alchemy 2.0.0-beta.16 → 2.0.0-beta.18

package/bin/cli.js

@@ -21,24 +21,26 @@
 //
 // foreground-child forwards stdio + signals and exits with the child's code,
 // so the launcher is transparent to the invoking shell / npm script.
-import { existsSync } from "node:fs";
-import { createRequire } from "node:module";
+import { fileURLToPath } from "node:url";
 import path from "pathe";
 import { foregroundChild } from "foreground-child";
 
-const require = createRequire(import.meta.url);
-
 const execpath = (process.env.npm_execpath ?? "").toLowerCase();
 const userAgent = (process.env.npm_config_user_agent ?? "").toLowerCase();
 const invokedByBun = execpath.includes("bun") || userAgent.startsWith("bun/");
 
-const jsEntry = require.resolve("alchemy/bin/alchemy.js");
-const binDir = path.dirname(jsEntry);
+// Derive the bin dir from this launcher's own location rather than
+// require.resolve("alchemy/bin/alchemy.js"). The bundled alchemy.js is a
+// build artifact (tsdown output) and may not exist in a fresh checkout
+// (e.g. CI before `bun run build`); resolving it would throw
+// MODULE_NOT_FOUND before we get a chance to fall back to the .ts source.
+const binDir = path.dirname(fileURLToPath(import.meta.url));
+const jsEntry = path.join(binDir, "alchemy.js");
 const tsEntry = path.join(binDir, "alchemy.ts");
 
 // Treat any install-tree path as published; only a raw checkout uses .ts.
 const useTs = !(
-  jsEntry.includes("/node_modules/") || jsEntry.includes("\\node_modules\\")
+  binDir.includes("/node_modules/") || binDir.includes("\\node_modules\\")
 );
 
 // .ts only runs under bun. Force bun in dev even if node was the invoker.

package/bin/commands/deploy.ts

@@ -84,7 +84,14 @@ const execStack = Effect.fn(function* ({
       if (dryRun) {
         yield* cli.displayPlan(updatePlan);
       } else {
-        if (!yes) {
+        const hasChanges =
+          Object.keys(updatePlan.deletions).length > 0 ||
+          Object.values(updatePlan.resources).some(
+            (node) =>
+              node.action !== "noop" ||
+              node.bindings.some((b) => b.action !== "noop"),
+          );
+        if (!yes && hasChanges) {
           const approved = yield* cli.approvePlan(updatePlan);
           if (!approved) {
             return;
@@ -92,7 +99,9 @@ const execStack = Effect.fn(function* ({
         }
         const outputs = yield* apply(updatePlan);
 
-        yield* Console.log(outputs);
+        if (outputs !== undefined) {
+          yield* Console.log(outputs);
+        }
       }
     }).pipe(Effect.provide(stack.services));
   }).pipe(Effect.provide(services));

package/bin/commands/profile.ts

@@ -6,7 +6,9 @@ import * as Logger from "effect/Logger";
 import { Command } from "effect/unstable/cli";
 
 import { AuthProviders } from "../../src/Auth/AuthProvider.ts";
+import { deleteProfileCredentials } from "../../src/Auth/Credentials.ts";
 import {
+  deleteProfile,
   getProfile,
   readConfig,
   withProfileOverride,
@@ -81,6 +83,24 @@ const showCommand = Command.make(
   }),
 );
 
+const clearCommand = Command.make(
+  "clear",
+  { profile },
+  Effect.fnUntraced(function* ({ profile }) {
+    const removed = yield* deleteProfile(profile);
+    yield* deleteProfileCredentials(profile);
+    if (removed) {
+      yield* Console.log(
+        `Cleared profile '${profile}' and all its credentials.`,
+      );
+    } else {
+      yield* Console.log(
+        `Profile '${profile}' not found in profiles.json; removed any stray credentials directory.`,
+      );
+    }
+  }),
+);
+
 export const profileCommand = Command.make("profile", {}).pipe(
-  Command.withSubcommands([showCommand]),
+  Command.withSubcommands([showCommand, clearCommand]),
 );

package/bin/commands/state.ts

@@ -3,6 +3,7 @@ import * as Console from "effect/Console";
 import * as Effect from "effect/Effect";
 import * as Layer from "effect/Layer";
 import * as Logger from "effect/Logger";
+import * as Option from "effect/Option";
 import { Argument, Command, Flag } from "effect/unstable/cli";
 
 import { AuthProviders } from "../../src/Auth/AuthProvider.ts";
@@ -10,10 +11,11 @@ import { withProfileOverride } from "../../src/Auth/Profile.ts";
 import { Stage } from "../../src/Stage.ts";
 import * as State from "../../src/State/index.ts";
 import { encodeState } from "../../src/State/StateEncoding.ts";
+import * as Clank from "../../src/Util/Clank.ts";
 import { loadConfigProvider } from "../../src/Util/ConfigProvider.ts";
 import { fileLogger } from "../../src/Util/FileLogger.ts";
 
-import { envFile, importStack, main, profile, stage } from "./_shared.ts";
+import { envFile, importStack, main, profile, stage, yes } from "./_shared.ts";
 
 /**
  * When set, the State service is replaced with the on-disk
@@ -222,6 +224,93 @@ const treeCommand = Command.make(
   }),
 );
 
+const clearStackArg = Argument.string("stack").pipe(
+  Argument.withDescription(
+    "Stack name to clear. Omit to clear ALL stacks in the store.",
+  ),
+  Argument.optional,
+);
+
+const clearStageArg = Argument.string("stage").pipe(
+  Argument.withDescription(
+    "Stage to clear within the stack. Omit to clear all stages in the stack.",
+  ),
+  Argument.optional,
+);
+
+/**
+ * Destructive: removes resource state from the store. The actual cloud
+ * resources are NOT touched — this only affects what alchemy thinks
+ * exists. Always confirms before deleting unless `--yes` is passed.
+ */
+const clearCommand = Command.make(
+  "clear",
+  {
+    stack: clearStackArg,
+    stageName: clearStageArg,
+    main,
+    envFile,
+    stage,
+    profile,
+    local: localFlag,
+    yes,
+  },
+  Effect.fnUntraced(function* ({ stack: stackOpt, stageName: stageOpt, yes: yesFlag, ...rest }) {
+    const stackName = Option.getOrUndefined(stackOpt);
+    const stageName = Option.getOrUndefined(stageOpt);
+
+    if (stageName !== undefined && stackName === undefined) {
+      yield* Console.log(
+        "Error: cannot specify <stage> without <stack>. Pass the stack name as the first argument.",
+      );
+      return yield* Effect.fail(new Error("missing stack"));
+    }
+
+    yield* withStateService(rest, (state) =>
+      Effect.gen(function* () {
+        const targets: ReadonlyArray<{ stack: string; stage?: string }> =
+          stackName === undefined
+            ? [...(yield* state.listStacks())]
+                .sort()
+                .map((s) => ({ stack: s }))
+            : stageName === undefined
+              ? [{ stack: stackName }]
+              : [{ stack: stackName, stage: stageName }];
+
+        if (targets.length === 0) {
+          yield* Console.log("(nothing to clear)");
+          return;
+        }
+
+        const scope =
+          stackName === undefined
+            ? `ALL stacks (${targets.length}): ${targets.map((t) => t.stack).join(", ")}`
+            : stageName === undefined
+              ? `stack '${stackName}' (all stages)`
+              : `stage '${stageName}' in stack '${stackName}'`;
+
+        if (!yesFlag) {
+          const ok = yield* Clank.confirm({
+            message: `About to delete ${scope} from the state store. This cannot be undone. Continue?`,
+            initialValue: false,
+          });
+          if (!ok) {
+            yield* Console.log("Cancelled.");
+            return;
+          }
+        }
+
+        for (const target of targets) {
+          yield* state.deleteStack(target);
+          yield* Console.log(
+            `cleared ${target.stack}${target.stage ? `/${target.stage}` : ""}`,
+          );
+        }
+      }),
+    );
+  }),
+);
+
 export const stateCommand = Command.make("state", {}).pipe(
   Command.withSubcommands([
     stacksCommand,
@@ -229,5 +318,6 @@ export const stateCommand = Command.make("state", {}).pipe(
     resourcesCommand,
     getCommand,
     treeCommand,
+    clearCommand,
   ]),
 );

package/lib/AWS/CloudFront/CachePolicy.d.ts

@@ -0,0 +1,106 @@
+import * as cloudfront from "@distilled.cloud/aws/cloudfront";
+import * as Provider from "../../Provider.ts";
+import { Resource } from "../../Resource.ts";
+import type { Providers } from "../Providers.ts";
+export interface CachePolicyProps {
+    /**
+     * Name of the cache policy. If omitted, a deterministic name is generated.
+     *
+     * Names must be unique per AWS account. Changing the name triggers
+     * a replacement.
+     */
+    name?: string;
+    /**
+     * Optional comment describing the policy.
+     */
+    comment?: string;
+    /**
+     * Minimum amount of time, in seconds, that objects stay in the cache.
+     */
+    minTTL: number;
+    /**
+     * Default amount of time, in seconds, that objects stay in the cache when
+     * the origin does not send `Cache-Control` or `Expires` headers.
+     */
+    defaultTTL?: number;
+    /**
+     * Maximum amount of time, in seconds, that objects stay in the cache.
+     */
+    maxTTL?: number;
+    /**
+     * Controls which request values become part of the cache key and which
+     * additional headers/cookies/query strings CloudFront forwards to the origin.
+     */
+    parametersInCacheKeyAndForwardedToOrigin?: cloudfront.ParametersInCacheKeyAndForwardedToOrigin;
+}
+export interface CachePolicy extends Resource<"AWS.CloudFront.CachePolicy", CachePolicyProps, {
+    /**
+     * CloudFront-assigned cache policy identifier.
+     */
+    cachePolicyId: string;
+    /**
+     * Name of the cache policy.
+     */
+    name: string;
+    /**
+     * Most recent entity tag for update/delete operations.
+     */
+    etag: string | undefined;
+    /**
+     * Current comment on the policy.
+     */
+    comment: string | undefined;
+    /**
+     * Current minimum TTL.
+     */
+    minTTL: number;
+    /**
+     * Current default TTL.
+     */
+    defaultTTL: number | undefined;
+    /**
+     * Current maximum TTL.
+     */
+    maxTTL: number | undefined;
+    /**
+     * Current cache-key/forwarded-value configuration.
+     */
+    parametersInCacheKeyAndForwardedToOrigin: cloudfront.ParametersInCacheKeyAndForwardedToOrigin | undefined;
+}, never, Providers> {
+}
+/**
+ * A CloudFront cache policy.
+ *
+ * Cache policies determine the values CloudFront includes in the cache key,
+ * the headers, cookies and query strings it forwards to the origin, and the
+ * TTL bounds for cached responses. Policies are referenced by ID on a
+ * Distribution's default behavior or per-path cache behaviors.
+ *
+ * For AWS-managed policies (CachingOptimized, CachingDisabled,
+ * AllViewerExceptHostHeader) reference them by ID via the constants in
+ * {@link ManagedPolicies} instead of creating a custom policy.
+ *
+ * @section Creating Cache Policies
+ * @example Cache by query string and Authorization header
+ * ```typescript
+ * const cachePolicy = yield* CachePolicy("ApiCachePolicy", {
+ *   comment: "Cache GETs by query string + Authorization",
+ *   minTTL: 0,
+ *   defaultTTL: 60,
+ *   maxTTL: 3600,
+ *   parametersInCacheKeyAndForwardedToOrigin: {
+ *     EnableAcceptEncodingGzip: true,
+ *     EnableAcceptEncodingBrotli: true,
+ *     HeadersConfig: {
+ *       HeaderBehavior: "whitelist",
+ *       Headers: { Quantity: 1, Items: ["Authorization"] },
+ *     },
+ *     CookiesConfig: { CookieBehavior: "none" },
+ *     QueryStringsConfig: { QueryStringBehavior: "all" },
+ *   },
+ * });
+ * ```
+ */
+export declare const CachePolicy: import("../../Resource.ts").ResourceClass<CachePolicy>;
+export declare const CachePolicyProvider: () => import("effect/Layer").Layer<Provider.Provider<CachePolicy>, never, import("effect/unstable/http/HttpClient").HttpClient | import("../../Stage.ts").Stage | import("../../Stack.ts").Stack | import("@distilled.cloud/aws/Region").Region | import("@distilled.cloud/aws/Credentials").Credentials>;
+//# sourceMappingURL=CachePolicy.d.ts.map

package/lib/AWS/CloudFront/CachePolicy.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"CachePolicy.d.ts","sourceRoot":"","sources":["../../../src/AWS/CloudFront/CachePolicy.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,UAAU,MAAM,iCAAiC,CAAC;AAI9D,OAAO,KAAK,QAAQ,MAAM,mBAAmB,CAAC;AAC9C,OAAO,EAAE,QAAQ,EAAE,MAAM,mBAAmB,CAAC;AAC7C,OAAO,KAAK,EAAE,SAAS,EAAE,MAAM,iBAAiB,CAAC;AAEjD,MAAM,WAAW,gBAAgB;IAC/B;;;;;OAKG;IACH,IAAI,CAAC,EAAE,MAAM,CAAC;IACd;;OAEG;IACH,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB;;OAEG;IACH,MAAM,EAAE,MAAM,CAAC;IACf;;;OAGG;IACH,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB;;OAEG;IACH,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB;;;OAGG;IACH,wCAAwC,CAAC,EAAE,UAAU,CAAC,wCAAwC,CAAC;CAChG;AAED,MAAM,WAAW,WAAY,SAAQ,QAAQ,CAC3C,4BAA4B,EAC5B,gBAAgB,EAChB;IACE;;OAEG;IACH,aAAa,EAAE,MAAM,CAAC;IACtB;;OAEG;IACH,IAAI,EAAE,MAAM,CAAC;IACb;;OAEG;IACH,IAAI,EAAE,MAAM,GAAG,SAAS,CAAC;IACzB;;OAEG;IACH,OAAO,EAAE,MAAM,GAAG,SAAS,CAAC;IAC5B;;OAEG;IACH,MAAM,EAAE,MAAM,CAAC;IACf;;OAEG;IACH,UAAU,EAAE,MAAM,GAAG,SAAS,CAAC;IAC/B;;OAEG;IACH,MAAM,EAAE,MAAM,GAAG,SAAS,CAAC;IAC3B;;OAEG;IACH,wCAAwC,EACpC,UAAU,CAAC,wCAAwC,GACnD,SAAS,CAAC;CACf,EACD,KAAK,EACL,SAAS,CACV;CAAG;AAEJ;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAgCG;AACH,eAAO,MAAM,WAAW,wDAAsD,CAAC;AAE/E,eAAO,MAAM,mBAAmB,2SAmJ7B,CAAC"}

package/lib/AWS/CloudFront/CachePolicy.js

@@ -0,0 +1,147 @@
+import * as cloudfront from "@distilled.cloud/aws/cloudfront";
+import * as Effect from "effect/Effect";
+import { isResolved } from "../../Diff.js";
+import { createPhysicalName } from "../../PhysicalName.js";
+import * as Provider from "../../Provider.js";
+import { Resource } from "../../Resource.js";
+/**
+ * A CloudFront cache policy.
+ *
+ * Cache policies determine the values CloudFront includes in the cache key,
+ * the headers, cookies and query strings it forwards to the origin, and the
+ * TTL bounds for cached responses. Policies are referenced by ID on a
+ * Distribution's default behavior or per-path cache behaviors.
+ *
+ * For AWS-managed policies (CachingOptimized, CachingDisabled,
+ * AllViewerExceptHostHeader) reference them by ID via the constants in
+ * {@link ManagedPolicies} instead of creating a custom policy.
+ *
+ * @section Creating Cache Policies
+ * @example Cache by query string and Authorization header
+ * ```typescript
+ * const cachePolicy = yield* CachePolicy("ApiCachePolicy", {
+ *   comment: "Cache GETs by query string + Authorization",
+ *   minTTL: 0,
+ *   defaultTTL: 60,
+ *   maxTTL: 3600,
+ *   parametersInCacheKeyAndForwardedToOrigin: {
+ *     EnableAcceptEncodingGzip: true,
+ *     EnableAcceptEncodingBrotli: true,
+ *     HeadersConfig: {
+ *       HeaderBehavior: "whitelist",
+ *       Headers: { Quantity: 1, Items: ["Authorization"] },
+ *     },
+ *     CookiesConfig: { CookieBehavior: "none" },
+ *     QueryStringsConfig: { QueryStringBehavior: "all" },
+ *   },
+ * });
+ * ```
+ */
+export const CachePolicy = Resource("AWS.CloudFront.CachePolicy");
+export const CachePolicyProvider = () => Provider.effect(CachePolicy, Effect.gen(function* () {
+    const getById = Effect.fn(function* (id) {
+        const config = yield* cloudfront
+            .getCachePolicyConfig({ Id: id })
+            .pipe(Effect.catchTag("NoSuchCachePolicy", () => Effect.succeed(undefined)));
+        if (!config?.CachePolicyConfig)
+            return undefined;
+        return { config: config.CachePolicyConfig, etag: config.ETag };
+    });
+    const getByName = Effect.fn(function* (name) {
+        const listed = yield* cloudfront.listCachePolicies({ Type: "custom" });
+        const summary = listed.CachePolicyList?.Items?.find((item) => item.CachePolicy?.CachePolicyConfig?.Name === name);
+        if (!summary?.CachePolicy?.Id)
+            return undefined;
+        return yield* getById(summary.CachePolicy.Id).pipe(Effect.map((found) => found ? { id: summary.CachePolicy.Id, ...found } : undefined));
+    });
+    const buildConfig = (name, props) => ({
+        Name: name,
+        Comment: props.comment,
+        MinTTL: props.minTTL,
+        DefaultTTL: props.defaultTTL,
+        MaxTTL: props.maxTTL,
+        ParametersInCacheKeyAndForwardedToOrigin: props.parametersInCacheKeyAndForwardedToOrigin,
+    });
+    const toAttrs = (id, config, etag) => ({
+        cachePolicyId: id,
+        name: config.Name,
+        etag,
+        comment: config.Comment,
+        minTTL: config.MinTTL,
+        defaultTTL: config.DefaultTTL,
+        maxTTL: config.MaxTTL,
+        parametersInCacheKeyAndForwardedToOrigin: config.ParametersInCacheKeyAndForwardedToOrigin,
+    });
+    return {
+        stables: ["cachePolicyId"],
+        diff: Effect.fn(function* ({ id, news, olds }) {
+            if (!isResolved(news))
+                return undefined;
+            if ((yield* createName(id, olds ?? {})) !==
+                (yield* createName(id, news))) {
+                return { action: "replace" };
+            }
+        }),
+        read: Effect.fn(function* ({ id, olds, output }) {
+            if (output?.cachePolicyId) {
+                const found = yield* getById(output.cachePolicyId);
+                if (found)
+                    return toAttrs(output.cachePolicyId, found.config, found.etag);
+            }
+            const name = yield* createName(id, olds ?? {});
+            const found = yield* getByName(name);
+            if (!found)
+                return undefined;
+            return toAttrs(found.id, found.config, found.etag);
+        }),
+        create: Effect.fn(function* ({ id, news, session }) {
+            const name = yield* createName(id, news);
+            const created = yield* cloudfront
+                .createCachePolicy({ CachePolicyConfig: buildConfig(name, news) })
+                .pipe(Effect.catchTag("CachePolicyAlreadyExists", () => getByName(name).pipe(Effect.flatMap((existing) => existing
+                ? Effect.succeed({
+                    CachePolicy: {
+                        Id: existing.id,
+                        LastModifiedTime: new Date(),
+                        CachePolicyConfig: existing.config,
+                    },
+                    ETag: existing.etag,
+                    Location: undefined,
+                })
+                : Effect.fail(new Error(`Cache policy '${name}' already exists but could not be recovered`))))));
+            if (!created.CachePolicy?.Id) {
+                return yield* Effect.fail(new Error("createCachePolicy returned no identifier"));
+            }
+            yield* session.note(created.CachePolicy.Id);
+            return toAttrs(created.CachePolicy.Id, created.CachePolicy.CachePolicyConfig, created.ETag);
+        }),
+        update: Effect.fn(function* ({ news, output, session }) {
+            const current = yield* getById(output.cachePolicyId);
+            const updated = yield* cloudfront.updateCachePolicy({
+                Id: output.cachePolicyId,
+                IfMatch: current?.etag ?? output.etag,
+                CachePolicyConfig: buildConfig(output.name, news),
+            });
+            if (!updated.CachePolicy?.Id) {
+                return yield* Effect.fail(new Error("updateCachePolicy returned no identifier"));
+            }
+            yield* session.note(output.cachePolicyId);
+            return toAttrs(updated.CachePolicy.Id, updated.CachePolicy.CachePolicyConfig, updated.ETag);
+        }),
+        delete: Effect.fn(function* ({ output }) {
+            const current = yield* getById(output.cachePolicyId);
+            if (!current)
+                return;
+            yield* cloudfront
+                .deleteCachePolicy({
+                Id: output.cachePolicyId,
+                IfMatch: current.etag,
+            })
+                .pipe(Effect.catchTag("NoSuchCachePolicy", () => Effect.void));
+        }),
+    };
+}));
+const createName = (id, props) => props.name
+    ? Effect.succeed(props.name)
+    : createPhysicalName({ id, maxLength: 128, lowercase: true });
+//# sourceMappingURL=CachePolicy.js.map

package/lib/AWS/CloudFront/CachePolicy.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"CachePolicy.js","sourceRoot":"","sources":["../../../src/AWS/CloudFront/CachePolicy.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,UAAU,MAAM,iCAAiC,CAAC;AAC9D,OAAO,KAAK,MAAM,MAAM,eAAe,CAAC;AACxC,OAAO,EAAE,UAAU,EAAE,MAAM,eAAe,CAAC;AAC3C,OAAO,EAAE,kBAAkB,EAAE,MAAM,uBAAuB,CAAC;AAC3D,OAAO,KAAK,QAAQ,MAAM,mBAAmB,CAAC;AAC9C,OAAO,EAAE,QAAQ,EAAE,MAAM,mBAAmB,CAAC;AA8E7C;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAgCG;AACH,MAAM,CAAC,MAAM,WAAW,GAAG,QAAQ,CAAc,4BAA4B,CAAC,CAAC;AAE/E,MAAM,CAAC,MAAM,mBAAmB,GAAG,GAAG,EAAE,CACtC,QAAQ,CAAC,MAAM,CACb,WAAW,EACX,MAAM,CAAC,GAAG,CAAC,QAAQ,CAAC;IAClB,MAAM,OAAO,GAAG,MAAM,CAAC,EAAE,CAAC,QAAQ,CAAC,EAAE,EAAU;QAC7C,MAAM,MAAM,GAAG,KAAK,CAAC,CAAC,UAAU;aAC7B,oBAAoB,CAAC,EAAE,EAAE,EAAE,EAAE,EAAE,CAAC;aAChC,IAAI,CACH,MAAM,CAAC,QAAQ,CAAC,mBAAmB,EAAE,GAAG,EAAE,CAAC,MAAM,CAAC,OAAO,CAAC,SAAS,CAAC,CAAC,CACtE,CAAC;QACJ,IAAI,CAAC,MAAM,EAAE,iBAAiB;YAAE,OAAO,SAAS,CAAC;QACjD,OAAO,EAAE,MAAM,EAAE,MAAM,CAAC,iBAAiB,EAAE,IAAI,EAAE,MAAM,CAAC,IAAI,EAAE,CAAC;IACjE,CAAC,CAAC,CAAC;IAEH,MAAM,SAAS,GAAG,MAAM,CAAC,EAAE,CAAC,QAAQ,CAAC,EAAE,IAAY;QACjD,MAAM,MAAM,GAAG,KAAK,CAAC,CAAC,UAAU,CAAC,iBAAiB,CAAC,EAAE,IAAI,EAAE,QAAQ,EAAE,CAAC,CAAC;QACvE,MAAM,OAAO,GAAG,MAAM,CAAC,eAAe,EAAE,KAAK,EAAE,IAAI,CACjD,CAAC,IAAI,EAAE,EAAE,CAAC,IAAI,CAAC,WAAW,EAAE,iBAAiB,EAAE,IAAI,KAAK,IAAI,CAC7D,CAAC;QACF,IAAI,CAAC,OAAO,EAAE,WAAW,EAAE,EAAE;YAAE,OAAO,SAAS,CAAC;QAChD,OAAO,KAAK,CAAC,CAAC,OAAO,CAAC,OAAO,CAAC,WAAW,CAAC,EAAE,CAAC,CAAC,IAAI,CAChD,MAAM,CAAC,GAAG,CAAC,CAAC,KAAK,EAAE,EAAE,CACnB,KAAK,CAAC,CAAC,CAAC,EAAE,EAAE,EAAE,OAAO,CAAC,WAAW,CAAC,EAAE,EAAE,GAAG,KAAK,EAAE,CAAC,CAAC,CAAC,SAAS,CAC7D,CACF,CAAC;IACJ,CAAC,CAAC,CAAC;IAEH,MAAM,WAAW,GAAG,CAClB,IAAY,EACZ,KAAuB,EACO,EAAE,CAAC,CAAC;QAClC,IAAI,EAAE,IAAI;QACV,OAAO,EAAE,KAAK,CAAC,OAAO;QACtB,MAAM,EAAE,KAAK,CAAC,MAAM;QACpB,UAAU,EAAE,KAAK,CAAC,UAAU;QAC5B,MAAM,EAAE,KAAK,CAAC,MAAM;QACpB,wCAAwC,EACtC,KAAK,CAAC,wCAAwC;KACjD,CAAC,CAAC;IAEH,MAAM,OAAO,GAAG,CACd,EAAU,EACV,MAAoC,EACpC,IAAwB,EACxB,EAAE,CAAC,CAAC;QACJ,aAAa,EAAE,EAAE;QACjB,IAAI,EAAE,MAAM,CAAC,IAAI;QACjB,IAAI;QACJ,OAAO,EAAE,MAAM,CAAC,OAAO;QACvB,MAAM,EAAE,MAAM,CAAC,MAAM;QACrB,UAAU,EAAE,MAAM,CAAC,UAAU;QAC7B,MAAM,EAAE,MAAM,CAAC,MAAM;QACrB,wCAAwC,EACtC,MAAM,CAAC,wCAAwC;KAClD,CAAC,CAAC;IAEH,OAAO;QACL,OAAO,EAAE,CAAC,eAAe,CAAC;QAC1B,IAAI,EAAE,MAAM,CAAC,EAAE,CAAC,QAAQ,CAAC,EAAE,EAAE,EAAE,EAAE,IAAI,EAAE,IAAI,EAAE;YAC3C,IAAI,CAAC,UAAU,CAAC,IAAI,CAAC;gBAAE,OAAO,SAAS,CAAC;YACxC,IACE,CAAC,KAAK,CAAC,CAAC,UAAU,CAAC,EAAE,EAAE,IAAI,IAAI,EAAE,CAAC,CAAC;gBACnC,CAAC,KAAK,CAAC,CAAC,UAAU,CAAC,EAAE,EAAE,IAAI,CAAC,CAAC,EAC7B,CAAC;gBACD,OAAO,EAAE,MAAM,EAAE,SAAS,EAAW,CAAC;YACxC,CAAC;QACH,CAAC,CAAC;QACF,IAAI,EAAE,MAAM,CAAC,EAAE,CAAC,QAAQ,CAAC,EAAE,EAAE,EAAE,EAAE,IAAI,EAAE,MAAM,EAAE;YAC7C,IAAI,MAAM,EAAE,aAAa,EAAE,CAAC;gBAC1B,MAAM,KAAK,GAAG,KAAK,CAAC,CAAC,OAAO,CAAC,MAAM,CAAC,aAAa,CAAC,CAAC;gBACnD,IAAI,KAAK;oBAAE,OAAO,OAAO,CAAC,MAAM,CAAC,aAAa,EAAE,KAAK,CAAC,MAAM,EAAE,KAAK,CAAC,IAAI,CAAC,CAAC;YAC5E,CAAC;YACD,MAAM,IAAI,GAAG,KAAK,CAAC,CAAC,UAAU,CAAC,EAAE,EAAE,IAAI,IAAI,EAAE,CAAC,CAAC;YAC/C,MAAM,KAAK,GAAG,KAAK,CAAC,CAAC,SAAS,CAAC,IAAI,CAAC,CAAC;YACrC,IAAI,CAAC,KAAK;gBAAE,OAAO,SAAS,CAAC;YAC7B,OAAO,OAAO,CAAC,KAAK,CAAC,EAAE,EAAE,KAAK,CAAC,MAAM,EAAE,KAAK,CAAC,IAAI,CAAC,CAAC;QACrD,CAAC,CAAC;QACF,MAAM,EAAE,MAAM,CAAC,EAAE,CAAC,QAAQ,CAAC,EAAE,EAAE,EAAE,EAAE,IAAI,EAAE,OAAO,EAAE;YAChD,MAAM,IAAI,GAAG,KAAK,CAAC,CAAC,UAAU,CAAC,EAAE,EAAE,IAAI,CAAC,CAAC;YACzC,MAAM,OAAO,GAAG,KAAK,CAAC,CAAC,UAAU;iBAC9B,iBAAiB,CAAC,EAAE,iBAAiB,EAAE,WAAW,CAAC,IAAI,EAAE,IAAI,CAAC,EAAE,CAAC;iBACjE,IAAI,CACH,MAAM,CAAC,QAAQ,CAAC,0BAA0B,EAAE,GAAG,EAAE,CAC/C,SAAS,CAAC,IAAI,CAAC,CAAC,IAAI,CAClB,MAAM,CAAC,OAAO,CAAC,CAAC,QAAQ,EAAE,EAAE,CAC1B,QAAQ;gBACN,CAAC,CAAC,MAAM,CAAC,OAAO,CAAC;oBACb,WAAW,EAAE;wBACX,EAAE,EAAE,QAAQ,CAAC,EAAE;wBACf,gBAAgB,EAAE,IAAI,IAAI,EAAE;wBAC5B,iBAAiB,EAAE,QAAQ,CAAC,MAAM;qBACnC;oBACD,IAAI,EAAE,QAAQ,CAAC,IAAI;oBACnB,QAAQ,EAAE,SAAS;iBACpB,CAAC;gBACJ,CAAC,CAAC,MAAM,CAAC,IAAI,CACT,IAAI,KAAK,CACP,iBAAiB,IAAI,6CAA6C,CACnE,CACF,CACN,CACF,CACF,CACF,CAAC;YACJ,IAAI,CAAC,OAAO,CAAC,WAAW,EAAE,EAAE,EAAE,CAAC;gBAC7B,OAAO,KAAK,CAAC,CAAC,MAAM,CAAC,IAAI,CACvB,IAAI,KAAK,CAAC,0CAA0C,CAAC,CACtD,CAAC;YACJ,CAAC;YACD,KAAK,CAAC,CAAC,OAAO,CAAC,IAAI,CAAC,OAAO,CAAC,WAAW,CAAC,EAAE,CAAC,CAAC;YAC5C,OAAO,OAAO,CACZ,OAAO,CAAC,WAAW,CAAC,EAAE,EACtB,OAAO,CAAC,WAAW,CAAC,iBAAiB,EACrC,OAAO,CAAC,IAAI,CACb,CAAC;QACJ,CAAC,CAAC;QACF,MAAM,EAAE,MAAM,CAAC,EAAE,CAAC,QAAQ,CAAC,EAAE,EAAE,IAAI,EAAE,MAAM,EAAE,OAAO,EAAE;YACpD,MAAM,OAAO,GAAG,KAAK,CAAC,CAAC,OAAO,CAAC,MAAM,CAAC,aAAa,CAAC,CAAC;YACrD,MAAM,OAAO,GAAG,KAAK,CAAC,CAAC,UAAU,CAAC,iBAAiB,CAAC;gBAClD,EAAE,EAAE,MAAM,CAAC,aAAa;gBACxB,OAAO,EAAE,OAAO,EAAE,IAAI,IAAI,MAAM,CAAC,IAAI;gBACrC,iBAAiB,EAAE,WAAW,CAAC,MAAM,CAAC,IAAI,EAAE,IAAI,CAAC;aAClD,CAAC,CAAC;YACH,IAAI,CAAC,OAAO,CAAC,WAAW,EAAE,EAAE,EAAE,CAAC;gBAC7B,OAAO,KAAK,CAAC,CAAC,MAAM,CAAC,IAAI,CACvB,IAAI,KAAK,CAAC,0CAA0C,CAAC,CACtD,CAAC;YACJ,CAAC;YACD,KAAK,CAAC,CAAC,OAAO,CAAC,IAAI,CAAC,MAAM,CAAC,aAAa,CAAC,CAAC;YAC1C,OAAO,OAAO,CACZ,OAAO,CAAC,WAAW,CAAC,EAAE,EACtB,OAAO,CAAC,WAAW,CAAC,iBAAiB,EACrC,OAAO,CAAC,IAAI,CACb,CAAC;QACJ,CAAC,CAAC;QACF,MAAM,EAAE,MAAM,CAAC,EAAE,CAAC,QAAQ,CAAC,EAAE,EAAE,MAAM,EAAE;YACrC,MAAM,OAAO,GAAG,KAAK,CAAC,CAAC,OAAO,CAAC,MAAM,CAAC,aAAa,CAAC,CAAC;YACrD,IAAI,CAAC,OAAO;gBAAE,OAAO;YACrB,KAAK,CAAC,CAAC,UAAU;iBACd,iBAAiB,CAAC;gBACjB,EAAE,EAAE,MAAM,CAAC,aAAa;gBACxB,OAAO,EAAE,OAAO,CAAC,IAAI;aACtB,CAAC;iBACD,IAAI,CAAC,MAAM,CAAC,QAAQ,CAAC,mBAAmB,EAAE,GAAG,EAAE,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC,CAAC;QACnE,CAAC,CAAC;KACH,CAAC;AACJ,CAAC,CAAC,CACH,CAAC;AAEJ,MAAM,UAAU,GAAG,CAAC,EAAU,EAAE,KAAuB,EAAE,EAAE,CACzD,KAAK,CAAC,IAAI;IACR,CAAC,CAAC,MAAM,CAAC,OAAO,CAAC,KAAK,CAAC,IAAI,CAAC;IAC5B,CAAC,CAAC,kBAAkB,CAAC,EAAE,EAAE,EAAE,SAAS,EAAE,GAAG,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAC"}

package/lib/AWS/CloudFront/KeyGroup.d.ts

@@ -0,0 +1,72 @@
+import type { Input } from "../../Input.ts";
+import * as Provider from "../../Provider.ts";
+import { Resource } from "../../Resource.ts";
+import type { Providers } from "../Providers.ts";
+export interface KeyGroupProps {
+    /**
+     * Name of the key group. If omitted, a deterministic name is generated.
+     *
+     * Names must be unique per AWS account. Changing the name triggers
+     * a replacement.
+     */
+    name?: string;
+    /**
+     * Public key IDs that belong to the group. Order is preserved.
+     */
+    items: Input<string>[];
+    /**
+     * Optional comment describing the group.
+     */
+    comment?: string;
+}
+export interface KeyGroup extends Resource<"AWS.CloudFront.KeyGroup", KeyGroupProps, {
+    /**
+     * CloudFront-assigned key group identifier. Used by Distributions in
+     * `TrustedKeyGroups` to authorize signed URLs/cookies.
+     */
+    keyGroupId: string;
+    /**
+     * Name of the key group.
+     */
+    name: string;
+    /**
+     * Public key IDs that belong to the group.
+     */
+    items: string[];
+    /**
+     * Most recent entity tag for update/delete operations.
+     */
+    etag: string | undefined;
+    /**
+     * Current comment on the group.
+     */
+    comment: string | undefined;
+}, never, Providers> {
+}
+/**
+ * A CloudFront key group.
+ *
+ * Key groups bundle one or more {@link PublicKey} resources for use as
+ * `TrustedKeyGroups` on a Distribution's cache behavior. CloudFront uses
+ * the keys in the group to verify the signatures on signed URLs and
+ * signed cookies for that behavior.
+ *
+ * @section Creating Key Groups
+ * @example Group two public keys for signed URL verification
+ * ```typescript
+ * const primary = yield* PublicKey("PrimarySigningKey", {
+ *   encodedKey: yield* fs.readFileString("./primary.pem"),
+ * });
+ * const secondary = yield* PublicKey("SecondarySigningKey", {
+ *   encodedKey: yield* fs.readFileString("./secondary.pem"),
+ * });
+ *
+ * const keyGroup = yield* KeyGroup("SignedUrlKeys", {
+ *   comment: "Trusted signers for /private",
+ *   items: [primary.publicKeyId, secondary.publicKeyId],
+ * });
+ * ```
+ */
+export declare const KeyGroup: import("../../Resource.ts").ResourceClass<KeyGroup>;
+export declare const KeyGroupProvider: () => import("effect/Layer").Layer<Provider.Provider<KeyGroup>, never, import("effect/unstable/http/HttpClient").HttpClient | import("../../Stage.ts").Stage | import("../../Stack.ts").Stack | import("@distilled.cloud/aws/Region").Region | import("@distilled.cloud/aws/Credentials").Credentials>;
+//# sourceMappingURL=KeyGroup.d.ts.map

package/lib/AWS/CloudFront/KeyGroup.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"KeyGroup.d.ts","sourceRoot":"","sources":["../../../src/AWS/CloudFront/KeyGroup.ts"],"names":[],"mappings":"AAGA,OAAO,KAAK,EAAE,KAAK,EAAE,MAAM,gBAAgB,CAAC;AAE5C,OAAO,KAAK,QAAQ,MAAM,mBAAmB,CAAC;AAC9C,OAAO,EAAE,QAAQ,EAAE,MAAM,mBAAmB,CAAC;AAC7C,OAAO,KAAK,EAAE,SAAS,EAAE,MAAM,iBAAiB,CAAC;AAEjD,MAAM,WAAW,aAAa;IAC5B;;;;;OAKG;IACH,IAAI,CAAC,EAAE,MAAM,CAAC;IACd;;OAEG;IACH,KAAK,EAAE,KAAK,CAAC,MAAM,CAAC,EAAE,CAAC;IACvB;;OAEG;IACH,OAAO,CAAC,EAAE,MAAM,CAAC;CAClB;AAED,MAAM,WAAW,QAAS,SAAQ,QAAQ,CACxC,yBAAyB,EACzB,aAAa,EACb;IACE;;;OAGG;IACH,UAAU,EAAE,MAAM,CAAC;IACnB;;OAEG;IACH,IAAI,EAAE,MAAM,CAAC;IACb;;OAEG;IACH,KAAK,EAAE,MAAM,EAAE,CAAC;IAChB;;OAEG;IACH,IAAI,EAAE,MAAM,GAAG,SAAS,CAAC;IACzB;;OAEG;IACH,OAAO,EAAE,MAAM,GAAG,SAAS,CAAC;CAC7B,EACD,KAAK,EACL,SAAS,CACV;CAAG;AAEJ;;;;;;;;;;;;;;;;;;;;;;;GAuBG;AACH,eAAO,MAAM,QAAQ,qDAAgD,CAAC;AAEtE,eAAO,MAAM,gBAAgB,wSAgJ1B,CAAC"}