIN_LTE_MAX:"minCapacity must be less than or equal to maxCapacity"},DIRECT_ACCESS:{NO_DOMAIN:"directAccess cannot be used with domain (no ALB for HTTPS)",NO_LOAD_BALANCER:"directAccess cannot be used with loadBalancer (mutually exclusive)"},GLOBAL_AURORA:{PRIMARY_REGION_REQUIRED:"primaryRegion is required for GlobalAurora databases"},NAT_GATEWAY:{INTEGER:"NAT gateway count must be an integer",MIN:"NAT gateway count must be at least 0",MAX:"NAT gateway count cannot exceed 3"},CIDR_MASK:{INTEGER:"CIDR mask must be an integer",MIN:"CIDR mask must be at least 16",MAX:"CIDR mask cannot exceed 28"},CPU:{INTEGER:"CPU must be an integer",MIN:"CPU must be at least 256 units",MAX:"CPU cannot exceed 4096 units"},KMS:{KEY_REQUIRED:"KMS key ARN is required when using KMS encryption"},READER_INSTANCES:{MAX:"Cannot have more than 15 reader instances",COUNT_OR_INSTANCES:"Cannot specify both 'count' and 'instances' - use one or the other"},GENERATOR_CAPACITY:{MIN:{MIN:"Minimum capacity must be at least 1",MAX:"Minimum capacity cannot exceed 1000"},MAX:{MIN:"Maximum capacity must be at least 1",MAX:"Maximum capacity cannot exceed 1000"}},INSTANCE_TYPE:"Unknown instance type. Common types include: t4g.micro, t4g.small, m5.large",ARCHITECTURE_MISMATCH:"Architecture mismatch between instance type and AMI",ALLOCATED_STORAGE:{INTEGER:"Allocated storage must be an integer",MIN:"Allocated storage must be at least 20 GB",MAX:"Allocated storage cannot exceed 65536 GB"},DLQ:{MAX_RECEIVE_COUNT:{INTEGER:"Max receive count must be an integer",MIN:"Max receive count must be at least 1",MAX:"Max receive count cannot exceed 1000"}},ALARM:{PERCENTAGE:{MIN:"Threshold must be at least 1%",MAX:"Threshold must be at most 100%"},FREE_STORAGE_GIB:{MIN:"Free storage threshold must be at least 1 GiB"}},REGION:"Invalid AWS region",PASCAL_CASE:"Resource name must start with an uppercase letter and contain only alphanumerics (PascalCase).",IMAGE_DOCKER_MUTEX:"image and docker are mutually exclusive",AWS_ACCOUNT_ID:"AWS account id must be exactly 12 digits (no hyphens)",VPC_ID:"VPC id must look like vpc-abc12345",ROLE_ARN:"Role ARN must have the form arn:aws:iam::<account-id>:role/<name>",CIDR:"CIDR must be in dotted-quad/prefix-length form (e.g. 10.0.0.0/16)",VPC_PEER:{MIN_REQUESTER_ACCOUNTS:"At least one requester account id is required",REGION_REQUIRED:"Peer region is required when specified",ROUTE_TABLE_ID_REQUIRED:"Route table id must not be empty"},SCHEDULE_EXPRESSION:"Schedule expression must be 'rate(N minute|minutes|hour|hours|day|days)' with N>=1, or 'cron(<6-field AWS expression>)'"});var xU=Object.defineProperty,dt=(e,t)=>xU(e,"name",{value:t,configurable:!0}),IU=["us-east-2","us-west-2","us-east-1","eu-west-1","eu-central-1","ap-southeast-1"],$U=Object.freeze(IU.flatMap(e=>{let t=Ni(e);return t?[t]:[]})),qv=Object.freeze(["us-east-2","us-west-2","us-east-1","eu-west-1","ap-southeast-1"]);function Wl(e){return e?e.split(",").map(t=>t.trim()).filter(Boolean):[]}dt(Wl,"parseRegionList");function Yv(e){return er.includes(e)}dt(Yv,"isValidRegion");function Xv(e){return/^[a-z]{2}-[a-z]+-[1-9]$/.test(e)}dt(Xv,"isValidRegionFormat");function Jv(e){if(!e)return qv.slice(0,3);let t=e.toLowerCase().split("-"),r=t[0],i=t.length>1?t[1]:"",n=[];return r&&i&&(n=er.filter(o=>o.startsWith(`${r}-${i}`))),n.length===0&&r&&(n=er.filter(o=>o.startsWith(`${r}-`))),n.length>0?n.slice(0,3):qv.slice(0,3)}dt(Jv,"getSuggestions");function Qv(e){if(Yv(e))return!0;let t=Jv(e);return Xv(e)?`Unknown region. Try: ${t.join(", ")}`:`Invalid format. Try: ${t.join(", ")}`}dt(Qv,"validateRegion");function oT(e){if(!e||e.trim()==="")return!0;let t=Wl(e);for(let r of t){let i=Qv(r);if(i!==!0)return i}return!0}dt(oT,"validateRegionList");function ey(e,t){return e.filter(r=>r!==t)}dt(ey,"filterDuplicateRegions");function ty(e){return{label:e.city,value:e.code,description:e.optIn?`${e.code} \u2014 opt-in required`:e.code}}dt(ty,"toRegionOption");function aT(){return lt.map(ty)}dt(aT,"getRegionOptions");function sT(e){return lt.filter(t=>t.code!==e).map(ty)}dt(sT,"getRegionOptionsExcluding");function cT(e){let t=lt.find(r=>r.code===e);return t?t.city:e}dt(cT,"getRegionName");function lT(e){return t=>{let r=Wl(t);return ey(r,e)}}dt(lT,"createRegionFormatter");var Hl="14.0.0";var Kl=["Aurora","Instance","GlobalAurora","ClickHouse"],Wi=["FARGATE","FARGATE_SPOT","EC2"],xt=["standard","resilient","enterprise"],ql=["tinkerer","lightweight","standard","resilient","enterprise"],ry="custom",Na=[...ql,ry];var TU=Object.defineProperty,RU=(e,t)=>TU(e,"name",{value:t,configurable:!0}),uT=Object.freeze({RESOURCE_SUFFIXES:Object.freeze({storage:"Storage",database:"Database",cluster:"Cluster",function:"Function",instance:"Instance",compute:"Compute"})}),Pa=["ecs","lambda","ec2"],Hi=Object.freeze({ECS:"ecs",LAMBDA:"lambda",EC2:"ec2"}),Yl=["code","container"],ka=Object.freeze({CODE:"code",CONTAINER:"container"}),Xl=["ARM_64","X86_64"],dT="ARM_64",Ca=["NONE","AWS_IAM"],Jl=["public","internal"],Ql=["CPU","MEMORY"],eu=["ARM","STANDARD"],ny=["Instance","Aurora"],Ki=["postgresql","mysql"],wa=["web","worker"],mT=["foundation","compliance","hardened"];var tu=["t3.nano","t3.micro","t3.small","t3.medium","t3.large","t3.xlarge","t3.2xlarge","t3a.nano","t3a.micro","t3a.small","t3a.medium","t3a.large","t3a.xlarge","t3a.2xlarge","t4g.nano","t4g.micro","t4g.small","t4g.medium","t4g.large","t4g.xlarge","t4g.2xlarge","c5.large","c5.xlarge","c5.2xlarge","c5.4xlarge","c5.9xlarge","c5.12xlarge","c5.18xlarge","c5.24xlarge","c5a.large","c5a.xlarge","c5a.2xlarge","c5a.4xlarge","c5a.8xlarge","c5a.12xlarge","c5a.16xlarge","c5a.24xlarge","c6g.medium","c6g.large","c6g.xlarge","c6g.2xlarge","c6g.4xlarge","c6g.8xlarge","c6g.12xlarge","c6g.16xlarge","r5.large","r5.xlarge","r5.2xlarge","r5.4xlarge","r5.8xlarge","r5.12xlarge","r5.16xlarge","r5.24xlarge","r5a.large","r5a.xlarge","r5a.2xlarge","r5a.4xlarge","r5a.8xlarge","r5a.12xlarge","r5a.16xlarge","r5a.24xlarge","r6g.medium","r6g.large","r6g.xlarge","r6g.2xlarge","r6g.4xlarge","r6g.8xlarge","r6g.12xlarge","r6g.16xlarge","i3.large","i3.xlarge","i3.2xlarge","i3.4xlarge","i3.8xlarge","i3.16xlarge","p3.2xlarge","p3.8xlarge","p3.16xlarge","g4dn.xlarge","g4dn.2xlarge","g4dn.4xlarge","g4dn.8xlarge","g4dn.12xlarge","g4dn.16xlarge","m5.large","m5.xlarge","m5.2xlarge","m5.4xlarge","m5.8xlarge","m5.12xlarge","m5.16xlarge","m5.24xlarge","m5a.large","m5a.xlarge","m5a.2xlarge","m5a.4xlarge","m5a.8xlarge","m5a.12xlarge","m5a.16xlarge","m5a.24xlarge"],pT=[0,1,5,10,15,30,60];function mt(e,t){return e.includes(t)}RU(mt,"constIncludes");var fT=1,gT=65535,iX=Object.freeze({postgresql:5432,mysql:3306}),hT=128,vT=10240,ru=1,nu=900,iy=1,oy=1e3,qi=100,yT=100;var bT=3e3;var ST=["GET","POST","PUT","DELETE","HEAD","OPTIONS","PATCH"],ET=["standard","assets","upload","website"],Yi=["AES256","KMS"];var NU=Object.defineProperty,Oa=(e,t)=>NU(e,"name",{value:t,configurable:!0}),He=Oa(e=>s.union([s.literal(!1),e]),"optionalOrDisabled"),In={check:Oa(e=>e.minCapacity!==void 0&&e.maxCapacity!==void 0?e.minCapacity<=e.maxCapacity:!0,"check"),params:{message:m.CAPACITY_CONSTRAINT.MIN_LTE_MAX,path:["maxCapacity"]}},Da=Oa(e=>s.number().int(m.MEMORY_LIMIT.INTEGER).min(e,e===128?m.MEMORY_LIMIT.MIN_128:m.MEMORY_LIMIT.MIN_512).max(30720,m.MEMORY_LIMIT.MAX),"memoryLimitMiBSchema"),B=s.string().min(1,m.REQUIRED.RESOURCE_NAME).max(63,m.MAX_LENGTH.RESOURCE_NAME).regex(L.RESOURCE_NAME,m.RESOURCE_NAME),AT=s.string().min(1,m.REQUIRED.BUCKET_NAME).max(63,m.MAX_LENGTH.BUCKET_NAME).regex(L.BUCKET_NAME,m.BUCKET_NAME),xT=s.string().min(1,m.REQUIRED.DATABASE_NAME).max(63,m.MAX_LENGTH.DATABASE_NAME).regex(L.DATABASE_NAME,m.DATABASE_NAME);function iu(e,t=L.IDENTIFIER,r=m.IDENTIFIER){return s.string().min(2,m.IDENTIFIER_MIN_LENGTH).max(50,e).regex(t,r).refine(i=>!i.endsWith("-"),{message:m.IDENTIFIER_NO_TRAILING_HYPHEN}).refine(i=>!i.includes("--"),{message:m.IDENTIFIER_NO_CONSECUTIVE_HYPHENS})}Oa(iu,"identifierSchema");var Se=iu(m.MAX_LENGTH.APP_NAME),dX=iu(m.MAX_LENGTH.APP_NAME,L.NEW_APP_NAME,m.NEW_APP_NAME),$n=s.number().int(m.PORT.INTEGER).min(fT,m.PORT.MIN).max(gT,m.PORT.MAX),Pe=s.object({key:s.string(),sourceText:s.string()}).strict(),PU=s.object({__identifier:s.string()}).strict(),kU=s.object({__expression:s.string()}).strict(),CU=s.object({__call:s.string()}).strict(),wU=s.union([PU,kU,CU]),OU=s.union([s.string(),s.number(),s.boolean(),wU]),Xi=s.record(s.string().regex(L.ENV_VAR_NAME,m.ENV_VAR_NAME),OU),DU=s.object({id:s.string(),name:s.string().optional(),arn:s.string().optional(),field:s.string().optional()}).strict().refine(e=>e.name!==void 0!=(e.arn!==void 0),{message:"secretsImport requires exactly one of `name` or `arn`."}),IT=s.record(s.string(),DU),mX=s.record(s.string(),s.unknown()),ay=s.enum(Na).describe(`Application type must be one of: ${Na.join(", ")}`),sy=s.enum(wt).describe(`OpenNext deployment pattern: ${wt.join(", ")}`),jU=s.enum(["before-imports","after-imports","after-app-init","after-tags","after-resource","end-of-file"]),MU=s.enum(["import","app-init","tags","database","compute","storage","network","messaging","cdn","pattern","vpc-peer","vpc-peer-accepter","cross-plan-connection","custom"]),$T=s.object({sourceText:s.string(),position:jU,afterManagedResource:s.object({type:MU,name:s.string().optional()}).strict().optional(),originalLine:s.number().int().optional(),leadingComments:s.array(s.string()).optional(),orphaned:s.boolean().optional(),orphanedComment:s.string().optional()}).strict(),TT=s.union([s.object({tier:s.enum(xt)}).strict(),s.literal(!1)]),RT=s.union([s.object({instanceType:s.string().optional()}).strict(),s.literal(!1)]),zU=iu(m.MAX_LENGTH.ORGANISATION_NAME),LU=s.string().regex(L.EMAIL,m.EMAIL),_T=s.string().refine(e=>er.includes(e),{message:m.REGION}),pX=s.object({name:zU,email:LU,accountName:s.string().optional(),primaryRegion:_T.optional().default(Ri),secondaryRegions:s.array(_T).optional(),security:s.enum(mT).optional(),force:s.boolean().optional()}).strict();function ja(e){return e.issues.map(t=>`${t.path.length>0?`${t.path.join(".")}: `:""}${t.message}`).join(`
+`)}catch{}}gU(bU,"writeDebugSync");var SU=Object.defineProperty,Gi=(e,t)=>SU(e,"name",{value:t,configurable:!0});function Zv(e){return e.success===!0}Gi(Zv,"isSuccess");function Gv(e){return e.success===!1}Gi(Gv,"isFailure");function k(e){return{success:!0,data:e}}Gi(k,"success");function T(e){return{success:!1,error:e}}Gi(T,"failure");async function Wv(e){try{let t=await e();return k(t)}catch(t){return T(_t(t))}}Gi(Wv,"tryAsync");function Hv(e){try{let t=e();return k(t)}catch(t){return T(_t(t))}}Gi(Hv,"trySync");var EU=Object.defineProperty,_U=(e,t)=>EU(e,"name",{value:t,configurable:!0}),iT=/^[a-zA-Z][a-zA-Z0-9-]*$/,AU=da.source.replace(/^\^|\$$/g,""),L=Object.freeze({IDENTIFIER:iT,NEW_APP_NAME:/^[a-z][a-z0-9-]*$/,RESOURCE_NAME:/^[a-zA-Z][a-zA-Z0-9]*$/,ECS_SERVICE_NAME:iT,BUCKET_NAME:/^[a-z][a-z0-9-]*[a-z0-9]$|^[a-z][a-z0-9]*$/,DATABASE_NAME:/^[a-zA-Z][a-zA-Z0-9_]*$/,RESOURCE_TYPE:/^[a-z]+(:[a-z]+)?$/,SSM_PATH:new RegExp(`^(?:/${AU})+$`),SECRET_NAME:Il,SSM_COMPONENT:da,EMAIL:/^[^\s@]+@[^\s@]+\.[^\s@]+$/,DOCKER_IMAGE:/^[a-z0-9][a-z0-9._-]*[a-z0-9](:[a-z0-9._-]+)?$/,DOMAIN:/^[a-z0-9]([a-z0-9-]*[a-z0-9])?(\.[a-z0-9]([a-z0-9-]*[a-z0-9])?)+$/i,HTTP_ORIGIN:/^https?:\/\/[a-z0-9.-]+(:\d+)?$/i,PASCAL_CASE:/^[A-Z][A-Za-z0-9]*$/,AWS_ACCOUNT_ID:/^\d{12}$/,VPC_ID:/^vpc-[a-z0-9]+$/,ROLE_ARN:/^arn:aws[a-zA-Z-]*:iam::\d{12}:role\/.+$/,CIDR:/^((25[0-5]|2[0-4]\d|1\d\d|[1-9]?\d)\.){3}(25[0-5]|2[0-4]\d|1\d\d|[1-9]?\d)\/(3[0-2]|[12]?\d)$/,SCHEDULE_EXPRESSION:/^(rate\(1 (?:minute|hour|day)\)|rate\((?:[2-9]|[1-9]\d+) (?:minutes|hours|days)\)|cron\([^\s()]+ [^\s()]+ [^\s()]+ [^\s()]+ [^\s()]+ [^\s()]+\))$/,LAMBDA_RUNTIME_IDENTIFIER:/^[A-Za-z0-9._-]+$/,ENV_VAR_NAME:/^[A-Za-z_][A-Za-z0-9_]*$/});function Kv(e){let t=/^rate\((\d+) (minute|minutes|hour|hours|day|days)\)$/.exec(e);if(!t)return;let r=t[1],i=t[2];if(r===void 0||i===void 0)return;let n=parseInt(r,10);if(!Number.isFinite(n)||n<1)return;let o=i==="minute"||i==="hour"||i==="day";if(!(o&&n!==1)&&!(!o&&n===1))return i==="minute"||i==="minutes"?{everyMs:n*6e4}:i==="hour"||i==="hours"?{everyMs:n*60*6e4}:{everyMs:n*24*60*6e4}}_U(Kv,"parseRateExpression");var m=Object.freeze({IDENTIFIER:"Must start with a letter, contain only letters, numbers, and hyphens",NEW_APP_NAME:"Must start with a lowercase letter and contain only lowercase letters, numbers, and hyphens",IDENTIFIER_MIN_LENGTH:"Must be at least 2 characters",IDENTIFIER_NO_TRAILING_HYPHEN:"Must not end with a hyphen",IDENTIFIER_NO_CONSECUTIVE_HYPHENS:"Must not contain consecutive hyphens",RESOURCE_NAME:"Must start with a letter and contain only letters and numbers (PascalCase recommended)",ECS_SERVICE_NAME:"Service name must start with a letter and contain only letters, numbers, and hyphens",BUCKET_NAME:"Bucket name must start with a lowercase letter and contain only lowercase letters, numbers, and hyphens",DATABASE_NAME:"Database name must start with a letter and contain only letters, numbers, and underscores",RESOURCE_TYPE:"Resource type must be in format 'category' or 'category:type'",SSM_PATH:"SSM path must start with / and contain valid namespace segments (e.g., /myapp/ApiCluster/service)",SECRET_NAME:Yh,SSM_COMPONENT:$l,EMAIL:"Please enter a valid email address",DOMAIN:"Please enter a valid domain (e.g., cms.example.com)",DOCKER_IMAGE:"Invalid Docker image name format",REQUIRED:{APP_NAME:"Application name is required",RESOURCE_NAME:"Resource name is required",BUCKET_NAME:"Bucket name is required",SERVICE_NAME:"Service name is required",NETWORK_NAME:"Network name is required",DATABASE_NAME:"Database name is required",ORGANISATION_NAME:"Organisation name is required",EMAIL:"Email is required",NAME:"Name is required",USERNAME:"Username is required",CONTAINER_NAME:"Container name is required",GROUP:"Group is required",PATTERN_NAME:"Pattern name is required",SOURCE:"Source directory is required",BUILD_COMMAND:"Build command is required",OUTPUT_DIR:"Output directory is required",FORMS_TO:"Forms recipient address is required",ROUTING_PATH:"Routing path is required",RESOURCE_REFERENCE:"Resource reference is required",RESOURCE_TYPE:"Resource type is required",VARIANT:"Variant is required",SUBTYPE:"Subtype is required",DEPLOY_TARGET:"Deploy target is required",DESTROY_TARGET:"Destroy target is required"},MAX_LENGTH:{APP_NAME:"Application name must be 50 characters or less",RESOURCE_NAME:"Resource name must be 63 characters or less",BUCKET_NAME:"Bucket name must be 63 characters or less",SERVICE_NAME:"Service name must be 255 characters or less",NETWORK_NAME:"Network name must be 50 characters or less",DATABASE_NAME:"Database name must be 63 characters or less",ORGANISATION_NAME:"Organisation name must be 50 characters or less"},PORT:{INTEGER:"Port must be an integer",MIN:"Port must be at least 1",MAX:"Port cannot exceed 65535"},USERNAME:{MAX_LENGTH:"Username cannot exceed 63 characters"},LAMBDA:{MEMORY:{INTEGER:"Lambda memory must be an integer",MIN:"Memory must be at least 128 MB",MAX:"Memory cannot exceed 10240 MB",MULTIPLE:"Memory must be 128 MB or a multiple of 64 MB"},TIMEOUT:{INTEGER:"Timeout must be an integer",MIN:"Timeout must be at least 1 second",MAX:"Timeout cannot exceed 900 seconds"},RUNTIME:"Lambda runtime must contain only letters, digits, dots, underscores, or dashes (e.g. 'NODEJS_20_X' or 'nodejs20.x')"},ENV_VAR_NAME:"Environment variable names must start with a letter or underscore and contain only letters, digits, and underscores",PRIORITY:{INTEGER:"Priority must be an integer",MIN:"Priority must be at least 1",MAX:"Priority cannot exceed 50000"},CAPACITY:{MIN:{INTEGER:"Minimum capacity must be an integer",MIN_0:"Minimum capacity must be at least 0",MIN_1:"Minimum capacity must be at least 1",MAX:"Minimum capacity cannot exceed 100"},MAX:{INTEGER:"Maximum capacity must be an integer",MIN_0:"Maximum capacity must be at least 0",MIN_1:"Maximum capacity must be at least 1",MAX:"Maximum capacity cannot exceed 100"},DESIRED:{INTEGER:"Desired count must be an integer",MIN:"Desired count must be at least 0",MAX:"Desired count cannot exceed 100"},WARM_POOL_REQUIRED:"minCapacity 0 requires a warmPool \u2014 without it, new tasks wait 60-90s for a cold instance launch",WARM_POOL:{MIN_SIZE:{INTEGER:"Warm pool minSize must be an integer",MIN:"Warm pool minSize must be at least 0",MAX:"Warm pool minSize cannot exceed 100"},MIN_SIZE_EXCEEDS_MAX_CAPACITY:"warmPool.minSize cannot exceed maxCapacity \u2014 the warm pool cannot hold more instances than the ASG allows"}},MEMORY_LIMIT:{INTEGER:"Memory limit must be an integer",MIN_512:"Memory limit must be at least 512 MiB",MIN_128:"Memory limit must be at least 128 MiB",MAX:"Memory limit cannot exceed 30720 MiB"},DATABASE:{PORT:{INTEGER:"Database port must be an integer",MIN:"Database port must be at least 1024",MAX:"Database port cannot exceed 65535"},NAME:{REQUIRED:"Database name is required",MAX_LENGTH:"Database name must be 63 characters or less"}},BACKUP_RETENTION:{INTEGER:"Backup retention must be an integer",MIN:"Backup retention must be at least 1 day",MAX:"Backup retention cannot exceed 35 days"},SQS:{VISIBILITY_TIMEOUT:{INTEGER:"Visibility timeout must be an integer",MIN:"Visibility timeout must be at least 0 seconds",MAX:"Visibility timeout cannot exceed 43200 seconds (12 hours)"},RETENTION_PERIOD:{INTEGER:"Retention period must be an integer",MIN:"Retention period must be at least 60 seconds",MAX:"Retention period cannot exceed 1209600 seconds (14 days)"}},READER:{COUNT:{INTEGER:"Reader count must be an integer",MIN:"Reader count must be at least 0",MAX:"Reader count cannot exceed 15"}},IDENTIFIER_SUFFIX:{REQUIRED:"Identifier suffix is required when specified",MAX_LENGTH:"Identifier suffix cannot exceed 50 characters"},ROTATION:{INTEGER:"Rotation days must be an integer",MIN:"Rotation interval must be at least 1 day",MAX:"Rotation interval cannot exceed 365 days"},MAX_CONNECTIONS:{INTEGER:"Max connections must be an integer",MIN:"Max connections must be at least 1",MAX:"Max connections cannot exceed 100"},MONITORING_INTERVAL:{INTEGER:"Monitoring interval must be an integer",MIN:"Monitoring interval must be at least 0",MAX:"Monitoring interval cannot exceed 60 seconds",VALUES:"Monitoring interval must be 0, 1, 5, 10, 15, 30, or 60 seconds"},RETENTION_DAYS:{INTEGER:"Retention days must be an integer",MIN:"Retention days must be at least 1",MAX:"Retention days cannot exceed 365"},BATCH_SIZE:{INTEGER:"Batch size must be an integer",MIN:"Batch size must be at least 1",MAX:"Batch size cannot exceed 10000"},SERVICE:{UNIQUE_WITHIN_CLUSTER:"Service names must be unique within a cluster",MIN_REQUIRED:"At least one service is required",ROUTING_REQUIRED:"Multiple services with ports require routing config (path or host)"},PROXY_CONFIG:{MAX_IDLE_CONNECTIONS:{INTEGER:"Max idle connections must be an integer",MIN:"Max idle connections must be at least 0",MAX:"Max idle connections cannot exceed 100"},BORROW_TIMEOUT:{INTEGER:"Connection borrow timeout must be an integer",MIN:"Connection borrow timeout must be at least 1 second",MAX:"Connection borrow timeout cannot exceed 3600 seconds"}},MAX_AZS:{INTEGER:"Max AZs must be an integer",MIN:"Max AZs must be at least 1",MAX:"Max AZs cannot exceed 3"},BATCHING_WINDOW:{INTEGER:"Max batching window must be an integer",MIN:"Max batching window must be at least 0",MAX:"Max batching window cannot exceed 300 seconds"},HEALTH_CHECK:{INTERVAL:{INTEGER:"Health check interval must be an integer",MIN:"Health check interval must be at least 5 seconds",MAX:"Health check interval cannot exceed 300 seconds"},TIMEOUT:{INTEGER:"Health check timeout must be an integer",MIN:"Health check timeout must be at least 2 seconds",MAX:"Health check timeout cannot exceed 60 seconds"},RETRIES:{INTEGER:"Health check retries must be an integer",MIN:"Health check retries must be at least 1",MAX:"Health check retries cannot exceed 10"},START_PERIOD:{INTEGER:"Health check start period must be an integer",MIN:"Health check start period must be at least 0 seconds",MAX:"Health check start period cannot exceed 300 seconds"}},EPHEMERAL_STORAGE:{INTEGER:"Ephemeral storage size must be an integer",MIN:"Ephemeral storage size must be at least 512 MB",MAX:"Ephemeral storage size cannot exceed 10240 MB"},MAX_MESSAGE_SIZE:{INTEGER:"Max message size must be an integer",MIN:"Max message size must be at least 1024 bytes",MAX:"Max message size cannot exceed 262144 bytes (256 KB)"},CAPACITY_CONSTRAINT:{MIN_LTE_MAX:"minCapacity must be less than or equal to maxCapacity"},DIRECT_ACCESS:{NO_DOMAIN:"directAccess cannot be used with domain (no ALB for HTTPS)",NO_LOAD_BALANCER:"directAccess cannot be used with loadBalancer (mutually exclusive)"},GLOBAL_AURORA:{PRIMARY_REGION_REQUIRED:"primaryRegion is required for GlobalAurora databases"},NAT_GATEWAY:{INTEGER:"NAT gateway count must be an integer",MIN:"NAT gateway count must be at least 0",MAX:"NAT gateway count cannot exceed 3"},CIDR_MASK:{INTEGER:"CIDR mask must be an integer",MIN:"CIDR mask must be at least 16",MAX:"CIDR mask cannot exceed 28"},CPU:{INTEGER:"CPU must be an integer",MIN:"CPU must be at least 256 units",MAX:"CPU cannot exceed 4096 units"},KMS:{KEY_REQUIRED:"KMS key ARN is required when using KMS encryption"},READER_INSTANCES:{MAX:"Cannot have more than 15 reader instances",COUNT_OR_INSTANCES:"Cannot specify both 'count' and 'instances' - use one or the other"},GENERATOR_CAPACITY:{MIN:{MIN:"Minimum capacity must be at least 1",MAX:"Minimum capacity cannot exceed 1000"},MAX:{MIN:"Maximum capacity must be at least 1",MAX:"Maximum capacity cannot exceed 1000"}},INSTANCE_TYPE:"Unknown instance type. Common types include: t4g.micro, t4g.small, m5.large",ARCHITECTURE_MISMATCH:"Architecture mismatch between instance type and AMI",ALLOCATED_STORAGE:{INTEGER:"Allocated storage must be an integer",MIN:"Allocated storage must be at least 20 GB",MAX:"Allocated storage cannot exceed 65536 GB"},DLQ:{MAX_RECEIVE_COUNT:{INTEGER:"Max receive count must be an integer",MIN:"Max receive count must be at least 1",MAX:"Max receive count cannot exceed 1000"}},ALARM:{PERCENTAGE:{MIN:"Threshold must be at least 1%",MAX:"Threshold must be at most 100%"},FREE_STORAGE_GIB:{MIN:"Free storage threshold must be at least 1 GiB"}},REGION:"Invalid AWS region",PASCAL_CASE:"Resource name must start with an uppercase letter and contain only alphanumerics (PascalCase).",IMAGE_DOCKER_MUTEX:"image and docker are mutually exclusive",AWS_ACCOUNT_ID:"AWS account id must be exactly 12 digits (no hyphens)",VPC_ID:"VPC id must look like vpc-abc12345",ROLE_ARN:"Role ARN must have the form arn:aws:iam::<account-id>:role/<name>",CIDR:"CIDR must be in dotted-quad/prefix-length form (e.g. 10.0.0.0/16)",VPC_PEER:{MIN_REQUESTER_ACCOUNTS:"At least one requester account id is required",REGION_REQUIRED:"Peer region is required when specified",ROUTE_TABLE_ID_REQUIRED:"Route table id must not be empty"},SCHEDULE_EXPRESSION:"Schedule expression must be 'rate(N minute|minutes|hour|hours|day|days)' with N>=1, or 'cron(<6-field AWS expression>)'"});var xU=Object.defineProperty,dt=(e,t)=>xU(e,"name",{value:t,configurable:!0}),IU=["us-east-2","us-west-2","us-east-1","eu-west-1","eu-central-1","ap-southeast-1"],$U=Object.freeze(IU.flatMap(e=>{let t=Ni(e);return t?[t]:[]})),qv=Object.freeze(["us-east-2","us-west-2","us-east-1","eu-west-1","ap-southeast-1"]);function Wl(e){return e?e.split(",").map(t=>t.trim()).filter(Boolean):[]}dt(Wl,"parseRegionList");function Yv(e){return er.includes(e)}dt(Yv,"isValidRegion");function Xv(e){return/^[a-z]{2}-[a-z]+-[1-9]$/.test(e)}dt(Xv,"isValidRegionFormat");function Jv(e){if(!e)return qv.slice(0,3);let t=e.toLowerCase().split("-"),r=t[0],i=t.length>1?t[1]:"",n=[];return r&&i&&(n=er.filter(o=>o.startsWith(`${r}-${i}`))),n.length===0&&r&&(n=er.filter(o=>o.startsWith(`${r}-`))),n.length>0?n.slice(0,3):qv.slice(0,3)}dt(Jv,"getSuggestions");function Qv(e){if(Yv(e))return!0;let t=Jv(e);return Xv(e)?`Unknown region. Try: ${t.join(", ")}`:`Invalid format. Try: ${t.join(", ")}`}dt(Qv,"validateRegion");function oT(e){if(!e||e.trim()==="")return!0;let t=Wl(e);for(let r of t){let i=Qv(r);if(i!==!0)return i}return!0}dt(oT,"validateRegionList");function ey(e,t){return e.filter(r=>r!==t)}dt(ey,"filterDuplicateRegions");function ty(e){return{label:e.city,value:e.code,description:e.optIn?`${e.code} \u2014 opt-in required`:e.code}}dt(ty,"toRegionOption");function aT(){return lt.map(ty)}dt(aT,"getRegionOptions");function sT(e){return lt.filter(t=>t.code!==e).map(ty)}dt(sT,"getRegionOptionsExcluding");function cT(e){let t=lt.find(r=>r.code===e);return t?t.city:e}dt(cT,"getRegionName");function lT(e){return t=>{let r=Wl(t);return ey(r,e)}}dt(lT,"createRegionFormatter");var Hl="14.1.0";var Kl=["Aurora","Instance","GlobalAurora","ClickHouse"],Wi=["FARGATE","FARGATE_SPOT","EC2"],xt=["standard","resilient","enterprise"],ql=["tinkerer","lightweight","standard","resilient","enterprise"],ry="custom",Na=[...ql,ry];var TU=Object.defineProperty,RU=(e,t)=>TU(e,"name",{value:t,configurable:!0}),uT=Object.freeze({RESOURCE_SUFFIXES:Object.freeze({storage:"Storage",database:"Database",cluster:"Cluster",function:"Function",instance:"Instance",compute:"Compute"})}),Pa=["ecs","lambda","ec2"],Hi=Object.freeze({ECS:"ecs",LAMBDA:"lambda",EC2:"ec2"}),Yl=["code","container"],ka=Object.freeze({CODE:"code",CONTAINER:"container"}),Xl=["ARM_64","X86_64"],dT="ARM_64",Ca=["NONE","AWS_IAM"],Jl=["public","internal"],Ql=["CPU","MEMORY"],eu=["ARM","STANDARD"],ny=["Instance","Aurora"],Ki=["postgresql","mysql"],wa=["web","worker"],mT=["foundation","compliance","hardened"];var tu=["t3.nano","t3.micro","t3.small","t3.medium","t3.large","t3.xlarge","t3.2xlarge","t3a.nano","t3a.micro","t3a.small","t3a.medium","t3a.large","t3a.xlarge","t3a.2xlarge","t4g.nano","t4g.micro","t4g.small","t4g.medium","t4g.large","t4g.xlarge","t4g.2xlarge","c5.large","c5.xlarge","c5.2xlarge","c5.4xlarge","c5.9xlarge","c5.12xlarge","c5.18xlarge","c5.24xlarge","c5a.large","c5a.xlarge","c5a.2xlarge","c5a.4xlarge","c5a.8xlarge","c5a.12xlarge","c5a.16xlarge","c5a.24xlarge","c6g.medium","c6g.large","c6g.xlarge","c6g.2xlarge","c6g.4xlarge","c6g.8xlarge","c6g.12xlarge","c6g.16xlarge","r5.large","r5.xlarge","r5.2xlarge","r5.4xlarge","r5.8xlarge","r5.12xlarge","r5.16xlarge","r5.24xlarge","r5a.large","r5a.xlarge","r5a.2xlarge","r5a.4xlarge","r5a.8xlarge","r5a.12xlarge","r5a.16xlarge","r5a.24xlarge","r6g.medium","r6g.large","r6g.xlarge","r6g.2xlarge","r6g.4xlarge","r6g.8xlarge","r6g.12xlarge","r6g.16xlarge","i3.large","i3.xlarge","i3.2xlarge","i3.4xlarge","i3.8xlarge","i3.16xlarge","p3.2xlarge","p3.8xlarge","p3.16xlarge","g4dn.xlarge","g4dn.2xlarge","g4dn.4xlarge","g4dn.8xlarge","g4dn.12xlarge","g4dn.16xlarge","m5.large","m5.xlarge","m5.2xlarge","m5.4xlarge","m5.8xlarge","m5.12xlarge","m5.16xlarge","m5.24xlarge","m5a.large","m5a.xlarge","m5a.2xlarge","m5a.4xlarge","m5a.8xlarge","m5a.12xlarge","m5a.16xlarge","m5a.24xlarge"],pT=[0,1,5,10,15,30,60];function mt(e,t){return e.includes(t)}RU(mt,"constIncludes");var fT=1,gT=65535,iX=Object.freeze({postgresql:5432,mysql:3306}),hT=128,vT=10240,ru=1,nu=900,iy=1,oy=1e3,qi=100,yT=100;var bT=3e3;var ST=["GET","POST","PUT","DELETE","HEAD","OPTIONS","PATCH"],ET=["standard","assets","upload","website"],Yi=["AES256","KMS"];var NU=Object.defineProperty,Oa=(e,t)=>NU(e,"name",{value:t,configurable:!0}),He=Oa(e=>s.union([s.literal(!1),e]),"optionalOrDisabled"),In={check:Oa(e=>e.minCapacity!==void 0&&e.maxCapacity!==void 0?e.minCapacity<=e.maxCapacity:!0,"check"),params:{message:m.CAPACITY_CONSTRAINT.MIN_LTE_MAX,path:["maxCapacity"]}},Da=Oa(e=>s.number().int(m.MEMORY_LIMIT.INTEGER).min(e,e===128?m.MEMORY_LIMIT.MIN_128:m.MEMORY_LIMIT.MIN_512).max(30720,m.MEMORY_LIMIT.MAX),"memoryLimitMiBSchema"),B=s.string().min(1,m.REQUIRED.RESOURCE_NAME).max(63,m.MAX_LENGTH.RESOURCE_NAME).regex(L.RESOURCE_NAME,m.RESOURCE_NAME),AT=s.string().min(1,m.REQUIRED.BUCKET_NAME).max(63,m.MAX_LENGTH.BUCKET_NAME).regex(L.BUCKET_NAME,m.BUCKET_NAME),xT=s.string().min(1,m.REQUIRED.DATABASE_NAME).max(63,m.MAX_LENGTH.DATABASE_NAME).regex(L.DATABASE_NAME,m.DATABASE_NAME);function iu(e,t=L.IDENTIFIER,r=m.IDENTIFIER){return s.string().min(2,m.IDENTIFIER_MIN_LENGTH).max(50,e).regex(t,r).refine(i=>!i.endsWith("-"),{message:m.IDENTIFIER_NO_TRAILING_HYPHEN}).refine(i=>!i.includes("--"),{message:m.IDENTIFIER_NO_CONSECUTIVE_HYPHENS})}Oa(iu,"identifierSchema");var Se=iu(m.MAX_LENGTH.APP_NAME),dX=iu(m.MAX_LENGTH.APP_NAME,L.NEW_APP_NAME,m.NEW_APP_NAME),$n=s.number().int(m.PORT.INTEGER).min(fT,m.PORT.MIN).max(gT,m.PORT.MAX),Pe=s.object({key:s.string(),sourceText:s.string()}).strict(),PU=s.object({__identifier:s.string()}).strict(),kU=s.object({__expression:s.string()}).strict(),CU=s.object({__call:s.string()}).strict(),wU=s.union([PU,kU,CU]),OU=s.union([s.string(),s.number(),s.boolean(),wU]),Xi=s.record(s.string().regex(L.ENV_VAR_NAME,m.ENV_VAR_NAME),OU),DU=s.object({id:s.string(),name:s.string().optional(),arn:s.string().optional(),field:s.string().optional()}).strict().refine(e=>e.name!==void 0!=(e.arn!==void 0),{message:"secretsImport requires exactly one of `name` or `arn`."}),IT=s.record(s.string(),DU),mX=s.record(s.string(),s.unknown()),ay=s.enum(Na).describe(`Application type must be one of: ${Na.join(", ")}`),sy=s.enum(wt).describe(`OpenNext deployment pattern: ${wt.join(", ")}`),jU=s.enum(["before-imports","after-imports","after-app-init","after-tags","after-resource","end-of-file"]),MU=s.enum(["import","app-init","tags","database","compute","storage","network","messaging","cdn","pattern","vpc-peer","vpc-peer-accepter","cross-plan-connection","custom"]),$T=s.object({sourceText:s.string(),position:jU,afterManagedResource:s.object({type:MU,name:s.string().optional()}).strict().optional(),originalLine:s.number().int().optional(),leadingComments:s.array(s.string()).optional(),orphaned:s.boolean().optional(),orphanedComment:s.string().optional()}).strict(),TT=s.union([s.object({tier:s.enum(xt)}).strict(),s.literal(!1)]),RT=s.union([s.object({instanceType:s.string().optional()}).strict(),s.literal(!1)]),zU=iu(m.MAX_LENGTH.ORGANISATION_NAME),LU=s.string().regex(L.EMAIL,m.EMAIL),_T=s.string().refine(e=>er.includes(e),{message:m.REGION}),pX=s.object({name:zU,email:LU,accountName:s.string().optional(),primaryRegion:_T.optional().default(Ri),secondaryRegions:s.array(_T).optional(),security:s.enum(mT).optional(),force:s.boolean().optional()}).strict();function ja(e){return e.issues.map(t=>`${t.path.length>0?`${t.path.join(".")}: `:""}${t.message}`).join(`
 `)}Oa(ja,"getZodErrorMessage");var ou=s.number().min(1,m.ALARM.PERCENTAGE.MIN).max(100,m.ALARM.PERCENTAGE.MAX),cy=s.union([ou,s.literal(!1)]),UU=s.number().min(1,m.ALARM.FREE_STORAGE_GIB.MIN),NT=s.union([s.literal(!1),s.object({cpuThreshold:cy.optional(),memoryThreshold:cy.optional(),runningTasksMinimum:s.number().int().min(0).optional(),http5xxThreshold:cy.optional()}).strict()]),PT=s.union([s.literal(!1),s.object({cpuThreshold:ou.optional(),freeStorageThresholdGiB:UU.optional(),connectionsThreshold:s.number().int().min(1).optional()}).strict()]),kT=s.union([s.literal(!1),s.object({errorRateThreshold:ou.optional(),durationThresholdPercent:ou.optional()}).strict()]);var cr=s.number().int(m.BACKUP_RETENTION.INTEGER).min(1,m.BACKUP_RETENTION.MIN).max(35,m.BACKUP_RETENTION.MAX),Ma=s.number().int(m.MONITORING_INTERVAL.INTEGER).refine(e=>mt(pT,e),{message:m.MONITORING_INTERVAL.VALUES}),su=s.number().int(m.DATABASE.PORT.INTEGER).min(1024,m.DATABASE.PORT.MIN).max(65535,m.DATABASE.PORT.MAX),FU=s.enum(Kl).describe(`Database type must be one of: ${Kl.join(", ")}`),VU=s.object({maxConnections:s.number().int(m.MAX_CONNECTIONS.INTEGER).min(1,m.MAX_CONNECTIONS.MIN).max(100,m.MAX_CONNECTIONS.MAX).optional(),maxIdleConnections:s.number().int(m.PROXY_CONFIG.MAX_IDLE_CONNECTIONS.INTEGER).min(0,m.PROXY_CONFIG.MAX_IDLE_CONNECTIONS.MIN).max(100,m.PROXY_CONFIG.MAX_IDLE_CONNECTIONS.MAX).optional(),connectionBorrowTimeout:s.number().int(m.PROXY_CONFIG.BORROW_TIMEOUT.INTEGER).min(1,m.PROXY_CONFIG.BORROW_TIMEOUT.MIN).max(3600,m.PROXY_CONFIG.BORROW_TIMEOUT.MAX).optional(),requireTLS:s.boolean().optional()}).strict().describe("RDS Proxy configuration"),BU=s.object({instanceType:s.string().optional(),availabilityZone:s.string().optional()}).strict().describe("Read replica configuration"),ZU=s.object({automaticallyAfterDays:s.number().int(m.ROTATION.INTEGER).min(1,m.ROTATION.MIN).max(365,m.ROTATION.MAX).optional()}).strict().describe("Secret rotation configuration"),cu=s.object({username:s.string().min(1,m.REQUIRED.USERNAME).max(63,m.USERNAME.MAX_LENGTH).optional(),secretRotation:ZU.optional()}).strict().describe("Database credentials configuration"),lu=He(VU),uu=He(BU),GU=s.object({scaleWithWriter:s.boolean().optional(),enableDatabaseInsights:s.boolean().optional(),identifierSuffix:s.string().min(1,m.IDENTIFIER_SUFFIX.REQUIRED).max(50,m.IDENTIFIER_SUFFIX.MAX_LENGTH).optional(),availabilityZone:s.string().optional()}).strict().describe("Configuration for a single Aurora reader instance"),za=s.object({enableDatabaseInsights:s.boolean().optional(),identifierSuffix:s.string().min(1,m.IDENTIFIER_SUFFIX.REQUIRED).max(50,m.IDENTIFIER_SUFFIX.MAX_LENGTH).optional(),availabilityZone:s.string().optional()}).strict().describe("Configuration for Aurora writer instance"),WU=s.object({count:s.number().int(m.READER.COUNT.INTEGER).min(0,m.READER.COUNT.MIN).max(15,m.READER.COUNT.MAX).optional(),instances:s.array(GU).max(15,m.READER_INSTANCES.MAX).optional(),defaultEnableDatabaseInsights:s.boolean().optional()}).strict().refine(e=>!(e.count!==void 0&&e.instances!==void 0),{message:m.READER_INSTANCES.COUNT_OR_INSTANCES,path:["count"]}).describe("Aurora readers configuration"),La=He(WU),HU=s.object({awsManaged:s.literal(!0)}).strict(),KU=s.object({useCMK:s.literal(!0)}).strict(),CT=s.union([HU,KU]),qU=s.object({mode:s.enum(["standard","advanced"]).optional(),encryptionKey:CT.optional()}).strict().describe("Database Insights configuration"),du=He(qU),mu=s.object({storageKey:CT.optional()}).strict().describe("Encryption configuration (DESTRUCTIVE to change storageKey)"),wT=s.object({name:B,type:FU,databaseName:s.string().min(1,m.REQUIRED.DATABASE_NAME),instanceType:s.string().optional(),allocatedStorage:s.number().optional(),multiAz:s.boolean().optional(),publiclyAccessible:s.boolean().optional(),databaseInsights:du.optional(),port:su.optional(),deletionProtection:s.boolean().optional(),proxy:lu.optional(),credentials:cu.optional(),readReplica:uu.optional(),encryption:mu.optional(),writer:za.optional(),readers:La.optional(),backupRetention:cr.optional(),preferredMaintenanceWindow:s.string().optional(),monitoringInterval:Ma.optional(),primaryRegion:s.string().optional(),secondaryRegions:s.array(s.string()).optional(),globalClusterIdentifier:s.string().optional(),enableGlobalWriteForwarding:s.boolean().optional(),snapshotIdentifier:s.string().optional(),snapshotUsername:s.string().optional(),databaseEngine:s.enum(Ki).optional(),engineExpression:s.string().optional(),variableName:s.string().optional(),extraProperties:s.array(Pe).optional(),alarms:PT.optional()}).strict(),pu=s.object({appName:Se,nameProvidedByFlag:s.boolean().optional(),databaseName:s.string().min(1,m.REQUIRED.DATABASE_NAME).max(63,m.MAX_LENGTH.DATABASE_NAME).regex(L.DATABASE_NAME,m.DATABASE_NAME),resourceName:B.optional(),connectionConfig:s.object({connectToCompute:s.array(s.string()).optional(),connectToServices:s.array(s.string()).optional()}).strict().optional(),databaseInsights:du.optional(),port:su.optional(),proxy:lu.optional(),credentials:cu.optional(),encryption:mu.optional(),deletionProtection:s.boolean().optional()}).strict(),OT={databaseType:s.literal("Instance"),instanceType:s.string().optional(),multiAz:s.boolean().optional(),readReplica:uu.optional(),publiclyAccessible:s.boolean().optional(),backupRetention:cr.optional(),allocatedStorage:s.number().optional(),snapshotIdentifier:s.string().optional(),snapshotUsername:s.string().optional()},DT={databaseType:s.literal("Aurora"),writer:za.optional(),readers:La.optional(),backupRetention:cr.optional(),preferredMaintenanceWindow:s.string().optional(),monitoringInterval:Ma.optional(),snapshotIdentifier:s.string().optional(),snapshotUsername:s.string().optional()},jT={databaseType:s.literal("GlobalAurora"),primaryRegion:s.string().min(1,m.GLOBAL_AURORA.PRIMARY_REGION_REQUIRED),secondaryRegions:s.array(s.string()).optional(),globalClusterIdentifier:s.string().optional(),enableGlobalWriteForwarding:s.boolean().optional(),writer:za.optional(),readers:La.optional(),backupRetention:cr.optional(),preferredMaintenanceWindow:s.string().optional(),monitoringInterval:Ma.optional(),snapshotIdentifier:s.string().optional(),snapshotUsername:s.string().optional()},MT=s.object({appName:Se,nameProvidedByFlag:s.boolean().optional(),databaseName:s.string().min(1,m.REQUIRED.DATABASE_NAME).max(63,m.MAX_LENGTH.DATABASE_NAME).regex(L.DATABASE_NAME,m.DATABASE_NAME),resourceName:B.optional(),connectionConfig:s.object({connectToCompute:s.array(s.string()).optional(),connectToServices:s.array(s.string()).optional()}).strict().optional()}).strict(),zT={databaseType:s.literal("ClickHouse"),instanceType:s.string().optional(),coldTier:s.union([s.object({mode:s.literal("s3")}).strict(),s.literal(!1)]).optional(),optimiseSchedule:s.union([s.string(),s.literal(!1)]).optional(),backupSchedule:s.union([s.string(),s.literal(!1)]).optional(),backupRetentionDays:cr.optional()},YU=pu.extend(OT).strict(),XU=pu.extend(DT).strict(),JU=pu.extend(jT).strict(),QU=MT.extend(zT).strict(),AX=s.discriminatedUnion("databaseType",[YU,XU,JU,QU]),ly=pu.extend({resourceName:B}).strict(),eF=ly.extend(OT).strict(),tF=ly.extend(DT).strict(),rF=ly.extend(jT).strict(),nF=MT.extend({resourceName:B}).strict(),iF=nF.extend(zT).strict(),xX=s.discriminatedUnion("databaseType",[eF,tF,rF,iF]),IX=s.object({appName:Se,databaseName:s.string().min(1,m.REQUIRED.DATABASE_NAME),maxConnections:s.number().int(m.MAX_CONNECTIONS.INTEGER).min(1,m.MAX_CONNECTIONS.MIN).max(100,m.MAX_CONNECTIONS.MAX).optional(),maxIdleConnections:s.number().int(m.PROXY_CONFIG.MAX_IDLE_CONNECTIONS.INTEGER).min(0,m.PROXY_CONFIG.MAX_IDLE_CONNECTIONS.MIN).max(100,m.PROXY_CONFIG.MAX_IDLE_CONNECTIONS.MAX).optional(),connectionBorrowTimeout:s.number().int(m.PROXY_CONFIG.BORROW_TIMEOUT.INTEGER).min(1,m.PROXY_CONFIG.BORROW_TIMEOUT.MIN).max(3600,m.PROXY_CONFIG.BORROW_TIMEOUT.MAX).optional(),requireTLS:s.boolean().optional(),nameProvidedByFlag:s.boolean().optional()}).strict(),oF=["S","N","B"],au=s.object({name:s.string(),type:s.enum(oF)}).strict(),LT=s.object({name:B,partitionKey:au,sortKey:au.optional(),globalSecondaryIndexes:s.array(s.object({indexName:s.string(),partitionKey:au,sortKey:au.optional()}).strict()).optional(),ttlAttribute:s.string().optional(),stream:s.boolean().optional(),variableName:s.string().optional(),extraProperties:s.array(Pe).optional()}).strict(),aF=s.object({mode:s.literal("s3")}).strict(),UT=s.object({name:B,type:s.literal("ClickHouse"),databaseName:xT,instanceType:s.string().optional(),coldTier:s.union([aF,s.literal(!1)]).optional(),optimiseSchedule:s.union([s.string(),s.literal(!1)]).optional(),backupSchedule:s.union([s.string(),s.literal(!1)]).optional(),backupRetentionDays:cr.optional(),variableName:s.string().optional(),extraProperties:s.array(Pe).optional()}).strict();var sF=s.object({count:s.number().int(m.NAT_GATEWAY.INTEGER).min(0,m.NAT_GATEWAY.MIN).max(3,m.NAT_GATEWAY.MAX).optional()}).strict().describe("NAT gateway configuration"),FT=He(sF),uy=s.enum(["cloudwatch","s3"]),cF=s.object({destination:uy.optional(),retentionDays:s.number().int(m.RETENTION_DAYS.INTEGER).min(1,m.RETENTION_DAYS.MIN).max(365,m.RETENTION_DAYS.MAX).optional(),trafficType:s.enum(["ALL","ACCEPT","REJECT"]).optional()}).strict().describe("VPC flow log configuration"),VT=He(cF),lF=s.object({s3:s.boolean().optional(),dynamodb:s.boolean().optional()}).strict().describe("Gateway VPC endpoints (FREE)"),uF=He(lF),dF=s.object({ecr:s.boolean().optional(),secretsManager:s.boolean().optional(),kms:s.boolean().optional(),cloudwatchLogs:s.boolean().optional(),ssm:s.boolean().optional(),sts:s.boolean().optional()}).strict().describe("Interface VPC endpoints (cost per hour)"),mF=He(dF),pF=s.object({gateway:uF.optional(),interface:mF.optional()}).strict().describe("VPC endpoints configuration"),BT=He(pF),fu=s.object({maxAzs:s.number().int(m.MAX_AZS.INTEGER).min(1,m.MAX_AZS.MIN).max(3,m.MAX_AZS.MAX).optional(),natGateways:FT.optional(),flowLogs:VT.optional(),vpcEndpoints:BT.optional(),cidrMask:s.number().int(m.CIDR_MASK.INTEGER).min(16,m.CIDR_MASK.MIN).max(28,m.CIDR_MASK.MAX).optional()}).strict(),ZT=s.string().min(1,m.REQUIRED.NETWORK_NAME).max(50,m.MAX_LENGTH.NETWORK_NAME).regex(L.RESOURCE_NAME,m.RESOURCE_NAME),GT=fu.extend({name:ZT}).strict(),WT=He(fu),PX=s.object({appName:Se,networkName:ZT.optional(),maxAzs:s.number().int(m.MAX_AZS.INTEGER).min(1,m.MAX_AZS.MIN).max(3,m.MAX_AZS.MAX).optional(),natGateways:FT.optional(),flowLogs:VT.optional(),vpcEndpoints:BT.optional()}).strict(),fF=L.CIDR,dy=s.string().regex(fF,m.CIDR),gF=s.object({kind:s.literal("database"),resource:s.string().min(1,m.REQUIRED.RESOURCE_REFERENCE),name:B,allowedFromCidrs:s.array(dy),access:s.enum(["read","write","readWrite"]).optional()}).strict(),hF=s.object({kind:s.literal("ecsService"),resource:s.string().min(1,m.REQUIRED.RESOURCE_REFERENCE),serviceName:s.string().min(1,m.REQUIRED.SERVICE_NAME),name:B,allowedFromCidrs:s.array(dy),port:$n.optional()}).strict(),vF=s.discriminatedUnion("kind",[gF,hF]),kX=s.object({name:B,peerAppName:s.string().min(1,m.REQUIRED.APP_NAME),peerAccountId:s.string().regex(L.AWS_ACCOUNT_ID,m.AWS_ACCOUNT_ID),peerRegion:s.string().min(1,m.VPC_PEER.REGION_REQUIRED).optional(),peerVpcId:s.string().regex(L.VPC_ID,m.VPC_ID).optional(),peerVpcCidr:dy.optional(),peerRoleArn:s.string().regex(L.ROLE_ARN,m.ROLE_ARN).optional(),peerRouteTableIds:s.array(s.string().min(1,m.VPC_PEER.ROUTE_TABLE_ID_REQUIRED)).optional(),localVpcName:s.string().min(1,m.REQUIRED.NETWORK_NAME).optional(),enableDnsResolution:s.boolean().optional()}).strict(),CX=s.object({name:B,requesterAccountIds:s.array(s.string().regex(L.AWS_ACCOUNT_ID,m.AWS_ACCOUNT_ID)).min(1,m.VPC_PEER.MIN_REQUESTER_ACCOUNTS),localVpcName:s.string().min(1,m.REQUIRED.NETWORK_NAME).optional(),publishToSsm:s.boolean().optional(),exposedResources:s.array(vF).optional()}).strict();var gu=["storage","cdn","compute"],yF=s.object({sid:s.string().optional(),effect:s.enum(["Allow","Deny"]),principals:s.array(s.string()),actions:s.array(s.string()),resources:s.array(s.string()).optional(),conditions:s.record(s.string(),s.record(s.string(),s.union([s.string(),s.array(s.string())]))).optional()}).strict(),HT=s.object({name:B,bucketName:s.string().optional(),publicReadAccess:s.boolean().optional(),websiteHosting:s.object({indexDocument:s.string(),errorDocument:s.string().optional()}).strict().optional(),backupVaultTier:s.enum(xt).optional(),versioned:s.boolean().optional(),encryption:s.enum(Yi).optional(),kmsKeyArn:s.string().optional(),cors:s.array(s.object({allowedOrigins:s.array(s.string()),allowedMethods:s.array(s.string()),allowedHeaders:s.array(s.string()).optional(),exposedHeaders:s.array(s.string()).optional(),maxAge:s.number().optional()}).strict()).optional(),deployment:s.object({source:s.string(),prune:s.boolean().optional(),cacheControl:s.object({maxAge:s.number().optional(),immutable:s.boolean().optional()}).strict().optional()}).strict().optional(),retain:s.boolean().optional(),resourcePolicyStatements:s.array(yF).optional(),stackPlacement:s.enum(gu).optional(),variableName:s.string().optional(),extraProperties:s.array(Pe).optional()}).strict().refine(e=>e.encryption!=="KMS"||!!e.kmsKeyArn,{message:m.KMS.KEY_REQUIRED}),zX=s.object({appName:Se,bucketName:AT,nameProvidedByFlag:s.boolean().optional(),storagePreset:s.enum(ET).optional(),publicReadAccess:s.boolean().optional(),websiteHosting:s.object({indexDocument:s.string(),errorDocument:s.string().optional()}).strict().optional(),backupVaultTier:s.enum(xt).optional(),versioned:s.boolean().optional(),encryption:s.enum(Yi).optional(),kmsKeyArn:s.string().optional(),cors:s.array(s.object({allowedOrigins:s.array(s.string()),allowedMethods:s.array(s.string()),allowedHeaders:s.array(s.string()).optional(),exposedHeaders:s.array(s.string()).optional(),maxAge:s.number().optional()}).strict()).optional(),connectionConfig:s.object({connectToCompute:s.array(s.string()).optional(),connectToServices:s.array(s.string()).optional()}).strict().optional()}).strict().refine(e=>e.encryption!=="KMS"||!!e.kmsKeyArn,{message:m.KMS.KEY_REQUIRED,path:["kmsKeyArn"]});var my=s.enum(["DESTROY","RETAIN"]),KT=s.object({name:B,queueType:s.enum(["standard","fifo"]).default("standard"),visibilityTimeout:s.number().int(m.SQS.VISIBILITY_TIMEOUT.INTEGER).min(0,m.SQS.VISIBILITY_TIMEOUT.MIN).max(43200,m.SQS.VISIBILITY_TIMEOUT.MAX).optional(),retentionPeriod:s.number().int(m.SQS.RETENTION_PERIOD.INTEGER).min(60,m.SQS.RETENTION_PERIOD.MIN).max(1209600,m.SQS.RETENTION_PERIOD.MAX).optional(),contentBasedDeduplication:s.boolean().optional(),removalPolicy:my.optional(),variableName:s.string().optional(),extraProperties:s.array(Pe).optional()}).strict();var qT=s.object({type:s.literal("basic-auth"),username:s.string().min(1),password:s.string().min(1)}).strict(),YT=s.object({name:B,defaultOriginRef:s.string(),behaviours:s.array(s.object({pathPattern:s.string(),originRef:s.string(),cachePolicy:s.enum(["CACHING_OPTIMIZED","CACHING_DISABLED"]).optional()}).strict()).optional(),customDomain:s.string().optional(),certificateArn:s.string().optional(),accessGate:s.union([s.literal(!1),qT]).optional(),extraProperties:s.array(Pe).optional()}).strict(),WX=s.object({appName:s.string(),name:B.optional(),defaultOriginRef:s.string(),behaviours:s.array(s.object({pathPattern:s.string(),originRef:s.string(),cachePolicy:s.enum(["CACHING_OPTIMIZED","CACHING_DISABLED"]).optional()}).strict()).optional(),customDomain:s.string().optional(),certificateArn:s.string().optional(),accessGate:s.union([s.literal(!1),qT]).optional(),nameProvidedByFlag:s.boolean().optional()}).strict();var bF=Object.defineProperty,py=(e,t)=>bF(e,"name",{value:t,configurable:!0}),SF=new Set(["t4g","c6g","c6gd","c6gn","c7g","c7gd","c7gn","r6g","r6gd","r7g","r7gd","r8g","r8gd","c8g","c8gd","c8gn","m6g","m6gd","m7g","m7gd","m8g","m8gd","x8g","i8g","a1","x2gd","im4gn","is4gen","i4g","hpc7g"]);function Ji(e){let t=e.split(".")[0]??"";return SF.has(t)?"ARM":"STANDARD"}py(Ji,"getArchitectureForInstanceType");function hu(e,t){let r=Ji(e);return r!==t?{valid:!1,message:`Instance type '${e}' requires ${r} architecture, but '${t}' AMI was specified. Use a ${r==="ARM"?"Graviton instance (t4g, c6g, r6g, m6g, etc.)":"Intel/AMD instance (t3, c5, r5, m5, etc.)"} instead.`}:{valid:!0}}py(hu,"validateArchitectureMatch");function XT(e,t){return Ji(e)===t}py(XT,"isArchitectureCompatible");var EF=Object.defineProperty,vu=(e,t)=>EF(e,"name",{value:t,configurable:!0});var _F=1;var AF=/^[A-Za-z0-9_.-]+$/,xF=s.object({id:s.string().min(1,"buildSecret id cannot be empty").regex(AF,"buildSecret id may contain only letters, digits, '_', '.', and '-' (no comma, '=', or whitespace, which would break the buildx --secret argv)"),ssm:s.string().min(1,"ssm parameter name cannot be empty").optional(),secretsManager:s.object({name:s.string().min(1,"secret name cannot be empty").optional(),arn:s.string().min(1,"secret arn cannot be empty").optional(),field:s.string().min(1,"secret field cannot be empty").optional()}).strict().refine(e=>e.name===void 0!=(e.arn===void 0),"secretsManager requires exactly one of name or arn").optional(),env:s.string().min(1,"env variable name cannot be empty").optional()}).strict().superRefine((e,t)=>{[e.ssm,e.secretsManager,e.env].filter(r=>r!==void 0).length!==1&&t.addIssue({code:s.ZodIssueCode.custom,message:"buildSecret requires exactly one source (ssm, secretsManager, or env)"})}),IF=s.union([s.string(),s.object({ssm:s.string().min(1,"ssm parameter name cannot be empty").optional(),secretsManager:s.object({name:s.string().min(1,"secret name cannot be empty").optional(),arn:s.string().min(1,"secret arn cannot be empty").optional(),field:s.string().min(1,"secret field cannot be empty").optional()}).strict().refine(e=>e.name===void 0!=(e.arn===void 0),"secretsManager requires exactly one of name or arn").optional(),env:s.string().min(1,"env variable name cannot be empty").optional(),acknowledgePublic:s.boolean().optional()}).strict().superRefine((e,t)=>{[e.ssm,e.secretsManager,e.env].filter(r=>r!==void 0).length!==1&&t.addIssue({code:s.ZodIssueCode.custom,message:"buildArg value requires exactly one source (ssm, secretsManager, or env)"})})]),Ot=s.object({path:s.string(),context:s.string().min(1,"context cannot be empty").optional(),target:s.string().min(1,"target cannot be empty").optional(),buildArgs:s.record(s.string(),IF).optional(),buildSecrets:s.array(xF).optional()}).strict(),XX=Ot.partial();function $F(e,t){if(t===void 0)return e;let r=t.context??e.context,i=t.target??e.target,n=t.buildArgs??e.buildArgs,o=t.buildSecrets??e.buildSecrets;return{path:t.path??e.path,...r!==void 0&&{context:r},...i!==void 0&&{target:i},...n!==void 0&&{buildArgs:n},...o!==void 0&&{buildSecrets:o}}}vu($F,"mergeDockerBuild");function fy(e){return typeof e=="object"&&e!==null&&!Array.isArray(e)}vu(fy,"isRecord");function JT(e){if(!fy(e)||typeof e.path!="string"||e.path.length===0)return;let t=typeof e.context=="string"&&e.context.length>0?e.context:void 0,r=typeof e.target=="string"&&e.target.length>0?e.target:void 0,i=fy(e.buildArgs)&&Object.keys(e.buildArgs).length>0?e.buildArgs:void 0,n=Array.isArray(e.buildSecrets)&&e.buildSecrets.length>0?e.buildSecrets:void 0,o={path:e.path,...t!==void 0&&{context:t},...r!==void 0&&{target:r},...i!==void 0&&{buildArgs:i},...n!==void 0&&{buildSecrets:n}},a=Ot.safeParse(o);return a.success?a.data:void 0}vu(JT,"normaliseDockerBuild");function TF(e){if(e===void 0)return;let t=JT(e);return t===void 0?void 0:JSON.stringify(t)}vu(TF,"dockerBuildFingerprint");var RF=s.object({name:s.string(),clusterName:s.string().optional(),docker:Ot.optional(),containerPort:s.number().optional(),secrets:s.array(s.string()).optional(),ssmSecretsPath:s.string().optional(),importedSecretNames:s.array(s.string()).optional(),schemaGateImageTag:s.string().optional()}).strict(),NF=s.object({type:s.enum(wt),name:s.string(),source:s.string()}).strict(),PF=s.object({repositoryName:s.string()}).strict(),kF=["x86_64","arm64"],CF=s.object({name:s.string(),secrets:s.array(s.string()).optional(),ssmSecretsPath:s.string().optional(),importedSecretNames:s.array(s.string()).optional(),docker:Ot.optional(),imageKey:s.string().optional(),architecture:s.enum(kF).optional()}).strict(),wF=s.object({templateHash:s.string(),synthTimestamp:s.string()}).strict(),OF=s.object({constructPath:s.string().max(512),group:s.string().max(128),resourceType:s.string().max(256)}).strict(),DF=s.object({synthesisedBy:s.string().min(1).max(128),minimumEngineVersion:s.string().min(1).max(32),maximumEngineMajor:s.number().int().min(0).optional(),minimumAwsCdkCli:s.string().min(1).max(32).optional()}).strict(),jF=s.object({appName:s.string().min(1).max(128),slot:s.string().min(1).max(64),clusterName:s.string().min(1).max(128),anchor:s.string().min(1).max(128),pinned:s.boolean(),currentServiceName:s.string().min(1).max(256),legacyKey:s.string().min(1).max(256),legacyAnchor:s.string().min(1).max(256),legacyServiceName:s.string().min(1).max(512),legacyKeyFields:s.array(s.string().max(64)).max(32)}).strict(),MF=s.object({constructPath:s.string().min(1).max(512),resourceType:s.string().min(1).max(256),physicalNameHint:s.string().min(1).max(512),policy:s.enum(["retain","snapshot","adopted"]),destroyDisposition:s.enum(["survives","deleted-on-explicit-destroy"]),reason:s.string().min(1).max(1024),costClass:s.enum(["none","storage","fixed-monthly"]),cleanupHint:s.string().min(1).max(1024)}).strict(),JX=s.object({version:s.literal(_F),generatedAt:s.string(),appName:s.string(),services:s.array(RF),lambdas:s.array(CF),pattern:NF.optional(),ecr:PF.optional(),stacks:s.record(s.string(),wF),resourceMap:s.record(s.string(),OF).optional(),engineCompat:DF.optional(),identityAliases:s.array(jF).optional(),residuals:s.array(MF).optional()}).strict();var zF=Object.defineProperty,LF=(e,t)=>zF(e,"name",{value:t,configurable:!0});function eR(e){return!(e.image!==void 0&&e.docker!==void 0)}LF(eR,"imageDockerMutexCheck");var tR=s.number().int(m.CAPACITY.MIN.INTEGER).min(iy,m.GENERATOR_CAPACITY.MIN.MIN).max(oy,m.GENERATOR_CAPACITY.MIN.MAX),rR=s.number().int(m.CAPACITY.MAX.INTEGER).min(iy,m.GENERATOR_CAPACITY.MAX.MIN).max(oy,m.GENERATOR_CAPACITY.MAX.MAX),Qi=s.number().int(m.LAMBDA.MEMORY.INTEGER).min(hT,m.LAMBDA.MEMORY.MIN).max(vT,m.LAMBDA.MEMORY.MAX).refine(e=>e===128||e%64===0,m.LAMBDA.MEMORY.MULTIPLE),nR=s.string().regex(L.LAMBDA_RUNTIME_IDENTIFIER,m.LAMBDA.RUNTIME),gy=s.number().int(m.CPU.INTEGER).min(256,m.CPU.MIN).max(4096,m.CPU.MAX),bu=s.number().int(m.CAPACITY.DESIRED.INTEGER).min(0,m.CAPACITY.DESIRED.MIN).max(qi,m.CAPACITY.DESIRED.MAX),Ua=s.object({connectToDatabase:s.array(s.string()).optional()}).strict(),UF=s.object({minSize:s.number().int(m.CAPACITY.WARM_POOL.MIN_SIZE.INTEGER).min(0,m.CAPACITY.WARM_POOL.MIN_SIZE.MIN).max(yT,m.CAPACITY.WARM_POOL.MIN_SIZE.MAX).optional(),reuseOnScaleIn:s.boolean().optional()}).strict(),hy=s.object({instanceType:s.string().optional(),amiHardwareType:s.enum(eu).optional(),minCapacity:s.number().int(m.CAPACITY.MIN.INTEGER).min(0,m.CAPACITY.MIN.MIN_0).max(qi,m.CAPACITY.MIN.MAX).optional(),maxCapacity:s.number().int(m.CAPACITY.MAX.INTEGER).min(1,m.CAPACITY.MAX.MIN_1).max(qi,m.CAPACITY.MAX.MAX).optional(),memoryLimitMiB:Da(128).optional(),warmPool:UF.optional(),extraProperties:s.array(Pe).optional()}).strict().superRefine((e,t)=>{if(!e.instanceType||!e.amiHardwareType)return;let r=hu(e.instanceType,e.amiHardwareType);r.valid||t.addIssue({code:"custom",message:r.message??m.ARCHITECTURE_MISMATCH,path:["instanceType"]})}).superRefine((e,t)=>{e.minCapacity===0&&!e.warmPool&&t.addIssue({code:"custom",message:m.CAPACITY.WARM_POOL_REQUIRED,path:["minCapacity"]}),e.warmPool?.minSize!==void 0&&e.maxCapacity!==void 0&&e.warmPool.minSize>e.maxCapacity&&t.addIssue({code:"custom",message:m.CAPACITY.WARM_POOL.MIN_SIZE_EXCEEDS_MAX_CAPACITY,path:["warmPool","minSize"]})}),FF=s.enum(Pa).describe(`Compute type must be one of: ${Pa.join(", ")}`),vy=s.enum(Wi).describe(`ECS capacity provider must be one of: ${Wi.join(", ")}`),yy=s.string().refine(e=>mt(tu,e),{message:m.INSTANCE_TYPE}),iR=s.object({sourceType:s.enum(["sqs","dynamodb","eventbridge"]),sourceRef:s.string().describe("Name of the source resource"),batchSize:s.number().int(m.BATCH_SIZE.INTEGER).min(1,m.BATCH_SIZE.MIN).max(1e4,m.BATCH_SIZE.MAX).optional(),startingPosition:s.enum(["TRIM_HORIZON","LATEST"]).optional(),maxBatchingWindow:s.number().int(m.BATCHING_WINDOW.INTEGER).min(0,m.BATCHING_WINDOW.MIN).max(300,m.BATCHING_WINDOW.MAX).optional(),reportBatchItemFailures:s.boolean().optional()}).strict(),VF=s.object({name:s.string().min(1,m.REQUIRED.CONTAINER_NAME).optional(),image:s.string().optional(),port:$n.optional(),environment:Xi.optional(),secretsImport:IT.optional(),command:s.array(s.string()).optional(),entryPoint:s.array(s.string()).optional(),essential:s.boolean().optional(),healthCheck:s.object({command:s.array(s.string()),interval:s.number().int(m.HEALTH_CHECK.INTERVAL.INTEGER).min(5,m.HEALTH_CHECK.INTERVAL.MIN).max(300,m.HEALTH_CHECK.INTERVAL.MAX).optional(),timeout:s.number().int(m.HEALTH_CHECK.TIMEOUT.INTEGER).min(2,m.HEALTH_CHECK.TIMEOUT.MIN).max(60,m.HEALTH_CHECK.TIMEOUT.MAX).optional(),retries:s.number().int(m.HEALTH_CHECK.RETRIES.INTEGER).min(1,m.HEALTH_CHECK.RETRIES.MIN).max(10,m.HEALTH_CHECK.RETRIES.MAX).optional(),startPeriod:s.number().int(m.HEALTH_CHECK.START_PERIOD.INTEGER).min(0,m.HEALTH_CHECK.START_PERIOD.MIN).max(300,m.HEALTH_CHECK.START_PERIOD.MAX).optional()}).strict().optional(),ssmSecrets:s.array(s.string().regex(L.SECRET_NAME,m.SECRET_NAME)).optional(),extraProperties:s.array(Pe).optional()}).strict(),oR=s.string().min(1,m.REQUIRED.SERVICE_NAME).max(255,m.MAX_LENGTH.SERVICE_NAME).regex(L.ECS_SERVICE_NAME,m.ECS_SERVICE_NAME),aR=s.object({domain:s.string().optional(),loadBalancer:s.union([s.literal(!1),s.enum(Jl)]).optional(),directAccess:s.boolean().optional(),extraProperties:s.array(Pe).optional()}).strict().refine(e=>!(e.directAccess&&e.domain),{message:m.DIRECT_ACCESS.NO_DOMAIN,path:["directAccess"]}).refine(e=>!(e.directAccess&&typeof e.loadBalancer=="string"),{message:m.DIRECT_ACCESS.NO_LOAD_BALANCER}).describe("Cluster-level configuration"),yu=s.object({path:s.string().optional(),host:s.string().optional(),priority:s.number().int(m.PRIORITY.INTEGER).min(1,m.PRIORITY.MIN).max(5e4,m.PRIORITY.MAX).optional(),healthCheckPath:s.string().optional()}).strict().describe("Path/host-based routing configuration"),BF=s.object({desiredCount:bu.optional(),minCapacity:s.number().int(m.CAPACITY.MIN.INTEGER).min(0,m.CAPACITY.MIN.MIN_0).max(qi,m.CAPACITY.MIN.MAX).optional(),maxCapacity:s.number().int(m.CAPACITY.MAX.INTEGER).min(1,m.CAPACITY.MAX.MIN_1).max(qi,m.CAPACITY.MAX.MAX).optional(),scalingType:s.enum(Ql).optional()}).strict().refine(In.check,In.params).describe("ECS service scaling configuration"),sR=s.object({name:oR,docker:Ot.optional(),needsDatabaseConnection:s.boolean().optional(),needsStorageConnection:s.boolean().optional(),needsMessagingConnection:s.boolean().optional(),image:s.string().optional(),containers:s.array(VF).optional(),routing:s.union([yu,s.array(yu).min(1)]).optional(),serviceType:s.enum(wa).optional(),cpu:gy.optional(),memoryLimitMiB:Da(512).optional(),desiredCount:bu.optional(),scaling:He(BF).optional(),capacityProvider:vy,ec2Config:hy.optional(),ssmSecretsPath:s.string().regex(L.SSM_PATH,m.SSM_PATH).optional(),extraProperties:s.array(Pe).optional(),alarms:NT.optional()}).strict().superRefine((e,t)=>{eR(e)||t.addIssue({code:"custom",path:["docker"],message:m.IMAGE_DOCKER_MUTEX})}).describe("Configuration for a service in an ECS cluster"),cR=s.object({name:B,type:FF,needsConnection:s.boolean(),connectedDatabase:s.array(s.string()).optional(),connectedStorage:s.array(s.string()).optional(),connectedMessaging:s.array(s.string()).optional(),cluster:aR.optional(),services:s.array(sR).optional(),docker:Ot.partial().optional(),deployment:s.enum(Yl).optional(),codePath:s.string().optional(),timeout:s.number().int(m.LAMBDA.TIMEOUT.INTEGER).min(ru,m.LAMBDA.TIMEOUT.MIN).max(nu,m.LAMBDA.TIMEOUT.MAX).optional(),memory:Qi.optional(),handler:s.string().optional(),runtime:nR.optional(),environment:Xi.optional(),secrets:Xi.optional(),eventSources:s.array(iR).optional(),functionUrl:s.object({authType:s.enum(Ca)}).strict().optional(),description:s.string().optional(),scheduleExpression:s.string().optional(),architecture:s.enum(Xl).optional(),ephemeralStorageSize:s.number().int(m.EPHEMERAL_STORAGE.INTEGER).min(512,m.EPHEMERAL_STORAGE.MIN).max(10240,m.EPHEMERAL_STORAGE.MAX).optional(),functionName:s.string().optional(),ssmSecrets:s.array(s.string()).optional(),ssmSecretsPath:s.string().optional(),alarms:kT.optional(),instanceType:yy.optional(),enableSSH:s.boolean().optional(),keyName:s.string().optional(),userData:s.string().optional(),securityGroups:s.array(s.string()).optional(),variableName:s.string().optional(),extraProperties:s.array(Pe).optional()}).strict().superRefine((e,t)=>{if(e.type==="ecs"&&e.services)for(let r=0;r<e.services.length;r++){let i=e.services[r];i?.ec2Config?.instanceType&&!i.ec2Config.amiHardwareType&&Ji(i.ec2Config.instanceType)!=="ARM"&&t.addIssue({code:"custom",message:`Service '${i.name??r}' uses instance type '${i.ec2Config.instanceType}' (x86), which requires Docker images built for linux/amd64. The default build targets linux/arm64 (Graviton). Use a Graviton instance type (t4g, c6g, r6g, m6g, etc.) or set amiHardwareType: "STANDARD" to acknowledge x86.`,path:["services",r,"ec2Config","instanceType"]})}e.type==="lambda"&&e.deployment==="container"&&e.architecture==="X86_64"&&t.addIssue({code:"custom",message:"Lambda architecture 'X86_64' requires Docker images built for linux/amd64, but the default build targets linux/arm64. Use 'ARM_64' for Graviton Lambdas (recommended) or ensure your build pipeline targets linux/amd64.",path:["architecture"]})}),sJ=s.object({appName:Se,clusterName:B,containerPort:$n,nameProvidedByFlag:s.boolean().optional(),ecrRepository:s.string().optional(),capacityProvider:vy.optional(),useAppEcr:s.boolean().optional(),desiredCount:bu.optional(),cpu:gy.optional(),memoryLimitMiB:Da(512).optional(),minCapacity:tR.optional(),maxCapacity:rR.optional(),ec2Config:hy.optional(),connectionConfig:Ua.optional()}).strict().refine(In.check,In.params),cJ=s.object({appName:Se,functionName:B,nameProvidedByFlag:s.boolean().optional(),lambdaType:s.enum(["basic","web","custom"]).optional(),ecrRepository:s.string().optional(),timeout:s.number().int(m.LAMBDA.TIMEOUT.INTEGER).min(ru,m.LAMBDA.TIMEOUT.MIN).max(nu,m.LAMBDA.TIMEOUT.MAX).optional(),memory:Qi.optional(),enableFunctionUrl:s.boolean().optional(),description:s.string().optional(),enableCors:s.boolean().optional(),corsOrigins:s.string().optional(),corsHeaders:s.string().optional(),corsMethods:s.array(s.enum(ST)).optional(),corsCredentials:s.boolean().optional(),connectionConfig:Ua.optional()}).strict(),lJ=s.object({appName:Se,instanceName:B,nameProvidedByFlag:s.boolean().optional(),instanceType:yy.optional(),enableSSH:s.boolean().optional(),minCapacity:tR.optional(),maxCapacity:rR.optional(),connectionConfig:Ua.optional()}).strict().refine(In.check,In.params),uJ=s.object({appName:Se,clusterName:B,serviceName:oR,capacityProvider:vy,containerPort:$n.optional(),cpu:gy.optional(),memoryLimitMiB:Da(512).optional(),desiredCount:bu.optional(),ec2Config:hy.optional(),routing:s.union([yu,s.array(yu).min(1)]).optional(),docker:Ot.partial().optional(),nameProvidedByFlag:s.boolean().optional(),connectionConfig:Ua.optional()}).strict(),by=s.object({appName:Se,computeName:B,nameProvidedByFlag:s.boolean().optional(),connectionConfig:Ua.optional()}).strict(),ZF=by.extend({type:s.literal("ecs"),cluster:aR.optional(),services:s.array(sR).min(1,m.SERVICE.MIN_REQUIRED),docker:Ot.partial().optional()}).strict().refine(e=>{let t=e.services.filter(r=>r.containers?.some(i=>i.port));return t.length>1?t.every(r=>(Array.isArray(r.routing)?r.routing:r.routing?[r.routing]:[]).some(i=>i.path||i.host)):!0},{message:m.SERVICE.ROUTING_REQUIRED}).refine(e=>{let t=e.services.map(r=>r.name);return new Set(t).size===t.length},{message:m.SERVICE.UNIQUE_WITHIN_CLUSTER}),GF=by.extend({type:s.literal("lambda"),timeout:s.number().int(m.LAMBDA.TIMEOUT.INTEGER).min(ru,m.LAMBDA.TIMEOUT.MIN).max(nu,m.LAMBDA.TIMEOUT.MAX).optional(),memory:Qi.optional(),handler:s.string().optional(),runtime:nR.optional(),environment:Xi.optional(),secrets:Xi.optional(),description:s.string().optional(),functionUrl:s.union([s.object({authType:s.enum(Ca).optional()}).strict(),s.literal(!1)]).optional(),eventSources:s.array(iR).optional()}).strict(),WF=by.extend({type:s.literal("ec2"),instanceType:yy.optional(),enableSSH:s.boolean().optional(),keyName:s.string().optional(),userData:s.string().optional(),securityGroups:s.array(s.string()).optional()}).strict(),lR=s.discriminatedUnion("type",[ZF,GF,WF]),QT=s.object({path:s.string().min(1,m.REQUIRED.ROUTING_PATH),priority:s.number().int(m.PRIORITY.INTEGER).min(1,m.PRIORITY.MIN).max(5e4,m.PRIORITY.MAX).optional()}).strict(),uR=s.object({name:s.string().min(1,m.REQUIRED.SERVICE_NAME).max(255,m.MAX_LENGTH.SERVICE_NAME).regex(L.RESOURCE_NAME,m.RESOURCE_NAME),serviceType:s.enum(wa).optional(),docker:Ot.partial().optional(),containerPort:$n.optional(),needsDatabaseConnection:s.boolean().optional(),routing:s.union([QT,s.array(QT).min(1)]).optional()}).strict().superRefine((e,t)=>{e.serviceType==="worker"&&(e.containerPort!==void 0&&t.addIssue({code:"custom",path:["containerPort"],message:"Worker services are not reachable inbound; remove containerPort."}),e.routing!==void 0&&t.addIssue({code:"custom",path:["routing"],message:"Worker services have no ALB route; remove routing."}))}),dJ=s.object({appName:Se,instanceType:s.string().optional()}).strict();var Sy=s.object({memorySize:Qi.optional(),timeout:s.number().int(m.LAMBDA.TIMEOUT.INTEGER).min(1,m.LAMBDA.TIMEOUT.MIN).max(900,m.LAMBDA.TIMEOUT.MAX).optional(),ephemeralStorageSize:s.number().int(m.EPHEMERAL_STORAGE.INTEGER).min(512,m.EPHEMERAL_STORAGE.MIN).max(10240,m.EPHEMERAL_STORAGE.MAX).optional()}).strict(),dR=s.object({type:s.enum(ny).optional(),databaseName:s.string().optional(),databaseEngine:s.enum(Ki).optional(),deletionProtection:s.boolean().optional(),backupRetention:cr.optional(),port:su.optional(),publiclyAccessible:s.boolean().optional(),allowedIpCidr:s.string().optional(),instanceType:s.string().optional(),allocatedStorage:s.number().int(m.ALLOCATED_STORAGE.INTEGER).min(20,m.ALLOCATED_STORAGE.MIN).max(65536,m.ALLOCATED_STORAGE.MAX).optional(),multiAz:s.boolean().optional(),readReplica:uu.optional(),writer:za.optional(),readers:La.optional(),allowVpcAccess:s.boolean().optional(),monitoringInterval:Ma.optional(),preferredMaintenanceWindow:s.string().optional(),databaseInsights:du.optional(),proxy:lu.optional(),credentials:cu.optional(),encryption:mu.optional(),snapshotIdentifier:s.string().optional(),snapshotUsername:s.string().optional()}).strict(),mR=s.object({server:Sy.optional(),imageOptimisation:Sy.optional(),revalidation:Sy.optional()}).strict(),Ey=s.object({versioned:s.boolean().optional()}).strict(),pR=s.object({assets:Ey.optional(),cache:Ey.optional(),media:Ey.optional()}).strict(),HF=s.object({visibilityTimeout:s.number().int(m.SQS.VISIBILITY_TIMEOUT.INTEGER).min(0,m.SQS.VISIBILITY_TIMEOUT.MIN).max(43200,m.SQS.VISIBILITY_TIMEOUT.MAX).optional(),messageRetentionPeriod:s.number().int(m.SQS.RETENTION_PERIOD.INTEGER).min(60,m.SQS.RETENTION_PERIOD.MIN).max(1209600,m.SQS.RETENTION_PERIOD.MAX).optional(),maxMessageSize:s.number().int(m.MAX_MESSAGE_SIZE.INTEGER).min(1024,m.MAX_MESSAGE_SIZE.MIN).max(262144,m.MAX_MESSAGE_SIZE.MAX).optional(),deadLetterQueue:s.union([s.literal(!1),s.object({enabled:s.boolean().optional(),maxReceiveCount:s.number().int(m.DLQ.MAX_RECEIVE_COUNT.INTEGER).min(1,m.DLQ.MAX_RECEIVE_COUNT.MIN).max(1e3,m.DLQ.MAX_RECEIVE_COUNT.MAX).optional()}).strict()]).optional()}).strict(),fR=s.object({revalidationQueue:HF.optional()}).strict(),gR=s.object({domainNames:s.array(s.string()).optional(),certificateArn:s.string().optional()}).strict(),hR=s.record(s.string().regex(L.ENV_VAR_NAME,m.ENV_VAR_NAME),s.string()).optional(),KF=s.object({type:s.literal("payload"),name:s.string().min(1,m.REQUIRED.PATTERN_NAME),domain:s.string().optional(),database:dR.optional(),compute:mR.optional(),storage:pR.optional(),messaging:fR.optional(),cdn:gR.optional(),environment:hR}).strict(),qF=s.object({type:s.literal("nextjs"),name:s.string().min(1,m.REQUIRED.PATTERN_NAME),domain:s.string().optional(),database:dR.optional(),compute:mR.optional(),storage:pR.optional(),messaging:fR.optional(),cdn:gR.optional(),environment:hR}).strict(),_y=s.enum(fa),YF=s.object({command:s.string().min(1,m.REQUIRED.BUILD_COMMAND),outputDir:s.string().min(1,m.REQUIRED.OUTPUT_DIR)}).strict(),XF=s.object({headers:s.boolean().optional(),contentSecurityPolicy:s.string().optional()}).strict(),JF=s.object({to:s.string().min(1,m.REQUIRED.FORMS_TO).regex(L.EMAIL,m.EMAIL),from:s.string().regex(L.EMAIL,m.EMAIL).optional(),corsOrigin:s.string().regex(L.HTTP_ORIGIN,"corsOrigin must be an exact origin such as https://example.com (no path, no trailing slash)").optional(),maxConcurrency:s.number().int().min(1).max(100).optional()}).strict(),QF=s.object({behaviours:s.array(s.unknown()).optional()}).strict(),Ay=s.object({type:s.literal("staticsite"),name:s.string().min(1,m.REQUIRED.PATTERN_NAME),source:s.string().min(1,m.REQUIRED.SOURCE),build:YF,routing:_y.optional(),security:XF.optional(),domain:s.string().optional(),forms:JF.optional(),cdn:QF.optional()}).strict().superRefine((e,t)=>{if(e.forms===void 0)return;let r=e.domain;if(r===void 0||r===""){t.addIssue({code:"custom",path:["domain"],message:"A domain is required when forms are enabled: SES sends only from a verified identity, and the site's domain is the identity the pattern verifies"});return}let i=e.forms.from;i!==void 0&&!Nl(i,r)&&t.addIssue({code:"custom",path:["forms","from"],message:`forms.from must be an address at ${r} (the verified SES identity) \u2014 for example noreply@${r}. Use forms.to for the recipient.`})}),Fa=s.discriminatedUnion("type",[KF,qF,Ay]),vR=s.enum(["lightweight","standard","resilient","custom"]),yR=s.object({type:s.enum(ny),instanceType:s.string().optional(),backupRetention:cr.optional(),deletionProtection:s.boolean().optional(),encryption:s.union([s.object({useCMK:s.literal(!0)}).strict(),s.literal(!1)]).optional()}).strict(),bR=s.object({memorySize:Qi.optional(),timeout:s.number().int(m.LAMBDA.TIMEOUT.INTEGER).min(1,m.LAMBDA.TIMEOUT.MIN).max(900,m.LAMBDA.TIMEOUT.MAX).optional()}).strict();var SR=s.object({appName:Se,type:ay,pattern:sy.optional(),patternConfig:Fa.optional(),owner:s.string().optional(),tags:s.record(s.string(),s.string()).optional(),vpcId:s.string().optional(),network:fu.optional(),backup:TT.optional(),tunnel:RT.optional(),additionalNetworks:s.array(GT).optional(),database:s.array(wT),s3:s.array(HT),compute:s.array(cR),dynamodb:s.array(LT).optional(),clickhouse:s.array(UT).optional(),sqs:s.array(KT).optional(),cdn:YT.optional(),customCodeBlocks:s.array($T).optional(),additionalManagedImports:s.array(s.object({moduleSpecifier:s.string(),namedImports:s.array(s.string()),defaultImport:s.string().optional()}).strict()).optional()}).strict(),kJ=s.object({name:Se,type:ay,pattern:sy.optional(),patternTier:vR.optional(),patternDomain:s.string().optional(),source:s.string().min(1,m.REQUIRED.SOURCE).optional(),buildCommand:s.string().min(1,m.REQUIRED.BUILD_COMMAND).optional(),outputDir:s.string().min(1,m.REQUIRED.OUTPUT_DIR).optional(),routing:_y.optional(),formsTo:s.string().min(1,m.REQUIRED.FORMS_TO).regex(L.EMAIL,m.EMAIL).optional(),corsOrigin:s.string().regex(L.HTTP_ORIGIN,"corsOrigin must be an exact origin such as https://example.com (no path, no trailing slash)").optional(),customDatabase:yR.optional(),customCompute:bR.optional(),region:s.string().optional(),owner:s.string().optional(),includeDatabase:s.boolean().optional(),databaseName:s.string().min(1,m.DATABASE.NAME.REQUIRED).max(63,m.DATABASE.NAME.MAX_LENGTH).optional(),vpcId:s.string().optional(),network:WT.optional(),services:s.array(uR).optional(),snapshotIdentifier:s.string().optional(),snapshotUsername:s.string().optional()}).strict().superRefine((e,t)=>{e.formsTo!==void 0&&(e.patternDomain!==void 0&&e.patternDomain!==""||t.addIssue({code:"custom",path:["patternDomain"],message:"A domain is required when forms are enabled: SES sends only from a verified identity, and the site's domain is the identity the pattern verifies"}))}),CJ=s.object({name:B,localResource:s.string().min(1),remoteApp:s.string().min(1),remoteResource:s.string().min(1),permission:s.enum(["read","write","read-write"]),remoteArn:s.string().optional()}).strict();var e4=["fjall-managed","external","external-manual"],MJ=s.enum(e4);var ER=s.object({givenName:s.string().min(1),familyName:s.string().min(1),displayName:s.string().min(1).optional(),expires:s.string().min(1).optional()}).strict(),_R=s.object({name:s.string().min(1),path:s.string().min(1).optional()}).strict(),t4=s.union([s.object({managedPolicyArn:s.string().min(1)}).strict(),s.object({customerManagedPolicy:_R}).strict()]),r4=s.object({managedPolicies:s.array(s.string().min(1)).optional(),inlinePolicy:s.record(s.string(),s.unknown()).optional(),customerManagedPolicies:s.array(_R).optional(),permissionsBoundary:t4.optional(),sessionDuration:s.string().min(1).optional(),description:s.string().optional(),accounts:s.union([s.array(s.string().min(1)),s.literal("all")]).optional(),includeManagementAccount:s.boolean().optional(),groups:s.array(s.string().min(1)).optional()}).strict(),n4=s.object({description:s.string().optional()}).strict(),Su=s.string().regex(L.EMAIL,m.EMAIL),xy={groups:s.record(s.string(),n4).optional(),permissionSets:s.record(s.string(),r4).optional(),memberships:s.record(s.string(),s.array(Su)).optional(),resolutionVersion:s.number().int().min(1).optional(),defaultPermissionSets:s.boolean().optional()},i4=s.discriminatedUnion("source",[s.object({...xy,source:s.literal("fjall-managed"),users:s.record(Su,ER)}).strict(),s.object({...xy,source:s.literal("external")}).strict(),s.object({...xy,source:s.literal("external-manual"),users:s.record(Su,ER).optional()}).strict()]),zJ=s.object({name:B,type:s.literal("organisation").optional(),organisationName:s.string().min(1).optional(),orgEmail:Su.optional(),accounts:s.unknown().optional(),accountIds:s.record(s.string(),s.string()).optional(),identityCentre:s.union([i4,s.literal(!1)]).optional(),allowedRegions:s.array(s.string().min(1)).optional()}).strict();var o4=Object.defineProperty,a4=(e,t)=>o4(e,"name",{value:t,configurable:!0}),s4=[1,3,5,7,14,30,60,90,120,150,180,365,400,545,731,1827,3653],c4=s.object({buildkiteQueue:s.string().min(1,"buildkiteQueue cannot be empty").max(100).regex(/^[a-zA-Z0-9-_]+$/,"buildkiteQueue must be alphanumeric with hyphens/underscores"),buildkiteOrgSlug:s.string().min(1,"buildkiteOrgSlug cannot be empty").max(100).regex(/^[a-z0-9-]+$/,"buildkiteOrgSlug must be a lowercase Buildkite organisation slug"),agentTokenSsmParameterName:s.string().min(2).regex(/^\//,"agentTokenSsmParameterName must be a full path (leading /)").optional(),agentTokenKmsKeyArn:s.string().min(1).optional(),fjallApiKeySsmParameterName:s.string().min(2).regex(/^\//,"fjallApiKeySsmParameterName must be a full path (leading /)").optional(),instanceType:s.string().min(1).default("c8g.xlarge"),agentVolumeSizeGib:s.number().int().min(20).max(1e3).default(250),agentMinInstances:s.number().int().min(0).default(0),agentMaxInstances:s.number().int().min(1).default(2),agentsPerInstance:s.number().int().min(1).default(1),spotCapacityPercentage:s.number().int().min(0).max(100).default(0),scaleInIdlePeriodSeconds:s.number().int().min(60).default(600),disconnectAfterUptimeSeconds:s.number().int().min(3600).default(86400),maxInstanceLifetimeDays:s.number().int().min(1).max(365).default(7),terminateInstanceAfterJob:s.boolean().default(!1),purgeBuildsOnDiskFull:s.boolean().default(!0),terminateInstanceOnDiskFull:s.boolean().default(!1),logRetentionDays:s.number().int().min(1).default(30),agentLogRetentionDays:s.literal(s4).default(7),buildkiteAgentRelease:s.enum(["stable","beta","edge"]).default("stable"),buildkiteAgentTags:s.string().default(""),buildkiteAgentTimestampLines:s.boolean().default(!1),buildkiteAgentExperiments:s.string().default(""),buildkiteAgentTracingBackend:s.enum(["","datadog","opentelemetry"]).default(""),buildkiteAgentCancelGracePeriodSeconds:s.number().int().min(10).default(60),enableSecretsPlugin:s.boolean().default(!0),enableEcrPlugin:s.boolean().default(!1),enableDockerLoginPlugin:s.boolean().default(!1),enableDockerUserNamespaceRemap:s.boolean().default(!0),enableDockerExperimental:s.boolean().default(!1),dockerNetworkingProtocol:s.enum(["ipv4","dualstack"]).default("ipv4"),enableInstanceStorage:s.boolean().default(!1),mountTmpfsAtTmp:s.boolean().default(!0),buildkiteAgentEnableGitMirrors:s.boolean().default(!1),bootstrapScriptUrl:s.string().default(""),agentEnvFileUrl:s.string().default(""),scalerEventSchedulePeriod:s.string().min(1).default("1 minute"),scalerMinPollInterval:s.string().min(1).default("10s"),scaleOutFactor:s.string().min(1).default("1.0"),scaleOutWaitingForJobs:s.boolean().default(!1),rolePermissionsBoundaryArn:s.string().min(1).optional(),alarmSnsTopicArn:s.string().min(1).optional(),applicationId:s.string().min(1).optional(),costAllocationEnvironment:s.string().min(1).optional(),costAllocationOwner:s.string().min(1).optional()}).strict(),l4=c4.refine(e=>e.agentMinInstances<=e.agentMaxInstances,{message:"agentMinInstances must be <= agentMaxInstances"});function u4(e){let t=l4.safeParse(e);if(!t.success){let r=t.error.issues.map(i=>`  - ${i.path.join(".")||"(root)"}: ${i.message}`).join(`
 `);throw new Error(`Buildkite: invalid props:
 ${r}`)}return t.data}a4(u4,"validateBuildkiteProps");var d4=Object.defineProperty,m4=(e,t)=>d4(e,"name",{value:t,configurable:!0});function p4(e){return`FjallDeployBoundary${e}`}m4(p4,"deployBoundaryName");var Iy={Sid:"FjallInheritAdministratorAccess",Effect:"Allow",Action:"*",Resource:"*"},AR=[{Sid:"FjallDenyOrgAndAccountEscape",Effect:"Deny",Action:["organizations:LeaveOrganization","account:CloseAccount"],Resource:"*"},{Sid:"FjallDenyDisableAuditLogging",Effect:"Deny",Action:["cloudtrail:StopLogging"],Resource:"*"},{Sid:"FjallDenyBoundarySelfEscape",Effect:"Deny",Action:["iam:DeleteRolePermissionsBoundary"],Resource:"*"},{Sid:"FjallDenyDisableKmsKey",Effect:"Deny",Action:["kms:DisableKey"],Resource:"*"}],xR=[...AR,{Sid:"FjallDenyStandingHumanCredentials",Effect:"Deny",Action:["iam:CreateUser","iam:CreateLoginProfile","iam:CreateAccessKey","iam:CreateAccountAlias"],Resource:"*"},{Sid:"FjallDenyDisableConfigRecorder",Effect:"Deny",Action:["config:StopConfigurationRecorder"],Resource:"*"}],f4=[...xR,{Sid:"FjallDenyAccountPasswordPolicyTamper",Effect:"Deny",Action:["iam:UpdateAccountPasswordPolicy","iam:DeleteAccountPasswordPolicy"],Resource:"*"},{Sid:"FjallDenyDisableDefaultEbsEncryption",Effect:"Deny",Action:["ec2:DisableEbsEncryptionByDefault"],Resource:"*"}],e5={foundation:[Iy,...AR],compliance:[Iy,...xR],hardened:[Iy,...f4]};var g4=Object.defineProperty,Ee=(e,t)=>g4(e,"name",{value:t,configurable:!0});var Ry="sts.amazonaws.com";function h4(e){return`FjallDevDeploy${e}`}Ee(h4,"devDeployRoleName");function v4(e){return`FjallDevProvisioner${e}`}Ee(v4,"devProvisionerRoleName");function y4(e){return`FjallDevSyncWriter${e}`}Ee(y4,"devSyncWriterRoleName");var b4="FjallDevBoundary";function IR(e){return`arn:aws:iam::${e}:policy/${b4}`}Ee(IR,"devBoundaryPolicyArn");function $R(e){return`org:${e}:dev-provisioner`}Ee($R,"devProvisionerSubject");function TR(e){return`org:${e}:dev-sync`}Ee(TR,"devSyncSubject");function $y(e,t){return`org:${e}:acct:${t}`}Ee($y,"deployAccountSubject");function Ty(e){return`org:${e}:*`}Ee(Ty,"genericMachineSubject");var S4=["discovery","connection","org-setup","dev-substrate-setup"];function RR(e,t){return`org:${e}:${t}`}Ee(RR,"serviceSubject");function E4(e){let{fjallOrgId:t,providerArn:r,issuerDomain:i,accountTier:n,accountId:o}=e,a=e.machineTrustMode??"expanded",c={[`${i}:aud`]:Ry},l;if(a==="account-scoped"){if(n===void 0||!Al(n)||o===void 0)throw new Error(`machineTrustMode "account-scoped" requires a governance accountTier and an accountId (got tier: ${String(n)}, accountId ${o===void 0?"absent":"present"}) \u2014 refusing to fall back to the generic machine subject: a silent fallback would re-widen the trust the \xA74.4a Step-3 contract removes`);l=[$y(t,o)]}else o!==void 0?l=[Ty(t),$y(t,o)]:l=Ty(t);return[{Sid:"FjallMachineSubject",Effect:"Allow",Principal:{Federated:r},Action:"sts:AssumeRoleWithWebIdentity",Condition:{StringEquals:{...c,[`${i}:sub`]:l}}},{Sid:"FjallUserSubjects",Effect:"Allow",Principal:{Federated:r},Action:"sts:AssumeRoleWithWebIdentity",Condition:{StringEquals:c,StringLike:{[`${i}:sub`]:`org:${t}:user:*`}}},{Sid:"FjallServiceSubjects",Effect:"Allow",Principal:{Federated:r},Action:"sts:AssumeRoleWithWebIdentity",Condition:{StringEquals:{...c,[`${i}:sub`]:S4.map(u=>RR(t,u))}}}]}Ee(E4,"buildNarrowedDeployTrustStatements");function _4(e){let{fjallOrgId:t,providerArn:r,issuerDomain:i,accountId:n}=e;return[{Sid:"FjallDevSubjectsThisAccount",Effect:"Allow",Principal:{Federated:r},Action:"sts:AssumeRoleWithWebIdentity",Condition:{StringEquals:{[`${i}:aud`]:Ry},StringLike:{[`${i}:sub`]:`org:${t}:dev:${n}:*`}}}]}Ee(_4,"buildDevDeployTrustStatements");function Ny(e){let{providerArn:t,issuerDomain:r,sid:i,subject:n}=e;return[{Sid:i,Effect:"Allow",Principal:{Federated:t},Action:"sts:AssumeRoleWithWebIdentity",Condition:{StringEquals:{[`${r}:aud`]:Ry,[`${r}:sub`]:n}}}]}Ee(Ny,"buildServiceSubjectTrustStatements");function A4(e){return Ny({...e,sid:"FjallDevProvisionerSubject",subject:$R(e.fjallOrgId)})}Ee(A4,"buildDevProvisionerTrustStatements");function x4(e){return Ny({...e,sid:"FjallDevSyncSubject",subject:TR(e.fjallOrgId)})}Ee(x4,"buildDevSyncWriterTrustStatements");function I4({accountId:e}){return[{Sid:"FjallDevEcsTaggedMutations",Effect:"Allow",Action:["ecs:UpdateService","ecs:DeleteService","ecs:RunTask","ecs:StopTask"],Resource:`arn:aws:ecs:*:${e}:*`,Condition:{StringEquals:{"aws:ResourceTag/fjall:dev":"true"}}},{Sid:"FjallDevEcsTaggedCreates",Effect:"Allow",Action:["ecs:RegisterTaskDefinition","ecs:CreateService"],Resource:"*",Condition:{StringEquals:{"aws:RequestTag/fjall:dev":"true"}}},{Sid:"FjallDevEcsTagOnCreate",Effect:"Allow",Action:["ecs:TagResource"],Resource:`arn:aws:ecs:*:${e}:*`,Condition:{StringEquals:{"ecs:CreateAction":["RegisterTaskDefinition","CreateService","RunTask"]}}},{Sid:"FjallDevEcsReads",Effect:"Allow",Action:["ecs:Describe*","ecs:List*"],Resource:"*"},{Sid:"FjallDevEcsDeregisterTaskDefinition",Effect:"Allow",Action:["ecs:DeregisterTaskDefinition"],Resource:`arn:aws:ecs:*:${e}:task-definition/fjall-dev-*`},{Sid:"FjallDevElbTaggedMutations",Effect:"Allow",Action:["elasticloadbalancing:ModifyRule","elasticloadbalancing:DeleteRule","elasticloadbalancing:ModifyTargetGroup","elasticloadbalancing:ModifyTargetGroupAttributes","elasticloadbalancing:DeleteTargetGroup","elasticloadbalancing:RegisterTargets","elasticloadbalancing:DeregisterTargets"],Resource:`arn:aws:elasticloadbalancing:*:${e}:*`,Condition:{StringEquals:{"aws:ResourceTag/fjall:dev":"true"}}},{Sid:"FjallDevElbTaggedCreates",Effect:"Allow",Action:["elasticloadbalancing:CreateTargetGroup","elasticloadbalancing:CreateRule"],Resource:`arn:aws:elasticloadbalancing:*:${e}:*`,Condition:{StringEquals:{"aws:RequestTag/fjall:dev":"true"}}},{Sid:"FjallDevElbTagOnCreate",Effect:"Allow",Action:["elasticloadbalancing:AddTags"],Resource:`arn:aws:elasticloadbalancing:*:${e}:*`,Condition:{StringEquals:{"elasticloadbalancing:CreateAction":["CreateTargetGroup","CreateRule"]}}},{Sid:"FjallDevElbReads",Effect:"Allow",Action:["elasticloadbalancing:Describe*"],Resource:"*"},{Sid:"FjallDevSsmDevTree",Effect:"Allow",Action:["ssm:GetParameter*","ssm:PutParameter","ssm:AddTagsToResource"],Resource:`arn:aws:ssm:*:${e}:parameter/fjall/dev/*`},{Sid:"FjallDevLogsMutations",Effect:"Allow",Action:["logs:PutRetentionPolicy","logs:DeleteLogGroup"],Resource:`arn:aws:logs:*:${e}:log-group:/fjall/dev/*`},{Sid:"FjallDevLogsTaggedCreate",Effect:"Allow",Action:["logs:CreateLogGroup","logs:TagResource"],Resource:`arn:aws:logs:*:${e}:log-group:/fjall/dev/*`,Condition:{StringEquals:{"aws:RequestTag/fjall:dev":"true"}}},{Sid:"FjallDevLogsRead",Effect:"Allow",Action:["logs:GetLogEvents","logs:DescribeLogStreams","logs:FilterLogEvents"],Resource:`arn:aws:logs:*:${e}:log-group:/fjall/dev/*`},{Sid:"FjallDevLogsDescribeGroups",Effect:"Allow",Action:["logs:DescribeLogGroups"],Resource:"*"},{Sid:"FjallDevKmsViaDevAlias",Effect:"Allow",Action:["kms:Encrypt","kms:Decrypt","kms:GenerateDataKey"],Resource:`arn:aws:kms:*:${e}:key/*`,Condition:{"ForAnyValue:StringLike":{"kms:ResourceAliases":"alias/fjall-dev-*"}}},{Sid:"FjallDevKmsSsmSecureString",Effect:"Allow",Action:["kms:Encrypt","kms:Decrypt","kms:GenerateDataKey"],Resource:`arn:aws:kms:*:${e}:key/*`,Condition:{StringLike:{"kms:ViaService":"ssm.*.amazonaws.com"}}},{Sid:"FjallDevEcrAuthToken",Effect:"Allow",Action:["ecr:GetAuthorizationToken"],Resource:"*"},{Sid:"FjallDevEcrPushPull",Effect:"Allow",Action:["ecr:PutImage","ecr:InitiateLayerUpload","ecr:UploadLayerPart","ecr:CompleteLayerUpload","ecr:BatchCheckLayerAvailability","ecr:BatchGetImage","ecr:GetDownloadUrlForLayer","ecr:DescribeImages"],Resource:`arn:aws:ecr:*:${e}:repository/*`},{Sid:"FjallDevPassDevPathRoles",Effect:"Allow",Action:["iam:PassRole"],Resource:`arn:aws:iam::${e}:role/fjall/dev/*`}]}Ee(I4,"buildDevDeployPolicyStatements");function $4({accountId:e}){return[{Sid:"FjallDevProvisionerBoundedRoleWrites",Effect:"Allow",Action:["iam:CreateRole","iam:PutRolePolicy","iam:AttachRolePolicy"],Resource:`arn:aws:iam::${e}:role/fjall/dev/*`,Condition:{StringEquals:{"iam:PermissionsBoundary":IR(e)}}},{Sid:"FjallDevProvisionerPathRoleOps",Effect:"Allow",Action:["iam:DeleteRole","iam:DeleteRolePolicy","iam:DetachRolePolicy","iam:ListRolePolicies","iam:TagRole"],Resource:`arn:aws:iam::${e}:role/fjall/dev/*`},{Sid:"FjallDevProvisionerListRoles",Effect:"Allow",Action:["iam:ListRoles"],Resource:"*"},{Sid:"FjallDevProvisionerDevMasterSecrets",Effect:"Allow",Action:["secretsmanager:GetSecretValue"],Resource:`arn:aws:secretsmanager:*:${e}:secret:fjall-dev-*`},{Sid:"FjallDevProvisionerKmsDecryptViaSecretsManager",Effect:"Allow",Action:["kms:Decrypt"],Resource:`arn:aws:kms:*:${e}:key/*`,Condition:{StringLike:{"kms:ViaService":"secretsmanager.*.amazonaws.com"}}},{Sid:"FjallDevProvisionerDataApi",Effect:"Allow",Action:["rds-data:ExecuteStatement","rds-data:BatchExecuteStatement","rds-data:BeginTransaction","rds-data:CommitTransaction","rds-data:RollbackTransaction"],Resource:`arn:aws:rds:*:${e}:cluster:fjall-dev-*`},{Sid:"FjallDevProvisionerMetrics",Effect:"Allow",Action:["cloudwatch:GetMetricData"],Resource:"*"},{Sid:"FjallDevProvisionerOrphanDiscovery",Effect:"Allow",Action:["tag:GetResources"],Resource:"*"},{Sid:"FjallDevProvisionerSsmTeardown",Effect:"Allow",Action:["ssm:DeleteParameter*"],Resource:`arn:aws:ssm:*:${e}:parameter/fjall/dev/*`},{Sid:"FjallDevProvisionerLogsTeardown",Effect:"Allow",Action:["logs:DeleteLogGroup"],Resource:`arn:aws:logs:*:${e}:log-group:/fjall/dev/*`},{Sid:"FjallDevProvisionerTaggedTeardown",Effect:"Allow",Action:["ecs:UpdateService","ecs:StopTask","ecs:DeleteService","elasticloadbalancing:DeleteRule","elasticloadbalancing:DeleteTargetGroup","elasticloadbalancing:DeregisterTargets"],Resource:[`arn:aws:ecs:*:${e}:*`,`arn:aws:elasticloadbalancing:*:${e}:*`],Condition:{StringEquals:{"aws:ResourceTag/fjall:dev":"true"}}},{Sid:"FjallDevProvisionerTeardownReads",Effect:"Allow",Action:["ecs:Describe*","elasticloadbalancing:Describe*"],Resource:"*"},{Sid:"FjallDevProvisionerImageJanitor",Effect:"Allow",Action:["ecr:ListImages","ecr:DescribeImages","ecr:BatchDeleteImage"],Resource:`arn:aws:ecr:*:${e}:repository/*`},{Sid:"FjallDevProvisionerSsmReadAll",Effect:"Allow",Action:["ssm:GetParameter*"],Resource:`arn:aws:ssm:*:${e}:parameter/*`},{Sid:"FjallDevProvisionerKmsDecryptViaSsm",Effect:"Allow",Action:["kms:Decrypt"],Resource:`arn:aws:kms:*:${e}:key/*`,Condition:{StringLike:{"kms:ViaService":"ssm.*.amazonaws.com"}}}]}Ee($4,"buildDevProvisionerPolicyStatements");function T4({accountId:e}){return[{Sid:"FjallDevSyncPrefixReadWrite",Effect:"Allow",Action:["s3:GetObject","s3:PutObject"],Resource:`arn:aws:s3:::fjall-dev-sync-${e}-*/*`,Condition:{StringEquals:{"aws:ResourceAccount":e}}}]}Ee(T4,"buildDevSyncWriterPolicyStatements");function R4({accountId:e}){return[{Sid:"FjallDevBoundarySsmDevRead",Effect:"Allow",Action:["ssm:GetParameter*"],Resource:`arn:aws:ssm:*:${e}:parameter/fjall/dev/*`},{Sid:"FjallDevBoundaryKmsDecryptDevAlias",Effect:"Allow",Action:["kms:Decrypt"],Resource:`arn:aws:kms:*:${e}:key/*`,Condition:{"ForAnyValue:StringLike":{"kms:ResourceAliases":"alias/fjall-dev-*"}}},{Sid:"FjallDevBoundarySyncPrefixReadWrite",Effect:"Allow",Action:["s3:GetObject","s3:PutObject"],Resource:`arn:aws:s3:::fjall-dev-sync-${e}-*/*`,Condition:{StringEquals:{"aws:ResourceAccount":e}}},{Sid:"FjallDevBoundarySlotLogs",Effect:"Allow",Action:["logs:CreateLogStream","logs:PutLogEvents"],Resource:`arn:aws:logs:*:${e}:log-group:/fjall/dev/*`},{Sid:"FjallDevBoundarySyncQueue",Effect:"Allow",Action:["sqs:ReceiveMessage","sqs:DeleteMessage","sqs:GetQueueUrl"],Resource:`arn:aws:sqs:*:${e}:fjall-dev-sync-${e}-*`}]}Ee(R4,"buildDevBoundaryStatements");var N4=Object.defineProperty,Ke=(e,t)=>N4(e,"name",{value:t,configurable:!0});function R(e){return JSON.stringify(e)}Ke(R,"escapeStringLiteral");function Tn(e){return e.map(R).join(", ")}Ke(Tn,"formatStringArray");var P4="import:SharedAlarmTopicArn";function Rn(e="    "){return`

package/bin/assets/generators/compute/service/generator.js

@@ -74,7 +74,7 @@ Set the \`cycles\` parameter to \`"ref"\` to resolve cyclical schemas with defs.
 ${fr}`:"",x=[],B=0;for(let er=a-1;er>=g;er--){let Re=o[er]??"",H=B+Re.length+1;if((er>0?fr.length+1:0)+H+l.length+v.length>n)break;x.unshift(Re),B=H}let O=a-x.length>0?`${fr}
 `:"",Te=x.length>0?`${x.join(`
 `)}
-`:"";return O+Te+l+v}wc($A,"extractErrorWindow");var HO=Object.defineProperty,oi=(e,t)=>HO(e,"name",{value:t,configurable:!0});function eh(e){return e.success===!0}oi(eh,"isSuccess");function th(e){return e.success===!1}oi(th,"isFailure");function k(e){return{success:!0,data:e}}oi(k,"success");function $(e){return{success:!1,error:e}}oi($,"failure");async function rh(e){try{let t=await e();return k(t)}catch(t){return $(ft(t))}}oi(rh,"tryAsync");function nh(e){try{let t=e();return k(t)}catch(t){return $(ft(t))}}oi(nh,"trySync");var YO=Object.defineProperty,XO=(e,t)=>YO(e,"name",{value:t,configurable:!0}),TA=/^[a-zA-Z][a-zA-Z0-9-]*$/,JO=Ro.source.replace(/^\^|\$$/g,""),z=Object.freeze({IDENTIFIER:TA,NEW_APP_NAME:/^[a-z][a-z0-9-]*$/,RESOURCE_NAME:/^[a-zA-Z][a-zA-Z0-9]*$/,ECS_SERVICE_NAME:TA,BUCKET_NAME:/^[a-z][a-z0-9-]*[a-z0-9]$|^[a-z][a-z0-9]*$/,DATABASE_NAME:/^[a-zA-Z][a-zA-Z0-9_]*$/,RESOURCE_TYPE:/^[a-z]+(:[a-z]+)?$/,SSM_PATH:new RegExp(`^(?:/${JO})+$`),SECRET_NAME:kc,SSM_COMPONENT:Ro,EMAIL:/^[^\s@]+@[^\s@]+\.[^\s@]+$/,DOCKER_IMAGE:/^[a-z0-9][a-z0-9._-]*[a-z0-9](:[a-z0-9._-]+)?$/,DOMAIN:/^[a-z0-9]([a-z0-9-]*[a-z0-9])?(\.[a-z0-9]([a-z0-9-]*[a-z0-9])?)+$/i,HTTP_ORIGIN:/^https?:\/\/[a-z0-9.-]+(:\d+)?$/i,PASCAL_CASE:/^[A-Z][A-Za-z0-9]*$/,AWS_ACCOUNT_ID:/^\d{12}$/,VPC_ID:/^vpc-[a-z0-9]+$/,ROLE_ARN:/^arn:aws[a-zA-Z-]*:iam::\d{12}:role\/.+$/,CIDR:/^((25[0-5]|2[0-4]\d|1\d\d|[1-9]?\d)\.){3}(25[0-5]|2[0-4]\d|1\d\d|[1-9]?\d)\/(3[0-2]|[12]?\d)$/,SCHEDULE_EXPRESSION:/^(rate\(1 (?:minute|hour|day)\)|rate\((?:[2-9]|[1-9]\d+) (?:minutes|hours|days)\)|cron\([^\s()]+ [^\s()]+ [^\s()]+ [^\s()]+ [^\s()]+ [^\s()]+\))$/,LAMBDA_RUNTIME_IDENTIFIER:/^[A-Za-z0-9._-]+$/,ENV_VAR_NAME:/^[A-Za-z_][A-Za-z0-9_]*$/});function ih(e){let t=/^rate\((\d+) (minute|minutes|hour|hours|day|days)\)$/.exec(e);if(!t)return;let n=t[1],i=t[2];if(n===void 0||i===void 0)return;let r=parseInt(n,10);if(!Number.isFinite(r)||r<1)return;let o=i==="minute"||i==="hour"||i==="day";if(!(o&&r!==1)&&!(!o&&r===1))return i==="minute"||i==="minutes"?{everyMs:r*6e4}:i==="hour"||i==="hours"?{everyMs:r*60*6e4}:{everyMs:r*24*60*6e4}}XO(ih,"parseRateExpression");var m=Object.freeze({IDENTIFIER:"Must start with a letter, contain only letters, numbers, and hyphens",NEW_APP_NAME:"Must start with a lowercase letter and contain only lowercase letters, numbers, and hyphens",IDENTIFIER_MIN_LENGTH:"Must be at least 2 characters",IDENTIFIER_NO_TRAILING_HYPHEN:"Must not end with a hyphen",IDENTIFIER_NO_CONSECUTIVE_HYPHENS:"Must not contain consecutive hyphens",RESOURCE_NAME:"Must start with a letter and contain only letters and numbers (PascalCase recommended)",ECS_SERVICE_NAME:"Service name must start with a letter and contain only letters, numbers, and hyphens",BUCKET_NAME:"Bucket name must start with a lowercase letter and contain only lowercase letters, numbers, and hyphens",DATABASE_NAME:"Database name must start with a letter and contain only letters, numbers, and underscores",RESOURCE_TYPE:"Resource type must be in format 'category' or 'category:type'",SSM_PATH:"SSM path must start with / and contain valid namespace segments (e.g., /myapp/ApiCluster/service)",SECRET_NAME:Og,SSM_COMPONENT:Pc,EMAIL:"Please enter a valid email address",DOMAIN:"Please enter a valid domain (e.g., cms.example.com)",DOCKER_IMAGE:"Invalid Docker image name format",REQUIRED:{APP_NAME:"Application name is required",RESOURCE_NAME:"Resource name is required",BUCKET_NAME:"Bucket name is required",SERVICE_NAME:"Service name is required",NETWORK_NAME:"Network name is required",DATABASE_NAME:"Database name is required",ORGANISATION_NAME:"Organisation name is required",EMAIL:"Email is required",NAME:"Name is required",USERNAME:"Username is required",CONTAINER_NAME:"Container name is required",GROUP:"Group is required",PATTERN_NAME:"Pattern name is required",SOURCE:"Source directory is required",BUILD_COMMAND:"Build command is required",OUTPUT_DIR:"Output directory is required",FORMS_TO:"Forms recipient address is required",ROUTING_PATH:"Routing path is required",RESOURCE_REFERENCE:"Resource reference is required",RESOURCE_TYPE:"Resource type is required",VARIANT:"Variant is required",SUBTYPE:"Subtype is required",DEPLOY_TARGET:"Deploy target is required",DESTROY_TARGET:"Destroy target is required"},MAX_LENGTH:{APP_NAME:"Application name must be 50 characters or less",RESOURCE_NAME:"Resource name must be 63 characters or less",BUCKET_NAME:"Bucket name must be 63 characters or less",SERVICE_NAME:"Service name must be 255 characters or less",NETWORK_NAME:"Network name must be 50 characters or less",DATABASE_NAME:"Database name must be 63 characters or less",ORGANISATION_NAME:"Organisation name must be 50 characters or less"},PORT:{INTEGER:"Port must be an integer",MIN:"Port must be at least 1",MAX:"Port cannot exceed 65535"},USERNAME:{MAX_LENGTH:"Username cannot exceed 63 characters"},LAMBDA:{MEMORY:{INTEGER:"Lambda memory must be an integer",MIN:"Memory must be at least 128 MB",MAX:"Memory cannot exceed 10240 MB",MULTIPLE:"Memory must be 128 MB or a multiple of 64 MB"},TIMEOUT:{INTEGER:"Timeout must be an integer",MIN:"Timeout must be at least 1 second",MAX:"Timeout cannot exceed 900 seconds"},RUNTIME:"Lambda runtime must contain only letters, digits, dots, underscores, or dashes (e.g. 'NODEJS_20_X' or 'nodejs20.x')"},ENV_VAR_NAME:"Environment variable names must start with a letter or underscore and contain only letters, digits, and underscores",PRIORITY:{INTEGER:"Priority must be an integer",MIN:"Priority must be at least 1",MAX:"Priority cannot exceed 50000"},CAPACITY:{MIN:{INTEGER:"Minimum capacity must be an integer",MIN_0:"Minimum capacity must be at least 0",MIN_1:"Minimum capacity must be at least 1",MAX:"Minimum capacity cannot exceed 100"},MAX:{INTEGER:"Maximum capacity must be an integer",MIN_0:"Maximum capacity must be at least 0",MIN_1:"Maximum capacity must be at least 1",MAX:"Maximum capacity cannot exceed 100"},DESIRED:{INTEGER:"Desired count must be an integer",MIN:"Desired count must be at least 0",MAX:"Desired count cannot exceed 100"},WARM_POOL_REQUIRED:"minCapacity 0 requires a warmPool \u2014 without it, new tasks wait 60-90s for a cold instance launch",WARM_POOL:{MIN_SIZE:{INTEGER:"Warm pool minSize must be an integer",MIN:"Warm pool minSize must be at least 0",MAX:"Warm pool minSize cannot exceed 100"},MIN_SIZE_EXCEEDS_MAX_CAPACITY:"warmPool.minSize cannot exceed maxCapacity \u2014 the warm pool cannot hold more instances than the ASG allows"}},MEMORY_LIMIT:{INTEGER:"Memory limit must be an integer",MIN_512:"Memory limit must be at least 512 MiB",MIN_128:"Memory limit must be at least 128 MiB",MAX:"Memory limit cannot exceed 30720 MiB"},DATABASE:{PORT:{INTEGER:"Database port must be an integer",MIN:"Database port must be at least 1024",MAX:"Database port cannot exceed 65535"},NAME:{REQUIRED:"Database name is required",MAX_LENGTH:"Database name must be 63 characters or less"}},BACKUP_RETENTION:{INTEGER:"Backup retention must be an integer",MIN:"Backup retention must be at least 1 day",MAX:"Backup retention cannot exceed 35 days"},SQS:{VISIBILITY_TIMEOUT:{INTEGER:"Visibility timeout must be an integer",MIN:"Visibility timeout must be at least 0 seconds",MAX:"Visibility timeout cannot exceed 43200 seconds (12 hours)"},RETENTION_PERIOD:{INTEGER:"Retention period must be an integer",MIN:"Retention period must be at least 60 seconds",MAX:"Retention period cannot exceed 1209600 seconds (14 days)"}},READER:{COUNT:{INTEGER:"Reader count must be an integer",MIN:"Reader count must be at least 0",MAX:"Reader count cannot exceed 15"}},IDENTIFIER_SUFFIX:{REQUIRED:"Identifier suffix is required when specified",MAX_LENGTH:"Identifier suffix cannot exceed 50 characters"},ROTATION:{INTEGER:"Rotation days must be an integer",MIN:"Rotation interval must be at least 1 day",MAX:"Rotation interval cannot exceed 365 days"},MAX_CONNECTIONS:{INTEGER:"Max connections must be an integer",MIN:"Max connections must be at least 1",MAX:"Max connections cannot exceed 100"},MONITORING_INTERVAL:{INTEGER:"Monitoring interval must be an integer",MIN:"Monitoring interval must be at least 0",MAX:"Monitoring interval cannot exceed 60 seconds",VALUES:"Monitoring interval must be 0, 1, 5, 10, 15, 30, or 60 seconds"},RETENTION_DAYS:{INTEGER:"Retention days must be an integer",MIN:"Retention days must be at least 1",MAX:"Retention days cannot exceed 365"},BATCH_SIZE:{INTEGER:"Batch size must be an integer",MIN:"Batch size must be at least 1",MAX:"Batch size cannot exceed 10000"},SERVICE:{UNIQUE_WITHIN_CLUSTER:"Service names must be unique within a cluster",MIN_REQUIRED:"At least one service is required",ROUTING_REQUIRED:"Multiple services with ports require routing config (path or host)"},PROXY_CONFIG:{MAX_IDLE_CONNECTIONS:{INTEGER:"Max idle connections must be an integer",MIN:"Max idle connections must be at least 0",MAX:"Max idle connections cannot exceed 100"},BORROW_TIMEOUT:{INTEGER:"Connection borrow timeout must be an integer",MIN:"Connection borrow timeout must be at least 1 second",MAX:"Connection borrow timeout cannot exceed 3600 seconds"}},MAX_AZS:{INTEGER:"Max AZs must be an integer",MIN:"Max AZs must be at least 1",MAX:"Max AZs cannot exceed 3"},BATCHING_WINDOW:{INTEGER:"Max batching window must be an integer",MIN:"Max batching window must be at least 0",MAX:"Max batching window cannot exceed 300 seconds"},HEALTH_CHECK:{INTERVAL:{INTEGER:"Health check interval must be an integer",MIN:"Health check interval must be at least 5 seconds",MAX:"Health check interval cannot exceed 300 seconds"},TIMEOUT:{INTEGER:"Health check timeout must be an integer",MIN:"Health check timeout must be at least 2 seconds",MAX:"Health check timeout cannot exceed 60 seconds"},RETRIES:{INTEGER:"Health check retries must be an integer",MIN:"Health check retries must be at least 1",MAX:"Health check retries cannot exceed 10"},START_PERIOD:{INTEGER:"Health check start period must be an integer",MIN:"Health check start period must be at least 0 seconds",MAX:"Health check start period cannot exceed 300 seconds"}},EPHEMERAL_STORAGE:{INTEGER:"Ephemeral storage size must be an integer",MIN:"Ephemeral storage size must be at least 512 MB",MAX:"Ephemeral storage size cannot exceed 10240 MB"},MAX_MESSAGE_SIZE:{INTEGER:"Max message size must be an integer",MIN:"Max message size must be at least 1024 bytes",MAX:"Max message size cannot exceed 262144 bytes (256 KB)"},CAPACITY_CONSTRAINT:{MIN_LTE_MAX:"minCapacity must be less than or equal to maxCapacity"},DIRECT_ACCESS:{NO_DOMAIN:"directAccess cannot be used with domain (no ALB for HTTPS)",NO_LOAD_BALANCER:"directAccess cannot be used with loadBalancer (mutually exclusive)"},GLOBAL_AURORA:{PRIMARY_REGION_REQUIRED:"primaryRegion is required for GlobalAurora databases"},NAT_GATEWAY:{INTEGER:"NAT gateway count must be an integer",MIN:"NAT gateway count must be at least 0",MAX:"NAT gateway count cannot exceed 3"},CIDR_MASK:{INTEGER:"CIDR mask must be an integer",MIN:"CIDR mask must be at least 16",MAX:"CIDR mask cannot exceed 28"},CPU:{INTEGER:"CPU must be an integer",MIN:"CPU must be at least 256 units",MAX:"CPU cannot exceed 4096 units"},KMS:{KEY_REQUIRED:"KMS key ARN is required when using KMS encryption"},READER_INSTANCES:{MAX:"Cannot have more than 15 reader instances",COUNT_OR_INSTANCES:"Cannot specify both 'count' and 'instances' - use one or the other"},GENERATOR_CAPACITY:{MIN:{MIN:"Minimum capacity must be at least 1",MAX:"Minimum capacity cannot exceed 1000"},MAX:{MIN:"Maximum capacity must be at least 1",MAX:"Maximum capacity cannot exceed 1000"}},INSTANCE_TYPE:"Unknown instance type. Common types include: t4g.micro, t4g.small, m5.large",ARCHITECTURE_MISMATCH:"Architecture mismatch between instance type and AMI",ALLOCATED_STORAGE:{INTEGER:"Allocated storage must be an integer",MIN:"Allocated storage must be at least 20 GB",MAX:"Allocated storage cannot exceed 65536 GB"},DLQ:{MAX_RECEIVE_COUNT:{INTEGER:"Max receive count must be an integer",MIN:"Max receive count must be at least 1",MAX:"Max receive count cannot exceed 1000"}},ALARM:{PERCENTAGE:{MIN:"Threshold must be at least 1%",MAX:"Threshold must be at most 100%"},FREE_STORAGE_GIB:{MIN:"Free storage threshold must be at least 1 GiB"}},REGION:"Invalid AWS region",PASCAL_CASE:"Resource name must start with an uppercase letter and contain only alphanumerics (PascalCase).",IMAGE_DOCKER_MUTEX:"image and docker are mutually exclusive",AWS_ACCOUNT_ID:"AWS account id must be exactly 12 digits (no hyphens)",VPC_ID:"VPC id must look like vpc-abc12345",ROLE_ARN:"Role ARN must have the form arn:aws:iam::<account-id>:role/<name>",CIDR:"CIDR must be in dotted-quad/prefix-length form (e.g. 10.0.0.0/16)",VPC_PEER:{MIN_REQUESTER_ACCOUNTS:"At least one requester account id is required",REGION_REQUIRED:"Peer region is required when specified",ROUTE_TABLE_ID_REQUIRED:"Route table id must not be empty"},SCHEDULE_EXPRESSION:"Schedule expression must be 'rate(N minute|minutes|hour|hours|day|days)' with N>=1, or 'cron(<6-field AWS expression>)'"});var qO=Object.defineProperty,tt=(e,t)=>qO(e,"name",{value:t,configurable:!0}),QO=["us-east-2","us-west-2","us-east-1","eu-west-1","eu-central-1","ap-southeast-1"],eD=Object.freeze(QO.flatMap(e=>{let t=qn(e);return t?[t]:[]})),oh=Object.freeze(["us-east-2","us-west-2","us-east-1","eu-west-1","ap-southeast-1"]);function jc(e){return e?e.split(",").map(t=>t.trim()).filter(Boolean):[]}tt(jc,"parseRegionList");function ah(e){return Mt.includes(e)}tt(ah,"isValidRegion");function sh(e){return/^[a-z]{2}-[a-z]+-[1-9]$/.test(e)}tt(sh,"isValidRegionFormat");function ch(e){if(!e)return oh.slice(0,3);let t=e.toLowerCase().split("-"),n=t[0],i=t.length>1?t[1]:"",r=[];return n&&i&&(r=Mt.filter(o=>o.startsWith(`${n}-${i}`))),r.length===0&&n&&(r=Mt.filter(o=>o.startsWith(`${n}-`))),r.length>0?r.slice(0,3):oh.slice(0,3)}tt(ch,"getSuggestions");function lh(e){if(ah(e))return!0;let t=ch(e);return sh(e)?`Unknown region. Try: ${t.join(", ")}`:`Invalid format. Try: ${t.join(", ")}`}tt(lh,"validateRegion");function RA(e){if(!e||e.trim()==="")return!0;let t=jc(e);for(let n of t){let i=lh(n);if(i!==!0)return i}return!0}tt(RA,"validateRegionList");function uh(e,t){return e.filter(n=>n!==t)}tt(uh,"filterDuplicateRegions");function dh(e){return{label:e.city,value:e.code,description:e.optIn?`${e.code} \u2014 opt-in required`:e.code}}tt(dh,"toRegionOption");function NA(){return et.map(dh)}tt(NA,"getRegionOptions");function kA(e){return et.filter(t=>t.code!==e).map(dh)}tt(kA,"getRegionOptionsExcluding");function PA(e){let t=et.find(n=>n.code===e);return t?t.city:e}tt(PA,"getRegionName");function CA(e){return t=>{let n=jc(t);return uh(n,e)}}tt(CA,"createRegionFormatter");var Mc="14.0.0";var zc=["Aurora","Instance","GlobalAurora","ClickHouse"],ai=["FARGATE","FARGATE_SPOT","EC2"],gt=["standard","resilient","enterprise"],Lc=["tinkerer","lightweight","standard","resilient","enterprise"],mh="custom",Co=[...Lc,mh];var tD=Object.defineProperty,rD=(e,t)=>tD(e,"name",{value:t,configurable:!0}),D6=Object.freeze({RESOURCE_SUFFIXES:Object.freeze({storage:"Storage",database:"Database",cluster:"Cluster",function:"Function",instance:"Instance",compute:"Compute"})}),Oo=["ecs","lambda","ec2"],si=Object.freeze({ECS:"ecs",LAMBDA:"lambda",EC2:"ec2"}),Uc=["code","container"],Do=Object.freeze({CODE:"code",CONTAINER:"container"}),Fc=["ARM_64","X86_64"],OA="ARM_64",wo=["NONE","AWS_IAM"],Vc=["public","internal"],Zc=["CPU","MEMORY"],Bc=["ARM","STANDARD"],ph=["Instance","Aurora"],ci=["postgresql","mysql"],jo=["web","worker"],DA=["foundation","compliance","hardened"];var Gc=["t3.nano","t3.micro","t3.small","t3.medium","t3.large","t3.xlarge","t3.2xlarge","t3a.nano","t3a.micro","t3a.small","t3a.medium","t3a.large","t3a.xlarge","t3a.2xlarge","t4g.nano","t4g.micro","t4g.small","t4g.medium","t4g.large","t4g.xlarge","t4g.2xlarge","c5.large","c5.xlarge","c5.2xlarge","c5.4xlarge","c5.9xlarge","c5.12xlarge","c5.18xlarge","c5.24xlarge","c5a.large","c5a.xlarge","c5a.2xlarge","c5a.4xlarge","c5a.8xlarge","c5a.12xlarge","c5a.16xlarge","c5a.24xlarge","c6g.medium","c6g.large","c6g.xlarge","c6g.2xlarge","c6g.4xlarge","c6g.8xlarge","c6g.12xlarge","c6g.16xlarge","r5.large","r5.xlarge","r5.2xlarge","r5.4xlarge","r5.8xlarge","r5.12xlarge","r5.16xlarge","r5.24xlarge","r5a.large","r5a.xlarge","r5a.2xlarge","r5a.4xlarge","r5a.8xlarge","r5a.12xlarge","r5a.16xlarge","r5a.24xlarge","r6g.medium","r6g.large","r6g.xlarge","r6g.2xlarge","r6g.4xlarge","r6g.8xlarge","r6g.12xlarge","r6g.16xlarge","i3.large","i3.xlarge","i3.2xlarge","i3.4xlarge","i3.8xlarge","i3.16xlarge","p3.2xlarge","p3.8xlarge","p3.16xlarge","g4dn.xlarge","g4dn.2xlarge","g4dn.4xlarge","g4dn.8xlarge","g4dn.12xlarge","g4dn.16xlarge","m5.large","m5.xlarge","m5.2xlarge","m5.4xlarge","m5.8xlarge","m5.12xlarge","m5.16xlarge","m5.24xlarge","m5a.large","m5a.xlarge","m5a.2xlarge","m5a.4xlarge","m5a.8xlarge","m5a.12xlarge","m5a.16xlarge","m5a.24xlarge"],wA=[0,1,5,10,15,30,60];function rt(e,t){return e.includes(t)}rD(rt,"constIncludes");var jA=1,MA=65535,L6=Object.freeze({postgresql:5432,mysql:3306}),zA=128,LA=10240,Wc=1,Kc=900,fh=1,gh=1e3,li=100,UA=100;var FA=3e3;var VA=["GET","POST","PUT","DELETE","HEAD","OPTIONS","PATCH"],ZA=["standard","assets","upload","website"],ui=["AES256","KMS"];var nD=Object.defineProperty,Mo=(e,t)=>nD(e,"name",{value:t,configurable:!0}),Fe=Mo(e=>s.union([s.literal(!1),e]),"optionalOrDisabled"),Ur={check:Mo(e=>e.minCapacity!==void 0&&e.maxCapacity!==void 0?e.minCapacity<=e.maxCapacity:!0,"check"),params:{message:m.CAPACITY_CONSTRAINT.MIN_LTE_MAX,path:["maxCapacity"]}},zo=Mo(e=>s.number().int(m.MEMORY_LIMIT.INTEGER).min(e,e===128?m.MEMORY_LIMIT.MIN_128:m.MEMORY_LIMIT.MIN_512).max(30720,m.MEMORY_LIMIT.MAX),"memoryLimitMiBSchema"),F=s.string().min(1,m.REQUIRED.RESOURCE_NAME).max(63,m.MAX_LENGTH.RESOURCE_NAME).regex(z.RESOURCE_NAME,m.RESOURCE_NAME),GA=s.string().min(1,m.REQUIRED.BUCKET_NAME).max(63,m.MAX_LENGTH.BUCKET_NAME).regex(z.BUCKET_NAME,m.BUCKET_NAME),WA=s.string().min(1,m.REQUIRED.DATABASE_NAME).max(63,m.MAX_LENGTH.DATABASE_NAME).regex(z.DATABASE_NAME,m.DATABASE_NAME);function Hc(e,t=z.IDENTIFIER,n=m.IDENTIFIER){return s.string().min(2,m.IDENTIFIER_MIN_LENGTH).max(50,e).regex(t,n).refine(i=>!i.endsWith("-"),{message:m.IDENTIFIER_NO_TRAILING_HYPHEN}).refine(i=>!i.includes("--"),{message:m.IDENTIFIER_NO_CONSECUTIVE_HYPHENS})}Mo(Hc,"identifierSchema");var pe=Hc(m.MAX_LENGTH.APP_NAME),W6=Hc(m.MAX_LENGTH.APP_NAME,z.NEW_APP_NAME,m.NEW_APP_NAME),Fr=s.number().int(m.PORT.INTEGER).min(jA,m.PORT.MIN).max(MA,m.PORT.MAX),_e=s.object({key:s.string(),sourceText:s.string()}).strict(),iD=s.object({__identifier:s.string()}).strict(),oD=s.object({__expression:s.string()}).strict(),aD=s.object({__call:s.string()}).strict(),sD=s.union([iD,oD,aD]),cD=s.union([s.string(),s.number(),s.boolean(),sD]),di=s.record(s.string().regex(z.ENV_VAR_NAME,m.ENV_VAR_NAME),cD),lD=s.object({id:s.string(),name:s.string().optional(),arn:s.string().optional(),field:s.string().optional()}).strict().refine(e=>e.name!==void 0!=(e.arn!==void 0),{message:"secretsImport requires exactly one of `name` or `arn`."}),KA=s.record(s.string(),lD),K6=s.record(s.string(),s.unknown()),hh=s.enum(Co).describe(`Application type must be one of: ${Co.join(", ")}`),vh=s.enum(At).describe(`OpenNext deployment pattern: ${At.join(", ")}`),uD=s.enum(["before-imports","after-imports","after-app-init","after-tags","after-resource","end-of-file"]),dD=s.enum(["import","app-init","tags","database","compute","storage","network","messaging","cdn","pattern","vpc-peer","vpc-peer-accepter","cross-plan-connection","custom"]),HA=s.object({sourceText:s.string(),position:uD,afterManagedResource:s.object({type:dD,name:s.string().optional()}).strict().optional(),originalLine:s.number().int().optional(),leadingComments:s.array(s.string()).optional(),orphaned:s.boolean().optional(),orphanedComment:s.string().optional()}).strict(),YA=s.union([s.object({tier:s.enum(gt)}).strict(),s.literal(!1)]),XA=s.union([s.object({instanceType:s.string().optional()}).strict(),s.literal(!1)]),mD=Hc(m.MAX_LENGTH.ORGANISATION_NAME),pD=s.string().regex(z.EMAIL,m.EMAIL),BA=s.string().refine(e=>Mt.includes(e),{message:m.REGION}),H6=s.object({name:mD,email:pD,accountName:s.string().optional(),primaryRegion:BA.optional().default(Jn),secondaryRegions:s.array(BA).optional(),security:s.enum(DA).optional(),force:s.boolean().optional()}).strict();function Lo(e){return e.issues.map(t=>`${t.path.length>0?`${t.path.join(".")}: `:""}${t.message}`).join(`
+`:"";return O+Te+l+v}wc($A,"extractErrorWindow");var HO=Object.defineProperty,oi=(e,t)=>HO(e,"name",{value:t,configurable:!0});function eh(e){return e.success===!0}oi(eh,"isSuccess");function th(e){return e.success===!1}oi(th,"isFailure");function k(e){return{success:!0,data:e}}oi(k,"success");function $(e){return{success:!1,error:e}}oi($,"failure");async function rh(e){try{let t=await e();return k(t)}catch(t){return $(ft(t))}}oi(rh,"tryAsync");function nh(e){try{let t=e();return k(t)}catch(t){return $(ft(t))}}oi(nh,"trySync");var YO=Object.defineProperty,XO=(e,t)=>YO(e,"name",{value:t,configurable:!0}),TA=/^[a-zA-Z][a-zA-Z0-9-]*$/,JO=Ro.source.replace(/^\^|\$$/g,""),z=Object.freeze({IDENTIFIER:TA,NEW_APP_NAME:/^[a-z][a-z0-9-]*$/,RESOURCE_NAME:/^[a-zA-Z][a-zA-Z0-9]*$/,ECS_SERVICE_NAME:TA,BUCKET_NAME:/^[a-z][a-z0-9-]*[a-z0-9]$|^[a-z][a-z0-9]*$/,DATABASE_NAME:/^[a-zA-Z][a-zA-Z0-9_]*$/,RESOURCE_TYPE:/^[a-z]+(:[a-z]+)?$/,SSM_PATH:new RegExp(`^(?:/${JO})+$`),SECRET_NAME:kc,SSM_COMPONENT:Ro,EMAIL:/^[^\s@]+@[^\s@]+\.[^\s@]+$/,DOCKER_IMAGE:/^[a-z0-9][a-z0-9._-]*[a-z0-9](:[a-z0-9._-]+)?$/,DOMAIN:/^[a-z0-9]([a-z0-9-]*[a-z0-9])?(\.[a-z0-9]([a-z0-9-]*[a-z0-9])?)+$/i,HTTP_ORIGIN:/^https?:\/\/[a-z0-9.-]+(:\d+)?$/i,PASCAL_CASE:/^[A-Z][A-Za-z0-9]*$/,AWS_ACCOUNT_ID:/^\d{12}$/,VPC_ID:/^vpc-[a-z0-9]+$/,ROLE_ARN:/^arn:aws[a-zA-Z-]*:iam::\d{12}:role\/.+$/,CIDR:/^((25[0-5]|2[0-4]\d|1\d\d|[1-9]?\d)\.){3}(25[0-5]|2[0-4]\d|1\d\d|[1-9]?\d)\/(3[0-2]|[12]?\d)$/,SCHEDULE_EXPRESSION:/^(rate\(1 (?:minute|hour|day)\)|rate\((?:[2-9]|[1-9]\d+) (?:minutes|hours|days)\)|cron\([^\s()]+ [^\s()]+ [^\s()]+ [^\s()]+ [^\s()]+ [^\s()]+\))$/,LAMBDA_RUNTIME_IDENTIFIER:/^[A-Za-z0-9._-]+$/,ENV_VAR_NAME:/^[A-Za-z_][A-Za-z0-9_]*$/});function ih(e){let t=/^rate\((\d+) (minute|minutes|hour|hours|day|days)\)$/.exec(e);if(!t)return;let n=t[1],i=t[2];if(n===void 0||i===void 0)return;let r=parseInt(n,10);if(!Number.isFinite(r)||r<1)return;let o=i==="minute"||i==="hour"||i==="day";if(!(o&&r!==1)&&!(!o&&r===1))return i==="minute"||i==="minutes"?{everyMs:r*6e4}:i==="hour"||i==="hours"?{everyMs:r*60*6e4}:{everyMs:r*24*60*6e4}}XO(ih,"parseRateExpression");var m=Object.freeze({IDENTIFIER:"Must start with a letter, contain only letters, numbers, and hyphens",NEW_APP_NAME:"Must start with a lowercase letter and contain only lowercase letters, numbers, and hyphens",IDENTIFIER_MIN_LENGTH:"Must be at least 2 characters",IDENTIFIER_NO_TRAILING_HYPHEN:"Must not end with a hyphen",IDENTIFIER_NO_CONSECUTIVE_HYPHENS:"Must not contain consecutive hyphens",RESOURCE_NAME:"Must start with a letter and contain only letters and numbers (PascalCase recommended)",ECS_SERVICE_NAME:"Service name must start with a letter and contain only letters, numbers, and hyphens",BUCKET_NAME:"Bucket name must start with a lowercase letter and contain only lowercase letters, numbers, and hyphens",DATABASE_NAME:"Database name must start with a letter and contain only letters, numbers, and underscores",RESOURCE_TYPE:"Resource type must be in format 'category' or 'category:type'",SSM_PATH:"SSM path must start with / and contain valid namespace segments (e.g., /myapp/ApiCluster/service)",SECRET_NAME:Og,SSM_COMPONENT:Pc,EMAIL:"Please enter a valid email address",DOMAIN:"Please enter a valid domain (e.g., cms.example.com)",DOCKER_IMAGE:"Invalid Docker image name format",REQUIRED:{APP_NAME:"Application name is required",RESOURCE_NAME:"Resource name is required",BUCKET_NAME:"Bucket name is required",SERVICE_NAME:"Service name is required",NETWORK_NAME:"Network name is required",DATABASE_NAME:"Database name is required",ORGANISATION_NAME:"Organisation name is required",EMAIL:"Email is required",NAME:"Name is required",USERNAME:"Username is required",CONTAINER_NAME:"Container name is required",GROUP:"Group is required",PATTERN_NAME:"Pattern name is required",SOURCE:"Source directory is required",BUILD_COMMAND:"Build command is required",OUTPUT_DIR:"Output directory is required",FORMS_TO:"Forms recipient address is required",ROUTING_PATH:"Routing path is required",RESOURCE_REFERENCE:"Resource reference is required",RESOURCE_TYPE:"Resource type is required",VARIANT:"Variant is required",SUBTYPE:"Subtype is required",DEPLOY_TARGET:"Deploy target is required",DESTROY_TARGET:"Destroy target is required"},MAX_LENGTH:{APP_NAME:"Application name must be 50 characters or less",RESOURCE_NAME:"Resource name must be 63 characters or less",BUCKET_NAME:"Bucket name must be 63 characters or less",SERVICE_NAME:"Service name must be 255 characters or less",NETWORK_NAME:"Network name must be 50 characters or less",DATABASE_NAME:"Database name must be 63 characters or less",ORGANISATION_NAME:"Organisation name must be 50 characters or less"},PORT:{INTEGER:"Port must be an integer",MIN:"Port must be at least 1",MAX:"Port cannot exceed 65535"},USERNAME:{MAX_LENGTH:"Username cannot exceed 63 characters"},LAMBDA:{MEMORY:{INTEGER:"Lambda memory must be an integer",MIN:"Memory must be at least 128 MB",MAX:"Memory cannot exceed 10240 MB",MULTIPLE:"Memory must be 128 MB or a multiple of 64 MB"},TIMEOUT:{INTEGER:"Timeout must be an integer",MIN:"Timeout must be at least 1 second",MAX:"Timeout cannot exceed 900 seconds"},RUNTIME:"Lambda runtime must contain only letters, digits, dots, underscores, or dashes (e.g. 'NODEJS_20_X' or 'nodejs20.x')"},ENV_VAR_NAME:"Environment variable names must start with a letter or underscore and contain only letters, digits, and underscores",PRIORITY:{INTEGER:"Priority must be an integer",MIN:"Priority must be at least 1",MAX:"Priority cannot exceed 50000"},CAPACITY:{MIN:{INTEGER:"Minimum capacity must be an integer",MIN_0:"Minimum capacity must be at least 0",MIN_1:"Minimum capacity must be at least 1",MAX:"Minimum capacity cannot exceed 100"},MAX:{INTEGER:"Maximum capacity must be an integer",MIN_0:"Maximum capacity must be at least 0",MIN_1:"Maximum capacity must be at least 1",MAX:"Maximum capacity cannot exceed 100"},DESIRED:{INTEGER:"Desired count must be an integer",MIN:"Desired count must be at least 0",MAX:"Desired count cannot exceed 100"},WARM_POOL_REQUIRED:"minCapacity 0 requires a warmPool \u2014 without it, new tasks wait 60-90s for a cold instance launch",WARM_POOL:{MIN_SIZE:{INTEGER:"Warm pool minSize must be an integer",MIN:"Warm pool minSize must be at least 0",MAX:"Warm pool minSize cannot exceed 100"},MIN_SIZE_EXCEEDS_MAX_CAPACITY:"warmPool.minSize cannot exceed maxCapacity \u2014 the warm pool cannot hold more instances than the ASG allows"}},MEMORY_LIMIT:{INTEGER:"Memory limit must be an integer",MIN_512:"Memory limit must be at least 512 MiB",MIN_128:"Memory limit must be at least 128 MiB",MAX:"Memory limit cannot exceed 30720 MiB"},DATABASE:{PORT:{INTEGER:"Database port must be an integer",MIN:"Database port must be at least 1024",MAX:"Database port cannot exceed 65535"},NAME:{REQUIRED:"Database name is required",MAX_LENGTH:"Database name must be 63 characters or less"}},BACKUP_RETENTION:{INTEGER:"Backup retention must be an integer",MIN:"Backup retention must be at least 1 day",MAX:"Backup retention cannot exceed 35 days"},SQS:{VISIBILITY_TIMEOUT:{INTEGER:"Visibility timeout must be an integer",MIN:"Visibility timeout must be at least 0 seconds",MAX:"Visibility timeout cannot exceed 43200 seconds (12 hours)"},RETENTION_PERIOD:{INTEGER:"Retention period must be an integer",MIN:"Retention period must be at least 60 seconds",MAX:"Retention period cannot exceed 1209600 seconds (14 days)"}},READER:{COUNT:{INTEGER:"Reader count must be an integer",MIN:"Reader count must be at least 0",MAX:"Reader count cannot exceed 15"}},IDENTIFIER_SUFFIX:{REQUIRED:"Identifier suffix is required when specified",MAX_LENGTH:"Identifier suffix cannot exceed 50 characters"},ROTATION:{INTEGER:"Rotation days must be an integer",MIN:"Rotation interval must be at least 1 day",MAX:"Rotation interval cannot exceed 365 days"},MAX_CONNECTIONS:{INTEGER:"Max connections must be an integer",MIN:"Max connections must be at least 1",MAX:"Max connections cannot exceed 100"},MONITORING_INTERVAL:{INTEGER:"Monitoring interval must be an integer",MIN:"Monitoring interval must be at least 0",MAX:"Monitoring interval cannot exceed 60 seconds",VALUES:"Monitoring interval must be 0, 1, 5, 10, 15, 30, or 60 seconds"},RETENTION_DAYS:{INTEGER:"Retention days must be an integer",MIN:"Retention days must be at least 1",MAX:"Retention days cannot exceed 365"},BATCH_SIZE:{INTEGER:"Batch size must be an integer",MIN:"Batch size must be at least 1",MAX:"Batch size cannot exceed 10000"},SERVICE:{UNIQUE_WITHIN_CLUSTER:"Service names must be unique within a cluster",MIN_REQUIRED:"At least one service is required",ROUTING_REQUIRED:"Multiple services with ports require routing config (path or host)"},PROXY_CONFIG:{MAX_IDLE_CONNECTIONS:{INTEGER:"Max idle connections must be an integer",MIN:"Max idle connections must be at least 0",MAX:"Max idle connections cannot exceed 100"},BORROW_TIMEOUT:{INTEGER:"Connection borrow timeout must be an integer",MIN:"Connection borrow timeout must be at least 1 second",MAX:"Connection borrow timeout cannot exceed 3600 seconds"}},MAX_AZS:{INTEGER:"Max AZs must be an integer",MIN:"Max AZs must be at least 1",MAX:"Max AZs cannot exceed 3"},BATCHING_WINDOW:{INTEGER:"Max batching window must be an integer",MIN:"Max batching window must be at least 0",MAX:"Max batching window cannot exceed 300 seconds"},HEALTH_CHECK:{INTERVAL:{INTEGER:"Health check interval must be an integer",MIN:"Health check interval must be at least 5 seconds",MAX:"Health check interval cannot exceed 300 seconds"},TIMEOUT:{INTEGER:"Health check timeout must be an integer",MIN:"Health check timeout must be at least 2 seconds",MAX:"Health check timeout cannot exceed 60 seconds"},RETRIES:{INTEGER:"Health check retries must be an integer",MIN:"Health check retries must be at least 1",MAX:"Health check retries cannot exceed 10"},START_PERIOD:{INTEGER:"Health check start period must be an integer",MIN:"Health check start period must be at least 0 seconds",MAX:"Health check start period cannot exceed 300 seconds"}},EPHEMERAL_STORAGE:{INTEGER:"Ephemeral storage size must be an integer",MIN:"Ephemeral storage size must be at least 512 MB",MAX:"Ephemeral storage size cannot exceed 10240 MB"},MAX_MESSAGE_SIZE:{INTEGER:"Max message size must be an integer",MIN:"Max message size must be at least 1024 bytes",MAX:"Max message size cannot exceed 262144 bytes (256 KB)"},CAPACITY_CONSTRAINT:{MIN_LTE_MAX:"minCapacity must be less than or equal to maxCapacity"},DIRECT_ACCESS:{NO_DOMAIN:"directAccess cannot be used with domain (no ALB for HTTPS)",NO_LOAD_BALANCER:"directAccess cannot be used with loadBalancer (mutually exclusive)"},GLOBAL_AURORA:{PRIMARY_REGION_REQUIRED:"primaryRegion is required for GlobalAurora databases"},NAT_GATEWAY:{INTEGER:"NAT gateway count must be an integer",MIN:"NAT gateway count must be at least 0",MAX:"NAT gateway count cannot exceed 3"},CIDR_MASK:{INTEGER:"CIDR mask must be an integer",MIN:"CIDR mask must be at least 16",MAX:"CIDR mask cannot exceed 28"},CPU:{INTEGER:"CPU must be an integer",MIN:"CPU must be at least 256 units",MAX:"CPU cannot exceed 4096 units"},KMS:{KEY_REQUIRED:"KMS key ARN is required when using KMS encryption"},READER_INSTANCES:{MAX:"Cannot have more than 15 reader instances",COUNT_OR_INSTANCES:"Cannot specify both 'count' and 'instances' - use one or the other"},GENERATOR_CAPACITY:{MIN:{MIN:"Minimum capacity must be at least 1",MAX:"Minimum capacity cannot exceed 1000"},MAX:{MIN:"Maximum capacity must be at least 1",MAX:"Maximum capacity cannot exceed 1000"}},INSTANCE_TYPE:"Unknown instance type. Common types include: t4g.micro, t4g.small, m5.large",ARCHITECTURE_MISMATCH:"Architecture mismatch between instance type and AMI",ALLOCATED_STORAGE:{INTEGER:"Allocated storage must be an integer",MIN:"Allocated storage must be at least 20 GB",MAX:"Allocated storage cannot exceed 65536 GB"},DLQ:{MAX_RECEIVE_COUNT:{INTEGER:"Max receive count must be an integer",MIN:"Max receive count must be at least 1",MAX:"Max receive count cannot exceed 1000"}},ALARM:{PERCENTAGE:{MIN:"Threshold must be at least 1%",MAX:"Threshold must be at most 100%"},FREE_STORAGE_GIB:{MIN:"Free storage threshold must be at least 1 GiB"}},REGION:"Invalid AWS region",PASCAL_CASE:"Resource name must start with an uppercase letter and contain only alphanumerics (PascalCase).",IMAGE_DOCKER_MUTEX:"image and docker are mutually exclusive",AWS_ACCOUNT_ID:"AWS account id must be exactly 12 digits (no hyphens)",VPC_ID:"VPC id must look like vpc-abc12345",ROLE_ARN:"Role ARN must have the form arn:aws:iam::<account-id>:role/<name>",CIDR:"CIDR must be in dotted-quad/prefix-length form (e.g. 10.0.0.0/16)",VPC_PEER:{MIN_REQUESTER_ACCOUNTS:"At least one requester account id is required",REGION_REQUIRED:"Peer region is required when specified",ROUTE_TABLE_ID_REQUIRED:"Route table id must not be empty"},SCHEDULE_EXPRESSION:"Schedule expression must be 'rate(N minute|minutes|hour|hours|day|days)' with N>=1, or 'cron(<6-field AWS expression>)'"});var qO=Object.defineProperty,tt=(e,t)=>qO(e,"name",{value:t,configurable:!0}),QO=["us-east-2","us-west-2","us-east-1","eu-west-1","eu-central-1","ap-southeast-1"],eD=Object.freeze(QO.flatMap(e=>{let t=qn(e);return t?[t]:[]})),oh=Object.freeze(["us-east-2","us-west-2","us-east-1","eu-west-1","ap-southeast-1"]);function jc(e){return e?e.split(",").map(t=>t.trim()).filter(Boolean):[]}tt(jc,"parseRegionList");function ah(e){return Mt.includes(e)}tt(ah,"isValidRegion");function sh(e){return/^[a-z]{2}-[a-z]+-[1-9]$/.test(e)}tt(sh,"isValidRegionFormat");function ch(e){if(!e)return oh.slice(0,3);let t=e.toLowerCase().split("-"),n=t[0],i=t.length>1?t[1]:"",r=[];return n&&i&&(r=Mt.filter(o=>o.startsWith(`${n}-${i}`))),r.length===0&&n&&(r=Mt.filter(o=>o.startsWith(`${n}-`))),r.length>0?r.slice(0,3):oh.slice(0,3)}tt(ch,"getSuggestions");function lh(e){if(ah(e))return!0;let t=ch(e);return sh(e)?`Unknown region. Try: ${t.join(", ")}`:`Invalid format. Try: ${t.join(", ")}`}tt(lh,"validateRegion");function RA(e){if(!e||e.trim()==="")return!0;let t=jc(e);for(let n of t){let i=lh(n);if(i!==!0)return i}return!0}tt(RA,"validateRegionList");function uh(e,t){return e.filter(n=>n!==t)}tt(uh,"filterDuplicateRegions");function dh(e){return{label:e.city,value:e.code,description:e.optIn?`${e.code} \u2014 opt-in required`:e.code}}tt(dh,"toRegionOption");function NA(){return et.map(dh)}tt(NA,"getRegionOptions");function kA(e){return et.filter(t=>t.code!==e).map(dh)}tt(kA,"getRegionOptionsExcluding");function PA(e){let t=et.find(n=>n.code===e);return t?t.city:e}tt(PA,"getRegionName");function CA(e){return t=>{let n=jc(t);return uh(n,e)}}tt(CA,"createRegionFormatter");var Mc="14.1.0";var zc=["Aurora","Instance","GlobalAurora","ClickHouse"],ai=["FARGATE","FARGATE_SPOT","EC2"],gt=["standard","resilient","enterprise"],Lc=["tinkerer","lightweight","standard","resilient","enterprise"],mh="custom",Co=[...Lc,mh];var tD=Object.defineProperty,rD=(e,t)=>tD(e,"name",{value:t,configurable:!0}),D6=Object.freeze({RESOURCE_SUFFIXES:Object.freeze({storage:"Storage",database:"Database",cluster:"Cluster",function:"Function",instance:"Instance",compute:"Compute"})}),Oo=["ecs","lambda","ec2"],si=Object.freeze({ECS:"ecs",LAMBDA:"lambda",EC2:"ec2"}),Uc=["code","container"],Do=Object.freeze({CODE:"code",CONTAINER:"container"}),Fc=["ARM_64","X86_64"],OA="ARM_64",wo=["NONE","AWS_IAM"],Vc=["public","internal"],Zc=["CPU","MEMORY"],Bc=["ARM","STANDARD"],ph=["Instance","Aurora"],ci=["postgresql","mysql"],jo=["web","worker"],DA=["foundation","compliance","hardened"];var Gc=["t3.nano","t3.micro","t3.small","t3.medium","t3.large","t3.xlarge","t3.2xlarge","t3a.nano","t3a.micro","t3a.small","t3a.medium","t3a.large","t3a.xlarge","t3a.2xlarge","t4g.nano","t4g.micro","t4g.small","t4g.medium","t4g.large","t4g.xlarge","t4g.2xlarge","c5.large","c5.xlarge","c5.2xlarge","c5.4xlarge","c5.9xlarge","c5.12xlarge","c5.18xlarge","c5.24xlarge","c5a.large","c5a.xlarge","c5a.2xlarge","c5a.4xlarge","c5a.8xlarge","c5a.12xlarge","c5a.16xlarge","c5a.24xlarge","c6g.medium","c6g.large","c6g.xlarge","c6g.2xlarge","c6g.4xlarge","c6g.8xlarge","c6g.12xlarge","c6g.16xlarge","r5.large","r5.xlarge","r5.2xlarge","r5.4xlarge","r5.8xlarge","r5.12xlarge","r5.16xlarge","r5.24xlarge","r5a.large","r5a.xlarge","r5a.2xlarge","r5a.4xlarge","r5a.8xlarge","r5a.12xlarge","r5a.16xlarge","r5a.24xlarge","r6g.medium","r6g.large","r6g.xlarge","r6g.2xlarge","r6g.4xlarge","r6g.8xlarge","r6g.12xlarge","r6g.16xlarge","i3.large","i3.xlarge","i3.2xlarge","i3.4xlarge","i3.8xlarge","i3.16xlarge","p3.2xlarge","p3.8xlarge","p3.16xlarge","g4dn.xlarge","g4dn.2xlarge","g4dn.4xlarge","g4dn.8xlarge","g4dn.12xlarge","g4dn.16xlarge","m5.large","m5.xlarge","m5.2xlarge","m5.4xlarge","m5.8xlarge","m5.12xlarge","m5.16xlarge","m5.24xlarge","m5a.large","m5a.xlarge","m5a.2xlarge","m5a.4xlarge","m5a.8xlarge","m5a.12xlarge","m5a.16xlarge","m5a.24xlarge"],wA=[0,1,5,10,15,30,60];function rt(e,t){return e.includes(t)}rD(rt,"constIncludes");var jA=1,MA=65535,L6=Object.freeze({postgresql:5432,mysql:3306}),zA=128,LA=10240,Wc=1,Kc=900,fh=1,gh=1e3,li=100,UA=100;var FA=3e3;var VA=["GET","POST","PUT","DELETE","HEAD","OPTIONS","PATCH"],ZA=["standard","assets","upload","website"],ui=["AES256","KMS"];var nD=Object.defineProperty,Mo=(e,t)=>nD(e,"name",{value:t,configurable:!0}),Fe=Mo(e=>s.union([s.literal(!1),e]),"optionalOrDisabled"),Ur={check:Mo(e=>e.minCapacity!==void 0&&e.maxCapacity!==void 0?e.minCapacity<=e.maxCapacity:!0,"check"),params:{message:m.CAPACITY_CONSTRAINT.MIN_LTE_MAX,path:["maxCapacity"]}},zo=Mo(e=>s.number().int(m.MEMORY_LIMIT.INTEGER).min(e,e===128?m.MEMORY_LIMIT.MIN_128:m.MEMORY_LIMIT.MIN_512).max(30720,m.MEMORY_LIMIT.MAX),"memoryLimitMiBSchema"),F=s.string().min(1,m.REQUIRED.RESOURCE_NAME).max(63,m.MAX_LENGTH.RESOURCE_NAME).regex(z.RESOURCE_NAME,m.RESOURCE_NAME),GA=s.string().min(1,m.REQUIRED.BUCKET_NAME).max(63,m.MAX_LENGTH.BUCKET_NAME).regex(z.BUCKET_NAME,m.BUCKET_NAME),WA=s.string().min(1,m.REQUIRED.DATABASE_NAME).max(63,m.MAX_LENGTH.DATABASE_NAME).regex(z.DATABASE_NAME,m.DATABASE_NAME);function Hc(e,t=z.IDENTIFIER,n=m.IDENTIFIER){return s.string().min(2,m.IDENTIFIER_MIN_LENGTH).max(50,e).regex(t,n).refine(i=>!i.endsWith("-"),{message:m.IDENTIFIER_NO_TRAILING_HYPHEN}).refine(i=>!i.includes("--"),{message:m.IDENTIFIER_NO_CONSECUTIVE_HYPHENS})}Mo(Hc,"identifierSchema");var pe=Hc(m.MAX_LENGTH.APP_NAME),W6=Hc(m.MAX_LENGTH.APP_NAME,z.NEW_APP_NAME,m.NEW_APP_NAME),Fr=s.number().int(m.PORT.INTEGER).min(jA,m.PORT.MIN).max(MA,m.PORT.MAX),_e=s.object({key:s.string(),sourceText:s.string()}).strict(),iD=s.object({__identifier:s.string()}).strict(),oD=s.object({__expression:s.string()}).strict(),aD=s.object({__call:s.string()}).strict(),sD=s.union([iD,oD,aD]),cD=s.union([s.string(),s.number(),s.boolean(),sD]),di=s.record(s.string().regex(z.ENV_VAR_NAME,m.ENV_VAR_NAME),cD),lD=s.object({id:s.string(),name:s.string().optional(),arn:s.string().optional(),field:s.string().optional()}).strict().refine(e=>e.name!==void 0!=(e.arn!==void 0),{message:"secretsImport requires exactly one of `name` or `arn`."}),KA=s.record(s.string(),lD),K6=s.record(s.string(),s.unknown()),hh=s.enum(Co).describe(`Application type must be one of: ${Co.join(", ")}`),vh=s.enum(At).describe(`OpenNext deployment pattern: ${At.join(", ")}`),uD=s.enum(["before-imports","after-imports","after-app-init","after-tags","after-resource","end-of-file"]),dD=s.enum(["import","app-init","tags","database","compute","storage","network","messaging","cdn","pattern","vpc-peer","vpc-peer-accepter","cross-plan-connection","custom"]),HA=s.object({sourceText:s.string(),position:uD,afterManagedResource:s.object({type:dD,name:s.string().optional()}).strict().optional(),originalLine:s.number().int().optional(),leadingComments:s.array(s.string()).optional(),orphaned:s.boolean().optional(),orphanedComment:s.string().optional()}).strict(),YA=s.union([s.object({tier:s.enum(gt)}).strict(),s.literal(!1)]),XA=s.union([s.object({instanceType:s.string().optional()}).strict(),s.literal(!1)]),mD=Hc(m.MAX_LENGTH.ORGANISATION_NAME),pD=s.string().regex(z.EMAIL,m.EMAIL),BA=s.string().refine(e=>Mt.includes(e),{message:m.REGION}),H6=s.object({name:mD,email:pD,accountName:s.string().optional(),primaryRegion:BA.optional().default(Jn),secondaryRegions:s.array(BA).optional(),security:s.enum(DA).optional(),force:s.boolean().optional()}).strict();function Lo(e){return e.issues.map(t=>`${t.path.length>0?`${t.path.join(".")}: `:""}${t.message}`).join(`
 `)}Mo(Lo,"getZodErrorMessage");var Yc=s.number().min(1,m.ALARM.PERCENTAGE.MIN).max(100,m.ALARM.PERCENTAGE.MAX),yh=s.union([Yc,s.literal(!1)]),fD=s.number().min(1,m.ALARM.FREE_STORAGE_GIB.MIN),JA=s.union([s.literal(!1),s.object({cpuThreshold:yh.optional(),memoryThreshold:yh.optional(),runningTasksMinimum:s.number().int().min(0).optional(),http5xxThreshold:yh.optional()}).strict()]),qA=s.union([s.literal(!1),s.object({cpuThreshold:Yc.optional(),freeStorageThresholdGiB:fD.optional(),connectionsThreshold:s.number().int().min(1).optional()}).strict()]),QA=s.union([s.literal(!1),s.object({errorRateThreshold:Yc.optional(),durationThresholdPercent:Yc.optional()}).strict()]);var zt=s.number().int(m.BACKUP_RETENTION.INTEGER).min(1,m.BACKUP_RETENTION.MIN).max(35,m.BACKUP_RETENTION.MAX),Uo=s.number().int(m.MONITORING_INTERVAL.INTEGER).refine(e=>rt(wA,e),{message:m.MONITORING_INTERVAL.VALUES}),Jc=s.number().int(m.DATABASE.PORT.INTEGER).min(1024,m.DATABASE.PORT.MIN).max(65535,m.DATABASE.PORT.MAX),gD=s.enum(zc).describe(`Database type must be one of: ${zc.join(", ")}`),hD=s.object({maxConnections:s.number().int(m.MAX_CONNECTIONS.INTEGER).min(1,m.MAX_CONNECTIONS.MIN).max(100,m.MAX_CONNECTIONS.MAX).optional(),maxIdleConnections:s.number().int(m.PROXY_CONFIG.MAX_IDLE_CONNECTIONS.INTEGER).min(0,m.PROXY_CONFIG.MAX_IDLE_CONNECTIONS.MIN).max(100,m.PROXY_CONFIG.MAX_IDLE_CONNECTIONS.MAX).optional(),connectionBorrowTimeout:s.number().int(m.PROXY_CONFIG.BORROW_TIMEOUT.INTEGER).min(1,m.PROXY_CONFIG.BORROW_TIMEOUT.MIN).max(3600,m.PROXY_CONFIG.BORROW_TIMEOUT.MAX).optional(),requireTLS:s.boolean().optional()}).strict().describe("RDS Proxy configuration"),vD=s.object({instanceType:s.string().optional(),availabilityZone:s.string().optional()}).strict().describe("Read replica configuration"),yD=s.object({automaticallyAfterDays:s.number().int(m.ROTATION.INTEGER).min(1,m.ROTATION.MIN).max(365,m.ROTATION.MAX).optional()}).strict().describe("Secret rotation configuration"),qc=s.object({username:s.string().min(1,m.REQUIRED.USERNAME).max(63,m.USERNAME.MAX_LENGTH).optional(),secretRotation:yD.optional()}).strict().describe("Database credentials configuration"),Qc=Fe(hD),el=Fe(vD),bD=s.object({scaleWithWriter:s.boolean().optional(),enableDatabaseInsights:s.boolean().optional(),identifierSuffix:s.string().min(1,m.IDENTIFIER_SUFFIX.REQUIRED).max(50,m.IDENTIFIER_SUFFIX.MAX_LENGTH).optional(),availabilityZone:s.string().optional()}).strict().describe("Configuration for a single Aurora reader instance"),Fo=s.object({enableDatabaseInsights:s.boolean().optional(),identifierSuffix:s.string().min(1,m.IDENTIFIER_SUFFIX.REQUIRED).max(50,m.IDENTIFIER_SUFFIX.MAX_LENGTH).optional(),availabilityZone:s.string().optional()}).strict().describe("Configuration for Aurora writer instance"),SD=s.object({count:s.number().int(m.READER.COUNT.INTEGER).min(0,m.READER.COUNT.MIN).max(15,m.READER.COUNT.MAX).optional(),instances:s.array(bD).max(15,m.READER_INSTANCES.MAX).optional(),defaultEnableDatabaseInsights:s.boolean().optional()}).strict().refine(e=>!(e.count!==void 0&&e.instances!==void 0),{message:m.READER_INSTANCES.COUNT_OR_INSTANCES,path:["count"]}).describe("Aurora readers configuration"),Vo=Fe(SD),ED=s.object({awsManaged:s.literal(!0)}).strict(),_D=s.object({useCMK:s.literal(!0)}).strict(),eI=s.union([ED,_D]),AD=s.object({mode:s.enum(["standard","advanced"]).optional(),encryptionKey:eI.optional()}).strict().describe("Database Insights configuration"),tl=Fe(AD),rl=s.object({storageKey:eI.optional()}).strict().describe("Encryption configuration (DESTRUCTIVE to change storageKey)"),tI=s.object({name:F,type:gD,databaseName:s.string().min(1,m.REQUIRED.DATABASE_NAME),instanceType:s.string().optional(),allocatedStorage:s.number().optional(),multiAz:s.boolean().optional(),publiclyAccessible:s.boolean().optional(),databaseInsights:tl.optional(),port:Jc.optional(),deletionProtection:s.boolean().optional(),proxy:Qc.optional(),credentials:qc.optional(),readReplica:el.optional(),encryption:rl.optional(),writer:Fo.optional(),readers:Vo.optional(),backupRetention:zt.optional(),preferredMaintenanceWindow:s.string().optional(),monitoringInterval:Uo.optional(),primaryRegion:s.string().optional(),secondaryRegions:s.array(s.string()).optional(),globalClusterIdentifier:s.string().optional(),enableGlobalWriteForwarding:s.boolean().optional(),snapshotIdentifier:s.string().optional(),snapshotUsername:s.string().optional(),databaseEngine:s.enum(ci).optional(),engineExpression:s.string().optional(),variableName:s.string().optional(),extraProperties:s.array(_e).optional(),alarms:qA.optional()}).strict(),nl=s.object({appName:pe,nameProvidedByFlag:s.boolean().optional(),databaseName:s.string().min(1,m.REQUIRED.DATABASE_NAME).max(63,m.MAX_LENGTH.DATABASE_NAME).regex(z.DATABASE_NAME,m.DATABASE_NAME),resourceName:F.optional(),connectionConfig:s.object({connectToCompute:s.array(s.string()).optional(),connectToServices:s.array(s.string()).optional()}).strict().optional(),databaseInsights:tl.optional(),port:Jc.optional(),proxy:Qc.optional(),credentials:qc.optional(),encryption:rl.optional(),deletionProtection:s.boolean().optional()}).strict(),rI={databaseType:s.literal("Instance"),instanceType:s.string().optional(),multiAz:s.boolean().optional(),readReplica:el.optional(),publiclyAccessible:s.boolean().optional(),backupRetention:zt.optional(),allocatedStorage:s.number().optional(),snapshotIdentifier:s.string().optional(),snapshotUsername:s.string().optional()},nI={databaseType:s.literal("Aurora"),writer:Fo.optional(),readers:Vo.optional(),backupRetention:zt.optional(),preferredMaintenanceWindow:s.string().optional(),monitoringInterval:Uo.optional(),snapshotIdentifier:s.string().optional(),snapshotUsername:s.string().optional()},iI={databaseType:s.literal("GlobalAurora"),primaryRegion:s.string().min(1,m.GLOBAL_AURORA.PRIMARY_REGION_REQUIRED),secondaryRegions:s.array(s.string()).optional(),globalClusterIdentifier:s.string().optional(),enableGlobalWriteForwarding:s.boolean().optional(),writer:Fo.optional(),readers:Vo.optional(),backupRetention:zt.optional(),preferredMaintenanceWindow:s.string().optional(),monitoringInterval:Uo.optional(),snapshotIdentifier:s.string().optional(),snapshotUsername:s.string().optional()},oI=s.object({appName:pe,nameProvidedByFlag:s.boolean().optional(),databaseName:s.string().min(1,m.REQUIRED.DATABASE_NAME).max(63,m.MAX_LENGTH.DATABASE_NAME).regex(z.DATABASE_NAME,m.DATABASE_NAME),resourceName:F.optional(),connectionConfig:s.object({connectToCompute:s.array(s.string()).optional(),connectToServices:s.array(s.string()).optional()}).strict().optional()}).strict(),aI={databaseType:s.literal("ClickHouse"),instanceType:s.string().optional(),coldTier:s.union([s.object({mode:s.literal("s3")}).strict(),s.literal(!1)]).optional(),optimiseSchedule:s.union([s.string(),s.literal(!1)]).optional(),backupSchedule:s.union([s.string(),s.literal(!1)]).optional(),backupRetentionDays:zt.optional()},ID=nl.extend(rI).strict(),xD=nl.extend(nI).strict(),$D=nl.extend(iI).strict(),TD=oI.extend(aI).strict(),iV=s.discriminatedUnion("databaseType",[ID,xD,$D,TD]),bh=nl.extend({resourceName:F}).strict(),RD=bh.extend(rI).strict(),ND=bh.extend(nI).strict(),kD=bh.extend(iI).strict(),PD=oI.extend({resourceName:F}).strict(),CD=PD.extend(aI).strict(),oV=s.discriminatedUnion("databaseType",[RD,ND,kD,CD]),aV=s.object({appName:pe,databaseName:s.string().min(1,m.REQUIRED.DATABASE_NAME),maxConnections:s.number().int(m.MAX_CONNECTIONS.INTEGER).min(1,m.MAX_CONNECTIONS.MIN).max(100,m.MAX_CONNECTIONS.MAX).optional(),maxIdleConnections:s.number().int(m.PROXY_CONFIG.MAX_IDLE_CONNECTIONS.INTEGER).min(0,m.PROXY_CONFIG.MAX_IDLE_CONNECTIONS.MIN).max(100,m.PROXY_CONFIG.MAX_IDLE_CONNECTIONS.MAX).optional(),connectionBorrowTimeout:s.number().int(m.PROXY_CONFIG.BORROW_TIMEOUT.INTEGER).min(1,m.PROXY_CONFIG.BORROW_TIMEOUT.MIN).max(3600,m.PROXY_CONFIG.BORROW_TIMEOUT.MAX).optional(),requireTLS:s.boolean().optional(),nameProvidedByFlag:s.boolean().optional()}).strict(),OD=["S","N","B"],Xc=s.object({name:s.string(),type:s.enum(OD)}).strict(),sI=s.object({name:F,partitionKey:Xc,sortKey:Xc.optional(),globalSecondaryIndexes:s.array(s.object({indexName:s.string(),partitionKey:Xc,sortKey:Xc.optional()}).strict()).optional(),ttlAttribute:s.string().optional(),stream:s.boolean().optional(),variableName:s.string().optional(),extraProperties:s.array(_e).optional()}).strict(),DD=s.object({mode:s.literal("s3")}).strict(),cI=s.object({name:F,type:s.literal("ClickHouse"),databaseName:WA,instanceType:s.string().optional(),coldTier:s.union([DD,s.literal(!1)]).optional(),optimiseSchedule:s.union([s.string(),s.literal(!1)]).optional(),backupSchedule:s.union([s.string(),s.literal(!1)]).optional(),backupRetentionDays:zt.optional(),variableName:s.string().optional(),extraProperties:s.array(_e).optional()}).strict();var wD=s.object({count:s.number().int(m.NAT_GATEWAY.INTEGER).min(0,m.NAT_GATEWAY.MIN).max(3,m.NAT_GATEWAY.MAX).optional()}).strict().describe("NAT gateway configuration"),lI=Fe(wD),Sh=s.enum(["cloudwatch","s3"]),jD=s.object({destination:Sh.optional(),retentionDays:s.number().int(m.RETENTION_DAYS.INTEGER).min(1,m.RETENTION_DAYS.MIN).max(365,m.RETENTION_DAYS.MAX).optional(),trafficType:s.enum(["ALL","ACCEPT","REJECT"]).optional()}).strict().describe("VPC flow log configuration"),uI=Fe(jD),MD=s.object({s3:s.boolean().optional(),dynamodb:s.boolean().optional()}).strict().describe("Gateway VPC endpoints (FREE)"),zD=Fe(MD),LD=s.object({ecr:s.boolean().optional(),secretsManager:s.boolean().optional(),kms:s.boolean().optional(),cloudwatchLogs:s.boolean().optional(),ssm:s.boolean().optional(),sts:s.boolean().optional()}).strict().describe("Interface VPC endpoints (cost per hour)"),UD=Fe(LD),FD=s.object({gateway:zD.optional(),interface:UD.optional()}).strict().describe("VPC endpoints configuration"),dI=Fe(FD),il=s.object({maxAzs:s.number().int(m.MAX_AZS.INTEGER).min(1,m.MAX_AZS.MIN).max(3,m.MAX_AZS.MAX).optional(),natGateways:lI.optional(),flowLogs:uI.optional(),vpcEndpoints:dI.optional(),cidrMask:s.number().int(m.CIDR_MASK.INTEGER).min(16,m.CIDR_MASK.MIN).max(28,m.CIDR_MASK.MAX).optional()}).strict(),mI=s.string().min(1,m.REQUIRED.NETWORK_NAME).max(50,m.MAX_LENGTH.NETWORK_NAME).regex(z.RESOURCE_NAME,m.RESOURCE_NAME),pI=il.extend({name:mI}).strict(),fI=Fe(il),dV=s.object({appName:pe,networkName:mI.optional(),maxAzs:s.number().int(m.MAX_AZS.INTEGER).min(1,m.MAX_AZS.MIN).max(3,m.MAX_AZS.MAX).optional(),natGateways:lI.optional(),flowLogs:uI.optional(),vpcEndpoints:dI.optional()}).strict(),VD=z.CIDR,Eh=s.string().regex(VD,m.CIDR),ZD=s.object({kind:s.literal("database"),resource:s.string().min(1,m.REQUIRED.RESOURCE_REFERENCE),name:F,allowedFromCidrs:s.array(Eh),access:s.enum(["read","write","readWrite"]).optional()}).strict(),BD=s.object({kind:s.literal("ecsService"),resource:s.string().min(1,m.REQUIRED.RESOURCE_REFERENCE),serviceName:s.string().min(1,m.REQUIRED.SERVICE_NAME),name:F,allowedFromCidrs:s.array(Eh),port:Fr.optional()}).strict(),GD=s.discriminatedUnion("kind",[ZD,BD]),mV=s.object({name:F,peerAppName:s.string().min(1,m.REQUIRED.APP_NAME),peerAccountId:s.string().regex(z.AWS_ACCOUNT_ID,m.AWS_ACCOUNT_ID),peerRegion:s.string().min(1,m.VPC_PEER.REGION_REQUIRED).optional(),peerVpcId:s.string().regex(z.VPC_ID,m.VPC_ID).optional(),peerVpcCidr:Eh.optional(),peerRoleArn:s.string().regex(z.ROLE_ARN,m.ROLE_ARN).optional(),peerRouteTableIds:s.array(s.string().min(1,m.VPC_PEER.ROUTE_TABLE_ID_REQUIRED)).optional(),localVpcName:s.string().min(1,m.REQUIRED.NETWORK_NAME).optional(),enableDnsResolution:s.boolean().optional()}).strict(),pV=s.object({name:F,requesterAccountIds:s.array(s.string().regex(z.AWS_ACCOUNT_ID,m.AWS_ACCOUNT_ID)).min(1,m.VPC_PEER.MIN_REQUESTER_ACCOUNTS),localVpcName:s.string().min(1,m.REQUIRED.NETWORK_NAME).optional(),publishToSsm:s.boolean().optional(),exposedResources:s.array(GD).optional()}).strict();var ol=["storage","cdn","compute"],WD=s.object({sid:s.string().optional(),effect:s.enum(["Allow","Deny"]),principals:s.array(s.string()),actions:s.array(s.string()),resources:s.array(s.string()).optional(),conditions:s.record(s.string(),s.record(s.string(),s.union([s.string(),s.array(s.string())]))).optional()}).strict(),gI=s.object({name:F,bucketName:s.string().optional(),publicReadAccess:s.boolean().optional(),websiteHosting:s.object({indexDocument:s.string(),errorDocument:s.string().optional()}).strict().optional(),backupVaultTier:s.enum(gt).optional(),versioned:s.boolean().optional(),encryption:s.enum(ui).optional(),kmsKeyArn:s.string().optional(),cors:s.array(s.object({allowedOrigins:s.array(s.string()),allowedMethods:s.array(s.string()),allowedHeaders:s.array(s.string()).optional(),exposedHeaders:s.array(s.string()).optional(),maxAge:s.number().optional()}).strict()).optional(),deployment:s.object({source:s.string(),prune:s.boolean().optional(),cacheControl:s.object({maxAge:s.number().optional(),immutable:s.boolean().optional()}).strict().optional()}).strict().optional(),retain:s.boolean().optional(),resourcePolicyStatements:s.array(WD).optional(),stackPlacement:s.enum(ol).optional(),variableName:s.string().optional(),extraProperties:s.array(_e).optional()}).strict().refine(e=>e.encryption!=="KMS"||!!e.kmsKeyArn,{message:m.KMS.KEY_REQUIRED}),bV=s.object({appName:pe,bucketName:GA,nameProvidedByFlag:s.boolean().optional(),storagePreset:s.enum(ZA).optional(),publicReadAccess:s.boolean().optional(),websiteHosting:s.object({indexDocument:s.string(),errorDocument:s.string().optional()}).strict().optional(),backupVaultTier:s.enum(gt).optional(),versioned:s.boolean().optional(),encryption:s.enum(ui).optional(),kmsKeyArn:s.string().optional(),cors:s.array(s.object({allowedOrigins:s.array(s.string()),allowedMethods:s.array(s.string()),allowedHeaders:s.array(s.string()).optional(),exposedHeaders:s.array(s.string()).optional(),maxAge:s.number().optional()}).strict()).optional(),connectionConfig:s.object({connectToCompute:s.array(s.string()).optional(),connectToServices:s.array(s.string()).optional()}).strict().optional()}).strict().refine(e=>e.encryption!=="KMS"||!!e.kmsKeyArn,{message:m.KMS.KEY_REQUIRED,path:["kmsKeyArn"]});var _h=s.enum(["DESTROY","RETAIN"]),hI=s.object({name:F,queueType:s.enum(["standard","fifo"]).default("standard"),visibilityTimeout:s.number().int(m.SQS.VISIBILITY_TIMEOUT.INTEGER).min(0,m.SQS.VISIBILITY_TIMEOUT.MIN).max(43200,m.SQS.VISIBILITY_TIMEOUT.MAX).optional(),retentionPeriod:s.number().int(m.SQS.RETENTION_PERIOD.INTEGER).min(60,m.SQS.RETENTION_PERIOD.MIN).max(1209600,m.SQS.RETENTION_PERIOD.MAX).optional(),contentBasedDeduplication:s.boolean().optional(),removalPolicy:_h.optional(),variableName:s.string().optional(),extraProperties:s.array(_e).optional()}).strict();var vI=s.object({type:s.literal("basic-auth"),username:s.string().min(1),password:s.string().min(1)}).strict(),yI=s.object({name:F,defaultOriginRef:s.string(),behaviours:s.array(s.object({pathPattern:s.string(),originRef:s.string(),cachePolicy:s.enum(["CACHING_OPTIMIZED","CACHING_DISABLED"]).optional()}).strict()).optional(),customDomain:s.string().optional(),certificateArn:s.string().optional(),accessGate:s.union([s.literal(!1),vI]).optional(),extraProperties:s.array(_e).optional()}).strict(),TV=s.object({appName:s.string(),name:F.optional(),defaultOriginRef:s.string(),behaviours:s.array(s.object({pathPattern:s.string(),originRef:s.string(),cachePolicy:s.enum(["CACHING_OPTIMIZED","CACHING_DISABLED"]).optional()}).strict()).optional(),customDomain:s.string().optional(),certificateArn:s.string().optional(),accessGate:s.union([s.literal(!1),vI]).optional(),nameProvidedByFlag:s.boolean().optional()}).strict();var KD=Object.defineProperty,Ah=(e,t)=>KD(e,"name",{value:t,configurable:!0}),HD=new Set(["t4g","c6g","c6gd","c6gn","c7g","c7gd","c7gn","r6g","r6gd","r7g","r7gd","r8g","r8gd","c8g","c8gd","c8gn","m6g","m6gd","m7g","m7gd","m8g","m8gd","x8g","i8g","a1","x2gd","im4gn","is4gen","i4g","hpc7g"]);function mi(e){let t=e.split(".")[0]??"";return HD.has(t)?"ARM":"STANDARD"}Ah(mi,"getArchitectureForInstanceType");function al(e,t){let n=mi(e);return n!==t?{valid:!1,message:`Instance type '${e}' requires ${n} architecture, but '${t}' AMI was specified. Use a ${n==="ARM"?"Graviton instance (t4g, c6g, r6g, m6g, etc.)":"Intel/AMD instance (t3, c5, r5, m5, etc.)"} instead.`}:{valid:!0}}Ah(al,"validateArchitectureMatch");function bI(e,t){return mi(e)===t}Ah(bI,"isArchitectureCompatible");var YD=Object.defineProperty,sl=(e,t)=>YD(e,"name",{value:t,configurable:!0});var XD=1;var JD=/^[A-Za-z0-9_.-]+$/,qD=s.object({id:s.string().min(1,"buildSecret id cannot be empty").regex(JD,"buildSecret id may contain only letters, digits, '_', '.', and '-' (no comma, '=', or whitespace, which would break the buildx --secret argv)"),ssm:s.string().min(1,"ssm parameter name cannot be empty").optional(),secretsManager:s.object({name:s.string().min(1,"secret name cannot be empty").optional(),arn:s.string().min(1,"secret arn cannot be empty").optional(),field:s.string().min(1,"secret field cannot be empty").optional()}).strict().refine(e=>e.name===void 0!=(e.arn===void 0),"secretsManager requires exactly one of name or arn").optional(),env:s.string().min(1,"env variable name cannot be empty").optional()}).strict().superRefine((e,t)=>{[e.ssm,e.secretsManager,e.env].filter(n=>n!==void 0).length!==1&&t.addIssue({code:s.ZodIssueCode.custom,message:"buildSecret requires exactly one source (ssm, secretsManager, or env)"})}),QD=s.union([s.string(),s.object({ssm:s.string().min(1,"ssm parameter name cannot be empty").optional(),secretsManager:s.object({name:s.string().min(1,"secret name cannot be empty").optional(),arn:s.string().min(1,"secret arn cannot be empty").optional(),field:s.string().min(1,"secret field cannot be empty").optional()}).strict().refine(e=>e.name===void 0!=(e.arn===void 0),"secretsManager requires exactly one of name or arn").optional(),env:s.string().min(1,"env variable name cannot be empty").optional(),acknowledgePublic:s.boolean().optional()}).strict().superRefine((e,t)=>{[e.ssm,e.secretsManager,e.env].filter(n=>n!==void 0).length!==1&&t.addIssue({code:s.ZodIssueCode.custom,message:"buildArg value requires exactly one source (ssm, secretsManager, or env)"})})]),It=s.object({path:s.string(),context:s.string().min(1,"context cannot be empty").optional(),target:s.string().min(1,"target cannot be empty").optional(),buildArgs:s.record(s.string(),QD).optional(),buildSecrets:s.array(qD).optional()}).strict(),CV=It.partial();function ew(e,t){if(t===void 0)return e;let n=t.context??e.context,i=t.target??e.target,r=t.buildArgs??e.buildArgs,o=t.buildSecrets??e.buildSecrets;return{path:t.path??e.path,...n!==void 0&&{context:n},...i!==void 0&&{target:i},...r!==void 0&&{buildArgs:r},...o!==void 0&&{buildSecrets:o}}}sl(ew,"mergeDockerBuild");function Ih(e){return typeof e=="object"&&e!==null&&!Array.isArray(e)}sl(Ih,"isRecord");function SI(e){if(!Ih(e)||typeof e.path!="string"||e.path.length===0)return;let t=typeof e.context=="string"&&e.context.length>0?e.context:void 0,n=typeof e.target=="string"&&e.target.length>0?e.target:void 0,i=Ih(e.buildArgs)&&Object.keys(e.buildArgs).length>0?e.buildArgs:void 0,r=Array.isArray(e.buildSecrets)&&e.buildSecrets.length>0?e.buildSecrets:void 0,o={path:e.path,...t!==void 0&&{context:t},...n!==void 0&&{target:n},...i!==void 0&&{buildArgs:i},...r!==void 0&&{buildSecrets:r}},a=It.safeParse(o);return a.success?a.data:void 0}sl(SI,"normaliseDockerBuild");function tw(e){if(e===void 0)return;let t=SI(e);return t===void 0?void 0:JSON.stringify(t)}sl(tw,"dockerBuildFingerprint");var rw=s.object({name:s.string(),clusterName:s.string().optional(),docker:It.optional(),containerPort:s.number().optional(),secrets:s.array(s.string()).optional(),ssmSecretsPath:s.string().optional(),importedSecretNames:s.array(s.string()).optional(),schemaGateImageTag:s.string().optional()}).strict(),nw=s.object({type:s.enum(At),name:s.string(),source:s.string()}).strict(),iw=s.object({repositoryName:s.string()}).strict(),ow=["x86_64","arm64"],aw=s.object({name:s.string(),secrets:s.array(s.string()).optional(),ssmSecretsPath:s.string().optional(),importedSecretNames:s.array(s.string()).optional(),docker:It.optional(),imageKey:s.string().optional(),architecture:s.enum(ow).optional()}).strict(),sw=s.object({templateHash:s.string(),synthTimestamp:s.string()}).strict(),cw=s.object({constructPath:s.string().max(512),group:s.string().max(128),resourceType:s.string().max(256)}).strict(),lw=s.object({synthesisedBy:s.string().min(1).max(128),minimumEngineVersion:s.string().min(1).max(32),maximumEngineMajor:s.number().int().min(0).optional(),minimumAwsCdkCli:s.string().min(1).max(32).optional()}).strict(),uw=s.object({appName:s.string().min(1).max(128),slot:s.string().min(1).max(64),clusterName:s.string().min(1).max(128),anchor:s.string().min(1).max(128),pinned:s.boolean(),currentServiceName:s.string().min(1).max(256),legacyKey:s.string().min(1).max(256),legacyAnchor:s.string().min(1).max(256),legacyServiceName:s.string().min(1).max(512),legacyKeyFields:s.array(s.string().max(64)).max(32)}).strict(),dw=s.object({constructPath:s.string().min(1).max(512),resourceType:s.string().min(1).max(256),physicalNameHint:s.string().min(1).max(512),policy:s.enum(["retain","snapshot","adopted"]),destroyDisposition:s.enum(["survives","deleted-on-explicit-destroy"]),reason:s.string().min(1).max(1024),costClass:s.enum(["none","storage","fixed-monthly"]),cleanupHint:s.string().min(1).max(1024)}).strict(),OV=s.object({version:s.literal(XD),generatedAt:s.string(),appName:s.string(),services:s.array(rw),lambdas:s.array(aw),pattern:nw.optional(),ecr:iw.optional(),stacks:s.record(s.string(),sw),resourceMap:s.record(s.string(),cw).optional(),engineCompat:lw.optional(),identityAliases:s.array(uw).optional(),residuals:s.array(dw).optional()}).strict();var mw=Object.defineProperty,pw=(e,t)=>mw(e,"name",{value:t,configurable:!0});function _I(e){return!(e.image!==void 0&&e.docker!==void 0)}pw(_I,"imageDockerMutexCheck");var AI=s.number().int(m.CAPACITY.MIN.INTEGER).min(fh,m.GENERATOR_CAPACITY.MIN.MIN).max(gh,m.GENERATOR_CAPACITY.MIN.MAX),II=s.number().int(m.CAPACITY.MAX.INTEGER).min(fh,m.GENERATOR_CAPACITY.MAX.MIN).max(gh,m.GENERATOR_CAPACITY.MAX.MAX),pi=s.number().int(m.LAMBDA.MEMORY.INTEGER).min(zA,m.LAMBDA.MEMORY.MIN).max(LA,m.LAMBDA.MEMORY.MAX).refine(e=>e===128||e%64===0,m.LAMBDA.MEMORY.MULTIPLE),xI=s.string().regex(z.LAMBDA_RUNTIME_IDENTIFIER,m.LAMBDA.RUNTIME),xh=s.number().int(m.CPU.INTEGER).min(256,m.CPU.MIN).max(4096,m.CPU.MAX),ll=s.number().int(m.CAPACITY.DESIRED.INTEGER).min(0,m.CAPACITY.DESIRED.MIN).max(li,m.CAPACITY.DESIRED.MAX),Zo=s.object({connectToDatabase:s.array(s.string()).optional()}).strict(),fw=s.object({minSize:s.number().int(m.CAPACITY.WARM_POOL.MIN_SIZE.INTEGER).min(0,m.CAPACITY.WARM_POOL.MIN_SIZE.MIN).max(UA,m.CAPACITY.WARM_POOL.MIN_SIZE.MAX).optional(),reuseOnScaleIn:s.boolean().optional()}).strict(),$h=s.object({instanceType:s.string().optional(),amiHardwareType:s.enum(Bc).optional(),minCapacity:s.number().int(m.CAPACITY.MIN.INTEGER).min(0,m.CAPACITY.MIN.MIN_0).max(li,m.CAPACITY.MIN.MAX).optional(),maxCapacity:s.number().int(m.CAPACITY.MAX.INTEGER).min(1,m.CAPACITY.MAX.MIN_1).max(li,m.CAPACITY.MAX.MAX).optional(),memoryLimitMiB:zo(128).optional(),warmPool:fw.optional(),extraProperties:s.array(_e).optional()}).strict().superRefine((e,t)=>{if(!e.instanceType||!e.amiHardwareType)return;let n=al(e.instanceType,e.amiHardwareType);n.valid||t.addIssue({code:"custom",message:n.message??m.ARCHITECTURE_MISMATCH,path:["instanceType"]})}).superRefine((e,t)=>{e.minCapacity===0&&!e.warmPool&&t.addIssue({code:"custom",message:m.CAPACITY.WARM_POOL_REQUIRED,path:["minCapacity"]}),e.warmPool?.minSize!==void 0&&e.maxCapacity!==void 0&&e.warmPool.minSize>e.maxCapacity&&t.addIssue({code:"custom",message:m.CAPACITY.WARM_POOL.MIN_SIZE_EXCEEDS_MAX_CAPACITY,path:["warmPool","minSize"]})}),gw=s.enum(Oo).describe(`Compute type must be one of: ${Oo.join(", ")}`),Th=s.enum(ai).describe(`ECS capacity provider must be one of: ${ai.join(", ")}`),Rh=s.string().refine(e=>rt(Gc,e),{message:m.INSTANCE_TYPE}),$I=s.object({sourceType:s.enum(["sqs","dynamodb","eventbridge"]),sourceRef:s.string().describe("Name of the source resource"),batchSize:s.number().int(m.BATCH_SIZE.INTEGER).min(1,m.BATCH_SIZE.MIN).max(1e4,m.BATCH_SIZE.MAX).optional(),startingPosition:s.enum(["TRIM_HORIZON","LATEST"]).optional(),maxBatchingWindow:s.number().int(m.BATCHING_WINDOW.INTEGER).min(0,m.BATCHING_WINDOW.MIN).max(300,m.BATCHING_WINDOW.MAX).optional(),reportBatchItemFailures:s.boolean().optional()}).strict(),hw=s.object({name:s.string().min(1,m.REQUIRED.CONTAINER_NAME).optional(),image:s.string().optional(),port:Fr.optional(),environment:di.optional(),secretsImport:KA.optional(),command:s.array(s.string()).optional(),entryPoint:s.array(s.string()).optional(),essential:s.boolean().optional(),healthCheck:s.object({command:s.array(s.string()),interval:s.number().int(m.HEALTH_CHECK.INTERVAL.INTEGER).min(5,m.HEALTH_CHECK.INTERVAL.MIN).max(300,m.HEALTH_CHECK.INTERVAL.MAX).optional(),timeout:s.number().int(m.HEALTH_CHECK.TIMEOUT.INTEGER).min(2,m.HEALTH_CHECK.TIMEOUT.MIN).max(60,m.HEALTH_CHECK.TIMEOUT.MAX).optional(),retries:s.number().int(m.HEALTH_CHECK.RETRIES.INTEGER).min(1,m.HEALTH_CHECK.RETRIES.MIN).max(10,m.HEALTH_CHECK.RETRIES.MAX).optional(),startPeriod:s.number().int(m.HEALTH_CHECK.START_PERIOD.INTEGER).min(0,m.HEALTH_CHECK.START_PERIOD.MIN).max(300,m.HEALTH_CHECK.START_PERIOD.MAX).optional()}).strict().optional(),ssmSecrets:s.array(s.string().regex(z.SECRET_NAME,m.SECRET_NAME)).optional(),extraProperties:s.array(_e).optional()}).strict(),TI=s.string().min(1,m.REQUIRED.SERVICE_NAME).max(255,m.MAX_LENGTH.SERVICE_NAME).regex(z.ECS_SERVICE_NAME,m.ECS_SERVICE_NAME),RI=s.object({domain:s.string().optional(),loadBalancer:s.union([s.literal(!1),s.enum(Vc)]).optional(),directAccess:s.boolean().optional(),extraProperties:s.array(_e).optional()}).strict().refine(e=>!(e.directAccess&&e.domain),{message:m.DIRECT_ACCESS.NO_DOMAIN,path:["directAccess"]}).refine(e=>!(e.directAccess&&typeof e.loadBalancer=="string"),{message:m.DIRECT_ACCESS.NO_LOAD_BALANCER}).describe("Cluster-level configuration"),cl=s.object({path:s.string().optional(),host:s.string().optional(),priority:s.number().int(m.PRIORITY.INTEGER).min(1,m.PRIORITY.MIN).max(5e4,m.PRIORITY.MAX).optional(),healthCheckPath:s.string().optional()}).strict().describe("Path/host-based routing configuration"),vw=s.object({desiredCount:ll.optional(),minCapacity:s.number().int(m.CAPACITY.MIN.INTEGER).min(0,m.CAPACITY.MIN.MIN_0).max(li,m.CAPACITY.MIN.MAX).optional(),maxCapacity:s.number().int(m.CAPACITY.MAX.INTEGER).min(1,m.CAPACITY.MAX.MIN_1).max(li,m.CAPACITY.MAX.MAX).optional(),scalingType:s.enum(Zc).optional()}).strict().refine(Ur.check,Ur.params).describe("ECS service scaling configuration"),NI=s.object({name:TI,docker:It.optional(),needsDatabaseConnection:s.boolean().optional(),needsStorageConnection:s.boolean().optional(),needsMessagingConnection:s.boolean().optional(),image:s.string().optional(),containers:s.array(hw).optional(),routing:s.union([cl,s.array(cl).min(1)]).optional(),serviceType:s.enum(jo).optional(),cpu:xh.optional(),memoryLimitMiB:zo(512).optional(),desiredCount:ll.optional(),scaling:Fe(vw).optional(),capacityProvider:Th,ec2Config:$h.optional(),ssmSecretsPath:s.string().regex(z.SSM_PATH,m.SSM_PATH).optional(),extraProperties:s.array(_e).optional(),alarms:JA.optional()}).strict().superRefine((e,t)=>{_I(e)||t.addIssue({code:"custom",path:["docker"],message:m.IMAGE_DOCKER_MUTEX})}).describe("Configuration for a service in an ECS cluster"),kI=s.object({name:F,type:gw,needsConnection:s.boolean(),connectedDatabase:s.array(s.string()).optional(),connectedStorage:s.array(s.string()).optional(),connectedMessaging:s.array(s.string()).optional(),cluster:RI.optional(),services:s.array(NI).optional(),docker:It.partial().optional(),deployment:s.enum(Uc).optional(),codePath:s.string().optional(),timeout:s.number().int(m.LAMBDA.TIMEOUT.INTEGER).min(Wc,m.LAMBDA.TIMEOUT.MIN).max(Kc,m.LAMBDA.TIMEOUT.MAX).optional(),memory:pi.optional(),handler:s.string().optional(),runtime:xI.optional(),environment:di.optional(),secrets:di.optional(),eventSources:s.array($I).optional(),functionUrl:s.object({authType:s.enum(wo)}).strict().optional(),description:s.string().optional(),scheduleExpression:s.string().optional(),architecture:s.enum(Fc).optional(),ephemeralStorageSize:s.number().int(m.EPHEMERAL_STORAGE.INTEGER).min(512,m.EPHEMERAL_STORAGE.MIN).max(10240,m.EPHEMERAL_STORAGE.MAX).optional(),functionName:s.string().optional(),ssmSecrets:s.array(s.string()).optional(),ssmSecretsPath:s.string().optional(),alarms:QA.optional(),instanceType:Rh.optional(),enableSSH:s.boolean().optional(),keyName:s.string().optional(),userData:s.string().optional(),securityGroups:s.array(s.string()).optional(),variableName:s.string().optional(),extraProperties:s.array(_e).optional()}).strict().superRefine((e,t)=>{if(e.type==="ecs"&&e.services)for(let n=0;n<e.services.length;n++){let i=e.services[n];i?.ec2Config?.instanceType&&!i.ec2Config.amiHardwareType&&mi(i.ec2Config.instanceType)!=="ARM"&&t.addIssue({code:"custom",message:`Service '${i.name??n}' uses instance type '${i.ec2Config.instanceType}' (x86), which requires Docker images built for linux/amd64. The default build targets linux/arm64 (Graviton). Use a Graviton instance type (t4g, c6g, r6g, m6g, etc.) or set amiHardwareType: "STANDARD" to acknowledge x86.`,path:["services",n,"ec2Config","instanceType"]})}e.type==="lambda"&&e.deployment==="container"&&e.architecture==="X86_64"&&t.addIssue({code:"custom",message:"Lambda architecture 'X86_64' requires Docker images built for linux/amd64, but the default build targets linux/arm64. Use 'ARM_64' for Graviton Lambdas (recommended) or ensure your build pipeline targets linux/amd64.",path:["architecture"]})}),VV=s.object({appName:pe,clusterName:F,containerPort:Fr,nameProvidedByFlag:s.boolean().optional(),ecrRepository:s.string().optional(),capacityProvider:Th.optional(),useAppEcr:s.boolean().optional(),desiredCount:ll.optional(),cpu:xh.optional(),memoryLimitMiB:zo(512).optional(),minCapacity:AI.optional(),maxCapacity:II.optional(),ec2Config:$h.optional(),connectionConfig:Zo.optional()}).strict().refine(Ur.check,Ur.params),ZV=s.object({appName:pe,functionName:F,nameProvidedByFlag:s.boolean().optional(),lambdaType:s.enum(["basic","web","custom"]).optional(),ecrRepository:s.string().optional(),timeout:s.number().int(m.LAMBDA.TIMEOUT.INTEGER).min(Wc,m.LAMBDA.TIMEOUT.MIN).max(Kc,m.LAMBDA.TIMEOUT.MAX).optional(),memory:pi.optional(),enableFunctionUrl:s.boolean().optional(),description:s.string().optional(),enableCors:s.boolean().optional(),corsOrigins:s.string().optional(),corsHeaders:s.string().optional(),corsMethods:s.array(s.enum(VA)).optional(),corsCredentials:s.boolean().optional(),connectionConfig:Zo.optional()}).strict(),BV=s.object({appName:pe,instanceName:F,nameProvidedByFlag:s.boolean().optional(),instanceType:Rh.optional(),enableSSH:s.boolean().optional(),minCapacity:AI.optional(),maxCapacity:II.optional(),connectionConfig:Zo.optional()}).strict().refine(Ur.check,Ur.params),PI=s.object({appName:pe,clusterName:F,serviceName:TI,capacityProvider:Th,containerPort:Fr.optional(),cpu:xh.optional(),memoryLimitMiB:zo(512).optional(),desiredCount:ll.optional(),ec2Config:$h.optional(),routing:s.union([cl,s.array(cl).min(1)]).optional(),docker:It.partial().optional(),nameProvidedByFlag:s.boolean().optional(),connectionConfig:Zo.optional()}).strict(),Nh=s.object({appName:pe,computeName:F,nameProvidedByFlag:s.boolean().optional(),connectionConfig:Zo.optional()}).strict(),yw=Nh.extend({type:s.literal("ecs"),cluster:RI.optional(),services:s.array(NI).min(1,m.SERVICE.MIN_REQUIRED),docker:It.partial().optional()}).strict().refine(e=>{let t=e.services.filter(n=>n.containers?.some(i=>i.port));return t.length>1?t.every(n=>(Array.isArray(n.routing)?n.routing:n.routing?[n.routing]:[]).some(i=>i.path||i.host)):!0},{message:m.SERVICE.ROUTING_REQUIRED}).refine(e=>{let t=e.services.map(n=>n.name);return new Set(t).size===t.length},{message:m.SERVICE.UNIQUE_WITHIN_CLUSTER}),bw=Nh.extend({type:s.literal("lambda"),timeout:s.number().int(m.LAMBDA.TIMEOUT.INTEGER).min(Wc,m.LAMBDA.TIMEOUT.MIN).max(Kc,m.LAMBDA.TIMEOUT.MAX).optional(),memory:pi.optional(),handler:s.string().optional(),runtime:xI.optional(),environment:di.optional(),secrets:di.optional(),description:s.string().optional(),functionUrl:s.union([s.object({authType:s.enum(wo).optional()}).strict(),s.literal(!1)]).optional(),eventSources:s.array($I).optional()}).strict(),Sw=Nh.extend({type:s.literal("ec2"),instanceType:Rh.optional(),enableSSH:s.boolean().optional(),keyName:s.string().optional(),userData:s.string().optional(),securityGroups:s.array(s.string()).optional()}).strict(),GV=s.discriminatedUnion("type",[yw,bw,Sw]),EI=s.object({path:s.string().min(1,m.REQUIRED.ROUTING_PATH),priority:s.number().int(m.PRIORITY.INTEGER).min(1,m.PRIORITY.MIN).max(5e4,m.PRIORITY.MAX).optional()}).strict(),CI=s.object({name:s.string().min(1,m.REQUIRED.SERVICE_NAME).max(255,m.MAX_LENGTH.SERVICE_NAME).regex(z.RESOURCE_NAME,m.RESOURCE_NAME),serviceType:s.enum(jo).optional(),docker:It.partial().optional(),containerPort:Fr.optional(),needsDatabaseConnection:s.boolean().optional(),routing:s.union([EI,s.array(EI).min(1)]).optional()}).strict().superRefine((e,t)=>{e.serviceType==="worker"&&(e.containerPort!==void 0&&t.addIssue({code:"custom",path:["containerPort"],message:"Worker services are not reachable inbound; remove containerPort."}),e.routing!==void 0&&t.addIssue({code:"custom",path:["routing"],message:"Worker services have no ALB route; remove routing."}))}),WV=s.object({appName:pe,instanceType:s.string().optional()}).strict();var kh=s.object({memorySize:pi.optional(),timeout:s.number().int(m.LAMBDA.TIMEOUT.INTEGER).min(1,m.LAMBDA.TIMEOUT.MIN).max(900,m.LAMBDA.TIMEOUT.MAX).optional(),ephemeralStorageSize:s.number().int(m.EPHEMERAL_STORAGE.INTEGER).min(512,m.EPHEMERAL_STORAGE.MIN).max(10240,m.EPHEMERAL_STORAGE.MAX).optional()}).strict(),OI=s.object({type:s.enum(ph).optional(),databaseName:s.string().optional(),databaseEngine:s.enum(ci).optional(),deletionProtection:s.boolean().optional(),backupRetention:zt.optional(),port:Jc.optional(),publiclyAccessible:s.boolean().optional(),allowedIpCidr:s.string().optional(),instanceType:s.string().optional(),allocatedStorage:s.number().int(m.ALLOCATED_STORAGE.INTEGER).min(20,m.ALLOCATED_STORAGE.MIN).max(65536,m.ALLOCATED_STORAGE.MAX).optional(),multiAz:s.boolean().optional(),readReplica:el.optional(),writer:Fo.optional(),readers:Vo.optional(),allowVpcAccess:s.boolean().optional(),monitoringInterval:Uo.optional(),preferredMaintenanceWindow:s.string().optional(),databaseInsights:tl.optional(),proxy:Qc.optional(),credentials:qc.optional(),encryption:rl.optional(),snapshotIdentifier:s.string().optional(),snapshotUsername:s.string().optional()}).strict(),DI=s.object({server:kh.optional(),imageOptimisation:kh.optional(),revalidation:kh.optional()}).strict(),Ph=s.object({versioned:s.boolean().optional()}).strict(),wI=s.object({assets:Ph.optional(),cache:Ph.optional(),media:Ph.optional()}).strict(),Ew=s.object({visibilityTimeout:s.number().int(m.SQS.VISIBILITY_TIMEOUT.INTEGER).min(0,m.SQS.VISIBILITY_TIMEOUT.MIN).max(43200,m.SQS.VISIBILITY_TIMEOUT.MAX).optional(),messageRetentionPeriod:s.number().int(m.SQS.RETENTION_PERIOD.INTEGER).min(60,m.SQS.RETENTION_PERIOD.MIN).max(1209600,m.SQS.RETENTION_PERIOD.MAX).optional(),maxMessageSize:s.number().int(m.MAX_MESSAGE_SIZE.INTEGER).min(1024,m.MAX_MESSAGE_SIZE.MIN).max(262144,m.MAX_MESSAGE_SIZE.MAX).optional(),deadLetterQueue:s.union([s.literal(!1),s.object({enabled:s.boolean().optional(),maxReceiveCount:s.number().int(m.DLQ.MAX_RECEIVE_COUNT.INTEGER).min(1,m.DLQ.MAX_RECEIVE_COUNT.MIN).max(1e3,m.DLQ.MAX_RECEIVE_COUNT.MAX).optional()}).strict()]).optional()}).strict(),jI=s.object({revalidationQueue:Ew.optional()}).strict(),MI=s.object({domainNames:s.array(s.string()).optional(),certificateArn:s.string().optional()}).strict(),zI=s.record(s.string().regex(z.ENV_VAR_NAME,m.ENV_VAR_NAME),s.string()).optional(),_w=s.object({type:s.literal("payload"),name:s.string().min(1,m.REQUIRED.PATTERN_NAME),domain:s.string().optional(),database:OI.optional(),compute:DI.optional(),storage:wI.optional(),messaging:jI.optional(),cdn:MI.optional(),environment:zI}).strict(),Aw=s.object({type:s.literal("nextjs"),name:s.string().min(1,m.REQUIRED.PATTERN_NAME),domain:s.string().optional(),database:OI.optional(),compute:DI.optional(),storage:wI.optional(),messaging:jI.optional(),cdn:MI.optional(),environment:zI}).strict(),Ch=s.enum(Po),Iw=s.object({command:s.string().min(1,m.REQUIRED.BUILD_COMMAND),outputDir:s.string().min(1,m.REQUIRED.OUTPUT_DIR)}).strict(),xw=s.object({headers:s.boolean().optional(),contentSecurityPolicy:s.string().optional()}).strict(),$w=s.object({to:s.string().min(1,m.REQUIRED.FORMS_TO).regex(z.EMAIL,m.EMAIL),from:s.string().regex(z.EMAIL,m.EMAIL).optional(),corsOrigin:s.string().regex(z.HTTP_ORIGIN,"corsOrigin must be an exact origin such as https://example.com (no path, no trailing slash)").optional(),maxConcurrency:s.number().int().min(1).max(100).optional()}).strict(),Tw=s.object({behaviours:s.array(s.unknown()).optional()}).strict(),Oh=s.object({type:s.literal("staticsite"),name:s.string().min(1,m.REQUIRED.PATTERN_NAME),source:s.string().min(1,m.REQUIRED.SOURCE),build:Iw,routing:Ch.optional(),security:xw.optional(),domain:s.string().optional(),forms:$w.optional(),cdn:Tw.optional()}).strict().superRefine((e,t)=>{if(e.forms===void 0)return;let n=e.domain;if(n===void 0||n===""){t.addIssue({code:"custom",path:["domain"],message:"A domain is required when forms are enabled: SES sends only from a verified identity, and the site's domain is the identity the pattern verifies"});return}let i=e.forms.from;i!==void 0&&!Dc(i,n)&&t.addIssue({code:"custom",path:["forms","from"],message:`forms.from must be an address at ${n} (the verified SES identity) \u2014 for example noreply@${n}. Use forms.to for the recipient.`})}),Bo=s.discriminatedUnion("type",[_w,Aw,Oh]),LI=s.enum(["lightweight","standard","resilient","custom"]),UI=s.object({type:s.enum(ph),instanceType:s.string().optional(),backupRetention:zt.optional(),deletionProtection:s.boolean().optional(),encryption:s.union([s.object({useCMK:s.literal(!0)}).strict(),s.literal(!1)]).optional()}).strict(),FI=s.object({memorySize:pi.optional(),timeout:s.number().int(m.LAMBDA.TIMEOUT.INTEGER).min(1,m.LAMBDA.TIMEOUT.MIN).max(900,m.LAMBDA.TIMEOUT.MAX).optional()}).strict();var VI=s.object({appName:pe,type:hh,pattern:vh.optional(),patternConfig:Bo.optional(),owner:s.string().optional(),tags:s.record(s.string(),s.string()).optional(),vpcId:s.string().optional(),network:il.optional(),backup:YA.optional(),tunnel:XA.optional(),additionalNetworks:s.array(pI).optional(),database:s.array(tI),s3:s.array(gI),compute:s.array(kI),dynamodb:s.array(sI).optional(),clickhouse:s.array(cI).optional(),sqs:s.array(hI).optional(),cdn:yI.optional(),customCodeBlocks:s.array(HA).optional(),additionalManagedImports:s.array(s.object({moduleSpecifier:s.string(),namedImports:s.array(s.string()),defaultImport:s.string().optional()}).strict()).optional()}).strict(),mZ=s.object({name:pe,type:hh,pattern:vh.optional(),patternTier:LI.optional(),patternDomain:s.string().optional(),source:s.string().min(1,m.REQUIRED.SOURCE).optional(),buildCommand:s.string().min(1,m.REQUIRED.BUILD_COMMAND).optional(),outputDir:s.string().min(1,m.REQUIRED.OUTPUT_DIR).optional(),routing:Ch.optional(),formsTo:s.string().min(1,m.REQUIRED.FORMS_TO).regex(z.EMAIL,m.EMAIL).optional(),corsOrigin:s.string().regex(z.HTTP_ORIGIN,"corsOrigin must be an exact origin such as https://example.com (no path, no trailing slash)").optional(),customDatabase:UI.optional(),customCompute:FI.optional(),region:s.string().optional(),owner:s.string().optional(),includeDatabase:s.boolean().optional(),databaseName:s.string().min(1,m.DATABASE.NAME.REQUIRED).max(63,m.DATABASE.NAME.MAX_LENGTH).optional(),vpcId:s.string().optional(),network:fI.optional(),services:s.array(CI).optional(),snapshotIdentifier:s.string().optional(),snapshotUsername:s.string().optional()}).strict().superRefine((e,t)=>{e.formsTo!==void 0&&(e.patternDomain!==void 0&&e.patternDomain!==""||t.addIssue({code:"custom",path:["patternDomain"],message:"A domain is required when forms are enabled: SES sends only from a verified identity, and the site's domain is the identity the pattern verifies"}))}),pZ=s.object({name:F,localResource:s.string().min(1),remoteApp:s.string().min(1),remoteResource:s.string().min(1),permission:s.enum(["read","write","read-write"]),remoteArn:s.string().optional()}).strict();var Rw=["fjall-managed","external","external-manual"],yZ=s.enum(Rw);var ZI=s.object({givenName:s.string().min(1),familyName:s.string().min(1),displayName:s.string().min(1).optional(),expires:s.string().min(1).optional()}).strict(),BI=s.object({name:s.string().min(1),path:s.string().min(1).optional()}).strict(),Nw=s.union([s.object({managedPolicyArn:s.string().min(1)}).strict(),s.object({customerManagedPolicy:BI}).strict()]),kw=s.object({managedPolicies:s.array(s.string().min(1)).optional(),inlinePolicy:s.record(s.string(),s.unknown()).optional(),customerManagedPolicies:s.array(BI).optional(),permissionsBoundary:Nw.optional(),sessionDuration:s.string().min(1).optional(),description:s.string().optional(),accounts:s.union([s.array(s.string().min(1)),s.literal("all")]).optional(),includeManagementAccount:s.boolean().optional(),groups:s.array(s.string().min(1)).optional()}).strict(),Pw=s.object({description:s.string().optional()}).strict(),ul=s.string().regex(z.EMAIL,m.EMAIL),Dh={groups:s.record(s.string(),Pw).optional(),permissionSets:s.record(s.string(),kw).optional(),memberships:s.record(s.string(),s.array(ul)).optional(),resolutionVersion:s.number().int().min(1).optional(),defaultPermissionSets:s.boolean().optional()},Cw=s.discriminatedUnion("source",[s.object({...Dh,source:s.literal("fjall-managed"),users:s.record(ul,ZI)}).strict(),s.object({...Dh,source:s.literal("external")}).strict(),s.object({...Dh,source:s.literal("external-manual"),users:s.record(ul,ZI).optional()}).strict()]),bZ=s.object({name:F,type:s.literal("organisation").optional(),organisationName:s.string().min(1).optional(),orgEmail:ul.optional(),accounts:s.unknown().optional(),accountIds:s.record(s.string(),s.string()).optional(),identityCentre:s.union([Cw,s.literal(!1)]).optional(),allowedRegions:s.array(s.string().min(1)).optional()}).strict();var Ow=Object.defineProperty,Dw=(e,t)=>Ow(e,"name",{value:t,configurable:!0}),ww=[1,3,5,7,14,30,60,90,120,150,180,365,400,545,731,1827,3653],jw=s.object({buildkiteQueue:s.string().min(1,"buildkiteQueue cannot be empty").max(100).regex(/^[a-zA-Z0-9-_]+$/,"buildkiteQueue must be alphanumeric with hyphens/underscores"),buildkiteOrgSlug:s.string().min(1,"buildkiteOrgSlug cannot be empty").max(100).regex(/^[a-z0-9-]+$/,"buildkiteOrgSlug must be a lowercase Buildkite organisation slug"),agentTokenSsmParameterName:s.string().min(2).regex(/^\//,"agentTokenSsmParameterName must be a full path (leading /)").optional(),agentTokenKmsKeyArn:s.string().min(1).optional(),fjallApiKeySsmParameterName:s.string().min(2).regex(/^\//,"fjallApiKeySsmParameterName must be a full path (leading /)").optional(),instanceType:s.string().min(1).default("c8g.xlarge"),agentVolumeSizeGib:s.number().int().min(20).max(1e3).default(250),agentMinInstances:s.number().int().min(0).default(0),agentMaxInstances:s.number().int().min(1).default(2),agentsPerInstance:s.number().int().min(1).default(1),spotCapacityPercentage:s.number().int().min(0).max(100).default(0),scaleInIdlePeriodSeconds:s.number().int().min(60).default(600),disconnectAfterUptimeSeconds:s.number().int().min(3600).default(86400),maxInstanceLifetimeDays:s.number().int().min(1).max(365).default(7),terminateInstanceAfterJob:s.boolean().default(!1),purgeBuildsOnDiskFull:s.boolean().default(!0),terminateInstanceOnDiskFull:s.boolean().default(!1),logRetentionDays:s.number().int().min(1).default(30),agentLogRetentionDays:s.literal(ww).default(7),buildkiteAgentRelease:s.enum(["stable","beta","edge"]).default("stable"),buildkiteAgentTags:s.string().default(""),buildkiteAgentTimestampLines:s.boolean().default(!1),buildkiteAgentExperiments:s.string().default(""),buildkiteAgentTracingBackend:s.enum(["","datadog","opentelemetry"]).default(""),buildkiteAgentCancelGracePeriodSeconds:s.number().int().min(10).default(60),enableSecretsPlugin:s.boolean().default(!0),enableEcrPlugin:s.boolean().default(!1),enableDockerLoginPlugin:s.boolean().default(!1),enableDockerUserNamespaceRemap:s.boolean().default(!0),enableDockerExperimental:s.boolean().default(!1),dockerNetworkingProtocol:s.enum(["ipv4","dualstack"]).default("ipv4"),enableInstanceStorage:s.boolean().default(!1),mountTmpfsAtTmp:s.boolean().default(!0),buildkiteAgentEnableGitMirrors:s.boolean().default(!1),bootstrapScriptUrl:s.string().default(""),agentEnvFileUrl:s.string().default(""),scalerEventSchedulePeriod:s.string().min(1).default("1 minute"),scalerMinPollInterval:s.string().min(1).default("10s"),scaleOutFactor:s.string().min(1).default("1.0"),scaleOutWaitingForJobs:s.boolean().default(!1),rolePermissionsBoundaryArn:s.string().min(1).optional(),alarmSnsTopicArn:s.string().min(1).optional(),applicationId:s.string().min(1).optional(),costAllocationEnvironment:s.string().min(1).optional(),costAllocationOwner:s.string().min(1).optional()}).strict(),Mw=jw.refine(e=>e.agentMinInstances<=e.agentMaxInstances,{message:"agentMinInstances must be <= agentMaxInstances"});function zw(e){let t=Mw.safeParse(e);if(!t.success){let n=t.error.issues.map(i=>`  - ${i.path.join(".")||"(root)"}: ${i.message}`).join(`
 `);throw new Error(`Buildkite: invalid props:
 ${n}`)}return t.data}Dw(zw,"validateBuildkiteProps");var Lw=Object.defineProperty,Uw=(e,t)=>Lw(e,"name",{value:t,configurable:!0});function Fw(e){return`FjallDeployBoundary${e}`}Uw(Fw,"deployBoundaryName");var wh={Sid:"FjallInheritAdministratorAccess",Effect:"Allow",Action:"*",Resource:"*"},GI=[{Sid:"FjallDenyOrgAndAccountEscape",Effect:"Deny",Action:["organizations:LeaveOrganization","account:CloseAccount"],Resource:"*"},{Sid:"FjallDenyDisableAuditLogging",Effect:"Deny",Action:["cloudtrail:StopLogging"],Resource:"*"},{Sid:"FjallDenyBoundarySelfEscape",Effect:"Deny",Action:["iam:DeleteRolePermissionsBoundary"],Resource:"*"},{Sid:"FjallDenyDisableKmsKey",Effect:"Deny",Action:["kms:DisableKey"],Resource:"*"}],WI=[...GI,{Sid:"FjallDenyStandingHumanCredentials",Effect:"Deny",Action:["iam:CreateUser","iam:CreateLoginProfile","iam:CreateAccessKey","iam:CreateAccountAlias"],Resource:"*"},{Sid:"FjallDenyDisableConfigRecorder",Effect:"Deny",Action:["config:StopConfigurationRecorder"],Resource:"*"}],Vw=[...WI,{Sid:"FjallDenyAccountPasswordPolicyTamper",Effect:"Deny",Action:["iam:UpdateAccountPasswordPolicy","iam:DeleteAccountPasswordPolicy"],Resource:"*"},{Sid:"FjallDenyDisableDefaultEbsEncryption",Effect:"Deny",Action:["ec2:DisableEbsEncryptionByDefault"],Resource:"*"}],wZ={foundation:[wh,...GI],compliance:[wh,...WI],hardened:[wh,...Vw]};var Zw=Object.defineProperty,fe=(e,t)=>Zw(e,"name",{value:t,configurable:!0});var zh="sts.amazonaws.com";function Bw(e){return`FjallDevDeploy${e}`}fe(Bw,"devDeployRoleName");function Gw(e){return`FjallDevProvisioner${e}`}fe(Gw,"devProvisionerRoleName");function Ww(e){return`FjallDevSyncWriter${e}`}fe(Ww,"devSyncWriterRoleName");var Kw="FjallDevBoundary";function KI(e){return`arn:aws:iam::${e}:policy/${Kw}`}fe(KI,"devBoundaryPolicyArn");function HI(e){return`org:${e}:dev-provisioner`}fe(HI,"devProvisionerSubject");function YI(e){return`org:${e}:dev-sync`}fe(YI,"devSyncSubject");function jh(e,t){return`org:${e}:acct:${t}`}fe(jh,"deployAccountSubject");function Mh(e){return`org:${e}:*`}fe(Mh,"genericMachineSubject");var Hw=["discovery","connection","org-setup","dev-substrate-setup"];function XI(e,t){return`org:${e}:${t}`}fe(XI,"serviceSubject");function Yw(e){let{fjallOrgId:t,providerArn:n,issuerDomain:i,accountTier:r,accountId:o}=e,a=e.machineTrustMode??"expanded",c={[`${i}:aud`]:zh},l;if(a==="account-scoped"){if(r===void 0||!Rc(r)||o===void 0)throw new Error(`machineTrustMode "account-scoped" requires a governance accountTier and an accountId (got tier: ${String(r)}, accountId ${o===void 0?"absent":"present"}) \u2014 refusing to fall back to the generic machine subject: a silent fallback would re-widen the trust the \xA74.4a Step-3 contract removes`);l=[jh(t,o)]}else o!==void 0?l=[Mh(t),jh(t,o)]:l=Mh(t);return[{Sid:"FjallMachineSubject",Effect:"Allow",Principal:{Federated:n},Action:"sts:AssumeRoleWithWebIdentity",Condition:{StringEquals:{...c,[`${i}:sub`]:l}}},{Sid:"FjallUserSubjects",Effect:"Allow",Principal:{Federated:n},Action:"sts:AssumeRoleWithWebIdentity",Condition:{StringEquals:c,StringLike:{[`${i}:sub`]:`org:${t}:user:*`}}},{Sid:"FjallServiceSubjects",Effect:"Allow",Principal:{Federated:n},Action:"sts:AssumeRoleWithWebIdentity",Condition:{StringEquals:{...c,[`${i}:sub`]:Hw.map(u=>XI(t,u))}}}]}fe(Yw,"buildNarrowedDeployTrustStatements");function Xw(e){let{fjallOrgId:t,providerArn:n,issuerDomain:i,accountId:r}=e;return[{Sid:"FjallDevSubjectsThisAccount",Effect:"Allow",Principal:{Federated:n},Action:"sts:AssumeRoleWithWebIdentity",Condition:{StringEquals:{[`${i}:aud`]:zh},StringLike:{[`${i}:sub`]:`org:${t}:dev:${r}:*`}}}]}fe(Xw,"buildDevDeployTrustStatements");function Lh(e){let{providerArn:t,issuerDomain:n,sid:i,subject:r}=e;return[{Sid:i,Effect:"Allow",Principal:{Federated:t},Action:"sts:AssumeRoleWithWebIdentity",Condition:{StringEquals:{[`${n}:aud`]:zh,[`${n}:sub`]:r}}}]}fe(Lh,"buildServiceSubjectTrustStatements");function Jw(e){return Lh({...e,sid:"FjallDevProvisionerSubject",subject:HI(e.fjallOrgId)})}fe(Jw,"buildDevProvisionerTrustStatements");function qw(e){return Lh({...e,sid:"FjallDevSyncSubject",subject:YI(e.fjallOrgId)})}fe(qw,"buildDevSyncWriterTrustStatements");function Qw({accountId:e}){return[{Sid:"FjallDevEcsTaggedMutations",Effect:"Allow",Action:["ecs:UpdateService","ecs:DeleteService","ecs:RunTask","ecs:StopTask"],Resource:`arn:aws:ecs:*:${e}:*`,Condition:{StringEquals:{"aws:ResourceTag/fjall:dev":"true"}}},{Sid:"FjallDevEcsTaggedCreates",Effect:"Allow",Action:["ecs:RegisterTaskDefinition","ecs:CreateService"],Resource:"*",Condition:{StringEquals:{"aws:RequestTag/fjall:dev":"true"}}},{Sid:"FjallDevEcsTagOnCreate",Effect:"Allow",Action:["ecs:TagResource"],Resource:`arn:aws:ecs:*:${e}:*`,Condition:{StringEquals:{"ecs:CreateAction":["RegisterTaskDefinition","CreateService","RunTask"]}}},{Sid:"FjallDevEcsReads",Effect:"Allow",Action:["ecs:Describe*","ecs:List*"],Resource:"*"},{Sid:"FjallDevEcsDeregisterTaskDefinition",Effect:"Allow",Action:["ecs:DeregisterTaskDefinition"],Resource:`arn:aws:ecs:*:${e}:task-definition/fjall-dev-*`},{Sid:"FjallDevElbTaggedMutations",Effect:"Allow",Action:["elasticloadbalancing:ModifyRule","elasticloadbalancing:DeleteRule","elasticloadbalancing:ModifyTargetGroup","elasticloadbalancing:ModifyTargetGroupAttributes","elasticloadbalancing:DeleteTargetGroup","elasticloadbalancing:RegisterTargets","elasticloadbalancing:DeregisterTargets"],Resource:`arn:aws:elasticloadbalancing:*:${e}:*`,Condition:{StringEquals:{"aws:ResourceTag/fjall:dev":"true"}}},{Sid:"FjallDevElbTaggedCreates",Effect:"Allow",Action:["elasticloadbalancing:CreateTargetGroup","elasticloadbalancing:CreateRule"],Resource:`arn:aws:elasticloadbalancing:*:${e}:*`,Condition:{StringEquals:{"aws:RequestTag/fjall:dev":"true"}}},{Sid:"FjallDevElbTagOnCreate",Effect:"Allow",Action:["elasticloadbalancing:AddTags"],Resource:`arn:aws:elasticloadbalancing:*:${e}:*`,Condition:{StringEquals:{"elasticloadbalancing:CreateAction":["CreateTargetGroup","CreateRule"]}}},{Sid:"FjallDevElbReads",Effect:"Allow",Action:["elasticloadbalancing:Describe*"],Resource:"*"},{Sid:"FjallDevSsmDevTree",Effect:"Allow",Action:["ssm:GetParameter*","ssm:PutParameter","ssm:AddTagsToResource"],Resource:`arn:aws:ssm:*:${e}:parameter/fjall/dev/*`},{Sid:"FjallDevLogsMutations",Effect:"Allow",Action:["logs:PutRetentionPolicy","logs:DeleteLogGroup"],Resource:`arn:aws:logs:*:${e}:log-group:/fjall/dev/*`},{Sid:"FjallDevLogsTaggedCreate",Effect:"Allow",Action:["logs:CreateLogGroup","logs:TagResource"],Resource:`arn:aws:logs:*:${e}:log-group:/fjall/dev/*`,Condition:{StringEquals:{"aws:RequestTag/fjall:dev":"true"}}},{Sid:"FjallDevLogsRead",Effect:"Allow",Action:["logs:GetLogEvents","logs:DescribeLogStreams","logs:FilterLogEvents"],Resource:`arn:aws:logs:*:${e}:log-group:/fjall/dev/*`},{Sid:"FjallDevLogsDescribeGroups",Effect:"Allow",Action:["logs:DescribeLogGroups"],Resource:"*"},{Sid:"FjallDevKmsViaDevAlias",Effect:"Allow",Action:["kms:Encrypt","kms:Decrypt","kms:GenerateDataKey"],Resource:`arn:aws:kms:*:${e}:key/*`,Condition:{"ForAnyValue:StringLike":{"kms:ResourceAliases":"alias/fjall-dev-*"}}},{Sid:"FjallDevKmsSsmSecureString",Effect:"Allow",Action:["kms:Encrypt","kms:Decrypt","kms:GenerateDataKey"],Resource:`arn:aws:kms:*:${e}:key/*`,Condition:{StringLike:{"kms:ViaService":"ssm.*.amazonaws.com"}}},{Sid:"FjallDevEcrAuthToken",Effect:"Allow",Action:["ecr:GetAuthorizationToken"],Resource:"*"},{Sid:"FjallDevEcrPushPull",Effect:"Allow",Action:["ecr:PutImage","ecr:InitiateLayerUpload","ecr:UploadLayerPart","ecr:CompleteLayerUpload","ecr:BatchCheckLayerAvailability","ecr:BatchGetImage","ecr:GetDownloadUrlForLayer","ecr:DescribeImages"],Resource:`arn:aws:ecr:*:${e}:repository/*`},{Sid:"FjallDevPassDevPathRoles",Effect:"Allow",Action:["iam:PassRole"],Resource:`arn:aws:iam::${e}:role/fjall/dev/*`}]}fe(Qw,"buildDevDeployPolicyStatements");function e0({accountId:e}){return[{Sid:"FjallDevProvisionerBoundedRoleWrites",Effect:"Allow",Action:["iam:CreateRole","iam:PutRolePolicy","iam:AttachRolePolicy"],Resource:`arn:aws:iam::${e}:role/fjall/dev/*`,Condition:{StringEquals:{"iam:PermissionsBoundary":KI(e)}}},{Sid:"FjallDevProvisionerPathRoleOps",Effect:"Allow",Action:["iam:DeleteRole","iam:DeleteRolePolicy","iam:DetachRolePolicy","iam:ListRolePolicies","iam:TagRole"],Resource:`arn:aws:iam::${e}:role/fjall/dev/*`},{Sid:"FjallDevProvisionerListRoles",Effect:"Allow",Action:["iam:ListRoles"],Resource:"*"},{Sid:"FjallDevProvisionerDevMasterSecrets",Effect:"Allow",Action:["secretsmanager:GetSecretValue"],Resource:`arn:aws:secretsmanager:*:${e}:secret:fjall-dev-*`},{Sid:"FjallDevProvisionerKmsDecryptViaSecretsManager",Effect:"Allow",Action:["kms:Decrypt"],Resource:`arn:aws:kms:*:${e}:key/*`,Condition:{StringLike:{"kms:ViaService":"secretsmanager.*.amazonaws.com"}}},{Sid:"FjallDevProvisionerDataApi",Effect:"Allow",Action:["rds-data:ExecuteStatement","rds-data:BatchExecuteStatement","rds-data:BeginTransaction","rds-data:CommitTransaction","rds-data:RollbackTransaction"],Resource:`arn:aws:rds:*:${e}:cluster:fjall-dev-*`},{Sid:"FjallDevProvisionerMetrics",Effect:"Allow",Action:["cloudwatch:GetMetricData"],Resource:"*"},{Sid:"FjallDevProvisionerOrphanDiscovery",Effect:"Allow",Action:["tag:GetResources"],Resource:"*"},{Sid:"FjallDevProvisionerSsmTeardown",Effect:"Allow",Action:["ssm:DeleteParameter*"],Resource:`arn:aws:ssm:*:${e}:parameter/fjall/dev/*`},{Sid:"FjallDevProvisionerLogsTeardown",Effect:"Allow",Action:["logs:DeleteLogGroup"],Resource:`arn:aws:logs:*:${e}:log-group:/fjall/dev/*`},{Sid:"FjallDevProvisionerTaggedTeardown",Effect:"Allow",Action:["ecs:UpdateService","ecs:StopTask","ecs:DeleteService","elasticloadbalancing:DeleteRule","elasticloadbalancing:DeleteTargetGroup","elasticloadbalancing:DeregisterTargets"],Resource:[`arn:aws:ecs:*:${e}:*`,`arn:aws:elasticloadbalancing:*:${e}:*`],Condition:{StringEquals:{"aws:ResourceTag/fjall:dev":"true"}}},{Sid:"FjallDevProvisionerTeardownReads",Effect:"Allow",Action:["ecs:Describe*","elasticloadbalancing:Describe*"],Resource:"*"},{Sid:"FjallDevProvisionerImageJanitor",Effect:"Allow",Action:["ecr:ListImages","ecr:DescribeImages","ecr:BatchDeleteImage"],Resource:`arn:aws:ecr:*:${e}:repository/*`},{Sid:"FjallDevProvisionerSsmReadAll",Effect:"Allow",Action:["ssm:GetParameter*"],Resource:`arn:aws:ssm:*:${e}:parameter/*`},{Sid:"FjallDevProvisionerKmsDecryptViaSsm",Effect:"Allow",Action:["kms:Decrypt"],Resource:`arn:aws:kms:*:${e}:key/*`,Condition:{StringLike:{"kms:ViaService":"ssm.*.amazonaws.com"}}}]}fe(e0,"buildDevProvisionerPolicyStatements");function t0({accountId:e}){return[{Sid:"FjallDevSyncPrefixReadWrite",Effect:"Allow",Action:["s3:GetObject","s3:PutObject"],Resource:`arn:aws:s3:::fjall-dev-sync-${e}-*/*`,Condition:{StringEquals:{"aws:ResourceAccount":e}}}]}fe(t0,"buildDevSyncWriterPolicyStatements");function r0({accountId:e}){return[{Sid:"FjallDevBoundarySsmDevRead",Effect:"Allow",Action:["ssm:GetParameter*"],Resource:`arn:aws:ssm:*:${e}:parameter/fjall/dev/*`},{Sid:"FjallDevBoundaryKmsDecryptDevAlias",Effect:"Allow",Action:["kms:Decrypt"],Resource:`arn:aws:kms:*:${e}:key/*`,Condition:{"ForAnyValue:StringLike":{"kms:ResourceAliases":"alias/fjall-dev-*"}}},{Sid:"FjallDevBoundarySyncPrefixReadWrite",Effect:"Allow",Action:["s3:GetObject","s3:PutObject"],Resource:`arn:aws:s3:::fjall-dev-sync-${e}-*/*`,Condition:{StringEquals:{"aws:ResourceAccount":e}}},{Sid:"FjallDevBoundarySlotLogs",Effect:"Allow",Action:["logs:CreateLogStream","logs:PutLogEvents"],Resource:`arn:aws:logs:*:${e}:log-group:/fjall/dev/*`},{Sid:"FjallDevBoundarySyncQueue",Effect:"Allow",Action:["sqs:ReceiveMessage","sqs:DeleteMessage","sqs:GetQueueUrl"],Resource:`arn:aws:sqs:*:${e}:fjall-dev-sync-${e}-*`}]}fe(r0,"buildDevBoundaryStatements");var n0=Object.defineProperty,Ve=(e,t)=>n0(e,"name",{value:t,configurable:!0});function T(e){return JSON.stringify(e)}Ve(T,"escapeStringLiteral");function Vr(e){return e.map(T).join(", ")}Ve(Vr,"formatStringArray");var i0="import:SharedAlarmTopicArn";function Zr(e="    "){return`