chore: show TheCloud instead of Floci in console text and messages

Labels, empty states, error messages and defaults the console shows now name
TheCloud or its runtimes. Identifiers that must match the emulator (FLOCI_*
settings, the X-Floci-CSRF header, emulator-returned host names) are unchanged.

README.md

@@ -79,6 +79,7 @@ cd packages/api && bun run scripts/service-matrix.ts
 | Networking | ELB / Load Balancing | Yes (list, create, update, delete, inspect) | No | No |
 | Networking | ELB Target Groups / Target Groups | Yes (list, create, delete, inspect) | No | No |
 | Networking | Route 53 / DNS | Yes (list, create, delete, inspect) | No | No |
+| Networking | CloudFront / CDN | Yes (list, create, delete, inspect) | No | No |
 | Integration | SQS / Messaging / Pub/Sub | Yes (list, create, inspect, delete) | Yes (list, create, delete, inspect) | Yes (list, create, inspect, delete) |
 | Integration | API Gateway | Yes (list, create, delete, inspect) | No | No |
 | Integration | SNS / Notifications | Yes (list, create, inspect, delete) | No | No |
@@ -102,7 +103,7 @@ Console Home is available for all three clouds.
 
 Runtime gaps — an adapter exists but the local runtime does not implement it:
 
-- Azure Serverless: the Floci-AZ runtime returns 501 NotImplemented for the Azure Functions endpoint.
+- Azure Serverless: TheCloud's Azure runtime returns 501 NotImplemented for the Azure Functions endpoint.
 
 Services marked `No` render as a disabled sidebar row whose tooltip carries the
 server-supplied reason. Adding one is a catalog row in

packages/api/package.json

@@ -13,6 +13,7 @@
     "@aws-sdk/client-api-gateway": "^3.1076.0",
     "@aws-sdk/client-appconfig": "^3.1076.0",
     "@aws-sdk/client-cloudformation": "^3.1111.0",
+    "@aws-sdk/client-cloudfront": "^3.1146.0",
     "@aws-sdk/client-cloudwatch": "^3.1076.0",
     "@aws-sdk/client-cloudwatch-logs": "^3.1096.0",
     "@aws-sdk/client-codebuild": "^3.1076.0",

packages/api/src/adapter-aws/AwsCdnAdapter.test.ts

@@ -0,0 +1,182 @@
+import {describe, expect, test} from 'bun:test'
+import {
+    CreateDistributionCommand,
+    CreateInvalidationCommand,
+    DeleteDistributionCommand,
+    GetDistributionCommand,
+    GetDistributionConfigCommand,
+    ListDistributionsCommand,
+    ListInvalidationsCommand,
+    UpdateDistributionCommand,
+    type CloudFrontClient,
+    type DistributionConfig,
+} from '@aws-sdk/client-cloudfront'
+import {HeadBucketCommand, type S3Client} from '@aws-sdk/client-s3'
+import {AwsCdnAdapter} from './AwsCdnAdapter'
+import {ConflictError, ValidationError} from '../cloud-spi/errors'
+
+type SendResult = Record<string, unknown>
+
+function stub(handler: (command: object) => SendResult | Promise<SendResult>) {
+    const sent: object[] = []
+    const client = {
+        async send(command: object) {
+            sent.push(command)
+            return handler(command)
+        },
+    }
+    return {client, sent}
+}
+
+function awsError(name: string, status = 400): Error {
+    return Object.assign(new Error(name), {name, $metadata: {httpStatusCode: status}})
+}
+
+const ID = 'E7CPM0P0G0VC8D'
+const origin = {Id: 's3-site', DomainName: 'site.s3.amazonaws.com', S3OriginConfig: {OriginAccessIdentity: ''}}
+const config = {
+    CallerReference: 'r', Comment: 'Docs site', Enabled: true, DefaultRootObject: 'index.html',
+    Origins: {Quantity: 1, Items: [origin]},
+    DefaultCacheBehavior: {TargetOriginId: 's3-site', ViewerProtocolPolicy: 'allow-all', AllowedMethods: {Quantity: 2, Items: ['GET', 'HEAD']}},
+    CacheBehaviors: {Quantity: 1, Items: [{PathPattern: '/api/*', TargetOriginId: 'custom-api', ViewerProtocolPolicy: 'https-only', AllowedMethods: {Quantity: 7, Items: ['GET', 'HEAD', 'OPTIONS', 'PUT', 'POST', 'PATCH', 'DELETE']}}]},
+} as DistributionConfig
+const distribution = {Id: ID, ARN: `arn:aws:cloudfront::000000000000:distribution/${ID}`, DomainName: 'e7cpm0p0g0vc8d.cloudfront.net', Status: 'Deployed', LastModifiedTime: new Date('2026-10-24T18:00:00Z'), DistributionConfig: config}
+
+function adapter(cloudfront: (command: object) => SendResult | Promise<SendResult>, s3: (command: object) => SendResult | Promise<SendResult> = () => ({})) {
+    const cf = stub(cloudfront)
+    const bucket = stub(s3)
+    return {adapter: new AwsCdnAdapter(cf.client as unknown as CloudFrontClient, bucket.client as unknown as S3Client, 'http://floci:4566'), sent: cf.sent, s3Sent: bucket.sent}
+}
+
+describe('AwsCdnAdapter distributions', () => {
+    test('lists distributions with their local URL, origins and description, and filters them', async () => {
+        const {adapter: cdn} = adapter((command) => command instanceof ListDistributionsCommand
+            ? {DistributionList: {Items: [{...distribution, Enabled: true, Comment: 'Docs site', Origins: config.Origins}], IsTruncated: false}}
+            : {})
+
+        const [listed] = await cdn.list()
+        expect(listed).toMatchObject({id: ID, name: 'e7cpm0p0g0vc8d.cloudfront.net', status: 'Deployed'})
+        expect(listed.metadata).toMatchObject({viewerUrl: 'http://e7cpm0p0g0vc8d.cloudfront.localhost:4566/', enabled: true, comment: 'Docs site', originDomains: ['site.s3.amazonaws.com']})
+        expect(await cdn.list({search: 'site.s3'})).toHaveLength(1)
+        expect(await cdn.list({search: 'nothing'})).toHaveLength(0)
+    })
+
+    test('describes behaviours and recent invalidations, and treats a missing distribution as absent', async () => {
+        const {adapter: cdn} = adapter((command) => {
+            if (command instanceof GetDistributionCommand && command.input.Id === ID) return {Distribution: distribution, ETag: 'e1'}
+            if (command instanceof GetDistributionCommand) throw awsError('NoSuchDistribution', 404)
+            if (command instanceof ListInvalidationsCommand) return {InvalidationList: {Items: [{Id: 'I1', Status: 'Completed', CreateTime: new Date('2026-10-24T18:05:00Z')}]}}
+            return {}
+        })
+
+        const described = await cdn.get(ID)
+        expect(described?.metadata).toMatchObject({
+            defaultRootObject: 'index.html',
+            behaviors: [
+                {pathPattern: '/api/*', originId: 'custom-api', viewerProtocol: 'https-only', methods: ['GET', 'HEAD', 'OPTIONS', 'PUT', 'POST', 'PATCH', 'DELETE']},
+                {pathPattern: 'Default (*)', originId: 's3-site', viewerProtocol: 'allow-all', methods: ['GET', 'HEAD']},
+            ],
+            invalidations: [{id: 'I1', status: 'Completed', createdAt: '2026-10-24T18:05:00.000Z', paths: []}],
+        })
+        expect(await cdn.get('EMISSING')).toBeNull()
+    })
+
+    test('creates a cached website from a bucket that exists', async () => {
+        const {adapter: cdn, sent, s3Sent} = adapter((command) => command instanceof CreateDistributionCommand
+            ? {Distribution: {...distribution, DistributionConfig: command.input.DistributionConfig}}
+            : {})
+
+        await cdn.create({values: {originType: 's3', bucket: 'site', defaultRootObject: '/index.html', comment: 'Docs'}})
+
+        expect(s3Sent[0]).toBeInstanceOf(HeadBucketCommand)
+        const created = (sent[0] as CreateDistributionCommand).input.DistributionConfig!
+        expect(created).toMatchObject({Enabled: true, Comment: 'Docs', DefaultRootObject: 'index.html', Origins: {Quantity: 1, Items: [{Id: 's3-site', DomainName: 'site.s3.amazonaws.com'}]}})
+        expect(created.DefaultCacheBehavior).toMatchObject({TargetOriginId: 's3-site', ViewerProtocolPolicy: 'allow-all', CachePolicyId: '658327ea-f89d-4fab-a63d-7e88639e58f6', AllowedMethods: {Quantity: 2}})
+        expect(created.DefaultCacheBehavior?.OriginRequestPolicyId).toBeUndefined()
+    })
+
+    test('creates an uncached API in front of a custom origin, forwarding the viewer request', async () => {
+        const {adapter: cdn, sent, s3Sent} = adapter((command) => command instanceof CreateDistributionCommand
+            ? {Distribution: {...distribution, DistributionConfig: command.input.DistributionConfig}}
+            : {})
+
+        await cdn.create({values: {originType: 'custom', originDomain: 'API.example.com', originProtocol: 'http-only', originPort: '8080', allowedMethods: 'all', viewerProtocol: 'redirect-to-https'}})
+
+        expect(s3Sent).toHaveLength(0)
+        const created = (sent[0] as CreateDistributionCommand).input.DistributionConfig!
+        expect(created.Origins?.Items?.[0]).toMatchObject({Id: 'custom-api.example.com', DomainName: 'api.example.com', CustomOriginConfig: {HTTPPort: 8080, HTTPSPort: 8080, OriginProtocolPolicy: 'http-only'}})
+        expect(created.DefaultCacheBehavior).toMatchObject({
+            ViewerProtocolPolicy: 'redirect-to-https', AllowedMethods: {Quantity: 7},
+            CachePolicyId: '4135ea2d-6df8-44a3-9df3-4b5a84be39ad', OriginRequestPolicyId: 'b689b0a8-53d0-40ab-baf2-68738e2966ac',
+        })
+    })
+
+    test('refuses a missing bucket and invalid settings before creating anything', async () => {
+        const {adapter: cdn, sent} = adapter(() => ({}), () => { throw awsError('NotFound', 404) })
+
+        await expect(cdn.create({values: {originType: 's3', bucket: 'nope'}})).rejects.toThrow(/no S3 bucket named nope/)
+        await expect(cdn.create({values: {originType: 's3', bucket: 'Bad_Name'}})).rejects.toThrow(ValidationError)
+        await expect(cdn.create({values: {originType: 'custom', originDomain: 'not a host'}})).rejects.toThrow(ValidationError)
+        await expect(cdn.create({values: {originType: 'custom', originDomain: 'api.example.com', originPort: '70000'}})).rejects.toThrow(/originPort/)
+        await expect(cdn.create({values: {originType: 'ftp'}})).rejects.toThrow(/originType/)
+        expect(sent.some((command) => command instanceof CreateDistributionCommand)).toBe(false)
+    })
+
+    test('disables an enabled distribution, then deletes it with the new ETag', async () => {
+        const {adapter: cdn, sent} = adapter((command) => {
+            if (command instanceof GetDistributionCommand) return {Distribution: distribution, ETag: 'e1'}
+            if (command instanceof GetDistributionConfigCommand) return {DistributionConfig: config, ETag: 'e1'}
+            if (command instanceof UpdateDistributionCommand) return {Distribution: {...distribution, Status: 'Deployed'}, ETag: 'e2'}
+            return {}
+        })
+
+        await cdn.delete(ID)
+
+        const update = sent.find((command) => command instanceof UpdateDistributionCommand) as UpdateDistributionCommand
+        expect(update.input).toMatchObject({Id: ID, IfMatch: 'e1', DistributionConfig: {Enabled: false, Comment: 'Docs site'}})
+        expect((sent.find((command) => command instanceof DeleteDistributionCommand) as DeleteDistributionCommand).input).toEqual({Id: ID, IfMatch: 'e2'})
+    })
+
+    test('says to try again while CloudFront is still deploying the disable', async () => {
+        const {adapter: cdn, sent} = adapter((command) => {
+            if (command instanceof GetDistributionCommand) return {Distribution: distribution, ETag: 'e1'}
+            if (command instanceof GetDistributionConfigCommand) return {DistributionConfig: config, ETag: 'e1'}
+            if (command instanceof UpdateDistributionCommand) return {Distribution: {...distribution, Status: 'InProgress'}, ETag: 'e2'}
+            return {}
+        })
+
+        await expect(cdn.delete(ID)).rejects.toThrow(ConflictError)
+        expect(sent.some((command) => command instanceof DeleteDistributionCommand)).toBe(false)
+    })
+})
+
+describe('AwsCdnAdapter actions', () => {
+    test('enables or disables a distribution, keeping the rest of its configuration', async () => {
+        const {adapter: cdn, sent} = adapter((command) => {
+            if (command instanceof GetDistributionConfigCommand) return {DistributionConfig: config, ETag: 'e1'}
+            if (command instanceof GetDistributionCommand) return {Distribution: {...distribution, DistributionConfig: {...config, Enabled: false}}, ETag: 'e2'}
+            if (command instanceof ListInvalidationsCommand) return {InvalidationList: {Items: []}}
+            return {}
+        })
+
+        const disabled = await cdn.setDistributionEnabled(ID, false)
+        expect(disabled.metadata.enabled).toBe(false)
+        expect((sent.find((command) => command instanceof UpdateDistributionCommand) as UpdateDistributionCommand).input.DistributionConfig).toEqual({...config, Enabled: false})
+
+        // The stored configuration is already enabled: nothing to change.
+        const before = sent.length
+        await cdn.setDistributionEnabled(ID, true)
+        expect(sent.slice(before).some((command) => command instanceof UpdateDistributionCommand)).toBe(false)
+    })
+
+    test('invalidates paths that start with a slash', async () => {
+        const {adapter: cdn, sent} = adapter((command) => command instanceof CreateInvalidationCommand
+            ? {Invalidation: {Id: 'I2', Status: 'Completed', CreateTime: new Date('2026-10-24T18:10:00Z'), InvalidationBatch: command.input.InvalidationBatch}}
+            : {})
+
+        expect(await cdn.createDistributionInvalidation(ID, [' /* ', '/index.html', '/*'])).toEqual({id: 'I2', status: 'Completed', createdAt: '2026-10-24T18:10:00.000Z', paths: ['/*', '/index.html']})
+        await expect(cdn.createDistributionInvalidation(ID, ['index.html'])).rejects.toThrow(/must start with \//)
+        await expect(cdn.createDistributionInvalidation(ID, [])).rejects.toThrow(/at least one path/)
+        expect(sent.filter((command) => command instanceof CreateInvalidationCommand)).toHaveLength(1)
+    })
+})

packages/api/src/adapter-aws/AwsCdnAdapter.ts

@@ -0,0 +1,301 @@
+import {
+    CreateDistributionCommand,
+    CreateInvalidationCommand,
+    DeleteDistributionCommand,
+    GetDistributionCommand,
+    GetDistributionConfigCommand,
+    ListDistributionsCommand,
+    ListInvalidationsCommand,
+    UpdateDistributionCommand,
+    type CacheBehavior,
+    type CloudFrontClient,
+    type DefaultCacheBehavior,
+    type Distribution,
+    type DistributionConfig,
+    type DistributionSummary,
+    type Origin,
+} from '@aws-sdk/client-cloudfront'
+import {HeadBucketCommand, type S3Client} from '@aws-sdk/client-s3'
+import {
+    CDN_ALLOWED_METHODS,
+    CDN_BUCKET_PATTERN,
+    CDN_ORIGIN_DOMAIN_PATTERN,
+    CDN_ORIGIN_PROTOCOLS,
+    CDN_ORIGIN_TYPES,
+    CDN_VIEWER_PROTOCOLS,
+    awsCdnSchema,
+} from '../cloud-spi/cdnSchema'
+import {ConflictError, NotFoundError, ValidationError} from '../cloud-spi/errors'
+import type {CloudResource, CloudServiceAdapter, CreateResourceInput, DistributionInvalidation, ResourceQuery, ServiceSchema} from '../cloud-spi/types'
+
+/** AWS managed cache and origin request policies, which CloudFront and the runtime both know by ID. */
+const CACHING_OPTIMIZED = '658327ea-f89d-4fab-a63d-7e88639e58f6'
+const CACHING_DISABLED = '4135ea2d-6df8-44a3-9df3-4b5a84be39ad'
+const ALL_VIEWER_EXCEPT_HOST_HEADER = 'b689b0a8-53d0-40ab-baf2-68738e2966ac'
+const READ_METHODS = ['GET', 'HEAD']
+const ALL_METHODS = ['GET', 'HEAD', 'OPTIONS', 'PUT', 'POST', 'PATCH', 'DELETE']
+/** CloudFront's limit on paths in one invalidation that are not wildcards. */
+const MAX_INVALIDATION_PATHS = 3000
+const RECENT_INVALIDATIONS = 5
+
+/**
+ * Talks to CloudFront distributions, verified against Floci core (community, `latest`).
+ *
+ * Notes from probing the runtime:
+ *  - A distribution is `Deployed` as soon as it is created or updated; AWS takes minutes.
+ *  - `DeleteDistribution` refuses an enabled distribution with `DistributionNotDisabled`
+ *    (409), as on AWS, so delete disables it first.
+ *  - A missing distribution is `NoSuchDistribution` with HTTP 404.
+ *  - Viewer requests reach a distribution at `{id}.cloudfront.localhost` on the runtime's
+ *    port. Browsers and curl resolve every `.localhost` name to the machine itself (RFC 6761),
+ *    so no DNS or hosts-file entry is needed.
+ */
+export class AwsCdnAdapter implements CloudServiceAdapter {
+    readonly cloud = 'aws' as const
+    readonly service = 'cdn' as const
+
+    constructor(
+        private readonly cloudfront: CloudFrontClient,
+        private readonly s3: S3Client,
+        private readonly endpoint = process.env.FLOCI_ENDPOINT ?? 'http://localhost:4566',
+    ) {}
+
+    schema(): ServiceSchema {
+        return awsCdnSchema()
+    }
+
+    async list(query: ResourceQuery = {}): Promise<CloudResource[]> {
+        const summaries: DistributionSummary[] = []
+        let marker: string | undefined
+        do {
+            const res = await this.cloudfront.send(new ListDistributionsCommand({...(marker ? {Marker: marker} : {})}))
+            summaries.push(...(res.DistributionList?.Items ?? []))
+            marker = res.DistributionList?.IsTruncated ? res.DistributionList.NextMarker : undefined
+        } while (marker)
+
+        const search = query.search?.trim().toLowerCase()
+        return summaries.map((summary) => this.toResource(summary, summary.Enabled ?? false, summary.Comment, summary.Origins?.Items))
+            .filter((resource) => !search || [resource.id, resource.name, ...stringList(resource.metadata.originDomains)].some((value) => value.toLowerCase().includes(search)))
+    }
+
+    async get(id: string): Promise<CloudResource | null> {
+        let distribution: Distribution | undefined
+        try {
+            distribution = (await this.cloudfront.send(new GetDistributionCommand({Id: id}))).Distribution
+        } catch (error) {
+            if (errorName(error) === 'NoSuchDistribution') return null
+            throw error
+        }
+        if (!distribution) return null
+        const config = distribution.DistributionConfig
+        const invalidations = await this.recentInvalidations(id)
+        const resource = this.toResource(distribution, config?.Enabled ?? false, config?.Comment, config?.Origins?.Items)
+        resource.metadata = {
+            ...resource.metadata,
+            defaultRootObject: config?.DefaultRootObject || null,
+            aliases: config?.Aliases?.Items ?? [],
+            behaviors: behaviorsOf(config),
+            invalidations,
+        }
+        return resource
+    }
+
+    async create(input: CreateResourceInput): Promise<CloudResource> {
+        const values = input.values
+        const originType = oneOf(values.originType ?? 's3', CDN_ORIGIN_TYPES, 'originType')
+        const viewerProtocol = oneOf(values.viewerProtocol || 'allow-all', CDN_VIEWER_PROTOCOLS, 'viewerProtocol')
+        const methods = oneOf(values.allowedMethods || 'read', CDN_ALLOWED_METHODS, 'allowedMethods')
+        const comment = text(values.comment)
+        if (comment.length > 128) throw new ValidationError('comment must be at most 128 characters')
+        const defaultRootObject = text(values.defaultRootObject).replace(/^\/+/, '')
+
+        const origin = originType === 's3' ? await this.s3Origin(text(values.bucket)) : customOrigin(values)
+        const allowed = methods === 'all' ? ALL_METHODS : READ_METHODS
+        const behavior: DefaultCacheBehavior = {
+            TargetOriginId: origin.Id,
+            ViewerProtocolPolicy: viewerProtocol,
+            AllowedMethods: {Quantity: allowed.length, Items: allowed as never, CachedMethods: {Quantity: 2, Items: ['GET', 'HEAD']}},
+            Compress: true,
+            // A website is cached; an API, which sees every method, is not, and gets the viewer's request.
+            CachePolicyId: methods === 'all' ? CACHING_DISABLED : CACHING_OPTIMIZED,
+            ...(methods === 'all' && originType === 'custom' ? {OriginRequestPolicyId: ALL_VIEWER_EXCEPT_HOST_HEADER} : {}),
+        }
+        const res = await this.cloudfront.send(new CreateDistributionCommand({
+            DistributionConfig: {
+                CallerReference: crypto.randomUUID(),
+                Comment: comment,
+                Enabled: true,
+                DefaultRootObject: defaultRootObject || undefined,
+                Origins: {Quantity: 1, Items: [origin]},
+                DefaultCacheBehavior: behavior,
+            },
+        }))
+        if (!res.Distribution) throw new ValidationError('CloudFront did not return the new distribution')
+        const config = res.Distribution.DistributionConfig
+        return this.toResource(res.Distribution, config?.Enabled ?? true, config?.Comment, config?.Origins?.Items)
+    }
+
+    /** CloudFront deletes only a disabled distribution, so an enabled one is disabled first. */
+    async delete(id: string): Promise<void> {
+        let etag = (await this.cloudfront.send(new GetDistributionCommand({Id: id}))).ETag
+        const current = await this.cloudfront.send(new GetDistributionConfigCommand({Id: id}))
+        if (current.DistributionConfig?.Enabled) {
+            const disabled = await this.cloudfront.send(new UpdateDistributionCommand({
+                Id: id,
+                IfMatch: current.ETag,
+                DistributionConfig: {...current.DistributionConfig, Enabled: false},
+            }))
+            if (disabled.Distribution?.Status !== 'Deployed') {
+                throw new ConflictError('The distribution is now disabled. CloudFront deletes it once the change is deployed: try again when its status is Deployed')
+            }
+            etag = disabled.ETag
+        }
+        try {
+            await this.cloudfront.send(new DeleteDistributionCommand({Id: id, IfMatch: etag}))
+        } catch (error) {
+            if (errorName(error) === 'DistributionNotDisabled') {
+                throw new ConflictError('CloudFront is still disabling the distribution: try again when its status is Deployed')
+            }
+            throw error
+        }
+    }
+
+    async setDistributionEnabled(id: string, enabled: boolean): Promise<CloudResource> {
+        if (typeof enabled !== 'boolean') throw new ValidationError('enabled must be true or false')
+        const current = await this.cloudfront.send(new GetDistributionConfigCommand({Id: id}))
+        if (!current.DistributionConfig) throw new NotFoundError(`Distribution ${id} was not found`)
+        if (current.DistributionConfig.Enabled !== enabled) {
+            await this.cloudfront.send(new UpdateDistributionCommand({
+                Id: id,
+                IfMatch: current.ETag,
+                DistributionConfig: {...current.DistributionConfig, Enabled: enabled},
+            }))
+        }
+        const resource = await this.get(id)
+        if (!resource) throw new NotFoundError(`Distribution ${id} was not found`)
+        return resource
+    }
+
+    async createDistributionInvalidation(id: string, paths: string[]): Promise<DistributionInvalidation> {
+        if (!Array.isArray(paths)) throw new ValidationError('paths must be a list')
+        const items = [...new Set(paths.map((path) => String(path).trim()).filter(Boolean))]
+        if (items.length === 0) throw new ValidationError('Add at least one path, such as /* or /index.html')
+        if (items.length > MAX_INVALIDATION_PATHS) throw new ValidationError(`An invalidation holds at most ${MAX_INVALIDATION_PATHS} paths`)
+        const invalid = items.find((path) => !path.startsWith('/'))
+        if (invalid) throw new ValidationError(`${invalid} must start with /`)
+        const res = await this.cloudfront.send(new CreateInvalidationCommand({
+            DistributionId: id,
+            InvalidationBatch: {CallerReference: crypto.randomUUID(), Paths: {Quantity: items.length, Items: items}},
+        }))
+        return {
+            id: res.Invalidation?.Id ?? '',
+            status: res.Invalidation?.Status ?? 'InProgress',
+            createdAt: res.Invalidation?.CreateTime?.toISOString() ?? null,
+            paths: res.Invalidation?.InvalidationBatch?.Paths?.Items ?? items,
+        }
+    }
+
+    private async s3Origin(bucket: string): Promise<Origin> {
+        if (!new RegExp(CDN_BUCKET_PATTERN).test(bucket)) throw new ValidationError('bucket must be the name of an existing S3 bucket')
+        try {
+            await this.s3.send(new HeadBucketCommand({Bucket: bucket}))
+        } catch (error) {
+            if (['NotFound', 'NoSuchBucket'].includes(errorName(error))) throw new ValidationError(`There is no S3 bucket named ${bucket}`)
+            throw error
+        }
+        return {Id: `s3-${bucket}`, DomainName: `${bucket}.s3.amazonaws.com`, S3OriginConfig: {OriginAccessIdentity: ''}}
+    }
+
+    private async recentInvalidations(id: string): Promise<DistributionInvalidation[]> {
+        const res = await this.cloudfront.send(new ListInvalidationsCommand({DistributionId: id, MaxItems: RECENT_INVALIDATIONS}))
+        return (res.InvalidationList?.Items ?? []).map((invalidation) => ({
+            id: invalidation.Id ?? '',
+            status: invalidation.Status ?? '',
+            createdAt: invalidation.CreateTime?.toISOString() ?? null,
+            paths: [],
+        }))
+    }
+
+    private toResource(distribution: Pick<Distribution, 'Id' | 'DomainName' | 'Status' | 'LastModifiedTime' | 'ARN'>, enabled: boolean, comment: string | undefined, origins: Origin[] | undefined): CloudResource {
+        const id = distribution.Id ?? ''
+        return {
+            id,
+            name: distribution.DomainName ?? id,
+            cloud: 'aws',
+            service: 'cdn',
+            type: 'distribution',
+            region: null,
+            createdAt: distribution.LastModifiedTime?.toISOString() ?? null,
+            status: distribution.Status ?? null,
+            metadata: {
+                arn: distribution.ARN ?? null,
+                domainName: distribution.DomainName ?? null,
+                viewerUrl: this.viewerUrl(id),
+                enabled,
+                comment: comment || null,
+                originDomains: (origins ?? []).map((origin) => origin.DomainName ?? ''),
+                origins: (origins ?? []).map((origin) => ({
+                    id: origin.Id ?? '',
+                    domainName: origin.DomainName ?? '',
+                    kind: origin.S3OriginConfig ? 's3' : 'custom',
+                    protocol: origin.CustomOriginConfig?.OriginProtocolPolicy ?? null,
+                })),
+            },
+        }
+    }
+
+    /** Where a browser on this machine reaches the distribution through the runtime. */
+    private viewerUrl(id: string): string {
+        const port = new URL(this.endpoint).port || '4566'
+        return `http://${id.toLowerCase()}.cloudfront.localhost:${port}/`
+    }
+}
+
+function customOrigin(values: Record<string, unknown>): Origin {
+    const domain = text(values.originDomain).toLowerCase()
+    if (!new RegExp(CDN_ORIGIN_DOMAIN_PATTERN).test(domain)) throw new ValidationError('originDomain must be a host name such as api.example.com')
+    const protocol = oneOf(values.originProtocol || 'https-only', CDN_ORIGIN_PROTOCOLS, 'originProtocol')
+    const port = text(values.originPort)
+    const portNumber = port ? Number(port) : null
+    if (portNumber !== null && (!Number.isInteger(portNumber) || portNumber < 1 || portNumber > 65535)) throw new ValidationError('originPort must be between 1 and 65535')
+    return {
+        Id: `custom-${domain}`,
+        DomainName: domain,
+        CustomOriginConfig: {
+            HTTPPort: portNumber ?? 80,
+            HTTPSPort: portNumber ?? 443,
+            OriginProtocolPolicy: protocol,
+            OriginSslProtocols: {Quantity: 1, Items: ['TLSv1.2']},
+        },
+    }
+}
+
+function behaviorsOf(config: DistributionConfig | undefined) {
+    const describe = (behavior: DefaultCacheBehavior | CacheBehavior, pathPattern: string) => ({
+        pathPattern,
+        originId: behavior.TargetOriginId ?? '',
+        viewerProtocol: behavior.ViewerProtocolPolicy ?? '',
+        methods: behavior.AllowedMethods?.Items ?? READ_METHODS,
+    })
+    return [
+        ...(config?.CacheBehaviors?.Items ?? []).map((behavior) => describe(behavior, behavior.PathPattern ?? '')),
+        ...(config?.DefaultCacheBehavior ? [describe(config.DefaultCacheBehavior, 'Default (*)')] : []),
+    ]
+}
+
+function oneOf<T extends string>(value: unknown, allowed: readonly T[], field: string): T {
+    if (typeof value === 'string' && (allowed as readonly string[]).includes(value)) return value as T
+    throw new ValidationError(`${field} must be one of ${allowed.join(', ')}`)
+}
+
+function text(value: unknown): string {
+    return typeof value === 'string' ? value.trim() : ''
+}
+
+function stringList(value: unknown): string[] {
+    return Array.isArray(value) ? value.filter((entry): entry is string => typeof entry === 'string') : []
+}
+
+function errorName(error: unknown): string {
+    return (error as {name?: string} | null)?.name ?? ''
+}

packages/api/src/adapter-aws/AwsLogsAdapter.ts

@@ -135,7 +135,7 @@ export class AwsLogsAdapter implements CloudServiceAdapter {
                 limit: input.limit,
             }),
         )
-        if (!queryId) throw new NotFoundError(`Floci did not return a query id for ${logGroupName}.`)
+        if (!queryId) throw new NotFoundError(`The runtime did not return a query id for ${logGroupName}.`)
 
         const deadline = Date.now() + (this.queryPoll.timeoutMs ?? QUERY_POLL_TIMEOUT_MS)
         const pollInterval = this.queryPoll.intervalMs ?? QUERY_POLL_INTERVAL_MS

packages/api/src/adapter-aws/AwsSesAdapter.ts

@@ -62,7 +62,7 @@ export class AwsSesAdapter implements CloudServiceAdapter {
     }
 
     async delete(_id: string): Promise<void> {
-        throw new NotSupportedError('Deleting individual captured emails is not supported by Floci SES')
+        throw new NotSupportedError('Deleting individual captured emails is not supported by TheCloud SES')
     }
 
     async clearEmailInbox(): Promise<void> {
@@ -76,10 +76,10 @@ export class AwsSesAdapter implements CloudServiceAdapter {
         try {
             body = await response.json() as FlociSesInbox
         } catch (error) {
-            throw new RuntimeError('Floci SES inspection returned invalid JSON', {cause: error})
+            throw new RuntimeError('TheCloud SES inspection returned invalid JSON', {cause: error})
         }
         if (!Array.isArray(body.messages)) {
-            throw new RuntimeError('Floci SES inspection response did not contain messages')
+            throw new RuntimeError('TheCloud SES inspection response did not contain messages')
         }
         return body.messages
     }
@@ -89,14 +89,14 @@ export class AwsSesAdapter implements CloudServiceAdapter {
         try {
             response = await this.fetcher(`${this.endpoint.replace(/\/$/, '')}${path}`, init)
         } catch (error) {
-            throw new RuntimeUnavailableError(`Cannot reach Floci SES at ${this.endpoint}`, {cause: error})
+            throw new RuntimeUnavailableError(`Cannot reach TheCloud SES at ${this.endpoint}`, {cause: error})
         }
         if (response.ok) return response
 
         const detail = await response.text().catch(() => '')
         throw httpStatusToCloudError(
             response.status,
-            detail || `Floci SES inspection returned HTTP ${response.status}`,
+            detail || `TheCloud SES inspection returned HTTP ${response.status}`,
         )
     }
 }

packages/api/src/adapter-azure/AzureAksAdapter.ts

@@ -106,7 +106,7 @@ export class AzureAksAdapter implements CloudServiceAdapter {
 
         const body = await this.json<ArmList<{subscriptionId?: string}>>('/subscriptions')
         const id = body?.value?.[0]?.subscriptionId
-        if (!id) throw new RuntimeError('Floci-AZ returned no subscription to scope cluster requests to')
+        if (!id) throw new RuntimeError('The Azure runtime returned no subscription to scope cluster requests to')
 
         this.subscriptionId = id
         return id

packages/api/src/adapter-azure/AzureComputeAdapter.ts

@@ -182,7 +182,7 @@ export class AzureComputeAdapter implements CloudServiceAdapter {
 
         const body = await this.json<ArmList<{subscriptionId?: string}>>('/subscriptions')
         const id = body?.value?.[0]?.subscriptionId
-        if (!id) throw new RuntimeError('Floci-AZ returned no subscription to scope compute requests to')
+        if (!id) throw new RuntimeError('The Azure runtime returned no subscription to scope compute requests to')
 
         this.subscriptionId = id
         return id

packages/api/src/adapter-azure/AzureServerlessAdapter.ts

@@ -49,7 +49,7 @@ export class AzureServerlessAdapter implements CloudServiceAdapter {
     descriptorOverride(): CloudServiceDescriptorOverride {
         return {
             availability: 'coming_soon',
-            reason: 'The Floci-AZ runtime returns 501 NotImplemented for the Azure Functions endpoint.',
+            reason: 'TheCloud\'s Azure runtime returns 501 NotImplemented for the Azure Functions endpoint.',
         }
     }
 

packages/api/src/adapter-azure/CosmosNoSqlUnavailableError.ts

@@ -8,5 +8,5 @@ import {CloudError, type CloudErrorStatus} from '../cloud-spi/errors'
 export class CosmosNoSqlUnavailableError extends CloudError {
     readonly status: CloudErrorStatus = 502
     readonly code = 'cosmos_nosql_unavailable' as const
-    protected readonly label = 'Cosmos NoSQL endpoint is not available on the selected Floci-AZ runtime'
+    protected readonly label = 'Cosmos NoSQL endpoint is not available on the selected Azure runtime'
 }

packages/api/src/adapter-azure/MssqlDataClient.ts

@@ -57,7 +57,7 @@ function connectionConfig(connection: SqlDataConnection): MssqlConfig {
         options: {
             encrypt: connection.tlsMode !== 'disable',
             trustServerCertificate: connection.tlsMode !== 'verify',
-            appName: 'Floci UI',
+            appName: 'TheCloud',
         },
     }
 }

packages/api/src/adapter-azure/PostgresDataClient.ts

@@ -26,7 +26,7 @@ export class PostgresDataClient implements SqlDataClient {
             connectionTimeoutMillis: 10_000,
             query_timeout: 30_000,
             statement_timeout: 30_000,
-            application_name: 'Floci UI',
+            application_name: 'TheCloud',
         })
         const startedAt = performance.now()
         let phase: SqlDataPhase = 'connect'

packages/api/src/auth.ts

@@ -270,7 +270,7 @@ function loginPage(c: Context, config: AuthConfig): Response {
         ? `<form method="get" action="/api/auth/oidc/login"><input type="hidden" name="returnTo" value="${escapeHtml(returnTo)}"><button class="sso-button" type="submit"><span class="ready"><svg viewBox="0 0 24 24" aria-hidden="true"><path d="M12 2 4 5v6c0 5 3.4 9.5 8 11 4.6-1.5 8-6 8-11V5l-8-3Zm0 4 4 1.5V11c0 3.2-1.9 6.2-4 7.4C9.9 17.2 8 14.2 8 11V7.5L12 6Z"/></svg>Sign in with Authentik</span><span class="loading"><i></i>Redirecting...</span></button></form>`
         : `<form method="post" action="/api/auth/login"><input type="hidden" name="csrf" value="${csrf}"><input type="hidden" name="returnTo" value="${escapeHtml(returnTo)}"><label for="username">Username</label><input id="username" name="username" autocomplete="username" required autofocus><label for="password">Password</label><input id="password" name="password" type="password" autocomplete="current-password" required><button class="sso-button" type="submit">Sign in</button></form>`
     const error = loginErrorMessage(c.req.query('error'))
-    return c.html(`<!doctype html><html lang="en"><head><meta charset="utf-8"><meta name="viewport" content="width=device-width,initial-scale=1"><title>Welcome back | TheCloud</title><style>:root{color-scheme:dark;--bg:#0f141a;--surface:#161d26;--raised:#232b37;--border:#424650;--text:#c6c6cd;--bright:#f9f9fa;--muted:#a4a4ad;--accent:#42b4ff;--danger:#ff9b93}@media(prefers-color-scheme:light){:root{color-scheme:light;--bg:#efe7d2;--surface:#fffaf0;--raised:#ece4cf;--border:rgba(21,20,15,.16);--text:#2a2620;--bright:#15140f;--muted:#5a5448;--accent:#ed6f5c;--danger:#bd3f30}}*{box-sizing:border-box}body{margin:0;min-width:320px;min-height:100vh;display:grid;place-items:center;padding:28px 20px;color:var(--text);font:14px Sora,Inter,system-ui,sans-serif;background:radial-gradient(circle at 14% 12%,color-mix(in srgb,var(--accent) 16%,transparent),transparent 28rem),linear-gradient(135deg,var(--bg),var(--raised));}.shell{width:min(420px,100%);animation:enter .45s ease-out}.brand{display:flex;align-items:center;gap:12px;margin:0 0 20px 8px;color:var(--bright)}.brand svg{width:34px;height:34px;fill:none;stroke:var(--accent);stroke-width:1.6}.brand strong{display:block;font-size:16px;letter-spacing:-.02em}.brand small{display:block;margin-top:2px;color:var(--muted);font-size:11px}.card{padding:30px;border:1px solid var(--border);border-radius:14px;background:color-mix(in srgb,var(--surface) 94%,transparent);box-shadow:0 24px 64px #0005}.eyebrow{margin:0 0 8px;color:var(--accent);font-size:11px;font-weight:700;letter-spacing:.12em;text-transform:uppercase}h1{margin:0;color:var(--bright);font-size:26px;letter-spacing:-.04em}p{margin:9px 0 24px;color:var(--muted);line-height:1.55}.alert{display:flex;gap:9px;margin:0 0 18px;padding:11px 12px;border:1px solid color-mix(in srgb,var(--danger) 55%,var(--border));border-radius:8px;color:var(--danger);background:color-mix(in srgb,var(--danger) 10%,transparent);line-height:1.4}.sso-button{display:grid;place-items:center;width:100%;min-height:46px;border:0;border-radius:8px;background:var(--accent);color:#06131d;font:700 14px inherit;cursor:pointer;transition:transform .15s,filter .15s,box-shadow .15s}.sso-button:hover{filter:brightness(1.08);box-shadow:0 8px 20px color-mix(in srgb,var(--accent) 28%,transparent)}.sso-button:active{transform:translateY(1px)}.sso-button:focus-visible{outline:3px solid color-mix(in srgb,var(--accent) 58%,white);outline-offset:3px}.ready,.loading{display:flex;align-items:center;gap:9px}.ready svg{width:19px;height:19px;fill:currentColor;stroke:none}.loading{display:none}.sso-button:active .ready{display:none}.sso-button:active .loading{display:flex}.loading i{width:15px;height:15px;border:2px solid #06131d55;border-top-color:#06131d;border-radius:50%;animation:spin .7s linear infinite}.footer{margin:19px 0 0;text-align:center;font-size:12px;color:var(--muted)}label{display:block;margin:14px 0 6px}input{width:100%;padding:10px;border:1px solid var(--border);border-radius:7px;background:var(--bg);color:var(--bright)}@keyframes enter{from{opacity:0;transform:translateY(10px)}to{opacity:1;transform:none}}@keyframes spin{to{transform:rotate(360deg)}}@media(max-width:380px){body{padding:18px 14px}.card{padding:24px 20px}h1{font-size:23px}}@media(prefers-reduced-motion:reduce){*,*::before,*::after{animation:none!important;transition:none!important}}</style></head><body><main class="shell" aria-labelledby="welcome"><header class="brand"><svg viewBox="0 0 40 40" aria-hidden="true"><path d="M7 25c-3-7 3-13 10-11 4-8 16-5 16 4 5 1 6 8 1 10H12c-2 0-4-1-5-3Z"/><path d="M13 31h14"/></svg><span><strong>Floci DevTools</strong><small>Local AWS, on your own infrastructure.</small></span></header><section class="card" aria-label="Sign in"><div class="eyebrow">Secure console</div><h1 id="welcome">Welcome back</h1><p>Sign in with your account to access the console.</p>${error ? `<div class="alert" role="alert">${error}</div>` : ''}${content}<div class="footer">Protected by Authentik SSO</div></section></main></body></html>`)
+    return c.html(`<!doctype html><html lang="en"><head><meta charset="utf-8"><meta name="viewport" content="width=device-width,initial-scale=1"><title>Welcome back | TheCloud</title><style>:root{color-scheme:dark;--bg:#0f141a;--surface:#161d26;--raised:#232b37;--border:#424650;--text:#c6c6cd;--bright:#f9f9fa;--muted:#a4a4ad;--accent:#42b4ff;--danger:#ff9b93}@media(prefers-color-scheme:light){:root{color-scheme:light;--bg:#efe7d2;--surface:#fffaf0;--raised:#ece4cf;--border:rgba(21,20,15,.16);--text:#2a2620;--bright:#15140f;--muted:#5a5448;--accent:#ed6f5c;--danger:#bd3f30}}*{box-sizing:border-box}body{margin:0;min-width:320px;min-height:100vh;display:grid;place-items:center;padding:28px 20px;color:var(--text);font:14px Sora,Inter,system-ui,sans-serif;background:radial-gradient(circle at 14% 12%,color-mix(in srgb,var(--accent) 16%,transparent),transparent 28rem),linear-gradient(135deg,var(--bg),var(--raised));}.shell{width:min(420px,100%);animation:enter .45s ease-out}.brand{display:flex;align-items:center;gap:12px;margin:0 0 20px 8px;color:var(--bright)}.brand svg{width:34px;height:34px;fill:none;stroke:var(--accent);stroke-width:1.6}.brand strong{display:block;font-size:16px;letter-spacing:-.02em}.brand small{display:block;margin-top:2px;color:var(--muted);font-size:11px}.card{padding:30px;border:1px solid var(--border);border-radius:14px;background:color-mix(in srgb,var(--surface) 94%,transparent);box-shadow:0 24px 64px #0005}.eyebrow{margin:0 0 8px;color:var(--accent);font-size:11px;font-weight:700;letter-spacing:.12em;text-transform:uppercase}h1{margin:0;color:var(--bright);font-size:26px;letter-spacing:-.04em}p{margin:9px 0 24px;color:var(--muted);line-height:1.55}.alert{display:flex;gap:9px;margin:0 0 18px;padding:11px 12px;border:1px solid color-mix(in srgb,var(--danger) 55%,var(--border));border-radius:8px;color:var(--danger);background:color-mix(in srgb,var(--danger) 10%,transparent);line-height:1.4}.sso-button{display:grid;place-items:center;width:100%;min-height:46px;border:0;border-radius:8px;background:var(--accent);color:#06131d;font:700 14px inherit;cursor:pointer;transition:transform .15s,filter .15s,box-shadow .15s}.sso-button:hover{filter:brightness(1.08);box-shadow:0 8px 20px color-mix(in srgb,var(--accent) 28%,transparent)}.sso-button:active{transform:translateY(1px)}.sso-button:focus-visible{outline:3px solid color-mix(in srgb,var(--accent) 58%,white);outline-offset:3px}.ready,.loading{display:flex;align-items:center;gap:9px}.ready svg{width:19px;height:19px;fill:currentColor;stroke:none}.loading{display:none}.sso-button:active .ready{display:none}.sso-button:active .loading{display:flex}.loading i{width:15px;height:15px;border:2px solid #06131d55;border-top-color:#06131d;border-radius:50%;animation:spin .7s linear infinite}.footer{margin:19px 0 0;text-align:center;font-size:12px;color:var(--muted)}label{display:block;margin:14px 0 6px}input{width:100%;padding:10px;border:1px solid var(--border);border-radius:7px;background:var(--bg);color:var(--bright)}@keyframes enter{from{opacity:0;transform:translateY(10px)}to{opacity:1;transform:none}}@keyframes spin{to{transform:rotate(360deg)}}@media(max-width:380px){body{padding:18px 14px}.card{padding:24px 20px}h1{font-size:23px}}@media(prefers-reduced-motion:reduce){*,*::before,*::after{animation:none!important;transition:none!important}}</style></head><body><main class="shell" aria-labelledby="welcome"><header class="brand"><svg viewBox="0 0 40 40" aria-hidden="true"><path d="M7 25c-3-7 3-13 10-11 4-8 16-5 16 4 5 1 6 8 1 10H12c-2 0-4-1-5-3Z"/><path d="M13 31h14"/></svg><span><strong>TheCloud</strong><small>Local AWS, on your own infrastructure.</small></span></header><section class="card" aria-label="Sign in"><div class="eyebrow">Secure console</div><h1 id="welcome">Welcome back</h1><p>Sign in with your account to access the console.</p>${error ? `<div class="alert" role="alert">${error}</div>` : ''}${content}<div class="footer">Protected by Authentik SSO</div></section></main></body></html>`)
 }
 
 function loginFailure(c: Context, status: 401 | 403 | 429): Response {

packages/api/src/aws.ts

@@ -32,6 +32,7 @@ import { ElastiCacheClient } from "@aws-sdk/client-elasticache";
 import { LightsailClient } from "@aws-sdk/client-lightsail";
 import { CognitoIdentityProviderClient } from "@aws-sdk/client-cognito-identity-provider";
 import { Route53Client } from "@aws-sdk/client-route-53";
+import { CloudFrontClient } from "@aws-sdk/client-cloudfront";
 
 const endpoint = process.env.FLOCI_ENDPOINT;
 const region = process.env.AWS_REGION || "us-east-1";
@@ -95,6 +96,7 @@ export type AwsClients = {
   lightsail: LightsailClient;
   cognito: CognitoIdentityProviderClient;
   route53: Route53Client;
+  cloudfront: CloudFrontClient;
 };
 
 export type AwsClientName = keyof AwsClients;
@@ -142,6 +144,7 @@ function buildClients(accountId: string): AwsClients {
     lightsail: new LightsailClient(base),
     cognito: new CognitoIdentityProviderClient(base),
     route53: new Route53Client(base),
+    cloudfront: new CloudFrontClient(base),
   };
 }
 

packages/api/src/azure.test.ts

@@ -32,7 +32,7 @@ describe('AzureRestRuntimeClient', () => {
         const client = new AzureRestRuntimeClient('http://localhost:4577', 'devstoreaccount1')
 
         await expect(client.fetch('/container?restype=container', {method: 'PUT'})).rejects.toThrow(
-            'Cannot reach Floci-AZ at http://localhost:4577: connection refused',
+            "Cannot reach TheCloud's Azure runtime at http://localhost:4577: connection refused",
         )
     })
 })

packages/api/src/azure.ts

@@ -29,7 +29,7 @@ export class AzureRestRuntimeClient implements AzureRuntimeClient {
             })
         } catch (error) {
             throw new RuntimeUnavailableError(
-                `Cannot reach Floci-AZ at ${this.endpoint}: ${errorMessage(error)}`,
+                `Cannot reach TheCloud's Azure runtime at ${this.endpoint}: ${errorMessage(error)}`,
                 {cause: error},
             )
         }

packages/api/src/cloud-spi/cdnSchema.ts

@@ -0,0 +1,131 @@
+import type {CloudProvider, FieldSchema, ServiceSchema, TableColumnSchema} from './types'
+
+export const CDN_ORIGIN_TYPES = ['s3', 'custom'] as const
+export const CDN_VIEWER_PROTOCOLS = ['redirect-to-https', 'allow-all', 'https-only'] as const
+export const CDN_ORIGIN_PROTOCOLS = ['https-only', 'http-only', 'match-viewer'] as const
+export const CDN_ALLOWED_METHODS = ['read', 'all'] as const
+/** An S3 bucket name as S3 allows it for new buckets. */
+export const CDN_BUCKET_PATTERN = '^[a-z0-9][a-z0-9.-]{1,61}[a-z0-9]$'
+/** A host name, optionally with a port, as a custom origin's DomainName. */
+export const CDN_ORIGIN_DOMAIN_PATTERN = '^[A-Za-z0-9]([A-Za-z0-9-]{0,61}[A-Za-z0-9])?(\\.[A-Za-z0-9]([A-Za-z0-9-]{0,61}[A-Za-z0-9])?)*$'
+
+const distributionColumns: TableColumnSchema[] = [
+    {name: 'id', label: 'Distribution ID', format: 'code'},
+    {name: 'viewerUrl', label: 'Local URL', path: 'metadata.viewerUrl', format: 'code'},
+    {name: 'status', label: 'Status', format: 'badge'},
+    {name: 'enabled', label: 'Enabled', path: 'metadata.enabled', format: 'boolean'},
+    {name: 'origins', label: 'Origins', path: 'metadata.originDomains', format: 'list'},
+    {name: 'comment', label: 'Description', path: 'metadata.comment', emptyText: '—'},
+]
+
+const distributionFilters: FieldSchema[] = [{name: 'search', label: 'Search', type: 'text', required: false}]
+
+export function awsCdnSchema(): ServiceSchema {
+    return {
+        cloud: 'aws',
+        service: 'cdn',
+        displayName: 'Amazon CloudFront distributions',
+        fields: [
+            {
+                name: 'originType',
+                label: 'Origin',
+                type: 'select',
+                required: true,
+                defaultValue: 's3',
+                options: [{label: 'S3 bucket', value: 's3'}, {label: 'Custom origin (a web server or API)', value: 'custom'}],
+            },
+            {
+                name: 'bucket',
+                label: 'S3 bucket',
+                type: 'text',
+                required: false,
+                requiredWhen: {field: 'originType', equals: 's3'},
+                visibleWhen: {field: 'originType', values: ['s3']},
+                validation: {pattern: CDN_BUCKET_PATTERN, message: 'Use the name of an existing bucket'},
+            },
+            {
+                name: 'originDomain',
+                label: 'Origin domain',
+                type: 'text',
+                required: false,
+                requiredWhen: {field: 'originType', equals: 'custom'},
+                visibleWhen: {field: 'originType', values: ['custom']},
+                description: 'For example api.example.com. A local server needs FLOCI_SERVICES_CLOUDFRONT_ALLOWED_PRIVATE_ORIGIN_HOSTS on the runtime.',
+                validation: {pattern: CDN_ORIGIN_DOMAIN_PATTERN, message: 'Use a host name such as api.example.com'},
+            },
+            {
+                name: 'originProtocol',
+                label: 'Origin protocol',
+                type: 'select',
+                required: false,
+                defaultValue: 'https-only',
+                visibleWhen: {field: 'originType', values: ['custom']},
+                options: [
+                    {label: 'HTTPS only', value: 'https-only'},
+                    {label: 'HTTP only', value: 'http-only'},
+                    {label: 'Match the viewer', value: 'match-viewer'},
+                ],
+            },
+            {
+                name: 'originPort',
+                label: 'Origin port',
+                type: 'text',
+                required: false,
+                visibleWhen: {field: 'originType', values: ['custom']},
+                description: 'Leave empty for 443 (HTTPS) and 80 (HTTP).',
+                validation: {pattern: '^\\d{1,5}$', message: 'Use a port number'},
+            },
+            {
+                name: 'defaultRootObject',
+                label: 'Default root object',
+                type: 'text',
+                required: false,
+                defaultValue: 'index.html',
+                description: 'What the distribution serves for a request to /.',
+            },
+            {
+                name: 'viewerProtocol',
+                label: 'Viewer protocol',
+                type: 'select',
+                required: false,
+                defaultValue: 'allow-all',
+                options: [
+                    {label: 'HTTP and HTTPS', value: 'allow-all'},
+                    {label: 'Redirect HTTP to HTTPS', value: 'redirect-to-https'},
+                    {label: 'HTTPS only', value: 'https-only'},
+                ],
+            },
+            {
+                name: 'allowedMethods',
+                label: 'Allowed methods',
+                type: 'select',
+                required: false,
+                defaultValue: 'read',
+                options: [
+                    {label: 'GET and HEAD (a website or files)', value: 'read'},
+                    {label: 'All methods (an API)', value: 'all'},
+                ],
+            },
+            {name: 'comment', label: 'Description', type: 'text', required: false},
+        ],
+        actions: ['list', 'create', 'delete', 'inspect'],
+        capabilities: {
+            resourceActions: [
+                {name: 'list', label: 'List distributions', enabled: true, status: 'available', runtimeRequired: true},
+                {name: 'create', label: 'Create distribution', enabled: true, status: 'available', runtimeRequired: true},
+                {name: 'delete', label: 'Disable and delete distribution', enabled: true, status: 'available', runtimeRequired: true},
+                {name: 'inspect', label: 'Inspect distribution', enabled: true, status: 'available', runtimeRequired: true},
+            ],
+            distributionActions: [
+                {name: 'setEnabled', label: 'Enable or disable a distribution', enabled: true, status: 'available', runtimeRequired: true},
+                {name: 'createInvalidation', label: 'Invalidate cached paths', enabled: true, status: 'available', runtimeRequired: true},
+            ],
+        },
+        filters: distributionFilters,
+        columns: distributionColumns,
+    }
+}
+
+export function cdnSchemaFor(cloud: CloudProvider): ServiceSchema | null {
+    return cloud === 'aws' ? awsCdnSchema() : null
+}

packages/api/src/cloud-spi/codebuildSchema.ts

@@ -36,7 +36,7 @@ export function awsCodeBuildSchema(): ServiceSchema {
             {
                 name: 'buildspec', label: 'Buildspec', type: 'textarea', required: false, group: 'Source', span: true,
                 defaultValueWhen: {field: 'sourceType', values: {NO_SOURCE: DEFAULT_DOCKER_TO_ECR_BUILDSPEC, S3: ''}},
-                description: 'For no source, this is a Floci Node 20 Docker-to-ECR buildspec. For S3, leave blank to use buildspec.yml from the source, or provide an override. Include taskdef.json and appspec.yaml in the source for CodeDeployToECS.',
+                description: 'For no source, this is TheCloud\'s Node 20 Docker-to-ECR buildspec. For S3, leave blank to use buildspec.yml from the source, or provide an override. Include taskdef.json and appspec.yaml in the source for CodeDeployToECS.',
             },
             {
                 name: 'artifactsType', label: 'Artifact type', type: 'select', required: true, group: 'Artifacts', defaultValue: 'NO_ARTIFACTS',

packages/api/src/cloud-spi/databaseSchema.ts

@@ -131,7 +131,7 @@ export function awsDatabaseSchema(): ServiceSchema {
                     label: 'Create DB snapshot',
                     enabled: true,
                     status: 'partial',
-                    reason: 'The Cloud Proxy operation is available, but the current Floci runtime does not implement CreateDBSnapshot.',
+                    reason: 'The Cloud Proxy operation is available, but the current runtime does not implement CreateDBSnapshot.',
                     runtimeRequired: true,
                 },
             ],

packages/api/src/cloud-spi/serviceCatalog.ts

@@ -239,6 +239,13 @@ export const SERVICE_CATALOG = {
         // AWS retains its dedicated page while Azure and GCP use Cloud Explorer.
         routeByCloud: {aws: '/secretsmanager'},
     },
+    cdn: {
+        displayName: 'CDN',
+        displayNameByCloud: {aws: 'CloudFront'},
+        iconKey: 'cdn',
+        group: 'Networking',
+        order: 50,
+    },
     dns: {
         displayName: 'DNS',
         displayNameByCloud: {aws: 'Route 53'},

packages/api/src/cloud-spi/types.ts

@@ -180,6 +180,7 @@ export type UserPoolActionName =
     | 'testSignIn'
     | 'describeClient'
     | 'updateClientOAuth'
+export type DistributionActionName = 'setEnabled' | 'createInvalidation'
 export type CapabilityStatus = 'available' | 'blocked' | 'partial' | 'coming_soon'
 
 export interface CapabilitySchema<TAction extends string> {
@@ -224,6 +225,7 @@ export interface ServiceSchema {
         databaseActions?: CapabilitySchema<DatabaseActionName>[]
         kubernetesActions?: CapabilitySchema<KubernetesActionName>[]
         userPoolActions?: CapabilitySchema<UserPoolActionName>[]
+        distributionActions?: CapabilitySchema<DistributionActionName>[]
         // Child levels advertise separately from the resource level because a
         // store can be readable at the leaf and writable at the collection —
         // CloudWatch Logs creates streams but cannot delete an event.
@@ -455,6 +457,13 @@ export interface UserPoolSignInTestInput {
 }
 
 /** Decoded claims only: the console shows what a sign-in yields without handing out tokens. */
+export interface DistributionInvalidation {
+    id: string
+    status: string
+    createdAt: string | null
+    paths: string[]
+}
+
 export type UserPoolOAuthFlow = 'code' | 'implicit' | 'client_credentials'
 
 /** The app client settings that decide how the hosted login and OAuth endpoints treat it. */
@@ -996,6 +1005,8 @@ export interface CloudServiceAdapter {
     deleteUserPoolGroup?(poolId: string, groupName: string): Promise<void>
     testUserPoolSignIn?(poolId: string, input: UserPoolSignInTestInput): Promise<UserPoolSignInTestResult>
     describeUserPoolClient?(poolId: string, clientId: string): Promise<UserPoolClientSettings>
+    setDistributionEnabled?(distributionId: string, enabled: boolean): Promise<CloudResource>
+    createDistributionInvalidation?(distributionId: string, paths: string[]): Promise<DistributionInvalidation>
     updateUserPoolClientOAuth?(poolId: string, clientId: string, input: UpdateUserPoolClientOAuthInput): Promise<UserPoolClientSettings>
     /** Clears the provider's locally captured email inbox, if it exposes one. */
     clearEmailInbox?(): Promise<void>

packages/api/src/cloudProxy.test.ts

@@ -2,7 +2,7 @@ import {describe, expect, test} from 'bun:test'
 import {createCloudAdapterRegistry} from './cloudProxy'
 import {checkChildCapabilities} from './cloud-spi/childCapabilities'
 import {isServiceType} from './cloud-spi/serviceCatalog'
-import type {CloudProvider, CloudServiceAdapter, CloudServiceType, DatabaseActionName, KubernetesActionName, ResourceActionName, UserPoolActionName} from './cloud-spi/types'
+import type {CloudProvider, CloudServiceAdapter, CloudServiceType, DatabaseActionName, DistributionActionName, KubernetesActionName, ResourceActionName, UserPoolActionName} from './cloud-spi/types'
 
 /**
  * Guards the schema-to-implementation contract for every registered adapter.
@@ -47,6 +47,11 @@ const METHOD_FOR_KUBERNETES_ACTION: Record<KubernetesActionName, keyof CloudServ
     deleteFargateProfile: 'deleteKubernetesFargateProfile',
 }
 
+const METHOD_FOR_DISTRIBUTION_ACTION: Record<DistributionActionName, keyof CloudServiceAdapter> = {
+    setEnabled: 'setDistributionEnabled',
+    createInvalidation: 'createDistributionInvalidation',
+}
+
 const METHOD_FOR_USER_POOL_ACTION: Record<UserPoolActionName, keyof CloudServiceAdapter> = {
     updateUser: 'updateUserPoolUser',
     setUserGroups: 'setUserPoolUserGroups',
@@ -141,6 +146,15 @@ describe('registered adapters honour their schema', () => {
                     `${label} advertises ${capability.name} as available but has no ${String(method)}()`,
                 ).toBe('function')
             }
+
+            const distributionClaims = (adapter.schema().capabilities?.distributionActions ?? []).filter((capability) => capability.status === 'available')
+            for (const capability of distributionClaims) {
+                const method = METHOD_FOR_DISTRIBUTION_ACTION[capability.name]
+                expect(
+                    typeof adapter[method],
+                    `${label} advertises ${capability.name} as available but has no ${String(method)}()`,
+                ).toBe('function')
+            }
         })
 
         test(`${label} child collections match their advertised capabilities`, () => {
@@ -154,6 +168,7 @@ describe('registered adapters honour their schema', () => {
                 ...(adapter.schema().capabilities?.databaseActions ?? []),
                 ...(adapter.schema().capabilities?.kubernetesActions ?? []),
                 ...(adapter.schema().capabilities?.userPoolActions ?? []),
+                ...(adapter.schema().capabilities?.distributionActions ?? []),
                 ...(adapter.schema().capabilities?.collectionActions ?? []),
                 ...(adapter.schema().capabilities?.itemActions ?? []),
             ]
@@ -218,7 +233,7 @@ describe('adapter capability advertisements match the runtime reality', () => {
                 label: 'Create DB snapshot',
                 enabled: true,
                 status: 'partial',
-                reason: 'The Cloud Proxy operation is available, but the current Floci runtime does not implement CreateDBSnapshot.',
+                reason: 'The Cloud Proxy operation is available, but the current runtime does not implement CreateDBSnapshot.',
                 runtimeRequired: true,
             },
         ])

packages/api/src/cloudProxy.ts

@@ -49,6 +49,7 @@ import {AwsElastiCacheAdapter} from './adapter-aws/AwsElastiCacheAdapter'
 import {AwsLightsailAdapter} from './adapter-aws/AwsLightsailAdapter'
 import {AwsUserPoolsAdapter} from './adapter-aws/AwsUserPoolsAdapter'
 import {AwsDnsAdapter} from './adapter-aws/AwsDnsAdapter'
+import {AwsCdnAdapter} from './adapter-aws/AwsCdnAdapter'
 import {awsClientsForAccount, resolveAccountId} from './aws'
 import {createEc2Service} from './services/ec2'
 import {createEksService} from './services/eks'
@@ -100,6 +101,7 @@ export function createCloudAdapterRegistry(accountId?: string | null): CloudAdap
         new AwsLightsailAdapter(clients.lightsail),
         new AwsUserPoolsAdapter(clients.cognito),
         new AwsDnsAdapter(clients.route53),
+        new AwsCdnAdapter(clients.cloudfront, clients.s3),
         new AzureStorageAdapter(),
         new AzureServiceBusAdapter(),
         new AzureDatabaseAdapter(),

packages/api/src/gcp.test.ts

@@ -122,6 +122,6 @@ describe('GcpRestRuntimeClient.health', () => {
         stubFetch(() => {
             throw Object.assign(new Error('connect ECONNREFUSED'), {code: 'ECONNREFUSED'})
         })
-        await expect(client().health()).rejects.toThrow(`Cannot reach Floci-GCP at ${ENDPOINT}`)
+        await expect(client().health()).rejects.toThrow(`Cannot reach TheCloud's GCP runtime at ${ENDPOINT}`)
     })
 })

packages/api/src/gcp.ts

@@ -40,7 +40,7 @@ export class GcpRestRuntimeClient implements GcpRuntimeClient {
             res = await globalThis.fetch(`${this.endpoint}${path}`, init)
         } catch (error) {
             throw new RuntimeUnavailableError(
-                `Cannot reach Floci-GCP at ${this.endpoint}: ${errorMessage(error)}`,
+                `Cannot reach TheCloud's GCP runtime at ${this.endpoint}: ${errorMessage(error)}`,
                 {cause: error},
             )
         }
@@ -76,12 +76,12 @@ export class GcpRestRuntimeClient implements GcpRuntimeClient {
             res = await globalThis.fetch(url, {method: 'GET'})
         } catch (error) {
             throw new RuntimeUnavailableError(
-                `Cannot reach Floci-GCP at ${this.endpoint}: ${errorMessage(error)}`,
+                `Cannot reach TheCloud's GCP runtime at ${this.endpoint}: ${errorMessage(error)}`,
                 {cause: error},
             )
         }
         if (res.status >= 500) {
-            throw new RuntimeUnavailableError(`Floci-GCP at ${this.endpoint} returned HTTP ${res.status}`)
+            throw new RuntimeUnavailableError(`TheCloud's GCP runtime at ${this.endpoint} returned HTTP ${res.status}`)
         }
     }
 }

packages/api/src/routes/clouds.test.ts

@@ -17,6 +17,7 @@ import {awsKmsSchema} from '../cloud-spi/kmsSchema'
 import {awsStorageSchema, azureStorageSchema, gcpStorageSchema} from '../cloud-spi/storageSchema'
 import {awsSesEmailSchema} from '../cloud-spi/emailSchema'
 import {awsUserPoolsSchema} from '../cloud-spi/userPoolsSchema'
+import {awsCdnSchema} from '../cloud-spi/cdnSchema'
 import {awsAppConfigSchema} from '../cloud-spi/appConfigSchema'
 import {awsEventBridgeSchema} from '../cloud-spi/eventbridgeSchema'
 import {awsNotificationsSchema} from '../cloud-spi/notificationsSchema'
@@ -769,6 +770,31 @@ describe('cloud schema routes', () => {
         expect(calls).toEqual([['us-east-1_x', 'c1', input]])
     })
 
+    test('enables a distribution and invalidates its paths through the CloudFront adapter', async () => {
+        const calls: unknown[] = []
+        const app = appWithRoutes([mockAdapter('aws', {
+            service: 'cdn',
+            schema: awsCdnSchema,
+            setDistributionEnabled: async (id, enabled) => {
+                calls.push(['enabled', id, enabled])
+                return {id, name: 'd.cloudfront.net', cloud: 'aws', service: 'cdn', type: 'distribution', region: null, createdAt: null, metadata: {enabled}}
+            },
+            createDistributionInvalidation: async (id, paths) => {
+                calls.push(['invalidate', id, paths])
+                return {id: 'I1', status: 'Completed', createdAt: null, paths}
+            },
+        })])
+        const json = (method: string, body: unknown) => ({method, headers: {'content-type': 'application/json'}, body: JSON.stringify(body)})
+        const base = '/api/clouds/aws/services/cdn/resources/E123'
+
+        const enabled = await app.request(`${base}/enabled`, json('PUT', {enabled: false}))
+        expect(enabled.status).toBe(200)
+        expect((await enabled.json()).metadata.enabled).toBe(false)
+        const invalidated = await app.request(`${base}/invalidations`, json('POST', {paths: ['/*']}))
+        expect(invalidated.status).toBe(201)
+        expect(calls).toEqual([['enabled', 'E123', false], ['invalidate', 'E123', ['/*']]])
+    })
+
     test('clears the SES mailbox through the email adapter', async () => {
         let cleared = false
         const app = appWithRoutes([mockAdapter('aws', {

packages/api/src/routes/clouds.ts

@@ -461,6 +461,26 @@ export function createCloudRoutes(injectedService?: CloudProxyService) {
         return withRuntime(c, async () => c.json(await svc(c).updateUserPoolClientOAuth(cloud, c.req.param('id'), c.req.param('clientId'), await c.req.json())))
     })
 
+    app.put('/:cloud/services/cdn/resources/:id/enabled', async (c) => {
+        const cloud = c.req.param('cloud') as CloudProvider
+        if (!isCloudProvider(cloud)) return c.json({error: 'Unknown cloud'}, 404)
+
+        return withRuntime(c, async () => {
+            const body = await c.req.json<{enabled?: boolean}>()
+            return c.json(await svc(c).setDistributionEnabled(cloud, c.req.param('id'), body.enabled as boolean))
+        })
+    })
+
+    app.post('/:cloud/services/cdn/resources/:id/invalidations', async (c) => {
+        const cloud = c.req.param('cloud') as CloudProvider
+        if (!isCloudProvider(cloud)) return c.json({error: 'Unknown cloud'}, 404)
+
+        return withRuntime(c, async () => {
+            const body = await c.req.json<{paths?: string[]}>()
+            return c.json(await svc(c).createDistributionInvalidation(cloud, c.req.param('id'), body.paths as string[]), 201)
+        })
+    })
+
     app.get('/:cloud/services/k8s/resources/:id/nodegroups', async (c) => {
         const cloud = c.req.param('cloud') as CloudProvider
         if (!isCloudProvider(cloud)) return c.json({error: 'Unknown cloud'}, 404)

packages/api/src/service/CloudProxyService.ts

@@ -82,6 +82,7 @@ import type {
     UserPoolSignInTestInput,
     UserPoolSignInTestResult,
     UserPoolClientSettings,
+    DistributionInvalidation,
     UpdateUserPoolClientOAuthInput,
     UserPoolUserAction,
 } from '../cloud-spi/types'
@@ -833,6 +834,18 @@ export class CloudProxyService {
         return adapter.testUserPoolSignIn(poolId, input)
     }
 
+    async setDistributionEnabled(cloud: CloudProvider, distributionId: string, enabled: boolean): Promise<CloudResource> {
+        const adapter = this.requireAdapter(cloud, 'cdn')
+        if (!adapter.setDistributionEnabled) throw new NotSupportedError(`Enabling distributions is not supported for ${cloud}/cdn`)
+        return adapter.setDistributionEnabled(distributionId, enabled)
+    }
+
+    async createDistributionInvalidation(cloud: CloudProvider, distributionId: string, paths: string[]): Promise<DistributionInvalidation> {
+        const adapter = this.requireAdapter(cloud, 'cdn')
+        if (!adapter.createDistributionInvalidation) throw new NotSupportedError(`Invalidations are not supported for ${cloud}/cdn`)
+        return adapter.createDistributionInvalidation(distributionId, paths)
+    }
+
     async describeUserPoolClient(cloud: CloudProvider, poolId: string, clientId: string): Promise<UserPoolClientSettings> {
         const adapter = this.requireAdapter(cloud, 'userpools')
         if (!adapter.describeUserPoolClient) throw new NotSupportedError(`App client settings are not supported for ${cloud}/userpools`)

packages/api/src/service/runtimeProbe.ts

@@ -16,7 +16,7 @@ export type RuntimeProbe = () => Promise<void>
 export const runtimeProbes: Record<CloudProvider, RuntimeProbe> = {
     // Every runtime exposes a health endpoint, but under its own path: core and
     // Floci-AZ use /_floci/health, Floci-GCP uses /_floci-gcp/health.
-    aws: () => probeHttp(`${awsEndpoint()}/_floci/health`, 'Floci core'),
+    aws: () => probeHttp(`${awsEndpoint()}/_floci/health`, 'TheCloud AWS runtime'),
     azure: async () => {
         await azure.fetch('/_floci/health', {method: 'GET'})
     },

packages/api/src/services/lightsailDeployment.ts

@@ -5,7 +5,7 @@ export type LightsailNodeDeployment = {status: 'deployed'; files: number; port:
 
 export async function deployLightsailStaticFiles(instanceName: string, form: FormData): Promise<LightsailStaticDeployment> {
     const endpoint = process.env.FLOCI_ENDPOINT
-    if (!endpoint) throw new RuntimeUnavailableError('Floci diagnostics are unavailable')
+    if (!endpoint) throw new RuntimeUnavailableError('TheCloud diagnostics are unavailable')
 
     let response: Response
     try {
@@ -13,19 +13,19 @@ export async function deployLightsailStaticFiles(instanceName: string, form: For
             method: 'POST', body: form, redirect: 'error', signal: AbortSignal.timeout(30_000),
         })
     } catch (error) {
-        throw new RuntimeUnavailableError('Floci diagnostics are unavailable', {cause: error})
+        throw new RuntimeUnavailableError('TheCloud diagnostics are unavailable', {cause: error})
     }
     const body = await response.json().catch(() => ({})) as {message?: unknown; files?: unknown; status?: unknown}
     if (!response.ok) throw httpStatusToCloudError(response.status, typeof body.message === 'string' ? body.message : 'Static file deployment failed')
     if (body.status !== 'deployed' || typeof body.files !== 'number') {
-        throw new RuntimeUnavailableError('Floci diagnostics returned an invalid deployment response')
+        throw new RuntimeUnavailableError('TheCloud diagnostics returned an invalid deployment response')
     }
     return {status: 'deployed', files: body.files}
 }
 
 export async function deployLightsailNodeApplication(instanceName: string, form: FormData): Promise<LightsailNodeDeployment> {
     const endpoint = process.env.FLOCI_ENDPOINT
-    if (!endpoint) throw new RuntimeUnavailableError('Floci diagnostics are unavailable')
+    if (!endpoint) throw new RuntimeUnavailableError('TheCloud diagnostics are unavailable')
 
     let response: Response
     try {
@@ -33,12 +33,12 @@ export async function deployLightsailNodeApplication(instanceName: string, form:
             method: 'POST', body: form, redirect: 'error', signal: AbortSignal.timeout(360_000),
         })
     } catch (error) {
-        throw new RuntimeUnavailableError('Floci diagnostics are unavailable', {cause: error})
+        throw new RuntimeUnavailableError('TheCloud diagnostics are unavailable', {cause: error})
     }
     const body = await response.json().catch(() => ({})) as {message?: unknown; files?: unknown; status?: unknown; port?: unknown; releaseId?: unknown}
     if (!response.ok) throw httpStatusToCloudError(response.status, typeof body.message === 'string' ? body.message : 'Node.js deployment failed')
     if (body.status !== 'deployed' || typeof body.files !== 'number' || typeof body.port !== 'number' || typeof body.releaseId !== 'string') {
-        throw new RuntimeUnavailableError('Floci diagnostics returned an invalid Node.js deployment response')
+        throw new RuntimeUnavailableError('TheCloud diagnostics returned an invalid Node.js deployment response')
     }
     return {status: 'deployed', files: body.files, port: body.port, releaseId: body.releaseId}
 }

packages/api/src/services/sshCheck.ts

@@ -59,23 +59,23 @@ type SshCheckDependencies = {
 async function fetchDiagnostics(): Promise<DiagnosticResponse> {
     const endpoint = process.env.FLOCI_ENDPOINT
     if (!endpoint) {
-        throw new SshCheckError('DIAGNOSTICS_UNAVAILABLE', 'Floci diagnostics are unavailable', 503)
+        throw new SshCheckError('DIAGNOSTICS_UNAVAILABLE', 'TheCloud diagnostics are unavailable', 503)
     }
 
     let response: Response
     try {
         response = await fetch(`${endpoint}/_floci/diagnose`, {signal: AbortSignal.timeout(DEFAULT_TIMEOUT_MS)})
     } catch {
-        throw new SshCheckError('DIAGNOSTICS_UNAVAILABLE', 'Floci diagnostics are unavailable', 503)
+        throw new SshCheckError('DIAGNOSTICS_UNAVAILABLE', 'TheCloud diagnostics are unavailable', 503)
     }
     if (!response.ok) {
-        throw new SshCheckError('DIAGNOSTICS_UNAVAILABLE', 'Floci diagnostics are unavailable', 503)
+        throw new SshCheckError('DIAGNOSTICS_UNAVAILABLE', 'TheCloud diagnostics are unavailable', 503)
     }
 
     try {
         return await response.json() as DiagnosticResponse
     } catch {
-        throw new SshCheckError('DIAGNOSTICS_UNAVAILABLE', 'Floci diagnostics returned an invalid response', 502)
+        throw new SshCheckError('DIAGNOSTICS_UNAVAILABLE', 'TheCloud diagnostics returned an invalid response', 502)
     }
 }
 
@@ -149,12 +149,12 @@ export function createSshCheckService(dependencies: SshCheckDependencies = {}) {
                 diagnostics = await diagnosticFetcher()
             } catch (error) {
                 if (error instanceof SshCheckError) throw error
-                throw new SshCheckError('DIAGNOSTICS_UNAVAILABLE', 'Floci diagnostics are unavailable', 503)
+                throw new SshCheckError('DIAGNOSTICS_UNAVAILABLE', 'TheCloud diagnostics are unavailable', 503)
             }
 
             if (!diagnostics || typeof diagnostics !== 'object'
                 || !Array.isArray(diagnostics.ec2?.instances)) {
-                throw new SshCheckError('DIAGNOSTICS_UNAVAILABLE', 'Floci diagnostics returned an invalid response', 502)
+                throw new SshCheckError('DIAGNOSTICS_UNAVAILABLE', 'TheCloud diagnostics returned an invalid response', 502)
             }
             const instance = diagnostics.ec2.instances.find((candidate) => candidate.instanceId === instanceId)
             if (!instance) {

packages/frontend/src/api/api.ts

@@ -130,6 +130,10 @@ export const apiEndpointKeys = {
       messages: {send: "clouds.services.messaging.messages.send", receive: "clouds.services.messaging.messages.receive", delete: "clouds.services.messaging.messages.delete", purge: "clouds.services.messaging.messages.purge"},
       moveTasks: "clouds.services.messaging.move-tasks",
     },
+    cdn: {
+      enabled: "clouds.services.cdn.enabled",
+      invalidations: "clouds.services.cdn.invalidations",
+    },
     userpools: {
       userAction: "clouds.services.userpools.users.action",
       userGroups: "clouds.services.userpools.users.groups",
@@ -886,6 +890,20 @@ export const endpointRegistry: EndpointRegistry = new Map([
       method: "POST",
     },
   ],
+  [
+    apiEndpointKeys.clouds.cdn.enabled,
+    {
+      path: "/clouds/:cloud/services/cdn/resources/:id/enabled",
+      method: "PUT",
+    },
+  ],
+  [
+    apiEndpointKeys.clouds.cdn.invalidations,
+    {
+      path: "/clouds/:cloud/services/cdn/resources/:id/invalidations",
+      method: "POST",
+    },
+  ],
   [
     apiEndpointKeys.clouds.userpools.client.get,
     {

packages/frontend/src/api/cloudProxyClient.ts

@@ -32,6 +32,7 @@ import type {
   UserPoolSignInTestInput,
   UserPoolSignInTestResult,
   UserPoolClientSettings,
+  DistributionInvalidation,
   UpdateUserPoolClientOAuthInput,
   UserPoolUserAction,
   LogsInsightsQueryInput,
@@ -1476,6 +1477,32 @@ export async function testUserPoolSignIn(
   return res.data;
 }
 
+export async function setDistributionEnabled(
+  cloud: CloudProvider,
+  distributionId: string,
+  enabled: boolean,
+): Promise<CloudResource> {
+  const res = await apiClient.call<CloudResource, { enabled: boolean }>(
+    apiEndpointKeys.clouds.cdn.enabled,
+    requestOptions(cloud, "cdn", { body: { enabled } }),
+    { cloud, id: distributionId },
+  );
+  return res.data;
+}
+
+export async function createDistributionInvalidation(
+  cloud: CloudProvider,
+  distributionId: string,
+  paths: string[],
+): Promise<DistributionInvalidation> {
+  const res = await apiClient.call<DistributionInvalidation, { paths: string[] }>(
+    apiEndpointKeys.clouds.cdn.invalidations,
+    requestOptions(cloud, "cdn", { body: { paths } }),
+    { cloud, id: distributionId },
+  );
+  return res.data;
+}
+
 export async function describeUserPoolClient(
   cloud: CloudProvider,
   poolId: string,

packages/frontend/src/components/AzureSqlPanel.tsx

@@ -234,7 +234,7 @@ export function AzureSqlPanel({
         )}
         <small className="sql-credential-note">
           {isAwsRds
-            ? "Queries use Floci's local RDS Data API credentials. Database passwords are not sent by the console."
+            ? "Queries use TheCloud's local RDS Data API credentials. Database passwords are not sent by the console."
             : "Credentials remain in this page only and are sent to the local API per request."}
         </small>
         {connectionError && <div className="form-error">{connectionError}</div>}
@@ -243,7 +243,7 @@ export function AzureSqlPanel({
       {!connected ? (
         <div className="empty compact sql-connect-empty">
           <h3>Connect to browse SQL data</h3>
-          <p>{isAwsRds ? "Connect through Floci's local RDS Data API to browse databases and run SQL." : "Use the administrator login configured for this local engine."}</p>
+          <p>{isAwsRds ? "Connect through TheCloud's local RDS Data API to browse databases and run SQL." : "Use the administrator login configured for this local engine."}</p>
         </div>
       ) : (
         <div className="sql-explorer">

packages/frontend/src/components/CloudFrontPanel.test.tsx

@@ -0,0 +1,71 @@
+import {QueryClient, QueryClientProvider} from '@tanstack/react-query'
+import {render, screen, within} from '@testing-library/react'
+import userEvent from '@testing-library/user-event'
+import {beforeEach, expect, test, vi} from 'vitest'
+import {CloudFrontPanel} from './CloudFrontPanel'
+import type {CloudResource} from '@/types/resource'
+
+const api = vi.hoisted(() => ({
+    getCloudResource: vi.fn(),
+    setDistributionEnabled: vi.fn(),
+    createDistributionInvalidation: vi.fn(),
+}))
+
+vi.mock('@/api/cloudProxyClient', () => api)
+vi.mock('@/lib/accountStore', () => ({useAccountId: () => '000000000000'}))
+
+const VIEWER_URL = 'http://e7cpm0p0g0vc8d.cloudfront.localhost:4566/'
+const distribution: CloudResource = {
+    id: 'E7CPM0P0G0VC8D', name: 'e7cpm0p0g0vc8d.cloudfront.net', cloud: 'aws', service: 'cdn', type: 'distribution',
+    region: null, createdAt: null, status: 'Deployed',
+    metadata: {
+        viewerUrl: VIEWER_URL, domainName: 'e7cpm0p0g0vc8d.cloudfront.net', enabled: true, defaultRootObject: 'index.html',
+        origins: [{id: 's3-site', domainName: 'site.s3.amazonaws.com', kind: 's3', protocol: null}],
+        behaviors: [{pathPattern: 'Default (*)', originId: 's3-site', viewerProtocol: 'redirect-to-https', methods: ['GET', 'HEAD']}],
+        invalidations: [{id: 'I1', status: 'Completed', createdAt: null, paths: []}],
+    },
+}
+
+function renderPanel() {
+    const client = new QueryClient({defaultOptions: {queries: {retry: false}}})
+    return render(<QueryClientProvider client={client}><CloudFrontPanel resource={distribution} runtimeReachable/></QueryClientProvider>)
+}
+
+beforeEach(() => {
+    vi.clearAllMocks()
+    api.getCloudResource.mockResolvedValue(distribution)
+    api.setDistributionEnabled.mockImplementation(async (_cloud, _id, enabled) => ({...distribution, metadata: {...distribution.metadata, enabled}}))
+    api.createDistributionInvalidation.mockImplementation(async (_cloud, _id, paths) => ({id: 'I2', status: 'Completed', createdAt: null, paths}))
+})
+
+test('opens the distribution locally and shows its origins and behaviours', async () => {
+    renderPanel()
+
+    expect(await screen.findByRole('link', {name: /Open/})).toHaveAttribute('href', VIEWER_URL)
+    expect(screen.getByText('site.s3.amazonaws.com')).toBeInTheDocument()
+    expect(screen.getByText('Redirect to HTTPS')).toBeInTheDocument()
+    expect(screen.getByText('I1')).toBeInTheDocument()
+})
+
+test('disables the distribution', async () => {
+    const user = userEvent.setup()
+    renderPanel()
+
+    await user.click(await screen.findByRole('button', {name: 'Disable'}))
+    expect(api.setDistributionEnabled).toHaveBeenCalledWith('aws', distribution.id, false)
+    expect(await screen.findByText(/Distribution disabled/)).toBeInTheDocument()
+})
+
+test('invalidates the paths entered, one per line', async () => {
+    const user = userEvent.setup()
+    renderPanel()
+
+    const form = await screen.findByRole('form', {name: 'Create invalidation'})
+    const field = within(form).getByLabelText(/Paths/)
+    await user.clear(field)
+    await user.type(field, '/index.html{enter}/assets/*')
+    await user.click(within(form).getByRole('button', {name: 'Create invalidation'}))
+
+    expect(api.createDistributionInvalidation).toHaveBeenCalledWith('aws', distribution.id, ['/index.html', '/assets/*'])
+    expect(await screen.findByText(/Invalidation I2 completed for \/index.html, \/assets\/\*/)).toBeInTheDocument()
+})

packages/frontend/src/components/CloudFrontPanel.tsx

@@ -0,0 +1,124 @@
+import {ExternalLink, RefreshCw} from 'lucide-react'
+import {useMutation, useQuery, useQueryClient} from '@tanstack/react-query'
+import {useEffect, useState} from 'react'
+import {createDistributionInvalidation, getCloudResource, setDistributionEnabled} from '@/api/cloudProxyClient'
+import {CopyValueButton} from '@/components/CopyValueButton'
+import {useAccountId} from '@/lib/accountStore'
+import {formatDateTime} from '@/lib/format'
+import type {CloudResource} from '@/types/resource'
+
+type Props = {
+    resource?: CloudResource
+    runtimeReachable: boolean
+}
+
+type Origin = {id: string; domainName: string; kind: string; protocol: string | null}
+type Behavior = {pathPattern: string; originId: string; viewerProtocol: string; methods: string[]}
+type Invalidation = {id: string; status: string; createdAt: string | null}
+
+const VIEWER_PROTOCOL: Record<string, string> = {
+    'allow-all': 'HTTP and HTTPS',
+    'redirect-to-https': 'Redirect to HTTPS',
+    'https-only': 'HTTPS only',
+}
+
+export function CloudFrontPanel({resource, runtimeReachable}: Props) {
+    const accountId = useAccountId()
+    const queryClient = useQueryClient()
+    const [paths, setPaths] = useState('/*')
+    const [notice, setNotice] = useState('')
+    const distributionKey = ['cdn-distribution', accountId, resource?.id]
+
+    // The table row is a list summary; behaviours and invalidations come from the full distribution.
+    const distributionQuery = useQuery({
+        queryKey: distributionKey,
+        queryFn: ({signal}) => getCloudResource('aws', 'cdn', resource?.id ?? '', signal),
+        enabled: Boolean(resource) && runtimeReachable,
+    })
+
+    useEffect(() => {
+        setPaths('/*')
+        setNotice('')
+    }, [resource?.id])
+
+    const refresh = () => Promise.all([
+        queryClient.invalidateQueries({queryKey: distributionKey}),
+        queryClient.invalidateQueries({queryKey: ['cloud-resources', 'aws', 'cdn']}),
+    ])
+
+    const enabledMutation = useMutation({
+        mutationFn: (enabled: boolean) => setDistributionEnabled('aws', resource?.id ?? '', enabled),
+        onSuccess: (updated) => {
+            setNotice(updated.metadata.enabled ? 'Distribution enabled.' : 'Distribution disabled. It no longer answers viewer requests.')
+            return refresh()
+        },
+    })
+    const invalidationMutation = useMutation({
+        mutationFn: () => createDistributionInvalidation('aws', resource?.id ?? '', paths.split('\n')),
+        onSuccess: (invalidation) => {
+            setNotice(`Invalidation ${invalidation.id} ${invalidation.status === 'Completed' ? 'completed' : 'started'} for ${invalidation.paths.join(', ')}.`)
+            return refresh()
+        },
+    })
+
+    if (!resource) {
+        return <section className="table-panel"><div className="empty compact"><h3>Select a distribution</h3><p>Choose a distribution to open it, change its state or invalidate cached files.</p></div></section>
+    }
+
+    const distribution = distributionQuery.data ?? resource
+    const metadata = distribution.metadata
+    const viewerUrl = typeof metadata.viewerUrl === 'string' ? metadata.viewerUrl : ''
+    const enabled = metadata.enabled === true
+    const origins = list<Origin>(metadata.origins)
+    const behaviors = list<Behavior>(metadata.behaviors)
+    const invalidations = list<Invalidation>(metadata.invalidations)
+    const pending = enabledMutation.isPending || invalidationMutation.isPending
+    const disabled = !runtimeReachable || pending
+    const error = distributionQuery.error ?? enabledMutation.error ?? invalidationMutation.error
+
+    return <section className="table-panel" style={{marginTop: 16}} aria-label={`Distribution ${distribution.id}`}>
+        <div className="input-row resource-table-bar">
+            <div><p className="eyebrow">Distribution</p><span className="muted">{enabled ? 'Enabled' : 'Disabled'} · {distribution.status ?? 'Unknown'}{metadata.defaultRootObject ? ` · serves ${String(metadata.defaultRootObject)} at /` : ''}</span></div>
+            <div className="cdn-actions">
+                <button className="button" type="button" disabled={disabled} onClick={() => { setNotice(''); enabledMutation.mutate(!enabled) }}>{enabled ? 'Disable' : 'Enable'}</button>
+                <button className="button" type="button" disabled={!runtimeReachable || distributionQuery.isFetching} onClick={() => { void refresh() }}><RefreshCw size={14}/>{distributionQuery.isFetching ? 'Loading' : 'Refresh'}</button>
+            </div>
+        </div>
+        {viewerUrl && <div className="cdn-viewer">
+            <span className="copy-value mono">{viewerUrl}<CopyValueButton value={viewerUrl} label="Local URL"/></span>
+            <a className="button" href={viewerUrl} target="_blank" rel="noreferrer"><ExternalLink size={13}/> Open</a>
+            <small className="muted">Served by TheCloud on this machine. On AWS the same distribution answers at <code>{String(metadata.domainName ?? distribution.name)}</code>.</small>
+        </div>}
+
+        <div className="input-row resource-table-bar"><div><p className="eyebrow">Origins</p></div></div>
+        {origins.length > 0 && <div className="cognito-table"><table className="table"><thead><tr><th>Origin</th><th>Domain</th><th>Type</th></tr></thead><tbody>{origins.map((origin) => (
+            <tr key={origin.id}><td className="mono">{origin.id}</td><td className="mono">{origin.domainName}</td><td>{origin.kind === 's3' ? 'S3 bucket' : `Custom (${origin.protocol ?? 'https-only'})`}</td></tr>
+        ))}</tbody></table></div>}
+
+        {behaviors.length > 0 && <>
+            <div className="input-row resource-table-bar"><div><p className="eyebrow">Cache behaviours</p><span className="muted">The first path pattern that matches a request decides how it is served.</span></div></div>
+            <div className="cognito-table"><table className="table"><thead><tr><th>Path pattern</th><th>Origin</th><th>Viewer protocol</th><th>Methods</th></tr></thead><tbody>{behaviors.map((behavior) => (
+                <tr key={behavior.pathPattern}><td className="mono">{behavior.pathPattern}</td><td className="mono">{behavior.originId}</td><td>{VIEWER_PROTOCOL[behavior.viewerProtocol] ?? behavior.viewerProtocol}</td><td>{behavior.methods.join(', ')}</td></tr>
+            ))}</tbody></table></div>
+        </>}
+
+        <div className="input-row resource-table-bar"><div><p className="eyebrow">Invalidations</p><span className="muted">Clear cached copies so the next request fetches them from the origin.</span></div></div>
+        <form className="dynamic-form" aria-label="Create invalidation" onSubmit={(event) => { event.preventDefault(); setNotice(''); invalidationMutation.mutate() }}>
+            <label className="dynamic-field dynamic-field--span"><span>Paths</span>
+                <textarea className="textarea code-textarea small" rows={2} value={paths} onChange={(event) => setPaths(event.target.value)} disabled={disabled} required/>
+                <small className="muted">One per line, each starting with /. Use /* for everything.</small>
+            </label>
+            <div><button className="button primary" type="submit" disabled={disabled || !paths.trim()}>{invalidationMutation.isPending ? 'Invalidating' : 'Create invalidation'}</button></div>
+        </form>
+        {invalidations.length > 0 && <div className="cognito-table"><table className="table"><thead><tr><th>Invalidation</th><th>Status</th><th>Created</th></tr></thead><tbody>{invalidations.map((invalidation) => (
+            <tr key={invalidation.id}><td className="mono">{invalidation.id}</td><td><code>{invalidation.status}</code></td><td>{formatDateTime(invalidation.createdAt) ?? '—'}</td></tr>
+        ))}</tbody></table></div>}
+
+        {notice && <p className="cognito-outcome cognito-outcome--ok" role="status">{notice}</p>}
+        {error instanceof Error && <p className="error-text compact-text" role="alert">{error.message}</p>}
+    </section>
+}
+
+function list<T>(value: unknown): T[] {
+    return Array.isArray(value) ? value as T[] : []
+}

packages/frontend/src/components/DatabaseSnapshotsPanel.tsx

@@ -77,7 +77,7 @@ export function DatabaseSnapshotsPanel({
       "code" in error.body &&
       (error.body as { code?: unknown }).code === "operation_not_implemented"
     ) {
-      return "Snapshot creation is available in Floci UI, but the selected Floci runtime does not implement CreateDBSnapshot.";
+      return "Snapshot creation is available in TheCloud, but the selected runtime does not implement CreateDBSnapshot.";
     }
     if (error instanceof Error) {
       return error.message;

packages/frontend/src/components/DynamicResourceView.tsx

@@ -66,6 +66,7 @@ import { TargetGroupPanel } from "@/components/TargetGroupPanel";
 import { LoadBalancerListenerPanel } from "@/components/LoadBalancerListenerPanel";
 import { CognitoUsersPanel } from "@/components/CognitoUsersPanel";
 import { Route53RecordsPanel } from "@/components/Route53RecordsPanel";
+import { CloudFrontPanel } from "@/components/CloudFrontPanel";
 import { WorkflowExecutionDebugger } from "@/components/WorkflowExecutionDebugger";
 import { CodeBuildPanel } from "@/components/CodeBuildPanel";
 import { CodePipelinePanel } from "@/components/CodePipelinePanel";
@@ -983,6 +984,9 @@ export function DynamicResourceView({
       {service === "dns" && cloud === "aws" && (
         <Route53RecordsPanel resource={activeSelected} runtimeReachable={canUseRuntime} />
       )}
+      {service === "cdn" && cloud === "aws" && (
+        <CloudFrontPanel resource={activeSelected} runtimeReachable={canUseRuntime} />
+      )}
       {service === "compute" && (
         <ComputePanel
           cloud={cloud}

packages/frontend/src/components/Layout.tsx

@@ -190,7 +190,7 @@ export function Layout() {
                     </nav>
 
                     <div className="sidebar-footer">
-                        <span className="sidebar-footer-text">Floci DevTools · Local</span>
+                        <span className="sidebar-footer-text">TheCloud · Local</span>
                         <button
                             ref={toggleRef}
                             className="icon-btn"

packages/frontend/src/components/LightsailLaunchPanel.tsx

@@ -58,7 +58,7 @@ export function LightsailLaunchPanel({isSubmitting, submitError, onCancel, onSub
             <div>
                 <p className="eyebrow">Amazon Lightsail</p>
                 <h2>Create an instance</h2>
-                <p className="muted">Choose a blueprint, a plan, and a name. The instance launches locally through Floci.</p>
+                <p className="muted">Choose a blueprint, a plan, and a name. The instance launches locally on TheCloud.</p>
             </div>
             <button className="icon-btn" type="button" onClick={onCancel} aria-label="Close create instance">×</button>
         </div>

packages/frontend/src/components/LogsQueryPanel.tsx

@@ -190,7 +190,7 @@ function LogsQueryResults({result, expanded}: {result?: LogsInsightsQueryResult;
             </div>
             {stillRunning && (
                 <div className="muted padded">
-                    Floci hadn't finished this query when the console stopped waiting — these rows are a partial,
+                    The runtime hadn't finished this query when the console stopped waiting — these rows are a partial,
                     in-progress result, not the full answer. Run the query again to see if it has finished
                     (query id: {result.queryId}).
                 </div>

packages/frontend/src/components/SesConsolePanel.tsx

@@ -13,12 +13,12 @@ export function SesConsolePanel({runtimeReachable}: {runtimeReachable: boolean})
     const [from, setFrom] = useState('')
     const [to, setTo] = useState(SIMULATORS[0])
     const [subject, setSubject] = useState('Local SES test')
-    const [text, setText] = useState('Sent from the Floci SES console.')
+    const [text, setText] = useState('Sent from TheCloud\'s SES console.')
     const [html, setHtml] = useState('')
     const [raw, setRaw] = useState('From: sender@example.test\r\nTo: success@simulator.amazonses.com\r\nSubject: Raw SES test\r\nMIME-Version: 1.0\r\nContent-Type: text/plain; charset=UTF-8\r\n\r\nHello from a raw MIME message.')
     const [configurationSet, setConfigurationSet] = useState('')
     const [templateName, setTemplateName] = useState('')
-    const [templateData, setTemplateData] = useState('{"name":"Floci"}')
+    const [templateData, setTemplateData] = useState('{"name":"TheCloud"}')
     const [editingTemplate, setEditingTemplate] = useState('')
     const [templateSubject, setTemplateSubject] = useState('Hello {{name}}')
     const [templateText, setTemplateText] = useState('Hello {{name}}')
@@ -61,7 +61,7 @@ export function SesConsolePanel({runtimeReachable}: {runtimeReachable: boolean})
     const pending = send.isPending || createIdentity.isPending || saveTemplate.isPending || addSuppression.isPending || createConfigurationSet.isPending || addDestination.isPending
 
     return <div className="ses-console">
-        <section className="table-panel"><div className="dynamic-stage-header"><div><p className="eyebrow">SES identities</p><h3>Verify senders</h3><p className="muted compact-text">Floci verifies identities immediately for AWS-compatible workflows. Local sending is not sandbox-gated.</p></div><button className="button compact" type="button" onClick={() => identities.refetch()}><RefreshCw size={13}/>Refresh</button></div><form className="input-row" onSubmit={(event) => {event.preventDefault(); if (identity.trim()) createIdentity.mutate()}}><input className="input" value={identity} onChange={(event) => setIdentity(event.target.value)} placeholder="sender@example.test or example.test" required/><button className="button primary" disabled={!runtimeReachable || createIdentity.isPending}><Plus size={13}/>Verify identity</button></form>{identities.data?.map((item) => <div className="apigateway-route-item" key={item.IdentityName}><div><code>{item.IdentityName}</code><small>{item.IdentityType} · {item.VerifiedForSendingStatus ? 'verified for sending' : 'not verified'}</small></div><button className="icon-btn danger" onClick={() => deleteSesIdentity(item.IdentityName).then(() => qc.invalidateQueries({queryKey: ['ses-identities']}))}><Trash2 size={13}/></button></div>)}</section>
+        <section className="table-panel"><div className="dynamic-stage-header"><div><p className="eyebrow">SES identities</p><h3>Verify senders</h3><p className="muted compact-text">TheCloud verifies identities immediately for AWS-compatible workflows. Local sending is not sandbox-gated.</p></div><button className="button compact" type="button" onClick={() => identities.refetch()}><RefreshCw size={13}/>Refresh</button></div><form className="input-row" onSubmit={(event) => {event.preventDefault(); if (identity.trim()) createIdentity.mutate()}}><input className="input" value={identity} onChange={(event) => setIdentity(event.target.value)} placeholder="sender@example.test or example.test" required/><button className="button primary" disabled={!runtimeReachable || createIdentity.isPending}><Plus size={13}/>Verify identity</button></form>{identities.data?.map((item) => <div className="apigateway-route-item" key={item.IdentityName}><div><code>{item.IdentityName}</code><small>{item.IdentityType} · {item.VerifiedForSendingStatus ? 'verified for sending' : 'not verified'}</small></div><button className="icon-btn danger" onClick={() => deleteSesIdentity(item.IdentityName).then(() => qc.invalidateQueries({queryKey: ['ses-identities']}))}><Trash2 size={13}/></button></div>)}</section>
         <section className="table-panel"><div className="dynamic-stage-header"><div><p className="eyebrow">Compose</p><h3><Mail size={15}/> Send through SES</h3><p className="muted compact-text">Simulator recipients produce documented delivery, bounce, and complaint events locally.</p></div></div><div className="button-row">{SIMULATORS.map((address) => <button className="button compact" type="button" key={address} onClick={() => setTo(address)}>{address.split('@')[0]}</button>)}</div><form className="dynamic-form" onSubmit={(event) => {event.preventDefault(); send.mutate()}}><label className="dynamic-field"><span>Format</span><select className="input" value={mode} onChange={(event) => setMode(event.target.value as typeof mode)}><option value="simple">Simple</option><option value="raw">Raw MIME</option><option value="template">Template</option></select></label><label className="dynamic-field"><span>From</span><input className="input" value={from} onChange={(event) => setFrom(event.target.value)} placeholder="Verified identity" required={mode !== 'raw'}/></label><label className="dynamic-field"><span>To</span><input className="input" value={to} onChange={(event) => setTo(event.target.value)} required/></label><label className="dynamic-field"><span>Configuration set</span><select className="input" value={configurationSet} onChange={(event) => setConfigurationSet(event.target.value)}><option value="">None</option>{configurationSets.data?.map((item) => <option key={item.ConfigurationSetName} value={item.ConfigurationSetName}>{item.ConfigurationSetName}</option>)}</select></label>{mode === 'simple' && <><label className="dynamic-field dynamic-field--span"><span>Subject</span><input className="input" value={subject} onChange={(event) => setSubject(event.target.value)} required/></label><label className="dynamic-field"><span>Text body</span><textarea className="textarea code-textarea small" value={text} onChange={(event) => setText(event.target.value)}/></label><label className="dynamic-field"><span>HTML body</span><textarea className="textarea code-textarea small" value={html} onChange={(event) => setHtml(event.target.value)}/></label></>}{mode === 'raw' && <label className="dynamic-field dynamic-field--span"><span>Raw MIME</span><textarea className="textarea code-textarea" value={raw} onChange={(event) => setRaw(event.target.value)} required/></label>}{mode === 'template' && <><label className="dynamic-field"><span>Template</span><select className="input" value={templateName} onChange={(event) => setTemplateName(event.target.value)} required><option value="">Select template</option>{templates.data?.map((item) => <option key={item.TemplateName} value={item.TemplateName}>{item.TemplateName}</option>)}</select></label><label className="dynamic-field"><span>Template data (JSON)</span><textarea className="textarea code-textarea small" value={templateData} onChange={(event) => setTemplateData(event.target.value)} required/></label></>}<button className="button primary" disabled={!runtimeReachable || pending}>{send.isPending ? <Loader2 className="spin" size={13}/> : <Send size={13}/>}{send.isPending ? 'Sending' : 'Send email'}</button></form>{send.isSuccess && <p className="success-text compact-text">Accepted by SES. Refresh the mailbox above to inspect the captured message.</p>}</section>
         <section className="table-panel"><div className="dynamic-stage-header"><div><p className="eyebrow">Templates</p><h3>Author and render</h3></div></div><form className="dynamic-form" onSubmit={(event) => {event.preventDefault(); saveTemplate.mutate()}}><label className="dynamic-field"><span>Template name</span><input className="input" value={editingTemplate} onChange={(event) => setEditingTemplate(event.target.value)} required/></label><label className="dynamic-field"><span>Subject</span><input className="input" value={templateSubject} onChange={(event) => setTemplateSubject(event.target.value)} required/></label><label className="dynamic-field"><span>Text</span><textarea className="textarea code-textarea small" value={templateText} onChange={(event) => setTemplateText(event.target.value)}/></label><label className="dynamic-field"><span>HTML</span><textarea className="textarea code-textarea small" value={templateHtml} onChange={(event) => setTemplateHtml(event.target.value)}/></label><div className="button-row"><button className="button primary" disabled={!runtimeReachable || !editingTemplate.trim() || saveTemplate.isPending}>Save template</button><button className="button" type="button" disabled={!editingTemplate.trim() || renderTemplate.isPending} onClick={() => renderTemplate.mutate()}>Test render</button></div></form>{rendered && <pre className="metadata-block">{rendered}</pre>}{templates.data?.map((item) => <div className="apigateway-route-item" key={item.TemplateName}><code>{item.TemplateName}</code><div><button className="button compact" onClick={() => void loadTemplate(item.TemplateName)}>Edit</button><button className="icon-btn danger" onClick={() => deleteSesTemplate(item.TemplateName).then(() => qc.invalidateQueries({queryKey: ['ses-templates']}))}><Trash2 size={13}/></button></div></div>)}</section>
         <section className="table-panel"><div className="dynamic-stage-header"><div><p className="eyebrow">Suppression list</p><h3>Accepted but suppressed</h3><p className="muted compact-text">Suppressed mail is still accepted and captured, but it is not relayed.</p></div></div><form className="input-row" onSubmit={(event) => {event.preventDefault(); addSuppression.mutate()}}><input className="input" type="email" value={suppressionAddress} onChange={(event) => setSuppressionAddress(event.target.value)} placeholder="recipient@example.test" required/><select className="input" value={suppressionReason} onChange={(event) => setSuppressionReason(event.target.value as typeof suppressionReason)}><option value="BOUNCE">Bounce</option><option value="COMPLAINT">Complaint</option></select><button className="button primary" disabled={addSuppression.isPending}>Add</button></form>{suppressions.data?.map((item) => <div className="apigateway-route-item" key={item.EmailAddress}><div><code>{item.EmailAddress}</code><small>{item.Reason}</small></div><button className="icon-btn danger" onClick={() => deleteSesSuppression(item.EmailAddress ?? '').then(() => qc.invalidateQueries({queryKey: ['ses-suppressions']}))}><Trash2 size={13}/></button></div>)}</section>

packages/frontend/src/components/serviceIcons.tsx

@@ -4,6 +4,7 @@ import {
     Clock,
     Container,
     Database,
+    Earth,
     Globe,
     HardDrive,
     Hammer,
@@ -33,6 +34,7 @@ import codePipelineIcon from '../../../../aws-icons-svg/Developer-Tools/CodePipe
 import codeDeployIcon from '../../../../aws-icons-svg/Developer-Tools/CodeDeploy.svg'
 import cognitoIcon from '../../../../aws-icons-svg/Security-Identity-Compliance/Cognito.svg'
 import route53Icon from '../../../../aws-icons-svg/Networking-Content-Delivery/Route-53.svg'
+import cloudFrontIcon from '../../../../aws-icons-svg/Networking-Content-Delivery/CloudFront.svg'
 import cloudFormationIcon from '@/assets/aws-services/cloudformation.svg'
 import cloudWatchLogsIcon from '@/assets/aws-services/cloudwatch-logs.svg'
 import dynamoDbIcon from '@/assets/aws-services/dynamodb.svg'
@@ -90,6 +92,7 @@ const SERVICE_ICONS: Record<string, LucideIcon> = {
     kms: Lock,
     userpools: UsersRound,
     dns: Globe,
+    cdn: Earth,
     loadbalancing: Scale,
     parameters: SlidersHorizontal,
     configuration: SlidersHorizontal,
@@ -135,6 +138,7 @@ const AWS_SERVICE_ICON_ASSETS: Record<string, string> = {
     storage: s3Icon,
     userpools: cognitoIcon,
     dns: route53Icon,
+    cdn: cloudFrontIcon,
     workflows: stepFunctionsIcon,
 }
 

packages/frontend/src/features/cloud-console/cloudConsoleHome.utils.ts

@@ -20,7 +20,7 @@ export function runtimeClassFor(status: CloudStatus | undefined, loading: boolea
 export function runtimeDetailFor(cloud: CloudProvider, status?: CloudStatus): string {
     if (status?.runtime === 'reachable') return 'Connected through Cloud Proxy API'
     if (status?.runtime === 'unavailable') return 'Start the selected runtime to load resources'
-    if (cloud === 'gcp') return 'Waiting for Floci-GCP runtime status'
+    if (cloud === 'gcp') return 'Waiting for the GCP runtime status'
     return 'Waiting for runtime status'
 }
 
@@ -52,9 +52,9 @@ export function cloudName(cloud: CloudProvider): string {
 }
 
 export function providerDescription(cloud: CloudProvider): string {
-    if (cloud === 'aws') return 'Storage, runtime infrastructure, and AWS-specific pages are backed by Floci AWS Core.'
+    if (cloud === 'aws') return 'Storage, runtime infrastructure, and AWS-specific pages are backed by TheCloud\'s AWS runtime.'
-    if (cloud === 'azure') return 'Storage is backed by Floci-AZ through the same normalized storage contract.'
+    if (cloud === 'azure') return 'Storage is backed by TheCloud\'s Azure runtime through the same normalized storage contract.'
-    return 'Storage is backed by Floci-GCP through the same normalized storage contract.'
+    return 'Storage is backed by TheCloud\'s GCP runtime through the same normalized storage contract.'
 }
 
 export function adapterLabel(cloud: CloudProvider, status?: CloudStatus): string {
@@ -63,7 +63,7 @@ export function adapterLabel(cloud: CloudProvider, status?: CloudStatus): string
 }
 
 export function runtimeName(cloud: CloudProvider): string {
-    if (cloud === 'aws') return 'Floci AWS Core'
+    if (cloud === 'aws') return 'TheCloud AWS runtime'
-    if (cloud === 'azure') return 'Floci-AZ'
+    if (cloud === 'azure') return 'TheCloud Azure runtime'
-    return 'Floci-GCP'
+    return 'TheCloud GCP runtime'
 }

packages/frontend/src/features/eks/EKSPage.tsx

@@ -243,13 +243,13 @@ export function EKSPage() {
             <EmptyState
               icon={Boxes}
               title="Cannot load clusters"
-              description="EKS did not respond from the Floci endpoint."
+              description="EKS did not respond from TheCloud's runtime."
             />
           ) : clusters.length === 0 ? (
             <EmptyState
               icon={Boxes}
               title="No EKS clusters"
-              description="No Kubernetes clusters were returned by Floci."
+              description="No Kubernetes clusters were returned by TheCloud's runtime."
             />
           ) : (
             clusters.map((cluster) => (

packages/frontend/src/features/secretsmanager/SecretsManagerPage.tsx

@@ -729,7 +729,7 @@ export function SecretsManagerPage() {
             <h3>Secrets</h3>
           </div>
           {query.isError ? (
-            <EmptyState icon={KeyRound} title="Cannot load secrets" description="Secrets Manager did not respond from the Floci endpoint." />
+            <EmptyState icon={KeyRound} title="Cannot load secrets" description="Secrets Manager did not respond from TheCloud's runtime." />
           ) : query.isLoading ? (
             <div className="empty"><p>Loading secrets…</p></div>
           ) : secrets.length === 0 ? (

packages/frontend/src/index.css

@@ -6525,3 +6525,16 @@ button.console-service-card {
 .dns-values { overflow-wrap: anywhere; }
 .dns-badge { margin-left: 8px; }
 tr[aria-current="true"] td { background: var(--hover-md); }
+
+.cdn-actions { display: flex; flex-wrap: wrap; gap: 8px; }
+
+.cdn-viewer {
+    display: flex;
+    flex-wrap: wrap;
+    align-items: center;
+    gap: 8px 12px;
+    padding: 0 16px 12px;
+}
+
+.cdn-viewer .copy-value { overflow-wrap: anywhere; min-width: 0; }
+.cdn-viewer small { flex-basis: 100%; }

packages/frontend/src/types/resource.ts

@@ -302,6 +302,13 @@ export interface UserPoolSignInTestInput {
     password: string
 }
 
+export interface DistributionInvalidation {
+    id: string
+    status: string
+    createdAt: string | null
+    paths: string[]
+}
+
 export type UserPoolOAuthFlow = 'code' | 'implicit' | 'client_credentials'
 
 export interface UserPoolClientSettings {

packages/frontend/src/types/schema.ts

@@ -27,6 +27,7 @@ export type KubernetesActionName =
     | 'createFargateProfile'
     | 'deleteFargateProfile'
 export type ItemActionName = 'list' | 'get' | 'put' | 'delete' | 'query'
+export type DistributionActionName = 'setEnabled' | 'createInvalidation'
 export type UserPoolActionName = 'updateUser' | 'setUserGroups' | 'listGroups' | 'createGroup' | 'deleteGroup' | 'testSignIn' | 'describeClient' | 'updateClientOAuth'
 export type CapabilityStatus = 'available' | 'blocked' | 'partial' | 'coming_soon'
 
@@ -88,6 +89,7 @@ export interface ServiceSchema {
         kubernetesActions?: Array<CapabilitySchema<KubernetesActionName> | KubernetesActionName>
         itemActions?: Array<CapabilitySchema<ItemActionName> | ItemActionName>
         userPoolActions?: Array<CapabilitySchema<UserPoolActionName>>
+        distributionActions?: Array<CapabilitySchema<DistributionActionName>>
     }
     filters: FieldSchema[]
     columns: TableColumnSchema[]

pnpm-lock.yaml

@@ -19,6 +19,9 @@ importers:
       '@aws-sdk/client-cloudformation':
         specifier: ^3.1111.0
         version: 3.1111.0
+      '@aws-sdk/client-cloudfront':
+        specifier: ^3.1146.0
+        version: 3.1156.0
       '@aws-sdk/client-cloudwatch':
         specifier: ^3.1076.0
         version: 3.1146.0
@@ -304,6 +307,10 @@ packages:
     resolution: {integrity: sha512-tZHW6n0vbA1fiJZtxCWVFWUssP47es/EAu7kH2FId6nY/svNoQVHYTqA7ALhLqB+W6ASzNTpnJeCq8evoXlKBQ==}
     engines: {node: '>=20.0.0'}
 
+  '@aws-sdk/client-cloudfront@3.1156.0':
+    resolution: {integrity: sha512-z4V/ecv6b5uGwVVMaE8NbczaPVfM2HwbZAGUFp9XDjm+Q8WoFrF0vRlWaRWpW+rox4yPZc4tSo+cv8drud+r8A==}
+    engines: {node: '>=20.0.0'}
+
   '@aws-sdk/client-cloudwatch-logs@3.1131.0':
     resolution: {integrity: sha512-FmV57mQjXtze2y/TCepl0E+4vvHqXCkiAMn24E5ogYC/xEGAYDPupTkzCQdSUmbyW6/tmPtmcOD+6LbUP1AKog==}
     engines: {node: '>=20.0.0'}
@@ -2916,6 +2923,17 @@ snapshots:
       '@smithy/types': 4.16.1
       tslib: 2.8.1
 
+  '@aws-sdk/client-cloudfront@3.1156.0':
+    dependencies:
+      '@aws-sdk/core': 3.978.5
+      '@aws-sdk/credential-provider-node': 3.972.88
+      '@aws-sdk/types': 3.975.0
+      '@smithy/core': 3.36.2
+      '@smithy/fetch-http-handler': 5.8.0
+      '@smithy/node-http-handler': 4.12.1
+      '@smithy/types': 4.19.0
+      tslib: 2.8.1
+
   '@aws-sdk/client-cloudwatch-logs@3.1131.0':
     dependencies:
       '@aws-sdk/core': 3.978.0
@@ -3601,55 +3619,55 @@ snapshots:
 
   '@aws-sdk/credential-provider-login@3.972.60':
     dependencies:
-      '@aws-sdk/core': 3.978.1
+      '@aws-sdk/core': 3.978.5
       '@aws-sdk/nested-clients': 3.997.45
-      '@aws-sdk/types': 3.974.6
+      '@aws-sdk/types': 3.975.0
-      '@smithy/core': 3.35.0
+      '@smithy/core': 3.36.2
       '@smithy/types': 4.19.0
       tslib: 2.8.1
 
   '@aws-sdk/credential-provider-login@3.972.69':
     dependencies:
-      '@aws-sdk/core': 3.978.1
+      '@aws-sdk/core': 3.978.5
       '@aws-sdk/nested-clients': 3.997.36
-      '@aws-sdk/types': 3.974.6
+      '@aws-sdk/types': 3.975.0
-      '@smithy/core': 3.35.0
+      '@smithy/core': 3.36.2
       '@smithy/types': 4.19.0
       tslib: 2.8.1
 
   '@aws-sdk/credential-provider-login@3.972.76':
     dependencies:
-      '@aws-sdk/core': 3.978.1
+      '@aws-sdk/core': 3.978.5
       '@aws-sdk/nested-clients': 3.997.45
-      '@aws-sdk/types': 3.974.6
+      '@aws-sdk/types': 3.975.0
-      '@smithy/core': 3.35.0
+      '@smithy/core': 3.36.2
       '@smithy/types': 4.19.0
       tslib: 2.8.1
 
   '@aws-sdk/credential-provider-login@3.972.77':
     dependencies:
-      '@aws-sdk/core': 3.978.1
+      '@aws-sdk/core': 3.978.5
       '@aws-sdk/nested-clients': 3.997.45
-      '@aws-sdk/types': 3.974.6
+      '@aws-sdk/types': 3.975.0
-      '@smithy/core': 3.35.0
+      '@smithy/core': 3.36.2
       '@smithy/types': 4.19.0
       tslib: 2.8.1
 
   '@aws-sdk/credential-provider-login@3.972.78':
     dependencies:
-      '@aws-sdk/core': 3.978.1
+      '@aws-sdk/core': 3.978.5
       '@aws-sdk/nested-clients': 3.997.45
-      '@aws-sdk/types': 3.974.6
+      '@aws-sdk/types': 3.975.0
-      '@smithy/core': 3.35.0
+      '@smithy/core': 3.36.2
       '@smithy/types': 4.19.0
       tslib: 2.8.1
 
   '@aws-sdk/credential-provider-login@3.972.79':
     dependencies:
-      '@aws-sdk/core': 3.978.1
+      '@aws-sdk/core': 3.978.5
       '@aws-sdk/nested-clients': 3.997.46
-      '@aws-sdk/types': 3.974.6
+      '@aws-sdk/types': 3.975.0
-      '@smithy/core': 3.35.0
+      '@smithy/core': 3.36.2
       '@smithy/types': 4.19.0
       tslib: 2.8.1
 
@@ -4037,10 +4055,10 @@ snapshots:
 
   '@aws-sdk/nested-clients@3.997.28':
     dependencies:
-      '@aws-sdk/core': 3.978.1
+      '@aws-sdk/core': 3.978.5
       '@aws-sdk/signature-v4-multi-region': 3.996.47
-      '@aws-sdk/types': 3.974.6
+      '@aws-sdk/types': 3.975.0
-      '@smithy/core': 3.35.0
+      '@smithy/core': 3.36.2
       '@smithy/fetch-http-handler': 5.8.0
       '@smithy/node-http-handler': 4.12.1
       '@smithy/types': 4.19.0
@@ -4048,10 +4066,10 @@ snapshots:
 
   '@aws-sdk/nested-clients@3.997.36':
     dependencies:
-      '@aws-sdk/core': 3.978.1
+      '@aws-sdk/core': 3.978.5
       '@aws-sdk/signature-v4-multi-region': 3.996.47
-      '@aws-sdk/types': 3.974.6
+      '@aws-sdk/types': 3.975.0
-      '@smithy/core': 3.35.0
+      '@smithy/core': 3.36.2
       '@smithy/fetch-http-handler': 5.8.0
       '@smithy/node-http-handler': 4.12.1
       '@smithy/types': 4.19.0
@@ -4059,10 +4077,10 @@ snapshots:
 
   '@aws-sdk/nested-clients@3.997.43':
     dependencies:
-      '@aws-sdk/core': 3.978.1
+      '@aws-sdk/core': 3.978.5
       '@aws-sdk/signature-v4-multi-region': 3.996.47
-      '@aws-sdk/types': 3.974.6
+      '@aws-sdk/types': 3.975.0
-      '@smithy/core': 3.35.0
+      '@smithy/core': 3.36.2
       '@smithy/fetch-http-handler': 5.8.0
       '@smithy/node-http-handler': 4.12.1
       '@smithy/types': 4.19.0
@@ -4070,10 +4088,10 @@ snapshots:
 
   '@aws-sdk/nested-clients@3.997.44':
     dependencies:
-      '@aws-sdk/core': 3.978.1
+      '@aws-sdk/core': 3.978.5
       '@aws-sdk/signature-v4-multi-region': 3.996.47
-      '@aws-sdk/types': 3.974.6
+      '@aws-sdk/types': 3.975.0
-      '@smithy/core': 3.35.0
+      '@smithy/core': 3.36.2
       '@smithy/fetch-http-handler': 5.8.0
       '@smithy/node-http-handler': 4.12.1
       '@smithy/types': 4.19.0
@@ -4081,10 +4099,10 @@ snapshots:
 
   '@aws-sdk/nested-clients@3.997.45':
     dependencies:
-      '@aws-sdk/core': 3.978.1
+      '@aws-sdk/core': 3.978.5
       '@aws-sdk/signature-v4-multi-region': 3.996.47
-      '@aws-sdk/types': 3.974.6
+      '@aws-sdk/types': 3.975.0
-      '@smithy/core': 3.35.0
+      '@smithy/core': 3.36.2
       '@smithy/fetch-http-handler': 5.8.0
       '@smithy/node-http-handler': 4.12.1
       '@smithy/types': 4.19.0
@@ -4092,10 +4110,10 @@ snapshots:
 
   '@aws-sdk/nested-clients@3.997.46':
     dependencies:
-      '@aws-sdk/core': 3.978.1
+      '@aws-sdk/core': 3.978.5
       '@aws-sdk/signature-v4-multi-region': 3.996.47
-      '@aws-sdk/types': 3.974.6
+      '@aws-sdk/types': 3.975.0
-      '@smithy/core': 3.35.0
+      '@smithy/core': 3.36.2
       '@smithy/fetch-http-handler': 5.8.0
       '@smithy/node-http-handler': 4.12.1
       '@smithy/types': 4.19.0
@@ -4142,55 +4160,55 @@ snapshots:
 
   '@aws-sdk/token-providers@3.1080.0':
     dependencies:
-      '@aws-sdk/core': 3.978.1
+      '@aws-sdk/core': 3.978.5
       '@aws-sdk/nested-clients': 3.997.45
-      '@aws-sdk/types': 3.974.6
+      '@aws-sdk/types': 3.975.0
-      '@smithy/core': 3.35.0
+      '@smithy/core': 3.36.2
       '@smithy/types': 4.19.0
       tslib: 2.8.1
 
   '@aws-sdk/token-providers@3.1096.0':
     dependencies:
-      '@aws-sdk/core': 3.978.1
+      '@aws-sdk/core': 3.978.5
       '@aws-sdk/nested-clients': 3.997.36
-      '@aws-sdk/types': 3.974.6
+      '@aws-sdk/types': 3.975.0
-      '@smithy/core': 3.35.0
+      '@smithy/core': 3.36.2
       '@smithy/types': 4.19.0
       tslib: 2.8.1
 
   '@aws-sdk/token-providers@3.1111.0':
     dependencies:
-      '@aws-sdk/core': 3.978.1
+      '@aws-sdk/core': 3.978.5
       '@aws-sdk/nested-clients': 3.997.45
-      '@aws-sdk/types': 3.974.6
+      '@aws-sdk/types': 3.975.0
-      '@smithy/core': 3.35.0
+      '@smithy/core': 3.36.2
       '@smithy/types': 4.19.0
       tslib: 2.8.1
 
   '@aws-sdk/token-providers@3.1116.0':
     dependencies:
-      '@aws-sdk/core': 3.978.1
+      '@aws-sdk/core': 3.978.5
       '@aws-sdk/nested-clients': 3.997.45
-      '@aws-sdk/types': 3.974.6
+      '@aws-sdk/types': 3.975.0
-      '@smithy/core': 3.35.0
+      '@smithy/core': 3.36.2
       '@smithy/types': 4.19.0
       tslib: 2.8.1
 
   '@aws-sdk/token-providers@3.1129.0':
     dependencies:
-      '@aws-sdk/core': 3.978.1
+      '@aws-sdk/core': 3.978.5
       '@aws-sdk/nested-clients': 3.997.45
-      '@aws-sdk/types': 3.974.6
+      '@aws-sdk/types': 3.975.0
-      '@smithy/core': 3.35.0
+      '@smithy/core': 3.36.2
       '@smithy/types': 4.19.0
       tslib: 2.8.1
 
   '@aws-sdk/token-providers@3.1138.0':
     dependencies:
-      '@aws-sdk/core': 3.978.1
+      '@aws-sdk/core': 3.978.5
       '@aws-sdk/nested-clients': 3.997.46
-      '@aws-sdk/types': 3.974.6
+      '@aws-sdk/types': 3.975.0
-      '@smithy/core': 3.35.0
+      '@smithy/core': 3.36.2
       '@smithy/types': 4.19.0
       tslib: 2.8.1