alchemy 2.0.0-beta.4 → 2.0.0-beta.41

package/lib/AWS/EC2/NatGateway.js

@@ -0,0 +1,243 @@
+import * as ec2 from "@distilled.cloud/aws/ec2";
+import { Region } from "@distilled.cloud/aws/Region";
+import * as Data from "effect/Data";
+import * as Effect from "effect/Effect";
+import * as Schedule from "effect/Schedule";
+import { isResolved } from "../../Diff.js";
+import * as Provider from "../../Provider.js";
+import { Resource } from "../../Resource.js";
+import { createAlchemyTagFilters, createInternalTags, createTagsList, diffTags, } from "../../Tags.js";
+import { AWSEnvironment } from "../Environment.js";
+export const NatGatewayId = (id) => `nat-${id}`;
+export const NatGateway = Resource("AWS.EC2.NatGateway");
+export const NatGatewayProvider = () => Provider.effect(NatGateway, Effect.gen(function* () {
+    const region = yield* Region;
+    const { accountId } = yield* AWSEnvironment;
+    const createTags = Effect.fn(function* (id, tags) {
+        return {
+            Name: id,
+            ...(yield* createInternalTags(id)),
+            ...tags,
+        };
+    });
+    const describeNatGateway = (natGatewayId) => ec2.describeNatGateways({ NatGatewayIds: [natGatewayId] }).pipe(Effect.map((r) => r.NatGateways?.[0]), Effect.flatMap((gw) => gw
+        ? Effect.succeed(gw)
+        : Effect.fail(new Error(`NAT Gateway ${natGatewayId} not found`))));
+    const toAttrs = (gw) => {
+        const primaryAddress = gw.NatGatewayAddresses?.find((a) => a.IsPrimary) ??
+            gw.NatGatewayAddresses?.[0];
+        return {
+            natGatewayId: gw.NatGatewayId,
+            natGatewayArn: `arn:aws:ec2:${region}:${accountId}:natgateway/${gw.NatGatewayId}`,
+            subnetId: gw.SubnetId,
+            vpcId: gw.VpcId,
+            state: gw.State,
+            connectivityType: gw.ConnectivityType,
+            publicIp: primaryAddress?.PublicIp,
+            privateIp: primaryAddress?.PrivateIp,
+            natGatewayAddresses: gw.NatGatewayAddresses?.map((a) => ({
+                allocationId: a.AllocationId,
+                networkInterfaceId: a.NetworkInterfaceId,
+                privateIp: a.PrivateIp,
+                publicIp: a.PublicIp,
+                associationId: a.AssociationId,
+                isPrimary: a.IsPrimary,
+                failureMessage: a.FailureMessage,
+                status: a.Status,
+            })),
+            failureCode: gw.FailureCode,
+            failureMessage: gw.FailureMessage,
+            createTime: gw.CreateTime instanceof Date
+                ? gw.CreateTime.toISOString()
+                : gw.CreateTime,
+            deleteTime: gw.DeleteTime instanceof Date
+                ? gw.DeleteTime.toISOString()
+                : gw.DeleteTime,
+        };
+    };
+    // Find NAT Gateway by alchemy tags when we don't have the ID
+    const findNatGatewayByTags = Effect.fn(function* (id) {
+        const filters = yield* createAlchemyTagFilters(id);
+        const result = yield* ec2.describeNatGateways({ Filter: filters });
+        // Find a NAT Gateway that's not deleted and has matching tags
+        for (const gw of result.NatGateways ?? []) {
+            return gw;
+        }
+        return undefined;
+    });
+    return {
+        stables: ["natGatewayId", "natGatewayArn", "vpcId"],
+        read: Effect.fn(function* ({ id, output }) {
+            if (output) {
+                // We have the NAT Gateway ID, use it directly
+                return toAttrs(yield* describeNatGateway(output.natGatewayId));
+            }
+            // No output - try to find by tags (recovery from incomplete create)
+            const gw = yield* findNatGatewayByTags(id);
+            if (gw) {
+                return toAttrs(gw);
+            }
+            // Not found
+            return undefined;
+        }),
+        diff: Effect.fn(function* ({ news, olds }) {
+            if (!isResolved(news))
+                return;
+            // NAT Gateway is mostly immutable - any change to core properties requires replacement
+            if (news.subnetId !== olds.subnetId ||
+                news.connectivityType !== olds.connectivityType ||
+                news.allocationId !== olds.allocationId) {
+                return { action: "replace" };
+            }
+            // Tags can be updated in-place
+        }),
+        reconcile: Effect.fn(function* ({ id, news, output, session }) {
+            const desiredTags = yield* createTags(id, news.tags);
+            // Observe — try the cached id first; if missing, search by alchemy
+            // tags so an interrupted create can recover before re-running the
+            // API. We treat a non-deleted match as ours because diff/replace
+            // already covers immutable property changes upstream.
+            let gw;
+            if (output?.natGatewayId) {
+                const lookup = yield* ec2
+                    .describeNatGateways({ NatGatewayIds: [output.natGatewayId] })
+                    .pipe(Effect.catchTag("NatGatewayNotFound", () => Effect.succeed({ NatGateways: [] })));
+                gw = lookup.NatGateways?.[0];
+            }
+            else {
+                gw = yield* findNatGatewayByTags(id);
+            }
+            // Treat a deleted/deleting NAT as if it doesn't exist so we recreate.
+            if (gw &&
+                (gw.State === "deleted" ||
+                    gw.State === "deleting" ||
+                    gw.State === "failed")) {
+                gw = undefined;
+            }
+            // Ensure — create the NAT gateway when missing.
+            if (gw === undefined) {
+                yield* session.note("Creating NAT Gateway...");
+                const result = yield* ec2.createNatGateway({
+                    SubnetId: news.subnetId,
+                    AllocationId: news.allocationId,
+                    ConnectivityType: news.connectivityType ?? "public",
+                    PrivateIpAddress: news.privateIpAddress,
+                    SecondaryAllocationIds: news.secondaryAllocationIds,
+                    SecondaryPrivateIpAddresses: news.secondaryPrivateIpAddresses,
+                    SecondaryPrivateIpAddressCount: news.secondaryPrivateIpAddressCount,
+                    TagSpecifications: [
+                        {
+                            ResourceType: "natgateway",
+                            Tags: createTagsList(desiredTags),
+                        },
+                    ],
+                    DryRun: false,
+                });
+                const natGatewayId = result.NatGateway.NatGatewayId;
+                yield* session.note(`NAT Gateway created: ${natGatewayId}`);
+                gw = yield* waitForNatGatewayAvailable(natGatewayId, session);
+            }
+            const natGatewayId = gw.NatGatewayId;
+            // Sync tags — observed cloud tags vs desired.
+            const currentTags = (yield* ec2
+                .describeTags({
+                Filters: [
+                    { Name: "resource-id", Values: [natGatewayId] },
+                    { Name: "resource-type", Values: ["natgateway"] },
+                ],
+            })
+                .pipe(Effect.map((r) => Object.fromEntries(r.Tags?.map((t) => [t.Key, t.Value]) ?? [])))) ?? {};
+            const { removed, upsert } = diffTags(currentTags, desiredTags);
+            if (removed.length > 0) {
+                yield* ec2.deleteTags({
+                    Resources: [natGatewayId],
+                    Tags: removed.map((key) => ({ Key: key })),
+                    DryRun: false,
+                });
+            }
+            if (upsert.length > 0) {
+                yield* ec2.createTags({
+                    Resources: [natGatewayId],
+                    Tags: upsert,
+                    DryRun: false,
+                });
+            }
+            // Re-read final state.
+            const final = yield* describeNatGateway(natGatewayId);
+            return toAttrs(final);
+        }),
+        delete: Effect.fn(function* ({ output, session }) {
+            const natGatewayId = output.natGatewayId;
+            yield* session.note(`Deleting NAT Gateway: ${natGatewayId}`);
+            yield* ec2
+                .deleteNatGateway({
+                NatGatewayId: natGatewayId,
+                DryRun: false,
+            })
+                .pipe(Effect.catchTag("NatGatewayNotFound", () => Effect.void));
+            // Wait for NAT Gateway to be deleted
+            yield* waitForNatGatewayDeleted(natGatewayId, session);
+            yield* session.note(`NAT Gateway ${natGatewayId} deleted`);
+        }),
+    };
+}));
+// Retryable error: NAT Gateway is still pending
+class NatGatewayPending extends Data.TaggedError("NatGatewayPending") {
+}
+// Terminal error: NAT Gateway creation failed
+class NatGatewayFailed extends Data.TaggedError("NatGatewayFailed") {
+}
+// Terminal error: NAT Gateway not found
+class NatGatewayNotFound extends Data.TaggedError("NatGatewayNotFound") {
+}
+/**
+ * Wait for NAT Gateway to be in available state
+ */
+const waitForNatGatewayAvailable = (natGatewayId, session) => Effect.gen(function* () {
+    const result = yield* ec2.describeNatGateways({
+        NatGatewayIds: [natGatewayId],
+    });
+    const gw = result.NatGateways?.[0];
+    if (!gw) {
+        return yield* new NatGatewayNotFound({ natGatewayId });
+    }
+    if (gw.State === "available") {
+        return gw;
+    }
+    if (gw.State === "failed") {
+        return yield* new NatGatewayFailed({
+            natGatewayId,
+            failureCode: gw.FailureCode,
+            failureMessage: gw.FailureMessage,
+        });
+    }
+    // Still pending - this is the only retryable case
+    return yield* new NatGatewayPending({ natGatewayId, state: gw.State });
+}).pipe(Effect.tapError(Effect.logDebug), Effect.retry({
+    while: (e) => e._tag === "NatGatewayPending",
+    schedule: Schedule.fixed(5000).pipe(Schedule.both(Schedule.recurs(60)), // Max 5 minutes
+    Schedule.tapOutput(([, attempt]) => session.note(`Waiting for NAT Gateway to be available... (${(attempt + 1) * 5}s)`))),
+}));
+// Retryable error: NAT Gateway is still deleting
+class NatGatewayDeleting extends Data.TaggedError("NatGatewayDeleting") {
+}
+/**
+ * Wait for NAT Gateway to be deleted
+ */
+const waitForNatGatewayDeleted = (natGatewayId, session) => Effect.gen(function* () {
+    const result = yield* ec2
+        .describeNatGateways({ NatGatewayIds: [natGatewayId] })
+        .pipe(Effect.catchTag("NatGatewayNotFound", () => Effect.succeed({ NatGateways: [] })));
+    const gw = result.NatGateways?.[0];
+    if (!gw || gw.State === "deleted") {
+        return; // Successfully deleted
+    }
+    yield* Effect.logDebug(gw);
+    // Still deleting - this is the only retryable case
+    return yield* new NatGatewayDeleting({ natGatewayId, state: gw.State });
+}).pipe(Effect.tapError(Effect.logDebug), Effect.retry({
+    while: (e) => e._tag === "NatGatewayDeleting",
+    schedule: Schedule.fixed(5000).pipe(Schedule.both(Schedule.recurs(60)), // Max 5 minutes
+    Schedule.tapOutput(([, attempt]) => session.note(`Waiting for NAT Gateway deletion... (${(attempt + 1) * 5}s)`))),
+}));
+//# sourceMappingURL=NatGateway.js.map

package/lib/AWS/EC2/NatGateway.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"NatGateway.js","sourceRoot":"","sources":["../../../src/AWS/EC2/NatGateway.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,GAAG,MAAM,0BAA0B,CAAC;AAChD,OAAO,EAAE,MAAM,EAAE,MAAM,6BAA6B,CAAC;AACrD,OAAO,KAAK,IAAI,MAAM,aAAa,CAAC;AACpC,OAAO,KAAK,MAAM,MAAM,eAAe,CAAC;AACxC,OAAO,KAAK,QAAQ,MAAM,iBAAiB,CAAC;AAG5C,OAAO,EAAE,UAAU,EAAE,MAAM,eAAe,CAAC;AAC3C,OAAO,KAAK,QAAQ,MAAM,mBAAmB,CAAC;AAC9C,OAAO,EAAE,QAAQ,EAAE,MAAM,mBAAmB,CAAC;AAE7C,OAAO,EACL,uBAAuB,EACvB,kBAAkB,EAClB,cAAc,EACd,QAAQ,GACT,MAAM,eAAe,CAAC;AAEvB,OAAO,EAAE,cAAc,EAAE,MAAM,mBAAmB,CAAC;AAMnD,MAAM,CAAC,MAAM,YAAY,GAAG,CAC1B,EAAM,EACiB,EAAE,CAAC,OAAO,EAAE,EAA2B,CAAC;AAuIjE,MAAM,CAAC,MAAM,UAAU,GAAG,QAAQ,CAAa,oBAAoB,CAAC,CAAC;AAErE,MAAM,CAAC,MAAM,kBAAkB,GAAG,GAAG,EAAE,CACrC,QAAQ,CAAC,MAAM,CACb,UAAU,EACV,MAAM,CAAC,GAAG,CAAC,QAAQ,CAAC;IAClB,MAAM,MAAM,GAAG,KAAK,CAAC,CAAC,MAAM,CAAC;IAC7B,MAAM,EAAE,SAAS,EAAE,GAAG,KAAK,CAAC,CAAC,cAAc,CAAC;IAE5C,MAAM,UAAU,GAAG,MAAM,CAAC,EAAE,CAAC,QAAQ,CAAC,EACpC,EAAU,EACV,IAA6B;QAE7B,OAAO;YACL,IAAI,EAAE,EAAE;YACR,GAAG,CAAC,KAAK,CAAC,CAAC,kBAAkB,CAAC,EAAE,CAAC,CAAC;YAClC,GAAG,IAAI;SACR,CAAC;IACJ,CAAC,CAAC,CAAC;IAEH,MAAM,kBAAkB,GAAG,CAAC,YAAoB,EAAE,EAAE,CAClD,GAAG,CAAC,mBAAmB,CAAC,EAAE,aAAa,EAAE,CAAC,YAAY,CAAC,EAAE,CAAC,CAAC,IAAI,CAC7D,MAAM,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,WAAW,EAAE,CAAC,CAAC,CAAC,CAAC,EACrC,MAAM,CAAC,OAAO,CAAC,CAAC,EAAE,EAAE,EAAE,CACpB,EAAE;QACA,CAAC,CAAC,MAAM,CAAC,OAAO,CAAC,EAAE,CAAC;QACpB,CAAC,CAAC,MAAM,CAAC,IAAI,CAAC,IAAI,KAAK,CAAC,eAAe,YAAY,YAAY,CAAC,CAAC,CACpE,CACF,CAAC;IAEJ,MAAM,OAAO,GAAG,CAAC,EAAkB,EAA4B,EAAE;QAC/D,MAAM,cAAc,GAClB,EAAE,CAAC,mBAAmB,EAAE,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,SAAS,CAAC;YAChD,EAAE,CAAC,mBAAmB,EAAE,CAAC,CAAC,CAAC,CAAC;QAC9B,OAAO;YACL,YAAY,EAAE,EAAE,CAAC,YAA4B;YAC7C,aAAa,EACX,eAAe,MAAM,IAAI,SAAS,eAAe,EAAE,CAAC,YAAY,EAAmB;YACrF,QAAQ,EAAE,EAAE,CAAC,QAAoB;YACjC,KAAK,EAAE,EAAE,CAAC,KAAM;YAChB,KAAK,EAAE,EAAE,CAAC,KAAM;YAChB,gBAAgB,EAAE,EAAE,CAAC,gBAAiB;YACtC,QAAQ,EAAE,cAAc,EAAE,QAAQ;YAClC,SAAS,EAAE,cAAc,EAAE,SAAS;YACpC,mBAAmB,EAAE,EAAE,CAAC,mBAAmB,EAAE,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC;gBACvD,YAAY,EAAE,CAAC,CAAC,YAAY;gBAC5B,kBAAkB,EAAE,CAAC,CAAC,kBAAkB;gBACxC,SAAS,EAAE,CAAC,CAAC,SAAS;gBACtB,QAAQ,EAAE,CAAC,CAAC,QAAQ;gBACpB,aAAa,EAAE,CAAC,CAAC,aAAa;gBAC9B,SAAS,EAAE,CAAC,CAAC,SAAS;gBACtB,cAAc,EAAE,CAAC,CAAC,cAAc;gBAChC,MAAM,EAAE,CAAC,CAAC,MAAM;aACjB,CAAC,CAAC;YACH,WAAW,EAAE,EAAE,CAAC,WAAW;YAC3B,cAAc,EAAE,EAAE,CAAC,cAAc;YACjC,UAAU,EACR,EAAE,CAAC,UAAU,YAAY,IAAI;gBAC3B,CAAC,CAAC,EAAE,CAAC,UAAU,CAAC,WAAW,EAAE;gBAC7B,CAAC,CAAE,EAAE,CAAC,UAAiC;YAC3C,UAAU,EACR,EAAE,CAAC,UAAU,YAAY,IAAI;gBAC3B,CAAC,CAAC,EAAE,CAAC,UAAU,CAAC,WAAW,EAAE;gBAC7B,CAAC,CAAE,EAAE,CAAC,UAAiC;SAC5C,CAAC;IACJ,CAAC,CAAC;IAEF,6DAA6D;IAC7D,MAAM,oBAAoB,GAAG,MAAM,CAAC,EAAE,CAAC,QAAQ,CAAC,EAAE,EAAU;QAC1D,MAAM,OAAO,GAAG,KAAK,CAAC,CAAC,uBAAuB,CAAC,EAAE,CAAC,CAAC;QACnD,MAAM,MAAM,GAAG,KAAK,CAAC,CAAC,GAAG,CAAC,mBAAmB,CAAC,EAAE,MAAM,EAAE,OAAO,EAAE,CAAC,CAAC;QAEnE,8DAA8D;QAC9D,KAAK,MAAM,EAAE,IAAI,MAAM,CAAC,WAAW,IAAI,EAAE,EAAE,CAAC;YAC1C,OAAO,EAAE,CAAC;QACZ,CAAC;QACD,OAAO,SAAS,CAAC;IACnB,CAAC,CAAC,CAAC;IAEH,OAAO;QACL,OAAO,EAAE,CAAC,cAAc,EAAE,eAAe,EAAE,OAAO,CAAC;QAEnD,IAAI,EAAE,MAAM,CAAC,EAAE,CAAC,QAAQ,CAAC,EAAE,EAAE,EAAE,EAAE,MAAM,EAAE;YACvC,IAAI,MAAM,EAAE,CAAC;gBACX,8CAA8C;gBAC9C,OAAO,OAAO,CAAC,KAAK,CAAC,CAAC,kBAAkB,CAAC,MAAM,CAAC,YAAY,CAAC,CAAC,CAAC;YACjE,CAAC;YAED,oEAAoE;YACpE,MAAM,EAAE,GAAG,KAAK,CAAC,CAAC,oBAAoB,CAAC,EAAE,CAAC,CAAC;YAC3C,IAAI,EAAE,EAAE,CAAC;gBACP,OAAO,OAAO,CAAC,EAAE,CAAC,CAAC;YACrB,CAAC;YAED,YAAY;YACZ,OAAO,SAAS,CAAC;QACnB,CAAC,CAAC;QAEF,IAAI,EAAE,MAAM,CAAC,EAAE,CAAC,QAAQ,CAAC,EAAE,EAAE,IAAI,EAAE,IAAI,EAAE;YACvC,IAAI,CAAC,UAAU,CAAC,IAAI,CAAC;gBAAE,OAAO;YAC9B,uFAAuF;YACvF,IACE,IAAI,CAAC,QAAQ,KAAK,IAAI,CAAC,QAAQ;gBAC/B,IAAI,CAAC,gBAAgB,KAAK,IAAI,CAAC,gBAAgB;gBAC/C,IAAI,CAAC,YAAY,KAAK,IAAI,CAAC,YAAY,EACvC,CAAC;gBACD,OAAO,EAAE,MAAM,EAAE,SAAS,EAAE,CAAC;YAC/B,CAAC;YACD,+BAA+B;QACjC,CAAC,CAAC;QAEF,SAAS,EAAE,MAAM,CAAC,EAAE,CAAC,QAAQ,CAAC,EAAE,EAAE,EAAE,EAAE,IAAI,EAAE,MAAM,EAAE,OAAO,EAAE;YAC3D,MAAM,WAAW,GAAG,KAAK,CAAC,CAAC,UAAU,CAAC,EAAE,EAAE,IAAI,CAAC,IAAI,CAAC,CAAC;YAErD,mEAAmE;YACnE,kEAAkE;YAClE,iEAAiE;YACjE,sDAAsD;YACtD,IAAI,EAA8B,CAAC;YACnC,IAAI,MAAM,EAAE,YAAY,EAAE,CAAC;gBACzB,MAAM,MAAM,GAAG,KAAK,CAAC,CAAC,GAAG;qBACtB,mBAAmB,CAAC,EAAE,aAAa,EAAE,CAAC,MAAM,CAAC,YAAY,CAAC,EAAE,CAAC;qBAC7D,IAAI,CACH,MAAM,CAAC,QAAQ,CAAC,oBAAoB,EAAE,GAAG,EAAE,CACzC,MAAM,CAAC,OAAO,CAAC,EAAE,WAAW,EAAE,EAAE,EAAE,CAAC,CACpC,CACF,CAAC;gBACJ,EAAE,GAAG,MAAM,CAAC,WAAW,EAAE,CAAC,CAAC,CAAC,CAAC;YAC/B,CAAC;iBAAM,CAAC;gBACN,EAAE,GAAG,KAAK,CAAC,CAAC,oBAAoB,CAAC,EAAE,CAAC,CAAC;YACvC,CAAC;YAED,sEAAsE;YACtE,IACE,EAAE;gBACF,CAAC,EAAE,CAAC,KAAK,KAAK,SAAS;oBACrB,EAAE,CAAC,KAAK,KAAK,UAAU;oBACvB,EAAE,CAAC,KAAK,KAAK,QAAQ,CAAC,EACxB,CAAC;gBACD,EAAE,GAAG,SAAS,CAAC;YACjB,CAAC;YAED,gDAAgD;YAChD,IAAI,EAAE,KAAK,SAAS,EAAE,CAAC;gBACrB,KAAK,CAAC,CAAC,OAAO,CAAC,IAAI,CAAC,yBAAyB,CAAC,CAAC;gBAC/C,MAAM,MAAM,GAAG,KAAK,CAAC,CAAC,GAAG,CAAC,gBAAgB,CAAC;oBACzC,QAAQ,EAAE,IAAI,CAAC,QAAkB;oBACjC,YAAY,EAAE,IAAI,CAAC,YAAkC;oBACrD,gBAAgB,EAAE,IAAI,CAAC,gBAAgB,IAAI,QAAQ;oBACnD,gBAAgB,EAAE,IAAI,CAAC,gBAAgB;oBACvC,sBAAsB,EAAE,IAAI,CAAC,sBAEhB;oBACb,2BAA2B,EAAE,IAAI,CAAC,2BAA2B;oBAC7D,8BAA8B,EAC5B,IAAI,CAAC,8BAA8B;oBACrC,iBAAiB,EAAE;wBACjB;4BACE,YAAY,EAAE,YAAY;4BAC1B,IAAI,EAAE,cAAc,CAAC,WAAW,CAAC;yBAClC;qBACF;oBACD,MAAM,EAAE,KAAK;iBACd,CAAC,CAAC;gBACH,MAAM,YAAY,GAAG,MAAM,CAAC,UAAW,CAAC,YAAa,CAAC;gBACtD,KAAK,CAAC,CAAC,OAAO,CAAC,IAAI,CAAC,wBAAwB,YAAY,EAAE,CAAC,CAAC;gBAC5D,EAAE,GAAG,KAAK,CAAC,CAAC,0BAA0B,CAAC,YAAY,EAAE,OAAO,CAAC,CAAC;YAChE,CAAC;YAED,MAAM,YAAY,GAAG,EAAE,CAAC,YAAa,CAAC;YAEtC,8CAA8C;YAC9C,MAAM,WAAW,GACf,CAAC,KAAK,CAAC,CAAC,GAAG;iBACR,YAAY,CAAC;gBACZ,OAAO,EAAE;oBACP,EAAE,IAAI,EAAE,aAAa,EAAE,MAAM,EAAE,CAAC,YAAY,CAAC,EAAE;oBAC/C,EAAE,IAAI,EAAE,eAAe,EAAE,MAAM,EAAE,CAAC,YAAY,CAAC,EAAE;iBAClD;aACF,CAAC;iBACD,IAAI,CACH,MAAM,CAAC,GAAG,CACR,CAAC,CAAC,EAAE,EAAE,CACJ,MAAM,CAAC,WAAW,CAChB,CAAC,CAAC,IAAI,EAAE,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,CAAC,GAAI,EAAE,CAAC,CAAC,KAAM,CAAC,CAAC,IAAI,EAAE,CACnB,CAC9B,CACF,CAAC,IAAI,EAAE,CAAC;YACb,MAAM,EAAE,OAAO,EAAE,MAAM,EAAE,GAAG,QAAQ,CAAC,WAAW,EAAE,WAAW,CAAC,CAAC;YAC/D,IAAI,OAAO,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;gBACvB,KAAK,CAAC,CAAC,GAAG,CAAC,UAAU,CAAC;oBACpB,SAAS,EAAE,CAAC,YAAY,CAAC;oBACzB,IAAI,EAAE,OAAO,CAAC,GAAG,CAAC,CAAC,GAAG,EAAE,EAAE,CAAC,CAAC,EAAE,GAAG,EAAE,GAAG,EAAE,CAAC,CAAC;oBAC1C,MAAM,EAAE,KAAK;iBACd,CAAC,CAAC;YACL,CAAC;YACD,IAAI,MAAM,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;gBACtB,KAAK,CAAC,CAAC,GAAG,CAAC,UAAU,CAAC;oBACpB,SAAS,EAAE,CAAC,YAAY,CAAC;oBACzB,IAAI,EAAE,MAAM;oBACZ,MAAM,EAAE,KAAK;iBACd,CAAC,CAAC;YACL,CAAC;YAED,uBAAuB;YACvB,MAAM,KAAK,GAAG,KAAK,CAAC,CAAC,kBAAkB,CAAC,YAAY,CAAC,CAAC;YACtD,OAAO,OAAO,CAAC,KAAK,CAAC,CAAC;QACxB,CAAC,CAAC;QAEF,MAAM,EAAE,MAAM,CAAC,EAAE,CAAC,QAAQ,CAAC,EAAE,EAAE,MAAM,EAAE,OAAO,EAAE;YAC9C,MAAM,YAAY,GAAG,MAAM,CAAC,YAAY,CAAC;YAEzC,KAAK,CAAC,CAAC,OAAO,CAAC,IAAI,CAAC,yBAAyB,YAAY,EAAE,CAAC,CAAC;YAE7D,KAAK,CAAC,CAAC,GAAG;iBACP,gBAAgB,CAAC;gBAChB,YAAY,EAAE,YAAY;gBAC1B,MAAM,EAAE,KAAK;aACd,CAAC;iBACD,IAAI,CAAC,MAAM,CAAC,QAAQ,CAAC,oBAAoB,EAAE,GAAG,EAAE,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC,CAAC;YAElE,qCAAqC;YACrC,KAAK,CAAC,CAAC,wBAAwB,CAAC,YAAY,EAAE,OAAO,CAAC,CAAC;YAEvD,KAAK,CAAC,CAAC,OAAO,CAAC,IAAI,CAAC,eAAe,YAAY,UAAU,CAAC,CAAC;QAC7D,CAAC,CAAC;KACH,CAAC;AACJ,CAAC,CAAC,CACH,CAAC;AAEJ,gDAAgD;AAChD,MAAM,iBAAkB,SAAQ,IAAI,CAAC,WAAW,CAAC,mBAAmB,CAGlE;CAAG;AAEL,8CAA8C;AAC9C,MAAM,gBAAiB,SAAQ,IAAI,CAAC,WAAW,CAAC,kBAAkB,CAIhE;CAAG;AAEL,wCAAwC;AACxC,MAAM,kBAAmB,SAAQ,IAAI,CAAC,WAAW,CAAC,oBAAoB,CAEpE;CAAG;AAEL;;GAEG;AACH,MAAM,0BAA0B,GAAG,CACjC,YAAoB,EACpB,OAAgC,EAChC,EAAE,CACF,MAAM,CAAC,GAAG,CAAC,QAAQ,CAAC;IAClB,MAAM,MAAM,GAAG,KAAK,CAAC,CAAC,GAAG,CAAC,mBAAmB,CAAC;QAC5C,aAAa,EAAE,CAAC,YAAY,CAAC;KAC9B,CAAC,CAAC;IACH,MAAM,EAAE,GAAG,MAAM,CAAC,WAAW,EAAE,CAAC,CAAC,CAAC,CAAC;IAEnC,IAAI,CAAC,EAAE,EAAE,CAAC;QACR,OAAO,KAAK,CAAC,CAAC,IAAI,kBAAkB,CAAC,EAAE,YAAY,EAAE,CAAC,CAAC;IACzD,CAAC;IAED,IAAI,EAAE,CAAC,KAAK,KAAK,WAAW,EAAE,CAAC;QAC7B,OAAO,EAAE,CAAC;IACZ,CAAC;IAED,IAAI,EAAE,CAAC,KAAK,KAAK,QAAQ,EAAE,CAAC;QAC1B,OAAO,KAAK,CAAC,CAAC,IAAI,gBAAgB,CAAC;YACjC,YAAY;YACZ,WAAW,EAAE,EAAE,CAAC,WAAW;YAC3B,cAAc,EAAE,EAAE,CAAC,cAAc;SAClC,CAAC,CAAC;IACL,CAAC;IAED,kDAAkD;IAClD,OAAO,KAAK,CAAC,CAAC,IAAI,iBAAiB,CAAC,EAAE,YAAY,EAAE,KAAK,EAAE,EAAE,CAAC,KAAM,EAAE,CAAC,CAAC;AAC1E,CAAC,CAAC,CAAC,IAAI,CACL,MAAM,CAAC,QAAQ,CAAC,MAAM,CAAC,QAAQ,CAAC,EAChC,MAAM,CAAC,KAAK,CAAC;IACX,KAAK,EAAE,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,KAAK,mBAAmB;IAC5C,QAAQ,EAAE,QAAQ,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC,IAAI,CACjC,QAAQ,CAAC,IAAI,CAAC,QAAQ,CAAC,MAAM,CAAC,EAAE,CAAC,CAAC,EAAE,gBAAgB;IACpD,QAAQ,CAAC,SAAS,CAAC,CAAC,CAAC,EAAE,OAAO,CAAC,EAAE,EAAE,CACjC,OAAO,CAAC,IAAI,CACV,+CAA+C,CAAC,OAAO,GAAG,CAAC,CAAC,GAAG,CAAC,IAAI,CACrE,CACF,CACF;CACF,CAAC,CACH,CAAC;AAEJ,iDAAiD;AACjD,MAAM,kBAAmB,SAAQ,IAAI,CAAC,WAAW,CAAC,oBAAoB,CAGpE;CAAG;AAEL;;GAEG;AACH,MAAM,wBAAwB,GAAG,CAC/B,YAAoB,EACpB,OAAgC,EAChC,EAAE,CACF,MAAM,CAAC,GAAG,CAAC,QAAQ,CAAC;IAClB,MAAM,MAAM,GAAG,KAAK,CAAC,CAAC,GAAG;SACtB,mBAAmB,CAAC,EAAE,aAAa,EAAE,CAAC,YAAY,CAAC,EAAE,CAAC;SACtD,IAAI,CACH,MAAM,CAAC,QAAQ,CAAC,oBAAoB,EAAE,GAAG,EAAE,CACzC,MAAM,CAAC,OAAO,CAAC,EAAE,WAAW,EAAE,EAAE,EAAE,CAAC,CACpC,CACF,CAAC;IAEJ,MAAM,EAAE,GAAG,MAAM,CAAC,WAAW,EAAE,CAAC,CAAC,CAAC,CAAC;IAEnC,IAAI,CAAC,EAAE,IAAI,EAAE,CAAC,KAAK,KAAK,SAAS,EAAE,CAAC;QAClC,OAAO,CAAC,uBAAuB;IACjC,CAAC;IAED,KAAK,CAAC,CAAC,MAAM,CAAC,QAAQ,CAAC,EAAE,CAAC,CAAC;IAE3B,mDAAmD;IACnD,OAAO,KAAK,CAAC,CAAC,IAAI,kBAAkB,CAAC,EAAE,YAAY,EAAE,KAAK,EAAE,EAAE,CAAC,KAAM,EAAE,CAAC,CAAC;AAC3E,CAAC,CAAC,CAAC,IAAI,CACL,MAAM,CAAC,QAAQ,CAAC,MAAM,CAAC,QAAQ,CAAC,EAChC,MAAM,CAAC,KAAK,CAAC;IACX,KAAK,EAAE,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,KAAK,oBAAoB;IAC7C,QAAQ,EAAE,QAAQ,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC,IAAI,CACjC,QAAQ,CAAC,IAAI,CAAC,QAAQ,CAAC,MAAM,CAAC,EAAE,CAAC,CAAC,EAAE,gBAAgB;IACpD,QAAQ,CAAC,SAAS,CAAC,CAAC,CAAC,EAAE,OAAO,CAAC,EAAE,EAAE,CACjC,OAAO,CAAC,IAAI,CACV,wCAAwC,CAAC,OAAO,GAAG,CAAC,CAAC,GAAG,CAAC,IAAI,CAC9D,CACF,CACF;CACF,CAAC,CACH,CAAC"}

package/lib/AWS/EC2/Network.d.ts

@@ -0,0 +1,127 @@
+import { Region } from "@distilled.cloud/aws/Region";
+import * as Effect from "effect/Effect";
+import type { EIP as EIPResource } from "./EIP.ts";
+import type { InternetGateway as InternetGatewayResource } from "./InternetGateway.ts";
+import type { NatGateway as NatGatewayResource } from "./NatGateway.ts";
+import type { Route as RouteResource } from "./Route.ts";
+import type { RouteTable as RouteTableResource } from "./RouteTable.ts";
+import type { RouteTableAssociation as RouteTableAssociationResource } from "./RouteTableAssociation.ts";
+import type { Subnet as SubnetResource } from "./Subnet.ts";
+import type { Vpc as VpcResource } from "./Vpc.ts";
+import type { VpcEndpoint as VpcEndpointResource } from "./VpcEndpoint.ts";
+export type NetworkNat = "none" | "single" | "per-az";
+export type NetworkGatewayEndpoint = "s3" | "dynamodb";
+export interface NetworkProps {
+    /**
+     * IPv4 CIDR block for the VPC.
+     * @example "10.42.0.0/16"
+     */
+    cidrBlock: string;
+    /**
+     * Number of Availability Zones to span or an explicit ordered list of zone names.
+     * Defaults to 2 available zones.
+     */
+    availabilityZones?: number | string[];
+    /**
+     * NAT strategy for private subnets.
+     * - `"none"` keeps private subnets isolated
+     * - `"single"` creates one shared NAT gateway
+     * - `"per-az"` creates one NAT gateway per Availability Zone
+     * @default "none"
+     */
+    nat?: NetworkNat;
+    /**
+     * Gateway endpoints to attach to the private route tables.
+     * Supported in v1: S3 and DynamoDB.
+     */
+    gatewayEndpoints?: NetworkGatewayEndpoint[];
+    /**
+     * Whether DNS resolution is supported for the VPC.
+     * @default true
+     */
+    enableDnsSupport?: boolean;
+    /**
+     * Whether instances launched in the VPC receive DNS hostnames.
+     * @default true
+     */
+    enableDnsHostnames?: boolean;
+    /**
+     * Tags to apply to all created resources.
+     */
+    tags?: Record<string, string>;
+}
+export interface NetworkResources {
+    availabilityZones: string[];
+    vpc: VpcResource;
+    internetGateway?: InternetGatewayResource;
+    elasticIps: EIPResource[];
+    natGateways: NatGatewayResource[];
+    publicSubnets: SubnetResource[];
+    privateSubnets: SubnetResource[];
+    publicRouteTables: RouteTableResource[];
+    privateRouteTables: RouteTableResource[];
+    publicRoutes: RouteResource[];
+    privateRoutes: RouteResource[];
+    publicRouteAssociations: RouteTableAssociationResource[];
+    privateRouteAssociations: RouteTableAssociationResource[];
+    gatewayEndpoints: VpcEndpointResource[];
+    vpcId: VpcResource["vpcId"];
+    publicSubnetIds: Array<SubnetResource["subnetId"]>;
+    privateSubnetIds: Array<SubnetResource["subnetId"]>;
+}
+export type Network = Effect.Success<ReturnType<typeof Network>>;
+/**
+ * Creates a production-shaped VPC network from the low-level EC2 primitives.
+ *
+ * `Network` is the ergonomic entry point for users who want a ready-to-use VPC
+ * layout without manually creating route tables, internet gateways, NAT
+ * gateways, and subnet associations by hand.
+ *
+ * The helper still returns the underlying canonical resources so callers can
+ * keep composing with raw `AWS.EC2.*` APIs when they need more control.
+ *
+ * @example Minimal network
+ * ```typescript
+ * const network = yield* AWS.EC2.Network("AppNetwork", {
+ *   cidrBlock: "10.42.0.0/16",
+ * });
+ * ```
+ *
+ * @example ECS-ready network with shared NAT
+ * ```typescript
+ * const network = yield* AWS.EC2.Network("AppNetwork", {
+ *   cidrBlock: "10.42.0.0/16",
+ *   availabilityZones: 2,
+ *   nat: "single",
+ *   gatewayEndpoints: ["s3"],
+ * });
+ *
+ * yield* AWS.ECS.Service("ApiService", {
+ *   cluster,
+ *   task: apiTask,
+ *   vpcId: network.vpcId,
+ *   subnets: network.publicSubnetIds,
+ *   assignPublicIp: true,
+ * });
+ * ```
+ */
+export declare const Network: (id: string, props: NetworkProps) => Effect.Effect<{
+    availabilityZones: string[];
+    vpc: VpcResource;
+    internetGateway: InternetGatewayResource;
+    elasticIps: EIPResource[];
+    natGateways: NatGatewayResource[];
+    publicSubnets: SubnetResource[];
+    privateSubnets: SubnetResource[];
+    publicRouteTables: RouteTableResource[];
+    privateRouteTables: RouteTableResource[];
+    publicRoutes: RouteResource[];
+    privateRoutes: RouteResource[];
+    publicRouteAssociations: RouteTableAssociationResource[];
+    privateRouteAssociations: RouteTableAssociationResource[];
+    gatewayEndpoints: VpcEndpointResource[];
+    vpcId: import("../../Output.ts").Output<`vpc-${string}`, never>;
+    publicSubnetIds: import("../../Output.ts").Output<`subnet-${string}`, never>[];
+    privateSubnetIds: import("../../Output.ts").Output<`subnet-${string}`, never>[];
+}, never, import("effect/unstable/http/HttpClient").HttpClient | import("../Providers.ts").Providers | Region | import("@distilled.cloud/aws/Credentials").Credentials>;
+//# sourceMappingURL=Network.d.ts.map

package/lib/AWS/EC2/Network.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"Network.d.ts","sourceRoot":"","sources":["../../../src/AWS/EC2/Network.ts"],"names":[],"mappings":"AACA,OAAO,EAAE,MAAM,EAAE,MAAM,6BAA6B,CAAC;AACrD,OAAO,KAAK,MAAM,MAAM,eAAe,CAAC;AAExC,OAAO,KAAK,EAAE,GAAG,IAAI,WAAW,EAAE,MAAM,UAAU,CAAC;AAEnD,OAAO,KAAK,EAAE,eAAe,IAAI,uBAAuB,EAAE,MAAM,sBAAsB,CAAC;AAEvF,OAAO,KAAK,EAAE,UAAU,IAAI,kBAAkB,EAAE,MAAM,iBAAiB,CAAC;AAExE,OAAO,KAAK,EAAE,KAAK,IAAI,aAAa,EAAE,MAAM,YAAY,CAAC;AAEzD,OAAO,KAAK,EAAE,UAAU,IAAI,kBAAkB,EAAE,MAAM,iBAAiB,CAAC;AAExE,OAAO,KAAK,EAAE,qBAAqB,IAAI,6BAA6B,EAAE,MAAM,4BAA4B,CAAC;AAEzG,OAAO,KAAK,EAAE,MAAM,IAAI,cAAc,EAAE,MAAM,aAAa,CAAC;AAE5D,OAAO,KAAK,EAAE,GAAG,IAAI,WAAW,EAAE,MAAM,UAAU,CAAC;AAEnD,OAAO,KAAK,EAAE,WAAW,IAAI,mBAAmB,EAAE,MAAM,kBAAkB,CAAC;AAG3E,MAAM,MAAM,UAAU,GAAG,MAAM,GAAG,QAAQ,GAAG,QAAQ,CAAC;AAEtD,MAAM,MAAM,sBAAsB,GAAG,IAAI,GAAG,UAAU,CAAC;AAEvD,MAAM,WAAW,YAAY;IAC3B;;;OAGG;IACH,SAAS,EAAE,MAAM,CAAC;IAElB;;;OAGG;IACH,iBAAiB,CAAC,EAAE,MAAM,GAAG,MAAM,EAAE,CAAC;IAEtC;;;;;;OAMG;IACH,GAAG,CAAC,EAAE,UAAU,CAAC;IAEjB;;;OAGG;IACH,gBAAgB,CAAC,EAAE,sBAAsB,EAAE,CAAC;IAE5C;;;OAGG;IACH,gBAAgB,CAAC,EAAE,OAAO,CAAC;IAE3B;;;OAGG;IACH,kBAAkB,CAAC,EAAE,OAAO,CAAC;IAE7B;;OAEG;IACH,IAAI,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;CAC/B;AAED,MAAM,WAAW,gBAAgB;IAC/B,iBAAiB,EAAE,MAAM,EAAE,CAAC;IAC5B,GAAG,EAAE,WAAW,CAAC;IACjB,eAAe,CAAC,EAAE,uBAAuB,CAAC;IAC1C,UAAU,EAAE,WAAW,EAAE,CAAC;IAC1B,WAAW,EAAE,kBAAkB,EAAE,CAAC;IAClC,aAAa,EAAE,cAAc,EAAE,CAAC;IAChC,cAAc,EAAE,cAAc,EAAE,CAAC;IACjC,iBAAiB,EAAE,kBAAkB,EAAE,CAAC;IACxC,kBAAkB,EAAE,kBAAkB,EAAE,CAAC;IACzC,YAAY,EAAE,aAAa,EAAE,CAAC;IAC9B,aAAa,EAAE,aAAa,EAAE,CAAC;IAC/B,uBAAuB,EAAE,6BAA6B,EAAE,CAAC;IACzD,wBAAwB,EAAE,6BAA6B,EAAE,CAAC;IAC1D,gBAAgB,EAAE,mBAAmB,EAAE,CAAC;IACxC,KAAK,EAAE,WAAW,CAAC,OAAO,CAAC,CAAC;IAC5B,eAAe,EAAE,KAAK,CAAC,cAAc,CAAC,UAAU,CAAC,CAAC,CAAC;IACnD,gBAAgB,EAAE,KAAK,CAAC,cAAc,CAAC,UAAU,CAAC,CAAC,CAAC;CACrD;AAED,MAAM,MAAM,OAAO,GAAG,MAAM,CAAC,OAAO,CAAC,UAAU,CAAC,OAAO,OAAO,CAAC,CAAC,CAAC;AAEjE;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAkCG;AACH,eAAO,MAAM,OAAO,GAAI,IAAI,MAAM,EAAE,OAAO,YAAY;;;;;;;;;;;;;;;;;;uKAsNpD,CAAC"}

package/lib/AWS/EC2/Network.js

@@ -0,0 +1,279 @@
+import * as ec2 from "@distilled.cloud/aws/ec2";
+import { Region } from "@distilled.cloud/aws/Region";
+import * as Effect from "effect/Effect";
+import * as Namespace from "../../Namespace.js";
+import { EIP } from "./EIP.js";
+import { InternetGateway } from "./InternetGateway.js";
+import { NatGateway } from "./NatGateway.js";
+import { Route } from "./Route.js";
+import { RouteTable } from "./RouteTable.js";
+import { RouteTableAssociation } from "./RouteTableAssociation.js";
+import { Subnet } from "./Subnet.js";
+import { Vpc } from "./Vpc.js";
+import { VpcEndpoint } from "./VpcEndpoint.js";
+/**
+ * Creates a production-shaped VPC network from the low-level EC2 primitives.
+ *
+ * `Network` is the ergonomic entry point for users who want a ready-to-use VPC
+ * layout without manually creating route tables, internet gateways, NAT
+ * gateways, and subnet associations by hand.
+ *
+ * The helper still returns the underlying canonical resources so callers can
+ * keep composing with raw `AWS.EC2.*` APIs when they need more control.
+ *
+ * @example Minimal network
+ * ```typescript
+ * const network = yield* AWS.EC2.Network("AppNetwork", {
+ *   cidrBlock: "10.42.0.0/16",
+ * });
+ * ```
+ *
+ * @example ECS-ready network with shared NAT
+ * ```typescript
+ * const network = yield* AWS.EC2.Network("AppNetwork", {
+ *   cidrBlock: "10.42.0.0/16",
+ *   availabilityZones: 2,
+ *   nat: "single",
+ *   gatewayEndpoints: ["s3"],
+ * });
+ *
+ * yield* AWS.ECS.Service("ApiService", {
+ *   cluster,
+ *   task: apiTask,
+ *   vpcId: network.vpcId,
+ *   subnets: network.publicSubnetIds,
+ *   assignPublicIp: true,
+ * });
+ * ```
+ */
+export const Network = (id, props) => Namespace.push(id, Effect.gen(function* () {
+    const availabilityZones = yield* resolveAvailabilityZones(props.availabilityZones);
+    const subnetCidrs = deriveSubnetCidrs(props.cidrBlock, availabilityZones.length);
+    const tags = props.tags;
+    const vpc = yield* Vpc("Vpc", {
+        cidrBlock: props.cidrBlock,
+        enableDnsSupport: props.enableDnsSupport ?? true,
+        enableDnsHostnames: props.enableDnsHostnames ?? true,
+        tags,
+    });
+    const internetGateway = yield* InternetGateway("InternetGateway", {
+        vpcId: vpc.vpcId,
+        tags,
+    });
+    const publicSubnets = [];
+    const privateSubnets = [];
+    for (const [index, availabilityZone] of availabilityZones.entries()) {
+        const publicSubnet = yield* Subnet(`PublicSubnet${index + 1}`, {
+            vpcId: vpc.vpcId,
+            cidrBlock: subnetCidrs.public[index],
+            availabilityZone,
+            mapPublicIpOnLaunch: true,
+            tags: {
+                ...tags,
+                Tier: "public",
+            },
+        });
+        publicSubnets.push(publicSubnet);
+        const privateSubnet = yield* Subnet(`PrivateSubnet${index + 1}`, {
+            vpcId: vpc.vpcId,
+            cidrBlock: subnetCidrs.private[index],
+            availabilityZone,
+            tags: {
+                ...tags,
+                Tier: "private",
+            },
+        });
+        privateSubnets.push(privateSubnet);
+    }
+    const publicRouteTable = yield* RouteTable("PublicRouteTable", {
+        vpcId: vpc.vpcId,
+        tags: {
+            ...tags,
+            Tier: "public",
+        },
+    });
+    const publicInternetRoute = yield* Route("PublicInternetRoute", {
+        routeTableId: publicRouteTable.routeTableId,
+        destinationCidrBlock: "0.0.0.0/0",
+        gatewayId: internetGateway.internetGatewayId,
+    });
+    const publicRouteAssociations = [];
+    for (const [index, subnet] of publicSubnets.entries()) {
+        publicRouteAssociations.push(yield* RouteTableAssociation(`PublicSubnetAssociation${index + 1}`, {
+            routeTableId: publicRouteTable.routeTableId,
+            subnetId: subnet.subnetId,
+        }));
+    }
+    const nat = props.nat ?? "none";
+    const elasticIps = [];
+    const natGateways = [];
+    const privateRouteTables = [];
+    const privateRoutes = [];
+    const privateRouteAssociations = [];
+    if (nat === "per-az") {
+        for (const [index, subnet] of publicSubnets.entries()) {
+            const eip = yield* EIP(`NatEip${index + 1}`, {
+                domain: "vpc",
+                tags,
+            });
+            elasticIps.push(eip);
+            const natGateway = yield* NatGateway(`NatGateway${index + 1}`, {
+                subnetId: subnet.subnetId,
+                allocationId: eip.allocationId,
+                connectivityType: "public",
+                tags,
+            });
+            natGateways.push(natGateway);
+            const privateRouteTable = yield* RouteTable(`PrivateRouteTable${index + 1}`, {
+                vpcId: vpc.vpcId,
+                tags: {
+                    ...tags,
+                    Tier: "private",
+                },
+            });
+            privateRouteTables.push(privateRouteTable);
+            privateRoutes.push(yield* Route(`PrivateInternetRoute${index + 1}`, {
+                routeTableId: privateRouteTable.routeTableId,
+                destinationCidrBlock: "0.0.0.0/0",
+                natGatewayId: natGateway.natGatewayId,
+            }));
+            privateRouteAssociations.push(yield* RouteTableAssociation(`PrivateSubnetAssociation${index + 1}`, {
+                routeTableId: privateRouteTable.routeTableId,
+                subnetId: privateSubnets[index].subnetId,
+            }));
+        }
+    }
+    else {
+        const privateRouteTable = yield* RouteTable("PrivateRouteTable", {
+            vpcId: vpc.vpcId,
+            tags: {
+                ...tags,
+                Tier: "private",
+            },
+        });
+        privateRouteTables.push(privateRouteTable);
+        if (nat === "single") {
+            const eip = yield* EIP("NatEip", {
+                domain: "vpc",
+                tags,
+            });
+            elasticIps.push(eip);
+            const natGateway = yield* NatGateway("NatGateway", {
+                subnetId: publicSubnets[0].subnetId,
+                allocationId: eip.allocationId,
+                connectivityType: "public",
+                tags,
+            });
+            natGateways.push(natGateway);
+            privateRoutes.push(yield* Route("PrivateInternetRoute", {
+                routeTableId: privateRouteTable.routeTableId,
+                destinationCidrBlock: "0.0.0.0/0",
+                natGatewayId: natGateway.natGatewayId,
+            }));
+        }
+        for (const [index, subnet] of privateSubnets.entries()) {
+            privateRouteAssociations.push(yield* RouteTableAssociation(`PrivateSubnetAssociation${index + 1}`, {
+                routeTableId: privateRouteTable.routeTableId,
+                subnetId: subnet.subnetId,
+            }));
+        }
+    }
+    const region = yield* Region;
+    const gatewayEndpoints = [];
+    for (const service of uniqueGatewayEndpoints(props.gatewayEndpoints)) {
+        gatewayEndpoints.push(yield* VpcEndpoint(`${toEndpointId(service)}Endpoint`, {
+            vpcId: vpc.vpcId,
+            serviceName: `com.amazonaws.${region}.${service}`,
+            vpcEndpointType: "Gateway",
+            routeTableIds: privateRouteTables.map((table) => table.routeTableId),
+            tags,
+        }));
+    }
+    return {
+        availabilityZones,
+        vpc,
+        internetGateway,
+        elasticIps,
+        natGateways,
+        publicSubnets,
+        privateSubnets,
+        publicRouteTables: [publicRouteTable],
+        privateRouteTables,
+        publicRoutes: [publicInternetRoute],
+        privateRoutes,
+        publicRouteAssociations,
+        privateRouteAssociations,
+        gatewayEndpoints,
+        vpcId: vpc.vpcId,
+        publicSubnetIds: publicSubnets.map((subnet) => subnet.subnetId),
+        privateSubnetIds: privateSubnets.map((subnet) => subnet.subnetId),
+    };
+}).pipe(Effect.orDie));
+const resolveAvailabilityZones = (input) => Effect.gen(function* () {
+    if (Array.isArray(input)) {
+        if (input.length === 0) {
+            return yield* Effect.fail(new Error("EC2.Network requires at least one availability zone"));
+        }
+        if (new Set(input).size !== input.length) {
+            return yield* Effect.fail(new Error("EC2.Network availabilityZones must not contain duplicates"));
+        }
+        return input;
+    }
+    const desiredCount = input ?? 2;
+    if (!Number.isInteger(desiredCount) || desiredCount <= 0) {
+        return yield* Effect.fail(new Error("EC2.Network availabilityZones count must be a positive integer"));
+    }
+    const result = yield* ec2.describeAvailabilityZones({});
+    const zones = (result.AvailabilityZones ?? [])
+        .filter((zone) => zone.State === "available" && zone.ZoneName)
+        .map((zone) => zone.ZoneName)
+        .sort((a, b) => a.localeCompare(b));
+    if (zones.length < desiredCount) {
+        return yield* Effect.fail(new Error(`EC2.Network requested ${desiredCount} availability zones, but only ${zones.length} are available`));
+    }
+    return zones.slice(0, desiredCount);
+});
+const deriveSubnetCidrs = (cidrBlock, azCount) => {
+    const [baseAddress, prefixText] = cidrBlock.split("/");
+    const prefix = Number(prefixText);
+    if (!baseAddress || !Number.isInteger(prefix) || prefix < 0 || prefix > 28) {
+        throw new Error(`EC2.Network requires a valid IPv4 CIDR block, got '${cidrBlock}'`);
+    }
+    const totalSubnets = azCount * 2;
+    const additionalBits = Math.ceil(Math.log2(totalSubnets));
+    const subnetPrefix = Math.max(prefix + additionalBits, 24);
+    if (subnetPrefix > 28) {
+        throw new Error(`EC2.Network CIDR block '${cidrBlock}' is too small for ${totalSubnets} subnets`);
+    }
+    const subnetSize = 2 ** (32 - subnetPrefix);
+    const base = toNetworkAddress(baseAddress, prefix);
+    return {
+        public: Array.from({ length: azCount }, (_, index) => toCidr(base + subnetSize * index, subnetPrefix)),
+        private: Array.from({ length: azCount }, (_, index) => toCidr(base + subnetSize * (index + azCount), subnetPrefix)),
+    };
+};
+const toNetworkAddress = (ip, prefix) => {
+    const value = ipv4ToNumber(ip);
+    const blockSize = 2 ** (32 - prefix);
+    return Math.floor(value / blockSize) * blockSize;
+};
+const ipv4ToNumber = (ip) => {
+    const octets = ip.split(".").map((part) => Number(part));
+    if (octets.length !== 4 ||
+        octets.some((octet) => !Number.isInteger(octet) || octet < 0 || octet > 255)) {
+        throw new Error(`Invalid IPv4 address '${ip}'`);
+    }
+    return (octets[0] * 256 ** 3 + octets[1] * 256 ** 2 + octets[2] * 256 + octets[3]);
+};
+const numberToIpv4 = (value) => [
+    Math.floor(value / 256 ** 3) % 256,
+    Math.floor(value / 256 ** 2) % 256,
+    Math.floor(value / 256) % 256,
+    value % 256,
+].join(".");
+const toCidr = (value, prefix) => `${numberToIpv4(value)}/${prefix}`;
+const uniqueGatewayEndpoints = (services = []) => [
+    ...new Set(services),
+];
+const toEndpointId = (service) => service === "s3" ? "S3" : "DynamoDb";
+//# sourceMappingURL=Network.js.map