fjall 39.0.3 → 39.0.4

package/bin/assets/generators/application/generator.js

@@ -296,7 +296,7 @@ ${B0}
 `)}
 `}Bi(LM,"renderUpdateEnvelope");var ih,ah=!1;function dX(e){ih=e,ah=!1}Bi(dX,"armUpdateEnvelope");function pX(){ih=void 0,ah=!1}Bi(pX,"disarmUpdateEnvelope");function jM(){if(!(ah||ih===void 0)){ah=!0;try{return ih()}catch(e){Rs.debug("UpdateEnvelope","Envelope source failed",{error:K(e instanceof Error?e.message:String(e))});return}}}Bi(jM,"takeUpdateEnvelope");function ks(){let e=jM();return e===void 0?"":LM(e)}Bi(ks,"takeUpdateEnvelopeTail");var mX=Object.defineProperty,Pa=(e,t)=>mX(e,"name",{value:t,configurable:!0}),N={success:Pa(e=>e.outcome==="success","success"),error:Pa(e=>e.outcome==="error","error"),empty:Pa(e=>e.outcome==="empty","empty"),unsupported:Pa(e=>e.outcome==="unsupported","unsupported"),successDryRun:Pa(e=>e.outcome==="success"&&e.dryRun==="true","successDryRun"),successOffline:Pa(e=>e.outcome==="success"&&e.offline==="true","successOffline"),errorWithCode:Pa(e=>t=>t.outcome==="error"&&t.errorCode===e,"errorWithCode")};var fX=Object.defineProperty,hX=(e,t)=>fX(e,"name",{value:t,configurable:!0}),gX=["account deploy","add","agent install-skill","agent session-context","apps create","apps deregister","apps describe","apps detect","apps list","assets compliance","assets list","assets show","assets summary","aws exec","build","ci run","ci setup","ci status","ci token list","ci token revoke","ci verify","compliance fix","compliance fix --execute","connect","connect status","costs show","create account","create app","create domain","create org","deploy","deploy diff","deploy logs","deployments cancel","deployments force-release","deployments list","destroy","dev down","dev list","dev substrate down","dev up","domain","domain create","domain delegate","domain deploy","domain destroy","domain eject","domain export","domain import","domain list","domain records list","domain sync","domain verify","drift detect","drift repair","drift resume","fjall","history","home","import","list","login","metrics show","migrate identity","modify","org bind","org deploy","org get","org identity setup-google","platform deploy","remove","restore","secrets delete","secrets exec","secrets export","secrets get","secrets import","secrets list","secrets set","services","status","target get","target list","target set","token create","token list","token revoke","token show","tunnel","tunnel status","tunnel stop","undo","unlock bucket","user add","user list","user rebind","user remove","validate"],yX=new Set(gX);function oh(e){return typeof e=="string"&&yX.has(e)}hX(oh,"isAgentWriterSurface");var ol="fjall";var vX=Object.defineProperty,SX=(e,t)=>vX(e,"name",{value:t,configurable:!0}),FM=[{command:ol,match:N.error,templates:["Run `fjall --help` to list the available commands"]},{command:"home",match:N.success,templates:["Run `fjall apps describe <name>` to see app details","Run `fjall deploy <name>` to deploy","Run `fjall status <name>` to check a specific app"]},{command:"home",match:N.empty,templates:[`Run \`${ne.createApplicationAgent} --name "<name>"\` to create your first app`,`Run \`${ne.connect}\` to connect an AWS account`]},{command:"apps list",match:N.success,templates:["Run `fjall apps describe <name>` to see app details","Run `fjall deploy <name>` to deploy",`Run \`${ne.createApplicationAgent} --name "<name>"\` to create a new app`]},{command:"apps list",match:N.empty,templates:[`Run \`${ne.createApplicationAgent} --name "<name>"\` to create your first app`,`Run \`${ne.connect}\` to connect an AWS account first`]},{command:"apps describe",match:N.success,templates:["Run `fjall deploy <app>` to deploy","Run `fjall secrets list --app <app>` to list secrets","Run `fjall status <app>` to check health"]},{command:"apps detect",match:N.empty,templates:["Run `fjall apps detect <path> --agent` against the directory holding the application, if this was the repository root","Pass `--pattern staticsite` with `--source`, `--build-command` and `--output-dir` explicitly if the app has no recognised framework dependency"]},{command:"apps detect",match:N.success,templates:[`Run \`${ne.createApplicationAgent} --name <name> --pattern <pattern>\` using the \`pattern\` column \u2014 never the \`framework\` column`,"Skip any row whose `role` is `library` \u2014 those are not deployable applications","Confirm `outputDir` exists after building: it is a framework convention, not a verified path"]},{command:"apps create",match:N.successOffline,templates:["Run `npm install` in the app directory \u2014 `--offline` skipped it",`Re-run \`${ne.createApplicationAgent}\` without \`--offline\` once you have credentials, to register the app`,"Run `fjall deploy <app>` only after both of the above"]},{command:"apps create",match:N.success,templates:["Run `fjall deploy <app>` to deploy your new app","Run `fjall secrets set --app <app> DB_URL=<url>` to configure secrets"]},{command:"apps deregister",match:N.success,templates:["Check the AWS console for any stack the application still has \u2014 de-registering removed the Fjall record only, and the CLI can no longer address it by name","Run `fjall apps list --agent` to confirm the application count against your plan limit"]},{command:"status",match:N.success,templates:["Run `fjall deploy <app>` to deploy","Run `fjall apps describe <app>` for details"]},{command:"deploy",match:N.success,templates:["Run `fjall status <app>` to check health","Run `fjall apps describe <app>` for full details"]},{command:"deploy",match:N.error,templates:["Run `fjall deploy <app>` to retry","Run `fjall status <app>` to check current state"]},{command:"destroy",match:N.success,templates:["Run `fjall list` to see remaining resources","Run `fjall apps list` to see remaining apps"]},{command:"destroy",match:N.error,templates:["Run `fjall destroy <app> --skip-confirmation` to force destroy","Run `fjall status <app>` to check current state"]},{command:"build",match:N.success,templates:["Run `fjall deploy <app> --image-tag <tag>` with a tag from `artefacts` to roll out this build","Run `fjall status <app>` to check health"]},{command:"connect",match:SX(e=>e.outcome==="success"&&e.pending==="true","match"),templates:["Run `fjall connect status --external-id <externalId> --wait` to block until the stack completes"]},{command:"connect",match:N.success,templates:[`Run \`${ne.accountDeploy}\` or \`${ne.organisationDeploy}\` to deploy infrastructure`,`Run \`${ne.createApplicationAgent} --name "<name>"\` to create an app`]},{command:"connect status",match:N.success,templates:["Run `fjall connect status --external-id <id> --wait` to block until a pending stack completes",`Run \`${ne.accountDeploy}\` or \`${ne.organisationDeploy}\` to deploy infrastructure`]},{command:"connect status",match:N.empty,templates:[`Run \`${ne.connect}\` to connect an AWS account`]},{command:"login",match:N.success,templates:["Run `fjall apps list` to see your applications",`Run \`${ne.connect}\` to connect an AWS account`]},{command:"list",match:N.success,templates:["Run `fjall apps describe <name>` for app details","Run `fjall deploy <name>` to deploy"]},{command:"add",match:N.success,templates:["Run `fjall deploy <app>` to deploy the change","Run `fjall apps describe <app>` to see updated resources"]},{command:"modify",match:N.success,templates:["Run `fjall validate --deep --app <app>` to typecheck the edited infrastructure.ts","Run `fjall deploy <app>` to deploy the change","Run `fjall undo --app <app>` to restore the .bak sidecar if the edit was wrong"]},{command:"remove",match:N.success,templates:["Run `fjall validate --deep --app <app>` to confirm nothing still references the removed resource","Run `fjall deploy <app>` to deploy the change","Run `fjall undo --app <app>` to restore the .bak sidecar if the removal was wrong"]},{command:"validate",match:N.success,templates:["Run `fjall deploy <app>` to deploy the validated infrastructure"]},{command:"validate",match:N.error,templates:["Run `fjall undo --app <app>` to restore the most recent .bak sidecar","Run `fjall history --app <app>` to list older snapshots to restore from"]},{command:"undo",match:N.success,templates:["Run `fjall validate --deep --app <app>` to confirm the restored infrastructure.ts typechecks","Run `fjall history --app <app>` to restore an older snapshot instead"]},{command:"history",match:N.success,templates:["Run `fjall history --restore <timestamp> --app <app>` to restore a specific snapshot","Run `fjall undo --app <app>` to restore the most recent .bak sidecar instead"]},{command:"history",match:N.empty,templates:["No snapshots yet \u2014 `fjall add`, `fjall modify` and `fjall remove` each write one before editing infrastructure.ts"]},{command:"tunnel",match:N.success,templates:["Run `fjall tunnel status` to list detached tunnels","Run `fjall tunnel stop <name>` to close this tunnel"]},{command:"tunnel status",match:N.success,templates:["Run `fjall tunnel stop <name>` to close a tunnel"]},{command:"tunnel status",match:N.empty,templates:["Run `fjall tunnel <app> --background` to open a detached tunnel"]},{command:"tunnel stop",match:N.success,templates:["Run `fjall tunnel status` to list the tunnels still running"]}];var UM=[{command:"secrets list",match:N.success,templates:["Run `fjall secrets set --app <app> KEY=VALUE` to set a secret","Run `fjall rollout <app>` to restart running services with the latest values"]},{command:"secrets list",match:N.empty,templates:["Run `fjall secrets set --app <app> KEY=VALUE` to add a secret","Run `fjall secrets import --app <app> <file>` to bulk import"]},{command:"secrets get",match:N.success,templates:["Run `fjall secrets set --app <app> KEY=VALUE` to update","Run `fjall secrets list --app <app>` to see all secrets"]},{command:"secrets set",match:N.success,templates:["Run `fjall rollout <app>` to restart running services with the new value","New key? Run a full `fjall deploy <app>` so the task definition gains the reference","Run `fjall secrets list --app <app>` to verify"]},{command:"secrets delete",match:N.success,templates:["Declared for a service? Re-run with `--remove-declaration` (or edit infrastructure.ts ssmSecrets), then `fjall deploy <app>` \u2014 a stale declaration breaks task launches","Not declared anywhere? Run `fjall rollout <app>` so running services drop the previous value","Run `fjall secrets list --app <app>` to verify"]},{command:"secrets import",match:N.success,templates:["Run `fjall rollout <app>` to restart running services with the imported values","New keys? Run a full `fjall deploy <app>` so task definitions gain the references","Run `fjall secrets list --app <app>` to verify"]},{command:"secrets export",match:N.success,templates:["Run `fjall secrets list --app <app>` to see all secret names","Run `fjall secrets import --app <app> <file>` to restore"]},{command:"secrets exec",match:N.success,templates:["Run `fjall secrets list --app <app>` to see available secrets"]}];var bX=Object.defineProperty,EX=(e,t)=>bX(e,"name",{value:t,configurable:!0});var BM="identity-only organisation deploys typically take 2-5 minutes",rx=`Run \`${ne.organisationDeploy}\` to apply the change (${BM}).`,qme=`Deploy the organisation now to apply this change? (${BM})`,_X="Groups have no members",ws="fjall user add <email> --group <group>",AX=ws,Qme=`${_X} \u2014 run \`${AX}\` to declare access.`;function xX(e,t){return`Declared identity (source "${e}"): ${String(t)} user${t===1?"":"s"}`}EX(xX,"formatUserListHeading");var efe=`No users or memberships declared. Run \`${ws}\` to add one.`;var zM=[{command:"user list",match:N.success,templates:[`Run \`${ws}\` to grant access`,`Run \`${ne.organisationDeploy}\` to apply declared changes`]},{command:"user list",match:N.empty,templates:[`Run \`${ws}\` to declare the first membership`]},{command:"user add",match:N.success,templates:[rx,"Run `fjall user list` to review the declared users"]},{command:"user remove",match:N.success,templates:[rx,"Run `fjall user list` to see the remaining users"]},{command:"user rebind",match:N.success,templates:[`Run \`${ne.organisationDeploy}\` to re-resolve external users against the identity store`]},{command:"org identity setup-google",match:N.success,templates:[`Run \`${ws} --live\` to declare access for a synced user`,"Run `fjall user list --live` to compare declared memberships against the identity store"]},{command:"token create",match:N.success,templates:["Run `fjall token list` to see all tokens","Save the token now \u2014 it cannot be retrieved again"]},{command:"token list",match:N.success,templates:["Run `fjall token create --name <name> --scope <scope> --expires <duration>` to create a token","Run `fjall token revoke <id>` to revoke a token"]},{command:"token show",match:N.success,templates:["Run `fjall token revoke <id>` to revoke this token","Run `fjall token list` to see all tokens"]},{command:"token revoke",match:N.success,templates:["Run `fjall token list` to see remaining tokens"]},{command:"target list",match:N.success,templates:["Run `fjall target set <name>` to change active target","Run `fjall deploy <app>` to deploy to the active target","Run `fjall apps list` to see applications"]},{command:"target list",match:N.empty,templates:[`Run \`${ne.connect}\` to connect an AWS account`,`Run \`${ne.login}\` to authenticate if not logged in`]},{command:"org bind",match:N.success,templates:["Run `fjall org get` to confirm the organisation's regions and accounts","Commit fjall-config.json so every checkout of this project carries the binding"]},{command:"org get",match:N.success,templates:["Run `fjall target list` to see which account/region pairs are deployable","Run `fjall accounts list` to see application-hosting accounts only"]},{command:"target get",match:N.success,templates:["Run `fjall target set <name>` to change active target","Run `fjall target list` to see all targets"]},{command:"target get",match:N.empty,templates:["Run `fjall target set <name>` to set a target","Run `fjall target list` to see available targets"]},{command:"target set",match:N.success,templates:["Run `fjall deploy <app>` to deploy to this target","Run `fjall target get` to verify the active target"]},{command:"target set",match:N.errorWithCode("NOT_FOUND"),templates:["Run `fjall target list` to see available targets",`Run \`${ne.connect}\` to connect an AWS account if none available`]}];import{platform as WX,arch as HX}from"os";import*as je from"fs";import*as jt from"path";var TX=Object.defineProperty,sh=(e,t)=>TX(e,"name",{value:t,configurable:!0});function GM(e){return e.success===!0}sh(GM,"isSuccess");function VM(e){return e.success===!1}sh(VM,"isFailure");function ge(e){return{success:!0,data:e}}sh(ge,"success");function U(e){return{success:!1,error:e}}sh(U,"failure");var CX=Object.defineProperty,ch=(e,t)=>CX(e,"name",{value:t,configurable:!0}),IX=ch(e=>{try{return JSON.stringify(e)}catch{return"[unserializable]"}},"safeStringify"),KM=ch((e,t,r,i)=>{let n=new Date().toISOString(),a=e.toUpperCase(),o=i?` ${IX(i)}`:"";process.stderr.write(`[${n}] [${a}] [${t}] ${r}${o}
 `)},"defaultWriter"),Oa=KM;function DX(e){Oa=e}ch(DX,"configureLogWriter");function NX(){Oa=KM}ch(NX,"resetLogWriter");var $a={info(e,t,r){Oa("info",e,t,r)},warn(e,t,r){Oa("warn",e,t,r)},error(e,t,r){Oa("error",e,t,r)},debug(e,t,r){process.env.FJALL_DEBUG==="true"&&Oa("debug",e,t,r)},trace(e,t,r){process.env.FJALL_TRACE==="true"&&Oa("trace",e,t,r)},isDebugEnabled(){return process.env.FJALL_DEBUG==="true"}};var kX=Object.defineProperty,nx=(e,t)=>kX(e,"name",{value:t,configurable:!0}),ix=c.object({name:c.string(),type:c.enum(["apex","delegated"]),parentDomain:c.string().optional(),account:c.string().optional(),region:c.string().optional()}).strict(),ax=c.object({id:c.string().min(1),name:c.string().min(1).optional()}).strict(),uh=c.object({activeTarget:c.string().optional(),domains:c.array(ix).optional(),capacityIdentity:Sf.optional(),organisation:ax.optional()}).strict(),sl=c.object({activeTarget:c.string().optional(),domains:c.array(ix).optional(),capacityIdentity:Sf.optional(),organisation:ax.optional()});function Ma(e={}){return JSON.stringify(e,null,2)}nx(Ma,"serialiseRootConfig");var lh=uh.keyof().options;function ox(e,t,r){let i=t[r];i!==void 0&&(e[r]=i)}nx(ox,"copyDefinedKey");function dh(e,t){if(t===void 0)return!1;let r=new Set([...Object.keys(e),...Object.keys(t)]);for(let i of r)if(e[i]!==t[i])return!1;return!0}nx(dh,"domainEntriesEqual");var RX=Object.defineProperty,Ps=(e,t)=>RX(e,"name",{value:t,configurable:!0});function cl(e){if(e===void 0||e==="")return{kind:"absent"};let t;try{t=JSON.parse(e)}catch(a){return{kind:"unmergeable",reason:`the existing file could not be read or parsed as JSON (${K(We(a))})`}}if(typeof t!="object"||t===null||Array.isArray(t))return{kind:"unmergeable",reason:"it does not contain a JSON object"};let r=sl.safeParse(t);if(!r.success){let a=r.error.issues.map(o=>`${o.path.join(".")}: ${o.message}`).join("; ");return{kind:"unmergeable",reason:`a recognised key in the existing file is malformed (${K(a)})`}}let i={},n=lh;for(let[a,o]of Object.entries(t))n.includes(a)||(i[a]=o);return{kind:"ok",disk:{known:r.data,foreign:i}}}Ps(cl,"readRootConfigForMerge");function WM(e,t,r){return JSON.stringify(e[r])!==JSON.stringify(t[r])}Ps(WM,"sessionChangedKey");function HM(e,t,r){let i=t.domains,n=r.domains??[];if(i===void 0&&n.length===0)return e;let a=Ps(g=>g.toLowerCase(),"norm"),o=i??[],s=new Map(n.map(g=>[a(g.name),g])),u=new Map(o.map(g=>[a(g.name),g])),p=[],d=new Set;for(let g of e??[]){let h=a(g.name);d.add(h);let l=u.get(h),m=s.get(h);if(l!==void 0&&!dh(l,m)){p.push(l);continue}l===void 0&&m!==void 0||p.push(g)}for(let g of o){let h=a(g.name);d.has(h)||dh(g,s.get(h))||p.push(g)}return p}Ps(HM,"mergeDomains");function ul(e,t,r){let i={...e.foreign,...e.known};for(let a of lh)a!=="domains"&&WM(t,r,a)&&(t[a]===void 0?delete i[a]:ox(i,t,a));let n=HM(e.known.domains,t,r);return n!==void 0?i.domains=n:delete i.domains,i}Ps(ul,"mergeRootConfig");function ZM(e,t,r={}){let i=cl(e);return i.kind==="unmergeable"?{kind:"unmergeable",reason:i.reason}:i.kind==="absent"?{kind:"ok",content:Ma(t)}:{kind:"ok",content:Ma(ul(i.disk,t,r))}}Ps(ZM,"mergeRootConfigContent");var wX=Object.defineProperty,PX=(e,t)=>wX(e,"name",{value:t,configurable:!0}),OX=10;var $X=c.object({activeTarget:c.string().optional()}),ph=class e{static{PX(this,"Config")}rootConfig;configPath=null;loadFailed=!1;parseDegraded=!1;loadedSnapshot={};searchStartDir;constructor(t,r){this.rootConfig=t??{},this.configPath=r??null}static findConfigDirectory(t){let r=t!==void 0&&t!==""?t:process.cwd();for(let i=0;i<OX;i++){let n=jt.join(r,"fjall"),a=jt.join(n,qn);if(je.existsSync(a))return n;let o=jt.join(r,qn);if(je.existsSync(o))return r;let s=jt.dirname(r);if(s===r)break;r=s}return null}static loadConfigFile(t){try{return je.accessSync(t,je.constants.R_OK),je.readFileSync(t,{encoding:"utf8"})}catch(r){return $a.warn("Config",`Config file at ${t} could not be read; using defaults`,{file:t,error:K(We(r))}),null}}static loadConfig(t){let r=e.findConfigDirectory(t);if(!r){let u=new e;return u.searchStartDir=t,u}let i=jt.join(r,qn),n=e.loadConfigFile(i);if(n===null){let u=new e(void 0,i);return u.searchStartDir=t,u.loadFailed=!0,u}let a,o=!1;if(n!==""){let u;try{u=JSON.parse(n)}catch(d){throw e.formatZodError(d,qn)}let p=uh.safeParse(u);if(p.success)a=p.data;else{let d=sl.safeParse(u);a=d.success?d.data:{},o=!d.success,d.success?$a.warn("Config","fjall-config.json contains keys this version does not recognise (only activeTarget, domains, capacityIdentity and organisation are read). They were most likely written by a newer fjall version \u2014 leave them in place; saves preserve them verbatim.",{file:i}):$a.warn("Config","fjall-config.json has a malformed activeTarget, domains or capacityIdentity value, so its contents were ignored for this run \u2014 any capacity-identity pins it holds will NOT apply (a pinned stack deploys unpinned and is blocked by the rename gate). Fix the file by hand; do NOT regenerate it, which would discard the pins.",{file:i})}}let s=new e(a,i);return s.searchStartDir=t,s.parseDegraded=o,s.loadedSnapshot=structuredClone(s.rootConfig),s}static formatZodError(t,r){if(t instanceof c.ZodError&&t.issues.length>0){let n=t.issues.map(a=>`${a.path.join(".")}: ${a.message}`).join("; ");return new Error(`Failed to parse ${r}: ${n}`)}let i=(t instanceof Error?t.message:String(t)).replace(/\n/g," ").substring(0,500);return new Error(`Failed to parse ${r}: ${i}`)}saveConfig(){let t=jt.join(this.resolveProjectDirectory()??jt.join(this.searchStartDir??process.cwd(),"fjall"),qn);if(this.loadFailed)return U(new Error(`Refusing to save ${t}: the file exists but could not be read when this config loaded, so saving would replace its contents with state that never included them. Fix the file permissions (e.g. chmod u+rw ${t}) and retry.`));let r=jt.dirname(t);try{je.mkdirSync(r,{recursive:!0})}catch(s){return U(new Error(`Cannot create config directory ${r}: ${K(We(s))}`))}let i=e.assertWritable(t,r);if(!i.success)return i;let n=this.mergeWithDisk(t);if(!n.success)return n;let a=Ma(n.data),o=`${t}.tmp-${process.pid}`;try{je.writeFileSync(o,a,{mode:384}),je.renameSync(o,t)}catch(s){return U(new Error(`Failed to save ${t}: ${K(We(s))}`))}return this.configPath=t,ge(void 0)}static assertWritable(t,r){if(je.existsSync(t))try{je.accessSync(t,je.constants.W_OK)}catch{return U(new Error(`Cannot save ${t}: the file is read-only. Make it writable (e.g. chmod u+w ${t}) and retry.`))}try{je.accessSync(r,je.constants.W_OK)}catch{return U(new Error(`Cannot save ${t}: the directory ${r} is not writable. Make it writable (e.g. chmod u+w ${r}) and retry.`))}return ge(void 0)}mergeWithDisk(t){let r=e.readDiskConfigForMerge(t);return r.kind==="unmergeable"?U(new Error(`Refusing to save ${t}: ${r.reason}. Writing now would keep only this session's state and drop everything else the file carries (including keys written by other fjall versions). Fix or remove the file and retry.`)):r.kind==="absent"?ge(this.rootConfig):ge(ul(r.disk,this.rootConfig,this.loadedSnapshot))}static readDiskConfigForMerge(t){if(!je.existsSync(t))return{kind:"absent"};let r;try{r=je.readFileSync(t,{encoding:"utf8"})}catch(i){return{kind:"unmergeable",reason:`the existing file could not be read or parsed as JSON (${K(We(i))})`}}return cl(r)}static getConfigDirectory(t){return e.findConfigDirectory(t)}getConfigPath(){return this.configPath}isContentUnavailable(){return this.loadFailed||this.parseDegraded}static warnedLegacyActiveTarget=!1;localConfigCache;resolveProjectDirectory(){return this.configPath!==null?jt.dirname(this.configPath):e.findConfigDirectory(this.searchStartDir)}localConfigFile(){let t=this.resolveProjectDirectory();return t===null?null:jt.join(t,Ui,Wu)}loadLocalConfig(){if(this.localConfigCache===void 0){let t=this.localConfigFile();if(t===null)return this.localConfigCache={};try{let r=je.readFileSync(t,{encoding:"utf8"}),i=$X.safeParse(JSON.parse(r));this.localConfigCache=i.success?i.data:{}}catch{this.localConfigCache={}}}return this.localConfigCache}writeLocalConfig(t){let r=this.localConfigFile();if(r===null)return U(new Error("Cannot persist local state: no fjall-config.json was found from this directory, so there is no project to anchor `.fjall/local.json` to. Run this from inside a fjall project, or run `fjall create account` / `fjall create app` first."));try{je.mkdirSync(jt.dirname(r),{recursive:!0});let i=`${r}.tmp-${process.pid}`;je.writeFileSync(i,JSON.stringify(t,null,2)+`
-`,{encoding:"utf8"}),je.renameSync(i,r),Xf(jt.dirname(jt.dirname(r)),[Zf,...Hu],{header:P0,marker:sM})}catch(i){return U(new Error(`Failed to write ${r}: ${K(We(i))}`))}return this.localConfigCache=t,ge(void 0)}static warnLegacyActiveTargetOnce(){e.warnedLegacyActiveTarget||(e.warnedLegacyActiveTarget=!0,$a.warn("Config","`activeTarget` in fjall-config.json is deprecated and ignored: a committed target must never re-aim a deploy or CI pipeline. Run `fjall target set <name>` to store it locally in .fjall/local.json, then remove `activeTarget` from the committed fjall-config.json."))}getActiveTarget(){let t=this.loadLocalConfig().activeTarget;if(t!==void 0)return t;this.rootConfig.activeTarget!==void 0&&e.warnLegacyActiveTargetOnce()}setActiveTarget(t){let r=this.loadLocalConfig();return r.activeTarget=t,this.writeLocalConfig(r)}clearActiveTarget(){let t=this.loadLocalConfig();return delete t.activeTarget,this.writeLocalConfig(t)}getDomains(){return this.rootConfig.domains??[]}setDomains(t){this.rootConfig.domains=t}addDomain(t){this.rootConfig.domains||(this.rootConfig.domains=[]),this.rootConfig.domains.push(t)}getDomain(t){return this.rootConfig.domains?.find(r=>r.name.toLowerCase()===t.toLowerCase())}removeDomain(t){if(!this.rootConfig.domains)return!1;let r=this.rootConfig.domains.findIndex(i=>i.name.toLowerCase()===t.toLowerCase());return r===-1?!1:(this.rootConfig.domains.splice(r,1),!0)}getOrganisation(){return this.rootConfig.organisation}setOrganisation(t){this.rootConfig.organisation=t}clearOrganisation(){delete this.rootConfig.organisation}};var MX=Object.defineProperty,zi=(e,t)=>MX(e,"name",{value:t,configurable:!0});function sx(e){let t;try{t=ph.loadConfig(e)}catch(i){return{kind:"unreadable",reason:K(We(i))}}if(t.isContentUnavailable())return{kind:"unreadable",reason:"fjall-config.json exists but its contents could not be loaded (the preceding warning names the problem)"};let r=t.getOrganisation();return r!==void 0?{kind:"bound",bound:r}:t.getConfigPath()===null?{kind:"no_project"}:{kind:"unbound"}}zi(sx,"readProjectBinding");function cx(e,t,r){switch(e.kind){case"unreadable":return e;case"no_project":return{kind:"unbound",projectFound:!1,identity:t};case"unbound":return{kind:"unbound",projectFound:!0,identity:t};case"bound":return t===null?{kind:"unverifiable",bound:e.bound,reason:r??"the organisation could not be resolved"}:e.bound.id===t.id?{kind:"matched",bound:e.bound}:{kind:"mismatched",bound:e.bound,actual:t}}}zi(cx,"resolveBindingVerdict");function XM(e,t={}){return cx(sx(t.startDir),e,t.unresolvedReason)}zi(XM,"checkProjectOrganisation");function La(e){return e.name!==void 0&&e.name!==""?`${e.name} (${e.id})`:e.id}zi(La,"describeOrganisation");function JM(e,t,r){return`Refusing to ${e}: this project's fjall-config.json records organisation ${La(t)} as its home, but the credential in use belongs to ${La(r)}. Nothing was created, synthesised or deployed. Cure: authenticate as ${La(t)} ('fjall login', or set FJALL_API_KEY to a key for that organisation), or \u2014 if this project really is moving \u2014 run 'fjall org bind --org ${r.id} --force' to re-bind it.`}zi(JM,"buildWrongOrganisationMessage");function YM(e,t){return`Refusing to ${e}: ${t}, so this project's organisation binding cannot be checked. Nothing was created, synthesised or deployed. Cure: fix fjall-config.json (permissions or contents), then re-run.`}zi(YM,"buildUnreadableConfigMessage");function qM(e,t){return`Could not confirm which organisation your credential belongs to (${t}). Proceeding \u2014 this project is bound to ${La(e)}, and a mismatch would not have been caught.`}zi(qM,"buildUnverifiableNotice");function QM(e){return`This project is not bound to an organisation. Run 'fjall org bind' to pin it to ${La(e)} \u2014 afterwards, any command run here with another organisation's credential is refused instead of silently landing there.`}zi(QM,"buildUnboundNotice");import{createHash as FX}from"node:crypto";var LX=Object.defineProperty,jX=(e,t)=>LX(e,"name",{value:t,configurable:!0});function eL(e,t){return FX("sha256").update(`${e}${t}`).digest("hex")}jX(eL,"credentialFingerprint");import*as fh from"node:fs";var UX=Object.defineProperty,mh=(e,t)=>UX(e,"name",{value:t,configurable:!0}),tL="org-config-cache.json";function ux(){return Ss(tL)}mh(ux,"orgConfigCachePath");function lx(e){return typeof e=="object"&&e!==null&&!Array.isArray(e)}mh(lx,"isObject");function dx(e){return lx(e)&&typeof e.organisationId=="string"&&e.organisationId!==""&&typeof e.organisationName=="string"}mh(dx,"isCachedCredentialIdentity");function rL(e){try{let t=ux();if(!fh.existsSync(t))return null;let r=JSON.parse(fh.readFileSync(t,"utf-8"));return!lx(r)||r.credentialFingerprint!==e?null:dx(r.identity)?r.identity:null}catch(t){return $a.debug("cachedCredentialIdentity","Cache read failed, treating as a miss",{error:K(We(t))}),null}}mh(rL,"readCachedCredentialIdentity");var BX=Object.defineProperty,zX=(e,t)=>BX(e,"name",{value:t,configurable:!0}),nL="https://fjall.io";function hh(){let e=process.env.FJALL_API_URL;return e!==void 0&&e!==""?e:nL}zX(hh,"resolveApiBaseUrl");var iL={name:"@fjall/cli",version:"39.0.3",repository:{type:"git",url:"git+https://github.com/fjall-tech/fjall.git",directory:"cli"},description:"Fjall CLI helper",private:!0,type:"module",bin:{fjall:"dist/src/cli.js"},files:["dist/"],scripts:{clean:"rm -rf ./dist ./dist.next ./sourcemaps","clean:node":"rm -rf ./node_modules","copy-files":'DEST="${DEST:-dist}"; find generators -type d -name files | while read dir; do mkdir -p "$DEST/$dir" && cp -R "$dir/." "$DEST/$dir/"; done && cp -R src/proto "./$DEST/src/proto"',build:"node ../scripts/run-build.mjs --purpose=build -- npm run build:steps","build:steps":"rm -rf ./dist.next ./sourcemaps && npx tsc --outDir dist.next && DEST=dist.next npm run copy-files && node ../scripts/minify-dist.mjs dist.next && chmod +x ./dist.next/src/cli.js && rm -rf ./dist && mv ./dist.next ./dist && node ../scripts/stamp-build.mjs",watch:"npm run build && npx tsc-watch","watch:only":'npx tsc-watch --onSuccess "npm run copy-files"',"fjall-cli":"node ./dist/src/cli.js",version:"npx tsx scripts/updateTemplateVersions.ts && node ../scripts/sync-ci-plugin-major.mjs",format:'prettier --write "src/**/*.{ts,tsx,js,jsx,json}" "generators/**/*.{ts,tsx,js,jsx,json}"',"format:check":'prettier --check "src/**/*.{ts,tsx,js,jsx,json}" "generators/**/*.{ts,tsx,js,jsx,json}"',lint:"eslint src/ generators/","lint:fix":"eslint src/ generators/ --fix",typecheck:"tsc --noEmit","typecheck:tests":"tsc --noEmit --project tsconfig.test.json","typecheck:scripts":"tsc --noEmit --project tsconfig.scripts.json","typecheck:all":"npm run typecheck && npm run typecheck:tests && npm run typecheck:scripts",test:"vitest run","test:watch":"vitest","test:coverage":"vitest run --coverage","test:integration":"vitest run --config vitest.config.integration.ts","test:integration:watch":"vitest --config vitest.config.integration.ts","test:e2e":"vitest run --config vitest.e2e.config.ts","test:all":"npm run test && npm run test:integration && npm run test:e2e","test:setup":"node scripts/setupTestFixtures.mjs","test:payload-compat":"npx tsx scripts/testPayloadCompatibility.ts","test:payload-compat:e2e":"npx tsx scripts/testPayloadCompatibility.ts --e2e"},engines:{node:">=22.3.0"},author:"",license:"SEE LICENSE IN LICENSE",devDependencies:{"@eslint/js":"^10.0.1","@playwright/test":"^1.62.0","@testing-library/dom":"^10.4.1","@testing-library/react":"^16.3.2","@types/ejs":"^3.1.5","@types/prompts":"^2.4.9","@types/proper-lockfile":"^4.1.4","@types/react":"^19.2.17","@typescript-eslint/parser":"^8.65.0","@vitest/coverage-v8":"^4.1.11","aws-cdk-lib":"^2.265.0",constructs:"^10.7.2",eslint:"^10.8.0","ink-testing-library":"^4.0.0",jsdom:"^30.0.1",prettier:"^3.9.6","react-dom":"^19.2.8","strip-ansi":"^6.0.1","tsc-watch":"^7.2.1",tsx:"^4.23.1","typescript-eslint":"^8.65.0",vitest:"4.1.11"},dependencies:{"@anthropic-ai/sdk":"^0.115.0","@aws-sdk/client-acm":"^3.1098.0","@aws-sdk/client-auto-scaling":"^3.1098.0","@aws-sdk/client-backup":"^3.1098.0","@aws-sdk/client-cloudformation":"^3.1098.0","@aws-sdk/client-cost-explorer":"^3.1098.0","@aws-sdk/client-ec2":"^3.1098.0","@aws-sdk/client-ecr":"^3.1098.0","@aws-sdk/client-ecs":"^3.1098.0","@aws-sdk/client-elasticache":"^3.1098.0","@aws-sdk/client-iam":"^3.1098.0","@aws-sdk/client-identitystore":"^3.1098.0","@aws-sdk/client-lambda":"^3.1098.0","@aws-sdk/client-organizations":"^3.1098.0","@aws-sdk/client-ram":"^3.1098.0","@aws-sdk/client-rds":"^3.1098.0","@aws-sdk/client-route-53":"^3.1098.0","@aws-sdk/client-s3":"^3.1098.0","@aws-sdk/client-secrets-manager":"^3.1098.0","@aws-sdk/client-ssm":"^3.1098.0","@aws-sdk/client-sso":"^3.1098.0","@aws-sdk/client-sso-admin":"^3.1098.0","@aws-sdk/client-sso-oidc":"^3.1098.0","@aws-sdk/client-sts":"^3.1098.0","@fjall/ai-tools":"^39.0.3","@fjall/deploy-core":"^39.0.3","@fjall/generator":"^39.0.3","@fjall/util":"^39.0.3","@opennextjs/aws":"^4.1.0","@smithy/node-http-handler":"^4.9.13","@toon-format/toon":"^4.1.0","aws-cdk":"^2.1134.0",axios:"^1.19.0",chalk:"^6.0.0","cli-cursor":"^5.0.0",commander:"^15.0.0",ejs:"^6.0.1",ink:"^7.1.1","js-yaml":"^5.2.2",open:"^11.0.0",ora:"^9.4.1",prompts:"^2.4.2","proper-lockfile":"^4.1.2",protobufjs:"^8.7.1",react:"^19.2.8",typescript:"^6.0.3","update-check":"^1.5.4",zod:"^4.4.3"}};var VX=Object.defineProperty,KX=(e,t)=>VX(e,"name",{value:t,configurable:!0}),qfe=`fjall-cli/${iL.version} node/${process.versions.node} ${WX()}/${HX()}`;var px=hh(),Qfe=c.looseObject({deviceCode:c.string(),userCode:c.string(),verificationUri:c.string(),expiresIn:c.number(),interval:c.number()}),ehe=c.looseObject({status:c.string(),apiKey:c.string().optional(),organisationId:c.string().optional(),organisationName:c.string().optional(),email:c.string().optional()}),the=c.looseObject({application:c.looseObject({id:c.string()})}),mx=c.looseObject({id:c.string(),name:c.string(),vpcCidr:c.string().nullable(),connectedAwsAccountId:c.string().nullable()}),rhe=c.looseObject({applications:c.array(mx),nextCursor:c.string().optional()}),nhe=c.looseObject({application:mx}),ihe=c.looseObject({applications:c.array(mx)}),ahe=c.looseObject({application:c.looseObject({id:c.string(),name:c.string()})}),ohe=c.looseObject({primaryRegion:c.string().nullish(),secondaryRegions:c.array(c.string()).optional(),disasterRecoveryRegion:c.string().nullish(),providerAccounts:c.custom(e=>Array.isArray(e)),ssoSessions:c.record(c.string(),c.looseObject({ssoRegion:c.string(),ssoStartUrl:c.string()})).optional(),rootOidcRoleArn:c.string().nullish(),allowCodemodLlmFallback:c.boolean().optional(),postureStrict:c.boolean().optional(),rootAccessManagement:c.custom(e=>typeof e=="string").optional(),requireTrackedDeploys:c.boolean().optional().catch(void 0)}),she=c.looseObject({id:c.string(),token:c.string(),tokenPrefix:c.string(),name:c.string(),scopes:c.array(c.string())}),ZX=c.looseObject({id:c.string(),name:c.string(),tokenPrefix:c.string(),scopes:c.array(c.string()),resourceConstraints:c.record(c.string(),c.unknown()),sourceTag:c.string().nullable(),expiresAt:c.string(),createdAt:c.string(),revokedAt:c.string().nullable(),revokedReason:c.string().nullable(),lastUsedAt:c.string().nullable(),usageCount:c.number(),deniedCount:c.number()}),che=c.looseObject({tokens:c.array(ZX)}),uhe=c.looseObject({scopes:c.array(c.string()),expiresAt:c.string().optional()}),XX=c.looseObject({id:c.string(),awsAccountId:c.string(),accountName:c.string().nullable(),environment:c.string().nullable()}),lhe=c.looseObject({accounts:c.array(XX)}),JX=c.looseObject({id:c.string(),assetIdentifier:c.string(),name:c.string(),type:c.string(),status:c.string(),region:c.string().nullish(),_count:c.looseObject({complianceIssues:c.number()}).optional()}),YX=c.looseObject({id:c.string(),name:c.string(),assetIdentifier:c.string(),provider:c.string(),type:c.string(),status:c.string(),region:c.string().nullish(),iacStatus:c.string().nullish(),accountId:c.string().nullish(),estimatedMonthlyCost:c.string().nullish(),lastSeenAt:c.string().nullish(),createdAt:c.string().nullish(),updatedAt:c.string().nullish()}),dhe=c.looseObject({assets:c.array(JX),nextCursor:c.string().optional()}),phe=c.looseObject({asset:YX}),qX=c.looseObject({id:c.string(),ruleId:c.string(),title:c.string(),severity:c.string(),status:c.string()}),mhe=c.looseObject({issues:c.array(qX)}),fhe=c.record(c.string(),c.unknown()),hhe=c.union([c.array(c.record(c.string(),c.unknown())),c.record(c.string(),c.unknown())]),ghe=c.record(c.string(),c.unknown()),yhe=c.record(c.string(),c.unknown()),vhe=c.record(c.string(),c.unknown()),She=c.record(c.string(),c.unknown()),bhe=c.looseObject({deployment:c.looseObject({id:c.string()}),minCliVersion:c.string().optional()});var QX=c.object({id:c.string(),releaseNumber:c.number().int(),status:c.string(),commitSha:c.string().nullable(),branch:c.string().nullable(),createdAt:c.string(),assemblyDigest:c.string().nullable(),createdByDeploymentId:c.string().nullable(),rollbackOfReleaseId:c.string().nullable(),services:c.array(Gf.strip())}),Ehe=c.object({releases:c.array(QX),currentReleaseId:c.string().nullable(),nextCursor:c.number().int().optional()}),eJ=c.object({id:c.string(),status:c.string(),target:c.string().nullish(),applicationId:c.string().nullish(),applicationName:c.string().nullish(),connectedAwsAccountId:c.string().nullish(),source:c.string().nullish(),startedAt:c.string().nullish(),triggeredByName:c.string().nullish(),machineLabel:c.string().nullish()}),_he=c.object({deployments:c.array(eJ)}),Ahe=c.object({cancelled:c.boolean(),message:c.string().nullish(),declined:c.boolean().nullish()}),xhe=c.object({released:c.literal(!0),id:c.string().nullish()}),The=c.looseObject({organisationId:c.string(),organisationName:c.string(),organisationSlug:c.string().min(1).optional()}),Che=c.looseObject({status:c.string(),roleArn:c.string().optional(),accountId:c.string().optional(),phase:c.string().optional(),reason:c.string().optional()}),Ihe=c.looseObject({token:c.string()}),tJ=c.looseObject({quickCreateUrl:c.string(),externalId:c.string()}),rJ=c.looseObject({alreadyConnected:c.literal(!0),account:c.looseObject({awsAccountId:c.string(),accountName:c.string().nullable(),status:c.string()})}),Dhe=c.union([rJ,tJ]);function nJ(e){return"alreadyConnected"in e&&e.alreadyConnected===!0}KX(nJ,"isAlreadyConnected");var Nhe=c.looseObject({registered:c.boolean(),repository:c.looseObject({id:c.string()}).optional()});var iJ=Object.defineProperty,aL=(e,t)=>iJ(e,"name",{value:t,configurable:!0});function oL(e=px){return`${e}/settings/ci`}aL(oL,"deployTokenMintUrl");function ll(e=px){return`Deploy tokens are minted from a signed-in browser session by an owner or admin: open ${oL(e)} (Settings \u2192 CI/CD Tokens).`}aL(ll,"deployTokenMintGuidance");var sL=[{command:"ci status",match:N.success,templates:["Run `fjall ci verify` to check the rest of the wiring \u2014 an active deploy token is necessary, not sufficient","Run `fjall ci token list` to see which applications, environments and accounts each active token may deploy to"]},{command:"ci status",match:N.empty,templates:[ll(),"Run `fjall ci setup --plan --app <app>` to learn where the workflow file will go and which secret name it will read (`workflowPath`, `secretName`) \u2014 the two things needed to stage the secret before minting. `--plan` writes nothing, and the workflow BODY is printed on the human surface only: it is not a field of the agent payload"]},{command:"ci token list",match:N.success,templates:["Run `fjall token show <id>` to inspect one token's stored constraints","Run `fjall ci token revoke <id> --reason <text>` to revoke a listed token"]},{command:"ci token list",match:N.empty,templates:[ll(),"Run `fjall ci status` to re-check readiness once a token exists"]},{command:"ci token revoke",match:N.success,templates:["Run `fjall ci token list` to confirm the token now lists as revoked \u2014 a revoked token stays listed, it does not disappear",`Any CI job still holding this token now fails to authenticate. ${ll()}`]}];var gh="Do not retry or vary flags: `supported: false` is the server's capability verdict, not an input error \u2014 every invocation answers the same until the Fjall server is updated to a version that ships this API (the `message` field names the upgrade)",cL=[{command:"deployments list",match:N.unsupported,templates:[gh]},{command:"deployments cancel",match:N.unsupported,templates:[gh]},{command:"deployments force-release",match:N.unsupported,templates:[gh]},{command:"dev list",match:N.unsupported,templates:[gh]},{command:"deployments list",match:N.success,templates:["Run `fjall deployments cancel <id>` to request co-operative cancellation of a listed deployment","Run `fjall deploy logs --deployment-id <id>` to read one deployment's logs"]},{command:"deployments cancel",match:N.success,templates:["Run `fjall deployments list` to confirm whether the slot is free, and read `cancelled` and `declined` before assuming it is: `cancelled: false` means the request was refused, `declined: true` is an already-terminal reject, and a plain granted cancel is co-operative \u2014 the deployment has to acknowledge it","Run `fjall deployments force-release <id> --confirm <id>` to clear a slot that stays occupied (organisation admin, audited \u2014 retype the id in `--confirm`)"]},{command:"deployments force-release",match:N.success,templates:["Run `fjall deployments list` to confirm the slot is free","Run `fjall deploy <app>` to retry the deployment the wedged slot was blocking"]},{command:"dev up",match:N.success,templates:["Run `fjall dev list <app>` to see every slot for this app with its `host` \u2014 rows carry `host`, not a full URL, and it is empty until the slot leaves `creating`","Run `fjall dev down <app> --branch <branch>` to tear this slot down"]},{command:"dev list",match:N.success,templates:["Run `fjall dev down <app> --branch <branch>` to tear one listed slot down \u2014 every row carries the `branch` to name here","Run `fjall dev up <app> --branch <branch>` to bring another branch up"]},{command:"dev down",match:N.success,templates:["Run `fjall dev list <app>` to see which slots remain","Run `fjall dev up <app> --branch <branch>` to bring the branch back up"]},{command:"dev substrate down",match:N.success,templates:["Run `fjall dev list <app>` to confirm no slot survives \u2014 the substrate will not tear down under live slots, and `--force` takes them with it","Any `residuals` row survives the teardown and can still cost: its `cleanupHint` names the manual step"]}];var uL=["Run `fjall domain deploy <name>` to deploy the domain","Run `fjall domain verify <name>` to check DNS delegation once it is deployed","Run `fjall domain export <name>` to export the live zone records"],lL=[{command:"org deploy",match:N.success,templates:["Run `fjall org get` to review the deployed organisation topology and accounts",`Run \`${ne.accountDeploy}\` to deploy the account tier if you passed \`--no-cascade\``,`Run \`${ne.createApplicationAgent} --name "<name>"\` to create an application to deploy into it`]},{command:"org deploy",match:N.error,templates:["Run `fjall org get` to see which tier of the cascade is already deployed",`Run \`${ne.organisationDeploy} --no-cascade\` to retry the organisation stack alone`]},{command:"platform deploy",match:N.success,templates:[`Run \`${ne.accountDeploy}\` to deploy the account tier on top of it`]},{command:"platform deploy",match:N.error,templates:["Run `fjall org get` to check the organisation tier is deployed first"]},{command:"account deploy",match:N.success,templates:["Run `fjall apps list` to see which applications are registered","Run `fjall deploy <application>` to deploy one into this account"]},{command:"account deploy",match:N.error,templates:["Run `fjall org get` to confirm the account is registered in the organisation",`Run \`${ne.accountDeploy} --target <target>\` to select a specific member account`]},{command:"domain list",match:N.success,templates:["Run `fjall domain verify <name>` to check DNS delegation","Run `fjall domain export <name>` to export zone file","Run `fjall create domain --name <name>` to create a new domain"]},{command:"domain list",match:N.empty,templates:['Run `fjall create domain --name "<name>"` to create a domain',"Run `fjall domain import <name>` to import from Route53"]},{command:"domain verify",match:N.success,templates:["Run `fjall domain export <name>` to export zone file","Run `fjall domain deploy <name>` to deploy domain infrastructure"]},{command:"domain verify",match:N.error,templates:["Run `fjall domain verify <name>` to retry","Run `fjall domain list` to see existing domains"]},{command:"domain export",match:N.success,templates:["Run `fjall domain verify <name>` to check delegation","Run `fjall domain import <name>` to re-import from Route53"]},{command:"domain import",match:N.success,templates:["Run `fjall domain verify <name>` to check delegation","Run `fjall domain export <name>` to see the zone file","Run `fjall domain deploy <name>` to deploy domain infrastructure"]},{command:"domain import",match:N.error,templates:["Run `fjall domain import --hosted-zone-id <id>` to import by zone ID","Run `fjall domain list` to see existing domains"]},{command:"domain records list",match:N.success,templates:["Run `fjall domain sync <domain>` for the full zone-hygiene report","Run `fjall domain sync <domain> --fix` to remediate residue records via the destruction ceremony"]},{command:"domain records list",match:N.empty,templates:["Run `fjall domain deploy <domain>` to deploy the domain's declared records","Run `fjall domain list` to see existing domains"]},{command:"domain records list",match:N.error,templates:["Run `fjall domain records list <domain> --hosted-zone-id <id>` when the zone is not resolvable by name",`Run \`${ne.connect}\` if AWS credentials are missing`]},{command:"domain sync",match:N.success,templates:["Run `fjall domain sync <domain> --fix` to remediate residue records (ceremony-gated)","Run `fjall domain records list <domain>` to see every record with its owner"]},{command:"domain sync",match:N.error,templates:["Run `fjall domain sync <domain> --hosted-zone-id <id>` when the zone is not resolvable by name","Run `fjall domain list` to see existing domains"]},{command:"domain delegate",match:N.success,templates:["Run `fjall domain verify <domain>` to confirm public DNS resolution","Run `fjall domain deploy <domain>` to continue a two-phase deploy after delegation"]},{command:"domain delegate",match:N.error,templates:["Run `fjall domain deploy <parent-domain>` so the parent publishes its DelegationRole","Run `fjall domain verify <domain> --show-delegation` for registrar instructions"]},{command:"domain destroy",match:N.success,templates:["Run `fjall domain list` to see remaining domains","Run `fjall domain sync <parent-domain>` to confirm no delegation residue remains"]},{command:"domain destroy",match:N.error,templates:["Run `fjall domain destroy <domain> --remediate '<name>'=recreate` with the exact consent the ticket names","Run `fjall domain list` to see existing domains"]},{command:"domain deploy",match:N.success,templates:["Run `fjall domain verify <domain>` to check DNS propagation","Run `fjall domain delegate <domain>` to write the NS delegation for a delegated child"]},{command:"domain deploy",match:N.error,templates:["Run `fjall domain deploy <domain>` to resume \u2014 the zone phase is retained and skipped on re-run","Run `fjall domain verify <domain> --show-delegation` for registrar delegation instructions"]},{command:"domain eject",match:N.success,templates:["Review the ejected infrastructure.ts \u2014 it is now vanilla CDK owned by you","Run `fjall domain list` to see remaining managed domains"]},{command:"create domain",match:N.success,templates:uL},{command:"domain create",match:N.success,templates:uL},{command:"create domain",match:N.error,templates:["Run `fjall domain list` to see existing domains",'Run `fjall create domain --name "<name>"` to retry with a different name']},{command:"create account",match:N.success,templates:[`Run \`${ne.connect} --environment production\` to link your AWS account`,`Run \`${ne.accountDeploy}\` to deploy account infrastructure (after connecting)`]},{command:"create account",match:N.error,templates:[`Run \`${ne.createAccount} --primary-region <region>\` to retry`,`Run \`${ne.createAccount} --help\` for usage information`]},{command:"create org",match:N.success,templates:[`Run \`${ne.connect} --name "<account-name>" --region <region>\` to link the AWS Organizations management account \u2014 omit \`--environment\` so it registers at the organisation tier`,`Run \`${ne.organisationDeploy}\` to deploy all infrastructure (after connecting)`]},{command:"create org",match:N.error,templates:[`Run \`${ne.createOrganisation} --email "<email>"\` to retry (add \`--name "<name>"\` only for a brand-new organisation)`,`Run \`${ne.createOrganisation} --help\` for all options`]},{command:"restore",match:N.successDryRun,templates:["Run `fjall restore <resourceType> --recovery-point <recoveryPointArn> --yes` to initiate restore","Run `fjall apps list` to see existing applications"]},{command:"restore",match:N.success,templates:["Open the AWS Console URL above to monitor restore progress","Run `fjall import` to import the restored resource after completion"]},{command:"restore",match:N.errorWithCode("NOT_FOUND"),templates:["Verify the recovery point ARN is correct and exists in the current region","Run `fjall restore <resourceType> --recovery-point <arn>` to retry"]},{command:"restore",match:N.errorWithCode("FORBIDDEN"),templates:["Ensure the IAM role has backup:StartRestoreJob and iam:PassRole permissions","Run `fjall restore` interactively to configure with guided setup"]},{command:"import",match:N.successDryRun,templates:["Run `fjall import --app <app> --resource-id <resourceId> --yes` to import a specific resource","Run `fjall import --app <app> --yes` to import all discovered resources"]},{command:"import",match:N.success,templates:["Run `fjall deploy <app>` to deploy with the imported resource","Run `fjall apps describe <app>` to see updated resources"]},{command:"import",match:N.errorWithCode("NOT_FOUND"),templates:[`Run \`${ne.createApplicationAgent} --name "<app>"\` to create the application`,"Run `fjall apps list` to see existing applications"]},{command:"import",match:N.errorWithCode("VALIDATION_ERROR"),templates:["Run `fjall import --app <app> --resource-id <resourceId>` to import a specific resource","Run `fjall import --app <app> --resource-id <resourceId> --yes` to import immediately"]},{command:"aws exec",match:N.success,templates:["Run `fjall aws exec -- <command...>` to run another AWS CLI command","Run `fjall status` to check application health"]},{command:"aws exec",match:N.error,templates:["Retry the command \u2014 OIDC token mints can fail transiently",`Run \`${ne.login}\` if the retry also fails with an authentication error`]},{command:"unlock bucket",match:N.success,templates:["Re-put sane bucket policy statements (enforceSSL deny, access grants) \u2014 the unlock deleted the ENTIRE policy","Run `fjall destroy <app>` to retry the blocked stack cleanup"]},{command:"unlock bucket",match:N.error,templates:["Ensure your credentials belong to the organisation's management account \u2014 STS AssumeRoot is rejected elsewhere","Run `fjall unlock bucket <name> --account <id> --acknowledge-root-session` to retry"]}];var aJ=c.object({entity:c.enum(["application","deployment","asset","account"]).describe("What to query"),id:c.string().optional().describe("Specific entity ID for detail fetch"),applicationId:c.string().optional().describe("Filter by application (deployments only)"),status:c.string().optional().describe("Status filter (deployments: queued/pending/running/succeeded/failed)"),limit:c.number().int().min(1).max(100).optional().describe("Max results (default varies by entity)")}).strict();var oJ=c.object({mode:c.enum(["issues","counts","summary"]).describe("issues: list findings; counts: breakdown by severity; summary: compliance score and overview"),severity:c.enum(["critical","high","medium","low"]).optional().describe("Filter by severity (issues mode)"),status:c.enum(Ts).optional().describe("Filter by status (issues mode)"),limit:c.number().int().min(1).max(50).optional().describe("Max results for issues mode (default 20)")}).strict();var sJ=c.object({mode:c.enum(["summary","trend","forecast","attribution","per_request","per_deployment","month_to_date"]).default("summary").describe("summary: total + by-service (default); trend: daily with period comparison; forecast: linear regression projection; attribution: service breakdown; per_request/per_deployment: cost ratios for an app; month_to_date: MTD total"),applicationId:c.string().optional().describe("Required for per_request, per_deployment, and app-specific month_to_date"),days:c.number().int().min(1).max(90).optional().describe("Lookback period (default 30)"),forecastDays:c.number().int().min(1).max(30).optional().describe("Forecast horizon, only for forecast mode (default 7)")}).strict();var cJ=c.object({mode:c.enum(["time_series","latest","sparklines","org_summary"]).default("latest").describe("time_series: metric values over time for an app; latest: current metrics (default); sparklines: hourly mini-trends; org_summary: org-wide aggregates"),applicationId:c.string().optional().describe("Required for time_series"),hours:c.number().int().min(1).max(168).optional().describe("Lookback hours (default 24)"),limit:c.number().int().min(1).max(500).optional().describe("Max data points for time_series (default 100)")}).strict();var uJ=["stats","compliance","costs","deployments"],lJ=c.object({sections:c.array(c.enum(uJ)).optional().describe("Which sections to include (default: all). Omit sections for faster response.")}).strict();var dJ=c.object({applicationId:c.string().describe("Application experiencing the error"),errorPattern:c.string().optional().describe("Error message or pattern to search for"),deploymentId:c.string().optional().describe("Deployment that may have introduced the error"),hours:c.number().int().min(1).max(168).optional().describe("Lookback window in hours (default 24)")}).strict();var pJ=c.object({deploymentIdA:c.string().describe("First deployment ID (typically older)"),deploymentIdB:c.string().describe("Second deployment ID (typically newer)")}).strict();var dl=c.enum(["compliance","cost","performance"]),mJ=c.object({domain:dl.describe("What type of issue to remediate"),applicationId:c.string().optional().describe("Specific application context"),issueId:c.string().optional().describe("Specific compliance issue ID for targeted advice")}).strict();var dL=c.enum(["count","rate","duration_ms","bytes","currency","percent"]),fJ=c.object({kind:c.enum(["timeseries","bar","categoryBar"]),title:c.string().optional(),series:c.array(c.object({id:c.string(),label:c.string(),kind:dL,data:c.array(c.object({x:c.number().describe("Unix timestamp in milliseconds, or numeric value"),y:c.number().nullable()}).strict())}).strict()).optional().describe("Series data for timeseries and bar charts"),data:c.array(c.object({label:c.string(),value:c.number()}).strict()).optional().describe("Category data for categoryBar charts"),unit:dL.optional(),stacked:c.boolean().optional(),areaFill:c.boolean().optional()}).strict();var hJ=c.object({applicationId:c.string().describe("The application ID to deploy"),environment:c.string().optional().describe("Target environment (e.g. production, staging)"),branch:c.string().optional().describe("Git branch to deploy from (defaults to repository default)")}).strict();var gJ=c.object({operation:c.enum(["set","delete","list"]).describe("Operation to perform. Note: get is intentionally omitted \u2014 secret values are never exposed."),applicationId:c.string().describe("The application whose AWS account holds the secrets"),app:c.string().min(1).optional().describe("Deprecated and ignored \u2014 the app segment is derived from applicationId"),cluster:c.string().min(1).optional().describe("SSM namespace cluster component"),service:c.string().min(1).optional().describe("SSM namespace service component"),lambda:c.string().min(1).optional().describe("SSM namespace lambda function component (mutually exclusive with cluster and service)"),name:c.string().min(1).optional().describe("Secret name (required for set and delete operations)"),value:c.string().max(4096).optional().describe("Secret value (required for set operation)")}).strict().refine(e=>!(e.service&&!e.cluster),{message:"Cluster is required when service is specified"}).refine(e=>!(e.lambda&&(e.cluster||e.service)),{message:"Lambda is mutually exclusive with cluster and service"}).refine(e=>e.cluster!=="lambda",{message:'The cluster name "lambda" is reserved for lambda-scoped parameter paths'});var yJ=c.object({applicationId:c.string().describe("Application to update"),name:c.string().min(1).max(100).optional().describe("New application name"),description:c.string().max(500).optional().describe("New application description"),configPath:c.string().max(500).optional().describe("New IaC configuration path")}).strict().refine(e=>e.name!==void 0||e.description!==void 0||e.configPath!==void 0,{message:"At least one of 'name', 'description', or 'configPath' must be provided"});var vJ=c.object({operation:c.enum(["list","records_list","sync_report","verify","mutation_commands","add","remove"]).describe("list: declared domains with live zone/stack status; records_list: every live record with its ownership classification (declared/satellite/residue/unknown; satellite includes a delegated child's domain stack in another AWS account; unknown is NEVER remediable; classification fails closed); sync_report: the same classification grouped per class as a read-only report (never deletes anything); verify: DNS nameserver delegation check; mutation_commands: the exact ceremony-gated CLI commands for the mutations this tool never performs. add/remove are deprecated aliases of mutation_commands."),domain:c.string().min(1).max(253).optional().describe("Domain (hosted zone) name \u2014 required for records_list, sync_report, and verify; optional context for mutation_commands")}).strict().refine(e=>!((e.operation==="records_list"||e.operation==="sync_report"||e.operation==="verify")&&e.domain===void 0),{message:"domain is required for records_list, sync_report, and verify operations"});var SJ=c.object({region:c.string().describe("AWS region code to add, e.g. 'ap-southeast-2'"),connectedAwsAccountId:c.string().optional().describe("Target connected-account id; only needed when the organisation has no organisation-tier account and multiple accounts are connected")}).strict();var bJ=Object.defineProperty,hL=(e,t)=>bJ(e,"name",{value:t,configurable:!0}),pL="Run `fjall connect status` to check that an AWS account is connected: asset discovery only inventories connected accounts, so an organisation with none has nothing to inventory",mL=["Run `fjall assets show <asset>` to read one asset in full \u2014 pass its `assetIdentifier`","Run `fjall assets compliance <asset>` to list an asset's recorded posture issues \u2014 pass its `assetIdentifier`, the address every server version accepts"],fL=hL(e=>e.outcome==="success"&&e.nextCursor!==void 0,"isTruncatedPage"),gL=[{command:"assets list",match:hL(e=>fL(e)&&e.fields!==void 0&&e.fields!=="","match"),templates:["This window is truncated \u2014 more assets exist beyond these rows. Run `fjall assets list --cursor <nextCursor> --fields <fields>` to fetch the next page with the same projection; `total` counts this window only, and `fjall assets summary` reports the estate-wide tally, split active/deleted",...mL]},{command:"assets list",match:fL,templates:["This window is truncated \u2014 more assets exist beyond these rows. Run `fjall assets list --cursor <nextCursor>` to fetch the next page; `total` counts this window only, and `fjall assets summary` reports the estate-wide tally, split active/deleted",...mL]},{command:"assets list",match:N.success,templates:["The `total` aggregate counts the rows in this response, not the estate: `--take` bounds the window (default 50). No `nextCursor` aggregate here means the estate ends with these rows; `fjall assets summary` reports the estate-wide tally, split active/deleted","Run `fjall assets show <asset>` to read one asset in full","Run `fjall assets compliance <asset>` to list an asset's recorded posture issues \u2014 pass its `assetIdentifier`, the address every server version accepts (row `id`s are only accepted by newer servers)"]},{command:"assets list",match:N.empty,templates:["Run `fjall assets list --status deleted` to include assets discovery has since marked deleted \u2014 the default listing hides them",pL]},{command:"assets show",match:N.success,templates:["Run `fjall assets compliance <asset>` to list the posture issues recorded against this asset","Run `fjall assets show <asset> --fields id,accountId,iacStatus,estimatedMonthlyCost,lastSeenAt` to read the fields the default projection omits"]},{command:"assets compliance",match:N.success,templates:["Read the `status` column before acting: this listing returns every issue recorded against the asset, `resolved` and `suppressed` included, where the `openIssues` count on `fjall assets list` counts only the open ones",`Run \`fjall compliance fix --domain compliance --issue-id <issueId>\` to read this issue in full alongside the organisation's other open issues. \`--domain\` is the producer's category \u2014 one of ${dl.options.join(", ")} \u2014 not a framework name, and the response is context to reason from, not a remediation step: use \`--execute\` to run one`,"Run `fjall assets show <asset>` to read the asset these issues were raised against"]},{command:"assets compliance",match:N.empty,templates:["No issue of ANY status has been recorded against this asset \u2014 an empty listing here is not the same as issues that were resolved, which would still appear with `status: resolved`","Run `fjall assets list --fields name,assetIdentifier,openIssues` to find the assets that do carry open issues"]},{command:"assets summary",match:N.success,templates:["Run `fjall assets list --fields name,assetIdentifier,openIssues` to see which assets sit behind `withIssues` \u2014 `withIssues` counts the assets carrying at least one open issue, `openIssues` counts those issues per asset","Run `fjall assets list --take <n>` to read the rows behind these totals \u2014 page onwards with `--cursor` when the listing reports a `nextCursor`, and pass `--status deleted` to include the `deleted` rows in the listing (interleaved with active \u2014 read the `status` column). These totals are estate-wide (the summary pages the listing to exhaustion, deleted assets included): `total` counts the whole estate, `active` and `deleted` split it"]},{command:"assets summary",match:N.empty,templates:[pL]},{command:"costs show",match:N.success,templates:["Run `fjall costs --mode forecast` to see forecasted spend","Run `fjall costs --mode breakdown` to see service-level breakdown"]},{command:"costs show",match:N.error,templates:["Run `fjall costs --app <app>` to filter by application","Run `fjall costs --help` for usage information"]},{command:"metrics show",match:N.success,templates:["Run `fjall metrics --mode latency` to see latency percentiles","Run `fjall metrics --mode errors` to see error trends"]},{command:"metrics show",match:N.error,templates:["Run `fjall metrics --app <app>` to filter by application","Run `fjall metrics --help` for usage information"]},{command:"compliance fix",match:N.success,templates:["Run `fjall compliance fix --domain <domain> --issue-id <id>` to narrow the suggestions to one issue","Run `fjall deploy <app>` to apply remediation changes"]},{command:"compliance fix",match:N.error,templates:[`Run \`fjall compliance fix --domain <domain>\` to name the issue domain \u2014 one of ${dl.options.join(", ")}, not a framework name`,"Run `fjall compliance --help` for usage information"]},{command:"compliance fix --execute",match:N.success,templates:["Read the result's `kind` before treating the issue as fixed: `auto-pr` opened a pull request that still has to be merged, `imperative` rewrote the live policy, and `manual-hint` changed nothing \u2014 its `awsCliHint` carries the manual step, and that field is absent for rules that supply no hint (`message` is a fixed string either way)","Do not re-read the issue to confirm the cure: nothing on the remediation path writes to the issue record, so `status` stays `open` until the next discovery scan re-evaluates the asset. Verify at the thing that changed \u2014 the pull request, or the live resource","Run `fjall deploy <app>` to roll out an `auto-pr` remediation once its pull request is merged"]},{command:"deploy diff",match:N.success,templates:["Run `fjall deploy logs --deployment-id <id>` to analyse deployment logs","Run `fjall status <app>` to check current deployment health"]},{command:"deploy diff",match:N.error,templates:["Run `fjall list deployments` to see recent deployment IDs","Run `fjall deploy diff --help` for usage information"]},{command:"deploy logs",match:N.success,templates:["Run `fjall deploy diff <idA> <idB>` to compare two deployments","Run `fjall status <app>` to check current deployment health"]},{command:"deploy logs",match:N.error,templates:["Run `fjall deploy logs --deployment-id <id>` with a valid deployment ID","Run `fjall list deployments` to find a deployment ID"]}];var EJ={command:"*",match:N.error,templates:["Run `fjall <command> --help` for usage information"]},yL=[...FM,...UM,...zM,...sL,...cL,...lL,...gL,EJ];var _J=Object.defineProperty,AJ=(e,t)=>_J(e,"name",{value:t,configurable:!0}),vL=["app","environment","region","profile","target","cluster","service","lambda","status","type"],ja=["app","cluster","service","lambda","target"],xJ=["status","type","region"],fx={deploy:["environment","region","target"],"deploy diff":[],"deploy logs":[],destroy:["target"],"org deploy":["target"],"org destroy":["target"],"platform deploy":["target"],"platform destroy":["target"],"account deploy":["target"],"account destroy":["target"],status:[],rollout:[],list:["app"],apps:["target"],connect:["environment","region"],"connect status":[],import:["app","region"],costs:["app"],metrics:["app"],compliance:["app"],"token create":["app","environment"],"unlock bucket":["region"],"aws exec":["app","region","target"],"secrets set":ja,"secrets get":ja,"secrets list":ja,"secrets delete":ja,"secrets export":ja,"secrets import":ja,"secrets exec":ja,"assets list":xJ},TJ=Math.max(...Object.keys(fx).map(e=>e.split(" ").length));function hx(e){let t=e.trim().split(/\s+/).slice(1);for(let r=TJ;r>=1;r--){let i=t.slice(0,r).join(" ");if(Object.hasOwn(fx,i))return fx[i]}return[]}AJ(hx,"resolvePreservableFlags");var CJ=Object.defineProperty,vh=(e,t)=>CJ(e,"name",{value:t,configurable:!0});function gx(e){let t=e.replace(/[\u0000-\u001f\u007f`]/g,"");return/[^\w@%+=:,./-]/.test(t)?`'${t.replace(/'/g,"'\\''")}'`:t}vh(gx,"shellEscape");function SL(e,t,r){let i=new Set,n=e.replace(/<(\w+)>/g,(a,o)=>{let s=t[o];return s===void 0||s===""?`<${o}>`:(i.add(o),o==="command"?s:gx(s))});return bL(n,r,i)}vh(SL,"interpolateTemplate");var yh=class{static{vh(this,"SuggestionResolver")}command;flags;constructor(t,r){this.command=t,this.flags=r}resolve(t){let r=yL.find(i=>(i.command===this.command||i.command==="*")&&i.match(t));return r===void 0?[]:r.templates.map(i=>SL(i,t,this.flags))}};function bL(e,t,r=new Set){let i=/`(fjall[^`]*)`/.exec(e),n=i?.[1];if(i===null||n===void 0)return e;let a=hx(n),o=[];for(let d of vL){if(!a.includes(d))continue;let g=t[d];g!==void 0&&g!==""&&!r.has(d)&&!n.includes(`--${d}`)&&o.push(`--${d} ${gx(g)}`)}if(o.length===0)return e;let s=` ${o.join(" ")}`,u=n.indexOf(" -- "),p=u===-1?`${n}${s}`:`${n.slice(0,u)}${s}${n.slice(u)}`;return e.slice(0,i.index)+`\`${p}\``+e.slice(i.index+i[0].length)}vh(bL,"applyPreservedFlags");var IJ=Object.defineProperty,ii=(e,t)=>IJ(e,"name",{value:t,configurable:!0});function an(e,t){if(t!==void 0&&Os(e)){let i={};for(let[n,a]of Object.entries(e))i[n]=t.has(n)?a:an(a);return i}if(typeof e=="string")return K(e);if(e==null||typeof e!="object")return e;if(Array.isArray(e))return e.map(i=>an(i));if(e instanceof Date||e instanceof RegExp)return e;let r={};for(let[i,n]of Object.entries(e))r[i]=an(n);return r}ii(an,"maskTree");function Sh(e){if(Array.isArray(e))return e.map(Sh);if(!Os(e))return e;let t={};for(let[r,i]of Object.entries(e))i!==void 0&&(t[r]=Sh(i));return t}ii(Sh,"stripAbsent");function Os(e){return typeof e=="object"&&e!==null&&!Array.isArray(e)&&!(e instanceof Date)&&!(e instanceof RegExp)}ii(Os,"isPlainRecord");function EL(e){let t=e?.verbatimFields;return t!==void 0&&t.length>0?new Set(t):void 0}ii(EL,"toVerbatimKeys");function _L(e,t){return t===void 0||!Os(e)?!1:Object.keys(e).some(r=>t.has(r))}ii(_L,"carriesVerbatimField");function AL(e,t){let r=e;for(let i of t.split(".")){if(!Os(r))return;r=r[i]}return r}ii(AL,"resolveDotPath");function xL(e,t,r){let i=e.project(t),n={};for(let a of r)a in i&&(n[a]=i[a]);return n}ii(xL,"projectSelectedFields");var pl=class{static{ii(this,"AgentOutputWriter")}write;hasWrittenBlock=!1;resolver;flags;full;budget;requestedFields;constructor(t){this.write=t.writeFn??(r=>{process.stdout.write(r)}),this.resolver=new yh(t.command,t.flags),this.flags=t.flags,this.full=t.full??!1,this.budget=t.budget,this.requestedFields=t.fields??[]}get isFullOutput(){return this.full}writeBlock(t){t!==""&&(this.hasWrittenBlock&&this.write(B0+`
+`,{encoding:"utf8"}),je.renameSync(i,r),Xf(jt.dirname(jt.dirname(r)),[Zf,...Hu],{header:P0,marker:sM})}catch(i){return U(new Error(`Failed to write ${r}: ${K(We(i))}`))}return this.localConfigCache=t,ge(void 0)}static warnLegacyActiveTargetOnce(){e.warnedLegacyActiveTarget||(e.warnedLegacyActiveTarget=!0,$a.warn("Config","`activeTarget` in fjall-config.json is deprecated and ignored: a committed target must never re-aim a deploy or CI pipeline. Run `fjall target set <name>` to store it locally in .fjall/local.json, then remove `activeTarget` from the committed fjall-config.json."))}getActiveTarget(){let t=this.loadLocalConfig().activeTarget;if(t!==void 0)return t;this.rootConfig.activeTarget!==void 0&&e.warnLegacyActiveTargetOnce()}setActiveTarget(t){let r=this.loadLocalConfig();return r.activeTarget=t,this.writeLocalConfig(r)}clearActiveTarget(){let t=this.loadLocalConfig();return delete t.activeTarget,this.writeLocalConfig(t)}getDomains(){return this.rootConfig.domains??[]}setDomains(t){this.rootConfig.domains=t}addDomain(t){this.rootConfig.domains||(this.rootConfig.domains=[]),this.rootConfig.domains.push(t)}getDomain(t){return this.rootConfig.domains?.find(r=>r.name.toLowerCase()===t.toLowerCase())}removeDomain(t){if(!this.rootConfig.domains)return!1;let r=this.rootConfig.domains.findIndex(i=>i.name.toLowerCase()===t.toLowerCase());return r===-1?!1:(this.rootConfig.domains.splice(r,1),!0)}getOrganisation(){return this.rootConfig.organisation}setOrganisation(t){this.rootConfig.organisation=t}clearOrganisation(){delete this.rootConfig.organisation}};var MX=Object.defineProperty,zi=(e,t)=>MX(e,"name",{value:t,configurable:!0});function sx(e){let t;try{t=ph.loadConfig(e)}catch(i){return{kind:"unreadable",reason:K(We(i))}}if(t.isContentUnavailable())return{kind:"unreadable",reason:"fjall-config.json exists but its contents could not be loaded (the preceding warning names the problem)"};let r=t.getOrganisation();return r!==void 0?{kind:"bound",bound:r}:t.getConfigPath()===null?{kind:"no_project"}:{kind:"unbound"}}zi(sx,"readProjectBinding");function cx(e,t,r){switch(e.kind){case"unreadable":return e;case"no_project":return{kind:"unbound",projectFound:!1,identity:t};case"unbound":return{kind:"unbound",projectFound:!0,identity:t};case"bound":return t===null?{kind:"unverifiable",bound:e.bound,reason:r??"the organisation could not be resolved"}:e.bound.id===t.id?{kind:"matched",bound:e.bound}:{kind:"mismatched",bound:e.bound,actual:t}}}zi(cx,"resolveBindingVerdict");function XM(e,t={}){return cx(sx(t.startDir),e,t.unresolvedReason)}zi(XM,"checkProjectOrganisation");function La(e){return e.name!==void 0&&e.name!==""?`${e.name} (${e.id})`:e.id}zi(La,"describeOrganisation");function JM(e,t,r){return`Refusing to ${e}: this project's fjall-config.json records organisation ${La(t)} as its home, but the credential in use belongs to ${La(r)}. Nothing was created, synthesised or deployed. Cure: authenticate as ${La(t)} ('fjall login', or set FJALL_API_KEY to a key for that organisation), or \u2014 if this project really is moving \u2014 run 'fjall org bind --org ${r.id} --force' to re-bind it.`}zi(JM,"buildWrongOrganisationMessage");function YM(e,t){return`Refusing to ${e}: ${t}, so this project's organisation binding cannot be checked. Nothing was created, synthesised or deployed. Cure: fix fjall-config.json (permissions or contents), then re-run.`}zi(YM,"buildUnreadableConfigMessage");function qM(e,t){return`Could not confirm which organisation your credential belongs to (${t}). Proceeding \u2014 this project is bound to ${La(e)}, and a mismatch would not have been caught.`}zi(qM,"buildUnverifiableNotice");function QM(e){return`This project is not bound to an organisation. Run 'fjall org bind' to pin it to ${La(e)} \u2014 afterwards, any command run here with another organisation's credential is refused instead of silently landing there.`}zi(QM,"buildUnboundNotice");import{createHash as FX}from"node:crypto";var LX=Object.defineProperty,jX=(e,t)=>LX(e,"name",{value:t,configurable:!0});function eL(e,t){return FX("sha256").update(`${e}${t}`).digest("hex")}jX(eL,"credentialFingerprint");import*as fh from"node:fs";var UX=Object.defineProperty,mh=(e,t)=>UX(e,"name",{value:t,configurable:!0}),tL="org-config-cache.json";function ux(){return Ss(tL)}mh(ux,"orgConfigCachePath");function lx(e){return typeof e=="object"&&e!==null&&!Array.isArray(e)}mh(lx,"isObject");function dx(e){return lx(e)&&typeof e.organisationId=="string"&&e.organisationId!==""&&typeof e.organisationName=="string"}mh(dx,"isCachedCredentialIdentity");function rL(e){try{let t=ux();if(!fh.existsSync(t))return null;let r=JSON.parse(fh.readFileSync(t,"utf-8"));return!lx(r)||r.credentialFingerprint!==e?null:dx(r.identity)?r.identity:null}catch(t){return $a.debug("cachedCredentialIdentity","Cache read failed, treating as a miss",{error:K(We(t))}),null}}mh(rL,"readCachedCredentialIdentity");var BX=Object.defineProperty,zX=(e,t)=>BX(e,"name",{value:t,configurable:!0}),nL="https://fjall.io";function hh(){let e=process.env.FJALL_API_URL;return e!==void 0&&e!==""?e:nL}zX(hh,"resolveApiBaseUrl");var iL={name:"@fjall/cli",version:"39.0.4",repository:{type:"git",url:"git+https://github.com/fjall-tech/fjall.git",directory:"cli"},description:"Fjall CLI helper",private:!0,type:"module",bin:{fjall:"dist/src/cli.js"},files:["dist/"],scripts:{clean:"rm -rf ./dist ./dist.next ./sourcemaps","clean:node":"rm -rf ./node_modules","copy-files":'DEST="${DEST:-dist}"; find generators -type d -name files | while read dir; do mkdir -p "$DEST/$dir" && cp -R "$dir/." "$DEST/$dir/"; done && cp -R src/proto "./$DEST/src/proto"',build:"node ../scripts/run-build.mjs --purpose=build -- npm run build:steps","build:steps":"rm -rf ./dist.next ./sourcemaps && npx tsc --outDir dist.next && DEST=dist.next npm run copy-files && node ../scripts/minify-dist.mjs dist.next && chmod +x ./dist.next/src/cli.js && rm -rf ./dist && mv ./dist.next ./dist && node ../scripts/stamp-build.mjs",watch:"npm run build && npx tsc-watch","watch:only":'npx tsc-watch --onSuccess "npm run copy-files"',"fjall-cli":"node ./dist/src/cli.js",version:"npx tsx scripts/updateTemplateVersions.ts && node ../scripts/sync-ci-plugin-major.mjs",format:'prettier --write "src/**/*.{ts,tsx,js,jsx,json}" "generators/**/*.{ts,tsx,js,jsx,json}"',"format:check":'prettier --check "src/**/*.{ts,tsx,js,jsx,json}" "generators/**/*.{ts,tsx,js,jsx,json}"',lint:"eslint src/ generators/","lint:fix":"eslint src/ generators/ --fix",typecheck:"tsc --noEmit","typecheck:tests":"tsc --noEmit --project tsconfig.test.json","typecheck:scripts":"tsc --noEmit --project tsconfig.scripts.json","typecheck:all":"npm run typecheck && npm run typecheck:tests && npm run typecheck:scripts",test:"vitest run","test:watch":"vitest","test:coverage":"vitest run --coverage","test:integration":"vitest run --config vitest.config.integration.ts","test:integration:watch":"vitest --config vitest.config.integration.ts","test:e2e":"vitest run --config vitest.e2e.config.ts","test:all":"npm run test && npm run test:integration && npm run test:e2e","test:setup":"node scripts/setupTestFixtures.mjs","test:payload-compat":"npx tsx scripts/testPayloadCompatibility.ts","test:payload-compat:e2e":"npx tsx scripts/testPayloadCompatibility.ts --e2e"},engines:{node:">=22.3.0"},author:"",license:"SEE LICENSE IN LICENSE",devDependencies:{"@eslint/js":"^10.0.1","@playwright/test":"^1.62.0","@testing-library/dom":"^10.4.1","@testing-library/react":"^16.3.2","@types/ejs":"^3.1.5","@types/prompts":"^2.4.9","@types/proper-lockfile":"^4.1.4","@types/react":"^19.2.17","@typescript-eslint/parser":"^8.65.0","@vitest/coverage-v8":"^4.1.11","aws-cdk-lib":"^2.265.0",constructs:"^10.7.2",eslint:"^10.8.0","ink-testing-library":"^4.0.0",jsdom:"^30.0.1",prettier:"^3.9.6","react-dom":"^19.2.8","strip-ansi":"^6.0.1","tsc-watch":"^7.2.1",tsx:"^4.23.1","typescript-eslint":"^8.65.0",vitest:"4.1.11"},dependencies:{"@anthropic-ai/sdk":"^0.115.0","@aws-sdk/client-acm":"^3.1098.0","@aws-sdk/client-auto-scaling":"^3.1098.0","@aws-sdk/client-backup":"^3.1098.0","@aws-sdk/client-cloudformation":"^3.1098.0","@aws-sdk/client-cost-explorer":"^3.1098.0","@aws-sdk/client-ec2":"^3.1098.0","@aws-sdk/client-ecr":"^3.1098.0","@aws-sdk/client-ecs":"^3.1098.0","@aws-sdk/client-elasticache":"^3.1098.0","@aws-sdk/client-iam":"^3.1098.0","@aws-sdk/client-identitystore":"^3.1098.0","@aws-sdk/client-lambda":"^3.1098.0","@aws-sdk/client-organizations":"^3.1098.0","@aws-sdk/client-ram":"^3.1098.0","@aws-sdk/client-rds":"^3.1098.0","@aws-sdk/client-route-53":"^3.1098.0","@aws-sdk/client-s3":"^3.1098.0","@aws-sdk/client-secrets-manager":"^3.1098.0","@aws-sdk/client-ssm":"^3.1098.0","@aws-sdk/client-sso":"^3.1098.0","@aws-sdk/client-sso-admin":"^3.1098.0","@aws-sdk/client-sso-oidc":"^3.1098.0","@aws-sdk/client-sts":"^3.1098.0","@fjall/ai-tools":"^39.0.4","@fjall/deploy-core":"^39.0.4","@fjall/generator":"^39.0.4","@fjall/util":"^39.0.4","@opennextjs/aws":"^4.1.0","@smithy/node-http-handler":"^4.9.13","@toon-format/toon":"^4.1.0","aws-cdk":"^2.1134.0",axios:"^1.19.0",chalk:"^6.0.0","cli-cursor":"^5.0.0",commander:"^15.0.0",ejs:"^6.0.1",ink:"^7.1.1","js-yaml":"^5.2.2",open:"^11.0.0",ora:"^9.4.1",prompts:"^2.4.2","proper-lockfile":"^4.1.2",protobufjs:"^8.7.1",react:"^19.2.8",typescript:"^6.0.3","update-check":"^1.5.4",zod:"^4.4.3"}};var VX=Object.defineProperty,KX=(e,t)=>VX(e,"name",{value:t,configurable:!0}),qfe=`fjall-cli/${iL.version} node/${process.versions.node} ${WX()}/${HX()}`;var px=hh(),Qfe=c.looseObject({deviceCode:c.string(),userCode:c.string(),verificationUri:c.string(),expiresIn:c.number(),interval:c.number()}),ehe=c.looseObject({status:c.string(),apiKey:c.string().optional(),organisationId:c.string().optional(),organisationName:c.string().optional(),email:c.string().optional()}),the=c.looseObject({application:c.looseObject({id:c.string()})}),mx=c.looseObject({id:c.string(),name:c.string(),vpcCidr:c.string().nullable(),connectedAwsAccountId:c.string().nullable()}),rhe=c.looseObject({applications:c.array(mx),nextCursor:c.string().optional()}),nhe=c.looseObject({application:mx}),ihe=c.looseObject({applications:c.array(mx)}),ahe=c.looseObject({application:c.looseObject({id:c.string(),name:c.string()})}),ohe=c.looseObject({primaryRegion:c.string().nullish(),secondaryRegions:c.array(c.string()).optional(),disasterRecoveryRegion:c.string().nullish(),providerAccounts:c.custom(e=>Array.isArray(e)),ssoSessions:c.record(c.string(),c.looseObject({ssoRegion:c.string(),ssoStartUrl:c.string()})).optional(),rootOidcRoleArn:c.string().nullish(),allowCodemodLlmFallback:c.boolean().optional(),postureStrict:c.boolean().optional(),rootAccessManagement:c.custom(e=>typeof e=="string").optional(),requireTrackedDeploys:c.boolean().optional().catch(void 0)}),she=c.looseObject({id:c.string(),token:c.string(),tokenPrefix:c.string(),name:c.string(),scopes:c.array(c.string())}),ZX=c.looseObject({id:c.string(),name:c.string(),tokenPrefix:c.string(),scopes:c.array(c.string()),resourceConstraints:c.record(c.string(),c.unknown()),sourceTag:c.string().nullable(),expiresAt:c.string(),createdAt:c.string(),revokedAt:c.string().nullable(),revokedReason:c.string().nullable(),lastUsedAt:c.string().nullable(),usageCount:c.number(),deniedCount:c.number()}),che=c.looseObject({tokens:c.array(ZX)}),uhe=c.looseObject({scopes:c.array(c.string()),expiresAt:c.string().optional()}),XX=c.looseObject({id:c.string(),awsAccountId:c.string(),accountName:c.string().nullable(),environment:c.string().nullable()}),lhe=c.looseObject({accounts:c.array(XX)}),JX=c.looseObject({id:c.string(),assetIdentifier:c.string(),name:c.string(),type:c.string(),status:c.string(),region:c.string().nullish(),_count:c.looseObject({complianceIssues:c.number()}).optional()}),YX=c.looseObject({id:c.string(),name:c.string(),assetIdentifier:c.string(),provider:c.string(),type:c.string(),status:c.string(),region:c.string().nullish(),iacStatus:c.string().nullish(),accountId:c.string().nullish(),estimatedMonthlyCost:c.string().nullish(),lastSeenAt:c.string().nullish(),createdAt:c.string().nullish(),updatedAt:c.string().nullish()}),dhe=c.looseObject({assets:c.array(JX),nextCursor:c.string().optional()}),phe=c.looseObject({asset:YX}),qX=c.looseObject({id:c.string(),ruleId:c.string(),title:c.string(),severity:c.string(),status:c.string()}),mhe=c.looseObject({issues:c.array(qX)}),fhe=c.record(c.string(),c.unknown()),hhe=c.union([c.array(c.record(c.string(),c.unknown())),c.record(c.string(),c.unknown())]),ghe=c.record(c.string(),c.unknown()),yhe=c.record(c.string(),c.unknown()),vhe=c.record(c.string(),c.unknown()),She=c.record(c.string(),c.unknown()),bhe=c.looseObject({deployment:c.looseObject({id:c.string()}),minCliVersion:c.string().optional()});var QX=c.object({id:c.string(),releaseNumber:c.number().int(),status:c.string(),commitSha:c.string().nullable(),branch:c.string().nullable(),createdAt:c.string(),assemblyDigest:c.string().nullable(),createdByDeploymentId:c.string().nullable(),rollbackOfReleaseId:c.string().nullable(),services:c.array(Gf.strip())}),Ehe=c.object({releases:c.array(QX),currentReleaseId:c.string().nullable(),nextCursor:c.number().int().optional()}),eJ=c.object({id:c.string(),status:c.string(),target:c.string().nullish(),applicationId:c.string().nullish(),applicationName:c.string().nullish(),connectedAwsAccountId:c.string().nullish(),source:c.string().nullish(),startedAt:c.string().nullish(),triggeredByName:c.string().nullish(),machineLabel:c.string().nullish()}),_he=c.object({deployments:c.array(eJ)}),Ahe=c.object({cancelled:c.boolean(),message:c.string().nullish(),declined:c.boolean().nullish()}),xhe=c.object({released:c.literal(!0),id:c.string().nullish()}),The=c.looseObject({organisationId:c.string(),organisationName:c.string(),organisationSlug:c.string().min(1).optional()}),Che=c.looseObject({status:c.string(),roleArn:c.string().optional(),accountId:c.string().optional(),phase:c.string().optional(),reason:c.string().optional()}),Ihe=c.looseObject({token:c.string()}),tJ=c.looseObject({quickCreateUrl:c.string(),externalId:c.string()}),rJ=c.looseObject({alreadyConnected:c.literal(!0),account:c.looseObject({awsAccountId:c.string(),accountName:c.string().nullable(),status:c.string()})}),Dhe=c.union([rJ,tJ]);function nJ(e){return"alreadyConnected"in e&&e.alreadyConnected===!0}KX(nJ,"isAlreadyConnected");var Nhe=c.looseObject({registered:c.boolean(),repository:c.looseObject({id:c.string()}).optional()});var iJ=Object.defineProperty,aL=(e,t)=>iJ(e,"name",{value:t,configurable:!0});function oL(e=px){return`${e}/settings/ci`}aL(oL,"deployTokenMintUrl");function ll(e=px){return`Deploy tokens are minted from a signed-in browser session by an owner or admin: open ${oL(e)} (Settings \u2192 CI/CD Tokens).`}aL(ll,"deployTokenMintGuidance");var sL=[{command:"ci status",match:N.success,templates:["Run `fjall ci verify` to check the rest of the wiring \u2014 an active deploy token is necessary, not sufficient","Run `fjall ci token list` to see which applications, environments and accounts each active token may deploy to"]},{command:"ci status",match:N.empty,templates:[ll(),"Run `fjall ci setup --plan --app <app>` to learn where the workflow file will go and which secret name it will read (`workflowPath`, `secretName`) \u2014 the two things needed to stage the secret before minting. `--plan` writes nothing, and the workflow BODY is printed on the human surface only: it is not a field of the agent payload"]},{command:"ci token list",match:N.success,templates:["Run `fjall token show <id>` to inspect one token's stored constraints","Run `fjall ci token revoke <id> --reason <text>` to revoke a listed token"]},{command:"ci token list",match:N.empty,templates:[ll(),"Run `fjall ci status` to re-check readiness once a token exists"]},{command:"ci token revoke",match:N.success,templates:["Run `fjall ci token list` to confirm the token now lists as revoked \u2014 a revoked token stays listed, it does not disappear",`Any CI job still holding this token now fails to authenticate. ${ll()}`]}];var gh="Do not retry or vary flags: `supported: false` is the server's capability verdict, not an input error \u2014 every invocation answers the same until the Fjall server is updated to a version that ships this API (the `message` field names the upgrade)",cL=[{command:"deployments list",match:N.unsupported,templates:[gh]},{command:"deployments cancel",match:N.unsupported,templates:[gh]},{command:"deployments force-release",match:N.unsupported,templates:[gh]},{command:"dev list",match:N.unsupported,templates:[gh]},{command:"deployments list",match:N.success,templates:["Run `fjall deployments cancel <id>` to request co-operative cancellation of a listed deployment","Run `fjall deploy logs --deployment-id <id>` to read one deployment's logs"]},{command:"deployments cancel",match:N.success,templates:["Run `fjall deployments list` to confirm whether the slot is free, and read `cancelled` and `declined` before assuming it is: `cancelled: false` means the request was refused, `declined: true` is an already-terminal reject, and a plain granted cancel is co-operative \u2014 the deployment has to acknowledge it","Run `fjall deployments force-release <id> --confirm <id>` to clear a slot that stays occupied (organisation admin, audited \u2014 retype the id in `--confirm`)"]},{command:"deployments force-release",match:N.success,templates:["Run `fjall deployments list` to confirm the slot is free","Run `fjall deploy <app>` to retry the deployment the wedged slot was blocking"]},{command:"dev up",match:N.success,templates:["Run `fjall dev list <app>` to see every slot for this app with its `host` \u2014 rows carry `host`, not a full URL, and it is empty until the slot leaves `creating`","Run `fjall dev down <app> --branch <branch>` to tear this slot down"]},{command:"dev list",match:N.success,templates:["Run `fjall dev down <app> --branch <branch>` to tear one listed slot down \u2014 every row carries the `branch` to name here","Run `fjall dev up <app> --branch <branch>` to bring another branch up"]},{command:"dev down",match:N.success,templates:["Run `fjall dev list <app>` to see which slots remain","Run `fjall dev up <app> --branch <branch>` to bring the branch back up"]},{command:"dev substrate down",match:N.success,templates:["Run `fjall dev list <app>` to confirm no slot survives \u2014 the substrate will not tear down under live slots, and `--force` takes them with it","Any `residuals` row survives the teardown and can still cost: its `cleanupHint` names the manual step"]}];var uL=["Run `fjall domain deploy <name>` to deploy the domain","Run `fjall domain verify <name>` to check DNS delegation once it is deployed","Run `fjall domain export <name>` to export the live zone records"],lL=[{command:"org deploy",match:N.success,templates:["Run `fjall org get` to review the deployed organisation topology and accounts",`Run \`${ne.accountDeploy}\` to deploy the account tier if you passed \`--no-cascade\``,`Run \`${ne.createApplicationAgent} --name "<name>"\` to create an application to deploy into it`]},{command:"org deploy",match:N.error,templates:["Run `fjall org get` to see which tier of the cascade is already deployed",`Run \`${ne.organisationDeploy} --no-cascade\` to retry the organisation stack alone`]},{command:"platform deploy",match:N.success,templates:[`Run \`${ne.accountDeploy}\` to deploy the account tier on top of it`]},{command:"platform deploy",match:N.error,templates:["Run `fjall org get` to check the organisation tier is deployed first"]},{command:"account deploy",match:N.success,templates:["Run `fjall apps list` to see which applications are registered","Run `fjall deploy <application>` to deploy one into this account"]},{command:"account deploy",match:N.error,templates:["Run `fjall org get` to confirm the account is registered in the organisation",`Run \`${ne.accountDeploy} --target <target>\` to select a specific member account`]},{command:"domain list",match:N.success,templates:["Run `fjall domain verify <name>` to check DNS delegation","Run `fjall domain export <name>` to export zone file","Run `fjall create domain --name <name>` to create a new domain"]},{command:"domain list",match:N.empty,templates:['Run `fjall create domain --name "<name>"` to create a domain',"Run `fjall domain import <name>` to import from Route53"]},{command:"domain verify",match:N.success,templates:["Run `fjall domain export <name>` to export zone file","Run `fjall domain deploy <name>` to deploy domain infrastructure"]},{command:"domain verify",match:N.error,templates:["Run `fjall domain verify <name>` to retry","Run `fjall domain list` to see existing domains"]},{command:"domain export",match:N.success,templates:["Run `fjall domain verify <name>` to check delegation","Run `fjall domain import <name>` to re-import from Route53"]},{command:"domain import",match:N.success,templates:["Run `fjall domain verify <name>` to check delegation","Run `fjall domain export <name>` to see the zone file","Run `fjall domain deploy <name>` to deploy domain infrastructure"]},{command:"domain import",match:N.error,templates:["Run `fjall domain import --hosted-zone-id <id>` to import by zone ID","Run `fjall domain list` to see existing domains"]},{command:"domain records list",match:N.success,templates:["Run `fjall domain sync <domain>` for the full zone-hygiene report","Run `fjall domain sync <domain> --fix` to remediate residue records via the destruction ceremony"]},{command:"domain records list",match:N.empty,templates:["Run `fjall domain deploy <domain>` to deploy the domain's declared records","Run `fjall domain list` to see existing domains"]},{command:"domain records list",match:N.error,templates:["Run `fjall domain records list <domain> --hosted-zone-id <id>` when the zone is not resolvable by name",`Run \`${ne.connect}\` if AWS credentials are missing`]},{command:"domain sync",match:N.success,templates:["Run `fjall domain sync <domain> --fix` to remediate residue records (ceremony-gated)","Run `fjall domain records list <domain>` to see every record with its owner"]},{command:"domain sync",match:N.error,templates:["Run `fjall domain sync <domain> --hosted-zone-id <id>` when the zone is not resolvable by name","Run `fjall domain list` to see existing domains"]},{command:"domain delegate",match:N.success,templates:["Run `fjall domain verify <domain>` to confirm public DNS resolution","Run `fjall domain deploy <domain>` to continue a two-phase deploy after delegation"]},{command:"domain delegate",match:N.error,templates:["Run `fjall domain deploy <parent-domain>` so the parent publishes its DelegationRole","Run `fjall domain verify <domain> --show-delegation` for registrar instructions"]},{command:"domain destroy",match:N.success,templates:["Run `fjall domain list` to see remaining domains","Run `fjall domain sync <parent-domain>` to confirm no delegation residue remains"]},{command:"domain destroy",match:N.error,templates:["Run `fjall domain destroy <domain> --remediate '<name>'=recreate` with the exact consent the ticket names","Run `fjall domain list` to see existing domains"]},{command:"domain deploy",match:N.success,templates:["Run `fjall domain verify <domain>` to check DNS propagation","Run `fjall domain delegate <domain>` to write the NS delegation for a delegated child"]},{command:"domain deploy",match:N.error,templates:["Run `fjall domain deploy <domain>` to resume \u2014 the zone phase is retained and skipped on re-run","Run `fjall domain verify <domain> --show-delegation` for registrar delegation instructions"]},{command:"domain eject",match:N.success,templates:["Review the ejected infrastructure.ts \u2014 it is now vanilla CDK owned by you","Run `fjall domain list` to see remaining managed domains"]},{command:"create domain",match:N.success,templates:uL},{command:"domain create",match:N.success,templates:uL},{command:"create domain",match:N.error,templates:["Run `fjall domain list` to see existing domains",'Run `fjall create domain --name "<name>"` to retry with a different name']},{command:"create account",match:N.success,templates:[`Run \`${ne.connect} --environment production\` to link your AWS account`,`Run \`${ne.accountDeploy}\` to deploy account infrastructure (after connecting)`]},{command:"create account",match:N.error,templates:[`Run \`${ne.createAccount} --primary-region <region>\` to retry`,`Run \`${ne.createAccount} --help\` for usage information`]},{command:"create org",match:N.success,templates:[`Run \`${ne.connect} --name "<account-name>" --region <region>\` to link the AWS Organizations management account \u2014 omit \`--environment\` so it registers at the organisation tier`,`Run \`${ne.organisationDeploy}\` to deploy all infrastructure (after connecting)`]},{command:"create org",match:N.error,templates:[`Run \`${ne.createOrganisation} --email "<email>"\` to retry (add \`--name "<name>"\` only for a brand-new organisation)`,`Run \`${ne.createOrganisation} --help\` for all options`]},{command:"restore",match:N.successDryRun,templates:["Run `fjall restore <resourceType> --recovery-point <recoveryPointArn> --yes` to initiate restore","Run `fjall apps list` to see existing applications"]},{command:"restore",match:N.success,templates:["Open the AWS Console URL above to monitor restore progress","Run `fjall import` to import the restored resource after completion"]},{command:"restore",match:N.errorWithCode("NOT_FOUND"),templates:["Verify the recovery point ARN is correct and exists in the current region","Run `fjall restore <resourceType> --recovery-point <arn>` to retry"]},{command:"restore",match:N.errorWithCode("FORBIDDEN"),templates:["Ensure the IAM role has backup:StartRestoreJob and iam:PassRole permissions","Run `fjall restore` interactively to configure with guided setup"]},{command:"import",match:N.successDryRun,templates:["Run `fjall import --app <app> --resource-id <resourceId> --yes` to import a specific resource","Run `fjall import --app <app> --yes` to import all discovered resources"]},{command:"import",match:N.success,templates:["Run `fjall deploy <app>` to deploy with the imported resource","Run `fjall apps describe <app>` to see updated resources"]},{command:"import",match:N.errorWithCode("NOT_FOUND"),templates:[`Run \`${ne.createApplicationAgent} --name "<app>"\` to create the application`,"Run `fjall apps list` to see existing applications"]},{command:"import",match:N.errorWithCode("VALIDATION_ERROR"),templates:["Run `fjall import --app <app> --resource-id <resourceId>` to import a specific resource","Run `fjall import --app <app> --resource-id <resourceId> --yes` to import immediately"]},{command:"aws exec",match:N.success,templates:["Run `fjall aws exec -- <command...>` to run another AWS CLI command","Run `fjall status` to check application health"]},{command:"aws exec",match:N.error,templates:["Retry the command \u2014 OIDC token mints can fail transiently",`Run \`${ne.login}\` if the retry also fails with an authentication error`]},{command:"unlock bucket",match:N.success,templates:["Re-put sane bucket policy statements (enforceSSL deny, access grants) \u2014 the unlock deleted the ENTIRE policy","Run `fjall destroy <app>` to retry the blocked stack cleanup"]},{command:"unlock bucket",match:N.error,templates:["Ensure your credentials belong to the organisation's management account \u2014 STS AssumeRoot is rejected elsewhere","Run `fjall unlock bucket <name> --account <id> --acknowledge-root-session` to retry"]}];var aJ=c.object({entity:c.enum(["application","deployment","asset","account"]).describe("What to query"),id:c.string().optional().describe("Specific entity ID for detail fetch"),applicationId:c.string().optional().describe("Filter by application (deployments only)"),status:c.string().optional().describe("Status filter (deployments: queued/pending/running/succeeded/failed)"),limit:c.number().int().min(1).max(100).optional().describe("Max results (default varies by entity)")}).strict();var oJ=c.object({mode:c.enum(["issues","counts","summary"]).describe("issues: list findings; counts: breakdown by severity; summary: compliance score and overview"),severity:c.enum(["critical","high","medium","low"]).optional().describe("Filter by severity (issues mode)"),status:c.enum(Ts).optional().describe("Filter by status (issues mode)"),limit:c.number().int().min(1).max(50).optional().describe("Max results for issues mode (default 20)")}).strict();var sJ=c.object({mode:c.enum(["summary","trend","forecast","attribution","per_request","per_deployment","month_to_date"]).default("summary").describe("summary: total + by-service (default); trend: daily with period comparison; forecast: linear regression projection; attribution: service breakdown; per_request/per_deployment: cost ratios for an app; month_to_date: MTD total"),applicationId:c.string().optional().describe("Required for per_request, per_deployment, and app-specific month_to_date"),days:c.number().int().min(1).max(90).optional().describe("Lookback period (default 30)"),forecastDays:c.number().int().min(1).max(30).optional().describe("Forecast horizon, only for forecast mode (default 7)")}).strict();var cJ=c.object({mode:c.enum(["time_series","latest","sparklines","org_summary"]).default("latest").describe("time_series: metric values over time for an app; latest: current metrics (default); sparklines: hourly mini-trends; org_summary: org-wide aggregates"),applicationId:c.string().optional().describe("Required for time_series"),hours:c.number().int().min(1).max(168).optional().describe("Lookback hours (default 24)"),limit:c.number().int().min(1).max(500).optional().describe("Max data points for time_series (default 100)")}).strict();var uJ=["stats","compliance","costs","deployments"],lJ=c.object({sections:c.array(c.enum(uJ)).optional().describe("Which sections to include (default: all). Omit sections for faster response.")}).strict();var dJ=c.object({applicationId:c.string().describe("Application experiencing the error"),errorPattern:c.string().optional().describe("Error message or pattern to search for"),deploymentId:c.string().optional().describe("Deployment that may have introduced the error"),hours:c.number().int().min(1).max(168).optional().describe("Lookback window in hours (default 24)")}).strict();var pJ=c.object({deploymentIdA:c.string().describe("First deployment ID (typically older)"),deploymentIdB:c.string().describe("Second deployment ID (typically newer)")}).strict();var dl=c.enum(["compliance","cost","performance"]),mJ=c.object({domain:dl.describe("What type of issue to remediate"),applicationId:c.string().optional().describe("Specific application context"),issueId:c.string().optional().describe("Specific compliance issue ID for targeted advice")}).strict();var dL=c.enum(["count","rate","duration_ms","bytes","currency","percent"]),fJ=c.object({kind:c.enum(["timeseries","bar","categoryBar"]),title:c.string().optional(),series:c.array(c.object({id:c.string(),label:c.string(),kind:dL,data:c.array(c.object({x:c.number().describe("Unix timestamp in milliseconds, or numeric value"),y:c.number().nullable()}).strict())}).strict()).optional().describe("Series data for timeseries and bar charts"),data:c.array(c.object({label:c.string(),value:c.number()}).strict()).optional().describe("Category data for categoryBar charts"),unit:dL.optional(),stacked:c.boolean().optional(),areaFill:c.boolean().optional()}).strict();var hJ=c.object({applicationId:c.string().describe("The application ID to deploy"),environment:c.string().optional().describe("Target environment (e.g. production, staging)"),branch:c.string().optional().describe("Git branch to deploy from (defaults to repository default)")}).strict();var gJ=c.object({operation:c.enum(["set","delete","list"]).describe("Operation to perform. Note: get is intentionally omitted \u2014 secret values are never exposed."),applicationId:c.string().describe("The application whose AWS account holds the secrets"),app:c.string().min(1).optional().describe("Deprecated and ignored \u2014 the app segment is derived from applicationId"),cluster:c.string().min(1).optional().describe("SSM namespace cluster component"),service:c.string().min(1).optional().describe("SSM namespace service component"),lambda:c.string().min(1).optional().describe("SSM namespace lambda function component (mutually exclusive with cluster and service)"),name:c.string().min(1).optional().describe("Secret name (required for set and delete operations)"),value:c.string().max(4096).optional().describe("Secret value (required for set operation)")}).strict().refine(e=>!(e.service&&!e.cluster),{message:"Cluster is required when service is specified"}).refine(e=>!(e.lambda&&(e.cluster||e.service)),{message:"Lambda is mutually exclusive with cluster and service"}).refine(e=>e.cluster!=="lambda",{message:'The cluster name "lambda" is reserved for lambda-scoped parameter paths'});var yJ=c.object({applicationId:c.string().describe("Application to update"),name:c.string().min(1).max(100).optional().describe("New application name"),description:c.string().max(500).optional().describe("New application description"),configPath:c.string().max(500).optional().describe("New IaC configuration path")}).strict().refine(e=>e.name!==void 0||e.description!==void 0||e.configPath!==void 0,{message:"At least one of 'name', 'description', or 'configPath' must be provided"});var vJ=c.object({operation:c.enum(["list","records_list","sync_report","verify","mutation_commands","add","remove"]).describe("list: declared domains with live zone/stack status; records_list: every live record with its ownership classification (declared/satellite/residue/unknown; satellite includes a delegated child's domain stack in another AWS account; unknown is NEVER remediable; classification fails closed); sync_report: the same classification grouped per class as a read-only report (never deletes anything); verify: DNS nameserver delegation check; mutation_commands: the exact ceremony-gated CLI commands for the mutations this tool never performs. add/remove are deprecated aliases of mutation_commands."),domain:c.string().min(1).max(253).optional().describe("Domain (hosted zone) name \u2014 required for records_list, sync_report, and verify; optional context for mutation_commands")}).strict().refine(e=>!((e.operation==="records_list"||e.operation==="sync_report"||e.operation==="verify")&&e.domain===void 0),{message:"domain is required for records_list, sync_report, and verify operations"});var SJ=c.object({region:c.string().describe("AWS region code to add, e.g. 'ap-southeast-2'"),connectedAwsAccountId:c.string().optional().describe("Target connected-account id; only needed when the organisation has no organisation-tier account and multiple accounts are connected")}).strict();var bJ=Object.defineProperty,hL=(e,t)=>bJ(e,"name",{value:t,configurable:!0}),pL="Run `fjall connect status` to check that an AWS account is connected: asset discovery only inventories connected accounts, so an organisation with none has nothing to inventory",mL=["Run `fjall assets show <asset>` to read one asset in full \u2014 pass its `assetIdentifier`","Run `fjall assets compliance <asset>` to list an asset's recorded posture issues \u2014 pass its `assetIdentifier`, the address every server version accepts"],fL=hL(e=>e.outcome==="success"&&e.nextCursor!==void 0,"isTruncatedPage"),gL=[{command:"assets list",match:hL(e=>fL(e)&&e.fields!==void 0&&e.fields!=="","match"),templates:["This window is truncated \u2014 more assets exist beyond these rows. Run `fjall assets list --cursor <nextCursor> --fields <fields>` to fetch the next page with the same projection; `total` counts this window only, and `fjall assets summary` reports the estate-wide tally, split active/deleted",...mL]},{command:"assets list",match:fL,templates:["This window is truncated \u2014 more assets exist beyond these rows. Run `fjall assets list --cursor <nextCursor>` to fetch the next page; `total` counts this window only, and `fjall assets summary` reports the estate-wide tally, split active/deleted",...mL]},{command:"assets list",match:N.success,templates:["The `total` aggregate counts the rows in this response, not the estate: `--take` bounds the window (default 50). No `nextCursor` aggregate here means the estate ends with these rows; `fjall assets summary` reports the estate-wide tally, split active/deleted","Run `fjall assets show <asset>` to read one asset in full","Run `fjall assets compliance <asset>` to list an asset's recorded posture issues \u2014 pass its `assetIdentifier`, the address every server version accepts (row `id`s are only accepted by newer servers)"]},{command:"assets list",match:N.empty,templates:["Run `fjall assets list --status deleted` to include assets discovery has since marked deleted \u2014 the default listing hides them",pL]},{command:"assets show",match:N.success,templates:["Run `fjall assets compliance <asset>` to list the posture issues recorded against this asset","Run `fjall assets show <asset> --fields id,accountId,iacStatus,estimatedMonthlyCost,lastSeenAt` to read the fields the default projection omits"]},{command:"assets compliance",match:N.success,templates:["Read the `status` column before acting: this listing returns every issue recorded against the asset, `resolved` and `suppressed` included, where the `openIssues` count on `fjall assets list` counts only the open ones",`Run \`fjall compliance fix --domain compliance --issue-id <issueId>\` to read this issue in full alongside the organisation's other open issues. \`--domain\` is the producer's category \u2014 one of ${dl.options.join(", ")} \u2014 not a framework name, and the response is context to reason from, not a remediation step: use \`--execute\` to run one`,"Run `fjall assets show <asset>` to read the asset these issues were raised against"]},{command:"assets compliance",match:N.empty,templates:["No issue of ANY status has been recorded against this asset \u2014 an empty listing here is not the same as issues that were resolved, which would still appear with `status: resolved`","Run `fjall assets list --fields name,assetIdentifier,openIssues` to find the assets that do carry open issues"]},{command:"assets summary",match:N.success,templates:["Run `fjall assets list --fields name,assetIdentifier,openIssues` to see which assets sit behind `withIssues` \u2014 `withIssues` counts the assets carrying at least one open issue, `openIssues` counts those issues per asset","Run `fjall assets list --take <n>` to read the rows behind these totals \u2014 page onwards with `--cursor` when the listing reports a `nextCursor`, and pass `--status deleted` to include the `deleted` rows in the listing (interleaved with active \u2014 read the `status` column). These totals are estate-wide (the summary pages the listing to exhaustion, deleted assets included): `total` counts the whole estate, `active` and `deleted` split it"]},{command:"assets summary",match:N.empty,templates:[pL]},{command:"costs show",match:N.success,templates:["Run `fjall costs --mode forecast` to see forecasted spend","Run `fjall costs --mode breakdown` to see service-level breakdown"]},{command:"costs show",match:N.error,templates:["Run `fjall costs --app <app>` to filter by application","Run `fjall costs --help` for usage information"]},{command:"metrics show",match:N.success,templates:["Run `fjall metrics --mode latency` to see latency percentiles","Run `fjall metrics --mode errors` to see error trends"]},{command:"metrics show",match:N.error,templates:["Run `fjall metrics --app <app>` to filter by application","Run `fjall metrics --help` for usage information"]},{command:"compliance fix",match:N.success,templates:["Run `fjall compliance fix --domain <domain> --issue-id <id>` to narrow the suggestions to one issue","Run `fjall deploy <app>` to apply remediation changes"]},{command:"compliance fix",match:N.error,templates:[`Run \`fjall compliance fix --domain <domain>\` to name the issue domain \u2014 one of ${dl.options.join(", ")}, not a framework name`,"Run `fjall compliance --help` for usage information"]},{command:"compliance fix --execute",match:N.success,templates:["Read the result's `kind` before treating the issue as fixed: `auto-pr` opened a pull request that still has to be merged, `imperative` rewrote the live policy, and `manual-hint` changed nothing \u2014 its `awsCliHint` carries the manual step, and that field is absent for rules that supply no hint (`message` is a fixed string either way)","Do not re-read the issue to confirm the cure: nothing on the remediation path writes to the issue record, so `status` stays `open` until the next discovery scan re-evaluates the asset. Verify at the thing that changed \u2014 the pull request, or the live resource","Run `fjall deploy <app>` to roll out an `auto-pr` remediation once its pull request is merged"]},{command:"deploy diff",match:N.success,templates:["Run `fjall deploy logs --deployment-id <id>` to analyse deployment logs","Run `fjall status <app>` to check current deployment health"]},{command:"deploy diff",match:N.error,templates:["Run `fjall list deployments` to see recent deployment IDs","Run `fjall deploy diff --help` for usage information"]},{command:"deploy logs",match:N.success,templates:["Run `fjall deploy diff <idA> <idB>` to compare two deployments","Run `fjall status <app>` to check current deployment health"]},{command:"deploy logs",match:N.error,templates:["Run `fjall deploy logs --deployment-id <id>` with a valid deployment ID","Run `fjall list deployments` to find a deployment ID"]}];var EJ={command:"*",match:N.error,templates:["Run `fjall <command> --help` for usage information"]},yL=[...FM,...UM,...zM,...sL,...cL,...lL,...gL,EJ];var _J=Object.defineProperty,AJ=(e,t)=>_J(e,"name",{value:t,configurable:!0}),vL=["app","environment","region","profile","target","cluster","service","lambda","status","type"],ja=["app","cluster","service","lambda","target"],xJ=["status","type","region"],fx={deploy:["environment","region","target"],"deploy diff":[],"deploy logs":[],destroy:["target"],"org deploy":["target"],"org destroy":["target"],"platform deploy":["target"],"platform destroy":["target"],"account deploy":["target"],"account destroy":["target"],status:[],rollout:[],list:["app"],apps:["target"],connect:["environment","region"],"connect status":[],import:["app","region"],costs:["app"],metrics:["app"],compliance:["app"],"token create":["app","environment"],"unlock bucket":["region"],"aws exec":["app","region","target"],"secrets set":ja,"secrets get":ja,"secrets list":ja,"secrets delete":ja,"secrets export":ja,"secrets import":ja,"secrets exec":ja,"assets list":xJ},TJ=Math.max(...Object.keys(fx).map(e=>e.split(" ").length));function hx(e){let t=e.trim().split(/\s+/).slice(1);for(let r=TJ;r>=1;r--){let i=t.slice(0,r).join(" ");if(Object.hasOwn(fx,i))return fx[i]}return[]}AJ(hx,"resolvePreservableFlags");var CJ=Object.defineProperty,vh=(e,t)=>CJ(e,"name",{value:t,configurable:!0});function gx(e){let t=e.replace(/[\u0000-\u001f\u007f`]/g,"");return/[^\w@%+=:,./-]/.test(t)?`'${t.replace(/'/g,"'\\''")}'`:t}vh(gx,"shellEscape");function SL(e,t,r){let i=new Set,n=e.replace(/<(\w+)>/g,(a,o)=>{let s=t[o];return s===void 0||s===""?`<${o}>`:(i.add(o),o==="command"?s:gx(s))});return bL(n,r,i)}vh(SL,"interpolateTemplate");var yh=class{static{vh(this,"SuggestionResolver")}command;flags;constructor(t,r){this.command=t,this.flags=r}resolve(t){let r=yL.find(i=>(i.command===this.command||i.command==="*")&&i.match(t));return r===void 0?[]:r.templates.map(i=>SL(i,t,this.flags))}};function bL(e,t,r=new Set){let i=/`(fjall[^`]*)`/.exec(e),n=i?.[1];if(i===null||n===void 0)return e;let a=hx(n),o=[];for(let d of vL){if(!a.includes(d))continue;let g=t[d];g!==void 0&&g!==""&&!r.has(d)&&!n.includes(`--${d}`)&&o.push(`--${d} ${gx(g)}`)}if(o.length===0)return e;let s=` ${o.join(" ")}`,u=n.indexOf(" -- "),p=u===-1?`${n}${s}`:`${n.slice(0,u)}${s}${n.slice(u)}`;return e.slice(0,i.index)+`\`${p}\``+e.slice(i.index+i[0].length)}vh(bL,"applyPreservedFlags");var IJ=Object.defineProperty,ii=(e,t)=>IJ(e,"name",{value:t,configurable:!0});function an(e,t){if(t!==void 0&&Os(e)){let i={};for(let[n,a]of Object.entries(e))i[n]=t.has(n)?a:an(a);return i}if(typeof e=="string")return K(e);if(e==null||typeof e!="object")return e;if(Array.isArray(e))return e.map(i=>an(i));if(e instanceof Date||e instanceof RegExp)return e;let r={};for(let[i,n]of Object.entries(e))r[i]=an(n);return r}ii(an,"maskTree");function Sh(e){if(Array.isArray(e))return e.map(Sh);if(!Os(e))return e;let t={};for(let[r,i]of Object.entries(e))i!==void 0&&(t[r]=Sh(i));return t}ii(Sh,"stripAbsent");function Os(e){return typeof e=="object"&&e!==null&&!Array.isArray(e)&&!(e instanceof Date)&&!(e instanceof RegExp)}ii(Os,"isPlainRecord");function EL(e){let t=e?.verbatimFields;return t!==void 0&&t.length>0?new Set(t):void 0}ii(EL,"toVerbatimKeys");function _L(e,t){return t===void 0||!Os(e)?!1:Object.keys(e).some(r=>t.has(r))}ii(_L,"carriesVerbatimField");function AL(e,t){let r=e;for(let i of t.split(".")){if(!Os(r))return;r=r[i]}return r}ii(AL,"resolveDotPath");function xL(e,t,r){let i=e.project(t),n={};for(let a of r)a in i&&(n[a]=i[a]);return n}ii(xL,"projectSelectedFields");var pl=class{static{ii(this,"AgentOutputWriter")}write;hasWrittenBlock=!1;resolver;flags;full;budget;requestedFields;constructor(t){this.write=t.writeFn??(r=>{process.stdout.write(r)}),this.resolver=new yh(t.command,t.flags),this.flags=t.flags,this.full=t.full??!1,this.budget=t.budget,this.requestedFields=t.fields??[]}get isFullOutput(){return this.full}writeBlock(t){t!==""&&(this.hasWrittenBlock&&this.write(B0+`
 `),this.hasWrittenBlock=!0,this.write(t))}renderResult(t,r){let i=EL(r?.schema),n=an(t,i),a=r?.schema!==void 0&&Os(n)?this.applySchema(n,r.schema):n,o=G0(a),s=this.resolveHelp(r?.suggestionContext),u=o+s+`
 `;this.writeBlock((_L(a,i)?u:nh(u,this.budget))+ks())}renderListResult(t,r,i){let n=t.map(p=>an(p)),a=i.fields,o=a!==void 0&&a.length>0?a:r.fields,s=V0(n,{fields:o,project:ii(p=>xL(r,p,o),"project")},{entity:i.entity,aggregates:i.aggregates===void 0?void 0:an(i.aggregates)}),u=this.resolveHelp(i.suggestionContext);this.writeBlock(nh(s+u+`
 `,this.budget)+ks())}renderEvent(t){let r=an(t),i=H0({...r,value:Sh(r.value)});this.writeBlock(i)}renderError(t,r){let i={...t,message:K(t.message),...t.details!==void 0?{details:an(t.details)}:{}},n=K0(i),a=this.resolveHelp(r);this.writeBlock(n+a+`
@@ -316,7 +316,7 @@ ${B0}
 `)}Vi(w9,"writeResult");function P9(e){process.stdout.write(`${e}
 `)}Vi(P9,"writeValue");function Dh(e){process.stderr.write(`${Ox(e,js!==!1)}
 `)}Vi(Dh,"writeNote");function O9(e){Dh(e),al()}Vi(O9,"writeFailure");function $9(){let e=Ls===!1?0:Ls.level,t=js===!1?0:js.level;HL.level=Math.max(e,t)}Vi($9,"alignColourLevel");function Px(e){return new Promise(t=>{e.write("",()=>t())})}Vi(Px,"drain");async function M9(){await Promise.all([Px(process.stdout),Px(process.stderr)])}Vi(M9,"drainOutputStreams");var L9=Object.defineProperty,Lx=(e,t)=>L9(e,"name",{value:t,configurable:!0});function Mx(){let e=_x();return e==="agent"||e==="mcp"}Lx(Mx,"isStructuredOutputMode");function XL(){return Is.isUIMode||Is.isNonInteractive}Lx(XL,"surfaceOwnsConsole");var Nh=class e{static{Lx(this,"Logger")}static instance=null;config;debugEnabled;traceEnabled;minLevel;fileWriter;mainLogPath;debugLogPath;constructor(){let t=yl(),r=$x(t,"debug"),{maxFileSize:i,maxFiles:n}=Tx();this.config={logDir:t,debugLogDir:r,maxFileSize:i,maxFiles:n,maxBufferSize:En.MAX_BUFFER_SIZE,flushIntervalMs:En.FLUSH_INTERVAL_MS},this.mainLogPath=$x(t,En.LOG_FILENAME),this.debugLogPath=$x(r,En.DEBUG_LOG_FILENAME),this.debugEnabled=process.env.FJALL_DEBUG==="true"||process.env.FJALL_TRACE==="true"||process.argv.includes("--verbose")||process.argv.includes("-v"),this.traceEnabled=process.env.FJALL_TRACE==="true";let a=process.env.FJALL_LOG_LEVEL?.toLowerCase();a&&a in Gi?this.minLevel=a:this.traceEnabled?this.minLevel="trace":this.debugEnabled?this.minLevel="debug":this.minLevel="info",this.fileWriter=new Ah(this.config,this.mainLogPath,this.debugLogPath,this.debugEnabled)}static getInstance(){return e.instance||(e.instance=new e),e.instance}shouldLog(t){return Gi[t]>=Gi[this.minLevel]}createEntry(t,r,i,n,a,o,s){return{timestamp:new Date().toISOString(),level:t,component:r,message:i,...a&&{correlationId:a},...n&&Object.keys(n).length>0&&{data:n},...o&&{stackName:o},...s&&{phase:s}}}log(t,r,i,n,a,o,s){if(!this.shouldLog(t))return;let u=this.createEntry(t,r,i,n,a,o,s),p=t==="debug"||t==="trace";this.fileWriter.write(u,p),this.writeConsole(u)}writeConsole(t){if(Mx()||XL()){this.debugEnabled&&this.writeStderrLine(t);return}let r=this.getConsolePrefix(t.level),i=`[${t.component}]`;Dh(K(`${r} ${i} ${t.message}`))}writeStderrLine(t){let r=this.getConsolePrefix(t.level),i=`[${t.component}]`,n="";if(t.data&&Object.keys(t.data).length>0)try{n=` ${JSON.stringify(t.data)}`}catch{n=" [unserialisable data]"}let a=`${r} ${i} ${t.message}${n}`;process.stderr.write(`${K(a)}
-`)}getConsolePrefix(t){switch(t){case"error":return"[ERROR]";case"warn":return"[WARN]";case"info":return"[INFO]";case"debug":return"[DEBUG]";case"trace":return"[TRACE]"}}error(t,r,i){this.log("error",t,r,i)}warn(t,r,i){this.log("warn",t,r,i)}info(t,r,i){this.log("info",t,r,i)}debug(t,r,i){this.log("debug",t,r,i)}trace(t,r,i){this.log("trace",t,r,i)}diagnostic(t,r,i,n){this.log(t,r,i,n),!this.debugEnabled&&Mx()&&(Gi[t]<Gi.info||this.writeStderrLine(this.createEntry(t,r,i,n)))}isDebugEnabled(){return this.debugEnabled}isTraceEnabled(){return this.traceEnabled}enableDebug(){this.debugEnabled=!0,Gi[this.minLevel]>Gi.debug&&(this.minLevel="debug"),this.fileWriter.setDebugEnabled(!0),this.fileWriter.isInitialised&&this.fileWriter.initialiseDebugStream()}withCorrelation(t){return new ml(this,t)}forDeployment(t,r="deploy"){return new xh(this,t,r)}close(){this.fileWriter.close()}async flushAndClose(){await this.fileWriter.closeAndFlush()}getLogPath(){return this.mainLogPath}getDebugLogPath(){return this.debugLogPath}getLogDir(){return this.config.logDir}logWithCorrelation(t,r,i,n,a,o,s){this.log(t,r,i,a,n,o,s)}static reset(){e.instance&&(e.instance.close(),e.instance=null)}};var Rs=Nh.getInstance();var j9=Object.defineProperty,ft=(e,t)=>j9(e,"name",{value:t,configurable:!0}),Fs="fjall";function Ua(e,t){let r=F9(e);if(r.includes("..")||r.startsWith("/"))throw new Error(`Invalid ${t}: path traversal is not allowed`)}ft(Ua,"assertNoTraversal");function U9(){return Fs}ft(U9,"getFjallPath");function B9(e){let t=JL(e);return JL(t)||"."}ft(B9,"getProjectRoot");function QL(e){if(!qL(e))throw new Error(`Infrastructure file not found: ${e}`);let t=YL(e,"utf-8"),r=e1(t);if(r===void 0)throw new Error(`Could not find appName in infrastructure file: ${e}. Expected format: const appName = "yourAppName";`);return r}ft(QL,"getAppNameFromInfrastructure");function e1(e){return e.match(/const\s+appName\s*=\s*["']([^"']+)["']/)?.[1]}ft(e1,"parseAppNameFromInfrastructureContent");function z9(e){if(!qL(e))return;let t;try{t=YL(e,"utf-8")}catch(r){Rs.debug("PathHelpers","Could not read organisation infrastructure",{error:K(We(r))});return}return t.match(/organisationName:\s*(["'])(.+?)\1/)?.[2]}ft(z9,"readOrganisationNameFromInfrastructure");function G9(e){let t=Or(e,Ux);return QL(t)}ft(G9,"getAppName");function jx(e){return Ua(e,"app name"),Or(Fs,e,Ux)}ft(jx,"getInfrastructurePath");function Ba(e){return Ua(e,"app name"),Or(Fs,e)}ft(Ba,"getAppPath");function t1(e,t){let r=e??process.cwd();return t===void 0?r:(Ua(t,"container"),Or(r,t))}ft(t1,"resolveScaffoldRootDir");function V9(e,t,r){return Or(t1(t,r),Ba(e))}ft(V9,"resolveAppScaffoldPath");function K9(e){return Ua(e,"component name"),Or(Fs,e)}ft(K9,"getOrganisationComponentPath");function W9(e){return Ua(e,"deployment type"),Or(Fs,e,"logs")}ft(W9,"getDeploymentLogsPath");function r1(){return Or(Fs,"domains")}ft(r1,"getDomainsDir");function Fx(e){return Ua(e,"domain name"),Or(r1(),e)}ft(Fx,"getDomainComponentPath");function H9(e){return Or(Fx(e),Ux)}ft(H9,"getDomainInfrastructurePath");function Z9(e){return Or(Fx(e),X9)}ft(Z9,"getDomainZoneFilePath");var Ux="infrastructure.ts",X9="zone.bind",J9="cdk.out";function Y9(e){return Or(e,J9)}ft(Y9,"getCdkOutPath");var q9=Object.defineProperty,Q9=(e,t)=>q9(e,"name",{value:t,configurable:!0}),e8=import.meta.dirname;function Bx(e,t,r,i){let n=n1(e8,"..","shared","files"),a=t.includes("/")?t:Ba(t);Nv(e,n,a,r,i),Qc(e,n1(a,".gitignore"),Zu,i)}Q9(Bx,"copySharedCdkFiles");var t8=Object.defineProperty,Us=(e,t)=>t8(e,"name",{value:t,configurable:!0});function i1(e){return e.success===!0}Us(i1,"isSuccess");function a1(e){return e.success===!1}Us(a1,"isFailure");function H(e){return{success:!0,data:e}}Us(H,"success");function $(e){return{success:!1,error:e}}Us($,"failure");async function o1(e){try{let t=await e();return H(t)}catch(t){return $(Mi(t))}}Us(o1,"tryAsync");function s1(e){try{let t=e();return H(t)}catch(t){return $(Mi(t))}}Us(s1,"trySync");var r8=Object.defineProperty,n8=(e,t)=>r8(e,"name",{value:t,configurable:!0}),c1=/^[a-zA-Z][a-zA-Z0-9-]*$/,i8=Fu.source.replace(/^\^|\$$/g,""),ye=Object.freeze({IDENTIFIER:c1,NEW_APP_NAME:/^[a-z][a-z0-9-]*$/,RESOURCE_NAME:/^[a-zA-Z][a-zA-Z0-9]*$/,ECS_SERVICE_NAME:c1,BUCKET_NAME:/^[a-z][a-z0-9-]*[a-z0-9]$|^[a-z][a-z0-9]*$/,DATABASE_NAME:/^[a-zA-Z][a-zA-Z0-9_]*$/,RESOURCE_TYPE:/^[a-z]+(:[a-z]+)?$/,SSM_PATH:new RegExp(`^(?:/${i8})+$`),SECRET_NAME:$f,SSM_COMPONENT:Fu,EMAIL:/^[^\s@]+@[^\s@]+\.[^\s@]+$/,DOCKER_IMAGE:/^[a-z0-9][a-z0-9._-]*[a-z0-9](:[a-z0-9._-]+)?$/,DOMAIN:/^[a-z0-9]([a-z0-9-]*[a-z0-9])?(\.[a-z0-9]([a-z0-9-]*[a-z0-9])?)+$/i,HTTP_ORIGIN:/^https?:\/\/[a-z0-9.-]+(:\d+)?$/i,PASCAL_CASE:/^[A-Z][A-Za-z0-9]*$/,AWS_ACCOUNT_ID:/^\d{12}$/,VPC_ID:/^vpc-[a-z0-9]+$/,ROLE_ARN:/^arn:aws[a-zA-Z-]*:iam::\d{12}:role\/.+$/,CIDR:/^((25[0-5]|2[0-4]\d|1\d\d|[1-9]?\d)\.){3}(25[0-5]|2[0-4]\d|1\d\d|[1-9]?\d)\/(3[0-2]|[12]?\d)$/,SCHEDULE_EXPRESSION:/^(rate\(1 (?:minute|hour|day)\)|rate\((?:[2-9]|[1-9]\d+) (?:minutes|hours|days)\)|cron\([^\s()]+ [^\s()]+ [^\s()]+ [^\s()]+ [^\s()]+ [^\s()]+\))$/,LAMBDA_RUNTIME_IDENTIFIER:/^[A-Za-z0-9._-]+$/,ENV_VAR_NAME:/^[A-Za-z_][A-Za-z0-9_]*$/});function zx(e){let t=/^rate\((\d+) (minute|minutes|hour|hours|day|days)\)$/.exec(e);if(!t)return;let r=t[1],i=t[2];if(r===void 0||i===void 0)return;let n=parseInt(r,10);if(!Number.isFinite(n)||n<1)return;let a=i==="minute"||i==="hour"||i==="day";if(!(a&&n!==1)&&!(!a&&n===1))return i==="minute"||i==="minutes"?{everyMs:n*6e4}:i==="hour"||i==="hours"?{everyMs:n*60*6e4}:{everyMs:n*24*60*6e4}}n8(zx,"parseRateExpression");var u1=["t4g.medium","m7g.medium","m8g.medium","r7g.medium","r8g.medium","m7g.large","m8g.large","r7g.large","r8g.large","m7g.xlarge","m8g.xlarge","r7g.xlarge","r8g.xlarge"];var _=Object.freeze({IDENTIFIER:"Must start with a letter, contain only letters, numbers, and hyphens",NEW_APP_NAME:"Must start with a lowercase letter and contain only lowercase letters, numbers, and hyphens",IDENTIFIER_MIN_LENGTH:"Must be at least 2 characters",IDENTIFIER_NO_TRAILING_HYPHEN:"Must not end with a hyphen",IDENTIFIER_NO_CONSECUTIVE_HYPHENS:"Must not contain consecutive hyphens",RESOURCE_NAME:"Must start with a letter and contain only letters and numbers (PascalCase recommended)",ECS_SERVICE_NAME:"Service name must start with a letter and contain only letters, numbers, and hyphens",BUCKET_NAME:"Bucket name must start with a lowercase letter and contain only lowercase letters, numbers, and hyphens",DATABASE_NAME:"Database name must start with a letter and contain only letters, numbers, and underscores",RESOURCE_TYPE:"Resource type must be in format 'category' or 'category:type'",SSM_PATH:"SSM path must start with / and contain valid namespace segments (e.g., /myapp/ApiCluster/service)",SECRET_NAME:QA,SSM_COMPONENT:Mf,EMAIL:"Please enter a valid email address",DOMAIN:"Please enter a valid domain (e.g., cms.example.com)",DOCKER_IMAGE:"Invalid Docker image name format",REQUIRED:{APP_NAME:"Application name is required",RESOURCE_NAME:"Resource name is required",BUCKET_NAME:"Bucket name is required",SERVICE_NAME:"Service name is required",NETWORK_NAME:"Network name is required",DATABASE_NAME:"Database name is required",ORGANISATION_NAME:"Organisation name is required",EMAIL:"Email is required",NAME:"Name is required",USERNAME:"Username is required",CONTAINER_NAME:"Container name is required",GROUP:"Group is required",PATTERN_NAME:"Pattern name is required",SOURCE:"Source directory is required",BUILD_COMMAND:"Build command is required",OUTPUT_DIR:"Output directory is required",FORMS_TO:"Forms recipient address is required",ROUTING_PATH:"Routing path is required",RESOURCE_REFERENCE:"Resource reference is required",RESOURCE_TYPE:"Resource type is required",VARIANT:"Variant is required",SUBTYPE:"Subtype is required",DEPLOY_TARGET:"Deploy target is required",DESTROY_TARGET:"Destroy target is required",CONNECTED_RESOURCE_NAME:"Connected resource names must not be empty",SSH_ALLOWED_IP_CIDRS:"sshAccess.allowedIpCidrs must list at least one IPv4 CIDR",SSH_KEY_NAME:"sshAccess.keyName must not be empty (omit it to create a key pair)"},MAX_LENGTH:{APP_NAME:"Application name must be 50 characters or less",RESOURCE_NAME:"Resource name must be 63 characters or less",BUCKET_NAME:"Bucket name must be 63 characters or less",SERVICE_NAME:"Service name must be 255 characters or less",NETWORK_NAME:"Network name must be 50 characters or less",DATABASE_NAME:"Database name must be 63 characters or less",ORGANISATION_NAME:"Organisation name must be 50 characters or less"},PORT:{INTEGER:"Port must be an integer",MIN:"Port must be at least 1",MAX:"Port cannot exceed 65535"},USERNAME:{MAX_LENGTH:"Username cannot exceed 63 characters"},LAMBDA:{MEMORY:{INTEGER:"Lambda memory must be an integer",MIN:"Memory must be at least 128 MB",MAX:"Memory cannot exceed 10240 MB",MULTIPLE:"Memory must be 128 MB or a multiple of 64 MB"},TIMEOUT:{INTEGER:"Timeout must be an integer",MIN:"Timeout must be at least 1 second",MAX:"Timeout cannot exceed 900 seconds"},RUNTIME:"Lambda runtime must contain only letters, digits, dots, underscores, or dashes (e.g. 'NODEJS_20_X' or 'nodejs20.x')"},ENV_VAR_NAME:"Environment variable names must start with a letter or underscore and contain only letters, digits, and underscores",PRIORITY:{INTEGER:"Priority must be an integer",MIN:"Priority must be at least 1",MAX:"Priority cannot exceed 50000"},CAPACITY:{MIN:{INTEGER:"Minimum capacity must be an integer",MIN_0:"Minimum capacity must be at least 0",MIN_1:"Minimum capacity must be at least 1",MAX:"Minimum capacity cannot exceed 100"},MAX:{INTEGER:"Maximum capacity must be an integer",MIN_0:"Maximum capacity must be at least 0",MIN_1:"Maximum capacity must be at least 1",MAX:"Maximum capacity cannot exceed 100"},DESIRED:{INTEGER:"Desired count must be an integer",MIN:"Desired count must be at least 0",MAX:"Desired count cannot exceed 100"},WARM_POOL_REQUIRED:"minCapacity 0 requires a warmPool \u2014 without it, new tasks wait 60-90s for a cold instance launch",WARM_POOL:{MIN_SIZE:{INTEGER:"Warm pool minSize must be an integer",MIN:"Warm pool minSize must be at least 0",MAX:"Warm pool minSize cannot exceed 100"},MIN_SIZE_EXCEEDS_MAX_CAPACITY:"warmPool.minSize cannot exceed maxCapacity \u2014 the warm pool cannot hold more instances than the ASG allows"}},MEMORY_LIMIT:{INTEGER:"Memory limit must be an integer",MIN_512:"Memory limit must be at least 512 MiB",MIN_128:"Memory limit must be at least 128 MiB",MAX:"Memory limit cannot exceed 30720 MiB"},DATABASE:{PORT:{INTEGER:"Database port must be an integer",MIN:"Database port must be at least 1024",MAX:"Database port cannot exceed 65535"},NAME:{REQUIRED:"Database name is required",MAX_LENGTH:"Database name must be 63 characters or less"}},CLICKHOUSE_STORAGE:{INTEGER:"ClickHouse storage must be a whole number of GiB",MIN:`ClickHouse storage must be at least ${100} GiB`,MAX:`ClickHouse storage cannot exceed ${16384} GiB (the gp3 ceiling)`},CLICKHOUSE_IOPS:{INTEGER:"ClickHouse iops must be a whole number",MIN:`ClickHouse iops must be at least ${3e3} (the gp3 baseline)`,MAX:`ClickHouse iops cannot exceed ${8e4} (the gp3 ceiling)`},CLICKHOUSE_THROUGHPUT:{INTEGER:"ClickHouse throughputMbps must be a whole number of MiB/s",MIN:`ClickHouse throughputMbps must be at least ${125} MiB/s (the gp3 baseline)`,MAX:`ClickHouse throughputMbps cannot exceed ${2e3} MiB/s (the gp3 ceiling)`},BACKUP_RETENTION:{INTEGER:"Backup retention must be an integer",MIN:"Backup retention must be at least 1 day",MAX:"Backup retention cannot exceed 35 days (the RDS automated-backup ceiling)"},CLICKHOUSE_BACKUP_RETENTION:{INTEGER:"ClickHouse backup retention must be an integer number of days",MIN:`ClickHouse backup retention must be at least ${1} day`,MAX:`ClickHouse backup retention cannot exceed ${3650} days`},SQS:{VISIBILITY_TIMEOUT:{INTEGER:"Visibility timeout must be an integer",MIN:"Visibility timeout must be at least 0 seconds",MAX:"Visibility timeout cannot exceed 43200 seconds (12 hours)"},RETENTION_PERIOD:{INTEGER:"Retention period must be an integer",MIN:"Retention period must be at least 60 seconds",MAX:"Retention period cannot exceed 1209600 seconds (14 days)"}},READER:{COUNT:{INTEGER:"Reader count must be an integer",MIN:"Reader count must be at least 0",MAX:"Reader count cannot exceed 15"}},IDENTIFIER_SUFFIX:{REQUIRED:"Identifier suffix is required when specified",MAX_LENGTH:"Identifier suffix cannot exceed 50 characters"},ROTATION:{INTEGER:"Rotation days must be an integer",MIN:"Rotation interval must be at least 1 day",MAX:"Rotation interval cannot exceed 365 days"},MAX_CONNECTIONS:{INTEGER:"Max connections must be an integer",MIN:"Max connections must be at least 1",MAX:"Max connections cannot exceed 100"},MONITORING_INTERVAL:{INTEGER:"Monitoring interval must be an integer",MIN:"Monitoring interval must be at least 0",MAX:"Monitoring interval cannot exceed 60 seconds",VALUES:"Monitoring interval must be 0, 1, 5, 10, 15, 30, or 60 seconds"},RETENTION_DAYS:{INTEGER:"Retention days must be an integer",MIN:"Retention days must be at least 1",MAX:"Retention days cannot exceed 365"},BATCH_SIZE:{INTEGER:"Batch size must be an integer",MIN:"Batch size must be at least 1",MAX:"Batch size cannot exceed 10000"},SERVICE:{UNIQUE_WITHIN_CLUSTER:"Service names must be unique within a cluster",MIN_REQUIRED:"At least one service is required",ROUTING_REQUIRED:"Multiple services with ports require routing config (path or host)"},PROXY_CONFIG:{MAX_IDLE_CONNECTIONS:{INTEGER:"Max idle connections must be an integer",MIN:"Max idle connections must be at least 0",MAX:"Max idle connections cannot exceed 100"},BORROW_TIMEOUT:{INTEGER:"Connection borrow timeout must be an integer",MIN:"Connection borrow timeout must be at least 1 second",MAX:"Connection borrow timeout cannot exceed 3600 seconds"}},MAX_AZS:{INTEGER:"Max AZs must be an integer",MIN:"Max AZs must be at least 1",MAX:"Max AZs cannot exceed 3"},BATCHING_WINDOW:{INTEGER:"Max batching window must be an integer",MIN:"Max batching window must be at least 0",MAX:"Max batching window cannot exceed 300 seconds"},HEALTH_CHECK:{INTERVAL:{INTEGER:"Health check interval must be an integer",MIN:"Health check interval must be at least 5 seconds",MAX:"Health check interval cannot exceed 300 seconds"},TIMEOUT:{INTEGER:"Health check timeout must be an integer",MIN:"Health check timeout must be at least 2 seconds",MAX:"Health check timeout cannot exceed 60 seconds"},RETRIES:{INTEGER:"Health check retries must be an integer",MIN:"Health check retries must be at least 1",MAX:"Health check retries cannot exceed 10"},START_PERIOD:{INTEGER:"Health check start period must be an integer",MIN:"Health check start period must be at least 0 seconds",MAX:"Health check start period cannot exceed 300 seconds"}},EPHEMERAL_STORAGE:{INTEGER:"Ephemeral storage size must be an integer",MIN:"Ephemeral storage size must be at least 512 MB",MAX:"Ephemeral storage size cannot exceed 10240 MB"},MAX_MESSAGE_SIZE:{INTEGER:"Max message size must be an integer",MIN:"Max message size must be at least 1024 bytes",MAX:"Max message size cannot exceed 262144 bytes (256 KB)"},CAPACITY_CONSTRAINT:{MIN_LTE_MAX:"minCapacity must be less than or equal to maxCapacity"},DIRECT_ACCESS:{NO_DOMAIN:"directAccess cannot be used with domain (no ALB for HTTPS)",NO_LOAD_BALANCER:"directAccess cannot be used with loadBalancer (mutually exclusive)"},GLOBAL_AURORA:{PRIMARY_REGION_REQUIRED:"primaryRegion is required for GlobalAurora databases"},NAT_GATEWAY:{INTEGER:"NAT gateway count must be an integer",MIN:"NAT gateway count must be at least 0",MAX:"NAT gateway count cannot exceed 3"},CIDR_MASK:{INTEGER:"CIDR mask must be an integer",MIN:"CIDR mask must be at least 16",MAX:"CIDR mask cannot exceed 28"},CPU:{INTEGER:"CPU must be an integer",MIN:"CPU must be at least 256 units",MAX:"CPU cannot exceed 4096 units"},KMS:{KEY_REQUIRED:"KMS key ARN is required when using KMS encryption"},READER_INSTANCES:{MAX:"Cannot have more than 15 reader instances",COUNT_OR_INSTANCES:"Cannot specify both 'count' and 'instances' - use one or the other"},INSTANCE_TYPE:"Unknown instance type. Common types include: t4g.micro, t4g.small, m5.large",ARCHITECTURE_MISMATCH:"Architecture mismatch between instance type and AMI",ALLOCATED_STORAGE:{INTEGER:"Allocated storage must be an integer",MIN:"Allocated storage must be at least 20 GB",MAX:"Allocated storage cannot exceed 65536 GB"},DLQ:{MAX_RECEIVE_COUNT:{INTEGER:"Max receive count must be an integer",MIN:"Max receive count must be at least 1",MAX:"Max receive count cannot exceed 1000"}},ALARM:{PERCENTAGE:{MIN:"Threshold must be at least 1%",MAX:"Threshold must be at most 100%"},FREE_STORAGE_GIB:{MIN:"Free storage threshold must be at least 1 GiB"},RESPONSE_TIME_MS:{MIN:"Response-time threshold must be at least 1 ms"}},REGION:"Invalid AWS region",PASCAL_CASE:"Resource name must start with an uppercase letter and contain only alphanumerics (PascalCase).",IMAGE_DOCKER_MUTEX:"image and docker are mutually exclusive",AWS_ACCOUNT_ID:"AWS account id must be exactly 12 digits (no hyphens)",VPC_ID:"VPC id must look like vpc-abc12345",ROLE_ARN:"Role ARN must have the form arn:aws:iam::<account-id>:role/<name>",CIDR:"CIDR must be in dotted-quad/prefix-length form (e.g. 10.0.0.0/16)",SSH_ALLOWED_IP_CIDRS_UNIQUE:"sshAccess.allowedIpCidrs must not repeat a range (each is one ingress rule)",VPC_PEER:{MIN_REQUESTER_ACCOUNTS:"At least one requester account id is required",REGION_REQUIRED:"Peer region is required when specified",ROUTE_TABLE_ID_REQUIRED:"Route table id must not be empty"},SCHEDULE_EXPRESSION:"Schedule expression must be 'rate(N minute|minutes|hour|hours|day|days)' with N>=1, or 'cron(<6-field AWS expression>)'"});var a8=Object.defineProperty,$r=(e,t)=>a8(e,"name",{value:t,configurable:!0}),o8=["us-east-2","us-west-2","us-east-1","eu-west-1","eu-central-1","ap-southeast-1"],s8=Object.freeze(o8.flatMap(e=>{let t=gs(e);return t?[t]:[]})),Yx=Object.freeze(["us-east-2","us-west-2","us-east-1","eu-west-1","ap-southeast-1"]);function kh(e){return e?e.split(",").map(t=>t.trim()).filter(Boolean):[]}$r(kh,"parseRegionList");function qx(e){return Yn.includes(e)}$r(qx,"isValidRegion");function Qx(e){return/^[a-z]{2}-[a-z]+-[1-9]$/.test(e)}$r(Qx,"isValidRegionFormat");function eT(e){if(!e)return Yx.slice(0,3);let t=e.toLowerCase().split("-"),r=t[0],i=t.length>1?t[1]:"",n=[];return r&&i&&(n=Yn.filter(a=>a.startsWith(`${r}-${i}`))),n.length===0&&r&&(n=Yn.filter(a=>a.startsWith(`${r}-`))),n.length>0?n.slice(0,3):Yx.slice(0,3)}$r(eT,"getSuggestions");function tT(e){if(qx(e))return!0;let t=eT(e);return Qx(e)?`Unknown region. Try: ${t.join(", ")}`:`Invalid format. Try: ${t.join(", ")}`}$r(tT,"validateRegion");function l1(e){if(!e||e.trim()==="")return!0;let t=kh(e);for(let r of t){let i=tT(r);if(i!==!0)return i}return!0}$r(l1,"validateRegionList");function rT(e,t){return e.filter(r=>r!==t)}$r(rT,"filterDuplicateRegions");function nT(e){return{label:e.city,value:e.code,description:e.optIn?`${e.code} \u2014 opt-in required`:e.code}}$r(nT,"toRegionOption");function d1(){return Xt.map(nT)}$r(d1,"getRegionOptions");function p1(e){return Xt.filter(t=>t.code!==e).map(nT)}$r(p1,"getRegionOptionsExcluding");function m1(e){let t=Xt.find(r=>r.code===e);return t?t.city:e}$r(m1,"getRegionName");function f1(e){return t=>{let r=kh(t);return rT(r,e)}}$r(f1,"createRegionFormatter");var Rh="39.0.3";var wh=["Aurora","Instance","GlobalAurora","ClickHouse"],Bs=["FARGATE","FARGATE_SPOT","EC2"],on=Mu,iT=jf;var Al=i0;var u8=Object.defineProperty,l8=(e,t)=>u8(e,"name",{value:t,configurable:!0}),Bve=Object.freeze({RESOURCE_SUFFIXES:Object.freeze({storage:"Storage",database:"Database",cluster:"Cluster",function:"Function",instance:"Instance",compute:"Compute"})}),xl=["ecs","lambda","ec2"],za=Object.freeze({ECS:"ecs",LAMBDA:"lambda",EC2:"ec2"}),Ph=["code","container"],Oh=Object.freeze({CODE:"code",CONTAINER:"container"}),$h=["ARM_64","X86_64"],h1="ARM_64",Tl=["NONE","AWS_IAM"],Mh=["public","internal"],Lh=["CPU","MEMORY"],Ga=["messaging","compute"],jh=["ARM","STANDARD"],aT=["Instance","Aurora"],zs=["postgresql","mysql"],Cl=["web","worker"],g1=["foundation","compliance","hardened"];var Fh=["t3.nano","t3.micro","t3.small","t3.medium","t3.large","t3.xlarge","t3.2xlarge","t3a.nano","t3a.micro","t3a.small","t3a.medium","t3a.large","t3a.xlarge","t3a.2xlarge","t4g.nano","t4g.micro","t4g.small","t4g.medium","t4g.large","t4g.xlarge","t4g.2xlarge","c5.large","c5.xlarge","c5.2xlarge","c5.4xlarge","c5.9xlarge","c5.12xlarge","c5.18xlarge","c5.24xlarge","c5a.large","c5a.xlarge","c5a.2xlarge","c5a.4xlarge","c5a.8xlarge","c5a.12xlarge","c5a.16xlarge","c5a.24xlarge","c6g.medium","c6g.large","c6g.xlarge","c6g.2xlarge","c6g.4xlarge","c6g.8xlarge","c6g.12xlarge","c6g.16xlarge","r5.large","r5.xlarge","r5.2xlarge","r5.4xlarge","r5.8xlarge","r5.12xlarge","r5.16xlarge","r5.24xlarge","r5a.large","r5a.xlarge","r5a.2xlarge","r5a.4xlarge","r5a.8xlarge","r5a.12xlarge","r5a.16xlarge","r5a.24xlarge","r6g.medium","r6g.large","r6g.xlarge","r6g.2xlarge","r6g.4xlarge","r6g.8xlarge","r6g.12xlarge","r6g.16xlarge","i3.large","i3.xlarge","i3.2xlarge","i3.4xlarge","i3.8xlarge","i3.16xlarge","p3.2xlarge","p3.8xlarge","p3.16xlarge","g4dn.xlarge","g4dn.2xlarge","g4dn.4xlarge","g4dn.8xlarge","g4dn.12xlarge","g4dn.16xlarge","m5.large","m5.xlarge","m5.2xlarge","m5.4xlarge","m5.8xlarge","m5.12xlarge","m5.16xlarge","m5.24xlarge","m5a.large","m5a.xlarge","m5a.2xlarge","m5a.4xlarge","m5a.8xlarge","m5a.12xlarge","m5a.16xlarge","m5a.24xlarge"],y1=[0,1,5,10,15,30,60];function Jt(e,t){return e.includes(t)}l8(Jt,"constIncludes");var v1=1,S1=65535,Wve=Object.freeze({postgresql:5432,mysql:3306}),b1=128,E1=10240,oT=1,sT=900,Gs=100,_1=100;var A1=3e3;var x1=["standard","assets","upload","website"],Vs=["AES256","KMS"];var d8=Object.defineProperty,Il=(e,t)=>d8(e,"name",{value:t,configurable:!0}),Yt=Il(e=>c.union([c.literal(!1),e]),"optionalOrDisabled"),cT={check:Il(e=>e.minCapacity!==void 0&&e.maxCapacity!==void 0?e.minCapacity<=e.maxCapacity:!0,"check"),params:{message:_.CAPACITY_CONSTRAINT.MIN_LTE_MAX,path:["maxCapacity"]}},Uh=Il(e=>c.number().int(_.MEMORY_LIMIT.INTEGER).min(e,e===128?_.MEMORY_LIMIT.MIN_128:_.MEMORY_LIMIT.MIN_512).max(30720,_.MEMORY_LIMIT.MAX),"memoryLimitMiBSchema"),Ae=c.string().min(1,_.REQUIRED.RESOURCE_NAME).max(63,_.MAX_LENGTH.RESOURCE_NAME).regex(ye.RESOURCE_NAME,_.RESOURCE_NAME),C1=c.string().min(1,_.REQUIRED.BUCKET_NAME).max(63,_.MAX_LENGTH.BUCKET_NAME).regex(ye.BUCKET_NAME,_.BUCKET_NAME),I1=c.string().min(1,_.REQUIRED.DATABASE_NAME).max(63,_.MAX_LENGTH.DATABASE_NAME).regex(ye.DATABASE_NAME,_.DATABASE_NAME);function Bh(e,t=ye.IDENTIFIER,r=_.IDENTIFIER){return c.string().min(2,_.IDENTIFIER_MIN_LENGTH).max(50,e).regex(t,r).refine(i=>!i.endsWith("-"),{message:_.IDENTIFIER_NO_TRAILING_HYPHEN}).refine(i=>!i.includes("--"),{message:_.IDENTIFIER_NO_CONSECUTIVE_HYPHENS})}Il(Bh,"identifierSchema");var Ft=Bh(_.MAX_LENGTH.APP_NAME),Qve=Bh(_.MAX_LENGTH.APP_NAME,ye.NEW_APP_NAME,_.NEW_APP_NAME),Ks=c.number().int(_.PORT.INTEGER).min(v1,_.PORT.MIN).max(S1,_.PORT.MAX),Dt=c.object({key:c.string(),sourceText:c.string()}).strict(),p8=c.object({__identifier:c.string()}).strict(),m8=c.object({__expression:c.string()}).strict(),f8=c.object({__call:c.string()}).strict(),h8=c.union([p8,m8,f8]),g8=c.union([c.string(),c.number(),c.boolean(),h8]),Ws=c.record(c.string().regex(ye.ENV_VAR_NAME,_.ENV_VAR_NAME),g8),y8=c.object({id:c.string(),name:c.string().optional(),arn:c.string().optional(),field:c.string().optional()}).strict().refine(e=>e.name!==void 0!=(e.arn!==void 0),{message:"secretsImport requires exactly one of `name` or `arn`."}),D1=c.record(c.string(),y8),uT=c.enum(Al).describe(`Application type must be one of: ${Al.join(", ")}`),lT=c.enum(Rr).describe(`OpenNext deployment pattern: ${Rr.join(", ")}`),v8=c.enum(["before-imports","after-imports","after-app-init","after-tags","after-resource","end-of-file"]),S8=c.enum(["import","app-init","tags","database","compute","storage","network","messaging","cdn","pattern","vpc-peer","vpc-peer-accepter","cross-plan-connection","custom"]),N1=c.object({sourceText:c.string(),position:v8,afterManagedResource:c.object({type:S8,name:c.string().optional()}).strict().optional(),originalLine:c.number().int().optional(),leadingComments:c.array(c.string()).optional(),orphaned:c.boolean().optional(),orphanedComment:c.string().optional()}).strict(),k1=c.union([c.object({tier:c.enum(on)}).strict(),c.literal(!1)]),R1=c.union([c.object({instanceType:c.string().optional()}).strict(),c.literal(!1)]),b8=Bh(_.MAX_LENGTH.ORGANISATION_NAME),E8=c.string().regex(ye.EMAIL,_.EMAIL),T1=c.string().refine(e=>Yn.includes(e),{message:_.REGION}),eSe=c.object({name:b8,email:E8,accountName:c.string().optional(),primaryRegion:T1.optional().default(hs),secondaryRegions:c.array(T1).optional(),security:c.enum(g1).optional(),force:c.boolean().optional()}).strict();function Dl(e){return e.issues.map(t=>`${t.path.length>0?`${t.path.join(".")}: `:""}${t.message}`).join(`
+`)}getConsolePrefix(t){switch(t){case"error":return"[ERROR]";case"warn":return"[WARN]";case"info":return"[INFO]";case"debug":return"[DEBUG]";case"trace":return"[TRACE]"}}error(t,r,i){this.log("error",t,r,i)}warn(t,r,i){this.log("warn",t,r,i)}info(t,r,i){this.log("info",t,r,i)}debug(t,r,i){this.log("debug",t,r,i)}trace(t,r,i){this.log("trace",t,r,i)}diagnostic(t,r,i,n){this.log(t,r,i,n),!this.debugEnabled&&Mx()&&(Gi[t]<Gi.info||this.writeStderrLine(this.createEntry(t,r,i,n)))}isDebugEnabled(){return this.debugEnabled}isTraceEnabled(){return this.traceEnabled}enableDebug(){this.debugEnabled=!0,Gi[this.minLevel]>Gi.debug&&(this.minLevel="debug"),this.fileWriter.setDebugEnabled(!0),this.fileWriter.isInitialised&&this.fileWriter.initialiseDebugStream()}withCorrelation(t){return new ml(this,t)}forDeployment(t,r="deploy"){return new xh(this,t,r)}close(){this.fileWriter.close()}async flushAndClose(){await this.fileWriter.closeAndFlush()}getLogPath(){return this.mainLogPath}getDebugLogPath(){return this.debugLogPath}getLogDir(){return this.config.logDir}logWithCorrelation(t,r,i,n,a,o,s){this.log(t,r,i,a,n,o,s)}static reset(){e.instance&&(e.instance.close(),e.instance=null)}};var Rs=Nh.getInstance();var j9=Object.defineProperty,ft=(e,t)=>j9(e,"name",{value:t,configurable:!0}),Fs="fjall";function Ua(e,t){let r=F9(e);if(r.includes("..")||r.startsWith("/"))throw new Error(`Invalid ${t}: path traversal is not allowed`)}ft(Ua,"assertNoTraversal");function U9(){return Fs}ft(U9,"getFjallPath");function B9(e){let t=JL(e);return JL(t)||"."}ft(B9,"getProjectRoot");function QL(e){if(!qL(e))throw new Error(`Infrastructure file not found: ${e}`);let t=YL(e,"utf-8"),r=e1(t);if(r===void 0)throw new Error(`Could not find appName in infrastructure file: ${e}. Expected format: const appName = "yourAppName";`);return r}ft(QL,"getAppNameFromInfrastructure");function e1(e){return e.match(/const\s+appName\s*=\s*["']([^"']+)["']/)?.[1]}ft(e1,"parseAppNameFromInfrastructureContent");function z9(e){if(!qL(e))return;let t;try{t=YL(e,"utf-8")}catch(r){Rs.debug("PathHelpers","Could not read organisation infrastructure",{error:K(We(r))});return}return t.match(/organisationName:\s*(["'])(.+?)\1/)?.[2]}ft(z9,"readOrganisationNameFromInfrastructure");function G9(e){let t=Or(e,Ux);return QL(t)}ft(G9,"getAppName");function jx(e){return Ua(e,"app name"),Or(Fs,e,Ux)}ft(jx,"getInfrastructurePath");function Ba(e){return Ua(e,"app name"),Or(Fs,e)}ft(Ba,"getAppPath");function t1(e,t){let r=e??process.cwd();return t===void 0?r:(Ua(t,"container"),Or(r,t))}ft(t1,"resolveScaffoldRootDir");function V9(e,t,r){return Or(t1(t,r),Ba(e))}ft(V9,"resolveAppScaffoldPath");function K9(e){return Ua(e,"component name"),Or(Fs,e)}ft(K9,"getOrganisationComponentPath");function W9(e){return Ua(e,"deployment type"),Or(Fs,e,"logs")}ft(W9,"getDeploymentLogsPath");function r1(){return Or(Fs,"domains")}ft(r1,"getDomainsDir");function Fx(e){return Ua(e,"domain name"),Or(r1(),e)}ft(Fx,"getDomainComponentPath");function H9(e){return Or(Fx(e),Ux)}ft(H9,"getDomainInfrastructurePath");function Z9(e){return Or(Fx(e),X9)}ft(Z9,"getDomainZoneFilePath");var Ux="infrastructure.ts",X9="zone.bind",J9="cdk.out";function Y9(e){return Or(e,J9)}ft(Y9,"getCdkOutPath");var q9=Object.defineProperty,Q9=(e,t)=>q9(e,"name",{value:t,configurable:!0}),e8=import.meta.dirname;function Bx(e,t,r,i){let n=n1(e8,"..","shared","files"),a=t.includes("/")?t:Ba(t);Nv(e,n,a,r,i),Qc(e,n1(a,".gitignore"),Zu,i)}Q9(Bx,"copySharedCdkFiles");var t8=Object.defineProperty,Us=(e,t)=>t8(e,"name",{value:t,configurable:!0});function i1(e){return e.success===!0}Us(i1,"isSuccess");function a1(e){return e.success===!1}Us(a1,"isFailure");function H(e){return{success:!0,data:e}}Us(H,"success");function $(e){return{success:!1,error:e}}Us($,"failure");async function o1(e){try{let t=await e();return H(t)}catch(t){return $(Mi(t))}}Us(o1,"tryAsync");function s1(e){try{let t=e();return H(t)}catch(t){return $(Mi(t))}}Us(s1,"trySync");var r8=Object.defineProperty,n8=(e,t)=>r8(e,"name",{value:t,configurable:!0}),c1=/^[a-zA-Z][a-zA-Z0-9-]*$/,i8=Fu.source.replace(/^\^|\$$/g,""),ye=Object.freeze({IDENTIFIER:c1,NEW_APP_NAME:/^[a-z][a-z0-9-]*$/,RESOURCE_NAME:/^[a-zA-Z][a-zA-Z0-9]*$/,ECS_SERVICE_NAME:c1,BUCKET_NAME:/^[a-z][a-z0-9-]*[a-z0-9]$|^[a-z][a-z0-9]*$/,DATABASE_NAME:/^[a-zA-Z][a-zA-Z0-9_]*$/,RESOURCE_TYPE:/^[a-z]+(:[a-z]+)?$/,SSM_PATH:new RegExp(`^(?:/${i8})+$`),SECRET_NAME:$f,SSM_COMPONENT:Fu,EMAIL:/^[^\s@]+@[^\s@]+\.[^\s@]+$/,DOCKER_IMAGE:/^[a-z0-9][a-z0-9._-]*[a-z0-9](:[a-z0-9._-]+)?$/,DOMAIN:/^[a-z0-9]([a-z0-9-]*[a-z0-9])?(\.[a-z0-9]([a-z0-9-]*[a-z0-9])?)+$/i,HTTP_ORIGIN:/^https?:\/\/[a-z0-9.-]+(:\d+)?$/i,PASCAL_CASE:/^[A-Z][A-Za-z0-9]*$/,AWS_ACCOUNT_ID:/^\d{12}$/,VPC_ID:/^vpc-[a-z0-9]+$/,ROLE_ARN:/^arn:aws[a-zA-Z-]*:iam::\d{12}:role\/.+$/,CIDR:/^((25[0-5]|2[0-4]\d|1\d\d|[1-9]?\d)\.){3}(25[0-5]|2[0-4]\d|1\d\d|[1-9]?\d)\/(3[0-2]|[12]?\d)$/,SCHEDULE_EXPRESSION:/^(rate\(1 (?:minute|hour|day)\)|rate\((?:[2-9]|[1-9]\d+) (?:minutes|hours|days)\)|cron\([^\s()]+ [^\s()]+ [^\s()]+ [^\s()]+ [^\s()]+ [^\s()]+\))$/,LAMBDA_RUNTIME_IDENTIFIER:/^[A-Za-z0-9._-]+$/,ENV_VAR_NAME:/^[A-Za-z_][A-Za-z0-9_]*$/});function zx(e){let t=/^rate\((\d+) (minute|minutes|hour|hours|day|days)\)$/.exec(e);if(!t)return;let r=t[1],i=t[2];if(r===void 0||i===void 0)return;let n=parseInt(r,10);if(!Number.isFinite(n)||n<1)return;let a=i==="minute"||i==="hour"||i==="day";if(!(a&&n!==1)&&!(!a&&n===1))return i==="minute"||i==="minutes"?{everyMs:n*6e4}:i==="hour"||i==="hours"?{everyMs:n*60*6e4}:{everyMs:n*24*60*6e4}}n8(zx,"parseRateExpression");var u1=["t4g.medium","m7g.medium","m8g.medium","r7g.medium","r8g.medium","m7g.large","m8g.large","r7g.large","r8g.large","m7g.xlarge","m8g.xlarge","r7g.xlarge","r8g.xlarge"];var _=Object.freeze({IDENTIFIER:"Must start with a letter, contain only letters, numbers, and hyphens",NEW_APP_NAME:"Must start with a lowercase letter and contain only lowercase letters, numbers, and hyphens",IDENTIFIER_MIN_LENGTH:"Must be at least 2 characters",IDENTIFIER_NO_TRAILING_HYPHEN:"Must not end with a hyphen",IDENTIFIER_NO_CONSECUTIVE_HYPHENS:"Must not contain consecutive hyphens",RESOURCE_NAME:"Must start with a letter and contain only letters and numbers (PascalCase recommended)",ECS_SERVICE_NAME:"Service name must start with a letter and contain only letters, numbers, and hyphens",BUCKET_NAME:"Bucket name must start with a lowercase letter and contain only lowercase letters, numbers, and hyphens",DATABASE_NAME:"Database name must start with a letter and contain only letters, numbers, and underscores",RESOURCE_TYPE:"Resource type must be in format 'category' or 'category:type'",SSM_PATH:"SSM path must start with / and contain valid namespace segments (e.g., /myapp/ApiCluster/service)",SECRET_NAME:QA,SSM_COMPONENT:Mf,EMAIL:"Please enter a valid email address",DOMAIN:"Please enter a valid domain (e.g., cms.example.com)",DOCKER_IMAGE:"Invalid Docker image name format",REQUIRED:{APP_NAME:"Application name is required",RESOURCE_NAME:"Resource name is required",BUCKET_NAME:"Bucket name is required",SERVICE_NAME:"Service name is required",NETWORK_NAME:"Network name is required",DATABASE_NAME:"Database name is required",ORGANISATION_NAME:"Organisation name is required",EMAIL:"Email is required",NAME:"Name is required",USERNAME:"Username is required",CONTAINER_NAME:"Container name is required",GROUP:"Group is required",PATTERN_NAME:"Pattern name is required",SOURCE:"Source directory is required",BUILD_COMMAND:"Build command is required",OUTPUT_DIR:"Output directory is required",FORMS_TO:"Forms recipient address is required",ROUTING_PATH:"Routing path is required",RESOURCE_REFERENCE:"Resource reference is required",RESOURCE_TYPE:"Resource type is required",VARIANT:"Variant is required",SUBTYPE:"Subtype is required",DEPLOY_TARGET:"Deploy target is required",DESTROY_TARGET:"Destroy target is required",CONNECTED_RESOURCE_NAME:"Connected resource names must not be empty",SSH_ALLOWED_IP_CIDRS:"sshAccess.allowedIpCidrs must list at least one IPv4 CIDR",SSH_KEY_NAME:"sshAccess.keyName must not be empty (omit it to create a key pair)"},MAX_LENGTH:{APP_NAME:"Application name must be 50 characters or less",RESOURCE_NAME:"Resource name must be 63 characters or less",BUCKET_NAME:"Bucket name must be 63 characters or less",SERVICE_NAME:"Service name must be 255 characters or less",NETWORK_NAME:"Network name must be 50 characters or less",DATABASE_NAME:"Database name must be 63 characters or less",ORGANISATION_NAME:"Organisation name must be 50 characters or less"},PORT:{INTEGER:"Port must be an integer",MIN:"Port must be at least 1",MAX:"Port cannot exceed 65535"},USERNAME:{MAX_LENGTH:"Username cannot exceed 63 characters"},LAMBDA:{MEMORY:{INTEGER:"Lambda memory must be an integer",MIN:"Memory must be at least 128 MB",MAX:"Memory cannot exceed 10240 MB",MULTIPLE:"Memory must be 128 MB or a multiple of 64 MB"},TIMEOUT:{INTEGER:"Timeout must be an integer",MIN:"Timeout must be at least 1 second",MAX:"Timeout cannot exceed 900 seconds"},RUNTIME:"Lambda runtime must contain only letters, digits, dots, underscores, or dashes (e.g. 'NODEJS_20_X' or 'nodejs20.x')"},ENV_VAR_NAME:"Environment variable names must start with a letter or underscore and contain only letters, digits, and underscores",PRIORITY:{INTEGER:"Priority must be an integer",MIN:"Priority must be at least 1",MAX:"Priority cannot exceed 50000"},CAPACITY:{MIN:{INTEGER:"Minimum capacity must be an integer",MIN_0:"Minimum capacity must be at least 0",MIN_1:"Minimum capacity must be at least 1",MAX:"Minimum capacity cannot exceed 100"},MAX:{INTEGER:"Maximum capacity must be an integer",MIN_0:"Maximum capacity must be at least 0",MIN_1:"Maximum capacity must be at least 1",MAX:"Maximum capacity cannot exceed 100"},DESIRED:{INTEGER:"Desired count must be an integer",MIN:"Desired count must be at least 0",MAX:"Desired count cannot exceed 100"},WARM_POOL_REQUIRED:"minCapacity 0 requires a warmPool \u2014 without it, new tasks wait 60-90s for a cold instance launch",WARM_POOL:{MIN_SIZE:{INTEGER:"Warm pool minSize must be an integer",MIN:"Warm pool minSize must be at least 0",MAX:"Warm pool minSize cannot exceed 100"},MIN_SIZE_EXCEEDS_MAX_CAPACITY:"warmPool.minSize cannot exceed maxCapacity \u2014 the warm pool cannot hold more instances than the ASG allows"}},MEMORY_LIMIT:{INTEGER:"Memory limit must be an integer",MIN_512:"Memory limit must be at least 512 MiB",MIN_128:"Memory limit must be at least 128 MiB",MAX:"Memory limit cannot exceed 30720 MiB"},DATABASE:{PORT:{INTEGER:"Database port must be an integer",MIN:"Database port must be at least 1024",MAX:"Database port cannot exceed 65535"},NAME:{REQUIRED:"Database name is required",MAX_LENGTH:"Database name must be 63 characters or less"}},CLICKHOUSE_STORAGE:{INTEGER:"ClickHouse storage must be a whole number of GiB",MIN:`ClickHouse storage must be at least ${100} GiB`,MAX:`ClickHouse storage cannot exceed ${16384} GiB (the gp3 ceiling)`},CLICKHOUSE_IOPS:{INTEGER:"ClickHouse iops must be a whole number",MIN:`ClickHouse iops must be at least ${3e3} (the gp3 baseline)`,MAX:`ClickHouse iops cannot exceed ${8e4} (the gp3 ceiling)`},CLICKHOUSE_THROUGHPUT:{INTEGER:"ClickHouse throughputMbps must be a whole number of MiB/s",MIN:`ClickHouse throughputMbps must be at least ${125} MiB/s (the gp3 baseline)`,MAX:`ClickHouse throughputMbps cannot exceed ${2e3} MiB/s (the gp3 ceiling)`},BACKUP_RETENTION:{INTEGER:"Backup retention must be an integer",MIN:"Backup retention must be at least 1 day",MAX:"Backup retention cannot exceed 35 days (the RDS automated-backup ceiling)"},CLICKHOUSE_BACKUP_RETENTION:{INTEGER:"ClickHouse backup retention must be an integer number of days",MIN:`ClickHouse backup retention must be at least ${1} day`,MAX:`ClickHouse backup retention cannot exceed ${3650} days`},SQS:{VISIBILITY_TIMEOUT:{INTEGER:"Visibility timeout must be an integer",MIN:"Visibility timeout must be at least 0 seconds",MAX:"Visibility timeout cannot exceed 43200 seconds (12 hours)"},RETENTION_PERIOD:{INTEGER:"Retention period must be an integer",MIN:"Retention period must be at least 60 seconds",MAX:"Retention period cannot exceed 1209600 seconds (14 days)"}},READER:{COUNT:{INTEGER:"Reader count must be an integer",MIN:"Reader count must be at least 0",MAX:"Reader count cannot exceed 15"}},IDENTIFIER_SUFFIX:{REQUIRED:"Identifier suffix is required when specified",MAX_LENGTH:"Identifier suffix cannot exceed 50 characters"},ROTATION:{INTEGER:"Rotation days must be an integer",MIN:"Rotation interval must be at least 1 day",MAX:"Rotation interval cannot exceed 365 days"},MAX_CONNECTIONS:{INTEGER:"Max connections must be an integer",MIN:"Max connections must be at least 1",MAX:"Max connections cannot exceed 100"},MONITORING_INTERVAL:{INTEGER:"Monitoring interval must be an integer",MIN:"Monitoring interval must be at least 0",MAX:"Monitoring interval cannot exceed 60 seconds",VALUES:"Monitoring interval must be 0, 1, 5, 10, 15, 30, or 60 seconds"},RETENTION_DAYS:{INTEGER:"Retention days must be an integer",MIN:"Retention days must be at least 1",MAX:"Retention days cannot exceed 365"},BATCH_SIZE:{INTEGER:"Batch size must be an integer",MIN:"Batch size must be at least 1",MAX:"Batch size cannot exceed 10000"},SERVICE:{UNIQUE_WITHIN_CLUSTER:"Service names must be unique within a cluster",MIN_REQUIRED:"At least one service is required",ROUTING_REQUIRED:"Multiple services with ports require routing config (path or host)"},PROXY_CONFIG:{MAX_IDLE_CONNECTIONS:{INTEGER:"Max idle connections must be an integer",MIN:"Max idle connections must be at least 0",MAX:"Max idle connections cannot exceed 100"},BORROW_TIMEOUT:{INTEGER:"Connection borrow timeout must be an integer",MIN:"Connection borrow timeout must be at least 1 second",MAX:"Connection borrow timeout cannot exceed 3600 seconds"}},MAX_AZS:{INTEGER:"Max AZs must be an integer",MIN:"Max AZs must be at least 1",MAX:"Max AZs cannot exceed 3"},BATCHING_WINDOW:{INTEGER:"Max batching window must be an integer",MIN:"Max batching window must be at least 0",MAX:"Max batching window cannot exceed 300 seconds"},HEALTH_CHECK:{INTERVAL:{INTEGER:"Health check interval must be an integer",MIN:"Health check interval must be at least 5 seconds",MAX:"Health check interval cannot exceed 300 seconds"},TIMEOUT:{INTEGER:"Health check timeout must be an integer",MIN:"Health check timeout must be at least 2 seconds",MAX:"Health check timeout cannot exceed 60 seconds"},RETRIES:{INTEGER:"Health check retries must be an integer",MIN:"Health check retries must be at least 1",MAX:"Health check retries cannot exceed 10"},START_PERIOD:{INTEGER:"Health check start period must be an integer",MIN:"Health check start period must be at least 0 seconds",MAX:"Health check start period cannot exceed 300 seconds"}},EPHEMERAL_STORAGE:{INTEGER:"Ephemeral storage size must be an integer",MIN:"Ephemeral storage size must be at least 512 MB",MAX:"Ephemeral storage size cannot exceed 10240 MB"},MAX_MESSAGE_SIZE:{INTEGER:"Max message size must be an integer",MIN:"Max message size must be at least 1024 bytes",MAX:"Max message size cannot exceed 262144 bytes (256 KB)"},CAPACITY_CONSTRAINT:{MIN_LTE_MAX:"minCapacity must be less than or equal to maxCapacity"},DIRECT_ACCESS:{NO_DOMAIN:"directAccess cannot be used with domain (no ALB for HTTPS)",NO_LOAD_BALANCER:"directAccess cannot be used with loadBalancer (mutually exclusive)"},GLOBAL_AURORA:{PRIMARY_REGION_REQUIRED:"primaryRegion is required for GlobalAurora databases"},NAT_GATEWAY:{INTEGER:"NAT gateway count must be an integer",MIN:"NAT gateway count must be at least 0",MAX:"NAT gateway count cannot exceed 3"},CIDR_MASK:{INTEGER:"CIDR mask must be an integer",MIN:"CIDR mask must be at least 16",MAX:"CIDR mask cannot exceed 28"},CPU:{INTEGER:"CPU must be an integer",MIN:"CPU must be at least 256 units",MAX:"CPU cannot exceed 4096 units"},KMS:{KEY_REQUIRED:"KMS key ARN is required when using KMS encryption"},READER_INSTANCES:{MAX:"Cannot have more than 15 reader instances",COUNT_OR_INSTANCES:"Cannot specify both 'count' and 'instances' - use one or the other"},INSTANCE_TYPE:"Unknown instance type. Common types include: t4g.micro, t4g.small, m5.large",ARCHITECTURE_MISMATCH:"Architecture mismatch between instance type and AMI",ALLOCATED_STORAGE:{INTEGER:"Allocated storage must be an integer",MIN:"Allocated storage must be at least 20 GB",MAX:"Allocated storage cannot exceed 65536 GB"},DLQ:{MAX_RECEIVE_COUNT:{INTEGER:"Max receive count must be an integer",MIN:"Max receive count must be at least 1",MAX:"Max receive count cannot exceed 1000"}},ALARM:{PERCENTAGE:{MIN:"Threshold must be at least 1%",MAX:"Threshold must be at most 100%"},FREE_STORAGE_GIB:{MIN:"Free storage threshold must be at least 1 GiB"},RESPONSE_TIME_MS:{MIN:"Response-time threshold must be at least 1 ms"}},REGION:"Invalid AWS region",PASCAL_CASE:"Resource name must start with an uppercase letter and contain only alphanumerics (PascalCase).",IMAGE_DOCKER_MUTEX:"image and docker are mutually exclusive",AWS_ACCOUNT_ID:"AWS account id must be exactly 12 digits (no hyphens)",VPC_ID:"VPC id must look like vpc-abc12345",ROLE_ARN:"Role ARN must have the form arn:aws:iam::<account-id>:role/<name>",CIDR:"CIDR must be in dotted-quad/prefix-length form (e.g. 10.0.0.0/16)",SSH_ALLOWED_IP_CIDRS_UNIQUE:"sshAccess.allowedIpCidrs must not repeat a range (each is one ingress rule)",VPC_PEER:{MIN_REQUESTER_ACCOUNTS:"At least one requester account id is required",REGION_REQUIRED:"Peer region is required when specified",ROUTE_TABLE_ID_REQUIRED:"Route table id must not be empty"},SCHEDULE_EXPRESSION:"Schedule expression must be 'rate(N minute|minutes|hour|hours|day|days)' with N>=1, or 'cron(<6-field AWS expression>)'"});var a8=Object.defineProperty,$r=(e,t)=>a8(e,"name",{value:t,configurable:!0}),o8=["us-east-2","us-west-2","us-east-1","eu-west-1","eu-central-1","ap-southeast-1"],s8=Object.freeze(o8.flatMap(e=>{let t=gs(e);return t?[t]:[]})),Yx=Object.freeze(["us-east-2","us-west-2","us-east-1","eu-west-1","ap-southeast-1"]);function kh(e){return e?e.split(",").map(t=>t.trim()).filter(Boolean):[]}$r(kh,"parseRegionList");function qx(e){return Yn.includes(e)}$r(qx,"isValidRegion");function Qx(e){return/^[a-z]{2}-[a-z]+-[1-9]$/.test(e)}$r(Qx,"isValidRegionFormat");function eT(e){if(!e)return Yx.slice(0,3);let t=e.toLowerCase().split("-"),r=t[0],i=t.length>1?t[1]:"",n=[];return r&&i&&(n=Yn.filter(a=>a.startsWith(`${r}-${i}`))),n.length===0&&r&&(n=Yn.filter(a=>a.startsWith(`${r}-`))),n.length>0?n.slice(0,3):Yx.slice(0,3)}$r(eT,"getSuggestions");function tT(e){if(qx(e))return!0;let t=eT(e);return Qx(e)?`Unknown region. Try: ${t.join(", ")}`:`Invalid format. Try: ${t.join(", ")}`}$r(tT,"validateRegion");function l1(e){if(!e||e.trim()==="")return!0;let t=kh(e);for(let r of t){let i=tT(r);if(i!==!0)return i}return!0}$r(l1,"validateRegionList");function rT(e,t){return e.filter(r=>r!==t)}$r(rT,"filterDuplicateRegions");function nT(e){return{label:e.city,value:e.code,description:e.optIn?`${e.code} \u2014 opt-in required`:e.code}}$r(nT,"toRegionOption");function d1(){return Xt.map(nT)}$r(d1,"getRegionOptions");function p1(e){return Xt.filter(t=>t.code!==e).map(nT)}$r(p1,"getRegionOptionsExcluding");function m1(e){let t=Xt.find(r=>r.code===e);return t?t.city:e}$r(m1,"getRegionName");function f1(e){return t=>{let r=kh(t);return rT(r,e)}}$r(f1,"createRegionFormatter");var Rh="39.0.4";var wh=["Aurora","Instance","GlobalAurora","ClickHouse"],Bs=["FARGATE","FARGATE_SPOT","EC2"],on=Mu,iT=jf;var Al=i0;var u8=Object.defineProperty,l8=(e,t)=>u8(e,"name",{value:t,configurable:!0}),Bve=Object.freeze({RESOURCE_SUFFIXES:Object.freeze({storage:"Storage",database:"Database",cluster:"Cluster",function:"Function",instance:"Instance",compute:"Compute"})}),xl=["ecs","lambda","ec2"],za=Object.freeze({ECS:"ecs",LAMBDA:"lambda",EC2:"ec2"}),Ph=["code","container"],Oh=Object.freeze({CODE:"code",CONTAINER:"container"}),$h=["ARM_64","X86_64"],h1="ARM_64",Tl=["NONE","AWS_IAM"],Mh=["public","internal"],Lh=["CPU","MEMORY"],Ga=["messaging","compute"],jh=["ARM","STANDARD"],aT=["Instance","Aurora"],zs=["postgresql","mysql"],Cl=["web","worker"],g1=["foundation","compliance","hardened"];var Fh=["t3.nano","t3.micro","t3.small","t3.medium","t3.large","t3.xlarge","t3.2xlarge","t3a.nano","t3a.micro","t3a.small","t3a.medium","t3a.large","t3a.xlarge","t3a.2xlarge","t4g.nano","t4g.micro","t4g.small","t4g.medium","t4g.large","t4g.xlarge","t4g.2xlarge","c5.large","c5.xlarge","c5.2xlarge","c5.4xlarge","c5.9xlarge","c5.12xlarge","c5.18xlarge","c5.24xlarge","c5a.large","c5a.xlarge","c5a.2xlarge","c5a.4xlarge","c5a.8xlarge","c5a.12xlarge","c5a.16xlarge","c5a.24xlarge","c6g.medium","c6g.large","c6g.xlarge","c6g.2xlarge","c6g.4xlarge","c6g.8xlarge","c6g.12xlarge","c6g.16xlarge","r5.large","r5.xlarge","r5.2xlarge","r5.4xlarge","r5.8xlarge","r5.12xlarge","r5.16xlarge","r5.24xlarge","r5a.large","r5a.xlarge","r5a.2xlarge","r5a.4xlarge","r5a.8xlarge","r5a.12xlarge","r5a.16xlarge","r5a.24xlarge","r6g.medium","r6g.large","r6g.xlarge","r6g.2xlarge","r6g.4xlarge","r6g.8xlarge","r6g.12xlarge","r6g.16xlarge","i3.large","i3.xlarge","i3.2xlarge","i3.4xlarge","i3.8xlarge","i3.16xlarge","p3.2xlarge","p3.8xlarge","p3.16xlarge","g4dn.xlarge","g4dn.2xlarge","g4dn.4xlarge","g4dn.8xlarge","g4dn.12xlarge","g4dn.16xlarge","m5.large","m5.xlarge","m5.2xlarge","m5.4xlarge","m5.8xlarge","m5.12xlarge","m5.16xlarge","m5.24xlarge","m5a.large","m5a.xlarge","m5a.2xlarge","m5a.4xlarge","m5a.8xlarge","m5a.12xlarge","m5a.16xlarge","m5a.24xlarge"],y1=[0,1,5,10,15,30,60];function Jt(e,t){return e.includes(t)}l8(Jt,"constIncludes");var v1=1,S1=65535,Wve=Object.freeze({postgresql:5432,mysql:3306}),b1=128,E1=10240,oT=1,sT=900,Gs=100,_1=100;var A1=3e3;var x1=["standard","assets","upload","website"],Vs=["AES256","KMS"];var d8=Object.defineProperty,Il=(e,t)=>d8(e,"name",{value:t,configurable:!0}),Yt=Il(e=>c.union([c.literal(!1),e]),"optionalOrDisabled"),cT={check:Il(e=>e.minCapacity!==void 0&&e.maxCapacity!==void 0?e.minCapacity<=e.maxCapacity:!0,"check"),params:{message:_.CAPACITY_CONSTRAINT.MIN_LTE_MAX,path:["maxCapacity"]}},Uh=Il(e=>c.number().int(_.MEMORY_LIMIT.INTEGER).min(e,e===128?_.MEMORY_LIMIT.MIN_128:_.MEMORY_LIMIT.MIN_512).max(30720,_.MEMORY_LIMIT.MAX),"memoryLimitMiBSchema"),Ae=c.string().min(1,_.REQUIRED.RESOURCE_NAME).max(63,_.MAX_LENGTH.RESOURCE_NAME).regex(ye.RESOURCE_NAME,_.RESOURCE_NAME),C1=c.string().min(1,_.REQUIRED.BUCKET_NAME).max(63,_.MAX_LENGTH.BUCKET_NAME).regex(ye.BUCKET_NAME,_.BUCKET_NAME),I1=c.string().min(1,_.REQUIRED.DATABASE_NAME).max(63,_.MAX_LENGTH.DATABASE_NAME).regex(ye.DATABASE_NAME,_.DATABASE_NAME);function Bh(e,t=ye.IDENTIFIER,r=_.IDENTIFIER){return c.string().min(2,_.IDENTIFIER_MIN_LENGTH).max(50,e).regex(t,r).refine(i=>!i.endsWith("-"),{message:_.IDENTIFIER_NO_TRAILING_HYPHEN}).refine(i=>!i.includes("--"),{message:_.IDENTIFIER_NO_CONSECUTIVE_HYPHENS})}Il(Bh,"identifierSchema");var Ft=Bh(_.MAX_LENGTH.APP_NAME),Qve=Bh(_.MAX_LENGTH.APP_NAME,ye.NEW_APP_NAME,_.NEW_APP_NAME),Ks=c.number().int(_.PORT.INTEGER).min(v1,_.PORT.MIN).max(S1,_.PORT.MAX),Dt=c.object({key:c.string(),sourceText:c.string()}).strict(),p8=c.object({__identifier:c.string()}).strict(),m8=c.object({__expression:c.string()}).strict(),f8=c.object({__call:c.string()}).strict(),h8=c.union([p8,m8,f8]),g8=c.union([c.string(),c.number(),c.boolean(),h8]),Ws=c.record(c.string().regex(ye.ENV_VAR_NAME,_.ENV_VAR_NAME),g8),y8=c.object({id:c.string(),name:c.string().optional(),arn:c.string().optional(),field:c.string().optional()}).strict().refine(e=>e.name!==void 0!=(e.arn!==void 0),{message:"secretsImport requires exactly one of `name` or `arn`."}),D1=c.record(c.string(),y8),uT=c.enum(Al).describe(`Application type must be one of: ${Al.join(", ")}`),lT=c.enum(Rr).describe(`OpenNext deployment pattern: ${Rr.join(", ")}`),v8=c.enum(["before-imports","after-imports","after-app-init","after-tags","after-resource","end-of-file"]),S8=c.enum(["import","app-init","tags","database","compute","storage","network","messaging","cdn","pattern","vpc-peer","vpc-peer-accepter","cross-plan-connection","custom"]),N1=c.object({sourceText:c.string(),position:v8,afterManagedResource:c.object({type:S8,name:c.string().optional()}).strict().optional(),originalLine:c.number().int().optional(),leadingComments:c.array(c.string()).optional(),orphaned:c.boolean().optional(),orphanedComment:c.string().optional()}).strict(),k1=c.union([c.object({tier:c.enum(on)}).strict(),c.literal(!1)]),R1=c.union([c.object({instanceType:c.string().optional()}).strict(),c.literal(!1)]),b8=Bh(_.MAX_LENGTH.ORGANISATION_NAME),E8=c.string().regex(ye.EMAIL,_.EMAIL),T1=c.string().refine(e=>Yn.includes(e),{message:_.REGION}),eSe=c.object({name:b8,email:E8,accountName:c.string().optional(),primaryRegion:T1.optional().default(hs),secondaryRegions:c.array(T1).optional(),security:c.enum(g1).optional(),force:c.boolean().optional()}).strict();function Dl(e){return e.issues.map(t=>`${t.path.length>0?`${t.path.join(".")}: `:""}${t.message}`).join(`
 `)}Il(Dl,"getZodErrorMessage");var zh=c.number().min(1,_.ALARM.PERCENTAGE.MIN).max(100,_.ALARM.PERCENTAGE.MAX),dT=c.union([zh,c.literal(!1)]),_8=c.union([c.number().min(1,_.ALARM.RESPONSE_TIME_MS.MIN),c.literal(!1)]),A8=c.number().min(1,_.ALARM.FREE_STORAGE_GIB.MIN),w1=c.union([c.literal(!1),c.object({cpuThreshold:dT.optional(),memoryThreshold:dT.optional(),runningTasksMinimum:c.number().int().min(0).optional(),http5xxThreshold:dT.optional(),p99ResponseTimeThresholdMs:_8.optional()}).strict()]),P1=c.union([c.literal(!1),c.object({cpuThreshold:zh.optional(),freeStorageThresholdGiB:A8.optional(),connectionsThreshold:c.number().int().min(1).optional()}).strict()]),O1=c.union([c.literal(!1),c.object({errorRateThreshold:zh.optional(),durationThresholdPercent:zh.optional()}).strict()]);var Va=c.number().int(_.BACKUP_RETENTION.INTEGER).min(1,_.BACKUP_RETENTION.MIN).max(35,_.BACKUP_RETENTION.MAX),$1=c.number().int(_.CLICKHOUSE_STORAGE.INTEGER).min(100,_.CLICKHOUSE_STORAGE.MIN).max(16384,_.CLICKHOUSE_STORAGE.MAX),M1=c.number().int(_.CLICKHOUSE_IOPS.INTEGER).min(3e3,_.CLICKHOUSE_IOPS.MIN).max(8e4,_.CLICKHOUSE_IOPS.MAX),L1=c.number().int(_.CLICKHOUSE_THROUGHPUT.INTEGER).min(125,_.CLICKHOUSE_THROUGHPUT.MIN).max(2e3,_.CLICKHOUSE_THROUGHPUT.MAX),x8=c.enum(u1),j1=c.number().int(_.CLICKHOUSE_BACKUP_RETENTION.INTEGER).min(1,_.CLICKHOUSE_BACKUP_RETENTION.MIN).max(3650,_.CLICKHOUSE_BACKUP_RETENTION.MAX),Nl=c.number().int(_.MONITORING_INTERVAL.INTEGER).refine(e=>Jt(y1,e),{message:_.MONITORING_INTERVAL.VALUES}),Vh=c.number().int(_.DATABASE.PORT.INTEGER).min(1024,_.DATABASE.PORT.MIN).max(65535,_.DATABASE.PORT.MAX),T8=c.enum(wh).describe(`Database type must be one of: ${wh.join(", ")}`),C8=c.object({maxConnections:c.number().int(_.MAX_CONNECTIONS.INTEGER).min(1,_.MAX_CONNECTIONS.MIN).max(100,_.MAX_CONNECTIONS.MAX).optional(),maxIdleConnections:c.number().int(_.PROXY_CONFIG.MAX_IDLE_CONNECTIONS.INTEGER).min(0,_.PROXY_CONFIG.MAX_IDLE_CONNECTIONS.MIN).max(100,_.PROXY_CONFIG.MAX_IDLE_CONNECTIONS.MAX).optional(),connectionBorrowTimeout:c.number().int(_.PROXY_CONFIG.BORROW_TIMEOUT.INTEGER).min(1,_.PROXY_CONFIG.BORROW_TIMEOUT.MIN).max(3600,_.PROXY_CONFIG.BORROW_TIMEOUT.MAX).optional(),requireTLS:c.boolean().optional()}).strict().describe("RDS Proxy configuration"),I8=c.object({instanceType:c.string().optional(),availabilityZone:c.string().optional()}).strict().describe("Read replica configuration"),D8=c.object({automaticallyAfterDays:c.number().int(_.ROTATION.INTEGER).min(1,_.ROTATION.MIN).max(365,_.ROTATION.MAX).optional()}).strict().describe("Secret rotation configuration"),Kh=c.object({username:c.string().min(1,_.REQUIRED.USERNAME).max(63,_.USERNAME.MAX_LENGTH).optional(),secretRotation:D8.optional()}).strict().describe("Database credentials configuration"),Wh=Yt(C8),Hh=Yt(I8),N8=c.object({scaleWithWriter:c.boolean().optional(),enableDatabaseInsights:c.boolean().optional(),identifierSuffix:c.string().min(1,_.IDENTIFIER_SUFFIX.REQUIRED).max(50,_.IDENTIFIER_SUFFIX.MAX_LENGTH).optional(),availabilityZone:c.string().optional()}).strict().describe("Configuration for a single Aurora reader instance"),kl=c.object({enableDatabaseInsights:c.boolean().optional(),identifierSuffix:c.string().min(1,_.IDENTIFIER_SUFFIX.REQUIRED).max(50,_.IDENTIFIER_SUFFIX.MAX_LENGTH).optional(),availabilityZone:c.string().optional()}).strict().describe("Configuration for Aurora writer instance"),k8=c.object({count:c.number().int(_.READER.COUNT.INTEGER).min(0,_.READER.COUNT.MIN).max(15,_.READER.COUNT.MAX).optional(),instances:c.array(N8).max(15,_.READER_INSTANCES.MAX).optional(),defaultEnableDatabaseInsights:c.boolean().optional()}).strict().refine(e=>!(e.count!==void 0&&e.instances!==void 0),{message:_.READER_INSTANCES.COUNT_OR_INSTANCES,path:["count"]}).describe("Aurora readers configuration"),Rl=Yt(k8),R8=c.object({awsManaged:c.literal(!0)}).strict(),w8=c.object({useCMK:c.literal(!0)}).strict(),F1=c.union([R8,w8]),P8=c.object({mode:c.enum(["standard","advanced"]).optional(),encryptionKey:F1.optional()}).strict().describe("Database Insights configuration"),Zh=Yt(P8),Xh=c.object({storageKey:F1.optional()}).strict().describe("Encryption configuration (DESTRUCTIVE to change storageKey)"),wl=c.object({name:Ae,type:T8,databaseName:c.string().min(1,_.REQUIRED.DATABASE_NAME),instanceType:c.string().optional(),allocatedStorage:c.number().optional(),multiAz:c.boolean().optional(),publiclyAccessible:c.boolean().optional(),databaseInsights:Zh.optional(),port:Vh.optional(),deletionProtection:c.boolean().optional(),proxy:Wh.optional(),credentials:Kh.optional(),readReplica:Hh.optional(),encryption:Xh.optional(),writer:kl.optional(),readers:Rl.optional(),backupRetention:Va.optional(),preferredMaintenanceWindow:c.string().optional(),monitoringInterval:Nl.optional(),primaryRegion:c.string().optional(),secondaryRegions:c.array(c.string()).optional(),globalClusterIdentifier:c.string().optional(),enableGlobalWriteForwarding:c.boolean().optional(),snapshotIdentifier:c.string().optional(),snapshotUsername:c.string().optional(),databaseEngine:c.enum(zs).optional(),engineExpression:c.string().optional(),variableName:c.string().optional(),extraProperties:c.array(Dt).optional(),alarms:P1.optional()}).strict(),Jh=c.object({appName:Ft,nameProvidedByFlag:c.boolean().optional(),databaseName:c.string().min(1,_.REQUIRED.DATABASE_NAME).max(63,_.MAX_LENGTH.DATABASE_NAME).regex(ye.DATABASE_NAME,_.DATABASE_NAME),resourceName:Ae.optional(),connectionConfig:c.object({connectToCompute:c.array(c.string()).optional(),connectToServices:c.array(c.string()).optional()}).strict().optional(),databaseInsights:Zh.optional(),port:Vh.optional(),proxy:Wh.optional(),credentials:Kh.optional(),encryption:Xh.optional(),deletionProtection:c.boolean().optional()}).strict(),U1={databaseType:c.literal("Instance"),instanceType:c.string().optional(),multiAz:c.boolean().optional(),readReplica:Hh.optional(),publiclyAccessible:c.boolean().optional(),backupRetention:Va.optional(),allocatedStorage:c.number().optional(),snapshotIdentifier:c.string().optional(),snapshotUsername:c.string().optional()},B1={databaseType:c.literal("Aurora"),writer:kl.optional(),readers:Rl.optional(),backupRetention:Va.optional(),preferredMaintenanceWindow:c.string().optional(),monitoringInterval:Nl.optional(),snapshotIdentifier:c.string().optional(),snapshotUsername:c.string().optional()},z1={databaseType:c.literal("GlobalAurora"),primaryRegion:c.string().min(1,_.GLOBAL_AURORA.PRIMARY_REGION_REQUIRED),secondaryRegions:c.array(c.string()).optional(),globalClusterIdentifier:c.string().optional(),enableGlobalWriteForwarding:c.boolean().optional(),writer:kl.optional(),readers:Rl.optional(),backupRetention:Va.optional(),preferredMaintenanceWindow:c.string().optional(),monitoringInterval:Nl.optional(),snapshotIdentifier:c.string().optional(),snapshotUsername:c.string().optional()},G1=c.object({appName:Ft,nameProvidedByFlag:c.boolean().optional(),databaseName:c.string().min(1,_.REQUIRED.DATABASE_NAME).max(63,_.MAX_LENGTH.DATABASE_NAME).regex(ye.DATABASE_NAME,_.DATABASE_NAME),resourceName:Ae.optional(),connectionConfig:c.object({connectToCompute:c.array(c.string()).optional(),connectToServices:c.array(c.string()).optional()}).strict().optional()}).strict(),V1={databaseType:c.literal("ClickHouse"),instanceType:x8.optional(),storageGb:$1.optional(),iops:M1.optional(),throughputMbps:L1.optional(),coldTier:c.union([c.object({mode:c.literal("s3")}).strict(),c.literal(!1)]).optional(),optimiseSchedule:c.union([c.string(),c.literal(!1)]).optional(),backupSchedule:c.union([c.string(),c.literal(!1)]).optional(),backupVerify:c.literal(!1).optional(),backupRetentionDays:j1.optional()},O8=Jh.extend(U1).strict(),$8=Jh.extend(B1).strict(),M8=Jh.extend(z1).strict(),L8=G1.extend(V1).strict(),dSe=c.discriminatedUnion("databaseType",[O8,$8,M8,L8]),pT=Jh.extend({resourceName:Ae}).strict(),j8=pT.extend(U1).strict(),F8=pT.extend(B1).strict(),U8=pT.extend(z1).strict(),B8=G1.extend({resourceName:Ae}).strict(),z8=B8.extend(V1).strict(),pSe=c.discriminatedUnion("databaseType",[j8,F8,U8,z8]),mSe=c.object({appName:Ft,databaseName:c.string().min(1,_.REQUIRED.DATABASE_NAME),maxConnections:c.number().int(_.MAX_CONNECTIONS.INTEGER).min(1,_.MAX_CONNECTIONS.MIN).max(100,_.MAX_CONNECTIONS.MAX).optional(),maxIdleConnections:c.number().int(_.PROXY_CONFIG.MAX_IDLE_CONNECTIONS.INTEGER).min(0,_.PROXY_CONFIG.MAX_IDLE_CONNECTIONS.MIN).max(100,_.PROXY_CONFIG.MAX_IDLE_CONNECTIONS.MAX).optional(),connectionBorrowTimeout:c.number().int(_.PROXY_CONFIG.BORROW_TIMEOUT.INTEGER).min(1,_.PROXY_CONFIG.BORROW_TIMEOUT.MIN).max(3600,_.PROXY_CONFIG.BORROW_TIMEOUT.MAX).optional(),requireTLS:c.boolean().optional(),nameProvidedByFlag:c.boolean().optional()}).strict(),G8=["S","N","B"],Gh=c.object({name:c.string(),type:c.enum(G8)}).strict(),K1=c.object({name:Ae,partitionKey:Gh,sortKey:Gh.optional(),globalSecondaryIndexes:c.array(c.object({indexName:c.string(),partitionKey:Gh,sortKey:Gh.optional()}).strict()).optional(),ttlAttribute:c.string().optional(),stream:c.boolean().optional(),variableName:c.string().optional(),extraProperties:c.array(Dt).optional()}).strict(),V8=c.object({mode:c.literal("s3")}).strict(),W1=c.object({name:Ae,type:c.literal("ClickHouse"),databaseName:I1,instanceType:c.string().optional(),storageGb:$1.optional(),iops:M1.optional(),throughputMbps:L1.optional(),coldTier:c.union([V8,c.literal(!1)]).optional(),optimiseSchedule:c.union([c.string(),c.literal(!1)]).optional(),backupSchedule:c.union([c.string(),c.literal(!1)]).optional(),backupVerify:c.literal(!1).optional(),backupRetentionDays:j1.optional(),variableName:c.string().optional(),extraProperties:c.array(Dt).optional()}).strict();var K8=c.object({count:c.number().int(_.NAT_GATEWAY.INTEGER).min(0,_.NAT_GATEWAY.MIN).max(3,_.NAT_GATEWAY.MAX).optional()}).strict().describe("NAT gateway configuration"),H1=Yt(K8),mT=c.enum(["cloudwatch","s3"]),W8=c.object({destination:mT.optional(),retentionDays:c.number().int(_.RETENTION_DAYS.INTEGER).min(1,_.RETENTION_DAYS.MIN).max(365,_.RETENTION_DAYS.MAX).optional(),trafficType:c.enum(["ALL","ACCEPT","REJECT"]).optional()}).strict().describe("VPC flow log configuration"),Z1=Yt(W8),H8=c.object({s3:c.boolean().optional(),dynamodb:c.boolean().optional()}).strict().describe("Gateway VPC endpoints (FREE)"),Z8=Yt(H8),X8=c.object({ecr:c.boolean().optional(),secretsManager:c.boolean().optional(),kms:c.boolean().optional(),cloudwatchLogs:c.boolean().optional(),ssm:c.boolean().optional(),sts:c.boolean().optional()}).strict().describe("Interface VPC endpoints (cost per hour)"),J8=Yt(X8),Y8=c.object({gateway:Z8.optional(),interface:J8.optional()}).strict().describe("VPC endpoints configuration"),X1=Yt(Y8),Ka=c.object({maxAzs:c.number().int(_.MAX_AZS.INTEGER).min(1,_.MAX_AZS.MIN).max(3,_.MAX_AZS.MAX).optional(),natGateways:H1.optional(),flowLogs:Z1.optional(),vpcEndpoints:X1.optional(),cidrMask:c.number().int(_.CIDR_MASK.INTEGER).min(16,_.CIDR_MASK.MIN).max(28,_.CIDR_MASK.MAX).optional()}).strict(),J1=c.string().min(1,_.REQUIRED.NETWORK_NAME).max(50,_.MAX_LENGTH.NETWORK_NAME).regex(ye.RESOURCE_NAME,_.RESOURCE_NAME),Y1=Ka.extend({name:J1}).strict(),q1=Yt(Ka),vSe=c.object({appName:Ft,networkName:J1.optional(),maxAzs:c.number().int(_.MAX_AZS.INTEGER).min(1,_.MAX_AZS.MIN).max(3,_.MAX_AZS.MAX).optional(),natGateways:H1.optional(),flowLogs:Z1.optional(),vpcEndpoints:X1.optional()}).strict(),q8=ye.CIDR,Q1="0.0.0.0/0",Pl=c.string().regex(q8,_.CIDR),Q8=c.object({kind:c.literal("database"),resource:c.string().min(1,_.REQUIRED.RESOURCE_REFERENCE),name:Ae,allowedFromCidrs:c.array(Pl),access:c.enum(["read","write","readWrite"]).optional()}).strict(),eY=c.object({kind:c.literal("ecsService"),resource:c.string().min(1,_.REQUIRED.RESOURCE_REFERENCE),serviceName:c.string().min(1,_.REQUIRED.SERVICE_NAME),name:Ae,allowedFromCidrs:c.array(Pl),port:Ks.optional()}).strict(),tY=c.discriminatedUnion("kind",[Q8,eY]),ej=c.object({name:Ae,peerAppName:c.string().min(1,_.REQUIRED.APP_NAME),peerAccountId:c.string().regex(ye.AWS_ACCOUNT_ID,_.AWS_ACCOUNT_ID),peerRegion:c.string().min(1,_.VPC_PEER.REGION_REQUIRED).optional(),peerVpcId:c.string().regex(ye.VPC_ID,_.VPC_ID).optional(),peerVpcCidr:Pl.optional(),peerRoleArn:c.string().regex(ye.ROLE_ARN,_.ROLE_ARN).optional(),peerRouteTableIds:c.array(c.string().min(1,_.VPC_PEER.ROUTE_TABLE_ID_REQUIRED)).optional(),localVpcName:c.string().min(1,_.REQUIRED.NETWORK_NAME).optional(),enableDnsResolution:c.boolean().optional()}).strict(),fT=c.object({name:Ae,requesterAccountIds:c.array(c.string().regex(ye.AWS_ACCOUNT_ID,_.AWS_ACCOUNT_ID)).min(1,_.VPC_PEER.MIN_REQUESTER_ACCOUNTS),localVpcName:c.string().min(1,_.REQUIRED.NETWORK_NAME).optional(),publishToSsm:c.boolean().optional(),exposedResources:c.array(tY).optional()}).strict();var Yh=["storage","cdn","compute"],rY=c.object({sid:c.string().optional(),effect:c.enum(["Allow","Deny"]),principals:c.array(c.string()),actions:c.array(c.string()),resources:c.array(c.string()).optional(),conditions:c.record(c.string(),c.record(c.string(),c.union([c.string(),c.array(c.string())]))).optional()}).strict(),Ol=c.object({name:Ae,bucketName:c.string().optional(),publicReadAccess:c.boolean().optional(),websiteHosting:c.object({indexDocument:c.string(),errorDocument:c.string().optional()}).strict().optional(),backupVaultTier:c.enum(on).optional(),versioned:c.boolean().optional(),encryption:c.enum(Vs).optional(),kmsKeyArn:c.string().optional(),cors:c.array(c.object({allowedOrigins:c.array(c.string()),allowedMethods:c.array(c.string()),allowedHeaders:c.array(c.string()).optional(),exposedHeaders:c.array(c.string()).optional(),maxAge:c.number().optional()}).strict()).optional(),deployment:c.object({source:c.string(),prune:c.boolean().optional(),cacheControl:c.object({maxAge:c.number().optional(),immutable:c.boolean().optional()}).strict().optional()}).strict().optional(),retain:c.boolean().optional(),resourcePolicyStatements:c.array(rY).optional(),stackPlacement:c.enum(Yh).optional(),variableName:c.string().optional(),extraProperties:c.array(Dt).optional()}).strict().refine(e=>e.encryption!=="KMS"||!!e.kmsKeyArn,{message:_.KMS.KEY_REQUIRED}),xSe=c.object({appName:Ft,bucketName:C1,nameProvidedByFlag:c.boolean().optional(),storagePreset:c.enum(x1).optional(),publicReadAccess:c.boolean().optional(),websiteHosting:c.object({indexDocument:c.string(),errorDocument:c.string().optional()}).strict().optional(),backupVaultTier:c.enum(on).optional(),versioned:c.boolean().optional(),encryption:c.enum(Vs).optional(),kmsKeyArn:c.string().optional(),cors:c.array(c.object({allowedOrigins:c.array(c.string()),allowedMethods:c.array(c.string()),allowedHeaders:c.array(c.string()).optional(),exposedHeaders:c.array(c.string()).optional(),maxAge:c.number().optional()}).strict()).optional(),connectionConfig:c.object({connectToCompute:c.array(c.string()).optional(),connectToServices:c.array(c.string()).optional()}).strict().optional()}).strict().refine(e=>e.encryption!=="KMS"||!!e.kmsKeyArn,{message:_.KMS.KEY_REQUIRED,path:["kmsKeyArn"]});var hT=c.enum(["DESTROY","RETAIN"]),$l=c.object({name:Ae,queueType:c.enum(["standard","fifo"]).default("standard"),visibilityTimeout:c.number().int(_.SQS.VISIBILITY_TIMEOUT.INTEGER).min(0,_.SQS.VISIBILITY_TIMEOUT.MIN).max(43200,_.SQS.VISIBILITY_TIMEOUT.MAX).optional(),retentionPeriod:c.number().int(_.SQS.RETENTION_PERIOD.INTEGER).min(60,_.SQS.RETENTION_PERIOD.MIN).max(1209600,_.SQS.RETENTION_PERIOD.MAX).optional(),contentBasedDeduplication:c.boolean().optional(),removalPolicy:hT.optional(),variableName:c.string().optional(),extraProperties:c.array(Dt).optional()}).strict();var tj=c.object({type:c.literal("basic-auth"),username:c.string().min(1),password:c.string().min(1)}).strict(),Ml=c.object({name:Ae,defaultOriginRef:c.string(),behaviours:c.array(c.object({pathPattern:c.string(),originRef:c.string(),cachePolicy:c.enum(["CACHING_OPTIMIZED","CACHING_DISABLED"]).optional()}).strict()).optional(),customDomain:c.string().optional(),certificateArn:c.string().optional(),domain:c.string().optional(),originHostname:c.string().optional(),accessGate:c.union([c.literal(!1),tj]).optional(),extraProperties:c.array(Dt).optional()}).strict(),wSe=c.object({appName:c.string(),name:Ae.optional(),defaultOriginRef:c.string(),behaviours:c.array(c.object({pathPattern:c.string(),originRef:c.string(),cachePolicy:c.enum(["CACHING_OPTIMIZED","CACHING_DISABLED"]).optional()}).strict()).optional(),customDomain:c.string().optional(),certificateArn:c.string().optional(),domain:c.string().optional(),originHostname:c.string().optional(),accessGate:c.union([c.literal(!1),tj]).optional(),nameProvidedByFlag:c.boolean().optional()}).strict();var nY=Object.defineProperty,gT=(e,t)=>nY(e,"name",{value:t,configurable:!0}),iY=new Set(["t4g","c6g","c6gd","c6gn","c7g","c7gd","c7gn","r6g","r6gd","r7g","r7gd","r8g","r8gd","c8g","c8gd","c8gn","m6g","m6gd","m7g","m7gd","m8g","m8gd","x8g","i8g","a1","x2gd","im4gn","is4gen","i4g","hpc7g"]);function Ki(e){let t=e.split(".")[0]??"";return iY.has(t)?"ARM":"STANDARD"}gT(Ki,"getArchitectureForInstanceType");function qh(e,t){let r=Ki(e);return r!==t?{valid:!1,message:`Instance type '${e}' requires ${r} architecture, but '${t}' AMI was specified. Use a ${r==="ARM"?"Graviton instance (t4g, c6g, r6g, m6g, etc.)":"Intel/AMD instance (t3, c5, r5, m5, etc.)"} instead.`}:{valid:!0}}gT(qh,"validateArchitectureMatch");function rj(e,t){return Ki(e)===t}gT(rj,"isArchitectureCompatible");var aY=Object.defineProperty,Qh=(e,t)=>aY(e,"name",{value:t,configurable:!0});var oY=1;var sY=/^[A-Za-z0-9_.-]+$/,cY=c.object({id:c.string().min(1,"buildSecret id cannot be empty").regex(sY,"buildSecret id may contain only letters, digits, '_', '.', and '-' (no comma, '=', or whitespace, which would break the buildx --secret argv)"),ssm:c.string().min(1,"ssm parameter name cannot be empty").optional(),secretsManager:c.object({name:c.string().min(1,"secret name cannot be empty").optional(),arn:c.string().min(1,"secret arn cannot be empty").optional(),field:c.string().min(1,"secret field cannot be empty").optional()}).strict().refine(e=>e.name===void 0!=(e.arn===void 0),"secretsManager requires exactly one of name or arn").optional(),env:c.string().min(1,"env variable name cannot be empty").optional()}).strict().superRefine((e,t)=>{[e.ssm,e.secretsManager,e.env].filter(r=>r!==void 0).length!==1&&t.addIssue({code:c.ZodIssueCode.custom,message:"buildSecret requires exactly one source (ssm, secretsManager, or env)"})}),uY=c.union([c.string(),c.object({ssm:c.string().min(1,"ssm parameter name cannot be empty").optional(),secretsManager:c.object({name:c.string().min(1,"secret name cannot be empty").optional(),arn:c.string().min(1,"secret arn cannot be empty").optional(),field:c.string().min(1,"secret field cannot be empty").optional()}).strict().refine(e=>e.name===void 0!=(e.arn===void 0),"secretsManager requires exactly one of name or arn").optional(),env:c.string().min(1,"env variable name cannot be empty").optional(),acknowledgePublic:c.boolean().optional()}).strict().superRefine((e,t)=>{[e.ssm,e.secretsManager,e.env].filter(r=>r!==void 0).length!==1&&t.addIssue({code:c.ZodIssueCode.custom,message:"buildArg value requires exactly one source (ssm, secretsManager, or env)"})})]),An=c.object({path:c.string(),context:c.string().min(1,"context cannot be empty").optional(),target:c.string().min(1,"target cannot be empty").optional(),buildArgs:c.record(c.string(),uY).optional(),buildSecrets:c.array(cY).optional()}).strict(),LSe=An.partial();function lY(e,t){if(t===void 0)return e;let r=t.context??e.context,i=t.target??e.target,n=t.buildArgs??e.buildArgs,a=t.buildSecrets??e.buildSecrets;return{path:t.path??e.path,...r!==void 0&&{context:r},...i!==void 0&&{target:i},...n!==void 0&&{buildArgs:n},...a!==void 0&&{buildSecrets:a}}}Qh(lY,"mergeDockerBuild");function yT(e){return typeof e=="object"&&e!==null&&!Array.isArray(e)}Qh(yT,"isRecord");function nj(e){if(!yT(e)||typeof e.path!="string"||e.path.length===0)return;let t=typeof e.context=="string"&&e.context.length>0?e.context:void 0,r=typeof e.target=="string"&&e.target.length>0?e.target:void 0,i=yT(e.buildArgs)&&Object.keys(e.buildArgs).length>0?e.buildArgs:void 0,n=Array.isArray(e.buildSecrets)&&e.buildSecrets.length>0?e.buildSecrets:void 0,a={path:e.path,...t!==void 0&&{context:t},...r!==void 0&&{target:r},...i!==void 0&&{buildArgs:i},...n!==void 0&&{buildSecrets:n}},o=An.safeParse(a);return o.success?o.data:void 0}Qh(nj,"normaliseDockerBuild");function dY(e){if(e===void 0)return;let t=nj(e);return t===void 0?void 0:JSON.stringify(t)}Qh(dY,"dockerBuildFingerprint");var pY=c.object({name:c.string(),clusterName:c.string().optional(),docker:An.optional(),containerPort:c.number().optional(),secrets:c.array(c.string()).optional(),ssmSecretsPath:c.string().optional(),importedSecretNames:c.array(c.string()).optional(),schemaGateImageTag:c.string().optional()}).strict(),mY=c.object({type:c.enum(Rr),name:c.string(),source:c.string()}).strict(),fY=c.object({repositoryName:c.string()}).strict(),hY=["x86_64","arm64"],gY=c.object({name:c.string(),secrets:c.array(c.string()).optional(),ssmSecretsPath:c.string().optional(),importedSecretNames:c.array(c.string()).optional(),docker:An.optional(),imageKey:c.string().optional(),architecture:c.enum(hY).optional()}).strict(),yY=c.object({templateHash:c.string(),synthTimestamp:c.string()}).strict(),vY=c.object({constructPath:c.string().max(512),group:c.string().max(128),resourceType:c.string().max(256)}).strict(),SY=c.object({synthesisedBy:c.string().min(1).max(128),minimumEngineVersion:c.string().min(1).max(32),maximumEngineMajor:c.number().int().min(0).optional(),minimumAwsCdkCli:c.string().min(1).max(32).optional()}).strict(),bY=c.object({appName:c.string().min(1).max(128),slot:c.string().min(1).max(64),clusterName:c.string().min(1).max(128),anchor:c.string().min(1).max(128),pinned:c.boolean(),currentServiceName:c.string().min(1).max(256),legacyKey:c.string().min(1).max(256),legacyAnchor:c.string().min(1).max(256),legacyServiceName:c.string().min(1).max(512),legacyKeyFields:c.array(c.string().max(64)).max(32)}).strict(),EY=c.object({constructPath:c.string().min(1).max(512),resourceType:c.string().min(1).max(256),physicalNameHint:c.string().min(1).max(512),policy:c.enum(["retain","snapshot","adopted"]),destroyDisposition:c.enum(["survives","deleted-on-explicit-destroy"]),reason:c.string().min(1).max(1024),costClass:c.enum(["none","storage","fixed-monthly"]),cleanupHint:c.string().min(1).max(1024)}).strict(),jSe=c.object({version:c.literal(oY),generatedAt:c.string(),appName:c.string(),services:c.array(pY),lambdas:c.array(gY),pattern:mY.optional(),ecr:fY.optional(),stacks:c.record(c.string(),yY),resourceMap:c.record(c.string(),vY).optional(),engineCompat:SY.optional(),identityAliases:c.array(bY).optional(),residuals:c.array(EY).optional()}).strict();var _Y=Object.defineProperty,AY=(e,t)=>_Y(e,"name",{value:t,configurable:!0});function aj(e){return!(e.image!==void 0&&e.docker!==void 0)}AY(aj,"imageDockerMutexCheck");var Ll=c.number().int(_.LAMBDA.MEMORY.INTEGER).min(b1,_.LAMBDA.MEMORY.MIN).max(E1,_.LAMBDA.MEMORY.MAX).refine(e=>e===128||e%64===0,_.LAMBDA.MEMORY.MULTIPLE),oj=c.string().regex(ye.LAMBDA_RUNTIME_IDENTIFIER,_.LAMBDA.RUNTIME),sj=c.number().int(_.CPU.INTEGER).min(256,_.CPU.MIN).max(4096,_.CPU.MAX),vT=c.number().int(_.CAPACITY.DESIRED.INTEGER).min(0,_.CAPACITY.DESIRED.MIN).max(Gs,_.CAPACITY.DESIRED.MAX),cj=c.object({connectToDatabase:c.array(c.string()).optional()}).strict(),xY=c.object({minSize:c.number().int(_.CAPACITY.WARM_POOL.MIN_SIZE.INTEGER).min(0,_.CAPACITY.WARM_POOL.MIN_SIZE.MIN).max(_1,_.CAPACITY.WARM_POOL.MIN_SIZE.MAX).optional(),reuseOnScaleIn:c.boolean().optional()}).strict(),uj=c.object({instanceType:c.string().optional(),amiHardwareType:c.enum(jh).optional(),minCapacity:c.number().int(_.CAPACITY.MIN.INTEGER).min(0,_.CAPACITY.MIN.MIN_0).max(Gs,_.CAPACITY.MIN.MAX).optional(),maxCapacity:c.number().int(_.CAPACITY.MAX.INTEGER).min(1,_.CAPACITY.MAX.MIN_1).max(Gs,_.CAPACITY.MAX.MAX).optional(),memoryLimitMiB:Uh(128).optional(),warmPool:xY.optional(),extraProperties:c.array(Dt).optional()}).strict().superRefine((e,t)=>{if(!e.instanceType||!e.amiHardwareType)return;let r=qh(e.instanceType,e.amiHardwareType);r.valid||t.addIssue({code:"custom",message:r.message??_.ARCHITECTURE_MISMATCH,path:["instanceType"]})}).superRefine((e,t)=>{e.minCapacity===0&&!e.warmPool&&t.addIssue({code:"custom",message:_.CAPACITY.WARM_POOL_REQUIRED,path:["minCapacity"]}),e.warmPool?.minSize!==void 0&&e.maxCapacity!==void 0&&e.warmPool.minSize>e.maxCapacity&&t.addIssue({code:"custom",message:_.CAPACITY.WARM_POOL.MIN_SIZE_EXCEEDS_MAX_CAPACITY,path:["warmPool","minSize"]})}),TY=c.enum(xl).describe(`Compute type must be one of: ${xl.join(", ")}`),lj=c.enum(Bs).describe(`ECS capacity provider must be one of: ${Bs.join(", ")}`),dj=c.string().refine(e=>Jt(Fh,e),{message:_.INSTANCE_TYPE}),pj=c.object({sourceType:c.enum(["sqs","dynamodb","eventbridge"]),sourceRef:c.string().describe("Name of the source resource"),batchSize:c.number().int(_.BATCH_SIZE.INTEGER).min(1,_.BATCH_SIZE.MIN).max(1e4,_.BATCH_SIZE.MAX).optional(),startingPosition:c.enum(["TRIM_HORIZON","LATEST"]).optional(),maxBatchingWindow:c.number().int(_.BATCHING_WINDOW.INTEGER).min(0,_.BATCHING_WINDOW.MIN).max(300,_.BATCHING_WINDOW.MAX).optional(),reportBatchItemFailures:c.boolean().optional()}).strict(),CY=c.object({name:c.string().min(1,_.REQUIRED.CONTAINER_NAME).optional(),image:c.string().optional(),port:Ks.optional(),environment:Ws.optional(),secretsImport:D1.optional(),command:c.array(c.string()).optional(),entryPoint:c.array(c.string()).optional(),essential:c.boolean().optional(),healthCheck:c.object({command:c.array(c.string()),interval:c.number().int(_.HEALTH_CHECK.INTERVAL.INTEGER).min(5,_.HEALTH_CHECK.INTERVAL.MIN).max(300,_.HEALTH_CHECK.INTERVAL.MAX).optional(),timeout:c.number().int(_.HEALTH_CHECK.TIMEOUT.INTEGER).min(2,_.HEALTH_CHECK.TIMEOUT.MIN).max(60,_.HEALTH_CHECK.TIMEOUT.MAX).optional(),retries:c.number().int(_.HEALTH_CHECK.RETRIES.INTEGER).min(1,_.HEALTH_CHECK.RETRIES.MIN).max(10,_.HEALTH_CHECK.RETRIES.MAX).optional(),startPeriod:c.number().int(_.HEALTH_CHECK.START_PERIOD.INTEGER).min(0,_.HEALTH_CHECK.START_PERIOD.MIN).max(300,_.HEALTH_CHECK.START_PERIOD.MAX).optional()}).strict().optional(),ssmSecrets:c.array(c.string().regex(ye.SECRET_NAME,_.SECRET_NAME)).optional(),extraProperties:c.array(Dt).optional()}).strict(),mj=c.string().min(1,_.REQUIRED.SERVICE_NAME).max(255,_.MAX_LENGTH.SERVICE_NAME).regex(ye.ECS_SERVICE_NAME,_.ECS_SERVICE_NAME),fj=c.object({domain:c.string().optional(),loadBalancer:c.union([c.literal(!1),c.enum(Mh)]).optional(),directAccess:c.boolean().optional(),extraProperties:c.array(Dt).optional()}).strict().refine(e=>!(e.directAccess&&e.domain),{message:_.DIRECT_ACCESS.NO_DOMAIN,path:["directAccess"]}).refine(e=>!(e.directAccess&&typeof e.loadBalancer=="string"),{message:_.DIRECT_ACCESS.NO_LOAD_BALANCER}).describe("Cluster-level configuration"),eg=c.object({path:c.string().optional(),host:c.string().optional(),priority:c.number().int(_.PRIORITY.INTEGER).min(1,_.PRIORITY.MIN).max(5e4,_.PRIORITY.MAX).optional(),healthCheckPath:c.string().optional()}).strict().describe("Path/host-based routing configuration"),IY=c.object({desiredCount:vT.optional(),minCapacity:c.number().int(_.CAPACITY.MIN.INTEGER).min(0,_.CAPACITY.MIN.MIN_0).max(Gs,_.CAPACITY.MIN.MAX).optional(),maxCapacity:c.number().int(_.CAPACITY.MAX.INTEGER).min(1,_.CAPACITY.MAX.MIN_1).max(Gs,_.CAPACITY.MAX.MAX).optional(),scalingType:c.enum(Lh).optional()}).strict().refine(cT.check,cT.params).describe("ECS service scaling configuration"),hj=c.object({name:mj,docker:An.optional(),needsDatabaseConnection:c.boolean().optional(),needsStorageConnection:c.boolean().optional(),needsMessagingConnection:c.boolean().optional(),image:c.string().optional(),containers:c.array(CY).optional(),routing:c.union([eg,c.array(eg).min(1)]).optional(),serviceType:c.enum(Cl).optional(),cpu:sj.optional(),memoryLimitMiB:Uh(512).optional(),desiredCount:vT.optional(),scaling:Yt(IY).optional(),capacityProvider:lj,ec2Config:uj.optional(),ssmSecretsPath:c.string().regex(ye.SSM_PATH,_.SSM_PATH).optional(),extraProperties:c.array(Dt).optional(),alarms:w1.optional()}).strict().superRefine((e,t)=>{aj(e)||t.addIssue({code:"custom",path:["docker"],message:_.IMAGE_DOCKER_MUTEX})}).describe("Configuration for a service in an ECS cluster"),tg=c.object({allowedIpCidrs:c.array(Pl).min(1,_.REQUIRED.SSH_ALLOWED_IP_CIDRS).refine(e=>new Set(e).size===e.length,_.SSH_ALLOWED_IP_CIDRS_UNIQUE).describe("IPv4 source ranges allowed on TCP 22, one ingress rule each; 0.0.0.0/0 deploys with a synth warning"),keyName:c.string().min(1,_.REQUIRED.SSH_KEY_NAME).optional().describe("Existing EC2 key pair name; omit to create one named after the instance"),public:c.boolean().optional().describe("Public subnets and a public IP; default false keeps the instances private, reachable only from inside the VPC, a peer or a VPN")}).strict().describe("SSH access: who may reach port 22, which key pair, and whether the instances are public. Omit for Session Manager-only access"),jl=c.object({name:Ae,type:TY,needsConnection:c.boolean(),connectedDatabase:c.array(c.string().min(1,_.REQUIRED.CONNECTED_RESOURCE_NAME)).optional(),connectedStorage:c.array(c.string().min(1,_.REQUIRED.CONNECTED_RESOURCE_NAME)).optional(),connectedMessaging:c.array(c.string().min(1,_.REQUIRED.CONNECTED_RESOURCE_NAME)).optional(),cluster:fj.optional(),containerInsights:c.boolean().optional(),services:c.array(hj).optional(),docker:An.partial().optional(),deployment:c.enum(Ph).optional(),codePath:c.string().optional(),timeout:c.number().int(_.LAMBDA.TIMEOUT.INTEGER).min(oT,_.LAMBDA.TIMEOUT.MIN).max(sT,_.LAMBDA.TIMEOUT.MAX).optional(),memory:Ll.optional(),handler:c.string().optional(),runtime:oj.optional(),environment:Ws.optional(),secrets:Ws.optional(),eventSources:c.array(pj).optional(),functionUrl:c.object({authType:c.enum(Tl)}).strict().optional(),description:c.string().optional(),scheduleExpression:c.string().optional(),scheduleStackPlacement:c.enum(Ga).optional(),architecture:c.enum($h).optional(),ephemeralStorageSize:c.number().int(_.EPHEMERAL_STORAGE.INTEGER).min(512,_.EPHEMERAL_STORAGE.MIN).max(10240,_.EPHEMERAL_STORAGE.MAX).optional(),functionName:c.string().optional(),ssmSecrets:c.array(c.string()).optional(),ssmSecretsPath:c.string().optional(),alarms:O1.optional(),instanceType:dj.optional(),sshAccess:tg.optional(),userData:c.string().optional(),securityGroups:c.array(c.string()).optional(),variableName:c.string().optional(),extraProperties:c.array(Dt).optional()}).strict().superRefine((e,t)=>{if(e.type==="ecs"&&e.services)for(let r=0;r<e.services.length;r++){let i=e.services[r];i?.ec2Config?.instanceType&&!i.ec2Config.amiHardwareType&&Ki(i.ec2Config.instanceType)!=="ARM"&&t.addIssue({code:"custom",message:`Service '${i.name??r}' uses instance type '${i.ec2Config.instanceType}' (x86), which requires Docker images built for linux/amd64. The default build targets linux/arm64 (Graviton). Use a Graviton instance type (t4g, c6g, r6g, m6g, etc.) or set amiHardwareType: "STANDARD" to acknowledge x86.`,path:["services",r,"ec2Config","instanceType"]})}e.type==="lambda"&&e.deployment==="container"&&e.architecture==="X86_64"&&t.addIssue({code:"custom",message:"Lambda architecture 'X86_64' requires Docker images built for linux/amd64, but the default build targets linux/arm64. Use 'ARM_64' for Graviton Lambdas (recommended) or ensure your build pipeline targets linux/amd64.",path:["architecture"]})}),ZSe=c.object({appName:Ft,clusterName:Ae,serviceName:mj,capacityProvider:lj,containerPort:Ks.optional(),cpu:sj.optional(),memoryLimitMiB:Uh(512).optional(),desiredCount:vT.optional(),ec2Config:uj.optional(),routing:c.union([eg,c.array(eg).min(1)]).optional(),docker:An.partial().optional(),nameProvidedByFlag:c.boolean().optional(),connectionConfig:cj.optional()}).strict(),ST=c.object({appName:Ft,computeName:Ae,nameProvidedByFlag:c.boolean().optional(),connectionConfig:cj.optional()}).strict(),DY=ST.extend({type:c.literal("ecs"),cluster:fj.optional(),services:c.array(hj).min(1,_.SERVICE.MIN_REQUIRED),docker:An.partial().optional()}).strict().refine(e=>{let t=e.services.filter(r=>r.containers?.some(i=>i.port));return t.length>1?t.every(r=>(Array.isArray(r.routing)?r.routing:r.routing?[r.routing]:[]).some(i=>i.path||i.host)):!0},{message:_.SERVICE.ROUTING_REQUIRED}).refine(e=>{let t=e.services.map(r=>r.name);return new Set(t).size===t.length},{message:_.SERVICE.UNIQUE_WITHIN_CLUSTER}),NY=ST.extend({type:c.literal("lambda"),timeout:c.number().int(_.LAMBDA.TIMEOUT.INTEGER).min(oT,_.LAMBDA.TIMEOUT.MIN).max(sT,_.LAMBDA.TIMEOUT.MAX).optional(),memory:Ll.optional(),handler:c.string().optional(),runtime:oj.optional(),environment:Ws.optional(),secrets:Ws.optional(),description:c.string().optional(),functionUrl:c.union([c.object({authType:c.enum(Tl).optional()}).strict(),c.literal(!1)]).optional(),eventSources:c.array(pj).optional()}).strict(),kY=ST.extend({type:c.literal("ec2"),instanceType:dj.optional(),sshAccess:tg.optional(),userData:c.string().optional(),securityGroups:c.array(c.string()).optional()}).strict(),XSe=c.discriminatedUnion("type",[DY,NY,kY]),ij=c.object({path:c.string().min(1,_.REQUIRED.ROUTING_PATH),priority:c.number().int(_.PRIORITY.INTEGER).min(1,_.PRIORITY.MIN).max(5e4,_.PRIORITY.MAX).optional()}).strict(),gj=c.object({name:c.string().min(1,_.REQUIRED.SERVICE_NAME).max(255,_.MAX_LENGTH.SERVICE_NAME).regex(ye.RESOURCE_NAME,_.RESOURCE_NAME),serviceType:c.enum(Cl).optional(),docker:An.partial().optional(),containerPort:Ks.optional(),needsDatabaseConnection:c.boolean().optional(),routing:c.union([ij,c.array(ij).min(1)]).optional()}).strict().superRefine((e,t)=>{e.serviceType==="worker"&&(e.containerPort!==void 0&&t.addIssue({code:"custom",path:["containerPort"],message:"Worker services are not reachable inbound; remove containerPort."}),e.routing!==void 0&&t.addIssue({code:"custom",path:["routing"],message:"Worker services have no ALB route; remove routing."}))}),JSe=c.object({appName:Ft,instanceType:c.string().optional()}).strict();var bT=c.object({memorySize:Ll.optional(),timeout:c.number().int(_.LAMBDA.TIMEOUT.INTEGER).min(1,_.LAMBDA.TIMEOUT.MIN).max(900,_.LAMBDA.TIMEOUT.MAX).optional(),ephemeralStorageSize:c.number().int(_.EPHEMERAL_STORAGE.INTEGER).min(512,_.EPHEMERAL_STORAGE.MIN).max(10240,_.EPHEMERAL_STORAGE.MAX).optional()}).strict(),yj=c.object({type:c.enum(aT).optional(),databaseName:c.string().optional(),databaseEngine:c.enum(zs).optional(),deletionProtection:c.boolean().optional(),backupRetention:Va.optional(),port:Vh.optional(),publiclyAccessible:c.boolean().optional(),allowedIpCidr:c.string().optional(),instanceType:c.string().optional(),allocatedStorage:c.number().int(_.ALLOCATED_STORAGE.INTEGER).min(20,_.ALLOCATED_STORAGE.MIN).max(65536,_.ALLOCATED_STORAGE.MAX).optional(),multiAz:c.boolean().optional(),readReplica:Hh.optional(),writer:kl.optional(),readers:Rl.optional(),allowVpcAccess:c.boolean().optional(),monitoringInterval:Nl.optional(),preferredMaintenanceWindow:c.string().optional(),databaseInsights:Zh.optional(),proxy:Wh.optional(),credentials:Kh.optional(),encryption:Xh.optional(),snapshotIdentifier:c.string().optional(),snapshotUsername:c.string().optional()}).strict(),vj=c.object({server:bT.optional(),imageOptimisation:bT.optional(),revalidation:bT.optional()}).strict(),ET=c.object({versioned:c.boolean().optional()}).strict(),RY={assets:ET.optional(),cache:ET.optional(),media:ET.optional()},Sj=c.object(RY).strict(),wY=c.object({visibilityTimeout:c.number().int(_.SQS.VISIBILITY_TIMEOUT.INTEGER).min(0,_.SQS.VISIBILITY_TIMEOUT.MIN).max(43200,_.SQS.VISIBILITY_TIMEOUT.MAX).optional(),messageRetentionPeriod:c.number().int(_.SQS.RETENTION_PERIOD.INTEGER).min(60,_.SQS.RETENTION_PERIOD.MIN).max(1209600,_.SQS.RETENTION_PERIOD.MAX).optional(),maxMessageSize:c.number().int(_.MAX_MESSAGE_SIZE.INTEGER).min(1024,_.MAX_MESSAGE_SIZE.MIN).max(262144,_.MAX_MESSAGE_SIZE.MAX).optional(),deadLetterQueue:c.union([c.literal(!1),c.object({enabled:c.boolean().optional(),maxReceiveCount:c.number().int(_.DLQ.MAX_RECEIVE_COUNT.INTEGER).min(1,_.DLQ.MAX_RECEIVE_COUNT.MIN).max(1e3,_.DLQ.MAX_RECEIVE_COUNT.MAX).optional()}).strict()]).optional()}).strict(),bj=c.object({revalidationQueue:wY.optional()}).strict(),Ej=c.object({domainNames:c.array(c.string()).optional(),certificateArn:c.string().optional()}).strict(),_j=c.record(c.string().regex(ye.ENV_VAR_NAME,_.ENV_VAR_NAME),c.string()).optional(),_T=c.object({type:c.literal("payload"),name:c.string().min(1,_.REQUIRED.PATTERN_NAME),domain:c.string().optional(),database:yj.optional(),compute:vj.optional(),storage:Sj.optional(),messaging:bj.optional(),cdn:Ej.optional(),environment:_j}).strict(),AT=c.object({type:c.literal("nextjs"),name:c.string().min(1,_.REQUIRED.PATTERN_NAME),domain:c.string().optional(),database:yj.optional(),compute:vj.optional(),storage:Sj.optional(),messaging:bj.optional(),cdn:Ej.optional(),environment:_j}).strict(),xT=c.enum(Vu),PY=c.object({command:c.string().min(1,_.REQUIRED.BUILD_COMMAND),outputDir:c.string().min(1,_.REQUIRED.OUTPUT_DIR)}).strict(),OY=c.object({maxAgeDays:c.number().optional(),includeSubdomains:c.boolean().optional(),preload:c.boolean().optional()}).strict(),$Y=c.object({headers:c.boolean().optional(),contentSecurityPolicy:c.string().optional(),hsts:c.union([c.literal(!1),OY]).optional()}).strict(),MY=c.object({to:c.string().min(1,_.REQUIRED.FORMS_TO).regex(ye.EMAIL,_.EMAIL),from:c.string().regex(ye.EMAIL,_.EMAIL).optional(),corsOrigin:c.string().regex(ye.HTTP_ORIGIN,"corsOrigin must be an exact origin such as https://example.com (no path, no trailing slash)").optional(),maxConcurrency:c.number().int().min(1).max(100).optional()}).strict(),LY=c.object({behaviours:c.array(c.unknown()).optional(),priceClass:c.enum(Ku).optional(),invalidateOnDeploy:c.boolean().optional()}).strict(),jY=c.object({type:c.literal("basic-auth"),username:c.string().min(1,"accessGate.username must not be empty"),password:c.string().min(1,"accessGate.password must not be empty")}).strict(),Fl=c.object({type:c.literal("staticsite"),name:c.string().min(1,_.REQUIRED.PATTERN_NAME),source:c.string().min(1,_.REQUIRED.SOURCE),build:PY,routing:xT.optional(),security:$Y.optional(),domain:c.string().optional(),zoneName:c.string().optional(),hostedZoneId:c.string().optional(),forms:MY.optional(),cdn:LY.optional(),accessGate:jY.optional()}).strict().superRefine((e,t)=>{if(e.forms===void 0)return;let r=e.domain;if(r===void 0||r===""){t.addIssue({code:"custom",path:["domain"],message:"A domain is required when forms are enabled: SES sends only from a verified identity, and the site's domain is the identity the pattern verifies"});return}let i=e.forms.from;i!==void 0&&!Wf(i,r)&&t.addIssue({code:"custom",path:["forms","from"],message:`forms.from must be an address at ${r} (the verified SES identity) \u2014 for example noreply@${r}. Use forms.to for the recipient.`})}),Wi=c.discriminatedUnion("type",[_T,AT,Fl]),Aj=c.enum(A0),xj=c.object({type:c.enum(aT),instanceType:c.string().optional(),backupRetention:Va.optional(),deletionProtection:c.boolean().optional(),encryption:c.union([c.object({useCMK:c.literal(!0)}).strict(),c.literal(!1)]).optional()}).strict(),Tj=c.object({memorySize:Ll.optional(),timeout:c.number().int(_.LAMBDA.TIMEOUT.INTEGER).min(1,_.LAMBDA.TIMEOUT.MIN).max(900,_.LAMBDA.TIMEOUT.MAX).optional()}).strict();var Cj=c.object({appName:Ft,type:uT,pattern:lT.optional(),patternConfig:Wi.optional(),owner:c.string().optional(),tags:c.record(c.string(),c.string()).optional(),vpcId:c.string().optional(),network:Ka.optional(),backup:k1.optional(),tunnel:R1.optional(),additionalNetworks:c.array(Y1).optional(),database:c.array(wl),s3:c.array(Ol),compute:c.array(jl),dynamodb:c.array(K1).optional(),clickhouse:c.array(W1).optional(),sqs:c.array($l).optional(),cdn:Ml.optional(),customCodeBlocks:c.array(N1).optional(),additionalManagedImports:c.array(c.object({moduleSpecifier:c.string(),namedImports:c.array(c.string()),defaultImport:c.string().optional()}).strict()).optional()}).strict(),Ij=c.object({name:Ft,type:uT,pattern:lT.optional(),patternTier:Aj.optional(),patternDomain:c.string().optional(),source:c.string().min(1,_.REQUIRED.SOURCE).optional(),buildCommand:c.string().min(1,_.REQUIRED.BUILD_COMMAND).optional(),outputDir:c.string().min(1,_.REQUIRED.OUTPUT_DIR).optional(),routing:xT.optional(),formsTo:c.string().min(1,_.REQUIRED.FORMS_TO).regex(ye.EMAIL,_.EMAIL).optional(),corsOrigin:c.string().regex(ye.HTTP_ORIGIN,"corsOrigin must be an exact origin such as https://example.com (no path, no trailing slash)").optional(),customDatabase:xj.optional(),customCompute:Tj.optional(),region:c.string().optional(),owner:c.string().optional(),includeDatabase:c.boolean().optional(),databaseName:c.string().min(1,_.DATABASE.NAME.REQUIRED).max(63,_.DATABASE.NAME.MAX_LENGTH).optional(),vpcId:c.string().optional(),network:q1.optional(),services:c.array(gj).optional(),snapshotIdentifier:c.string().optional(),snapshotUsername:c.string().optional()}).strict().superRefine((e,t)=>{e.formsTo!==void 0&&(e.patternDomain!==void 0&&e.patternDomain!==""||t.addIssue({code:"custom",path:["patternDomain"],message:"A domain is required when forms are enabled: SES sends only from a verified identity, and the site's domain is the identity the pattern verifies"}))}),TT=c.object({name:Ae,localResource:c.string().min(1),remoteApp:c.string().min(1),remoteResource:c.string().min(1),permission:c.enum(["read","write","read-write"]),remoteArn:c.string().optional()}).strict();var FY=["fjall-managed","external","external-manual"],bbe=c.enum(FY);var Dj=c.object({givenName:c.string().min(1),familyName:c.string().min(1),displayName:c.string().min(1).optional(),expires:c.string().min(1).optional()}).strict(),Nj=c.object({name:c.string().min(1),path:c.string().min(1).optional()}).strict(),UY=c.union([c.object({managedPolicyArn:c.string().min(1)}).strict(),c.object({customerManagedPolicy:Nj}).strict()]),BY=c.object({managedPolicies:c.array(c.string().min(1)).optional(),inlinePolicy:c.record(c.string(),c.unknown()).optional(),customerManagedPolicies:c.array(Nj).optional(),permissionsBoundary:UY.optional(),sessionDuration:c.string().min(1).optional(),description:c.string().optional(),accounts:c.union([c.array(c.string().min(1)),c.literal("all")]).optional(),includeManagementAccount:c.boolean().optional(),groups:c.array(c.string().min(1)).optional()}).strict(),zY=c.object({description:c.string().optional()}).strict(),rg=c.string().regex(ye.EMAIL,_.EMAIL),CT={groups:c.record(c.string(),zY).optional(),permissionSets:c.record(c.string(),BY).optional(),memberships:c.record(c.string(),c.array(rg)).optional(),resolutionVersion:c.number().int().min(1).optional(),defaultPermissionSets:c.boolean().optional()},GY=c.discriminatedUnion("source",[c.object({...CT,source:c.literal("fjall-managed"),users:c.record(rg,Dj)}).strict(),c.object({...CT,source:c.literal("external")}).strict(),c.object({...CT,source:c.literal("external-manual"),users:c.record(rg,Dj).optional()}).strict()]),IT=c.object({name:Ae,type:c.literal("organisation").optional(),organisationName:c.string().min(1).optional(),orgEmail:rg.optional(),accounts:c.unknown().optional(),accountIds:c.record(c.string(),c.string()).optional(),identityCentre:c.union([GY,c.literal(!1)]).optional(),allowedRegions:c.array(c.string().min(1)).optional()}).strict();var VY=Object.defineProperty,KY=(e,t)=>VY(e,"name",{value:t,configurable:!0}),WY=[1,3,5,7,14,30,60,90,120,150,180,365,400,545,731,1827,3653],ng=c.object({buildkiteQueue:c.string().min(1,"buildkiteQueue cannot be empty").max(100).regex(/^[a-zA-Z0-9-_]+$/,"buildkiteQueue must be alphanumeric with hyphens/underscores"),buildkiteOrgSlug:c.string().min(1,"buildkiteOrgSlug cannot be empty").max(100).regex(/^[a-z0-9-]+$/,"buildkiteOrgSlug must be a lowercase Buildkite organisation slug"),agentTokenSsmParameterName:c.string().min(2).regex(/^\//,"agentTokenSsmParameterName must be a full path (leading /)").optional(),agentTokenKmsKeyArn:c.string().min(1).optional(),fjallApiKeySsmParameterName:c.string().min(2).regex(/^\//,"fjallApiKeySsmParameterName must be a full path (leading /)").optional(),instanceType:c.string().min(1).default("c8g.xlarge"),agentVolumeSizeGib:c.number().int().min(20).max(1e3).default(250),agentMinInstances:c.number().int().min(0).default(0),agentMaxInstances:c.number().int().min(1).default(2),agentsPerInstance:c.number().int().min(1).default(1),spotCapacityPercentage:c.number().int().min(0).max(100).default(0),scaleInIdlePeriodSeconds:c.number().int().min(60).default(600),disconnectAfterUptimeSeconds:c.number().int().min(3600).default(86400),maxInstanceLifetimeDays:c.number().int().min(1).max(365).default(7),terminateInstanceAfterJob:c.boolean().default(!1),purgeBuildsOnDiskFull:c.boolean().default(!0),terminateInstanceOnDiskFull:c.boolean().default(!1),logRetentionDays:c.number().int().min(1).default(30),agentLogRetentionDays:c.literal(WY).default(7),buildkiteAgentRelease:c.enum(["stable","beta","edge"]).default("stable"),buildkiteAgentTags:c.string().default(""),buildkiteAgentTimestampLines:c.boolean().default(!1),buildkiteAgentExperiments:c.string().default(""),buildkiteAgentTracingBackend:c.enum(["","datadog","opentelemetry"]).default(""),buildkiteAgentCancelGracePeriodSeconds:c.number().int().min(10).default(60),enableSecretsPlugin:c.boolean().default(!0),enableEcrPlugin:c.boolean().default(!1),enableDockerLoginPlugin:c.boolean().default(!1),enableDockerUserNamespaceRemap:c.boolean().default(!0),enableDockerExperimental:c.boolean().default(!1),dockerNetworkingProtocol:c.enum(["ipv4","dualstack"]).default("ipv4"),enableInstanceStorage:c.boolean().default(!1),mountTmpfsAtTmp:c.boolean().default(!0),buildkiteAgentEnableGitMirrors:c.boolean().default(!1),bootstrapScriptUrl:c.string().default(""),agentEnvFileUrl:c.string().default(""),scalerEventSchedulePeriod:c.string().min(1).default("1 minute"),scalerMinPollInterval:c.string().min(1).default("10s"),scaleOutFactor:c.string().min(1).default("1.0"),scaleOutWaitingForJobs:c.boolean().default(!1),rolePermissionsBoundaryArn:c.string().min(1).optional(),alarmSnsTopicArn:c.string().min(1).optional(),applicationId:c.string().min(1).optional(),costAllocationEnvironment:c.string().min(1).optional(),costAllocationOwner:c.string().min(1).optional()}).strict(),HY=ng.refine(e=>e.agentMinInstances<=e.agentMaxInstances,{message:"agentMinInstances must be <= agentMaxInstances"});function ZY(e){let t=HY.safeParse(e);if(!t.success){let r=t.error.issues.map(i=>`  - ${i.path.join(".")||"(root)"}: ${i.message}`).join(`
 `);throw new Error(`Buildkite: invalid props:
 ${r}`)}return t.data}KY(ZY,"validateBuildkiteProps");var XY=Object.defineProperty,NT=(e,t)=>XY(e,"name",{value:t,configurable:!0});function Rj(e){return`FjallDeployBoundary${e}`}NT(Rj,"deployBoundaryName");function wj(e,t,r){return`arn:${e}:iam::${t}:policy/${Rj(r)}`}NT(wj,"deployBoundaryPolicyArn");var JY="/fjall/";function Pj(e){return`FjallDeploy${e}`}NT(Pj,"deployRoleName");var kj=wj("*","*","*"),YY=[`arn:*:iam::*:role${JY}${Pj("*")}`,"arn:*:iam::*:role/cdk-*-cfn-exec-role-*"],DT={Sid:"FjallInheritAdministratorAccess",Effect:"Allow",Action:"*",Resource:"*"},Oj=[{Sid:"FjallDenyOrgAndAccountEscape",Effect:"Deny",Action:["organizations:LeaveOrganization","account:CloseAccount"],Resource:"*"},{Sid:"FjallDenyDisableAuditLogging",Effect:"Deny",Action:["cloudtrail:StopLogging"],Resource:"*"},{Sid:"FjallDenyBoundarySelfEscape",Effect:"Deny",Action:["iam:DeleteRolePermissionsBoundary"],Resource:"*"},{Sid:"FjallDenyBoundaryReplace",Effect:"Deny",Action:["iam:PutRolePermissionsBoundary"],Resource:YY,Condition:{ArnNotLike:{"iam:PermissionsBoundary":kj}}},{Sid:"FjallDenyBoundaryPolicyTamper",Effect:"Deny",Action:["iam:CreatePolicy","iam:CreatePolicyVersion","iam:DeletePolicyVersion","iam:SetDefaultPolicyVersion","iam:DeletePolicy"],Resource:kj},{Sid:"FjallDenyDisableKmsKey",Effect:"Deny",Action:["kms:DisableKey"],Resource:"*"}],$j=[...Oj,{Sid:"FjallDenyStandingHumanCredentials",Effect:"Deny",Action:["iam:CreateUser","iam:CreateLoginProfile","iam:CreateAccessKey","iam:CreateAccountAlias"],Resource:"*"},{Sid:"FjallDenyDisableConfigRecorder",Effect:"Deny",Action:["config:StopConfigurationRecorder"],Resource:"*"}],qY=[...$j,{Sid:"FjallDenyAccountPasswordPolicyTamper",Effect:"Deny",Action:["iam:UpdateAccountPasswordPolicy","iam:DeleteAccountPasswordPolicy"],Resource:"*"},{Sid:"FjallDenyDisableDefaultEbsEncryption",Effect:"Deny",Action:["ec2:DisableEbsEncryptionByDefault"],Resource:"*"}];var Mbe={foundation:[DT,...Oj],compliance:[DT,...$j],hardened:[DT,...qY]};var QY=Object.defineProperty,ht=(e,t)=>QY(e,"name",{value:t,configurable:!0});var wT="sts.amazonaws.com";function eq(e){return`FjallDevDeploy${e}`}ht(eq,"devDeployRoleName");function tq(e){return`FjallDevProvisioner${e}`}ht(tq,"devProvisionerRoleName");function rq(e){return`FjallDevSyncWriter${e}`}ht(rq,"devSyncWriterRoleName");var nq="FjallDevBoundary";function Mj(e){return`arn:aws:iam::${e}:policy/${nq}`}ht(Mj,"devBoundaryPolicyArn");function Lj(e){return`org:${e}:dev-provisioner`}ht(Lj,"devProvisionerSubject");function jj(e){return`org:${e}:dev-sync`}ht(jj,"devSyncSubject");function kT(e,t){return`org:${e}:acct:${t}`}ht(kT,"deployAccountSubject");function RT(e){return`org:${e}:*`}ht(RT,"genericMachineSubject");var iq=["discovery","connection","org-setup","dev-substrate-setup"];function Fj(e,t){return`org:${e}:${t}`}ht(Fj,"serviceSubject");function aq(e){let{fjallOrgId:t,providerArn:r,issuerDomain:i,accountTier:n,accountId:a}=e,o=e.machineTrustMode??"expanded",s={[`${i}:aud`]:wT},u;if(o==="account-scoped"){if(n===void 0||!Rf(n)||a===void 0)throw new Error(`machineTrustMode "account-scoped" requires a governance accountTier and an accountId (got tier: ${String(n)}, accountId ${a===void 0?"absent":"present"}) \u2014 refusing to fall back to the generic machine subject: a silent fallback would re-widen the trust the \xA74.4a Step-3 contract removes`);u=[kT(t,a)]}else a!==void 0?u=[RT(t),kT(t,a)]:u=RT(t);return[{Sid:"FjallMachineSubject",Effect:"Allow",Principal:{Federated:r},Action:"sts:AssumeRoleWithWebIdentity",Condition:{StringEquals:{...s,[`${i}:sub`]:u}}},{Sid:"FjallUserSubjects",Effect:"Allow",Principal:{Federated:r},Action:"sts:AssumeRoleWithWebIdentity",Condition:{StringEquals:s,StringLike:{[`${i}:sub`]:`org:${t}:user:*`}}},{Sid:"FjallServiceSubjects",Effect:"Allow",Principal:{Federated:r},Action:"sts:AssumeRoleWithWebIdentity",Condition:{StringEquals:{...s,[`${i}:sub`]:iq.map(p=>Fj(t,p))}}}]}ht(aq,"buildNarrowedDeployTrustStatements");function oq(e){let{fjallOrgId:t,providerArn:r,issuerDomain:i,accountId:n}=e;return[{Sid:"FjallDevSubjectsThisAccount",Effect:"Allow",Principal:{Federated:r},Action:"sts:AssumeRoleWithWebIdentity",Condition:{StringEquals:{[`${i}:aud`]:wT},StringLike:{[`${i}:sub`]:`org:${t}:dev:${n}:*`}}}]}ht(oq,"buildDevDeployTrustStatements");function PT(e){let{providerArn:t,issuerDomain:r,sid:i,subject:n}=e;return[{Sid:i,Effect:"Allow",Principal:{Federated:t},Action:"sts:AssumeRoleWithWebIdentity",Condition:{StringEquals:{[`${r}:aud`]:wT,[`${r}:sub`]:n}}}]}ht(PT,"buildServiceSubjectTrustStatements");function sq(e){return PT({...e,sid:"FjallDevProvisionerSubject",subject:Lj(e.fjallOrgId)})}ht(sq,"buildDevProvisionerTrustStatements");function cq(e){return PT({...e,sid:"FjallDevSyncSubject",subject:jj(e.fjallOrgId)})}ht(cq,"buildDevSyncWriterTrustStatements");function uq({accountId:e}){return[{Sid:"FjallDevEcsTaggedMutations",Effect:"Allow",Action:["ecs:UpdateService","ecs:DeleteService","ecs:RunTask","ecs:StopTask"],Resource:`arn:aws:ecs:*:${e}:*`,Condition:{StringEquals:{"aws:ResourceTag/fjall:dev":"true"}}},{Sid:"FjallDevEcsTaggedCreates",Effect:"Allow",Action:["ecs:RegisterTaskDefinition","ecs:CreateService"],Resource:"*",Condition:{StringEquals:{"aws:RequestTag/fjall:dev":"true"}}},{Sid:"FjallDevEcsTagOnCreate",Effect:"Allow",Action:["ecs:TagResource"],Resource:`arn:aws:ecs:*:${e}:*`,Condition:{StringEquals:{"ecs:CreateAction":["RegisterTaskDefinition","CreateService","RunTask"]}}},{Sid:"FjallDevEcsReads",Effect:"Allow",Action:["ecs:Describe*","ecs:List*"],Resource:"*"},{Sid:"FjallDevEcsDeregisterTaskDefinition",Effect:"Allow",Action:["ecs:DeregisterTaskDefinition"],Resource:`arn:aws:ecs:*:${e}:task-definition/fjall-dev-*`},{Sid:"FjallDevElbTaggedMutations",Effect:"Allow",Action:["elasticloadbalancing:ModifyRule","elasticloadbalancing:DeleteRule","elasticloadbalancing:ModifyTargetGroup","elasticloadbalancing:ModifyTargetGroupAttributes","elasticloadbalancing:DeleteTargetGroup","elasticloadbalancing:RegisterTargets","elasticloadbalancing:DeregisterTargets"],Resource:`arn:aws:elasticloadbalancing:*:${e}:*`,Condition:{StringEquals:{"aws:ResourceTag/fjall:dev":"true"}}},{Sid:"FjallDevElbTaggedCreates",Effect:"Allow",Action:["elasticloadbalancing:CreateTargetGroup","elasticloadbalancing:CreateRule"],Resource:`arn:aws:elasticloadbalancing:*:${e}:*`,Condition:{StringEquals:{"aws:RequestTag/fjall:dev":"true"}}},{Sid:"FjallDevElbTagOnCreate",Effect:"Allow",Action:["elasticloadbalancing:AddTags"],Resource:`arn:aws:elasticloadbalancing:*:${e}:*`,Condition:{StringEquals:{"elasticloadbalancing:CreateAction":["CreateTargetGroup","CreateRule"]}}},{Sid:"FjallDevElbReads",Effect:"Allow",Action:["elasticloadbalancing:Describe*"],Resource:"*"},{Sid:"FjallDevSsmDevTree",Effect:"Allow",Action:["ssm:GetParameter*","ssm:PutParameter","ssm:AddTagsToResource"],Resource:`arn:aws:ssm:*:${e}:parameter/fjall/dev/*`},{Sid:"FjallDevLogsMutations",Effect:"Allow",Action:["logs:PutRetentionPolicy","logs:DeleteLogGroup"],Resource:`arn:aws:logs:*:${e}:log-group:/fjall/dev/*`},{Sid:"FjallDevLogsTaggedCreate",Effect:"Allow",Action:["logs:CreateLogGroup","logs:TagResource"],Resource:`arn:aws:logs:*:${e}:log-group:/fjall/dev/*`,Condition:{StringEquals:{"aws:RequestTag/fjall:dev":"true"}}},{Sid:"FjallDevLogsRead",Effect:"Allow",Action:["logs:GetLogEvents","logs:DescribeLogStreams","logs:FilterLogEvents"],Resource:`arn:aws:logs:*:${e}:log-group:/fjall/dev/*`},{Sid:"FjallDevLogsDescribeGroups",Effect:"Allow",Action:["logs:DescribeLogGroups"],Resource:"*"},{Sid:"FjallDevKmsViaDevAlias",Effect:"Allow",Action:["kms:Encrypt","kms:Decrypt","kms:GenerateDataKey"],Resource:`arn:aws:kms:*:${e}:key/*`,Condition:{"ForAnyValue:StringLike":{"kms:ResourceAliases":"alias/fjall-dev-*"}}},{Sid:"FjallDevKmsSsmSecureString",Effect:"Allow",Action:["kms:Encrypt","kms:Decrypt","kms:GenerateDataKey"],Resource:`arn:aws:kms:*:${e}:key/*`,Condition:{StringLike:{"kms:ViaService":"ssm.*.amazonaws.com"}}},{Sid:"FjallDevEcrAuthToken",Effect:"Allow",Action:["ecr:GetAuthorizationToken"],Resource:"*"},{Sid:"FjallDevEcrPushPull",Effect:"Allow",Action:["ecr:PutImage","ecr:InitiateLayerUpload","ecr:UploadLayerPart","ecr:CompleteLayerUpload","ecr:BatchCheckLayerAvailability","ecr:BatchGetImage","ecr:GetDownloadUrlForLayer","ecr:DescribeImages"],Resource:`arn:aws:ecr:*:${e}:repository/*`},{Sid:"FjallDevPassDevPathRoles",Effect:"Allow",Action:["iam:PassRole"],Resource:`arn:aws:iam::${e}:role/fjall/dev/*`}]}ht(uq,"buildDevDeployPolicyStatements");function lq({accountId:e}){return[{Sid:"FjallDevProvisionerBoundedRoleWrites",Effect:"Allow",Action:["iam:CreateRole","iam:PutRolePolicy","iam:AttachRolePolicy"],Resource:`arn:aws:iam::${e}:role/fjall/dev/*`,Condition:{StringEquals:{"iam:PermissionsBoundary":Mj(e)}}},{Sid:"FjallDevProvisionerPathRoleOps",Effect:"Allow",Action:["iam:DeleteRole","iam:DeleteRolePolicy","iam:DetachRolePolicy","iam:ListRolePolicies","iam:TagRole"],Resource:`arn:aws:iam::${e}:role/fjall/dev/*`},{Sid:"FjallDevProvisionerListRoles",Effect:"Allow",Action:["iam:ListRoles"],Resource:"*"},{Sid:"FjallDevProvisionerDevMasterSecrets",Effect:"Allow",Action:["secretsmanager:GetSecretValue"],Resource:`arn:aws:secretsmanager:*:${e}:secret:fjall-dev-*`},{Sid:"FjallDevProvisionerKmsDecryptViaSecretsManager",Effect:"Allow",Action:["kms:Decrypt"],Resource:`arn:aws:kms:*:${e}:key/*`,Condition:{StringLike:{"kms:ViaService":"secretsmanager.*.amazonaws.com"}}},{Sid:"FjallDevProvisionerDataApi",Effect:"Allow",Action:["rds-data:ExecuteStatement","rds-data:BatchExecuteStatement","rds-data:BeginTransaction","rds-data:CommitTransaction","rds-data:RollbackTransaction"],Resource:`arn:aws:rds:*:${e}:cluster:fjall-dev-*`},{Sid:"FjallDevProvisionerMetrics",Effect:"Allow",Action:["cloudwatch:GetMetricData"],Resource:"*"},{Sid:"FjallDevProvisionerOrphanDiscovery",Effect:"Allow",Action:["tag:GetResources"],Resource:"*"},{Sid:"FjallDevProvisionerSsmTeardown",Effect:"Allow",Action:["ssm:DeleteParameter*"],Resource:`arn:aws:ssm:*:${e}:parameter/fjall/dev/*`},{Sid:"FjallDevProvisionerLogsTeardown",Effect:"Allow",Action:["logs:DeleteLogGroup"],Resource:`arn:aws:logs:*:${e}:log-group:/fjall/dev/*`},{Sid:"FjallDevProvisionerTaggedTeardown",Effect:"Allow",Action:["ecs:UpdateService","ecs:StopTask","ecs:DeleteService","elasticloadbalancing:DeleteRule","elasticloadbalancing:DeleteTargetGroup","elasticloadbalancing:DeregisterTargets"],Resource:[`arn:aws:ecs:*:${e}:*`,`arn:aws:elasticloadbalancing:*:${e}:*`],Condition:{StringEquals:{"aws:ResourceTag/fjall:dev":"true"}}},{Sid:"FjallDevProvisionerTeardownReads",Effect:"Allow",Action:["ecs:Describe*","elasticloadbalancing:Describe*"],Resource:"*"},{Sid:"FjallDevProvisionerImageJanitor",Effect:"Allow",Action:["ecr:ListImages","ecr:DescribeImages","ecr:BatchDeleteImage"],Resource:`arn:aws:ecr:*:${e}:repository/*`},{Sid:"FjallDevProvisionerSsmReadAll",Effect:"Allow",Action:["ssm:GetParameter*"],Resource:`arn:aws:ssm:*:${e}:parameter/*`},{Sid:"FjallDevProvisionerKmsDecryptViaSsm",Effect:"Allow",Action:["kms:Decrypt"],Resource:`arn:aws:kms:*:${e}:key/*`,Condition:{StringLike:{"kms:ViaService":"ssm.*.amazonaws.com"}}}]}ht(lq,"buildDevProvisionerPolicyStatements");function dq({accountId:e}){return[{Sid:"FjallDevSyncPrefixReadWrite",Effect:"Allow",Action:["s3:GetObject","s3:PutObject"],Resource:`arn:aws:s3:::fjall-dev-sync-${e}-*/*`,Condition:{StringEquals:{"aws:ResourceAccount":e}}}]}ht(dq,"buildDevSyncWriterPolicyStatements");function pq({accountId:e}){return[{Sid:"FjallDevBoundarySsmDevRead",Effect:"Allow",Action:["ssm:GetParameter*"],Resource:`arn:aws:ssm:*:${e}:parameter/fjall/dev/*`},{Sid:"FjallDevBoundaryKmsDecryptDevAlias",Effect:"Allow",Action:["kms:Decrypt"],Resource:`arn:aws:kms:*:${e}:key/*`,Condition:{"ForAnyValue:StringLike":{"kms:ResourceAliases":"alias/fjall-dev-*"}}},{Sid:"FjallDevBoundarySyncPrefixReadWrite",Effect:"Allow",Action:["s3:GetObject","s3:PutObject"],Resource:`arn:aws:s3:::fjall-dev-sync-${e}-*/*`,Condition:{StringEquals:{"aws:ResourceAccount":e}}},{Sid:"FjallDevBoundarySlotLogs",Effect:"Allow",Action:["logs:CreateLogStream","logs:PutLogEvents"],Resource:`arn:aws:logs:*:${e}:log-group:/fjall/dev/*`},{Sid:"FjallDevBoundarySyncQueue",Effect:"Allow",Action:["sqs:ReceiveMessage","sqs:DeleteMessage","sqs:GetQueueUrl"],Resource:`arn:aws:sqs:*:${e}:fjall-dev-sync-${e}-*`}]}ht(pq,"buildDevBoundaryStatements");var mq=Object.defineProperty,qt=(e,t)=>mq(e,"name",{value:t,configurable:!0});function q(e){return JSON.stringify(e)}qt(q,"escapeStringLiteral");function Ul(e){return e.map(q).join(", ")}qt(Ul,"formatStringArray");var fq="import:SharedAlarmTopicArn";function Wa(e="    "){return`