@staticforge/aws 0.0.0-stage → 0.1.1

package/dist/iac.js

@@ -0,0 +1,223 @@
+import { fileURLToPath } from 'node:url';
+import { ListOpenIDConnectProviderTagsCommand, ListOpenIDConnectProvidersCommand, } from '@aws-sdk/client-iam';
+import { HeadBucketCommand } from '@aws-sdk/client-s3';
+import { GetCallerIdentityCommand } from '@aws-sdk/client-sts';
+import { ErrorCode, SforgeError } from '@staticforge/core';
+import { projectName, } from '@staticforge/iac';
+import { searchPaths, securityHeaders } from '@staticforge/provider-api';
+import { awsError, defaultClients, errorName, httpStatus } from './clients.js';
+/** Packaged HCL, next to src/ and dist/. */
+const terraformDir = (path) => fileURLToPath(new URL(`../terraform/${path}`, import.meta.url));
+export const SITE_MODULE_DIR = terraformDir('modules/site');
+export const STATE_BOOTSTRAP_DIR = terraformDir('state-bootstrap');
+const AWS_PROVIDER = { source: 'hashicorp/aws', version: '>= 6.0, < 7.0' };
+const GITHUB_OIDC_HOST = 'token.actions.githubusercontent.com';
+/** `sforge-state-<accountId>-<region>` unless configured, key `<site>/<target>.tfstate`. */
+export function stateLocation(target, accountId, project, targetName) {
+    const region = target.state.region ?? target.region;
+    return {
+        bucket: target.state.bucket ?? `sforge-state-${accountId}-${region}`,
+        region,
+        key: `${project}/${targetName}.tfstate`,
+    };
+}
+function s3Backend(location, kmsKeyArn) {
+    return {
+        type: 's3',
+        config: {
+            bucket: location.bucket,
+            key: location.key,
+            region: location.region,
+            encrypt: true,
+            use_lockfile: true,
+            ...(kmsKeyArn !== undefined && { kms_key_id: kmsKeyArn }),
+        },
+    };
+}
+async function accountId(clients, region) {
+    try {
+        const identity = await clients.sts(region).send(new GetCallerIdentityCommand({}));
+        if (identity.Account === undefined)
+            throw new Error('no account in the caller identity');
+        return identity.Account;
+    }
+    catch (error) {
+        throw awsError(error, 'Could not identify the AWS account', ErrorCode.CloudAuth);
+    }
+}
+async function bucketExists(clients, bucket, region) {
+    try {
+        await clients.s3(region).send(new HeadBucketCommand({ Bucket: bucket }));
+        return true;
+    }
+    catch (error) {
+        const status = httpStatus(error);
+        if (status === 404 || errorName(error) === 'NotFound' || errorName(error) === 'NoSuchBucket') {
+            return false;
+        }
+        if (status === 403) {
+            throw new SforgeError(ErrorCode.CloudAuth, `The state bucket ${bucket} exists but this AWS identity cannot access it`, {
+                hint: 'Bucket names are global: if another account owns it, set targets.<name>.state.bucket.',
+            });
+        }
+        throw awsError(error, `Could not check the state bucket ${bucket}`, ErrorCode.CloudAuth);
+    }
+}
+/**
+ * The account's GitHub OIDC provider is shared: reuse an existing one, unless
+ * this target created it (tagged `sforge:owner = <site>-<target>`), in which
+ * case it stays managed here.
+ */
+export async function chooseOidcProvider(clients, owner) {
+    try {
+        const iam = clients.iam();
+        const list = await iam.send(new ListOpenIDConnectProvidersCommand({}));
+        const arn = list.OpenIDConnectProviderList?.map((p) => p.Arn).find((a) => a !== undefined && a.endsWith(`/${GITHUB_OIDC_HOST}`));
+        if (arn === undefined)
+            return { create: true };
+        const tags = await iam.send(new ListOpenIDConnectProviderTagsCommand({ OpenIDConnectProviderArn: arn }));
+        const ours = tags.Tags?.some((t) => t.Key === 'sforge:owner' && t.Value === owner) ?? false;
+        return ours ? { create: true } : { create: false, arn };
+    }
+    catch (error) {
+        throw awsError(error, 'Could not look up the GitHub OIDC provider', ErrorCode.CloudAuth);
+    }
+}
+/** Instructions for DNS records the user must create (no Route 53 hosted zone). */
+export function describeValidation(outputs) {
+    const records = outputs.validation_records;
+    if (records === undefined || records.length === 0)
+        return undefined;
+    const lines = records.map((r) => `  ${r.name} ${r.type} ${r.value}`);
+    return [
+        'Create these DNS records to validate the certificate (provisioning waits until they resolve):',
+        ...lines,
+    ].join('\n');
+}
+export function createAwsIacProfile(clients = defaultClients()) {
+    return {
+        provider: 'aws',
+        async prepare(input) {
+            const target = input.target;
+            const project = projectName(input.config);
+            const id = `${project}-${input.targetName}`;
+            const account = await accountId(clients, target.region);
+            const location = stateLocation(target, account, project, input.targetName);
+            const outputsOnly = input.purpose === 'outputs';
+            const exists = outputsOnly
+                ? true
+                : await bucketExists(clients, location.bucket, location.region);
+            if (target.previewDomain !== undefined && target.domain === undefined) {
+                throw new SforgeError(ErrorCode.ConfigInvalid, `targets.${input.targetName}.previewDomain needs a domain`, {
+                    hint: 'PR previews are served from a wildcard certificate of the custom domain.',
+                });
+            }
+            const oidc = target.ci === undefined || outputsOnly ? undefined : await chooseOidcProvider(clients, id);
+            const headers = securityHeaders(input.config);
+            const tags = { 'sforge:managed-by': 'staticforge' };
+            const inputs = {
+                name: project,
+                target: input.targetName,
+                trailing_slash: input.config.build.trailingSlash,
+                domain: target.domain ?? null,
+                hosted_zone: target.hostedZone ?? null,
+                preview_domain: target.previewDomain ?? null,
+                logging: target.logging,
+                waf_web_acl_arn: target.wafWebAclArn ?? null,
+                force_destroy: false,
+                security_headers: {
+                    content_security_policy: headers.contentSecurityPolicy,
+                    search_content_security_policy: headers.searchContentSecurityPolicy,
+                    hsts_max_age: headers.hsts?.maxAge ?? null,
+                    hsts_include_subdomains: headers.hsts?.includeSubDomains ?? false,
+                    hsts_preload: headers.hsts?.preload ?? false,
+                    referrer_policy: headers.referrerPolicy,
+                    frame_options: headers.frameOptions,
+                    permissions_policy: headers.permissionsPolicy,
+                },
+                search_paths: searchPaths(input.config),
+                ci: target.ci === undefined
+                    ? null
+                    : {
+                        repo: target.ci.repo,
+                        branches: target.ci.branches,
+                        environments: target.ci.environments,
+                        pull_requests: target.ci.pullRequests,
+                        // Reading outputs never applies, so the choice does not matter there.
+                        create_oidc_provider: oidc?.create ?? false,
+                        oidc_provider_arn: oidc?.arn ?? null,
+                        state_bucket: location.bucket,
+                        state_key: location.key,
+                    },
+                tags,
+                ...input.inputs,
+            };
+            const defaultTags = [
+                { tags: { ...tags, 'sforge:site': project, 'sforge:target': input.targetName } },
+            ];
+            const spec = {
+                requiredProviders: { aws: AWS_PROVIDER },
+                providers: {
+                    aws: [
+                        { region: target.region, default_tags: defaultTags },
+                        { alias: 'us_east_1', region: 'us-east-1', default_tags: defaultTags },
+                    ],
+                },
+                module: {
+                    name: 'site',
+                    dir: SITE_MODULE_DIR,
+                    inputs,
+                    providers: { aws: 'aws', 'aws.us_east_1': 'aws.us_east_1' },
+                },
+                outputs: [
+                    'bucket',
+                    'bucket_region',
+                    'distribution_id',
+                    'distribution_arn',
+                    'distribution_domain',
+                    'kvs_arn',
+                    'url',
+                    'preview_domain',
+                    'trailing_slash',
+                    'certificate_arn',
+                    'validation_records',
+                    'dns_records',
+                    'ci_role_arn',
+                    'oidc_provider_arn',
+                ],
+                backend: s3Backend(location, target.state.kmsKeyArn),
+            };
+            const bootstrap = {
+                requiredProviders: { aws: AWS_PROVIDER },
+                providers: { aws: [{ region: location.region, default_tags: [{ tags }] }] },
+                module: {
+                    name: 'state',
+                    dir: STATE_BOOTSTRAP_DIR,
+                    inputs: { bucket_name: location.bucket, kms_key_arn: target.state.kmsKeyArn ?? null },
+                },
+                outputs: ['bucket', 'region'],
+                backend: s3Backend({ ...location, key: '_sforge/state-bootstrap.tfstate' }, target.state.kmsKeyArn),
+            };
+            return {
+                spec,
+                state: {
+                    id: `aws-${account}-${location.region}${target.state.bucket ? `-${target.state.bucket}` : ''}`,
+                    description: `s3://${location.bucket}/${location.key}`,
+                    exists,
+                    bootstrap,
+                },
+                preDestroyInputs: { force_destroy: true },
+                // Deploys and rollbacks switch the active version with the SDK.
+                expectedDrift: ['module.site.aws_cloudfrontkeyvaluestore_key.active'],
+                ...(target.domain !== undefined &&
+                    target.hostedZone === undefined && {
+                    prePhase: {
+                        targets: ['module.site.aws_acm_certificate.site'],
+                        describe: describeValidation,
+                    },
+                }),
+            };
+        },
+    };
+}
+//# sourceMappingURL=iac.js.map

package/dist/iac.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"iac.js","sourceRoot":"","sources":["../src/iac.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,aAAa,EAAE,MAAM,UAAU,CAAC;AACzC,OAAO,EACL,oCAAoC,EACpC,iCAAiC,GAClC,MAAM,qBAAqB,CAAC;AAC7B,OAAO,EAAE,iBAAiB,EAAE,MAAM,oBAAoB,CAAC;AACvD,OAAO,EAAE,wBAAwB,EAAE,MAAM,qBAAqB,CAAC;AAC/D,OAAO,EAAwB,SAAS,EAAE,WAAW,EAAE,MAAM,mBAAmB,CAAC;AACjF,OAAO,EAML,WAAW,GACZ,MAAM,kBAAkB,CAAC;AAC1B,OAAO,EAAE,WAAW,EAAE,eAAe,EAAE,MAAM,2BAA2B,CAAC;AACzE,OAAO,EAAmB,QAAQ,EAAE,cAAc,EAAE,SAAS,EAAE,UAAU,EAAE,MAAM,cAAc,CAAC;AAEhG,4CAA4C;AAC5C,MAAM,YAAY,GAAG,CAAC,IAAY,EAAE,EAAE,CACpC,aAAa,CAAC,IAAI,GAAG,CAAC,gBAAgB,IAAI,EAAE,EAAE,MAAM,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC;AAElE,MAAM,CAAC,MAAM,eAAe,GAAG,YAAY,CAAC,cAAc,CAAC,CAAC;AAC5D,MAAM,CAAC,MAAM,mBAAmB,GAAG,YAAY,CAAC,iBAAiB,CAAC,CAAC;AAEnE,MAAM,YAAY,GAAG,EAAE,MAAM,EAAE,eAAe,EAAE,OAAO,EAAE,eAAe,EAAE,CAAC;AAC3E,MAAM,gBAAgB,GAAG,qCAAqC,CAAC;AAQ/D,4FAA4F;AAC5F,MAAM,UAAU,aAAa,CAC3B,MAAuB,EACvB,SAAiB,EACjB,OAAe,EACf,UAAkB;IAElB,MAAM,MAAM,GAAG,MAAM,CAAC,KAAK,CAAC,MAAM,IAAI,MAAM,CAAC,MAAM,CAAC;IACpD,OAAO;QACL,MAAM,EAAE,MAAM,CAAC,KAAK,CAAC,MAAM,IAAI,gBAAgB,SAAS,IAAI,MAAM,EAAE;QACpE,MAAM;QACN,GAAG,EAAE,GAAG,OAAO,IAAI,UAAU,UAAU;KACxC,CAAC;AACJ,CAAC;AAED,SAAS,SAAS,CAAC,QAAuB,EAAE,SAA6B;IACvE,OAAO;QACL,IAAI,EAAE,IAAI;QACV,MAAM,EAAE;YACN,MAAM,EAAE,QAAQ,CAAC,MAAM;YACvB,GAAG,EAAE,QAAQ,CAAC,GAAG;YACjB,MAAM,EAAE,QAAQ,CAAC,MAAM;YACvB,OAAO,EAAE,IAAI;YACb,YAAY,EAAE,IAAI;YAClB,GAAG,CAAC,SAAS,KAAK,SAAS,IAAI,EAAE,UAAU,EAAE,SAAS,EAAE,CAAC;SAC1D;KACF,CAAC;AACJ,CAAC;AAED,KAAK,UAAU,SAAS,CAAC,OAAmB,EAAE,MAAc;IAC1D,IAAI,CAAC;QACH,MAAM,QAAQ,GAAG,MAAM,OAAO,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC,IAAI,CAAC,IAAI,wBAAwB,CAAC,EAAE,CAAC,CAAC,CAAC;QAClF,IAAI,QAAQ,CAAC,OAAO,KAAK,SAAS;YAAE,MAAM,IAAI,KAAK,CAAC,mCAAmC,CAAC,CAAC;QACzF,OAAO,QAAQ,CAAC,OAAO,CAAC;IAC1B,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,MAAM,QAAQ,CAAC,KAAK,EAAE,oCAAoC,EAAE,SAAS,CAAC,SAAS,CAAC,CAAC;IACnF,CAAC;AACH,CAAC;AAED,KAAK,UAAU,YAAY,CAAC,OAAmB,EAAE,MAAc,EAAE,MAAc;IAC7E,IAAI,CAAC;QACH,MAAM,OAAO,CAAC,EAAE,CAAC,MAAM,CAAC,CAAC,IAAI,CAAC,IAAI,iBAAiB,CAAC,EAAE,MAAM,EAAE,MAAM,EAAE,CAAC,CAAC,CAAC;QACzE,OAAO,IAAI,CAAC;IACd,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,MAAM,MAAM,GAAG,UAAU,CAAC,KAAK,CAAC,CAAC;QACjC,IAAI,MAAM,KAAK,GAAG,IAAI,SAAS,CAAC,KAAK,CAAC,KAAK,UAAU,IAAI,SAAS,CAAC,KAAK,CAAC,KAAK,cAAc,EAAE,CAAC;YAC7F,OAAO,KAAK,CAAC;QACf,CAAC;QACD,IAAI,MAAM,KAAK,GAAG,EAAE,CAAC;YACnB,MAAM,IAAI,WAAW,CACnB,SAAS,CAAC,SAAS,EACnB,oBAAoB,MAAM,gDAAgD,EAC1E;gBACE,IAAI,EAAE,uFAAuF;aAC9F,CACF,CAAC;QACJ,CAAC;QACD,MAAM,QAAQ,CAAC,KAAK,EAAE,oCAAoC,MAAM,EAAE,EAAE,SAAS,CAAC,SAAS,CAAC,CAAC;IAC3F,CAAC;AACH,CAAC;AAOD;;;;GAIG;AACH,MAAM,CAAC,KAAK,UAAU,kBAAkB,CACtC,OAAmB,EACnB,KAAa;IAEb,IAAI,CAAC;QACH,MAAM,GAAG,GAAG,OAAO,CAAC,GAAG,EAAE,CAAC;QAC1B,MAAM,IAAI,GAAG,MAAM,GAAG,CAAC,IAAI,CAAC,IAAI,iCAAiC,CAAC,EAAE,CAAC,CAAC,CAAC;QACvE,MAAM,GAAG,GAAG,IAAI,CAAC,yBAAyB,EAAE,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,IAAI,CAChE,CAAC,CAAC,EAAe,EAAE,CAAC,CAAC,KAAK,SAAS,IAAI,CAAC,CAAC,QAAQ,CAAC,IAAI,gBAAgB,EAAE,CAAC,CAC1E,CAAC;QACF,IAAI,GAAG,KAAK,SAAS;YAAE,OAAO,EAAE,MAAM,EAAE,IAAI,EAAE,CAAC;QAC/C,MAAM,IAAI,GAAG,MAAM,GAAG,CAAC,IAAI,CACzB,IAAI,oCAAoC,CAAC,EAAE,wBAAwB,EAAE,GAAG,EAAE,CAAC,CAC5E,CAAC;QACF,MAAM,IAAI,GAAG,IAAI,CAAC,IAAI,EAAE,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,GAAG,KAAK,cAAc,IAAI,CAAC,CAAC,KAAK,KAAK,KAAK,CAAC,IAAI,KAAK,CAAC;QAC5F,OAAO,IAAI,CAAC,CAAC,CAAC,EAAE,MAAM,EAAE,IAAI,EAAE,CAAC,CAAC,CAAC,EAAE,MAAM,EAAE,KAAK,EAAE,GAAG,EAAE,CAAC;IAC1D,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,MAAM,QAAQ,CAAC,KAAK,EAAE,4CAA4C,EAAE,SAAS,CAAC,SAAS,CAAC,CAAC;IAC3F,CAAC;AACH,CAAC;AAED,mFAAmF;AACnF,MAAM,UAAU,kBAAkB,CAAC,OAAgC;IACjE,MAAM,OAAO,GAAG,OAAO,CAAC,kBACqC,CAAC;IAC9D,IAAI,OAAO,KAAK,SAAS,IAAI,OAAO,CAAC,MAAM,KAAK,CAAC;QAAE,OAAO,SAAS,CAAC;IACpE,MAAM,KAAK,GAAG,OAAO,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,KAAK,CAAC,CAAC,IAAI,IAAI,CAAC,CAAC,IAAI,IAAI,CAAC,CAAC,KAAK,EAAE,CAAC,CAAC;IACrE,OAAO;QACL,+FAA+F;QAC/F,GAAG,KAAK;KACT,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;AACf,CAAC;AAED,MAAM,UAAU,mBAAmB,CAAC,UAAsB,cAAc,EAAE;IACxE,OAAO;QACL,QAAQ,EAAE,KAAK;QACf,KAAK,CAAC,OAAO,CAAC,KAAmB;YAC/B,MAAM,MAAM,GAAG,KAAK,CAAC,MAAyB,CAAC;YAC/C,MAAM,OAAO,GAAG,WAAW,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC;YAC1C,MAAM,EAAE,GAAG,GAAG,OAAO,IAAI,KAAK,CAAC,UAAU,EAAE,CAAC;YAC5C,MAAM,OAAO,GAAG,MAAM,SAAS,CAAC,OAAO,EAAE,MAAM,CAAC,MAAM,CAAC,CAAC;YACxD,MAAM,QAAQ,GAAG,aAAa,CAAC,MAAM,EAAE,OAAO,EAAE,OAAO,EAAE,KAAK,CAAC,UAAU,CAAC,CAAC;YAC3E,MAAM,WAAW,GAAG,KAAK,CAAC,OAAO,KAAK,SAAS,CAAC;YAChD,MAAM,MAAM,GAAG,WAAW;gBACxB,CAAC,CAAC,IAAI;gBACN,CAAC,CAAC,MAAM,YAAY,CAAC,OAAO,EAAE,QAAQ,CAAC,MAAM,EAAE,QAAQ,CAAC,MAAM,CAAC,CAAC;YAElE,IAAI,MAAM,CAAC,aAAa,KAAK,SAAS,IAAI,MAAM,CAAC,MAAM,KAAK,SAAS,EAAE,CAAC;gBACtE,MAAM,IAAI,WAAW,CACnB,SAAS,CAAC,aAAa,EACvB,WAAW,KAAK,CAAC,UAAU,+BAA+B,EAC1D;oBACE,IAAI,EAAE,0EAA0E;iBACjF,CACF,CAAC;YACJ,CAAC;YAED,MAAM,IAAI,GACR,MAAM,CAAC,EAAE,KAAK,SAAS,IAAI,WAAW,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,MAAM,kBAAkB,CAAC,OAAO,EAAE,EAAE,CAAC,CAAC;YAC7F,MAAM,OAAO,GAAG,eAAe,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC;YAC9C,MAAM,IAAI,GAAG,EAAE,mBAAmB,EAAE,aAAa,EAAE,CAAC;YACpD,MAAM,MAAM,GAA4B;gBACtC,IAAI,EAAE,OAAO;gBACb,MAAM,EAAE,KAAK,CAAC,UAAU;gBACxB,cAAc,EAAE,KAAK,CAAC,MAAM,CAAC,KAAK,CAAC,aAAa;gBAChD,MAAM,EAAE,MAAM,CAAC,MAAM,IAAI,IAAI;gBAC7B,WAAW,EAAE,MAAM,CAAC,UAAU,IAAI,IAAI;gBACtC,cAAc,EAAE,MAAM,CAAC,aAAa,IAAI,IAAI;gBAC5C,OAAO,EAAE,MAAM,CAAC,OAAO;gBACvB,eAAe,EAAE,MAAM,CAAC,YAAY,IAAI,IAAI;gBAC5C,aAAa,EAAE,KAAK;gBACpB,gBAAgB,EAAE;oBAChB,uBAAuB,EAAE,OAAO,CAAC,qBAAqB;oBACtD,8BAA8B,EAAE,OAAO,CAAC,2BAA2B;oBACnE,YAAY,EAAE,OAAO,CAAC,IAAI,EAAE,MAAM,IAAI,IAAI;oBAC1C,uBAAuB,EAAE,OAAO,CAAC,IAAI,EAAE,iBAAiB,IAAI,KAAK;oBACjE,YAAY,EAAE,OAAO,CAAC,IAAI,EAAE,OAAO,IAAI,KAAK;oBAC5C,eAAe,EAAE,OAAO,CAAC,cAAc;oBACvC,aAAa,EAAE,OAAO,CAAC,YAAY;oBACnC,kBAAkB,EAAE,OAAO,CAAC,iBAAiB;iBAC9C;gBACD,YAAY,EAAE,WAAW,CAAC,KAAK,CAAC,MAAM,CAAC;gBACvC,EAAE,EACA,MAAM,CAAC,EAAE,KAAK,SAAS;oBACrB,CAAC,CAAC,IAAI;oBACN,CAAC,CAAC;wBACE,IAAI,EAAE,MAAM,CAAC,EAAE,CAAC,IAAI;wBACpB,QAAQ,EAAE,MAAM,CAAC,EAAE,CAAC,QAAQ;wBAC5B,YAAY,EAAE,MAAM,CAAC,EAAE,CAAC,YAAY;wBACpC,aAAa,EAAE,MAAM,CAAC,EAAE,CAAC,YAAY;wBACrC,sEAAsE;wBACtE,oBAAoB,EAAE,IAAI,EAAE,MAAM,IAAI,KAAK;wBAC3C,iBAAiB,EAAE,IAAI,EAAE,GAAG,IAAI,IAAI;wBACpC,YAAY,EAAE,QAAQ,CAAC,MAAM;wBAC7B,SAAS,EAAE,QAAQ,CAAC,GAAG;qBACxB;gBACP,IAAI;gBACJ,GAAG,KAAK,CAAC,MAAM;aAChB,CAAC;YAEF,MAAM,WAAW,GAAG;gBAClB,EAAE,IAAI,EAAE,EAAE,GAAG,IAAI,EAAE,aAAa,EAAE,OAAO,EAAE,eAAe,EAAE,KAAK,CAAC,UAAU,EAAE,EAAE;aACjF,CAAC;YACF,MAAM,IAAI,GAAY;gBACpB,iBAAiB,EAAE,EAAE,GAAG,EAAE,YAAY,EAAE;gBACxC,SAAS,EAAE;oBACT,GAAG,EAAE;wBACH,EAAE,MAAM,EAAE,MAAM,CAAC,MAAM,EAAE,YAAY,EAAE,WAAW,EAAE;wBACpD,EAAE,KAAK,EAAE,WAAW,EAAE,MAAM,EAAE,WAAW,EAAE,YAAY,EAAE,WAAW,EAAE;qBACvE;iBACF;gBACD,MAAM,EAAE;oBACN,IAAI,EAAE,MAAM;oBACZ,GAAG,EAAE,eAAe;oBACpB,MAAM;oBACN,SAAS,EAAE,EAAE,GAAG,EAAE,KAAK,EAAE,eAAe,EAAE,eAAe,EAAE;iBAC5D;gBACD,OAAO,EAAE;oBACP,QAAQ;oBACR,eAAe;oBACf,iBAAiB;oBACjB,kBAAkB;oBAClB,qBAAqB;oBACrB,SAAS;oBACT,KAAK;oBACL,gBAAgB;oBAChB,gBAAgB;oBAChB,iBAAiB;oBACjB,oBAAoB;oBACpB,aAAa;oBACb,aAAa;oBACb,mBAAmB;iBACpB;gBACD,OAAO,EAAE,SAAS,CAAC,QAAQ,EAAE,MAAM,CAAC,KAAK,CAAC,SAAS,CAAC;aACrD,CAAC;YAEF,MAAM,SAAS,GAAY;gBACzB,iBAAiB,EAAE,EAAE,GAAG,EAAE,YAAY,EAAE;gBACxC,SAAS,EAAE,EAAE,GAAG,EAAE,CAAC,EAAE,MAAM,EAAE,QAAQ,CAAC,MAAM,EAAE,YAAY,EAAE,CAAC,EAAE,IAAI,EAAE,CAAC,EAAE,CAAC,EAAE;gBAC3E,MAAM,EAAE;oBACN,IAAI,EAAE,OAAO;oBACb,GAAG,EAAE,mBAAmB;oBACxB,MAAM,EAAE,EAAE,WAAW,EAAE,QAAQ,CAAC,MAAM,EAAE,WAAW,EAAE,MAAM,CAAC,KAAK,CAAC,SAAS,IAAI,IAAI,EAAE;iBACtF;gBACD,OAAO,EAAE,CAAC,QAAQ,EAAE,QAAQ,CAAC;gBAC7B,OAAO,EAAE,SAAS,CAChB,EAAE,GAAG,QAAQ,EAAE,GAAG,EAAE,iCAAiC,EAAE,EACvD,MAAM,CAAC,KAAK,CAAC,SAAS,CACvB;aACF,CAAC;YAEF,OAAO;gBACL,IAAI;gBACJ,KAAK,EAAE;oBACL,EAAE,EAAE,OAAO,OAAO,IAAI,QAAQ,CAAC,MAAM,GAAG,MAAM,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC,CAAC,IAAI,MAAM,CAAC,KAAK,CAAC,MAAM,EAAE,CAAC,CAAC,CAAC,EAAE,EAAE;oBAC9F,WAAW,EAAE,QAAQ,QAAQ,CAAC,MAAM,IAAI,QAAQ,CAAC,GAAG,EAAE;oBACtD,MAAM;oBACN,SAAS;iBACV;gBACD,gBAAgB,EAAE,EAAE,aAAa,EAAE,IAAI,EAAE;gBACzC,gEAAgE;gBAChE,aAAa,EAAE,CAAC,oDAAoD,CAAC;gBACrE,GAAG,CAAC,MAAM,CAAC,MAAM,KAAK,SAAS;oBAC7B,MAAM,CAAC,UAAU,KAAK,SAAS,IAAI;oBACjC,QAAQ,EAAE;wBACR,OAAO,EAAE,CAAC,sCAAsC,CAAC;wBACjD,QAAQ,EAAE,kBAAkB;qBAC7B;iBACF,CAAC;aACL,CAAC;QACJ,CAAC;KACF,CAAC;AACJ,CAAC"}

package/dist/index.d.ts

@@ -0,0 +1,9 @@
+import type { Provider } from '@staticforge/provider-api';
+import { type AwsClients } from './clients.js';
+export * from './clients.js';
+export * from './deployer.js';
+export * from './iac.js';
+export * from './routing.js';
+/** The AWS provider: private S3 + CloudFront with OAC, versions in a KeyValueStore. */
+export declare function createAwsProvider(clients?: AwsClients): Provider;
+//# sourceMappingURL=index.d.ts.map

package/dist/index.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,QAAQ,EAAE,MAAM,2BAA2B,CAAC;AAC1D,OAAO,EAAE,KAAK,UAAU,EAAkB,MAAM,cAAc,CAAC;AAI/D,cAAc,cAAc,CAAC;AAC7B,cAAc,eAAe,CAAC;AAC9B,cAAc,UAAU,CAAC;AACzB,cAAc,cAAc,CAAC;AAE7B,uFAAuF;AACvF,wBAAgB,iBAAiB,CAAC,OAAO,GAAE,UAA6B,GAAG,QAAQ,CAOlF"}

package/dist/index.js

@@ -0,0 +1,17 @@
+import { defaultClients } from './clients.js';
+import { REQUIRED_OUTPUTS, createAwsDeployer } from './deployer.js';
+import { createAwsIacProfile } from './iac.js';
+export * from './clients.js';
+export * from './deployer.js';
+export * from './iac.js';
+export * from './routing.js';
+/** The AWS provider: private S3 + CloudFront with OAC, versions in a KeyValueStore. */
+export function createAwsProvider(clients = defaultClients()) {
+    return {
+        id: 'aws',
+        iac: createAwsIacProfile(clients),
+        createDeployer: (context) => createAwsDeployer(context, clients),
+        requiredOutputs: REQUIRED_OUTPUTS,
+    };
+}
+//# sourceMappingURL=index.js.map

package/dist/index.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AACA,OAAO,EAAmB,cAAc,EAAE,MAAM,cAAc,CAAC;AAC/D,OAAO,EAAE,gBAAgB,EAAE,iBAAiB,EAAE,MAAM,eAAe,CAAC;AACpE,OAAO,EAAE,mBAAmB,EAAE,MAAM,UAAU,CAAC;AAE/C,cAAc,cAAc,CAAC;AAC7B,cAAc,eAAe,CAAC;AAC9B,cAAc,UAAU,CAAC;AACzB,cAAc,cAAc,CAAC;AAE7B,uFAAuF;AACvF,MAAM,UAAU,iBAAiB,CAAC,UAAsB,cAAc,EAAE;IACtE,OAAO;QACL,EAAE,EAAE,KAAK;QACT,GAAG,EAAE,mBAAmB,CAAC,OAAO,CAAC;QACjC,cAAc,EAAE,CAAC,OAAO,EAAE,EAAE,CAAC,iBAAiB,CAAC,OAAO,EAAE,OAAO,CAAC;QAChE,eAAe,EAAE,gBAAgB;KAClC,CAAC;AACJ,CAAC"}

package/dist/routing.d.ts

@@ -0,0 +1,32 @@
+export type TrailingSlash = 'always' | 'never';
+/** What the CloudFront router does with a URL path, before route exceptions. */
+export type RouterTarget = {
+    file: string;
+    key?: string;
+} | {
+    redirect: string;
+    key?: string;
+} | {
+    missing: true;
+    key?: string;
+};
+/**
+ * The rule-based part of terraform/modules/site/router.js, mirrored for
+ * computing route exceptions. `key` (page-like URLs only) is the canonical
+ * path under which an exception is looked up.
+ */
+export declare function routeByRule(uri: string, trailingSlash: TrailingSlash): RouterTarget;
+export interface RouteExceptions {
+    /** KVS key (without the "r:<version>:" prefix) → value. */
+    entries: Record<string, string>;
+    /** Page URLs whose exception key would be too long for the KVS. */
+    skipped: string[];
+}
+/**
+ * The URLs of a build that the router's rules would serve differently from
+ * `sforge preview` (resolveRequest), such as section pages with trailingSlash
+ * "never" or files without an extension. `sforge deploy` stores them in the
+ * KVS so CloudFront matches the local server.
+ */
+export declare function routeExceptions(files: Iterable<string>, trailingSlash: TrailingSlash, versionId: string): RouteExceptions;
+//# sourceMappingURL=routing.d.ts.map

package/dist/routing.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"routing.d.ts","sourceRoot":"","sources":["../src/routing.ts"],"names":[],"mappings":"AAEA,MAAM,MAAM,aAAa,GAAG,QAAQ,GAAG,OAAO,CAAC;AAE/C,gFAAgF;AAChF,MAAM,MAAM,YAAY,GACpB;IAAE,IAAI,EAAE,MAAM,CAAC;IAAC,GAAG,CAAC,EAAE,MAAM,CAAA;CAAE,GAC9B;IAAE,QAAQ,EAAE,MAAM,CAAC;IAAC,GAAG,CAAC,EAAE,MAAM,CAAA;CAAE,GAClC;IAAE,OAAO,EAAE,IAAI,CAAC;IAAC,GAAG,CAAC,EAAE,MAAM,CAAA;CAAE,CAAC;AAEpC;;;;GAIG;AACH,wBAAgB,WAAW,CAAC,GAAG,EAAE,MAAM,EAAE,aAAa,EAAE,aAAa,GAAG,YAAY,CA8BnF;AA6BD,MAAM,WAAW,eAAe;IAC9B,2DAA2D;IAC3D,OAAO,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;IAChC,mEAAmE;IACnE,OAAO,EAAE,MAAM,EAAE,CAAC;CACnB;AAED;;;;;GAKG;AACH,wBAAgB,eAAe,CAC7B,KAAK,EAAE,QAAQ,CAAC,MAAM,CAAC,EACvB,aAAa,EAAE,aAAa,EAC5B,SAAS,EAAE,MAAM,GAChB,eAAe,CA+BjB"}

package/dist/routing.js

@@ -0,0 +1,111 @@
+import { resolveRequest } from '@staticforge/server';
+/**
+ * The rule-based part of terraform/modules/site/router.js, mirrored for
+ * computing route exceptions. `key` (page-like URLs only) is the canonical
+ * path under which an exception is looked up.
+ */
+export function routeByRule(uri, trailingSlash) {
+    if (!uri.startsWith('/'))
+        return { missing: true };
+    const raw = uri.slice(1).split('/');
+    const trailing = raw.at(-1) === '';
+    if (trailing)
+        raw.pop();
+    const canonical = [];
+    for (const part of raw) {
+        let segment;
+        try {
+            segment = decodeURIComponent(part);
+        }
+        catch {
+            return { missing: true };
+        }
+        if (segment === '' || segment.startsWith('.') || /[\\\0]/.test(segment))
+            return { missing: true };
+        canonical.push(encodeURIComponent(segment));
+    }
+    if (raw.length === 0)
+        return { file: 'index.html' };
+    const path = raw.join('/');
+    const key = `/${canonical.join('/')}${trailing ? '/' : ''}`;
+    if (trailing) {
+        if (trailingSlash === 'always')
+            return { file: `${path}/index.html`, key };
+        // "/style.css/" is not a page; only pages lose their slash.
+        return raw.at(-1).includes('.') ? { missing: true, key } : { redirect: `/${path}`, key };
+    }
+    if (raw.at(-1).includes('.'))
+        return { file: path };
+    return trailingSlash === 'always'
+        ? { redirect: `/${path}/`, key }
+        : { file: `${path}.html`, key };
+}
+/** The S3 key part of a router file target (URL-decoded). */
+function decodedFile(file) {
+    return file.split('/').map(decodeURIComponent).join('/');
+}
+function encodePath(path) {
+    return path.split('/').map(encodeURIComponent).join('/');
+}
+/** Value of an "r:<version>:<key>" KVS entry: f:<file>, r:<location> or 404. */
+function exceptionValue(truth) {
+    if (truth.kind === 'redirect')
+        return `r:${truth.location}`;
+    if (truth.kind === 'file' && truth.status === 200)
+        return `f:${encodePath(truth.path)}`;
+    return '404';
+}
+function sameOutcome(rule, truth) {
+    if ('redirect' in rule)
+        return truth.kind === 'redirect' && truth.location === rule.redirect;
+    if ('missing' in rule)
+        return truth.kind !== 'file' || truth.status === 404;
+    if (truth.kind === 'file' && truth.status === 200)
+        return decodedFile(rule.file) === truth.path;
+    // The rule names a file that does not exist: S3 answers 404, like the local server.
+    return truth.kind !== 'redirect';
+}
+/** Longest KVS key is 512 bytes. */
+const MAX_KEY_BYTES = 512;
+/**
+ * The URLs of a build that the router's rules would serve differently from
+ * `sforge preview` (resolveRequest), such as section pages with trailingSlash
+ * "never" or files without an extension. `sforge deploy` stores them in the
+ * KVS so CloudFront matches the local server.
+ */
+export function routeExceptions(files, trailingSlash, versionId) {
+    const set = new Set(files);
+    const exists = (path) => set.has(path);
+    const candidates = new Set();
+    for (const file of set) {
+        const encoded = `/${encodePath(file)}`;
+        if (file.endsWith('/index.html')) {
+            const dir = encoded.slice(0, -'index.html'.length);
+            candidates.add(dir).add(dir.slice(0, -1));
+        }
+        else if (file.endsWith('.html')) {
+            const page = encoded.slice(0, -'.html'.length);
+            candidates.add(page).add(`${page}/`);
+        }
+        else if (!file.split('/').at(-1).includes('.')) {
+            candidates.add(encoded).add(`${encoded}/`);
+        }
+    }
+    const entries = {};
+    const skipped = [];
+    for (const url of [...candidates].sort()) {
+        const rule = routeByRule(url, trailingSlash);
+        if (rule.key === undefined)
+            continue;
+        const truth = resolveRequest(url, exists, { trailingSlash });
+        if (sameOutcome(rule, truth))
+            continue;
+        if (Buffer.byteLength(`r:${versionId}:${rule.key}`) > MAX_KEY_BYTES) {
+            skipped.push(url);
+            continue;
+        }
+        entries[rule.key] = exceptionValue(truth);
+    }
+    return { entries, skipped };
+}
+//# sourceMappingURL=routing.js.map

package/dist/routing.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"routing.js","sourceRoot":"","sources":["../src/routing.ts"],"names":[],"mappings":"AAAA,OAAO,EAAmB,cAAc,EAAE,MAAM,qBAAqB,CAAC;AAUtE;;;;GAIG;AACH,MAAM,UAAU,WAAW,CAAC,GAAW,EAAE,aAA4B;IACnE,IAAI,CAAC,GAAG,CAAC,UAAU,CAAC,GAAG,CAAC;QAAE,OAAO,EAAE,OAAO,EAAE,IAAI,EAAE,CAAC;IACnD,MAAM,GAAG,GAAG,GAAG,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC;IACpC,MAAM,QAAQ,GAAG,GAAG,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC,KAAK,EAAE,CAAC;IACnC,IAAI,QAAQ;QAAE,GAAG,CAAC,GAAG,EAAE,CAAC;IACxB,MAAM,SAAS,GAAa,EAAE,CAAC;IAC/B,KAAK,MAAM,IAAI,IAAI,GAAG,EAAE,CAAC;QACvB,IAAI,OAAe,CAAC;QACpB,IAAI,CAAC;YACH,OAAO,GAAG,kBAAkB,CAAC,IAAI,CAAC,CAAC;QACrC,CAAC;QAAC,MAAM,CAAC;YACP,OAAO,EAAE,OAAO,EAAE,IAAI,EAAE,CAAC;QAC3B,CAAC;QACD,IAAI,OAAO,KAAK,EAAE,IAAI,OAAO,CAAC,UAAU,CAAC,GAAG,CAAC,IAAI,QAAQ,CAAC,IAAI,CAAC,OAAO,CAAC;YACrE,OAAO,EAAE,OAAO,EAAE,IAAI,EAAE,CAAC;QAC3B,SAAS,CAAC,IAAI,CAAC,kBAAkB,CAAC,OAAO,CAAC,CAAC,CAAC;IAC9C,CAAC;IACD,IAAI,GAAG,CAAC,MAAM,KAAK,CAAC;QAAE,OAAO,EAAE,IAAI,EAAE,YAAY,EAAE,CAAC;IAEpD,MAAM,IAAI,GAAG,GAAG,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;IAC3B,MAAM,GAAG,GAAG,IAAI,SAAS,CAAC,IAAI,CAAC,GAAG,CAAC,GAAG,QAAQ,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC;IAC5D,IAAI,QAAQ,EAAE,CAAC;QACb,IAAI,aAAa,KAAK,QAAQ;YAAE,OAAO,EAAE,IAAI,EAAE,GAAG,IAAI,aAAa,EAAE,GAAG,EAAE,CAAC;QAC3E,4DAA4D;QAC5D,OAAO,GAAG,CAAC,EAAE,CAAC,CAAC,CAAC,CAAE,CAAC,QAAQ,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,EAAE,OAAO,EAAE,IAAI,EAAE,GAAG,EAAE,CAAC,CAAC,CAAC,EAAE,QAAQ,EAAE,IAAI,IAAI,EAAE,EAAE,GAAG,EAAE,CAAC;IAC5F,CAAC;IACD,IAAI,GAAG,CAAC,EAAE,CAAC,CAAC,CAAC,CAAE,CAAC,QAAQ,CAAC,GAAG,CAAC;QAAE,OAAO,EAAE,IAAI,EAAE,IAAI,EAAE,CAAC;IACrD,OAAO,aAAa,KAAK,QAAQ;QAC/B,CAAC,CAAC,EAAE,QAAQ,EAAE,IAAI,IAAI,GAAG,EAAE,GAAG,EAAE;QAChC,CAAC,CAAC,EAAE,IAAI,EAAE,GAAG,IAAI,OAAO,EAAE,GAAG,EAAE,CAAC;AACpC,CAAC;AAED,6DAA6D;AAC7D,SAAS,WAAW,CAAC,IAAY;IAC/B,OAAO,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,GAAG,CAAC,kBAAkB,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;AAC3D,CAAC;AAED,SAAS,UAAU,CAAC,IAAY;IAC9B,OAAO,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,GAAG,CAAC,kBAAkB,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;AAC3D,CAAC;AAED,gFAAgF;AAChF,SAAS,cAAc,CAAC,KAAiB;IACvC,IAAI,KAAK,CAAC,IAAI,KAAK,UAAU;QAAE,OAAO,KAAK,KAAK,CAAC,QAAQ,EAAE,CAAC;IAC5D,IAAI,KAAK,CAAC,IAAI,KAAK,MAAM,IAAI,KAAK,CAAC,MAAM,KAAK,GAAG;QAAE,OAAO,KAAK,UAAU,CAAC,KAAK,CAAC,IAAI,CAAC,EAAE,CAAC;IACxF,OAAO,KAAK,CAAC;AACf,CAAC;AAED,SAAS,WAAW,CAAC,IAAkB,EAAE,KAAiB;IACxD,IAAI,UAAU,IAAI,IAAI;QAAE,OAAO,KAAK,CAAC,IAAI,KAAK,UAAU,IAAI,KAAK,CAAC,QAAQ,KAAK,IAAI,CAAC,QAAQ,CAAC;IAC7F,IAAI,SAAS,IAAI,IAAI;QAAE,OAAO,KAAK,CAAC,IAAI,KAAK,MAAM,IAAI,KAAK,CAAC,MAAM,KAAK,GAAG,CAAC;IAC5E,IAAI,KAAK,CAAC,IAAI,KAAK,MAAM,IAAI,KAAK,CAAC,MAAM,KAAK,GAAG;QAAE,OAAO,WAAW,CAAC,IAAI,CAAC,IAAI,CAAC,KAAK,KAAK,CAAC,IAAI,CAAC;IAChG,oFAAoF;IACpF,OAAO,KAAK,CAAC,IAAI,KAAK,UAAU,CAAC;AACnC,CAAC;AAED,oCAAoC;AACpC,MAAM,aAAa,GAAG,GAAG,CAAC;AAS1B;;;;;GAKG;AACH,MAAM,UAAU,eAAe,CAC7B,KAAuB,EACvB,aAA4B,EAC5B,SAAiB;IAEjB,MAAM,GAAG,GAAG,IAAI,GAAG,CAAC,KAAK,CAAC,CAAC;IAC3B,MAAM,MAAM,GAAG,CAAC,IAAY,EAAE,EAAE,CAAC,GAAG,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC;IAC/C,MAAM,UAAU,GAAG,IAAI,GAAG,EAAU,CAAC;IACrC,KAAK,MAAM,IAAI,IAAI,GAAG,EAAE,CAAC;QACvB,MAAM,OAAO,GAAG,IAAI,UAAU,CAAC,IAAI,CAAC,EAAE,CAAC;QACvC,IAAI,IAAI,CAAC,QAAQ,CAAC,aAAa,CAAC,EAAE,CAAC;YACjC,MAAM,GAAG,GAAG,OAAO,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC,YAAY,CAAC,MAAM,CAAC,CAAC;YACnD,UAAU,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC,GAAG,CAAC,GAAG,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC;QAC5C,CAAC;aAAM,IAAI,IAAI,CAAC,QAAQ,CAAC,OAAO,CAAC,EAAE,CAAC;YAClC,MAAM,IAAI,GAAG,OAAO,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC,OAAO,CAAC,MAAM,CAAC,CAAC;YAC/C,UAAU,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC,GAAG,CAAC,GAAG,IAAI,GAAG,CAAC,CAAC;QACvC,CAAC;aAAM,IAAI,CAAC,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,CAAE,CAAC,QAAQ,CAAC,GAAG,CAAC,EAAE,CAAC;YAClD,UAAU,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,GAAG,CAAC,GAAG,OAAO,GAAG,CAAC,CAAC;QAC7C,CAAC;IACH,CAAC;IAED,MAAM,OAAO,GAA2B,EAAE,CAAC;IAC3C,MAAM,OAAO,GAAa,EAAE,CAAC;IAC7B,KAAK,MAAM,GAAG,IAAI,CAAC,GAAG,UAAU,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC;QACzC,MAAM,IAAI,GAAG,WAAW,CAAC,GAAG,EAAE,aAAa,CAAC,CAAC;QAC7C,IAAI,IAAI,CAAC,GAAG,KAAK,SAAS;YAAE,SAAS;QACrC,MAAM,KAAK,GAAG,cAAc,CAAC,GAAG,EAAE,MAAM,EAAE,EAAE,aAAa,EAAE,CAAC,CAAC;QAC7D,IAAI,WAAW,CAAC,IAAI,EAAE,KAAK,CAAC;YAAE,SAAS;QACvC,IAAI,MAAM,CAAC,UAAU,CAAC,KAAK,SAAS,IAAI,IAAI,CAAC,GAAG,EAAE,CAAC,GAAG,aAAa,EAAE,CAAC;YACpE,OAAO,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;YAClB,SAAS;QACX,CAAC;QACD,OAAO,CAAC,IAAI,CAAC,GAAG,CAAC,GAAG,cAAc,CAAC,KAAK,CAAC,CAAC;IAC5C,CAAC;IACD,OAAO,EAAE,OAAO,EAAE,OAAO,EAAE,CAAC;AAC9B,CAAC"}

package/package.json

@@ -1,6 +1,62 @@
 {
   "name": "@staticforge/aws",
-  "version": "0.0.0-stage",
-  "stub": true,
-  "description": "Temporary package placeholder for staged publishing"
+  "version": "0.1.1",
+  "description": "AWS provider for staticforge: private S3 + CloudFront (OAC), KeyValueStore versions, previews",
+  "keywords": [
+    "staticforge",
+    "aws",
+    "s3",
+    "cloudfront",
+    "opentofu",
+    "terraform"
+  ],
+  "homepage": "https://github.com/elchanio-76/sforge#readme",
+  "bugs": {
+    "url": "https://github.com/elchanio-76/sforge/issues"
+  },
+  "repository": {
+    "type": "git",
+    "url": "git+https://github.com/elchanio-76/sforge.git",
+    "directory": "packages/providers/aws"
+  },
+  "license": "MIT",
+  "author": "Eleftherios Chaniotakis",
+  "type": "module",
+  "exports": {
+    ".": {
+      "@staticforge/source": "./src/index.ts",
+      "types": "./dist/index.d.ts",
+      "default": "./dist/index.js"
+    }
+  },
+  "files": [
+    "dist",
+    "terraform/**/*.tf",
+    "terraform/**/*.js",
+    "terraform/**/*.hcl",
+    "!terraform/**/.terraform.lock.hcl",
+    "!terraform/**/tests/**"
+  ],
+  "engines": {
+    "node": "^22.22.0 || >=24.8.0"
+  },
+  "publishConfig": {
+    "access": "public"
+  },
+  "dependencies": {
+    "@aws-sdk/client-cloudfront": "^3.1138.0",
+    "@aws-sdk/client-cloudfront-keyvaluestore": "^3.1138.0",
+    "@aws-sdk/client-iam": "^3.1138.0",
+    "@aws-sdk/client-s3": "^3.1138.0",
+    "@aws-sdk/client-sts": "^3.1138.0",
+    "@aws-sdk/signature-v4a": "^3.1138.0",
+    "@staticforge/core": "0.1.1",
+    "@staticforge/iac": "0.1.1",
+    "@staticforge/provider-api": "0.1.1",
+    "@staticforge/server": "0.1.1"
+  },
+  "devDependencies": {
+    "@smithy/util-stream": "^4.8.2",
+    "aws-sdk-client-mock": "^4.1.0"
+  }
 }