@quadnix/octo-aws-cdk 0.2.0 → 0.2.1

package/dist/modules/server/aws-server/models/server/aws-server.model.d.ts

@@ -0,0 +1,11 @@
+import { Server } from '@quadnix/octo';
+import { AwsServerSchema } from './aws-server.schema.js';
+/**
+ * @internal
+ */
+export declare class AwsServer extends Server {
+    /**
+     * @internal
+     */
+    static unSynth(server: AwsServerSchema): Promise<AwsServer>;
+}

package/dist/modules/server/{aws-ecs-server/models/server/aws-ecs-server.model.js → aws-server/models/server/aws-server.model.js}

@@ -4,22 +4,22 @@ var __decorate = (this && this.__decorate) || function (decorators, target, key,
     else for (var i = decorators.length - 1; i >= 0; i--) if (d = decorators[i]) r = (c < 3 ? d(r) : c > 3 ? d(target, key, r) : d(target, key)) || r;
     return c > 3 && r && Object.defineProperty(target, key, r), r;
 };
-var AwsEcsServer_1;
+var AwsServer_1;
 import { Model, Server } from '@quadnix/octo';
-import { AwsEcsServerSchema } from './aws-ecs-server.schema.js';
+import { AwsServerSchema } from './aws-server.schema.js';
 /**
  * @internal
  */
-let AwsEcsServer = AwsEcsServer_1 = class AwsEcsServer extends Server {
+let AwsServer = AwsServer_1 = class AwsServer extends Server {
     /**
      * @internal
      */
     static async unSynth(server) {
-        return new AwsEcsServer_1(server.serverKey);
+        return new AwsServer_1(server.serverKey);
     }
 };
-AwsEcsServer = AwsEcsServer_1 = __decorate([
-    Model('@octo', 'server', AwsEcsServerSchema)
-], AwsEcsServer);
-export { AwsEcsServer };
-//# sourceMappingURL=aws-ecs-server.model.js.map
+AwsServer = AwsServer_1 = __decorate([
+    Model('@octo', 'server', AwsServerSchema)
+], AwsServer);
+export { AwsServer };
+//# sourceMappingURL=aws-server.model.js.map

package/dist/modules/server/aws-server/models/server/aws-server.model.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"aws-server.model.js","sourceRoot":"","sources":["../../../../../../src/modules/server/aws-server/models/server/aws-server.model.ts"],"names":[],"mappings":";;;;;;;AAAA,OAAO,EAAE,KAAK,EAAE,MAAM,EAAE,MAAM,eAAe,CAAC;AAC9C,OAAO,EAAE,eAAe,EAAE,MAAM,wBAAwB,CAAC;AAEzD;;GAEG;AAEI,IAAM,SAAS,iBAAf,MAAM,SAAU,SAAQ,MAAM;IACnC;;OAEG;IACH,MAAM,CAAU,KAAK,CAAC,OAAO,CAAC,MAAuB;QACnD,OAAO,IAAI,WAAS,CAAC,MAAM,CAAC,SAAS,CAAC,CAAC;IACzC,CAAC;CACF,CAAA;AAPY,SAAS;IADrB,KAAK,CAAY,OAAO,EAAE,QAAQ,EAAE,eAAe,CAAC;GACxC,SAAS,CAOrB"}

package/dist/modules/server/{aws-ecs-server/models/server/aws-ecs-server.schema.d.ts → aws-server/models/server/aws-server.schema.d.ts}

@@ -2,5 +2,5 @@ import { ServerSchema } from '@quadnix/octo';
 /**
  * @internal
  */
-export declare class AwsEcsServerSchema extends ServerSchema {
+export declare class AwsServerSchema extends ServerSchema {
 }

package/dist/modules/server/aws-server/models/server/aws-server.schema.js

@@ -0,0 +1,7 @@
+import { ServerSchema } from '@quadnix/octo';
+/**
+ * @internal
+ */
+export class AwsServerSchema extends ServerSchema {
+}
+//# sourceMappingURL=aws-server.schema.js.map

package/dist/modules/server/aws-server/models/server/aws-server.schema.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"aws-server.schema.js","sourceRoot":"","sources":["../../../../../../src/modules/server/aws-server/models/server/aws-server.schema.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,YAAY,EAAE,MAAM,eAAe,CAAC;AAE7C;;GAEG;AACH,MAAM,OAAO,eAAgB,SAAQ,YAAY;CAAG"}

package/dist/modules/server/aws-server/models/server/index.d.ts

@@ -0,0 +1,2 @@
+import './actions/add-aws-server.model.action.js';
+export { AwsServer } from './aws-server.model.js';

package/dist/modules/server/aws-server/models/server/index.js

@@ -0,0 +1,3 @@
+import './actions/add-aws-server.model.action.js';
+export { AwsServer } from './aws-server.model.js';
+//# sourceMappingURL=index.js.map

package/dist/modules/server/aws-server/models/server/index.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../../../../../../src/modules/server/aws-server/models/server/index.ts"],"names":[],"mappings":"AAAA,OAAO,0CAA0C,CAAC;AAElD,OAAO,EAAE,SAAS,EAAE,MAAM,uBAAuB,CAAC"}

package/dist/modules/server/aws-server/overlays/aws-server-dynamodb-access/actions/add-aws-server-dynamodb-access.overlay.action.d.ts

@@ -0,0 +1,28 @@
+import { type ActionOutputs, type Diff, type EnhancedModuleSchema, type IModelAction } from '@quadnix/octo';
+import type { AwsServerModule } from '../../../aws-server.module.js';
+import { AwsServerDynamoDBAccessOverlay } from '../aws-server-dynamodb-access.overlay.js';
+/**
+ * A grant creates nothing. The execution running the server grants it to the role it creates.
+ *
+ * @internal
+ */
+export declare class AddAwsServerDynamoDBAccessOverlayAction implements IModelAction<AwsServerModule> {
+    /**
+     * @internal
+     */
+    filter(diff: Diff): boolean;
+    /**
+     * @internal
+     */
+    handle(_diff: Diff<AwsServerDynamoDBAccessOverlay>, _actionInputs: EnhancedModuleSchema<AwsServerModule>, actionOutputs: ActionOutputs): Promise<ActionOutputs>;
+}
+/**
+ * @internal
+ */
+export declare class AddAwsServerDynamoDBAccessOverlayActionFactory {
+    private static instance;
+    /**
+     * @internal
+     */
+    static create(): Promise<AddAwsServerDynamoDBAccessOverlayAction>;
+}

package/dist/modules/server/aws-server/overlays/aws-server-dynamodb-access/actions/add-aws-server-dynamodb-access.overlay.action.js

@@ -0,0 +1,53 @@
+var __decorate = (this && this.__decorate) || function (decorators, target, key, desc) {
+    var c = arguments.length, r = c < 3 ? target : desc === null ? desc = Object.getOwnPropertyDescriptor(target, key) : desc, d;
+    if (typeof Reflect === "object" && typeof Reflect.decorate === "function") r = Reflect.decorate(decorators, target, key, desc);
+    else for (var i = decorators.length - 1; i >= 0; i--) if (d = decorators[i]) r = (c < 3 ? d(r) : c > 3 ? d(target, key, r) : d(target, key)) || r;
+    return c > 3 && r && Object.defineProperty(target, key, r), r;
+};
+import { Action, DiffAction, Factory, hasNodeName, } from '@quadnix/octo';
+import { AwsServerDynamoDBAccessOverlay } from '../aws-server-dynamodb-access.overlay.js';
+/**
+ * A grant creates nothing. The execution running the server grants it to the role it creates.
+ *
+ * @internal
+ */
+let AddAwsServerDynamoDBAccessOverlayAction = class AddAwsServerDynamoDBAccessOverlayAction {
+    /**
+     * @internal
+     */
+    filter(diff) {
+        return (diff.action === DiffAction.ADD &&
+            diff.node instanceof AwsServerDynamoDBAccessOverlay &&
+            hasNodeName(diff.node, 'aws-server-dynamodb-access-overlay') &&
+            diff.field === 'overlayId');
+    }
+    /**
+     * @internal
+     */
+    async handle(_diff, _actionInputs, actionOutputs) {
+        return actionOutputs;
+    }
+};
+AddAwsServerDynamoDBAccessOverlayAction = __decorate([
+    Action(AwsServerDynamoDBAccessOverlay)
+], AddAwsServerDynamoDBAccessOverlayAction);
+export { AddAwsServerDynamoDBAccessOverlayAction };
+/**
+ * @internal
+ */
+let AddAwsServerDynamoDBAccessOverlayActionFactory = class AddAwsServerDynamoDBAccessOverlayActionFactory {
+    /**
+     * @internal
+     */
+    static async create() {
+        if (!this.instance) {
+            this.instance = new AddAwsServerDynamoDBAccessOverlayAction();
+        }
+        return this.instance;
+    }
+};
+AddAwsServerDynamoDBAccessOverlayActionFactory = __decorate([
+    Factory(AddAwsServerDynamoDBAccessOverlayAction)
+], AddAwsServerDynamoDBAccessOverlayActionFactory);
+export { AddAwsServerDynamoDBAccessOverlayActionFactory };
+//# sourceMappingURL=add-aws-server-dynamodb-access.overlay.action.js.map

package/dist/modules/server/aws-server/overlays/aws-server-dynamodb-access/actions/add-aws-server-dynamodb-access.overlay.action.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"add-aws-server-dynamodb-access.overlay.action.js","sourceRoot":"","sources":["../../../../../../../src/modules/server/aws-server/overlays/aws-server-dynamodb-access/actions/add-aws-server-dynamodb-access.overlay.action.ts"],"names":[],"mappings":";;;;;;AAAA,OAAO,EACL,MAAM,EAGN,UAAU,EAEV,OAAO,EAEP,WAAW,GACZ,MAAM,eAAe,CAAC;AAEvB,OAAO,EAAE,8BAA8B,EAAE,MAAM,0CAA0C,CAAC;AAE1F;;;;GAIG;AAEI,IAAM,uCAAuC,GAA7C,MAAM,uCAAuC;IAClD;;OAEG;IACH,MAAM,CAAC,IAAU;QACf,OAAO,CACL,IAAI,CAAC,MAAM,KAAK,UAAU,CAAC,GAAG;YAC9B,IAAI,CAAC,IAAI,YAAY,8BAA8B;YACnD,WAAW,CAAC,IAAI,CAAC,IAAI,EAAE,oCAAoC,CAAC;YAC5D,IAAI,CAAC,KAAK,KAAK,WAAW,CAC3B,CAAC;IACJ,CAAC;IAED;;OAEG;IACH,KAAK,CAAC,MAAM,CACV,KAA2C,EAC3C,aAAoD,EACpD,aAA4B;QAE5B,OAAO,aAAa,CAAC;IACvB,CAAC;CACF,CAAA;AAvBY,uCAAuC;IADnD,MAAM,CAAC,8BAA8B,CAAC;GAC1B,uCAAuC,CAuBnD;;AAED;;GAEG;AAEI,IAAM,8CAA8C,GAApD,MAAM,8CAA8C;IAGzD;;OAEG;IACH,MAAM,CAAC,KAAK,CAAC,MAAM;QACjB,IAAI,CAAC,IAAI,CAAC,QAAQ,EAAE,CAAC;YACnB,IAAI,CAAC,QAAQ,GAAG,IAAI,uCAAuC,EAAE,CAAC;QAChE,CAAC;QACD,OAAO,IAAI,CAAC,QAAQ,CAAC;IACvB,CAAC;CACF,CAAA;AAZY,8CAA8C;IAD1D,OAAO,CAA0C,uCAAuC,CAAC;GAC7E,8CAA8C,CAY1D"}

package/dist/modules/server/aws-server/overlays/aws-server-dynamodb-access/aws-server-dynamodb-access.overlay.d.ts

@@ -0,0 +1,22 @@
+import { AOverlay, type Diff, type MatchingAnchor } from '@quadnix/octo';
+import type { AwsDynamoDBAnchorSchema } from '../../../../../anchors/aws-dynamodb/aws-dynamodb.anchor.schema.js';
+import type { AwsServerAnchor } from '../../../../../anchors/aws-server/aws-server.anchor.js';
+import { AwsServerDynamoDBAccessOverlaySchema } from './aws-server-dynamodb-access.schema.js';
+/**
+ * A server's grant to one DynamoDB table. It creates nothing: the execution running the
+ * server reads it and grants the access to the role it creates.
+ *
+ * @internal
+ */
+export declare class AwsServerDynamoDBAccessOverlay extends AOverlay<AwsServerDynamoDBAccessOverlaySchema, AwsServerDynamoDBAccessOverlay> {
+    anchors: [AwsServerAnchor, MatchingAnchor<AwsDynamoDBAnchorSchema>];
+    properties: AwsServerDynamoDBAccessOverlaySchema['properties'];
+    /**
+     * @internal
+     */
+    constructor(overlayId: string, properties: AwsServerDynamoDBAccessOverlaySchema['properties'], anchors: [AwsServerAnchor, MatchingAnchor<AwsDynamoDBAnchorSchema>]);
+    /**
+     * @internal
+     */
+    diffAnchors(): Promise<Diff[]>;
+}

package/dist/modules/server/aws-server/overlays/aws-server-dynamodb-access/aws-server-dynamodb-access.overlay.js

@@ -0,0 +1,37 @@
+var __decorate = (this && this.__decorate) || function (decorators, target, key, desc) {
+    var c = arguments.length, r = c < 3 ? target : desc === null ? desc = Object.getOwnPropertyDescriptor(target, key) : desc, d;
+    if (typeof Reflect === "object" && typeof Reflect.decorate === "function") r = Reflect.decorate(decorators, target, key, desc);
+    else for (var i = decorators.length - 1; i >= 0; i--) if (d = decorators[i]) r = (c < 3 ? d(r) : c > 3 ? d(target, key, r) : d(target, key)) || r;
+    return c > 3 && r && Object.defineProperty(target, key, r), r;
+};
+var __metadata = (this && this.__metadata) || function (k, v) {
+    if (typeof Reflect === "object" && typeof Reflect.metadata === "function") return Reflect.metadata(k, v);
+};
+import { AOverlay, Overlay } from '@quadnix/octo';
+import { AwsServerDynamoDBAccessOverlaySchema } from './aws-server-dynamodb-access.schema.js';
+/**
+ * A server's grant to one DynamoDB table. It creates nothing: the execution running the
+ * server reads it and grants the access to the role it creates.
+ *
+ * @internal
+ */
+let AwsServerDynamoDBAccessOverlay = class AwsServerDynamoDBAccessOverlay extends AOverlay {
+    /**
+     * @internal
+     */
+    constructor(overlayId, properties, anchors) {
+        super(overlayId, properties, anchors);
+    }
+    /**
+     * @internal
+     */
+    async diffAnchors() {
+        return [];
+    }
+};
+AwsServerDynamoDBAccessOverlay = __decorate([
+    Overlay('@octo', 'aws-server-dynamodb-access-overlay', AwsServerDynamoDBAccessOverlaySchema),
+    __metadata("design:paramtypes", [String, Object, Array])
+], AwsServerDynamoDBAccessOverlay);
+export { AwsServerDynamoDBAccessOverlay };
+//# sourceMappingURL=aws-server-dynamodb-access.overlay.js.map

package/dist/modules/server/aws-server/overlays/aws-server-dynamodb-access/aws-server-dynamodb-access.overlay.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"aws-server-dynamodb-access.overlay.js","sourceRoot":"","sources":["../../../../../../src/modules/server/aws-server/overlays/aws-server-dynamodb-access/aws-server-dynamodb-access.overlay.ts"],"names":[],"mappings":";;;;;;;;;AAAA,OAAO,EAAE,QAAQ,EAAkC,OAAO,EAAE,MAAM,eAAe,CAAC;AAGlF,OAAO,EAAE,oCAAoC,EAAE,MAAM,wCAAwC,CAAC;AAE9F;;;;;GAKG;AAEI,IAAM,8BAA8B,GAApC,MAAM,8BAA+B,SAAQ,QAGnD;IAIC;;OAEG;IACH,YACE,SAAiB,EACjB,UAA8D,EAC9D,OAAmE;QAEnE,KAAK,CAAC,SAAS,EAAE,UAAU,EAAE,OAAO,CAAC,CAAC;IACxC,CAAC;IAED;;OAEG;IACM,KAAK,CAAC,WAAW;QACxB,OAAO,EAAE,CAAC;IACZ,CAAC;CACF,CAAA;AAxBY,8BAA8B;IAD1C,OAAO,CAAC,OAAO,EAAE,oCAAoC,EAAE,oCAAoC,CAAC;;GAChF,8BAA8B,CAwB1C"}

package/dist/modules/server/aws-server/overlays/aws-server-dynamodb-access/aws-server-dynamodb-access.schema.d.ts

@@ -0,0 +1,13 @@
+import { BaseOverlaySchema } from '@quadnix/octo';
+/**
+ * @internal
+ */
+export declare class AwsServerDynamoDBAccessOverlaySchema extends BaseOverlaySchema {
+    properties: {
+        allowRead: boolean;
+        allowWrite: boolean;
+        awsRegionId: string;
+        serverKey: string;
+        tableName: string;
+    };
+}

package/dist/modules/server/aws-server/overlays/aws-server-dynamodb-access/aws-server-dynamodb-access.schema.js

@@ -0,0 +1,33 @@
+var __decorate = (this && this.__decorate) || function (decorators, target, key, desc) {
+    var c = arguments.length, r = c < 3 ? target : desc === null ? desc = Object.getOwnPropertyDescriptor(target, key) : desc, d;
+    if (typeof Reflect === "object" && typeof Reflect.decorate === "function") r = Reflect.decorate(decorators, target, key, desc);
+    else for (var i = decorators.length - 1; i >= 0; i--) if (d = decorators[i]) r = (c < 3 ? d(r) : c > 3 ? d(target, key, r) : d(target, key)) || r;
+    return c > 3 && r && Object.defineProperty(target, key, r), r;
+};
+var __metadata = (this && this.__metadata) || function (k, v) {
+    if (typeof Reflect === "object" && typeof Reflect.metadata === "function") return Reflect.metadata(k, v);
+};
+import { BaseOverlaySchema, Schema, Validate } from '@quadnix/octo';
+/**
+ * @internal
+ */
+export class AwsServerDynamoDBAccessOverlaySchema extends BaseOverlaySchema {
+    constructor() {
+        super(...arguments);
+        this.properties = Schema();
+    }
+}
+__decorate([
+    Validate({
+        destruct: (value) => [
+            String(value.allowRead),
+            String(value.allowWrite),
+            value.awsRegionId,
+            value.serverKey,
+            value.tableName,
+        ],
+        options: { minLength: 1 },
+    }),
+    __metadata("design:type", Object)
+], AwsServerDynamoDBAccessOverlaySchema.prototype, "properties", void 0);
+//# sourceMappingURL=aws-server-dynamodb-access.schema.js.map

package/dist/modules/server/aws-server/overlays/aws-server-dynamodb-access/aws-server-dynamodb-access.schema.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"aws-server-dynamodb-access.schema.js","sourceRoot":"","sources":["../../../../../../src/modules/server/aws-server/overlays/aws-server-dynamodb-access/aws-server-dynamodb-access.schema.ts"],"names":[],"mappings":";;;;;;;;;AAAA,OAAO,EAAE,iBAAiB,EAAE,MAAM,EAAE,QAAQ,EAAE,MAAM,eAAe,CAAC;AAEpE;;GAEG;AACH,MAAM,OAAO,oCAAqC,SAAQ,iBAAiB;IAA3E;;QAWW,eAAU,GAAG,MAAM,EAMxB,CAAC;IACP,CAAC;CAAA;AAPU;IAVR,QAAQ,CAAC;QACR,QAAQ,EAAE,CAAC,KAAyD,EAAY,EAAE,CAAC;YACjF,MAAM,CAAC,KAAK,CAAC,SAAS,CAAC;YACvB,MAAM,CAAC,KAAK,CAAC,UAAU,CAAC;YACxB,KAAK,CAAC,WAAW;YACjB,KAAK,CAAC,SAAS;YACf,KAAK,CAAC,SAAS;SAChB;QACD,OAAO,EAAE,EAAE,SAAS,EAAE,CAAC,EAAE;KAC1B,CAAC;;wEAOG"}

package/dist/modules/server/aws-server/overlays/aws-server-dynamodb-access/index.d.ts

@@ -0,0 +1,2 @@
+import './actions/add-aws-server-dynamodb-access.overlay.action.js';
+export { AwsServerDynamoDBAccessOverlay } from './aws-server-dynamodb-access.overlay.js';

package/dist/modules/server/aws-server/overlays/aws-server-dynamodb-access/index.js

@@ -0,0 +1,3 @@
+import './actions/add-aws-server-dynamodb-access.overlay.action.js';
+export { AwsServerDynamoDBAccessOverlay } from './aws-server-dynamodb-access.overlay.js';
+//# sourceMappingURL=index.js.map

package/dist/modules/server/aws-server/overlays/aws-server-dynamodb-access/index.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../../../../../../src/modules/server/aws-server/overlays/aws-server-dynamodb-access/index.ts"],"names":[],"mappings":"AAAA,OAAO,4DAA4D,CAAC;AAEpE,OAAO,EAAE,8BAA8B,EAAE,MAAM,yCAAyC,CAAC"}

package/dist/modules/server/aws-server/overlays/aws-server-s3-access/actions/add-aws-server-s3-access.overlay.action.d.ts

@@ -0,0 +1,28 @@
+import { type ActionOutputs, type Diff, type EnhancedModuleSchema, type IModelAction } from '@quadnix/octo';
+import type { AwsServerModule } from '../../../aws-server.module.js';
+import { AwsServerS3AccessOverlay } from '../aws-server-s3-access.overlay.js';
+/**
+ * A grant creates nothing. The execution running the server grants it to the role it creates.
+ *
+ * @internal
+ */
+export declare class AddAwsServerS3AccessOverlayAction implements IModelAction<AwsServerModule> {
+    /**
+     * @internal
+     */
+    filter(diff: Diff): boolean;
+    /**
+     * @internal
+     */
+    handle(_diff: Diff<AwsServerS3AccessOverlay>, _actionInputs: EnhancedModuleSchema<AwsServerModule>, actionOutputs: ActionOutputs): Promise<ActionOutputs>;
+}
+/**
+ * @internal
+ */
+export declare class AddAwsServerS3AccessOverlayActionFactory {
+    private static instance;
+    /**
+     * @internal
+     */
+    static create(): Promise<AddAwsServerS3AccessOverlayAction>;
+}

package/dist/modules/server/aws-server/overlays/aws-server-s3-access/actions/add-aws-server-s3-access.overlay.action.js

@@ -0,0 +1,53 @@
+var __decorate = (this && this.__decorate) || function (decorators, target, key, desc) {
+    var c = arguments.length, r = c < 3 ? target : desc === null ? desc = Object.getOwnPropertyDescriptor(target, key) : desc, d;
+    if (typeof Reflect === "object" && typeof Reflect.decorate === "function") r = Reflect.decorate(decorators, target, key, desc);
+    else for (var i = decorators.length - 1; i >= 0; i--) if (d = decorators[i]) r = (c < 3 ? d(r) : c > 3 ? d(target, key, r) : d(target, key)) || r;
+    return c > 3 && r && Object.defineProperty(target, key, r), r;
+};
+import { Action, DiffAction, Factory, hasNodeName, } from '@quadnix/octo';
+import { AwsServerS3AccessOverlay } from '../aws-server-s3-access.overlay.js';
+/**
+ * A grant creates nothing. The execution running the server grants it to the role it creates.
+ *
+ * @internal
+ */
+let AddAwsServerS3AccessOverlayAction = class AddAwsServerS3AccessOverlayAction {
+    /**
+     * @internal
+     */
+    filter(diff) {
+        return (diff.action === DiffAction.ADD &&
+            diff.node instanceof AwsServerS3AccessOverlay &&
+            hasNodeName(diff.node, 'aws-server-s3-access-overlay') &&
+            diff.field === 'overlayId');
+    }
+    /**
+     * @internal
+     */
+    async handle(_diff, _actionInputs, actionOutputs) {
+        return actionOutputs;
+    }
+};
+AddAwsServerS3AccessOverlayAction = __decorate([
+    Action(AwsServerS3AccessOverlay)
+], AddAwsServerS3AccessOverlayAction);
+export { AddAwsServerS3AccessOverlayAction };
+/**
+ * @internal
+ */
+let AddAwsServerS3AccessOverlayActionFactory = class AddAwsServerS3AccessOverlayActionFactory {
+    /**
+     * @internal
+     */
+    static async create() {
+        if (!this.instance) {
+            this.instance = new AddAwsServerS3AccessOverlayAction();
+        }
+        return this.instance;
+    }
+};
+AddAwsServerS3AccessOverlayActionFactory = __decorate([
+    Factory(AddAwsServerS3AccessOverlayAction)
+], AddAwsServerS3AccessOverlayActionFactory);
+export { AddAwsServerS3AccessOverlayActionFactory };
+//# sourceMappingURL=add-aws-server-s3-access.overlay.action.js.map

package/dist/modules/server/aws-server/overlays/aws-server-s3-access/actions/add-aws-server-s3-access.overlay.action.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"add-aws-server-s3-access.overlay.action.js","sourceRoot":"","sources":["../../../../../../../src/modules/server/aws-server/overlays/aws-server-s3-access/actions/add-aws-server-s3-access.overlay.action.ts"],"names":[],"mappings":";;;;;;AAAA,OAAO,EACL,MAAM,EAGN,UAAU,EAEV,OAAO,EAEP,WAAW,GACZ,MAAM,eAAe,CAAC;AAEvB,OAAO,EAAE,wBAAwB,EAAE,MAAM,oCAAoC,CAAC;AAE9E;;;;GAIG;AAEI,IAAM,iCAAiC,GAAvC,MAAM,iCAAiC;IAC5C;;OAEG;IACH,MAAM,CAAC,IAAU;QACf,OAAO,CACL,IAAI,CAAC,MAAM,KAAK,UAAU,CAAC,GAAG;YAC9B,IAAI,CAAC,IAAI,YAAY,wBAAwB;YAC7C,WAAW,CAAC,IAAI,CAAC,IAAI,EAAE,8BAA8B,CAAC;YACtD,IAAI,CAAC,KAAK,KAAK,WAAW,CAC3B,CAAC;IACJ,CAAC;IAED;;OAEG;IACH,KAAK,CAAC,MAAM,CACV,KAAqC,EACrC,aAAoD,EACpD,aAA4B;QAE5B,OAAO,aAAa,CAAC;IACvB,CAAC;CACF,CAAA;AAvBY,iCAAiC;IAD7C,MAAM,CAAC,wBAAwB,CAAC;GACpB,iCAAiC,CAuB7C;;AAED;;GAEG;AAEI,IAAM,wCAAwC,GAA9C,MAAM,wCAAwC;IAGnD;;OAEG;IACH,MAAM,CAAC,KAAK,CAAC,MAAM;QACjB,IAAI,CAAC,IAAI,CAAC,QAAQ,EAAE,CAAC;YACnB,IAAI,CAAC,QAAQ,GAAG,IAAI,iCAAiC,EAAE,CAAC;QAC1D,CAAC;QACD,OAAO,IAAI,CAAC,QAAQ,CAAC;IACvB,CAAC;CACF,CAAA;AAZY,wCAAwC;IADpD,OAAO,CAAoC,iCAAiC,CAAC;GACjE,wCAAwC,CAYpD"}

package/dist/modules/server/aws-server/overlays/aws-server-s3-access/aws-server-s3-access.overlay.d.ts

@@ -0,0 +1,22 @@
+import { AOverlay, type Diff, type MatchingAnchor } from '@quadnix/octo';
+import type { AwsS3StorageServiceAccessPrefixAnchorSchema } from '../../../../../anchors/aws-s3-storage-service/aws-s3-storage-service-access-prefix.anchor.schema.js';
+import type { AwsServerAnchor } from '../../../../../anchors/aws-server/aws-server.anchor.js';
+import { AwsServerS3AccessOverlaySchema } from './aws-server-s3-access.schema.js';
+/**
+ * A server's grant to one access prefix of an S3 bucket. It creates nothing: the execution running the
+ * server reads it and grants the access to the role it creates.
+ *
+ * @internal
+ */
+export declare class AwsServerS3AccessOverlay extends AOverlay<AwsServerS3AccessOverlaySchema, AwsServerS3AccessOverlay> {
+    anchors: [AwsServerAnchor, MatchingAnchor<AwsS3StorageServiceAccessPrefixAnchorSchema>];
+    properties: AwsServerS3AccessOverlaySchema['properties'];
+    /**
+     * @internal
+     */
+    constructor(overlayId: string, properties: AwsServerS3AccessOverlaySchema['properties'], anchors: [AwsServerAnchor, MatchingAnchor<AwsS3StorageServiceAccessPrefixAnchorSchema>]);
+    /**
+     * @internal
+     */
+    diffAnchors(): Promise<Diff[]>;
+}

package/dist/modules/server/aws-server/overlays/aws-server-s3-access/aws-server-s3-access.overlay.js

@@ -0,0 +1,37 @@
+var __decorate = (this && this.__decorate) || function (decorators, target, key, desc) {
+    var c = arguments.length, r = c < 3 ? target : desc === null ? desc = Object.getOwnPropertyDescriptor(target, key) : desc, d;
+    if (typeof Reflect === "object" && typeof Reflect.decorate === "function") r = Reflect.decorate(decorators, target, key, desc);
+    else for (var i = decorators.length - 1; i >= 0; i--) if (d = decorators[i]) r = (c < 3 ? d(r) : c > 3 ? d(target, key, r) : d(target, key)) || r;
+    return c > 3 && r && Object.defineProperty(target, key, r), r;
+};
+var __metadata = (this && this.__metadata) || function (k, v) {
+    if (typeof Reflect === "object" && typeof Reflect.metadata === "function") return Reflect.metadata(k, v);
+};
+import { AOverlay, Overlay } from '@quadnix/octo';
+import { AwsServerS3AccessOverlaySchema } from './aws-server-s3-access.schema.js';
+/**
+ * A server's grant to one access prefix of an S3 bucket. It creates nothing: the execution running the
+ * server reads it and grants the access to the role it creates.
+ *
+ * @internal
+ */
+let AwsServerS3AccessOverlay = class AwsServerS3AccessOverlay extends AOverlay {
+    /**
+     * @internal
+     */
+    constructor(overlayId, properties, anchors) {
+        super(overlayId, properties, anchors);
+    }
+    /**
+     * @internal
+     */
+    async diffAnchors() {
+        return [];
+    }
+};
+AwsServerS3AccessOverlay = __decorate([
+    Overlay('@octo', 'aws-server-s3-access-overlay', AwsServerS3AccessOverlaySchema),
+    __metadata("design:paramtypes", [String, Object, Array])
+], AwsServerS3AccessOverlay);
+export { AwsServerS3AccessOverlay };
+//# sourceMappingURL=aws-server-s3-access.overlay.js.map

package/dist/modules/server/aws-server/overlays/aws-server-s3-access/aws-server-s3-access.overlay.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"aws-server-s3-access.overlay.js","sourceRoot":"","sources":["../../../../../../src/modules/server/aws-server/overlays/aws-server-s3-access/aws-server-s3-access.overlay.ts"],"names":[],"mappings":";;;;;;;;;AAAA,OAAO,EAAE,QAAQ,EAAkC,OAAO,EAAE,MAAM,eAAe,CAAC;AAGlF,OAAO,EAAE,8BAA8B,EAAE,MAAM,kCAAkC,CAAC;AAElF;;;;;GAKG;AAEI,IAAM,wBAAwB,GAA9B,MAAM,wBAAyB,SAAQ,QAAkE;IAI9G;;OAEG;IACH,YACE,SAAiB,EACjB,UAAwD,EACxD,OAAuF;QAEvF,KAAK,CAAC,SAAS,EAAE,UAAU,EAAE,OAAO,CAAC,CAAC;IACxC,CAAC;IAED;;OAEG;IACM,KAAK,CAAC,WAAW;QACxB,OAAO,EAAE,CAAC;IACZ,CAAC;CACF,CAAA;AArBY,wBAAwB;IADpC,OAAO,CAAC,OAAO,EAAE,8BAA8B,EAAE,8BAA8B,CAAC;;GACpE,wBAAwB,CAqBpC"}

package/dist/modules/server/{aws-ecs-server/overlays/aws-ecs-server-s3-access/aws-ecs-server-s3-access.schema.d.ts → aws-server/overlays/aws-server-s3-access/aws-server-s3-access.schema.d.ts}

@@ -2,13 +2,12 @@ import { BaseOverlaySchema } from '@quadnix/octo';
 /**
  * @internal
  */
-export declare class AwsEcsServerS3AccessOverlaySchema extends BaseOverlaySchema {
+export declare class AwsServerS3AccessOverlaySchema extends BaseOverlaySchema {
     properties: {
+        accessPrefix: string;
         allowRead: boolean;
         allowWrite: boolean;
         bucketName: string;
-        iamRoleName: string;
-        iamRolePolicyId: string;
-        remoteDirectoryPath: string;
+        serverKey: string;
     };
 }

package/dist/modules/server/{aws-ecs-server/overlays/aws-ecs-server-s3-access/aws-ecs-server-s3-access.schema.js → aws-server/overlays/aws-server-s3-access/aws-server-s3-access.schema.js}

@@ -11,7 +11,7 @@ import { BaseOverlaySchema, Schema, Validate } from '@quadnix/octo';
 /**
  * @internal
  */
-export class AwsEcsServerS3AccessOverlaySchema extends BaseOverlaySchema {
+export class AwsServerS3AccessOverlaySchema extends BaseOverlaySchema {
     constructor() {
         super(...arguments);
         this.properties = Schema();
@@ -23,12 +23,11 @@ __decorate([
             String(value.allowRead),
             String(value.allowWrite),
             value.bucketName,
-            value.iamRoleName,
-            value.iamRolePolicyId,
-            value.remoteDirectoryPath,
+            value.accessPrefix,
+            value.serverKey,
         ],
         options: { minLength: 1 },
     }),
     __metadata("design:type", Object)
-], AwsEcsServerS3AccessOverlaySchema.prototype, "properties", void 0);
-//# sourceMappingURL=aws-ecs-server-s3-access.schema.js.map
+], AwsServerS3AccessOverlaySchema.prototype, "properties", void 0);
+//# sourceMappingURL=aws-server-s3-access.schema.js.map

package/dist/modules/server/aws-server/overlays/aws-server-s3-access/aws-server-s3-access.schema.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"aws-server-s3-access.schema.js","sourceRoot":"","sources":["../../../../../../src/modules/server/aws-server/overlays/aws-server-s3-access/aws-server-s3-access.schema.ts"],"names":[],"mappings":";;;;;;;;;AAAA,OAAO,EAAE,iBAAiB,EAAE,MAAM,EAAE,QAAQ,EAAE,MAAM,eAAe,CAAC;AAEpE;;GAEG;AACH,MAAM,OAAO,8BAA+B,SAAQ,iBAAiB;IAArE;;QAWW,eAAU,GAAG,MAAM,EAMxB,CAAC;IACP,CAAC;CAAA;AAPU;IAVR,QAAQ,CAAC;QACR,QAAQ,EAAE,CAAC,KAAmD,EAAY,EAAE,CAAC;YAC3E,MAAM,CAAC,KAAK,CAAC,SAAS,CAAC;YACvB,MAAM,CAAC,KAAK,CAAC,UAAU,CAAC;YACxB,KAAK,CAAC,UAAU;YAChB,KAAK,CAAC,YAAY;YAClB,KAAK,CAAC,SAAS;SAChB;QACD,OAAO,EAAE,EAAE,SAAS,EAAE,CAAC,EAAE;KAC1B,CAAC;;kEAOG"}

package/dist/modules/server/aws-server/overlays/aws-server-s3-access/index.d.ts

@@ -0,0 +1,2 @@
+import './actions/add-aws-server-s3-access.overlay.action.js';
+export { AwsServerS3AccessOverlay } from './aws-server-s3-access.overlay.js';

package/dist/modules/server/aws-server/overlays/aws-server-s3-access/index.js

@@ -0,0 +1,3 @@
+import './actions/add-aws-server-s3-access.overlay.action.js';
+export { AwsServerS3AccessOverlay } from './aws-server-s3-access.overlay.js';
+//# sourceMappingURL=index.js.map

package/dist/modules/server/aws-server/overlays/aws-server-s3-access/index.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../../../../../../src/modules/server/aws-server/overlays/aws-server-s3-access/index.ts"],"names":[],"mappings":"AAAA,OAAO,sDAAsD,CAAC;AAE9D,OAAO,EAAE,wBAAwB,EAAE,MAAM,mCAAmC,CAAC"}

package/dist/modules/service/aws-cloudfront-invalidation-service/aws-cloudfront-invalidation-service.module.d.ts

@@ -0,0 +1,36 @@
+import { AModule } from '@quadnix/octo';
+import { AwsCloudFrontInvalidationServiceModuleSchema } from './index.schema.js';
+import { AwsCloudFrontInvalidationOverlay } from './overlays/aws-cloudfront-invalidation/index.js';
+/**
+ * `AwsCloudFrontInvalidationServiceModule` is a CloudFront-based AWS module that drops what a distribution's
+ * edges hold for one bucket, every time that bucket's files change. Without it, changed files are
+ * served from the edges' old copies until those expire.
+ *
+ * It runs after the bucket's files are uploaded. It drops `/*`, which CloudFront bills as one path.
+ * One module covers one bucket; a distribution serving several buckets takes one module per bucket.
+ *
+ * @example
+ * TypeScript
+ * ```ts
+ * import { type Service, stub } from '@quadnix/octo';
+ * import { AwsCloudFrontInvalidationServiceModule } from '@quadnix/octo-aws-cdk/modules/service/aws-cloudfront-invalidation-service';
+ *
+ * octo.loadModule(AwsCloudFrontInvalidationServiceModule, 'my-invalidation-module', {
+ *   cloudFront: stub<Service>('${{my-distribution-module.model.service}}'),
+ *   source: stub<Service>('${{my-content-module.model.service}}'),
+ * });
+ * ```
+ *
+ * @group Modules/Service/AwsCloudFrontInvalidationService
+ *
+ * @reference Resources {@link CloudFrontInvalidationSchema}
+ *
+ * @see {@link AwsCloudFrontInvalidationServiceModuleSchema} for the input schema.
+ * @see {@link AModule} to learn more about modules.
+ */
+export declare class AwsCloudFrontInvalidationServiceModule extends AModule<AwsCloudFrontInvalidationServiceModuleSchema, AwsCloudFrontInvalidationOverlay> {
+    /**
+     * Validates the distribution serves the bucket, and creates the overlay joining them.
+     */
+    onInit(inputs: AwsCloudFrontInvalidationServiceModuleSchema): Promise<AwsCloudFrontInvalidationOverlay>;
+}

package/dist/modules/service/aws-cloudfront-invalidation-service/aws-cloudfront-invalidation-service.module.js

@@ -0,0 +1,66 @@
+var __decorate = (this && this.__decorate) || function (decorators, target, key, desc) {
+    var c = arguments.length, r = c < 3 ? target : desc === null ? desc = Object.getOwnPropertyDescriptor(target, key) : desc, d;
+    if (typeof Reflect === "object" && typeof Reflect.decorate === "function") r = Reflect.decorate(decorators, target, key, desc);
+    else for (var i = decorators.length - 1; i >= 0; i--) if (d = decorators[i]) r = (c < 3 ? d(r) : c > 3 ? d(target, key, r) : d(target, key)) || r;
+    return c > 3 && r && Object.defineProperty(target, key, r), r;
+};
+import { AModule, Module, ModuleError } from '@quadnix/octo';
+import { AwsCloudFrontAnchorSchema } from '../../../anchors/aws-cloudfront/aws-cloudfront.anchor.schema.js';
+import { AwsS3StorageServiceAnchorSchema } from '../../../anchors/aws-s3-storage-service/aws-s3-storage-service.anchor.schema.js';
+import { AwsCloudFrontInvalidationServiceModuleSchema } from './index.schema.js';
+import { AwsCloudFrontInvalidationOverlay } from './overlays/aws-cloudfront-invalidation/index.js';
+/**
+ * `AwsCloudFrontInvalidationServiceModule` is a CloudFront-based AWS module that drops what a distribution's
+ * edges hold for one bucket, every time that bucket's files change. Without it, changed files are
+ * served from the edges' old copies until those expire.
+ *
+ * It runs after the bucket's files are uploaded. It drops `/*`, which CloudFront bills as one path.
+ * One module covers one bucket; a distribution serving several buckets takes one module per bucket.
+ *
+ * @example
+ * TypeScript
+ * ```ts
+ * import { type Service, stub } from '@quadnix/octo';
+ * import { AwsCloudFrontInvalidationServiceModule } from '@quadnix/octo-aws-cdk/modules/service/aws-cloudfront-invalidation-service';
+ *
+ * octo.loadModule(AwsCloudFrontInvalidationServiceModule, 'my-invalidation-module', {
+ *   cloudFront: stub<Service>('${{my-distribution-module.model.service}}'),
+ *   source: stub<Service>('${{my-content-module.model.service}}'),
+ * });
+ * ```
+ *
+ * @group Modules/Service/AwsCloudFrontInvalidationService
+ *
+ * @reference Resources {@link CloudFrontInvalidationSchema}
+ *
+ * @see {@link AwsCloudFrontInvalidationServiceModuleSchema} for the input schema.
+ * @see {@link AModule} to learn more about modules.
+ */
+let AwsCloudFrontInvalidationServiceModule = class AwsCloudFrontInvalidationServiceModule extends AModule {
+    /**
+     * Validates the distribution serves the bucket, and creates the overlay joining them.
+     */
+    async onInit(inputs) {
+        const { cloudFront, source } = inputs;
+        // Get the distribution and the bucket.
+        const [matchingCloudFrontAnchor] = await cloudFront.getAnchorsMatchingSchema(AwsCloudFrontAnchorSchema, [], {
+            searchBoundaryMembers: false,
+        });
+        const [matchingSourceAnchor] = await source.getAnchorsMatchingSchema(AwsS3StorageServiceAnchorSchema, [], {
+            searchBoundaryMembers: false,
+        });
+        const { awsAccountId, distributionName } = matchingCloudFrontAnchor.getSchemaInstance().properties;
+        const { bucketName, contentDigest } = matchingSourceAnchor.getSchemaInstance().properties;
+        // Validate the distribution serves the bucket.
+        const originOverlays = (cloudFront.getSiblings()['aws-cloudfront-s3-origin-overlay'] || []).map((d) => d.to);
+        if (!originOverlays.some((o) => o.properties.bucketName === bucketName)) {
+            throw new ModuleError(`Bucket "${bucketName}" is not served by distribution "${distributionName}"!`, this.constructor.name);
+        }
+        return new AwsCloudFrontInvalidationOverlay(`aws-cloudfront-invalidation-overlay-${distributionName}-${bucketName}`, { awsAccountId, bucketName, contentDigest, distributionName }, [matchingCloudFrontAnchor, matchingSourceAnchor]);
+    }
+};
+AwsCloudFrontInvalidationServiceModule = __decorate([
+    Module('@octo', AwsCloudFrontInvalidationServiceModuleSchema)
+], AwsCloudFrontInvalidationServiceModule);
+export { AwsCloudFrontInvalidationServiceModule };
+//# sourceMappingURL=aws-cloudfront-invalidation-service.module.js.map

package/dist/modules/service/aws-cloudfront-invalidation-service/aws-cloudfront-invalidation-service.module.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"aws-cloudfront-invalidation-service.module.js","sourceRoot":"","sources":["../../../../src/modules/service/aws-cloudfront-invalidation-service/aws-cloudfront-invalidation-service.module.ts"],"names":[],"mappings":";;;;;;AAAA,OAAO,EAAE,OAAO,EAAiB,MAAM,EAAE,WAAW,EAAE,MAAM,eAAe,CAAC;AAC5E,OAAO,EAAE,yBAAyB,EAAE,MAAM,iEAAiE,CAAC;AAC5G,OAAO,EAAE,+BAA+B,EAAE,MAAM,iFAAiF,CAAC;AAClI,OAAO,EAAE,4CAA4C,EAAE,MAAM,mBAAmB,CAAC;AACjF,OAAO,EAAE,gCAAgC,EAAE,MAAM,iDAAiD,CAAC;AAEnG;;;;;;;;;;;;;;;;;;;;;;;;;;GA0BG;AAEI,IAAM,sCAAsC,GAA5C,MAAM,sCAAuC,SAAQ,OAG3D;IACC;;OAEG;IACH,KAAK,CAAC,MAAM,CAAC,MAAoD;QAC/D,MAAM,EAAE,UAAU,EAAE,MAAM,EAAE,GAAG,MAAM,CAAC;QAEtC,uCAAuC;QACvC,MAAM,CAAC,wBAAwB,CAAC,GAAG,MAAM,UAAU,CAAC,wBAAwB,CAAC,yBAAyB,EAAE,EAAE,EAAE;YAC1G,qBAAqB,EAAE,KAAK;SAC7B,CAAC,CAAC;QACH,MAAM,CAAC,oBAAoB,CAAC,GAAG,MAAM,MAAM,CAAC,wBAAwB,CAAC,+BAA+B,EAAE,EAAE,EAAE;YACxG,qBAAqB,EAAE,KAAK;SAC7B,CAAC,CAAC;QACH,MAAM,EAAE,YAAY,EAAE,gBAAgB,EAAE,GAAG,wBAAwB,CAAC,iBAAiB,EAAE,CAAC,UAAU,CAAC;QACnG,MAAM,EAAE,UAAU,EAAE,aAAa,EAAE,GAAG,oBAAoB,CAAC,iBAAiB,EAAE,CAAC,UAAU,CAAC;QAE1F,+CAA+C;QAC/C,MAAM,cAAc,GAAG,CAAC,UAAU,CAAC,WAAW,EAAE,CAAC,kCAAkC,CAAC,IAAI,EAAE,CAAC,CAAC,GAAG,CAC7F,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,EAAwB,CAClC,CAAC;QACF,IAAI,CAAC,cAAc,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,UAAU,CAAC,UAAU,KAAK,UAAU,CAAC,EAAE,CAAC;YACxE,MAAM,IAAI,WAAW,CACnB,WAAW,UAAU,oCAAoC,gBAAgB,IAAI,EAC7E,IAAI,CAAC,WAAW,CAAC,IAAI,CACtB,CAAC;QACJ,CAAC;QAED,OAAO,IAAI,gCAAgC,CACzC,uCAAuC,gBAAgB,IAAI,UAAU,EAAE,EACvE,EAAE,YAAY,EAAE,UAAU,EAAE,aAAa,EAAE,gBAAgB,EAAE,EAC7D,CAAC,wBAAwB,EAAE,oBAAoB,CAAC,CACjD,CAAC;IACJ,CAAC;CACF,CAAA;AArCY,sCAAsC;IADlD,MAAM,CAAyC,OAAO,EAAE,4CAA4C,CAAC;GACzF,sCAAsC,CAqClD"}