rds-database-auto-start-preventer 0.2.6 → 0.3.1

package/assets/funcs/auto-start-prevent.lambda/index.js

@@ -20566,7 +20566,7 @@ var require_lib = __commonJS({
   "node_modules/fetch-retrier/lib/index.js"(exports2) {
     "use strict";
     Object.defineProperty(exports2, "__esModule", { value: true });
-    exports2.fetchRetrier = exports2.FetchRetrierUnreachableError = exports2.FetchRetrierNetworkError = exports2.FetchRetrierHttpError = exports2.FetchRetrierAlreadyAbortedError = exports2.FetchRetrierAbortError = void 0;
+    exports2.parseRetryAfterMs = exports2.fetchRetrier = exports2.defaultShouldRetry = exports2.DEFAULT_RETRYABLE_HTTP_STATUSES = exports2.FetchRetrierUnreachableError = exports2.FetchRetrierInvalidOptionsError = exports2.FetchRetrierNetworkError = exports2.FetchRetrierHttpError = exports2.FetchRetrierAlreadyAbortedError = exports2.FetchRetrierAbortError = void 0;
     var FetchRetrierAbortError = class _FetchRetrierAbortError extends Error {
       /**
        * @param message - Human-readable reason (default: `'Aborted'`)
@@ -20593,10 +20593,12 @@ var require_lib = __commonJS({
       /**
        * @param message - Error description
        * @param status - HTTP status code from the last non-OK response
+       * @param body - Response body text already read via `response.text()` for that attempt
        */
-      constructor(message, status) {
+      constructor(message, status, body) {
         super(message);
         this.status = status;
+        this.body = body;
         this.name = "FetchRetrierHttpError";
         Object.setPrototypeOf(this, _FetchRetrierHttpError.prototype);
       }
@@ -20615,6 +20617,17 @@ var require_lib = __commonJS({
       }
     };
     exports2.FetchRetrierNetworkError = FetchRetrierNetworkError;
+    var FetchRetrierInvalidOptionsError = class _FetchRetrierInvalidOptionsError extends TypeError {
+      /**
+       * @param message - Human-readable reason describing the invalid option
+       */
+      constructor(message) {
+        super(message);
+        this.name = "FetchRetrierInvalidOptionsError";
+        Object.setPrototypeOf(this, _FetchRetrierInvalidOptionsError.prototype);
+      }
+    };
+    exports2.FetchRetrierInvalidOptionsError = FetchRetrierInvalidOptionsError;
     var FetchRetrierUnreachableError = class _FetchRetrierUnreachableError extends Error {
       /**
        * @param message - Human-readable reason (default: `'Unreachable'`)
@@ -20626,11 +20639,26 @@ var require_lib = __commonJS({
       }
     };
     exports2.FetchRetrierUnreachableError = FetchRetrierUnreachableError;
-    var defaultShouldRetry = (res) => {
-      return [429, 500, 502, 503, 504].includes(res.status);
+    exports2.DEFAULT_RETRYABLE_HTTP_STATUSES = [408, 425, 429, 500, 502, 503, 504];
+    var defaultShouldRetry = (response, _body) => {
+      return exports2.DEFAULT_RETRYABLE_HTTP_STATUSES.includes(response.status);
+    };
+    exports2.defaultShouldRetry = defaultShouldRetry;
+    var validateRequestOptions = (options) => {
+      const { retries, timeoutMs, baseBackoffMs } = options;
+      if (retries < 1) {
+        throw new FetchRetrierInvalidOptionsError("retries must be >= 1");
+      }
+      if (timeoutMs <= 0) {
+        throw new FetchRetrierInvalidOptionsError("timeoutMs must be > 0");
+      }
+      if (baseBackoffMs < 0) {
+        throw new FetchRetrierInvalidOptionsError("baseBackoffMs must be >= 0");
+      }
     };
     var fetchRetrier = async (url, options) => {
-      const { headers, init, retries, timeoutMs, baseBackoffMs, signal: externalSignal, shouldRetry = defaultShouldRetry } = options;
+      const { headers, init, retries, timeoutMs, baseBackoffMs, signal: externalSignal, shouldRetry = exports2.defaultShouldRetry } = options;
+      validateRequestOptions({ retries, timeoutMs, baseBackoffMs });
       for (let attempt = 1; attempt <= retries; attempt++) {
         if (externalSignal?.aborted) {
           throw new FetchRetrierAlreadyAbortedError();
@@ -20659,11 +20687,11 @@ var require_lib = __commonJS({
           const isContinue = shouldRetry(res, text);
           if (isContinue) {
             if (attempt === retries) {
-              throw new FetchRetrierHttpError(`HTTP ${res.status}`, res.status);
+              throw new FetchRetrierHttpError(`HTTP ${res.status}`, res.status, text);
             }
-            await wait(fullJitter(baseBackoffMs, attempt));
+            await wait(resolveRetryDelayMs(res, baseBackoffMs, attempt));
           } else {
-            throw new FetchRetrierHttpError(`Non-retriable HTTP error: ${res.status}`, res.status);
+            throw new FetchRetrierHttpError(`Non-retriable HTTP error: ${res.status}`, res.status, text);
           }
         } catch (err) {
           clearTimeout(timer);
@@ -20693,32 +20721,251 @@ var require_lib = __commonJS({
       const cap = base * Math.pow(2, attempt);
       return Math.floor(Math.random() * cap);
     };
+    var parseRetryAfterMs = (value, nowMs = Date.now()) => {
+      const trimmed = value.trim();
+      if (trimmed === "") {
+        return void 0;
+      }
+      if (/^\d+$/.test(trimmed)) {
+        return Number.parseInt(trimmed, 10) * 1e3;
+      }
+      if (/^-?\d+(\.\d+)?$/.test(trimmed)) {
+        return void 0;
+      }
+      const dateMs = Date.parse(trimmed);
+      if (Number.isNaN(dateMs)) {
+        return void 0;
+      }
+      return Math.max(0, dateMs - nowMs);
+    };
+    exports2.parseRetryAfterMs = parseRetryAfterMs;
+    var resolveRetryDelayMs = (response, baseBackoffMs, attempt, nowMs = Date.now()) => {
+      const header = response.headers?.get("Retry-After");
+      if (header == null) {
+        return fullJitter(baseBackoffMs, attempt);
+      }
+      const fromHeader = (0, exports2.parseRetryAfterMs)(header, nowMs);
+      if (fromHeader === void 0) {
+        return fullJitter(baseBackoffMs, attempt);
+      }
+      return fromHeader;
+    };
   }
 });
 
-// node_modules/aws-lambda-secret-fetcher/lib/index.js
+// node_modules/quiet-json-parser/lib/index.js
 var require_lib2 = __commonJS({
+  "node_modules/quiet-json-parser/lib/index.js"(exports2) {
+    "use strict";
+    Object.defineProperty(exports2, "__esModule", { value: true });
+    exports2.quietParse = void 0;
+    var safeReviver = (key, value) => {
+      if (key === "__proto__" || key === "constructor" || key === "prototype") {
+        return void 0;
+      }
+      return value;
+    };
+    var quietParse = (jsonString, fallback, onError) => {
+      if (!jsonString) {
+        return fallback;
+      }
+      try {
+        return JSON.parse(jsonString, safeReviver);
+      } catch (error) {
+        onError?.(error);
+        return fallback;
+      }
+    };
+    exports2.quietParse = quietParse;
+  }
+});
+
+// node_modules/aws-lambda-secret-fetcher/node_modules/strict-env-resolver/lib/index.js
+var require_lib3 = __commonJS({
+  "node_modules/aws-lambda-secret-fetcher/node_modules/strict-env-resolver/lib/index.js"(exports2) {
+    "use strict";
+    Object.defineProperty(exports2, "__esModule", { value: true });
+    exports2.StrictEnvResolver = exports2.StrictEnvType = exports2.StrictEnvValidationError = exports2.StrictEnvError = void 0;
+    var TRUE_BOOLEAN_PATTERN = /^(1|true|yes|on)$/i;
+    var parseNumber = (raw) => {
+      const n = Number(raw);
+      if (!Number.isFinite(n)) {
+        return void 0;
+      }
+      return n;
+    };
+    var parseBooleanEnvValue = (normalizedRaw) => TRUE_BOOLEAN_PATTERN.test(normalizedRaw);
+    var StrictEnvError = class extends Error {
+      /**
+       * @param message - Error message.
+       */
+      constructor(message) {
+        super(message);
+        this.name = "StrictEnvError";
+      }
+    };
+    exports2.StrictEnvError = StrictEnvError;
+    var StrictEnvValidationError = class _StrictEnvValidationError extends StrictEnvError {
+      /**
+       * Formats validation errors into a human-readable error message.
+       *
+       * @template K - Environment variable key type.
+       * @param errors - Validation error entries to format.
+       * @returns Multi-line summary listing each key and message.
+       */
+      static format(errors) {
+        const lines = errors.map((e) => `- ${e.key}: ${e.message}${e.raw == null ? "" : ` (raw="${e.raw}")`}`);
+        return `Invalid environment variables (${errors.length}):
+${lines.join("\n")}`;
+      }
+      /**
+       * Creates a new validation error from one or more `StrictEnvValidationEntry` entries.
+       *
+       * @param errors - One or more structured validation errors.
+       */
+      constructor(errors) {
+        const msg = _StrictEnvValidationError.format(errors);
+        super(msg);
+        this.name = "StrictEnvValidationError";
+        this.errors = errors;
+        this.keys = errors.map((e) => e.key);
+      }
+    };
+    exports2.StrictEnvValidationError = StrictEnvValidationError;
+    exports2.StrictEnvType = {
+      /** Spec for a string value (returned as-is unless `trim: true` is set in options). */
+      String: { type: "string" },
+      /**
+       * Spec for a finite numeric value (`Number()` parsing; rejects `NaN` and `Infinity`).
+       */
+      Number: { type: "number" },
+      /** Spec for a boolean value (`1`/`true`/`yes`/`on` → `true`; other non-empty values → `false`). */
+      Boolean: { type: "boolean" },
+      /**
+       * Returns a spec that restricts the value to one of the given choices.
+       *
+       * @param choices - Allowed string literals.
+       * @returns Enum spec for use with `resolve` or `resolveAll`.
+       */
+      Enum: (choices) => ({ type: "enum", choices })
+    };
+    var defaultTrimForSpec = (spec) => spec.type !== "string";
+    var normalizeEnvRaw = (raw, trim) => {
+      if (raw == null) {
+        return void 0;
+      }
+      if (!trim) {
+        return raw;
+      }
+      return raw.trim();
+    };
+    var resolveSchemaEntry = (entry) => ({
+      spec: Array.isArray(entry) ? entry[0] : entry,
+      options: Array.isArray(entry) ? entry[1] : void 0
+    });
+    var parseEnvValue = (key, spec, raw, defaultValue, options) => {
+      const trim = options?.trim ?? defaultTrimForSpec(spec);
+      const normalizedRaw = normalizeEnvRaw(raw, trim);
+      const hasDefault = defaultValue !== void 0;
+      if (normalizedRaw == null || normalizedRaw === "") {
+        if (hasDefault) {
+          return { ok: true, value: defaultValue };
+        }
+        return {
+          ok: false,
+          error: { key, message: `Missing required environment variable: ${key}`, raw, kind: "missing" }
+        };
+      }
+      switch (spec.type) {
+        case "number": {
+          const n = parseNumber(normalizedRaw);
+          if (n === void 0) {
+            return {
+              ok: false,
+              error: { key, message: `Env ${key}: expected number, got "${raw}"`, raw, kind: "invalid_number" }
+            };
+          }
+          return { ok: true, value: n };
+        }
+        case "boolean":
+          return { ok: true, value: parseBooleanEnvValue(normalizedRaw) };
+        case "enum":
+          if (!spec.choices.includes(normalizedRaw)) {
+            return {
+              ok: false,
+              error: {
+                key,
+                message: `Env ${key}: must be one of [${spec.choices.join(", ")}]`,
+                raw,
+                kind: "invalid_enum"
+              }
+            };
+          }
+          return { ok: true, value: normalizedRaw };
+        default:
+          return { ok: true, value: normalizedRaw };
+      }
+    };
+    var resolve = (key, spec = exports2.StrictEnvType.String, options) => {
+      const result = parseEnvValue(key, spec, process.env[key], options?.default, options);
+      if (!result.ok) {
+        throw new StrictEnvValidationError([result.error]);
+      }
+      return result.value;
+    };
+    var resolveAll = (schema) => {
+      const envs = {};
+      const errors = [];
+      for (const key of Object.keys(schema)) {
+        const { spec, options } = resolveSchemaEntry(schema[key]);
+        const result = parseEnvValue(key, spec, process.env[key], options?.default, options);
+        if (!result.ok) {
+          errors.push(result.error);
+          continue;
+        }
+        envs[key] = result.value;
+      }
+      if (errors.length > 0)
+        throw new StrictEnvValidationError(errors);
+      return envs;
+    };
+    exports2.StrictEnvResolver = {
+      /** Reads and parses a single environment variable. See {@link resolve}. */
+      resolve,
+      /** Reads and parses multiple environment variables in one pass. See {@link resolveAll}. */
+      resolveAll
+    };
+  }
+});
+
+// node_modules/aws-lambda-secret-fetcher/lib/index.js
+var require_lib4 = __commonJS({
   "node_modules/aws-lambda-secret-fetcher/lib/index.js"(exports2) {
     "use strict";
     Object.defineProperty(exports2, "__esModule", { value: true });
     exports2.secretFetcher = void 0;
     var fetch_retrier_1 = require_lib();
+    var quiet_json_parser_1 = require_lib2();
+    var strict_env_resolver_1 = require_lib3();
     var getSecretValue = async (name, options = {}) => {
       const { extensionHttpPort, timeoutMs = 2e3, retries = 3, baseBackoffMs = 300 } = options;
       const port = resolveExtensionHttpPort(extensionHttpPort);
+      const sessionToken = resolveAwsSessionToken();
       const url = `http://localhost:${port}/secretsmanager/get?secretId=${encodeURIComponent(name)}`;
       const requestOptions = {
         headers: {
-          "X-Aws-Parameters-Secrets-Token": process.env.AWS_SESSION_TOKEN ?? ""
+          "X-Aws-Parameters-Secrets-Token": sessionToken
         },
         retries,
         timeoutMs,
         baseBackoffMs,
         shouldRetry: (res, body) => {
-          if ([429, 500, 502, 503, 504].includes(res.status))
+          if ((0, fetch_retrier_1.defaultShouldRetry)(res, body)) {
             return true;
-          if (res.status === 400 && /not\s+ready.*traffic/i.test(body))
+          }
+          if (res.status === 400 && /not\s+ready.*traffic/i.test(body)) {
             return true;
+          }
           return false;
         }
       };
@@ -20728,21 +20975,34 @@ var require_lib2 = __commonJS({
         throw new Error("Invalid secret response format");
       }
       const data = raw;
-      const secretString = data.SecretString;
-      if (looksLikeJson(secretString)) {
-        return JSON.parse(secretString);
+      return (0, quiet_json_parser_1.quietParse)(data.SecretString, data.SecretString);
+    };
+    var AWS_SESSION_TOKEN_GUIDANCE = "AWS_SESSION_TOKEN is not set. This library only works inside an AWS Lambda execution environment where the runtime provides AWS_SESSION_TOKEN for the Parameters and Secrets Extension. Attach the extension layer and run your code as a Lambda function handler.";
+    var MIN_TCP_PORT = 1;
+    var MAX_TCP_PORT = 65535;
+    var resolveAwsSessionToken = () => {
+      try {
+        return strict_env_resolver_1.StrictEnvResolver.resolve("AWS_SESSION_TOKEN", strict_env_resolver_1.StrictEnvType.String, { trim: true });
+      } catch (e) {
+        if (e instanceof strict_env_resolver_1.StrictEnvValidationError && e.errors.length === 1 && e.errors[0]?.key === "AWS_SESSION_TOKEN" && e.errors[0]?.kind === "missing") {
+          throw new Error(AWS_SESSION_TOKEN_GUIDANCE);
+        }
+        throw e;
       }
-      return secretString;
     };
     var resolveExtensionHttpPort = (overridePort) => {
-      const fromOverride = overridePort === void 0 ? void 0 : String(overridePort);
-      const fromEnv = process.env.PARAMETERS_SECRETS_EXTENSION_HTTP_PORT;
-      const candidate = (fromOverride ?? fromEnv ?? "2773").trim();
+      const port = overridePort === void 0 ? strict_env_resolver_1.StrictEnvResolver.resolve("PARAMETERS_SECRETS_EXTENSION_HTTP_PORT", strict_env_resolver_1.StrictEnvType.Number, { default: 2773 }) : parseExtensionHttpPortOverride(overridePort);
+      return assertValidTcpPort(port);
+    };
+    var parseExtensionHttpPortOverride = (overridePort) => {
+      const candidate = String(overridePort).trim();
       if (!/^\d+$/.test(candidate)) {
         throw new Error("Invalid extension HTTP port: must be a number");
       }
-      const port = Number.parseInt(candidate, 10);
-      if (port < 1 || port > 65535) {
+      return Number.parseInt(candidate, 10);
+    };
+    var assertValidTcpPort = (port) => {
+      if (port < MIN_TCP_PORT || port > MAX_TCP_PORT) {
         throw new Error("Invalid extension HTTP port: must be between 1 and 65535");
       }
       return String(port);
@@ -20753,19 +21013,217 @@ var require_lib2 = __commonJS({
       const v = value;
       return typeof v.SecretString === "string" && typeof v.Name === "string" && typeof v.ARN === "string" && (v.VersionId === void 0 || typeof v.VersionId === "string");
     };
-    var looksLikeJson = (str) => {
-      return typeof str === "string" && str.trim().startsWith("{");
-    };
     exports2.secretFetcher = {
       getSecretValue
     };
   }
 });
 
+// node_modules/strict-env-resolver/lib/index.js
+var require_lib5 = __commonJS({
+  "node_modules/strict-env-resolver/lib/index.js"(exports2) {
+    "use strict";
+    Object.defineProperty(exports2, "__esModule", { value: true });
+    exports2.StrictEnvResolver = exports2.StrictEnvType = exports2.StrictEnvValidationError = exports2.StrictEnvError = void 0;
+    var TRUE_BOOLEAN_PATTERN = /^(1|true|yes|on)$/i;
+    var parseNumber = (raw) => {
+      const n = Number(raw);
+      if (!Number.isFinite(n)) {
+        return void 0;
+      }
+      return n;
+    };
+    var parseBooleanEnvValue = (normalizedRaw) => TRUE_BOOLEAN_PATTERN.test(normalizedRaw);
+    var StrictEnvError = class extends Error {
+      /**
+       * @param message - Error message.
+       */
+      constructor(message) {
+        super(message);
+        this.name = "StrictEnvError";
+      }
+    };
+    exports2.StrictEnvError = StrictEnvError;
+    var StrictEnvValidationError = class _StrictEnvValidationError extends StrictEnvError {
+      /**
+       * Formats validation errors into a human-readable error message.
+       *
+       * @template K - Environment variable key type.
+       * @param errors - Validation error entries to format.
+       * @returns Multi-line summary listing each key and message.
+       */
+      static format(errors) {
+        const lines = errors.map((e) => `- ${e.key}: ${e.message}${e.raw == null ? "" : ` (raw="${e.raw}")`}`);
+        return `Invalid environment variables (${errors.length}):
+${lines.join("\n")}`;
+      }
+      /**
+       * Creates a new validation error from one or more `StrictEnvValidationEntry` entries.
+       *
+       * @param errors - One or more structured validation errors.
+       */
+      constructor(errors) {
+        const msg = _StrictEnvValidationError.format(errors);
+        super(msg);
+        this.name = "StrictEnvValidationError";
+        this.errors = errors;
+        this.keys = errors.map((e) => e.key);
+      }
+    };
+    exports2.StrictEnvValidationError = StrictEnvValidationError;
+    var createNumberSpec = (constraints) => ({
+      type: "number",
+      ...constraints?.min !== void 0 ? { min: constraints.min } : {},
+      ...constraints?.max !== void 0 ? { max: constraints.max } : {},
+      ...constraints?.integer !== void 0 ? { integer: constraints.integer } : {}
+    });
+    var NumberSpec = Object.assign((constraints) => createNumberSpec(constraints), { type: "number" });
+    exports2.StrictEnvType = {
+      /** Spec for a string value (returned as-is unless `trim: true` is set in options). */
+      String: { type: "string" },
+      /**
+       * Spec for a finite numeric value (`Number()` parsing; rejects `NaN` and `Infinity`).
+       * Use as `StrictEnvType.Number`, or call as `StrictEnvType.Number({ min, max, integer })`.
+       */
+      Number: NumberSpec,
+      /**
+       * Spec for a positive integer (`>= 1`). Sugar for `Number({ min: 1, integer: true })`.
+       */
+      PositiveInt: createNumberSpec({ min: 1, integer: true }),
+      /**
+       * Spec for a negative integer (`<= -1`). Sugar for `Number({ max: -1, integer: true })`.
+       */
+      NegativeInt: createNumberSpec({ max: -1, integer: true }),
+      /** Spec for a boolean value (`1`/`true`/`yes`/`on` → `true`; other non-empty values → `false`). */
+      Boolean: { type: "boolean" },
+      /**
+       * Returns a spec that restricts the value to one of the given choices.
+       *
+       * @param choices - Allowed string literals.
+       * @returns Enum spec for use with `resolve` or `resolveAll`.
+       */
+      Enum: (choices) => ({ type: "enum", choices })
+    };
+    var defaultTrimForSpec = (spec) => spec.type !== "string";
+    var normalizeEnvRaw = (raw, trim) => {
+      if (raw == null) {
+        return void 0;
+      }
+      if (!trim) {
+        return raw;
+      }
+      return raw.trim();
+    };
+    var validateNumberConstraints = (key, raw, n, constraints) => {
+      if (constraints.integer === true && !Number.isInteger(n)) {
+        return { key, message: `Env ${key}: expected integer, got "${raw}"`, raw, kind: "invalid_number" };
+      }
+      if (constraints.min !== void 0 && n < constraints.min) {
+        return {
+          key,
+          message: `Env ${key}: must be >= ${constraints.min}, got ${n}`,
+          raw,
+          kind: "invalid_number"
+        };
+      }
+      if (constraints.max !== void 0 && n > constraints.max) {
+        return {
+          key,
+          message: `Env ${key}: must be <= ${constraints.max}, got ${n}`,
+          raw,
+          kind: "invalid_number"
+        };
+      }
+      return void 0;
+    };
+    var resolveSchemaEntry = (entry) => ({
+      spec: Array.isArray(entry) ? entry[0] : entry,
+      options: Array.isArray(entry) ? entry[1] : void 0
+    });
+    var parseEnvValue = (key, spec, raw, defaultValue, options) => {
+      const trim = options?.trim ?? defaultTrimForSpec(spec);
+      const normalizedRaw = normalizeEnvRaw(raw, trim);
+      const hasDefault = defaultValue !== void 0;
+      if (normalizedRaw == null || normalizedRaw === "") {
+        if (hasDefault) {
+          return { ok: true, value: defaultValue };
+        }
+        return {
+          ok: false,
+          error: { key, message: `Missing required environment variable: ${key}`, raw, kind: "missing" }
+        };
+      }
+      switch (spec.type) {
+        case "number": {
+          const n = parseNumber(normalizedRaw);
+          if (n === void 0) {
+            return {
+              ok: false,
+              error: { key, message: `Env ${key}: expected number, got "${raw}"`, raw, kind: "invalid_number" }
+            };
+          }
+          const constraintError = validateNumberConstraints(key, raw, n, spec);
+          if (constraintError !== void 0) {
+            return { ok: false, error: constraintError };
+          }
+          return { ok: true, value: n };
+        }
+        case "boolean":
+          return { ok: true, value: parseBooleanEnvValue(normalizedRaw) };
+        case "enum":
+          if (!spec.choices.includes(normalizedRaw)) {
+            return {
+              ok: false,
+              error: {
+                key,
+                message: `Env ${key}: must be one of [${spec.choices.join(", ")}]`,
+                raw,
+                kind: "invalid_enum"
+              }
+            };
+          }
+          return { ok: true, value: normalizedRaw };
+        default:
+          return { ok: true, value: normalizedRaw };
+      }
+    };
+    var resolve = (key, spec = exports2.StrictEnvType.String, options) => {
+      const result = parseEnvValue(key, spec, process.env[key], options?.default, options);
+      if (!result.ok) {
+        throw new StrictEnvValidationError([result.error]);
+      }
+      return result.value;
+    };
+    var resolveAll = (schema) => {
+      const envs = {};
+      const errors = [];
+      for (const key of Object.keys(schema)) {
+        const { spec, options } = resolveSchemaEntry(schema[key]);
+        const result = parseEnvValue(key, spec, process.env[key], options?.default, options);
+        if (!result.ok) {
+          errors.push(result.error);
+          continue;
+        }
+        envs[key] = result.value;
+      }
+      if (errors.length > 0)
+        throw new StrictEnvValidationError(errors);
+      return envs;
+    };
+    exports2.StrictEnvResolver = {
+      /** Reads and parses a single environment variable. See {@link resolve}. */
+      resolve,
+      /** Reads and parses multiple environment variables in one pass. See {@link resolveAll}. */
+      resolveAll
+    };
+  }
+});
+
 // src/funcs/auto-start-prevent.lambda.ts
 var auto_start_prevent_lambda_exports = {};
 __export(auto_start_prevent_lambda_exports, {
-  handler: () => handler
+  handler: () => handler,
+  processAutoStartPrevent: () => processAutoStartPrevent
 });
 module.exports = __toCommonJS(auto_start_prevent_lambda_exports);
 
@@ -24286,36 +24744,10 @@ var DEFAULT_CONFIG = {
 // src/funcs/auto-start-prevent.lambda.ts
 var import_client_rds = require("@aws-sdk/client-rds");
 var import_web_api = __toESM(require_dist5());
-var import_aws_lambda_secret_fetcher = __toESM(require_lib2());
-var isRawEvent = (input) => typeof input === "object" && input != null && "detail" in input && "detail-type" in input;
-var paramsFromEnv = () => {
-  const tagKey = process.env.TAG_KEY;
-  const tagValuesJson = process.env.TAG_VALUES;
-  if (!tagKey || !tagValuesJson) {
-    throw new Error("missing environment variables TAG_KEY or TAG_VALUES.");
-  }
-  let tagValues;
-  try {
-    tagValues = JSON.parse(tagValuesJson);
-  } catch {
-    throw new Error("TAG_VALUES must be a JSON array of strings.");
-  }
-  if (!Array.isArray(tagValues)) {
-    throw new Error("TAG_VALUES must be a JSON array of strings.");
-  }
-  return { tagKey, tagValues };
-};
-var normalizeInput = (input) => {
-  if (isRawEvent(input)) {
-    return { event: input, params: paramsFromEnv() };
-  }
-  const candidate = input;
-  if (typeof candidate === "object" && candidate != null && candidate.event != null && candidate.params != null) {
-    return candidate;
-  }
-  throw new Error("Invalid input: expected RDS event or { event, params }.");
-};
-var rdsClient = new import_client_rds.RDSClient({});
+var import_aws_lambda_secret_fetcher = __toESM(require_lib4());
+var import_strict_env_resolver = __toESM(require_lib5());
+
+// src/funcs/auto-start-prevent.predicates.ts
 var TRANSITIONAL_STATUSES = /* @__PURE__ */ new Set([
   "starting",
   "configuring-enhanced-monitoring",
@@ -24323,6 +24755,31 @@ var TRANSITIONAL_STATUSES = /* @__PURE__ */ new Set([
   "modifying",
   "stopping"
 ]);
+var isTransitionalStatus = (status) => TRANSITIONAL_STATUSES.has(status);
+var isSlackSecret = (value) => {
+  if (typeof value !== "object" || value == null) {
+    return false;
+  }
+  if (!("token" in value) || !("channel" in value)) {
+    return false;
+  }
+  return typeof value.token === "string" && value.token.length > 0 && typeof value.channel === "string" && value.channel.length > 0;
+};
+var isAutoStartPreventInput = (input) => {
+  if (typeof input !== "object" || input == null) {
+    return false;
+  }
+  if (!("event" in input) || !("params" in input)) {
+    return false;
+  }
+  return input.event != null && input.params != null;
+};
+var normalizeInput = (input) => {
+  if (isAutoStartPreventInput(input)) {
+    return input;
+  }
+  throw new Error("Invalid input: expected { event, params }.");
+};
 var matchTag = (params, tags) => {
   if (!tags || tags.length === 0) {
     return false;
@@ -24333,29 +24790,175 @@ var matchTag = (params, tags) => {
   }
   return params.tagValues.includes(value);
 };
-var handler = withDurableExecution(
-  async (input, context) => {
-    const { event, params } = normalizeInput(input);
-    const { detail, "detail-type": detailType } = event;
-    const slackSecretName = process.env.SLACK_SECRET_NAME;
-    if (!slackSecretName) {
-      throw new Error("missing environment variable SLACK_SECRET_NAME.");
-    }
-    const slackSecretValue = await context.step("fetch-slack-secret", async () => {
-      return import_aws_lambda_secret_fetcher.secretFetcher.getSecretValue(slackSecretName);
-    });
-    if (!slackSecretValue?.token || !slackSecretValue?.channel) {
-      throw new Error("Slack secret must contain token and channel.");
+var isDbInstanceAutoStart = (detailType, detail) => detailType === "RDS DB Instance Event" && detail.SourceType === "DB_INSTANCE" && detail.EventID === "RDS-EVENT-0154";
+var isDbClusterAutoStart = (detailType, detail) => detailType === "RDS DB Cluster Event" && detail.SourceType === "CLUSTER" && detail.EventID === "RDS-EVENT-0153";
+var waitStrategyUntilStable = (state) => {
+  if (isTransitionalStatus(state.status)) {
+    return { shouldContinue: true, delay: { minutes: 5 } };
+  }
+  return { shouldContinue: false };
+};
+var waitStrategyUntilStopped = (state) => {
+  if (state.status === "stopped") {
+    return { shouldContinue: false };
+  }
+  if (isTransitionalStatus(state.status)) {
+    return { shouldContinue: true, delay: { minutes: 5 } };
+  }
+  throw new Error(`Unexpected status while waiting for stop: ${state.status}`);
+};
+var decideAfterTagMatch = (status) => {
+  if (status === "available") {
+    return { kind: "stop" };
+  }
+  if (status === "stopped") {
+    return {
+      kind: "no-op",
+      result: {
+        action: "no-op",
+        reason: "already stopped",
+        status
+      }
+    };
+  }
+  return {
+    kind: "error",
+    message: `DB status is not stopped after processing: ${status}`
+  };
+};
+var tagMismatchNoOp = (status) => ({
+  action: "no-op",
+  reason: "tag not matched or not found",
+  status
+});
+var parseRdsSourceArn = (sourceArn) => {
+  const parts = sourceArn.split(":");
+  return {
+    region: parts[3] ?? "",
+    account: parts[4] ?? ""
+  };
+};
+var buildSlackStopNotification = (args) => ({
+  channel: args.channel,
+  attachments: [
+    {
+      color: "#36a64f",
+      pretext: `\u{1F634} Successfully stopped the automatically running RDS ${args.sourceType} ${args.sourceIdentifier}.`,
+      fields: [
+        {
+          title: "Account",
+          value: args.account,
+          short: true
+        },
+        {
+          title: "Region",
+          value: args.region,
+          short: true
+        },
+        {
+          title: "Type",
+          value: args.sourceType,
+          short: true
+        },
+        {
+          title: "Identifier",
+          value: args.sourceIdentifier,
+          short: true
+        }
+      ]
     }
-    const isInstance = detailType === "RDS DB Instance Event" && detail.SourceType === "DB_INSTANCE" && detail.EventID === "RDS-EVENT-0154";
-    const isCluster = detailType === "RDS DB Cluster Event" && detail.SourceType === "CLUSTER" && detail.EventID === "RDS-EVENT-0153";
-    if (!isInstance && !isCluster) {
-      throw new Error(
-        `Unsupported event: detail-type=${detailType}, SourceType=${detail.SourceType}, EventID=${detail.EventID}`
+  ]
+});
+var buildStoppedResult = (args) => ({
+  action: "stopped",
+  finalStatus: args.finalStatus,
+  account: args.account,
+  region: args.region,
+  identifier: args.identifier
+});
+
+// src/funcs/auto-start-prevent.lambda.ts
+var rdsClient = new import_client_rds.RDSClient({});
+var processAutoStartPrevent = async (input, context) => {
+  const { event, params } = normalizeInput(input);
+  const { detail, "detail-type": detailType } = event;
+  const slackSecretName = import_strict_env_resolver.StrictEnvResolver.resolve("SLACK_SECRET_NAME", import_strict_env_resolver.StrictEnvType.String, {
+    trim: true
+  });
+  const slackSecretValue = await context.step("fetch-slack-secret", async () => {
+    return import_aws_lambda_secret_fetcher.secretFetcher.getSecretValue(slackSecretName);
+  });
+  if (!isSlackSecret(slackSecretValue)) {
+    throw new Error("Slack secret must be JSON with non-empty token and channel.");
+  }
+  const isInstance = isDbInstanceAutoStart(detailType, detail);
+  const isCluster = isDbClusterAutoStart(detailType, detail);
+  if (!isInstance && !isCluster) {
+    throw new Error(
+      `Unsupported event: detail-type=${detailType}, SourceType=${detail.SourceType}, EventID=${detail.EventID}`
+    );
+  }
+  await context.wait({ minutes: 1 });
+  const firstDescribe = await context.waitForCondition(
+    async (_state, _ctx) => {
+      if (isInstance) {
+        const res2 = await rdsClient.send(
+          new import_client_rds.DescribeDBInstancesCommand({
+            DBInstanceIdentifier: detail.SourceIdentifier
+          })
+        );
+        const db = res2.DBInstances?.[0];
+        return {
+          status: db?.DBInstanceStatus ?? "unknown",
+          identifier: db?.DBInstanceIdentifier ?? detail.SourceIdentifier,
+          tags: db?.TagList ?? []
+        };
+      }
+      const res = await rdsClient.send(
+        new import_client_rds.DescribeDBClustersCommand({
+          DBClusterIdentifier: detail.SourceIdentifier
+        })
       );
+      const cluster = res.DBClusters?.[0];
+      return {
+        status: cluster?.Status ?? "unknown",
+        identifier: cluster?.DBClusterIdentifier ?? detail.SourceIdentifier,
+        tags: cluster?.TagList ?? []
+      };
+    },
+    {
+      initialState: {
+        status: "starting",
+        identifier: detail.SourceIdentifier
+      },
+      waitStrategy: waitStrategyUntilStable
+    }
+  );
+  if (!matchTag(params, firstDescribe.tags)) {
+    return tagMismatchNoOp(firstDescribe.status);
+  }
+  let didStop = false;
+  let finalStatus = firstDescribe.status;
+  const afterTagMatch = decideAfterTagMatch(firstDescribe.status);
+  if (afterTagMatch.kind === "stop") {
+    if (isInstance) {
+      await context.step("stop-db-instance", async () => {
+        await rdsClient.send(
+          new import_client_rds.StopDBInstanceCommand({
+            DBInstanceIdentifier: detail.SourceIdentifier
+          })
+        );
+      });
+    } else {
+      await context.step("stop-db-cluster", async () => {
+        await rdsClient.send(
+          new import_client_rds.StopDBClusterCommand({
+            DBClusterIdentifier: detail.SourceIdentifier
+          })
+        );
+      });
     }
-    await context.wait({ minutes: 1 });
-    const firstDescribe = await context.waitForCondition(
+    const stopped = await context.waitForCondition(
       async (_state, _ctx) => {
         if (isInstance) {
           const res2 = await rdsClient.send(
@@ -24366,8 +24969,7 @@ var handler = withDurableExecution(
           const db = res2.DBInstances?.[0];
           return {
             status: db?.DBInstanceStatus ?? "unknown",
-            identifier: db?.DBInstanceIdentifier ?? detail.SourceIdentifier,
-            tags: db?.TagList ?? []
+            identifier: db?.DBInstanceIdentifier ?? detail.SourceIdentifier
           };
         }
         const res = await rdsClient.send(
@@ -24378,157 +24980,56 @@ var handler = withDurableExecution(
         const cluster = res.DBClusters?.[0];
         return {
           status: cluster?.Status ?? "unknown",
-          identifier: cluster?.DBClusterIdentifier ?? detail.SourceIdentifier,
-          tags: cluster?.TagList ?? []
+          identifier: cluster?.DBClusterIdentifier ?? detail.SourceIdentifier
         };
       },
       {
         initialState: {
-          status: "starting",
-          identifier: detail.SourceIdentifier
+          status: firstDescribe.status,
+          identifier: firstDescribe.identifier
         },
-        waitStrategy: (state) => {
-          if (TRANSITIONAL_STATUSES.has(state.status)) {
-            return { shouldContinue: true, delay: { minutes: 5 } };
-          }
-          return { shouldContinue: false };
-        }
+        waitStrategy: waitStrategyUntilStopped
       }
     );
-    if (!matchTag(params, firstDescribe.tags)) {
-      return {
-        action: "no-op",
-        reason: "tag not matched or not found",
-        status: firstDescribe.status
-      };
-    }
-    let didStop = false;
-    let finalStatus = firstDescribe.status;
-    if (firstDescribe.status === "available") {
-      if (isInstance) {
-        await context.step("stop-db-instance", async () => {
-          await rdsClient.send(
-            new import_client_rds.StopDBInstanceCommand({
-              DBInstanceIdentifier: detail.SourceIdentifier
-            })
-          );
-        });
-      } else {
-        await context.step("stop-db-cluster", async () => {
-          await rdsClient.send(
-            new import_client_rds.StopDBClusterCommand({
-              DBClusterIdentifier: detail.SourceIdentifier
-            })
-          );
-        });
-      }
-      const stopped = await context.waitForCondition(
-        async (_state, _ctx) => {
-          if (isInstance) {
-            const res2 = await rdsClient.send(
-              new import_client_rds.DescribeDBInstancesCommand({
-                DBInstanceIdentifier: detail.SourceIdentifier
-              })
-            );
-            const db = res2.DBInstances?.[0];
-            return {
-              status: db?.DBInstanceStatus ?? "unknown",
-              identifier: db?.DBInstanceIdentifier ?? detail.SourceIdentifier
-            };
-          }
-          const res = await rdsClient.send(
-            new import_client_rds.DescribeDBClustersCommand({
-              DBClusterIdentifier: detail.SourceIdentifier
-            })
-          );
-          const cluster = res.DBClusters?.[0];
-          return {
-            status: cluster?.Status ?? "unknown",
-            identifier: cluster?.DBClusterIdentifier ?? detail.SourceIdentifier
-          };
-        },
-        {
-          initialState: {
-            status: firstDescribe.status,
-            identifier: firstDescribe.identifier
-          },
-          waitStrategy: (state) => {
-            if (state.status === "stopped") {
-              return { shouldContinue: false };
-            }
-            if (TRANSITIONAL_STATUSES.has(state.status)) {
-              return { shouldContinue: true, delay: { minutes: 5 } };
-            }
-            throw new Error(`Unexpected status while waiting for stop: ${state.status}`);
-          }
-        }
-      );
-      didStop = true;
-      finalStatus = stopped.status;
-    }
-    if (!didStop) {
-      if (finalStatus === "stopped") {
-        return {
-          action: "no-op",
-          reason: "already stopped",
-          status: finalStatus
-        };
-      }
-      throw new Error(`DB status is not stopped after processing: ${finalStatus}`);
-    }
-    if (finalStatus !== "stopped") {
-      throw new Error(`DB status is not stopped after processing: ${finalStatus}`);
-    }
-    const sourceArnParts = detail.SourceArn.split(":");
-    const region = sourceArnParts[3];
-    const account = sourceArnParts[4];
-    const client = new import_web_api.WebClient(slackSecretValue.token);
-    const channel = slackSecretValue.channel;
-    await context.step("post-slack-messages", async () => {
-      return client.chat.postMessage({
-        channel,
-        attachments: [
-          {
-            color: "#36a64f",
-            pretext: `\u{1F634} Successfully stopped the automatically running RDS ${detail.SourceType} ${detail.SourceIdentifier}.`,
-            fields: [
-              {
-                title: "Account",
-                value: account,
-                short: true
-              },
-              {
-                title: "Region",
-                value: region,
-                short: true
-              },
-              {
-                title: "Type",
-                value: detail.SourceType,
-                short: true
-              },
-              {
-                title: "Identifier",
-                value: detail.SourceIdentifier,
-                short: true
-              }
-            ]
-          }
-        ]
-      });
-    });
-    return {
-      action: "stopped",
-      finalStatus,
-      account,
-      region,
-      identifier: detail.SourceIdentifier
-    };
-  }
-);
+    didStop = true;
+    finalStatus = stopped.status;
+  }
+  if (!didStop) {
+    if (afterTagMatch.kind === "no-op") {
+      return afterTagMatch.result;
+    }
+    if (afterTagMatch.kind === "error") {
+      throw new Error(afterTagMatch.message);
+    }
+  }
+  if (finalStatus !== "stopped") {
+    throw new Error(`DB status is not stopped after processing: ${finalStatus}`);
+  }
+  const { region, account } = parseRdsSourceArn(detail.SourceArn);
+  const client = new import_web_api.WebClient(slackSecretValue.token);
+  await context.step("post-slack-messages", async () => {
+    return client.chat.postMessage(
+      buildSlackStopNotification({
+        channel: slackSecretValue.channel,
+        sourceType: detail.SourceType,
+        sourceIdentifier: detail.SourceIdentifier,
+        account,
+        region
+      })
+    );
+  });
+  return buildStoppedResult({
+    finalStatus,
+    account,
+    region,
+    identifier: detail.SourceIdentifier
+  });
+};
+var handler = withDurableExecution(processAutoStartPrevent);
 // Annotate the CommonJS export names for ESM import in node:
 0 && (module.exports = {
-  handler
+  handler,
+  processAutoStartPrevent
 });
 /*! Bundled license information: