@anvil-cloud/sdk 0.0.13 → 0.0.15

package/bin/aws/httpApi.js

@@ -0,0 +1,60 @@
+"use strict";
+// *** WARNING: this file was generated by pulumi-language-nodejs. ***
+// *** Do not edit by hand unless you're certain you know what you are doing! ***
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.HttpApi = void 0;
+const pulumi = require("@pulumi/pulumi");
+const utilities = require("../utilities");
+/**
+ * An Anvil-managed AWS HTTP API Gateway (API Gateway v2). Route-level consumers support Lambda, SQS, EventBridge, Step Functions, and HTTP proxy integrations. Secure by default: TLS 1.2 minimum enforced on custom domains, execute-api endpoint disabled when a custom domain is set, conservative throttling defaults (1000 rps / 500 burst), CORS opt-in with wildcard origin blocked, per-consumer least-privilege IAM roles, access logs on by default.
+ */
+class HttpApi extends pulumi.ComponentResource {
+    /**
+     * Returns true if the given object is an instance of HttpApi.  This is designed to work even
+     * when multiple copies of the Pulumi SDK have been loaded into the same process.
+     */
+    static isInstance(obj) {
+        if (obj === undefined || obj === null) {
+            return false;
+        }
+        return obj['__pulumiType'] === HttpApi.__pulumiType;
+    }
+    /**
+     * Create a HttpApi resource with the given unique name, arguments, and options.
+     *
+     * @param name The _unique_ name of the resource.
+     * @param args The arguments to use to populate this resource's properties.
+     * @param opts A bag of options that control this resource's behavior.
+     */
+    constructor(name, args, opts) {
+        let resourceInputs = {};
+        opts = opts || {};
+        if (!opts.id) {
+            if (args?.routes === undefined && !opts.urn) {
+                throw new Error("Missing required property 'routes'");
+            }
+            resourceInputs["cors"] = args?.cors;
+            resourceInputs["defaultAuthorizerId"] = args?.defaultAuthorizerId;
+            resourceInputs["domain"] = args?.domain;
+            resourceInputs["logRetention"] = args?.logRetention;
+            resourceInputs["routes"] = args?.routes;
+            resourceInputs["throttling"] = args?.throttling;
+            resourceInputs["apiEndpoint"] = undefined /*out*/;
+            resourceInputs["apiId"] = undefined /*out*/;
+            resourceInputs["certValidationCname"] = undefined /*out*/;
+            resourceInputs["url"] = undefined /*out*/;
+        }
+        else {
+            resourceInputs["apiEndpoint"] = undefined /*out*/;
+            resourceInputs["apiId"] = undefined /*out*/;
+            resourceInputs["certValidationCname"] = undefined /*out*/;
+            resourceInputs["url"] = undefined /*out*/;
+        }
+        opts = pulumi.mergeOptions(utilities.resourceOptsDefaults(), opts);
+        super(HttpApi.__pulumiType, name, resourceInputs, opts, true /*remote*/);
+    }
+}
+exports.HttpApi = HttpApi;
+/** @internal */
+HttpApi.__pulumiType = 'anvil:aws:HttpApi';
+//# sourceMappingURL=httpApi.js.map

package/bin/aws/httpApi.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"httpApi.js","sourceRoot":"","sources":["../../aws/httpApi.ts"],"names":[],"mappings":";AAAA,sEAAsE;AACtE,iFAAiF;;;AAEjF,yCAAyC;AAIzC,0CAA0C;AAE1C;;GAEG;AACH,MAAa,OAAQ,SAAQ,MAAM,CAAC,iBAAiB;IAIjD;;;OAGG;IACI,MAAM,CAAC,UAAU,CAAC,GAAQ;QAC7B,IAAI,GAAG,KAAK,SAAS,IAAI,GAAG,KAAK,IAAI,EAAE;YACnC,OAAO,KAAK,CAAC;SAChB;QACD,OAAO,GAAG,CAAC,cAAc,CAAC,KAAK,OAAO,CAAC,YAAY,CAAC;IACxD,CAAC;IAmBD;;;;;;OAMG;IACH,YAAY,IAAY,EAAE,IAAiB,EAAE,IAAsC;QAC/E,IAAI,cAAc,GAAkB,EAAE,CAAC;QACvC,IAAI,GAAG,IAAI,IAAI,EAAE,CAAC;QAClB,IAAI,CAAC,IAAI,CAAC,EAAE,EAAE;YACV,IAAI,IAAI,EAAE,MAAM,KAAK,SAAS,IAAI,CAAC,IAAI,CAAC,GAAG,EAAE;gBACzC,MAAM,IAAI,KAAK,CAAC,oCAAoC,CAAC,CAAC;aACzD;YACD,cAAc,CAAC,MAAM,CAAC,GAAG,IAAI,EAAE,IAAI,CAAC;YACpC,cAAc,CAAC,qBAAqB,CAAC,GAAG,IAAI,EAAE,mBAAmB,CAAC;YAClE,cAAc,CAAC,QAAQ,CAAC,GAAG,IAAI,EAAE,MAAM,CAAC;YACxC,cAAc,CAAC,cAAc,CAAC,GAAG,IAAI,EAAE,YAAY,CAAC;YACpD,cAAc,CAAC,QAAQ,CAAC,GAAG,IAAI,EAAE,MAAM,CAAC;YACxC,cAAc,CAAC,YAAY,CAAC,GAAG,IAAI,EAAE,UAAU,CAAC;YAChD,cAAc,CAAC,aAAa,CAAC,GAAG,SAAS,CAAC,OAAO,CAAC;YAClD,cAAc,CAAC,OAAO,CAAC,GAAG,SAAS,CAAC,OAAO,CAAC;YAC5C,cAAc,CAAC,qBAAqB,CAAC,GAAG,SAAS,CAAC,OAAO,CAAC;YAC1D,cAAc,CAAC,KAAK,CAAC,GAAG,SAAS,CAAC,OAAO,CAAC;SAC7C;aAAM;YACH,cAAc,CAAC,aAAa,CAAC,GAAG,SAAS,CAAC,OAAO,CAAC;YAClD,cAAc,CAAC,OAAO,CAAC,GAAG,SAAS,CAAC,OAAO,CAAC;YAC5C,cAAc,CAAC,qBAAqB,CAAC,GAAG,SAAS,CAAC,OAAO,CAAC;YAC1D,cAAc,CAAC,KAAK,CAAC,GAAG,SAAS,CAAC,OAAO,CAAC;SAC7C;QACD,IAAI,GAAG,MAAM,CAAC,YAAY,CAAC,SAAS,CAAC,oBAAoB,EAAE,EAAE,IAAI,CAAC,CAAC;QACnE,KAAK,CAAC,OAAO,CAAC,YAAY,EAAE,IAAI,EAAE,cAAc,EAAE,IAAI,EAAE,IAAI,CAAC,UAAU,CAAC,CAAC;IAC7E,CAAC;;AAhEL,0BAiEC;AAhEG,gBAAgB;AACO,oBAAY,GAAG,mBAAmB,CAAC"}

package/bin/aws/index.d.ts

@@ -1,10 +1,37 @@
 export { BucketArgs } from "./bucket";
 export type Bucket = import("./bucket").Bucket;
 export declare const Bucket: typeof import("./bucket").Bucket;
+export { CognitoAuthArgs } from "./cognitoAuth";
+export type CognitoAuth = import("./cognitoAuth").CognitoAuth;
+export declare const CognitoAuth: typeof import("./cognitoAuth").CognitoAuth;
+export { CognitoUserPoolArgs } from "./cognitoUserPool";
+export type CognitoUserPool = import("./cognitoUserPool").CognitoUserPool;
+export declare const CognitoUserPool: typeof import("./cognitoUserPool").CognitoUserPool;
+export { DynamoDBArgs } from "./dynamoDB";
+export type DynamoDB = import("./dynamoDB").DynamoDB;
+export declare const DynamoDB: typeof import("./dynamoDB").DynamoDB;
+export { EventBusArgs } from "./eventBus";
+export type EventBus = import("./eventBus").EventBus;
+export declare const EventBus: typeof import("./eventBus").EventBus;
+export { HttpApiArgs } from "./httpApi";
+export type HttpApi = import("./httpApi").HttpApi;
+export declare const HttpApi: typeof import("./httpApi").HttpApi;
 export { LambdaArgs } from "./lambda";
 export type Lambda = import("./lambda").Lambda;
 export declare const Lambda: typeof import("./lambda").Lambda;
+export { OAuthAuthorizerArgs } from "./oauthAuthorizer";
+export type OAuthAuthorizer = import("./oauthAuthorizer").OAuthAuthorizer;
+export declare const OAuthAuthorizer: typeof import("./oauthAuthorizer").OAuthAuthorizer;
+export { QueueArgs } from "./queue";
+export type Queue = import("./queue").Queue;
+export declare const Queue: typeof import("./queue").Queue;
 export { SvelteKitSiteArgs } from "./svelteKitSite";
 export type SvelteKitSite = import("./svelteKitSite").SvelteKitSite;
 export declare const SvelteKitSite: typeof import("./svelteKitSite").SvelteKitSite;
+export { VpcArgs } from "./vpc";
+export type Vpc = import("./vpc").Vpc;
+export declare const Vpc: typeof import("./vpc").Vpc;
+export { VpcEndpointArgs } from "./vpcEndpoint";
+export type VpcEndpoint = import("./vpcEndpoint").VpcEndpoint;
+export declare const VpcEndpoint: typeof import("./vpcEndpoint").VpcEndpoint;
 export * from "../types/enums/aws";

package/bin/aws/index.js

@@ -16,15 +16,33 @@ var __exportStar = (this && this.__exportStar) || function(m, exports) {
     for (var p in m) if (p !== "default" && !Object.prototype.hasOwnProperty.call(exports, p)) __createBinding(exports, m, p);
 };
 Object.defineProperty(exports, "__esModule", { value: true });
-exports.SvelteKitSite = exports.Lambda = exports.Bucket = void 0;
+exports.VpcEndpoint = exports.Vpc = exports.SvelteKitSite = exports.Queue = exports.OAuthAuthorizer = exports.Lambda = exports.HttpApi = exports.EventBus = exports.DynamoDB = exports.CognitoUserPool = exports.CognitoAuth = exports.Bucket = void 0;
 const pulumi = require("@pulumi/pulumi");
 const utilities = require("../utilities");
 exports.Bucket = null;
 utilities.lazyLoad(exports, ["Bucket"], () => require("./bucket"));
+exports.CognitoAuth = null;
+utilities.lazyLoad(exports, ["CognitoAuth"], () => require("./cognitoAuth"));
+exports.CognitoUserPool = null;
+utilities.lazyLoad(exports, ["CognitoUserPool"], () => require("./cognitoUserPool"));
+exports.DynamoDB = null;
+utilities.lazyLoad(exports, ["DynamoDB"], () => require("./dynamoDB"));
+exports.EventBus = null;
+utilities.lazyLoad(exports, ["EventBus"], () => require("./eventBus"));
+exports.HttpApi = null;
+utilities.lazyLoad(exports, ["HttpApi"], () => require("./httpApi"));
 exports.Lambda = null;
 utilities.lazyLoad(exports, ["Lambda"], () => require("./lambda"));
+exports.OAuthAuthorizer = null;
+utilities.lazyLoad(exports, ["OAuthAuthorizer"], () => require("./oauthAuthorizer"));
+exports.Queue = null;
+utilities.lazyLoad(exports, ["Queue"], () => require("./queue"));
 exports.SvelteKitSite = null;
 utilities.lazyLoad(exports, ["SvelteKitSite"], () => require("./svelteKitSite"));
+exports.Vpc = null;
+utilities.lazyLoad(exports, ["Vpc"], () => require("./vpc"));
+exports.VpcEndpoint = null;
+utilities.lazyLoad(exports, ["VpcEndpoint"], () => require("./vpcEndpoint"));
 // Export enums:
 __exportStar(require("../types/enums/aws"), exports);
 const _module = {
@@ -33,10 +51,28 @@ const _module = {
         switch (type) {
             case "anvil:aws:Bucket":
                 return new exports.Bucket(name, undefined, { urn });
+            case "anvil:aws:CognitoAuth":
+                return new exports.CognitoAuth(name, undefined, { urn });
+            case "anvil:aws:CognitoUserPool":
+                return new exports.CognitoUserPool(name, undefined, { urn });
+            case "anvil:aws:DynamoDB":
+                return new exports.DynamoDB(name, undefined, { urn });
+            case "anvil:aws:EventBus":
+                return new exports.EventBus(name, undefined, { urn });
+            case "anvil:aws:HttpApi":
+                return new exports.HttpApi(name, undefined, { urn });
             case "anvil:aws:Lambda":
                 return new exports.Lambda(name, undefined, { urn });
+            case "anvil:aws:OAuthAuthorizer":
+                return new exports.OAuthAuthorizer(name, undefined, { urn });
+            case "anvil:aws:Queue":
+                return new exports.Queue(name, undefined, { urn });
             case "anvil:aws:SvelteKitSite":
                 return new exports.SvelteKitSite(name, undefined, { urn });
+            case "anvil:aws:Vpc":
+                return new exports.Vpc(name, undefined, { urn });
+            case "anvil:aws:VpcEndpoint":
+                return new exports.VpcEndpoint(name, undefined, { urn });
             default:
                 throw new Error(`unknown resource type ${type}`);
         }

package/bin/aws/index.js.map

@@ -1 +1 @@
-{"version":3,"file":"index.js","sourceRoot":"","sources":["../../aws/index.ts"],"names":[],"mappings":";AAAA,sEAAsE;AACtE,iFAAiF;;;;;;;;;;;;;;;;;AAEjF,yCAAyC;AACzC,0CAA0C;AAK7B,QAAA,MAAM,GAAqC,IAAW,CAAC;AACpE,SAAS,CAAC,QAAQ,CAAC,OAAO,EAAE,CAAC,QAAQ,CAAC,EAAE,GAAG,EAAE,CAAC,OAAO,CAAC,UAAU,CAAC,CAAC,CAAC;AAItD,QAAA,MAAM,GAAqC,IAAW,CAAC;AACpE,SAAS,CAAC,QAAQ,CAAC,OAAO,EAAE,CAAC,QAAQ,CAAC,EAAE,GAAG,EAAE,CAAC,OAAO,CAAC,UAAU,CAAC,CAAC,CAAC;AAItD,QAAA,aAAa,GAAmD,IAAW,CAAC;AACzF,SAAS,CAAC,QAAQ,CAAC,OAAO,EAAE,CAAC,eAAe,CAAC,EAAE,GAAG,EAAE,CAAC,OAAO,CAAC,iBAAiB,CAAC,CAAC,CAAC;AAGjF,gBAAgB;AAChB,qDAAmC;AAEnC,MAAM,OAAO,GAAG;IACZ,OAAO,EAAE,SAAS,CAAC,UAAU,EAAE;IAC/B,SAAS,EAAE,CAAC,IAAY,EAAE,IAAY,EAAE,GAAW,EAAmB,EAAE;QACpE,QAAQ,IAAI,EAAE;YACV,KAAK,kBAAkB;gBACnB,OAAO,IAAI,cAAM,CAAC,IAAI,EAAO,SAAS,EAAE,EAAE,GAAG,EAAE,CAAC,CAAA;YACpD,KAAK,kBAAkB;gBACnB,OAAO,IAAI,cAAM,CAAC,IAAI,EAAO,SAAS,EAAE,EAAE,GAAG,EAAE,CAAC,CAAA;YACpD,KAAK,yBAAyB;gBAC1B,OAAO,IAAI,qBAAa,CAAC,IAAI,EAAO,SAAS,EAAE,EAAE,GAAG,EAAE,CAAC,CAAA;YAC3D;gBACI,MAAM,IAAI,KAAK,CAAC,yBAAyB,IAAI,EAAE,CAAC,CAAC;SACxD;IACL,CAAC;CACJ,CAAC;AACF,MAAM,CAAC,OAAO,CAAC,sBAAsB,CAAC,OAAO,EAAE,KAAK,EAAE,OAAO,CAAC,CAAA"}
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../../aws/index.ts"],"names":[],"mappings":";AAAA,sEAAsE;AACtE,iFAAiF;;;;;;;;;;;;;;;;;AAEjF,yCAAyC;AACzC,0CAA0C;AAK7B,QAAA,MAAM,GAAqC,IAAW,CAAC;AACpE,SAAS,CAAC,QAAQ,CAAC,OAAO,EAAE,CAAC,QAAQ,CAAC,EAAE,GAAG,EAAE,CAAC,OAAO,CAAC,UAAU,CAAC,CAAC,CAAC;AAItD,QAAA,WAAW,GAA+C,IAAW,CAAC;AACnF,SAAS,CAAC,QAAQ,CAAC,OAAO,EAAE,CAAC,aAAa,CAAC,EAAE,GAAG,EAAE,CAAC,OAAO,CAAC,eAAe,CAAC,CAAC,CAAC;AAIhE,QAAA,eAAe,GAAuD,IAAW,CAAC;AAC/F,SAAS,CAAC,QAAQ,CAAC,OAAO,EAAE,CAAC,iBAAiB,CAAC,EAAE,GAAG,EAAE,CAAC,OAAO,CAAC,mBAAmB,CAAC,CAAC,CAAC;AAIxE,QAAA,QAAQ,GAAyC,IAAW,CAAC;AAC1E,SAAS,CAAC,QAAQ,CAAC,OAAO,EAAE,CAAC,UAAU,CAAC,EAAE,GAAG,EAAE,CAAC,OAAO,CAAC,YAAY,CAAC,CAAC,CAAC;AAI1D,QAAA,QAAQ,GAAyC,IAAW,CAAC;AAC1E,SAAS,CAAC,QAAQ,CAAC,OAAO,EAAE,CAAC,UAAU,CAAC,EAAE,GAAG,EAAE,CAAC,OAAO,CAAC,YAAY,CAAC,CAAC,CAAC;AAI1D,QAAA,OAAO,GAAuC,IAAW,CAAC;AACvE,SAAS,CAAC,QAAQ,CAAC,OAAO,EAAE,CAAC,SAAS,CAAC,EAAE,GAAG,EAAE,CAAC,OAAO,CAAC,WAAW,CAAC,CAAC,CAAC;AAIxD,QAAA,MAAM,GAAqC,IAAW,CAAC;AACpE,SAAS,CAAC,QAAQ,CAAC,OAAO,EAAE,CAAC,QAAQ,CAAC,EAAE,GAAG,EAAE,CAAC,OAAO,CAAC,UAAU,CAAC,CAAC,CAAC;AAItD,QAAA,eAAe,GAAuD,IAAW,CAAC;AAC/F,SAAS,CAAC,QAAQ,CAAC,OAAO,EAAE,CAAC,iBAAiB,CAAC,EAAE,GAAG,EAAE,CAAC,OAAO,CAAC,mBAAmB,CAAC,CAAC,CAAC;AAIxE,QAAA,KAAK,GAAmC,IAAW,CAAC;AACjE,SAAS,CAAC,QAAQ,CAAC,OAAO,EAAE,CAAC,OAAO,CAAC,EAAE,GAAG,EAAE,CAAC,OAAO,CAAC,SAAS,CAAC,CAAC,CAAC;AAIpD,QAAA,aAAa,GAAmD,IAAW,CAAC;AACzF,SAAS,CAAC,QAAQ,CAAC,OAAO,EAAE,CAAC,eAAe,CAAC,EAAE,GAAG,EAAE,CAAC,OAAO,CAAC,iBAAiB,CAAC,CAAC,CAAC;AAIpE,QAAA,GAAG,GAA+B,IAAW,CAAC;AAC3D,SAAS,CAAC,QAAQ,CAAC,OAAO,EAAE,CAAC,KAAK,CAAC,EAAE,GAAG,EAAE,CAAC,OAAO,CAAC,OAAO,CAAC,CAAC,CAAC;AAIhD,QAAA,WAAW,GAA+C,IAAW,CAAC;AACnF,SAAS,CAAC,QAAQ,CAAC,OAAO,EAAE,CAAC,aAAa,CAAC,EAAE,GAAG,EAAE,CAAC,OAAO,CAAC,eAAe,CAAC,CAAC,CAAC;AAG7E,gBAAgB;AAChB,qDAAmC;AAEnC,MAAM,OAAO,GAAG;IACZ,OAAO,EAAE,SAAS,CAAC,UAAU,EAAE;IAC/B,SAAS,EAAE,CAAC,IAAY,EAAE,IAAY,EAAE,GAAW,EAAmB,EAAE;QACpE,QAAQ,IAAI,EAAE;YACV,KAAK,kBAAkB;gBACnB,OAAO,IAAI,cAAM,CAAC,IAAI,EAAO,SAAS,EAAE,EAAE,GAAG,EAAE,CAAC,CAAA;YACpD,KAAK,uBAAuB;gBACxB,OAAO,IAAI,mBAAW,CAAC,IAAI,EAAO,SAAS,EAAE,EAAE,GAAG,EAAE,CAAC,CAAA;YACzD,KAAK,2BAA2B;gBAC5B,OAAO,IAAI,uBAAe,CAAC,IAAI,EAAO,SAAS,EAAE,EAAE,GAAG,EAAE,CAAC,CAAA;YAC7D,KAAK,oBAAoB;gBACrB,OAAO,IAAI,gBAAQ,CAAC,IAAI,EAAO,SAAS,EAAE,EAAE,GAAG,EAAE,CAAC,CAAA;YACtD,KAAK,oBAAoB;gBACrB,OAAO,IAAI,gBAAQ,CAAC,IAAI,EAAO,SAAS,EAAE,EAAE,GAAG,EAAE,CAAC,CAAA;YACtD,KAAK,mBAAmB;gBACpB,OAAO,IAAI,eAAO,CAAC,IAAI,EAAO,SAAS,EAAE,EAAE,GAAG,EAAE,CAAC,CAAA;YACrD,KAAK,kBAAkB;gBACnB,OAAO,IAAI,cAAM,CAAC,IAAI,EAAO,SAAS,EAAE,EAAE,GAAG,EAAE,CAAC,CAAA;YACpD,KAAK,2BAA2B;gBAC5B,OAAO,IAAI,uBAAe,CAAC,IAAI,EAAO,SAAS,EAAE,EAAE,GAAG,EAAE,CAAC,CAAA;YAC7D,KAAK,iBAAiB;gBAClB,OAAO,IAAI,aAAK,CAAC,IAAI,EAAO,SAAS,EAAE,EAAE,GAAG,EAAE,CAAC,CAAA;YACnD,KAAK,yBAAyB;gBAC1B,OAAO,IAAI,qBAAa,CAAC,IAAI,EAAO,SAAS,EAAE,EAAE,GAAG,EAAE,CAAC,CAAA;YAC3D,KAAK,eAAe;gBAChB,OAAO,IAAI,WAAG,CAAC,IAAI,EAAO,SAAS,EAAE,EAAE,GAAG,EAAE,CAAC,CAAA;YACjD,KAAK,uBAAuB;gBACxB,OAAO,IAAI,mBAAW,CAAC,IAAI,EAAO,SAAS,EAAE,EAAE,GAAG,EAAE,CAAC,CAAA;YACzD;gBACI,MAAM,IAAI,KAAK,CAAC,yBAAyB,IAAI,EAAE,CAAC,CAAC;SACxD;IACL,CAAC;CACJ,CAAC;AACF,MAAM,CAAC,OAAO,CAAC,sBAAsB,CAAC,OAAO,EAAE,KAAK,EAAE,OAAO,CAAC,CAAA"}

package/bin/aws/lambda.d.ts

@@ -24,6 +24,10 @@ export declare class Lambda extends pulumi.ComponentResource {
      * The ARN of the Lambda's IAM execution role.
      */
     readonly roleArn: pulumi.Output<string>;
+    /**
+     * The ID of the dedicated security group created for this Lambda. Only populated when vpc is set. Use this to grant other resources access to this Lambda via the grant system.
+     */
+    readonly securityGroupId: pulumi.Output<string | undefined>;
     /**
      * Create a Lambda resource with the given unique name, arguments, and options.
      *
@@ -97,11 +101,11 @@ export interface LambdaArgs {
     tracing?: pulumi.Input<boolean>;
     transform?: pulumi.Input<inputs.aws.LambdaTransformArgsArgs>;
     /**
-     * Enable a direct HTTPS endpoint for the function. Auth mode is AWS_IAM — never public. Default: false.
+     * Enable a direct HTTPS endpoint for the function. Auth mode is AWS_IAM - never public. Default: false.
      */
     url?: pulumi.Input<boolean>;
     /**
-     * VPC ID to place the Lambda in for access to private resources (RDS, ElastiCache, etc.).
+     * Places the Lambda inside a VPC for access to private resources such as RDS or ElastiCache. Anvil creates a dedicated security group with zero inbound and zero outbound rules. Nothing is reachable until explicitly granted via the grant system.
      */
-    vpc?: pulumi.Input<string>;
+    vpc?: pulumi.Input<inputs.aws.LambdaVpcArgsArgs>;
 }

package/bin/aws/lambda.js

@@ -52,12 +52,14 @@ class Lambda extends pulumi.ComponentResource {
             resourceInputs["functionName"] = undefined /*out*/;
             resourceInputs["functionUrl"] = undefined /*out*/;
             resourceInputs["roleArn"] = undefined /*out*/;
+            resourceInputs["securityGroupId"] = undefined /*out*/;
         }
         else {
             resourceInputs["arn"] = undefined /*out*/;
             resourceInputs["functionName"] = undefined /*out*/;
             resourceInputs["functionUrl"] = undefined /*out*/;
             resourceInputs["roleArn"] = undefined /*out*/;
+            resourceInputs["securityGroupId"] = undefined /*out*/;
         }
         opts = pulumi.mergeOptions(utilities.resourceOptsDefaults(), opts);
         super(Lambda.__pulumiType, name, resourceInputs, opts, true /*remote*/);

package/bin/aws/lambda.js.map

@@ -1 +1 @@
-{"version":3,"file":"lambda.js","sourceRoot":"","sources":["../../aws/lambda.ts"],"names":[],"mappings":";AAAA,sEAAsE;AACtE,iFAAiF;;;AAEjF,yCAAyC;AAIzC,0CAA0C;AAG1C,oCAAoC;AAEpC,MAAa,MAAO,SAAQ,MAAM,CAAC,iBAAiB;IAOhD;;;OAGG;IACI,MAAM,CAAC,UAAU,CAAC,GAAQ;QAC7B,IAAI,GAAG,KAAK,SAAS,IAAI,GAAG,KAAK,IAAI,EAAE;YACnC,OAAO,KAAK,CAAC;SAChB;QACD,OAAO,GAAG,CAAC,cAAc,CAAC,KAAK,MAAM,CAAC,YAAY,CAAC;IACvD,CAAC;IAmBD;;;;;;OAMG;IACH,YAAY,IAAY,EAAE,IAAgB,EAAE,IAAsC;QAC9E,IAAI,cAAc,GAAkB,EAAE,CAAC;QACvC,IAAI,GAAG,IAAI,IAAI,EAAE,CAAC;QAClB,IAAI,CAAC,IAAI,CAAC,EAAE,EAAE;YACV,IAAI,IAAI,EAAE,OAAO,KAAK,SAAS,IAAI,CAAC,IAAI,CAAC,GAAG,EAAE;gBAC1C,MAAM,IAAI,KAAK,CAAC,qCAAqC,CAAC,CAAC;aAC1D;YACD,IAAI,IAAI,EAAE,OAAO,KAAK,SAAS,IAAI,CAAC,IAAI,CAAC,GAAG,EAAE;gBAC1C,MAAM,IAAI,KAAK,CAAC,qCAAqC,CAAC,CAAC;aAC1D;YACD,cAAc,CAAC,cAAc,CAAC,GAAG,IAAI,EAAE,YAAY,CAAC;YACpD,cAAc,CAAC,YAAY,CAAC,GAAG,IAAI,EAAE,UAAU,CAAC;YAChD,cAAc,CAAC,OAAO,CAAC,GAAG,IAAI,EAAE,KAAK,CAAC;YACtC,cAAc,CAAC,aAAa,CAAC,GAAG,IAAI,EAAE,WAAW,CAAC;YAClD,cAAc,CAAC,SAAS,CAAC,GAAG,IAAI,EAAE,OAAO,CAAC;YAC1C,cAAc,CAAC,cAAc,CAAC,GAAG,IAAI,EAAE,YAAY,CAAC;YACpD,cAAc,CAAC,QAAQ,CAAC,GAAG,IAAI,EAAE,MAAM,CAAC;YACxC,cAAc,CAAC,aAAa,CAAC,GAAG,IAAI,EAAE,WAAW,CAAC;YAClD,cAAc,CAAC,SAAS,CAAC,GAAG,IAAI,EAAE,OAAO,CAAC;YAC1C,cAAc,CAAC,SAAS,CAAC,GAAG,IAAI,EAAE,OAAO,CAAC;YAC1C,cAAc,CAAC,SAAS,CAAC,GAAG,IAAI,EAAE,OAAO,CAAC;YAC1C,cAAc,CAAC,WAAW,CAAC,GAAG,IAAI,EAAE,SAAS,CAAC;YAC9C,cAAc,CAAC,KAAK,CAAC,GAAG,IAAI,EAAE,GAAG,CAAC;YAClC,cAAc,CAAC,KAAK,CAAC,GAAG,IAAI,EAAE,GAAG,CAAC;YAClC,cAAc,CAAC,KAAK,CAAC,GAAG,SAAS,CAAC,OAAO,CAAC;YAC1C,cAAc,CAAC,cAAc,CAAC,GAAG,SAAS,CAAC,OAAO,CAAC;YACnD,cAAc,CAAC,aAAa,CAAC,GAAG,SAAS,CAAC,OAAO,CAAC;YAClD,cAAc,CAAC,SAAS,CAAC,GAAG,SAAS,CAAC,OAAO,CAAC;SACjD;aAAM;YACH,cAAc,CAAC,KAAK,CAAC,GAAG,SAAS,CAAC,OAAO,CAAC;YAC1C,cAAc,CAAC,cAAc,CAAC,GAAG,SAAS,CAAC,OAAO,CAAC;YACnD,cAAc,CAAC,aAAa,CAAC,GAAG,SAAS,CAAC,OAAO,CAAC;YAClD,cAAc,CAAC,SAAS,CAAC,GAAG,SAAS,CAAC,OAAO,CAAC;SACjD;QACD,IAAI,GAAG,MAAM,CAAC,YAAY,CAAC,SAAS,CAAC,oBAAoB,EAAE,EAAE,IAAI,CAAC,CAAC;QACnE,KAAK,CAAC,MAAM,CAAC,YAAY,EAAE,IAAI,EAAE,cAAc,EAAE,IAAI,EAAE,IAAI,CAAC,UAAU,CAAC,CAAC;QACxE,IAAI,CAAC,MAAM,GAAG,IAAI,CAAC;IACvB,CAAC;IAED;;;;;;OAMG;IACI,WAAW,CAAC,MAA0B,EAAE,IAA0B;QACrE,MAAM,IAAI,GAAG,GAAG,IAAI,CAAC,MAAM,IAAI,MAAM,CAAC,SAAS,EAAE,SAAS,CAAC;QAC3D,MAAM,IAAI,GAAG,MAAM,CAAC,iBAAiB,CAAC,IAAI,CAAC,GAAG,EAAE,SAAS,CAAC,CAAC;QAC3D,MAAM,CAAC,WAAW,CAAC,IAAI,EAAE,IAAI,EAAE,MAAM,EAAE,CAAC,uBAAuB,CAAC,EAAE,IAAI,EAAE,IAAI,CAAC,CAAC;IAClF,CAAC;IACD,kEAAkE;IAC3D,SAAS;QACZ,OAAO,IAAI,CAAC,MAAM,CAAC;IACvB,CAAC;IAED,mEAAmE;IAC5D,YAAY;QACf,OAAO,IAAI,CAAC,OAAO,CAAC;IACxB,CAAC;;AArGL,wBAuGC;AAtGG,gBAAgB;AACO,mBAAY,GAAG,kBAAkB,CAAC"}
+{"version":3,"file":"lambda.js","sourceRoot":"","sources":["../../aws/lambda.ts"],"names":[],"mappings":";AAAA,sEAAsE;AACtE,iFAAiF;;;AAEjF,yCAAyC;AAIzC,0CAA0C;AAG1C,oCAAoC;AAEpC,MAAa,MAAO,SAAQ,MAAM,CAAC,iBAAiB;IAOhD;;;OAGG;IACI,MAAM,CAAC,UAAU,CAAC,GAAQ;QAC7B,IAAI,GAAG,KAAK,SAAS,IAAI,GAAG,KAAK,IAAI,EAAE;YACnC,OAAO,KAAK,CAAC;SAChB;QACD,OAAO,GAAG,CAAC,cAAc,CAAC,KAAK,MAAM,CAAC,YAAY,CAAC;IACvD,CAAC;IAuBD;;;;;;OAMG;IACH,YAAY,IAAY,EAAE,IAAgB,EAAE,IAAsC;QAC9E,IAAI,cAAc,GAAkB,EAAE,CAAC;QACvC,IAAI,GAAG,IAAI,IAAI,EAAE,CAAC;QAClB,IAAI,CAAC,IAAI,CAAC,EAAE,EAAE;YACV,IAAI,IAAI,EAAE,OAAO,KAAK,SAAS,IAAI,CAAC,IAAI,CAAC,GAAG,EAAE;gBAC1C,MAAM,IAAI,KAAK,CAAC,qCAAqC,CAAC,CAAC;aAC1D;YACD,IAAI,IAAI,EAAE,OAAO,KAAK,SAAS,IAAI,CAAC,IAAI,CAAC,GAAG,EAAE;gBAC1C,MAAM,IAAI,KAAK,CAAC,qCAAqC,CAAC,CAAC;aAC1D;YACD,cAAc,CAAC,cAAc,CAAC,GAAG,IAAI,EAAE,YAAY,CAAC;YACpD,cAAc,CAAC,YAAY,CAAC,GAAG,IAAI,EAAE,UAAU,CAAC;YAChD,cAAc,CAAC,OAAO,CAAC,GAAG,IAAI,EAAE,KAAK,CAAC;YACtC,cAAc,CAAC,aAAa,CAAC,GAAG,IAAI,EAAE,WAAW,CAAC;YAClD,cAAc,CAAC,SAAS,CAAC,GAAG,IAAI,EAAE,OAAO,CAAC;YAC1C,cAAc,CAAC,cAAc,CAAC,GAAG,IAAI,EAAE,YAAY,CAAC;YACpD,cAAc,CAAC,QAAQ,CAAC,GAAG,IAAI,EAAE,MAAM,CAAC;YACxC,cAAc,CAAC,aAAa,CAAC,GAAG,IAAI,EAAE,WAAW,CAAC;YAClD,cAAc,CAAC,SAAS,CAAC,GAAG,IAAI,EAAE,OAAO,CAAC;YAC1C,cAAc,CAAC,SAAS,CAAC,GAAG,IAAI,EAAE,OAAO,CAAC;YAC1C,cAAc,CAAC,SAAS,CAAC,GAAG,IAAI,EAAE,OAAO,CAAC;YAC1C,cAAc,CAAC,WAAW,CAAC,GAAG,IAAI,EAAE,SAAS,CAAC;YAC9C,cAAc,CAAC,KAAK,CAAC,GAAG,IAAI,EAAE,GAAG,CAAC;YAClC,cAAc,CAAC,KAAK,CAAC,GAAG,IAAI,EAAE,GAAG,CAAC;YAClC,cAAc,CAAC,KAAK,CAAC,GAAG,SAAS,CAAC,OAAO,CAAC;YAC1C,cAAc,CAAC,cAAc,CAAC,GAAG,SAAS,CAAC,OAAO,CAAC;YACnD,cAAc,CAAC,aAAa,CAAC,GAAG,SAAS,CAAC,OAAO,CAAC;YAClD,cAAc,CAAC,SAAS,CAAC,GAAG,SAAS,CAAC,OAAO,CAAC;YAC9C,cAAc,CAAC,iBAAiB,CAAC,GAAG,SAAS,CAAC,OAAO,CAAC;SACzD;aAAM;YACH,cAAc,CAAC,KAAK,CAAC,GAAG,SAAS,CAAC,OAAO,CAAC;YAC1C,cAAc,CAAC,cAAc,CAAC,GAAG,SAAS,CAAC,OAAO,CAAC;YACnD,cAAc,CAAC,aAAa,CAAC,GAAG,SAAS,CAAC,OAAO,CAAC;YAClD,cAAc,CAAC,SAAS,CAAC,GAAG,SAAS,CAAC,OAAO,CAAC;YAC9C,cAAc,CAAC,iBAAiB,CAAC,GAAG,SAAS,CAAC,OAAO,CAAC;SACzD;QACD,IAAI,GAAG,MAAM,CAAC,YAAY,CAAC,SAAS,CAAC,oBAAoB,EAAE,EAAE,IAAI,CAAC,CAAC;QACnE,KAAK,CAAC,MAAM,CAAC,YAAY,EAAE,IAAI,EAAE,cAAc,EAAE,IAAI,EAAE,IAAI,CAAC,UAAU,CAAC,CAAC;QACxE,IAAI,CAAC,MAAM,GAAG,IAAI,CAAC;IACvB,CAAC;IAED;;;;;;OAMG;IACI,WAAW,CAAC,MAA0B,EAAE,IAA0B;QACrE,MAAM,IAAI,GAAG,GAAG,IAAI,CAAC,MAAM,IAAI,MAAM,CAAC,SAAS,EAAE,SAAS,CAAC;QAC3D,MAAM,IAAI,GAAG,MAAM,CAAC,iBAAiB,CAAC,IAAI,CAAC,GAAG,EAAE,SAAS,CAAC,CAAC;QAC3D,MAAM,CAAC,WAAW,CAAC,IAAI,EAAE,IAAI,EAAE,MAAM,EAAE,CAAC,uBAAuB,CAAC,EAAE,IAAI,EAAE,IAAI,CAAC,CAAC;IAClF,CAAC;IACD,kEAAkE;IAC3D,SAAS;QACZ,OAAO,IAAI,CAAC,MAAM,CAAC;IACvB,CAAC;IAED,mEAAmE;IAC5D,YAAY;QACf,OAAO,IAAI,CAAC,OAAO,CAAC;IACxB,CAAC;;AA3GL,wBA6GC;AA5GG,gBAAgB;AACO,mBAAY,GAAG,kBAAkB,CAAC"}

package/bin/aws/oauthAuthorizer.d.ts

@@ -0,0 +1,36 @@
+import * as pulumi from "@pulumi/pulumi";
+/**
+ * An Anvil-managed JWT authorizer for HTTP API Gateway. Works with any OIDC-compliant identity provider — Auth0, Clerk, Google, Okta, Cognito. API Gateway verifies the JWT signature, issuer, audience, and expiry on every request natively — no Lambda or custom code required. Pass authorizerId to HttpApi defaultAuthorizerId to protect your routes.
+ */
+export declare class OAuthAuthorizer extends pulumi.ComponentResource {
+    /**
+     * Returns true if the given object is an instance of OAuthAuthorizer.  This is designed to work even
+     * when multiple copies of the Pulumi SDK have been loaded into the same process.
+     */
+    static isInstance(obj: any): obj is OAuthAuthorizer;
+    /**
+     * The API Gateway authorizer ID. Pass this to HttpApi defaultAuthorizerId to protect your API routes.
+     */
+    readonly authorizerId: pulumi.Output<string>;
+    /**
+     * Create a OAuthAuthorizer resource with the given unique name, arguments, and options.
+     *
+     * @param name The _unique_ name of the resource.
+     * @param args The arguments to use to populate this resource's properties.
+     * @param opts A bag of options that control this resource's behavior.
+     */
+    constructor(name: string, args: OAuthAuthorizerArgs, opts?: pulumi.ComponentResourceOptions);
+}
+/**
+ * The set of arguments for constructing a OAuthAuthorizer resource.
+ */
+export interface OAuthAuthorizerArgs {
+    /**
+     * The intended recipients of the JWT. API Gateway rejects tokens whose 'aud' claim does not match one of these values. Typically your API's client ID registered with the identity provider.
+     */
+    audience: pulumi.Input<pulumi.Input<string>[]>;
+    /**
+     * The OIDC issuer URL of your identity provider. API Gateway fetches public signing keys from {issuer}/.well-known/jwks.json to verify token signatures. Examples: Auth0: 'https://your-tenant.auth0.com/', Clerk: 'https://your-instance.clerk.accounts.dev', Google: 'https://accounts.google.com'.
+     */
+    issuer: pulumi.Input<string>;
+}

package/bin/aws/oauthAuthorizer.js

@@ -0,0 +1,53 @@
+"use strict";
+// *** WARNING: this file was generated by pulumi-language-nodejs. ***
+// *** Do not edit by hand unless you're certain you know what you are doing! ***
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.OAuthAuthorizer = void 0;
+const pulumi = require("@pulumi/pulumi");
+const utilities = require("../utilities");
+/**
+ * An Anvil-managed JWT authorizer for HTTP API Gateway. Works with any OIDC-compliant identity provider — Auth0, Clerk, Google, Okta, Cognito. API Gateway verifies the JWT signature, issuer, audience, and expiry on every request natively — no Lambda or custom code required. Pass authorizerId to HttpApi defaultAuthorizerId to protect your routes.
+ */
+class OAuthAuthorizer extends pulumi.ComponentResource {
+    /**
+     * Returns true if the given object is an instance of OAuthAuthorizer.  This is designed to work even
+     * when multiple copies of the Pulumi SDK have been loaded into the same process.
+     */
+    static isInstance(obj) {
+        if (obj === undefined || obj === null) {
+            return false;
+        }
+        return obj['__pulumiType'] === OAuthAuthorizer.__pulumiType;
+    }
+    /**
+     * Create a OAuthAuthorizer resource with the given unique name, arguments, and options.
+     *
+     * @param name The _unique_ name of the resource.
+     * @param args The arguments to use to populate this resource's properties.
+     * @param opts A bag of options that control this resource's behavior.
+     */
+    constructor(name, args, opts) {
+        let resourceInputs = {};
+        opts = opts || {};
+        if (!opts.id) {
+            if (args?.audience === undefined && !opts.urn) {
+                throw new Error("Missing required property 'audience'");
+            }
+            if (args?.issuer === undefined && !opts.urn) {
+                throw new Error("Missing required property 'issuer'");
+            }
+            resourceInputs["audience"] = args?.audience;
+            resourceInputs["issuer"] = args?.issuer;
+            resourceInputs["authorizerId"] = undefined /*out*/;
+        }
+        else {
+            resourceInputs["authorizerId"] = undefined /*out*/;
+        }
+        opts = pulumi.mergeOptions(utilities.resourceOptsDefaults(), opts);
+        super(OAuthAuthorizer.__pulumiType, name, resourceInputs, opts, true /*remote*/);
+    }
+}
+exports.OAuthAuthorizer = OAuthAuthorizer;
+/** @internal */
+OAuthAuthorizer.__pulumiType = 'anvil:aws:OAuthAuthorizer';
+//# sourceMappingURL=oauthAuthorizer.js.map

package/bin/aws/oauthAuthorizer.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"oauthAuthorizer.js","sourceRoot":"","sources":["../../aws/oauthAuthorizer.ts"],"names":[],"mappings":";AAAA,sEAAsE;AACtE,iFAAiF;;;AAEjF,yCAAyC;AACzC,0CAA0C;AAE1C;;GAEG;AACH,MAAa,eAAgB,SAAQ,MAAM,CAAC,iBAAiB;IAIzD;;;OAGG;IACI,MAAM,CAAC,UAAU,CAAC,GAAQ;QAC7B,IAAI,GAAG,KAAK,SAAS,IAAI,GAAG,KAAK,IAAI,EAAE;YACnC,OAAO,KAAK,CAAC;SAChB;QACD,OAAO,GAAG,CAAC,cAAc,CAAC,KAAK,eAAe,CAAC,YAAY,CAAC;IAChE,CAAC;IAOD;;;;;;OAMG;IACH,YAAY,IAAY,EAAE,IAAyB,EAAE,IAAsC;QACvF,IAAI,cAAc,GAAkB,EAAE,CAAC;QACvC,IAAI,GAAG,IAAI,IAAI,EAAE,CAAC;QAClB,IAAI,CAAC,IAAI,CAAC,EAAE,EAAE;YACV,IAAI,IAAI,EAAE,QAAQ,KAAK,SAAS,IAAI,CAAC,IAAI,CAAC,GAAG,EAAE;gBAC3C,MAAM,IAAI,KAAK,CAAC,sCAAsC,CAAC,CAAC;aAC3D;YACD,IAAI,IAAI,EAAE,MAAM,KAAK,SAAS,IAAI,CAAC,IAAI,CAAC,GAAG,EAAE;gBACzC,MAAM,IAAI,KAAK,CAAC,oCAAoC,CAAC,CAAC;aACzD;YACD,cAAc,CAAC,UAAU,CAAC,GAAG,IAAI,EAAE,QAAQ,CAAC;YAC5C,cAAc,CAAC,QAAQ,CAAC,GAAG,IAAI,EAAE,MAAM,CAAC;YACxC,cAAc,CAAC,cAAc,CAAC,GAAG,SAAS,CAAC,OAAO,CAAC;SACtD;aAAM;YACH,cAAc,CAAC,cAAc,CAAC,GAAG,SAAS,CAAC,OAAO,CAAC;SACtD;QACD,IAAI,GAAG,MAAM,CAAC,YAAY,CAAC,SAAS,CAAC,oBAAoB,EAAE,EAAE,IAAI,CAAC,CAAC;QACnE,KAAK,CAAC,eAAe,CAAC,YAAY,EAAE,IAAI,EAAE,cAAc,EAAE,IAAI,EAAE,IAAI,CAAC,UAAU,CAAC,CAAC;IACrF,CAAC;;AA7CL,0CA8CC;AA7CG,gBAAgB;AACO,4BAAY,GAAG,2BAA2B,CAAC"}

package/bin/aws/queue.d.ts

@@ -0,0 +1,83 @@
+import * as pulumi from "@pulumi/pulumi";
+import * as inputs from "../types/input";
+import * as grants from "../grants";
+/**
+ * An Anvil-managed SQS queue. A dead letter queue is always provisioned to prevent silent message loss. SSE-SQS encryption is enabled by default at no cost.
+ */
+export declare class Queue extends pulumi.ComponentResource {
+    /**
+     * Returns true if the given object is an instance of Queue.  This is designed to work even
+     * when multiple copies of the Pulumi SDK have been loaded into the same process.
+     */
+    static isInstance(obj: any): obj is Queue;
+    /**
+     * The ARN of the SQS queue.
+     */
+    readonly arn: pulumi.Output<string>;
+    /**
+     * The ARN of the dead letter queue.
+     */
+    readonly dlqArn: pulumi.Output<string>;
+    /**
+     * The URL of the dead letter queue.
+     */
+    readonly dlqUrl: pulumi.Output<string>;
+    /**
+     * The physical name of the SQS queue.
+     */
+    readonly name: pulumi.Output<string>;
+    /**
+     * The URL of the SQS queue. Use this to send and receive messages.
+     */
+    readonly url: pulumi.Output<string>;
+    /**
+     * Create a Queue resource with the given unique name, arguments, and options.
+     *
+     * @param name The _unique_ name of the resource.
+     * @param args The arguments to use to populate this resource's properties.
+     * @param opts A bag of options that control this resource's behavior.
+     */
+    constructor(name: string, args?: QueueArgs, opts?: pulumi.ComponentResourceOptions);
+    /**
+     * Grants sendmessage access (sqs:SendMessage) on this queue
+     * to the target compute resource's execution role.
+     *
+     * @param target - The compute resource to grant access to.
+     * @param opts - Optional grant options (justification for audit trail).
+     */
+    grantSendMessage(target: grants.GrantTarget, opts?: grants.GrantOptions): void;
+    /**
+     * Grants consumemessages access (sqs:ReceiveMessage, sqs:DeleteMessage, sqs:GetQueueAttributes) on this queue
+     * to the target compute resource's execution role.
+     *
+     * @param target - The compute resource to grant access to.
+     * @param opts - Optional grant options (justification for audit trail).
+     */
+    grantConsumeMessages(target: grants.GrantTarget, opts?: grants.GrantOptions): void;
+    /**
+     * Grants full access (sqs:SendMessage, sqs:ReceiveMessage, sqs:DeleteMessage, sqs:GetQueueAttributes, sqs:ChangeMessageVisibility, sqs:PurgeQueue) on this queue
+     * to the target compute resource's execution role.
+     *
+     * This is an escape hatch — prefer scoped grants (grantRead, grantWrite, etc.).
+     * A warning is logged if no justification is provided.
+     */
+    grantFullAccess(target: grants.GrantTarget, opts?: grants.GrantOptions): void;
+}
+/**
+ * The set of arguments for constructing a Queue resource.
+ */
+export interface QueueArgs {
+    /**
+     * Wires a compute resource to consume messages from this queue. Creates the event source mapping (trigger) and grants the necessary IAM permissions automatically.
+     */
+    consumer?: pulumi.Input<inputs.aws.QueueConsumerArgsArgs>;
+    /**
+     * Dead letter queue configuration. Always provisioned — messages that fail processing are moved here instead of being silently dropped. Omit to use defaults (managed DLQ, maxReceiveCount: 3). Set arn to reuse an existing queue.
+     */
+    dlq?: pulumi.Input<inputs.aws.QueueDlqArgsArgs>;
+    /**
+     * Creates a FIFO queue when true. FIFO queues guarantee message ordering and exactly-once processing but have lower throughput (~3,000 msg/s vs unlimited for standard). Use for financial transactions, inventory updates, or any workflow where ordering or deduplication matters. Default: false.
+     */
+    fifo?: pulumi.Input<boolean>;
+    transform?: pulumi.Input<inputs.aws.QueueTransformArgsArgs>;
+}

package/bin/aws/queue.js

@@ -0,0 +1,103 @@
+"use strict";
+// *** WARNING: this file was generated by pulumi-language-nodejs. ***
+// *** Do not edit by hand unless you're certain you know what you are doing! ***
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.Queue = void 0;
+const pulumi = require("@pulumi/pulumi");
+const utilities = require("../utilities");
+const grants = require("../grants");
+/**
+ * An Anvil-managed SQS queue. A dead letter queue is always provisioned to prevent silent message loss. SSE-SQS encryption is enabled by default at no cost.
+ */
+class Queue extends pulumi.ComponentResource {
+    /**
+     * Returns true if the given object is an instance of Queue.  This is designed to work even
+     * when multiple copies of the Pulumi SDK have been loaded into the same process.
+     */
+    static isInstance(obj) {
+        if (obj === undefined || obj === null) {
+            return false;
+        }
+        return obj['__pulumiType'] === Queue.__pulumiType;
+    }
+    /**
+     * Create a Queue resource with the given unique name, arguments, and options.
+     *
+     * @param name The _unique_ name of the resource.
+     * @param args The arguments to use to populate this resource's properties.
+     * @param opts A bag of options that control this resource's behavior.
+     */
+    constructor(name, args, opts) {
+        let resourceInputs = {};
+        opts = opts || {};
+        if (!opts.id) {
+            resourceInputs["consumer"] = args?.consumer;
+            resourceInputs["dlq"] = args?.dlq;
+            resourceInputs["fifo"] = args?.fifo;
+            resourceInputs["transform"] = args?.transform;
+            resourceInputs["arn"] = undefined /*out*/;
+            resourceInputs["dlqArn"] = undefined /*out*/;
+            resourceInputs["dlqUrl"] = undefined /*out*/;
+            resourceInputs["name"] = undefined /*out*/;
+            resourceInputs["url"] = undefined /*out*/;
+        }
+        else {
+            resourceInputs["arn"] = undefined /*out*/;
+            resourceInputs["dlqArn"] = undefined /*out*/;
+            resourceInputs["dlqUrl"] = undefined /*out*/;
+            resourceInputs["name"] = undefined /*out*/;
+            resourceInputs["url"] = undefined /*out*/;
+        }
+        opts = pulumi.mergeOptions(utilities.resourceOptsDefaults(), opts);
+        super(Queue.__pulumiType, name, resourceInputs, opts, true /*remote*/);
+        this.__name = name;
+    }
+    /**
+     * Grants sendmessage access (sqs:SendMessage) on this queue
+     * to the target compute resource's execution role.
+     *
+     * @param target - The compute resource to grant access to.
+     * @param opts - Optional grant options (justification for audit trail).
+     */
+    grantSendMessage(target, opts) {
+        const name = `${this.__name}-${target.grantName()}-sendmessage`;
+        const arns = grants.buildResourceArns(this.arn, undefined);
+        grants.createGrant(this, name, target, ["sqs:SendMessage"], arns, opts);
+    }
+    /**
+     * Grants consumemessages access (sqs:ReceiveMessage, sqs:DeleteMessage, sqs:GetQueueAttributes) on this queue
+     * to the target compute resource's execution role.
+     *
+     * @param target - The compute resource to grant access to.
+     * @param opts - Optional grant options (justification for audit trail).
+     */
+    grantConsumeMessages(target, opts) {
+        const name = `${this.__name}-${target.grantName()}-consumemessages`;
+        const arns = grants.buildResourceArns(this.arn, undefined);
+        grants.createGrant(this, name, target, ["sqs:ReceiveMessage", "sqs:DeleteMessage", "sqs:GetQueueAttributes"], arns, opts);
+    }
+    /**
+     * Grants full access (sqs:SendMessage, sqs:ReceiveMessage, sqs:DeleteMessage, sqs:GetQueueAttributes, sqs:ChangeMessageVisibility, sqs:PurgeQueue) on this queue
+     * to the target compute resource's execution role.
+     *
+     * This is an escape hatch — prefer scoped grants (grantRead, grantWrite, etc.).
+     * A warning is logged if no justification is provided.
+     */
+    grantFullAccess(target, opts) {
+        if (!opts?.justification) {
+            pulumi.log.warn(`⚠ ${this.__name} → ${target.grantName()}: full access granted with no justification. ` +
+                `Consider scoping with grantRead, grantWrite, or grantDelete, ` +
+                `or add a justification.`, this);
+        }
+        else {
+            pulumi.log.info(`ℹ ${this.__name} → ${target.grantName()}: full access granted. Justification: "${opts.justification}"`, this);
+        }
+        const name = `${this.__name}-${target.grantName()}-fullaccess`;
+        const arns = grants.buildResourceArns(this.arn, undefined);
+        grants.createGrant(this, name, target, ["sqs:SendMessage", "sqs:ReceiveMessage", "sqs:DeleteMessage", "sqs:GetQueueAttributes", "sqs:ChangeMessageVisibility", "sqs:PurgeQueue"], arns, opts);
+    }
+}
+exports.Queue = Queue;
+/** @internal */
+Queue.__pulumiType = 'anvil:aws:Queue';
+//# sourceMappingURL=queue.js.map

package/bin/aws/queue.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"queue.js","sourceRoot":"","sources":["../../aws/queue.ts"],"names":[],"mappings":";AAAA,sEAAsE;AACtE,iFAAiF;;;AAEjF,yCAAyC;AAIzC,0CAA0C;AAC1C,oCAAoC;AAEpC;;GAEG;AACH,MAAa,KAAM,SAAQ,MAAM,CAAC,iBAAiB;IAO/C;;;OAGG;IACI,MAAM,CAAC,UAAU,CAAC,GAAQ;QAC7B,IAAI,GAAG,KAAK,SAAS,IAAI,GAAG,KAAK,IAAI,EAAE;YACnC,OAAO,KAAK,CAAC;SAChB;QACD,OAAO,GAAG,CAAC,cAAc,CAAC,KAAK,KAAK,CAAC,YAAY,CAAC;IACtD,CAAC;IAuBD;;;;;;OAMG;IACH,YAAY,IAAY,EAAE,IAAgB,EAAE,IAAsC;QAC9E,IAAI,cAAc,GAAkB,EAAE,CAAC;QACvC,IAAI,GAAG,IAAI,IAAI,EAAE,CAAC;QAClB,IAAI,CAAC,IAAI,CAAC,EAAE,EAAE;YACV,cAAc,CAAC,UAAU,CAAC,GAAG,IAAI,EAAE,QAAQ,CAAC;YAC5C,cAAc,CAAC,KAAK,CAAC,GAAG,IAAI,EAAE,GAAG,CAAC;YAClC,cAAc,CAAC,MAAM,CAAC,GAAG,IAAI,EAAE,IAAI,CAAC;YACpC,cAAc,CAAC,WAAW,CAAC,GAAG,IAAI,EAAE,SAAS,CAAC;YAC9C,cAAc,CAAC,KAAK,CAAC,GAAG,SAAS,CAAC,OAAO,CAAC;YAC1C,cAAc,CAAC,QAAQ,CAAC,GAAG,SAAS,CAAC,OAAO,CAAC;YAC7C,cAAc,CAAC,QAAQ,CAAC,GAAG,SAAS,CAAC,OAAO,CAAC;YAC7C,cAAc,CAAC,MAAM,CAAC,GAAG,SAAS,CAAC,OAAO,CAAC;YAC3C,cAAc,CAAC,KAAK,CAAC,GAAG,SAAS,CAAC,OAAO,CAAC;SAC7C;aAAM;YACH,cAAc,CAAC,KAAK,CAAC,GAAG,SAAS,CAAC,OAAO,CAAC;YAC1C,cAAc,CAAC,QAAQ,CAAC,GAAG,SAAS,CAAC,OAAO,CAAC;YAC7C,cAAc,CAAC,QAAQ,CAAC,GAAG,SAAS,CAAC,OAAO,CAAC;YAC7C,cAAc,CAAC,MAAM,CAAC,GAAG,SAAS,CAAC,OAAO,CAAC;YAC3C,cAAc,CAAC,KAAK,CAAC,GAAG,SAAS,CAAC,OAAO,CAAC;SAC7C;QACD,IAAI,GAAG,MAAM,CAAC,YAAY,CAAC,SAAS,CAAC,oBAAoB,EAAE,EAAE,IAAI,CAAC,CAAC;QACnE,KAAK,CAAC,KAAK,CAAC,YAAY,EAAE,IAAI,EAAE,cAAc,EAAE,IAAI,EAAE,IAAI,CAAC,UAAU,CAAC,CAAC;QACvE,IAAI,CAAC,MAAM,GAAG,IAAI,CAAC;IACvB,CAAC;IAED;;;;;;OAMG;IACI,gBAAgB,CAAC,MAA0B,EAAE,IAA0B;QAC1E,MAAM,IAAI,GAAG,GAAG,IAAI,CAAC,MAAM,IAAI,MAAM,CAAC,SAAS,EAAE,cAAc,CAAC;QAChE,MAAM,IAAI,GAAG,MAAM,CAAC,iBAAiB,CAAC,IAAI,CAAC,GAAG,EAAE,SAAS,CAAC,CAAC;QAC3D,MAAM,CAAC,WAAW,CAAC,IAAI,EAAE,IAAI,EAAE,MAAM,EAAE,CAAC,iBAAiB,CAAC,EAAE,IAAI,EAAE,IAAI,CAAC,CAAC;IAC5E,CAAC;IAED;;;;;;OAMG;IACI,oBAAoB,CAAC,MAA0B,EAAE,IAA0B;QAC9E,MAAM,IAAI,GAAG,GAAG,IAAI,CAAC,MAAM,IAAI,MAAM,CAAC,SAAS,EAAE,kBAAkB,CAAC;QACpE,MAAM,IAAI,GAAG,MAAM,CAAC,iBAAiB,CAAC,IAAI,CAAC,GAAG,EAAE,SAAS,CAAC,CAAC;QAC3D,MAAM,CAAC,WAAW,CAAC,IAAI,EAAE,IAAI,EAAE,MAAM,EAAE,CAAC,oBAAoB,EAAE,mBAAmB,EAAE,wBAAwB,CAAC,EAAE,IAAI,EAAE,IAAI,CAAC,CAAC;IAC9H,CAAC;IAED;;;;;;OAMG;IACI,eAAe,CAAC,MAA0B,EAAE,IAA0B;QACzE,IAAI,CAAC,IAAI,EAAE,aAAa,EAAE;YACtB,MAAM,CAAC,GAAG,CAAC,IAAI,CACX,KAAK,IAAI,CAAC,MAAM,MAAM,MAAM,CAAC,SAAS,EAAE,+CAA+C;gBACvF,+DAA+D;gBAC/D,yBAAyB,EACzB,IAAI,CACP,CAAC;SACL;aAAM;YACH,MAAM,CAAC,GAAG,CAAC,IAAI,CACX,KAAK,IAAI,CAAC,MAAM,MAAM,MAAM,CAAC,SAAS,EAAE,0CAA0C,IAAI,CAAC,aAAa,GAAG,EACvG,IAAI,CACP,CAAC;SACL;QACD,MAAM,IAAI,GAAG,GAAG,IAAI,CAAC,MAAM,IAAI,MAAM,CAAC,SAAS,EAAE,aAAa,CAAC;QAC/D,MAAM,IAAI,GAAG,MAAM,CAAC,iBAAiB,CAAC,IAAI,CAAC,GAAG,EAAE,SAAS,CAAC,CAAC;QAC3D,MAAM,CAAC,WAAW,CAAC,IAAI,EAAE,IAAI,EAAE,MAAM,EAAE,CAAC,iBAAiB,EAAE,oBAAoB,EAAE,mBAAmB,EAAE,wBAAwB,EAAE,6BAA6B,EAAE,gBAAgB,CAAC,EAAE,IAAI,EAAE,IAAI,CAAC,CAAC;IAClM,CAAC;;AAzHL,sBA2HC;AA1HG,gBAAgB;AACO,kBAAY,GAAG,iBAAiB,CAAC"}

package/bin/aws/svelteKitSite.d.ts

@@ -1,4 +1,5 @@
 import * as pulumi from "@pulumi/pulumi";
+import * as inputs from "../types/input";
 export declare class SvelteKitSite extends pulumi.ComponentResource {
     /**
      * Returns true if the given object is an instance of SvelteKitSite.  This is designed to work even
@@ -9,6 +10,10 @@ export declare class SvelteKitSite extends pulumi.ComponentResource {
     readonly cloudFrontDistributionId: pulumi.Output<string | undefined>;
     readonly dnsRecords: pulumi.Output<string | undefined>;
     readonly functionName: pulumi.Output<string | undefined>;
+    /**
+     * OriginSecret is the x-origin-secret header value to configure in Cloudflare Transform Rules. Only populated when originProtection is set.
+     */
+    readonly originSecret: pulumi.Output<string | undefined>;
     readonly url: pulumi.Output<string | undefined>;
     /**
      * Create a SvelteKitSite resource with the given unique name, arguments, and options.
@@ -30,6 +35,10 @@ export interface SvelteKitSiteArgs {
     environment?: pulumi.Input<{
         [key: string]: pulumi.Input<string>;
     }>;
+    /**
+     * OriginProtection enables WAF-based origin protection. When set, a WAF WebACL is created that blocks requests missing the x-origin-secret header. The secret value is output as originSecret. Requires domain to be set.
+     */
+    originProtection?: pulumi.Input<inputs.aws.SiteOriginProtectionArgs>;
     path?: pulumi.Input<string>;
     /**
      * Runtime-only environment vars set on the Lambda function. Supports Pulumi Output values (e.g. bucket.name, fn.arn). Only available at request time, NOT during build/prerendering.

package/bin/aws/svelteKitSite.js

@@ -29,6 +29,7 @@ class SvelteKitSite extends pulumi.ComponentResource {
         if (!opts.id) {
             resourceInputs["domain"] = args?.domain;
             resourceInputs["environment"] = args?.environment;
+            resourceInputs["originProtection"] = args?.originProtection;
             resourceInputs["path"] = args?.path;
             resourceInputs["runtimeEnvironment"] = args?.runtimeEnvironment;
             resourceInputs["transform"] = args?.transform;
@@ -36,6 +37,7 @@ class SvelteKitSite extends pulumi.ComponentResource {
             resourceInputs["cloudFrontDistributionId"] = undefined /*out*/;
             resourceInputs["dnsRecords"] = undefined /*out*/;
             resourceInputs["functionName"] = undefined /*out*/;
+            resourceInputs["originSecret"] = undefined /*out*/;
             resourceInputs["url"] = undefined /*out*/;
         }
         else {
@@ -43,6 +45,7 @@ class SvelteKitSite extends pulumi.ComponentResource {
             resourceInputs["cloudFrontDistributionId"] = undefined /*out*/;
             resourceInputs["dnsRecords"] = undefined /*out*/;
             resourceInputs["functionName"] = undefined /*out*/;
+            resourceInputs["originSecret"] = undefined /*out*/;
             resourceInputs["url"] = undefined /*out*/;
         }
         opts = pulumi.mergeOptions(utilities.resourceOptsDefaults(), opts);

package/bin/aws/svelteKitSite.js.map

@@ -1 +1 @@
-{"version":3,"file":"svelteKitSite.js","sourceRoot":"","sources":["../../aws/svelteKitSite.ts"],"names":[],"mappings":";AAAA,sEAAsE;AACtE,iFAAiF;;;AAEjF,yCAAyC;AACzC,0CAA0C;AAE1C,MAAa,aAAc,SAAQ,MAAM,CAAC,iBAAiB;IAIvD;;;OAGG;IACI,MAAM,CAAC,UAAU,CAAC,GAAQ;QAC7B,IAAI,GAAG,KAAK,SAAS,IAAI,GAAG,KAAK,IAAI,EAAE;YACnC,OAAO,KAAK,CAAC;SAChB;QACD,OAAO,GAAG,CAAC,cAAc,CAAC,KAAK,aAAa,CAAC,YAAY,CAAC;IAC9D,CAAC;IAQD;;;;;;OAMG;IACH,YAAY,IAAY,EAAE,IAAwB,EAAE,IAAsC;QACtF,IAAI,cAAc,GAAkB,EAAE,CAAC;QACvC,IAAI,GAAG,IAAI,IAAI,EAAE,CAAC;QAClB,IAAI,CAAC,IAAI,CAAC,EAAE,EAAE;YACV,cAAc,CAAC,QAAQ,CAAC,GAAG,IAAI,EAAE,MAAM,CAAC;YACxC,cAAc,CAAC,aAAa,CAAC,GAAG,IAAI,EAAE,WAAW,CAAC;YAClD,cAAc,CAAC,MAAM,CAAC,GAAG,IAAI,EAAE,IAAI,CAAC;YACpC,cAAc,CAAC,oBAAoB,CAAC,GAAG,IAAI,EAAE,kBAAkB,CAAC;YAChE,cAAc,CAAC,WAAW,CAAC,GAAG,IAAI,EAAE,SAAS,CAAC;YAC9C,cAAc,CAAC,YAAY,CAAC,GAAG,SAAS,CAAC,OAAO,CAAC;YACjD,cAAc,CAAC,0BAA0B,CAAC,GAAG,SAAS,CAAC,OAAO,CAAC;YAC/D,cAAc,CAAC,YAAY,CAAC,GAAG,SAAS,CAAC,OAAO,CAAC;YACjD,cAAc,CAAC,cAAc,CAAC,GAAG,SAAS,CAAC,OAAO,CAAC;YACnD,cAAc,CAAC,KAAK,CAAC,GAAG,SAAS,CAAC,OAAO,CAAC;SAC7C;aAAM;YACH,cAAc,CAAC,YAAY,CAAC,GAAG,SAAS,CAAC,OAAO,CAAC;YACjD,cAAc,CAAC,0BAA0B,CAAC,GAAG,SAAS,CAAC,OAAO,CAAC;YAC/D,cAAc,CAAC,YAAY,CAAC,GAAG,SAAS,CAAC,OAAO,CAAC;YACjD,cAAc,CAAC,cAAc,CAAC,GAAG,SAAS,CAAC,OAAO,CAAC;YACnD,cAAc,CAAC,KAAK,CAAC,GAAG,SAAS,CAAC,OAAO,CAAC;SAC7C;QACD,IAAI,GAAG,MAAM,CAAC,YAAY,CAAC,SAAS,CAAC,oBAAoB,EAAE,EAAE,IAAI,CAAC,CAAC;QACnE,KAAK,CAAC,aAAa,CAAC,YAAY,EAAE,IAAI,EAAE,cAAc,EAAE,IAAI,EAAE,IAAI,CAAC,UAAU,CAAC,CAAC;IACnF,CAAC;;AAnDL,sCAoDC;AAnDG,gBAAgB;AACO,0BAAY,GAAG,yBAAyB,CAAC"}
+{"version":3,"file":"svelteKitSite.js","sourceRoot":"","sources":["../../aws/svelteKitSite.ts"],"names":[],"mappings":";AAAA,sEAAsE;AACtE,iFAAiF;;;AAEjF,yCAAyC;AAIzC,0CAA0C;AAE1C,MAAa,aAAc,SAAQ,MAAM,CAAC,iBAAiB;IAIvD;;;OAGG;IACI,MAAM,CAAC,UAAU,CAAC,GAAQ;QAC7B,IAAI,GAAG,KAAK,SAAS,IAAI,GAAG,KAAK,IAAI,EAAE;YACnC,OAAO,KAAK,CAAC;SAChB;QACD,OAAO,GAAG,CAAC,cAAc,CAAC,KAAK,aAAa,CAAC,YAAY,CAAC;IAC9D,CAAC;IAYD;;;;;;OAMG;IACH,YAAY,IAAY,EAAE,IAAwB,EAAE,IAAsC;QACtF,IAAI,cAAc,GAAkB,EAAE,CAAC;QACvC,IAAI,GAAG,IAAI,IAAI,EAAE,CAAC;QAClB,IAAI,CAAC,IAAI,CAAC,EAAE,EAAE;YACV,cAAc,CAAC,QAAQ,CAAC,GAAG,IAAI,EAAE,MAAM,CAAC;YACxC,cAAc,CAAC,aAAa,CAAC,GAAG,IAAI,EAAE,WAAW,CAAC;YAClD,cAAc,CAAC,kBAAkB,CAAC,GAAG,IAAI,EAAE,gBAAgB,CAAC;YAC5D,cAAc,CAAC,MAAM,CAAC,GAAG,IAAI,EAAE,IAAI,CAAC;YACpC,cAAc,CAAC,oBAAoB,CAAC,GAAG,IAAI,EAAE,kBAAkB,CAAC;YAChE,cAAc,CAAC,WAAW,CAAC,GAAG,IAAI,EAAE,SAAS,CAAC;YAC9C,cAAc,CAAC,YAAY,CAAC,GAAG,SAAS,CAAC,OAAO,CAAC;YACjD,cAAc,CAAC,0BAA0B,CAAC,GAAG,SAAS,CAAC,OAAO,CAAC;YAC/D,cAAc,CAAC,YAAY,CAAC,GAAG,SAAS,CAAC,OAAO,CAAC;YACjD,cAAc,CAAC,cAAc,CAAC,GAAG,SAAS,CAAC,OAAO,CAAC;YACnD,cAAc,CAAC,cAAc,CAAC,GAAG,SAAS,CAAC,OAAO,CAAC;YACnD,cAAc,CAAC,KAAK,CAAC,GAAG,SAAS,CAAC,OAAO,CAAC;SAC7C;aAAM;YACH,cAAc,CAAC,YAAY,CAAC,GAAG,SAAS,CAAC,OAAO,CAAC;YACjD,cAAc,CAAC,0BAA0B,CAAC,GAAG,SAAS,CAAC,OAAO,CAAC;YAC/D,cAAc,CAAC,YAAY,CAAC,GAAG,SAAS,CAAC,OAAO,CAAC;YACjD,cAAc,CAAC,cAAc,CAAC,GAAG,SAAS,CAAC,OAAO,CAAC;YACnD,cAAc,CAAC,cAAc,CAAC,GAAG,SAAS,CAAC,OAAO,CAAC;YACnD,cAAc,CAAC,KAAK,CAAC,GAAG,SAAS,CAAC,OAAO,CAAC;SAC7C;QACD,IAAI,GAAG,MAAM,CAAC,YAAY,CAAC,SAAS,CAAC,oBAAoB,EAAE,EAAE,IAAI,CAAC,CAAC;QACnE,KAAK,CAAC,aAAa,CAAC,YAAY,EAAE,IAAI,EAAE,cAAc,EAAE,IAAI,EAAE,IAAI,CAAC,UAAU,CAAC,CAAC;IACnF,CAAC;;AA1DL,sCA2DC;AA1DG,gBAAgB;AACO,0BAAY,GAAG,yBAAyB,CAAC"}