stacks 0.58.73 → 0.59.2

package/core/cloud/dist/index.js

@@ -1,2013 +0,0 @@
-// @bun
-// src/helpers.ts
-import {CloudFormation} from "@aws-sdk/client-cloudformation";
-import {CloudWatchLogsClient, DeleteLogGroupCommand, DescribeLogGroupsCommand} from "@aws-sdk/client-cloudwatch-logs";
-import {EC2, _InstanceType as InstanceType} from "@aws-sdk/client-ec2";
-import {DescribeFileSystemsCommand, EFSClient} from "@aws-sdk/client-efs";
-import {IAM} from "@aws-sdk/client-iam";
-import {SSM} from "@aws-sdk/client-ssm";
-import {Lambda} from "@aws-sdk/client-lambda";
-import {ContactType, Route53Domains} from "@aws-sdk/client-route-53-domains";
-import {ListBucketsCommand, S3} from "@aws-sdk/client-s3";
-import {config as config2} from "@stacksjs/config";
-import {err, handleError, ok} from "@stacksjs/error-handling";
-import {log} from "@stacksjs/logging";
-import {path as p} from "@stacksjs/path";
-import {rimraf} from "@stacksjs/utils";
-import {slug} from "@stacksjs/strings";
-async function getSecurityGroupId(securityGroupName) {
-  const ec2 = new EC2({ region: "us-east-1" });
-  const { SecurityGroups } = await ec2.describeSecurityGroups({
-    Filters: [{ Name: "group-name", Values: [securityGroupName] }]
-  });
-  if (!SecurityGroups)
-    return err(`Security group ${securityGroupName} not found`);
-  if (SecurityGroups[0])
-    return ok(SecurityGroups[0].GroupId);
-  return err(`Security group ${securityGroupName} not found`);
-}
-function purchaseDomain(domain, options) {
-  const route53domains = new Route53Domains({ region: "us-east-1" });
-  const contactType = options.contactType.toUpperCase();
-  const params = {
-    DomainName: domain,
-    DurationInYears: options.years || 1,
-    AutoRenew: options.autoRenew || true,
-    AdminContact: {
-      FirstName: options.adminFirstName,
-      LastName: options.adminLastName,
-      ContactType: contactType || ContactType.PERSON,
-      OrganizationName: options.adminOrganization,
-      AddressLine1: options.adminAddressLine1,
-      AddressLine2: options.adminAddressLine2,
-      City: options.adminCity,
-      State: options.adminState,
-      CountryCode: options.adminCountry,
-      ZipCode: options.adminZip.toString(),
-      PhoneNumber: options.adminPhone.toString().includes("+") ? options.adminPhone.toString() : `+${options.adminPhone.toString()}`,
-      Email: options.adminEmail
-    },
-    RegistrantContact: {
-      FirstName: options.registrantFirstName,
-      LastName: options.registrantLastName,
-      ContactType: contactType || ContactType.PERSON,
-      OrganizationName: options.registrantOrganization,
-      AddressLine1: options.registrantAddressLine1,
-      AddressLine2: options.registrantAddressLine2,
-      City: options.registrantCity,
-      State: options.registrantState,
-      CountryCode: options.registrantCountry,
-      ZipCode: options.registrantZip.toString(),
-      PhoneNumber: options.registrantPhone.toString().includes("+") ? options.registrantPhone.toString() : `+${options.registrantPhone.toString()}`,
-      Email: options.registrantEmail
-    },
-    TechContact: {
-      FirstName: options.techFirstName,
-      LastName: options.techLastName,
-      ContactType: contactType || ContactType.PERSON,
-      OrganizationName: options.techOrganization,
-      AddressLine1: options.techAddressLine1,
-      AddressLine2: options.techAddressLine2,
-      City: options.techCity,
-      State: options.techState,
-      CountryCode: options.techCountry,
-      ZipCode: options.techZip.toString(),
-      PhoneNumber: options.techPhone.toString().includes("+") ? options.techPhone.toString() : `+${options.techPhone.toString()}`,
-      Email: options.techEmail
-    },
-    PrivacyProtectAdminContact: options.privacyAdmin || options.privacy || true,
-    PrivacyProtectRegistrantContact: options.privacyRegistrant || options.privacy || true,
-    PrivacyProtectTechContact: options.privacyTech || options.privacy || true
-  };
-  try {
-    return ok(route53domains.registerDomain(params));
-  } catch (error) {
-    return err(error);
-  }
-}
-async function getJumpBoxInstanceId(name) {
-  if (!name)
-    name = `${cloudName}/JumpBox`;
-  const ec2 = new EC2({ region: "us-east-1" });
-  const data = await ec2.describeInstances({
-    Filters: [
-      {
-        Name: "tag:Name",
-        Values: [name]
-      }
-    ]
-  });
-  if (data.Reservations && data.Reservations[0] && data.Reservations[0].Instances && data.Reservations[0].Instances[0])
-    return data.Reservations[0].Instances[0].InstanceId;
-  return;
-}
-async function deleteEc2Instance(id, stackName) {
-  if (!stackName)
-    stackName = cloudName;
-  if (!id)
-    return err(`Instance ${id} not found`);
-  const ec2 = new EC2({ region: "us-east-1" });
-  await ec2.terminateInstances({ InstanceIds: [id] });
-  return ok(`Instance ${id} is being terminated`);
-}
-async function deleteJumpBox(stackName) {
-  if (!stackName)
-    stackName = cloudName;
-  const jumpBoxId = await getJumpBoxInstanceId();
-  if (!jumpBoxId)
-    return err("Jump-box not found");
-  log.info(`Deleting jump-box ${jumpBoxId}...`);
-  return await deleteEc2Instance(jumpBoxId, stackName);
-}
-async function deleteIamUsers() {
-  const iam = new IAM({ region: "us-east-1" });
-  const data = await iam.listUsers({});
-  const teamName = slug(config2.team.name);
-  const users = data.Users?.filter((user) => {
-    const userNameLower = user.UserName?.toLowerCase();
-    return userNameLower !== "stacks" && userNameLower !== teamName.toLowerCase() && userNameLower?.includes(teamName.toLowerCase());
-  }) || [];
-  if (!users || users.length === 0)
-    return ok(`No Stacks IAM users found for team ${teamName}`);
-  const promises = users.map(async (user) => {
-    const userName = user.UserName || "";
-    log.info(`Deleting IAM user: ${userName}`);
-    const policies = await iam.listAttachedUserPolicies({ UserName: userName });
-    await Promise.all(policies.AttachedPolicies?.map((policy) => iam.detachUserPolicy({ UserName: userName, PolicyArn: policy.PolicyArn || "" })) || []);
-    const accessKeys = await iam.listAccessKeys({ UserName: userName });
-    await Promise.all(accessKeys.AccessKeyMetadata?.map((key) => iam.deleteAccessKey({ UserName: userName, AccessKeyId: key.AccessKeyId || "" })) || []);
-    return iam.deleteUser({ UserName: userName });
-  });
-  await Promise.all(promises).catch((error) => {
-    console.error(`Error deleting user: ${error}`);
-    return err(handleError("Error deleting Stacks IAM users", error));
-  });
-  return ok(`Stacks IAM users deleted for team ${teamName}`);
-}
-async function deleteStacksBuckets() {
-  try {
-    const s3 = new S3({ region: "us-east-1" });
-    const data = await s3.listBuckets({});
-    const stacksBuckets = data.Buckets?.filter((bucket) => bucket.Name?.includes("stacks"));
-    if (!stacksBuckets)
-      return err("No stacks buckets found");
-    const promises = stacksBuckets.map(async (bucket) => {
-      const bucketName = bucket.Name || "";
-      log.info(`Deleting bucket ${bucketName}...`);
-      const objects = await s3.listObjectsV2({ Bucket: bucketName });
-      log.info(`Finished listing bucket ${bucketName} objects`);
-      if (objects.Contents) {
-        log.info("Deleting bucket objects...");
-        await Promise.all(objects.Contents.map((object) => s3.deleteObject({ Bucket: bucketName, Key: object.Key || "" }).catch((error) => handleError(error))));
-        log.info(`Finished deleting objects from bucket ${bucketName}`);
-      }
-      log.info(`Deleting bucket ${bucketName} versions...`);
-      try {
-        const versions = await s3.listObjectVersions({ Bucket: bucketName });
-        if (versions.Versions) {
-          await Promise.all(versions.Versions.map((version) => s3.deleteObject({ Bucket: bucketName, Key: version.Key || "", VersionId: version.VersionId }))).catch((error) => handleError(error));
-          log.info(`Finished deleting versions from bucket ${bucketName}`);
-        }
-        log.info(`Deleting bucket ${bucketName} delete markers...`);
-        if (versions.DeleteMarkers) {
-          await Promise.all(versions.DeleteMarkers.map((marker) => s3.deleteObject({ Bucket: bucketName, Key: marker.Key || "", VersionId: marker.VersionId }))).catch((error) => handleError(error));
-          log.info(`Finished deleting delete markers from bucket ${bucketName}`);
-        }
-        const uploads = await s3.listMultipartUploads({ Bucket: bucketName });
-        if (uploads.Uploads) {
-          log.info("Aborting bucket multipart uploads...");
-          await Promise.all(uploads.Uploads.map((upload) => s3.abortMultipartUpload({ Bucket: bucketName, Key: upload.Key || "", UploadId: upload.UploadId }))).catch((error) => handleError(error));
-          log.info(`Finished aborting multipart uploads from bucket ${bucketName}`);
-        }
-        await s3.deleteBucket({ Bucket: bucketName }).catch((error) => handleError(error));
-        log.info(`Bucket ${bucketName} deleted`);
-      } catch (error) {
-        log.info(`Error listing bucket ${bucketName} versions`, error);
-      }
-    });
-    await Promise.all(promises).catch((error) => {
-      return err(handleError("Error deleting stacks buckets", error));
-    });
-    return ok("Stacks buckets deleted");
-  } catch (error) {
-    return err(handleError("Error deleting stacks buckets", error));
-  }
-}
-async function deleteStacksFunctions() {
-  const lambda = new Lambda({ region: "us-east-1" });
-  const data = await lambda.listFunctions({});
-  const stacksFunctions = data.Functions?.filter((func) => func.FunctionName?.includes("stacks")) || [];
-  if (!stacksFunctions || stacksFunctions.length === 0)
-    return ok("No stacks functions found");
-  const promises = stacksFunctions.map((func) => lambda.deleteFunction({ FunctionName: func.FunctionName || "" }));
-  await Promise.all(promises).catch((error) => {
-    if (error.message.includes("it is a replicated function")) {
-      log.info("Function is replicated, skipping...");
-      return ok("CloudFront is still deleting the some functions. Try again later.");
-    }
-    return err(handleError("Error deleting stacks functions", error));
-  });
-  return ok("Stacks functions deleted");
-}
-async function deleteLogGroups() {
-  try {
-    const client = new CloudWatchLogsClient({ region: "us-east-1" });
-    const logGroups = await client.send(new DescribeLogGroupsCommand({}));
-    if (!logGroups?.logGroups)
-      return err("No log groups found");
-    for (const group of logGroups.logGroups) {
-      if (group.logGroupName?.includes("stacks"))
-        await client.send(new DeleteLogGroupCommand({ logGroupName: group.logGroupName }));
-    }
-    return ok("Log groups deleted");
-  } catch (error) {
-    return err(handleError("Error deleting log groups", error));
-  }
-}
-async function deleteParameterStore() {
-  const ssm = new SSM({ region: "us-east-1" });
-  const data = await ssm.describeParameters({});
-  if (!data.Parameters)
-    return ok("No parameters found");
-  const stacksParameters = data.Parameters.filter((param) => param.Name?.includes("stacks")) || [];
-  if (!stacksParameters || stacksParameters.length === 0)
-    return ok("No stacks parameters found");
-  const promises = stacksParameters.map((param) => ssm.deleteParameter({ Name: param.Name || "" }));
-  await Promise.all(promises).catch((error) => {
-    return err(handleError("Error deleting parameter store", error));
-  });
-  return ok("Parameter store deleted");
-}
-async function deleteCdkRemnants() {
-  try {
-    return ok(await rimraf([
-      p.cloudPath("cdk.out/"),
-      p.cloudPath("cdk.context.json")
-    ]));
-  } catch (error) {
-    return err(handleError("Error deleting CDK remnants", error));
-  }
-}
-async function hasBeenDeployed() {
-  const s3 = new S3({ region: "us-east-1" });
-  try {
-    const response = await s3.send(new ListBucketsCommand({}));
-    return ok(response.Buckets?.some((bucket) => bucket.Name?.includes(config2.app.name?.toLocaleLowerCase() || "stacks")) || false);
-  } catch (error) {
-    return err(handleError("Error checking if the app has been deployed", error));
-  }
-}
-async function getJumpBoxInstanceProfileName() {
-  const iam = new IAM({ region: "us-east-1" });
-  const data = await iam.listInstanceProfiles({});
-  const instanceProfile = data.InstanceProfiles?.find((profile) => profile.InstanceProfileName?.includes("JumpBox"));
-  if (!instanceProfile)
-    return err("Jump-box IAM instance profile not found");
-  return ok(instanceProfile?.InstanceProfileName);
-}
-async function addJumpBox(stackName) {
-  if (!stackName)
-    stackName = cloudName;
-  if (await getJumpBoxInstanceId())
-    return err("The jump\u2013box you are trying to add already exists. Please remove it & wait until it finished terminating.");
-  const ec2 = new EC2({ region: "us-east-1" });
-  const r = await getJumpBoxSecurityGroupName();
-  if (r.isErr())
-    return err(r.error);
-  if (!r.value)
-    return err("Security group not found when adding jump-box");
-  const result = await getSecurityGroupId(r.value);
-  let sgId;
-  if (result.isErr())
-    return err(result.error);
-  else
-    sgId = result.value;
-  if (!sgId)
-    return err("Security group not found when adding jump-box");
-  const client = new EFSClient({ region: "us-east-1" });
-  const command = new DescribeFileSystemsCommand({});
-  const data = await client.send(command);
-  const fileSystemName = `stacks-${config2.app.env}-efs`;
-  const fileSystem = data.FileSystems?.find((fs) => fs.Name === fileSystemName);
-  const fileSystemId = fileSystem?.FileSystemId;
-  if (!fileSystem || !fileSystemId)
-    return err(`EFS file system ${fileSystemName} not found`);
-  const userDataScript = `
-#!/bin/bash
-yum update -y
-yum install -y amazon-efs-utils
-yum install -y git
-yum install -y https://s3.us-east-1.amazonaws.com/amazon-ssm-us-east-1/latest/linux_amd64/amazon-ssm-agent.rpm
-mkdir /mnt/efs
-mount -t efs ${fileSystemId}:/ /mnt/efs
-git clone https://github.com/stacksjs/stacks.git /mnt/efs
-`;
-  const base64UserData = btoa(userDataScript);
-  const res = await getJumpBoxInstanceProfileName();
-  if (res.isErr())
-    return err(res.error);
-  const jumpBoxInstanceProfileName = res.value;
-  if (!jumpBoxInstanceProfileName)
-    return err("Jump-box IAM instance profile not found");
-  const instance = await ec2.runInstances({
-    ImageId: "ami-03a6eaae9938c858c",
-    InstanceType: InstanceType.t2_micro,
-    MaxCount: 1,
-    MinCount: 1,
-    SecurityGroupIds: [sgId],
-    SubnetId: "subnet-004c5f196358b00f0",
-    TagSpecifications: [
-      {
-        ResourceType: "instance",
-        Tags: [
-          {
-            Key: "Name",
-            Value: `${cloudName}-jump-box`
-          }
-        ]
-      }
-    ],
-    UserData: base64UserData,
-    IamInstanceProfile: {
-      Name: jumpBoxInstanceProfileName
-    }
-  });
-  return instance.Instances && instance.Instances[0] ? ok(`Jump-box created with id ${instance.Instances[0].InstanceId}`) : err("Jump-box creation failed");
-}
-async function getJumpBoxSecurityGroupName() {
-  const jumpBoxId = await getJumpBoxInstanceId();
-  if (!jumpBoxId)
-    return err("Jump-box not found");
-  const ec2 = new EC2({ region: "us-east-1" });
-  const data = await ec2.describeInstances({ InstanceIds: [jumpBoxId] });
-  if (data.Reservations && data.Reservations[0] && data.Reservations[0].Instances && data.Reservations[0].Instances[0]) {
-    const instance = data.Reservations[0].Instances[0];
-    const securityGroups = instance.SecurityGroups;
-    if (securityGroups && securityGroups[0])
-      return ok(securityGroups[0].GroupName);
-  }
-  return err("Security group not found");
-}
-async function getSecurityGroupFromInstanceId(instanceId) {
-  const ec2 = new EC2({ region: "us-east-1" });
-  const data = await ec2.describeInstances({ InstanceIds: [instanceId] });
-  if (data.Reservations && data.Reservations[0] && data.Reservations[0].Instances && data.Reservations[0].Instances[0]) {
-    const instance = data.Reservations[0].Instances[0];
-    const securityGroups = instance.SecurityGroups;
-    if (securityGroups && securityGroups[0])
-      return securityGroups[0].GroupId;
-  }
-  return;
-}
-async function isFirstDeployment() {
-  const stackName = cloudName;
-  const cloudFormation = new CloudFormation;
-  const data = await cloudFormation.listStacks({ StackStatusFilter: ["CREATE_COMPLETE", "UPDATE_COMPLETE"] });
-  const isStacksCloudPresent = data.StackSummaries?.some((stack) => stack.StackName === stackName);
-  return !isStacksCloudPresent;
-}
-async function isFailedState() {
-  const cloudFormation = new CloudFormation;
-  const data = await cloudFormation.listStacks({ StackStatusFilter: ["CREATE_FAILED", "UPDATE_FAILED", "ROLLBACK_COMPLETE", "UPDATE_ROLLBACK_COMPLETE"] });
-  const isStacksCloudPresent = data.StackSummaries?.some((stack) => stack.StackName === cloudName);
-  return !isStacksCloudPresent;
-}
-async function getOrCreateTimestamp() {
-  const parameterName = `/stacks/timestamp`;
-  const ssm = new SSM({ region: "us-east-1" });
-  try {
-    const response = await ssm.getParameter({ Name: parameterName });
-    const timestamp = response.Parameter ? response.Parameter.Value : undefined;
-    if (!timestamp)
-      throw new Error("Timestamp parameter not found");
-    return timestamp;
-  } catch (error) {
-    const timestamp = new Date().getTime().toString();
-    log.debug(`Creating timestamp parameter ${parameterName} with value ${timestamp}`);
-    await ssm.putParameter({
-      Name: parameterName,
-      Value: timestamp,
-      Type: "String"
-    });
-    return timestamp;
-  }
-}
-var appEnv = config2.app.env === "local" ? "dev" : config2.app.env;
-var cloudName = `stacks-cloud-${appEnv}`;
-// src/cloud/index.ts
-import {Stack as Stack2} from "aws-cdk-lib";
-import {config as config20} from "@stacksjs/config";
-
-// src/cloud/ai.ts
-import {Duration, CfnOutput as Output, aws_iam as iam, aws_lambda as lambda} from "aws-cdk-lib";
-import {config as config4} from "@stacksjs/config";
-
-class AiStack {
-  askAiUrl;
-  summarizeAiUrl;
-  constructor(scope, props) {
-    const awsSdkLayer = new lambda.LayerVersion(scope, "AwsSdkLayer", {
-      code: lambda.Code.fromAsset("../core/cloud/src/cloud/aws-sdk-layer"),
-      compatibleRuntimes: [lambda.Runtime.NODEJS_20_X],
-      description: "Layer with aws-sdk"
-    });
-    const bedrockAccessPolicy = new iam.PolicyStatement({
-      effect: iam.Effect.ALLOW,
-      actions: [
-        "bedrock:InvokeModel",
-        "bedrock:InvokeModelWithResponseStream"
-      ],
-      resources: config4.ai.models?.map((model) => `arn:aws:bedrock:us-east-1::foundation-model/${model}`)
-    });
-    const bedrockAccessRole = new iam.Role(scope, "BedrockAccessRole", {
-      assumedBy: new iam.ServicePrincipal("lambda.amazonaws.com"),
-      managedPolicies: [
-        iam.ManagedPolicy.fromAwsManagedPolicyName("service-role/AWSLambdaBasicExecutionRole")
-      ]
-    });
-    bedrockAccessRole.addToPolicy(bedrockAccessPolicy);
-    const askAi = new lambda.Function(scope, "AskAiFunction", {
-      functionName: `${props.slug}-${props.appEnv}-ai-ask`,
-      description: "Lambda function to invoke the AI model",
-      runtime: lambda.Runtime.NODEJS_20_X,
-      handler: "index.handler",
-      code: lambda.Code.fromAsset("../core/cloud/src/cloud/lambda/ask"),
-      layers: [awsSdkLayer],
-      role: bedrockAccessRole,
-      timeout: Duration.seconds(30)
-    });
-    this.askAiUrl = new lambda.FunctionUrl(scope, "AskAiFunctionUrl", {
-      function: askAi,
-      authType: lambda.FunctionUrlAuthType.NONE,
-      cors: {
-        allowedOrigins: ["*"]
-      }
-    });
-    const summarizeAi = new lambda.Function(scope, "SummarizeAiFunction", {
-      functionName: `${props.slug}-${props.appEnv}-ai-summarize`,
-      description: "Lambda function to summarize any given text",
-      runtime: lambda.Runtime.NODEJS_20_X,
-      handler: "index.handler",
-      code: lambda.Code.fromAsset("../core/cloud/src/cloud/lambda/summarize"),
-      layers: [awsSdkLayer],
-      role: bedrockAccessRole,
-      timeout: Duration.seconds(30)
-    });
-    this.summarizeAiUrl = new lambda.FunctionUrl(scope, "SummarizeAiFunctionUrl", {
-      function: summarizeAi,
-      authType: lambda.FunctionUrlAuthType.NONE,
-      cors: {
-        allowedOrigins: ["*"]
-      }
-    });
-    new Output(scope, "AiVanityAskApiUrl", {
-      value: this.askAiUrl.url
-    });
-    new Output(scope, "AiVanitySummarizeApiUrl", {
-      value: this.summarizeAiUrl.url
-    });
-    new Output(scope, "AiAskApiUrl", {
-      value: `https://${props.domain}/ai/ask`
-    });
-    new Output(scope, "AiSummarizeApiUrl", {
-      value: `https://${props.domain}/ai/summary`
-    });
-  }
-}
-
-// src/cloud/cdn.ts
-import {Duration as Duration2, Fn, CfnOutput as Output2, aws_cloudfront as cloudfront, aws_cloudfront_origins as origins, aws_route53 as route53, aws_route53_targets as targets} from "aws-cdk-lib";
-import {config as config6} from "@stacksjs/config";
-import {hasFiles} from "@stacksjs/storage";
-import {path as p2} from "@stacksjs/path";
-import {env as env2} from "@stacksjs/env";
-import * as kinesis from "aws-cdk-lib/aws-kinesis";
-
-class CdnStack {
-  distribution;
-  originAccessIdentity;
-  cdnCachePolicy;
-  apiCachePolicy;
-  vanityUrl;
-  realtimeLogConfig;
-  props;
-  constructor(scope, props) {
-    this.props = props;
-    this.originAccessIdentity = new cloudfront.OriginAccessIdentity(scope, "OAI");
-    this.cdnCachePolicy = new cloudfront.CachePolicy(scope, "CdnCachePolicy", {
-      comment: "Stacks CDN Cache Policy",
-      cachePolicyName: `${props.slug}-${props.appEnv}-cdn-cache-policy`,
-      minTtl: config6.cloud.cdn?.minTtl ? Duration2.seconds(config6.cloud.cdn.minTtl) : undefined,
-      defaultTtl: config6.cloud.cdn?.defaultTtl ? Duration2.seconds(config6.cloud.cdn.defaultTtl) : undefined,
-      maxTtl: config6.cloud.cdn?.maxTtl ? Duration2.seconds(config6.cloud.cdn.maxTtl) : undefined,
-      cookieBehavior: this.getCookieBehavior(config6.cloud.cdn?.cookieBehavior)
-    });
-    const logStream = new kinesis.Stream(scope, "StacksCdnRealtimeLogStream", {
-      streamName: "StacksCdnRealtimeLogStream",
-      retentionPeriod: Duration2.days(1),
-      shardCount: 1,
-      encryption: kinesis.StreamEncryption.UNENCRYPTED
-    });
-    this.realtimeLogConfig = new cloudfront.RealtimeLogConfig(scope, "StacksRealTimeLogConfig", {
-      endPoints: [
-        cloudfront.Endpoint.fromKinesisStream(logStream)
-      ],
-      fields: [
-        "timestamp",
-        "c-ip",
-        "cs-method",
-        "cs-uri-stem",
-        "cs-uri-query",
-        "cs-referer",
-        "cs-user-agent",
-        "sc-status"
-      ],
-      samplingRate: 100
-    });
-    this.distribution = new cloudfront.Distribution(scope, "Cdn", {
-      domainNames: [props.domain],
-      defaultRootObject: "index.html",
-      comment: `CDN for ${config6.app.url}`,
-      certificate: props.certificate,
-      enableLogging: true,
-      logBucket: props.logBucket,
-      httpVersion: cloudfront.HttpVersion.HTTP2_AND_3,
-      priceClass: cloudfront.PriceClass.PRICE_CLASS_ALL,
-      enabled: true,
-      minimumProtocolVersion: cloudfront.SecurityPolicyProtocol.TLS_V1_2_2021,
-      webAclId: props.firewall.attrArn,
-      enableIpv6: true,
-      defaultBehavior: {
-        origin: new origins.S3Origin(props.publicBucket, {
-          originAccessIdentity: this.originAccessIdentity
-        }),
-        edgeLambdas: [
-          {
-            eventType: cloudfront.LambdaEdgeEventType.ORIGIN_REQUEST,
-            functionVersion: props.originRequestFunction.currentVersion
-          }
-        ],
-        compress: config6.cloud.cdn?.compress,
-        allowedMethods: this.allowedMethods(),
-        cachedMethods: this.cachedMethods(),
-        viewerProtocolPolicy: cloudfront.ViewerProtocolPolicy.REDIRECT_TO_HTTPS,
-        cachePolicy: this.cdnCachePolicy,
-        realtimeLogConfig: this.realtimeLogConfig
-      },
-      additionalBehaviors: this.additionalBehaviors(scope, props),
-      errorResponses: [
-        {
-          httpStatus: 403,
-          responsePagePath: "/index.html",
-          responseHttpStatus: 200,
-          ttl: Duration2.seconds(0)
-        }
-      ]
-    });
-    new route53.ARecord(scope, "AliasRecord", {
-      recordName: props.domain,
-      zone: props.zone,
-      target: route53.RecordTarget.fromAlias(new targets.CloudFrontTarget(this.distribution))
-    });
-    new Output2(scope, "DistributionId", {
-      value: this.distribution.distributionId
-    });
-    new Output2(scope, "AppUrl", {
-      value: `https://${props.domain}`,
-      description: "The URL of the deployed application"
-    });
-    this.vanityUrl = `https://${this.distribution.domainName}`;
-    new Output2(scope, "AppVanityUrl", {
-      value: this.vanityUrl,
-      description: "The vanity URL of the deployed application"
-    });
-  }
-  getCookieBehavior(behavior) {
-    switch (behavior) {
-      case "all":
-        return cloudfront.CacheCookieBehavior.all();
-      case "none":
-        return cloudfront.CacheCookieBehavior.none();
-      case "allowList":
-        return cloudfront.CacheCookieBehavior.allowList(...config6.cloud.cdn?.allowList.cookies || []);
-      default:
-        return;
-    }
-  }
-  allowedMethods() {
-    switch (config6.cloud.cdn?.allowedMethods) {
-      case "ALL":
-        return cloudfront.AllowedMethods.ALLOW_ALL;
-      case "GET_HEAD":
-        return cloudfront.AllowedMethods.ALLOW_GET_HEAD;
-      case "GET_HEAD_OPTIONS":
-        return cloudfront.AllowedMethods.ALLOW_GET_HEAD_OPTIONS;
-      default:
-        return cloudfront.AllowedMethods.ALLOW_ALL;
-    }
-  }
-  cachedMethods() {
-    switch (config6.cloud.cdn?.cachedMethods) {
-      case "GET_HEAD":
-        return cloudfront.CachedMethods.CACHE_GET_HEAD;
-      case "GET_HEAD_OPTIONS":
-        return cloudfront.CachedMethods.CACHE_GET_HEAD_OPTIONS;
-      default:
-        return cloudfront.CachedMethods.CACHE_GET_HEAD;
-    }
-  }
-  allowedMethodsFromString(methods) {
-    if (!methods)
-      return cloudfront.AllowedMethods.ALLOW_ALL;
-    switch (methods) {
-      case "ALL":
-        return cloudfront.AllowedMethods.ALLOW_ALL;
-      case "GET_HEAD":
-        return cloudfront.AllowedMethods.ALLOW_GET_HEAD;
-      case "GET_HEAD_OPTIONS":
-        return cloudfront.AllowedMethods.ALLOW_GET_HEAD_OPTIONS;
-      default:
-        return cloudfront.AllowedMethods.ALLOW_ALL;
-    }
-  }
-  cachedMethodsFromString(methods) {
-    if (!methods)
-      return cloudfront.CachedMethods.CACHE_GET_HEAD;
-    switch (methods) {
-      case "GET_HEAD":
-        return cloudfront.CachedMethods.CACHE_GET_HEAD;
-      case "GET_HEAD_OPTIONS":
-        return cloudfront.CachedMethods.CACHE_GET_HEAD_OPTIONS;
-      default:
-        return cloudfront.CachedMethods.CACHE_GET_HEAD;
-    }
-  }
-  shouldDeployApi() {
-    return config6.cloud.api?.deploy;
-  }
-  apiBehaviorOptions(scope, props) {
-    const hostname = `api.${props.domain}`;
-    const origin = () => {
-      return new origins.HttpOrigin(hostname, {
-        originPath: "/",
-        protocolPolicy: cloudfront.OriginProtocolPolicy.HTTPS_ONLY
-      });
-    };
-    return {
-      "/api": {
-        origin: origin(),
-        compress: true,
-        allowedMethods: cloudfront.AllowedMethods.ALLOW_ALL,
-        cachedMethods: cloudfront.CachedMethods.CACHE_GET_HEAD_OPTIONS,
-        cachePolicy: this.setApiCachePolicy(scope),
-        viewerProtocolPolicy: cloudfront.ViewerProtocolPolicy.REDIRECT_TO_HTTPS,
-        realtimeLogConfig: this.realtimeLogConfig
-      },
-      "/api/*": {
-        origin: origin(),
-        compress: true,
-        allowedMethods: cloudfront.AllowedMethods.ALLOW_ALL,
-        cachedMethods: cloudfront.CachedMethods.CACHE_GET_HEAD_OPTIONS,
-        cachePolicy: this.apiCachePolicy,
-        viewerProtocolPolicy: cloudfront.ViewerProtocolPolicy.REDIRECT_TO_HTTPS,
-        realtimeLogConfig: this.realtimeLogConfig
-      }
-    };
-  }
-  docsBehaviorOptions(props) {
-    return {
-      "/docs": {
-        origin: new origins.S3Origin(props.publicBucket, {
-          originAccessIdentity: this.originAccessIdentity,
-          originPath: "/docs"
-        }),
-        compress: true,
-        allowedMethods: this.allowedMethodsFromString(config6.cloud.cdn?.allowedMethods),
-        cachedMethods: this.cachedMethodsFromString(config6.cloud.cdn?.cachedMethods),
-        viewerProtocolPolicy: cloudfront.ViewerProtocolPolicy.REDIRECT_TO_HTTPS,
-        cachePolicy: cloudfront.CachePolicy.CACHING_OPTIMIZED,
-        realtimeLogConfig: this.realtimeLogConfig
-      },
-      "/docs/*": {
-        origin: new origins.S3Origin(props.publicBucket, {
-          originAccessIdentity: this.originAccessIdentity,
-          originPath: "/docs"
-        }),
-        compress: true,
-        allowedMethods: this.allowedMethodsFromString(config6.cloud.cdn?.allowedMethods),
-        cachedMethods: this.cachedMethodsFromString(config6.cloud.cdn?.cachedMethods),
-        viewerProtocolPolicy: cloudfront.ViewerProtocolPolicy.REDIRECT_TO_HTTPS,
-        cachePolicy: cloudfront.CachePolicy.CACHING_OPTIMIZED,
-        realtimeLogConfig: this.realtimeLogConfig
-      }
-    };
-  }
-  aiBehaviorOptions(scope, props) {
-    const hostname = Fn.select(2, Fn.split("/", props.askAiUrl.url));
-    const summaryHostname = Fn.select(2, Fn.split("/", props.summarizeAiUrl.url));
-    const aiCachePolicy = new cloudfront.CachePolicy(scope, "AiCachePolicy", {
-      comment: "Stacks AI Cache Policy",
-      cachePolicyName: `${this.props.slug}-${this.props.appEnv}-ai-cache-policy`,
-      defaultTtl: Duration2.seconds(0),
-      cookieBehavior: cloudfront.CacheCookieBehavior.none(),
-      headerBehavior: cloudfront.CacheHeaderBehavior.allowList("Accept", "x-api-key", "Authorization", "Content-Type"),
-      queryStringBehavior: cloudfront.CacheQueryStringBehavior.all()
-    });
-    return {
-      "/ai/ask": {
-        origin: new origins.HttpOrigin(hostname, {
-          originPath: "/ai",
-          protocolPolicy: cloudfront.OriginProtocolPolicy.HTTPS_ONLY
-        }),
-        compress: false,
-        allowedMethods: cloudfront.AllowedMethods.ALLOW_ALL,
-        viewerProtocolPolicy: cloudfront.ViewerProtocolPolicy.REDIRECT_TO_HTTPS,
-        cachePolicy: aiCachePolicy,
-        realtimeLogConfig: this.realtimeLogConfig
-      },
-      "/ai/summary": {
-        origin: new origins.HttpOrigin(summaryHostname, {
-          originPath: "/ai",
-          protocolPolicy: cloudfront.OriginProtocolPolicy.HTTPS_ONLY
-        }),
-        compress: false,
-        allowedMethods: cloudfront.AllowedMethods.ALLOW_ALL,
-        viewerProtocolPolicy: cloudfront.ViewerProtocolPolicy.REDIRECT_TO_HTTPS,
-        cachePolicy: aiCachePolicy,
-        realtimeLogConfig: this.realtimeLogConfig
-      }
-    };
-  }
-  cliSetupBehaviorOptions(scope, props) {
-    const hostname = Fn.select(2, Fn.split("/", props.cliSetupUrl.url));
-    return {
-      "/install": {
-        origin: new origins.HttpOrigin(hostname, {
-          originPath: "/cli-setup",
-          protocolPolicy: cloudfront.OriginProtocolPolicy.HTTPS_ONLY
-        }),
-        compress: false,
-        allowedMethods: cloudfront.AllowedMethods.ALLOW_ALL,
-        viewerProtocolPolicy: cloudfront.ViewerProtocolPolicy.REDIRECT_TO_HTTPS,
-        cachePolicy: new cloudfront.CachePolicy(scope, "CliSetupCachePolicy", {
-          comment: "Stacks CLI Setup Cache Policy",
-          cachePolicyName: `${this.props.slug}-${this.props.appEnv}-cli-setup-cache-policy`,
-          defaultTtl: Duration2.seconds(0),
-          cookieBehavior: cloudfront.CacheCookieBehavior.none(),
-          headerBehavior: cloudfront.CacheHeaderBehavior.none(),
-          queryStringBehavior: cloudfront.CacheQueryStringBehavior.none()
-        }),
-        realtimeLogConfig: this.realtimeLogConfig
-      }
-    };
-  }
-  shouldDeployAiEndpoints() {
-    return config6.cloud.ai;
-  }
-  shouldDeployCliSetup() {
-    return config6.cloud.cli;
-  }
-  shouldDeployDocs() {
-    return hasFiles(p2.projectPath("docs"));
-  }
-  additionalBehaviors(scope, props) {
-    let behaviorOptions = {};
-    if (this.shouldDeployApi()) {
-      const keysToRemove = ["_HANDLER", "_X_AMZN_TRACE_ID", "AWS_REGION", "AWS_EXECUTION_ENV", "AWS_LAMBDA_FUNCTION_NAME", "AWS_LAMBDA_FUNCTION_MEMORY_SIZE", "AWS_LAMBDA_FUNCTION_VERSION", "AWS_LAMBDA_INITIALIZATION_TYPE", "AWS_LAMBDA_LOG_GROUP_NAME", "AWS_LAMBDA_LOG_STREAM_NAME", "AWS_ACCESS_KEY", "AWS_ACCESS_KEY_ID", "AWS_SECRET_ACCESS_KEY", "AWS_SESSION_TOKEN", "AWS_LAMBDA_RUNTIME_API", "LAMBDA_TASK_ROOT", "LAMBDA_RUNTIME_DIR", "_"];
-      keysToRemove.forEach((key) => delete env2[key]);
-      behaviorOptions = this.apiBehaviorOptions(scope, props);
-    }
-    if (this.shouldDeployDocs() && !config6.app.docMode) {
-      behaviorOptions = {
-        ...this.docsBehaviorOptions(props),
-        ...behaviorOptions
-      };
-    }
-    if (this.shouldDeployAiEndpoints()) {
-      behaviorOptions = {
-        ...this.aiBehaviorOptions(scope, props),
-        ...behaviorOptions
-      };
-    }
-    if (this.shouldDeployCliSetup()) {
-      behaviorOptions = {
-        ...this.cliSetupBehaviorOptions(scope, props),
-        ...behaviorOptions
-      };
-    }
-    return behaviorOptions;
-  }
-  setApiCachePolicy(scope) {
-    if (this.apiCachePolicy)
-      return this.apiCachePolicy;
-    this.apiCachePolicy = new cloudfront.CachePolicy(scope, "ApiCachePolicy", {
-      comment: "Stacks API Cache Policy",
-      cachePolicyName: `${this.props.slug}-${this.props.appEnv}-api-cache-policy`,
-      defaultTtl: Duration2.seconds(0),
-      cookieBehavior: cloudfront.CacheCookieBehavior.none(),
-      headerBehavior: cloudfront.CacheHeaderBehavior.allowList("Accept", "x-api-key", "Authorization", "Content-Type"),
-      queryStringBehavior: cloudfront.CacheQueryStringBehavior.none()
-    });
-    return this.apiCachePolicy;
-  }
-}
-
-// src/cloud/cli.ts
-import {Duration as Duration3, CfnOutput as Output3, aws_lambda as lambda2} from "aws-cdk-lib";
-
-class CliStack {
-  cliSetupUrl;
-  constructor(scope, props) {
-    const cliSetupFunc = new lambda2.Function(scope, "CliSetupFunction", {
-      functionName: `${props.slug}-${props.appEnv}-cli-setup`,
-      description: "Lambda function that triggers setup script for a Stacks project",
-      runtime: lambda2.Runtime.NODEJS_20_X,
-      handler: "index.handler",
-      code: lambda2.Code.fromAsset("../core/cloud/src/cloud/lambda/cli-setup"),
-      timeout: Duration3.seconds(30)
-    });
-    this.cliSetupUrl = new lambda2.FunctionUrl(scope, "CliSetupFunctionUrl", {
-      function: cliSetupFunc,
-      authType: lambda2.FunctionUrlAuthType.NONE,
-      cors: {
-        allowedOrigins: ["*"]
-      }
-    });
-    new Output3(scope, "CliSetupVanityUrl", {
-      value: `${this.cliSetupUrl.url}cli-setup`
-    });
-    new Output3(scope, "CliSetupUrl", {
-      value: `https://${props.domain}/install`,
-      description: "URL to trigger the CLI setup function"
-    });
-  }
-}
-
-// src/cloud/dns.ts
-import {RemovalPolicy, aws_route53 as route532, aws_s3 as s3, aws_route53_targets as targets2} from "aws-cdk-lib";
-
-class DnsStack {
-  zone;
-  constructor(scope, props) {
-    this.zone = route532.PublicHostedZone.fromLookup(scope, "AppUrlHostedZone", {
-      domainName: props.domain
-    });
-    const wwwBucket = new s3.Bucket(scope, "WwwBucket", {
-      bucketName: `www.${props.domain}`,
-      websiteRedirect: {
-        hostName: props.domain,
-        protocol: s3.RedirectProtocol.HTTPS
-      },
-      removalPolicy: RemovalPolicy.DESTROY,
-      autoDeleteObjects: true
-    });
-    new route532.ARecord(scope, "WwwAliasRecord", {
-      recordName: `www.${props.domain}`,
-      zone: this.zone,
-      target: route532.RecordTarget.fromAlias(new targets2.BucketWebsiteTarget(wwwBucket))
-    });
-    new route532.ARecord(scope, "StoreAliasRecord", {
-      recordName: `store.${props.domain}`,
-      zone: this.zone,
-      target: route532.RecordTarget.fromIpAddresses("137.66.37.136")
-    });
-  }
-}
-
-// src/cloud/docs.ts
-import {AssetHashType, CfnOutput as Output4, RemovalPolicy as RemovalPolicy2, aws_lambda as lambda3} from "aws-cdk-lib";
-import {config as config8} from "@stacksjs/config";
-import {path as p3} from "@stacksjs/path";
-import {storage as storage3} from "@stacksjs/storage";
-import {originRequestFunctionHash} from "@stacksjs/utils";
-
-class DocsStack {
-  originRequestFunction;
-  constructor(scope, props) {
-    const docsPrefix = config8.app.docMode ? "" : config8.docs.base;
-    this.originRequestFunction = new lambda3.Function(scope, "OriginRequestFunction", {
-      functionName: `${props.slug}-${props.appEnv}-origin-request-${props.timestamp}`,
-      description: "The Stacks Origin Request function that prettifies URLs",
-      runtime: lambda3.Runtime.NODEJS_18_X,
-      handler: "dist/origin-request.handler",
-      code: lambda3.Code.fromAsset(p3.frameworkCloudPath("dist.zip"), {
-        assetHash: originRequestFunctionHash(),
-        assetHashType: AssetHashType.CUSTOM
-      })
-    });
-    const cfnOriginRequestFunction = this.originRequestFunction.node.defaultChild;
-    cfnOriginRequestFunction.applyRemovalPolicy(RemovalPolicy2.RETAIN);
-    if (!config8.app.docMode && storage3.hasFiles(p3.projectPath("docs"))) {
-      new Output4(scope, "DocsUrl", {
-        value: `https://${props.domain}/${docsPrefix}`,
-        description: "The URL of the deployed documentation"
-      });
-    }
-  }
-}
-
-// src/cloud/storage.ts
-import {RemovalPolicy as RemovalPolicy3, Tags, aws_backup as backup, aws_iam as iam2, aws_s3 as s32} from "aws-cdk-lib";
-
-class StorageStack {
-  publicBucket;
-  privateBucket;
-  logBucket;
-  bucketPrefix;
-  vault;
-  backupPlan;
-  backupRole;
-  constructor(scope, props) {
-    this.bucketPrefix = `${props.slug}-${props.appEnv}`;
-    this.publicBucket = new s32.Bucket(scope, "PublicBucket", {
-      bucketName: `${this.bucketPrefix}-public-${props.timestamp}`,
-      versioned: true,
-      autoDeleteObjects: true,
-      removalPolicy: RemovalPolicy3.DESTROY,
-      encryption: s32.BucketEncryption.S3_MANAGED
-    });
-    Tags.of(this.publicBucket).add("daily-backup", "true");
-    this.privateBucket = new s32.Bucket(scope, "PrivateBucket", {
-      bucketName: `${this.bucketPrefix}-private-${props.timestamp}`,
-      versioned: true,
-      removalPolicy: RemovalPolicy3.DESTROY,
-      autoDeleteObjects: true,
-      encryption: s32.BucketEncryption.S3_MANAGED,
-      enforceSSL: true,
-      publicReadAccess: false,
-      blockPublicAccess: {
-        blockPublicAcls: true,
-        blockPublicPolicy: true,
-        ignorePublicAcls: true,
-        restrictPublicBuckets: true
-      }
-    });
-    Tags.of(this.privateBucket).add("daily-backup", "true");
-    this.logBucket = new s32.Bucket(scope, "LogsBucket", {
-      bucketName: `${this.bucketPrefix}-logs-${props.timestamp}`,
-      removalPolicy: RemovalPolicy3.RETAIN,
-      blockPublicAccess: new s32.BlockPublicAccess({
-        blockPublicAcls: false,
-        ignorePublicAcls: true,
-        blockPublicPolicy: true,
-        restrictPublicBuckets: true
-      }),
-      objectOwnership: s32.ObjectOwnership.BUCKET_OWNER_PREFERRED
-    });
-    Tags.of(this.logBucket).add("daily-backup", "true");
-    this.backupRole = this.createBackupRole(scope);
-    this.vault = new backup.BackupVault(scope, "BackupVault", {
-      backupVaultName: `${props.slug}-${props.appEnv}-daily-backup-vault`,
-      encryptionKey: props.kmsKey,
-      removalPolicy: RemovalPolicy3.DESTROY
-    });
-    this.backupPlan = backup.BackupPlan.daily35DayRetention(scope, "BackupPlan", this.vault);
-    this.backupPlan.addSelection("Selection", {
-      role: this.backupRole,
-      resources: [backup.BackupResource.fromTag("daily-backup", "true")]
-    });
-  }
-  createBackupRole(scope) {
-    const backupRole = new iam2.Role(scope, "BackupRole", {
-      assumedBy: new iam2.ServicePrincipal("backup.amazonaws.com")
-    });
-    backupRole.addToPolicy(new iam2.PolicyStatement({
-      actions: [
-        "s3:GetInventoryConfiguration",
-        "s3:PutInventoryConfiguration",
-        "s3:ListBucketVersions",
-        "s3:ListBucket",
-        "s3:GetBucketVersioning",
-        "s3:GetBucketNotification",
-        "s3:PutBucketNotification",
-        "s3:GetBucketLocation",
-        "s3:GetBucketTagging"
-      ],
-      resources: ["arn:aws:s3:::*"],
-      sid: "S3BucketBackupPermissions"
-    }));
-    backupRole.addToPolicy(new iam2.PolicyStatement({
-      actions: [
-        "s3:GetObjectAcl",
-        "s3:GetObject",
-        "s3:GetObjectVersionTagging",
-        "s3:GetObjectVersionAcl",
-        "s3:GetObjectTagging",
-        "s3:GetObjectVersion"
-      ],
-      resources: ["arn:aws:s3:::*/*"],
-      sid: "S3ObjectBackupPermissions"
-    }));
-    backupRole.addToPolicy(new iam2.PolicyStatement({
-      actions: ["s3:ListAllMyBuckets"],
-      resources: ["*"],
-      sid: "S3GlobalPermissions"
-    }));
-    backupRole.addToPolicy(new iam2.PolicyStatement({
-      actions: ["kms:Decrypt", "kms:DescribeKey"],
-      resources: ["*"],
-      sid: "KMSBackupPermissions",
-      conditions: {
-        StringLike: {
-          "kms:ViaService": "s3.*.amazonaws.com"
-        }
-      }
-    }));
-    backupRole.addToPolicy(new iam2.PolicyStatement({
-      actions: [
-        "events:DescribeRule",
-        "events:EnableRule",
-        "events:PutRule",
-        "events:DeleteRule",
-        "events:PutTargets",
-        "events:RemoveTargets",
-        "events:ListTargetsByRule",
-        "events:DisableRule"
-      ],
-      resources: ["arn:aws:events:*:*:rule/AwsBackupManagedRule*"],
-      sid: "EventsPermissions"
-    }));
-    backupRole.addToPolicy(new iam2.PolicyStatement({
-      actions: ["cloudwatch:GetMetricData", "events:ListRules"],
-      resources: ["*"],
-      sid: "EventsMetricsGlobalPermissions"
-    }));
-    return backupRole;
-  }
-}
-
-// src/cloud/security.ts
-import {config as config10} from "@stacksjs/config";
-import {Duration as Duration4, RemovalPolicy as RemovalPolicy4, Tags as Tags2, aws_certificatemanager as acm, aws_kms as kms, aws_wafv2 as wafv2} from "aws-cdk-lib";
-
-class SecurityStack {
-  firewall;
-  kmsKey;
-  certificate;
-  constructor(scope, props) {
-    const firewallOptions = config10.cloud.firewall;
-    if (!firewallOptions)
-      throw new Error("No firewall options found in config");
-    const options = {
-      defaultAction: { allow: {} },
-      scope: "CLOUDFRONT",
-      visibilityConfig: {
-        sampledRequestsEnabled: true,
-        cloudWatchMetricsEnabled: true,
-        metricName: "firewallMetric"
-      },
-      rules: this.getFirewallRules()
-    };
-    this.firewall = new wafv2.CfnWebACL(scope, "StacksWebFirewall", options);
-    Tags2.of(this.firewall).add("Name", "waf-cloudfront", { priority: 300 });
-    Tags2.of(this.firewall).add("Purpose", "CloudFront", { priority: 300 });
-    Tags2.of(this.firewall).add("CreatedBy", "CloudFormation", { priority: 300 });
-    this.kmsKey = new kms.Key(scope, "EncryptionKey", {
-      alias: "stacks-encryption-key",
-      description: "KMS key for Stacks Cloud",
-      enableKeyRotation: true,
-      removalPolicy: RemovalPolicy4.DESTROY,
-      pendingWindow: Duration4.days(30)
-    });
-    this.certificate = new acm.Certificate(scope, "Certificate", {
-      domainName: props.domain,
-      validation: acm.CertificateValidation.fromDns(props.zone),
-      subjectAlternativeNames: [`www.${props.domain}`, `api.${props.domain}`]
-    });
-  }
-  getFirewallRules() {
-    const rules = [];
-    const priorities = [];
-    if (config10.security.firewall?.countryCodes?.length) {
-      priorities.push(1);
-      rules.push({
-        name: "CountryRule",
-        priority: priorities.length,
-        statement: {
-          geoMatchStatement: {
-            countryCodes: config10.security.firewall.countryCodes
-          }
-        },
-        action: {
-          block: {}
-        },
-        visibilityConfig: {
-          sampledRequestsEnabled: true,
-          cloudWatchMetricsEnabled: true,
-          metricName: "CountryRule"
-        }
-      });
-    }
-    if (config10.security.firewall?.ipAddresses?.length) {
-      const ipSet = new wafv2.CfnIPSet(this, "IpSet", {
-        name: "IpSet",
-        description: "IP Set",
-        scope: "CLOUDFRONT",
-        addresses: config10.security.firewall.ipAddresses,
-        ipAddressVersion: "IPV4"
-      });
-      priorities.push(1);
-      rules.push({
-        name: "IpAddressRule",
-        priority: priorities.length,
-        statement: {
-          ipSetReferenceStatement: {
-            arn: ipSet.attrArn
-          }
-        },
-        action: {
-          block: {}
-        },
-        visibilityConfig: {
-          sampledRequestsEnabled: true,
-          cloudWatchMetricsEnabled: true,
-          metricName: "IpAddressRule"
-        }
-      });
-    }
-    if (config10.security.firewall?.httpHeaders?.length) {
-      config10.security.firewall.httpHeaders.forEach((header, index) => {
-        priorities.push(1);
-        rules.push({
-          name: `HttpHeaderRule${index}`,
-          priority: priorities.length,
-          statement: {
-            byteMatchStatement: {
-              fieldToMatch: {
-                singleHeader: {
-                  name: header
-                }
-              },
-              positionalConstraint: "EXACTLY",
-              searchString: "true",
-              textTransformations: [
-                {
-                  priority: index,
-                  type: "NONE"
-                }
-              ]
-            }
-          },
-          action: {
-            block: {}
-          },
-          visibilityConfig: {
-            sampledRequestsEnabled: true,
-            cloudWatchMetricsEnabled: true,
-            metricName: `HttpHeaderRule${index}`
-          }
-        });
-      });
-    }
-    return rules;
-  }
-}
-
-// src/cloud/deployment.ts
-import {AssetHashType as AssetHashType2, aws_s3_deployment as s3deploy} from "aws-cdk-lib";
-import {config as config12} from "@stacksjs/config";
-import {websiteSourceHash} from "@stacksjs/utils";
-
-class DeploymentStack {
-  privateSource;
-  docsSource;
-  websiteSource;
-  constructor(scope, props) {
-    this.privateSource = "../../private";
-    this.docsSource = "../docs/dist/";
-    this.websiteSource = config12.app.docMode === true ? this.docsSource : "../views/dist/";
-    new s3deploy.BucketDeployment(scope, "Website", {
-      sources: [s3deploy.Source.asset(this.websiteSource, {
-        assetHash: websiteSourceHash,
-        assetHashType: AssetHashType2.CUSTOM
-      })],
-      destinationBucket: props.publicBucket,
-      distribution: props.cdn,
-      distributionPaths: ["/*"]
-    });
-    new s3deploy.BucketDeployment(scope, "PrivateFiles", {
-      sources: [s3deploy.Source.asset(this.privateSource)],
-      destinationBucket: props.privateBucket
-    });
-  }
-}
-
-// src/cloud/jump-box.ts
-import {CfnOutput as Output5, aws_ec2 as ec2, aws_iam as iam3} from "aws-cdk-lib";
-
-class JumpBoxStack {
-  jumpBox;
-  constructor(scope, props) {
-    const role = new iam3.Role(scope, "JumpBoxInstanceRole", {
-      assumedBy: new iam3.ServicePrincipal("ec2.amazonaws.com"),
-      managedPolicies: [
-        iam3.ManagedPolicy.fromAwsManagedPolicyName("AmazonSSMManagedInstanceCore"),
-        iam3.ManagedPolicy.fromAwsManagedPolicyName("CloudWatchAgentServerPolicy")
-      ]
-    });
-    this.jumpBox = new ec2.Instance(scope, "JumpBox", {
-      vpc: props.vpc,
-      instanceType: ec2.InstanceType.of(ec2.InstanceClass.T2, ec2.InstanceSize.MICRO),
-      machineImage: new ec2.AmazonLinuxImage,
-      role,
-      userData: ec2.UserData.custom(`
-      #!/bin/bash
-      yum update -y
-      yum install -y amazon-efs-utils
-      yum install -y git
-      yum install -y https://s3.us-east-1.amazonaws.com/amazon-ssm-us-east-1/latest/linux_amd64/amazon-ssm-agent.rpm
-      mkdir /mnt/efs
-      mount -t efs ${props.fileSystem.fileSystemId}:/ /mnt/efs
-      git clone https://github.com/stacksjs/stacks.git /mnt/efs
-    `)
-    });
-    new Output5(scope, "JumpBoxInstanceId", {
-      value: this.jumpBox.instanceId,
-      description: "The ID of the EC2 instance that can be used to SSH into the Stacks Cloud."
-    });
-  }
-}
-
-// src/cloud/file-system.ts
-import {RemovalPolicy as RemovalPolicy5, aws_efs as efs} from "aws-cdk-lib";
-
-class FileSystemStack {
-  fileSystem;
-  accessPoint;
-  constructor(scope, props) {
-    this.fileSystem = new efs.FileSystem(scope, "FileSystem", {
-      fileSystemName: `${props.slug}-${props.appEnv}-efs`,
-      vpc: props.vpc,
-      removalPolicy: RemovalPolicy5.DESTROY,
-      lifecyclePolicy: efs.LifecyclePolicy.AFTER_7_DAYS,
-      performanceMode: efs.PerformanceMode.GENERAL_PURPOSE,
-      throughputMode: efs.ThroughputMode.BURSTING,
-      enableAutomaticBackups: true,
-      encrypted: true
-    });
-    this.accessPoint = new efs.AccessPoint(scope, "FileSystemAccessPoint", {
-      fileSystem: this.fileSystem,
-      path: "/",
-      posixUser: {
-        uid: "1000",
-        gid: "1000"
-      }
-    });
-  }
-}
-
-// src/cloud/network.ts
-import {aws_ec2 as ec22} from "aws-cdk-lib";
-
-class NetworkStack {
-  vpc;
-  constructor(scope, props) {
-    this.vpc = new ec22.Vpc(scope, "Network", {
-      vpcName: `${props.slug}-${props.appEnv}-vpc`,
-      ipAddresses: ec22.IpAddresses.cidr("10.0.0.0/16"),
-      maxAzs: 3,
-      natGateways: 0,
-      subnetConfiguration: [
-        {
-          name: "public-subnet-1",
-          subnetType: ec22.SubnetType.PUBLIC,
-          cidrMask: 24
-        },
-        {
-          name: "private-subnet-1",
-          subnetType: ec22.SubnetType.PRIVATE_ISOLATED,
-          cidrMask: 28
-        }
-      ]
-    });
-  }
-}
-
-// src/cloud/redirects.ts
-import {config as config14} from "@stacksjs/config";
-import {RemovalPolicy as RemovalPolicy6, aws_route53 as route533, aws_s3 as s33} from "aws-cdk-lib";
-
-class RedirectsStack {
-  redirectZones = [];
-  constructor(scope, props) {
-    config14.dns.redirects?.forEach((redirect) => {
-      const slug2 = redirect.split(".").map((part, index) => index === 0 ? part : part.charAt(0).toUpperCase() + part.slice(1)).join("");
-      const hostedZone = route533.HostedZone.fromLookup(scope, "HostedZone", { domainName: redirect });
-      const redirectBucket = new s33.Bucket(scope, `RedirectBucket${slug2}`, {
-        bucketName: `${redirect}-redirect`,
-        websiteRedirect: {
-          hostName: props.domain,
-          protocol: s33.RedirectProtocol.HTTPS
-        },
-        removalPolicy: RemovalPolicy6.DESTROY,
-        autoDeleteObjects: true
-      });
-      new route533.CnameRecord(scope, `RedirectRecord${slug2}`, {
-        zone: hostedZone,
-        recordName: "redirect",
-        domainName: redirectBucket.bucketWebsiteDomainName
-      });
-    });
-    config14.dns.redirects?.forEach((redirect) => {
-      const slug2 = redirect.split(".").map((part, index) => index === 0 ? part : part.charAt(0).toUpperCase() + part.slice(1)).join("");
-      const hostedZone = route533.HostedZone.fromLookup(scope, `RedirectHostedZone${slug2}`, { domainName: redirect });
-      this.redirectZones.push(hostedZone);
-    });
-  }
-}
-
-// src/cloud/email.ts
-import {Duration as Duration5, RemovalPolicy as RemovalPolicy7, Stack, Tags as Tags3, aws_iam as iam4, aws_lambda as lambda4, aws_route53 as route534, aws_s3 as s34, aws_s3_notifications as s3n, aws_ses as ses} from "aws-cdk-lib";
-import {config as config16} from "@stacksjs/config";
-
-class EmailStack {
-  emailBucket;
-  constructor(scope, props) {
-    const bucketPrefix = `${props.slug}-${props.appEnv}`;
-    this.emailBucket = new s34.Bucket(scope, "EmailBucket", {
-      bucketName: `${bucketPrefix}-email-${props.timestamp}`,
-      versioned: true,
-      removalPolicy: RemovalPolicy7.DESTROY,
-      autoDeleteObjects: true,
-      encryption: s34.BucketEncryption.S3_MANAGED,
-      lifecycleRules: [
-        {
-          id: "24h",
-          enabled: true,
-          expiration: Duration5.days(1),
-          noncurrentVersionExpiration: Duration5.days(1),
-          prefix: "today/"
-        },
-        {
-          id: "Intelligent transition for Inbox",
-          enabled: true,
-          prefix: "inbox/",
-          transitions: [
-            {
-              storageClass: s34.StorageClass.INTELLIGENT_TIERING,
-              transitionAfter: Duration5.days(0)
-            }
-          ]
-        },
-        {
-          id: "Intelligent transition for Sent",
-          enabled: true,
-          prefix: "sent/",
-          transitions: [
-            {
-              storageClass: s34.StorageClass.INTELLIGENT_TIERING,
-              transitionAfter: Duration5.days(0)
-            }
-          ]
-        }
-      ]
-    });
-    Tags3.of(this.emailBucket).add("daily-backup", "true");
-    const sesPrincipal = new iam4.ServicePrincipal("ses.amazonaws.com");
-    const ruleSetName = `${props.slug}-${props.appEnv}-email-receipt-rule-set`;
-    const receiptRuleName = `${props.slug}-${props.appEnv}-email-receipt-rule`;
-    const ruleSet = new ses.CfnReceiptRuleSet(scope, "SESReceiptRuleSet", {
-      ruleSetName
-    });
-    this.emailBucket.addToResourcePolicy(new iam4.PolicyStatement({
-      sid: "AllowSESPuts",
-      effect: iam4.Effect.ALLOW,
-      principals: [sesPrincipal],
-      actions: [
-        "s3:PutObject"
-      ],
-      resources: [
-        `${this.emailBucket.bucketArn}/*`
-      ],
-      conditions: {
-        StringEquals: {
-          "aws:SourceAccount": Stack.of(scope).account
-        },
-        ArnLike: {
-          "aws:SourceArn": `arn:aws:ses:${Stack.of(scope).region}:${Stack.of(scope).account}:receipt-rule-set/${ruleSetName}:receipt-rule/${receiptRuleName}`
-        }
-      }
-    }));
-    const receiptRule = new ses.CfnReceiptRule(scope, "SESReceiptRule", {
-      ruleSetName: ruleSet.ref,
-      rule: {
-        name: receiptRuleName,
-        enabled: true,
-        actions: [
-          {
-            s3Action: {
-              bucketName: this.emailBucket.bucketName,
-              objectKeyPrefix: "tmp/email_in/"
-            }
-          }
-        ],
-        recipients: config16.email.mailboxes || [],
-        scanEnabled: config16.email.server?.scan || true,
-        tlsPolicy: "Require"
-      }
-    });
-    receiptRule.node.addDependency(this.emailBucket);
-    const iamGroup = new iam4.Group(scope, "IAMGroup", {
-      groupName: `${props.slug}-${props.appEnv}-email-management-s3-group`
-    });
-    const listBucketsPolicyStatement = new iam4.PolicyStatement({
-      effect: iam4.Effect.ALLOW,
-      actions: ["s3:ListAllMyBuckets"],
-      resources: ["*"]
-    });
-    const policyStatement = new iam4.PolicyStatement({
-      effect: iam4.Effect.ALLOW,
-      actions: [
-        "s3:ListBucket",
-        "s3:GetObject",
-        "s3:PutObject",
-        "s3:DeleteObject",
-        "s3:GetObjectAcl",
-        "s3:GetObjectVersionAcl",
-        "s3:PutObjectAcl",
-        "s3:PutObjectVersionAcl"
-      ],
-      resources: [
-        this.emailBucket.bucketArn,
-        `${this.emailBucket.bucketArn}/*`
-      ]
-    });
-    const policy = new iam4.Policy(scope, "EmailAccessPolicy", {
-      policyName: `${props.slug}-${props.appEnv}-email-management-s3-policy`,
-      statements: [policyStatement, listBucketsPolicyStatement]
-    });
-    iamGroup.attachInlinePolicy(policy);
-    const sesIdentity = new ses.CfnEmailIdentity(scope, "DomainIdentity", {
-      emailIdentity: props.domain,
-      dkimSigningAttributes: {
-        nextSigningKeyLength: "RSA_2048_BIT"
-      },
-      dkimAttributes: {
-        signingEnabled: true
-      },
-      mailFromAttributes: {
-        behaviorOnMxFailure: "USE_DEFAULT_VALUE",
-        mailFromDomain: `mail.${props.domain}`
-      },
-      feedbackAttributes: {
-        emailForwardingEnabled: true
-      }
-    });
-    new route534.CfnRecordSet(scope, "DkimRecord1", {
-      hostedZoneName: `${props.zone.zoneName}.`,
-      name: sesIdentity.attrDkimDnsTokenName1,
-      type: "CNAME",
-      resourceRecords: [sesIdentity.attrDkimDnsTokenValue1],
-      ttl: "1800"
-    });
-    new route534.CfnRecordSet(scope, "DkimRecord2", {
-      hostedZoneName: `${props.zone.zoneName}.`,
-      name: sesIdentity.attrDkimDnsTokenName2,
-      type: "CNAME",
-      resourceRecords: [sesIdentity.attrDkimDnsTokenValue2],
-      ttl: "1800"
-    });
-    new route534.CfnRecordSet(scope, "DkimRecord3", {
-      hostedZoneName: `${props.zone.zoneName}.`,
-      name: sesIdentity.attrDkimDnsTokenName3,
-      type: "CNAME",
-      resourceRecords: [sesIdentity.attrDkimDnsTokenValue3],
-      ttl: "1800"
-    });
-    new route534.MxRecord(scope, "MxRecord", {
-      zone: props.zone,
-      recordName: "mail",
-      values: [{
-        priority: 10,
-        hostName: "feedback-smtp.us-east-1.amazonses.com"
-      }]
-    });
-    new route534.TxtRecord(scope, "TxtSpfRecord", {
-      zone: props.zone,
-      recordName: "mail",
-      values: ["v=spf1 include:amazonses.com ~all"]
-    });
-    new route534.TxtRecord(scope, "TxtDmarcRecord", {
-      zone: props.zone,
-      recordName: "_dmarc",
-      values: [`v=DMARC1;p=quarantine;pct=25;rua=mailto:dmarcreports@${props.domain}`]
-    });
-    const lambdaEmailOutboundRole = new iam4.Role(scope, "LambdaEmailOutboundRole", {
-      roleName: `${props.slug}-${props.appEnv}-email-outbound`,
-      assumedBy: new iam4.ServicePrincipal("lambda.amazonaws.com"),
-      managedPolicies: [
-        iam4.ManagedPolicy.fromAwsManagedPolicyName("service-role/AWSLambdaBasicExecutionRole")
-      ]
-    });
-    const lambdaEmailOutbound = new lambda4.Function(scope, "LambdaEmailOutbound", {
-      functionName: `${props.slug}-${props.appEnv}-email-outbound`,
-      description: "Take the JSON and convert it in to an raw email.",
-      code: lambda4.Code.fromInline("exports.handler = async (event) => {return true;};"),
-      handler: "index.handler",
-      memorySize: 256,
-      runtime: lambda4.Runtime.NODEJS_18_X,
-      timeout: Duration5.seconds(60),
-      environment: {
-        BUCKET: this.emailBucket.bucketName
-      },
-      role: lambdaEmailOutboundRole
-    });
-    lambdaEmailOutboundRole.addToPolicy(policyStatement);
-    const sesPolicyStatement = new iam4.PolicyStatement({
-      effect: iam4.Effect.ALLOW,
-      actions: ["ses:SendRawEmail"],
-      resources: ["*"]
-    });
-    lambdaEmailOutboundRole.addToPolicy(sesPolicyStatement);
-    const lambdaEmailInboundRole = new iam4.Role(scope, "LambdaEmailInboundRole", {
-      roleName: `${props.slug}-${props.appEnv}-email-inbound`,
-      assumedBy: new iam4.ServicePrincipal("lambda.amazonaws.com"),
-      managedPolicies: [
-        iam4.ManagedPolicy.fromAwsManagedPolicyName("service-role/AWSLambdaBasicExecutionRole")
-      ]
-    });
-    const lambdaEmailInbound = new lambda4.Function(scope, "LambdaEmailInbound", {
-      functionName: `${props.slug}-${props.appEnv}-email-inbound`,
-      description: "This Lambda organizes all the incoming emails based on the From and To field.",
-      code: lambda4.Code.fromInline("exports.handler = async (event) => {return true;};"),
-      handler: "index.handler",
-      memorySize: 256,
-      role: lambdaEmailInboundRole,
-      runtime: lambda4.Runtime.NODEJS_18_X,
-      timeout: Duration5.seconds(60),
-      environment: {
-        BUCKET: this.emailBucket.bucketName
-      }
-    });
-    new lambda4.CfnPermission(scope, "S3InboundPermission", {
-      action: "lambda:InvokeFunction",
-      functionName: lambdaEmailInbound.functionName,
-      principal: "s3.amazonaws.com"
-    });
-    const inboundS3PolicyStatement = new iam4.PolicyStatement({
-      effect: iam4.Effect.ALLOW,
-      actions: ["s3:*"],
-      resources: [
-        this.emailBucket.bucketArn,
-        `${this.emailBucket.bucketArn}/*`
-      ]
-    });
-    lambdaEmailInboundRole.addToPolicy(inboundS3PolicyStatement);
-    const sesInboundPolicyStatement = new iam4.PolicyStatement({
-      effect: iam4.Effect.ALLOW,
-      actions: ["ses:ListIdentities"],
-      resources: ["*"]
-    });
-    lambdaEmailInboundRole.addToPolicy(sesInboundPolicyStatement);
-    const lambdaEmailConverterRole = new iam4.Role(scope, "LambdaEmailConverterRole", {
-      roleName: `${props.slug}-${props.appEnv}-email-converter`,
-      assumedBy: new iam4.ServicePrincipal("lambda.amazonaws.com"),
-      managedPolicies: [
-        iam4.ManagedPolicy.fromAwsManagedPolicyName("service-role/AWSLambdaBasicExecutionRole")
-      ]
-    });
-    const lambdaEmailConverter = new lambda4.Function(scope, "LambdaEmailConverter", {
-      functionName: `${props.slug}-${props.appEnv}-email-converter`,
-      description: "This Lambda converts raw emails files in to HTML and text.",
-      code: lambda4.Code.fromInline('exports.handler = async (event) => {console.log("hello world email converter");return true;};'),
-      handler: "index.handler",
-      memorySize: 256,
-      role: lambdaEmailConverterRole,
-      runtime: lambda4.Runtime.NODEJS_18_X,
-      timeout: Duration5.seconds(60),
-      environment: {
-        BUCKET: this.emailBucket.bucketName
-      }
-    });
-    const converterS3PolicyStatement = new iam4.PolicyStatement({
-      effect: iam4.Effect.ALLOW,
-      actions: ["s3:*"],
-      resources: [
-        this.emailBucket.bucketArn,
-        `${this.emailBucket.bucketArn}/*`
-      ]
-    });
-    new lambda4.CfnPermission(scope, "S3ConverterPermission", {
-      action: "lambda:InvokeFunction",
-      functionName: lambdaEmailConverter.functionName,
-      principal: "s3.amazonaws.com"
-    });
-    lambdaEmailConverterRole.addToPolicy(converterS3PolicyStatement);
-    this.emailBucket.addEventNotification(s34.EventType.OBJECT_CREATED_PUT, new s3n.LambdaDestination(lambdaEmailInbound), { prefix: "tmp/email_in/" });
-    this.emailBucket.addEventNotification(s34.EventType.OBJECT_CREATED_PUT, new s3n.LambdaDestination(lambdaEmailOutbound), { prefix: "tmp/email_out/json/" });
-    this.emailBucket.addEventNotification(s34.EventType.OBJECT_CREATED_COPY, new s3n.LambdaDestination(lambdaEmailConverter), { prefix: "sent/" });
-    this.emailBucket.addEventNotification(s34.EventType.OBJECT_CREATED_COPY, new s3n.LambdaDestination(lambdaEmailConverter), { prefix: "inbox/" });
-    this.emailBucket.addEventNotification(s34.EventType.OBJECT_CREATED_COPY, new s3n.LambdaDestination(lambdaEmailConverter), { prefix: "today/" });
-  }
-}
-
-// src/cloud/permissions.ts
-import {SecretValue, aws_iam as iam5} from "aws-cdk-lib";
-import {config as config18} from "@stacksjs/config";
-import {string} from "@stacksjs/strings";
-import {env as env4} from "@stacksjs/env";
-
-class PermissionsStack {
-  constructor(scope) {
-    const teamName = config18.team.name;
-    const users = config18.team.members;
-    const password = env4.AWS_DEFAULT_PASSWORD || string.random();
-    for (const name in users) {
-      const id = `User${string.pascalCase(teamName)}${string.pascalCase(name)}`;
-      const userName = string.slug(`${teamName}-${name}`);
-      const user = new iam5.User(scope, id, {
-        userName,
-        password: SecretValue.unsafePlainText(password),
-        passwordResetRequired: true
-      });
-      user.addManagedPolicy(iam5.ManagedPolicy.fromAwsManagedPolicyName("AdministratorAccess"));
-    }
-  }
-}
-
-// src/cloud/compute.ts
-import {Duration as Duration6, CfnOutput as Output6, RemovalPolicy as RemovalPolicy8, aws_ec2 as ec23, aws_ecs as ecs, aws_route53 as route535, aws_route53_targets as route53Targets, aws_secretsmanager as secretsmanager} from "aws-cdk-lib";
-import {path as p4} from "@stacksjs/path";
-import {env as env6} from "@stacksjs/env";
-import {LogGroup} from "aws-cdk-lib/aws-logs";
-import * as elbv2 from "aws-cdk-lib/aws-elasticloadbalancingv2";
-
-class ComputeStack {
-  lb;
-  cluster;
-  taskDefinition;
-  constructor(scope, props) {
-    const vpc = props.vpc;
-    const fileSystem = props.fileSystem;
-    if (!fileSystem)
-      throw new Error("The file system is missing. Please make sure it was created properly.");
-    this.cluster = new ecs.Cluster(scope, "StacksCluster", {
-      clusterName: `${props.slug}-${props.appEnv}-web-server-cluster`,
-      vpc
-    });
-    this.taskDefinition = new ecs.FargateTaskDefinition(scope, "TaskDefinition", {
-      family: `${props.appName}-${props.appEnv}-api`,
-      memoryLimitMiB: 512,
-      cpu: 256,
-      runtimePlatform: {
-        cpuArchitecture: ecs.CpuArchitecture.ARM64
-      }
-    });
-    const container = this.taskDefinition.addContainer("WebServerContainer", {
-      containerName: `${props.appName}-${props.appEnv}-api`,
-      image: ecs.ContainerImage.fromAsset(p4.frameworkPath("server")),
-      logging: new ecs.AwsLogDriver({
-        streamPrefix: `${props.appName}-${props.appEnv}-web-server-logs`,
-        logGroup: new LogGroup(scope, "StacksApiLogs", {
-          logGroupName: "/aws/ecs/stacks-api",
-          removalPolicy: RemovalPolicy8.DESTROY
-        })
-      }),
-      healthCheck: {
-        command: ["CMD-SHELL", "curl -f http://localhost:3000/api/health || exit 1"],
-        interval: Duration6.seconds(10),
-        timeout: Duration6.seconds(5),
-        retries: 3,
-        startPeriod: Duration6.seconds(10)
-      }
-    });
-    container.addPortMappings({
-      containerPort: 3000,
-      hostPort: 3000
-    });
-    const serviceSecurityGroup = new ec23.SecurityGroup(scope, "ServiceSecurityGroup", {
-      securityGroupName: `${props.appName}-${props.appEnv}-api-service-sg`,
-      vpc,
-      description: "Stacks Security Group for API Service"
-    });
-    const publicLoadBalancerSG = new ec23.SecurityGroup(scope, "PublicLoadBalancerSG", {
-      securityGroupName: `${props.appName}-${props.appEnv}-public-load-balancer-sg`,
-      vpc,
-      description: "Access to the public facing load balancer"
-    });
-    serviceSecurityGroup.addIngressRule(publicLoadBalancerSG, ec23.Port.allTraffic(), "Ingress from the public ALB");
-    this.lb = new elbv2.ApplicationLoadBalancer(scope, "ApplicationLoadBalancer", {
-      http2Enabled: true,
-      loadBalancerName: `${props.appName}-${props.appEnv}-alb`,
-      vpc,
-      vpcSubnets: {
-        subnets: vpc.selectSubnets({
-          subnetType: ec23.SubnetType.PUBLIC,
-          onePerAz: true
-        }).subnets
-      },
-      internetFacing: true,
-      idleTimeout: Duration6.seconds(30),
-      securityGroup: publicLoadBalancerSG
-    });
-    new route535.ARecord(scope, "ApiDomainAliasRecord", {
-      zone: props.zone,
-      recordName: "api",
-      target: route535.RecordTarget.fromAlias(new route53Targets.LoadBalancerTarget(this.lb))
-    });
-    const serviceTargetGroup = new elbv2.ApplicationTargetGroup(scope, "ServiceTargetGroup", {
-      targetGroupName: `${props.appName}-${props.appEnv}-api-tg`,
-      vpc,
-      targetType: elbv2.TargetType.IP,
-      protocol: elbv2.ApplicationProtocol.HTTP,
-      port: 3000,
-      healthCheck: {
-        interval: Duration6.seconds(6),
-        path: "/api/health",
-        protocol: elbv2.Protocol.HTTP,
-        timeout: Duration6.seconds(5),
-        healthyThresholdCount: 2,
-        unhealthyThresholdCount: 10
-      }
-    });
-    const service = new ecs.FargateService(scope, "StacksApiService", {
-      serviceName: `${props.appName}-${props.appEnv}-api-service`,
-      cluster: this.cluster,
-      taskDefinition: this.taskDefinition,
-      desiredCount: 1,
-      assignPublicIp: true,
-      maxHealthyPercent: 200,
-      vpcSubnets: vpc.selectSubnets({
-        subnetType: ec23.SubnetType.PUBLIC,
-        onePerAz: true
-      }),
-      minHealthyPercent: 75,
-      securityGroups: [serviceSecurityGroup]
-    });
-    service.attachToApplicationTargetGroup(serviceTargetGroup);
-    publicLoadBalancerSG.addIngressRule(ec23.Peer.anyIpv4(), ec23.Port.allTraffic());
-    this.lb.addListener("HttpsListener", {
-      port: 443,
-      certificates: [props.certificate],
-      defaultAction: elbv2.ListenerAction.forward([serviceTargetGroup])
-    });
-    this.lb.addListener("HttpListener", {
-      port: 80,
-      defaultAction: elbv2.ListenerAction.forward([serviceTargetGroup])
-    });
-    props.fileSystem.connections.allowFromAnyIpv4(ec23.Port.tcp(2049));
-    const volumeName = `${props.slug}-${props.appEnv}-efs`;
-    this.taskDefinition.addVolume({
-      name: volumeName,
-      efsVolumeConfiguration: {
-        fileSystemId: props.fileSystem.fileSystemId
-      }
-    });
-    container.addMountPoints({
-      sourceVolume: volumeName,
-      containerPath: "/mnt/efs",
-      readOnly: false
-    });
-    const scaling = service.autoScaleTaskCount({ maxCapacity: 2 });
-    scaling.scaleOnCpuUtilization("CpuScaling", {
-      targetUtilizationPercent: 50,
-      scaleInCooldown: Duration6.seconds(60),
-      scaleOutCooldown: Duration6.seconds(60)
-    });
-    scaling.scaleOnMemoryUtilization("MemoryScaling", {
-      targetUtilizationPercent: 60,
-      scaleInCooldown: Duration6.seconds(60),
-      scaleOutCooldown: Duration6.seconds(60)
-    });
-    const keysToRemove = ["_HANDLER", "_X_AMZN_TRACE_ID", "AWS_REGION", "AWS_EXECUTION_ENV", "AWS_LAMBDA_FUNCTION_NAME", "AWS_LAMBDA_FUNCTION_MEMORY_SIZE", "AWS_LAMBDA_FUNCTION_VERSION", "AWS_LAMBDA_INITIALIZATION_TYPE", "AWS_LAMBDA_LOG_GROUP_NAME", "AWS_LAMBDA_LOG_STREAM_NAME", "AWS_ACCESS_KEY", "AWS_ACCESS_KEY_ID", "AWS_SECRET_ACCESS_KEY", "AWS_SESSION_TOKEN", "AWS_LAMBDA_RUNTIME_API", "LAMBDA_TASK_ROOT", "LAMBDA_RUNTIME_DIR", "_"];
-    keysToRemove.forEach((key) => delete env6[key]);
-    const secrets = new secretsmanager.Secret(scope, "StacksSecrets", {
-      secretName: `${props.slug}-${props.appEnv}-secrets`,
-      description: "Secrets for the Stacks application",
-      generateSecretString: {
-        secretStringTemplate: JSON.stringify(env6),
-        generateStringKey: Object.keys(env6).join(",").length.toString()
-      }
-    });
-    secrets.grantRead(service.taskDefinition.executionRole);
-    container.addEnvironment("SECRETS_ARN", secrets.secretArn);
-    const apiPrefix = "api";
-    new Output6(scope, "ApiUrl", {
-      value: `https://${props.domain}/${apiPrefix}`,
-      description: "The URL of the deployed application"
-    });
-    new Output6(scope, "ApiVanityUrl", {
-      value: `http://${this.lb.loadBalancerDnsName}`,
-      description: "The Vanity URL / DNS name of the load balancer"
-    });
-  }
-}
-
-// src/cloud/queue.ts
-import {aws_ec2 as ec24} from "aws-cdk-lib";
-import {pascalCase, slug as slug2} from "@stacksjs/strings";
-import {fs} from "@stacksjs/storage";
-import {path as path6} from "@stacksjs/path";
-import {Rule, Schedule} from "aws-cdk-lib/aws-events";
-import {EcsTask} from "aws-cdk-lib/aws-events-targets";
-
-class QueueStack {
-  scope;
-  props;
-  constructor(scope, props) {
-    this.scope = scope;
-    this.props = props;
-  }
-  async init() {
-    const jobsDir = path6.jobsPath();
-    const actionsDir = path6.appPath("Actions");
-    const jobFiles = await fs.readdir(jobsDir);
-    const actionFiles = await fs.readdir(actionsDir);
-    const jobs = [];
-    for (const file of jobFiles) {
-      if (!file.endsWith(".ts"))
-        continue;
-      const jobPath = path6.jobsPath(file);
-      const job = await this.loadModule(jobPath);
-      this.createQueueRule(job, file);
-      jobs.push(job);
-    }
-    for (const file of actionFiles) {
-      if (!file.endsWith(".ts"))
-        continue;
-      const actionPath = path6.appPath(`Actions/${file}`);
-      const action = await this.loadModule(actionPath);
-      this.createQueueRule(action, file);
-      jobs.push(action);
-    }
-  }
-  cronScheduleFromRate(rate) {
-    const parts = rate.split(" ");
-    return {
-      minute: parts[0],
-      hour: parts[1],
-      month: parts[2],
-      weekDay: parts[3],
-      year: parts[4]
-    };
-  }
-  async loadModule(filePath) {
-    const jobModule = await import(filePath);
-    return jobModule;
-  }
-  createQueueRule(module, file) {
-    const rate = module.default?.rate;
-    if (!rate || module.default?.enabled === false)
-      return;
-    const schedule = Schedule.cron(this.cronScheduleFromRate(rate));
-    const id = `QueueRule${pascalCase(file.replace(".ts", ""))}`;
-    const rule = new Rule(this.scope, id, {
-      ruleName: `${this.props.appName}-${this.props.appEnv}-queue-rule-${slug2(file.replace(".ts", ""))}`,
-      schedule
-    });
-    rule.addTarget(new EcsTask({
-      cluster: this.props.cluster,
-      taskDefinition: this.props.taskDefinition,
-      containerOverrides: [
-        {
-          containerName: `${this.props.appName}-${this.props.appEnv}-api`,
-          environment: [
-            {
-              name: "QUEUE_WORKER",
-              value: "true"
-            },
-            {
-              name: "JOB",
-              value: file
-            },
-            {
-              name: "JOB_BACKOFF_FACTOR",
-              value: module.default?.backoffFactor
-            },
-            {
-              name: "JOB_RETRIES",
-              value: module.default?.tries
-            },
-            {
-              name: "JOB_INITIAL_DELAY",
-              value: module.default?.initialDelay
-            },
-            {
-              name: "JOB_JITTER",
-              value: module.default?.jitter
-            }
-          ]
-        }
-      ],
-      retryAttempts: 1,
-      subnetSelection: {
-        subnetType: ec24.SubnetType.PUBLIC
-      }
-    }));
-  }
-}
-
-// src/cloud/index.ts
-class Cloud extends Stack2 {
-  dns;
-  security;
-  storage;
-  network;
-  fileSystem;
-  jumpBox;
-  docs;
-  email;
-  redirects;
-  permissions;
-  ai;
-  cli;
-  api;
-  cdn;
-  queue;
-  deployment;
-  scope;
-  props;
-  constructor(scope, id, props) {
-    super(scope, id, props);
-    this.scope = scope;
-    this.props = props;
-    this.dns = new DnsStack(this, props);
-    this.security = new SecurityStack(this, {
-      ...props,
-      zone: this.dns.zone
-    });
-    this.storage = new StorageStack(this, {
-      ...props,
-      kmsKey: this.security.kmsKey
-    });
-    this.network = new NetworkStack(this, props);
-    this.fileSystem = new FileSystemStack(this, {
-      ...props,
-      vpc: this.network.vpc
-    });
-    this.jumpBox = new JumpBoxStack(this, {
-      ...props,
-      vpc: this.network.vpc,
-      fileSystem: this.fileSystem.fileSystem
-    });
-    this.docs = new DocsStack(this, props);
-    this.email = new EmailStack(this, {
-      ...props,
-      zone: this.dns.zone
-    });
-    this.redirects = new RedirectsStack(this, props);
-    this.permissions = new PermissionsStack(this);
-    this.ai = new AiStack(this, props);
-    this.cli = new CliStack(this, props);
-  }
-  async init() {
-    if (config20.cloud.api?.deploy) {
-      const props = this.props;
-      this.api = new ComputeStack(this, {
-        ...props,
-        vpc: this.network.vpc,
-        fileSystem: this.fileSystem.fileSystem,
-        zone: this.dns.zone,
-        certificate: this.security.certificate
-      });
-      this.queue = new QueueStack(this, {
-        ...props,
-        cluster: this.api.cluster,
-        taskDefinition: this.api.taskDefinition
-      });
-      await this.queue.init();
-      this.cdn = new CdnStack(this, {
-        ...props,
-        publicBucket: this.storage.publicBucket,
-        logBucket: this.storage.logBucket,
-        certificate: this.security.certificate,
-        firewall: this.security.firewall,
-        originRequestFunction: this.docs.originRequestFunction,
-        zone: this.dns.zone,
-        cliSetupUrl: this.cli.cliSetupUrl,
-        askAiUrl: this.ai.askAiUrl,
-        summarizeAiUrl: this.ai.summarizeAiUrl,
-        lb: this.api?.lb
-      });
-      this.deployment = new DeploymentStack(this, {
-        ...props,
-        publicBucket: this.storage.publicBucket,
-        privateBucket: this.storage.privateBucket,
-        cdn: this.cdn.distribution
-      });
-    }
-  }
-}
-export {
-  purchaseDomain,
-  isFirstDeployment,
-  isFailedState,
-  hasBeenDeployed,
-  getSecurityGroupId,
-  getSecurityGroupFromInstanceId,
-  getOrCreateTimestamp,
-  getJumpBoxSecurityGroupName,
-  getJumpBoxInstanceProfileName,
-  getJumpBoxInstanceId,
-  deleteStacksFunctions,
-  deleteStacksBuckets,
-  deleteParameterStore,
-  deleteLogGroups,
-  deleteJumpBox,
-  deleteIamUsers,
-  deleteEc2Instance,
-  deleteCdkRemnants,
-  addJumpBox,
-  InstanceType,
-  Cloud
-};