cdnlisted

# setup:cdn — provision the headless download CDN Provision S3 + CloudFront for artifact downloads via the `forge-cdn` Terraform module, then wire the config so `/forge:publish` works. Run it from a checkout of the repo — the Terraform lives in `infra/`. ## 1. Prerequisites - **Terraform** on PATH (the repo pins a version in `infra/.terraform-version`; use tfenv). - **Active AWS credentials** — authenticate however you normally do. Verify with `aws sts get-caller-identity`. ## 2. Decide the shape (ask the user) - **Gated or open?** `--signed` = private, expiring links; omit for public permanent links. - **Custom domain?** `--domain <fqdn> --zone <route53-zone>` auto-creates the ACM cert (us-east-1) + DNS; omit for the free `*.cloudfront.net` domain. - **Region** (`--region`). ## 3. Plan (never applies) "${CLAUDE_PLUGIN_ROOT}/scripts/setup_cdn.sh" --region <region> \ [--signed] [--domain <fqdn> --zone <zone>] [--bucket <name>] Runs preflight (terraform + creds), generates a signing keypair if `--signed` and none exists (private key stays local, `0600`), writes `infra/terraform.tfvars`, and prints `terraform plan`. **Show the plan and get the user's explicit OK before applying.** ## 4. Apply (only after confirmation) "${CLAUDE_PLUGIN_ROOT}/scripts/setup_cdn.sh" … --apply Prints `FORGE_*` lines — write them into the forge config (`~/.config/forge/config` or `/etc/forge/config`) so `/forge:publish` can sign + publish. ## 5. Verify Publish a test file w