puls-dev 0.1.0 → 0.1.8

package/dist/providers/aws/rds.js

@@ -1,17 +1,17 @@
-import { DescribeDBInstancesCommand, CreateDBInstanceCommand, ModifyDBInstanceCommand, DeleteDBInstanceCommand, DescribeDBSubnetGroupsCommand, CreateDBSubnetGroupCommand, } from '@aws-sdk/client-rds';
-import { DescribeVpcsCommand, DescribeSubnetsCommand, DescribeSecurityGroupsCommand, CreateSecurityGroupCommand, AuthorizeSecurityGroupIngressCommand, } from '@aws-sdk/client-ec2';
-import { BaseBuilder } from '../../core/resource.js';
-import { getRDSClient, getEC2Client } from './api.js';
-import { Config } from '../../core/config.js';
+import { DescribeDBInstancesCommand, CreateDBInstanceCommand, ModifyDBInstanceCommand, DeleteDBInstanceCommand, DescribeDBSubnetGroupsCommand, CreateDBSubnetGroupCommand, } from "@aws-sdk/client-rds";
+import { DescribeVpcsCommand, DescribeSubnetsCommand, DescribeSecurityGroupsCommand, CreateSecurityGroupCommand, AuthorizeSecurityGroupIngressCommand, } from "@aws-sdk/client-ec2";
+import { BaseBuilder } from "../../core/resource.js";
+import { getRDSClient, getEC2Client } from "./api.js";
+import { Config } from "../../core/config.js";
 const DB_PORT = {
     postgres: 5432,
     mysql: 3306,
     mariadb: 3306,
 };
 export class RDSBuilder extends BaseBuilder {
-    _engine = 'postgres';
-    _engineVersion = '16';
-    _instanceClass = 'db.t3.micro';
+    _engine = "postgres";
+    _engineVersion = "16";
+    _instanceClass = "db.t3.micro";
     _storage = 20;
     _username;
     _password;
@@ -31,12 +31,30 @@ export class RDSBuilder extends BaseBuilder {
         this._engineVersion = e.version;
         return this;
     }
-    size(instanceClass) { this._instanceClass = instanceClass; return this; }
-    storage(gb) { this._storage = gb; return this; }
-    subnets(ids) { this._subnetIds = ids; return this; }
-    securityGroups(ids) { this._securityGroupIds = ids; return this; }
-    publicAccess(enabled = true) { this._publicAccess = enabled; return this; }
-    database(name) { this._dbName = name; return this; }
+    size(instanceClass) {
+        this._instanceClass = instanceClass;
+        return this;
+    }
+    storage(gb) {
+        this._storage = gb;
+        return this;
+    }
+    subnets(ids) {
+        this._subnetIds = ids;
+        return this;
+    }
+    securityGroups(ids) {
+        this._securityGroupIds = ids;
+        return this;
+    }
+    publicAccess(enabled = true) {
+        this._publicAccess = enabled;
+        return this;
+    }
+    database(name) {
+        this._dbName = name;
+        return this;
+    }
     credentials(username, password) {
         this._username = username;
         this._password = password;
@@ -48,7 +66,7 @@ export class RDSBuilder extends BaseBuilder {
                 DBInstanceIdentifier: identifier,
             }));
             const instance = result.DBInstances?.[0];
-            if (!instance || instance.DBInstanceStatus === 'deleting')
+            if (!instance || instance.DBInstanceStatus === "deleting")
                 return null;
             this.resolvedArn = instance.DBInstanceArn ?? null;
             this.resolvedEndpoint = instance.Endpoint?.Address ?? null;
@@ -56,9 +74,9 @@ export class RDSBuilder extends BaseBuilder {
             return instance;
         }
         catch (e) {
-            if (e.name === 'DBInstanceNotFound')
+            if (e.name === "DBInstanceNotFound")
                 return null;
-            if (e.name === 'CredentialsProviderError')
+            if (e.name === "CredentialsProviderError")
                 return null;
             throw e;
         }
@@ -66,15 +84,17 @@ export class RDSBuilder extends BaseBuilder {
     async discoverDefaultVpc() {
         const ec2 = getEC2Client();
         const vpcs = await ec2.send(new DescribeVpcsCommand({
-            Filters: [{ Name: 'isDefault', Values: ['true'] }],
+            Filters: [{ Name: "isDefault", Values: ["true"] }],
         }));
         const vpc = vpcs.Vpcs?.[0];
         if (!vpc?.VpcId)
             throw new Error(`[RDS:${this.name}] No default VPC found. Use .subnets(ids[]) to specify subnets.`);
         const subnets = await ec2.send(new DescribeSubnetsCommand({
-            Filters: [{ Name: 'vpc-id', Values: [vpc.VpcId] }],
+            Filters: [{ Name: "vpc-id", Values: [vpc.VpcId] }],
         }));
-        const subnetIds = (subnets.Subnets ?? []).map(s => s.SubnetId).filter(Boolean);
+        const subnetIds = (subnets.Subnets ?? [])
+            .map((s) => s.SubnetId)
+            .filter(Boolean);
         return { vpcId: vpc.VpcId, vpcCidr: vpc.CidrBlock, subnetIds };
     }
     async ensureSubnetGroup(subnetIds) {
@@ -85,7 +105,7 @@ export class RDSBuilder extends BaseBuilder {
             return groupName;
         }
         catch (e) {
-            if (e.name !== 'DBSubnetGroupNotFoundFault')
+            if (e.name !== "DBSubnetGroupNotFoundFault")
                 throw e;
         }
         await rds.send(new CreateDBSubnetGroupCommand({
@@ -102,8 +122,8 @@ export class RDSBuilder extends BaseBuilder {
         const port = DB_PORT[this._engine] ?? 5432;
         const existing = await ec2.send(new DescribeSecurityGroupsCommand({
             Filters: [
-                { Name: 'group-name', Values: [sgName] },
-                { Name: 'vpc-id', Values: [vpcId] },
+                { Name: "group-name", Values: [sgName] },
+                { Name: "vpc-id", Values: [vpcId] },
             ],
         }));
         if (existing.SecurityGroups?.length)
@@ -116,38 +136,49 @@ export class RDSBuilder extends BaseBuilder {
         const sgId = created.GroupId;
         // Allow inbound on DB port from VPC CIDR only (secure default)
         // Use .publicAccess() to open to the internet
-        const cidr = this._publicAccess ? '0.0.0.0/0' : vpcCidr;
+        const cidr = this._publicAccess ? "0.0.0.0/0" : vpcCidr;
         await ec2.send(new AuthorizeSecurityGroupIngressCommand({
             GroupId: sgId,
-            IpPermissions: [{
-                    IpProtocol: 'tcp',
+            IpPermissions: [
+                {
+                    IpProtocol: "tcp",
                     FromPort: port,
                     ToPort: port,
-                    IpRanges: [{ CidrIp: cidr, Description: this._publicAccess ? 'Public access' : 'VPC only' }],
-                }],
+                    IpRanges: [
+                        {
+                            CidrIp: cidr,
+                            Description: this._publicAccess ? "Public access" : "VPC only",
+                        },
+                    ],
+                },
+            ],
         }));
-        console.log(`   ✅ Created security group: ${sgName} (${sgId}) — port ${port} open to ${cidr}`);
+        console.log(`   ✅ Created security group: ${sgName} (${sgId}) - port ${port} open to ${cidr}`);
         return sgId;
     }
     async deploy() {
         const dryRun = this.isDryRunActive();
         const existing = await this.discoveryPromise;
-        const region = Config.get().providers.aws?.region ?? 'us-east-1';
+        const region = Config.get().providers.aws?.region ?? "us-east-1";
         const port = DB_PORT[this._engine] ?? 5432;
         console.log(`\n⚡ Finalizing RDS Instance "${this.name}"...`);
         if (dryRun) {
-            console.log(`   📝 [PLAN] ${existing ? 'Update' : 'Create'} RDS instance "${this.name}"`);
+            console.log(`   📝 [PLAN] ${existing ? "Update" : "Create"} RDS instance "${this.name}"`);
             console.log(`      └─ Engine: ${this._engine} ${this._engineVersion}`);
             console.log(`      └─ Class: ${this._instanceClass} | Storage: ${this._storage}GB`);
             console.log(`      └─ Port: ${port} | Public: ${this._publicAccess}`);
             this.resolvedEndpoint = `${this.name}.DRYRUN.${region}.rds.amazonaws.com`;
             this.resolvedPort = port;
-            return { name: this.name, endpoint: this.resolvedEndpoint, port: this.resolvedPort };
+            return {
+                name: this.name,
+                endpoint: this.resolvedEndpoint,
+                port: this.resolvedPort,
+            };
         }
         if (!this._username || !this._password) {
             throw new Error(`[RDS:${this.name}] .credentials(username, password) is required`);
         }
-        // Resolve networking — only hit EC2 if needed
+        // Resolve networking - only hit EC2 if needed
         let subnetGroupName;
         let securityGroupIds;
         if (this._subnetIds && this._securityGroupIds) {
@@ -157,7 +188,9 @@ export class RDSBuilder extends BaseBuilder {
         else {
             const { vpcId, vpcCidr, subnetIds } = await this.discoverDefaultVpc();
             subnetGroupName = await this.ensureSubnetGroup(this._subnetIds ?? subnetIds);
-            securityGroupIds = this._securityGroupIds ?? [await this.ensureSecurityGroup(vpcId, vpcCidr)];
+            securityGroupIds = this._securityGroupIds ?? [
+                await this.ensureSecurityGroup(vpcId, vpcCidr),
+            ];
         }
         const rds = getRDSClient();
         if (existing) {
@@ -183,15 +216,15 @@ export class RDSBuilder extends BaseBuilder {
                 DBSubnetGroupName: subnetGroupName,
                 VpcSecurityGroupIds: securityGroupIds,
                 PubliclyAccessible: this._publicAccess,
-                StorageType: 'gp3',
+                StorageType: "gp3",
                 BackupRetentionPeriod: 7,
                 DeletionProtection: false,
             }));
-            console.log(`🚀 Creating RDS instance "${this.name}" — waiting for available...`);
+            console.log(`🚀 Creating RDS instance "${this.name}" - waiting for available...`);
             await this.waitFor(`"${this.name}" to become available`, async () => {
                 const r = await getRDSClient().send(new DescribeDBInstancesCommand({ DBInstanceIdentifier: this.name }));
                 const inst = r.DBInstances?.[0];
-                if (inst?.DBInstanceStatus === 'available') {
+                if (inst?.DBInstanceStatus === "available") {
                     this.resolvedEndpoint = inst.Endpoint?.Address ?? null;
                     this.resolvedPort = inst.Endpoint?.Port ?? null;
                     this.resolvedArn = inst.DBInstanceArn ?? null;
@@ -202,14 +235,19 @@ export class RDSBuilder extends BaseBuilder {
             console.log(`   🌐 Endpoint: ${this.resolvedEndpoint}:${this.resolvedPort}`);
         }
         await this.deploySidecars();
-        return { name: this.name, endpoint: this.resolvedEndpoint, port: this.resolvedPort, arn: this.resolvedArn };
+        return {
+            name: this.name,
+            endpoint: this.resolvedEndpoint,
+            port: this.resolvedPort,
+            arn: this.resolvedArn,
+        };
     }
     async destroy() {
         const dryRun = this.isDryRunActive();
         const existing = await this.discoveryPromise;
         console.log(`\n🗑️  Destroying RDS Instance "${this.name}"...`);
         if (!existing) {
-            console.log(`   ✅ Instance "${this.name}" does not exist — nothing to do`);
+            console.log(`   ✅ Instance "${this.name}" does not exist - nothing to do`);
             return { destroyed: this.name };
         }
         if (dryRun) {

package/dist/providers/aws/route53.d.ts

@@ -1,7 +1,7 @@
-import { BaseBuilder } from '../../core/resource.js';
-import { Output } from '../../core/output.js';
-import { ACMCertificateBuilder } from './acm.js';
-import type { RegistrantContact } from '../../types/aws.js';
+import { BaseBuilder } from "../../core/resource.js";
+import { Output } from "../../core/output.js";
+import { ACMCertificateBuilder } from "./acm.js";
+import type { RegistrantContact } from "../../types/aws.js";
 export declare class Route53Builder extends BaseBuilder {
     readonly out: {
         zone: Output<{
@@ -21,7 +21,7 @@ export declare class Route53Builder extends BaseBuilder {
     cert(): ACMCertificateBuilder | undefined;
     withWildcardSSL(): this;
     register(contact?: RegistrantContact): this;
-    record(name: string, type: 'A' | 'CNAME' | 'AAAA', value: string): this;
+    record(name: string, type: "A" | "CNAME" | "AAAA", value: string): this;
     pointer(name: string, target: BaseBuilder): this;
     deploy(): Promise<{
         zone: string;

package/dist/providers/aws/route53.js

@@ -1,9 +1,9 @@
-import { ListHostedZonesByNameCommand, CreateHostedZoneCommand, ChangeResourceRecordSetsCommand, } from '@aws-sdk/client-route-53';
-import { RegisterDomainCommand, GetOperationDetailCommand, CheckDomainAvailabilityCommand, } from '@aws-sdk/client-route-53-domains';
-import { BaseBuilder } from '../../core/resource.js';
-import { Output } from '../../core/output.js';
-import { ACMCertificateBuilder } from './acm.js';
-import { getR53Client, getR53DomainsClient } from './api.js';
+import { ListHostedZonesByNameCommand, CreateHostedZoneCommand, ChangeResourceRecordSetsCommand, } from "@aws-sdk/client-route-53";
+import { RegisterDomainCommand, GetOperationDetailCommand, CheckDomainAvailabilityCommand, } from "@aws-sdk/client-route-53-domains";
+import { BaseBuilder } from "../../core/resource.js";
+import { Output } from "../../core/output.js";
+import { ACMCertificateBuilder } from "./acm.js";
+import { getR53Client, getR53DomainsClient } from "./api.js";
 export class Route53Builder extends BaseBuilder {
     out = {
         zone: new Output(),
@@ -14,8 +14,8 @@ export class Route53Builder extends BaseBuilder {
     _isRegistering = false;
     _registrantContact;
     _wantsWildcardSSL = false;
-    constructor(zoneName = '') {
-        super(zoneName || 'route53-pending');
+    constructor(zoneName = "") {
+        super(zoneName || "route53-pending");
         this.zoneName = zoneName;
         this.discoveryPromise = this.discoverZone(zoneName);
     }
@@ -25,29 +25,29 @@ export class Route53Builder extends BaseBuilder {
         try {
             const r53 = getR53Client();
             const result = await r53.send(new ListHostedZonesByNameCommand({ DNSName: name, MaxItems: 5 }));
-            const match = (result.HostedZones ?? []).find(z => z.Name === `${name}.`);
+            const match = (result.HostedZones ?? []).find((z) => z.Name === `${name}.`);
             if (match) {
-                this.zoneId = match.Id.replace('/hostedzone/', '');
+                this.zoneId = match.Id.replace("/hostedzone/", "");
                 return match;
             }
             return null;
         }
         catch (e) {
-            if (e.name === 'CredentialsProviderError')
+            if (e.name === "CredentialsProviderError")
                 return null;
             throw e;
         }
     }
     randomDomain() {
-        const chars = 'abcdefghijklmnopqrstuvwxyz0123456789';
-        const id = Array.from({ length: 12 }, () => chars[Math.floor(Math.random() * chars.length)]).join('');
+        const chars = "abcdefghijklmnopqrstuvwxyz0123456789";
+        const id = Array.from({ length: 12 }, () => chars[Math.floor(Math.random() * chars.length)]).join("");
         this.zoneName = `${id}.com`;
         this.name = this.zoneName;
         this.discoveryPromise = this.discoverZone(this.zoneName);
         return this;
     }
     cert() {
-        return this.sidecars.find(s => s instanceof ACMCertificateBuilder);
+        return this.sidecars.find((s) => s instanceof ACMCertificateBuilder);
     }
     withWildcardSSL() {
         this._wantsWildcardSSL = true;
@@ -63,7 +63,7 @@ export class Route53Builder extends BaseBuilder {
         return this;
     }
     pointer(name, target) {
-        this.records.push({ name, type: 'A', value: target, isAlias: true });
+        this.records.push({ name, type: "A", value: target, isAlias: true });
         return this;
     }
     async deploy() {
@@ -78,17 +78,17 @@ export class Route53Builder extends BaseBuilder {
         if (!existing) {
             if (dryRun) {
                 console.log(`   📝 [PLAN] Create hosted zone ${this.zoneName}`);
-                this.out.zone.resolve({ name: this.zoneName, id: 'PENDING' });
+                this.out.zone.resolve({ name: this.zoneName, id: "PENDING" });
             }
             else {
-                // Route53 Domains auto-creates the hosted zone on registration — check again before creating
+                // Route53 Domains auto-creates the hosted zone on registration - check again before creating
                 const recheck = await this.discoverZone(this.zoneName);
                 if (!recheck) {
                     const result = await r53.send(new CreateHostedZoneCommand({
                         Name: this.zoneName,
                         CallerReference: `puls-${Date.now()}`,
                     }));
-                    this.zoneId = result.HostedZone.Id.replace('/hostedzone/', '');
+                    this.zoneId = result.HostedZone.Id.replace("/hostedzone/", "");
                     console.log(`🚀 Created hosted zone ${this.zoneName} (id=${this.zoneId})`);
                 }
                 else {
@@ -106,21 +106,23 @@ export class Route53Builder extends BaseBuilder {
         }
         const cert = this.cert();
         if (cert) {
-            cert.forZone(this); // zoneId is set by now — cert writes its own validation CNAMEs
+            cert.forZone(this); // zoneId is set by now - cert writes its own validation CNAMEs
             await cert.deploy();
         }
         // Regular records
         if (this.records.length > 0 && !dryRun && this.zoneId) {
-            const resolved = this.records.map(r => ({
+            const resolved = this.records.map((r) => ({
                 type: r.type,
                 name: r.name,
                 value: r.value instanceof BaseBuilder ? `[alias: ${r.value.name}]` : r.value,
             }));
-            await this.upsertRecords(r53, resolved.map(r => ({ ...r, ttl: 300 })));
+            await this.upsertRecords(r53, resolved.map((r) => ({ ...r, ttl: 300 })));
         }
         for (const rec of this.records) {
-            const val = rec.value instanceof BaseBuilder ? `[Alias to ${rec.value.name}]` : rec.value;
-            console.log(`   ✅ [${dryRun ? 'PLAN' : 'OK'}] ${rec.type}: ${rec.name}.${this.zoneName} → ${val}`);
+            const val = rec.value instanceof BaseBuilder
+                ? `[Alias to ${rec.value.name}]`
+                : rec.value;
+            console.log(`   ✅ [${dryRun ? "PLAN" : "OK"}] ${rec.type}: ${rec.name}.${this.zoneName} → ${val}`);
         }
         return { zone: this.zoneName, id: this.zoneId };
     }
@@ -135,13 +137,13 @@ export class Route53Builder extends BaseBuilder {
         }
         // Check availability before attempting registration
         const avail = await domains.send(new CheckDomainAvailabilityCommand({ DomainName: this.zoneName }));
-        if (avail.Availability !== 'AVAILABLE') {
-            console.log(`   ℹ️  Domain ${this.zoneName} is not available for registration (${avail.Availability}) — skipping`);
+        if (avail.Availability !== "AVAILABLE") {
+            console.log(`   ℹ️  Domain ${this.zoneName} is not available for registration (${avail.Availability}) - skipping`);
             return;
         }
         const contact = c ? this.mapContact(c) : undefined;
         if (!contact)
-            throw new Error(`register() called without contact details — provide a RegistrantContact`);
+            throw new Error(`register() called without contact details - provide a RegistrantContact`);
         console.log(`   📋 Registering domain ${this.zoneName}... (est. ~5 min)`);
         const result = await domains.send(new RegisterDomainCommand({
             DomainName: this.zoneName,
@@ -157,10 +159,10 @@ export class Route53Builder extends BaseBuilder {
         console.log(`🚀 Domain registration submitted (operationId=${result.OperationId})`);
         await this.waitFor(`domain "${this.zoneName}" to become active`, async () => {
             const op = await domains.send(new GetOperationDetailCommand({ OperationId: result.OperationId }));
-            if (op.Status === 'ERROR' || op.Status === 'FAILED') {
+            if (op.Status === "ERROR" || op.Status === "FAILED") {
                 throw new Error(`Domain registration failed (${op.Status}): ${op.Message}`);
             }
-            return op.Status === 'SUCCESSFUL';
+            return op.Status === "SUCCESSFUL";
         }, { intervalMs: 15_000, timeoutMs: 900_000 });
         console.log(`   ✅ Domain ${this.zoneName} registered`);
     }
@@ -180,11 +182,11 @@ export class Route53Builder extends BaseBuilder {
     }
     // Route53 Domains requires +CC.subscriber format (e.g. +46.708339809)
     normalizePhone(phone) {
-        if (phone.includes('.'))
+        if (phone.includes("."))
             return phone;
-        const digits = phone.replace(/^\+/, '');
+        const digits = phone.replace(/^\+/, "");
         // +1 (US/CA) and +7 (RU/KZ) are single-digit country codes
-        if (digits.startsWith('1') || digits.startsWith('7')) {
+        if (digits.startsWith("1") || digits.startsWith("7")) {
             return `+${digits[0]}.${digits.slice(1)}`;
         }
         // Default: treat first 2 digits as country code
@@ -192,9 +194,14 @@ export class Route53Builder extends BaseBuilder {
     }
     async upsertCnames(records) {
         if (!this.zoneId)
-            throw new Error(`Zone ${this.zoneName} has no ID — was it deployed?`);
+            throw new Error(`Zone ${this.zoneName} has no ID - was it deployed?`);
         const r53 = getR53Client();
-        await this.upsertRecords(r53, records.map(r => ({ type: 'CNAME', name: `${r.name}.${this.zoneName}`, value: r.value, ttl: 300 })));
+        await this.upsertRecords(r53, records.map((r) => ({
+            type: "CNAME",
+            name: `${r.name}.${this.zoneName}`,
+            value: r.value,
+            ttl: 300,
+        })));
         for (const r of records) {
             console.log(`   ✅ CNAME ${r.name}.${this.zoneName} → ${r.value}`);
         }
@@ -203,8 +210,8 @@ export class Route53Builder extends BaseBuilder {
         await r53.send(new ChangeResourceRecordSetsCommand({
             HostedZoneId: this.zoneId,
             ChangeBatch: {
-                Changes: records.map(r => ({
-                    Action: 'UPSERT',
+                Changes: records.map((r) => ({
+                    Action: "UPSERT",
                     ResourceRecordSet: {
                         Name: r.name,
                         Type: r.type,

package/dist/providers/aws/s3.d.ts

@@ -1,5 +1,5 @@
-import { BaseBuilder } from '../../core/resource.js';
-import { CloudFrontBuilder } from './cloudfront.js';
+import { BaseBuilder } from "../../core/resource.js";
+import { CloudFrontBuilder } from "./cloudfront.js";
 export declare class S3BucketBuilder extends BaseBuilder {
     bucketName: string;
     private _versioning;

package/dist/providers/aws/s3.js

@@ -1,9 +1,9 @@
-import { readFileSync } from 'node:fs';
-import { basename, extname } from 'node:path';
-import { HeadBucketCommand, CreateBucketCommand, GetBucketPolicyCommand, PutBucketPolicyCommand, PutObjectCommand, } from '@aws-sdk/client-s3';
-import { BaseBuilder } from '../../core/resource.js';
-import { getS3Client } from './api.js';
-import { Config } from '../../core/config.js';
+import { readFileSync } from "node:fs";
+import { basename, extname } from "node:path";
+import { HeadBucketCommand, CreateBucketCommand, GetBucketPolicyCommand, PutBucketPolicyCommand, PutObjectCommand, } from "@aws-sdk/client-s3";
+import { BaseBuilder } from "../../core/resource.js";
+import { getS3Client } from "./api.js";
+import { Config } from "../../core/config.js";
 export class S3BucketBuilder extends BaseBuilder {
     bucketName;
     _versioning = false;
@@ -27,11 +27,11 @@ export class S3BucketBuilder extends BaseBuilder {
         }
         catch (e) {
             const status = e.$metadata?.httpStatusCode;
-            if (status === 404 || e.name === 'NotFound')
+            if (status === 404 || e.name === "NotFound")
                 return false;
             if (status === 301 || status === 403)
                 return true; // exists in different region or access denied
-            if (e.name === 'CredentialsProviderError')
+            if (e.name === "CredentialsProviderError")
                 return false;
             throw e;
         }
@@ -51,7 +51,7 @@ export class S3BucketBuilder extends BaseBuilder {
     async deploy() {
         const dryRun = this.isDryRunActive();
         const exists = await this.discoveryPromise;
-        const region = this._region ?? Config.get().providers.aws?.region ?? 'us-east-1';
+        const region = this._region ?? Config.get().providers.aws?.region ?? "us-east-1";
         const s3 = getS3Client(region);
         console.log(`\n🪣  Finalizing S3 Bucket "${this.bucketName}"...`);
         if (!exists) {
@@ -60,7 +60,7 @@ export class S3BucketBuilder extends BaseBuilder {
             }
             else {
                 const createCmd = { Bucket: this.bucketName };
-                if (region !== 'us-east-1') {
+                if (region !== "us-east-1") {
                     createCmd.CreateBucketConfiguration = { LocationConstraint: region };
                 }
                 await s3.send(new CreateBucketCommand(createCmd));
@@ -71,13 +71,13 @@ export class S3BucketBuilder extends BaseBuilder {
             console.log(`   ✅ Bucket ${this.bucketName} already exists.`);
         }
         if (this._allowedDistributions.length > 0) {
-            const unresolved = this._allowedDistributions.filter(d => !d.resolvedArn);
+            const unresolved = this._allowedDistributions.filter((d) => !d.resolvedArn);
             if (unresolved.length > 0) {
                 throw new Error(`[S3:${this.bucketName}] allowFrom() has unresolved distributions: ` +
-                    unresolved.map(d => `"${d.name}"`).join(', ') +
-                    '. Declare the bucket after all CloudFront distributions in your Stack.');
+                    unresolved.map((d) => `"${d.name}"`).join(", ") +
+                    ". Declare the bucket after all CloudFront distributions in your Stack.");
             }
-            const newArns = this._allowedDistributions.map(d => d.resolvedArn);
+            const newArns = this._allowedDistributions.map((d) => d.resolvedArn);
             if (dryRun) {
                 console.log(`   📝 [PLAN] Append ${newArns.length} CloudFront OAC ARN(s) to bucket policy`);
                 for (const arn of newArns)
@@ -102,15 +102,16 @@ export class S3BucketBuilder extends BaseBuilder {
         const key = basename(filePath);
         const body = readFileSync(filePath);
         const contentTypeMap = {
-            '.json': 'application/json',
-            '.js': 'application/javascript',
-            '.html': 'text/html',
-            '.css': 'text/css',
-            '.png': 'image/png',
-            '.jpg': 'image/jpeg',
-            '.svg': 'image/svg+xml',
+            ".json": "application/json",
+            ".js": "application/javascript",
+            ".html": "text/html",
+            ".css": "text/css",
+            ".png": "image/png",
+            ".jpg": "image/jpeg",
+            ".svg": "image/svg+xml",
         };
-        const contentType = contentTypeMap[extname(filePath).toLowerCase()] ?? 'application/octet-stream';
+        const contentType = contentTypeMap[extname(filePath).toLowerCase()] ??
+            "application/octet-stream";
         await s3.send(new PutObjectCommand({
             Bucket: this.bucketName,
             Key: key,
@@ -120,45 +121,51 @@ export class S3BucketBuilder extends BaseBuilder {
         console.log(`   ✅ Uploaded ${key} → s3://${this.bucketName}/${key}`);
     }
     async updateBucketPolicy(s3, newArns) {
-        let policy = { Version: '2012-10-17', Statement: [] };
+        let policy = { Version: "2012-10-17", Statement: [] };
         try {
             const existing = await s3.send(new GetBucketPolicyCommand({ Bucket: this.bucketName }));
             if (existing.Policy)
                 policy = JSON.parse(existing.Policy);
         }
         catch (e) {
-            if (e.name !== 'NoSuchBucketPolicy')
+            if (e.name !== "NoSuchBucketPolicy")
                 throw e;
         }
         // Find any existing CloudFront-principal statement regardless of Sid
-        let stmt = policy.Statement.find((s) => s.Principal?.Service === 'cloudfront.amazonaws.com' && s.Effect === 'Allow');
+        let stmt = policy.Statement.find((s) => s.Principal?.Service === "cloudfront.amazonaws.com" &&
+            s.Effect === "Allow");
         if (!stmt) {
             stmt = {
-                Sid: 'AllowCloudFrontServicePrincipal',
-                Effect: 'Allow',
-                Principal: { Service: 'cloudfront.amazonaws.com' },
-                Action: 's3:GetObject',
+                Sid: "AllowCloudFrontServicePrincipal",
+                Effect: "Allow",
+                Principal: { Service: "cloudfront.amazonaws.com" },
+                Action: "s3:GetObject",
                 Resource: `arn:aws:s3:::${this.bucketName}/*`,
-                Condition: { StringEquals: { 'AWS:SourceArn': [] } },
+                Condition: { StringEquals: { "AWS:SourceArn": [] } },
             };
             policy.Statement.push(stmt);
         }
         // Condition key may be 'aws:SourceArn' or 'AWS:SourceArn' depending on how it was created
         const cond = stmt.Condition?.StringEquals ?? {};
-        const sourceArnKey = Object.keys(cond).find(k => k.toLowerCase() === 'aws:sourcearn') ?? 'AWS:SourceArn';
+        const sourceArnKey = Object.keys(cond).find((k) => k.toLowerCase() === "aws:sourcearn") ??
+            "AWS:SourceArn";
         if (!stmt.Condition)
             stmt.Condition = { StringEquals: {} };
         if (!stmt.Condition.StringEquals)
             stmt.Condition.StringEquals = {};
         const existing = stmt.Condition.StringEquals[sourceArnKey];
-        const existingArns = Array.isArray(existing) ? existing : existing ? [existing] : [];
+        const existingArns = Array.isArray(existing)
+            ? existing
+            : existing
+                ? [existing]
+                : [];
         const merged = [...new Set([...existingArns, ...newArns])];
         stmt.Condition.StringEquals[sourceArnKey] = merged;
         await s3.send(new PutBucketPolicyCommand({
             Bucket: this.bucketName,
             Policy: JSON.stringify(policy),
         }));
-        console.log(`   ✅ Updated bucket policy — ${merged.length} distribution ARN(s) allowed`);
+        console.log(`   ✅ Updated bucket policy - ${merged.length} distribution ARN(s) allowed`);
         for (const arn of newArns)
             console.log(`      └─ ${arn}`);
     }