effortless-aws 0.9.0 → 0.10.0

package/dist/{chunk-B4P7ZKNM.js → chunk-HINWSFWC.js}

@@ -1,28 +1,67 @@
 // src/runtime/table-client.ts
 import { DynamoDB } from "@aws-sdk/client-dynamodb";
 import { marshall, unmarshall } from "@aws-sdk/util-dynamodb";
-var createTableClient = (tableName) => {
+var GSI_TAG_PK = "tag-pk-index";
+var marshallKey = (key) => marshall(key, { removeUndefinedValues: true });
+var buildSkCondition = (sk) => {
+  const names = { "#sk": "sk" };
+  if (typeof sk === "string") {
+    return { expression: "AND #sk = :sk", names, values: { ":sk": sk } };
+  }
+  if ("begins_with" in sk) {
+    return { expression: "AND begins_with(#sk, :sk)", names, values: { ":sk": sk.begins_with } };
+  }
+  if ("gt" in sk) {
+    return { expression: "AND #sk > :sk", names, values: { ":sk": sk.gt } };
+  }
+  if ("gte" in sk) {
+    return { expression: "AND #sk >= :sk", names, values: { ":sk": sk.gte } };
+  }
+  if ("lt" in sk) {
+    return { expression: "AND #sk < :sk", names, values: { ":sk": sk.lt } };
+  }
+  if ("lte" in sk) {
+    return { expression: "AND #sk <= :sk", names, values: { ":sk": sk.lte } };
+  }
+  if ("between" in sk) {
+    return { expression: "AND #sk BETWEEN :sk1 AND :sk2", names, values: { ":sk1": sk.between[0], ":sk2": sk.between[1] } };
+  }
+  return { expression: "", names: {}, values: {} };
+};
+var createTableClient = (tableName, options) => {
   let client2 = null;
   const getClient2 = () => client2 ??= new DynamoDB({});
+  const tagField = options?.tagField ?? "tag";
   return {
     tableName,
-    async put(item) {
+    async put(item, putOptions) {
+      const dataObj = item.data;
+      const tag = dataObj?.[tagField] || "";
+      if (!tag) throw new Error(`tag is required: data must include a "${tagField}" field`);
+      const dynamoItem = {
+        pk: item.pk,
+        sk: item.sk,
+        tag,
+        data: item.data
+      };
+      if (item.ttl !== void 0) dynamoItem.ttl = item.ttl;
       await getClient2().putItem({
         TableName: tableName,
-        Item: marshall(item, { removeUndefinedValues: true })
+        Item: marshall(dynamoItem, { removeUndefinedValues: true }),
+        ...putOptions?.ifNotExists ? { ConditionExpression: "attribute_not_exists(pk)" } : {}
       });
     },
     async get(key) {
       const result = await getClient2().getItem({
         TableName: tableName,
-        Key: marshall(key, { removeUndefinedValues: true })
+        Key: marshallKey(key)
       });
       return result.Item ? unmarshall(result.Item) : void 0;
     },
     async delete(key) {
       await getClient2().deleteItem({
         TableName: tableName,
-        Key: marshall(key, { removeUndefinedValues: true })
+        Key: marshallKey(key)
       });
     },
     async update(key, actions) {
@@ -31,63 +70,108 @@ var createTableClient = (tableName) => {
       const setClauses = [];
       const removeClauses = [];
       let counter = 0;
+      const DATA_ALIAS = "#data";
+      let needsDataAlias = false;
       if (actions.set) {
         for (const [attr, val] of Object.entries(actions.set)) {
+          needsDataAlias = true;
           const alias = `#a${counter}`;
           const valAlias = `:v${counter}`;
           names[alias] = attr;
           values[valAlias] = val;
-          setClauses.push(`${alias} = ${valAlias}`);
+          setClauses.push(`${DATA_ALIAS}.${alias} = ${valAlias}`);
           counter++;
         }
       }
       if (actions.append) {
         for (const [attr, val] of Object.entries(actions.append)) {
+          needsDataAlias = true;
           const alias = `#a${counter}`;
           const valAlias = `:v${counter}`;
           const emptyAlias = `:empty${counter}`;
           names[alias] = attr;
           values[valAlias] = val;
           values[emptyAlias] = [];
-          setClauses.push(`${alias} = list_append(if_not_exists(${alias}, ${emptyAlias}), ${valAlias})`);
+          setClauses.push(`${DATA_ALIAS}.${alias} = list_append(if_not_exists(${DATA_ALIAS}.${alias}, ${emptyAlias}), ${valAlias})`);
           counter++;
         }
       }
       if (actions.remove) {
         for (const attr of actions.remove) {
+          needsDataAlias = true;
           const alias = `#a${counter}`;
           names[alias] = attr;
-          removeClauses.push(alias);
+          removeClauses.push(`${DATA_ALIAS}.${alias}`);
           counter++;
         }
       }
+      if (needsDataAlias) {
+        names[DATA_ALIAS] = "data";
+      }
+      if (actions.tag !== void 0) {
+        names["#tag"] = "tag";
+        values[":tagVal"] = actions.tag;
+        setClauses.push("#tag = :tagVal");
+      }
+      if (actions.ttl !== void 0) {
+        names["#ttl"] = "ttl";
+        if (actions.ttl === null) {
+          removeClauses.push("#ttl");
+        } else {
+          values[":ttlVal"] = actions.ttl;
+          setClauses.push("#ttl = :ttlVal");
+        }
+      }
       const parts = [];
       if (setClauses.length) parts.push(`SET ${setClauses.join(", ")}`);
       if (removeClauses.length) parts.push(`REMOVE ${removeClauses.join(", ")}`);
       if (!parts.length) return;
       await getClient2().updateItem({
         TableName: tableName,
-        Key: marshall(key, { removeUndefinedValues: true }),
+        Key: marshallKey(key),
         UpdateExpression: parts.join(" "),
         ExpressionAttributeNames: names,
         ...Object.keys(values).length ? { ExpressionAttributeValues: marshall(values, { removeUndefinedValues: true }) } : {}
       });
     },
     async query(params) {
-      const names = { "#pk": params.pk.name };
-      const values = { ":pk": params.pk.value };
+      const names = { "#pk": "pk" };
+      const values = { ":pk": params.pk };
       let keyCondition = "#pk = :pk";
-      if (params.sk) {
-        names["#sk"] = params.sk.name;
-        values[":sk"] = params.sk.value;
-        if (params.sk.condition === "begins_with") {
-          keyCondition += " AND begins_with(#sk, :sk)";
-        } else {
-          keyCondition += ` AND #sk ${params.sk.condition} :sk`;
+      if (params.sk !== void 0) {
+        const skCond = buildSkCondition(params.sk);
+        keyCondition += ` ${skCond.expression}`;
+        Object.assign(names, skCond.names);
+        Object.assign(values, skCond.values);
+      }
+      const result = await getClient2().query({
+        TableName: tableName,
+        KeyConditionExpression: keyCondition,
+        ExpressionAttributeNames: names,
+        ExpressionAttributeValues: marshall(values, { removeUndefinedValues: true }),
+        ...params.limit ? { Limit: params.limit } : {},
+        ...params.scanIndexForward !== void 0 ? { ScanIndexForward: params.scanIndexForward } : {}
+      });
+      return (result.Items ?? []).map((item) => unmarshall(item));
+    },
+    async queryByTag(params) {
+      const names = { "#tag": "tag" };
+      const values = { ":tag": params.tag };
+      let keyCondition = "#tag = :tag";
+      if (params.pk !== void 0) {
+        const pkCond = buildSkCondition(params.pk);
+        const remapped = pkCond.expression.replace(/#sk/g, "#pk").replace(/:sk/g, ":pk");
+        keyCondition += ` ${remapped}`;
+        for (const [k, v] of Object.entries(pkCond.names)) {
+          names[k === "#sk" ? "#pk" : k] = v === "sk" ? "pk" : v;
+        }
+        for (const [k, v] of Object.entries(pkCond.values)) {
+          values[k.replace(":sk", ":pk")] = v;
         }
       }
       const result = await getClient2().query({
         TableName: tableName,
+        IndexName: GSI_TAG_PK,
         KeyConditionExpression: keyCondition,
         ExpressionAttributeNames: names,
         ExpressionAttributeValues: marshall(values, { removeUndefinedValues: true }),
@@ -167,7 +251,7 @@ var buildParams = async (params) => {
   return result;
 };
 var readStatic = (filePath) => readFileSync(join(process.cwd(), filePath), "utf-8");
-var createHandlerRuntime = (handler, handlerType, logLevel = "info") => {
+var createHandlerRuntime = (handler, handlerType, logLevel = "info", extraSetupArgs) => {
   const handlerName = process.env.EFF_HANDLER ?? "unknown";
   const rank = LOG_RANK[logLevel];
   let ctx = null;
@@ -187,7 +271,8 @@ var createHandlerRuntime = (handler, handlerType, logLevel = "info") => {
       const args = {};
       if (params) args.config = params;
       if (deps) args.deps = deps;
-      ctx = Object.keys(args).length > 0 ? await handler.setup(args) : await handler.setup();
+      if (extraSetupArgs) Object.assign(args, extraSetupArgs());
+      ctx = Object.keys(args).length > 0 || extraSetupArgs ? await handler.setup(args) : await handler.setup();
     }
     return ctx;
   };

package/dist/cli/index.js

@@ -70781,6 +70781,7 @@ var ensureLambda = (config2) => Effect_exports.gen(function* () {
   const runtime5 = config2.runtime ?? Runtime2.nodejs24x;
   const layers = config2.layers ?? [];
   const environment2 = config2.environment ?? {};
+  const arch = config2.architecture ?? Architecture.arm64;
   const existingFunction = yield* lambda_exports.make("get_function", {
     FunctionName: functionName
   }).pipe(
@@ -70800,7 +70801,7 @@ var ensureLambda = (config2) => Effect_exports.gen(function* () {
     const envKeys = [.../* @__PURE__ */ new Set([...Object.keys(existingEnv), ...Object.keys(environment2)])].sort();
     const envChanged = envKeys.some((k) => existingEnv[k] !== environment2[k]);
     const existingArch = existingFunction.Architectures?.[0] ?? Architecture.x86_64;
-    const archChanged = existingArch !== Architecture.arm64;
+    const archChanged = existingArch !== arch;
     const configChanged = existingFunction.MemorySize !== memory || existingFunction.Timeout !== timeout4 || existingFunction.Handler !== handler || existingFunction.Runtime !== runtime5 || layersChanged || envChanged;
     if (!codeChanged && !archChanged && !configChanged) {
       yield* Effect_exports.logDebug(`Function ${functionName} unchanged, skipping update`);
@@ -70811,7 +70812,7 @@ var ensureLambda = (config2) => Effect_exports.gen(function* () {
       yield* lambda_exports.make("update_function_code", {
         FunctionName: functionName,
         ZipFile: config2.code,
-        Architectures: [Architecture.arm64]
+        Architectures: [arch]
       });
       yield* waitForFunctionActive(functionName);
     } else {
@@ -70853,7 +70854,7 @@ var ensureLambda = (config2) => Effect_exports.gen(function* () {
     },
     Handler: handler,
     Runtime: runtime5,
-    Architectures: [Architecture.arm64],
+    Architectures: [arch],
     MemorySize: memory,
     Timeout: timeout4,
     Tags: config2.tags,
@@ -70883,6 +70884,16 @@ var waitForFunctionActive = (functionName) => Effect_exports.gen(function* () {
   );
   yield* Effect_exports.logDebug(`Function ${functionName} is active`);
 });
+var publishVersion = (functionName) => Effect_exports.gen(function* () {
+  yield* Effect_exports.logDebug(`Publishing version for: ${functionName}`);
+  const result = yield* lambda_exports.make("publish_version", {
+    FunctionName: functionName
+  });
+  return {
+    versionArn: result.FunctionArn,
+    version: result.Version
+  };
+});
 var deleteLambda = (functionName) => Effect_exports.gen(function* () {
   yield* Effect_exports.logDebug(`Deleting Lambda function: ${functionName}`);
   yield* lambda_exports.make("delete_function", {
@@ -70956,6 +70967,18 @@ var LAMBDA_ASSUME_ROLE_POLICY = JSON.stringify({
     }
   ]
 });
+var EDGE_LAMBDA_ASSUME_ROLE_POLICY = JSON.stringify({
+  Version: "2012-10-17",
+  Statement: [
+    {
+      Effect: "Allow",
+      Principal: {
+        Service: ["lambda.amazonaws.com", "edgelambda.amazonaws.com"]
+      },
+      Action: "sts:AssumeRole"
+    }
+  ]
+});
 var BASIC_EXECUTION_POLICY_ARN = "arn:aws:iam::aws:policy/service-role/AWSLambdaBasicExecutionRole";
 var ensureRole = (project2, stage, name, additionalActions, tags2) => Effect_exports.gen(function* () {
   const roleName = `${project2}-${stage}-${name}-role`;
@@ -70996,6 +71019,39 @@ var ensureRole = (project2, stage, name, additionalActions, tags2) => Effect_exp
   yield* Effect_exports.sleep("10 seconds");
   return createResult.Role.Arn;
 });
+var ensureEdgeRole = (project2, stage, name, tags2) => Effect_exports.gen(function* () {
+  const roleName = `${project2}-${stage}-${name}-role`;
+  const existingRole = yield* iam_exports.make("get_role", { RoleName: roleName }).pipe(
+    Effect_exports.map((r) => r.Role),
+    Effect_exports.catchIf(
+      (e) => e._tag === "IAMError" && e.is("NoSuchEntityException"),
+      () => Effect_exports.succeed(void 0)
+    )
+  );
+  if (existingRole) {
+    yield* Effect_exports.logDebug(`Using existing edge role: ${roleName}`);
+    if (tags2) {
+      yield* iam_exports.make("tag_role", {
+        RoleName: roleName,
+        Tags: toAwsTagList(tags2)
+      });
+    }
+    return existingRole.Arn;
+  }
+  yield* Effect_exports.logDebug(`Creating edge role: ${roleName}`);
+  const createResult = yield* iam_exports.make("create_role", {
+    RoleName: roleName,
+    AssumeRolePolicyDocument: EDGE_LAMBDA_ASSUME_ROLE_POLICY,
+    Description: `Execution role for Lambda@Edge function ${name}`,
+    Tags: tags2 ? toAwsTagList(tags2) : void 0
+  });
+  yield* iam_exports.make("attach_role_policy", {
+    RoleName: roleName,
+    PolicyArn: BASIC_EXECUTION_POLICY_ARN
+  });
+  yield* Effect_exports.sleep("10 seconds");
+  return createResult.Role.Arn;
+});
 var ensureInlinePolicy = (roleName, functionName, actions) => Effect_exports.gen(function* () {
   const policyName = `${functionName}-inline-policy`;
   const policyDocument = JSON.stringify({
@@ -71085,18 +71141,7 @@ var listEffortlessRoles = () => Effect_exports.gen(function* () {
 });
 
 // src/aws/dynamodb.ts
-var keyTypeToDynamoDB = (type2) => {
-  switch (type2) {
-    case "string":
-      return "S";
-    case "number":
-      return "N";
-    case "binary":
-      return "B";
-    default:
-      return type2;
-  }
-};
+var GSI_TAG_PK = "tag-pk-index";
 var streamViewToSpec = (view) => ({
   StreamEnabled: true,
   StreamViewType: view
@@ -71141,7 +71186,7 @@ var ensureTimeToLive = (tableName, attributeName) => Effect_exports.gen(function
   });
 });
 var ensureTable = (input) => Effect_exports.gen(function* () {
-  const { name, pk, sk, billingMode = "PAY_PER_REQUEST", streamView = "NEW_AND_OLD_IMAGES", tags: tags2, ttlAttribute } = input;
+  const { name, billingMode = "PAY_PER_REQUEST", streamView = "NEW_AND_OLD_IMAGES", tags: tags2 } = input;
   const existingTable = yield* dynamodb_exports.make("describe_table", { TableName: name }).pipe(
     Effect_exports.map((result2) => result2.Table),
     Effect_exports.catchIf(
@@ -71152,20 +71197,25 @@ var ensureTable = (input) => Effect_exports.gen(function* () {
   let result;
   if (!existingTable) {
     yield* Effect_exports.logInfo(`Creating table ${name}...`);
-    const keySchema = [
-      { AttributeName: pk.name, KeyType: "HASH" }
-    ];
-    const attributeDefinitions = [
-      { AttributeName: pk.name, AttributeType: keyTypeToDynamoDB(pk.type) }
-    ];
-    if (sk) {
-      keySchema.push({ AttributeName: sk.name, KeyType: "RANGE" });
-      attributeDefinitions.push({ AttributeName: sk.name, AttributeType: keyTypeToDynamoDB(sk.type) });
-    }
     yield* dynamodb_exports.make("create_table", {
       TableName: name,
-      KeySchema: keySchema,
-      AttributeDefinitions: attributeDefinitions,
+      KeySchema: [
+        { AttributeName: "pk", KeyType: "HASH" },
+        { AttributeName: "sk", KeyType: "RANGE" }
+      ],
+      AttributeDefinitions: [
+        { AttributeName: "pk", AttributeType: "S" },
+        { AttributeName: "sk", AttributeType: "S" },
+        { AttributeName: "tag", AttributeType: "S" }
+      ],
+      GlobalSecondaryIndexes: [{
+        IndexName: GSI_TAG_PK,
+        KeySchema: [
+          { AttributeName: "tag", KeyType: "HASH" },
+          { AttributeName: "pk", KeyType: "RANGE" }
+        ],
+        Projection: { ProjectionType: "ALL" }
+      }],
       BillingMode: billingMode,
       StreamSpecification: streamViewToSpec(streamView),
       Tags: tags2 ? toAwsTagList(tags2) : void 0
@@ -71189,21 +71239,40 @@ var ensureTable = (input) => Effect_exports.gen(function* () {
         TableName: name,
         StreamSpecification: streamViewToSpec(streamView)
       });
-      const table3 = yield* waitForTableActive(name);
-      result = {
-        tableArn: table3.TableArn,
-        streamArn: table3.LatestStreamArn
-      };
-    } else {
-      result = {
-        tableArn: existingTable.TableArn,
-        streamArn: existingTable.LatestStreamArn
-      };
+      yield* waitForTableActive(name);
     }
+    const hasGsi = existingTable.GlobalSecondaryIndexes?.some(
+      (gsi) => gsi.IndexName === GSI_TAG_PK
+    );
+    if (!hasGsi) {
+      yield* Effect_exports.logInfo(`Adding GSI ${GSI_TAG_PK} to table ${name}...`);
+      yield* dynamodb_exports.make("update_table", {
+        TableName: name,
+        AttributeDefinitions: [
+          { AttributeName: "pk", AttributeType: "S" },
+          { AttributeName: "sk", AttributeType: "S" },
+          { AttributeName: "tag", AttributeType: "S" }
+        ],
+        GlobalSecondaryIndexUpdates: [{
+          Create: {
+            IndexName: GSI_TAG_PK,
+            KeySchema: [
+              { AttributeName: "tag", KeyType: "HASH" },
+              { AttributeName: "pk", KeyType: "RANGE" }
+            ],
+            Projection: { ProjectionType: "ALL" }
+          }
+        }]
+      });
+      yield* waitForTableActive(name);
+    }
+    const updated = yield* dynamodb_exports.make("describe_table", { TableName: name });
+    result = {
+      tableArn: updated.Table.TableArn,
+      streamArn: updated.Table.LatestStreamArn
+    };
   }
-  if (ttlAttribute) {
-    yield* ensureTimeToLive(name, ttlAttribute);
-  }
+  yield* ensureTimeToLive(name, "ttl");
   return result;
 });
 var ensureEventSourceMapping = (input) => Effect_exports.gen(function* () {
@@ -72046,14 +72115,15 @@ var ensureViewerRequestFunction = (name, config2) => Effect_exports.gen(function
 });
 var makeDistComment = (project2, stage, handlerName) => `effortless: ${project2}/${stage}/${handlerName}`;
 var ensureDistribution = (input) => Effect_exports.gen(function* () {
-  const { project: project2, stage, handlerName, bucketName, bucketRegion, oacId, spa, index, tags: tags2, urlRewriteFunctionArn, aliases, acmCertificateArn } = input;
+  const { project: project2, stage, handlerName, bucketName, bucketRegion, oacId, spa, index, tags: tags2, urlRewriteFunctionArn, lambdaEdgeArn, aliases, acmCertificateArn } = input;
   const aliasesConfig = aliases && aliases.length > 0 ? { Quantity: aliases.length, Items: aliases } : { Quantity: 0, Items: [] };
   const viewerCertificate = acmCertificateArn ? {
     ACMCertificateArn: acmCertificateArn,
     SSLSupportMethod: "sni-only",
     MinimumProtocolVersion: "TLSv1.2_2021"
   } : void 0;
-  const functionAssociations = urlRewriteFunctionArn ? { Quantity: 1, Items: [{ FunctionARN: urlRewriteFunctionArn, EventType: "viewer-request" }] } : { Quantity: 0, Items: [] };
+  const functionAssociations = !lambdaEdgeArn && urlRewriteFunctionArn ? { Quantity: 1, Items: [{ FunctionARN: urlRewriteFunctionArn, EventType: "viewer-request" }] } : { Quantity: 0, Items: [] };
+  const lambdaFunctionAssociations = lambdaEdgeArn ? { Quantity: 1, Items: [{ EventType: "viewer-request", LambdaFunctionARN: lambdaEdgeArn, IncludeBody: false }] } : { Quantity: 0, Items: [] };
   const comment = makeDistComment(project2, stage, handlerName);
   const originId = `S3-${bucketName}`;
   const originDomain = `${bucketName}.s3.${bucketRegion}.amazonaws.com`;
@@ -72087,7 +72157,8 @@ var ensureDistribution = (input) => Effect_exports.gen(function* () {
     const desiredAliases = aliases ?? [];
     const aliasesMatch = currentAliases.length === desiredAliases.length && desiredAliases.every((a) => currentAliases.includes(a));
     const certMatch = currentConfig.ViewerCertificate?.ACMCertificateArn === (acmCertificateArn ?? void 0);
-    const needsUpdate = currentOrigin?.DomainName !== originDomain || currentOrigin?.OriginAccessControlId !== oacId || currentConfig.DefaultRootObject !== index || currentConfig.DefaultCacheBehavior?.CachePolicyId !== CACHING_OPTIMIZED_POLICY_ID || (currentConfig.CustomErrorResponses?.Quantity ?? 0) !== customErrorResponses.Quantity || (currentConfig.DefaultCacheBehavior?.FunctionAssociations?.Quantity ?? 0) !== functionAssociations.Quantity || currentConfig.DefaultCacheBehavior?.FunctionAssociations?.Items?.[0]?.FunctionARN !== (urlRewriteFunctionArn ?? void 0) || !aliasesMatch || !certMatch;
+    const currentLambdaEdgeArn = currentConfig.DefaultCacheBehavior?.LambdaFunctionAssociations?.Items?.[0]?.LambdaFunctionARN;
+    const needsUpdate = currentOrigin?.DomainName !== originDomain || currentOrigin?.OriginAccessControlId !== oacId || currentConfig.DefaultRootObject !== index || currentConfig.DefaultCacheBehavior?.CachePolicyId !== CACHING_OPTIMIZED_POLICY_ID || (currentConfig.CustomErrorResponses?.Quantity ?? 0) !== customErrorResponses.Quantity || (currentConfig.DefaultCacheBehavior?.FunctionAssociations?.Quantity ?? 0) !== functionAssociations.Quantity || currentConfig.DefaultCacheBehavior?.FunctionAssociations?.Items?.[0]?.FunctionARN !== (urlRewriteFunctionArn ?? void 0) || (currentConfig.DefaultCacheBehavior?.LambdaFunctionAssociations?.Quantity ?? 0) !== lambdaFunctionAssociations.Quantity || currentLambdaEdgeArn !== (lambdaEdgeArn ?? void 0) || !aliasesMatch || !certMatch;
     if (needsUpdate) {
       yield* Effect_exports.logDebug(`CloudFront distribution ${existing.Id} config changed, updating...`);
       const etag = configResult.ETag;
@@ -72122,6 +72193,7 @@ var ensureDistribution = (input) => Effect_exports.gen(function* () {
             Compress: true,
             CachePolicyId: CACHING_OPTIMIZED_POLICY_ID,
             FunctionAssociations: functionAssociations,
+            LambdaFunctionAssociations: lambdaFunctionAssociations,
             ForwardedValues: void 0
           },
           Aliases: aliasesConfig,
@@ -72171,7 +72243,8 @@ var ensureDistribution = (input) => Effect_exports.gen(function* () {
           },
           Compress: true,
           CachePolicyId: CACHING_OPTIMIZED_POLICY_ID,
-          FunctionAssociations: functionAssociations
+          FunctionAssociations: functionAssociations,
+          LambdaFunctionAssociations: lambdaFunctionAssociations
         },
         Aliases: aliasesConfig,
         ...viewerCertificate ? { ViewerCertificate: viewerCertificate } : {},
@@ -72443,7 +72516,7 @@ var parseSource = (source) => {
   const project2 = new Project({ useInMemoryFileSystem: true });
   return project2.createSourceFile("input.ts", source);
 };
-var RUNTIME_PROPS = ["onRequest", "onRecord", "onBatchComplete", "onBatch", "onMessage", "setup", "schema", "onError", "deps", "config", "static"];
+var RUNTIME_PROPS = ["onRequest", "onRecord", "onBatchComplete", "onBatch", "onMessage", "setup", "schema", "onError", "deps", "config", "static", "middleware"];
 var buildConfigWithoutRuntime = (obj) => {
   const props = obj.getProperties().filter((p3) => {
     if (p3.getKind() === SyntaxKind.PropertyAssignment) {
@@ -72557,9 +72630,9 @@ var handlerRegistry = {
   },
   staticSite: {
     defineFn: "defineStaticSite",
-    handlerProps: [],
-    wrapperFn: "",
-    wrapperPath: ""
+    handlerProps: ["middleware"],
+    wrapperFn: "wrapMiddleware",
+    wrapperPath: "~/runtime/wrap-middleware"
   },
   fifoQueue: {
     defineFn: "defineFifoQueue",
@@ -73024,8 +73097,6 @@ var deployTableFunction = ({ input, fn: fn2, layerArn, external, depsEnv, depsPe
   const tableName = `${input.project}-${tagCtx.stage}-${handlerName}`;
   const { tableArn, streamArn } = yield* ensureTable({
     name: tableName,
-    pk: config2.pk,
-    sk: config2.sk,
     billingMode: config2.billingMode ?? "PAY_PER_REQUEST",
     streamView: config2.streamView ?? "NEW_AND_OLD_IMAGES",
     tags: makeTags(tagCtx, "dynamodb")
@@ -73157,13 +73228,54 @@ var deployAppLambda = ({ input, fn: fn2, layerArn, external, depsEnv, depsPermis
 });
 
 // src/deploy/deploy-static-site.ts
+import { Architecture as Architecture3 } from "@aws-sdk/client-lambda";
 import { execSync as execSync2 } from "child_process";
 import * as path8 from "path";
+var deployMiddlewareLambda = (input) => Effect_exports.gen(function* () {
+  const { projectDir, project: project2, stage, handlerName, file: file7, exportName, tagCtx } = input;
+  const middlewareName = `${handlerName}-middleware`;
+  yield* Effect_exports.logDebug(`Deploying middleware Lambda@Edge: ${middlewareName}`);
+  const roleArn = yield* ensureEdgeRole(
+    project2,
+    stage,
+    middlewareName,
+    makeTags(tagCtx, "iam-role")
+  );
+  const bundled = yield* bundle({
+    projectDir,
+    file: file7,
+    exportName,
+    type: "staticSite"
+  });
+  const code2 = yield* zip12({ content: bundled });
+  const { functionArn } = yield* ensureLambda({
+    project: project2,
+    stage,
+    name: middlewareName,
+    region: "us-east-1",
+    roleArn,
+    code: code2,
+    memory: 128,
+    timeout: 5,
+    architecture: Architecture3.x86_64,
+    tags: makeTags(tagCtx, "lambda")
+  }).pipe(
+    Effect_exports.provide(clients_exports.makeClients({ lambda: { region: "us-east-1" } }))
+  );
+  const { versionArn } = yield* publishVersion(
+    `${project2}-${stage}-${middlewareName}`
+  ).pipe(
+    Effect_exports.provide(clients_exports.makeClients({ lambda: { region: "us-east-1" } }))
+  );
+  yield* Effect_exports.logDebug(`Middleware deployed: ${versionArn}`);
+  return { versionArn };
+});
 var deployStaticSite = (input) => Effect_exports.gen(function* () {
   const { projectDir, project: project2, region, fn: fn2 } = input;
   const { exportName, config: config2 } = fn2;
   const stage = resolveStage(input.stage);
   const handlerName = config2.name ?? exportName;
+  const hasMiddleware = fn2.hasHandler;
   const tagCtx = { project: project2, stage, handler: handlerName };
   if (config2.build) {
     yield* Effect_exports.logDebug(`Building site: ${config2.build}`);
@@ -73173,7 +73285,7 @@ var deployStaticSite = (input) => Effect_exports.gen(function* () {
     });
   }
   const bucketName = `${project2}-${stage}-${handlerName}-site`.toLowerCase();
-  const { bucketArn } = yield* ensureBucket({
+  yield* ensureBucket({
     name: bucketName,
     region,
     tags: makeTags(tagCtx, "s3-bucket")
@@ -73201,16 +73313,32 @@ var deployStaticSite = (input) => Effect_exports.gen(function* () {
     }
   }
   const isSpa = config2.spa ?? false;
-  const needsUrlRewrite = !isSpa;
-  const needsWwwRedirect = !!wwwDomain;
   let urlRewriteFunctionArn;
-  if (needsUrlRewrite || needsWwwRedirect) {
-    const fnName = needsWwwRedirect ? `${project2}-${stage}-${handlerName}-viewer-req` : `${project2}-${stage}-url-rewrite`;
-    const result = yield* ensureViewerRequestFunction(fnName, {
-      rewriteUrls: needsUrlRewrite,
-      redirectWwwDomain: wwwDomain
-    });
-    urlRewriteFunctionArn = result.functionArn;
+  let lambdaEdgeArn;
+  if (hasMiddleware && input.file) {
+    const result = yield* deployMiddlewareLambda({
+      projectDir,
+      project: project2,
+      stage,
+      handlerName,
+      file: input.file,
+      exportName,
+      tagCtx
+    }).pipe(
+      Effect_exports.provide(clients_exports.makeClients({ iam: { region: "us-east-1" } }))
+    );
+    lambdaEdgeArn = result.versionArn;
+  } else {
+    const needsUrlRewrite = !isSpa;
+    const needsWwwRedirect = !!wwwDomain;
+    if (needsUrlRewrite || needsWwwRedirect) {
+      const fnName = needsWwwRedirect ? `${project2}-${stage}-${handlerName}-viewer-req` : `${project2}-${stage}-url-rewrite`;
+      const result = yield* ensureViewerRequestFunction(fnName, {
+        rewriteUrls: needsUrlRewrite,
+        redirectWwwDomain: wwwDomain
+      });
+      urlRewriteFunctionArn = result.functionArn;
+    }
   }
   const index = config2.index ?? "index.html";
   const { distributionId, distributionArn, domainName } = yield* ensureDistribution({
@@ -73224,6 +73352,7 @@ var deployStaticSite = (input) => Effect_exports.gen(function* () {
     index,
     tags: makeTags(tagCtx, "cloudfront-distribution"),
     urlRewriteFunctionArn,
+    lambdaEdgeArn,
     aliases,
     acmCertificateArn
   });
@@ -73555,7 +73684,7 @@ var buildAppTasks = (ctx, handlers, apiId, results) => {
 var buildStaticSiteTasks = (ctx, handlers, results) => {
   const tasks = [];
   const { region } = ctx.input;
-  for (const { exports } of handlers) {
+  for (const { file: file7, exports } of handlers) {
     for (const fn2 of exports) {
       tasks.push(
         Effect_exports.gen(function* () {
@@ -73564,7 +73693,8 @@ var buildStaticSiteTasks = (ctx, handlers, results) => {
             project: ctx.input.project,
             stage: ctx.input.stage,
             region,
-            fn: fn2
+            fn: fn2,
+            ...fn2.hasHandler ? { file: file7 } : {}
           }).pipe(Effect_exports.provide(clients_exports.makeClients({
             s3: { region },
             cloudfront: { region: "us-east-1" },