@fntio/infra-client 0.0.0-stage → 0.5.0

package/assets/api/vendor_modules/vary/package.json

@@ -0,0 +1,43 @@
+{
+  "name": "vary",
+  "description": "Manipulate the HTTP Vary header",
+  "version": "1.1.2",
+  "author": "Douglas Christopher Wilson <doug@somethingdoug.com>",
+  "license": "MIT",
+  "keywords": [
+    "http",
+    "res",
+    "vary"
+  ],
+  "repository": "jshttp/vary",
+  "devDependencies": {
+    "beautify-benchmark": "0.2.4",
+    "benchmark": "2.1.4",
+    "eslint": "3.19.0",
+    "eslint-config-standard": "10.2.1",
+    "eslint-plugin-import": "2.7.0",
+    "eslint-plugin-markdown": "1.0.0-beta.6",
+    "eslint-plugin-node": "5.1.1",
+    "eslint-plugin-promise": "3.5.0",
+    "eslint-plugin-standard": "3.0.1",
+    "istanbul": "0.4.5",
+    "mocha": "2.5.3",
+    "supertest": "1.1.0"
+  },
+  "files": [
+    "HISTORY.md",
+    "LICENSE",
+    "README.md",
+    "index.js"
+  ],
+  "engines": {
+    "node": ">= 0.8"
+  },
+  "scripts": {
+    "bench": "node benchmark/index.js",
+    "lint": "eslint --plugin markdown --ext js,md .",
+    "test": "mocha --reporter spec --bail --check-leaks test/",
+    "test-cov": "istanbul cover node_modules/mocha/bin/_mocha -- --reporter dot --check-leaks test/",
+    "test-travis": "istanbul cover node_modules/mocha/bin/_mocha --report lcovonly -- --reporter spec --check-leaks test/"
+  }
+}

package/assets/federation-presignup/index.js

@@ -0,0 +1,108 @@
+"use strict";
+var __defProp = Object.defineProperty;
+var __getOwnPropDesc = Object.getOwnPropertyDescriptor;
+var __getOwnPropNames = Object.getOwnPropertyNames;
+var __hasOwnProp = Object.prototype.hasOwnProperty;
+var __export = (target, all) => {
+  for (var name in all)
+    __defProp(target, name, { get: all[name], enumerable: true });
+};
+var __copyProps = (to, from, except, desc) => {
+  if (from && typeof from === "object" || typeof from === "function") {
+    for (let key of __getOwnPropNames(from))
+      if (!__hasOwnProp.call(to, key) && key !== except)
+        __defProp(to, key, { get: () => from[key], enumerable: !(desc = __getOwnPropDesc(from, key)) || desc.enumerable });
+  }
+  return to;
+};
+var __toCommonJS = (mod) => __copyProps(__defProp({}, "__esModule", { value: true }), mod);
+
+// lambdacode/federation/presignup.ts
+var presignup_exports = {};
+__export(presignup_exports, {
+  LINKED_RETRY: () => LINKED_RETRY,
+  NOT_INVITED: () => NOT_INVITED,
+  NO_EMAIL: () => NO_EMAIL,
+  handler: () => handler
+});
+module.exports = __toCommonJS(presignup_exports);
+var import_client_cognito_identity_provider = require("@aws-sdk/client-cognito-identity-provider");
+var cognito = new import_client_cognito_identity_provider.CognitoIdentityProviderClient({});
+var LINKED_RETRY = "FEDERATION_LINKED_RETRY";
+var NOT_INVITED = "FEDERATION_NOT_INVITED";
+var NO_EMAIL = "FEDERATION_NO_EMAIL";
+var log = (msg, extra = {}) => console.log(JSON.stringify({ msg, ...extra }));
+async function handler(event) {
+  if (event.triggerSource !== "PreSignUp_ExternalProvider") return event;
+  const asserted = (event.request.userAttributes.email ?? "").trim();
+  if (!asserted) {
+    log("federated sign-up without an email claim", { userName: event.userName });
+    throw new Error(`${NO_EMAIL}: the identity provider sent no email for this account.`);
+  }
+  const sep = event.userName.indexOf("_");
+  if (sep <= 0) throw new Error(`unexpected external username shape: ${event.userName}`);
+  const providerName = event.userName.slice(0, sep);
+  const subject = event.userName.slice(sep + 1);
+  const native = await findInvitedUser(event.userPoolId, asserted);
+  if (!native) {
+    log("federated sign-up refused: no invited user", { providerName, email: asserted });
+    throw new Error(`${NOT_INVITED}: no invited user with this email.`);
+  }
+  try {
+    await cognito.send(
+      new import_client_cognito_identity_provider.AdminLinkProviderForUserCommand({
+        UserPoolId: event.userPoolId,
+        DestinationUser: { ProviderName: "Cognito", ProviderAttributeValue: native },
+        SourceUser: {
+          ProviderName: providerName,
+          ProviderAttributeName: "Cognito_Subject",
+          ProviderAttributeValue: subject
+        }
+      })
+    );
+    log("linked federated identity to invited user", { providerName, email: asserted });
+  } catch (err) {
+    if (!isAlreadyLinked(err)) throw err;
+    log("federated identity was already linked", { providerName, email: asserted });
+  }
+  throw new Error(`${LINKED_RETRY}: identity linked, sign in again.`);
+}
+var isAlreadyLinked = (err) => /already linked|Already found an entry/i.test(err?.message ?? "");
+var SCAN_BUDGET_MS = 3e3;
+async function findInvitedUser(userPoolId, email) {
+  const candidates = [email, email.toLowerCase()].filter((v, i, a) => a.indexOf(v) === i);
+  const results = await Promise.all(
+    candidates.map(
+      (candidate) => cognito.send(new import_client_cognito_identity_provider.AdminGetUserCommand({ UserPoolId: userPoolId, Username: candidate })).catch((err) => {
+        if (err instanceof import_client_cognito_identity_provider.UserNotFoundException) return void 0;
+        throw err;
+      })
+    )
+  );
+  for (const user of results) {
+    if (user && user.UserStatus !== "EXTERNAL_PROVIDER" && user.Username) return user.Username;
+  }
+  return scanForEmail(userPoolId, email.toLowerCase());
+}
+async function scanForEmail(userPoolId, wanted) {
+  const deadline = Date.now() + SCAN_BUDGET_MS;
+  let PaginationToken;
+  do {
+    const page = await cognito.send(
+      new import_client_cognito_identity_provider.ListUsersCommand({ UserPoolId: userPoolId, Limit: 60, AttributesToGet: ["email"], PaginationToken })
+    );
+    for (const u of page.Users ?? []) {
+      const email = u.Attributes?.find((a) => a.Name === "email")?.Value;
+      if (u.Username && u.UserStatus !== "EXTERNAL_PROVIDER" && email?.toLowerCase() === wanted) return u.Username;
+    }
+    PaginationToken = page.PaginationToken;
+  } while (PaginationToken && Date.now() < deadline);
+  return void 0;
+}
+// Annotate the CommonJS export names for ESM import in node:
+0 && (module.exports = {
+  LINKED_RETRY,
+  NOT_INVITED,
+  NO_EMAIL,
+  handler
+});

package/assets/firstadmin/index.js

@@ -0,0 +1,361 @@
+"use strict";
+var __defProp = Object.defineProperty;
+var __getOwnPropDesc = Object.getOwnPropertyDescriptor;
+var __getOwnPropNames = Object.getOwnPropertyNames;
+var __hasOwnProp = Object.prototype.hasOwnProperty;
+var __export = (target, all) => {
+  for (var name in all)
+    __defProp(target, name, { get: all[name], enumerable: true });
+};
+var __copyProps = (to, from, except, desc) => {
+  if (from && typeof from === "object" || typeof from === "function") {
+    for (let key of __getOwnPropNames(from))
+      if (!__hasOwnProp.call(to, key) && key !== except)
+        __defProp(to, key, { get: () => from[key], enumerable: !(desc = __getOwnPropDesc(from, key)) || desc.enumerable });
+  }
+  return to;
+};
+var __toCommonJS = (mod) => __copyProps(__defProp({}, "__esModule", { value: true }), mod);
+
+// lambdacode/firstadmin/handler.ts
+var handler_exports = {};
+__export(handler_exports, {
+  handler: () => handler
+});
+module.exports = __toCommonJS(handler_exports);
+var import_client_cognito_identity_provider = require("@aws-sdk/client-cognito-identity-provider");
+
+// lambdacode/api/services/actorContext.ts
+var import_async_hooks = require("async_hooks");
+var store = new import_async_hooks.AsyncLocalStorage();
+function currentActor() {
+  return store.getStore();
+}
+var systemActor = (job, name) => ({
+  kind: "system",
+  id: `system:${job}`,
+  name: name ?? job
+});
+
+// lambdacode/api/services/auditService.ts
+var import_crypto = require("crypto");
+var import_client_dynamodb2 = require("@aws-sdk/client-dynamodb");
+var import_lib_dynamodb2 = require("@aws-sdk/lib-dynamodb");
+
+// lambdacode/api/services/access.ts
+var import_client_dynamodb = require("@aws-sdk/client-dynamodb");
+
+// ../infra-client-plugin-sdk/src/contracts/manifest.ts
+var PLUGIN_PERMISSIONS = ["user", "admin"];
+var PLUGIN_ID_PATTERN = /^[a-z][a-z0-9-]{0,63}$/;
+var AWS_ACCOUNT_PATTERN = /^\d{12}$/;
+
+// ../infra-client-plugin-sdk/src/contracts/access.ts
+var PLUGIN_TARGET_PREFIX = "plugin#";
+function parsePluginTargetKey(key) {
+  if (!key.startsWith(PLUGIN_TARGET_PREFIX)) return null;
+  const parts = key.slice(PLUGIN_TARGET_PREFIX.length).split("#");
+  if (parts.length !== 3) return null;
+  const [pluginId, accountNumber, permission] = parts;
+  if (!PLUGIN_ID_PATTERN.test(pluginId) || !AWS_ACCOUNT_PATTERN.test(accountNumber)) return null;
+  if (!PLUGIN_PERMISSIONS.includes(permission)) return null;
+  return { pluginId, accountNumber, permission };
+}
+
+// lambdacode/api/services/access.ts
+var import_lib_dynamodb = require("@aws-sdk/lib-dynamodb");
+var ddb = import_lib_dynamodb.DynamoDBDocumentClient.from(new import_client_dynamodb.DynamoDBClient({}));
+var ACCESS_TABLE_NAME = process.env.ACCESS_TABLE_NAME;
+function parseTarget(t) {
+  if (t.startsWith("role#")) {
+    const rest = t.slice(5);
+    const hash = rest.indexOf("#");
+    if (hash < 0) return null;
+    return { kind: "role", accountNumber: rest.slice(0, hash), roleName: rest.slice(hash + 1) };
+  }
+  if (t.startsWith("resource#")) return { kind: "resource", resourceId: t.slice(9) };
+  if (t.startsWith("share#")) return { kind: "share", shareId: t.slice(6) };
+  if (t.startsWith("plugin#")) {
+    const p = parsePluginTargetKey(t);
+    return p ? { kind: "plugin", ...p } : null;
+  }
+  if (t.startsWith("member#")) return { kind: "member", groupId: t.slice(7) };
+  if (t.startsWith("pref#role#")) {
+    const rest = t.slice(10);
+    const hash = rest.indexOf("#");
+    if (hash < 0) return null;
+    return { kind: "pref", accountNumber: rest.slice(0, hash), roleName: rest.slice(hash + 1) };
+  }
+  return null;
+}
+
+// lambdacode/api/services/auditService.ts
+var ddb2 = import_lib_dynamodb2.DynamoDBDocumentClient.from(new import_client_dynamodb2.DynamoDBClient({}));
+var tableName = () => process.env.AUDIT_TABLE_NAME ?? "";
+var log = (msg, extra = {}) => console.log(JSON.stringify({ msg, ...extra }));
+var DEFAULT_RETENTION_DAYS = 400;
+var REASON_MAX = 300;
+var NOTE_MAX = 500;
+var AFFECTED_CAP = 50;
+var DAY_MS = 24 * 60 * 60 * 1e3;
+function retentionDays() {
+  const n = Number(process.env.AUDIT_RETENTION_DAYS);
+  return Number.isInteger(n) && n > 0 ? n : DEFAULT_RETENTION_DAYS;
+}
+var UNKNOWN_ACTOR = { kind: "system", id: "system:unknown" };
+var warnedNoTable = false;
+function tableOr() {
+  const table = tableName();
+  if (table) return table;
+  if (!warnedNoTable) {
+    warnedNoTable = true;
+    log("WARN: AUDIT_TABLE_NAME unset \u2014 activity is not recorded");
+  }
+  return void 0;
+}
+function compact(value) {
+  if (Array.isArray(value)) return value.map(compact);
+  if (value && typeof value === "object" && !(value instanceof Set)) {
+    const out = {};
+    for (const [k, v] of Object.entries(value)) {
+      if (v !== void 0) out[k] = compact(v);
+    }
+    return out;
+  }
+  return value;
+}
+var SESSION_ACTIONS = /* @__PURE__ */ new Set(["vpn.connect", "vpn.disconnect"]);
+function toRow(input, now) {
+  const bound = input.actor ?? currentActor();
+  if (!bound) log("ERROR: activity row without a bound actor (missing runAsActor?)", { action: input.action, target: input.target });
+  const actor = bound ?? UNKNOWN_ACTOR;
+  const details = input.details ? { ...input.details } : void 0;
+  if (details?.note !== void 0) details.note = String(details.note).slice(0, NOTE_MAX);
+  if (details?.affected && details.affected.length > AFFECTED_CAP) {
+    details.affectedCount = details.affected.length;
+    details.affected = details.affected.slice(0, AFFECTED_CAP);
+  }
+  if (details?.unchanged && details.unchanged.length > AFFECTED_CAP) {
+    details.unchangedCount = details.unchanged.length;
+    details.unchanged = details.unchanged.slice(0, AFFECTED_CAP);
+  }
+  const accountNumber = input.accountNumber ?? accountOf(input.target);
+  return compact({
+    ...input,
+    eventId: (0, import_crypto.randomUUID)(),
+    outcome: input.outcome ?? "OK",
+    reason: input.reason === void 0 ? void 0 : String(input.reason).slice(0, REASON_MAX),
+    actor: { kind: actor.kind, id: actor.id, name: actor.name, claims: actor.claims && Object.keys(actor.claims).length ? actor.claims : void 0 },
+    accountNumber,
+    details,
+    at: now.toISOString(),
+    day: now.toISOString().slice(0, 10),
+    userId: input.subject?.id,
+    actorId: SESSION_ACTIONS.has(input.action) && input.subject?.kind === "user" ? input.subject.id : actor.id,
+    expiresAt: Math.floor(now.getTime() / 1e3) + retentionDays() * 24 * 60 * 60
+  });
+}
+function accountOf(target) {
+  if (!target) return void 0;
+  const p = parseTarget(target);
+  if (p?.kind === "role" || p?.kind === "plugin") return p.accountNumber;
+  if (target.startsWith("account#")) return target.slice("account#".length);
+  return void 0;
+}
+async function recordEvent(input) {
+  const table = tableOr();
+  if (!table) return;
+  const row = toRow(input, /* @__PURE__ */ new Date());
+  try {
+    await ddb2.send(new import_lib_dynamodb2.PutCommand({ TableName: table, Item: row }));
+    log("activity recorded", { action: row.action, outcome: row.outcome, actor: row.actorId, subject: row.userId, target: row.target, eventId: row.eventId });
+  } catch (err) {
+    log("ERROR: activity write failed (mutation unaffected)", { action: row.action, target: row.target, error: err.message });
+  }
+}
+
+// lambdacode/api/services/tempPassword.ts
+var import_crypto2 = require("crypto");
+var TEMP_PW_SETS = [
+  "ABCDEFGHJKMNPQRSTUVWXYZ",
+  "abcdefghjkmnpqrstuvwxyz",
+  "23456789",
+  "!$*._~-"
+];
+function tempPassword(len = 24) {
+  const all = TEMP_PW_SETS.join("");
+  const chars = TEMP_PW_SETS.map((s) => s[(0, import_crypto2.randomInt)(s.length)]);
+  while (chars.length < len) chars.push(all[(0, import_crypto2.randomInt)(all.length)]);
+  for (let i = chars.length - 1; i > 0; i--) {
+    const j = (0, import_crypto2.randomInt)(i + 1);
+    [chars[i], chars[j]] = [chars[j], chars[i]];
+  }
+  return chars.join("");
+}
+
+// lambdacode/firstadmin/handler.ts
+var cognito = new import_client_cognito_identity_provider.CognitoIdentityProviderClient({});
+var USER_POOL_ID = process.env.USER_POOL_ID;
+var ADMIN_GROUP = "admins";
+var TRANSIENT = /* @__PURE__ */ new Set(["TooManyRequestsException", "InternalErrorException"]);
+var log2 = (msg, extra = {}) => console.log(JSON.stringify({ msg, ...extra }));
+async function findByEmail(email) {
+  try {
+    const user = await cognito.send(
+      new import_client_cognito_identity_provider.AdminGetUserCommand({ UserPoolId: USER_POOL_ID, Username: email })
+    );
+    return {
+      status: user.UserStatus,
+      sub: user.UserAttributes?.find((a) => a.Name === "sub")?.Value
+    };
+  } catch (err) {
+    if (err instanceof import_client_cognito_identity_provider.UserNotFoundException) return void 0;
+    throw err;
+  }
+}
+var createUser = async (email, suppress) => {
+  const res = await cognito.send(
+    new import_client_cognito_identity_provider.AdminCreateUserCommand({
+      UserPoolId: USER_POOL_ID,
+      Username: email,
+      UserAttributes: [
+        { Name: "email", Value: email },
+        { Name: "email_verified", Value: "true" }
+      ],
+      TemporaryPassword: tempPassword(),
+      DesiredDeliveryMediums: ["EMAIL"],
+      ...suppress ? { MessageAction: "SUPPRESS" } : {}
+    })
+  );
+  return res.User?.Attributes?.find((a) => a.Name === "sub")?.Value;
+};
+var resendInvite = (email) => cognito.send(
+  new import_client_cognito_identity_provider.AdminCreateUserCommand({
+    UserPoolId: USER_POOL_ID,
+    Username: email,
+    MessageAction: "RESEND",
+    TemporaryPassword: tempPassword(),
+    DesiredDeliveryMediums: ["EMAIL"]
+  })
+);
+async function ensureAccount(email) {
+  let user = await findByEmail(email);
+  if (!user) {
+    try {
+      const sub = await createUser(email, false);
+      log2("first admin created + invited", { email });
+      return { user: sub ? { sub } : void 0, invite: "sent", created: true };
+    } catch (err) {
+      if (err instanceof import_client_cognito_identity_provider.UsernameExistsException) {
+        user = await findByEmail(email);
+      } else if (TRANSIENT.has(err.name)) {
+        throw err;
+      } else {
+        let sub;
+        try {
+          sub = await createUser(email, true);
+        } catch (err2) {
+          if (!(err2 instanceof import_client_cognito_identity_provider.UsernameExistsException)) throw err2;
+        }
+        log2("first admin created WITHOUT invite \u2014 the email send failed", {
+          email,
+          error: String(err)
+        });
+        return { user: sub ? { sub } : void 0, invite: "suppressed", created: true };
+      }
+    }
+    if (!user) return { invite: "unknown" };
+  }
+  if (user.status === "FORCE_CHANGE_PASSWORD") {
+    try {
+      await resendInvite(email);
+      log2("first admin invite re-sent", { email });
+      return { user, invite: "sent" };
+    } catch (err) {
+      log2("first admin invite re-send failed \u2014 the account is unchanged", {
+        email,
+        error: String(err)
+      });
+      return { user, invite: "suppressed" };
+    }
+  }
+  if (user.status === "CONFIRMED") {
+    log2("first admin already active \u2014 ensuring group only", { email });
+    return { user, invite: "already-active" };
+  }
+  log2(
+    "first admin exists in an unexpected state \u2014 no invite sent; resolve the account by hand",
+    { email, status: user.status }
+  );
+  return { user, invite: "blocked" };
+}
+async function inAdminsGroup(username) {
+  try {
+    const res = await cognito.send(new import_client_cognito_identity_provider.AdminListGroupsForUserCommand({ UserPoolId: USER_POOL_ID, Username: username }));
+    return (res.Groups ?? []).some((g) => g.GroupName === ADMIN_GROUP);
+  } catch (err) {
+    log2("WARN: could not read the first admin's groups", { error: err.message });
+    return void 0;
+  }
+}
+async function recordPromotion(sub, email) {
+  try {
+    await recordEvent({
+      category: "users",
+      action: "user.admin.grant",
+      actor: systemActor("deploy"),
+      subject: { kind: "user", id: sub, name: email },
+      target: `user#${sub}`,
+      targetName: email,
+      details: { firstAdmin: true }
+    });
+  } catch (err) {
+    log2("WARN: first admin promotion row not written", { error: err.message });
+  }
+}
+async function recordInvite(sub, email) {
+  try {
+    await recordEvent({
+      category: "users",
+      action: "user.invite",
+      actor: systemActor("deploy"),
+      subject: { kind: "user", id: sub, name: email },
+      target: `user#${sub}`,
+      details: { admin: true, firstAdmin: true }
+    });
+  } catch (err) {
+    log2("WARN: first admin invite row not written", { email, error: err.message });
+  }
+}
+async function handler(event) {
+  const physical = "first-admin";
+  if (event.RequestType === "Delete") {
+    return { PhysicalResourceId: physical, Data: { InviteSent: "n/a" } };
+  }
+  const email = (event.ResourceProperties.Email ?? "").trim().toLowerCase();
+  if (!email) throw new Error("FirstAdmin: Email property is required");
+  const oldEmail = event.OldResourceProperties?.Email?.trim().toLowerCase();
+  if (oldEmail && oldEmail !== email) {
+    log2(
+      "first admin email changed \u2014 the previous account keeps its admins membership; retire it from the Users page",
+      { previous: oldEmail, email }
+    );
+  }
+  const { user, invite, created } = await ensureAccount(email);
+  const alreadyAdmin = created ? false : await inAdminsGroup(user?.sub ?? email);
+  await cognito.send(
+    new import_client_cognito_identity_provider.AdminAddUserToGroupCommand({
+      UserPoolId: USER_POOL_ID,
+      // The email works as Username too (sign-in alias) when no sub is known.
+      Username: user?.sub ?? email,
+      GroupName: ADMIN_GROUP
+    })
+  );
+  if (created) await recordInvite(user?.sub ?? email, email);
+  else if (alreadyAdmin === false) await recordPromotion(user?.sub ?? email, email);
+  return { PhysicalResourceId: physical, Data: { InviteSent: invite } };
+}
+// Annotate the CommonJS export names for ESM import in node:
+0 && (module.exports = {
+  handler
+});

package/assets/headscale-apikey/index.js

@@ -0,0 +1,140 @@
+"use strict";
+var __defProp = Object.defineProperty;
+var __getOwnPropDesc = Object.getOwnPropertyDescriptor;
+var __getOwnPropNames = Object.getOwnPropertyNames;
+var __hasOwnProp = Object.prototype.hasOwnProperty;
+var __export = (target, all) => {
+  for (var name in all)
+    __defProp(target, name, { get: all[name], enumerable: true });
+};
+var __copyProps = (to, from, except, desc) => {
+  if (from && typeof from === "object" || typeof from === "function") {
+    for (let key of __getOwnPropNames(from))
+      if (!__hasOwnProp.call(to, key) && key !== except)
+        __defProp(to, key, { get: () => from[key], enumerable: !(desc = __getOwnPropDesc(from, key)) || desc.enumerable });
+  }
+  return to;
+};
+var __toCommonJS = (mod) => __copyProps(__defProp({}, "__esModule", { value: true }), mod);
+
+// lambdacode/headscale-apikey/handler.ts
+var handler_exports = {};
+__export(handler_exports, {
+  handler: () => handler,
+  timing: () => timing
+});
+module.exports = __toCommonJS(handler_exports);
+var import_client_ecs = require("@aws-sdk/client-ecs");
+var import_client_cloudwatch_logs = require("@aws-sdk/client-cloudwatch-logs");
+var import_client_secrets_manager = require("@aws-sdk/client-secrets-manager");
+var ecs = new import_client_ecs.ECSClient({});
+var logsClient = new import_client_cloudwatch_logs.CloudWatchLogsClient({});
+var secrets = new import_client_secrets_manager.SecretsManagerClient({});
+var WAIT_TIMEOUT_MS = 8 * 6e4;
+var KEY_CONTAINER = "headscale";
+var timing = { poll: 15e3, logLag: 5e3 };
+var log = (msg, extra = {}) => console.log(JSON.stringify({ msg, ...extra }));
+var sleep = (ms) => new Promise((r) => setTimeout(r, ms));
+async function currentSecret(name) {
+  try {
+    const v = await secrets.send(new import_client_secrets_manager.GetSecretValueCommand({ SecretId: name }));
+    return v.SecretString?.trim() || void 0;
+  } catch (err) {
+    if (err instanceof import_client_secrets_manager.ResourceNotFoundException) return void 0;
+    throw err;
+  }
+}
+async function storeSecret(name, value) {
+  try {
+    await secrets.send(
+      new import_client_secrets_manager.CreateSecretCommand({
+        Name: name,
+        SecretString: value,
+        Description: "Headscale admin API key (minted by the deploy)"
+      })
+    );
+  } catch (err) {
+    if (!(err instanceof import_client_secrets_manager.ResourceExistsException)) throw err;
+    await secrets.send(new import_client_secrets_manager.PutSecretValueCommand({ SecretId: name, SecretString: value }));
+  }
+}
+async function awaitBootstrapTask(p, deadline) {
+  while (Date.now() < deadline) {
+    const svc = (await ecs.send(
+      new import_client_ecs.DescribeServicesCommand({ cluster: p.ClusterArn, services: [p.ServiceName] })
+    )).services?.[0];
+    if ((svc?.runningCount ?? 0) >= 1) {
+      const arns = (await ecs.send(
+        new import_client_ecs.ListTasksCommand({
+          cluster: p.ClusterArn,
+          serviceName: p.ServiceName,
+          desiredStatus: "RUNNING"
+        })
+      )).taskArns ?? [];
+      if (arns.length) {
+        const tasks = (await ecs.send(new import_client_ecs.DescribeTasksCommand({ cluster: p.ClusterArn, tasks: arns }))).tasks ?? [];
+        tasks.sort((a, b) => (b.startedAt?.getTime() ?? 0) - (a.startedAt?.getTime() ?? 0));
+        const task = tasks[0];
+        const server = task?.containers?.find((c) => c.name === KEY_CONTAINER);
+        if (server?.lastStatus === "STOPPED") {
+          throw new Error(
+            `${KEY_CONTAINER} exited ${server.exitCode} in task ${task.taskArn} \u2014 see its log stream`
+          );
+        }
+        if (server?.lastStatus === "RUNNING" && server.healthStatus === "HEALTHY") {
+          return task.taskArn.split("/").pop();
+        }
+      }
+    }
+    await sleep(timing.poll);
+  }
+  throw new Error(`service ${p.ServiceName} never had a healthy ${KEY_CONTAINER} container in time`);
+}
+var KEY_RE = /^APIKEY="?([A-Za-z0-9_-]+\.[A-Za-z0-9_-]{16,})"?,?$/;
+async function readMintedKey(p, taskId, deadline) {
+  let lines = [];
+  do {
+    await sleep(timing.logLag);
+    const events = await logsClient.send(
+      new import_client_cloudwatch_logs.GetLogEventsCommand({
+        logGroupName: p.LogGroupName,
+        logStreamName: `${p.StreamPrefix}/${KEY_CONTAINER}/${taskId}`,
+        startFromHead: true
+      })
+    );
+    lines = (events.events ?? []).map((e) => (e.message ?? "").trim()).filter(Boolean);
+    for (const line of [...lines].reverse()) {
+      const m = KEY_RE.exec(line);
+      if (m) return m[1];
+    }
+    await sleep(timing.poll);
+  } while (Date.now() < deadline);
+  throw new Error(`no API key in the ${KEY_CONTAINER} output of task ${taskId} (${lines.length} lines)`);
+}
+async function handler(event) {
+  const p = event.ResourceProperties;
+  const physical = `headscale-apikey-${p.SiteId ?? "unknown"}`;
+  if (event.RequestType === "Delete") {
+    return { PhysicalResourceId: physical, Data: { Source: "kept" } };
+  }
+  for (const k of ["SiteId", "SecretName", "ClusterArn", "ServiceName", "LogGroupName", "StreamPrefix"]) {
+    if (!p[k]) throw new Error(`HeadscaleApiKey: ${k} property is required`);
+  }
+  const rotated = event.RequestType === "Update" && !!p.Rotation && p.Rotation !== event.OldResourceProperties?.Rotation;
+  const existing = await currentSecret(p.SecretName);
+  if (existing && !rotated) {
+    log("api key adopted", { site: p.SiteId, secret: p.SecretName });
+    return { PhysicalResourceId: physical, Data: { Source: "existing" } };
+  }
+  const deadline = Date.now() + WAIT_TIMEOUT_MS;
+  const taskId = await awaitBootstrapTask(p, deadline);
+  const key = await readMintedKey(p, taskId, deadline);
+  await storeSecret(p.SecretName, key);
+  log(rotated ? "api key rotated" : "api key minted", { site: p.SiteId, secret: p.SecretName, taskId });
+  return { PhysicalResourceId: physical, Data: { Source: rotated ? "rotated" : "created" } };
+}
+// Annotate the CommonJS export names for ESM import in node:
+0 && (module.exports = {
+  handler,
+  timing
+});