@deployfoundation/foundation-deploy 0.2.37 → 0.2.39

package/dist/chunk-gmdzzrc4.js

@@ -1,442 +0,0 @@
-import {
-  RELEASE_BUCKET_ENV,
-  RELEASE_VERSION_RE,
-  instanceNames,
-  loadInstanceFile,
-  manifestKey,
-  releaseCacheDir,
-  verifyManifest
-} from "./chunk-hps5vshg.js";
-
-// src/deploy/release.ts
-import { existsSync as existsSync2, mkdirSync, readFileSync as readFileSync2 } from "node:fs";
-import { dirname as dirname3, isAbsolute, join as join2, resolve as resolve2 } from "node:path";
-
-// src/release/kms.ts
-import { KMSClient, SignCommand, VerifyCommand } from "@aws-sdk/client-kms";
-function regionOfKeyArn(keyArn) {
-  const region = keyArn.split(":")[3];
-  if (region === undefined || region === "")
-    throw new Error(`not a KMS key ARN: ${keyArn} (expected arn:aws:kms:<region>:<account>:key/…)`);
-  return region;
-}
-function client(keyArn, options = {}) {
-  const profile = options.profile ?? "";
-  return new KMSClient({
-    region: regionOfKeyArn(keyArn),
-    ...profile === "" ? {} : { profile }
-  });
-}
-function kmsVerifier(keyArn, options = {}) {
-  const kms = client(keyArn, options);
-  return {
-    async verify(input) {
-      const result = await kms.send(new VerifyCommand(input));
-      return {
-        ...result.SignatureValid === undefined ? {} : { SignatureValid: result.SignatureValid }
-      };
-    }
-  };
-}
-
-// src/deploy/aws.ts
-import { mkdtempSync, rmSync, writeFileSync } from "node:fs";
-import { tmpdir } from "node:os";
-import { join } from "node:path";
-
-// src/deploy/instance.ts
-import { dirname } from "node:path";
-var INSTANCE_FILE_ENV = "FOUNDATION_INSTANCE_FILE";
-function resolveInstanceFilePath(argv = [], env = {}) {
-  for (let i = 0;i < argv.length; i++) {
-    const arg = argv[i] ?? "";
-    if (arg === "--instance") {
-      const next = argv[i + 1];
-      if (next === undefined || next.startsWith("-"))
-        throw new Error("--instance needs a path, e.g. --instance .foundation/instance.yaml");
-      return next;
-    }
-    if (arg.startsWith("--instance=")) {
-      const value = arg.slice("--instance=".length);
-      if (value === "")
-        throw new Error("--instance needs a path");
-      return value;
-    }
-  }
-  const fromEnv = env[INSTANCE_FILE_ENV];
-  if (fromEnv !== undefined && fromEnv !== "")
-    return fromEnv;
-  throw new Error(`--instance <path> is required (or set ${INSTANCE_FILE_ENV}); it is the path to the deployment's instance YAML`);
-}
-function loadInstanceContext(path, cwd = process.cwd()) {
-  const file = loadInstanceFile(path, cwd);
-  return { ...file, root: dirname(file.path) };
-}
-function loadInstanceFromArgs(argv = process.argv.slice(2), env = process.env) {
-  return loadInstanceContext(resolveInstanceFilePath(argv, env));
-}
-function instanceBanner(context) {
-  const { instance } = context;
-  return `instance: ${instance.name} (account ${instance.aws.account}, region ${instance.aws.region})
-  file: ${context.path}
-  config: ${context.configPath}`;
-}
-
-// src/deploy/sh.ts
-import { spawn as nodeSpawn } from "node:child_process";
-function formatCommand(cmd, env) {
-  const prefix = Object.entries(env ?? {}).map(([k, v]) => `${k}=${quote(v)}`).join(" ");
-  const body = cmd.map(quote).join(" ");
-  return prefix === "" ? body : `${prefix} ${body}`;
-}
-function quote(value) {
-  return /^[A-Za-z0-9_@%+=:,./-]+$/.test(value) ? value : `'${value.replaceAll("'", `'\\''`)}'`;
-}
-function start(cmd, opts, stdout) {
-  const [bin, ...rest] = cmd;
-  if (bin === undefined)
-    throw new Error("run: empty command");
-  const child = nodeSpawn(bin, rest, {
-    cwd: opts.cwd,
-    env: { ...process.env, ...opts.env },
-    stdio: [
-      opts.stdin === undefined ? "ignore" : "pipe",
-      stdout,
-      stdout === "inherit" ? "inherit" : "pipe"
-    ]
-  });
-  if (opts.stdin !== undefined && child.stdin !== null) {
-    child.stdin.end(opts.stdin);
-  }
-  return child;
-}
-function exited(child) {
-  return new Promise((resolve, reject) => {
-    child.once("error", reject);
-    child.once("close", (code, signal) => resolve(code ?? (signal === null ? 1 : 128)));
-  });
-}
-function collect(stream) {
-  if (stream === null)
-    return Promise.resolve("");
-  return new Promise((resolve, reject) => {
-    const chunks = [];
-    stream.on("data", (c) => chunks.push(c));
-    stream.once("error", reject);
-    stream.once("end", () => resolve(Buffer.concat(chunks).toString("utf8")));
-  });
-}
-async function run(cmd, opts = {}) {
-  if (opts.dryRun === true) {
-    console.log(`  $ ${formatCommand(cmd, opts.env)}`);
-    return;
-  }
-  const code = await exited(start(cmd, opts, "inherit"));
-  if (code !== 0)
-    throw new Error(`${formatCommand(cmd)} exited ${code}`);
-}
-async function runCapture(cmd, opts = {}) {
-  const child = start(cmd, opts, "pipe");
-  const [out, err, code] = await Promise.all([
-    collect(child.stdout),
-    collect(child.stderr),
-    exited(child)
-  ]);
-  if (code !== 0)
-    throw new Error(`${formatCommand(cmd)} exited ${code}: ${err.trim()}`);
-  return out.trim();
-}
-
-// src/deploy/aws.ts
-function resolveProfile(fallback, explicit, env = process.env) {
-  if (env.FOUNDATION_NO_PROFILE === "1")
-    return "";
-  if (explicit !== undefined)
-    return explicit;
-  if (env.AWS_PROFILE !== undefined && env.AWS_PROFILE !== "")
-    return env.AWS_PROFILE;
-  if (env.GITHUB_ACTIONS === "true")
-    return "";
-  return fallback;
-}
-function awsContext(overrides = {}) {
-  const env = overrides.env ?? process.env;
-  const paths = overrides.paths ?? loadInstanceFromArgs();
-  const instance = paths.instance;
-  return {
-    profile: resolveProfile(instance.aws.profile, overrides.profile, env),
-    region: overrides.region ?? env.AWS_REGION ?? instance.aws.region,
-    dryRun: overrides.dryRun ?? false,
-    instance,
-    paths,
-    names: instanceNames(instance)
-  };
-}
-function argv(ctx, args) {
-  const profile = ctx.profile === "" ? [] : ["--profile", ctx.profile];
-  return ["aws", ...args, ...profile, "--region", ctx.region];
-}
-function cdkEnv(ctx) {
-  return {
-    ...ctx.profile === "" ? {} : { AWS_PROFILE: ctx.profile },
-    AWS_REGION: ctx.region,
-    CDK_DEFAULT_REGION: ctx.region
-  };
-}
-async function aws(ctx, args, stdin) {
-  return runCapture(argv(ctx, args), { stdin });
-}
-async function awsMutate(ctx, args, stdin) {
-  if (ctx.dryRun === true) {
-    console.log(`  $ ${argv(ctx, args).join(" ")}${stdin === undefined ? "" : " < (stdin)"}`);
-    return;
-  }
-  await run(argv(ctx, args), { stdin });
-}
-async function stackOutput(ctx, stack, key) {
-  const value = await aws(ctx, [
-    "cloudformation",
-    "describe-stacks",
-    "--stack-name",
-    stack,
-    "--query",
-    `Stacks[0].Outputs[?OutputKey=='${key}'].OutputValue`,
-    "--output",
-    "text"
-  ]);
-  if (value === "" || value === "None")
-    throw new Error(`stack ${stack} has no output ${key} — has it been deployed?`);
-  return value;
-}
-async function stackExists(ctx, stack) {
-  try {
-    await aws(ctx, [
-      "cloudformation",
-      "describe-stacks",
-      "--stack-name",
-      stack,
-      "--output",
-      "text"
-    ]);
-    return true;
-  } catch {
-    return false;
-  }
-}
-async function secretExists(ctx, secretId) {
-  try {
-    await aws(ctx, [
-      "secretsmanager",
-      "describe-secret",
-      "--secret-id",
-      secretId,
-      "--output",
-      "text"
-    ]);
-    return true;
-  } catch {
-    return false;
-  }
-}
-async function readSecretString(ctx, secretId) {
-  return aws(ctx, [
-    "secretsmanager",
-    "get-secret-value",
-    "--secret-id",
-    secretId,
-    "--query",
-    "SecretString",
-    "--output",
-    "text"
-  ]);
-}
-async function readSecretJson(ctx, secretId) {
-  return JSON.parse(await readSecretString(ctx, secretId));
-}
-async function putSecretString(ctx, secretId, value) {
-  await throughSecretFile(value, (file) => awsMutate(ctx, [
-    "secretsmanager",
-    "put-secret-value",
-    "--secret-id",
-    secretId,
-    "--secret-string",
-    `file://${file}`
-  ]));
-}
-async function createSecretString(ctx, secretId, value, description) {
-  await throughSecretFile(value, (file) => awsMutate(ctx, [
-    "secretsmanager",
-    "create-secret",
-    "--name",
-    secretId,
-    "--description",
-    description,
-    "--secret-string",
-    `file://${file}`
-  ]));
-}
-async function throughSecretFile(value, body) {
-  const dir = mkdtempSync(join(tmpdir(), "foundation-secret-"));
-  const file = join(dir, "value.json");
-  try {
-    writeFileSync(file, value, { mode: 384 });
-    await body(file);
-  } finally {
-    rmSync(dir, { recursive: true, force: true });
-  }
-}
-async function putSecretJson(ctx, secretId, value) {
-  await putSecretString(ctx, secretId, JSON.stringify(value));
-}
-async function callerAccountId(ctx) {
-  return aws(ctx, ["sts", "get-caller-identity", "--query", "Account", "--output", "text"]);
-}
-
-// src/deploy/paths.ts
-import { existsSync, readFileSync } from "node:fs";
-import { dirname as dirname2, resolve } from "node:path";
-import { fileURLToPath } from "node:url";
-var PACKAGE_NAME = "@deployfoundation/foundation-deploy";
-function packageRoot(from) {
-  let dir = from;
-  for (;; ) {
-    const manifest = resolve(dir, "package.json");
-    if (existsSync(manifest)) {
-      try {
-        const { name } = JSON.parse(readFileSync(manifest, "utf8"));
-        if (name === PACKAGE_NAME)
-          return dir;
-      } catch {}
-    }
-    const parent = dirname2(dir);
-    if (parent === dir)
-      throw new Error(`cannot find the ${PACKAGE_NAME} package root above ${from}`);
-    dir = parent;
-  }
-}
-var INFRA_ROOT = packageRoot(dirname2(fileURLToPath(import.meta.url)));
-var FOUNDATION_ROOT = resolve(INFRA_ROOT, "..", "..");
-var AGENT_DOCKERFILE = "packages/infra/agent-image/Dockerfile";
-var PACKAGE_ASSETS = resolve(INFRA_ROOT, "src", "deploy", "assets");
-
-// src/deploy/release.ts
-var DEFAULT_RELEASE_BUCKET = "foundry41-foundation-releases";
-var RELEASE_KMS_KEY_ARN_ENV = "FOUNDATION_RELEASE_KMS_KEY_ARN";
-var RELEASE_KMS_KEY_ARN = "arn:aws:kms:us-east-1:793593623536:key/fba7d9f3-e9b6-49ae-b4a5-c8c5f1429231";
-function flag(args, name) {
-  const index = args.indexOf(name);
-  const value = index === -1 ? undefined : args[index + 1];
-  if (value?.startsWith("-") === true)
-    throw new Error(`${name} needs a value, e.g. ${name} ${name === "--release" ? "v0.1.0" : "…"}`);
-  const inline = args.find((arg) => arg.startsWith(`${name}=`));
-  return value ?? (inline === undefined ? undefined : inline.slice(name.length + 1));
-}
-function toolVersion(infraRoot = INFRA_ROOT) {
-  const { version } = JSON.parse(readFileSync2(join2(infraRoot, "package.json"), "utf8"));
-  return version;
-}
-function foundationVersion(release) {
-  return release?.version ?? `v${toolVersion()}`;
-}
-function hasFoundationWorkspace(foundationRoot = FOUNDATION_ROOT) {
-  return existsSync2(join2(foundationRoot, "packages", "gateway", "package.json"));
-}
-function releaseRequest(args, options = {}) {
-  const env = options.env ?? process.env;
-  const bucket = flag(args, "--release-bucket") ?? env[RELEASE_BUCKET_ENV] ?? DEFAULT_RELEASE_BUCKET;
-  const manifestRef = flag(args, "--manifest");
-  const explicit = flag(args, "--release");
-  if (explicit !== undefined) {
-    if (!RELEASE_VERSION_RE.test(explicit))
-      throw new Error(`--release wants a version like v0.1.0, not "${explicit}"`);
-    return { version: explicit, bucket, ...manifestRef === undefined ? {} : { manifestRef } };
-  }
-  if (manifestRef !== undefined)
-    return { manifestRef, bucket };
-  const workspace = options.workspace ?? hasFoundationWorkspace();
-  if (workspace)
-    return;
-  const version = `v${options.version ?? toolVersion()}`;
-  if (!RELEASE_VERSION_RE.test(version))
-    throw new Error(`this copy of foundation-deploy is version ${version.slice(1)}, which is not a release; pass --release <version>`);
-  return { version, bucket };
-}
-function expectedKeyArn(env = process.env) {
-  const configured = env[RELEASE_KMS_KEY_ARN_ENV] ?? RELEASE_KMS_KEY_ARN;
-  if (configured === undefined || configured === "")
-    throw new Error(`no Foundation release signing key is configured; set ${RELEASE_KMS_KEY_ARN_ENV} to the key ARN published with the release`);
-  return configured;
-}
-async function s3Download(ctx, bucket, key, dest) {
-  mkdirSync(dirname3(dest), { recursive: true });
-  await aws(ctx, ["s3", "cp", `s3://${bucket}/${key}`, dest]);
-}
-async function verifyRelease(ctx, request, deps = {}) {
-  const env = deps.env ?? process.env;
-  const kmsKeyArn = deps.kmsKeyArn ?? expectedKeyArn(env);
-  const download = deps.download ?? s3Download;
-  const local = localManifestRef(request);
-  const version = request.version;
-  const cacheDir = deps.cacheDir ?? releaseCacheDir(version ?? "unversioned", env);
-  const manifestPath = local ?? join2(cacheDir, "manifest.json");
-  if (local === undefined) {
-    const source = s3ManifestRef(request);
-    await download(ctx, source.bucket, source.key, manifestPath);
-  }
-  const manifest = await verifyManifest(JSON.parse(readFileSync2(manifestPath, "utf8")), {
-    kmsKeyArn,
-    kms: deps.kms ?? kmsVerifier(kmsKeyArn, ctx.profile === "" ? {} : { profile: ctx.profile }),
-    ...version === undefined ? {} : { expectVersion: version },
-    ...deps.verifyArtifacts === false ? {} : {
-      readArtifact: async (key) => {
-        const dest = join2(cacheDir, "artifacts", key.split("/").slice(-1)[0] ?? "artifact");
-        await download(ctx, request.bucket, key, dest);
-        return readFileSync2(dest);
-      }
-    }
-  });
-  return { version: manifest.version, bucket: request.bucket, manifestPath, manifest };
-}
-async function resolveRelease(ctx, request, deps = {}) {
-  return ctx.dryRun === true ? plannedRelease(request) : verifyRelease(ctx, request, deps);
-}
-function plannedRelease(request) {
-  const version = request.version ?? "<from the manifest>";
-  const local = localManifestRef(request);
-  return {
-    version,
-    bucket: request.bucket,
-    manifestPath: local ?? join2(releaseCacheDir(version), "manifest.json")
-  };
-}
-function localManifestRef(request) {
-  const ref = request.manifestRef;
-  if (ref === undefined || ref.startsWith("s3://"))
-    return;
-  return isAbsolute(ref) ? ref : resolve2(process.cwd(), ref);
-}
-function s3ManifestRef(request) {
-  const ref = request.manifestRef;
-  if (ref?.startsWith("s3://") === true) {
-    const [bucket, ...rest] = ref.slice("s3://".length).split("/");
-    const key = rest.join("/");
-    if (bucket === undefined || bucket === "" || key === "")
-      throw new Error(`--manifest ${ref} is not an s3://bucket/key URI`);
-    return { bucket, key };
-  }
-  if (request.version === undefined)
-    throw new Error("a release needs a version or a manifest to fetch");
-  return { bucket: request.bucket, key: manifestKey(request.version) };
-}
-function releaseContext(release) {
-  return [
-    "-c",
-    `release=${release.version}`,
-    "-c",
-    `releaseManifest=${release.manifestPath}`,
-    "-c",
-    `releaseBucket=${release.bucket}`
-  ];
-}
-
-export { resolveInstanceFilePath, loadInstanceContext, instanceBanner, run, runCapture, awsContext, argv, cdkEnv, aws, awsMutate, stackOutput, stackExists, secretExists, readSecretString, readSecretJson, putSecretString, createSecretString, putSecretJson, callerAccountId, INFRA_ROOT, FOUNDATION_ROOT, AGENT_DOCKERFILE, PACKAGE_ASSETS, DEFAULT_RELEASE_BUCKET, toolVersion, foundationVersion, hasFoundationWorkspace, releaseRequest, resolveRelease, releaseContext };