{
  "name": "cloudfront",
  "version": "1.0.0",
  "kind": "l1",
  "type": "aws:cloudfront:distribution",
  "description": "CloudFront distribution primitive (substrate-agnostic stack types aws:cloudfront:distribution + aws:cloudfront:originaccesscontrol; the Terraform adapter translates to aws_cloudfront_distribution + aws_cloudfront_origin_access_control).",
  "inputs": {
    "bucket_regional_domain_name": {
      "type": "string",
      "description": "The S3 bucket regional domain name (ref to s3 origin).",
      "required": true
    },
    "price_class": {
      "type": "string",
      "description": "CloudFront price class (default PriceClass_100).",
      "required": false,
      "default": "PriceClass_100"
    },
    "viewer_protocol_policy": {
      "type": "string",
      "description": "Viewer protocol policy (default redirect-to-https).",
      "required": false,
      "default": "redirect-to-https"
    },
    "default_ttl": {
      "type": "number",
      "description": "Default TTL in seconds (default 3600).",
      "required": false,
      "default": 3600
    },
    "max_ttl": {
      "type": "number",
      "description": "Max TTL in seconds (default 86400).",
      "required": false,
      "default": 86400
    },
    "waf_web_acl_arn": {
      "type": "string",
      "description": "WAF web ACL ARN to associate (optional, ref to waf).",
      "required": false
    },
    "region": {
      "type": "string",
      "description": "AWS region (CloudFront is global but the provider region is used for the OAC).",
      "required": true
    }
  },
  "outputs": {
    "distribution_arn": {
      "type": "arn",
      "description": "The CloudFront distribution ARN."
    },
    "distribution_domain_name": {
      "type": "string",
      "description": "The CloudFront distribution domain name (e.g. d111111abcdef8.cloudfront.net)."
    },
    "oac_id": {
      "type": "string",
      "description": "The Origin Access Control ID."
    }
  },
  "nfrs": {
    "encryption_enabled": {
      "type": "boolean",
      "description": "Enable encryption in transit (HTTPS only).",
      "default": true
    }
  },
  "resources": [
    {
      "type": "aws:cloudfront:distribution",
      "description": "CloudFront distribution with S3 origin via OAC.",
      "inputs": ["bucket_regional_domain_name", "price_class", "viewer_protocol_policy", "default_ttl", "max_ttl", "waf_web_acl_arn", "oac_id"],
      "outputs": ["distribution_arn", "distribution_domain_name"]
    },
    {
      "type": "aws:cloudfront:originaccesscontrol",
      "description": "Origin Access Control for the S3 origin.",
      "inputs": ["name", "origin_type", "signing_behavior"],
      "outputs": ["oac_id"]
    }
  ],
  "intra_refs": [
    {"from": "aws:cloudfront:distribution.oac_id", "to": "aws:cloudfront:originaccesscontrol.oac_id"}
  ]
}