alchemy 2.0.0-beta.test-export-fix-4 → 2.0.0-cli-bundle-fix.1

package/lib/AWS/ACM/Certificate.js

@@ -0,0 +1,268 @@
+import { Region as AwsRegion } from "@distilled.cloud/aws/Region";
+import * as acm from "@distilled.cloud/aws/acm";
+import * as route53 from "@distilled.cloud/aws/route-53";
+import * as Effect from "effect/Effect";
+import * as Schedule from "effect/Schedule";
+import { deepEqual, isResolved } from "../../Diff.js";
+import * as Provider from "../../Provider.js";
+import { Resource } from "../../Resource.js";
+import { createInternalTags, createTagsList, diffTags, hasAlchemyTags, } from "../../Tags.js";
+/**
+ * An ACM certificate for CloudFront and other AWS endpoints.
+ *
+ * `Certificate` requests an ACM certificate in `us-east-1`, which is the
+ * region required for CloudFront viewer certificates. When `hostedZoneId` is
+ * provided for DNS validation, the provider creates or updates the Route 53
+ * validation records and waits for the certificate to be issued.
+ *
+ * @section Requesting Certificates
+ * @example DNS-Validated Certificate
+ * ```typescript
+ * const cert = yield* Certificate("WebsiteCertificate", {
+ *   domainName: "www.example.com",
+ *   hostedZoneId: "Z1234567890",
+ * });
+ * ```
+ *
+ * @example Certificate With SANs
+ * ```typescript
+ * const cert = yield* Certificate("WebsiteCertificate", {
+ *   domainName: "example.com",
+ *   subjectAlternativeNames: ["www.example.com"],
+ *   hostedZoneId: "Z1234567890",
+ * });
+ * ```
+ */
+export const Certificate = Resource("AWS.ACM.Certificate");
+export const CertificateProvider = () => Provider.effect(Certificate, Effect.gen(function* () {
+    const describeCertificate = Effect.fn(function* (certificateArn) {
+        return yield* withAcmRegion(acm.describeCertificate({ CertificateArn: certificateArn }).pipe(Effect.map((response) => response.Certificate), Effect.catchTag("ResourceNotFoundException", () => Effect.succeed(undefined))));
+    });
+    const listCertificateTags = Effect.fn(function* (certificateArn) {
+        return yield* withAcmRegion(acm.listTagsForCertificate({ CertificateArn: certificateArn }).pipe(Effect.map((response) => toTagRecord(response.Tags)), Effect.catchTag("ResourceNotFoundException", () => Effect.succeed({}))));
+    });
+    const findManagedCertificate = Effect.fn(function* (id, props) {
+        const listed = yield* withAcmRegion(acm.listCertificates({
+            Includes: {
+                keyTypes: props.keyAlgorithm ? [props.keyAlgorithm] : undefined,
+            },
+        }));
+        const summaries = listed.CertificateSummaryList?.filter((summary) => summary.DomainName === props.domainName) ?? [];
+        for (const summary of summaries) {
+            if (!summary.CertificateArn) {
+                continue;
+            }
+            const detail = yield* describeCertificate(summary.CertificateArn);
+            if (!detail?.CertificateArn) {
+                continue;
+            }
+            if (detail.DomainName !== props.domainName ||
+                JSON.stringify(normalizeSanList(detail.SubjectAlternativeNames)) !==
+                    JSON.stringify(normalizeSanList(props.subjectAlternativeNames))) {
+                continue;
+            }
+            const tags = yield* listCertificateTags(detail.CertificateArn);
+            if (yield* hasAlchemyTags(id, tags)) {
+                return detail;
+            }
+        }
+        return undefined;
+    });
+    const waitForValidationRecords = Effect.fn(function* (certificateArn) {
+        return yield* describeCertificate(certificateArn).pipe(Effect.flatMap((detail) => {
+            const validations = detail?.DomainValidationOptions ?? [];
+            if (validations.length === 0 ||
+                validations.some((option) => option.ResourceRecord === undefined)) {
+                return Effect.fail(new Error("CertificateValidationRecordPending"));
+            }
+            return Effect.succeed(detail);
+        }), Effect.retry({
+            while: (error) => error instanceof Error &&
+                error.message === "CertificateValidationRecordPending",
+            schedule: Schedule.fixed("2 seconds").pipe(Schedule.both(Schedule.recurs(60))),
+        }));
+    });
+    const waitForIssued = Effect.fn(function* (certificateArn) {
+        return yield* describeCertificate(certificateArn).pipe(Effect.flatMap((detail) => {
+            if (!detail?.CertificateArn) {
+                return Effect.fail(new Error("CertificateNotFound"));
+            }
+            if (detail.Status === "ISSUED") {
+                return Effect.succeed(detail);
+            }
+            if (isTerminalFailure(detail.Status)) {
+                return Effect.fail(new Error(`Certificate issuance failed with status ${detail.Status}${detail.FailureReason ? ` (${detail.FailureReason})` : ""}`));
+            }
+            return Effect.fail(new Error("CertificatePendingValidation"));
+        }), Effect.retry({
+            while: (error) => error instanceof Error &&
+                error.message === "CertificatePendingValidation",
+            schedule: Schedule.fixed("10 seconds").pipe(Schedule.both(Schedule.recurs(60))),
+        }));
+    });
+    const waitForChange = Effect.fn(function* (changeId) {
+        return yield* route53.getChange({ Id: changeId }).pipe(Effect.map((response) => response.ChangeInfo), Effect.flatMap((changeInfo) => changeInfo.Status === "INSYNC"
+            ? Effect.succeed(changeInfo)
+            : Effect.fail(new Error("Route53ChangePending"))), Effect.retry({
+            while: (error) => error instanceof Error &&
+                error.message === "Route53ChangePending",
+            schedule: Schedule.fixed("2 seconds").pipe(Schedule.both(Schedule.recurs(60))),
+        }));
+    });
+    const upsertValidationRecords = Effect.fn(function* (hostedZoneId, certificate) {
+        const changes = (certificate.DomainValidationOptions ?? [])
+            .flatMap((option) => option.ResourceRecord ? [option.ResourceRecord] : [])
+            .map((record) => ({
+            Action: "UPSERT",
+            ResourceRecordSet: {
+                Name: record.Name,
+                Type: record.Type,
+                TTL: 60,
+                ResourceRecords: [{ Value: record.Value }],
+            },
+        }));
+        if (changes.length === 0) {
+            return;
+        }
+        const response = yield* route53.changeResourceRecordSets({
+            HostedZoneId: normalizeHostedZoneId(hostedZoneId),
+            ChangeBatch: {
+                Comment: "Alchemy ACM DNS validation",
+                Changes: changes,
+            },
+        });
+        yield* waitForChange(response.ChangeInfo.Id);
+    });
+    return {
+        stables: ["certificateArn"],
+        diff: Effect.fn(function* ({ olds, news: _news }) {
+            if (!isResolved(_news))
+                return undefined;
+            const news = _news;
+            if (olds.domainName !== news.domainName ||
+                !deepEqual(normalizeSanList(olds.subjectAlternativeNames), normalizeSanList(news.subjectAlternativeNames)) ||
+                (olds.validationMethod ?? defaultValidationMethod) !==
+                    (news.validationMethod ?? defaultValidationMethod) ||
+                olds.hostedZoneId !== news.hostedZoneId ||
+                olds.keyAlgorithm !== news.keyAlgorithm ||
+                olds.certificateTransparencyLoggingPreference !==
+                    news.certificateTransparencyLoggingPreference) {
+                return { action: "replace" };
+            }
+        }),
+        read: Effect.fn(function* ({ id, olds, output }) {
+            const certificate = output?.certificateArn
+                ? yield* describeCertificate(output.certificateArn)
+                : yield* findManagedCertificate(id, olds);
+            if (!certificate?.CertificateArn) {
+                return undefined;
+            }
+            const tags = yield* listCertificateTags(certificate.CertificateArn);
+            return toAttrs(olds, certificate, tags);
+        }),
+        create: Effect.fn(function* ({ id, instanceId, news, session }) {
+            const tags = {
+                ...(yield* createInternalTags(id)),
+                ...news.tags,
+            };
+            const existing = yield* findManagedCertificate(id, news);
+            const certificate = existing ??
+                (yield* withAcmRegion(acm
+                    .requestCertificate({
+                    DomainName: news.domainName,
+                    SubjectAlternativeNames: news.subjectAlternativeNames,
+                    ValidationMethod: news.validationMethod ?? defaultValidationMethod,
+                    KeyAlgorithm: news.keyAlgorithm,
+                    Options: news.certificateTransparencyLoggingPreference
+                        ? {
+                            CertificateTransparencyLoggingPreference: news.certificateTransparencyLoggingPreference,
+                        }
+                        : undefined,
+                    IdempotencyToken: instanceId
+                        .replaceAll(/[^a-zA-Z0-9]/g, "")
+                        .slice(0, 32),
+                    Tags: createTagsList(tags),
+                })
+                    .pipe(Effect.flatMap((response) => response.CertificateArn
+                    ? describeCertificate(response.CertificateArn).pipe(Effect.map((detail) => detail))
+                    : Effect.fail(new Error("requestCertificate returned no certificate ARN"))))));
+            if (!certificate?.CertificateArn) {
+                return yield* Effect.fail(new Error("Failed to obtain ACM certificate"));
+            }
+            yield* session.note(certificate.CertificateArn);
+            const shouldAutoValidate = (news.validationMethod ?? defaultValidationMethod) === "DNS" &&
+                news.hostedZoneId !== undefined;
+            const finalCertificate = shouldAutoValidate
+                ? yield* Effect.gen(function* () {
+                    const withRecords = yield* waitForValidationRecords(certificate.CertificateArn);
+                    yield* upsertValidationRecords(news.hostedZoneId, withRecords);
+                    return yield* waitForIssued(certificate.CertificateArn);
+                })
+                : certificate;
+            const listedTags = yield* listCertificateTags(certificate.CertificateArn);
+            return toAttrs(news, finalCertificate, listedTags);
+        }),
+        update: Effect.fn(function* ({ id, olds, news, output, session }) {
+            const oldTags = {
+                ...(yield* createInternalTags(id)),
+                ...olds.tags,
+            };
+            const newTags = {
+                ...(yield* createInternalTags(id)),
+                ...news.tags,
+            };
+            const { removed, upsert } = diffTags(oldTags, newTags);
+            if (upsert.length > 0) {
+                yield* withAcmRegion(acm.addTagsToCertificate({
+                    CertificateArn: output.certificateArn,
+                    Tags: upsert,
+                }));
+            }
+            if (removed.length > 0) {
+                yield* withAcmRegion(acm.removeTagsFromCertificate({
+                    CertificateArn: output.certificateArn,
+                    Tags: removed.map((Key) => ({ Key })),
+                }));
+            }
+            const detail = yield* describeCertificate(output.certificateArn);
+            if (!detail?.CertificateArn) {
+                return output;
+            }
+            yield* session.note(output.certificateArn);
+            const tags = yield* listCertificateTags(output.certificateArn);
+            return toAttrs(news, detail, tags);
+        }),
+        delete: Effect.fn(function* ({ output }) {
+            yield* withAcmRegion(acm
+                .deleteCertificate({
+                CertificateArn: output.certificateArn,
+            })
+                .pipe(Effect.catchTag("ResourceNotFoundException", () => Effect.void)));
+        }),
+    };
+}));
+const ACM_REGION = "us-east-1";
+const defaultValidationMethod = "DNS";
+const withAcmRegion = (effect) => effect.pipe(Effect.provideService(AwsRegion, ACM_REGION));
+const normalizeHostedZoneId = (hostedZoneId) => hostedZoneId.replace(/^\/hostedzone\//, "");
+const normalizeSanList = (names) => [...(names ?? [])].sort((a, b) => a.localeCompare(b));
+const toTagRecord = (tags) => Object.fromEntries((tags ?? [])
+    .filter((tag) => typeof tag.Key === "string" && typeof tag.Value === "string")
+    .map((tag) => [tag.Key, tag.Value]));
+const toAttrs = (props, detail, tags) => ({
+    certificateArn: detail.CertificateArn,
+    domainName: detail.DomainName ?? props.domainName,
+    subjectAlternativeNames: detail.SubjectAlternativeNames ?? [],
+    status: detail.Status,
+    domainValidationOptions: detail.DomainValidationOptions ?? [],
+    validationMethod: props.validationMethod ?? defaultValidationMethod,
+    keyAlgorithm: detail.KeyAlgorithm ?? props.keyAlgorithm,
+    hostedZoneId: props.hostedZoneId
+        ? normalizeHostedZoneId(props.hostedZoneId)
+        : undefined,
+    tags,
+    issuedAt: detail.IssuedAt,
+    notAfter: detail.NotAfter,
+});
+const isTerminalFailure = (status) => status === "FAILED" || status === "VALIDATION_TIMED_OUT";
+//# sourceMappingURL=Certificate.js.map

package/lib/AWS/ACM/Certificate.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"Certificate.js","sourceRoot":"","sources":["../../../src/AWS/ACM/Certificate.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,MAAM,IAAI,SAAS,EAAE,MAAM,6BAA6B,CAAC;AAClE,OAAO,KAAK,GAAG,MAAM,0BAA0B,CAAC;AAChD,OAAO,KAAK,OAAO,MAAM,+BAA+B,CAAC;AACzD,OAAO,KAAK,MAAM,MAAM,eAAe,CAAC;AACxC,OAAO,KAAK,QAAQ,MAAM,iBAAiB,CAAC;AAC5C,OAAO,EAAE,SAAS,EAAE,UAAU,EAAE,MAAM,eAAe,CAAC;AACtD,OAAO,KAAK,QAAQ,MAAM,mBAAmB,CAAC;AAC9C,OAAO,EAAE,QAAQ,EAAE,MAAM,mBAAmB,CAAC;AAE7C,OAAO,EACL,kBAAkB,EAClB,cAAc,EACd,QAAQ,EACR,cAAc,GACf,MAAM,eAAe,CAAC;AA0FvB;;;;;;;;;;;;;;;;;;;;;;;;;GAyBG;AACH,MAAM,CAAC,MAAM,WAAW,GAAG,QAAQ,CAAc,qBAAqB,CAAC,CAAC;AAExE,MAAM,CAAC,MAAM,mBAAmB,GAAG,GAAG,EAAE,CACtC,QAAQ,CAAC,MAAM,CACb,WAAW,EACX,MAAM,CAAC,GAAG,CAAC,QAAQ,CAAC;IAClB,MAAM,mBAAmB,GAAG,MAAM,CAAC,EAAE,CAAC,QAAQ,CAAC,EAAE,cAAsB;QACrE,OAAO,KAAK,CAAC,CAAC,aAAa,CACzB,GAAG,CAAC,mBAAmB,CAAC,EAAE,cAAc,EAAE,cAAc,EAAE,CAAC,CAAC,IAAI,CAC9D,MAAM,CAAC,GAAG,CAAC,CAAC,QAAQ,EAAE,EAAE,CAAC,QAAQ,CAAC,WAAW,CAAC,EAC9C,MAAM,CAAC,QAAQ,CAAC,2BAA2B,EAAE,GAAG,EAAE,CAChD,MAAM,CAAC,OAAO,CAAC,SAAS,CAAC,CAC1B,CACF,CACF,CAAC;IACJ,CAAC,CAAC,CAAC;IAEH,MAAM,mBAAmB,GAAG,MAAM,CAAC,EAAE,CAAC,QAAQ,CAAC,EAAE,cAAsB;QACrE,OAAO,KAAK,CAAC,CAAC,aAAa,CACzB,GAAG,CAAC,sBAAsB,CAAC,EAAE,cAAc,EAAE,cAAc,EAAE,CAAC,CAAC,IAAI,CACjE,MAAM,CAAC,GAAG,CAAC,CAAC,QAAQ,EAAE,EAAE,CAAC,WAAW,CAAC,QAAQ,CAAC,IAAI,CAAC,CAAC,EACpD,MAAM,CAAC,QAAQ,CAAC,2BAA2B,EAAE,GAAG,EAAE,CAChD,MAAM,CAAC,OAAO,CAAC,EAAE,CAAC,CACnB,CACF,CACF,CAAC;IACJ,CAAC,CAAC,CAAC;IAEH,MAAM,sBAAsB,GAAG,MAAM,CAAC,EAAE,CAAC,QAAQ,CAAC,EAChD,EAAU,EACV,KAAuB;QAEvB,MAAM,MAAM,GAAG,KAAK,CAAC,CAAC,aAAa,CACjC,GAAG,CAAC,gBAAgB,CAAC;YACnB,QAAQ,EAAE;gBACR,QAAQ,EAAE,KAAK,CAAC,YAAY,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,YAAY,CAAC,CAAC,CAAC,CAAC,SAAS;aAChE;SACK,CAAC,CACV,CAAC;QAEF,MAAM,SAAS,GACb,MAAM,CAAC,sBAAsB,EAAE,MAAM,CACnC,CAAC,OAAO,EAAE,EAAE,CAAC,OAAO,CAAC,UAAU,KAAK,KAAK,CAAC,UAAU,CACrD,IAAI,EAAE,CAAC;QAEV,KAAK,MAAM,OAAO,IAAI,SAAS,EAAE,CAAC;YAChC,IAAI,CAAC,OAAO,CAAC,cAAc,EAAE,CAAC;gBAC5B,SAAS;YACX,CAAC;YACD,MAAM,MAAM,GAAG,KAAK,CAAC,CAAC,mBAAmB,CAAC,OAAO,CAAC,cAAc,CAAC,CAAC;YAClE,IAAI,CAAC,MAAM,EAAE,cAAc,EAAE,CAAC;gBAC5B,SAAS;YACX,CAAC;YACD,IACE,MAAM,CAAC,UAAU,KAAK,KAAK,CAAC,UAAU;gBACtC,IAAI,CAAC,SAAS,CAAC,gBAAgB,CAAC,MAAM,CAAC,uBAAuB,CAAC,CAAC;oBAC9D,IAAI,CAAC,SAAS,CAAC,gBAAgB,CAAC,KAAK,CAAC,uBAAuB,CAAC,CAAC,EACjE,CAAC;gBACD,SAAS;YACX,CAAC;YACD,MAAM,IAAI,GAAG,KAAK,CAAC,CAAC,mBAAmB,CAAC,MAAM,CAAC,cAAc,CAAC,CAAC;YAC/D,IAAI,KAAK,CAAC,CAAC,cAAc,CAAC,EAAE,EAAE,IAAI,CAAC,EAAE,CAAC;gBACpC,OAAO,MAAM,CAAC;YAChB,CAAC;QACH,CAAC;QAED,OAAO,SAAS,CAAC;IACnB,CAAC,CAAC,CAAC;IAEH,MAAM,wBAAwB,GAAG,MAAM,CAAC,EAAE,CAAC,QAAQ,CAAC,EAClD,cAAsB;QAEtB,OAAO,KAAK,CAAC,CAAC,mBAAmB,CAAC,cAAc,CAAC,CAAC,IAAI,CACpD,MAAM,CAAC,OAAO,CAAC,CAAC,MAAM,EAAE,EAAE;YACxB,MAAM,WAAW,GAAG,MAAM,EAAE,uBAAuB,IAAI,EAAE,CAAC;YAC1D,IACE,WAAW,CAAC,MAAM,KAAK,CAAC;gBACxB,WAAW,CAAC,IAAI,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC,MAAM,CAAC,cAAc,KAAK,SAAS,CAAC,EACjE,CAAC;gBACD,OAAO,MAAM,CAAC,IAAI,CAChB,IAAI,KAAK,CAAC,oCAAoC,CAAC,CAChD,CAAC;YACJ,CAAC;YACD,OAAO,MAAM,CAAC,OAAO,CAAC,MAAO,CAAC,CAAC;QACjC,CAAC,CAAC,EACF,MAAM,CAAC,KAAK,CAAC;YACX,KAAK,EAAE,CAAC,KAAK,EAAE,EAAE,CACf,KAAK,YAAY,KAAK;gBACtB,KAAK,CAAC,OAAO,KAAK,oCAAoC;YACxD,QAAQ,EAAE,QAAQ,CAAC,KAAK,CAAC,WAAW,CAAC,CAAC,IAAI,CACxC,QAAQ,CAAC,IAAI,CAAC,QAAQ,CAAC,MAAM,CAAC,EAAE,CAAC,CAAC,CACnC;SACF,CAAC,CACH,CAAC;IACJ,CAAC,CAAC,CAAC;IAEH,MAAM,aAAa,GAAG,MAAM,CAAC,EAAE,CAAC,QAAQ,CAAC,EAAE,cAAsB;QAC/D,OAAO,KAAK,CAAC,CAAC,mBAAmB,CAAC,cAAc,CAAC,CAAC,IAAI,CACpD,MAAM,CAAC,OAAO,CAAC,CAAC,MAAM,EAAE,EAAE;YACxB,IAAI,CAAC,MAAM,EAAE,cAAc,EAAE,CAAC;gBAC5B,OAAO,MAAM,CAAC,IAAI,CAAC,IAAI,KAAK,CAAC,qBAAqB,CAAC,CAAC,CAAC;YACvD,CAAC;YACD,IAAI,MAAM,CAAC,MAAM,KAAK,QAAQ,EAAE,CAAC;gBAC/B,OAAO,MAAM,CAAC,OAAO,CAAC,MAAM,CAAC,CAAC;YAChC,CAAC;YACD,IAAI,iBAAiB,CAAC,MAAM,CAAC,MAAM,CAAC,EAAE,CAAC;gBACrC,OAAO,MAAM,CAAC,IAAI,CAChB,IAAI,KAAK,CACP,2CAA2C,MAAM,CAAC,MAAM,GAAG,MAAM,CAAC,aAAa,CAAC,CAAC,CAAC,KAAK,MAAM,CAAC,aAAa,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CACtH,CACF,CAAC;YACJ,CAAC;YACD,OAAO,MAAM,CAAC,IAAI,CAAC,IAAI,KAAK,CAAC,8BAA8B,CAAC,CAAC,CAAC;QAChE,CAAC,CAAC,EACF,MAAM,CAAC,KAAK,CAAC;YACX,KAAK,EAAE,CAAC,KAAK,EAAE,EAAE,CACf,KAAK,YAAY,KAAK;gBACtB,KAAK,CAAC,OAAO,KAAK,8BAA8B;YAClD,QAAQ,EAAE,QAAQ,CAAC,KAAK,CAAC,YAAY,CAAC,CAAC,IAAI,CACzC,QAAQ,CAAC,IAAI,CAAC,QAAQ,CAAC,MAAM,CAAC,EAAE,CAAC,CAAC,CACnC;SACF,CAAC,CACH,CAAC;IACJ,CAAC,CAAC,CAAC;IAEH,MAAM,aAAa,GAAG,MAAM,CAAC,EAAE,CAAC,QAAQ,CAAC,EAAE,QAAgB;QACzD,OAAO,KAAK,CAAC,CAAC,OAAO,CAAC,SAAS,CAAC,EAAE,EAAE,EAAE,QAAQ,EAAE,CAAC,CAAC,IAAI,CACpD,MAAM,CAAC,GAAG,CAAC,CAAC,QAAQ,EAAE,EAAE,CAAC,QAAQ,CAAC,UAAU,CAAC,EAC7C,MAAM,CAAC,OAAO,CAAC,CAAC,UAAU,EAAE,EAAE,CAC5B,UAAU,CAAC,MAAM,KAAK,QAAQ;YAC5B,CAAC,CAAC,MAAM,CAAC,OAAO,CAAC,UAAU,CAAC;YAC5B,CAAC,CAAC,MAAM,CAAC,IAAI,CAAC,IAAI,KAAK,CAAC,sBAAsB,CAAC,CAAC,CACnD,EACD,MAAM,CAAC,KAAK,CAAC;YACX,KAAK,EAAE,CAAC,KAAK,EAAE,EAAE,CACf,KAAK,YAAY,KAAK;gBACtB,KAAK,CAAC,OAAO,KAAK,sBAAsB;YAC1C,QAAQ,EAAE,QAAQ,CAAC,KAAK,CAAC,WAAW,CAAC,CAAC,IAAI,CACxC,QAAQ,CAAC,IAAI,CAAC,QAAQ,CAAC,MAAM,CAAC,EAAE,CAAC,CAAC,CACnC;SACF,CAAC,CACH,CAAC;IACJ,CAAC,CAAC,CAAC;IAEH,MAAM,uBAAuB,GAAG,MAAM,CAAC,EAAE,CAAC,QAAQ,CAAC,EACjD,YAAoB,EACpB,WAAkC;QAElC,MAAM,OAAO,GAAG,CAAC,WAAW,CAAC,uBAAuB,IAAI,EAAE,CAAC;aACxD,OAAO,CAAC,CAAC,MAAM,EAAE,EAAE,CAClB,MAAM,CAAC,cAAc,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,cAAc,CAAC,CAAC,CAAC,CAAC,EAAE,CACrD;aACA,GAAG,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC,CAAC;YAChB,MAAM,EAAE,QAAiB;YACzB,iBAAiB,EAAE;gBACjB,IAAI,EAAE,MAAM,CAAC,IAAI;gBACjB,IAAI,EAAE,MAAM,CAAC,IAAI;gBACjB,GAAG,EAAE,EAAE;gBACP,eAAe,EAAE,CAAC,EAAE,KAAK,EAAE,MAAM,CAAC,KAAK,EAAE,CAAC;aAC3C;SACF,CAAC,CAAC,CAAC;QAEN,IAAI,OAAO,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;YACzB,OAAO;QACT,CAAC;QAED,MAAM,QAAQ,GAAG,KAAK,CAAC,CAAC,OAAO,CAAC,wBAAwB,CAAC;YACvD,YAAY,EAAE,qBAAqB,CAAC,YAAY,CAAC;YACjD,WAAW,EAAE;gBACX,OAAO,EAAE,4BAA4B;gBACrC,OAAO,EAAE,OAAO;aACjB;SACF,CAAC,CAAC;QAEH,KAAK,CAAC,CAAC,aAAa,CAAC,QAAQ,CAAC,UAAU,CAAC,EAAE,CAAC,CAAC;IAC/C,CAAC,CAAC,CAAC;IAEH,OAAO;QACL,OAAO,EAAE,CAAC,gBAAgB,CAAC;QAC3B,IAAI,EAAE,MAAM,CAAC,EAAE,CAAC,QAAQ,CAAC,EAAE,EAAE,IAAI,EAAE,IAAI,EAAE,KAAK,EAAE;YAC9C,IAAI,CAAC,UAAU,CAAC,KAAK,CAAC;gBAAE,OAAO,SAAS,CAAC;YACzC,MAAM,IAAI,GAAG,KAAoB,CAAC;YAClC,IACE,IAAI,CAAC,UAAU,KAAK,IAAI,CAAC,UAAU;gBACnC,CAAC,SAAS,CACR,gBAAgB,CAAC,IAAI,CAAC,uBAAuB,CAAC,EAC9C,gBAAgB,CAAC,IAAI,CAAC,uBAAuB,CAAC,CAC/C;gBACD,CAAC,IAAI,CAAC,gBAAgB,IAAI,uBAAuB,CAAC;oBAChD,CAAC,IAAI,CAAC,gBAAgB,IAAI,uBAAuB,CAAC;gBACpD,IAAI,CAAC,YAAY,KAAK,IAAI,CAAC,YAAY;gBACvC,IAAI,CAAC,YAAY,KAAK,IAAI,CAAC,YAAY;gBACvC,IAAI,CAAC,wCAAwC;oBAC3C,IAAI,CAAC,wCAAwC,EAC/C,CAAC;gBACD,OAAO,EAAE,MAAM,EAAE,SAAS,EAAW,CAAC;YACxC,CAAC;QACH,CAAC,CAAC;QACF,IAAI,EAAE,MAAM,CAAC,EAAE,CAAC,QAAQ,CAAC,EAAE,EAAE,EAAE,EAAE,IAAI,EAAE,MAAM,EAAE;YAC7C,MAAM,WAAW,GAAG,MAAM,EAAE,cAAc;gBACxC,CAAC,CAAC,KAAK,CAAC,CAAC,mBAAmB,CAAC,MAAM,CAAC,cAAc,CAAC;gBACnD,CAAC,CAAC,KAAK,CAAC,CAAC,sBAAsB,CAAC,EAAE,EAAE,IAAK,CAAC,CAAC;YAE7C,IAAI,CAAC,WAAW,EAAE,cAAc,EAAE,CAAC;gBACjC,OAAO,SAAS,CAAC;YACnB,CAAC;YAED,MAAM,IAAI,GAAG,KAAK,CAAC,CAAC,mBAAmB,CAAC,WAAW,CAAC,cAAc,CAAC,CAAC;YACpE,OAAO,OAAO,CAAC,IAAK,EAAE,WAAW,EAAE,IAAI,CAAC,CAAC;QAC3C,CAAC,CAAC;QACF,MAAM,EAAE,MAAM,CAAC,EAAE,CAAC,QAAQ,CAAC,EAAE,EAAE,EAAE,EAAE,UAAU,EAAE,IAAI,EAAE,OAAO,EAAE;YAC5D,MAAM,IAAI,GAAG;gBACX,GAAG,CAAC,KAAK,CAAC,CAAC,kBAAkB,CAAC,EAAE,CAAC,CAAC;gBAClC,GAAG,IAAI,CAAC,IAAI;aACb,CAAC;YAEF,MAAM,QAAQ,GAAG,KAAK,CAAC,CAAC,sBAAsB,CAAC,EAAE,EAAE,IAAI,CAAC,CAAC;YACzD,MAAM,WAAW,GACf,QAAQ;gBACR,CAAC,KAAK,CAAC,CAAC,aAAa,CACnB,GAAG;qBACA,kBAAkB,CAAC;oBAClB,UAAU,EAAE,IAAI,CAAC,UAAU;oBAC3B,uBAAuB,EAAE,IAAI,CAAC,uBAAuB;oBACrD,gBAAgB,EACd,IAAI,CAAC,gBAAgB,IAAI,uBAAuB;oBAClD,YAAY,EAAE,IAAI,CAAC,YAAY;oBAC/B,OAAO,EAAE,IAAI,CAAC,wCAAwC;wBACpD,CAAC,CAAC;4BACE,wCAAwC,EACtC,IAAI,CAAC,wCAAwC;yBAChD;wBACH,CAAC,CAAC,SAAS;oBACb,gBAAgB,EAAE,UAAU;yBACzB,UAAU,CAAC,eAAe,EAAE,EAAE,CAAC;yBAC/B,KAAK,CAAC,CAAC,EAAE,EAAE,CAAC;oBACf,IAAI,EAAE,cAAc,CAAC,IAAI,CAAC;iBAC3B,CAAC;qBACD,IAAI,CACH,MAAM,CAAC,OAAO,CAAC,CAAC,QAAQ,EAAE,EAAE,CAC1B,QAAQ,CAAC,cAAc;oBACrB,CAAC,CAAC,mBAAmB,CAAC,QAAQ,CAAC,cAAc,CAAC,CAAC,IAAI,CAC/C,MAAM,CAAC,GAAG,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC,MAAO,CAAC,CAChC;oBACH,CAAC,CAAC,MAAM,CAAC,IAAI,CACT,IAAI,KAAK,CACP,gDAAgD,CACjD,CACF,CACN,CACF,CACJ,CAAC,CAAC;YAEL,IAAI,CAAC,WAAW,EAAE,cAAc,EAAE,CAAC;gBACjC,OAAO,KAAK,CAAC,CAAC,MAAM,CAAC,IAAI,CACvB,IAAI,KAAK,CAAC,kCAAkC,CAAC,CAC9C,CAAC;YACJ,CAAC;YAED,KAAK,CAAC,CAAC,OAAO,CAAC,IAAI,CAAC,WAAW,CAAC,cAAc,CAAC,CAAC;YAEhD,MAAM,kBAAkB,GACtB,CAAC,IAAI,CAAC,gBAAgB,IAAI,uBAAuB,CAAC,KAAK,KAAK;gBAC5D,IAAI,CAAC,YAAY,KAAK,SAAS,CAAC;YAElC,MAAM,gBAAgB,GAAG,kBAAkB;gBACzC,CAAC,CAAC,KAAK,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,QAAQ,CAAC;oBACzB,MAAM,WAAW,GAAG,KAAK,CAAC,CAAC,wBAAwB,CACjD,WAAW,CAAC,cAAe,CAC5B,CAAC;oBACF,KAAK,CAAC,CAAC,uBAAuB,CAAC,IAAI,CAAC,YAAa,EAAE,WAAW,CAAC,CAAC;oBAChE,OAAO,KAAK,CAAC,CAAC,aAAa,CAAC,WAAW,CAAC,cAAe,CAAC,CAAC;gBAC3D,CAAC,CAAC;gBACJ,CAAC,CAAC,WAAW,CAAC;YAEhB,MAAM,UAAU,GAAG,KAAK,CAAC,CAAC,mBAAmB,CAC3C,WAAW,CAAC,cAAc,CAC3B,CAAC;YACF,OAAO,OAAO,CAAC,IAAI,EAAE,gBAAgB,EAAE,UAAU,CAAC,CAAC;QACrD,CAAC,CAAC;QACF,MAAM,EAAE,MAAM,CAAC,EAAE,CAAC,QAAQ,CAAC,EAAE,EAAE,EAAE,EAAE,IAAI,EAAE,IAAI,EAAE,MAAM,EAAE,OAAO,EAAE;YAC9D,MAAM,OAAO,GAAG;gBACd,GAAG,CAAC,KAAK,CAAC,CAAC,kBAAkB,CAAC,EAAE,CAAC,CAAC;gBAClC,GAAG,IAAI,CAAC,IAAI;aACb,CAAC;YACF,MAAM,OAAO,GAAG;gBACd,GAAG,CAAC,KAAK,CAAC,CAAC,kBAAkB,CAAC,EAAE,CAAC,CAAC;gBAClC,GAAG,IAAI,CAAC,IAAI;aACb,CAAC;YACF,MAAM,EAAE,OAAO,EAAE,MAAM,EAAE,GAAG,QAAQ,CAAC,OAAO,EAAE,OAAO,CAAC,CAAC;YAEvD,IAAI,MAAM,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;gBACtB,KAAK,CAAC,CAAC,aAAa,CAClB,GAAG,CAAC,oBAAoB,CAAC;oBACvB,cAAc,EAAE,MAAM,CAAC,cAAc;oBACrC,IAAI,EAAE,MAAM;iBACb,CAAC,CACH,CAAC;YACJ,CAAC;YAED,IAAI,OAAO,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;gBACvB,KAAK,CAAC,CAAC,aAAa,CAClB,GAAG,CAAC,yBAAyB,CAAC;oBAC5B,cAAc,EAAE,MAAM,CAAC,cAAc;oBACrC,IAAI,EAAE,OAAO,CAAC,GAAG,CAAC,CAAC,GAAG,EAAE,EAAE,CAAC,CAAC,EAAE,GAAG,EAAE,CAAC,CAAC;iBACtC,CAAC,CACH,CAAC;YACJ,CAAC;YAED,MAAM,MAAM,GAAG,KAAK,CAAC,CAAC,mBAAmB,CAAC,MAAM,CAAC,cAAc,CAAC,CAAC;YACjE,IAAI,CAAC,MAAM,EAAE,cAAc,EAAE,CAAC;gBAC5B,OAAO,MAAM,CAAC;YAChB,CAAC;YAED,KAAK,CAAC,CAAC,OAAO,CAAC,IAAI,CAAC,MAAM,CAAC,cAAc,CAAC,CAAC;YAC3C,MAAM,IAAI,GAAG,KAAK,CAAC,CAAC,mBAAmB,CAAC,MAAM,CAAC,cAAc,CAAC,CAAC;YAC/D,OAAO,OAAO,CAAC,IAAI,EAAE,MAAM,EAAE,IAAI,CAAC,CAAC;QACrC,CAAC,CAAC;QACF,MAAM,EAAE,MAAM,CAAC,EAAE,CAAC,QAAQ,CAAC,EAAE,EAAE,MAAM,EAAE;YACrC,KAAK,CAAC,CAAC,aAAa,CAClB,GAAG;iBACA,iBAAiB,CAAC;gBACjB,cAAc,EAAE,MAAM,CAAC,cAAc;aACtC,CAAC;iBACD,IAAI,CACH,MAAM,CAAC,QAAQ,CAAC,2BAA2B,EAAE,GAAG,EAAE,CAAC,MAAM,CAAC,IAAI,CAAC,CAChE,CACJ,CAAC;QACJ,CAAC,CAAC;KACH,CAAC;AACJ,CAAC,CAAC,CACH,CAAC;AAEJ,MAAM,UAAU,GAAG,WAAoB,CAAC;AACxC,MAAM,uBAAuB,GAAG,KAAc,CAAC;AAE/C,MAAM,aAAa,GAAG,CAAU,MAA8B,EAAE,EAAE,CAChE,MAAM,CAAC,IAAI,CAAC,MAAM,CAAC,cAAc,CAAC,SAAS,EAAE,UAAiB,CAAC,CAAC,CAAC;AAEnE,MAAM,qBAAqB,GAAG,CAAC,YAAoB,EAAE,EAAE,CACrD,YAAY,CAAC,OAAO,CAAC,iBAAiB,EAAE,EAAE,CAAC,CAAC;AAE9C,MAAM,gBAAgB,GAAG,CAAC,KAA2B,EAAE,EAAE,CACvD,CAAC,GAAG,CAAC,KAAK,IAAI,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,aAAa,CAAC,CAAC,CAAC,CAAC,CAAC;AAExD,MAAM,WAAW,GAAG,CAAC,IAA2B,EAAE,EAAE,CAClD,MAAM,CAAC,WAAW,CAChB,CAAC,IAAI,IAAI,EAAE,CAAC;KACT,MAAM,CACL,CAAC,GAAG,EAAyC,EAAE,CAC7C,OAAO,GAAG,CAAC,GAAG,KAAK,QAAQ,IAAI,OAAO,GAAG,CAAC,KAAK,KAAK,QAAQ,CAC/D;KACA,GAAG,CAAC,CAAC,GAAG,EAAE,EAAE,CAAC,CAAC,GAAG,CAAC,GAAG,EAAE,GAAG,CAAC,KAAK,CAAC,CAAC,CACtC,CAAC;AAEJ,MAAM,OAAO,GAAG,CACd,KAAuB,EACvB,MAA6B,EAC7B,IAA4B,EAC5B,EAAE,CAAC,CAAC;IACJ,cAAc,EAAE,MAAM,CAAC,cAAe;IACtC,UAAU,EAAE,MAAM,CAAC,UAAU,IAAI,KAAK,CAAC,UAAU;IACjD,uBAAuB,EAAE,MAAM,CAAC,uBAAuB,IAAI,EAAE;IAC7D,MAAM,EAAE,MAAM,CAAC,MAAM;IACrB,uBAAuB,EAAE,MAAM,CAAC,uBAAuB,IAAI,EAAE;IAC7D,gBAAgB,EAAE,KAAK,CAAC,gBAAgB,IAAI,uBAAuB;IACnE,YAAY,EAAE,MAAM,CAAC,YAAY,IAAI,KAAK,CAAC,YAAY;IACvD,YAAY,EAAE,KAAK,CAAC,YAAY;QAC9B,CAAC,CAAC,qBAAqB,CAAC,KAAK,CAAC,YAAY,CAAC;QAC3C,CAAC,CAAC,SAAS;IACb,IAAI;IACJ,QAAQ,EAAE,MAAM,CAAC,QAAQ;IACzB,QAAQ,EAAE,MAAM,CAAC,QAAQ;CAC1B,CAAC,CAAC;AAEH,MAAM,iBAAiB,GAAG,CAAC,MAAyC,EAAE,EAAE,CACtE,MAAM,KAAK,QAAQ,IAAI,MAAM,KAAK,sBAAsB,CAAC"}

package/lib/AWS/ACM/index.d.ts

@@ -0,0 +1,2 @@
+export { Certificate, CertificateProvider } from "./Certificate.ts";
+//# sourceMappingURL=index.d.ts.map

package/lib/AWS/ACM/index.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../../src/AWS/ACM/index.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,WAAW,EAAE,mBAAmB,EAAE,MAAM,kBAAkB,CAAC"}

package/lib/AWS/ACM/index.js

@@ -0,0 +1,2 @@
+export { Certificate, CertificateProvider } from "./Certificate.js";
+//# sourceMappingURL=index.js.map

package/lib/AWS/ACM/index.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../../../src/AWS/ACM/index.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,WAAW,EAAE,mBAAmB,EAAE,MAAM,kBAAkB,CAAC"}

package/lib/AWS/Arn.d.ts

@@ -0,0 +1,2 @@
+export type Arn = string;
+//# sourceMappingURL=Arn.d.ts.map

package/lib/AWS/Arn.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"Arn.d.ts","sourceRoot":"","sources":["../../src/AWS/Arn.ts"],"names":[],"mappings":"AAAA,MAAM,MAAM,GAAG,GAAG,MAAM,CAAC"}

package/lib/AWS/Arn.js

@@ -0,0 +1 @@
+//# sourceMappingURL=Arn.js.map

package/lib/AWS/Arn.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"Arn.js","sourceRoot":"","sources":["../../src/AWS/Arn.ts"],"names":[],"mappings":""}

package/lib/AWS/Assets.d.ts

@@ -0,0 +1,65 @@
+import type { Credentials } from "@distilled.cloud/aws/Credentials";
+import { Region } from "@distilled.cloud/aws/Region";
+import * as s3 from "@distilled.cloud/aws/s3";
+import * as Context from "effect/Context";
+import * as Effect from "effect/Effect";
+import * as Layer from "effect/Layer";
+import type { HttpClient } from "effect/unstable/http/HttpClient";
+import { lookupAssetsBucket } from "./Bootstrap.ts";
+/**
+ * Error type for Assets service operations.
+ */
+export type AssetsError = {
+    readonly _tag: "AssetsUploadError";
+    readonly message: string;
+    readonly cause?: unknown;
+} | {
+    readonly _tag: "AssetsCheckError";
+    readonly message: string;
+    readonly cause?: unknown;
+};
+/**
+ * Requirements for Assets operations (S3 operations need these).
+ */
+export type AssetsRequirements = Region | Credentials | HttpClient;
+declare const Assets_base: Context.ServiceClass<Assets, "AWS::Assets", {
+    /**
+     * The name of the assets bucket.
+     */
+    readonly bucketName: string;
+    /**
+     * Upload an asset to the assets bucket.
+     * Uses content-addressed storage: `lambda/{hash}.zip`
+     *
+     * @param hash - The content hash of the asset
+     * @param content - The asset content (zip file)
+     * @returns The S3 key where the asset was uploaded
+     */
+    readonly uploadAsset: (hash: string, content: Uint8Array) => Effect.Effect<string, AssetsError, AssetsRequirements>;
+    /**
+     * Check if an asset already exists in the assets bucket.
+     *
+     * @param hash - The content hash to check
+     * @returns true if the asset exists
+     */
+    readonly hasAsset: (hash: string) => Effect.Effect<boolean, AssetsError, AssetsRequirements>;
+}>;
+export declare class Assets extends Assets_base {
+}
+/**
+ * Look up the assets bucket by scanning for the bootstrap tags.
+ * Returns Option.some(bucketName) if found, Option.none() otherwise.
+ */
+export { lookupAssetsBucket };
+/**
+ * Layer that provides the Assets service.
+ * Looks up the assets bucket on initialization.
+ * If the bucket doesn't exist, the layer will fail - use `assetsLayerWithFallback` for graceful fallback.
+ */
+export declare const assetsLayer: Layer.Layer<Assets, Error, HttpClient | Region | Credentials>;
+/**
+ * Try to create the assets layer, but don't fail if the bucket doesn't exist.
+ * Returns Layer.empty if the bucket is not found.
+ */
+export declare const AssetsProvider: () => Layer.Layer<never, s3.ListBucketsError, HttpClient | Region | Credentials>;
+//# sourceMappingURL=Assets.d.ts.map

package/lib/AWS/Assets.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"Assets.d.ts","sourceRoot":"","sources":["../../src/AWS/Assets.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,kCAAkC,CAAC;AACpE,OAAO,EAAE,MAAM,EAAE,MAAM,6BAA6B,CAAC;AACrD,OAAO,KAAK,EAAE,MAAM,yBAAyB,CAAC;AAC9C,OAAO,KAAK,OAAO,MAAM,gBAAgB,CAAC;AAC1C,OAAO,KAAK,MAAM,MAAM,eAAe,CAAC;AACxC,OAAO,KAAK,KAAK,MAAM,cAAc,CAAC;AAEtC,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,iCAAiC,CAAC;AAElE,OAAO,EAAE,kBAAkB,EAAE,MAAM,gBAAgB,CAAC;AAEpD;;GAEG;AACH,MAAM,MAAM,WAAW,GACnB;IACE,QAAQ,CAAC,IAAI,EAAE,mBAAmB,CAAC;IACnC,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAC;IACzB,QAAQ,CAAC,KAAK,CAAC,EAAE,OAAO,CAAC;CAC1B,GACD;IACE,QAAQ,CAAC,IAAI,EAAE,kBAAkB,CAAC;IAClC,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAC;IACzB,QAAQ,CAAC,KAAK,CAAC,EAAE,OAAO,CAAC;CAC1B,CAAC;AAEN;;GAEG;AACH,MAAM,MAAM,kBAAkB,GAAG,MAAM,GAAG,WAAW,GAAG,UAAU,CAAC;;IAK/D;;OAEG;yBACkB,MAAM;IAE3B;;;;;;;OAOG;0BACmB,CACpB,IAAI,EAAE,MAAM,EACZ,OAAO,EAAE,UAAU,KAChB,MAAM,CAAC,MAAM,CAAC,MAAM,EAAE,WAAW,EAAE,kBAAkB,CAAC;IAE3D;;;;;OAKG;uBACgB,CACjB,IAAI,EAAE,MAAM,KACT,MAAM,CAAC,MAAM,CAAC,OAAO,EAAE,WAAW,EAAE,kBAAkB,CAAC;;AA7BhE,qBAAa,MAAO,SAAQ,WA+BV;CAAG;AAYrB;;;GAGG;AACH,OAAO,EAAE,kBAAkB,EAAE,CAAC;AA+D9B;;;;GAIG;AACH,eAAO,MAAM,WAAW,+DAevB,CAAC;AAEF;;;GAGG;AACH,eAAO,MAAM,cAAc,kFAcxB,CAAC"}

package/lib/AWS/Assets.js

@@ -0,0 +1,87 @@
+import { Region } from "@distilled.cloud/aws/Region";
+import * as s3 from "@distilled.cloud/aws/s3";
+import * as Context from "effect/Context";
+import * as Effect from "effect/Effect";
+import * as Layer from "effect/Layer";
+import * as Option from "effect/Option";
+import { lookupAssetsBucket } from "./Bootstrap.js";
+export class Assets extends Context.Service()("AWS::Assets") {
+}
+/**
+ * S3 key prefix for Lambda function code assets.
+ */
+const LAMBDA_PREFIX = "lambda";
+/**
+ * Generate the S3 key for a Lambda asset.
+ */
+const getLambdaAssetKey = (hash) => `${LAMBDA_PREFIX}/${hash}.zip`;
+/**
+ * Look up the assets bucket by scanning for the bootstrap tags.
+ * Returns Option.some(bucketName) if found, Option.none() otherwise.
+ */
+export { lookupAssetsBucket };
+/**
+ * Create the Assets service implementation for a given bucket.
+ */
+const createAssetsService = (bucketName) => ({
+    bucketName,
+    uploadAsset: (hash, content) => {
+        const key = getLambdaAssetKey(hash);
+        return Effect.gen(function* () {
+            // Check if asset already exists
+            const exists = yield* s3
+                .headObject({ Bucket: bucketName, Key: key })
+                .pipe(Effect.map(() => true), Effect.catchTag("NotFound", () => Effect.succeed(false)));
+            if (exists) {
+                yield* Effect.logDebug(`Asset already exists: s3://${bucketName}/${key}`);
+                return key;
+            }
+            // Upload the asset
+            yield* s3.putObject({
+                Bucket: bucketName,
+                Key: key,
+                Body: content,
+                ContentType: "application/zip",
+            });
+            yield* Effect.logDebug(`Uploaded asset: s3://${bucketName}/${key}`);
+            return key;
+        }).pipe(Effect.mapError((err) => ({
+            _tag: "AssetsUploadError",
+            message: `Failed to upload asset ${key}`,
+            cause: err,
+        })));
+    },
+    hasAsset: (hash) => {
+        const key = getLambdaAssetKey(hash);
+        return s3.headObject({ Bucket: bucketName, Key: key }).pipe(Effect.map(() => true), Effect.catchTag("NotFound", () => Effect.succeed(false)), Effect.mapError((err) => ({
+            _tag: "AssetsCheckError",
+            message: `Failed to check asset ${key}`,
+            cause: err,
+        })));
+    },
+});
+/**
+ * Layer that provides the Assets service.
+ * Looks up the assets bucket on initialization.
+ * If the bucket doesn't exist, the layer will fail - use `assetsLayerWithFallback` for graceful fallback.
+ */
+export const assetsLayer = Layer.effect(Assets, Effect.gen(function* () {
+    const maybeBucket = yield* lookupAssetsBucket;
+    if (Option.isNone(maybeBucket)) {
+        return yield* Effect.fail(new Error("Assets bucket not found. Run 'alchemy bootstrap' to create it."));
+    }
+    return createAssetsService(maybeBucket.value);
+}));
+/**
+ * Try to create the assets layer, but don't fail if the bucket doesn't exist.
+ * Returns Layer.empty if the bucket is not found.
+ */
+export const AssetsProvider = () => Layer.unwrap(Effect.gen(function* () {
+    const maybeBucket = yield* lookupAssetsBucket;
+    if (Option.isNone(maybeBucket)) {
+        yield* Effect.logDebug("Assets bucket not found. Lambda will use inline ZipFile deployment.");
+        return Layer.empty;
+    }
+    return Layer.succeed(Assets, createAssetsService(maybeBucket.value));
+}));
+//# sourceMappingURL=Assets.js.map

package/lib/AWS/Assets.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"Assets.js","sourceRoot":"","sources":["../../src/AWS/Assets.ts"],"names":[],"mappings":"AACA,OAAO,EAAE,MAAM,EAAE,MAAM,6BAA6B,CAAC;AACrD,OAAO,KAAK,EAAE,MAAM,yBAAyB,CAAC;AAC9C,OAAO,KAAK,OAAO,MAAM,gBAAgB,CAAC;AAC1C,OAAO,KAAK,MAAM,MAAM,eAAe,CAAC;AACxC,OAAO,KAAK,KAAK,MAAM,cAAc,CAAC;AACtC,OAAO,KAAK,MAAM,MAAM,eAAe,CAAC;AAGxC,OAAO,EAAE,kBAAkB,EAAE,MAAM,gBAAgB,CAAC;AAsBpD,MAAM,OAAO,MAAO,SAAQ,OAAO,CAAC,OAAO,EA+BxC,CAAC,aAAa,CAAC;CAAG;AAErB;;GAEG;AACH,MAAM,aAAa,GAAG,QAAQ,CAAC;AAE/B;;GAEG;AACH,MAAM,iBAAiB,GAAG,CAAC,IAAY,EAAE,EAAE,CAAC,GAAG,aAAa,IAAI,IAAI,MAAM,CAAC;AAE3E;;;GAGG;AACH,OAAO,EAAE,kBAAkB,EAAE,CAAC;AAE9B;;GAEG;AACH,MAAM,mBAAmB,GAAG,CAAC,UAAkB,EAAyB,EAAE,CAAC,CAAC;IAC1E,UAAU;IACV,WAAW,EAAE,CAAC,IAAY,EAAE,OAAmB,EAAE,EAAE;QACjD,MAAM,GAAG,GAAG,iBAAiB,CAAC,IAAI,CAAC,CAAC;QAEpC,OAAO,MAAM,CAAC,GAAG,CAAC,QAAQ,CAAC;YACzB,gCAAgC;YAChC,MAAM,MAAM,GAAG,KAAK,CAAC,CAAC,EAAE;iBACrB,UAAU,CAAC,EAAE,MAAM,EAAE,UAAU,EAAE,GAAG,EAAE,GAAG,EAAE,CAAC;iBAC5C,IAAI,CACH,MAAM,CAAC,GAAG,CAAC,GAAG,EAAE,CAAC,IAAI,CAAC,EACtB,MAAM,CAAC,QAAQ,CAAC,UAAU,EAAE,GAAG,EAAE,CAAC,MAAM,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC,CACzD,CAAC;YAEJ,IAAI,MAAM,EAAE,CAAC;gBACX,KAAK,CAAC,CAAC,MAAM,CAAC,QAAQ,CACpB,8BAA8B,UAAU,IAAI,GAAG,EAAE,CAClD,CAAC;gBACF,OAAO,GAAG,CAAC;YACb,CAAC;YAED,mBAAmB;YACnB,KAAK,CAAC,CAAC,EAAE,CAAC,SAAS,CAAC;gBAClB,MAAM,EAAE,UAAU;gBAClB,GAAG,EAAE,GAAG;gBACR,IAAI,EAAE,OAAO;gBACb,WAAW,EAAE,iBAAiB;aAC/B,CAAC,CAAC;YAEH,KAAK,CAAC,CAAC,MAAM,CAAC,QAAQ,CAAC,wBAAwB,UAAU,IAAI,GAAG,EAAE,CAAC,CAAC;YACpE,OAAO,GAAG,CAAC;QACb,CAAC,CAAC,CAAC,IAAI,CACL,MAAM,CAAC,QAAQ,CACb,CAAC,GAAG,EAAe,EAAE,CAAC,CAAC;YACrB,IAAI,EAAE,mBAAmB;YACzB,OAAO,EAAE,0BAA0B,GAAG,EAAE;YACxC,KAAK,EAAE,GAAG;SACX,CAAC,CACH,CACF,CAAC;IACJ,CAAC;IACD,QAAQ,EAAE,CAAC,IAAY,EAAE,EAAE;QACzB,MAAM,GAAG,GAAG,iBAAiB,CAAC,IAAI,CAAC,CAAC;QAEpC,OAAO,EAAE,CAAC,UAAU,CAAC,EAAE,MAAM,EAAE,UAAU,EAAE,GAAG,EAAE,GAAG,EAAE,CAAC,CAAC,IAAI,CACzD,MAAM,CAAC,GAAG,CAAC,GAAG,EAAE,CAAC,IAAI,CAAC,EACtB,MAAM,CAAC,QAAQ,CAAC,UAAU,EAAE,GAAG,EAAE,CAAC,MAAM,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC,EACxD,MAAM,CAAC,QAAQ,CACb,CAAC,GAAG,EAAe,EAAE,CAAC,CAAC;YACrB,IAAI,EAAE,kBAAkB;YACxB,OAAO,EAAE,yBAAyB,GAAG,EAAE;YACvC,KAAK,EAAE,GAAG;SACX,CAAC,CACH,CACF,CAAC;IACJ,CAAC;CACF,CAAC,CAAC;AAEH;;;;GAIG;AACH,MAAM,CAAC,MAAM,WAAW,GAAG,KAAK,CAAC,MAAM,CACrC,MAAM,EACN,MAAM,CAAC,GAAG,CAAC,QAAQ,CAAC;IAClB,MAAM,WAAW,GAAG,KAAK,CAAC,CAAC,kBAAkB,CAAC;IAE9C,IAAI,MAAM,CAAC,MAAM,CAAC,WAAW,CAAC,EAAE,CAAC;QAC/B,OAAO,KAAK,CAAC,CAAC,MAAM,CAAC,IAAI,CACvB,IAAI,KAAK,CACP,gEAAgE,CACjE,CACF,CAAC;IACJ,CAAC;IAED,OAAO,mBAAmB,CAAC,WAAW,CAAC,KAAK,CAAC,CAAC;AAChD,CAAC,CAAC,CACH,CAAC;AAEF;;;GAGG;AACH,MAAM,CAAC,MAAM,cAAc,GAAG,GAAG,EAAE,CACjC,KAAK,CAAC,MAAM,CACV,MAAM,CAAC,GAAG,CAAC,QAAQ,CAAC;IAClB,MAAM,WAAW,GAAG,KAAK,CAAC,CAAC,kBAAkB,CAAC;IAE9C,IAAI,MAAM,CAAC,MAAM,CAAC,WAAW,CAAC,EAAE,CAAC;QAC/B,KAAK,CAAC,CAAC,MAAM,CAAC,QAAQ,CACpB,qEAAqE,CACtE,CAAC;QACF,OAAO,KAAK,CAAC,KAAK,CAAC;IACrB,CAAC;IAED,OAAO,KAAK,CAAC,OAAO,CAAC,MAAM,EAAE,mBAAmB,CAAC,WAAW,CAAC,KAAK,CAAC,CAAC,CAAC;AACvE,CAAC,CAAC,CACH,CAAC"}

package/lib/AWS/AuthProvider.d.ts

@@ -0,0 +1,33 @@
+import * as Redacted from "effect/Redacted";
+export declare const AWS_AUTH_PROVIDER_NAME = "AWS";
+/**
+ * Layer that registers the AWS {@link AuthProvider} into the
+ * {@link AuthProviders} registry when built. Include this in the AWS
+ * `providers()` layer so `alchemy login` can discover it.
+ */
+export declare const AwsAuth: import("effect/Layer").Layer<never, never, import("../Auth/AuthProvider.ts").AuthProviders>;
+export type AwsAuthConfig = {
+    method: "sso";
+    ssoProfile: string;
+} | {
+    method: "stored";
+} | {
+    method: "env";
+};
+export interface AwsStoredCredentials {
+    accessKeyId: string;
+    secretAccessKey: string;
+    sessionToken?: string;
+    region?: string;
+}
+export interface AwsResolvedCredentials {
+    accessKeyId: Redacted.Redacted<string>;
+    secretAccessKey: Redacted.Redacted<string>;
+    sessionToken?: Redacted.Redacted<string>;
+    region?: string;
+    source: {
+        type: AwsAuthConfig["method"];
+        details?: string;
+    };
+}
+//# sourceMappingURL=AuthProvider.d.ts.map

package/lib/AWS/AuthProvider.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"AuthProvider.d.ts","sourceRoot":"","sources":["../../src/AWS/AuthProvider.ts"],"names":[],"mappings":"AAMA,OAAO,KAAK,QAAQ,MAAM,iBAAiB,CAAC;AAuB5C,eAAO,MAAM,sBAAsB,QAAQ,CAAC;AAE5C;;;;GAIG;AACH,eAAO,MAAM,OAAO,6FASlB,CAAC;AAEH,MAAM,MAAM,aAAa,GACrB;IAAE,MAAM,EAAE,KAAK,CAAC;IAAC,UAAU,EAAE,MAAM,CAAA;CAAE,GACrC;IAAE,MAAM,EAAE,QAAQ,CAAA;CAAE,GACpB;IAAE,MAAM,EAAE,KAAK,CAAA;CAAE,CAAC;AAwBtB,MAAM,WAAW,oBAAoB;IACnC,WAAW,EAAE,MAAM,CAAC;IACpB,eAAe,EAAE,MAAM,CAAC;IACxB,YAAY,CAAC,EAAE,MAAM,CAAC;IACtB,MAAM,CAAC,EAAE,MAAM,CAAC;CACjB;AAED,MAAM,WAAW,sBAAsB;IACrC,WAAW,EAAE,QAAQ,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC;IACvC,eAAe,EAAE,QAAQ,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC;IAC3C,YAAY,CAAC,EAAE,QAAQ,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC;IACzC,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,MAAM,EAAE;QACN,IAAI,EAAE,aAAa,CAAC,QAAQ,CAAC,CAAC;QAC9B,OAAO,CAAC,EAAE,MAAM,CAAC;KAClB,CAAC;CACH"}