fjall 28.1.1 → 28.2.0

package/bin/assets/generators/database/proxy/generator.js

@@ -216,7 +216,7 @@ ${eu.join(`
 `;return _m.appendFileSync(i,`${s}${r.marker}
 ${o.join(`
 `)}
-`,"utf8"),!0}catch{return!1}}YG(Tm,"ensureGitignoreEntries");var tV=Object.defineProperty,Wo=(e,t)=>tV(e,"name",{value:t,configurable:!0});function IA(e){return e.success===!0}Wo(IA,"isSuccess");function DA(e){return e.success===!1}Wo(DA,"isFailure");function G(e){return{success:!0,data:e}}Wo(G,"success");function O(e){return{success:!1,error:e}}Wo(O,"failure");async function kA(e){try{let t=await e();return G(t)}catch(t){return O(Mr(t))}}Wo(kA,"tryAsync");function NA(e){try{let t=e();return G(t)}catch(t){return O(Mr(t))}}Wo(NA,"trySync");var rV=Object.defineProperty,nV=(e,t)=>rV(e,"name",{value:t,configurable:!0}),gP=/^[a-zA-Z][a-zA-Z0-9-]*$/,iV=Hc.source.replace(/^\^|\$$/g,""),he=Object.freeze({IDENTIFIER:gP,NEW_APP_NAME:/^[a-z][a-z0-9-]*$/,RESOURCE_NAME:/^[a-zA-Z][a-zA-Z0-9]*$/,ECS_SERVICE_NAME:gP,BUCKET_NAME:/^[a-z][a-z0-9-]*[a-z0-9]$|^[a-z][a-z0-9]*$/,DATABASE_NAME:/^[a-zA-Z][a-zA-Z0-9_]*$/,RESOURCE_TYPE:/^[a-z]+(:[a-z]+)?$/,SSM_PATH:new RegExp(`^(?:/${iV})+$`),SECRET_NAME:pm,SSM_COMPONENT:Hc,EMAIL:/^[^\s@]+@[^\s@]+\.[^\s@]+$/,DOCKER_IMAGE:/^[a-z0-9][a-z0-9._-]*[a-z0-9](:[a-z0-9._-]+)?$/,DOMAIN:/^[a-z0-9]([a-z0-9-]*[a-z0-9])?(\.[a-z0-9]([a-z0-9-]*[a-z0-9])?)+$/i,HTTP_ORIGIN:/^https?:\/\/[a-z0-9.-]+(:\d+)?$/i,PASCAL_CASE:/^[A-Z][A-Za-z0-9]*$/,AWS_ACCOUNT_ID:/^\d{12}$/,VPC_ID:/^vpc-[a-z0-9]+$/,ROLE_ARN:/^arn:aws[a-zA-Z-]*:iam::\d{12}:role\/.+$/,CIDR:/^((25[0-5]|2[0-4]\d|1\d\d|[1-9]?\d)\.){3}(25[0-5]|2[0-4]\d|1\d\d|[1-9]?\d)\/(3[0-2]|[12]?\d)$/,SCHEDULE_EXPRESSION:/^(rate\(1 (?:minute|hour|day)\)|rate\((?:[2-9]|[1-9]\d+) (?:minutes|hours|days)\)|cron\([^\s()]+ [^\s()]+ [^\s()]+ [^\s()]+ [^\s()]+ [^\s()]+\))$/,LAMBDA_RUNTIME_IDENTIFIER:/^[A-Za-z0-9._-]+$/,ENV_VAR_NAME:/^[A-Za-z_][A-Za-z0-9_]*$/});function wA(e){let t=/^rate\((\d+) (minute|minutes|hour|hours|day|days)\)$/.exec(e);if(!t)return;let r=t[1],i=t[2];if(r===void 0||i===void 0)return;let n=parseInt(r,10);if(!Number.isFinite(n)||n<1)return;let a=i==="minute"||i==="hour"||i==="day";if(!(a&&n!==1)&&!(!a&&n===1))return i==="minute"||i==="minutes"?{everyMs:n*6e4}:i==="hour"||i==="hours"?{everyMs:n*60*6e4}:{everyMs:n*24*60*6e4}}nV(wA,"parseRateExpression");var yP=["t4g.medium","m7g.medium","m8g.medium","r7g.medium","r8g.medium","m7g.large","m8g.large","r7g.large","r8g.large","m7g.xlarge","m8g.xlarge","r7g.xlarge","r8g.xlarge"];var E=Object.freeze({IDENTIFIER:"Must start with a letter, contain only letters, numbers, and hyphens",NEW_APP_NAME:"Must start with a lowercase letter and contain only lowercase letters, numbers, and hyphens",IDENTIFIER_MIN_LENGTH:"Must be at least 2 characters",IDENTIFIER_NO_TRAILING_HYPHEN:"Must not end with a hyphen",IDENTIFIER_NO_CONSECUTIVE_HYPHENS:"Must not contain consecutive hyphens",RESOURCE_NAME:"Must start with a letter and contain only letters and numbers (PascalCase recommended)",ECS_SERVICE_NAME:"Service name must start with a letter and contain only letters, numbers, and hyphens",BUCKET_NAME:"Bucket name must start with a lowercase letter and contain only lowercase letters, numbers, and hyphens",DATABASE_NAME:"Database name must start with a letter and contain only letters, numbers, and underscores",RESOURCE_TYPE:"Resource type must be in format 'category' or 'category:type'",SSM_PATH:"SSM path must start with / and contain valid namespace segments (e.g., /myapp/ApiCluster/service)",SECRET_NAME:KE,SSM_COMPONENT:mm,EMAIL:"Please enter a valid email address",DOMAIN:"Please enter a valid domain (e.g., cms.example.com)",DOCKER_IMAGE:"Invalid Docker image name format",REQUIRED:{APP_NAME:"Application name is required",RESOURCE_NAME:"Resource name is required",BUCKET_NAME:"Bucket name is required",SERVICE_NAME:"Service name is required",NETWORK_NAME:"Network name is required",DATABASE_NAME:"Database name is required",ORGANISATION_NAME:"Organisation name is required",EMAIL:"Email is required",NAME:"Name is required",USERNAME:"Username is required",CONTAINER_NAME:"Container name is required",GROUP:"Group is required",PATTERN_NAME:"Pattern name is required",SOURCE:"Source directory is required",BUILD_COMMAND:"Build command is required",OUTPUT_DIR:"Output directory is required",FORMS_TO:"Forms recipient address is required",ROUTING_PATH:"Routing path is required",RESOURCE_REFERENCE:"Resource reference is required",RESOURCE_TYPE:"Resource type is required",VARIANT:"Variant is required",SUBTYPE:"Subtype is required",DEPLOY_TARGET:"Deploy target is required",DESTROY_TARGET:"Destroy target is required",CONNECTED_RESOURCE_NAME:"Connected resource names must not be empty"},MAX_LENGTH:{APP_NAME:"Application name must be 50 characters or less",RESOURCE_NAME:"Resource name must be 63 characters or less",BUCKET_NAME:"Bucket name must be 63 characters or less",SERVICE_NAME:"Service name must be 255 characters or less",NETWORK_NAME:"Network name must be 50 characters or less",DATABASE_NAME:"Database name must be 63 characters or less",ORGANISATION_NAME:"Organisation name must be 50 characters or less"},PORT:{INTEGER:"Port must be an integer",MIN:"Port must be at least 1",MAX:"Port cannot exceed 65535"},USERNAME:{MAX_LENGTH:"Username cannot exceed 63 characters"},LAMBDA:{MEMORY:{INTEGER:"Lambda memory must be an integer",MIN:"Memory must be at least 128 MB",MAX:"Memory cannot exceed 10240 MB",MULTIPLE:"Memory must be 128 MB or a multiple of 64 MB"},TIMEOUT:{INTEGER:"Timeout must be an integer",MIN:"Timeout must be at least 1 second",MAX:"Timeout cannot exceed 900 seconds"},RUNTIME:"Lambda runtime must contain only letters, digits, dots, underscores, or dashes (e.g. 'NODEJS_20_X' or 'nodejs20.x')"},ENV_VAR_NAME:"Environment variable names must start with a letter or underscore and contain only letters, digits, and underscores",PRIORITY:{INTEGER:"Priority must be an integer",MIN:"Priority must be at least 1",MAX:"Priority cannot exceed 50000"},CAPACITY:{MIN:{INTEGER:"Minimum capacity must be an integer",MIN_0:"Minimum capacity must be at least 0",MIN_1:"Minimum capacity must be at least 1",MAX:"Minimum capacity cannot exceed 100"},MAX:{INTEGER:"Maximum capacity must be an integer",MIN_0:"Maximum capacity must be at least 0",MIN_1:"Maximum capacity must be at least 1",MAX:"Maximum capacity cannot exceed 100"},DESIRED:{INTEGER:"Desired count must be an integer",MIN:"Desired count must be at least 0",MAX:"Desired count cannot exceed 100"},WARM_POOL_REQUIRED:"minCapacity 0 requires a warmPool \u2014 without it, new tasks wait 60-90s for a cold instance launch",WARM_POOL:{MIN_SIZE:{INTEGER:"Warm pool minSize must be an integer",MIN:"Warm pool minSize must be at least 0",MAX:"Warm pool minSize cannot exceed 100"},MIN_SIZE_EXCEEDS_MAX_CAPACITY:"warmPool.minSize cannot exceed maxCapacity \u2014 the warm pool cannot hold more instances than the ASG allows"}},MEMORY_LIMIT:{INTEGER:"Memory limit must be an integer",MIN_512:"Memory limit must be at least 512 MiB",MIN_128:"Memory limit must be at least 128 MiB",MAX:"Memory limit cannot exceed 30720 MiB"},DATABASE:{PORT:{INTEGER:"Database port must be an integer",MIN:"Database port must be at least 1024",MAX:"Database port cannot exceed 65535"},NAME:{REQUIRED:"Database name is required",MAX_LENGTH:"Database name must be 63 characters or less"}},CLICKHOUSE_STORAGE:{INTEGER:"ClickHouse storage must be a whole number of GiB",MIN:`ClickHouse storage must be at least ${100} GiB`,MAX:`ClickHouse storage cannot exceed ${16384} GiB (the gp3 ceiling)`},CLICKHOUSE_IOPS:{INTEGER:"ClickHouse iops must be a whole number",MIN:`ClickHouse iops must be at least ${3e3} (the gp3 baseline)`,MAX:`ClickHouse iops cannot exceed ${8e4} (the gp3 ceiling)`},CLICKHOUSE_THROUGHPUT:{INTEGER:"ClickHouse throughputMbps must be a whole number of MiB/s",MIN:`ClickHouse throughputMbps must be at least ${125} MiB/s (the gp3 baseline)`,MAX:`ClickHouse throughputMbps cannot exceed ${2e3} MiB/s (the gp3 ceiling)`},BACKUP_RETENTION:{INTEGER:"Backup retention must be an integer",MIN:"Backup retention must be at least 1 day",MAX:"Backup retention cannot exceed 35 days (the RDS automated-backup ceiling)"},CLICKHOUSE_BACKUP_RETENTION:{INTEGER:"ClickHouse backup retention must be an integer number of days",MIN:`ClickHouse backup retention must be at least ${1} day`,MAX:`ClickHouse backup retention cannot exceed ${3650} days`},SQS:{VISIBILITY_TIMEOUT:{INTEGER:"Visibility timeout must be an integer",MIN:"Visibility timeout must be at least 0 seconds",MAX:"Visibility timeout cannot exceed 43200 seconds (12 hours)"},RETENTION_PERIOD:{INTEGER:"Retention period must be an integer",MIN:"Retention period must be at least 60 seconds",MAX:"Retention period cannot exceed 1209600 seconds (14 days)"}},READER:{COUNT:{INTEGER:"Reader count must be an integer",MIN:"Reader count must be at least 0",MAX:"Reader count cannot exceed 15"}},IDENTIFIER_SUFFIX:{REQUIRED:"Identifier suffix is required when specified",MAX_LENGTH:"Identifier suffix cannot exceed 50 characters"},ROTATION:{INTEGER:"Rotation days must be an integer",MIN:"Rotation interval must be at least 1 day",MAX:"Rotation interval cannot exceed 365 days"},MAX_CONNECTIONS:{INTEGER:"Max connections must be an integer",MIN:"Max connections must be at least 1",MAX:"Max connections cannot exceed 100"},MONITORING_INTERVAL:{INTEGER:"Monitoring interval must be an integer",MIN:"Monitoring interval must be at least 0",MAX:"Monitoring interval cannot exceed 60 seconds",VALUES:"Monitoring interval must be 0, 1, 5, 10, 15, 30, or 60 seconds"},RETENTION_DAYS:{INTEGER:"Retention days must be an integer",MIN:"Retention days must be at least 1",MAX:"Retention days cannot exceed 365"},BATCH_SIZE:{INTEGER:"Batch size must be an integer",MIN:"Batch size must be at least 1",MAX:"Batch size cannot exceed 10000"},SERVICE:{UNIQUE_WITHIN_CLUSTER:"Service names must be unique within a cluster",MIN_REQUIRED:"At least one service is required",ROUTING_REQUIRED:"Multiple services with ports require routing config (path or host)"},PROXY_CONFIG:{MAX_IDLE_CONNECTIONS:{INTEGER:"Max idle connections must be an integer",MIN:"Max idle connections must be at least 0",MAX:"Max idle connections cannot exceed 100"},BORROW_TIMEOUT:{INTEGER:"Connection borrow timeout must be an integer",MIN:"Connection borrow timeout must be at least 1 second",MAX:"Connection borrow timeout cannot exceed 3600 seconds"}},MAX_AZS:{INTEGER:"Max AZs must be an integer",MIN:"Max AZs must be at least 1",MAX:"Max AZs cannot exceed 3"},BATCHING_WINDOW:{INTEGER:"Max batching window must be an integer",MIN:"Max batching window must be at least 0",MAX:"Max batching window cannot exceed 300 seconds"},HEALTH_CHECK:{INTERVAL:{INTEGER:"Health check interval must be an integer",MIN:"Health check interval must be at least 5 seconds",MAX:"Health check interval cannot exceed 300 seconds"},TIMEOUT:{INTEGER:"Health check timeout must be an integer",MIN:"Health check timeout must be at least 2 seconds",MAX:"Health check timeout cannot exceed 60 seconds"},RETRIES:{INTEGER:"Health check retries must be an integer",MIN:"Health check retries must be at least 1",MAX:"Health check retries cannot exceed 10"},START_PERIOD:{INTEGER:"Health check start period must be an integer",MIN:"Health check start period must be at least 0 seconds",MAX:"Health check start period cannot exceed 300 seconds"}},EPHEMERAL_STORAGE:{INTEGER:"Ephemeral storage size must be an integer",MIN:"Ephemeral storage size must be at least 512 MB",MAX:"Ephemeral storage size cannot exceed 10240 MB"},MAX_MESSAGE_SIZE:{INTEGER:"Max message size must be an integer",MIN:"Max message size must be at least 1024 bytes",MAX:"Max message size cannot exceed 262144 bytes (256 KB)"},CAPACITY_CONSTRAINT:{MIN_LTE_MAX:"minCapacity must be less than or equal to maxCapacity"},DIRECT_ACCESS:{NO_DOMAIN:"directAccess cannot be used with domain (no ALB for HTTPS)",NO_LOAD_BALANCER:"directAccess cannot be used with loadBalancer (mutually exclusive)"},GLOBAL_AURORA:{PRIMARY_REGION_REQUIRED:"primaryRegion is required for GlobalAurora databases"},NAT_GATEWAY:{INTEGER:"NAT gateway count must be an integer",MIN:"NAT gateway count must be at least 0",MAX:"NAT gateway count cannot exceed 3"},CIDR_MASK:{INTEGER:"CIDR mask must be an integer",MIN:"CIDR mask must be at least 16",MAX:"CIDR mask cannot exceed 28"},CPU:{INTEGER:"CPU must be an integer",MIN:"CPU must be at least 256 units",MAX:"CPU cannot exceed 4096 units"},KMS:{KEY_REQUIRED:"KMS key ARN is required when using KMS encryption"},READER_INSTANCES:{MAX:"Cannot have more than 15 reader instances",COUNT_OR_INSTANCES:"Cannot specify both 'count' and 'instances' - use one or the other"},GENERATOR_CAPACITY:{MIN:{MIN:"Minimum capacity must be at least 1",MAX:"Minimum capacity cannot exceed 1000"},MAX:{MIN:"Maximum capacity must be at least 1",MAX:"Maximum capacity cannot exceed 1000"}},INSTANCE_TYPE:"Unknown instance type. Common types include: t4g.micro, t4g.small, m5.large",ARCHITECTURE_MISMATCH:"Architecture mismatch between instance type and AMI",ALLOCATED_STORAGE:{INTEGER:"Allocated storage must be an integer",MIN:"Allocated storage must be at least 20 GB",MAX:"Allocated storage cannot exceed 65536 GB"},DLQ:{MAX_RECEIVE_COUNT:{INTEGER:"Max receive count must be an integer",MIN:"Max receive count must be at least 1",MAX:"Max receive count cannot exceed 1000"}},ALARM:{PERCENTAGE:{MIN:"Threshold must be at least 1%",MAX:"Threshold must be at most 100%"},FREE_STORAGE_GIB:{MIN:"Free storage threshold must be at least 1 GiB"},RESPONSE_TIME_MS:{MIN:"Response-time threshold must be at least 1 ms"}},REGION:"Invalid AWS region",PASCAL_CASE:"Resource name must start with an uppercase letter and contain only alphanumerics (PascalCase).",IMAGE_DOCKER_MUTEX:"image and docker are mutually exclusive",AWS_ACCOUNT_ID:"AWS account id must be exactly 12 digits (no hyphens)",VPC_ID:"VPC id must look like vpc-abc12345",ROLE_ARN:"Role ARN must have the form arn:aws:iam::<account-id>:role/<name>",CIDR:"CIDR must be in dotted-quad/prefix-length form (e.g. 10.0.0.0/16)",VPC_PEER:{MIN_REQUESTER_ACCOUNTS:"At least one requester account id is required",REGION_REQUIRED:"Peer region is required when specified",ROUTE_TABLE_ID_REQUIRED:"Route table id must not be empty"},SCHEDULE_EXPRESSION:"Schedule expression must be 'rate(N minute|minutes|hour|hours|day|days)' with N>=1, or 'cron(<6-field AWS expression>)'"});var aV=Object.defineProperty,mr=(e,t)=>aV(e,"name",{value:t,configurable:!0}),oV=["us-east-2","us-west-2","us-east-1","eu-west-1","eu-central-1","ap-southeast-1"],sV=Object.freeze(oV.flatMap(e=>{let t=$o(e);return t?[t]:[]})),UA=Object.freeze(["us-east-2","us-west-2","us-east-1","eu-west-1","ap-southeast-1"]);function Cm(e){return e?e.split(",").map(t=>t.trim()).filter(Boolean):[]}mr(Cm,"parseRegionList");function zA(e){return Pn.includes(e)}mr(zA,"isValidRegion");function BA(e){return/^[a-z]{2}-[a-z]+-[1-9]$/.test(e)}mr(BA,"isValidRegionFormat");function GA(e){if(!e)return UA.slice(0,3);let t=e.toLowerCase().split("-"),r=t[0],i=t.length>1?t[1]:"",n=[];return r&&i&&(n=Pn.filter(a=>a.startsWith(`${r}-${i}`))),n.length===0&&r&&(n=Pn.filter(a=>a.startsWith(`${r}-`))),n.length>0?n.slice(0,3):UA.slice(0,3)}mr(GA,"getSuggestions");function VA(e){if(zA(e))return!0;let t=GA(e);return BA(e)?`Unknown region. Try: ${t.join(", ")}`:`Invalid format. Try: ${t.join(", ")}`}mr(VA,"validateRegion");function vP(e){if(!e||e.trim()==="")return!0;let t=Cm(e);for(let r of t){let i=VA(r);if(i!==!0)return i}return!0}mr(vP,"validateRegionList");function WA(e,t){return e.filter(r=>r!==t)}mr(WA,"filterDuplicateRegions");function KA(e){return{label:e.city,value:e.code,description:e.optIn?`${e.code} \u2014 opt-in required`:e.code}}mr(KA,"toRegionOption");function bP(){return dr.map(KA)}mr(bP,"getRegionOptions");function SP(e){return dr.filter(t=>t.code!==e).map(KA)}mr(SP,"getRegionOptionsExcluding");function EP(e){let t=dr.find(r=>r.code===e);return t?t.city:e}mr(EP,"getRegionName");function AP(e){return t=>{let r=Cm(t);return WA(r,e)}}mr(AP,"createRegionFormatter");var Im="28.1.1";var Dm=["Aurora","Instance","GlobalAurora","ClickHouse"],Ko=["FARGATE","FARGATE_SPOT","EC2"],Fr=["standard","resilient","enterprise"],km=["tinkerer","lightweight","standard","resilient","enterprise"],ZA="custom",tu=[...km,ZA];var cV=Object.defineProperty,uV=(e,t)=>cV(e,"name",{value:t,configurable:!0}),Pie=Object.freeze({RESOURCE_SUFFIXES:Object.freeze({storage:"Storage",database:"Database",cluster:"Cluster",function:"Function",instance:"Instance",compute:"Compute"})}),ru=["ecs","lambda","ec2"],nu=Object.freeze({ECS:"ecs",LAMBDA:"lambda",EC2:"ec2"}),Nm=["code","container"],wm=Object.freeze({CODE:"code",CONTAINER:"container"}),Pm=["ARM_64","X86_64"],xP="ARM_64",iu=["NONE","AWS_IAM"],Rm=["public","internal"],Om=["CPU","MEMORY"],ea=["messaging","compute"],$m=["ARM","STANDARD"],HA=["Instance","Aurora"],Zo=["postgresql","mysql"],au=["web","worker"],_P=["foundation","compliance","hardened"];var jm=["t3.nano","t3.micro","t3.small","t3.medium","t3.large","t3.xlarge","t3.2xlarge","t3a.nano","t3a.micro","t3a.small","t3a.medium","t3a.large","t3a.xlarge","t3a.2xlarge","t4g.nano","t4g.micro","t4g.small","t4g.medium","t4g.large","t4g.xlarge","t4g.2xlarge","c5.large","c5.xlarge","c5.2xlarge","c5.4xlarge","c5.9xlarge","c5.12xlarge","c5.18xlarge","c5.24xlarge","c5a.large","c5a.xlarge","c5a.2xlarge","c5a.4xlarge","c5a.8xlarge","c5a.12xlarge","c5a.16xlarge","c5a.24xlarge","c6g.medium","c6g.large","c6g.xlarge","c6g.2xlarge","c6g.4xlarge","c6g.8xlarge","c6g.12xlarge","c6g.16xlarge","r5.large","r5.xlarge","r5.2xlarge","r5.4xlarge","r5.8xlarge","r5.12xlarge","r5.16xlarge","r5.24xlarge","r5a.large","r5a.xlarge","r5a.2xlarge","r5a.4xlarge","r5a.8xlarge","r5a.12xlarge","r5a.16xlarge","r5a.24xlarge","r6g.medium","r6g.large","r6g.xlarge","r6g.2xlarge","r6g.4xlarge","r6g.8xlarge","r6g.12xlarge","r6g.16xlarge","i3.large","i3.xlarge","i3.2xlarge","i3.4xlarge","i3.8xlarge","i3.16xlarge","p3.2xlarge","p3.8xlarge","p3.16xlarge","g4dn.xlarge","g4dn.2xlarge","g4dn.4xlarge","g4dn.8xlarge","g4dn.12xlarge","g4dn.16xlarge","m5.large","m5.xlarge","m5.2xlarge","m5.4xlarge","m5.8xlarge","m5.12xlarge","m5.16xlarge","m5.24xlarge","m5a.large","m5a.xlarge","m5a.2xlarge","m5a.4xlarge","m5a.8xlarge","m5a.12xlarge","m5a.16xlarge","m5a.24xlarge"],TP=[0,1,5,10,15,30,60];function jt(e,t){return e.includes(t)}uV(jt,"constIncludes");var CP=1,IP=65535,Mie=Object.freeze({postgresql:5432,mysql:3306}),DP=128,kP=10240,Mm=1,Fm=900,JA=1,XA=1e3,Ho=100,NP=100;var wP=3e3;var PP=["GET","POST","PUT","DELETE","HEAD","OPTIONS","PATCH"],RP=["standard","assets","upload","website"],Jo=["AES256","KMS"];var lV=Object.defineProperty,ou=(e,t)=>lV(e,"name",{value:t,configurable:!0}),Mt=ou(e=>c.union([c.literal(!1),e]),"optionalOrDisabled"),ta={check:ou(e=>e.minCapacity!==void 0&&e.maxCapacity!==void 0?e.minCapacity<=e.maxCapacity:!0,"check"),params:{message:E.CAPACITY_CONSTRAINT.MIN_LTE_MAX,path:["maxCapacity"]}},su=ou(e=>c.number().int(E.MEMORY_LIMIT.INTEGER).min(e,e===128?E.MEMORY_LIMIT.MIN_128:E.MEMORY_LIMIT.MIN_512).max(30720,E.MEMORY_LIMIT.MAX),"memoryLimitMiBSchema"),be=c.string().min(1,E.REQUIRED.RESOURCE_NAME).max(63,E.MAX_LENGTH.RESOURCE_NAME).regex(he.RESOURCE_NAME,E.RESOURCE_NAME),$P=c.string().min(1,E.REQUIRED.BUCKET_NAME).max(63,E.MAX_LENGTH.BUCKET_NAME).regex(he.BUCKET_NAME,E.BUCKET_NAME),jP=c.string().min(1,E.REQUIRED.DATABASE_NAME).max(63,E.MAX_LENGTH.DATABASE_NAME).regex(he.DATABASE_NAME,E.DATABASE_NAME);function Lm(e,t=he.IDENTIFIER,r=E.IDENTIFIER){return c.string().min(2,E.IDENTIFIER_MIN_LENGTH).max(50,e).regex(t,r).refine(i=>!i.endsWith("-"),{message:E.IDENTIFIER_NO_TRAILING_HYPHEN}).refine(i=>!i.includes("--"),{message:E.IDENTIFIER_NO_CONSECUTIVE_HYPHENS})}ou(Lm,"identifierSchema");var at=Lm(E.MAX_LENGTH.APP_NAME),Vie=Lm(E.MAX_LENGTH.APP_NAME,he.NEW_APP_NAME,E.NEW_APP_NAME),ra=c.number().int(E.PORT.INTEGER).min(CP,E.PORT.MIN).max(IP,E.PORT.MAX),gt=c.object({key:c.string(),sourceText:c.string()}).strict(),dV=c.object({__identifier:c.string()}).strict(),pV=c.object({__expression:c.string()}).strict(),mV=c.object({__call:c.string()}).strict(),fV=c.union([dV,pV,mV]),hV=c.union([c.string(),c.number(),c.boolean(),fV]),Xo=c.record(c.string().regex(he.ENV_VAR_NAME,E.ENV_VAR_NAME),hV),gV=c.object({id:c.string(),name:c.string().optional(),arn:c.string().optional(),field:c.string().optional()}).strict().refine(e=>e.name!==void 0!=(e.arn!==void 0),{message:"secretsImport requires exactly one of `name` or `arn`."}),MP=c.record(c.string(),gV),Wie=c.record(c.string(),c.unknown()),qA=c.enum(tu).describe(`Application type must be one of: ${tu.join(", ")}`),YA=c.enum(pr).describe(`OpenNext deployment pattern: ${pr.join(", ")}`),yV=c.enum(["before-imports","after-imports","after-app-init","after-tags","after-resource","end-of-file"]),vV=c.enum(["import","app-init","tags","database","compute","storage","network","messaging","cdn","pattern","vpc-peer","vpc-peer-accepter","cross-plan-connection","custom"]),FP=c.object({sourceText:c.string(),position:yV,afterManagedResource:c.object({type:vV,name:c.string().optional()}).strict().optional(),originalLine:c.number().int().optional(),leadingComments:c.array(c.string()).optional(),orphaned:c.boolean().optional(),orphanedComment:c.string().optional()}).strict(),LP=c.union([c.object({tier:c.enum(Fr)}).strict(),c.literal(!1)]),UP=c.union([c.object({instanceType:c.string().optional()}).strict(),c.literal(!1)]),bV=Lm(E.MAX_LENGTH.ORGANISATION_NAME),SV=c.string().regex(he.EMAIL,E.EMAIL),OP=c.string().refine(e=>Pn.includes(e),{message:E.REGION}),Kie=c.object({name:bV,email:SV,accountName:c.string().optional(),primaryRegion:OP.optional().default(Oo),secondaryRegions:c.array(OP).optional(),security:c.enum(_P).optional(),force:c.boolean().optional()}).strict();function cu(e){return e.issues.map(t=>`${t.path.length>0?`${t.path.join(".")}: `:""}${t.message}`).join(`
+`,"utf8"),!0}catch{return!1}}YG(Tm,"ensureGitignoreEntries");var tV=Object.defineProperty,Wo=(e,t)=>tV(e,"name",{value:t,configurable:!0});function IA(e){return e.success===!0}Wo(IA,"isSuccess");function DA(e){return e.success===!1}Wo(DA,"isFailure");function G(e){return{success:!0,data:e}}Wo(G,"success");function O(e){return{success:!1,error:e}}Wo(O,"failure");async function kA(e){try{let t=await e();return G(t)}catch(t){return O(Mr(t))}}Wo(kA,"tryAsync");function NA(e){try{let t=e();return G(t)}catch(t){return O(Mr(t))}}Wo(NA,"trySync");var rV=Object.defineProperty,nV=(e,t)=>rV(e,"name",{value:t,configurable:!0}),gP=/^[a-zA-Z][a-zA-Z0-9-]*$/,iV=Hc.source.replace(/^\^|\$$/g,""),he=Object.freeze({IDENTIFIER:gP,NEW_APP_NAME:/^[a-z][a-z0-9-]*$/,RESOURCE_NAME:/^[a-zA-Z][a-zA-Z0-9]*$/,ECS_SERVICE_NAME:gP,BUCKET_NAME:/^[a-z][a-z0-9-]*[a-z0-9]$|^[a-z][a-z0-9]*$/,DATABASE_NAME:/^[a-zA-Z][a-zA-Z0-9_]*$/,RESOURCE_TYPE:/^[a-z]+(:[a-z]+)?$/,SSM_PATH:new RegExp(`^(?:/${iV})+$`),SECRET_NAME:pm,SSM_COMPONENT:Hc,EMAIL:/^[^\s@]+@[^\s@]+\.[^\s@]+$/,DOCKER_IMAGE:/^[a-z0-9][a-z0-9._-]*[a-z0-9](:[a-z0-9._-]+)?$/,DOMAIN:/^[a-z0-9]([a-z0-9-]*[a-z0-9])?(\.[a-z0-9]([a-z0-9-]*[a-z0-9])?)+$/i,HTTP_ORIGIN:/^https?:\/\/[a-z0-9.-]+(:\d+)?$/i,PASCAL_CASE:/^[A-Z][A-Za-z0-9]*$/,AWS_ACCOUNT_ID:/^\d{12}$/,VPC_ID:/^vpc-[a-z0-9]+$/,ROLE_ARN:/^arn:aws[a-zA-Z-]*:iam::\d{12}:role\/.+$/,CIDR:/^((25[0-5]|2[0-4]\d|1\d\d|[1-9]?\d)\.){3}(25[0-5]|2[0-4]\d|1\d\d|[1-9]?\d)\/(3[0-2]|[12]?\d)$/,SCHEDULE_EXPRESSION:/^(rate\(1 (?:minute|hour|day)\)|rate\((?:[2-9]|[1-9]\d+) (?:minutes|hours|days)\)|cron\([^\s()]+ [^\s()]+ [^\s()]+ [^\s()]+ [^\s()]+ [^\s()]+\))$/,LAMBDA_RUNTIME_IDENTIFIER:/^[A-Za-z0-9._-]+$/,ENV_VAR_NAME:/^[A-Za-z_][A-Za-z0-9_]*$/});function wA(e){let t=/^rate\((\d+) (minute|minutes|hour|hours|day|days)\)$/.exec(e);if(!t)return;let r=t[1],i=t[2];if(r===void 0||i===void 0)return;let n=parseInt(r,10);if(!Number.isFinite(n)||n<1)return;let a=i==="minute"||i==="hour"||i==="day";if(!(a&&n!==1)&&!(!a&&n===1))return i==="minute"||i==="minutes"?{everyMs:n*6e4}:i==="hour"||i==="hours"?{everyMs:n*60*6e4}:{everyMs:n*24*60*6e4}}nV(wA,"parseRateExpression");var yP=["t4g.medium","m7g.medium","m8g.medium","r7g.medium","r8g.medium","m7g.large","m8g.large","r7g.large","r8g.large","m7g.xlarge","m8g.xlarge","r7g.xlarge","r8g.xlarge"];var E=Object.freeze({IDENTIFIER:"Must start with a letter, contain only letters, numbers, and hyphens",NEW_APP_NAME:"Must start with a lowercase letter and contain only lowercase letters, numbers, and hyphens",IDENTIFIER_MIN_LENGTH:"Must be at least 2 characters",IDENTIFIER_NO_TRAILING_HYPHEN:"Must not end with a hyphen",IDENTIFIER_NO_CONSECUTIVE_HYPHENS:"Must not contain consecutive hyphens",RESOURCE_NAME:"Must start with a letter and contain only letters and numbers (PascalCase recommended)",ECS_SERVICE_NAME:"Service name must start with a letter and contain only letters, numbers, and hyphens",BUCKET_NAME:"Bucket name must start with a lowercase letter and contain only lowercase letters, numbers, and hyphens",DATABASE_NAME:"Database name must start with a letter and contain only letters, numbers, and underscores",RESOURCE_TYPE:"Resource type must be in format 'category' or 'category:type'",SSM_PATH:"SSM path must start with / and contain valid namespace segments (e.g., /myapp/ApiCluster/service)",SECRET_NAME:KE,SSM_COMPONENT:mm,EMAIL:"Please enter a valid email address",DOMAIN:"Please enter a valid domain (e.g., cms.example.com)",DOCKER_IMAGE:"Invalid Docker image name format",REQUIRED:{APP_NAME:"Application name is required",RESOURCE_NAME:"Resource name is required",BUCKET_NAME:"Bucket name is required",SERVICE_NAME:"Service name is required",NETWORK_NAME:"Network name is required",DATABASE_NAME:"Database name is required",ORGANISATION_NAME:"Organisation name is required",EMAIL:"Email is required",NAME:"Name is required",USERNAME:"Username is required",CONTAINER_NAME:"Container name is required",GROUP:"Group is required",PATTERN_NAME:"Pattern name is required",SOURCE:"Source directory is required",BUILD_COMMAND:"Build command is required",OUTPUT_DIR:"Output directory is required",FORMS_TO:"Forms recipient address is required",ROUTING_PATH:"Routing path is required",RESOURCE_REFERENCE:"Resource reference is required",RESOURCE_TYPE:"Resource type is required",VARIANT:"Variant is required",SUBTYPE:"Subtype is required",DEPLOY_TARGET:"Deploy target is required",DESTROY_TARGET:"Destroy target is required",CONNECTED_RESOURCE_NAME:"Connected resource names must not be empty"},MAX_LENGTH:{APP_NAME:"Application name must be 50 characters or less",RESOURCE_NAME:"Resource name must be 63 characters or less",BUCKET_NAME:"Bucket name must be 63 characters or less",SERVICE_NAME:"Service name must be 255 characters or less",NETWORK_NAME:"Network name must be 50 characters or less",DATABASE_NAME:"Database name must be 63 characters or less",ORGANISATION_NAME:"Organisation name must be 50 characters or less"},PORT:{INTEGER:"Port must be an integer",MIN:"Port must be at least 1",MAX:"Port cannot exceed 65535"},USERNAME:{MAX_LENGTH:"Username cannot exceed 63 characters"},LAMBDA:{MEMORY:{INTEGER:"Lambda memory must be an integer",MIN:"Memory must be at least 128 MB",MAX:"Memory cannot exceed 10240 MB",MULTIPLE:"Memory must be 128 MB or a multiple of 64 MB"},TIMEOUT:{INTEGER:"Timeout must be an integer",MIN:"Timeout must be at least 1 second",MAX:"Timeout cannot exceed 900 seconds"},RUNTIME:"Lambda runtime must contain only letters, digits, dots, underscores, or dashes (e.g. 'NODEJS_20_X' or 'nodejs20.x')"},ENV_VAR_NAME:"Environment variable names must start with a letter or underscore and contain only letters, digits, and underscores",PRIORITY:{INTEGER:"Priority must be an integer",MIN:"Priority must be at least 1",MAX:"Priority cannot exceed 50000"},CAPACITY:{MIN:{INTEGER:"Minimum capacity must be an integer",MIN_0:"Minimum capacity must be at least 0",MIN_1:"Minimum capacity must be at least 1",MAX:"Minimum capacity cannot exceed 100"},MAX:{INTEGER:"Maximum capacity must be an integer",MIN_0:"Maximum capacity must be at least 0",MIN_1:"Maximum capacity must be at least 1",MAX:"Maximum capacity cannot exceed 100"},DESIRED:{INTEGER:"Desired count must be an integer",MIN:"Desired count must be at least 0",MAX:"Desired count cannot exceed 100"},WARM_POOL_REQUIRED:"minCapacity 0 requires a warmPool \u2014 without it, new tasks wait 60-90s for a cold instance launch",WARM_POOL:{MIN_SIZE:{INTEGER:"Warm pool minSize must be an integer",MIN:"Warm pool minSize must be at least 0",MAX:"Warm pool minSize cannot exceed 100"},MIN_SIZE_EXCEEDS_MAX_CAPACITY:"warmPool.minSize cannot exceed maxCapacity \u2014 the warm pool cannot hold more instances than the ASG allows"}},MEMORY_LIMIT:{INTEGER:"Memory limit must be an integer",MIN_512:"Memory limit must be at least 512 MiB",MIN_128:"Memory limit must be at least 128 MiB",MAX:"Memory limit cannot exceed 30720 MiB"},DATABASE:{PORT:{INTEGER:"Database port must be an integer",MIN:"Database port must be at least 1024",MAX:"Database port cannot exceed 65535"},NAME:{REQUIRED:"Database name is required",MAX_LENGTH:"Database name must be 63 characters or less"}},CLICKHOUSE_STORAGE:{INTEGER:"ClickHouse storage must be a whole number of GiB",MIN:`ClickHouse storage must be at least ${100} GiB`,MAX:`ClickHouse storage cannot exceed ${16384} GiB (the gp3 ceiling)`},CLICKHOUSE_IOPS:{INTEGER:"ClickHouse iops must be a whole number",MIN:`ClickHouse iops must be at least ${3e3} (the gp3 baseline)`,MAX:`ClickHouse iops cannot exceed ${8e4} (the gp3 ceiling)`},CLICKHOUSE_THROUGHPUT:{INTEGER:"ClickHouse throughputMbps must be a whole number of MiB/s",MIN:`ClickHouse throughputMbps must be at least ${125} MiB/s (the gp3 baseline)`,MAX:`ClickHouse throughputMbps cannot exceed ${2e3} MiB/s (the gp3 ceiling)`},BACKUP_RETENTION:{INTEGER:"Backup retention must be an integer",MIN:"Backup retention must be at least 1 day",MAX:"Backup retention cannot exceed 35 days (the RDS automated-backup ceiling)"},CLICKHOUSE_BACKUP_RETENTION:{INTEGER:"ClickHouse backup retention must be an integer number of days",MIN:`ClickHouse backup retention must be at least ${1} day`,MAX:`ClickHouse backup retention cannot exceed ${3650} days`},SQS:{VISIBILITY_TIMEOUT:{INTEGER:"Visibility timeout must be an integer",MIN:"Visibility timeout must be at least 0 seconds",MAX:"Visibility timeout cannot exceed 43200 seconds (12 hours)"},RETENTION_PERIOD:{INTEGER:"Retention period must be an integer",MIN:"Retention period must be at least 60 seconds",MAX:"Retention period cannot exceed 1209600 seconds (14 days)"}},READER:{COUNT:{INTEGER:"Reader count must be an integer",MIN:"Reader count must be at least 0",MAX:"Reader count cannot exceed 15"}},IDENTIFIER_SUFFIX:{REQUIRED:"Identifier suffix is required when specified",MAX_LENGTH:"Identifier suffix cannot exceed 50 characters"},ROTATION:{INTEGER:"Rotation days must be an integer",MIN:"Rotation interval must be at least 1 day",MAX:"Rotation interval cannot exceed 365 days"},MAX_CONNECTIONS:{INTEGER:"Max connections must be an integer",MIN:"Max connections must be at least 1",MAX:"Max connections cannot exceed 100"},MONITORING_INTERVAL:{INTEGER:"Monitoring interval must be an integer",MIN:"Monitoring interval must be at least 0",MAX:"Monitoring interval cannot exceed 60 seconds",VALUES:"Monitoring interval must be 0, 1, 5, 10, 15, 30, or 60 seconds"},RETENTION_DAYS:{INTEGER:"Retention days must be an integer",MIN:"Retention days must be at least 1",MAX:"Retention days cannot exceed 365"},BATCH_SIZE:{INTEGER:"Batch size must be an integer",MIN:"Batch size must be at least 1",MAX:"Batch size cannot exceed 10000"},SERVICE:{UNIQUE_WITHIN_CLUSTER:"Service names must be unique within a cluster",MIN_REQUIRED:"At least one service is required",ROUTING_REQUIRED:"Multiple services with ports require routing config (path or host)"},PROXY_CONFIG:{MAX_IDLE_CONNECTIONS:{INTEGER:"Max idle connections must be an integer",MIN:"Max idle connections must be at least 0",MAX:"Max idle connections cannot exceed 100"},BORROW_TIMEOUT:{INTEGER:"Connection borrow timeout must be an integer",MIN:"Connection borrow timeout must be at least 1 second",MAX:"Connection borrow timeout cannot exceed 3600 seconds"}},MAX_AZS:{INTEGER:"Max AZs must be an integer",MIN:"Max AZs must be at least 1",MAX:"Max AZs cannot exceed 3"},BATCHING_WINDOW:{INTEGER:"Max batching window must be an integer",MIN:"Max batching window must be at least 0",MAX:"Max batching window cannot exceed 300 seconds"},HEALTH_CHECK:{INTERVAL:{INTEGER:"Health check interval must be an integer",MIN:"Health check interval must be at least 5 seconds",MAX:"Health check interval cannot exceed 300 seconds"},TIMEOUT:{INTEGER:"Health check timeout must be an integer",MIN:"Health check timeout must be at least 2 seconds",MAX:"Health check timeout cannot exceed 60 seconds"},RETRIES:{INTEGER:"Health check retries must be an integer",MIN:"Health check retries must be at least 1",MAX:"Health check retries cannot exceed 10"},START_PERIOD:{INTEGER:"Health check start period must be an integer",MIN:"Health check start period must be at least 0 seconds",MAX:"Health check start period cannot exceed 300 seconds"}},EPHEMERAL_STORAGE:{INTEGER:"Ephemeral storage size must be an integer",MIN:"Ephemeral storage size must be at least 512 MB",MAX:"Ephemeral storage size cannot exceed 10240 MB"},MAX_MESSAGE_SIZE:{INTEGER:"Max message size must be an integer",MIN:"Max message size must be at least 1024 bytes",MAX:"Max message size cannot exceed 262144 bytes (256 KB)"},CAPACITY_CONSTRAINT:{MIN_LTE_MAX:"minCapacity must be less than or equal to maxCapacity"},DIRECT_ACCESS:{NO_DOMAIN:"directAccess cannot be used with domain (no ALB for HTTPS)",NO_LOAD_BALANCER:"directAccess cannot be used with loadBalancer (mutually exclusive)"},GLOBAL_AURORA:{PRIMARY_REGION_REQUIRED:"primaryRegion is required for GlobalAurora databases"},NAT_GATEWAY:{INTEGER:"NAT gateway count must be an integer",MIN:"NAT gateway count must be at least 0",MAX:"NAT gateway count cannot exceed 3"},CIDR_MASK:{INTEGER:"CIDR mask must be an integer",MIN:"CIDR mask must be at least 16",MAX:"CIDR mask cannot exceed 28"},CPU:{INTEGER:"CPU must be an integer",MIN:"CPU must be at least 256 units",MAX:"CPU cannot exceed 4096 units"},KMS:{KEY_REQUIRED:"KMS key ARN is required when using KMS encryption"},READER_INSTANCES:{MAX:"Cannot have more than 15 reader instances",COUNT_OR_INSTANCES:"Cannot specify both 'count' and 'instances' - use one or the other"},GENERATOR_CAPACITY:{MIN:{MIN:"Minimum capacity must be at least 1",MAX:"Minimum capacity cannot exceed 1000"},MAX:{MIN:"Maximum capacity must be at least 1",MAX:"Maximum capacity cannot exceed 1000"}},INSTANCE_TYPE:"Unknown instance type. Common types include: t4g.micro, t4g.small, m5.large",ARCHITECTURE_MISMATCH:"Architecture mismatch between instance type and AMI",ALLOCATED_STORAGE:{INTEGER:"Allocated storage must be an integer",MIN:"Allocated storage must be at least 20 GB",MAX:"Allocated storage cannot exceed 65536 GB"},DLQ:{MAX_RECEIVE_COUNT:{INTEGER:"Max receive count must be an integer",MIN:"Max receive count must be at least 1",MAX:"Max receive count cannot exceed 1000"}},ALARM:{PERCENTAGE:{MIN:"Threshold must be at least 1%",MAX:"Threshold must be at most 100%"},FREE_STORAGE_GIB:{MIN:"Free storage threshold must be at least 1 GiB"},RESPONSE_TIME_MS:{MIN:"Response-time threshold must be at least 1 ms"}},REGION:"Invalid AWS region",PASCAL_CASE:"Resource name must start with an uppercase letter and contain only alphanumerics (PascalCase).",IMAGE_DOCKER_MUTEX:"image and docker are mutually exclusive",AWS_ACCOUNT_ID:"AWS account id must be exactly 12 digits (no hyphens)",VPC_ID:"VPC id must look like vpc-abc12345",ROLE_ARN:"Role ARN must have the form arn:aws:iam::<account-id>:role/<name>",CIDR:"CIDR must be in dotted-quad/prefix-length form (e.g. 10.0.0.0/16)",VPC_PEER:{MIN_REQUESTER_ACCOUNTS:"At least one requester account id is required",REGION_REQUIRED:"Peer region is required when specified",ROUTE_TABLE_ID_REQUIRED:"Route table id must not be empty"},SCHEDULE_EXPRESSION:"Schedule expression must be 'rate(N minute|minutes|hour|hours|day|days)' with N>=1, or 'cron(<6-field AWS expression>)'"});var aV=Object.defineProperty,mr=(e,t)=>aV(e,"name",{value:t,configurable:!0}),oV=["us-east-2","us-west-2","us-east-1","eu-west-1","eu-central-1","ap-southeast-1"],sV=Object.freeze(oV.flatMap(e=>{let t=$o(e);return t?[t]:[]})),UA=Object.freeze(["us-east-2","us-west-2","us-east-1","eu-west-1","ap-southeast-1"]);function Cm(e){return e?e.split(",").map(t=>t.trim()).filter(Boolean):[]}mr(Cm,"parseRegionList");function zA(e){return Pn.includes(e)}mr(zA,"isValidRegion");function BA(e){return/^[a-z]{2}-[a-z]+-[1-9]$/.test(e)}mr(BA,"isValidRegionFormat");function GA(e){if(!e)return UA.slice(0,3);let t=e.toLowerCase().split("-"),r=t[0],i=t.length>1?t[1]:"",n=[];return r&&i&&(n=Pn.filter(a=>a.startsWith(`${r}-${i}`))),n.length===0&&r&&(n=Pn.filter(a=>a.startsWith(`${r}-`))),n.length>0?n.slice(0,3):UA.slice(0,3)}mr(GA,"getSuggestions");function VA(e){if(zA(e))return!0;let t=GA(e);return BA(e)?`Unknown region. Try: ${t.join(", ")}`:`Invalid format. Try: ${t.join(", ")}`}mr(VA,"validateRegion");function vP(e){if(!e||e.trim()==="")return!0;let t=Cm(e);for(let r of t){let i=VA(r);if(i!==!0)return i}return!0}mr(vP,"validateRegionList");function WA(e,t){return e.filter(r=>r!==t)}mr(WA,"filterDuplicateRegions");function KA(e){return{label:e.city,value:e.code,description:e.optIn?`${e.code} \u2014 opt-in required`:e.code}}mr(KA,"toRegionOption");function bP(){return dr.map(KA)}mr(bP,"getRegionOptions");function SP(e){return dr.filter(t=>t.code!==e).map(KA)}mr(SP,"getRegionOptionsExcluding");function EP(e){let t=dr.find(r=>r.code===e);return t?t.city:e}mr(EP,"getRegionName");function AP(e){return t=>{let r=Cm(t);return WA(r,e)}}mr(AP,"createRegionFormatter");var Im="28.2.0";var Dm=["Aurora","Instance","GlobalAurora","ClickHouse"],Ko=["FARGATE","FARGATE_SPOT","EC2"],Fr=["standard","resilient","enterprise"],km=["tinkerer","lightweight","standard","resilient","enterprise"],ZA="custom",tu=[...km,ZA];var cV=Object.defineProperty,uV=(e,t)=>cV(e,"name",{value:t,configurable:!0}),Pie=Object.freeze({RESOURCE_SUFFIXES:Object.freeze({storage:"Storage",database:"Database",cluster:"Cluster",function:"Function",instance:"Instance",compute:"Compute"})}),ru=["ecs","lambda","ec2"],nu=Object.freeze({ECS:"ecs",LAMBDA:"lambda",EC2:"ec2"}),Nm=["code","container"],wm=Object.freeze({CODE:"code",CONTAINER:"container"}),Pm=["ARM_64","X86_64"],xP="ARM_64",iu=["NONE","AWS_IAM"],Rm=["public","internal"],Om=["CPU","MEMORY"],ea=["messaging","compute"],$m=["ARM","STANDARD"],HA=["Instance","Aurora"],Zo=["postgresql","mysql"],au=["web","worker"],_P=["foundation","compliance","hardened"];var jm=["t3.nano","t3.micro","t3.small","t3.medium","t3.large","t3.xlarge","t3.2xlarge","t3a.nano","t3a.micro","t3a.small","t3a.medium","t3a.large","t3a.xlarge","t3a.2xlarge","t4g.nano","t4g.micro","t4g.small","t4g.medium","t4g.large","t4g.xlarge","t4g.2xlarge","c5.large","c5.xlarge","c5.2xlarge","c5.4xlarge","c5.9xlarge","c5.12xlarge","c5.18xlarge","c5.24xlarge","c5a.large","c5a.xlarge","c5a.2xlarge","c5a.4xlarge","c5a.8xlarge","c5a.12xlarge","c5a.16xlarge","c5a.24xlarge","c6g.medium","c6g.large","c6g.xlarge","c6g.2xlarge","c6g.4xlarge","c6g.8xlarge","c6g.12xlarge","c6g.16xlarge","r5.large","r5.xlarge","r5.2xlarge","r5.4xlarge","r5.8xlarge","r5.12xlarge","r5.16xlarge","r5.24xlarge","r5a.large","r5a.xlarge","r5a.2xlarge","r5a.4xlarge","r5a.8xlarge","r5a.12xlarge","r5a.16xlarge","r5a.24xlarge","r6g.medium","r6g.large","r6g.xlarge","r6g.2xlarge","r6g.4xlarge","r6g.8xlarge","r6g.12xlarge","r6g.16xlarge","i3.large","i3.xlarge","i3.2xlarge","i3.4xlarge","i3.8xlarge","i3.16xlarge","p3.2xlarge","p3.8xlarge","p3.16xlarge","g4dn.xlarge","g4dn.2xlarge","g4dn.4xlarge","g4dn.8xlarge","g4dn.12xlarge","g4dn.16xlarge","m5.large","m5.xlarge","m5.2xlarge","m5.4xlarge","m5.8xlarge","m5.12xlarge","m5.16xlarge","m5.24xlarge","m5a.large","m5a.xlarge","m5a.2xlarge","m5a.4xlarge","m5a.8xlarge","m5a.12xlarge","m5a.16xlarge","m5a.24xlarge"],TP=[0,1,5,10,15,30,60];function jt(e,t){return e.includes(t)}uV(jt,"constIncludes");var CP=1,IP=65535,Mie=Object.freeze({postgresql:5432,mysql:3306}),DP=128,kP=10240,Mm=1,Fm=900,JA=1,XA=1e3,Ho=100,NP=100;var wP=3e3;var PP=["GET","POST","PUT","DELETE","HEAD","OPTIONS","PATCH"],RP=["standard","assets","upload","website"],Jo=["AES256","KMS"];var lV=Object.defineProperty,ou=(e,t)=>lV(e,"name",{value:t,configurable:!0}),Mt=ou(e=>c.union([c.literal(!1),e]),"optionalOrDisabled"),ta={check:ou(e=>e.minCapacity!==void 0&&e.maxCapacity!==void 0?e.minCapacity<=e.maxCapacity:!0,"check"),params:{message:E.CAPACITY_CONSTRAINT.MIN_LTE_MAX,path:["maxCapacity"]}},su=ou(e=>c.number().int(E.MEMORY_LIMIT.INTEGER).min(e,e===128?E.MEMORY_LIMIT.MIN_128:E.MEMORY_LIMIT.MIN_512).max(30720,E.MEMORY_LIMIT.MAX),"memoryLimitMiBSchema"),be=c.string().min(1,E.REQUIRED.RESOURCE_NAME).max(63,E.MAX_LENGTH.RESOURCE_NAME).regex(he.RESOURCE_NAME,E.RESOURCE_NAME),$P=c.string().min(1,E.REQUIRED.BUCKET_NAME).max(63,E.MAX_LENGTH.BUCKET_NAME).regex(he.BUCKET_NAME,E.BUCKET_NAME),jP=c.string().min(1,E.REQUIRED.DATABASE_NAME).max(63,E.MAX_LENGTH.DATABASE_NAME).regex(he.DATABASE_NAME,E.DATABASE_NAME);function Lm(e,t=he.IDENTIFIER,r=E.IDENTIFIER){return c.string().min(2,E.IDENTIFIER_MIN_LENGTH).max(50,e).regex(t,r).refine(i=>!i.endsWith("-"),{message:E.IDENTIFIER_NO_TRAILING_HYPHEN}).refine(i=>!i.includes("--"),{message:E.IDENTIFIER_NO_CONSECUTIVE_HYPHENS})}ou(Lm,"identifierSchema");var at=Lm(E.MAX_LENGTH.APP_NAME),Vie=Lm(E.MAX_LENGTH.APP_NAME,he.NEW_APP_NAME,E.NEW_APP_NAME),ra=c.number().int(E.PORT.INTEGER).min(CP,E.PORT.MIN).max(IP,E.PORT.MAX),gt=c.object({key:c.string(),sourceText:c.string()}).strict(),dV=c.object({__identifier:c.string()}).strict(),pV=c.object({__expression:c.string()}).strict(),mV=c.object({__call:c.string()}).strict(),fV=c.union([dV,pV,mV]),hV=c.union([c.string(),c.number(),c.boolean(),fV]),Xo=c.record(c.string().regex(he.ENV_VAR_NAME,E.ENV_VAR_NAME),hV),gV=c.object({id:c.string(),name:c.string().optional(),arn:c.string().optional(),field:c.string().optional()}).strict().refine(e=>e.name!==void 0!=(e.arn!==void 0),{message:"secretsImport requires exactly one of `name` or `arn`."}),MP=c.record(c.string(),gV),Wie=c.record(c.string(),c.unknown()),qA=c.enum(tu).describe(`Application type must be one of: ${tu.join(", ")}`),YA=c.enum(pr).describe(`OpenNext deployment pattern: ${pr.join(", ")}`),yV=c.enum(["before-imports","after-imports","after-app-init","after-tags","after-resource","end-of-file"]),vV=c.enum(["import","app-init","tags","database","compute","storage","network","messaging","cdn","pattern","vpc-peer","vpc-peer-accepter","cross-plan-connection","custom"]),FP=c.object({sourceText:c.string(),position:yV,afterManagedResource:c.object({type:vV,name:c.string().optional()}).strict().optional(),originalLine:c.number().int().optional(),leadingComments:c.array(c.string()).optional(),orphaned:c.boolean().optional(),orphanedComment:c.string().optional()}).strict(),LP=c.union([c.object({tier:c.enum(Fr)}).strict(),c.literal(!1)]),UP=c.union([c.object({instanceType:c.string().optional()}).strict(),c.literal(!1)]),bV=Lm(E.MAX_LENGTH.ORGANISATION_NAME),SV=c.string().regex(he.EMAIL,E.EMAIL),OP=c.string().refine(e=>Pn.includes(e),{message:E.REGION}),Kie=c.object({name:bV,email:SV,accountName:c.string().optional(),primaryRegion:OP.optional().default(Oo),secondaryRegions:c.array(OP).optional(),security:c.enum(_P).optional(),force:c.boolean().optional()}).strict();function cu(e){return e.issues.map(t=>`${t.path.length>0?`${t.path.join(".")}: `:""}${t.message}`).join(`
 `)}ou(cu,"getZodErrorMessage");var Um=c.number().min(1,E.ALARM.PERCENTAGE.MIN).max(100,E.ALARM.PERCENTAGE.MAX),QA=c.union([Um,c.literal(!1)]),EV=c.union([c.number().min(1,E.ALARM.RESPONSE_TIME_MS.MIN),c.literal(!1)]),AV=c.number().min(1,E.ALARM.FREE_STORAGE_GIB.MIN),zP=c.union([c.literal(!1),c.object({cpuThreshold:QA.optional(),memoryThreshold:QA.optional(),runningTasksMinimum:c.number().int().min(0).optional(),http5xxThreshold:QA.optional(),p99ResponseTimeThresholdMs:EV.optional()}).strict()]),BP=c.union([c.literal(!1),c.object({cpuThreshold:Um.optional(),freeStorageThresholdGiB:AV.optional(),connectionsThreshold:c.number().int().min(1).optional()}).strict()]),GP=c.union([c.literal(!1),c.object({errorRateThreshold:Um.optional(),durationThresholdPercent:Um.optional()}).strict()]);var na=c.number().int(E.BACKUP_RETENTION.INTEGER).min(1,E.BACKUP_RETENTION.MIN).max(35,E.BACKUP_RETENTION.MAX),VP=c.number().int(E.CLICKHOUSE_STORAGE.INTEGER).min(100,E.CLICKHOUSE_STORAGE.MIN).max(16384,E.CLICKHOUSE_STORAGE.MAX),WP=c.number().int(E.CLICKHOUSE_IOPS.INTEGER).min(3e3,E.CLICKHOUSE_IOPS.MIN).max(8e4,E.CLICKHOUSE_IOPS.MAX),KP=c.number().int(E.CLICKHOUSE_THROUGHPUT.INTEGER).min(125,E.CLICKHOUSE_THROUGHPUT.MIN).max(2e3,E.CLICKHOUSE_THROUGHPUT.MAX),xV=c.enum(yP),ZP=c.number().int(E.CLICKHOUSE_BACKUP_RETENTION.INTEGER).min(1,E.CLICKHOUSE_BACKUP_RETENTION.MIN).max(3650,E.CLICKHOUSE_BACKUP_RETENTION.MAX),uu=c.number().int(E.MONITORING_INTERVAL.INTEGER).refine(e=>jt(TP,e),{message:E.MONITORING_INTERVAL.VALUES}),Bm=c.number().int(E.DATABASE.PORT.INTEGER).min(1024,E.DATABASE.PORT.MIN).max(65535,E.DATABASE.PORT.MAX),_V=c.enum(Dm).describe(`Database type must be one of: ${Dm.join(", ")}`),TV=c.object({maxConnections:c.number().int(E.MAX_CONNECTIONS.INTEGER).min(1,E.MAX_CONNECTIONS.MIN).max(100,E.MAX_CONNECTIONS.MAX).optional(),maxIdleConnections:c.number().int(E.PROXY_CONFIG.MAX_IDLE_CONNECTIONS.INTEGER).min(0,E.PROXY_CONFIG.MAX_IDLE_CONNECTIONS.MIN).max(100,E.PROXY_CONFIG.MAX_IDLE_CONNECTIONS.MAX).optional(),connectionBorrowTimeout:c.number().int(E.PROXY_CONFIG.BORROW_TIMEOUT.INTEGER).min(1,E.PROXY_CONFIG.BORROW_TIMEOUT.MIN).max(3600,E.PROXY_CONFIG.BORROW_TIMEOUT.MAX).optional(),requireTLS:c.boolean().optional()}).strict().describe("RDS Proxy configuration"),CV=c.object({instanceType:c.string().optional(),availabilityZone:c.string().optional()}).strict().describe("Read replica configuration"),IV=c.object({automaticallyAfterDays:c.number().int(E.ROTATION.INTEGER).min(1,E.ROTATION.MIN).max(365,E.ROTATION.MAX).optional()}).strict().describe("Secret rotation configuration"),Gm=c.object({username:c.string().min(1,E.REQUIRED.USERNAME).max(63,E.USERNAME.MAX_LENGTH).optional(),secretRotation:IV.optional()}).strict().describe("Database credentials configuration"),Vm=Mt(TV),Wm=Mt(CV),DV=c.object({scaleWithWriter:c.boolean().optional(),enableDatabaseInsights:c.boolean().optional(),identifierSuffix:c.string().min(1,E.IDENTIFIER_SUFFIX.REQUIRED).max(50,E.IDENTIFIER_SUFFIX.MAX_LENGTH).optional(),availabilityZone:c.string().optional()}).strict().describe("Configuration for a single Aurora reader instance"),lu=c.object({enableDatabaseInsights:c.boolean().optional(),identifierSuffix:c.string().min(1,E.IDENTIFIER_SUFFIX.REQUIRED).max(50,E.IDENTIFIER_SUFFIX.MAX_LENGTH).optional(),availabilityZone:c.string().optional()}).strict().describe("Configuration for Aurora writer instance"),kV=c.object({count:c.number().int(E.READER.COUNT.INTEGER).min(0,E.READER.COUNT.MIN).max(15,E.READER.COUNT.MAX).optional(),instances:c.array(DV).max(15,E.READER_INSTANCES.MAX).optional(),defaultEnableDatabaseInsights:c.boolean().optional()}).strict().refine(e=>!(e.count!==void 0&&e.instances!==void 0),{message:E.READER_INSTANCES.COUNT_OR_INSTANCES,path:["count"]}).describe("Aurora readers configuration"),du=Mt(kV),NV=c.object({awsManaged:c.literal(!0)}).strict(),wV=c.object({useCMK:c.literal(!0)}).strict(),HP=c.union([NV,wV]),PV=c.object({mode:c.enum(["standard","advanced"]).optional(),encryptionKey:HP.optional()}).strict().describe("Database Insights configuration"),Km=Mt(PV),Zm=c.object({storageKey:HP.optional()}).strict().describe("Encryption configuration (DESTRUCTIVE to change storageKey)"),pu=c.object({name:be,type:_V,databaseName:c.string().min(1,E.REQUIRED.DATABASE_NAME),instanceType:c.string().optional(),allocatedStorage:c.number().optional(),multiAz:c.boolean().optional(),publiclyAccessible:c.boolean().optional(),databaseInsights:Km.optional(),port:Bm.optional(),deletionProtection:c.boolean().optional(),proxy:Vm.optional(),credentials:Gm.optional(),readReplica:Wm.optional(),encryption:Zm.optional(),writer:lu.optional(),readers:du.optional(),backupRetention:na.optional(),preferredMaintenanceWindow:c.string().optional(),monitoringInterval:uu.optional(),primaryRegion:c.string().optional(),secondaryRegions:c.array(c.string()).optional(),globalClusterIdentifier:c.string().optional(),enableGlobalWriteForwarding:c.boolean().optional(),snapshotIdentifier:c.string().optional(),snapshotUsername:c.string().optional(),databaseEngine:c.enum(Zo).optional(),engineExpression:c.string().optional(),variableName:c.string().optional(),extraProperties:c.array(gt).optional(),alarms:BP.optional()}).strict(),Hm=c.object({appName:at,nameProvidedByFlag:c.boolean().optional(),databaseName:c.string().min(1,E.REQUIRED.DATABASE_NAME).max(63,E.MAX_LENGTH.DATABASE_NAME).regex(he.DATABASE_NAME,E.DATABASE_NAME),resourceName:be.optional(),connectionConfig:c.object({connectToCompute:c.array(c.string()).optional(),connectToServices:c.array(c.string()).optional()}).strict().optional(),databaseInsights:Km.optional(),port:Bm.optional(),proxy:Vm.optional(),credentials:Gm.optional(),encryption:Zm.optional(),deletionProtection:c.boolean().optional()}).strict(),JP={databaseType:c.literal("Instance"),instanceType:c.string().optional(),multiAz:c.boolean().optional(),readReplica:Wm.optional(),publiclyAccessible:c.boolean().optional(),backupRetention:na.optional(),allocatedStorage:c.number().optional(),snapshotIdentifier:c.string().optional(),snapshotUsername:c.string().optional()},XP={databaseType:c.literal("Aurora"),writer:lu.optional(),readers:du.optional(),backupRetention:na.optional(),preferredMaintenanceWindow:c.string().optional(),monitoringInterval:uu.optional(),snapshotIdentifier:c.string().optional(),snapshotUsername:c.string().optional()},qP={databaseType:c.literal("GlobalAurora"),primaryRegion:c.string().min(1,E.GLOBAL_AURORA.PRIMARY_REGION_REQUIRED),secondaryRegions:c.array(c.string()).optional(),globalClusterIdentifier:c.string().optional(),enableGlobalWriteForwarding:c.boolean().optional(),writer:lu.optional(),readers:du.optional(),backupRetention:na.optional(),preferredMaintenanceWindow:c.string().optional(),monitoringInterval:uu.optional(),snapshotIdentifier:c.string().optional(),snapshotUsername:c.string().optional()},YP=c.object({appName:at,nameProvidedByFlag:c.boolean().optional(),databaseName:c.string().min(1,E.REQUIRED.DATABASE_NAME).max(63,E.MAX_LENGTH.DATABASE_NAME).regex(he.DATABASE_NAME,E.DATABASE_NAME),resourceName:be.optional(),connectionConfig:c.object({connectToCompute:c.array(c.string()).optional(),connectToServices:c.array(c.string()).optional()}).strict().optional()}).strict(),QP={databaseType:c.literal("ClickHouse"),instanceType:xV.optional(),storageGb:VP.optional(),iops:WP.optional(),throughputMbps:KP.optional(),coldTier:c.union([c.object({mode:c.literal("s3")}).strict(),c.literal(!1)]).optional(),optimiseSchedule:c.union([c.string(),c.literal(!1)]).optional(),backupSchedule:c.union([c.string(),c.literal(!1)]).optional(),backupVerify:c.literal(!1).optional(),backupRetentionDays:ZP.optional()},RV=Hm.extend(JP).strict(),OV=Hm.extend(XP).strict(),$V=Hm.extend(qP).strict(),jV=YP.extend(QP).strict(),nae=c.discriminatedUnion("databaseType",[RV,OV,$V,jV]),ex=Hm.extend({resourceName:be}).strict(),MV=ex.extend(JP).strict(),FV=ex.extend(XP).strict(),LV=ex.extend(qP).strict(),UV=YP.extend({resourceName:be}).strict(),zV=UV.extend(QP).strict(),iae=c.discriminatedUnion("databaseType",[MV,FV,LV,zV]),eR=c.object({appName:at,databaseName:c.string().min(1,E.REQUIRED.DATABASE_NAME),maxConnections:c.number().int(E.MAX_CONNECTIONS.INTEGER).min(1,E.MAX_CONNECTIONS.MIN).max(100,E.MAX_CONNECTIONS.MAX).optional(),maxIdleConnections:c.number().int(E.PROXY_CONFIG.MAX_IDLE_CONNECTIONS.INTEGER).min(0,E.PROXY_CONFIG.MAX_IDLE_CONNECTIONS.MIN).max(100,E.PROXY_CONFIG.MAX_IDLE_CONNECTIONS.MAX).optional(),connectionBorrowTimeout:c.number().int(E.PROXY_CONFIG.BORROW_TIMEOUT.INTEGER).min(1,E.PROXY_CONFIG.BORROW_TIMEOUT.MIN).max(3600,E.PROXY_CONFIG.BORROW_TIMEOUT.MAX).optional(),requireTLS:c.boolean().optional(),nameProvidedByFlag:c.boolean().optional()}).strict(),BV=["S","N","B"],zm=c.object({name:c.string(),type:c.enum(BV)}).strict(),tR=c.object({name:be,partitionKey:zm,sortKey:zm.optional(),globalSecondaryIndexes:c.array(c.object({indexName:c.string(),partitionKey:zm,sortKey:zm.optional()}).strict()).optional(),ttlAttribute:c.string().optional(),stream:c.boolean().optional(),variableName:c.string().optional(),extraProperties:c.array(gt).optional()}).strict(),GV=c.object({mode:c.literal("s3")}).strict(),rR=c.object({name:be,type:c.literal("ClickHouse"),databaseName:jP,instanceType:c.string().optional(),storageGb:VP.optional(),iops:WP.optional(),throughputMbps:KP.optional(),coldTier:c.union([GV,c.literal(!1)]).optional(),optimiseSchedule:c.union([c.string(),c.literal(!1)]).optional(),backupSchedule:c.union([c.string(),c.literal(!1)]).optional(),backupVerify:c.literal(!1).optional(),backupRetentionDays:ZP.optional(),variableName:c.string().optional(),extraProperties:c.array(gt).optional()}).strict();var VV=c.object({count:c.number().int(E.NAT_GATEWAY.INTEGER).min(0,E.NAT_GATEWAY.MIN).max(3,E.NAT_GATEWAY.MAX).optional()}).strict().describe("NAT gateway configuration"),nR=Mt(VV),tx=c.enum(["cloudwatch","s3"]),WV=c.object({destination:tx.optional(),retentionDays:c.number().int(E.RETENTION_DAYS.INTEGER).min(1,E.RETENTION_DAYS.MIN).max(365,E.RETENTION_DAYS.MAX).optional(),trafficType:c.enum(["ALL","ACCEPT","REJECT"]).optional()}).strict().describe("VPC flow log configuration"),iR=Mt(WV),KV=c.object({s3:c.boolean().optional(),dynamodb:c.boolean().optional()}).strict().describe("Gateway VPC endpoints (FREE)"),ZV=Mt(KV),HV=c.object({ecr:c.boolean().optional(),secretsManager:c.boolean().optional(),kms:c.boolean().optional(),cloudwatchLogs:c.boolean().optional(),ssm:c.boolean().optional(),sts:c.boolean().optional()}).strict().describe("Interface VPC endpoints (cost per hour)"),JV=Mt(HV),XV=c.object({gateway:ZV.optional(),interface:JV.optional()}).strict().describe("VPC endpoints configuration"),aR=Mt(XV),ia=c.object({maxAzs:c.number().int(E.MAX_AZS.INTEGER).min(1,E.MAX_AZS.MIN).max(3,E.MAX_AZS.MAX).optional(),natGateways:nR.optional(),flowLogs:iR.optional(),vpcEndpoints:aR.optional(),cidrMask:c.number().int(E.CIDR_MASK.INTEGER).min(16,E.CIDR_MASK.MIN).max(28,E.CIDR_MASK.MAX).optional()}).strict(),oR=c.string().min(1,E.REQUIRED.NETWORK_NAME).max(50,E.MAX_LENGTH.NETWORK_NAME).regex(he.RESOURCE_NAME,E.RESOURCE_NAME),sR=ia.extend({name:oR}).strict(),cR=Mt(ia),uae=c.object({appName:at,networkName:oR.optional(),maxAzs:c.number().int(E.MAX_AZS.INTEGER).min(1,E.MAX_AZS.MIN).max(3,E.MAX_AZS.MAX).optional(),natGateways:nR.optional(),flowLogs:iR.optional(),vpcEndpoints:aR.optional()}).strict(),qV=he.CIDR,rx=c.string().regex(qV,E.CIDR),YV=c.object({kind:c.literal("database"),resource:c.string().min(1,E.REQUIRED.RESOURCE_REFERENCE),name:be,allowedFromCidrs:c.array(rx),access:c.enum(["read","write","readWrite"]).optional()}).strict(),QV=c.object({kind:c.literal("ecsService"),resource:c.string().min(1,E.REQUIRED.RESOURCE_REFERENCE),serviceName:c.string().min(1,E.REQUIRED.SERVICE_NAME),name:be,allowedFromCidrs:c.array(rx),port:ra.optional()}).strict(),e3=c.discriminatedUnion("kind",[YV,QV]),uR=c.object({name:be,peerAppName:c.string().min(1,E.REQUIRED.APP_NAME),peerAccountId:c.string().regex(he.AWS_ACCOUNT_ID,E.AWS_ACCOUNT_ID),peerRegion:c.string().min(1,E.VPC_PEER.REGION_REQUIRED).optional(),peerVpcId:c.string().regex(he.VPC_ID,E.VPC_ID).optional(),peerVpcCidr:rx.optional(),peerRoleArn:c.string().regex(he.ROLE_ARN,E.ROLE_ARN).optional(),peerRouteTableIds:c.array(c.string().min(1,E.VPC_PEER.ROUTE_TABLE_ID_REQUIRED)).optional(),localVpcName:c.string().min(1,E.REQUIRED.NETWORK_NAME).optional(),enableDnsResolution:c.boolean().optional()}).strict(),nx=c.object({name:be,requesterAccountIds:c.array(c.string().regex(he.AWS_ACCOUNT_ID,E.AWS_ACCOUNT_ID)).min(1,E.VPC_PEER.MIN_REQUESTER_ACCOUNTS),localVpcName:c.string().min(1,E.REQUIRED.NETWORK_NAME).optional(),publishToSsm:c.boolean().optional(),exposedResources:c.array(e3).optional()}).strict();var Jm=["storage","cdn","compute"],t3=c.object({sid:c.string().optional(),effect:c.enum(["Allow","Deny"]),principals:c.array(c.string()),actions:c.array(c.string()),resources:c.array(c.string()).optional(),conditions:c.record(c.string(),c.record(c.string(),c.union([c.string(),c.array(c.string())]))).optional()}).strict(),mu=c.object({name:be,bucketName:c.string().optional(),publicReadAccess:c.boolean().optional(),websiteHosting:c.object({indexDocument:c.string(),errorDocument:c.string().optional()}).strict().optional(),backupVaultTier:c.enum(Fr).optional(),versioned:c.boolean().optional(),encryption:c.enum(Jo).optional(),kmsKeyArn:c.string().optional(),cors:c.array(c.object({allowedOrigins:c.array(c.string()),allowedMethods:c.array(c.string()),allowedHeaders:c.array(c.string()).optional(),exposedHeaders:c.array(c.string()).optional(),maxAge:c.number().optional()}).strict()).optional(),deployment:c.object({source:c.string(),prune:c.boolean().optional(),cacheControl:c.object({maxAge:c.number().optional(),immutable:c.boolean().optional()}).strict().optional()}).strict().optional(),retain:c.boolean().optional(),resourcePolicyStatements:c.array(t3).optional(),stackPlacement:c.enum(Jm).optional(),variableName:c.string().optional(),extraProperties:c.array(gt).optional()}).strict().refine(e=>e.encryption!=="KMS"||!!e.kmsKeyArn,{message:E.KMS.KEY_REQUIRED}),hae=c.object({appName:at,bucketName:$P,nameProvidedByFlag:c.boolean().optional(),storagePreset:c.enum(RP).optional(),publicReadAccess:c.boolean().optional(),websiteHosting:c.object({indexDocument:c.string(),errorDocument:c.string().optional()}).strict().optional(),backupVaultTier:c.enum(Fr).optional(),versioned:c.boolean().optional(),encryption:c.enum(Jo).optional(),kmsKeyArn:c.string().optional(),cors:c.array(c.object({allowedOrigins:c.array(c.string()),allowedMethods:c.array(c.string()),allowedHeaders:c.array(c.string()).optional(),exposedHeaders:c.array(c.string()).optional(),maxAge:c.number().optional()}).strict()).optional(),connectionConfig:c.object({connectToCompute:c.array(c.string()).optional(),connectToServices:c.array(c.string()).optional()}).strict().optional()}).strict().refine(e=>e.encryption!=="KMS"||!!e.kmsKeyArn,{message:E.KMS.KEY_REQUIRED,path:["kmsKeyArn"]});var ix=c.enum(["DESTROY","RETAIN"]),fu=c.object({name:be,queueType:c.enum(["standard","fifo"]).default("standard"),visibilityTimeout:c.number().int(E.SQS.VISIBILITY_TIMEOUT.INTEGER).min(0,E.SQS.VISIBILITY_TIMEOUT.MIN).max(43200,E.SQS.VISIBILITY_TIMEOUT.MAX).optional(),retentionPeriod:c.number().int(E.SQS.RETENTION_PERIOD.INTEGER).min(60,E.SQS.RETENTION_PERIOD.MIN).max(1209600,E.SQS.RETENTION_PERIOD.MAX).optional(),contentBasedDeduplication:c.boolean().optional(),removalPolicy:ix.optional(),variableName:c.string().optional(),extraProperties:c.array(gt).optional()}).strict();var lR=c.object({type:c.literal("basic-auth"),username:c.string().min(1),password:c.string().min(1)}).strict(),hu=c.object({name:be,defaultOriginRef:c.string(),behaviours:c.array(c.object({pathPattern:c.string(),originRef:c.string(),cachePolicy:c.enum(["CACHING_OPTIMIZED","CACHING_DISABLED"]).optional()}).strict()).optional(),customDomain:c.string().optional(),certificateArn:c.string().optional(),domain:c.string().optional(),originHostname:c.string().optional(),accessGate:c.union([c.literal(!1),lR]).optional(),extraProperties:c.array(gt).optional()}).strict(),xae=c.object({appName:c.string(),name:be.optional(),defaultOriginRef:c.string(),behaviours:c.array(c.object({pathPattern:c.string(),originRef:c.string(),cachePolicy:c.enum(["CACHING_OPTIMIZED","CACHING_DISABLED"]).optional()}).strict()).optional(),customDomain:c.string().optional(),certificateArn:c.string().optional(),domain:c.string().optional(),originHostname:c.string().optional(),accessGate:c.union([c.literal(!1),lR]).optional(),nameProvidedByFlag:c.boolean().optional()}).strict();var r3=Object.defineProperty,ax=(e,t)=>r3(e,"name",{value:t,configurable:!0}),n3=new Set(["t4g","c6g","c6gd","c6gn","c7g","c7gd","c7gn","r6g","r6gd","r7g","r7gd","r8g","r8gd","c8g","c8gd","c8gn","m6g","m6gd","m7g","m7gd","m8g","m8gd","x8g","i8g","a1","x2gd","im4gn","is4gen","i4g","hpc7g"]);function vi(e){let t=e.split(".")[0]??"";return n3.has(t)?"ARM":"STANDARD"}ax(vi,"getArchitectureForInstanceType");function Xm(e,t){let r=vi(e);return r!==t?{valid:!1,message:`Instance type '${e}' requires ${r} architecture, but '${t}' AMI was specified. Use a ${r==="ARM"?"Graviton instance (t4g, c6g, r6g, m6g, etc.)":"Intel/AMD instance (t3, c5, r5, m5, etc.)"} instead.`}:{valid:!0}}ax(Xm,"validateArchitectureMatch");function dR(e,t){return vi(e)===t}ax(dR,"isArchitectureCompatible");var i3=Object.defineProperty,qm=(e,t)=>i3(e,"name",{value:t,configurable:!0});var a3=1;var o3=/^[A-Za-z0-9_.-]+$/,s3=c.object({id:c.string().min(1,"buildSecret id cannot be empty").regex(o3,"buildSecret id may contain only letters, digits, '_', '.', and '-' (no comma, '=', or whitespace, which would break the buildx --secret argv)"),ssm:c.string().min(1,"ssm parameter name cannot be empty").optional(),secretsManager:c.object({name:c.string().min(1,"secret name cannot be empty").optional(),arn:c.string().min(1,"secret arn cannot be empty").optional(),field:c.string().min(1,"secret field cannot be empty").optional()}).strict().refine(e=>e.name===void 0!=(e.arn===void 0),"secretsManager requires exactly one of name or arn").optional(),env:c.string().min(1,"env variable name cannot be empty").optional()}).strict().superRefine((e,t)=>{[e.ssm,e.secretsManager,e.env].filter(r=>r!==void 0).length!==1&&t.addIssue({code:c.ZodIssueCode.custom,message:"buildSecret requires exactly one source (ssm, secretsManager, or env)"})}),c3=c.union([c.string(),c.object({ssm:c.string().min(1,"ssm parameter name cannot be empty").optional(),secretsManager:c.object({name:c.string().min(1,"secret name cannot be empty").optional(),arn:c.string().min(1,"secret arn cannot be empty").optional(),field:c.string().min(1,"secret field cannot be empty").optional()}).strict().refine(e=>e.name===void 0!=(e.arn===void 0),"secretsManager requires exactly one of name or arn").optional(),env:c.string().min(1,"env variable name cannot be empty").optional(),acknowledgePublic:c.boolean().optional()}).strict().superRefine((e,t)=>{[e.ssm,e.secretsManager,e.env].filter(r=>r!==void 0).length!==1&&t.addIssue({code:c.ZodIssueCode.custom,message:"buildArg value requires exactly one source (ssm, secretsManager, or env)"})})]),Qr=c.object({path:c.string(),context:c.string().min(1,"context cannot be empty").optional(),target:c.string().min(1,"target cannot be empty").optional(),buildArgs:c.record(c.string(),c3).optional(),buildSecrets:c.array(s3).optional()}).strict(),Dae=Qr.partial();function u3(e,t){if(t===void 0)return e;let r=t.context??e.context,i=t.target??e.target,n=t.buildArgs??e.buildArgs,a=t.buildSecrets??e.buildSecrets;return{path:t.path??e.path,...r!==void 0&&{context:r},...i!==void 0&&{target:i},...n!==void 0&&{buildArgs:n},...a!==void 0&&{buildSecrets:a}}}qm(u3,"mergeDockerBuild");function ox(e){return typeof e=="object"&&e!==null&&!Array.isArray(e)}qm(ox,"isRecord");function pR(e){if(!ox(e)||typeof e.path!="string"||e.path.length===0)return;let t=typeof e.context=="string"&&e.context.length>0?e.context:void 0,r=typeof e.target=="string"&&e.target.length>0?e.target:void 0,i=ox(e.buildArgs)&&Object.keys(e.buildArgs).length>0?e.buildArgs:void 0,n=Array.isArray(e.buildSecrets)&&e.buildSecrets.length>0?e.buildSecrets:void 0,a={path:e.path,...t!==void 0&&{context:t},...r!==void 0&&{target:r},...i!==void 0&&{buildArgs:i},...n!==void 0&&{buildSecrets:n}},o=Qr.safeParse(a);return o.success?o.data:void 0}qm(pR,"normaliseDockerBuild");function l3(e){if(e===void 0)return;let t=pR(e);return t===void 0?void 0:JSON.stringify(t)}qm(l3,"dockerBuildFingerprint");var d3=c.object({name:c.string(),clusterName:c.string().optional(),docker:Qr.optional(),containerPort:c.number().optional(),secrets:c.array(c.string()).optional(),ssmSecretsPath:c.string().optional(),importedSecretNames:c.array(c.string()).optional(),schemaGateImageTag:c.string().optional()}).strict(),p3=c.object({type:c.enum(pr),name:c.string(),source:c.string()}).strict(),m3=c.object({repositoryName:c.string()}).strict(),f3=["x86_64","arm64"],h3=c.object({name:c.string(),secrets:c.array(c.string()).optional(),ssmSecretsPath:c.string().optional(),importedSecretNames:c.array(c.string()).optional(),docker:Qr.optional(),imageKey:c.string().optional(),architecture:c.enum(f3).optional()}).strict(),g3=c.object({templateHash:c.string(),synthTimestamp:c.string()}).strict(),y3=c.object({constructPath:c.string().max(512),group:c.string().max(128),resourceType:c.string().max(256)}).strict(),v3=c.object({synthesisedBy:c.string().min(1).max(128),minimumEngineVersion:c.string().min(1).max(32),maximumEngineMajor:c.number().int().min(0).optional(),minimumAwsCdkCli:c.string().min(1).max(32).optional()}).strict(),b3=c.object({appName:c.string().min(1).max(128),slot:c.string().min(1).max(64),clusterName:c.string().min(1).max(128),anchor:c.string().min(1).max(128),pinned:c.boolean(),currentServiceName:c.string().min(1).max(256),legacyKey:c.string().min(1).max(256),legacyAnchor:c.string().min(1).max(256),legacyServiceName:c.string().min(1).max(512),legacyKeyFields:c.array(c.string().max(64)).max(32)}).strict(),S3=c.object({constructPath:c.string().min(1).max(512),resourceType:c.string().min(1).max(256),physicalNameHint:c.string().min(1).max(512),policy:c.enum(["retain","snapshot","adopted"]),destroyDisposition:c.enum(["survives","deleted-on-explicit-destroy"]),reason:c.string().min(1).max(1024),costClass:c.enum(["none","storage","fixed-monthly"]),cleanupHint:c.string().min(1).max(1024)}).strict(),kae=c.object({version:c.literal(a3),generatedAt:c.string(),appName:c.string(),services:c.array(d3),lambdas:c.array(h3),pattern:p3.optional(),ecr:m3.optional(),stacks:c.record(c.string(),g3),resourceMap:c.record(c.string(),y3).optional(),engineCompat:v3.optional(),identityAliases:c.array(b3).optional(),residuals:c.array(S3).optional()}).strict();var E3=Object.defineProperty,A3=(e,t)=>E3(e,"name",{value:t,configurable:!0});function fR(e){return!(e.image!==void 0&&e.docker!==void 0)}A3(fR,"imageDockerMutexCheck");var hR=c.number().int(E.CAPACITY.MIN.INTEGER).min(JA,E.GENERATOR_CAPACITY.MIN.MIN).max(XA,E.GENERATOR_CAPACITY.MIN.MAX),gR=c.number().int(E.CAPACITY.MAX.INTEGER).min(JA,E.GENERATOR_CAPACITY.MAX.MIN).max(XA,E.GENERATOR_CAPACITY.MAX.MAX),qo=c.number().int(E.LAMBDA.MEMORY.INTEGER).min(DP,E.LAMBDA.MEMORY.MIN).max(kP,E.LAMBDA.MEMORY.MAX).refine(e=>e===128||e%64===0,E.LAMBDA.MEMORY.MULTIPLE),yR=c.string().regex(he.LAMBDA_RUNTIME_IDENTIFIER,E.LAMBDA.RUNTIME),sx=c.number().int(E.CPU.INTEGER).min(256,E.CPU.MIN).max(4096,E.CPU.MAX),Qm=c.number().int(E.CAPACITY.DESIRED.INTEGER).min(0,E.CAPACITY.DESIRED.MIN).max(Ho,E.CAPACITY.DESIRED.MAX),gu=c.object({connectToDatabase:c.array(c.string()).optional()}).strict(),x3=c.object({minSize:c.number().int(E.CAPACITY.WARM_POOL.MIN_SIZE.INTEGER).min(0,E.CAPACITY.WARM_POOL.MIN_SIZE.MIN).max(NP,E.CAPACITY.WARM_POOL.MIN_SIZE.MAX).optional(),reuseOnScaleIn:c.boolean().optional()}).strict(),cx=c.object({instanceType:c.string().optional(),amiHardwareType:c.enum($m).optional(),minCapacity:c.number().int(E.CAPACITY.MIN.INTEGER).min(0,E.CAPACITY.MIN.MIN_0).max(Ho,E.CAPACITY.MIN.MAX).optional(),maxCapacity:c.number().int(E.CAPACITY.MAX.INTEGER).min(1,E.CAPACITY.MAX.MIN_1).max(Ho,E.CAPACITY.MAX.MAX).optional(),memoryLimitMiB:su(128).optional(),warmPool:x3.optional(),extraProperties:c.array(gt).optional()}).strict().superRefine((e,t)=>{if(!e.instanceType||!e.amiHardwareType)return;let r=Xm(e.instanceType,e.amiHardwareType);r.valid||t.addIssue({code:"custom",message:r.message??E.ARCHITECTURE_MISMATCH,path:["instanceType"]})}).superRefine((e,t)=>{e.minCapacity===0&&!e.warmPool&&t.addIssue({code:"custom",message:E.CAPACITY.WARM_POOL_REQUIRED,path:["minCapacity"]}),e.warmPool?.minSize!==void 0&&e.maxCapacity!==void 0&&e.warmPool.minSize>e.maxCapacity&&t.addIssue({code:"custom",message:E.CAPACITY.WARM_POOL.MIN_SIZE_EXCEEDS_MAX_CAPACITY,path:["warmPool","minSize"]})}),_3=c.enum(ru).describe(`Compute type must be one of: ${ru.join(", ")}`),ux=c.enum(Ko).describe(`ECS capacity provider must be one of: ${Ko.join(", ")}`),lx=c.string().refine(e=>jt(jm,e),{message:E.INSTANCE_TYPE}),vR=c.object({sourceType:c.enum(["sqs","dynamodb","eventbridge"]),sourceRef:c.string().describe("Name of the source resource"),batchSize:c.number().int(E.BATCH_SIZE.INTEGER).min(1,E.BATCH_SIZE.MIN).max(1e4,E.BATCH_SIZE.MAX).optional(),startingPosition:c.enum(["TRIM_HORIZON","LATEST"]).optional(),maxBatchingWindow:c.number().int(E.BATCHING_WINDOW.INTEGER).min(0,E.BATCHING_WINDOW.MIN).max(300,E.BATCHING_WINDOW.MAX).optional(),reportBatchItemFailures:c.boolean().optional()}).strict(),T3=c.object({name:c.string().min(1,E.REQUIRED.CONTAINER_NAME).optional(),image:c.string().optional(),port:ra.optional(),environment:Xo.optional(),secretsImport:MP.optional(),command:c.array(c.string()).optional(),entryPoint:c.array(c.string()).optional(),essential:c.boolean().optional(),healthCheck:c.object({command:c.array(c.string()),interval:c.number().int(E.HEALTH_CHECK.INTERVAL.INTEGER).min(5,E.HEALTH_CHECK.INTERVAL.MIN).max(300,E.HEALTH_CHECK.INTERVAL.MAX).optional(),timeout:c.number().int(E.HEALTH_CHECK.TIMEOUT.INTEGER).min(2,E.HEALTH_CHECK.TIMEOUT.MIN).max(60,E.HEALTH_CHECK.TIMEOUT.MAX).optional(),retries:c.number().int(E.HEALTH_CHECK.RETRIES.INTEGER).min(1,E.HEALTH_CHECK.RETRIES.MIN).max(10,E.HEALTH_CHECK.RETRIES.MAX).optional(),startPeriod:c.number().int(E.HEALTH_CHECK.START_PERIOD.INTEGER).min(0,E.HEALTH_CHECK.START_PERIOD.MIN).max(300,E.HEALTH_CHECK.START_PERIOD.MAX).optional()}).strict().optional(),ssmSecrets:c.array(c.string().regex(he.SECRET_NAME,E.SECRET_NAME)).optional(),extraProperties:c.array(gt).optional()}).strict(),bR=c.string().min(1,E.REQUIRED.SERVICE_NAME).max(255,E.MAX_LENGTH.SERVICE_NAME).regex(he.ECS_SERVICE_NAME,E.ECS_SERVICE_NAME),SR=c.object({domain:c.string().optional(),loadBalancer:c.union([c.literal(!1),c.enum(Rm)]).optional(),directAccess:c.boolean().optional(),extraProperties:c.array(gt).optional()}).strict().refine(e=>!(e.directAccess&&e.domain),{message:E.DIRECT_ACCESS.NO_DOMAIN,path:["directAccess"]}).refine(e=>!(e.directAccess&&typeof e.loadBalancer=="string"),{message:E.DIRECT_ACCESS.NO_LOAD_BALANCER}).describe("Cluster-level configuration"),Ym=c.object({path:c.string().optional(),host:c.string().optional(),priority:c.number().int(E.PRIORITY.INTEGER).min(1,E.PRIORITY.MIN).max(5e4,E.PRIORITY.MAX).optional(),healthCheckPath:c.string().optional()}).strict().describe("Path/host-based routing configuration"),C3=c.object({desiredCount:Qm.optional(),minCapacity:c.number().int(E.CAPACITY.MIN.INTEGER).min(0,E.CAPACITY.MIN.MIN_0).max(Ho,E.CAPACITY.MIN.MAX).optional(),maxCapacity:c.number().int(E.CAPACITY.MAX.INTEGER).min(1,E.CAPACITY.MAX.MIN_1).max(Ho,E.CAPACITY.MAX.MAX).optional(),scalingType:c.enum(Om).optional()}).strict().refine(ta.check,ta.params).describe("ECS service scaling configuration"),ER=c.object({name:bR,docker:Qr.optional(),needsDatabaseConnection:c.boolean().optional(),needsStorageConnection:c.boolean().optional(),needsMessagingConnection:c.boolean().optional(),image:c.string().optional(),containers:c.array(T3).optional(),routing:c.union([Ym,c.array(Ym).min(1)]).optional(),serviceType:c.enum(au).optional(),cpu:sx.optional(),memoryLimitMiB:su(512).optional(),desiredCount:Qm.optional(),scaling:Mt(C3).optional(),capacityProvider:ux,ec2Config:cx.optional(),ssmSecretsPath:c.string().regex(he.SSM_PATH,E.SSM_PATH).optional(),extraProperties:c.array(gt).optional(),alarms:zP.optional()}).strict().superRefine((e,t)=>{fR(e)||t.addIssue({code:"custom",path:["docker"],message:E.IMAGE_DOCKER_MUTEX})}).describe("Configuration for a service in an ECS cluster"),yu=c.object({name:be,type:_3,needsConnection:c.boolean(),connectedDatabase:c.array(c.string().min(1,E.REQUIRED.CONNECTED_RESOURCE_NAME)).optional(),connectedStorage:c.array(c.string().min(1,E.REQUIRED.CONNECTED_RESOURCE_NAME)).optional(),connectedMessaging:c.array(c.string().min(1,E.REQUIRED.CONNECTED_RESOURCE_NAME)).optional(),cluster:SR.optional(),services:c.array(ER).optional(),docker:Qr.partial().optional(),deployment:c.enum(Nm).optional(),codePath:c.string().optional(),timeout:c.number().int(E.LAMBDA.TIMEOUT.INTEGER).min(Mm,E.LAMBDA.TIMEOUT.MIN).max(Fm,E.LAMBDA.TIMEOUT.MAX).optional(),memory:qo.optional(),handler:c.string().optional(),runtime:yR.optional(),environment:Xo.optional(),secrets:Xo.optional(),eventSources:c.array(vR).optional(),functionUrl:c.object({authType:c.enum(iu)}).strict().optional(),description:c.string().optional(),scheduleExpression:c.string().optional(),scheduleStackPlacement:c.enum(ea).optional(),architecture:c.enum(Pm).optional(),ephemeralStorageSize:c.number().int(E.EPHEMERAL_STORAGE.INTEGER).min(512,E.EPHEMERAL_STORAGE.MIN).max(10240,E.EPHEMERAL_STORAGE.MAX).optional(),functionName:c.string().optional(),ssmSecrets:c.array(c.string()).optional(),ssmSecretsPath:c.string().optional(),alarms:GP.optional(),instanceType:lx.optional(),enableSSH:c.boolean().optional(),keyName:c.string().optional(),userData:c.string().optional(),securityGroups:c.array(c.string()).optional(),variableName:c.string().optional(),extraProperties:c.array(gt).optional()}).strict().superRefine((e,t)=>{if(e.type==="ecs"&&e.services)for(let r=0;r<e.services.length;r++){let i=e.services[r];i?.ec2Config?.instanceType&&!i.ec2Config.amiHardwareType&&vi(i.ec2Config.instanceType)!=="ARM"&&t.addIssue({code:"custom",message:`Service '${i.name??r}' uses instance type '${i.ec2Config.instanceType}' (x86), which requires Docker images built for linux/amd64. The default build targets linux/arm64 (Graviton). Use a Graviton instance type (t4g, c6g, r6g, m6g, etc.) or set amiHardwareType: "STANDARD" to acknowledge x86.`,path:["services",r,"ec2Config","instanceType"]})}e.type==="lambda"&&e.deployment==="container"&&e.architecture==="X86_64"&&t.addIssue({code:"custom",message:"Lambda architecture 'X86_64' requires Docker images built for linux/amd64, but the default build targets linux/arm64. Use 'ARM_64' for Graviton Lambdas (recommended) or ensure your build pipeline targets linux/amd64.",path:["architecture"]})}),Fae=c.object({appName:at,clusterName:be,containerPort:ra,nameProvidedByFlag:c.boolean().optional(),ecrRepository:c.string().optional(),capacityProvider:ux.optional(),useAppEcr:c.boolean().optional(),desiredCount:Qm.optional(),cpu:sx.optional(),memoryLimitMiB:su(512).optional(),minCapacity:hR.optional(),maxCapacity:gR.optional(),ec2Config:cx.optional(),connectionConfig:gu.optional()}).strict().refine(ta.check,ta.params),Lae=c.object({appName:at,functionName:be,nameProvidedByFlag:c.boolean().optional(),lambdaType:c.enum(["basic","web","custom"]).optional(),ecrRepository:c.string().optional(),timeout:c.number().int(E.LAMBDA.TIMEOUT.INTEGER).min(Mm,E.LAMBDA.TIMEOUT.MIN).max(Fm,E.LAMBDA.TIMEOUT.MAX).optional(),memory:qo.optional(),enableFunctionUrl:c.boolean().optional(),description:c.string().optional(),enableCors:c.boolean().optional(),corsOrigins:c.string().optional(),corsHeaders:c.string().optional(),corsMethods:c.array(c.enum(PP)).optional(),corsCredentials:c.boolean().optional(),connectionConfig:gu.optional()}).strict(),Uae=c.object({appName:at,instanceName:be,nameProvidedByFlag:c.boolean().optional(),instanceType:lx.optional(),enableSSH:c.boolean().optional(),minCapacity:hR.optional(),maxCapacity:gR.optional(),connectionConfig:gu.optional()}).strict().refine(ta.check,ta.params),zae=c.object({appName:at,clusterName:be,serviceName:bR,capacityProvider:ux,containerPort:ra.optional(),cpu:sx.optional(),memoryLimitMiB:su(512).optional(),desiredCount:Qm.optional(),ec2Config:cx.optional(),routing:c.union([Ym,c.array(Ym).min(1)]).optional(),docker:Qr.partial().optional(),nameProvidedByFlag:c.boolean().optional(),connectionConfig:gu.optional()}).strict(),dx=c.object({appName:at,computeName:be,nameProvidedByFlag:c.boolean().optional(),connectionConfig:gu.optional()}).strict(),I3=dx.extend({type:c.literal("ecs"),cluster:SR.optional(),services:c.array(ER).min(1,E.SERVICE.MIN_REQUIRED),docker:Qr.partial().optional()}).strict().refine(e=>{let t=e.services.filter(r=>r.containers?.some(i=>i.port));return t.length>1?t.every(r=>(Array.isArray(r.routing)?r.routing:r.routing?[r.routing]:[]).some(i=>i.path||i.host)):!0},{message:E.SERVICE.ROUTING_REQUIRED}).refine(e=>{let t=e.services.map(r=>r.name);return new Set(t).size===t.length},{message:E.SERVICE.UNIQUE_WITHIN_CLUSTER}),D3=dx.extend({type:c.literal("lambda"),timeout:c.number().int(E.LAMBDA.TIMEOUT.INTEGER).min(Mm,E.LAMBDA.TIMEOUT.MIN).max(Fm,E.LAMBDA.TIMEOUT.MAX).optional(),memory:qo.optional(),handler:c.string().optional(),runtime:yR.optional(),environment:Xo.optional(),secrets:Xo.optional(),description:c.string().optional(),functionUrl:c.union([c.object({authType:c.enum(iu).optional()}).strict(),c.literal(!1)]).optional(),eventSources:c.array(vR).optional()}).strict(),k3=dx.extend({type:c.literal("ec2"),instanceType:lx.optional(),enableSSH:c.boolean().optional(),keyName:c.string().optional(),userData:c.string().optional(),securityGroups:c.array(c.string()).optional()}).strict(),Bae=c.discriminatedUnion("type",[I3,D3,k3]),mR=c.object({path:c.string().min(1,E.REQUIRED.ROUTING_PATH),priority:c.number().int(E.PRIORITY.INTEGER).min(1,E.PRIORITY.MIN).max(5e4,E.PRIORITY.MAX).optional()}).strict(),AR=c.object({name:c.string().min(1,E.REQUIRED.SERVICE_NAME).max(255,E.MAX_LENGTH.SERVICE_NAME).regex(he.RESOURCE_NAME,E.RESOURCE_NAME),serviceType:c.enum(au).optional(),docker:Qr.partial().optional(),containerPort:ra.optional(),needsDatabaseConnection:c.boolean().optional(),routing:c.union([mR,c.array(mR).min(1)]).optional()}).strict().superRefine((e,t)=>{e.serviceType==="worker"&&(e.containerPort!==void 0&&t.addIssue({code:"custom",path:["containerPort"],message:"Worker services are not reachable inbound; remove containerPort."}),e.routing!==void 0&&t.addIssue({code:"custom",path:["routing"],message:"Worker services have no ALB route; remove routing."}))}),Gae=c.object({appName:at,instanceType:c.string().optional()}).strict();var px=c.object({memorySize:qo.optional(),timeout:c.number().int(E.LAMBDA.TIMEOUT.INTEGER).min(1,E.LAMBDA.TIMEOUT.MIN).max(900,E.LAMBDA.TIMEOUT.MAX).optional(),ephemeralStorageSize:c.number().int(E.EPHEMERAL_STORAGE.INTEGER).min(512,E.EPHEMERAL_STORAGE.MIN).max(10240,E.EPHEMERAL_STORAGE.MAX).optional()}).strict(),xR=c.object({type:c.enum(HA).optional(),databaseName:c.string().optional(),databaseEngine:c.enum(Zo).optional(),deletionProtection:c.boolean().optional(),backupRetention:na.optional(),port:Bm.optional(),publiclyAccessible:c.boolean().optional(),allowedIpCidr:c.string().optional(),instanceType:c.string().optional(),allocatedStorage:c.number().int(E.ALLOCATED_STORAGE.INTEGER).min(20,E.ALLOCATED_STORAGE.MIN).max(65536,E.ALLOCATED_STORAGE.MAX).optional(),multiAz:c.boolean().optional(),readReplica:Wm.optional(),writer:lu.optional(),readers:du.optional(),allowVpcAccess:c.boolean().optional(),monitoringInterval:uu.optional(),preferredMaintenanceWindow:c.string().optional(),databaseInsights:Km.optional(),proxy:Vm.optional(),credentials:Gm.optional(),encryption:Zm.optional(),snapshotIdentifier:c.string().optional(),snapshotUsername:c.string().optional()}).strict(),_R=c.object({server:px.optional(),imageOptimisation:px.optional(),revalidation:px.optional()}).strict(),mx=c.object({versioned:c.boolean().optional()}).strict(),TR=c.object({assets:mx.optional(),cache:mx.optional(),media:mx.optional()}).strict(),N3=c.object({visibilityTimeout:c.number().int(E.SQS.VISIBILITY_TIMEOUT.INTEGER).min(0,E.SQS.VISIBILITY_TIMEOUT.MIN).max(43200,E.SQS.VISIBILITY_TIMEOUT.MAX).optional(),messageRetentionPeriod:c.number().int(E.SQS.RETENTION_PERIOD.INTEGER).min(60,E.SQS.RETENTION_PERIOD.MIN).max(1209600,E.SQS.RETENTION_PERIOD.MAX).optional(),maxMessageSize:c.number().int(E.MAX_MESSAGE_SIZE.INTEGER).min(1024,E.MAX_MESSAGE_SIZE.MIN).max(262144,E.MAX_MESSAGE_SIZE.MAX).optional(),deadLetterQueue:c.union([c.literal(!1),c.object({enabled:c.boolean().optional(),maxReceiveCount:c.number().int(E.DLQ.MAX_RECEIVE_COUNT.INTEGER).min(1,E.DLQ.MAX_RECEIVE_COUNT.MIN).max(1e3,E.DLQ.MAX_RECEIVE_COUNT.MAX).optional()}).strict()]).optional()}).strict(),CR=c.object({revalidationQueue:N3.optional()}).strict(),IR=c.object({domainNames:c.array(c.string()).optional(),certificateArn:c.string().optional()}).strict(),DR=c.record(c.string().regex(he.ENV_VAR_NAME,E.ENV_VAR_NAME),c.string()).optional(),fx=c.object({type:c.literal("payload"),name:c.string().min(1,E.REQUIRED.PATTERN_NAME),domain:c.string().optional(),database:xR.optional(),compute:_R.optional(),storage:TR.optional(),messaging:CR.optional(),cdn:IR.optional(),environment:DR}).strict(),hx=c.object({type:c.literal("nextjs"),name:c.string().min(1,E.REQUIRED.PATTERN_NAME),domain:c.string().optional(),database:xR.optional(),compute:_R.optional(),storage:TR.optional(),messaging:CR.optional(),cdn:IR.optional(),environment:DR}).strict(),gx=c.enum(qc),w3=c.object({command:c.string().min(1,E.REQUIRED.BUILD_COMMAND),outputDir:c.string().min(1,E.REQUIRED.OUTPUT_DIR)}).strict(),P3=c.object({maxAgeDays:c.number().optional(),includeSubdomains:c.boolean().optional(),preload:c.boolean().optional()}).strict(),R3=c.object({headers:c.boolean().optional(),contentSecurityPolicy:c.string().optional(),hsts:c.union([c.literal(!1),P3]).optional()}).strict(),O3=c.object({to:c.string().min(1,E.REQUIRED.FORMS_TO).regex(he.EMAIL,E.EMAIL),from:c.string().regex(he.EMAIL,E.EMAIL).optional(),corsOrigin:c.string().regex(he.HTTP_ORIGIN,"corsOrigin must be an exact origin such as https://example.com (no path, no trailing slash)").optional(),maxConcurrency:c.number().int().min(1).max(100).optional()}).strict(),$3=c.object({behaviours:c.array(c.unknown()).optional(),priceClass:c.enum(Yc).optional(),invalidateOnDeploy:c.boolean().optional()}).strict(),j3=c.object({type:c.literal("basic-auth"),username:c.string().min(1,"accessGate.username must not be empty"),password:c.string().min(1,"accessGate.password must not be empty")}).strict(),vu=c.object({type:c.literal("staticsite"),name:c.string().min(1,E.REQUIRED.PATTERN_NAME),source:c.string().min(1,E.REQUIRED.SOURCE),build:w3,routing:gx.optional(),security:R3.optional(),domain:c.string().optional(),zoneName:c.string().optional(),hostedZoneId:c.string().optional(),forms:O3.optional(),cdn:$3.optional(),accessGate:j3.optional()}).strict().superRefine((e,t)=>{if(e.forms===void 0)return;let r=e.domain;if(r===void 0||r===""){t.addIssue({code:"custom",path:["domain"],message:"A domain is required when forms are enabled: SES sends only from a verified identity, and the site's domain is the identity the pattern verifies"});return}let i=e.forms.from;i!==void 0&&!Em(i,r)&&t.addIssue({code:"custom",path:["forms","from"],message:`forms.from must be an address at ${r} (the verified SES identity) \u2014 for example noreply@${r}. Use forms.to for the recipient.`})}),bu=c.discriminatedUnion("type",[fx,hx,vu]),kR=c.enum(["lightweight","standard","resilient","custom"]),NR=c.object({type:c.enum(HA),instanceType:c.string().optional(),backupRetention:na.optional(),deletionProtection:c.boolean().optional(),encryption:c.union([c.object({useCMK:c.literal(!0)}).strict(),c.literal(!1)]).optional()}).strict(),wR=c.object({memorySize:qo.optional(),timeout:c.number().int(E.LAMBDA.TIMEOUT.INTEGER).min(1,E.LAMBDA.TIMEOUT.MIN).max(900,E.LAMBDA.TIMEOUT.MAX).optional()}).strict();var PR=c.object({appName:at,type:qA,pattern:YA.optional(),patternConfig:bu.optional(),owner:c.string().optional(),tags:c.record(c.string(),c.string()).optional(),vpcId:c.string().optional(),network:ia.optional(),backup:LP.optional(),tunnel:UP.optional(),additionalNetworks:c.array(sR).optional(),database:c.array(pu),s3:c.array(mu),compute:c.array(yu),dynamodb:c.array(tR).optional(),clickhouse:c.array(rR).optional(),sqs:c.array(fu).optional(),cdn:hu.optional(),customCodeBlocks:c.array(FP).optional(),additionalManagedImports:c.array(c.object({moduleSpecifier:c.string(),namedImports:c.array(c.string()),defaultImport:c.string().optional()}).strict()).optional()}).strict(),uoe=c.object({name:at,type:qA,pattern:YA.optional(),patternTier:kR.optional(),patternDomain:c.string().optional(),source:c.string().min(1,E.REQUIRED.SOURCE).optional(),buildCommand:c.string().min(1,E.REQUIRED.BUILD_COMMAND).optional(),outputDir:c.string().min(1,E.REQUIRED.OUTPUT_DIR).optional(),routing:gx.optional(),formsTo:c.string().min(1,E.REQUIRED.FORMS_TO).regex(he.EMAIL,E.EMAIL).optional(),corsOrigin:c.string().regex(he.HTTP_ORIGIN,"corsOrigin must be an exact origin such as https://example.com (no path, no trailing slash)").optional(),customDatabase:NR.optional(),customCompute:wR.optional(),region:c.string().optional(),owner:c.string().optional(),includeDatabase:c.boolean().optional(),databaseName:c.string().min(1,E.DATABASE.NAME.REQUIRED).max(63,E.DATABASE.NAME.MAX_LENGTH).optional(),vpcId:c.string().optional(),network:cR.optional(),services:c.array(AR).optional(),snapshotIdentifier:c.string().optional(),snapshotUsername:c.string().optional()}).strict().superRefine((e,t)=>{e.formsTo!==void 0&&(e.patternDomain!==void 0&&e.patternDomain!==""||t.addIssue({code:"custom",path:["patternDomain"],message:"A domain is required when forms are enabled: SES sends only from a verified identity, and the site's domain is the identity the pattern verifies"}))}),yx=c.object({name:be,localResource:c.string().min(1),remoteApp:c.string().min(1),remoteResource:c.string().min(1),permission:c.enum(["read","write","read-write"]),remoteArn:c.string().optional()}).strict();var M3=["fjall-managed","external","external-manual"],foe=c.enum(M3);var RR=c.object({givenName:c.string().min(1),familyName:c.string().min(1),displayName:c.string().min(1).optional(),expires:c.string().min(1).optional()}).strict(),OR=c.object({name:c.string().min(1),path:c.string().min(1).optional()}).strict(),F3=c.union([c.object({managedPolicyArn:c.string().min(1)}).strict(),c.object({customerManagedPolicy:OR}).strict()]),L3=c.object({managedPolicies:c.array(c.string().min(1)).optional(),inlinePolicy:c.record(c.string(),c.unknown()).optional(),customerManagedPolicies:c.array(OR).optional(),permissionsBoundary:F3.optional(),sessionDuration:c.string().min(1).optional(),description:c.string().optional(),accounts:c.union([c.array(c.string().min(1)),c.literal("all")]).optional(),includeManagementAccount:c.boolean().optional(),groups:c.array(c.string().min(1)).optional()}).strict(),U3=c.object({description:c.string().optional()}).strict(),ef=c.string().regex(he.EMAIL,E.EMAIL),vx={groups:c.record(c.string(),U3).optional(),permissionSets:c.record(c.string(),L3).optional(),memberships:c.record(c.string(),c.array(ef)).optional(),resolutionVersion:c.number().int().min(1).optional(),defaultPermissionSets:c.boolean().optional()},z3=c.discriminatedUnion("source",[c.object({...vx,source:c.literal("fjall-managed"),users:c.record(ef,RR)}).strict(),c.object({...vx,source:c.literal("external")}).strict(),c.object({...vx,source:c.literal("external-manual"),users:c.record(ef,RR).optional()}).strict()]),bx=c.object({name:be,type:c.literal("organisation").optional(),organisationName:c.string().min(1).optional(),orgEmail:ef.optional(),accounts:c.unknown().optional(),accountIds:c.record(c.string(),c.string()).optional(),identityCentre:c.union([z3,c.literal(!1)]).optional(),allowedRegions:c.array(c.string().min(1)).optional()}).strict();var B3=Object.defineProperty,G3=(e,t)=>B3(e,"name",{value:t,configurable:!0}),V3=[1,3,5,7,14,30,60,90,120,150,180,365,400,545,731,1827,3653],tf=c.object({buildkiteQueue:c.string().min(1,"buildkiteQueue cannot be empty").max(100).regex(/^[a-zA-Z0-9-_]+$/,"buildkiteQueue must be alphanumeric with hyphens/underscores"),buildkiteOrgSlug:c.string().min(1,"buildkiteOrgSlug cannot be empty").max(100).regex(/^[a-z0-9-]+$/,"buildkiteOrgSlug must be a lowercase Buildkite organisation slug"),agentTokenSsmParameterName:c.string().min(2).regex(/^\//,"agentTokenSsmParameterName must be a full path (leading /)").optional(),agentTokenKmsKeyArn:c.string().min(1).optional(),fjallApiKeySsmParameterName:c.string().min(2).regex(/^\//,"fjallApiKeySsmParameterName must be a full path (leading /)").optional(),instanceType:c.string().min(1).default("c8g.xlarge"),agentVolumeSizeGib:c.number().int().min(20).max(1e3).default(250),agentMinInstances:c.number().int().min(0).default(0),agentMaxInstances:c.number().int().min(1).default(2),agentsPerInstance:c.number().int().min(1).default(1),spotCapacityPercentage:c.number().int().min(0).max(100).default(0),scaleInIdlePeriodSeconds:c.number().int().min(60).default(600),disconnectAfterUptimeSeconds:c.number().int().min(3600).default(86400),maxInstanceLifetimeDays:c.number().int().min(1).max(365).default(7),terminateInstanceAfterJob:c.boolean().default(!1),purgeBuildsOnDiskFull:c.boolean().default(!0),terminateInstanceOnDiskFull:c.boolean().default(!1),logRetentionDays:c.number().int().min(1).default(30),agentLogRetentionDays:c.literal(V3).default(7),buildkiteAgentRelease:c.enum(["stable","beta","edge"]).default("stable"),buildkiteAgentTags:c.string().default(""),buildkiteAgentTimestampLines:c.boolean().default(!1),buildkiteAgentExperiments:c.string().default(""),buildkiteAgentTracingBackend:c.enum(["","datadog","opentelemetry"]).default(""),buildkiteAgentCancelGracePeriodSeconds:c.number().int().min(10).default(60),enableSecretsPlugin:c.boolean().default(!0),enableEcrPlugin:c.boolean().default(!1),enableDockerLoginPlugin:c.boolean().default(!1),enableDockerUserNamespaceRemap:c.boolean().default(!0),enableDockerExperimental:c.boolean().default(!1),dockerNetworkingProtocol:c.enum(["ipv4","dualstack"]).default("ipv4"),enableInstanceStorage:c.boolean().default(!1),mountTmpfsAtTmp:c.boolean().default(!0),buildkiteAgentEnableGitMirrors:c.boolean().default(!1),bootstrapScriptUrl:c.string().default(""),agentEnvFileUrl:c.string().default(""),scalerEventSchedulePeriod:c.string().min(1).default("1 minute"),scalerMinPollInterval:c.string().min(1).default("10s"),scaleOutFactor:c.string().min(1).default("1.0"),scaleOutWaitingForJobs:c.boolean().default(!1),rolePermissionsBoundaryArn:c.string().min(1).optional(),alarmSnsTopicArn:c.string().min(1).optional(),applicationId:c.string().min(1).optional(),costAllocationEnvironment:c.string().min(1).optional(),costAllocationOwner:c.string().min(1).optional()}).strict(),W3=tf.refine(e=>e.agentMinInstances<=e.agentMaxInstances,{message:"agentMinInstances must be <= agentMaxInstances"});function K3(e){let t=W3.safeParse(e);if(!t.success){let r=t.error.issues.map(i=>`  - ${i.path.join(".")||"(root)"}: ${i.message}`).join(`
 `);throw new Error(`Buildkite: invalid props:
 ${r}`)}return t.data}G3(K3,"validateBuildkiteProps");var Z3=Object.defineProperty,H3=(e,t)=>Z3(e,"name",{value:t,configurable:!0});function J3(e){return`FjallDeployBoundary${e}`}H3(J3,"deployBoundaryName");var Sx={Sid:"FjallInheritAdministratorAccess",Effect:"Allow",Action:"*",Resource:"*"},$R=[{Sid:"FjallDenyOrgAndAccountEscape",Effect:"Deny",Action:["organizations:LeaveOrganization","account:CloseAccount"],Resource:"*"},{Sid:"FjallDenyDisableAuditLogging",Effect:"Deny",Action:["cloudtrail:StopLogging"],Resource:"*"},{Sid:"FjallDenyBoundarySelfEscape",Effect:"Deny",Action:["iam:DeleteRolePermissionsBoundary"],Resource:"*"},{Sid:"FjallDenyDisableKmsKey",Effect:"Deny",Action:["kms:DisableKey"],Resource:"*"}],jR=[...$R,{Sid:"FjallDenyStandingHumanCredentials",Effect:"Deny",Action:["iam:CreateUser","iam:CreateLoginProfile","iam:CreateAccessKey","iam:CreateAccountAlias"],Resource:"*"},{Sid:"FjallDenyDisableConfigRecorder",Effect:"Deny",Action:["config:StopConfigurationRecorder"],Resource:"*"}],X3=[...jR,{Sid:"FjallDenyAccountPasswordPolicyTamper",Effect:"Deny",Action:["iam:UpdateAccountPasswordPolicy","iam:DeleteAccountPasswordPolicy"],Resource:"*"},{Sid:"FjallDenyDisableDefaultEbsEncryption",Effect:"Deny",Action:["ec2:DisableEbsEncryptionByDefault"],Resource:"*"}],Noe={foundation:[Sx,...$R],compliance:[Sx,...jR],hardened:[Sx,...X3]};var q3=Object.defineProperty,ot=(e,t)=>q3(e,"name",{value:t,configurable:!0});var xx="sts.amazonaws.com";function Y3(e){return`FjallDevDeploy${e}`}ot(Y3,"devDeployRoleName");function Q3(e){return`FjallDevProvisioner${e}`}ot(Q3,"devProvisionerRoleName");function eW(e){return`FjallDevSyncWriter${e}`}ot(eW,"devSyncWriterRoleName");var tW="FjallDevBoundary";function MR(e){return`arn:aws:iam::${e}:policy/${tW}`}ot(MR,"devBoundaryPolicyArn");function FR(e){return`org:${e}:dev-provisioner`}ot(FR,"devProvisionerSubject");function LR(e){return`org:${e}:dev-sync`}ot(LR,"devSyncSubject");function Ex(e,t){return`org:${e}:acct:${t}`}ot(Ex,"deployAccountSubject");function Ax(e){return`org:${e}:*`}ot(Ax,"genericMachineSubject");var rW=["discovery","connection","org-setup","dev-substrate-setup"];function UR(e,t){return`org:${e}:${t}`}ot(UR,"serviceSubject");function nW(e){let{fjallOrgId:t,providerArn:r,issuerDomain:i,accountTier:n,accountId:a}=e,o=e.machineTrustMode??"expanded",s={[`${i}:aud`]:xx},u;if(o==="account-scoped"){if(n===void 0||!um(n)||a===void 0)throw new Error(`machineTrustMode "account-scoped" requires a governance accountTier and an accountId (got tier: ${String(n)}, accountId ${a===void 0?"absent":"present"}) \u2014 refusing to fall back to the generic machine subject: a silent fallback would re-widen the trust the \xA74.4a Step-3 contract removes`);u=[Ex(t,a)]}else a!==void 0?u=[Ax(t),Ex(t,a)]:u=Ax(t);return[{Sid:"FjallMachineSubject",Effect:"Allow",Principal:{Federated:r},Action:"sts:AssumeRoleWithWebIdentity",Condition:{StringEquals:{...s,[`${i}:sub`]:u}}},{Sid:"FjallUserSubjects",Effect:"Allow",Principal:{Federated:r},Action:"sts:AssumeRoleWithWebIdentity",Condition:{StringEquals:s,StringLike:{[`${i}:sub`]:`org:${t}:user:*`}}},{Sid:"FjallServiceSubjects",Effect:"Allow",Principal:{Federated:r},Action:"sts:AssumeRoleWithWebIdentity",Condition:{StringEquals:{...s,[`${i}:sub`]:rW.map(m=>UR(t,m))}}}]}ot(nW,"buildNarrowedDeployTrustStatements");function iW(e){let{fjallOrgId:t,providerArn:r,issuerDomain:i,accountId:n}=e;return[{Sid:"FjallDevSubjectsThisAccount",Effect:"Allow",Principal:{Federated:r},Action:"sts:AssumeRoleWithWebIdentity",Condition:{StringEquals:{[`${i}:aud`]:xx},StringLike:{[`${i}:sub`]:`org:${t}:dev:${n}:*`}}}]}ot(iW,"buildDevDeployTrustStatements");function _x(e){let{providerArn:t,issuerDomain:r,sid:i,subject:n}=e;return[{Sid:i,Effect:"Allow",Principal:{Federated:t},Action:"sts:AssumeRoleWithWebIdentity",Condition:{StringEquals:{[`${r}:aud`]:xx,[`${r}:sub`]:n}}}]}ot(_x,"buildServiceSubjectTrustStatements");function aW(e){return _x({...e,sid:"FjallDevProvisionerSubject",subject:FR(e.fjallOrgId)})}ot(aW,"buildDevProvisionerTrustStatements");function oW(e){return _x({...e,sid:"FjallDevSyncSubject",subject:LR(e.fjallOrgId)})}ot(oW,"buildDevSyncWriterTrustStatements");function sW({accountId:e}){return[{Sid:"FjallDevEcsTaggedMutations",Effect:"Allow",Action:["ecs:UpdateService","ecs:DeleteService","ecs:RunTask","ecs:StopTask"],Resource:`arn:aws:ecs:*:${e}:*`,Condition:{StringEquals:{"aws:ResourceTag/fjall:dev":"true"}}},{Sid:"FjallDevEcsTaggedCreates",Effect:"Allow",Action:["ecs:RegisterTaskDefinition","ecs:CreateService"],Resource:"*",Condition:{StringEquals:{"aws:RequestTag/fjall:dev":"true"}}},{Sid:"FjallDevEcsTagOnCreate",Effect:"Allow",Action:["ecs:TagResource"],Resource:`arn:aws:ecs:*:${e}:*`,Condition:{StringEquals:{"ecs:CreateAction":["RegisterTaskDefinition","CreateService","RunTask"]}}},{Sid:"FjallDevEcsReads",Effect:"Allow",Action:["ecs:Describe*","ecs:List*"],Resource:"*"},{Sid:"FjallDevEcsDeregisterTaskDefinition",Effect:"Allow",Action:["ecs:DeregisterTaskDefinition"],Resource:`arn:aws:ecs:*:${e}:task-definition/fjall-dev-*`},{Sid:"FjallDevElbTaggedMutations",Effect:"Allow",Action:["elasticloadbalancing:ModifyRule","elasticloadbalancing:DeleteRule","elasticloadbalancing:ModifyTargetGroup","elasticloadbalancing:ModifyTargetGroupAttributes","elasticloadbalancing:DeleteTargetGroup","elasticloadbalancing:RegisterTargets","elasticloadbalancing:DeregisterTargets"],Resource:`arn:aws:elasticloadbalancing:*:${e}:*`,Condition:{StringEquals:{"aws:ResourceTag/fjall:dev":"true"}}},{Sid:"FjallDevElbTaggedCreates",Effect:"Allow",Action:["elasticloadbalancing:CreateTargetGroup","elasticloadbalancing:CreateRule"],Resource:`arn:aws:elasticloadbalancing:*:${e}:*`,Condition:{StringEquals:{"aws:RequestTag/fjall:dev":"true"}}},{Sid:"FjallDevElbTagOnCreate",Effect:"Allow",Action:["elasticloadbalancing:AddTags"],Resource:`arn:aws:elasticloadbalancing:*:${e}:*`,Condition:{StringEquals:{"elasticloadbalancing:CreateAction":["CreateTargetGroup","CreateRule"]}}},{Sid:"FjallDevElbReads",Effect:"Allow",Action:["elasticloadbalancing:Describe*"],Resource:"*"},{Sid:"FjallDevSsmDevTree",Effect:"Allow",Action:["ssm:GetParameter*","ssm:PutParameter","ssm:AddTagsToResource"],Resource:`arn:aws:ssm:*:${e}:parameter/fjall/dev/*`},{Sid:"FjallDevLogsMutations",Effect:"Allow",Action:["logs:PutRetentionPolicy","logs:DeleteLogGroup"],Resource:`arn:aws:logs:*:${e}:log-group:/fjall/dev/*`},{Sid:"FjallDevLogsTaggedCreate",Effect:"Allow",Action:["logs:CreateLogGroup","logs:TagResource"],Resource:`arn:aws:logs:*:${e}:log-group:/fjall/dev/*`,Condition:{StringEquals:{"aws:RequestTag/fjall:dev":"true"}}},{Sid:"FjallDevLogsRead",Effect:"Allow",Action:["logs:GetLogEvents","logs:DescribeLogStreams","logs:FilterLogEvents"],Resource:`arn:aws:logs:*:${e}:log-group:/fjall/dev/*`},{Sid:"FjallDevLogsDescribeGroups",Effect:"Allow",Action:["logs:DescribeLogGroups"],Resource:"*"},{Sid:"FjallDevKmsViaDevAlias",Effect:"Allow",Action:["kms:Encrypt","kms:Decrypt","kms:GenerateDataKey"],Resource:`arn:aws:kms:*:${e}:key/*`,Condition:{"ForAnyValue:StringLike":{"kms:ResourceAliases":"alias/fjall-dev-*"}}},{Sid:"FjallDevKmsSsmSecureString",Effect:"Allow",Action:["kms:Encrypt","kms:Decrypt","kms:GenerateDataKey"],Resource:`arn:aws:kms:*:${e}:key/*`,Condition:{StringLike:{"kms:ViaService":"ssm.*.amazonaws.com"}}},{Sid:"FjallDevEcrAuthToken",Effect:"Allow",Action:["ecr:GetAuthorizationToken"],Resource:"*"},{Sid:"FjallDevEcrPushPull",Effect:"Allow",Action:["ecr:PutImage","ecr:InitiateLayerUpload","ecr:UploadLayerPart","ecr:CompleteLayerUpload","ecr:BatchCheckLayerAvailability","ecr:BatchGetImage","ecr:GetDownloadUrlForLayer","ecr:DescribeImages"],Resource:`arn:aws:ecr:*:${e}:repository/*`},{Sid:"FjallDevPassDevPathRoles",Effect:"Allow",Action:["iam:PassRole"],Resource:`arn:aws:iam::${e}:role/fjall/dev/*`}]}ot(sW,"buildDevDeployPolicyStatements");function cW({accountId:e}){return[{Sid:"FjallDevProvisionerBoundedRoleWrites",Effect:"Allow",Action:["iam:CreateRole","iam:PutRolePolicy","iam:AttachRolePolicy"],Resource:`arn:aws:iam::${e}:role/fjall/dev/*`,Condition:{StringEquals:{"iam:PermissionsBoundary":MR(e)}}},{Sid:"FjallDevProvisionerPathRoleOps",Effect:"Allow",Action:["iam:DeleteRole","iam:DeleteRolePolicy","iam:DetachRolePolicy","iam:ListRolePolicies","iam:TagRole"],Resource:`arn:aws:iam::${e}:role/fjall/dev/*`},{Sid:"FjallDevProvisionerListRoles",Effect:"Allow",Action:["iam:ListRoles"],Resource:"*"},{Sid:"FjallDevProvisionerDevMasterSecrets",Effect:"Allow",Action:["secretsmanager:GetSecretValue"],Resource:`arn:aws:secretsmanager:*:${e}:secret:fjall-dev-*`},{Sid:"FjallDevProvisionerKmsDecryptViaSecretsManager",Effect:"Allow",Action:["kms:Decrypt"],Resource:`arn:aws:kms:*:${e}:key/*`,Condition:{StringLike:{"kms:ViaService":"secretsmanager.*.amazonaws.com"}}},{Sid:"FjallDevProvisionerDataApi",Effect:"Allow",Action:["rds-data:ExecuteStatement","rds-data:BatchExecuteStatement","rds-data:BeginTransaction","rds-data:CommitTransaction","rds-data:RollbackTransaction"],Resource:`arn:aws:rds:*:${e}:cluster:fjall-dev-*`},{Sid:"FjallDevProvisionerMetrics",Effect:"Allow",Action:["cloudwatch:GetMetricData"],Resource:"*"},{Sid:"FjallDevProvisionerOrphanDiscovery",Effect:"Allow",Action:["tag:GetResources"],Resource:"*"},{Sid:"FjallDevProvisionerSsmTeardown",Effect:"Allow",Action:["ssm:DeleteParameter*"],Resource:`arn:aws:ssm:*:${e}:parameter/fjall/dev/*`},{Sid:"FjallDevProvisionerLogsTeardown",Effect:"Allow",Action:["logs:DeleteLogGroup"],Resource:`arn:aws:logs:*:${e}:log-group:/fjall/dev/*`},{Sid:"FjallDevProvisionerTaggedTeardown",Effect:"Allow",Action:["ecs:UpdateService","ecs:StopTask","ecs:DeleteService","elasticloadbalancing:DeleteRule","elasticloadbalancing:DeleteTargetGroup","elasticloadbalancing:DeregisterTargets"],Resource:[`arn:aws:ecs:*:${e}:*`,`arn:aws:elasticloadbalancing:*:${e}:*`],Condition:{StringEquals:{"aws:ResourceTag/fjall:dev":"true"}}},{Sid:"FjallDevProvisionerTeardownReads",Effect:"Allow",Action:["ecs:Describe*","elasticloadbalancing:Describe*"],Resource:"*"},{Sid:"FjallDevProvisionerImageJanitor",Effect:"Allow",Action:["ecr:ListImages","ecr:DescribeImages","ecr:BatchDeleteImage"],Resource:`arn:aws:ecr:*:${e}:repository/*`},{Sid:"FjallDevProvisionerSsmReadAll",Effect:"Allow",Action:["ssm:GetParameter*"],Resource:`arn:aws:ssm:*:${e}:parameter/*`},{Sid:"FjallDevProvisionerKmsDecryptViaSsm",Effect:"Allow",Action:["kms:Decrypt"],Resource:`arn:aws:kms:*:${e}:key/*`,Condition:{StringLike:{"kms:ViaService":"ssm.*.amazonaws.com"}}}]}ot(cW,"buildDevProvisionerPolicyStatements");function uW({accountId:e}){return[{Sid:"FjallDevSyncPrefixReadWrite",Effect:"Allow",Action:["s3:GetObject","s3:PutObject"],Resource:`arn:aws:s3:::fjall-dev-sync-${e}-*/*`,Condition:{StringEquals:{"aws:ResourceAccount":e}}}]}ot(uW,"buildDevSyncWriterPolicyStatements");function lW({accountId:e}){return[{Sid:"FjallDevBoundarySsmDevRead",Effect:"Allow",Action:["ssm:GetParameter*"],Resource:`arn:aws:ssm:*:${e}:parameter/fjall/dev/*`},{Sid:"FjallDevBoundaryKmsDecryptDevAlias",Effect:"Allow",Action:["kms:Decrypt"],Resource:`arn:aws:kms:*:${e}:key/*`,Condition:{"ForAnyValue:StringLike":{"kms:ResourceAliases":"alias/fjall-dev-*"}}},{Sid:"FjallDevBoundarySyncPrefixReadWrite",Effect:"Allow",Action:["s3:GetObject","s3:PutObject"],Resource:`arn:aws:s3:::fjall-dev-sync-${e}-*/*`,Condition:{StringEquals:{"aws:ResourceAccount":e}}},{Sid:"FjallDevBoundarySlotLogs",Effect:"Allow",Action:["logs:CreateLogStream","logs:PutLogEvents"],Resource:`arn:aws:logs:*:${e}:log-group:/fjall/dev/*`},{Sid:"FjallDevBoundarySyncQueue",Effect:"Allow",Action:["sqs:ReceiveMessage","sqs:DeleteMessage","sqs:GetQueueUrl"],Resource:`arn:aws:sqs:*:${e}:fjall-dev-sync-${e}-*`}]}ot(lW,"buildDevBoundaryStatements");var dW=Object.defineProperty,Ht=(e,t)=>dW(e,"name",{value:t,configurable:!0});function J(e){return JSON.stringify(e)}Ht(J,"escapeStringLiteral");function Su(e){return e.map(J).join(", ")}Ht(Su,"formatStringArray");var pW="import:SharedAlarmTopicArn";function aa(e="    "){return`
@@ -702,8 +702,8 @@ ${sC}
 `)}Zr(Ua,"collapseBlankLines");function ig(e,t){if(t===void 0)return e;if(t==="minimal")return jU(e);if(t==="compact")return MU(e);let r=parseInt(t,10);return Number.isNaN(r)||r<=0?e:FU(e,r)}Zr(ig,"applyBudget");var aq=Object.defineProperty,SC=(e,t)=>aq(e,"name",{value:t,configurable:!0}),EC=!1;function AC(){EC=!0}SC(AC,"markAgentFailureRendered");function oq(){return EC}SC(oq,"agentFailureRendered");function sq(){EC=!1}SC(sq,"resetAgentFailureLatch");var cq=Object.defineProperty,$i=(e,t)=>cq(e,"name",{value:t,configurable:!0});function LU(e,t){switch(e.state){case"unstamped":case"incomplete":return!0;case"installed":return e.version!==t;case"missing":case"unreadable":return!1}}$i(LU,"isSkillStale");function uq(e){return`${e.current} -> ${e.latest}`}$i(uq,"formatUpdateAvailable");function lq(e){let t=LU(e.skill,e.current);if(!(e.update===null&&!t))return{...e.update!==null?{updateAvailable:{current:e.current,latest:e.update.latest,installSource:e.update.installSource}}:{},...t?{skillStale:!0}:{}}}$i(lq,"buildUpdateEnvelope");function UU(e){let t=[];if(e.updateAvailable!==void 0){let{current:r,latest:i,installSource:n}=e.updateAvailable;t.push(`updateAvailable: ${r} -> ${i}`),t.push(`upgrade: ${gm(n)}`)}return e.skillStale===!0&&t.push("skillStale: true"),t.length===0?"":`${t.join(`
 `)}
 `}$i(UU,"renderUpdateEnvelope");var ag,og=!1;function dq(e){ag=e,og=!1}$i(dq,"armUpdateEnvelope");function pq(){ag=void 0,og=!1}$i(pq,"disarmUpdateEnvelope");function zU(){if(!(og||ag===void 0)){og=!0;try{return ag()}catch(e){bn.debug("UpdateEnvelope","Envelope source failed",{error:ue(e instanceof Error?e.message:String(e))});return}}}$i(zU,"takeUpdateEnvelope");function Ys(){let e=zU();return e===void 0?"":UU(e)}$i(Ys,"takeUpdateEnvelopeTail");var mq=Object.defineProperty,za=(e,t)=>mq(e,"name",{value:t,configurable:!0}),k={success:za(e=>e.outcome==="success","success"),error:za(e=>e.outcome==="error","error"),empty:za(e=>e.outcome==="empty","empty"),unsupported:za(e=>e.outcome==="unsupported","unsupported"),successDryRun:za(e=>e.outcome==="success"&&e.dryRun==="true","successDryRun"),successOffline:za(e=>e.outcome==="success"&&e.offline==="true","successOffline"),errorWithCode:za(e=>t=>t.outcome==="error"&&t.errorCode===e,"errorWithCode")};var fq=Object.defineProperty,hq=(e,t)=>fq(e,"name",{value:t,configurable:!0}),gq=["account deploy","add","agent install-skill","agent session-context","apps create","apps describe","apps detect","apps list","assets compliance","assets list","assets show","assets summary","aws exec","build","ci run","ci setup","ci status","ci token create","ci token list","ci token revoke","ci verify","compliance fix","compliance fix --execute","connect","connect status","costs show","create account","create app","create domain","create org","deploy","deploy diff","deploy logs","deployments cancel","deployments force-release","deployments list","destroy","dev down","dev list","dev substrate down","dev up","domain","domain create","domain delegate","domain deploy","domain destroy","domain eject","domain export","domain import","domain list","domain records list","domain sync","domain verify","drift detect","drift repair","drift resume","fjall","history","home","import","list","login","metrics show","migrate identity","modify","org bind","org deploy","org get","org identity setup-google","platform deploy","remove","restore","secrets delete","secrets exec","secrets export","secrets get","secrets import","secrets list","secrets set","services","status","target get","target list","target set","token create","token list","token revoke","token show","tunnel","undo","unlock bucket","user add","user list","user rebind","user remove","validate"],yq=new Set(gq);function sg(e){return typeof e=="string"&&yq.has(e)}hq(sg,"isAgentWriterSurface");var Hl="fjall";var vq=Object.defineProperty,bq=(e,t)=>vq(e,"name",{value:t,configurable:!0}),BU=[{command:Hl,match:k.error,templates:["Run `fjall --help` to list the available commands"]},{command:"home",match:k.success,templates:["Run `fjall apps describe <name>` to see app details","Run `fjall deploy <name>` to deploy","Run `fjall status <name>` to check a specific app"]},{command:"home",match:k.empty,templates:[`Run \`${te.createApplicationAgent} --name "<name>"\` to create your first app`,`Run \`${te.connect}\` to connect an AWS account`]},{command:"apps list",match:k.success,templates:["Run `fjall apps describe <name>` to see app details","Run `fjall deploy <name>` to deploy",`Run \`${te.createApplicationAgent} --name "<name>"\` to create a new app`]},{command:"apps list",match:k.empty,templates:[`Run \`${te.createApplicationAgent} --name "<name>"\` to create your first app`,`Run \`${te.connect}\` to connect an AWS account first`]},{command:"apps describe",match:k.success,templates:["Run `fjall deploy <app>` to deploy","Run `fjall secrets list --app <app>` to list secrets","Run `fjall status <app>` to check health"]},{command:"apps detect",match:k.empty,templates:["Run `fjall apps detect <path> --agent` against the directory holding the application, if this was the repository root","Pass `--pattern staticsite` with `--source`, `--build-command` and `--output-dir` explicitly if the app has no recognised framework dependency"]},{command:"apps detect",match:k.success,templates:[`Run \`${te.createApplicationAgent} --name <name> --pattern <pattern>\` using the \`pattern\` column \u2014 never the \`framework\` column`,"Skip any row whose `role` is `library` \u2014 those are not deployable applications","Confirm `outputDir` exists after building: it is a framework convention, not a verified path"]},{command:"apps create",match:k.successOffline,templates:["Run `npm install` in the app directory \u2014 `--offline` skipped it",`Re-run \`${te.createApplicationAgent}\` without \`--offline\` once you have credentials, to register the app`,"Run `fjall deploy <app>` only after both of the above"]},{command:"apps create",match:k.success,templates:["Run `fjall deploy <app>` to deploy your new app","Run `fjall secrets set --app <app> DB_URL=<url>` to configure secrets"]},{command:"status",match:k.success,templates:["Run `fjall deploy <app>` to deploy","Run `fjall apps describe <app>` for details"]},{command:"deploy",match:k.success,templates:["Run `fjall status <app>` to check health","Run `fjall apps describe <app>` for full details"]},{command:"deploy",match:k.error,templates:["Run `fjall deploy <app>` to retry","Run `fjall status <app>` to check current state"]},{command:"destroy",match:k.success,templates:["Run `fjall list` to see remaining resources","Run `fjall apps list` to see remaining apps"]},{command:"destroy",match:k.error,templates:["Run `fjall destroy <app> --skip-confirmation` to force destroy","Run `fjall status <app>` to check current state"]},{command:"build",match:k.success,templates:["Run `fjall deploy <app> --image-tag <tag>` with a tag from `artefacts` to roll out this build","Run `fjall status <app>` to check health"]},{command:"connect",match:bq(e=>e.outcome==="success"&&e.pending==="true","match"),templates:["Run `fjall connect status --external-id <externalId> --wait` to block until the stack completes"]},{command:"connect",match:k.success,templates:[`Run \`${te.accountDeploy}\` or \`${te.organisationDeploy}\` to deploy infrastructure`,`Run \`${te.createApplicationAgent} --name "<name>"\` to create an app`]},{command:"connect status",match:k.success,templates:["Run `fjall connect status --external-id <id> --wait` to block until a pending stack completes",`Run \`${te.accountDeploy}\` or \`${te.organisationDeploy}\` to deploy infrastructure`]},{command:"connect status",match:k.empty,templates:[`Run \`${te.connect}\` to connect an AWS account`]},{command:"login",match:k.success,templates:["Run `fjall apps list` to see your applications",`Run \`${te.connect}\` to connect an AWS account`]},{command:"list",match:k.success,templates:["Run `fjall apps describe <name>` for app details","Run `fjall deploy <name>` to deploy"]},{command:"add",match:k.success,templates:["Run `fjall deploy <app>` to deploy the change","Run `fjall apps describe <app>` to see updated resources"]},{command:"modify",match:k.success,templates:["Run `fjall validate --deep --app <app>` to typecheck the edited infrastructure.ts","Run `fjall deploy <app>` to deploy the change","Run `fjall undo --app <app>` to restore the .bak sidecar if the edit was wrong"]},{command:"remove",match:k.success,templates:["Run `fjall validate --deep --app <app>` to confirm nothing still references the removed resource","Run `fjall deploy <app>` to deploy the change","Run `fjall undo --app <app>` to restore the .bak sidecar if the removal was wrong"]},{command:"validate",match:k.success,templates:["Run `fjall deploy <app>` to deploy the validated infrastructure"]},{command:"validate",match:k.error,templates:["Run `fjall undo --app <app>` to restore the most recent .bak sidecar","Run `fjall history --app <app>` to list older snapshots to restore from"]},{command:"undo",match:k.success,templates:["Run `fjall validate --deep --app <app>` to confirm the restored infrastructure.ts typechecks","Run `fjall history --app <app>` to restore an older snapshot instead"]},{command:"history",match:k.success,templates:["Run `fjall history --restore <timestamp> --app <app>` to restore a specific snapshot","Run `fjall undo --app <app>` to restore the most recent .bak sidecar instead"]},{command:"history",match:k.empty,templates:["No snapshots yet \u2014 `fjall add`, `fjall modify` and `fjall remove` each write one before editing infrastructure.ts"]},{command:"tunnel",match:k.success,templates:["Run `fjall tunnel <app> --background` to run in the background"]}];var GU=[{command:"secrets list",match:k.success,templates:["Run `fjall secrets set --app <app> KEY=VALUE` to set a secret","Run `fjall rollout <app>` to restart running services with the latest values"]},{command:"secrets list",match:k.empty,templates:["Run `fjall secrets set --app <app> KEY=VALUE` to add a secret","Run `fjall secrets import --app <app> <file>` to bulk import"]},{command:"secrets get",match:k.success,templates:["Run `fjall secrets set --app <app> KEY=VALUE` to update","Run `fjall secrets list --app <app>` to see all secrets"]},{command:"secrets set",match:k.success,templates:["Run `fjall rollout <app>` to restart running services with the new value","New key? Run a full `fjall deploy <app>` so the task definition gains the reference","Run `fjall secrets list --app <app>` to verify"]},{command:"secrets delete",match:k.success,templates:["Declared for a service? Re-run with `--remove-declaration` (or edit infrastructure.ts ssmSecrets), then `fjall deploy <app>` \u2014 a stale declaration breaks task launches","Not declared anywhere? Run `fjall rollout <app>` so running services drop the previous value","Run `fjall secrets list --app <app>` to verify"]},{command:"secrets import",match:k.success,templates:["Run `fjall rollout <app>` to restart running services with the imported values","New keys? Run a full `fjall deploy <app>` so task definitions gain the references","Run `fjall secrets list --app <app>` to verify"]},{command:"secrets export",match:k.success,templates:["Run `fjall secrets list --app <app>` to see all secret names","Run `fjall secrets import --app <app> <file>` to restore"]},{command:"secrets exec",match:k.success,templates:["Run `fjall secrets list --app <app>` to see available secrets"]}];var Sq=Object.defineProperty,Eq=(e,t)=>Sq(e,"name",{value:t,configurable:!0});var VU="identity-only organisation deploys typically take 2-5 minutes",xC=`Run \`${te.organisationDeploy}\` to apply the change (${VU}).`,ffe=`Deploy the organisation now to apply this change? (${VU})`,Aq="Groups have no members",Qs="fjall user add <email> --group <group>",xq=Qs,hfe=`${Aq} \u2014 run \`${xq}\` to declare access.`;function _q(e,t){return`Declared identity (source "${e}"): ${String(t)} user${t===1?"":"s"}`}Eq(_q,"formatUserListHeading");var gfe=`No users or memberships declared. Run \`${Qs}\` to add one.`;var WU=[{command:"user list",match:k.success,templates:[`Run \`${Qs}\` to grant access`,`Run \`${te.organisationDeploy}\` to apply declared changes`]},{command:"user list",match:k.empty,templates:[`Run \`${Qs}\` to declare the first membership`]},{command:"user add",match:k.success,templates:[xC,"Run `fjall user list` to review the declared users"]},{command:"user remove",match:k.success,templates:[xC,"Run `fjall user list` to see the remaining users"]},{command:"user rebind",match:k.success,templates:[`Run \`${te.organisationDeploy}\` to re-resolve external users against the identity store`]},{command:"org identity setup-google",match:k.success,templates:[`Run \`${Qs} --live\` to declare access for a synced user`,"Run `fjall user list --live` to compare declared memberships against the identity store"]},{command:"token create",match:k.success,templates:["Run `fjall token list` to see all tokens","Save the token now \u2014 it cannot be retrieved again"]},{command:"token list",match:k.success,templates:["Run `fjall token create --name <name> --scope <scope> --expires <duration>` to create a token","Run `fjall token revoke <id>` to revoke a token"]},{command:"token show",match:k.success,templates:["Run `fjall token revoke <id>` to revoke this token","Run `fjall token list` to see all tokens"]},{command:"token revoke",match:k.success,templates:["Run `fjall token list` to see remaining tokens"]},{command:"target list",match:k.success,templates:["Run `fjall target set <name>` to change active target","Run `fjall deploy <app>` to deploy to the active target","Run `fjall apps list` to see applications"]},{command:"target list",match:k.empty,templates:[`Run \`${te.connect}\` to connect an AWS account`,`Run \`${te.login}\` to authenticate if not logged in`]},{command:"org bind",match:k.success,templates:["Run `fjall org get` to confirm the organisation's regions and accounts","Commit fjall-config.json so every checkout of this project carries the binding"]},{command:"org get",match:k.success,templates:["Run `fjall target list` to see which account/region pairs are deployable","Run `fjall accounts list` to see application-hosting accounts only"]},{command:"target get",match:k.success,templates:["Run `fjall target set <name>` to change active target","Run `fjall target list` to see all targets"]},{command:"target get",match:k.empty,templates:["Run `fjall target set <name>` to set a target","Run `fjall target list` to see available targets"]},{command:"target set",match:k.success,templates:["Run `fjall deploy <app>` to deploy to this target","Run `fjall target get` to verify the active target"]},{command:"target set",match:k.errorWithCode("NOT_FOUND"),templates:["Run `fjall target list` to see available targets",`Run \`${te.connect}\` to connect an AWS account if none available`]}];import{platform as Wq,arch as Kq}from"os";import*as Oe from"fs";import*as wt from"path";var Tq=Object.defineProperty,cg=(e,t)=>Tq(e,"name",{value:t,configurable:!0});function Cq(e){return e.success===!0}cg(Cq,"isSuccess");function Iq(e){return e.success===!1}cg(Iq,"isFailure");function Ba(e){return{success:!0,data:e}}cg(Ba,"success");function Sn(e){return{success:!1,error:e}}cg(Sn,"failure");var Dq=Object.defineProperty,ug=(e,t)=>Dq(e,"name",{value:t,configurable:!0}),kq=ug(e=>{try{return JSON.stringify(e)}catch{return"[unserializable]"}},"safeStringify"),KU=ug((e,t,r,i)=>{let n=new Date().toISOString(),a=e.toUpperCase(),o=i?` ${kq(i)}`:"";process.stderr.write(`[${n}] [${a}] [${t}] ${r}${o}
-`)},"defaultWriter"),Ga=KU;function Nq(e){Ga=e}ug(Nq,"configureLogWriter");function wq(){Ga=KU}ug(wq,"resetLogWriter");var Va={info(e,t,r){Ga("info",e,t,r)},warn(e,t,r){Ga("warn",e,t,r)},error(e,t,r){Ga("error",e,t,r)},debug(e,t,r){process.env.FJALL_DEBUG==="true"&&Ga("debug",e,t,r)},trace(e,t,r){process.env.FJALL_TRACE==="true"&&Ga("trace",e,t,r)},isDebugEnabled(){return process.env.FJALL_DEBUG==="true"}};var Pq=Object.defineProperty,Jl=(e,t)=>Pq(e,"name",{value:t,configurable:!0}),Rq=10;var JU=c.object({name:c.string(),type:c.enum(["apex","delegated"]),parentDomain:c.string().optional(),account:c.string().optional(),region:c.string().optional()}).strict(),XU=c.object({id:c.string().min(1),name:c.string().min(1).optional()}).strict(),qU=c.object({activeTarget:c.string().optional(),domains:c.array(JU).optional(),capacityIdentity:Xp.optional(),organisation:XU.optional()}).strict(),ZU=c.object({activeTarget:c.string().optional(),domains:c.array(JU).optional(),capacityIdentity:Xp.optional(),organisation:XU.optional()}),Oq=c.object({activeTarget:c.string().optional()});function YU(e={}){return JSON.stringify(e,null,2)}Jl(YU,"serialiseRootConfig");var HU=qU.keyof().options;function QU(e,t,r){let i=t[r];i!==void 0&&(e[r]=i)}Jl(QU,"copyDefinedKey");function _C(e,t){if(t===void 0)return!1;let r=new Set([...Object.keys(e),...Object.keys(t)]);for(let i of r)if(e[i]!==t[i])return!1;return!0}Jl(_C,"domainEntriesEqual");var lg=class e{static{Jl(this,"Config")}rootConfig;configPath=null;loadFailed=!1;parseDegraded=!1;loadedSnapshot={};constructor(t,r){this.rootConfig=t??{},this.configPath=r??null}static findConfigDirectory(t){let r=t!==void 0&&t!==""?t:process.cwd();for(let i=0;i<Rq;i++){let n=wt.join(r,"fjall"),a=wt.join(n,Rn);if(Oe.existsSync(a))return n;let o=wt.join(r,Rn);if(Oe.existsSync(o))return r;let s=wt.dirname(r);if(s===r)break;r=s}return null}static loadConfigFile(t){try{return Oe.accessSync(t,Oe.constants.R_OK),Oe.readFileSync(t,{encoding:"utf8"})}catch(r){return Va.warn("Config",`Config file at ${t} could not be read; using defaults`,{file:t,error:ue(Ve(r))}),null}}static loadConfig(t){let r=e.findConfigDirectory(t);if(!r)return new e;let i=wt.join(r,Rn),n=e.loadConfigFile(i);if(n===null){let u=new e(void 0,i);return u.loadFailed=!0,u}let a,o=!1;if(n!==""){let u;try{u=JSON.parse(n)}catch(d){throw e.formatZodError(d,Rn)}let m=qU.safeParse(u);if(m.success)a=m.data;else{let d=ZU.safeParse(u);a=d.success?d.data:{},o=!d.success,d.success?Va.warn("Config","fjall-config.json contains keys this version does not recognise (only activeTarget, domains, capacityIdentity and organisation are read). They were most likely written by a newer fjall version \u2014 leave them in place; saves preserve them verbatim.",{file:i}):Va.warn("Config","fjall-config.json has a malformed activeTarget, domains or capacityIdentity value, so its contents were ignored for this run \u2014 any capacity-identity pins it holds will NOT apply (a pinned stack deploys unpinned and is blocked by the rename gate). Fix the file by hand; do NOT regenerate it, which would discard the pins.",{file:i})}}let s=new e(a,i);return s.parseDegraded=o,s.loadedSnapshot=structuredClone(s.rootConfig),s}static formatZodError(t,r){if(t instanceof c.ZodError&&t.issues.length>0){let n=t.issues.map(a=>`${a.path.join(".")}: ${a.message}`).join("; ");return new Error(`Failed to parse ${r}: ${n}`)}let i=(t instanceof Error?t.message:String(t)).replace(/\n/g," ").substring(0,500);return new Error(`Failed to parse ${r}: ${i}`)}saveConfig(){let t=wt.join(this.resolveProjectDirectory()??wt.join(process.cwd(),"fjall"),Rn);if(this.loadFailed)return Sn(new Error(`Refusing to save ${t}: the file exists but could not be read when this config loaded, so saving would replace its contents with state that never included them. Fix the file permissions (e.g. chmod u+rw ${t}) and retry.`));let r=wt.dirname(t);try{Oe.mkdirSync(r,{recursive:!0})}catch(s){return Sn(new Error(`Cannot create config directory ${r}: ${ue(Ve(s))}`))}let i=e.assertWritable(t,r);if(!i.success)return i;let n=this.mergeWithDisk(t);if(!n.success)return n;let a=YU(n.data),o=`${t}.tmp-${process.pid}`;try{Oe.writeFileSync(o,a,{mode:384}),Oe.renameSync(o,t)}catch(s){return Sn(new Error(`Failed to save ${t}: ${ue(Ve(s))}`))}return this.configPath=t,Ba(void 0)}static assertWritable(t,r){if(Oe.existsSync(t))try{Oe.accessSync(t,Oe.constants.W_OK)}catch{return Sn(new Error(`Cannot save ${t}: the file is read-only. Make it writable (e.g. chmod u+w ${t}) and retry.`))}try{Oe.accessSync(r,Oe.constants.W_OK)}catch{return Sn(new Error(`Cannot save ${t}: the directory ${r} is not writable. Make it writable (e.g. chmod u+w ${r}) and retry.`))}return Ba(void 0)}mergeWithDisk(t){let r=e.readDiskConfigForMerge(t);if(r.kind==="unmergeable")return Sn(new Error(`Refusing to save ${t}: ${r.reason}. Writing now would keep only this session's state and drop everything else the file carries (including keys written by other fjall versions). Fix or remove the file and retry.`));if(r.kind==="absent")return Ba(this.rootConfig);let i=r.disk,n={...i.foreign,...i.known};for(let o of HU)o!=="domains"&&this.sessionChangedKey(o)&&(this.rootConfig[o]===void 0?delete n[o]:QU(n,this.rootConfig,o));let a=this.mergeDomains(i.known.domains);return a!==void 0?n.domains=a:delete n.domains,Ba(n)}sessionChangedKey(t){return JSON.stringify(this.rootConfig[t])!==JSON.stringify(this.loadedSnapshot[t])}mergeDomains(t){let r=this.rootConfig.domains,i=this.loadedSnapshot.domains??[];if(r===void 0&&i.length===0)return t;let n=Jl(d=>d.toLowerCase(),"norm"),a=r??[],o=new Map(i.map(d=>[n(d.name),d])),s=new Map(a.map(d=>[n(d.name),d])),u=[],m=new Set;for(let d of t??[]){let h=n(d.name);m.add(h);let g=s.get(h),l=o.get(h);if(g!==void 0&&!_C(g,l)){u.push(g);continue}g===void 0&&l!==void 0||u.push(d)}for(let d of a){let h=n(d.name);m.has(h)||_C(d,o.get(h))||u.push(d)}return u}static readDiskConfigForMerge(t){if(!Oe.existsSync(t))return{kind:"absent"};let r;try{let a=Oe.readFileSync(t,{encoding:"utf8"});if(a==="")return{kind:"absent"};r=JSON.parse(a)}catch(a){return{kind:"unmergeable",reason:`the existing file could not be read or parsed as JSON (${ue(Ve(a))})`}}let i=ZU.safeParse(r);if(!i.success){let a=i.error.issues.map(o=>`${o.path.join(".")}: ${o.message}`).join("; ");return{kind:"unmergeable",reason:`a recognised key in the existing file is malformed (${ue(a)})`}}let n={};if(typeof r=="object"&&r!==null){let a=HU;for(let[o,s]of Object.entries(r))a.includes(o)||(n[o]=s)}return{kind:"ok",disk:{known:i.data,foreign:n}}}static getConfigDirectory(t){return e.findConfigDirectory(t)}getConfigPath(){return this.configPath}isContentUnavailable(){return this.loadFailed||this.parseDegraded}static warnedLegacyActiveTarget=!1;localConfigCache;resolveProjectDirectory(){return this.configPath!==null?wt.dirname(this.configPath):e.findConfigDirectory()}localConfigFile(){let t=this.resolveProjectDirectory();return t===null?null:wt.join(t,yi,Qc)}loadLocalConfig(){if(this.localConfigCache===void 0){let t=this.localConfigFile();if(t===null)return this.localConfigCache={};try{let r=Oe.readFileSync(t,{encoding:"utf8"}),i=Oq.safeParse(JSON.parse(r));this.localConfigCache=i.success?i.data:{}}catch{this.localConfigCache={}}}return this.localConfigCache}writeLocalConfig(t){let r=this.localConfigFile();if(r===null)return Sn(new Error("Cannot persist local state: no fjall-config.json was found from this directory, so there is no project to anchor `.fjall/local.json` to. Run this from inside a fjall project, or run `fjall create account` / `fjall create app` first."));try{Oe.mkdirSync(wt.dirname(r),{recursive:!0});let i=`${r}.tmp-${process.pid}`;Oe.writeFileSync(i,JSON.stringify(t,null,2)+`
-`,{encoding:"utf8"}),Oe.renameSync(i,r),Tm(wt.dirname(wt.dirname(r)),[xm,...eu],{header:CA,marker:hP})}catch(i){return Sn(new Error(`Failed to write ${r}: ${ue(Ve(i))}`))}return this.localConfigCache=t,Ba(void 0)}static warnLegacyActiveTargetOnce(){e.warnedLegacyActiveTarget||(e.warnedLegacyActiveTarget=!0,Va.warn("Config","`activeTarget` in fjall-config.json is deprecated and ignored: a committed target must never re-aim a deploy or CI pipeline. Run `fjall target set <name>` to store it locally in .fjall/local.json, then remove `activeTarget` from the committed fjall-config.json."))}getActiveTarget(){let t=this.loadLocalConfig().activeTarget;if(t!==void 0)return t;this.rootConfig.activeTarget!==void 0&&e.warnLegacyActiveTargetOnce()}setActiveTarget(t){let r=this.loadLocalConfig();return r.activeTarget=t,this.writeLocalConfig(r)}clearActiveTarget(){let t=this.loadLocalConfig();return delete t.activeTarget,this.writeLocalConfig(t)}getDomains(){return this.rootConfig.domains??[]}setDomains(t){this.rootConfig.domains=t}addDomain(t){this.rootConfig.domains||(this.rootConfig.domains=[]),this.rootConfig.domains.push(t)}getDomain(t){return this.rootConfig.domains?.find(r=>r.name.toLowerCase()===t.toLowerCase())}removeDomain(t){if(!this.rootConfig.domains)return!1;let r=this.rootConfig.domains.findIndex(i=>i.name.toLowerCase()===t.toLowerCase());return r===-1?!1:(this.rootConfig.domains.splice(r,1),!0)}getOrganisation(){return this.rootConfig.organisation}setOrganisation(t){this.rootConfig.organisation=t}clearOrganisation(){delete this.rootConfig.organisation}};var $q=Object.defineProperty,ji=(e,t)=>$q(e,"name",{value:t,configurable:!0});function TC(e){let t;try{t=lg.loadConfig(e)}catch(i){return{kind:"unreadable",reason:ue(Ve(i))}}if(t.isContentUnavailable())return{kind:"unreadable",reason:"fjall-config.json exists but its contents could not be loaded (the preceding warning names the problem)"};let r=t.getOrganisation();return r!==void 0?{kind:"bound",bound:r}:t.getConfigPath()===null?{kind:"no_project"}:{kind:"unbound"}}ji(TC,"readProjectBinding");function CC(e,t,r){switch(e.kind){case"unreadable":return e;case"no_project":return{kind:"unbound",projectFound:!1,identity:t};case"unbound":return{kind:"unbound",projectFound:!0,identity:t};case"bound":return t===null?{kind:"unverifiable",bound:e.bound,reason:r??"the organisation could not be resolved"}:e.bound.id===t.id?{kind:"matched",bound:e.bound}:{kind:"mismatched",bound:e.bound,actual:t}}}ji(CC,"resolveBindingVerdict");function ez(e,t={}){return CC(TC(t.startDir),e,t.unresolvedReason)}ji(ez,"checkProjectOrganisation");function Wa(e){return e.name!==void 0&&e.name!==""?`${e.name} (${e.id})`:e.id}ji(Wa,"describeOrganisation");function tz(e,t,r){return`Refusing to ${e}: this project's fjall-config.json records organisation ${Wa(t)} as its home, but the credential in use belongs to ${Wa(r)}. Nothing was created, synthesised or deployed. Cure: authenticate as ${Wa(t)} ('fjall login', or set FJALL_API_KEY to a key for that organisation), or \u2014 if this project really is moving \u2014 run 'fjall org bind --org ${r.id} --force' to re-bind it.`}ji(tz,"buildWrongOrganisationMessage");function rz(e,t){return`Refusing to ${e}: ${t}, so this project's organisation binding cannot be checked. Nothing was created, synthesised or deployed. Cure: fix fjall-config.json (permissions or contents), then re-run.`}ji(rz,"buildUnreadableConfigMessage");function nz(e,t){return`Could not confirm which organisation your credential belongs to (${t}). Proceeding \u2014 this project is bound to ${Wa(e)}, and a mismatch would not have been caught.`}ji(nz,"buildUnverifiableNotice");function iz(e){return`This project is not bound to an organisation. Run 'fjall org bind' to pin it to ${Wa(e)} \u2014 afterwards, any command run here with another organisation's credential is refused instead of silently landing there.`}ji(iz,"buildUnboundNotice");import{createHash as Fq}from"node:crypto";var jq=Object.defineProperty,Mq=(e,t)=>jq(e,"name",{value:t,configurable:!0});function az(e,t){return Fq("sha256").update(`${e}${t}`).digest("hex")}Mq(az,"credentialFingerprint");import*as pg from"node:fs";var Lq=Object.defineProperty,dg=(e,t)=>Lq(e,"name",{value:t,configurable:!0}),oz="org-config-cache.json";function IC(){return Lo(oz)}dg(IC,"orgConfigCachePath");function DC(e){return typeof e=="object"&&e!==null&&!Array.isArray(e)}dg(DC,"isObject");function kC(e){return DC(e)&&typeof e.organisationId=="string"&&e.organisationId!==""&&typeof e.organisationName=="string"}dg(kC,"isCachedCredentialIdentity");function sz(e){try{let t=IC();if(!pg.existsSync(t))return null;let r=JSON.parse(pg.readFileSync(t,"utf-8"));return!DC(r)||r.credentialFingerprint!==e?null:kC(r.identity)?r.identity:null}catch(t){return Va.debug("cachedCredentialIdentity","Cache read failed, treating as a miss",{error:ue(Ve(t))}),null}}dg(sz,"readCachedCredentialIdentity");var Uq=Object.defineProperty,zq=(e,t)=>Uq(e,"name",{value:t,configurable:!0}),cz="https://fjall.io";function mg(){let e=process.env.FJALL_API_URL;return e!==void 0&&e!==""?e:cz}zq(mg,"resolveApiBaseUrl");var uz={name:"@fjall/cli",version:"28.1.1",repository:{type:"git",url:"git+https://github.com/fjall-tech/fjall.git",directory:"cli"},description:"Fjall CLI helper",private:!0,type:"module",bin:{fjall:"dist/src/cli.js"},files:["dist/"],scripts:{clean:"rm -rf ./dist ./dist.next ./sourcemaps","clean:node":"rm -rf ./node_modules","copy-files":'DEST="${DEST:-dist}"; find generators -type d -name files | while read dir; do mkdir -p "$DEST/$dir" && cp -R "$dir/." "$DEST/$dir/"; done && cp -R src/proto "./$DEST/src/proto"',build:"rm -rf ./dist.next ./sourcemaps && npx tsc --outDir dist.next && DEST=dist.next npm run copy-files && node ../scripts/minify-dist.mjs dist.next && chmod +x ./dist.next/src/cli.js && rm -rf ./dist && mv ./dist.next ./dist && node ../scripts/stamp-build.mjs",watch:"npm run build && npx tsc-watch","watch:only":'npx tsc-watch --onSuccess "npm run copy-files"',"fjall-cli":"node ./dist/src/cli.js",version:"npx tsx scripts/updateTemplateVersions.ts && node ../scripts/sync-ci-plugin-major.mjs",format:'prettier --write "src/**/*.{ts,tsx,js,jsx,json}" "generators/**/*.{ts,tsx,js,jsx,json}"',"format:check":'prettier --check "src/**/*.{ts,tsx,js,jsx,json}" "generators/**/*.{ts,tsx,js,jsx,json}"',lint:"eslint src/ generators/","lint:fix":"eslint src/ generators/ --fix",typecheck:"tsc --noEmit","typecheck:tests":"tsc --noEmit --project tsconfig.test.json","typecheck:scripts":"tsc --noEmit --project tsconfig.scripts.json","typecheck:all":"npm run typecheck && npm run typecheck:tests && npm run typecheck:scripts",test:"vitest run","test:watch":"vitest","test:coverage":"vitest run --coverage","test:integration":"vitest run --config vitest.config.integration.ts","test:integration:watch":"vitest --config vitest.config.integration.ts","test:e2e":"vitest run --config vitest.e2e.config.ts","test:all":"npm run test && npm run test:integration && npm run test:e2e","test:setup":"node scripts/setupTestFixtures.mjs","test:payload-compat":"npx tsx scripts/testPayloadCompatibility.ts","test:payload-compat:e2e":"npx tsx scripts/testPayloadCompatibility.ts --e2e"},engines:{node:">=22.0.0"},author:"",license:"SEE LICENSE IN LICENSE",devDependencies:{"@eslint/js":"^10.0.1","@playwright/test":"^1.62.0","@testing-library/dom":"^10.4.1","@testing-library/react":"^16.3.2","@types/ejs":"^3.1.5","@types/prompts":"^2.4.9","@types/proper-lockfile":"^4.1.4","@types/react":"^19.2.17","@typescript-eslint/parser":"^8.65.0","@vitest/coverage-v8":"^4.1.10","aws-cdk-lib":"^2.265.0",constructs:"^10.7.2",eslint:"^10.8.0","ink-testing-library":"^4.0.0",jsdom:"^30.0.1",prettier:"^3.9.6","react-dom":"^19.2.8","strip-ansi":"^6.0.1","tsc-watch":"^7.2.1",tsx:"^4.23.1","typescript-eslint":"^8.65.0",vitest:"4.1.10"},dependencies:{"@anthropic-ai/sdk":"^0.115.0","@aws-sdk/client-acm":"^3.1098.0","@aws-sdk/client-auto-scaling":"^3.1098.0","@aws-sdk/client-backup":"^3.1098.0","@aws-sdk/client-cloudformation":"^3.1098.0","@aws-sdk/client-cost-explorer":"^3.1098.0","@aws-sdk/client-ec2":"^3.1098.0","@aws-sdk/client-ecr":"^3.1098.0","@aws-sdk/client-ecs":"^3.1098.0","@aws-sdk/client-elasticache":"^3.1098.0","@aws-sdk/client-iam":"^3.1098.0","@aws-sdk/client-identitystore":"^3.1098.0","@aws-sdk/client-lambda":"^3.1098.0","@aws-sdk/client-organizations":"^3.1098.0","@aws-sdk/client-ram":"^3.1098.0","@aws-sdk/client-rds":"^3.1098.0","@aws-sdk/client-route-53":"^3.1098.0","@aws-sdk/client-s3":"^3.1098.0","@aws-sdk/client-secrets-manager":"^3.1098.0","@aws-sdk/client-ssm":"^3.1098.0","@aws-sdk/client-sso":"^3.1098.0","@aws-sdk/client-sso-admin":"^3.1098.0","@aws-sdk/client-sso-oidc":"^3.1098.0","@aws-sdk/client-sts":"^3.1098.0","@fjall/deploy-core":"^28.1.1","@fjall/generator":"^28.1.1","@fjall/util":"^28.1.1","@nx/devkit":"^23.1.0","@opennextjs/aws":"^4.1.0","@smithy/node-http-handler":"^4.9.13","@toon-format/toon":"^4.1.0","aws-cdk":"^2.1134.0",axios:"^1.19.0",chalk:"^6.0.0","cli-cursor":"^5.0.0",commander:"^15.0.0",ejs:"^6.0.1",ink:"^7.1.1","js-yaml":"^5.2.2",open:"^11.0.0",ora:"^9.4.1",prompts:"^2.4.2","proper-lockfile":"^4.1.2",protobufjs:"^8.7.1",react:"^19.2.8",typescript:"^6.0.3","update-check":"^1.5.4",zod:"^4.4.3"}};var Gq=Object.defineProperty,Vq=(e,t)=>Gq(e,"name",{value:t,configurable:!0}),ihe=`fjall-cli/${uz.version} node/${process.versions.node} ${Wq()}/${Kq()}`;var lz=mg(),ahe=c.looseObject({deviceCode:c.string(),userCode:c.string(),verificationUri:c.string(),expiresIn:c.number(),interval:c.number()}),ohe=c.looseObject({status:c.string(),apiKey:c.string().optional(),organisationId:c.string().optional(),organisationName:c.string().optional(),email:c.string().optional()}),she=c.looseObject({application:c.looseObject({id:c.string()})}),NC=c.looseObject({id:c.string(),name:c.string(),vpcCidr:c.string().nullable(),connectedAwsAccountId:c.string().nullable()}),che=c.looseObject({applications:c.array(NC),nextCursor:c.string().optional()}),uhe=c.looseObject({application:NC}),lhe=c.looseObject({applications:c.array(NC)}),dhe=c.looseObject({application:c.looseObject({id:c.string(),name:c.string()})}),phe=c.looseObject({primaryRegion:c.string().nullish(),secondaryRegions:c.array(c.string()).optional(),disasterRecoveryRegion:c.string().nullish(),providerAccounts:c.custom(e=>Array.isArray(e)),ssoSessions:c.record(c.string(),c.looseObject({ssoRegion:c.string(),ssoStartUrl:c.string()})).optional(),rootOidcRoleArn:c.string().nullish(),allowCodemodLlmFallback:c.boolean().optional(),rootAccessManagement:c.custom(e=>typeof e=="string").optional(),requireTrackedDeploys:c.boolean().optional().catch(void 0)}),mhe=c.looseObject({id:c.string(),token:c.string(),tokenPrefix:c.string(),name:c.string(),scopes:c.array(c.string())}),Zq=c.looseObject({id:c.string(),name:c.string(),tokenPrefix:c.string(),scopes:c.array(c.string()),resourceConstraints:c.record(c.string(),c.unknown()),sourceTag:c.string().nullable(),expiresAt:c.string(),createdAt:c.string(),revokedAt:c.string().nullable(),revokedReason:c.string().nullable(),lastUsedAt:c.string().nullable(),usageCount:c.number(),deniedCount:c.number()}),fhe=c.looseObject({tokens:c.array(Zq)}),hhe=c.looseObject({scopes:c.array(c.string()),expiresAt:c.string().optional()}),Hq=c.looseObject({id:c.string(),awsAccountId:c.string(),accountName:c.string().nullable(),environment:c.string().nullable()}),ghe=c.looseObject({accounts:c.array(Hq)}),Jq=c.looseObject({id:c.string(),assetIdentifier:c.string(),name:c.string(),type:c.string(),status:c.string(),region:c.string().nullish(),_count:c.looseObject({complianceIssues:c.number()}).optional()}),Xq=c.looseObject({id:c.string(),name:c.string(),assetIdentifier:c.string(),provider:c.string(),type:c.string(),status:c.string(),region:c.string().nullish(),iacStatus:c.string().nullish(),accountId:c.string().nullish(),estimatedMonthlyCost:c.string().nullish(),lastSeenAt:c.string().nullish(),createdAt:c.string().nullish(),updatedAt:c.string().nullish()}),yhe=c.looseObject({assets:c.array(Jq),nextCursor:c.string().optional()}),vhe=c.looseObject({asset:Xq}),qq=c.looseObject({id:c.string(),ruleId:c.string(),title:c.string(),severity:c.string(),status:c.string()}),bhe=c.looseObject({issues:c.array(qq)}),She=c.record(c.string(),c.unknown()),Ehe=c.union([c.array(c.record(c.string(),c.unknown())),c.record(c.string(),c.unknown())]),Ahe=c.record(c.string(),c.unknown()),xhe=c.record(c.string(),c.unknown()),_he=c.record(c.string(),c.unknown()),The=c.record(c.string(),c.unknown()),Che=c.looseObject({deployment:c.looseObject({id:c.string()}),minCliVersion:c.string().optional()});var Yq=c.object({id:c.string(),releaseNumber:c.number().int(),status:c.string(),commitSha:c.string().nullable(),branch:c.string().nullable(),createdAt:c.string(),assemblyDigest:c.string().nullable(),createdByDeploymentId:c.string().nullable(),rollbackOfReleaseId:c.string().nullable(),services:c.array(vm.strip())}),Ihe=c.object({releases:c.array(Yq),currentReleaseId:c.string().nullable(),nextCursor:c.number().int().optional()}),Qq=c.object({id:c.string(),status:c.string(),target:c.string().nullish(),applicationId:c.string().nullish(),applicationName:c.string().nullish(),connectedAwsAccountId:c.string().nullish(),source:c.string().nullish(),startedAt:c.string().nullish(),triggeredByName:c.string().nullish(),machineLabel:c.string().nullish()}),Dhe=c.object({deployments:c.array(Qq)}),khe=c.object({cancelled:c.boolean(),message:c.string().nullish(),declined:c.boolean().nullish()}),Nhe=c.object({released:c.literal(!0),id:c.string().nullish()}),whe=c.looseObject({organisationId:c.string(),organisationName:c.string(),organisationSlug:c.string().min(1).optional()}),Phe=c.looseObject({status:c.string(),roleArn:c.string().optional(),accountId:c.string().optional(),phase:c.string().optional(),reason:c.string().optional()}),Rhe=c.looseObject({token:c.string()}),eY=c.looseObject({quickCreateUrl:c.string(),externalId:c.string()}),tY=c.looseObject({alreadyConnected:c.literal(!0),account:c.looseObject({awsAccountId:c.string(),accountName:c.string().nullable(),status:c.string()})}),Ohe=c.union([tY,eY]);function rY(e){return"alreadyConnected"in e&&e.alreadyConnected===!0}Vq(rY,"isAlreadyConnected");var $he=c.looseObject({registered:c.boolean(),repository:c.looseObject({id:c.string()}).optional()});var nY=Object.defineProperty,iY=(e,t)=>nY(e,"name",{value:t,configurable:!0});function Xl(e=lz){return`Deploy tokens are minted from a signed-in browser session by an owner or admin: open ${e}/settings/ci (Settings \u2192 CI/CD Tokens).`}iY(Xl,"deployTokenMintGuidance");var dz=[{command:"ci status",match:k.success,templates:["Run `fjall ci verify` to check the rest of the wiring \u2014 an active deploy token is necessary, not sufficient","Run `fjall ci token list` to see which applications, environments and accounts each active token may deploy to"]},{command:"ci status",match:k.empty,templates:[Xl(),"Run `fjall ci setup --plan --app <app>` to learn where the workflow file will go and which secret name it will read (`workflowPath`, `secretName`) \u2014 the two things needed to stage the secret before minting. `--plan` mints nothing and writes nothing, and the workflow BODY is printed on the human surface only: it is not a field of the agent payload"]},{command:"ci token list",match:k.success,templates:["Run `fjall token show <id>` to inspect one token's stored constraints","Run `fjall ci token revoke <id> --reason <text>` to revoke a listed token"]},{command:"ci token list",match:k.empty,templates:[Xl(),"Run `fjall ci status` to re-check readiness once a token exists"]},{command:"ci token revoke",match:k.success,templates:["Run `fjall ci token list` to confirm the token now lists as revoked \u2014 a revoked token stays listed, it does not disappear",`Any CI job still holding this token now fails to authenticate. ${Xl()}`]}];var fg="Do not retry or vary flags: `supported: false` is the server's capability verdict, not an input error \u2014 every invocation answers the same until the Fjall server is updated to a version that ships this API (the `message` field names the upgrade)",pz=[{command:"deployments list",match:k.unsupported,templates:[fg]},{command:"deployments cancel",match:k.unsupported,templates:[fg]},{command:"deployments force-release",match:k.unsupported,templates:[fg]},{command:"dev list",match:k.unsupported,templates:[fg]},{command:"deployments list",match:k.success,templates:["Run `fjall deployments cancel <id>` to request co-operative cancellation of a listed deployment","Run `fjall deploy logs --deployment-id <id>` to read one deployment's logs"]},{command:"deployments cancel",match:k.success,templates:["Run `fjall deployments list` to confirm whether the slot is free, and read `cancelled` and `declined` before assuming it is: `cancelled: false` means the request was refused, `declined: true` is an already-terminal reject, and a plain granted cancel is co-operative \u2014 the deployment has to acknowledge it","Run `fjall deployments force-release <id> --confirm <id>` to clear a slot that stays occupied (organisation admin, audited \u2014 retype the id in `--confirm`)"]},{command:"deployments force-release",match:k.success,templates:["Run `fjall deployments list` to confirm the slot is free","Run `fjall deploy <app>` to retry the deployment the wedged slot was blocking"]},{command:"dev up",match:k.success,templates:["Run `fjall dev list <app>` to see every slot for this app with its `host` \u2014 rows carry `host`, not a full URL, and it is empty until the slot leaves `creating`","Run `fjall dev down <app> --branch <branch>` to tear this slot down"]},{command:"dev list",match:k.success,templates:["Run `fjall dev down <app> --branch <branch>` to tear one listed slot down \u2014 every row carries the `branch` to name here","Run `fjall dev up <app> --branch <branch>` to bring another branch up"]},{command:"dev down",match:k.success,templates:["Run `fjall dev list <app>` to see which slots remain","Run `fjall dev up <app> --branch <branch>` to bring the branch back up"]},{command:"dev substrate down",match:k.success,templates:["Run `fjall dev list <app>` to confirm no slot survives \u2014 the substrate will not tear down under live slots, and `--force` takes them with it","Any `residuals` row survives the teardown and can still cost: its `cleanupHint` names the manual step"]}];var mz=["Run `fjall domain deploy <name>` to deploy the domain","Run `fjall domain verify <name>` to check DNS delegation once it is deployed","Run `fjall domain export <name>` to export the live zone records"],fz=[{command:"org deploy",match:k.success,templates:["Run `fjall org get` to review the deployed organisation topology and accounts",`Run \`${te.accountDeploy}\` to deploy the account tier if you passed \`--no-cascade\``,`Run \`${te.createApplicationAgent} --name "<name>"\` to create an application to deploy into it`]},{command:"org deploy",match:k.error,templates:["Run `fjall org get` to see which tier of the cascade is already deployed",`Run \`${te.organisationDeploy} --no-cascade\` to retry the organisation stack alone`]},{command:"platform deploy",match:k.success,templates:[`Run \`${te.accountDeploy}\` to deploy the account tier on top of it`]},{command:"platform deploy",match:k.error,templates:["Run `fjall org get` to check the organisation tier is deployed first"]},{command:"account deploy",match:k.success,templates:["Run `fjall apps list` to see which applications are registered","Run `fjall deploy <application>` to deploy one into this account"]},{command:"account deploy",match:k.error,templates:["Run `fjall org get` to confirm the account is registered in the organisation",`Run \`${te.accountDeploy} --target <target>\` to select a specific member account`]},{command:"domain list",match:k.success,templates:["Run `fjall domain verify <name>` to check DNS delegation","Run `fjall domain export <name>` to export zone file","Run `fjall create domain --name <name>` to create a new domain"]},{command:"domain list",match:k.empty,templates:['Run `fjall create domain --name "<name>"` to create a domain',"Run `fjall domain import <name>` to import from Route53"]},{command:"domain verify",match:k.success,templates:["Run `fjall domain export <name>` to export zone file","Run `fjall domain deploy <name>` to deploy domain infrastructure"]},{command:"domain verify",match:k.error,templates:["Run `fjall domain verify <name>` to retry","Run `fjall domain list` to see existing domains"]},{command:"domain export",match:k.success,templates:["Run `fjall domain verify <name>` to check delegation","Run `fjall domain import <name>` to re-import from Route53"]},{command:"domain import",match:k.success,templates:["Run `fjall domain verify <name>` to check delegation","Run `fjall domain export <name>` to see the zone file","Run `fjall domain deploy <name>` to deploy domain infrastructure"]},{command:"domain import",match:k.error,templates:["Run `fjall domain import --hosted-zone-id <id>` to import by zone ID","Run `fjall domain list` to see existing domains"]},{command:"domain records list",match:k.success,templates:["Run `fjall domain sync <domain>` for the full zone-hygiene report","Run `fjall domain sync <domain> --fix` to remediate residue records via the destruction ceremony"]},{command:"domain records list",match:k.empty,templates:["Run `fjall domain deploy <domain>` to deploy the domain's declared records","Run `fjall domain list` to see existing domains"]},{command:"domain records list",match:k.error,templates:["Run `fjall domain records list <domain> --hosted-zone-id <id>` when the zone is not resolvable by name",`Run \`${te.connect}\` if AWS credentials are missing`]},{command:"domain sync",match:k.success,templates:["Run `fjall domain sync <domain> --fix` to remediate residue records (ceremony-gated)","Run `fjall domain records list <domain>` to see every record with its owner"]},{command:"domain sync",match:k.error,templates:["Run `fjall domain sync <domain> --hosted-zone-id <id>` when the zone is not resolvable by name","Run `fjall domain list` to see existing domains"]},{command:"domain delegate",match:k.success,templates:["Run `fjall domain verify <domain>` to confirm public DNS resolution","Run `fjall domain deploy <domain>` to continue a two-phase deploy after delegation"]},{command:"domain delegate",match:k.error,templates:["Run `fjall domain deploy <parent-domain>` so the parent publishes its DelegationRole","Run `fjall domain verify <domain> --show-delegation` for registrar instructions"]},{command:"domain destroy",match:k.success,templates:["Run `fjall domain list` to see remaining domains","Run `fjall domain sync <parent-domain>` to confirm no delegation residue remains"]},{command:"domain destroy",match:k.error,templates:["Run `fjall domain destroy <domain> --remediate '<name>'=recreate` with the exact consent the ticket names","Run `fjall domain list` to see existing domains"]},{command:"domain deploy",match:k.success,templates:["Run `fjall domain verify <domain>` to check DNS propagation","Run `fjall domain delegate <domain>` to write the NS delegation for a delegated child"]},{command:"domain deploy",match:k.error,templates:["Run `fjall domain deploy <domain>` to resume \u2014 the zone phase is retained and skipped on re-run","Run `fjall domain verify <domain> --show-delegation` for registrar delegation instructions"]},{command:"domain eject",match:k.success,templates:["Review the ejected infrastructure.ts \u2014 it is now vanilla CDK owned by you","Run `fjall domain list` to see remaining managed domains"]},{command:"create domain",match:k.success,templates:mz},{command:"domain create",match:k.success,templates:mz},{command:"create domain",match:k.error,templates:["Run `fjall domain list` to see existing domains",'Run `fjall create domain --name "<name>"` to retry with a different name']},{command:"create account",match:k.success,templates:[`Run \`${te.connect} --environment production\` to link your AWS account`,`Run \`${te.accountDeploy}\` to deploy account infrastructure (after connecting)`]},{command:"create account",match:k.error,templates:[`Run \`${te.createAccount} --primary-region <region>\` to retry`,`Run \`${te.createAccount} --help\` for usage information`]},{command:"create org",match:k.success,templates:[`Run \`${te.connect} --name "<account-name>" --region <region>\` to link the AWS Organizations management account \u2014 omit \`--environment\` so it registers at the organisation tier`,`Run \`${te.organisationDeploy}\` to deploy all infrastructure (after connecting)`]},{command:"create org",match:k.error,templates:[`Run \`${te.createOrganisation} --email "<email>"\` to retry (add \`--name "<name>"\` only for a brand-new organisation)`,`Run \`${te.createOrganisation} --help\` for all options`]},{command:"restore",match:k.successDryRun,templates:["Run `fjall restore <resourceType> --recovery-point <recoveryPointArn> --yes` to initiate restore","Run `fjall apps list` to see existing applications"]},{command:"restore",match:k.success,templates:["Open the AWS Console URL above to monitor restore progress","Run `fjall import` to import the restored resource after completion"]},{command:"restore",match:k.errorWithCode("NOT_FOUND"),templates:["Verify the recovery point ARN is correct and exists in the current region","Run `fjall restore <resourceType> --recovery-point <arn>` to retry"]},{command:"restore",match:k.errorWithCode("FORBIDDEN"),templates:["Ensure the IAM role has backup:StartRestoreJob and iam:PassRole permissions","Run `fjall restore` interactively to configure with guided setup"]},{command:"import",match:k.successDryRun,templates:["Run `fjall import --app <app> --resource-id <resourceId> --yes` to import a specific resource","Run `fjall import --app <app> --yes` to import all discovered resources"]},{command:"import",match:k.success,templates:["Run `fjall deploy <app>` to deploy with the imported resource","Run `fjall apps describe <app>` to see updated resources"]},{command:"import",match:k.errorWithCode("NOT_FOUND"),templates:[`Run \`${te.createApplicationAgent} --name "<app>"\` to create the application`,"Run `fjall apps list` to see existing applications"]},{command:"import",match:k.errorWithCode("VALIDATION_ERROR"),templates:["Run `fjall import --app <app> --resource-id <resourceId>` to import a specific resource","Run `fjall import --app <app> --resource-id <resourceId> --yes` to import immediately"]},{command:"aws exec",match:k.success,templates:["Run `fjall aws exec -- <command...>` to run another AWS CLI command","Run `fjall status` to check application health"]},{command:"aws exec",match:k.error,templates:["Retry the command \u2014 OIDC token mints can fail transiently",`Run \`${te.login}\` if the retry also fails with an authentication error`]},{command:"unlock bucket",match:k.success,templates:["Re-put sane bucket policy statements (enforceSSL deny, access grants) \u2014 the unlock deleted the ENTIRE policy","Run `fjall destroy <app>` to retry the blocked stack cleanup"]},{command:"unlock bucket",match:k.error,templates:["Ensure your credentials belong to the organisation's management account \u2014 STS AssumeRoot is rejected elsewhere","Run `fjall unlock bucket <name> --account <id> --acknowledge-root-session` to retry"]}];var aY=Object.defineProperty,vz=(e,t)=>aY(e,"name",{value:t,configurable:!0}),hz="Run `fjall connect status` to check that an AWS account is connected: asset discovery only inventories connected accounts, so an organisation with none has nothing to inventory",gz=["Run `fjall assets show <asset>` to read one asset in full \u2014 pass its `assetIdentifier`","Run `fjall assets compliance <asset>` to list an asset's recorded posture issues \u2014 pass its `assetIdentifier`, the address every server version accepts"],yz=vz(e=>e.outcome==="success"&&e.nextCursor!==void 0,"isTruncatedPage"),bz=[{command:"assets list",match:vz(e=>yz(e)&&e.fields!==void 0&&e.fields!=="","match"),templates:["This window is truncated \u2014 more assets exist beyond these rows. Run `fjall assets list --cursor <nextCursor> --fields <fields>` to fetch the next page with the same projection; `total` counts this window only, and `fjall assets summary` reports the estate-wide tally, split active/deleted",...gz]},{command:"assets list",match:yz,templates:["This window is truncated \u2014 more assets exist beyond these rows. Run `fjall assets list --cursor <nextCursor>` to fetch the next page; `total` counts this window only, and `fjall assets summary` reports the estate-wide tally, split active/deleted",...gz]},{command:"assets list",match:k.success,templates:["The `total` aggregate counts the rows in this response, not the estate: `--take` bounds the window (default 50). No `nextCursor` aggregate here means the estate ends with these rows; `fjall assets summary` reports the estate-wide tally, split active/deleted","Run `fjall assets show <asset>` to read one asset in full","Run `fjall assets compliance <asset>` to list an asset's recorded posture issues \u2014 pass its `assetIdentifier`, the address every server version accepts (row `id`s are only accepted by newer servers)"]},{command:"assets list",match:k.empty,templates:["Run `fjall assets list --status deleted` to include assets discovery has since marked deleted \u2014 the default listing hides them",hz]},{command:"assets show",match:k.success,templates:["Run `fjall assets compliance <asset>` to list the posture issues recorded against this asset","Run `fjall assets show <asset> --fields id,accountId,iacStatus,estimatedMonthlyCost,lastSeenAt` to read the fields the default projection omits"]},{command:"assets compliance",match:k.success,templates:["Read the `status` column before acting: this listing returns every issue recorded against the asset, `resolved` and `suppressed` included, where the `openIssues` count on `fjall assets list` counts only the open ones","Run `fjall compliance fix --domain compliance --issue-id <issueId>` to read this issue in full alongside the organisation's other open issues. `--domain` is the producer's category \u2014 one of `compliance`, `cost`, `performance` \u2014 not a framework name, and the response is context to reason from, not a remediation step: use `--execute` to run one","Run `fjall assets show <asset>` to read the asset these issues were raised against"]},{command:"assets compliance",match:k.empty,templates:["No issue of ANY status has been recorded against this asset \u2014 an empty listing here is not the same as issues that were resolved, which would still appear with `status: resolved`","Run `fjall assets list --fields name,assetIdentifier,openIssues` to find the assets that do carry open issues"]},{command:"assets summary",match:k.success,templates:["Run `fjall assets list --fields name,assetIdentifier,openIssues` to see which assets sit behind `withIssues` \u2014 `withIssues` counts the assets carrying at least one open issue, `openIssues` counts those issues per asset","Run `fjall assets list --take <n>` to read the rows behind these totals \u2014 page onwards with `--cursor` when the listing reports a `nextCursor`, and pass `--status deleted` to include the `deleted` rows in the listing (interleaved with active \u2014 read the `status` column). These totals are estate-wide (the summary pages the listing to exhaustion, deleted assets included): `total` counts the whole estate, `active` and `deleted` split it"]},{command:"assets summary",match:k.empty,templates:[hz]},{command:"costs show",match:k.success,templates:["Run `fjall costs --mode forecast` to see forecasted spend","Run `fjall costs --mode breakdown` to see service-level breakdown"]},{command:"costs show",match:k.error,templates:["Run `fjall costs --app <app>` to filter by application","Run `fjall costs --help` for usage information"]},{command:"metrics show",match:k.success,templates:["Run `fjall metrics --mode latency` to see latency percentiles","Run `fjall metrics --mode errors` to see error trends"]},{command:"metrics show",match:k.error,templates:["Run `fjall metrics --app <app>` to filter by application","Run `fjall metrics --help` for usage information"]},{command:"compliance fix",match:k.success,templates:["Run `fjall compliance fix --domain <domain> --issue-id <id>` to narrow the suggestions to one issue","Run `fjall deploy <app>` to apply remediation changes"]},{command:"compliance fix",match:k.error,templates:["Run `fjall compliance fix --domain <domain>` to name the compliance domain","Run `fjall compliance --help` for usage information"]},{command:"compliance fix --execute",match:k.success,templates:["Read the result's `kind` before treating the issue as fixed: `auto-pr` opened a pull request that still has to be merged, `imperative` rewrote the live policy, and `manual-hint` changed nothing \u2014 its `awsCliHint` carries the manual step, and that field is absent for rules that supply no hint (`message` is a fixed string either way)","Do not re-read the issue to confirm the cure: nothing on the remediation path writes to the issue record, so `status` stays `open` until the next discovery scan re-evaluates the asset. Verify at the thing that changed \u2014 the pull request, or the live resource","Run `fjall deploy <app>` to roll out an `auto-pr` remediation once its pull request is merged"]},{command:"deploy diff",match:k.success,templates:["Run `fjall deploy logs --deployment-id <id>` to analyse deployment logs","Run `fjall status <app>` to check current deployment health"]},{command:"deploy diff",match:k.error,templates:["Run `fjall list deployments` to see recent deployment IDs","Run `fjall deploy diff --help` for usage information"]},{command:"deploy logs",match:k.success,templates:["Run `fjall deploy diff <idA> <idB>` to compare two deployments","Run `fjall status <app>` to check current deployment health"]},{command:"deploy logs",match:k.error,templates:["Run `fjall deploy logs --deployment-id <id>` with a valid deployment ID","Run `fjall list deployments` to find a deployment ID"]}];var oY={command:"*",match:k.error,templates:["Run `fjall <command> --help` for usage information"]},Sz=[...BU,...GU,...WU,...dz,...pz,...fz,...bz,oY];var sY=Object.defineProperty,cY=(e,t)=>sY(e,"name",{value:t,configurable:!0}),Ez=["app","environment","region","profile","target","cluster","service","lambda","status","type"],Ka=["app","cluster","service","lambda"],uY=["status","type","region"],wC={deploy:["environment","region","target"],"deploy diff":[],"deploy logs":[],destroy:["target"],"org deploy":["target"],"org destroy":["target"],"platform deploy":["target"],"platform destroy":["target"],"account deploy":["target"],"account destroy":["target"],status:[],rollout:[],list:["app"],apps:["target"],connect:["environment","region"],"connect status":[],import:["app","region"],costs:["app"],metrics:["app"],compliance:["app"],"token create":["app","environment"],"unlock bucket":["region"],"aws exec":["app","region","target"],"secrets set":Ka,"secrets get":Ka,"secrets list":Ka,"secrets delete":Ka,"secrets export":Ka,"secrets import":Ka,"secrets exec":Ka,"assets list":uY},lY=Math.max(...Object.keys(wC).map(e=>e.split(" ").length));function PC(e){let t=e.trim().split(/\s+/).slice(1);for(let r=lY;r>=1;r--){let i=t.slice(0,r).join(" ");if(Object.hasOwn(wC,i))return wC[i]}return[]}cY(PC,"resolvePreservableFlags");var dY=Object.defineProperty,gg=(e,t)=>dY(e,"name",{value:t,configurable:!0});function RC(e){let t=e.replace(/[\u0000-\u001f\u007f`]/g,"");return/[^\w@%+=:,./-]/.test(t)?`'${t.replace(/'/g,"'\\''")}'`:t}gg(RC,"shellEscape");function Az(e,t,r){let i=new Set,n=e.replace(/<(\w+)>/g,(a,o)=>{let s=t[o];return s===void 0||s===""?`<${o}>`:(i.add(o),o==="command"?s:RC(s))});return xz(n,r,i)}gg(Az,"interpolateTemplate");var hg=class{static{gg(this,"SuggestionResolver")}command;flags;constructor(t,r){this.command=t,this.flags=r}resolve(t){let r=Sz.find(i=>(i.command===this.command||i.command==="*")&&i.match(t));return r===void 0?[]:r.templates.map(i=>Az(i,t,this.flags))}};function xz(e,t,r=new Set){let i=/`(fjall[^`]*)`/.exec(e),n=i?.[1];if(i===null||n===void 0)return e;let a=PC(n),o=[];for(let d of Ez){if(!a.includes(d))continue;let h=t[d];h!==void 0&&h!==""&&!r.has(d)&&!n.includes(`--${d}`)&&o.push(`--${d} ${RC(h)}`)}if(o.length===0)return e;let s=` ${o.join(" ")}`,u=n.indexOf(" -- "),m=u===-1?`${n}${s}`:`${n.slice(0,u)}${s}${n.slice(u)}`;return e.slice(0,i.index)+`\`${m}\``+e.slice(i.index+i[0].length)}gg(xz,"applyPreservedFlags");var pY=Object.defineProperty,ti=(e,t)=>pY(e,"name",{value:t,configurable:!0});function En(e,t){if(t!==void 0&&ec(e)){let i={};for(let[n,a]of Object.entries(e))i[n]=t.has(n)?a:En(a);return i}if(typeof e=="string")return ue(e);if(e==null||typeof e!="object")return e;if(Array.isArray(e))return e.map(i=>En(i));if(e instanceof Date||e instanceof RegExp)return e;let r={};for(let[i,n]of Object.entries(e))r[i]=En(n);return r}ti(En,"maskTree");function yg(e){if(Array.isArray(e))return e.map(yg);if(!ec(e))return e;let t={};for(let[r,i]of Object.entries(e))i!==void 0&&(t[r]=yg(i));return t}ti(yg,"stripAbsent");function ec(e){return typeof e=="object"&&e!==null&&!Array.isArray(e)&&!(e instanceof Date)&&!(e instanceof RegExp)}ti(ec,"isPlainRecord");function _z(e){let t=e?.verbatimFields;return t!==void 0&&t.length>0?new Set(t):void 0}ti(_z,"toVerbatimKeys");function Tz(e,t){return t===void 0||!ec(e)?!1:Object.keys(e).some(r=>t.has(r))}ti(Tz,"carriesVerbatimField");function Cz(e,t){let r=e;for(let i of t.split(".")){if(!ec(r))return;r=r[i]}return r}ti(Cz,"resolveDotPath");function Iz(e,t,r){let i=e.project(t),n={};for(let a of r)a in i&&(n[a]=i[a]);return n}ti(Iz,"projectSelectedFields");var ql=class{static{ti(this,"AgentOutputWriter")}write;hasWrittenBlock=!1;resolver;flags;full;budget;requestedFields;constructor(t){this.write=t.writeFn??(r=>{process.stdout.write(r)}),this.resolver=new hg(t.command,t.flags),this.flags=t.flags,this.full=t.full??!1,this.budget=t.budget,this.requestedFields=t.fields??[]}get isFullOutput(){return this.full}writeBlock(t){t!==""&&(this.hasWrittenBlock&&this.write(sC+`
+`)},"defaultWriter"),Ga=KU;function Nq(e){Ga=e}ug(Nq,"configureLogWriter");function wq(){Ga=KU}ug(wq,"resetLogWriter");var Va={info(e,t,r){Ga("info",e,t,r)},warn(e,t,r){Ga("warn",e,t,r)},error(e,t,r){Ga("error",e,t,r)},debug(e,t,r){process.env.FJALL_DEBUG==="true"&&Ga("debug",e,t,r)},trace(e,t,r){process.env.FJALL_TRACE==="true"&&Ga("trace",e,t,r)},isDebugEnabled(){return process.env.FJALL_DEBUG==="true"}};var Pq=Object.defineProperty,Jl=(e,t)=>Pq(e,"name",{value:t,configurable:!0}),Rq=10;var JU=c.object({name:c.string(),type:c.enum(["apex","delegated"]),parentDomain:c.string().optional(),account:c.string().optional(),region:c.string().optional()}).strict(),XU=c.object({id:c.string().min(1),name:c.string().min(1).optional()}).strict(),qU=c.object({activeTarget:c.string().optional(),domains:c.array(JU).optional(),capacityIdentity:Xp.optional(),organisation:XU.optional()}).strict(),ZU=c.object({activeTarget:c.string().optional(),domains:c.array(JU).optional(),capacityIdentity:Xp.optional(),organisation:XU.optional()}),Oq=c.object({activeTarget:c.string().optional()});function YU(e={}){return JSON.stringify(e,null,2)}Jl(YU,"serialiseRootConfig");var HU=qU.keyof().options;function QU(e,t,r){let i=t[r];i!==void 0&&(e[r]=i)}Jl(QU,"copyDefinedKey");function _C(e,t){if(t===void 0)return!1;let r=new Set([...Object.keys(e),...Object.keys(t)]);for(let i of r)if(e[i]!==t[i])return!1;return!0}Jl(_C,"domainEntriesEqual");var lg=class e{static{Jl(this,"Config")}rootConfig;configPath=null;loadFailed=!1;parseDegraded=!1;loadedSnapshot={};searchStartDir;constructor(t,r){this.rootConfig=t??{},this.configPath=r??null}static findConfigDirectory(t){let r=t!==void 0&&t!==""?t:process.cwd();for(let i=0;i<Rq;i++){let n=wt.join(r,"fjall"),a=wt.join(n,Rn);if(Oe.existsSync(a))return n;let o=wt.join(r,Rn);if(Oe.existsSync(o))return r;let s=wt.dirname(r);if(s===r)break;r=s}return null}static loadConfigFile(t){try{return Oe.accessSync(t,Oe.constants.R_OK),Oe.readFileSync(t,{encoding:"utf8"})}catch(r){return Va.warn("Config",`Config file at ${t} could not be read; using defaults`,{file:t,error:ue(Ve(r))}),null}}static loadConfig(t){let r=e.findConfigDirectory(t);if(!r){let u=new e;return u.searchStartDir=t,u}let i=wt.join(r,Rn),n=e.loadConfigFile(i);if(n===null){let u=new e(void 0,i);return u.searchStartDir=t,u.loadFailed=!0,u}let a,o=!1;if(n!==""){let u;try{u=JSON.parse(n)}catch(d){throw e.formatZodError(d,Rn)}let m=qU.safeParse(u);if(m.success)a=m.data;else{let d=ZU.safeParse(u);a=d.success?d.data:{},o=!d.success,d.success?Va.warn("Config","fjall-config.json contains keys this version does not recognise (only activeTarget, domains, capacityIdentity and organisation are read). They were most likely written by a newer fjall version \u2014 leave them in place; saves preserve them verbatim.",{file:i}):Va.warn("Config","fjall-config.json has a malformed activeTarget, domains or capacityIdentity value, so its contents were ignored for this run \u2014 any capacity-identity pins it holds will NOT apply (a pinned stack deploys unpinned and is blocked by the rename gate). Fix the file by hand; do NOT regenerate it, which would discard the pins.",{file:i})}}let s=new e(a,i);return s.searchStartDir=t,s.parseDegraded=o,s.loadedSnapshot=structuredClone(s.rootConfig),s}static formatZodError(t,r){if(t instanceof c.ZodError&&t.issues.length>0){let n=t.issues.map(a=>`${a.path.join(".")}: ${a.message}`).join("; ");return new Error(`Failed to parse ${r}: ${n}`)}let i=(t instanceof Error?t.message:String(t)).replace(/\n/g," ").substring(0,500);return new Error(`Failed to parse ${r}: ${i}`)}saveConfig(){let t=wt.join(this.resolveProjectDirectory()??wt.join(this.searchStartDir??process.cwd(),"fjall"),Rn);if(this.loadFailed)return Sn(new Error(`Refusing to save ${t}: the file exists but could not be read when this config loaded, so saving would replace its contents with state that never included them. Fix the file permissions (e.g. chmod u+rw ${t}) and retry.`));let r=wt.dirname(t);try{Oe.mkdirSync(r,{recursive:!0})}catch(s){return Sn(new Error(`Cannot create config directory ${r}: ${ue(Ve(s))}`))}let i=e.assertWritable(t,r);if(!i.success)return i;let n=this.mergeWithDisk(t);if(!n.success)return n;let a=YU(n.data),o=`${t}.tmp-${process.pid}`;try{Oe.writeFileSync(o,a,{mode:384}),Oe.renameSync(o,t)}catch(s){return Sn(new Error(`Failed to save ${t}: ${ue(Ve(s))}`))}return this.configPath=t,Ba(void 0)}static assertWritable(t,r){if(Oe.existsSync(t))try{Oe.accessSync(t,Oe.constants.W_OK)}catch{return Sn(new Error(`Cannot save ${t}: the file is read-only. Make it writable (e.g. chmod u+w ${t}) and retry.`))}try{Oe.accessSync(r,Oe.constants.W_OK)}catch{return Sn(new Error(`Cannot save ${t}: the directory ${r} is not writable. Make it writable (e.g. chmod u+w ${r}) and retry.`))}return Ba(void 0)}mergeWithDisk(t){let r=e.readDiskConfigForMerge(t);if(r.kind==="unmergeable")return Sn(new Error(`Refusing to save ${t}: ${r.reason}. Writing now would keep only this session's state and drop everything else the file carries (including keys written by other fjall versions). Fix or remove the file and retry.`));if(r.kind==="absent")return Ba(this.rootConfig);let i=r.disk,n={...i.foreign,...i.known};for(let o of HU)o!=="domains"&&this.sessionChangedKey(o)&&(this.rootConfig[o]===void 0?delete n[o]:QU(n,this.rootConfig,o));let a=this.mergeDomains(i.known.domains);return a!==void 0?n.domains=a:delete n.domains,Ba(n)}sessionChangedKey(t){return JSON.stringify(this.rootConfig[t])!==JSON.stringify(this.loadedSnapshot[t])}mergeDomains(t){let r=this.rootConfig.domains,i=this.loadedSnapshot.domains??[];if(r===void 0&&i.length===0)return t;let n=Jl(d=>d.toLowerCase(),"norm"),a=r??[],o=new Map(i.map(d=>[n(d.name),d])),s=new Map(a.map(d=>[n(d.name),d])),u=[],m=new Set;for(let d of t??[]){let h=n(d.name);m.add(h);let g=s.get(h),l=o.get(h);if(g!==void 0&&!_C(g,l)){u.push(g);continue}g===void 0&&l!==void 0||u.push(d)}for(let d of a){let h=n(d.name);m.has(h)||_C(d,o.get(h))||u.push(d)}return u}static readDiskConfigForMerge(t){if(!Oe.existsSync(t))return{kind:"absent"};let r;try{let a=Oe.readFileSync(t,{encoding:"utf8"});if(a==="")return{kind:"absent"};r=JSON.parse(a)}catch(a){return{kind:"unmergeable",reason:`the existing file could not be read or parsed as JSON (${ue(Ve(a))})`}}let i=ZU.safeParse(r);if(!i.success){let a=i.error.issues.map(o=>`${o.path.join(".")}: ${o.message}`).join("; ");return{kind:"unmergeable",reason:`a recognised key in the existing file is malformed (${ue(a)})`}}let n={};if(typeof r=="object"&&r!==null){let a=HU;for(let[o,s]of Object.entries(r))a.includes(o)||(n[o]=s)}return{kind:"ok",disk:{known:i.data,foreign:n}}}static getConfigDirectory(t){return e.findConfigDirectory(t)}getConfigPath(){return this.configPath}isContentUnavailable(){return this.loadFailed||this.parseDegraded}static warnedLegacyActiveTarget=!1;localConfigCache;resolveProjectDirectory(){return this.configPath!==null?wt.dirname(this.configPath):e.findConfigDirectory(this.searchStartDir)}localConfigFile(){let t=this.resolveProjectDirectory();return t===null?null:wt.join(t,yi,Qc)}loadLocalConfig(){if(this.localConfigCache===void 0){let t=this.localConfigFile();if(t===null)return this.localConfigCache={};try{let r=Oe.readFileSync(t,{encoding:"utf8"}),i=Oq.safeParse(JSON.parse(r));this.localConfigCache=i.success?i.data:{}}catch{this.localConfigCache={}}}return this.localConfigCache}writeLocalConfig(t){let r=this.localConfigFile();if(r===null)return Sn(new Error("Cannot persist local state: no fjall-config.json was found from this directory, so there is no project to anchor `.fjall/local.json` to. Run this from inside a fjall project, or run `fjall create account` / `fjall create app` first."));try{Oe.mkdirSync(wt.dirname(r),{recursive:!0});let i=`${r}.tmp-${process.pid}`;Oe.writeFileSync(i,JSON.stringify(t,null,2)+`
+`,{encoding:"utf8"}),Oe.renameSync(i,r),Tm(wt.dirname(wt.dirname(r)),[xm,...eu],{header:CA,marker:hP})}catch(i){return Sn(new Error(`Failed to write ${r}: ${ue(Ve(i))}`))}return this.localConfigCache=t,Ba(void 0)}static warnLegacyActiveTargetOnce(){e.warnedLegacyActiveTarget||(e.warnedLegacyActiveTarget=!0,Va.warn("Config","`activeTarget` in fjall-config.json is deprecated and ignored: a committed target must never re-aim a deploy or CI pipeline. Run `fjall target set <name>` to store it locally in .fjall/local.json, then remove `activeTarget` from the committed fjall-config.json."))}getActiveTarget(){let t=this.loadLocalConfig().activeTarget;if(t!==void 0)return t;this.rootConfig.activeTarget!==void 0&&e.warnLegacyActiveTargetOnce()}setActiveTarget(t){let r=this.loadLocalConfig();return r.activeTarget=t,this.writeLocalConfig(r)}clearActiveTarget(){let t=this.loadLocalConfig();return delete t.activeTarget,this.writeLocalConfig(t)}getDomains(){return this.rootConfig.domains??[]}setDomains(t){this.rootConfig.domains=t}addDomain(t){this.rootConfig.domains||(this.rootConfig.domains=[]),this.rootConfig.domains.push(t)}getDomain(t){return this.rootConfig.domains?.find(r=>r.name.toLowerCase()===t.toLowerCase())}removeDomain(t){if(!this.rootConfig.domains)return!1;let r=this.rootConfig.domains.findIndex(i=>i.name.toLowerCase()===t.toLowerCase());return r===-1?!1:(this.rootConfig.domains.splice(r,1),!0)}getOrganisation(){return this.rootConfig.organisation}setOrganisation(t){this.rootConfig.organisation=t}clearOrganisation(){delete this.rootConfig.organisation}};var $q=Object.defineProperty,ji=(e,t)=>$q(e,"name",{value:t,configurable:!0});function TC(e){let t;try{t=lg.loadConfig(e)}catch(i){return{kind:"unreadable",reason:ue(Ve(i))}}if(t.isContentUnavailable())return{kind:"unreadable",reason:"fjall-config.json exists but its contents could not be loaded (the preceding warning names the problem)"};let r=t.getOrganisation();return r!==void 0?{kind:"bound",bound:r}:t.getConfigPath()===null?{kind:"no_project"}:{kind:"unbound"}}ji(TC,"readProjectBinding");function CC(e,t,r){switch(e.kind){case"unreadable":return e;case"no_project":return{kind:"unbound",projectFound:!1,identity:t};case"unbound":return{kind:"unbound",projectFound:!0,identity:t};case"bound":return t===null?{kind:"unverifiable",bound:e.bound,reason:r??"the organisation could not be resolved"}:e.bound.id===t.id?{kind:"matched",bound:e.bound}:{kind:"mismatched",bound:e.bound,actual:t}}}ji(CC,"resolveBindingVerdict");function ez(e,t={}){return CC(TC(t.startDir),e,t.unresolvedReason)}ji(ez,"checkProjectOrganisation");function Wa(e){return e.name!==void 0&&e.name!==""?`${e.name} (${e.id})`:e.id}ji(Wa,"describeOrganisation");function tz(e,t,r){return`Refusing to ${e}: this project's fjall-config.json records organisation ${Wa(t)} as its home, but the credential in use belongs to ${Wa(r)}. Nothing was created, synthesised or deployed. Cure: authenticate as ${Wa(t)} ('fjall login', or set FJALL_API_KEY to a key for that organisation), or \u2014 if this project really is moving \u2014 run 'fjall org bind --org ${r.id} --force' to re-bind it.`}ji(tz,"buildWrongOrganisationMessage");function rz(e,t){return`Refusing to ${e}: ${t}, so this project's organisation binding cannot be checked. Nothing was created, synthesised or deployed. Cure: fix fjall-config.json (permissions or contents), then re-run.`}ji(rz,"buildUnreadableConfigMessage");function nz(e,t){return`Could not confirm which organisation your credential belongs to (${t}). Proceeding \u2014 this project is bound to ${Wa(e)}, and a mismatch would not have been caught.`}ji(nz,"buildUnverifiableNotice");function iz(e){return`This project is not bound to an organisation. Run 'fjall org bind' to pin it to ${Wa(e)} \u2014 afterwards, any command run here with another organisation's credential is refused instead of silently landing there.`}ji(iz,"buildUnboundNotice");import{createHash as Fq}from"node:crypto";var jq=Object.defineProperty,Mq=(e,t)=>jq(e,"name",{value:t,configurable:!0});function az(e,t){return Fq("sha256").update(`${e}${t}`).digest("hex")}Mq(az,"credentialFingerprint");import*as pg from"node:fs";var Lq=Object.defineProperty,dg=(e,t)=>Lq(e,"name",{value:t,configurable:!0}),oz="org-config-cache.json";function IC(){return Lo(oz)}dg(IC,"orgConfigCachePath");function DC(e){return typeof e=="object"&&e!==null&&!Array.isArray(e)}dg(DC,"isObject");function kC(e){return DC(e)&&typeof e.organisationId=="string"&&e.organisationId!==""&&typeof e.organisationName=="string"}dg(kC,"isCachedCredentialIdentity");function sz(e){try{let t=IC();if(!pg.existsSync(t))return null;let r=JSON.parse(pg.readFileSync(t,"utf-8"));return!DC(r)||r.credentialFingerprint!==e?null:kC(r.identity)?r.identity:null}catch(t){return Va.debug("cachedCredentialIdentity","Cache read failed, treating as a miss",{error:ue(Ve(t))}),null}}dg(sz,"readCachedCredentialIdentity");var Uq=Object.defineProperty,zq=(e,t)=>Uq(e,"name",{value:t,configurable:!0}),cz="https://fjall.io";function mg(){let e=process.env.FJALL_API_URL;return e!==void 0&&e!==""?e:cz}zq(mg,"resolveApiBaseUrl");var uz={name:"@fjall/cli",version:"28.2.0",repository:{type:"git",url:"git+https://github.com/fjall-tech/fjall.git",directory:"cli"},description:"Fjall CLI helper",private:!0,type:"module",bin:{fjall:"dist/src/cli.js"},files:["dist/"],scripts:{clean:"rm -rf ./dist ./dist.next ./sourcemaps","clean:node":"rm -rf ./node_modules","copy-files":'DEST="${DEST:-dist}"; find generators -type d -name files | while read dir; do mkdir -p "$DEST/$dir" && cp -R "$dir/." "$DEST/$dir/"; done && cp -R src/proto "./$DEST/src/proto"',build:"rm -rf ./dist.next ./sourcemaps && npx tsc --outDir dist.next && DEST=dist.next npm run copy-files && node ../scripts/minify-dist.mjs dist.next && chmod +x ./dist.next/src/cli.js && rm -rf ./dist && mv ./dist.next ./dist && node ../scripts/stamp-build.mjs",watch:"npm run build && npx tsc-watch","watch:only":'npx tsc-watch --onSuccess "npm run copy-files"',"fjall-cli":"node ./dist/src/cli.js",version:"npx tsx scripts/updateTemplateVersions.ts && node ../scripts/sync-ci-plugin-major.mjs",format:'prettier --write "src/**/*.{ts,tsx,js,jsx,json}" "generators/**/*.{ts,tsx,js,jsx,json}"',"format:check":'prettier --check "src/**/*.{ts,tsx,js,jsx,json}" "generators/**/*.{ts,tsx,js,jsx,json}"',lint:"eslint src/ generators/","lint:fix":"eslint src/ generators/ --fix",typecheck:"tsc --noEmit","typecheck:tests":"tsc --noEmit --project tsconfig.test.json","typecheck:scripts":"tsc --noEmit --project tsconfig.scripts.json","typecheck:all":"npm run typecheck && npm run typecheck:tests && npm run typecheck:scripts",test:"vitest run","test:watch":"vitest","test:coverage":"vitest run --coverage","test:integration":"vitest run --config vitest.config.integration.ts","test:integration:watch":"vitest --config vitest.config.integration.ts","test:e2e":"vitest run --config vitest.e2e.config.ts","test:all":"npm run test && npm run test:integration && npm run test:e2e","test:setup":"node scripts/setupTestFixtures.mjs","test:payload-compat":"npx tsx scripts/testPayloadCompatibility.ts","test:payload-compat:e2e":"npx tsx scripts/testPayloadCompatibility.ts --e2e"},engines:{node:">=22.0.0"},author:"",license:"SEE LICENSE IN LICENSE",devDependencies:{"@eslint/js":"^10.0.1","@playwright/test":"^1.62.0","@testing-library/dom":"^10.4.1","@testing-library/react":"^16.3.2","@types/ejs":"^3.1.5","@types/prompts":"^2.4.9","@types/proper-lockfile":"^4.1.4","@types/react":"^19.2.17","@typescript-eslint/parser":"^8.65.0","@vitest/coverage-v8":"^4.1.10","aws-cdk-lib":"^2.265.0",constructs:"^10.7.2",eslint:"^10.8.0","ink-testing-library":"^4.0.0",jsdom:"^30.0.1",prettier:"^3.9.6","react-dom":"^19.2.8","strip-ansi":"^6.0.1","tsc-watch":"^7.2.1",tsx:"^4.23.1","typescript-eslint":"^8.65.0",vitest:"4.1.10"},dependencies:{"@anthropic-ai/sdk":"^0.115.0","@aws-sdk/client-acm":"^3.1098.0","@aws-sdk/client-auto-scaling":"^3.1098.0","@aws-sdk/client-backup":"^3.1098.0","@aws-sdk/client-cloudformation":"^3.1098.0","@aws-sdk/client-cost-explorer":"^3.1098.0","@aws-sdk/client-ec2":"^3.1098.0","@aws-sdk/client-ecr":"^3.1098.0","@aws-sdk/client-ecs":"^3.1098.0","@aws-sdk/client-elasticache":"^3.1098.0","@aws-sdk/client-iam":"^3.1098.0","@aws-sdk/client-identitystore":"^3.1098.0","@aws-sdk/client-lambda":"^3.1098.0","@aws-sdk/client-organizations":"^3.1098.0","@aws-sdk/client-ram":"^3.1098.0","@aws-sdk/client-rds":"^3.1098.0","@aws-sdk/client-route-53":"^3.1098.0","@aws-sdk/client-s3":"^3.1098.0","@aws-sdk/client-secrets-manager":"^3.1098.0","@aws-sdk/client-ssm":"^3.1098.0","@aws-sdk/client-sso":"^3.1098.0","@aws-sdk/client-sso-admin":"^3.1098.0","@aws-sdk/client-sso-oidc":"^3.1098.0","@aws-sdk/client-sts":"^3.1098.0","@fjall/deploy-core":"^28.2.0","@fjall/generator":"^28.2.0","@fjall/util":"^28.2.0","@nx/devkit":"^23.1.0","@opennextjs/aws":"^4.1.0","@smithy/node-http-handler":"^4.9.13","@toon-format/toon":"^4.1.0","aws-cdk":"^2.1134.0",axios:"^1.19.0",chalk:"^6.0.0","cli-cursor":"^5.0.0",commander:"^15.0.0",ejs:"^6.0.1",ink:"^7.1.1","js-yaml":"^5.2.2",open:"^11.0.0",ora:"^9.4.1",prompts:"^2.4.2","proper-lockfile":"^4.1.2",protobufjs:"^8.7.1",react:"^19.2.8",typescript:"^6.0.3","update-check":"^1.5.4",zod:"^4.4.3"}};var Gq=Object.defineProperty,Vq=(e,t)=>Gq(e,"name",{value:t,configurable:!0}),ihe=`fjall-cli/${uz.version} node/${process.versions.node} ${Wq()}/${Kq()}`;var lz=mg(),ahe=c.looseObject({deviceCode:c.string(),userCode:c.string(),verificationUri:c.string(),expiresIn:c.number(),interval:c.number()}),ohe=c.looseObject({status:c.string(),apiKey:c.string().optional(),organisationId:c.string().optional(),organisationName:c.string().optional(),email:c.string().optional()}),she=c.looseObject({application:c.looseObject({id:c.string()})}),NC=c.looseObject({id:c.string(),name:c.string(),vpcCidr:c.string().nullable(),connectedAwsAccountId:c.string().nullable()}),che=c.looseObject({applications:c.array(NC),nextCursor:c.string().optional()}),uhe=c.looseObject({application:NC}),lhe=c.looseObject({applications:c.array(NC)}),dhe=c.looseObject({application:c.looseObject({id:c.string(),name:c.string()})}),phe=c.looseObject({primaryRegion:c.string().nullish(),secondaryRegions:c.array(c.string()).optional(),disasterRecoveryRegion:c.string().nullish(),providerAccounts:c.custom(e=>Array.isArray(e)),ssoSessions:c.record(c.string(),c.looseObject({ssoRegion:c.string(),ssoStartUrl:c.string()})).optional(),rootOidcRoleArn:c.string().nullish(),allowCodemodLlmFallback:c.boolean().optional(),rootAccessManagement:c.custom(e=>typeof e=="string").optional(),requireTrackedDeploys:c.boolean().optional().catch(void 0)}),mhe=c.looseObject({id:c.string(),token:c.string(),tokenPrefix:c.string(),name:c.string(),scopes:c.array(c.string())}),Zq=c.looseObject({id:c.string(),name:c.string(),tokenPrefix:c.string(),scopes:c.array(c.string()),resourceConstraints:c.record(c.string(),c.unknown()),sourceTag:c.string().nullable(),expiresAt:c.string(),createdAt:c.string(),revokedAt:c.string().nullable(),revokedReason:c.string().nullable(),lastUsedAt:c.string().nullable(),usageCount:c.number(),deniedCount:c.number()}),fhe=c.looseObject({tokens:c.array(Zq)}),hhe=c.looseObject({scopes:c.array(c.string()),expiresAt:c.string().optional()}),Hq=c.looseObject({id:c.string(),awsAccountId:c.string(),accountName:c.string().nullable(),environment:c.string().nullable()}),ghe=c.looseObject({accounts:c.array(Hq)}),Jq=c.looseObject({id:c.string(),assetIdentifier:c.string(),name:c.string(),type:c.string(),status:c.string(),region:c.string().nullish(),_count:c.looseObject({complianceIssues:c.number()}).optional()}),Xq=c.looseObject({id:c.string(),name:c.string(),assetIdentifier:c.string(),provider:c.string(),type:c.string(),status:c.string(),region:c.string().nullish(),iacStatus:c.string().nullish(),accountId:c.string().nullish(),estimatedMonthlyCost:c.string().nullish(),lastSeenAt:c.string().nullish(),createdAt:c.string().nullish(),updatedAt:c.string().nullish()}),yhe=c.looseObject({assets:c.array(Jq),nextCursor:c.string().optional()}),vhe=c.looseObject({asset:Xq}),qq=c.looseObject({id:c.string(),ruleId:c.string(),title:c.string(),severity:c.string(),status:c.string()}),bhe=c.looseObject({issues:c.array(qq)}),She=c.record(c.string(),c.unknown()),Ehe=c.union([c.array(c.record(c.string(),c.unknown())),c.record(c.string(),c.unknown())]),Ahe=c.record(c.string(),c.unknown()),xhe=c.record(c.string(),c.unknown()),_he=c.record(c.string(),c.unknown()),The=c.record(c.string(),c.unknown()),Che=c.looseObject({deployment:c.looseObject({id:c.string()}),minCliVersion:c.string().optional()});var Yq=c.object({id:c.string(),releaseNumber:c.number().int(),status:c.string(),commitSha:c.string().nullable(),branch:c.string().nullable(),createdAt:c.string(),assemblyDigest:c.string().nullable(),createdByDeploymentId:c.string().nullable(),rollbackOfReleaseId:c.string().nullable(),services:c.array(vm.strip())}),Ihe=c.object({releases:c.array(Yq),currentReleaseId:c.string().nullable(),nextCursor:c.number().int().optional()}),Qq=c.object({id:c.string(),status:c.string(),target:c.string().nullish(),applicationId:c.string().nullish(),applicationName:c.string().nullish(),connectedAwsAccountId:c.string().nullish(),source:c.string().nullish(),startedAt:c.string().nullish(),triggeredByName:c.string().nullish(),machineLabel:c.string().nullish()}),Dhe=c.object({deployments:c.array(Qq)}),khe=c.object({cancelled:c.boolean(),message:c.string().nullish(),declined:c.boolean().nullish()}),Nhe=c.object({released:c.literal(!0),id:c.string().nullish()}),whe=c.looseObject({organisationId:c.string(),organisationName:c.string(),organisationSlug:c.string().min(1).optional()}),Phe=c.looseObject({status:c.string(),roleArn:c.string().optional(),accountId:c.string().optional(),phase:c.string().optional(),reason:c.string().optional()}),Rhe=c.looseObject({token:c.string()}),eY=c.looseObject({quickCreateUrl:c.string(),externalId:c.string()}),tY=c.looseObject({alreadyConnected:c.literal(!0),account:c.looseObject({awsAccountId:c.string(),accountName:c.string().nullable(),status:c.string()})}),Ohe=c.union([tY,eY]);function rY(e){return"alreadyConnected"in e&&e.alreadyConnected===!0}Vq(rY,"isAlreadyConnected");var $he=c.looseObject({registered:c.boolean(),repository:c.looseObject({id:c.string()}).optional()});var nY=Object.defineProperty,iY=(e,t)=>nY(e,"name",{value:t,configurable:!0});function Xl(e=lz){return`Deploy tokens are minted from a signed-in browser session by an owner or admin: open ${e}/settings/ci (Settings \u2192 CI/CD Tokens).`}iY(Xl,"deployTokenMintGuidance");var dz=[{command:"ci status",match:k.success,templates:["Run `fjall ci verify` to check the rest of the wiring \u2014 an active deploy token is necessary, not sufficient","Run `fjall ci token list` to see which applications, environments and accounts each active token may deploy to"]},{command:"ci status",match:k.empty,templates:[Xl(),"Run `fjall ci setup --plan --app <app>` to learn where the workflow file will go and which secret name it will read (`workflowPath`, `secretName`) \u2014 the two things needed to stage the secret before minting. `--plan` mints nothing and writes nothing, and the workflow BODY is printed on the human surface only: it is not a field of the agent payload"]},{command:"ci token list",match:k.success,templates:["Run `fjall token show <id>` to inspect one token's stored constraints","Run `fjall ci token revoke <id> --reason <text>` to revoke a listed token"]},{command:"ci token list",match:k.empty,templates:[Xl(),"Run `fjall ci status` to re-check readiness once a token exists"]},{command:"ci token revoke",match:k.success,templates:["Run `fjall ci token list` to confirm the token now lists as revoked \u2014 a revoked token stays listed, it does not disappear",`Any CI job still holding this token now fails to authenticate. ${Xl()}`]}];var fg="Do not retry or vary flags: `supported: false` is the server's capability verdict, not an input error \u2014 every invocation answers the same until the Fjall server is updated to a version that ships this API (the `message` field names the upgrade)",pz=[{command:"deployments list",match:k.unsupported,templates:[fg]},{command:"deployments cancel",match:k.unsupported,templates:[fg]},{command:"deployments force-release",match:k.unsupported,templates:[fg]},{command:"dev list",match:k.unsupported,templates:[fg]},{command:"deployments list",match:k.success,templates:["Run `fjall deployments cancel <id>` to request co-operative cancellation of a listed deployment","Run `fjall deploy logs --deployment-id <id>` to read one deployment's logs"]},{command:"deployments cancel",match:k.success,templates:["Run `fjall deployments list` to confirm whether the slot is free, and read `cancelled` and `declined` before assuming it is: `cancelled: false` means the request was refused, `declined: true` is an already-terminal reject, and a plain granted cancel is co-operative \u2014 the deployment has to acknowledge it","Run `fjall deployments force-release <id> --confirm <id>` to clear a slot that stays occupied (organisation admin, audited \u2014 retype the id in `--confirm`)"]},{command:"deployments force-release",match:k.success,templates:["Run `fjall deployments list` to confirm the slot is free","Run `fjall deploy <app>` to retry the deployment the wedged slot was blocking"]},{command:"dev up",match:k.success,templates:["Run `fjall dev list <app>` to see every slot for this app with its `host` \u2014 rows carry `host`, not a full URL, and it is empty until the slot leaves `creating`","Run `fjall dev down <app> --branch <branch>` to tear this slot down"]},{command:"dev list",match:k.success,templates:["Run `fjall dev down <app> --branch <branch>` to tear one listed slot down \u2014 every row carries the `branch` to name here","Run `fjall dev up <app> --branch <branch>` to bring another branch up"]},{command:"dev down",match:k.success,templates:["Run `fjall dev list <app>` to see which slots remain","Run `fjall dev up <app> --branch <branch>` to bring the branch back up"]},{command:"dev substrate down",match:k.success,templates:["Run `fjall dev list <app>` to confirm no slot survives \u2014 the substrate will not tear down under live slots, and `--force` takes them with it","Any `residuals` row survives the teardown and can still cost: its `cleanupHint` names the manual step"]}];var mz=["Run `fjall domain deploy <name>` to deploy the domain","Run `fjall domain verify <name>` to check DNS delegation once it is deployed","Run `fjall domain export <name>` to export the live zone records"],fz=[{command:"org deploy",match:k.success,templates:["Run `fjall org get` to review the deployed organisation topology and accounts",`Run \`${te.accountDeploy}\` to deploy the account tier if you passed \`--no-cascade\``,`Run \`${te.createApplicationAgent} --name "<name>"\` to create an application to deploy into it`]},{command:"org deploy",match:k.error,templates:["Run `fjall org get` to see which tier of the cascade is already deployed",`Run \`${te.organisationDeploy} --no-cascade\` to retry the organisation stack alone`]},{command:"platform deploy",match:k.success,templates:[`Run \`${te.accountDeploy}\` to deploy the account tier on top of it`]},{command:"platform deploy",match:k.error,templates:["Run `fjall org get` to check the organisation tier is deployed first"]},{command:"account deploy",match:k.success,templates:["Run `fjall apps list` to see which applications are registered","Run `fjall deploy <application>` to deploy one into this account"]},{command:"account deploy",match:k.error,templates:["Run `fjall org get` to confirm the account is registered in the organisation",`Run \`${te.accountDeploy} --target <target>\` to select a specific member account`]},{command:"domain list",match:k.success,templates:["Run `fjall domain verify <name>` to check DNS delegation","Run `fjall domain export <name>` to export zone file","Run `fjall create domain --name <name>` to create a new domain"]},{command:"domain list",match:k.empty,templates:['Run `fjall create domain --name "<name>"` to create a domain',"Run `fjall domain import <name>` to import from Route53"]},{command:"domain verify",match:k.success,templates:["Run `fjall domain export <name>` to export zone file","Run `fjall domain deploy <name>` to deploy domain infrastructure"]},{command:"domain verify",match:k.error,templates:["Run `fjall domain verify <name>` to retry","Run `fjall domain list` to see existing domains"]},{command:"domain export",match:k.success,templates:["Run `fjall domain verify <name>` to check delegation","Run `fjall domain import <name>` to re-import from Route53"]},{command:"domain import",match:k.success,templates:["Run `fjall domain verify <name>` to check delegation","Run `fjall domain export <name>` to see the zone file","Run `fjall domain deploy <name>` to deploy domain infrastructure"]},{command:"domain import",match:k.error,templates:["Run `fjall domain import --hosted-zone-id <id>` to import by zone ID","Run `fjall domain list` to see existing domains"]},{command:"domain records list",match:k.success,templates:["Run `fjall domain sync <domain>` for the full zone-hygiene report","Run `fjall domain sync <domain> --fix` to remediate residue records via the destruction ceremony"]},{command:"domain records list",match:k.empty,templates:["Run `fjall domain deploy <domain>` to deploy the domain's declared records","Run `fjall domain list` to see existing domains"]},{command:"domain records list",match:k.error,templates:["Run `fjall domain records list <domain> --hosted-zone-id <id>` when the zone is not resolvable by name",`Run \`${te.connect}\` if AWS credentials are missing`]},{command:"domain sync",match:k.success,templates:["Run `fjall domain sync <domain> --fix` to remediate residue records (ceremony-gated)","Run `fjall domain records list <domain>` to see every record with its owner"]},{command:"domain sync",match:k.error,templates:["Run `fjall domain sync <domain> --hosted-zone-id <id>` when the zone is not resolvable by name","Run `fjall domain list` to see existing domains"]},{command:"domain delegate",match:k.success,templates:["Run `fjall domain verify <domain>` to confirm public DNS resolution","Run `fjall domain deploy <domain>` to continue a two-phase deploy after delegation"]},{command:"domain delegate",match:k.error,templates:["Run `fjall domain deploy <parent-domain>` so the parent publishes its DelegationRole","Run `fjall domain verify <domain> --show-delegation` for registrar instructions"]},{command:"domain destroy",match:k.success,templates:["Run `fjall domain list` to see remaining domains","Run `fjall domain sync <parent-domain>` to confirm no delegation residue remains"]},{command:"domain destroy",match:k.error,templates:["Run `fjall domain destroy <domain> --remediate '<name>'=recreate` with the exact consent the ticket names","Run `fjall domain list` to see existing domains"]},{command:"domain deploy",match:k.success,templates:["Run `fjall domain verify <domain>` to check DNS propagation","Run `fjall domain delegate <domain>` to write the NS delegation for a delegated child"]},{command:"domain deploy",match:k.error,templates:["Run `fjall domain deploy <domain>` to resume \u2014 the zone phase is retained and skipped on re-run","Run `fjall domain verify <domain> --show-delegation` for registrar delegation instructions"]},{command:"domain eject",match:k.success,templates:["Review the ejected infrastructure.ts \u2014 it is now vanilla CDK owned by you","Run `fjall domain list` to see remaining managed domains"]},{command:"create domain",match:k.success,templates:mz},{command:"domain create",match:k.success,templates:mz},{command:"create domain",match:k.error,templates:["Run `fjall domain list` to see existing domains",'Run `fjall create domain --name "<name>"` to retry with a different name']},{command:"create account",match:k.success,templates:[`Run \`${te.connect} --environment production\` to link your AWS account`,`Run \`${te.accountDeploy}\` to deploy account infrastructure (after connecting)`]},{command:"create account",match:k.error,templates:[`Run \`${te.createAccount} --primary-region <region>\` to retry`,`Run \`${te.createAccount} --help\` for usage information`]},{command:"create org",match:k.success,templates:[`Run \`${te.connect} --name "<account-name>" --region <region>\` to link the AWS Organizations management account \u2014 omit \`--environment\` so it registers at the organisation tier`,`Run \`${te.organisationDeploy}\` to deploy all infrastructure (after connecting)`]},{command:"create org",match:k.error,templates:[`Run \`${te.createOrganisation} --email "<email>"\` to retry (add \`--name "<name>"\` only for a brand-new organisation)`,`Run \`${te.createOrganisation} --help\` for all options`]},{command:"restore",match:k.successDryRun,templates:["Run `fjall restore <resourceType> --recovery-point <recoveryPointArn> --yes` to initiate restore","Run `fjall apps list` to see existing applications"]},{command:"restore",match:k.success,templates:["Open the AWS Console URL above to monitor restore progress","Run `fjall import` to import the restored resource after completion"]},{command:"restore",match:k.errorWithCode("NOT_FOUND"),templates:["Verify the recovery point ARN is correct and exists in the current region","Run `fjall restore <resourceType> --recovery-point <arn>` to retry"]},{command:"restore",match:k.errorWithCode("FORBIDDEN"),templates:["Ensure the IAM role has backup:StartRestoreJob and iam:PassRole permissions","Run `fjall restore` interactively to configure with guided setup"]},{command:"import",match:k.successDryRun,templates:["Run `fjall import --app <app> --resource-id <resourceId> --yes` to import a specific resource","Run `fjall import --app <app> --yes` to import all discovered resources"]},{command:"import",match:k.success,templates:["Run `fjall deploy <app>` to deploy with the imported resource","Run `fjall apps describe <app>` to see updated resources"]},{command:"import",match:k.errorWithCode("NOT_FOUND"),templates:[`Run \`${te.createApplicationAgent} --name "<app>"\` to create the application`,"Run `fjall apps list` to see existing applications"]},{command:"import",match:k.errorWithCode("VALIDATION_ERROR"),templates:["Run `fjall import --app <app> --resource-id <resourceId>` to import a specific resource","Run `fjall import --app <app> --resource-id <resourceId> --yes` to import immediately"]},{command:"aws exec",match:k.success,templates:["Run `fjall aws exec -- <command...>` to run another AWS CLI command","Run `fjall status` to check application health"]},{command:"aws exec",match:k.error,templates:["Retry the command \u2014 OIDC token mints can fail transiently",`Run \`${te.login}\` if the retry also fails with an authentication error`]},{command:"unlock bucket",match:k.success,templates:["Re-put sane bucket policy statements (enforceSSL deny, access grants) \u2014 the unlock deleted the ENTIRE policy","Run `fjall destroy <app>` to retry the blocked stack cleanup"]},{command:"unlock bucket",match:k.error,templates:["Ensure your credentials belong to the organisation's management account \u2014 STS AssumeRoot is rejected elsewhere","Run `fjall unlock bucket <name> --account <id> --acknowledge-root-session` to retry"]}];var aY=Object.defineProperty,vz=(e,t)=>aY(e,"name",{value:t,configurable:!0}),hz="Run `fjall connect status` to check that an AWS account is connected: asset discovery only inventories connected accounts, so an organisation with none has nothing to inventory",gz=["Run `fjall assets show <asset>` to read one asset in full \u2014 pass its `assetIdentifier`","Run `fjall assets compliance <asset>` to list an asset's recorded posture issues \u2014 pass its `assetIdentifier`, the address every server version accepts"],yz=vz(e=>e.outcome==="success"&&e.nextCursor!==void 0,"isTruncatedPage"),bz=[{command:"assets list",match:vz(e=>yz(e)&&e.fields!==void 0&&e.fields!=="","match"),templates:["This window is truncated \u2014 more assets exist beyond these rows. Run `fjall assets list --cursor <nextCursor> --fields <fields>` to fetch the next page with the same projection; `total` counts this window only, and `fjall assets summary` reports the estate-wide tally, split active/deleted",...gz]},{command:"assets list",match:yz,templates:["This window is truncated \u2014 more assets exist beyond these rows. Run `fjall assets list --cursor <nextCursor>` to fetch the next page; `total` counts this window only, and `fjall assets summary` reports the estate-wide tally, split active/deleted",...gz]},{command:"assets list",match:k.success,templates:["The `total` aggregate counts the rows in this response, not the estate: `--take` bounds the window (default 50). No `nextCursor` aggregate here means the estate ends with these rows; `fjall assets summary` reports the estate-wide tally, split active/deleted","Run `fjall assets show <asset>` to read one asset in full","Run `fjall assets compliance <asset>` to list an asset's recorded posture issues \u2014 pass its `assetIdentifier`, the address every server version accepts (row `id`s are only accepted by newer servers)"]},{command:"assets list",match:k.empty,templates:["Run `fjall assets list --status deleted` to include assets discovery has since marked deleted \u2014 the default listing hides them",hz]},{command:"assets show",match:k.success,templates:["Run `fjall assets compliance <asset>` to list the posture issues recorded against this asset","Run `fjall assets show <asset> --fields id,accountId,iacStatus,estimatedMonthlyCost,lastSeenAt` to read the fields the default projection omits"]},{command:"assets compliance",match:k.success,templates:["Read the `status` column before acting: this listing returns every issue recorded against the asset, `resolved` and `suppressed` included, where the `openIssues` count on `fjall assets list` counts only the open ones","Run `fjall compliance fix --domain compliance --issue-id <issueId>` to read this issue in full alongside the organisation's other open issues. `--domain` is the producer's category \u2014 one of `compliance`, `cost`, `performance` \u2014 not a framework name, and the response is context to reason from, not a remediation step: use `--execute` to run one","Run `fjall assets show <asset>` to read the asset these issues were raised against"]},{command:"assets compliance",match:k.empty,templates:["No issue of ANY status has been recorded against this asset \u2014 an empty listing here is not the same as issues that were resolved, which would still appear with `status: resolved`","Run `fjall assets list --fields name,assetIdentifier,openIssues` to find the assets that do carry open issues"]},{command:"assets summary",match:k.success,templates:["Run `fjall assets list --fields name,assetIdentifier,openIssues` to see which assets sit behind `withIssues` \u2014 `withIssues` counts the assets carrying at least one open issue, `openIssues` counts those issues per asset","Run `fjall assets list --take <n>` to read the rows behind these totals \u2014 page onwards with `--cursor` when the listing reports a `nextCursor`, and pass `--status deleted` to include the `deleted` rows in the listing (interleaved with active \u2014 read the `status` column). These totals are estate-wide (the summary pages the listing to exhaustion, deleted assets included): `total` counts the whole estate, `active` and `deleted` split it"]},{command:"assets summary",match:k.empty,templates:[hz]},{command:"costs show",match:k.success,templates:["Run `fjall costs --mode forecast` to see forecasted spend","Run `fjall costs --mode breakdown` to see service-level breakdown"]},{command:"costs show",match:k.error,templates:["Run `fjall costs --app <app>` to filter by application","Run `fjall costs --help` for usage information"]},{command:"metrics show",match:k.success,templates:["Run `fjall metrics --mode latency` to see latency percentiles","Run `fjall metrics --mode errors` to see error trends"]},{command:"metrics show",match:k.error,templates:["Run `fjall metrics --app <app>` to filter by application","Run `fjall metrics --help` for usage information"]},{command:"compliance fix",match:k.success,templates:["Run `fjall compliance fix --domain <domain> --issue-id <id>` to narrow the suggestions to one issue","Run `fjall deploy <app>` to apply remediation changes"]},{command:"compliance fix",match:k.error,templates:["Run `fjall compliance fix --domain <domain>` to name the compliance domain","Run `fjall compliance --help` for usage information"]},{command:"compliance fix --execute",match:k.success,templates:["Read the result's `kind` before treating the issue as fixed: `auto-pr` opened a pull request that still has to be merged, `imperative` rewrote the live policy, and `manual-hint` changed nothing \u2014 its `awsCliHint` carries the manual step, and that field is absent for rules that supply no hint (`message` is a fixed string either way)","Do not re-read the issue to confirm the cure: nothing on the remediation path writes to the issue record, so `status` stays `open` until the next discovery scan re-evaluates the asset. Verify at the thing that changed \u2014 the pull request, or the live resource","Run `fjall deploy <app>` to roll out an `auto-pr` remediation once its pull request is merged"]},{command:"deploy diff",match:k.success,templates:["Run `fjall deploy logs --deployment-id <id>` to analyse deployment logs","Run `fjall status <app>` to check current deployment health"]},{command:"deploy diff",match:k.error,templates:["Run `fjall list deployments` to see recent deployment IDs","Run `fjall deploy diff --help` for usage information"]},{command:"deploy logs",match:k.success,templates:["Run `fjall deploy diff <idA> <idB>` to compare two deployments","Run `fjall status <app>` to check current deployment health"]},{command:"deploy logs",match:k.error,templates:["Run `fjall deploy logs --deployment-id <id>` with a valid deployment ID","Run `fjall list deployments` to find a deployment ID"]}];var oY={command:"*",match:k.error,templates:["Run `fjall <command> --help` for usage information"]},Sz=[...BU,...GU,...WU,...dz,...pz,...fz,...bz,oY];var sY=Object.defineProperty,cY=(e,t)=>sY(e,"name",{value:t,configurable:!0}),Ez=["app","environment","region","profile","target","cluster","service","lambda","status","type"],Ka=["app","cluster","service","lambda"],uY=["status","type","region"],wC={deploy:["environment","region","target"],"deploy diff":[],"deploy logs":[],destroy:["target"],"org deploy":["target"],"org destroy":["target"],"platform deploy":["target"],"platform destroy":["target"],"account deploy":["target"],"account destroy":["target"],status:[],rollout:[],list:["app"],apps:["target"],connect:["environment","region"],"connect status":[],import:["app","region"],costs:["app"],metrics:["app"],compliance:["app"],"token create":["app","environment"],"unlock bucket":["region"],"aws exec":["app","region","target"],"secrets set":Ka,"secrets get":Ka,"secrets list":Ka,"secrets delete":Ka,"secrets export":Ka,"secrets import":Ka,"secrets exec":Ka,"assets list":uY},lY=Math.max(...Object.keys(wC).map(e=>e.split(" ").length));function PC(e){let t=e.trim().split(/\s+/).slice(1);for(let r=lY;r>=1;r--){let i=t.slice(0,r).join(" ");if(Object.hasOwn(wC,i))return wC[i]}return[]}cY(PC,"resolvePreservableFlags");var dY=Object.defineProperty,gg=(e,t)=>dY(e,"name",{value:t,configurable:!0});function RC(e){let t=e.replace(/[\u0000-\u001f\u007f`]/g,"");return/[^\w@%+=:,./-]/.test(t)?`'${t.replace(/'/g,"'\\''")}'`:t}gg(RC,"shellEscape");function Az(e,t,r){let i=new Set,n=e.replace(/<(\w+)>/g,(a,o)=>{let s=t[o];return s===void 0||s===""?`<${o}>`:(i.add(o),o==="command"?s:RC(s))});return xz(n,r,i)}gg(Az,"interpolateTemplate");var hg=class{static{gg(this,"SuggestionResolver")}command;flags;constructor(t,r){this.command=t,this.flags=r}resolve(t){let r=Sz.find(i=>(i.command===this.command||i.command==="*")&&i.match(t));return r===void 0?[]:r.templates.map(i=>Az(i,t,this.flags))}};function xz(e,t,r=new Set){let i=/`(fjall[^`]*)`/.exec(e),n=i?.[1];if(i===null||n===void 0)return e;let a=PC(n),o=[];for(let d of Ez){if(!a.includes(d))continue;let h=t[d];h!==void 0&&h!==""&&!r.has(d)&&!n.includes(`--${d}`)&&o.push(`--${d} ${RC(h)}`)}if(o.length===0)return e;let s=` ${o.join(" ")}`,u=n.indexOf(" -- "),m=u===-1?`${n}${s}`:`${n.slice(0,u)}${s}${n.slice(u)}`;return e.slice(0,i.index)+`\`${m}\``+e.slice(i.index+i[0].length)}gg(xz,"applyPreservedFlags");var pY=Object.defineProperty,ti=(e,t)=>pY(e,"name",{value:t,configurable:!0});function En(e,t){if(t!==void 0&&ec(e)){let i={};for(let[n,a]of Object.entries(e))i[n]=t.has(n)?a:En(a);return i}if(typeof e=="string")return ue(e);if(e==null||typeof e!="object")return e;if(Array.isArray(e))return e.map(i=>En(i));if(e instanceof Date||e instanceof RegExp)return e;let r={};for(let[i,n]of Object.entries(e))r[i]=En(n);return r}ti(En,"maskTree");function yg(e){if(Array.isArray(e))return e.map(yg);if(!ec(e))return e;let t={};for(let[r,i]of Object.entries(e))i!==void 0&&(t[r]=yg(i));return t}ti(yg,"stripAbsent");function ec(e){return typeof e=="object"&&e!==null&&!Array.isArray(e)&&!(e instanceof Date)&&!(e instanceof RegExp)}ti(ec,"isPlainRecord");function _z(e){let t=e?.verbatimFields;return t!==void 0&&t.length>0?new Set(t):void 0}ti(_z,"toVerbatimKeys");function Tz(e,t){return t===void 0||!ec(e)?!1:Object.keys(e).some(r=>t.has(r))}ti(Tz,"carriesVerbatimField");function Cz(e,t){let r=e;for(let i of t.split(".")){if(!ec(r))return;r=r[i]}return r}ti(Cz,"resolveDotPath");function Iz(e,t,r){let i=e.project(t),n={};for(let a of r)a in i&&(n[a]=i[a]);return n}ti(Iz,"projectSelectedFields");var ql=class{static{ti(this,"AgentOutputWriter")}write;hasWrittenBlock=!1;resolver;flags;full;budget;requestedFields;constructor(t){this.write=t.writeFn??(r=>{process.stdout.write(r)}),this.resolver=new hg(t.command,t.flags),this.flags=t.flags,this.full=t.full??!1,this.budget=t.budget,this.requestedFields=t.fields??[]}get isFullOutput(){return this.full}writeBlock(t){t!==""&&(this.hasWrittenBlock&&this.write(sC+`
 `),this.hasWrittenBlock=!0,this.write(t))}renderResult(t,r){let i=_z(r?.schema),n=En(t,i),a=r?.schema!==void 0&&ec(n)?this.applySchema(n,r.schema):n,o=uC(a),s=this.resolveHelp(r?.suggestionContext),u=o+s+`
 `;this.writeBlock((Tz(a,i)?u:ig(u,this.budget))+Ys())}renderListResult(t,r,i){let n=t.map(m=>En(m)),a=i.fields,o=a!==void 0&&a.length>0?a:r.fields,s=lC(n,{fields:o,project:ti(m=>Iz(r,m,o),"project")},{entity:i.entity,aggregates:i.aggregates}),u=this.resolveHelp(i.suggestionContext);this.writeBlock(ig(s+u+`
 `,this.budget)+Ys())}renderEvent(t){let r=En(t),i=mC({...r,value:yg(r.value)});this.writeBlock(i)}renderError(t,r){let i={...t,message:ue(t.message),...t.details!==void 0?{details:En(t.details)}:{}},n=dC(i),a=this.resolveHelp(r);this.writeBlock(n+a+`