diff --git a/.changeset/kind-coats-poke.md b/.changeset/kind-coats-poke.md
new file mode 100644
index 00000000000..4bf75f6de07
--- /dev/null
+++ b/.changeset/kind-coats-poke.md
@@ -0,0 +1,5 @@
+---
+'hive': minor
+---
+
+Add AWS Lambda CDN Artifact Handler.
diff --git a/.github/workflows/build-and-dockerize.yaml b/.github/workflows/build-and-dockerize.yaml
index 48027d66261..9f197a6dbc7 100644
--- a/.github/workflows/build-and-dockerize.yaml
+++ b/.github/workflows/build-and-dockerize.yaml
@@ -79,6 +79,7 @@ jobs:
           files:
             packages/services/broker-worker/dist/index.worker.mjs
             packages/services/cdn-worker/dist/index.worker.mjs
+            packages/services/cdn-worker/dist/index.lambda.mjs
           dest: ${{ inputs.imageTag }}.zip
 
       - name: upload artifact
diff --git a/deployment/index.ts b/deployment/index.ts
index 159e2cce5d4..6c1a3aa29fe 100644
--- a/deployment/index.ts
+++ b/deployment/index.ts
@@ -1,5 +1,6 @@
 import * as pulumi from '@pulumi/pulumi';
 import { deployApp } from './services/app';
+import { deployAWSArtifactsLambdaFunction } from './services/aws-artifacts-lambda-function';
 import { deployCFBroker } from './services/cf-broker';
 import { deployCFCDN } from './services/cf-cdn';
 import { deployClickhouse } from './services/clickhouse';
@@ -89,6 +90,11 @@ const cdn = deployCFCDN({
   environment,
 });
 
+const lambdaFunction = deployAWSArtifactsLambdaFunction({
+  s3Mirror,
+  environment,
+});
+
 const broker = deployCFBroker({
   environment,
   sentry,
@@ -346,3 +352,4 @@ export const webhooksApiServiceId = webhooks.service.id;
 export const appId = app.deployment.id;
 export const otelCollectorId = otelCollector.deployment.id;
 export const publicIp = proxy.get()!.status.loadBalancer.ingress[0].ip;
+export const awsLambdaArtifactsFunctionUrl = lambdaFunction;
diff --git a/deployment/package.json b/deployment/package.json
index a2bd4480743..45b73920d92 100644
--- a/deployment/package.json
+++ b/deployment/package.json
@@ -10,6 +10,7 @@
   "dependencies": {
     "@lbrlabs/pulumi-grafana": "0.1.0",
     "@manypkg/get-packages": "2.2.2",
+    "@pulumi/aws": "7.12.0",
     "@pulumi/cloudflare": "4.16.0",
     "@pulumi/command": "1.0.1",
     "@pulumi/kubernetes": "4.23.0",
diff --git a/deployment/services/aws-artifacts-lambda-function.ts b/deployment/services/aws-artifacts-lambda-function.ts
new file mode 100644
index 00000000000..ef9074c676b
--- /dev/null
+++ b/deployment/services/aws-artifacts-lambda-function.ts
@@ -0,0 +1,74 @@
+import { readFileSync } from 'node:fs';
+import { resolve } from 'node:path';
+import * as aws from '@pulumi/aws';
+import * as pulumi from '@pulumi/pulumi';
+import { Environment } from './environment';
+import { S3 } from './s3';
+
+export function deployAWSArtifactsLambdaFunction(args: {
+  environment: Environment;
+  /** Note: We run this mirror only on the AWS S3 Bucket on purpose. */
+  s3Mirror: S3;
+}) {
+  const lambdaRole = new aws.iam.Role('awsLambdaArtifactsHandlerRole', {
+    assumeRolePolicy: {
+      Version: '2012-10-17',
+      Statement: [
+        {
+          Effect: 'Allow',
+          Principal: { Service: 'lambda.amazonaws.com' },
+          Action: 'sts:AssumeRole',
+        },
+      ],
+    },
+  });
+
+  new aws.iam.RolePolicyAttachment('lambdaBasicExecution', {
+    role: lambdaRole.name,
+    policyArn: aws.iam.ManagedPolicy.AWSLambdaBasicExecutionRole,
+  });
+
+  const awsLambdaArtifactsHandler = new aws.lambda.Function('awsLambdaArtifactsHandler', {
+    name: `hive-artifacts-handler-${args.environment.envName}`,
+    runtime: aws.lambda.Runtime.NodeJS22dX,
+    handler: 'index.handler',
+    packageType: 'Zip',
+    architectures: ['arm64'],
+    code: new pulumi.asset.AssetArchive({
+      'index.mjs': new pulumi.asset.StringAsset(
+        readFileSync(
+          process.env.AWS_LAMBDA_ARTIFACT_PATH ||
+            resolve(__dirname, '../../packages/services/cdn-worker/dist/index.lambda.mjs'),
+          'utf-8',
+        ),
+      ),
+    }),
+    role: lambdaRole.arn,
+    region: 'us-east-2',
+    environment: {
+      variables: {
+        // This could be done better with secrets manager etc.
+        // But it adds a lot of complexity and overhead and runtime logic
+        AWS_S3_ENDPOINT: args.s3Mirror.secret.raw.endpoint,
+        AWS_S3_BUCKET_NAME: args.s3Mirror.secret.raw.bucket,
+        AWS_S3_ACCESS_KEY_ID: args.s3Mirror.secret.raw.accessKeyId,
+        AWS_S3_ACCESSS_KEY_SECRET: args.s3Mirror.secret.raw.secretAccessKey,
+      },
+    },
+    // 448mb
+    memorySize: 448,
+    // 10 seconds
+    timeout: 10,
+  });
+
+  const example = new aws.lambda.FunctionUrl('awsLambdaArtifactsHandlerUrl', {
+    functionName: awsLambdaArtifactsHandler.arn,
+    authorizationType: 'NONE',
+    invokeMode: 'BUFFERED',
+    region: 'us-east-2',
+  });
+
+  return {
+    functionUrl: example.functionUrl,
+  };
+}
diff --git a/packages/libraries/core/package.json b/packages/libraries/core/package.json
index 0242680b775..12586fde199 100644
--- a/packages/libraries/core/package.json
+++ b/packages/libraries/core/package.json
@@ -48,7 +48,7 @@
   "dependencies": {
     "@graphql-hive/signal": "^2.0.0",
     "@graphql-tools/utils": "^10.0.0",
-    "@whatwg-node/fetch": "^0.10.6",
+    "@whatwg-node/fetch": "^0.10.13",
     "async-retry": "^1.3.3",
     "events": "^3.3.0",
     "js-md5": "0.8.3",
diff --git a/packages/libraries/yoga/package.json b/packages/libraries/yoga/package.json
index 1f961b918d9..0b88b44eb1b 100644
--- a/packages/libraries/yoga/package.json
+++ b/packages/libraries/yoga/package.json
@@ -56,7 +56,7 @@
     "@graphql-yoga/plugin-disable-introspection": "2.7.0",
     "@graphql-yoga/plugin-graphql-sse": "3.7.0",
     "@graphql-yoga/plugin-response-cache": "3.9.0",
-    "@whatwg-node/fetch": "0.10.6",
+    "@whatwg-node/fetch": "0.10.13",
     "graphql-ws": "5.16.1",
     "graphql-yoga": "5.13.3",
     "nock": "14.0.10",
diff --git a/packages/migrations/package.json b/packages/migrations/package.json
index 81fa5b4bf89..482860bdf0b 100644
--- a/packages/migrations/package.json
+++ b/packages/migrations/package.json
@@ -21,7 +21,7 @@
     "@types/bcryptjs": "2.4.6",
     "@types/node": "22.10.5",
     "@types/pg": "8.11.10",
-    "@whatwg-node/fetch": "0.10.6",
+    "@whatwg-node/fetch": "0.10.13",
     "bcryptjs": "2.4.3",
     "copyfiles": "2.4.1",
     "date-fns": "4.1.0",
diff --git a/packages/services/broker-worker/package.json b/packages/services/broker-worker/package.json
index ad631dcecd0..775a0b04e96 100644
--- a/packages/services/broker-worker/package.json
+++ b/packages/services/broker-worker/package.json
@@ -10,7 +10,7 @@
   "devDependencies": {
     "@cloudflare/workers-types": "4.20250913.0",
     "@types/service-worker-mock": "2.0.4",
-    "@whatwg-node/server": "0.10.5",
+    "@whatwg-node/server": "0.10.17",
     "esbuild": "0.25.9",
     "itty-router": "4.2.2",
     "toucan-js": "4.1.0",
diff --git a/packages/services/cdn-worker/README.md b/packages/services/cdn-worker/README.md
index 13248c0d978..3cdad58f3c9 100644
--- a/packages/services/cdn-worker/README.md
+++ b/packages/services/cdn-worker/README.md
@@ -43,3 +43,72 @@ CF_BASE_PATH=http://localhost:4010
 ```
 
 This way, your local Hive instance will be able to send schema to the locally running CDN Worker.
+
+### Deployment
+
+There is two variants being built that can be deployed independently.
+
+- `Cloudflare Worker`: `dist/index.worker.mjs`
+- `AWS Lambda`: `dist/index.lambda.mjs`
+
+#### Cloudflare Worker
+
+THe documentation is work in progress and will be improved in the future.
+
+```
+type Env = {
+  S3_ENDPOINT: string;
+  S3_ACCESS_KEY_ID: string;
+  S3_SECRET_ACCESS_KEY: string;
+  S3_BUCKET_NAME: string;
+  S3_SESSION_TOKEN?: string;
+
+  S3_MIRROR_ENDPOINT: string;
+  S3_MIRROR_ACCESS_KEY_ID: string;
+  S3_MIRROR_SECRET_ACCESS_KEY: string;
+  S3_MIRROR_BUCKET_NAME: string;
+  S3_MIRROR_SESSION_TOKEN?: string;
+
+  SENTRY_DSN: string;
+  /**
+   * Name of the environment, e.g. staging, production
+   */
+  SENTRY_ENVIRONMENT: string;
+  /**
+   * Id of the release
+   */
+  SENTRY_RELEASE: string;
+  /**
+   * Worker's Analytics Engines
+   */
+  USAGE_ANALYTICS: AnalyticsEngine;
+  ERROR_ANALYTICS: AnalyticsEngine;
+  RESPONSE_ANALYTICS: AnalyticsEngine;
+  R2_ANALYTICS: AnalyticsEngine;
+  S3_ANALYTICS: AnalyticsEngine;
+  KEY_VALIDATION_ANALYTICS: AnalyticsEngine;
+  /**
+   * Base URL of the KV storage, used to fetch the schema from the KV storage.
+   * If not provided, the schema will be fetched from default KV storage value.
+   *
+   * @default https://key-cache.graphql-hive.com
+   */
+  KV_STORAGE_BASE_URL?: string;
+};
+```
+
+#### AWS Lambda
+
+**Runtime**: Node.js 22.x
+
+| Name                        | Required | Description               | Example Value           |
+| --------------------------- | -------- | ------------------------- | ----------------------- |
+| `AWS_S3_ENDPOINT`           | **Yes**  | The S3 endpoint.          | `http://localhost:9000` |
+| `AWS_S3_BUCKET_NAME`        | **Yes**  | The S3 bucket name.       | `artifacts`             |
+| `AWS_S3_ACCESS_KEY_ID`      | **Yes**  | The S3 access key id.     | `minioadmin`            |
+| `AWS_S3_ACCESSS_KEY_SECRET` | **Yes**  | The S3 secret access key. | `minioadmin`            |
+
+All other configuration options available for Cloudflare Workers are currently not supported.
+
+We recommend deploying the function to AWS Lambda, create a AWS Lambda Function invocation URL and
+then add the function as origin to CloudFront.
diff --git a/packages/services/cdn-worker/build.mjs b/packages/services/cdn-worker/build.mjs
index 72bbf7013b0..a009e9b2dad 100644
--- a/packages/services/cdn-worker/build.mjs
+++ b/packages/services/cdn-worker/build.mjs
@@ -7,6 +7,7 @@ console.log('🚀 Building CDN Worker...');
 const __dirname = dirname(fileURLToPath(import.meta.url));
 const nodeOutputPath = `${__dirname}/dist/index.nodejs.js`;
 const workerOutputPath = `${__dirname}/dist/index.worker.mjs`;
+const lambdaOutputPath = `${__dirname}/dist/index.lambda.mjs`;
 
 await Promise.all([
   // Build for integration tests, and expect it to run on NodeJS
@@ -38,4 +39,21 @@ await Promise.all([
     console.log(`✅ Built for CloudFlare Worker: "${workerOutputPath}"`);
     return result;
   }),
+  build({
+    entryPoints: [`${__dirname}/src/index-lambda.ts`],
+    bundle: true,
+    platform: 'node',
+    target: 'node22',
+    format: 'esm',
+    minify: false,
+    sourcemap: true,
+    outfile: lambdaOutputPath,
+    treeShaking: true,
+    banner: {
+      js: "import { createRequire } from 'module'; const require = createRequire(import.meta.url);",
+    },
+  }).then(result => {
+    console.log(`✅ Built for AWS Lambda: "${lambdaOutputPath}"`);
+    return result;
+  }),
 ]);
diff --git a/packages/services/cdn-worker/package.json b/packages/services/cdn-worker/package.json
index 182f311f06c..3d68bba5252 100644
--- a/packages/services/cdn-worker/package.json
+++ b/packages/services/cdn-worker/package.json
@@ -19,7 +19,7 @@
   "devDependencies": {
     "@cloudflare/workers-types": "4.20250913.0",
     "@types/service-worker-mock": "2.0.4",
-    "@whatwg-node/server": "0.10.5",
+    "@whatwg-node/server": "0.10.17",
     "bcryptjs": "2.4.3",
     "dotenv": "16.4.7",
     "esbuild": "0.25.9",
diff --git a/packages/services/cdn-worker/src/index-lambda.ts b/packages/services/cdn-worker/src/index-lambda.ts
new file mode 100644
index 00000000000..39e6465a5fa
--- /dev/null
+++ b/packages/services/cdn-worker/src/index-lambda.ts
@@ -0,0 +1,102 @@
+import type { APIGatewayProxyEventV2, APIGatewayProxyResult, Context } from 'aws-lambda';
+import { z } from 'zod';
+import { createServerAdapter } from '@whatwg-node/server';
+import { createArtifactRequestHandler } from './artifact-handler';
+import { ArtifactStorageReader } from './artifact-storage-reader';
+import { AwsClient } from './aws';
+import { createIsAppDeploymentActive } from './is-app-deployment-active';
+import { createIsKeyValid } from './key-validation';
+
+const env = z
+  .object({
+    AWS_S3_ACCESS_KEY_ID: z.string(),
+    AWS_S3_ACCESSS_KEY_SECRET: z.string(),
+    AWS_S3_ENDPOINT: z.string(),
+    AWS_S3_BUCKET_NAME: z.string(),
+  })
+  .parse((globalThis as any).process.env);
+
+const s3 = {
+  client: new AwsClient({
+    accessKeyId: env.AWS_S3_ACCESS_KEY_ID,
+    secretAccessKey: env.AWS_S3_ACCESSS_KEY_SECRET,
+    service: 's3',
+  }),
+  endpoint: env.AWS_S3_ENDPOINT,
+  bucketName: env.AWS_S3_BUCKET_NAME,
+};
+
+const s3Mirror = null;
+
+const artifactStorageReader = new ArtifactStorageReader(s3, s3Mirror, null, null);
+
+const artifactHandler = createArtifactRequestHandler({
+  isKeyValid: createIsKeyValid({
+    artifactStorageReader,
+    analytics: null,
+    breadcrumb(message: string) {
+      console.log(message);
+    },
+    getCache: null,
+    waitUntil: null,
+    captureException() {},
+  }),
+  artifactStorageReader,
+  isAppDeploymentActive: createIsAppDeploymentActive({
+    artifactStorageReader,
+    getCache: null,
+    waitUntil: null,
+  }),
+});
+
+const artifactRouteHandler = createServerAdapter(artifactHandler as any);
+
+export async function handler(
+  event: APIGatewayProxyEventV2,
+  lambdaContext: Context,
+): Promise<APIGatewayProxyResult> {
+  console.log(event.requestContext.http.method, event.rawPath);
+  const url = new URL(event.rawPath, 'http://localhost');
+  if (event.queryStringParameters != null) {
+    for (const name in event.queryStringParameters) {
+      const value = event.queryStringParameters[name];
+      if (value != null) {
+        url.searchParams.set(name, value);
+      }
+    }
+  }
+
+  const response = await artifactRouteHandler.fetch(
+    url,
+    {
+      method: event.requestContext.http.method,
+      headers: event.headers as HeadersInit,
+      body: undefined,
+    },
+    {
+      event,
+      lambdaContext,
+    },
+  );
+
+  if (!response) {
+    return {
+      statusCode: 404,
+      body: '',
+      isBase64Encoded: false,
+    };
+  }
+
+  const responseHeaders: Record<string, string> = {};
+
+  response.headers.forEach((value, name) => {
+    responseHeaders[name] = value;
+  });
+
+  return {
+    statusCode: response.status,
+    headers: responseHeaders,
+    body: await response.text(),
+    isBase64Encoded: false,
+  };
+}
diff --git a/packages/services/external-composition/federation-2/package.json b/packages/services/external-composition/federation-2/package.json
index c80205d7da9..99741dc668f 100644
--- a/packages/services/external-composition/federation-2/package.json
+++ b/packages/services/external-composition/federation-2/package.json
@@ -11,7 +11,7 @@
     "@apollo/composition": "2.10.4",
     "@apollo/federation-internals": "2.9.3",
     "@graphql-hive/external-composition": "workspace:*",
-    "@whatwg-node/server": "0.10.5",
+    "@whatwg-node/server": "0.10.17",
     "dotenv": "16.4.7",
     "graphql": "16.9.0",
     "lru-cache": "^7.17.0",
diff --git a/packages/services/server/package.json b/packages/services/server/package.json
index 77d960068ea..3152b196782 100644
--- a/packages/services/server/package.json
+++ b/packages/services/server/package.json
@@ -36,7 +36,7 @@
     "@theguild/federation-composition": "0.20.2",
     "@trpc/client": "10.45.2",
     "@trpc/server": "10.45.2",
-    "@whatwg-node/server": "0.10.5",
+    "@whatwg-node/server": "0.10.17",
     "dotenv": "16.4.7",
     "fastify": "4.29.1",
     "got": "14.4.7",
diff --git a/pnpm-lock.yaml b/pnpm-lock.yaml
index 0fc7d69d890..9c37f4daba0 100644
--- a/pnpm-lock.yaml
+++ b/pnpm-lock.yaml
@@ -233,6 +233,9 @@ importers:
       '@manypkg/get-packages':
         specifier: 2.2.2
         version: 2.2.2
+      '@pulumi/aws':
+        specifier: 7.12.0
+        version: 7.12.0(ts-node@10.9.2(@swc/core@1.13.5)(@types/node@22.10.5)(typescript@5.7.3))(typescript@5.7.3)
       '@pulumi/cloudflare':
         specifier: 4.16.0
         version: 4.16.0(ts-node@10.9.2(@swc/core@1.13.5)(@types/node@22.10.5)(typescript@5.7.3))(typescript@5.7.3)
@@ -514,8 +517,8 @@ importers:
         specifier: ^10.0.0
         version: 10.5.6(graphql@16.9.0)
       '@whatwg-node/fetch':
-        specifier: ^0.10.6
-        version: 0.10.6
+        specifier: ^0.10.13
+        version: 0.10.13
       async-retry:
         specifier: ^1.3.3
         version: 1.3.3
@@ -630,8 +633,8 @@ importers:
         specifier: 3.9.0
         version: 3.9.0(@envelop/core@5.3.1)(graphql-yoga@5.13.3(graphql@16.9.0))(graphql@16.9.0)
       '@whatwg-node/fetch':
-        specifier: 0.10.6
-        version: 0.10.6
+        specifier: 0.10.13
+        version: 0.10.13
       graphql-ws:
         specifier: 5.16.1
         version: 5.16.1(graphql@16.9.0)
@@ -667,8 +670,8 @@ importers:
         specifier: 8.11.10
         version: 8.11.10
       '@whatwg-node/fetch':
-        specifier: 0.10.6
-        version: 0.10.6
+        specifier: 0.10.13
+        version: 0.10.13
       bcryptjs:
         specifier: 2.4.3
         version: 2.4.3
@@ -917,8 +920,8 @@ importers:
         specifier: 2.0.4
         version: 2.0.4
       '@whatwg-node/server':
-        specifier: 0.10.5
-        version: 0.10.5
+        specifier: 0.10.17
+        version: 0.10.17
       esbuild:
         specifier: 0.25.9
         version: 0.25.9
@@ -950,8 +953,8 @@ importers:
         specifier: 2.0.4
         version: 2.0.4
       '@whatwg-node/server':
-        specifier: 0.10.5
-        version: 0.10.5
+        specifier: 0.10.17
+        version: 0.10.17
       bcryptjs:
         specifier: 2.4.3
         version: 2.4.3
@@ -1113,8 +1116,8 @@ importers:
         specifier: workspace:*
         version: link:../../../libraries/external-composition/dist
       '@whatwg-node/server':
-        specifier: 0.10.5
-        version: 0.10.5
+        specifier: 0.10.17
+        version: 0.10.17
       dotenv:
         specifier: 16.4.7
         version: 16.4.7
@@ -1326,8 +1329,8 @@ importers:
         specifier: 10.45.2
         version: 10.45.2
       '@whatwg-node/server':
-        specifier: 0.10.5
-        version: 0.10.5
+        specifier: 0.10.17
+        version: 0.10.17
       dotenv:
         specifier: 16.4.7
         version: 16.4.7
@@ -6295,6 +6298,9 @@ packages:
   '@protobufjs/utf8@1.1.0':
     resolution: {integrity: sha512-Vvn3zZrhQZkkBE8LSuW3em98c0FwgO4nxzv6OdSxPKJIEKY2bGbHn+mhGIPerzI4twdxaP8/0+06HBpwf345Lw==}
 
+  '@pulumi/aws@7.12.0':
+    resolution: {integrity: sha512-uVrfb8PsWyGl3W3hUrnp/RipU5OQQr/5EcxZaT1qmbaHsiCo2yzv3v4/0uxq3uFnhFo4B1EjiFe2lENfTZP3mQ==}
+
   '@pulumi/cloudflare@4.16.0':
     resolution: {integrity: sha512-cwdB70bLeKL/VNIqqOD5fpHQcocVmpHuiHH589eR+QUfbLa4f+M8yA/TTCcxx2AFFctTqO5wgVuC+faL8xZmWQ==}
 
@@ -9204,8 +9210,8 @@ packages:
     resolution: {integrity: sha512-AyQEn5hIPV7Ze+xFoXVU3QTHXVbWPrzaOkxtENMPMuNL6VVHrp4hHfDt9nrQpjO7BgvuM95dMtkycX5M/DZR3w==}
     engines: {node: '>=16.0.0'}
 
-  '@whatwg-node/fetch@0.10.6':
-    resolution: {integrity: sha512-6uzhO2aQ757p3bSHcemA8C4pqEXuyBqyGAM7cYpO0c6/igRMV9As9XL0W12h5EPYMclgr7FgjmbVQBoWEdJ/yA==}
+  '@whatwg-node/fetch@0.10.13':
+    resolution: {integrity: sha512-b4PhJ+zYj4357zwk4TTuF2nEe0vVtOrwdsrNo5hL+u1ojXNhh1FgJ6pg1jzDlwlT4oBdzfSwaBwMCtFCsIWg8Q==}
     engines: {node: '>=18.0.0'}
 
   '@whatwg-node/fetch@0.8.8':
@@ -9222,8 +9228,8 @@ packages:
     resolution: {integrity: sha512-0OaMj5W4fzWimRSFq07qFiWfquaUMNB+695GwE76LYKVuah+jwCdzSgsIOtwPkiyJ35w0XGhXmJPiIJCdLwopg==}
     engines: {node: '>=18.0.0'}
 
-  '@whatwg-node/node-fetch@0.7.18':
-    resolution: {integrity: sha512-IxKdVWfZYasGiyxBcsROxq6FmDQu3MNNiOYJ/yqLKhe+Qq27IIWsK7ItbjS2M9L5aM5JxjWkIS7JDh7wnsn+CQ==}
+  '@whatwg-node/node-fetch@0.8.4':
+    resolution: {integrity: sha512-AlKLc57loGoyYlrzDbejB9EeR+pfdJdGzbYnkEuZaGekFboBwzfVYVMsy88PMriqPI1ORpiGYGgSSWpx7a2sDA==}
     engines: {node: '>=18.0.0'}
 
   '@whatwg-node/promise-helpers@1.3.0':
@@ -9234,12 +9240,16 @@ packages:
     resolution: {integrity: sha512-D+OwTEunoQhVHVToD80dPhfz9xgPLqJyEA3F5jCRM14A2u8tBBQVdZekqfqx6ZAfZ+POT4Hb0dn601UKMsvADw==}
     engines: {node: '>=16.0.0'}
 
-  '@whatwg-node/server@0.10.3':
-    resolution: {integrity: sha512-2Dnfey57vWR+hDUMjPhNzJQc9z116BBzSQwR9eD0vhnzYmN2rJXuY0QuMaHDCCqEZRmFHg2bo8iJ+/1uHOlxpg==}
+  '@whatwg-node/promise-helpers@1.3.2':
+    resolution: {integrity: sha512-Nst5JdK47VIl9UcGwtv2Rcgyn5lWtZ0/mhRQ4G8NN2isxpq2TO30iqHzmwoJycjWuyUfg3GFXqP/gFHXeV57IA==}
+    engines: {node: '>=16.0.0'}
+
+  '@whatwg-node/server@0.10.17':
+    resolution: {integrity: sha512-QxI+HQfJeI/UscFNCTcSri6nrHP25mtyAMbhEri7W2ctdb3EsorPuJz7IovSgNjvKVs73dg9Fmayewx1O2xOxA==}
     engines: {node: '>=18.0.0'}
 
-  '@whatwg-node/server@0.10.5':
-    resolution: {integrity: sha512-ydxzH1iox9AzLe+uaX9jjyVFkQO+h15j+JClropw0P4Vz+ES4+xTZVu5leUsWW8AYTVZBFkiC0iHl/PwFZ+Q1Q==}
+  '@whatwg-node/server@0.10.3':
+    resolution: {integrity: sha512-2Dnfey57vWR+hDUMjPhNzJQc9z116BBzSQwR9eD0vhnzYmN2rJXuY0QuMaHDCCqEZRmFHg2bo8iJ+/1uHOlxpg==}
     engines: {node: '>=18.0.0'}
 
   '@whatwg-node/server@0.9.65':
@@ -17871,8 +17881,8 @@ snapshots:
     dependencies:
       '@aws-crypto/sha256-browser': 3.0.0
       '@aws-crypto/sha256-js': 3.0.0
-      '@aws-sdk/client-sso-oidc': 3.596.0
-      '@aws-sdk/client-sts': 3.596.0(@aws-sdk/client-sso-oidc@3.596.0)
+      '@aws-sdk/client-sso-oidc': 3.596.0(@aws-sdk/client-sts@3.596.0)
+      '@aws-sdk/client-sts': 3.596.0
       '@aws-sdk/core': 3.592.0
       '@aws-sdk/credential-provider-node': 3.596.0(@aws-sdk/client-sso-oidc@3.596.0)(@aws-sdk/client-sts@3.596.0)
       '@aws-sdk/middleware-host-header': 3.577.0
@@ -18024,11 +18034,11 @@ snapshots:
     transitivePeerDependencies:
       - aws-crt
 
-  '@aws-sdk/client-sso-oidc@3.596.0':
+  '@aws-sdk/client-sso-oidc@3.596.0(@aws-sdk/client-sts@3.596.0)':
     dependencies:
       '@aws-crypto/sha256-browser': 3.0.0
       '@aws-crypto/sha256-js': 3.0.0
-      '@aws-sdk/client-sts': 3.596.0(@aws-sdk/client-sso-oidc@3.596.0)
+      '@aws-sdk/client-sts': 3.596.0
       '@aws-sdk/core': 3.592.0
       '@aws-sdk/credential-provider-node': 3.596.0(@aws-sdk/client-sso-oidc@3.596.0)(@aws-sdk/client-sts@3.596.0)
       '@aws-sdk/middleware-host-header': 3.577.0
@@ -18067,6 +18077,7 @@ snapshots:
       '@smithy/util-utf8': 3.0.0
       tslib: 2.8.1
     transitivePeerDependencies:
+      - '@aws-sdk/client-sts'
       - aws-crt
 
   '@aws-sdk/client-sso-oidc@3.723.0(@aws-sdk/client-sts@3.723.0)':
@@ -18243,11 +18254,11 @@ snapshots:
     transitivePeerDependencies:
       - aws-crt
 
-  '@aws-sdk/client-sts@3.596.0(@aws-sdk/client-sso-oidc@3.596.0)':
+  '@aws-sdk/client-sts@3.596.0':
     dependencies:
       '@aws-crypto/sha256-browser': 3.0.0
       '@aws-crypto/sha256-js': 3.0.0
-      '@aws-sdk/client-sso-oidc': 3.596.0
+      '@aws-sdk/client-sso-oidc': 3.596.0(@aws-sdk/client-sts@3.596.0)
       '@aws-sdk/core': 3.592.0
       '@aws-sdk/credential-provider-node': 3.596.0(@aws-sdk/client-sso-oidc@3.596.0)(@aws-sdk/client-sts@3.596.0)
       '@aws-sdk/middleware-host-header': 3.577.0
@@ -18286,7 +18297,6 @@ snapshots:
       '@smithy/util-utf8': 3.0.0
       tslib: 2.8.1
     transitivePeerDependencies:
-      - '@aws-sdk/client-sso-oidc'
       - aws-crt
 
   '@aws-sdk/client-sts@3.723.0':
@@ -18437,7 +18447,7 @@ snapshots:
 
   '@aws-sdk/credential-provider-ini@3.596.0(@aws-sdk/client-sso-oidc@3.596.0)(@aws-sdk/client-sts@3.596.0)':
     dependencies:
-      '@aws-sdk/client-sts': 3.596.0(@aws-sdk/client-sso-oidc@3.596.0)
+      '@aws-sdk/client-sts': 3.596.0
       '@aws-sdk/credential-provider-env': 3.587.0
       '@aws-sdk/credential-provider-http': 3.596.0
       '@aws-sdk/credential-provider-process': 3.587.0
@@ -18613,7 +18623,7 @@ snapshots:
 
   '@aws-sdk/credential-provider-web-identity@3.587.0(@aws-sdk/client-sts@3.596.0)':
     dependencies:
-      '@aws-sdk/client-sts': 3.596.0(@aws-sdk/client-sso-oidc@3.596.0)
+      '@aws-sdk/client-sts': 3.596.0
       '@aws-sdk/types': 3.577.0
       '@smithy/property-provider': 3.1.11
       '@smithy/types': 3.7.2
@@ -18908,7 +18918,7 @@ snapshots:
 
   '@aws-sdk/token-providers@3.587.0(@aws-sdk/client-sso-oidc@3.596.0)':
     dependencies:
-      '@aws-sdk/client-sso-oidc': 3.596.0
+      '@aws-sdk/client-sso-oidc': 3.596.0(@aws-sdk/client-sts@3.596.0)
       '@aws-sdk/types': 3.577.0
       '@smithy/property-provider': 3.1.11
       '@smithy/shared-ini-file-loader': 3.1.12
@@ -19858,7 +19868,7 @@ snapshots:
     dependencies:
       '@envelop/instrumentation': 1.0.0
       '@envelop/types': 5.2.1
-      '@whatwg-node/promise-helpers': 1.3.1
+      '@whatwg-node/promise-helpers': 1.3.2
       tslib: 2.8.1
 
   '@envelop/graphql-jit@8.0.3(@envelop/core@5.0.2)(graphql@16.9.0)':
@@ -19878,7 +19888,7 @@ snapshots:
 
   '@envelop/instrumentation@1.0.0':
     dependencies:
-      '@whatwg-node/promise-helpers': 1.3.1
+      '@whatwg-node/promise-helpers': 1.3.2
       tslib: 2.8.1
 
   '@envelop/on-resolve@4.1.0(@envelop/core@5.0.2)(graphql@16.9.0)':
@@ -19909,7 +19919,7 @@ snapshots:
     dependencies:
       '@envelop/core': 5.2.3
       '@graphql-tools/utils': 10.9.1(graphql@16.9.0)
-      '@whatwg-node/fetch': 0.10.6
+      '@whatwg-node/fetch': 0.10.13
       '@whatwg-node/promise-helpers': 1.3.1
       fast-json-stable-stringify: 2.1.0
       graphql: 16.9.0
@@ -20317,7 +20327,7 @@ snapshots:
       '@graphql-tools/url-loader': 8.0.33(@types/node@22.10.5)(graphql@16.9.0)
       '@graphql-tools/utils': 10.9.1(graphql@16.9.0)
       '@inquirer/prompts': 7.8.6(@types/node@22.10.5)
-      '@whatwg-node/fetch': 0.10.6
+      '@whatwg-node/fetch': 0.10.13
       chalk: 4.1.2
       cosmiconfig: 9.0.0(typescript@5.7.3)
       debounce: 2.2.0
@@ -20759,7 +20769,7 @@ snapshots:
   '@graphql-tools/apollo-engine-loader@8.0.22(graphql@16.9.0)':
     dependencies:
       '@graphql-tools/utils': 10.9.1(graphql@16.9.0)
-      '@whatwg-node/fetch': 0.10.6
+      '@whatwg-node/fetch': 0.10.13
       graphql: 16.9.0
       sync-fetch: 0.6.0-2
       tslib: 2.8.1
@@ -20985,7 +20995,7 @@ snapshots:
       '@graphql-tools/utils': 10.9.1(graphql@16.9.0)
       '@repeaterjs/repeater': 3.0.6
       '@whatwg-node/disposablestack': 0.0.6
-      '@whatwg-node/fetch': 0.10.6
+      '@whatwg-node/fetch': 0.10.13
       '@whatwg-node/promise-helpers': 1.3.1
       graphql: 16.9.0
       meros: 1.2.1(@types/node@22.10.5)
@@ -21357,7 +21367,7 @@ snapshots:
       '@graphql-tools/utils': 10.9.1(graphql@16.9.0)
       '@graphql-tools/wrap': 10.1.4(graphql@16.9.0)
       '@types/ws': 8.5.3
-      '@whatwg-node/fetch': 0.10.6
+      '@whatwg-node/fetch': 0.10.13
       '@whatwg-node/promise-helpers': 1.3.1
       graphql: 16.9.0
       isomorphic-ws: 5.0.0(ws@8.18.0)
@@ -23717,6 +23727,16 @@ snapshots:
 
   '@protobufjs/utf8@1.1.0': {}
 
+  '@pulumi/aws@7.12.0(ts-node@10.9.2(@swc/core@1.13.5)(@types/node@22.10.5)(typescript@5.7.3))(typescript@5.7.3)':
+    dependencies:
+      '@pulumi/pulumi': 3.185.0(ts-node@10.9.2(@swc/core@1.13.5)(@types/node@22.10.5)(typescript@5.7.3))(typescript@5.7.3)
+      mime: 2.6.0
+    transitivePeerDependencies:
+      - bluebird
+      - supports-color
+      - ts-node
+      - typescript
+
   '@pulumi/cloudflare@4.16.0(ts-node@10.9.2(@swc/core@1.13.5)(@types/node@22.10.5)(typescript@5.7.3))(typescript@5.7.3)':
     dependencies:
       '@pulumi/pulumi': 3.185.0(ts-node@10.9.2(@swc/core@1.13.5)(@types/node@22.10.5)(typescript@5.7.3))(typescript@5.7.3)
@@ -27539,16 +27559,16 @@ snapshots:
 
   '@whatwg-node/disposablestack@0.0.6':
     dependencies:
-      '@whatwg-node/promise-helpers': 1.3.1
+      '@whatwg-node/promise-helpers': 1.3.2
       tslib: 2.8.1
 
   '@whatwg-node/events@0.0.3': {}
 
   '@whatwg-node/events@0.1.1': {}
 
-  '@whatwg-node/fetch@0.10.6':
+  '@whatwg-node/fetch@0.10.13':
     dependencies:
-      '@whatwg-node/node-fetch': 0.7.18
+      '@whatwg-node/node-fetch': 0.8.4
       urlpattern-polyfill: 10.0.0
 
   '@whatwg-node/fetch@0.8.8':
@@ -27579,11 +27599,11 @@ snapshots:
       fast-querystring: 1.1.2
       tslib: 2.8.1
 
-  '@whatwg-node/node-fetch@0.7.18':
+  '@whatwg-node/node-fetch@0.8.4':
     dependencies:
       '@fastify/busboy': 3.1.1
       '@whatwg-node/disposablestack': 0.0.6
-      '@whatwg-node/promise-helpers': 1.3.1
+      '@whatwg-node/promise-helpers': 1.3.2
       tslib: 2.8.1
 
   '@whatwg-node/promise-helpers@1.3.0':
@@ -27594,26 +27614,30 @@ snapshots:
     dependencies:
       tslib: 2.8.1
 
-  '@whatwg-node/server@0.10.3':
+  '@whatwg-node/promise-helpers@1.3.2':
+    dependencies:
+      tslib: 2.8.1
+
+  '@whatwg-node/server@0.10.17':
     dependencies:
       '@envelop/instrumentation': 1.0.0
       '@whatwg-node/disposablestack': 0.0.6
-      '@whatwg-node/fetch': 0.10.6
-      '@whatwg-node/promise-helpers': 1.3.1
+      '@whatwg-node/fetch': 0.10.13
+      '@whatwg-node/promise-helpers': 1.3.2
       tslib: 2.8.1
 
-  '@whatwg-node/server@0.10.5':
+  '@whatwg-node/server@0.10.3':
     dependencies:
       '@envelop/instrumentation': 1.0.0
       '@whatwg-node/disposablestack': 0.0.6
-      '@whatwg-node/fetch': 0.10.6
+      '@whatwg-node/fetch': 0.10.13
       '@whatwg-node/promise-helpers': 1.3.1
       tslib: 2.8.1
 
   '@whatwg-node/server@0.9.65':
     dependencies:
       '@whatwg-node/disposablestack': 0.0.5
-      '@whatwg-node/fetch': 0.10.6
+      '@whatwg-node/fetch': 0.10.13
       tslib: 2.8.1
 
   '@xmldom/xmldom@0.9.8': {}
@@ -30969,7 +30993,7 @@ snapshots:
       '@graphql-tools/utils': 10.9.1(graphql@16.9.0)
       '@graphql-yoga/logger': 2.0.1
       '@graphql-yoga/subscription': 5.0.4
-      '@whatwg-node/fetch': 0.10.6
+      '@whatwg-node/fetch': 0.10.13
       '@whatwg-node/promise-helpers': 1.3.0
       '@whatwg-node/server': 0.10.3
       dset: 3.1.4