@stacksjs/cloud 0.61.24 → 0.63.0

package/dist/index.js

@@ -10,7 +10,7 @@ import {ContactType, Route53Domains} from "@aws-sdk/client-route-53-domains";
 import {ListBucketsCommand, S3} from "@aws-sdk/client-s3";
 import {SSM} from "@aws-sdk/client-ssm";
 import {runCommand} from "@stacksjs/cli";
-import {config as config2} from "@stacksjs/config";
+import {config as config3} from "@stacksjs/config";
 import {err, handleError, ok} from "@stacksjs/error-handling";
 import {log} from "@stacksjs/logging";
 import {path as p} from "@stacksjs/path";
@@ -97,7 +97,7 @@ async function getJumpBoxInstanceId(name) {
       }
     ]
   });
-  if (data.Reservations?.[0].Instances?.[0])
+  if (data.Reservations?.[0]?.Instances?.[0])
     return data.Reservations[0].Instances[0].InstanceId;
   return;
 }
@@ -122,7 +122,7 @@ async function deleteJumpBox(stackName) {
 async function deleteIamUsers() {
   const iam = new IAM({ region: "us-east-1" });
   const data = await iam.listUsers({});
-  const teamName = slug(config2.team.name);
+  const teamName = slug(config3.team.name);
   const users = data.Users?.filter((user) => {
     const userNameLower = user.UserName?.toLowerCase();
     return userNameLower !== "stacks" && userNameLower !== teamName.toLowerCase() && userNameLower?.includes(teamName.toLowerCase());
@@ -273,7 +273,7 @@ async function hasBeenDeployed() {
   const s3 = new S3({ region: "us-east-1" });
   try {
     const response = await s3.send(new ListBucketsCommand({}));
-    return ok(response.Buckets?.some((bucket) => bucket.Name?.includes(config2.app.name?.toLocaleLowerCase() || "stacks")) || false);
+    return ok(response.Buckets?.some((bucket) => bucket.Name?.includes(config3.app.name?.toLocaleLowerCase() || "stacks")) || false);
   } catch (error) {
     console.error(error);
     return err(handleError("Error checking if the app has been deployed"));
@@ -307,7 +307,7 @@ async function addJumpBox(stackName) {
   const client = new EFSClient({ region: "us-east-1" });
   const command = new DescribeFileSystemsCommand({});
   const data = await client.send(command);
-  const fileSystemName = `stacks-${config2.app.env}-efs`;
+  const fileSystemName = `stacks-${config3.app.env}-efs`;
   const fileSystem = data.FileSystems?.find((fs) => fs.Name === fileSystemName);
   const fileSystemId = fileSystem?.FileSystemId;
   if (!fileSystem || !fileSystemId)
@@ -360,7 +360,7 @@ async function getJumpBoxSecurityGroupName() {
     return err("Jump-box not found");
   const ec2 = new EC2({ region: "us-east-1" });
   const data = await ec2.describeInstances({ InstanceIds: [jumpBoxId] });
-  if (data.Reservations?.[0].Instances?.[0]) {
+  if (data.Reservations?.[0]?.Instances?.[0]) {
     const instance = data.Reservations[0].Instances[0];
     const securityGroups = instance.SecurityGroups;
     if (securityGroups?.[0])
@@ -371,7 +371,7 @@ async function getJumpBoxSecurityGroupName() {
 async function getSecurityGroupFromInstanceId(instanceId) {
   const ec2 = new EC2({ region: "us-east-1" });
   const data = await ec2.describeInstances({ InstanceIds: [instanceId] });
-  if (data.Reservations?.[0].Instances?.[0]) {
+  if (data.Reservations?.[0]?.Instances?.[0]) {
     const instance = data.Reservations[0].Instances[0];
     const securityGroups = instance.SecurityGroups;
     if (securityGroups?.[0])
@@ -416,14 +416,17 @@ async function getOrCreateTimestamp() {
     return timestamp;
   }
 }
-var appEnv = config2.app.env === "local" ? "dev" : config2.app.env;
+async function getCloudFrontDistributionId() {
+  return "";
+}
+var appEnv = config3.app.env === "local" ? "dev" : config3.app.env;
 var cloudName = `stacks-cloud-${appEnv}`;
 // src/cloud/index.ts
-import {config as config20} from "@stacksjs/config";
+import {config as config21} from "@stacksjs/config";
 import {Stack as Stack2} from "aws-cdk-lib";
 
 // src/cloud/ai.ts
-import {config as config4} from "@stacksjs/config";
+import {config as config5} from "@stacksjs/config";
 import {Duration, CfnOutput as Output, aws_iam as iam, aws_lambda as lambda} from "aws-cdk-lib";
 
 class AiStack {
@@ -438,7 +441,7 @@ class AiStack {
     const bedrockAccessPolicy = new iam.PolicyStatement({
       effect: iam.Effect.ALLOW,
       actions: ["bedrock:InvokeModel", "bedrock:InvokeModelWithResponseStream"],
-      resources: config4.ai.models?.map((model) => `arn:aws:bedrock:us-east-1::foundation-model/${model}`)
+      resources: config5.ai.models?.map((model) => `arn:aws:bedrock:us-east-1::foundation-model/${model}`)
     });
     const bedrockAccessRole = new iam.Role(scope, "BedrockAccessRole", {
       assumedBy: new iam.ServicePrincipal("lambda.amazonaws.com"),
@@ -495,7 +498,7 @@ class AiStack {
 }
 
 // src/cloud/cdn.ts
-import {config as config6} from "@stacksjs/config";
+import {config as config7} from "@stacksjs/config";
 import {env as env2} from "@stacksjs/env";
 import {path as p2} from "@stacksjs/path";
 import {hasFiles} from "@stacksjs/storage";
@@ -508,7 +511,6 @@ aws_cloudfront_origins as origins,
 aws_route53 as route53,
 aws_route53_targets as targets
 } from "aws-cdk-lib";
-import * as kinesis from "aws-cdk-lib/aws-kinesis";
 
 class CdnStack {
   distribution;
@@ -524,35 +526,15 @@ class CdnStack {
     this.cdnCachePolicy = new cloudfront.CachePolicy(scope, "CdnCachePolicy", {
       comment: "Stacks CDN Cache Policy",
       cachePolicyName: `${props.slug}-${props.appEnv}-cdn-cache-policy`,
-      minTtl: config6.cloud.cdn?.minTtl ? Duration2.seconds(config6.cloud.cdn.minTtl) : undefined,
-      defaultTtl: config6.cloud.cdn?.defaultTtl ? Duration2.seconds(config6.cloud.cdn.defaultTtl) : undefined,
-      maxTtl: config6.cloud.cdn?.maxTtl ? Duration2.seconds(config6.cloud.cdn.maxTtl) : undefined,
-      cookieBehavior: this.getCookieBehavior(config6.cloud.cdn?.cookieBehavior)
-    });
-    const logStream = new kinesis.Stream(scope, "StacksCdnRealtimeLogStream", {
-      streamName: "StacksCdnRealtimeLogStream",
-      retentionPeriod: Duration2.days(1),
-      shardCount: 1,
-      encryption: kinesis.StreamEncryption.UNENCRYPTED
-    });
-    this.realtimeLogConfig = new cloudfront.RealtimeLogConfig(scope, "StacksRealTimeLogConfig", {
-      endPoints: [cloudfront.Endpoint.fromKinesisStream(logStream)],
-      fields: [
-        "timestamp",
-        "c-ip",
-        "cs-method",
-        "cs-uri-stem",
-        "cs-uri-query",
-        "cs-referer",
-        "cs-user-agent",
-        "sc-status"
-      ],
-      samplingRate: 100
+      minTtl: config7.cloud.cdn?.minTtl ? Duration2.seconds(config7.cloud.cdn.minTtl) : undefined,
+      defaultTtl: config7.cloud.cdn?.defaultTtl ? Duration2.seconds(config7.cloud.cdn.defaultTtl) : undefined,
+      maxTtl: config7.cloud.cdn?.maxTtl ? Duration2.seconds(config7.cloud.cdn.maxTtl) : undefined,
+      cookieBehavior: this.getCookieBehavior(config7.cloud.cdn?.cookieBehavior)
     });
     this.distribution = new cloudfront.Distribution(scope, "Cdn", {
       domainNames: [props.domain],
       defaultRootObject: "index.html",
-      comment: `CDN for ${config6.app.url}`,
+      comment: `CDN for ${config7.app.url}`,
       certificate: props.certificate,
       enableLogging: true,
       logBucket: props.logBucket,
@@ -563,7 +545,7 @@ class CdnStack {
       webAclId: props.firewall.attrArn,
       enableIpv6: true,
       defaultBehavior: {
-        origin: new origins.S3Origin(props.publicBucket, {
+        origin: new origins.S3Origin(config7.app.docMode ? props.docsBucket : props.publicBucket, {
           originAccessIdentity: this.originAccessIdentity
         }),
         edgeLambdas: [
@@ -572,12 +554,11 @@ class CdnStack {
             functionVersion: props.originRequestFunction.currentVersion
           }
         ],
-        compress: config6.cloud.cdn?.compress,
+        compress: config7.cloud.cdn?.compress,
         allowedMethods: this.allowedMethods(),
         cachedMethods: this.cachedMethods(),
         viewerProtocolPolicy: cloudfront.ViewerProtocolPolicy.REDIRECT_TO_HTTPS,
-        cachePolicy: this.cdnCachePolicy,
-        realtimeLogConfig: this.realtimeLogConfig
+        cachePolicy: this.cdnCachePolicy
       },
       additionalBehaviors: this.additionalBehaviors(scope, props),
       errorResponses: [
@@ -614,13 +595,13 @@ class CdnStack {
       case "none":
         return cloudfront.CacheCookieBehavior.none();
       case "allowList":
-        return cloudfront.CacheCookieBehavior.allowList(...config6.cloud.cdn?.allowList.cookies || []);
+        return cloudfront.CacheCookieBehavior.allowList(...config7.cloud.cdn?.allowList.cookies || []);
       default:
         return;
     }
   }
   allowedMethods() {
-    switch (config6.cloud.cdn?.allowedMethods) {
+    switch (config7.cloud.cdn?.allowedMethods) {
       case "ALL":
         return cloudfront.AllowedMethods.ALLOW_ALL;
       case "GET_HEAD":
@@ -632,7 +613,7 @@ class CdnStack {
     }
   }
   cachedMethods() {
-    switch (config6.cloud.cdn?.cachedMethods) {
+    switch (config7.cloud.cdn?.cachedMethods) {
       case "GET_HEAD":
         return cloudfront.CachedMethods.CACHE_GET_HEAD;
       case "GET_HEAD_OPTIONS":
@@ -668,19 +649,17 @@ class CdnStack {
     }
   }
   shouldDeployApi() {
-    return config6.api?.deploy;
+    return config7.cloud.api?.deploy;
   }
   apiBehaviorOptions(scope, props) {
     const hostname = `api.${props.domain}`;
-    const origin = () => {
-      return new origins.HttpOrigin(hostname, {
-        originPath: "/",
-        protocolPolicy: cloudfront.OriginProtocolPolicy.HTTPS_ONLY
-      });
-    };
+    const origin = new origins.HttpOrigin(hostname, {
+      originPath: "/",
+      protocolPolicy: cloudfront.OriginProtocolPolicy.HTTPS_ONLY
+    });
     return {
       "/api": {
-        origin: origin(),
+        origin,
         compress: true,
         allowedMethods: cloudfront.AllowedMethods.ALLOW_ALL,
         cachedMethods: cloudfront.CachedMethods.CACHE_GET_HEAD_OPTIONS,
@@ -689,7 +668,7 @@ class CdnStack {
         realtimeLogConfig: this.realtimeLogConfig
       },
       "/api/*": {
-        origin: origin(),
+        origin,
         compress: true,
         allowedMethods: cloudfront.AllowedMethods.ALLOW_ALL,
         cachedMethods: cloudfront.CachedMethods.CACHE_GET_HEAD_OPTIONS,
@@ -699,28 +678,28 @@ class CdnStack {
       }
     };
   }
-  docsBehaviorOptions(props) {
+  docsBehaviorOptions(docsBucket) {
+    if (!docsBucket)
+      return {};
+    const origin = new origins.S3Origin(docsBucket, {
+      originAccessIdentity: this.originAccessIdentity,
+      originPath: "/"
+    });
     return {
       "/docs": {
-        origin: new origins.S3Origin(props.publicBucket, {
-          originAccessIdentity: this.originAccessIdentity,
-          originPath: "/docs"
-        }),
+        origin,
         compress: true,
-        allowedMethods: this.allowedMethodsFromString(config6.cloud.cdn?.allowedMethods),
-        cachedMethods: this.cachedMethodsFromString(config6.cloud.cdn?.cachedMethods),
+        allowedMethods: this.allowedMethodsFromString(config7.cloud.cdn?.allowedMethods),
+        cachedMethods: this.cachedMethodsFromString(config7.cloud.cdn?.cachedMethods),
         viewerProtocolPolicy: cloudfront.ViewerProtocolPolicy.REDIRECT_TO_HTTPS,
         cachePolicy: cloudfront.CachePolicy.CACHING_OPTIMIZED,
         realtimeLogConfig: this.realtimeLogConfig
       },
       "/docs/*": {
-        origin: new origins.S3Origin(props.publicBucket, {
-          originAccessIdentity: this.originAccessIdentity,
-          originPath: "/docs"
-        }),
+        origin,
         compress: true,
-        allowedMethods: this.allowedMethodsFromString(config6.cloud.cdn?.allowedMethods),
-        cachedMethods: this.cachedMethodsFromString(config6.cloud.cdn?.cachedMethods),
+        allowedMethods: this.allowedMethodsFromString(config7.cloud.cdn?.allowedMethods),
+        cachedMethods: this.cachedMethodsFromString(config7.cloud.cdn?.cachedMethods),
         viewerProtocolPolicy: cloudfront.ViewerProtocolPolicy.REDIRECT_TO_HTTPS,
         cachePolicy: cloudfront.CachePolicy.CACHING_OPTIMIZED,
         realtimeLogConfig: this.realtimeLogConfig
@@ -787,13 +766,13 @@ class CdnStack {
     };
   }
   shouldDeployAiEndpoints() {
-    return config6.cloud.ai;
+    return config7.cloud.ai;
   }
   shouldDeployCliSetup() {
-    return config6.cloud.cli;
+    return config7.cloud.cli;
   }
   shouldDeployDocs() {
-    return hasFiles(p2.projectPath("docs"));
+    return hasFiles(p2.projectPath("docs")) && !config7.app.docMode;
   }
   additionalBehaviors(scope, props) {
     let behaviorOptions = {};
@@ -821,9 +800,9 @@ class CdnStack {
       keysToRemove.forEach((key) => delete env2[key]);
       behaviorOptions = this.apiBehaviorOptions(scope, props);
     }
-    if (this.shouldDeployDocs() && !config6.app.docMode) {
+    if (this.shouldDeployDocs()) {
       behaviorOptions = {
-        ...this.docsBehaviorOptions(props),
+        ...this.docsBehaviorOptions(props.docsBucket),
         ...behaviorOptions
       };
     }
@@ -926,7 +905,7 @@ class ComputeStack {
     });
     const container = this.taskDefinition.addContainer("WebServerContainer", {
       containerName: `${props.appName}-${props.appEnv}-api`,
-      image: ecs.ContainerImage.fromAsset(p3.frameworkPath("server")),
+      image: ecs.ContainerImage.fromAsset(p3.frameworkCloudPath()),
       logging: new ecs.AwsLogDriver({
         streamPrefix: `${props.appName}-${props.appEnv}-web-server-logs`,
         logGroup: new LogGroup(scope, "StacksApiLogs", {
@@ -1069,8 +1048,12 @@ class ComputeStack {
         generateStringKey: Object.keys(env4).join(",").length.toString()
       }
     });
-    secrets.grantRead(service.taskDefinition.executionRole);
-    container.addEnvironment("SECRETS_ARN", secrets.secretArn);
+    if (service.taskDefinition.executionRole) {
+      secrets.grantRead(service.taskDefinition.executionRole);
+      container.addEnvironment("SECRETS_ARN", secrets.secretArn);
+    } else {
+      throw new Error("Service task execution role is undefined.");
+    }
     const apiPrefix = "api";
     new Output4(scope, "ApiUrl", {
       value: `https://${props.domain}/${apiPrefix}`,
@@ -1084,21 +1067,23 @@ class ComputeStack {
 }
 
 // src/cloud/deployment.ts
-import {config as config8} from "@stacksjs/config";
-import {websiteSourceHash} from "@stacksjs/utils";
+import {config as config9} from "@stacksjs/config";
+import {path as p4} from "@stacksjs/path";
+import {hasFiles as hasFiles2} from "@stacksjs/storage";
+import {docsSourceHash, websiteSourceHash} from "@stacksjs/utils";
 import {AssetHashType, aws_s3_deployment as s3deploy} from "aws-cdk-lib";
 
 class DeploymentStack {
   privateSource;
   docsSource;
-  websiteSource;
+  publicSource;
   constructor(scope, props) {
     this.privateSource = "../../private";
     this.docsSource = "../docs/dist/";
-    this.websiteSource = config8.app.docMode === true ? this.docsSource : "../views/dist/";
+    this.publicSource = config9.app.docMode === true ? this.docsSource : "../views/web/dist/";
     new s3deploy.BucketDeployment(scope, "Website", {
       sources: [
-        s3deploy.Source.asset(this.websiteSource, {
+        s3deploy.Source.asset(this.publicSource, {
           assetHash: websiteSourceHash(),
           assetHashType: AssetHashType.CUSTOM
         })
@@ -1107,10 +1092,30 @@ class DeploymentStack {
       distribution: props.cdn,
       distributionPaths: ["/*"]
     });
-    new s3deploy.BucketDeployment(scope, "PrivateFiles", {
-      sources: [s3deploy.Source.asset(this.privateSource)],
-      destinationBucket: props.privateBucket
-    });
+    if (this.shouldDeployDocs()) {
+      new s3deploy.BucketDeployment(scope, "Docs", {
+        sources: [
+          s3deploy.Source.asset(this.docsSource, {
+            assetHash: docsSourceHash(),
+            assetHashType: AssetHashType.CUSTOM
+          })
+        ],
+        destinationBucket: props.docsBucket,
+        distribution: props.cdn,
+        distributionPaths: ["/docs/*"]
+      });
+    }
+    if (hasFiles2(this.privateSource)) {
+      new s3deploy.BucketDeployment(scope, "PrivateFiles", {
+        sources: [s3deploy.Source.asset(this.privateSource)],
+        destinationBucket: props.privateBucket
+      });
+    } else {
+      console.error(`The path ${this.privateSource} does not have any files`);
+    }
+  }
+  shouldDeployDocs() {
+    return hasFiles2(p4.projectPath("docs")) && !config9.app.docMode;
   }
 }
 
@@ -1146,29 +1151,29 @@ class DnsStack {
 }
 
 // src/cloud/docs.ts
-import {config as config10} from "@stacksjs/config";
-import {path as p4} from "@stacksjs/path";
-import {storage as storage3} from "@stacksjs/storage";
+import {config as config11} from "@stacksjs/config";
+import {path as p5} from "@stacksjs/path";
+import {storage as storage4} from "@stacksjs/storage";
 import {originRequestFunctionHash} from "@stacksjs/utils";
 import {AssetHashType as AssetHashType2, CfnOutput as Output5, RemovalPolicy as RemovalPolicy3, aws_lambda as lambda3} from "aws-cdk-lib";
 
 class DocsStack {
   originRequestFunction;
   constructor(scope, props) {
-    const docsPrefix = config10.app.docMode ? "" : config10.docs.base;
+    const docsPrefix = "docs";
     this.originRequestFunction = new lambda3.Function(scope, "OriginRequestFunction", {
       functionName: `${props.slug}-${props.appEnv}-origin-request-${props.timestamp}`,
       description: "The Stacks Origin Request function that prettifies URLs",
       runtime: lambda3.Runtime.NODEJS_18_X,
       handler: "dist/origin-request.handler",
-      code: lambda3.Code.fromAsset(p4.frameworkCloudPath("dist.zip"), {
+      code: lambda3.Code.fromAsset(p5.frameworkCloudPath("dist.zip"), {
         assetHash: originRequestFunctionHash(),
         assetHashType: AssetHashType2.CUSTOM
       })
     });
     const cfnOriginRequestFunction = this.originRequestFunction.node.defaultChild;
     cfnOriginRequestFunction.applyRemovalPolicy(RemovalPolicy3.RETAIN);
-    if (!config10.app.docMode && storage3.hasFiles(p4.projectPath("docs"))) {
+    if (!config11.app.docMode && storage4.hasFiles(p5.projectPath("docs"))) {
       new Output5(scope, "DocsUrl", {
         value: `https://${props.domain}/${docsPrefix}`,
         description: "The URL of the deployed documentation"
@@ -1178,7 +1183,7 @@ class DocsStack {
 }
 
 // src/cloud/email.ts
-import {config as config12} from "@stacksjs/config";
+import {config as config13} from "@stacksjs/config";
 import {
 Duration as Duration5,
 RemovalPolicy as RemovalPolicy4,
@@ -1269,8 +1274,8 @@ class EmailStack {
             }
           }
         ],
-        recipients: config12.email.mailboxes || [],
-        scanEnabled: config12.email.server?.scan || true,
+        recipients: config13.email.mailboxes || [],
+        scanEnabled: config13.email.server?.scan || true,
         tlsPolicy: "Require"
       }
     });
@@ -1548,15 +1553,15 @@ class NetworkStack {
 }
 
 // src/cloud/permissions.ts
-import {config as config14} from "@stacksjs/config";
+import {config as config15} from "@stacksjs/config";
 import {env as env6} from "@stacksjs/env";
 import {string} from "@stacksjs/strings";
 import {SecretValue, aws_iam as iam4} from "aws-cdk-lib";
 
 class PermissionsStack {
   constructor(scope) {
-    const teamName = config14.team.name;
-    const users = config14.team.members;
+    const teamName = config15.team.name;
+    const users = config15.team.members;
     const password = env6.AWS_DEFAULT_PASSWORD || string.random();
     for (const name in users) {
       const id = `User${string.pascalCase(teamName)}${string.pascalCase(name)}`;
@@ -1572,7 +1577,7 @@ class PermissionsStack {
 }
 
 // src/cloud/queue.ts
-import {path as path6} from "@stacksjs/path";
+import {path as path7} from "@stacksjs/path";
 import {fs} from "@stacksjs/storage";
 import {pascalCase, slug as slug2} from "@stacksjs/strings";
 import {aws_ec2 as ec24} from "aws-cdk-lib";
@@ -1587,9 +1592,9 @@ class QueueStack {
     this.props = props;
   }
   async init() {
-    const jobsDir = path6.jobsPath();
-    const actionsDir = path6.appPath("Actions");
-    const ormActionDir = path6.projectStoragePath("framework/orm/Actions");
+    const jobsDir = path7.jobsPath();
+    const actionsDir = path7.appPath("Actions");
+    const ormActionDir = path7.builtUserActionsPath("src");
     const jobFiles = await fs.readdir(jobsDir);
     const actionFiles = await fs.readdir(actionsDir);
     const ormActionFiles = await fs.readdir(ormActionDir);
@@ -1597,7 +1602,7 @@ class QueueStack {
     for (const file of jobFiles) {
       if (!file.endsWith(".ts"))
         continue;
-      const jobPath = path6.jobsPath(file);
+      const jobPath = path7.jobsPath(file);
       const job = await this.loadModule(jobPath);
       this.createQueueRule(job, file);
       jobs.push(job);
@@ -1605,7 +1610,7 @@ class QueueStack {
     for (const ormFile of ormActionFiles) {
       if (!ormFile.endsWith(".ts"))
         continue;
-      const ormActionPath = path6.projectStoragePath(`framework/orm/Actions/${ormFile}`);
+      const ormActionPath = path7.builtUserActionsPath(ormFile);
       const ormAction = await this.loadModule(ormActionPath);
       this.createQueueRule(ormAction, ormFile);
       jobs.push(ormAction);
@@ -1613,8 +1618,7 @@ class QueueStack {
     for (const file of actionFiles) {
       if (!file.endsWith(".ts"))
         continue;
-      const actionPath = path6.appPath(`Actions/${file}`);
-      console.log(actionPath);
+      const actionPath = path7.appPath(`Actions/${file}`);
       const action = await this.loadModule(actionPath);
       this.createQueueRule(action, file);
       jobs.push(action);
@@ -1687,13 +1691,13 @@ class QueueStack {
 }
 
 // src/cloud/redirects.ts
-import {config as config16} from "@stacksjs/config";
+import {config as config17} from "@stacksjs/config";
 import {RemovalPolicy as RemovalPolicy6, aws_route53 as route535, aws_s3 as s33} from "aws-cdk-lib";
 
 class RedirectsStack {
   redirectZones = [];
   constructor(scope, props) {
-    config16.dns.redirects?.forEach((redirect) => {
+    config17.dns.redirects?.forEach((redirect) => {
       const slug3 = redirect.split(".").map((part, index) => index === 0 ? part : part.charAt(0).toUpperCase() + part.slice(1)).join("");
       const hostedZone = route535.HostedZone.fromLookup(scope, "HostedZone", {
         domainName: redirect
@@ -1713,7 +1717,7 @@ class RedirectsStack {
         domainName: redirectBucket.bucketWebsiteDomainName
       });
     });
-    config16.dns.redirects?.forEach((redirect) => {
+    config17.dns.redirects?.forEach((redirect) => {
       const slug3 = redirect.split(".").map((part, index) => index === 0 ? part : part.charAt(0).toUpperCase() + part.slice(1)).join("");
       const hostedZone = route535.HostedZone.fromLookup(scope, `RedirectHostedZone${slug3}`, { domainName: redirect });
       this.redirectZones.push(hostedZone);
@@ -1722,7 +1726,7 @@ class RedirectsStack {
 }
 
 // src/cloud/security.ts
-import {config as config18} from "@stacksjs/config";
+import {config as config19} from "@stacksjs/config";
 import {
 Duration as Duration6,
 RemovalPolicy as RemovalPolicy7,
@@ -1737,7 +1741,7 @@ class SecurityStack {
   kmsKey;
   certificate;
   constructor(scope, props) {
-    const firewallOptions = config18.cloud.firewall;
+    const firewallOptions = config19.cloud.firewall;
     if (!firewallOptions)
       throw new Error("No firewall options found in config");
     const options = {
@@ -1772,12 +1776,16 @@ class SecurityStack {
   getFirewallRules(scope) {
     const rules = [];
     const priorities = [];
-    if (config18.security.firewall?.countryCodes?.length) {
+    if (config19.security.firewall?.countryCodes?.length) {
       priorities.push(1);
       rules.push({
         name: "CountryRule",
         priority: priorities.length,
-        statement: {},
+        statement: {
+          geoMatchStatement: {
+            countryCodes: config19.security.firewall.countryCodes
+          }
+        },
         action: {
           block: {}
         },
@@ -1788,12 +1796,12 @@ class SecurityStack {
         }
       });
     }
-    if (config18.security.firewall?.ipAddresses?.length) {
+    if (config19.security.firewall?.ipAddresses?.length) {
       const ipSet = new wafv2.CfnIPSet(scope, "IpSet", {
         name: "IpSet",
         description: "IP Set",
         scope: "CLOUDFRONT",
-        addresses: config18.security.firewall.ipAddresses,
+        addresses: config19.security.firewall.ipAddresses,
         ipAddressVersion: "IPV4"
       });
       priorities.push(1);
@@ -1815,8 +1823,8 @@ class SecurityStack {
         }
       });
     }
-    if (config18.security.firewall?.httpHeaders?.length) {
-      config18.security.firewall.httpHeaders.forEach((header, index) => {
+    if (config19.security.firewall?.httpHeaders?.length) {
+      config19.security.firewall.httpHeaders.forEach((header, index) => {
         priorities.push(1);
         rules.push({
           name: `HttpHeaderRule${index}`,
@@ -1832,7 +1840,7 @@ class SecurityStack {
               searchString: "true",
               textTransformations: [
                 {
-                  priority: index,
+                  priority: 0,
                   type: "NONE"
                 }
               ]
@@ -1854,11 +1862,14 @@ class SecurityStack {
 }
 
 // src/cloud/storage.ts
+import {path as p6} from "@stacksjs/path";
+import {hasFiles as hasFiles3} from "@stacksjs/storage";
 import {RemovalPolicy as RemovalPolicy8, Tags as Tags3, aws_backup as backup, aws_iam as iam5, aws_s3 as s34} from "aws-cdk-lib";
 
 class StorageStack {
   publicBucket;
   privateBucket;
+  docsBucket;
   logBucket;
   bucketPrefix;
   vault;
@@ -1874,6 +1885,16 @@ class StorageStack {
       encryption: s34.BucketEncryption.S3_MANAGED
     });
     Tags3.of(this.publicBucket).add("daily-backup", "true");
+    if (this.shouldDeployDocs()) {
+      this.docsBucket = new s34.Bucket(scope, "DocsBucket", {
+        bucketName: `${this.bucketPrefix}-docs-${props.timestamp}`,
+        versioned: true,
+        autoDeleteObjects: true,
+        removalPolicy: RemovalPolicy8.DESTROY,
+        encryption: s34.BucketEncryption.S3_MANAGED
+      });
+      Tags3.of(this.docsBucket).add("weekly-backup", "true");
+    }
     this.privateBucket = new s34.Bucket(scope, "PrivateBucket", {
       bucketName: `${this.bucketPrefix}-private-${props.timestamp}`,
       versioned: true,
@@ -1981,6 +2002,9 @@ class StorageStack {
     }));
     return backupRole;
   }
+  shouldDeployDocs() {
+    return hasFiles3(p6.projectPath("docs")) || config.app.docMode;
+  }
 }
 
 // src/cloud/index.ts
@@ -2037,8 +2061,8 @@ class Cloud extends Stack2 {
     this.cli = new CliStack(this, props);
   }
   async init() {
-    if (config20.api?.deploy) {
-      const props = this.props;
+    const props = this.props;
+    if (this.shouldDeployApi()) {
       this.api = new ComputeStack(this, {
         ...props,
         vpc: this.network.vpc,
@@ -2052,26 +2076,31 @@ class Cloud extends Stack2 {
         taskDefinition: this.api.taskDefinition
       });
       await this.queue.init();
-      this.cdn = new CdnStack(this, {
-        ...props,
-        publicBucket: this.storage.publicBucket,
-        logBucket: this.storage.logBucket,
-        certificate: this.security.certificate,
-        firewall: this.security.firewall,
-        originRequestFunction: this.docs.originRequestFunction,
-        zone: this.dns.zone,
-        cliSetupUrl: this.cli.cliSetupUrl,
-        askAiUrl: this.ai.askAiUrl,
-        summarizeAiUrl: this.ai.summarizeAiUrl,
-        lb: this.api?.lb
-      });
-      this.deployment = new DeploymentStack(this, {
-        ...props,
-        publicBucket: this.storage.publicBucket,
-        privateBucket: this.storage.privateBucket,
-        cdn: this.cdn.distribution
-      });
     }
+    this.cdn = new CdnStack(this, {
+      ...props,
+      publicBucket: this.storage.publicBucket,
+      docsBucket: this.storage.docsBucket,
+      logBucket: this.storage.logBucket,
+      certificate: this.security.certificate,
+      firewall: this.security.firewall,
+      originRequestFunction: this.docs.originRequestFunction,
+      zone: this.dns.zone,
+      cliSetupUrl: this.cli.cliSetupUrl,
+      askAiUrl: this.ai.askAiUrl,
+      summarizeAiUrl: this.ai.summarizeAiUrl,
+      lb: this.api?.lb
+    });
+    this.deployment = new DeploymentStack(this, {
+      ...props,
+      publicBucket: this.storage.publicBucket,
+      privateBucket: this.storage.privateBucket,
+      docsBucket: this.storage.docsBucket,
+      cdn: this.cdn.distribution
+    });
+  }
+  shouldDeployApi() {
+    return config21.cloud.api?.deploy;
   }
 }
 export {
@@ -2085,6 +2114,7 @@ export {
   getJumpBoxSecurityGroupName,
   getJumpBoxInstanceProfileName,
   getJumpBoxInstanceId,
+  getCloudFrontDistributionId,
   deleteStacksFunctions,
   deleteStacksBuckets,
   deleteParameterStore,
@@ -2097,3 +2127,6 @@ export {
   InstanceType,
   Cloud
 };
+
+//# debugId=B17D4D8836F8DA4664756E2164756E21
+//# sourceMappingURL=index.js.map