@stacksjs/ts-cloud 0.2.25 → 0.2.26

package/dist/drivers/index.d.ts

@@ -7,3 +7,5 @@ export { buildAwsArtifactFetch, buildLocalArtifactFetch, buildSiteDeployScript,
 export { deployAllComputeSites, deploySiteRelease, reloadRpxGateway } from './shared/compute-deploy';
 export { buildRpxConfig, buildRpxProvisionScript, deriveRouteId, normalizeRoutePath, renderRpxLauncher, DEFAULT_RPX_CERTS_DIR, RPX_DIR, RPX_LAUNCHER_PATH, RPX_SERVICE_NAME, } from './shared/rpx-gateway';
 export type { BuildRpxConfigOptions, BuildRpxProvisionOptions, RpxGatewayConfig, RpxRoute, } from './shared/rpx-gateway';
+export { buildCloudFrontOriginConfig, MANAGED_CACHE_POLICY_DISABLED, MANAGED_CACHE_POLICY_OPTIMIZED, MANAGED_ORIGIN_REQUEST_POLICY_ALL_VIEWER, } from './shared/cloudfront-origin';
+export type { BuildCloudFrontOriginOptions, OriginFrontedBehavior, } from './shared/cloudfront-origin';

package/dist/drivers/shared/cloudfront-origin.d.ts

@@ -0,0 +1,61 @@
+/**
+ * CloudFront-in-front-of-a-custom-origin distribution config.
+ *
+ * When a self-hosted gateway (rpx on a Hetzner box) is the origin behind
+ * CloudFront, the distribution needs a very specific shape — and several
+ * non-obvious settings will silently break it if wrong. This builder encodes
+ * the working configuration so it can't regress:
+ *
+ *  - **One custom origin**, the dedicated origin host (e.g. `origin.example.com`),
+ *    HTTPS-only. It must NOT be a public alias (that loops) and can't be a bare IP.
+ *  - **Host forwarding** via the AWS-managed `AllViewer` origin-request policy, so
+ *    the box receives `Host: <alias>` and routes by it (not by the origin host).
+ *  - **No `DefaultRootObject`.** Setting it to `index.html` makes CloudFront fetch
+ *    `/index.html`, which a gateway with clean-URLs 301-redirects back to `/` — an
+ *    infinite loop. Leave it empty and let the origin serve `/`.
+ *  - **No CloudFront Functions / Lambda@Edge.** S3-era URL-rewrite functions fight
+ *    a gateway that already does its own path-mounting + clean URLs (→ 301 loops).
+ *  - **Dynamic paths** (e.g. `/api/*`) use the managed `CachingDisabled` policy and
+ *    allow all HTTP methods; **static paths** use `CachingOptimized`.
+ *  - **Origin lockdown header** (optional): a secret injected on the origin hop,
+ *    paired with rpx `createOriginGuard`, so the publicly-resolvable origin can't
+ *    be used to bypass the CDN.
+ *
+ * The result is a complete `DistributionConfig` suitable for CloudFront
+ * `CreateDistribution` or `UpdateDistribution`.
+ */
+/** AWS-managed cache/origin-request policy IDs (identical across all accounts). */
+export declare const MANAGED_CACHE_POLICY_OPTIMIZED = "658327ea-f89d-4fab-a63d-7e88639e58f6";
+export declare const MANAGED_CACHE_POLICY_DISABLED = "4135ea2d-6df8-44a3-9df3-4b5a84be39ad";
+export declare const MANAGED_ORIGIN_REQUEST_POLICY_ALL_VIEWER = "216adef6-5c7f-47e4-b989-5492eafa07d3";
+export interface OriginFrontedBehavior {
+    /** Path pattern this behavior owns, e.g. `/api/*`, `/docs`, `/docs/*`. */
+    pathPattern: string;
+    /** `dynamic` → no caching + all methods (apps/APIs); `static` → cached (CachingOptimized). */
+    kind: 'dynamic' | 'static';
+}
+export interface BuildCloudFrontOriginOptions {
+    /** Public aliases (CNAMEs) on the distribution, e.g. `['example.com', 'www.example.com']`. */
+    aliases: string[];
+    /** Dedicated origin hostname CloudFront connects to. MUST resolve to the box, MUST NOT be an alias. */
+    originDomain: string;
+    /** ACM certificate ARN (us-east-1) covering {@link aliases}. */
+    viewerCertificateArn: string;
+    /** Per-path behaviors layered over the default. The default behavior (`/`) is always `static`. */
+    behaviors?: OriginFrontedBehavior[];
+    /** Secret injected on the origin hop (paired with rpx `createOriginGuard`). Omit to leave the origin open. */
+    originSecret?: string;
+    /** Header carrying {@link originSecret}. @default 'X-Origin-Verify' */
+    originSecretHeader?: string;
+    /** Stable id used to deterministically derive `CallerReference`. @default originDomain */
+    callerReference?: string;
+    /** Distribution comment. */
+    comment?: string;
+    /** `PriceClass_All` | `PriceClass_200` | `PriceClass_100`. @default 'PriceClass_All' */
+    priceClass?: string;
+}
+/**
+ * Build a complete CloudFront `DistributionConfig` for a self-hosted origin.
+ * See the module docblock for the rationale behind each fixed setting.
+ */
+export declare function buildCloudFrontOriginConfig(options: BuildCloudFrontOriginOptions): Record<string, any>;

package/dist/drivers/shared/rpx-gateway.d.ts

@@ -67,6 +67,15 @@ export interface RpxGatewayConfig {
         hosts: false;
         certs: false;
     };
+    /**
+     * Origin lockdown (from `proxy.cdn` when a `secret` is set): rpx rejects
+     * direct hits to the CDN-fronted hosts that lack the shared-secret header.
+     */
+    originGuard?: {
+        header: string;
+        value: string;
+        hosts: string[];
+    };
 }
 export interface BuildRpxConfigOptions {
     /** Proxy config from `infrastructure.compute.proxy`. */

package/dist/index.js

@@ -81788,6 +81788,14 @@ function buildRpxConfig(sites, options) {
       certsDir
     };
   }
+  const cdn = options.proxy.cdn;
+  if (cdn?.secret && cdn.frontedHosts.length > 0) {
+    config6.originGuard = {
+      header: cdn.secretHeader ?? "X-Origin-Verify",
+      value: cdn.secret,
+      hosts: cdn.frontedHosts
+    };
+  }
   return config6;
 }
 function renderRpxLauncher(config6) {

package/package.json

@@ -1,7 +1,7 @@
 {
   "name": "@stacksjs/ts-cloud",
   "type": "module",
-  "version": "0.2.25",
+  "version": "0.2.26",
   "description": "A lightweight, performant infrastructure-as-code library and CLI for deploying both server-based (EC2) and serverless applications.",
   "author": "Chris Breuer <chris@stacksjs.com>",
   "license": "MIT",
@@ -89,8 +89,8 @@
     "test": "bun test"
   },
   "dependencies": {
-    "@ts-cloud/aws-types": "0.2.25",
-    "@ts-cloud/core": "0.2.25",
+    "@ts-cloud/aws-types": "0.2.26",
+    "@ts-cloud/core": "0.2.26",
     "@stacksjs/ts-xml": "^0.1.0"
   },
   "devDependencies": {