alchemy 2.0.0-beta.56 → 2.0.0-beta.57

package/lib/AWS/EKS/Cluster.js

@@ -13,7 +13,7 @@ import { Resource } from "../../Resource.js";
 import { createInternalTags, diffTags, hasAlchemyTags } from "../../Tags.js";
 /**
  * An Amazon EKS cluster with support for EKS Auto Mode settings.
- *
+ * @resource
  * @section Creating Clusters
  * @example Auto Mode Cluster from Existing Roles and Subnets
  * ```typescript

package/lib/AWS/EKS/LoadBalancedWorkload.d.ts

@@ -28,7 +28,7 @@ export interface LoadBalancedWorkloadProps extends Omit<WorkloadProps, "service"
  *
  * This helper is the ergonomic path for the common "run a deployment and make
  * it reachable through the EKS-managed load balancer integration" flow.
- *
+ * @resource
  * @example Internet-facing workload
  * ```typescript
  * const app = yield* LoadBalancedWorkload("api", {

package/lib/AWS/EKS/LoadBalancedWorkload.js

@@ -4,7 +4,7 @@ import { Workload, } from "./Workload.js";
  *
  * This helper is the ergonomic path for the common "run a deployment and make
  * it reachable through the EKS-managed load balancer integration" flow.
- *
+ * @resource
  * @example Internet-facing workload
  * ```typescript
  * const app = yield* LoadBalancedWorkload("api", {

package/lib/AWS/EKS/PodIdentityAssociation.d.ts

@@ -56,7 +56,7 @@ export interface PodIdentityAssociation extends Resource<"AWS.EKS.PodIdentityAss
  *
  * `PodIdentityAssociation` is the canonical workload-identity resource for EKS
  * clusters that use EKS Pod Identity instead of IRSA.
- *
+ * @resource
  * @section Managing Pod Identity
  * @example Bind a Service Account to a Role
  * ```typescript

package/lib/AWS/EKS/PodIdentityAssociation.js

@@ -12,7 +12,7 @@ import { createInternalTags, diffTags, hasAlchemyTags } from "../../Tags.js";
  *
  * `PodIdentityAssociation` is the canonical workload-identity resource for EKS
  * clusters that use EKS Pod Identity instead of IRSA.
- *
+ * @resource
  * @section Managing Pod Identity
  * @example Bind a Service Account to a Role
  * ```typescript

package/lib/AWS/EKS/PodIdentityServiceAccount.d.ts

@@ -73,7 +73,7 @@ export interface PodIdentityServiceAccountResources {
 }
 /**
  * Creates a Kubernetes service account and binds it to EKS Pod Identity.
- *
+ * @resource
  * @example Service account with generated IAM role
  * ```typescript
  * const identity = yield* PodIdentityServiceAccount("ApiIdentity", {

package/lib/AWS/EKS/PodIdentityServiceAccount.js

@@ -5,7 +5,7 @@ import { Role } from "../IAM/Role.js";
 import { PodIdentityAssociation, } from "./PodIdentityAssociation.js";
 /**
  * Creates a Kubernetes service account and binds it to EKS Pod Identity.
- *
+ * @resource
  * @example Service account with generated IAM role
  * ```typescript
  * const identity = yield* PodIdentityServiceAccount("ApiIdentity", {

package/lib/AWS/EKS/PodIdentityWorkload.d.ts

@@ -109,7 +109,7 @@ export interface PodIdentityWorkloadResources {
  * can declare a service-account-backed deployment without manually wiring the
  * IAM role, EKS pod identity association, Kubernetes service account, and
  * deployment together.
- *
+ * @resource
  * @example Pod identity workload with generated role
  * ```typescript
  * const app = yield* PodIdentityWorkload("api", {

package/lib/AWS/EKS/PodIdentityWorkload.js

@@ -10,7 +10,7 @@ import { Workload } from "./Workload.js";
  * can declare a service-account-backed deployment without manually wiring the
  * IAM role, EKS pod identity association, Kubernetes service account, and
  * deployment together.
- *
+ * @resource
  * @example Pod identity workload with generated role
  * ```typescript
  * const app = yield* PodIdentityWorkload("api", {

package/lib/AWS/EKS/Workload.d.ts

@@ -80,7 +80,7 @@ export interface WorkloadResources {
  * `Workload` is the higher-level helper for the common "run pods and maybe
  * expose them on a Service" pattern without dropping down to each individual
  * Kubernetes primitive.
- *
+ * @resource
  * @example Deployment with a ClusterIP service
  * ```typescript
  * const app = yield* Workload("api", {

package/lib/AWS/EKS/Workload.js

@@ -7,7 +7,7 @@ import * as Kubernetes from "../../Kubernetes/index.js";
  * `Workload` is the higher-level helper for the common "run pods and maybe
  * expose them on a Service" pattern without dropping down to each individual
  * Kubernetes primitive.
- *
+ * @resource
  * @example Deployment with a ClusterIP service
  * ```typescript
  * const app = yield* Workload("api", {

package/lib/AWS/ELBv2/Listener.d.ts

@@ -4,25 +4,155 @@ import { Resource } from "../../Resource.ts";
 import type { AccountID } from "../Environment.ts";
 import type { Providers } from "../Providers.ts";
 import type { RegionID } from "../Region.ts";
+import { type ListenerAction } from "./common.ts";
 import type { LoadBalancer, LoadBalancerArn } from "./LoadBalancer.ts";
 import type { TargetGroup, TargetGroupArn } from "./TargetGroup.ts";
 export type ListenerArn = `arn:aws:elasticloadbalancing:${RegionID}:${AccountID}:listener/${string}`;
 export interface ListenerProps {
+    /** The load balancer this listener belongs to. Changing it replaces the listener. */
     loadBalancerArn: Input<LoadBalancerArn> | LoadBalancer;
-    targetGroupArn: Input<TargetGroupArn> | TargetGroup;
+    /**
+     * Single forward target group. Convenience sugar that desugars to a single
+     * `{ type: "forward" }` default action. Prefer {@link defaultActions} for the
+     * full action surface. Mutually exclusive with `defaultActions`.
+     */
+    targetGroupArn?: Input<TargetGroupArn> | TargetGroup;
+    /**
+     * The default actions for the listener (forward / redirect / fixedResponse /
+     * authenticateOidc / authenticateCognito). Takes precedence over
+     * {@link targetGroupArn}.
+     */
+    defaultActions?: ListenerAction[];
+    /** The port on which the load balancer listens. Updated in place. */
     port: number;
-    protocol?: "HTTP" | "HTTPS" | "TCP";
+    /**
+     * The listener protocol.
+     * @default "HTTP"
+     */
+    protocol?: "HTTP" | "HTTPS" | "TCP" | "TLS" | "UDP" | "TCP_UDP";
+    /**
+     * The default (and any additional SNI) certificate ARNs. The first entry is
+     * the default certificate; the rest are attached as SNI certificates.
+     * Prefer this over the legacy single {@link certificateArn}.
+     */
+    certificates?: string[];
+    /**
+     * The default certificate ARN (legacy single-cert form). Folded into
+     * {@link certificates} as the default certificate.
+     */
     certificateArn?: string;
+    /** The security policy that defines supported protocols and ciphers (HTTPS/TLS). */
     sslPolicy?: string;
+    /** The ALPN policy for TLS listeners (e.g. `HTTP2Optional`). */
+    alpnPolicy?: string[];
+    /** Mutual TLS (mTLS) configuration for HTTPS listeners. */
+    mutualAuthentication?: {
+        /** The mTLS mode. */
+        mode: "off" | "passthrough" | "verify";
+        /** The trust store ARN. Required when `mode` is `verify`. */
+        trustStoreArn?: string;
+        /** Whether to ignore expired client certificates. */
+        ignoreClientCertificateExpiry?: boolean;
+        /** Whether to advertise the trust-store CA names in the TLS handshake. */
+        advertiseTrustStoreCaNames?: "on" | "off";
+    };
 }
 export interface Listener extends Resource<"AWS.ELBv2.Listener", ListenerProps, {
     listenerArn: ListenerArn;
     loadBalancerArn: LoadBalancerArn;
-    targetGroupArn: TargetGroupArn;
+    targetGroupArn: TargetGroupArn | undefined;
     port: number;
     protocol: string;
 }, never, Providers> {
 }
+/**
+ * An ELBv2 (Application/Network) Load Balancer listener. A listener checks for
+ * connection requests using its configured protocol and port, then routes them
+ * to target groups via its default actions (and any attached
+ * {@link ListenerRule}s).
+ * @resource
+ * @section Creating a Listener
+ * @example Basic HTTP forward listener
+ * ```typescript
+ * const listener = yield* Listener("http", {
+ *   loadBalancerArn: lb.loadBalancerArn,
+ *   targetGroupArn: tg.targetGroupArn,
+ *   port: 80,
+ *   protocol: "HTTP",
+ * });
+ * ```
+ *
+ * @example HTTPS listener with certificate and SSL policy
+ * ```typescript
+ * const listener = yield* Listener("https", {
+ *   loadBalancerArn: lb.loadBalancerArn,
+ *   defaultActions: [
+ *     { type: "forward", targetGroups: [{ targetGroupArn: tg.targetGroupArn }] },
+ *   ],
+ *   port: 443,
+ *   protocol: "HTTPS",
+ *   certificates: [primaryCertArn, sniCertArn],
+ *   sslPolicy: "ELBSecurityPolicy-TLS13-1-2-2021-06",
+ * });
+ * ```
+ *
+ * @section Default Actions
+ * @example Redirect HTTP to HTTPS
+ * ```typescript
+ * const redirect = yield* Listener("redirect", {
+ *   loadBalancerArn: lb.loadBalancerArn,
+ *   defaultActions: [
+ *     { type: "redirect", statusCode: "HTTP_301", protocol: "HTTPS", port: "443" },
+ *   ],
+ *   port: 80,
+ *   protocol: "HTTP",
+ * });
+ * ```
+ *
+ * @example Fixed response
+ * ```typescript
+ * const maintenance = yield* Listener("maintenance", {
+ *   loadBalancerArn: lb.loadBalancerArn,
+ *   defaultActions: [
+ *     { type: "fixedResponse", statusCode: "503", contentType: "text/plain", messageBody: "down" },
+ *   ],
+ *   port: 80,
+ * });
+ * ```
+ *
+ * @example Weighted forward with stickiness
+ * ```typescript
+ * const weighted = yield* Listener("weighted", {
+ *   loadBalancerArn: lb.loadBalancerArn,
+ *   defaultActions: [
+ *     {
+ *       type: "forward",
+ *       targetGroups: [
+ *         { targetGroupArn: blue.targetGroupArn, weight: 90 },
+ *         { targetGroupArn: green.targetGroupArn, weight: 10 },
+ *       ],
+ *       stickiness: { enabled: true, durationSeconds: 3600 },
+ *     },
+ *   ],
+ *   port: 80,
+ * });
+ * ```
+ *
+ * @section Mutual TLS
+ * @example mTLS verify mode with a trust store
+ * ```typescript
+ * const mtls = yield* Listener("mtls", {
+ *   loadBalancerArn: lb.loadBalancerArn,
+ *   defaultActions: [
+ *     { type: "forward", targetGroups: [{ targetGroupArn: tg.targetGroupArn }] },
+ *   ],
+ *   port: 443,
+ *   protocol: "HTTPS",
+ *   certificates: [certArn],
+ *   mutualAuthentication: { mode: "verify", trustStoreArn: trustStore.trustStoreArn },
+ * });
+ * ```
+ */
 export declare const Listener: import("../../Resource.ts").ResourceClass<Listener>;
 export declare const ListenerProvider: () => import("effect/Layer").Layer<Provider.Provider<Listener>, never, import("@distilled.cloud/aws/Credentials").Credentials | import("effect/unstable/http/HttpClient").HttpClient | import("@distilled.cloud/aws/Region").Region>;
 //# sourceMappingURL=Listener.d.ts.map

package/lib/AWS/ELBv2/Listener.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"Listener.d.ts","sourceRoot":"","sources":["../../../src/AWS/ELBv2/Listener.ts"],"names":[],"mappings":"AAIA,OAAO,KAAK,EAAE,KAAK,EAAE,MAAM,gBAAgB,CAAC;AAC5C,OAAO,KAAK,QAAQ,MAAM,mBAAmB,CAAC;AAC9C,OAAO,EAAE,QAAQ,EAAE,MAAM,mBAAmB,CAAC;AAC7C,OAAO,KAAK,EAAE,SAAS,EAAE,MAAM,mBAAmB,CAAC;AACnD,OAAO,KAAK,EAAE,SAAS,EAAE,MAAM,iBAAiB,CAAC;AACjD,OAAO,KAAK,EAAE,QAAQ,EAAE,MAAM,cAAc,CAAC;AAC7C,OAAO,KAAK,EAAE,YAAY,EAAE,eAAe,EAAE,MAAM,mBAAmB,CAAC;AACvE,OAAO,KAAK,EAAE,WAAW,EAAE,cAAc,EAAE,MAAM,kBAAkB,CAAC;AAEpE,MAAM,MAAM,WAAW,GACrB,gCAAgC,QAAQ,IAAI,SAAS,aAAa,MAAM,EAAE,CAAC;AAE7E,MAAM,WAAW,aAAa;IAC5B,eAAe,EAAE,KAAK,CAAC,eAAe,CAAC,GAAG,YAAY,CAAC;IACvD,cAAc,EAAE,KAAK,CAAC,cAAc,CAAC,GAAG,WAAW,CAAC;IACpD,IAAI,EAAE,MAAM,CAAC;IACb,QAAQ,CAAC,EAAE,MAAM,GAAG,OAAO,GAAG,KAAK,CAAC;IACpC,cAAc,CAAC,EAAE,MAAM,CAAC;IACxB,SAAS,CAAC,EAAE,MAAM,CAAC;CACpB;AAED,MAAM,WAAW,QAAS,SAAQ,QAAQ,CACxC,oBAAoB,EACpB,aAAa,EACb;IACE,WAAW,EAAE,WAAW,CAAC;IACzB,eAAe,EAAE,eAAe,CAAC;IACjC,cAAc,EAAE,cAAc,CAAC;IAC/B,IAAI,EAAE,MAAM,CAAC;IACb,QAAQ,EAAE,MAAM,CAAC;CAClB,EACD,KAAK,EACL,SAAS,CACV;CAAG;AAEJ,eAAO,MAAM,QAAQ,qDAA2C,CAAC;AAEjE,eAAO,MAAM,gBAAgB,sOAwMzB,CAAC"}
+{"version":3,"file":"Listener.d.ts","sourceRoot":"","sources":["../../../src/AWS/ELBv2/Listener.ts"],"names":[],"mappings":"AAIA,OAAO,KAAK,EAAE,KAAK,EAAE,MAAM,gBAAgB,CAAC;AAC5C,OAAO,KAAK,QAAQ,MAAM,mBAAmB,CAAC;AAC9C,OAAO,EAAE,QAAQ,EAAE,MAAM,mBAAmB,CAAC;AAC7C,OAAO,KAAK,EAAE,SAAS,EAAE,MAAM,mBAAmB,CAAC;AACnD,OAAO,KAAK,EAAE,SAAS,EAAE,MAAM,iBAAiB,CAAC;AACjD,OAAO,KAAK,EAAE,QAAQ,EAAE,MAAM,cAAc,CAAC;AAC7C,OAAO,EAAE,KAAK,cAAc,EAAoB,MAAM,aAAa,CAAC;AACpE,OAAO,KAAK,EAAE,YAAY,EAAE,eAAe,EAAE,MAAM,mBAAmB,CAAC;AACvE,OAAO,KAAK,EAAE,WAAW,EAAE,cAAc,EAAE,MAAM,kBAAkB,CAAC;AAEpE,MAAM,MAAM,WAAW,GACrB,gCAAgC,QAAQ,IAAI,SAAS,aAAa,MAAM,EAAE,CAAC;AAE7E,MAAM,WAAW,aAAa;IAC5B,qFAAqF;IACrF,eAAe,EAAE,KAAK,CAAC,eAAe,CAAC,GAAG,YAAY,CAAC;IACvD;;;;OAIG;IACH,cAAc,CAAC,EAAE,KAAK,CAAC,cAAc,CAAC,GAAG,WAAW,CAAC;IACrD;;;;OAIG;IACH,cAAc,CAAC,EAAE,cAAc,EAAE,CAAC;IAClC,qEAAqE;IACrE,IAAI,EAAE,MAAM,CAAC;IACb;;;OAGG;IACH,QAAQ,CAAC,EAAE,MAAM,GAAG,OAAO,GAAG,KAAK,GAAG,KAAK,GAAG,KAAK,GAAG,SAAS,CAAC;IAChE;;;;OAIG;IACH,YAAY,CAAC,EAAE,MAAM,EAAE,CAAC;IACxB;;;OAGG;IACH,cAAc,CAAC,EAAE,MAAM,CAAC;IACxB,oFAAoF;IACpF,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,gEAAgE;IAChE,UAAU,CAAC,EAAE,MAAM,EAAE,CAAC;IACtB,2DAA2D;IAC3D,oBAAoB,CAAC,EAAE;QACrB,qBAAqB;QACrB,IAAI,EAAE,KAAK,GAAG,aAAa,GAAG,QAAQ,CAAC;QACvC,6DAA6D;QAC7D,aAAa,CAAC,EAAE,MAAM,CAAC;QACvB,qDAAqD;QACrD,6BAA6B,CAAC,EAAE,OAAO,CAAC;QACxC,0EAA0E;QAC1E,0BAA0B,CAAC,EAAE,IAAI,GAAG,KAAK,CAAC;KAC3C,CAAC;CACH;AAED,MAAM,WAAW,QAAS,SAAQ,QAAQ,CACxC,oBAAoB,EACpB,aAAa,EACb;IACE,WAAW,EAAE,WAAW,CAAC;IACzB,eAAe,EAAE,eAAe,CAAC;IACjC,cAAc,EAAE,cAAc,GAAG,SAAS,CAAC;IAC3C,IAAI,EAAE,MAAM,CAAC;IACb,QAAQ,EAAE,MAAM,CAAC;CAClB,EACD,KAAK,EACL,SAAS,CACV;CAAG;AAEJ;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAuFG;AACH,eAAO,MAAM,QAAQ,qDAA2C,CAAC;AAqDjE,eAAO,MAAM,gBAAgB,sOAmNzB,CAAC"}

package/lib/AWS/ELBv2/Listener.js

@@ -4,7 +4,134 @@ import * as Stream from "effect/Stream";
 import { isResolved } from "../../Diff.js";
 import * as Provider from "../../Provider.js";
 import { Resource } from "../../Resource.js";
+import { serializeActions } from "./common.js";
+/**
+ * An ELBv2 (Application/Network) Load Balancer listener. A listener checks for
+ * connection requests using its configured protocol and port, then routes them
+ * to target groups via its default actions (and any attached
+ * {@link ListenerRule}s).
+ * @resource
+ * @section Creating a Listener
+ * @example Basic HTTP forward listener
+ * ```typescript
+ * const listener = yield* Listener("http", {
+ *   loadBalancerArn: lb.loadBalancerArn,
+ *   targetGroupArn: tg.targetGroupArn,
+ *   port: 80,
+ *   protocol: "HTTP",
+ * });
+ * ```
+ *
+ * @example HTTPS listener with certificate and SSL policy
+ * ```typescript
+ * const listener = yield* Listener("https", {
+ *   loadBalancerArn: lb.loadBalancerArn,
+ *   defaultActions: [
+ *     { type: "forward", targetGroups: [{ targetGroupArn: tg.targetGroupArn }] },
+ *   ],
+ *   port: 443,
+ *   protocol: "HTTPS",
+ *   certificates: [primaryCertArn, sniCertArn],
+ *   sslPolicy: "ELBSecurityPolicy-TLS13-1-2-2021-06",
+ * });
+ * ```
+ *
+ * @section Default Actions
+ * @example Redirect HTTP to HTTPS
+ * ```typescript
+ * const redirect = yield* Listener("redirect", {
+ *   loadBalancerArn: lb.loadBalancerArn,
+ *   defaultActions: [
+ *     { type: "redirect", statusCode: "HTTP_301", protocol: "HTTPS", port: "443" },
+ *   ],
+ *   port: 80,
+ *   protocol: "HTTP",
+ * });
+ * ```
+ *
+ * @example Fixed response
+ * ```typescript
+ * const maintenance = yield* Listener("maintenance", {
+ *   loadBalancerArn: lb.loadBalancerArn,
+ *   defaultActions: [
+ *     { type: "fixedResponse", statusCode: "503", contentType: "text/plain", messageBody: "down" },
+ *   ],
+ *   port: 80,
+ * });
+ * ```
+ *
+ * @example Weighted forward with stickiness
+ * ```typescript
+ * const weighted = yield* Listener("weighted", {
+ *   loadBalancerArn: lb.loadBalancerArn,
+ *   defaultActions: [
+ *     {
+ *       type: "forward",
+ *       targetGroups: [
+ *         { targetGroupArn: blue.targetGroupArn, weight: 90 },
+ *         { targetGroupArn: green.targetGroupArn, weight: 10 },
+ *       ],
+ *       stickiness: { enabled: true, durationSeconds: 3600 },
+ *     },
+ *   ],
+ *   port: 80,
+ * });
+ * ```
+ *
+ * @section Mutual TLS
+ * @example mTLS verify mode with a trust store
+ * ```typescript
+ * const mtls = yield* Listener("mtls", {
+ *   loadBalancerArn: lb.loadBalancerArn,
+ *   defaultActions: [
+ *     { type: "forward", targetGroups: [{ targetGroupArn: tg.targetGroupArn }] },
+ *   ],
+ *   port: 443,
+ *   protocol: "HTTPS",
+ *   certificates: [certArn],
+ *   mutualAuthentication: { mode: "verify", trustStoreArn: trustStore.trustStoreArn },
+ * });
+ * ```
+ */
 export const Listener = Resource("AWS.ELBv2.Listener");
+// Build the default-action wire shape from desugared props.
+const desiredDefaultActions = (props) => {
+    if (props.defaultActions && props.defaultActions.length > 0) {
+        return serializeActions(props.defaultActions);
+    }
+    if (props.targetGroupArn) {
+        return serializeActions([
+            {
+                type: "forward",
+                targetGroups: [
+                    { targetGroupArn: props.targetGroupArn },
+                ],
+            },
+        ]);
+    }
+    return [];
+};
+// The default forward target group (if any) for the Attributes shape.
+const defaultForwardTargetGroup = (actions) => {
+    const forward = (actions ?? []).find((a) => a.Type === "forward");
+    return (forward?.TargetGroupArn ??
+        forward?.ForwardConfig?.TargetGroups?.[0]?.TargetGroupArn);
+};
+// Build certificate list: first = default, the rest are SNI extras.
+const desiredCertificates = (props) => {
+    if (props.certificates && props.certificates.length > 0) {
+        return props.certificates;
+    }
+    return props.certificateArn ? [props.certificateArn] : [];
+};
+const desiredMutualAuth = (props) => props.mutualAuthentication
+    ? {
+        Mode: props.mutualAuthentication.mode,
+        TrustStoreArn: props.mutualAuthentication.trustStoreArn,
+        IgnoreClientCertificateExpiry: props.mutualAuthentication.ignoreClientCertificateExpiry,
+        AdvertiseTrustStoreCaNames: props.mutualAuthentication.advertiseTrustStoreCaNames,
+    }
+    : undefined;
 export const ListenerProvider = () => Provider.succeed(Listener, {
     stables: ["listenerArn", "loadBalancerArn"],
     diff: Effect.fn(function* ({ olds, news }) {
@@ -27,12 +154,11 @@ export const ListenerProvider = () => Provider.succeed(Listener, {
         if (!listener?.ListenerArn) {
             return undefined;
         }
-        const defaultForward = (listener.DefaultActions ?? []).find((action) => action.Type === "forward");
         return {
             listenerArn: listener.ListenerArn,
             loadBalancerArn: listener.LoadBalancerArn,
-            targetGroupArn: (defaultForward?.TargetGroupArn ??
-                output.targetGroupArn),
+            targetGroupArn: defaultForwardTargetGroup(listener.DefaultActions) ??
+                output.targetGroupArn,
             port: listener.Port,
             protocol: listener.Protocol,
         };
@@ -48,17 +174,13 @@ export const ListenerProvider = () => Provider.succeed(Listener, {
             .pages({ LoadBalancerArn: loadBalancerArn })
             .pipe(Stream.runCollect, Effect.map((chunk) => Array.from(chunk).flatMap((page) => (page.Listeners ?? [])
             .filter((l) => l.ListenerArn != null)
-            .map((listener) => {
-            const defaultForward = (listener.DefaultActions ?? []).find((action) => action.Type === "forward");
-            return {
-                listenerArn: listener.ListenerArn,
-                loadBalancerArn: listener.LoadBalancerArn,
-                targetGroupArn: (defaultForward?.TargetGroupArn ??
-                    ""),
-                port: listener.Port,
-                protocol: listener.Protocol,
-            };
-        }))), 
+            .map((listener) => ({
+            listenerArn: listener.ListenerArn,
+            loadBalancerArn: listener.LoadBalancerArn,
+            targetGroupArn: defaultForwardTargetGroup(listener.DefaultActions),
+            port: listener.Port,
+            protocol: listener.Protocol,
+        })))), 
         // The LB may vanish between enumeration and per-LB listing.
         Effect.catchTag("LoadBalancerNotFoundException", () => Effect.succeed([])), Effect.catchTag("ListenerNotFoundException", () => Effect.succeed([]))), { concurrency: 10 });
         const result = rows.flat();
@@ -66,8 +188,10 @@ export const ListenerProvider = () => Provider.succeed(Listener, {
     }),
     reconcile: Effect.fn(function* ({ news, output, session }) {
         const loadBalancerArn = news.loadBalancerArn;
-        const desiredTargetGroupArn = news.targetGroupArn;
         const desiredProtocol = news.protocol ?? "HTTP";
+        const defaultActions = desiredDefaultActions(news);
+        const certs = desiredCertificates(news);
+        const mutualAuthentication = desiredMutualAuth(news);
         // Observe — describe the listener if we have a prior ARN; otherwise
         // list listeners on the load balancer and find one matching port.
         let listener;
@@ -87,61 +211,69 @@ export const ListenerProvider = () => Provider.succeed(Listener, {
                 .pipe(Effect.catchTag("LoadBalancerNotFoundException", () => Effect.succeed(undefined)), Effect.catchTag("ListenerNotFoundException", () => Effect.succeed(undefined)));
             listener = listed?.Listeners?.find((l) => l.Port === news.port);
         }
-        // Ensure — create if missing.
+        // Ensure — create if missing. The first certificate is the default.
         if (!listener?.ListenerArn) {
             const created = yield* elbv2.createListener({
                 LoadBalancerArn: loadBalancerArn,
                 Port: news.port,
                 Protocol: desiredProtocol,
-                Certificates: news.certificateArn
-                    ? [{ CertificateArn: news.certificateArn }]
-                    : undefined,
+                Certificates: certs.length > 0 ? [{ CertificateArn: certs[0] }] : undefined,
                 SslPolicy: news.sslPolicy,
-                DefaultActions: [
-                    {
-                        Type: "forward",
-                        TargetGroupArn: desiredTargetGroupArn,
-                    },
-                ],
+                AlpnPolicy: news.alpnPolicy,
+                MutualAuthentication: mutualAuthentication,
+                DefaultActions: defaultActions,
             });
             listener = created.Listeners?.[0];
             if (!listener?.ListenerArn) {
                 return yield* Effect.die(new Error("createListener returned no listener"));
             }
-            yield* session.note(listener.ListenerArn);
-            return {
-                listenerArn: listener.ListenerArn,
-                loadBalancerArn: listener.LoadBalancerArn,
-                targetGroupArn: desiredTargetGroupArn,
-                port: listener.Port,
-                protocol: listener.Protocol,
-            };
         }
-        // Sync — apply mutable fields (port, protocol, certificates,
-        // sslPolicy, defaultActions). modifyListener fully replaces these.
-        const modified = yield* elbv2.modifyListener({
-            ListenerArn: listener.ListenerArn,
-            Port: news.port,
-            Protocol: desiredProtocol,
-            Certificates: news.certificateArn
-                ? [{ CertificateArn: news.certificateArn }]
-                : undefined,
-            SslPolicy: news.sslPolicy,
-            DefaultActions: [
-                {
-                    Type: "forward",
-                    TargetGroupArn: desiredTargetGroupArn,
-                },
-            ],
-        });
-        const final = modified.Listeners?.[0] ?? listener;
-        yield* session.note(listener.ListenerArn);
+        else {
+            // Sync — modifyListener fully replaces these mutable fields.
+            const modified = yield* elbv2.modifyListener({
+                ListenerArn: listener.ListenerArn,
+                Port: news.port,
+                Protocol: desiredProtocol,
+                Certificates: certs.length > 0 ? [{ CertificateArn: certs[0] }] : undefined,
+                SslPolicy: news.sslPolicy,
+                AlpnPolicy: news.alpnPolicy,
+                MutualAuthentication: mutualAuthentication,
+                DefaultActions: defaultActions,
+            });
+            listener = modified.Listeners?.[0] ?? listener;
+        }
+        const listenerArn = listener.ListenerArn;
+        // Sync additional SNI certificates — observed ↔ desired. The default
+        // certificate (certs[0]) is carried by modifyListener and is excluded
+        // from the SNI set.
+        const desiredSni = new Set(certs.slice(1));
+        const observedCerts = yield* elbv2
+            .describeListenerCertificates({ ListenerArn: listenerArn })
+            .pipe(Effect.catchTag("ListenerNotFoundException", () => Effect.succeed(undefined)));
+        const observedSni = (observedCerts?.Certificates ?? [])
+            .filter((c) => !c.IsDefault && c.CertificateArn)
+            .map((c) => c.CertificateArn);
+        const toAdd = [...desiredSni].filter((arn) => !observedSni.includes(arn));
+        const toRemove = observedSni.filter((arn) => !desiredSni.has(arn));
+        if (toAdd.length > 0) {
+            yield* elbv2.addListenerCertificates({
+                ListenerArn: listenerArn,
+                Certificates: toAdd.map((arn) => ({ CertificateArn: arn })),
+            });
+        }
+        if (toRemove.length > 0) {
+            yield* elbv2.removeListenerCertificates({
+                ListenerArn: listenerArn,
+                Certificates: toRemove.map((arn) => ({ CertificateArn: arn })),
+            });
+        }
+        yield* session.note(listenerArn);
         return {
-            listenerArn: listener.ListenerArn,
+            listenerArn: listenerArn,
             loadBalancerArn: listener.LoadBalancerArn,
-            targetGroupArn: desiredTargetGroupArn,
-            port: final.Port ?? news.port,
-            protocol: final.Protocol ?? desiredProtocol,
+            targetGroupArn: defaultForwardTargetGroup(defaultActions),
+            port: listener.Port ?? news.port,
+            protocol: listener.Protocol ?? desiredProtocol,
         };
     }),
     delete: Effect.fn(function* ({ output }) {

package/lib/AWS/ELBv2/Listener.js.map

@@ -1 +1 @@
-{"version":3,"file":"Listener.js","sourceRoot":"","sources":["../../../src/AWS/ELBv2/Listener.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,KAAK,MAAM,gDAAgD,CAAC;AACxE,OAAO,KAAK,MAAM,MAAM,eAAe,CAAC;AACxC,OAAO,KAAK,MAAM,MAAM,eAAe,CAAC;AACxC,OAAO,EAAE,UAAU,EAAE,MAAM,eAAe,CAAC;AAE3C,OAAO,KAAK,QAAQ,MAAM,mBAAmB,CAAC;AAC9C,OAAO,EAAE,QAAQ,EAAE,MAAM,mBAAmB,CAAC;AAiC7C,MAAM,CAAC,MAAM,QAAQ,GAAG,QAAQ,CAAW,oBAAoB,CAAC,CAAC;AAEjE,MAAM,CAAC,MAAM,gBAAgB,GAAG,GAAG,EAAE,CACnC,QAAQ,CAAC,OAAO,CAAC,QAAQ,EAAE;IACzB,OAAO,EAAE,CAAC,aAAa,EAAE,iBAAiB,CAAC;IAC3C,IAAI,EAAE,MAAM,CAAC,EAAE,CAAC,QAAQ,CAAC,EAAE,EAAE,IAAI,EAAE,IAAI,EAAE;QACvC,IAAI,CAAC,UAAU,CAAC,IAAI,CAAC;YAAE,OAAO;QAC9B,IAAI,IAAI,CAAC,eAAe,KAAK,IAAI,CAAC,eAAe,EAAE,CAAC;YAClD,OAAO,EAAE,MAAM,EAAE,SAAS,EAAW,CAAC;QACxC,CAAC;IACH,CAAC,CAAC;IACF,IAAI,EAAE,MAAM,CAAC,EAAE,CAAC,QAAQ,CAAC,EAAE,EAAE,MAAM,EAAE;QACnC,IAAI,CAAC,MAAM,EAAE,CAAC;YACZ,OAAO,SAAS,CAAC;QACnB,CAAC;QACD,MAAM,SAAS,GAAG,KAAK,CAAC,CAAC,KAAK;aAC3B,iBAAiB,CAAC;YACjB,YAAY,EAAE,CAAC,MAAM,CAAC,WAAW,CAAC;SACnC,CAAC;aACD,IAAI,CACH,MAAM,CAAC,QAAQ,CAAC,2BAA2B,EAAE,GAAG,EAAE,CAChD,MAAM,CAAC,OAAO,CAAC,SAAS,CAAC,CAC1B,CACF,CAAC;QACJ,MAAM,QAAQ,GAAG,SAAS,EAAE,SAAS,EAAE,CAAC,CAAC,CAAC,CAAC;QAC3C,IAAI,CAAC,QAAQ,EAAE,WAAW,EAAE,CAAC;YAC3B,OAAO,SAAS,CAAC;QACnB,CAAC;QACD,MAAM,cAAc,GAAG,CAAC,QAAQ,CAAC,cAAc,IAAI,EAAE,CAAC,CAAC,IAAI,CACzD,CAAC,MAAM,EAAE,EAAE,CAAC,MAAM,CAAC,IAAI,KAAK,SAAS,CACtC,CAAC;QACF,OAAO;YACL,WAAW,EAAE,QAAQ,CAAC,WAA0B;YAChD,eAAe,EAAE,QAAQ,CAAC,eAAkC;YAC5D,cAAc,EAAE,CAAC,cAAc,EAAE,cAAc;gBAC7C,MAAM,CAAC,cAAc,CAAmB;YAC1C,IAAI,EAAE,QAAQ,CAAC,IAAK;YACpB,QAAQ,EAAE,QAAQ,CAAC,QAAS;SAC7B,CAAC;IACJ,CAAC,CAAC;IACF,oEAAoE;IACpE,0EAA0E;IAC1E,kDAAkD;IAClD,IAAI,EAAE,MAAM,CAAC,EAAE,CAAC,QAAQ,CAAC;QACvB,MAAM,gBAAgB,GAAG,KAAK,CAAC,CAAC,KAAK,CAAC,qBAAqB;aACxD,KAAK,CAAC,EAAE,CAAC;aACT,IAAI,CACH,MAAM,CAAC,UAAU,EACjB,MAAM,CAAC,GAAG,CAAC,CAAC,KAAK,EAAE,EAAE,CACnB,KAAK,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,OAAO,CAAC,CAAC,IAAI,EAAE,EAAE,CACjC,CAAC,IAAI,CAAC,aAAa,IAAI,EAAE,CAAC,CAAC,OAAO,CAAC,CAAC,EAAE,EAAE,EAAE,CACxC,EAAE,CAAC,eAAe,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC,eAAe,CAAC,CAAC,CAAC,CAAC,EAAE,CAC/C,CACF,CACF,CACF,CAAC;QACJ,MAAM,IAAI,GAAG,KAAK,CAAC,CAAC,MAAM,CAAC,OAAO,CAChC,gBAAgB,EAChB,CAAC,eAAe,EAAE,EAAE,CAClB,KAAK,CAAC,iBAAiB;aACpB,KAAK,CAAC,EAAE,eAAe,EAAE,eAAe,EAAE,CAAC;aAC3C,IAAI,CACH,MAAM,CAAC,UAAU,EACjB,MAAM,CAAC,GAAG,CAAC,CAAC,KAAK,EAAE,EAAE,CACnB,KAAK,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,OAAO,CAAC,CAAC,IAAI,EAAE,EAAE,CACjC,CAAC,IAAI,CAAC,SAAS,IAAI,EAAE,CAAC;aACnB,MAAM,CACL,CAAC,CAAC,EAA2C,EAAE,CAC7C,CAAC,CAAC,WAAW,IAAI,IAAI,CACxB;aACA,GAAG,CAAC,CAAC,QAAQ,EAAE,EAAE;YAChB,MAAM,cAAc,GAAG,CACrB,QAAQ,CAAC,cAAc,IAAI,EAAE,CAC9B,CAAC,IAAI,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC,MAAM,CAAC,IAAI,KAAK,SAAS,CAAC,CAAC;YAC9C,OAAO;gBACL,WAAW,EAAE,QAAQ,CAAC,WAA0B;gBAChD,eAAe,EACb,QAAQ,CAAC,eAAkC;gBAC7C,cAAc,EAAE,CAAC,cAAc,EAAE,cAAc;oBAC7C,EAAE,CAAmB;gBACvB,IAAI,EAAE,QAAQ,CAAC,IAAK;gBACpB,QAAQ,EAAE,QAAQ,CAAC,QAAS;aAC7B,CAAC;QACJ,CAAC,CAAC,CACL,CACF;QACD,4DAA4D;QAC5D,MAAM,CAAC,QAAQ,CAAC,+BAA+B,EAAE,GAAG,EAAE,CACpD,MAAM,CAAC,OAAO,CAAC,EAAE,CAAC,CACnB,EACD,MAAM,CAAC,QAAQ,CAAC,2BAA2B,EAAE,GAAG,EAAE,CAChD,MAAM,CAAC,OAAO,CAAC,EAAE,CAAC,CACnB,CACF,EACL,EAAE,WAAW,EAAE,EAAE,EAAE,CACpB,CAAC;QACF,MAAM,MAAM,GAA6B,IAAI,CAAC,IAAI,EAAE,CAAC;QACrD,OAAO,MAAM,CAAC;IAChB,CAAC,CAAC;IACF,SAAS,EAAE,MAAM,CAAC,EAAE,CAAC,QAAQ,CAAC,EAAE,EAAE,IAAI,EAAE,MAAM,EAAE,OAAO,EAAE;QACvD,MAAM,eAAe,GAAG,IAAI,CAAC,eAAkC,CAAC;QAChE,MAAM,qBAAqB,GAAG,IAAI,CAAC,cAAgC,CAAC;QACpE,MAAM,eAAe,GAAG,IAAI,CAAC,QAAQ,IAAI,MAAM,CAAC;QAEhD,oEAAoE;QACpE,kEAAkE;QAClE,IAAI,QAAoC,CAAC;QACzC,IAAI,MAAM,EAAE,WAAW,EAAE,CAAC;YACxB,MAAM,SAAS,GAAG,KAAK,CAAC,CAAC,KAAK;iBAC3B,iBAAiB,CAAC;gBACjB,YAAY,EAAE,CAAC,MAAM,CAAC,WAAW,CAAC;aACnC,CAAC;iBACD,IAAI,CACH,MAAM,CAAC,QAAQ,CAAC,2BAA2B,EAAE,GAAG,EAAE,CAChD,MAAM,CAAC,OAAO,CAAC,SAAS,CAAC,CAC1B,CACF,CAAC;YACJ,QAAQ,GAAG,SAAS,EAAE,SAAS,EAAE,CAAC,CAAC,CAAC,CAAC;QACvC,CAAC;QACD,IAAI,CAAC,QAAQ,EAAE,WAAW,EAAE,CAAC;YAC3B,MAAM,MAAM,GAAG,KAAK,CAAC,CAAC,KAAK;iBACxB,iBAAiB,CAAC;gBACjB,eAAe,EAAE,eAAe;aACjC,CAAC;iBACD,IAAI,CACH,MAAM,CAAC,QAAQ,CAAC,+BAA+B,EAAE,GAAG,EAAE,CACpD,MAAM,CAAC,OAAO,CAAC,SAAS,CAAC,CAC1B,EACD,MAAM,CAAC,QAAQ,CAAC,2BAA2B,EAAE,GAAG,EAAE,CAChD,MAAM,CAAC,OAAO,CAAC,SAAS,CAAC,CAC1B,CACF,CAAC;YACJ,QAAQ,GAAG,MAAM,EAAE,SAAS,EAAE,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,KAAK,IAAI,CAAC,IAAI,CAAC,CAAC;QAClE,CAAC;QAED,8BAA8B;QAC9B,IAAI,CAAC,QAAQ,EAAE,WAAW,EAAE,CAAC;YAC3B,MAAM,OAAO,GAAG,KAAK,CAAC,CAAC,KAAK,CAAC,cAAc,CAAC;gBAC1C,eAAe,EAAE,eAAe;gBAChC,IAAI,EAAE,IAAI,CAAC,IAAI;gBACf,QAAQ,EAAE,eAAe;gBACzB,YAAY,EAAE,IAAI,CAAC,cAAc;oBAC/B,CAAC,CAAC,CAAC,EAAE,cAAc,EAAE,IAAI,CAAC,cAAc,EAAE,CAAC;oBAC3C,CAAC,CAAC,SAAS;gBACb,SAAS,EAAE,IAAI,CAAC,SAAS;gBACzB,cAAc,EAAE;oBACd;wBACE,IAAI,EAAE,SAAS;wBACf,cAAc,EAAE,qBAAqB;qBACtC;iBACF;aACF,CAAC,CAAC;YACH,QAAQ,GAAG,OAAO,CAAC,SAAS,EAAE,CAAC,CAAC,CAAC,CAAC;YAClC,IAAI,CAAC,QAAQ,EAAE,WAAW,EAAE,CAAC;gBAC3B,OAAO,KAAK,CAAC,CAAC,MAAM,CAAC,GAAG,CACtB,IAAI,KAAK,CAAC,qCAAqC,CAAC,CACjD,CAAC;YACJ,CAAC;YACD,KAAK,CAAC,CAAC,OAAO,CAAC,IAAI,CAAC,QAAQ,CAAC,WAAW,CAAC,CAAC;YAC1C,OAAO;gBACL,WAAW,EAAE,QAAQ,CAAC,WAA0B;gBAChD,eAAe,EAAE,QAAQ,CAAC,eAAkC;gBAC5D,cAAc,EAAE,qBAAqB;gBACrC,IAAI,EAAE,QAAQ,CAAC,IAAK;gBACpB,QAAQ,EAAE,QAAQ,CAAC,QAAS;aAC7B,CAAC;QACJ,CAAC;QAED,6DAA6D;QAC7D,mEAAmE;QACnE,MAAM,QAAQ,GAAG,KAAK,CAAC,CAAC,KAAK,CAAC,cAAc,CAAC;YAC3C,WAAW,EAAE,QAAQ,CAAC,WAAW;YACjC,IAAI,EAAE,IAAI,CAAC,IAAI;YACf,QAAQ,EAAE,eAAe;YACzB,YAAY,EAAE,IAAI,CAAC,cAAc;gBAC/B,CAAC,CAAC,CAAC,EAAE,cAAc,EAAE,IAAI,CAAC,cAAc,EAAE,CAAC;gBAC3C,CAAC,CAAC,SAAS;YACb,SAAS,EAAE,IAAI,CAAC,SAAS;YACzB,cAAc,EAAE;gBACd;oBACE,IAAI,EAAE,SAAS;oBACf,cAAc,EAAE,qBAAqB;iBACtC;aACF;SACF,CAAC,CAAC;QACH,MAAM,KAAK,GAAG,QAAQ,CAAC,SAAS,EAAE,CAAC,CAAC,CAAC,IAAI,QAAQ,CAAC;QAClD,KAAK,CAAC,CAAC,OAAO,CAAC,IAAI,CAAC,QAAQ,CAAC,WAAW,CAAC,CAAC;QAC1C,OAAO;YACL,WAAW,EAAE,QAAQ,CAAC,WAA0B;YAChD,eAAe,EAAE,QAAQ,CAAC,eAAkC;YAC5D,cAAc,EAAE,qBAAqB;YACrC,IAAI,EAAE,KAAK,CAAC,IAAI,IAAI,IAAI,CAAC,IAAI;YAC7B,QAAQ,EAAE,KAAK,CAAC,QAAQ,IAAI,eAAe;SAC5C,CAAC;IACJ,CAAC,CAAC;IACF,MAAM,EAAE,MAAM,CAAC,EAAE,CAAC,QAAQ,CAAC,EAAE,EAAE,MAAM,EAAE;QACrC,KAAK,CAAC,CAAC,KAAK;aACT,cAAc,CAAC;YACd,WAAW,EAAE,MAAM,CAAC,WAAW;SAChC,CAAC;aACD,IAAI,CAAC,MAAM,CAAC,QAAQ,CAAC,2BAA2B,EAAE,GAAG,EAAE,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC,CAAC;IAC3E,CAAC,CAAC;CACH,CAAC,CAAC"}
+{"version":3,"file":"Listener.js","sourceRoot":"","sources":["../../../src/AWS/ELBv2/Listener.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,KAAK,MAAM,gDAAgD,CAAC;AACxE,OAAO,KAAK,MAAM,MAAM,eAAe,CAAC;AACxC,OAAO,KAAK,MAAM,MAAM,eAAe,CAAC;AACxC,OAAO,EAAE,UAAU,EAAE,MAAM,eAAe,CAAC;AAE3C,OAAO,KAAK,QAAQ,MAAM,mBAAmB,CAAC;AAC9C,OAAO,EAAE,QAAQ,EAAE,MAAM,mBAAmB,CAAC;AAI7C,OAAO,EAAuB,gBAAgB,EAAE,MAAM,aAAa,CAAC;AAuEpE;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAuFG;AACH,MAAM,CAAC,MAAM,QAAQ,GAAG,QAAQ,CAAW,oBAAoB,CAAC,CAAC;AAEjE,4DAA4D;AAC5D,MAAM,qBAAqB,GAAG,CAAC,KAAoB,EAAkB,EAAE;IACrE,IAAI,KAAK,CAAC,cAAc,IAAI,KAAK,CAAC,cAAc,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;QAC5D,OAAO,gBAAgB,CAAC,KAAK,CAAC,cAAc,CAAC,CAAC;IAChD,CAAC;IACD,IAAI,KAAK,CAAC,cAAc,EAAE,CAAC;QACzB,OAAO,gBAAgB,CAAC;YACtB;gBACE,IAAI,EAAE,SAAS;gBACf,YAAY,EAAE;oBACZ,EAAE,cAAc,EAAE,KAAK,CAAC,cAAgC,EAAE;iBAC3D;aACF;SACF,CAAC,CAAC;IACL,CAAC;IACD,OAAO,EAAE,CAAC;AACZ,CAAC,CAAC;AAEF,sEAAsE;AACtE,MAAM,yBAAyB,GAAG,CAChC,OAAmC,EACP,EAAE;IAC9B,MAAM,OAAO,GAAG,CAAC,OAAO,IAAI,EAAE,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,KAAK,SAAS,CAAC,CAAC;IAClE,OAAO,CAAC,OAAO,EAAE,cAAc;QAC7B,OAAO,EAAE,aAAa,EAAE,YAAY,EAAE,CAAC,CAAC,CAAC,EAAE,cAAc,CAE9C,CAAC;AAChB,CAAC,CAAC;AAEF,oEAAoE;AACpE,MAAM,mBAAmB,GAAG,CAAC,KAAoB,EAAY,EAAE;IAC7D,IAAI,KAAK,CAAC,YAAY,IAAI,KAAK,CAAC,YAAY,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;QACxD,OAAO,KAAK,CAAC,YAAY,CAAC;IAC5B,CAAC;IACD,OAAO,KAAK,CAAC,cAAc,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,cAAc,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC;AAC5D,CAAC,CAAC;AAEF,MAAM,iBAAiB,GAAG,CACxB,KAAoB,EAC8B,EAAE,CACpD,KAAK,CAAC,oBAAoB;IACxB,CAAC,CAAC;QACE,IAAI,EAAE,KAAK,CAAC,oBAAoB,CAAC,IAAI;QACrC,aAAa,EAAE,KAAK,CAAC,oBAAoB,CAAC,aAAa;QACvD,6BAA6B,EAC3B,KAAK,CAAC,oBAAoB,CAAC,6BAA6B;QAC1D,0BAA0B,EACxB,KAAK,CAAC,oBAAoB,CAAC,0BAA0B;KACxD;IACH,CAAC,CAAC,SAAS,CAAC;AAEhB,MAAM,CAAC,MAAM,gBAAgB,GAAG,GAAG,EAAE,CACnC,QAAQ,CAAC,OAAO,CAAC,QAAQ,EAAE;IACzB,OAAO,EAAE,CAAC,aAAa,EAAE,iBAAiB,CAAC;IAC3C,IAAI,EAAE,MAAM,CAAC,EAAE,CAAC,QAAQ,CAAC,EAAE,EAAE,IAAI,EAAE,IAAI,EAAE;QACvC,IAAI,CAAC,UAAU,CAAC,IAAI,CAAC;YAAE,OAAO;QAC9B,IAAI,IAAI,CAAC,eAAe,KAAK,IAAI,CAAC,eAAe,EAAE,CAAC;YAClD,OAAO,EAAE,MAAM,EAAE,SAAS,EAAW,CAAC;QACxC,CAAC;IACH,CAAC,CAAC;IACF,IAAI,EAAE,MAAM,CAAC,EAAE,CAAC,QAAQ,CAAC,EAAE,EAAE,MAAM,EAAE;QACnC,IAAI,CAAC,MAAM,EAAE,CAAC;YACZ,OAAO,SAAS,CAAC;QACnB,CAAC;QACD,MAAM,SAAS,GAAG,KAAK,CAAC,CAAC,KAAK;aAC3B,iBAAiB,CAAC;YACjB,YAAY,EAAE,CAAC,MAAM,CAAC,WAAW,CAAC;SACnC,CAAC;aACD,IAAI,CACH,MAAM,CAAC,QAAQ,CAAC,2BAA2B,EAAE,GAAG,EAAE,CAChD,MAAM,CAAC,OAAO,CAAC,SAAS,CAAC,CAC1B,CACF,CAAC;QACJ,MAAM,QAAQ,GAAG,SAAS,EAAE,SAAS,EAAE,CAAC,CAAC,CAAC,CAAC;QAC3C,IAAI,CAAC,QAAQ,EAAE,WAAW,EAAE,CAAC;YAC3B,OAAO,SAAS,CAAC;QACnB,CAAC;QACD,OAAO;YACL,WAAW,EAAE,QAAQ,CAAC,WAA0B;YAChD,eAAe,EAAE,QAAQ,CAAC,eAAkC;YAC5D,cAAc,EACZ,yBAAyB,CAAC,QAAQ,CAAC,cAAc,CAAC;gBAClD,MAAM,CAAC,cAAc;YACvB,IAAI,EAAE,QAAQ,CAAC,IAAK;YACpB,QAAQ,EAAE,QAAQ,CAAC,QAAS;SAC7B,CAAC;IACJ,CAAC,CAAC;IACF,oEAAoE;IACpE,0EAA0E;IAC1E,kDAAkD;IAClD,IAAI,EAAE,MAAM,CAAC,EAAE,CAAC,QAAQ,CAAC;QACvB,MAAM,gBAAgB,GAAG,KAAK,CAAC,CAAC,KAAK,CAAC,qBAAqB;aACxD,KAAK,CAAC,EAAE,CAAC;aACT,IAAI,CACH,MAAM,CAAC,UAAU,EACjB,MAAM,CAAC,GAAG,CAAC,CAAC,KAAK,EAAE,EAAE,CACnB,KAAK,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,OAAO,CAAC,CAAC,IAAI,EAAE,EAAE,CACjC,CAAC,IAAI,CAAC,aAAa,IAAI,EAAE,CAAC,CAAC,OAAO,CAAC,CAAC,EAAE,EAAE,EAAE,CACxC,EAAE,CAAC,eAAe,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC,eAAe,CAAC,CAAC,CAAC,CAAC,EAAE,CAC/C,CACF,CACF,CACF,CAAC;QACJ,MAAM,IAAI,GAAG,KAAK,CAAC,CAAC,MAAM,CAAC,OAAO,CAChC,gBAAgB,EAChB,CAAC,eAAe,EAAE,EAAE,CAClB,KAAK,CAAC,iBAAiB;aACpB,KAAK,CAAC,EAAE,eAAe,EAAE,eAAe,EAAE,CAAC;aAC3C,IAAI,CACH,MAAM,CAAC,UAAU,EACjB,MAAM,CAAC,GAAG,CAAC,CAAC,KAAK,EAAE,EAAE,CACnB,KAAK,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,OAAO,CAAC,CAAC,IAAI,EAAE,EAAE,CACjC,CAAC,IAAI,CAAC,SAAS,IAAI,EAAE,CAAC;aACnB,MAAM,CACL,CAAC,CAAC,EAA2C,EAAE,CAC7C,CAAC,CAAC,WAAW,IAAI,IAAI,CACxB;aACA,GAAG,CAAC,CAAC,QAAQ,EAAE,EAAE,CAAC,CAAC;YAClB,WAAW,EAAE,QAAQ,CAAC,WAA0B;YAChD,eAAe,EACb,QAAQ,CAAC,eAAkC;YAC7C,cAAc,EAAE,yBAAyB,CACvC,QAAQ,CAAC,cAAc,CACxB;YACD,IAAI,EAAE,QAAQ,CAAC,IAAK;YACpB,QAAQ,EAAE,QAAQ,CAAC,QAAS;SAC7B,CAAC,CAAC,CACN,CACF;QACD,4DAA4D;QAC5D,MAAM,CAAC,QAAQ,CAAC,+BAA+B,EAAE,GAAG,EAAE,CACpD,MAAM,CAAC,OAAO,CAAC,EAAE,CAAC,CACnB,EACD,MAAM,CAAC,QAAQ,CAAC,2BAA2B,EAAE,GAAG,EAAE,CAChD,MAAM,CAAC,OAAO,CAAC,EAAE,CAAC,CACnB,CACF,EACL,EAAE,WAAW,EAAE,EAAE,EAAE,CACpB,CAAC;QACF,MAAM,MAAM,GAA6B,IAAI,CAAC,IAAI,EAAE,CAAC;QACrD,OAAO,MAAM,CAAC;IAChB,CAAC,CAAC;IACF,SAAS,EAAE,MAAM,CAAC,EAAE,CAAC,QAAQ,CAAC,EAAE,EAAE,IAAI,EAAE,MAAM,EAAE,OAAO,EAAE;QACvD,MAAM,eAAe,GAAG,IAAI,CAAC,eAAkC,CAAC;QAChE,MAAM,eAAe,GAAG,IAAI,CAAC,QAAQ,IAAI,MAAM,CAAC;QAChD,MAAM,cAAc,GAAG,qBAAqB,CAAC,IAAI,CAAC,CAAC;QACnD,MAAM,KAAK,GAAG,mBAAmB,CAAC,IAAI,CAAC,CAAC;QACxC,MAAM,oBAAoB,GAAG,iBAAiB,CAAC,IAAI,CAAC,CAAC;QAErD,oEAAoE;QACpE,kEAAkE;QAClE,IAAI,QAAoC,CAAC;QACzC,IAAI,MAAM,EAAE,WAAW,EAAE,CAAC;YACxB,MAAM,SAAS,GAAG,KAAK,CAAC,CAAC,KAAK;iBAC3B,iBAAiB,CAAC;gBACjB,YAAY,EAAE,CAAC,MAAM,CAAC,WAAW,CAAC;aACnC,CAAC;iBACD,IAAI,CACH,MAAM,CAAC,QAAQ,CAAC,2BAA2B,EAAE,GAAG,EAAE,CAChD,MAAM,CAAC,OAAO,CAAC,SAAS,CAAC,CAC1B,CACF,CAAC;YACJ,QAAQ,GAAG,SAAS,EAAE,SAAS,EAAE,CAAC,CAAC,CAAC,CAAC;QACvC,CAAC;QACD,IAAI,CAAC,QAAQ,EAAE,WAAW,EAAE,CAAC;YAC3B,MAAM,MAAM,GAAG,KAAK,CAAC,CAAC,KAAK;iBACxB,iBAAiB,CAAC;gBACjB,eAAe,EAAE,eAAe;aACjC,CAAC;iBACD,IAAI,CACH,MAAM,CAAC,QAAQ,CAAC,+BAA+B,EAAE,GAAG,EAAE,CACpD,MAAM,CAAC,OAAO,CAAC,SAAS,CAAC,CAC1B,EACD,MAAM,CAAC,QAAQ,CAAC,2BAA2B,EAAE,GAAG,EAAE,CAChD,MAAM,CAAC,OAAO,CAAC,SAAS,CAAC,CAC1B,CACF,CAAC;YACJ,QAAQ,GAAG,MAAM,EAAE,SAAS,EAAE,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,KAAK,IAAI,CAAC,IAAI,CAAC,CAAC;QAClE,CAAC;QAED,oEAAoE;QACpE,IAAI,CAAC,QAAQ,EAAE,WAAW,EAAE,CAAC;YAC3B,MAAM,OAAO,GAAG,KAAK,CAAC,CAAC,KAAK,CAAC,cAAc,CAAC;gBAC1C,eAAe,EAAE,eAAe;gBAChC,IAAI,EAAE,IAAI,CAAC,IAAI;gBACf,QAAQ,EAAE,eAAe;gBACzB,YAAY,EACV,KAAK,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC,EAAE,cAAc,EAAE,KAAK,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC,SAAS;gBAC/D,SAAS,EAAE,IAAI,CAAC,SAAS;gBACzB,UAAU,EAAE,IAAI,CAAC,UAAU;gBAC3B,oBAAoB,EAAE,oBAAoB;gBAC1C,cAAc,EAAE,cAAc;aAC/B,CAAC,CAAC;YACH,QAAQ,GAAG,OAAO,CAAC,SAAS,EAAE,CAAC,CAAC,CAAC,CAAC;YAClC,IAAI,CAAC,QAAQ,EAAE,WAAW,EAAE,CAAC;gBAC3B,OAAO,KAAK,CAAC,CAAC,MAAM,CAAC,GAAG,CACtB,IAAI,KAAK,CAAC,qCAAqC,CAAC,CACjD,CAAC;YACJ,CAAC;QACH,CAAC;aAAM,CAAC;YACN,6DAA6D;YAC7D,MAAM,QAAQ,GAAG,KAAK,CAAC,CAAC,KAAK,CAAC,cAAc,CAAC;gBAC3C,WAAW,EAAE,QAAQ,CAAC,WAAW;gBACjC,IAAI,EAAE,IAAI,CAAC,IAAI;gBACf,QAAQ,EAAE,eAAe;gBACzB,YAAY,EACV,KAAK,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC,EAAE,cAAc,EAAE,KAAK,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC,SAAS;gBAC/D,SAAS,EAAE,IAAI,CAAC,SAAS;gBACzB,UAAU,EAAE,IAAI,CAAC,UAAU;gBAC3B,oBAAoB,EAAE,oBAAoB;gBAC1C,cAAc,EAAE,cAAc;aAC/B,CAAC,CAAC;YACH,QAAQ,GAAG,QAAQ,CAAC,SAAS,EAAE,CAAC,CAAC,CAAC,IAAI,QAAQ,CAAC;QACjD,CAAC;QAED,MAAM,WAAW,GAAG,QAAQ,CAAC,WAAY,CAAC;QAE1C,qEAAqE;QACrE,sEAAsE;QACtE,oBAAoB;QACpB,MAAM,UAAU,GAAG,IAAI,GAAG,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC;QAC3C,MAAM,aAAa,GAAG,KAAK,CAAC,CAAC,KAAK;aAC/B,4BAA4B,CAAC,EAAE,WAAW,EAAE,WAAW,EAAE,CAAC;aAC1D,IAAI,CACH,MAAM,CAAC,QAAQ,CAAC,2BAA2B,EAAE,GAAG,EAAE,CAChD,MAAM,CAAC,OAAO,CAAC,SAAS,CAAC,CAC1B,CACF,CAAC;QACJ,MAAM,WAAW,GAAG,CAAC,aAAa,EAAE,YAAY,IAAI,EAAE,CAAC;aACpD,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,CAAC,SAAS,IAAI,CAAC,CAAC,cAAc,CAAC;aAC/C,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,cAAe,CAAC,CAAC;QACjC,MAAM,KAAK,GAAG,CAAC,GAAG,UAAU,CAAC,CAAC,MAAM,CAAC,CAAC,GAAG,EAAE,EAAE,CAAC,CAAC,WAAW,CAAC,QAAQ,CAAC,GAAG,CAAC,CAAC,CAAC;QAC1E,MAAM,QAAQ,GAAG,WAAW,CAAC,MAAM,CAAC,CAAC,GAAG,EAAE,EAAE,CAAC,CAAC,UAAU,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC,CAAC;QACnE,IAAI,KAAK,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;YACrB,KAAK,CAAC,CAAC,KAAK,CAAC,uBAAuB,CAAC;gBACnC,WAAW,EAAE,WAAW;gBACxB,YAAY,EAAE,KAAK,CAAC,GAAG,CAAC,CAAC,GAAG,EAAE,EAAE,CAAC,CAAC,EAAE,cAAc,EAAE,GAAG,EAAE,CAAC,CAAC;aAC5D,CAAC,CAAC;QACL,CAAC;QACD,IAAI,QAAQ,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;YACxB,KAAK,CAAC,CAAC,KAAK,CAAC,0BAA0B,CAAC;gBACtC,WAAW,EAAE,WAAW;gBACxB,YAAY,EAAE,QAAQ,CAAC,GAAG,CAAC,CAAC,GAAG,EAAE,EAAE,CAAC,CAAC,EAAE,cAAc,EAAE,GAAG,EAAE,CAAC,CAAC;aAC/D,CAAC,CAAC;QACL,CAAC;QAED,KAAK,CAAC,CAAC,OAAO,CAAC,IAAI,CAAC,WAAW,CAAC,CAAC;QACjC,OAAO;YACL,WAAW,EAAE,WAA0B;YACvC,eAAe,EAAE,QAAQ,CAAC,eAAkC;YAC5D,cAAc,EAAE,yBAAyB,CAAC,cAAc,CAAC;YACzD,IAAI,EAAE,QAAQ,CAAC,IAAI,IAAI,IAAI,CAAC,IAAI;YAChC,QAAQ,EAAE,QAAQ,CAAC,QAAQ,IAAI,eAAe;SAC/C,CAAC;IACJ,CAAC,CAAC;IACF,MAAM,EAAE,MAAM,CAAC,EAAE,CAAC,QAAQ,CAAC,EAAE,EAAE,MAAM,EAAE;QACrC,KAAK,CAAC,CAAC,KAAK;aACT,cAAc,CAAC;YACd,WAAW,EAAE,MAAM,CAAC,WAAW;SAChC,CAAC;aACD,IAAI,CAAC,MAAM,CAAC,QAAQ,CAAC,2BAA2B,EAAE,GAAG,EAAE,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC,CAAC;IAC3E,CAAC,CAAC;CACH,CAAC,CAAC"}