@geekmidas/cli 10.0.0-alpha.124 → 10.0.0-alpha.125

package/dist/{deploy-BbI1UMh3.cjs → deploy-DVrNjX1X.cjs}

@@ -1,21 +1,21 @@
 const require_rolldown_runtime = require("./rolldown-runtime-C0BPl7ul.cjs");
 const require_errors = require("./errors-DMC4Umsb.cjs");
 const require_credentials = require("./credentials-D7XJypNd.cjs");
-const require_workspace = require("./workspace-C82GLPnf.cjs");
-const require_snsSubscriptions = require("./snsSubscriptions-CSkteK2J.cjs");
+const require_workspace = require("./workspace-Du4Afb03.cjs");
+const require_snsSubscriptions = require("./snsSubscriptions-5Cqww8S7.cjs");
 const require_define = require("./define-crmMcXFS.cjs");
-const require_seeds = require("./seeds-DOfxmDRO.cjs");
+const require_seeds = require("./seeds-CPEcmoPn.cjs");
 const require_derive = require("./derive-DAbo49sm.cjs");
-const require_SubscriberGenerator = require("./SubscriberGenerator-C3QTae-R.cjs");
+const require_SubscriberGenerator = require("./SubscriberGenerator-BDUp7OeY.cjs");
 const require_identity = require("./identity-CbLfgQNT.cjs");
-const require_discover = require("./discover-ojkcbxHw.cjs");
+const require_discover = require("./discover-DL6h-J97.cjs");
 const require_sandbox = require("./sandbox-CHv3OYXg.cjs");
 const require_config = require("./config.cjs");
-const require_resolve = require("./resolve-C7GKQcE4.cjs");
+const require_resolve = require("./resolve-C9QqOl5t.cjs");
 const require_local = require("./local-OPC9BCZt.cjs");
-const require_sniffer = require("./sniffer-C7O9Pna_.cjs");
+const require_sniffer = require("./sniffer-DdX_WN_-.cjs");
 const require_projectBucket = require("./projectBucket-BBbQ1lHF.cjs");
-const require_credentialSchemas = require("./credentialSchemas-AhIBuQxQ.cjs");
+const require_credentialSchemas = require("./credentialSchemas-DFxvGEwa.cjs");
 let node_path = require("node:path");
 let node_crypto = require("node:crypto");
 let _geekmidas_manifest = require("@geekmidas/manifest");
@@ -221,10 +221,13 @@ function openResource(bucket, pattern) {
 }
 /**
 * The bucket's own policy: every request refused unless it came over TLS,
-* and — only when a file server opens paths on it — anonymous `s3:GetObject`
-* on exactly those prefixes.
+* and — only when a file server opens paths on it — `s3:GetObject` on
+* exactly those prefixes: to anyone, or, when a CDN serves them, to
+* CloudFront alone, for exactly the stage's distributions. Behind a CDN the
+* bucket is never public: a key outside the open prefixes is refused to
+* CloudFront too, so the edge answers it 403.
 */
-function bucketPolicy(bucket, open = []) {
+function bucketPolicy(bucket, open = [], options = {}) {
 	const statements = [{
 		Sid: "GkmDenyInsecureTransport",
 		Effect: "Deny",
@@ -233,12 +236,21 @@ function bucketPolicy(bucket, open = []) {
 		Resource: [bucketArn(bucket), `${bucketArn(bucket)}/*`],
 		Condition: { Bool: { "aws:SecureTransport": "false" } }
 	}];
-	if (open.length > 0) statements.push({
+	const resources = [...new Set(open.map((p) => openResource(bucket, p)))].sort();
+	if (open.length > 0 && options.cdn) statements.push({
+		Sid: "GkmCdnRead",
+		Effect: "Allow",
+		Principal: { Service: "cloudfront.amazonaws.com" },
+		Action: "s3:GetObject",
+		Resource: resources,
+		Condition: { StringEquals: { "AWS:SourceArn": [...new Set(options.cdn.distributionArns)].sort() } }
+	});
+	else if (open.length > 0) statements.push({
 		Sid: "GkmOpenPaths",
 		Effect: "Allow",
 		Principal: "*",
 		Action: "s3:GetObject",
-		Resource: [...new Set(open.map((p) => openResource(bucket, p)))].sort()
+		Resource: resources
 	});
 	return {
 		Version: "2012-10-17",
@@ -287,7 +299,7 @@ function canonical(value, key) {
 	}
 	if (value && typeof value === "object") return Object.fromEntries(Object.keys(value).sort().map((k) => {
 		const v = value[k];
-		return [k, canonical(k === "Action" || k === "Resource" || k === "AWS" ? Array.isArray(v) ? v : [v] : v, k)];
+		return [k, canonical(k === "Action" || k === "Resource" || k === "AWS" || k === "AWS:SourceArn" ? Array.isArray(v) ? v : [v] : v, k)];
 	}));
 	return value;
 }
@@ -333,7 +345,7 @@ function identityTags(ctx, id) {
 	];
 }
 /** A read whose "there is none" answer is one of `missing`. */
-async function readOr$2(read, missing) {
+async function readOr$3(read, missing) {
 	try {
 		return await read();
 	} catch (error) {
@@ -363,7 +375,7 @@ async function ensureIamUser(ctx, clients, input) {
 		key: `iam-user:${id}`,
 		type: "iam-user"
 	};
-	const found = await readOr$2(() => iam.send(new IAM.GetUserCommand({ UserName: user })), ["NoSuchEntity", "NoSuchEntityException"]);
+	const found = await readOr$3(() => iam.send(new IAM.GetUserCommand({ UserName: user })), ["NoSuchEntity", "NoSuchEntityException"]);
 	if (found?.User) {
 		const tags = await iam.send(new IAM.ListUserTagsCommand({ UserName: user }));
 		const tag = (key) => tags.Tags?.find((t) => t.Key === key)?.Value;
@@ -383,7 +395,7 @@ async function ensureIamUser(ctx, clients, input) {
 		await ctx.state.ready(entry, user);
 	});
 	const exists = Boolean(found?.User) || !ctx.dryRun;
-	const current = exists ? await readOr$2(() => iam.send(new IAM.GetUserPolicyCommand({
+	const current = exists ? await readOr$3(() => iam.send(new IAM.GetUserPolicyCommand({
 		UserName: user,
 		PolicyName: input.policyName
 	})), ["NoSuchEntity", "NoSuchEntityException"]) : void 0;
@@ -797,6 +809,738 @@ async function verifyStageBackups(input) {
 	}
 }
 //#endregion
+//#region src/providers/dnsWriter.ts
+/**
+* The DNS records a provider asks for — a certificate's validation record, a
+* CDN's name — written through the stage's own DNS providers.
+*
+* The same machinery the deploy's DNS step uses for the stack's hosts
+* (`settleStackDns`), handed a plan of CNAMEs instead of the server's
+* addresses: a record holding its value is left alone, one with another value
+* is replaced and printed, and what is written is read back. A host under no
+* domain in `dns`, or under a `manual` one, is printed for the person to
+* create and reported back, so the provider can say what it is waiting on.
+*/
+async function writeProviderDns(records, options) {
+	const { log } = options;
+	const dns = options.workspace.dns ? require_seeds.normalizeDnsConfig(options.workspace.dns) : {};
+	const manual = [];
+	const domains = /* @__PURE__ */ new Map();
+	for (const record of records) {
+		const host = record.host.toLowerCase().replace(/\.$/, "");
+		const value = record.value.replace(/\.$/, "");
+		const domain = require_seeds.findRootDomain(host, dns);
+		if (!domain) {
+			log(`   create at its DNS host: ${host} CNAME ${value}`);
+			manual.push(host);
+			continue;
+		}
+		const config = dns[domain];
+		const plan = domains.get(domain) ?? {
+			domain,
+			provider: typeof config.provider === "string" ? config.provider : "custom",
+			config,
+			records: []
+		};
+		const planned = {
+			host,
+			domain,
+			name: require_seeds.extractSubdomain(host, domain),
+			type: record.type,
+			value,
+			ttl: require_snsSubscriptions.recordTtl(config)
+		};
+		plan.records.push(planned);
+		domains.set(domain, plan);
+	}
+	if (domains.size === 0) return { manual };
+	const plans = [...domains.values()];
+	const tokens = await require_snsSubscriptions.dnsCredentials(options.stage, plans.map(({ domain, config }) => ({
+		domain,
+		config
+	})), options.credentials);
+	const applied = await require_snsSubscriptions.settleStackDns({
+		stage: options.stage,
+		server: { ipv4: "" },
+		domains: plans,
+		uncovered: []
+	}, {
+		...options.dryRun ? { dryRun: true } : { confirm: true },
+		log,
+		credentials: {
+			...tokens.godaddy ? { credential: tokens.godaddy } : {},
+			log
+		},
+		...tokens.hostinger ? { hostinger: tokens.hostinger } : {},
+		...options.providerFor ? { providerFor: options.providerFor } : {}
+	});
+	for (const change of applied.changes) {
+		if (change.action !== "manual") continue;
+		const host = plans.find((p) => p.domain === change.domain)?.records.find((r) => r.name === change.name)?.host;
+		if (host) manual.push(host);
+	}
+	return { manual: [...new Set(manual)].sort() };
+}
+//#endregion
+//#region src/providers/s3/cdn.ts
+/** AWS's managed `CachingOptimized` cache policy: path-keyed, gzip and brotli. */
+const CACHING_OPTIMIZED = "658327ea-f89d-4fab-a63d-7e88639e58f6";
+/** What an immutable path is served with. */
+const IMMUTABLE_CACHE_CONTROL = "public, max-age=31536000, immutable";
+/** The only region CloudFront reads a certificate from. */
+const CDN_REGION = "us-east-1";
+/** The distribution's bucket origin. */
+const ORIGIN_ID = "bucket";
+/** Its processors' origin: the stack's processor unit, at a host of its own. */
+const PROCESSORS_ORIGIN_ID = "processors";
+/**
+* AWS's managed `CachingOptimizedForUncompressedObjects`: keyed on the path
+* alone, and nothing re-compressed — a derivative is an image, already
+* compressed, and its width is in the path, so nothing else may fragment it.
+*/
+const CACHING_OPTIMIZED_UNCOMPRESSED = "b2884449-e4de-46a7-ac36-70bc7f1ddd6d";
+/** A CDN is a name on the stage's domain, and the stage has none. */
+var FileServerCdnNeedsDomain = class extends require_errors.GkmError {
+	server;
+	stage;
+	constructor(server, stage) {
+		super(`'${server}' is served through a CDN on '${stage}', which answers on <fileserver>.<domain> — and '${stage}' has no domain. Set domains.${stage} in gkm.config.ts, or set deploy.objects.${stage}.cdn to false to serve it from the bucket's own endpoint.`);
+		this.server = server;
+		this.stage = stage;
+		this.name = "FileServerCdnNeedsDomain";
+	}
+};
+/**
+* The certificate is waiting on its validation record: one the person has to
+* create, or one that has not propagated yet. Everything up to it is
+* recorded, so the next deploy carries on from here.
+*/
+var CdnCertificatePending = class extends require_errors.GkmError {
+	server;
+	host;
+	record;
+	reason;
+	constructor(server, host, record, reason) {
+		super((reason === "manual" ? `The certificate for ${host} ('${server}') is validated by a DNS record no DNS provider in gkm.config.ts can write. Create it at the domain's DNS host:
+` : `The certificate for ${host} ('${server}') is not issued yet: ACM has not seen its validation record. It is written; DNS can take a while to answer with it. Check it resolves:
+`) + `  ${record.name} CNAME ${record.value}\nthen deploy again — the certificate and everything before it are recorded, and the deploy carries on from there.`);
+		this.server = server;
+		this.host = host;
+		this.record = record;
+		this.reason = reason;
+		this.name = "CdnCertificatePending";
+	}
+};
+/** ACM gave up on the certificate. */
+var CdnCertificateFailed = class extends require_errors.GkmError {
+	server;
+	host;
+	status;
+	reason;
+	constructor(server, host, status, reason) {
+		super(`ACM did not issue the certificate for ${host} ('${server}'): ${status}` + (reason ? ` (${reason})` : "") + ". A CAA record on the domain that does not allow amazon.com, or a validation record removed before it was checked, are the usual causes. Fix it and deploy again: a new certificate is requested.");
+		this.server = server;
+		this.host = host;
+		this.status = status;
+		this.reason = reason;
+		this.name = "CdnCertificateFailed";
+	}
+};
+/** Where a file server answers: `<fileserver>.<domain>`. */
+function cdnHost(serverId, domain) {
+	return `${require_derive.appKey(serverId)}.${domain}`.toLowerCase();
+}
+/**
+* The name the stage's CDN resources go by, within CloudFront's limits:
+* letters, digits, `-` and `_`, and at most 64 characters (an origin access
+* control's). Kept whole where it fits; otherwise shortened with a hash of
+* the whole, so two long names never meet.
+*/
+function cdnName(scope, stage, serverId) {
+	const whole = `gkm-${scope}-${stage}-${require_derive.appKey(serverId)}`.replace(/[^A-Za-z0-9_-]/g, "-");
+	if (whole.length <= 56) return whole;
+	return `${whole.slice(0, 47)}-${hash(whole)}`;
+}
+function hash(value) {
+	let h = 2166136261;
+	for (let i = 0; i < value.length; i++) {
+		h ^= value.charCodeAt(i);
+		h = Math.imul(h, 16777619);
+	}
+	return (h >>> 0).toString(36).padStart(8, "0").slice(0, 8);
+}
+/**
+* An open or immutable glob as a CloudFront path pattern. CloudFront's `*`
+* crosses `/`, so a single star is as wide as a double one — the bucket
+* policy reads it the same way, and the construct's own check is the
+* stricter of the three.
+*/
+function pathPattern(glob) {
+	return glob.replace(/^\/+/, "").replace(/\*\*/g, "*");
+}
+/** A CloudFront list: its `Quantity` and, when it has some, its `Items`. */
+function list(items) {
+	return items.length > 0 ? {
+		Quantity: items.length,
+		Items: [...items]
+	} : { Quantity: 0 };
+}
+/** One of the stage's response headers policies. */
+function headersPolicyConfig(input) {
+	return {
+		Name: input.name,
+		Comment: input.comment,
+		...input.origins.length > 0 ? { CorsConfig: {
+			AccessControlAllowOrigins: list([...input.origins].sort()),
+			AccessControlAllowHeaders: {
+				Quantity: 1,
+				Items: ["*"]
+			},
+			AccessControlAllowMethods: {
+				Quantity: 3,
+				Items: [
+					"GET",
+					"HEAD",
+					"OPTIONS"
+				]
+			},
+			AccessControlAllowCredentials: false,
+			AccessControlMaxAgeSec: 86400,
+			OriginOverride: false
+		} } : {},
+		...input.immutable ? { CustomHeadersConfig: {
+			Quantity: 1,
+			Items: [{
+				Header: "Cache-Control",
+				Value: IMMUTABLE_CACHE_CONTROL,
+				Override: true
+			}]
+		} } : {}
+	};
+}
+/** The parts of a distribution's config this provider owns. */
+function distributionConfig(input) {
+	const behaviour = (policy) => ({
+		TargetOriginId: ORIGIN_ID,
+		ViewerProtocolPolicy: "redirect-to-https",
+		AllowedMethods: {
+			Quantity: 3,
+			Items: [
+				"GET",
+				"HEAD",
+				"OPTIONS"
+			],
+			CachedMethods: {
+				Quantity: 2,
+				Items: ["GET", "HEAD"]
+			}
+		},
+		Compress: true,
+		CachePolicyId: CACHING_OPTIMIZED,
+		...policy ? { ResponseHeadersPolicyId: policy } : {}
+	});
+	const patterns = [...new Set(input.immutable.map(pathPattern))].sort();
+	const processors = input.processors;
+	const processorPatterns = processors ? [...new Set(processors.prefixes.map((p) => `${pathPattern(p)}*`))].sort() : [];
+	return {
+		CallerReference: input.callerReference,
+		Comment: input.comment,
+		Enabled: true,
+		Aliases: {
+			Quantity: 1,
+			Items: [input.host]
+		},
+		Origins: list([{
+			Id: ORIGIN_ID,
+			DomainName: input.bucketDomain,
+			OriginPath: "",
+			S3OriginConfig: { OriginAccessIdentity: "" },
+			OriginAccessControlId: input.originAccessControlId
+		}, ...processors ? [{
+			Id: PROCESSORS_ORIGIN_ID,
+			DomainName: processors.host,
+			OriginPath: "",
+			CustomOriginConfig: {
+				HTTPPort: 80,
+				HTTPSPort: 443,
+				OriginProtocolPolicy: "https-only",
+				OriginSslProtocols: {
+					Quantity: 1,
+					Items: ["TLSv1.2"]
+				},
+				OriginReadTimeout: 30,
+				OriginKeepaliveTimeout: 5
+			},
+			CustomHeaders: {
+				Quantity: 1,
+				Items: [{
+					HeaderName: require_seeds.ORIGIN_VERIFY_HEADER,
+					HeaderValue: processors.secret
+				}]
+			}
+		}] : []]),
+		DefaultCacheBehavior: behaviour(input.corsPolicyId),
+		CacheBehaviors: list([...processorPatterns.map((PathPattern) => ({
+			...behaviour(input.corsPolicyId),
+			TargetOriginId: PROCESSORS_ORIGIN_ID,
+			Compress: false,
+			CachePolicyId: CACHING_OPTIMIZED_UNCOMPRESSED,
+			PathPattern
+		})), ...patterns.map((PathPattern) => ({
+			...behaviour(input.immutablePolicyId),
+			PathPattern
+		}))]),
+		ViewerCertificate: {
+			ACMCertificateArn: input.certificateArn,
+			SSLSupportMethod: "sni-only",
+			MinimumProtocolVersion: "TLSv1.2_2021",
+			CloudFrontDefaultCertificate: false
+		},
+		HttpVersion: "http2and3",
+		IsIPV6Enabled: true,
+		DefaultRootObject: ""
+	};
+}
+/**
+* Whether `current` already holds everything in `wanted`: each key `wanted`
+* names, recursively, with lists compared as sets. What else `current` holds
+* — logging, a WAF, geo restrictions set by hand — is left alone, and a
+* `CallerReference`, fixed at creation, is never compared.
+*/
+function holds(current, wanted, key) {
+	if (key === "CallerReference") return true;
+	if (Array.isArray(wanted)) return Array.isArray(current) && current.length === wanted.length && wanted.every((w) => current.some((c) => holds(c, w)));
+	if (wanted && typeof wanted === "object") {
+		if (!current || typeof current !== "object") return false;
+		return Object.entries(wanted).every(([k, v]) => holds(current[k], v, k));
+	}
+	return current === wanted;
+}
+/** Header configs a policy may hold that this provider never sets. */
+const FOREIGN_HEADER_CONFIGS = [
+	"CorsConfig",
+	"CustomHeadersConfig",
+	"SecurityHeadersConfig",
+	"RemoveHeadersConfig",
+	"ServerTimingHeadersConfig"
+];
+/** Whether a policy is exactly what is wanted: nothing missing, nothing more. */
+function sameHeadersPolicy(current, wanted) {
+	if (!current || !holds(current, wanted)) return false;
+	return FOREIGN_HEADER_CONFIGS.every((k) => {
+		if (k in wanted) return true;
+		const extra = current[k];
+		return !extra || extra.Quantity === 0;
+	});
+}
+const defaultCdnClients = async (credential) => {
+	const CF = await import("@aws-sdk/client-cloudfront");
+	const ACM = await import("@aws-sdk/client-acm");
+	const config = await require_snsSubscriptions.awsClientConfig(credential, CDN_REGION);
+	const cloudfront = require_snsSubscriptions.awsEndpoint(process.env, "CLOUDFRONT");
+	const acm = require_snsSubscriptions.awsEndpoint(process.env, "ACM");
+	return {
+		CF,
+		ACM,
+		cloudfront: new CF.CloudFrontClient({
+			...config,
+			...cloudfront ? { endpoint: cloudfront } : {}
+		}),
+		acm: new ACM.ACMClient({
+			...config,
+			...acm ? { endpoint: acm } : {}
+		}),
+		wait: {
+			timeoutMs: 9e5,
+			intervalMs: 1e4
+		}
+	};
+};
+let makeCdnClients = defaultCdnClients;
+/** What an AWS SDK error is called, whichever field carries it. */
+function errorName$2(error) {
+	const e = error;
+	return e?.Code ?? e?.name ?? "";
+}
+async function readOr$2(read, missing) {
+	try {
+		return await read();
+	} catch (error) {
+		if (missing.includes(errorName$2(error))) return void 0;
+		throw error;
+	}
+}
+const sleep = (ms) => new Promise((resolve) => setTimeout(resolve, ms));
+/** What stands in for an id a dry run would create. */
+const PLANNED = "(created by this deploy)";
+/** Each file server over a bucket, behind its own distribution. */
+async function ensureBucketCdn(ctx, input) {
+	const domain = ctx.workspace.domains?.[ctx.stage];
+	if (!domain) throw new FileServerCdnNeedsDomain(input.servers[0].id, ctx.stage);
+	const clients = await makeCdnClients(ctx.credential);
+	const out = {
+		distributionArns: [],
+		urls: {}
+	};
+	for (const server of input.servers) {
+		const { arn, url } = await ensureServerCdn(ctx, clients, {
+			...input,
+			server,
+			host: cdnHost(server.id, domain),
+			processorHost: require_seeds.processorOriginHost(server.id, domain)
+		});
+		out.distributionArns.push(arn);
+		out.urls[server.id] = url;
+	}
+	return out;
+}
+async function ensureServerCdn(ctx, clients, input) {
+	const { server, host } = input;
+	const name = cdnName(ctx.identity.scope, ctx.stage, server.id);
+	const comment = `gkm ${ctx.identity.key} ${ctx.stage} ${server.id}`.slice(0, 128);
+	const certificateArn = await ensureCertificate(ctx, clients, {
+		id: server.id,
+		host,
+		name
+	});
+	const originAccessControlId = await ensureOriginAccessControl(ctx, clients, {
+		id: server.id,
+		name,
+		bucket: input.bucket
+	});
+	const corsPolicyId = input.origins.length > 0 ? await ensureHeadersPolicy(ctx, clients, {
+		id: server.id,
+		kind: "cors",
+		config: headersPolicyConfig({
+			name: `${name}-cors`,
+			comment: `${comment}: CORS`,
+			origins: input.origins,
+			immutable: false
+		})
+	}) : void 0;
+	const immutablePolicyId = server.immutable.length > 0 ? await ensureHeadersPolicy(ctx, clients, {
+		id: server.id,
+		kind: "immutable",
+		config: headersPolicyConfig({
+			name: `${name}-immutable`,
+			comment: `${comment}: CORS and Cache-Control immutable`,
+			origins: input.origins,
+			immutable: true
+		})
+	}) : void 0;
+	const processors = server.processors?.length ? {
+		prefixes: server.processors,
+		host: input.processorHost,
+		secret: await ensureOriginSecret(ctx, server.id)
+	} : void 0;
+	const distribution = await ensureDistribution(ctx, clients, {
+		id: server.id,
+		comment,
+		config: distributionConfig({
+			comment,
+			callerReference: name,
+			host,
+			certificateArn,
+			bucketDomain: `${input.bucket}.s3.${input.region}.amazonaws.com`,
+			originAccessControlId,
+			...corsPolicyId ? { corsPolicyId } : {},
+			...immutablePolicyId ? { immutablePolicyId } : {},
+			immutable: server.immutable,
+			...processors ? { processors } : {}
+		})
+	});
+	if (distribution.domainName !== PLANNED) {
+		if ((await ctx.writeDns([{
+			host,
+			type: "CNAME",
+			value: distribution.domainName
+		}])).manual.includes(host)) ctx.log(`   ${host} answers once that record exists — ${server.id}'s URL is https://${host}`);
+	}
+	return {
+		arn: distribution.arn,
+		url: `https://${host}`
+	};
+}
+/**
+* The secret the CDN sends a file server's processors: the one in the stage's
+* secrets, or a new one written there — read by the stack, whose edge checks
+* it, when it composes.
+*/
+async function ensureOriginSecret(ctx, serverId) {
+	const key = require_seeds.originSecretKey(serverId);
+	const kept = ctx.secrets[key];
+	if (kept) return kept;
+	const secret = require_seeds.newOriginSecret();
+	ctx.log(`   ${serverId}: a new processor origin secret, kept as ${key}`);
+	await ctx.writeSecrets({ [key]: secret });
+	return secret;
+}
+/** The certificate for `host`: recorded, adopted, or requested — then issued. */
+async function ensureCertificate(ctx, clients, input) {
+	const { ACM, acm } = clients;
+	const { id, host } = input;
+	const entry = {
+		key: `acm-certificate:${id}`,
+		type: "acm-certificate",
+		data: { host }
+	};
+	const describe = (arn) => readOr$2(() => acm.send(new ACM.DescribeCertificateCommand({ CertificateArn: arn })), ["ResourceNotFoundException"]).then((out) => out?.Certificate);
+	let arn;
+	const recorded = ctx.state.record(entry.key);
+	if (recorded?.id && recorded.data?.host === host) {
+		const found = await describe(recorded.id);
+		if (found && found.Status !== "FAILED" && found.Status !== "VALIDATION_TIMED_OUT" && found.Status !== "REVOKED" && found.Status !== "EXPIRED") arn = recorded.id;
+	}
+	if (!arn) {
+		arn = await findCertificate(clients, host);
+		if (arn) ctx.log(`   adopting the certificate for ${host} — ${arn}`);
+	}
+	if (!arn) {
+		if (ctx.dryRun) {
+			await ctx.change({
+				construct: id,
+				resource: `certificate ${host}`,
+				change: "request (ACM, us-east-1, DNS-validated)"
+			}, async () => {});
+			return PLANNED;
+		}
+		await ctx.state.pending(entry);
+		arn = (await acm.send(new ACM.RequestCertificateCommand({
+			DomainName: host,
+			ValidationMethod: "DNS",
+			IdempotencyToken: input.name.replace(/[^A-Za-z0-9]/g, "").slice(0, 32),
+			Tags: identityTags(ctx, id).map((t) => ({
+				Key: t.Key,
+				Value: t.Value
+			}))
+		}))).CertificateArn;
+		await ctx.change({
+			construct: id,
+			resource: `certificate ${host}`,
+			change: "request (ACM, us-east-1, DNS-validated)"
+		}, async () => {});
+	}
+	if (!ctx.dryRun) await ctx.state.ready(entry, arn);
+	let certificate = await describe(arn);
+	let record = certificate?.DomainValidationOptions?.[0]?.ResourceRecord;
+	for (let i = 0; !record && i < 15; i++) {
+		await sleep(Math.min(clients.wait.intervalMs, 2e3));
+		certificate = await describe(arn);
+		record = certificate?.DomainValidationOptions?.[0]?.ResourceRecord;
+	}
+	const validation = record ? {
+		name: record.Name.replace(/\.$/, ""),
+		value: record.Value.replace(/\.$/, "")
+	} : void 0;
+	const written = validation ? await ctx.writeDns([{
+		host: validation.name,
+		type: "CNAME",
+		value: validation.value
+	}]) : { manual: [] };
+	if (certificate?.Status === "ISSUED" || ctx.dryRun) return arn;
+	if (validation && written.manual.includes(validation.name.toLowerCase())) throw new CdnCertificatePending(id, host, validation, "manual");
+	ctx.log(`   waiting for ACM to issue the certificate for ${host}…`);
+	const deadline = Date.now() + clients.wait.timeoutMs;
+	while (certificate?.Status === "PENDING_VALIDATION" && Date.now() < deadline) {
+		await sleep(clients.wait.intervalMs);
+		certificate = await describe(arn);
+	}
+	if (certificate?.Status === "ISSUED") return arn;
+	if (certificate?.Status === "PENDING_VALIDATION" || !certificate) throw new CdnCertificatePending(id, host, validation ?? {
+		name: `(not published yet) ${host}`,
+		value: ""
+	}, "timeout");
+	throw new CdnCertificateFailed(id, host, certificate.Status ?? "unknown", certificate.FailureReason);
+}
+/** An issued or pending certificate for exactly `host`, if the account has one. */
+async function findCertificate(clients, host) {
+	const { ACM, acm } = clients;
+	let NextToken;
+	do {
+		const page = await acm.send(new ACM.ListCertificatesCommand({
+			CertificateStatuses: ["ISSUED", "PENDING_VALIDATION"],
+			...NextToken ? { NextToken } : {}
+		}));
+		const match = page.CertificateSummaryList?.find((c) => c.DomainName?.toLowerCase() === host);
+		if (match?.CertificateArn) return match.CertificateArn;
+		NextToken = page.NextToken;
+	} while (NextToken);
+}
+/** The origin access control CloudFront signs its bucket requests with. */
+async function ensureOriginAccessControl(ctx, clients, input) {
+	const { CF, cloudfront } = clients;
+	const entry = {
+		key: `cloudfront-oac:${input.id}`,
+		type: "cloudfront-oac",
+		data: { name: input.name }
+	};
+	const recorded = ctx.state.record(entry.key)?.id;
+	if (recorded) {
+		if (await readOr$2(() => cloudfront.send(new CF.GetOriginAccessControlCommand({ Id: recorded })), ["NoSuchOriginAccessControl"])) return recorded;
+	}
+	let Marker;
+	do {
+		const page = await cloudfront.send(new CF.ListOriginAccessControlsCommand({ ...Marker ? { Marker } : {} }));
+		const match = page.OriginAccessControlList?.Items?.find((o) => o.Name === input.name);
+		if (match?.Id) {
+			if (!ctx.dryRun) await ctx.state.ready(entry, match.Id);
+			return match.Id;
+		}
+		Marker = page.OriginAccessControlList?.NextMarker;
+	} while (Marker);
+	let id = PLANNED;
+	await ctx.change({
+		construct: input.id,
+		resource: `origin access control ${input.name}`,
+		change: `create (CloudFront signs its reads of ${input.bucket})`
+	}, async () => {
+		await ctx.state.pending(entry);
+		id = (await cloudfront.send(new CF.CreateOriginAccessControlCommand({ OriginAccessControlConfig: {
+			Name: input.name,
+			Description: `gkm: CloudFront's reads of ${input.bucket}`,
+			OriginAccessControlOriginType: "s3",
+			SigningBehavior: "always",
+			SigningProtocol: "sigv4"
+		} }))).OriginAccessControl.Id;
+		await ctx.state.ready(entry, id);
+	});
+	return id;
+}
+/** One response headers policy, as wanted. */
+async function ensureHeadersPolicy(ctx, clients, input) {
+	const { CF, cloudfront } = clients;
+	const { config } = input;
+	const entry = {
+		key: `cloudfront-headers:${input.id}:${input.kind}`,
+		type: "cloudfront-headers",
+		data: { name: config.Name }
+	};
+	const read = (Id) => readOr$2(() => cloudfront.send(new CF.GetResponseHeadersPolicyConfigCommand({ Id })), ["NoSuchResponseHeadersPolicy"]);
+	let id = ctx.state.record(entry.key)?.id;
+	let current = id ? await read(id) : void 0;
+	if (!current) {
+		id = void 0;
+		let Marker;
+		do {
+			const page = await cloudfront.send(new CF.ListResponseHeadersPoliciesCommand({
+				Type: "custom",
+				...Marker ? { Marker } : {}
+			}));
+			const match = page.ResponseHeadersPolicyList?.Items?.find((p) => p.ResponseHeadersPolicy?.ResponseHeadersPolicyConfig?.Name === config.Name);
+			if (match?.ResponseHeadersPolicy?.Id) {
+				id = match.ResponseHeadersPolicy.Id;
+				current = await read(id);
+			}
+			Marker = page.ResponseHeadersPolicyList?.NextMarker;
+		} while (!id && Marker);
+	}
+	if (id && current) {
+		if (!ctx.dryRun) await ctx.state.ready(entry, id);
+		if (sameHeadersPolicy(current.ResponseHeadersPolicyConfig, config)) return id;
+		const existing = id;
+		await ctx.change({
+			construct: input.id,
+			resource: `response headers policy ${config.Name}`,
+			change: "put back what drifted"
+		}, async () => {
+			await cloudfront.send(new CF.UpdateResponseHeadersPolicyCommand({
+				Id: existing,
+				IfMatch: current.ETag,
+				ResponseHeadersPolicyConfig: config
+			}));
+		});
+		return existing;
+	}
+	let created = PLANNED;
+	await ctx.change({
+		construct: input.id,
+		resource: `response headers policy ${config.Name}`,
+		change: "create"
+	}, async () => {
+		await ctx.state.pending(entry);
+		created = (await cloudfront.send(new CF.CreateResponseHeadersPolicyCommand({ ResponseHeadersPolicyConfig: config }))).ResponseHeadersPolicy.Id;
+		await ctx.state.ready(entry, created);
+	});
+	return created;
+}
+/** The distribution: recorded, found by its comment, or created — as wanted. */
+async function ensureDistribution(ctx, clients, input) {
+	const { CF, cloudfront } = clients;
+	const entry = {
+		key: `cloudfront-distribution:${input.id}`,
+		type: "cloudfront-distribution"
+	};
+	const get = (Id) => readOr$2(() => cloudfront.send(new CF.GetDistributionCommand({ Id })), ["NoSuchDistribution"]);
+	let found = ctx.state.record(entry.key)?.id ? await get(ctx.state.record(entry.key).id) : void 0;
+	if (!found) {
+		let Marker;
+		do {
+			const page = await cloudfront.send(new CF.ListDistributionsCommand({ ...Marker ? { Marker } : {} }));
+			const match = page.DistributionList?.Items?.find((d) => d.Comment === input.comment);
+			if (match?.Id) found = await get(match.Id);
+			Marker = page.DistributionList?.NextMarker;
+		} while (!found && Marker);
+	}
+	if (found?.Distribution) {
+		const distribution = found.Distribution;
+		const id = distribution.Id;
+		const located = {
+			arn: distribution.ARN,
+			domainName: distribution.DomainName
+		};
+		if (!ctx.dryRun) await ctx.state.ready({
+			...entry,
+			data: located
+		}, id);
+		const current = await cloudfront.send(new CF.GetDistributionConfigCommand({ Id: id }));
+		if (holds(current.DistributionConfig, input.config)) return located;
+		await ctx.change({
+			construct: input.id,
+			resource: `distribution ${id}`,
+			change: "put back what drifted"
+		}, async () => {
+			await cloudfront.send(new CF.UpdateDistributionCommand({
+				Id: id,
+				IfMatch: current.ETag,
+				DistributionConfig: {
+					...current.DistributionConfig,
+					...input.config,
+					CallerReference: current.DistributionConfig.CallerReference
+				}
+			}));
+		});
+		return located;
+	}
+	let created = {
+		arn: `arn:aws:cloudfront::${PLANNED}`,
+		domainName: PLANNED
+	};
+	const host = input.config.Aliases?.Items?.[0] ?? input.id;
+	await ctx.change({
+		construct: input.id,
+		resource: `distribution ${host}`,
+		change: "create (CloudFront, takes minutes to reach every edge)"
+	}, async () => {
+		await ctx.state.pending(entry);
+		const out = await cloudfront.send(new CF.CreateDistributionWithTagsCommand({ DistributionConfigWithTags: {
+			DistributionConfig: input.config,
+			Tags: { Items: identityTags(ctx, input.id).map((t) => ({
+				Key: t.Key,
+				Value: t.Value
+			})) }
+		} }));
+		created = {
+			arn: out.Distribution.ARN,
+			domainName: out.Distribution.DomainName
+		};
+		await ctx.state.ready({
+			...entry,
+			data: created
+		}, out.Distribution.Id);
+	});
+	return created;
+}
+//#endregion
 //#region src/providers/s3/events.ts
 /** What S3 tells the topic about: every object written, and every removed. */
 const BUCKET_EVENTS = ["s3:ObjectCreated:*", "s3:ObjectRemoved:*"];
@@ -1225,10 +1969,12 @@ function bucketConstructs(manifest) {
 	return Object.entries(manifest).filter(([, d]) => d.kind === "objects").map(([id, d]) => ({
 		id,
 		versioned: d.versioned === true,
-		...d.expire ? { expire: d.expire } : {},
+		...(0, _geekmidas_manifest.bucketExpiry)(manifest, id) ? { expire: (0, _geekmidas_manifest.bucketExpiry)(manifest, id) } : {},
 		servers: Object.entries(manifest).filter(([, s]) => s.kind === "file-server" && s.of === id).map(([sid, s]) => ({
 			id: sid,
-			open: s.open ?? []
+			open: s.open ?? [],
+			immutable: s.immutable ?? [],
+			...s.processors?.length ? { processors: [...new Set(s.processors.map((p) => p.prefix))].sort() } : {}
 		})).sort((a, b) => a.id.localeCompare(b.id))
 	})).sort((a, b) => a.id.localeCompare(b.id));
 }
@@ -1379,12 +2125,25 @@ async function ensureBucket(ctx, stageClients, construct, watchers) {
 		clients = await makeClients(ctx.credential, located.region);
 		ctx.log(`   '${bucket}' is in ${located.region}, not ${stageClients.region}: '${id}' is reached and addressed there`);
 	}
+	const cdn = ctx.config.cdn !== false && construct.servers.length > 0 ? await ensureBucketCdn(ctx, {
+		bucket,
+		region: clients.region,
+		servers: construct.servers,
+		origins: bucketOrigins({
+			workspace: ctx.workspace,
+			manifest: ctx.manifest,
+			runnables: ctx.runnables,
+			stage: ctx.stage,
+			bucket: id
+		}).origins
+	}) : void 0;
 	await ensureBucketSettings(ctx, clients, {
 		id,
 		bucket,
 		exists,
 		versioning,
 		open,
+		...cdn ? { cdn } : {},
 		...construct.expire ? { expire: construct.expire } : {}
 	});
 	const events = watchers ? await ensureBucketEvents(ctx, clients, {
@@ -1421,8 +2180,9 @@ async function ensureBucket(ctx, stageClients, construct, watchers) {
 			watchers
 		});
 	}
-	const publicUrl = bucketPublicUrl(bucket, clients.region, clients.endpoint);
+	const bucketUrl = bucketPublicUrl(bucket, clients.region, clients.endpoint);
 	for (const server of construct.servers) {
+		const publicUrl = cdn?.urls[server.id] ?? bucketUrl;
 		const key = (0, _geekmidas_manifest.provideKey)(server.id, "url");
 		const entry = {
 			key: `file-server:${server.id}`,
@@ -1580,7 +2340,7 @@ async function ensureBucketSettings(ctx, clients, input) {
 			Value: t.Value
 		})) }
 	})));
-	const isOpen = input.open.length > 0;
+	const isOpen = input.open.length > 0 && !input.cdn;
 	const block = publicAccessBlock(isOpen);
 	const ensureBlock = async () => {
 		const now = (await read(() => s3.send(new S3.GetPublicAccessBlockCommand({ Bucket })), ["NoSuchPublicAccessBlockConfiguration"]))?.PublicAccessBlockConfiguration;
@@ -1589,10 +2349,10 @@ async function ensureBucketSettings(ctx, clients, input) {
 			PublicAccessBlockConfiguration: block
 		})));
 	};
-	const policy = bucketPolicy(bucket, input.open);
+	const policy = bucketPolicy(bucket, input.open, input.cdn ? { cdn: input.cdn } : {});
 	const ensurePolicy = async () => {
 		const current = await read(() => s3.send(new S3.GetBucketPolicyCommand({ Bucket })), ["NoSuchBucketPolicy"]);
-		if (!(current?.Policy !== void 0 && canonicalPolicy(JSON.parse(current.Policy)) === canonicalPolicy(policy))) await set(isOpen ? `policy: TLS only, public read on ${input.open.join(", ")}` : "policy: TLS only", () => s3.send(new S3.PutBucketPolicyCommand({
+		if (!(current?.Policy !== void 0 && canonicalPolicy(JSON.parse(current.Policy)) === canonicalPolicy(policy))) await set(isOpen ? `policy: TLS only, public read on ${input.open.join(", ")}` : input.cdn && input.open.length > 0 ? `policy: TLS only, CloudFront reads ${input.open.join(", ")}` : "policy: TLS only", () => s3.send(new S3.PutBucketPolicyCommand({
 			Bucket,
 			Policy: JSON.stringify(policy)
 		})));
@@ -1894,6 +2654,17 @@ async function provisionStage(options) {
 				log(`   ${dryRun ? "would " : ""}${action.change} — ${action.resource}`);
 			},
 			writeSecrets,
+			writeDns: (records) => writeProviderDns(records, {
+				workspace,
+				stage,
+				dryRun,
+				credentials: options.credentials ?? require_credentials.storedCredentials({
+					env,
+					...options.home ? { home: options.home } : {}
+				}),
+				...options.dnsProviderFor ? { providerFor: options.dnsProviderFor } : {},
+				log
+			}),
 			log
 		});
 		if (entry.report.actions.length === 0) log("   up to date");
@@ -2336,6 +3107,7 @@ async function provisionResources(phaseCtx, request, ctx, store, emit) {
 			...request.rotateKeys ? { rotateKeys: true } : {},
 			...request.retireOldKeys ? { retireOldKeys: true } : {},
 			...ctx.home ? { home: ctx.home } : {},
+			credentials: ctx.credentials,
 			log: (line) => phaseCtx.logger.info(line)
 		});
 		if (!ctx.dryRun) return;
@@ -2719,4 +3491,4 @@ Object.defineProperty(exports, "iamUserName", {
 	}
 });
 
-//# sourceMappingURL=deploy-BbI1UMh3.cjs.map
+//# sourceMappingURL=deploy-DVrNjX1X.cjs.map