alchemy 2.0.0-beta.16 → 2.0.0-beta.18

package/lib/AWS/CloudFront/KeyGroup.js

@@ -0,0 +1,136 @@
+import * as cloudfront from "@distilled.cloud/aws/cloudfront";
+import * as Effect from "effect/Effect";
+import { isResolved } from "../../Diff.js";
+import { createPhysicalName } from "../../PhysicalName.js";
+import * as Provider from "../../Provider.js";
+import { Resource } from "../../Resource.js";
+/**
+ * A CloudFront key group.
+ *
+ * Key groups bundle one or more {@link PublicKey} resources for use as
+ * `TrustedKeyGroups` on a Distribution's cache behavior. CloudFront uses
+ * the keys in the group to verify the signatures on signed URLs and
+ * signed cookies for that behavior.
+ *
+ * @section Creating Key Groups
+ * @example Group two public keys for signed URL verification
+ * ```typescript
+ * const primary = yield* PublicKey("PrimarySigningKey", {
+ *   encodedKey: yield* fs.readFileString("./primary.pem"),
+ * });
+ * const secondary = yield* PublicKey("SecondarySigningKey", {
+ *   encodedKey: yield* fs.readFileString("./secondary.pem"),
+ * });
+ *
+ * const keyGroup = yield* KeyGroup("SignedUrlKeys", {
+ *   comment: "Trusted signers for /private",
+ *   items: [primary.publicKeyId, secondary.publicKeyId],
+ * });
+ * ```
+ */
+export const KeyGroup = Resource("AWS.CloudFront.KeyGroup");
+export const KeyGroupProvider = () => Provider.effect(KeyGroup, Effect.gen(function* () {
+    const getById = Effect.fn(function* (id) {
+        const config = yield* cloudfront
+            .getKeyGroupConfig({ Id: id })
+            .pipe(Effect.catchTag("NoSuchResource", () => Effect.succeed(undefined)));
+        if (!config?.KeyGroupConfig)
+            return undefined;
+        return { config: config.KeyGroupConfig, etag: config.ETag };
+    });
+    const getByName = Effect.fn(function* (name) {
+        const listed = yield* cloudfront.listKeyGroups({});
+        const summary = listed.KeyGroupList?.Items?.find((item) => item.KeyGroup?.KeyGroupConfig?.Name === name);
+        if (!summary?.KeyGroup?.Id)
+            return undefined;
+        return yield* getById(summary.KeyGroup.Id).pipe(Effect.map((found) => found ? { id: summary.KeyGroup.Id, ...found } : undefined));
+    });
+    const buildConfig = (name, items, comment) => ({
+        Name: name,
+        Items: items,
+        Comment: comment,
+    });
+    const toAttrs = (id, config, etag) => ({
+        keyGroupId: id,
+        name: config.Name,
+        items: config.Items,
+        etag,
+        comment: config.Comment,
+    });
+    return {
+        stables: ["keyGroupId"],
+        diff: Effect.fn(function* ({ id, news, olds }) {
+            if (!isResolved(news))
+                return undefined;
+            if ((yield* createName(id, olds ?? {})) !==
+                (yield* createName(id, news))) {
+                return { action: "replace" };
+            }
+        }),
+        read: Effect.fn(function* ({ id, olds, output }) {
+            if (output?.keyGroupId) {
+                const found = yield* getById(output.keyGroupId);
+                if (found)
+                    return toAttrs(output.keyGroupId, found.config, found.etag);
+            }
+            const name = yield* createName(id, olds ?? {});
+            const found = yield* getByName(name);
+            if (!found)
+                return undefined;
+            return toAttrs(found.id, found.config, found.etag);
+        }),
+        create: Effect.fn(function* ({ id, news, session }) {
+            const name = yield* createName(id, news);
+            const items = news.items;
+            const created = yield* cloudfront
+                .createKeyGroup({
+                KeyGroupConfig: buildConfig(name, items, news.comment),
+            })
+                .pipe(Effect.catchTag("KeyGroupAlreadyExists", () => getByName(name).pipe(Effect.flatMap((existing) => existing
+                ? Effect.succeed({
+                    KeyGroup: {
+                        Id: existing.id,
+                        LastModifiedTime: new Date(),
+                        KeyGroupConfig: existing.config,
+                    },
+                    ETag: existing.etag,
+                    Location: undefined,
+                })
+                : Effect.fail(new Error(`Key group '${name}' already exists but could not be recovered`))))));
+            if (!created.KeyGroup?.Id) {
+                return yield* Effect.fail(new Error("createKeyGroup returned no identifier"));
+            }
+            yield* session.note(created.KeyGroup.Id);
+            return toAttrs(created.KeyGroup.Id, created.KeyGroup.KeyGroupConfig, created.ETag);
+        }),
+        update: Effect.fn(function* ({ news, output, session }) {
+            const current = yield* getById(output.keyGroupId);
+            const items = news.items;
+            const updated = yield* cloudfront.updateKeyGroup({
+                Id: output.keyGroupId,
+                IfMatch: current?.etag ?? output.etag,
+                KeyGroupConfig: buildConfig(output.name, items, news.comment),
+            });
+            if (!updated.KeyGroup?.Id) {
+                return yield* Effect.fail(new Error("updateKeyGroup returned no identifier"));
+            }
+            yield* session.note(output.keyGroupId);
+            return toAttrs(updated.KeyGroup.Id, updated.KeyGroup.KeyGroupConfig, updated.ETag);
+        }),
+        delete: Effect.fn(function* ({ output }) {
+            const current = yield* getById(output.keyGroupId);
+            if (!current)
+                return;
+            yield* cloudfront
+                .deleteKeyGroup({
+                Id: output.keyGroupId,
+                IfMatch: current.etag,
+            })
+                .pipe(Effect.catchTag("NoSuchResource", () => Effect.void));
+        }),
+    };
+}));
+const createName = (id, props) => props.name
+    ? Effect.succeed(props.name)
+    : createPhysicalName({ id, maxLength: 128, lowercase: true });
+//# sourceMappingURL=KeyGroup.js.map

package/lib/AWS/CloudFront/KeyGroup.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"KeyGroup.js","sourceRoot":"","sources":["../../../src/AWS/CloudFront/KeyGroup.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,UAAU,MAAM,iCAAiC,CAAC;AAC9D,OAAO,KAAK,MAAM,MAAM,eAAe,CAAC;AACxC,OAAO,EAAE,UAAU,EAAE,MAAM,eAAe,CAAC;AAE3C,OAAO,EAAE,kBAAkB,EAAE,MAAM,uBAAuB,CAAC;AAC3D,OAAO,KAAK,QAAQ,MAAM,mBAAmB,CAAC;AAC9C,OAAO,EAAE,QAAQ,EAAE,MAAM,mBAAmB,CAAC;AAmD7C;;;;;;;;;;;;;;;;;;;;;;;GAuBG;AACH,MAAM,CAAC,MAAM,QAAQ,GAAG,QAAQ,CAAW,yBAAyB,CAAC,CAAC;AAEtE,MAAM,CAAC,MAAM,gBAAgB,GAAG,GAAG,EAAE,CACnC,QAAQ,CAAC,MAAM,CACb,QAAQ,EACR,MAAM,CAAC,GAAG,CAAC,QAAQ,CAAC;IAClB,MAAM,OAAO,GAAG,MAAM,CAAC,EAAE,CAAC,QAAQ,CAAC,EAAE,EAAU;QAC7C,MAAM,MAAM,GAAG,KAAK,CAAC,CAAC,UAAU;aAC7B,iBAAiB,CAAC,EAAE,EAAE,EAAE,EAAE,EAAE,CAAC;aAC7B,IAAI,CACH,MAAM,CAAC,QAAQ,CAAC,gBAAgB,EAAE,GAAG,EAAE,CAAC,MAAM,CAAC,OAAO,CAAC,SAAS,CAAC,CAAC,CACnE,CAAC;QACJ,IAAI,CAAC,MAAM,EAAE,cAAc;YAAE,OAAO,SAAS,CAAC;QAC9C,OAAO,EAAE,MAAM,EAAE,MAAM,CAAC,cAAc,EAAE,IAAI,EAAE,MAAM,CAAC,IAAI,EAAE,CAAC;IAC9D,CAAC,CAAC,CAAC;IAEH,MAAM,SAAS,GAAG,MAAM,CAAC,EAAE,CAAC,QAAQ,CAAC,EAAE,IAAY;QACjD,MAAM,MAAM,GAAG,KAAK,CAAC,CAAC,UAAU,CAAC,aAAa,CAAC,EAAE,CAAC,CAAC;QACnD,MAAM,OAAO,GAAG,MAAM,CAAC,YAAY,EAAE,KAAK,EAAE,IAAI,CAC9C,CAAC,IAAI,EAAE,EAAE,CAAC,IAAI,CAAC,QAAQ,EAAE,cAAc,EAAE,IAAI,KAAK,IAAI,CACvD,CAAC;QACF,IAAI,CAAC,OAAO,EAAE,QAAQ,EAAE,EAAE;YAAE,OAAO,SAAS,CAAC;QAC7C,OAAO,KAAK,CAAC,CAAC,OAAO,CAAC,OAAO,CAAC,QAAQ,CAAC,EAAE,CAAC,CAAC,IAAI,CAC7C,MAAM,CAAC,GAAG,CAAC,CAAC,KAAK,EAAE,EAAE,CACnB,KAAK,CAAC,CAAC,CAAC,EAAE,EAAE,EAAE,OAAO,CAAC,QAAQ,CAAC,EAAE,EAAE,GAAG,KAAK,EAAE,CAAC,CAAC,CAAC,SAAS,CAC1D,CACF,CAAC;IACJ,CAAC,CAAC,CAAC;IAEH,MAAM,WAAW,GAAG,CAClB,IAAY,EACZ,KAAe,EACf,OAA2B,EACA,EAAE,CAAC,CAAC;QAC/B,IAAI,EAAE,IAAI;QACV,KAAK,EAAE,KAAK;QACZ,OAAO,EAAE,OAAO;KACjB,CAAC,CAAC;IAEH,MAAM,OAAO,GAAG,CACd,EAAU,EACV,MAAiC,EACjC,IAAwB,EACxB,EAAE,CAAC,CAAC;QACJ,UAAU,EAAE,EAAE;QACd,IAAI,EAAE,MAAM,CAAC,IAAI;QACjB,KAAK,EAAE,MAAM,CAAC,KAAK;QACnB,IAAI;QACJ,OAAO,EAAE,MAAM,CAAC,OAAO;KACxB,CAAC,CAAC;IAEH,OAAO;QACL,OAAO,EAAE,CAAC,YAAY,CAAC;QACvB,IAAI,EAAE,MAAM,CAAC,EAAE,CAAC,QAAQ,CAAC,EAAE,EAAE,EAAE,EAAE,IAAI,EAAE,IAAI,EAAE;YAC3C,IAAI,CAAC,UAAU,CAAC,IAAI,CAAC;gBAAE,OAAO,SAAS,CAAC;YACxC,IACE,CAAC,KAAK,CAAC,CAAC,UAAU,CAAC,EAAE,EAAE,IAAI,IAAI,EAAE,CAAC,CAAC;gBACnC,CAAC,KAAK,CAAC,CAAC,UAAU,CAAC,EAAE,EAAE,IAAI,CAAC,CAAC,EAC7B,CAAC;gBACD,OAAO,EAAE,MAAM,EAAE,SAAS,EAAW,CAAC;YACxC,CAAC;QACH,CAAC,CAAC;QACF,IAAI,EAAE,MAAM,CAAC,EAAE,CAAC,QAAQ,CAAC,EAAE,EAAE,EAAE,EAAE,IAAI,EAAE,MAAM,EAAE;YAC7C,IAAI,MAAM,EAAE,UAAU,EAAE,CAAC;gBACvB,MAAM,KAAK,GAAG,KAAK,CAAC,CAAC,OAAO,CAAC,MAAM,CAAC,UAAU,CAAC,CAAC;gBAChD,IAAI,KAAK;oBAAE,OAAO,OAAO,CAAC,MAAM,CAAC,UAAU,EAAE,KAAK,CAAC,MAAM,EAAE,KAAK,CAAC,IAAI,CAAC,CAAC;YACzE,CAAC;YACD,MAAM,IAAI,GAAG,KAAK,CAAC,CAAC,UAAU,CAAC,EAAE,EAAE,IAAI,IAAI,EAAE,CAAC,CAAC;YAC/C,MAAM,KAAK,GAAG,KAAK,CAAC,CAAC,SAAS,CAAC,IAAI,CAAC,CAAC;YACrC,IAAI,CAAC,KAAK;gBAAE,OAAO,SAAS,CAAC;YAC7B,OAAO,OAAO,CAAC,KAAK,CAAC,EAAE,EAAE,KAAK,CAAC,MAAM,EAAE,KAAK,CAAC,IAAI,CAAC,CAAC;QACrD,CAAC,CAAC;QACF,MAAM,EAAE,MAAM,CAAC,EAAE,CAAC,QAAQ,CAAC,EAAE,EAAE,EAAE,EAAE,IAAI,EAAE,OAAO,EAAE;YAChD,MAAM,IAAI,GAAG,KAAK,CAAC,CAAC,UAAU,CAAC,EAAE,EAAE,IAAI,CAAC,CAAC;YACzC,MAAM,KAAK,GAAG,IAAI,CAAC,KAAiB,CAAC;YACrC,MAAM,OAAO,GAAG,KAAK,CAAC,CAAC,UAAU;iBAC9B,cAAc,CAAC;gBACd,cAAc,EAAE,WAAW,CAAC,IAAI,EAAE,KAAK,EAAE,IAAI,CAAC,OAAO,CAAC;aACvD,CAAC;iBACD,IAAI,CACH,MAAM,CAAC,QAAQ,CAAC,uBAAuB,EAAE,GAAG,EAAE,CAC5C,SAAS,CAAC,IAAI,CAAC,CAAC,IAAI,CAClB,MAAM,CAAC,OAAO,CAAC,CAAC,QAAQ,EAAE,EAAE,CAC1B,QAAQ;gBACN,CAAC,CAAC,MAAM,CAAC,OAAO,CAAC;oBACb,QAAQ,EAAE;wBACR,EAAE,EAAE,QAAQ,CAAC,EAAE;wBACf,gBAAgB,EAAE,IAAI,IAAI,EAAE;wBAC5B,cAAc,EAAE,QAAQ,CAAC,MAAM;qBAChC;oBACD,IAAI,EAAE,QAAQ,CAAC,IAAI;oBACnB,QAAQ,EAAE,SAAS;iBACpB,CAAC;gBACJ,CAAC,CAAC,MAAM,CAAC,IAAI,CACT,IAAI,KAAK,CACP,cAAc,IAAI,6CAA6C,CAChE,CACF,CACN,CACF,CACF,CACF,CAAC;YACJ,IAAI,CAAC,OAAO,CAAC,QAAQ,EAAE,EAAE,EAAE,CAAC;gBAC1B,OAAO,KAAK,CAAC,CAAC,MAAM,CAAC,IAAI,CACvB,IAAI,KAAK,CAAC,uCAAuC,CAAC,CACnD,CAAC;YACJ,CAAC;YACD,KAAK,CAAC,CAAC,OAAO,CAAC,IAAI,CAAC,OAAO,CAAC,QAAQ,CAAC,EAAE,CAAC,CAAC;YACzC,OAAO,OAAO,CACZ,OAAO,CAAC,QAAQ,CAAC,EAAE,EACnB,OAAO,CAAC,QAAQ,CAAC,cAAc,EAC/B,OAAO,CAAC,IAAI,CACb,CAAC;QACJ,CAAC,CAAC;QACF,MAAM,EAAE,MAAM,CAAC,EAAE,CAAC,QAAQ,CAAC,EAAE,EAAE,IAAI,EAAE,MAAM,EAAE,OAAO,EAAE;YACpD,MAAM,OAAO,GAAG,KAAK,CAAC,CAAC,OAAO,CAAC,MAAM,CAAC,UAAU,CAAC,CAAC;YAClD,MAAM,KAAK,GAAG,IAAI,CAAC,KAAiB,CAAC;YACrC,MAAM,OAAO,GAAG,KAAK,CAAC,CAAC,UAAU,CAAC,cAAc,CAAC;gBAC/C,EAAE,EAAE,MAAM,CAAC,UAAU;gBACrB,OAAO,EAAE,OAAO,EAAE,IAAI,IAAI,MAAM,CAAC,IAAI;gBACrC,cAAc,EAAE,WAAW,CAAC,MAAM,CAAC,IAAI,EAAE,KAAK,EAAE,IAAI,CAAC,OAAO,CAAC;aAC9D,CAAC,CAAC;YACH,IAAI,CAAC,OAAO,CAAC,QAAQ,EAAE,EAAE,EAAE,CAAC;gBAC1B,OAAO,KAAK,CAAC,CAAC,MAAM,CAAC,IAAI,CACvB,IAAI,KAAK,CAAC,uCAAuC,CAAC,CACnD,CAAC;YACJ,CAAC;YACD,KAAK,CAAC,CAAC,OAAO,CAAC,IAAI,CAAC,MAAM,CAAC,UAAU,CAAC,CAAC;YACvC,OAAO,OAAO,CACZ,OAAO,CAAC,QAAQ,CAAC,EAAE,EACnB,OAAO,CAAC,QAAQ,CAAC,cAAc,EAC/B,OAAO,CAAC,IAAI,CACb,CAAC;QACJ,CAAC,CAAC;QACF,MAAM,EAAE,MAAM,CAAC,EAAE,CAAC,QAAQ,CAAC,EAAE,EAAE,MAAM,EAAE;YACrC,MAAM,OAAO,GAAG,KAAK,CAAC,CAAC,OAAO,CAAC,MAAM,CAAC,UAAU,CAAC,CAAC;YAClD,IAAI,CAAC,OAAO;gBAAE,OAAO;YACrB,KAAK,CAAC,CAAC,UAAU;iBACd,cAAc,CAAC;gBACd,EAAE,EAAE,MAAM,CAAC,UAAU;gBACrB,OAAO,EAAE,OAAO,CAAC,IAAI;aACtB,CAAC;iBACD,IAAI,CAAC,MAAM,CAAC,QAAQ,CAAC,gBAAgB,EAAE,GAAG,EAAE,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC,CAAC;QAChE,CAAC,CAAC;KACH,CAAC;AACJ,CAAC,CAAC,CACH,CAAC;AAEJ,MAAM,UAAU,GAAG,CAAC,EAAU,EAAE,KAAwB,EAAE,EAAE,CAC1D,KAAK,CAAC,IAAI;IACR,CAAC,CAAC,MAAM,CAAC,OAAO,CAAC,KAAK,CAAC,IAAI,CAAC;IAC5B,CAAC,CAAC,kBAAkB,CAAC,EAAE,EAAE,EAAE,SAAS,EAAE,GAAG,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAC"}

package/lib/AWS/CloudFront/OriginRequestPolicy.d.ts

@@ -0,0 +1,84 @@
+import * as cloudfront from "@distilled.cloud/aws/cloudfront";
+import * as Provider from "../../Provider.ts";
+import { Resource } from "../../Resource.ts";
+import type { Providers } from "../Providers.ts";
+export interface OriginRequestPolicyProps {
+    /**
+     * Name of the origin request policy. If omitted, a deterministic name is
+     * generated. Names must be unique per AWS account. Changing the name
+     * triggers a replacement.
+     */
+    name?: string;
+    /**
+     * Optional comment describing the policy.
+     */
+    comment?: string;
+    /**
+     * Headers to forward to the origin (in addition to the cache key).
+     */
+    headersConfig: cloudfront.OriginRequestPolicyHeadersConfig;
+    /**
+     * Cookies to forward to the origin (in addition to the cache key).
+     */
+    cookiesConfig: cloudfront.OriginRequestPolicyCookiesConfig;
+    /**
+     * Query strings to forward to the origin (in addition to the cache key).
+     */
+    queryStringsConfig: cloudfront.OriginRequestPolicyQueryStringsConfig;
+}
+export interface OriginRequestPolicy extends Resource<"AWS.CloudFront.OriginRequestPolicy", OriginRequestPolicyProps, {
+    /**
+     * CloudFront-assigned origin request policy identifier.
+     */
+    originRequestPolicyId: string;
+    /**
+     * Name of the origin request policy.
+     */
+    name: string;
+    /**
+     * Most recent entity tag for update/delete operations.
+     */
+    etag: string | undefined;
+    /**
+     * Current comment on the policy.
+     */
+    comment: string | undefined;
+    /**
+     * Current headers configuration.
+     */
+    headersConfig: cloudfront.OriginRequestPolicyHeadersConfig;
+    /**
+     * Current cookies configuration.
+     */
+    cookiesConfig: cloudfront.OriginRequestPolicyCookiesConfig;
+    /**
+     * Current query strings configuration.
+     */
+    queryStringsConfig: cloudfront.OriginRequestPolicyQueryStringsConfig;
+}, never, Providers> {
+}
+/**
+ * A CloudFront origin request policy.
+ *
+ * Origin request policies control which values from the viewer request (in
+ * addition to those used in the cache key) CloudFront includes when sending
+ * a request to the origin. They are referenced by ID on a Distribution's
+ * default behavior or per-path cache behaviors.
+ *
+ * @section Creating Origin Request Policies
+ * @example Forward all viewer headers and cookies
+ * ```typescript
+ * const originRequestPolicy = yield* OriginRequestPolicy("AppOriginRequest", {
+ *   comment: "Forward auth + locale",
+ *   headersConfig: {
+ *     HeaderBehavior: "whitelist",
+ *     Headers: { Quantity: 2, Items: ["Authorization", "Accept-Language"] },
+ *   },
+ *   cookiesConfig: { CookieBehavior: "all" },
+ *   queryStringsConfig: { QueryStringBehavior: "all" },
+ * });
+ * ```
+ */
+export declare const OriginRequestPolicy: import("../../Resource.ts").ResourceClass<OriginRequestPolicy>;
+export declare const OriginRequestPolicyProvider: () => import("effect/Layer").Layer<Provider.Provider<OriginRequestPolicy>, never, import("effect/unstable/http/HttpClient").HttpClient | import("../../Stage.ts").Stage | import("../../Stack.ts").Stack | import("@distilled.cloud/aws/Region").Region | import("@distilled.cloud/aws/Credentials").Credentials>;
+//# sourceMappingURL=OriginRequestPolicy.d.ts.map

package/lib/AWS/CloudFront/OriginRequestPolicy.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"OriginRequestPolicy.d.ts","sourceRoot":"","sources":["../../../src/AWS/CloudFront/OriginRequestPolicy.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,UAAU,MAAM,iCAAiC,CAAC;AAI9D,OAAO,KAAK,QAAQ,MAAM,mBAAmB,CAAC;AAC9C,OAAO,EAAE,QAAQ,EAAE,MAAM,mBAAmB,CAAC;AAC7C,OAAO,KAAK,EAAE,SAAS,EAAE,MAAM,iBAAiB,CAAC;AAEjD,MAAM,WAAW,wBAAwB;IACvC;;;;OAIG;IACH,IAAI,CAAC,EAAE,MAAM,CAAC;IACd;;OAEG;IACH,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB;;OAEG;IACH,aAAa,EAAE,UAAU,CAAC,gCAAgC,CAAC;IAC3D;;OAEG;IACH,aAAa,EAAE,UAAU,CAAC,gCAAgC,CAAC;IAC3D;;OAEG;IACH,kBAAkB,EAAE,UAAU,CAAC,qCAAqC,CAAC;CACtE;AAED,MAAM,WAAW,mBAAoB,SAAQ,QAAQ,CACnD,oCAAoC,EACpC,wBAAwB,EACxB;IACE;;OAEG;IACH,qBAAqB,EAAE,MAAM,CAAC;IAC9B;;OAEG;IACH,IAAI,EAAE,MAAM,CAAC;IACb;;OAEG;IACH,IAAI,EAAE,MAAM,GAAG,SAAS,CAAC;IACzB;;OAEG;IACH,OAAO,EAAE,MAAM,GAAG,SAAS,CAAC;IAC5B;;OAEG;IACH,aAAa,EAAE,UAAU,CAAC,gCAAgC,CAAC;IAC3D;;OAEG;IACH,aAAa,EAAE,UAAU,CAAC,gCAAgC,CAAC;IAC3D;;OAEG;IACH,kBAAkB,EAAE,UAAU,CAAC,qCAAqC,CAAC;CACtE,EACD,KAAK,EACL,SAAS,CACV;CAAG;AAEJ;;;;;;;;;;;;;;;;;;;;;GAqBG;AACH,eAAO,MAAM,mBAAmB,gEAE/B,CAAC;AAEF,eAAO,MAAM,2BAA2B,mTA0JrC,CAAC"}

package/lib/AWS/CloudFront/OriginRequestPolicy.js

@@ -0,0 +1,139 @@
+import * as cloudfront from "@distilled.cloud/aws/cloudfront";
+import * as Effect from "effect/Effect";
+import { isResolved } from "../../Diff.js";
+import { createPhysicalName } from "../../PhysicalName.js";
+import * as Provider from "../../Provider.js";
+import { Resource } from "../../Resource.js";
+/**
+ * A CloudFront origin request policy.
+ *
+ * Origin request policies control which values from the viewer request (in
+ * addition to those used in the cache key) CloudFront includes when sending
+ * a request to the origin. They are referenced by ID on a Distribution's
+ * default behavior or per-path cache behaviors.
+ *
+ * @section Creating Origin Request Policies
+ * @example Forward all viewer headers and cookies
+ * ```typescript
+ * const originRequestPolicy = yield* OriginRequestPolicy("AppOriginRequest", {
+ *   comment: "Forward auth + locale",
+ *   headersConfig: {
+ *     HeaderBehavior: "whitelist",
+ *     Headers: { Quantity: 2, Items: ["Authorization", "Accept-Language"] },
+ *   },
+ *   cookiesConfig: { CookieBehavior: "all" },
+ *   queryStringsConfig: { QueryStringBehavior: "all" },
+ * });
+ * ```
+ */
+export const OriginRequestPolicy = Resource("AWS.CloudFront.OriginRequestPolicy");
+export const OriginRequestPolicyProvider = () => Provider.effect(OriginRequestPolicy, Effect.gen(function* () {
+    const getById = Effect.fn(function* (id) {
+        const config = yield* cloudfront
+            .getOriginRequestPolicyConfig({ Id: id })
+            .pipe(Effect.catchTag("NoSuchOriginRequestPolicy", () => Effect.succeed(undefined)));
+        if (!config?.OriginRequestPolicyConfig)
+            return undefined;
+        return { config: config.OriginRequestPolicyConfig, etag: config.ETag };
+    });
+    const getByName = Effect.fn(function* (name) {
+        const listed = yield* cloudfront.listOriginRequestPolicies({
+            Type: "custom",
+        });
+        const summary = listed.OriginRequestPolicyList?.Items?.find((item) => item.OriginRequestPolicy?.OriginRequestPolicyConfig?.Name === name);
+        if (!summary?.OriginRequestPolicy?.Id)
+            return undefined;
+        return yield* getById(summary.OriginRequestPolicy.Id).pipe(Effect.map((found) => found ? { id: summary.OriginRequestPolicy.Id, ...found } : undefined));
+    });
+    const buildConfig = (name, props) => ({
+        Name: name,
+        Comment: props.comment,
+        HeadersConfig: props.headersConfig,
+        CookiesConfig: props.cookiesConfig,
+        QueryStringsConfig: props.queryStringsConfig,
+    });
+    const toAttrs = (id, config, etag) => ({
+        originRequestPolicyId: id,
+        name: config.Name,
+        etag,
+        comment: config.Comment,
+        headersConfig: config.HeadersConfig,
+        cookiesConfig: config.CookiesConfig,
+        queryStringsConfig: config.QueryStringsConfig,
+    });
+    return {
+        stables: ["originRequestPolicyId"],
+        diff: Effect.fn(function* ({ id, news, olds }) {
+            if (!isResolved(news))
+                return undefined;
+            if ((yield* createName(id, olds ?? {})) !==
+                (yield* createName(id, news))) {
+                return { action: "replace" };
+            }
+        }),
+        read: Effect.fn(function* ({ id, olds, output }) {
+            if (output?.originRequestPolicyId) {
+                const found = yield* getById(output.originRequestPolicyId);
+                if (found) {
+                    return toAttrs(output.originRequestPolicyId, found.config, found.etag);
+                }
+            }
+            const name = yield* createName(id, olds ?? {});
+            const found = yield* getByName(name);
+            if (!found)
+                return undefined;
+            return toAttrs(found.id, found.config, found.etag);
+        }),
+        create: Effect.fn(function* ({ id, news, session }) {
+            const name = yield* createName(id, news);
+            const created = yield* cloudfront
+                .createOriginRequestPolicy({
+                OriginRequestPolicyConfig: buildConfig(name, news),
+            })
+                .pipe(Effect.catchTag("OriginRequestPolicyAlreadyExists", () => getByName(name).pipe(Effect.flatMap((existing) => existing
+                ? Effect.succeed({
+                    OriginRequestPolicy: {
+                        Id: existing.id,
+                        LastModifiedTime: new Date(),
+                        OriginRequestPolicyConfig: existing.config,
+                    },
+                    ETag: existing.etag,
+                    Location: undefined,
+                })
+                : Effect.fail(new Error(`Origin request policy '${name}' already exists but could not be recovered`))))));
+            if (!created.OriginRequestPolicy?.Id) {
+                return yield* Effect.fail(new Error("createOriginRequestPolicy returned no identifier"));
+            }
+            yield* session.note(created.OriginRequestPolicy.Id);
+            return toAttrs(created.OriginRequestPolicy.Id, created.OriginRequestPolicy.OriginRequestPolicyConfig, created.ETag);
+        }),
+        update: Effect.fn(function* ({ news, output, session }) {
+            const current = yield* getById(output.originRequestPolicyId);
+            const updated = yield* cloudfront.updateOriginRequestPolicy({
+                Id: output.originRequestPolicyId,
+                IfMatch: current?.etag ?? output.etag,
+                OriginRequestPolicyConfig: buildConfig(output.name, news),
+            });
+            if (!updated.OriginRequestPolicy?.Id) {
+                return yield* Effect.fail(new Error("updateOriginRequestPolicy returned no identifier"));
+            }
+            yield* session.note(output.originRequestPolicyId);
+            return toAttrs(updated.OriginRequestPolicy.Id, updated.OriginRequestPolicy.OriginRequestPolicyConfig, updated.ETag);
+        }),
+        delete: Effect.fn(function* ({ output }) {
+            const current = yield* getById(output.originRequestPolicyId);
+            if (!current)
+                return;
+            yield* cloudfront
+                .deleteOriginRequestPolicy({
+                Id: output.originRequestPolicyId,
+                IfMatch: current.etag,
+            })
+                .pipe(Effect.catchTag("NoSuchOriginRequestPolicy", () => Effect.void));
+        }),
+    };
+}));
+const createName = (id, props) => props.name
+    ? Effect.succeed(props.name)
+    : createPhysicalName({ id, maxLength: 128, lowercase: true });
+//# sourceMappingURL=OriginRequestPolicy.js.map

package/lib/AWS/CloudFront/OriginRequestPolicy.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"OriginRequestPolicy.js","sourceRoot":"","sources":["../../../src/AWS/CloudFront/OriginRequestPolicy.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,UAAU,MAAM,iCAAiC,CAAC;AAC9D,OAAO,KAAK,MAAM,MAAM,eAAe,CAAC;AACxC,OAAO,EAAE,UAAU,EAAE,MAAM,eAAe,CAAC;AAC3C,OAAO,EAAE,kBAAkB,EAAE,MAAM,uBAAuB,CAAC;AAC3D,OAAO,KAAK,QAAQ,MAAM,mBAAmB,CAAC;AAC9C,OAAO,EAAE,QAAQ,EAAE,MAAM,mBAAmB,CAAC;AAiE7C;;;;;;;;;;;;;;;;;;;;;GAqBG;AACH,MAAM,CAAC,MAAM,mBAAmB,GAAG,QAAQ,CACzC,oCAAoC,CACrC,CAAC;AAEF,MAAM,CAAC,MAAM,2BAA2B,GAAG,GAAG,EAAE,CAC9C,QAAQ,CAAC,MAAM,CACb,mBAAmB,EACnB,MAAM,CAAC,GAAG,CAAC,QAAQ,CAAC;IAClB,MAAM,OAAO,GAAG,MAAM,CAAC,EAAE,CAAC,QAAQ,CAAC,EAAE,EAAU;QAC7C,MAAM,MAAM,GAAG,KAAK,CAAC,CAAC,UAAU;aAC7B,4BAA4B,CAAC,EAAE,EAAE,EAAE,EAAE,EAAE,CAAC;aACxC,IAAI,CACH,MAAM,CAAC,QAAQ,CAAC,2BAA2B,EAAE,GAAG,EAAE,CAChD,MAAM,CAAC,OAAO,CAAC,SAAS,CAAC,CAC1B,CACF,CAAC;QACJ,IAAI,CAAC,MAAM,EAAE,yBAAyB;YAAE,OAAO,SAAS,CAAC;QACzD,OAAO,EAAE,MAAM,EAAE,MAAM,CAAC,yBAAyB,EAAE,IAAI,EAAE,MAAM,CAAC,IAAI,EAAE,CAAC;IACzE,CAAC,CAAC,CAAC;IAEH,MAAM,SAAS,GAAG,MAAM,CAAC,EAAE,CAAC,QAAQ,CAAC,EAAE,IAAY;QACjD,MAAM,MAAM,GAAG,KAAK,CAAC,CAAC,UAAU,CAAC,yBAAyB,CAAC;YACzD,IAAI,EAAE,QAAQ;SACf,CAAC,CAAC;QACH,MAAM,OAAO,GAAG,MAAM,CAAC,uBAAuB,EAAE,KAAK,EAAE,IAAI,CACzD,CAAC,IAAI,EAAE,EAAE,CACP,IAAI,CAAC,mBAAmB,EAAE,yBAAyB,EAAE,IAAI,KAAK,IAAI,CACrE,CAAC;QACF,IAAI,CAAC,OAAO,EAAE,mBAAmB,EAAE,EAAE;YAAE,OAAO,SAAS,CAAC;QACxD,OAAO,KAAK,CAAC,CAAC,OAAO,CAAC,OAAO,CAAC,mBAAmB,CAAC,EAAE,CAAC,CAAC,IAAI,CACxD,MAAM,CAAC,GAAG,CAAC,CAAC,KAAK,EAAE,EAAE,CACnB,KAAK,CAAC,CAAC,CAAC,EAAE,EAAE,EAAE,OAAO,CAAC,mBAAmB,CAAC,EAAE,EAAE,GAAG,KAAK,EAAE,CAAC,CAAC,CAAC,SAAS,CACrE,CACF,CAAC;IACJ,CAAC,CAAC,CAAC;IAEH,MAAM,WAAW,GAAG,CAClB,IAAY,EACZ,KAA+B,EACO,EAAE,CAAC,CAAC;QAC1C,IAAI,EAAE,IAAI;QACV,OAAO,EAAE,KAAK,CAAC,OAAO;QACtB,aAAa,EAAE,KAAK,CAAC,aAAa;QAClC,aAAa,EAAE,KAAK,CAAC,aAAa;QAClC,kBAAkB,EAAE,KAAK,CAAC,kBAAkB;KAC7C,CAAC,CAAC;IAEH,MAAM,OAAO,GAAG,CACd,EAAU,EACV,MAA4C,EAC5C,IAAwB,EACxB,EAAE,CAAC,CAAC;QACJ,qBAAqB,EAAE,EAAE;QACzB,IAAI,EAAE,MAAM,CAAC,IAAI;QACjB,IAAI;QACJ,OAAO,EAAE,MAAM,CAAC,OAAO;QACvB,aAAa,EAAE,MAAM,CAAC,aAAa;QACnC,aAAa,EAAE,MAAM,CAAC,aAAa;QACnC,kBAAkB,EAAE,MAAM,CAAC,kBAAkB;KAC9C,CAAC,CAAC;IAEH,OAAO;QACL,OAAO,EAAE,CAAC,uBAAuB,CAAC;QAClC,IAAI,EAAE,MAAM,CAAC,EAAE,CAAC,QAAQ,CAAC,EAAE,EAAE,EAAE,EAAE,IAAI,EAAE,IAAI,EAAE;YAC3C,IAAI,CAAC,UAAU,CAAC,IAAI,CAAC;gBAAE,OAAO,SAAS,CAAC;YACxC,IACE,CAAC,KAAK,CAAC,CAAC,UAAU,CAAC,EAAE,EAAE,IAAI,IAAI,EAAE,CAAC,CAAC;gBACnC,CAAC,KAAK,CAAC,CAAC,UAAU,CAAC,EAAE,EAAE,IAAI,CAAC,CAAC,EAC7B,CAAC;gBACD,OAAO,EAAE,MAAM,EAAE,SAAS,EAAW,CAAC;YACxC,CAAC;QACH,CAAC,CAAC;QACF,IAAI,EAAE,MAAM,CAAC,EAAE,CAAC,QAAQ,CAAC,EAAE,EAAE,EAAE,EAAE,IAAI,EAAE,MAAM,EAAE;YAC7C,IAAI,MAAM,EAAE,qBAAqB,EAAE,CAAC;gBAClC,MAAM,KAAK,GAAG,KAAK,CAAC,CAAC,OAAO,CAAC,MAAM,CAAC,qBAAqB,CAAC,CAAC;gBAC3D,IAAI,KAAK,EAAE,CAAC;oBACV,OAAO,OAAO,CAAC,MAAM,CAAC,qBAAqB,EAAE,KAAK,CAAC,MAAM,EAAE,KAAK,CAAC,IAAI,CAAC,CAAC;gBACzE,CAAC;YACH,CAAC;YACD,MAAM,IAAI,GAAG,KAAK,CAAC,CAAC,UAAU,CAAC,EAAE,EAAE,IAAI,IAAI,EAAE,CAAC,CAAC;YAC/C,MAAM,KAAK,GAAG,KAAK,CAAC,CAAC,SAAS,CAAC,IAAI,CAAC,CAAC;YACrC,IAAI,CAAC,KAAK;gBAAE,OAAO,SAAS,CAAC;YAC7B,OAAO,OAAO,CAAC,KAAK,CAAC,EAAE,EAAE,KAAK,CAAC,MAAM,EAAE,KAAK,CAAC,IAAI,CAAC,CAAC;QACrD,CAAC,CAAC;QACF,MAAM,EAAE,MAAM,CAAC,EAAE,CAAC,QAAQ,CAAC,EAAE,EAAE,EAAE,EAAE,IAAI,EAAE,OAAO,EAAE;YAChD,MAAM,IAAI,GAAG,KAAK,CAAC,CAAC,UAAU,CAAC,EAAE,EAAE,IAAI,CAAC,CAAC;YACzC,MAAM,OAAO,GAAG,KAAK,CAAC,CAAC,UAAU;iBAC9B,yBAAyB,CAAC;gBACzB,yBAAyB,EAAE,WAAW,CAAC,IAAI,EAAE,IAAI,CAAC;aACnD,CAAC;iBACD,IAAI,CACH,MAAM,CAAC,QAAQ,CAAC,kCAAkC,EAAE,GAAG,EAAE,CACvD,SAAS,CAAC,IAAI,CAAC,CAAC,IAAI,CAClB,MAAM,CAAC,OAAO,CAAC,CAAC,QAAQ,EAAE,EAAE,CAC1B,QAAQ;gBACN,CAAC,CAAC,MAAM,CAAC,OAAO,CAAC;oBACb,mBAAmB,EAAE;wBACnB,EAAE,EAAE,QAAQ,CAAC,EAAE;wBACf,gBAAgB,EAAE,IAAI,IAAI,EAAE;wBAC5B,yBAAyB,EAAE,QAAQ,CAAC,MAAM;qBAC3C;oBACD,IAAI,EAAE,QAAQ,CAAC,IAAI;oBACnB,QAAQ,EAAE,SAAS;iBACpB,CAAC;gBACJ,CAAC,CAAC,MAAM,CAAC,IAAI,CACT,IAAI,KAAK,CACP,0BAA0B,IAAI,6CAA6C,CAC5E,CACF,CACN,CACF,CACF,CACF,CAAC;YACJ,IAAI,CAAC,OAAO,CAAC,mBAAmB,EAAE,EAAE,EAAE,CAAC;gBACrC,OAAO,KAAK,CAAC,CAAC,MAAM,CAAC,IAAI,CACvB,IAAI,KAAK,CAAC,kDAAkD,CAAC,CAC9D,CAAC;YACJ,CAAC;YACD,KAAK,CAAC,CAAC,OAAO,CAAC,IAAI,CAAC,OAAO,CAAC,mBAAmB,CAAC,EAAE,CAAC,CAAC;YACpD,OAAO,OAAO,CACZ,OAAO,CAAC,mBAAmB,CAAC,EAAE,EAC9B,OAAO,CAAC,mBAAmB,CAAC,yBAAyB,EACrD,OAAO,CAAC,IAAI,CACb,CAAC;QACJ,CAAC,CAAC;QACF,MAAM,EAAE,MAAM,CAAC,EAAE,CAAC,QAAQ,CAAC,EAAE,EAAE,IAAI,EAAE,MAAM,EAAE,OAAO,EAAE;YACpD,MAAM,OAAO,GAAG,KAAK,CAAC,CAAC,OAAO,CAAC,MAAM,CAAC,qBAAqB,CAAC,CAAC;YAC7D,MAAM,OAAO,GAAG,KAAK,CAAC,CAAC,UAAU,CAAC,yBAAyB,CAAC;gBAC1D,EAAE,EAAE,MAAM,CAAC,qBAAqB;gBAChC,OAAO,EAAE,OAAO,EAAE,IAAI,IAAI,MAAM,CAAC,IAAI;gBACrC,yBAAyB,EAAE,WAAW,CAAC,MAAM,CAAC,IAAI,EAAE,IAAI,CAAC;aAC1D,CAAC,CAAC;YACH,IAAI,CAAC,OAAO,CAAC,mBAAmB,EAAE,EAAE,EAAE,CAAC;gBACrC,OAAO,KAAK,CAAC,CAAC,MAAM,CAAC,IAAI,CACvB,IAAI,KAAK,CAAC,kDAAkD,CAAC,CAC9D,CAAC;YACJ,CAAC;YACD,KAAK,CAAC,CAAC,OAAO,CAAC,IAAI,CAAC,MAAM,CAAC,qBAAqB,CAAC,CAAC;YAClD,OAAO,OAAO,CACZ,OAAO,CAAC,mBAAmB,CAAC,EAAE,EAC9B,OAAO,CAAC,mBAAmB,CAAC,yBAAyB,EACrD,OAAO,CAAC,IAAI,CACb,CAAC;QACJ,CAAC,CAAC;QACF,MAAM,EAAE,MAAM,CAAC,EAAE,CAAC,QAAQ,CAAC,EAAE,EAAE,MAAM,EAAE;YACrC,MAAM,OAAO,GAAG,KAAK,CAAC,CAAC,OAAO,CAAC,MAAM,CAAC,qBAAqB,CAAC,CAAC;YAC7D,IAAI,CAAC,OAAO;gBAAE,OAAO;YACrB,KAAK,CAAC,CAAC,UAAU;iBACd,yBAAyB,CAAC;gBACzB,EAAE,EAAE,MAAM,CAAC,qBAAqB;gBAChC,OAAO,EAAE,OAAO,CAAC,IAAI;aACtB,CAAC;iBACD,IAAI,CACH,MAAM,CAAC,QAAQ,CAAC,2BAA2B,EAAE,GAAG,EAAE,CAAC,MAAM,CAAC,IAAI,CAAC,CAChE,CAAC;QACN,CAAC,CAAC;KACH,CAAC;AACJ,CAAC,CAAC,CACH,CAAC;AAEJ,MAAM,UAAU,GAAG,CAAC,EAAU,EAAE,KAA+B,EAAE,EAAE,CACjE,KAAK,CAAC,IAAI;IACR,CAAC,CAAC,MAAM,CAAC,OAAO,CAAC,KAAK,CAAC,IAAI,CAAC;IAC5B,CAAC,CAAC,kBAAkB,CAAC,EAAE,EAAE,EAAE,SAAS,EAAE,GAAG,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAC"}

package/lib/AWS/CloudFront/PublicKey.d.ts

@@ -0,0 +1,72 @@
+import * as Redacted from "effect/Redacted";
+import * as Provider from "../../Provider.ts";
+import { Resource } from "../../Resource.ts";
+import type { Providers } from "../Providers.ts";
+export interface PublicKeyProps {
+    /**
+     * Name of the public key. If omitted, a deterministic name is generated.
+     *
+     * Names must be unique per AWS account. Changing the name triggers
+     * a replacement.
+     */
+    name?: string;
+    /**
+     * PEM-encoded public key body. Changing the key material triggers a
+     * replacement (CloudFront does not allow rotating an existing public
+     * key in place).
+     */
+    encodedKey: Redacted.Redacted<string> | string;
+    /**
+     * Optional comment describing the key.
+     */
+    comment?: string;
+}
+export interface PublicKey extends Resource<"AWS.CloudFront.PublicKey", PublicKeyProps, {
+    /**
+     * CloudFront-assigned public key identifier. Used by KeyGroups to
+     * reference the key.
+     */
+    publicKeyId: string;
+    /**
+     * Name of the public key.
+     */
+    name: string;
+    /**
+     * PEM-encoded public key body.
+     */
+    encodedKey: string;
+    /**
+     * Caller reference used at create time. Stable across updates.
+     */
+    callerReference: string;
+    /**
+     * Most recent entity tag for update/delete operations.
+     */
+    etag: string | undefined;
+    /**
+     * Current comment on the key.
+     */
+    comment: string | undefined;
+}, never, Providers> {
+}
+/**
+ * A CloudFront public key.
+ *
+ * Public keys are uploaded ahead of being grouped into a {@link KeyGroup} and
+ * used by Distributions for signed URL or signed cookie verification.
+ *
+ * The key body is immutable after creation — changing `encodedKey` triggers
+ * a replacement (CloudFront returns no API to rotate a key in place).
+ *
+ * @section Creating Public Keys
+ * @example PEM-encoded RSA public key
+ * ```typescript
+ * const key = yield* PublicKey("SignedUrlKey", {
+ *   encodedKey: Redacted.make(yield* fs.readFileString("./public_key.pem")),
+ *   comment: "RSA-2048 signed URL key for /private",
+ * });
+ * ```
+ */
+export declare const PublicKey: import("../../Resource.ts").ResourceClass<PublicKey>;
+export declare const PublicKeyProvider: () => import("effect/Layer").Layer<Provider.Provider<PublicKey>, never, import("effect/unstable/http/HttpClient").HttpClient | import("../../Stage.ts").Stage | import("../../Stack.ts").Stack | import("@distilled.cloud/aws/Region").Region | import("@distilled.cloud/aws/Credentials").Credentials>;
+//# sourceMappingURL=PublicKey.d.ts.map

package/lib/AWS/CloudFront/PublicKey.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"PublicKey.d.ts","sourceRoot":"","sources":["../../../src/AWS/CloudFront/PublicKey.ts"],"names":[],"mappings":"AAEA,OAAO,KAAK,QAAQ,MAAM,iBAAiB,CAAC;AAG5C,OAAO,KAAK,QAAQ,MAAM,mBAAmB,CAAC;AAC9C,OAAO,EAAE,QAAQ,EAAE,MAAM,mBAAmB,CAAC;AAC7C,OAAO,KAAK,EAAE,SAAS,EAAE,MAAM,iBAAiB,CAAC;AAGjD,MAAM,WAAW,cAAc;IAC7B;;;;;OAKG;IACH,IAAI,CAAC,EAAE,MAAM,CAAC;IACd;;;;OAIG;IACH,UAAU,EAAE,QAAQ,CAAC,QAAQ,CAAC,MAAM,CAAC,GAAG,MAAM,CAAC;IAC/C;;OAEG;IACH,OAAO,CAAC,EAAE,MAAM,CAAC;CAClB;AAED,MAAM,WAAW,SAAU,SAAQ,QAAQ,CACzC,0BAA0B,EAC1B,cAAc,EACd;IACE;;;OAGG;IACH,WAAW,EAAE,MAAM,CAAC;IACpB;;OAEG;IACH,IAAI,EAAE,MAAM,CAAC;IACb;;OAEG;IACH,UAAU,EAAE,MAAM,CAAC;IACnB;;OAEG;IACH,eAAe,EAAE,MAAM,CAAC;IACxB;;OAEG;IACH,IAAI,EAAE,MAAM,GAAG,SAAS,CAAC;IACzB;;OAEG;IACH,OAAO,EAAE,MAAM,GAAG,SAAS,CAAC;CAC7B,EACD,KAAK,EACL,SAAS,CACV;CAAG;AAEJ;;;;;;;;;;;;;;;;;GAiBG;AACH,eAAO,MAAM,SAAS,sDAAkD,CAAC;AAEzE,eAAO,MAAM,iBAAiB,ySA2J3B,CAAC"}

package/lib/AWS/CloudFront/PublicKey.js

@@ -0,0 +1,137 @@
+import * as cloudfront from "@distilled.cloud/aws/cloudfront";
+import * as Effect from "effect/Effect";
+import * as Redacted from "effect/Redacted";
+import { isResolved } from "../../Diff.js";
+import { createPhysicalName } from "../../PhysicalName.js";
+import * as Provider from "../../Provider.js";
+import { Resource } from "../../Resource.js";
+import { extractValue } from "./common.js";
+/**
+ * A CloudFront public key.
+ *
+ * Public keys are uploaded ahead of being grouped into a {@link KeyGroup} and
+ * used by Distributions for signed URL or signed cookie verification.
+ *
+ * The key body is immutable after creation — changing `encodedKey` triggers
+ * a replacement (CloudFront returns no API to rotate a key in place).
+ *
+ * @section Creating Public Keys
+ * @example PEM-encoded RSA public key
+ * ```typescript
+ * const key = yield* PublicKey("SignedUrlKey", {
+ *   encodedKey: Redacted.make(yield* fs.readFileString("./public_key.pem")),
+ *   comment: "RSA-2048 signed URL key for /private",
+ * });
+ * ```
+ */
+export const PublicKey = Resource("AWS.CloudFront.PublicKey");
+export const PublicKeyProvider = () => Provider.effect(PublicKey, Effect.gen(function* () {
+    const getById = Effect.fn(function* (id) {
+        const config = yield* cloudfront
+            .getPublicKeyConfig({ Id: id })
+            .pipe(Effect.catchTag("NoSuchPublicKey", () => Effect.succeed(undefined)));
+        if (!config?.PublicKeyConfig)
+            return undefined;
+        return { config: config.PublicKeyConfig, etag: config.ETag };
+    });
+    const getByName = Effect.fn(function* (name) {
+        const listed = yield* cloudfront.listPublicKeys({});
+        const summary = listed.PublicKeyList?.Items?.find((item) => item.Name === name);
+        if (!summary?.Id)
+            return undefined;
+        return yield* getById(summary.Id).pipe(Effect.map((found) => found ? { id: summary.Id, ...found } : undefined));
+    });
+    const buildConfig = (name, callerReference, props) => ({
+        Name: name,
+        CallerReference: callerReference,
+        EncodedKey: extractValue(props.encodedKey),
+        Comment: props.comment,
+    });
+    const toAttrs = (id, config, etag) => ({
+        publicKeyId: id,
+        name: config.Name,
+        encodedKey: config.EncodedKey,
+        callerReference: config.CallerReference,
+        etag,
+        comment: config.Comment,
+    });
+    return {
+        stables: ["publicKeyId", "callerReference"],
+        diff: Effect.fn(function* ({ id, news, olds }) {
+            if (!isResolved(news))
+                return undefined;
+            if ((yield* createName(id, olds ?? {})) !==
+                (yield* createName(id, news))) {
+                return { action: "replace" };
+            }
+            if (isResolved(olds.encodedKey) &&
+                extractValue(olds.encodedKey) !== extractValue(news.encodedKey)) {
+                return { action: "replace" };
+            }
+        }),
+        read: Effect.fn(function* ({ id, olds, output }) {
+            if (output?.publicKeyId) {
+                const found = yield* getById(output.publicKeyId);
+                if (found)
+                    return toAttrs(output.publicKeyId, found.config, found.etag);
+            }
+            const name = yield* createName(id, olds ?? {});
+            const found = yield* getByName(name);
+            if (!found)
+                return undefined;
+            return toAttrs(found.id, found.config, found.etag);
+        }),
+        create: Effect.fn(function* ({ id, news, session }) {
+            const name = yield* createName(id, news);
+            const callerReference = name;
+            const created = yield* cloudfront
+                .createPublicKey({
+                PublicKeyConfig: buildConfig(name, callerReference, news),
+            })
+                .pipe(Effect.catchTag("PublicKeyAlreadyExists", () => getByName(name).pipe(Effect.flatMap((existing) => existing
+                ? Effect.succeed({
+                    PublicKey: {
+                        Id: existing.id,
+                        CreatedTime: new Date(),
+                        PublicKeyConfig: existing.config,
+                    },
+                    ETag: existing.etag,
+                    Location: undefined,
+                })
+                : Effect.fail(new Error(`Public key '${name}' already exists but could not be recovered`))))));
+            if (!created.PublicKey?.Id) {
+                return yield* Effect.fail(new Error("createPublicKey returned no identifier"));
+            }
+            yield* session.note(created.PublicKey.Id);
+            return toAttrs(created.PublicKey.Id, created.PublicKey.PublicKeyConfig, created.ETag);
+        }),
+        update: Effect.fn(function* ({ news, output, session }) {
+            const current = yield* getById(output.publicKeyId);
+            const updated = yield* cloudfront.updatePublicKey({
+                Id: output.publicKeyId,
+                IfMatch: current?.etag ?? output.etag,
+                PublicKeyConfig: buildConfig(output.name, output.callerReference, news),
+            });
+            if (!updated.PublicKey?.Id) {
+                return yield* Effect.fail(new Error("updatePublicKey returned no identifier"));
+            }
+            yield* session.note(output.publicKeyId);
+            return toAttrs(updated.PublicKey.Id, updated.PublicKey.PublicKeyConfig, updated.ETag);
+        }),
+        delete: Effect.fn(function* ({ output }) {
+            const current = yield* getById(output.publicKeyId);
+            if (!current)
+                return;
+            yield* cloudfront
+                .deletePublicKey({
+                Id: output.publicKeyId,
+                IfMatch: current.etag,
+            })
+                .pipe(Effect.catchTag("NoSuchPublicKey", () => Effect.void));
+        }),
+    };
+}));
+const createName = (id, props) => props.name
+    ? Effect.succeed(props.name)
+    : createPhysicalName({ id, maxLength: 128, lowercase: true });
+//# sourceMappingURL=PublicKey.js.map

package/lib/AWS/CloudFront/PublicKey.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"PublicKey.js","sourceRoot":"","sources":["../../../src/AWS/CloudFront/PublicKey.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,UAAU,MAAM,iCAAiC,CAAC;AAC9D,OAAO,KAAK,MAAM,MAAM,eAAe,CAAC;AACxC,OAAO,KAAK,QAAQ,MAAM,iBAAiB,CAAC;AAC5C,OAAO,EAAE,UAAU,EAAE,MAAM,eAAe,CAAC;AAC3C,OAAO,EAAE,kBAAkB,EAAE,MAAM,uBAAuB,CAAC;AAC3D,OAAO,KAAK,QAAQ,MAAM,mBAAmB,CAAC;AAC9C,OAAO,EAAE,QAAQ,EAAE,MAAM,mBAAmB,CAAC;AAE7C,OAAO,EAAE,YAAY,EAAE,MAAM,aAAa,CAAC;AAwD3C;;;;;;;;;;;;;;;;;GAiBG;AACH,MAAM,CAAC,MAAM,SAAS,GAAG,QAAQ,CAAY,0BAA0B,CAAC,CAAC;AAEzE,MAAM,CAAC,MAAM,iBAAiB,GAAG,GAAG,EAAE,CACpC,QAAQ,CAAC,MAAM,CACb,SAAS,EACT,MAAM,CAAC,GAAG,CAAC,QAAQ,CAAC;IAClB,MAAM,OAAO,GAAG,MAAM,CAAC,EAAE,CAAC,QAAQ,CAAC,EAAE,EAAU;QAC7C,MAAM,MAAM,GAAG,KAAK,CAAC,CAAC,UAAU;aAC7B,kBAAkB,CAAC,EAAE,EAAE,EAAE,EAAE,EAAE,CAAC;aAC9B,IAAI,CACH,MAAM,CAAC,QAAQ,CAAC,iBAAiB,EAAE,GAAG,EAAE,CAAC,MAAM,CAAC,OAAO,CAAC,SAAS,CAAC,CAAC,CACpE,CAAC;QACJ,IAAI,CAAC,MAAM,EAAE,eAAe;YAAE,OAAO,SAAS,CAAC;QAC/C,OAAO,EAAE,MAAM,EAAE,MAAM,CAAC,eAAe,EAAE,IAAI,EAAE,MAAM,CAAC,IAAI,EAAE,CAAC;IAC/D,CAAC,CAAC,CAAC;IAEH,MAAM,SAAS,GAAG,MAAM,CAAC,EAAE,CAAC,QAAQ,CAAC,EAAE,IAAY;QACjD,MAAM,MAAM,GAAG,KAAK,CAAC,CAAC,UAAU,CAAC,cAAc,CAAC,EAAE,CAAC,CAAC;QACpD,MAAM,OAAO,GAAG,MAAM,CAAC,aAAa,EAAE,KAAK,EAAE,IAAI,CAC/C,CAAC,IAAI,EAAE,EAAE,CAAC,IAAI,CAAC,IAAI,KAAK,IAAI,CAC7B,CAAC;QACF,IAAI,CAAC,OAAO,EAAE,EAAE;YAAE,OAAO,SAAS,CAAC;QACnC,OAAO,KAAK,CAAC,CAAC,OAAO,CAAC,OAAO,CAAC,EAAE,CAAC,CAAC,IAAI,CACpC,MAAM,CAAC,GAAG,CAAC,CAAC,KAAK,EAAE,EAAE,CACnB,KAAK,CAAC,CAAC,CAAC,EAAE,EAAE,EAAE,OAAO,CAAC,EAAE,EAAE,GAAG,KAAK,EAAE,CAAC,CAAC,CAAC,SAAS,CACjD,CACF,CAAC;IACJ,CAAC,CAAC,CAAC;IAEH,MAAM,WAAW,GAAG,CAClB,IAAY,EACZ,eAAuB,EACvB,KAAqB,EACO,EAAE,CAAC,CAAC;QAChC,IAAI,EAAE,IAAI;QACV,eAAe,EAAE,eAAe;QAChC,UAAU,EAAE,YAAY,CAAC,KAAK,CAAC,UAAU,CAAC;QAC1C,OAAO,EAAE,KAAK,CAAC,OAAO;KACvB,CAAC,CAAC;IAEH,MAAM,OAAO,GAAG,CACd,EAAU,EACV,MAAkC,EAClC,IAAwB,EACxB,EAAE,CAAC,CAAC;QACJ,WAAW,EAAE,EAAE;QACf,IAAI,EAAE,MAAM,CAAC,IAAI;QACjB,UAAU,EAAE,MAAM,CAAC,UAAU;QAC7B,eAAe,EAAE,MAAM,CAAC,eAAe;QACvC,IAAI;QACJ,OAAO,EAAE,MAAM,CAAC,OAAO;KACxB,CAAC,CAAC;IAEH,OAAO;QACL,OAAO,EAAE,CAAC,aAAa,EAAE,iBAAiB,CAAC;QAC3C,IAAI,EAAE,MAAM,CAAC,EAAE,CAAC,QAAQ,CAAC,EAAE,EAAE,EAAE,EAAE,IAAI,EAAE,IAAI,EAAE;YAC3C,IAAI,CAAC,UAAU,CAAC,IAAI,CAAC;gBAAE,OAAO,SAAS,CAAC;YACxC,IACE,CAAC,KAAK,CAAC,CAAC,UAAU,CAAC,EAAE,EAAE,IAAI,IAAI,EAAE,CAAC,CAAC;gBACnC,CAAC,KAAK,CAAC,CAAC,UAAU,CAAC,EAAE,EAAE,IAAI,CAAC,CAAC,EAC7B,CAAC;gBACD,OAAO,EAAE,MAAM,EAAE,SAAS,EAAW,CAAC;YACxC,CAAC;YACD,IACE,UAAU,CAAC,IAAI,CAAC,UAAU,CAAC;gBAC3B,YAAY,CAAC,IAAI,CAAC,UAAU,CAAC,KAAK,YAAY,CAAC,IAAI,CAAC,UAAU,CAAC,EAC/D,CAAC;gBACD,OAAO,EAAE,MAAM,EAAE,SAAS,EAAW,CAAC;YACxC,CAAC;QACH,CAAC,CAAC;QACF,IAAI,EAAE,MAAM,CAAC,EAAE,CAAC,QAAQ,CAAC,EAAE,EAAE,EAAE,EAAE,IAAI,EAAE,MAAM,EAAE;YAC7C,IAAI,MAAM,EAAE,WAAW,EAAE,CAAC;gBACxB,MAAM,KAAK,GAAG,KAAK,CAAC,CAAC,OAAO,CAAC,MAAM,CAAC,WAAW,CAAC,CAAC;gBACjD,IAAI,KAAK;oBAAE,OAAO,OAAO,CAAC,MAAM,CAAC,WAAW,EAAE,KAAK,CAAC,MAAM,EAAE,KAAK,CAAC,IAAI,CAAC,CAAC;YAC1E,CAAC;YACD,MAAM,IAAI,GAAG,KAAK,CAAC,CAAC,UAAU,CAAC,EAAE,EAAE,IAAI,IAAI,EAAE,CAAC,CAAC;YAC/C,MAAM,KAAK,GAAG,KAAK,CAAC,CAAC,SAAS,CAAC,IAAI,CAAC,CAAC;YACrC,IAAI,CAAC,KAAK;gBAAE,OAAO,SAAS,CAAC;YAC7B,OAAO,OAAO,CAAC,KAAK,CAAC,EAAE,EAAE,KAAK,CAAC,MAAM,EAAE,KAAK,CAAC,IAAI,CAAC,CAAC;QACrD,CAAC,CAAC;QACF,MAAM,EAAE,MAAM,CAAC,EAAE,CAAC,QAAQ,CAAC,EAAE,EAAE,EAAE,EAAE,IAAI,EAAE,OAAO,EAAE;YAChD,MAAM,IAAI,GAAG,KAAK,CAAC,CAAC,UAAU,CAAC,EAAE,EAAE,IAAI,CAAC,CAAC;YACzC,MAAM,eAAe,GAAG,IAAI,CAAC;YAC7B,MAAM,OAAO,GAAG,KAAK,CAAC,CAAC,UAAU;iBAC9B,eAAe,CAAC;gBACf,eAAe,EAAE,WAAW,CAAC,IAAI,EAAE,eAAe,EAAE,IAAI,CAAC;aAC1D,CAAC;iBACD,IAAI,CACH,MAAM,CAAC,QAAQ,CAAC,wBAAwB,EAAE,GAAG,EAAE,CAC7C,SAAS,CAAC,IAAI,CAAC,CAAC,IAAI,CAClB,MAAM,CAAC,OAAO,CAAC,CAAC,QAAQ,EAAE,EAAE,CAC1B,QAAQ;gBACN,CAAC,CAAC,MAAM,CAAC,OAAO,CAAC;oBACb,SAAS,EAAE;wBACT,EAAE,EAAE,QAAQ,CAAC,EAAE;wBACf,WAAW,EAAE,IAAI,IAAI,EAAE;wBACvB,eAAe,EAAE,QAAQ,CAAC,MAAM;qBACjC;oBACD,IAAI,EAAE,QAAQ,CAAC,IAAI;oBACnB,QAAQ,EAAE,SAAS;iBACpB,CAAC;gBACJ,CAAC,CAAC,MAAM,CAAC,IAAI,CACT,IAAI,KAAK,CACP,eAAe,IAAI,6CAA6C,CACjE,CACF,CACN,CACF,CACF,CACF,CAAC;YACJ,IAAI,CAAC,OAAO,CAAC,SAAS,EAAE,EAAE,EAAE,CAAC;gBAC3B,OAAO,KAAK,CAAC,CAAC,MAAM,CAAC,IAAI,CACvB,IAAI,KAAK,CAAC,wCAAwC,CAAC,CACpD,CAAC;YACJ,CAAC;YACD,KAAK,CAAC,CAAC,OAAO,CAAC,IAAI,CAAC,OAAO,CAAC,SAAS,CAAC,EAAE,CAAC,CAAC;YAC1C,OAAO,OAAO,CACZ,OAAO,CAAC,SAAS,CAAC,EAAE,EACpB,OAAO,CAAC,SAAS,CAAC,eAAe,EACjC,OAAO,CAAC,IAAI,CACb,CAAC;QACJ,CAAC,CAAC;QACF,MAAM,EAAE,MAAM,CAAC,EAAE,CAAC,QAAQ,CAAC,EAAE,EAAE,IAAI,EAAE,MAAM,EAAE,OAAO,EAAE;YACpD,MAAM,OAAO,GAAG,KAAK,CAAC,CAAC,OAAO,CAAC,MAAM,CAAC,WAAW,CAAC,CAAC;YACnD,MAAM,OAAO,GAAG,KAAK,CAAC,CAAC,UAAU,CAAC,eAAe,CAAC;gBAChD,EAAE,EAAE,MAAM,CAAC,WAAW;gBACtB,OAAO,EAAE,OAAO,EAAE,IAAI,IAAI,MAAM,CAAC,IAAI;gBACrC,eAAe,EAAE,WAAW,CAC1B,MAAM,CAAC,IAAI,EACX,MAAM,CAAC,eAAe,EACtB,IAAI,CACL;aACF,CAAC,CAAC;YACH,IAAI,CAAC,OAAO,CAAC,SAAS,EAAE,EAAE,EAAE,CAAC;gBAC3B,OAAO,KAAK,CAAC,CAAC,MAAM,CAAC,IAAI,CACvB,IAAI,KAAK,CAAC,wCAAwC,CAAC,CACpD,CAAC;YACJ,CAAC;YACD,KAAK,CAAC,CAAC,OAAO,CAAC,IAAI,CAAC,MAAM,CAAC,WAAW,CAAC,CAAC;YACxC,OAAO,OAAO,CACZ,OAAO,CAAC,SAAS,CAAC,EAAE,EACpB,OAAO,CAAC,SAAS,CAAC,eAAe,EACjC,OAAO,CAAC,IAAI,CACb,CAAC;QACJ,CAAC,CAAC;QACF,MAAM,EAAE,MAAM,CAAC,EAAE,CAAC,QAAQ,CAAC,EAAE,EAAE,MAAM,EAAE;YACrC,MAAM,OAAO,GAAG,KAAK,CAAC,CAAC,OAAO,CAAC,MAAM,CAAC,WAAW,CAAC,CAAC;YACnD,IAAI,CAAC,OAAO;gBAAE,OAAO;YACrB,KAAK,CAAC,CAAC,UAAU;iBACd,eAAe,CAAC;gBACf,EAAE,EAAE,MAAM,CAAC,WAAW;gBACtB,OAAO,EAAE,OAAO,CAAC,IAAI;aACtB,CAAC;iBACD,IAAI,CAAC,MAAM,CAAC,QAAQ,CAAC,iBAAiB,EAAE,GAAG,EAAE,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC,CAAC;QACjE,CAAC,CAAC;KACH,CAAC;AACJ,CAAC,CAAC,CACH,CAAC;AAEJ,MAAM,UAAU,GAAG,CAAC,EAAU,EAAE,KAAqB,EAAE,EAAE,CACvD,KAAK,CAAC,IAAI;IACR,CAAC,CAAC,MAAM,CAAC,OAAO,CAAC,KAAK,CAAC,IAAI,CAAC;IAC5B,CAAC,CAAC,kBAAkB,CAAC,EAAE,EAAE,EAAE,SAAS,EAAE,GAAG,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAC"}