fjall 3.8.1 → 3.10.0

package/bin/assets/generators/cdn/generator.js

@@ -184,7 +184,7 @@ ${Ee.hex("#D9622E").bold(`--- ${e} ---`)}`),F&&F.start())}Ge(tj,"step");function
 `);return{buffer:[],stream:r}}flush(){let t=this.flushBuffer(this.buffer,this.mainLogStream,this.mainLogPath);this.buffer=t.buffer,this.mainLogStream=t.stream;let n=this.flushBuffer(this.debugBuffer,this.debugLogStream,this.debugLogPath);this.debugBuffer=n.buffer,this.debugLogStream=n.stream}close(){this.isClosing=!0,this.flush(),this.flushInterval&&(clearInterval(this.flushInterval),this.flushInterval=null),this.mainLogStream&&(this.mainLogStream.end(),this.mainLogStream=null),this.debugLogStream&&(this.debugLogStream.end(),this.debugLogStream=null),this.buffer=[],this.debugBuffer=[],this.initialised=!1,this.isClosing=!1}async closeAndFlush(){this.isClosing=!0,this.flush(),this.flushInterval&&(clearInterval(this.flushInterval),this.flushInterval=null);let t=[];this.mainLogStream&&(t.push(this.mainLogStream),this.mainLogStream=null),this.debugLogStream&&(t.push(this.debugLogStream),this.debugLogStream=null),this.buffer=[],this.debugBuffer=[],this.initialised=!1,await Promise.all(t.map(n=>new Promise(i=>{n.end(()=>i())}))),this.isClosing=!1}};import{createWriteStream as _j,existsSync as Ej,mkdirSync as xj}from"fs";import{join as bI}from"path";var rn={trace:0,debug:1,info:2,warn:3,error:4},We={MAX_FILE_SIZE:10*1024*1024,MAX_FILES:5,MAX_BUFFER_SIZE:100,FLUSH_INTERVAL_MS:500,LOG_FILENAME:"fjall.jsonl",DEBUG_LOG_FILENAME:"fjall-debug.jsonl"};import{join as vj}from"path";import{homedir as bj}from"os";var gj=Object.defineProperty,hj=(e,t)=>gj(e,"name",{value:t,configurable:!0});function Ir(){let e=process.env.FJALL_LOG_DIR;return e!==void 0&&e!==""?e:vj(bj(),".fjall","logs")}hj(Ir,"getDefaultLogDir");var yj=Object.defineProperty,Sj=(e,t)=>yj(e,"name",{value:t,configurable:!0}),Xo=class{static{Sj(this,"DeploymentLoggerImpl")}mainLogger;appName;operationType;logStream=null;logPath;deploymentId;buffer=[];flushInterval=null;isClosing=!1;maxBufferSize=We.MAX_BUFFER_SIZE;constructor(t,n,i){this.mainLogger=t,this.appName=n,this.operationType=i,this.deploymentId=`${i}-${Date.now()}`;let r=Ir(),o=bI(r,"deployments",n);Ej(o)||xj(o,{recursive:!0});let a=new Date().toISOString().replace(/[:.]/g,"-"),c=`${i}-${a}.jsonl`;this.logPath=bI(o,c);try{this.logStream=_j(this.logPath,{flags:"a"}),this.flushInterval=setInterval(()=>this.flush(),We.FLUSH_INTERVAL_MS),this.info("DeploymentLogger","Deployment logging initialised",{appName:n,operationType:i,deploymentId:this.deploymentId,logPath:this.logPath})}catch{}}log(t,n,i,r,o,a){if(this.isClosing)return;let c={timestamp:new Date().toISOString(),level:t,component:n,message:i,correlationId:this.deploymentId,...r&&Object.keys(r).length>0&&{data:r},...o&&{stackName:o},...a&&{phase:a}};this.buffer.push(c),this.mainLogger.logWithCorrelation(t,n,i,this.deploymentId,r,o,a),this.buffer.length>=this.maxBufferSize&&this.flush()}flush(){if(!(this.buffer.length===0||!this.logStream)){for(let t of this.buffer)this.logStream.write(JSON.stringify(t)+`
 `);this.buffer=[]}}info(t,n,i){this.log("info",t,n,i)}warn(t,n,i){this.log("warn",t,n,i)}error(t,n,i){this.log("error",t,n,i)}debug(t,n,i){this.log("debug",t,n,i)}stackEvent(t,n,i,r){this.log("info","StackDeployment",i,r,t,n)}dockerEvent(t,n){this.log("info","DockerOperation",t,{percentage:n})}ecsEvent(t,n,i){this.log("info","ECSDeployment",t,{percentage:n,taskCount:i})}close(){this.isClosing=!0,this.flush(),this.flushInterval&&(clearInterval(this.flushInterval),this.flushInterval=null),this.logStream&&(this.logStream.end(),this.logStream=null),this.buffer=[],this.isClosing=!1}getLogPath(){return this.logPath}getDeploymentId(){return this.deploymentId}};var Aj=Object.defineProperty,Ij=(e,t)=>Aj(e,"name",{value:t,configurable:!0}),vu=class e{static{Ij(this,"Logger")}static instance=null;config;debugEnabled;traceEnabled;minLevel;fileWriter;mainLogPath;debugLogPath;constructor(){let t=Ir(),n=nv(t,"debug"),i=this.parseEnvInt("FJALL_LOG_MAX_SIZE",We.MAX_FILE_SIZE),r=this.parseEnvInt("FJALL_LOG_MAX_FILES",We.MAX_FILES);this.config={logDir:t,debugLogDir:n,maxFileSize:i,maxFiles:r,maxBufferSize:We.MAX_BUFFER_SIZE,flushIntervalMs:We.FLUSH_INTERVAL_MS},this.mainLogPath=nv(t,We.LOG_FILENAME),this.debugLogPath=nv(n,We.DEBUG_LOG_FILENAME),this.debugEnabled=process.env.FJALL_DEBUG==="true"||process.env.FJALL_TRACE==="true"||process.argv.includes("--verbose")||process.argv.includes("-v"),this.traceEnabled=process.env.FJALL_TRACE==="true";let o=process.env.FJALL_LOG_LEVEL?.toLowerCase();o&&o in rn?this.minLevel=o:this.traceEnabled?this.minLevel="trace":this.debugEnabled?this.minLevel="debug":this.minLevel="info",this.fileWriter=new hu(this.config,this.mainLogPath,this.debugLogPath,this.debugEnabled)}parseEnvInt(t,n){let i=process.env[t];if(i){let r=parseInt(i,10);if(!isNaN(r)&&r>0)return r}return n}static getInstance(){return e.instance||(e.instance=new e),e.instance}shouldLog(t){return rn[t]>=rn[this.minLevel]}createEntry(t,n,i,r,o,a,c){return{timestamp:new Date().toISOString(),level:t,component:n,message:i,...o&&{correlationId:o},...r&&Object.keys(r).length>0&&{data:r},...a&&{stackName:a},...c&&{phase:c}}}log(t,n,i,r,o,a,c){if(!this.shouldLog(t))return;let u=this.createEntry(t,n,i,r,o,a,c),l=t==="debug"||t==="trace";this.fileWriter.write(u,l),this.writeConsole(u)}writeConsole(t){if(he.shouldSuppressOutput||he.isNonInteractive){this.debugEnabled&&this.writeDebugMirror(t);return}let n=this.getConsolePrefix(t.level),i=`[${t.component}]`,r=`${n} ${i} ${t.message}`;t.level==="error"?console.error(r):t.level==="warn"?console.warn(r):console.log(r)}writeDebugMirror(t){let n=this.getConsolePrefix(t.level),i=`[${t.component}]`,r="";if(t.data&&Object.keys(t.data).length>0)try{r=` ${JSON.stringify(t.data)}`}catch{r=" [unserialisable data]"}let o=`${n} ${i} ${t.message}${r}`;process.stderr.write(`${Nn(o)}
 `)}getConsolePrefix(t){switch(t){case"error":return"[ERROR]";case"warn":return"[WARN]";case"info":return"[INFO]";case"debug":return"[DEBUG]";case"trace":return"[TRACE]"}}error(t,n,i){this.log("error",t,n,i)}warn(t,n,i){this.log("warn",t,n,i)}info(t,n,i){this.log("info",t,n,i)}debug(t,n,i){this.log("debug",t,n,i)}trace(t,n,i){this.log("trace",t,n,i)}isDebugEnabled(){return this.debugEnabled}isTraceEnabled(){return this.traceEnabled}enableDebug(){this.debugEnabled=!0,rn[this.minLevel]>rn.debug&&(this.minLevel="debug"),this.fileWriter.setDebugEnabled(!0),this.fileWriter.isInitialised&&this.fileWriter.initialiseDebugStream()}withCorrelation(t){return new hi(this,t)}forDeployment(t,n="deploy"){return new Xo(this,t,n)}close(){this.fileWriter.close()}async flushAndClose(){await this.fileWriter.closeAndFlush()}getLogPath(){return this.mainLogPath}getDebugLogPath(){return this.debugLogPath}getLogDir(){return this.config.logDir}logWithCorrelation(t,n,i,r,o,a,c){this.log(t,n,i,o,r,a,c)}static reset(){e.instance&&(e.instance.close(),e.instance=null)}};var $j=Object.defineProperty,Tj=(e,t)=>$j(e,"name",{value:t,configurable:!0}),gu=vu.getInstance();function Nj(e){let t=Ir(),n=SI(t,"debug"),i=SI(n,We.DEBUG_LOG_FILENAME);try{yI(n)||Rj(n,{recursive:!0}),yI(i)&&Pj(i).size>We.MAX_FILE_SIZE&&new vi({maxFiles:We.MAX_FILES}).rotate(i);let r={timestamp:new Date().toISOString(),level:"debug",component:"Emergency",message:e};Cj(i,JSON.stringify(r)+`
-`)}catch{}}Tj(Nj,"writeDebugSync");var wj=Object.defineProperty,bi=(e,t)=>wj(e,"name",{value:t,configurable:!0});function iv(e){return e.success===!0}bi(iv,"isSuccess");function ov(e){return e.success===!1}bi(ov,"isFailure");function C(e){return{success:!0,data:e}}bi(C,"success");function $(e){return{success:!1,error:e}}bi($,"failure");async function av(e){try{let t=await e();return C(t)}catch(t){return $(ht(t))}}bi(av,"tryAsync");function sv(e){try{let t=e();return C(t)}catch(t){return $(ht(t))}}bi(sv,"trySync");var kj=Object.defineProperty,Oj=(e,t)=>kj(e,"name",{value:t,configurable:!0}),_I=/^[a-zA-Z][a-zA-Z0-9-]*$/,Dj=zo.source.replace(/^\^|\$$/g,""),L=Object.freeze({IDENTIFIER:_I,NEW_APP_NAME:/^[a-z][a-z0-9-]*$/,RESOURCE_NAME:/^[a-zA-Z][a-zA-Z0-9]*$/,ECS_SERVICE_NAME:_I,BUCKET_NAME:/^[a-z][a-z0-9-]*[a-z0-9]$|^[a-z][a-z0-9]*$/,DATABASE_NAME:/^[a-zA-Z][a-zA-Z0-9_]*$/,RESOURCE_TYPE:/^[a-z]+(:[a-z]+)?$/,SSM_PATH:new RegExp(`^(?:/${Dj})+$`),SECRET_NAME:qc,SSM_COMPONENT:zo,EMAIL:/^[^\s@]+@[^\s@]+\.[^\s@]+$/,DOCKER_IMAGE:/^[a-z0-9][a-z0-9._-]*[a-z0-9](:[a-z0-9._-]+)?$/,DOMAIN:/^[a-z0-9]([a-z0-9-]*[a-z0-9])?(\.[a-z0-9]([a-z0-9-]*[a-z0-9])?)+$/i,HTTP_ORIGIN:/^https?:\/\/[a-z0-9.-]+(:\d+)?$/i,PASCAL_CASE:/^[A-Z][A-Za-z0-9]*$/,AWS_ACCOUNT_ID:/^\d{12}$/,VPC_ID:/^vpc-[a-z0-9]+$/,ROLE_ARN:/^arn:aws[a-zA-Z-]*:iam::\d{12}:role\/.+$/,CIDR:/^((25[0-5]|2[0-4]\d|1\d\d|[1-9]?\d)\.){3}(25[0-5]|2[0-4]\d|1\d\d|[1-9]?\d)\/(3[0-2]|[12]?\d)$/,SCHEDULE_EXPRESSION:/^(rate\(1 (?:minute|hour|day)\)|rate\((?:[2-9]|[1-9]\d+) (?:minutes|hours|days)\)|cron\([^\s()]+ [^\s()]+ [^\s()]+ [^\s()]+ [^\s()]+ [^\s()]+\))$/,LAMBDA_RUNTIME_IDENTIFIER:/^[A-Za-z0-9._-]+$/,ENV_VAR_NAME:/^[A-Za-z_][A-Za-z0-9_]*$/});function cv(e){let t=/^rate\((\d+) (minute|minutes|hour|hours|day|days)\)$/.exec(e);if(!t)return;let n=t[1],i=t[2];if(n===void 0||i===void 0)return;let r=parseInt(n,10);if(!Number.isFinite(r)||r<1)return;let o=i==="minute"||i==="hour"||i==="day";if(!(o&&r!==1)&&!(!o&&r===1))return i==="minute"||i==="minutes"?{everyMs:r*6e4}:i==="hour"||i==="hours"?{everyMs:r*60*6e4}:{everyMs:r*24*60*6e4}}Oj(cv,"parseRateExpression");var d=Object.freeze({IDENTIFIER:"Must start with a letter, contain only letters, numbers, and hyphens",NEW_APP_NAME:"Must start with a lowercase letter and contain only lowercase letters, numbers, and hyphens",IDENTIFIER_MIN_LENGTH:"Must be at least 2 characters",IDENTIFIER_NO_TRAILING_HYPHEN:"Must not end with a hyphen",IDENTIFIER_NO_CONSECUTIVE_HYPHENS:"Must not contain consecutive hyphens",RESOURCE_NAME:"Must start with a letter and contain only letters and numbers (PascalCase recommended)",ECS_SERVICE_NAME:"Service name must start with a letter and contain only letters, numbers, and hyphens",BUCKET_NAME:"Bucket name must start with a lowercase letter and contain only lowercase letters, numbers, and hyphens",DATABASE_NAME:"Database name must start with a letter and contain only letters, numbers, and underscores",RESOURCE_TYPE:"Resource type must be in format 'category' or 'category:type'",SSM_PATH:"SSM path must start with / and contain valid namespace segments (e.g., /myapp/ApiCluster/service)",SECRET_NAME:ch,SSM_COMPONENT:Kc,EMAIL:"Please enter a valid email address",DOMAIN:"Please enter a valid domain (e.g., cms.example.com)",DOCKER_IMAGE:"Invalid Docker image name format",REQUIRED:{APP_NAME:"Application name is required",RESOURCE_NAME:"Resource name is required",BUCKET_NAME:"Bucket name is required",SERVICE_NAME:"Service name is required",NETWORK_NAME:"Network name is required",DATABASE_NAME:"Database name is required",ORGANISATION_NAME:"Organisation name is required",EMAIL:"Email is required",NAME:"Name is required",USERNAME:"Username is required",CONTAINER_NAME:"Container name is required",GROUP:"Group is required",PATTERN_NAME:"Pattern name is required",SOURCE:"Source directory is required",BUILD_COMMAND:"Build command is required",OUTPUT_DIR:"Output directory is required",FORMS_TO:"Forms recipient address is required",ROUTING_PATH:"Routing path is required",RESOURCE_REFERENCE:"Resource reference is required",RESOURCE_TYPE:"Resource type is required",VARIANT:"Variant is required",SUBTYPE:"Subtype is required",DEPLOY_TARGET:"Deploy target is required",DESTROY_TARGET:"Destroy target is required"},MAX_LENGTH:{APP_NAME:"Application name must be 50 characters or less",RESOURCE_NAME:"Resource name must be 63 characters or less",BUCKET_NAME:"Bucket name must be 63 characters or less",SERVICE_NAME:"Service name must be 255 characters or less",NETWORK_NAME:"Network name must be 50 characters or less",DATABASE_NAME:"Database name must be 63 characters or less",ORGANISATION_NAME:"Organisation name must be 50 characters or less"},PORT:{INTEGER:"Port must be an integer",MIN:"Port must be at least 1",MAX:"Port cannot exceed 65535"},USERNAME:{MAX_LENGTH:"Username cannot exceed 63 characters"},LAMBDA:{MEMORY:{INTEGER:"Lambda memory must be an integer",MIN:"Memory must be at least 128 MB",MAX:"Memory cannot exceed 10240 MB",MULTIPLE:"Memory must be 128 MB or a multiple of 64 MB"},TIMEOUT:{INTEGER:"Timeout must be an integer",MIN:"Timeout must be at least 1 second",MAX:"Timeout cannot exceed 900 seconds"},RUNTIME:"Lambda runtime must contain only letters, digits, dots, underscores, or dashes (e.g. 'NODEJS_20_X' or 'nodejs20.x')"},ENV_VAR_NAME:"Environment variable names must start with a letter or underscore and contain only letters, digits, and underscores",PRIORITY:{INTEGER:"Priority must be an integer",MIN:"Priority must be at least 1",MAX:"Priority cannot exceed 50000"},CAPACITY:{MIN:{INTEGER:"Minimum capacity must be an integer",MIN_0:"Minimum capacity must be at least 0",MIN_1:"Minimum capacity must be at least 1",MAX:"Minimum capacity cannot exceed 100"},MAX:{INTEGER:"Maximum capacity must be an integer",MIN_0:"Maximum capacity must be at least 0",MIN_1:"Maximum capacity must be at least 1",MAX:"Maximum capacity cannot exceed 100"},DESIRED:{INTEGER:"Desired count must be an integer",MIN:"Desired count must be at least 0",MAX:"Desired count cannot exceed 100"},WARM_POOL_REQUIRED:"minCapacity 0 requires a warmPool \u2014 without it, new tasks wait 60-90s for a cold instance launch",WARM_POOL:{MIN_SIZE:{INTEGER:"Warm pool minSize must be an integer",MIN:"Warm pool minSize must be at least 0",MAX:"Warm pool minSize cannot exceed 100"},MIN_SIZE_EXCEEDS_MAX_CAPACITY:"warmPool.minSize cannot exceed maxCapacity \u2014 the warm pool cannot hold more instances than the ASG allows"}},MEMORY_LIMIT:{INTEGER:"Memory limit must be an integer",MIN_512:"Memory limit must be at least 512 MiB",MIN_128:"Memory limit must be at least 128 MiB",MAX:"Memory limit cannot exceed 30720 MiB"},DATABASE:{PORT:{INTEGER:"Database port must be an integer",MIN:"Database port must be at least 1024",MAX:"Database port cannot exceed 65535"},NAME:{REQUIRED:"Database name is required",MAX_LENGTH:"Database name must be 63 characters or less"}},BACKUP_RETENTION:{INTEGER:"Backup retention must be an integer",MIN:"Backup retention must be at least 1 day",MAX:"Backup retention cannot exceed 35 days"},SQS:{VISIBILITY_TIMEOUT:{INTEGER:"Visibility timeout must be an integer",MIN:"Visibility timeout must be at least 0 seconds",MAX:"Visibility timeout cannot exceed 43200 seconds (12 hours)"},RETENTION_PERIOD:{INTEGER:"Retention period must be an integer",MIN:"Retention period must be at least 60 seconds",MAX:"Retention period cannot exceed 1209600 seconds (14 days)"}},READER:{COUNT:{INTEGER:"Reader count must be an integer",MIN:"Reader count must be at least 0",MAX:"Reader count cannot exceed 15"}},IDENTIFIER_SUFFIX:{REQUIRED:"Identifier suffix is required when specified",MAX_LENGTH:"Identifier suffix cannot exceed 50 characters"},ROTATION:{INTEGER:"Rotation days must be an integer",MIN:"Rotation interval must be at least 1 day",MAX:"Rotation interval cannot exceed 365 days"},MAX_CONNECTIONS:{INTEGER:"Max connections must be an integer",MIN:"Max connections must be at least 1",MAX:"Max connections cannot exceed 100"},MONITORING_INTERVAL:{INTEGER:"Monitoring interval must be an integer",MIN:"Monitoring interval must be at least 0",MAX:"Monitoring interval cannot exceed 60 seconds",VALUES:"Monitoring interval must be 0, 1, 5, 10, 15, 30, or 60 seconds"},RETENTION_DAYS:{INTEGER:"Retention days must be an integer",MIN:"Retention days must be at least 1",MAX:"Retention days cannot exceed 365"},BATCH_SIZE:{INTEGER:"Batch size must be an integer",MIN:"Batch size must be at least 1",MAX:"Batch size cannot exceed 10000"},SERVICE:{UNIQUE_WITHIN_CLUSTER:"Service names must be unique within a cluster",MIN_REQUIRED:"At least one service is required",ROUTING_REQUIRED:"Multiple services with ports require routing config (path or host)"},PROXY_CONFIG:{MAX_IDLE_CONNECTIONS:{INTEGER:"Max idle connections must be an integer",MIN:"Max idle connections must be at least 0",MAX:"Max idle connections cannot exceed 100"},BORROW_TIMEOUT:{INTEGER:"Connection borrow timeout must be an integer",MIN:"Connection borrow timeout must be at least 1 second",MAX:"Connection borrow timeout cannot exceed 3600 seconds"}},MAX_AZS:{INTEGER:"Max AZs must be an integer",MIN:"Max AZs must be at least 1",MAX:"Max AZs cannot exceed 3"},BATCHING_WINDOW:{INTEGER:"Max batching window must be an integer",MIN:"Max batching window must be at least 0",MAX:"Max batching window cannot exceed 300 seconds"},HEALTH_CHECK:{INTERVAL:{INTEGER:"Health check interval must be an integer",MIN:"Health check interval must be at least 5 seconds",MAX:"Health check interval cannot exceed 300 seconds"},TIMEOUT:{INTEGER:"Health check timeout must be an integer",MIN:"Health check timeout must be at least 2 seconds",MAX:"Health check timeout cannot exceed 60 seconds"},RETRIES:{INTEGER:"Health check retries must be an integer",MIN:"Health check retries must be at least 1",MAX:"Health check retries cannot exceed 10"},START_PERIOD:{INTEGER:"Health check start period must be an integer",MIN:"Health check start period must be at least 0 seconds",MAX:"Health check start period cannot exceed 300 seconds"}},EPHEMERAL_STORAGE:{INTEGER:"Ephemeral storage size must be an integer",MIN:"Ephemeral storage size must be at least 512 MB",MAX:"Ephemeral storage size cannot exceed 10240 MB"},MAX_MESSAGE_SIZE:{INTEGER:"Max message size must be an integer",MIN:"Max message size must be at least 1024 bytes",MAX:"Max message size cannot exceed 262144 bytes (256 KB)"},CAPACITY_CONSTRAINT:{MIN_LTE_MAX:"minCapacity must be less than or equal to maxCapacity"},DIRECT_ACCESS:{NO_DOMAIN:"directAccess cannot be used with domain (no ALB for HTTPS)",NO_LOAD_BALANCER:"directAccess cannot be used with loadBalancer (mutually exclusive)"},GLOBAL_AURORA:{PRIMARY_REGION_REQUIRED:"primaryRegion is required for GlobalAurora databases"},NAT_GATEWAY:{INTEGER:"NAT gateway count must be an integer",MIN:"NAT gateway count must be at least 0",MAX:"NAT gateway count cannot exceed 3"},CIDR_MASK:{INTEGER:"CIDR mask must be an integer",MIN:"CIDR mask must be at least 16",MAX:"CIDR mask cannot exceed 28"},CPU:{INTEGER:"CPU must be an integer",MIN:"CPU must be at least 256 units",MAX:"CPU cannot exceed 4096 units"},KMS:{KEY_REQUIRED:"KMS key ARN is required when using KMS encryption"},READER_INSTANCES:{MAX:"Cannot have more than 15 reader instances",COUNT_OR_INSTANCES:"Cannot specify both 'count' and 'instances' - use one or the other"},GENERATOR_CAPACITY:{MIN:{MIN:"Minimum capacity must be at least 1",MAX:"Minimum capacity cannot exceed 1000"},MAX:{MIN:"Maximum capacity must be at least 1",MAX:"Maximum capacity cannot exceed 1000"}},INSTANCE_TYPE:"Unknown instance type. Common types include: t4g.micro, t4g.small, m5.large",ARCHITECTURE_MISMATCH:"Architecture mismatch between instance type and AMI",ALLOCATED_STORAGE:{INTEGER:"Allocated storage must be an integer",MIN:"Allocated storage must be at least 20 GB",MAX:"Allocated storage cannot exceed 65536 GB"},DLQ:{MAX_RECEIVE_COUNT:{INTEGER:"Max receive count must be an integer",MIN:"Max receive count must be at least 1",MAX:"Max receive count cannot exceed 1000"}},ALARM:{PERCENTAGE:{MIN:"Threshold must be at least 1%",MAX:"Threshold must be at most 100%"},FREE_STORAGE_GIB:{MIN:"Free storage threshold must be at least 1 GiB"}},REGION:"Invalid AWS region",PASCAL_CASE:"Resource name must start with an uppercase letter and contain only alphanumerics (PascalCase).",IMAGE_DOCKER_MUTEX:"image and docker are mutually exclusive",AWS_ACCOUNT_ID:"AWS account id must be exactly 12 digits (no hyphens)",VPC_ID:"VPC id must look like vpc-abc12345",ROLE_ARN:"Role ARN must have the form arn:aws:iam::<account-id>:role/<name>",CIDR:"CIDR must be in dotted-quad/prefix-length form (e.g. 10.0.0.0/16)",VPC_PEER:{MIN_REQUESTER_ACCOUNTS:"At least one requester account id is required",REGION_REQUIRED:"Peer region is required when specified",ROUTE_TABLE_ID_REQUIRED:"Route table id must not be empty"},SCHEDULE_EXPRESSION:"Schedule expression must be 'rate(N minute|minutes|hour|hours|day|days)' with N>=1, or 'cron(<6-field AWS expression>)'"});var Mj=Object.defineProperty,st=(e,t)=>Mj(e,"name",{value:t,configurable:!0}),jj=["us-east-2","us-west-2","us-east-1","eu-west-1","eu-central-1","ap-southeast-1"],zj=Object.freeze(jj.flatMap(e=>{let t=Rn(e);return t?[t]:[]})),uv=Object.freeze(["us-east-2","us-west-2","us-east-1","eu-west-1","ap-southeast-1"]);function bu(e){return e?e.split(",").map(t=>t.trim()).filter(Boolean):[]}st(bu,"parseRegionList");function lv(e){return qt.includes(e)}st(lv,"isValidRegion");function dv(e){return/^[a-z]{2}-[a-z]+-[1-9]$/.test(e)}st(dv,"isValidRegionFormat");function mv(e){if(!e)return uv.slice(0,3);let t=e.toLowerCase().split("-"),n=t[0],i=t.length>1?t[1]:"",r=[];return n&&i&&(r=qt.filter(o=>o.startsWith(`${n}-${i}`))),r.length===0&&n&&(r=qt.filter(o=>o.startsWith(`${n}-`))),r.length>0?r.slice(0,3):uv.slice(0,3)}st(mv,"getSuggestions");function pv(e){if(lv(e))return!0;let t=mv(e);return dv(e)?`Unknown region. Try: ${t.join(", ")}`:`Invalid format. Try: ${t.join(", ")}`}st(pv,"validateRegion");function EI(e){if(!e||e.trim()==="")return!0;let t=bu(e);for(let n of t){let i=pv(n);if(i!==!0)return i}return!0}st(EI,"validateRegionList");function fv(e,t){return e.filter(n=>n!==t)}st(fv,"filterDuplicateRegions");function gv(e){return{label:e.city,value:e.code,description:e.optIn?`${e.code} \u2014 opt-in required`:e.code}}st(gv,"toRegionOption");function xI(){return it.map(gv)}st(xI,"getRegionOptions");function AI(e){return it.filter(t=>t.code!==e).map(gv)}st(AI,"getRegionOptionsExcluding");function II(e){let t=it.find(n=>n.code===e);return t?t.city:e}st(II,"getRegionName");function $I(e){return t=>{let n=bu(t);return fv(n,e)}}st($I,"createRegionFormatter");var yu="3.8.1";var Su=["Aurora","Instance","GlobalAurora","ClickHouse"],yi=["FARGATE","FARGATE_SPOT","EC2"],St=["standard","resilient","enterprise"],_u=["tinkerer","lightweight","standard","resilient","enterprise"],hv="custom",Jo=[..._u,hv];var Lj=Object.defineProperty,Uj=(e,t)=>Lj(e,"name",{value:t,configurable:!0}),V8=Object.freeze({RESOURCE_SUFFIXES:Object.freeze({storage:"Storage",database:"Database",cluster:"Cluster",function:"Function",instance:"Instance",compute:"Compute"})}),Qo=["ecs","lambda","ec2"],Si=Object.freeze({ECS:"ecs",LAMBDA:"lambda",EC2:"ec2"}),Eu=["code","container"],ea=Object.freeze({CODE:"code",CONTAINER:"container"}),xu=["ARM_64","X86_64"],TI="ARM_64",ta=["NONE","AWS_IAM"],Au=["public","internal"],Iu=["CPU","MEMORY"],$u=["ARM","STANDARD"],vv=["Instance","Aurora"],_i=["postgresql","mysql"],RI=["foundation","compliance","hardened"];var Tu=["t3.nano","t3.micro","t3.small","t3.medium","t3.large","t3.xlarge","t3.2xlarge","t3a.nano","t3a.micro","t3a.small","t3a.medium","t3a.large","t3a.xlarge","t3a.2xlarge","t4g.nano","t4g.micro","t4g.small","t4g.medium","t4g.large","t4g.xlarge","t4g.2xlarge","c5.large","c5.xlarge","c5.2xlarge","c5.4xlarge","c5.9xlarge","c5.12xlarge","c5.18xlarge","c5.24xlarge","c5a.large","c5a.xlarge","c5a.2xlarge","c5a.4xlarge","c5a.8xlarge","c5a.12xlarge","c5a.16xlarge","c5a.24xlarge","c6g.medium","c6g.large","c6g.xlarge","c6g.2xlarge","c6g.4xlarge","c6g.8xlarge","c6g.12xlarge","c6g.16xlarge","r5.large","r5.xlarge","r5.2xlarge","r5.4xlarge","r5.8xlarge","r5.12xlarge","r5.16xlarge","r5.24xlarge","r5a.large","r5a.xlarge","r5a.2xlarge","r5a.4xlarge","r5a.8xlarge","r5a.12xlarge","r5a.16xlarge","r5a.24xlarge","r6g.medium","r6g.large","r6g.xlarge","r6g.2xlarge","r6g.4xlarge","r6g.8xlarge","r6g.12xlarge","r6g.16xlarge","i3.large","i3.xlarge","i3.2xlarge","i3.4xlarge","i3.8xlarge","i3.16xlarge","p3.2xlarge","p3.8xlarge","p3.16xlarge","g4dn.xlarge","g4dn.2xlarge","g4dn.4xlarge","g4dn.8xlarge","g4dn.12xlarge","g4dn.16xlarge","m5.large","m5.xlarge","m5.2xlarge","m5.4xlarge","m5.8xlarge","m5.12xlarge","m5.16xlarge","m5.24xlarge","m5a.large","m5a.xlarge","m5a.2xlarge","m5a.4xlarge","m5a.8xlarge","m5a.12xlarge","m5a.16xlarge","m5a.24xlarge"],PI=[0,1,5,10,15,30,60];function ct(e,t){return e.includes(t)}Uj(ct,"constIncludes");var CI=1,NI=65535,q8=Object.freeze({postgresql:5432,mysql:3306}),wI=128,kI=10240,Ru=1,Pu=900,bv=1,yv=1e3,Ei=100,OI=100;var DI=3e3;var MI=["GET","POST","PUT","DELETE","HEAD","OPTIONS","PATCH"],jI=["standard","assets","upload","website"],xi=["AES256","KMS"];var Fj=Object.defineProperty,ra=(e,t)=>Fj(e,"name",{value:t,configurable:!0}),He=ra(e=>s.union([s.literal(!1),e]),"optionalOrDisabled"),nn={check:ra(e=>e.minCapacity!==void 0&&e.maxCapacity!==void 0?e.minCapacity<=e.maxCapacity:!0,"check"),params:{message:d.CAPACITY_CONSTRAINT.MIN_LTE_MAX,path:["maxCapacity"]}},na=ra(e=>s.number().int(d.MEMORY_LIMIT.INTEGER).min(e,e===128?d.MEMORY_LIMIT.MIN_128:d.MEMORY_LIMIT.MIN_512).max(30720,d.MEMORY_LIMIT.MAX),"memoryLimitMiBSchema"),V=s.string().min(1,d.REQUIRED.RESOURCE_NAME).max(63,d.MAX_LENGTH.RESOURCE_NAME).regex(L.RESOURCE_NAME,d.RESOURCE_NAME),LI=s.string().min(1,d.REQUIRED.BUCKET_NAME).max(63,d.MAX_LENGTH.BUCKET_NAME).regex(L.BUCKET_NAME,d.BUCKET_NAME),UI=s.string().min(1,d.REQUIRED.DATABASE_NAME).max(63,d.MAX_LENGTH.DATABASE_NAME).regex(L.DATABASE_NAME,d.DATABASE_NAME);function Cu(e,t=L.IDENTIFIER,n=d.IDENTIFIER){return s.string().min(2,d.IDENTIFIER_MIN_LENGTH).max(50,e).regex(t,n).refine(i=>!i.endsWith("-"),{message:d.IDENTIFIER_NO_TRAILING_HYPHEN}).refine(i=>!i.includes("--"),{message:d.IDENTIFIER_NO_CONSECUTIVE_HYPHENS})}ra(Cu,"identifierSchema");var ve=Cu(d.MAX_LENGTH.APP_NAME),t5=Cu(d.MAX_LENGTH.APP_NAME,L.NEW_APP_NAME,d.NEW_APP_NAME),on=s.number().int(d.PORT.INTEGER).min(CI,d.PORT.MIN).max(NI,d.PORT.MAX),Re=s.object({key:s.string(),sourceText:s.string()}).strict(),Bj=s.object({__identifier:s.string()}).strict(),Vj=s.object({__expression:s.string()}).strict(),Zj=s.object({__call:s.string()}).strict(),Gj=s.union([Bj,Vj,Zj]),Wj=s.union([s.string(),s.number(),s.boolean(),Gj]),Ai=s.record(s.string().regex(L.ENV_VAR_NAME,d.ENV_VAR_NAME),Wj),Hj=s.object({id:s.string(),name:s.string().optional(),arn:s.string().optional(),field:s.string().optional()}).strict().refine(e=>e.name!==void 0!=(e.arn!==void 0),{message:"secretsImport requires exactly one of `name` or `arn`."}),FI=s.record(s.string(),Hj),r5=s.record(s.string(),s.unknown()),Sv=s.enum(Jo).describe(`Application type must be one of: ${Jo.join(", ")}`),_v=s.enum(kt).describe(`OpenNext deployment pattern: ${kt.join(", ")}`),qj=s.enum(["before-imports","after-imports","after-app-init","after-tags","after-resource","end-of-file"]),Kj=s.enum(["import","app-init","tags","database","compute","storage","network","messaging","cdn","pattern","vpc-peer","vpc-peer-accepter","cross-plan-connection","custom"]),BI=s.object({sourceText:s.string(),position:qj,afterManagedResource:s.object({type:Kj,name:s.string().optional()}).strict().optional(),originalLine:s.number().int().optional(),leadingComments:s.array(s.string()).optional(),orphaned:s.boolean().optional(),orphanedComment:s.string().optional()}).strict(),VI=s.union([s.object({tier:s.enum(St)}).strict(),s.literal(!1)]),ZI=s.union([s.object({instanceType:s.string().optional()}).strict(),s.literal(!1)]),Yj=Cu(d.MAX_LENGTH.ORGANISATION_NAME),Xj=s.string().regex(L.EMAIL,d.EMAIL),zI=s.string().refine(e=>qt.includes(e),{message:d.REGION}),n5=s.object({name:Yj,email:Xj,accountName:s.string().optional(),primaryRegion:zI.optional().default(Tn),secondaryRegions:s.array(zI).optional(),security:s.enum(RI).optional(),force:s.boolean().optional()}).strict();function ia(e){return e.issues.map(t=>`${t.path.length>0?`${t.path.join(".")}: `:""}${t.message}`).join(`
+`)}catch{}}Tj(Nj,"writeDebugSync");var wj=Object.defineProperty,bi=(e,t)=>wj(e,"name",{value:t,configurable:!0});function iv(e){return e.success===!0}bi(iv,"isSuccess");function ov(e){return e.success===!1}bi(ov,"isFailure");function C(e){return{success:!0,data:e}}bi(C,"success");function $(e){return{success:!1,error:e}}bi($,"failure");async function av(e){try{let t=await e();return C(t)}catch(t){return $(ht(t))}}bi(av,"tryAsync");function sv(e){try{let t=e();return C(t)}catch(t){return $(ht(t))}}bi(sv,"trySync");var kj=Object.defineProperty,Oj=(e,t)=>kj(e,"name",{value:t,configurable:!0}),_I=/^[a-zA-Z][a-zA-Z0-9-]*$/,Dj=zo.source.replace(/^\^|\$$/g,""),L=Object.freeze({IDENTIFIER:_I,NEW_APP_NAME:/^[a-z][a-z0-9-]*$/,RESOURCE_NAME:/^[a-zA-Z][a-zA-Z0-9]*$/,ECS_SERVICE_NAME:_I,BUCKET_NAME:/^[a-z][a-z0-9-]*[a-z0-9]$|^[a-z][a-z0-9]*$/,DATABASE_NAME:/^[a-zA-Z][a-zA-Z0-9_]*$/,RESOURCE_TYPE:/^[a-z]+(:[a-z]+)?$/,SSM_PATH:new RegExp(`^(?:/${Dj})+$`),SECRET_NAME:qc,SSM_COMPONENT:zo,EMAIL:/^[^\s@]+@[^\s@]+\.[^\s@]+$/,DOCKER_IMAGE:/^[a-z0-9][a-z0-9._-]*[a-z0-9](:[a-z0-9._-]+)?$/,DOMAIN:/^[a-z0-9]([a-z0-9-]*[a-z0-9])?(\.[a-z0-9]([a-z0-9-]*[a-z0-9])?)+$/i,HTTP_ORIGIN:/^https?:\/\/[a-z0-9.-]+(:\d+)?$/i,PASCAL_CASE:/^[A-Z][A-Za-z0-9]*$/,AWS_ACCOUNT_ID:/^\d{12}$/,VPC_ID:/^vpc-[a-z0-9]+$/,ROLE_ARN:/^arn:aws[a-zA-Z-]*:iam::\d{12}:role\/.+$/,CIDR:/^((25[0-5]|2[0-4]\d|1\d\d|[1-9]?\d)\.){3}(25[0-5]|2[0-4]\d|1\d\d|[1-9]?\d)\/(3[0-2]|[12]?\d)$/,SCHEDULE_EXPRESSION:/^(rate\(1 (?:minute|hour|day)\)|rate\((?:[2-9]|[1-9]\d+) (?:minutes|hours|days)\)|cron\([^\s()]+ [^\s()]+ [^\s()]+ [^\s()]+ [^\s()]+ [^\s()]+\))$/,LAMBDA_RUNTIME_IDENTIFIER:/^[A-Za-z0-9._-]+$/,ENV_VAR_NAME:/^[A-Za-z_][A-Za-z0-9_]*$/});function cv(e){let t=/^rate\((\d+) (minute|minutes|hour|hours|day|days)\)$/.exec(e);if(!t)return;let n=t[1],i=t[2];if(n===void 0||i===void 0)return;let r=parseInt(n,10);if(!Number.isFinite(r)||r<1)return;let o=i==="minute"||i==="hour"||i==="day";if(!(o&&r!==1)&&!(!o&&r===1))return i==="minute"||i==="minutes"?{everyMs:r*6e4}:i==="hour"||i==="hours"?{everyMs:r*60*6e4}:{everyMs:r*24*60*6e4}}Oj(cv,"parseRateExpression");var d=Object.freeze({IDENTIFIER:"Must start with a letter, contain only letters, numbers, and hyphens",NEW_APP_NAME:"Must start with a lowercase letter and contain only lowercase letters, numbers, and hyphens",IDENTIFIER_MIN_LENGTH:"Must be at least 2 characters",IDENTIFIER_NO_TRAILING_HYPHEN:"Must not end with a hyphen",IDENTIFIER_NO_CONSECUTIVE_HYPHENS:"Must not contain consecutive hyphens",RESOURCE_NAME:"Must start with a letter and contain only letters and numbers (PascalCase recommended)",ECS_SERVICE_NAME:"Service name must start with a letter and contain only letters, numbers, and hyphens",BUCKET_NAME:"Bucket name must start with a lowercase letter and contain only lowercase letters, numbers, and hyphens",DATABASE_NAME:"Database name must start with a letter and contain only letters, numbers, and underscores",RESOURCE_TYPE:"Resource type must be in format 'category' or 'category:type'",SSM_PATH:"SSM path must start with / and contain valid namespace segments (e.g., /myapp/ApiCluster/service)",SECRET_NAME:ch,SSM_COMPONENT:Kc,EMAIL:"Please enter a valid email address",DOMAIN:"Please enter a valid domain (e.g., cms.example.com)",DOCKER_IMAGE:"Invalid Docker image name format",REQUIRED:{APP_NAME:"Application name is required",RESOURCE_NAME:"Resource name is required",BUCKET_NAME:"Bucket name is required",SERVICE_NAME:"Service name is required",NETWORK_NAME:"Network name is required",DATABASE_NAME:"Database name is required",ORGANISATION_NAME:"Organisation name is required",EMAIL:"Email is required",NAME:"Name is required",USERNAME:"Username is required",CONTAINER_NAME:"Container name is required",GROUP:"Group is required",PATTERN_NAME:"Pattern name is required",SOURCE:"Source directory is required",BUILD_COMMAND:"Build command is required",OUTPUT_DIR:"Output directory is required",FORMS_TO:"Forms recipient address is required",ROUTING_PATH:"Routing path is required",RESOURCE_REFERENCE:"Resource reference is required",RESOURCE_TYPE:"Resource type is required",VARIANT:"Variant is required",SUBTYPE:"Subtype is required",DEPLOY_TARGET:"Deploy target is required",DESTROY_TARGET:"Destroy target is required"},MAX_LENGTH:{APP_NAME:"Application name must be 50 characters or less",RESOURCE_NAME:"Resource name must be 63 characters or less",BUCKET_NAME:"Bucket name must be 63 characters or less",SERVICE_NAME:"Service name must be 255 characters or less",NETWORK_NAME:"Network name must be 50 characters or less",DATABASE_NAME:"Database name must be 63 characters or less",ORGANISATION_NAME:"Organisation name must be 50 characters or less"},PORT:{INTEGER:"Port must be an integer",MIN:"Port must be at least 1",MAX:"Port cannot exceed 65535"},USERNAME:{MAX_LENGTH:"Username cannot exceed 63 characters"},LAMBDA:{MEMORY:{INTEGER:"Lambda memory must be an integer",MIN:"Memory must be at least 128 MB",MAX:"Memory cannot exceed 10240 MB",MULTIPLE:"Memory must be 128 MB or a multiple of 64 MB"},TIMEOUT:{INTEGER:"Timeout must be an integer",MIN:"Timeout must be at least 1 second",MAX:"Timeout cannot exceed 900 seconds"},RUNTIME:"Lambda runtime must contain only letters, digits, dots, underscores, or dashes (e.g. 'NODEJS_20_X' or 'nodejs20.x')"},ENV_VAR_NAME:"Environment variable names must start with a letter or underscore and contain only letters, digits, and underscores",PRIORITY:{INTEGER:"Priority must be an integer",MIN:"Priority must be at least 1",MAX:"Priority cannot exceed 50000"},CAPACITY:{MIN:{INTEGER:"Minimum capacity must be an integer",MIN_0:"Minimum capacity must be at least 0",MIN_1:"Minimum capacity must be at least 1",MAX:"Minimum capacity cannot exceed 100"},MAX:{INTEGER:"Maximum capacity must be an integer",MIN_0:"Maximum capacity must be at least 0",MIN_1:"Maximum capacity must be at least 1",MAX:"Maximum capacity cannot exceed 100"},DESIRED:{INTEGER:"Desired count must be an integer",MIN:"Desired count must be at least 0",MAX:"Desired count cannot exceed 100"},WARM_POOL_REQUIRED:"minCapacity 0 requires a warmPool \u2014 without it, new tasks wait 60-90s for a cold instance launch",WARM_POOL:{MIN_SIZE:{INTEGER:"Warm pool minSize must be an integer",MIN:"Warm pool minSize must be at least 0",MAX:"Warm pool minSize cannot exceed 100"},MIN_SIZE_EXCEEDS_MAX_CAPACITY:"warmPool.minSize cannot exceed maxCapacity \u2014 the warm pool cannot hold more instances than the ASG allows"}},MEMORY_LIMIT:{INTEGER:"Memory limit must be an integer",MIN_512:"Memory limit must be at least 512 MiB",MIN_128:"Memory limit must be at least 128 MiB",MAX:"Memory limit cannot exceed 30720 MiB"},DATABASE:{PORT:{INTEGER:"Database port must be an integer",MIN:"Database port must be at least 1024",MAX:"Database port cannot exceed 65535"},NAME:{REQUIRED:"Database name is required",MAX_LENGTH:"Database name must be 63 characters or less"}},BACKUP_RETENTION:{INTEGER:"Backup retention must be an integer",MIN:"Backup retention must be at least 1 day",MAX:"Backup retention cannot exceed 35 days"},SQS:{VISIBILITY_TIMEOUT:{INTEGER:"Visibility timeout must be an integer",MIN:"Visibility timeout must be at least 0 seconds",MAX:"Visibility timeout cannot exceed 43200 seconds (12 hours)"},RETENTION_PERIOD:{INTEGER:"Retention period must be an integer",MIN:"Retention period must be at least 60 seconds",MAX:"Retention period cannot exceed 1209600 seconds (14 days)"}},READER:{COUNT:{INTEGER:"Reader count must be an integer",MIN:"Reader count must be at least 0",MAX:"Reader count cannot exceed 15"}},IDENTIFIER_SUFFIX:{REQUIRED:"Identifier suffix is required when specified",MAX_LENGTH:"Identifier suffix cannot exceed 50 characters"},ROTATION:{INTEGER:"Rotation days must be an integer",MIN:"Rotation interval must be at least 1 day",MAX:"Rotation interval cannot exceed 365 days"},MAX_CONNECTIONS:{INTEGER:"Max connections must be an integer",MIN:"Max connections must be at least 1",MAX:"Max connections cannot exceed 100"},MONITORING_INTERVAL:{INTEGER:"Monitoring interval must be an integer",MIN:"Monitoring interval must be at least 0",MAX:"Monitoring interval cannot exceed 60 seconds",VALUES:"Monitoring interval must be 0, 1, 5, 10, 15, 30, or 60 seconds"},RETENTION_DAYS:{INTEGER:"Retention days must be an integer",MIN:"Retention days must be at least 1",MAX:"Retention days cannot exceed 365"},BATCH_SIZE:{INTEGER:"Batch size must be an integer",MIN:"Batch size must be at least 1",MAX:"Batch size cannot exceed 10000"},SERVICE:{UNIQUE_WITHIN_CLUSTER:"Service names must be unique within a cluster",MIN_REQUIRED:"At least one service is required",ROUTING_REQUIRED:"Multiple services with ports require routing config (path or host)"},PROXY_CONFIG:{MAX_IDLE_CONNECTIONS:{INTEGER:"Max idle connections must be an integer",MIN:"Max idle connections must be at least 0",MAX:"Max idle connections cannot exceed 100"},BORROW_TIMEOUT:{INTEGER:"Connection borrow timeout must be an integer",MIN:"Connection borrow timeout must be at least 1 second",MAX:"Connection borrow timeout cannot exceed 3600 seconds"}},MAX_AZS:{INTEGER:"Max AZs must be an integer",MIN:"Max AZs must be at least 1",MAX:"Max AZs cannot exceed 3"},BATCHING_WINDOW:{INTEGER:"Max batching window must be an integer",MIN:"Max batching window must be at least 0",MAX:"Max batching window cannot exceed 300 seconds"},HEALTH_CHECK:{INTERVAL:{INTEGER:"Health check interval must be an integer",MIN:"Health check interval must be at least 5 seconds",MAX:"Health check interval cannot exceed 300 seconds"},TIMEOUT:{INTEGER:"Health check timeout must be an integer",MIN:"Health check timeout must be at least 2 seconds",MAX:"Health check timeout cannot exceed 60 seconds"},RETRIES:{INTEGER:"Health check retries must be an integer",MIN:"Health check retries must be at least 1",MAX:"Health check retries cannot exceed 10"},START_PERIOD:{INTEGER:"Health check start period must be an integer",MIN:"Health check start period must be at least 0 seconds",MAX:"Health check start period cannot exceed 300 seconds"}},EPHEMERAL_STORAGE:{INTEGER:"Ephemeral storage size must be an integer",MIN:"Ephemeral storage size must be at least 512 MB",MAX:"Ephemeral storage size cannot exceed 10240 MB"},MAX_MESSAGE_SIZE:{INTEGER:"Max message size must be an integer",MIN:"Max message size must be at least 1024 bytes",MAX:"Max message size cannot exceed 262144 bytes (256 KB)"},CAPACITY_CONSTRAINT:{MIN_LTE_MAX:"minCapacity must be less than or equal to maxCapacity"},DIRECT_ACCESS:{NO_DOMAIN:"directAccess cannot be used with domain (no ALB for HTTPS)",NO_LOAD_BALANCER:"directAccess cannot be used with loadBalancer (mutually exclusive)"},GLOBAL_AURORA:{PRIMARY_REGION_REQUIRED:"primaryRegion is required for GlobalAurora databases"},NAT_GATEWAY:{INTEGER:"NAT gateway count must be an integer",MIN:"NAT gateway count must be at least 0",MAX:"NAT gateway count cannot exceed 3"},CIDR_MASK:{INTEGER:"CIDR mask must be an integer",MIN:"CIDR mask must be at least 16",MAX:"CIDR mask cannot exceed 28"},CPU:{INTEGER:"CPU must be an integer",MIN:"CPU must be at least 256 units",MAX:"CPU cannot exceed 4096 units"},KMS:{KEY_REQUIRED:"KMS key ARN is required when using KMS encryption"},READER_INSTANCES:{MAX:"Cannot have more than 15 reader instances",COUNT_OR_INSTANCES:"Cannot specify both 'count' and 'instances' - use one or the other"},GENERATOR_CAPACITY:{MIN:{MIN:"Minimum capacity must be at least 1",MAX:"Minimum capacity cannot exceed 1000"},MAX:{MIN:"Maximum capacity must be at least 1",MAX:"Maximum capacity cannot exceed 1000"}},INSTANCE_TYPE:"Unknown instance type. Common types include: t4g.micro, t4g.small, m5.large",ARCHITECTURE_MISMATCH:"Architecture mismatch between instance type and AMI",ALLOCATED_STORAGE:{INTEGER:"Allocated storage must be an integer",MIN:"Allocated storage must be at least 20 GB",MAX:"Allocated storage cannot exceed 65536 GB"},DLQ:{MAX_RECEIVE_COUNT:{INTEGER:"Max receive count must be an integer",MIN:"Max receive count must be at least 1",MAX:"Max receive count cannot exceed 1000"}},ALARM:{PERCENTAGE:{MIN:"Threshold must be at least 1%",MAX:"Threshold must be at most 100%"},FREE_STORAGE_GIB:{MIN:"Free storage threshold must be at least 1 GiB"}},REGION:"Invalid AWS region",PASCAL_CASE:"Resource name must start with an uppercase letter and contain only alphanumerics (PascalCase).",IMAGE_DOCKER_MUTEX:"image and docker are mutually exclusive",AWS_ACCOUNT_ID:"AWS account id must be exactly 12 digits (no hyphens)",VPC_ID:"VPC id must look like vpc-abc12345",ROLE_ARN:"Role ARN must have the form arn:aws:iam::<account-id>:role/<name>",CIDR:"CIDR must be in dotted-quad/prefix-length form (e.g. 10.0.0.0/16)",VPC_PEER:{MIN_REQUESTER_ACCOUNTS:"At least one requester account id is required",REGION_REQUIRED:"Peer region is required when specified",ROUTE_TABLE_ID_REQUIRED:"Route table id must not be empty"},SCHEDULE_EXPRESSION:"Schedule expression must be 'rate(N minute|minutes|hour|hours|day|days)' with N>=1, or 'cron(<6-field AWS expression>)'"});var Mj=Object.defineProperty,st=(e,t)=>Mj(e,"name",{value:t,configurable:!0}),jj=["us-east-2","us-west-2","us-east-1","eu-west-1","eu-central-1","ap-southeast-1"],zj=Object.freeze(jj.flatMap(e=>{let t=Rn(e);return t?[t]:[]})),uv=Object.freeze(["us-east-2","us-west-2","us-east-1","eu-west-1","ap-southeast-1"]);function bu(e){return e?e.split(",").map(t=>t.trim()).filter(Boolean):[]}st(bu,"parseRegionList");function lv(e){return qt.includes(e)}st(lv,"isValidRegion");function dv(e){return/^[a-z]{2}-[a-z]+-[1-9]$/.test(e)}st(dv,"isValidRegionFormat");function mv(e){if(!e)return uv.slice(0,3);let t=e.toLowerCase().split("-"),n=t[0],i=t.length>1?t[1]:"",r=[];return n&&i&&(r=qt.filter(o=>o.startsWith(`${n}-${i}`))),r.length===0&&n&&(r=qt.filter(o=>o.startsWith(`${n}-`))),r.length>0?r.slice(0,3):uv.slice(0,3)}st(mv,"getSuggestions");function pv(e){if(lv(e))return!0;let t=mv(e);return dv(e)?`Unknown region. Try: ${t.join(", ")}`:`Invalid format. Try: ${t.join(", ")}`}st(pv,"validateRegion");function EI(e){if(!e||e.trim()==="")return!0;let t=bu(e);for(let n of t){let i=pv(n);if(i!==!0)return i}return!0}st(EI,"validateRegionList");function fv(e,t){return e.filter(n=>n!==t)}st(fv,"filterDuplicateRegions");function gv(e){return{label:e.city,value:e.code,description:e.optIn?`${e.code} \u2014 opt-in required`:e.code}}st(gv,"toRegionOption");function xI(){return it.map(gv)}st(xI,"getRegionOptions");function AI(e){return it.filter(t=>t.code!==e).map(gv)}st(AI,"getRegionOptionsExcluding");function II(e){let t=it.find(n=>n.code===e);return t?t.city:e}st(II,"getRegionName");function $I(e){return t=>{let n=bu(t);return fv(n,e)}}st($I,"createRegionFormatter");var yu="3.10.0";var Su=["Aurora","Instance","GlobalAurora","ClickHouse"],yi=["FARGATE","FARGATE_SPOT","EC2"],St=["standard","resilient","enterprise"],_u=["tinkerer","lightweight","standard","resilient","enterprise"],hv="custom",Jo=[..._u,hv];var Lj=Object.defineProperty,Uj=(e,t)=>Lj(e,"name",{value:t,configurable:!0}),V8=Object.freeze({RESOURCE_SUFFIXES:Object.freeze({storage:"Storage",database:"Database",cluster:"Cluster",function:"Function",instance:"Instance",compute:"Compute"})}),Qo=["ecs","lambda","ec2"],Si=Object.freeze({ECS:"ecs",LAMBDA:"lambda",EC2:"ec2"}),Eu=["code","container"],ea=Object.freeze({CODE:"code",CONTAINER:"container"}),xu=["ARM_64","X86_64"],TI="ARM_64",ta=["NONE","AWS_IAM"],Au=["public","internal"],Iu=["CPU","MEMORY"],$u=["ARM","STANDARD"],vv=["Instance","Aurora"],_i=["postgresql","mysql"],RI=["foundation","compliance","hardened"];var Tu=["t3.nano","t3.micro","t3.small","t3.medium","t3.large","t3.xlarge","t3.2xlarge","t3a.nano","t3a.micro","t3a.small","t3a.medium","t3a.large","t3a.xlarge","t3a.2xlarge","t4g.nano","t4g.micro","t4g.small","t4g.medium","t4g.large","t4g.xlarge","t4g.2xlarge","c5.large","c5.xlarge","c5.2xlarge","c5.4xlarge","c5.9xlarge","c5.12xlarge","c5.18xlarge","c5.24xlarge","c5a.large","c5a.xlarge","c5a.2xlarge","c5a.4xlarge","c5a.8xlarge","c5a.12xlarge","c5a.16xlarge","c5a.24xlarge","c6g.medium","c6g.large","c6g.xlarge","c6g.2xlarge","c6g.4xlarge","c6g.8xlarge","c6g.12xlarge","c6g.16xlarge","r5.large","r5.xlarge","r5.2xlarge","r5.4xlarge","r5.8xlarge","r5.12xlarge","r5.16xlarge","r5.24xlarge","r5a.large","r5a.xlarge","r5a.2xlarge","r5a.4xlarge","r5a.8xlarge","r5a.12xlarge","r5a.16xlarge","r5a.24xlarge","r6g.medium","r6g.large","r6g.xlarge","r6g.2xlarge","r6g.4xlarge","r6g.8xlarge","r6g.12xlarge","r6g.16xlarge","i3.large","i3.xlarge","i3.2xlarge","i3.4xlarge","i3.8xlarge","i3.16xlarge","p3.2xlarge","p3.8xlarge","p3.16xlarge","g4dn.xlarge","g4dn.2xlarge","g4dn.4xlarge","g4dn.8xlarge","g4dn.12xlarge","g4dn.16xlarge","m5.large","m5.xlarge","m5.2xlarge","m5.4xlarge","m5.8xlarge","m5.12xlarge","m5.16xlarge","m5.24xlarge","m5a.large","m5a.xlarge","m5a.2xlarge","m5a.4xlarge","m5a.8xlarge","m5a.12xlarge","m5a.16xlarge","m5a.24xlarge"],PI=[0,1,5,10,15,30,60];function ct(e,t){return e.includes(t)}Uj(ct,"constIncludes");var CI=1,NI=65535,q8=Object.freeze({postgresql:5432,mysql:3306}),wI=128,kI=10240,Ru=1,Pu=900,bv=1,yv=1e3,Ei=100,OI=100;var DI=3e3;var MI=["GET","POST","PUT","DELETE","HEAD","OPTIONS","PATCH"],jI=["standard","assets","upload","website"],xi=["AES256","KMS"];var Fj=Object.defineProperty,ra=(e,t)=>Fj(e,"name",{value:t,configurable:!0}),He=ra(e=>s.union([s.literal(!1),e]),"optionalOrDisabled"),nn={check:ra(e=>e.minCapacity!==void 0&&e.maxCapacity!==void 0?e.minCapacity<=e.maxCapacity:!0,"check"),params:{message:d.CAPACITY_CONSTRAINT.MIN_LTE_MAX,path:["maxCapacity"]}},na=ra(e=>s.number().int(d.MEMORY_LIMIT.INTEGER).min(e,e===128?d.MEMORY_LIMIT.MIN_128:d.MEMORY_LIMIT.MIN_512).max(30720,d.MEMORY_LIMIT.MAX),"memoryLimitMiBSchema"),V=s.string().min(1,d.REQUIRED.RESOURCE_NAME).max(63,d.MAX_LENGTH.RESOURCE_NAME).regex(L.RESOURCE_NAME,d.RESOURCE_NAME),LI=s.string().min(1,d.REQUIRED.BUCKET_NAME).max(63,d.MAX_LENGTH.BUCKET_NAME).regex(L.BUCKET_NAME,d.BUCKET_NAME),UI=s.string().min(1,d.REQUIRED.DATABASE_NAME).max(63,d.MAX_LENGTH.DATABASE_NAME).regex(L.DATABASE_NAME,d.DATABASE_NAME);function Cu(e,t=L.IDENTIFIER,n=d.IDENTIFIER){return s.string().min(2,d.IDENTIFIER_MIN_LENGTH).max(50,e).regex(t,n).refine(i=>!i.endsWith("-"),{message:d.IDENTIFIER_NO_TRAILING_HYPHEN}).refine(i=>!i.includes("--"),{message:d.IDENTIFIER_NO_CONSECUTIVE_HYPHENS})}ra(Cu,"identifierSchema");var ve=Cu(d.MAX_LENGTH.APP_NAME),t5=Cu(d.MAX_LENGTH.APP_NAME,L.NEW_APP_NAME,d.NEW_APP_NAME),on=s.number().int(d.PORT.INTEGER).min(CI,d.PORT.MIN).max(NI,d.PORT.MAX),Re=s.object({key:s.string(),sourceText:s.string()}).strict(),Bj=s.object({__identifier:s.string()}).strict(),Vj=s.object({__expression:s.string()}).strict(),Zj=s.object({__call:s.string()}).strict(),Gj=s.union([Bj,Vj,Zj]),Wj=s.union([s.string(),s.number(),s.boolean(),Gj]),Ai=s.record(s.string().regex(L.ENV_VAR_NAME,d.ENV_VAR_NAME),Wj),Hj=s.object({id:s.string(),name:s.string().optional(),arn:s.string().optional(),field:s.string().optional()}).strict().refine(e=>e.name!==void 0!=(e.arn!==void 0),{message:"secretsImport requires exactly one of `name` or `arn`."}),FI=s.record(s.string(),Hj),r5=s.record(s.string(),s.unknown()),Sv=s.enum(Jo).describe(`Application type must be one of: ${Jo.join(", ")}`),_v=s.enum(kt).describe(`OpenNext deployment pattern: ${kt.join(", ")}`),qj=s.enum(["before-imports","after-imports","after-app-init","after-tags","after-resource","end-of-file"]),Kj=s.enum(["import","app-init","tags","database","compute","storage","network","messaging","cdn","pattern","vpc-peer","vpc-peer-accepter","cross-plan-connection","custom"]),BI=s.object({sourceText:s.string(),position:qj,afterManagedResource:s.object({type:Kj,name:s.string().optional()}).strict().optional(),originalLine:s.number().int().optional(),leadingComments:s.array(s.string()).optional(),orphaned:s.boolean().optional(),orphanedComment:s.string().optional()}).strict(),VI=s.union([s.object({tier:s.enum(St)}).strict(),s.literal(!1)]),ZI=s.union([s.object({instanceType:s.string().optional()}).strict(),s.literal(!1)]),Yj=Cu(d.MAX_LENGTH.ORGANISATION_NAME),Xj=s.string().regex(L.EMAIL,d.EMAIL),zI=s.string().refine(e=>qt.includes(e),{message:d.REGION}),n5=s.object({name:Yj,email:Xj,accountName:s.string().optional(),primaryRegion:zI.optional().default(Tn),secondaryRegions:s.array(zI).optional(),security:s.enum(RI).optional(),force:s.boolean().optional()}).strict();function ia(e){return e.issues.map(t=>`${t.path.length>0?`${t.path.join(".")}: `:""}${t.message}`).join(`
 `)}ra(ia,"getZodErrorMessage");var Ii=s.number().min(1,d.ALARM.PERCENTAGE.MIN).max(100,d.ALARM.PERCENTAGE.MAX),Jj=s.number().min(1,d.ALARM.FREE_STORAGE_GIB.MIN),GI=s.union([s.literal(!1),s.object({cpuThreshold:Ii.optional(),memoryThreshold:Ii.optional(),runningTasksMinimum:s.number().int().min(0).optional(),http5xxThreshold:Ii.optional()}).strict()]),WI=s.union([s.literal(!1),s.object({cpuThreshold:Ii.optional(),freeStorageThresholdGiB:Jj.optional(),connectionsThreshold:s.number().int().min(1).optional()}).strict()]),HI=s.union([s.literal(!1),s.object({errorRateThreshold:Ii.optional(),durationThresholdPercent:Ii.optional()}).strict()]);var Jt=s.number().int(d.BACKUP_RETENTION.INTEGER).min(1,d.BACKUP_RETENTION.MIN).max(35,d.BACKUP_RETENTION.MAX),oa=s.number().int(d.MONITORING_INTERVAL.INTEGER).refine(e=>ct(PI,e),{message:d.MONITORING_INTERVAL.VALUES}),wu=s.number().int(d.DATABASE.PORT.INTEGER).min(1024,d.DATABASE.PORT.MIN).max(65535,d.DATABASE.PORT.MAX),Qj=s.enum(Su).describe(`Database type must be one of: ${Su.join(", ")}`),ez=s.object({maxConnections:s.number().int(d.MAX_CONNECTIONS.INTEGER).min(1,d.MAX_CONNECTIONS.MIN).max(100,d.MAX_CONNECTIONS.MAX).optional(),maxIdleConnections:s.number().int(d.PROXY_CONFIG.MAX_IDLE_CONNECTIONS.INTEGER).min(0,d.PROXY_CONFIG.MAX_IDLE_CONNECTIONS.MIN).max(100,d.PROXY_CONFIG.MAX_IDLE_CONNECTIONS.MAX).optional(),connectionBorrowTimeout:s.number().int(d.PROXY_CONFIG.BORROW_TIMEOUT.INTEGER).min(1,d.PROXY_CONFIG.BORROW_TIMEOUT.MIN).max(3600,d.PROXY_CONFIG.BORROW_TIMEOUT.MAX).optional(),requireTLS:s.boolean().optional()}).strict().describe("RDS Proxy configuration"),tz=s.object({instanceType:s.string().optional(),availabilityZone:s.string().optional()}).strict().describe("Read replica configuration"),rz=s.object({automaticallyAfterDays:s.number().int(d.ROTATION.INTEGER).min(1,d.ROTATION.MIN).max(365,d.ROTATION.MAX).optional()}).strict().describe("Secret rotation configuration"),ku=s.object({username:s.string().min(1,d.REQUIRED.USERNAME).max(63,d.USERNAME.MAX_LENGTH).optional(),secretRotation:rz.optional()}).strict().describe("Database credentials configuration"),Ou=He(ez),Du=He(tz),nz=s.object({scaleWithWriter:s.boolean().optional(),enableDatabaseInsights:s.boolean().optional(),identifierSuffix:s.string().min(1,d.IDENTIFIER_SUFFIX.REQUIRED).max(50,d.IDENTIFIER_SUFFIX.MAX_LENGTH).optional(),availabilityZone:s.string().optional()}).strict().describe("Configuration for a single Aurora reader instance"),aa=s.object({enableDatabaseInsights:s.boolean().optional(),identifierSuffix:s.string().min(1,d.IDENTIFIER_SUFFIX.REQUIRED).max(50,d.IDENTIFIER_SUFFIX.MAX_LENGTH).optional(),availabilityZone:s.string().optional()}).strict().describe("Configuration for Aurora writer instance"),iz=s.object({count:s.number().int(d.READER.COUNT.INTEGER).min(0,d.READER.COUNT.MIN).max(15,d.READER.COUNT.MAX).optional(),instances:s.array(nz).max(15,d.READER_INSTANCES.MAX).optional(),defaultEnableDatabaseInsights:s.boolean().optional()}).strict().refine(e=>!(e.count!==void 0&&e.instances!==void 0),{message:d.READER_INSTANCES.COUNT_OR_INSTANCES,path:["count"]}).describe("Aurora readers configuration"),sa=He(iz),oz=s.object({awsManaged:s.literal(!0)}).strict(),az=s.object({useCMK:s.literal(!0)}).strict(),qI=s.union([oz,az]),sz=s.object({mode:s.enum(["standard","advanced"]).optional(),encryptionKey:qI.optional()}).strict().describe("Database Insights configuration"),Mu=He(sz),ju=s.object({storageKey:qI.optional()}).strict().describe("Encryption configuration (DESTRUCTIVE to change storageKey)"),KI=s.object({name:V,type:Qj,databaseName:s.string().min(1,d.REQUIRED.DATABASE_NAME),instanceType:s.string().optional(),allocatedStorage:s.number().optional(),multiAz:s.boolean().optional(),publiclyAccessible:s.boolean().optional(),databaseInsights:Mu.optional(),port:wu.optional(),deletionProtection:s.boolean().optional(),proxy:Ou.optional(),credentials:ku.optional(),readReplica:Du.optional(),encryption:ju.optional(),writer:aa.optional(),readers:sa.optional(),backupRetention:Jt.optional(),preferredMaintenanceWindow:s.string().optional(),monitoringInterval:oa.optional(),primaryRegion:s.string().optional(),secondaryRegions:s.array(s.string()).optional(),globalClusterIdentifier:s.string().optional(),enableGlobalWriteForwarding:s.boolean().optional(),snapshotIdentifier:s.string().optional(),snapshotUsername:s.string().optional(),databaseEngine:s.enum(_i).optional(),engineExpression:s.string().optional(),variableName:s.string().optional(),extraProperties:s.array(Re).optional(),alarms:WI.optional()}).strict(),zu=s.object({appName:ve,nameProvidedByFlag:s.boolean().optional(),databaseName:s.string().min(1,d.REQUIRED.DATABASE_NAME).max(63,d.MAX_LENGTH.DATABASE_NAME).regex(L.DATABASE_NAME,d.DATABASE_NAME),resourceName:V.optional(),connectionConfig:s.object({connectToCompute:s.array(s.string()).optional(),connectToServices:s.array(s.string()).optional()}).strict().optional(),databaseInsights:Mu.optional(),port:wu.optional(),proxy:Ou.optional(),credentials:ku.optional(),encryption:ju.optional(),deletionProtection:s.boolean().optional()}).strict(),YI={databaseType:s.literal("Instance"),instanceType:s.string().optional(),multiAz:s.boolean().optional(),readReplica:Du.optional(),publiclyAccessible:s.boolean().optional(),backupRetention:Jt.optional(),allocatedStorage:s.number().optional(),snapshotIdentifier:s.string().optional(),snapshotUsername:s.string().optional()},XI={databaseType:s.literal("Aurora"),writer:aa.optional(),readers:sa.optional(),backupRetention:Jt.optional(),preferredMaintenanceWindow:s.string().optional(),monitoringInterval:oa.optional(),snapshotIdentifier:s.string().optional(),snapshotUsername:s.string().optional()},JI={databaseType:s.literal("GlobalAurora"),primaryRegion:s.string().min(1,d.GLOBAL_AURORA.PRIMARY_REGION_REQUIRED),secondaryRegions:s.array(s.string()).optional(),globalClusterIdentifier:s.string().optional(),enableGlobalWriteForwarding:s.boolean().optional(),writer:aa.optional(),readers:sa.optional(),backupRetention:Jt.optional(),preferredMaintenanceWindow:s.string().optional(),monitoringInterval:oa.optional(),snapshotIdentifier:s.string().optional(),snapshotUsername:s.string().optional()},QI=s.object({appName:ve,nameProvidedByFlag:s.boolean().optional(),databaseName:s.string().min(1,d.REQUIRED.DATABASE_NAME).max(63,d.MAX_LENGTH.DATABASE_NAME).regex(L.DATABASE_NAME,d.DATABASE_NAME),resourceName:V.optional(),connectionConfig:s.object({connectToCompute:s.array(s.string()).optional(),connectToServices:s.array(s.string()).optional()}).strict().optional()}).strict(),e$={databaseType:s.literal("ClickHouse"),instanceType:s.string().optional(),coldTier:s.union([s.object({mode:s.literal("s3")}).strict(),s.literal(!1)]).optional(),optimiseSchedule:s.union([s.string(),s.literal(!1)]).optional(),backupSchedule:s.union([s.string(),s.literal(!1)]).optional(),backupRetentionDays:Jt.optional()},cz=zu.extend(YI).strict(),uz=zu.extend(XI).strict(),lz=zu.extend(JI).strict(),dz=QI.extend(e$).strict(),p5=s.discriminatedUnion("databaseType",[cz,uz,lz,dz]),Ev=zu.extend({resourceName:V}).strict(),mz=Ev.extend(YI).strict(),pz=Ev.extend(XI).strict(),fz=Ev.extend(JI).strict(),gz=QI.extend({resourceName:V}).strict(),hz=gz.extend(e$).strict(),f5=s.discriminatedUnion("databaseType",[mz,pz,fz,hz]),g5=s.object({appName:ve,databaseName:s.string().min(1,d.REQUIRED.DATABASE_NAME),maxConnections:s.number().int(d.MAX_CONNECTIONS.INTEGER).min(1,d.MAX_CONNECTIONS.MIN).max(100,d.MAX_CONNECTIONS.MAX).optional(),maxIdleConnections:s.number().int(d.PROXY_CONFIG.MAX_IDLE_CONNECTIONS.INTEGER).min(0,d.PROXY_CONFIG.MAX_IDLE_CONNECTIONS.MIN).max(100,d.PROXY_CONFIG.MAX_IDLE_CONNECTIONS.MAX).optional(),connectionBorrowTimeout:s.number().int(d.PROXY_CONFIG.BORROW_TIMEOUT.INTEGER).min(1,d.PROXY_CONFIG.BORROW_TIMEOUT.MIN).max(3600,d.PROXY_CONFIG.BORROW_TIMEOUT.MAX).optional(),requireTLS:s.boolean().optional(),nameProvidedByFlag:s.boolean().optional()}).strict(),vz=["S","N","B"],Nu=s.object({name:s.string(),type:s.enum(vz)}).strict(),t$=s.object({name:V,partitionKey:Nu,sortKey:Nu.optional(),globalSecondaryIndexes:s.array(s.object({indexName:s.string(),partitionKey:Nu,sortKey:Nu.optional()}).strict()).optional(),ttlAttribute:s.string().optional(),stream:s.boolean().optional(),variableName:s.string().optional(),extraProperties:s.array(Re).optional()}).strict(),bz=s.object({mode:s.literal("s3")}).strict(),r$=s.object({name:V,type:s.literal("ClickHouse"),databaseName:UI,instanceType:s.string().optional(),coldTier:s.union([bz,s.literal(!1)]).optional(),optimiseSchedule:s.union([s.string(),s.literal(!1)]).optional(),backupSchedule:s.union([s.string(),s.literal(!1)]).optional(),backupRetentionDays:Jt.optional(),variableName:s.string().optional(),extraProperties:s.array(Re).optional()}).strict();var yz=s.object({count:s.number().int(d.NAT_GATEWAY.INTEGER).min(0,d.NAT_GATEWAY.MIN).max(3,d.NAT_GATEWAY.MAX).optional()}).strict().describe("NAT gateway configuration"),n$=He(yz),xv=s.enum(["cloudwatch","s3"]),Sz=s.object({destination:xv.optional(),retentionDays:s.number().int(d.RETENTION_DAYS.INTEGER).min(1,d.RETENTION_DAYS.MIN).max(365,d.RETENTION_DAYS.MAX).optional(),trafficType:s.enum(["ALL","ACCEPT","REJECT"]).optional()}).strict().describe("VPC flow log configuration"),i$=He(Sz),_z=s.object({s3:s.boolean().optional(),dynamodb:s.boolean().optional()}).strict().describe("Gateway VPC endpoints (FREE)"),Ez=He(_z),xz=s.object({ecr:s.boolean().optional(),secretsManager:s.boolean().optional(),kms:s.boolean().optional(),cloudwatchLogs:s.boolean().optional(),ssm:s.boolean().optional(),sts:s.boolean().optional()}).strict().describe("Interface VPC endpoints (cost per hour)"),Az=He(xz),Iz=s.object({gateway:Ez.optional(),interface:Az.optional()}).strict().describe("VPC endpoints configuration"),o$=He(Iz),Lu=s.object({maxAzs:s.number().int(d.MAX_AZS.INTEGER).min(1,d.MAX_AZS.MIN).max(3,d.MAX_AZS.MAX).optional(),natGateways:n$.optional(),flowLogs:i$.optional(),vpcEndpoints:o$.optional(),cidrMask:s.number().int(d.CIDR_MASK.INTEGER).min(16,d.CIDR_MASK.MIN).max(28,d.CIDR_MASK.MAX).optional()}).strict(),a$=s.string().min(1,d.REQUIRED.NETWORK_NAME).max(50,d.MAX_LENGTH.NETWORK_NAME).regex(L.RESOURCE_NAME,d.RESOURCE_NAME),s$=Lu.extend({name:a$}).strict(),c$=He(Lu),S5=s.object({appName:ve,networkName:a$.optional(),maxAzs:s.number().int(d.MAX_AZS.INTEGER).min(1,d.MAX_AZS.MIN).max(3,d.MAX_AZS.MAX).optional(),natGateways:n$.optional(),flowLogs:i$.optional(),vpcEndpoints:o$.optional()}).strict(),$z=L.CIDR,Av=s.string().regex($z,d.CIDR),Tz=s.object({kind:s.literal("database"),resource:s.string().min(1,d.REQUIRED.RESOURCE_REFERENCE),name:V,allowedFromCidrs:s.array(Av),access:s.enum(["read","write","readWrite"]).optional()}).strict(),Rz=s.object({kind:s.literal("ecsService"),resource:s.string().min(1,d.REQUIRED.RESOURCE_REFERENCE),serviceName:s.string().min(1,d.REQUIRED.SERVICE_NAME),name:V,allowedFromCidrs:s.array(Av),port:on.optional()}).strict(),Pz=s.discriminatedUnion("kind",[Tz,Rz]),_5=s.object({name:V,peerAppName:s.string().min(1,d.REQUIRED.APP_NAME),peerAccountId:s.string().regex(L.AWS_ACCOUNT_ID,d.AWS_ACCOUNT_ID),peerRegion:s.string().min(1,d.VPC_PEER.REGION_REQUIRED).optional(),peerVpcId:s.string().regex(L.VPC_ID,d.VPC_ID).optional(),peerVpcCidr:Av.optional(),peerRoleArn:s.string().regex(L.ROLE_ARN,d.ROLE_ARN).optional(),peerRouteTableIds:s.array(s.string().min(1,d.VPC_PEER.ROUTE_TABLE_ID_REQUIRED)).optional(),localVpcName:s.string().min(1,d.REQUIRED.NETWORK_NAME).optional(),enableDnsResolution:s.boolean().optional()}).strict(),E5=s.object({name:V,requesterAccountIds:s.array(s.string().regex(L.AWS_ACCOUNT_ID,d.AWS_ACCOUNT_ID)).min(1,d.VPC_PEER.MIN_REQUESTER_ACCOUNTS),localVpcName:s.string().min(1,d.REQUIRED.NETWORK_NAME).optional(),publishToSsm:s.boolean().optional(),exposedResources:s.array(Pz).optional()}).strict();var Uu=["storage","cdn","compute"],Cz=s.object({sid:s.string().optional(),effect:s.enum(["Allow","Deny"]),principals:s.array(s.string()),actions:s.array(s.string()),resources:s.array(s.string()).optional(),conditions:s.record(s.string(),s.record(s.string(),s.union([s.string(),s.array(s.string())]))).optional()}).strict(),u$=s.object({name:V,bucketName:s.string().optional(),publicReadAccess:s.boolean().optional(),websiteHosting:s.object({indexDocument:s.string(),errorDocument:s.string().optional()}).strict().optional(),backupVaultTier:s.enum(St).optional(),versioned:s.boolean().optional(),encryption:s.enum(xi).optional(),kmsKeyArn:s.string().optional(),cors:s.array(s.object({allowedOrigins:s.array(s.string()),allowedMethods:s.array(s.string()),allowedHeaders:s.array(s.string()).optional(),exposedHeaders:s.array(s.string()).optional(),maxAge:s.number().optional()}).strict()).optional(),deployment:s.object({source:s.string(),prune:s.boolean().optional(),cacheControl:s.object({maxAge:s.number().optional(),immutable:s.boolean().optional()}).strict().optional()}).strict().optional(),retain:s.boolean().optional(),resourcePolicyStatements:s.array(Cz).optional(),stackPlacement:s.enum(Uu).optional(),variableName:s.string().optional(),extraProperties:s.array(Re).optional()}).strict().refine(e=>e.encryption!=="KMS"||!!e.kmsKeyArn,{message:d.KMS.KEY_REQUIRED}),R5=s.object({appName:ve,bucketName:LI,nameProvidedByFlag:s.boolean().optional(),storagePreset:s.enum(jI).optional(),publicReadAccess:s.boolean().optional(),websiteHosting:s.object({indexDocument:s.string(),errorDocument:s.string().optional()}).strict().optional(),backupVaultTier:s.enum(St).optional(),versioned:s.boolean().optional(),encryption:s.enum(xi).optional(),kmsKeyArn:s.string().optional(),cors:s.array(s.object({allowedOrigins:s.array(s.string()),allowedMethods:s.array(s.string()),allowedHeaders:s.array(s.string()).optional(),exposedHeaders:s.array(s.string()).optional(),maxAge:s.number().optional()}).strict()).optional(),connectionConfig:s.object({connectToCompute:s.array(s.string()).optional(),connectToServices:s.array(s.string()).optional()}).strict().optional()}).strict().refine(e=>e.encryption!=="KMS"||!!e.kmsKeyArn,{message:d.KMS.KEY_REQUIRED,path:["kmsKeyArn"]});var Iv=s.enum(["DESTROY","RETAIN"]),l$=s.object({name:V,queueType:s.enum(["standard","fifo"]).default("standard"),visibilityTimeout:s.number().int(d.SQS.VISIBILITY_TIMEOUT.INTEGER).min(0,d.SQS.VISIBILITY_TIMEOUT.MIN).max(43200,d.SQS.VISIBILITY_TIMEOUT.MAX).optional(),retentionPeriod:s.number().int(d.SQS.RETENTION_PERIOD.INTEGER).min(60,d.SQS.RETENTION_PERIOD.MIN).max(1209600,d.SQS.RETENTION_PERIOD.MAX).optional(),contentBasedDeduplication:s.boolean().optional(),removalPolicy:Iv.optional(),variableName:s.string().optional(),extraProperties:s.array(Re).optional()}).strict();var d$=s.object({type:s.literal("basic-auth"),username:s.string().min(1),password:s.string().min(1)}).strict(),m$=s.object({name:V,defaultOriginRef:s.string(),behaviours:s.array(s.object({pathPattern:s.string(),originRef:s.string(),cachePolicy:s.enum(["CACHING_OPTIMIZED","CACHING_DISABLED"]).optional()}).strict()).optional(),customDomain:s.string().optional(),certificateArn:s.string().optional(),accessGate:s.union([s.literal(!1),d$]).optional(),extraProperties:s.array(Re).optional()}).strict(),p$=s.object({appName:s.string(),name:V.optional(),defaultOriginRef:s.string(),behaviours:s.array(s.object({pathPattern:s.string(),originRef:s.string(),cachePolicy:s.enum(["CACHING_OPTIMIZED","CACHING_DISABLED"]).optional()}).strict()).optional(),customDomain:s.string().optional(),certificateArn:s.string().optional(),accessGate:s.union([s.literal(!1),d$]).optional(),nameProvidedByFlag:s.boolean().optional()}).strict();var Nz=Object.defineProperty,$v=(e,t)=>Nz(e,"name",{value:t,configurable:!0}),wz=new Set(["t4g","c6g","c6gd","c6gn","c7g","c7gd","c7gn","r6g","r6gd","r7g","r7gd","m6g","m6gd","m7g","m7gd","a1","x2gd","im4gn","is4gen","i4g","hpc7g"]);function $i(e){let t=e.split(".")[0]??"";return wz.has(t)?"ARM":"STANDARD"}$v($i,"getArchitectureForInstanceType");function Fu(e,t){let n=$i(e);return n!==t?{valid:!1,message:`Instance type '${e}' requires ${n} architecture, but '${t}' AMI was specified. Use a ${n==="ARM"?"Graviton instance (t4g, c6g, r6g, m6g, etc.)":"Intel/AMD instance (t3, c5, r5, m5, etc.)"} instead.`}:{valid:!0}}$v(Fu,"validateArchitectureMatch");function f$(e,t){return $i(e)===t}$v(f$,"isArchitectureCompatible");var kz=Object.defineProperty,Bu=(e,t)=>kz(e,"name",{value:t,configurable:!0});var Oz=1,Dz=/^[A-Za-z0-9_.-]+$/,Mz=s.object({id:s.string().min(1,"buildSecret id cannot be empty").regex(Dz,"buildSecret id may contain only letters, digits, '_', '.', and '-' (no comma, '=', or whitespace, which would break the buildx --secret argv)"),ssm:s.string().min(1,"ssm parameter name cannot be empty").optional(),secretsManager:s.object({name:s.string().min(1,"secret name cannot be empty").optional(),arn:s.string().min(1,"secret arn cannot be empty").optional(),field:s.string().min(1,"secret field cannot be empty").optional()}).strict().refine(e=>e.name===void 0!=(e.arn===void 0),"secretsManager requires exactly one of name or arn").optional(),env:s.string().min(1,"env variable name cannot be empty").optional()}).strict().superRefine((e,t)=>{[e.ssm,e.secretsManager,e.env].filter(n=>n!==void 0).length!==1&&t.addIssue({code:s.ZodIssueCode.custom,message:"buildSecret requires exactly one source (ssm, secretsManager, or env)"})}),jz=s.union([s.string(),s.object({ssm:s.string().min(1,"ssm parameter name cannot be empty").optional(),secretsManager:s.object({name:s.string().min(1,"secret name cannot be empty").optional(),arn:s.string().min(1,"secret arn cannot be empty").optional(),field:s.string().min(1,"secret field cannot be empty").optional()}).strict().refine(e=>e.name===void 0!=(e.arn===void 0),"secretsManager requires exactly one of name or arn").optional(),env:s.string().min(1,"env variable name cannot be empty").optional(),acknowledgePublic:s.boolean().optional()}).strict().superRefine((e,t)=>{[e.ssm,e.secretsManager,e.env].filter(n=>n!==void 0).length!==1&&t.addIssue({code:s.ZodIssueCode.custom,message:"buildArg value requires exactly one source (ssm, secretsManager, or env)"})})]),Ot=s.object({path:s.string(),context:s.string().min(1,"context cannot be empty").optional(),target:s.string().min(1,"target cannot be empty").optional(),buildArgs:s.record(s.string(),jz).optional(),buildSecrets:s.array(Mz).optional()}).strict(),U5=Ot.partial();function zz(e,t){if(t===void 0)return e;let n=t.context??e.context,i=t.target??e.target,r=t.buildArgs??e.buildArgs,o=t.buildSecrets??e.buildSecrets;return{path:t.path??e.path,...n!==void 0&&{context:n},...i!==void 0&&{target:i},...r!==void 0&&{buildArgs:r},...o!==void 0&&{buildSecrets:o}}}Bu(zz,"mergeDockerBuild");function Tv(e){return typeof e=="object"&&e!==null&&!Array.isArray(e)}Bu(Tv,"isRecord");function g$(e){if(!Tv(e)||typeof e.path!="string"||e.path.length===0)return;let t=typeof e.context=="string"&&e.context.length>0?e.context:void 0,n=typeof e.target=="string"&&e.target.length>0?e.target:void 0,i=Tv(e.buildArgs)&&Object.keys(e.buildArgs).length>0?e.buildArgs:void 0,r=Array.isArray(e.buildSecrets)&&e.buildSecrets.length>0?e.buildSecrets:void 0,o={path:e.path,...t!==void 0&&{context:t},...n!==void 0&&{target:n},...i!==void 0&&{buildArgs:i},...r!==void 0&&{buildSecrets:r}},a=Ot.safeParse(o);return a.success?a.data:void 0}Bu(g$,"normaliseDockerBuild");function Lz(e){if(e===void 0)return;let t=g$(e);return t===void 0?void 0:JSON.stringify(t)}Bu(Lz,"dockerBuildFingerprint");var Uz=s.object({name:s.string(),clusterName:s.string().optional(),docker:Ot.optional(),containerPort:s.number().optional(),secrets:s.array(s.string()).optional(),ssmSecretsPath:s.string().optional(),importedSecretNames:s.array(s.string()).optional()}).strict(),Fz=s.object({type:s.enum(kt),name:s.string(),source:s.string()}).strict(),Bz=s.object({repositoryName:s.string()}).strict(),Vz=s.object({name:s.string(),secrets:s.array(s.string()).optional(),ssmSecretsPath:s.string().optional(),importedSecretNames:s.array(s.string()).optional(),docker:Ot.optional(),imageKey:s.string().optional()}).strict(),Zz=s.object({templateHash:s.string(),synthTimestamp:s.string()}).strict(),Gz=s.object({constructPath:s.string().max(512),group:s.string().max(128),resourceType:s.string().max(256)}).strict(),F5=s.object({version:s.literal(Oz),generatedAt:s.string(),appName:s.string(),services:s.array(Uz),lambdas:s.array(Vz),pattern:Fz.optional(),ecr:Bz.optional(),stacks:s.record(s.string(),Zz),resourceMap:s.record(s.string(),Gz).optional()}).strict();var Wz=Object.defineProperty,Hz=(e,t)=>Wz(e,"name",{value:t,configurable:!0});function v$(e){return!(e.image!==void 0&&e.docker!==void 0)}Hz(v$,"imageDockerMutexCheck");var b$=s.number().int(d.CAPACITY.MIN.INTEGER).min(bv,d.GENERATOR_CAPACITY.MIN.MIN).max(yv,d.GENERATOR_CAPACITY.MIN.MAX),y$=s.number().int(d.CAPACITY.MAX.INTEGER).min(bv,d.GENERATOR_CAPACITY.MAX.MIN).max(yv,d.GENERATOR_CAPACITY.MAX.MAX),Ti=s.number().int(d.LAMBDA.MEMORY.INTEGER).min(wI,d.LAMBDA.MEMORY.MIN).max(kI,d.LAMBDA.MEMORY.MAX).refine(e=>e===128||e%64===0,d.LAMBDA.MEMORY.MULTIPLE),S$=s.string().regex(L.LAMBDA_RUNTIME_IDENTIFIER,d.LAMBDA.RUNTIME),Rv=s.number().int(d.CPU.INTEGER).min(256,d.CPU.MIN).max(4096,d.CPU.MAX),Zu=s.number().int(d.CAPACITY.DESIRED.INTEGER).min(0,d.CAPACITY.DESIRED.MIN).max(Ei,d.CAPACITY.DESIRED.MAX),ca=s.object({connectToDatabase:s.array(s.string()).optional()}).strict(),qz=s.object({minSize:s.number().int(d.CAPACITY.WARM_POOL.MIN_SIZE.INTEGER).min(0,d.CAPACITY.WARM_POOL.MIN_SIZE.MIN).max(OI,d.CAPACITY.WARM_POOL.MIN_SIZE.MAX).optional(),reuseOnScaleIn:s.boolean().optional()}).strict(),Pv=s.object({instanceType:s.string().optional(),amiHardwareType:s.enum($u).optional(),minCapacity:s.number().int(d.CAPACITY.MIN.INTEGER).min(0,d.CAPACITY.MIN.MIN_0).max(Ei,d.CAPACITY.MIN.MAX).optional(),maxCapacity:s.number().int(d.CAPACITY.MAX.INTEGER).min(1,d.CAPACITY.MAX.MIN_1).max(Ei,d.CAPACITY.MAX.MAX).optional(),memoryLimitMiB:na(128).optional(),warmPool:qz.optional(),extraProperties:s.array(Re).optional()}).strict().superRefine((e,t)=>{if(!e.instanceType||!e.amiHardwareType)return;let n=Fu(e.instanceType,e.amiHardwareType);n.valid||t.addIssue({code:"custom",message:n.message??d.ARCHITECTURE_MISMATCH,path:["instanceType"]})}).superRefine((e,t)=>{e.minCapacity===0&&!e.warmPool&&t.addIssue({code:"custom",message:d.CAPACITY.WARM_POOL_REQUIRED,path:["minCapacity"]}),e.warmPool?.minSize!==void 0&&e.maxCapacity!==void 0&&e.warmPool.minSize>e.maxCapacity&&t.addIssue({code:"custom",message:d.CAPACITY.WARM_POOL.MIN_SIZE_EXCEEDS_MAX_CAPACITY,path:["warmPool","minSize"]})}),Kz=s.enum(Qo).describe(`Compute type must be one of: ${Qo.join(", ")}`),Cv=s.enum(yi).describe(`ECS capacity provider must be one of: ${yi.join(", ")}`),Nv=s.string().refine(e=>ct(Tu,e),{message:d.INSTANCE_TYPE}),_$=s.object({sourceType:s.enum(["sqs","dynamodb","eventbridge"]),sourceRef:s.string().describe("Name of the source resource"),batchSize:s.number().int(d.BATCH_SIZE.INTEGER).min(1,d.BATCH_SIZE.MIN).max(1e4,d.BATCH_SIZE.MAX).optional(),startingPosition:s.enum(["TRIM_HORIZON","LATEST"]).optional(),maxBatchingWindow:s.number().int(d.BATCHING_WINDOW.INTEGER).min(0,d.BATCHING_WINDOW.MIN).max(300,d.BATCHING_WINDOW.MAX).optional(),reportBatchItemFailures:s.boolean().optional()}).strict(),Yz=s.object({name:s.string().min(1,d.REQUIRED.CONTAINER_NAME).optional(),image:s.string().optional(),port:on.optional(),environment:Ai.optional(),secretsImport:FI.optional(),command:s.array(s.string()).optional(),entryPoint:s.array(s.string()).optional(),essential:s.boolean().optional(),healthCheck:s.object({command:s.array(s.string()),interval:s.number().int(d.HEALTH_CHECK.INTERVAL.INTEGER).min(5,d.HEALTH_CHECK.INTERVAL.MIN).max(300,d.HEALTH_CHECK.INTERVAL.MAX).optional(),timeout:s.number().int(d.HEALTH_CHECK.TIMEOUT.INTEGER).min(2,d.HEALTH_CHECK.TIMEOUT.MIN).max(60,d.HEALTH_CHECK.TIMEOUT.MAX).optional(),retries:s.number().int(d.HEALTH_CHECK.RETRIES.INTEGER).min(1,d.HEALTH_CHECK.RETRIES.MIN).max(10,d.HEALTH_CHECK.RETRIES.MAX).optional(),startPeriod:s.number().int(d.HEALTH_CHECK.START_PERIOD.INTEGER).min(0,d.HEALTH_CHECK.START_PERIOD.MIN).max(300,d.HEALTH_CHECK.START_PERIOD.MAX).optional()}).strict().optional(),ssmSecrets:s.array(s.string().regex(L.SECRET_NAME,d.SECRET_NAME)).optional(),extraProperties:s.array(Re).optional()}).strict(),E$=s.string().min(1,d.REQUIRED.SERVICE_NAME).max(255,d.MAX_LENGTH.SERVICE_NAME).regex(L.ECS_SERVICE_NAME,d.ECS_SERVICE_NAME),x$=s.object({domain:s.string().optional(),loadBalancer:s.union([s.literal(!1),s.enum(Au)]).optional(),directAccess:s.boolean().optional(),extraProperties:s.array(Re).optional()}).strict().refine(e=>!(e.directAccess&&e.domain),{message:d.DIRECT_ACCESS.NO_DOMAIN,path:["directAccess"]}).refine(e=>!(e.directAccess&&typeof e.loadBalancer=="string"),{message:d.DIRECT_ACCESS.NO_LOAD_BALANCER}).describe("Cluster-level configuration"),Vu=s.object({path:s.string().optional(),host:s.string().optional(),priority:s.number().int(d.PRIORITY.INTEGER).min(1,d.PRIORITY.MIN).max(5e4,d.PRIORITY.MAX).optional(),healthCheckPath:s.string().optional()}).strict().describe("Path/host-based routing configuration"),Xz=s.object({desiredCount:Zu.optional(),minCapacity:s.number().int(d.CAPACITY.MIN.INTEGER).min(0,d.CAPACITY.MIN.MIN_0).max(Ei,d.CAPACITY.MIN.MAX).optional(),maxCapacity:s.number().int(d.CAPACITY.MAX.INTEGER).min(1,d.CAPACITY.MAX.MIN_1).max(Ei,d.CAPACITY.MAX.MAX).optional(),scalingType:s.enum(Iu).optional()}).strict().refine(nn.check,nn.params).describe("ECS service scaling configuration"),A$=s.object({name:E$,docker:Ot.optional(),needsDatabaseConnection:s.boolean().optional(),needsStorageConnection:s.boolean().optional(),needsMessagingConnection:s.boolean().optional(),image:s.string().optional(),containers:s.array(Yz).optional(),routing:s.union([Vu,s.array(Vu).min(1)]).optional(),cpu:Rv.optional(),memoryLimitMiB:na(512).optional(),desiredCount:Zu.optional(),scaling:He(Xz).optional(),capacityProvider:Cv,ec2Config:Pv.optional(),ssmSecretsPath:s.string().regex(L.SSM_PATH,d.SSM_PATH).optional(),extraProperties:s.array(Re).optional(),alarms:GI.optional()}).strict().superRefine((e,t)=>{v$(e)||t.addIssue({code:"custom",path:["docker"],message:d.IMAGE_DOCKER_MUTEX})}).describe("Configuration for a service in an ECS cluster"),I$=s.object({name:V,type:Kz,needsConnection:s.boolean(),connectedDatabase:s.array(s.string()).optional(),connectedStorage:s.array(s.string()).optional(),connectedMessaging:s.array(s.string()).optional(),cluster:x$.optional(),services:s.array(A$).optional(),docker:Ot.partial().optional(),deployment:s.enum(Eu).optional(),codePath:s.string().optional(),timeout:s.number().int(d.LAMBDA.TIMEOUT.INTEGER).min(Ru,d.LAMBDA.TIMEOUT.MIN).max(Pu,d.LAMBDA.TIMEOUT.MAX).optional(),memory:Ti.optional(),handler:s.string().optional(),runtime:S$.optional(),environment:Ai.optional(),secrets:Ai.optional(),eventSources:s.array(_$).optional(),functionUrl:s.object({authType:s.enum(ta)}).strict().optional(),description:s.string().optional(),scheduleExpression:s.string().optional(),architecture:s.enum(xu).optional(),ephemeralStorageSize:s.number().int(d.EPHEMERAL_STORAGE.INTEGER).min(512,d.EPHEMERAL_STORAGE.MIN).max(10240,d.EPHEMERAL_STORAGE.MAX).optional(),functionName:s.string().optional(),ssmSecrets:s.array(s.string()).optional(),ssmSecretsPath:s.string().optional(),alarms:HI.optional(),instanceType:Nv.optional(),enableSSH:s.boolean().optional(),keyName:s.string().optional(),userData:s.string().optional(),securityGroups:s.array(s.string()).optional(),variableName:s.string().optional(),extraProperties:s.array(Re).optional()}).strict().superRefine((e,t)=>{if(e.type==="ecs"&&e.services)for(let n=0;n<e.services.length;n++){let i=e.services[n];i?.ec2Config?.instanceType&&!i.ec2Config.amiHardwareType&&$i(i.ec2Config.instanceType)!=="ARM"&&t.addIssue({code:"custom",message:`Service '${i.name??n}' uses instance type '${i.ec2Config.instanceType}' (x86), which requires Docker images built for linux/amd64. The default build targets linux/arm64 (Graviton). Use a Graviton instance type (t4g, c6g, r6g, m6g, etc.) or set amiHardwareType: "STANDARD" to acknowledge x86.`,path:["services",n,"ec2Config","instanceType"]})}e.type==="lambda"&&e.deployment==="container"&&e.architecture==="X86_64"&&t.addIssue({code:"custom",message:"Lambda architecture 'X86_64' requires Docker images built for linux/amd64, but the default build targets linux/arm64. Use 'ARM_64' for Graviton Lambdas (recommended) or ensure your build pipeline targets linux/amd64.",path:["architecture"]})}),Y5=s.object({appName:ve,clusterName:V,containerPort:on,nameProvidedByFlag:s.boolean().optional(),ecrRepository:s.string().optional(),capacityProvider:Cv.optional(),useAppEcr:s.boolean().optional(),desiredCount:Zu.optional(),cpu:Rv.optional(),memoryLimitMiB:na(512).optional(),minCapacity:b$.optional(),maxCapacity:y$.optional(),ec2Config:Pv.optional(),connectionConfig:ca.optional()}).strict().refine(nn.check,nn.params),X5=s.object({appName:ve,functionName:V,nameProvidedByFlag:s.boolean().optional(),lambdaType:s.enum(["basic","web","custom"]).optional(),ecrRepository:s.string().optional(),timeout:s.number().int(d.LAMBDA.TIMEOUT.INTEGER).min(Ru,d.LAMBDA.TIMEOUT.MIN).max(Pu,d.LAMBDA.TIMEOUT.MAX).optional(),memory:Ti.optional(),enableFunctionUrl:s.boolean().optional(),description:s.string().optional(),enableCors:s.boolean().optional(),corsOrigins:s.string().optional(),corsHeaders:s.string().optional(),corsMethods:s.array(s.enum(MI)).optional(),corsCredentials:s.boolean().optional(),connectionConfig:ca.optional()}).strict(),J5=s.object({appName:ve,instanceName:V,nameProvidedByFlag:s.boolean().optional(),instanceType:Nv.optional(),enableSSH:s.boolean().optional(),minCapacity:b$.optional(),maxCapacity:y$.optional(),connectionConfig:ca.optional()}).strict().refine(nn.check,nn.params),Q5=s.object({appName:ve,clusterName:V,serviceName:E$,capacityProvider:Cv,containerPort:on.optional(),cpu:Rv.optional(),memoryLimitMiB:na(512).optional(),desiredCount:Zu.optional(),ec2Config:Pv.optional(),routing:s.union([Vu,s.array(Vu).min(1)]).optional(),docker:Ot.partial().optional(),nameProvidedByFlag:s.boolean().optional(),connectionConfig:ca.optional()}).strict(),wv=s.object({appName:ve,computeName:V,nameProvidedByFlag:s.boolean().optional(),connectionConfig:ca.optional()}).strict(),Jz=wv.extend({type:s.literal("ecs"),cluster:x$.optional(),services:s.array(A$).min(1,d.SERVICE.MIN_REQUIRED),docker:Ot.partial().optional()}).strict().refine(e=>{let t=e.services.filter(n=>n.containers?.some(i=>i.port));return t.length>1?t.every(n=>(Array.isArray(n.routing)?n.routing:n.routing?[n.routing]:[]).some(i=>i.path||i.host)):!0},{message:d.SERVICE.ROUTING_REQUIRED}).refine(e=>{let t=e.services.map(n=>n.name);return new Set(t).size===t.length},{message:d.SERVICE.UNIQUE_WITHIN_CLUSTER}),Qz=wv.extend({type:s.literal("lambda"),timeout:s.number().int(d.LAMBDA.TIMEOUT.INTEGER).min(Ru,d.LAMBDA.TIMEOUT.MIN).max(Pu,d.LAMBDA.TIMEOUT.MAX).optional(),memory:Ti.optional(),handler:s.string().optional(),runtime:S$.optional(),environment:Ai.optional(),secrets:Ai.optional(),description:s.string().optional(),functionUrl:s.union([s.object({authType:s.enum(ta).optional()}).strict(),s.literal(!1)]).optional(),eventSources:s.array(_$).optional()}).strict(),eL=wv.extend({type:s.literal("ec2"),instanceType:Nv.optional(),enableSSH:s.boolean().optional(),keyName:s.string().optional(),userData:s.string().optional(),securityGroups:s.array(s.string()).optional()}).strict(),eH=s.discriminatedUnion("type",[Jz,Qz,eL]),h$=s.object({path:s.string().min(1,d.REQUIRED.ROUTING_PATH),priority:s.number().int(d.PRIORITY.INTEGER).min(1,d.PRIORITY.MIN).max(5e4,d.PRIORITY.MAX).optional()}).strict(),$$=s.object({name:s.string().min(1,d.REQUIRED.SERVICE_NAME).max(255,d.MAX_LENGTH.SERVICE_NAME).regex(L.RESOURCE_NAME,d.RESOURCE_NAME),serviceType:s.enum(["web","worker"]).optional(),docker:Ot.partial().optional(),containerPort:on.optional(),needsDatabaseConnection:s.boolean().optional(),routing:s.union([h$,s.array(h$).min(1)]).optional()}).strict().superRefine((e,t)=>{e.serviceType==="worker"&&(e.containerPort!==void 0&&t.addIssue({code:"custom",path:["containerPort"],message:"Worker services are not reachable inbound; remove containerPort."}),e.routing!==void 0&&t.addIssue({code:"custom",path:["routing"],message:"Worker services have no ALB route; remove routing."}))}),tH=s.object({appName:ve,instanceType:s.string().optional()}).strict();var kv=s.object({memorySize:Ti.optional(),timeout:s.number().int(d.LAMBDA.TIMEOUT.INTEGER).min(1,d.LAMBDA.TIMEOUT.MIN).max(900,d.LAMBDA.TIMEOUT.MAX).optional(),ephemeralStorageSize:s.number().int(d.EPHEMERAL_STORAGE.INTEGER).min(512,d.EPHEMERAL_STORAGE.MIN).max(10240,d.EPHEMERAL_STORAGE.MAX).optional()}).strict(),T$=s.object({type:s.enum(vv).optional(),databaseName:s.string().optional(),databaseEngine:s.enum(_i).optional(),deletionProtection:s.boolean().optional(),backupRetention:Jt.optional(),port:wu.optional(),publiclyAccessible:s.boolean().optional(),allowedIpCidr:s.string().optional(),instanceType:s.string().optional(),allocatedStorage:s.number().int(d.ALLOCATED_STORAGE.INTEGER).min(20,d.ALLOCATED_STORAGE.MIN).max(65536,d.ALLOCATED_STORAGE.MAX).optional(),multiAz:s.boolean().optional(),readReplica:Du.optional(),writer:aa.optional(),readers:sa.optional(),allowVpcAccess:s.boolean().optional(),monitoringInterval:oa.optional(),preferredMaintenanceWindow:s.string().optional(),databaseInsights:Mu.optional(),proxy:Ou.optional(),credentials:ku.optional(),encryption:ju.optional(),snapshotIdentifier:s.string().optional(),snapshotUsername:s.string().optional()}).strict(),R$=s.object({server:kv.optional(),imageOptimisation:kv.optional(),revalidation:kv.optional()}).strict(),Ov=s.object({versioned:s.boolean().optional()}).strict(),P$=s.object({assets:Ov.optional(),cache:Ov.optional(),media:Ov.optional()}).strict(),tL=s.object({visibilityTimeout:s.number().int(d.SQS.VISIBILITY_TIMEOUT.INTEGER).min(0,d.SQS.VISIBILITY_TIMEOUT.MIN).max(43200,d.SQS.VISIBILITY_TIMEOUT.MAX).optional(),messageRetentionPeriod:s.number().int(d.SQS.RETENTION_PERIOD.INTEGER).min(60,d.SQS.RETENTION_PERIOD.MIN).max(1209600,d.SQS.RETENTION_PERIOD.MAX).optional(),maxMessageSize:s.number().int(d.MAX_MESSAGE_SIZE.INTEGER).min(1024,d.MAX_MESSAGE_SIZE.MIN).max(262144,d.MAX_MESSAGE_SIZE.MAX).optional(),deadLetterQueue:s.union([s.literal(!1),s.object({enabled:s.boolean().optional(),maxReceiveCount:s.number().int(d.DLQ.MAX_RECEIVE_COUNT.INTEGER).min(1,d.DLQ.MAX_RECEIVE_COUNT.MIN).max(1e3,d.DLQ.MAX_RECEIVE_COUNT.MAX).optional()}).strict()]).optional()}).strict(),C$=s.object({revalidationQueue:tL.optional()}).strict(),N$=s.object({domainNames:s.array(s.string()).optional(),certificateArn:s.string().optional()}).strict(),w$=s.record(s.string().regex(L.ENV_VAR_NAME,d.ENV_VAR_NAME),s.string()).optional(),rL=s.object({type:s.literal("payload"),name:s.string().min(1,d.REQUIRED.PATTERN_NAME),domain:s.string().optional(),database:T$.optional(),compute:R$.optional(),storage:P$.optional(),messaging:C$.optional(),cdn:N$.optional(),environment:w$}).strict(),nL=s.object({type:s.literal("nextjs"),name:s.string().min(1,d.REQUIRED.PATTERN_NAME),domain:s.string().optional(),database:T$.optional(),compute:R$.optional(),storage:P$.optional(),messaging:C$.optional(),cdn:N$.optional(),environment:w$}).strict(),Dv=s.enum(Uo),iL=s.object({command:s.string().min(1,d.REQUIRED.BUILD_COMMAND),outputDir:s.string().min(1,d.REQUIRED.OUTPUT_DIR)}).strict(),oL=s.object({headers:s.boolean().optional(),contentSecurityPolicy:s.string().optional()}).strict(),aL=s.object({to:s.string().min(1,d.REQUIRED.FORMS_TO).regex(L.EMAIL,d.EMAIL),from:s.string().regex(L.EMAIL,d.EMAIL).optional(),corsOrigin:s.string().regex(L.HTTP_ORIGIN,"corsOrigin must be an exact origin such as https://example.com (no path, no trailing slash)").optional(),maxConcurrency:s.number().int().min(1).max(100).optional()}).strict(),sL=s.object({behaviours:s.array(s.unknown()).optional()}).strict(),Mv=s.object({type:s.literal("staticsite"),name:s.string().min(1,d.REQUIRED.PATTERN_NAME),source:s.string().min(1,d.REQUIRED.SOURCE),build:iL,routing:Dv.optional(),security:oL.optional(),domain:s.string().optional(),forms:aL.optional(),cdn:sL.optional()}).strict().superRefine((e,t)=>{if(e.forms===void 0)return;let n=e.domain;if(n===void 0||n===""){t.addIssue({code:"custom",path:["domain"],message:"A domain is required when forms are enabled: SES sends only from a verified identity, and the site's domain is the identity the pattern verifies"});return}let i=e.forms.from;i!==void 0&&!Xc(i,n)&&t.addIssue({code:"custom",path:["forms","from"],message:`forms.from must be an address at ${n} (the verified SES identity) \u2014 for example noreply@${n}. Use forms.to for the recipient.`})}),ua=s.discriminatedUnion("type",[rL,nL,Mv]),k$=s.enum(["lightweight","standard","resilient","custom"]),O$=s.object({type:s.enum(vv),instanceType:s.string().optional(),backupRetention:Jt.optional(),deletionProtection:s.boolean().optional(),encryption:s.union([s.object({useCMK:s.literal(!0)}).strict(),s.literal(!1)]).optional()}).strict(),D$=s.object({memorySize:Ti.optional(),timeout:s.number().int(d.LAMBDA.TIMEOUT.INTEGER).min(1,d.LAMBDA.TIMEOUT.MIN).max(900,d.LAMBDA.TIMEOUT.MAX).optional()}).strict();var M$=s.object({appName:ve,type:Sv,pattern:_v.optional(),patternConfig:ua.optional(),owner:s.string().optional(),tags:s.record(s.string(),s.string()).optional(),vpcId:s.string().optional(),network:Lu.optional(),backup:VI.optional(),tunnel:ZI.optional(),additionalNetworks:s.array(s$).optional(),database:s.array(KI),s3:s.array(u$),compute:s.array(I$),dynamodb:s.array(t$).optional(),clickhouse:s.array(r$).optional(),sqs:s.array(l$).optional(),cdn:m$.optional(),customCodeBlocks:s.array(BI).optional(),additionalManagedImports:s.array(s.object({moduleSpecifier:s.string(),namedImports:s.array(s.string()),defaultImport:s.string().optional()}).strict()).optional()}).strict(),_H=s.object({name:ve,type:Sv,pattern:_v.optional(),patternTier:k$.optional(),patternDomain:s.string().optional(),source:s.string().min(1,d.REQUIRED.SOURCE).optional(),buildCommand:s.string().min(1,d.REQUIRED.BUILD_COMMAND).optional(),outputDir:s.string().min(1,d.REQUIRED.OUTPUT_DIR).optional(),routing:Dv.optional(),formsTo:s.string().min(1,d.REQUIRED.FORMS_TO).regex(L.EMAIL,d.EMAIL).optional(),corsOrigin:s.string().regex(L.HTTP_ORIGIN,"corsOrigin must be an exact origin such as https://example.com (no path, no trailing slash)").optional(),customDatabase:O$.optional(),customCompute:D$.optional(),region:s.string().optional(),owner:s.string().optional(),includeDatabase:s.boolean().optional(),databaseName:s.string().min(1,d.DATABASE.NAME.REQUIRED).max(63,d.DATABASE.NAME.MAX_LENGTH).optional(),vpcId:s.string().optional(),network:c$.optional(),services:s.array($$).optional(),snapshotIdentifier:s.string().optional(),snapshotUsername:s.string().optional()}).strict().superRefine((e,t)=>{e.formsTo!==void 0&&(e.patternDomain!==void 0&&e.patternDomain!==""||t.addIssue({code:"custom",path:["patternDomain"],message:"A domain is required when forms are enabled: SES sends only from a verified identity, and the site's domain is the identity the pattern verifies"}))}),EH=s.object({name:V,localResource:s.string().min(1),remoteApp:s.string().min(1),remoteResource:s.string().min(1),permission:s.enum(["read","write","read-write"]),remoteArn:s.string().optional()}).strict();var cL=["fjall-managed","external","external-manual"],TH=s.enum(cL);var j$=s.object({givenName:s.string().min(1),familyName:s.string().min(1),displayName:s.string().min(1).optional(),expires:s.string().min(1).optional()}).strict(),z$=s.object({name:s.string().min(1),path:s.string().min(1).optional()}).strict(),uL=s.union([s.object({managedPolicyArn:s.string().min(1)}).strict(),s.object({customerManagedPolicy:z$}).strict()]),lL=s.object({managedPolicies:s.array(s.string().min(1)).optional(),inlinePolicy:s.record(s.string(),s.unknown()).optional(),customerManagedPolicies:s.array(z$).optional(),permissionsBoundary:uL.optional(),sessionDuration:s.string().min(1).optional(),description:s.string().optional(),accounts:s.union([s.array(s.string().min(1)),s.literal("all")]).optional(),includeManagementAccount:s.boolean().optional(),groups:s.array(s.string().min(1)).optional()}).strict(),dL=s.object({description:s.string().optional()}).strict(),Gu=s.string().regex(L.EMAIL,d.EMAIL),jv={groups:s.record(s.string(),dL).optional(),permissionSets:s.record(s.string(),lL).optional(),memberships:s.record(s.string(),s.array(Gu)).optional(),resolutionVersion:s.number().int().min(1).optional(),defaultPermissionSets:s.boolean().optional()},mL=s.discriminatedUnion("source",[s.object({...jv,source:s.literal("fjall-managed"),users:s.record(Gu,j$)}).strict(),s.object({...jv,source:s.literal("external")}).strict(),s.object({...jv,source:s.literal("external-manual"),users:s.record(Gu,j$).optional()}).strict()]),RH=s.object({name:V,type:s.literal("organisation").optional(),organisationName:s.string().min(1).optional(),orgEmail:Gu.optional(),accounts:s.unknown().optional(),accountIds:s.record(s.string(),s.string()).optional(),identityCentre:s.union([mL,s.literal(!1)]).optional(),allowedRegions:s.array(s.string().min(1)).optional()}).strict();var pL=Object.defineProperty,fL=(e,t)=>pL(e,"name",{value:t,configurable:!0}),gL=[1,3,5,7,14,30,60,90,120,150,180,365,400,545,731,1827,3653],hL=s.object({buildkiteQueue:s.string().min(1,"buildkiteQueue cannot be empty").max(100).regex(/^[a-zA-Z0-9-_]+$/,"buildkiteQueue must be alphanumeric with hyphens/underscores"),buildkiteOrgSlug:s.string().min(1,"buildkiteOrgSlug cannot be empty").max(100).regex(/^[a-z0-9-]+$/,"buildkiteOrgSlug must be a lowercase Buildkite organisation slug"),agentTokenSsmParameterName:s.string().min(2).regex(/^\//,"agentTokenSsmParameterName must be a full path (leading /)").optional(),agentTokenKmsKeyArn:s.string().min(1).optional(),fjallApiKeySsmParameterName:s.string().min(2).regex(/^\//,"fjallApiKeySsmParameterName must be a full path (leading /)").optional(),instanceType:s.string().min(1).default("c8g.xlarge"),agentVolumeSizeGib:s.number().int().min(20).max(1e3).default(250),agentMinInstances:s.number().int().min(0).default(0),agentMaxInstances:s.number().int().min(1).default(2),agentsPerInstance:s.number().int().min(1).default(1),spotCapacityPercentage:s.number().int().min(0).max(100).default(0),scaleInIdlePeriodSeconds:s.number().int().min(60).default(600),disconnectAfterUptimeSeconds:s.number().int().min(3600).default(86400),maxInstanceLifetimeDays:s.number().int().min(1).max(365).default(7),terminateInstanceAfterJob:s.boolean().default(!1),purgeBuildsOnDiskFull:s.boolean().default(!0),terminateInstanceOnDiskFull:s.boolean().default(!1),logRetentionDays:s.number().int().min(1).default(30),agentLogRetentionDays:s.literal(gL).default(7),buildkiteAgentRelease:s.enum(["stable","beta","edge"]).default("stable"),buildkiteAgentTags:s.string().default(""),buildkiteAgentTimestampLines:s.boolean().default(!1),buildkiteAgentExperiments:s.string().default(""),buildkiteAgentTracingBackend:s.enum(["","datadog","opentelemetry"]).default(""),buildkiteAgentCancelGracePeriodSeconds:s.number().int().min(10).default(60),enableSecretsPlugin:s.boolean().default(!0),enableEcrPlugin:s.boolean().default(!1),enableDockerLoginPlugin:s.boolean().default(!1),enableDockerUserNamespaceRemap:s.boolean().default(!0),enableDockerExperimental:s.boolean().default(!1),dockerNetworkingProtocol:s.enum(["ipv4","dualstack"]).default("ipv4"),enableInstanceStorage:s.boolean().default(!1),mountTmpfsAtTmp:s.boolean().default(!0),buildkiteAgentEnableGitMirrors:s.boolean().default(!1),bootstrapScriptUrl:s.string().default(""),agentEnvFileUrl:s.string().default(""),scalerEventSchedulePeriod:s.string().min(1).default("1 minute"),scalerMinPollInterval:s.string().min(1).default("10s"),scaleOutFactor:s.string().min(1).default("1.0"),scaleOutWaitingForJobs:s.boolean().default(!1),rolePermissionsBoundaryArn:s.string().min(1).optional(),alarmSnsTopicArn:s.string().min(1).optional(),applicationId:s.string().min(1).optional(),costAllocationEnvironment:s.string().min(1).optional(),costAllocationOwner:s.string().min(1).optional()}).strict(),vL=hL.refine(e=>e.agentMinInstances<=e.agentMaxInstances,{message:"agentMinInstances must be <= agentMaxInstances"});function bL(e){let t=vL.safeParse(e);if(!t.success){let n=t.error.issues.map(i=>`  - ${i.path.join(".")||"(root)"}: ${i.message}`).join(`
 `);throw new Error(`Buildkite: invalid props:
 ${n}`)}return t.data}fL(bL,"validateBuildkiteProps");var yL=Object.defineProperty,SL=(e,t)=>yL(e,"name",{value:t,configurable:!0});function _L(e){return`FjallDeployBoundary${e}`}SL(_L,"deployBoundaryName");var zv={Sid:"FjallInheritAdministratorAccess",Effect:"Allow",Action:"*",Resource:"*"},L$=[{Sid:"FjallDenyOrgAndAccountEscape",Effect:"Deny",Action:["organizations:LeaveOrganization","account:CloseAccount"],Resource:"*"},{Sid:"FjallDenyDisableAuditLogging",Effect:"Deny",Action:["cloudtrail:StopLogging"],Resource:"*"},{Sid:"FjallDenyBoundarySelfEscape",Effect:"Deny",Action:["iam:DeleteRolePermissionsBoundary"],Resource:"*"},{Sid:"FjallDenyDisableKmsKey",Effect:"Deny",Action:["kms:DisableKey"],Resource:"*"}],U$=[...L$,{Sid:"FjallDenyStandingHumanCredentials",Effect:"Deny",Action:["iam:CreateUser","iam:CreateLoginProfile","iam:CreateAccessKey","iam:CreateAccountAlias"],Resource:"*"},{Sid:"FjallDenyDisableConfigRecorder",Effect:"Deny",Action:["config:StopConfigurationRecorder"],Resource:"*"}],EL=[...U$,{Sid:"FjallDenyAccountPasswordPolicyTamper",Effect:"Deny",Action:["iam:UpdateAccountPasswordPolicy","iam:DeleteAccountPasswordPolicy"],Resource:"*"},{Sid:"FjallDenyDisableDefaultEbsEncryption",Effect:"Deny",Action:["ec2:DisableEbsEncryptionByDefault"],Resource:"*"}],ZH={foundation:[zv,...L$],compliance:[zv,...U$],hardened:[zv,...EL]};var xL=Object.defineProperty,je=(e,t)=>xL(e,"name",{value:t,configurable:!0});var Lv="sts.amazonaws.com";function AL(e){return`FjallDevDeploy${e}`}je(AL,"devDeployRoleName");function IL(e){return`FjallDevProvisioner${e}`}je(IL,"devProvisionerRoleName");function $L(e){return`FjallDevSyncWriter${e}`}je($L,"devSyncWriterRoleName");var TL="FjallDevBoundary";function F$(e){return`arn:aws:iam::${e}:policy/${TL}`}je(F$,"devBoundaryPolicyArn");function B$(e){return`org:${e}:dev-provisioner`}je(B$,"devProvisionerSubject");function V$(e){return`org:${e}:dev-sync`}je(V$,"devSyncSubject");function RL(e){let{fjallOrgId:t,providerArn:n,issuerDomain:i}=e,r={[`${i}:aud`]:Lv};return[{Sid:"FjallMachineSubject",Effect:"Allow",Principal:{Federated:n},Action:"sts:AssumeRoleWithWebIdentity",Condition:{StringEquals:{...r,[`${i}:sub`]:`org:${t}:*`}}},{Sid:"FjallUserSubjects",Effect:"Allow",Principal:{Federated:n},Action:"sts:AssumeRoleWithWebIdentity",Condition:{StringEquals:r,StringLike:{[`${i}:sub`]:`org:${t}:user:*`}}},{Sid:"FjallServiceSubjects",Effect:"Allow",Principal:{Federated:n},Action:"sts:AssumeRoleWithWebIdentity",Condition:{StringEquals:{...r,[`${i}:sub`]:[`org:${t}:discovery`,`org:${t}:connection`,`org:${t}:org-setup`,`org:${t}:dev-substrate-setup`]}}}]}je(RL,"buildNarrowedDeployTrustStatements");function PL(e){let{fjallOrgId:t,providerArn:n,issuerDomain:i,accountId:r}=e;return[{Sid:"FjallDevSubjectsThisAccount",Effect:"Allow",Principal:{Federated:n},Action:"sts:AssumeRoleWithWebIdentity",Condition:{StringEquals:{[`${i}:aud`]:Lv},StringLike:{[`${i}:sub`]:`org:${t}:dev:${r}:*`}}}]}je(PL,"buildDevDeployTrustStatements");function Uv(e){let{providerArn:t,issuerDomain:n,sid:i,subject:r}=e;return[{Sid:i,Effect:"Allow",Principal:{Federated:t},Action:"sts:AssumeRoleWithWebIdentity",Condition:{StringEquals:{[`${n}:aud`]:Lv,[`${n}:sub`]:r}}}]}je(Uv,"buildServiceSubjectTrustStatements");function CL(e){return Uv({...e,sid:"FjallDevProvisionerSubject",subject:B$(e.fjallOrgId)})}je(CL,"buildDevProvisionerTrustStatements");function NL(e){return Uv({...e,sid:"FjallDevSyncSubject",subject:V$(e.fjallOrgId)})}je(NL,"buildDevSyncWriterTrustStatements");function wL({accountId:e}){return[{Sid:"FjallDevEcsTaggedMutations",Effect:"Allow",Action:["ecs:UpdateService","ecs:DeleteService","ecs:RunTask","ecs:StopTask"],Resource:`arn:aws:ecs:*:${e}:*`,Condition:{StringEquals:{"aws:ResourceTag/fjall:dev":"true"}}},{Sid:"FjallDevEcsTaggedCreates",Effect:"Allow",Action:["ecs:RegisterTaskDefinition","ecs:CreateService"],Resource:"*",Condition:{StringEquals:{"aws:RequestTag/fjall:dev":"true"}}},{Sid:"FjallDevEcsTagOnCreate",Effect:"Allow",Action:["ecs:TagResource"],Resource:`arn:aws:ecs:*:${e}:*`,Condition:{StringEquals:{"ecs:CreateAction":["RegisterTaskDefinition","CreateService","RunTask"]}}},{Sid:"FjallDevEcsReads",Effect:"Allow",Action:["ecs:Describe*","ecs:List*"],Resource:"*"},{Sid:"FjallDevEcsDeregisterTaskDefinition",Effect:"Allow",Action:["ecs:DeregisterTaskDefinition"],Resource:`arn:aws:ecs:*:${e}:task-definition/fjall-dev-*`},{Sid:"FjallDevElbTaggedMutations",Effect:"Allow",Action:["elasticloadbalancing:ModifyRule","elasticloadbalancing:DeleteRule","elasticloadbalancing:ModifyTargetGroup","elasticloadbalancing:ModifyTargetGroupAttributes","elasticloadbalancing:DeleteTargetGroup","elasticloadbalancing:RegisterTargets","elasticloadbalancing:DeregisterTargets"],Resource:`arn:aws:elasticloadbalancing:*:${e}:*`,Condition:{StringEquals:{"aws:ResourceTag/fjall:dev":"true"}}},{Sid:"FjallDevElbTaggedCreates",Effect:"Allow",Action:["elasticloadbalancing:CreateTargetGroup","elasticloadbalancing:CreateRule"],Resource:`arn:aws:elasticloadbalancing:*:${e}:*`,Condition:{StringEquals:{"aws:RequestTag/fjall:dev":"true"}}},{Sid:"FjallDevElbTagOnCreate",Effect:"Allow",Action:["elasticloadbalancing:AddTags"],Resource:`arn:aws:elasticloadbalancing:*:${e}:*`,Condition:{StringEquals:{"elasticloadbalancing:CreateAction":["CreateTargetGroup","CreateRule"]}}},{Sid:"FjallDevElbReads",Effect:"Allow",Action:["elasticloadbalancing:Describe*"],Resource:"*"},{Sid:"FjallDevSsmDevTree",Effect:"Allow",Action:["ssm:GetParameter*","ssm:PutParameter","ssm:AddTagsToResource"],Resource:`arn:aws:ssm:*:${e}:parameter/fjall/dev/*`},{Sid:"FjallDevLogsMutations",Effect:"Allow",Action:["logs:PutRetentionPolicy","logs:DeleteLogGroup"],Resource:`arn:aws:logs:*:${e}:log-group:/fjall/dev/*`},{Sid:"FjallDevLogsTaggedCreate",Effect:"Allow",Action:["logs:CreateLogGroup","logs:TagResource"],Resource:`arn:aws:logs:*:${e}:log-group:/fjall/dev/*`,Condition:{StringEquals:{"aws:RequestTag/fjall:dev":"true"}}},{Sid:"FjallDevLogsRead",Effect:"Allow",Action:["logs:GetLogEvents","logs:DescribeLogStreams","logs:FilterLogEvents"],Resource:`arn:aws:logs:*:${e}:log-group:/fjall/dev/*`},{Sid:"FjallDevLogsDescribeGroups",Effect:"Allow",Action:["logs:DescribeLogGroups"],Resource:"*"},{Sid:"FjallDevKmsViaDevAlias",Effect:"Allow",Action:["kms:Encrypt","kms:Decrypt","kms:GenerateDataKey"],Resource:`arn:aws:kms:*:${e}:key/*`,Condition:{"ForAnyValue:StringLike":{"kms:ResourceAliases":"alias/fjall-dev-*"}}},{Sid:"FjallDevKmsSsmSecureString",Effect:"Allow",Action:["kms:Encrypt","kms:Decrypt","kms:GenerateDataKey"],Resource:`arn:aws:kms:*:${e}:key/*`,Condition:{StringLike:{"kms:ViaService":"ssm.*.amazonaws.com"}}},{Sid:"FjallDevEcrAuthToken",Effect:"Allow",Action:["ecr:GetAuthorizationToken"],Resource:"*"},{Sid:"FjallDevEcrPushPull",Effect:"Allow",Action:["ecr:PutImage","ecr:InitiateLayerUpload","ecr:UploadLayerPart","ecr:CompleteLayerUpload","ecr:BatchCheckLayerAvailability","ecr:BatchGetImage","ecr:GetDownloadUrlForLayer","ecr:DescribeImages"],Resource:`arn:aws:ecr:*:${e}:repository/*`},{Sid:"FjallDevPassDevPathRoles",Effect:"Allow",Action:["iam:PassRole"],Resource:`arn:aws:iam::${e}:role/fjall/dev/*`}]}je(wL,"buildDevDeployPolicyStatements");function kL({accountId:e}){return[{Sid:"FjallDevProvisionerBoundedRoleWrites",Effect:"Allow",Action:["iam:CreateRole","iam:PutRolePolicy","iam:AttachRolePolicy"],Resource:`arn:aws:iam::${e}:role/fjall/dev/*`,Condition:{StringEquals:{"iam:PermissionsBoundary":F$(e)}}},{Sid:"FjallDevProvisionerPathRoleOps",Effect:"Allow",Action:["iam:DeleteRole","iam:DeleteRolePolicy","iam:DetachRolePolicy","iam:ListRolePolicies","iam:TagRole"],Resource:`arn:aws:iam::${e}:role/fjall/dev/*`},{Sid:"FjallDevProvisionerListRoles",Effect:"Allow",Action:["iam:ListRoles"],Resource:"*"},{Sid:"FjallDevProvisionerDevMasterSecrets",Effect:"Allow",Action:["secretsmanager:GetSecretValue"],Resource:`arn:aws:secretsmanager:*:${e}:secret:fjall-dev-*`},{Sid:"FjallDevProvisionerKmsDecryptViaSecretsManager",Effect:"Allow",Action:["kms:Decrypt"],Resource:`arn:aws:kms:*:${e}:key/*`,Condition:{StringLike:{"kms:ViaService":"secretsmanager.*.amazonaws.com"}}},{Sid:"FjallDevProvisionerDataApi",Effect:"Allow",Action:["rds-data:ExecuteStatement","rds-data:BatchExecuteStatement","rds-data:BeginTransaction","rds-data:CommitTransaction","rds-data:RollbackTransaction"],Resource:`arn:aws:rds:*:${e}:cluster:fjall-dev-*`},{Sid:"FjallDevProvisionerMetrics",Effect:"Allow",Action:["cloudwatch:GetMetricData"],Resource:"*"},{Sid:"FjallDevProvisionerOrphanDiscovery",Effect:"Allow",Action:["tag:GetResources"],Resource:"*"},{Sid:"FjallDevProvisionerSsmTeardown",Effect:"Allow",Action:["ssm:DeleteParameter*"],Resource:`arn:aws:ssm:*:${e}:parameter/fjall/dev/*`},{Sid:"FjallDevProvisionerLogsTeardown",Effect:"Allow",Action:["logs:DeleteLogGroup"],Resource:`arn:aws:logs:*:${e}:log-group:/fjall/dev/*`},{Sid:"FjallDevProvisionerTaggedTeardown",Effect:"Allow",Action:["ecs:UpdateService","ecs:StopTask","ecs:DeleteService","elasticloadbalancing:DeleteRule","elasticloadbalancing:DeleteTargetGroup","elasticloadbalancing:DeregisterTargets"],Resource:[`arn:aws:ecs:*:${e}:*`,`arn:aws:elasticloadbalancing:*:${e}:*`],Condition:{StringEquals:{"aws:ResourceTag/fjall:dev":"true"}}},{Sid:"FjallDevProvisionerTeardownReads",Effect:"Allow",Action:["ecs:Describe*","elasticloadbalancing:Describe*"],Resource:"*"},{Sid:"FjallDevProvisionerImageJanitor",Effect:"Allow",Action:["ecr:ListImages","ecr:DescribeImages","ecr:BatchDeleteImage"],Resource:`arn:aws:ecr:*:${e}:repository/*`},{Sid:"FjallDevProvisionerSsmReadAll",Effect:"Allow",Action:["ssm:GetParameter*"],Resource:`arn:aws:ssm:*:${e}:parameter/*`},{Sid:"FjallDevProvisionerKmsDecryptViaSsm",Effect:"Allow",Action:["kms:Decrypt"],Resource:`arn:aws:kms:*:${e}:key/*`,Condition:{StringLike:{"kms:ViaService":"ssm.*.amazonaws.com"}}}]}je(kL,"buildDevProvisionerPolicyStatements");function OL({accountId:e}){return[{Sid:"FjallDevSyncPrefixReadWrite",Effect:"Allow",Action:["s3:GetObject","s3:PutObject"],Resource:`arn:aws:s3:::fjall-dev-sync-${e}-*/*`,Condition:{StringEquals:{"aws:ResourceAccount":e}}}]}je(OL,"buildDevSyncWriterPolicyStatements");function DL({accountId:e}){return[{Sid:"FjallDevBoundarySsmDevRead",Effect:"Allow",Action:["ssm:GetParameter*"],Resource:`arn:aws:ssm:*:${e}:parameter/fjall/dev/*`},{Sid:"FjallDevBoundaryKmsDecryptDevAlias",Effect:"Allow",Action:["kms:Decrypt"],Resource:`arn:aws:kms:*:${e}:key/*`,Condition:{"ForAnyValue:StringLike":{"kms:ResourceAliases":"alias/fjall-dev-*"}}},{Sid:"FjallDevBoundarySyncPrefixReadWrite",Effect:"Allow",Action:["s3:GetObject","s3:PutObject"],Resource:`arn:aws:s3:::fjall-dev-sync-${e}-*/*`,Condition:{StringEquals:{"aws:ResourceAccount":e}}},{Sid:"FjallDevBoundarySlotLogs",Effect:"Allow",Action:["logs:CreateLogStream","logs:PutLogEvents"],Resource:`arn:aws:logs:*:${e}:log-group:/fjall/dev/*`},{Sid:"FjallDevBoundarySyncQueue",Effect:"Allow",Action:["sqs:ReceiveMessage","sqs:DeleteMessage","sqs:GetQueueUrl"],Resource:`arn:aws:sqs:*:${e}:fjall-dev-sync-${e}-*`}]}je(DL,"buildDevBoundaryStatements");var ML=Object.defineProperty,_t=(e,t)=>ML(e,"name",{value:t,configurable:!0});function T(e){return JSON.stringify(e)}_t(T,"escapeStringLiteral");function an(e){return e.map(T).join(", ")}_t(an,"formatStringArray");var jL="import:SharedAlarmTopicArn";function sn(e="    "){return`

package/bin/assets/generators/compute/generator.js

@@ -184,7 +184,7 @@ ${Ee.hex("#D9622E").bold(`--- ${e} ---`)}`),F&&F.start())}Ge(Pj,"step");function
 `);return{buffer:[],stream:r}}flush(){let t=this.flushBuffer(this.buffer,this.mainLogStream,this.mainLogPath);this.buffer=t.buffer,this.mainLogStream=t.stream;let n=this.flushBuffer(this.debugBuffer,this.debugLogStream,this.debugLogPath);this.debugBuffer=n.buffer,this.debugLogStream=n.stream}close(){this.isClosing=!0,this.flush(),this.flushInterval&&(clearInterval(this.flushInterval),this.flushInterval=null),this.mainLogStream&&(this.mainLogStream.end(),this.mainLogStream=null),this.debugLogStream&&(this.debugLogStream.end(),this.debugLogStream=null),this.buffer=[],this.debugBuffer=[],this.initialised=!1,this.isClosing=!1}async closeAndFlush(){this.isClosing=!0,this.flush(),this.flushInterval&&(clearInterval(this.flushInterval),this.flushInterval=null);let t=[];this.mainLogStream&&(t.push(this.mainLogStream),this.mainLogStream=null),this.debugLogStream&&(t.push(this.debugLogStream),this.debugLogStream=null),this.buffer=[],this.debugBuffer=[],this.initialised=!1,await Promise.all(t.map(n=>new Promise(i=>{n.end(()=>i())}))),this.isClosing=!1}};import{createWriteStream as Kj,existsSync as Yj,mkdirSync as Xj}from"fs";import{join as $I}from"path";var an={trace:0,debug:1,info:2,warn:3,error:4},We={MAX_FILE_SIZE:10*1024*1024,MAX_FILES:5,MAX_BUFFER_SIZE:100,FLUSH_INTERVAL_MS:500,LOG_FILENAME:"fjall.jsonl",DEBUG_LOG_FILENAME:"fjall-debug.jsonl"};import{join as Gj}from"path";import{homedir as Wj}from"os";var Vj=Object.defineProperty,Zj=(e,t)=>Vj(e,"name",{value:t,configurable:!0});function $r(){let e=process.env.FJALL_LOG_DIR;return e!==void 0&&e!==""?e:Gj(Wj(),".fjall","logs")}Zj($r,"getDefaultLogDir");var Hj=Object.defineProperty,qj=(e,t)=>Hj(e,"name",{value:t,configurable:!0}),ta=class{static{qj(this,"DeploymentLoggerImpl")}mainLogger;appName;operationType;logStream=null;logPath;deploymentId;buffer=[];flushInterval=null;isClosing=!1;maxBufferSize=We.MAX_BUFFER_SIZE;constructor(t,n,i){this.mainLogger=t,this.appName=n,this.operationType=i,this.deploymentId=`${i}-${Date.now()}`;let r=$r(),o=$I(r,"deployments",n);Yj(o)||Xj(o,{recursive:!0});let a=new Date().toISOString().replace(/[:.]/g,"-"),c=`${i}-${a}.jsonl`;this.logPath=$I(o,c);try{this.logStream=Kj(this.logPath,{flags:"a"}),this.flushInterval=setInterval(()=>this.flush(),We.FLUSH_INTERVAL_MS),this.info("DeploymentLogger","Deployment logging initialised",{appName:n,operationType:i,deploymentId:this.deploymentId,logPath:this.logPath})}catch{}}log(t,n,i,r,o,a){if(this.isClosing)return;let c={timestamp:new Date().toISOString(),level:t,component:n,message:i,correlationId:this.deploymentId,...r&&Object.keys(r).length>0&&{data:r},...o&&{stackName:o},...a&&{phase:a}};this.buffer.push(c),this.mainLogger.logWithCorrelation(t,n,i,this.deploymentId,r,o,a),this.buffer.length>=this.maxBufferSize&&this.flush()}flush(){if(!(this.buffer.length===0||!this.logStream)){for(let t of this.buffer)this.logStream.write(JSON.stringify(t)+`
 `);this.buffer=[]}}info(t,n,i){this.log("info",t,n,i)}warn(t,n,i){this.log("warn",t,n,i)}error(t,n,i){this.log("error",t,n,i)}debug(t,n,i){this.log("debug",t,n,i)}stackEvent(t,n,i,r){this.log("info","StackDeployment",i,r,t,n)}dockerEvent(t,n){this.log("info","DockerOperation",t,{percentage:n})}ecsEvent(t,n,i){this.log("info","ECSDeployment",t,{percentage:n,taskCount:i})}close(){this.isClosing=!0,this.flush(),this.flushInterval&&(clearInterval(this.flushInterval),this.flushInterval=null),this.logStream&&(this.logStream.end(),this.logStream=null),this.buffer=[],this.isClosing=!1}getLogPath(){return this.logPath}getDeploymentId(){return this.deploymentId}};var Jj=Object.defineProperty,Qj=(e,t)=>Jj(e,"name",{value:t,configurable:!0}),_u=class e{static{Qj(this,"Logger")}static instance=null;config;debugEnabled;traceEnabled;minLevel;fileWriter;mainLogPath;debugLogPath;constructor(){let t=$r(),n=dv(t,"debug"),i=this.parseEnvInt("FJALL_LOG_MAX_SIZE",We.MAX_FILE_SIZE),r=this.parseEnvInt("FJALL_LOG_MAX_FILES",We.MAX_FILES);this.config={logDir:t,debugLogDir:n,maxFileSize:i,maxFiles:r,maxBufferSize:We.MAX_BUFFER_SIZE,flushIntervalMs:We.FLUSH_INTERVAL_MS},this.mainLogPath=dv(t,We.LOG_FILENAME),this.debugLogPath=dv(n,We.DEBUG_LOG_FILENAME),this.debugEnabled=process.env.FJALL_DEBUG==="true"||process.env.FJALL_TRACE==="true"||process.argv.includes("--verbose")||process.argv.includes("-v"),this.traceEnabled=process.env.FJALL_TRACE==="true";let o=process.env.FJALL_LOG_LEVEL?.toLowerCase();o&&o in an?this.minLevel=o:this.traceEnabled?this.minLevel="trace":this.debugEnabled?this.minLevel="debug":this.minLevel="info",this.fileWriter=new Su(this.config,this.mainLogPath,this.debugLogPath,this.debugEnabled)}parseEnvInt(t,n){let i=process.env[t];if(i){let r=parseInt(i,10);if(!isNaN(r)&&r>0)return r}return n}static getInstance(){return e.instance||(e.instance=new e),e.instance}shouldLog(t){return an[t]>=an[this.minLevel]}createEntry(t,n,i,r,o,a,c){return{timestamp:new Date().toISOString(),level:t,component:n,message:i,...o&&{correlationId:o},...r&&Object.keys(r).length>0&&{data:r},...a&&{stackName:a},...c&&{phase:c}}}log(t,n,i,r,o,a,c){if(!this.shouldLog(t))return;let u=this.createEntry(t,n,i,r,o,a,c),l=t==="debug"||t==="trace";this.fileWriter.write(u,l),this.writeConsole(u)}writeConsole(t){if(he.shouldSuppressOutput||he.isNonInteractive){this.debugEnabled&&this.writeDebugMirror(t);return}let n=this.getConsolePrefix(t.level),i=`[${t.component}]`,r=`${n} ${i} ${t.message}`;t.level==="error"?console.error(r):t.level==="warn"?console.warn(r):console.log(r)}writeDebugMirror(t){let n=this.getConsolePrefix(t.level),i=`[${t.component}]`,r="";if(t.data&&Object.keys(t.data).length>0)try{r=` ${JSON.stringify(t.data)}`}catch{r=" [unserialisable data]"}let o=`${n} ${i} ${t.message}${r}`;process.stderr.write(`${kn(o)}
 `)}getConsolePrefix(t){switch(t){case"error":return"[ERROR]";case"warn":return"[WARN]";case"info":return"[INFO]";case"debug":return"[DEBUG]";case"trace":return"[TRACE]"}}error(t,n,i){this.log("error",t,n,i)}warn(t,n,i){this.log("warn",t,n,i)}info(t,n,i){this.log("info",t,n,i)}debug(t,n,i){this.log("debug",t,n,i)}trace(t,n,i){this.log("trace",t,n,i)}isDebugEnabled(){return this.debugEnabled}isTraceEnabled(){return this.traceEnabled}enableDebug(){this.debugEnabled=!0,an[this.minLevel]>an.debug&&(this.minLevel="debug"),this.fileWriter.setDebugEnabled(!0),this.fileWriter.isInitialised&&this.fileWriter.initialiseDebugStream()}withCorrelation(t){return new bi(this,t)}forDeployment(t,n="deploy"){return new ta(this,t,n)}close(){this.fileWriter.close()}async flushAndClose(){await this.fileWriter.closeAndFlush()}getLogPath(){return this.mainLogPath}getDebugLogPath(){return this.debugLogPath}getLogDir(){return this.config.logDir}logWithCorrelation(t,n,i,r,o,a,c){this.log(t,n,i,o,r,a,c)}static reset(){e.instance&&(e.instance.close(),e.instance=null)}};var ez=Object.defineProperty,tz=(e,t)=>ez(e,"name",{value:t,configurable:!0}),yu=_u.getInstance();function oz(e){let t=$r(),n=RI(t,"debug"),i=RI(n,We.DEBUG_LOG_FILENAME);try{TI(n)||rz(n,{recursive:!0}),TI(i)&&nz(i).size>We.MAX_FILE_SIZE&&new yi({maxFiles:We.MAX_FILES}).rotate(i);let r={timestamp:new Date().toISOString(),level:"debug",component:"Emergency",message:e};iz(i,JSON.stringify(r)+`
-`)}catch{}}tz(oz,"writeDebugSync");var az=Object.defineProperty,Si=(e,t)=>az(e,"name",{value:t,configurable:!0});function mv(e){return e.success===!0}Si(mv,"isSuccess");function pv(e){return e.success===!1}Si(pv,"isFailure");function C(e){return{success:!0,data:e}}Si(C,"success");function $(e){return{success:!1,error:e}}Si($,"failure");async function fv(e){try{let t=await e();return C(t)}catch(t){return $(vt(t))}}Si(fv,"tryAsync");function gv(e){try{let t=e();return C(t)}catch(t){return $(vt(t))}}Si(gv,"trySync");var sz=Object.defineProperty,cz=(e,t)=>sz(e,"name",{value:t,configurable:!0}),PI=/^[a-zA-Z][a-zA-Z0-9-]*$/,uz=Bo.source.replace(/^\^|\$$/g,""),L=Object.freeze({IDENTIFIER:PI,NEW_APP_NAME:/^[a-z][a-z0-9-]*$/,RESOURCE_NAME:/^[a-zA-Z][a-zA-Z0-9]*$/,ECS_SERVICE_NAME:PI,BUCKET_NAME:/^[a-z][a-z0-9-]*[a-z0-9]$|^[a-z][a-z0-9]*$/,DATABASE_NAME:/^[a-zA-Z][a-zA-Z0-9_]*$/,RESOURCE_TYPE:/^[a-z]+(:[a-z]+)?$/,SSM_PATH:new RegExp(`^(?:/${uz})+$`),SECRET_NAME:Jc,SSM_COMPONENT:Bo,EMAIL:/^[^\s@]+@[^\s@]+\.[^\s@]+$/,DOCKER_IMAGE:/^[a-z0-9][a-z0-9._-]*[a-z0-9](:[a-z0-9._-]+)?$/,DOMAIN:/^[a-z0-9]([a-z0-9-]*[a-z0-9])?(\.[a-z0-9]([a-z0-9-]*[a-z0-9])?)+$/i,HTTP_ORIGIN:/^https?:\/\/[a-z0-9.-]+(:\d+)?$/i,PASCAL_CASE:/^[A-Z][A-Za-z0-9]*$/,AWS_ACCOUNT_ID:/^\d{12}$/,VPC_ID:/^vpc-[a-z0-9]+$/,ROLE_ARN:/^arn:aws[a-zA-Z-]*:iam::\d{12}:role\/.+$/,CIDR:/^((25[0-5]|2[0-4]\d|1\d\d|[1-9]?\d)\.){3}(25[0-5]|2[0-4]\d|1\d\d|[1-9]?\d)\/(3[0-2]|[12]?\d)$/,SCHEDULE_EXPRESSION:/^(rate\(1 (?:minute|hour|day)\)|rate\((?:[2-9]|[1-9]\d+) (?:minutes|hours|days)\)|cron\([^\s()]+ [^\s()]+ [^\s()]+ [^\s()]+ [^\s()]+ [^\s()]+\))$/,LAMBDA_RUNTIME_IDENTIFIER:/^[A-Za-z0-9._-]+$/,ENV_VAR_NAME:/^[A-Za-z_][A-Za-z0-9_]*$/});function hv(e){let t=/^rate\((\d+) (minute|minutes|hour|hours|day|days)\)$/.exec(e);if(!t)return;let n=t[1],i=t[2];if(n===void 0||i===void 0)return;let r=parseInt(n,10);if(!Number.isFinite(r)||r<1)return;let o=i==="minute"||i==="hour"||i==="day";if(!(o&&r!==1)&&!(!o&&r===1))return i==="minute"||i==="minutes"?{everyMs:r*6e4}:i==="hour"||i==="hours"?{everyMs:r*60*6e4}:{everyMs:r*24*60*6e4}}cz(hv,"parseRateExpression");var d=Object.freeze({IDENTIFIER:"Must start with a letter, contain only letters, numbers, and hyphens",NEW_APP_NAME:"Must start with a lowercase letter and contain only lowercase letters, numbers, and hyphens",IDENTIFIER_MIN_LENGTH:"Must be at least 2 characters",IDENTIFIER_NO_TRAILING_HYPHEN:"Must not end with a hyphen",IDENTIFIER_NO_CONSECUTIVE_HYPHENS:"Must not contain consecutive hyphens",RESOURCE_NAME:"Must start with a letter and contain only letters and numbers (PascalCase recommended)",ECS_SERVICE_NAME:"Service name must start with a letter and contain only letters, numbers, and hyphens",BUCKET_NAME:"Bucket name must start with a lowercase letter and contain only lowercase letters, numbers, and hyphens",DATABASE_NAME:"Database name must start with a letter and contain only letters, numbers, and underscores",RESOURCE_TYPE:"Resource type must be in format 'category' or 'category:type'",SSM_PATH:"SSM path must start with / and contain valid namespace segments (e.g., /myapp/ApiCluster/service)",SECRET_NAME:hh,SSM_COMPONENT:Qc,EMAIL:"Please enter a valid email address",DOMAIN:"Please enter a valid domain (e.g., cms.example.com)",DOCKER_IMAGE:"Invalid Docker image name format",REQUIRED:{APP_NAME:"Application name is required",RESOURCE_NAME:"Resource name is required",BUCKET_NAME:"Bucket name is required",SERVICE_NAME:"Service name is required",NETWORK_NAME:"Network name is required",DATABASE_NAME:"Database name is required",ORGANISATION_NAME:"Organisation name is required",EMAIL:"Email is required",NAME:"Name is required",USERNAME:"Username is required",CONTAINER_NAME:"Container name is required",GROUP:"Group is required",PATTERN_NAME:"Pattern name is required",SOURCE:"Source directory is required",BUILD_COMMAND:"Build command is required",OUTPUT_DIR:"Output directory is required",FORMS_TO:"Forms recipient address is required",ROUTING_PATH:"Routing path is required",RESOURCE_REFERENCE:"Resource reference is required",RESOURCE_TYPE:"Resource type is required",VARIANT:"Variant is required",SUBTYPE:"Subtype is required",DEPLOY_TARGET:"Deploy target is required",DESTROY_TARGET:"Destroy target is required"},MAX_LENGTH:{APP_NAME:"Application name must be 50 characters or less",RESOURCE_NAME:"Resource name must be 63 characters or less",BUCKET_NAME:"Bucket name must be 63 characters or less",SERVICE_NAME:"Service name must be 255 characters or less",NETWORK_NAME:"Network name must be 50 characters or less",DATABASE_NAME:"Database name must be 63 characters or less",ORGANISATION_NAME:"Organisation name must be 50 characters or less"},PORT:{INTEGER:"Port must be an integer",MIN:"Port must be at least 1",MAX:"Port cannot exceed 65535"},USERNAME:{MAX_LENGTH:"Username cannot exceed 63 characters"},LAMBDA:{MEMORY:{INTEGER:"Lambda memory must be an integer",MIN:"Memory must be at least 128 MB",MAX:"Memory cannot exceed 10240 MB",MULTIPLE:"Memory must be 128 MB or a multiple of 64 MB"},TIMEOUT:{INTEGER:"Timeout must be an integer",MIN:"Timeout must be at least 1 second",MAX:"Timeout cannot exceed 900 seconds"},RUNTIME:"Lambda runtime must contain only letters, digits, dots, underscores, or dashes (e.g. 'NODEJS_20_X' or 'nodejs20.x')"},ENV_VAR_NAME:"Environment variable names must start with a letter or underscore and contain only letters, digits, and underscores",PRIORITY:{INTEGER:"Priority must be an integer",MIN:"Priority must be at least 1",MAX:"Priority cannot exceed 50000"},CAPACITY:{MIN:{INTEGER:"Minimum capacity must be an integer",MIN_0:"Minimum capacity must be at least 0",MIN_1:"Minimum capacity must be at least 1",MAX:"Minimum capacity cannot exceed 100"},MAX:{INTEGER:"Maximum capacity must be an integer",MIN_0:"Maximum capacity must be at least 0",MIN_1:"Maximum capacity must be at least 1",MAX:"Maximum capacity cannot exceed 100"},DESIRED:{INTEGER:"Desired count must be an integer",MIN:"Desired count must be at least 0",MAX:"Desired count cannot exceed 100"},WARM_POOL_REQUIRED:"minCapacity 0 requires a warmPool \u2014 without it, new tasks wait 60-90s for a cold instance launch",WARM_POOL:{MIN_SIZE:{INTEGER:"Warm pool minSize must be an integer",MIN:"Warm pool minSize must be at least 0",MAX:"Warm pool minSize cannot exceed 100"},MIN_SIZE_EXCEEDS_MAX_CAPACITY:"warmPool.minSize cannot exceed maxCapacity \u2014 the warm pool cannot hold more instances than the ASG allows"}},MEMORY_LIMIT:{INTEGER:"Memory limit must be an integer",MIN_512:"Memory limit must be at least 512 MiB",MIN_128:"Memory limit must be at least 128 MiB",MAX:"Memory limit cannot exceed 30720 MiB"},DATABASE:{PORT:{INTEGER:"Database port must be an integer",MIN:"Database port must be at least 1024",MAX:"Database port cannot exceed 65535"},NAME:{REQUIRED:"Database name is required",MAX_LENGTH:"Database name must be 63 characters or less"}},BACKUP_RETENTION:{INTEGER:"Backup retention must be an integer",MIN:"Backup retention must be at least 1 day",MAX:"Backup retention cannot exceed 35 days"},SQS:{VISIBILITY_TIMEOUT:{INTEGER:"Visibility timeout must be an integer",MIN:"Visibility timeout must be at least 0 seconds",MAX:"Visibility timeout cannot exceed 43200 seconds (12 hours)"},RETENTION_PERIOD:{INTEGER:"Retention period must be an integer",MIN:"Retention period must be at least 60 seconds",MAX:"Retention period cannot exceed 1209600 seconds (14 days)"}},READER:{COUNT:{INTEGER:"Reader count must be an integer",MIN:"Reader count must be at least 0",MAX:"Reader count cannot exceed 15"}},IDENTIFIER_SUFFIX:{REQUIRED:"Identifier suffix is required when specified",MAX_LENGTH:"Identifier suffix cannot exceed 50 characters"},ROTATION:{INTEGER:"Rotation days must be an integer",MIN:"Rotation interval must be at least 1 day",MAX:"Rotation interval cannot exceed 365 days"},MAX_CONNECTIONS:{INTEGER:"Max connections must be an integer",MIN:"Max connections must be at least 1",MAX:"Max connections cannot exceed 100"},MONITORING_INTERVAL:{INTEGER:"Monitoring interval must be an integer",MIN:"Monitoring interval must be at least 0",MAX:"Monitoring interval cannot exceed 60 seconds",VALUES:"Monitoring interval must be 0, 1, 5, 10, 15, 30, or 60 seconds"},RETENTION_DAYS:{INTEGER:"Retention days must be an integer",MIN:"Retention days must be at least 1",MAX:"Retention days cannot exceed 365"},BATCH_SIZE:{INTEGER:"Batch size must be an integer",MIN:"Batch size must be at least 1",MAX:"Batch size cannot exceed 10000"},SERVICE:{UNIQUE_WITHIN_CLUSTER:"Service names must be unique within a cluster",MIN_REQUIRED:"At least one service is required",ROUTING_REQUIRED:"Multiple services with ports require routing config (path or host)"},PROXY_CONFIG:{MAX_IDLE_CONNECTIONS:{INTEGER:"Max idle connections must be an integer",MIN:"Max idle connections must be at least 0",MAX:"Max idle connections cannot exceed 100"},BORROW_TIMEOUT:{INTEGER:"Connection borrow timeout must be an integer",MIN:"Connection borrow timeout must be at least 1 second",MAX:"Connection borrow timeout cannot exceed 3600 seconds"}},MAX_AZS:{INTEGER:"Max AZs must be an integer",MIN:"Max AZs must be at least 1",MAX:"Max AZs cannot exceed 3"},BATCHING_WINDOW:{INTEGER:"Max batching window must be an integer",MIN:"Max batching window must be at least 0",MAX:"Max batching window cannot exceed 300 seconds"},HEALTH_CHECK:{INTERVAL:{INTEGER:"Health check interval must be an integer",MIN:"Health check interval must be at least 5 seconds",MAX:"Health check interval cannot exceed 300 seconds"},TIMEOUT:{INTEGER:"Health check timeout must be an integer",MIN:"Health check timeout must be at least 2 seconds",MAX:"Health check timeout cannot exceed 60 seconds"},RETRIES:{INTEGER:"Health check retries must be an integer",MIN:"Health check retries must be at least 1",MAX:"Health check retries cannot exceed 10"},START_PERIOD:{INTEGER:"Health check start period must be an integer",MIN:"Health check start period must be at least 0 seconds",MAX:"Health check start period cannot exceed 300 seconds"}},EPHEMERAL_STORAGE:{INTEGER:"Ephemeral storage size must be an integer",MIN:"Ephemeral storage size must be at least 512 MB",MAX:"Ephemeral storage size cannot exceed 10240 MB"},MAX_MESSAGE_SIZE:{INTEGER:"Max message size must be an integer",MIN:"Max message size must be at least 1024 bytes",MAX:"Max message size cannot exceed 262144 bytes (256 KB)"},CAPACITY_CONSTRAINT:{MIN_LTE_MAX:"minCapacity must be less than or equal to maxCapacity"},DIRECT_ACCESS:{NO_DOMAIN:"directAccess cannot be used with domain (no ALB for HTTPS)",NO_LOAD_BALANCER:"directAccess cannot be used with loadBalancer (mutually exclusive)"},GLOBAL_AURORA:{PRIMARY_REGION_REQUIRED:"primaryRegion is required for GlobalAurora databases"},NAT_GATEWAY:{INTEGER:"NAT gateway count must be an integer",MIN:"NAT gateway count must be at least 0",MAX:"NAT gateway count cannot exceed 3"},CIDR_MASK:{INTEGER:"CIDR mask must be an integer",MIN:"CIDR mask must be at least 16",MAX:"CIDR mask cannot exceed 28"},CPU:{INTEGER:"CPU must be an integer",MIN:"CPU must be at least 256 units",MAX:"CPU cannot exceed 4096 units"},KMS:{KEY_REQUIRED:"KMS key ARN is required when using KMS encryption"},READER_INSTANCES:{MAX:"Cannot have more than 15 reader instances",COUNT_OR_INSTANCES:"Cannot specify both 'count' and 'instances' - use one or the other"},GENERATOR_CAPACITY:{MIN:{MIN:"Minimum capacity must be at least 1",MAX:"Minimum capacity cannot exceed 1000"},MAX:{MIN:"Maximum capacity must be at least 1",MAX:"Maximum capacity cannot exceed 1000"}},INSTANCE_TYPE:"Unknown instance type. Common types include: t4g.micro, t4g.small, m5.large",ARCHITECTURE_MISMATCH:"Architecture mismatch between instance type and AMI",ALLOCATED_STORAGE:{INTEGER:"Allocated storage must be an integer",MIN:"Allocated storage must be at least 20 GB",MAX:"Allocated storage cannot exceed 65536 GB"},DLQ:{MAX_RECEIVE_COUNT:{INTEGER:"Max receive count must be an integer",MIN:"Max receive count must be at least 1",MAX:"Max receive count cannot exceed 1000"}},ALARM:{PERCENTAGE:{MIN:"Threshold must be at least 1%",MAX:"Threshold must be at most 100%"},FREE_STORAGE_GIB:{MIN:"Free storage threshold must be at least 1 GiB"}},REGION:"Invalid AWS region",PASCAL_CASE:"Resource name must start with an uppercase letter and contain only alphanumerics (PascalCase).",IMAGE_DOCKER_MUTEX:"image and docker are mutually exclusive",AWS_ACCOUNT_ID:"AWS account id must be exactly 12 digits (no hyphens)",VPC_ID:"VPC id must look like vpc-abc12345",ROLE_ARN:"Role ARN must have the form arn:aws:iam::<account-id>:role/<name>",CIDR:"CIDR must be in dotted-quad/prefix-length form (e.g. 10.0.0.0/16)",VPC_PEER:{MIN_REQUESTER_ACCOUNTS:"At least one requester account id is required",REGION_REQUIRED:"Peer region is required when specified",ROUTE_TABLE_ID_REQUIRED:"Route table id must not be empty"},SCHEDULE_EXPRESSION:"Schedule expression must be 'rate(N minute|minutes|hour|hours|day|days)' with N>=1, or 'cron(<6-field AWS expression>)'"});var lz=Object.defineProperty,st=(e,t)=>lz(e,"name",{value:t,configurable:!0}),dz=["us-east-2","us-west-2","us-east-1","eu-west-1","eu-central-1","ap-southeast-1"],mz=Object.freeze(dz.flatMap(e=>{let t=Cn(e);return t?[t]:[]})),vv=Object.freeze(["us-east-2","us-west-2","us-east-1","eu-west-1","ap-southeast-1"]);function Eu(e){return e?e.split(",").map(t=>t.trim()).filter(Boolean):[]}st(Eu,"parseRegionList");function bv(e){return Kt.includes(e)}st(bv,"isValidRegion");function yv(e){return/^[a-z]{2}-[a-z]+-[1-9]$/.test(e)}st(yv,"isValidRegionFormat");function Sv(e){if(!e)return vv.slice(0,3);let t=e.toLowerCase().split("-"),n=t[0],i=t.length>1?t[1]:"",r=[];return n&&i&&(r=Kt.filter(o=>o.startsWith(`${n}-${i}`))),r.length===0&&n&&(r=Kt.filter(o=>o.startsWith(`${n}-`))),r.length>0?r.slice(0,3):vv.slice(0,3)}st(Sv,"getSuggestions");function _v(e){if(bv(e))return!0;let t=Sv(e);return yv(e)?`Unknown region. Try: ${t.join(", ")}`:`Invalid format. Try: ${t.join(", ")}`}st(_v,"validateRegion");function CI(e){if(!e||e.trim()==="")return!0;let t=Eu(e);for(let n of t){let i=_v(n);if(i!==!0)return i}return!0}st(CI,"validateRegionList");function Ev(e,t){return e.filter(n=>n!==t)}st(Ev,"filterDuplicateRegions");function xv(e){return{label:e.city,value:e.code,description:e.optIn?`${e.code} \u2014 opt-in required`:e.code}}st(xv,"toRegionOption");function NI(){return it.map(xv)}st(NI,"getRegionOptions");function wI(e){return it.filter(t=>t.code!==e).map(xv)}st(wI,"getRegionOptionsExcluding");function kI(e){let t=it.find(n=>n.code===e);return t?t.city:e}st(kI,"getRegionName");function OI(e){return t=>{let n=Eu(t);return Ev(n,e)}}st(OI,"createRegionFormatter");var xu="3.8.1";var Au=["Aurora","Instance","GlobalAurora","ClickHouse"],_i=["FARGATE","FARGATE_SPOT","EC2"],_t=["standard","resilient","enterprise"],Iu=["tinkerer","lightweight","standard","resilient","enterprise"],Av="custom",ra=[...Iu,Av];var pz=Object.defineProperty,fz=(e,t)=>pz(e,"name",{value:t,configurable:!0}),DI=Object.freeze({RESOURCE_SUFFIXES:Object.freeze({storage:"Storage",database:"Database",cluster:"Cluster",function:"Function",instance:"Instance",compute:"Compute"})}),na=["ecs","lambda","ec2"],Ei=Object.freeze({ECS:"ecs",LAMBDA:"lambda",EC2:"ec2"}),$u=["code","container"],ia=Object.freeze({CODE:"code",CONTAINER:"container"}),Tu=["ARM_64","X86_64"],MI="ARM_64",oa=["NONE","AWS_IAM"],Ru=["public","internal"],Pu=["CPU","MEMORY"],Cu=["ARM","STANDARD"],Iv=["Instance","Aurora"],xi=["postgresql","mysql"],jI=["foundation","compliance","hardened"];var Nu=["t3.nano","t3.micro","t3.small","t3.medium","t3.large","t3.xlarge","t3.2xlarge","t3a.nano","t3a.micro","t3a.small","t3a.medium","t3a.large","t3a.xlarge","t3a.2xlarge","t4g.nano","t4g.micro","t4g.small","t4g.medium","t4g.large","t4g.xlarge","t4g.2xlarge","c5.large","c5.xlarge","c5.2xlarge","c5.4xlarge","c5.9xlarge","c5.12xlarge","c5.18xlarge","c5.24xlarge","c5a.large","c5a.xlarge","c5a.2xlarge","c5a.4xlarge","c5a.8xlarge","c5a.12xlarge","c5a.16xlarge","c5a.24xlarge","c6g.medium","c6g.large","c6g.xlarge","c6g.2xlarge","c6g.4xlarge","c6g.8xlarge","c6g.12xlarge","c6g.16xlarge","r5.large","r5.xlarge","r5.2xlarge","r5.4xlarge","r5.8xlarge","r5.12xlarge","r5.16xlarge","r5.24xlarge","r5a.large","r5a.xlarge","r5a.2xlarge","r5a.4xlarge","r5a.8xlarge","r5a.12xlarge","r5a.16xlarge","r5a.24xlarge","r6g.medium","r6g.large","r6g.xlarge","r6g.2xlarge","r6g.4xlarge","r6g.8xlarge","r6g.12xlarge","r6g.16xlarge","i3.large","i3.xlarge","i3.2xlarge","i3.4xlarge","i3.8xlarge","i3.16xlarge","p3.2xlarge","p3.8xlarge","p3.16xlarge","g4dn.xlarge","g4dn.2xlarge","g4dn.4xlarge","g4dn.8xlarge","g4dn.12xlarge","g4dn.16xlarge","m5.large","m5.xlarge","m5.2xlarge","m5.4xlarge","m5.8xlarge","m5.12xlarge","m5.16xlarge","m5.24xlarge","m5a.large","m5a.xlarge","m5a.2xlarge","m5a.4xlarge","m5a.8xlarge","m5a.12xlarge","m5a.16xlarge","m5a.24xlarge"],zI=[0,1,5,10,15,30,60];function ct(e,t){return e.includes(t)}fz(ct,"constIncludes");var LI=1,UI=65535,m5=Object.freeze({postgresql:5432,mysql:3306}),FI=128,BI=10240,wu=1,ku=900,$v=1,Tv=1e3,Ai=100,VI=100;var ZI=3e3;var GI=["GET","POST","PUT","DELETE","HEAD","OPTIONS","PATCH"],WI=["standard","assets","upload","website"],Ii=["AES256","KMS"];var gz=Object.defineProperty,aa=(e,t)=>gz(e,"name",{value:t,configurable:!0}),He=aa(e=>s.union([s.literal(!1),e]),"optionalOrDisabled"),sn={check:aa(e=>e.minCapacity!==void 0&&e.maxCapacity!==void 0?e.minCapacity<=e.maxCapacity:!0,"check"),params:{message:d.CAPACITY_CONSTRAINT.MIN_LTE_MAX,path:["maxCapacity"]}},sa=aa(e=>s.number().int(d.MEMORY_LIMIT.INTEGER).min(e,e===128?d.MEMORY_LIMIT.MIN_128:d.MEMORY_LIMIT.MIN_512).max(30720,d.MEMORY_LIMIT.MAX),"memoryLimitMiBSchema"),V=s.string().min(1,d.REQUIRED.RESOURCE_NAME).max(63,d.MAX_LENGTH.RESOURCE_NAME).regex(L.RESOURCE_NAME,d.RESOURCE_NAME),qI=s.string().min(1,d.REQUIRED.BUCKET_NAME).max(63,d.MAX_LENGTH.BUCKET_NAME).regex(L.BUCKET_NAME,d.BUCKET_NAME),KI=s.string().min(1,d.REQUIRED.DATABASE_NAME).max(63,d.MAX_LENGTH.DATABASE_NAME).regex(L.DATABASE_NAME,d.DATABASE_NAME);function Ou(e,t=L.IDENTIFIER,n=d.IDENTIFIER){return s.string().min(2,d.IDENTIFIER_MIN_LENGTH).max(50,e).regex(t,n).refine(i=>!i.endsWith("-"),{message:d.IDENTIFIER_NO_TRAILING_HYPHEN}).refine(i=>!i.includes("--"),{message:d.IDENTIFIER_NO_CONSECUTIVE_HYPHENS})}aa(Ou,"identifierSchema");var ve=Ou(d.MAX_LENGTH.APP_NAME),y5=Ou(d.MAX_LENGTH.APP_NAME,L.NEW_APP_NAME,d.NEW_APP_NAME),cn=s.number().int(d.PORT.INTEGER).min(LI,d.PORT.MIN).max(UI,d.PORT.MAX),Te=s.object({key:s.string(),sourceText:s.string()}).strict(),hz=s.object({__identifier:s.string()}).strict(),vz=s.object({__expression:s.string()}).strict(),bz=s.object({__call:s.string()}).strict(),yz=s.union([hz,vz,bz]),Sz=s.union([s.string(),s.number(),s.boolean(),yz]),$i=s.record(s.string().regex(L.ENV_VAR_NAME,d.ENV_VAR_NAME),Sz),_z=s.object({id:s.string(),name:s.string().optional(),arn:s.string().optional(),field:s.string().optional()}).strict().refine(e=>e.name!==void 0!=(e.arn!==void 0),{message:"secretsImport requires exactly one of `name` or `arn`."}),YI=s.record(s.string(),_z),S5=s.record(s.string(),s.unknown()),Rv=s.enum(ra).describe(`Application type must be one of: ${ra.join(", ")}`),Pv=s.enum(kt).describe(`OpenNext deployment pattern: ${kt.join(", ")}`),Ez=s.enum(["before-imports","after-imports","after-app-init","after-tags","after-resource","end-of-file"]),xz=s.enum(["import","app-init","tags","database","compute","storage","network","messaging","cdn","pattern","vpc-peer","vpc-peer-accepter","cross-plan-connection","custom"]),XI=s.object({sourceText:s.string(),position:Ez,afterManagedResource:s.object({type:xz,name:s.string().optional()}).strict().optional(),originalLine:s.number().int().optional(),leadingComments:s.array(s.string()).optional(),orphaned:s.boolean().optional(),orphanedComment:s.string().optional()}).strict(),JI=s.union([s.object({tier:s.enum(_t)}).strict(),s.literal(!1)]),QI=s.union([s.object({instanceType:s.string().optional()}).strict(),s.literal(!1)]),Az=Ou(d.MAX_LENGTH.ORGANISATION_NAME),Iz=s.string().regex(L.EMAIL,d.EMAIL),HI=s.string().refine(e=>Kt.includes(e),{message:d.REGION}),_5=s.object({name:Az,email:Iz,accountName:s.string().optional(),primaryRegion:HI.optional().default(Pn),secondaryRegions:s.array(HI).optional(),security:s.enum(jI).optional(),force:s.boolean().optional()}).strict();function ca(e){return e.issues.map(t=>`${t.path.length>0?`${t.path.join(".")}: `:""}${t.message}`).join(`
+`)}catch{}}tz(oz,"writeDebugSync");var az=Object.defineProperty,Si=(e,t)=>az(e,"name",{value:t,configurable:!0});function mv(e){return e.success===!0}Si(mv,"isSuccess");function pv(e){return e.success===!1}Si(pv,"isFailure");function C(e){return{success:!0,data:e}}Si(C,"success");function $(e){return{success:!1,error:e}}Si($,"failure");async function fv(e){try{let t=await e();return C(t)}catch(t){return $(vt(t))}}Si(fv,"tryAsync");function gv(e){try{let t=e();return C(t)}catch(t){return $(vt(t))}}Si(gv,"trySync");var sz=Object.defineProperty,cz=(e,t)=>sz(e,"name",{value:t,configurable:!0}),PI=/^[a-zA-Z][a-zA-Z0-9-]*$/,uz=Bo.source.replace(/^\^|\$$/g,""),L=Object.freeze({IDENTIFIER:PI,NEW_APP_NAME:/^[a-z][a-z0-9-]*$/,RESOURCE_NAME:/^[a-zA-Z][a-zA-Z0-9]*$/,ECS_SERVICE_NAME:PI,BUCKET_NAME:/^[a-z][a-z0-9-]*[a-z0-9]$|^[a-z][a-z0-9]*$/,DATABASE_NAME:/^[a-zA-Z][a-zA-Z0-9_]*$/,RESOURCE_TYPE:/^[a-z]+(:[a-z]+)?$/,SSM_PATH:new RegExp(`^(?:/${uz})+$`),SECRET_NAME:Jc,SSM_COMPONENT:Bo,EMAIL:/^[^\s@]+@[^\s@]+\.[^\s@]+$/,DOCKER_IMAGE:/^[a-z0-9][a-z0-9._-]*[a-z0-9](:[a-z0-9._-]+)?$/,DOMAIN:/^[a-z0-9]([a-z0-9-]*[a-z0-9])?(\.[a-z0-9]([a-z0-9-]*[a-z0-9])?)+$/i,HTTP_ORIGIN:/^https?:\/\/[a-z0-9.-]+(:\d+)?$/i,PASCAL_CASE:/^[A-Z][A-Za-z0-9]*$/,AWS_ACCOUNT_ID:/^\d{12}$/,VPC_ID:/^vpc-[a-z0-9]+$/,ROLE_ARN:/^arn:aws[a-zA-Z-]*:iam::\d{12}:role\/.+$/,CIDR:/^((25[0-5]|2[0-4]\d|1\d\d|[1-9]?\d)\.){3}(25[0-5]|2[0-4]\d|1\d\d|[1-9]?\d)\/(3[0-2]|[12]?\d)$/,SCHEDULE_EXPRESSION:/^(rate\(1 (?:minute|hour|day)\)|rate\((?:[2-9]|[1-9]\d+) (?:minutes|hours|days)\)|cron\([^\s()]+ [^\s()]+ [^\s()]+ [^\s()]+ [^\s()]+ [^\s()]+\))$/,LAMBDA_RUNTIME_IDENTIFIER:/^[A-Za-z0-9._-]+$/,ENV_VAR_NAME:/^[A-Za-z_][A-Za-z0-9_]*$/});function hv(e){let t=/^rate\((\d+) (minute|minutes|hour|hours|day|days)\)$/.exec(e);if(!t)return;let n=t[1],i=t[2];if(n===void 0||i===void 0)return;let r=parseInt(n,10);if(!Number.isFinite(r)||r<1)return;let o=i==="minute"||i==="hour"||i==="day";if(!(o&&r!==1)&&!(!o&&r===1))return i==="minute"||i==="minutes"?{everyMs:r*6e4}:i==="hour"||i==="hours"?{everyMs:r*60*6e4}:{everyMs:r*24*60*6e4}}cz(hv,"parseRateExpression");var d=Object.freeze({IDENTIFIER:"Must start with a letter, contain only letters, numbers, and hyphens",NEW_APP_NAME:"Must start with a lowercase letter and contain only lowercase letters, numbers, and hyphens",IDENTIFIER_MIN_LENGTH:"Must be at least 2 characters",IDENTIFIER_NO_TRAILING_HYPHEN:"Must not end with a hyphen",IDENTIFIER_NO_CONSECUTIVE_HYPHENS:"Must not contain consecutive hyphens",RESOURCE_NAME:"Must start with a letter and contain only letters and numbers (PascalCase recommended)",ECS_SERVICE_NAME:"Service name must start with a letter and contain only letters, numbers, and hyphens",BUCKET_NAME:"Bucket name must start with a lowercase letter and contain only lowercase letters, numbers, and hyphens",DATABASE_NAME:"Database name must start with a letter and contain only letters, numbers, and underscores",RESOURCE_TYPE:"Resource type must be in format 'category' or 'category:type'",SSM_PATH:"SSM path must start with / and contain valid namespace segments (e.g., /myapp/ApiCluster/service)",SECRET_NAME:hh,SSM_COMPONENT:Qc,EMAIL:"Please enter a valid email address",DOMAIN:"Please enter a valid domain (e.g., cms.example.com)",DOCKER_IMAGE:"Invalid Docker image name format",REQUIRED:{APP_NAME:"Application name is required",RESOURCE_NAME:"Resource name is required",BUCKET_NAME:"Bucket name is required",SERVICE_NAME:"Service name is required",NETWORK_NAME:"Network name is required",DATABASE_NAME:"Database name is required",ORGANISATION_NAME:"Organisation name is required",EMAIL:"Email is required",NAME:"Name is required",USERNAME:"Username is required",CONTAINER_NAME:"Container name is required",GROUP:"Group is required",PATTERN_NAME:"Pattern name is required",SOURCE:"Source directory is required",BUILD_COMMAND:"Build command is required",OUTPUT_DIR:"Output directory is required",FORMS_TO:"Forms recipient address is required",ROUTING_PATH:"Routing path is required",RESOURCE_REFERENCE:"Resource reference is required",RESOURCE_TYPE:"Resource type is required",VARIANT:"Variant is required",SUBTYPE:"Subtype is required",DEPLOY_TARGET:"Deploy target is required",DESTROY_TARGET:"Destroy target is required"},MAX_LENGTH:{APP_NAME:"Application name must be 50 characters or less",RESOURCE_NAME:"Resource name must be 63 characters or less",BUCKET_NAME:"Bucket name must be 63 characters or less",SERVICE_NAME:"Service name must be 255 characters or less",NETWORK_NAME:"Network name must be 50 characters or less",DATABASE_NAME:"Database name must be 63 characters or less",ORGANISATION_NAME:"Organisation name must be 50 characters or less"},PORT:{INTEGER:"Port must be an integer",MIN:"Port must be at least 1",MAX:"Port cannot exceed 65535"},USERNAME:{MAX_LENGTH:"Username cannot exceed 63 characters"},LAMBDA:{MEMORY:{INTEGER:"Lambda memory must be an integer",MIN:"Memory must be at least 128 MB",MAX:"Memory cannot exceed 10240 MB",MULTIPLE:"Memory must be 128 MB or a multiple of 64 MB"},TIMEOUT:{INTEGER:"Timeout must be an integer",MIN:"Timeout must be at least 1 second",MAX:"Timeout cannot exceed 900 seconds"},RUNTIME:"Lambda runtime must contain only letters, digits, dots, underscores, or dashes (e.g. 'NODEJS_20_X' or 'nodejs20.x')"},ENV_VAR_NAME:"Environment variable names must start with a letter or underscore and contain only letters, digits, and underscores",PRIORITY:{INTEGER:"Priority must be an integer",MIN:"Priority must be at least 1",MAX:"Priority cannot exceed 50000"},CAPACITY:{MIN:{INTEGER:"Minimum capacity must be an integer",MIN_0:"Minimum capacity must be at least 0",MIN_1:"Minimum capacity must be at least 1",MAX:"Minimum capacity cannot exceed 100"},MAX:{INTEGER:"Maximum capacity must be an integer",MIN_0:"Maximum capacity must be at least 0",MIN_1:"Maximum capacity must be at least 1",MAX:"Maximum capacity cannot exceed 100"},DESIRED:{INTEGER:"Desired count must be an integer",MIN:"Desired count must be at least 0",MAX:"Desired count cannot exceed 100"},WARM_POOL_REQUIRED:"minCapacity 0 requires a warmPool \u2014 without it, new tasks wait 60-90s for a cold instance launch",WARM_POOL:{MIN_SIZE:{INTEGER:"Warm pool minSize must be an integer",MIN:"Warm pool minSize must be at least 0",MAX:"Warm pool minSize cannot exceed 100"},MIN_SIZE_EXCEEDS_MAX_CAPACITY:"warmPool.minSize cannot exceed maxCapacity \u2014 the warm pool cannot hold more instances than the ASG allows"}},MEMORY_LIMIT:{INTEGER:"Memory limit must be an integer",MIN_512:"Memory limit must be at least 512 MiB",MIN_128:"Memory limit must be at least 128 MiB",MAX:"Memory limit cannot exceed 30720 MiB"},DATABASE:{PORT:{INTEGER:"Database port must be an integer",MIN:"Database port must be at least 1024",MAX:"Database port cannot exceed 65535"},NAME:{REQUIRED:"Database name is required",MAX_LENGTH:"Database name must be 63 characters or less"}},BACKUP_RETENTION:{INTEGER:"Backup retention must be an integer",MIN:"Backup retention must be at least 1 day",MAX:"Backup retention cannot exceed 35 days"},SQS:{VISIBILITY_TIMEOUT:{INTEGER:"Visibility timeout must be an integer",MIN:"Visibility timeout must be at least 0 seconds",MAX:"Visibility timeout cannot exceed 43200 seconds (12 hours)"},RETENTION_PERIOD:{INTEGER:"Retention period must be an integer",MIN:"Retention period must be at least 60 seconds",MAX:"Retention period cannot exceed 1209600 seconds (14 days)"}},READER:{COUNT:{INTEGER:"Reader count must be an integer",MIN:"Reader count must be at least 0",MAX:"Reader count cannot exceed 15"}},IDENTIFIER_SUFFIX:{REQUIRED:"Identifier suffix is required when specified",MAX_LENGTH:"Identifier suffix cannot exceed 50 characters"},ROTATION:{INTEGER:"Rotation days must be an integer",MIN:"Rotation interval must be at least 1 day",MAX:"Rotation interval cannot exceed 365 days"},MAX_CONNECTIONS:{INTEGER:"Max connections must be an integer",MIN:"Max connections must be at least 1",MAX:"Max connections cannot exceed 100"},MONITORING_INTERVAL:{INTEGER:"Monitoring interval must be an integer",MIN:"Monitoring interval must be at least 0",MAX:"Monitoring interval cannot exceed 60 seconds",VALUES:"Monitoring interval must be 0, 1, 5, 10, 15, 30, or 60 seconds"},RETENTION_DAYS:{INTEGER:"Retention days must be an integer",MIN:"Retention days must be at least 1",MAX:"Retention days cannot exceed 365"},BATCH_SIZE:{INTEGER:"Batch size must be an integer",MIN:"Batch size must be at least 1",MAX:"Batch size cannot exceed 10000"},SERVICE:{UNIQUE_WITHIN_CLUSTER:"Service names must be unique within a cluster",MIN_REQUIRED:"At least one service is required",ROUTING_REQUIRED:"Multiple services with ports require routing config (path or host)"},PROXY_CONFIG:{MAX_IDLE_CONNECTIONS:{INTEGER:"Max idle connections must be an integer",MIN:"Max idle connections must be at least 0",MAX:"Max idle connections cannot exceed 100"},BORROW_TIMEOUT:{INTEGER:"Connection borrow timeout must be an integer",MIN:"Connection borrow timeout must be at least 1 second",MAX:"Connection borrow timeout cannot exceed 3600 seconds"}},MAX_AZS:{INTEGER:"Max AZs must be an integer",MIN:"Max AZs must be at least 1",MAX:"Max AZs cannot exceed 3"},BATCHING_WINDOW:{INTEGER:"Max batching window must be an integer",MIN:"Max batching window must be at least 0",MAX:"Max batching window cannot exceed 300 seconds"},HEALTH_CHECK:{INTERVAL:{INTEGER:"Health check interval must be an integer",MIN:"Health check interval must be at least 5 seconds",MAX:"Health check interval cannot exceed 300 seconds"},TIMEOUT:{INTEGER:"Health check timeout must be an integer",MIN:"Health check timeout must be at least 2 seconds",MAX:"Health check timeout cannot exceed 60 seconds"},RETRIES:{INTEGER:"Health check retries must be an integer",MIN:"Health check retries must be at least 1",MAX:"Health check retries cannot exceed 10"},START_PERIOD:{INTEGER:"Health check start period must be an integer",MIN:"Health check start period must be at least 0 seconds",MAX:"Health check start period cannot exceed 300 seconds"}},EPHEMERAL_STORAGE:{INTEGER:"Ephemeral storage size must be an integer",MIN:"Ephemeral storage size must be at least 512 MB",MAX:"Ephemeral storage size cannot exceed 10240 MB"},MAX_MESSAGE_SIZE:{INTEGER:"Max message size must be an integer",MIN:"Max message size must be at least 1024 bytes",MAX:"Max message size cannot exceed 262144 bytes (256 KB)"},CAPACITY_CONSTRAINT:{MIN_LTE_MAX:"minCapacity must be less than or equal to maxCapacity"},DIRECT_ACCESS:{NO_DOMAIN:"directAccess cannot be used with domain (no ALB for HTTPS)",NO_LOAD_BALANCER:"directAccess cannot be used with loadBalancer (mutually exclusive)"},GLOBAL_AURORA:{PRIMARY_REGION_REQUIRED:"primaryRegion is required for GlobalAurora databases"},NAT_GATEWAY:{INTEGER:"NAT gateway count must be an integer",MIN:"NAT gateway count must be at least 0",MAX:"NAT gateway count cannot exceed 3"},CIDR_MASK:{INTEGER:"CIDR mask must be an integer",MIN:"CIDR mask must be at least 16",MAX:"CIDR mask cannot exceed 28"},CPU:{INTEGER:"CPU must be an integer",MIN:"CPU must be at least 256 units",MAX:"CPU cannot exceed 4096 units"},KMS:{KEY_REQUIRED:"KMS key ARN is required when using KMS encryption"},READER_INSTANCES:{MAX:"Cannot have more than 15 reader instances",COUNT_OR_INSTANCES:"Cannot specify both 'count' and 'instances' - use one or the other"},GENERATOR_CAPACITY:{MIN:{MIN:"Minimum capacity must be at least 1",MAX:"Minimum capacity cannot exceed 1000"},MAX:{MIN:"Maximum capacity must be at least 1",MAX:"Maximum capacity cannot exceed 1000"}},INSTANCE_TYPE:"Unknown instance type. Common types include: t4g.micro, t4g.small, m5.large",ARCHITECTURE_MISMATCH:"Architecture mismatch between instance type and AMI",ALLOCATED_STORAGE:{INTEGER:"Allocated storage must be an integer",MIN:"Allocated storage must be at least 20 GB",MAX:"Allocated storage cannot exceed 65536 GB"},DLQ:{MAX_RECEIVE_COUNT:{INTEGER:"Max receive count must be an integer",MIN:"Max receive count must be at least 1",MAX:"Max receive count cannot exceed 1000"}},ALARM:{PERCENTAGE:{MIN:"Threshold must be at least 1%",MAX:"Threshold must be at most 100%"},FREE_STORAGE_GIB:{MIN:"Free storage threshold must be at least 1 GiB"}},REGION:"Invalid AWS region",PASCAL_CASE:"Resource name must start with an uppercase letter and contain only alphanumerics (PascalCase).",IMAGE_DOCKER_MUTEX:"image and docker are mutually exclusive",AWS_ACCOUNT_ID:"AWS account id must be exactly 12 digits (no hyphens)",VPC_ID:"VPC id must look like vpc-abc12345",ROLE_ARN:"Role ARN must have the form arn:aws:iam::<account-id>:role/<name>",CIDR:"CIDR must be in dotted-quad/prefix-length form (e.g. 10.0.0.0/16)",VPC_PEER:{MIN_REQUESTER_ACCOUNTS:"At least one requester account id is required",REGION_REQUIRED:"Peer region is required when specified",ROUTE_TABLE_ID_REQUIRED:"Route table id must not be empty"},SCHEDULE_EXPRESSION:"Schedule expression must be 'rate(N minute|minutes|hour|hours|day|days)' with N>=1, or 'cron(<6-field AWS expression>)'"});var lz=Object.defineProperty,st=(e,t)=>lz(e,"name",{value:t,configurable:!0}),dz=["us-east-2","us-west-2","us-east-1","eu-west-1","eu-central-1","ap-southeast-1"],mz=Object.freeze(dz.flatMap(e=>{let t=Cn(e);return t?[t]:[]})),vv=Object.freeze(["us-east-2","us-west-2","us-east-1","eu-west-1","ap-southeast-1"]);function Eu(e){return e?e.split(",").map(t=>t.trim()).filter(Boolean):[]}st(Eu,"parseRegionList");function bv(e){return Kt.includes(e)}st(bv,"isValidRegion");function yv(e){return/^[a-z]{2}-[a-z]+-[1-9]$/.test(e)}st(yv,"isValidRegionFormat");function Sv(e){if(!e)return vv.slice(0,3);let t=e.toLowerCase().split("-"),n=t[0],i=t.length>1?t[1]:"",r=[];return n&&i&&(r=Kt.filter(o=>o.startsWith(`${n}-${i}`))),r.length===0&&n&&(r=Kt.filter(o=>o.startsWith(`${n}-`))),r.length>0?r.slice(0,3):vv.slice(0,3)}st(Sv,"getSuggestions");function _v(e){if(bv(e))return!0;let t=Sv(e);return yv(e)?`Unknown region. Try: ${t.join(", ")}`:`Invalid format. Try: ${t.join(", ")}`}st(_v,"validateRegion");function CI(e){if(!e||e.trim()==="")return!0;let t=Eu(e);for(let n of t){let i=_v(n);if(i!==!0)return i}return!0}st(CI,"validateRegionList");function Ev(e,t){return e.filter(n=>n!==t)}st(Ev,"filterDuplicateRegions");function xv(e){return{label:e.city,value:e.code,description:e.optIn?`${e.code} \u2014 opt-in required`:e.code}}st(xv,"toRegionOption");function NI(){return it.map(xv)}st(NI,"getRegionOptions");function wI(e){return it.filter(t=>t.code!==e).map(xv)}st(wI,"getRegionOptionsExcluding");function kI(e){let t=it.find(n=>n.code===e);return t?t.city:e}st(kI,"getRegionName");function OI(e){return t=>{let n=Eu(t);return Ev(n,e)}}st(OI,"createRegionFormatter");var xu="3.10.0";var Au=["Aurora","Instance","GlobalAurora","ClickHouse"],_i=["FARGATE","FARGATE_SPOT","EC2"],_t=["standard","resilient","enterprise"],Iu=["tinkerer","lightweight","standard","resilient","enterprise"],Av="custom",ra=[...Iu,Av];var pz=Object.defineProperty,fz=(e,t)=>pz(e,"name",{value:t,configurable:!0}),DI=Object.freeze({RESOURCE_SUFFIXES:Object.freeze({storage:"Storage",database:"Database",cluster:"Cluster",function:"Function",instance:"Instance",compute:"Compute"})}),na=["ecs","lambda","ec2"],Ei=Object.freeze({ECS:"ecs",LAMBDA:"lambda",EC2:"ec2"}),$u=["code","container"],ia=Object.freeze({CODE:"code",CONTAINER:"container"}),Tu=["ARM_64","X86_64"],MI="ARM_64",oa=["NONE","AWS_IAM"],Ru=["public","internal"],Pu=["CPU","MEMORY"],Cu=["ARM","STANDARD"],Iv=["Instance","Aurora"],xi=["postgresql","mysql"],jI=["foundation","compliance","hardened"];var Nu=["t3.nano","t3.micro","t3.small","t3.medium","t3.large","t3.xlarge","t3.2xlarge","t3a.nano","t3a.micro","t3a.small","t3a.medium","t3a.large","t3a.xlarge","t3a.2xlarge","t4g.nano","t4g.micro","t4g.small","t4g.medium","t4g.large","t4g.xlarge","t4g.2xlarge","c5.large","c5.xlarge","c5.2xlarge","c5.4xlarge","c5.9xlarge","c5.12xlarge","c5.18xlarge","c5.24xlarge","c5a.large","c5a.xlarge","c5a.2xlarge","c5a.4xlarge","c5a.8xlarge","c5a.12xlarge","c5a.16xlarge","c5a.24xlarge","c6g.medium","c6g.large","c6g.xlarge","c6g.2xlarge","c6g.4xlarge","c6g.8xlarge","c6g.12xlarge","c6g.16xlarge","r5.large","r5.xlarge","r5.2xlarge","r5.4xlarge","r5.8xlarge","r5.12xlarge","r5.16xlarge","r5.24xlarge","r5a.large","r5a.xlarge","r5a.2xlarge","r5a.4xlarge","r5a.8xlarge","r5a.12xlarge","r5a.16xlarge","r5a.24xlarge","r6g.medium","r6g.large","r6g.xlarge","r6g.2xlarge","r6g.4xlarge","r6g.8xlarge","r6g.12xlarge","r6g.16xlarge","i3.large","i3.xlarge","i3.2xlarge","i3.4xlarge","i3.8xlarge","i3.16xlarge","p3.2xlarge","p3.8xlarge","p3.16xlarge","g4dn.xlarge","g4dn.2xlarge","g4dn.4xlarge","g4dn.8xlarge","g4dn.12xlarge","g4dn.16xlarge","m5.large","m5.xlarge","m5.2xlarge","m5.4xlarge","m5.8xlarge","m5.12xlarge","m5.16xlarge","m5.24xlarge","m5a.large","m5a.xlarge","m5a.2xlarge","m5a.4xlarge","m5a.8xlarge","m5a.12xlarge","m5a.16xlarge","m5a.24xlarge"],zI=[0,1,5,10,15,30,60];function ct(e,t){return e.includes(t)}fz(ct,"constIncludes");var LI=1,UI=65535,m5=Object.freeze({postgresql:5432,mysql:3306}),FI=128,BI=10240,wu=1,ku=900,$v=1,Tv=1e3,Ai=100,VI=100;var ZI=3e3;var GI=["GET","POST","PUT","DELETE","HEAD","OPTIONS","PATCH"],WI=["standard","assets","upload","website"],Ii=["AES256","KMS"];var gz=Object.defineProperty,aa=(e,t)=>gz(e,"name",{value:t,configurable:!0}),He=aa(e=>s.union([s.literal(!1),e]),"optionalOrDisabled"),sn={check:aa(e=>e.minCapacity!==void 0&&e.maxCapacity!==void 0?e.minCapacity<=e.maxCapacity:!0,"check"),params:{message:d.CAPACITY_CONSTRAINT.MIN_LTE_MAX,path:["maxCapacity"]}},sa=aa(e=>s.number().int(d.MEMORY_LIMIT.INTEGER).min(e,e===128?d.MEMORY_LIMIT.MIN_128:d.MEMORY_LIMIT.MIN_512).max(30720,d.MEMORY_LIMIT.MAX),"memoryLimitMiBSchema"),V=s.string().min(1,d.REQUIRED.RESOURCE_NAME).max(63,d.MAX_LENGTH.RESOURCE_NAME).regex(L.RESOURCE_NAME,d.RESOURCE_NAME),qI=s.string().min(1,d.REQUIRED.BUCKET_NAME).max(63,d.MAX_LENGTH.BUCKET_NAME).regex(L.BUCKET_NAME,d.BUCKET_NAME),KI=s.string().min(1,d.REQUIRED.DATABASE_NAME).max(63,d.MAX_LENGTH.DATABASE_NAME).regex(L.DATABASE_NAME,d.DATABASE_NAME);function Ou(e,t=L.IDENTIFIER,n=d.IDENTIFIER){return s.string().min(2,d.IDENTIFIER_MIN_LENGTH).max(50,e).regex(t,n).refine(i=>!i.endsWith("-"),{message:d.IDENTIFIER_NO_TRAILING_HYPHEN}).refine(i=>!i.includes("--"),{message:d.IDENTIFIER_NO_CONSECUTIVE_HYPHENS})}aa(Ou,"identifierSchema");var ve=Ou(d.MAX_LENGTH.APP_NAME),y5=Ou(d.MAX_LENGTH.APP_NAME,L.NEW_APP_NAME,d.NEW_APP_NAME),cn=s.number().int(d.PORT.INTEGER).min(LI,d.PORT.MIN).max(UI,d.PORT.MAX),Te=s.object({key:s.string(),sourceText:s.string()}).strict(),hz=s.object({__identifier:s.string()}).strict(),vz=s.object({__expression:s.string()}).strict(),bz=s.object({__call:s.string()}).strict(),yz=s.union([hz,vz,bz]),Sz=s.union([s.string(),s.number(),s.boolean(),yz]),$i=s.record(s.string().regex(L.ENV_VAR_NAME,d.ENV_VAR_NAME),Sz),_z=s.object({id:s.string(),name:s.string().optional(),arn:s.string().optional(),field:s.string().optional()}).strict().refine(e=>e.name!==void 0!=(e.arn!==void 0),{message:"secretsImport requires exactly one of `name` or `arn`."}),YI=s.record(s.string(),_z),S5=s.record(s.string(),s.unknown()),Rv=s.enum(ra).describe(`Application type must be one of: ${ra.join(", ")}`),Pv=s.enum(kt).describe(`OpenNext deployment pattern: ${kt.join(", ")}`),Ez=s.enum(["before-imports","after-imports","after-app-init","after-tags","after-resource","end-of-file"]),xz=s.enum(["import","app-init","tags","database","compute","storage","network","messaging","cdn","pattern","vpc-peer","vpc-peer-accepter","cross-plan-connection","custom"]),XI=s.object({sourceText:s.string(),position:Ez,afterManagedResource:s.object({type:xz,name:s.string().optional()}).strict().optional(),originalLine:s.number().int().optional(),leadingComments:s.array(s.string()).optional(),orphaned:s.boolean().optional(),orphanedComment:s.string().optional()}).strict(),JI=s.union([s.object({tier:s.enum(_t)}).strict(),s.literal(!1)]),QI=s.union([s.object({instanceType:s.string().optional()}).strict(),s.literal(!1)]),Az=Ou(d.MAX_LENGTH.ORGANISATION_NAME),Iz=s.string().regex(L.EMAIL,d.EMAIL),HI=s.string().refine(e=>Kt.includes(e),{message:d.REGION}),_5=s.object({name:Az,email:Iz,accountName:s.string().optional(),primaryRegion:HI.optional().default(Pn),secondaryRegions:s.array(HI).optional(),security:s.enum(jI).optional(),force:s.boolean().optional()}).strict();function ca(e){return e.issues.map(t=>`${t.path.length>0?`${t.path.join(".")}: `:""}${t.message}`).join(`
 `)}aa(ca,"getZodErrorMessage");var Ti=s.number().min(1,d.ALARM.PERCENTAGE.MIN).max(100,d.ALARM.PERCENTAGE.MAX),$z=s.number().min(1,d.ALARM.FREE_STORAGE_GIB.MIN),e$=s.union([s.literal(!1),s.object({cpuThreshold:Ti.optional(),memoryThreshold:Ti.optional(),runningTasksMinimum:s.number().int().min(0).optional(),http5xxThreshold:Ti.optional()}).strict()]),t$=s.union([s.literal(!1),s.object({cpuThreshold:Ti.optional(),freeStorageThresholdGiB:$z.optional(),connectionsThreshold:s.number().int().min(1).optional()}).strict()]),r$=s.union([s.literal(!1),s.object({errorRateThreshold:Ti.optional(),durationThresholdPercent:Ti.optional()}).strict()]);var Qt=s.number().int(d.BACKUP_RETENTION.INTEGER).min(1,d.BACKUP_RETENTION.MIN).max(35,d.BACKUP_RETENTION.MAX),ua=s.number().int(d.MONITORING_INTERVAL.INTEGER).refine(e=>ct(zI,e),{message:d.MONITORING_INTERVAL.VALUES}),Mu=s.number().int(d.DATABASE.PORT.INTEGER).min(1024,d.DATABASE.PORT.MIN).max(65535,d.DATABASE.PORT.MAX),Tz=s.enum(Au).describe(`Database type must be one of: ${Au.join(", ")}`),Rz=s.object({maxConnections:s.number().int(d.MAX_CONNECTIONS.INTEGER).min(1,d.MAX_CONNECTIONS.MIN).max(100,d.MAX_CONNECTIONS.MAX).optional(),maxIdleConnections:s.number().int(d.PROXY_CONFIG.MAX_IDLE_CONNECTIONS.INTEGER).min(0,d.PROXY_CONFIG.MAX_IDLE_CONNECTIONS.MIN).max(100,d.PROXY_CONFIG.MAX_IDLE_CONNECTIONS.MAX).optional(),connectionBorrowTimeout:s.number().int(d.PROXY_CONFIG.BORROW_TIMEOUT.INTEGER).min(1,d.PROXY_CONFIG.BORROW_TIMEOUT.MIN).max(3600,d.PROXY_CONFIG.BORROW_TIMEOUT.MAX).optional(),requireTLS:s.boolean().optional()}).strict().describe("RDS Proxy configuration"),Pz=s.object({instanceType:s.string().optional(),availabilityZone:s.string().optional()}).strict().describe("Read replica configuration"),Cz=s.object({automaticallyAfterDays:s.number().int(d.ROTATION.INTEGER).min(1,d.ROTATION.MIN).max(365,d.ROTATION.MAX).optional()}).strict().describe("Secret rotation configuration"),ju=s.object({username:s.string().min(1,d.REQUIRED.USERNAME).max(63,d.USERNAME.MAX_LENGTH).optional(),secretRotation:Cz.optional()}).strict().describe("Database credentials configuration"),zu=He(Rz),Lu=He(Pz),Nz=s.object({scaleWithWriter:s.boolean().optional(),enableDatabaseInsights:s.boolean().optional(),identifierSuffix:s.string().min(1,d.IDENTIFIER_SUFFIX.REQUIRED).max(50,d.IDENTIFIER_SUFFIX.MAX_LENGTH).optional(),availabilityZone:s.string().optional()}).strict().describe("Configuration for a single Aurora reader instance"),la=s.object({enableDatabaseInsights:s.boolean().optional(),identifierSuffix:s.string().min(1,d.IDENTIFIER_SUFFIX.REQUIRED).max(50,d.IDENTIFIER_SUFFIX.MAX_LENGTH).optional(),availabilityZone:s.string().optional()}).strict().describe("Configuration for Aurora writer instance"),wz=s.object({count:s.number().int(d.READER.COUNT.INTEGER).min(0,d.READER.COUNT.MIN).max(15,d.READER.COUNT.MAX).optional(),instances:s.array(Nz).max(15,d.READER_INSTANCES.MAX).optional(),defaultEnableDatabaseInsights:s.boolean().optional()}).strict().refine(e=>!(e.count!==void 0&&e.instances!==void 0),{message:d.READER_INSTANCES.COUNT_OR_INSTANCES,path:["count"]}).describe("Aurora readers configuration"),da=He(wz),kz=s.object({awsManaged:s.literal(!0)}).strict(),Oz=s.object({useCMK:s.literal(!0)}).strict(),n$=s.union([kz,Oz]),Dz=s.object({mode:s.enum(["standard","advanced"]).optional(),encryptionKey:n$.optional()}).strict().describe("Database Insights configuration"),Uu=He(Dz),Fu=s.object({storageKey:n$.optional()}).strict().describe("Encryption configuration (DESTRUCTIVE to change storageKey)"),i$=s.object({name:V,type:Tz,databaseName:s.string().min(1,d.REQUIRED.DATABASE_NAME),instanceType:s.string().optional(),allocatedStorage:s.number().optional(),multiAz:s.boolean().optional(),publiclyAccessible:s.boolean().optional(),databaseInsights:Uu.optional(),port:Mu.optional(),deletionProtection:s.boolean().optional(),proxy:zu.optional(),credentials:ju.optional(),readReplica:Lu.optional(),encryption:Fu.optional(),writer:la.optional(),readers:da.optional(),backupRetention:Qt.optional(),preferredMaintenanceWindow:s.string().optional(),monitoringInterval:ua.optional(),primaryRegion:s.string().optional(),secondaryRegions:s.array(s.string()).optional(),globalClusterIdentifier:s.string().optional(),enableGlobalWriteForwarding:s.boolean().optional(),snapshotIdentifier:s.string().optional(),snapshotUsername:s.string().optional(),databaseEngine:s.enum(xi).optional(),engineExpression:s.string().optional(),variableName:s.string().optional(),extraProperties:s.array(Te).optional(),alarms:t$.optional()}).strict(),Bu=s.object({appName:ve,nameProvidedByFlag:s.boolean().optional(),databaseName:s.string().min(1,d.REQUIRED.DATABASE_NAME).max(63,d.MAX_LENGTH.DATABASE_NAME).regex(L.DATABASE_NAME,d.DATABASE_NAME),resourceName:V.optional(),connectionConfig:s.object({connectToCompute:s.array(s.string()).optional(),connectToServices:s.array(s.string()).optional()}).strict().optional(),databaseInsights:Uu.optional(),port:Mu.optional(),proxy:zu.optional(),credentials:ju.optional(),encryption:Fu.optional(),deletionProtection:s.boolean().optional()}).strict(),o$={databaseType:s.literal("Instance"),instanceType:s.string().optional(),multiAz:s.boolean().optional(),readReplica:Lu.optional(),publiclyAccessible:s.boolean().optional(),backupRetention:Qt.optional(),allocatedStorage:s.number().optional(),snapshotIdentifier:s.string().optional(),snapshotUsername:s.string().optional()},a$={databaseType:s.literal("Aurora"),writer:la.optional(),readers:da.optional(),backupRetention:Qt.optional(),preferredMaintenanceWindow:s.string().optional(),monitoringInterval:ua.optional(),snapshotIdentifier:s.string().optional(),snapshotUsername:s.string().optional()},s$={databaseType:s.literal("GlobalAurora"),primaryRegion:s.string().min(1,d.GLOBAL_AURORA.PRIMARY_REGION_REQUIRED),secondaryRegions:s.array(s.string()).optional(),globalClusterIdentifier:s.string().optional(),enableGlobalWriteForwarding:s.boolean().optional(),writer:la.optional(),readers:da.optional(),backupRetention:Qt.optional(),preferredMaintenanceWindow:s.string().optional(),monitoringInterval:ua.optional(),snapshotIdentifier:s.string().optional(),snapshotUsername:s.string().optional()},c$=s.object({appName:ve,nameProvidedByFlag:s.boolean().optional(),databaseName:s.string().min(1,d.REQUIRED.DATABASE_NAME).max(63,d.MAX_LENGTH.DATABASE_NAME).regex(L.DATABASE_NAME,d.DATABASE_NAME),resourceName:V.optional(),connectionConfig:s.object({connectToCompute:s.array(s.string()).optional(),connectToServices:s.array(s.string()).optional()}).strict().optional()}).strict(),u$={databaseType:s.literal("ClickHouse"),instanceType:s.string().optional(),coldTier:s.union([s.object({mode:s.literal("s3")}).strict(),s.literal(!1)]).optional(),optimiseSchedule:s.union([s.string(),s.literal(!1)]).optional(),backupSchedule:s.union([s.string(),s.literal(!1)]).optional(),backupRetentionDays:Qt.optional()},Mz=Bu.extend(o$).strict(),jz=Bu.extend(a$).strict(),zz=Bu.extend(s$).strict(),Lz=c$.extend(u$).strict(),N5=s.discriminatedUnion("databaseType",[Mz,jz,zz,Lz]),Cv=Bu.extend({resourceName:V}).strict(),Uz=Cv.extend(o$).strict(),Fz=Cv.extend(a$).strict(),Bz=Cv.extend(s$).strict(),Vz=c$.extend({resourceName:V}).strict(),Zz=Vz.extend(u$).strict(),w5=s.discriminatedUnion("databaseType",[Uz,Fz,Bz,Zz]),k5=s.object({appName:ve,databaseName:s.string().min(1,d.REQUIRED.DATABASE_NAME),maxConnections:s.number().int(d.MAX_CONNECTIONS.INTEGER).min(1,d.MAX_CONNECTIONS.MIN).max(100,d.MAX_CONNECTIONS.MAX).optional(),maxIdleConnections:s.number().int(d.PROXY_CONFIG.MAX_IDLE_CONNECTIONS.INTEGER).min(0,d.PROXY_CONFIG.MAX_IDLE_CONNECTIONS.MIN).max(100,d.PROXY_CONFIG.MAX_IDLE_CONNECTIONS.MAX).optional(),connectionBorrowTimeout:s.number().int(d.PROXY_CONFIG.BORROW_TIMEOUT.INTEGER).min(1,d.PROXY_CONFIG.BORROW_TIMEOUT.MIN).max(3600,d.PROXY_CONFIG.BORROW_TIMEOUT.MAX).optional(),requireTLS:s.boolean().optional(),nameProvidedByFlag:s.boolean().optional()}).strict(),Gz=["S","N","B"],Du=s.object({name:s.string(),type:s.enum(Gz)}).strict(),l$=s.object({name:V,partitionKey:Du,sortKey:Du.optional(),globalSecondaryIndexes:s.array(s.object({indexName:s.string(),partitionKey:Du,sortKey:Du.optional()}).strict()).optional(),ttlAttribute:s.string().optional(),stream:s.boolean().optional(),variableName:s.string().optional(),extraProperties:s.array(Te).optional()}).strict(),Wz=s.object({mode:s.literal("s3")}).strict(),d$=s.object({name:V,type:s.literal("ClickHouse"),databaseName:KI,instanceType:s.string().optional(),coldTier:s.union([Wz,s.literal(!1)]).optional(),optimiseSchedule:s.union([s.string(),s.literal(!1)]).optional(),backupSchedule:s.union([s.string(),s.literal(!1)]).optional(),backupRetentionDays:Qt.optional(),variableName:s.string().optional(),extraProperties:s.array(Te).optional()}).strict();var Hz=s.object({count:s.number().int(d.NAT_GATEWAY.INTEGER).min(0,d.NAT_GATEWAY.MIN).max(3,d.NAT_GATEWAY.MAX).optional()}).strict().describe("NAT gateway configuration"),m$=He(Hz),Nv=s.enum(["cloudwatch","s3"]),qz=s.object({destination:Nv.optional(),retentionDays:s.number().int(d.RETENTION_DAYS.INTEGER).min(1,d.RETENTION_DAYS.MIN).max(365,d.RETENTION_DAYS.MAX).optional(),trafficType:s.enum(["ALL","ACCEPT","REJECT"]).optional()}).strict().describe("VPC flow log configuration"),p$=He(qz),Kz=s.object({s3:s.boolean().optional(),dynamodb:s.boolean().optional()}).strict().describe("Gateway VPC endpoints (FREE)"),Yz=He(Kz),Xz=s.object({ecr:s.boolean().optional(),secretsManager:s.boolean().optional(),kms:s.boolean().optional(),cloudwatchLogs:s.boolean().optional(),ssm:s.boolean().optional(),sts:s.boolean().optional()}).strict().describe("Interface VPC endpoints (cost per hour)"),Jz=He(Xz),Qz=s.object({gateway:Yz.optional(),interface:Jz.optional()}).strict().describe("VPC endpoints configuration"),f$=He(Qz),Vu=s.object({maxAzs:s.number().int(d.MAX_AZS.INTEGER).min(1,d.MAX_AZS.MIN).max(3,d.MAX_AZS.MAX).optional(),natGateways:m$.optional(),flowLogs:p$.optional(),vpcEndpoints:f$.optional(),cidrMask:s.number().int(d.CIDR_MASK.INTEGER).min(16,d.CIDR_MASK.MIN).max(28,d.CIDR_MASK.MAX).optional()}).strict(),g$=s.string().min(1,d.REQUIRED.NETWORK_NAME).max(50,d.MAX_LENGTH.NETWORK_NAME).regex(L.RESOURCE_NAME,d.RESOURCE_NAME),h$=Vu.extend({name:g$}).strict(),v$=He(Vu),z5=s.object({appName:ve,networkName:g$.optional(),maxAzs:s.number().int(d.MAX_AZS.INTEGER).min(1,d.MAX_AZS.MIN).max(3,d.MAX_AZS.MAX).optional(),natGateways:m$.optional(),flowLogs:p$.optional(),vpcEndpoints:f$.optional()}).strict(),eL=L.CIDR,wv=s.string().regex(eL,d.CIDR),tL=s.object({kind:s.literal("database"),resource:s.string().min(1,d.REQUIRED.RESOURCE_REFERENCE),name:V,allowedFromCidrs:s.array(wv),access:s.enum(["read","write","readWrite"]).optional()}).strict(),rL=s.object({kind:s.literal("ecsService"),resource:s.string().min(1,d.REQUIRED.RESOURCE_REFERENCE),serviceName:s.string().min(1,d.REQUIRED.SERVICE_NAME),name:V,allowedFromCidrs:s.array(wv),port:cn.optional()}).strict(),nL=s.discriminatedUnion("kind",[tL,rL]),L5=s.object({name:V,peerAppName:s.string().min(1,d.REQUIRED.APP_NAME),peerAccountId:s.string().regex(L.AWS_ACCOUNT_ID,d.AWS_ACCOUNT_ID),peerRegion:s.string().min(1,d.VPC_PEER.REGION_REQUIRED).optional(),peerVpcId:s.string().regex(L.VPC_ID,d.VPC_ID).optional(),peerVpcCidr:wv.optional(),peerRoleArn:s.string().regex(L.ROLE_ARN,d.ROLE_ARN).optional(),peerRouteTableIds:s.array(s.string().min(1,d.VPC_PEER.ROUTE_TABLE_ID_REQUIRED)).optional(),localVpcName:s.string().min(1,d.REQUIRED.NETWORK_NAME).optional(),enableDnsResolution:s.boolean().optional()}).strict(),U5=s.object({name:V,requesterAccountIds:s.array(s.string().regex(L.AWS_ACCOUNT_ID,d.AWS_ACCOUNT_ID)).min(1,d.VPC_PEER.MIN_REQUESTER_ACCOUNTS),localVpcName:s.string().min(1,d.REQUIRED.NETWORK_NAME).optional(),publishToSsm:s.boolean().optional(),exposedResources:s.array(nL).optional()}).strict();var Zu=["storage","cdn","compute"],iL=s.object({sid:s.string().optional(),effect:s.enum(["Allow","Deny"]),principals:s.array(s.string()),actions:s.array(s.string()),resources:s.array(s.string()).optional(),conditions:s.record(s.string(),s.record(s.string(),s.union([s.string(),s.array(s.string())]))).optional()}).strict(),b$=s.object({name:V,bucketName:s.string().optional(),publicReadAccess:s.boolean().optional(),websiteHosting:s.object({indexDocument:s.string(),errorDocument:s.string().optional()}).strict().optional(),backupVaultTier:s.enum(_t).optional(),versioned:s.boolean().optional(),encryption:s.enum(Ii).optional(),kmsKeyArn:s.string().optional(),cors:s.array(s.object({allowedOrigins:s.array(s.string()),allowedMethods:s.array(s.string()),allowedHeaders:s.array(s.string()).optional(),exposedHeaders:s.array(s.string()).optional(),maxAge:s.number().optional()}).strict()).optional(),deployment:s.object({source:s.string(),prune:s.boolean().optional(),cacheControl:s.object({maxAge:s.number().optional(),immutable:s.boolean().optional()}).strict().optional()}).strict().optional(),retain:s.boolean().optional(),resourcePolicyStatements:s.array(iL).optional(),stackPlacement:s.enum(Zu).optional(),variableName:s.string().optional(),extraProperties:s.array(Te).optional()}).strict().refine(e=>e.encryption!=="KMS"||!!e.kmsKeyArn,{message:d.KMS.KEY_REQUIRED}),W5=s.object({appName:ve,bucketName:qI,nameProvidedByFlag:s.boolean().optional(),storagePreset:s.enum(WI).optional(),publicReadAccess:s.boolean().optional(),websiteHosting:s.object({indexDocument:s.string(),errorDocument:s.string().optional()}).strict().optional(),backupVaultTier:s.enum(_t).optional(),versioned:s.boolean().optional(),encryption:s.enum(Ii).optional(),kmsKeyArn:s.string().optional(),cors:s.array(s.object({allowedOrigins:s.array(s.string()),allowedMethods:s.array(s.string()),allowedHeaders:s.array(s.string()).optional(),exposedHeaders:s.array(s.string()).optional(),maxAge:s.number().optional()}).strict()).optional(),connectionConfig:s.object({connectToCompute:s.array(s.string()).optional(),connectToServices:s.array(s.string()).optional()}).strict().optional()}).strict().refine(e=>e.encryption!=="KMS"||!!e.kmsKeyArn,{message:d.KMS.KEY_REQUIRED,path:["kmsKeyArn"]});var kv=s.enum(["DESTROY","RETAIN"]),y$=s.object({name:V,queueType:s.enum(["standard","fifo"]).default("standard"),visibilityTimeout:s.number().int(d.SQS.VISIBILITY_TIMEOUT.INTEGER).min(0,d.SQS.VISIBILITY_TIMEOUT.MIN).max(43200,d.SQS.VISIBILITY_TIMEOUT.MAX).optional(),retentionPeriod:s.number().int(d.SQS.RETENTION_PERIOD.INTEGER).min(60,d.SQS.RETENTION_PERIOD.MIN).max(1209600,d.SQS.RETENTION_PERIOD.MAX).optional(),contentBasedDeduplication:s.boolean().optional(),removalPolicy:kv.optional(),variableName:s.string().optional(),extraProperties:s.array(Te).optional()}).strict();var S$=s.object({type:s.literal("basic-auth"),username:s.string().min(1),password:s.string().min(1)}).strict(),_$=s.object({name:V,defaultOriginRef:s.string(),behaviours:s.array(s.object({pathPattern:s.string(),originRef:s.string(),cachePolicy:s.enum(["CACHING_OPTIMIZED","CACHING_DISABLED"]).optional()}).strict()).optional(),customDomain:s.string().optional(),certificateArn:s.string().optional(),accessGate:s.union([s.literal(!1),S$]).optional(),extraProperties:s.array(Te).optional()}).strict(),eH=s.object({appName:s.string(),name:V.optional(),defaultOriginRef:s.string(),behaviours:s.array(s.object({pathPattern:s.string(),originRef:s.string(),cachePolicy:s.enum(["CACHING_OPTIMIZED","CACHING_DISABLED"]).optional()}).strict()).optional(),customDomain:s.string().optional(),certificateArn:s.string().optional(),accessGate:s.union([s.literal(!1),S$]).optional(),nameProvidedByFlag:s.boolean().optional()}).strict();var oL=Object.defineProperty,Ov=(e,t)=>oL(e,"name",{value:t,configurable:!0}),aL=new Set(["t4g","c6g","c6gd","c6gn","c7g","c7gd","c7gn","r6g","r6gd","r7g","r7gd","m6g","m6gd","m7g","m7gd","a1","x2gd","im4gn","is4gen","i4g","hpc7g"]);function Ri(e){let t=e.split(".")[0]??"";return aL.has(t)?"ARM":"STANDARD"}Ov(Ri,"getArchitectureForInstanceType");function Gu(e,t){let n=Ri(e);return n!==t?{valid:!1,message:`Instance type '${e}' requires ${n} architecture, but '${t}' AMI was specified. Use a ${n==="ARM"?"Graviton instance (t4g, c6g, r6g, m6g, etc.)":"Intel/AMD instance (t3, c5, r5, m5, etc.)"} instead.`}:{valid:!0}}Ov(Gu,"validateArchitectureMatch");function E$(e,t){return Ri(e)===t}Ov(E$,"isArchitectureCompatible");var sL=Object.defineProperty,Wu=(e,t)=>sL(e,"name",{value:t,configurable:!0});var cL=1,uL=/^[A-Za-z0-9_.-]+$/,lL=s.object({id:s.string().min(1,"buildSecret id cannot be empty").regex(uL,"buildSecret id may contain only letters, digits, '_', '.', and '-' (no comma, '=', or whitespace, which would break the buildx --secret argv)"),ssm:s.string().min(1,"ssm parameter name cannot be empty").optional(),secretsManager:s.object({name:s.string().min(1,"secret name cannot be empty").optional(),arn:s.string().min(1,"secret arn cannot be empty").optional(),field:s.string().min(1,"secret field cannot be empty").optional()}).strict().refine(e=>e.name===void 0!=(e.arn===void 0),"secretsManager requires exactly one of name or arn").optional(),env:s.string().min(1,"env variable name cannot be empty").optional()}).strict().superRefine((e,t)=>{[e.ssm,e.secretsManager,e.env].filter(n=>n!==void 0).length!==1&&t.addIssue({code:s.ZodIssueCode.custom,message:"buildSecret requires exactly one source (ssm, secretsManager, or env)"})}),dL=s.union([s.string(),s.object({ssm:s.string().min(1,"ssm parameter name cannot be empty").optional(),secretsManager:s.object({name:s.string().min(1,"secret name cannot be empty").optional(),arn:s.string().min(1,"secret arn cannot be empty").optional(),field:s.string().min(1,"secret field cannot be empty").optional()}).strict().refine(e=>e.name===void 0!=(e.arn===void 0),"secretsManager requires exactly one of name or arn").optional(),env:s.string().min(1,"env variable name cannot be empty").optional(),acknowledgePublic:s.boolean().optional()}).strict().superRefine((e,t)=>{[e.ssm,e.secretsManager,e.env].filter(n=>n!==void 0).length!==1&&t.addIssue({code:s.ZodIssueCode.custom,message:"buildArg value requires exactly one source (ssm, secretsManager, or env)"})})]),Ot=s.object({path:s.string(),context:s.string().min(1,"context cannot be empty").optional(),target:s.string().min(1,"target cannot be empty").optional(),buildArgs:s.record(s.string(),dL).optional(),buildSecrets:s.array(lL).optional()}).strict(),oH=Ot.partial();function mL(e,t){if(t===void 0)return e;let n=t.context??e.context,i=t.target??e.target,r=t.buildArgs??e.buildArgs,o=t.buildSecrets??e.buildSecrets;return{path:t.path??e.path,...n!==void 0&&{context:n},...i!==void 0&&{target:i},...r!==void 0&&{buildArgs:r},...o!==void 0&&{buildSecrets:o}}}Wu(mL,"mergeDockerBuild");function Dv(e){return typeof e=="object"&&e!==null&&!Array.isArray(e)}Wu(Dv,"isRecord");function x$(e){if(!Dv(e)||typeof e.path!="string"||e.path.length===0)return;let t=typeof e.context=="string"&&e.context.length>0?e.context:void 0,n=typeof e.target=="string"&&e.target.length>0?e.target:void 0,i=Dv(e.buildArgs)&&Object.keys(e.buildArgs).length>0?e.buildArgs:void 0,r=Array.isArray(e.buildSecrets)&&e.buildSecrets.length>0?e.buildSecrets:void 0,o={path:e.path,...t!==void 0&&{context:t},...n!==void 0&&{target:n},...i!==void 0&&{buildArgs:i},...r!==void 0&&{buildSecrets:r}},a=Ot.safeParse(o);return a.success?a.data:void 0}Wu(x$,"normaliseDockerBuild");function pL(e){if(e===void 0)return;let t=x$(e);return t===void 0?void 0:JSON.stringify(t)}Wu(pL,"dockerBuildFingerprint");var fL=s.object({name:s.string(),clusterName:s.string().optional(),docker:Ot.optional(),containerPort:s.number().optional(),secrets:s.array(s.string()).optional(),ssmSecretsPath:s.string().optional(),importedSecretNames:s.array(s.string()).optional()}).strict(),gL=s.object({type:s.enum(kt),name:s.string(),source:s.string()}).strict(),hL=s.object({repositoryName:s.string()}).strict(),vL=s.object({name:s.string(),secrets:s.array(s.string()).optional(),ssmSecretsPath:s.string().optional(),importedSecretNames:s.array(s.string()).optional(),docker:Ot.optional(),imageKey:s.string().optional()}).strict(),bL=s.object({templateHash:s.string(),synthTimestamp:s.string()}).strict(),yL=s.object({constructPath:s.string().max(512),group:s.string().max(128),resourceType:s.string().max(256)}).strict(),aH=s.object({version:s.literal(cL),generatedAt:s.string(),appName:s.string(),services:s.array(fL),lambdas:s.array(vL),pattern:gL.optional(),ecr:hL.optional(),stacks:s.record(s.string(),bL),resourceMap:s.record(s.string(),yL).optional()}).strict();var SL=Object.defineProperty,_L=(e,t)=>SL(e,"name",{value:t,configurable:!0});function I$(e){return!(e.image!==void 0&&e.docker!==void 0)}_L(I$,"imageDockerMutexCheck");var $$=s.number().int(d.CAPACITY.MIN.INTEGER).min($v,d.GENERATOR_CAPACITY.MIN.MIN).max(Tv,d.GENERATOR_CAPACITY.MIN.MAX),T$=s.number().int(d.CAPACITY.MAX.INTEGER).min($v,d.GENERATOR_CAPACITY.MAX.MIN).max(Tv,d.GENERATOR_CAPACITY.MAX.MAX),Pi=s.number().int(d.LAMBDA.MEMORY.INTEGER).min(FI,d.LAMBDA.MEMORY.MIN).max(BI,d.LAMBDA.MEMORY.MAX).refine(e=>e===128||e%64===0,d.LAMBDA.MEMORY.MULTIPLE),R$=s.string().regex(L.LAMBDA_RUNTIME_IDENTIFIER,d.LAMBDA.RUNTIME),Mv=s.number().int(d.CPU.INTEGER).min(256,d.CPU.MIN).max(4096,d.CPU.MAX),qu=s.number().int(d.CAPACITY.DESIRED.INTEGER).min(0,d.CAPACITY.DESIRED.MIN).max(Ai,d.CAPACITY.DESIRED.MAX),ma=s.object({connectToDatabase:s.array(s.string()).optional()}).strict(),EL=s.object({minSize:s.number().int(d.CAPACITY.WARM_POOL.MIN_SIZE.INTEGER).min(0,d.CAPACITY.WARM_POOL.MIN_SIZE.MIN).max(VI,d.CAPACITY.WARM_POOL.MIN_SIZE.MAX).optional(),reuseOnScaleIn:s.boolean().optional()}).strict(),jv=s.object({instanceType:s.string().optional(),amiHardwareType:s.enum(Cu).optional(),minCapacity:s.number().int(d.CAPACITY.MIN.INTEGER).min(0,d.CAPACITY.MIN.MIN_0).max(Ai,d.CAPACITY.MIN.MAX).optional(),maxCapacity:s.number().int(d.CAPACITY.MAX.INTEGER).min(1,d.CAPACITY.MAX.MIN_1).max(Ai,d.CAPACITY.MAX.MAX).optional(),memoryLimitMiB:sa(128).optional(),warmPool:EL.optional(),extraProperties:s.array(Te).optional()}).strict().superRefine((e,t)=>{if(!e.instanceType||!e.amiHardwareType)return;let n=Gu(e.instanceType,e.amiHardwareType);n.valid||t.addIssue({code:"custom",message:n.message??d.ARCHITECTURE_MISMATCH,path:["instanceType"]})}).superRefine((e,t)=>{e.minCapacity===0&&!e.warmPool&&t.addIssue({code:"custom",message:d.CAPACITY.WARM_POOL_REQUIRED,path:["minCapacity"]}),e.warmPool?.minSize!==void 0&&e.maxCapacity!==void 0&&e.warmPool.minSize>e.maxCapacity&&t.addIssue({code:"custom",message:d.CAPACITY.WARM_POOL.MIN_SIZE_EXCEEDS_MAX_CAPACITY,path:["warmPool","minSize"]})}),xL=s.enum(na).describe(`Compute type must be one of: ${na.join(", ")}`),zv=s.enum(_i).describe(`ECS capacity provider must be one of: ${_i.join(", ")}`),Lv=s.string().refine(e=>ct(Nu,e),{message:d.INSTANCE_TYPE}),P$=s.object({sourceType:s.enum(["sqs","dynamodb","eventbridge"]),sourceRef:s.string().describe("Name of the source resource"),batchSize:s.number().int(d.BATCH_SIZE.INTEGER).min(1,d.BATCH_SIZE.MIN).max(1e4,d.BATCH_SIZE.MAX).optional(),startingPosition:s.enum(["TRIM_HORIZON","LATEST"]).optional(),maxBatchingWindow:s.number().int(d.BATCHING_WINDOW.INTEGER).min(0,d.BATCHING_WINDOW.MIN).max(300,d.BATCHING_WINDOW.MAX).optional(),reportBatchItemFailures:s.boolean().optional()}).strict(),AL=s.object({name:s.string().min(1,d.REQUIRED.CONTAINER_NAME).optional(),image:s.string().optional(),port:cn.optional(),environment:$i.optional(),secretsImport:YI.optional(),command:s.array(s.string()).optional(),entryPoint:s.array(s.string()).optional(),essential:s.boolean().optional(),healthCheck:s.object({command:s.array(s.string()),interval:s.number().int(d.HEALTH_CHECK.INTERVAL.INTEGER).min(5,d.HEALTH_CHECK.INTERVAL.MIN).max(300,d.HEALTH_CHECK.INTERVAL.MAX).optional(),timeout:s.number().int(d.HEALTH_CHECK.TIMEOUT.INTEGER).min(2,d.HEALTH_CHECK.TIMEOUT.MIN).max(60,d.HEALTH_CHECK.TIMEOUT.MAX).optional(),retries:s.number().int(d.HEALTH_CHECK.RETRIES.INTEGER).min(1,d.HEALTH_CHECK.RETRIES.MIN).max(10,d.HEALTH_CHECK.RETRIES.MAX).optional(),startPeriod:s.number().int(d.HEALTH_CHECK.START_PERIOD.INTEGER).min(0,d.HEALTH_CHECK.START_PERIOD.MIN).max(300,d.HEALTH_CHECK.START_PERIOD.MAX).optional()}).strict().optional(),ssmSecrets:s.array(s.string().regex(L.SECRET_NAME,d.SECRET_NAME)).optional(),extraProperties:s.array(Te).optional()}).strict(),C$=s.string().min(1,d.REQUIRED.SERVICE_NAME).max(255,d.MAX_LENGTH.SERVICE_NAME).regex(L.ECS_SERVICE_NAME,d.ECS_SERVICE_NAME),N$=s.object({domain:s.string().optional(),loadBalancer:s.union([s.literal(!1),s.enum(Ru)]).optional(),directAccess:s.boolean().optional(),extraProperties:s.array(Te).optional()}).strict().refine(e=>!(e.directAccess&&e.domain),{message:d.DIRECT_ACCESS.NO_DOMAIN,path:["directAccess"]}).refine(e=>!(e.directAccess&&typeof e.loadBalancer=="string"),{message:d.DIRECT_ACCESS.NO_LOAD_BALANCER}).describe("Cluster-level configuration"),Hu=s.object({path:s.string().optional(),host:s.string().optional(),priority:s.number().int(d.PRIORITY.INTEGER).min(1,d.PRIORITY.MIN).max(5e4,d.PRIORITY.MAX).optional(),healthCheckPath:s.string().optional()}).strict().describe("Path/host-based routing configuration"),IL=s.object({desiredCount:qu.optional(),minCapacity:s.number().int(d.CAPACITY.MIN.INTEGER).min(0,d.CAPACITY.MIN.MIN_0).max(Ai,d.CAPACITY.MIN.MAX).optional(),maxCapacity:s.number().int(d.CAPACITY.MAX.INTEGER).min(1,d.CAPACITY.MAX.MIN_1).max(Ai,d.CAPACITY.MAX.MAX).optional(),scalingType:s.enum(Pu).optional()}).strict().refine(sn.check,sn.params).describe("ECS service scaling configuration"),w$=s.object({name:C$,docker:Ot.optional(),needsDatabaseConnection:s.boolean().optional(),needsStorageConnection:s.boolean().optional(),needsMessagingConnection:s.boolean().optional(),image:s.string().optional(),containers:s.array(AL).optional(),routing:s.union([Hu,s.array(Hu).min(1)]).optional(),cpu:Mv.optional(),memoryLimitMiB:sa(512).optional(),desiredCount:qu.optional(),scaling:He(IL).optional(),capacityProvider:zv,ec2Config:jv.optional(),ssmSecretsPath:s.string().regex(L.SSM_PATH,d.SSM_PATH).optional(),extraProperties:s.array(Te).optional(),alarms:e$.optional()}).strict().superRefine((e,t)=>{I$(e)||t.addIssue({code:"custom",path:["docker"],message:d.IMAGE_DOCKER_MUTEX})}).describe("Configuration for a service in an ECS cluster"),k$=s.object({name:V,type:xL,needsConnection:s.boolean(),connectedDatabase:s.array(s.string()).optional(),connectedStorage:s.array(s.string()).optional(),connectedMessaging:s.array(s.string()).optional(),cluster:N$.optional(),services:s.array(w$).optional(),docker:Ot.partial().optional(),deployment:s.enum($u).optional(),codePath:s.string().optional(),timeout:s.number().int(d.LAMBDA.TIMEOUT.INTEGER).min(wu,d.LAMBDA.TIMEOUT.MIN).max(ku,d.LAMBDA.TIMEOUT.MAX).optional(),memory:Pi.optional(),handler:s.string().optional(),runtime:R$.optional(),environment:$i.optional(),secrets:$i.optional(),eventSources:s.array(P$).optional(),functionUrl:s.object({authType:s.enum(oa)}).strict().optional(),description:s.string().optional(),scheduleExpression:s.string().optional(),architecture:s.enum(Tu).optional(),ephemeralStorageSize:s.number().int(d.EPHEMERAL_STORAGE.INTEGER).min(512,d.EPHEMERAL_STORAGE.MIN).max(10240,d.EPHEMERAL_STORAGE.MAX).optional(),functionName:s.string().optional(),ssmSecrets:s.array(s.string()).optional(),ssmSecretsPath:s.string().optional(),alarms:r$.optional(),instanceType:Lv.optional(),enableSSH:s.boolean().optional(),keyName:s.string().optional(),userData:s.string().optional(),securityGroups:s.array(s.string()).optional(),variableName:s.string().optional(),extraProperties:s.array(Te).optional()}).strict().superRefine((e,t)=>{if(e.type==="ecs"&&e.services)for(let n=0;n<e.services.length;n++){let i=e.services[n];i?.ec2Config?.instanceType&&!i.ec2Config.amiHardwareType&&Ri(i.ec2Config.instanceType)!=="ARM"&&t.addIssue({code:"custom",message:`Service '${i.name??n}' uses instance type '${i.ec2Config.instanceType}' (x86), which requires Docker images built for linux/amd64. The default build targets linux/arm64 (Graviton). Use a Graviton instance type (t4g, c6g, r6g, m6g, etc.) or set amiHardwareType: "STANDARD" to acknowledge x86.`,path:["services",n,"ec2Config","instanceType"]})}e.type==="lambda"&&e.deployment==="container"&&e.architecture==="X86_64"&&t.addIssue({code:"custom",message:"Lambda architecture 'X86_64' requires Docker images built for linux/amd64, but the default build targets linux/arm64. Use 'ARM_64' for Graviton Lambdas (recommended) or ensure your build pipeline targets linux/amd64.",path:["architecture"]})}),gH=s.object({appName:ve,clusterName:V,containerPort:cn,nameProvidedByFlag:s.boolean().optional(),ecrRepository:s.string().optional(),capacityProvider:zv.optional(),useAppEcr:s.boolean().optional(),desiredCount:qu.optional(),cpu:Mv.optional(),memoryLimitMiB:sa(512).optional(),minCapacity:$$.optional(),maxCapacity:T$.optional(),ec2Config:jv.optional(),connectionConfig:ma.optional()}).strict().refine(sn.check,sn.params),hH=s.object({appName:ve,functionName:V,nameProvidedByFlag:s.boolean().optional(),lambdaType:s.enum(["basic","web","custom"]).optional(),ecrRepository:s.string().optional(),timeout:s.number().int(d.LAMBDA.TIMEOUT.INTEGER).min(wu,d.LAMBDA.TIMEOUT.MIN).max(ku,d.LAMBDA.TIMEOUT.MAX).optional(),memory:Pi.optional(),enableFunctionUrl:s.boolean().optional(),description:s.string().optional(),enableCors:s.boolean().optional(),corsOrigins:s.string().optional(),corsHeaders:s.string().optional(),corsMethods:s.array(s.enum(GI)).optional(),corsCredentials:s.boolean().optional(),connectionConfig:ma.optional()}).strict(),vH=s.object({appName:ve,instanceName:V,nameProvidedByFlag:s.boolean().optional(),instanceType:Lv.optional(),enableSSH:s.boolean().optional(),minCapacity:$$.optional(),maxCapacity:T$.optional(),connectionConfig:ma.optional()}).strict().refine(sn.check,sn.params),bH=s.object({appName:ve,clusterName:V,serviceName:C$,capacityProvider:zv,containerPort:cn.optional(),cpu:Mv.optional(),memoryLimitMiB:sa(512).optional(),desiredCount:qu.optional(),ec2Config:jv.optional(),routing:s.union([Hu,s.array(Hu).min(1)]).optional(),docker:Ot.partial().optional(),nameProvidedByFlag:s.boolean().optional(),connectionConfig:ma.optional()}).strict(),Uv=s.object({appName:ve,computeName:V,nameProvidedByFlag:s.boolean().optional(),connectionConfig:ma.optional()}).strict(),$L=Uv.extend({type:s.literal("ecs"),cluster:N$.optional(),services:s.array(w$).min(1,d.SERVICE.MIN_REQUIRED),docker:Ot.partial().optional()}).strict().refine(e=>{let t=e.services.filter(n=>n.containers?.some(i=>i.port));return t.length>1?t.every(n=>(Array.isArray(n.routing)?n.routing:n.routing?[n.routing]:[]).some(i=>i.path||i.host)):!0},{message:d.SERVICE.ROUTING_REQUIRED}).refine(e=>{let t=e.services.map(n=>n.name);return new Set(t).size===t.length},{message:d.SERVICE.UNIQUE_WITHIN_CLUSTER}),TL=Uv.extend({type:s.literal("lambda"),timeout:s.number().int(d.LAMBDA.TIMEOUT.INTEGER).min(wu,d.LAMBDA.TIMEOUT.MIN).max(ku,d.LAMBDA.TIMEOUT.MAX).optional(),memory:Pi.optional(),handler:s.string().optional(),runtime:R$.optional(),environment:$i.optional(),secrets:$i.optional(),description:s.string().optional(),functionUrl:s.union([s.object({authType:s.enum(oa).optional()}).strict(),s.literal(!1)]).optional(),eventSources:s.array(P$).optional()}).strict(),RL=Uv.extend({type:s.literal("ec2"),instanceType:Lv.optional(),enableSSH:s.boolean().optional(),keyName:s.string().optional(),userData:s.string().optional(),securityGroups:s.array(s.string()).optional()}).strict(),O$=s.discriminatedUnion("type",[$L,TL,RL]),A$=s.object({path:s.string().min(1,d.REQUIRED.ROUTING_PATH),priority:s.number().int(d.PRIORITY.INTEGER).min(1,d.PRIORITY.MIN).max(5e4,d.PRIORITY.MAX).optional()}).strict(),D$=s.object({name:s.string().min(1,d.REQUIRED.SERVICE_NAME).max(255,d.MAX_LENGTH.SERVICE_NAME).regex(L.RESOURCE_NAME,d.RESOURCE_NAME),serviceType:s.enum(["web","worker"]).optional(),docker:Ot.partial().optional(),containerPort:cn.optional(),needsDatabaseConnection:s.boolean().optional(),routing:s.union([A$,s.array(A$).min(1)]).optional()}).strict().superRefine((e,t)=>{e.serviceType==="worker"&&(e.containerPort!==void 0&&t.addIssue({code:"custom",path:["containerPort"],message:"Worker services are not reachable inbound; remove containerPort."}),e.routing!==void 0&&t.addIssue({code:"custom",path:["routing"],message:"Worker services have no ALB route; remove routing."}))}),yH=s.object({appName:ve,instanceType:s.string().optional()}).strict();var Fv=s.object({memorySize:Pi.optional(),timeout:s.number().int(d.LAMBDA.TIMEOUT.INTEGER).min(1,d.LAMBDA.TIMEOUT.MIN).max(900,d.LAMBDA.TIMEOUT.MAX).optional(),ephemeralStorageSize:s.number().int(d.EPHEMERAL_STORAGE.INTEGER).min(512,d.EPHEMERAL_STORAGE.MIN).max(10240,d.EPHEMERAL_STORAGE.MAX).optional()}).strict(),M$=s.object({type:s.enum(Iv).optional(),databaseName:s.string().optional(),databaseEngine:s.enum(xi).optional(),deletionProtection:s.boolean().optional(),backupRetention:Qt.optional(),port:Mu.optional(),publiclyAccessible:s.boolean().optional(),allowedIpCidr:s.string().optional(),instanceType:s.string().optional(),allocatedStorage:s.number().int(d.ALLOCATED_STORAGE.INTEGER).min(20,d.ALLOCATED_STORAGE.MIN).max(65536,d.ALLOCATED_STORAGE.MAX).optional(),multiAz:s.boolean().optional(),readReplica:Lu.optional(),writer:la.optional(),readers:da.optional(),allowVpcAccess:s.boolean().optional(),monitoringInterval:ua.optional(),preferredMaintenanceWindow:s.string().optional(),databaseInsights:Uu.optional(),proxy:zu.optional(),credentials:ju.optional(),encryption:Fu.optional(),snapshotIdentifier:s.string().optional(),snapshotUsername:s.string().optional()}).strict(),j$=s.object({server:Fv.optional(),imageOptimisation:Fv.optional(),revalidation:Fv.optional()}).strict(),Bv=s.object({versioned:s.boolean().optional()}).strict(),z$=s.object({assets:Bv.optional(),cache:Bv.optional(),media:Bv.optional()}).strict(),PL=s.object({visibilityTimeout:s.number().int(d.SQS.VISIBILITY_TIMEOUT.INTEGER).min(0,d.SQS.VISIBILITY_TIMEOUT.MIN).max(43200,d.SQS.VISIBILITY_TIMEOUT.MAX).optional(),messageRetentionPeriod:s.number().int(d.SQS.RETENTION_PERIOD.INTEGER).min(60,d.SQS.RETENTION_PERIOD.MIN).max(1209600,d.SQS.RETENTION_PERIOD.MAX).optional(),maxMessageSize:s.number().int(d.MAX_MESSAGE_SIZE.INTEGER).min(1024,d.MAX_MESSAGE_SIZE.MIN).max(262144,d.MAX_MESSAGE_SIZE.MAX).optional(),deadLetterQueue:s.union([s.literal(!1),s.object({enabled:s.boolean().optional(),maxReceiveCount:s.number().int(d.DLQ.MAX_RECEIVE_COUNT.INTEGER).min(1,d.DLQ.MAX_RECEIVE_COUNT.MIN).max(1e3,d.DLQ.MAX_RECEIVE_COUNT.MAX).optional()}).strict()]).optional()}).strict(),L$=s.object({revalidationQueue:PL.optional()}).strict(),U$=s.object({domainNames:s.array(s.string()).optional(),certificateArn:s.string().optional()}).strict(),F$=s.record(s.string().regex(L.ENV_VAR_NAME,d.ENV_VAR_NAME),s.string()).optional(),CL=s.object({type:s.literal("payload"),name:s.string().min(1,d.REQUIRED.PATTERN_NAME),domain:s.string().optional(),database:M$.optional(),compute:j$.optional(),storage:z$.optional(),messaging:L$.optional(),cdn:U$.optional(),environment:F$}).strict(),NL=s.object({type:s.literal("nextjs"),name:s.string().min(1,d.REQUIRED.PATTERN_NAME),domain:s.string().optional(),database:M$.optional(),compute:j$.optional(),storage:z$.optional(),messaging:L$.optional(),cdn:U$.optional(),environment:F$}).strict(),Vv=s.enum(Zo),wL=s.object({command:s.string().min(1,d.REQUIRED.BUILD_COMMAND),outputDir:s.string().min(1,d.REQUIRED.OUTPUT_DIR)}).strict(),kL=s.object({headers:s.boolean().optional(),contentSecurityPolicy:s.string().optional()}).strict(),OL=s.object({to:s.string().min(1,d.REQUIRED.FORMS_TO).regex(L.EMAIL,d.EMAIL),from:s.string().regex(L.EMAIL,d.EMAIL).optional(),corsOrigin:s.string().regex(L.HTTP_ORIGIN,"corsOrigin must be an exact origin such as https://example.com (no path, no trailing slash)").optional(),maxConcurrency:s.number().int().min(1).max(100).optional()}).strict(),DL=s.object({behaviours:s.array(s.unknown()).optional()}).strict(),Zv=s.object({type:s.literal("staticsite"),name:s.string().min(1,d.REQUIRED.PATTERN_NAME),source:s.string().min(1,d.REQUIRED.SOURCE),build:wL,routing:Vv.optional(),security:kL.optional(),domain:s.string().optional(),forms:OL.optional(),cdn:DL.optional()}).strict().superRefine((e,t)=>{if(e.forms===void 0)return;let n=e.domain;if(n===void 0||n===""){t.addIssue({code:"custom",path:["domain"],message:"A domain is required when forms are enabled: SES sends only from a verified identity, and the site's domain is the identity the pattern verifies"});return}let i=e.forms.from;i!==void 0&&!tu(i,n)&&t.addIssue({code:"custom",path:["forms","from"],message:`forms.from must be an address at ${n} (the verified SES identity) \u2014 for example noreply@${n}. Use forms.to for the recipient.`})}),pa=s.discriminatedUnion("type",[CL,NL,Zv]),B$=s.enum(["lightweight","standard","resilient","custom"]),V$=s.object({type:s.enum(Iv),instanceType:s.string().optional(),backupRetention:Qt.optional(),deletionProtection:s.boolean().optional(),encryption:s.union([s.object({useCMK:s.literal(!0)}).strict(),s.literal(!1)]).optional()}).strict(),Z$=s.object({memorySize:Pi.optional(),timeout:s.number().int(d.LAMBDA.TIMEOUT.INTEGER).min(1,d.LAMBDA.TIMEOUT.MIN).max(900,d.LAMBDA.TIMEOUT.MAX).optional()}).strict();var G$=s.object({appName:ve,type:Rv,pattern:Pv.optional(),patternConfig:pa.optional(),owner:s.string().optional(),tags:s.record(s.string(),s.string()).optional(),vpcId:s.string().optional(),network:Vu.optional(),backup:JI.optional(),tunnel:QI.optional(),additionalNetworks:s.array(h$).optional(),database:s.array(i$),s3:s.array(b$),compute:s.array(k$),dynamodb:s.array(l$).optional(),clickhouse:s.array(d$).optional(),sqs:s.array(y$).optional(),cdn:_$.optional(),customCodeBlocks:s.array(XI).optional(),additionalManagedImports:s.array(s.object({moduleSpecifier:s.string(),namedImports:s.array(s.string()),defaultImport:s.string().optional()}).strict()).optional()}).strict(),LH=s.object({name:ve,type:Rv,pattern:Pv.optional(),patternTier:B$.optional(),patternDomain:s.string().optional(),source:s.string().min(1,d.REQUIRED.SOURCE).optional(),buildCommand:s.string().min(1,d.REQUIRED.BUILD_COMMAND).optional(),outputDir:s.string().min(1,d.REQUIRED.OUTPUT_DIR).optional(),routing:Vv.optional(),formsTo:s.string().min(1,d.REQUIRED.FORMS_TO).regex(L.EMAIL,d.EMAIL).optional(),corsOrigin:s.string().regex(L.HTTP_ORIGIN,"corsOrigin must be an exact origin such as https://example.com (no path, no trailing slash)").optional(),customDatabase:V$.optional(),customCompute:Z$.optional(),region:s.string().optional(),owner:s.string().optional(),includeDatabase:s.boolean().optional(),databaseName:s.string().min(1,d.DATABASE.NAME.REQUIRED).max(63,d.DATABASE.NAME.MAX_LENGTH).optional(),vpcId:s.string().optional(),network:v$.optional(),services:s.array(D$).optional(),snapshotIdentifier:s.string().optional(),snapshotUsername:s.string().optional()}).strict().superRefine((e,t)=>{e.formsTo!==void 0&&(e.patternDomain!==void 0&&e.patternDomain!==""||t.addIssue({code:"custom",path:["patternDomain"],message:"A domain is required when forms are enabled: SES sends only from a verified identity, and the site's domain is the identity the pattern verifies"}))}),UH=s.object({name:V,localResource:s.string().min(1),remoteApp:s.string().min(1),remoteResource:s.string().min(1),permission:s.enum(["read","write","read-write"]),remoteArn:s.string().optional()}).strict();var ML=["fjall-managed","external","external-manual"],GH=s.enum(ML);var W$=s.object({givenName:s.string().min(1),familyName:s.string().min(1),displayName:s.string().min(1).optional(),expires:s.string().min(1).optional()}).strict(),H$=s.object({name:s.string().min(1),path:s.string().min(1).optional()}).strict(),jL=s.union([s.object({managedPolicyArn:s.string().min(1)}).strict(),s.object({customerManagedPolicy:H$}).strict()]),zL=s.object({managedPolicies:s.array(s.string().min(1)).optional(),inlinePolicy:s.record(s.string(),s.unknown()).optional(),customerManagedPolicies:s.array(H$).optional(),permissionsBoundary:jL.optional(),sessionDuration:s.string().min(1).optional(),description:s.string().optional(),accounts:s.union([s.array(s.string().min(1)),s.literal("all")]).optional(),includeManagementAccount:s.boolean().optional(),groups:s.array(s.string().min(1)).optional()}).strict(),LL=s.object({description:s.string().optional()}).strict(),Ku=s.string().regex(L.EMAIL,d.EMAIL),Gv={groups:s.record(s.string(),LL).optional(),permissionSets:s.record(s.string(),zL).optional(),memberships:s.record(s.string(),s.array(Ku)).optional(),resolutionVersion:s.number().int().min(1).optional(),defaultPermissionSets:s.boolean().optional()},UL=s.discriminatedUnion("source",[s.object({...Gv,source:s.literal("fjall-managed"),users:s.record(Ku,W$)}).strict(),s.object({...Gv,source:s.literal("external")}).strict(),s.object({...Gv,source:s.literal("external-manual"),users:s.record(Ku,W$).optional()}).strict()]),WH=s.object({name:V,type:s.literal("organisation").optional(),organisationName:s.string().min(1).optional(),orgEmail:Ku.optional(),accounts:s.unknown().optional(),accountIds:s.record(s.string(),s.string()).optional(),identityCentre:s.union([UL,s.literal(!1)]).optional(),allowedRegions:s.array(s.string().min(1)).optional()}).strict();var FL=Object.defineProperty,BL=(e,t)=>FL(e,"name",{value:t,configurable:!0}),VL=[1,3,5,7,14,30,60,90,120,150,180,365,400,545,731,1827,3653],ZL=s.object({buildkiteQueue:s.string().min(1,"buildkiteQueue cannot be empty").max(100).regex(/^[a-zA-Z0-9-_]+$/,"buildkiteQueue must be alphanumeric with hyphens/underscores"),buildkiteOrgSlug:s.string().min(1,"buildkiteOrgSlug cannot be empty").max(100).regex(/^[a-z0-9-]+$/,"buildkiteOrgSlug must be a lowercase Buildkite organisation slug"),agentTokenSsmParameterName:s.string().min(2).regex(/^\//,"agentTokenSsmParameterName must be a full path (leading /)").optional(),agentTokenKmsKeyArn:s.string().min(1).optional(),fjallApiKeySsmParameterName:s.string().min(2).regex(/^\//,"fjallApiKeySsmParameterName must be a full path (leading /)").optional(),instanceType:s.string().min(1).default("c8g.xlarge"),agentVolumeSizeGib:s.number().int().min(20).max(1e3).default(250),agentMinInstances:s.number().int().min(0).default(0),agentMaxInstances:s.number().int().min(1).default(2),agentsPerInstance:s.number().int().min(1).default(1),spotCapacityPercentage:s.number().int().min(0).max(100).default(0),scaleInIdlePeriodSeconds:s.number().int().min(60).default(600),disconnectAfterUptimeSeconds:s.number().int().min(3600).default(86400),maxInstanceLifetimeDays:s.number().int().min(1).max(365).default(7),terminateInstanceAfterJob:s.boolean().default(!1),purgeBuildsOnDiskFull:s.boolean().default(!0),terminateInstanceOnDiskFull:s.boolean().default(!1),logRetentionDays:s.number().int().min(1).default(30),agentLogRetentionDays:s.literal(VL).default(7),buildkiteAgentRelease:s.enum(["stable","beta","edge"]).default("stable"),buildkiteAgentTags:s.string().default(""),buildkiteAgentTimestampLines:s.boolean().default(!1),buildkiteAgentExperiments:s.string().default(""),buildkiteAgentTracingBackend:s.enum(["","datadog","opentelemetry"]).default(""),buildkiteAgentCancelGracePeriodSeconds:s.number().int().min(10).default(60),enableSecretsPlugin:s.boolean().default(!0),enableEcrPlugin:s.boolean().default(!1),enableDockerLoginPlugin:s.boolean().default(!1),enableDockerUserNamespaceRemap:s.boolean().default(!0),enableDockerExperimental:s.boolean().default(!1),dockerNetworkingProtocol:s.enum(["ipv4","dualstack"]).default("ipv4"),enableInstanceStorage:s.boolean().default(!1),mountTmpfsAtTmp:s.boolean().default(!0),buildkiteAgentEnableGitMirrors:s.boolean().default(!1),bootstrapScriptUrl:s.string().default(""),agentEnvFileUrl:s.string().default(""),scalerEventSchedulePeriod:s.string().min(1).default("1 minute"),scalerMinPollInterval:s.string().min(1).default("10s"),scaleOutFactor:s.string().min(1).default("1.0"),scaleOutWaitingForJobs:s.boolean().default(!1),rolePermissionsBoundaryArn:s.string().min(1).optional(),alarmSnsTopicArn:s.string().min(1).optional(),applicationId:s.string().min(1).optional(),costAllocationEnvironment:s.string().min(1).optional(),costAllocationOwner:s.string().min(1).optional()}).strict(),GL=ZL.refine(e=>e.agentMinInstances<=e.agentMaxInstances,{message:"agentMinInstances must be <= agentMaxInstances"});function WL(e){let t=GL.safeParse(e);if(!t.success){let n=t.error.issues.map(i=>`  - ${i.path.join(".")||"(root)"}: ${i.message}`).join(`
 `);throw new Error(`Buildkite: invalid props:
 ${n}`)}return t.data}BL(WL,"validateBuildkiteProps");var HL=Object.defineProperty,qL=(e,t)=>HL(e,"name",{value:t,configurable:!0});function KL(e){return`FjallDeployBoundary${e}`}qL(KL,"deployBoundaryName");var Wv={Sid:"FjallInheritAdministratorAccess",Effect:"Allow",Action:"*",Resource:"*"},q$=[{Sid:"FjallDenyOrgAndAccountEscape",Effect:"Deny",Action:["organizations:LeaveOrganization","account:CloseAccount"],Resource:"*"},{Sid:"FjallDenyDisableAuditLogging",Effect:"Deny",Action:["cloudtrail:StopLogging"],Resource:"*"},{Sid:"FjallDenyBoundarySelfEscape",Effect:"Deny",Action:["iam:DeleteRolePermissionsBoundary"],Resource:"*"},{Sid:"FjallDenyDisableKmsKey",Effect:"Deny",Action:["kms:DisableKey"],Resource:"*"}],K$=[...q$,{Sid:"FjallDenyStandingHumanCredentials",Effect:"Deny",Action:["iam:CreateUser","iam:CreateLoginProfile","iam:CreateAccessKey","iam:CreateAccountAlias"],Resource:"*"},{Sid:"FjallDenyDisableConfigRecorder",Effect:"Deny",Action:["config:StopConfigurationRecorder"],Resource:"*"}],YL=[...K$,{Sid:"FjallDenyAccountPasswordPolicyTamper",Effect:"Deny",Action:["iam:UpdateAccountPasswordPolicy","iam:DeleteAccountPasswordPolicy"],Resource:"*"},{Sid:"FjallDenyDisableDefaultEbsEncryption",Effect:"Deny",Action:["ec2:DisableEbsEncryptionByDefault"],Resource:"*"}],cq={foundation:[Wv,...q$],compliance:[Wv,...K$],hardened:[Wv,...YL]};var XL=Object.defineProperty,je=(e,t)=>XL(e,"name",{value:t,configurable:!0});var Hv="sts.amazonaws.com";function JL(e){return`FjallDevDeploy${e}`}je(JL,"devDeployRoleName");function QL(e){return`FjallDevProvisioner${e}`}je(QL,"devProvisionerRoleName");function eU(e){return`FjallDevSyncWriter${e}`}je(eU,"devSyncWriterRoleName");var tU="FjallDevBoundary";function Y$(e){return`arn:aws:iam::${e}:policy/${tU}`}je(Y$,"devBoundaryPolicyArn");function X$(e){return`org:${e}:dev-provisioner`}je(X$,"devProvisionerSubject");function J$(e){return`org:${e}:dev-sync`}je(J$,"devSyncSubject");function rU(e){let{fjallOrgId:t,providerArn:n,issuerDomain:i}=e,r={[`${i}:aud`]:Hv};return[{Sid:"FjallMachineSubject",Effect:"Allow",Principal:{Federated:n},Action:"sts:AssumeRoleWithWebIdentity",Condition:{StringEquals:{...r,[`${i}:sub`]:`org:${t}:*`}}},{Sid:"FjallUserSubjects",Effect:"Allow",Principal:{Federated:n},Action:"sts:AssumeRoleWithWebIdentity",Condition:{StringEquals:r,StringLike:{[`${i}:sub`]:`org:${t}:user:*`}}},{Sid:"FjallServiceSubjects",Effect:"Allow",Principal:{Federated:n},Action:"sts:AssumeRoleWithWebIdentity",Condition:{StringEquals:{...r,[`${i}:sub`]:[`org:${t}:discovery`,`org:${t}:connection`,`org:${t}:org-setup`,`org:${t}:dev-substrate-setup`]}}}]}je(rU,"buildNarrowedDeployTrustStatements");function nU(e){let{fjallOrgId:t,providerArn:n,issuerDomain:i,accountId:r}=e;return[{Sid:"FjallDevSubjectsThisAccount",Effect:"Allow",Principal:{Federated:n},Action:"sts:AssumeRoleWithWebIdentity",Condition:{StringEquals:{[`${i}:aud`]:Hv},StringLike:{[`${i}:sub`]:`org:${t}:dev:${r}:*`}}}]}je(nU,"buildDevDeployTrustStatements");function qv(e){let{providerArn:t,issuerDomain:n,sid:i,subject:r}=e;return[{Sid:i,Effect:"Allow",Principal:{Federated:t},Action:"sts:AssumeRoleWithWebIdentity",Condition:{StringEquals:{[`${n}:aud`]:Hv,[`${n}:sub`]:r}}}]}je(qv,"buildServiceSubjectTrustStatements");function iU(e){return qv({...e,sid:"FjallDevProvisionerSubject",subject:X$(e.fjallOrgId)})}je(iU,"buildDevProvisionerTrustStatements");function oU(e){return qv({...e,sid:"FjallDevSyncSubject",subject:J$(e.fjallOrgId)})}je(oU,"buildDevSyncWriterTrustStatements");function aU({accountId:e}){return[{Sid:"FjallDevEcsTaggedMutations",Effect:"Allow",Action:["ecs:UpdateService","ecs:DeleteService","ecs:RunTask","ecs:StopTask"],Resource:`arn:aws:ecs:*:${e}:*`,Condition:{StringEquals:{"aws:ResourceTag/fjall:dev":"true"}}},{Sid:"FjallDevEcsTaggedCreates",Effect:"Allow",Action:["ecs:RegisterTaskDefinition","ecs:CreateService"],Resource:"*",Condition:{StringEquals:{"aws:RequestTag/fjall:dev":"true"}}},{Sid:"FjallDevEcsTagOnCreate",Effect:"Allow",Action:["ecs:TagResource"],Resource:`arn:aws:ecs:*:${e}:*`,Condition:{StringEquals:{"ecs:CreateAction":["RegisterTaskDefinition","CreateService","RunTask"]}}},{Sid:"FjallDevEcsReads",Effect:"Allow",Action:["ecs:Describe*","ecs:List*"],Resource:"*"},{Sid:"FjallDevEcsDeregisterTaskDefinition",Effect:"Allow",Action:["ecs:DeregisterTaskDefinition"],Resource:`arn:aws:ecs:*:${e}:task-definition/fjall-dev-*`},{Sid:"FjallDevElbTaggedMutations",Effect:"Allow",Action:["elasticloadbalancing:ModifyRule","elasticloadbalancing:DeleteRule","elasticloadbalancing:ModifyTargetGroup","elasticloadbalancing:ModifyTargetGroupAttributes","elasticloadbalancing:DeleteTargetGroup","elasticloadbalancing:RegisterTargets","elasticloadbalancing:DeregisterTargets"],Resource:`arn:aws:elasticloadbalancing:*:${e}:*`,Condition:{StringEquals:{"aws:ResourceTag/fjall:dev":"true"}}},{Sid:"FjallDevElbTaggedCreates",Effect:"Allow",Action:["elasticloadbalancing:CreateTargetGroup","elasticloadbalancing:CreateRule"],Resource:`arn:aws:elasticloadbalancing:*:${e}:*`,Condition:{StringEquals:{"aws:RequestTag/fjall:dev":"true"}}},{Sid:"FjallDevElbTagOnCreate",Effect:"Allow",Action:["elasticloadbalancing:AddTags"],Resource:`arn:aws:elasticloadbalancing:*:${e}:*`,Condition:{StringEquals:{"elasticloadbalancing:CreateAction":["CreateTargetGroup","CreateRule"]}}},{Sid:"FjallDevElbReads",Effect:"Allow",Action:["elasticloadbalancing:Describe*"],Resource:"*"},{Sid:"FjallDevSsmDevTree",Effect:"Allow",Action:["ssm:GetParameter*","ssm:PutParameter","ssm:AddTagsToResource"],Resource:`arn:aws:ssm:*:${e}:parameter/fjall/dev/*`},{Sid:"FjallDevLogsMutations",Effect:"Allow",Action:["logs:PutRetentionPolicy","logs:DeleteLogGroup"],Resource:`arn:aws:logs:*:${e}:log-group:/fjall/dev/*`},{Sid:"FjallDevLogsTaggedCreate",Effect:"Allow",Action:["logs:CreateLogGroup","logs:TagResource"],Resource:`arn:aws:logs:*:${e}:log-group:/fjall/dev/*`,Condition:{StringEquals:{"aws:RequestTag/fjall:dev":"true"}}},{Sid:"FjallDevLogsRead",Effect:"Allow",Action:["logs:GetLogEvents","logs:DescribeLogStreams","logs:FilterLogEvents"],Resource:`arn:aws:logs:*:${e}:log-group:/fjall/dev/*`},{Sid:"FjallDevLogsDescribeGroups",Effect:"Allow",Action:["logs:DescribeLogGroups"],Resource:"*"},{Sid:"FjallDevKmsViaDevAlias",Effect:"Allow",Action:["kms:Encrypt","kms:Decrypt","kms:GenerateDataKey"],Resource:`arn:aws:kms:*:${e}:key/*`,Condition:{"ForAnyValue:StringLike":{"kms:ResourceAliases":"alias/fjall-dev-*"}}},{Sid:"FjallDevKmsSsmSecureString",Effect:"Allow",Action:["kms:Encrypt","kms:Decrypt","kms:GenerateDataKey"],Resource:`arn:aws:kms:*:${e}:key/*`,Condition:{StringLike:{"kms:ViaService":"ssm.*.amazonaws.com"}}},{Sid:"FjallDevEcrAuthToken",Effect:"Allow",Action:["ecr:GetAuthorizationToken"],Resource:"*"},{Sid:"FjallDevEcrPushPull",Effect:"Allow",Action:["ecr:PutImage","ecr:InitiateLayerUpload","ecr:UploadLayerPart","ecr:CompleteLayerUpload","ecr:BatchCheckLayerAvailability","ecr:BatchGetImage","ecr:GetDownloadUrlForLayer","ecr:DescribeImages"],Resource:`arn:aws:ecr:*:${e}:repository/*`},{Sid:"FjallDevPassDevPathRoles",Effect:"Allow",Action:["iam:PassRole"],Resource:`arn:aws:iam::${e}:role/fjall/dev/*`}]}je(aU,"buildDevDeployPolicyStatements");function sU({accountId:e}){return[{Sid:"FjallDevProvisionerBoundedRoleWrites",Effect:"Allow",Action:["iam:CreateRole","iam:PutRolePolicy","iam:AttachRolePolicy"],Resource:`arn:aws:iam::${e}:role/fjall/dev/*`,Condition:{StringEquals:{"iam:PermissionsBoundary":Y$(e)}}},{Sid:"FjallDevProvisionerPathRoleOps",Effect:"Allow",Action:["iam:DeleteRole","iam:DeleteRolePolicy","iam:DetachRolePolicy","iam:ListRolePolicies","iam:TagRole"],Resource:`arn:aws:iam::${e}:role/fjall/dev/*`},{Sid:"FjallDevProvisionerListRoles",Effect:"Allow",Action:["iam:ListRoles"],Resource:"*"},{Sid:"FjallDevProvisionerDevMasterSecrets",Effect:"Allow",Action:["secretsmanager:GetSecretValue"],Resource:`arn:aws:secretsmanager:*:${e}:secret:fjall-dev-*`},{Sid:"FjallDevProvisionerKmsDecryptViaSecretsManager",Effect:"Allow",Action:["kms:Decrypt"],Resource:`arn:aws:kms:*:${e}:key/*`,Condition:{StringLike:{"kms:ViaService":"secretsmanager.*.amazonaws.com"}}},{Sid:"FjallDevProvisionerDataApi",Effect:"Allow",Action:["rds-data:ExecuteStatement","rds-data:BatchExecuteStatement","rds-data:BeginTransaction","rds-data:CommitTransaction","rds-data:RollbackTransaction"],Resource:`arn:aws:rds:*:${e}:cluster:fjall-dev-*`},{Sid:"FjallDevProvisionerMetrics",Effect:"Allow",Action:["cloudwatch:GetMetricData"],Resource:"*"},{Sid:"FjallDevProvisionerOrphanDiscovery",Effect:"Allow",Action:["tag:GetResources"],Resource:"*"},{Sid:"FjallDevProvisionerSsmTeardown",Effect:"Allow",Action:["ssm:DeleteParameter*"],Resource:`arn:aws:ssm:*:${e}:parameter/fjall/dev/*`},{Sid:"FjallDevProvisionerLogsTeardown",Effect:"Allow",Action:["logs:DeleteLogGroup"],Resource:`arn:aws:logs:*:${e}:log-group:/fjall/dev/*`},{Sid:"FjallDevProvisionerTaggedTeardown",Effect:"Allow",Action:["ecs:UpdateService","ecs:StopTask","ecs:DeleteService","elasticloadbalancing:DeleteRule","elasticloadbalancing:DeleteTargetGroup","elasticloadbalancing:DeregisterTargets"],Resource:[`arn:aws:ecs:*:${e}:*`,`arn:aws:elasticloadbalancing:*:${e}:*`],Condition:{StringEquals:{"aws:ResourceTag/fjall:dev":"true"}}},{Sid:"FjallDevProvisionerTeardownReads",Effect:"Allow",Action:["ecs:Describe*","elasticloadbalancing:Describe*"],Resource:"*"},{Sid:"FjallDevProvisionerImageJanitor",Effect:"Allow",Action:["ecr:ListImages","ecr:DescribeImages","ecr:BatchDeleteImage"],Resource:`arn:aws:ecr:*:${e}:repository/*`},{Sid:"FjallDevProvisionerSsmReadAll",Effect:"Allow",Action:["ssm:GetParameter*"],Resource:`arn:aws:ssm:*:${e}:parameter/*`},{Sid:"FjallDevProvisionerKmsDecryptViaSsm",Effect:"Allow",Action:["kms:Decrypt"],Resource:`arn:aws:kms:*:${e}:key/*`,Condition:{StringLike:{"kms:ViaService":"ssm.*.amazonaws.com"}}}]}je(sU,"buildDevProvisionerPolicyStatements");function cU({accountId:e}){return[{Sid:"FjallDevSyncPrefixReadWrite",Effect:"Allow",Action:["s3:GetObject","s3:PutObject"],Resource:`arn:aws:s3:::fjall-dev-sync-${e}-*/*`,Condition:{StringEquals:{"aws:ResourceAccount":e}}}]}je(cU,"buildDevSyncWriterPolicyStatements");function uU({accountId:e}){return[{Sid:"FjallDevBoundarySsmDevRead",Effect:"Allow",Action:["ssm:GetParameter*"],Resource:`arn:aws:ssm:*:${e}:parameter/fjall/dev/*`},{Sid:"FjallDevBoundaryKmsDecryptDevAlias",Effect:"Allow",Action:["kms:Decrypt"],Resource:`arn:aws:kms:*:${e}:key/*`,Condition:{"ForAnyValue:StringLike":{"kms:ResourceAliases":"alias/fjall-dev-*"}}},{Sid:"FjallDevBoundarySyncPrefixReadWrite",Effect:"Allow",Action:["s3:GetObject","s3:PutObject"],Resource:`arn:aws:s3:::fjall-dev-sync-${e}-*/*`,Condition:{StringEquals:{"aws:ResourceAccount":e}}},{Sid:"FjallDevBoundarySlotLogs",Effect:"Allow",Action:["logs:CreateLogStream","logs:PutLogEvents"],Resource:`arn:aws:logs:*:${e}:log-group:/fjall/dev/*`},{Sid:"FjallDevBoundarySyncQueue",Effect:"Allow",Action:["sqs:ReceiveMessage","sqs:DeleteMessage","sqs:GetQueueUrl"],Resource:`arn:aws:sqs:*:${e}:fjall-dev-sync-${e}-*`}]}je(uU,"buildDevBoundaryStatements");var lU=Object.defineProperty,Et=(e,t)=>lU(e,"name",{value:t,configurable:!0});function T(e){return JSON.stringify(e)}Et(T,"escapeStringLiteral");function un(e){return e.map(T).join(", ")}Et(un,"formatStringArray");var dU="import:SharedAlarmTopicArn";function ln(e="    "){return`