fjall 29.0.0 → 30.0.0

package/bin/fjall.bundle.js

@@ -7,9 +7,9 @@ const __fjfilename = __fjpath(import.meta.url);
 const __fjbinDir = __fjdir(__fjfilename);
 process.env.FJALL_ASSETS_DIR = process.env.FJALL_ASSETS_DIR || __fjjoin(__fjbinDir, "assets");
 process.env.FJALL_BUNDLED = "1";
-globalThis["__FJALL_DEPLOY_CORE_VERSION__"] = "29.0.0";
+globalThis["__FJALL_DEPLOY_CORE_VERSION__"] = "30.0.0";
 
-var YCr=Object.create;var Hie=Object.defineProperty;var JCr=Object.getOwnPropertyDescriptor;var ZCr=Object.getOwnPropertyNames;var XCr=Object.getPrototypeOf,QCr=Object.prototype.hasOwnProperty;var zt=(e=>typeof require<"u"?require:typeof Proxy<"u"?new Proxy(e,{get:(t,r)=>(typeof require<"u"?require:t)[r]}):e)(function(e){if(typeof require<"u")return require.apply(this,arguments);throw Error('Dynamic require of "'+e+'" is not supported')});var w=(e,t,r)=>()=>{if(r)throw r[0];try{return e&&(t=e(e=0)),t}catch(n){throw r=[n],n}};var Se=(e,t)=>()=>{try{return t||e((t={exports:{}}).exports,t),t.exports}catch(r){throw t=0,r}},nr=(e,t)=>{for(var r in t)Hie(e,r,{get:t[r],enumerable:!0})},Uyt=(e,t,r,n)=>{if(t&&typeof t=="object"||typeof t=="function")for(let a of ZCr(t))!QCr.call(e,a)&&a!==r&&Hie(e,a,{get:()=>t[a],enumerable:!(n=JCr(t,a))||n.enumerable});return e};var Rc=(e,t,r)=>(r=e!=null?YCr(XCr(e)):{},Uyt(t||!e||!e.__esModule?Hie(r,"default",{value:e,enumerable:!0}):r,e)),gr=e=>Uyt(Hie({},"__esModule",{value:!0}),e);var Sm,dF=w(()=>{Sm={name:"@fjall/cli",version:"29.0.0",repository:{type:"git",url:"git+https://github.com/fjall-tech/fjall.git",directory:"cli"},description:"Fjall CLI helper",private:!0,type:"module",bin:{fjall:"dist/src/cli.js"},files:["dist/"],scripts:{clean:"rm -rf ./dist ./dist.next ./sourcemaps","clean:node":"rm -rf ./node_modules","copy-files":'DEST="${DEST:-dist}"; find generators -type d -name files | while read dir; do mkdir -p "$DEST/$dir" && cp -R "$dir/." "$DEST/$dir/"; done && cp -R src/proto "./$DEST/src/proto"',build:"rm -rf ./dist.next ./sourcemaps && npx tsc --outDir dist.next && DEST=dist.next npm run copy-files && node ../scripts/minify-dist.mjs dist.next && chmod +x ./dist.next/src/cli.js && rm -rf ./dist && mv ./dist.next ./dist && node ../scripts/stamp-build.mjs",watch:"npm run build && npx tsc-watch","watch:only":'npx tsc-watch --onSuccess "npm run copy-files"',"fjall-cli":"node ./dist/src/cli.js",version:"npx tsx scripts/updateTemplateVersions.ts && node ../scripts/sync-ci-plugin-major.mjs",format:'prettier --write "src/**/*.{ts,tsx,js,jsx,json}" "generators/**/*.{ts,tsx,js,jsx,json}"',"format:check":'prettier --check "src/**/*.{ts,tsx,js,jsx,json}" "generators/**/*.{ts,tsx,js,jsx,json}"',lint:"eslint src/ generators/","lint:fix":"eslint src/ generators/ --fix",typecheck:"tsc --noEmit","typecheck:tests":"tsc --noEmit --project tsconfig.test.json","typecheck:scripts":"tsc --noEmit --project tsconfig.scripts.json","typecheck:all":"npm run typecheck && npm run typecheck:tests && npm run typecheck:scripts",test:"vitest run","test:watch":"vitest","test:coverage":"vitest run --coverage","test:integration":"vitest run --config vitest.config.integration.ts","test:integration:watch":"vitest --config vitest.config.integration.ts","test:e2e":"vitest run --config vitest.e2e.config.ts","test:all":"npm run test && npm run test:integration && npm run test:e2e","test:setup":"node scripts/setupTestFixtures.mjs","test:payload-compat":"npx tsx scripts/testPayloadCompatibility.ts","test:payload-compat:e2e":"npx tsx scripts/testPayloadCompatibility.ts --e2e"},engines:{node:">=22.0.0"},author:"",license:"SEE LICENSE IN LICENSE",devDependencies:{"@eslint/js":"^10.0.1","@playwright/test":"^1.62.0","@testing-library/dom":"^10.4.1","@testing-library/react":"^16.3.2","@types/ejs":"^3.1.5","@types/prompts":"^2.4.9","@types/proper-lockfile":"^4.1.4","@types/react":"^19.2.17","@typescript-eslint/parser":"^8.65.0","@vitest/coverage-v8":"^4.1.10","aws-cdk-lib":"^2.265.0",constructs:"^10.7.2",eslint:"^10.8.0","ink-testing-library":"^4.0.0",jsdom:"^30.0.1",prettier:"^3.9.6","react-dom":"^19.2.8","strip-ansi":"^6.0.1","tsc-watch":"^7.2.1",tsx:"^4.23.1","typescript-eslint":"^8.65.0",vitest:"4.1.10"},dependencies:{"@anthropic-ai/sdk":"^0.115.0","@aws-sdk/client-acm":"^3.1098.0","@aws-sdk/client-auto-scaling":"^3.1098.0","@aws-sdk/client-backup":"^3.1098.0","@aws-sdk/client-cloudformation":"^3.1098.0","@aws-sdk/client-cost-explorer":"^3.1098.0","@aws-sdk/client-ec2":"^3.1098.0","@aws-sdk/client-ecr":"^3.1098.0","@aws-sdk/client-ecs":"^3.1098.0","@aws-sdk/client-elasticache":"^3.1098.0","@aws-sdk/client-iam":"^3.1098.0","@aws-sdk/client-identitystore":"^3.1098.0","@aws-sdk/client-lambda":"^3.1098.0","@aws-sdk/client-organizations":"^3.1098.0","@aws-sdk/client-ram":"^3.1098.0","@aws-sdk/client-rds":"^3.1098.0","@aws-sdk/client-route-53":"^3.1098.0","@aws-sdk/client-s3":"^3.1098.0","@aws-sdk/client-secrets-manager":"^3.1098.0","@aws-sdk/client-ssm":"^3.1098.0","@aws-sdk/client-sso":"^3.1098.0","@aws-sdk/client-sso-admin":"^3.1098.0","@aws-sdk/client-sso-oidc":"^3.1098.0","@aws-sdk/client-sts":"^3.1098.0","@fjall/deploy-core":"^29.0.0","@fjall/generator":"^29.0.0","@fjall/util":"^29.0.0","@nx/devkit":"^23.1.0","@opennextjs/aws":"^4.1.0","@smithy/node-http-handler":"^4.9.13","@toon-format/toon":"^4.1.0","aws-cdk":"^2.1134.0",axios:"^1.19.0",chalk:"^6.0.0","cli-cursor":"^5.0.0",commander:"^15.0.0",ejs:"^6.0.1",ink:"^7.1.1","js-yaml":"^5.2.2",open:"^11.0.0",ora:"^9.4.1",prompts:"^2.4.2","proper-lockfile":"^4.1.2",protobufjs:"^8.7.1",react:"^19.2.8",typescript:"^6.0.3","update-check":"^1.5.4",zod:"^4.4.3"}}});function $r(e){return e.replace(/[-_](.)/g,(t,r)=>r.toUpperCase()).replace(/^./,t=>t.toUpperCase())}function Wr(e){return e.replace(/([A-Z]+)([A-Z][a-z])/g,"$1-$2").replace(/([a-z\d])([A-Z])/g,"$1-$2").replace(/[\s_]+/g,"-").toLowerCase()}function XT(e){return Wr(e).replace(/-/g,"_")}function yPe(e){return Wr(e).replace(/-/g,"_").toUpperCase()}function Bf(e){return e.length===0?e:e.charAt(0).toUpperCase()+e.slice(1)}function C6(e){return e.split(".").join("")}function JT(e){return e.toLowerCase().replace(/[^a-z0-9]/g,"")}function vPe(e){let t=e.replace(new RegExp("\\P{ASCII}","gu"),"");return JT(t)===JT(e)&&JT(e)!==""}var t0r,ZT,Iw=w(()=>{"use strict";t0r=Object.defineProperty,ZT=(e,t)=>t0r(e,"name",{value:t,configurable:!0});ZT($r,"toPascalCase");ZT(Wr,"toKebab");ZT(XT,"toValidDatabaseName");ZT(yPe,"toScreamingSnake");ZT(Bf,"capitalise");ZT(C6,"getSafeZoneName");ZT(JT,"accountConstructKey");ZT(vPe,"hasAsciiStableConstructKey")});function yn(e){return`${$r(e.split(".").join(""))}Domain`}function QT(e){return`${e}UsEast1Certificates`}function Fo(e){let t=e.replace(/\./g,"-");return{hostedZoneId:`${t}-hosted-zone-id`,certificateArn:`${t}-certificate-arn`,certificateHosts:`${t}-certificate-hosts`,usEast1CertificateArn:`${t}-us-east-1-certificate-arn`,usEast1CertificateHosts:`${t}-us-east-1-certificate-hosts`,delegationRoleArn:`${t}-delegation-role-arn`,nameservers:`${t}-nameservers`}}function T6(e){let t=[],r=[];for(let n of e){let a=[...r,n];r.length>0&&Buffer.byteLength(JSON.stringify(a),"utf8")>SPe?(t.push(r),r=[n]):r=a}return r.length>0&&t.push(r),t.map(n=>JSON.stringify(n))}function eP(e,t){return`${e}-${t}`}function bPe(e){return typeof e.hostedZoneId=="string"}var r0r,pF,Kie,Gyt,SPe,Vyt=w(()=>{"use strict";Iw();r0r=Object.defineProperty,pF=(e,t)=>r0r(e,"name",{value:t,configurable:!0}),Kie="@";pF(yn,"getDomainStackName");pF(QT,"getDomainUsEast1CertificatesStackName");Gyt="full";pF(Fo,"getDomainExportNames");SPe=1e3;pF(T6,"serialiseHostsChunks");pF(eP,"hostsExportPartName");pF(bPe,"isManagedDomainBinding")});var vb,Wyt=w(()=>{"use strict";vb="backupVault"});var mF,ex,zyt=w(()=>{"use strict";mF="Approval token: ",ex="Token: "});function tP(e){return`${$r(e)}ImageTag`}var n0r,a0r,Hyt=w(()=>{"use strict";Iw();n0r=Object.defineProperty,a0r=(e,t)=>n0r(e,"name",{value:t,configurable:!0});a0r(tP,"imageTagParameterName")});function rP(e){return $r(e.replace(/[^A-Za-z0-9-]/g,""))}function EPe(e,t){let r=rP(e);return t===void 0?r:`${r}-${rP(t)}-`}function x6(e,t){return`${EPe(e,t)}AlbDnsName`}function k6(e,t){return`${EPe(e,t)}AlbHostedZoneId`}function Kyt(e,t){let r=rP(e);return t===void 0?r:`${r}-${rP(t)}-`}function I6(e,t){return`${Kyt(e,t)}CdnDistributionDomainName`}function APe(e,t){return`${rP(e)}-${rP(t)}-`}function R6(e,t){return`${APe(e,t)}WebsiteEndpoint`}function _6(e,t){return`${APe(e,t)}WebsiteHostedZoneId`}var o0r,Rw,qyt=w(()=>{"use strict";Iw();o0r=Object.defineProperty,Rw=(e,t)=>o0r(e,"name",{value:t,configurable:!0});Rw(rP,"safeExportToken");Rw(EPe,"albExportScope");Rw(x6,"albDnsExportName");Rw(k6,"albHostedZoneIdExportName");Rw(Kyt,"cdnExportScope");Rw(I6,"cdnDomainExportName");Rw(APe,"bucketExportScope");Rw(R6,"bucketWebsiteEndpointExportName");Rw(_6,"bucketWebsiteHostedZoneIdExportName")});function pe(e,t,r){function n(s,c){if(s._zod||Object.defineProperty(s,"_zod",{value:{def:c,constr:i,traits:new Set},enumerable:!1}),s._zod.traits.has(e))return;s._zod.traits.add(e),t(s,c);let l=i.prototype,u=Object.keys(l);for(let d=0;d<u.length;d++){let p=u[d];p in s||(s[p]=l[p].bind(s))}}let a=r?.Parent??Object;class o extends a{}Object.defineProperty(o,"name",{value:e});function i(s){var c;let l=r?.Parent?new o:this;n(l,s),(c=l._zod).deferred??(c.deferred=[]);for(let u of l._zod.deferred)u();return l}return Object.defineProperty(i,"init",{value:n}),Object.defineProperty(i,Symbol.hasInstance,{value:s=>r?.Parent&&s instanceof r.Parent?!0:s?._zod?.traits?.has(e)}),Object.defineProperty(i,"name",{value:e}),i}function us(e){return e&&Object.assign(nP,e),nP}var Yyt,wPe,CPe,mv,tx,nP,aP=w(()=>{wPe=Object.freeze({status:"aborted"});CPe=Symbol("zod_brand"),mv=class extends Error{constructor(){super("Encountered Promise during synchronous parse. Use .parseAsync() instead.")}},tx=class extends Error{constructor(t){super(`Encountered unidirectional transform during encode: ${t}`),this.name="ZodEncodeError"}};(Yyt=globalThis).__zod_globalConfig??(Yyt.__zod_globalConfig={});nP=globalThis.__zod_globalConfig});var ot={};nr(ot,{BIGINT_FORMAT_RANGES:()=>NPe,Class:()=>xPe,NUMBER_FORMAT_RANGES:()=>DPe,aborted:()=>ox,allowsEval:()=>RPe,assert:()=>u0r,assertEqual:()=>i0r,assertIs:()=>c0r,assertNever:()=>l0r,assertNotEqual:()=>s0r,assignProp:()=>nx,base64ToUint8Array:()=>Zyt,base64urlToUint8Array:()=>k0r,cached:()=>hF,captureStackTrace:()=>Yie,cleanEnum:()=>x0r,cleanRegex:()=>D6,clone:()=>Wd,cloneDef:()=>p0r,createTransparentProxy:()=>v0r,defineLazy:()=>wn,esc:()=>qie,escapeRegex:()=>ng,explicitlyAborted:()=>$Pe,extend:()=>E0r,finalizeIssue:()=>zd,floatSafeRemainder:()=>kPe,getElementAtPath:()=>m0r,getEnumValues:()=>O6,getLengthableOrigin:()=>M6,getParsedType:()=>y0r,getSizableOrigin:()=>$6,hexToUint8Array:()=>R0r,isObject:()=>oP,isPlainObject:()=>ax,issue:()=>gF,joinValues:()=>we,jsonStringifyReplacer:()=>fF,merge:()=>w0r,mergeDefs:()=>_w,normalizeParams:()=>dt,nullish:()=>rx,numKeys:()=>g0r,objectClone:()=>d0r,omit:()=>b0r,optionalKeys:()=>OPe,parsedType:()=>tt,partial:()=>C0r,pick:()=>S0r,prefixIssues:()=>bm,primitiveTypes:()=>PPe,promiseAllObject:()=>f0r,propertyKeyTypes:()=>N6,randomString:()=>h0r,required:()=>T0r,safeExtend:()=>A0r,shallowClone:()=>_Pe,slugify:()=>IPe,stringifyPrimitive:()=>Ze,uint8ArrayToBase64:()=>Xyt,uint8ArrayToBase64url:()=>I0r,uint8ArrayToHex:()=>_0r,unwrapMessage:()=>P6});function i0r(e){return e}function s0r(e){return e}function c0r(e){}function l0r(e){throw new Error("Unexpected value in exhaustive check")}function u0r(e){}function O6(e){let t=Object.values(e).filter(n=>typeof n=="number");return Object.entries(e).filter(([n,a])=>t.indexOf(+n)===-1).map(([n,a])=>a)}function we(e,t="|"){return e.map(r=>Ze(r)).join(t)}function fF(e,t){return typeof t=="bigint"?t.toString():t}function hF(e){return{get value(){{let r=e();return Object.defineProperty(this,"value",{value:r}),r}throw new Error("cached value already set")}}}function rx(e){return e==null}function D6(e){let t=e.startsWith("^")?1:0,r=e.endsWith("$")?e.length-1:e.length;return e.slice(t,r)}function kPe(e,t){let r=e/t,n=Math.round(r),a=Number.EPSILON*Math.max(Math.abs(r),1);return Math.abs(r-n)<a?0:r-n}function wn(e,t,r){let n;Object.defineProperty(e,t,{get(){if(n!==Jyt)return n===void 0&&(n=Jyt,n=r()),n},set(a){Object.defineProperty(e,t,{value:a})},configurable:!0})}function d0r(e){return Object.create(Object.getPrototypeOf(e),Object.getOwnPropertyDescriptors(e))}function nx(e,t,r){Object.defineProperty(e,t,{value:r,writable:!0,enumerable:!0,configurable:!0})}function _w(...e){let t={};for(let r of e){let n=Object.getOwnPropertyDescriptors(r);Object.assign(t,n)}return Object.defineProperties({},t)}function p0r(e){return _w(e._zod.def)}function m0r(e,t){return t?t.reduce((r,n)=>r?.[n],e):e}function f0r(e){let t=Object.keys(e),r=t.map(n=>e[n]);return Promise.all(r).then(n=>{let a={};for(let o=0;o<t.length;o++)a[t[o]]=n[o];return a})}function h0r(e=10){let t="abcdefghijklmnopqrstuvwxyz",r="";for(let n=0;n<e;n++)r+=t[Math.floor(Math.random()*t.length)];return r}function qie(e){return JSON.stringify(e)}function IPe(e){return e.toLowerCase().trim().replace(/[^\w\s-]/g,"").replace(/[\s_-]+/g,"-").replace(/^-+|-+$/g,"")}function oP(e){return typeof e=="object"&&e!==null&&!Array.isArray(e)}function ax(e){if(oP(e)===!1)return!1;let t=e.constructor;if(t===void 0||typeof t!="function")return!0;let r=t.prototype;return!(oP(r)===!1||Object.prototype.hasOwnProperty.call(r,"isPrototypeOf")===!1)}function _Pe(e){return ax(e)?{...e}:Array.isArray(e)?[...e]:e instanceof Map?new Map(e):e instanceof Set?new Set(e):e}function g0r(e){let t=0;for(let r in e)Object.prototype.hasOwnProperty.call(e,r)&&t++;return t}function ng(e){return e.replace(/[.*+?^${}()|[\]\\]/g,"\\$&")}function Wd(e,t,r){let n=new e._zod.constr(t??e._zod.def);return(!t||r?.parent)&&(n._zod.parent=e),n}function dt(e){let t=e;if(!t)return{};if(typeof t=="string")return{error:()=>t};if(t?.message!==void 0){if(t?.error!==void 0)throw new Error("Cannot specify both `message` and `error` params");t.error=t.message}return delete t.message,typeof t.error=="string"?{...t,error:()=>t.error}:t}function v0r(e){let t;return new Proxy({},{get(r,n,a){return t??(t=e()),Reflect.get(t,n,a)},set(r,n,a,o){return t??(t=e()),Reflect.set(t,n,a,o)},has(r,n){return t??(t=e()),Reflect.has(t,n)},deleteProperty(r,n){return t??(t=e()),Reflect.deleteProperty(t,n)},ownKeys(r){return t??(t=e()),Reflect.ownKeys(t)},getOwnPropertyDescriptor(r,n){return t??(t=e()),Reflect.getOwnPropertyDescriptor(t,n)},defineProperty(r,n,a){return t??(t=e()),Reflect.defineProperty(t,n,a)}})}function Ze(e){return typeof e=="bigint"?e.toString()+"n":typeof e=="string"?`"${e}"`:`${e}`}function OPe(e){return Object.keys(e).filter(t=>e[t]._zod.optin==="optional"&&e[t]._zod.optout==="optional")}function S0r(e,t){let r=e._zod.def,n=r.checks;if(n&&n.length>0)throw new Error(".pick() cannot be used on object schemas containing refinements");let o=_w(e._zod.def,{get shape(){let i={};for(let s in t){if(!(s in r.shape))throw new Error(`Unrecognized key: "${s}"`);t[s]&&(i[s]=r.shape[s])}return nx(this,"shape",i),i},checks:[]});return Wd(e,o)}function b0r(e,t){let r=e._zod.def,n=r.checks;if(n&&n.length>0)throw new Error(".omit() cannot be used on object schemas containing refinements");let o=_w(e._zod.def,{get shape(){let i={...e._zod.def.shape};for(let s in t){if(!(s in r.shape))throw new Error(`Unrecognized key: "${s}"`);t[s]&&delete i[s]}return nx(this,"shape",i),i},checks:[]});return Wd(e,o)}function E0r(e,t){if(!ax(t))throw new Error("Invalid input to extend: expected a plain object");let r=e._zod.def.checks;if(r&&r.length>0){let o=e._zod.def.shape;for(let i in t)if(Object.getOwnPropertyDescriptor(o,i)!==void 0)throw new Error("Cannot overwrite keys on object schemas containing refinements. Use `.safeExtend()` instead.")}let a=_w(e._zod.def,{get shape(){let o={...e._zod.def.shape,...t};return nx(this,"shape",o),o}});return Wd(e,a)}function A0r(e,t){if(!ax(t))throw new Error("Invalid input to safeExtend: expected a plain object");let r=_w(e._zod.def,{get shape(){let n={...e._zod.def.shape,...t};return nx(this,"shape",n),n}});return Wd(e,r)}function w0r(e,t){if(e._zod.def.checks?.length)throw new Error(".merge() cannot be used on object schemas containing refinements. Use .safeExtend() instead.");let r=_w(e._zod.def,{get shape(){let n={...e._zod.def.shape,...t._zod.def.shape};return nx(this,"shape",n),n},get catchall(){return t._zod.def.catchall},checks:t._zod.def.checks??[]});return Wd(e,r)}function C0r(e,t,r){let a=t._zod.def.checks;if(a&&a.length>0)throw new Error(".partial() cannot be used on object schemas containing refinements");let i=_w(t._zod.def,{get shape(){let s=t._zod.def.shape,c={...s};if(r)for(let l in r){if(!(l in s))throw new Error(`Unrecognized key: "${l}"`);r[l]&&(c[l]=e?new e({type:"optional",innerType:s[l]}):s[l])}else for(let l in s)c[l]=e?new e({type:"optional",innerType:s[l]}):s[l];return nx(this,"shape",c),c},checks:[]});return Wd(t,i)}function T0r(e,t,r){let n=_w(t._zod.def,{get shape(){let a=t._zod.def.shape,o={...a};if(r)for(let i in r){if(!(i in o))throw new Error(`Unrecognized key: "${i}"`);r[i]&&(o[i]=new e({type:"nonoptional",innerType:a[i]}))}else for(let i in a)o[i]=new e({type:"nonoptional",innerType:a[i]});return nx(this,"shape",o),o}});return Wd(t,n)}function ox(e,t=0){if(e.aborted===!0)return!0;for(let r=t;r<e.issues.length;r++)if(e.issues[r]?.continue!==!0)return!0;return!1}function $Pe(e,t=0){if(e.aborted===!0)return!0;for(let r=t;r<e.issues.length;r++)if(e.issues[r]?.continue===!1)return!0;return!1}function bm(e,t){return t.map(r=>{var n;return(n=r).path??(n.path=[]),r.path.unshift(e),r})}function P6(e){return typeof e=="string"?e:e?.message}function zd(e,t,r){let n=e.message?e.message:P6(e.inst?._zod.def?.error?.(e))??P6(t?.error?.(e))??P6(r.customError?.(e))??P6(r.localeError?.(e))??"Invalid input",{inst:a,continue:o,input:i,...s}=e;return s.path??(s.path=[]),s.message=n,t?.reportInput&&(s.input=i),s}function $6(e){return e instanceof Set?"set":e instanceof Map?"map":e instanceof File?"file":"unknown"}function M6(e){return Array.isArray(e)?"array":typeof e=="string"?"string":"unknown"}function tt(e){let t=typeof e;switch(t){case"number":return Number.isNaN(e)?"nan":"number";case"object":{if(e===null)return"null";if(Array.isArray(e))return"array";let r=e;if(r&&Object.getPrototypeOf(r)!==Object.prototype&&"constructor"in r&&r.constructor)return r.constructor.name}}return t}function gF(...e){let[t,r,n]=e;return typeof t=="string"?{message:t,code:"custom",input:r,inst:n}:{...t}}function x0r(e){return Object.entries(e).filter(([t,r])=>Number.isNaN(Number.parseInt(t,10))).map(t=>t[1])}function Zyt(e){let t=atob(e),r=new Uint8Array(t.length);for(let n=0;n<t.length;n++)r[n]=t.charCodeAt(n);return r}function Xyt(e){let t="";for(let r=0;r<e.length;r++)t+=String.fromCharCode(e[r]);return btoa(t)}function k0r(e){let t=e.replace(/-/g,"+").replace(/_/g,"/"),r="=".repeat((4-t.length%4)%4);return Zyt(t+r)}function I0r(e){return Xyt(e).replace(/\+/g,"-").replace(/\//g,"_").replace(/=/g,"")}function R0r(e){let t=e.replace(/^0x/,"");if(t.length%2!==0)throw new Error("Invalid hex string length");let r=new Uint8Array(t.length/2);for(let n=0;n<t.length;n+=2)r[n/2]=Number.parseInt(t.slice(n,n+2),16);return r}function _0r(e){return Array.from(e).map(t=>t.toString(16).padStart(2,"0")).join("")}var Jyt,Yie,RPe,y0r,N6,PPe,DPe,NPe,xPe,Zt=w(()=>{aP();Jyt=Symbol("evaluating");Yie="captureStackTrace"in Error?Error.captureStackTrace:(...e)=>{};RPe=hF(()=>{if(nP.jitless||typeof navigator<"u"&&navigator?.userAgent?.includes("Cloudflare"))return!1;try{let e=Function;return new e(""),!0}catch{return!1}});y0r=e=>{let t=typeof e;switch(t){case"undefined":return"undefined";case"string":return"string";case"number":return Number.isNaN(e)?"nan":"number";case"boolean":return"boolean";case"function":return"function";case"bigint":return"bigint";case"symbol":return"symbol";case"object":return Array.isArray(e)?"array":e===null?"null":e.then&&typeof e.then=="function"&&e.catch&&typeof e.catch=="function"?"promise":typeof Map<"u"&&e instanceof Map?"map":typeof Set<"u"&&e instanceof Set?"set":typeof Date<"u"&&e instanceof Date?"date":typeof File<"u"&&e instanceof File?"file":"object";default:throw new Error(`Unknown data type: ${t}`)}},N6=new Set(["string","number","symbol"]),PPe=new Set(["string","number","bigint","boolean","symbol","undefined"]);DPe={safeint:[Number.MIN_SAFE_INTEGER,Number.MAX_SAFE_INTEGER],int32:[-2147483648,2147483647],uint32:[0,4294967295],float32:[-34028234663852886e22,34028234663852886e22],float64:[-Number.MAX_VALUE,Number.MAX_VALUE]},NPe={int64:[BigInt("-9223372036854775808"),BigInt("9223372036854775807")],uint64:[BigInt(0),BigInt("18446744073709551615")]};xPe=class{constructor(...t){}}});function F6(e,t=r=>r.message){let r={},n=[];for(let a of e.issues)a.path.length>0?(r[a.path[0]]=r[a.path[0]]||[],r[a.path[0]].push(t(a))):n.push(t(a));return{formErrors:n,fieldErrors:r}}function j6(e,t=r=>r.message){let r={_errors:[]},n=(a,o=[])=>{for(let i of a.issues)if(i.code==="invalid_union"&&i.errors.length)i.errors.map(s=>n({issues:s},[...o,...i.path]));else if(i.code==="invalid_key")n({issues:i.issues},[...o,...i.path]);else if(i.code==="invalid_element")n({issues:i.issues},[...o,...i.path]);else{let s=[...o,...i.path];if(s.length===0)r._errors.push(t(i));else{let c=r,l=0;for(;l<s.length;){let u=s[l];l===s.length-1?(c[u]=c[u]||{_errors:[]},c[u]._errors.push(t(i))):c[u]=c[u]||{_errors:[]},c=c[u],l++}}}};return n(e),r}function MPe(e,t=r=>r.message){let r={errors:[]},n=(a,o=[])=>{var i,s;for(let c of a.issues)if(c.code==="invalid_union"&&c.errors.length)c.errors.map(l=>n({issues:l},[...o,...c.path]));else if(c.code==="invalid_key")n({issues:c.issues},[...o,...c.path]);else if(c.code==="invalid_element")n({issues:c.issues},[...o,...c.path]);else{let l=[...o,...c.path];if(l.length===0){r.errors.push(t(c));continue}let u=r,d=0;for(;d<l.length;){let p=l[d],m=d===l.length-1;typeof p=="string"?(u.properties??(u.properties={}),(i=u.properties)[p]??(i[p]={errors:[]}),u=u.properties[p]):(u.items??(u.items=[]),(s=u.items)[p]??(s[p]={errors:[]}),u=u.items[p]),m&&u.errors.push(t(c)),d++}}};return n(e),r}function evt(e){let t=[],r=e.map(n=>typeof n=="object"?n.key:n);for(let n of r)typeof n=="number"?t.push(`[${n}]`):typeof n=="symbol"?t.push(`[${JSON.stringify(String(n))}]`):/[^\w$]/.test(n)?t.push(`[${JSON.stringify(n)}]`):(t.length&&t.push("."),t.push(n));return t.join("")}function LPe(e){let t=[],r=[...e.issues].sort((n,a)=>(n.path??[]).length-(a.path??[]).length);for(let n of r)t.push(`\u2716 ${n.message}`),n.path?.length&&t.push(`  \u2192 at ${evt(n.path)}`);return t.join(`
+var YCr=Object.create;var Hie=Object.defineProperty;var JCr=Object.getOwnPropertyDescriptor;var ZCr=Object.getOwnPropertyNames;var XCr=Object.getPrototypeOf,QCr=Object.prototype.hasOwnProperty;var zt=(e=>typeof require<"u"?require:typeof Proxy<"u"?new Proxy(e,{get:(t,r)=>(typeof require<"u"?require:t)[r]}):e)(function(e){if(typeof require<"u")return require.apply(this,arguments);throw Error('Dynamic require of "'+e+'" is not supported')});var w=(e,t,r)=>()=>{if(r)throw r[0];try{return e&&(t=e(e=0)),t}catch(n){throw r=[n],n}};var Se=(e,t)=>()=>{try{return t||e((t={exports:{}}).exports,t),t.exports}catch(r){throw t=0,r}},nr=(e,t)=>{for(var r in t)Hie(e,r,{get:t[r],enumerable:!0})},Uyt=(e,t,r,n)=>{if(t&&typeof t=="object"||typeof t=="function")for(let a of ZCr(t))!QCr.call(e,a)&&a!==r&&Hie(e,a,{get:()=>t[a],enumerable:!(n=JCr(t,a))||n.enumerable});return e};var Rc=(e,t,r)=>(r=e!=null?YCr(XCr(e)):{},Uyt(t||!e||!e.__esModule?Hie(r,"default",{value:e,enumerable:!0}):r,e)),gr=e=>Uyt(Hie({},"__esModule",{value:!0}),e);var Sm,dF=w(()=>{Sm={name:"@fjall/cli",version:"30.0.0",repository:{type:"git",url:"git+https://github.com/fjall-tech/fjall.git",directory:"cli"},description:"Fjall CLI helper",private:!0,type:"module",bin:{fjall:"dist/src/cli.js"},files:["dist/"],scripts:{clean:"rm -rf ./dist ./dist.next ./sourcemaps","clean:node":"rm -rf ./node_modules","copy-files":'DEST="${DEST:-dist}"; find generators -type d -name files | while read dir; do mkdir -p "$DEST/$dir" && cp -R "$dir/." "$DEST/$dir/"; done && cp -R src/proto "./$DEST/src/proto"',build:"rm -rf ./dist.next ./sourcemaps && npx tsc --outDir dist.next && DEST=dist.next npm run copy-files && node ../scripts/minify-dist.mjs dist.next && chmod +x ./dist.next/src/cli.js && rm -rf ./dist && mv ./dist.next ./dist && node ../scripts/stamp-build.mjs",watch:"npm run build && npx tsc-watch","watch:only":'npx tsc-watch --onSuccess "npm run copy-files"',"fjall-cli":"node ./dist/src/cli.js",version:"npx tsx scripts/updateTemplateVersions.ts && node ../scripts/sync-ci-plugin-major.mjs",format:'prettier --write "src/**/*.{ts,tsx,js,jsx,json}" "generators/**/*.{ts,tsx,js,jsx,json}"',"format:check":'prettier --check "src/**/*.{ts,tsx,js,jsx,json}" "generators/**/*.{ts,tsx,js,jsx,json}"',lint:"eslint src/ generators/","lint:fix":"eslint src/ generators/ --fix",typecheck:"tsc --noEmit","typecheck:tests":"tsc --noEmit --project tsconfig.test.json","typecheck:scripts":"tsc --noEmit --project tsconfig.scripts.json","typecheck:all":"npm run typecheck && npm run typecheck:tests && npm run typecheck:scripts",test:"vitest run","test:watch":"vitest","test:coverage":"vitest run --coverage","test:integration":"vitest run --config vitest.config.integration.ts","test:integration:watch":"vitest --config vitest.config.integration.ts","test:e2e":"vitest run --config vitest.e2e.config.ts","test:all":"npm run test && npm run test:integration && npm run test:e2e","test:setup":"node scripts/setupTestFixtures.mjs","test:payload-compat":"npx tsx scripts/testPayloadCompatibility.ts","test:payload-compat:e2e":"npx tsx scripts/testPayloadCompatibility.ts --e2e"},engines:{node:">=22.0.0"},author:"",license:"SEE LICENSE IN LICENSE",devDependencies:{"@eslint/js":"^10.0.1","@playwright/test":"^1.62.0","@testing-library/dom":"^10.4.1","@testing-library/react":"^16.3.2","@types/ejs":"^3.1.5","@types/prompts":"^2.4.9","@types/proper-lockfile":"^4.1.4","@types/react":"^19.2.17","@typescript-eslint/parser":"^8.65.0","@vitest/coverage-v8":"^4.1.10","aws-cdk-lib":"^2.265.0",constructs:"^10.7.2",eslint:"^10.8.0","ink-testing-library":"^4.0.0",jsdom:"^30.0.1",prettier:"^3.9.6","react-dom":"^19.2.8","strip-ansi":"^6.0.1","tsc-watch":"^7.2.1",tsx:"^4.23.1","typescript-eslint":"^8.65.0",vitest:"4.1.10"},dependencies:{"@anthropic-ai/sdk":"^0.115.0","@aws-sdk/client-acm":"^3.1098.0","@aws-sdk/client-auto-scaling":"^3.1098.0","@aws-sdk/client-backup":"^3.1098.0","@aws-sdk/client-cloudformation":"^3.1098.0","@aws-sdk/client-cost-explorer":"^3.1098.0","@aws-sdk/client-ec2":"^3.1098.0","@aws-sdk/client-ecr":"^3.1098.0","@aws-sdk/client-ecs":"^3.1098.0","@aws-sdk/client-elasticache":"^3.1098.0","@aws-sdk/client-iam":"^3.1098.0","@aws-sdk/client-identitystore":"^3.1098.0","@aws-sdk/client-lambda":"^3.1098.0","@aws-sdk/client-organizations":"^3.1098.0","@aws-sdk/client-ram":"^3.1098.0","@aws-sdk/client-rds":"^3.1098.0","@aws-sdk/client-route-53":"^3.1098.0","@aws-sdk/client-s3":"^3.1098.0","@aws-sdk/client-secrets-manager":"^3.1098.0","@aws-sdk/client-ssm":"^3.1098.0","@aws-sdk/client-sso":"^3.1098.0","@aws-sdk/client-sso-admin":"^3.1098.0","@aws-sdk/client-sso-oidc":"^3.1098.0","@aws-sdk/client-sts":"^3.1098.0","@fjall/deploy-core":"^30.0.0","@fjall/generator":"^30.0.0","@fjall/util":"^30.0.0","@nx/devkit":"^23.1.0","@opennextjs/aws":"^4.1.0","@smithy/node-http-handler":"^4.9.13","@toon-format/toon":"^4.1.0","aws-cdk":"^2.1134.0",axios:"^1.19.0",chalk:"^6.0.0","cli-cursor":"^5.0.0",commander:"^15.0.0",ejs:"^6.0.1",ink:"^7.1.1","js-yaml":"^5.2.2",open:"^11.0.0",ora:"^9.4.1",prompts:"^2.4.2","proper-lockfile":"^4.1.2",protobufjs:"^8.7.1",react:"^19.2.8",typescript:"^6.0.3","update-check":"^1.5.4",zod:"^4.4.3"}}});function $r(e){return e.replace(/[-_](.)/g,(t,r)=>r.toUpperCase()).replace(/^./,t=>t.toUpperCase())}function Wr(e){return e.replace(/([A-Z]+)([A-Z][a-z])/g,"$1-$2").replace(/([a-z\d])([A-Z])/g,"$1-$2").replace(/[\s_]+/g,"-").toLowerCase()}function XT(e){return Wr(e).replace(/-/g,"_")}function yPe(e){return Wr(e).replace(/-/g,"_").toUpperCase()}function Bf(e){return e.length===0?e:e.charAt(0).toUpperCase()+e.slice(1)}function C6(e){return e.split(".").join("")}function JT(e){return e.toLowerCase().replace(/[^a-z0-9]/g,"")}function vPe(e){let t=e.replace(new RegExp("\\P{ASCII}","gu"),"");return JT(t)===JT(e)&&JT(e)!==""}var t0r,ZT,Iw=w(()=>{"use strict";t0r=Object.defineProperty,ZT=(e,t)=>t0r(e,"name",{value:t,configurable:!0});ZT($r,"toPascalCase");ZT(Wr,"toKebab");ZT(XT,"toValidDatabaseName");ZT(yPe,"toScreamingSnake");ZT(Bf,"capitalise");ZT(C6,"getSafeZoneName");ZT(JT,"accountConstructKey");ZT(vPe,"hasAsciiStableConstructKey")});function yn(e){return`${$r(e.split(".").join(""))}Domain`}function QT(e){return`${e}UsEast1Certificates`}function Fo(e){let t=e.replace(/\./g,"-");return{hostedZoneId:`${t}-hosted-zone-id`,certificateArn:`${t}-certificate-arn`,certificateHosts:`${t}-certificate-hosts`,usEast1CertificateArn:`${t}-us-east-1-certificate-arn`,usEast1CertificateHosts:`${t}-us-east-1-certificate-hosts`,delegationRoleArn:`${t}-delegation-role-arn`,nameservers:`${t}-nameservers`}}function T6(e){let t=[],r=[];for(let n of e){let a=[...r,n];r.length>0&&Buffer.byteLength(JSON.stringify(a),"utf8")>SPe?(t.push(r),r=[n]):r=a}return r.length>0&&t.push(r),t.map(n=>JSON.stringify(n))}function eP(e,t){return`${e}-${t}`}function bPe(e){return typeof e.hostedZoneId=="string"}var r0r,pF,Kie,Gyt,SPe,Vyt=w(()=>{"use strict";Iw();r0r=Object.defineProperty,pF=(e,t)=>r0r(e,"name",{value:t,configurable:!0}),Kie="@";pF(yn,"getDomainStackName");pF(QT,"getDomainUsEast1CertificatesStackName");Gyt="full";pF(Fo,"getDomainExportNames");SPe=1e3;pF(T6,"serialiseHostsChunks");pF(eP,"hostsExportPartName");pF(bPe,"isManagedDomainBinding")});var vb,Wyt=w(()=>{"use strict";vb="backupVault"});var mF,ex,zyt=w(()=>{"use strict";mF="Approval token: ",ex="Token: "});function tP(e){return`${$r(e)}ImageTag`}var n0r,a0r,Hyt=w(()=>{"use strict";Iw();n0r=Object.defineProperty,a0r=(e,t)=>n0r(e,"name",{value:t,configurable:!0});a0r(tP,"imageTagParameterName")});function rP(e){return $r(e.replace(/[^A-Za-z0-9-]/g,""))}function EPe(e,t){let r=rP(e);return t===void 0?r:`${r}-${rP(t)}-`}function x6(e,t){return`${EPe(e,t)}AlbDnsName`}function k6(e,t){return`${EPe(e,t)}AlbHostedZoneId`}function Kyt(e,t){let r=rP(e);return t===void 0?r:`${r}-${rP(t)}-`}function I6(e,t){return`${Kyt(e,t)}CdnDistributionDomainName`}function APe(e,t){return`${rP(e)}-${rP(t)}-`}function R6(e,t){return`${APe(e,t)}WebsiteEndpoint`}function _6(e,t){return`${APe(e,t)}WebsiteHostedZoneId`}var o0r,Rw,qyt=w(()=>{"use strict";Iw();o0r=Object.defineProperty,Rw=(e,t)=>o0r(e,"name",{value:t,configurable:!0});Rw(rP,"safeExportToken");Rw(EPe,"albExportScope");Rw(x6,"albDnsExportName");Rw(k6,"albHostedZoneIdExportName");Rw(Kyt,"cdnExportScope");Rw(I6,"cdnDomainExportName");Rw(APe,"bucketExportScope");Rw(R6,"bucketWebsiteEndpointExportName");Rw(_6,"bucketWebsiteHostedZoneIdExportName")});function pe(e,t,r){function n(s,c){if(s._zod||Object.defineProperty(s,"_zod",{value:{def:c,constr:i,traits:new Set},enumerable:!1}),s._zod.traits.has(e))return;s._zod.traits.add(e),t(s,c);let l=i.prototype,u=Object.keys(l);for(let d=0;d<u.length;d++){let p=u[d];p in s||(s[p]=l[p].bind(s))}}let a=r?.Parent??Object;class o extends a{}Object.defineProperty(o,"name",{value:e});function i(s){var c;let l=r?.Parent?new o:this;n(l,s),(c=l._zod).deferred??(c.deferred=[]);for(let u of l._zod.deferred)u();return l}return Object.defineProperty(i,"init",{value:n}),Object.defineProperty(i,Symbol.hasInstance,{value:s=>r?.Parent&&s instanceof r.Parent?!0:s?._zod?.traits?.has(e)}),Object.defineProperty(i,"name",{value:e}),i}function us(e){return e&&Object.assign(nP,e),nP}var Yyt,wPe,CPe,mv,tx,nP,aP=w(()=>{wPe=Object.freeze({status:"aborted"});CPe=Symbol("zod_brand"),mv=class extends Error{constructor(){super("Encountered Promise during synchronous parse. Use .parseAsync() instead.")}},tx=class extends Error{constructor(t){super(`Encountered unidirectional transform during encode: ${t}`),this.name="ZodEncodeError"}};(Yyt=globalThis).__zod_globalConfig??(Yyt.__zod_globalConfig={});nP=globalThis.__zod_globalConfig});var ot={};nr(ot,{BIGINT_FORMAT_RANGES:()=>NPe,Class:()=>xPe,NUMBER_FORMAT_RANGES:()=>DPe,aborted:()=>ox,allowsEval:()=>RPe,assert:()=>u0r,assertEqual:()=>i0r,assertIs:()=>c0r,assertNever:()=>l0r,assertNotEqual:()=>s0r,assignProp:()=>nx,base64ToUint8Array:()=>Zyt,base64urlToUint8Array:()=>k0r,cached:()=>hF,captureStackTrace:()=>Yie,cleanEnum:()=>x0r,cleanRegex:()=>D6,clone:()=>Wd,cloneDef:()=>p0r,createTransparentProxy:()=>v0r,defineLazy:()=>wn,esc:()=>qie,escapeRegex:()=>ng,explicitlyAborted:()=>$Pe,extend:()=>E0r,finalizeIssue:()=>zd,floatSafeRemainder:()=>kPe,getElementAtPath:()=>m0r,getEnumValues:()=>O6,getLengthableOrigin:()=>M6,getParsedType:()=>y0r,getSizableOrigin:()=>$6,hexToUint8Array:()=>R0r,isObject:()=>oP,isPlainObject:()=>ax,issue:()=>gF,joinValues:()=>we,jsonStringifyReplacer:()=>fF,merge:()=>w0r,mergeDefs:()=>_w,normalizeParams:()=>dt,nullish:()=>rx,numKeys:()=>g0r,objectClone:()=>d0r,omit:()=>b0r,optionalKeys:()=>OPe,parsedType:()=>tt,partial:()=>C0r,pick:()=>S0r,prefixIssues:()=>bm,primitiveTypes:()=>PPe,promiseAllObject:()=>f0r,propertyKeyTypes:()=>N6,randomString:()=>h0r,required:()=>T0r,safeExtend:()=>A0r,shallowClone:()=>_Pe,slugify:()=>IPe,stringifyPrimitive:()=>Ze,uint8ArrayToBase64:()=>Xyt,uint8ArrayToBase64url:()=>I0r,uint8ArrayToHex:()=>_0r,unwrapMessage:()=>P6});function i0r(e){return e}function s0r(e){return e}function c0r(e){}function l0r(e){throw new Error("Unexpected value in exhaustive check")}function u0r(e){}function O6(e){let t=Object.values(e).filter(n=>typeof n=="number");return Object.entries(e).filter(([n,a])=>t.indexOf(+n)===-1).map(([n,a])=>a)}function we(e,t="|"){return e.map(r=>Ze(r)).join(t)}function fF(e,t){return typeof t=="bigint"?t.toString():t}function hF(e){return{get value(){{let r=e();return Object.defineProperty(this,"value",{value:r}),r}throw new Error("cached value already set")}}}function rx(e){return e==null}function D6(e){let t=e.startsWith("^")?1:0,r=e.endsWith("$")?e.length-1:e.length;return e.slice(t,r)}function kPe(e,t){let r=e/t,n=Math.round(r),a=Number.EPSILON*Math.max(Math.abs(r),1);return Math.abs(r-n)<a?0:r-n}function wn(e,t,r){let n;Object.defineProperty(e,t,{get(){if(n!==Jyt)return n===void 0&&(n=Jyt,n=r()),n},set(a){Object.defineProperty(e,t,{value:a})},configurable:!0})}function d0r(e){return Object.create(Object.getPrototypeOf(e),Object.getOwnPropertyDescriptors(e))}function nx(e,t,r){Object.defineProperty(e,t,{value:r,writable:!0,enumerable:!0,configurable:!0})}function _w(...e){let t={};for(let r of e){let n=Object.getOwnPropertyDescriptors(r);Object.assign(t,n)}return Object.defineProperties({},t)}function p0r(e){return _w(e._zod.def)}function m0r(e,t){return t?t.reduce((r,n)=>r?.[n],e):e}function f0r(e){let t=Object.keys(e),r=t.map(n=>e[n]);return Promise.all(r).then(n=>{let a={};for(let o=0;o<t.length;o++)a[t[o]]=n[o];return a})}function h0r(e=10){let t="abcdefghijklmnopqrstuvwxyz",r="";for(let n=0;n<e;n++)r+=t[Math.floor(Math.random()*t.length)];return r}function qie(e){return JSON.stringify(e)}function IPe(e){return e.toLowerCase().trim().replace(/[^\w\s-]/g,"").replace(/[\s_-]+/g,"-").replace(/^-+|-+$/g,"")}function oP(e){return typeof e=="object"&&e!==null&&!Array.isArray(e)}function ax(e){if(oP(e)===!1)return!1;let t=e.constructor;if(t===void 0||typeof t!="function")return!0;let r=t.prototype;return!(oP(r)===!1||Object.prototype.hasOwnProperty.call(r,"isPrototypeOf")===!1)}function _Pe(e){return ax(e)?{...e}:Array.isArray(e)?[...e]:e instanceof Map?new Map(e):e instanceof Set?new Set(e):e}function g0r(e){let t=0;for(let r in e)Object.prototype.hasOwnProperty.call(e,r)&&t++;return t}function ng(e){return e.replace(/[.*+?^${}()|[\]\\]/g,"\\$&")}function Wd(e,t,r){let n=new e._zod.constr(t??e._zod.def);return(!t||r?.parent)&&(n._zod.parent=e),n}function dt(e){let t=e;if(!t)return{};if(typeof t=="string")return{error:()=>t};if(t?.message!==void 0){if(t?.error!==void 0)throw new Error("Cannot specify both `message` and `error` params");t.error=t.message}return delete t.message,typeof t.error=="string"?{...t,error:()=>t.error}:t}function v0r(e){let t;return new Proxy({},{get(r,n,a){return t??(t=e()),Reflect.get(t,n,a)},set(r,n,a,o){return t??(t=e()),Reflect.set(t,n,a,o)},has(r,n){return t??(t=e()),Reflect.has(t,n)},deleteProperty(r,n){return t??(t=e()),Reflect.deleteProperty(t,n)},ownKeys(r){return t??(t=e()),Reflect.ownKeys(t)},getOwnPropertyDescriptor(r,n){return t??(t=e()),Reflect.getOwnPropertyDescriptor(t,n)},defineProperty(r,n,a){return t??(t=e()),Reflect.defineProperty(t,n,a)}})}function Ze(e){return typeof e=="bigint"?e.toString()+"n":typeof e=="string"?`"${e}"`:`${e}`}function OPe(e){return Object.keys(e).filter(t=>e[t]._zod.optin==="optional"&&e[t]._zod.optout==="optional")}function S0r(e,t){let r=e._zod.def,n=r.checks;if(n&&n.length>0)throw new Error(".pick() cannot be used on object schemas containing refinements");let o=_w(e._zod.def,{get shape(){let i={};for(let s in t){if(!(s in r.shape))throw new Error(`Unrecognized key: "${s}"`);t[s]&&(i[s]=r.shape[s])}return nx(this,"shape",i),i},checks:[]});return Wd(e,o)}function b0r(e,t){let r=e._zod.def,n=r.checks;if(n&&n.length>0)throw new Error(".omit() cannot be used on object schemas containing refinements");let o=_w(e._zod.def,{get shape(){let i={...e._zod.def.shape};for(let s in t){if(!(s in r.shape))throw new Error(`Unrecognized key: "${s}"`);t[s]&&delete i[s]}return nx(this,"shape",i),i},checks:[]});return Wd(e,o)}function E0r(e,t){if(!ax(t))throw new Error("Invalid input to extend: expected a plain object");let r=e._zod.def.checks;if(r&&r.length>0){let o=e._zod.def.shape;for(let i in t)if(Object.getOwnPropertyDescriptor(o,i)!==void 0)throw new Error("Cannot overwrite keys on object schemas containing refinements. Use `.safeExtend()` instead.")}let a=_w(e._zod.def,{get shape(){let o={...e._zod.def.shape,...t};return nx(this,"shape",o),o}});return Wd(e,a)}function A0r(e,t){if(!ax(t))throw new Error("Invalid input to safeExtend: expected a plain object");let r=_w(e._zod.def,{get shape(){let n={...e._zod.def.shape,...t};return nx(this,"shape",n),n}});return Wd(e,r)}function w0r(e,t){if(e._zod.def.checks?.length)throw new Error(".merge() cannot be used on object schemas containing refinements. Use .safeExtend() instead.");let r=_w(e._zod.def,{get shape(){let n={...e._zod.def.shape,...t._zod.def.shape};return nx(this,"shape",n),n},get catchall(){return t._zod.def.catchall},checks:t._zod.def.checks??[]});return Wd(e,r)}function C0r(e,t,r){let a=t._zod.def.checks;if(a&&a.length>0)throw new Error(".partial() cannot be used on object schemas containing refinements");let i=_w(t._zod.def,{get shape(){let s=t._zod.def.shape,c={...s};if(r)for(let l in r){if(!(l in s))throw new Error(`Unrecognized key: "${l}"`);r[l]&&(c[l]=e?new e({type:"optional",innerType:s[l]}):s[l])}else for(let l in s)c[l]=e?new e({type:"optional",innerType:s[l]}):s[l];return nx(this,"shape",c),c},checks:[]});return Wd(t,i)}function T0r(e,t,r){let n=_w(t._zod.def,{get shape(){let a=t._zod.def.shape,o={...a};if(r)for(let i in r){if(!(i in o))throw new Error(`Unrecognized key: "${i}"`);r[i]&&(o[i]=new e({type:"nonoptional",innerType:a[i]}))}else for(let i in a)o[i]=new e({type:"nonoptional",innerType:a[i]});return nx(this,"shape",o),o}});return Wd(t,n)}function ox(e,t=0){if(e.aborted===!0)return!0;for(let r=t;r<e.issues.length;r++)if(e.issues[r]?.continue!==!0)return!0;return!1}function $Pe(e,t=0){if(e.aborted===!0)return!0;for(let r=t;r<e.issues.length;r++)if(e.issues[r]?.continue===!1)return!0;return!1}function bm(e,t){return t.map(r=>{var n;return(n=r).path??(n.path=[]),r.path.unshift(e),r})}function P6(e){return typeof e=="string"?e:e?.message}function zd(e,t,r){let n=e.message?e.message:P6(e.inst?._zod.def?.error?.(e))??P6(t?.error?.(e))??P6(r.customError?.(e))??P6(r.localeError?.(e))??"Invalid input",{inst:a,continue:o,input:i,...s}=e;return s.path??(s.path=[]),s.message=n,t?.reportInput&&(s.input=i),s}function $6(e){return e instanceof Set?"set":e instanceof Map?"map":e instanceof File?"file":"unknown"}function M6(e){return Array.isArray(e)?"array":typeof e=="string"?"string":"unknown"}function tt(e){let t=typeof e;switch(t){case"number":return Number.isNaN(e)?"nan":"number";case"object":{if(e===null)return"null";if(Array.isArray(e))return"array";let r=e;if(r&&Object.getPrototypeOf(r)!==Object.prototype&&"constructor"in r&&r.constructor)return r.constructor.name}}return t}function gF(...e){let[t,r,n]=e;return typeof t=="string"?{message:t,code:"custom",input:r,inst:n}:{...t}}function x0r(e){return Object.entries(e).filter(([t,r])=>Number.isNaN(Number.parseInt(t,10))).map(t=>t[1])}function Zyt(e){let t=atob(e),r=new Uint8Array(t.length);for(let n=0;n<t.length;n++)r[n]=t.charCodeAt(n);return r}function Xyt(e){let t="";for(let r=0;r<e.length;r++)t+=String.fromCharCode(e[r]);return btoa(t)}function k0r(e){let t=e.replace(/-/g,"+").replace(/_/g,"/"),r="=".repeat((4-t.length%4)%4);return Zyt(t+r)}function I0r(e){return Xyt(e).replace(/\+/g,"-").replace(/\//g,"_").replace(/=/g,"")}function R0r(e){let t=e.replace(/^0x/,"");if(t.length%2!==0)throw new Error("Invalid hex string length");let r=new Uint8Array(t.length/2);for(let n=0;n<t.length;n+=2)r[n/2]=Number.parseInt(t.slice(n,n+2),16);return r}function _0r(e){return Array.from(e).map(t=>t.toString(16).padStart(2,"0")).join("")}var Jyt,Yie,RPe,y0r,N6,PPe,DPe,NPe,xPe,Zt=w(()=>{aP();Jyt=Symbol("evaluating");Yie="captureStackTrace"in Error?Error.captureStackTrace:(...e)=>{};RPe=hF(()=>{if(nP.jitless||typeof navigator<"u"&&navigator?.userAgent?.includes("Cloudflare"))return!1;try{let e=Function;return new e(""),!0}catch{return!1}});y0r=e=>{let t=typeof e;switch(t){case"undefined":return"undefined";case"string":return"string";case"number":return Number.isNaN(e)?"nan":"number";case"boolean":return"boolean";case"function":return"function";case"bigint":return"bigint";case"symbol":return"symbol";case"object":return Array.isArray(e)?"array":e===null?"null":e.then&&typeof e.then=="function"&&e.catch&&typeof e.catch=="function"?"promise":typeof Map<"u"&&e instanceof Map?"map":typeof Set<"u"&&e instanceof Set?"set":typeof Date<"u"&&e instanceof Date?"date":typeof File<"u"&&e instanceof File?"file":"object";default:throw new Error(`Unknown data type: ${t}`)}},N6=new Set(["string","number","symbol"]),PPe=new Set(["string","number","bigint","boolean","symbol","undefined"]);DPe={safeint:[Number.MIN_SAFE_INTEGER,Number.MAX_SAFE_INTEGER],int32:[-2147483648,2147483647],uint32:[0,4294967295],float32:[-34028234663852886e22,34028234663852886e22],float64:[-Number.MAX_VALUE,Number.MAX_VALUE]},NPe={int64:[BigInt("-9223372036854775808"),BigInt("9223372036854775807")],uint64:[BigInt(0),BigInt("18446744073709551615")]};xPe=class{constructor(...t){}}});function F6(e,t=r=>r.message){let r={},n=[];for(let a of e.issues)a.path.length>0?(r[a.path[0]]=r[a.path[0]]||[],r[a.path[0]].push(t(a))):n.push(t(a));return{formErrors:n,fieldErrors:r}}function j6(e,t=r=>r.message){let r={_errors:[]},n=(a,o=[])=>{for(let i of a.issues)if(i.code==="invalid_union"&&i.errors.length)i.errors.map(s=>n({issues:s},[...o,...i.path]));else if(i.code==="invalid_key")n({issues:i.issues},[...o,...i.path]);else if(i.code==="invalid_element")n({issues:i.issues},[...o,...i.path]);else{let s=[...o,...i.path];if(s.length===0)r._errors.push(t(i));else{let c=r,l=0;for(;l<s.length;){let u=s[l];l===s.length-1?(c[u]=c[u]||{_errors:[]},c[u]._errors.push(t(i))):c[u]=c[u]||{_errors:[]},c=c[u],l++}}}};return n(e),r}function MPe(e,t=r=>r.message){let r={errors:[]},n=(a,o=[])=>{var i,s;for(let c of a.issues)if(c.code==="invalid_union"&&c.errors.length)c.errors.map(l=>n({issues:l},[...o,...c.path]));else if(c.code==="invalid_key")n({issues:c.issues},[...o,...c.path]);else if(c.code==="invalid_element")n({issues:c.issues},[...o,...c.path]);else{let l=[...o,...c.path];if(l.length===0){r.errors.push(t(c));continue}let u=r,d=0;for(;d<l.length;){let p=l[d],m=d===l.length-1;typeof p=="string"?(u.properties??(u.properties={}),(i=u.properties)[p]??(i[p]={errors:[]}),u=u.properties[p]):(u.items??(u.items=[]),(s=u.items)[p]??(s[p]={errors:[]}),u=u.items[p]),m&&u.errors.push(t(c)),d++}}};return n(e),r}function evt(e){let t=[],r=e.map(n=>typeof n=="object"?n.key:n);for(let n of r)typeof n=="number"?t.push(`[${n}]`):typeof n=="symbol"?t.push(`[${JSON.stringify(String(n))}]`):/[^\w$]/.test(n)?t.push(`[${JSON.stringify(n)}]`):(t.length&&t.push("."),t.push(n));return t.join("")}function LPe(e){let t=[],r=[...e.issues].sort((n,a)=>(n.path??[]).length-(a.path??[]).length);for(let n of r)t.push(`\u2716 ${n.message}`),n.path?.length&&t.push(`  \u2192 at ${evt(n.path)}`);return t.join(`
 `)}var Qyt,L6,Em,FPe=w(()=>{aP();Zt();Qyt=(e,t)=>{e.name="$ZodError",Object.defineProperty(e,"_zod",{value:e._zod,enumerable:!1}),Object.defineProperty(e,"issues",{value:t,enumerable:!1}),e.message=JSON.stringify(t,fF,2),Object.defineProperty(e,"toString",{value:()=>e.message,enumerable:!1})},L6=pe("$ZodError",Qyt),Em=pe("$ZodError",Qyt,{Parent:Error})});var yF,Jie,vF,Zie,SF,jPe,bF,BPe,Xie,O0r,Qie,D0r,ese,N0r,tse,$0r,rse,M0r,nse,L0r,ase,F0r,ose,j0r,UPe=w(()=>{aP();FPe();Zt();yF=e=>(t,r,n,a)=>{let o=n?{...n,async:!1}:{async:!1},i=t._zod.run({value:r,issues:[]},o);if(i instanceof Promise)throw new mv;if(i.issues.length){let s=new(a?.Err??e)(i.issues.map(c=>zd(c,o,us())));throw Yie(s,a?.callee),s}return i.value},Jie=yF(Em),vF=e=>async(t,r,n,a)=>{let o=n?{...n,async:!0}:{async:!0},i=t._zod.run({value:r,issues:[]},o);if(i instanceof Promise&&(i=await i),i.issues.length){let s=new(a?.Err??e)(i.issues.map(c=>zd(c,o,us())));throw Yie(s,a?.callee),s}return i.value},Zie=vF(Em),SF=e=>(t,r,n)=>{let a=n?{...n,async:!1}:{async:!1},o=t._zod.run({value:r,issues:[]},a);if(o instanceof Promise)throw new mv;return o.issues.length?{success:!1,error:new(e??L6)(o.issues.map(i=>zd(i,a,us())))}:{success:!0,data:o.value}},jPe=SF(Em),bF=e=>async(t,r,n)=>{let a=n?{...n,async:!0}:{async:!0},o=t._zod.run({value:r,issues:[]},a);return o instanceof Promise&&(o=await o),o.issues.length?{success:!1,error:new e(o.issues.map(i=>zd(i,a,us())))}:{success:!0,data:o.value}},BPe=bF(Em),Xie=e=>(t,r,n)=>{let a=n?{...n,direction:"backward"}:{direction:"backward"};return yF(e)(t,r,a)},O0r=Xie(Em),Qie=e=>(t,r,n)=>yF(e)(t,r,n),D0r=Qie(Em),ese=e=>async(t,r,n)=>{let a=n?{...n,direction:"backward"}:{direction:"backward"};return vF(e)(t,r,a)},N0r=ese(Em),tse=e=>async(t,r,n)=>vF(e)(t,r,n),$0r=tse(Em),rse=e=>(t,r,n)=>{let a=n?{...n,direction:"backward"}:{direction:"backward"};return SF(e)(t,r,a)},M0r=rse(Em),nse=e=>(t,r,n)=>SF(e)(t,r,n),L0r=nse(Em),ase=e=>async(t,r,n)=>{let a=n?{...n,direction:"backward"}:{direction:"backward"};return bF(e)(t,r,a)},F0r=ase(Em),ose=e=>async(t,r,n)=>bF(e)(t,r,n),j0r=ose(Em)});var Uf={};nr(Uf,{base64:()=>nOe,base64url:()=>ise,bigint:()=>uOe,boolean:()=>pOe,browserEmail:()=>K0r,cidrv4:()=>tOe,cidrv6:()=>rOe,cuid:()=>GPe,cuid2:()=>VPe,date:()=>iOe,datetime:()=>cOe,domain:()=>J0r,duration:()=>qPe,e164:()=>oOe,email:()=>JPe,emoji:()=>ZPe,extendedDuration:()=>B0r,guid:()=>YPe,hex:()=>Z0r,hostname:()=>Y0r,html5Email:()=>W0r,httpProtocol:()=>aOe,idnEmail:()=>H0r,integer:()=>dOe,ipv4:()=>XPe,ipv6:()=>QPe,ksuid:()=>HPe,lowercase:()=>hOe,mac:()=>eOe,md5_base64:()=>Q0r,md5_base64url:()=>eTr,md5_hex:()=>X0r,nanoid:()=>KPe,null:()=>mOe,number:()=>sse,rfc5322Email:()=>z0r,sha1_base64:()=>rTr,sha1_base64url:()=>nTr,sha1_hex:()=>tTr,sha256_base64:()=>oTr,sha256_base64url:()=>iTr,sha256_hex:()=>aTr,sha384_base64:()=>cTr,sha384_base64url:()=>lTr,sha384_hex:()=>sTr,sha512_base64:()=>dTr,sha512_base64url:()=>pTr,sha512_hex:()=>uTr,string:()=>lOe,time:()=>sOe,ulid:()=>WPe,undefined:()=>fOe,unicodeEmail:()=>tvt,uppercase:()=>gOe,uuid:()=>iP,uuid4:()=>U0r,uuid6:()=>G0r,uuid7:()=>V0r,xid:()=>zPe});function ZPe(){return new RegExp(q0r,"u")}function nvt(e){let t="(?:[01]\\d|2[0-3]):[0-5]\\d";return typeof e.precision=="number"?e.precision===-1?`${t}`:e.precision===0?`${t}:[0-5]\\d`:`${t}:[0-5]\\d\\.\\d{${e.precision}}`:`${t}(?::[0-5]\\d(?:\\.\\d+)?)?`}function sOe(e){return new RegExp(`^${nvt(e)}$`)}function cOe(e){let t=nvt({precision:e.precision}),r=["Z"];e.local&&r.push(""),e.offset&&r.push("([+-](?:[01]\\d|2[0-3]):[0-5]\\d)");let n=`${t}(?:${r.join("|")})`;return new RegExp(`^${rvt}T(?:${n})$`)}function B6(e,t){return new RegExp(`^[A-Za-z0-9+/]{${e}}${t}$`)}function U6(e){return new RegExp(`^[A-Za-z0-9_-]{${e}}$`)}var GPe,VPe,WPe,zPe,HPe,KPe,qPe,B0r,YPe,iP,U0r,G0r,V0r,JPe,W0r,z0r,tvt,H0r,K0r,q0r,XPe,QPe,eOe,tOe,rOe,nOe,ise,Y0r,J0r,aOe,oOe,rvt,iOe,lOe,uOe,dOe,sse,pOe,mOe,fOe,hOe,gOe,Z0r,X0r,Q0r,eTr,tTr,rTr,nTr,aTr,oTr,iTr,sTr,cTr,lTr,uTr,dTr,pTr,cse=w(()=>{Zt();GPe=/^[cC][0-9a-z]{6,}$/,VPe=/^[0-9a-z]+$/,WPe=/^[0-9A-HJKMNP-TV-Za-hjkmnp-tv-z]{26}$/,zPe=/^[0-9a-vA-V]{20}$/,HPe=/^[A-Za-z0-9]{27}$/,KPe=/^[a-zA-Z0-9_-]{21}$/,qPe=/^P(?:(\d+W)|(?!.*W)(?=\d|T\d)(\d+Y)?(\d+M)?(\d+D)?(T(?=\d)(\d+H)?(\d+M)?(\d+([.,]\d+)?S)?)?)$/,B0r=/^[-+]?P(?!$)(?:(?:[-+]?\d+Y)|(?:[-+]?\d+[.,]\d+Y$))?(?:(?:[-+]?\d+M)|(?:[-+]?\d+[.,]\d+M$))?(?:(?:[-+]?\d+W)|(?:[-+]?\d+[.,]\d+W$))?(?:(?:[-+]?\d+D)|(?:[-+]?\d+[.,]\d+D$))?(?:T(?=[\d+-])(?:(?:[-+]?\d+H)|(?:[-+]?\d+[.,]\d+H$))?(?:(?:[-+]?\d+M)|(?:[-+]?\d+[.,]\d+M$))?(?:[-+]?\d+(?:[.,]\d+)?S)?)??$/,YPe=/^([0-9a-fA-F]{8}-[0-9a-fA-F]{4}-[0-9a-fA-F]{4}-[0-9a-fA-F]{4}-[0-9a-fA-F]{12})$/,iP=e=>e?new RegExp(`^([0-9a-fA-F]{8}-[0-9a-fA-F]{4}-${e}[0-9a-fA-F]{3}-[89abAB][0-9a-fA-F]{3}-[0-9a-fA-F]{12})$`):/^([0-9a-fA-F]{8}-[0-9a-fA-F]{4}-[1-8][0-9a-fA-F]{3}-[89abAB][0-9a-fA-F]{3}-[0-9a-fA-F]{12}|00000000-0000-0000-0000-000000000000|ffffffff-ffff-ffff-ffff-ffffffffffff)$/,U0r=iP(4),G0r=iP(6),V0r=iP(7),JPe=/^(?!\.)(?!.*\.\.)([A-Za-z0-9_'+\-\.]*)[A-Za-z0-9_+-]@([A-Za-z0-9][A-Za-z0-9\-]*\.)+[A-Za-z]{2,}$/,W0r=/^[a-zA-Z0-9.!#$%&'*+/=?^_`{|}~-]+@[a-zA-Z0-9](?:[a-zA-Z0-9-]{0,61}[a-zA-Z0-9])?(?:\.[a-zA-Z0-9](?:[a-zA-Z0-9-]{0,61}[a-zA-Z0-9])?)*$/,z0r=/^(([^<>()\[\]\\.,;:\s@"]+(\.[^<>()\[\]\\.,;:\s@"]+)*)|(".+"))@((\[[0-9]{1,3}\.[0-9]{1,3}\.[0-9]{1,3}\.[0-9]{1,3}])|(([a-zA-Z\-0-9]+\.)+[a-zA-Z]{2,}))$/,tvt=/^[^\s@"]{1,64}@[^\s@]{1,255}$/u,H0r=tvt,K0r=/^[a-zA-Z0-9.!#$%&'*+/=?^_`{|}~-]+@[a-zA-Z0-9](?:[a-zA-Z0-9-]{0,61}[a-zA-Z0-9])?(?:\.[a-zA-Z0-9](?:[a-zA-Z0-9-]{0,61}[a-zA-Z0-9])?)*$/,q0r="^(\\p{Extended_Pictographic}|\\p{Emoji_Component})+$";XPe=/^(?:(?:25[0-5]|2[0-4][0-9]|1[0-9][0-9]|[1-9][0-9]|[0-9])\.){3}(?:25[0-5]|2[0-4][0-9]|1[0-9][0-9]|[1-9][0-9]|[0-9])$/,QPe=/^(([0-9a-fA-F]{1,4}:){7}[0-9a-fA-F]{1,4}|([0-9a-fA-F]{1,4}:){1,7}:|([0-9a-fA-F]{1,4}:){1,6}:[0-9a-fA-F]{1,4}|([0-9a-fA-F]{1,4}:){1,5}(:[0-9a-fA-F]{1,4}){1,2}|([0-9a-fA-F]{1,4}:){1,4}(:[0-9a-fA-F]{1,4}){1,3}|([0-9a-fA-F]{1,4}:){1,3}(:[0-9a-fA-F]{1,4}){1,4}|([0-9a-fA-F]{1,4}:){1,2}(:[0-9a-fA-F]{1,4}){1,5}|[0-9a-fA-F]{1,4}:((:[0-9a-fA-F]{1,4}){1,6})|:((:[0-9a-fA-F]{1,4}){1,7}|:))$/,eOe=e=>{let t=ng(e??":");return new RegExp(`^(?:[0-9A-F]{2}${t}){5}[0-9A-F]{2}$|^(?:[0-9a-f]{2}${t}){5}[0-9a-f]{2}$`)},tOe=/^((25[0-5]|2[0-4][0-9]|1[0-9][0-9]|[1-9][0-9]|[0-9])\.){3}(25[0-5]|2[0-4][0-9]|1[0-9][0-9]|[1-9][0-9]|[0-9])\/([0-9]|[1-2][0-9]|3[0-2])$/,rOe=/^(([0-9a-fA-F]{1,4}:){7}[0-9a-fA-F]{1,4}|::|([0-9a-fA-F]{1,4})?::([0-9a-fA-F]{1,4}:?){0,6})\/(12[0-8]|1[01][0-9]|[1-9]?[0-9])$/,nOe=/^$|^(?:[0-9a-zA-Z+/]{4})*(?:(?:[0-9a-zA-Z+/]{2}==)|(?:[0-9a-zA-Z+/]{3}=))?$/,ise=/^[A-Za-z0-9_-]*$/,Y0r=/^(?=.{1,253}\.?$)[a-zA-Z0-9](?:[a-zA-Z0-9-]{0,61}[a-zA-Z0-9])?(?:\.[a-zA-Z0-9](?:[-0-9a-zA-Z]{0,61}[0-9a-zA-Z])?)*\.?$/,J0r=/^([a-zA-Z0-9](?:[a-zA-Z0-9-]{0,61}[a-zA-Z0-9])?\.)+[a-zA-Z]{2,}$/,aOe=/^https?$/,oOe=/^\+[1-9]\d{6,14}$/,rvt="(?:(?:\\d\\d[2468][048]|\\d\\d[13579][26]|\\d\\d0[48]|[02468][048]00|[13579][26]00)-02-29|\\d{4}-(?:(?:0[13578]|1[02])-(?:0[1-9]|[12]\\d|3[01])|(?:0[469]|11)-(?:0[1-9]|[12]\\d|30)|(?:02)-(?:0[1-9]|1\\d|2[0-8])))",iOe=new RegExp(`^${rvt}$`);lOe=e=>{let t=e?`[\\s\\S]{${e?.minimum??0},${e?.maximum??""}}`:"[\\s\\S]*";return new RegExp(`^${t}$`)},uOe=/^-?\d+n?$/,dOe=/^-?\d+$/,sse=/^-?\d+(?:\.\d+)?$/,pOe=/^(?:true|false)$/i,mOe=/^null$/i,fOe=/^undefined$/i,hOe=/^[^A-Z]*$/,gOe=/^[^a-z]*$/,Z0r=/^[0-9a-fA-F]*$/;X0r=/^[0-9a-fA-F]{32}$/,Q0r=B6(22,"=="),eTr=U6(22),tTr=/^[0-9a-fA-F]{40}$/,rTr=B6(27,"="),nTr=U6(27),aTr=/^[0-9a-fA-F]{64}$/,oTr=B6(43,"="),iTr=U6(43),sTr=/^[0-9a-fA-F]{96}$/,cTr=B6(64,""),lTr=U6(64),uTr=/^[0-9a-fA-F]{128}$/,dTr=B6(86,"=="),pTr=U6(86)});function avt(e,t,r){e.issues.length&&t.issues.push(...bm(r,e.issues))}var ko,ovt,lse,use,yOe,vOe,SOe,bOe,EOe,AOe,wOe,COe,TOe,EF,xOe,kOe,IOe,ROe,_Oe,POe,OOe,DOe,NOe,dse=w(()=>{aP();cse();Zt();ko=pe("$ZodCheck",(e,t)=>{var r;e._zod??(e._zod={}),e._zod.def=t,(r=e._zod).onattach??(r.onattach=[])}),ovt={number:"number",bigint:"bigint",object:"date"},lse=pe("$ZodCheckLessThan",(e,t)=>{ko.init(e,t);let r=ovt[typeof t.value];e._zod.onattach.push(n=>{let a=n._zod.bag,o=(t.inclusive?a.maximum:a.exclusiveMaximum)??Number.POSITIVE_INFINITY;t.value<o&&(t.inclusive?a.maximum=t.value:a.exclusiveMaximum=t.value)}),e._zod.check=n=>{(t.inclusive?n.value<=t.value:n.value<t.value)||n.issues.push({origin:r,code:"too_big",maximum:typeof t.value=="object"?t.value.getTime():t.value,input:n.value,inclusive:t.inclusive,inst:e,continue:!t.abort})}}),use=pe("$ZodCheckGreaterThan",(e,t)=>{ko.init(e,t);let r=ovt[typeof t.value];e._zod.onattach.push(n=>{let a=n._zod.bag,o=(t.inclusive?a.minimum:a.exclusiveMinimum)??Number.NEGATIVE_INFINITY;t.value>o&&(t.inclusive?a.minimum=t.value:a.exclusiveMinimum=t.value)}),e._zod.check=n=>{(t.inclusive?n.value>=t.value:n.value>t.value)||n.issues.push({origin:r,code:"too_small",minimum:typeof t.value=="object"?t.value.getTime():t.value,input:n.value,inclusive:t.inclusive,inst:e,continue:!t.abort})}}),yOe=pe("$ZodCheckMultipleOf",(e,t)=>{ko.init(e,t),e._zod.onattach.push(r=>{var n;(n=r._zod.bag).multipleOf??(n.multipleOf=t.value)}),e._zod.check=r=>{if(typeof r.value!=typeof t.value)throw new Error("Cannot mix number and bigint in multiple_of check.");(typeof r.value=="bigint"?r.value%t.value===BigInt(0):kPe(r.value,t.value)===0)||r.issues.push({origin:typeof r.value,code:"not_multiple_of",divisor:t.value,input:r.value,inst:e,continue:!t.abort})}}),vOe=pe("$ZodCheckNumberFormat",(e,t)=>{ko.init(e,t),t.format=t.format||"float64";let r=t.format?.includes("int"),n=r?"int":"number",[a,o]=DPe[t.format];e._zod.onattach.push(i=>{let s=i._zod.bag;s.format=t.format,s.minimum=a,s.maximum=o,r&&(s.pattern=dOe)}),e._zod.check=i=>{let s=i.value;if(r){if(!Number.isInteger(s)){i.issues.push({expected:n,format:t.format,code:"invalid_type",continue:!1,input:s,inst:e});return}if(!Number.isSafeInteger(s)){s>0?i.issues.push({input:s,code:"too_big",maximum:Number.MAX_SAFE_INTEGER,note:"Integers must be within the safe integer range.",inst:e,origin:n,inclusive:!0,continue:!t.abort}):i.issues.push({input:s,code:"too_small",minimum:Number.MIN_SAFE_INTEGER,note:"Integers must be within the safe integer range.",inst:e,origin:n,inclusive:!0,continue:!t.abort});return}}s<a&&i.issues.push({origin:"number",input:s,code:"too_small",minimum:a,inclusive:!0,inst:e,continue:!t.abort}),s>o&&i.issues.push({origin:"number",input:s,code:"too_big",maximum:o,inclusive:!0,inst:e,continue:!t.abort})}}),SOe=pe("$ZodCheckBigIntFormat",(e,t)=>{ko.init(e,t);let[r,n]=NPe[t.format];e._zod.onattach.push(a=>{let o=a._zod.bag;o.format=t.format,o.minimum=r,o.maximum=n}),e._zod.check=a=>{let o=a.value;o<r&&a.issues.push({origin:"bigint",input:o,code:"too_small",minimum:r,inclusive:!0,inst:e,continue:!t.abort}),o>n&&a.issues.push({origin:"bigint",input:o,code:"too_big",maximum:n,inclusive:!0,inst:e,continue:!t.abort})}}),bOe=pe("$ZodCheckMaxSize",(e,t)=>{var r;ko.init(e,t),(r=e._zod.def).when??(r.when=n=>{let a=n.value;return!rx(a)&&a.size!==void 0}),e._zod.onattach.push(n=>{let a=n._zod.bag.maximum??Number.POSITIVE_INFINITY;t.maximum<a&&(n._zod.bag.maximum=t.maximum)}),e._zod.check=n=>{let a=n.value;a.size<=t.maximum||n.issues.push({origin:$6(a),code:"too_big",maximum:t.maximum,inclusive:!0,input:a,inst:e,continue:!t.abort})}}),EOe=pe("$ZodCheckMinSize",(e,t)=>{var r;ko.init(e,t),(r=e._zod.def).when??(r.when=n=>{let a=n.value;return!rx(a)&&a.size!==void 0}),e._zod.onattach.push(n=>{let a=n._zod.bag.minimum??Number.NEGATIVE_INFINITY;t.minimum>a&&(n._zod.bag.minimum=t.minimum)}),e._zod.check=n=>{let a=n.value;a.size>=t.minimum||n.issues.push({origin:$6(a),code:"too_small",minimum:t.minimum,inclusive:!0,input:a,inst:e,continue:!t.abort})}}),AOe=pe("$ZodCheckSizeEquals",(e,t)=>{var r;ko.init(e,t),(r=e._zod.def).when??(r.when=n=>{let a=n.value;return!rx(a)&&a.size!==void 0}),e._zod.onattach.push(n=>{let a=n._zod.bag;a.minimum=t.size,a.maximum=t.size,a.size=t.size}),e._zod.check=n=>{let a=n.value,o=a.size;if(o===t.size)return;let i=o>t.size;n.issues.push({origin:$6(a),...i?{code:"too_big",maximum:t.size}:{code:"too_small",minimum:t.size},inclusive:!0,exact:!0,input:n.value,inst:e,continue:!t.abort})}}),wOe=pe("$ZodCheckMaxLength",(e,t)=>{var r;ko.init(e,t),(r=e._zod.def).when??(r.when=n=>{let a=n.value;return!rx(a)&&a.length!==void 0}),e._zod.onattach.push(n=>{let a=n._zod.bag.maximum??Number.POSITIVE_INFINITY;t.maximum<a&&(n._zod.bag.maximum=t.maximum)}),e._zod.check=n=>{let a=n.value;if(a.length<=t.maximum)return;let i=M6(a);n.issues.push({origin:i,code:"too_big",maximum:t.maximum,inclusive:!0,input:a,inst:e,continue:!t.abort})}}),COe=pe("$ZodCheckMinLength",(e,t)=>{var r;ko.init(e,t),(r=e._zod.def).when??(r.when=n=>{let a=n.value;return!rx(a)&&a.length!==void 0}),e._zod.onattach.push(n=>{let a=n._zod.bag.minimum??Number.NEGATIVE_INFINITY;t.minimum>a&&(n._zod.bag.minimum=t.minimum)}),e._zod.check=n=>{let a=n.value;if(a.length>=t.minimum)return;let i=M6(a);n.issues.push({origin:i,code:"too_small",minimum:t.minimum,inclusive:!0,input:a,inst:e,continue:!t.abort})}}),TOe=pe("$ZodCheckLengthEquals",(e,t)=>{var r;ko.init(e,t),(r=e._zod.def).when??(r.when=n=>{let a=n.value;return!rx(a)&&a.length!==void 0}),e._zod.onattach.push(n=>{let a=n._zod.bag;a.minimum=t.length,a.maximum=t.length,a.length=t.length}),e._zod.check=n=>{let a=n.value,o=a.length;if(o===t.length)return;let i=M6(a),s=o>t.length;n.issues.push({origin:i,...s?{code:"too_big",maximum:t.length}:{code:"too_small",minimum:t.length},inclusive:!0,exact:!0,input:n.value,inst:e,continue:!t.abort})}}),EF=pe("$ZodCheckStringFormat",(e,t)=>{var r,n;ko.init(e,t),e._zod.onattach.push(a=>{let o=a._zod.bag;o.format=t.format,t.pattern&&(o.patterns??(o.patterns=new Set),o.patterns.add(t.pattern))}),t.pattern?(r=e._zod).check??(r.check=a=>{t.pattern.lastIndex=0,!t.pattern.test(a.value)&&a.issues.push({origin:"string",code:"invalid_format",format:t.format,input:a.value,...t.pattern?{pattern:t.pattern.toString()}:{},inst:e,continue:!t.abort})}):(n=e._zod).check??(n.check=()=>{})}),xOe=pe("$ZodCheckRegex",(e,t)=>{EF.init(e,t),e._zod.check=r=>{t.pattern.lastIndex=0,!t.pattern.test(r.value)&&r.issues.push({origin:"string",code:"invalid_format",format:"regex",input:r.value,pattern:t.pattern.toString(),inst:e,continue:!t.abort})}}),kOe=pe("$ZodCheckLowerCase",(e,t)=>{t.pattern??(t.pattern=hOe),EF.init(e,t)}),IOe=pe("$ZodCheckUpperCase",(e,t)=>{t.pattern??(t.pattern=gOe),EF.init(e,t)}),ROe=pe("$ZodCheckIncludes",(e,t)=>{ko.init(e,t);let r=ng(t.includes),n=new RegExp(typeof t.position=="number"?`^.{${t.position}}${r}`:r);t.pattern=n,e._zod.onattach.push(a=>{let o=a._zod.bag;o.patterns??(o.patterns=new Set),o.patterns.add(n)}),e._zod.check=a=>{a.value.includes(t.includes,t.position)||a.issues.push({origin:"string",code:"invalid_format",format:"includes",includes:t.includes,input:a.value,inst:e,continue:!t.abort})}}),_Oe=pe("$ZodCheckStartsWith",(e,t)=>{ko.init(e,t);let r=new RegExp(`^${ng(t.prefix)}.*`);t.pattern??(t.pattern=r),e._zod.onattach.push(n=>{let a=n._zod.bag;a.patterns??(a.patterns=new Set),a.patterns.add(r)}),e._zod.check=n=>{n.value.startsWith(t.prefix)||n.issues.push({origin:"string",code:"invalid_format",format:"starts_with",prefix:t.prefix,input:n.value,inst:e,continue:!t.abort})}}),POe=pe("$ZodCheckEndsWith",(e,t)=>{ko.init(e,t);let r=new RegExp(`.*${ng(t.suffix)}$`);t.pattern??(t.pattern=r),e._zod.onattach.push(n=>{let a=n._zod.bag;a.patterns??(a.patterns=new Set),a.patterns.add(r)}),e._zod.check=n=>{n.value.endsWith(t.suffix)||n.issues.push({origin:"string",code:"invalid_format",format:"ends_with",suffix:t.suffix,input:n.value,inst:e,continue:!t.abort})}});OOe=pe("$ZodCheckProperty",(e,t)=>{ko.init(e,t),e._zod.check=r=>{let n=t.schema._zod.run({value:r.value[t.property],issues:[]},{});if(n instanceof Promise)return n.then(a=>avt(a,r,t.property));avt(n,r,t.property)}}),DOe=pe("$ZodCheckMimeType",(e,t)=>{ko.init(e,t);let r=new Set(t.mime);e._zod.onattach.push(n=>{n._zod.bag.mime=t.mime}),e._zod.check=n=>{r.has(n.value.type)||n.issues.push({code:"invalid_value",values:t.mime,input:n.value.type,inst:e,continue:!t.abort})}}),NOe=pe("$ZodCheckOverwrite",(e,t)=>{ko.init(e,t),e._zod.check=r=>{r.value=t.tx(r.value)}})});var G6,$Oe=w(()=>{G6=class{constructor(t=[]){this.content=[],this.indent=0,this&&(this.args=t)}indented(t){this.indent+=1,t(this),this.indent-=1}write(t){if(typeof t=="function"){t(this,{execution:"sync"}),t(this,{execution:"async"});return}let n=t.split(`
 `).filter(i=>i),a=Math.min(...n.map(i=>i.length-i.trimStart().length)),o=n.map(i=>i.slice(a)).map(i=>" ".repeat(this.indent*2)+i);for(let i of o)this.content.push(i)}compile(){let t=Function,r=this?.args,a=[...(this?.content??[""]).map(o=>`  ${o}`)];return new t(...r,a.join(`
 `))}}});var MOe,LOe=w(()=>{MOe={major:4,minor:4,patch:3}});function oDe(e){if(e==="")return!0;if(/\s/.test(e)||e.length%4!==0)return!1;try{return atob(e),!0}catch{return!1}}function Evt(e){if(!ise.test(e))return!1;let t=e.replace(/[-_]/g,n=>n==="-"?"+":"/"),r=t.padEnd(Math.ceil(t.length/4)*4,"=");return oDe(r)}function Avt(e,t=null){try{let r=e.split(".");if(r.length!==3)return!1;let[n]=r;if(!n)return!1;let a=JSON.parse(atob(n));return!("typ"in a&&a?.typ!=="JWT"||!a.alg||t&&(!("alg"in a)||a.alg!==t))}catch{return!1}}function svt(e,t,r){e.issues.length&&t.issues.push(...bm(r,e.issues)),t.value[r]=e.value}function hse(e,t,r,n,a,o){let i=r in n;if(e.issues.length){if(a&&o&&!i)return;t.issues.push(...bm(r,e.issues))}if(!i&&!a){e.issues.length||t.issues.push({code:"invalid_type",expected:"nonoptional",input:void 0,path:[r]});return}e.value===void 0?i&&(t.value[r]=void 0):t.value[r]=e.value}function wvt(e){let t=Object.keys(e.shape);for(let n of t)if(!e.shape?.[n]?._zod?.traits?.has("$ZodType"))throw new Error(`Invalid element at key "${n}": expected a Zod schema`);let r=OPe(e.shape);return{...e,keys:t,keySet:new Set(t),numKeys:t.length,optionalKeys:new Set(r)}}function Cvt(e,t,r,n,a,o){let i=[],s=a.keySet,c=a.catchall._zod,l=c.def.type,u=c.optin==="optional",d=c.optout==="optional";for(let p in t){if(p==="__proto__"||s.has(p))continue;if(l==="never"){i.push(p);continue}let m=c.run({value:t[p],issues:[]},n);m instanceof Promise?e.push(m.then(f=>hse(f,r,p,t,u,d))):hse(m,r,p,t,u,d)}return i.length&&r.issues.push({code:"unrecognized_keys",keys:i,input:t,inst:o}),e.length?Promise.all(e).then(()=>r):r}function cvt(e,t,r,n){for(let o of e)if(o.issues.length===0)return t.value=o.value,t;let a=e.filter(o=>!ox(o));return a.length===1?(t.value=a[0].value,a[0]):(t.issues.push({code:"invalid_union",input:t.value,inst:r,errors:e.map(o=>o.issues.map(i=>zd(i,n,us())))}),t)}function lvt(e,t,r,n){let a=e.filter(o=>o.issues.length===0);return a.length===1?(t.value=a[0].value,t):(a.length===0?t.issues.push({code:"invalid_union",input:t.value,inst:r,errors:e.map(o=>o.issues.map(i=>zd(i,n,us())))}):t.issues.push({code:"invalid_union",input:t.value,inst:r,errors:[],inclusive:!1}),t)}function FOe(e,t){if(e===t)return{valid:!0,data:e};if(e instanceof Date&&t instanceof Date&&+e==+t)return{valid:!0,data:e};if(ax(e)&&ax(t)){let r=Object.keys(t),n=Object.keys(e).filter(o=>r.indexOf(o)!==-1),a={...e,...t};for(let o of n){let i=FOe(e[o],t[o]);if(!i.valid)return{valid:!1,mergeErrorPath:[o,...i.mergeErrorPath]};a[o]=i.data}return{valid:!0,data:a}}if(Array.isArray(e)&&Array.isArray(t)){if(e.length!==t.length)return{valid:!1,mergeErrorPath:[]};let r=[];for(let n=0;n<e.length;n++){let a=e[n],o=t[n],i=FOe(a,o);if(!i.valid)return{valid:!1,mergeErrorPath:[n,...i.mergeErrorPath]};r.push(i.data)}return{valid:!0,data:r}}return{valid:!1,mergeErrorPath:[]}}function uvt(e,t,r){let n=new Map,a;for(let s of t.issues)if(s.code==="unrecognized_keys"){a??(a=s);for(let c of s.keys)n.has(c)||n.set(c,{}),n.get(c).l=!0}else e.issues.push(s);for(let s of r.issues)if(s.code==="unrecognized_keys")for(let c of s.keys)n.has(c)||n.set(c,{}),n.get(c).r=!0;else e.issues.push(s);let o=[...n].filter(([,s])=>s.l&&s.r).map(([s])=>s);if(o.length&&a&&e.issues.push({...a,keys:o}),ox(e))return e;let i=FOe(t.value,r.value);if(!i.valid)throw new Error(`Unmergable intersection. Error path: ${JSON.stringify(i.mergeErrorPath)}`);return e.value=i.data,e}function dvt(e,t){for(let r=e.length-1;r>=0;r--)if(e[r]._zod[t]!=="optional")return r+1;return 0}function pvt(e,t,r){e.issues.length&&t.issues.push(...bm(r,e.issues)),t.value[r]=e.value}function mvt(e,t,r,n,a){for(let o=0;o<r.length;o++){let i=e[o],s=o<n.length;if(i.issues.length){if(!s&&o>=a){t.value.length=o;break}t.issues.push(...bm(o,i.issues))}t.value[o]=i.value}for(let o=t.value.length-1;o>=n.length&&(r[o]._zod.optout==="optional"&&t.value[o]===void 0);o--)t.value.length=o;return t}function fvt(e,t,r,n,a,o,i){e.issues.length&&(N6.has(typeof n)?r.issues.push(...bm(n,e.issues)):r.issues.push({code:"invalid_key",origin:"map",input:a,inst:o,issues:e.issues.map(s=>zd(s,i,us()))})),t.issues.length&&(N6.has(typeof n)?r.issues.push(...bm(n,t.issues)):r.issues.push({origin:"map",code:"invalid_element",input:a,inst:o,key:n,issues:t.issues.map(s=>zd(s,i,us()))})),r.value.set(e.value,t.value)}function hvt(e,t){e.issues.length&&t.issues.push(...e.issues),t.value.add(e.value)}function gvt(e,t){return t===void 0&&(e.issues.length||e.fallback)?{issues:[],value:void 0}:e}function yvt(e,t){return e.value===void 0&&(e.value=t.defaultValue),e}function vvt(e,t){return!e.issues.length&&e.value===void 0&&e.issues.push({code:"invalid_type",expected:"nonoptional",input:e.value,inst:t}),e}function pse(e,t,r){return e.issues.length?(e.aborted=!0,e):t._zod.run({value:e.value,issues:e.issues,fallback:e.fallback},r)}function mse(e,t,r){if(e.issues.length)return e.aborted=!0,e;if((r.direction||"forward")==="forward"){let a=t.transform(e.value,e);return a instanceof Promise?a.then(o=>fse(e,o,t.out,r)):fse(e,a,t.out,r)}else{let a=t.reverseTransform(e.value,e);return a instanceof Promise?a.then(o=>fse(e,o,t.in,r)):fse(e,a,t.in,r)}}function fse(e,t,r,n){return e.issues.length?(e.aborted=!0,e):r._zod.run({value:t,issues:e.issues},n)}function Svt(e){return e.value=Object.freeze(e.value),e}function bvt(e,t,r,n){if(!e){let a={code:"custom",input:r,inst:n,path:[...n._zod.def.path??[]],continue:!n._zod.def.abort};n._zod.def.params&&(a.params=n._zod.def.params),t.issues.push(gF(a))}}var Br,sP,ho,jOe,BOe,UOe,GOe,VOe,WOe,zOe,HOe,KOe,qOe,YOe,JOe,ZOe,XOe,QOe,eDe,tDe,rDe,nDe,aDe,iDe,sDe,cDe,lDe,uDe,gse,dDe,V6,yse,pDe,mDe,fDe,hDe,gDe,yDe,vDe,SDe,bDe,EDe,Tvt,ADe,W6,wDe,CDe,TDe,vse,xDe,kDe,IDe,RDe,_De,PDe,ODe,Sse,DDe,NDe,$De,MDe,LDe,FDe,jDe,BDe,bse,z6,UDe,GDe,VDe,WDe,zDe,HDe,KDe,qDe=w(()=>{dse();aP();$Oe();UPe();cse();Zt();LOe();Zt();Br=pe("$ZodType",(e,t)=>{var r;e??(e={}),e._zod.def=t,e._zod.bag=e._zod.bag||{},e._zod.version=MOe;let n=[...e._zod.def.checks??[]];e._zod.traits.has("$ZodCheck")&&n.unshift(e);for(let a of n)for(let o of a._zod.onattach)o(e);if(n.length===0)(r=e._zod).deferred??(r.deferred=[]),e._zod.deferred?.push(()=>{e._zod.run=e._zod.parse});else{let a=(i,s,c)=>{let l=ox(i),u;for(let d of s){if(d._zod.def.when){if($Pe(i)||!d._zod.def.when(i))continue}else if(l)continue;let p=i.issues.length,m=d._zod.check(i);if(m instanceof Promise&&c?.async===!1)throw new mv;if(u||m instanceof Promise)u=(u??Promise.resolve()).then(async()=>{await m,i.issues.length!==p&&(l||(l=ox(i,p)))});else{if(i.issues.length===p)continue;l||(l=ox(i,p))}}return u?u.then(()=>i):i},o=(i,s,c)=>{if(ox(i))return i.aborted=!0,i;let l=a(s,n,c);if(l instanceof Promise){if(c.async===!1)throw new mv;return l.then(u=>e._zod.parse(u,c))}return e._zod.parse(l,c)};e._zod.run=(i,s)=>{if(s.skipChecks)return e._zod.parse(i,s);if(s.direction==="backward"){let l=e._zod.parse({value:i.value,issues:[]},{...s,skipChecks:!0});return l instanceof Promise?l.then(u=>o(u,i,s)):o(l,i,s)}let c=e._zod.parse(i,s);if(c instanceof Promise){if(s.async===!1)throw new mv;return c.then(l=>a(l,n,s))}return a(c,n,s)}}wn(e,"~standard",()=>({validate:a=>{try{let o=jPe(e,a);return o.success?{value:o.data}:{issues:o.error?.issues}}catch{return BPe(e,a).then(i=>i.success?{value:i.data}:{issues:i.error?.issues})}},vendor:"zod",version:1}))}),sP=pe("$ZodString",(e,t)=>{Br.init(e,t),e._zod.pattern=[...e?._zod.bag?.patterns??[]].pop()??lOe(e._zod.bag),e._zod.parse=(r,n)=>{if(t.coerce)try{r.value=String(r.value)}catch{}return typeof r.value=="string"||r.issues.push({expected:"string",code:"invalid_type",input:r.value,inst:e}),r}}),ho=pe("$ZodStringFormat",(e,t)=>{EF.init(e,t),sP.init(e,t)}),jOe=pe("$ZodGUID",(e,t)=>{t.pattern??(t.pattern=YPe),ho.init(e,t)}),BOe=pe("$ZodUUID",(e,t)=>{if(t.version){let n={v1:1,v2:2,v3:3,v4:4,v5:5,v6:6,v7:7,v8:8}[t.version];if(n===void 0)throw new Error(`Invalid UUID version: "${t.version}"`);t.pattern??(t.pattern=iP(n))}else t.pattern??(t.pattern=iP());ho.init(e,t)}),UOe=pe("$ZodEmail",(e,t)=>{t.pattern??(t.pattern=JPe),ho.init(e,t)}),GOe=pe("$ZodURL",(e,t)=>{ho.init(e,t),e._zod.check=r=>{try{let n=r.value.trim();if(!t.normalize&&t.protocol?.source===aOe.source&&!/^https?:\/\//i.test(n)){r.issues.push({code:"invalid_format",format:"url",note:"Invalid URL format",input:r.value,inst:e,continue:!t.abort});return}let a=new URL(n);t.hostname&&(t.hostname.lastIndex=0,t.hostname.test(a.hostname)||r.issues.push({code:"invalid_format",format:"url",note:"Invalid hostname",pattern:t.hostname.source,input:r.value,inst:e,continue:!t.abort})),t.protocol&&(t.protocol.lastIndex=0,t.protocol.test(a.protocol.endsWith(":")?a.protocol.slice(0,-1):a.protocol)||r.issues.push({code:"invalid_format",format:"url",note:"Invalid protocol",pattern:t.protocol.source,input:r.value,inst:e,continue:!t.abort})),t.normalize?r.value=a.href:r.value=n;return}catch{r.issues.push({code:"invalid_format",format:"url",input:r.value,inst:e,continue:!t.abort})}}}),VOe=pe("$ZodEmoji",(e,t)=>{t.pattern??(t.pattern=ZPe()),ho.init(e,t)}),WOe=pe("$ZodNanoID",(e,t)=>{t.pattern??(t.pattern=KPe),ho.init(e,t)}),zOe=pe("$ZodCUID",(e,t)=>{t.pattern??(t.pattern=GPe),ho.init(e,t)}),HOe=pe("$ZodCUID2",(e,t)=>{t.pattern??(t.pattern=VPe),ho.init(e,t)}),KOe=pe("$ZodULID",(e,t)=>{t.pattern??(t.pattern=WPe),ho.init(e,t)}),qOe=pe("$ZodXID",(e,t)=>{t.pattern??(t.pattern=zPe),ho.init(e,t)}),YOe=pe("$ZodKSUID",(e,t)=>{t.pattern??(t.pattern=HPe),ho.init(e,t)}),JOe=pe("$ZodISODateTime",(e,t)=>{t.pattern??(t.pattern=cOe(t)),ho.init(e,t)}),ZOe=pe("$ZodISODate",(e,t)=>{t.pattern??(t.pattern=iOe),ho.init(e,t)}),XOe=pe("$ZodISOTime",(e,t)=>{t.pattern??(t.pattern=sOe(t)),ho.init(e,t)}),QOe=pe("$ZodISODuration",(e,t)=>{t.pattern??(t.pattern=qPe),ho.init(e,t)}),eDe=pe("$ZodIPv4",(e,t)=>{t.pattern??(t.pattern=XPe),ho.init(e,t),e._zod.bag.format="ipv4"}),tDe=pe("$ZodIPv6",(e,t)=>{t.pattern??(t.pattern=QPe),ho.init(e,t),e._zod.bag.format="ipv6",e._zod.check=r=>{try{new URL(`http://[${r.value}]`)}catch{r.issues.push({code:"invalid_format",format:"ipv6",input:r.value,inst:e,continue:!t.abort})}}}),rDe=pe("$ZodMAC",(e,t)=>{t.pattern??(t.pattern=eOe(t.delimiter)),ho.init(e,t),e._zod.bag.format="mac"}),nDe=pe("$ZodCIDRv4",(e,t)=>{t.pattern??(t.pattern=tOe),ho.init(e,t)}),aDe=pe("$ZodCIDRv6",(e,t)=>{t.pattern??(t.pattern=rOe),ho.init(e,t),e._zod.check=r=>{let n=r.value.split("/");try{if(n.length!==2)throw new Error;let[a,o]=n;if(!o)throw new Error;let i=Number(o);if(`${i}`!==o)throw new Error;if(i<0||i>128)throw new Error;new URL(`http://[${a}]`)}catch{r.issues.push({code:"invalid_format",format:"cidrv6",input:r.value,inst:e,continue:!t.abort})}}});iDe=pe("$ZodBase64",(e,t)=>{t.pattern??(t.pattern=nOe),ho.init(e,t),e._zod.bag.contentEncoding="base64",e._zod.check=r=>{oDe(r.value)||r.issues.push({code:"invalid_format",format:"base64",input:r.value,inst:e,continue:!t.abort})}});sDe=pe("$ZodBase64URL",(e,t)=>{t.pattern??(t.pattern=ise),ho.init(e,t),e._zod.bag.contentEncoding="base64url",e._zod.check=r=>{Evt(r.value)||r.issues.push({code:"invalid_format",format:"base64url",input:r.value,inst:e,continue:!t.abort})}}),cDe=pe("$ZodE164",(e,t)=>{t.pattern??(t.pattern=oOe),ho.init(e,t)});lDe=pe("$ZodJWT",(e,t)=>{ho.init(e,t),e._zod.check=r=>{Avt(r.value,t.alg)||r.issues.push({code:"invalid_format",format:"jwt",input:r.value,inst:e,continue:!t.abort})}}),uDe=pe("$ZodCustomStringFormat",(e,t)=>{ho.init(e,t),e._zod.check=r=>{t.fn(r.value)||r.issues.push({code:"invalid_format",format:t.format,input:r.value,inst:e,continue:!t.abort})}}),gse=pe("$ZodNumber",(e,t)=>{Br.init(e,t),e._zod.pattern=e._zod.bag.pattern??sse,e._zod.parse=(r,n)=>{if(t.coerce)try{r.value=Number(r.value)}catch{}let a=r.value;if(typeof a=="number"&&!Number.isNaN(a)&&Number.isFinite(a))return r;let o=typeof a=="number"?Number.isNaN(a)?"NaN":Number.isFinite(a)?void 0:"Infinity":void 0;return r.issues.push({expected:"number",code:"invalid_type",input:a,inst:e,...o?{received:o}:{}}),r}}),dDe=pe("$ZodNumberFormat",(e,t)=>{vOe.init(e,t),gse.init(e,t)}),V6=pe("$ZodBoolean",(e,t)=>{Br.init(e,t),e._zod.pattern=pOe,e._zod.parse=(r,n)=>{if(t.coerce)try{r.value=!!r.value}catch{}let a=r.value;return typeof a=="boolean"||r.issues.push({expected:"boolean",code:"invalid_type",input:a,inst:e}),r}}),yse=pe("$ZodBigInt",(e,t)=>{Br.init(e,t),e._zod.pattern=uOe,e._zod.parse=(r,n)=>{if(t.coerce)try{r.value=BigInt(r.value)}catch{}return typeof r.value=="bigint"||r.issues.push({expected:"bigint",code:"invalid_type",input:r.value,inst:e}),r}}),pDe=pe("$ZodBigIntFormat",(e,t)=>{SOe.init(e,t),yse.init(e,t)}),mDe=pe("$ZodSymbol",(e,t)=>{Br.init(e,t),e._zod.parse=(r,n)=>{let a=r.value;return typeof a=="symbol"||r.issues.push({expected:"symbol",code:"invalid_type",input:a,inst:e}),r}}),fDe=pe("$ZodUndefined",(e,t)=>{Br.init(e,t),e._zod.pattern=fOe,e._zod.values=new Set([void 0]),e._zod.parse=(r,n)=>{let a=r.value;return typeof a>"u"||r.issues.push({expected:"undefined",code:"invalid_type",input:a,inst:e}),r}}),hDe=pe("$ZodNull",(e,t)=>{Br.init(e,t),e._zod.pattern=mOe,e._zod.values=new Set([null]),e._zod.parse=(r,n)=>{let a=r.value;return a===null||r.issues.push({expected:"null",code:"invalid_type",input:a,inst:e}),r}}),gDe=pe("$ZodAny",(e,t)=>{Br.init(e,t),e._zod.parse=r=>r}),yDe=pe("$ZodUnknown",(e,t)=>{Br.init(e,t),e._zod.parse=r=>r}),vDe=pe("$ZodNever",(e,t)=>{Br.init(e,t),e._zod.parse=(r,n)=>(r.issues.push({expected:"never",code:"invalid_type",input:r.value,inst:e}),r)}),SDe=pe("$ZodVoid",(e,t)=>{Br.init(e,t),e._zod.parse=(r,n)=>{let a=r.value;return typeof a>"u"||r.issues.push({expected:"void",code:"invalid_type",input:a,inst:e}),r}}),bDe=pe("$ZodDate",(e,t)=>{Br.init(e,t),e._zod.parse=(r,n)=>{if(t.coerce)try{r.value=new Date(r.value)}catch{}let a=r.value,o=a instanceof Date;return o&&!Number.isNaN(a.getTime())||r.issues.push({expected:"date",code:"invalid_type",input:a,...o?{received:"Invalid Date"}:{},inst:e}),r}});EDe=pe("$ZodArray",(e,t)=>{Br.init(e,t),e._zod.parse=(r,n)=>{let a=r.value;if(!Array.isArray(a))return r.issues.push({expected:"array",code:"invalid_type",input:a,inst:e}),r;r.value=Array(a.length);let o=[];for(let i=0;i<a.length;i++){let s=a[i],c=t.element._zod.run({value:s,issues:[]},n);c instanceof Promise?o.push(c.then(l=>svt(l,r,i))):svt(c,r,i)}return o.length?Promise.all(o).then(()=>r):r}});Tvt=pe("$ZodObject",(e,t)=>{if(Br.init(e,t),!Object.getOwnPropertyDescriptor(t,"shape")?.get){let s=t.shape;Object.defineProperty(t,"shape",{get:()=>{let c={...s};return Object.defineProperty(t,"shape",{value:c}),c}})}let n=hF(()=>wvt(t));wn(e._zod,"propValues",()=>{let s=t.shape,c={};for(let l in s){let u=s[l]._zod;if(u.values){c[l]??(c[l]=new Set);for(let d of u.values)c[l].add(d)}}return c});let a=oP,o=t.catchall,i;e._zod.parse=(s,c)=>{i??(i=n.value);let l=s.value;if(!a(l))return s.issues.push({expected:"object",code:"invalid_type",input:l,inst:e}),s;s.value={};let u=[],d=i.shape;for(let p of i.keys){let m=d[p],f=m._zod.optin==="optional",y=m._zod.optout==="optional",v=m._zod.run({value:l[p],issues:[]},c);v instanceof Promise?u.push(v.then(S=>hse(S,s,p,l,f,y))):hse(v,s,p,l,f,y)}return o?Cvt(u,l,s,c,n.value,e):u.length?Promise.all(u).then(()=>s):s}}),ADe=pe("$ZodObjectJIT",(e,t)=>{Tvt.init(e,t);let r=e._zod.parse,n=hF(()=>wvt(t)),a=p=>{let m=new G6(["shape","payload","ctx"]),f=n.value,y=C=>{let T=qie(C);return`shape[${T}]._zod.run({ value: input[${T}], issues: [] }, ctx)`};m.write("const input = payload.value;");let v=Object.create(null),S=0;for(let C of f.keys)v[C]=`key_${S++}`;m.write("const newResult = {};");for(let C of f.keys){let T=v[C],x=qie(C),R=p[C],I=R?._zod?.optin==="optional",D=R?._zod?.optout==="optional";m.write(`const ${T} = ${y(C)};`),I&&D?m.write(`
@@ -202,7 +202,7 @@ ${d}\r
 `)}d.push(null)}),d}async function E$r(e,t){let r=0,n=[],a=e.getReader(),o=!1;for(;!o;){let{done:c,value:l}=await a.read();if(l&&(n.push(l),r+=l?.byteLength??0),r>=t)break;o=c}a.releaseLock();let i=new Uint8Array(Math.min(t,r)),s=0;for(let c of n){if(c.byteLength>i.byteLength-s){i.set(c.subarray(0,i.byteLength-s),s);break}else i.set(c,s);s+=c.length}return i}var A$r=(e,t)=>Bb(e)?E$r(e,t):new Promise((r,n)=>{let a=new w$r;a.limit=t,e.pipe(a),e.on("error",o=>{a.end(),n(o)}),a.on("error",n),a.on("finish",function(){let o=Tde(this.buffers);r(o)})}),w$r=class extends Mxt{buffers=[];limit=1/0;bytesBuffered=0;_write(t,r,n){if(this.buffers.push(t),this.bytesBuffered+=t.byteLength??0,this.bytesBuffered>=this.limit){let a=this.bytesBuffered-this.limit,o=this.buffers[this.buffers.length-1];this.buffers[this.buffers.length-1]=o.subarray(0,o.byteLength-a),this.emit("finish")}n()}},C$r=e=>{if(typeof e=="string")return e;if(typeof e!="object"||typeof e.byteOffset!="number"||typeof e.byteLength!="number")throw new Error("@smithy/util-utf8: toUtf8 encoder function only accepts string | Uint8Array.");return new TextDecoder("utf-8").decode(e)},T$r=async e=>xde(e)?okt(e):ikt(e);async function okt(e){return e.arrayBuffer().then(t=>new Uint8Array(t))}async function ikt(e){let t=[],r=e.getReader(),n=0;for(;;){let{done:a,value:o}=await r.read();if(o&&(t.push(o),n+=o.length),a)break}return Tde(t,n)}var Dxt="The stream has already been transformed.",x$r=e=>{if(!Nxt(e)&&!Bb(e)){let a=e?.__proto__?.constructor?.name||e;throw new Error(`Unexpected stream implementation, expect Blob or ReadableStream, got ${a}`)}let t=!1,r=async()=>{if(t)throw new Error(Dxt);return t=!0,await T$r(e)},n=a=>{if(typeof a.stream!="function")throw new Error(`Cannot transform payload Blob to web stream. Please make sure the Blob.stream() is polyfilled.
 If you are using React Native, this API is not yet supported, see: https://react-native.canny.io/feature-requests/p/fetch-streaming-body`);return a.stream()};return Object.assign(e,{transformToByteArray:r,transformToString:async a=>{let o=await r();if(a==="base64")return rkt(o);if(a==="hex")return qxt(o);if(a===void 0||a==="utf8"||a==="utf-8")return C$r(o);if(typeof TextDecoder=="function")return new TextDecoder(a).decode(o);throw new Error("TextDecoder is not available, please make sure polyfill is provided.")},transformToWebStream:()=>{if(t)throw new Error(Dxt);if(t=!0,Nxt(e))return n(e);if(Bb(e))return e;throw new Error(`Cannot transform payload to web stream, got ${e}`)}})},Nxt=e=>typeof Blob=="function"&&e instanceof Blob,skt=e=>xde(e)?okt(e):Bb(e)?ikt(e):new Promise((t,r)=>{let n=new Vje,a=e;a.pipe(n),a.on("error",o=>{n.end(),r(o)}),n.on("error",r),n.on("finish",function(){let o=Tde(this.bufferedBytes);t(o)})}),Vje=class extends Mxt{bufferedBytes=[];_write(t,r,n){this.bufferedBytes.push(t),n()}},$xt="The stream has already been transformed.",k$r=e=>{if(!(e instanceof Vj))try{return x$r(e)}catch{let a=e?.__proto__?.constructor?.name||e;throw new Error(`Unexpected stream implementation, expect Stream.Readable instance, got ${a}`)}let t=!1,r=async()=>{if(t)throw new Error($xt);return t=!0,await skt(e)};return Object.assign(e,{transformToByteArray:r,transformToString:async n=>{let a=await r();return n===void 0||Buffer.isEncoding(n)?zj(a.buffer,a.byteOffset,a.byteLength).toString(n):new TextDecoder(n).decode(a)},transformToWebStream:()=>{if(t)throw new Error($xt);if(e.readableFlowing!==null)throw new Error("The stream has been consumed by other callbacks.");if(typeof Vj.toWeb!="function")throw new Error("Readable.toWeb() is not supported. Please ensure a polyfill is available.");return t=!0,Vj.toWeb(e)}})};async function I$r(e){return typeof e.stream=="function"&&(e=e.stream()),e.tee()}async function R$r(e){if(Bb(e)||xde(e))return I$r(e);let t=new Rxt,r=new Rxt;return e.pipe(t),e.pipe(r),[t,r]}var Wje=class extends m1r(jxt,Cde,zje,Fxt){},_$r=i1r,ckt=f1r(_$r),P$r=ckt;It.ChecksumStream=ekt;It.Hash=Uje;It.LazyJsonString=cO;It.NumericValue=Ade;It.Uint8ArrayBlobAdapter=Wje;It._parseEpochTimestamp=r$r;It._parseRfc3339DateTimeWithOffset=n$r;It._parseRfc7231DateTime=a$r;It.calculateBodyLength=l$r;It.concatBytes=Tde;It.copyDocumentWithTransform=h1r;It.createBufferedReadable=v$r;It.createChecksumStream=g$r;It.dateToUtcString=O1r;It.deserializerMiddleware=Jxt;It.deserializerMiddlewareOption=Xxt;It.expectBoolean=y1r;It.expectByte=jje;It.expectFloat32=bde;It.expectInt=S1r;It.expectInt32=Lje;It.expectLong=r5;It.expectNonNull=E1r;It.expectNumber=t5;It.expectObject=Bxt;It.expectShort=Fje;It.expectString=A1r;It.expectUnion=w1r;It.fromArrayBuffer=zj;It.fromBase64=Fxt;It.fromHex=c$r;It.fromString=wde;It.fromUtf8=Cde;It.generateIdempotencyToken=P$r;It.getAwsChunkedEncodingStream=b$r;It.getSerdePlugin=u$r;It.handleFloat=x1r;It.headStream=A$r;It.isArrayBuffer=Lxt;It.isBlob=xde;It.isReadableStream=Bb;It.limitedParseDouble=qje;It.limitedParseFloat=k1r;It.limitedParseFloat32=I1r;It.logger=n5;It.nv=s$r;It.parseBoolean=g1r;It.parseEpochTimestamp=U1r;It.parseRfc3339DateTime=N1r;It.parseRfc3339DateTimeWithOffset=M1r;It.parseRfc7231DateTime=B1r;It.quoteHeader=J1r;It.sdkStreamMixin=k$r;It.serializerMiddleware=Zxt;It.serializerMiddlewareOption=Qxt;It.splitEvery=o$r;It.splitHeader=i$r;It.splitStream=R$r;It.streamCollector=skt;It.strictParseByte=Wxt;It.strictParseDouble=Kje;It.strictParseFloat=C1r;It.strictParseFloat32=Uxt;It.strictParseInt=R1r;It.strictParseInt32=_1r;It.strictParseLong=Vxt;It.strictParseShort=Hj;It.toBase64=zje;It.toHex=qxt;It.toUint8Array=Yxt;It.toUtf8=jxt;It.v4=ckt});var Skt=Se(np=>{var{createReadStream:O$r}=zt("node:fs"),{Writable:D$r}=zt("node:stream"),{toUint8Array:Yj,concatBytes:N$r}=kde(),{createHash:o5,createHmac:$$r}=zt("node:crypto"),lkt=zt("node:zlib");async function fkt(e,t,r=1024*1024){let n=e.size,a=0;for(;a<n;){let o=e.slice(a,Math.min(n,a+r));t(new Uint8Array(await o.arrayBuffer())),a+=o.size}}var M$r=async function(t,r){let n=new t;return await fkt(r,a=>{n.update(a)}),n.digest()},Rde=class extends D$r{hash;constructor(t,r){super(r),this.hash=t}_write(t,r,n){try{this.hash.update(Yj(t))}catch(a){return n(a)}n()}},L$r=(e,t)=>new Promise((r,n)=>{if(!F$r(t)){n(new Error("Unable to calculate hash for non-file streams."));return}let a=O$r(t.path,{start:t.start,end:t.end}),o=new e,i=new Rde(o);a.pipe(i),a.on("error",s=>{i.end(),n(s)}),i.on("error",n),i.on("finish",function(){o.digest().then(r).catch(n)})}),F$r=e=>typeof e.path=="string",j$r=(e,t)=>{if(t.readableFlowing!==null)throw new Error("Unable to calculate hash for flowing readable stream");let r=new e,n=new Rde(r);return t.pipe(n),new Promise((a,o)=>{t.on("error",i=>{n.end(),o(i)}),n.on("error",o),n.on("finish",()=>{r.digest().then(a).catch(o)})})},_de=class{digestLength=16;state=Uint32Array.from(ukt);writeBuffer=new DataView(new ArrayBuffer(64));bufferLength=0;bytesHashed=0;update(t){let r=Yj(t),n=0,a=r.byteLength;for(this.bytesHashed+=a;a>0;)this.writeBuffer.setUint8(this.bufferLength++,r[n++]),--a,this.bufferLength===64&&(Qje(this.state,this.writeBuffer),this.bufferLength=0)}async digest(){let t=Uint32Array.from(this.state),r=new DataView(this.writeBuffer.buffer.slice(0)),n=this.bufferLength,a=this.bytesHashed*8;if(r.setUint8(n++,128),this.bufferLength%64>=56){for(let s=n;s<64;++s)r.setUint8(s,0);Qje(t,r),n=0}for(let s=n;s<56;++s)r.setUint8(s,0);r.setUint32(56,a>>>0,!0),r.setUint32(60,Math.floor(a/2**32),!0),Qje(t,r);let o=new Uint8Array(16),i=new DataView(o.buffer);for(let s=0;s<4;++s)i.setUint32(s*4,t[s],!0);return o}reset(){this.state.set(ukt),this.writeBuffer=new DataView(new ArrayBuffer(64)),this.bufferLength=0,this.bytesHashed=0}},ukt=[1732584193,4023233417,2562383102,271733878],jx=4294967295,B$r=Uint8Array.of(7,12,17,22,5,9,14,20,4,11,16,23,6,10,15,21),U$r=Array.from({length:64},(e,t)=>Math.abs(Math.sin(t+1))*2**32>>>0);function Qje(e,t){let r=e[0],n=e[1],a=e[2],o=e[3];for(let i=0;i<64;++i){let s,c;i<16?(s=n&a|~n&o,c=i):i<32?(s=o&n|a&~o,c=(5*i+1)%16):i<48?(s=n^a^o,c=(3*i+5)%16):(s=a^(n|~o),c=7*i%16);let l=t.getUint32(c*4,!0),u=o;o=a,a=n;let d=B$r[(i>>4)*4+(i&3)],p=(r+s&jx)+(l+U$r[i]&jx)&jx;n=n+((p<<d|p>>>32-d)>>>0)&jx,r=u}e[0]=e[0]+r&jx,e[1]=e[1]+n&jx,e[2]=e[2]+a&jx,e[3]=e[3]+o&jx}var G$r=(()=>{try{return o5("md5"),!0}catch{return!1}})(),hkt=G$r?V$r():_de;function V$r(){return class{digestLength=16;hash=o5("md5");update(t){this.hash.update(Yj(t))}async digest(){let t=this.hash.copy().digest();return new Uint8Array(t.buffer,t.byteOffset,t.byteLength)}reset(){this.hash=o5("md5")}}}var gkt=new Uint32Array(256);for(let e=0;e<256;++e){let t=e;for(let r=0;r<8;++r)t=t&1?3988292384^t>>>1:t>>>1;gkt[e]=t>>>0}var e2e=4294967295,Pde=class{digestLength=4;checksum=e2e;update(t){for(let r=0;r<t.length;++r)this.checksum=this.checksum>>>8^gkt[(this.checksum^t[r])&255]}digestSync(){return(this.checksum^e2e)>>>0}async digest(){let t=this.digestSync(),r=new Uint8Array(4);return new DataView(r.buffer).setUint32(0,t,!1),r}reset(){this.checksum=e2e}},dkt=typeof lkt.crc32=="function"?lkt.crc32:void 0,ykt=dkt?W$r(dkt):Pde;function W$r(e){return class{digestLength=4;value=0;update(r){this.value=e(r,this.value)}digestSync(){return this.value>>>0}async digest(){let r=new Uint8Array(4);return new DataView(r.buffer).setUint32(0,this.digestSync(),!1),r}reset(){this.value=0}}}var cu=64,pkt=32,z$r=2**53-1,Jj=class e{digestLength=pkt;state=Int32Array.from(mkt);w;buffer=new Uint8Array(64);bufferLength=0;bytesHashed=0;finished=!1;inner;outer;constructor(t){if(t){let r=e.normalizeKey(t);this.inner=new e,this.outer=new e;let{inner:n,outer:a}=this,o=new Uint8Array(cu*2);for(let i=0;i<cu;++i)o[i]=54^r[i],o[i+cu]=92^r[i];n.update(o.subarray(0,cu)),a.update(o.subarray(cu))}}update(t){if(this.finished)throw new Error("Attempted to update an already finished HMAC.");if(this.inner){this.inner.update(t);return}let r=Yj(t),n=0,{byteLength:a}=r;if(this.bytesHashed+=a,this.bytesHashed*8>z$r)throw new Error("Cannot hash more than 2^53 - 1 bits");for(;a>0;)this.buffer[this.bufferLength++]=r[n++],a--,this.bufferLength===cu&&(this.hashBuffer(),this.bufferLength=0)}async digest(){let{inner:t,outer:r}=this;if(t&&r){if(this.finished)throw new Error("Attempted to digest an already finished HMAC.");this.finished=!0;let n=t.digestSync();return r.update(n),r.digestSync()}return this.digestSync()}reset(){this.state=Int32Array.from(mkt),this.buffer=new Uint8Array(64),this.bufferLength=0,this.bytesHashed=0}digestSync(){let t=this.state.slice(),r=this.buffer.slice(),n=this.bufferLength,a=this.bytesHashed*8,o=new DataView(r.buffer,r.byteOffset,r.byteLength);if(o.setUint8(n++,128),(n-1)%cu>=cu-8){for(let s=n;s<cu;++s)o.setUint8(s,0);this.hashBufferWith(t,r),n=0}for(let s=n;s<cu-8;++s)o.setUint8(s,0);o.setUint32(cu-8,Math.floor(a/4294967296),!1),o.setUint32(cu-4,a,!1),this.hashBufferWith(t,r);let i=new Uint8Array(pkt);for(let s=0;s<8;++s)i[s*4]=t[s]>>>24&255,i[s*4+1]=t[s]>>>16&255,i[s*4+2]=t[s]>>>8&255,i[s*4+3]=t[s]>>>0&255;return i}static normalizeKey(t){let r=Yj(t);if(r.byteLength>cu){let n=new e;n.update(r);let a=n.digestSync(),o=new Uint8Array(cu);return o.set(a),o}if(r.byteLength<cu){let n=new Uint8Array(cu);return n.set(r),n}return r}hashBuffer(){this.hashBufferWith(this.state,this.buffer)}hashBufferWith(t,r){let n=this.w??=new Int32Array(64),a=t[0],o=t[1],i=t[2],s=t[3],c=t[4],l=t[5],u=t[6],d=t[7];for(let p=0;p<cu;++p){if(p<16)n[p]=(r[p*4]&255)<<24|(r[p*4+1]&255)<<16|(r[p*4+2]&255)<<8|r[p*4+3]&255;else{let y=n[p-2],v=(y>>>17|y<<15)^(y>>>19|y<<13)^y>>>10;y=n[p-15];let S=(y>>>7|y<<25)^(y>>>18|y<<14)^y>>>3;n[p]=(v+n[p-7]|0)+(S+n[p-16]|0)}let m=(((c>>>6|c<<26)^(c>>>11|c<<21)^(c>>>25|c<<7))+(c&l^~c&u)|0)+(d+(H$r[p]+n[p]|0)|0)|0,f=((a>>>2|a<<30)^(a>>>13|a<<19)^(a>>>22|a<<10))+(a&o^a&i^o&i)|0;d=u,u=l,l=c,c=s+m|0,s=i,i=o,o=a,a=m+f|0}t[0]+=a,t[1]+=o,t[2]+=i,t[3]+=s,t[4]+=c,t[5]+=l,t[6]+=u,t[7]+=d}},mkt=new Int32Array([1779033703,3144134277,1013904242,2773480762,1359893119,2600822924,528734635,1541459225]),H$r=new Int32Array([1116352408,1899447441,3049323471,3921009573,961987163,1508970993,2453635748,2870763221,3624381080,310598401,607225278,1426881987,1925078388,2162078206,2614888103,3248222580,3835390401,4022224774,264347078,604807628,770255983,1249150122,1555081692,1996064986,2554220882,2821834349,2952996808,3210313671,3336571891,3584528711,113926993,338241895,666307205,773529912,1294757372,1396182291,1695183700,1986661051,2177026350,2456956037,2730485921,2820302411,3259730800,3345764771,3516065817,3600352804,4094571909,275423344,430227734,506948616,659060556,883997877,958139571,1322822218,1537002063,1747873779,1955562222,2024104815,2227730452,2361852424,2428436474,2756734187,3204031479,3329325298]),K$r=(()=>{try{return o5("sha256"),!0}catch{return!1}})(),vkt=K$r?q$r():Jj;function q$r(){return class{digestLength=32;secret;hash;isHmac;finished=!1;constructor(t){this.secret=t,this.isHmac=!!t,this.hash=this.createHash()}update(t){if(this.finished)throw new Error("Attempted to update an already finished hash.");this.hash.update(t)}async digest(){let t;return this.isHmac?(this.finished=!0,t=this.hash.digest()):t=this.hash.copy().digest(),new Uint8Array(t.buffer,t.byteOffset,t.byteLength)}reset(){this.hash=this.createHash(),this.finished=!1}createHash(){return this.secret?$$r("sha256",Y$r(this.secret)):o5("sha256")}}}function Y$r(e){return typeof e=="string"?e:ArrayBuffer.isView(e)?Buffer.from(e.buffer,e.byteOffset,e.byteLength):Buffer.from(e)}var{digest:J$r,sign:Z$r,importKey:X$r}=globalThis?.crypto?.subtle??{},Ide=typeof J$r=="function"&&typeof Z$r=="function"&&typeof X$r=="function"?globalThis.crypto.subtle:void 0,Q$r=8*1024*1024,t2e=class{digestLength=32;secret;pending=[];pendingBytes=0;fallback;finished=!1;constructor(t){t&&(this.secret=Yj(t))}update(t){if(this.finished)throw new Error("Attempted to update an already finished HMAC.");if(this.fallback){this.fallback.update(t);return}this.pending.push(t.slice()),this.pendingBytes+=t.byteLength,this.pendingBytes>=Q$r&&this.switchToFallback()}async digest(){if(this.fallback)return this.fallback.digest();if(this.secret&&this.finished)throw new Error("Attempted to digest an already finished HMAC.");let t=N$r(this.pending);if(Ide){if(this.secret){this.finished=!0;let a=await Ide.importKey("raw",this.secret,{name:"HMAC",hash:"SHA-256"},!1,["sign"]),o=await Ide.sign("HMAC",a,t);return new Uint8Array(o)}let n=await Ide.digest("SHA-256",t);return new Uint8Array(n)}let r=new Jj(this.secret);return r.update(t),r.digest()}reset(){this.pending=[],this.pendingBytes=0,this.fallback=void 0,this.finished=!1}switchToFallback(){let t=new Jj(this.secret);for(let r of this.pending)t.update(r);this.fallback=t,this.pending=[],this.pendingBytes=0}};np.Crc32=ykt;np.Crc32Js=Pde;np.Crc32Node=ykt;np.Md5=hkt;np.Md5Js=_de;np.Md5Node=hkt;np.Sha256=vkt;np.Sha256Js=Jj;np.Sha256Node=vkt;np.Sha256WebCrypto=t2e;np.blobHasher=M$r;np.blobReader=fkt;np.fileStreamHasher=L$r;np.readableStreamHasher=j$r});var Tkt=Se(Dc=>{var{Crc32:Akt}=Skt(),{toHex:Zj,fromHex:eMr,toUtf8:tMr,fromUtf8:rMr}=kde(),{Readable:nMr}=zt("node:stream"),{TypeRegistry:aMr}=cde(),Xj=class e{bytes;constructor(t){if(this.bytes=t,t.byteLength!==8)throw new Error("Int64 buffers must be exactly 8 bytes")}static fromNumber(t){if(t>9223372036854776e3||t<-9223372036854776e3)throw new Error(`${t} is too large (or, if negative, too small) to represent as an Int64`);let r=new Uint8Array(8);for(let n=7,a=Math.abs(Math.round(t));n>-1&&a>0;n--,a/=256)r[n]=a;return t<0&&bkt(r),new e(r)}valueOf(){let t=this.bytes.slice(0),r=t[0]&128;return r&&bkt(t),parseInt(Zj(t),16)*(r?-1:1)}toString(){return String(this.valueOf())}};function bkt(e){for(let t=0;t<8;t++)e[t]^=255;for(let t=7;t>-1&&(e[t]++,e[t]===0);t--);}var Ode=class{toUtf8;fromUtf8;constructor(t,r){this.toUtf8=t,this.fromUtf8=r}format(t){let r=[];for(let o of Object.keys(t)){let i=this.fromUtf8(o);r.push(Uint8Array.from([i.byteLength]),i,this.formatHeaderValue(t[o]))}let n=new Uint8Array(r.reduce((o,i)=>o+i.byteLength,0)),a=0;for(let o of r)n.set(o,a),a+=o.byteLength;return n}formatHeaderValue(t){switch(t.type){case"boolean":return Uint8Array.from([t.value?fs.boolTrue:fs.boolFalse]);case"byte":return Uint8Array.from([fs.byte,t.value]);case"short":let r=new DataView(new ArrayBuffer(3));return r.setUint8(0,fs.short),r.setInt16(1,t.value,!1),new Uint8Array(r.buffer);case"integer":let n=new DataView(new ArrayBuffer(5));return n.setUint8(0,fs.integer),n.setInt32(1,t.value,!1),new Uint8Array(n.buffer);case"long":let a=new Uint8Array(9);return a[0]=fs.long,a.set(t.value.bytes,1),a;case"binary":let o=new DataView(new ArrayBuffer(3+t.value.byteLength));o.setUint8(0,fs.byteArray),o.setUint16(1,t.value.byteLength,!1);let i=new Uint8Array(o.buffer);return i.set(t.value,3),i;case"string":let s=this.fromUtf8(t.value),c=new DataView(new ArrayBuffer(3+s.byteLength));c.setUint8(0,fs.string),c.setUint16(1,s.byteLength,!1);let l=new Uint8Array(c.buffer);return l.set(s,3),l;case"timestamp":let u=new Uint8Array(9);return u[0]=fs.timestamp,u.set(Xj.fromNumber(t.value.valueOf()).bytes,1),u;case"uuid":if(!mMr.test(t.value))throw new Error(`Invalid UUID received: ${t.value}`);let d=new Uint8Array(17);return d[0]=fs.uuid,d.set(eMr(t.value.replace(/-/g,"")),1),d}}parse(t){let r={},n=0;for(;n<t.byteLength;){let a=t.getUint8(n++),o=this.toUtf8(new Uint8Array(t.buffer,t.byteOffset+n,a));switch(n+=a,t.getUint8(n++)){case fs.boolTrue:r[o]={type:Ekt,value:!0};break;case fs.boolFalse:r[o]={type:Ekt,value:!1};break;case fs.byte:r[o]={type:oMr,value:t.getInt8(n++)};break;case fs.short:r[o]={type:iMr,value:t.getInt16(n,!1)},n+=2;break;case fs.integer:r[o]={type:sMr,value:t.getInt32(n,!1)},n+=4;break;case fs.long:r[o]={type:cMr,value:new Xj(new Uint8Array(t.buffer,t.byteOffset+n,8))},n+=8;break;case fs.byteArray:let i=t.getUint16(n,!1);n+=2,r[o]={type:lMr,value:new Uint8Array(t.buffer,t.byteOffset+n,i)},n+=i;break;case fs.string:let s=t.getUint16(n,!1);n+=2,r[o]={type:uMr,value:this.toUtf8(new Uint8Array(t.buffer,t.byteOffset+n,s))},n+=s;break;case fs.timestamp:r[o]={type:dMr,value:new Date(new Xj(new Uint8Array(t.buffer,t.byteOffset+n,8)).valueOf())},n+=8;break;case fs.uuid:let c=new Uint8Array(t.buffer,t.byteOffset+n,16);n+=16,r[o]={type:pMr,value:`${Zj(c.subarray(0,4))}-${Zj(c.subarray(4,6))}-${Zj(c.subarray(6,8))}-${Zj(c.subarray(8,10))}-${Zj(c.subarray(10))}`};break;default:throw new Error("Unrecognized header type tag")}}return r}},fs;(function(e){e[e.boolTrue=0]="boolTrue",e[e.boolFalse=1]="boolFalse",e[e.byte=2]="byte",e[e.short=3]="short",e[e.integer=4]="integer",e[e.long=5]="long",e[e.byteArray=6]="byteArray",e[e.string=7]="string",e[e.timestamp=8]="timestamp",e[e.uuid=9]="uuid"})(fs||(fs={}));var Ekt="boolean",oMr="byte",iMr="short",sMr="integer",cMr="long",lMr="binary",uMr="string",dMr="timestamp",pMr="uuid",mMr=/^[a-f0-9]{8}-[a-f0-9]{4}-[a-f0-9]{4}-[a-f0-9]{4}-[a-f0-9]{12}$/,wkt=4,Bx=wkt*2,lO=4,fMr=Bx+lO*2;function hMr({byteLength:e,byteOffset:t,buffer:r}){if(e<fMr)throw new Error("Provided message too short to accommodate event stream message overhead");let n=new DataView(r,t,e),a=n.getUint32(0,!1);if(e!==a)throw new Error("Reported message length does not match received message length");let o=n.getUint32(wkt,!1),i=n.getUint32(Bx,!1),s=n.getUint32(e-lO,!1),c=new Akt;if(c.update(new Uint8Array(r,t,Bx)),i!==c.digestSync())throw new Error(`The prelude checksum specified in the message (${i}) does not match the calculated CRC32 checksum (${c.digestSync()})`);if(c.update(new Uint8Array(r,t+Bx,e-(Bx+lO))),s!==c.digestSync())throw new Error(`The message checksum (${c.digestSync()}) did not match the expected value of ${s}`);return{headers:new DataView(r,t+Bx+lO,o),body:new Uint8Array(r,t+Bx+lO+o,a-o-(Bx+lO+lO))}}var Dde=class{headerMarshaller;messageBuffer;isEndOfStream;constructor(t,r){this.headerMarshaller=new Ode(t,r),this.messageBuffer=[],this.isEndOfStream=!1}feed(t){this.messageBuffer.push(this.decode(t))}endOfStream(){this.isEndOfStream=!0}getMessage(){let t=this.messageBuffer.pop(),r=this.isEndOfStream;return{getMessage(){return t},isEndOfStream(){return r}}}getAvailableMessages(){let t=this.messageBuffer;this.messageBuffer=[];let r=this.isEndOfStream;return{getMessages(){return t},isEndOfStream(){return r}}}encode({headers:t,body:r}){let n=this.headerMarshaller.format(t),a=n.byteLength+r.byteLength+16,o=new Uint8Array(a),i=new DataView(o.buffer,o.byteOffset,o.byteLength),s=new Akt;return i.setUint32(0,a,!1),i.setUint32(4,n.byteLength,!1),s.update(o.subarray(0,8)),i.setUint32(8,s.digestSync(),!1),o.set(n,12),o.set(r,n.byteLength+12),s.update(o.subarray(8,a-4)),i.setUint32(a-4,s.digestSync(),!1),o}decode(t){let{headers:r,body:n}=hMr(t);return{headers:this.headerMarshaller.parse(r),body:n}}formatHeaders(t){return this.headerMarshaller.format(t)}},Nde=class{options;constructor(t){this.options=t}[Symbol.asyncIterator](){return this.asyncIterator()}async*asyncIterator(){for await(let t of this.options.inputStream)yield this.options.decoder.decode(t)}},$de=class{options;constructor(t){this.options=t}[Symbol.asyncIterator](){return this.asyncIterator()}async*asyncIterator(){for await(let t of this.options.messageStream)yield this.options.encoder.encode(t);this.options.includeEndFrame&&(yield new Uint8Array(0))}},Mde=class{options;constructor(t){this.options=t}[Symbol.asyncIterator](){return this.asyncIterator()}async*asyncIterator(){for await(let t of this.options.messageStream){let r=await this.options.deserializer(t);r!==void 0&&(yield r)}}},Lde=class{options;constructor(t){this.options=t}[Symbol.asyncIterator](){return this.asyncIterator()}async*asyncIterator(){for await(let t of this.options.inputStream)yield this.options.serializer(t)}};function Ckt(e){let t=0,r=0,n=null,a=null,o=s=>{if(typeof s!="number")throw new Error("Attempted to allocate an event message where size was not a number: "+s);t=s,r=4,n=new Uint8Array(s),new DataView(n.buffer).setUint32(0,s,!1)},i=async function*(){let s=e[Symbol.asyncIterator]();for(;;){let{value:c,done:l}=await s.next();if(l){if(t)if(t===r)yield n;else throw new Error("Truncated event message received.");else return;return}let u=c.length,d=0;for(;d<u;){if(!n){let m=u-d;a||(a=new Uint8Array(4));let f=Math.min(4-r,m);if(a.set(c.slice(d,d+f),r),r+=f,d+=f,r<4)break;o(new DataView(a.buffer).getUint32(0,!1)),a=null}let p=Math.min(t-r,u-d);n.set(c.slice(d,d+p),r),r+=p,d+=p,t&&t===r&&(yield n,n=null,t=0,r=0)}}};return{[Symbol.asyncIterator]:i}}function gMr(e,t){let r=n2e(t.deserializer,t.toUtf8);return{[Symbol.asyncIterator]:async function*(){for await(let n of e){let a=t.eventStreamCodec.decode(n),o=await r(a);o!==void 0&&(yield o)}}}}function n2e(e,t){return async function(r){let{value:n}=r.headers[":message-type"];if(n==="error"){let a=new Error(r.headers[":error-message"].value||"UnknownError");throw a.name=r.headers[":error-code"].value,a}else if(n==="exception"){let a=r.headers[":exception-type"].value,o={[a]:r},i=await e(o);if(i.$unknown){let s=new Error(t(r.body));throw s.name=a,s}throw i[a]}else if(n==="event"){let a={[r.headers[":event-type"].value]:r},o=await e(a);return o.$unknown?void 0:o}else throw Error(`Unrecognizable event type: ${r.headers[":event-type"].value}`)}}var a2e=class{eventStreamCodec;utfEncoder;constructor({utf8Encoder:t,utf8Decoder:r}){this.eventStreamCodec=new Dde(t,r),this.utfEncoder=t}deserialize(t,r){let n=Ckt(t);return new Mde({messageStream:new Nde({inputStream:n,decoder:this.eventStreamCodec}),deserializer:n2e(r,this.utfEncoder)})}serialize(t,r){return new $de({messageStream:new Lde({inputStream:t,serializer:r}),encoder:this.eventStreamCodec,includeEndFrame:!0})}},yMr=e=>new a2e(e),Fde=class{universalMarshaller;constructor({utf8Encoder:t,utf8Decoder:r}){this.universalMarshaller=new a2e({utf8Decoder:r,utf8Encoder:t})}deserialize(t,r){let n=typeof t[Symbol.asyncIterator]=="function"?t:SMr(t);return this.universalMarshaller.deserialize(n,r)}serialize(t,r){return nMr.from(this.universalMarshaller.serialize(t,r))}},vMr=e=>new Fde(e);async function*SMr(e){let t=!1,r=!1,n=new Array;for(e.on("error",a=>{if(t||(t=!0),a)throw a}),e.on("data",a=>{n.push(a)}),e.on("end",()=>{t=!0});!r;){let a=await new Promise(o=>setTimeout(()=>o(n.shift()),0));a&&(yield a),r=t&&n.length===0}}var bMr=e=>({[Symbol.asyncIterator]:async function*(){let t=e.getReader();try{for(;;){let{done:r,value:n}=await t.read();if(r)return;yield n}}finally{t.releaseLock()}}}),EMr=e=>{let t=e[Symbol.asyncIterator]();return new ReadableStream({async pull(r){let{done:n,value:a}=await t.next();if(n)return r.close();r.enqueue(a)}})},AMr=e=>Object.assign(e,{eventStreamMarshaller:e.eventStreamSerdeProvider(e)}),r2e=class{marshaller;serializer;deserializer;serdeContext;defaultContentType;compositeErrorRegistry;constructor({marshaller:t,serializer:r,deserializer:n,serdeContext:a,defaultContentType:o,compositeErrorRegistry:i}){this.marshaller=t,this.serializer=r,this.deserializer=n,this.serdeContext=a,this.defaultContentType=o,this.compositeErrorRegistry=i}async serializeEventStream({eventStream:t,requestSchema:r,initialRequest:n}){let a=this.marshaller,o=r.getEventStreamMember(),i=r.getMemberSchema(o),s=this.serializer,c=this.defaultContentType,l=Symbol("initialRequestMarker"),u={async*[Symbol.asyncIterator](){if(n){let d={":event-type":{type:"string",value:"initial-request"},":message-type":{type:"string",value:"event"},":content-type":{type:"string",value:c}};s.write(r,n);let p=s.flush();yield{[l]:!0,headers:d,body:p}}for await(let d of t)yield d}};return a.serialize(u,d=>{if(d[l])return{headers:d.headers,body:d.body};let p="";for(let A in d)if(A!=="__type"){p=A;break}let{additionalHeaders:m,body:f,eventType:y,explicitPayloadContentType:v}=this.writeEventBody(p,i,d);return{headers:{":event-type":{type:"string",value:y},":message-type":{type:"string",value:"event"},":content-type":{type:"string",value:v??c},...m},body:f}})}async deserializeEventStream({response:t,responseSchema:r,initialResponseContainer:n}){let a=this.marshaller,o=r.getEventStreamMember(),s=r.getMemberSchema(o).getMemberSchemas(),c=Symbol("initialResponseMarker"),l=a.deserialize(t.body,async p=>{let m="";for(let y in p)if(y!=="__type"){m=y;break}let f=p[m].body;if(m==="initial-response"){let y=await this.deserializer.read(r,f);return delete y[o],{[c]:!0,...y}}else if(m in s){let y=s[m];if(y.isStructSchema()){let v={},S=!1;for(let[A,C]of y.structIterator()){let{eventHeader:T,eventPayload:x}=C.getMergedTraits();if(S=S||!!(T||x),x)C.isBlobSchema()?v[A]=f:C.isStringSchema()?v[A]=(this.serdeContext?.utf8Encoder??tMr)(f):C.isStructSchema()&&(v[A]=await this.deserializer.read(C,f));else if(T){let R=p[m].headers[A]?.value;R!=null&&(C.isNumericSchema()?R&&typeof R=="object"&&"bytes"in R?v[A]=BigInt(R.toString()):v[A]=Number(R):v[A]=R)}}return{[m]:await this.readEventMember(y,f,S,v)}}return{[m]:await this.deserializer.read(y,f)}}else return{$unknown:p}}),u=l[Symbol.asyncIterator](),d=await u.next();if(d.done)return l;if(d.value?.[c]){if(!r)throw new Error("@smithy::core/protocols - initial-response event encountered in event stream but no response schema given.");for(let p in d.value)n[p]=d.value[p]}return{async*[Symbol.asyncIterator](){for(d?.value?.[c]||(yield d.value);;){let{done:p,value:m}=await u.next();if(p)break;yield m}}}}async readEventMember(t,r,n,a){let o,i=t.getSchema();if(Array.isArray(i)&&i[0]===-3){let c=i[1],l=aMr.for(c);this.compositeErrorRegistry?.copyFrom(l),o=(this.compositeErrorRegistry??l)?.getErrorCtor(i)}let s=n?a:r.byteLength===0?{}:await this.deserializer.read(t,r);if(o){let c=s.message??s.Message??"Unknown",l={},u=t.getMergedTraits().error;return u&&(l.$fault=u),Object.assign(new o({}),l,{message:c},s)}return s}writeEventBody(t,r,n){let a=this.serializer,o=t,i=null,s,c=r.getSchema()[4].includes(t),l={};if(c){let p=r.getMemberSchema(t);if(p.isStructSchema()){for(let[m,f]of p.structIterator()){let{eventHeader:y,eventPayload:v}=f.getMergedTraits();if(v)i=m;else if(y){let S=n[t][m],A="binary";f.isNumericSchema()?(-2)**31<=S&&S<=2**31-1?A="integer":A="long":f.isTimestampSchema()?A="timestamp":f.isStringSchema()?A="string":f.isBooleanSchema()&&(A="boolean"),S!=null&&(l[m]={type:A,value:S},delete n[t][m])}}if(i!==null){let m=p.getMemberSchema(i);m.isBlobSchema()?s="application/octet-stream":m.isStringSchema()&&(s="text/plain"),a.write(m,n[t][i])}else a.write(p,n[t])}else if(p.isUnitSchema())a.write(p,{});else throw new Error("@smithy/core/event-streams - non-struct member not supported in event stream union.")}else{let[p,m]=n[t];o=p,a.write(15,m)}let u=a.flush()??new Uint8Array;return{body:typeof u=="string"?(this.serdeContext?.utf8Decoder??rMr)(u):u,eventType:o,explicitPayloadContentType:s,additionalHeaders:l}}};Dc.EventStreamCodec=Dde;Dc.EventStreamMarshaller=Fde;Dc.EventStreamSerde=r2e;Dc.HeaderMarshaller=Ode;Dc.Int64=Xj;Dc.MessageDecoderStream=Nde;Dc.MessageEncoderStream=$de;Dc.SmithyMessageDecoderStream=Mde;Dc.SmithyMessageEncoderStream=Lde;Dc.UniversalEventStreamMarshaller=a2e;Dc.eventStreamSerdeProvider=vMr;Dc.getChunkedStream=Ckt;Dc.getMessageUnmarshaller=n2e;Dc.getUnmarshalledStream=gMr;Dc.iterableToReadableStream=EMr;Dc.readableStreamToIterable=bMr;Dc.resolveEventStreamSerdeConfig=AMr;Dc.universalEventStreamSerdeProvider=yMr});var Fkt=Se(Ga=>{var{Uint8ArrayBlobAdapter:o2e,sdkStreamMixin:wMr,splitEvery:CMr,splitHeader:Rkt,fromBase64:xkt,_parseEpochTimestamp:TMr,_parseRfc7231DateTime:xMr,_parseRfc3339DateTimeWithOffset:kMr,LazyJsonString:_kt,NumericValue:IMr,toUtf8:Pkt,fromUtf8:RMr,generateIdempotencyToken:_Mr,toBase64:kkt,dateToUtcString:PMr,quoteHeader:OMr}=kde(),{TypeRegistry:DMr,NormalizedSchema:Ub,translateTraits:Okt}=cde(),{HttpRequest:Qj,HttpResponse:Dkt,isValidHostname:Nkt}=$x(),{parseQueryString:NMr,parseUrl:$Mr}=$x();Ga.HttpRequest=Qj;Ga.HttpResponse=Dkt;Ga.isValidHostname=Nkt;Ga.parseQueryString=NMr;Ga.parseUrl=$Mr;var{FieldPosition:MMr}=(Uj(),gr(Bj)),uO=async(e=new Uint8Array,t)=>{if(e instanceof Uint8Array)return o2e.mutate(e);if(!e)return o2e.mutate(new Uint8Array);let r=t.streamCollector(e);return o2e.mutate(await r)};function s5(e){return encodeURIComponent(e).replace(/[!'()*]/g,function(t){return"%"+t.charCodeAt(0).toString(16).toUpperCase()})}var dO=class{serdeContext;setSerdeContext(t){this.serdeContext=t}},c5=class extends dO{options;compositeErrorRegistry;constructor(t){super(),this.options=t,this.compositeErrorRegistry=DMr.for(t.defaultNamespace);for(let r of t.errorTypeRegistries??[])this.compositeErrorRegistry.copyFrom(r)}getRequestType(){return Qj}getResponseType(){return Dkt}setSerdeContext(t){this.serdeContext=t,this.serializer.setSerdeContext(t),this.deserializer.setSerdeContext(t),this.getPayloadCodec()&&this.getPayloadCodec().setSerdeContext(t)}updateServiceEndpoint(t,r){if("url"in r){t.protocol=r.url.protocol,t.hostname=r.url.hostname,t.port=r.url.port?Number(r.url.port):void 0,t.path=r.url.pathname,t.fragment=r.url.hash||void 0,t.username=r.url.username||void 0,t.password=r.url.password||void 0,t.query||(t.query={});for(let[n,a]of r.url.searchParams.entries())t.query[n]=a;if(r.headers)for(let n in r.headers)t.headers[n]=r.headers[n].join(", ");return t}else{if(t.protocol=r.protocol,t.hostname=r.hostname,t.port=r.port?Number(r.port):void 0,t.path=r.path,t.query={...r.query},r.headers)for(let n in r.headers)t.headers[n]=r.headers[n];return t}}setHostPrefix(t,r,n){if(this.serdeContext?.disableHostPrefix)return;let a=Ub.of(r.input),o=Okt(r.traits??{});if(o.endpoint){let i=o.endpoint?.[0];if(typeof i=="string"){for(let[s,c]of a.structIterator()){if(!c.getMergedTraits().hostLabel)continue;let l=n[s];if(typeof l!="string")throw new Error(`@smithy/core/schema - ${s} in input must be a string as hostLabel.`);i=i.replace(`{${s}}`,l)}if(t.hostname=i+t.hostname,!Nkt(t.hostname))throw new Error(`[${t.hostname}] is not a valid hostname.`)}}}deserializeMetadata(t){return{httpStatusCode:t.statusCode,requestId:t.headers["x-amzn-requestid"]??t.headers["x-amzn-request-id"]??t.headers["x-amz-request-id"],extendedRequestId:t.headers["x-amz-id-2"],cfId:t.headers["x-amz-cf-id"]}}async serializeEventStream({eventStream:t,requestSchema:r,initialRequest:n}){return(await this.loadEventStreamCapability()).serializeEventStream({eventStream:t,requestSchema:r,initialRequest:n})}async deserializeEventStream({response:t,responseSchema:r,initialResponseContainer:n}){return(await this.loadEventStreamCapability()).deserializeEventStream({response:t,responseSchema:r,initialResponseContainer:n})}async loadEventStreamCapability(){let{EventStreamSerde:t,eventStreamSerdeProvider:r}=Tkt(),n=this.resolveEventStreamMarshaller(r);return new t({marshaller:n,serializer:this.serializer,deserializer:this.deserializer,serdeContext:this.serdeContext,defaultContentType:this.getDefaultContentType(),compositeErrorRegistry:this.compositeErrorRegistry})}resolveEventStreamMarshaller(t){let r=this.serdeContext;return r.eventStreamMarshaller?r.eventStreamMarshaller:t(this.serdeContext)}getDefaultContentType(){throw new Error(`@smithy/core/protocols - ${this.constructor.name} getDefaultContentType() implementation missing.`)}async deserializeHttpMessage(t,r,n,a,o){return[]}getEventStreamMarshaller(){let t=this.serdeContext;if(!t.eventStreamMarshaller)throw new Error("@smithy/core - HttpProtocol: eventStreamMarshaller missing in serdeContext.");return t.eventStreamMarshaller}},i2e=class extends c5{async serializeRequest(t,r,n){let a=r&&typeof r=="object"?r:{},o=this.serializer,i={},s={},c=await n.endpoint(),l=Ub.of(t?.input),u=[],d=[],p=!1,m,f=new Qj({protocol:"",hostname:"",port:void 0,path:"",fragment:void 0,query:i,headers:s,body:void 0});if(c){this.updateServiceEndpoint(f,c),this.setHostPrefix(f,t,a);let y=Okt(t.traits);if(y.http){f.method=y.http[0];let[v,S]=y.http[1].split("?");f.path=="/"?f.path=v:f.path+=v;let A=new URLSearchParams(S??"");for(let[C,T]of A)i[C]=T}}for(let[y,v]of l.structIterator()){let S=v.getMergedTraits()??{},A=a[y];if(A==null&&!v.isIdempotencyToken()){if(S.httpLabel&&(f.path.includes(`{${y}+}`)||f.path.includes(`{${y}}`)))throw new Error(`No value provided for input HTTP label: ${y}.`);continue}if(S.httpPayload)v.isStreaming()?v.isStructSchema()?a[y]&&(m=await this.serializeEventStream({eventStream:a[y],requestSchema:l})):m=A:(o.write(v,A),m=o.flush());else if(S.httpLabel){o.write(v,A);let C=o.flush();f.path.includes(`{${y}+}`)?f.path=f.path.replace(`{${y}+}`,C.split("/").map(s5).join("/")):f.path.includes(`{${y}}`)&&(f.path=f.path.replace(`{${y}}`,s5(C)))}else if(S.httpHeader)o.write(v,A),s[S.httpHeader.toLowerCase()]=String(o.flush());else if(typeof S.httpPrefixHeaders=="string")for(let C in A){let T=A[C],x=S.httpPrefixHeaders+C;o.write([v.getValueSchema(),{httpHeader:x}],T),s[x.toLowerCase()]=o.flush()}else S.httpQuery||S.httpQueryParams?this.serializeQuery(v,A,i):(p=!0,u.push(y),d.push(v))}if(p&&a){let[y,v]=(l.getName(!0)??"#Unknown").split("#"),S=l.getSchema()[6],A=[3,y,v,l.getMergedTraits(),u,d,void 0];S?A[6]=S:A.pop(),o.write(A,a),m=o.flush()}return f.headers=s,f.query=i,f.body=m,f}serializeQuery(t,r,n){let a=this.serializer,o=t.getMergedTraits();if(o.httpQueryParams){for(let i in r)if(!(i in n)){let s=r[i],c=t.getValueSchema();Object.assign(c.getMergedTraits(),{...o,httpQuery:i,httpQueryParams:void 0}),this.serializeQuery(c,s,n)}return}if(t.isListSchema()){let i=!!t.getMergedTraits().sparse,s=[];for(let c of r){a.write([t.getValueSchema(),o],c);let l=a.flush();(i||l!==void 0)&&s.push(l)}n[o.httpQuery]=s}else a.write([t,o],r),n[o.httpQuery]=a.flush()}async deserializeResponse(t,r,n){let a=this.deserializer,o=Ub.of(t.output),i={};if(n.statusCode>=300){let c=await uO(n.body,r);throw c.byteLength>0&&Object.assign(i,await a.read(15,c)),await this.handleError(t,r,n,i,this.deserializeMetadata(n)),new Error("@smithy/core/protocols - HTTP Protocol error handler failed to throw.")}for(let c in n.headers){let l=n.headers[c];delete n.headers[c],n.headers[c.toLowerCase()]=l}let s=await this.deserializeHttpMessage(o,r,n,i);if(s.length){let c=await uO(n.body,r);if(c.byteLength>0){let l=await a.read(o,c);for(let u of s)l[u]!=null&&(i[u]=l[u])}}else s.discardResponseBody&&await uO(n.body,r);return i.$metadata=this.deserializeMetadata(n),i}async deserializeHttpMessage(t,r,n,a,o){let i;a instanceof Set?i=o:i=a;let s=!0,c=this.deserializer,l=Ub.of(t),u=[];for(let[d,p]of l.structIterator()){let m=p.getMemberTraits();if(m.httpPayload){if(s=!1,p.isStreaming())p.isStructSchema()?i[d]=await this.deserializeEventStream({response:n,responseSchema:l}):i[d]=wMr(n.body);else if(n.body){let y=await uO(n.body,r);y.byteLength>0&&(i[d]=await c.read(p,y))}}else if(m.httpHeader){let f=String(m.httpHeader).toLowerCase(),y=n.headers[f];if(y!=null)if(p.isListSchema()){let v=p.getValueSchema();v.getMergedTraits().httpHeader=f;let S;v.isTimestampSchema()&&v.getSchema()===4?S=CMr(y,",",2):S=Rkt(y);let A=[];for(let C of S)A.push(await c.read(v,C.trim()));i[d]=A}else i[d]=await c.read(p,y)}else if(m.httpPrefixHeaders!==void 0){i[d]={};for(let f in n.headers)if(f.startsWith(m.httpPrefixHeaders)){let y=n.headers[f],v=p.getValueSchema();v.getMergedTraits().httpHeader=f,i[d][f.slice(m.httpPrefixHeaders.length)]=await c.read(v,y)}}else m.httpResponseCode?i[d]=n.statusCode:u.push(d)}return u.discardResponseBody=s,u}},s2e=class extends c5{async serializeRequest(t,r,n){let a=this.serializer,o={},i={},s=await n.endpoint(),c=Ub.of(t?.input),l=c.getSchema(),u,d=r&&typeof r=="object"?r:{},p=new Qj({protocol:"",hostname:"",port:void 0,path:"/",fragment:void 0,query:o,headers:i,body:void 0});if(s&&(this.updateServiceEndpoint(p,s),this.setHostPrefix(p,t,d)),d){let m=c.getEventStreamMember();if(m){if(d[m]){let f={};for(let[y,v]of c.structIterator())y!==m&&d[y]&&(a.write(v,d[y]),f[y]=a.flush());u=await this.serializeEventStream({eventStream:d[m],requestSchema:c,initialRequest:f})}}else a.write(l,d),u=a.flush()}return p.headers=Object.assign(p.headers,i),p.query=o,p.body=u,p.method="POST",p}async deserializeResponse(t,r,n){let a=this.deserializer,o=Ub.of(t.output),i={};if(n.statusCode>=300){let c=await uO(n.body,r);throw c.byteLength>0&&Object.assign(i,await a.read(15,c)),await this.handleError(t,r,n,i,this.deserializeMetadata(n)),new Error("@smithy/core/protocols - RPC Protocol error handler failed to throw.")}for(let c in n.headers){let l=n.headers[c];delete n.headers[c],n.headers[c.toLowerCase()]=l}let s=o.getEventStreamMember();if(s)i[s]=await this.deserializeEventStream({response:n,responseSchema:o,initialResponseContainer:i});else{let c=await uO(n.body,r);c.byteLength>0&&Object.assign(i,await a.read(o,c))}return i.$metadata=this.deserializeMetadata(n),i}},$kt=(e,t,r,n,a,o)=>{if(t!=null&&t[r]!==void 0){let i=n();if(i==null||i.length<=0)throw new Error("Empty value provided for input HTTP label: "+r+".");e=e.replace(a,o?i.split("/").map(s=>s5(s)).join("/"):s5(i))}else throw new Error("No value provided for input HTTP label: "+r+".");return e};function LMr(e,t){return new jde(e,t)}var jde=class{input;context;query={};method="";headers={};path="";body=null;hostname="";resolvePathStack=[];constructor(t,r){this.input=t,this.context=r}async build(){let{hostname:t,protocol:r="https",port:n,path:a}=await this.context.endpoint();this.path=a;for(let o of this.resolvePathStack)o(this.path);return new Qj({protocol:r,hostname:this.hostname||t,port:n,method:this.method,path:this.path,query:this.query,body:this.body,headers:this.headers})}hn(t){return this.hostname=t,this}bp(t){return this.resolvePathStack.push(r=>{this.path=`${r?.endsWith("/")?r.slice(0,-1):r||""}`+t}),this}p(t,r,n,a){return this.resolvePathStack.push(o=>{this.path=$kt(o,this.input,t,r,n,a)}),this}h(t){return this.headers=t,this}q(t){return this.query=t,this}b(t){return this.body=t,this}m(t){return this.method=t,this}};function p2e(e,t){if(t.timestampFormat.useTrait&&e.isTimestampSchema()&&(e.getSchema()===5||e.getSchema()===6||e.getSchema()===7))return e.getSchema();let{httpLabel:r,httpPrefixHeaders:n,httpHeader:a,httpQuery:o}=e.getMergedTraits();return(t.httpBindings?typeof n=="string"||a?6:o||r?5:void 0:void 0)??t.timestampFormat.default}var Bde=class extends dO{settings;constructor(t){super(),this.settings=t}read(t,r){let n=Ub.of(t);if(n.isListSchema())return Rkt(r).map(a=>this.read(n.getValueSchema(),a));if(n.isBlobSchema())return(this.serdeContext?.base64Decoder??xkt)(r);if(n.isTimestampSchema())switch(p2e(n,this.settings)){case 5:return kMr(r);case 6:return xMr(r);case 7:return TMr(r);default:return console.warn("Missing timestamp format, parsing value with Date constructor:",r),new Date(r)}if(n.isStringSchema()){let a=n.getMergedTraits().mediaType,o=r;if(a)return n.getMergedTraits().httpHeader&&(o=this.base64ToUtf8(o)),(a==="application/json"||a.endsWith("+json"))&&(o=_kt.from(o)),o}return n.isNumericSchema()?Number(r):n.isBigIntegerSchema()?BigInt(r):n.isBigDecimalSchema()?new IMr(r,"bigDecimal"):n.isBooleanSchema()?String(r).toLowerCase()==="true":r}base64ToUtf8(t){return(this.serdeContext?.utf8Encoder??Pkt)((this.serdeContext?.base64Decoder??xkt)(t))}},c2e=class extends dO{codecDeserializer;stringDeserializer;constructor(t,r){super(),this.codecDeserializer=t,this.stringDeserializer=new Bde(r)}setSerdeContext(t){this.stringDeserializer.setSerdeContext(t),this.codecDeserializer.setSerdeContext(t),this.serdeContext=t}read(t,r){let n=Ub.of(t),a=n.getMergedTraits(),o=this.serdeContext?.utf8Encoder??Pkt;if(a.httpHeader||a.httpResponseCode)return this.stringDeserializer.read(n,o(r));if(a.httpPayload){if(n.isBlobSchema()){let i=this.serdeContext?.utf8Decoder??RMr;return typeof r=="string"?i(r):r}else if(n.isStringSchema())return"byteLength"in r?o(r):r}return this.codecDeserializer.read(n,r)}},Ude=class extends dO{settings;stringBuffer="";constructor(t){super(),this.settings=t}write(t,r){let n=Ub.of(t);switch(typeof r){case"object":if(r===null){this.stringBuffer="null";return}if(n.isTimestampSchema()){if(!(r instanceof Date))throw new Error(`@smithy/core/protocols - received non-Date value ${r} when schema expected Date in ${n.getName(!0)}`);switch(p2e(n,this.settings)){case 5:this.stringBuffer=r.toISOString().replace(".000Z","Z");break;case 6:this.stringBuffer=PMr(r);break;case 7:this.stringBuffer=String(r.getTime()/1e3);break;default:console.warn("Missing timestamp format, using epoch seconds",r),this.stringBuffer=String(r.getTime()/1e3)}return}if(n.isBlobSchema()&&"byteLength"in r){this.stringBuffer=(this.serdeContext?.base64Encoder??kkt)(r);return}if(n.isListSchema()&&Array.isArray(r)){let i="";for(let s of r){this.write([n.getValueSchema(),n.getMergedTraits()],s);let c=this.flush(),l=n.getValueSchema().isTimestampSchema()?c:OMr(c);i!==""&&(i+=", "),i+=l}this.stringBuffer=i;return}this.stringBuffer=JSON.stringify(r,null,2);break;case"string":let a=n.getMergedTraits().mediaType,o=r;if(a&&((a==="application/json"||a.endsWith("+json"))&&(o=_kt.from(o)),n.getMergedTraits().httpHeader)){this.stringBuffer=(this.serdeContext?.base64Encoder??kkt)(o.toString());return}this.stringBuffer=r;break;default:n.isIdempotencyToken()?this.stringBuffer=_Mr():this.stringBuffer=String(r)}}flush(){let t=this.stringBuffer;return this.stringBuffer="",t}},l2e=class{codecSerializer;stringSerializer;buffer;constructor(t,r,n=new Ude(r)){this.codecSerializer=t,this.stringSerializer=n}setSerdeContext(t){this.codecSerializer.setSerdeContext(t),this.stringSerializer.setSerdeContext(t)}write(t,r){let n=Ub.of(t),a=n.getMergedTraits();if(a.httpHeader||a.httpLabel||a.httpQuery){this.stringSerializer.write(n,r),this.buffer=this.stringSerializer.flush();return}return this.codecSerializer.write(n,r)}flush(){if(this.buffer!==void 0){let t=this.buffer;return this.buffer=void 0,t}return this.codecSerializer.flush()}},u2e=class{name;kind;values;constructor({name:t,kind:r=MMr.HEADER,values:n=[]}){this.name=t,this.kind=r,this.values=n}add(t){this.values.push(t)}set(t){this.values=t}remove(t){this.values=this.values.filter(r=>r!==t)}toString(){return this.values.map(t=>t.includes(",")||t.includes(" ")?`"${t}"`:t).join(", ")}get(){return this.values}},d2e=class{entries={};encoding;constructor({fields:t=[],encoding:r="utf-8"}){t.forEach(this.setField.bind(this)),this.encoding=r}setField(t){this.entries[t.name.toLowerCase()]=t}getField(t){return this.entries[t.toLowerCase()]}removeField(t){delete this.entries[t.toLowerCase()]}getByType(t){return Object.values(this.entries).filter(r=>r.kind===t)}},FMr=e=>({setHttpHandler(t){e.httpHandler=t},httpHandler(){return e.httpHandler},updateHttpClientConfig(t,r){e.httpHandler?.updateHttpClientConfig(t,r)},httpHandlerConfigs(){return e.httpHandler.httpHandlerConfigs()}}),jMr=e=>({httpHandler:e.httpHandler()}),Ikt="content-length";function Mkt(e){return t=>async r=>{let n=r.request;if(Qj.isInstance(n)){let{body:a,headers:o}=n;if(a&&Object.keys(o).map(i=>i.toLowerCase()).indexOf(Ikt)===-1)try{let i=e(a);n.headers={...n.headers,[Ikt]:String(i)}}catch{}}return t({...r,request:n})}}var Lkt={step:"build",tags:["SET_CONTENT_LENGTH","CONTENT_LENGTH"],name:"contentLengthMiddleware",override:!0},BMr=e=>({applyToStack:t=>{t.add(Mkt(e.bodyLengthChecker),Lkt)}}),i5=e=>encodeURIComponent(e).replace(/[!'()*]/g,UMr),UMr=e=>`%${e.charCodeAt(0).toString(16).toUpperCase()}`,GMr=e=>e.split("/").map(i5).join("/");function VMr(e){let t=[];for(let r of Object.keys(e).sort()){let n=e[r];if(r=i5(r),Array.isArray(n))for(let a=0,o=n.length;a<o;a++)t.push(`${r}=${i5(n[a])}`);else{let a=r;(n||typeof n=="string")&&(a+=`=${i5(n)}`),t.push(a)}}return t.join("&")}Ga.Field=u2e;Ga.Fields=d2e;Ga.FromStringShapeDeserializer=Bde;Ga.HttpBindingProtocol=i2e;Ga.HttpInterceptingShapeDeserializer=c2e;Ga.HttpInterceptingShapeSerializer=l2e;Ga.HttpProtocol=c5;Ga.RequestBuilder=jde;Ga.RpcProtocol=s2e;Ga.SerdeContext=dO;Ga.ToStringShapeSerializer=Ude;Ga.buildQueryString=VMr;Ga.collectBody=uO;Ga.contentLengthMiddleware=Mkt;Ga.contentLengthMiddlewareOptions=Lkt;Ga.determineTimestampFormat=p2e;Ga.escapeUri=i5;Ga.escapeUriPath=GMr;Ga.extendedEncodeURIComponent=s5;Ga.getContentLengthPlugin=BMr;Ga.getHttpHandlerExtensionConfiguration=FMr;Ga.requestBuilder=LMr;Ga.resolveHttpHandlerRuntimeConfig=jMr;Ga.resolvedPath=$kt});function m2e(e){let t=e&&typeof e=="object"&&"reason"in e?e.reason:void 0;if(t){if(t instanceof Error){let a=new Error("Request aborted");return a.name="AbortError",a.cause=t,a}let n=new Error(String(t));return n.name="AbortError",n}let r=new Error("Request aborted");return r.name="AbortError",r}var jkt=w(()=>{});var Bkt,Ukt=w(()=>{Bkt=["ECONNRESET","EPIPE","ETIMEDOUT"]});var Gkt,Vkt=w(()=>{Gkt=e=>{let t={};for(let r in e){let n=e[r];t[r]=Array.isArray(n)?n.join(","):n}return t}});import l5 from"node:https";var Wkt=w(()=>{});var Gi,pO=w(()=>{Gi={setTimeout:(e,t)=>setTimeout(e,t),clearTimeout:e=>clearTimeout(e)}});var zkt,Hkt,Kkt=w(()=>{pO();zkt=1e3,Hkt=(e,t,r=0)=>{if(!r)return-1;let n=a=>{let o=Gi.setTimeout(()=>{e.destroy(),t(Object.assign(new Error(`@smithy/node-http-handler - the request socket did not establish a connection with the server within the configured timeout of ${r} ms.`),{name:"TimeoutError"}))},r-a),i=s=>{s?.connecting?s.on("connect",()=>{Gi.clearTimeout(o)}):Gi.clearTimeout(o)};e.socket?i(e.socket):e.on("socket",i)};return r<2e3?(n(0),0):Gi.setTimeout(n.bind(null,zkt),zkt)}});var qkt,Ykt=w(()=>{pO();qkt=(e,t,r=0,n,a)=>r?Gi.setTimeout(()=>{let o=`@smithy/node-http-handler - [${n?"ERROR":"WARN"}] a request has exceeded the configured ${r} ms requestTimeout.`;if(n){let i=Object.assign(new Error(o),{name:"TimeoutError",code:"ETIMEDOUT"});e.destroy(i),t(i)}else o+=" Init client requestHandler with throwOnRequestTimeout=true to turn this into an error.",a?.warn?.(o)},r):-1});var WMr,Jkt,Zkt=w(()=>{pO();WMr=3e3,Jkt=(e,{keepAlive:t,keepAliveMsecs:r},n=WMr)=>{if(t!==!0)return-1;let a=()=>{e.socket?e.socket.setKeepAlive(t,r||0):e.on("socket",o=>{o.setKeepAlive(t,r||0)})};return n===0?(a(),0):Gi.setTimeout(a,n)}});var Xkt,Qkt,eIt=w(()=>{pO();Xkt=3e3,Qkt=(e,t,r=0)=>{let n=a=>{let o=r-a,i=()=>{e.destroy(),t(Object.assign(new Error(`@smithy/node-http-handler - the request socket timed out after ${r} ms of inactivity (configured by client requestHandler).`),{name:"TimeoutError"}))};e.socket?(e.socket.setTimeout(o,i),e.on("close",()=>e.socket?.removeListener("timeout",i))):e.setTimeout(o,i)};return 0<r&&r<6e3?(n(0),0):Gi.setTimeout(n.bind(null,r===0?0:Xkt),Xkt)}});import{Readable as zMr}from"node:stream";async function rIt(e,t,r=tIt,n=!1){let a=t.headers,o=a?a.Expect||a.expect:void 0,i=-1,s=!0;!n&&o==="100-continue"&&(s=await Promise.race([new Promise(c=>{i=Number(Gi.setTimeout(()=>c(!0),Math.max(tIt,r)))}),new Promise(c=>{e.on("continue",()=>{Gi.clearTimeout(i),c(!0)}),e.on("response",()=>{Gi.clearTimeout(i),c(!1)}),e.on("error",()=>{Gi.clearTimeout(i),c(!1)})})])),s&&HMr(e,t.body)}function HMr(e,t){if(t instanceof zMr){t.pipe(e);return}if(t){let r=Buffer.isBuffer(t);if(r||typeof t=="string"){r&&t.byteLength===0?e.end():e.end(t);return}let a=t;if(typeof a=="object"&&a.buffer&&typeof a.byteOffset=="number"&&typeof a.byteLength=="number"){e.end(Buffer.from(a.buffer,a.byteOffset,a.byteLength));return}e.end(Buffer.from(t));return}e.end()}var tIt,nIt=w(()=>{pO();tIt=6e3});var Vde,Gde,aIt,aa,oIt=w(()=>{Vde=Rc(Fkt());jkt();Ukt();Vkt();Wkt();Kkt();Ykt();Zkt();eIt();pO();nIt();aa=class e{config;configProvider;socketWarningTimestamp=0;externalAgent=!1;metadata={handlerProtocol:"http/1.1"};static create(t){return typeof t?.handle=="function"?t:new e(t)}static checkSocketUsage(t,r,n=console){let{sockets:a,requests:o,maxSockets:i}=t;if(typeof i!="number"||i===1/0||Date.now()-15e3<r)return r;if(a&&o)for(let c in a){let l=a[c]?.length??0,u=o[c]?.length??0;if(l>=i&&u>=2*i)return n?.warn?.(`@smithy/node-http-handler:WARN - socket usage at capacity=${l} and ${u} additional requests are enqueued.
 See https://docs.aws.amazon.com/sdk-for-javascript/v3/developer-guide/node-configuring-maxsockets.html
-or increase socketAcquisitionWarningTimeout=(millis) in the NodeHttpHandler config.`),Date.now()}return r}constructor(t){this.configProvider=new Promise((r,n)=>{typeof t=="function"?t().then(a=>{r(this.resolveDefaultConfig(a))}).catch(n):r(this.resolveDefaultConfig(t))})}destroy(){this.config?.httpAgent?.destroy(),this.config?.httpsAgent?.destroy()}async handle(t,{abortSignal:r,requestTimeout:n}={}){this.config||(this.config=await this.configProvider);let a=this.config,o=t.protocol==="https:";return!o&&!this.config.httpAgent&&(this.config.httpAgent=await this.config.httpAgentProvider()),new Promise((i,s)=>{let c,l=-1,u=-1,d=-1,p=-1,m=-1,f=()=>{Gi.clearTimeout(l),Gi.clearTimeout(u),Gi.clearTimeout(d),Gi.clearTimeout(p),Gi.clearTimeout(m)},y=async F=>{await c,f(),i(F)},v=async F=>{await c,f(),s(F)};if(r?.aborted){let F=m2e(r);v(F);return}let S=t.headers,A=S?(S.Expect??S.expect)==="100-continue":!1,C=o?a.httpsAgent:a.httpAgent;A&&!this.externalAgent&&(C=new(o?l5.Agent:Gde)({keepAlive:!1,maxSockets:1/0})),l=Gi.setTimeout(()=>{this.socketWarningTimestamp=e.checkSocketUsage(C,this.socketWarningTimestamp,a.logger)},a.socketAcquisitionWarningTimeout??(a.requestTimeout??2e3)+(a.connectionTimeout??1e3));let T=t.query?(0,Vde.buildQueryString)(t.query):"",x;if(t.username!=null||t.password!=null){let F=t.username??"",G=t.password??"";x=`${F}:${G}`}let R=t.path;T&&(R+=`?${T}`),t.fragment&&(R+=`#${t.fragment}`);let I=t.hostname??"";I[0]==="["&&I.endsWith("]")?I=t.hostname.slice(1,-1):I=t.hostname;let D={headers:t.headers,host:I,method:t.method,path:R,port:t.port,agent:C,auth:x},N=(o?l5.request:aIt)(D,F=>{let G=new Vde.HttpResponse({statusCode:F.statusCode||-1,reason:F.statusMessage,headers:Gkt(F.headers),body:F});y({response:G})});if(N.on("error",F=>{Bkt.includes(F.code)?v(Object.assign(F,{name:"TimeoutError"})):v(F)}),r){let F=()=>{N.destroy();let G=m2e(r);v(G)};if(typeof r.addEventListener=="function"){let G=r;G.addEventListener("abort",F,{once:!0}),N.once("close",()=>G.removeEventListener("abort",F))}else r.onabort=F}let M=n??a.requestTimeout;u=Hkt(N,v,a.connectionTimeout),d=qkt(N,v,M,a.throwOnRequestTimeout,a.logger??console),p=Qkt(N,v,a.socketTimeout);let L=D.agent;typeof L=="object"&&"keepAlive"in L&&(m=Jkt(N,{keepAlive:L.keepAlive,keepAliveMsecs:L.keepAliveMsecs})),c=rIt(N,t,M,this.externalAgent).catch(F=>(f(),s(F)))})}updateHttpClientConfig(t,r){this.config=void 0,this.configProvider=this.configProvider.then(n=>({...n,[t]:r}))}httpHandlerConfigs(){return this.config??{}}resolveDefaultConfig(t){let{requestTimeout:r,connectionTimeout:n,socketTimeout:a,socketAcquisitionWarningTimeout:o,httpAgent:i,httpsAgent:s,throwOnRequestTimeout:c,logger:l}=t||{},u=!0,d=50;return{connectionTimeout:n,requestTimeout:r,socketTimeout:a,socketAcquisitionWarningTimeout:o,throwOnRequestTimeout:c,httpAgentProvider:async()=>{let p=await import("node:http"),{Agent:m,request:f}=p.default??p;return aIt=f,Gde=m,i instanceof Gde||typeof i?.destroy=="function"?(this.externalAgent=!0,i):new Gde({keepAlive:u,maxSockets:d,...i})},httpsAgent:s instanceof l5.Agent||typeof s?.destroy=="function"?(this.externalAgent=!0,s):new l5.Agent({keepAlive:u,maxSockets:d,...s}),logger:l}}}});var _m=w(()=>{oIt()});function sC(e){return Array.isArray(e)}function X(e,t=3e4){let r=AbortSignal.timeout(t);return e!==void 0?AbortSignal.any([e,r]):r}function oe(e){return e?.aborted===!0}function kt(e){return typeof e=="object"&&e!==null&&"name"in e&&typeof e.name=="string"?e.name:"UnknownError"}function hs(e){return e==="AccessDenied"||e===Pm.ACCESS_DENIED}var KMr,u5,Pm,ht=w(()=>{"use strict";KMr=Object.defineProperty,u5=(e,t)=>KMr(e,"name",{value:t,configurable:!0}),Pm={ACCESS_DENIED:"AccessDeniedException",ACCOUNT_ALREADY_REGISTERED:"AccountAlreadyRegisteredException",ACCOUNT_NOT_FOUND:"AccountNotFoundException",CHILD_NOT_FOUND:"ChildNotFoundException",ORGS_NOT_IN_USE:"AWSOrganizationsNotInUseException"};u5(sC,"isOULeaf");u5(X,"composeSdkAbortSignal");u5(oe,"isAborted");u5(kt,"extractErrorName");u5(hs,"isAccessDenied")});import{STSClient as JMr,AssumeRoleCommand as ZMr}from"@aws-sdk/client-sts";var qMr,YMr,iIt,bi,Ux=w(()=>{"use strict";_m();ht();qMr=Object.defineProperty,YMr=(e,t)=>qMr(e,"name",{value:t,configurable:!0}),iIt=3e4,bi=class e{static{YMr(this,"SimpleAwsProvider")}credentials;region;accountId;clientCache=new Map;assumeScopedBuildSecretSession;constructor(t,r){this.credentials={accessKeyId:t.accessKeyId,secretAccessKey:t.secretAccessKey,sessionToken:t.sessionToken},this.region=t.region,this.accountId=t.accountId,r!==void 0&&(this.assumeScopedBuildSecretSession=async(n,a)=>{let o=await r(n,a);return new e(o)})}getClient(t){let r=t.name,n=this.clientCache.get(r);if(n!==void 0)return n;let a={region:this.region,credentials:this.credentials,requestHandler:new aa({requestTimeout:iIt})},o=new t(a);return this.clientCache.set(r,o),o}getRegion(){return this.region}getAccountId(){return this.accountId}getCredentials(){return this.credentials}exportToEnv(){process.env.AWS_ACCESS_KEY_ID=this.credentials.accessKeyId,process.env.AWS_SECRET_ACCESS_KEY=this.credentials.secretAccessKey,process.env.AWS_REGION=this.region,this.credentials.sessionToken?process.env.AWS_SESSION_TOKEN=this.credentials.sessionToken:delete process.env.AWS_SESSION_TOKEN}async assumeRole(t,r){let n=(await this.getClient(JMr).send(new ZMr({RoleArn:t,RoleSessionName:r}),{abortSignal:X(void 0,iIt)})).Credentials;if(!n?.AccessKeyId||!n?.SecretAccessKey)throw new Error(`AssumeRole for ${t} returned incomplete credentials`);return{accessKeyId:n.AccessKeyId,secretAccessKey:n.SecretAccessKey,sessionToken:n.SessionToken}}scopedProvider(t){return new e(t)}}});var d5=w(()=>{"use strict";$()});function p5(e){return e.success===!0}function Vn(e){return e.success===!1}function E(e){return{success:!0,data:e}}function g(e){return{success:!1,error:e}}async function Wde(e){try{let t=await e();return E(t)}catch(t){return g(rn(t))}}function zde(e){try{let t=e();return E(t)}catch(t){return g(rn(t))}}var XMr,e2,Sn=w(()=>{"use strict";d5();XMr=Object.defineProperty,e2=(e,t)=>XMr(e,"name",{value:t,configurable:!0});e2(p5,"isSuccess");e2(Vn,"isFailure");e2(E,"success");e2(g,"failure");e2(Wde,"tryAsync");e2(zde,"trySync")});function Hde(e){let t=/^rate\((\d+) (minute|minutes|hour|hours|day|days)\)$/.exec(e);if(!t)return;let r=t[1],n=t[2];if(r===void 0||n===void 0)return;let a=parseInt(r,10);if(!Number.isFinite(a)||a<1)return;let o=n==="minute"||n==="hour"||n==="day";if(!(o&&a!==1)&&!(!o&&a===1))return n==="minute"||n==="minutes"?{everyMs:a*6e4}:n==="hour"||n==="hours"?{everyMs:a*60*6e4}:{everyMs:a*24*60*6e4}}var QMr,eLr,sIt,tLr,Ht,cIt=w(()=>{"use strict";$();QMr=Object.defineProperty,eLr=(e,t)=>QMr(e,"name",{value:t,configurable:!0}),sIt=/^[a-zA-Z][a-zA-Z0-9-]*$/,tLr=Lw.source.replace(/^\^|\$$/g,""),Ht=Object.freeze({IDENTIFIER:sIt,NEW_APP_NAME:/^[a-z][a-z0-9-]*$/,RESOURCE_NAME:/^[a-zA-Z][a-zA-Z0-9]*$/,ECS_SERVICE_NAME:sIt,BUCKET_NAME:/^[a-z][a-z0-9-]*[a-z0-9]$|^[a-z][a-z0-9]*$/,DATABASE_NAME:/^[a-zA-Z][a-zA-Z0-9_]*$/,RESOURCE_TYPE:/^[a-z]+(:[a-z]+)?$/,SSM_PATH:new RegExp(`^(?:/${tLr})+$`),SECRET_NAME:ig,SSM_COMPONENT:Lw,EMAIL:/^[^\s@]+@[^\s@]+\.[^\s@]+$/,DOCKER_IMAGE:/^[a-z0-9][a-z0-9._-]*[a-z0-9](:[a-z0-9._-]+)?$/,DOMAIN:/^[a-z0-9]([a-z0-9-]*[a-z0-9])?(\.[a-z0-9]([a-z0-9-]*[a-z0-9])?)+$/i,HTTP_ORIGIN:/^https?:\/\/[a-z0-9.-]+(:\d+)?$/i,PASCAL_CASE:/^[A-Z][A-Za-z0-9]*$/,AWS_ACCOUNT_ID:/^\d{12}$/,VPC_ID:/^vpc-[a-z0-9]+$/,ROLE_ARN:/^arn:aws[a-zA-Z-]*:iam::\d{12}:role\/.+$/,CIDR:/^((25[0-5]|2[0-4]\d|1\d\d|[1-9]?\d)\.){3}(25[0-5]|2[0-4]\d|1\d\d|[1-9]?\d)\/(3[0-2]|[12]?\d)$/,SCHEDULE_EXPRESSION:/^(rate\(1 (?:minute|hour|day)\)|rate\((?:[2-9]|[1-9]\d+) (?:minutes|hours|days)\)|cron\([^\s()]+ [^\s()]+ [^\s()]+ [^\s()]+ [^\s()]+ [^\s()]+\))$/,LAMBDA_RUNTIME_IDENTIFIER:/^[A-Za-z0-9._-]+$/,ENV_VAR_NAME:/^[A-Za-z_][A-Za-z0-9_]*$/});eLr(Hde,"parseRateExpression")});var lIt,f2e=w(()=>{"use strict";lIt=["t4g.medium","m7g.medium","m8g.medium","r7g.medium","r8g.medium","m7g.large","m8g.large","r7g.large","r8g.large","m7g.xlarge","m8g.xlarge","r7g.xlarge","r8g.xlarge"]});var z,uIt=w(()=>{"use strict";$();f2e();z=Object.freeze({IDENTIFIER:"Must start with a letter, contain only letters, numbers, and hyphens",NEW_APP_NAME:"Must start with a lowercase letter and contain only lowercase letters, numbers, and hyphens",IDENTIFIER_MIN_LENGTH:"Must be at least 2 characters",IDENTIFIER_NO_TRAILING_HYPHEN:"Must not end with a hyphen",IDENTIFIER_NO_CONSECUTIVE_HYPHENS:"Must not contain consecutive hyphens",RESOURCE_NAME:"Must start with a letter and contain only letters and numbers (PascalCase recommended)",ECS_SERVICE_NAME:"Service name must start with a letter and contain only letters, numbers, and hyphens",BUCKET_NAME:"Bucket name must start with a lowercase letter and contain only lowercase letters, numbers, and hyphens",DATABASE_NAME:"Database name must start with a letter and contain only letters, numbers, and underscores",RESOURCE_TYPE:"Resource type must be in format 'category' or 'category:type'",SSM_PATH:"SSM path must start with / and contain valid namespace segments (e.g., /myapp/ApiCluster/service)",SECRET_NAME:Mw,SSM_COMPONENT:hx,EMAIL:"Please enter a valid email address",DOMAIN:"Please enter a valid domain (e.g., cms.example.com)",DOCKER_IMAGE:"Invalid Docker image name format",REQUIRED:{APP_NAME:"Application name is required",RESOURCE_NAME:"Resource name is required",BUCKET_NAME:"Bucket name is required",SERVICE_NAME:"Service name is required",NETWORK_NAME:"Network name is required",DATABASE_NAME:"Database name is required",ORGANISATION_NAME:"Organisation name is required",EMAIL:"Email is required",NAME:"Name is required",USERNAME:"Username is required",CONTAINER_NAME:"Container name is required",GROUP:"Group is required",PATTERN_NAME:"Pattern name is required",SOURCE:"Source directory is required",BUILD_COMMAND:"Build command is required",OUTPUT_DIR:"Output directory is required",FORMS_TO:"Forms recipient address is required",ROUTING_PATH:"Routing path is required",RESOURCE_REFERENCE:"Resource reference is required",RESOURCE_TYPE:"Resource type is required",VARIANT:"Variant is required",SUBTYPE:"Subtype is required",DEPLOY_TARGET:"Deploy target is required",DESTROY_TARGET:"Destroy target is required",CONNECTED_RESOURCE_NAME:"Connected resource names must not be empty"},MAX_LENGTH:{APP_NAME:"Application name must be 50 characters or less",RESOURCE_NAME:"Resource name must be 63 characters or less",BUCKET_NAME:"Bucket name must be 63 characters or less",SERVICE_NAME:"Service name must be 255 characters or less",NETWORK_NAME:"Network name must be 50 characters or less",DATABASE_NAME:"Database name must be 63 characters or less",ORGANISATION_NAME:"Organisation name must be 50 characters or less"},PORT:{INTEGER:"Port must be an integer",MIN:"Port must be at least 1",MAX:"Port cannot exceed 65535"},USERNAME:{MAX_LENGTH:"Username cannot exceed 63 characters"},LAMBDA:{MEMORY:{INTEGER:"Lambda memory must be an integer",MIN:"Memory must be at least 128 MB",MAX:"Memory cannot exceed 10240 MB",MULTIPLE:"Memory must be 128 MB or a multiple of 64 MB"},TIMEOUT:{INTEGER:"Timeout must be an integer",MIN:"Timeout must be at least 1 second",MAX:"Timeout cannot exceed 900 seconds"},RUNTIME:"Lambda runtime must contain only letters, digits, dots, underscores, or dashes (e.g. 'NODEJS_20_X' or 'nodejs20.x')"},ENV_VAR_NAME:"Environment variable names must start with a letter or underscore and contain only letters, digits, and underscores",PRIORITY:{INTEGER:"Priority must be an integer",MIN:"Priority must be at least 1",MAX:"Priority cannot exceed 50000"},CAPACITY:{MIN:{INTEGER:"Minimum capacity must be an integer",MIN_0:"Minimum capacity must be at least 0",MIN_1:"Minimum capacity must be at least 1",MAX:"Minimum capacity cannot exceed 100"},MAX:{INTEGER:"Maximum capacity must be an integer",MIN_0:"Maximum capacity must be at least 0",MIN_1:"Maximum capacity must be at least 1",MAX:"Maximum capacity cannot exceed 100"},DESIRED:{INTEGER:"Desired count must be an integer",MIN:"Desired count must be at least 0",MAX:"Desired count cannot exceed 100"},WARM_POOL_REQUIRED:"minCapacity 0 requires a warmPool \u2014 without it, new tasks wait 60-90s for a cold instance launch",WARM_POOL:{MIN_SIZE:{INTEGER:"Warm pool minSize must be an integer",MIN:"Warm pool minSize must be at least 0",MAX:"Warm pool minSize cannot exceed 100"},MIN_SIZE_EXCEEDS_MAX_CAPACITY:"warmPool.minSize cannot exceed maxCapacity \u2014 the warm pool cannot hold more instances than the ASG allows"}},MEMORY_LIMIT:{INTEGER:"Memory limit must be an integer",MIN_512:"Memory limit must be at least 512 MiB",MIN_128:"Memory limit must be at least 128 MiB",MAX:"Memory limit cannot exceed 30720 MiB"},DATABASE:{PORT:{INTEGER:"Database port must be an integer",MIN:"Database port must be at least 1024",MAX:"Database port cannot exceed 65535"},NAME:{REQUIRED:"Database name is required",MAX_LENGTH:"Database name must be 63 characters or less"}},CLICKHOUSE_STORAGE:{INTEGER:"ClickHouse storage must be a whole number of GiB",MIN:`ClickHouse storage must be at least ${100} GiB`,MAX:`ClickHouse storage cannot exceed ${16384} GiB (the gp3 ceiling)`},CLICKHOUSE_IOPS:{INTEGER:"ClickHouse iops must be a whole number",MIN:`ClickHouse iops must be at least ${3e3} (the gp3 baseline)`,MAX:`ClickHouse iops cannot exceed ${8e4} (the gp3 ceiling)`},CLICKHOUSE_THROUGHPUT:{INTEGER:"ClickHouse throughputMbps must be a whole number of MiB/s",MIN:`ClickHouse throughputMbps must be at least ${125} MiB/s (the gp3 baseline)`,MAX:`ClickHouse throughputMbps cannot exceed ${2e3} MiB/s (the gp3 ceiling)`},BACKUP_RETENTION:{INTEGER:"Backup retention must be an integer",MIN:"Backup retention must be at least 1 day",MAX:"Backup retention cannot exceed 35 days (the RDS automated-backup ceiling)"},CLICKHOUSE_BACKUP_RETENTION:{INTEGER:"ClickHouse backup retention must be an integer number of days",MIN:`ClickHouse backup retention must be at least ${1} day`,MAX:`ClickHouse backup retention cannot exceed ${3650} days`},SQS:{VISIBILITY_TIMEOUT:{INTEGER:"Visibility timeout must be an integer",MIN:"Visibility timeout must be at least 0 seconds",MAX:"Visibility timeout cannot exceed 43200 seconds (12 hours)"},RETENTION_PERIOD:{INTEGER:"Retention period must be an integer",MIN:"Retention period must be at least 60 seconds",MAX:"Retention period cannot exceed 1209600 seconds (14 days)"}},READER:{COUNT:{INTEGER:"Reader count must be an integer",MIN:"Reader count must be at least 0",MAX:"Reader count cannot exceed 15"}},IDENTIFIER_SUFFIX:{REQUIRED:"Identifier suffix is required when specified",MAX_LENGTH:"Identifier suffix cannot exceed 50 characters"},ROTATION:{INTEGER:"Rotation days must be an integer",MIN:"Rotation interval must be at least 1 day",MAX:"Rotation interval cannot exceed 365 days"},MAX_CONNECTIONS:{INTEGER:"Max connections must be an integer",MIN:"Max connections must be at least 1",MAX:"Max connections cannot exceed 100"},MONITORING_INTERVAL:{INTEGER:"Monitoring interval must be an integer",MIN:"Monitoring interval must be at least 0",MAX:"Monitoring interval cannot exceed 60 seconds",VALUES:"Monitoring interval must be 0, 1, 5, 10, 15, 30, or 60 seconds"},RETENTION_DAYS:{INTEGER:"Retention days must be an integer",MIN:"Retention days must be at least 1",MAX:"Retention days cannot exceed 365"},BATCH_SIZE:{INTEGER:"Batch size must be an integer",MIN:"Batch size must be at least 1",MAX:"Batch size cannot exceed 10000"},SERVICE:{UNIQUE_WITHIN_CLUSTER:"Service names must be unique within a cluster",MIN_REQUIRED:"At least one service is required",ROUTING_REQUIRED:"Multiple services with ports require routing config (path or host)"},PROXY_CONFIG:{MAX_IDLE_CONNECTIONS:{INTEGER:"Max idle connections must be an integer",MIN:"Max idle connections must be at least 0",MAX:"Max idle connections cannot exceed 100"},BORROW_TIMEOUT:{INTEGER:"Connection borrow timeout must be an integer",MIN:"Connection borrow timeout must be at least 1 second",MAX:"Connection borrow timeout cannot exceed 3600 seconds"}},MAX_AZS:{INTEGER:"Max AZs must be an integer",MIN:"Max AZs must be at least 1",MAX:"Max AZs cannot exceed 3"},BATCHING_WINDOW:{INTEGER:"Max batching window must be an integer",MIN:"Max batching window must be at least 0",MAX:"Max batching window cannot exceed 300 seconds"},HEALTH_CHECK:{INTERVAL:{INTEGER:"Health check interval must be an integer",MIN:"Health check interval must be at least 5 seconds",MAX:"Health check interval cannot exceed 300 seconds"},TIMEOUT:{INTEGER:"Health check timeout must be an integer",MIN:"Health check timeout must be at least 2 seconds",MAX:"Health check timeout cannot exceed 60 seconds"},RETRIES:{INTEGER:"Health check retries must be an integer",MIN:"Health check retries must be at least 1",MAX:"Health check retries cannot exceed 10"},START_PERIOD:{INTEGER:"Health check start period must be an integer",MIN:"Health check start period must be at least 0 seconds",MAX:"Health check start period cannot exceed 300 seconds"}},EPHEMERAL_STORAGE:{INTEGER:"Ephemeral storage size must be an integer",MIN:"Ephemeral storage size must be at least 512 MB",MAX:"Ephemeral storage size cannot exceed 10240 MB"},MAX_MESSAGE_SIZE:{INTEGER:"Max message size must be an integer",MIN:"Max message size must be at least 1024 bytes",MAX:"Max message size cannot exceed 262144 bytes (256 KB)"},CAPACITY_CONSTRAINT:{MIN_LTE_MAX:"minCapacity must be less than or equal to maxCapacity"},DIRECT_ACCESS:{NO_DOMAIN:"directAccess cannot be used with domain (no ALB for HTTPS)",NO_LOAD_BALANCER:"directAccess cannot be used with loadBalancer (mutually exclusive)"},GLOBAL_AURORA:{PRIMARY_REGION_REQUIRED:"primaryRegion is required for GlobalAurora databases"},NAT_GATEWAY:{INTEGER:"NAT gateway count must be an integer",MIN:"NAT gateway count must be at least 0",MAX:"NAT gateway count cannot exceed 3"},CIDR_MASK:{INTEGER:"CIDR mask must be an integer",MIN:"CIDR mask must be at least 16",MAX:"CIDR mask cannot exceed 28"},CPU:{INTEGER:"CPU must be an integer",MIN:"CPU must be at least 256 units",MAX:"CPU cannot exceed 4096 units"},KMS:{KEY_REQUIRED:"KMS key ARN is required when using KMS encryption"},READER_INSTANCES:{MAX:"Cannot have more than 15 reader instances",COUNT_OR_INSTANCES:"Cannot specify both 'count' and 'instances' - use one or the other"},GENERATOR_CAPACITY:{MIN:{MIN:"Minimum capacity must be at least 1",MAX:"Minimum capacity cannot exceed 1000"},MAX:{MIN:"Maximum capacity must be at least 1",MAX:"Maximum capacity cannot exceed 1000"}},INSTANCE_TYPE:"Unknown instance type. Common types include: t4g.micro, t4g.small, m5.large",ARCHITECTURE_MISMATCH:"Architecture mismatch between instance type and AMI",ALLOCATED_STORAGE:{INTEGER:"Allocated storage must be an integer",MIN:"Allocated storage must be at least 20 GB",MAX:"Allocated storage cannot exceed 65536 GB"},DLQ:{MAX_RECEIVE_COUNT:{INTEGER:"Max receive count must be an integer",MIN:"Max receive count must be at least 1",MAX:"Max receive count cannot exceed 1000"}},ALARM:{PERCENTAGE:{MIN:"Threshold must be at least 1%",MAX:"Threshold must be at most 100%"},FREE_STORAGE_GIB:{MIN:"Free storage threshold must be at least 1 GiB"},RESPONSE_TIME_MS:{MIN:"Response-time threshold must be at least 1 ms"}},REGION:"Invalid AWS region",PASCAL_CASE:"Resource name must start with an uppercase letter and contain only alphanumerics (PascalCase).",IMAGE_DOCKER_MUTEX:"image and docker are mutually exclusive",AWS_ACCOUNT_ID:"AWS account id must be exactly 12 digits (no hyphens)",VPC_ID:"VPC id must look like vpc-abc12345",ROLE_ARN:"Role ARN must have the form arn:aws:iam::<account-id>:role/<name>",CIDR:"CIDR must be in dotted-quad/prefix-length form (e.g. 10.0.0.0/16)",VPC_PEER:{MIN_REQUESTER_ACCOUNTS:"At least one requester account id is required",REGION_REQUIRED:"Peer region is required when specified",ROUTE_TABLE_ID_REQUIRED:"Route table id must not be empty"},SCHEDULE_EXPRESSION:"Schedule expression must be 'rate(N minute|minutes|hour|hours|day|days)' with N>=1, or 'cron(<6-field AWS expression>)'"})});var fg=w(()=>{"use strict";cIt();uIt()});function mO(e){return e?e.split(",").map(t=>t.trim()).filter(Boolean):[]}function r2(e){return qd.includes(e)}function n2(e){return/^[a-z]{2}-[a-z]+-[1-9]$/.test(e)}function a2(e){if(!e)return t2.slice(0,3);let t=e.toLowerCase().split("-"),r=t[0],n=t.length>1?t[1]:"",a=[];return r&&n&&(a=qd.filter(o=>o.startsWith(`${r}-${n}`))),a.length===0&&r&&(a=qd.filter(o=>o.startsWith(`${r}-`))),a.length>0?a.slice(0,3):t2.slice(0,3)}function o2(e){if(r2(e))return!0;let t=a2(e);return n2(e)?`Unknown region. Try: ${t.join(", ")}`:`Invalid format. Try: ${t.join(", ")}`}function f5(e){if(!e||e.trim()==="")return!0;let t=mO(e);for(let r of t){let n=o2(r);if(n!==!0)return n}return!0}function i2(e,t){return e.filter(r=>r!==t)}function w2e(e){return{label:e.city,value:e.code,description:e.optIn?`${e.code} \u2014 opt-in required`:e.code}}function ap(){return ec.map(w2e)}function cC(e){return ec.filter(t=>t.code!==e).map(w2e)}function Om(e){let t=ec.find(r=>r.code===e);return t?t.city:e}function h5(e){return t=>{let r=mO(t);return i2(r,e)}}var rLr,hg,nLr,m5,t2,C2e=w(()=>{"use strict";$();$();rLr=Object.defineProperty,hg=(e,t)=>rLr(e,"name",{value:t,configurable:!0}),nLr=["us-east-2","us-west-2","us-east-1","eu-west-1","eu-central-1","ap-southeast-1"],m5=Object.freeze(nLr.flatMap(e=>{let t=px(e);return t?[t]:[]})),t2=Object.freeze(["us-east-2","us-west-2","us-east-1","eu-west-1","ap-southeast-1"]);hg(mO,"parseRegionList");hg(r2,"isValidRegion");hg(n2,"isValidRegionFormat");hg(a2,"getSuggestions");hg(o2,"validateRegion");hg(f5,"validateRegionList");hg(i2,"filterDuplicateRegions");hg(w2e,"toRegionOption");hg(ap,"getRegionOptions");hg(cC,"getRegionOptionsExcluding");hg(Om,"getRegionName");hg(h5,"createRegionFormatter")});var Gb,Kde=w(()=>{"use strict";Gb="29.0.0"});var g5,lC,gg,Ei,yg,uC,fO=w(()=>{"use strict";g5=["Aurora","Instance","GlobalAurora","ClickHouse"],lC=["FARGATE","FARGATE_SPOT","EC2"],gg=["standard","resilient","enterprise"],Ei=["tinkerer","lightweight","standard","resilient","enterprise"],yg="custom",uC=[...Ei,yg]});function op(e,t){return e.includes(t)}var aLr,oLr,iLr,s2,c2,y5,v5,S5,T2e,l2,b5,E5,Gx,A5,qde,hO,u2,Vb,gO,w5,x2e,k2e,I2e,sLr,R2e,_2e,C5,T5,Yde,Jde,yO,P2e,cLr,lLr,Dm,vg,O2e,D2e,N2e,vO,El=w(()=>{"use strict";fO();fO();$();fO();fO();aLr=Object.defineProperty,oLr=(e,t)=>aLr(e,"name",{value:t,configurable:!0}),iLr=Object.freeze({RESOURCE_SUFFIXES:Object.freeze({storage:"Storage",database:"Database",cluster:"Cluster",function:"Function",instance:"Instance",compute:"Compute"})}),s2=["ecs","lambda","ec2"],c2=Object.freeze({ECS:"ecs",LAMBDA:"lambda",EC2:"ec2"}),y5=["code","container"],v5=Object.freeze({CODE:"code",CONTAINER:"container"}),S5=["ARM_64","X86_64"],T2e="ARM_64",l2=["NONE","AWS_IAM"],b5=["public","internal"],E5=["CPU","MEMORY"],Gx=["messaging","compute"],A5=["ARM","STANDARD"],qde=["Instance","Aurora"],hO=["postgresql","mysql"],u2=["web","worker"],Vb=["foundation","compliance","hardened"],gO="FARGATE",w5=["t3.nano","t3.micro","t3.small","t3.medium","t3.large","t3.xlarge","t3.2xlarge","t3a.nano","t3a.micro","t3a.small","t3a.medium","t3a.large","t3a.xlarge","t3a.2xlarge","t4g.nano","t4g.micro","t4g.small","t4g.medium","t4g.large","t4g.xlarge","t4g.2xlarge","c5.large","c5.xlarge","c5.2xlarge","c5.4xlarge","c5.9xlarge","c5.12xlarge","c5.18xlarge","c5.24xlarge","c5a.large","c5a.xlarge","c5a.2xlarge","c5a.4xlarge","c5a.8xlarge","c5a.12xlarge","c5a.16xlarge","c5a.24xlarge","c6g.medium","c6g.large","c6g.xlarge","c6g.2xlarge","c6g.4xlarge","c6g.8xlarge","c6g.12xlarge","c6g.16xlarge","r5.large","r5.xlarge","r5.2xlarge","r5.4xlarge","r5.8xlarge","r5.12xlarge","r5.16xlarge","r5.24xlarge","r5a.large","r5a.xlarge","r5a.2xlarge","r5a.4xlarge","r5a.8xlarge","r5a.12xlarge","r5a.16xlarge","r5a.24xlarge","r6g.medium","r6g.large","r6g.xlarge","r6g.2xlarge","r6g.4xlarge","r6g.8xlarge","r6g.12xlarge","r6g.16xlarge","i3.large","i3.xlarge","i3.2xlarge","i3.4xlarge","i3.8xlarge","i3.16xlarge","p3.2xlarge","p3.8xlarge","p3.16xlarge","g4dn.xlarge","g4dn.2xlarge","g4dn.4xlarge","g4dn.8xlarge","g4dn.12xlarge","g4dn.16xlarge","m5.large","m5.xlarge","m5.2xlarge","m5.4xlarge","m5.8xlarge","m5.12xlarge","m5.16xlarge","m5.24xlarge","m5a.large","m5a.xlarge","m5a.2xlarge","m5a.4xlarge","m5a.8xlarge","m5a.12xlarge","m5a.16xlarge","m5a.24xlarge"],x2e=[0,1,5,10,15,30,60];oLr(op,"constIncludes");k2e=1,I2e=65535,sLr=Object.freeze({postgresql:5432,mysql:3306}),R2e=128,_2e=10240,C5=1,T5=900,Yde=1,Jde=1e3,yO=100,P2e=100,cLr=1,lLr=!1,Dm=3e3,vg="t4g.micro",O2e=30,D2e=["GET","POST","PUT","DELETE","HEAD","OPTIONS","PATCH"],N2e=["standard","assets","upload","website"],vO=["AES256","KMS"]});function Zde(e,t=Ht.IDENTIFIER,r=z.IDENTIFIER){return h.string().min(2,z.IDENTIFIER_MIN_LENGTH).max(50,e).regex(t,r).refine(n=>!n.endsWith("-"),{message:z.IDENTIFIER_NO_TRAILING_HYPHEN}).refine(n=>!n.includes("--"),{message:z.IDENTIFIER_NO_CONSECUTIVE_HYPHENS})}function Zf(e){return e.issues.map(t=>`${t.path.length>0?`${t.path.join(".")}: `:""}${t.message}`).join(`
+or increase socketAcquisitionWarningTimeout=(millis) in the NodeHttpHandler config.`),Date.now()}return r}constructor(t){this.configProvider=new Promise((r,n)=>{typeof t=="function"?t().then(a=>{r(this.resolveDefaultConfig(a))}).catch(n):r(this.resolveDefaultConfig(t))})}destroy(){this.config?.httpAgent?.destroy(),this.config?.httpsAgent?.destroy()}async handle(t,{abortSignal:r,requestTimeout:n}={}){this.config||(this.config=await this.configProvider);let a=this.config,o=t.protocol==="https:";return!o&&!this.config.httpAgent&&(this.config.httpAgent=await this.config.httpAgentProvider()),new Promise((i,s)=>{let c,l=-1,u=-1,d=-1,p=-1,m=-1,f=()=>{Gi.clearTimeout(l),Gi.clearTimeout(u),Gi.clearTimeout(d),Gi.clearTimeout(p),Gi.clearTimeout(m)},y=async F=>{await c,f(),i(F)},v=async F=>{await c,f(),s(F)};if(r?.aborted){let F=m2e(r);v(F);return}let S=t.headers,A=S?(S.Expect??S.expect)==="100-continue":!1,C=o?a.httpsAgent:a.httpAgent;A&&!this.externalAgent&&(C=new(o?l5.Agent:Gde)({keepAlive:!1,maxSockets:1/0})),l=Gi.setTimeout(()=>{this.socketWarningTimestamp=e.checkSocketUsage(C,this.socketWarningTimestamp,a.logger)},a.socketAcquisitionWarningTimeout??(a.requestTimeout??2e3)+(a.connectionTimeout??1e3));let T=t.query?(0,Vde.buildQueryString)(t.query):"",x;if(t.username!=null||t.password!=null){let F=t.username??"",G=t.password??"";x=`${F}:${G}`}let R=t.path;T&&(R+=`?${T}`),t.fragment&&(R+=`#${t.fragment}`);let I=t.hostname??"";I[0]==="["&&I.endsWith("]")?I=t.hostname.slice(1,-1):I=t.hostname;let D={headers:t.headers,host:I,method:t.method,path:R,port:t.port,agent:C,auth:x},N=(o?l5.request:aIt)(D,F=>{let G=new Vde.HttpResponse({statusCode:F.statusCode||-1,reason:F.statusMessage,headers:Gkt(F.headers),body:F});y({response:G})});if(N.on("error",F=>{Bkt.includes(F.code)?v(Object.assign(F,{name:"TimeoutError"})):v(F)}),r){let F=()=>{N.destroy();let G=m2e(r);v(G)};if(typeof r.addEventListener=="function"){let G=r;G.addEventListener("abort",F,{once:!0}),N.once("close",()=>G.removeEventListener("abort",F))}else r.onabort=F}let M=n??a.requestTimeout;u=Hkt(N,v,a.connectionTimeout),d=qkt(N,v,M,a.throwOnRequestTimeout,a.logger??console),p=Qkt(N,v,a.socketTimeout);let L=D.agent;typeof L=="object"&&"keepAlive"in L&&(m=Jkt(N,{keepAlive:L.keepAlive,keepAliveMsecs:L.keepAliveMsecs})),c=rIt(N,t,M,this.externalAgent).catch(F=>(f(),s(F)))})}updateHttpClientConfig(t,r){this.config=void 0,this.configProvider=this.configProvider.then(n=>({...n,[t]:r}))}httpHandlerConfigs(){return this.config??{}}resolveDefaultConfig(t){let{requestTimeout:r,connectionTimeout:n,socketTimeout:a,socketAcquisitionWarningTimeout:o,httpAgent:i,httpsAgent:s,throwOnRequestTimeout:c,logger:l}=t||{},u=!0,d=50;return{connectionTimeout:n,requestTimeout:r,socketTimeout:a,socketAcquisitionWarningTimeout:o,throwOnRequestTimeout:c,httpAgentProvider:async()=>{let p=await import("node:http"),{Agent:m,request:f}=p.default??p;return aIt=f,Gde=m,i instanceof Gde||typeof i?.destroy=="function"?(this.externalAgent=!0,i):new Gde({keepAlive:u,maxSockets:d,...i})},httpsAgent:s instanceof l5.Agent||typeof s?.destroy=="function"?(this.externalAgent=!0,s):new l5.Agent({keepAlive:u,maxSockets:d,...s}),logger:l}}}});var _m=w(()=>{oIt()});function sC(e){return Array.isArray(e)}function X(e,t=3e4){let r=AbortSignal.timeout(t);return e!==void 0?AbortSignal.any([e,r]):r}function oe(e){return e?.aborted===!0}function kt(e){return typeof e=="object"&&e!==null&&"name"in e&&typeof e.name=="string"?e.name:"UnknownError"}function hs(e){return e==="AccessDenied"||e===Pm.ACCESS_DENIED}var KMr,u5,Pm,ht=w(()=>{"use strict";KMr=Object.defineProperty,u5=(e,t)=>KMr(e,"name",{value:t,configurable:!0}),Pm={ACCESS_DENIED:"AccessDeniedException",ACCOUNT_ALREADY_REGISTERED:"AccountAlreadyRegisteredException",ACCOUNT_NOT_FOUND:"AccountNotFoundException",CHILD_NOT_FOUND:"ChildNotFoundException",ORGS_NOT_IN_USE:"AWSOrganizationsNotInUseException"};u5(sC,"isOULeaf");u5(X,"composeSdkAbortSignal");u5(oe,"isAborted");u5(kt,"extractErrorName");u5(hs,"isAccessDenied")});import{STSClient as JMr,AssumeRoleCommand as ZMr}from"@aws-sdk/client-sts";var qMr,YMr,iIt,bi,Ux=w(()=>{"use strict";_m();ht();qMr=Object.defineProperty,YMr=(e,t)=>qMr(e,"name",{value:t,configurable:!0}),iIt=3e4,bi=class e{static{YMr(this,"SimpleAwsProvider")}credentials;region;accountId;clientCache=new Map;assumeScopedBuildSecretSession;constructor(t,r){this.credentials={accessKeyId:t.accessKeyId,secretAccessKey:t.secretAccessKey,sessionToken:t.sessionToken},this.region=t.region,this.accountId=t.accountId,r!==void 0&&(this.assumeScopedBuildSecretSession=async(n,a)=>{let o=await r(n,a);return new e(o)})}getClient(t){let r=t.name,n=this.clientCache.get(r);if(n!==void 0)return n;let a={region:this.region,credentials:this.credentials,requestHandler:new aa({requestTimeout:iIt})},o=new t(a);return this.clientCache.set(r,o),o}getRegion(){return this.region}getAccountId(){return this.accountId}getCredentials(){return this.credentials}exportToEnv(){process.env.AWS_ACCESS_KEY_ID=this.credentials.accessKeyId,process.env.AWS_SECRET_ACCESS_KEY=this.credentials.secretAccessKey,process.env.AWS_REGION=this.region,this.credentials.sessionToken?process.env.AWS_SESSION_TOKEN=this.credentials.sessionToken:delete process.env.AWS_SESSION_TOKEN}async assumeRole(t,r){let n=(await this.getClient(JMr).send(new ZMr({RoleArn:t,RoleSessionName:r}),{abortSignal:X(void 0,iIt)})).Credentials;if(!n?.AccessKeyId||!n?.SecretAccessKey)throw new Error(`AssumeRole for ${t} returned incomplete credentials`);return{accessKeyId:n.AccessKeyId,secretAccessKey:n.SecretAccessKey,sessionToken:n.SessionToken}}scopedProvider(t){return new e(t)}}});var d5=w(()=>{"use strict";$()});function p5(e){return e.success===!0}function Vn(e){return e.success===!1}function E(e){return{success:!0,data:e}}function g(e){return{success:!1,error:e}}async function Wde(e){try{let t=await e();return E(t)}catch(t){return g(rn(t))}}function zde(e){try{let t=e();return E(t)}catch(t){return g(rn(t))}}var XMr,e2,Sn=w(()=>{"use strict";d5();XMr=Object.defineProperty,e2=(e,t)=>XMr(e,"name",{value:t,configurable:!0});e2(p5,"isSuccess");e2(Vn,"isFailure");e2(E,"success");e2(g,"failure");e2(Wde,"tryAsync");e2(zde,"trySync")});function Hde(e){let t=/^rate\((\d+) (minute|minutes|hour|hours|day|days)\)$/.exec(e);if(!t)return;let r=t[1],n=t[2];if(r===void 0||n===void 0)return;let a=parseInt(r,10);if(!Number.isFinite(a)||a<1)return;let o=n==="minute"||n==="hour"||n==="day";if(!(o&&a!==1)&&!(!o&&a===1))return n==="minute"||n==="minutes"?{everyMs:a*6e4}:n==="hour"||n==="hours"?{everyMs:a*60*6e4}:{everyMs:a*24*60*6e4}}var QMr,eLr,sIt,tLr,Ht,cIt=w(()=>{"use strict";$();QMr=Object.defineProperty,eLr=(e,t)=>QMr(e,"name",{value:t,configurable:!0}),sIt=/^[a-zA-Z][a-zA-Z0-9-]*$/,tLr=Lw.source.replace(/^\^|\$$/g,""),Ht=Object.freeze({IDENTIFIER:sIt,NEW_APP_NAME:/^[a-z][a-z0-9-]*$/,RESOURCE_NAME:/^[a-zA-Z][a-zA-Z0-9]*$/,ECS_SERVICE_NAME:sIt,BUCKET_NAME:/^[a-z][a-z0-9-]*[a-z0-9]$|^[a-z][a-z0-9]*$/,DATABASE_NAME:/^[a-zA-Z][a-zA-Z0-9_]*$/,RESOURCE_TYPE:/^[a-z]+(:[a-z]+)?$/,SSM_PATH:new RegExp(`^(?:/${tLr})+$`),SECRET_NAME:ig,SSM_COMPONENT:Lw,EMAIL:/^[^\s@]+@[^\s@]+\.[^\s@]+$/,DOCKER_IMAGE:/^[a-z0-9][a-z0-9._-]*[a-z0-9](:[a-z0-9._-]+)?$/,DOMAIN:/^[a-z0-9]([a-z0-9-]*[a-z0-9])?(\.[a-z0-9]([a-z0-9-]*[a-z0-9])?)+$/i,HTTP_ORIGIN:/^https?:\/\/[a-z0-9.-]+(:\d+)?$/i,PASCAL_CASE:/^[A-Z][A-Za-z0-9]*$/,AWS_ACCOUNT_ID:/^\d{12}$/,VPC_ID:/^vpc-[a-z0-9]+$/,ROLE_ARN:/^arn:aws[a-zA-Z-]*:iam::\d{12}:role\/.+$/,CIDR:/^((25[0-5]|2[0-4]\d|1\d\d|[1-9]?\d)\.){3}(25[0-5]|2[0-4]\d|1\d\d|[1-9]?\d)\/(3[0-2]|[12]?\d)$/,SCHEDULE_EXPRESSION:/^(rate\(1 (?:minute|hour|day)\)|rate\((?:[2-9]|[1-9]\d+) (?:minutes|hours|days)\)|cron\([^\s()]+ [^\s()]+ [^\s()]+ [^\s()]+ [^\s()]+ [^\s()]+\))$/,LAMBDA_RUNTIME_IDENTIFIER:/^[A-Za-z0-9._-]+$/,ENV_VAR_NAME:/^[A-Za-z_][A-Za-z0-9_]*$/});eLr(Hde,"parseRateExpression")});var lIt,f2e=w(()=>{"use strict";lIt=["t4g.medium","m7g.medium","m8g.medium","r7g.medium","r8g.medium","m7g.large","m8g.large","r7g.large","r8g.large","m7g.xlarge","m8g.xlarge","r7g.xlarge","r8g.xlarge"]});var z,uIt=w(()=>{"use strict";$();f2e();z=Object.freeze({IDENTIFIER:"Must start with a letter, contain only letters, numbers, and hyphens",NEW_APP_NAME:"Must start with a lowercase letter and contain only lowercase letters, numbers, and hyphens",IDENTIFIER_MIN_LENGTH:"Must be at least 2 characters",IDENTIFIER_NO_TRAILING_HYPHEN:"Must not end with a hyphen",IDENTIFIER_NO_CONSECUTIVE_HYPHENS:"Must not contain consecutive hyphens",RESOURCE_NAME:"Must start with a letter and contain only letters and numbers (PascalCase recommended)",ECS_SERVICE_NAME:"Service name must start with a letter and contain only letters, numbers, and hyphens",BUCKET_NAME:"Bucket name must start with a lowercase letter and contain only lowercase letters, numbers, and hyphens",DATABASE_NAME:"Database name must start with a letter and contain only letters, numbers, and underscores",RESOURCE_TYPE:"Resource type must be in format 'category' or 'category:type'",SSM_PATH:"SSM path must start with / and contain valid namespace segments (e.g., /myapp/ApiCluster/service)",SECRET_NAME:Mw,SSM_COMPONENT:hx,EMAIL:"Please enter a valid email address",DOMAIN:"Please enter a valid domain (e.g., cms.example.com)",DOCKER_IMAGE:"Invalid Docker image name format",REQUIRED:{APP_NAME:"Application name is required",RESOURCE_NAME:"Resource name is required",BUCKET_NAME:"Bucket name is required",SERVICE_NAME:"Service name is required",NETWORK_NAME:"Network name is required",DATABASE_NAME:"Database name is required",ORGANISATION_NAME:"Organisation name is required",EMAIL:"Email is required",NAME:"Name is required",USERNAME:"Username is required",CONTAINER_NAME:"Container name is required",GROUP:"Group is required",PATTERN_NAME:"Pattern name is required",SOURCE:"Source directory is required",BUILD_COMMAND:"Build command is required",OUTPUT_DIR:"Output directory is required",FORMS_TO:"Forms recipient address is required",ROUTING_PATH:"Routing path is required",RESOURCE_REFERENCE:"Resource reference is required",RESOURCE_TYPE:"Resource type is required",VARIANT:"Variant is required",SUBTYPE:"Subtype is required",DEPLOY_TARGET:"Deploy target is required",DESTROY_TARGET:"Destroy target is required",CONNECTED_RESOURCE_NAME:"Connected resource names must not be empty"},MAX_LENGTH:{APP_NAME:"Application name must be 50 characters or less",RESOURCE_NAME:"Resource name must be 63 characters or less",BUCKET_NAME:"Bucket name must be 63 characters or less",SERVICE_NAME:"Service name must be 255 characters or less",NETWORK_NAME:"Network name must be 50 characters or less",DATABASE_NAME:"Database name must be 63 characters or less",ORGANISATION_NAME:"Organisation name must be 50 characters or less"},PORT:{INTEGER:"Port must be an integer",MIN:"Port must be at least 1",MAX:"Port cannot exceed 65535"},USERNAME:{MAX_LENGTH:"Username cannot exceed 63 characters"},LAMBDA:{MEMORY:{INTEGER:"Lambda memory must be an integer",MIN:"Memory must be at least 128 MB",MAX:"Memory cannot exceed 10240 MB",MULTIPLE:"Memory must be 128 MB or a multiple of 64 MB"},TIMEOUT:{INTEGER:"Timeout must be an integer",MIN:"Timeout must be at least 1 second",MAX:"Timeout cannot exceed 900 seconds"},RUNTIME:"Lambda runtime must contain only letters, digits, dots, underscores, or dashes (e.g. 'NODEJS_20_X' or 'nodejs20.x')"},ENV_VAR_NAME:"Environment variable names must start with a letter or underscore and contain only letters, digits, and underscores",PRIORITY:{INTEGER:"Priority must be an integer",MIN:"Priority must be at least 1",MAX:"Priority cannot exceed 50000"},CAPACITY:{MIN:{INTEGER:"Minimum capacity must be an integer",MIN_0:"Minimum capacity must be at least 0",MIN_1:"Minimum capacity must be at least 1",MAX:"Minimum capacity cannot exceed 100"},MAX:{INTEGER:"Maximum capacity must be an integer",MIN_0:"Maximum capacity must be at least 0",MIN_1:"Maximum capacity must be at least 1",MAX:"Maximum capacity cannot exceed 100"},DESIRED:{INTEGER:"Desired count must be an integer",MIN:"Desired count must be at least 0",MAX:"Desired count cannot exceed 100"},WARM_POOL_REQUIRED:"minCapacity 0 requires a warmPool \u2014 without it, new tasks wait 60-90s for a cold instance launch",WARM_POOL:{MIN_SIZE:{INTEGER:"Warm pool minSize must be an integer",MIN:"Warm pool minSize must be at least 0",MAX:"Warm pool minSize cannot exceed 100"},MIN_SIZE_EXCEEDS_MAX_CAPACITY:"warmPool.minSize cannot exceed maxCapacity \u2014 the warm pool cannot hold more instances than the ASG allows"}},MEMORY_LIMIT:{INTEGER:"Memory limit must be an integer",MIN_512:"Memory limit must be at least 512 MiB",MIN_128:"Memory limit must be at least 128 MiB",MAX:"Memory limit cannot exceed 30720 MiB"},DATABASE:{PORT:{INTEGER:"Database port must be an integer",MIN:"Database port must be at least 1024",MAX:"Database port cannot exceed 65535"},NAME:{REQUIRED:"Database name is required",MAX_LENGTH:"Database name must be 63 characters or less"}},CLICKHOUSE_STORAGE:{INTEGER:"ClickHouse storage must be a whole number of GiB",MIN:`ClickHouse storage must be at least ${100} GiB`,MAX:`ClickHouse storage cannot exceed ${16384} GiB (the gp3 ceiling)`},CLICKHOUSE_IOPS:{INTEGER:"ClickHouse iops must be a whole number",MIN:`ClickHouse iops must be at least ${3e3} (the gp3 baseline)`,MAX:`ClickHouse iops cannot exceed ${8e4} (the gp3 ceiling)`},CLICKHOUSE_THROUGHPUT:{INTEGER:"ClickHouse throughputMbps must be a whole number of MiB/s",MIN:`ClickHouse throughputMbps must be at least ${125} MiB/s (the gp3 baseline)`,MAX:`ClickHouse throughputMbps cannot exceed ${2e3} MiB/s (the gp3 ceiling)`},BACKUP_RETENTION:{INTEGER:"Backup retention must be an integer",MIN:"Backup retention must be at least 1 day",MAX:"Backup retention cannot exceed 35 days (the RDS automated-backup ceiling)"},CLICKHOUSE_BACKUP_RETENTION:{INTEGER:"ClickHouse backup retention must be an integer number of days",MIN:`ClickHouse backup retention must be at least ${1} day`,MAX:`ClickHouse backup retention cannot exceed ${3650} days`},SQS:{VISIBILITY_TIMEOUT:{INTEGER:"Visibility timeout must be an integer",MIN:"Visibility timeout must be at least 0 seconds",MAX:"Visibility timeout cannot exceed 43200 seconds (12 hours)"},RETENTION_PERIOD:{INTEGER:"Retention period must be an integer",MIN:"Retention period must be at least 60 seconds",MAX:"Retention period cannot exceed 1209600 seconds (14 days)"}},READER:{COUNT:{INTEGER:"Reader count must be an integer",MIN:"Reader count must be at least 0",MAX:"Reader count cannot exceed 15"}},IDENTIFIER_SUFFIX:{REQUIRED:"Identifier suffix is required when specified",MAX_LENGTH:"Identifier suffix cannot exceed 50 characters"},ROTATION:{INTEGER:"Rotation days must be an integer",MIN:"Rotation interval must be at least 1 day",MAX:"Rotation interval cannot exceed 365 days"},MAX_CONNECTIONS:{INTEGER:"Max connections must be an integer",MIN:"Max connections must be at least 1",MAX:"Max connections cannot exceed 100"},MONITORING_INTERVAL:{INTEGER:"Monitoring interval must be an integer",MIN:"Monitoring interval must be at least 0",MAX:"Monitoring interval cannot exceed 60 seconds",VALUES:"Monitoring interval must be 0, 1, 5, 10, 15, 30, or 60 seconds"},RETENTION_DAYS:{INTEGER:"Retention days must be an integer",MIN:"Retention days must be at least 1",MAX:"Retention days cannot exceed 365"},BATCH_SIZE:{INTEGER:"Batch size must be an integer",MIN:"Batch size must be at least 1",MAX:"Batch size cannot exceed 10000"},SERVICE:{UNIQUE_WITHIN_CLUSTER:"Service names must be unique within a cluster",MIN_REQUIRED:"At least one service is required",ROUTING_REQUIRED:"Multiple services with ports require routing config (path or host)"},PROXY_CONFIG:{MAX_IDLE_CONNECTIONS:{INTEGER:"Max idle connections must be an integer",MIN:"Max idle connections must be at least 0",MAX:"Max idle connections cannot exceed 100"},BORROW_TIMEOUT:{INTEGER:"Connection borrow timeout must be an integer",MIN:"Connection borrow timeout must be at least 1 second",MAX:"Connection borrow timeout cannot exceed 3600 seconds"}},MAX_AZS:{INTEGER:"Max AZs must be an integer",MIN:"Max AZs must be at least 1",MAX:"Max AZs cannot exceed 3"},BATCHING_WINDOW:{INTEGER:"Max batching window must be an integer",MIN:"Max batching window must be at least 0",MAX:"Max batching window cannot exceed 300 seconds"},HEALTH_CHECK:{INTERVAL:{INTEGER:"Health check interval must be an integer",MIN:"Health check interval must be at least 5 seconds",MAX:"Health check interval cannot exceed 300 seconds"},TIMEOUT:{INTEGER:"Health check timeout must be an integer",MIN:"Health check timeout must be at least 2 seconds",MAX:"Health check timeout cannot exceed 60 seconds"},RETRIES:{INTEGER:"Health check retries must be an integer",MIN:"Health check retries must be at least 1",MAX:"Health check retries cannot exceed 10"},START_PERIOD:{INTEGER:"Health check start period must be an integer",MIN:"Health check start period must be at least 0 seconds",MAX:"Health check start period cannot exceed 300 seconds"}},EPHEMERAL_STORAGE:{INTEGER:"Ephemeral storage size must be an integer",MIN:"Ephemeral storage size must be at least 512 MB",MAX:"Ephemeral storage size cannot exceed 10240 MB"},MAX_MESSAGE_SIZE:{INTEGER:"Max message size must be an integer",MIN:"Max message size must be at least 1024 bytes",MAX:"Max message size cannot exceed 262144 bytes (256 KB)"},CAPACITY_CONSTRAINT:{MIN_LTE_MAX:"minCapacity must be less than or equal to maxCapacity"},DIRECT_ACCESS:{NO_DOMAIN:"directAccess cannot be used with domain (no ALB for HTTPS)",NO_LOAD_BALANCER:"directAccess cannot be used with loadBalancer (mutually exclusive)"},GLOBAL_AURORA:{PRIMARY_REGION_REQUIRED:"primaryRegion is required for GlobalAurora databases"},NAT_GATEWAY:{INTEGER:"NAT gateway count must be an integer",MIN:"NAT gateway count must be at least 0",MAX:"NAT gateway count cannot exceed 3"},CIDR_MASK:{INTEGER:"CIDR mask must be an integer",MIN:"CIDR mask must be at least 16",MAX:"CIDR mask cannot exceed 28"},CPU:{INTEGER:"CPU must be an integer",MIN:"CPU must be at least 256 units",MAX:"CPU cannot exceed 4096 units"},KMS:{KEY_REQUIRED:"KMS key ARN is required when using KMS encryption"},READER_INSTANCES:{MAX:"Cannot have more than 15 reader instances",COUNT_OR_INSTANCES:"Cannot specify both 'count' and 'instances' - use one or the other"},GENERATOR_CAPACITY:{MIN:{MIN:"Minimum capacity must be at least 1",MAX:"Minimum capacity cannot exceed 1000"},MAX:{MIN:"Maximum capacity must be at least 1",MAX:"Maximum capacity cannot exceed 1000"}},INSTANCE_TYPE:"Unknown instance type. Common types include: t4g.micro, t4g.small, m5.large",ARCHITECTURE_MISMATCH:"Architecture mismatch between instance type and AMI",ALLOCATED_STORAGE:{INTEGER:"Allocated storage must be an integer",MIN:"Allocated storage must be at least 20 GB",MAX:"Allocated storage cannot exceed 65536 GB"},DLQ:{MAX_RECEIVE_COUNT:{INTEGER:"Max receive count must be an integer",MIN:"Max receive count must be at least 1",MAX:"Max receive count cannot exceed 1000"}},ALARM:{PERCENTAGE:{MIN:"Threshold must be at least 1%",MAX:"Threshold must be at most 100%"},FREE_STORAGE_GIB:{MIN:"Free storage threshold must be at least 1 GiB"},RESPONSE_TIME_MS:{MIN:"Response-time threshold must be at least 1 ms"}},REGION:"Invalid AWS region",PASCAL_CASE:"Resource name must start with an uppercase letter and contain only alphanumerics (PascalCase).",IMAGE_DOCKER_MUTEX:"image and docker are mutually exclusive",AWS_ACCOUNT_ID:"AWS account id must be exactly 12 digits (no hyphens)",VPC_ID:"VPC id must look like vpc-abc12345",ROLE_ARN:"Role ARN must have the form arn:aws:iam::<account-id>:role/<name>",CIDR:"CIDR must be in dotted-quad/prefix-length form (e.g. 10.0.0.0/16)",VPC_PEER:{MIN_REQUESTER_ACCOUNTS:"At least one requester account id is required",REGION_REQUIRED:"Peer region is required when specified",ROUTE_TABLE_ID_REQUIRED:"Route table id must not be empty"},SCHEDULE_EXPRESSION:"Schedule expression must be 'rate(N minute|minutes|hour|hours|day|days)' with N>=1, or 'cron(<6-field AWS expression>)'"})});var fg=w(()=>{"use strict";cIt();uIt()});function mO(e){return e?e.split(",").map(t=>t.trim()).filter(Boolean):[]}function r2(e){return qd.includes(e)}function n2(e){return/^[a-z]{2}-[a-z]+-[1-9]$/.test(e)}function a2(e){if(!e)return t2.slice(0,3);let t=e.toLowerCase().split("-"),r=t[0],n=t.length>1?t[1]:"",a=[];return r&&n&&(a=qd.filter(o=>o.startsWith(`${r}-${n}`))),a.length===0&&r&&(a=qd.filter(o=>o.startsWith(`${r}-`))),a.length>0?a.slice(0,3):t2.slice(0,3)}function o2(e){if(r2(e))return!0;let t=a2(e);return n2(e)?`Unknown region. Try: ${t.join(", ")}`:`Invalid format. Try: ${t.join(", ")}`}function f5(e){if(!e||e.trim()==="")return!0;let t=mO(e);for(let r of t){let n=o2(r);if(n!==!0)return n}return!0}function i2(e,t){return e.filter(r=>r!==t)}function w2e(e){return{label:e.city,value:e.code,description:e.optIn?`${e.code} \u2014 opt-in required`:e.code}}function ap(){return ec.map(w2e)}function cC(e){return ec.filter(t=>t.code!==e).map(w2e)}function Om(e){let t=ec.find(r=>r.code===e);return t?t.city:e}function h5(e){return t=>{let r=mO(t);return i2(r,e)}}var rLr,hg,nLr,m5,t2,C2e=w(()=>{"use strict";$();$();rLr=Object.defineProperty,hg=(e,t)=>rLr(e,"name",{value:t,configurable:!0}),nLr=["us-east-2","us-west-2","us-east-1","eu-west-1","eu-central-1","ap-southeast-1"],m5=Object.freeze(nLr.flatMap(e=>{let t=px(e);return t?[t]:[]})),t2=Object.freeze(["us-east-2","us-west-2","us-east-1","eu-west-1","ap-southeast-1"]);hg(mO,"parseRegionList");hg(r2,"isValidRegion");hg(n2,"isValidRegionFormat");hg(a2,"getSuggestions");hg(o2,"validateRegion");hg(f5,"validateRegionList");hg(i2,"filterDuplicateRegions");hg(w2e,"toRegionOption");hg(ap,"getRegionOptions");hg(cC,"getRegionOptionsExcluding");hg(Om,"getRegionName");hg(h5,"createRegionFormatter")});var Gb,Kde=w(()=>{"use strict";Gb="30.0.0"});var g5,lC,gg,Ei,yg,uC,fO=w(()=>{"use strict";g5=["Aurora","Instance","GlobalAurora","ClickHouse"],lC=["FARGATE","FARGATE_SPOT","EC2"],gg=["standard","resilient","enterprise"],Ei=["tinkerer","lightweight","standard","resilient","enterprise"],yg="custom",uC=[...Ei,yg]});function op(e,t){return e.includes(t)}var aLr,oLr,iLr,s2,c2,y5,v5,S5,T2e,l2,b5,E5,Gx,A5,qde,hO,u2,Vb,gO,w5,x2e,k2e,I2e,sLr,R2e,_2e,C5,T5,Yde,Jde,yO,P2e,cLr,lLr,Dm,vg,O2e,D2e,N2e,vO,El=w(()=>{"use strict";fO();fO();$();fO();fO();aLr=Object.defineProperty,oLr=(e,t)=>aLr(e,"name",{value:t,configurable:!0}),iLr=Object.freeze({RESOURCE_SUFFIXES:Object.freeze({storage:"Storage",database:"Database",cluster:"Cluster",function:"Function",instance:"Instance",compute:"Compute"})}),s2=["ecs","lambda","ec2"],c2=Object.freeze({ECS:"ecs",LAMBDA:"lambda",EC2:"ec2"}),y5=["code","container"],v5=Object.freeze({CODE:"code",CONTAINER:"container"}),S5=["ARM_64","X86_64"],T2e="ARM_64",l2=["NONE","AWS_IAM"],b5=["public","internal"],E5=["CPU","MEMORY"],Gx=["messaging","compute"],A5=["ARM","STANDARD"],qde=["Instance","Aurora"],hO=["postgresql","mysql"],u2=["web","worker"],Vb=["foundation","compliance","hardened"],gO="FARGATE",w5=["t3.nano","t3.micro","t3.small","t3.medium","t3.large","t3.xlarge","t3.2xlarge","t3a.nano","t3a.micro","t3a.small","t3a.medium","t3a.large","t3a.xlarge","t3a.2xlarge","t4g.nano","t4g.micro","t4g.small","t4g.medium","t4g.large","t4g.xlarge","t4g.2xlarge","c5.large","c5.xlarge","c5.2xlarge","c5.4xlarge","c5.9xlarge","c5.12xlarge","c5.18xlarge","c5.24xlarge","c5a.large","c5a.xlarge","c5a.2xlarge","c5a.4xlarge","c5a.8xlarge","c5a.12xlarge","c5a.16xlarge","c5a.24xlarge","c6g.medium","c6g.large","c6g.xlarge","c6g.2xlarge","c6g.4xlarge","c6g.8xlarge","c6g.12xlarge","c6g.16xlarge","r5.large","r5.xlarge","r5.2xlarge","r5.4xlarge","r5.8xlarge","r5.12xlarge","r5.16xlarge","r5.24xlarge","r5a.large","r5a.xlarge","r5a.2xlarge","r5a.4xlarge","r5a.8xlarge","r5a.12xlarge","r5a.16xlarge","r5a.24xlarge","r6g.medium","r6g.large","r6g.xlarge","r6g.2xlarge","r6g.4xlarge","r6g.8xlarge","r6g.12xlarge","r6g.16xlarge","i3.large","i3.xlarge","i3.2xlarge","i3.4xlarge","i3.8xlarge","i3.16xlarge","p3.2xlarge","p3.8xlarge","p3.16xlarge","g4dn.xlarge","g4dn.2xlarge","g4dn.4xlarge","g4dn.8xlarge","g4dn.12xlarge","g4dn.16xlarge","m5.large","m5.xlarge","m5.2xlarge","m5.4xlarge","m5.8xlarge","m5.12xlarge","m5.16xlarge","m5.24xlarge","m5a.large","m5a.xlarge","m5a.2xlarge","m5a.4xlarge","m5a.8xlarge","m5a.12xlarge","m5a.16xlarge","m5a.24xlarge"],x2e=[0,1,5,10,15,30,60];oLr(op,"constIncludes");k2e=1,I2e=65535,sLr=Object.freeze({postgresql:5432,mysql:3306}),R2e=128,_2e=10240,C5=1,T5=900,Yde=1,Jde=1e3,yO=100,P2e=100,cLr=1,lLr=!1,Dm=3e3,vg="t4g.micro",O2e=30,D2e=["GET","POST","PUT","DELETE","HEAD","OPTIONS","PATCH"],N2e=["standard","assets","upload","website"],vO=["AES256","KMS"]});function Zde(e,t=Ht.IDENTIFIER,r=z.IDENTIFIER){return h.string().min(2,z.IDENTIFIER_MIN_LENGTH).max(50,e).regex(t,r).refine(n=>!n.endsWith("-"),{message:z.IDENTIFIER_NO_TRAILING_HYPHEN}).refine(n=>!n.includes("--"),{message:z.IDENTIFIER_NO_CONSECUTIVE_HYPHENS})}function Zf(e){return e.issues.map(t=>`${t.path.length>0?`${t.path.join(".")}: `:""}${t.message}`).join(`
 `)}var uLr,x5,ip,Vx,d2,cr,p2,Wx,Ta,zx,Nm,lu,dIt,pIt,mIt,fIt,hIt,SO,gIt,$2e,dLr,m2,f2,yIt,vIt,M2e,L2e,F2e,Hx,Kx,Nc,pLr,Dv=w(()=>{"use strict";Lt();fg();El();C2e();uLr=Object.defineProperty,x5=(e,t)=>uLr(e,"name",{value:t,configurable:!0}),ip=x5(e=>h.union([h.literal(!1),e]),"optionalOrDisabled"),Vx={check:x5(e=>e.minCapacity!==void 0&&e.maxCapacity!==void 0?e.minCapacity<=e.maxCapacity:!0,"check"),params:{message:z.CAPACITY_CONSTRAINT.MIN_LTE_MAX,path:["maxCapacity"]}},d2=x5(e=>h.number().int(z.MEMORY_LIMIT.INTEGER).min(e,e===128?z.MEMORY_LIMIT.MIN_128:z.MEMORY_LIMIT.MIN_512).max(30720,z.MEMORY_LIMIT.MAX),"memoryLimitMiBSchema"),cr=h.string().min(1,z.REQUIRED.RESOURCE_NAME).max(63,z.MAX_LENGTH.RESOURCE_NAME).regex(Ht.RESOURCE_NAME,z.RESOURCE_NAME),p2=h.string().min(1,z.REQUIRED.BUCKET_NAME).max(63,z.MAX_LENGTH.BUCKET_NAME).regex(Ht.BUCKET_NAME,z.BUCKET_NAME),Wx=h.string().min(1,z.REQUIRED.DATABASE_NAME).max(63,z.MAX_LENGTH.DATABASE_NAME).regex(Ht.DATABASE_NAME,z.DATABASE_NAME);x5(Zde,"identifierSchema");Ta=Zde(z.MAX_LENGTH.APP_NAME),zx=Zde(z.MAX_LENGTH.APP_NAME,Ht.NEW_APP_NAME,z.NEW_APP_NAME),Nm=h.number().int(z.PORT.INTEGER).min(k2e,z.PORT.MIN).max(I2e,z.PORT.MAX),lu=h.object({key:h.string(),sourceText:h.string()}).strict(),dIt=h.object({__identifier:h.string()}).strict(),pIt=h.object({__expression:h.string()}).strict(),mIt=h.object({__call:h.string()}).strict(),fIt=h.union([dIt,pIt,mIt]),hIt=h.union([h.string(),h.number(),h.boolean(),fIt]),SO=h.record(h.string().regex(Ht.ENV_VAR_NAME,z.ENV_VAR_NAME),hIt),gIt=h.object({id:h.string(),name:h.string().optional(),arn:h.string().optional(),field:h.string().optional()}).strict().refine(e=>e.name!==void 0!=(e.arn!==void 0),{message:"secretsImport requires exactly one of `name` or `arn`."}),$2e=h.record(h.string(),gIt),dLr=h.record(h.string(),h.unknown()),m2=h.enum(uC).describe(`Application type must be one of: ${uC.join(", ")}`),f2=h.enum(Pc).describe(`OpenNext deployment pattern: ${Pc.join(", ")}`),yIt=h.enum(["before-imports","after-imports","after-app-init","after-tags","after-resource","end-of-file"]),vIt=h.enum(["import","app-init","tags","database","compute","storage","network","messaging","cdn","pattern","vpc-peer","vpc-peer-accepter","cross-plan-connection","custom"]),M2e=h.object({sourceText:h.string(),position:yIt,afterManagedResource:h.object({type:vIt,name:h.string().optional()}).strict().optional(),originalLine:h.number().int().optional(),leadingComments:h.array(h.string()).optional(),orphaned:h.boolean().optional(),orphanedComment:h.string().optional()}).strict(),L2e=h.union([h.object({tier:h.enum(gg)}).strict(),h.literal(!1)]),F2e=h.union([h.object({instanceType:h.string().optional()}).strict(),h.literal(!1)]),Hx=Zde(z.MAX_LENGTH.ORGANISATION_NAME),Kx=h.string().regex(Ht.EMAIL,z.EMAIL),Nc=h.string().refine(e=>qd.includes(e),{message:z.REGION}),pLr=h.object({name:Hx,email:Kx,accountName:h.string().optional(),primaryRegion:Nc.optional().default(At),secondaryRegions:h.array(Nc).optional(),security:h.enum(Vb).optional(),force:h.boolean().optional()}).strict();x5(Zf,"getZodErrorMessage")});var Xde,j2e,mLr,fLr,B2e,U2e,G2e,Qde=w(()=>{"use strict";Lt();fg();Xde=h.number().min(1,z.ALARM.PERCENTAGE.MIN).max(100,z.ALARM.PERCENTAGE.MAX),j2e=h.union([Xde,h.literal(!1)]),mLr=h.union([h.number().min(1,z.ALARM.RESPONSE_TIME_MS.MIN),h.literal(!1)]),fLr=h.number().min(1,z.ALARM.FREE_STORAGE_GIB.MIN),B2e=h.union([h.literal(!1),h.object({cpuThreshold:j2e.optional(),memoryThreshold:j2e.optional(),runningTasksMinimum:h.number().int().min(0).optional(),http5xxThreshold:j2e.optional(),p99ResponseTimeThresholdMs:mLr.optional()}).strict()]),U2e=h.union([h.literal(!1),h.object({cpuThreshold:Xde.optional(),freeStorageThresholdGiB:fLr.optional(),connectionsThreshold:h.number().int().min(1).optional()}).strict()]),G2e=h.union([h.literal(!1),h.object({errorRateThreshold:Xde.optional(),durationThresholdPercent:Xde.optional()}).strict()])});var qx,V2e,W2e,z2e,SIt,H2e,h2,k5,bIt,EIt,AIt,wIt,I5,R5,_5,CIt,g2,TIt,y2,xIt,kIt,K2e,IIt,P5,O5,v2,tpe,RIt,_It,PIt,OIt,DIt,hLr,gLr,yLr,vLr,S2,q2e,SLr,bLr,ELr,ALr,wLr,Y2e,Yx,CLr,epe,J2e,TLr,Z2e,D5=w(()=>{"use strict";Lt();fg();El();Dv();Qde();f2e();qx=h.number().int(z.BACKUP_RETENTION.INTEGER).min(1,z.BACKUP_RETENTION.MIN).max(35,z.BACKUP_RETENTION.MAX),V2e=h.number().int(z.CLICKHOUSE_STORAGE.INTEGER).min(100,z.CLICKHOUSE_STORAGE.MIN).max(16384,z.CLICKHOUSE_STORAGE.MAX),W2e=h.number().int(z.CLICKHOUSE_IOPS.INTEGER).min(3e3,z.CLICKHOUSE_IOPS.MIN).max(8e4,z.CLICKHOUSE_IOPS.MAX),z2e=h.number().int(z.CLICKHOUSE_THROUGHPUT.INTEGER).min(125,z.CLICKHOUSE_THROUGHPUT.MIN).max(2e3,z.CLICKHOUSE_THROUGHPUT.MAX),SIt=h.enum(lIt),H2e=h.number().int(z.CLICKHOUSE_BACKUP_RETENTION.INTEGER).min(1,z.CLICKHOUSE_BACKUP_RETENTION.MIN).max(3650,z.CLICKHOUSE_BACKUP_RETENTION.MAX),h2=h.number().int(z.MONITORING_INTERVAL.INTEGER).refine(e=>op(x2e,e),{message:z.MONITORING_INTERVAL.VALUES}),k5=h.number().int(z.DATABASE.PORT.INTEGER).min(1024,z.DATABASE.PORT.MIN).max(65535,z.DATABASE.PORT.MAX),bIt=h.enum(g5).describe(`Database type must be one of: ${g5.join(", ")}`),EIt=h.object({maxConnections:h.number().int(z.MAX_CONNECTIONS.INTEGER).min(1,z.MAX_CONNECTIONS.MIN).max(100,z.MAX_CONNECTIONS.MAX).optional(),maxIdleConnections:h.number().int(z.PROXY_CONFIG.MAX_IDLE_CONNECTIONS.INTEGER).min(0,z.PROXY_CONFIG.MAX_IDLE_CONNECTIONS.MIN).max(100,z.PROXY_CONFIG.MAX_IDLE_CONNECTIONS.MAX).optional(),connectionBorrowTimeout:h.number().int(z.PROXY_CONFIG.BORROW_TIMEOUT.INTEGER).min(1,z.PROXY_CONFIG.BORROW_TIMEOUT.MIN).max(3600,z.PROXY_CONFIG.BORROW_TIMEOUT.MAX).optional(),requireTLS:h.boolean().optional()}).strict().describe("RDS Proxy configuration"),AIt=h.object({instanceType:h.string().optional(),availabilityZone:h.string().optional()}).strict().describe("Read replica configuration"),wIt=h.object({automaticallyAfterDays:h.number().int(z.ROTATION.INTEGER).min(1,z.ROTATION.MIN).max(365,z.ROTATION.MAX).optional()}).strict().describe("Secret rotation configuration"),I5=h.object({username:h.string().min(1,z.REQUIRED.USERNAME).max(63,z.USERNAME.MAX_LENGTH).optional(),secretRotation:wIt.optional()}).strict().describe("Database credentials configuration"),R5=ip(EIt),_5=ip(AIt),CIt=h.object({scaleWithWriter:h.boolean().optional(),enableDatabaseInsights:h.boolean().optional(),identifierSuffix:h.string().min(1,z.IDENTIFIER_SUFFIX.REQUIRED).max(50,z.IDENTIFIER_SUFFIX.MAX_LENGTH).optional(),availabilityZone:h.string().optional()}).strict().describe("Configuration for a single Aurora reader instance"),g2=h.object({enableDatabaseInsights:h.boolean().optional(),identifierSuffix:h.string().min(1,z.IDENTIFIER_SUFFIX.REQUIRED).max(50,z.IDENTIFIER_SUFFIX.MAX_LENGTH).optional(),availabilityZone:h.string().optional()}).strict().describe("Configuration for Aurora writer instance"),TIt=h.object({count:h.number().int(z.READER.COUNT.INTEGER).min(0,z.READER.COUNT.MIN).max(15,z.READER.COUNT.MAX).optional(),instances:h.array(CIt).max(15,z.READER_INSTANCES.MAX).optional(),defaultEnableDatabaseInsights:h.boolean().optional()}).strict().refine(e=>!(e.count!==void 0&&e.instances!==void 0),{message:z.READER_INSTANCES.COUNT_OR_INSTANCES,path:["count"]}).describe("Aurora readers configuration"),y2=ip(TIt),xIt=h.object({awsManaged:h.literal(!0)}).strict(),kIt=h.object({useCMK:h.literal(!0)}).strict(),K2e=h.union([xIt,kIt]),IIt=h.object({mode:h.enum(["standard","advanced"]).optional(),encryptionKey:K2e.optional()}).strict().describe("Database Insights configuration"),P5=ip(IIt),O5=h.object({storageKey:K2e.optional()}).strict().describe("Encryption configuration (DESTRUCTIVE to change storageKey)"),v2=h.object({name:cr,type:bIt,databaseName:h.string().min(1,z.REQUIRED.DATABASE_NAME),instanceType:h.string().optional(),allocatedStorage:h.number().optional(),multiAz:h.boolean().optional(),publiclyAccessible:h.boolean().optional(),databaseInsights:P5.optional(),port:k5.optional(),deletionProtection:h.boolean().optional(),proxy:R5.optional(),credentials:I5.optional(),readReplica:_5.optional(),encryption:O5.optional(),writer:g2.optional(),readers:y2.optional(),backupRetention:qx.optional(),preferredMaintenanceWindow:h.string().optional(),monitoringInterval:h2.optional(),primaryRegion:h.string().optional(),secondaryRegions:h.array(h.string()).optional(),globalClusterIdentifier:h.string().optional(),enableGlobalWriteForwarding:h.boolean().optional(),snapshotIdentifier:h.string().optional(),snapshotUsername:h.string().optional(),databaseEngine:h.enum(hO).optional(),engineExpression:h.string().optional(),variableName:h.string().optional(),extraProperties:h.array(lu).optional(),alarms:U2e.optional()}).strict(),tpe=h.object({appName:Ta,nameProvidedByFlag:h.boolean().optional(),databaseName:h.string().min(1,z.REQUIRED.DATABASE_NAME).max(63,z.MAX_LENGTH.DATABASE_NAME).regex(Ht.DATABASE_NAME,z.DATABASE_NAME),resourceName:cr.optional(),connectionConfig:h.object({connectToCompute:h.array(h.string()).optional(),connectToServices:h.array(h.string()).optional()}).strict().optional(),databaseInsights:P5.optional(),port:k5.optional(),proxy:R5.optional(),credentials:I5.optional(),encryption:O5.optional(),deletionProtection:h.boolean().optional()}).strict(),RIt={databaseType:h.literal("Instance"),instanceType:h.string().optional(),multiAz:h.boolean().optional(),readReplica:_5.optional(),publiclyAccessible:h.boolean().optional(),backupRetention:qx.optional(),allocatedStorage:h.number().optional(),snapshotIdentifier:h.string().optional(),snapshotUsername:h.string().optional()},_It={databaseType:h.literal("Aurora"),writer:g2.optional(),readers:y2.optional(),backupRetention:qx.optional(),preferredMaintenanceWindow:h.string().optional(),monitoringInterval:h2.optional(),snapshotIdentifier:h.string().optional(),snapshotUsername:h.string().optional()},PIt={databaseType:h.literal("GlobalAurora"),primaryRegion:h.string().min(1,z.GLOBAL_AURORA.PRIMARY_REGION_REQUIRED),secondaryRegions:h.array(h.string()).optional(),globalClusterIdentifier:h.string().optional(),enableGlobalWriteForwarding:h.boolean().optional(),writer:g2.optional(),readers:y2.optional(),backupRetention:qx.optional(),preferredMaintenanceWindow:h.string().optional(),monitoringInterval:h2.optional(),snapshotIdentifier:h.string().optional(),snapshotUsername:h.string().optional()},OIt=h.object({appName:Ta,nameProvidedByFlag:h.boolean().optional(),databaseName:h.string().min(1,z.REQUIRED.DATABASE_NAME).max(63,z.MAX_LENGTH.DATABASE_NAME).regex(Ht.DATABASE_NAME,z.DATABASE_NAME),resourceName:cr.optional(),connectionConfig:h.object({connectToCompute:h.array(h.string()).optional(),connectToServices:h.array(h.string()).optional()}).strict().optional()}).strict(),DIt={databaseType:h.literal("ClickHouse"),instanceType:SIt.optional(),storageGb:V2e.optional(),iops:W2e.optional(),throughputMbps:z2e.optional(),coldTier:h.union([h.object({mode:h.literal("s3")}).strict(),h.literal(!1)]).optional(),optimiseSchedule:h.union([h.string(),h.literal(!1)]).optional(),backupSchedule:h.union([h.string(),h.literal(!1)]).optional(),backupVerify:h.literal(!1).optional(),backupRetentionDays:H2e.optional()},hLr=tpe.extend(RIt).strict(),gLr=tpe.extend(_It).strict(),yLr=tpe.extend(PIt).strict(),vLr=OIt.extend(DIt).strict(),S2=h.discriminatedUnion("databaseType",[hLr,gLr,yLr,vLr]),q2e=tpe.extend({resourceName:cr}).strict(),SLr=q2e.extend(RIt).strict(),bLr=q2e.extend(_It).strict(),ELr=q2e.extend(PIt).strict(),ALr=OIt.extend({resourceName:cr}).strict(),wLr=ALr.extend(DIt).strict(),Y2e=h.discriminatedUnion("databaseType",[SLr,bLr,ELr,wLr]),Yx=h.object({appName:Ta,databaseName:h.string().min(1,z.REQUIRED.DATABASE_NAME),maxConnections:h.number().int(z.MAX_CONNECTIONS.INTEGER).min(1,z.MAX_CONNECTIONS.MIN).max(100,z.MAX_CONNECTIONS.MAX).optional(),maxIdleConnections:h.number().int(z.PROXY_CONFIG.MAX_IDLE_CONNECTIONS.INTEGER).min(0,z.PROXY_CONFIG.MAX_IDLE_CONNECTIONS.MIN).max(100,z.PROXY_CONFIG.MAX_IDLE_CONNECTIONS.MAX).optional(),connectionBorrowTimeout:h.number().int(z.PROXY_CONFIG.BORROW_TIMEOUT.INTEGER).min(1,z.PROXY_CONFIG.BORROW_TIMEOUT.MIN).max(3600,z.PROXY_CONFIG.BORROW_TIMEOUT.MAX).optional(),requireTLS:h.boolean().optional(),nameProvidedByFlag:h.boolean().optional()}).strict(),CLr=["S","N","B"],epe=h.object({name:h.string(),type:h.enum(CLr)}).strict(),J2e=h.object({name:cr,partitionKey:epe,sortKey:epe.optional(),globalSecondaryIndexes:h.array(h.object({indexName:h.string(),partitionKey:epe,sortKey:epe.optional()}).strict()).optional(),ttlAttribute:h.string().optional(),stream:h.boolean().optional(),variableName:h.string().optional(),extraProperties:h.array(lu).optional()}).strict(),TLr=h.object({mode:h.literal("s3")}).strict(),Z2e=h.object({name:cr,type:h.literal("ClickHouse"),databaseName:Wx,instanceType:h.string().optional(),storageGb:V2e.optional(),iops:W2e.optional(),throughputMbps:z2e.optional(),coldTier:h.union([TLr,h.literal(!1)]).optional(),optimiseSchedule:h.union([h.string(),h.literal(!1)]).optional(),backupSchedule:h.union([h.string(),h.literal(!1)]).optional(),backupVerify:h.literal(!1).optional(),backupRetentionDays:H2e.optional(),variableName:h.string().optional(),extraProperties:h.array(lu).optional()}).strict()});var NIt,X2e,rpe,$It,Q2e,MIt,LIt,FIt,jIt,BIt,eBe,Jx,tBe,rBe,nBe,npe,UIt,ape,GIt,VIt,WIt,ope,N5,ipe=w(()=>{"use strict";Lt();fg();Dv();NIt=h.object({count:h.number().int(z.NAT_GATEWAY.INTEGER).min(0,z.NAT_GATEWAY.MIN).max(3,z.NAT_GATEWAY.MAX).optional()}).strict().describe("NAT gateway configuration"),X2e=ip(NIt),rpe=h.enum(["cloudwatch","s3"]),$It=h.object({destination:rpe.optional(),retentionDays:h.number().int(z.RETENTION_DAYS.INTEGER).min(1,z.RETENTION_DAYS.MIN).max(365,z.RETENTION_DAYS.MAX).optional(),trafficType:h.enum(["ALL","ACCEPT","REJECT"]).optional()}).strict().describe("VPC flow log configuration"),Q2e=ip($It),MIt=h.object({s3:h.boolean().optional(),dynamodb:h.boolean().optional()}).strict().describe("Gateway VPC endpoints (FREE)"),LIt=ip(MIt),FIt=h.object({ecr:h.boolean().optional(),secretsManager:h.boolean().optional(),kms:h.boolean().optional(),cloudwatchLogs:h.boolean().optional(),ssm:h.boolean().optional(),sts:h.boolean().optional()}).strict().describe("Interface VPC endpoints (cost per hour)"),jIt=ip(FIt),BIt=h.object({gateway:LIt.optional(),interface:jIt.optional()}).strict().describe("VPC endpoints configuration"),eBe=ip(BIt),Jx=h.object({maxAzs:h.number().int(z.MAX_AZS.INTEGER).min(1,z.MAX_AZS.MIN).max(3,z.MAX_AZS.MAX).optional(),natGateways:X2e.optional(),flowLogs:Q2e.optional(),vpcEndpoints:eBe.optional(),cidrMask:h.number().int(z.CIDR_MASK.INTEGER).min(16,z.CIDR_MASK.MIN).max(28,z.CIDR_MASK.MAX).optional()}).strict(),tBe=h.string().min(1,z.REQUIRED.NETWORK_NAME).max(50,z.MAX_LENGTH.NETWORK_NAME).regex(Ht.RESOURCE_NAME,z.RESOURCE_NAME),rBe=Jx.extend({name:tBe}).strict(),nBe=ip(Jx),npe=h.object({appName:Ta,networkName:tBe.optional(),maxAzs:h.number().int(z.MAX_AZS.INTEGER).min(1,z.MAX_AZS.MIN).max(3,z.MAX_AZS.MAX).optional(),natGateways:X2e.optional(),flowLogs:Q2e.optional(),vpcEndpoints:eBe.optional()}).strict(),UIt=Ht.CIDR,ape=h.string().regex(UIt,z.CIDR),GIt=h.object({kind:h.literal("database"),resource:h.string().min(1,z.REQUIRED.RESOURCE_REFERENCE),name:cr,allowedFromCidrs:h.array(ape),access:h.enum(["read","write","readWrite"]).optional()}).strict(),VIt=h.object({kind:h.literal("ecsService"),resource:h.string().min(1,z.REQUIRED.RESOURCE_REFERENCE),serviceName:h.string().min(1,z.REQUIRED.SERVICE_NAME),name:cr,allowedFromCidrs:h.array(ape),port:Nm.optional()}).strict(),WIt=h.discriminatedUnion("kind",[GIt,VIt]),ope=h.object({name:cr,peerAppName:h.string().min(1,z.REQUIRED.APP_NAME),peerAccountId:h.string().regex(Ht.AWS_ACCOUNT_ID,z.AWS_ACCOUNT_ID),peerRegion:h.string().min(1,z.VPC_PEER.REGION_REQUIRED).optional(),peerVpcId:h.string().regex(Ht.VPC_ID,z.VPC_ID).optional(),peerVpcCidr:ape.optional(),peerRoleArn:h.string().regex(Ht.ROLE_ARN,z.ROLE_ARN).optional(),peerRouteTableIds:h.array(h.string().min(1,z.VPC_PEER.ROUTE_TABLE_ID_REQUIRED)).optional(),localVpcName:h.string().min(1,z.REQUIRED.NETWORK_NAME).optional(),enableDnsResolution:h.boolean().optional()}).strict(),N5=h.object({name:cr,requesterAccountIds:h.array(h.string().regex(Ht.AWS_ACCOUNT_ID,z.AWS_ACCOUNT_ID)).min(1,z.VPC_PEER.MIN_REQUESTER_ACCOUNTS),localVpcName:h.string().min(1,z.REQUIRED.NETWORK_NAME).optional(),publishToSsm:h.boolean().optional(),exposedResources:h.array(WIt).optional()}).strict()});var $5,spe,b2,bO,aBe=w(()=>{"use strict";Lt();fg();El();Dv();$5=["storage","cdn","compute"],spe=h.object({sid:h.string().optional(),effect:h.enum(["Allow","Deny"]),principals:h.array(h.string()),actions:h.array(h.string()),resources:h.array(h.string()).optional(),conditions:h.record(h.string(),h.record(h.string(),h.union([h.string(),h.array(h.string())]))).optional()}).strict(),b2=h.object({name:cr,bucketName:h.string().optional(),publicReadAccess:h.boolean().optional(),websiteHosting:h.object({indexDocument:h.string(),errorDocument:h.string().optional()}).strict().optional(),backupVaultTier:h.enum(gg).optional(),versioned:h.boolean().optional(),encryption:h.enum(vO).optional(),kmsKeyArn:h.string().optional(),cors:h.array(h.object({allowedOrigins:h.array(h.string()),allowedMethods:h.array(h.string()),allowedHeaders:h.array(h.string()).optional(),exposedHeaders:h.array(h.string()).optional(),maxAge:h.number().optional()}).strict()).optional(),deployment:h.object({source:h.string(),prune:h.boolean().optional(),cacheControl:h.object({maxAge:h.number().optional(),immutable:h.boolean().optional()}).strict().optional()}).strict().optional(),retain:h.boolean().optional(),resourcePolicyStatements:h.array(spe).optional(),stackPlacement:h.enum($5).optional(),variableName:h.string().optional(),extraProperties:h.array(lu).optional()}).strict().refine(e=>e.encryption!=="KMS"||!!e.kmsKeyArn,{message:z.KMS.KEY_REQUIRED}),bO=h.object({appName:Ta,bucketName:p2,nameProvidedByFlag:h.boolean().optional(),storagePreset:h.enum(N2e).optional(),publicReadAccess:h.boolean().optional(),websiteHosting:h.object({indexDocument:h.string(),errorDocument:h.string().optional()}).strict().optional(),backupVaultTier:h.enum(gg).optional(),versioned:h.boolean().optional(),encryption:h.enum(vO).optional(),kmsKeyArn:h.string().optional(),cors:h.array(h.object({allowedOrigins:h.array(h.string()),allowedMethods:h.array(h.string()),allowedHeaders:h.array(h.string()).optional(),exposedHeaders:h.array(h.string()).optional(),maxAge:h.number().optional()}).strict()).optional(),connectionConfig:h.object({connectToCompute:h.array(h.string()).optional(),connectToServices:h.array(h.string()).optional()}).strict().optional()}).strict().refine(e=>e.encryption!=="KMS"||!!e.kmsKeyArn,{message:z.KMS.KEY_REQUIRED,path:["kmsKeyArn"]})});var cpe,E2,lpe=w(()=>{"use strict";Lt();fg();Dv();cpe=h.enum(["DESTROY","RETAIN"]),E2=h.object({name:cr,queueType:h.enum(["standard","fifo"]).default("standard"),visibilityTimeout:h.number().int(z.SQS.VISIBILITY_TIMEOUT.INTEGER).min(0,z.SQS.VISIBILITY_TIMEOUT.MIN).max(43200,z.SQS.VISIBILITY_TIMEOUT.MAX).optional(),retentionPeriod:h.number().int(z.SQS.RETENTION_PERIOD.INTEGER).min(60,z.SQS.RETENTION_PERIOD.MIN).max(1209600,z.SQS.RETENTION_PERIOD.MAX).optional(),contentBasedDeduplication:h.boolean().optional(),removalPolicy:cpe.optional(),variableName:h.string().optional(),extraProperties:h.array(lu).optional()}).strict()});var oBe,A2,iBe,sBe=w(()=>{"use strict";Lt();Dv();oBe=h.object({type:h.literal("basic-auth"),username:h.string().min(1),password:h.string().min(1)}).strict(),A2=h.object({name:cr,defaultOriginRef:h.string(),behaviours:h.array(h.object({pathPattern:h.string(),originRef:h.string(),cachePolicy:h.enum(["CACHING_OPTIMIZED","CACHING_DISABLED"]).optional()}).strict()).optional(),customDomain:h.string().optional(),certificateArn:h.string().optional(),domain:h.string().optional(),originHostname:h.string().optional(),accessGate:h.union([h.literal(!1),oBe]).optional(),extraProperties:h.array(lu).optional()}).strict(),iBe=h.object({appName:h.string(),name:cr.optional(),defaultOriginRef:h.string(),behaviours:h.array(h.object({pathPattern:h.string(),originRef:h.string(),cachePolicy:h.enum(["CACHING_OPTIMIZED","CACHING_DISABLED"]).optional()}).strict()).optional(),customDomain:h.string().optional(),certificateArn:h.string().optional(),domain:h.string().optional(),originHostname:h.string().optional(),accessGate:h.union([h.literal(!1),oBe]).optional(),nameProvidedByFlag:h.boolean().optional()}).strict()});function dC(e){let t=e.split(".")[0]??"";return kLr.has(t)?"ARM":"STANDARD"}function M5(e,t){let r=dC(e);return r!==t?{valid:!1,message:`Instance type '${e}' requires ${r} architecture, but '${t}' AMI was specified. Use a ${r==="ARM"?"Graviton instance (t4g, c6g, r6g, m6g, etc.)":"Intel/AMD instance (t3, c5, r5, m5, etc.)"} instead.`}:{valid:!0}}function lBe(e,t){return dC(e)===t}var xLr,cBe,kLr,upe=w(()=>{"use strict";xLr=Object.defineProperty,cBe=(e,t)=>xLr(e,"name",{value:t,configurable:!0}),kLr=new Set(["t4g","c6g","c6gd","c6gn","c7g","c7gd","c7gn","r6g","r6gd","r7g","r7gd","r8g","r8gd","c8g","c8gd","c8gn","m6g","m6gd","m7g","m7gd","m8g","m8gd","x8g","i8g","a1","x2gd","im4gn","is4gen","i4g","hpc7g"]);cBe(dC,"getArchitectureForInstanceType");cBe(M5,"validateArchitectureMatch");cBe(lBe,"isArchitectureCompatible")});function pBe(e,t){if(t===void 0)return e;let r=t.context??e.context,n=t.target??e.target,a=t.buildArgs??e.buildArgs,o=t.buildSecrets??e.buildSecrets;return{path:t.path??e.path,...r!==void 0&&{context:r},...n!==void 0&&{target:n},...a!==void 0&&{buildArgs:a},...o!==void 0&&{buildSecrets:o}}}function uBe(e){return typeof e=="object"&&e!==null&&!Array.isArray(e)}function L5(e){if(!uBe(e)||typeof e.path!="string"||e.path.length===0)return;let t=typeof e.context=="string"&&e.context.length>0?e.context:void 0,r=typeof e.target=="string"&&e.target.length>0?e.target:void 0,n=uBe(e.buildArgs)&&Object.keys(e.buildArgs).length>0?e.buildArgs:void 0,a=Array.isArray(e.buildSecrets)&&e.buildSecrets.length>0?e.buildSecrets:void 0,o={path:e.path,...t!==void 0&&{context:t},...r!==void 0&&{target:r},...n!==void 0&&{buildArgs:n},...a!==void 0&&{buildSecrets:a}},i=Sg.safeParse(o);return i.success?i.data:void 0}function RLr(e){if(e===void 0)return;let t=L5(e);return t===void 0?void 0:JSON.stringify(t)}var ILr,dpe,Xf,w2,dBe,ppe,mpe,zIt,Sg,HIt,mBe,fBe,hBe,gBe,yBe,vBe,SBe,KIt,qIt,_Lr,fpe,EO=w(()=>{"use strict";Lt();jK();ILr=Object.defineProperty,dpe=(e,t)=>ILr(e,"name",{value:t,configurable:!0}),Xf="fjall-manifest.json",w2=1,dBe=1,ppe=/^[A-Za-z0-9_.-]+$/,mpe=h.object({id:h.string().min(1,"buildSecret id cannot be empty").regex(ppe,"buildSecret id may contain only letters, digits, '_', '.', and '-' (no comma, '=', or whitespace, which would break the buildx --secret argv)"),ssm:h.string().min(1,"ssm parameter name cannot be empty").optional(),secretsManager:h.object({name:h.string().min(1,"secret name cannot be empty").optional(),arn:h.string().min(1,"secret arn cannot be empty").optional(),field:h.string().min(1,"secret field cannot be empty").optional()}).strict().refine(e=>e.name===void 0!=(e.arn===void 0),"secretsManager requires exactly one of name or arn").optional(),env:h.string().min(1,"env variable name cannot be empty").optional()}).strict().superRefine((e,t)=>{[e.ssm,e.secretsManager,e.env].filter(r=>r!==void 0).length!==1&&t.addIssue({code:h.ZodIssueCode.custom,message:"buildSecret requires exactly one source (ssm, secretsManager, or env)"})}),zIt=h.union([h.string(),h.object({ssm:h.string().min(1,"ssm parameter name cannot be empty").optional(),secretsManager:h.object({name:h.string().min(1,"secret name cannot be empty").optional(),arn:h.string().min(1,"secret arn cannot be empty").optional(),field:h.string().min(1,"secret field cannot be empty").optional()}).strict().refine(e=>e.name===void 0!=(e.arn===void 0),"secretsManager requires exactly one of name or arn").optional(),env:h.string().min(1,"env variable name cannot be empty").optional(),acknowledgePublic:h.boolean().optional()}).strict().superRefine((e,t)=>{[e.ssm,e.secretsManager,e.env].filter(r=>r!==void 0).length!==1&&t.addIssue({code:h.ZodIssueCode.custom,message:"buildArg value requires exactly one source (ssm, secretsManager, or env)"})})]),Sg=h.object({path:h.string(),context:h.string().min(1,"context cannot be empty").optional(),target:h.string().min(1,"target cannot be empty").optional(),buildArgs:h.record(h.string(),zIt).optional(),buildSecrets:h.array(mpe).optional()}).strict(),HIt=Sg.partial();dpe(pBe,"mergeDockerBuild");dpe(uBe,"isRecord");dpe(L5,"normaliseDockerBuild");dpe(RLr,"dockerBuildFingerprint");mBe=h.object({name:h.string(),clusterName:h.string().optional(),docker:Sg.optional(),containerPort:h.number().optional(),secrets:h.array(h.string()).optional(),ssmSecretsPath:h.string().optional(),importedSecretNames:h.array(h.string()).optional(),schemaGateImageTag:h.string().optional()}).strict(),fBe=h.object({type:h.enum(Pc),name:h.string(),source:h.string()}).strict(),hBe=h.object({repositoryName:h.string()}).strict(),gBe=["x86_64","arm64"],yBe=h.object({name:h.string(),secrets:h.array(h.string()).optional(),ssmSecretsPath:h.string().optional(),importedSecretNames:h.array(h.string()).optional(),docker:Sg.optional(),imageKey:h.string().optional(),architecture:h.enum(gBe).optional()}).strict(),vBe=h.object({templateHash:h.string(),synthTimestamp:h.string()}).strict(),SBe=h.object({constructPath:h.string().max(512),group:h.string().max(128),resourceType:h.string().max(256)}).strict(),KIt=h.object({synthesisedBy:h.string().min(1).max(128),minimumEngineVersion:h.string().min(1).max(32),maximumEngineMajor:h.number().int().min(0).optional(),minimumAwsCdkCli:h.string().min(1).max(32).optional()}).strict(),qIt=h.object({appName:h.string().min(1).max(128),slot:h.string().min(1).max(64),clusterName:h.string().min(1).max(128),anchor:h.string().min(1).max(128),pinned:h.boolean(),currentServiceName:h.string().min(1).max(256),legacyKey:h.string().min(1).max(256),legacyAnchor:h.string().min(1).max(256),legacyServiceName:h.string().min(1).max(512),legacyKeyFields:h.array(h.string().max(64)).max(32)}).strict(),_Lr=h.object({constructPath:h.string().min(1).max(512),resourceType:h.string().min(1).max(256),physicalNameHint:h.string().min(1).max(512),policy:h.enum(["retain","snapshot","adopted"]),destroyDisposition:h.enum(["survives","deleted-on-explicit-destroy"]),reason:h.string().min(1).max(1024),costClass:h.enum(["none","storage","fixed-monthly"]),cleanupHint:h.string().min(1).max(1024)}).strict(),fpe=h.object({version:h.literal(w2),generatedAt:h.string(),appName:h.string(),services:h.array(mBe),lambdas:h.array(yBe),pattern:fBe.optional(),ecr:hBe.optional(),stacks:h.record(h.string(),vBe),resourceMap:h.record(h.string(),SBe).optional(),engineCompat:KIt.optional(),identityAliases:h.array(qIt).optional(),residuals:h.array(_Lr).optional()}).strict()});function YIt(e){return!(e.image!==void 0&&e.docker!==void 0)}var PLr,OLr,JIt,ZIt,AO,EBe,ABe,hpe,j5,XIt,gpe,QIt,ype,vpe,wBe,eRt,C2,CBe,F5,tRt,TBe,T2,xBe,kBe,IBe,x2,RBe,DLr,NLr,$Lr,_Be,bBe,B5,U5,Spe=w(()=>{"use strict";Lt();fg();El();upe();Dv();EO();Qde();PLr=Object.defineProperty,OLr=(e,t)=>PLr(e,"name",{value:t,configurable:!0});OLr(YIt,"imageDockerMutexCheck");JIt=h.number().int(z.CAPACITY.MIN.INTEGER).min(Yde,z.GENERATOR_CAPACITY.MIN.MIN).max(Jde,z.GENERATOR_CAPACITY.MIN.MAX),ZIt=h.number().int(z.CAPACITY.MAX.INTEGER).min(Yde,z.GENERATOR_CAPACITY.MAX.MIN).max(Jde,z.GENERATOR_CAPACITY.MAX.MAX),AO=h.number().int(z.LAMBDA.MEMORY.INTEGER).min(R2e,z.LAMBDA.MEMORY.MIN).max(_2e,z.LAMBDA.MEMORY.MAX).refine(e=>e===128||e%64===0,z.LAMBDA.MEMORY.MULTIPLE),EBe=h.string().regex(Ht.LAMBDA_RUNTIME_IDENTIFIER,z.LAMBDA.RUNTIME),ABe=h.number().int(z.CPU.INTEGER).min(256,z.CPU.MIN).max(4096,z.CPU.MAX),hpe=h.number().int(z.CAPACITY.DESIRED.INTEGER).min(0,z.CAPACITY.DESIRED.MIN).max(yO,z.CAPACITY.DESIRED.MAX),j5=h.object({connectToDatabase:h.array(h.string()).optional()}).strict(),XIt=h.object({minSize:h.number().int(z.CAPACITY.WARM_POOL.MIN_SIZE.INTEGER).min(0,z.CAPACITY.WARM_POOL.MIN_SIZE.MIN).max(P2e,z.CAPACITY.WARM_POOL.MIN_SIZE.MAX).optional(),reuseOnScaleIn:h.boolean().optional()}).strict(),gpe=h.object({instanceType:h.string().optional(),amiHardwareType:h.enum(A5).optional(),minCapacity:h.number().int(z.CAPACITY.MIN.INTEGER).min(0,z.CAPACITY.MIN.MIN_0).max(yO,z.CAPACITY.MIN.MAX).optional(),maxCapacity:h.number().int(z.CAPACITY.MAX.INTEGER).min(1,z.CAPACITY.MAX.MIN_1).max(yO,z.CAPACITY.MAX.MAX).optional(),memoryLimitMiB:d2(128).optional(),warmPool:XIt.optional(),extraProperties:h.array(lu).optional()}).strict().superRefine((e,t)=>{if(!e.instanceType||!e.amiHardwareType)return;let r=M5(e.instanceType,e.amiHardwareType);r.valid||t.addIssue({code:"custom",message:r.message??z.ARCHITECTURE_MISMATCH,path:["instanceType"]})}).superRefine((e,t)=>{e.minCapacity===0&&!e.warmPool&&t.addIssue({code:"custom",message:z.CAPACITY.WARM_POOL_REQUIRED,path:["minCapacity"]}),e.warmPool?.minSize!==void 0&&e.maxCapacity!==void 0&&e.warmPool.minSize>e.maxCapacity&&t.addIssue({code:"custom",message:z.CAPACITY.WARM_POOL.MIN_SIZE_EXCEEDS_MAX_CAPACITY,path:["warmPool","minSize"]})}),QIt=h.enum(s2).describe(`Compute type must be one of: ${s2.join(", ")}`),ype=h.enum(lC).describe(`ECS capacity provider must be one of: ${lC.join(", ")}`),vpe=h.string().refine(e=>op(w5,e),{message:z.INSTANCE_TYPE}),wBe=h.object({sourceType:h.enum(["sqs","dynamodb","eventbridge"]),sourceRef:h.string().describe("Name of the source resource"),batchSize:h.number().int(z.BATCH_SIZE.INTEGER).min(1,z.BATCH_SIZE.MIN).max(1e4,z.BATCH_SIZE.MAX).optional(),startingPosition:h.enum(["TRIM_HORIZON","LATEST"]).optional(),maxBatchingWindow:h.number().int(z.BATCHING_WINDOW.INTEGER).min(0,z.BATCHING_WINDOW.MIN).max(300,z.BATCHING_WINDOW.MAX).optional(),reportBatchItemFailures:h.boolean().optional()}).strict(),eRt=h.object({name:h.string().min(1,z.REQUIRED.CONTAINER_NAME).optional(),image:h.string().optional(),port:Nm.optional(),environment:SO.optional(),secretsImport:$2e.optional(),command:h.array(h.string()).optional(),entryPoint:h.array(h.string()).optional(),essential:h.boolean().optional(),healthCheck:h.object({command:h.array(h.string()),interval:h.number().int(z.HEALTH_CHECK.INTERVAL.INTEGER).min(5,z.HEALTH_CHECK.INTERVAL.MIN).max(300,z.HEALTH_CHECK.INTERVAL.MAX).optional(),timeout:h.number().int(z.HEALTH_CHECK.TIMEOUT.INTEGER).min(2,z.HEALTH_CHECK.TIMEOUT.MIN).max(60,z.HEALTH_CHECK.TIMEOUT.MAX).optional(),retries:h.number().int(z.HEALTH_CHECK.RETRIES.INTEGER).min(1,z.HEALTH_CHECK.RETRIES.MIN).max(10,z.HEALTH_CHECK.RETRIES.MAX).optional(),startPeriod:h.number().int(z.HEALTH_CHECK.START_PERIOD.INTEGER).min(0,z.HEALTH_CHECK.START_PERIOD.MIN).max(300,z.HEALTH_CHECK.START_PERIOD.MAX).optional()}).strict().optional(),ssmSecrets:h.array(h.string().regex(Ht.SECRET_NAME,z.SECRET_NAME)).optional(),extraProperties:h.array(lu).optional()}).strict(),C2=h.string().min(1,z.REQUIRED.SERVICE_NAME).max(255,z.MAX_LENGTH.SERVICE_NAME).regex(Ht.ECS_SERVICE_NAME,z.ECS_SERVICE_NAME),CBe=h.object({domain:h.string().optional(),loadBalancer:h.union([h.literal(!1),h.enum(b5)]).optional(),directAccess:h.boolean().optional(),extraProperties:h.array(lu).optional()}).strict().refine(e=>!(e.directAccess&&e.domain),{message:z.DIRECT_ACCESS.NO_DOMAIN,path:["directAccess"]}).refine(e=>!(e.directAccess&&typeof e.loadBalancer=="string"),{message:z.DIRECT_ACCESS.NO_LOAD_BALANCER}).describe("Cluster-level configuration"),F5=h.object({path:h.string().optional(),host:h.string().optional(),priority:h.number().int(z.PRIORITY.INTEGER).min(1,z.PRIORITY.MIN).max(5e4,z.PRIORITY.MAX).optional(),healthCheckPath:h.string().optional()}).strict().describe("Path/host-based routing configuration"),tRt=h.object({desiredCount:hpe.optional(),minCapacity:h.number().int(z.CAPACITY.MIN.INTEGER).min(0,z.CAPACITY.MIN.MIN_0).max(yO,z.CAPACITY.MIN.MAX).optional(),maxCapacity:h.number().int(z.CAPACITY.MAX.INTEGER).min(1,z.CAPACITY.MAX.MIN_1).max(yO,z.CAPACITY.MAX.MAX).optional(),scalingType:h.enum(E5).optional()}).strict().refine(Vx.check,Vx.params).describe("ECS service scaling configuration"),TBe=h.object({name:C2,docker:Sg.optional(),needsDatabaseConnection:h.boolean().optional(),needsStorageConnection:h.boolean().optional(),needsMessagingConnection:h.boolean().optional(),image:h.string().optional(),containers:h.array(eRt).optional(),routing:h.union([F5,h.array(F5).min(1)]).optional(),serviceType:h.enum(u2).optional(),cpu:ABe.optional(),memoryLimitMiB:d2(512).optional(),desiredCount:hpe.optional(),scaling:ip(tRt).optional(),capacityProvider:ype,ec2Config:gpe.optional(),ssmSecretsPath:h.string().regex(Ht.SSM_PATH,z.SSM_PATH).optional(),extraProperties:h.array(lu).optional(),alarms:B2e.optional()}).strict().superRefine((e,t)=>{YIt(e)||t.addIssue({code:"custom",path:["docker"],message:z.IMAGE_DOCKER_MUTEX})}).describe("Configuration for a service in an ECS cluster"),T2=h.object({name:cr,type:QIt,needsConnection:h.boolean(),connectedDatabase:h.array(h.string().min(1,z.REQUIRED.CONNECTED_RESOURCE_NAME)).optional(),connectedStorage:h.array(h.string().min(1,z.REQUIRED.CONNECTED_RESOURCE_NAME)).optional(),connectedMessaging:h.array(h.string().min(1,z.REQUIRED.CONNECTED_RESOURCE_NAME)).optional(),cluster:CBe.optional(),services:h.array(TBe).optional(),docker:Sg.partial().optional(),deployment:h.enum(y5).optional(),codePath:h.string().optional(),timeout:h.number().int(z.LAMBDA.TIMEOUT.INTEGER).min(C5,z.LAMBDA.TIMEOUT.MIN).max(T5,z.LAMBDA.TIMEOUT.MAX).optional(),memory:AO.optional(),handler:h.string().optional(),runtime:EBe.optional(),environment:SO.optional(),secrets:SO.optional(),eventSources:h.array(wBe).optional(),functionUrl:h.object({authType:h.enum(l2)}).strict().optional(),description:h.string().optional(),scheduleExpression:h.string().optional(),scheduleStackPlacement:h.enum(Gx).optional(),architecture:h.enum(S5).optional(),ephemeralStorageSize:h.number().int(z.EPHEMERAL_STORAGE.INTEGER).min(512,z.EPHEMERAL_STORAGE.MIN).max(10240,z.EPHEMERAL_STORAGE.MAX).optional(),functionName:h.string().optional(),ssmSecrets:h.array(h.string()).optional(),ssmSecretsPath:h.string().optional(),alarms:G2e.optional(),instanceType:vpe.optional(),enableSSH:h.boolean().optional(),keyName:h.string().optional(),userData:h.string().optional(),securityGroups:h.array(h.string()).optional(),variableName:h.string().optional(),extraProperties:h.array(lu).optional()}).strict().superRefine((e,t)=>{if(e.type==="ecs"&&e.services)for(let r=0;r<e.services.length;r++){let n=e.services[r];n?.ec2Config?.instanceType&&!n.ec2Config.amiHardwareType&&dC(n.ec2Config.instanceType)!=="ARM"&&t.addIssue({code:"custom",message:`Service '${n.name??r}' uses instance type '${n.ec2Config.instanceType}' (x86), which requires Docker images built for linux/amd64. The default build targets linux/arm64 (Graviton). Use a Graviton instance type (t4g, c6g, r6g, m6g, etc.) or set amiHardwareType: "STANDARD" to acknowledge x86.`,path:["services",r,"ec2Config","instanceType"]})}e.type==="lambda"&&e.deployment==="container"&&e.architecture==="X86_64"&&t.addIssue({code:"custom",message:"Lambda architecture 'X86_64' requires Docker images built for linux/amd64, but the default build targets linux/arm64. Use 'ARM_64' for Graviton Lambdas (recommended) or ensure your build pipeline targets linux/amd64.",path:["architecture"]})}),xBe=h.object({appName:Ta,clusterName:cr,containerPort:Nm,nameProvidedByFlag:h.boolean().optional(),ecrRepository:h.string().optional(),capacityProvider:ype.optional(),useAppEcr:h.boolean().optional(),desiredCount:hpe.optional(),cpu:ABe.optional(),memoryLimitMiB:d2(512).optional(),minCapacity:JIt.optional(),maxCapacity:ZIt.optional(),ec2Config:gpe.optional(),connectionConfig:j5.optional()}).strict().refine(Vx.check,Vx.params),kBe=h.object({appName:Ta,functionName:cr,nameProvidedByFlag:h.boolean().optional(),lambdaType:h.enum(["basic","web","custom"]).optional(),ecrRepository:h.string().optional(),timeout:h.number().int(z.LAMBDA.TIMEOUT.INTEGER).min(C5,z.LAMBDA.TIMEOUT.MIN).max(T5,z.LAMBDA.TIMEOUT.MAX).optional(),memory:AO.optional(),enableFunctionUrl:h.boolean().optional(),description:h.string().optional(),enableCors:h.boolean().optional(),corsOrigins:h.string().optional(),corsHeaders:h.string().optional(),corsMethods:h.array(h.enum(D2e)).optional(),corsCredentials:h.boolean().optional(),connectionConfig:j5.optional()}).strict(),IBe=h.object({appName:Ta,instanceName:cr,nameProvidedByFlag:h.boolean().optional(),instanceType:vpe.optional(),enableSSH:h.boolean().optional(),minCapacity:JIt.optional(),maxCapacity:ZIt.optional(),connectionConfig:j5.optional()}).strict().refine(Vx.check,Vx.params),x2=h.object({appName:Ta,clusterName:cr,serviceName:C2,capacityProvider:ype,containerPort:Nm.optional(),cpu:ABe.optional(),memoryLimitMiB:d2(512).optional(),desiredCount:hpe.optional(),ec2Config:gpe.optional(),routing:h.union([F5,h.array(F5).min(1)]).optional(),docker:Sg.partial().optional(),nameProvidedByFlag:h.boolean().optional(),connectionConfig:j5.optional()}).strict(),RBe=h.object({appName:Ta,computeName:cr,nameProvidedByFlag:h.boolean().optional(),connectionConfig:j5.optional()}).strict(),DLr=RBe.extend({type:h.literal("ecs"),cluster:CBe.optional(),services:h.array(TBe).min(1,z.SERVICE.MIN_REQUIRED),docker:Sg.partial().optional()}).strict().refine(e=>{let t=e.services.filter(r=>r.containers?.some(n=>n.port));return t.length>1?t.every(r=>(Array.isArray(r.routing)?r.routing:r.routing?[r.routing]:[]).some(n=>n.path||n.host)):!0},{message:z.SERVICE.ROUTING_REQUIRED}).refine(e=>{let t=e.services.map(r=>r.name);return new Set(t).size===t.length},{message:z.SERVICE.UNIQUE_WITHIN_CLUSTER}),NLr=RBe.extend({type:h.literal("lambda"),timeout:h.number().int(z.LAMBDA.TIMEOUT.INTEGER).min(C5,z.LAMBDA.TIMEOUT.MIN).max(T5,z.LAMBDA.TIMEOUT.MAX).optional(),memory:AO.optional(),handler:h.string().optional(),runtime:EBe.optional(),environment:SO.optional(),secrets:SO.optional(),description:h.string().optional(),functionUrl:h.union([h.object({authType:h.enum(l2).optional()}).strict(),h.literal(!1)]).optional(),eventSources:h.array(wBe).optional()}).strict(),$Lr=RBe.extend({type:h.literal("ec2"),instanceType:vpe.optional(),enableSSH:h.boolean().optional(),keyName:h.string().optional(),userData:h.string().optional(),securityGroups:h.array(h.string()).optional()}).strict(),_Be=h.discriminatedUnion("type",[DLr,NLr,$Lr]),bBe=h.object({path:h.string().min(1,z.REQUIRED.ROUTING_PATH),priority:h.number().int(z.PRIORITY.INTEGER).min(1,z.PRIORITY.MIN).max(5e4,z.PRIORITY.MAX).optional()}).strict(),B5=h.object({name:h.string().min(1,z.REQUIRED.SERVICE_NAME).max(255,z.MAX_LENGTH.SERVICE_NAME).regex(Ht.RESOURCE_NAME,z.RESOURCE_NAME),serviceType:h.enum(u2).optional(),docker:Sg.partial().optional(),containerPort:Nm.optional(),needsDatabaseConnection:h.boolean().optional(),routing:h.union([bBe,h.array(bBe).min(1)]).optional()}).strict().superRefine((e,t)=>{e.serviceType==="worker"&&(e.containerPort!==void 0&&t.addIssue({code:"custom",path:["containerPort"],message:"Worker services are not reachable inbound; remove containerPort."}),e.routing!==void 0&&t.addIssue({code:"custom",path:["routing"],message:"Worker services have no ALB route; remove routing."}))}),U5=h.object({appName:Ta,instanceType:h.string().optional()}).strict()});var bpe,PBe,OBe,Epe,DBe,rRt,NBe,$Be,nRt,Ape,wpe,k2,aRt,MLr,oRt,iRt,sRt,cRt,I2,R2,Nv,MBe,LBe,FBe=w(()=>{"use strict";Lt();fg();D5();Spe();El();$();bpe=h.object({memorySize:AO.optional(),timeout:h.number().int(z.LAMBDA.TIMEOUT.INTEGER).min(1,z.LAMBDA.TIMEOUT.MIN).max(900,z.LAMBDA.TIMEOUT.MAX).optional(),ephemeralStorageSize:h.number().int(z.EPHEMERAL_STORAGE.INTEGER).min(512,z.EPHEMERAL_STORAGE.MIN).max(10240,z.EPHEMERAL_STORAGE.MAX).optional()}).strict(),PBe=h.object({type:h.enum(qde).optional(),databaseName:h.string().optional(),databaseEngine:h.enum(hO).optional(),deletionProtection:h.boolean().optional(),backupRetention:qx.optional(),port:k5.optional(),publiclyAccessible:h.boolean().optional(),allowedIpCidr:h.string().optional(),instanceType:h.string().optional(),allocatedStorage:h.number().int(z.ALLOCATED_STORAGE.INTEGER).min(20,z.ALLOCATED_STORAGE.MIN).max(65536,z.ALLOCATED_STORAGE.MAX).optional(),multiAz:h.boolean().optional(),readReplica:_5.optional(),writer:g2.optional(),readers:y2.optional(),allowVpcAccess:h.boolean().optional(),monitoringInterval:h2.optional(),preferredMaintenanceWindow:h.string().optional(),databaseInsights:P5.optional(),proxy:R5.optional(),credentials:I5.optional(),encryption:O5.optional(),snapshotIdentifier:h.string().optional(),snapshotUsername:h.string().optional()}).strict(),OBe=h.object({server:bpe.optional(),imageOptimisation:bpe.optional(),revalidation:bpe.optional()}).strict(),Epe=h.object({versioned:h.boolean().optional()}).strict(),DBe=h.object({assets:Epe.optional(),cache:Epe.optional(),media:Epe.optional()}).strict(),rRt=h.object({visibilityTimeout:h.number().int(z.SQS.VISIBILITY_TIMEOUT.INTEGER).min(0,z.SQS.VISIBILITY_TIMEOUT.MIN).max(43200,z.SQS.VISIBILITY_TIMEOUT.MAX).optional(),messageRetentionPeriod:h.number().int(z.SQS.RETENTION_PERIOD.INTEGER).min(60,z.SQS.RETENTION_PERIOD.MIN).max(1209600,z.SQS.RETENTION_PERIOD.MAX).optional(),maxMessageSize:h.number().int(z.MAX_MESSAGE_SIZE.INTEGER).min(1024,z.MAX_MESSAGE_SIZE.MIN).max(262144,z.MAX_MESSAGE_SIZE.MAX).optional(),deadLetterQueue:h.union([h.literal(!1),h.object({enabled:h.boolean().optional(),maxReceiveCount:h.number().int(z.DLQ.MAX_RECEIVE_COUNT.INTEGER).min(1,z.DLQ.MAX_RECEIVE_COUNT.MIN).max(1e3,z.DLQ.MAX_RECEIVE_COUNT.MAX).optional()}).strict()]).optional()}).strict(),NBe=h.object({revalidationQueue:rRt.optional()}).strict(),$Be=h.object({domainNames:h.array(h.string()).optional(),certificateArn:h.string().optional()}).strict(),nRt=h.record(h.string().regex(Ht.ENV_VAR_NAME,z.ENV_VAR_NAME),h.string()).optional(),Ape=h.object({type:h.literal("payload"),name:h.string().min(1,z.REQUIRED.PATTERN_NAME),domain:h.string().optional(),database:PBe.optional(),compute:OBe.optional(),storage:DBe.optional(),messaging:NBe.optional(),cdn:$Be.optional(),environment:nRt}).strict(),wpe=h.object({type:h.literal("nextjs"),name:h.string().min(1,z.REQUIRED.PATTERN_NAME),domain:h.string().optional(),database:PBe.optional(),compute:OBe.optional(),storage:DBe.optional(),messaging:NBe.optional(),cdn:$Be.optional(),environment:nRt}).strict(),k2=h.enum(Hu),aRt=h.object({command:h.string().min(1,z.REQUIRED.BUILD_COMMAND),outputDir:h.string().min(1,z.REQUIRED.OUTPUT_DIR)}).strict(),MLr=h.object({maxAgeDays:h.number().optional(),includeSubdomains:h.boolean().optional(),preload:h.boolean().optional()}).strict(),oRt=h.object({headers:h.boolean().optional(),contentSecurityPolicy:h.string().optional(),hsts:h.union([h.literal(!1),MLr]).optional()}).strict(),iRt=h.object({to:h.string().min(1,z.REQUIRED.FORMS_TO).regex(Ht.EMAIL,z.EMAIL),from:h.string().regex(Ht.EMAIL,z.EMAIL).optional(),corsOrigin:h.string().regex(Ht.HTTP_ORIGIN,"corsOrigin must be an exact origin such as https://example.com (no path, no trailing slash)").optional(),maxConcurrency:h.number().int().min(1).max(100).optional()}).strict(),sRt=h.object({behaviours:h.array(h.unknown()).optional(),priceClass:h.enum(xP).optional(),invalidateOnDeploy:h.boolean().optional()}).strict(),cRt=h.object({type:h.literal("basic-auth"),username:h.string().min(1,"accessGate.username must not be empty"),password:h.string().min(1,"accessGate.password must not be empty")}).strict(),I2=h.object({type:h.literal("staticsite"),name:h.string().min(1,z.REQUIRED.PATTERN_NAME),source:h.string().min(1,z.REQUIRED.SOURCE),build:aRt,routing:k2.optional(),security:oRt.optional(),domain:h.string().optional(),zoneName:h.string().optional(),hostedZoneId:h.string().optional(),forms:iRt.optional(),cdn:sRt.optional(),accessGate:cRt.optional()}).strict().superRefine((e,t)=>{if(e.forms===void 0)return;let r=e.domain;if(r===void 0||r===""){t.addIssue({code:"custom",path:["domain"],message:"A domain is required when forms are enabled: SES sends only from a verified identity, and the site's domain is the identity the pattern verifies"});return}let n=e.forms.from;n!==void 0&&!cj(n,r)&&t.addIssue({code:"custom",path:["forms","from"],message:`forms.from must be an address at ${r} (the verified SES identity) \u2014 for example noreply@${r}. Use forms.to for the recipient.`})}),R2=h.discriminatedUnion("type",[Ape,wpe,I2]),Nv=h.enum(["lightweight","standard","resilient","custom"]),MBe=h.object({type:h.enum(qde),instanceType:h.string().optional(),backupRetention:qx.optional(),deletionProtection:h.boolean().optional(),encryption:h.union([h.object({useCMK:h.literal(!0)}).strict(),h.literal(!1)]).optional()}).strict(),LBe=h.object({memorySize:AO.optional(),timeout:h.number().int(z.LAMBDA.TIMEOUT.INTEGER).min(1,z.LAMBDA.TIMEOUT.MIN).max(900,z.LAMBDA.TIMEOUT.MAX).optional()}).strict()});var jBe,LLr,G5,lRt=w(()=>{"use strict";Lt();fg();Dv();D5();ipe();aBe();lpe();sBe();Spe();D5();FBe();jBe=h.object({appName:Ta,type:m2,pattern:f2.optional(),patternConfig:R2.optional(),owner:h.string().optional(),tags:h.record(h.string(),h.string()).optional(),vpcId:h.string().optional(),network:Jx.optional(),backup:L2e.optional(),tunnel:F2e.optional(),additionalNetworks:h.array(rBe).optional(),database:h.array(v2),s3:h.array(b2),compute:h.array(T2),dynamodb:h.array(J2e).optional(),clickhouse:h.array(Z2e).optional(),sqs:h.array(E2).optional(),cdn:A2.optional(),customCodeBlocks:h.array(M2e).optional(),additionalManagedImports:h.array(h.object({moduleSpecifier:h.string(),namedImports:h.array(h.string()),defaultImport:h.string().optional()}).strict()).optional()}).strict(),LLr=h.object({name:Ta,type:m2,pattern:f2.optional(),patternTier:Nv.optional(),patternDomain:h.string().optional(),source:h.string().min(1,z.REQUIRED.SOURCE).optional(),buildCommand:h.string().min(1,z.REQUIRED.BUILD_COMMAND).optional(),outputDir:h.string().min(1,z.REQUIRED.OUTPUT_DIR).optional(),routing:k2.optional(),formsTo:h.string().min(1,z.REQUIRED.FORMS_TO).regex(Ht.EMAIL,z.EMAIL).optional(),corsOrigin:h.string().regex(Ht.HTTP_ORIGIN,"corsOrigin must be an exact origin such as https://example.com (no path, no trailing slash)").optional(),customDatabase:MBe.optional(),customCompute:LBe.optional(),region:h.string().optional(),owner:h.string().optional(),includeDatabase:h.boolean().optional(),databaseName:h.string().min(1,z.DATABASE.NAME.REQUIRED).max(63,z.DATABASE.NAME.MAX_LENGTH).optional(),vpcId:h.string().optional(),network:nBe.optional(),services:h.array(B5).optional(),snapshotIdentifier:h.string().optional(),snapshotUsername:h.string().optional()}).strict().superRefine((e,t)=>{e.formsTo!==void 0&&(e.patternDomain!==void 0&&e.patternDomain!==""||t.addIssue({code:"custom",path:["patternDomain"],message:"A domain is required when forms are enabled: SES sends only from a verified identity, and the site's domain is the identity the pattern verifies"}))}),G5=h.object({name:cr,localResource:h.string().min(1),remoteApp:h.string().min(1),remoteResource:h.string().min(1),permission:h.enum(["read","write","read-write"]),remoteArn:h.string().optional()}).strict()});var uRt,FLr,GBe,UBe,VBe,dRt,pRt,mRt,Cpe,BBe,Tpe,xpe,fRt=w(()=>{"use strict";Lt();fg();Dv();uRt=["fjall-managed","external","external-manual"],FLr=h.enum(uRt),GBe=["AdministratorAccess","ReadOnlyAccess","Billing","ManagementAccountAccess"],UBe=h.object({givenName:h.string().min(1),familyName:h.string().min(1),displayName:h.string().min(1).optional(),expires:h.string().min(1).optional()}).strict(),VBe=h.object({name:h.string().min(1),path:h.string().min(1).optional()}).strict(),dRt=h.union([h.object({managedPolicyArn:h.string().min(1)}).strict(),h.object({customerManagedPolicy:VBe}).strict()]),pRt=h.object({managedPolicies:h.array(h.string().min(1)).optional(),inlinePolicy:h.record(h.string(),h.unknown()).optional(),customerManagedPolicies:h.array(VBe).optional(),permissionsBoundary:dRt.optional(),sessionDuration:h.string().min(1).optional(),description:h.string().optional(),accounts:h.union([h.array(h.string().min(1)),h.literal("all")]).optional(),includeManagementAccount:h.boolean().optional(),groups:h.array(h.string().min(1)).optional()}).strict(),mRt=h.object({description:h.string().optional()}).strict(),Cpe=h.string().regex(Ht.EMAIL,z.EMAIL),BBe={groups:h.record(h.string(),mRt).optional(),permissionSets:h.record(h.string(),pRt).optional(),memberships:h.record(h.string(),h.array(Cpe)).optional(),resolutionVersion:h.number().int().min(1).optional(),defaultPermissionSets:h.boolean().optional()},Tpe=h.discriminatedUnion("source",[h.object({...BBe,source:h.literal("fjall-managed"),users:h.record(Cpe,UBe)}).strict(),h.object({...BBe,source:h.literal("external")}).strict(),h.object({...BBe,source:h.literal("external-manual"),users:h.record(Cpe,UBe).optional()}).strict()]),xpe=h.object({name:cr,type:h.literal("organisation").optional(),organisationName:h.string().min(1).optional(),orgEmail:Cpe.optional(),accounts:h.unknown().optional(),accountIds:h.record(h.string(),h.string()).optional(),identityCentre:h.union([Tpe,h.literal(!1)]).optional(),allowedRegions:h.array(h.string().min(1)).optional()}).strict()});var _2=w(()=>{"use strict";Dv();D5();ipe();aBe();lpe();sBe();Spe();FBe();lRt();Qde();fRt()});function gRt(e){let t=hRt.safeParse(e);if(!t.success){let r=t.error.issues.map(n=>`  - ${n.path.join(".")||"(root)"}: ${n.message}`).join(`
 `);throw new Error(`Buildkite: invalid props:
 ${r}`)}return t.data}var jLr,BLr,ULr,V5,hRt,yRt=w(()=>{"use strict";Lt();jLr=Object.defineProperty,BLr=(e,t)=>jLr(e,"name",{value:t,configurable:!0}),ULr=[1,3,5,7,14,30,60,90,120,150,180,365,400,545,731,1827,3653],V5=h.object({buildkiteQueue:h.string().min(1,"buildkiteQueue cannot be empty").max(100).regex(/^[a-zA-Z0-9-_]+$/,"buildkiteQueue must be alphanumeric with hyphens/underscores"),buildkiteOrgSlug:h.string().min(1,"buildkiteOrgSlug cannot be empty").max(100).regex(/^[a-z0-9-]+$/,"buildkiteOrgSlug must be a lowercase Buildkite organisation slug"),agentTokenSsmParameterName:h.string().min(2).regex(/^\//,"agentTokenSsmParameterName must be a full path (leading /)").optional(),agentTokenKmsKeyArn:h.string().min(1).optional(),fjallApiKeySsmParameterName:h.string().min(2).regex(/^\//,"fjallApiKeySsmParameterName must be a full path (leading /)").optional(),instanceType:h.string().min(1).default("c8g.xlarge"),agentVolumeSizeGib:h.number().int().min(20).max(1e3).default(250),agentMinInstances:h.number().int().min(0).default(0),agentMaxInstances:h.number().int().min(1).default(2),agentsPerInstance:h.number().int().min(1).default(1),spotCapacityPercentage:h.number().int().min(0).max(100).default(0),scaleInIdlePeriodSeconds:h.number().int().min(60).default(600),disconnectAfterUptimeSeconds:h.number().int().min(3600).default(86400),maxInstanceLifetimeDays:h.number().int().min(1).max(365).default(7),terminateInstanceAfterJob:h.boolean().default(!1),purgeBuildsOnDiskFull:h.boolean().default(!0),terminateInstanceOnDiskFull:h.boolean().default(!1),logRetentionDays:h.number().int().min(1).default(30),agentLogRetentionDays:h.literal(ULr).default(7),buildkiteAgentRelease:h.enum(["stable","beta","edge"]).default("stable"),buildkiteAgentTags:h.string().default(""),buildkiteAgentTimestampLines:h.boolean().default(!1),buildkiteAgentExperiments:h.string().default(""),buildkiteAgentTracingBackend:h.enum(["","datadog","opentelemetry"]).default(""),buildkiteAgentCancelGracePeriodSeconds:h.number().int().min(10).default(60),enableSecretsPlugin:h.boolean().default(!0),enableEcrPlugin:h.boolean().default(!1),enableDockerLoginPlugin:h.boolean().default(!1),enableDockerUserNamespaceRemap:h.boolean().default(!0),enableDockerExperimental:h.boolean().default(!1),dockerNetworkingProtocol:h.enum(["ipv4","dualstack"]).default("ipv4"),enableInstanceStorage:h.boolean().default(!1),mountTmpfsAtTmp:h.boolean().default(!0),buildkiteAgentEnableGitMirrors:h.boolean().default(!1),bootstrapScriptUrl:h.string().default(""),agentEnvFileUrl:h.string().default(""),scalerEventSchedulePeriod:h.string().min(1).default("1 minute"),scalerMinPollInterval:h.string().min(1).default("10s"),scaleOutFactor:h.string().min(1).default("1.0"),scaleOutWaitingForJobs:h.boolean().default(!1),rolePermissionsBoundaryArn:h.string().min(1).optional(),alarmSnsTopicArn:h.string().min(1).optional(),applicationId:h.string().min(1).optional(),costAllocationEnvironment:h.string().min(1).optional(),costAllocationOwner:h.string().min(1).optional()}).strict(),hRt=V5.refine(e=>e.agentMinInstances<=e.agentMaxInstances,{message:"agentMinInstances must be <= agentMaxInstances"});BLr(gRt,"validateBuildkiteProps")});function vRt(e){return`FjallDeployBoundary${e}`}var GLr,VLr,WBe,SRt,bRt,WLr,zLr,ERt=w(()=>{"use strict";GLr=Object.defineProperty,VLr=(e,t)=>GLr(e,"name",{value:t,configurable:!0});VLr(vRt,"deployBoundaryName");WBe={Sid:"FjallInheritAdministratorAccess",Effect:"Allow",Action:"*",Resource:"*"},SRt=[{Sid:"FjallDenyOrgAndAccountEscape",Effect:"Deny",Action:["organizations:LeaveOrganization","account:CloseAccount"],Resource:"*"},{Sid:"FjallDenyDisableAuditLogging",Effect:"Deny",Action:["cloudtrail:StopLogging"],Resource:"*"},{Sid:"FjallDenyBoundarySelfEscape",Effect:"Deny",Action:["iam:DeleteRolePermissionsBoundary"],Resource:"*"},{Sid:"FjallDenyDisableKmsKey",Effect:"Deny",Action:["kms:DisableKey"],Resource:"*"}],bRt=[...SRt,{Sid:"FjallDenyStandingHumanCredentials",Effect:"Deny",Action:["iam:CreateUser","iam:CreateLoginProfile","iam:CreateAccessKey","iam:CreateAccountAlias"],Resource:"*"},{Sid:"FjallDenyDisableConfigRecorder",Effect:"Deny",Action:["config:StopConfigurationRecorder"],Resource:"*"}],WLr=[...bRt,{Sid:"FjallDenyAccountPasswordPolicyTamper",Effect:"Deny",Action:["iam:UpdateAccountPasswordPolicy","iam:DeleteAccountPasswordPolicy"],Resource:"*"},{Sid:"FjallDenyDisableDefaultEbsEncryption",Effect:"Deny",Action:["ec2:DisableEbsEncryptionByDefault"],Resource:"*"}],zLr={foundation:[WBe,...SRt],compliance:[WBe,...bRt],hardened:[WBe,...WLr]}});function _pe(e){return`FjallDevDeploy${e}`}function ARt(e){return`FjallDevProvisioner${e}`}function wRt(e){return`FjallDevSyncWriter${e}`}function HBe(e){return`arn:aws:iam::${e}:policy/${CRt}`}function KBe(e){return`org:${e}:dev-provisioner`}function qBe(e){return`org:${e}:dev-sync`}function kpe(e,t){return`org:${e}:acct:${t}`}function Ipe(e){return`org:${e}:*`}function YBe(e,t){return`org:${e}:${t}`}function xRt(e){let{fjallOrgId:t,providerArn:r,issuerDomain:n,accountTier:a,accountId:o}=e,i=e.machineTrustMode??"expanded",s={[`${n}:aud`]:P2},c;if(i==="account-scoped"){if(a===void 0||!yP(a)||o===void 0)throw new Error(`machineTrustMode "account-scoped" requires a governance accountTier and an accountId (got tier: ${String(a)}, accountId ${o===void 0?"absent":"present"}) \u2014 refusing to fall back to the generic machine subject: a silent fallback would re-widen the trust the \xA74.4a Step-3 contract removes`);c=[kpe(t,o)]}else o!==void 0?c=[Ipe(t),kpe(t,o)]:c=Ipe(t);return[{Sid:"FjallMachineSubject",Effect:"Allow",Principal:{Federated:r},Action:"sts:AssumeRoleWithWebIdentity",Condition:{StringEquals:{...s,[`${n}:sub`]:c}}},{Sid:"FjallUserSubjects",Effect:"Allow",Principal:{Federated:r},Action:"sts:AssumeRoleWithWebIdentity",Condition:{StringEquals:s,StringLike:{[`${n}:sub`]:`org:${t}:user:*`}}},{Sid:"FjallServiceSubjects",Effect:"Allow",Principal:{Federated:r},Action:"sts:AssumeRoleWithWebIdentity",Condition:{StringEquals:{...s,[`${n}:sub`]:TRt.map(l=>YBe(t,l))}}}]}function kRt(e){let{fjallOrgId:t,providerArn:r,issuerDomain:n,accountId:a}=e;return[{Sid:"FjallDevSubjectsThisAccount",Effect:"Allow",Principal:{Federated:r},Action:"sts:AssumeRoleWithWebIdentity",Condition:{StringEquals:{[`${n}:aud`]:P2},StringLike:{[`${n}:sub`]:`org:${t}:dev:${a}:*`}}}]}function JBe(e){let{providerArn:t,issuerDomain:r,sid:n,subject:a}=e;return[{Sid:n,Effect:"Allow",Principal:{Federated:t},Action:"sts:AssumeRoleWithWebIdentity",Condition:{StringEquals:{[`${r}:aud`]:P2,[`${r}:sub`]:a}}}]}function IRt(e){return JBe({...e,sid:"FjallDevProvisionerSubject",subject:KBe(e.fjallOrgId)})}function RRt(e){return JBe({...e,sid:"FjallDevSyncSubject",subject:qBe(e.fjallOrgId)})}function _Rt({accountId:e}){return[{Sid:"FjallDevEcsTaggedMutations",Effect:"Allow",Action:["ecs:UpdateService","ecs:DeleteService","ecs:RunTask","ecs:StopTask"],Resource:`arn:aws:ecs:*:${e}:*`,Condition:{StringEquals:{"aws:ResourceTag/fjall:dev":"true"}}},{Sid:"FjallDevEcsTaggedCreates",Effect:"Allow",Action:["ecs:RegisterTaskDefinition","ecs:CreateService"],Resource:"*",Condition:{StringEquals:{"aws:RequestTag/fjall:dev":"true"}}},{Sid:"FjallDevEcsTagOnCreate",Effect:"Allow",Action:["ecs:TagResource"],Resource:`arn:aws:ecs:*:${e}:*`,Condition:{StringEquals:{"ecs:CreateAction":["RegisterTaskDefinition","CreateService","RunTask"]}}},{Sid:"FjallDevEcsReads",Effect:"Allow",Action:["ecs:Describe*","ecs:List*"],Resource:"*"},{Sid:"FjallDevEcsDeregisterTaskDefinition",Effect:"Allow",Action:["ecs:DeregisterTaskDefinition"],Resource:`arn:aws:ecs:*:${e}:task-definition/fjall-dev-*`},{Sid:"FjallDevElbTaggedMutations",Effect:"Allow",Action:["elasticloadbalancing:ModifyRule","elasticloadbalancing:DeleteRule","elasticloadbalancing:ModifyTargetGroup","elasticloadbalancing:ModifyTargetGroupAttributes","elasticloadbalancing:DeleteTargetGroup","elasticloadbalancing:RegisterTargets","elasticloadbalancing:DeregisterTargets"],Resource:`arn:aws:elasticloadbalancing:*:${e}:*`,Condition:{StringEquals:{"aws:ResourceTag/fjall:dev":"true"}}},{Sid:"FjallDevElbTaggedCreates",Effect:"Allow",Action:["elasticloadbalancing:CreateTargetGroup","elasticloadbalancing:CreateRule"],Resource:`arn:aws:elasticloadbalancing:*:${e}:*`,Condition:{StringEquals:{"aws:RequestTag/fjall:dev":"true"}}},{Sid:"FjallDevElbTagOnCreate",Effect:"Allow",Action:["elasticloadbalancing:AddTags"],Resource:`arn:aws:elasticloadbalancing:*:${e}:*`,Condition:{StringEquals:{"elasticloadbalancing:CreateAction":["CreateTargetGroup","CreateRule"]}}},{Sid:"FjallDevElbReads",Effect:"Allow",Action:["elasticloadbalancing:Describe*"],Resource:"*"},{Sid:"FjallDevSsmDevTree",Effect:"Allow",Action:["ssm:GetParameter*","ssm:PutParameter","ssm:AddTagsToResource"],Resource:`arn:aws:ssm:*:${e}:parameter/fjall/dev/*`},{Sid:"FjallDevLogsMutations",Effect:"Allow",Action:["logs:PutRetentionPolicy","logs:DeleteLogGroup"],Resource:`arn:aws:logs:*:${e}:log-group:/fjall/dev/*`},{Sid:"FjallDevLogsTaggedCreate",Effect:"Allow",Action:["logs:CreateLogGroup","logs:TagResource"],Resource:`arn:aws:logs:*:${e}:log-group:/fjall/dev/*`,Condition:{StringEquals:{"aws:RequestTag/fjall:dev":"true"}}},{Sid:"FjallDevLogsRead",Effect:"Allow",Action:["logs:GetLogEvents","logs:DescribeLogStreams","logs:FilterLogEvents"],Resource:`arn:aws:logs:*:${e}:log-group:/fjall/dev/*`},{Sid:"FjallDevLogsDescribeGroups",Effect:"Allow",Action:["logs:DescribeLogGroups"],Resource:"*"},{Sid:"FjallDevKmsViaDevAlias",Effect:"Allow",Action:["kms:Encrypt","kms:Decrypt","kms:GenerateDataKey"],Resource:`arn:aws:kms:*:${e}:key/*`,Condition:{"ForAnyValue:StringLike":{"kms:ResourceAliases":"alias/fjall-dev-*"}}},{Sid:"FjallDevKmsSsmSecureString",Effect:"Allow",Action:["kms:Encrypt","kms:Decrypt","kms:GenerateDataKey"],Resource:`arn:aws:kms:*:${e}:key/*`,Condition:{StringLike:{"kms:ViaService":"ssm.*.amazonaws.com"}}},{Sid:"FjallDevEcrAuthToken",Effect:"Allow",Action:["ecr:GetAuthorizationToken"],Resource:"*"},{Sid:"FjallDevEcrPushPull",Effect:"Allow",Action:["ecr:PutImage","ecr:InitiateLayerUpload","ecr:UploadLayerPart","ecr:CompleteLayerUpload","ecr:BatchCheckLayerAvailability","ecr:BatchGetImage","ecr:GetDownloadUrlForLayer","ecr:DescribeImages"],Resource:`arn:aws:ecr:*:${e}:repository/*`},{Sid:"FjallDevPassDevPathRoles",Effect:"Allow",Action:["iam:PassRole"],Resource:`arn:aws:iam::${e}:role/fjall/dev/*`}]}function PRt({accountId:e}){return[{Sid:"FjallDevProvisionerBoundedRoleWrites",Effect:"Allow",Action:["iam:CreateRole","iam:PutRolePolicy","iam:AttachRolePolicy"],Resource:`arn:aws:iam::${e}:role/fjall/dev/*`,Condition:{StringEquals:{"iam:PermissionsBoundary":HBe(e)}}},{Sid:"FjallDevProvisionerPathRoleOps",Effect:"Allow",Action:["iam:DeleteRole","iam:DeleteRolePolicy","iam:DetachRolePolicy","iam:ListRolePolicies","iam:TagRole"],Resource:`arn:aws:iam::${e}:role/fjall/dev/*`},{Sid:"FjallDevProvisionerListRoles",Effect:"Allow",Action:["iam:ListRoles"],Resource:"*"},{Sid:"FjallDevProvisionerDevMasterSecrets",Effect:"Allow",Action:["secretsmanager:GetSecretValue"],Resource:`arn:aws:secretsmanager:*:${e}:secret:fjall-dev-*`},{Sid:"FjallDevProvisionerKmsDecryptViaSecretsManager",Effect:"Allow",Action:["kms:Decrypt"],Resource:`arn:aws:kms:*:${e}:key/*`,Condition:{StringLike:{"kms:ViaService":"secretsmanager.*.amazonaws.com"}}},{Sid:"FjallDevProvisionerDataApi",Effect:"Allow",Action:["rds-data:ExecuteStatement","rds-data:BatchExecuteStatement","rds-data:BeginTransaction","rds-data:CommitTransaction","rds-data:RollbackTransaction"],Resource:`arn:aws:rds:*:${e}:cluster:fjall-dev-*`},{Sid:"FjallDevProvisionerMetrics",Effect:"Allow",Action:["cloudwatch:GetMetricData"],Resource:"*"},{Sid:"FjallDevProvisionerOrphanDiscovery",Effect:"Allow",Action:["tag:GetResources"],Resource:"*"},{Sid:"FjallDevProvisionerSsmTeardown",Effect:"Allow",Action:["ssm:DeleteParameter*"],Resource:`arn:aws:ssm:*:${e}:parameter/fjall/dev/*`},{Sid:"FjallDevProvisionerLogsTeardown",Effect:"Allow",Action:["logs:DeleteLogGroup"],Resource:`arn:aws:logs:*:${e}:log-group:/fjall/dev/*`},{Sid:"FjallDevProvisionerTaggedTeardown",Effect:"Allow",Action:["ecs:UpdateService","ecs:StopTask","ecs:DeleteService","elasticloadbalancing:DeleteRule","elasticloadbalancing:DeleteTargetGroup","elasticloadbalancing:DeregisterTargets"],Resource:[`arn:aws:ecs:*:${e}:*`,`arn:aws:elasticloadbalancing:*:${e}:*`],Condition:{StringEquals:{"aws:ResourceTag/fjall:dev":"true"}}},{Sid:"FjallDevProvisionerTeardownReads",Effect:"Allow",Action:["ecs:Describe*","elasticloadbalancing:Describe*"],Resource:"*"},{Sid:"FjallDevProvisionerImageJanitor",Effect:"Allow",Action:["ecr:ListImages","ecr:DescribeImages","ecr:BatchDeleteImage"],Resource:`arn:aws:ecr:*:${e}:repository/*`},{Sid:"FjallDevProvisionerSsmReadAll",Effect:"Allow",Action:["ssm:GetParameter*"],Resource:`arn:aws:ssm:*:${e}:parameter/*`},{Sid:"FjallDevProvisionerKmsDecryptViaSsm",Effect:"Allow",Action:["kms:Decrypt"],Resource:`arn:aws:kms:*:${e}:key/*`,Condition:{StringLike:{"kms:ViaService":"ssm.*.amazonaws.com"}}}]}function ORt({accountId:e}){return[{Sid:"FjallDevSyncPrefixReadWrite",Effect:"Allow",Action:["s3:GetObject","s3:PutObject"],Resource:`arn:aws:s3:::fjall-dev-sync-${e}-*/*`,Condition:{StringEquals:{"aws:ResourceAccount":e}}}]}function DRt({accountId:e}){return[{Sid:"FjallDevBoundarySsmDevRead",Effect:"Allow",Action:["ssm:GetParameter*"],Resource:`arn:aws:ssm:*:${e}:parameter/fjall/dev/*`},{Sid:"FjallDevBoundaryKmsDecryptDevAlias",Effect:"Allow",Action:["kms:Decrypt"],Resource:`arn:aws:kms:*:${e}:key/*`,Condition:{"ForAnyValue:StringLike":{"kms:ResourceAliases":"alias/fjall-dev-*"}}},{Sid:"FjallDevBoundarySyncPrefixReadWrite",Effect:"Allow",Action:["s3:GetObject","s3:PutObject"],Resource:`arn:aws:s3:::fjall-dev-sync-${e}-*/*`,Condition:{StringEquals:{"aws:ResourceAccount":e}}},{Sid:"FjallDevBoundarySlotLogs",Effect:"Allow",Action:["logs:CreateLogStream","logs:PutLogEvents"],Resource:`arn:aws:logs:*:${e}:log-group:/fjall/dev/*`},{Sid:"FjallDevBoundarySyncQueue",Effect:"Allow",Action:["sqs:ReceiveMessage","sqs:DeleteMessage","sqs:GetQueueUrl"],Resource:`arn:aws:sqs:*:${e}:fjall-dev-sync-${e}-*`}]}var HLr,Al,Rpe,P2,zBe,KLr,qLr,YLr,CRt,TRt,NRt=w(()=>{"use strict";$();HLr=Object.defineProperty,Al=(e,t)=>HLr(e,"name",{value:t,configurable:!0}),Rpe="fjall.io",P2="sts.amazonaws.com",zBe="0000000000000000000000000000000000000000";Al(_pe,"devDeployRoleName");Al(ARt,"devProvisionerRoleName");Al(wRt,"devSyncWriterRoleName");KLr="FjallDevDeployPolicy",qLr="FjallDevProvisionerPolicy",YLr="FjallDevSyncWriterPolicy",CRt="FjallDevBoundary";Al(HBe,"devBoundaryPolicyArn");Al(KBe,"devProvisionerSubject");Al(qBe,"devSyncSubject");Al(kpe,"deployAccountSubject");Al(Ipe,"genericMachineSubject");TRt=["discovery","connection","org-setup","dev-substrate-setup"];Al(YBe,"serviceSubject");Al(xRt,"buildNarrowedDeployTrustStatements");Al(kRt,"buildDevDeployTrustStatements");Al(JBe,"buildServiceSubjectTrustStatements");Al(IRt,"buildDevProvisionerTrustStatements");Al(RRt,"buildDevSyncWriterTrustStatements");Al(_Rt,"buildDevDeployPolicyStatements");Al(PRt,"buildDevProvisionerPolicyStatements");Al(ORt,"buildDevSyncWriterPolicyStatements");Al(DRt,"buildDevBoundaryStatements")});var Ppe=w(()=>{"use strict";_2();yRt();El();ERt();NRt();upe()});function Rr(e){return JSON.stringify(e)}function W5(e){return e.map(Rr).join(", ")}function wO(e="    "){return`
@@ -445,7 +445,7 @@ app.${B2.appMethod}(
     accessGate: ${$a(e.cdn.accessGate,"    ")}`),r+=ac(e.cdn.extraProperties),r+=`
   })
 );
-`,r}function dB(e){let t=new Set;if(e.cdn&&(e.cdn.defaultOriginRef&&t.add(e.cdn.defaultOriginRef),e.cdn.behaviours))for(let r of e.cdn.behaviours)t.add(r.originRef);return t}function BO(e){return e.patternConfig!==void 0}var fUr,kg,O8,A4e=w(()=>{"use strict";Ai();oc();El();lme();pme();Zx();U2();OOt();fUr=Object.defineProperty,kg=(e,t)=>fUr(e,"name",{value:t,configurable:!0}),O8="fjall:costAllocation:owner";kg(DOt,"isEmptyObject");kg(E4e,"cleanNetworkConfig");kg(lB,"generateNetworkCode");kg(D8,"generateTags");kg(uB,"generateAppInit");kg(NOt,"collectComputeImports");kg(N8,"generateImports");kg($Ot,"cdnDefaultOriginNeedsAlbLane");kg($8,"generateCDNCode");kg(dB,"collectCdnReferencedResources");kg(BO,"usesPatternApproach")});var w4e=w(()=>{"use strict";oc();Zx();Jb();ame();ime();sme();oOt();sOt();A4e()});function Eme(e,t){return pu[e].database[t]}function MOt(e){return pu[e].compute.ecs}function vC(e){return pu[e].network}function x4e(e){return Ei.filter(t=>pu[t].database[e]!==null)}function LOt(e){return x4e(e).map(t=>({label:pu[t].displayName,value:t,description:pu[t].description}))}function pB(e){switch(e){case"tinkerer":case"lightweight":case"standard":return"Instance";case"resilient":case"enterprise":return"Aurora"}}function Ame(e,t){let r=pu[e].compute.ecs,n=r.services[0],a=!r.cluster?.directAccess&&r.cluster?.loadBalancer!==!1,o=t.filter(s=>s.serviceType!=="worker").length,i=t.findIndex(s=>s.serviceType!=="worker");return t.map((s,c)=>{let l=c===i,u=s.serviceType==="worker",d;return a&&!u&&(s.routing?d=s.routing:o>1&&(d={path:l?"/*":`/${s.name.toLowerCase()}/*`,...l?{}:{priority:100+c}})),{name:s.name,capacityProvider:n.capacityProvider,ec2Config:n.ec2Config,cpu:n.cpu,memoryLimitMiB:n.memoryLimitMiB,desiredCount:n.desiredCount,minCapacity:n.minCapacity,maxCapacity:n.maxCapacity,routing:d}})}var hUr,UO,M8,C4e,T4e,pu,wme=w(()=>{"use strict";fO();fO();hUr=Object.defineProperty,UO=(e,t)=>hUr(e,"name",{value:t,configurable:!0}),M8="service",C4e="cron(0 4 * * ? *)",T4e="cron(0 5 * * ? *)",pu=Object.freeze({tinkerer:{displayName:"Tinkerer",description:"Free tier eligible, minimal cost for experimentation",database:{Instance:{instanceType:"t4g.micro",multiAz:!1,proxy:!1,readReplica:!1,publiclyAccessible:!0},Aurora:null,GlobalAurora:null,ClickHouse:null},compute:{ecs:{services:[{name:M8,capacityProvider:"EC2",desiredCount:1,minCapacity:1,maxCapacity:1,ec2Config:{instanceType:"t4g.micro",amiHardwareType:"ARM",minCapacity:1,maxCapacity:1,memoryLimitMiB:400}}],cluster:{directAccess:!0}},lambda:{timeout:30,memory:128}},network:{maxAzs:2,natGateways:!1,flowLogs:!1},backup:!1},lightweight:{displayName:"Lightweight",description:"Streamlined single-AZ deployment for cost efficiency",database:{Instance:{instanceType:"t4g.small",multiAz:!1},Aurora:{readers:!1},GlobalAurora:null,ClickHouse:null},compute:{ecs:{services:[{name:M8,capacityProvider:"FARGATE_SPOT",cpu:256,memoryLimitMiB:512,desiredCount:1,minCapacity:1,maxCapacity:3}]},lambda:{timeout:30,memory:256}},network:{maxAzs:2,natGateways:{count:1},flowLogs:!1},backup:!1},standard:{displayName:"Standard",description:"Production-ready with sensible defaults",database:{Instance:{instanceType:"t4g.large"},Aurora:{readers:{count:1}},GlobalAurora:{readers:{count:1}},ClickHouse:{instanceType:"t4g.medium",coldTier:{mode:"s3"},optimiseSchedule:C4e,backupSchedule:T4e,backupRetentionDays:14}},compute:{ecs:{services:[{name:M8,capacityProvider:"FARGATE",cpu:512,memoryLimitMiB:1024,desiredCount:2,minCapacity:2,maxCapacity:5}]},lambda:{timeout:60,memory:256}},network:{maxAzs:3,natGateways:{count:1},flowLogs:{},vpcEndpoints:{interface:{ecr:!0}}},backup:!1},resilient:{displayName:"Resilient",description:"High availability with enhanced monitoring and scaling",database:{Instance:{instanceType:"r7g.large",encryption:{storageKey:{useCMK:!0}},databaseInsights:{mode:"advanced",encryptionKey:{useCMK:!0}},proxy:{requireTLS:!0}},Aurora:{readers:{count:2},encryption:{storageKey:{useCMK:!0}},databaseInsights:{mode:"advanced",encryptionKey:{useCMK:!0}},proxy:{requireTLS:!0},backupRetention:30},GlobalAurora:{readers:{count:2},encryption:{storageKey:{useCMK:!0}},databaseInsights:{mode:"advanced",encryptionKey:{useCMK:!0}},proxy:{requireTLS:!0},backupRetention:30,enableGlobalWriteForwarding:!0},ClickHouse:{instanceType:"m7g.large",coldTier:{mode:"s3"},optimiseSchedule:C4e,backupSchedule:T4e,backupRetentionDays:14}},compute:{ecs:{services:[{name:M8,capacityProvider:"FARGATE",cpu:1024,memoryLimitMiB:2048,desiredCount:4,minCapacity:4,maxCapacity:20}]},lambda:{timeout:120,memory:512}},network:{maxAzs:3,natGateways:{count:3},flowLogs:{retentionDays:90},vpcEndpoints:{interface:{ecr:!0,secretsManager:!0}}},backup:{tier:"resilient"}},enterprise:{displayName:"Enterprise",description:"Maximum capability with all features enabled",database:{Instance:{instanceType:"r7g.xlarge",encryption:{storageKey:{useCMK:!0}},databaseInsights:{mode:"advanced",encryptionKey:{useCMK:!0}},proxy:{requireTLS:!0},readReplica:{}},Aurora:{readers:{count:2},encryption:{storageKey:{useCMK:!0}},databaseInsights:{mode:"advanced",encryptionKey:{useCMK:!0}},proxy:{requireTLS:!0},backupRetention:35},GlobalAurora:{readers:{count:2},encryption:{storageKey:{useCMK:!0}},databaseInsights:{mode:"advanced",encryptionKey:{useCMK:!0}},proxy:{requireTLS:!0},backupRetention:35,enableGlobalWriteForwarding:!0},ClickHouse:{instanceType:"m7g.xlarge",coldTier:{mode:"s3"},optimiseSchedule:C4e,backupSchedule:T4e,backupRetentionDays:30}},compute:{ecs:{services:[{name:M8,capacityProvider:"FARGATE",cpu:2048,memoryLimitMiB:4096,desiredCount:6,minCapacity:6,maxCapacity:100}]},lambda:{timeout:300,memory:1024}},network:{maxAzs:3,natGateways:{count:3},flowLogs:{destination:"s3",retentionDays:365},vpcEndpoints:{interface:{ecr:!0,secretsManager:!0,kms:!0,cloudwatchLogs:!0}}},backup:{tier:"enterprise"}}});UO(Eme,"getDatabasePreset");UO(MOt,"getEcsPreset");UO(vC,"getNetworkPreset");UO(x4e,"getAvailableTiersForDatabase");UO(LOt,"getTierOptionsForDatabase");UO(pB,"getDefaultDatabaseTypeForTier");UO(Ame,"applyTierDefaultsToServices")});function L8(e){return Ig[e]}function F8(){return[{label:Ig.standard.displayName,value:"standard",description:Ig.standard.description},{label:Ig.lightweight.displayName,value:"lightweight",description:Ig.lightweight.description},{label:Ig.resilient.displayName,value:"resilient",description:Ig.resilient.description},{label:"Custom",value:"custom",description:"Full control \xB7 Configure everything"}]}function j8(e){return yUr.has(e)}var gUr,k4e,mB,FOt,Ig,yUr,I4e=w(()=>{"use strict";gUr=Object.defineProperty,k4e=(e,t)=>gUr(e,"name",{value:t,configurable:!0}),mB=["lightweight","standard","resilient"],FOt=[...mB,"custom"],Ig=Object.freeze({lightweight:{displayName:"Lightweight",description:"Cost-effective \xB7 Instance DB, minimal Lambda",database:{type:"Instance",instanceType:"t4g.small",backupRetention:7,deletionProtection:!1},compute:{memorySize:512,timeout:30},network:{maxAzs:2,natGateways:{count:1},flowLogs:!1},backup:!1},standard:{displayName:"Standard",description:"Production-ready \xB7 Instance DB, balanced Lambda",database:{type:"Instance",instanceType:"t4g.large",backupRetention:14,deletionProtection:!0},compute:{memorySize:1536,timeout:60},network:{maxAzs:3,natGateways:{count:1},flowLogs:{}},backup:{tier:"standard"}},resilient:{displayName:"Resilient",description:"High-availability \xB7 Aurora V2, KMS encryption",database:{type:"Aurora",backupRetention:30,deletionProtection:!0,encryption:{useCMK:!0}},compute:{memorySize:2048,timeout:120},network:{maxAzs:3,natGateways:{count:3},flowLogs:{retentionDays:90}},backup:{tier:"resilient"}}});k4e(L8,"getPatternTierPreset");k4e(F8,"getPatternTierOptions");yUr=new Set(mB);k4e(j8,"isPatternTierName")});function R4e(e){return{...sk[e]}}function _4e(){return[{label:"Standard",value:"standard"},{label:"Assets",value:"assets"},{label:"Upload",value:"upload"},{label:"Website Hosting",value:"website"}]}var vUr,jOt,sk,P4e=w(()=>{"use strict";vUr=Object.defineProperty,jOt=(e,t)=>vUr(e,"name",{value:t,configurable:!0}),sk=Object.freeze({standard:{},assets:{versioned:!0,deployment:{source:"./assets"}},upload:{versioned:!0,cors:[{allowedOrigins:["*"],allowedMethods:["GET","PUT","POST"]}]},website:{publicReadAccess:!0,websiteHosting:{indexDocument:"index.html",errorDocument:"error.html"}}});jOt(R4e,"getStoragePreset");jOt(_4e,"getStoragePresetOptions")});var BOt=w(()=>{"use strict";wme();I4e();P4e()});import*as mn from"typescript";function ga(e){let t={};for(let r of e.properties){if(!mn.isPropertyAssignment(r))continue;let n=mn.isIdentifier(r.name)||mn.isStringLiteral(r.name)?r.name.text:void 0;n!==void 0&&(t[n]=ck(r.initializer))}return t}function ck(e){if(mn.isStringLiteral(e))return e.text;if(mn.isNumericLiteral(e))return Number(e.text);if(e.kind===mn.SyntaxKind.TrueKeyword)return!0;if(e.kind===mn.SyntaxKind.FalseKeyword)return!1;if(mn.isArrayLiteralExpression(e))return e.elements.map(t=>ck(t));if(mn.isObjectLiteralExpression(e))return ga(e);if(mn.isIdentifier(e))return{__identifier:e.text};if(mn.isPropertyAccessExpression(e))return{__expression:e.getText()};if(mn.isCallExpression(e))return{__call:e.getText()};if(mn.isBinaryExpression(e)&&e.operatorToken.kind===mn.SyntaxKind.BarBarToken){let t=ck(e.left),r=ck(e.right);return typeof r=="string"?r:t}else if(mn.isConditionalExpression(e)){let t=ck(e.whenTrue),r=ck(e.whenFalse);return typeof r=="string"||typeof r=="number"?r:t}else if(mn.isTemplateExpression(e)||mn.isNoSubstitutionTemplateLiteral(e))return{__expression:e.getText()};return{__unknown:e.getText()}}function B8(e,t){return ah(e,r=>{if(mn.isVariableStatement(r)){for(let n of r.declarationList.declarations)if(mn.isIdentifier(n.name)&&n.name.text===t&&n.initializer){if(mn.isStringLiteral(n.initializer))return n.initializer.text;if(mn.isObjectLiteralExpression(n.initializer)){let a=ga(n.initializer);return JSON.stringify(a)}}}})}function O4e(e,t){return ah(e,r=>{if(mn.isVariableStatement(r)){for(let n of r.declarationList.declarations)if(mn.isIdentifier(n.name)&&n.name.text===t&&n.initializer&&mn.isObjectLiteralExpression(n.initializer))return ga(n.initializer)}})}function U8(e,t){if(!mn.isIdentifier(t.expression))return;let r=O4e(e,t.expression.text),n=t.name.text;if(r&&r[n]!==void 0)return String(r[n])}function Cme(e,t){let r=t.head.text;for(let n of t.templateSpans){if(mn.isIdentifier(n.expression)){let a=B8(e,n.expression.text);if(a)r+=a;else return t.getText(e).replace(/^`|`$/g,"")}else if(mn.isPropertyAccessExpression(n.expression)){let a=U8(e,n.expression);if(a)r+=a;else return t.getText(e).replace(/^`|`$/g,"")}else return t.getText(e).replace(/^`|`$/g,"");r+=n.literal.text}return r}var SUr,fB,UOt=w(()=>{"use strict";Lc();SUr=Object.defineProperty,fB=(e,t)=>SUr(e,"name",{value:t,configurable:!0});fB(ga,"parseObjectLiteral");fB(ck,"evaluateExpression");fB(B8,"findVariableValue");fB(O4e,"findObjectDeclaration");fB(U8,"evaluatePropertyAccess");fB(Cme,"resolveTemplateLiteral")});import*as Fc from"typescript";function oh(e){return typeof e=="object"&&e!==null&&!Array.isArray(e)}function rE(e){return oh(e)&&"__identifier"in e}function SC(e){return oh(e)&&"__expression"in e}function Rg(e){return oh(e)&&"__call"in e}function er(e){return oh(e)&&!("__identifier"in e)&&!("__expression"in e)&&!("__call"in e)&&!("__unknown"in e)}function De(e){return typeof e=="string"?e:void 0}function Kt(e){return typeof e=="number"?e:void 0}function cn(e){return typeof e=="boolean"?e:void 0}function gs(e){if(!Array.isArray(e))return;let t=[];for(let r of e){if(typeof r!="string")return;t.push(r)}return t.length>0?t:void 0}function fn(e,t){let r=De(e);if(r!==void 0)return op(t,r)?r:void 0}function Bm(e){let t={};for(let[r,n]of Object.entries(e))n!==void 0&&(t[r]=n);return t}function Tme(e){if(e===null)return"null";if(e===void 0)return"undefined";if(typeof e=="string")return JSON.stringify(e);if(typeof e=="number"||typeof e=="boolean")return String(e);if(Array.isArray(e))return`[${e.map(Tme).join(", ")}]`;if(!oh(e))return String(e);if(rE(e))return e.__identifier;if(SC(e))return e.__expression;if(Rg(e))return e.__call;if("__unknown"in e&&typeof e.__unknown=="string")return e.__unknown;let t=Object.entries(e);return t.length===0?"{}":`{ ${t.map(([r,n])=>`${r}: ${Tme(n)}`).join(", ")} }`}function zi(e,t){let r=[];for(let[n,a]of Object.entries(e))t.has(n)||a===void 0||r.push({key:n,sourceText:Tme(a)});return r}function lk(e,t){return Fc.isPropertyAssignment(e)&&Fc.isIdentifier(e.name)&&e.name.text===t}function nE(e){return Fc.isCallExpression(e)&&Fc.isPropertyAccessExpression(e.expression)&&e.expression.name.text==="getApp"&&Fc.isIdentifier(e.expression.expression)&&e.expression.expression.text==="App"}function mu(e,t){let{expression:r}=e;return Fc.isPropertyAccessExpression(r)&&r.name.text===t&&e.arguments.length>0}function ah(e,t){let r,n=Ro(a=>{r===void 0&&(r=t(a),r===void 0&&Fc.forEachChild(a,n))},"visit");return n(e),r}function Yu(e,t){let r=[],n=Ro(a=>{let o=t(a);o!==null&&r.push(o),Fc.forEachChild(a,n)},"visit");return n(e),r}function lp(e,t){return Fc.isCallExpression(e)&&Fc.isPropertyAccessExpression(e.expression)&&e.expression.name.text==="build"&&Fc.isIdentifier(e.expression.expression)&&e.expression.expression.text===t}function ih(e){let t=e.parent;if(Fc.isVariableDeclaration(t)&&Fc.isIdentifier(t.name))return t.name.text}function hB(e){if(e!=null){if(e===!1)return!1;if(typeof e=="object"&&!Array.isArray(e))return e}}function Fv(e,t){return e===!1?!1:er(e)?t(e):void 0}function Ju(e,t){return er(e)?t(e):void 0}function sh(e,t,r){let n=e[t];return er(n)?r(n):void 0}var bUr,Ro,_g,Lc=w(()=>{"use strict";El();UOt();bUr=Object.defineProperty,Ro=(e,t)=>bUr(e,"name",{value:t,configurable:!0});Ro(oh,"isPlainObject");Ro(rE,"isIdentifierRef");Ro(SC,"isExpressionRef");Ro(Rg,"isCallRef");Ro(er,"isParsedObject");Ro(De,"asString");Ro(Kt,"asNumber");Ro(cn,"asBoolean");Ro(gs,"asStringArray");Ro(fn,"asStringUnion");Ro(Bm,"omitUndefined");Ro(Tme,"parsedValueToSourceText");Ro(zi,"captureExtraProperties");Ro(lk,"isNamedProperty");Ro(nE,"isAppGetAppCall");Ro(mu,"isFactoryMethodCall");Ro(ah,"findFirstInAst");Ro(Yu,"collectFromAst");Ro(lp,"isFactoryBuildCall");Ro(ih,"extractVariableName");_g=Ro(()=>e=>e,"typed");Ro(hB,"asObjectOrFalse");Ro(Fv,"parseBooleanOrConfig");Ro(Ju,"parseOptionalConfig");Ro(sh,"extractSubConfig")});function G8(e){return e!==void 0&&oh(e)}function GOt(e){if(!er(e))return;let t={};for(let[r,n]of Object.entries(e))if(er(n)){let a=De(n.id),o=De(n.name);a&&o&&(t[r]={id:a,name:o,field:De(n.field)})}return Object.keys(t).length>0?t:void 0}function VOt(e){if(!er(e))return;let t=gs(e.command);if(!(!t||t.length===0))return{command:t,interval:Kt(e.interval),timeout:Kt(e.timeout),retries:Kt(e.retries),startPeriod:Kt(e.startPeriod)}}function WOt(e){let t=zi(e,new Set(["name","image","port","environment","essential","command","entryPoint","secretsImport","secrets","healthCheck"]));return{name:De(e.name),image:De(e.image),port:Kt(e.port),environment:G8(e.environment)?e.environment:void 0,essential:cn(e.essential),command:gs(e.command),entryPoint:gs(e.entryPoint),secretsImport:GOt(e.secretsImport),ssmSecrets:gs(e.secrets),healthCheck:VOt(e.healthCheck),extraProperties:t.length>0?t:void 0}}function zOt(e){if(Array.isArray(e))return e.filter(er).map(t=>({path:De(t.path),host:De(t.host),priority:Kt(t.priority),healthCheckPath:De(t.healthCheckPath)}));if(er(e))return{path:De(e.path),host:De(e.host),priority:Kt(e.priority),healthCheckPath:De(e.healthCheckPath)}}function HOt(e){if(e===!1)return!1;if(er(e))return{minCapacity:Kt(e.minCapacity),maxCapacity:Kt(e.maxCapacity),desiredCount:Kt(e.desiredCount),scalingType:fn(gB(e.scalingType,"ScalingType"),E5)}}function KOt(e){if(!er(e))return;let t=e.warmPool,r=er(t)?{minSize:Kt(t.minSize),reuseOnScaleIn:cn(t.reuseOnScaleIn)}:void 0,n=zi(e,AUr);return{instanceType:De(e.instanceType),amiHardwareType:fn(e.amiHardwareType,A5),minCapacity:Kt(e.minCapacity),maxCapacity:Kt(e.maxCapacity),memoryLimitMiB:Kt(e.memoryLimitMiB),warmPool:r,extraProperties:n.length>0?n:void 0}}function D4e(e){if(!er(e))return;let t=e.loadBalancer,r=zi(e,wUr);return{domain:De(e.domain),loadBalancer:t===!1?!1:fn(t,b5),directAccess:cn(e.directAccess),...r.length>0&&{extraProperties:r}}}function N4e(e){let t=e.containers,r=Array.isArray(t)?t.filter(er).map(WOt):void 0,n=zi(e,new Set(["name","image","docker","ssmSecretsPath","containers","routing","connections","serviceType","cpu","memoryLimitMiB","desiredCount","scaling","capacityProvider","ec2Config"]));return{name:De(e.name)??"",image:De(e.image),docker:qOt(e.docker),ssmSecretsPath:De(e.ssmSecretsPath),containers:r,routing:zOt(e.routing),serviceType:fn(e.serviceType,u2),cpu:Kt(e.cpu),memoryLimitMiB:Kt(e.memoryLimitMiB),desiredCount:Kt(e.desiredCount),scaling:HOt(e.scaling),capacityProvider:fn(e.capacityProvider,lC)??"FARGATE",ec2Config:KOt(e.ec2Config),...n.length>0&&{extraProperties:n}}}function qOt(e){if(!er(e))return;let t=De(e.path);if(t===void 0)return;let r=De(e.context),n=De(e.target);return{path:t,...r!==void 0&&{context:r},...n!==void 0&&{target:n}}}function gB(e,t){let r=De(e);if(r)return r;if(SC(e)&&e.__expression.startsWith(t+"."))return e.__expression.slice(t.length+1)}function $4e(e){return Rg(e)?e.__call.match(/\(\s*"([^"]+)"\s*\)/)?.[1]:void 0}function Zu(e,t,r){r!==void 0&&(e[t]=r)}var EUr,ch,AUr,wUr,YOt=w(()=>{"use strict";Lc();El();EUr=Object.defineProperty,ch=(e,t)=>EUr(e,"name",{value:t,configurable:!0});ch(G8,"isEnvironmentRecord");ch(GOt,"parseContainerSecretsImport");ch(VOt,"parseContainerHealthCheck");ch(WOt,"parseServiceContainer");ch(zOt,"parseServiceRouting");ch(HOt,"parseServiceScaling");AUr=new Set(["instanceType","amiHardwareType","minCapacity","maxCapacity","memoryLimitMiB","warmPool"]);ch(KOt,"parseServiceEc2Config");wUr=new Set(["domain","loadBalancer","directAccess"]);ch(D4e,"extractClusterConfig");ch(N4e,"parseEcsService");ch(qOt,"parseServiceDocker");ch(gB,"extractEnumString");ch($4e,"extractCallStringArg");ch(Zu,"assignIfDefined")});function M4e(e,t){return Array.isArray(e)?e.filter(rE).map(r=>t.find(n=>n.variableName===r.__identifier)).filter(r=>r!==void 0).map(r=>r.resourceName):[]}function L4e(e,t){return Array.isArray(e)?e.filter(rE).map(r=>t.find(n=>n.variableName===r.__identifier)).filter(r=>r!==void 0).map(r=>r.resourceName):[]}function F4e(e,t,r){if(!Array.isArray(t)||t.length===0)return;let n=t[0];if(!er(n))return;let a=n.containers;if(!Array.isArray(a)||a.length===0)return;let o=a[0];if(!er(o)||!er(o.environment))return;let i=o.environment;(i.DATABASE_HOST||i.DATABASE_PORT||i.DATABASE_NAME)&&(e.needsConnection=!0,r.length>0&&(e.connectedDatabase??[]).length===0&&(e.connectedDatabase=[r[0].name]));for(let s=1;s<=TUr;s++)(i[`DATABASE_HOST_${s}`]||i[`DATABASE_PORT_${s}`]||i[`DATABASE_NAME_${s}`])&&(e.needsConnection=!0)}function j4e(e,t,r){if(!Array.isArray(t)||t.length===0)return;let n=t[0];if(!er(n))return;let a=n.containers;if(!Array.isArray(a)||a.length===0)return;let o=a[0];!er(o)||!er(o.environment)||o.environment.BUCKET_NAME&&r.length>0&&(e.connectedStorage??[]).length===0&&(e.connectedStorage=[r[0].name])}var CUr,xme,TUr,JOt=w(()=>{"use strict";Lc();CUr=Object.defineProperty,xme=(e,t)=>CUr(e,"name",{value:t,configurable:!0}),TUr=10;xme(M4e,"resolveConnectedDatabaseNames");xme(L4e,"resolveConnectedStorageNames");xme(F4e,"inferDatabaseConnectionsFromEnv");xme(j4e,"inferStorageConnectionsFromEnv")});import*as yB from"typescript";function ZOt(e){if(e.arguments.length<2)return null;let t=e.arguments[0],r=e.arguments[1];if(!yB.isStringLiteral(t)||!yB.isObjectLiteralExpression(r))return null;let n=t.text,a=ga(r);return{resourceName:n,type:De(a.type)??"ecs",config:a,node:e}}function kme(e){return Yu(e,t=>{if(!yB.isCallExpression(t)||!mu(t,"addCompute"))return null;let r=t.arguments[0];if(!lp(r,"ComputeFactory"))return null;let n=ZOt(r);if(n){let a=ih(t);a&&(n.variableName=a)}return n})}function Ime(e,t,r){let n=zi(e.config,r);n.length>0&&(t.extraProperties=n)}function XOt(e,t){let r=e.config.docker;if(er(r)){let o=De(r.path),i=De(r.context),s=De(r.target);(o!==void 0||i!==void 0||s!==void 0)&&(t.docker={...o!==void 0&&{path:o},...i!==void 0&&{context:i},...s!==void 0&&{target:s}})}let n=e.config.cluster;n!==void 0&&(t.cluster=D4e(n));let a=e.config.services;a!==void 0&&Array.isArray(a)&&(t.services=a.filter(o=>er(o)).map(N4e)),Ime(e,t,new Set(["type","ecrRepository","docker","cluster","services","connections"]))}function QOt(e,t){if(Zu(t,"deployment",fn(e.config.deployment,y5)),Zu(t,"timeout",Kt(e.config.timeout)),Zu(t,"memory",Kt(e.config.memorySize)??Kt(e.config.memory)),Zu(t,"handler",De(e.config.handler)),Zu(t,"runtime",gB(e.config.runtime,"Runtime")),G8(e.config.environment)&&(t.environment=e.config.environment),G8(e.config.secrets))t.secrets=e.config.secrets;else{let a=gs(e.config.secrets);a&&(t.ssmSecrets=a)}let r=e.config.functionUrl;if(er(r)){let a=fn(gB(r.authType,"FunctionUrlAuthType"),l2);a!==void 0&&(t.functionUrl={authType:a})}let n=e.config.code;if(n!==void 0){let a=$4e(n);a&&(t.codePath=a)}Zu(t,"description",De(e.config.description)??De(e.config.lambdaDescription)),Zu(t,"architecture",fn(gB(e.config.architecture,"Architecture"),S5)),Zu(t,"ephemeralStorageSize",Kt(e.config.ephemeralStorageSize)),Zu(t,"functionName",De(e.config.functionName)),Zu(t,"ssmSecretsPath",De(e.config.ssmSecretsPath)),Ime(e,t,new Set(["type","deployment","timeout","memorySize","memory","handler","runtime","environment","secrets","functionUrl","code","connections","ecrRepository","containerSecretsImport","secretsImport","lambdaDescription","description","architecture","ephemeralStorageSize","functionName","ssmSecretsPath"]))}function eDt(e,t){Zu(t,"instanceType",fn(e.config.instanceType,w5));let r=e.config.ssh;r===!1?t.enableSSH=!1:r!==void 0&&er(r)?t.enableSSH=!0:Zu(t,"enableSSH",cn(e.config.enableSSH)),Zu(t,"keyName",De(e.config.keyName)),Zu(t,"userData",De(e.config.userData)),e.config.securityGroups!==void 0&&(t.securityGroups=gs(e.config.securityGroups)),Ime(e,t,new Set(["type","instanceType","ssh","enableSSH","keyName","userData","securityGroups","connections"]))}function tDt(e,t,r,n){let a=t.config.connections;if(!a&&Array.isArray(t.config.services)){let s=t.config.services[0];er(s)&&(a=s.connections)}if(!a)return;let o=M4e(a,r);o.length>0&&(e.needsConnection=!0,e.connectedDatabase=o);let i=L4e(a,n);i.length>0&&(e.connectedStorage=i)}function rDt(e,t){({ecs:XOt,lambda:QOt,ec2:eDt})[e.type]?.(t,e)}function B4e(e,t,r,n){return e.map(a=>{let o=fn(a.config.type,s2)??"ecs",i={name:a.resourceName,type:o,needsConnection:!1,connectedDatabase:[],...a.variableName&&{variableName:a.variableName}};return tDt(i,a,t,r),rDt(i,a),F4e(i,a.config.services,n.database),j4e(i,a.config.services,n.s3),i})}var xUr,bC,Rme=w(()=>{"use strict";Lc();El();YOt();JOt();xUr=Object.defineProperty,bC=(e,t)=>xUr(e,"name",{value:t,configurable:!0});bC(ZOt,"extractComputeResource");bC(kme,"findComputeResources");bC(Ime,"applyExtras");bC(XOt,"convertEcsCompute");bC(QOt,"convertLambdaCompute");bC(eDt,"convertEc2Compute");bC(tDt,"applyConnectionConfig");bC(rDt,"applyTypeSpecificConfig");bC(B4e,"convertComputeResources")});import*as Pg from"typescript";function _me(e){return Yu(e,t=>{if(!Pg.isCallExpression(t)||!mu(t,"addSchedule")||t.arguments.length<2)return null;let r=t.arguments[0],n=t.arguments[1];if(!Pg.isStringLiteral(r)||!Pg.isObjectLiteralExpression(n))return null;let a=ga(n),o=De(a.schedule);if(o===void 0)return null;let i=n.properties.find(c=>Pg.isPropertyAssignment(c)&&Pg.isIdentifier(c.name)&&c.name.text==="target");if(!i||!Pg.isPropertyAssignment(i)||!Pg.isIdentifier(i.initializer))return null;let s=fn(a.stackPlacement,Gx);return{id:r.text,schedule:o,targetVariableName:i.initializer.text,...s!==void 0&&{stackPlacement:s}}})}var kUr,IUr,U4e=w(()=>{"use strict";Lc();El();kUr=Object.defineProperty,IUr=(e,t)=>kUr(e,"name",{value:t,configurable:!0});IUr(_me,"findSchedules")});import*as up from"typescript";function nDt(e,t,r){let n=up.isIdentifier(e.name)?e.name.text:"";if(t.arguments&&t.arguments.length>=2){let a=t.arguments[1],o=up.isStringLiteral(a)?a.text:"",i=t.arguments.length>=3?t.arguments[2]:void 0,s=i&&up.isObjectLiteralExpression(i)?ga(i):{};return{variableName:n,resourceName:o,bucketClass:r,config:s,node:e}}return null}function aDt(e,t){if(t.arguments.length<2)return null;let r=t.arguments[0],n=t.arguments[1];if(!up.isStringLiteral(r)||!up.isObjectLiteralExpression(n))return null;let a=ga(n);return{variableName:ih(e)??"",resourceName:r.text,bucketClass:"StorageFactory",config:a,node:e}}function V4e(e){return Yu(e,t=>{if(!up.isVariableDeclaration(t)||!t.initializer||!up.isNewExpression(t.initializer))return null;let r=t.initializer;if(!up.isIdentifier(r.expression))return null;let n=r.expression.text;return G4e.has(n)?nDt(t,r,n):null})}function W4e(e){return Yu(e,t=>{if(!up.isCallExpression(t)||!mu(t,"addStorage"))return null;let r=t.arguments[0];return lp(r,"StorageFactory")?aDt(t,r):null})}function z4e(e){return e.map(t=>({name:t.resourceName,...De(t.config.bucketName)&&{bucketName:De(t.config.bucketName)},...cn(t.config.publicReadAccess)===!0&&{publicReadAccess:!0},...er(t.config.websiteHosting)&&(()=>{let r=t.config.websiteHosting;return{websiteHosting:{indexDocument:De(r.indexDocument)??"index.html",...De(r.errorDocument)&&{errorDocument:De(r.errorDocument)}}}})(),...fn(t.config.backupVaultTier,gg)&&{backupVaultTier:fn(t.config.backupVaultTier,gg)},...cn(t.config.versioned)!==void 0&&{versioned:cn(t.config.versioned)},...fn(t.config.encryption,vO)&&{encryption:fn(t.config.encryption,vO)},...De(t.config.kmsKeyArn)&&{kmsKeyArn:De(t.config.kmsKeyArn)},...Array.isArray(t.config.cors)&&t.config.cors.length>0&&{cors:t.config.cors.filter(er).map(r=>({allowedOrigins:Array.isArray(r.allowedOrigins)?r.allowedOrigins.filter(n=>typeof n=="string"):[],allowedMethods:Array.isArray(r.allowedMethods)?r.allowedMethods.filter(n=>typeof n=="string"):[]}))},...er(t.config.deployment)&&(()=>{let r=t.config.deployment;return{deployment:{source:De(r.source)??"",...cn(r.prune)!==void 0&&{prune:cn(r.prune)},...er(r.cacheControl)&&(()=>{let n=r.cacheControl;return{cacheControl:{...Kt(n.maxAge)!==void 0&&{maxAge:Kt(n.maxAge)},...cn(n.immutable)!==void 0&&{immutable:cn(n.immutable)}}}})()}}})(),...fn(t.config.stackPlacement,$5)&&{stackPlacement:fn(t.config.stackPlacement,$5)},...t.variableName&&{variableName:t.variableName},...(()=>{let r=new Set(["bucketName","publicReadAccess","websiteHosting","backupVaultTier","versioned","encryption","kmsKeyArn","cors","deployment","stackPlacement"]),n=zi(t.config,r);return n.length>0?{extraProperties:n}:{}})()}))}var RUr,V8,G4e,Pme=w(()=>{"use strict";_2();El();Lc();RUr=Object.defineProperty,V8=(e,t)=>RUr(e,"name",{value:t,configurable:!0}),G4e=new Set(["S3Bucket"]);V8(nDt,"extractS3Resource");V8(aDt,"extractS3FactoryResource");V8(V4e,"findS3Resources");V8(W4e,"findS3FactoryResources");V8(z4e,"convertS3Resources")});import*as Uo from"typescript";function Ome(e){return!!(e.startsWith("@fjall/")||e==="aws-cdk-lib"||e.startsWith("aws-cdk-lib/")||e==="constructs")}function dp(e){let t=[];for(let r of e.statements){let n=r.getFullStart(),a=r.getEnd();if(Uo.isImportDeclaration(r)){t.push({type:"import",node:r,startPos:n,endPos:a,isManaged:iDt(r)});continue}if(Uo.isVariableStatement(r)){t.push(sDt(r,n,a));continue}if(Uo.isExpressionStatement(r)){t.push(cDt(r,n,a));continue}t.push({type:"custom",node:r,startPos:n,endPos:a,isManaged:!1})}return t}function iDt(e){return Uo.isStringLiteral(e.moduleSpecifier)?Ome(e.moduleSpecifier.text):!1}function sDt(e,t,r){for(let n of e.declarationList.declarations)if(n.initializer){if(nE(n.initializer))return{type:"app-init",node:e,resourceName:Uo.isIdentifier(n.name)?n.name.text:void 0,startPos:t,endPos:r,isManaged:!0};if(Uo.isIdentifier(n.name)&&n.name.text==="appName"&&Uo.isStringLiteral(n.initializer))return{type:"app-init",node:e,startPos:t,endPos:r,isManaged:!0};if(Uo.isNewExpression(n.initializer)){let a=n.initializer;if(Uo.isIdentifier(a.expression)){let o=a.expression.text;if(G4e.has(o)){let i=a.arguments&&a.arguments.length>=2&&Uo.isStringLiteral(a.arguments[1])?a.arguments[1].text:void 0;return{type:"storage",node:e,resourceName:i,startPos:t,endPos:r,isManaged:!0}}}}if(Uo.isCallExpression(n.initializer)){let a=H4e(n.initializer,e,t,r);if(a.type!=="custom")return a}}return{type:"custom",node:e,startPos:t,endPos:r,isManaged:!1}}function cDt(e,t,r){let n=e.expression;return Uo.isCallExpression(n)?H4e(n,e,t,r):{type:"custom",node:e,startPos:t,endPos:r,isManaged:!1}}function H4e(e,t,r,n){let a=e.expression;if(Uo.isPropertyAccessExpression(a)&&Uo.isIdentifier(a.expression)){let o=a.name.text;if(o==="addTags")return{type:"tags",node:t,startPos:r,endPos:n,isManaged:!0};let i={addDatabase:{type:"database",factory:"DatabaseFactory"},addCompute:{type:"compute",factory:"ComputeFactory"},addNetwork:{type:"network",factory:"NetworkFactory"},addMessaging:{type:"messaging",factory:"MessagingFactory"},addCdn:{type:"cdn",factory:"CdnFactory"},addPattern:{type:"pattern",factory:"PatternFactory"},addStorage:{type:"storage",factory:"StorageFactory"}}[o];if(i){let s=lDt(e,i.factory);return{type:i.type,node:t,resourceName:s,startPos:r,endPos:n,isManaged:!0}}}return{type:"custom",node:t,startPos:r,endPos:n,isManaged:!1}}function lDt(e,t){if(e.arguments.length===0)return;let r=e.arguments[0];if(!Uo.isCallExpression(r))return;let n=r.expression;if(!Uo.isPropertyAccessExpression(n)||n.name.text!=="build"||!Uo.isIdentifier(n.expression)||n.expression.text!==t||r.arguments.length===0)return;let a=r.arguments[0];if(Uo.isStringLiteral(a))return a.text}var _Ur,GO,oDt,W8=w(()=>{"use strict";Lc();Pme();_Ur=Object.defineProperty,GO=(e,t)=>_Ur(e,"name",{value:t,configurable:!0}),oDt=new Set(["App","Architecture","DatabaseFactory","StorageFactory","ComputeFactory","getConfig","MessagingFactory","CdnFactory","Code","Runtime","FunctionUrlAuthType","NetworkFactory","PatternFactory","CrossPlanConnectionFactory"]);GO(Ome,"isManagedModuleSpecifier");GO(dp,"classifyStatements");GO(iDt,"isManagedImport");GO(sDt,"classifyVariableStatement");GO(cDt,"classifyExpressionStatement");GO(H4e,"classifyCallExpression");GO(lDt,"extractResourceNameFromFactoryCall")});import*as uDt from"typescript";function dDt(e){if(!e)return{position:"before-imports"};let t=OUr[e.type];return t?{position:t}:{position:"after-resource",afterManagedResource:{type:e.type,name:e.resourceName}}}function vB(e,t){let r=t??dp(e),n=[],a=e.getFullText(),o=null;for(let i of r)if(i.type==="custom"&&!i.isManaged){let{position:s,afterManagedResource:c}=dDt(o),l=pDt(a,i.node),u=mDt(a,i.node),d=e.getLineAndCharacterOfPosition(i.node.getStart());n.push({sourceText:l,position:s,afterManagedResource:c,originalLine:d.line+1,leadingComments:u.length>0?u:void 0})}else i.isManaged&&(o=i);return n}function pDt(e,t){let r=t.getFullStart(),n=t.getEnd(),a=e.slice(r,n).split(`
+`,r}function dB(e){let t=new Set;if(e.cdn&&(e.cdn.defaultOriginRef&&t.add(e.cdn.defaultOriginRef),e.cdn.behaviours))for(let r of e.cdn.behaviours)t.add(r.originRef);return t}function BO(e){return e.patternConfig!==void 0}var fUr,kg,O8,A4e=w(()=>{"use strict";Ai();oc();El();lme();pme();Zx();U2();OOt();fUr=Object.defineProperty,kg=(e,t)=>fUr(e,"name",{value:t,configurable:!0}),O8="fjall:costAllocation:owner";kg(DOt,"isEmptyObject");kg(E4e,"cleanNetworkConfig");kg(lB,"generateNetworkCode");kg(D8,"generateTags");kg(uB,"generateAppInit");kg(NOt,"collectComputeImports");kg(N8,"generateImports");kg($Ot,"cdnDefaultOriginNeedsAlbLane");kg($8,"generateCDNCode");kg(dB,"collectCdnReferencedResources");kg(BO,"usesPatternApproach")});var w4e=w(()=>{"use strict";oc();Zx();Jb();ame();ime();sme();oOt();sOt();A4e()});function Eme(e,t){return pu[e].database[t]}function MOt(e){return pu[e].compute.ecs}function vC(e){return pu[e].network}function x4e(e){return Ei.filter(t=>pu[t].database[e]!==null)}function LOt(e){return x4e(e).map(t=>({label:pu[t].displayName,value:t,description:pu[t].description}))}function pB(e){switch(e){case"tinkerer":case"lightweight":case"standard":return"Instance";case"resilient":case"enterprise":return"Aurora"}}function Ame(e,t){let r=pu[e].compute.ecs,n=r.services[0],a=!r.cluster?.directAccess&&r.cluster?.loadBalancer!==!1,o=t.filter(s=>s.serviceType!=="worker").length,i=t.findIndex(s=>s.serviceType!=="worker");return t.map((s,c)=>{let l=c===i,u=s.serviceType==="worker",d;return a&&!u&&(s.routing?d=s.routing:o>1&&(d={path:l?"/*":`/${s.name.toLowerCase()}/*`,...l?{}:{priority:100+c}})),{name:s.name,capacityProvider:n.capacityProvider,ec2Config:n.ec2Config,cpu:n.cpu,memoryLimitMiB:n.memoryLimitMiB,desiredCount:n.desiredCount,minCapacity:n.minCapacity,maxCapacity:n.maxCapacity,routing:d}})}var hUr,UO,M8,C4e,T4e,pu,wme=w(()=>{"use strict";fO();fO();hUr=Object.defineProperty,UO=(e,t)=>hUr(e,"name",{value:t,configurable:!0}),M8="service",C4e="cron(0 4 * * ? *)",T4e="cron(0 5 * * ? *)",pu=Object.freeze({tinkerer:{displayName:"Tinkerer",description:"Free tier eligible, minimal cost for experimentation",database:{Instance:{instanceType:"t4g.micro",multiAz:!1,proxy:!1,readReplica:!1,publiclyAccessible:!0},Aurora:null,GlobalAurora:null,ClickHouse:null},compute:{ecs:{services:[{name:M8,capacityProvider:"EC2",desiredCount:1,minCapacity:1,maxCapacity:1,ec2Config:{instanceType:"t4g.micro",amiHardwareType:"ARM",minCapacity:1,maxCapacity:1,memoryLimitMiB:400}}],cluster:{directAccess:!0}},lambda:{timeout:30,memory:128}},network:{maxAzs:2,natGateways:!1,flowLogs:!1},backup:!1},lightweight:{displayName:"Lightweight",description:"Streamlined single-AZ deployment for cost efficiency",database:{Instance:{instanceType:"t4g.small",multiAz:!1},Aurora:{readers:!1},GlobalAurora:null,ClickHouse:null},compute:{ecs:{services:[{name:M8,capacityProvider:"FARGATE_SPOT",cpu:256,memoryLimitMiB:512,desiredCount:1,minCapacity:1,maxCapacity:3}]},lambda:{timeout:30,memory:256}},network:{maxAzs:2,natGateways:{count:1},flowLogs:!1},backup:!1},standard:{displayName:"Standard",description:"Production-ready with sensible defaults",database:{Instance:{instanceType:"t4g.large"},Aurora:{readers:{count:1}},GlobalAurora:{readers:{count:1}},ClickHouse:{instanceType:"t4g.medium",coldTier:{mode:"s3"},optimiseSchedule:C4e,backupSchedule:T4e,backupRetentionDays:14}},compute:{ecs:{services:[{name:M8,capacityProvider:"FARGATE",cpu:512,memoryLimitMiB:1024,desiredCount:2,minCapacity:2,maxCapacity:5}]},lambda:{timeout:60,memory:256}},network:{maxAzs:3,natGateways:{count:1},flowLogs:{},vpcEndpoints:{interface:{ecr:!0}}},backup:!1},resilient:{displayName:"Resilient",description:"High availability with enhanced monitoring and scaling",database:{Instance:{instanceType:"r7g.large",encryption:{storageKey:{useCMK:!0}},databaseInsights:{mode:"advanced",encryptionKey:{useCMK:!0}},proxy:{requireTLS:!0}},Aurora:{readers:{count:2},encryption:{storageKey:{useCMK:!0}},databaseInsights:{mode:"advanced",encryptionKey:{useCMK:!0}},proxy:{requireTLS:!0},backupRetention:30},GlobalAurora:{readers:{count:2},encryption:{storageKey:{useCMK:!0}},databaseInsights:{mode:"advanced",encryptionKey:{useCMK:!0}},proxy:{requireTLS:!0},backupRetention:30,enableGlobalWriteForwarding:!0},ClickHouse:{instanceType:"m7g.large",coldTier:{mode:"s3"},optimiseSchedule:C4e,backupSchedule:T4e,backupRetentionDays:14}},compute:{ecs:{services:[{name:M8,capacityProvider:"FARGATE",cpu:1024,memoryLimitMiB:2048,desiredCount:4,minCapacity:4,maxCapacity:20}]},lambda:{timeout:120,memory:512}},network:{maxAzs:3,natGateways:{count:3},flowLogs:{retentionDays:90},vpcEndpoints:{interface:{ecr:!0,secretsManager:!0}}},backup:{tier:"resilient"}},enterprise:{displayName:"Enterprise",description:"Maximum capability with all features enabled",database:{Instance:{instanceType:"r7g.xlarge",encryption:{storageKey:{useCMK:!0}},databaseInsights:{mode:"advanced",encryptionKey:{useCMK:!0}},proxy:{requireTLS:!0},readReplica:{}},Aurora:{readers:{count:2},encryption:{storageKey:{useCMK:!0}},databaseInsights:{mode:"advanced",encryptionKey:{useCMK:!0}},proxy:{requireTLS:!0},backupRetention:35},GlobalAurora:{readers:{count:2},encryption:{storageKey:{useCMK:!0}},databaseInsights:{mode:"advanced",encryptionKey:{useCMK:!0}},proxy:{requireTLS:!0},backupRetention:35,enableGlobalWriteForwarding:!0},ClickHouse:{instanceType:"m7g.xlarge",coldTier:{mode:"s3"},optimiseSchedule:C4e,backupSchedule:T4e,backupRetentionDays:30}},compute:{ecs:{services:[{name:M8,capacityProvider:"FARGATE",cpu:2048,memoryLimitMiB:4096,desiredCount:6,minCapacity:6,maxCapacity:100}]},lambda:{timeout:300,memory:1024}},network:{maxAzs:3,natGateways:{count:3},flowLogs:{destination:"s3",retentionDays:365},vpcEndpoints:{interface:{ecr:!0,secretsManager:!0,kms:!0,cloudwatchLogs:!0}}},backup:{tier:"enterprise"}}});UO(Eme,"getDatabasePreset");UO(MOt,"getEcsPreset");UO(vC,"getNetworkPreset");UO(x4e,"getAvailableTiersForDatabase");UO(LOt,"getTierOptionsForDatabase");UO(pB,"getDefaultDatabaseTypeForTier");UO(Ame,"applyTierDefaultsToServices")});function L8(e){return Ig[e]}function F8(){return[{label:Ig.standard.displayName,value:"standard",description:Ig.standard.description},{label:Ig.lightweight.displayName,value:"lightweight",description:Ig.lightweight.description},{label:Ig.resilient.displayName,value:"resilient",description:Ig.resilient.description},{label:"Custom",value:"custom",description:"Full control \xB7 Configure everything"}]}function j8(e){return yUr.has(e)}var gUr,k4e,mB,FOt,Ig,yUr,I4e=w(()=>{"use strict";gUr=Object.defineProperty,k4e=(e,t)=>gUr(e,"name",{value:t,configurable:!0}),mB=["lightweight","standard","resilient"],FOt=[...mB,"custom"],Ig=Object.freeze({lightweight:{displayName:"Lightweight",description:"Cost-effective \xB7 Instance DB, minimal Lambda",database:{type:"Instance",instanceType:"t4g.small",backupRetention:7,deletionProtection:!1},compute:{memorySize:512,timeout:30},network:{maxAzs:2,natGateways:{count:1},flowLogs:!1},backup:!1},standard:{displayName:"Standard",description:"Production-ready \xB7 Instance DB, balanced Lambda",database:{type:"Instance",instanceType:"t4g.large",backupRetention:14,deletionProtection:!0},compute:{memorySize:1536,timeout:60},network:{maxAzs:3,natGateways:{count:1},flowLogs:{}},backup:{tier:"standard"}},resilient:{displayName:"Resilient",description:"High-availability \xB7 Aurora V2, KMS encryption",database:{type:"Aurora",backupRetention:30,deletionProtection:!0,encryption:{useCMK:!0}},compute:{memorySize:2048,timeout:120},network:{maxAzs:3,natGateways:{count:3},flowLogs:{retentionDays:90}},backup:{tier:"resilient"}}});k4e(L8,"getPatternTierPreset");k4e(F8,"getPatternTierOptions");yUr=new Set(mB);k4e(j8,"isPatternTierName")});function R4e(e){return{...sk[e]}}function _4e(){return[{label:"Standard",value:"standard"},{label:"Assets",value:"assets"},{label:"Upload",value:"upload"},{label:"Website Hosting",value:"website"}]}var vUr,jOt,sk,P4e=w(()=>{"use strict";vUr=Object.defineProperty,jOt=(e,t)=>vUr(e,"name",{value:t,configurable:!0}),sk=Object.freeze({standard:{},assets:{deployment:{source:"./assets"}},upload:{cors:[{allowedOrigins:["*"],allowedMethods:["GET","PUT","POST"]}]},website:{publicReadAccess:!0,websiteHosting:{indexDocument:"index.html",errorDocument:"error.html"}}});jOt(R4e,"getStoragePreset");jOt(_4e,"getStoragePresetOptions")});var BOt=w(()=>{"use strict";wme();I4e();P4e()});import*as mn from"typescript";function ga(e){let t={};for(let r of e.properties){if(!mn.isPropertyAssignment(r))continue;let n=mn.isIdentifier(r.name)||mn.isStringLiteral(r.name)?r.name.text:void 0;n!==void 0&&(t[n]=ck(r.initializer))}return t}function ck(e){if(mn.isStringLiteral(e))return e.text;if(mn.isNumericLiteral(e))return Number(e.text);if(e.kind===mn.SyntaxKind.TrueKeyword)return!0;if(e.kind===mn.SyntaxKind.FalseKeyword)return!1;if(mn.isArrayLiteralExpression(e))return e.elements.map(t=>ck(t));if(mn.isObjectLiteralExpression(e))return ga(e);if(mn.isIdentifier(e))return{__identifier:e.text};if(mn.isPropertyAccessExpression(e))return{__expression:e.getText()};if(mn.isCallExpression(e))return{__call:e.getText()};if(mn.isBinaryExpression(e)&&e.operatorToken.kind===mn.SyntaxKind.BarBarToken){let t=ck(e.left),r=ck(e.right);return typeof r=="string"?r:t}else if(mn.isConditionalExpression(e)){let t=ck(e.whenTrue),r=ck(e.whenFalse);return typeof r=="string"||typeof r=="number"?r:t}else if(mn.isTemplateExpression(e)||mn.isNoSubstitutionTemplateLiteral(e))return{__expression:e.getText()};return{__unknown:e.getText()}}function B8(e,t){return ah(e,r=>{if(mn.isVariableStatement(r)){for(let n of r.declarationList.declarations)if(mn.isIdentifier(n.name)&&n.name.text===t&&n.initializer){if(mn.isStringLiteral(n.initializer))return n.initializer.text;if(mn.isObjectLiteralExpression(n.initializer)){let a=ga(n.initializer);return JSON.stringify(a)}}}})}function O4e(e,t){return ah(e,r=>{if(mn.isVariableStatement(r)){for(let n of r.declarationList.declarations)if(mn.isIdentifier(n.name)&&n.name.text===t&&n.initializer&&mn.isObjectLiteralExpression(n.initializer))return ga(n.initializer)}})}function U8(e,t){if(!mn.isIdentifier(t.expression))return;let r=O4e(e,t.expression.text),n=t.name.text;if(r&&r[n]!==void 0)return String(r[n])}function Cme(e,t){let r=t.head.text;for(let n of t.templateSpans){if(mn.isIdentifier(n.expression)){let a=B8(e,n.expression.text);if(a)r+=a;else return t.getText(e).replace(/^`|`$/g,"")}else if(mn.isPropertyAccessExpression(n.expression)){let a=U8(e,n.expression);if(a)r+=a;else return t.getText(e).replace(/^`|`$/g,"")}else return t.getText(e).replace(/^`|`$/g,"");r+=n.literal.text}return r}var SUr,fB,UOt=w(()=>{"use strict";Lc();SUr=Object.defineProperty,fB=(e,t)=>SUr(e,"name",{value:t,configurable:!0});fB(ga,"parseObjectLiteral");fB(ck,"evaluateExpression");fB(B8,"findVariableValue");fB(O4e,"findObjectDeclaration");fB(U8,"evaluatePropertyAccess");fB(Cme,"resolveTemplateLiteral")});import*as Fc from"typescript";function oh(e){return typeof e=="object"&&e!==null&&!Array.isArray(e)}function rE(e){return oh(e)&&"__identifier"in e}function SC(e){return oh(e)&&"__expression"in e}function Rg(e){return oh(e)&&"__call"in e}function er(e){return oh(e)&&!("__identifier"in e)&&!("__expression"in e)&&!("__call"in e)&&!("__unknown"in e)}function De(e){return typeof e=="string"?e:void 0}function Kt(e){return typeof e=="number"?e:void 0}function cn(e){return typeof e=="boolean"?e:void 0}function gs(e){if(!Array.isArray(e))return;let t=[];for(let r of e){if(typeof r!="string")return;t.push(r)}return t.length>0?t:void 0}function fn(e,t){let r=De(e);if(r!==void 0)return op(t,r)?r:void 0}function Bm(e){let t={};for(let[r,n]of Object.entries(e))n!==void 0&&(t[r]=n);return t}function Tme(e){if(e===null)return"null";if(e===void 0)return"undefined";if(typeof e=="string")return JSON.stringify(e);if(typeof e=="number"||typeof e=="boolean")return String(e);if(Array.isArray(e))return`[${e.map(Tme).join(", ")}]`;if(!oh(e))return String(e);if(rE(e))return e.__identifier;if(SC(e))return e.__expression;if(Rg(e))return e.__call;if("__unknown"in e&&typeof e.__unknown=="string")return e.__unknown;let t=Object.entries(e);return t.length===0?"{}":`{ ${t.map(([r,n])=>`${r}: ${Tme(n)}`).join(", ")} }`}function zi(e,t){let r=[];for(let[n,a]of Object.entries(e))t.has(n)||a===void 0||r.push({key:n,sourceText:Tme(a)});return r}function lk(e,t){return Fc.isPropertyAssignment(e)&&Fc.isIdentifier(e.name)&&e.name.text===t}function nE(e){return Fc.isCallExpression(e)&&Fc.isPropertyAccessExpression(e.expression)&&e.expression.name.text==="getApp"&&Fc.isIdentifier(e.expression.expression)&&e.expression.expression.text==="App"}function mu(e,t){let{expression:r}=e;return Fc.isPropertyAccessExpression(r)&&r.name.text===t&&e.arguments.length>0}function ah(e,t){let r,n=Ro(a=>{r===void 0&&(r=t(a),r===void 0&&Fc.forEachChild(a,n))},"visit");return n(e),r}function Yu(e,t){let r=[],n=Ro(a=>{let o=t(a);o!==null&&r.push(o),Fc.forEachChild(a,n)},"visit");return n(e),r}function lp(e,t){return Fc.isCallExpression(e)&&Fc.isPropertyAccessExpression(e.expression)&&e.expression.name.text==="build"&&Fc.isIdentifier(e.expression.expression)&&e.expression.expression.text===t}function ih(e){let t=e.parent;if(Fc.isVariableDeclaration(t)&&Fc.isIdentifier(t.name))return t.name.text}function hB(e){if(e!=null){if(e===!1)return!1;if(typeof e=="object"&&!Array.isArray(e))return e}}function Fv(e,t){return e===!1?!1:er(e)?t(e):void 0}function Ju(e,t){return er(e)?t(e):void 0}function sh(e,t,r){let n=e[t];return er(n)?r(n):void 0}var bUr,Ro,_g,Lc=w(()=>{"use strict";El();UOt();bUr=Object.defineProperty,Ro=(e,t)=>bUr(e,"name",{value:t,configurable:!0});Ro(oh,"isPlainObject");Ro(rE,"isIdentifierRef");Ro(SC,"isExpressionRef");Ro(Rg,"isCallRef");Ro(er,"isParsedObject");Ro(De,"asString");Ro(Kt,"asNumber");Ro(cn,"asBoolean");Ro(gs,"asStringArray");Ro(fn,"asStringUnion");Ro(Bm,"omitUndefined");Ro(Tme,"parsedValueToSourceText");Ro(zi,"captureExtraProperties");Ro(lk,"isNamedProperty");Ro(nE,"isAppGetAppCall");Ro(mu,"isFactoryMethodCall");Ro(ah,"findFirstInAst");Ro(Yu,"collectFromAst");Ro(lp,"isFactoryBuildCall");Ro(ih,"extractVariableName");_g=Ro(()=>e=>e,"typed");Ro(hB,"asObjectOrFalse");Ro(Fv,"parseBooleanOrConfig");Ro(Ju,"parseOptionalConfig");Ro(sh,"extractSubConfig")});function G8(e){return e!==void 0&&oh(e)}function GOt(e){if(!er(e))return;let t={};for(let[r,n]of Object.entries(e))if(er(n)){let a=De(n.id),o=De(n.name);a&&o&&(t[r]={id:a,name:o,field:De(n.field)})}return Object.keys(t).length>0?t:void 0}function VOt(e){if(!er(e))return;let t=gs(e.command);if(!(!t||t.length===0))return{command:t,interval:Kt(e.interval),timeout:Kt(e.timeout),retries:Kt(e.retries),startPeriod:Kt(e.startPeriod)}}function WOt(e){let t=zi(e,new Set(["name","image","port","environment","essential","command","entryPoint","secretsImport","secrets","healthCheck"]));return{name:De(e.name),image:De(e.image),port:Kt(e.port),environment:G8(e.environment)?e.environment:void 0,essential:cn(e.essential),command:gs(e.command),entryPoint:gs(e.entryPoint),secretsImport:GOt(e.secretsImport),ssmSecrets:gs(e.secrets),healthCheck:VOt(e.healthCheck),extraProperties:t.length>0?t:void 0}}function zOt(e){if(Array.isArray(e))return e.filter(er).map(t=>({path:De(t.path),host:De(t.host),priority:Kt(t.priority),healthCheckPath:De(t.healthCheckPath)}));if(er(e))return{path:De(e.path),host:De(e.host),priority:Kt(e.priority),healthCheckPath:De(e.healthCheckPath)}}function HOt(e){if(e===!1)return!1;if(er(e))return{minCapacity:Kt(e.minCapacity),maxCapacity:Kt(e.maxCapacity),desiredCount:Kt(e.desiredCount),scalingType:fn(gB(e.scalingType,"ScalingType"),E5)}}function KOt(e){if(!er(e))return;let t=e.warmPool,r=er(t)?{minSize:Kt(t.minSize),reuseOnScaleIn:cn(t.reuseOnScaleIn)}:void 0,n=zi(e,AUr);return{instanceType:De(e.instanceType),amiHardwareType:fn(e.amiHardwareType,A5),minCapacity:Kt(e.minCapacity),maxCapacity:Kt(e.maxCapacity),memoryLimitMiB:Kt(e.memoryLimitMiB),warmPool:r,extraProperties:n.length>0?n:void 0}}function D4e(e){if(!er(e))return;let t=e.loadBalancer,r=zi(e,wUr);return{domain:De(e.domain),loadBalancer:t===!1?!1:fn(t,b5),directAccess:cn(e.directAccess),...r.length>0&&{extraProperties:r}}}function N4e(e){let t=e.containers,r=Array.isArray(t)?t.filter(er).map(WOt):void 0,n=zi(e,new Set(["name","image","docker","ssmSecretsPath","containers","routing","connections","serviceType","cpu","memoryLimitMiB","desiredCount","scaling","capacityProvider","ec2Config"]));return{name:De(e.name)??"",image:De(e.image),docker:qOt(e.docker),ssmSecretsPath:De(e.ssmSecretsPath),containers:r,routing:zOt(e.routing),serviceType:fn(e.serviceType,u2),cpu:Kt(e.cpu),memoryLimitMiB:Kt(e.memoryLimitMiB),desiredCount:Kt(e.desiredCount),scaling:HOt(e.scaling),capacityProvider:fn(e.capacityProvider,lC)??"FARGATE",ec2Config:KOt(e.ec2Config),...n.length>0&&{extraProperties:n}}}function qOt(e){if(!er(e))return;let t=De(e.path);if(t===void 0)return;let r=De(e.context),n=De(e.target);return{path:t,...r!==void 0&&{context:r},...n!==void 0&&{target:n}}}function gB(e,t){let r=De(e);if(r)return r;if(SC(e)&&e.__expression.startsWith(t+"."))return e.__expression.slice(t.length+1)}function $4e(e){return Rg(e)?e.__call.match(/\(\s*"([^"]+)"\s*\)/)?.[1]:void 0}function Zu(e,t,r){r!==void 0&&(e[t]=r)}var EUr,ch,AUr,wUr,YOt=w(()=>{"use strict";Lc();El();EUr=Object.defineProperty,ch=(e,t)=>EUr(e,"name",{value:t,configurable:!0});ch(G8,"isEnvironmentRecord");ch(GOt,"parseContainerSecretsImport");ch(VOt,"parseContainerHealthCheck");ch(WOt,"parseServiceContainer");ch(zOt,"parseServiceRouting");ch(HOt,"parseServiceScaling");AUr=new Set(["instanceType","amiHardwareType","minCapacity","maxCapacity","memoryLimitMiB","warmPool"]);ch(KOt,"parseServiceEc2Config");wUr=new Set(["domain","loadBalancer","directAccess"]);ch(D4e,"extractClusterConfig");ch(N4e,"parseEcsService");ch(qOt,"parseServiceDocker");ch(gB,"extractEnumString");ch($4e,"extractCallStringArg");ch(Zu,"assignIfDefined")});function M4e(e,t){return Array.isArray(e)?e.filter(rE).map(r=>t.find(n=>n.variableName===r.__identifier)).filter(r=>r!==void 0).map(r=>r.resourceName):[]}function L4e(e,t){return Array.isArray(e)?e.filter(rE).map(r=>t.find(n=>n.variableName===r.__identifier)).filter(r=>r!==void 0).map(r=>r.resourceName):[]}function F4e(e,t,r){if(!Array.isArray(t)||t.length===0)return;let n=t[0];if(!er(n))return;let a=n.containers;if(!Array.isArray(a)||a.length===0)return;let o=a[0];if(!er(o)||!er(o.environment))return;let i=o.environment;(i.DATABASE_HOST||i.DATABASE_PORT||i.DATABASE_NAME)&&(e.needsConnection=!0,r.length>0&&(e.connectedDatabase??[]).length===0&&(e.connectedDatabase=[r[0].name]));for(let s=1;s<=TUr;s++)(i[`DATABASE_HOST_${s}`]||i[`DATABASE_PORT_${s}`]||i[`DATABASE_NAME_${s}`])&&(e.needsConnection=!0)}function j4e(e,t,r){if(!Array.isArray(t)||t.length===0)return;let n=t[0];if(!er(n))return;let a=n.containers;if(!Array.isArray(a)||a.length===0)return;let o=a[0];!er(o)||!er(o.environment)||o.environment.BUCKET_NAME&&r.length>0&&(e.connectedStorage??[]).length===0&&(e.connectedStorage=[r[0].name])}var CUr,xme,TUr,JOt=w(()=>{"use strict";Lc();CUr=Object.defineProperty,xme=(e,t)=>CUr(e,"name",{value:t,configurable:!0}),TUr=10;xme(M4e,"resolveConnectedDatabaseNames");xme(L4e,"resolveConnectedStorageNames");xme(F4e,"inferDatabaseConnectionsFromEnv");xme(j4e,"inferStorageConnectionsFromEnv")});import*as yB from"typescript";function ZOt(e){if(e.arguments.length<2)return null;let t=e.arguments[0],r=e.arguments[1];if(!yB.isStringLiteral(t)||!yB.isObjectLiteralExpression(r))return null;let n=t.text,a=ga(r);return{resourceName:n,type:De(a.type)??"ecs",config:a,node:e}}function kme(e){return Yu(e,t=>{if(!yB.isCallExpression(t)||!mu(t,"addCompute"))return null;let r=t.arguments[0];if(!lp(r,"ComputeFactory"))return null;let n=ZOt(r);if(n){let a=ih(t);a&&(n.variableName=a)}return n})}function Ime(e,t,r){let n=zi(e.config,r);n.length>0&&(t.extraProperties=n)}function XOt(e,t){let r=e.config.docker;if(er(r)){let o=De(r.path),i=De(r.context),s=De(r.target);(o!==void 0||i!==void 0||s!==void 0)&&(t.docker={...o!==void 0&&{path:o},...i!==void 0&&{context:i},...s!==void 0&&{target:s}})}let n=e.config.cluster;n!==void 0&&(t.cluster=D4e(n));let a=e.config.services;a!==void 0&&Array.isArray(a)&&(t.services=a.filter(o=>er(o)).map(N4e)),Ime(e,t,new Set(["type","ecrRepository","docker","cluster","services","connections"]))}function QOt(e,t){if(Zu(t,"deployment",fn(e.config.deployment,y5)),Zu(t,"timeout",Kt(e.config.timeout)),Zu(t,"memory",Kt(e.config.memorySize)??Kt(e.config.memory)),Zu(t,"handler",De(e.config.handler)),Zu(t,"runtime",gB(e.config.runtime,"Runtime")),G8(e.config.environment)&&(t.environment=e.config.environment),G8(e.config.secrets))t.secrets=e.config.secrets;else{let a=gs(e.config.secrets);a&&(t.ssmSecrets=a)}let r=e.config.functionUrl;if(er(r)){let a=fn(gB(r.authType,"FunctionUrlAuthType"),l2);a!==void 0&&(t.functionUrl={authType:a})}let n=e.config.code;if(n!==void 0){let a=$4e(n);a&&(t.codePath=a)}Zu(t,"description",De(e.config.description)??De(e.config.lambdaDescription)),Zu(t,"architecture",fn(gB(e.config.architecture,"Architecture"),S5)),Zu(t,"ephemeralStorageSize",Kt(e.config.ephemeralStorageSize)),Zu(t,"functionName",De(e.config.functionName)),Zu(t,"ssmSecretsPath",De(e.config.ssmSecretsPath)),Ime(e,t,new Set(["type","deployment","timeout","memorySize","memory","handler","runtime","environment","secrets","functionUrl","code","connections","ecrRepository","containerSecretsImport","secretsImport","lambdaDescription","description","architecture","ephemeralStorageSize","functionName","ssmSecretsPath"]))}function eDt(e,t){Zu(t,"instanceType",fn(e.config.instanceType,w5));let r=e.config.ssh;r===!1?t.enableSSH=!1:r!==void 0&&er(r)?t.enableSSH=!0:Zu(t,"enableSSH",cn(e.config.enableSSH)),Zu(t,"keyName",De(e.config.keyName)),Zu(t,"userData",De(e.config.userData)),e.config.securityGroups!==void 0&&(t.securityGroups=gs(e.config.securityGroups)),Ime(e,t,new Set(["type","instanceType","ssh","enableSSH","keyName","userData","securityGroups","connections"]))}function tDt(e,t,r,n){let a=t.config.connections;if(!a&&Array.isArray(t.config.services)){let s=t.config.services[0];er(s)&&(a=s.connections)}if(!a)return;let o=M4e(a,r);o.length>0&&(e.needsConnection=!0,e.connectedDatabase=o);let i=L4e(a,n);i.length>0&&(e.connectedStorage=i)}function rDt(e,t){({ecs:XOt,lambda:QOt,ec2:eDt})[e.type]?.(t,e)}function B4e(e,t,r,n){return e.map(a=>{let o=fn(a.config.type,s2)??"ecs",i={name:a.resourceName,type:o,needsConnection:!1,connectedDatabase:[],...a.variableName&&{variableName:a.variableName}};return tDt(i,a,t,r),rDt(i,a),F4e(i,a.config.services,n.database),j4e(i,a.config.services,n.s3),i})}var xUr,bC,Rme=w(()=>{"use strict";Lc();El();YOt();JOt();xUr=Object.defineProperty,bC=(e,t)=>xUr(e,"name",{value:t,configurable:!0});bC(ZOt,"extractComputeResource");bC(kme,"findComputeResources");bC(Ime,"applyExtras");bC(XOt,"convertEcsCompute");bC(QOt,"convertLambdaCompute");bC(eDt,"convertEc2Compute");bC(tDt,"applyConnectionConfig");bC(rDt,"applyTypeSpecificConfig");bC(B4e,"convertComputeResources")});import*as Pg from"typescript";function _me(e){return Yu(e,t=>{if(!Pg.isCallExpression(t)||!mu(t,"addSchedule")||t.arguments.length<2)return null;let r=t.arguments[0],n=t.arguments[1];if(!Pg.isStringLiteral(r)||!Pg.isObjectLiteralExpression(n))return null;let a=ga(n),o=De(a.schedule);if(o===void 0)return null;let i=n.properties.find(c=>Pg.isPropertyAssignment(c)&&Pg.isIdentifier(c.name)&&c.name.text==="target");if(!i||!Pg.isPropertyAssignment(i)||!Pg.isIdentifier(i.initializer))return null;let s=fn(a.stackPlacement,Gx);return{id:r.text,schedule:o,targetVariableName:i.initializer.text,...s!==void 0&&{stackPlacement:s}}})}var kUr,IUr,U4e=w(()=>{"use strict";Lc();El();kUr=Object.defineProperty,IUr=(e,t)=>kUr(e,"name",{value:t,configurable:!0});IUr(_me,"findSchedules")});import*as up from"typescript";function nDt(e,t,r){let n=up.isIdentifier(e.name)?e.name.text:"";if(t.arguments&&t.arguments.length>=2){let a=t.arguments[1],o=up.isStringLiteral(a)?a.text:"",i=t.arguments.length>=3?t.arguments[2]:void 0,s=i&&up.isObjectLiteralExpression(i)?ga(i):{};return{variableName:n,resourceName:o,bucketClass:r,config:s,node:e}}return null}function aDt(e,t){if(t.arguments.length<2)return null;let r=t.arguments[0],n=t.arguments[1];if(!up.isStringLiteral(r)||!up.isObjectLiteralExpression(n))return null;let a=ga(n);return{variableName:ih(e)??"",resourceName:r.text,bucketClass:"StorageFactory",config:a,node:e}}function V4e(e){return Yu(e,t=>{if(!up.isVariableDeclaration(t)||!t.initializer||!up.isNewExpression(t.initializer))return null;let r=t.initializer;if(!up.isIdentifier(r.expression))return null;let n=r.expression.text;return G4e.has(n)?nDt(t,r,n):null})}function W4e(e){return Yu(e,t=>{if(!up.isCallExpression(t)||!mu(t,"addStorage"))return null;let r=t.arguments[0];return lp(r,"StorageFactory")?aDt(t,r):null})}function z4e(e){return e.map(t=>({name:t.resourceName,...De(t.config.bucketName)&&{bucketName:De(t.config.bucketName)},...cn(t.config.publicReadAccess)===!0&&{publicReadAccess:!0},...er(t.config.websiteHosting)&&(()=>{let r=t.config.websiteHosting;return{websiteHosting:{indexDocument:De(r.indexDocument)??"index.html",...De(r.errorDocument)&&{errorDocument:De(r.errorDocument)}}}})(),...fn(t.config.backupVaultTier,gg)&&{backupVaultTier:fn(t.config.backupVaultTier,gg)},...cn(t.config.versioned)!==void 0&&{versioned:cn(t.config.versioned)},...fn(t.config.encryption,vO)&&{encryption:fn(t.config.encryption,vO)},...De(t.config.kmsKeyArn)&&{kmsKeyArn:De(t.config.kmsKeyArn)},...Array.isArray(t.config.cors)&&t.config.cors.length>0&&{cors:t.config.cors.filter(er).map(r=>({allowedOrigins:Array.isArray(r.allowedOrigins)?r.allowedOrigins.filter(n=>typeof n=="string"):[],allowedMethods:Array.isArray(r.allowedMethods)?r.allowedMethods.filter(n=>typeof n=="string"):[]}))},...er(t.config.deployment)&&(()=>{let r=t.config.deployment;return{deployment:{source:De(r.source)??"",...cn(r.prune)!==void 0&&{prune:cn(r.prune)},...er(r.cacheControl)&&(()=>{let n=r.cacheControl;return{cacheControl:{...Kt(n.maxAge)!==void 0&&{maxAge:Kt(n.maxAge)},...cn(n.immutable)!==void 0&&{immutable:cn(n.immutable)}}}})()}}})(),...fn(t.config.stackPlacement,$5)&&{stackPlacement:fn(t.config.stackPlacement,$5)},...t.variableName&&{variableName:t.variableName},...(()=>{let r=new Set(["bucketName","publicReadAccess","websiteHosting","backupVaultTier","versioned","encryption","kmsKeyArn","cors","deployment","stackPlacement"]),n=zi(t.config,r);return n.length>0?{extraProperties:n}:{}})()}))}var RUr,V8,G4e,Pme=w(()=>{"use strict";_2();El();Lc();RUr=Object.defineProperty,V8=(e,t)=>RUr(e,"name",{value:t,configurable:!0}),G4e=new Set(["S3Bucket"]);V8(nDt,"extractS3Resource");V8(aDt,"extractS3FactoryResource");V8(V4e,"findS3Resources");V8(W4e,"findS3FactoryResources");V8(z4e,"convertS3Resources")});import*as Uo from"typescript";function Ome(e){return!!(e.startsWith("@fjall/")||e==="aws-cdk-lib"||e.startsWith("aws-cdk-lib/")||e==="constructs")}function dp(e){let t=[];for(let r of e.statements){let n=r.getFullStart(),a=r.getEnd();if(Uo.isImportDeclaration(r)){t.push({type:"import",node:r,startPos:n,endPos:a,isManaged:iDt(r)});continue}if(Uo.isVariableStatement(r)){t.push(sDt(r,n,a));continue}if(Uo.isExpressionStatement(r)){t.push(cDt(r,n,a));continue}t.push({type:"custom",node:r,startPos:n,endPos:a,isManaged:!1})}return t}function iDt(e){return Uo.isStringLiteral(e.moduleSpecifier)?Ome(e.moduleSpecifier.text):!1}function sDt(e,t,r){for(let n of e.declarationList.declarations)if(n.initializer){if(nE(n.initializer))return{type:"app-init",node:e,resourceName:Uo.isIdentifier(n.name)?n.name.text:void 0,startPos:t,endPos:r,isManaged:!0};if(Uo.isIdentifier(n.name)&&n.name.text==="appName"&&Uo.isStringLiteral(n.initializer))return{type:"app-init",node:e,startPos:t,endPos:r,isManaged:!0};if(Uo.isNewExpression(n.initializer)){let a=n.initializer;if(Uo.isIdentifier(a.expression)){let o=a.expression.text;if(G4e.has(o)){let i=a.arguments&&a.arguments.length>=2&&Uo.isStringLiteral(a.arguments[1])?a.arguments[1].text:void 0;return{type:"storage",node:e,resourceName:i,startPos:t,endPos:r,isManaged:!0}}}}if(Uo.isCallExpression(n.initializer)){let a=H4e(n.initializer,e,t,r);if(a.type!=="custom")return a}}return{type:"custom",node:e,startPos:t,endPos:r,isManaged:!1}}function cDt(e,t,r){let n=e.expression;return Uo.isCallExpression(n)?H4e(n,e,t,r):{type:"custom",node:e,startPos:t,endPos:r,isManaged:!1}}function H4e(e,t,r,n){let a=e.expression;if(Uo.isPropertyAccessExpression(a)&&Uo.isIdentifier(a.expression)){let o=a.name.text;if(o==="addTags")return{type:"tags",node:t,startPos:r,endPos:n,isManaged:!0};let i={addDatabase:{type:"database",factory:"DatabaseFactory"},addCompute:{type:"compute",factory:"ComputeFactory"},addNetwork:{type:"network",factory:"NetworkFactory"},addMessaging:{type:"messaging",factory:"MessagingFactory"},addCdn:{type:"cdn",factory:"CdnFactory"},addPattern:{type:"pattern",factory:"PatternFactory"},addStorage:{type:"storage",factory:"StorageFactory"}}[o];if(i){let s=lDt(e,i.factory);return{type:i.type,node:t,resourceName:s,startPos:r,endPos:n,isManaged:!0}}}return{type:"custom",node:t,startPos:r,endPos:n,isManaged:!1}}function lDt(e,t){if(e.arguments.length===0)return;let r=e.arguments[0];if(!Uo.isCallExpression(r))return;let n=r.expression;if(!Uo.isPropertyAccessExpression(n)||n.name.text!=="build"||!Uo.isIdentifier(n.expression)||n.expression.text!==t||r.arguments.length===0)return;let a=r.arguments[0];if(Uo.isStringLiteral(a))return a.text}var _Ur,GO,oDt,W8=w(()=>{"use strict";Lc();Pme();_Ur=Object.defineProperty,GO=(e,t)=>_Ur(e,"name",{value:t,configurable:!0}),oDt=new Set(["App","Architecture","DatabaseFactory","StorageFactory","ComputeFactory","getConfig","MessagingFactory","CdnFactory","Code","Runtime","FunctionUrlAuthType","NetworkFactory","PatternFactory","CrossPlanConnectionFactory"]);GO(Ome,"isManagedModuleSpecifier");GO(dp,"classifyStatements");GO(iDt,"isManagedImport");GO(sDt,"classifyVariableStatement");GO(cDt,"classifyExpressionStatement");GO(H4e,"classifyCallExpression");GO(lDt,"extractResourceNameFromFactoryCall")});import*as uDt from"typescript";function dDt(e){if(!e)return{position:"before-imports"};let t=OUr[e.type];return t?{position:t}:{position:"after-resource",afterManagedResource:{type:e.type,name:e.resourceName}}}function vB(e,t){let r=t??dp(e),n=[],a=e.getFullText(),o=null;for(let i of r)if(i.type==="custom"&&!i.isManaged){let{position:s,afterManagedResource:c}=dDt(o),l=pDt(a,i.node),u=mDt(a,i.node),d=e.getLineAndCharacterOfPosition(i.node.getStart());n.push({sourceText:l,position:s,afterManagedResource:c,originalLine:d.line+1,leadingComments:u.length>0?u:void 0})}else i.isManaged&&(o=i);return n}function pDt(e,t){let r=t.getFullStart(),n=t.getEnd(),a=e.slice(r,n).split(`
 `),o=a.findIndex(i=>i.trim()!=="");return a.slice(o===-1?0:o).join(`
 `)}function mDt(e,t){let r=[],n=uDt.getLeadingCommentRanges(e,t.getFullStart());if(n)for(let a of n){let o=e.slice(a.pos,a.end);r.push(o)}return r}function WO(e,t,r,n){let a=n??dp(e);for(let o of a)if(o.type===t&&o.resourceName===r)return{startPos:o.startPos,endPos:o.endPos,node:o.node};return null}function Dme(e,t,r){let n=r??dp(e),a=null;for(let o of n)o.type===t&&o.isManaged&&(a=o);return a}function Nme(e,t){let r=t??dp(e),n={import:[],"app-init":[],tags:[],database:[],compute:[],storage:[],network:[],messaging:[],cdn:[],pattern:[],"vpc-peer":[],"vpc-peer-accepter":[],"cross-plan-connection":[],custom:[]};for(let a of r)n[a.type].push(a);return n}var PUr,VO,OUr,K4e=w(()=>{"use strict";W8();PUr=Object.defineProperty,VO=(e,t)=>PUr(e,"name",{value:t,configurable:!0}),OUr={import:"after-imports","app-init":"after-app-init",tags:"after-tags"};VO(dDt,"determineCustomBlockPosition");VO(vB,"extractCustomCodeBlocks");VO(pDt,"getStatementTextWithComments");VO(mDt,"extractLeadingComments");VO(WO,"findManagedResourcePosition");VO(Dme,"getLastManagedStatementOfType");VO(Nme,"getManagedResourcesByType")});import*as H8 from"typescript";function z8(e){if(!er(e))return;let t=De(e.name),r=fn(e.type,NUr);if(!(!t||!r))return{name:t,type:r}}function Y4e(e){let t=e.node;if(!H8.isCallExpression(t))return null;let r=t.arguments[0];if(!H8.isCallExpression(r)||r.arguments.length<2)return null;let n=r.arguments[1];if(!H8.isObjectLiteralExpression(n))return null;let a=ga(n),o=z8(a.partitionKey);if(!o)return null;let i={resourceName:e.resourceName,partitionKey:o,node:e.node};e.variableName&&(i.variableName=e.variableName);let s=z8(a.sortKey);if(s&&(i.sortKey=s),Array.isArray(a.globalSecondaryIndexes)){let d=a.globalSecondaryIndexes.filter(er).map(p=>{let m=z8(p.partitionKey);if(!m)return null;let f=De(p.indexName);if(!f)return null;let y={indexName:f,partitionKey:m},v=z8(p.sortKey);return v&&(y.sortKey=v),y}).filter(p=>p!==null);d.length>0&&(i.globalSecondaryIndexes=d)}let c=De(a.ttlAttribute);c&&(i.ttlAttribute=c);let l=cn(a.stream);l!==void 0&&(i.stream=l);let u=zi(a,new Set(["type","databaseName","partitionKey","sortKey","globalSecondaryIndexes","ttlAttribute","stream"]));return u.length>0&&(i.extraProperties=u),i}function $me(e){if(e.length!==0)return e.map(t=>({name:t.resourceName,partitionKey:t.partitionKey,...Bm({sortKey:t.sortKey,globalSecondaryIndexes:t.globalSecondaryIndexes,ttlAttribute:t.ttlAttribute,stream:t.stream,variableName:t.variableName,extraProperties:t.extraProperties})}))}var DUr,q4e,NUr,J4e=w(()=>{"use strict";Lc();DUr=Object.defineProperty,q4e=(e,t)=>DUr(e,"name",{value:t,configurable:!0}),NUr=["S","N","B"];q4e(z8,"parseDynamoDBKey");q4e(Y4e,"extractDynamoDBFields");q4e($me,"convertDynamoDBResources")});import*as K8 from"typescript";function Z4e(e){let t=e.node;if(!K8.isCallExpression(t))return null;let r=t.arguments[0];if(!K8.isCallExpression(r)||r.arguments.length<2)return null;let n=r.arguments[1];if(!K8.isObjectLiteralExpression(n))return null;let a=ga(n),o={resourceName:e.resourceName,databaseName:e.databaseName,node:e.node};e.variableName&&(o.variableName=e.variableName);let i=De(a.instanceType);i&&(o.instanceType=i);let s=Kt(a.storageGb);s!==void 0&&(o.storageGb=s);let c=Kt(a.iops);c!==void 0&&(o.iops=c);let l=Kt(a.throughputMbps);l!==void 0&&(o.throughputMbps=l);let u=a.coldTier;u===!1?o.coldTier=!1:er(u)&&De(u.mode)==="s3"&&(o.coldTier={mode:"s3"});let d=a.optimiseSchedule;if(d===!1)o.optimiseSchedule=!1;else{let y=De(d);y&&(o.optimiseSchedule=y)}let p=a.backupSchedule;if(p===!1)o.backupSchedule=!1;else{let y=De(p);y&&(o.backupSchedule=y)}a.backupVerify===!1&&(o.backupVerify=!1);let m=Kt(a.backupRetentionDays);m!==void 0&&(o.backupRetentionDays=m);let f=zi(a,MUr);return f.length>0&&(o.extraProperties=f),o}function Mme(e){if(e.length!==0)return e.map(t=>({name:t.resourceName,type:"ClickHouse",databaseName:t.databaseName,...Bm({instanceType:t.instanceType,storageGb:t.storageGb,iops:t.iops,throughputMbps:t.throughputMbps,coldTier:t.coldTier,optimiseSchedule:t.optimiseSchedule,backupSchedule:t.backupSchedule,backupVerify:t.backupVerify,backupRetentionDays:t.backupRetentionDays,variableName:t.variableName,extraProperties:t.extraProperties})}))}var $Ur,fDt,MUr,X4e=w(()=>{"use strict";Lc();$Ur=Object.defineProperty,fDt=(e,t)=>$Ur(e,"name",{value:t,configurable:!0}),MUr=new Set(["type","databaseName","instanceType","storageGb","iops","throughputMbps","coldTier","optimiseSchedule","backupSchedule","backupVerify","backupRetentionDays"]);fDt(Z4e,"extractClickHouseFields");fDt(Mme,"convertClickHouseResources")});import*as EC from"typescript";function hDt(e){let t=De(e.databaseEngine);if(t!==void 0&&op(hO,t))return t;let r=e.engine;if(Rg(r)){let n=String(r.__call);if(n.includes("postgres")||n.includes("auroraPostgres"))return"postgresql";if(n.includes("mysql")||n.includes("auroraMysql"))return"mysql"}}function gDt(e){let t=e.engine;if(Rg(t))return String(t.__call)}function yDt(e,t,r){if(r.arguments.length<2)return null;let n=r.arguments[0],a=r.arguments[1];if(!EC.isStringLiteral(n)&&!EC.isTemplateExpression(n))return null;let o=EC.isStringLiteral(n)?n.text:Cme(e,n);if(!EC.isObjectLiteralExpression(a))return null;let i=ga(a),s={resourceName:o,type:De(i.type)??"",databaseName:De(i.databaseName)??"",databaseEngine:hDt(i),engineExpression:gDt(i),port:Kt(i.port),deletionProtection:cn(i.deletionProtection),instanceType:De(i.instanceType),multiAz:cn(i.multiAz),publiclyAccessible:cn(i.publiclyAccessible),enableSecretRotation:cn(i.enableSecretRotation),encryption:Ju(i.encryption,_g()),databaseInsights:Fv(i.databaseInsights,_g()),proxy:Fv(i.proxy,_g()),readReplica:Fv(i.readReplica,_g()),credentials:Ju(i.credentials,_g()),writer:Ju(i.writer,_g()),readers:Fv(i.readers,_g()),backupRetention:Kt(i.backupRetention),preferredMaintenanceWindow:De(i.preferredMaintenanceWindow),primaryRegion:De(i.primaryRegion),secondaryRegions:gs(i.secondaryRegions),globalClusterIdentifier:De(i.globalClusterIdentifier),enableGlobalWriteForwarding:cn(i.enableGlobalWriteForwarding),allocatedStorage:Kt(i.allocatedStorage),monitoringInterval:Kt(i.monitoringInterval),snapshotIdentifier:De(i.snapshotIdentifier),snapshotUsername:De(i.snapshotUsername),node:t},c=ih(t);c&&(s.variableName=c);let l=zi(i,FUr);return l.length>0&&(s.extraProperties=l),s}function Q4e(e){return Yu(e,t=>{if(!EC.isCallExpression(t)||!mu(t,"addDatabase"))return null;let r=t.arguments[0];return lp(r,"DatabaseFactory")?yDt(e,t,r):null})}function eGe(e){let t=[],r=[],n=[];for(let a of e)if(a.type==="DynamoDB"){let o=Y4e(a);o&&r.push(o)}else if(a.type==="ClickHouse"){let o=Z4e(a);o&&n.push(o)}else t.push(a);return{databases:t,dynamodb:r,clickhouse:n}}function tGe(e){return e.filter(t=>t.type!=="DynamoDB").map(t=>({name:t.resourceName,type:op(jUr,t.type)?t.type:"Instance",databaseName:t.databaseName,...Bm({port:t.port,deletionProtection:t.deletionProtection,instanceType:t.instanceType,multiAz:t.multiAz,publiclyAccessible:t.publiclyAccessible,enableSecretRotation:t.enableSecretRotation,encryption:t.encryption,databaseInsights:t.databaseInsights,proxy:t.proxy,readReplica:t.readReplica,credentials:t.credentials,writer:t.writer,readers:t.readers,backupRetention:t.backupRetention,preferredMaintenanceWindow:t.preferredMaintenanceWindow,primaryRegion:t.primaryRegion,secondaryRegions:t.secondaryRegions,globalClusterIdentifier:t.globalClusterIdentifier,enableGlobalWriteForwarding:t.enableGlobalWriteForwarding,allocatedStorage:t.allocatedStorage,monitoringInterval:t.monitoringInterval,variableName:t.variableName,databaseEngine:t.databaseEngine,engineExpression:t.engineExpression,extraProperties:t.extraProperties})}))}var LUr,SB,FUr,jUr,rGe=w(()=>{"use strict";El();Lc();J4e();X4e();J4e();X4e();LUr=Object.defineProperty,SB=(e,t)=>LUr(e,"name",{value:t,configurable:!0});SB(hDt,"extractDatabaseEngine");SB(gDt,"extractEngineExpression");FUr=new Set(["type","databaseName","databaseEngine","engine","vpc","port","deletionProtection","instanceType","multiAz","publiclyAccessible","enableSecretRotation","encryption","databaseInsights","proxy","readReplica","credentials","writer","readers","backupRetention","preferredMaintenanceWindow","primaryRegion","secondaryRegions","globalClusterIdentifier","enableGlobalWriteForwarding","snapshotIdentifier","allocatedStorage","monitoringInterval","snapshotUsername"]);SB(yDt,"extractDatabaseResource");SB(Q4e,"findDatabaseResources");SB(eGe,"splitDatabaseResources");jUr=["Instance","Aurora","GlobalAurora"];SB(tGe,"convertDatabaseResources")});import*as EB from"typescript";function vDt(e,t){if(t.arguments.length<2)return null;let r=t.arguments[0],n=t.arguments[1];if(!EB.isStringLiteral(r)||!EB.isObjectLiteralExpression(n))return null;let a=ga(n),o={resourceName:r.text,queueType:De(a.queueType)??"standard",visibilityTimeout:Kt(a.visibilityTimeout),retentionPeriod:Kt(a.messageRetentionPeriod),contentBasedDeduplication:cn(a.contentBasedDeduplication),removalPolicy:De(a.removalPolicy),node:e},i=ih(e);i&&(o.variableName=i);let s=zi(a,new Set(["type","queueType","visibilityTimeout","messageRetentionPeriod","contentBasedDeduplication","removalPolicy"]));return s.length>0&&(o.extraProperties=s),o}function nGe(e){if(e!=null){if(e===!1)return!1;if(er(e))return Bm({enabled:cn(e.enabled),maxReceiveCount:Kt(e.maxReceiveCount)})}}function aGe(e){return Yu(e,t=>{if(!EB.isCallExpression(t)||!mu(t,"addMessaging"))return null;let r=t.arguments[0];return lp(r,"MessagingFactory")?vDt(t,r):null})}function oGe(e){if(e.length!==0)return e.map(t=>({name:t.resourceName,queueType:t.queueType==="fifo"?"fifo":"standard",...Bm({visibilityTimeout:t.visibilityTimeout,retentionPeriod:t.retentionPeriod,contentBasedDeduplication:t.contentBasedDeduplication,removalPolicy:bDt(t.removalPolicy),variableName:t.variableName,extraProperties:t.extraProperties})}))}function SDt(e){return UUr.has(e)}function bDt(e){return e!==void 0&&SDt(e)?e:void 0}var BUr,bB,UUr,Lme=w(()=>{"use strict";lpe();Lc();BUr=Object.defineProperty,bB=(e,t)=>BUr(e,"name",{value:t,configurable:!0});bB(vDt,"extractSQSResource");bB(nGe,"parseDeadLetterQueueConfig");bB(aGe,"findSQSResources");bB(oGe,"convertSQSResources");UUr=new Set(cpe.options);bB(SDt,"isSqsRemovalPolicy");bB(bDt,"toSqsRemovalPolicy")});import*as AB from"typescript";function ADt(e){if(e.arguments.length<2)return null;let t=e.arguments[0],r=e.arguments[1];return!AB.isStringLiteral(t)||!AB.isObjectLiteralExpression(r)?null:{resourceName:t.text,config:ga(r),node:e}}function wDt(e,t,r){let n=t.find(o=>o.variableName===e);if(n)return n.resourceName;let a=r.find(o=>o.variableName===e||o.resourceName.charAt(0).toLowerCase()+o.resourceName.slice(1)===e);return a?a.resourceName:e}function iGe(e){return ah(e,t=>{if(!AB.isCallExpression(t)||!mu(t,"addCdn"))return;let r=t.arguments[0];if(lp(r,"CdnFactory"))return ADt(r)??void 0})}function sGe(e,t,r){if(!e)return;let n=e,a=n.config,o=q8(y=>rE(y)?wDt(y.__identifier,t,r):De(y)??"","resolveOrigin"),i=De(a.originType)==="alb",s;if(i){let y=o(a.loadBalancer),v=r.some(A=>A.resourceName===y),S=De(a.protocolPolicy);if(!v||S!=="HTTP_ONLY")throw new Error(`CDN '${n.resourceName}': only the generated alb lane is plan-mappable \u2014 originType "alb" with loadBalancer referencing a compute declared in this app and protocolPolicy "HTTP_ONLY". Reshape the statement to that form, or manage this CDN outside the generator lane.`);s=y}else s=o(a.origin);let c={name:n.resourceName,defaultOriginRef:s};if(Array.isArray(a.behaviours)){let y=a.behaviours.filter(er).map(v=>({pathPattern:De(v.pathPattern)??"",originRef:o(v.origin),...fn(v.cachePolicy,EDt)!==void 0&&{cachePolicy:fn(v.cachePolicy,EDt)}}));y.length>0&&(c.behaviours=y)}let l=De(a.customDomain);if(l)c.customDomain=l;else{let y=gs(a.domainNames);y&&y.length>0&&(c.customDomain=y[0])}let u=De(a.certificateArn);u&&(c.certificateArn=u);let d=De(a.originHostname);d&&(c.originHostname=d);let p=!1;if(er(a.domainConfig)){let y=a.domainConfig,v=De(y.domainName);v!==void 0&&Object.keys(y).every(S=>S==="domainName"||S==="record")&&(y.record===void 0||De(y.record)==="alias")&&(c.domain=v,p=!0)}if(a.accessGate!==void 0){if(a.accessGate===!1)c.accessGate=!1;else if(er(a.accessGate)){let y=a.accessGate,v=De(y.type),S=De(y.username),A=De(y.password);v==="basic-auth"&&S&&A&&(c.accessGate={type:"basic-auth",username:S,password:A})}}let m=new Set(["originType","origin","behaviours","customDomain","domainNames","certificateArn","accessGate"]);p&&m.add("domainConfig"),i&&(m.add("loadBalancer"),m.add("protocolPolicy")),d&&m.add("originHostname");let f=zi(a,m);return f.length>0&&(c.extraProperties=f),c}var GUr,q8,EDt,cGe=w(()=>{"use strict";Lc();GUr=Object.defineProperty,q8=(e,t)=>GUr(e,"name",{value:t,configurable:!0});q8(ADt,"extractCDNResource");q8(wDt,"resolveOriginIdentifier");EDt=["CACHING_OPTIMIZED","CACHING_DISABLED"];q8(iGe,"findCDNResource");q8(sGe,"convertCDNResource")});import*as ic from"typescript";function CDt(e){if(e!==void 0)return WUr.has(e)?e:void 0}function lGe(e){return{maxAzs:Kt(e.maxAzs),natGateways:Fv(e.natGateways,t=>({count:Kt(t.count)})),flowLogs:Fv(e.flowLogs,t=>({destination:De(t.destination),retentionDays:Kt(t.retentionDays)})),vpcEndpoints:er(e.vpcEndpoints)?e.vpcEndpoints:void 0}}function TDt(e,t){if(t.arguments.length<2)return null;let r=t.arguments[0],n=t.arguments[1];if(!ic.isStringLiteral(r))return null;let a=r.text,o=ic.isObjectLiteralExpression(n)?ga(n):{},i=lGe(o),s={name:a,config:Bm({...i}),node:e},c=ih(e);return c&&(s.variableName=c),s}function uGe(e){return ah(e,t=>{if(!nE(t)||t.arguments.length<=1)return;let r=t.arguments[1];if(ic.isObjectLiteralExpression(r)){for(let n of r.properties)if(lk(n,"network")&&ic.isObjectLiteralExpression(n.initializer)){for(let a of n.initializer.properties)if(lk(a,"useExisting")&&ic.isStringLiteral(a.initializer))return a.initializer.text}}})}function dGe(e){return ah(e,t=>{if(!nE(t)||t.arguments.length<=1)return;let r=t.arguments[1];if(ic.isObjectLiteralExpression(r)){for(let n of r.properties)if(lk(n,"network")){if(n.initializer.kind===ic.SyntaxKind.FalseKeyword)return;if(ic.isObjectLiteralExpression(n.initializer)&&!n.initializer.properties.some(a=>lk(a,"useExisting"))){let a=ga(n.initializer);return lGe(a)}}}})}function pGe(e){return ah(e,t=>{if(!nE(t)||t.arguments.length<=1)return;let r=t.arguments[1];if(ic.isObjectLiteralExpression(r)){for(let n of r.properties)if(lk(n,"backup")){if(n.initializer.kind===ic.SyntaxKind.FalseKeyword)return!1;if(ic.isObjectLiteralExpression(n.initializer)){let a=ga(n.initializer),o=De(a.tier);if(o)return{tier:o}}}}})}function mGe(e){return ah(e,t=>{if(!nE(t)||t.arguments.length<=1)return;let r=t.arguments[1];if(ic.isObjectLiteralExpression(r)){for(let n of r.properties)if(lk(n,"tunnel")){if(n.initializer.kind===ic.SyntaxKind.FalseKeyword)return!1;if(n.initializer.kind===ic.SyntaxKind.TrueKeyword)return!0;if(ic.isObjectLiteralExpression(n.initializer)){let a=ga(n.initializer),o=De(a.instanceType);return o?{instanceType:o}:{}}}}})}function fGe(e){return Yu(e,t=>{if(!ic.isCallExpression(t)||!mu(t,"addNetwork"))return null;let r=t.arguments[0];return lp(r,"NetworkFactory")?TDt(t,r):null})}function hGe(e){let t=e.flowLogs;return{...Bm({maxAzs:e.maxAzs,natGateways:e.natGateways,vpcEndpoints:e.vpcEndpoints}),...t!==void 0&&{flowLogs:t===!1?!1:Bm({destination:CDt(t.destination),retentionDays:t.retentionDays})}}}function gGe(e){if(e)return hGe(e)}function yGe(e){if(e===void 0)return;if(e===!1)return!1;let t=e.tier;if(op(gg,t))return{tier:t}}function vGe(e){if(e===void 0)return;if(e===!1)return!1;if(e===!0)return{};let t={};return e.instanceType&&(t.instanceType=e.instanceType),t}function SGe(e){if(!(!e||e.length===0))return e.map(t=>({name:t.name,...hGe(t.config)}))}var VUr,lh,WUr,bGe=w(()=>{"use strict";El();ipe();Lc();VUr=Object.defineProperty,lh=(e,t)=>VUr(e,"name",{value:t,configurable:!0}),WUr=new Set(rpe.options);lh(CDt,"asFlowLogDestination");lh(lGe,"parseNetworkConfigFields");lh(TDt,"extractNetworkResource");lh(uGe,"findVpcId");lh(dGe,"findNetworkConfig");lh(pGe,"findBackupConfig");lh(mGe,"findTunnelConfig");lh(fGe,"findNetworkResources");lh(hGe,"buildNetworkFields");lh(gGe,"convertNetworkConfig");lh(yGe,"convertBackupConfig");lh(vGe,"convertTunnelConfig");lh(SGe,"convertAdditionalNetworks")});import*as wB from"typescript";function Fme(e){if(!er(e))return;let t={...e.memorySize!==void 0&&{memorySize:Kt(e.memorySize)},...e.timeout!==void 0&&{timeout:Kt(e.timeout)},...e.ephemeralStorageSize!==void 0&&{ephemeralStorageSize:Kt(e.ephemeralStorageSize)}};return Object.keys(t).length>0?t:void 0}function xDt(e){return sh(e,"database",t=>({type:fn(t.type,HUr),databaseName:De(t.databaseName),databaseEngine:fn(t.databaseEngine,KUr),deletionProtection:cn(t.deletionProtection),backupRetention:Kt(t.backupRetention),port:Kt(t.port),publiclyAccessible:cn(t.publiclyAccessible),allowedIpCidr:De(t.allowedIpCidr),instanceType:De(t.instanceType),allocatedStorage:Kt(t.allocatedStorage),multiAz:cn(t.multiAz),allowVpcAccess:cn(t.allowVpcAccess),monitoringInterval:Kt(t.monitoringInterval),preferredMaintenanceWindow:De(t.preferredMaintenanceWindow),snapshotIdentifier:De(t.snapshotIdentifier),snapshotUsername:De(t.snapshotUsername),readReplica:hB(t.readReplica),writer:Ju(t.writer,_g()),readers:hB(t.readers),databaseInsights:hB(t.databaseInsights),proxy:hB(t.proxy),credentials:Ju(t.credentials,_g()),encryption:Ju(t.encryption,_g())}))}function kDt(e){return sh(e,"compute",t=>({server:Ju(t.server,Fme),imageOptimisation:Ju(t.imageOptimisation,Fme),revalidation:Ju(t.revalidation,Fme)}))}function IDt(e){let t=jc(r=>({versioned:cn(r.versioned)}),"parseVersionedConfig");return sh(e,"storage",r=>({assets:Ju(r.assets,t),cache:Ju(r.cache,t),media:Ju(r.media,t)}))}function RDt(e){return sh(e,"messaging",t=>({revalidationQueue:Ju(t.revalidationQueue,r=>({visibilityTimeout:Kt(r.visibilityTimeout),messageRetentionPeriod:Kt(r.messageRetentionPeriod),maxMessageSize:Kt(r.maxMessageSize),deadLetterQueue:nGe(r.deadLetterQueue)}))}))}function _Dt(e){return sh(e,"cdn",t=>({domainNames:gs(t.domainNames),certificateArn:De(t.certificateArn)}))}function PDt(e){return sh(e,"environment",t=>{let r=Object.fromEntries(Object.entries(t).filter(n=>typeof n[1]=="string"));return Object.keys(r).length>0?r:void 0})}function ODt(e,t){let r=DDt(e);return{name:t,source:De(e.source),build:sh(e,"build",n=>({command:De(n.command),outputDir:De(n.outputDir)})),routing:fn(e.routing,Hu),security:sh(e,"security",n=>({headers:cn(n.headers),contentSecurityPolicy:De(n.contentSecurityPolicy),hsts:Fv(n.hsts,a=>({maxAgeDays:Kt(a.maxAgeDays),includeSubdomains:cn(a.includeSubdomains),preload:cn(a.preload)}))})),domain:De(e.domain),zoneName:De(e.zoneName),hostedZoneId:De(e.hostedZoneId),forms:sh(e,"forms",n=>({to:De(n.to),from:De(n.from),corsOrigin:De(n.corsOrigin),maxConcurrency:Kt(n.maxConcurrency)})),cdn:sh(e,"cdn",n=>({behaviours:Array.isArray(n.behaviours)?n.behaviours:void 0,priceClass:fn(n.priceClass,xP),invalidateOnDeploy:cn(n.invalidateOnDeploy)})),accessGate:sh(e,"accessGate",n=>({type:fn(n.type,["basic-auth"]),username:De(n.username),password:De(n.password)})),...r.length>0&&{unreadableFields:r}}}function EGe(e){return oh(e)&&("__identifier"in e||"__expression"in e||"__call"in e||"__unknown"in e)}function DDt(e){let t=[],r=jc((o,i)=>{EGe(o)&&t.push(i)},"check");r(e.source,"source"),r(e.routing,"routing"),r(e.domain,"domain"),r(e.zoneName,"zoneName"),r(e.hostedZoneId,"hostedZoneId");let n=[[e.build,"build",["command","outputDir"]],[e.security,"security",["headers","contentSecurityPolicy","hsts"]],[e.forms,"forms",["to","from","corsOrigin","maxConcurrency"]],[e.cdn,"cdn",["behaviours","priceClass","invalidateOnDeploy"]],[e.accessGate,"accessGate",["type","username","password"]]];for(let[o,i,s]of n)if(EGe(o))t.push(i);else if(er(o))for(let c of s)r(o[c],`${i}.${c}`);let a=e.security;if(er(a)&&er(a.hsts)){let o=a.hsts;for(let i of["maxAgeDays","includeSubdomains","preload"])r(o[i],`security.hsts.${i}`)}return t}function aE(e){return e!==void 0&&e!==""}function Y8(e,t){return new Error(`Static-site pattern '${e}' in infrastructure.ts: Fjall could not read ${t.join(", ")} as inline literal(s). Fjall reads these fields out of the file and writes them back, so they must be written inline (source: "./site"), not as a variable or an expression.`)}function NDt(e,t){let r=t.to;if(!aE(r))throw Y8(e,["forms.to"]);return{to:r,...t.from!==void 0&&{from:t.from},...t.corsOrigin!==void 0&&{corsOrigin:t.corsOrigin},...t.maxConcurrency!==void 0&&{maxConcurrency:t.maxConcurrency}}}function $Dt(e,t){let r=[];if(t.type!=="basic-auth"&&r.push("accessGate.type"),aE(t.username)||r.push("accessGate.username"),aE(t.password)||r.push("accessGate.password"),r.length>0||t.username===void 0||t.password===void 0)throw Y8(e,r);return{type:"basic-auth",username:t.username,password:t.password}}function MDt(e,t){if(e.arguments.length<2)return null;let r=e.arguments[0],n=e.arguments[1];if(!wB.isStringLiteral(r)||!wB.isObjectLiteralExpression(n))return null;let a=r.text,o=ga(n),i=o.type,s=ih(t),c=De(o.name);return c?i==="payload"||i==="nextjs"?{variableName:s,constructId:a,type:i,config:{name:c,domain:De(o.domain),database:xDt(o),compute:kDt(o),storage:IDt(o),messaging:RDt(o),cdn:_Dt(o),environment:PDt(o)},node:e}:i==="staticsite"?{variableName:s,constructId:a,type:"staticsite",config:ODt(o,c),node:e}:null:null}function AGe(e){return Yu(e,t=>{if(!wB.isCallExpression(t)||!mu(t,"addPattern"))return null;let r=t.arguments[0];return lp(r,"PatternFactory")?MDt(r,t):null})}function wGe(e,t){if(!t||t.length===0)return;let r=t[0];if(e.pattern=r.type,r.type==="staticsite"){let{config:a}=r,o=a.source,i=a.build?.command,s=a.build?.outputDir;if(a.unreadableFields!==void 0)throw Y8(a.name,a.unreadableFields);if(!aE(o)||!aE(i)||!aE(s)){let c=[];throw aE(o)||c.push("source"),aE(i)||c.push("build.command"),aE(s)||c.push("build.outputDir"),Y8(a.name,c)}e.patternConfig={type:"staticsite",name:a.name,source:o,build:{command:i,outputDir:s},routing:a.routing,security:a.security,domain:a.domain,zoneName:a.zoneName,hostedZoneId:a.hostedZoneId,...a.forms!==void 0&&{forms:NDt(a.name,a.forms)},cdn:a.cdn,...a.accessGate!==void 0&&{accessGate:$Dt(a.name,a.accessGate)}};return}let{config:n}=r;e.patternConfig={type:r.type,name:n.name,domain:n.domain,database:n.database,compute:n.compute,storage:n.storage,messaging:n.messaging,cdn:n.cdn,environment:n.environment}}var zUr,jc,HUr,KUr,CGe=w(()=>{"use strict";$();Lc();Lme();zUr=Object.defineProperty,jc=(e,t)=>zUr(e,"name",{value:t,configurable:!0}),HUr=["Instance","Aurora"],KUr=["postgresql","mysql"];jc(Fme,"parseLambdaConfig");jc(xDt,"extractPatternDatabaseConfig");jc(kDt,"extractPatternComputeConfig");jc(IDt,"extractPatternStorageConfig");jc(RDt,"extractPatternMessagingConfig");jc(_Dt,"extractPatternCdnConfig");jc(PDt,"extractPatternEnvironmentConfig");jc(ODt,"extractStaticSiteConfig");jc(EGe,"isUnreadableRef");jc(DDt,"collectUnreadableStaticSiteFields");jc(aE,"isReadable");jc(Y8,"unreadableStaticSiteFields");jc(NDt,"readStaticSiteForms");jc($Dt,"readStaticSiteAccessGate");jc(MDt,"extractPatternResource");jc(AGe,"findPatternResources");jc(wGe,"applyPatternConfig")});function LDt(e,t){for(let r of t){let n=e.compute.find(a=>a.variableName===r.targetVariableName);n!==void 0&&n.type==="lambda"&&(n.scheduleExpression=r.schedule,r.stackPlacement!==void 0&&(n.scheduleStackPlacement=r.stackPlacement))}}function FDt(e,t){Object.keys(t).length>0&&(e.tags={...t}),t[O8]&&(e.owner=t[O8])}function jDt(e){let t=[];for(let r of e)if(Ome(r.moduleSpecifier))if(r.moduleSpecifier==="@fjall/components-infrastructure"||r.moduleSpecifier==="@fjall/infrastructure"){let n=r.namedImports.filter(a=>!oDt.has(a));n.length>0&&t.push({moduleSpecifier:r.moduleSpecifier,namedImports:n,defaultImport:r.defaultImport})}else(r.namedImports.length>0||r.defaultImport)&&t.push(r);return t.length>0?t:void 0}function Og(e,t,r){let n={appName:t,type:"standard",database:[],s3:[],compute:[]};if(wGe(n,e.patternResources),e.vpcId&&(n.vpcId=e.vpcId),n.network=gGe(e.network),n.backup=yGe(e.backup),n.tunnel=vGe(e.tunnel),n.additionalNetworks=SGe(e.networkResources),FDt(n,e.tags),n.database=tGe(e.databaseResources),n.dynamodb=$me(e.dynamodbResources),n.clickhouse=Mme(e.clickhouseResources),n.sqs=oGe(e.sqsResources),n.cdn=sGe(e.cdnResource,e.s3Resources,e.computeResources),n.s3=z4e(e.s3Resources),n.compute=B4e(e.computeResources,e.databaseResources,e.s3Resources,n),LDt(n,e.schedules),n.additionalManagedImports=jDt(e.imports),r?.skipValidation)return n;try{return jBe.parse(n)}catch(a){if(a instanceof h.ZodError){let o=Zf(a);throw new Error(`Invalid infrastructure configuration:
 ${o}`)}throw a}}var qUr,jme,BDt=w(()=>{"use strict";_2();Lt();A4e();rGe();Pme();Rme();Lme();cGe();bGe();CGe();W8();qUr=Object.defineProperty,jme=(e,t)=>qUr(e,"name",{value:t,configurable:!0});jme(LDt,"applyScheduleBackfill");jme(FDt,"applyTagsAndOwner");jme(jDt,"computeAdditionalManagedImports");jme(Og,"convertToResourcePlan")});import*as no from"typescript";function Cl(e,t){let r=no.createSourceFile("infrastructure.ts",e,no.ScriptTarget.Latest,!0,no.ScriptKind.TS),n=UDt(r),{appVariableName:a,appName:o}=VDt(r),i=uGe(r),s=dGe(r),c=pGe(r),l=mGe(r),u=fGe(r),d=Q4e(r),{databases:p,dynamodb:m,clickhouse:f}=eGe(d),y=aGe(r),v=iGe(r),S=[...V4e(r),...W4e(r)],A=kme(r),C=_me(r),T=AGe(r),x=WDt(r),R={sourceFile:r,imports:n,appVariableName:a,appName:o,vpcId:i,network:s,backup:c,tunnel:l,networkResources:u,databaseResources:p,dynamodbResources:m,clickhouseResources:f,sqsResources:y,cdnResource:v,s3Resources:S,computeResources:A,schedules:C,patternResources:T,tags:x};return t?.extractCustomCode&&(R.customCodeBlocks=vB(r),R.classifiedStatements=dp(r)),R}function UDt(e){let t=[];return no.forEachChild(e,r=>{if(no.isImportDeclaration(r)){if(!no.isStringLiteral(r.moduleSpecifier))return;let n={moduleSpecifier:r.moduleSpecifier.text,namedImports:[]};r.importClause&&(r.importClause.name&&(n.defaultImport=r.importClause.name.text),r.importClause.namedBindings&&no.isNamedImports(r.importClause.namedBindings)&&(n.namedImports=r.importClause.namedBindings.elements.map(a=>a.name.text))),t.push(n)}}),t}function GDt(e,t){return no.isStringLiteral(t)?t.text:no.isIdentifier(t)?B8(e,t.text)??"":no.isPropertyAccessExpression(t)?U8(e,t)??"":""}function VDt(e){return ah(e,t=>{if(no.isVariableStatement(t))for(let r of t.declarationList.declarations){if(!r.initializer||!nE(r.initializer))continue;let n=no.isIdentifier(r.name)?r.name.text:"",a=r.initializer.arguments.length>0?GDt(e,r.initializer.arguments[0]):"";return{appVariableName:n,appName:a}}})??{appVariableName:"",appName:""}}function WDt(e){let t={};function r(n){if(no.isCallExpression(n)&&no.isPropertyAccessExpression(n.expression)&&n.expression.name.text==="addTags"&&no.isIdentifier(n.expression.expression)&&n.arguments.length>0){let a=n.arguments[0];if(no.isObjectLiteralExpression(a)){let o=ga(a);for(let[i,s]of Object.entries(o))typeof s=="string"?t[i]=s:SC(s)&&(t[i]="default-value")}}no.forEachChild(n,r)}return CB(r,"visit"),r(e),t}var YUr,CB,Bme=w(()=>{"use strict";Lc();Rme();U4e();W8();K4e();BDt();Lc();rGe();Pme();Rme();U4e();Lme();cGe();bGe();CGe();W8();K4e();YUr=Object.defineProperty,CB=(e,t)=>YUr(e,"name",{value:t,configurable:!0});CB(Cl,"parseInfrastructure");CB(UDt,"extractImports");CB(GDt,"resolveAppName");CB(VDt,"findAppVariable");CB(WDt,"extractTags")});import*as TB from"typescript";function xB(e,t,r){return e.slice(0,t)+r+e.slice(t)}function Ume(e,t){return e.find(r=>r.type===t)}function TGe(e,t){return e.filter(r=>r.type===t).pop()}function uk(e){return TB.createSourceFile("infrastructure.ts",e,TB.ScriptTarget.Latest,!0,TB.ScriptKind.TS)}function Gme(e,t){return e.endsWith(`
@@ -1022,7 +1022,7 @@ ${e.mark.snippet}`),`${e.reason} ${r}`):e.reason}function fAe(e,t,r,n=""){let a=
 `),l}function Ehn(e,t){if(t.valueStart===fhn)return"";let{valueStart:r,valueEnd:n}=t;if(t.fast)return e.slice(r,n);switch(t.style){case 2:return Shn(e,r,n);case 3:return bhn(e,r,n);case 4:return DJt(e,r,n,t.indent,t.chomping,!1);case 5:return DJt(e,r,n,t.indent,t.chomping,!0);default:return vhn(e,r,n)}}function zJt(e,t){if(e.startsWith("!<")&&e.endsWith(">"))return decodeURIComponent(e.slice(2,-1));let r=e.indexOf("!",1),n=r===-1?"!":e.slice(0,r+1),a=t?.[n]??Ahn[n]??n;return decodeURIComponent(a)+decodeURIComponent(e.slice(n.length))}function whn(e){return"tagStart"in e&&e.tagStart!==P3?e.tagStart:"anchorStart"in e&&e.anchorStart!==P3?e.anchorStart:"valueStart"in e&&e.valueStart!==P3?e.valueStart:"start"in e?e.start:0}function cf(e,t){fAe(e.source,e.position,t,e.filename)}function HJt(e,t,r,n){try{return r.finalize(n)}catch(a){if(a instanceof sAe)throw a;fAe(e.source,t,a instanceof Error?a.message:String(a),e.filename)}}function iAe(e,t,r){let n=e[r];if(n)return n;for(let a of t)if(r.startsWith(a.tagName))return a}function Chn(e,t,r,n,a){let o=iAe(t,r,n);if(o)return o;cf(e,`unknown ${a} tag !<${n}>`)}function Thn(e,t){let r=Ehn(e.source,t),n=t.tagStart===P3?"":e.source.slice(t.tagStart,t.tagEnd),a=e.schema.defaultScalarTag;if(n!==""){if(n==="!")return{value:r,tag:a};let o=zJt(n,e.tagHandlers),i=iAe(e.schema.exact.scalar,e.schema.prefix.scalar,o);if(i){let c=i.resolve(r,!0,o);return c===ba&&cf(e,`cannot resolve a node with !<${o}> explicit tag`),{value:c,tag:i}}let s=iAe(e.schema.exact.mapping,e.schema.prefix.mapping,o)??iAe(e.schema.exact.sequence,e.schema.prefix.sequence,o);if(s){r!==""&&cf(e,`cannot resolve a node with !<${o}> explicit tag`);let c=s.create(o);return{value:s.carrierIsResult?c:HJt(e,e.position,s,c),tag:s}}cf(e,`unknown scalar tag !<${o}>`)}if(t.style===1){let o=e.schema.implicitScalarByFirstChar.get(r.charAt(0))??e.schema.implicitScalarAnyFirstChar;for(let i of o){let s=i.resolve(r,!1,i.tagName);if(s!==ba)return{value:s,tag:i}}}return{value:a.resolve(r,!1,a.tagName),tag:a}}function NJt(e,t,r,n,a,o){let i=t.tagStart===P3?"":e.source.slice(t.tagStart,t.tagEnd),s=i===""||i==="!"?a:zJt(i,e.tagHandlers);return{tagName:s,tag:Chn(e,r,n,s,o)}}function KJt(e){return e.nodeKind==="mapping"}function $Jt(e,t,r,n){for(let a of n.keys(r)){if(e.maxTotalMergeKeys!==-1&&++e.totalMergeKeys>e.maxTotalMergeKeys&&cf(e,`merge keys exceeded maxTotalMergeKeys (${e.maxTotalMergeKeys})`),t.tag.has(t.value,a))continue;let o=t.tag.addPair(t.value,a,n.get(r,a));o&&cf(e,o),(t.overridable??=new Set).add(a)}}function xhn(e,t,r,n){if(e.position=t.keyPosition,KJt(n))$Jt(e,t,r,n);else if(n.nodeKind==="sequence"&&Array.isArray(r))for(let a of r)$Jt(e,t,a,t.tag);else cf(e,"cannot merge mappings; the provided source object is unacceptable")}function khn(e,t,r,n,a){if(e.position=t.keyPosition,r===MXe){xhn(e,t,n,a);return}!e.json&&t.tag.has(t.value,r)&&!t.overridable?.has(r)&&cf(e,"duplicated mapping key");let o=t.tag.addPair(t.value,r,n);o&&cf(e,o),t.overridable?.delete(r)}function kXe(e,t,r){let n=e.frames[e.frames.length-1];if(n.kind==="document")n.value=t,n.hasValue=!0;else if(n.kind==="sequence"){n.merge&&(KJt(r)||cf(e,"cannot merge mappings; the provided source object is unacceptable"));let a=n.tag.addItem(n.value,t,n.index++);a&&cf(e,a)}else if(n.hasKey){let a=n.key;n.key=void 0,n.hasKey=!1,khn(e,n,a,t,r)}else n.key=t,n.keyPosition=e.position,n.hasKey=!0}function IXe(e,t,r,n,a){if(t.anchorStart!==P3){let o={value:r,tag:n,isValueFinal:a};return e.anchors.set(e.source.slice(t.anchorStart,t.anchorEnd),o),o}return null}function Ihn(e,t){let r={...GXe,...t,events:e,documents:[],eventIndex:0,position:0,frames:[],anchors:new Map,tagHandlers:Object.create(null),totalMergeKeys:0,aliasCount:0};for(;r.eventIndex<r.events.length;){let n=r.events[r.eventIndex++];switch(r.position=whn(n),n.type){case 1:r.anchors=new Map,r.aliasCount=0,r.tagHandlers=Object.create(null);for(let a of n.directives)a.kind==="tag"&&(r.tagHandlers[a.handle]=a.prefix);r.frames.push({kind:"document",position:r.position,value:void 0,hasValue:!1});break;case 4:{let{value:a,tag:o}=Thn(r,n);IXe(r,n,a,o,!0),kXe(r,a,o);break}case 2:{let a=NJt(r,n,r.schema.exact.sequence,r.schema.prefix.sequence,"tag:yaml.org,2002:seq","sequence"),o=a.tag.create(a.tagName),i=IXe(r,n,o,a.tag,a.tag.carrierIsResult),s=r.frames[r.frames.length-1],c=s!==void 0&&s.kind==="mapping"&&s.hasKey&&s.key===MXe;r.frames.push({kind:"sequence",position:r.position,value:o,tag:a.tag,anchor:i,index:0,merge:c});break}case 3:{let a=NJt(r,n,r.schema.exact.mapping,r.schema.prefix.mapping,"tag:yaml.org,2002:map","mapping"),o=a.tag.create(a.tagName),i=IXe(r,n,o,a.tag,a.tag.carrierIsResult);r.frames.push({kind:"mapping",position:r.position,value:o,tag:a.tag,anchor:i,key:void 0,keyPosition:r.position,hasKey:!1,overridable:null});break}case 5:{r.maxAliases!==-1&&++r.aliasCount>r.maxAliases&&cf(r,`aliases exceeded maxAliases (${r.maxAliases})`);let a=r.source.slice(n.anchorStart,n.anchorEnd),o=r.anchors.get(a);o||cf(r,`unidentified alias "${a}"`),o.isValueFinal||cf(r,`recursive alias "${a}" is not supported for tag ${o.tag.tagName} because it uses finalize()`),kXe(r,o.value,o.tag);break}case 6:{let a=r.frames.pop();if(a.kind==="document")r.documents.push(a.value);else{let o=a.tag.carrierIsResult?a.value:HJt(r,a.position,a.tag,a.value);a.anchor&&(a.anchor.value=o,a.anchor.isValueFinal=!0),kXe(r,o,a.tag)}break}}}return r.documents}function Nhn(e,t,r){e.events.push({type:1,explicitStart:t,explicitEnd:r,directives:e.directives})}function XJt(e,t,r,n,a,o,i){e.events.push({type:2,start:t,anchorStart:r,anchorEnd:n,tagStart:a,tagEnd:o,style:i})}function NXe(e,t,r,n,a,o,i){e.events.push({type:3,start:t,anchorStart:r,anchorEnd:n,tagStart:a,tagEnd:o,style:i})}function MJt(e,t){e.events.splice(t.eventsLength,0,{type:3,start:t.position,anchorStart:Ra,anchorEnd:Ra,tagStart:Ra,tagEnd:Ra,style:2})}function $3(e,t,r,n,a,o,i,s,c=1,l=-1,u=!1){e.events.push({type:4,valueStart:t,valueEnd:r,anchorStart:n,anchorEnd:a,tagStart:o,tagEnd:i,style:s,chomping:c,indent:l,fast:u})}function $hn(e,t,r){e.events.push({type:5,anchorStart:t,anchorEnd:r})}function O3(e){e.events.push({type:6})}function Fp(e){$3(e,Ra,Ra,Ra,Ra,Ra,Ra,1)}function LJt(){return{anchorStart:Ra,anchorEnd:Ra,tagStart:Ra,tagEnd:Ra}}function SQ(e){return{position:e.position,line:e.line,lineStart:e.lineStart,lineIndent:e.lineIndent,firstTabInLine:e.firstTabInLine,eventsLength:e.events.length}}function D3(e,t){e.position=t.position,e.line=t.line,e.lineStart=t.lineStart,e.lineIndent=t.lineIndent,e.firstTabInLine=t.firstTabInLine,e.events.length=t.eventsLength}function yr(e,t){fAe(e.input.slice(0,e.length),e.position,t,e.filename)}function Nl(e){return e===10||e===13}function j1(e){return e===9||e===32}function kS(e){return j1(e)||Nl(e)}function T0(e){return e===0||kS(e)}function B1(e){return e===44||e===91||e===93||e===123||e===125}function Mhn(e){return e>=48&&e<=57?e-48:-1}function Lhn(e){if(e>=48&&e<=57)return e-48;let t=e|32;return t>=97&&t<=102?t-97+10:-1}function Fhn(e){return e===120?2:e===117?4:e===85?8:0}function jhn(e){return e===48||e===97||e===98||e===116||e===9||e===110||e===118||e===102||e===114||e===101||e===32||e===34||e===47||e===92||e===78||e===95||e===76||e===80}function uAe(e){e.input.charCodeAt(e.position)===10?e.position++:(e.position++,e.input.charCodeAt(e.position)===10&&e.position++),e.line++,e.lineStart=e.position,e.lineIndent=0,e.firstTabInLine=-1}function jp(e,t){let r=0,n=e.input.charCodeAt(e.position),a=e.position===e.lineStart||kS(e.input.charCodeAt(e.position-1));for(;n!==0;){for(;j1(n);)a=!0,n===9&&e.firstTabInLine===-1&&(e.firstTabInLine=e.position),n=e.input.charCodeAt(++e.position);if(t&&a&&n===35)do n=e.input.charCodeAt(++e.position);while(!Nl(n)&&n!==0);if(!Nl(n))break;for(uAe(e),r++,a=!0,n=e.input.charCodeAt(e.position);n===32;)e.lineIndent++,n=e.input.charCodeAt(++e.position)}return r}function WI(e,t=e.position){let r=e.input.charCodeAt(t);if((r===45||r===46)&&r===e.input.charCodeAt(t+1)&&r===e.input.charCodeAt(t+2)){let n=e.input.charCodeAt(t+3);return n===0||kS(n)}return!1}function FJt(e){let t=e.input.charCodeAt(e.position);for(;t!==0&&!Nl(t);)t=e.input.charCodeAt(++e.position)}function QJt(e,t,r){Rhn.test(e.input.slice(t,r))&&yr(e,"the stream contains non-printable characters")}function Bhn(e,t,r){if(e.input.charCodeAt(e.position)!==33)return!1;t.tagStart!==Ra&&yr(e,"duplication of a tag property");let n=e.position,a=!1,o=!1,i="!",s=e.input.charCodeAt(++e.position);s===60?(a=!0,s=e.input.charCodeAt(++e.position)):s===33&&(o=!0,i="!!",s=e.input.charCodeAt(++e.position));let c=e.position,l;if(a){for(;s!==0&&s!==62;)s=e.input.charCodeAt(++e.position);s!==62&&yr(e,"unexpected end of the stream within a verbatim tag"),l=e.input.slice(c,e.position),e.position++}else{for(;s!==0&&!kS(s)&&!(r&&B1(s));)s===33&&(o?yr(e,"tag suffix cannot contain exclamation marks"):(i=e.input.slice(c-1,e.position+1),JJt.test(i)||yr(e,"named tag handle cannot contain such characters"),o=!0,c=e.position+1)),s=e.input.charCodeAt(++e.position);l=e.input.slice(c,e.position),_hn.test(l)&&yr(e,"tag suffix cannot contain flow indicator characters")}return l&&!(a?Phn.test(l):Ohn.test(l))&&yr(e,`tag name cannot contain such characters: ${l}`),!a&&i!=="!"&&i!=="!!"&&!qJt.call(e.tagHandlers,i)&&yr(e,`undeclared tag handle "${i}"`),t.tagStart=n,t.tagEnd=e.position,!0}function Uhn(e,t){if(e.input.charCodeAt(e.position)!==38)return!1;t.anchorStart!==Ra&&yr(e,"duplication of an anchor property"),e.position++;let r=e.position;for(;e.input.charCodeAt(e.position)!==0&&!kS(e.input.charCodeAt(e.position))&&!B1(e.input.charCodeAt(e.position));)e.position++;return e.position===r&&yr(e,"name of an anchor node must contain at least one character"),t.anchorStart=r,t.anchorEnd=e.position,!0}function Ghn(e,t){if(e.input.charCodeAt(e.position)!==42)return!1;(t.anchorStart!==Ra||t.tagStart!==Ra)&&yr(e,"alias node should not have any properties"),e.position++;let r=e.position;for(;e.input.charCodeAt(e.position)!==0&&!kS(e.input.charCodeAt(e.position))&&!B1(e.input.charCodeAt(e.position));)e.position++;return e.position===r&&yr(e,"name of an alias node must contain at least one character"),$hn(e,r,e.position),!0}function $Xe(e,t){jp(e,!1),e.lineIndent<t&&yr(e,"deficient indentation")}function Vhn(e,t,r){if(e.input.charCodeAt(e.position)!==39)return!1;e.position++;let n=e.position,a=!0;for(;e.input.charCodeAt(e.position)!==0;){let o=e.input.charCodeAt(e.position);if(o===39){if(e.input.charCodeAt(e.position+1)===39){a=!1,e.position+=2;continue}let i=e.position;return e.position++,$3(e,n,i,r.anchorStart,r.anchorEnd,r.tagStart,r.tagEnd,2,1,-1,a),!0}Nl(o)?(a=!1,$Xe(e,t)):e.position===e.lineStart&&WI(e)?yr(e,"unexpected end of the document within a single quoted scalar"):o!==9&&o<32?yr(e,"expected valid JSON character"):e.position++}yr(e,"unexpected end of the stream within a single quoted scalar")}function Whn(e,t,r){if(e.input.charCodeAt(e.position)!==34)return!1;e.position++;let n=e.position,a=!0;for(;e.input.charCodeAt(e.position)!==0;){let o=e.input.charCodeAt(e.position);if(o===34){let i=e.position;return e.position++,$3(e,n,i,r.anchorStart,r.anchorEnd,r.tagStart,r.tagEnd,3,1,-1,a),!0}if(o===92){a=!1;let i=e.input.charCodeAt(++e.position);if(Nl(i))$Xe(e,t);else if(jhn(i))e.position++;else{let s=Fhn(i);for(s===0&&yr(e,"unknown escape sequence");s-- >0;)e.position++,Lhn(e.input.charCodeAt(e.position))<0&&yr(e,"expected hexadecimal character");e.position++}}else Nl(o)?(a=!1,$Xe(e,t)):e.position===e.lineStart&&WI(e)?yr(e,"unexpected end of the document within a double quoted scalar"):o!==9&&o<32?yr(e,"expected valid JSON character"):e.position++}yr(e,"unexpected end of the stream within a double quoted scalar")}function zhn(e,t,r){let n=e.input.charCodeAt(e.position),a=1,o=-1,i=!1;if(n!==124&&n!==62)return!1;let s=n===124?4:5;for(e.position++;e.input.charCodeAt(e.position)!==0;){let m=e.input.charCodeAt(e.position),f=Mhn(m);if(m===43||m===45)a!==1&&yr(e,"repeat of a chomping mode identifier"),a=m===43?3:2,e.position++;else if(f>=0)f===0&&yr(e,"bad explicit indentation width of a block scalar; it cannot be less than one"),i&&yr(e,"repeat of an indentation width identifier"),o=t+f-1,i=!0,e.position++;else break}let c=!1;for(;j1(e.input.charCodeAt(e.position));)c=!0,e.position++;c&&e.input.charCodeAt(e.position)===35&&FJt(e),Nl(e.input.charCodeAt(e.position))?uAe(e):e.input.charCodeAt(e.position)!==0&&yr(e,"a line break is expected");let l=i?o:-1,u=0,d=e.position,p=e.position;for(;e.input.charCodeAt(e.position)!==0;){let m=e.position,f=0;for(;e.input.charCodeAt(m+f)===32;)f++;let y=e.input.charCodeAt(m+f);if(y===0){l>=0?f>l&&(p=m+f):f>0&&(p=m+f);break}if(m===e.lineStart&&WI(e,m))break;if(!i&&l===-1&&Nl(y)&&(u=Math.max(u,f)),!i&&l===-1&&!Nl(y)&&(y===9&&f<t&&(e.position=m+f,yr(e,"tab characters must not be used in indentation")),f<u&&(e.position=m+f,yr(e,"bad indentation of a mapping entry"))),l===-1&&y!==0&&!Nl(y)&&f<t){e.lineIndent=f,e.position=m+f;break}!i&&y!==0&&!Nl(y)&&l===-1&&(l=f);let v=l===-1?t+1:l;if(y!==0&&!Nl(y)&&f<v){e.lineIndent=f,e.position=m+f;break}FJt(e),p=e.position,Nl(e.input.charCodeAt(e.position))&&(uAe(e),p=e.position)}return QJt(e,d,p),$3(e,d,p,r.anchorStart,r.anchorEnd,r.tagStart,r.tagEnd,s,a,l),!0}function Hhn(e,t){let r=e.input.charCodeAt(e.position),n=t===N3;if(r===0||kS(r)||r===35||r===38||r===42||r===33||r===124||r===62||r===39||r===34||r===37||r===64||r===96||n&&B1(r))return!1;if(r===63||r===45){let a=e.input.charCodeAt(e.position+1);if(T0(a)||n&&B1(a))return!1}return!0}function Khn(e,t,r,n){if(!Hhn(e,r))return!1;let a=e.position,o=e.position,i=e.input.charCodeAt(e.position),s=r===N3,c=!1;for(;i!==0&&!(e.position===e.lineStart&&WI(e));){if(i===58){let l=e.input.charCodeAt(e.position+1);if(T0(l)||s&&B1(l))break}else if(i===35){if(kS(e.input.charCodeAt(e.position-1)))break}else{if(s&&B1(i))break;if(Nl(i)){let l=e.position,u=e.line,d=e.lineStart,p=e.lineIndent;if(jp(e,!1),e.lineIndent>=t){c=!0,i=e.input.charCodeAt(e.position);continue}e.position=l,e.line=u,e.lineStart=d,e.lineIndent=p;break}}j1(i)||(o=e.position+1),i=e.input.charCodeAt(++e.position)}return o===a?!1:(QJt(e,a,o),$3(e,a,o,n.anchorStart,n.anchorEnd,n.tagStart,n.tagEnd,1,1,-1,!c),!0)}function vQ(e,t){let r=e.line;jp(e,!0),(e.line>r&&e.lineIndent<t||e.firstTabInLine!==-1&&e.lineIndent<t)&&yr(e,"deficient indentation")}function qhn(e,t,r){let n=e.input.charCodeAt(e.position),a=n===123,o=e.position,i=!0;if(n!==91&&n!==123)return!1;let s=a?125:93;for(a?NXe(e,o,r.anchorStart,r.anchorEnd,r.tagStart,r.tagEnd,2):XJt(e,o,r.anchorStart,r.anchorEnd,r.tagStart,r.tagEnd,2),e.position++;e.input.charCodeAt(e.position)!==0;){vQ(e,t);let c=e.input.charCodeAt(e.position);if(c===s)return e.position++,O3(e),!0;i?c===44&&yr(e,"expected the node content, but found ','"):yr(e,"missed comma between flow collection entries");let l=!1,u=!1;c===63&&kS(e.input.charCodeAt(e.position+1))&&(l=u=!0,e.position+=1,vQ(e,t));let d=e.line,p=SQ(e),m=F1(e,t,N3,!1,!0);vQ(e,t),c=e.input.charCodeAt(e.position),(a||u||e.line===d)&&c===58?(l=!0,e.position++,vQ(e,t),a||MJt(e,p),m||Fp(e),F1(e,t,N3,!1,!0)||Fp(e),vQ(e,t),a||O3(e)):a&&l?(m||Fp(e),Fp(e)):a?Fp(e):l&&(MJt(e,p),m||Fp(e),Fp(e),O3(e)),c=e.input.charCodeAt(e.position),c===44?(i=!0,e.position++):i=!1}yr(e,"unexpected end of the stream within a flow collection")}function jJt(e,t,r){if(e.firstTabInLine!==-1||e.input.charCodeAt(e.position)!==45||!T0(e.input.charCodeAt(e.position+1)))return!1;for(XJt(e,e.position,r.anchorStart,r.anchorEnd,r.tagStart,r.tagEnd,1);e.input.charCodeAt(e.position)===45&&T0(e.input.charCodeAt(e.position+1));){e.firstTabInLine!==-1&&(e.position=e.firstTabInLine,yr(e,"tab characters must not be used in indentation"));let n=e.line;e.position++;let a=jp(e,!0)>0;if(e.firstTabInLine!==-1&&e.input.charCodeAt(e.position)===45&&T0(e.input.charCodeAt(e.position+1))&&yr(e,"bad indentation of a sequence entry"),a&&e.lineIndent<=t?Fp(e):F1(e,t,YJt,!1,!0),jp(e,!0),e.lineIndent<t||e.position>=e.length)break;e.lineIndent>t&&yr(e,"bad indentation of a sequence entry"),e.line===n&&e.input.charCodeAt(e.position)===45&&T0(e.input.charCodeAt(e.position+1))&&yr(e,"bad indentation of a sequence entry")}return O3(e),!0}function RXe(e,t,r,n){let a=!1,o=!1,i=!1,s=!1;if(e.firstTabInLine!==-1)return!1;let c=e.input.charCodeAt(e.position);for(;c!==0;){!a&&e.firstTabInLine!==-1&&(e.position=e.firstTabInLine,yr(e,"tab characters must not be used in indentation"));let l=e.input.charCodeAt(e.position+1),u=e.line;if((c===63||c===58)&&T0(l))i||(NXe(e,e.position,n.anchorStart,n.anchorEnd,n.tagStart,n.tagEnd,1),i=!0),c===63?(a&&Fp(e),o=!0,a=!0):(a||(Fp(e),o=!0),a=!1),e.position+=1,s=!0;else{a&&(Fp(e),a=!1);let d=SQ(e);if(!F1(e,r,OXe,!1,!0))break;if(e.line===u){for(c=e.input.charCodeAt(e.position);j1(c);)c=e.input.charCodeAt(++e.position);if(c===58){if(c=e.input.charCodeAt(++e.position),T0(c)||yr(e,"a whitespace character is expected after the key-value separator within a block mapping"),!i){for(D3(e,d),NXe(e,d.position,n.anchorStart,n.anchorEnd,n.tagStart,n.tagEnd,1),i=!0,F1(e,r,OXe,!1,!0),c=e.input.charCodeAt(e.position);j1(c);)c=e.input.charCodeAt(++e.position);e.position++}o=!0,a=!1,s=!1}else if(o)yr(e,"expected ':' after a mapping key");else return n.anchorStart!==Ra||n.tagStart!==Ra?(D3(e,d),!1):!0}else if(o)yr(e,"can not read a block mapping entry; a multiline key may not be an implicit key");else return n.anchorStart!==Ra||n.tagStart!==Ra?(D3(e,d),!1):!0}if(F1(e,t,lAe,!0,s)&&(s=!1),a||s&&(Fp(e),s=!1),jp(e,!0),c=e.input.charCodeAt(e.position),(e.line===u||e.lineIndent>t)&&c!==0)yr(e,"bad indentation of a mapping entry");else if(e.lineIndent<t)break}return o?(a&&Fp(e),i&&O3(e),!0):!1}function F1(e,t,r,n,a,o=!0){e.depth>=e.maxDepth&&yr(e,`nesting exceeded maxDepth (${e.maxDepth})`),e.depth++;let i=1,s=!1,c=!1,l=null,u=LJt(),d=r===lAe||r===YJt,p=d,m=d;if(n&&jp(e,!0)&&(s=!0,e.lineIndent>t?i=1:e.lineIndent===t?i=0:i=-1),e.position===e.lineStart&&WI(e))return e.depth--,!1;if(i===1)for(;;){let f=e.input.charCodeAt(e.position),y=SQ(e);if(s&&i!==1&&(f===33||f===38))break;if(s&&m&&(u.tagStart!==Ra||u.anchorStart!==Ra)&&(f===33||f===38)){let v=SQ(e),S=t+1;if(RXe(e,e.position-e.lineStart,S,u)&&e.events[v.eventsLength]?.type===3)return e.depth--,!0;D3(e,v)}if(s&&(f===33&&u.tagStart!==Ra||f===38&&u.anchorStart!==Ra)||!Bhn(e,u,r===N3)&&!Uhn(e,u))break;l===null&&(l=y),jp(e,!0)?(s=!0,p=m,e.lineIndent>t?i=1:e.lineIndent===t?i=0:i=-1):p=!1}if(p&&(p=s||a),i===1||r===lAe){let f=r===N3||r===OXe?t:t+1,y=e.position-e.lineStart;if(i===1)if(p&&(jJt(e,y,u)||RXe(e,y,f,u))||qhn(e,f,u))c=!0;else{let v=e.input.charCodeAt(e.position);if(l!==null&&o&&m&&!p&&v!==124&&v!==62){let S=SQ(e),A=l.position-l.lineStart;D3(e,l),RXe(e,A,f,LJt())&&e.events[S.eventsLength]?.type===3?c=!0:D3(e,S)}!c&&(d&&zhn(e,f,u)||Vhn(e,f,u)||Whn(e,f,u)||Ghn(e,u)||Khn(e,f,r,u))&&(c=!0)}else i===0&&(c=p&&jJt(e,y,u))}return d=d&&!c,!c&&(u.anchorStart!==Ra||u.tagStart!==Ra||d)&&($3(e,Ra,Ra,u.anchorStart,u.anchorEnd,u.tagStart,u.tagEnd,1),c=!0),e.depth--,c||u.anchorStart!==Ra||u.tagStart!==Ra}function Yhn(e){if(e.lineIndent>0||e.input.charCodeAt(e.position)!==37)return!1;e.position++;let t=e.position;for(;e.input.charCodeAt(e.position)!==0&&!kS(e.input.charCodeAt(e.position));)e.position++;let r=e.input.slice(t,e.position),n=[];for(r.length===0&&yr(e,"directive name must not be less than one character in length");e.input.charCodeAt(e.position)!==0&&!Nl(e.input.charCodeAt(e.position));){for(;j1(e.input.charCodeAt(e.position));)e.position++;if(e.input.charCodeAt(e.position)===35||Nl(e.input.charCodeAt(e.position))||e.input.charCodeAt(e.position)===0)break;let a=e.position;for(;e.input.charCodeAt(e.position)!==0&&!kS(e.input.charCodeAt(e.position));)e.position++;n.push(e.input.slice(a,e.position))}if(Nl(e.input.charCodeAt(e.position))&&uAe(e),r==="YAML"){e.directives.some(o=>o.kind==="yaml")&&yr(e,"duplication of %YAML directive"),n.length!==1&&yr(e,"YAML directive accepts exactly one argument");let a=/^([0-9]+)\.([0-9]+)$/.exec(n[0]);a===null&&yr(e,"ill-formed argument of the YAML directive"),parseInt(a[1],10)!==1&&yr(e,"unacceptable YAML version of the document"),e.directives.push({kind:"yaml",version:n[0]})}else if(r==="TAG"){n.length!==2&&yr(e,"TAG directive accepts exactly two arguments");let[a,o]=n;JJt.test(a)||yr(e,"ill-formed tag handle (first argument) of the TAG directive"),qJt.call(e.tagHandlers,a)&&yr(e,`there is a previously declared suffix for "${a}" tag handle`),Dhn.test(o)||yr(e,"ill-formed tag prefix (second argument) of the TAG directive"),e.tagHandlers[a]=o,e.directives.push({kind:"tag",handle:a,prefix:o})}return!0}function Jhn(e){e.directives=[],e.tagHandlers=Object.create(null);let t=!1;for(jp(e,!0);Yhn(e);)t=!0,jp(e,!0);let r=!1,n=!1,a=!0;if(e.lineIndent===0&&e.input.charCodeAt(e.position)===45&&e.input.charCodeAt(e.position+1)===45&&e.input.charCodeAt(e.position+2)===45&&T0(e.input.charCodeAt(e.position+3))){r=!0;let s=e.line;e.position+=3,jp(e,!0),a=e.line>s}else t&&yr(e,"directives end mark is expected");let o=e.events.length;if(!r&&e.position===e.lineStart&&e.input.charCodeAt(e.position)===46&&WI(e)){e.position+=3,jp(e,!0);return}if(Nhn(e,r,!1),F1(e,e.lineIndent-1,lAe,!1,a,a)||Fp(e),jp(e,!0),e.position===e.lineStart&&WI(e)&&(n=e.input.charCodeAt(e.position)===46,n)){let s=e.line;e.position+=3,jp(e,!0),e.line===s&&e.position<e.length&&yr(e,"end of the stream or a document separator is expected")}let i=e.events[o];i?.type===1&&(i.explicitEnd=n),O3(e),!n&&e.position<e.length&&!(e.position===e.lineStart&&WI(e))&&yr(e,"end of the stream or a document separator is expected")}function Zhn(e,t){let r=e.length,n={...VXe,...t,input:`${e}\0`,length:r,position:0,line:0,lineStart:0,lineIndent:0,firstTabInLine:-1,depth:0,directives:[],tagHandlers:Object.create(null),events:[]},a=e.indexOf("\0");for(a!==-1&&fAe(e,a,"null byte is not allowed in input",n.filename),n.input.charCodeAt(n.position)===65279&&n.position++;n.position<n.length&&(jp(n,!0),!(n.position>=n.length));){let o=n.position;Jhn(n),n.position===o&&yr(n,"can not read a document")}return n.events}function Qhn(e,t={}){let r={...Xhn,...t},n=String(e),a=Object.keys(VXe),o=Object.keys(GXe);return Ihn(Zhn(n,RJt(r,a)),{...RJt(r,o),source:n})}function eZt(e,t){let r=Qhn(e,t);if(r.length===0)throw new sAe("expected a document, but the input is empty");if(r.length===1)return r[0];throw new sAe("expected a single document in the stream, but found more")}var ba,MXe,lfn,ufn,dfn,pfn,mfn,ffn,hfn,gfn,yfn,vfn,Sfn,bfn,Efn,Afn,wfn,Cfn,Tfn,BJt,Ifn,Rfn,Ofn,Dfn,_Xe,Mfn,Lfn,UJt,Bfn,Ufn,Wfn,zfn,Hfn,PXe,FXe,Yfn,Xfn,Qfn,ehn,rhn,nhn,ahn,ohn,ihn,shn,mAe,jXe,Ono,BXe,dhn,Dno,Nno,phn,sAe,fhn,VJt,WJt,Ahn,P3,GXe,Ra,qJt,N3,OXe,YJt,lAe,Rhn,_hn,JJt,DXe,ZJt,Phn,Ohn,Dhn,VXe,Xhn,Bp,egn,tgn,$no,tZt=w(()=>{ba=Symbol("NOT_RESOLVED"),MXe=Symbol("MERGE_KEY");lfn=yd("tag:yaml.org,2002:str",{resolve:e=>e,identify:e=>typeof e=="string"}),ufn=["","~","null","Null","NULL"],dfn=yd("tag:yaml.org,2002:null",{implicit:!0,implicitFirstChars:["","~","n","N"],resolve:e=>ufn.indexOf(e)!==-1?null:ba,identify:e=>e===null,represent:()=>"null"}),pfn=yd("tag:yaml.org,2002:null",{implicit:!0,implicitFirstChars:["n"],resolve:(e,t)=>e==="null"||t&&e===""?null:ba,identify:e=>e===null,represent:()=>"null"}),mfn=["","~","null","Null","NULL"],ffn=yd("tag:yaml.org,2002:null",{implicit:!0,implicitFirstChars:["","~","n","N"],resolve:e=>mfn.indexOf(e)!==-1?null:ba,identify:e=>e===null,represent:()=>"null"}),hfn=["true","True","TRUE"],gfn=["false","False","FALSE"],yfn=yd("tag:yaml.org,2002:bool",{implicit:!0,implicitFirstChars:["t","T","f","F"],resolve:e=>hfn.indexOf(e)!==-1?!0:gfn.indexOf(e)!==-1?!1:ba,identify:e=>Object.prototype.toString.call(e)==="[object Boolean]",represent:e=>e?"true":"false"}),vfn=["true"],Sfn=["false"],bfn=yd("tag:yaml.org,2002:bool",{implicit:!0,implicitFirstChars:["t","f"],resolve:e=>vfn.indexOf(e)!==-1?!0:Sfn.indexOf(e)!==-1?!1:ba,identify:e=>Object.prototype.toString.call(e)==="[object Boolean]",represent:e=>e?"true":"false"}),Efn=["true","True","TRUE","y","Y","yes","Yes","YES","on","On","ON"],Afn=["false","False","FALSE","n","N","no","No","NO","off","Off","OFF"],wfn=yd("tag:yaml.org,2002:bool",{implicit:!0,implicitFirstChars:["y","Y","n","N","t","T","f","F","o","O"],resolve:e=>Efn.indexOf(e)!==-1?!0:Afn.indexOf(e)!==-1?!1:ba,identify:e=>Object.prototype.toString.call(e)==="[object Boolean]",represent:e=>e?"true":"false"}),Cfn=new RegExp("^(?:0o[0-7]+|0x[0-9a-fA-F]+|[-+]?[0-9]+)$"),Tfn=new RegExp("^(?:[-+]?0b[0-1]+|[-+]?0o[0-7]+|[-+]?0x[0-9a-fA-F]+|[-+]?[0-9]+)$");BJt=yd("tag:yaml.org,2002:int",{implicit:!0,implicitFirstChars:["-","+",..."0123456789"],resolve:kfn,identify:e=>Number.isInteger(e)&&!Object.is(e,-0)&&e.toString(10).indexOf("e")<0,represent:e=>e.toString(10)}),Ifn=new RegExp("^-?(?:0|[1-9][0-9]*)$"),Rfn=new RegExp("^(?:[-+]?0b[0-1]+|[-+]?0o[0-7]+|[-+]?0x[0-9a-fA-F]+|[-+]?[0-9]+)$");Ofn=yd("tag:yaml.org,2002:int",{implicit:!0,implicitFirstChars:["-",..."0123456789"],resolve:Pfn,identify:e=>Number.isInteger(e)&&!Object.is(e,-0)&&e.toString(10).indexOf("e")<0,represent:e=>e.toString(10)}),Dfn=new RegExp("^(?:[-+]?0b[0-1_]+|[-+]?0[0-7_]+|[-+]?0x[0-9a-fA-F_]+|[-+]?[0-9][0-9_]*(?::[0-5]?[0-9])+|[-+]?(?:0|[1-9][0-9_]*))$");_Xe=yd("tag:yaml.org,2002:int",{implicit:!0,implicitFirstChars:["-","+",..."0123456789"],resolve:$fn,identify:e=>Number.isInteger(e)&&!Object.is(e,-0)&&e.toString(10).indexOf("e")<0,represent:e=>e.toString(10)}),Mfn=new RegExp("^(?:[-+]?[0-9]+(?:\\.[0-9]*)?(?:[eE][-+]?[0-9]+)?|[-+]?\\.[0-9]+(?:[eE][-+]?[0-9]+)?|[-+]?\\.(?:inf|Inf|INF)|\\.(?:nan|NaN|NAN))$"),Lfn=new RegExp("^(?:[-+]?\\.(?:inf|Inf|INF)|\\.(?:nan|NaN|NAN))$");UJt=yd("tag:yaml.org,2002:float",{implicit:!0,implicitFirstChars:["-","+",".",..."0123456789"],resolve:Ffn,identify:e=>typeof e=="number"&&(!Number.isInteger(e)||Object.is(e,-0)||e.toString(10).indexOf("e")>=0),represent:jfn}),Bfn=new RegExp("^-?(?:0|[1-9][0-9]*)(?:\\.[0-9]*)?(?:[eE][-+]?[0-9]+)?$"),Ufn=new RegExp("^(?:[-+]?[0-9]+(?:\\.[0-9]*)?(?:[eE][-+]?[0-9]+)?|[-+]?\\.[0-9]+(?:[eE][-+]?[0-9]+)?|[-+]?\\.(?:inf|Inf|INF)|\\.(?:nan|NaN|NAN))$");Wfn=yd("tag:yaml.org,2002:float",{implicit:!0,implicitFirstChars:["-",..."0123456789"],resolve:Gfn,identify:e=>typeof e=="number"&&(!Number.isInteger(e)||Object.is(e,-0)||e.toString(10).indexOf("e")>=0),represent:Vfn}),zfn=new RegExp("^(?:[-+]?(?:(?:[0-9][0-9_]*)?\\.[0-9_]*)(?:[eE][-+][0-9]+)?|[-+]?[0-9][0-9_]*(?::[0-5]?[0-9])+\\.[0-9_]*|[-+]?\\.(?:inf|Inf|INF)|\\.(?:nan|NaN|NAN))$"),Hfn=new RegExp("^(?:[-+]?\\.(?:inf|Inf|INF)|\\.(?:nan|NaN|NAN))$");PXe=yd("tag:yaml.org,2002:float",{implicit:!0,implicitFirstChars:["-","+",".",..."0123456789"],resolve:Kfn,identify:e=>typeof e=="number"&&(!Number.isInteger(e)||Object.is(e,-0)||e.toString(10).indexOf("e")>=0),represent:qfn}),FXe=yd("tag:yaml.org,2002:merge",{implicit:!0,implicitFirstChars:["<"],resolve:(e,t)=>e==="<<"||t&&e===""?MXe:ba}),Yfn=/^[A-Za-z0-9+/]*={0,2}$/;Xfn=yd("tag:yaml.org,2002:binary",{resolve:Jfn,identify:e=>Object.prototype.toString.call(e)==="[object Uint8Array]",represent:Zfn}),Qfn=new RegExp("^([0-9][0-9][0-9][0-9])-([0-9][0-9])-([0-9][0-9])$"),ehn=new RegExp("^([0-9][0-9][0-9][0-9])-([0-9][0-9]?)-([0-9][0-9]?)(?:[Tt]|[ \\t]+)([0-9][0-9]?):([0-9][0-9]):([0-9][0-9])(?:\\.([0-9]*))?(?:[ \\t]*(Z|([-+])([0-9][0-9]?)(?::([0-9][0-9]))?))?$");rhn=yd("tag:yaml.org,2002:timestamp",{implicit:!0,implicitFirstChars:[..."0123456789"],resolve:thn,identify:e=>e instanceof Date,represent:e=>e.toISOString()}),nhn=LXe("tag:yaml.org,2002:seq",{create:()=>[],addItem:(e,t)=>{e.push(t)},identify:Array.isArray});ahn=LXe("tag:yaml.org,2002:omap",{create:()=>({list:[],seen:new Set}),addItem:(e,t)=>{let r;if(t instanceof Map){if(t.size!==1)return"cannot resolve an ordered map item";r=t.keys().next().value}else if(pAe(t)){let n=Object.keys(t);if(n.length!==1)return"cannot resolve an ordered map item";r=n[0]}else return"cannot resolve an ordered map item";return e.seen.has(r)?"duplicate key in ordered map":(e.seen.add(r),e.list.push(t),"")},finalize:e=>e.list}),ohn=LXe("tag:yaml.org,2002:pairs",{create:()=>[],addItem:(e,t)=>{if(t instanceof Map)return t.size!==1?"cannot resolve a pairs item":(e.push(t.entries().next().value),"");if(Object.prototype.toString.call(t)!=="[object Object]")return"cannot resolve a pairs item";let r=t,n=Object.keys(r);return n.length!==1?"cannot resolve a pairs item":(e.push([n[0],r[n[0]]]),"")}}),ihn=dAe("tag:yaml.org,2002:map",{create:()=>({}),identify:pAe,represent:e=>{let t=new Map;for(let r of Object.keys(e))t.set(r,e[r]);return t},addPair:(e,t,r)=>{if(t!==null&&typeof t=="object")return"object-based map does not support complex keys";let n=String(t);return n==="__proto__"?Object.defineProperty(e,n,{value:r,enumerable:!0,configurable:!0,writable:!0}):e[n]=r,""},has:(e,t)=>t!==null&&typeof t=="object"?!1:Object.prototype.hasOwnProperty.call(e,String(t)),keys:e=>Object.keys(e),get:(e,t)=>e[String(t)]}),shn=dAe("tag:yaml.org,2002:set",{create:()=>new Set,identify:e=>e instanceof Set,represent:e=>{let t=new Map;for(let r of e)t.set(r,null);return t},addPair:(e,t,r)=>r!==null?"cannot resolve a set item":(e.add(t),""),has:(e,t)=>e.has(t),keys:e=>e.keys(),get:()=>null});mAe=class GJt{tags;implicitScalarTags;implicitScalarByFirstChar;implicitScalarAnyFirstChar;defaultScalarTag;defaultSequenceTag;defaultMappingTag;exact;prefix;constructor(t){let r=uhn(t),n=[],a=chn(),o=lhn();for(let u of r){if(u.nodeKind==="scalar"&&u.implicit){if(u.matchByTagPrefix)throw new Error("Implicit scalar tags cannot match by tag prefix");n.push(u)}switch(u.nodeKind){case"scalar":u.matchByTagPrefix?o.scalar.push(u):a.scalar[u.tagName]=u;break;case"sequence":u.matchByTagPrefix?o.sequence.push(u):a.sequence[u.tagName]=u;break;case"mapping":u.matchByTagPrefix?o.mapping.push(u):a.mapping[u.tagName]=u;break}}let i=n.filter(u=>u.implicitFirstChars===null),s=new Set;for(let u of n)if(u.implicitFirstChars!==null)for(let d of u.implicitFirstChars)s.add(d);let c=new Map;for(let u of s)c.set(u,n.filter(d=>d.implicitFirstChars===null||d.implicitFirstChars.indexOf(u)!==-1));let l=a.scalar["tag:yaml.org,2002:str"];if(!l)throw new Error("schema does not define the default scalar tag (tag:yaml.org,2002:str)");this.tags=r,this.implicitScalarTags=n,this.implicitScalarByFirstChar=c,this.implicitScalarAnyFirstChar=i,this.defaultScalarTag=l,this.defaultSequenceTag=a.sequence["tag:yaml.org,2002:seq"],this.defaultMappingTag=a.mapping["tag:yaml.org,2002:map"],this.exact=a,this.prefix=o}withTags(...t){let r=[];for(let n of t)r=r.concat(n);return new GJt([...this.tags,...r])}},jXe=new mAe([lfn,nhn,ihn]),Ono=new mAe([...jXe.tags,pfn,bfn,Ofn,Wfn]),BXe=new mAe([...jXe.tags,dfn,yfn,BJt,UJt]),dhn=new mAe([...jXe.tags,ffn,wfn,_Xe,PXe,rhn,FXe,Xfn,ahn,ohn,shn]),Dno=dAe("tag:yaml.org,2002:map",{create:()=>new Map,addPair:(e,t,r)=>(e.set(t,r),""),has:(e,t)=>e.has(t),keys:e=>e.keys(),get:(e,t)=>e.get(t),identify:e=>e instanceof Map||pAe(e),represent:e=>{if(e instanceof Map)return e;let t=new Map,r=e;for(let n of Object.keys(r))t.set(n,r[n]);return t}});Nno=dAe("tag:yaml.org,2002:map",{create:()=>({}),identify:pAe,represent:e=>{let t=new Map;for(let r of Object.keys(e))t.set(r,e[r]);return t},addPair:(e,t,r)=>{let n=_Jt(t);return n===null?"nested arrays are not supported inside keys":(n==="__proto__"?Object.defineProperty(e,n,{value:r,enumerable:!0,configurable:!0,writable:!0}):e[n]=r,"")},has:(e,t)=>{let r=_Jt(t);return r!==null&&Object.prototype.hasOwnProperty.call(e,r)},keys:e=>Object.keys(e),get:(e,t)=>e[String(t)]}),phn={maxLength:79,indent:1,linesBefore:3,linesAfter:2};sAe=class extends Error{reason;mark;constructor(e,t){super(),this.name="YAMLException",this.reason=e,this.mark=t,this.message=PJt(this,!1),Error.captureStackTrace&&Error.captureStackTrace(this,this.constructor)}toString(e){return`${this.name}: ${PJt(this,e)}`}};fhn=-1;VJt=new Array(256),WJt=new Array(256);for(let e=0;e<256;e++)VJt[e]=OJt(e)?1:0,WJt[e]=OJt(e);Ahn={"!":"!","!!":"tag:yaml.org,2002:"};P3=-1,GXe={filename:"",schema:BXe,json:!1,maxTotalMergeKeys:1e4,maxAliases:-1};Ra=-1,qJt=Object.prototype.hasOwnProperty,N3=1,OXe=2,YJt=3,lAe=4,Rhn=/[\x00-\x08\x0B\x0C\x0E-\x1F\x7F-\x84\x86-\x9F\uFFFE\uFFFF]|[\uD800-\uDBFF](?![\uDC00-\uDFFF])|(?:[^\uD800-\uDBFF]|^)[\uDC00-\uDFFF]/,_hn=/[,\[\]{}]/,JJt=/^(?:!|!!|![0-9A-Za-z-]+!)$/,DXe=String.raw`(?:%[0-9A-Fa-f]{2}|[0-9A-Za-z\-#;/?:@&=+$,_.!~*'()\[\]])`,ZJt=String.raw`(?:%[0-9A-Fa-f]{2}|[0-9A-Za-z\-#;/?:@&=+$.~*'()_])`,Phn=new RegExp(`^(?:${DXe})*$`),Ohn=new RegExp(`^(?:${ZJt})+$`),Dhn=new RegExp(`^(?:!(?:${DXe})*|${ZJt}(?:${DXe})*)$`),VXe={filename:"",maxDepth:100};Xhn={...VXe,...GXe};Bp={};Bp[0]="\\0";Bp[7]="\\a";Bp[8]="\\b";Bp[9]="\\t";Bp[10]="\\n";Bp[11]="\\v";Bp[12]="\\f";Bp[13]="\\r";Bp[27]="\\e";Bp[34]='\\"';Bp[92]="\\\\";Bp[133]="\\N";Bp[160]="\\_";Bp[8232]="\\L";Bp[8233]="\\P";egn={indent:2,seqNoIndent:!1,seqInlineFirst:!0,sortKeys:!1,lineWidth:80,flowBracketPadding:!1,flowSkipCommaSpace:!1,flowSkipColonSpace:!1,quoteFlowKeys:!1,quoteStyle:"single",forceQuotes:!1,tagBeforeAnchor:!1},tgn=dhn.withTags({..._Xe,resolve:(e,t,r)=>{let n=_Xe.resolve(e,t,r);return n===ba?BJt.resolve(e,t,r):n}},{...PXe,resolve:(e,t,r)=>{let n=PXe.resolve(e,t,r);return n===ba?UJt.resolve(e,t,r):n}}),$no={...egn,schema:tgn,skipInvalid:!1,noRefs:!1,flowLevel:-1,transform:()=>{}}});var rgn,ngn,agn,Kc,WXe=w(()=>{"use strict";Pr();rgn=Object.defineProperty,ngn=(e,t)=>rgn(e,"name",{value:t,configurable:!0}),agn={image:"DOCKER_IMAGE_NOT_FOUND",dockerfile:"DOCKER_DOCKERFILE_NOT_FOUND"},Kc=class extends Ke{static{ngn(this,"DockerError")}errorType;resource;constructor(t,r,n,a=!1,o){let i=r==="not_found"?o:void 0,s=r==="not_found"?void 0:o;super(i!==void 0?agn[i]:s??`DOCKER_${r.toUpperCase()}`,t,n,a),this.errorType=r,this.resource=i}}});var x0,rZt,nZt,bQ=w(()=>{"use strict";x0="linux/arm64",rZt="backend",nZt="docker-compose.yml"});import{readFile as aZt}from"fs/promises";import{join as ign,resolve as zXe,relative as oZt}from"path";import{spawnSync as sgn}from"child_process";function iZt(e){if(typeof e!="object"||e===null)return!1;let t=e;return!("services"in t&&typeof t.services!="object")}function sZt(e){if(typeof e!="object"||e===null)return!1;let t=e;return"build"in t||"image"in t||Object.keys(t).length===0}var ogn,HXe,hAe,FI,cZt=w(()=>{"use strict";tZt();ae();le();he();$();So();Le();WXe();bQ();ogn=Object.defineProperty,HXe=(e,t)=>ogn(e,"name",{value:t,configurable:!0});HXe(iZt,"isDockerComposeConfig");HXe(sZt,"isDockerComposeService");hAe=class{static{HXe(this,"DockerConfigService")}async validateDockerfilePath(t,r){let n=this.validateRequiredPath(t,"Dockerfile path");if(!n.success)return g(n.error);let a=this.validateRequiredPath(r,"Application path");if(!a.success)return g(a.error);try{let o=await this.getGitRepositoryRoot(r),i=zXe(r,t),s=zXe(i);return!(t.startsWith("/")||t.match(/^[A-Z]:\\/))&&!s.startsWith(o)?g(new Kc(`Security violation: Relative Dockerfile path '${b(t)}' escapes repository boundary`,"security_violation",{dockerfilePath:t,gitRoot:o,resolvedPath:s})):await br(s)?E({pathIsSecure:!0,normalisedPath:s,gitRoot:o,relativePath:oZt(o,s)}):g(new Kc(`Dockerfile not found at: ${oZt(o,s)}`,"not_found",{dockerfilePath:t,normalisedPath:s},!1,"dockerfile"))}catch(o){let i=k(o);return g(new Kc(`Failed to validate Dockerfile path: ${b(i)}`,"parse_error",{dockerfilePath:t,error:o}))}}async validateDockerfile(t,r){let n=this.validateRequiredPath(t,"Dockerfile path");if(!n.success)return g(n.error);let a=this.validateRequiredPath(r,"Base path");if(!a.success)return g(a.error);let o=zXe(r,t);if(!await br(o))return g(new Kc(`Dockerfile not found: ${t}`,"not_found",{dockerfilePath:t,fullPath:o,basePath:r},!1,"dockerfile"));try{let i=await aZt(o,"utf8");return i.trim()?i.split(`
 `).some(s=>{let c=s.trim();return!c||c.startsWith("#")?!1:c.toUpperCase().startsWith("FROM ")})?E({valid:!0,fullPath:o}):g(new Kc(`Invalid Dockerfile: ${t}
 Dockerfile must contain at least one FROM instruction.`,"parse_error",{dockerfilePath:t,fullPath:o},!1,"DOCKER_DOCKERFILE_NOT_FOUND")):g(new Kc(`Dockerfile is empty: ${t}`,"parse_error",{dockerfilePath:t,fullPath:o},!1,"DOCKER_DOCKERFILE_NOT_FOUND"))}catch(i){let s=k(i);return g(new Kc(`Failed to read Dockerfile: ${b(t)}
-${b(s)}`,"read_failed",{dockerfilePath:t,fullPath:o,error:i},!1,"DOCKER_DOCKERFILE_NOT_FOUND"))}}async parseComposeFile(t){try{if(!await br(t))return E({services:[]});let r=await aZt(t,"utf8");if(r.trim()==="")return g(new Kc("Invalid docker-compose.yml format","parse_error",{composePath:t}));let n=eZt(r,{schema:BXe.withTags(FXe)});if(!iZt(n))return g(new Kc("Invalid docker-compose.yml format","parse_error",{composePath:t}));let a=n;if(!a?.services)return E({version:a?.version,services:[]});let o=[];for(let[i,s]of Object.entries(a.services)){if(!sZt(s))continue;let c=s,l,u;c.build&&(typeof c.build=="string"?(l=c.build,u="Dockerfile"):(l=c.build.context||".",u=c.build.dockerfile||"Dockerfile"));let d;if(c.ports){let p=c.ports[0];if(typeof p=="string"&&p.length>0){let m=p.split(":"),f=m[m.length-1];if(f){let y=parseInt(f,10);Number.isNaN(y)||(d=y)}}else typeof p=="object"&&(d=p.target)}o.push({name:i,...l!==void 0&&{buildContext:l},...u!==void 0&&{dockerfile:u},...c.image!==void 0&&{image:c.image},...d!==void 0&&{containerPort:d}})}return E({version:a.version,services:o})}catch(r){let n=k(r);return g(new Kc(`Failed to parse docker-compose.yml: ${b(n)}`,"parse_error",{path:t,error:r}))}}async parseInfrastructureFile(t){let r=await Ph().getDockerConfigs(t);if(!r.success)return P.debug("DockerConfigService","Manifest not found, returning null Docker config",{appPath:t,error:r.error.message}),E(null);let n=r.data;if(n.length===0)return E(null);let a=n.map(o=>({name:o.name,...o.docker!==void 0&&{docker:o.docker},...o.containerPort!==void 0&&{containerPort:o.containerPort}}));return E({services:a})}async getDockerConfig(t){let r=await this.parseInfrastructureFile(t);if(!r.success){let o=Ph().getManifestPath(t);return g(new Kc(`Fjall manifest not found at expected location: ${b(o)}. Run 'cdk synth' to generate the manifest.`,"parse_error",{manifestPath:o}))}if(!r.data)return g(new Kc("No Docker services configured in the Fjall manifest. Add at least one service with a Dockerfile to your infrastructure.","parse_error",{appPath:t}));let n=ign(t,nZt),a=await this.parseComposeFile(n);if(a.success&&a.data.services.length>0){let o=a.data.services[0];return E({...r.data,containerPort:r.data.containerPort||o.containerPort})}return r}async getGitRepositoryRoot(t){try{let r=sgn("git",["rev-parse","--show-toplevel"],{cwd:t,encoding:"utf8",timeout:5e3,shell:!1,env:Ir(process.env)});return r.status===0&&r.stdout?r.stdout.trim():t}catch(r){return P.debug("DockerConfigService","Git command failed or timed out, using startPath as fallback",{startPath:t,error:k(r)}),t}}validateRequiredPath(t,r){return t?.trim()?E(void 0):g(new Kc(`${r} cannot be empty`,"parse_error",{[r.toLowerCase().replace(/ /g,"")]:t}))}},FI=Mr(()=>new hAe)});var EQ=w(()=>{"use strict";cZt();WXe();bQ()});function lZt(e){let t=e.profileData?.name??e.profile??"\0ambient",r=e.region??"\0default",n=e.appName??"\0none";return`${t}|${r}|${n}`}function qc(){return qXe??=new KXe,qXe}function lgn(){qXe=void 0}var cgn,gAe,KXe,qXe,EA=w(()=>{"use strict";gd();cgn=Object.defineProperty,gAe=(e,t)=>cgn(e,"name",{value:t,configurable:!0}),KXe=class{static{gAe(this,"AwsContextProvider")}flights=new Map;queue=Promise.resolve();async acquire(t={}){if(t.credentials!==void 0)return this.launch(void 0,t);let r=lZt(t);if(t.forceRefresh===!0)return this.launch(r,t);for(;;){let n=this.flights.get(r);if(n===void 0)return this.launch(r,t);let a=await n;if(a===ze.getCurrent()&&!a.isExpired())return a;if(this.flights.get(r)===n)return this.flights.delete(r),this.launch(r,t)}}launch(t,r){let n=this.queue.then(()=>ze.initialise(r));return this.queue=n.catch(()=>{}),t!==void 0&&(this.flights.set(t,n),n.catch(()=>{this.flights.get(t)===n&&this.flights.delete(t)})),n}};gAe(lZt,"deriveProviderKey");gAe(qc,"getAwsContextProvider");gAe(lgn,"_resetAwsContextProvider")});var ugn,dgn,pgn,Yt,k0=w(()=>{"use strict";Pr();ugn=Object.defineProperty,dgn=(e,t)=>ugn(e,"name",{value:t,configurable:!0}),pgn={repository:"ECR_REPOSITORY_NOT_FOUND",image:"ECR_IMAGE_NOT_FOUND"},Yt=class extends Ke{static{dgn(this,"EcrError")}errorType;repositoryName;resource;constructor(t,r,n,a,o=!1,i){let s=r==="not_found"?i:void 0,c=r==="not_found"?void 0:i;super(s!==void 0?pgn[s]:c??`ECR_${r.toUpperCase()}`,t,a,o),this.errorType=r,this.repositoryName=n,this.resource=s}}});function YXe(e){return e.replace(/^https?:\/\//,"")}var mgn,fgn,uZt=w(()=>{"use strict";mgn=Object.defineProperty,fgn=(e,t)=>mgn(e,"name",{value:t,configurable:!0});fgn(YXe,"removeProtocol")});var dZt,pZt=w(()=>{"use strict";dZt={CREATE_IN_PROGRESS:{safeToRedeploy:"No",description:"Stack is busy with creation"},CREATE_COMPLETE:{safeToRedeploy:"Yes",description:"Stack was successfully created"},CREATE_FAILED:{safeToRedeploy:"Maybe",description:"Stack creation failed - fix issues before redeploying"},DELETE_IN_PROGRESS:{safeToRedeploy:"No",description:"Stack is busy with deletion"},DELETE_COMPLETE:{safeToRedeploy:"Yes",description:"Stack was successfully deleted"},DELETE_FAILED:{safeToRedeploy:"Maybe",description:"Stack deletion failed - investigate before redeploying"},ROLLBACK_IN_PROGRESS:{safeToRedeploy:"No",description:"Stack is rolling back due to failure"},ROLLBACK_COMPLETE:{safeToRedeploy:"Yes",description:"Stack rolled back due to failure - fix issues before redeploying"},ROLLBACK_FAILED:{safeToRedeploy:"No",description:"Rollback failed - manual intervention needed"},UPDATE_IN_PROGRESS:{safeToRedeploy:"No",description:"Stack update is in progress"},UPDATE_COMPLETE:{safeToRedeploy:"Yes",description:"Stack update completed successfully"},UPDATE_COMPLETE_CLEANUP_IN_PROGRESS:{safeToRedeploy:"No",description:"Stack update cleanup in progress"},UPDATE_FAILED:{safeToRedeploy:"Maybe",description:"Stack update failed - fix issues before redeploying"},UPDATE_ROLLBACK_IN_PROGRESS:{safeToRedeploy:"No",description:"Stack is rolling back an update"},UPDATE_ROLLBACK_COMPLETE:{safeToRedeploy:"Yes",description:"Stack update rolled back successfully"},UPDATE_ROLLBACK_FAILED:{safeToRedeploy:"No",description:"Update rollback failed - manual fix needed"},IMPORT_IN_PROGRESS:{safeToRedeploy:"No",description:"Resource import in progress"},IMPORT_COMPLETE:{safeToRedeploy:"Yes",description:"Resource import completed successfully"},IMPORT_ROLLBACK_IN_PROGRESS:{safeToRedeploy:"No",description:"Import rollback in progress"},IMPORT_ROLLBACK_COMPLETE:{safeToRedeploy:"Yes",description:"Import rollback completed"},IMPORT_ROLLBACK_FAILED:{safeToRedeploy:"No",description:"Import rollback failed - manual fix needed"},REVIEW_IN_PROGRESS:{safeToRedeploy:"Yes",description:"Stack is in review mode"},UNKNOWN:{safeToRedeploy:"Maybe",description:"Unknown stack status"}}});import{CloudFormationClient as M3,DeleteStackCommand as ggn,DescribeStacksCommand as JXe}from"@aws-sdk/client-cloudformation";function ZXe(e,t,r){let n=Ol(e),a=b(k(e));return n==="CredentialsError"||n==="UnauthorizedException"||n==="AccessDeniedException"?new Ey(`AWS credentials error: ${a}`,"auth_error",t,void 0,e,!1):n==="ThrottlingException"||n==="Throttling"||n==="TooManyRequestsException"?new Ey(`AWS rate limit exceeded: ${a}`,"throttled",t,void 0,e,!0):n==="NetworkingError"||a.includes("ENOTFOUND")?new Ey(`Network error: ${a}`,"network_error",t,void 0,e,!0):new Ey(`${r}: ${a}`,"unknown",t,void 0,e)}var hgn,XXe,Ey,L3,yAe=w(()=>{"use strict";EA();pZt();$();ae();eQe();Pr();le();$();hd();hgn=Object.defineProperty,XXe=(e,t)=>hgn(e,"name",{value:t,configurable:!0}),Ey=class extends Ke{static{XXe(this,"CloudFormationError")}errorType;stackName;stackStatus;constructor(t,r,n,a,o,i=!1){super(`CFN_${r.toUpperCase()}`,t,o,i),this.errorType=r,this.stackName=n,this.stackStatus=a}};XXe(ZXe,"classifyAwsError");L3=class{static{XXe(this,"CloudFormationService")}async getAws(){return qc().acquire()}async getStackOutputs(t,r){r?.onStackCheck?.(t);let n=(await this.getAws()).getClient(M3),a=new JXe({StackName:t});try{let o=(await n.send(a)).Stacks?.[0];if(!o?.Outputs)return E([]);let i=o.Outputs.map(s=>({OutputKey:s.OutputKey,OutputValue:s.OutputValue,ExportName:s.ExportName}));return r?.onOutputsRetrieved?.(t,i.length),E(i)}catch(o){if(nf(o))return r?.onStackNotFound?.(t),E([]);let i=b(k(o));return g(new Ey(`Failed to get outputs for stack ${t}: ${i}`,"unknown",t,void 0,o))}}async getStackStatus(t,r){r?.onStackCheck?.(t);let n=(await this.getAws()).getClient(M3),a=new JXe({StackName:t});try{let o=(await n.send(a)).Stacks?.[0];if(!o)return E({status:"DOES_NOT_EXIST",safeToRedeploy:"Yes",description:"Stack does not exist yet"});let i=o.StackStatus??"UNKNOWN",s=dZt[i]??{safeToRedeploy:"Maybe",description:"Unknown stack status"};return r?.onStackFound?.(t,i),E({status:i,safeToRedeploy:s.safeToRedeploy,description:s.description,statusReason:o.StackStatusReason})}catch(o){return nf(o)?E({status:"DOES_NOT_EXIST",safeToRedeploy:"Yes",description:"Stack does not exist yet"}):g(ZXe(o,t,`Failed to get stack status for ${t}`))}}async getExportsByNames(t){let r=(await this.getAws()).getClient(M3);return AQ(r,t)}async listExports(t){let r=(await this.getAws()).getClient(M3),n=await QXe(r);return n.success&&t?.onExportsRetrieved?.(n.data.length),n}async deleteStack(t){let r=(await this.getAws()).getClient(M3);try{return await r.send(new ggn({StackName:t})),E(void 0)}catch(n){return g(ZXe(n,t,`Failed to delete stack ${t}`))}}async stackExists(t,r){let n=r??(await this.getAws()).getClient(M3);try{let a=(await n.send(new JXe({StackName:t}))).Stacks?.[0]?.StackStatus;return!!a&&a!=="REVIEW_IN_PROGRESS"}catch(a){return!nf(a)}}async waitForDeleteComplete(t,r){let n=r?.timeoutMs??6e5,a=r?.pollIntervalMs??5e3,o=Date.now();for(;Date.now()-o<n;){let i=await this.getStackStatus(t);if(!i.success){if(i.error.recoverable){r?.onProgress?.(`Transient error polling stack ${t}, retrying: ${b(i.error.message)}`),await Wt(a);continue}return g(i.error)}let s=i.data.status;if(s==="DELETE_COMPLETE"||s==="DOES_NOT_EXIST")return E(void 0);if(s==="DELETE_FAILED")return g(new Ey(`Stack ${t} deletion failed: ${i.data?.statusReason||"unknown reason"}`,"stack_failed",t,s,void 0,!1));r?.onProgress?.(`Stack ${t} status: ${s??"unknown"}`),await Wt(a)}return g(new Ey(`Timed out waiting for stack ${t} deletion after ${Math.round(n/1e3)}s`,"timeout",t,void 0,void 0,!0))}}});import{ListExportsCommand as vgn}from"@aws-sdk/client-cloudformation";async function rQe(e,t){let r=[];try{let n;do{let a=new vgn({NextToken:n}),o=await e.send(a),i=o.Exports||[];for(let s of i)s.Name&&s.Value&&r.push({Name:s.Name,Value:s.Value});if(t?.(i))break;n=o.NextToken}while(n);return E(r)}catch(n){return g(new Ey(`Failed to list exports: ${b(k(n))}`,"unknown",void 0,void 0,n,!1))}}async function AQ(e,t){if(t.length===0)return E(new Map);let r=new Set(t),n=new Map,a=await rQe(e,o=>{for(let i of o)i.Name&&r.has(i.Name)&&i.Value&&n.set(i.Name,i.Value);return n.size>=r.size});return a.success?E(n):g(a.error)}async function QXe(e){return rQe(e)}var ygn,tQe,eQe=w(()=>{"use strict";ae();yAe();le();$();ygn=Object.defineProperty,tQe=(e,t)=>ygn(e,"name",{value:t,configurable:!0});tQe(rQe,"listAllExports");tQe(AQ,"getExportsByNames");tQe(QXe,"listExports")});import{ECRClient as bgn,CreateRepositoryCommand as Egn,DescribeRepositoriesCommand as Agn,PutLifecyclePolicyCommand as wgn,GetAuthorizationTokenCommand as Cgn}from"@aws-sdk/client-ecr";import{CloudFormationClient as Tgn}from"@aws-sdk/client-cloudformation";function fZt(e){return typeof e.repositoryName=="string"&&typeof e.repositoryArn=="string"&&typeof e.registryId=="string"&&typeof e.repositoryUri=="string"}var Sgn,mZt,xgn,wQ,hZt=w(()=>{"use strict";EA();ae();he();$();Ai();Ah();le();uZt();k0();hd();at();eQe();Sgn=Object.defineProperty,mZt=(e,t)=>Sgn(e,"name",{value:t,configurable:!0});mZt(fZt,"hasRequiredRepositoryFields");xgn=10,wQ=class{static{mZt(this,"EcrRepositoryService")}aws;constructor(t){this.aws=t??null}async getAwsContext(){return this.aws??qc().acquire()}async getClient(){return(await this.getAwsContext()).getClient(bgn)}async getCfnClient(){return(await this.getAwsContext()).getClient(Tgn)}async getRepositoryNameFromStackByExportName(t){let r=await this.getCfnClient(),n=await AQ(r,[t]);if(!n.success){let a=b(n.error.message);return P.debug("EcrService","Error describing stacks",{exportName:t,error:a}),g(new Yt(`Failed to query CloudFormation stacks: ${a}`,"unknown","",n.error))}return E(n.data.get(t))}async getAuthConfig(t,r){try{let n=await(await this.getClient()).send(new Cgn({registryIds:[t]}),{abortSignal:X(r)});if(!n.authorizationData?.[0])return g(new Yt("Failed to get ECR authorization token","auth_failed",void 0,"Check AWS credentials and permissions"));let a=n.authorizationData[0];if(!a.authorizationToken||!a.proxyEndpoint)return g(new Yt("ECR authorization response missing required fields","auth_failed",void 0,{hasToken:!!a.authorizationToken,hasEndpoint:!!a.proxyEndpoint}));let o=Buffer.from(a.authorizationToken,"base64").toString("utf-8"),i=o.indexOf(":");if(i<1)return g(new Yt("Invalid ECR authorization token format","auth_failed",void 0,{tokenFormat:"expected username:password"}));let s=o.slice(0,i),c=o.slice(i+1);return!s||!c?g(new Yt("Invalid ECR authorization token format","auth_failed",void 0,{tokenFormat:"expected username:password"})):E({username:s,password:c,serveraddress:a.proxyEndpoint,registryUrl:YXe(a.proxyEndpoint)})}catch(n){return g(new Yt(`Failed to get ECR authorization: ${b(k(n))}`,"auth_failed",void 0,n,!1))}}async fetchRepositories(t){try{let r=await this.getClient(),n=[],a;do{let s=await r.send(new Agn({...t?{repositoryNames:t}:{},...a!==void 0&&{nextToken:a}}));n.push(...s.repositories??[]),a=s.nextToken}while(a);let o=[],i=[];for(let s of n)fZt(s)?o.push({repositoryName:s.repositoryName,repositoryArn:s.repositoryArn,registryId:s.registryId,repositoryUri:s.repositoryUri,createdAt:s.createdAt,imageTagMutability:s.imageTagMutability,imageScanningConfiguration:s.imageScanningConfiguration}):i.push(s.repositoryName??s.repositoryArn??"(unidentifiable repository)");return E({repositories:o,dropped:i})}catch(r){return HG(r)?E({repositories:[],dropped:[]}):g(new Yt(`Failed to describe repositories: ${b(k(r))}`,"unknown",t?.join(", "),r))}}unreadableDescriptionError(t){return new Yt(`Repository ${t} exists but its description is missing required fields (repositoryName, repositoryArn, registryId, repositoryUri); check IAM response filtering before retrying`,"unknown",t)}async describeRepositories(t){let r=await this.fetchRepositories(t);if(!r.success)return g(r.error);let{repositories:n,dropped:a}=r.data,o=[];if(a.length>0){let i=a.slice(0,xgn),s=a.length-i.length;o.push(b(`Skipped ${a.length} ECR repository description(s) missing required fields: ${i.join(", ")}${s>0?` and ${s} more`:""}`))}return E({repositories:n,warnings:o})}async listRepositories(){return this.describeRepositories()}async getRepository(t){let r=await this.fetchRepositories([t]);if(!r.success)return g(r.error);let n=r.data.repositories[0];return n?E(n):r.data.dropped.length>0?g(this.unreadableDescriptionError(t)):E(null)}async createRepositoryIfNotExists(t,r){try{return await(await this.getClient()).send(new Egn({repositoryName:t,imageScanningConfiguration:{scanOnPush:!0},imageTagMutability:r?.imageTagMutability??"IMMUTABLE",tags:ik(t)})),E({created:!0})}catch(n){if(YYe(n))return E({created:!1});let a=b(k(n));return g(new Yt(`Failed to create ECR repository: ${a}`,"unknown",t,n))}}async setUntaggedLifecyclePolicy(t,r){return this.applyLifecyclePolicy(t,q4(r))}async applyLifecyclePolicy(t,r){try{return await(await this.getClient()).send(new wgn({repositoryName:t,lifecyclePolicyText:r})),E(void 0)}catch(n){let a=b(k(n));return g(new Yt(`Failed to set lifecycle policy: ${a}`,"lifecycle_policy_failed",t,n))}}async repositoryExists(t){let r=await this.fetchRepositories([t]);return r.success?r.data.repositories.length>0?E(!0):r.data.dropped.length>0?g(this.unreadableDescriptionError(t)):E(!1):g(r.error)}}});import{ECRClient as Rgn,ListImagesCommand as _gn,BatchDeleteImageCommand as Pgn,BatchGetImageCommand as Ogn,PutImageCommand as Dgn}from"@aws-sdk/client-ecr";var kgn,Ign,CQ,gZt=w(()=>{"use strict";EA();ae();le();k0();$();hd();kgn=Object.defineProperty,Ign=(e,t)=>kgn(e,"name",{value:t,configurable:!0}),CQ=class{static{Ign(this,"EcrImageService")}aws;constructor(t){this.aws=t??null}async getClient(){return(this.aws??await qc().acquire()).getClient(Rgn)}async listImages(t){try{let r=await this.getClient(),n=[],a;do{let i=await r.send(new _gn({repositoryName:t,maxResults:1e3,...a!==void 0&&{nextToken:a}}));n.push(...i.imageIds??[]),a=i.nextToken}while(a);let o=n.map(i=>({imageDigest:i.imageDigest,imageTags:i.imageTag?[i.imageTag]:void 0}));return E(o)}catch(r){return HG(r)?g(new Yt(`Repository '${t}' not found`,"not_found",t,r,!1,"repository")):g(new Yt(`Failed to list images: ${b(k(r))}`,"unknown",t,r))}}async countImages(t){let r=await this.listImages(t);return r.success?E(r.data.length):g(r.error)}async hasTag(t,r){let n=await this.listImages(t);return n.success?E(n.data.some(a=>a.imageTags?.includes(r))):g(n.error)}async copyImageTag(t,r,n){try{let a=await this.getClient(),o=await a.send(new Ogn({repositoryName:t,imageIds:[{imageTag:r}]}));if(!o.images||o.images.length===0||!o.images[0].imageManifest)return g(new Yt(`Source image tag '${r}' not found in repository '${t}'`,"not_found",t,{sourceTag:r,targetTag:n},!1,"image"));let i=o.images[0].imageManifest,s=o.images[0].imageManifestMediaType;return await a.send(new Dgn({repositoryName:t,imageManifest:i,imageManifestMediaType:s,imageTag:n})),E({tag:n,copied:!0})}catch(a){return KYe(a)||qYe(a)?E({tag:n,copied:!1}):HG(a)?g(new Yt(`Repository '${t}' not found`,"not_found",t,{sourceTag:r,targetTag:n,error:a},!1,"repository")):oA(a)?g(new Yt(`Permission denied when copying image tag from '${r}' to '${n}'`,"permission_denied",t,{sourceTag:r,targetTag:n,error:a})):g(new Yt(`Failed to copy image tag: ${b(k(a))}`,"unknown",t,{sourceTag:r,targetTag:n,error:a}))}}async getLatestTag(t){let r=await this.listImages(t);if(!r.success)return g(r.error);let n=r.data.filter(a=>a.imageTags?.length);return n.length===0?E(void 0):n.find(a=>a.imageTags?.includes("latest"))?E("latest"):E(n[0].imageTags?.[0])}async deleteImages(t,r){if(r.length===0)return E(void 0);try{return await(await this.getClient()).send(new Pgn({repositoryName:t,imageIds:r.map(n=>({imageTag:n}))})),E(void 0)}catch(n){return g(new Yt(`Failed to delete images: ${b(k(n))}`,"unknown",t,n))}}}});function Ay(e){if(typeof e!="object"||e===null)return!1;let t=e;return t.errorType===Mgn||t.statusCode===404}var Ngn,$gn,Mgn,F3=w(()=>{"use strict";Ngn=Object.defineProperty,$gn=(e,t)=>Ngn(e,"name",{value:t,configurable:!0}),Mgn="not_found";$gn(Ay,"isAbsence")});var Lgn,Fgn,yZt,TQ,vZt=w(()=>{"use strict";F3();ae();he();le();$();Ah();bQ();k0();Lgn=Object.defineProperty,Fgn=(e,t)=>Lgn(e,"name",{value:t,configurable:!0}),yZt="public.ecr.aws/fjall/welcome",TQ=class{static{Fgn(this,"EcrRepositoryInitialiser")}repositoryService;imageService;cli;buildxAsserted=!1;constructor(t,r,n){this.repositoryService=t,this.imageService=r,this.cli=n}async ensureBuildxAvailable(){if(this.buildxAsserted)return E(void 0);let t=await this.cli.assertBuildxAvailable();if(!t.success){let r=qi(t.error);return g(new Yt(`Buildx unavailable: ${r}`,"docker_not_running",void 0,t.error))}return this.buildxAsserted=!0,E(void 0)}async initialiseRepository(t,r,n,a){if(n?.isManagedAccount)return n?.onDockerProgress?.("Managed account detected - skipping ECR repository initialisation",100),E({message:"Managed account - ECR repository initialisation skipped",skipped:!0});n?.onDockerProgress?.("Checking if ECR repository has images...",10),a?.onImageCheck?.(t);let o=await this.imageService.listImages(t);if(!o.success){let c=o.error;if(!Ay(c)||c.resource!=="repository")return g(c)}let i=o.success?o.data:[];if(i.length>0)return n?.onDockerProgress?.(`Repository ${t} already has ${i.length} image(s)`,100),a?.onImageFound?.(t,i.length),E({message:"Repository already has images",skipped:!0});n?.onDockerProgress?.("Initialising ECR repository with default image...",15),a?.onInitStart?.(t);let s=await this.ensureBuildxAvailable();if(!s.success)return g(s.error);try{let c=await this.repositoryService.getAuthConfig(r);if(!c.success)return g(c.error);let l=c.data,u=`${yZt}:latest`,d=`${l.registryUrl}/${t}:latest`,p=x0;n?.onDockerProgress?.(`Pulling default image: ${u} for ${p}`,20);let m=await this.cli.pull(u,p,S=>{let A=b(S.status);n?.onDockerProgress?.(`Pulling ${S.id}: ${A}`,40,S.id,S.status)});if(!m.success){let S=qi(m.error);return g(new Yt(`Failed to pull default image: ${S}`,"pull_failed",t,m.error))}n?.onDockerProgress?.("Pull complete",50),n?.onDockerProgress?.("Tagging image for ECR...",55);let f=await this.cli.tag(u,d);if(!f.success){let S=qi(f.error);return g(new Yt(`Failed to tag image: ${S}`,"unknown",t,f.error))}n?.onDockerProgress?.("Authenticating to ECR...",58);let y=await this.cli.loginEcr({registry:l.serveraddress,username:l.username,password:l.password});if(!y.success){let S=qi(y.error);return g(new Yt(`Failed to authenticate to ECR: ${S}`,"auth_failed",t,y.error))}n?.onDockerProgress?.("Pushing image to ECR...",60);let v=await this.cli.push(d,S=>{let A=b(S.status);n?.onDockerProgress?.(`Pushing ${S.id}: ${A}`,85,S.id,S.status)});if(!v.success){let S=qi(v.error);return g(new Yt(`Failed to push image: ${S}`,"push_failed",t,v.error))}return n?.onDockerProgress?.("Push complete",95),await this.pushBackendImage(t,l.registryUrl,p,n?.onDockerProgress),n?.onDockerProgress?.("Default images pushed successfully to ECR",100),a?.onInitComplete?.(t),E({message:"ECR repository initialised with default image"})}catch(c){let l=b(k(c));return l.includes("Cannot connect to the Docker daemon")?g(new Yt("Docker is not running. Please start Docker Desktop and try again.","docker_not_running",t)):l.includes("pull access denied")?g(new Yt("Failed to pull default image. This might be a network issue or Docker Hub rate limiting.","pull_failed",t)):g(new Yt(`ECR initialisation failed: ${l}`,"unknown",t,c))}finally{await this.cli.logoutEcr().catch(()=>{})}}async pushBackendImage(t,r,n,a){let o=`${yZt}:backend`,i=`${r}/${t}:backend`;a?.(`Pulling backend image: ${o}`,70);let s=await this.cli.pull(o,n,u=>{a?.(b(u.status),75)});if(!s.success){let u=qi(s.error);P.warn("EcrService","Failed to pull backend image (non-critical)",{error:u}),a?.(`Warning: backend image pull failed (non-critical): ${u}`,80);return}let c=await this.cli.tag(o,i);if(!c.success){let u=qi(c.error);P.warn("EcrService","Failed to tag backend image (non-critical)",{error:u}),a?.(`Warning: backend image tag failed (non-critical): ${u}`,80);return}a?.("Pushing backend image to ECR...",80);let l=await this.cli.push(i,u=>{a?.(b(u.status),90)});if(!l.success){let u=qi(l.error);P.warn("EcrService","Failed to push backend image (non-critical)",{error:u}),a?.(`Warning: backend image push failed (non-critical): ${u}`,95)}}}});function nQe(e,t,r){return{logicalId:e,resourceType:t.type,status:bZt(t),timestamp:r(),...t.message!==""?{statusReason:t.message}:{}}}function bZt(e){switch(e.type){case"vertex":case"log":case"status":case"warning":return"running";default:return e.type}}var jgn,SZt,EZt=w(()=>{"use strict";jgn=Object.defineProperty,SZt=(e,t)=>jgn(e,"name",{value:t,configurable:!0});SZt(nQe,"mapBuildxEventToResourceEvent");SZt(bZt,"mapEventTypeToStatus")});import{isAbsolute as aQe,join as AZt,dirname as Ugn,resolve as xQ}from"path";import{existsSync as wZt}from"fs";function CZt(e,t){if(t===void 0||t==="")return E(e);let r=t.toLowerCase(),n=e.map(o=>o.name),a=e.filter(o=>{let i=o.name.toLowerCase();return i===r||i.endsWith(r)});return a.length===0?g(new Error(`Service '${t}' not found. Available services: ${n.join(", ")||"none"}`)):E(a)}function oQe(e,t,r){let n=AZt(t,e);if(wZt(n))return{path:n,base:t};if(r!==""&&r!==t){let a=AZt(r,e);if(wZt(a))return{path:a,base:r}}return{path:n,base:t}}function TZt(e,t){return`Dockerfile not found for service '${e}' at ${t}. Checked the synth directory and the working directory. If your Dockerfile lives at the project root with the CDK app in a subdirectory, set an absolute docker.context (the build context must share the Dockerfile's directory).`}async function xZt(e,t,r){for(let n of e){let a=n.docker?.path;if(!a)continue;let o=aQe(a)?a:oQe(a,t,r).path;if(!await br(o))return g(new Error(TZt(n.name,o)))}return E(void 0)}function vAe(e,t,r,n){let a=e.docker?.path,o=e.docker?.context,i,s;if(a!==void 0&&aQe(a))i=a,s=t;else{let d=oQe(a??"Dockerfile",t,r);i=d.path,s=d.base}let c=o?aQe(o)?xQ(o):xQ(s,o):xQ(Ugn(i)),l=n??e.docker?.target,u=s!==t;return l!==void 0?{buildContext:c,dockerfilePath:i,target:l,resolvedViaFallback:u}:{buildContext:c,dockerfilePath:i,resolvedViaFallback:u}}function iQe(e){return`${e.buildContext}|${e.dockerfilePath}|${e.target??""}`}function kZt(e,t,r){let n;try{n=HU(kv(e))}catch(o){return g(new Error(k(o)))}let a=new Map;for(let o of n){let i=vAe({name:o.name,docker:o.docker},e,t,r),s=iQe(i),c=a.get(s)??new Set;o.architecture!==void 0&&c.add(o.architecture),a.set(s,c)}return E(a)}async function IZt(e){let{leader:t,groupMembers:r,cwd:n,workingDirectory:a,context:o,cliDockerProvider:i,ecrAccountId:s,ecrRegion:c,cacheRepoUri:l,onParallelEvent:u,onParallelStatus:d,clock:p,awsProvider:m,abortSignal:f,flagBuildArgs:y,flagBuildSecrets:v,shouldEmitBakeWarning:S,targetsLambda:A,platform:C=x0}=e,T=t.name,{ecrBaseUri:x,dockerConfig:R,repositoryName:I,targetOverride:D}=o,O=vAe(t,n,a,D),N=O.target,M=r.map(se=>se.name);for(let se of M)d?.(se,"running");let L=Oh(se=>{let _e=b(se);for(let Ee of M)d?.(Ee,"failed",_e);return g(new Yt(_e,"unknown",I))},"failGroup"),F=t.docker?.buildArgs??R?.buildArgs,G=[...t.docker?.buildSecrets??[],...v??[]],V=IN({serviceName:T,dockerfilePath:O.dockerfilePath,buildContext:O.buildContext,...N!==void 0&&{target:N},...F!==void 0&&{buildArgs:F},...G.length>0&&{buildSecrets:G},members:r.map(se=>{let _e=se.docker?.buildArgs??R?.buildArgs;return{serviceName:se.name,..._e!==void 0&&{buildArgs:_e},...se.docker?.buildSecrets!==void 0&&{buildSecrets:se.docker.buildSecrets}}})});if(!V.success)return L(V.error.message);let W=V4(F,Wr(I));for(let se of W.warnings){let _e=b(se.message);S(_e)&&d?.(T,"running",_e)}if(W.findings.length>0)return L(W.findings.map(se=>se.message).join(" "));let U=G,J=CN(F);if(U.length>0&&m===void 0)return L(`Build secrets are declared for ${T} but no AWS context is available to resolve them.`);let te=m;if(m!==void 0){let se=await iI(m,[...U,...J],{appName:I,region:c,accountId:s,partition:a0(c)});if(!se.success)return L(se.error.message);te=se.data}let Y=await kN({...F!==void 0&&{manifestBuildArgs:F},serviceDir:O.buildContext,stage:Ggn,shellEnv:process.env,...y!==void 0&&{flagBuildArgs:y},...te!==void 0&&{resolveSourcedValue:Oh((se,_e)=>xN(te,{id:se,..._e},f),"resolveSourcedValue")}});if(!Y.success)return L(Y.error.message);let ne=Y.data.buildArgs;for(let se of Y.data.inferredDotenvKeys){let _e=b(`buildArg "${se}" was auto-declared from a .env file and will be baked into the image \u2014 ${rI}.`);S(_e)&&d?.(T,"running",_e)}let re=z4(ne,Wr(I),W4(F));if(re.length>0)return L(re.map(se=>se.message).join(" "));let ee,de;if(U.length>0&&te!==void 0){let se=await TN(te,U,f);if(!se.success)return L(`Failed to resolve build secrets for ${T}: ${se.error.message}`);ee=se.data.cleanup,de=se.data.resolved}try{let se=await i.buildAndPush({appName:I,appPath:O.buildContext,region:c,accountId:s,platform:C,pushByDigest:!0,targetsLambda:A,buildContext:O.buildContext,dockerfilePath:O.dockerfilePath,...N!==void 0&&{target:N},...l!==void 0&&{cacheRepoUri:l,serviceName:T},buildArgs:ne,...de!==void 0&&{buildSecrets:de},...f!==void 0&&{abortSignal:f}},void 0,_e=>{for(let Ee of M){let Ue=nQe(Ee,_e,p);u?.(Ee,Ue)}});return await RZt(se,{leaderName:T,repositoryName:I,ecrBaseUri:x,groupMembers:r,buildTarget:N,cliDockerProvider:i,onParallelStatus:d})}finally{ee!==void 0&&await ee().catch(se=>{P.warn("EcrBuildOrchestrator","Build-secret cleanup failed",{error:b(k(se))})})}}async function RZt(e,t){let{leaderName:r,repositoryName:n,ecrBaseUri:a,groupMembers:o,buildTarget:i,cliDockerProvider:s,onParallelStatus:c}=t;if(!e.success){let f=b(k(e.error));for(let y of o)c?.(y.name,"failed",f);return g(new Yt(`Docker build failed for ${r}: ${f}`,"push_failed",n,e.error))}let l=e.data.imageDigest,u=[],d=[];for(let f of o){let y=AP(l,f.name,i);if(!y.success){let v=b(y.error.message);for(let S of o)c?.(S.name,"failed",v);return g(new Yt(`Content-hash tag derivation failed for ${f.name}: ${v}`,"unknown",n,y.error))}u.push(y.data),d.push(`${a}:${y.data}`)}let p=await s.tagByDigest({sourceImage:a,digest:l,tags:d});if(!p.success){let f=b(k(p.error));for(let y of o)c?.(y.name,"failed",f);return g(new Yt(`Content-hash tag push failed for ${r}: ${f}`,"push_failed",n,p.error))}let m=[];return o.forEach((f,y)=>{c?.(f.name,"complete"),m.push({serviceName:f.name,pushedUrls:[d[y]],tagsPushed:1,contentHashTag:u[y],imageDigest:l})}),E(m)}function _Zt(e){let t=e.match(/^(\d+)\.dkr\.ecr\.([^.]+)\.(amazonaws\.com(?:\.cn)?)$/);return t===null?null:{accountId:t[1],region:t[2],dnsSuffix:t[3]}}async function sQe(e){let{repositoryName:t,dockerConfig:r,authConfig:n,appPath:a,workingDirectory:o,progressCallback:i,onDockerProgress:s,serviceFilter:c,targetOverride:l,platform:u,repositoryService:d,cliDockerProvider:p,onParallelEvent:m,onParallelStatus:f,clock:y,awsProvider:v,flagBuildArgs:S,flagBuildSecrets:A}=e,C=r?.services||[];if(C.length===0)return E({message:"No services configured - skipping Docker deployment"});let T=CZt(C,c);if(!T.success)return g(new Yt(b(T.error.message),"unknown",t));let x=T.data,R=xQ(a),I=o!==void 0&&o!==""?xQ(o):"",D=await xZt(x,R,I);if(!D.success)return g(new Yt(b(D.error.message),"unknown",t));let O=kZt(R,I,l);if(!O.success)return g(new Yt(b(O.error.message),"unknown",t));let N=O.data,M=await p.preflight?.();if(M!==void 0&&!M.success)return g(new Yt(b(M.error.message),"unknown",t));if(d!==void 0){let L=ty(t),F=await d.createRepositoryIfNotExists(L,{imageTagMutability:"MUTABLE"});if(!F.success)return g(F.error);let G=await d.setUntaggedLifecyclePolicy(L,fJ);if(!G.success)return g(G.error)}i?.(b(`Building ${x.length} service image(s)...`)),s?.("Starting Docker builds...",0);try{let L={ecrBaseUri:`${n.registryUrl}/${t}`,authConfig:n,dockerConfig:r,repositoryName:t,targetOverride:l,progressCallback:i,onDockerProgress:s},F=new Map;x.forEach(Ue=>{let Ot=vAe(Ue,R,I,l),Ie=iQe(Ot),Pe=F.get(Ie);Pe===void 0?(Ot.resolvedViaFallback&&i?.(b(`Building service '${Ue.name}' from ${Ot.dockerfilePath} (resolved at the project root).`)),F.set(Ie,{leader:Ue,members:[Ue]})):Pe.members.push(Ue)});let G=Array.from(F.entries());for(let[Ue,Ot]of G){let Ie=N.get(Ue);if(Ie===void 0)continue;if(Ie.size>1)return g(new Yt(`Build group for '${Ot.leader.name}' contains Lambda members targeting different architectures (${Array.from(Ie).join(", ")}) \u2014 members sharing one Dockerfile/context/target build as a single image and must agree on \`architecture\`. Give the differing Lambda a distinct docker.path/context/target, or align their \`architecture\` props.`,"unknown",t));let[Pe]=Ie;if(Pe!==void 0&&Pe!==t0)return g(new Yt(`Build group for '${Ot.leader.name}' declares Lambda architecture '${Pe}' but also contains ECS service members \u2014 fjall ECS tasks always run on '${t0}', so an image shared between ECS and Lambda must build for '${t0}'. Give the Lambda a distinct docker.path/context/target, or align its \`architecture\` prop.`,"unknown",t))}let V=gJ(G.length),W=new AbortController,U=_Zt(n.registryUrl);if(U===null)return g(new Yt(`Unable to parse ECR registry URL: ${n.registryUrl}`,"unknown",t));let J=d!==void 0?`${U.accountId}.dkr.ecr.${U.region}.${U.dnsSuffix}/${ty(t)}`:void 0,te=y??(()=>new Date),Y=G4(),ne,re=G.map(([Ue,Ot])=>async()=>{if(W.signal.aborted)return g(new Yt(`Build for ${Ot.leader.name} aborted by sibling failure`,"unknown",t));let Ie=await IZt({leader:Ot.leader,groupMembers:Ot.members,cwd:R,workingDirectory:I,context:L,cliDockerProvider:p,ecrAccountId:U.accountId,ecrRegion:U.region,cacheRepoUri:J,onParallelEvent:m,onParallelStatus:f,clock:te,platform:u??x0,targetsLambda:N.has(Ue),...v!==void 0&&{awsProvider:v},...S!==void 0&&{flagBuildArgs:S},...A!==void 0&&{flagBuildSecrets:A},abortSignal:W.signal,shouldEmitBakeWarning:Y});return Ie.success||(ne===void 0&&(ne=Ie.error),W.abort()),Ie}),ee=!1;if(p.beginEcrSession!==void 0){let Ue=await p.beginEcrSession({accountId:U.accountId,region:U.region});if(!Ue.success)return g(new Yt(b(Ue.error.message),"unknown",t));ee=!0}let de=await(async()=>{try{return await hJ(re,V,{abortOnFirstFailure:!0,abortSignal:W.signal})}finally{ee&&p.endEcrSession!==void 0&&await p.endEcrSession().catch(()=>{})}})(),se=0,_e=[],Ee=[];for(let Ue of de){if(Ue===void 0)continue;if(!Ue.success){let Ie=ne??Ue.error,Pe=b(k(Ie));return g(new Yt(Pe,"unknown",t,Ie))}let Ot=Ue.data;if(!Ot.success)return g(ne??Ot.error);for(let Ie of Ot.data)se+=Ie.tagsPushed,_e.push(...Ie.pushedUrls),Ee.push({serviceName:Ie.serviceName,imageTag:Ie.contentHashTag,imageDigest:Ie.imageDigest,imageUri:`${L.ecrBaseUri}:${Ie.contentHashTag}`})}return se===0?g(new Yt("Failed to push any tags to ECR","push_failed",t)):(i?.(b("All service images deployed to ECR")),s?.("Docker deployment complete",100),E({message:`Successfully pushed ${se} tag(s) for ${x.length} service(s) to ECR`,pushedImageUrls:_e,artefacts:Ee}))}catch(L){let F=b(k(L));return i?.(`Docker deployment failed: ${F}`),g(new Yt(F,"unknown",t,L))}}var Bgn,Oh,Ggn,PZt=w(()=>{"use strict";ae();$();Ah();So();le();he();EQ();k0();XKe();EZt();at();$();gp();Cr();Bgn=Object.defineProperty,Oh=(e,t)=>Bgn(e,"name",{value:t,configurable:!0}),Ggn="production";Oh(CZt,"filterServices");Oh(oQe,"resolveAgainstBases");Oh(TZt,"dockerfileNotFoundMessage");Oh(xZt,"validateDockerfiles");Oh(vAe,"resolveBuildIdentity");Oh(iQe,"buildIdentityKey");Oh(kZt,"resolveLambdaBuildIdentities");Oh(IZt,"buildGroupViaBuildx");Oh(RZt,"finaliseBuildGroup");Oh(_Zt,"parseEcrRegistry");Oh(sQe,"orchestrateDockerDeploy")});function bAe(e,t){return t&&e.containerPort!==void 0&&e.containerPort!==3e3?rZt:"latest"}async function OZt(e){let{service:t,isMultiService:r,ecrRepositoryName:n,appName:a,serviceBaseProgress:o,progressPerService:i,imageService:s,emit:c}=e,l=t.name,u=`${l.toLowerCase()}-latest`,d=bAe(t,r);c(`Tagging image for service: ${l} (${d} \u2192 ${u})`,o);let p=await s.hasTag(n,u);if(p.success&&p.data)return c(`Image tag ${u} already exists, skipping`,o+i*.9),E({tagged:!0});let m;for(let f=1;f<=zI;f++){let y=await s.copyImageTag(n,d,u);if(y.success){let S=y.data.copied?`Successfully tagged ${u} from ${d}`:`Tag ${u} already exists (idempotent)`;return c(S,o+i*.9),E({tagged:!0})}if(Ay(y.error)&&y.error.resource==="repository")return g(y.error);let v=b(y.error.message);if((v.includes("not found")||v.includes("does not exist"))&&f<zI){let S=o+f/zI*i*.8;c(`Waiting for image :${d} to be available (attempt ${f}/${zI})...`,S),await Wt(cQe);continue}m=v;break}return g(new Yt(`Failed to tag image for service ${l}: ${m??"Unknown error"}`,"unknown",a))}async function lQe(e,t,r,n){try{let a=SAe((p,m)=>{n?.onProgress?.(b(p),m)},"emit");a("Checking ECR repository...",5);let o=await e.resolveEcrRepositoryName(t,"tagEcrImages");if(!o.success)return g(o.error);let i=o.data;a("Getting service configuration...",10);let s=await e.getServicesFromInfrastructure(r);if(!s.success)return g(new Yt(`Failed to read manifest: ${b(s.error.message)}. Run 'cdk synth' first.`,"unknown",t,s.error));let c=s.data;if(c.length===0)return a("No services configured, skipping image tagging",100),E({taggedServices:[]});let l=c.length>1,u=[],d=zgn/c.length;for(let p=0;p<c.length;p++){let m=c[p],f=Wgn+p*d,y=await OZt({service:m,isMultiService:l,ecrRepositoryName:i,appName:t,serviceBaseProgress:f,progressPerService:d,imageService:e.imageService,emit:a});if(!y.success)return g(y.error);u.push(m.name)}return a(`Tagged ${u.length} service(s)`,100),E({taggedServices:u})}catch(a){let o=b(k(a));return g(new Yt(`Failed to tag ECR images: ${o}`,"unknown",t,a))}}var Vgn,SAe,zI,cQe,Wgn,zgn,uQe=w(()=>{"use strict";ae();F3();$();k0();le();bQ();Vgn=Object.defineProperty,SAe=(e,t)=>Vgn(e,"name",{value:t,configurable:!0}),zI=10,cQe=3e3,Wgn=10,zgn=80;SAe(bAe,"pickSourceTag");SAe(OZt,"tagSingleService");SAe(lQe,"runTagEcrImages")});import*as EAe from"path";var Hgn,dQe,kQ,DZt=w(()=>{"use strict";Le();EQ();ae();$();So();xi();EA();k0();hZt();gZt();vZt();PZt();uQe();k0();Hgn=Object.defineProperty,dQe=(e,t)=>Hgn(e,"name",{value:t,configurable:!0}),kQ=class{static{dQe(this,"EcrService")}repositoryService;imageService;initialiser;awsContext;constructor(){this.repositoryService=new wQ,this.imageService=new CQ,this.initialiser=new TQ(this.repositoryService,this.imageService,U1())}async ensureAwsContext(){let t=await qc().acquire();t!==this.awsContext&&(this.awsContext=t,this.repositoryService=new wQ(t),this.imageService=new CQ(t),this.initialiser=new TQ(this.repositoryService,this.imageService,U1()))}async getRepositoryNameFromStackByExportName(t){return await this.ensureAwsContext(),this.repositoryService.getRepositoryNameFromStackByExportName(t)}async getAuthConfig(t,r){return await this.ensureAwsContext(),this.repositoryService.getAuthConfig(t,r)}async describeRepositories(t){return await this.ensureAwsContext(),this.repositoryService.describeRepositories(t)}async listRepositories(){return await this.ensureAwsContext(),this.repositoryService.listRepositories()}async listImages(t){return await this.ensureAwsContext(),this.imageService.listImages(t)}async countImages(t){return await this.ensureAwsContext(),this.imageService.countImages(t)}async hasTag(t,r){return await this.ensureAwsContext(),this.imageService.hasTag(t,r)}async copyImageTag(t,r,n){return await this.ensureAwsContext(),this.imageService.copyImageTag(t,r,n)}async getLatestTag(t){return await this.ensureAwsContext(),this.imageService.getLatestTag(t)}async getRepository(t){return await this.ensureAwsContext(),this.repositoryService.getRepository(t)}async deleteImages(t,r){return await this.ensureAwsContext(),this.imageService.deleteImages(t,r)}async repositoryExists(t){return await this.ensureAwsContext(),this.repositoryService.repositoryExists(t)}async initialiseRepository(t,r,n,a){return await this.ensureAwsContext(),this.initialiser.initialiseRepository(t,r,n,a)}async deployDockerImage(t,r,n,a){await this.ensureAwsContext();let o=a?.dockerConfig;if(!o){let s=await FI().getDockerConfig(n);if(!s.success){let c=b(s.error.message);return g(new Yt(`Failed to get Docker configuration: ${c}`,"unknown",t,s.error))}o=s.data}if(!o)return g(new Yt("Docker configuration is required but was not provided","unknown",t));let i=await this.repositoryService.getAuthConfig(r);if(!i.success){let s=b(i.error.message);return g(new Yt(`Failed to get ECR auth: ${s}`,"auth_failed",t,i.error))}return sQe({repositoryName:t,dockerConfig:o,authConfig:i.data,appPath:n,workingDirectory:a?.workingDirectory,progressCallback:a?.progressCallback,onDockerProgress:a?.onDockerProgress,serviceFilter:a?.serviceFilter,targetOverride:a?.targetOverride,platform:a?.platform,repositoryService:this.repositoryService,cliDockerProvider:A1(),...a?.flagBuildArgs!==void 0&&{flagBuildArgs:a.flagBuildArgs},...a?.flagBuildSecrets!==void 0&&{flagBuildSecrets:a.flagBuildSecrets},...this.awsContext!==void 0&&{awsProvider:this.awsContext}})}async getServiceNamesFromInfrastructure(t){let r=await Ph().getServiceNames(t);return r.success?E(r.data):g(new Yt(b(r.error.message),"unknown",void 0,r.error))}async getServicesFromInfrastructure(t){let r=await Ph().getServices(t);return r.success?E(r.data):g(new Yt(b(r.error.message),"unknown",void 0,r.error))}async resolveEcrRepositoryName(t,r){let n=`${$r(t)}EcrRepositoryName`,a=await this.getRepositoryNameFromStackByExportName(n);if(!a.success)return g(new Yt(`Failed to get ECR repository name (${r}): ${b(a.error.message)}`,"unknown",t,a.error,!1,"ECR_REPOSITORY_NOT_FOUND"));let o=a.data;return o?E(o):g(new Yt(`ECR repository not found in stack outputs (${r}). Looking for export: ${n}. Ensure Network stack has been deployed.`,"not_found",t,void 0,!1,"repository"))}async tagEcrImages(t,r,n){return await this.ensureAwsContext(),lQe({resolveEcrRepositoryName:dQe((a,o)=>this.resolveEcrRepositoryName(a,o),"resolveEcrRepositoryName"),getServicesFromInfrastructure:dQe(a=>this.getServicesFromInfrastructure(a),"getServicesFromInfrastructure"),imageService:this.imageService},t,r,n)}async hasDockerConfiguration(t){try{let r=await FI().getDockerConfig(t);if(!r.success)return E(!1);let n=r.data?.services??[];if(n.length===0)return E(!1);for(let a of n){let o=a.docker?.path;if(!o)continue;let i=EAe.isAbsolute(o)?o:EAe.join(t,o);if(await br(i))return E(!0)}return E(!1)}catch(r){let n=b(r instanceof Error?r.message:String(r));return g(new Yt(`Failed to check Docker configuration: ${n}`,"unknown",void 0,r))}}}});var Kgn,qgn,j3,pQe=w(()=>{"use strict";gd();at();Le();at();Kgn=Object.defineProperty,qgn=(e,t)=>Kgn(e,"name",{value:t,configurable:!0}),j3=class{static{qgn(this,"EcsService")}inner=null;resolver=null;async getInner(){if(!this.inner){let t=await ze.initialise();this.inner=new Yv(t)}return this.inner}getResolver(){if(!this.resolver){let t=by();this.resolver=new Jv(t)}return this.resolver}async updateService(t,r,n){return(await this.getInner()).updateService(t,r,n)}async describeServices(t,r){return(await this.getInner()).describeServices(t,r)}async getDeploymentStatus(t,r){return(await this.getInner()).getDeploymentStatus(t,r)}async isDeploying(t,r){return(await this.getInner()).isDeploying(t,r)}async getServiceEvents(t,r){return(await this.getInner()).getServiceEvents(t,r)}async pollDeployment(t){return(await this.getInner()).pollDeployment(t)}async listClusters(){return(await this.getInner()).listClusters()}async describeClusters(t){return(await this.getInner()).describeClusters(t)}async listServices(t){return(await this.getInner()).listServices(t)}async registerTaskDefinition(t){return(await this.getInner()).registerTaskDefinition(t)}async getLatestTaskDefinition(t){return(await this.getInner()).getLatestTaskDefinition(t)}async deployService(t,r,n){return(await this.getInner()).deployService(t,r,n)}async getDeployableClusterAndServices(t){return this.getResolver().getDeployableClusterAndServices(t)}}});import{join as $Zt}from"node:path";import{tmpdir as Jgn}from"node:os";import{randomUUID as Zgn}from"node:crypto";import{unlink as NZt}from"node:fs/promises";function MZt(e){return e.startsWith("cn-")?"amazonaws.com.cn":"amazonaws.com"}function AAe(e,t){return`${e}.dkr.ecr.${t}.${MZt(t)}`}function wAe(e){return Wr(e)}function mQe(e){let t=e.split("/")[0]??"";if(!t.includes(".dkr.ecr."))return;let r=t.split(".")[0]??"";if(r!=="")return{registry:t,accountId:r}}function LZt(e){let t=e.indexOf("/");return t===-1?e:e.slice(t+1)}function fQe(){return $Zt(Jgn(),`fjall-buildx-meta-${Zgn()}.json`)}function hQe(){return{debug:$l((e,t,r)=>P.debug(e,t,r),"debug"),info:$l((e,t,r)=>P.info(e,t,r),"info"),warn:$l((e,t,r)=>P.warn(e,t,r),"warn"),error:$l((e,t,r)=>P.error(e,t,r),"error")}}var Ygn,$l,Xgn,Qgn,CAe,FZt=w(()=>{"use strict";at();Ah();$();F3();le();he();uQe();EQ();Ygn=Object.defineProperty,$l=(e,t)=>Ygn(e,"name",{value:t,configurable:!0}),Xgn="CliDockerProvider",Qgn="fjall";$l(MZt,"ecrDnsSuffix");$l(AAe,"ecrRegistryUrl");$l(wAe,"ecrRepositoryName");$l(mQe,"parseEcrRegistry");$l(LZt,"slotRepositoryName");$l(fQe,"tempMetadataPath");$l(hQe,"makeDockerCliLogger");CAe=class{static{$l(this,"CliDockerProvider")}cli;ecr;builderBootstrapped=void 0;cachedBuilderRejectionMessage=void 0;orchestratorSession=!1;constructor(t,r){this.cli=t,this.ecr=r}async preflight(){let t=await this.cli.detectDaemon();if(!t.success)return g(new Error(qi(t.error)));let r=await this.cli.assertBuildxAvailable();return r.success?E(void 0):g(new Error(qi(r.error)))}async beginEcrSession(t){let r=AAe(t.accountId,t.region),n=await this.resolveEcrAuth(t.accountId,t.abortSignal);if(!n.success)return n;let a=await this.cli.loginEcr({registry:r,username:n.data.username,password:n.data.password});return a.success?(this.orchestratorSession=!0,E(void 0)):g(this.ecrLoginFailure(a.error))}async endEcrSession(){this.orchestratorSession=!1,await this.cli.logoutEcr().catch(()=>{})}async resolveEcrAuth(t,r){let n=await this.ecr.getAuthConfig(t,r);if(!n.success){let a=b(n.error.message);return g(new Error(`ECR auth failed: ${a}`))}return E(n.data)}ecrLoginFailure(t){return new Error(`ECR login failed: ${qi(t)}`)}async buildAndPush(t,r,n){let{appName:a,region:o,accountId:i}=t,s=t.platform??x0,c=t.imageTag??"latest",l=AAe(i,o),u=wAe(a),d=`${l}/${u}`,p=`${d}:${c}`,m=fQe(),f=t.pushByDigest===!0,y=f?[]:t.imageTags!==void 0&&t.imageTags.length>0?t.imageTags:[p],v=$l((T,x,R,I)=>{r?.(b(T),x,R,I)},"emit"),S=pJ(process.env);if(!S.success){let T=b(S.error.message);return v(`Invalid build cache configuration: ${T}`),g(new Error(T))}let A=S.data,C=$l(async()=>{v("Building Docker image\u2026",15);let T=await this.ensureBuilderOnce();if(!T.success){let O=b(T.error.message);return v(`Builder bootstrap failed: ${O}`),g(new Error(`Builder bootstrap failed: ${O}`))}let x=mJ({cacheRepoUri:t.cacheRepoUri,appName:a,serviceName:t.serviceName,mode:A}),R={contextPath:t.buildContext??t.appPath,dockerfilePath:t.dockerfilePath??$Zt(t.appPath,"Dockerfile"),platforms:[s],tags:[...y],buildArgs:{...t.buildArgs??{}},...t.buildSecrets!==void 0&&{secrets:t.buildSecrets.map(O=>({id:O.id,source:O.source}))},provenance:t.targetsLambda!==!0,sbom:t.targetsLambda!==!0,push:!0,load:!1,...f&&{pushByDigest:!0,imageName:d},metadataFile:m,...t.target!==void 0&&{target:t.target},...x!==void 0&&{cacheFrom:x.cacheFrom},...x?.cacheTo!==void 0&&{cacheTo:x.cacheTo}},I=await this.cli.buildxBuild(R,O=>{v(O.message,O.percentage,O.vertex,O.type),n?.(O)},t.abortSignal);if(!I.success){let O=qi(I.error);return v(`Buildx build failed: ${O}`),g(new Error(`Buildx build failed: ${O}`))}let D=I.data.digest;return typeof D!="string"||D===""?(v("Buildx push succeeded but no image digest was reported"),g(new Error("Buildx push succeeded but no image digest was reported"))):(v("Docker image pushed successfully",100),E({imageUri:d,imageTag:c,imageDigest:D}))},"runBuild");try{let T=await this.cli.assertBuildxAvailable();if(!T.success){let R=qi(T.error);return v(`Buildx unavailable: ${R}`),g(new Error(`Buildx unavailable: ${R}`))}if(this.orchestratorSession)return await C();v("Authenticating to ECR\u2026",5);let x=await this.resolveEcrAuth(i);return x.success?await this.cli.withEcrSession({registry:l,username:x.data.username,password:x.data.password},C,R=>this.ecrLoginFailure(R)):x}catch(T){let x=b(k(T));return v(`Docker build/push failed for ${a}: ${x}`),g(new Error(`Docker build/push failed for ${a}: ${x}`))}finally{await NZt(m).catch(()=>{})}}async buildAndPushToRepo(t,r,n){let a=t.platform??x0,o=`${t.repoUri}:${t.imageTag}`,i=fQe(),s=$l((p,m,f,y)=>{r?.(b(p),m,f,y)},"emit"),c=mQe(t.repoUri);if(c===void 0){let p=b(t.repoUri);return s(`Not an ECR repository URI: ${p}`),g(new Error(`Not an ECR repository URI: ${p}`))}let l=pJ(process.env);if(!l.success){let p=b(l.error.message);return s(`Invalid build cache configuration: ${p}`),g(new Error(p))}let u=l.data,d=$l(async()=>{s("Building slot image\u2026",15);let p=await this.ensureBuilderOnce();if(!p.success){let S=b(p.error.message);return s(`Builder bootstrap failed: ${S}`),g(new Error(`Builder bootstrap failed: ${S}`))}let m=mJ({cacheRepoUri:t.cacheRepoUri,appName:LZt(t.repoUri),mode:u});m===void 0&&s("No build cache repository on this substrate \u2014 building uncached. Redeploy the substrate to enable caching.");let f={contextPath:t.contextPath,dockerfilePath:t.dockerfilePath,platforms:[a],tags:[o],buildArgs:{...t.buildArgs??{}},provenance:!1,sbom:!1,push:!0,load:!1,metadataFile:i,...m!==void 0&&{cacheFrom:m.cacheFrom},...m?.cacheTo!==void 0&&{cacheTo:m.cacheTo}},y=await this.cli.buildxBuild(f,S=>{s(S.message,S.percentage,S.vertex,S.type),n?.(S)});if(!y.success){let S=qi(y.error);return s(`Buildx build failed: ${S}`),g(new Error(`Buildx build failed: ${S}`))}let v=y.data.digest;return typeof v!="string"||v===""?(s("Buildx push succeeded but no image digest was reported"),g(new Error("Buildx push succeeded but no image digest was reported"))):(s("Slot image pushed successfully",100),E({imageUri:t.repoUri,imageTag:t.imageTag,imageDigest:v}))},"runBuild");try{let p=await this.cli.assertBuildxAvailable();if(!p.success){let m=qi(p.error);return s(`Buildx unavailable: ${m}`),g(new Error(`Buildx unavailable: ${m}`))}return await this.cli.withEcrSession({registry:c.registry,username:t.ecrAuth.username,password:t.ecrAuth.password},d,m=>this.ecrLoginFailure(m))}catch(p){let m=b(k(p));return s(`Slot build/push failed: ${m}`),g(new Error(`Slot build/push failed: ${m}`))}finally{await NZt(i).catch(()=>{})}}async ensureBuilderOnce(){if(this.cachedBuilderRejectionMessage!==void 0)return g(new Error(this.cachedBuilderRejectionMessage));this.builderBootstrapped===void 0&&(this.builderBootstrapped=this.cli.ensureBuilder(Qgn));let t;try{t=await this.builderBootstrapped}catch(r){let n=b(r instanceof Error?r.message:String(r));return this.cachedBuilderRejectionMessage=n,g(new Error(n))}if(!t.success){let r=qi(t.error);return this.cachedBuilderRejectionMessage=r,g(new Error(r))}return E(void 0)}async tagByDigest(t){let r=$l(async()=>{let o=await this.cli.tagByDigest(t.sourceImage,t.digest,t.tags);return o.success?E(void 0):g(new Error(`tagByDigest failed: ${qi(o.error)}`))},"runTag");if(this.orchestratorSession)return r();let n=mQe(t.sourceImage);if(n===void 0)return r();let a=await this.resolveEcrAuth(n.accountId);return a.success?this.cli.withEcrSession({registry:n.registry,username:a.data.username,password:a.data.password},r,o=>this.ecrLoginFailure(o)):a}async initialiseECR(t){let{appName:r,region:n,accountId:a}=t,o=wAe(r),i=`${AAe(a,n)}/${o}`;try{let s=await this.ecr.initialiseRepository(o,a);if(!s.success){let c=b(s.error.message);return g(new Error(`ECR initialisation failed: ${c}`))}return E({repositoryUri:i})}catch(s){let c=b(k(s));return g(new Error(`ECR initialisation failed for ${r}: ${c}`))}}async tagImages(t,r){let{appName:n,appPath:a}=t,o=wAe(n),i=$l((s,c,l,u)=>{r?.(b(s),c,l,u)},"emit");try{let s=await this.ecr.getServicesFromInfrastructure(a);if(!s.success){let d=b(s.error.message);return g(new Error(`Failed to read services for ${n}: ${d}`))}let c=s.data;if(c.length===0)return E({taggedServices:[]});let l=c.length>1,u=[];for(let d=0;d<c.length;d++){let p=c[d],m=p.name,f=`${m.toLowerCase()}-latest`,y=bAe(p,l);i(`Tagging image for service ${m} (${d+1}/${c.length})\u2026`);let v,S=!1;for(let A=1;A<=zI&&!S;A++){let C=await this.ecr.copyImageTag(o,y,f);if(C.success){S=!0;break}let T=b(C.error.message);if(Ay(C.error)&&C.error.resource==="repository"){v=T;break}if((T.includes("not found")||T.includes("does not exist"))&&A<zI){i(`Waiting for image :${y} to be available (attempt ${A}/${zI})\u2026`),await Wt(cQe);continue}v=T;break}if(!S)return g(new Error(`Failed to tag image for service ${m}: ${v??"Unknown error"}`));u.push(m),i(`Tagged image for service ${m}`)}return E({taggedServices:u})}catch(s){let c=b(k(s));return P.warn(Xgn,"tagImages failed",{appName:n,error:c}),g(new Error(`Failed to tag images for ${n}: ${c}`))}}}});function gQe(e){let t=e?.getAuthResult();if(t&&t.account&&t.arn&&t.userId)return{Account:t.account,Arn:t.arn,UserId:t.userId}}var eyn,tyn,jZt=w(()=>{"use strict";eyn=Object.defineProperty,tyn=(e,t)=>eyn(e,"name",{value:t,configurable:!0});tyn(gQe,"getCallerIdentityFromAuth")});var ryn,nyn,TAe,G1,Xn,HI=w(()=>{"use strict";Pr();ryn=Object.defineProperty,nyn=(e,t)=>ryn(e,"name",{value:t,configurable:!0}),TAe="OidcDeployRoleArn",G1="production",Xn=class extends Ke{static{nyn(this,"OrganisationError")}organisationType;target;operation;constructor(t,r,n,a,o,i=!1,s){super("ORGANISATION_ERROR",t,o,i,s),this.organisationType=r,this.target=n,this.operation=a}}});function KI(e){return gQe(e.aws)}function xAe(e){return e.find(t=>pr(t)==="platform")}function kAe(e){return xAe(e)?.id}async function B3(e,t,r,n,a,o){let i=a??At;if(e.aws)return P.debug("Organisation","Re-using existing AWS context (skipping re-auth)",{region:i,operationType:t.type,target:t.target}),E(i);let s=RQ(),c;t.type===ar.ORGANISATION?c="organisation":t.type===ar.PLATFORM?c="platform":c="account";let l=await s.assumeOrganisationProfile(c,i,o,n.deploymentTarget);if(!l.success)return g(new Xn(`Failed to switch to ${c} profile: ${b(l.error?.message??"")}`,t.type,t.target,"auth"));if(!l.data)return g(new Xn(`No suitable AWS profile found for ${c} deployment`,t.type,t.target,"auth"));let u;try{u=await ze.initialise({ssoCallbacks:{onSSOUrl:IS(p=>n.onSSOUrl?.(p),"onSSOUrl")}}),e.setAwsContext(u)}catch(p){return g(new Xn(`Authentication failed: ${b(k(p))}`,t.type,t.target,"auth"))}let d=u.getAuthResult();if(d)n.onSSOUrl?.(null),n.onAuthComplete?.(d);else return g(new Xn("Failed to authenticate with AWS",t.type,t.target,"auth"));return n.deploymentTarget!==void 0?E(u.getRegion()):E(i)}function yQe(e,t,r,n){let a=t!==void 0?`${e} (${t})`:e;return new Xn(`AWS account mismatch: Expected deployment to account ${a}, but currently authenticated to account ${r}. Profile switching may have failed. Please verify your AWS credentials.`,n.type,n.target,"authentication")}async function U3(e,t,r){if(!t.callerIdentity)return g(new Xn("No AWS credentials available",e.type,e.target,"authentication"));let n=t.callerIdentity.Account;if(r.providerAccounts===void 0)return g(new Xn(`Cannot verify the target AWS account for this ${e.type} ${r.mode}: the organisation's registered accounts could not be fetched from the Fjall API. The current AWS credentials resolve to account ${n}. Check your connection and retry; if the problem persists, run 'fjall login' to refresh your session.`,e.type,e.target,"authentication"));let a=r.providerAccounts;if(e.type===ar.ORGANISATION){let s=a.find(l=>pr(l)==="organisation"),c=s?.id??t.managementAccountId;if(c===void 0){let l=`Could not confirm the management account for this organisation ${r.mode}: no organisation-tier account is registered and the AWS Organizations lookup was unavailable.`;if(r.mode==="destroy")return g(new Xn(`${l} Retry, and check the credentials allow 'organizations:DescribeOrganization'.`,e.type,e.target,"authentication"));be(`${l} Proceeding against account ${n}.`,{scope:ce.deploy})}else if(c!==n)return g(yQe(c,s?.name,n,e));return E(void 0)}if(e.type===ar.PLATFORM){let s=xAe(a);return s===void 0?g(new Xn(`Cannot verify the platform account for this ${r.mode}: no platform-tier account is registered with Fjall. Run '${fe.organisationDeploy}' to sync accounts, then retry.`,e.type,e.target,"authentication")):s.id!==n?g(yQe(s.id,s.name,n,e)):E(void 0)}if(a.length===0)return be(`No accounts are registered with Fjall yet \u2014 skipping target-account verification (standalone account flow). Proceeding against account ${n}.`,{scope:ce.deploy}),E(void 0);let o=a.find(s=>pr(s)==="organisation"),i=xAe(a);return o&&n===o.id?g(new Xn(`Cannot deploy Account to root account ${o.id}. Account must be deployed to a non-root, non-platform account.`,e.type,e.target,"validation")):i&&n===i.id?g(new Xn(`Cannot deploy Account to platform account ${i.id}. Account must be deployed to a non-root, non-platform account.`,e.type,e.target,"validation")):E(void 0)}async function I0(e,t){let r=rt.fromCredentials();if(r)try{let n=await r.putOrganisationConfig(e);n.success?(P.info(t,"Organisation config pushed to API"),va().invalidateCache()):(P.warn(t,"Failed to push org config to API (non-critical)",{error:b(n.error.message)}),be(`Failed to push org config: ${n.error.message}`,{scope:ce.deploy}))}catch(n){let a=b(k(n));P.warn(t,"Failed to push org config to API (non-critical)",{error:a}),be(`Failed to push org config: ${a}`,{scope:ce.deploy})}}async function G3(){try{let e=rt.fromCredentials();if(!e)return;let t=await e.getIdentity();return t.success?t.data.organisationId:void 0}catch(e){P.debug("Organisation","Failed to fetch organisation identity",{error:b(k(e))});return}}async function V3(e,t){let r=un(),n=await e.executeStep(ge.VERIFY,async()=>{let a=await r.verifyDeploymentTarget({deployType:t.type,target:t.target,path:t.path});return a.success?{success:!0,message:"Deployment target verified"}:{success:!1,error:a.error.message}});return n.success?E(void 0):g(new Xn("error"in n?String(n.error):"Failed to verify deployment target",t.type,t.target,ge.VERIFY))}var ayn,IS,IQ,W3=w(()=>{"use strict";$();Dt();or();at();_i();Le();xi();jZt();ae();HI();ki();le();Rn();Le();$();he();Cn();ayn=Object.defineProperty,IS=(e,t)=>ayn(e,"name",{value:t,configurable:!0}),IQ=class{static{IS(this,"OrganisationState")}_aws=null;get aws(){return this._aws}setAwsContext(t){this._aws=t}};IS(KI,"getCallerIdentity");IS(xAe,"getPlatformAccount");IS(kAe,"getPlatformAccountId");IS(B3,"authenticateForOperation");IS(yQe,"buildMismatchError");IS(U3,"verifyTargetAccount");IS(I0,"pushOrgConfigToApi");IS(G3,"fetchFjallOrgId");IS(V3,"executeVerifyTargetStep")});function _Q(e){let t=e?.providerAccounts??[],r=e?.primaryRegion??At;return{providerAccounts:t,primaryRegion:r}}var oyn,iyn,vQe=w(()=>{"use strict";at();ki();oyn=Object.defineProperty,iyn=(e,t)=>oyn(e,"name",{value:t,configurable:!0});iyn(_Q,"loadConfigAndRegions")});var SQe=w(()=>{"use strict";at()});var syn,cyn,z3,bQe=w(()=>{"use strict";SQe();le();syn=Object.defineProperty,cyn=(e,t)=>syn(e,"name",{value:t,configurable:!0}),z3=class{static{cyn(this,"StepManager")}context;steps;stepStates;currentIndex=0;callbacks;constructor(t,r){this.context=t,this.callbacks=r,this.steps=js.getSteps(t),this.stepStates=new Map;for(let n of this.steps)this.stepStates.set(n.id,{id:n.id,name:n.name,status:"pending"})}updateContext(t){this.context=t,this.steps=js.getSteps(t);let r=new Map;for(let a of this.steps){let o=this.stepStates.get(a.id);o?r.set(a.id,o):r.set(a.id,{id:a.id,name:a.name,status:"pending"})}this.stepStates=r;let n=-1;for(let[a,o]of this.steps.entries()){let i=this.stepStates.get(o.id);i&&(i.status==="completed"||i.status==="running")&&(n=a)}this.currentIndex=Math.max(0,n)}reportStep(t,r){let n=this.steps.findIndex(c=>c.id===t);if(n===-1)return;let a=this.steps[n],o=this.stepStates.get(t);if(!o)return;let i=n+1,s=this.steps.length;switch(r){case"start":o.status="running",o.startTime=new Date,this.currentIndex=n,this.callbacks.onStepStart?.(a.id,a.name,i,s);break;case"complete":if(o.status==="completed")return;o.status="completed",o.endTime=new Date,this.callbacks.onStepComplete?.(a.id,a.name,"completed",i,s),this.currentIndex=n+1;break;case"error":if(o.status==="completed")return;o.status="error",o.endTime=new Date,this.callbacks.onStepComplete?.(a.id,a.name,"error",i,s);break;case"skipped":o.status="skipped",o.endTime=new Date,this.callbacks.onStepComplete?.(a.id,a.name,"skipped",i,s),this.currentIndex=n+1;break;case"cancelled":if(o.status==="completed")return;o.status="cancelled",o.endTime=new Date,this.callbacks.onStepComplete?.(a.id,a.name,"cancelled",i,s);break}}reportStepError(t,r){let n=this.stepStates.get(t);n&&(n.error=r),this.reportStep(t,"error")}skipRemainingInfraSteps(){let t=js.getInfraStepIds();for(let[r,n]of this.steps.entries())r>=this.currentIndex&&t.includes(n.id)&&this.reportStep(n.id,"skipped")}skipRemainingDockerSteps(){let t=js.getDockerStepIds();for(let[r,n]of this.steps.entries())r>=this.currentIndex&&t.includes(n.id)&&this.reportStep(n.id,"skipped")}getCurrentIndex(){return this.currentIndex}getCurrentStep(){return this.steps[this.currentIndex]}getStepsWithStates(){return this.steps.map(t=>({...t,state:this.stepStates.get(t.id)??{id:t.id,name:t.name,status:"pending"}}))}getProgress(){if(this.steps.length===0)return 100;let t=Array.from(this.stepStates.values()).filter(r=>r.status==="completed"||r.status==="skipped").length;return Math.round(t/this.steps.length*100)}isComplete(){return Array.from(this.stepStates.values()).every(t=>t.status==="completed"||t.status==="skipped")}hasError(){return Array.from(this.stepStates.values()).some(t=>t.status==="error")}getErrors(){let t=[];for(let r of this.stepStates.values())r.status==="error"&&r.error&&t.push({step:r.name,error:r.error});return t}reset(){this.currentIndex=0;for(let t of this.stepStates.values())t.status="pending",t.startTime=void 0,t.endTime=void 0,t.error=void 0}getStepNames(){return this.steps.map(t=>t.name)}hasStep(t){return this.steps.some(r=>r.id===t)}getStepIndex(t){return this.steps.findIndex(r=>r.id===t)}getStepState(t){return this.stepStates.get(t)?.status}async executeStep(t,r){this.reportStep(t,"start");try{let n=await r();return n.success?this.reportStep(t,"complete"):this.reportStep(t,"error"),n}catch(n){let a=k(n);throw this.reportStepError(t,a),n}}}});import{execFileSync as uyn}from"child_process";async function EQe(e,t){try{let r=BZt(t);if(r){let n=await e.registerRepository({remoteUrl:r});n.success?P.info(R0,"Repository registered with Fjall",{remoteUrl:r}):P.debug(R0,"Repo registration failed (non-critical)",{error:b(n.error.message)})}}catch(r){P.debug(R0,"Git remote detection failed (non-critical)",{error:b(k(r))})}}async function AQe(e,t,r){try{let n=await e.verifyAwsAccount({awsAccountId:t,accountName:r??"standalone"});n.success?P.info(R0,"Standalone account registered with Fjall",{accountId:t}):(P.warn(R0,"Standalone account registration failed (non-critical)",{error:b(n.error.message)}),be(`Account registration with Fjall failed: ${n.error.message}. You can register manually later.`,{scope:ce.deploy}))}catch(n){P.warn(R0,"Standalone account registration failed (non-critical)",{error:b(k(n))}),be(`Account registration with Fjall failed: ${k(n)}. You can register manually later.`,{scope:ce.deploy})}}async function wQe(e){try{let t=await e.getEntitlements();if(t.success){let{limits:r,usage:n}=t.data;if(r.awsAccounts!==-1&&!n)P.warn(R0,"Entitlements arrived without usage (non-critical), proceeding with deploy"),be("fjall.io returned your plan's AWS account limit without current usage, so the pre-deploy limit check was skipped \u2014 the limit is still enforced at registration.",{scope:ce.deploy});else if(r.awsAccounts!==-1&&n&&n.awsAccounts>=r.awsAccounts){let a=t.data.plan.charAt(0).toUpperCase()+t.data.plan.slice(1);return`AWS account limit reached (${n.awsAccounts}/${r.awsAccounts} on ${a} plan). Upgrade at fjall.io/settings/billing`}}else{let r=b(t.error.message);P.warn(R0,"Failed to check entitlements (non-critical), proceeding with deploy",{error:r}),be(t.error.errorType==="not_authenticated"?`Could not check your plan's AWS account limit \u2014 not logged in to fjall.io (${r}). Proceeding; the limit is still enforced at registration. Run 'fjall login' to restore the pre-deploy check.`:`Could not check your plan's AWS account limit (${r}) \u2014 proceeding; the limit is still enforced at registration.`,{scope:ce.deploy})}}catch(t){let r=b(k(t));P.warn(R0,"Failed to check entitlements (non-critical), proceeding with deploy",{error:r}),be(`Could not check your plan's AWS account limit (${r}) \u2014 proceeding; the limit is still enforced at registration.`,{scope:ce.deploy})}}function BZt(e){try{let t=uyn("git",["remote","get-url","origin"],{cwd:e,timeout:5e3,encoding:"utf-8",stdio:["pipe","pipe","pipe"],env:Ir(process.env)}).trim();return t.length>0?t:void 0}catch(t){P.debug("Organisation","Failed to detect git remote",{error:b(k(t))});return}}var lyn,IAe,R0,UZt=w(()=>{"use strict";Dt();or();he();le();$();lyn=Object.defineProperty,IAe=(e,t)=>lyn(e,"name",{value:t,configurable:!0}),R0="OrgPostDeploy";IAe(EQe,"registerRepository");IAe(AQe,"registerStandaloneAccount");IAe(wQe,"checkAccountEntitlements");IAe(BZt,"detectGitRemote")});import{CloudFormationClient as pyn}from"@aws-sdk/client-cloudformation";function H3(){return async(e,t)=>{try{let r=await new qo().getOrgConfig();if(!r.success)return g(new Error(`organisation config unavailable: ${r.error.message}`));let n=r.data,a=n.providerAccounts.find(l=>l.id===e);if(a===void 0)return g(new Error(`account ${e} is not a connected provider account: connect it with 'fjall connect' or fix the "account" value in fjall-config.json`));let o=t??a.region??n.primaryRegion;if(o===void 0)return g(new Error(`no region is known for account ${e} (no domain-entry region, no account region, no organisation primary region): run 'fjall connect' to complete organisation setup`));let i=Dp(n,a.name,o);if(i===void 0)return g(new Error(`no credential profile can be derived for account '${a.name}' (${e}) in ${o}: run 'fjall connect' to complete organisation setup`));let s=await FX(i,o,n,{onSSOUrl:GZt(()=>{throw new Error(`SSO session for account ${e} needs interactive re-authentication: run 'fjall connect' to refresh it, then retry`)},"onSSOUrl"),presenter:J9t}),c=new pyn({region:o,credentials:{accessKeyId:s.accessKeyId,secretAccessKey:s.secretAccessKey,...s.sessionToken!==void 0?{sessionToken:s.sessionToken}:{}},maxAttempts:3,requestHandler:new aa({requestTimeout:3e4,connectionTimeout:1e4})});return E({cloudFormation:c})}catch(r){return g(r instanceof Error?r:new Error(String(r)))}}}var dyn,GZt,CQe=w(()=>{"use strict";_m();ae();CEe();aEe();OI();md();dyn=Object.defineProperty,GZt=(e,t)=>dyn(e,"name",{value:t,configurable:!0});GZt(H3,"buildAccountCloudFormationClientFactory")});import{ListHostedZonesCommand as VZt,ListResourceRecordSetsCommand as fyn}from"@aws-sdk/client-route-53";function WZt(e){return hyn.has(e)}async function OQ(e,t,r){let n=t.endsWith(".")?t:`${t}.`,a;do{let o=await e.send(new VZt({MaxItems:100,Marker:a}),{abortSignal:X(r)}),i=(o.HostedZones??[]).find(s=>s.Name===n);if(i?.Id)return i.Id.replace("/hostedzone/","");a=o.IsTruncated?o.NextMarker:void 0}while(a)}async function TQe(e,t){let r=[],n;do{let a=await e.send(new VZt({MaxItems:100,Marker:n}),{abortSignal:X(t)});for(let o of a.HostedZones??[])if(!(o.Id===void 0||o.Name===void 0)&&(r.push({zoneName:o.Name.endsWith(".")?o.Name.slice(0,-1):o.Name,hostedZoneId:o.Id.replace("/hostedzone/",""),...o.ResourceRecordSetCount!==void 0?{recordCount:o.ResourceRecordSetCount}:{},privateZone:o.Config?.PrivateZone===!0}),r.length>=gyn))return r;n=a.IsTruncated?a.NextMarker:void 0}while(n);return r}async function yyn(e,t){let r=[],n,a;do{let o=await e.send(new fyn({HostedZoneId:t,StartRecordName:n,StartRecordType:a}));for(let i of o.ResourceRecordSets??[])i.AliasTarget||i.Type!=="SOA"&&i.Name&&i.Type&&i.ResourceRecords&&r.push({Name:i.Name,Type:i.Type,TTL:i.TTL,...i.SetIdentifier!==void 0?{SetIdentifier:i.SetIdentifier}:{},ResourceRecords:i.ResourceRecords.map(s=>({Value:s.Value??""}))});n=o.IsTruncated?o.NextRecordName:void 0,a=o.IsTruncated?o.NextRecordType:void 0}while(n);return r}function vyn(e,t){let r=[];for(let n of e){if(!WZt(n.Type))continue;let a=n.Type,o=n.Name??"";if(o.endsWith(".")&&(o=o.slice(0,-1)),o===t?o="@":o.endsWith(`.${t}`)&&(o=o.slice(0,-(t.length+1))),!(a==="NS"&&o==="@"))for(let i of n.ResourceRecords??[]){let s=i.Value;(a==="CNAME"||a==="NS"||a==="MX"||a==="SRV")&&s.endsWith(".")&&(s=s.slice(0,-1));let c={name:o,type:a,value:s};if(n.TTL!==void 0&&(c.ttl=n.TTL),a==="MX"){let l=s.split(/\s+/);l.length>=2&&(c.priority=parseInt(l[0],10),c.value=l.slice(1).join(" "),c.value.endsWith(".")&&(c.value=c.value.slice(0,-1)))}a==="TXT"&&(c.value=s.replace(/^"(.*)"$/,"$1")),r.push(c)}}return r}var myn,PQ,hyn,gyn,K3=w(()=>{"use strict";at();ue();at();myn=Object.defineProperty,PQ=(e,t)=>myn(e,"name",{value:t,configurable:!0}),hyn=new Set(pk.options);PQ(WZt,"isSupportedRecordType");PQ(OQ,"findHostedZoneId");gyn=1e3;PQ(TQe,"listHostedZones");PQ(yyn,"listRoute53Records");PQ(vyn,"convertRoute53Records")});import{Route53Client as byn}from"@aws-sdk/client-route-53";import{CloudFormationClient as Eyn}from"@aws-sdk/client-cloudformation";import{ACMClient as Ayn}from"@aws-sdk/client-acm";function zZt(e,t){let r=e.getCredentials(),n=new Map;for(let a of new Set(t))n.set(a,new Ayn({region:a,...r!==void 0?{credentials:{accessKeyId:r.accessKeyId,secretAccessKey:r.secretAccessKey,sessionToken:r.sessionToken}}:{},maxAttempts:3,requestHandler:new aa({requestTimeout:3e4,connectionTimeout:1e4})}));return n}function RAe(e,t){let r;try{r=_r.loadConfig(t)}catch(a){return be(`fjall-config.json could not be loaded: ${k(a)} \u2014 declared delegated children are unknown, so zone classification is account-local only`,{scope:ce.domainSync}),[]}if(r.isContentUnavailable()){let a=r.getConfigPath()??"fjall-config.json";return be(`fjall-config.json at ${a} exists but could not be read or its recognised keys are malformed \u2014 declared delegated children are unknown, so zone classification is account-local only`,{scope:ce.domainSync}),[]}let n=xr(e);return r.getDomains().filter(a=>a.type==="delegated"&&a.parentDomain!==void 0&&xr(a.parentDomain)===n).map(a=>({zoneName:xr(a.name),...a.account!==void 0?{accountId:a.account}:{},...a.region!==void 0?{region:a.region}:{}}))}async function RS(e){let{domainName:t,abortSignal:r,onPhase:n}=e,a=ze.getCurrent()??await ze.initialise(),o=a.getClient(byn),i=e.hostedZoneId??await OQ(o,t,r);if(i===void 0)return g(new Error(`domain sync: no Route53 hosted zone found for '${t}' in this account \u2014 deploy the domain stack first ('fjall domain deploy ${t}') or pass the zone id explicitly with --hosted-zone-id <id>`));let s=$I(t),c=s.success&&s.data!==void 0?s.data.cloudformationStackName:yn(t),l=RAe(t,e.configStartDir),u=await O7({zone:{hostedZoneId:i,zoneName:t},domainStackName:c,clients:{route53:o,cloudFormation:a.getClient(Eyn),acmByRegion:zZt(a,[a.getRegion(),wyn])},...l.length>0?{delegatedChildren:l,childAccountClientFactory:H3()}:{},...r!==void 0?{abortSignal:r}:{},...n!==void 0?{onPhase:n}:{}});return u.success?E(u.data):g(u.error)}var Syn,xQe,wyn,V1=w(()=>{"use strict";_m();at();$();Io();Dt();ae();le();or();_i();CQe();K3();pA();Syn=Object.defineProperty,xQe=(e,t)=>Syn(e,"name",{value:t,configurable:!0}),wyn="us-east-1";xQe(zZt,"buildAcmClients");xQe(RAe,"enumerateDelegatedChildren");xQe(RS,"classifyLiveZone")});import{existsSync as Tyn,readFileSync as xyn}from"fs";import{Route53Client as kyn,ListHostedZonesByNameCommand as Iyn,ChangeResourceRecordSetsCommand as Ryn}from"@aws-sdk/client-route-53";import{STSClient as _yn,AssumeRoleCommand as Pyn}from"@aws-sdk/client-sts";import{DescribeStacksCommand as Oyn}from"@aws-sdk/client-cloudformation";function qI(e){let t=ep(e);if(!Tyn(t))return g(new Error(`Domain '${e}': infrastructure.ts not found at ${t}. Import or create the domain first ('fjall domain create ${e}').`));let r;try{r=xyn(t,"utf-8")}catch(a){return g(new Error(`Domain '${e}': could not read ${t}: ${b(k(a))}`))}let n=AC(r,t,e);return n.success?E(n.data):g(new Error(b(n.error.message)))}function q3(e){let t=qI(e);return t.success?E(GN(t.data)):g(t.error)}function DQ(e,t){return new Wo(`Parent zone ${e}: its DelegationRole could not be resolved (${b(t)}). Nothing was deployed. Cures: run 'fjall connect' to add credentials for the parent account, run 'fjall domain deploy ${e}' to publish the delegation-role export, or set a literal parentDelegationRoleArn in the child's infrastructure.ts.`,"delegation_role_unusable",{parentZoneName:e})}async function kQe(e,t,r,n,a){let o=await n(t,r);if(!o.success)return g(o.error);let i=yn(e);try{let s=await o.data.cloudFormation.send(new Oyn({StackName:i}),a!==void 0?{abortSignal:a}:{}),c=new Map;for(let l of s.Stacks?.[0]?.Outputs??[])l.ExportName!==void 0&&l.OutputValue!==void 0&&c.set(l.ExportName,l.OutputValue);return E(c)}catch(s){return nf(s)?E(void 0):g(new Error(`DescribeStacks on '${i}' in account ${t} failed: ${b(k(s))}`))}}async function HZt(e,t,r,n){let a=n.clientFactory??H3(),o=await kQe(e,t,r,a,n.abortSignal);if(!o.success)return g(DQ(e,o.error.message));if(o.data===void 0)return g(DQ(e,`no deployed stack '${yn(e)}' in account ${t}`));let i=Fo(e).delegationRoleArn,s=o.data.get(i);return s===void 0||s===""?g(DQ(e,`stack '${yn(e)}' in account ${t} publishes no '${i}' export`)):E(s)}async function Y3(e,t={}){if(t.childDomainName!==void 0){let i=qI(t.childDomainName);if(i.success&&i.data.registrar==="external-delegated"&&i.data.parentDelegationRoleArn!==void 0&&i.data.parentDelegationRoleArn!=="")return E({managed:!0,delegationRoleArn:i.data.parentDelegationRoleArn,source:"literal"})}let r,n;try{let i=_r.loadConfig().getDomain(e);r=i?.account,n=i?.region}catch{}if(r!==void 0){let i;try{i=(ze.getCurrent()??await ze.initialise()).getAccountId()}catch(s){return g(DQ(e,`AWS authentication required: ${k(s)}`))}if(r!==i){let s=await HZt(e,r,n,t);return s.success?E({managed:!0,delegationRoleArn:s.data,source:"cross-account"}):g(s.error)}}let a=await La().resolveDomainForApp(e,t.abortSignal!==void 0?{abortSignal:t.abortSignal}:{});if(!a.success)return g(a.error);if(a.data===void 0)return E({managed:!1,source:"ambient"});let o=a.data.delegationRoleArn;return E({managed:!0,...o!==void 0&&o!==""?{delegationRoleArn:o}:{},source:"ambient"})}async function IQe(e,t={}){let r=Dh((d,p,m)=>({status:"unavailable",reason:b(d),cure:b(p),declaredChildren:m}),"unavailable"),n=La().resolveManagedDomainMatch(e);if(!n.success)return E(r(n.error.message,`fix fjall-config.json, then re-run 'fjall domain verify ${e}'`,[]));if(n.data?.matched!==e||!n.data.hasLocalDeclaration)return E(void 0);let a=qI(e);if(!a.success)return E(r(a.error.message,`fix ${ep(e)}, then re-run 'fjall domain verify ${e}'`,[]));let o,i;try{let d=_r.loadConfig(t.startDir);if(d.isContentUnavailable()){let m=d.getConfigPath()??"fjall-config.json";return E(r(`fjall-config.json at ${m} exists but could not be read or its recognised keys are malformed, so declared delegated children are unknown`,`fix ${m} (permissions or contents), then re-run 'fjall domain verify ${e}'`,[]))}let p=d.getDomain(e);o=p?.account,i=p?.region}catch(d){return E(r(`fjall-config.json could not be loaded: ${k(d)}`,`fix fjall-config.json, then re-run 'fjall domain verify ${e}'`,[]))}let s=RAe(e,t.startDir).map(d=>d.zoneName);if(s.length===0)return E(void 0);let c;if(o!==void 0){let d;try{d=(ze.getCurrent()??await ze.initialise()).getAccountId()}catch(p){return E(r(`AWS authentication required: ${k(p)}`,"run 'fjall connect' to include it",s))}c=o!==d?await kQe(e,o,i,t.clientFactory??H3(),t.abortSignal):await La().readDomainStackOutputs(e,{...t.abortSignal!==void 0?{abortSignal:t.abortSignal}:{}})}else c=await La().readDomainStackOutputs(e,{...t.abortSignal!==void 0?{abortSignal:t.abortSignal}:{}});if(!c.success)return E(r(c.error.message,"run 'fjall connect' to include it",s));if(c.data===void 0)return E(void 0);let l=Fo(e).delegationRoleArn,u=c.data.get(l);return E({status:u!==void 0&&u!==""?"published":"missing",declaredChildren:s})}function _Ae(){return async e=>{let t;try{t=ze.getCurrent()??await ze.initialise()}catch(r){return g(new Error(`AWS authentication required: ${b(k(r))}. Run 'fjall connect' and retry.`))}try{let r=(await t.getClient(_yn).send(new Pyn({RoleArn:e,RoleSessionName:"fjall-domain-delegation"}))).Credentials;return r?.AccessKeyId===void 0||r.SecretAccessKey===void 0?g(new Error(`AssumeRole on '${e}' returned no credentials \u2014 verify the role exists and trusts this account (it is created by the parent Domain stack).`)):E(new kyn({region:"us-east-1",credentials:{accessKeyId:r.AccessKeyId,secretAccessKey:r.SecretAccessKey,...r.SessionToken!==void 0?{sessionToken:r.SessionToken}:{}}}))}catch(r){return g(new Error(b(k(r))))}}}async function RQe(e){if(e.nameServers.length===0)return g(new Error(`Delegation for ${e.childZoneName}: the child zone reports no name servers \u2014 deploy the child zone first ('fjall domain deploy ${e.childZoneName}').`));let t=await(e.clientFactory??_Ae())(e.delegationRoleArn);if(!t.success)return g(new Error(`Delegation for ${e.childZoneName}: could not assume the parent DelegationRole ${e.delegationRoleArn}: ${b(k(t.error))}. Cure: verify the role exists and trusts this account, or add the NS records at the parent by hand.`));let r=t.data,n=e.abortSignal!==void 0?{abortSignal:e.abortSignal}:{},a;try{let o=((await r.send(new Iyn({DNSName:e.parentZoneName,MaxItems:100}),n)).HostedZones??[]).filter(i=>i.Name!==void 0&&xr(i.Name)===xr(e.parentZoneName));a=(o.find(i=>i.Config?.PrivateZone!==!0)??o[0])?.Id?.replace("/hostedzone/","")}catch(o){return g(new Error(`Delegation for ${e.childZoneName}: could not locate parent zone ${e.parentZoneName}: ${b(k(o))}`))}if(a===void 0)return g(new Error(`Delegation for ${e.childZoneName}: no hosted zone named '${e.parentZoneName}' is visible to the parent DelegationRole \u2014 verify the parent domain stack is deployed ('fjall domain deploy ${e.parentZoneName}').`));try{await r.send(new Ryn({HostedZoneId:a,ChangeBatch:{Comment:`fjall domain delegate: NS delegation for ${e.childZoneName}`,Changes:[{Action:"UPSERT",ResourceRecordSet:{Name:e.childZoneName,Type:"NS",TTL:Dyn,ResourceRecords:e.nameServers.map(o=>({Value:o}))}}]}}),n)}catch(o){return g(new Error(`Delegation for ${e.childZoneName}: the NS UPSERT into ${e.parentZoneName} failed: ${b(k(o))}`))}return E({parentHostedZoneId:a})}async function PAe(e,t,r={}){let n=await La().readDomainStackOutputs(e,r);return n.success?E(VN(n.data,t)):g(n.error)}function NQ(e,t={}){let r=q3(e);if(!r.success||r.data===void 0)return;let n=r.data;return{zoneName:n.childZoneName,async deployPhase(a,o){let i=await Y3(n.parentZoneName,{childDomainName:e,...t});if(!i.success)return g(i.error);if(!i.data.managed)be(`Parent zone ${n.parentZoneName} is not a managed domain here (Case 3) \u2014 no delegation record is written in-stack; delegate ${n.childZoneName} at the parent with 'fjall domain delegate ${e}' after the zone phase`,{scope:ce.domainDeploy});else if(i.data.source==="literal")o.onProgress?.({type:"info",message:`Using the literal parentDelegationRoleArn declared in ${e}'s infrastructure.ts for the ${n.parentZoneName} delegation`});else if(i.data.delegationRoleArn===void 0)return g(new Wo(`Parent domain stack for ${n.parentZoneName} publishes no delegation-role export - the child NS delegation for ${n.childZoneName} cannot be written in-stack. Nothing was deployed. Cures: run 'fjall connect' to add credentials for the parent account, run 'fjall domain deploy ${n.parentZoneName}' to publish the delegation-role export, or set a literal parentDelegationRoleArn in the child's infrastructure.ts.`,"delegation_role_unusable",{parentZoneName:n.parentZoneName}));let s=await La().deployDomain(e,{onProgress:Dh(c=>{o.onProgress?.({type:c.type,message:b(`[${n.childZoneName}] ${c.message??""}`)})},"onProgress")},{phase:a,...i.data.delegationRoleArn!==void 0&&i.data.source!=="literal"?{parentDelegationRoleArn:i.data.delegationRoleArn}:{}});if(!s.success)return g(new Error(s.error.message));if(a==="full"){let c=E0(e);c.success||be(`[${n.childZoneName}] deploy succeeded but recording deploy state failed: ${c.error.message} \u2014 the next cascade will re-deploy this domain`,{scope:ce.domainDeploy})}return E(void 0)},async zonePhaseState(){return PAe(e,n.childZoneName,t)}}}var Cyn,Dh,Dyn,W1=w(()=>{"use strict";at();ue();$();Io();Dt();or();ae();_i();CQe();hd();Le();Cr();pA();V1();Cyn=Object.defineProperty,Dh=(e,t)=>Cyn(e,"name",{value:t,configurable:!0}),Dyn=172800;Dh(qI,"parseDomainInfrastructure");Dh(q3,"readDelegatedTopology");Dh(DQ,"delegationRoleUnusable");Dh(kQe,"readForeignDomainStackOutputs");Dh(HZt,"resolveCrossAccountDelegationRole");Dh(Y3,"resolveParentDelegation");Dh(IQe,"auditParentDelegationRole");Dh(_Ae,"createDelegationRoute53ClientFactory");Dh(RQe,"upsertChildNsIntoParent");Dh(PAe,"readDelegatedZonePhaseState");Dh(NQ,"buildDelegatedDomainDeployer")});import{resolve as $yn}from"node:path";var Nyn,_Qe,OAe,KZt=w(()=>{"use strict";at();Io();$();Dt();or();Le();Cr();pA();xEe();W1();Nyn=Object.defineProperty,_Qe=(e,t)=>Nyn(e,"name",{value:t,configurable:!0}),OAe=class{static{_Qe(this,"CliDomainDeployProvider")}getDomains(){return _r.loadConfig().getDomains().map(t=>({name:t.name,type:t.type,...t.parentDomain!==void 0?{parentDomain:t.parentDomain}:{},...t.account!==void 0?{account:t.account}:{},...t.region!==void 0?{region:t.region}:{}}))}delegatedDeployer(t){return NQ(t)}async synthForTakeover(t,r){let n=await La().synthDomain(t,{onProgress:_Qe(a=>{r.onProgress?.({type:a.type,message:b(`[${t}] ${a.message??""}`)})},"onProgress")});return n.success?E({stackNames:[yn(t)],cdkOutPath:$yn(to(t),"cdk.out")}):g(new Error(n.error.message))}async deployDomain(t,r){let n=await La().deployDomain(t,{onProgress:_Qe(o=>{r.onProgress?.({type:o.type,message:b(`[${t}] ${o.message??""}`)})},"onProgress")});if(!n.success)return g(new Error(n.error.message));let a=E0(t);return a.success||be(`[${t}] deploy succeeded but recording deploy state failed: ${a.error.message} \u2014 the next cascade will re-deploy this domain`,{scope:ce.domainDeploy}),await MI([t],o=>{r.onProgress?.({type:"info",message:o})}),E(void 0)}}});function PQe(e,t){return{id:e,oidcRoleArn:t}}async function qZt(e){if(e.environment!==void 0)return Nw(e.environment)?E(e.environment):g(new na(`Invalid environment "${b(e.environment)}" \u2014 expected one of: ${yv()}`));let t=await e.onStandaloneEnvironmentRequired?.();return E(t??G1)}var Myn,$Q,Up,MQ,OQe=w(()=>{"use strict";Io();Le();vQe();he();$();xi();bQe();at();ae();Pr();HI();le();Mp();T1();W3();aA();md();Rn();UZt();KZt();pA();Myn=Object.defineProperty,$Q=(e,t)=>Myn(e,"name",{value:t,configurable:!0}),Up="OrgDeploy",MQ=class{static{$Q(this,"OrganisationDeployService")}state;setupService;adapter;constructor(t,r,n){this.state=t,this.setupService=r,this.adapter=n}async deploy(t,r={},n){let a=new da(void 0);try{let o=_r.loadConfig(),i=n,{providerAccounts:s,primaryRegion:c}=_Q(i),l=c,u=t.type===ar.ACCOUNT&&s.length===0;if(t.type===ar.ACCOUNT&&!u&&r.environment!==void 0)return g(new na("--environment applies only to a standalone account registration. This account is already registered with your organisation \u2014 its stage is managed in the org registry (fjall connect or the web app)."));let d=G1;if(u){let V=await qZt(r);if(!V.success)return V;d=V.data}let{platformAccount:p,memberAccounts:m}=Ip(s),f=m.length>0,y=p!==void 0,v={deploymentType:t.type,operation:"deploy",deployOnly:!1,infraOnly:!1,isManagedAccount:!1,hasDockerfile:!1,hasMemberAccounts:f,hasPlatformAccount:y},S=new z3(v,r),A=await V3(S,t);if(!A.success)return A;let C=await S.executeStep(ge.AUTH,async()=>{let V=await B3(this.state,t,o,r,i?.primaryRegion,i);return V.success?(l=V.data,{success:!0}):{success:!1,error:V.error.message}});if(!C.success)return g(new Xn(C.error??"Authentication failed",t.type,t.target,ge.AUTH));let T=KI(this.state),x=await a.recordStart({target:t.target,type:u?"infrastructure":"organisation",awsAccountId:T?.Account});if(x.blocked)return g(new Xn(mA(x),t.type,t.target,JX(x.refusal),x.details!==void 0?{blockedDeployment:x.details}:void 0));if(u){let V=rt.fromCredentials();if(V){let W=await wQe(V);if(W)return g(new Xn(W,t.type,t.target,"entitlement"))}}let R=0,I;if(t.type===ar.ORGANISATION){let V=await this.setupService.runOrganisationSetup(S,r,i);if(!V.success)return g(V.error);R=V.data.accountsCount,I=V.data.orgDetails?.managementAccountId;let W=await va().getOrgConfig({forceRefresh:!0});W.success?(i=GG(W.data,r.acknowledgeImmutableVaultLock)??W.data,P.info(Up,"Refreshed orgConfig after setup \u2014 cascade will use updated accounts",{accountCount:i.providerAccounts?.length??0})):P.warn(Up,"Failed to refresh orgConfig after setup \u2014 cascade uses pre-setup state",{error:b(W.error.message)});let{platformAccount:U,memberAccounts:J}=Ip(i?.providerAccounts??[]),te=VJe(o.getDomains());r.onChangeDetectionComplete?.({hasOrgChanges:!1,hasPlatformChanges:U!==void 0,hasAccountChanges:J.length>0,hasMemberAccounts:J.length>0,hasPlatformAccount:U!==void 0,hasDomainChanges:te.hasChanges,hasDomainConfiguration:te.hasConfiguration,changedDomainNames:te.deployable.filter(Y=>Y.verdict==="changed").map(Y=>Y.name),unprovableDomainNames:te.deployable.filter(Y=>Y.verdict==="unprovable").map(Y=>Y.name)})}let D=await G3(),O=await U3(t,{type:t.type,target:t.target,path:t.path,callerIdentity:KI(this.state),region:l,fjallOrgId:D,managementAccountId:I,...i&&{orgConfig:qo.serialise(i)}},{providerAccounts:i?i.providerAccounts??[]:void 0,mode:"deploy"});if(Vn(O))return g(O.error);if(!this.state.aws)return g(new Xn("AWS context not available after authentication",t.type,t.target,"deploy"));let N=r.onCascadeAccountComplete,M=r.onTrailLifecycleChanged,L={...r,onTrailLifecycleChanged:$Q((V,W,U)=>{if(M?.(V,W,U),!u){if(i?.providerAccounts?.some(J=>J.id===V)!==!0){P.warn(Up,`Trail lifecycle transition for account ${V} not persisted \u2014 account missing from local org-config snapshot; the next webapp-driven deploy or fjall run with a fresh org config will re-derive it`,{accountId:V,...W!==void 0&&{from:W},to:U});return}I0({providerAccounts:[{id:V,trailLifecycle:U}]},Up).catch(J=>{P.warn(Up,"Trail lifecycle persistence failed (non-critical)",{accountId:V,error:b(k(J))})})}},"onTrailLifecycleChanged"),onCascadeAccountComplete:$Q((V,W,U,J,te,Y)=>{if(N?.(V,W,U,J,te,Y),W&&te&&Y&&!u){let ne=te[TAe];ne&&I0({providerAccounts:[PQe(Y,ne)]},Up).catch(re=>{P.warn(Up,"Per-account registration failed (non-critical)",{accountId:Y,error:b(k(re))})})}},"onCascadeAccountComplete")},F=await this.adapter.deployOrganisation(t.target,process.cwd(),this.state.aws,L,i,a,D,new OAe);if(!F.success){let V=b(F.error.message);return await a.safeRecord(Up,"recordFailure",()=>a.recordFailure(V)),r.onProgress?.({type:"error",message:`Organisation deploy failed: ${V}`}),g(new Xn(V,t.type,t.target,"deploy"))}if(F.data.cancelled===!0)return await a.safeRecord(Up,"recordCancelled",()=>a.recordCancelled()),E({type:t.type,target:t.target,stackName:pn(t.type),region:l,cancelled:!0});if(F.data.destructionPending===!0)return await a.safeRecord(Up,"recordFailure",()=>a.recordFailure("Domain record takeover withheld pending named consent \u2014 the domains phase and member cascade were not applied")),E({type:t.type,target:t.target,stackName:pn(t.type),region:l,destructionPending:!0,...F.data.destructionTicket!==void 0?{destructionTicket:F.data.destructionTicket}:{},...F.data.destructionOutcome!==void 0?{destructionOutcome:F.data.destructionOutcome}:{},...F.data.destructionHaltReasons!==void 0?{destructionHaltReasons:F.data.destructionHaltReasons}:{}});if(!u){let V=F.data.outputs?.[TAe];if(V){let W=T?.Account;W&&await I0({providerAccounts:[PQe(W,V)]},Up)}}if(u)try{let V=T?.Account,W=rt.fromCredentials();if(V&&W){await AQe(W,V,t.target);let U=F.data.outputs?.[TAe];U&&(await I0({primaryRegion:l,rootOidcRoleArn:U,providerAccounts:[{id:V,name:t.target??"standalone",environment:d,oidcRoleArn:U}]},Up),r.onProgress?.({type:"info",message:"OIDC credentials configured \u2014 subsequent commands will use short-lived credentials"})),await EQe(W,process.cwd())}}catch(V){P.warn(Up,"Post-deploy registration failed (non-critical)",{error:b(k(V))})}await a.safeRecord(Up,"recordSuccess",()=>a.recordSuccess());let G={type:t.type,target:t.target,stackName:pn(t.type),region:l,...F.data.noChanges===!0?{noChanges:!0}:{},...R>0&&{accountsSync:{count:R,syncedAt:new Date}}};return E(G)}catch(o){return await a.safeRecord(Up,"recordFailure",()=>a.recordFailure(b(k(o)))),o instanceof Xn||o instanceof na||o instanceof Na||o instanceof nC?g(o):g(new Xn(b(k(o)),t.type,t.target,"deploy",o,!1,o instanceof Error?o:void 0))}}};$Q(PQe,"buildRegistrationEntry");$Q(qZt,"resolveStandaloneEnvironment")});var YZt=w(()=>{"use strict";at()});var Lyn,Fyn,LQ,DQe=w(()=>{"use strict";Io();Dt();or();Le();xi();bQe();at();ae();Pr();HI();vQe();md();YZt();le();he();$();Mp();T1();W3();Lyn=Object.defineProperty,Fyn=(e,t)=>Lyn(e,"name",{value:t,configurable:!0}),LQ=class{static{Fyn(this,"OrganisationDestroyService")}state;adapter;constructor(t,r){this.state=t,this.adapter=r}async destroy(t,r={},n){let a=new da(void 0);try{let o=_r.loadConfig(),i=un(),{providerAccounts:s,primaryRegion:c}=_Q(n),l=c,{platformAccount:u,memberAccounts:d}=Ip(s),p=d.length>0,m=u!==void 0,f={deploymentType:t.type,operation:"destroy",deployOnly:!1,infraOnly:!1,isManagedAccount:!1,hasDockerfile:!1,hasMemberAccounts:p,hasPlatformAccount:m},y=new z3(f,r),v=await V3(y,t);if(!v.success)return v;let S=await y.executeStep(ge.AUTH,async()=>{let N=await B3(this.state,t,o,r,n?.primaryRegion,n);return N.success?(l=N.data,{success:!0}):{success:!1,error:N.error.message}});if(!S.success)return g(new Xn(S.error??"Authentication failed",t.type,t.target,ge.AUTH));let A=KI(this.state),C=await a.recordStart({target:t.target,type:"infrastructure",awsAccountId:A?.Account,operation:"destroy"});if(C.blocked)return g(new Xn(mA(C),t.type,t.target,JX(C.refusal),C.details!==void 0?{blockedDeployment:C.details}:void 0));let T,x=await y.executeStep(ge.CFN_CHECK,async()=>{if(t.type===ar.ORGANISATION){let M=await z1().ensureOrganisationExists({onProgress:r.onProgress});M.success?T={orgId:M.data.orgId,rootId:M.data.rootId,managementAccountId:M.data.managementAccountId}:(P.warn("OrganisationDestroy","Failed to fetch org details for destroy context",{error:b(M.error.message)}),be(`Could not fetch organisation details: ${M.error.message} \u2014 destroy will proceed without full context`,{scope:ce.deploy}))}let N=await i.checkCloudFormationState({deployType:t.type,target:t.target,path:t.path});return N.success?{success:!0,message:"Deployment target verified"}:{success:!1,error:N.error.message}});if(!x.success)return g(new Xn(String(x.error),t.type,t.target,ge.CFN_CHECK));let R={type:t.type,target:t.target,path:t.path,callerIdentity:KI(this.state),region:l,orgId:T?.orgId,rootId:T?.rootId,managementAccountId:T?.managementAccountId,fjallOrgId:await G3(),...n&&{orgConfig:qo.serialise(n)}},I=await U3(t,R,{providerAccounts:n?n.providerAccounts??[]:void 0,mode:"destroy"});if(Vn(I))return g(I.error);if(this.state.aws&&await this.state.aws.refreshIfNeeded(),!this.state.aws)return g(new Xn("AWS context not available after authentication",t.type,t.target,"destroy"));let D=await this.adapter.destroyOrganisation(t.target,process.cwd(),this.state.aws,r,n,a);if(!D.success){let N=b(D.error.message);return await a.safeRecord("OrganisationDestroy","recordFailure",()=>a.recordFailure(N)),r.onProgress?.({type:"error",message:`Organisation destroy failed: ${N}`}),g(new Xn(N,t.type,t.target,"destroy",void 0,!1,D.error))}if(D.data.cancelled===!0)return await a.safeRecord("OrganisationDestroy","recordCancelled",()=>a.recordCancelled()),E({type:t.type,target:t.target,stackName:pn(t.type),region:R.region,cancelled:!0});try{await SD(t.path)}catch(N){let M=b(k(N));P.warn("OrganisationDestroy","Failed to delete state file after successful destroy",{path:t.path,error:M}),be(`Failed to clean up state file: ${M}`,{scope:ce.deploy})}await a.safeRecord("OrganisationDestroy","recordSuccess",()=>a.recordSuccess());let O={type:t.type,target:t.target,stackName:pn(t.type),region:R.region};return E(O)}catch(o){return await a.safeRecord("OrganisationDestroy","recordFailure",()=>a.recordFailure(b(k(o)))),o instanceof Xn||o instanceof na||o instanceof nC?g(o):g(new Xn(b(k(o)),t.type,t.target,"destroy",o))}}}});import{OrganizationsClient as Byn}from"@aws-sdk/client-organizations";function JZt(e,t){let r=e?.providerAccounts??[],n=kAe(r),a=t??[...new Set(r.map(i=>Sv(i)).filter(i=>i!==wm.ROOT&&i!=="organisation"))],o=r.filter(i=>pr(i)!=="organisation").map(i=>({id:i.id,name:i.name,environment:Sv(i)}));return{accounts:[],platformAccountId:n,organisationalUnits:a,accountPlacements:o,skipIdentityCentre:!1,...e?.rootAccessManagement==="off"&&{skipRootAccessManagement:!0}}}function ZZt(e){let t=new Map;return{onPhaseStart:_0(r=>{let n=NQe[r];n&&e.onOrgSetupProgress?.({type:n,phase:"started"})},"onPhaseStart"),onPhaseComplete:_0((r,n)=>{let a=NQe[r];if(a){let o=n==="completed"?"complete":n==="skipped"?"skipped":"error",i=t.get(r);e.onOrgSetupProgress?.({type:a,phase:o,...i!==void 0&&{detail:i}})}},"onPhaseComplete"),onProgress:_0(r=>{e.onProgress?.({type:"info",message:b(r)})},"onProgress"),onWarning:_0((r,n)=>{t.set(r,b(n)),be(n,{scope:ce.deploy})},"onWarning"),onError:_0((r,n)=>{let a=NQe[r];a&&e.onOrgSetupProgress?.({type:a,phase:"error",message:b(n.message)})},"onError")}}var jyn,_0,NQe,FQ,$Qe=w(()=>{"use strict";at();Dt();or();Le();at();W3();$();xi();ki();ae();HI();le();at();jyn=Object.defineProperty,_0=(e,t)=>jyn(e,"name",{value:t,configurable:!0});_0(JZt,"buildOrgSetupConfig");NQe={"create-organisation":"org-ensure","enable-policies":"policy-types","enable-service-access":"service-access","enable-root-access":"root-access","enable-ram-sharing":"ram-sharing","activate-trusted-access":"trusted-access","enable-ipam":"ipam-delegate","configure-backup":"backup-settings","create-accounts":"create-accounts","create-organisational-units":"ensure-ous","place-accounts":"place-accounts","activate-cost-tags":"cost-tags","check-identity-centre":"identity-centre","register-security-delegates":"security-delegates"};_0(ZZt,"buildOrgSetupCallbacks");FQ=class{static{_0(this,"OrganisationSetupService")}state;constructor(t){this.state=t}async runOrganisationSetup(t,r,n){let a=MQe(),o,i=0,s=await t.executeStep(ge.ORG_SETUP,async()=>{let c=this.buildAwsProvider();if(!c.success)return{success:!1,error:c.error.message};let l=await l0(process.cwd()),u=l.success&&l.data?dG(l.data):void 0,d=JZt(n,u),p=ZZt(r),m=c.data,f=m.getClient(Byn),y=await mE(f);if(!y.success)return r.onOrgSetupProgress?.({type:"org-ensure",phase:"error",message:b(y.error.message)}),{success:!1,error:y.error.message};o={orgId:y.data.orgId,rootId:y.data.rootId,managementAccountId:y.data.managementAccountId};let v=await bZ(m,d,p);if(!v.success)return{success:!1,error:v.error.message};let S=v.data;S.errors.length>0&&be(`Organisation setup phase errors: ${S.errors.map(x=>`${x.phase}: ${x.error}`).join("; ")}`,{scope:ce.deploy}),r.onOrgSetupProgress?.({type:"accounts",phase:"started"});let{onProgress:A}=r,C=await a.syncOrganisationAccounts({onProgress:A?x=>A({...x,message:b(x.message)}):void 0,onAccountsRetrieved:_0(x=>r.onAccountSync?.(`Retrieved ${x} accounts`,[]),"onAccountsRetrieved")});if(C.success)i=C.data.accounts.length,C.data.accounts.length>0&&await I0({providerAccounts:C.data.accounts},"OrgSetup");else{if(!C.error.recoverable)return r.onOrgSetupProgress?.({type:"accounts",phase:"error",message:b(C.error.message)}),{success:!1,error:C.error.message};be(`Account sync failed (recoverable): ${C.error.message}`,{scope:ce.deploy})}let T=C.success?i>0?`Synchronised ${i} accounts`:"Accounts synchronised":"Account sync skipped (will retry on next deploy)";return r.onOrgSetupProgress?.({type:"accounts",phase:"complete",detail:T}),r.onIdentityCentreCheck?.("Identity Centre checked",S.identityCentreStatus==="enabled"),{success:!0,message:"Organisation setup complete"}});if(!s.success){let c="error"in s?b(k(s.error)):"Organisation setup failed";return g(new Xn(c,ar.ORGANISATION,void 0,"orgSetup"))}return E({orgDetails:o,accountsCount:i})}buildAwsProvider(){let t=this.state.aws?.getCredentials();if(!t?.accessKeyId||!t?.secretAccessKey)return g(new Xn("AWS credentials not available. Ensure authentication is complete.",ar.ORGANISATION,void 0,"orgSetup"));let r=this.state.aws?.getRegion()??At,n=this.state.aws?.getAuthResult()?.account;return n?E(new bi({accessKeyId:t.accessKeyId,secretAccessKey:t.secretAccessKey,sessionToken:t.sessionToken,region:r,accountId:n})):g(new Xn("AWS account ID not available. Ensure authentication completed successfully.",ar.ORGANISATION,void 0,"orgSetup"))}}});var Uyn,XZt,H1,J3,LQe=w(()=>{"use strict";Le();$();ae();Pr();Uyn=Object.defineProperty,XZt=(e,t)=>Uyn(e,"name",{value:t,configurable:!0}),H1=class extends Ke{static{XZt(this,"EcsDeploymentError")}appName;operation;constructor(t,r,n,a,o){super("ECS_DEPLOYMENT_ERROR",t,a,o??!1),this.appName=r,this.operation=n}},J3=class{static{XZt(this,"EcsDeploymentService")}async deployStacksWithBuildInParallel(t,r,n,a,o){let i=FQe(),s=a(t,n,{onOutput:o?.onOutput?(y,v)=>o.onOutput?.(y,v):void 0,onResourceProgress:o?.onResourceProgress}),c=Date.now(),l=i.build({appPath:r.appPath,configPath:r.configPath,env:r.env},{onProgress:o?.onBuildProgress?y=>o.onBuildProgress?.(y.message):void 0,onBuildOutput:o?.onBuildOutput}),[u,d]=await Promise.allSettled([s,l]);if(u.status==="rejected")return g(new H1(`Parallel stack deployment failed: ${b(String(u.reason))}`,n.target,"parallel-deploy"));if(!u.value.success)return g(new H1(`Stack deployment failed: ${b(u.value.error.message)}`,n.target,"parallel-deploy"));let p=u.value.data,m=Date.now()-c,f=d.status==="fulfilled"?{success:d.value.success,error:d.value.success?void 0:d.value.error,duration:m,data:d.value.success?d.value.data:void 0}:{success:!1,error:d.reason instanceof Error?new Error(b(d.reason.message)):new Error(b(String(d.reason))),duration:m,data:void 0};return E({stackResults:p,buildResult:f})}}});import{CloudFormationClient as Vyn}from"@aws-sdk/client-cloudformation";import{EC2Client as Wyn}from"@aws-sdk/client-ec2";function DAe(e){switch(e.kind){case"missing-account-stack":return"account stack missing";case"missing-ipam-pool":return"IPAM pool missing"}}function nXt(e){let t=eXt.then(e,e);return eXt=t.then(()=>{},()=>{}),t}async function jQe(e){let t=ze.getCurrent(),r=new Map(uX.map(n=>[n,process.env[n]]));try{return await e()}finally{ze.getCurrent()!==t&&ze.clear();for(let n of uX){let a=r.get(n);a===void 0?delete process.env[n]:process.env[n]=a}}}function aXt(e,t){if(e.ssoSession===void 0)return!1;let r=t.ssoSessions?.[e.ssoSession];return r===void 0?!1:new qG().getToken(r.ssoStartUrl)!==null}async function oXt(e,t){try{let r=await Tu(e.name,void 0,async()=>E(t));if(!r.success){P.debug(jQ,"Readiness probe could not resolve a profile",{target:e.name,error:b(r.error.message)});return}let n=r.data;return n.type==="sso"&&!aXt(n,t)?void 0:(await ze.initialise({profileData:n,region:e.region})).getCredentials()}catch(r){P.debug(jQ,"Readiness probe credential resolution failed",{target:e.name,error:b(k(r))});return}}async function BQe(e,t,r){let n=await nXt(()=>oXt(e,t));if(n===void 0)return{state:"unknown",note:zyn};let a=AbortSignal.timeout(r);try{let o=await pD({cloudFormation:new Vyn({region:e.region,credentials:n}),ec2:new Wyn({region:Eh(t),credentials:n})},{id:e.accountId,name:e.accountName},e.region,t,a);return o.success?o.data.ready?{state:"ready"}:{state:"unready",reasons:o.data.reasons,advisory:L9({accountId:e.accountId,accountName:e.accountName,region:e.region,reasons:o.data.reasons,providerAccounts:t.providerAccounts})}:a.aborted?(P.debug(jQ,"Readiness probe exceeded its budget",{target:e.name,budgetMs:r}),{state:"unknown",note:QZt}):{state:"unknown",note:b(o.error.message)}}catch(o){if(a.aborted)return P.debug(jQ,"Readiness probe exceeded its budget",{target:e.name,budgetMs:r}),{state:"unknown",note:QZt};let i=b(k(o));return P.debug(jQ,"Readiness probe failed (advisory only)",{target:e.name,error:i}),{state:"unknown",note:i}}}function K1(e,t,r=rXt){return jQe(()=>BQe(e,t,r))}function BQ(e,t){return jQe(async()=>{let r=await hv(e,tXt,a=>BQe(a,t,rXt)),n=new Map;return r.forEach((a,o)=>{let i=e[o];i&&n.set(i.name,a.status==="fulfilled"?a.value:{state:"unknown",note:b(a.reason instanceof Error?a.reason.message:String(a.reason))})}),n})}var Gyn,YI,jQ,zyn,QZt,tXt,rXt,eXt,iXt=w(()=>{"use strict";at();$();gd();jYe();a7e();ae();le();he();UX();Gyn=Object.defineProperty,YI=(e,t)=>Gyn(e,"name",{value:t,configurable:!0}),jQ="TargetReadinessProbe",zyn="no AWS session",QZt="readiness probe timed out",tXt=4,rXt=15e3;YI(DAe,"shortReadinessReason");eXt=Promise.resolve();YI(nXt,"withSerialisedCredentialResolution");YI(jQe,"withRestoredAwsContext");YI(aXt,"hasCachedSsoToken");YI(oXt,"resolveProbeCredentials");YI(BQe,"probeTargetReadinessInner");YI(K1,"probeTargetReadiness");YI(BQ,"probeTargetsReadiness")});var Ml=w(()=>{"use strict";bZe();E1();DEe();LQe();pQe();aA();i1();UX();iXt();Mp()});var Hyn,Kyn,UQ,sXt=w(()=>{"use strict";W3();OQe();DQe();$Qe();Ml();OQe();DQe();$Qe();W3();HI();Hyn=Object.defineProperty,Kyn=(e,t)=>Hyn(e,"name",{value:t,configurable:!0}),UQ=class{static{Kyn(this,"OrganisationService")}state;deployService;destroyService;constructor(){this.state=new IQ;let t=new FQ(this.state),r=new $p;this.deployService=new MQ(this.state,t,r),this.destroyService=new LQ(this.state,r)}setAwsContext(t){this.state.setAwsContext(t)}async deploy(t,r={},n){return this.deployService.deploy(t,r,n)}async destroy(t,r={},n){return this.destroyService.destroy(t,r,n)}}});import{OrganizationsClient as Jyn,DescribeAccountCommand as Zyn,DescribeOrganizationCommand as Xyn,CreateOrganizationCommand as Qyn,CreateOrganizationalUnitCommand as evn,MoveAccountCommand as tvn,ListRootsCommand as rvn,ListOrganizationalUnitsForParentCommand as cXt,ListParentsCommand as nvn,EnablePolicyTypeCommand as avn,EnableAWSServiceAccessCommand as ovn}from"@aws-sdk/client-organizations";var qyn,Yyn,lXt,NAe,uXt=w(()=>{"use strict";at();qyn=Object.defineProperty,Yyn=(e,t)=>qyn(e,"name",{value:t,configurable:!0}),lXt="AWSOrganizationsNotInUseException",NAe=class{static{Yyn(this,"Organisations")}awsContext;client;constructor(t){this.awsContext=t,this.client=this.awsContext.getClient(Jyn)}async listAccounts(){let t=await dh(this.client);if(!t.success)throw t.error;return t.data}async findAccount(t){let r=await cU(this.client,t);if(!r.success)throw r.error;return r.data}async describeAccount(t){try{let r=await this.client.send(new Zyn({AccountId:t}));if(!r.Account)throw new Error(`Account ${t} not found`);return r.Account}catch(r){let n=kt(r);throw n==="AccessDeniedException"?new Error(`Access denied when describing account ${t}. Ensure your credentials have organizations:DescribeAccount permission.`,{cause:r}):n==="AccountNotFoundException"?new Error(`Account with ID ${t} not found in your organisation.`,{cause:r}):n===lXt?new Error("AWS Organisations is not enabled for this account",{cause:r}):r}}async getRootAccountName(t){let r=await this.describeAccount(t);if(!r.Name)throw new Error(`No name found for account ${t}`);return r.Name}async createAccount(t,r){let n=await bk(this.client,t,r);if(!n.success)throw n.error;return n.data}async moveAccount(t,r,n){try{await this.client.send(new tvn({AccountId:t,SourceParentId:r,DestinationParentId:n}))}catch(a){throw kt(a)==="AccountNotFoundException"?new Error(`Account ${t} not found when attempting to move.`,{cause:a}):a}}async listRoots(){return(await this.client.send(new rvn({}))).Roots??[]}async listOrganisationalUnits(t){let r=await this.client.send(new cXt({ParentId:t})),n=r.OrganizationalUnits??[],a=r.NextToken;for(;a;){let o=await this.client.send(new cXt({ParentId:t,NextToken:a}));n=n.concat(o.OrganizationalUnits??[]),a=o.NextToken}return n}async createOrganisationalUnit(t,r){let n=(await this.listOrganisationalUnits(r)).find(o=>o.Name===t);if(n)return n;let a=await this.client.send(new evn({Name:t,ParentId:r}));if(!a.OrganizationalUnit)throw new Error(`CreateOrganizationalUnit for "${t}" did not return an OU`);return a.OrganizationalUnit}async listParents(t){try{return(await this.client.send(new nvn({ChildId:t}))).Parents?.[0]?.Id}catch(r){if(kt(r)==="ChildNotFoundException")return;throw r}}async enablePolicyType(t,r){try{await this.client.send(new avn({RootId:t,PolicyType:r}))}catch(n){if(kt(n)==="PolicyTypeAlreadyEnabledException")return;throw n}}async describeOrganisation(){try{return(await this.client.send(new Xyn({}))).Organization??null}catch(t){if(kt(t)===lXt)return null;throw t}}async createOrganisation(t="ALL"){try{let r=await this.client.send(new Qyn({FeatureSet:t}));if(!r.Organization)throw new Error("CreateOrganization did not return an Organization");return r.Organization}catch(r){if(kt(r)==="AlreadyInOrganizationException"){let n=await this.describeOrganisation();if(!n)throw new Error("Account is already in an organisation but DescribeOrganization returned nothing",{cause:r});return n}throw r}}async enableAWSServiceAccess(t){try{await this.client.send(new ovn({ServicePrincipal:t}))}catch(r){throw kt(r)==="AccessDeniedException"?new Error(`Access denied when enabling service access for ${t}. Ensure your credentials have organizations:EnableAWSServiceAccess permission.`,{cause:r}):r}}}});async function $Ae(e,t){try{let r=e??await ze.initialise(),n=t??new NAe(r);return E({awsContext:r,organisations:n})}catch(r){return g(new Na(`Failed to initialise AWS dependencies: ${b(k(r))}`,"AwsContext","initialise",void 0,{originalError:r},!1))}}var ivn,dXt,Z3,MAe=w(()=>{"use strict";gd();uXt();ae();Pr();le();$();ivn=Object.defineProperty,dXt=(e,t)=>ivn(e,"name",{value:t,configurable:!0});dXt($Ae,"initialiseOrgAwsDependencies");Z3=class{static{dXt(this,"OrgAwsBase")}organisations=null;awsContext=null;async initialiseAwsDependencies(){let t=await $Ae(this.awsContext,this.organisations);return t.success&&(this.awsContext=t.data.awsContext,this.organisations=t.data.organisations),t}}});import{CostExplorerClient as pXt,ListCostAllocationTagsCommand as lvn,GetDimensionValuesCommand as uvn}from"@aws-sdk/client-cost-explorer";var svn,cvn,LAe,mXt=w(()=>{"use strict";ae();$();Pr();le();he();hd();pi();MAe();svn=Object.defineProperty,cvn=(e,t)=>svn(e,"name",{value:t,configurable:!0}),LAe=class{static{cvn(this,"CostAllocationService")}getAwsContext;setAwsContext;getOrganisations;setOrganisations;constructor(t,r,n,a){this.getAwsContext=t,this.setAwsContext=r,this.getOrganisations=n,this.setOrganisations=a}async initialiseAwsDependencies(){let t=await $Ae(this.getAwsContext(),this.getOrganisations());return t.success&&(this.setAwsContext(t.data.awsContext),this.setOrganisations(t.data.organisations)),t}async retrieveCostAllocationTags(t){let r=new Nt(t);try{r.info("Checking Cost Explorer status...");let n=await this.isAWSCostExplorerEnabled();if(Vn(n))return g(n.error);if(!n.data)return r.info("Cost Explorer is not enabled"),E({enabled:!1,hasTags:!1,tags:[],retrievedAt:new Date});r.info("Retrieving cost allocation tags...");let a=await this.initialiseAwsDependencies();if(Vn(a))return g(a.error);let{awsContext:o}=a.data,i=((await o.getClient(pXt).send(new lvn({MaxResults:1e3}))).CostAllocationTags||[]).filter(s=>s.TagKey?s.Type==="AWSGenerated"?!0:!s.TagKey.startsWith("aws:"):!1).map(s=>({TagKey:s.TagKey||"",Status:s.Status||"Unknown"}));return i.length>0?(r.info(`Retrieved ${i.length} cost allocation tags`),t?.onCostTagsRetrieved?.(i)):r.info("No cost allocation tags configured"),E({enabled:!0,hasTags:i.length>0,tags:i,retrievedAt:new Date})}catch(n){let a=rn(n);return t?.onError?.(a),g(new Na(`Failed to retrieve cost allocation tags: ${b(a.message)}`,"CostExplorer","listCostAllocationTags",void 0,{originalError:n},!1))}}async isAWSCostExplorerEnabled(){try{let t=await this.initialiseAwsDependencies();if(Vn(t))return g(t.error);let{awsContext:r}=t.data,n=r.getClient(pXt),a={TimePeriod:{Start:this.getDateXDaysAgo(30),End:this.getFormattedDate(new Date)},Dimension:"SERVICE"};return await n.send(new uvn(a)),E(!0)}catch(t){return JYe(t)?E(!0):(P.debug("AwsAccount","Cost Explorer check failed",{error:t instanceof Error?t.message:String(t)}),E(!1))}}getDateXDaysAgo(t){let r=new Date;return r.setDate(r.getDate()-t),this.getFormattedDate(r)}getFormattedDate(t){return t.toISOString().slice(0,10)}}});var dvn,pvn,fXt,GQ,hXt=w(()=>{"use strict";$();Dt();or();pi();ae();Pr();le();$();at();MAe();mXt();dvn=Object.defineProperty,pvn=(e,t)=>dvn(e,"name",{value:t,configurable:!0}),fXt="providerAccounts",GQ=class extends Z3{static{pvn(this,"AwsAccountService")}cachedOrgConfig;costAllocation;constructor(){super(),this.costAllocation=new LAe(()=>this.awsContext,t=>{this.awsContext=t},()=>this.organisations,t=>{this.organisations=t})}setOrgConfig(t){this.cachedOrgConfig=t}buildProviderAccountsFromConfig(t,r,n){let a=[],o=[],i=new Map,s=mI(t),c=r.filter(l=>!l.Id||!l.Name);c.length>0&&be(`${c.length} AWS Organizations account(s) came back without an Id or Name and cannot be mapped: ${c.map(l=>l.Id??l.Name??"<unidentified>").join(", ")}`,{scope:ce.deploy});for(let{accountName:l,environment:u}of s){let d=r.find(m=>m.Name?.toLowerCase()===l.toLowerCase());if(!d?.Id){o.push(l),n?.onDebug?.(`Account "${l}" defined in ACCOUNTS but not found in AWS Organizations`);continue}let p=Nw(u)||u===wm.ROOT;if(!p&&!HJ(u)){let m=i.get(u)??[];m.push(l),i.set(u,m)}a.push({id:d.Id,name:l.toLowerCase(),environment:p?u:null})}for(let[l,u]of i)be(`ACCOUNTS key "${l}" is not a recognised workload stage; ${u.map(d=>`"${d}"`).join(", ")} will sync without a stage label. Valid stages: ${Cm.join(", ")}. Edit fjall/organisation/infrastructure.ts if a stage was intended.`,{scope:ce.deploy});return o.length>0?g(new tp(`${o.length} account(s) defined in ACCOUNTS were not found in AWS Organizations: ${o.join(", ")}`,"validation_error")):E(a)}async syncOrganisationAccounts(t){let r=new Nt(t);try{r.info("Retrieving AWS account information...");let n=await this.initialiseAwsDependencies();if(Vn(n))return g(n.error);let{organisations:a,awsContext:o}=n.data,i=await a.listAccounts(),s=await l0(process.cwd());if(Vn(s)){let p=b(s.error.message);return t?.onDebug?.(`Failed to parse accounts configuration: ${p}`),be(`Could not read ACCOUNTS configuration \u2014 no accounts were mapped: ${s.error.message}`,{scope:ce.deploy}),E({accounts:[],syncedAt:new Date})}let c=s.data;if(!c)return r.info("No ACCOUNTS configuration found, skipping account mapping"),E({accounts:[],syncedAt:new Date});let l=this.buildProviderAccountsFromConfig(c,i,t);if(Vn(l)){let p=b(l.error.message);return g(new Na(`Failed to build provider accounts: ${p}`,"Organisations","buildProviderAccounts",void 0,{originalError:l.error},!1))}let u=l.data,d=o.getAuthResult();if(d?.success&&d.account){let p;try{p=(await a.describeOrganisation())?.MasterAccountId}catch(m){t?.onDebug?.(`Could not verify management account via DescribeOrganization: ${b(rn(m).message)}`)}if(p!==d.account)t?.onDebug?.("Authenticated account is not the organisation's management account; skipping organisation-tier stamp");else{let m=u.find(f=>f.id===d.account);if(m&&pr(m)!=="organisation")m.tier="organisation",m.environment=null;else if(!m){let f=i.find(y=>y.Id===d.account);f?.Id?u.push({id:f.Id,name:f.Name?.toLowerCase()||wm.ROOT,tier:"organisation",environment:null}):t?.onDebug?.("Could not find root account in AWS accounts list")}}}else t?.onDebug?.("No valid auth result or account ID available for root account detection");return r.info(`Mapped ${u.length} accounts from ACCOUNTS configuration`),t?.onAccountsRetrieved?.(u.length),E({accounts:u,syncedAt:new Date})}catch(n){let a=rn(n),o=b(a.message);return t?.onError?.(new Error(o)),g(new Na(`Failed to sync organisation accounts: ${o}`,"Organisations","listAccounts",void 0,{originalError:n},!0))}}resolveProviderAccounts(t){return(t??this.cachedOrgConfig)?.providerAccounts??[]}getAccounts(t){return E(this.resolveProviderAccounts(t))}getAccountById(t,r){let n=this.resolveProviderAccounts(r).find(a=>a.id===t);return n?E(n):g(new tp(`Account not found: ${t}`,fXt,void 0,{accountId:t}))}getAccountByName(t,r){let n=this.resolveProviderAccounts(r).find(a=>a.name.toLowerCase()===t.toLowerCase());return n?E(n):g(new tp(`Account not found: ${t}`,fXt,void 0,{accountName:t}))}async retrieveCostAllocationTags(t){return this.costAllocation.retrieveCostAllocationTags(t)}}});import{join as P0,dirname as gXt}from"path";import{existsSync as AA,readFileSync as yXt,writeFileSync as hvn,mkdirSync as vXt,rmSync as gvn,renameSync as yvn,statSync as vvn,readdirSync as Svn,chmodSync as bvn}from"fs";var mvn,fvn,FAe,SXt=w(()=>{"use strict";mvn=Object.defineProperty,fvn=(e,t)=>mvn(e,"name",{value:t,configurable:!0}),FAe=class{static{fvn(this,"SimpleTree")}changes=new Map;root;constructor(t){this.root=t}read(t,r){let n=this.changes.get(t);if(n){if(n.type==="DELETE")return null;if(n.content!==void 0){let o=Buffer.from(n.content);return r?o.toString(r):o}}let a=P0(this.root,t);return AA(a)?r?yXt(a,r):yXt(a):null}write(t,r){let n=P0(this.root,t),a=AA(n),o=typeof r=="string"?r:r.toString("utf-8");this.changes.set(t,{type:a?"UPDATE":"CREATE",path:t,content:o})}exists(t){let r=this.changes.get(t);return r?r.type!=="DELETE":AA(P0(this.root,t))}delete(t){this.changes.set(t,{type:"DELETE",path:t,content:void 0})}rename(t,r){let n=P0(this.root,t),a=P0(this.root,r);if(!AA(n))return;let o=gXt(a);AA(o)||vXt(o,{recursive:!0}),yvn(n,a)}isFile(t){let r=P0(this.root,t);return AA(r)?vvn(r).isFile():!1}children(t){let r=P0(this.root,t);if(!AA(r))return[];try{return Svn(r)}catch{return[]}}listChanges(){return Array.from(this.changes.values()).map(t=>({path:t.path,type:t.type,content:t.content?Buffer.from(t.content):null}))}changePermissions(t,r){let n=P0(this.root,t);AA(n)&&bvn(n,r)}getSimpleChanges(){return Array.from(this.changes.values())}flushChanges(){for(let t of this.changes.values()){let r=t.path.startsWith("/")?t.path:P0(this.root,t.path);if(t.type==="DELETE"){AA(r)&&gvn(r,{recursive:!0,force:!0});continue}let n=gXt(r);AA(n)||vXt(n,{recursive:!0}),t.content!==void 0&&hvn(r,t.content,"utf-8")}}}});function UQe(e){let t={appName:e.app??e.appName,nameProvidedByFlag:e.nameProvidedByFlag??!1};if(e.resourceType==="database")return{...t,resourceName:e.resourceName,databaseName:e.databaseName||e.resourceName,databaseType:e.variant||e.databaseType||"Aurora"};if(e.resourceType==="compute"||typeof e.resourceType=="string"&&e.resourceType.startsWith("compute:")){let r=e.variant||e.subtype||"lambda";if(r==="lambda")return{...t,functionName:e.resourceName,lambdaType:e.lambdaType||"basic"};if(r==="ecs")return{...t,serviceName:e.resourceName,capacityProvider:e.capacityProvider||"FARGATE"};if(r==="ec2")return{...t,instanceName:e.resourceName,instanceType:e.instanceType||"t4g.micro"}}return e.resourceType==="service"?{...t,clusterName:e.clusterName||e.resourceName,serviceName:e.serviceName||e.resourceName,capacityProvider:e.capacityProvider||"FARGATE",...e.containerPort!==void 0&&{containerPort:e.containerPort},...e.instanceType!==void 0&&{ec2Config:{instanceType:e.instanceType}},...e.routingPath!==void 0&&{routing:{path:e.routingPath}},...e.connectDatabase!==void 0&&{connectionConfig:{connectToDatabase:Array.isArray(e.connectDatabase)?e.connectDatabase:[e.connectDatabase]}}}:e.resourceType==="proxy"?{...t,databaseName:e.databaseName||e.resourceName,...e.maxConnections!==void 0&&{maxConnections:e.maxConnections},...e.maxIdleConnections!==void 0&&{maxIdleConnections:e.maxIdleConnections},...e.connectionBorrowTimeout!==void 0&&{connectionBorrowTimeout:e.connectionBorrowTimeout},...e.requireTLS!==void 0&&{requireTLS:e.requireTLS}}:(P.debug("Generator",`No schema transformation for resource type: ${String(e.resourceType)}`),e)}var Evn,Avn,bXt=w(()=>{"use strict";he();Evn=Object.defineProperty,Avn=(e,t)=>Evn(e,"name",{value:t,configurable:!0});Avn(UQe,"buildResourceSchema")});import{resolve as EXt,sep as Cvn}from"path";function X3(e){return typeof e=="object"&&e!==null&&!Array.isArray(e)}function VQ(e,t,r){let n=EXt(e,...t,"generator.js"),a=EXt(e);return n!==a&&!n.startsWith(a+Cvn)?g(new fc("Invalid generator path: resolved path escapes generators directory","generation_failed",r,"getGeneratorPath")):E(n)}function GQe(e,t,r){let n=AXt[t];if(n)return VQ(e,[n.path],t);if(t==="compute"&&r)return VQ(e,["compute",r],t);if(t.startsWith("compute:")){let a=t.split(":")[1];return a?VQ(e,["compute",a],t):g(new fc(`Invalid compute generator type: ${t} (missing subtype after ":")`,"generation_failed",t,"getGeneratorPath"))}return["lambda","ecs","ec2"].includes(t)?VQ(e,["compute",t],t):g(new fc(`No generator found for type: ${t}, subtype: ${r}`,"generation_failed",t,"getGeneratorPath"))}function VQe(e){let t=AXt[e];if(t?.schema&&t.label)return{schema:t.schema,label:t.label};if(e.startsWith("compute:")||["lambda","ecs","ec2"].includes(e))return{schema:_Be,label:"compute"}}var wvn,jAe,AXt,WQe=w(()=>{"use strict";ue();ae();BAe();wvn=Object.defineProperty,jAe=(e,t)=>wvn(e,"name",{value:t,configurable:!0}),AXt={database:{path:"database",schema:S2,label:"database"},"database:database":{path:"database",schema:S2,label:"database"},"storage:s3":{path:"storage/s3",schema:bO,label:"S3"},network:{path:"network",schema:npe,label:"network"},"network:network":{path:"network",schema:npe,label:"network"},service:{path:"compute/service",schema:x2,label:"service"},"compute:service":{path:"compute/service",schema:x2,label:"service"},proxy:{path:"database/proxy",schema:Yx,label:"proxy"},"database:proxy":{path:"database/proxy",schema:Yx,label:"proxy"},tunnel:{path:"tunnel",schema:U5,label:"tunnel"},domain:{path:"domain"},account:{path:"account"},application:{path:"application"},organisation:{path:"organisation"},cdn:{path:"cdn"},"cdn:cdn":{path:"cdn"}};jAe(X3,"isRecord");jAe(VQ,"resolveAndGuardPath");jAe(GQe,"resolveGeneratorPath");jAe(VQe,"getValidationSchemaForType")});import{existsSync as xvn}from"fs";import{join as wXt}from"path";function CXt(e){return typeof e=="function"}function TXt(e,t){let r=new Set(e.getSimpleChanges().map(n=>n.path));for(let[n,a]of t){if(!r.has(n)){let o=[...r].slice(0,5).join(", "),i=r.size>5?"\u2026":"";return g(`--file-override path "${n}" was not in the planned scaffold tree (allowed paths: ${o}${i})`)}e.write(n,a)}return E(void 0)}var Tvn,UAe,JI,kvn,Ivn,fc,WQ,BAe=w(()=>{"use strict";SXt();he();ae();Pr();le();bXt();$();WQe();Tvn=Object.defineProperty,UAe=(e,t)=>Tvn(e,"name",{value:t,configurable:!0}),JI="infrastructure",kvn=import.meta.dirname,Ivn=(()=>{let e;return()=>{if(e)return e;let t=process.env.FJALL_ASSETS_DIR;return e=t!==void 0&&t!==""?wXt(t,"generators"):wXt(kvn,"..","..","..","generators"),e}})();UAe(CXt,"isCallableGenerator");UAe(TXt,"applyFileOverrides");fc=class extends Ke{static{UAe(this,"GeneratorError")}errorType;generatorType;operation;constructor(t,r,n,a,o,i=!1){super("GENERATOR_ERROR",t,o,i),this.errorType=r,this.generatorType=n,this.operation=a}},WQ=class{static{UAe(this,"GeneratorService")}introspection;constructor(t){this.introspection=t}async getResourcePlan(t){return this.introspection.getResourcePlan(t)}async getComputeResources(t){return this.introspection.getComputeResources(t)}async getDatabaseResources(t){return this.introspection.getDatabaseResources(t)}async checkResourceExists(t,r){return this.introspection.checkResourceExists(t,r)}async checkDatabaseExists(t,r){return this.introspection.checkDatabaseExists(t,r)}async generateUniqueResourceName(t,r,n){return this.introspection.generateUniqueResourceName(t,r,n)}validateSchema(t,r){let n=VQe(t);if(!n)return P.debug("Generator",`No pre-validation for generator type: ${t}`),E(r);let a=n.schema.safeParse(r);if(!a.success){let o=`Invalid ${n.label} schema: ${Zf(a.error)}`;return P.debug("Generator",o),g(new fc(o,"parse_failed",n.label,"validateSchema"))}return E(a.data)}extractGeneratorFunction(t,r){if(!X3(t))return g(new fc("Generator module is not an object","generation_failed",void 0,"extractGeneratorFunction"));let n=t,a=r.indexOf(":"),o=a!==-1?r.slice(a+1)||void 0:r,i=o?`${o}Generator`:void 0,s=(i?n[i]:void 0)||n.generator||n.default;return!s||!CXt(s)?g(new fc("No valid generator function found in module","generation_failed",void 0,"extractGeneratorFunction")):E(s)}async runGenerator(t){let{type:r,subtype:n,schema:a,interactive:o=!1}=t;try{P.debug("Generator",`Running ${r} generator`);let i=this.validateSchema(r,a);if(!i.success)return g(i.error);let s=i.data,c=new FAe(t.rootDir??process.cwd()),l=Ivn(),u=GQe(l,r,n);if(!u.success)return g(u.error);let d=u.data;if(!xvn(d))return g(new fc(`Generator not found at: ${d}`,"generation_failed",r,"runGenerator"));let p=await import(d),m=this.extractGeneratorFunction(p,r);if(!m.success)return g(m.error);let f=m.data;if(await f(c,s),t.fileOverrides&&t.fileOverrides.size>0){let v=TXt(c,t.fileOverrides);if(!v.success)return g(new fc(v.error,"generation_failed",r,"runGenerator"))}let y=t.dryRun===!0;return!o&&!y&&c.flushChanges(),P.debug("Generator",`${r} generator completed successfully`),E({generatorType:r,message:`${r} generated successfully`,...y&&{pendingChanges:c.getSimpleChanges()}})}catch(i){let s=b(k(i));return P.error("Generator",`Generator failed: ${s}`),g(new fc(s,"generation_failed",r,"runGenerator",{originalError:i}))}}buildResourceSchema(t){return UQe(t)}}});import{existsSync as Pvn,readFileSync as Ovn}from"fs";import{join as Dvn}from"path";var Rvn,_vn,zQ,xXt=w(()=>{"use strict";ue();Cr();ae();BAe();le();$();Rvn=Object.defineProperty,_vn=(e,t)=>Rvn(e,"name",{value:t,configurable:!0}),zQ=class{static{_vn(this,"InfrastructureIntrospectionService")}readInfrastructureFile(t,r){let n=Ui(t),a=Dvn(process.cwd(),n);if(!Pvn(a))return g(new fc(`Infrastructure file not found for ${t} at ${a}`,"not_found",JI,r,{appName:t,fullPath:a}));try{return E(Ovn(a,"utf-8"))}catch(o){return g(new fc(`Failed to read infrastructure file for ${t}: ${b(k(o))}`,"read_failed",JI,r,{appName:t,fullPath:a,originalError:o}))}}async getResourcePlan(t){try{let r=this.readInfrastructureFile(t,"getResourcePlan");if(!r.success)return g(r.error);let n=Cl(r.data),a=Og(n,t);return E(a)}catch(r){return g(new fc(`Failed to get resource plan: ${b(k(r))}`,"parse_failed",JI,"getResourcePlan",{appName:t,originalError:r}))}}async getComputeResources(t){let r=await this.getResourcePlan(t);return r.success?E(r.data.compute||[]):g(r.error)}async getDatabaseResources(t){let r=await this.getResourcePlan(t);return r.success?E(r.data.database||[]):g(r.error)}async checkResourceExists(t,r){try{let n=await this.getResourcePlan(t);if(!n.success)return E(!1);let a=n.data,o=[...a.compute.map(i=>i.name),...a.database.map(i=>i.name),...a.s3.map(i=>i.name),...a.dynamodb?.map(i=>i.name)??[],...a.sqs?.map(i=>i.name)??[]];return E(o.includes(r))}catch(n){return g(new fc(`Failed to check resource existence: ${b(k(n))}`,"parse_failed",JI,"checkResourceExists",{appName:t,resourceName:r,originalError:n}))}}async checkDatabaseExists(t,r){try{let n=await this.getResourcePlan(t);return n.success?E(n.data.database.some(a=>a.databaseName===r)):E(!1)}catch(n){return g(new fc(`Failed to check database existence: ${b(k(n))}`,"parse_failed",JI,"checkDatabaseExists",{appName:t,databaseName:r,originalError:n}))}}async generateUniqueResourceName(t,r,n){try{let a=await this.getResourcePlan(t);if(!a.success)return g(a.error);let o=a.data,i=new Set(n==="database"?o.database.map(l=>l.databaseName):[...o.compute.map(l=>l.name),...o.database.map(l=>l.name),...o.s3.map(l=>l.name),...o.dynamodb?.map(l=>l.name)??[],...o.sqs?.map(l=>l.name)??[]]),s=r,c=1e3;for(let l=2;l<=c;l++){if(!i.has(s))return E(s);s=`${r}${l}`}return g(new fc(`Could not generate unique name for '${r}' after ${c} attempts`,"generation_failed",JI,"naming"))}catch(a){return g(new fc(`Failed to generate unique resource name: ${b(k(a))}`,"generation_failed",JI,"generateUniqueResourceName",{appName:t,baseName:r,resourceType:n,originalError:a}))}}}});import{existsSync as $vn,readFileSync as kXt}from"fs";import{join as IXt}from"path";function zQe(e,t){let r=IXt(e,"manifest.json");try{let n=JSON.parse(kXt(r,"utf-8"));if(typeof n!="object"||n===null||Array.isArray(n))return;let a=n;if(typeof a.artifacts!="object"||a.artifacts===null)return;let o=a.artifacts;if(typeof o[t]!="object"||o[t]===null)return;let i=o[t];if(!i.properties||typeof i.properties!="object")return;let s=i.properties;delete s.tags,delete s.cloudFormationExecutionRoleArn,delete s.assumeRoleArn;let c=s.templateFile;if(typeof c=="string"){let l=IXt(e,c);if($vn(l)){let u=JSON.parse(kXt(l,"utf-8"));if(typeof u=="object"&&u!==null&&!Array.isArray(u)){let d=u,p=typeof d.Parameters=="object"&&d.Parameters!==null?d.Parameters:void 0,m=typeof d.Rules=="object"&&d.Rules!==null?d.Rules:void 0;p?.BootstrapVersion&&delete p.BootstrapVersion,m?.CheckBootstrapVersion&&delete m.CheckBootstrapVersion,p&&Object.keys(p).length===0&&delete d.Parameters,m&&Object.keys(m).length===0&&delete d.Rules,xa(l,JSON.stringify(d,null,2))}}}xa(r,JSON.stringify(a,null,2)),P.debug("ImportService",`Patched manifest for import: stripped Tags/RoleArn from ${t}`)}catch(n){P.warn("ImportService","Failed to patch manifest for import",{error:b(k(n))})}}function HQ(e,t){try{xa(e,t),P.info("ImportService","Rolled back infrastructure file after failure")}catch(r){P.warn("ImportService","Failed to rollback infrastructure file",{error:b(k(r))})}}var Nvn,RXt,HQe=w(()=>{"use strict";So();le();he();$();Nvn=Object.defineProperty,RXt=(e,t)=>Nvn(e,"name",{value:t,configurable:!0});RXt(zQe,"patchManifestForImport");RXt(HQ,"rollbackInfrastructure")});var Mvn,Lvn,so,Q3=w(()=>{"use strict";Pr();Mvn=Object.defineProperty,Lvn=(e,t)=>Mvn(e,"name",{value:t,configurable:!0}),so=class extends Ke{static{Lvn(this,"ImportError")}constructor(t,r,n){super(r,t,n,!1),this.name="ImportError"}}});function _Xt(e){return $r(e)}function PXt(e){if(e?.Status){if(e.Status==="Enabled")return!0;if(e.Status==="Suspended")return!1}}function OXt(e){if(!e?.Rules||e.Rules.length===0)return;let t=e.Rules[0]?.ApplyServerSideEncryptionByDefault;if(t?.SSEAlgorithm){if(t.SSEAlgorithm==="aws:kms")return{encryption:"KMS",kmsKeyArn:t.KMSMasterKeyID};if(t.SSEAlgorithm==="AES256")return{encryption:"AES256"}}}function DXt(e){if(!e?.IndexDocument?.Suffix)return;let t={indexDocument:e.IndexDocument.Suffix};return e.ErrorDocument?.Key&&(t.errorDocument=e.ErrorDocument.Key),t}function NXt(e){if(!(!e?.CORSRules||e.CORSRules.length===0))return e.CORSRules.map(t=>{let r={allowedOrigins:t.AllowedOrigins??[],allowedMethods:t.AllowedMethods??[]};return t.AllowedHeaders&&t.AllowedHeaders.length>0&&(r.allowedHeaders=t.AllowedHeaders),t.ExposeHeaders&&t.ExposeHeaders.length>0&&(r.exposedHeaders=t.ExposeHeaders),t.MaxAgeSeconds!==void 0&&(r.maxAge=t.MaxAgeSeconds),r})}function $Xt(e,t){if(!(e&&(e.BlockPublicAcls||e.IgnorePublicAcls||e.BlockPublicPolicy||e.RestrictPublicBuckets))&&t?.IsPublic)return!0}function KQe(e){let t={name:_Xt(e.bucketName),bucketName:e.bucketName},r=PXt(e.versioning);r!==void 0&&(t.versioned=r);let n=OXt(e.encryption);n&&(t.encryption=n.encryption,n.kmsKeyArn&&(t.kmsKeyArn=n.kmsKeyArn));let a=DXt(e.website);a&&(t.websiteHosting=a);let o=NXt(e.cors);o&&o.length>0&&(t.cors=o);let i=$Xt(e.publicAccessBlock,e.policyStatus);return i&&(t.publicReadAccess=i),t}var Fvn,q1,MXt=w(()=>{"use strict";hA();Fvn=Object.defineProperty,q1=(e,t)=>Fvn(e,"name",{value:t,configurable:!0});q1(_Xt,"derivePascalCaseName");q1(PXt,"mapVersioning");q1(OXt,"mapEncryption");q1(DXt,"mapWebsiteHosting");q1(NXt,"mapCors");q1($Xt,"mapPublicAccess");q1(KQe,"mapS3Config")});function LXt(e){let t=FXt(e);return t?`app.addStorage(
+${b(s)}`,"read_failed",{dockerfilePath:t,fullPath:o,error:i},!1,"DOCKER_DOCKERFILE_NOT_FOUND"))}}async parseComposeFile(t){try{if(!await br(t))return E({services:[]});let r=await aZt(t,"utf8");if(r.trim()==="")return g(new Kc("Invalid docker-compose.yml format","parse_error",{composePath:t}));let n=eZt(r,{schema:BXe.withTags(FXe)});if(!iZt(n))return g(new Kc("Invalid docker-compose.yml format","parse_error",{composePath:t}));let a=n;if(!a?.services)return E({version:a?.version,services:[]});let o=[];for(let[i,s]of Object.entries(a.services)){if(!sZt(s))continue;let c=s,l,u;c.build&&(typeof c.build=="string"?(l=c.build,u="Dockerfile"):(l=c.build.context||".",u=c.build.dockerfile||"Dockerfile"));let d;if(c.ports){let p=c.ports[0];if(typeof p=="string"&&p.length>0){let m=p.split(":"),f=m[m.length-1];if(f){let y=parseInt(f,10);Number.isNaN(y)||(d=y)}}else typeof p=="object"&&(d=p.target)}o.push({name:i,...l!==void 0&&{buildContext:l},...u!==void 0&&{dockerfile:u},...c.image!==void 0&&{image:c.image},...d!==void 0&&{containerPort:d}})}return E({version:a.version,services:o})}catch(r){let n=k(r);return g(new Kc(`Failed to parse docker-compose.yml: ${b(n)}`,"parse_error",{path:t,error:r}))}}async parseInfrastructureFile(t){let r=await Ph().getDockerConfigs(t);if(!r.success)return P.debug("DockerConfigService","Manifest not found, returning null Docker config",{appPath:t,error:r.error.message}),E(null);let n=r.data;if(n.length===0)return E(null);let a=n.map(o=>({name:o.name,...o.docker!==void 0&&{docker:o.docker},...o.containerPort!==void 0&&{containerPort:o.containerPort}}));return E({services:a})}async getDockerConfig(t){let r=await this.parseInfrastructureFile(t);if(!r.success){let o=Ph().getManifestPath(t);return g(new Kc(`Fjall manifest not found at expected location: ${b(o)}. Run 'cdk synth' to generate the manifest.`,"parse_error",{manifestPath:o}))}if(!r.data)return g(new Kc("No Docker services configured in the Fjall manifest. Add at least one service with a Dockerfile to your infrastructure.","parse_error",{appPath:t}));let n=ign(t,nZt),a=await this.parseComposeFile(n);if(a.success&&a.data.services.length>0){let o=a.data.services[0];return E({...r.data,containerPort:r.data.containerPort||o.containerPort})}return r}async getGitRepositoryRoot(t){try{let r=sgn("git",["rev-parse","--show-toplevel"],{cwd:t,encoding:"utf8",timeout:5e3,shell:!1,env:Ir(process.env)});return r.status===0&&r.stdout?r.stdout.trim():t}catch(r){return P.debug("DockerConfigService","Git command failed or timed out, using startPath as fallback",{startPath:t,error:k(r)}),t}}validateRequiredPath(t,r){return t?.trim()?E(void 0):g(new Kc(`${r} cannot be empty`,"parse_error",{[r.toLowerCase().replace(/ /g,"")]:t}))}},FI=Mr(()=>new hAe)});var EQ=w(()=>{"use strict";cZt();WXe();bQ()});function lZt(e){let t=e.profileData?.name??e.profile??"\0ambient",r=e.region??"\0default",n=e.appName??"\0none";return`${t}|${r}|${n}`}function qc(){return qXe??=new KXe,qXe}function lgn(){qXe=void 0}var cgn,gAe,KXe,qXe,EA=w(()=>{"use strict";gd();cgn=Object.defineProperty,gAe=(e,t)=>cgn(e,"name",{value:t,configurable:!0}),KXe=class{static{gAe(this,"AwsContextProvider")}flights=new Map;queue=Promise.resolve();async acquire(t={}){if(t.credentials!==void 0)return this.launch(void 0,t);let r=lZt(t);if(t.forceRefresh===!0)return this.launch(r,t);for(;;){let n=this.flights.get(r);if(n===void 0)return this.launch(r,t);let a=await n;if(a===ze.getCurrent()&&!a.isExpired())return a;if(this.flights.get(r)===n)return this.flights.delete(r),this.launch(r,t)}}launch(t,r){let n=this.queue.then(()=>ze.initialise(r));return this.queue=n.catch(()=>{}),t!==void 0&&(this.flights.set(t,n),n.catch(()=>{this.flights.get(t)===n&&this.flights.delete(t)})),n}};gAe(lZt,"deriveProviderKey");gAe(qc,"getAwsContextProvider");gAe(lgn,"_resetAwsContextProvider")});var ugn,dgn,pgn,Yt,k0=w(()=>{"use strict";Pr();ugn=Object.defineProperty,dgn=(e,t)=>ugn(e,"name",{value:t,configurable:!0}),pgn={repository:"ECR_REPOSITORY_NOT_FOUND",image:"ECR_IMAGE_NOT_FOUND"},Yt=class extends Ke{static{dgn(this,"EcrError")}errorType;repositoryName;resource;constructor(t,r,n,a,o=!1,i){let s=r==="not_found"?i:void 0,c=r==="not_found"?void 0:i;super(s!==void 0?pgn[s]:c??`ECR_${r.toUpperCase()}`,t,a,o),this.errorType=r,this.repositoryName=n,this.resource=s}}});function YXe(e){return e.replace(/^https?:\/\//,"")}var mgn,fgn,uZt=w(()=>{"use strict";mgn=Object.defineProperty,fgn=(e,t)=>mgn(e,"name",{value:t,configurable:!0});fgn(YXe,"removeProtocol")});var dZt,pZt=w(()=>{"use strict";dZt={CREATE_IN_PROGRESS:{safeToRedeploy:"No",description:"Stack is busy with creation"},CREATE_COMPLETE:{safeToRedeploy:"Yes",description:"Stack was successfully created"},CREATE_FAILED:{safeToRedeploy:"Maybe",description:"Stack creation failed - fix issues before redeploying"},DELETE_IN_PROGRESS:{safeToRedeploy:"No",description:"Stack is busy with deletion"},DELETE_COMPLETE:{safeToRedeploy:"Yes",description:"Stack was successfully deleted"},DELETE_FAILED:{safeToRedeploy:"Maybe",description:"Stack deletion failed - investigate before redeploying"},ROLLBACK_IN_PROGRESS:{safeToRedeploy:"No",description:"Stack is rolling back due to failure"},ROLLBACK_COMPLETE:{safeToRedeploy:"Yes",description:"Stack rolled back due to failure - fix issues before redeploying"},ROLLBACK_FAILED:{safeToRedeploy:"No",description:"Rollback failed - manual intervention needed"},UPDATE_IN_PROGRESS:{safeToRedeploy:"No",description:"Stack update is in progress"},UPDATE_COMPLETE:{safeToRedeploy:"Yes",description:"Stack update completed successfully"},UPDATE_COMPLETE_CLEANUP_IN_PROGRESS:{safeToRedeploy:"No",description:"Stack update cleanup in progress"},UPDATE_FAILED:{safeToRedeploy:"Maybe",description:"Stack update failed - fix issues before redeploying"},UPDATE_ROLLBACK_IN_PROGRESS:{safeToRedeploy:"No",description:"Stack is rolling back an update"},UPDATE_ROLLBACK_COMPLETE:{safeToRedeploy:"Yes",description:"Stack update rolled back successfully"},UPDATE_ROLLBACK_FAILED:{safeToRedeploy:"No",description:"Update rollback failed - manual fix needed"},IMPORT_IN_PROGRESS:{safeToRedeploy:"No",description:"Resource import in progress"},IMPORT_COMPLETE:{safeToRedeploy:"Yes",description:"Resource import completed successfully"},IMPORT_ROLLBACK_IN_PROGRESS:{safeToRedeploy:"No",description:"Import rollback in progress"},IMPORT_ROLLBACK_COMPLETE:{safeToRedeploy:"Yes",description:"Import rollback completed"},IMPORT_ROLLBACK_FAILED:{safeToRedeploy:"No",description:"Import rollback failed - manual fix needed"},REVIEW_IN_PROGRESS:{safeToRedeploy:"Yes",description:"Stack is in review mode"},UNKNOWN:{safeToRedeploy:"Maybe",description:"Unknown stack status"}}});import{CloudFormationClient as M3,DeleteStackCommand as ggn,DescribeStacksCommand as JXe}from"@aws-sdk/client-cloudformation";function ZXe(e,t,r){let n=Ol(e),a=b(k(e));return n==="CredentialsError"||n==="UnauthorizedException"||n==="AccessDeniedException"?new Ey(`AWS credentials error: ${a}`,"auth_error",t,void 0,e,!1):n==="ThrottlingException"||n==="Throttling"||n==="TooManyRequestsException"?new Ey(`AWS rate limit exceeded: ${a}`,"throttled",t,void 0,e,!0):n==="NetworkingError"||a.includes("ENOTFOUND")?new Ey(`Network error: ${a}`,"network_error",t,void 0,e,!0):new Ey(`${r}: ${a}`,"unknown",t,void 0,e)}var hgn,XXe,Ey,L3,yAe=w(()=>{"use strict";EA();pZt();$();ae();eQe();Pr();le();$();hd();hgn=Object.defineProperty,XXe=(e,t)=>hgn(e,"name",{value:t,configurable:!0}),Ey=class extends Ke{static{XXe(this,"CloudFormationError")}errorType;stackName;stackStatus;constructor(t,r,n,a,o,i=!1){super(`CFN_${r.toUpperCase()}`,t,o,i),this.errorType=r,this.stackName=n,this.stackStatus=a}};XXe(ZXe,"classifyAwsError");L3=class{static{XXe(this,"CloudFormationService")}async getAws(){return qc().acquire()}async getStackOutputs(t,r){r?.onStackCheck?.(t);let n=(await this.getAws()).getClient(M3),a=new JXe({StackName:t});try{let o=(await n.send(a)).Stacks?.[0];if(!o?.Outputs)return E([]);let i=o.Outputs.map(s=>({OutputKey:s.OutputKey,OutputValue:s.OutputValue,ExportName:s.ExportName}));return r?.onOutputsRetrieved?.(t,i.length),E(i)}catch(o){if(nf(o))return r?.onStackNotFound?.(t),E([]);let i=b(k(o));return g(new Ey(`Failed to get outputs for stack ${t}: ${i}`,"unknown",t,void 0,o))}}async getStackStatus(t,r){r?.onStackCheck?.(t);let n=(await this.getAws()).getClient(M3),a=new JXe({StackName:t});try{let o=(await n.send(a)).Stacks?.[0];if(!o)return E({status:"DOES_NOT_EXIST",safeToRedeploy:"Yes",description:"Stack does not exist yet"});let i=o.StackStatus??"UNKNOWN",s=dZt[i]??{safeToRedeploy:"Maybe",description:"Unknown stack status"};return r?.onStackFound?.(t,i),E({status:i,safeToRedeploy:s.safeToRedeploy,description:s.description,statusReason:o.StackStatusReason})}catch(o){return nf(o)?E({status:"DOES_NOT_EXIST",safeToRedeploy:"Yes",description:"Stack does not exist yet"}):g(ZXe(o,t,`Failed to get stack status for ${t}`))}}async getExportsByNames(t){let r=(await this.getAws()).getClient(M3);return AQ(r,t)}async listExports(t){let r=(await this.getAws()).getClient(M3),n=await QXe(r);return n.success&&t?.onExportsRetrieved?.(n.data.length),n}async deleteStack(t){let r=(await this.getAws()).getClient(M3);try{return await r.send(new ggn({StackName:t})),E(void 0)}catch(n){return g(ZXe(n,t,`Failed to delete stack ${t}`))}}async stackExists(t,r){let n=r??(await this.getAws()).getClient(M3);try{let a=(await n.send(new JXe({StackName:t}))).Stacks?.[0]?.StackStatus;return!!a&&a!=="REVIEW_IN_PROGRESS"}catch(a){return!nf(a)}}async waitForDeleteComplete(t,r){let n=r?.timeoutMs??6e5,a=r?.pollIntervalMs??5e3,o=Date.now();for(;Date.now()-o<n;){let i=await this.getStackStatus(t);if(!i.success){if(i.error.recoverable){r?.onProgress?.(`Transient error polling stack ${t}, retrying: ${b(i.error.message)}`),await Wt(a);continue}return g(i.error)}let s=i.data.status;if(s==="DELETE_COMPLETE"||s==="DOES_NOT_EXIST")return E(void 0);if(s==="DELETE_FAILED")return g(new Ey(`Stack ${t} deletion failed: ${i.data?.statusReason||"unknown reason"}`,"stack_failed",t,s,void 0,!1));r?.onProgress?.(`Stack ${t} status: ${s??"unknown"}`),await Wt(a)}return g(new Ey(`Timed out waiting for stack ${t} deletion after ${Math.round(n/1e3)}s`,"timeout",t,void 0,void 0,!0))}}});import{ListExportsCommand as vgn}from"@aws-sdk/client-cloudformation";async function rQe(e,t){let r=[];try{let n;do{let a=new vgn({NextToken:n}),o=await e.send(a),i=o.Exports||[];for(let s of i)s.Name&&s.Value&&r.push({Name:s.Name,Value:s.Value});if(t?.(i))break;n=o.NextToken}while(n);return E(r)}catch(n){return g(new Ey(`Failed to list exports: ${b(k(n))}`,"unknown",void 0,void 0,n,!1))}}async function AQ(e,t){if(t.length===0)return E(new Map);let r=new Set(t),n=new Map,a=await rQe(e,o=>{for(let i of o)i.Name&&r.has(i.Name)&&i.Value&&n.set(i.Name,i.Value);return n.size>=r.size});return a.success?E(n):g(a.error)}async function QXe(e){return rQe(e)}var ygn,tQe,eQe=w(()=>{"use strict";ae();yAe();le();$();ygn=Object.defineProperty,tQe=(e,t)=>ygn(e,"name",{value:t,configurable:!0});tQe(rQe,"listAllExports");tQe(AQ,"getExportsByNames");tQe(QXe,"listExports")});import{ECRClient as bgn,CreateRepositoryCommand as Egn,DescribeRepositoriesCommand as Agn,PutLifecyclePolicyCommand as wgn,GetAuthorizationTokenCommand as Cgn}from"@aws-sdk/client-ecr";import{CloudFormationClient as Tgn}from"@aws-sdk/client-cloudformation";function fZt(e){return typeof e.repositoryName=="string"&&typeof e.repositoryArn=="string"&&typeof e.registryId=="string"&&typeof e.repositoryUri=="string"}var Sgn,mZt,xgn,wQ,hZt=w(()=>{"use strict";EA();ae();he();$();Ai();Ah();le();uZt();k0();hd();at();eQe();Sgn=Object.defineProperty,mZt=(e,t)=>Sgn(e,"name",{value:t,configurable:!0});mZt(fZt,"hasRequiredRepositoryFields");xgn=10,wQ=class{static{mZt(this,"EcrRepositoryService")}aws;constructor(t){this.aws=t??null}async getAwsContext(){return this.aws??qc().acquire()}async getClient(){return(await this.getAwsContext()).getClient(bgn)}async getCfnClient(){return(await this.getAwsContext()).getClient(Tgn)}async getRepositoryNameFromStackByExportName(t){let r=await this.getCfnClient(),n=await AQ(r,[t]);if(!n.success){let a=b(n.error.message);return P.debug("EcrService","Error describing stacks",{exportName:t,error:a}),g(new Yt(`Failed to query CloudFormation stacks: ${a}`,"unknown","",n.error))}return E(n.data.get(t))}async getAuthConfig(t,r){try{let n=await(await this.getClient()).send(new Cgn({registryIds:[t]}),{abortSignal:X(r)});if(!n.authorizationData?.[0])return g(new Yt("Failed to get ECR authorization token","auth_failed",void 0,"Check AWS credentials and permissions"));let a=n.authorizationData[0];if(!a.authorizationToken||!a.proxyEndpoint)return g(new Yt("ECR authorization response missing required fields","auth_failed",void 0,{hasToken:!!a.authorizationToken,hasEndpoint:!!a.proxyEndpoint}));let o=Buffer.from(a.authorizationToken,"base64").toString("utf-8"),i=o.indexOf(":");if(i<1)return g(new Yt("Invalid ECR authorization token format","auth_failed",void 0,{tokenFormat:"expected username:password"}));let s=o.slice(0,i),c=o.slice(i+1);return!s||!c?g(new Yt("Invalid ECR authorization token format","auth_failed",void 0,{tokenFormat:"expected username:password"})):E({username:s,password:c,serveraddress:a.proxyEndpoint,registryUrl:YXe(a.proxyEndpoint)})}catch(n){return g(new Yt(`Failed to get ECR authorization: ${b(k(n))}`,"auth_failed",void 0,n,!1))}}async fetchRepositories(t){try{let r=await this.getClient(),n=[],a;do{let s=await r.send(new Agn({...t?{repositoryNames:t}:{},...a!==void 0&&{nextToken:a}}));n.push(...s.repositories??[]),a=s.nextToken}while(a);let o=[],i=[];for(let s of n)fZt(s)?o.push({repositoryName:s.repositoryName,repositoryArn:s.repositoryArn,registryId:s.registryId,repositoryUri:s.repositoryUri,createdAt:s.createdAt,imageTagMutability:s.imageTagMutability,imageScanningConfiguration:s.imageScanningConfiguration}):i.push(s.repositoryName??s.repositoryArn??"(unidentifiable repository)");return E({repositories:o,dropped:i})}catch(r){return HG(r)?E({repositories:[],dropped:[]}):g(new Yt(`Failed to describe repositories: ${b(k(r))}`,"unknown",t?.join(", "),r))}}unreadableDescriptionError(t){return new Yt(`Repository ${t} exists but its description is missing required fields (repositoryName, repositoryArn, registryId, repositoryUri); check IAM response filtering before retrying`,"unknown",t)}async describeRepositories(t){let r=await this.fetchRepositories(t);if(!r.success)return g(r.error);let{repositories:n,dropped:a}=r.data,o=[];if(a.length>0){let i=a.slice(0,xgn),s=a.length-i.length;o.push(b(`Skipped ${a.length} ECR repository description(s) missing required fields: ${i.join(", ")}${s>0?` and ${s} more`:""}`))}return E({repositories:n,warnings:o})}async listRepositories(){return this.describeRepositories()}async getRepository(t){let r=await this.fetchRepositories([t]);if(!r.success)return g(r.error);let n=r.data.repositories[0];return n?E(n):r.data.dropped.length>0?g(this.unreadableDescriptionError(t)):E(null)}async createRepositoryIfNotExists(t,r){try{return await(await this.getClient()).send(new Egn({repositoryName:t,imageScanningConfiguration:{scanOnPush:!0},imageTagMutability:r?.imageTagMutability??"IMMUTABLE",tags:ik(t)})),E({created:!0})}catch(n){if(YYe(n))return E({created:!1});let a=b(k(n));return g(new Yt(`Failed to create ECR repository: ${a}`,"unknown",t,n))}}async setUntaggedLifecyclePolicy(t,r){return this.applyLifecyclePolicy(t,q4(r))}async applyLifecyclePolicy(t,r){try{return await(await this.getClient()).send(new wgn({repositoryName:t,lifecyclePolicyText:r})),E(void 0)}catch(n){let a=b(k(n));return g(new Yt(`Failed to set lifecycle policy: ${a}`,"lifecycle_policy_failed",t,n))}}async repositoryExists(t){let r=await this.fetchRepositories([t]);return r.success?r.data.repositories.length>0?E(!0):r.data.dropped.length>0?g(this.unreadableDescriptionError(t)):E(!1):g(r.error)}}});import{ECRClient as Rgn,ListImagesCommand as _gn,BatchDeleteImageCommand as Pgn,BatchGetImageCommand as Ogn,PutImageCommand as Dgn}from"@aws-sdk/client-ecr";var kgn,Ign,CQ,gZt=w(()=>{"use strict";EA();ae();le();k0();$();hd();kgn=Object.defineProperty,Ign=(e,t)=>kgn(e,"name",{value:t,configurable:!0}),CQ=class{static{Ign(this,"EcrImageService")}aws;constructor(t){this.aws=t??null}async getClient(){return(this.aws??await qc().acquire()).getClient(Rgn)}async listImages(t){try{let r=await this.getClient(),n=[],a;do{let i=await r.send(new _gn({repositoryName:t,maxResults:1e3,...a!==void 0&&{nextToken:a}}));n.push(...i.imageIds??[]),a=i.nextToken}while(a);let o=n.map(i=>({imageDigest:i.imageDigest,imageTags:i.imageTag?[i.imageTag]:void 0}));return E(o)}catch(r){return HG(r)?g(new Yt(`Repository '${t}' not found`,"not_found",t,r,!1,"repository")):g(new Yt(`Failed to list images: ${b(k(r))}`,"unknown",t,r))}}async countImages(t){let r=await this.listImages(t);return r.success?E(r.data.length):g(r.error)}async hasTag(t,r){let n=await this.listImages(t);return n.success?E(n.data.some(a=>a.imageTags?.includes(r))):g(n.error)}async copyImageTag(t,r,n){try{let a=await this.getClient(),o=await a.send(new Ogn({repositoryName:t,imageIds:[{imageTag:r}]}));if(!o.images||o.images.length===0||!o.images[0].imageManifest)return g(new Yt(`Source image tag '${r}' not found in repository '${t}'`,"not_found",t,{sourceTag:r,targetTag:n},!1,"image"));let i=o.images[0].imageManifest,s=o.images[0].imageManifestMediaType;return await a.send(new Dgn({repositoryName:t,imageManifest:i,imageManifestMediaType:s,imageTag:n})),E({tag:n,copied:!0})}catch(a){return KYe(a)||qYe(a)?E({tag:n,copied:!1}):HG(a)?g(new Yt(`Repository '${t}' not found`,"not_found",t,{sourceTag:r,targetTag:n,error:a},!1,"repository")):oA(a)?g(new Yt(`Permission denied when copying image tag from '${r}' to '${n}'`,"permission_denied",t,{sourceTag:r,targetTag:n,error:a})):g(new Yt(`Failed to copy image tag: ${b(k(a))}`,"unknown",t,{sourceTag:r,targetTag:n,error:a}))}}async getLatestTag(t){let r=await this.listImages(t);if(!r.success)return g(r.error);let n=r.data.filter(a=>a.imageTags?.length);return n.length===0?E(void 0):n.find(a=>a.imageTags?.includes("latest"))?E("latest"):E(n[0].imageTags?.[0])}async deleteImages(t,r){if(r.length===0)return E(void 0);try{return await(await this.getClient()).send(new Pgn({repositoryName:t,imageIds:r.map(n=>({imageTag:n}))})),E(void 0)}catch(n){return g(new Yt(`Failed to delete images: ${b(k(n))}`,"unknown",t,n))}}}});function Ay(e){if(typeof e!="object"||e===null)return!1;let t=e;return t.errorType===Mgn||t.statusCode===404}var Ngn,$gn,Mgn,F3=w(()=>{"use strict";Ngn=Object.defineProperty,$gn=(e,t)=>Ngn(e,"name",{value:t,configurable:!0}),Mgn="not_found";$gn(Ay,"isAbsence")});var Lgn,Fgn,yZt,TQ,vZt=w(()=>{"use strict";F3();ae();he();le();$();Ah();bQ();k0();Lgn=Object.defineProperty,Fgn=(e,t)=>Lgn(e,"name",{value:t,configurable:!0}),yZt="public.ecr.aws/fjall/welcome",TQ=class{static{Fgn(this,"EcrRepositoryInitialiser")}repositoryService;imageService;cli;buildxAsserted=!1;constructor(t,r,n){this.repositoryService=t,this.imageService=r,this.cli=n}async ensureBuildxAvailable(){if(this.buildxAsserted)return E(void 0);let t=await this.cli.assertBuildxAvailable();if(!t.success){let r=qi(t.error);return g(new Yt(`Buildx unavailable: ${r}`,"docker_not_running",void 0,t.error))}return this.buildxAsserted=!0,E(void 0)}async initialiseRepository(t,r,n,a){if(n?.isManagedAccount)return n?.onDockerProgress?.("Managed account detected - skipping ECR repository initialisation",100),E({message:"Managed account - ECR repository initialisation skipped",skipped:!0});n?.onDockerProgress?.("Checking if ECR repository has images...",10),a?.onImageCheck?.(t);let o=await this.imageService.listImages(t);if(!o.success){let c=o.error;if(!Ay(c)||c.resource!=="repository")return g(c)}let i=o.success?o.data:[];if(i.length>0)return n?.onDockerProgress?.(`Repository ${t} already has ${i.length} image(s)`,100),a?.onImageFound?.(t,i.length),E({message:"Repository already has images",skipped:!0});n?.onDockerProgress?.("Initialising ECR repository with default image...",15),a?.onInitStart?.(t);let s=await this.ensureBuildxAvailable();if(!s.success)return g(s.error);try{let c=await this.repositoryService.getAuthConfig(r);if(!c.success)return g(c.error);let l=c.data,u=`${yZt}:latest`,d=`${l.registryUrl}/${t}:latest`,p=x0;n?.onDockerProgress?.(`Pulling default image: ${u} for ${p}`,20);let m=await this.cli.pull(u,p,S=>{let A=b(S.status);n?.onDockerProgress?.(`Pulling ${S.id}: ${A}`,40,S.id,S.status)});if(!m.success){let S=qi(m.error);return g(new Yt(`Failed to pull default image: ${S}`,"pull_failed",t,m.error))}n?.onDockerProgress?.("Pull complete",50),n?.onDockerProgress?.("Tagging image for ECR...",55);let f=await this.cli.tag(u,d);if(!f.success){let S=qi(f.error);return g(new Yt(`Failed to tag image: ${S}`,"unknown",t,f.error))}n?.onDockerProgress?.("Authenticating to ECR...",58);let y=await this.cli.loginEcr({registry:l.serveraddress,username:l.username,password:l.password});if(!y.success){let S=qi(y.error);return g(new Yt(`Failed to authenticate to ECR: ${S}`,"auth_failed",t,y.error))}n?.onDockerProgress?.("Pushing image to ECR...",60);let v=await this.cli.push(d,S=>{let A=b(S.status);n?.onDockerProgress?.(`Pushing ${S.id}: ${A}`,85,S.id,S.status)});if(!v.success){let S=qi(v.error);return g(new Yt(`Failed to push image: ${S}`,"push_failed",t,v.error))}return n?.onDockerProgress?.("Push complete",95),await this.pushBackendImage(t,l.registryUrl,p,n?.onDockerProgress),n?.onDockerProgress?.("Default images pushed successfully to ECR",100),a?.onInitComplete?.(t),E({message:"ECR repository initialised with default image"})}catch(c){let l=b(k(c));return l.includes("Cannot connect to the Docker daemon")?g(new Yt("Docker is not running. Please start Docker Desktop and try again.","docker_not_running",t)):l.includes("pull access denied")?g(new Yt("Failed to pull default image. This might be a network issue or Docker Hub rate limiting.","pull_failed",t)):g(new Yt(`ECR initialisation failed: ${l}`,"unknown",t,c))}finally{await this.cli.logoutEcr().catch(()=>{})}}async pushBackendImage(t,r,n,a){let o=`${yZt}:backend`,i=`${r}/${t}:backend`;a?.(`Pulling backend image: ${o}`,70);let s=await this.cli.pull(o,n,u=>{a?.(b(u.status),75)});if(!s.success){let u=qi(s.error);P.warn("EcrService","Failed to pull backend image (non-critical)",{error:u}),a?.(`Warning: backend image pull failed (non-critical): ${u}`,80);return}let c=await this.cli.tag(o,i);if(!c.success){let u=qi(c.error);P.warn("EcrService","Failed to tag backend image (non-critical)",{error:u}),a?.(`Warning: backend image tag failed (non-critical): ${u}`,80);return}a?.("Pushing backend image to ECR...",80);let l=await this.cli.push(i,u=>{a?.(b(u.status),90)});if(!l.success){let u=qi(l.error);P.warn("EcrService","Failed to push backend image (non-critical)",{error:u}),a?.(`Warning: backend image push failed (non-critical): ${u}`,95)}}}});function nQe(e,t,r){return{logicalId:e,resourceType:t.type,status:bZt(t),timestamp:r(),...t.message!==""?{statusReason:t.message}:{}}}function bZt(e){switch(e.type){case"vertex":case"log":case"status":case"warning":return"running";default:return e.type}}var jgn,SZt,EZt=w(()=>{"use strict";jgn=Object.defineProperty,SZt=(e,t)=>jgn(e,"name",{value:t,configurable:!0});SZt(nQe,"mapBuildxEventToResourceEvent");SZt(bZt,"mapEventTypeToStatus")});import{isAbsolute as aQe,join as AZt,dirname as Ugn,resolve as xQ}from"path";import{existsSync as wZt}from"fs";function CZt(e,t){if(t===void 0||t==="")return E(e);let r=t.toLowerCase(),n=e.map(o=>o.name),a=e.filter(o=>{let i=o.name.toLowerCase();return i===r||i.endsWith(r)});return a.length===0?g(new Error(`Service '${t}' not found. Available services: ${n.join(", ")||"none"}`)):E(a)}function oQe(e,t,r){let n=AZt(t,e);if(wZt(n))return{path:n,base:t};if(r!==""&&r!==t){let a=AZt(r,e);if(wZt(a))return{path:a,base:r}}return{path:n,base:t}}function TZt(e,t){return`Dockerfile not found for service '${e}' at ${t}. Checked the synth directory and the working directory. If your Dockerfile lives at the project root with the CDK app in a subdirectory, set an absolute docker.context (the build context must share the Dockerfile's directory).`}async function xZt(e,t,r){for(let n of e){let a=n.docker?.path;if(!a)continue;let o=aQe(a)?a:oQe(a,t,r).path;if(!await br(o))return g(new Error(TZt(n.name,o)))}return E(void 0)}function vAe(e,t,r,n){let a=e.docker?.path,o=e.docker?.context,i,s;if(a!==void 0&&aQe(a))i=a,s=t;else{let d=oQe(a??"Dockerfile",t,r);i=d.path,s=d.base}let c=o?aQe(o)?xQ(o):xQ(s,o):xQ(Ugn(i)),l=n??e.docker?.target,u=s!==t;return l!==void 0?{buildContext:c,dockerfilePath:i,target:l,resolvedViaFallback:u}:{buildContext:c,dockerfilePath:i,resolvedViaFallback:u}}function iQe(e){return`${e.buildContext}|${e.dockerfilePath}|${e.target??""}`}function kZt(e,t,r){let n;try{n=HU(kv(e))}catch(o){return g(new Error(k(o)))}let a=new Map;for(let o of n){let i=vAe({name:o.name,docker:o.docker},e,t,r),s=iQe(i),c=a.get(s)??new Set;o.architecture!==void 0&&c.add(o.architecture),a.set(s,c)}return E(a)}async function IZt(e){let{leader:t,groupMembers:r,cwd:n,workingDirectory:a,context:o,cliDockerProvider:i,ecrAccountId:s,ecrRegion:c,cacheRepoUri:l,onParallelEvent:u,onParallelStatus:d,clock:p,awsProvider:m,abortSignal:f,flagBuildArgs:y,flagBuildSecrets:v,shouldEmitBakeWarning:S,targetsLambda:A,platform:C=x0}=e,T=t.name,{ecrBaseUri:x,dockerConfig:R,repositoryName:I,targetOverride:D}=o,O=vAe(t,n,a,D),N=O.target,M=r.map(se=>se.name);for(let se of M)d?.(se,"running");let L=Oh(se=>{let _e=b(se);for(let Ee of M)d?.(Ee,"failed",_e);return g(new Yt(_e,"unknown",I))},"failGroup"),F=t.docker?.buildArgs??R?.buildArgs,G=[...t.docker?.buildSecrets??[],...v??[]],V=IN({serviceName:T,dockerfilePath:O.dockerfilePath,buildContext:O.buildContext,...N!==void 0&&{target:N},...F!==void 0&&{buildArgs:F},...G.length>0&&{buildSecrets:G},members:r.map(se=>{let _e=se.docker?.buildArgs??R?.buildArgs;return{serviceName:se.name,..._e!==void 0&&{buildArgs:_e},...se.docker?.buildSecrets!==void 0&&{buildSecrets:se.docker.buildSecrets}}})});if(!V.success)return L(V.error.message);let W=V4(F,Wr(I));for(let se of W.warnings){let _e=b(se.message);S(_e)&&d?.(T,"running",_e)}if(W.findings.length>0)return L(W.findings.map(se=>se.message).join(" "));let U=G,J=CN(F);if(U.length>0&&m===void 0)return L(`Build secrets are declared for ${T} but no AWS context is available to resolve them.`);let te=m;if(m!==void 0){let se=await iI(m,[...U,...J],{appName:I,region:c,accountId:s,partition:a0(c)});if(!se.success)return L(se.error.message);te=se.data}let Y=await kN({...F!==void 0&&{manifestBuildArgs:F},serviceDir:O.buildContext,stage:Ggn,shellEnv:process.env,...y!==void 0&&{flagBuildArgs:y},...te!==void 0&&{resolveSourcedValue:Oh((se,_e)=>xN(te,{id:se,..._e},f),"resolveSourcedValue")}});if(!Y.success)return L(Y.error.message);let ne=Y.data.buildArgs;for(let se of Y.data.inferredDotenvKeys){let _e=b(`buildArg "${se}" was auto-declared from a .env file and will be baked into the image \u2014 ${rI}.`);S(_e)&&d?.(T,"running",_e)}let re=z4(ne,Wr(I),W4(F));if(re.length>0)return L(re.map(se=>se.message).join(" "));let ee,de;if(U.length>0&&te!==void 0){let se=await TN(te,U,f);if(!se.success)return L(`Failed to resolve build secrets for ${T}: ${se.error.message}`);ee=se.data.cleanup,de=se.data.resolved}try{let se=await i.buildAndPush({appName:I,appPath:O.buildContext,region:c,accountId:s,platform:C,pushByDigest:!0,targetsLambda:A,buildContext:O.buildContext,dockerfilePath:O.dockerfilePath,...N!==void 0&&{target:N},...l!==void 0&&{cacheRepoUri:l,serviceName:T},buildArgs:ne,...de!==void 0&&{buildSecrets:de},...f!==void 0&&{abortSignal:f}},void 0,_e=>{for(let Ee of M){let Ue=nQe(Ee,_e,p);u?.(Ee,Ue)}});return await RZt(se,{leaderName:T,repositoryName:I,ecrBaseUri:x,groupMembers:r,buildTarget:N,cliDockerProvider:i,onParallelStatus:d})}finally{ee!==void 0&&await ee().catch(se=>{P.warn("EcrBuildOrchestrator","Build-secret cleanup failed",{error:b(k(se))})})}}async function RZt(e,t){let{leaderName:r,repositoryName:n,ecrBaseUri:a,groupMembers:o,buildTarget:i,cliDockerProvider:s,onParallelStatus:c}=t;if(!e.success){let f=b(k(e.error));for(let y of o)c?.(y.name,"failed",f);return g(new Yt(`Docker build failed for ${r}: ${f}`,"push_failed",n,e.error))}let l=e.data.imageDigest,u=[],d=[];for(let f of o){let y=AP(l,f.name,i);if(!y.success){let v=b(y.error.message);for(let S of o)c?.(S.name,"failed",v);return g(new Yt(`Content-hash tag derivation failed for ${f.name}: ${v}`,"unknown",n,y.error))}u.push(y.data),d.push(`${a}:${y.data}`)}let p=await s.tagByDigest({sourceImage:a,digest:l,tags:d});if(!p.success){let f=b(k(p.error));for(let y of o)c?.(y.name,"failed",f);return g(new Yt(`Content-hash tag push failed for ${r}: ${f}`,"push_failed",n,p.error))}let m=[];return o.forEach((f,y)=>{c?.(f.name,"complete"),m.push({serviceName:f.name,pushedUrls:[d[y]],tagsPushed:1,contentHashTag:u[y],imageDigest:l})}),E(m)}function _Zt(e){let t=e.match(/^(\d+)\.dkr\.ecr\.([^.]+)\.(amazonaws\.com(?:\.cn)?)$/);return t===null?null:{accountId:t[1],region:t[2],dnsSuffix:t[3]}}async function sQe(e){let{repositoryName:t,dockerConfig:r,authConfig:n,appPath:a,workingDirectory:o,progressCallback:i,onDockerProgress:s,serviceFilter:c,targetOverride:l,platform:u,repositoryService:d,cliDockerProvider:p,onParallelEvent:m,onParallelStatus:f,clock:y,awsProvider:v,flagBuildArgs:S,flagBuildSecrets:A}=e,C=r?.services||[];if(C.length===0)return E({message:"No services configured - skipping Docker deployment"});let T=CZt(C,c);if(!T.success)return g(new Yt(b(T.error.message),"unknown",t));let x=T.data,R=xQ(a),I=o!==void 0&&o!==""?xQ(o):"",D=await xZt(x,R,I);if(!D.success)return g(new Yt(b(D.error.message),"unknown",t));let O=kZt(R,I,l);if(!O.success)return g(new Yt(b(O.error.message),"unknown",t));let N=O.data,M=await p.preflight?.();if(M!==void 0&&!M.success)return g(new Yt(b(M.error.message),"unknown",t));if(d!==void 0){let L=ty(t),F=await d.createRepositoryIfNotExists(L,{imageTagMutability:"MUTABLE"});if(!F.success)return g(F.error);let G=await d.setUntaggedLifecyclePolicy(L,fJ);if(!G.success)return g(G.error)}i?.(b(`Building ${x.length} service image(s)...`)),s?.("Starting Docker builds...",0);try{let L={ecrBaseUri:`${n.registryUrl}/${t}`,authConfig:n,dockerConfig:r,repositoryName:t,targetOverride:l,progressCallback:i,onDockerProgress:s},F=new Map;x.forEach(Ue=>{let Ot=vAe(Ue,R,I,l),Ie=iQe(Ot),Pe=F.get(Ie);Pe===void 0?(Ot.resolvedViaFallback&&i?.(b(`Building service '${Ue.name}' from ${Ot.dockerfilePath} (resolved at the project root).`)),F.set(Ie,{leader:Ue,members:[Ue]})):Pe.members.push(Ue)});let G=Array.from(F.entries());for(let[Ue,Ot]of G){let Ie=N.get(Ue);if(Ie===void 0)continue;if(Ie.size>1)return g(new Yt(`Build group for '${Ot.leader.name}' contains Lambda members targeting different architectures (${Array.from(Ie).join(", ")}) \u2014 members sharing one Dockerfile/context/target build as a single image and must agree on \`architecture\`. Give the differing Lambda a distinct docker.path/context/target, or align their \`architecture\` props.`,"unknown",t));let[Pe]=Ie;if(Pe!==void 0&&Pe!==t0)return g(new Yt(`Build group for '${Ot.leader.name}' declares Lambda architecture '${Pe}' but also contains ECS service members \u2014 fjall ECS tasks always run on '${t0}', so an image shared between ECS and Lambda must build for '${t0}'. Give the Lambda a distinct docker.path/context/target, or align its \`architecture\` prop.`,"unknown",t))}let V=gJ(G.length),W=new AbortController,U=_Zt(n.registryUrl);if(U===null)return g(new Yt(`Unable to parse ECR registry URL: ${n.registryUrl}`,"unknown",t));let J=d!==void 0?`${U.accountId}.dkr.ecr.${U.region}.${U.dnsSuffix}/${ty(t)}`:void 0,te=y??(()=>new Date),Y=G4(),ne,re=G.map(([Ue,Ot])=>async()=>{if(W.signal.aborted)return g(new Yt(`Build for ${Ot.leader.name} aborted by sibling failure`,"unknown",t));let Ie=await IZt({leader:Ot.leader,groupMembers:Ot.members,cwd:R,workingDirectory:I,context:L,cliDockerProvider:p,ecrAccountId:U.accountId,ecrRegion:U.region,cacheRepoUri:J,onParallelEvent:m,onParallelStatus:f,clock:te,platform:u??x0,targetsLambda:N.has(Ue),...v!==void 0&&{awsProvider:v},...S!==void 0&&{flagBuildArgs:S},...A!==void 0&&{flagBuildSecrets:A},abortSignal:W.signal,shouldEmitBakeWarning:Y});return Ie.success||(ne===void 0&&(ne=Ie.error),W.abort()),Ie}),ee=!1;if(p.beginEcrSession!==void 0){let Ue=await p.beginEcrSession({accountId:U.accountId,region:U.region});if(!Ue.success)return g(new Yt(b(Ue.error.message),"unknown",t));ee=!0}let de=await(async()=>{try{return await hJ(re,V,{abortOnFirstFailure:!0,abortSignal:W.signal})}finally{ee&&p.endEcrSession!==void 0&&await p.endEcrSession().catch(()=>{})}})(),se=0,_e=[],Ee=[];for(let Ue of de){if(Ue===void 0)continue;if(!Ue.success){let Ie=ne??Ue.error,Pe=b(k(Ie));return g(new Yt(Pe,"unknown",t,Ie))}let Ot=Ue.data;if(!Ot.success)return g(ne??Ot.error);for(let Ie of Ot.data)se+=Ie.tagsPushed,_e.push(...Ie.pushedUrls),Ee.push({serviceName:Ie.serviceName,imageTag:Ie.contentHashTag,imageDigest:Ie.imageDigest,imageUri:`${L.ecrBaseUri}:${Ie.contentHashTag}`})}return se===0?g(new Yt("Failed to push any tags to ECR","push_failed",t)):(i?.(b("All service images deployed to ECR")),s?.("Docker deployment complete",100),E({message:`Successfully pushed ${se} tag(s) for ${x.length} service(s) to ECR`,pushedImageUrls:_e,artefacts:Ee}))}catch(L){let F=b(k(L));return i?.(`Docker deployment failed: ${F}`),g(new Yt(F,"unknown",t,L))}}var Bgn,Oh,Ggn,PZt=w(()=>{"use strict";ae();$();Ah();So();le();he();EQ();k0();XKe();EZt();at();$();gp();Cr();Bgn=Object.defineProperty,Oh=(e,t)=>Bgn(e,"name",{value:t,configurable:!0}),Ggn="production";Oh(CZt,"filterServices");Oh(oQe,"resolveAgainstBases");Oh(TZt,"dockerfileNotFoundMessage");Oh(xZt,"validateDockerfiles");Oh(vAe,"resolveBuildIdentity");Oh(iQe,"buildIdentityKey");Oh(kZt,"resolveLambdaBuildIdentities");Oh(IZt,"buildGroupViaBuildx");Oh(RZt,"finaliseBuildGroup");Oh(_Zt,"parseEcrRegistry");Oh(sQe,"orchestrateDockerDeploy")});function bAe(e,t){return t&&e.containerPort!==void 0&&e.containerPort!==3e3?rZt:"latest"}async function OZt(e){let{service:t,isMultiService:r,ecrRepositoryName:n,appName:a,serviceBaseProgress:o,progressPerService:i,imageService:s,emit:c}=e,l=t.name,u=`${l.toLowerCase()}-latest`,d=bAe(t,r);c(`Tagging image for service: ${l} (${d} \u2192 ${u})`,o);let p=await s.hasTag(n,u);if(p.success&&p.data)return c(`Image tag ${u} already exists, skipping`,o+i*.9),E({tagged:!0});let m;for(let f=1;f<=zI;f++){let y=await s.copyImageTag(n,d,u);if(y.success){let S=y.data.copied?`Successfully tagged ${u} from ${d}`:`Tag ${u} already exists (idempotent)`;return c(S,o+i*.9),E({tagged:!0})}if(Ay(y.error)&&y.error.resource==="repository")return g(y.error);let v=b(y.error.message);if((v.includes("not found")||v.includes("does not exist"))&&f<zI){let S=o+f/zI*i*.8;c(`Waiting for image :${d} to be available (attempt ${f}/${zI})...`,S),await Wt(cQe);continue}m=v;break}return g(new Yt(`Failed to tag image for service ${l}: ${m??"Unknown error"}`,"unknown",a))}async function lQe(e,t,r,n){try{let a=SAe((p,m)=>{n?.onProgress?.(b(p),m)},"emit");a("Checking ECR repository...",5);let o=await e.resolveEcrRepositoryName(t,"tagEcrImages");if(!o.success)return g(o.error);let i=o.data;a("Getting service configuration...",10);let s=await e.getServicesFromInfrastructure(r);if(!s.success)return g(new Yt(`Failed to read manifest: ${b(s.error.message)}. Run 'cdk synth' first.`,"unknown",t,s.error));let c=s.data;if(c.length===0)return a("No services configured, skipping image tagging",100),E({taggedServices:[]});let l=c.length>1,u=[],d=zgn/c.length;for(let p=0;p<c.length;p++){let m=c[p],f=Wgn+p*d,y=await OZt({service:m,isMultiService:l,ecrRepositoryName:i,appName:t,serviceBaseProgress:f,progressPerService:d,imageService:e.imageService,emit:a});if(!y.success)return g(y.error);u.push(m.name)}return a(`Tagged ${u.length} service(s)`,100),E({taggedServices:u})}catch(a){let o=b(k(a));return g(new Yt(`Failed to tag ECR images: ${o}`,"unknown",t,a))}}var Vgn,SAe,zI,cQe,Wgn,zgn,uQe=w(()=>{"use strict";ae();F3();$();k0();le();bQ();Vgn=Object.defineProperty,SAe=(e,t)=>Vgn(e,"name",{value:t,configurable:!0}),zI=10,cQe=3e3,Wgn=10,zgn=80;SAe(bAe,"pickSourceTag");SAe(OZt,"tagSingleService");SAe(lQe,"runTagEcrImages")});import*as EAe from"path";var Hgn,dQe,kQ,DZt=w(()=>{"use strict";Le();EQ();ae();$();So();xi();EA();k0();hZt();gZt();vZt();PZt();uQe();k0();Hgn=Object.defineProperty,dQe=(e,t)=>Hgn(e,"name",{value:t,configurable:!0}),kQ=class{static{dQe(this,"EcrService")}repositoryService;imageService;initialiser;awsContext;constructor(){this.repositoryService=new wQ,this.imageService=new CQ,this.initialiser=new TQ(this.repositoryService,this.imageService,U1())}async ensureAwsContext(){let t=await qc().acquire();t!==this.awsContext&&(this.awsContext=t,this.repositoryService=new wQ(t),this.imageService=new CQ(t),this.initialiser=new TQ(this.repositoryService,this.imageService,U1()))}async getRepositoryNameFromStackByExportName(t){return await this.ensureAwsContext(),this.repositoryService.getRepositoryNameFromStackByExportName(t)}async getAuthConfig(t,r){return await this.ensureAwsContext(),this.repositoryService.getAuthConfig(t,r)}async describeRepositories(t){return await this.ensureAwsContext(),this.repositoryService.describeRepositories(t)}async listRepositories(){return await this.ensureAwsContext(),this.repositoryService.listRepositories()}async listImages(t){return await this.ensureAwsContext(),this.imageService.listImages(t)}async countImages(t){return await this.ensureAwsContext(),this.imageService.countImages(t)}async hasTag(t,r){return await this.ensureAwsContext(),this.imageService.hasTag(t,r)}async copyImageTag(t,r,n){return await this.ensureAwsContext(),this.imageService.copyImageTag(t,r,n)}async getLatestTag(t){return await this.ensureAwsContext(),this.imageService.getLatestTag(t)}async getRepository(t){return await this.ensureAwsContext(),this.repositoryService.getRepository(t)}async deleteImages(t,r){return await this.ensureAwsContext(),this.imageService.deleteImages(t,r)}async repositoryExists(t){return await this.ensureAwsContext(),this.repositoryService.repositoryExists(t)}async initialiseRepository(t,r,n,a){return await this.ensureAwsContext(),this.initialiser.initialiseRepository(t,r,n,a)}async deployDockerImage(t,r,n,a){await this.ensureAwsContext();let o=a?.dockerConfig;if(!o){let s=await FI().getDockerConfig(n);if(!s.success){let c=b(s.error.message);return g(new Yt(`Failed to get Docker configuration: ${c}`,"unknown",t,s.error))}o=s.data}if(!o)return g(new Yt("Docker configuration is required but was not provided","unknown",t));let i=await this.repositoryService.getAuthConfig(r);if(!i.success){let s=b(i.error.message);return g(new Yt(`Failed to get ECR auth: ${s}`,"auth_failed",t,i.error))}return sQe({repositoryName:t,dockerConfig:o,authConfig:i.data,appPath:n,workingDirectory:a?.workingDirectory,progressCallback:a?.progressCallback,onDockerProgress:a?.onDockerProgress,serviceFilter:a?.serviceFilter,targetOverride:a?.targetOverride,platform:a?.platform,repositoryService:this.repositoryService,cliDockerProvider:A1(),...a?.flagBuildArgs!==void 0&&{flagBuildArgs:a.flagBuildArgs},...a?.flagBuildSecrets!==void 0&&{flagBuildSecrets:a.flagBuildSecrets},...this.awsContext!==void 0&&{awsProvider:this.awsContext}})}async getServiceNamesFromInfrastructure(t){let r=await Ph().getServiceNames(t);return r.success?E(r.data):g(new Yt(b(r.error.message),"unknown",void 0,r.error))}async getServicesFromInfrastructure(t){let r=await Ph().getServices(t);return r.success?E(r.data):g(new Yt(b(r.error.message),"unknown",void 0,r.error))}async resolveEcrRepositoryName(t,r){let n=`${$r(t)}EcrRepositoryName`,a=await this.getRepositoryNameFromStackByExportName(n);if(!a.success)return g(new Yt(`Failed to get ECR repository name (${r}): ${b(a.error.message)}`,"unknown",t,a.error,!1,"ECR_REPOSITORY_NOT_FOUND"));let o=a.data;return o?E(o):g(new Yt(`ECR repository not found in stack outputs (${r}). Looking for export: ${n}. Ensure Network stack has been deployed.`,"not_found",t,void 0,!1,"repository"))}async tagEcrImages(t,r,n){return await this.ensureAwsContext(),lQe({resolveEcrRepositoryName:dQe((a,o)=>this.resolveEcrRepositoryName(a,o),"resolveEcrRepositoryName"),getServicesFromInfrastructure:dQe(a=>this.getServicesFromInfrastructure(a),"getServicesFromInfrastructure"),imageService:this.imageService},t,r,n)}async hasDockerConfiguration(t){try{let r=await FI().getDockerConfig(t);if(!r.success)return E(!1);let n=r.data?.services??[];if(n.length===0)return E(!1);for(let a of n){let o=a.docker?.path;if(!o)continue;let i=EAe.isAbsolute(o)?o:EAe.join(t,o);if(await br(i))return E(!0)}return E(!1)}catch(r){let n=b(r instanceof Error?r.message:String(r));return g(new Yt(`Failed to check Docker configuration: ${n}`,"unknown",void 0,r))}}}});var Kgn,qgn,j3,pQe=w(()=>{"use strict";gd();at();Le();at();Kgn=Object.defineProperty,qgn=(e,t)=>Kgn(e,"name",{value:t,configurable:!0}),j3=class{static{qgn(this,"EcsService")}inner=null;resolver=null;async getInner(){if(!this.inner){let t=await ze.initialise();this.inner=new Yv(t)}return this.inner}getResolver(){if(!this.resolver){let t=by();this.resolver=new Jv(t)}return this.resolver}async updateService(t,r,n){return(await this.getInner()).updateService(t,r,n)}async describeServices(t,r){return(await this.getInner()).describeServices(t,r)}async getDeploymentStatus(t,r){return(await this.getInner()).getDeploymentStatus(t,r)}async isDeploying(t,r){return(await this.getInner()).isDeploying(t,r)}async getServiceEvents(t,r){return(await this.getInner()).getServiceEvents(t,r)}async pollDeployment(t){return(await this.getInner()).pollDeployment(t)}async listClusters(){return(await this.getInner()).listClusters()}async describeClusters(t){return(await this.getInner()).describeClusters(t)}async listServices(t){return(await this.getInner()).listServices(t)}async registerTaskDefinition(t){return(await this.getInner()).registerTaskDefinition(t)}async getLatestTaskDefinition(t){return(await this.getInner()).getLatestTaskDefinition(t)}async deployService(t,r,n){return(await this.getInner()).deployService(t,r,n)}async getDeployableClusterAndServices(t){return this.getResolver().getDeployableClusterAndServices(t)}}});import{join as $Zt}from"node:path";import{tmpdir as Jgn}from"node:os";import{randomUUID as Zgn}from"node:crypto";import{unlink as NZt}from"node:fs/promises";function MZt(e){return e.startsWith("cn-")?"amazonaws.com.cn":"amazonaws.com"}function AAe(e,t){return`${e}.dkr.ecr.${t}.${MZt(t)}`}function wAe(e){return Wr(e)}function mQe(e){let t=e.split("/")[0]??"";if(!t.includes(".dkr.ecr."))return;let r=t.split(".")[0]??"";if(r!=="")return{registry:t,accountId:r}}function LZt(e){let t=e.indexOf("/");return t===-1?e:e.slice(t+1)}function fQe(){return $Zt(Jgn(),`fjall-buildx-meta-${Zgn()}.json`)}function hQe(){return{debug:$l((e,t,r)=>P.debug(e,t,r),"debug"),info:$l((e,t,r)=>P.info(e,t,r),"info"),warn:$l((e,t,r)=>P.warn(e,t,r),"warn"),error:$l((e,t,r)=>P.error(e,t,r),"error")}}var Ygn,$l,Xgn,Qgn,CAe,FZt=w(()=>{"use strict";at();Ah();$();F3();le();he();uQe();EQ();Ygn=Object.defineProperty,$l=(e,t)=>Ygn(e,"name",{value:t,configurable:!0}),Xgn="CliDockerProvider",Qgn="fjall";$l(MZt,"ecrDnsSuffix");$l(AAe,"ecrRegistryUrl");$l(wAe,"ecrRepositoryName");$l(mQe,"parseEcrRegistry");$l(LZt,"slotRepositoryName");$l(fQe,"tempMetadataPath");$l(hQe,"makeDockerCliLogger");CAe=class{static{$l(this,"CliDockerProvider")}cli;ecr;builderBootstrapped=void 0;cachedBuilderRejectionMessage=void 0;orchestratorSession=!1;constructor(t,r){this.cli=t,this.ecr=r}async preflight(){let t=await this.cli.detectDaemon();if(!t.success)return g(new Error(qi(t.error)));let r=await this.cli.assertBuildxAvailable();return r.success?E(void 0):g(new Error(qi(r.error)))}async beginEcrSession(t){let r=AAe(t.accountId,t.region),n=await this.resolveEcrAuth(t.accountId,t.abortSignal);if(!n.success)return n;let a=await this.cli.loginEcr({registry:r,username:n.data.username,password:n.data.password});return a.success?(this.orchestratorSession=!0,E(void 0)):g(this.ecrLoginFailure(a.error))}async endEcrSession(){this.orchestratorSession=!1,await this.cli.logoutEcr().catch(()=>{})}async resolveEcrAuth(t,r){let n=await this.ecr.getAuthConfig(t,r);if(!n.success){let a=b(n.error.message);return g(new Error(`ECR auth failed: ${a}`))}return E(n.data)}ecrLoginFailure(t){return new Error(`ECR login failed: ${qi(t)}`)}async buildAndPush(t,r,n){let{appName:a,region:o,accountId:i}=t,s=t.platform??x0,c=t.imageTag??"latest",l=AAe(i,o),u=wAe(a),d=`${l}/${u}`,p=`${d}:${c}`,m=fQe(),f=t.pushByDigest===!0,y=f?[]:t.imageTags!==void 0&&t.imageTags.length>0?t.imageTags:[p],v=$l((T,x,R,I)=>{r?.(b(T),x,R,I)},"emit"),S=pJ(process.env);if(!S.success){let T=b(S.error.message);return v(`Invalid build cache configuration: ${T}`),g(new Error(T))}let A=S.data,C=$l(async()=>{v("Building Docker image\u2026",15);let T=await this.ensureBuilderOnce();if(!T.success){let O=b(T.error.message);return v(`Builder bootstrap failed: ${O}`),g(new Error(`Builder bootstrap failed: ${O}`))}let x=mJ({cacheRepoUri:t.cacheRepoUri,appName:a,serviceName:t.serviceName,mode:A}),R={contextPath:t.buildContext??t.appPath,dockerfilePath:t.dockerfilePath??$Zt(t.appPath,"Dockerfile"),platforms:[s],tags:[...y],buildArgs:{...t.buildArgs??{}},...t.buildSecrets!==void 0&&{secrets:t.buildSecrets.map(O=>({id:O.id,source:O.source}))},provenance:t.targetsLambda!==!0,sbom:t.targetsLambda!==!0,push:!0,load:!1,...f&&{pushByDigest:!0,imageName:d},metadataFile:m,...t.target!==void 0&&{target:t.target},...x!==void 0&&{cacheFrom:x.cacheFrom},...x?.cacheTo!==void 0&&{cacheTo:x.cacheTo}},I=await this.cli.buildxBuild(R,O=>{v(O.message,O.percentage,O.vertex,O.type),n?.(O)},t.abortSignal);if(!I.success){let O=qi(I.error);return v(`Buildx build failed: ${O}`),g(new Error(`Buildx build failed: ${O}`))}let D=I.data.digest;return typeof D!="string"||D===""?(v("Buildx push succeeded but no image digest was reported"),g(new Error("Buildx push succeeded but no image digest was reported"))):(v("Docker image pushed successfully",100),E({imageUri:d,imageTag:c,imageDigest:D}))},"runBuild");try{let T=await this.cli.assertBuildxAvailable();if(!T.success){let R=qi(T.error);return v(`Buildx unavailable: ${R}`),g(new Error(`Buildx unavailable: ${R}`))}if(this.orchestratorSession)return await C();v("Authenticating to ECR\u2026",5);let x=await this.resolveEcrAuth(i);return x.success?await this.cli.withEcrSession({registry:l,username:x.data.username,password:x.data.password},C,R=>this.ecrLoginFailure(R)):x}catch(T){let x=b(k(T));return v(`Docker build/push failed for ${a}: ${x}`),g(new Error(`Docker build/push failed for ${a}: ${x}`))}finally{await NZt(m).catch(()=>{})}}async buildAndPushToRepo(t,r,n){let a=t.platform??x0,o=`${t.repoUri}:${t.imageTag}`,i=fQe(),s=$l((p,m,f,y)=>{r?.(b(p),m,f,y)},"emit"),c=mQe(t.repoUri);if(c===void 0){let p=b(t.repoUri);return s(`Not an ECR repository URI: ${p}`),g(new Error(`Not an ECR repository URI: ${p}`))}let l=pJ(process.env);if(!l.success){let p=b(l.error.message);return s(`Invalid build cache configuration: ${p}`),g(new Error(p))}let u=l.data,d=$l(async()=>{s("Building slot image\u2026",15);let p=await this.ensureBuilderOnce();if(!p.success){let S=b(p.error.message);return s(`Builder bootstrap failed: ${S}`),g(new Error(`Builder bootstrap failed: ${S}`))}let m=mJ({cacheRepoUri:t.cacheRepoUri,appName:LZt(t.repoUri),mode:u});m===void 0&&s("No build cache repository on this substrate \u2014 building uncached. Redeploy the substrate to enable caching.");let f={contextPath:t.contextPath,dockerfilePath:t.dockerfilePath,platforms:[a],tags:[o],buildArgs:{...t.buildArgs??{}},provenance:!1,sbom:!1,push:!0,load:!1,metadataFile:i,...m!==void 0&&{cacheFrom:m.cacheFrom},...m?.cacheTo!==void 0&&{cacheTo:m.cacheTo}},y=await this.cli.buildxBuild(f,S=>{s(S.message,S.percentage,S.vertex,S.type),n?.(S)});if(!y.success){let S=qi(y.error);return s(`Buildx build failed: ${S}`),g(new Error(`Buildx build failed: ${S}`))}let v=y.data.digest;return typeof v!="string"||v===""?(s("Buildx push succeeded but no image digest was reported"),g(new Error("Buildx push succeeded but no image digest was reported"))):(s("Slot image pushed successfully",100),E({imageUri:t.repoUri,imageTag:t.imageTag,imageDigest:v}))},"runBuild");try{let p=await this.cli.assertBuildxAvailable();if(!p.success){let m=qi(p.error);return s(`Buildx unavailable: ${m}`),g(new Error(`Buildx unavailable: ${m}`))}return await this.cli.withEcrSession({registry:c.registry,username:t.ecrAuth.username,password:t.ecrAuth.password},d,m=>this.ecrLoginFailure(m))}catch(p){let m=b(k(p));return s(`Slot build/push failed: ${m}`),g(new Error(`Slot build/push failed: ${m}`))}finally{await NZt(i).catch(()=>{})}}async ensureBuilderOnce(){if(this.cachedBuilderRejectionMessage!==void 0)return g(new Error(this.cachedBuilderRejectionMessage));this.builderBootstrapped===void 0&&(this.builderBootstrapped=this.cli.ensureBuilder(Qgn));let t;try{t=await this.builderBootstrapped}catch(r){let n=b(r instanceof Error?r.message:String(r));return this.cachedBuilderRejectionMessage=n,g(new Error(n))}if(!t.success){let r=qi(t.error);return this.cachedBuilderRejectionMessage=r,g(new Error(r))}return E(void 0)}async tagByDigest(t){let r=$l(async()=>{let o=await this.cli.tagByDigest(t.sourceImage,t.digest,t.tags);return o.success?E(void 0):g(new Error(`tagByDigest failed: ${qi(o.error)}`))},"runTag");if(this.orchestratorSession)return r();let n=mQe(t.sourceImage);if(n===void 0)return r();let a=await this.resolveEcrAuth(n.accountId);return a.success?this.cli.withEcrSession({registry:n.registry,username:a.data.username,password:a.data.password},r,o=>this.ecrLoginFailure(o)):a}async initialiseECR(t){let{appName:r,region:n,accountId:a}=t,o=wAe(r),i=`${AAe(a,n)}/${o}`;try{let s=await this.ecr.initialiseRepository(o,a);if(!s.success){let c=b(s.error.message);return g(new Error(`ECR initialisation failed: ${c}`))}return E({repositoryUri:i})}catch(s){let c=b(k(s));return g(new Error(`ECR initialisation failed for ${r}: ${c}`))}}async tagImages(t,r){let{appName:n,appPath:a}=t,o=wAe(n),i=$l((s,c,l,u)=>{r?.(b(s),c,l,u)},"emit");try{let s=await this.ecr.getServicesFromInfrastructure(a);if(!s.success){let d=b(s.error.message);return g(new Error(`Failed to read services for ${n}: ${d}`))}let c=s.data;if(c.length===0)return E({taggedServices:[]});let l=c.length>1,u=[];for(let d=0;d<c.length;d++){let p=c[d],m=p.name,f=`${m.toLowerCase()}-latest`,y=bAe(p,l);i(`Tagging image for service ${m} (${d+1}/${c.length})\u2026`);let v,S=!1;for(let A=1;A<=zI&&!S;A++){let C=await this.ecr.copyImageTag(o,y,f);if(C.success){S=!0;break}let T=b(C.error.message);if(Ay(C.error)&&C.error.resource==="repository"){v=T;break}if((T.includes("not found")||T.includes("does not exist"))&&A<zI){i(`Waiting for image :${y} to be available (attempt ${A}/${zI})\u2026`),await Wt(cQe);continue}v=T;break}if(!S)return g(new Error(`Failed to tag image for service ${m}: ${v??"Unknown error"}`));u.push(m),i(`Tagged image for service ${m}`)}return E({taggedServices:u})}catch(s){let c=b(k(s));return P.warn(Xgn,"tagImages failed",{appName:n,error:c}),g(new Error(`Failed to tag images for ${n}: ${c}`))}}}});function gQe(e){let t=e?.getAuthResult();if(t&&t.account&&t.arn&&t.userId)return{Account:t.account,Arn:t.arn,UserId:t.userId}}var eyn,tyn,jZt=w(()=>{"use strict";eyn=Object.defineProperty,tyn=(e,t)=>eyn(e,"name",{value:t,configurable:!0});tyn(gQe,"getCallerIdentityFromAuth")});var ryn,nyn,TAe,G1,Xn,HI=w(()=>{"use strict";Pr();ryn=Object.defineProperty,nyn=(e,t)=>ryn(e,"name",{value:t,configurable:!0}),TAe="OidcDeployRoleArn",G1="production",Xn=class extends Ke{static{nyn(this,"OrganisationError")}organisationType;target;operation;constructor(t,r,n,a,o,i=!1,s){super("ORGANISATION_ERROR",t,o,i,s),this.organisationType=r,this.target=n,this.operation=a}}});function KI(e){return gQe(e.aws)}function xAe(e){return e.find(t=>pr(t)==="platform")}function kAe(e){return xAe(e)?.id}async function B3(e,t,r,n,a,o){let i=a??At;if(e.aws)return P.debug("Organisation","Re-using existing AWS context (skipping re-auth)",{region:i,operationType:t.type,target:t.target}),E(i);let s=RQ(),c;t.type===ar.ORGANISATION?c="organisation":t.type===ar.PLATFORM?c="platform":c="account";let l=await s.assumeOrganisationProfile(c,i,o,n.deploymentTarget);if(!l.success)return g(new Xn(`Failed to switch to ${c} profile: ${b(l.error?.message??"")}`,t.type,t.target,"auth"));if(!l.data)return g(new Xn(`No suitable AWS profile found for ${c} deployment`,t.type,t.target,"auth"));let u;try{u=await ze.initialise({ssoCallbacks:{onSSOUrl:IS(p=>n.onSSOUrl?.(p),"onSSOUrl")}}),e.setAwsContext(u)}catch(p){return g(new Xn(`Authentication failed: ${b(k(p))}`,t.type,t.target,"auth"))}let d=u.getAuthResult();if(d)n.onSSOUrl?.(null),n.onAuthComplete?.(d);else return g(new Xn("Failed to authenticate with AWS",t.type,t.target,"auth"));return n.deploymentTarget!==void 0?E(u.getRegion()):E(i)}function yQe(e,t,r,n){let a=t!==void 0?`${e} (${t})`:e;return new Xn(`AWS account mismatch: Expected deployment to account ${a}, but currently authenticated to account ${r}. Profile switching may have failed. Please verify your AWS credentials.`,n.type,n.target,"authentication")}async function U3(e,t,r){if(!t.callerIdentity)return g(new Xn("No AWS credentials available",e.type,e.target,"authentication"));let n=t.callerIdentity.Account;if(r.providerAccounts===void 0)return g(new Xn(`Cannot verify the target AWS account for this ${e.type} ${r.mode}: the organisation's registered accounts could not be fetched from the Fjall API. The current AWS credentials resolve to account ${n}. Check your connection and retry; if the problem persists, run 'fjall login' to refresh your session.`,e.type,e.target,"authentication"));let a=r.providerAccounts;if(e.type===ar.ORGANISATION){let s=a.find(l=>pr(l)==="organisation"),c=s?.id??t.managementAccountId;if(c===void 0){let l=`Could not confirm the management account for this organisation ${r.mode}: no organisation-tier account is registered and the AWS Organizations lookup was unavailable.`;if(r.mode==="destroy")return g(new Xn(`${l} Retry, and check the credentials allow 'organizations:DescribeOrganization'.`,e.type,e.target,"authentication"));be(`${l} Proceeding against account ${n}.`,{scope:ce.deploy})}else if(c!==n)return g(yQe(c,s?.name,n,e));return E(void 0)}if(e.type===ar.PLATFORM){let s=xAe(a);return s===void 0?g(new Xn(`Cannot verify the platform account for this ${r.mode}: no platform-tier account is registered with Fjall. Run '${fe.organisationDeploy}' to sync accounts, then retry.`,e.type,e.target,"authentication")):s.id!==n?g(yQe(s.id,s.name,n,e)):E(void 0)}if(a.length===0)return be(`No accounts are registered with Fjall yet \u2014 skipping target-account verification (standalone account flow). Proceeding against account ${n}.`,{scope:ce.deploy}),E(void 0);let o=a.find(s=>pr(s)==="organisation"),i=xAe(a);return o&&n===o.id?g(new Xn(`Cannot deploy Account to root account ${o.id}. Account must be deployed to a non-root, non-platform account.`,e.type,e.target,"validation")):i&&n===i.id?g(new Xn(`Cannot deploy Account to platform account ${i.id}. Account must be deployed to a non-root, non-platform account.`,e.type,e.target,"validation")):E(void 0)}async function I0(e,t){let r=rt.fromCredentials();if(r)try{let n=await r.putOrganisationConfig(e);n.success?(P.info(t,"Organisation config pushed to API"),va().invalidateCache()):(P.warn(t,"Failed to push org config to API (non-critical)",{error:b(n.error.message)}),be(`Failed to push org config: ${n.error.message}`,{scope:ce.deploy}))}catch(n){let a=b(k(n));P.warn(t,"Failed to push org config to API (non-critical)",{error:a}),be(`Failed to push org config: ${a}`,{scope:ce.deploy})}}async function G3(){try{let e=rt.fromCredentials();if(!e)return;let t=await e.getIdentity();return t.success?t.data.organisationId:void 0}catch(e){P.debug("Organisation","Failed to fetch organisation identity",{error:b(k(e))});return}}async function V3(e,t){let r=un(),n=await e.executeStep(ge.VERIFY,async()=>{let a=await r.verifyDeploymentTarget({deployType:t.type,target:t.target,path:t.path});return a.success?{success:!0,message:"Deployment target verified"}:{success:!1,error:a.error.message}});return n.success?E(void 0):g(new Xn("error"in n?String(n.error):"Failed to verify deployment target",t.type,t.target,ge.VERIFY))}var ayn,IS,IQ,W3=w(()=>{"use strict";$();Dt();or();at();_i();Le();xi();jZt();ae();HI();ki();le();Rn();Le();$();he();Cn();ayn=Object.defineProperty,IS=(e,t)=>ayn(e,"name",{value:t,configurable:!0}),IQ=class{static{IS(this,"OrganisationState")}_aws=null;get aws(){return this._aws}setAwsContext(t){this._aws=t}};IS(KI,"getCallerIdentity");IS(xAe,"getPlatformAccount");IS(kAe,"getPlatformAccountId");IS(B3,"authenticateForOperation");IS(yQe,"buildMismatchError");IS(U3,"verifyTargetAccount");IS(I0,"pushOrgConfigToApi");IS(G3,"fetchFjallOrgId");IS(V3,"executeVerifyTargetStep")});function _Q(e){let t=e?.providerAccounts??[],r=e?.primaryRegion??At;return{providerAccounts:t,primaryRegion:r}}var oyn,iyn,vQe=w(()=>{"use strict";at();ki();oyn=Object.defineProperty,iyn=(e,t)=>oyn(e,"name",{value:t,configurable:!0});iyn(_Q,"loadConfigAndRegions")});var SQe=w(()=>{"use strict";at()});var syn,cyn,z3,bQe=w(()=>{"use strict";SQe();le();syn=Object.defineProperty,cyn=(e,t)=>syn(e,"name",{value:t,configurable:!0}),z3=class{static{cyn(this,"StepManager")}context;steps;stepStates;currentIndex=0;callbacks;constructor(t,r){this.context=t,this.callbacks=r,this.steps=js.getSteps(t),this.stepStates=new Map;for(let n of this.steps)this.stepStates.set(n.id,{id:n.id,name:n.name,status:"pending"})}updateContext(t){this.context=t,this.steps=js.getSteps(t);let r=new Map;for(let a of this.steps){let o=this.stepStates.get(a.id);o?r.set(a.id,o):r.set(a.id,{id:a.id,name:a.name,status:"pending"})}this.stepStates=r;let n=-1;for(let[a,o]of this.steps.entries()){let i=this.stepStates.get(o.id);i&&(i.status==="completed"||i.status==="running")&&(n=a)}this.currentIndex=Math.max(0,n)}reportStep(t,r){let n=this.steps.findIndex(c=>c.id===t);if(n===-1)return;let a=this.steps[n],o=this.stepStates.get(t);if(!o)return;let i=n+1,s=this.steps.length;switch(r){case"start":o.status="running",o.startTime=new Date,this.currentIndex=n,this.callbacks.onStepStart?.(a.id,a.name,i,s);break;case"complete":if(o.status==="completed")return;o.status="completed",o.endTime=new Date,this.callbacks.onStepComplete?.(a.id,a.name,"completed",i,s),this.currentIndex=n+1;break;case"error":if(o.status==="completed")return;o.status="error",o.endTime=new Date,this.callbacks.onStepComplete?.(a.id,a.name,"error",i,s);break;case"skipped":o.status="skipped",o.endTime=new Date,this.callbacks.onStepComplete?.(a.id,a.name,"skipped",i,s),this.currentIndex=n+1;break;case"cancelled":if(o.status==="completed")return;o.status="cancelled",o.endTime=new Date,this.callbacks.onStepComplete?.(a.id,a.name,"cancelled",i,s);break}}reportStepError(t,r){let n=this.stepStates.get(t);n&&(n.error=r),this.reportStep(t,"error")}skipRemainingInfraSteps(){let t=js.getInfraStepIds();for(let[r,n]of this.steps.entries())r>=this.currentIndex&&t.includes(n.id)&&this.reportStep(n.id,"skipped")}skipRemainingDockerSteps(){let t=js.getDockerStepIds();for(let[r,n]of this.steps.entries())r>=this.currentIndex&&t.includes(n.id)&&this.reportStep(n.id,"skipped")}getCurrentIndex(){return this.currentIndex}getCurrentStep(){return this.steps[this.currentIndex]}getStepsWithStates(){return this.steps.map(t=>({...t,state:this.stepStates.get(t.id)??{id:t.id,name:t.name,status:"pending"}}))}getProgress(){if(this.steps.length===0)return 100;let t=Array.from(this.stepStates.values()).filter(r=>r.status==="completed"||r.status==="skipped").length;return Math.round(t/this.steps.length*100)}isComplete(){return Array.from(this.stepStates.values()).every(t=>t.status==="completed"||t.status==="skipped")}hasError(){return Array.from(this.stepStates.values()).some(t=>t.status==="error")}getErrors(){let t=[];for(let r of this.stepStates.values())r.status==="error"&&r.error&&t.push({step:r.name,error:r.error});return t}reset(){this.currentIndex=0;for(let t of this.stepStates.values())t.status="pending",t.startTime=void 0,t.endTime=void 0,t.error=void 0}getStepNames(){return this.steps.map(t=>t.name)}hasStep(t){return this.steps.some(r=>r.id===t)}getStepIndex(t){return this.steps.findIndex(r=>r.id===t)}getStepState(t){return this.stepStates.get(t)?.status}async executeStep(t,r){this.reportStep(t,"start");try{let n=await r();return n.success?this.reportStep(t,"complete"):this.reportStep(t,"error"),n}catch(n){let a=k(n);throw this.reportStepError(t,a),n}}}});import{execFileSync as uyn}from"child_process";async function EQe(e,t){try{let r=BZt(t);if(r){let n=await e.registerRepository({remoteUrl:r});n.success?P.info(R0,"Repository registered with Fjall",{remoteUrl:r}):P.debug(R0,"Repo registration failed (non-critical)",{error:b(n.error.message)})}}catch(r){P.debug(R0,"Git remote detection failed (non-critical)",{error:b(k(r))})}}async function AQe(e,t,r){try{let n=await e.verifyAwsAccount({awsAccountId:t,accountName:r??"standalone"});n.success?P.info(R0,"Standalone account registered with Fjall",{accountId:t}):(P.warn(R0,"Standalone account registration failed (non-critical)",{error:b(n.error.message)}),be(`Account registration with Fjall failed: ${n.error.message}. You can register manually later.`,{scope:ce.deploy}))}catch(n){P.warn(R0,"Standalone account registration failed (non-critical)",{error:b(k(n))}),be(`Account registration with Fjall failed: ${k(n)}. You can register manually later.`,{scope:ce.deploy})}}async function wQe(e){try{let t=await e.getEntitlements();if(t.success){let{limits:r,usage:n}=t.data;if(r.awsAccounts!==-1&&!n)P.warn(R0,"Entitlements arrived without usage (non-critical), proceeding with deploy"),be("fjall.io returned your plan's AWS account limit without current usage, so the pre-deploy limit check was skipped \u2014 the limit is still enforced at registration.",{scope:ce.deploy});else if(r.awsAccounts!==-1&&n&&n.awsAccounts>=r.awsAccounts){let a=t.data.plan.charAt(0).toUpperCase()+t.data.plan.slice(1);return`AWS account limit reached (${n.awsAccounts}/${r.awsAccounts} on ${a} plan). Upgrade at fjall.io/settings/billing`}}else{let r=b(t.error.message);P.warn(R0,"Failed to check entitlements (non-critical), proceeding with deploy",{error:r}),be(t.error.errorType==="not_authenticated"?`Could not check your plan's AWS account limit \u2014 not logged in to fjall.io (${r}). Proceeding; the limit is still enforced at registration. Run 'fjall login' to restore the pre-deploy check.`:`Could not check your plan's AWS account limit (${r}) \u2014 proceeding; the limit is still enforced at registration.`,{scope:ce.deploy})}}catch(t){let r=b(k(t));P.warn(R0,"Failed to check entitlements (non-critical), proceeding with deploy",{error:r}),be(`Could not check your plan's AWS account limit (${r}) \u2014 proceeding; the limit is still enforced at registration.`,{scope:ce.deploy})}}function BZt(e){try{let t=uyn("git",["remote","get-url","origin"],{cwd:e,timeout:5e3,encoding:"utf-8",stdio:["pipe","pipe","pipe"],env:Ir(process.env)}).trim();return t.length>0?t:void 0}catch(t){P.debug("Organisation","Failed to detect git remote",{error:b(k(t))});return}}var lyn,IAe,R0,UZt=w(()=>{"use strict";Dt();or();he();le();$();lyn=Object.defineProperty,IAe=(e,t)=>lyn(e,"name",{value:t,configurable:!0}),R0="OrgPostDeploy";IAe(EQe,"registerRepository");IAe(AQe,"registerStandaloneAccount");IAe(wQe,"checkAccountEntitlements");IAe(BZt,"detectGitRemote")});import{CloudFormationClient as pyn}from"@aws-sdk/client-cloudformation";function H3(){return async(e,t)=>{try{let r=await new qo().getOrgConfig();if(!r.success)return g(new Error(`organisation config unavailable: ${r.error.message}`));let n=r.data,a=n.providerAccounts.find(l=>l.id===e);if(a===void 0)return g(new Error(`account ${e} is not a connected provider account: connect it with 'fjall connect' or fix the "account" value in fjall-config.json`));let o=t??a.region??n.primaryRegion;if(o===void 0)return g(new Error(`no region is known for account ${e} (no domain-entry region, no account region, no organisation primary region): run 'fjall connect' to complete organisation setup`));let i=Dp(n,a.name,o);if(i===void 0)return g(new Error(`no credential profile can be derived for account '${a.name}' (${e}) in ${o}: run 'fjall connect' to complete organisation setup`));let s=await FX(i,o,n,{onSSOUrl:GZt(()=>{throw new Error(`SSO session for account ${e} needs interactive re-authentication: run 'fjall connect' to refresh it, then retry`)},"onSSOUrl"),presenter:J9t}),c=new pyn({region:o,credentials:{accessKeyId:s.accessKeyId,secretAccessKey:s.secretAccessKey,...s.sessionToken!==void 0?{sessionToken:s.sessionToken}:{}},maxAttempts:3,requestHandler:new aa({requestTimeout:3e4,connectionTimeout:1e4})});return E({cloudFormation:c})}catch(r){return g(r instanceof Error?r:new Error(String(r)))}}}var dyn,GZt,CQe=w(()=>{"use strict";_m();ae();CEe();aEe();OI();md();dyn=Object.defineProperty,GZt=(e,t)=>dyn(e,"name",{value:t,configurable:!0});GZt(H3,"buildAccountCloudFormationClientFactory")});import{ListHostedZonesCommand as VZt,ListResourceRecordSetsCommand as fyn}from"@aws-sdk/client-route-53";function WZt(e){return hyn.has(e)}async function OQ(e,t,r){let n=t.endsWith(".")?t:`${t}.`,a;do{let o=await e.send(new VZt({MaxItems:100,Marker:a}),{abortSignal:X(r)}),i=(o.HostedZones??[]).find(s=>s.Name===n);if(i?.Id)return i.Id.replace("/hostedzone/","");a=o.IsTruncated?o.NextMarker:void 0}while(a)}async function TQe(e,t){let r=[],n;do{let a=await e.send(new VZt({MaxItems:100,Marker:n}),{abortSignal:X(t)});for(let o of a.HostedZones??[])if(!(o.Id===void 0||o.Name===void 0)&&(r.push({zoneName:o.Name.endsWith(".")?o.Name.slice(0,-1):o.Name,hostedZoneId:o.Id.replace("/hostedzone/",""),...o.ResourceRecordSetCount!==void 0?{recordCount:o.ResourceRecordSetCount}:{},privateZone:o.Config?.PrivateZone===!0}),r.length>=gyn))return r;n=a.IsTruncated?a.NextMarker:void 0}while(n);return r}async function yyn(e,t){let r=[],n,a;do{let o=await e.send(new fyn({HostedZoneId:t,StartRecordName:n,StartRecordType:a}));for(let i of o.ResourceRecordSets??[])i.AliasTarget||i.Type!=="SOA"&&i.Name&&i.Type&&i.ResourceRecords&&r.push({Name:i.Name,Type:i.Type,TTL:i.TTL,...i.SetIdentifier!==void 0?{SetIdentifier:i.SetIdentifier}:{},ResourceRecords:i.ResourceRecords.map(s=>({Value:s.Value??""}))});n=o.IsTruncated?o.NextRecordName:void 0,a=o.IsTruncated?o.NextRecordType:void 0}while(n);return r}function vyn(e,t){let r=[];for(let n of e){if(!WZt(n.Type))continue;let a=n.Type,o=n.Name??"";if(o.endsWith(".")&&(o=o.slice(0,-1)),o===t?o="@":o.endsWith(`.${t}`)&&(o=o.slice(0,-(t.length+1))),!(a==="NS"&&o==="@"))for(let i of n.ResourceRecords??[]){let s=i.Value;(a==="CNAME"||a==="NS"||a==="MX"||a==="SRV")&&s.endsWith(".")&&(s=s.slice(0,-1));let c={name:o,type:a,value:s};if(n.TTL!==void 0&&(c.ttl=n.TTL),a==="MX"){let l=s.split(/\s+/);l.length>=2&&(c.priority=parseInt(l[0],10),c.value=l.slice(1).join(" "),c.value.endsWith(".")&&(c.value=c.value.slice(0,-1)))}a==="TXT"&&(c.value=s.replace(/^"(.*)"$/,"$1")),r.push(c)}}return r}var myn,PQ,hyn,gyn,K3=w(()=>{"use strict";at();ue();at();myn=Object.defineProperty,PQ=(e,t)=>myn(e,"name",{value:t,configurable:!0}),hyn=new Set(pk.options);PQ(WZt,"isSupportedRecordType");PQ(OQ,"findHostedZoneId");gyn=1e3;PQ(TQe,"listHostedZones");PQ(yyn,"listRoute53Records");PQ(vyn,"convertRoute53Records")});import{Route53Client as byn}from"@aws-sdk/client-route-53";import{CloudFormationClient as Eyn}from"@aws-sdk/client-cloudformation";import{ACMClient as Ayn}from"@aws-sdk/client-acm";function zZt(e,t){let r=e.getCredentials(),n=new Map;for(let a of new Set(t))n.set(a,new Ayn({region:a,...r!==void 0?{credentials:{accessKeyId:r.accessKeyId,secretAccessKey:r.secretAccessKey,sessionToken:r.sessionToken}}:{},maxAttempts:3,requestHandler:new aa({requestTimeout:3e4,connectionTimeout:1e4})}));return n}function RAe(e,t){let r;try{r=_r.loadConfig(t)}catch(a){return be(`fjall-config.json could not be loaded: ${k(a)} \u2014 declared delegated children are unknown, so zone classification is account-local only`,{scope:ce.domainSync}),[]}if(r.isContentUnavailable()){let a=r.getConfigPath()??"fjall-config.json";return be(`fjall-config.json at ${a} exists but could not be read or its recognised keys are malformed \u2014 declared delegated children are unknown, so zone classification is account-local only`,{scope:ce.domainSync}),[]}let n=xr(e);return r.getDomains().filter(a=>a.type==="delegated"&&a.parentDomain!==void 0&&xr(a.parentDomain)===n).map(a=>({zoneName:xr(a.name),...a.account!==void 0?{accountId:a.account}:{},...a.region!==void 0?{region:a.region}:{}}))}async function RS(e){let{domainName:t,abortSignal:r,onPhase:n}=e,a=ze.getCurrent()??await ze.initialise(),o=a.getClient(byn),i=e.hostedZoneId??await OQ(o,t,r);if(i===void 0)return g(new Error(`domain sync: no Route53 hosted zone found for '${t}' in this account \u2014 deploy the domain stack first ('fjall domain deploy ${t}') or pass the zone id explicitly with --hosted-zone-id <id>`));let s=$I(t),c=s.success&&s.data!==void 0?s.data.cloudformationStackName:yn(t),l=RAe(t,e.configStartDir),u=await O7({zone:{hostedZoneId:i,zoneName:t},domainStackName:c,clients:{route53:o,cloudFormation:a.getClient(Eyn),acmByRegion:zZt(a,[a.getRegion(),wyn])},...l.length>0?{delegatedChildren:l,childAccountClientFactory:H3()}:{},...r!==void 0?{abortSignal:r}:{},...n!==void 0?{onPhase:n}:{}});return u.success?E(u.data):g(u.error)}var Syn,xQe,wyn,V1=w(()=>{"use strict";_m();at();$();Io();Dt();ae();le();or();_i();CQe();K3();pA();Syn=Object.defineProperty,xQe=(e,t)=>Syn(e,"name",{value:t,configurable:!0}),wyn="us-east-1";xQe(zZt,"buildAcmClients");xQe(RAe,"enumerateDelegatedChildren");xQe(RS,"classifyLiveZone")});import{existsSync as Tyn,readFileSync as xyn}from"fs";import{Route53Client as kyn,ListHostedZonesByNameCommand as Iyn,ChangeResourceRecordSetsCommand as Ryn}from"@aws-sdk/client-route-53";import{STSClient as _yn,AssumeRoleCommand as Pyn}from"@aws-sdk/client-sts";import{DescribeStacksCommand as Oyn}from"@aws-sdk/client-cloudformation";function qI(e){let t=ep(e);if(!Tyn(t))return g(new Error(`Domain '${e}': infrastructure.ts not found at ${t}. Import or create the domain first ('fjall domain create ${e}').`));let r;try{r=xyn(t,"utf-8")}catch(a){return g(new Error(`Domain '${e}': could not read ${t}: ${b(k(a))}`))}let n=AC(r,t,e);return n.success?E(n.data):g(new Error(b(n.error.message)))}function q3(e){let t=qI(e);return t.success?E(GN(t.data)):g(t.error)}function DQ(e,t){return new Wo(`Parent zone ${e}: its DelegationRole could not be resolved (${b(t)}). Nothing was deployed. Cures: run 'fjall connect' to add credentials for the parent account, run 'fjall domain deploy ${e}' to publish the delegation-role export, or set a literal parentDelegationRoleArn in the child's infrastructure.ts.`,"delegation_role_unusable",{parentZoneName:e})}async function kQe(e,t,r,n,a){let o=await n(t,r);if(!o.success)return g(o.error);let i=yn(e);try{let s=await o.data.cloudFormation.send(new Oyn({StackName:i}),a!==void 0?{abortSignal:a}:{}),c=new Map;for(let l of s.Stacks?.[0]?.Outputs??[])l.ExportName!==void 0&&l.OutputValue!==void 0&&c.set(l.ExportName,l.OutputValue);return E(c)}catch(s){return nf(s)?E(void 0):g(new Error(`DescribeStacks on '${i}' in account ${t} failed: ${b(k(s))}`))}}async function HZt(e,t,r,n){let a=n.clientFactory??H3(),o=await kQe(e,t,r,a,n.abortSignal);if(!o.success)return g(DQ(e,o.error.message));if(o.data===void 0)return g(DQ(e,`no deployed stack '${yn(e)}' in account ${t}`));let i=Fo(e).delegationRoleArn,s=o.data.get(i);return s===void 0||s===""?g(DQ(e,`stack '${yn(e)}' in account ${t} publishes no '${i}' export`)):E(s)}async function Y3(e,t={}){if(t.childDomainName!==void 0){let i=qI(t.childDomainName);if(i.success&&i.data.registrar==="external-delegated"&&i.data.parentDelegationRoleArn!==void 0&&i.data.parentDelegationRoleArn!=="")return E({managed:!0,delegationRoleArn:i.data.parentDelegationRoleArn,source:"literal"})}let r,n;try{let i=_r.loadConfig().getDomain(e);r=i?.account,n=i?.region}catch{}if(r!==void 0){let i;try{i=(ze.getCurrent()??await ze.initialise()).getAccountId()}catch(s){return g(DQ(e,`AWS authentication required: ${k(s)}`))}if(r!==i){let s=await HZt(e,r,n,t);return s.success?E({managed:!0,delegationRoleArn:s.data,source:"cross-account"}):g(s.error)}}let a=await La().resolveDomainForApp(e,t.abortSignal!==void 0?{abortSignal:t.abortSignal}:{});if(!a.success)return g(a.error);if(a.data===void 0)return E({managed:!1,source:"ambient"});let o=a.data.delegationRoleArn;return E({managed:!0,...o!==void 0&&o!==""?{delegationRoleArn:o}:{},source:"ambient"})}async function IQe(e,t={}){let r=Dh((d,p,m)=>({status:"unavailable",reason:b(d),cure:b(p),declaredChildren:m}),"unavailable"),n=La().resolveManagedDomainMatch(e);if(!n.success)return E(r(n.error.message,`fix fjall-config.json, then re-run 'fjall domain verify ${e}'`,[]));if(n.data?.matched!==e||!n.data.hasLocalDeclaration)return E(void 0);let a=qI(e);if(!a.success)return E(r(a.error.message,`fix ${ep(e)}, then re-run 'fjall domain verify ${e}'`,[]));let o,i;try{let d=_r.loadConfig(t.startDir);if(d.isContentUnavailable()){let m=d.getConfigPath()??"fjall-config.json";return E(r(`fjall-config.json at ${m} exists but could not be read or its recognised keys are malformed, so declared delegated children are unknown`,`fix ${m} (permissions or contents), then re-run 'fjall domain verify ${e}'`,[]))}let p=d.getDomain(e);o=p?.account,i=p?.region}catch(d){return E(r(`fjall-config.json could not be loaded: ${k(d)}`,`fix fjall-config.json, then re-run 'fjall domain verify ${e}'`,[]))}let s=RAe(e,t.startDir).map(d=>d.zoneName);if(s.length===0)return E(void 0);let c;if(o!==void 0){let d;try{d=(ze.getCurrent()??await ze.initialise()).getAccountId()}catch(p){return E(r(`AWS authentication required: ${k(p)}`,"run 'fjall connect' to include it",s))}c=o!==d?await kQe(e,o,i,t.clientFactory??H3(),t.abortSignal):await La().readDomainStackOutputs(e,{...t.abortSignal!==void 0?{abortSignal:t.abortSignal}:{}})}else c=await La().readDomainStackOutputs(e,{...t.abortSignal!==void 0?{abortSignal:t.abortSignal}:{}});if(!c.success)return E(r(c.error.message,"run 'fjall connect' to include it",s));if(c.data===void 0)return E(void 0);let l=Fo(e).delegationRoleArn,u=c.data.get(l);return E({status:u!==void 0&&u!==""?"published":"missing",declaredChildren:s})}function _Ae(){return async e=>{let t;try{t=ze.getCurrent()??await ze.initialise()}catch(r){return g(new Error(`AWS authentication required: ${b(k(r))}. Run 'fjall connect' and retry.`))}try{let r=(await t.getClient(_yn).send(new Pyn({RoleArn:e,RoleSessionName:"fjall-domain-delegation"}))).Credentials;return r?.AccessKeyId===void 0||r.SecretAccessKey===void 0?g(new Error(`AssumeRole on '${e}' returned no credentials \u2014 verify the role exists and trusts this account (it is created by the parent Domain stack).`)):E(new kyn({region:"us-east-1",credentials:{accessKeyId:r.AccessKeyId,secretAccessKey:r.SecretAccessKey,...r.SessionToken!==void 0?{sessionToken:r.SessionToken}:{}}}))}catch(r){return g(new Error(b(k(r))))}}}async function RQe(e){if(e.nameServers.length===0)return g(new Error(`Delegation for ${e.childZoneName}: the child zone reports no name servers \u2014 deploy the child zone first ('fjall domain deploy ${e.childZoneName}').`));let t=await(e.clientFactory??_Ae())(e.delegationRoleArn);if(!t.success)return g(new Error(`Delegation for ${e.childZoneName}: could not assume the parent DelegationRole ${e.delegationRoleArn}: ${b(k(t.error))}. Cure: verify the role exists and trusts this account, or add the NS records at the parent by hand.`));let r=t.data,n=e.abortSignal!==void 0?{abortSignal:e.abortSignal}:{},a;try{let o=((await r.send(new Iyn({DNSName:e.parentZoneName,MaxItems:100}),n)).HostedZones??[]).filter(i=>i.Name!==void 0&&xr(i.Name)===xr(e.parentZoneName));a=(o.find(i=>i.Config?.PrivateZone!==!0)??o[0])?.Id?.replace("/hostedzone/","")}catch(o){return g(new Error(`Delegation for ${e.childZoneName}: could not locate parent zone ${e.parentZoneName}: ${b(k(o))}`))}if(a===void 0)return g(new Error(`Delegation for ${e.childZoneName}: no hosted zone named '${e.parentZoneName}' is visible to the parent DelegationRole \u2014 verify the parent domain stack is deployed ('fjall domain deploy ${e.parentZoneName}').`));try{await r.send(new Ryn({HostedZoneId:a,ChangeBatch:{Comment:`fjall domain delegate: NS delegation for ${e.childZoneName}`,Changes:[{Action:"UPSERT",ResourceRecordSet:{Name:e.childZoneName,Type:"NS",TTL:Dyn,ResourceRecords:e.nameServers.map(o=>({Value:o}))}}]}}),n)}catch(o){return g(new Error(`Delegation for ${e.childZoneName}: the NS UPSERT into ${e.parentZoneName} failed: ${b(k(o))}`))}return E({parentHostedZoneId:a})}async function PAe(e,t,r={}){let n=await La().readDomainStackOutputs(e,r);return n.success?E(VN(n.data,t)):g(n.error)}function NQ(e,t={}){let r=q3(e);if(!r.success||r.data===void 0)return;let n=r.data;return{zoneName:n.childZoneName,async deployPhase(a,o){let i=await Y3(n.parentZoneName,{childDomainName:e,...t});if(!i.success)return g(i.error);if(!i.data.managed)be(`Parent zone ${n.parentZoneName} is not a managed domain here (Case 3) \u2014 no delegation record is written in-stack; delegate ${n.childZoneName} at the parent with 'fjall domain delegate ${e}' after the zone phase`,{scope:ce.domainDeploy});else if(i.data.source==="literal")o.onProgress?.({type:"info",message:`Using the literal parentDelegationRoleArn declared in ${e}'s infrastructure.ts for the ${n.parentZoneName} delegation`});else if(i.data.delegationRoleArn===void 0)return g(new Wo(`Parent domain stack for ${n.parentZoneName} publishes no delegation-role export - the child NS delegation for ${n.childZoneName} cannot be written in-stack. Nothing was deployed. Cures: run 'fjall connect' to add credentials for the parent account, run 'fjall domain deploy ${n.parentZoneName}' to publish the delegation-role export, or set a literal parentDelegationRoleArn in the child's infrastructure.ts.`,"delegation_role_unusable",{parentZoneName:n.parentZoneName}));let s=await La().deployDomain(e,{onProgress:Dh(c=>{o.onProgress?.({type:c.type,message:b(`[${n.childZoneName}] ${c.message??""}`)})},"onProgress")},{phase:a,...i.data.delegationRoleArn!==void 0&&i.data.source!=="literal"?{parentDelegationRoleArn:i.data.delegationRoleArn}:{}});if(!s.success)return g(new Error(s.error.message));if(a==="full"){let c=E0(e);c.success||be(`[${n.childZoneName}] deploy succeeded but recording deploy state failed: ${c.error.message} \u2014 the next cascade will re-deploy this domain`,{scope:ce.domainDeploy})}return E(void 0)},async zonePhaseState(){return PAe(e,n.childZoneName,t)}}}var Cyn,Dh,Dyn,W1=w(()=>{"use strict";at();ue();$();Io();Dt();or();ae();_i();CQe();hd();Le();Cr();pA();V1();Cyn=Object.defineProperty,Dh=(e,t)=>Cyn(e,"name",{value:t,configurable:!0}),Dyn=172800;Dh(qI,"parseDomainInfrastructure");Dh(q3,"readDelegatedTopology");Dh(DQ,"delegationRoleUnusable");Dh(kQe,"readForeignDomainStackOutputs");Dh(HZt,"resolveCrossAccountDelegationRole");Dh(Y3,"resolveParentDelegation");Dh(IQe,"auditParentDelegationRole");Dh(_Ae,"createDelegationRoute53ClientFactory");Dh(RQe,"upsertChildNsIntoParent");Dh(PAe,"readDelegatedZonePhaseState");Dh(NQ,"buildDelegatedDomainDeployer")});import{resolve as $yn}from"node:path";var Nyn,_Qe,OAe,KZt=w(()=>{"use strict";at();Io();$();Dt();or();Le();Cr();pA();xEe();W1();Nyn=Object.defineProperty,_Qe=(e,t)=>Nyn(e,"name",{value:t,configurable:!0}),OAe=class{static{_Qe(this,"CliDomainDeployProvider")}getDomains(){return _r.loadConfig().getDomains().map(t=>({name:t.name,type:t.type,...t.parentDomain!==void 0?{parentDomain:t.parentDomain}:{},...t.account!==void 0?{account:t.account}:{},...t.region!==void 0?{region:t.region}:{}}))}delegatedDeployer(t){return NQ(t)}async synthForTakeover(t,r){let n=await La().synthDomain(t,{onProgress:_Qe(a=>{r.onProgress?.({type:a.type,message:b(`[${t}] ${a.message??""}`)})},"onProgress")});return n.success?E({stackNames:[yn(t)],cdkOutPath:$yn(to(t),"cdk.out")}):g(new Error(n.error.message))}async deployDomain(t,r){let n=await La().deployDomain(t,{onProgress:_Qe(o=>{r.onProgress?.({type:o.type,message:b(`[${t}] ${o.message??""}`)})},"onProgress")});if(!n.success)return g(new Error(n.error.message));let a=E0(t);return a.success||be(`[${t}] deploy succeeded but recording deploy state failed: ${a.error.message} \u2014 the next cascade will re-deploy this domain`,{scope:ce.domainDeploy}),await MI([t],o=>{r.onProgress?.({type:"info",message:o})}),E(void 0)}}});function PQe(e,t){return{id:e,oidcRoleArn:t}}async function qZt(e){if(e.environment!==void 0)return Nw(e.environment)?E(e.environment):g(new na(`Invalid environment "${b(e.environment)}" \u2014 expected one of: ${yv()}`));let t=await e.onStandaloneEnvironmentRequired?.();return E(t??G1)}var Myn,$Q,Up,MQ,OQe=w(()=>{"use strict";Io();Le();vQe();he();$();xi();bQe();at();ae();Pr();HI();le();Mp();T1();W3();aA();md();Rn();UZt();KZt();pA();Myn=Object.defineProperty,$Q=(e,t)=>Myn(e,"name",{value:t,configurable:!0}),Up="OrgDeploy",MQ=class{static{$Q(this,"OrganisationDeployService")}state;setupService;adapter;constructor(t,r,n){this.state=t,this.setupService=r,this.adapter=n}async deploy(t,r={},n){let a=new da(void 0);try{let o=_r.loadConfig(),i=n,{providerAccounts:s,primaryRegion:c}=_Q(i),l=c,u=t.type===ar.ACCOUNT&&s.length===0;if(t.type===ar.ACCOUNT&&!u&&r.environment!==void 0)return g(new na("--environment applies only to a standalone account registration. This account is already registered with your organisation \u2014 its stage is managed in the org registry (fjall connect or the web app)."));let d=G1;if(u){let V=await qZt(r);if(!V.success)return V;d=V.data}let{platformAccount:p,memberAccounts:m}=Ip(s),f=m.length>0,y=p!==void 0,v={deploymentType:t.type,operation:"deploy",deployOnly:!1,infraOnly:!1,isManagedAccount:!1,hasDockerfile:!1,hasMemberAccounts:f,hasPlatformAccount:y},S=new z3(v,r),A=await V3(S,t);if(!A.success)return A;let C=await S.executeStep(ge.AUTH,async()=>{let V=await B3(this.state,t,o,r,i?.primaryRegion,i);return V.success?(l=V.data,{success:!0}):{success:!1,error:V.error.message}});if(!C.success)return g(new Xn(C.error??"Authentication failed",t.type,t.target,ge.AUTH));let T=KI(this.state),x=await a.recordStart({target:t.target,type:u?"infrastructure":"organisation",awsAccountId:T?.Account});if(x.blocked)return g(new Xn(mA(x),t.type,t.target,JX(x.refusal),x.details!==void 0?{blockedDeployment:x.details}:void 0));if(u){let V=rt.fromCredentials();if(V){let W=await wQe(V);if(W)return g(new Xn(W,t.type,t.target,"entitlement"))}}let R=0,I;if(t.type===ar.ORGANISATION){let V=await this.setupService.runOrganisationSetup(S,r,i);if(!V.success)return g(V.error);R=V.data.accountsCount,I=V.data.orgDetails?.managementAccountId;let W=await va().getOrgConfig({forceRefresh:!0});W.success?(i=GG(W.data,r.acknowledgeImmutableVaultLock)??W.data,P.info(Up,"Refreshed orgConfig after setup \u2014 cascade will use updated accounts",{accountCount:i.providerAccounts?.length??0})):P.warn(Up,"Failed to refresh orgConfig after setup \u2014 cascade uses pre-setup state",{error:b(W.error.message)});let{platformAccount:U,memberAccounts:J}=Ip(i?.providerAccounts??[]),te=VJe(o.getDomains());r.onChangeDetectionComplete?.({hasOrgChanges:!1,hasPlatformChanges:U!==void 0,hasAccountChanges:J.length>0,hasMemberAccounts:J.length>0,hasPlatformAccount:U!==void 0,hasDomainChanges:te.hasChanges,hasDomainConfiguration:te.hasConfiguration,changedDomainNames:te.deployable.filter(Y=>Y.verdict==="changed").map(Y=>Y.name),unprovableDomainNames:te.deployable.filter(Y=>Y.verdict==="unprovable").map(Y=>Y.name)})}let D=await G3(),O=await U3(t,{type:t.type,target:t.target,path:t.path,callerIdentity:KI(this.state),region:l,fjallOrgId:D,managementAccountId:I,...i&&{orgConfig:qo.serialise(i)}},{providerAccounts:i?i.providerAccounts??[]:void 0,mode:"deploy"});if(Vn(O))return g(O.error);if(!this.state.aws)return g(new Xn("AWS context not available after authentication",t.type,t.target,"deploy"));let N=r.onCascadeAccountComplete,M=r.onTrailLifecycleChanged,L={...r,onTrailLifecycleChanged:$Q((V,W,U)=>{if(M?.(V,W,U),!u){if(i?.providerAccounts?.some(J=>J.id===V)!==!0){P.warn(Up,`Trail lifecycle transition for account ${V} not persisted \u2014 account missing from local org-config snapshot; the next webapp-driven deploy or fjall run with a fresh org config will re-derive it`,{accountId:V,...W!==void 0&&{from:W},to:U});return}I0({providerAccounts:[{id:V,trailLifecycle:U}]},Up).catch(J=>{P.warn(Up,"Trail lifecycle persistence failed (non-critical)",{accountId:V,error:b(k(J))})})}},"onTrailLifecycleChanged"),onCascadeAccountComplete:$Q((V,W,U,J,te,Y)=>{if(N?.(V,W,U,J,te,Y),W&&te&&Y&&!u){let ne=te[TAe];ne&&I0({providerAccounts:[PQe(Y,ne)]},Up).catch(re=>{P.warn(Up,"Per-account registration failed (non-critical)",{accountId:Y,error:b(k(re))})})}},"onCascadeAccountComplete")},F=await this.adapter.deployOrganisation(t.target,process.cwd(),this.state.aws,L,i,a,D,new OAe);if(!F.success){let V=b(F.error.message);return await a.safeRecord(Up,"recordFailure",()=>a.recordFailure(V)),r.onProgress?.({type:"error",message:`Organisation deploy failed: ${V}`}),g(new Xn(V,t.type,t.target,"deploy"))}if(F.data.cancelled===!0)return await a.safeRecord(Up,"recordCancelled",()=>a.recordCancelled()),E({type:t.type,target:t.target,stackName:pn(t.type),region:l,cancelled:!0});if(F.data.destructionPending===!0)return await a.safeRecord(Up,"recordFailure",()=>a.recordFailure("Domain record takeover withheld pending named consent \u2014 the domains phase and member cascade were not applied")),E({type:t.type,target:t.target,stackName:pn(t.type),region:l,destructionPending:!0,...F.data.destructionTicket!==void 0?{destructionTicket:F.data.destructionTicket}:{},...F.data.destructionOutcome!==void 0?{destructionOutcome:F.data.destructionOutcome}:{},...F.data.destructionHaltReasons!==void 0?{destructionHaltReasons:F.data.destructionHaltReasons}:{}});if(!u){let V=F.data.outputs?.[TAe];if(V){let W=T?.Account;W&&await I0({providerAccounts:[PQe(W,V)]},Up)}}if(u)try{let V=T?.Account,W=rt.fromCredentials();if(V&&W){await AQe(W,V,t.target);let U=F.data.outputs?.[TAe];U&&(await I0({primaryRegion:l,rootOidcRoleArn:U,providerAccounts:[{id:V,name:t.target??"standalone",environment:d,oidcRoleArn:U}]},Up),r.onProgress?.({type:"info",message:"OIDC credentials configured \u2014 subsequent commands will use short-lived credentials"})),await EQe(W,process.cwd())}}catch(V){P.warn(Up,"Post-deploy registration failed (non-critical)",{error:b(k(V))})}await a.safeRecord(Up,"recordSuccess",()=>a.recordSuccess());let G={type:t.type,target:t.target,stackName:pn(t.type),region:l,...F.data.noChanges===!0?{noChanges:!0}:{},...R>0&&{accountsSync:{count:R,syncedAt:new Date}}};return E(G)}catch(o){return await a.safeRecord(Up,"recordFailure",()=>a.recordFailure(b(k(o)))),o instanceof Xn||o instanceof na||o instanceof Na||o instanceof nC?g(o):g(new Xn(b(k(o)),t.type,t.target,"deploy",o,!1,o instanceof Error?o:void 0))}}};$Q(PQe,"buildRegistrationEntry");$Q(qZt,"resolveStandaloneEnvironment")});var YZt=w(()=>{"use strict";at()});var Lyn,Fyn,LQ,DQe=w(()=>{"use strict";Io();Dt();or();Le();xi();bQe();at();ae();Pr();HI();vQe();md();YZt();le();he();$();Mp();T1();W3();Lyn=Object.defineProperty,Fyn=(e,t)=>Lyn(e,"name",{value:t,configurable:!0}),LQ=class{static{Fyn(this,"OrganisationDestroyService")}state;adapter;constructor(t,r){this.state=t,this.adapter=r}async destroy(t,r={},n){let a=new da(void 0);try{let o=_r.loadConfig(),i=un(),{providerAccounts:s,primaryRegion:c}=_Q(n),l=c,{platformAccount:u,memberAccounts:d}=Ip(s),p=d.length>0,m=u!==void 0,f={deploymentType:t.type,operation:"destroy",deployOnly:!1,infraOnly:!1,isManagedAccount:!1,hasDockerfile:!1,hasMemberAccounts:p,hasPlatformAccount:m},y=new z3(f,r),v=await V3(y,t);if(!v.success)return v;let S=await y.executeStep(ge.AUTH,async()=>{let N=await B3(this.state,t,o,r,n?.primaryRegion,n);return N.success?(l=N.data,{success:!0}):{success:!1,error:N.error.message}});if(!S.success)return g(new Xn(S.error??"Authentication failed",t.type,t.target,ge.AUTH));let A=KI(this.state),C=await a.recordStart({target:t.target,type:"infrastructure",awsAccountId:A?.Account,operation:"destroy"});if(C.blocked)return g(new Xn(mA(C),t.type,t.target,JX(C.refusal),C.details!==void 0?{blockedDeployment:C.details}:void 0));let T,x=await y.executeStep(ge.CFN_CHECK,async()=>{if(t.type===ar.ORGANISATION){let M=await z1().ensureOrganisationExists({onProgress:r.onProgress});M.success?T={orgId:M.data.orgId,rootId:M.data.rootId,managementAccountId:M.data.managementAccountId}:(P.warn("OrganisationDestroy","Failed to fetch org details for destroy context",{error:b(M.error.message)}),be(`Could not fetch organisation details: ${M.error.message} \u2014 destroy will proceed without full context`,{scope:ce.deploy}))}let N=await i.checkCloudFormationState({deployType:t.type,target:t.target,path:t.path});return N.success?{success:!0,message:"Deployment target verified"}:{success:!1,error:N.error.message}});if(!x.success)return g(new Xn(String(x.error),t.type,t.target,ge.CFN_CHECK));let R={type:t.type,target:t.target,path:t.path,callerIdentity:KI(this.state),region:l,orgId:T?.orgId,rootId:T?.rootId,managementAccountId:T?.managementAccountId,fjallOrgId:await G3(),...n&&{orgConfig:qo.serialise(n)}},I=await U3(t,R,{providerAccounts:n?n.providerAccounts??[]:void 0,mode:"destroy"});if(Vn(I))return g(I.error);if(this.state.aws&&await this.state.aws.refreshIfNeeded(),!this.state.aws)return g(new Xn("AWS context not available after authentication",t.type,t.target,"destroy"));let D=await this.adapter.destroyOrganisation(t.target,process.cwd(),this.state.aws,r,n,a);if(!D.success){let N=b(D.error.message);return await a.safeRecord("OrganisationDestroy","recordFailure",()=>a.recordFailure(N)),r.onProgress?.({type:"error",message:`Organisation destroy failed: ${N}`}),g(new Xn(N,t.type,t.target,"destroy",void 0,!1,D.error))}if(D.data.cancelled===!0)return await a.safeRecord("OrganisationDestroy","recordCancelled",()=>a.recordCancelled()),E({type:t.type,target:t.target,stackName:pn(t.type),region:R.region,cancelled:!0});try{await SD(t.path)}catch(N){let M=b(k(N));P.warn("OrganisationDestroy","Failed to delete state file after successful destroy",{path:t.path,error:M}),be(`Failed to clean up state file: ${M}`,{scope:ce.deploy})}await a.safeRecord("OrganisationDestroy","recordSuccess",()=>a.recordSuccess());let O={type:t.type,target:t.target,stackName:pn(t.type),region:R.region};return E(O)}catch(o){return await a.safeRecord("OrganisationDestroy","recordFailure",()=>a.recordFailure(b(k(o)))),o instanceof Xn||o instanceof na||o instanceof nC?g(o):g(new Xn(b(k(o)),t.type,t.target,"destroy",o))}}}});import{OrganizationsClient as Byn}from"@aws-sdk/client-organizations";function JZt(e,t){let r=e?.providerAccounts??[],n=kAe(r),a=t??[...new Set(r.map(i=>Sv(i)).filter(i=>i!==wm.ROOT&&i!=="organisation"))],o=r.filter(i=>pr(i)!=="organisation").map(i=>({id:i.id,name:i.name,environment:Sv(i)}));return{accounts:[],platformAccountId:n,organisationalUnits:a,accountPlacements:o,skipIdentityCentre:!1,...e?.rootAccessManagement==="off"&&{skipRootAccessManagement:!0}}}function ZZt(e){let t=new Map;return{onPhaseStart:_0(r=>{let n=NQe[r];n&&e.onOrgSetupProgress?.({type:n,phase:"started"})},"onPhaseStart"),onPhaseComplete:_0((r,n)=>{let a=NQe[r];if(a){let o=n==="completed"?"complete":n==="skipped"?"skipped":"error",i=t.get(r);e.onOrgSetupProgress?.({type:a,phase:o,...i!==void 0&&{detail:i}})}},"onPhaseComplete"),onProgress:_0(r=>{e.onProgress?.({type:"info",message:b(r)})},"onProgress"),onWarning:_0((r,n)=>{t.set(r,b(n)),be(n,{scope:ce.deploy})},"onWarning"),onError:_0((r,n)=>{let a=NQe[r];a&&e.onOrgSetupProgress?.({type:a,phase:"error",message:b(n.message)})},"onError")}}var jyn,_0,NQe,FQ,$Qe=w(()=>{"use strict";at();Dt();or();Le();at();W3();$();xi();ki();ae();HI();le();at();jyn=Object.defineProperty,_0=(e,t)=>jyn(e,"name",{value:t,configurable:!0});_0(JZt,"buildOrgSetupConfig");NQe={"create-organisation":"org-ensure","enable-policies":"policy-types","enable-service-access":"service-access","enable-root-access":"root-access","enable-ram-sharing":"ram-sharing","activate-trusted-access":"trusted-access","enable-ipam":"ipam-delegate","configure-backup":"backup-settings","create-accounts":"create-accounts","create-organisational-units":"ensure-ous","place-accounts":"place-accounts","activate-cost-tags":"cost-tags","check-identity-centre":"identity-centre","register-security-delegates":"security-delegates"};_0(ZZt,"buildOrgSetupCallbacks");FQ=class{static{_0(this,"OrganisationSetupService")}state;constructor(t){this.state=t}async runOrganisationSetup(t,r,n){let a=MQe(),o,i=0,s=await t.executeStep(ge.ORG_SETUP,async()=>{let c=this.buildAwsProvider();if(!c.success)return{success:!1,error:c.error.message};let l=await l0(process.cwd()),u=l.success&&l.data?dG(l.data):void 0,d=JZt(n,u),p=ZZt(r),m=c.data,f=m.getClient(Byn),y=await mE(f);if(!y.success)return r.onOrgSetupProgress?.({type:"org-ensure",phase:"error",message:b(y.error.message)}),{success:!1,error:y.error.message};o={orgId:y.data.orgId,rootId:y.data.rootId,managementAccountId:y.data.managementAccountId};let v=await bZ(m,d,p);if(!v.success)return{success:!1,error:v.error.message};let S=v.data;S.errors.length>0&&be(`Organisation setup phase errors: ${S.errors.map(x=>`${x.phase}: ${x.error}`).join("; ")}`,{scope:ce.deploy}),r.onOrgSetupProgress?.({type:"accounts",phase:"started"});let{onProgress:A}=r,C=await a.syncOrganisationAccounts({onProgress:A?x=>A({...x,message:b(x.message)}):void 0,onAccountsRetrieved:_0(x=>r.onAccountSync?.(`Retrieved ${x} accounts`,[]),"onAccountsRetrieved")});if(C.success)i=C.data.accounts.length,C.data.accounts.length>0&&await I0({providerAccounts:C.data.accounts},"OrgSetup");else{if(!C.error.recoverable)return r.onOrgSetupProgress?.({type:"accounts",phase:"error",message:b(C.error.message)}),{success:!1,error:C.error.message};be(`Account sync failed (recoverable): ${C.error.message}`,{scope:ce.deploy})}let T=C.success?i>0?`Synchronised ${i} accounts`:"Accounts synchronised":"Account sync skipped (will retry on next deploy)";return r.onOrgSetupProgress?.({type:"accounts",phase:"complete",detail:T}),r.onIdentityCentreCheck?.("Identity Centre checked",S.identityCentreStatus==="enabled"),{success:!0,message:"Organisation setup complete"}});if(!s.success){let c="error"in s?b(k(s.error)):"Organisation setup failed";return g(new Xn(c,ar.ORGANISATION,void 0,"orgSetup"))}return E({orgDetails:o,accountsCount:i})}buildAwsProvider(){let t=this.state.aws?.getCredentials();if(!t?.accessKeyId||!t?.secretAccessKey)return g(new Xn("AWS credentials not available. Ensure authentication is complete.",ar.ORGANISATION,void 0,"orgSetup"));let r=this.state.aws?.getRegion()??At,n=this.state.aws?.getAuthResult()?.account;return n?E(new bi({accessKeyId:t.accessKeyId,secretAccessKey:t.secretAccessKey,sessionToken:t.sessionToken,region:r,accountId:n})):g(new Xn("AWS account ID not available. Ensure authentication completed successfully.",ar.ORGANISATION,void 0,"orgSetup"))}}});var Uyn,XZt,H1,J3,LQe=w(()=>{"use strict";Le();$();ae();Pr();Uyn=Object.defineProperty,XZt=(e,t)=>Uyn(e,"name",{value:t,configurable:!0}),H1=class extends Ke{static{XZt(this,"EcsDeploymentError")}appName;operation;constructor(t,r,n,a,o){super("ECS_DEPLOYMENT_ERROR",t,a,o??!1),this.appName=r,this.operation=n}},J3=class{static{XZt(this,"EcsDeploymentService")}async deployStacksWithBuildInParallel(t,r,n,a,o){let i=FQe(),s=a(t,n,{onOutput:o?.onOutput?(y,v)=>o.onOutput?.(y,v):void 0,onResourceProgress:o?.onResourceProgress}),c=Date.now(),l=i.build({appPath:r.appPath,configPath:r.configPath,env:r.env},{onProgress:o?.onBuildProgress?y=>o.onBuildProgress?.(y.message):void 0,onBuildOutput:o?.onBuildOutput}),[u,d]=await Promise.allSettled([s,l]);if(u.status==="rejected")return g(new H1(`Parallel stack deployment failed: ${b(String(u.reason))}`,n.target,"parallel-deploy"));if(!u.value.success)return g(new H1(`Stack deployment failed: ${b(u.value.error.message)}`,n.target,"parallel-deploy"));let p=u.value.data,m=Date.now()-c,f=d.status==="fulfilled"?{success:d.value.success,error:d.value.success?void 0:d.value.error,duration:m,data:d.value.success?d.value.data:void 0}:{success:!1,error:d.reason instanceof Error?new Error(b(d.reason.message)):new Error(b(String(d.reason))),duration:m,data:void 0};return E({stackResults:p,buildResult:f})}}});import{CloudFormationClient as Vyn}from"@aws-sdk/client-cloudformation";import{EC2Client as Wyn}from"@aws-sdk/client-ec2";function DAe(e){switch(e.kind){case"missing-account-stack":return"account stack missing";case"missing-ipam-pool":return"IPAM pool missing"}}function nXt(e){let t=eXt.then(e,e);return eXt=t.then(()=>{},()=>{}),t}async function jQe(e){let t=ze.getCurrent(),r=new Map(uX.map(n=>[n,process.env[n]]));try{return await e()}finally{ze.getCurrent()!==t&&ze.clear();for(let n of uX){let a=r.get(n);a===void 0?delete process.env[n]:process.env[n]=a}}}function aXt(e,t){if(e.ssoSession===void 0)return!1;let r=t.ssoSessions?.[e.ssoSession];return r===void 0?!1:new qG().getToken(r.ssoStartUrl)!==null}async function oXt(e,t){try{let r=await Tu(e.name,void 0,async()=>E(t));if(!r.success){P.debug(jQ,"Readiness probe could not resolve a profile",{target:e.name,error:b(r.error.message)});return}let n=r.data;return n.type==="sso"&&!aXt(n,t)?void 0:(await ze.initialise({profileData:n,region:e.region})).getCredentials()}catch(r){P.debug(jQ,"Readiness probe credential resolution failed",{target:e.name,error:b(k(r))});return}}async function BQe(e,t,r){let n=await nXt(()=>oXt(e,t));if(n===void 0)return{state:"unknown",note:zyn};let a=AbortSignal.timeout(r);try{let o=await pD({cloudFormation:new Vyn({region:e.region,credentials:n}),ec2:new Wyn({region:Eh(t),credentials:n})},{id:e.accountId,name:e.accountName},e.region,t,a);return o.success?o.data.ready?{state:"ready"}:{state:"unready",reasons:o.data.reasons,advisory:L9({accountId:e.accountId,accountName:e.accountName,region:e.region,reasons:o.data.reasons,providerAccounts:t.providerAccounts})}:a.aborted?(P.debug(jQ,"Readiness probe exceeded its budget",{target:e.name,budgetMs:r}),{state:"unknown",note:QZt}):{state:"unknown",note:b(o.error.message)}}catch(o){if(a.aborted)return P.debug(jQ,"Readiness probe exceeded its budget",{target:e.name,budgetMs:r}),{state:"unknown",note:QZt};let i=b(k(o));return P.debug(jQ,"Readiness probe failed (advisory only)",{target:e.name,error:i}),{state:"unknown",note:i}}}function K1(e,t,r=rXt){return jQe(()=>BQe(e,t,r))}function BQ(e,t){return jQe(async()=>{let r=await hv(e,tXt,a=>BQe(a,t,rXt)),n=new Map;return r.forEach((a,o)=>{let i=e[o];i&&n.set(i.name,a.status==="fulfilled"?a.value:{state:"unknown",note:b(a.reason instanceof Error?a.reason.message:String(a.reason))})}),n})}var Gyn,YI,jQ,zyn,QZt,tXt,rXt,eXt,iXt=w(()=>{"use strict";at();$();gd();jYe();a7e();ae();le();he();UX();Gyn=Object.defineProperty,YI=(e,t)=>Gyn(e,"name",{value:t,configurable:!0}),jQ="TargetReadinessProbe",zyn="no AWS session",QZt="readiness probe timed out",tXt=4,rXt=15e3;YI(DAe,"shortReadinessReason");eXt=Promise.resolve();YI(nXt,"withSerialisedCredentialResolution");YI(jQe,"withRestoredAwsContext");YI(aXt,"hasCachedSsoToken");YI(oXt,"resolveProbeCredentials");YI(BQe,"probeTargetReadinessInner");YI(K1,"probeTargetReadiness");YI(BQ,"probeTargetsReadiness")});var Ml=w(()=>{"use strict";bZe();E1();DEe();LQe();pQe();aA();i1();UX();iXt();Mp()});var Hyn,Kyn,UQ,sXt=w(()=>{"use strict";W3();OQe();DQe();$Qe();Ml();OQe();DQe();$Qe();W3();HI();Hyn=Object.defineProperty,Kyn=(e,t)=>Hyn(e,"name",{value:t,configurable:!0}),UQ=class{static{Kyn(this,"OrganisationService")}state;deployService;destroyService;constructor(){this.state=new IQ;let t=new FQ(this.state),r=new $p;this.deployService=new MQ(this.state,t,r),this.destroyService=new LQ(this.state,r)}setAwsContext(t){this.state.setAwsContext(t)}async deploy(t,r={},n){return this.deployService.deploy(t,r,n)}async destroy(t,r={},n){return this.destroyService.destroy(t,r,n)}}});import{OrganizationsClient as Jyn,DescribeAccountCommand as Zyn,DescribeOrganizationCommand as Xyn,CreateOrganizationCommand as Qyn,CreateOrganizationalUnitCommand as evn,MoveAccountCommand as tvn,ListRootsCommand as rvn,ListOrganizationalUnitsForParentCommand as cXt,ListParentsCommand as nvn,EnablePolicyTypeCommand as avn,EnableAWSServiceAccessCommand as ovn}from"@aws-sdk/client-organizations";var qyn,Yyn,lXt,NAe,uXt=w(()=>{"use strict";at();qyn=Object.defineProperty,Yyn=(e,t)=>qyn(e,"name",{value:t,configurable:!0}),lXt="AWSOrganizationsNotInUseException",NAe=class{static{Yyn(this,"Organisations")}awsContext;client;constructor(t){this.awsContext=t,this.client=this.awsContext.getClient(Jyn)}async listAccounts(){let t=await dh(this.client);if(!t.success)throw t.error;return t.data}async findAccount(t){let r=await cU(this.client,t);if(!r.success)throw r.error;return r.data}async describeAccount(t){try{let r=await this.client.send(new Zyn({AccountId:t}));if(!r.Account)throw new Error(`Account ${t} not found`);return r.Account}catch(r){let n=kt(r);throw n==="AccessDeniedException"?new Error(`Access denied when describing account ${t}. Ensure your credentials have organizations:DescribeAccount permission.`,{cause:r}):n==="AccountNotFoundException"?new Error(`Account with ID ${t} not found in your organisation.`,{cause:r}):n===lXt?new Error("AWS Organisations is not enabled for this account",{cause:r}):r}}async getRootAccountName(t){let r=await this.describeAccount(t);if(!r.Name)throw new Error(`No name found for account ${t}`);return r.Name}async createAccount(t,r){let n=await bk(this.client,t,r);if(!n.success)throw n.error;return n.data}async moveAccount(t,r,n){try{await this.client.send(new tvn({AccountId:t,SourceParentId:r,DestinationParentId:n}))}catch(a){throw kt(a)==="AccountNotFoundException"?new Error(`Account ${t} not found when attempting to move.`,{cause:a}):a}}async listRoots(){return(await this.client.send(new rvn({}))).Roots??[]}async listOrganisationalUnits(t){let r=await this.client.send(new cXt({ParentId:t})),n=r.OrganizationalUnits??[],a=r.NextToken;for(;a;){let o=await this.client.send(new cXt({ParentId:t,NextToken:a}));n=n.concat(o.OrganizationalUnits??[]),a=o.NextToken}return n}async createOrganisationalUnit(t,r){let n=(await this.listOrganisationalUnits(r)).find(o=>o.Name===t);if(n)return n;let a=await this.client.send(new evn({Name:t,ParentId:r}));if(!a.OrganizationalUnit)throw new Error(`CreateOrganizationalUnit for "${t}" did not return an OU`);return a.OrganizationalUnit}async listParents(t){try{return(await this.client.send(new nvn({ChildId:t}))).Parents?.[0]?.Id}catch(r){if(kt(r)==="ChildNotFoundException")return;throw r}}async enablePolicyType(t,r){try{await this.client.send(new avn({RootId:t,PolicyType:r}))}catch(n){if(kt(n)==="PolicyTypeAlreadyEnabledException")return;throw n}}async describeOrganisation(){try{return(await this.client.send(new Xyn({}))).Organization??null}catch(t){if(kt(t)===lXt)return null;throw t}}async createOrganisation(t="ALL"){try{let r=await this.client.send(new Qyn({FeatureSet:t}));if(!r.Organization)throw new Error("CreateOrganization did not return an Organization");return r.Organization}catch(r){if(kt(r)==="AlreadyInOrganizationException"){let n=await this.describeOrganisation();if(!n)throw new Error("Account is already in an organisation but DescribeOrganization returned nothing",{cause:r});return n}throw r}}async enableAWSServiceAccess(t){try{await this.client.send(new ovn({ServicePrincipal:t}))}catch(r){throw kt(r)==="AccessDeniedException"?new Error(`Access denied when enabling service access for ${t}. Ensure your credentials have organizations:EnableAWSServiceAccess permission.`,{cause:r}):r}}}});async function $Ae(e,t){try{let r=e??await ze.initialise(),n=t??new NAe(r);return E({awsContext:r,organisations:n})}catch(r){return g(new Na(`Failed to initialise AWS dependencies: ${b(k(r))}`,"AwsContext","initialise",void 0,{originalError:r},!1))}}var ivn,dXt,Z3,MAe=w(()=>{"use strict";gd();uXt();ae();Pr();le();$();ivn=Object.defineProperty,dXt=(e,t)=>ivn(e,"name",{value:t,configurable:!0});dXt($Ae,"initialiseOrgAwsDependencies");Z3=class{static{dXt(this,"OrgAwsBase")}organisations=null;awsContext=null;async initialiseAwsDependencies(){let t=await $Ae(this.awsContext,this.organisations);return t.success&&(this.awsContext=t.data.awsContext,this.organisations=t.data.organisations),t}}});import{CostExplorerClient as pXt,ListCostAllocationTagsCommand as lvn,GetDimensionValuesCommand as uvn}from"@aws-sdk/client-cost-explorer";var svn,cvn,LAe,mXt=w(()=>{"use strict";ae();$();Pr();le();he();hd();pi();MAe();svn=Object.defineProperty,cvn=(e,t)=>svn(e,"name",{value:t,configurable:!0}),LAe=class{static{cvn(this,"CostAllocationService")}getAwsContext;setAwsContext;getOrganisations;setOrganisations;constructor(t,r,n,a){this.getAwsContext=t,this.setAwsContext=r,this.getOrganisations=n,this.setOrganisations=a}async initialiseAwsDependencies(){let t=await $Ae(this.getAwsContext(),this.getOrganisations());return t.success&&(this.setAwsContext(t.data.awsContext),this.setOrganisations(t.data.organisations)),t}async retrieveCostAllocationTags(t){let r=new Nt(t);try{r.info("Checking Cost Explorer status...");let n=await this.isAWSCostExplorerEnabled();if(Vn(n))return g(n.error);if(!n.data)return r.info("Cost Explorer is not enabled"),E({enabled:!1,hasTags:!1,tags:[],retrievedAt:new Date});r.info("Retrieving cost allocation tags...");let a=await this.initialiseAwsDependencies();if(Vn(a))return g(a.error);let{awsContext:o}=a.data,i=((await o.getClient(pXt).send(new lvn({MaxResults:1e3}))).CostAllocationTags||[]).filter(s=>s.TagKey?s.Type==="AWSGenerated"?!0:!s.TagKey.startsWith("aws:"):!1).map(s=>({TagKey:s.TagKey||"",Status:s.Status||"Unknown"}));return i.length>0?(r.info(`Retrieved ${i.length} cost allocation tags`),t?.onCostTagsRetrieved?.(i)):r.info("No cost allocation tags configured"),E({enabled:!0,hasTags:i.length>0,tags:i,retrievedAt:new Date})}catch(n){let a=rn(n);return t?.onError?.(a),g(new Na(`Failed to retrieve cost allocation tags: ${b(a.message)}`,"CostExplorer","listCostAllocationTags",void 0,{originalError:n},!1))}}async isAWSCostExplorerEnabled(){try{let t=await this.initialiseAwsDependencies();if(Vn(t))return g(t.error);let{awsContext:r}=t.data,n=r.getClient(pXt),a={TimePeriod:{Start:this.getDateXDaysAgo(30),End:this.getFormattedDate(new Date)},Dimension:"SERVICE"};return await n.send(new uvn(a)),E(!0)}catch(t){return JYe(t)?E(!0):(P.debug("AwsAccount","Cost Explorer check failed",{error:t instanceof Error?t.message:String(t)}),E(!1))}}getDateXDaysAgo(t){let r=new Date;return r.setDate(r.getDate()-t),this.getFormattedDate(r)}getFormattedDate(t){return t.toISOString().slice(0,10)}}});var dvn,pvn,fXt,GQ,hXt=w(()=>{"use strict";$();Dt();or();pi();ae();Pr();le();$();at();MAe();mXt();dvn=Object.defineProperty,pvn=(e,t)=>dvn(e,"name",{value:t,configurable:!0}),fXt="providerAccounts",GQ=class extends Z3{static{pvn(this,"AwsAccountService")}cachedOrgConfig;costAllocation;constructor(){super(),this.costAllocation=new LAe(()=>this.awsContext,t=>{this.awsContext=t},()=>this.organisations,t=>{this.organisations=t})}setOrgConfig(t){this.cachedOrgConfig=t}buildProviderAccountsFromConfig(t,r,n){let a=[],o=[],i=new Map,s=mI(t),c=r.filter(l=>!l.Id||!l.Name);c.length>0&&be(`${c.length} AWS Organizations account(s) came back without an Id or Name and cannot be mapped: ${c.map(l=>l.Id??l.Name??"<unidentified>").join(", ")}`,{scope:ce.deploy});for(let{accountName:l,environment:u}of s){let d=r.find(m=>m.Name?.toLowerCase()===l.toLowerCase());if(!d?.Id){o.push(l),n?.onDebug?.(`Account "${l}" defined in ACCOUNTS but not found in AWS Organizations`);continue}let p=Nw(u)||u===wm.ROOT;if(!p&&!HJ(u)){let m=i.get(u)??[];m.push(l),i.set(u,m)}a.push({id:d.Id,name:l.toLowerCase(),environment:p?u:null})}for(let[l,u]of i)be(`ACCOUNTS key "${l}" is not a recognised workload stage; ${u.map(d=>`"${d}"`).join(", ")} will sync without a stage label. Valid stages: ${Cm.join(", ")}. Edit fjall/organisation/infrastructure.ts if a stage was intended.`,{scope:ce.deploy});return o.length>0?g(new tp(`${o.length} account(s) defined in ACCOUNTS were not found in AWS Organizations: ${o.join(", ")}`,"validation_error")):E(a)}async syncOrganisationAccounts(t){let r=new Nt(t);try{r.info("Retrieving AWS account information...");let n=await this.initialiseAwsDependencies();if(Vn(n))return g(n.error);let{organisations:a,awsContext:o}=n.data,i=await a.listAccounts(),s=await l0(process.cwd());if(Vn(s)){let p=b(s.error.message);return t?.onDebug?.(`Failed to parse accounts configuration: ${p}`),be(`Could not read ACCOUNTS configuration \u2014 no accounts were mapped: ${s.error.message}`,{scope:ce.deploy}),E({accounts:[],syncedAt:new Date})}let c=s.data;if(!c)return r.info("No ACCOUNTS configuration found, skipping account mapping"),E({accounts:[],syncedAt:new Date});let l=this.buildProviderAccountsFromConfig(c,i,t);if(Vn(l)){let p=b(l.error.message);return g(new Na(`Failed to build provider accounts: ${p}`,"Organisations","buildProviderAccounts",void 0,{originalError:l.error},!1))}let u=l.data,d=o.getAuthResult();if(d?.success&&d.account){let p;try{p=(await a.describeOrganisation())?.MasterAccountId}catch(m){t?.onDebug?.(`Could not verify management account via DescribeOrganization: ${b(rn(m).message)}`)}if(p!==d.account)t?.onDebug?.("Authenticated account is not the organisation's management account; skipping organisation-tier stamp");else{let m=u.find(f=>f.id===d.account);if(m&&pr(m)!=="organisation")m.tier="organisation",m.environment=null;else if(!m){let f=i.find(y=>y.Id===d.account);f?.Id?u.push({id:f.Id,name:f.Name?.toLowerCase()||wm.ROOT,tier:"organisation",environment:null}):t?.onDebug?.("Could not find root account in AWS accounts list")}}}else t?.onDebug?.("No valid auth result or account ID available for root account detection");return r.info(`Mapped ${u.length} accounts from ACCOUNTS configuration`),t?.onAccountsRetrieved?.(u.length),E({accounts:u,syncedAt:new Date})}catch(n){let a=rn(n),o=b(a.message);return t?.onError?.(new Error(o)),g(new Na(`Failed to sync organisation accounts: ${o}`,"Organisations","listAccounts",void 0,{originalError:n},!0))}}resolveProviderAccounts(t){return(t??this.cachedOrgConfig)?.providerAccounts??[]}getAccounts(t){return E(this.resolveProviderAccounts(t))}getAccountById(t,r){let n=this.resolveProviderAccounts(r).find(a=>a.id===t);return n?E(n):g(new tp(`Account not found: ${t}`,fXt,void 0,{accountId:t}))}getAccountByName(t,r){let n=this.resolveProviderAccounts(r).find(a=>a.name.toLowerCase()===t.toLowerCase());return n?E(n):g(new tp(`Account not found: ${t}`,fXt,void 0,{accountName:t}))}async retrieveCostAllocationTags(t){return this.costAllocation.retrieveCostAllocationTags(t)}}});import{join as P0,dirname as gXt}from"path";import{existsSync as AA,readFileSync as yXt,writeFileSync as hvn,mkdirSync as vXt,rmSync as gvn,renameSync as yvn,statSync as vvn,readdirSync as Svn,chmodSync as bvn}from"fs";var mvn,fvn,FAe,SXt=w(()=>{"use strict";mvn=Object.defineProperty,fvn=(e,t)=>mvn(e,"name",{value:t,configurable:!0}),FAe=class{static{fvn(this,"SimpleTree")}changes=new Map;root;constructor(t){this.root=t}read(t,r){let n=this.changes.get(t);if(n){if(n.type==="DELETE")return null;if(n.content!==void 0){let o=Buffer.from(n.content);return r?o.toString(r):o}}let a=P0(this.root,t);return AA(a)?r?yXt(a,r):yXt(a):null}write(t,r){let n=P0(this.root,t),a=AA(n),o=typeof r=="string"?r:r.toString("utf-8");this.changes.set(t,{type:a?"UPDATE":"CREATE",path:t,content:o})}exists(t){let r=this.changes.get(t);return r?r.type!=="DELETE":AA(P0(this.root,t))}delete(t){this.changes.set(t,{type:"DELETE",path:t,content:void 0})}rename(t,r){let n=P0(this.root,t),a=P0(this.root,r);if(!AA(n))return;let o=gXt(a);AA(o)||vXt(o,{recursive:!0}),yvn(n,a)}isFile(t){let r=P0(this.root,t);return AA(r)?vvn(r).isFile():!1}children(t){let r=P0(this.root,t);if(!AA(r))return[];try{return Svn(r)}catch{return[]}}listChanges(){return Array.from(this.changes.values()).map(t=>({path:t.path,type:t.type,content:t.content?Buffer.from(t.content):null}))}changePermissions(t,r){let n=P0(this.root,t);AA(n)&&bvn(n,r)}getSimpleChanges(){return Array.from(this.changes.values())}flushChanges(){for(let t of this.changes.values()){let r=t.path.startsWith("/")?t.path:P0(this.root,t.path);if(t.type==="DELETE"){AA(r)&&gvn(r,{recursive:!0,force:!0});continue}let n=gXt(r);AA(n)||vXt(n,{recursive:!0}),t.content!==void 0&&hvn(r,t.content,"utf-8")}}}});function UQe(e){let t={appName:e.app??e.appName,nameProvidedByFlag:e.nameProvidedByFlag??!1};if(e.resourceType==="database")return{...t,resourceName:e.resourceName,databaseName:e.databaseName||e.resourceName,databaseType:e.variant||e.databaseType||"Aurora"};if(e.resourceType==="compute"||typeof e.resourceType=="string"&&e.resourceType.startsWith("compute:")){let r=e.variant||e.subtype||"lambda";if(r==="lambda")return{...t,functionName:e.resourceName,lambdaType:e.lambdaType||"basic"};if(r==="ecs")return{...t,serviceName:e.resourceName,capacityProvider:e.capacityProvider||"FARGATE"};if(r==="ec2")return{...t,instanceName:e.resourceName,instanceType:e.instanceType||"t4g.micro"}}return e.resourceType==="service"?{...t,clusterName:e.clusterName||e.resourceName,serviceName:e.serviceName||e.resourceName,capacityProvider:e.capacityProvider||"FARGATE",...e.containerPort!==void 0&&{containerPort:e.containerPort},...e.instanceType!==void 0&&{ec2Config:{instanceType:e.instanceType}},...e.routingPath!==void 0&&{routing:{path:e.routingPath}},...e.connectDatabase!==void 0&&{connectionConfig:{connectToDatabase:Array.isArray(e.connectDatabase)?e.connectDatabase:[e.connectDatabase]}}}:e.resourceType==="proxy"?{...t,databaseName:e.databaseName||e.resourceName,...e.maxConnections!==void 0&&{maxConnections:e.maxConnections},...e.maxIdleConnections!==void 0&&{maxIdleConnections:e.maxIdleConnections},...e.connectionBorrowTimeout!==void 0&&{connectionBorrowTimeout:e.connectionBorrowTimeout},...e.requireTLS!==void 0&&{requireTLS:e.requireTLS}}:(P.debug("Generator",`No schema transformation for resource type: ${String(e.resourceType)}`),e)}var Evn,Avn,bXt=w(()=>{"use strict";he();Evn=Object.defineProperty,Avn=(e,t)=>Evn(e,"name",{value:t,configurable:!0});Avn(UQe,"buildResourceSchema")});import{resolve as EXt,sep as Cvn}from"path";function X3(e){return typeof e=="object"&&e!==null&&!Array.isArray(e)}function VQ(e,t,r){let n=EXt(e,...t,"generator.js"),a=EXt(e);return n!==a&&!n.startsWith(a+Cvn)?g(new fc("Invalid generator path: resolved path escapes generators directory","generation_failed",r,"getGeneratorPath")):E(n)}function GQe(e,t,r){let n=AXt[t];if(n)return VQ(e,[n.path],t);if(t==="compute"&&r)return VQ(e,["compute",r],t);if(t.startsWith("compute:")){let a=t.split(":")[1];return a?VQ(e,["compute",a],t):g(new fc(`Invalid compute generator type: ${t} (missing subtype after ":")`,"generation_failed",t,"getGeneratorPath"))}return["lambda","ecs","ec2"].includes(t)?VQ(e,["compute",t],t):g(new fc(`No generator found for type: ${t}, subtype: ${r}`,"generation_failed",t,"getGeneratorPath"))}function VQe(e){let t=AXt[e];if(t?.schema&&t.label)return{schema:t.schema,label:t.label};if(e.startsWith("compute:")||["lambda","ecs","ec2"].includes(e))return{schema:_Be,label:"compute"}}var wvn,jAe,AXt,WQe=w(()=>{"use strict";ue();ae();BAe();wvn=Object.defineProperty,jAe=(e,t)=>wvn(e,"name",{value:t,configurable:!0}),AXt={database:{path:"database",schema:S2,label:"database"},"database:database":{path:"database",schema:S2,label:"database"},"storage:s3":{path:"storage/s3",schema:bO,label:"S3"},network:{path:"network",schema:npe,label:"network"},"network:network":{path:"network",schema:npe,label:"network"},service:{path:"compute/service",schema:x2,label:"service"},"compute:service":{path:"compute/service",schema:x2,label:"service"},proxy:{path:"database/proxy",schema:Yx,label:"proxy"},"database:proxy":{path:"database/proxy",schema:Yx,label:"proxy"},tunnel:{path:"tunnel",schema:U5,label:"tunnel"},domain:{path:"domain"},account:{path:"account"},application:{path:"application"},organisation:{path:"organisation"},cdn:{path:"cdn"},"cdn:cdn":{path:"cdn"}};jAe(X3,"isRecord");jAe(VQ,"resolveAndGuardPath");jAe(GQe,"resolveGeneratorPath");jAe(VQe,"getValidationSchemaForType")});import{existsSync as xvn}from"fs";import{join as wXt}from"path";function CXt(e){return typeof e=="function"}function TXt(e,t){let r=new Set(e.getSimpleChanges().map(n=>n.path));for(let[n,a]of t){if(!r.has(n)){let o=[...r].slice(0,5).join(", "),i=r.size>5?"\u2026":"";return g(`--file-override path "${n}" was not in the planned scaffold tree (allowed paths: ${o}${i})`)}e.write(n,a)}return E(void 0)}var Tvn,UAe,JI,kvn,Ivn,fc,WQ,BAe=w(()=>{"use strict";SXt();he();ae();Pr();le();bXt();$();WQe();Tvn=Object.defineProperty,UAe=(e,t)=>Tvn(e,"name",{value:t,configurable:!0}),JI="infrastructure",kvn=import.meta.dirname,Ivn=(()=>{let e;return()=>{if(e)return e;let t=process.env.FJALL_ASSETS_DIR;return e=t!==void 0&&t!==""?wXt(t,"generators"):wXt(kvn,"..","..","..","generators"),e}})();UAe(CXt,"isCallableGenerator");UAe(TXt,"applyFileOverrides");fc=class extends Ke{static{UAe(this,"GeneratorError")}errorType;generatorType;operation;constructor(t,r,n,a,o,i=!1){super("GENERATOR_ERROR",t,o,i),this.errorType=r,this.generatorType=n,this.operation=a}},WQ=class{static{UAe(this,"GeneratorService")}introspection;constructor(t){this.introspection=t}async getResourcePlan(t){return this.introspection.getResourcePlan(t)}async getComputeResources(t){return this.introspection.getComputeResources(t)}async getDatabaseResources(t){return this.introspection.getDatabaseResources(t)}async checkResourceExists(t,r){return this.introspection.checkResourceExists(t,r)}async checkDatabaseExists(t,r){return this.introspection.checkDatabaseExists(t,r)}async generateUniqueResourceName(t,r,n){return this.introspection.generateUniqueResourceName(t,r,n)}validateSchema(t,r){let n=VQe(t);if(!n)return P.debug("Generator",`No pre-validation for generator type: ${t}`),E(r);let a=n.schema.safeParse(r);if(!a.success){let o=`Invalid ${n.label} schema: ${Zf(a.error)}`;return P.debug("Generator",o),g(new fc(o,"parse_failed",n.label,"validateSchema"))}return E(a.data)}extractGeneratorFunction(t,r){if(!X3(t))return g(new fc("Generator module is not an object","generation_failed",void 0,"extractGeneratorFunction"));let n=t,a=r.indexOf(":"),o=a!==-1?r.slice(a+1)||void 0:r,i=o?`${o}Generator`:void 0,s=(i?n[i]:void 0)||n.generator||n.default;return!s||!CXt(s)?g(new fc("No valid generator function found in module","generation_failed",void 0,"extractGeneratorFunction")):E(s)}async runGenerator(t){let{type:r,subtype:n,schema:a,interactive:o=!1}=t;try{P.debug("Generator",`Running ${r} generator`);let i=this.validateSchema(r,a);if(!i.success)return g(i.error);let s=i.data,c=new FAe(t.rootDir??process.cwd()),l=Ivn(),u=GQe(l,r,n);if(!u.success)return g(u.error);let d=u.data;if(!xvn(d))return g(new fc(`Generator not found at: ${d}`,"generation_failed",r,"runGenerator"));let p=await import(d),m=this.extractGeneratorFunction(p,r);if(!m.success)return g(m.error);let f=m.data;if(await f(c,s),t.fileOverrides&&t.fileOverrides.size>0){let v=TXt(c,t.fileOverrides);if(!v.success)return g(new fc(v.error,"generation_failed",r,"runGenerator"))}let y=t.dryRun===!0;return!o&&!y&&c.flushChanges(),P.debug("Generator",`${r} generator completed successfully`),E({generatorType:r,message:`${r} generated successfully`,...y&&{pendingChanges:c.getSimpleChanges()}})}catch(i){let s=b(k(i));return P.error("Generator",`Generator failed: ${s}`),g(new fc(s,"generation_failed",r,"runGenerator",{originalError:i}))}}buildResourceSchema(t){return UQe(t)}}});import{existsSync as Pvn,readFileSync as Ovn}from"fs";import{join as Dvn}from"path";var Rvn,_vn,zQ,xXt=w(()=>{"use strict";ue();Cr();ae();BAe();le();$();Rvn=Object.defineProperty,_vn=(e,t)=>Rvn(e,"name",{value:t,configurable:!0}),zQ=class{static{_vn(this,"InfrastructureIntrospectionService")}readInfrastructureFile(t,r){let n=Ui(t),a=Dvn(process.cwd(),n);if(!Pvn(a))return g(new fc(`Infrastructure file not found for ${t} at ${a}`,"not_found",JI,r,{appName:t,fullPath:a}));try{return E(Ovn(a,"utf-8"))}catch(o){return g(new fc(`Failed to read infrastructure file for ${t}: ${b(k(o))}`,"read_failed",JI,r,{appName:t,fullPath:a,originalError:o}))}}async getResourcePlan(t){try{let r=this.readInfrastructureFile(t,"getResourcePlan");if(!r.success)return g(r.error);let n=Cl(r.data),a=Og(n,t);return E(a)}catch(r){return g(new fc(`Failed to get resource plan: ${b(k(r))}`,"parse_failed",JI,"getResourcePlan",{appName:t,originalError:r}))}}async getComputeResources(t){let r=await this.getResourcePlan(t);return r.success?E(r.data.compute||[]):g(r.error)}async getDatabaseResources(t){let r=await this.getResourcePlan(t);return r.success?E(r.data.database||[]):g(r.error)}async checkResourceExists(t,r){try{let n=await this.getResourcePlan(t);if(!n.success)return E(!1);let a=n.data,o=[...a.compute.map(i=>i.name),...a.database.map(i=>i.name),...a.s3.map(i=>i.name),...a.dynamodb?.map(i=>i.name)??[],...a.sqs?.map(i=>i.name)??[]];return E(o.includes(r))}catch(n){return g(new fc(`Failed to check resource existence: ${b(k(n))}`,"parse_failed",JI,"checkResourceExists",{appName:t,resourceName:r,originalError:n}))}}async checkDatabaseExists(t,r){try{let n=await this.getResourcePlan(t);return n.success?E(n.data.database.some(a=>a.databaseName===r)):E(!1)}catch(n){return g(new fc(`Failed to check database existence: ${b(k(n))}`,"parse_failed",JI,"checkDatabaseExists",{appName:t,databaseName:r,originalError:n}))}}async generateUniqueResourceName(t,r,n){try{let a=await this.getResourcePlan(t);if(!a.success)return g(a.error);let o=a.data,i=new Set(n==="database"?o.database.map(l=>l.databaseName):[...o.compute.map(l=>l.name),...o.database.map(l=>l.name),...o.s3.map(l=>l.name),...o.dynamodb?.map(l=>l.name)??[],...o.sqs?.map(l=>l.name)??[]]),s=r,c=1e3;for(let l=2;l<=c;l++){if(!i.has(s))return E(s);s=`${r}${l}`}return g(new fc(`Could not generate unique name for '${r}' after ${c} attempts`,"generation_failed",JI,"naming"))}catch(a){return g(new fc(`Failed to generate unique resource name: ${b(k(a))}`,"generation_failed",JI,"generateUniqueResourceName",{appName:t,baseName:r,resourceType:n,originalError:a}))}}}});import{existsSync as $vn,readFileSync as kXt}from"fs";import{join as IXt}from"path";function zQe(e,t){let r=IXt(e,"manifest.json");try{let n=JSON.parse(kXt(r,"utf-8"));if(typeof n!="object"||n===null||Array.isArray(n))return;let a=n;if(typeof a.artifacts!="object"||a.artifacts===null)return;let o=a.artifacts;if(typeof o[t]!="object"||o[t]===null)return;let i=o[t];if(!i.properties||typeof i.properties!="object")return;let s=i.properties;delete s.tags,delete s.cloudFormationExecutionRoleArn,delete s.assumeRoleArn;let c=s.templateFile;if(typeof c=="string"){let l=IXt(e,c);if($vn(l)){let u=JSON.parse(kXt(l,"utf-8"));if(typeof u=="object"&&u!==null&&!Array.isArray(u)){let d=u,p=typeof d.Parameters=="object"&&d.Parameters!==null?d.Parameters:void 0,m=typeof d.Rules=="object"&&d.Rules!==null?d.Rules:void 0;p?.BootstrapVersion&&delete p.BootstrapVersion,m?.CheckBootstrapVersion&&delete m.CheckBootstrapVersion,p&&Object.keys(p).length===0&&delete d.Parameters,m&&Object.keys(m).length===0&&delete d.Rules,xa(l,JSON.stringify(d,null,2))}}}xa(r,JSON.stringify(a,null,2)),P.debug("ImportService",`Patched manifest for import: stripped Tags/RoleArn from ${t}`)}catch(n){P.warn("ImportService","Failed to patch manifest for import",{error:b(k(n))})}}function HQ(e,t){try{xa(e,t),P.info("ImportService","Rolled back infrastructure file after failure")}catch(r){P.warn("ImportService","Failed to rollback infrastructure file",{error:b(k(r))})}}var Nvn,RXt,HQe=w(()=>{"use strict";So();le();he();$();Nvn=Object.defineProperty,RXt=(e,t)=>Nvn(e,"name",{value:t,configurable:!0});RXt(zQe,"patchManifestForImport");RXt(HQ,"rollbackInfrastructure")});var Mvn,Lvn,so,Q3=w(()=>{"use strict";Pr();Mvn=Object.defineProperty,Lvn=(e,t)=>Mvn(e,"name",{value:t,configurable:!0}),so=class extends Ke{static{Lvn(this,"ImportError")}constructor(t,r,n){super(r,t,n,!1),this.name="ImportError"}}});function _Xt(e){return $r(e)}function PXt(e){return e?.Status==="Enabled"}function OXt(e){if(!e?.Rules||e.Rules.length===0)return;let t=e.Rules[0]?.ApplyServerSideEncryptionByDefault;if(t?.SSEAlgorithm){if(t.SSEAlgorithm==="aws:kms")return{encryption:"KMS",kmsKeyArn:t.KMSMasterKeyID};if(t.SSEAlgorithm==="AES256")return{encryption:"AES256"}}}function DXt(e){if(!e?.IndexDocument?.Suffix)return;let t={indexDocument:e.IndexDocument.Suffix};return e.ErrorDocument?.Key&&(t.errorDocument=e.ErrorDocument.Key),t}function NXt(e){if(!(!e?.CORSRules||e.CORSRules.length===0))return e.CORSRules.map(t=>{let r={allowedOrigins:t.AllowedOrigins??[],allowedMethods:t.AllowedMethods??[]};return t.AllowedHeaders&&t.AllowedHeaders.length>0&&(r.allowedHeaders=t.AllowedHeaders),t.ExposeHeaders&&t.ExposeHeaders.length>0&&(r.exposedHeaders=t.ExposeHeaders),t.MaxAgeSeconds!==void 0&&(r.maxAge=t.MaxAgeSeconds),r})}function $Xt(e,t){if(!(e&&(e.BlockPublicAcls||e.IgnorePublicAcls||e.BlockPublicPolicy||e.RestrictPublicBuckets))&&t?.IsPublic)return!0}function KQe(e){let t={name:_Xt(e.bucketName),bucketName:e.bucketName,versioned:PXt(e.versioning)},r=OXt(e.encryption);r&&(t.encryption=r.encryption,r.kmsKeyArn&&(t.kmsKeyArn=r.kmsKeyArn));let n=DXt(e.website);n&&(t.websiteHosting=n);let a=NXt(e.cors);a&&a.length>0&&(t.cors=a);let o=$Xt(e.publicAccessBlock,e.policyStatus);return o&&(t.publicReadAccess=o),t}var Fvn,q1,MXt=w(()=>{"use strict";hA();Fvn=Object.defineProperty,q1=(e,t)=>Fvn(e,"name",{value:t,configurable:!0});q1(_Xt,"derivePascalCaseName");q1(PXt,"mapVersioning");q1(OXt,"mapEncryption");q1(DXt,"mapWebsiteHosting");q1(NXt,"mapCors");q1($Xt,"mapPublicAccess");q1(KQe,"mapS3Config")});function LXt(e){let t=FXt(e);return t?`app.addStorage(
   StorageFactory.build("${e.name}", {${t}
   })
 );`:`app.addStorage(
@@ -1034,8 +1034,8 @@ ${b(s)}`,"read_failed",{dockerfilePath:t,fullPath:o,error:i},!1,"DOCKER_DOCKERFI
       errorDocument: "${e.websiteHosting.errorDocument}"`:"";t+=`
     websiteHosting: {
       indexDocument: "${e.websiteHosting.indexDocument}"${r}
-    },`}return e.versioned!==void 0&&(t+=`
-    versioned: ${e.versioned},`),e.encryption&&(t+=`
+    },`}return t+=`
+    versioned: ${e.versioned},`,e.encryption&&(t+=`
     encryption: "${e.encryption}",`),e.kmsKeyArn&&(t+=`
     kmsKeyArn: "${e.kmsKeyArn}",`),e.cors&&e.cors.length>0&&(t+=`
     cors: ${jXt(e.cors)},`),t}function jXt(e){return`[
@@ -3049,7 +3049,7 @@ Failed: ${b(k(i.error))}`)),Je(i)}catch(o){Oe(rn(o))}})}zL(ERe,"reconnect");asyn
 `);throw new Error(`Multiple disconnected AWS accounts \u2014 specify which to reconnect:
 ${o}
 
-Run: fjall reconnect <awsAccountId>`)}let a=n[0];if(!a)throw new Error("No disconnected AWS accounts to reconnect.");return t.line(`Reconnecting the disconnected account: ${a.accountName??a.awsAccountId} (${a.awsAccountId})`),a.awsAccountId}zL(nbr,"resolveReconnectTarget");Le();tr();ae();Yi();var $4n=Object.defineProperty,abr=(e,t)=>$4n(e,"name",{value:t,configurable:!0});async function obr(e,t){return t.interactive&&t.confirm?t.confirm():t.fallbackValue}abr(obr,"confirmDialog");async function ibr(e,t){return t.interactive&&t.select?t.select():t.defaultValue}abr(ibr,"selectDialog");Cs();Fte();Rxe();Rte();Lte();OW();hre();ae();Rn();Yi();var M4n=Object.defineProperty,L4n=(e,t)=>M4n(e,"name",{value:t,configurable:!0});function Qo(){let e=rt.fromCredentials();return e?E(e):g(new it("Not authenticated. Run `fjall login` first.","not_authenticated","/api/tokens"))}L4n(Qo,"requireAuthenticatedClient");var F4n=Object.defineProperty,sbr=(e,t)=>F4n(e,"name",{value:t,configurable:!0});function cbr(e){let t={};return e.applicationIds&&e.applicationIds.length>0&&(t.applicationIds=e.applicationIds),e.environmentNames&&e.environmentNames.length>0&&(t.environmentNames=e.environmentNames),e.accountIds&&e.accountIds.length>0&&(t.accountIds=e.accountIds),{name:e.name,scopes:e.scopes,expiresAt:e.expiresAt,...Object.keys(t).length>0&&{resourceConstraints:t},...e.sourceTag!==void 0&&{sourceTag:e.sourceTag},...e.confirmProductionDestroy===!0&&{confirmProductionDestroy:!0}}}sbr(cbr,"buildPayload");async function joe(e){let t=Qo();return t.success?t.data.createToken(cbr(e)):t}sbr(joe,"userTokenCreateOperation");var j4n=Object.defineProperty,B4n=(e,t)=>j4n(e,"name",{value:t,configurable:!0});async function Boe(){let e=Qo();return e.success?e.data.listTokens():e}B4n(Boe,"userTokenListOperation");var U4n=Object.defineProperty,G4n=(e,t)=>U4n(e,"name",{value:t,configurable:!0});async function Uoe(e){let t=Qo();return t.success?t.data.revokeToken(e.id,e.reason):t}G4n(Uoe,"userTokenRevokeOperation");var V4n=Object.defineProperty,W4n=(e,t)=>V4n(e,"name",{value:t,configurable:!0});async function Goe(e){let t=Qo();return t.success?t.data.getToken(e):t}W4n(Goe,"userTokenShowOperation");ae();Yi();bA();var z4n=Object.defineProperty,lbr=(e,t)=>z4n(e,"name",{value:t,configurable:!0});function ubr(e){let t={};return e.applicationIds&&e.applicationIds.length>0&&(t.applicationIds=e.applicationIds),e.environmentNames&&e.environmentNames.length>0&&(t.environmentNames=e.environmentNames),e.accountIds&&e.accountIds.length>0&&(t.accountIds=e.accountIds),{name:e.name,expiresAt:e.expiresAt,...Object.keys(t).length>0&&{resourceConstraints:t},...e.sourceTag!==void 0&&{sourceTag:e.sourceTag}}}lbr(ubr,"buildPayload");async function HL(e){let t=Qo();if(!t.success)return t;let r=await t.data.createDeployToken(ubr(e));return!r.success&&r.error.statusCode===403?g(new it(`${r.error.message} ${Hf()}`,r.error.errorType,r.error.endpoint,r.error.statusCode)):r}lbr(HL,"ciTokenCreateOperation");ae();bA();var H4n=Object.defineProperty,K4n=(e,t)=>H4n(e,"name",{value:t,configurable:!0});async function Voe(){let e=Qo();if(!e.success)return e;let t=await e.data.listTokens();return t.success?E({tokens:t.data.tokens.filter(UI)}):t}K4n(Voe,"ciTokenListOperation");var q4n=Object.defineProperty,Y4n=(e,t)=>q4n(e,"name",{value:t,configurable:!0});async function KL(e){let t=Qo();return t.success?t.data.revokeToken(e.id,e.reason):t}Y4n(KL,"ciTokenRevokeOperation");ae();bA();var J4n=Object.defineProperty,Z4n=(e,t)=>J4n(e,"name",{value:t,configurable:!0});async function Woe(){let e=Qo();if(!e.success)return e;let t=await e.data.listTokens();if(!t.success)return t;let r=t.data.tokens.filter(UI),n=0,a=0,o=0;for(let i of r){let s=Sy(i);s==="revoked"?o++:s==="expired"?a++:n++}return E({totalDeployTokens:r.length,activeDeployTokens:n,expiredDeployTokens:a,revokedDeployTokens:o,ready:n>0})}Z4n(Woe,"ciStatusOperation");ae();bA();var X4n=Object.defineProperty,ARe=(e,t)=>X4n(e,"name",{value:t,configurable:!0}),Q4n={credential:"Credential present",principal:"Deploy principal",expiry:"Token expiry",application:"Application resolves"},eGn=336*60*60*1e3,a6="Mint a deploy token in the fjall web app (Settings \u2192 CI/CD Tokens)";function kc(e,t,r,n){return{id:e,label:Q4n[e],status:t,...r!==void 0&&{detail:r},...n!==void 0&&{fix:n}}}ARe(kc,"check");function dbr(){let e=process.env.FJALL_API_KEY;return e===void 0||e===""?"stored login session":e.startsWith(WZe)?`${WZe} deploy token via FJALL_API_KEY`:"API key via FJALL_API_KEY"}ARe(dbr,"describeCredentialSource");async function zoe(e={}){let t=[],r=ARe(s=>{s&&t.push(kc("principal","skip","No credential to inspect")),t.push(kc("expiry","skip","No token expiry to check")),e.app!==void 0&&t.push(kc("application","skip","No credential to resolve with"))},"skipRest"),n=Qo();if(!n.success)return t.push(kc("credential","fail","No credentials found (FJALL_API_KEY unset and no stored login)",`Set FJALL_API_KEY to a deploy token (${a6}), or run fjall login`)),r(!0),E({checks:t,passed:!1});let a=n.data;t.push(kc("credential","pass",`Using ${dbr()}`));let o=await a.getSelfToken(),i;if(o.success?(i=o.data.expiresAt,UI(o.data)?t.push(kc("principal","pass",`Deploy principal (scopes: ${o.data.scopes.join(", ")})`)):t.push(kc("principal","warn","Authenticated as a personal/agent token, not a CI deploy principal",`${a6}, then set FJALL_API_KEY to it`))):o.error.errorType==="not_found"?t.push(kc("principal","warn","Authenticated via a login session, not a token \u2014 CI needs FJALL_API_KEY",a6)):o.error.errorType==="not_authenticated"||o.error.statusCode===401?t.push(kc("principal","fail",`Credential rejected by the API: ${o.error.message}`,`The token may be expired or revoked \u2014 ${a6}`)):t.push(kc("principal","fail",`Could not verify the credential: ${o.error.message}`)),i===void 0)t.push(kc("expiry","skip","No token expiry to check"));else{let s=new Date(i).getTime()-Date.now();if(Number.isNaN(s)||s<=0)t.push(kc("expiry","fail",`Token expired at ${i}`,a6));else if(s<eGn){let c=Math.max(1,Math.floor(s/864e5));t.push(kc("expiry","warn",`Token expires in ${c} day${c===1?"":"s"} (${i})`,`Rotate soon \u2014 ${a6}`))}else t.push(kc("expiry","pass",`Token valid until ${i}`))}if(e.app===void 0)t.push(kc("application","skip","Pass --app <name> to verify an application resolves"));else{let s=await a.getApplicationByName(e.app);s.success?t.push(kc("application","pass",`Application "${e.app}" resolved (id: ${s.data.application.id})`)):s.error.errorType==="not_found"?t.push(kc("application","fail",`Application "${e.app}" not found for this organisation`,"Check the name, or register the app first (fjall create app)")):s.error.errorType==="permission_denied"||s.error.statusCode===403?t.push(kc("application","fail",`The current principal is not authorised for "${e.app}"`,"Mint a deploy token scoped to this application in the fjall web app (Settings \u2192 CI/CD Tokens)")):t.push(kc("application","fail",`Could not resolve "${e.app}": ${s.error.message}`))}return E({checks:t,passed:!t.some(s=>s.status==="fail")})}ARe(zoe,"ciVerifyOperation");So();$();ae();w0();Rh();lQ();import{existsSync as Ebr,mkdirSync as dGn}from"node:fs";import{dirname as pGn,join as mGn,relative as fGn,resolve as hGn}from"node:path";$();ae();Yi();_n();Ha();var tGn=Object.defineProperty,mb=(e,t)=>tGn(e,"name",{value:t,configurable:!0}),pbr="NONE",Nft="MALFORMED",rGn="unknown:",mbr="Unconstrained: this token is not limited to any application, environment or AWS account in the organisation.",fbr="Stored constraints do not match {applicationIds?, environmentNames?, accountIds?} string arrays \u2014 enforcement ignores what it cannot parse. Re-mint the token with the constraints you intend.",wRe=["environmentNames","accountIds","applicationIds"];function hbr(e){return Array.isArray(e)&&e.length>0&&e.every(t=>typeof t=="string"&&t.trim().length>0)}mb(hbr,"isNonEmptyStringArray");function gbr(e){return wRe.includes(e)}mb(gbr,"isKnownAxis");function iv(e){if(e==null)return{kind:"none"};if(typeof e!="object"||Array.isArray(e))return{kind:"malformed"};let t={environmentNames:[],accountIds:[],applicationIds:[]};for(let[r,n]of Object.entries(e)){if(!gbr(r))return{kind:"malformed"};if(n!==void 0){if(!hbr(n))return{kind:"malformed"};t[r]=n}}return wRe.some(r=>t[r].length>0)?{kind:"constrained",axes:t}:{kind:"none"}}mb(iv,"parseTokenConstraints");function ybr(e,t){let r=t.get(e);if(r===void 0)return`${rGn}${e}`;let n=r.accountName?.trim();return n!==void 0&&n.length>0?`${n}(${r.awsAccountId})`:r.awsAccountId}mb(ybr,"labelAccountConstraint");function jT(e){return e.kind==="constrained"&&e.axes.accountIds.length>0}mb(jT,"hasAccountConstraint");function $ft(e,t){let r=t.get(e);if(r===void 0)return`${e} (no matching connected account)`;let n=r.accountName?.trim(),a=n!==void 0&&n.length>0?`${n}, ${r.awsAccountId}`:r.awsAccountId;return`${e} (${a})`}mb($ft,"annotateAccountCuid");function BT(e,t){if(e.kind==="malformed")return Nft;if(e.kind==="none")return pbr;let r=[];if(e.axes.environmentNames.length>0&&r.push(`env=${e.axes.environmentNames.join(",")}`),e.axes.accountIds.length>0){let n=t===void 0?String(e.axes.accountIds.length):e.axes.accountIds.map(a=>ybr(a,t)).join(",");r.push(`acct=${n}`)}return e.axes.applicationIds.length>0&&r.push(`app=${e.axes.applicationIds.length}`),r.join(" ")}mb(BT,"summariseTokenConstraints");function Mft(e){return new Map(e.map(t=>[t.id,{awsAccountId:t.awsAccountId,accountName:t.accountName}]))}mb(Mft,"buildAccountLookup");function Hoe(e,t){return e.kind==="malformed"?Nft:e.kind==="none"?"":e.axes[t].join(",")}mb(Hoe,"constraintAxisCell");function Lft(e){return JSON.stringify(e)??String(e)}mb(Lft,"formatRawConstraints");function o6(e){let t=_.colours;return e===pbr?H.hex(t.warning).bold(e):e===Nft?H.hex(t.error).bold(e):e}mb(o6,"emphasiseConstraintSummary");var nGn=Object.defineProperty,CRe=(e,t)=>nGn(e,"name",{value:t,configurable:!0}),aGn=/^\d{12}$/,Fft="/api/aws-accounts";function Koe(e){let t=e.accountName??"(unnamed)",r=e.environment!==null?`, stage ${e.environment}`:"";return`${t} (${e.awsAccountId}${r})`}CRe(Koe,"describeAccount");async function TRe(e,t){let r=await e.getAwsAccounts();if(!r.success)return r;let n=r.data.accounts,a=n.length>0?`Connected accounts: ${n.map(Koe).join(", ")}.`:"No AWS accounts are connected \u2014 connect one first (`fjall connect`).",o=[];for(let i of t){let s=i.trim(),c=n.filter(S=>S.awsAccountId===s),l=n.filter(S=>S.accountName!==null&&S.accountName.toLowerCase()===s.toLowerCase()),u=aGn.test(s),d=u?c:l,p=d===c?l:c,m=d.length>0?d:p,f=d.length>0?p.filter(S=>!d.includes(S)):[],[y,...v]=m;if(y===void 0)return g(new it(b(`Account "${s}" matches no connected AWS account (by name or 12-digit AWS account id). ${a}`),"not_found",Fft));if(f.length>0)return g(new it(b(`Account "${s}" is ambiguous across forms \u2014 it is the 12-digit AWS account id of ${c.map(Koe).join(", ")} and also the name of ${l.map(Koe).join(", ")}. Neither form names one row here: rename the connected account called "${s}" so the two stop colliding.`),"api_error",Fft));if(v.length>0){let S=m===l&&!u?"Pass the 12-digit AWS account id instead.":"Neither form separates them \u2014 rename or disconnect the duplicate row.";return g(new it(b(`Account "${s}" is ambiguous \u2014 it matches ${m.length} connected accounts: ${m.map(Koe).join(", ")}. ${S}`),"api_error",Fft))}o.includes(y.id)||o.push(y.id)}return E(o)}CRe(TRe,"resolveAccountConstraints");async function UT(){let e=Qo();if(!e.success)return;let t=await e.data.getAwsAccounts();if(t.success)return Mft(t.data.accounts)}CRe(UT,"loadAccountLookup");async function qoe(e){if(e===void 0||e.length===0)return E(void 0);let t=Qo();return t.success?TRe(t.data,e):t}CRe(qoe,"resolveAccountFlagInputs");Uft();bA();var sGn=Object.defineProperty,Gft=(e,t)=>sGn(e,"name",{value:t,configurable:!0}),fb="FJALL_API_KEY";var cGn="fjall-tech/fjall-deploy#v19",lGn="fjall-tech/fjall-deploy-action@v19",Sbr=".github/workflows/fjall-deploy.yml",bbr=".buildkite/pipeline.yml";function Vft(e){return`# Generated by \`fjall ci setup\` \u2014 deploys ${e.app} on every push to main.
+Run: fjall reconnect <awsAccountId>`)}let a=n[0];if(!a)throw new Error("No disconnected AWS accounts to reconnect.");return t.line(`Reconnecting the disconnected account: ${a.accountName??a.awsAccountId} (${a.awsAccountId})`),a.awsAccountId}zL(nbr,"resolveReconnectTarget");Le();tr();ae();Yi();var $4n=Object.defineProperty,abr=(e,t)=>$4n(e,"name",{value:t,configurable:!0});async function obr(e,t){return t.interactive&&t.confirm?t.confirm():t.fallbackValue}abr(obr,"confirmDialog");async function ibr(e,t){return t.interactive&&t.select?t.select():t.defaultValue}abr(ibr,"selectDialog");Cs();Fte();Rxe();Rte();Lte();OW();hre();ae();Rn();Yi();var M4n=Object.defineProperty,L4n=(e,t)=>M4n(e,"name",{value:t,configurable:!0});function Qo(){let e=rt.fromCredentials();return e?E(e):g(new it("Not authenticated. Run `fjall login` first.","not_authenticated","/api/tokens"))}L4n(Qo,"requireAuthenticatedClient");var F4n=Object.defineProperty,sbr=(e,t)=>F4n(e,"name",{value:t,configurable:!0});function cbr(e){let t={};return e.applicationIds&&e.applicationIds.length>0&&(t.applicationIds=e.applicationIds),e.environmentNames&&e.environmentNames.length>0&&(t.environmentNames=e.environmentNames),e.accountIds&&e.accountIds.length>0&&(t.accountIds=e.accountIds),{name:e.name,scopes:e.scopes,expiresAt:e.expiresAt,...Object.keys(t).length>0&&{resourceConstraints:t},...e.sourceTag!==void 0&&{sourceTag:e.sourceTag},...e.confirmProductionDestroy===!0&&{confirmProductionDestroy:!0}}}sbr(cbr,"buildPayload");async function joe(e){let t=Qo();return t.success?t.data.createToken(cbr(e)):t}sbr(joe,"userTokenCreateOperation");var j4n=Object.defineProperty,B4n=(e,t)=>j4n(e,"name",{value:t,configurable:!0});async function Boe(){let e=Qo();return e.success?e.data.listTokens():e}B4n(Boe,"userTokenListOperation");var U4n=Object.defineProperty,G4n=(e,t)=>U4n(e,"name",{value:t,configurable:!0});async function Uoe(e){let t=Qo();return t.success?t.data.revokeToken(e.id,e.reason):t}G4n(Uoe,"userTokenRevokeOperation");var V4n=Object.defineProperty,W4n=(e,t)=>V4n(e,"name",{value:t,configurable:!0});async function Goe(e){let t=Qo();return t.success?t.data.getToken(e):t}W4n(Goe,"userTokenShowOperation");ae();Yi();bA();var z4n=Object.defineProperty,lbr=(e,t)=>z4n(e,"name",{value:t,configurable:!0});function ubr(e){let t={};return e.applicationIds&&e.applicationIds.length>0&&(t.applicationIds=e.applicationIds),e.environmentNames&&e.environmentNames.length>0&&(t.environmentNames=e.environmentNames),e.accountIds&&e.accountIds.length>0&&(t.accountIds=e.accountIds),{name:e.name,expiresAt:e.expiresAt,...Object.keys(t).length>0&&{resourceConstraints:t},...e.sourceTag!==void 0&&{sourceTag:e.sourceTag}}}lbr(ubr,"buildPayload");async function HL(e){let t=Qo();if(!t.success)return t;let r=await t.data.createDeployToken(ubr(e));return!r.success&&r.error.statusCode===403?g(new it(`${r.error.message} ${Hf()}`,r.error.errorType,r.error.endpoint,r.error.statusCode)):r}lbr(HL,"ciTokenCreateOperation");ae();bA();var H4n=Object.defineProperty,K4n=(e,t)=>H4n(e,"name",{value:t,configurable:!0});async function Voe(){let e=Qo();if(!e.success)return e;let t=await e.data.listTokens();return t.success?E({tokens:t.data.tokens.filter(UI)}):t}K4n(Voe,"ciTokenListOperation");var q4n=Object.defineProperty,Y4n=(e,t)=>q4n(e,"name",{value:t,configurable:!0});async function KL(e){let t=Qo();return t.success?t.data.revokeToken(e.id,e.reason):t}Y4n(KL,"ciTokenRevokeOperation");ae();bA();var J4n=Object.defineProperty,Z4n=(e,t)=>J4n(e,"name",{value:t,configurable:!0});async function Woe(){let e=Qo();if(!e.success)return e;let t=await e.data.listTokens();if(!t.success)return t;let r=t.data.tokens.filter(UI),n=0,a=0,o=0;for(let i of r){let s=Sy(i);s==="revoked"?o++:s==="expired"?a++:n++}return E({totalDeployTokens:r.length,activeDeployTokens:n,expiredDeployTokens:a,revokedDeployTokens:o,ready:n>0})}Z4n(Woe,"ciStatusOperation");ae();bA();var X4n=Object.defineProperty,ARe=(e,t)=>X4n(e,"name",{value:t,configurable:!0}),Q4n={credential:"Credential present",principal:"Deploy principal",expiry:"Token expiry",application:"Application resolves"},eGn=336*60*60*1e3,a6="Mint a deploy token in the fjall web app (Settings \u2192 CI/CD Tokens)";function kc(e,t,r,n){return{id:e,label:Q4n[e],status:t,...r!==void 0&&{detail:r},...n!==void 0&&{fix:n}}}ARe(kc,"check");function dbr(){let e=process.env.FJALL_API_KEY;return e===void 0||e===""?"stored login session":e.startsWith(WZe)?`${WZe} deploy token via FJALL_API_KEY`:"API key via FJALL_API_KEY"}ARe(dbr,"describeCredentialSource");async function zoe(e={}){let t=[],r=ARe(s=>{s&&t.push(kc("principal","skip","No credential to inspect")),t.push(kc("expiry","skip","No token expiry to check")),e.app!==void 0&&t.push(kc("application","skip","No credential to resolve with"))},"skipRest"),n=Qo();if(!n.success)return t.push(kc("credential","fail","No credentials found (FJALL_API_KEY unset and no stored login)",`Set FJALL_API_KEY to a deploy token (${a6}), or run fjall login`)),r(!0),E({checks:t,passed:!1});let a=n.data;t.push(kc("credential","pass",`Using ${dbr()}`));let o=await a.getSelfToken(),i;if(o.success?(i=o.data.expiresAt,UI(o.data)?t.push(kc("principal","pass",`Deploy principal (scopes: ${o.data.scopes.join(", ")})`)):t.push(kc("principal","warn","Authenticated as a personal/agent token, not a CI deploy principal",`${a6}, then set FJALL_API_KEY to it`))):o.error.errorType==="not_found"?t.push(kc("principal","warn","Authenticated via a login session, not a token \u2014 CI needs FJALL_API_KEY",a6)):o.error.errorType==="not_authenticated"||o.error.statusCode===401?t.push(kc("principal","fail",`Credential rejected by the API: ${o.error.message}`,`The token may be expired or revoked \u2014 ${a6}`)):t.push(kc("principal","fail",`Could not verify the credential: ${o.error.message}`)),i===void 0)t.push(kc("expiry","skip","No token expiry to check"));else{let s=new Date(i).getTime()-Date.now();if(Number.isNaN(s)||s<=0)t.push(kc("expiry","fail",`Token expired at ${i}`,a6));else if(s<eGn){let c=Math.max(1,Math.floor(s/864e5));t.push(kc("expiry","warn",`Token expires in ${c} day${c===1?"":"s"} (${i})`,`Rotate soon \u2014 ${a6}`))}else t.push(kc("expiry","pass",`Token valid until ${i}`))}if(e.app===void 0)t.push(kc("application","skip","Pass --app <name> to verify an application resolves"));else{let s=await a.getApplicationByName(e.app);s.success?t.push(kc("application","pass",`Application "${e.app}" resolved (id: ${s.data.application.id})`)):s.error.errorType==="not_found"?t.push(kc("application","fail",`Application "${e.app}" not found for this organisation`,"Check the name, or register the app first (fjall create app)")):s.error.errorType==="permission_denied"||s.error.statusCode===403?t.push(kc("application","fail",`The current principal is not authorised for "${e.app}"`,"Mint a deploy token scoped to this application in the fjall web app (Settings \u2192 CI/CD Tokens)")):t.push(kc("application","fail",`Could not resolve "${e.app}": ${s.error.message}`))}return E({checks:t,passed:!t.some(s=>s.status==="fail")})}ARe(zoe,"ciVerifyOperation");So();$();ae();w0();Rh();lQ();import{existsSync as Ebr,mkdirSync as dGn}from"node:fs";import{dirname as pGn,join as mGn,relative as fGn,resolve as hGn}from"node:path";$();ae();Yi();_n();Ha();var tGn=Object.defineProperty,mb=(e,t)=>tGn(e,"name",{value:t,configurable:!0}),pbr="NONE",Nft="MALFORMED",rGn="unknown:",mbr="Unconstrained: this token is not limited to any application, environment or AWS account in the organisation.",fbr="Stored constraints do not match {applicationIds?, environmentNames?, accountIds?} string arrays \u2014 enforcement ignores what it cannot parse. Re-mint the token with the constraints you intend.",wRe=["environmentNames","accountIds","applicationIds"];function hbr(e){return Array.isArray(e)&&e.length>0&&e.every(t=>typeof t=="string"&&t.trim().length>0)}mb(hbr,"isNonEmptyStringArray");function gbr(e){return wRe.includes(e)}mb(gbr,"isKnownAxis");function iv(e){if(e==null)return{kind:"none"};if(typeof e!="object"||Array.isArray(e))return{kind:"malformed"};let t={environmentNames:[],accountIds:[],applicationIds:[]};for(let[r,n]of Object.entries(e)){if(!gbr(r))return{kind:"malformed"};if(n!==void 0){if(!hbr(n))return{kind:"malformed"};t[r]=n}}return wRe.some(r=>t[r].length>0)?{kind:"constrained",axes:t}:{kind:"none"}}mb(iv,"parseTokenConstraints");function ybr(e,t){let r=t.get(e);if(r===void 0)return`${rGn}${e}`;let n=r.accountName?.trim();return n!==void 0&&n.length>0?`${n}(${r.awsAccountId})`:r.awsAccountId}mb(ybr,"labelAccountConstraint");function jT(e){return e.kind==="constrained"&&e.axes.accountIds.length>0}mb(jT,"hasAccountConstraint");function $ft(e,t){let r=t.get(e);if(r===void 0)return`${e} (no matching connected account)`;let n=r.accountName?.trim(),a=n!==void 0&&n.length>0?`${n}, ${r.awsAccountId}`:r.awsAccountId;return`${e} (${a})`}mb($ft,"annotateAccountCuid");function BT(e,t){if(e.kind==="malformed")return Nft;if(e.kind==="none")return pbr;let r=[];if(e.axes.environmentNames.length>0&&r.push(`env=${e.axes.environmentNames.join(",")}`),e.axes.accountIds.length>0){let n=t===void 0?String(e.axes.accountIds.length):e.axes.accountIds.map(a=>ybr(a,t)).join(",");r.push(`acct=${n}`)}return e.axes.applicationIds.length>0&&r.push(`app=${e.axes.applicationIds.length}`),r.join(" ")}mb(BT,"summariseTokenConstraints");function Mft(e){return new Map(e.map(t=>[t.id,{awsAccountId:t.awsAccountId,accountName:t.accountName}]))}mb(Mft,"buildAccountLookup");function Hoe(e,t){return e.kind==="malformed"?Nft:e.kind==="none"?"":e.axes[t].join(",")}mb(Hoe,"constraintAxisCell");function Lft(e){return JSON.stringify(e)??String(e)}mb(Lft,"formatRawConstraints");function o6(e){let t=_.colours;return e===pbr?H.hex(t.warning).bold(e):e===Nft?H.hex(t.error).bold(e):e}mb(o6,"emphasiseConstraintSummary");var nGn=Object.defineProperty,CRe=(e,t)=>nGn(e,"name",{value:t,configurable:!0}),aGn=/^\d{12}$/,Fft="/api/aws-accounts";function Koe(e){let t=e.accountName??"(unnamed)",r=e.environment!==null?`, stage ${e.environment}`:"";return`${t} (${e.awsAccountId}${r})`}CRe(Koe,"describeAccount");async function TRe(e,t){let r=await e.getAwsAccounts();if(!r.success)return r;let n=r.data.accounts,a=n.length>0?`Connected accounts: ${n.map(Koe).join(", ")}.`:"No AWS accounts are connected \u2014 connect one first (`fjall connect`).",o=[];for(let i of t){let s=i.trim(),c=n.filter(S=>S.awsAccountId===s),l=n.filter(S=>S.accountName!==null&&S.accountName.toLowerCase()===s.toLowerCase()),u=aGn.test(s),d=u?c:l,p=d===c?l:c,m=d.length>0?d:p,f=d.length>0?p.filter(S=>!d.includes(S)):[],[y,...v]=m;if(y===void 0)return g(new it(b(`Account "${s}" matches no connected AWS account (by name or 12-digit AWS account id). ${a}`),"not_found",Fft));if(f.length>0)return g(new it(b(`Account "${s}" is ambiguous across forms \u2014 it is the 12-digit AWS account id of ${c.map(Koe).join(", ")} and also the name of ${l.map(Koe).join(", ")}. Neither form names one row here: rename the connected account called "${s}" so the two stop colliding.`),"api_error",Fft));if(v.length>0){let S=m===l&&!u?"Pass the 12-digit AWS account id instead.":"Neither form separates them \u2014 rename or disconnect the duplicate row.";return g(new it(b(`Account "${s}" is ambiguous \u2014 it matches ${m.length} connected accounts: ${m.map(Koe).join(", ")}. ${S}`),"api_error",Fft))}o.includes(y.id)||o.push(y.id)}return E(o)}CRe(TRe,"resolveAccountConstraints");async function UT(){let e=Qo();if(!e.success)return;let t=await e.data.getAwsAccounts();if(t.success)return Mft(t.data.accounts)}CRe(UT,"loadAccountLookup");async function qoe(e){if(e===void 0||e.length===0)return E(void 0);let t=Qo();return t.success?TRe(t.data,e):t}CRe(qoe,"resolveAccountFlagInputs");Uft();bA();var sGn=Object.defineProperty,Gft=(e,t)=>sGn(e,"name",{value:t,configurable:!0}),fb="FJALL_API_KEY";var cGn="fjall-tech/fjall-deploy#v20",lGn="fjall-tech/fjall-deploy-action@v20",Sbr=".github/workflows/fjall-deploy.yml",bbr=".buildkite/pipeline.yml";function Vft(e){return`# Generated by \`fjall ci setup\` \u2014 deploys ${e.app} on every push to main.
 # Requires the ${fb} repository secret (a fjall_dk_ deploy token):
 #   gh secret set ${fb}
 name: Deploy ${e.app}