@quadnix/octo-aws-cdk 0.1.0 → 0.2.1

package/dist/resources/s3-storage/index.schema.js

@@ -8,6 +8,8 @@ var __metadata = (this && this.__metadata) || function (k, v) {
     if (typeof Reflect === "object" && typeof Reflect.metadata === "function") return Reflect.metadata(k, v);
 };
 import { BaseResourceSchema, Schema, Validate } from '@quadnix/octo';
+const S3_STORAGE_CORS_METHODS = ['DELETE', 'GET', 'HEAD', 'POST', 'PUT'];
+const S3_STORAGE_PRINCIPAL_TYPES = ['aws', 'cloudfront'];
 /**
  * Defines the schema for the s3 storage to allow permissions to a principal resource.
  *
@@ -17,6 +19,11 @@ import { BaseResourceSchema, Schema, Validate } from '@quadnix/octo';
  */
 export class S3StoragePermissionSchema {
     constructor() {
+        /**
+         * The key prefix within the bucket this permission is for, e.g. `uploads`.
+         * If you want to allow access to the entire bucket, use empty string `''`.
+         */
+        this.accessPrefix = Schema();
         /**
          * Allow read.
          */
@@ -30,12 +37,15 @@ export class S3StoragePermissionSchema {
          */
         this.principalResourceId = Schema();
         /**
-         * The path within the bucket this permission is for.
-         * If you want to allow access to the entire bucket, use empty string `''`.
+         * The kind of principal the permission admits.
          */
-        this.remoteDirectoryPath = Schema();
+        this.principalType = Schema();
     }
 }
+__decorate([
+    Validate({ options: { custom: (value) => typeof value === 'string' } }),
+    __metadata("design:type", Object)
+], S3StoragePermissionSchema.prototype, "accessPrefix", void 0);
 __decorate([
     Validate({ options: { minLength: 1 } }),
     __metadata("design:type", Object)
@@ -48,10 +58,152 @@ __decorate([
     Validate({ options: { minLength: 1 } }),
     __metadata("design:type", Object)
 ], S3StoragePermissionSchema.prototype, "principalResourceId", void 0);
+__decorate([
+    Validate({
+        options: { custom: (value) => S3_STORAGE_PRINCIPAL_TYPES.includes(value) },
+    }),
+    __metadata("design:type", Object)
+], S3StoragePermissionSchema.prototype, "principalType", void 0);
+/**
+ * Defines the schema for a CORS rule of the s3 storage, which lets a page on another origin call the
+ * bucket from a browser, e.g. to upload through a presigned URL or read a range of an object.
+ *
+ * S3 answers a request with the first rule its origin, method and headers all match.
+ *
+ * @group Resources/S3Storage
+ *
+ * @hideconstructor
+ */
+export class S3StorageCorsRuleSchema {
+    constructor() {
+        /**
+         * The request headers the calling page may send, e.g. `['Range']` to read part of an object.
+         * A name may use one `*`, and `*` alone allows every header. Header names are not case-sensitive.
+         */
+        this.allowHeaders = Schema([]);
+        /**
+         * The methods the calling page may use. See {@link IS3StorageCorsMethod}.
+         */
+        this.allowMethods = Schema();
+        /**
+         * The origins allowed to call, each a scheme, a host, and a port when it is not the default, e.g.
+         * `https://app.example.com`. An origin may use one `*`, e.g. `https://*.example.com`, and `*`
+         * alone allows every origin.
+         */
+        this.allowOrigins = Schema();
+        /**
+         * The response headers the calling page may read beyond the ones every browser shows, e.g.
+         * `['ETag']`.
+         */
+        this.exposeHeaders = Schema([]);
+        /**
+         * How long a browser may reuse the answer to a preflight request, in seconds. Omit it to let the
+         * browser decide.
+         */
+        this.maxAgeSeconds = Schema(null);
+    }
+}
+__decorate([
+    Validate({
+        destruct: (value) => value,
+        options: { minLength: 1 },
+    }),
+    __metadata("design:type", Object)
+], S3StorageCorsRuleSchema.prototype, "allowHeaders", void 0);
+__decorate([
+    Validate([
+        {
+            destruct: (value) => [value],
+            options: { minLength: 1 },
+        },
+        {
+            destruct: (value) => value,
+            options: { custom: (value) => S3_STORAGE_CORS_METHODS.includes(value) },
+        },
+    ]),
+    __metadata("design:type", Object)
+], S3StorageCorsRuleSchema.prototype, "allowMethods", void 0);
+__decorate([
+    Validate([
+        {
+            destruct: (value) => [value],
+            options: { minLength: 1 },
+        },
+        {
+            destruct: (value) => value,
+            options: { minLength: 1 },
+        },
+    ]),
+    __metadata("design:type", Object)
+], S3StorageCorsRuleSchema.prototype, "allowOrigins", void 0);
+__decorate([
+    Validate({
+        destruct: (value) => value,
+        options: { minLength: 1 },
+    }),
+    __metadata("design:type", Object)
+], S3StorageCorsRuleSchema.prototype, "exposeHeaders", void 0);
+__decorate([
+    Validate({
+        destruct: (value) => {
+            const subjects = [];
+            if (value !== null && value !== undefined) {
+                subjects.push(value);
+            }
+            return subjects;
+        },
+        options: { minLength: 0 },
+    }),
+    __metadata("design:type", Object)
+], S3StorageCorsRuleSchema.prototype, "maxAgeSeconds", void 0);
+/**
+ * Defines the schema for a lifecycle rule of the s3 storage, which expires the objects it matches
+ * some days after each was written.
+ *
+ * A rule matches the objects under its `prefix` that carry every one of its `tags`. With neither, it
+ * matches every object in the bucket.
+ *
+ * @group Resources/S3Storage
+ *
+ * @hideconstructor
+ */
+export class S3StorageLifecycleRuleSchema {
+    constructor() {
+        /**
+         * The number of days after an object was written that it expires and is deleted.
+         */
+        this.expirationInDays = Schema();
+        /**
+         * The key prefix the rule is limited to, e.g. `uploads/`. Omit it to match the whole bucket.
+         */
+        this.prefix = Schema('');
+        /**
+         * The tags an object must carry, every one of them, for the rule to match it, e.g. `{ upload: 'pending' }`.
+         */
+        this.tags = Schema({});
+    }
+}
 __decorate([
     Validate({ options: { minLength: 1 } }),
     __metadata("design:type", Object)
-], S3StoragePermissionSchema.prototype, "remoteDirectoryPath", void 0);
+], S3StorageLifecycleRuleSchema.prototype, "expirationInDays", void 0);
+__decorate([
+    Validate({
+        options: { custom: (value) => typeof value === 'string' },
+    }),
+    __metadata("design:type", Object)
+], S3StorageLifecycleRuleSchema.prototype, "prefix", void 0);
+__decorate([
+    Validate({
+        options: {
+            custom: (value) => typeof value === 'object' &&
+                value !== null &&
+                !Array.isArray(value) &&
+                Object.values(value).every((v) => typeof v === 'string'),
+        },
+    }),
+    __metadata("design:type", Object)
+], S3StorageLifecycleRuleSchema.prototype, "tags", void 0);
 /**
  * @internal
  */
@@ -80,14 +232,23 @@ __decorate([
  * The `S3StorageSchema` class is the schema for the `S3Storage` resource,
  * which represents the AWS Simple Storage Service (S3) Bucket resource.
  * Terraform provisions it as
- * [`aws_s3_bucket`](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/resources/s3_bucket) and
- * [`aws_s3_bucket_policy`](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/resources/s3_bucket_policy).
+ * [`aws_s3_bucket`](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/resources/s3_bucket),
+ * [`aws_s3_bucket_public_access_block`](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/resources/s3_bucket_public_access_block)
+ * when public access is blocked, one
+ * [`aws_s3_object`](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/resources/s3_object)
+ * per uploaded file, and
+ * [`aws_s3_bucket_policy`](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/resources/s3_bucket_policy)
+ * once a principal is admitted,
+ * [`aws_s3_bucket_cors_configuration`](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/resources/s3_bucket_cors_configuration)
+ * once it has a CORS rule, and
+ * [`aws_s3_bucket_lifecycle_configuration`](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/resources/s3_bucket_lifecycle_configuration)
+ * once it has a lifecycle rule.
  *
  * @group Resources/S3Storage
  *
  * @hideconstructor
  *
- * @overrideProperty parents - This resource has parents.
+ * @overrideProperty parents - The principals admitted to the bucket.
  * ```mermaid
  * graph TD;
  *   principal_resource((Principal<br>Resource)) --> s3_storage((S3<br>Storage))
@@ -101,17 +262,28 @@ export class S3StorageSchema extends BaseResourceSchema {
          * Input properties.
          * * `properties.awsAccountId` - The AWS account id.
          * * `properties.awsRegionId` - The AWS region id.
+         * * `properties.blockPublicAccess` - Blocks every public ACL and public policy on the bucket.
          * * `properties.Bucket` - The name of the bucket.
+         * * `properties.corsRules` - The rules letting a page on another origin call the bucket. See {@link S3StorageCorsRuleSchema} for options.
+         * * `properties.lifecycleRules` - The rules expiring the bucket's objects. See {@link S3StorageLifecycleRuleSchema} for options.
          * * `properties.permissions` - The permissions for the bucket. See {@link S3StoragePermissionSchema} for options.
          */
         this.properties = Schema();
         /**
          * Saved response.
          * * `response.Arn` - The ARN of the bucket.
+         * * `response.awsRegionId` - The AWS region id.
+         * * `response.Bucket` - The name of the bucket, as terraform created it.
+         * * `response.RegionalDomainName` - The bucket's REST endpoint, which is what a CloudFront origin
+         * points at.
          */
         this.response = Schema({
             Arn: 'arn:aws:s3:::mock-bucket',
+            awsRegionId: 'us-east-1',
+            Bucket: 'mock-bucket',
+            RegionalDomainName: 'mock-bucket.s3.us-east-1.amazonaws.com',
         });
+        this.sourcePathDigests = Schema({});
     }
 }
 __decorate([
@@ -124,6 +296,18 @@ __decorate([
             ],
             options: { minLength: 1 },
         },
+        {
+            destruct: (value) => [value.blockPublicAccess],
+            options: { minLength: 1 },
+        },
+        {
+            destruct: (value) => value.corsRules,
+            options: { isSchema: { schema: S3StorageCorsRuleSchema } },
+        },
+        {
+            destruct: (value) => value.lifecycleRules,
+            options: { isSchema: { schema: S3StorageLifecycleRuleSchema } },
+        },
         {
             destruct: (value) => value.permissions,
             options: { isSchema: { schema: S3StoragePermissionSchema } },
@@ -138,6 +322,15 @@ __decorate([
             if (value.Arn) {
                 subjects.push(value.Arn);
             }
+            if (value.awsRegionId) {
+                subjects.push(value.awsRegionId);
+            }
+            if (value.Bucket) {
+                subjects.push(value.Bucket);
+            }
+            if (value.RegionalDomainName) {
+                subjects.push(value.RegionalDomainName);
+            }
             return subjects;
         },
         options: { minLength: 1 },

package/dist/resources/s3-storage/index.schema.js.map

@@ -1 +1 @@
-{"version":3,"file":"index.schema.js","sourceRoot":"","sources":["../../../src/resources/s3-storage/index.schema.ts"],"names":[],"mappings":";;;;;;;;;AAAA,OAAO,EAAE,kBAAkB,EAAE,MAAM,EAAE,QAAQ,EAAE,MAAM,eAAe,CAAC;AAErE;;;;;;GAMG;AACH,MAAM,OAAO,yBAAyB;IAAtC;QACE;;WAEG;QAEH,cAAS,GAAG,MAAM,EAAW,CAAC;QAE9B;;WAEG;QAEH,eAAU,GAAG,MAAM,EAAW,CAAC;QAE/B;;WAEG;QAEH,wBAAmB,GAAG,MAAM,EAAU,CAAC;QAEvC;;;WAGG;QAEH,wBAAmB,GAAG,MAAM,EAAU,CAAC;IACzC,CAAC;CAAA;AApBC;IADC,QAAQ,CAAC,EAAE,OAAO,EAAE,EAAE,SAAS,EAAE,CAAC,EAAE,EAAE,CAAC;;4DACV;AAM9B;IADC,QAAQ,CAAC,EAAE,OAAO,EAAE,EAAE,SAAS,EAAE,CAAC,EAAE,EAAE,CAAC;;6DACT;AAM/B;IADC,QAAQ,CAAC,EAAE,OAAO,EAAE,EAAE,SAAS,EAAE,CAAC,EAAE,EAAE,CAAC;;sEACD;AAOvC;IADC,QAAQ,CAAC,EAAE,OAAO,EAAE,EAAE,SAAS,EAAE,CAAC,EAAE,EAAE,CAAC;;sEACD;AAGzC;;GAEG;AACH,MAAM,OAAO,uBAAwB,SAAQ,kBAAkB;IAA/D;;QAWW,aAAQ,GAAG,MAAM,CAEvB;YACD,GAAG,EAAE,0BAA0B;SAChC,CAAC,CAAC;IACL,CAAC;CAAA;AALU;IAVR,QAAQ,CAAC;QACR,QAAQ,EAAE,CAAC,KAA0C,EAAY,EAAE;YACjE,MAAM,QAAQ,GAAa,EAAE,CAAC;YAC9B,IAAI,KAAK,CAAC,GAAG,EAAE,CAAC;gBACd,QAAQ,CAAC,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC;YAC3B,CAAC;YACD,OAAO,QAAQ,CAAC;QAClB,CAAC;QACD,OAAO,EAAE,EAAE,SAAS,EAAE,CAAC,EAAE;KAC1B,CAAC;;yDAKC;AAGL;;;;;;;;;;;;;;;;;GAiBG;AACH,MAAM,OAAO,eAAgB,SAAQ,kBAAkB;IAAvD;;QACE;;;;;;WAMG;QAeM,eAAU,GAAG,MAAM,EAKxB,CAAC;QAEL;;;WAGG;QAWM,aAAQ,GAAG,MAAM,CAEvB;YACD,GAAG,EAAE,0BAA0B;SAChC,CAAC,CAAC;IACL,CAAC;CAAA;AA1BU;IAdR,QAAQ,CAAU;QACjB;YACE,QAAQ,EAAE,CAAC,KAAoC,EAAY,EAAE,CAAC;gBAC5D,KAAK,CAAC,YAAY;gBAClB,KAAK,CAAC,WAAW;gBACjB,KAAK,CAAC,MAAM;aACb;YACD,OAAO,EAAE,EAAE,SAAS,EAAE,CAAC,EAAE;SAC1B;QACD;YACE,QAAQ,EAAE,CAAC,KAAoC,EAA+B,EAAE,CAAC,KAAK,CAAC,WAAW;YAClG,OAAO,EAAE,EAAE,QAAQ,EAAE,EAAE,MAAM,EAAE,yBAAyB,EAAE,EAAE;SAC7D;KACF,CAAC;;mDAMG;AAgBI;IAVR,QAAQ,CAAC;QACR,QAAQ,EAAE,CAAC,KAAkC,EAAY,EAAE;YACzD,MAAM,QAAQ,GAAa,EAAE,CAAC;YAC9B,IAAI,KAAK,CAAC,GAAG,EAAE,CAAC;gBACd,QAAQ,CAAC,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC;YAC3B,CAAC;YACD,OAAO,QAAQ,CAAC;QAClB,CAAC;QACD,OAAO,EAAE,EAAE,SAAS,EAAE,CAAC,EAAE;KAC1B,CAAC;;iDAKC"}
+{"version":3,"file":"index.schema.js","sourceRoot":"","sources":["../../../src/resources/s3-storage/index.schema.ts"],"names":[],"mappings":";;;;;;;;;AAAA,OAAO,EAAE,kBAAkB,EAAE,MAAM,EAAE,QAAQ,EAAE,MAAM,eAAe,CAAC;AAErE,MAAM,uBAAuB,GAAG,CAAC,QAAQ,EAAE,KAAK,EAAE,MAAM,EAAE,MAAM,EAAE,KAAK,CAAU,CAAC;AAQlF,MAAM,0BAA0B,GAAG,CAAC,KAAK,EAAE,YAAY,CAAU,CAAC;AAYlE;;;;;;GAMG;AACH,MAAM,OAAO,yBAAyB;IAAtC;QACE;;;WAGG;QAEH,iBAAY,GAAG,MAAM,EAAU,CAAC;QAEhC;;WAEG;QAEH,cAAS,GAAG,MAAM,EAAW,CAAC;QAE9B;;WAEG;QAEH,eAAU,GAAG,MAAM,EAAW,CAAC;QAE/B;;WAEG;QAEH,wBAAmB,GAAG,MAAM,EAAU,CAAC;QAEvC;;WAEG;QAIH,kBAAa,GAAG,MAAM,EAA2B,CAAC;IACpD,CAAC;CAAA;AA3BC;IADC,QAAQ,CAAC,EAAE,OAAO,EAAE,EAAE,MAAM,EAAE,CAAC,KAAc,EAAW,EAAE,CAAC,OAAO,KAAK,KAAK,QAAQ,EAAE,EAAE,CAAC;;+DAC1D;AAMhC;IADC,QAAQ,CAAC,EAAE,OAAO,EAAE,EAAE,SAAS,EAAE,CAAC,EAAE,EAAE,CAAC;;4DACV;AAM9B;IADC,QAAQ,CAAC,EAAE,OAAO,EAAE,EAAE,SAAS,EAAE,CAAC,EAAE,EAAE,CAAC;;6DACT;AAM/B;IADC,QAAQ,CAAC,EAAE,OAAO,EAAE,EAAE,SAAS,EAAE,CAAC,EAAE,EAAE,CAAC;;sEACD;AAQvC;IAHC,QAAQ,CAAC;QACR,OAAO,EAAE,EAAE,MAAM,EAAE,CAAC,KAAa,EAAW,EAAE,CAAE,0BAAgD,CAAC,QAAQ,CAAC,KAAK,CAAC,EAAE;KACnH,CAAC;;gEACgD;AAGpD;;;;;;;;;GASG;AACH,MAAM,OAAO,uBAAuB;IAApC;QACE;;;WAGG;QAKH,iBAAY,GAAI,MAAM,CAAW,EAAE,CAAC,CAAC;QAErC;;WAEG;QAWH,iBAAY,GAAG,MAAM,EAA0B,CAAC;QAEhD;;;;WAIG;QAWH,iBAAY,GAAG,MAAM,EAAY,CAAC;QAElC;;;WAGG;QAKH,kBAAa,GAAI,MAAM,CAAW,EAAE,CAAC,CAAC;QAEtC;;;WAGG;QAWH,kBAAa,GAAI,MAAM,CAAgB,IAAI,CAAC,CAAC;IAC/C,CAAC;CAAA;AA3DC;IAJC,QAAQ,CAAC;QACR,QAAQ,EAAE,CAAC,KAA8C,EAAY,EAAE,CAAC,KAAM;QAC9E,OAAO,EAAE,EAAE,SAAS,EAAE,CAAC,EAAE;KAC1B,CAAC;;6DACmC;AAerC;IAVC,QAAQ,CAAU;QACjB;YACE,QAAQ,EAAE,CAAC,KAA8C,EAAc,EAAE,CAAC,CAAC,KAAK,CAAC;YACjF,OAAO,EAAE,EAAE,SAAS,EAAE,CAAC,EAAE;SAC1B;QACD;YACE,QAAQ,EAAE,CAAC,KAA8C,EAAY,EAAE,CAAC,KAAK;YAC7E,OAAO,EAAE,EAAE,MAAM,EAAE,CAAC,KAAa,EAAW,EAAE,CAAE,uBAA6C,CAAC,QAAQ,CAAC,KAAK,CAAC,EAAE;SAChH;KACF,CAAC;;6DAC8C;AAiBhD;IAVC,QAAQ,CAAU;QACjB;YACE,QAAQ,EAAE,CAAC,KAA8C,EAAc,EAAE,CAAC,CAAC,KAAK,CAAC;YACjF,OAAO,EAAE,EAAE,SAAS,EAAE,CAAC,EAAE;SAC1B;QACD;YACE,QAAQ,EAAE,CAAC,KAA8C,EAAY,EAAE,CAAC,KAAK;YAC7E,OAAO,EAAE,EAAE,SAAS,EAAE,CAAC,EAAE;SAC1B;KACF,CAAC;;6DACgC;AAUlC;IAJC,QAAQ,CAAC;QACR,QAAQ,EAAE,CAAC,KAA+C,EAAY,EAAE,CAAC,KAAM;QAC/E,OAAO,EAAE,EAAE,SAAS,EAAE,CAAC,EAAE;KAC1B,CAAC;;8DACoC;AAgBtC;IAVC,QAAQ,CAAC;QACR,QAAQ,EAAE,CAAC,KAA+C,EAAY,EAAE;YACtE,MAAM,QAAQ,GAAa,EAAE,CAAC;YAC9B,IAAI,KAAK,KAAK,IAAI,IAAI,KAAK,KAAK,SAAS,EAAE,CAAC;gBAC1C,QAAQ,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;YACvB,CAAC;YACD,OAAO,QAAQ,CAAC;QAClB,CAAC;QACD,OAAO,EAAE,EAAE,SAAS,EAAE,CAAC,EAAE;KAC1B,CAAC;;8DAC2C;AAG/C;;;;;;;;;;GAUG;AACH,MAAM,OAAO,4BAA4B;IAAzC;QACE;;WAEG;QAEH,qBAAgB,GAAG,MAAM,EAAU,CAAC;QAEpC;;WAEG;QAIH,WAAM,GAAI,MAAM,CAAS,EAAE,CAAC,CAAC;QAE7B;;WAEG;QAUH,SAAI,GAAI,MAAM,CAA4B,EAAE,CAAC,CAAC;IAChD,CAAC;CAAA;AAvBC;IADC,QAAQ,CAAC,EAAE,OAAO,EAAE,EAAE,SAAS,EAAE,CAAC,EAAE,EAAE,CAAC;;sEACJ;AAQpC;IAHC,QAAQ,CAAC;QACR,OAAO,EAAE,EAAE,MAAM,EAAE,CAAC,KAAc,EAAW,EAAE,CAAC,OAAO,KAAK,KAAK,QAAQ,EAAE;KAC5E,CAAC;;4DAC2B;AAc7B;IATC,QAAQ,CAAC;QACR,OAAO,EAAE;YACP,MAAM,EAAE,CAAC,KAAc,EAAW,EAAE,CAClC,OAAO,KAAK,KAAK,QAAQ;gBACzB,KAAK,KAAK,IAAI;gBACd,CAAC,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC;gBACrB,MAAM,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,OAAO,CAAC,KAAK,QAAQ,CAAC;SAC3D;KACF,CAAC;;0DAC4C;AAGhD;;GAEG;AACH,MAAM,OAAO,uBAAwB,SAAQ,kBAAkB;IAA/D;;QAWW,aAAQ,GAAG,MAAM,CAEvB;YACD,GAAG,EAAE,0BAA0B;SAChC,CAAC,CAAC;IACL,CAAC;CAAA;AALU;IAVR,QAAQ,CAAC;QACR,QAAQ,EAAE,CAAC,KAA0C,EAAY,EAAE;YACjE,MAAM,QAAQ,GAAa,EAAE,CAAC;YAC9B,IAAI,KAAK,CAAC,GAAG,EAAE,CAAC;gBACd,QAAQ,CAAC,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC;YAC3B,CAAC;YACD,OAAO,QAAQ,CAAC;QAClB,CAAC;QACD,OAAO,EAAE,EAAE,SAAS,EAAE,CAAC,EAAE;KAC1B,CAAC;;yDAKC;AAGL;;;;;;;;;;;;;;;;;;;;;;;;;;GA0BG;AACH,MAAM,OAAO,eAAgB,SAAQ,kBAAkB;IAAvD;;QACE;;;;;;;;;WASG;QA2BM,eAAU,GAAG,MAAM,EAQxB,CAAC;QAEL;;;;;;;WAOG;QAoBM,aAAQ,GAAG,MAAM,CAKvB;YACD,GAAG,EAAE,0BAA0B;YAC/B,WAAW,EAAE,WAAW;YACxB,MAAM,EAAE,aAAa;YACrB,kBAAkB,EAAE,wCAAwC;SAC7D,CAAC,CAAC;QAEH,sBAAiB,GAAG,MAAM,CAAmC,EAAE,CAAC,CAAC;IACnE,CAAC;CAAA;AAlDU;IA1BR,QAAQ,CAAU;QACjB;YACE,QAAQ,EAAE,CAAC,KAAoC,EAAY,EAAE,CAAC;gBAC5D,KAAK,CAAC,YAAY;gBAClB,KAAK,CAAC,WAAW;gBACjB,KAAK,CAAC,MAAM;aACb;YACD,OAAO,EAAE,EAAE,SAAS,EAAE,CAAC,EAAE;SAC1B;QACD;YACE,QAAQ,EAAE,CAAC,KAAoC,EAAa,EAAE,CAAC,CAAC,KAAK,CAAC,iBAAiB,CAAC;YACxF,OAAO,EAAE,EAAE,SAAS,EAAE,CAAC,EAAE;SAC1B;QACD;YACE,QAAQ,EAAE,CAAC,KAAoC,EAA6B,EAAE,CAAC,KAAK,CAAC,SAAS;YAC9F,OAAO,EAAE,EAAE,QAAQ,EAAE,EAAE,MAAM,EAAE,uBAAuB,EAAE,EAAE;SAC3D;QACD;YACE,QAAQ,EAAE,CAAC,KAAoC,EAAkC,EAAE,CAAC,KAAK,CAAC,cAAc;YACxG,OAAO,EAAE,EAAE,QAAQ,EAAE,EAAE,MAAM,EAAE,4BAA4B,EAAE,EAAE;SAChE;QACD;YACE,QAAQ,EAAE,CAAC,KAAoC,EAA+B,EAAE,CAAC,KAAK,CAAC,WAAW;YAClG,OAAO,EAAE,EAAE,QAAQ,EAAE,EAAE,MAAM,EAAE,yBAAyB,EAAE,EAAE;SAC7D;KACF,CAAC;;mDASG;AA6BI;IAnBR,QAAQ,CAAC;QACR,QAAQ,EAAE,CAAC,KAAkC,EAAY,EAAE;YACzD,MAAM,QAAQ,GAAa,EAAE,CAAC;YAC9B,IAAI,KAAK,CAAC,GAAG,EAAE,CAAC;gBACd,QAAQ,CAAC,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC;YAC3B,CAAC;YACD,IAAI,KAAK,CAAC,WAAW,EAAE,CAAC;gBACtB,QAAQ,CAAC,IAAI,CAAC,KAAK,CAAC,WAAW,CAAC,CAAC;YACnC,CAAC;YACD,IAAI,KAAK,CAAC,MAAM,EAAE,CAAC;gBACjB,QAAQ,CAAC,IAAI,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC;YAC9B,CAAC;YACD,IAAI,KAAK,CAAC,kBAAkB,EAAE,CAAC;gBAC7B,QAAQ,CAAC,IAAI,CAAC,KAAK,CAAC,kBAAkB,CAAC,CAAC;YAC1C,CAAC;YACD,OAAO,QAAQ,CAAC;QAClB,CAAC;QACD,OAAO,EAAE,EAAE,SAAS,EAAE,CAAC,EAAE;KAC1B,CAAC;;iDAWC"}

package/dist/resources/s3-storage/s3-storage.resource.d.ts

@@ -1,13 +1,6 @@
-import { ATerraformResource, Diff, MatchingResource, type TerraformModuleScope } from '@quadnix/octo';
-import { type PrincipalResourceSchema, S3StorageSchema } from './index.schema.js';
-/**
- * @internal
- */
-export type S3StorageManifestDiff = {
-    [key: string]: {
-        [key: string]: 'addDirectoryPermissions' | 'deleteDirectoryPermissions' | 'updateDirectoryPermissions';
-    };
-};
+import { AResource, ATerraformResource, type BaseResourceSchema, Diff, MatchingResource, type TerraformModuleScope } from '@quadnix/octo';
+import type { IManifest } from '../../utilities/s3-file-source/s3-file-source.utility.js';
+import { type IS3StoragePrincipalType, type PrincipalResourceSchema, S3StorageSchema } from './index.schema.js';
 /**
  * @internal
  */
@@ -15,16 +8,28 @@ export declare class S3Storage extends ATerraformResource<S3StorageSchema, S3Sto
     parents: MatchingResource<PrincipalResourceSchema>[];
     properties: S3StorageSchema['properties'];
     response: S3StorageSchema['response'];
+    private readonly manifest;
+    private sourcePathDigests;
+    /**
+     * @internal
+     */
+    constructor(resourceId: string, properties: S3StorageSchema['properties'], parents?: (MatchingResource<PrincipalResourceSchema> | AResource<BaseResourceSchema, any>)[]);
     /**
      * @internal
      */
-    constructor(resourceId: string, properties: S3StorageSchema['properties'], parents?: MatchingResource<PrincipalResourceSchema>[]);
+    static unSynth<S extends BaseResourceSchema, T>(deserializationClass: any, resource: S, deReferenceResource: (context: string) => Promise<AResource<BaseResourceSchema, any>>): Promise<T>;
     /**
+     * Admits one principal to an access prefix of this bucket, as statements of the bucket's policy.
+     *
+     * A principal already admitted to the prefix has its read and write replaced. A `cloudfront`
+     * principal may only read.
+     *
      * @internal
      */
-    addPermission(principal: MatchingResource<PrincipalResourceSchema>, remoteDirectoryPath: string, options: {
+    addPermission(principal: MatchingResource<PrincipalResourceSchema>, accessPrefix: string, options: {
         allowRead: boolean;
         allowWrite: boolean;
+        principalType: IS3StoragePrincipalType;
     }): void;
     /**
      * @internal
@@ -34,10 +39,18 @@ export declare class S3Storage extends ATerraformResource<S3StorageSchema, S3Sto
      * @internal
      */
     diffUnpack(diff: Diff): Diff[];
+    /**
+     * @internal
+     */
+    synth(): S3StorageSchema;
     /**
      * @internal
      */
     toHCL(terraform: TerraformModuleScope): Promise<void>;
+    /**
+     * @internal
+     */
+    updateManifest(manifestDiff: IManifest): void;
     /**
      * @internal
      */