@geekmidas/cli 10.0.0-alpha.11 → 10.0.0-alpha.111

package/dist/projectBucket-C_DN4WzF.mjs

@@ -0,0 +1,222 @@
+import { t as GkmError } from "./errors-D8Gwp5kU.mjs";
+import "./identity-CBXr4wNi.mjs";
+import { createHash } from "node:crypto";
+//#region src/providers/projectBucket.ts
+/**
+* The project bucket: one S3 bucket per project and AWS account, created and
+* owned by gkm, that holds what gkm keeps for every stage — the deploy state
+* under `<prefix>/<project>/<stage>/`, and anything else gkm writes per stage
+* beside it.
+*
+* Nothing can record its name — the deploy state lives in it — so the name is
+* worked out the same way every time: `gkm-<scope>-<account id>`, the scope
+* being the one the `s3` objects provider names its buckets with. The account
+* id keeps it from clashing with another account's project of the same name
+* without a random suffix; a clash that happens anyway (HeadBucket 403) is
+* refused, never adopted.
+*
+* Created with versioning, SSE-S3, every public access blocked, ownership
+* enforced for the bucket owner, a lifecycle that expires old versions, and
+* the tag `gkm:project=<identity key>`.
+*/
+/** What the project part may take: 63 less `gkm-`, `-` and a 12-digit id. */
+const SCOPE_MAX = 46;
+/** The tag the bucket is created with, as the `s3` provider tags its own. */
+const PROJECT_BUCKET_TAG = "gkm:project";
+/** The bucket's name is held by another account, or cannot be reached. */
+var ProjectBucketTaken = class extends GkmError {
+	bucket;
+	status;
+	constructor(bucket, status) {
+		super(`The project bucket '${bucket}' ${status === 301 ? "is in another region than the one configured" : "exists and this account cannot reach it — another account holds the name"} (HTTP ${status}). Name a bucket you own instead — in gkm.config.ts: state: { provider: 's3', bucket: '<your bucket>', region: '<its region>' } — or run with the credentials of the account the name is for.`);
+		this.bucket = bucket;
+		this.status = status;
+		this.name = "ProjectBucketTaken";
+	}
+};
+/** The running credentials may not create the project bucket. */
+var ProjectBucketNotCreatable = class extends GkmError {
+	bucket;
+	reason;
+	constructor(bucket, reason) {
+		super(`The project bucket '${bucket}' does not exist yet, and these credentials cannot create it (${reason}). Run the first deploy with credentials allowed s3:CreateBucket and the bucket put-config actions on it — \`gkm deploy:github\` grants them to the CI role — or name an existing bucket: state: { provider: 's3', bucket, region }.`);
+		this.bucket = bucket;
+		this.reason = reason;
+		this.name = "ProjectBucketNotCreatable";
+	}
+};
+/** {@link projectBucket}, from a deploy identity's scope. */
+function projectBucketName(scope, accountId) {
+	let part = scope.toLowerCase().replace(/[^a-z0-9]+/g, "-").replace(/^-+|-+$/g, "");
+	if (part.length > SCOPE_MAX) {
+		const hash = createHash("sha256").update(scope).digest("hex").slice(0, 6);
+		part = `${part.slice(0, 39).replace(/-+$/, "")}-${hash}`;
+	}
+	return `gkm-${part}-${accountId}`;
+}
+/** The account the credentials are in — what the bucket is named by. */
+async function callerAccountId(sts) {
+	const { GetCallerIdentityCommand } = await import("@aws-sdk/client-sts");
+	const { Account } = await sts.send(new GetCallerIdentityCommand({}));
+	return Account ?? "";
+}
+/**
+* The bucket's whole lifecycle configuration. A put replaces every rule the
+* bucket has, so this is the one place the set is built: the bucket's own
+* noncurrent-version expiry, and any per-prefix expiry passed in.
+*/
+function projectBucketLifecycle(expiries = []) {
+	return [{
+		ID: "gkm-noncurrent-versions",
+		Status: "Enabled",
+		Filter: { Prefix: "" },
+		NoncurrentVersionExpiration: { NoncurrentDays: 90 },
+		Expiration: { ExpiredObjectDeleteMarker: true }
+	}, ...expiries.map((expiry) => ({
+		ID: expiry.id,
+		Status: "Enabled",
+		Filter: { Prefix: expiry.prefix },
+		Expiration: { Days: expiry.days },
+		...expiry.abortIncompleteDays ? { AbortIncompleteMultipartUpload: { DaysAfterInitiation: expiry.abortIncompleteDays } } : {}
+	}))];
+}
+/** A lifecycle rule reduced to what gkm sets, for comparing with what is there. */
+function canonicalRule(rule) {
+	return JSON.stringify({
+		id: rule.ID ?? "",
+		status: rule.Status ?? "",
+		prefix: rule.Filter?.Prefix ?? rule.Prefix ?? "",
+		days: rule.Expiration?.Days ?? null,
+		markers: rule.Expiration?.ExpiredObjectDeleteMarker ?? null,
+		noncurrent: rule.NoncurrentVersionExpiration?.NoncurrentDays ?? null,
+		abort: rule.AbortIncompleteMultipartUpload?.DaysAfterInitiation ?? null
+	});
+}
+/** Whether two rule sets say the same thing, in any order. */
+function sameLifecycle(a, b) {
+	const canonical = (rules) => rules.map(canonicalRule).sort().join("\n");
+	return canonical(a) === canonical(b);
+}
+/**
+* The project bucket's lifecycle put to {@link projectBucketLifecycle} of
+* `expiries` — every stage's — when what it holds says anything else.
+* Returns whether it was put; with `dryRun`, whether it would be.
+*/
+async function reconcileProjectBucketLifecycle(s3, bucket, expiries, options = {}) {
+	const S3 = await import("@aws-sdk/client-s3");
+	const rules = projectBucketLifecycle(expiries);
+	let current = [];
+	try {
+		current = (await s3.send(new S3.GetBucketLifecycleConfigurationCommand({ Bucket: bucket }))).Rules ?? [];
+	} catch (error) {
+		const failure = error;
+		if ((failure.Code ?? failure.name) !== "NoSuchLifecycleConfiguration") throw error;
+	}
+	if (sameLifecycle(current, rules)) return false;
+	if (!options.dryRun) await s3.send(new S3.PutBucketLifecycleConfigurationCommand({
+		Bucket: bucket,
+		LifecycleConfiguration: { Rules: rules }
+	}));
+	return true;
+}
+/**
+* Whether `bucket` is this account's (`ours`) or does not exist (`none`).
+* Mapped by status: a HEAD has no body, so SDK v3 names a 301, 400 or 403
+* `Unknown`.
+*
+* @throws {ProjectBucketTaken} on a 403 or 301
+*/
+async function findProjectBucket(s3, bucket) {
+	const { HeadBucketCommand } = await import("@aws-sdk/client-s3");
+	try {
+		await s3.send(new HeadBucketCommand({ Bucket: bucket }));
+		return "ours";
+	} catch (error) {
+		const status = error.$metadata?.httpStatusCode;
+		if (status === 404) return "none";
+		if (status === 403 || status === 301) throw new ProjectBucketTaken(bucket, status);
+		throw error;
+	}
+}
+/**
+* The project bucket, created and configured if it does not exist yet.
+* Returns whether this call created it. One that exists is used as it is.
+*
+* @throws {ProjectBucketTaken} when another account holds the name
+* @throws {ProjectBucketNotCreatable} when the credentials may not create it
+*/
+async function ensureProjectBucket(s3, options) {
+	const { bucket: Bucket, region } = options;
+	if (await findProjectBucket(s3, Bucket) === "ours") return { created: false };
+	const S3 = await import("@aws-sdk/client-s3");
+	try {
+		await s3.send(new S3.CreateBucketCommand({
+			Bucket,
+			ObjectOwnership: "BucketOwnerEnforced",
+			...region === "us-east-1" ? {} : { CreateBucketConfiguration: { LocationConstraint: region } }
+		}));
+	} catch (error) {
+		const failure = error;
+		const code = failure.Code ?? failure.name;
+		if (code !== "BucketAlreadyOwnedByYou") {
+			if (code === "BucketAlreadyExists") throw new ProjectBucketTaken(Bucket, 409);
+			if (code === "AccessDenied" || failure.$metadata?.httpStatusCode === 403) throw new ProjectBucketNotCreatable(Bucket, failure.message ?? "AccessDenied");
+			throw error;
+		}
+	}
+	await s3.send(new S3.PutPublicAccessBlockCommand({
+		Bucket,
+		PublicAccessBlockConfiguration: {
+			BlockPublicAcls: true,
+			IgnorePublicAcls: true,
+			BlockPublicPolicy: true,
+			RestrictPublicBuckets: true
+		}
+	}));
+	await s3.send(new S3.PutBucketOwnershipControlsCommand({
+		Bucket,
+		OwnershipControls: { Rules: [{ ObjectOwnership: "BucketOwnerEnforced" }] }
+	}));
+	await s3.send(new S3.PutBucketEncryptionCommand({
+		Bucket,
+		ServerSideEncryptionConfiguration: { Rules: [{ ApplyServerSideEncryptionByDefault: { SSEAlgorithm: "AES256" } }] }
+	}));
+	await s3.send(new S3.PutBucketVersioningCommand({
+		Bucket,
+		VersioningConfiguration: { Status: "Enabled" }
+	}));
+	await s3.send(new S3.PutBucketLifecycleConfigurationCommand({
+		Bucket,
+		LifecycleConfiguration: { Rules: projectBucketLifecycle(options.expiries) }
+	}));
+	await s3.send(new S3.PutBucketTaggingCommand({
+		Bucket,
+		Tagging: { TagSet: [{
+			Key: PROJECT_BUCKET_TAG,
+			Value: options.identity.key
+		}] }
+	}));
+	return { created: true };
+}
+/**
+* The IAM actions creating and configuring the project bucket takes — what a
+* role that runs the first deploy needs on it, beside object access.
+*/
+const PROJECT_BUCKET_CREATE_ACTIONS = [
+	"s3:CreateBucket",
+	"s3:PutBucketVersioning",
+	"s3:PutEncryptionConfiguration",
+	"s3:PutBucketPublicAccessBlock",
+	"s3:PutBucketOwnershipControls",
+	"s3:PutLifecycleConfiguration",
+	"s3:PutBucketTagging"
+];
+/**
+* What keeping the project bucket's lifecycle takes on a bucket that exists:
+* reading it, to put it back only when it drifted.
+*/
+const PROJECT_BUCKET_LIFECYCLE_ACTIONS = ["s3:GetLifecycleConfiguration", "s3:PutLifecycleConfiguration"];
+//#endregion
+export { findProjectBucket as a, ensureProjectBucket as i, PROJECT_BUCKET_LIFECYCLE_ACTIONS as n, projectBucketName as o, callerAccountId as r, reconcileProjectBucketLifecycle as s, PROJECT_BUCKET_CREATE_ACTIONS as t };
+
+//# sourceMappingURL=projectBucket-C_DN4WzF.mjs.map

package/dist/projectBucket-C_DN4WzF.mjs.map

@@ -0,0 +1 @@
+{"version":3,"file":"projectBucket-C_DN4WzF.mjs","names":[],"sources":["../src/providers/projectBucket.ts"],"sourcesContent":["/**\n * The project bucket: one S3 bucket per project and AWS account, created and\n * owned by gkm, that holds what gkm keeps for every stage — the deploy state\n * under `<prefix>/<project>/<stage>/`, and anything else gkm writes per stage\n * beside it.\n *\n * Nothing can record its name — the deploy state lives in it — so the name is\n * worked out the same way every time: `gkm-<scope>-<account id>`, the scope\n * being the one the `s3` objects provider names its buckets with. The account\n * id keeps it from clashing with another account's project of the same name\n * without a random suffix; a clash that happens anyway (HeadBucket 403) is\n * refused, never adopted.\n *\n * Created with versioning, SSE-S3, every public access blocked, ownership\n * enforced for the bucket owner, a lifecycle that expires old versions, and\n * the tag `gkm:project=<identity key>`.\n */\n\nimport { createHash } from 'node:crypto';\nimport type {\n\tBucketLocationConstraint,\n\tLifecycleRule,\n\tS3Client,\n} from '@aws-sdk/client-s3';\nimport type { STSClient } from '@aws-sdk/client-sts';\nimport { type DeployIdentity, deployIdentity } from '../deploy/identity.js';\nimport { GkmError } from '../errors';\n\n/** S3's limit on a bucket name. */\nconst BUCKET_NAME_MAX = 63;\n/** What the project part may take: 63 less `gkm-`, `-` and a 12-digit id. */\nconst SCOPE_MAX = BUCKET_NAME_MAX - 'gkm-'.length - 1 - 12;\n\n/** The tag the bucket is created with, as the `s3` provider tags its own. */\nexport const PROJECT_BUCKET_TAG = 'gkm:project';\n\n/** How long a replaced or deleted object's old version is kept. */\nexport const NONCURRENT_VERSION_DAYS = 90;\n\n/** The bucket's name is held by another account, or cannot be reached. */\nexport class ProjectBucketTaken extends GkmError {\n\tconstructor(\n\t\treadonly bucket: string,\n\t\t/** HeadBucket's status: 403 another account's, 301 another region's. */\n\t\treadonly status: number,\n\t) {\n\t\tconst why =\n\t\t\tstatus === 301\n\t\t\t\t? 'is in another region than the one configured'\n\t\t\t\t: 'exists and this account cannot reach it — another account holds the name';\n\t\tsuper(\n\t\t\t`The project bucket '${bucket}' ${why} (HTTP ${status}). Name a bucket ` +\n\t\t\t\t\"you own instead — in gkm.config.ts: state: { provider: 's3', \" +\n\t\t\t\t\"bucket: '<your bucket>', region: '<its region>' } — or run with the \" +\n\t\t\t\t'credentials of the account the name is for.',\n\t\t);\n\t\tthis.name = 'ProjectBucketTaken';\n\t}\n}\n\n/** The running credentials may not create the project bucket. */\nexport class ProjectBucketNotCreatable extends GkmError {\n\tconstructor(\n\t\treadonly bucket: string,\n\t\treadonly reason: string,\n\t) {\n\t\tsuper(\n\t\t\t`The project bucket '${bucket}' does not exist yet, and these ` +\n\t\t\t\t`credentials cannot create it (${reason}). Run the first deploy with ` +\n\t\t\t\t'credentials allowed s3:CreateBucket and the bucket put-config ' +\n\t\t\t\t'actions on it — `gkm deploy:github` grants them to the CI role — ' +\n\t\t\t\t\"or name an existing bucket: state: { provider: 's3', bucket, region }.\",\n\t\t);\n\t\tthis.name = 'ProjectBucketNotCreatable';\n\t}\n}\n\n/**\n * The project bucket's name: `gkm-<scope>-<account id>`, lowercase and\n * DNS-safe. A scope too long to fit keeps its start and ends in a hash of\n * the whole, so two long scopes never share a name.\n */\nexport function projectBucket(\n\tworkspace: { name: string; deploy?: { namespace?: string } },\n\toptions: { accountId: string },\n): string {\n\tconst { scope } = deployIdentity(workspace, '');\n\treturn projectBucketName(scope, options.accountId);\n}\n\n/** {@link projectBucket}, from a deploy identity's scope. */\nexport function projectBucketName(scope: string, accountId: string): string {\n\tlet part = scope\n\t\t.toLowerCase()\n\t\t.replace(/[^a-z0-9]+/g, '-')\n\t\t.replace(/^-+|-+$/g, '');\n\tif (part.length > SCOPE_MAX) {\n\t\tconst hash = createHash('sha256').update(scope).digest('hex').slice(0, 6);\n\t\tpart = `${part.slice(0, SCOPE_MAX - 7).replace(/-+$/, '')}-${hash}`;\n\t}\n\treturn `gkm-${part}-${accountId}`;\n}\n\n/** The account the credentials are in — what the bucket is named by. */\nexport async function callerAccountId(sts: STSClient): Promise<string> {\n\tconst { GetCallerIdentityCommand } = await import('@aws-sdk/client-sts');\n\tconst { Account } = await sts.send(new GetCallerIdentityCommand({}));\n\treturn Account ?? '';\n}\n\n/** An expiry for one stage's prefix, added beside the bucket's own rule. */\nexport interface PrefixExpiry {\n\t/** Rule id, unique in the bucket — e.g. `backups-production`. */\n\tid: string;\n\t/** Key prefix it applies to — e.g. `gkm/acme/production/backups/`. */\n\tprefix: string;\n\t/** Days after which a current object expires. */\n\tdays: number;\n\t/**\n\t * Days after which a multipart upload under the prefix that never\n\t * completed is aborted — its parts are stored, and billed, until it is.\n\t */\n\tabortIncompleteDays?: number;\n}\n\n/**\n * The bucket's whole lifecycle configuration. A put replaces every rule the\n * bucket has, so this is the one place the set is built: the bucket's own\n * noncurrent-version expiry, and any per-prefix expiry passed in.\n */\nexport function projectBucketLifecycle(\n\texpiries: readonly PrefixExpiry[] = [],\n): LifecycleRule[] {\n\treturn [\n\t\t{\n\t\t\tID: 'gkm-noncurrent-versions',\n\t\t\tStatus: 'Enabled',\n\t\t\tFilter: { Prefix: '' },\n\t\t\tNoncurrentVersionExpiration: { NoncurrentDays: NONCURRENT_VERSION_DAYS },\n\t\t\t// A lock is deleted every run; its markers go once nothing is under them.\n\t\t\tExpiration: { ExpiredObjectDeleteMarker: true },\n\t\t},\n\t\t...expiries.map(\n\t\t\t(expiry): LifecycleRule => ({\n\t\t\t\tID: expiry.id,\n\t\t\t\tStatus: 'Enabled',\n\t\t\t\tFilter: { Prefix: expiry.prefix },\n\t\t\t\tExpiration: { Days: expiry.days },\n\t\t\t\t...(expiry.abortIncompleteDays\n\t\t\t\t\t? {\n\t\t\t\t\t\t\tAbortIncompleteMultipartUpload: {\n\t\t\t\t\t\t\t\tDaysAfterInitiation: expiry.abortIncompleteDays,\n\t\t\t\t\t\t\t},\n\t\t\t\t\t\t}\n\t\t\t\t\t: {}),\n\t\t\t}),\n\t\t),\n\t];\n}\n\n/** A lifecycle rule reduced to what gkm sets, for comparing with what is there. */\nfunction canonicalRule(rule: LifecycleRule): string {\n\treturn JSON.stringify({\n\t\tid: rule.ID ?? '',\n\t\tstatus: rule.Status ?? '',\n\t\tprefix: rule.Filter?.Prefix ?? rule.Prefix ?? '',\n\t\tdays: rule.Expiration?.Days ?? null,\n\t\tmarkers: rule.Expiration?.ExpiredObjectDeleteMarker ?? null,\n\t\tnoncurrent: rule.NoncurrentVersionExpiration?.NoncurrentDays ?? null,\n\t\tabort: rule.AbortIncompleteMultipartUpload?.DaysAfterInitiation ?? null,\n\t});\n}\n\n/** Whether two rule sets say the same thing, in any order. */\nexport function sameLifecycle(\n\ta: readonly LifecycleRule[],\n\tb: readonly LifecycleRule[],\n): boolean {\n\tconst canonical = (rules: readonly LifecycleRule[]) =>\n\t\trules.map(canonicalRule).sort().join('\\n');\n\treturn canonical(a) === canonical(b);\n}\n\n/**\n * The project bucket's lifecycle put to {@link projectBucketLifecycle} of\n * `expiries` — every stage's — when what it holds says anything else.\n * Returns whether it was put; with `dryRun`, whether it would be.\n */\nexport async function reconcileProjectBucketLifecycle(\n\ts3: S3Client,\n\tbucket: string,\n\texpiries: readonly PrefixExpiry[],\n\toptions: { dryRun?: boolean } = {},\n): Promise<boolean> {\n\tconst S3 = await import('@aws-sdk/client-s3');\n\tconst rules = projectBucketLifecycle(expiries);\n\tlet current: LifecycleRule[] = [];\n\ttry {\n\t\tconst out = await s3.send(\n\t\t\tnew S3.GetBucketLifecycleConfigurationCommand({ Bucket: bucket }),\n\t\t);\n\t\tcurrent = out.Rules ?? [];\n\t} catch (error) {\n\t\tconst failure = error as S3Failure;\n\t\tconst code = failure.Code ?? failure.name;\n\t\tif (code !== 'NoSuchLifecycleConfiguration') throw error;\n\t}\n\tif (sameLifecycle(current, rules)) return false;\n\tif (!options.dryRun) {\n\t\tawait s3.send(\n\t\t\tnew S3.PutBucketLifecycleConfigurationCommand({\n\t\t\t\tBucket: bucket,\n\t\t\t\tLifecycleConfiguration: { Rules: rules },\n\t\t\t}),\n\t\t);\n\t}\n\treturn true;\n}\n\ninterface S3Failure {\n\tname?: string;\n\tCode?: string;\n\tmessage?: string;\n\t$metadata?: { httpStatusCode?: number };\n}\n\n/**\n * Whether `bucket` is this account's (`ours`) or does not exist (`none`).\n * Mapped by status: a HEAD has no body, so SDK v3 names a 301, 400 or 403\n * `Unknown`.\n *\n * @throws {ProjectBucketTaken} on a 403 or 301\n */\nexport async function findProjectBucket(\n\ts3: S3Client,\n\tbucket: string,\n): Promise<'ours' | 'none'> {\n\tconst { HeadBucketCommand } = await import('@aws-sdk/client-s3');\n\ttry {\n\t\tawait s3.send(new HeadBucketCommand({ Bucket: bucket }));\n\t\treturn 'ours';\n\t} catch (error) {\n\t\tconst status = (error as S3Failure).$metadata?.httpStatusCode;\n\t\tif (status === 404) return 'none';\n\t\tif (status === 403 || status === 301) {\n\t\t\tthrow new ProjectBucketTaken(bucket, status);\n\t\t}\n\t\tthrow error;\n\t}\n}\n\nexport interface EnsureProjectBucketOptions {\n\tbucket: string;\n\tregion: string;\n\t/** The deploy identity the bucket is tagged with. */\n\tidentity: Pick<DeployIdentity, 'key'>;\n\t/** Per-prefix expiries beside the bucket's own rule. */\n\texpiries?: readonly PrefixExpiry[];\n}\n\n/**\n * The project bucket, created and configured if it does not exist yet.\n * Returns whether this call created it. One that exists is used as it is.\n *\n * @throws {ProjectBucketTaken} when another account holds the name\n * @throws {ProjectBucketNotCreatable} when the credentials may not create it\n */\nexport async function ensureProjectBucket(\n\ts3: S3Client,\n\toptions: EnsureProjectBucketOptions,\n): Promise<{ created: boolean }> {\n\tconst { bucket: Bucket, region } = options;\n\tif ((await findProjectBucket(s3, Bucket)) === 'ours') {\n\t\treturn { created: false };\n\t}\n\n\tconst S3 = await import('@aws-sdk/client-s3');\n\ttry {\n\t\tawait s3.send(\n\t\t\tnew S3.CreateBucketCommand({\n\t\t\t\tBucket,\n\t\t\t\tObjectOwnership: 'BucketOwnerEnforced',\n\t\t\t\t// us-east-1 is the one region named by leaving it out.\n\t\t\t\t...(region === 'us-east-1'\n\t\t\t\t\t? {}\n\t\t\t\t\t: {\n\t\t\t\t\t\t\tCreateBucketConfiguration: {\n\t\t\t\t\t\t\t\tLocationConstraint: region as BucketLocationConstraint,\n\t\t\t\t\t\t\t},\n\t\t\t\t\t\t}),\n\t\t\t}),\n\t\t);\n\t} catch (error) {\n\t\tconst failure = error as S3Failure;\n\t\tconst code = failure.Code ?? failure.name;\n\t\t// Another run created it a moment ago: configure it all the same.\n\t\tif (code !== 'BucketAlreadyOwnedByYou') {\n\t\t\tif (code === 'BucketAlreadyExists') {\n\t\t\t\tthrow new ProjectBucketTaken(Bucket, 409);\n\t\t\t}\n\t\t\tif (\n\t\t\t\tcode === 'AccessDenied' ||\n\t\t\t\tfailure.$metadata?.httpStatusCode === 403\n\t\t\t) {\n\t\t\t\tthrow new ProjectBucketNotCreatable(\n\t\t\t\t\tBucket,\n\t\t\t\t\tfailure.message ?? 'AccessDenied',\n\t\t\t\t);\n\t\t\t}\n\t\t\tthrow error;\n\t\t}\n\t}\n\n\tawait s3.send(\n\t\tnew S3.PutPublicAccessBlockCommand({\n\t\t\tBucket,\n\t\t\tPublicAccessBlockConfiguration: {\n\t\t\t\tBlockPublicAcls: true,\n\t\t\t\tIgnorePublicAcls: true,\n\t\t\t\tBlockPublicPolicy: true,\n\t\t\t\tRestrictPublicBuckets: true,\n\t\t\t},\n\t\t}),\n\t);\n\tawait s3.send(\n\t\tnew S3.PutBucketOwnershipControlsCommand({\n\t\t\tBucket,\n\t\t\tOwnershipControls: {\n\t\t\t\tRules: [{ ObjectOwnership: 'BucketOwnerEnforced' }],\n\t\t\t},\n\t\t}),\n\t);\n\tawait s3.send(\n\t\tnew S3.PutBucketEncryptionCommand({\n\t\t\tBucket,\n\t\t\tServerSideEncryptionConfiguration: {\n\t\t\t\tRules: [\n\t\t\t\t\t{ ApplyServerSideEncryptionByDefault: { SSEAlgorithm: 'AES256' } },\n\t\t\t\t],\n\t\t\t},\n\t\t}),\n\t);\n\tawait s3.send(\n\t\tnew S3.PutBucketVersioningCommand({\n\t\t\tBucket,\n\t\t\tVersioningConfiguration: { Status: 'Enabled' },\n\t\t}),\n\t);\n\tawait s3.send(\n\t\tnew S3.PutBucketLifecycleConfigurationCommand({\n\t\t\tBucket,\n\t\t\tLifecycleConfiguration: {\n\t\t\t\tRules: projectBucketLifecycle(options.expiries),\n\t\t\t},\n\t\t}),\n\t);\n\tawait s3.send(\n\t\tnew S3.PutBucketTaggingCommand({\n\t\t\tBucket,\n\t\t\tTagging: {\n\t\t\t\tTagSet: [{ Key: PROJECT_BUCKET_TAG, Value: options.identity.key }],\n\t\t\t},\n\t\t}),\n\t);\n\treturn { created: true };\n}\n\n/**\n * The IAM actions creating and configuring the project bucket takes — what a\n * role that runs the first deploy needs on it, beside object access.\n */\nexport const PROJECT_BUCKET_CREATE_ACTIONS = [\n\t's3:CreateBucket',\n\t's3:PutBucketVersioning',\n\t's3:PutEncryptionConfiguration',\n\t's3:PutBucketPublicAccessBlock',\n\t's3:PutBucketOwnershipControls',\n\t's3:PutLifecycleConfiguration',\n\t's3:PutBucketTagging',\n] as const;\n\n/**\n * What keeping the project bucket's lifecycle takes on a bucket that exists:\n * reading it, to put it back only when it drifted.\n */\nexport const PROJECT_BUCKET_LIFECYCLE_ACTIONS = [\n\t's3:GetLifecycleConfiguration',\n\t's3:PutLifecycleConfiguration',\n] as const;\n"],"mappings":";;;;;;;;;;;;;;;;;;;;;;AA+BA,MAAM,YAAY;;AAGlB,MAAa,qBAAqB;;AAMlC,IAAa,qBAAb,cAAwC,SAAS;CAEtC;CAEA;CAHV,YACC,QAEA,QACC;EAKD,MACC,uBAAuB,OAAO,IAJ9B,WAAW,MACR,iDACA,2EAEmC,SAAS,OAAO,8LAIvD;EAbS,KAAA,SAAA;EAEA,KAAA,SAAA;EAYT,KAAK,OAAO;CACb;AACD;;AAGA,IAAa,4BAAb,cAA+C,SAAS;CAE7C;CACA;CAFV,YACC,QACA,QACC;EACD,MACC,uBAAuB,OAAO,gEACI,OAAO,qOAI1C;EATS,KAAA,SAAA;EACA,KAAA,SAAA;EAST,KAAK,OAAO;CACb;AACD;;AAgBA,SAAgB,kBAAkB,OAAe,WAA2B;CAC3E,IAAI,OAAO,MACT,YAAY,CAAC,CACb,QAAQ,eAAe,GAAG,CAAC,CAC3B,QAAQ,YAAY,EAAE;CACxB,IAAI,KAAK,SAAS,WAAW;EAC5B,MAAM,OAAO,WAAW,QAAQ,CAAC,CAAC,OAAO,KAAK,CAAC,CAAC,OAAO,KAAK,CAAC,CAAC,MAAM,GAAG,CAAC;EACxE,OAAO,GAAG,KAAK,MAAM,GAAG,EAAa,CAAC,CAAC,QAAQ,OAAO,EAAE,EAAE,GAAG;CAC9D;CACA,OAAO,OAAO,KAAK,GAAG;AACvB;;AAGA,eAAsB,gBAAgB,KAAiC;CACtE,MAAM,EAAE,6BAA6B,MAAM,OAAO;CAClD,MAAM,EAAE,YAAY,MAAM,IAAI,KAAK,IAAI,yBAAyB,CAAC,CAAC,CAAC;CACnE,OAAO,WAAW;AACnB;;;;;;AAsBA,SAAgB,uBACf,WAAoC,CAAC,GACnB;CAClB,OAAO,CACN;EACC,IAAI;EACJ,QAAQ;EACR,QAAQ,EAAE,QAAQ,GAAG;EACrB,6BAA6B,EAAE,gBAAA,GAAwC;EAEvE,YAAY,EAAE,2BAA2B,KAAK;CAC/C,GACA,GAAG,SAAS,KACV,YAA2B;EAC3B,IAAI,OAAO;EACX,QAAQ;EACR,QAAQ,EAAE,QAAQ,OAAO,OAAO;EAChC,YAAY,EAAE,MAAM,OAAO,KAAK;EAChC,GAAI,OAAO,sBACR,EACA,gCAAgC,EAC/B,qBAAqB,OAAO,oBAC7B,EACD,IACC,CAAC;CACL,EACD,CACD;AACD;;AAGA,SAAS,cAAc,MAA6B;CACnD,OAAO,KAAK,UAAU;EACrB,IAAI,KAAK,MAAM;EACf,QAAQ,KAAK,UAAU;EACvB,QAAQ,KAAK,QAAQ,UAAU,KAAK,UAAU;EAC9C,MAAM,KAAK,YAAY,QAAQ;EAC/B,SAAS,KAAK,YAAY,6BAA6B;EACvD,YAAY,KAAK,6BAA6B,kBAAkB;EAChE,OAAO,KAAK,gCAAgC,uBAAuB;CACpE,CAAC;AACF;;AAGA,SAAgB,cACf,GACA,GACU;CACV,MAAM,aAAa,UAClB,MAAM,IAAI,aAAa,CAAC,CAAC,KAAK,CAAC,CAAC,KAAK,IAAI;CAC1C,OAAO,UAAU,CAAC,MAAM,UAAU,CAAC;AACpC;;;;;;AAOA,eAAsB,gCACrB,IACA,QACA,UACA,UAAgC,CAAC,GACd;CACnB,MAAM,KAAK,MAAM,OAAO;CACxB,MAAM,QAAQ,uBAAuB,QAAQ;CAC7C,IAAI,UAA2B,CAAC;CAChC,IAAI;EAIH,WAAU,MAHQ,GAAG,KACpB,IAAI,GAAG,uCAAuC,EAAE,QAAQ,OAAO,CAAC,CACjE,EAAA,CACc,SAAS,CAAC;CACzB,SAAS,OAAO;EACf,MAAM,UAAU;EAEhB,KADa,QAAQ,QAAQ,QAAQ,UACxB,gCAAgC,MAAM;CACpD;CACA,IAAI,cAAc,SAAS,KAAK,GAAG,OAAO;CAC1C,IAAI,CAAC,QAAQ,QACZ,MAAM,GAAG,KACR,IAAI,GAAG,uCAAuC;EAC7C,QAAQ;EACR,wBAAwB,EAAE,OAAO,MAAM;CACxC,CAAC,CACF;CAED,OAAO;AACR;;;;;;;;AAgBA,eAAsB,kBACrB,IACA,QAC2B;CAC3B,MAAM,EAAE,sBAAsB,MAAM,OAAO;CAC3C,IAAI;EACH,MAAM,GAAG,KAAK,IAAI,kBAAkB,EAAE,QAAQ,OAAO,CAAC,CAAC;EACvD,OAAO;CACR,SAAS,OAAO;EACf,MAAM,SAAU,MAAoB,WAAW;EAC/C,IAAI,WAAW,KAAK,OAAO;EAC3B,IAAI,WAAW,OAAO,WAAW,KAChC,MAAM,IAAI,mBAAmB,QAAQ,MAAM;EAE5C,MAAM;CACP;AACD;;;;;;;;AAkBA,eAAsB,oBACrB,IACA,SACgC;CAChC,MAAM,EAAE,QAAQ,QAAQ,WAAW;CACnC,IAAK,MAAM,kBAAkB,IAAI,MAAM,MAAO,QAC7C,OAAO,EAAE,SAAS,MAAM;CAGzB,MAAM,KAAK,MAAM,OAAO;CACxB,IAAI;EACH,MAAM,GAAG,KACR,IAAI,GAAG,oBAAoB;GAC1B;GACA,iBAAiB;GAEjB,GAAI,WAAW,cACZ,CAAC,IACD,EACA,2BAA2B,EAC1B,oBAAoB,OACrB,EACD;EACH,CAAC,CACF;CACD,SAAS,OAAO;EACf,MAAM,UAAU;EAChB,MAAM,OAAO,QAAQ,QAAQ,QAAQ;EAErC,IAAI,SAAS,2BAA2B;GACvC,IAAI,SAAS,uBACZ,MAAM,IAAI,mBAAmB,QAAQ,GAAG;GAEzC,IACC,SAAS,kBACT,QAAQ,WAAW,mBAAmB,KAEtC,MAAM,IAAI,0BACT,QACA,QAAQ,WAAW,cACpB;GAED,MAAM;EACP;CACD;CAEA,MAAM,GAAG,KACR,IAAI,GAAG,4BAA4B;EAClC;EACA,gCAAgC;GAC/B,iBAAiB;GACjB,kBAAkB;GAClB,mBAAmB;GACnB,uBAAuB;EACxB;CACD,CAAC,CACF;CACA,MAAM,GAAG,KACR,IAAI,GAAG,kCAAkC;EACxC;EACA,mBAAmB,EAClB,OAAO,CAAC,EAAE,iBAAiB,sBAAsB,CAAC,EACnD;CACD,CAAC,CACF;CACA,MAAM,GAAG,KACR,IAAI,GAAG,2BAA2B;EACjC;EACA,mCAAmC,EAClC,OAAO,CACN,EAAE,oCAAoC,EAAE,cAAc,SAAS,EAAE,CAClE,EACD;CACD,CAAC,CACF;CACA,MAAM,GAAG,KACR,IAAI,GAAG,2BAA2B;EACjC;EACA,yBAAyB,EAAE,QAAQ,UAAU;CAC9C,CAAC,CACF;CACA,MAAM,GAAG,KACR,IAAI,GAAG,uCAAuC;EAC7C;EACA,wBAAwB,EACvB,OAAO,uBAAuB,QAAQ,QAAQ,EAC/C;CACD,CAAC,CACF;CACA,MAAM,GAAG,KACR,IAAI,GAAG,wBAAwB;EAC9B;EACA,SAAS,EACR,QAAQ,CAAC;GAAE,KAAK;GAAoB,OAAO,QAAQ,SAAS;EAAI,CAAC,EAClE;CACD,CAAC,CACF;CACA,OAAO,EAAE,SAAS,KAAK;AACxB;;;;;AAMA,MAAa,gCAAgC;CAC5C;CACA;CACA;CACA;CACA;CACA;CACA;AACD;;;;;AAMA,MAAa,mCAAmC,CAC/C,gCACA,8BACD"}

package/dist/provider-BqpjG9QM.cjs

@@ -0,0 +1,57 @@
+const require_errors = require("./errors-DMC4Umsb.cjs");
+const require_define = require("./define-crmMcXFS.cjs");
+//#region src/target/provider.ts
+/**
+* `gkm deploy --provider`, from before there were targets.
+*
+* It named three things, and only one of them ever deployed a workspace:
+* `dokploy` is now the target of that name; `docker` and `aws-lambda` were
+* accepted and always failed, so they are gone with a pointer to what does
+* the job.
+*/
+/** What each removed provider's job is done with now. */
+const REMOVED = {
+	docker: "Build images with `gkm docker`, or run the stage as one Docker Compose stack with `gkm compose`",
+	"aws-lambda": "Deploy to AWS with SST: set deploy: { default: 'sst' } and run `gkm deploy --stage <stage>`, which runs `sst deploy`"
+};
+/** A `--provider` that no longer exists. */
+var ProviderRemoved = class extends require_errors.GkmError {
+	provider;
+	instead;
+	constructor(provider, instead) {
+		super(`--provider ${provider} has been removed. ${instead}.`);
+		this.provider = provider;
+		this.instead = instead;
+		this.name = "ProviderRemoved";
+	}
+};
+/** The deprecation `--provider` prints when it still means something. */
+function providerDeprecation(provider) {
+	return `--provider is deprecated; use --target ${provider}.`;
+}
+/**
+* The target a `--provider` value means. `warn` hears the deprecation; a
+* provider that is gone, or a target not deployable yet, throws.
+*/
+function targetForProvider(provider, warn) {
+	const removed = REMOVED[provider];
+	if (removed) throw new ProviderRemoved(provider, removed);
+	if (provider === "vercel" || provider === "cloudflare") throw new require_define.DeployTargetNotYetSupported(provider);
+	warn(providerDeprecation(provider));
+	return provider;
+}
+//#endregion
+Object.defineProperty(exports, "ProviderRemoved", {
+	enumerable: true,
+	get: function() {
+		return ProviderRemoved;
+	}
+});
+Object.defineProperty(exports, "targetForProvider", {
+	enumerable: true,
+	get: function() {
+		return targetForProvider;
+	}
+});
+
+//# sourceMappingURL=provider-BqpjG9QM.cjs.map

package/dist/provider-BqpjG9QM.cjs.map

@@ -0,0 +1 @@
+{"version":3,"file":"provider-BqpjG9QM.cjs","names":["GkmError","DeployTargetNotYetSupported"],"sources":["../src/target/provider.ts"],"sourcesContent":["/**\n * `gkm deploy --provider`, from before there were targets.\n *\n * It named three things, and only one of them ever deployed a workspace:\n * `dokploy` is now the target of that name; `docker` and `aws-lambda` were\n * accepted and always failed, so they are gone with a pointer to what does\n * the job.\n */\n\nimport { GkmError } from '../errors';\nimport { DeployTargetNotYetSupported } from './builtins';\n\n/** What each removed provider's job is done with now. */\nconst REMOVED: Record<string, string> = {\n\tdocker:\n\t\t'Build images with `gkm docker`, or run the stage as one Docker Compose stack with `gkm compose`',\n\t'aws-lambda':\n\t\t\"Deploy to AWS with SST: set deploy: { default: 'sst' } and run `gkm deploy --stage <stage>`, which runs `sst deploy`\",\n};\n\n/** A `--provider` that no longer exists. */\nexport class ProviderRemoved extends GkmError {\n\tconstructor(\n\t\treadonly provider: string,\n\t\t/** What to use instead. */\n\t\treadonly instead: string,\n\t) {\n\t\tsuper(`--provider ${provider} has been removed. ${instead}.`);\n\t\tthis.name = 'ProviderRemoved';\n\t}\n}\n\n/** The deprecation `--provider` prints when it still means something. */\nexport function providerDeprecation(provider: string): string {\n\treturn `--provider is deprecated; use --target ${provider}.`;\n}\n\n/**\n * The target a `--provider` value means. `warn` hears the deprecation; a\n * provider that is gone, or a target not deployable yet, throws.\n */\nexport function targetForProvider(\n\tprovider: string,\n\twarn: (message: string) => void,\n): string {\n\tconst removed = REMOVED[provider];\n\tif (removed) throw new ProviderRemoved(provider, removed);\n\tif (provider === 'vercel' || provider === 'cloudflare') {\n\t\tthrow new DeployTargetNotYetSupported(provider);\n\t}\n\twarn(providerDeprecation(provider));\n\treturn provider;\n}\n"],"mappings":";;;;;;;;;;;;AAaA,MAAM,UAAkC;CACvC,QACC;CACD,cACC;AACF;;AAGA,IAAa,kBAAb,cAAqCA,eAAAA,SAAS;CAEnC;CAEA;CAHV,YACC,UAEA,SACC;EACD,MAAM,cAAc,SAAS,qBAAqB,QAAQ,EAAE;EAJnD,KAAA,WAAA;EAEA,KAAA,UAAA;EAGT,KAAK,OAAO;CACb;AACD;;AAGA,SAAgB,oBAAoB,UAA0B;CAC7D,OAAO,0CAA0C,SAAS;AAC3D;;;;;AAMA,SAAgB,kBACf,UACA,MACS;CACT,MAAM,UAAU,QAAQ;CACxB,IAAI,SAAS,MAAM,IAAI,gBAAgB,UAAU,OAAO;CACxD,IAAI,aAAa,YAAY,aAAa,cACzC,MAAM,IAAIC,eAAAA,4BAA4B,QAAQ;CAE/C,KAAK,oBAAoB,QAAQ,CAAC;CAClC,OAAO;AACR"}

package/dist/provider-CEOKk8NS.mjs

@@ -0,0 +1,46 @@
+import { t as GkmError } from "./errors-D8Gwp5kU.mjs";
+import { i as DeployTargetNotYetSupported } from "./define-6poNqm5O.mjs";
+//#region src/target/provider.ts
+/**
+* `gkm deploy --provider`, from before there were targets.
+*
+* It named three things, and only one of them ever deployed a workspace:
+* `dokploy` is now the target of that name; `docker` and `aws-lambda` were
+* accepted and always failed, so they are gone with a pointer to what does
+* the job.
+*/
+/** What each removed provider's job is done with now. */
+const REMOVED = {
+	docker: "Build images with `gkm docker`, or run the stage as one Docker Compose stack with `gkm compose`",
+	"aws-lambda": "Deploy to AWS with SST: set deploy: { default: 'sst' } and run `gkm deploy --stage <stage>`, which runs `sst deploy`"
+};
+/** A `--provider` that no longer exists. */
+var ProviderRemoved = class extends GkmError {
+	provider;
+	instead;
+	constructor(provider, instead) {
+		super(`--provider ${provider} has been removed. ${instead}.`);
+		this.provider = provider;
+		this.instead = instead;
+		this.name = "ProviderRemoved";
+	}
+};
+/** The deprecation `--provider` prints when it still means something. */
+function providerDeprecation(provider) {
+	return `--provider is deprecated; use --target ${provider}.`;
+}
+/**
+* The target a `--provider` value means. `warn` hears the deprecation; a
+* provider that is gone, or a target not deployable yet, throws.
+*/
+function targetForProvider(provider, warn) {
+	const removed = REMOVED[provider];
+	if (removed) throw new ProviderRemoved(provider, removed);
+	if (provider === "vercel" || provider === "cloudflare") throw new DeployTargetNotYetSupported(provider);
+	warn(providerDeprecation(provider));
+	return provider;
+}
+//#endregion
+export { targetForProvider as n, ProviderRemoved as t };
+
+//# sourceMappingURL=provider-CEOKk8NS.mjs.map

package/dist/provider-CEOKk8NS.mjs.map

@@ -0,0 +1 @@
+{"version":3,"file":"provider-CEOKk8NS.mjs","names":[],"sources":["../src/target/provider.ts"],"sourcesContent":["/**\n * `gkm deploy --provider`, from before there were targets.\n *\n * It named three things, and only one of them ever deployed a workspace:\n * `dokploy` is now the target of that name; `docker` and `aws-lambda` were\n * accepted and always failed, so they are gone with a pointer to what does\n * the job.\n */\n\nimport { GkmError } from '../errors';\nimport { DeployTargetNotYetSupported } from './builtins';\n\n/** What each removed provider's job is done with now. */\nconst REMOVED: Record<string, string> = {\n\tdocker:\n\t\t'Build images with `gkm docker`, or run the stage as one Docker Compose stack with `gkm compose`',\n\t'aws-lambda':\n\t\t\"Deploy to AWS with SST: set deploy: { default: 'sst' } and run `gkm deploy --stage <stage>`, which runs `sst deploy`\",\n};\n\n/** A `--provider` that no longer exists. */\nexport class ProviderRemoved extends GkmError {\n\tconstructor(\n\t\treadonly provider: string,\n\t\t/** What to use instead. */\n\t\treadonly instead: string,\n\t) {\n\t\tsuper(`--provider ${provider} has been removed. ${instead}.`);\n\t\tthis.name = 'ProviderRemoved';\n\t}\n}\n\n/** The deprecation `--provider` prints when it still means something. */\nexport function providerDeprecation(provider: string): string {\n\treturn `--provider is deprecated; use --target ${provider}.`;\n}\n\n/**\n * The target a `--provider` value means. `warn` hears the deprecation; a\n * provider that is gone, or a target not deployable yet, throws.\n */\nexport function targetForProvider(\n\tprovider: string,\n\twarn: (message: string) => void,\n): string {\n\tconst removed = REMOVED[provider];\n\tif (removed) throw new ProviderRemoved(provider, removed);\n\tif (provider === 'vercel' || provider === 'cloudflare') {\n\t\tthrow new DeployTargetNotYetSupported(provider);\n\t}\n\twarn(providerDeprecation(provider));\n\treturn provider;\n}\n"],"mappings":";;;;;;;;;;;;AAaA,MAAM,UAAkC;CACvC,QACC;CACD,cACC;AACF;;AAGA,IAAa,kBAAb,cAAqC,SAAS;CAEnC;CAEA;CAHV,YACC,UAEA,SACC;EACD,MAAM,cAAc,SAAS,qBAAqB,QAAQ,EAAE;EAJnD,KAAA,WAAA;EAEA,KAAA,UAAA;EAGT,KAAK,OAAO;CACb;AACD;;AAGA,SAAgB,oBAAoB,UAA0B;CAC7D,OAAO,0CAA0C,SAAS;AAC3D;;;;;AAMA,SAAgB,kBACf,UACA,MACS;CACT,MAAM,UAAU,QAAQ;CACxB,IAAI,SAAS,MAAM,IAAI,gBAAgB,UAAU,OAAO;CACxD,IAAI,aAAa,YAAY,aAAa,cACzC,MAAM,IAAI,4BAA4B,QAAQ;CAE/C,KAAK,oBAAoB,QAAQ,CAAC;CAClC,OAAO;AACR"}

package/dist/publish-B-EIjfQ0.mjs

@@ -0,0 +1,123 @@
+import { t as GkmError } from "./errors-D8Gwp5kU.mjs";
+import { easCli, easSync } from "./eas-6ezdJtry.mjs";
+import { join } from "node:path";
+import { existsSync, readFileSync } from "node:fs";
+import { spawnSync } from "node:child_process";
+//#region src/mobile/publish.ts
+/**
+* `gkm publish --stage <stage>`: a mobile app shipped for a deployed stage.
+*
+* First the stage's EAS project is synced (`gkm eas:sync`), so what is built
+* reads the stage's values. Then, per platform, the cheapest release that
+* gets the app's current code to the stage's users:
+*
+* - **An update**, when a store build with the same native code is already
+*   out: the fingerprint `runtimeVersion: { policy: 'fingerprint' }` gives a
+*   build is computed with the stage's profile, and a finished store build
+*   of that profile with that fingerprint means only JavaScript changed. It
+*   goes out on the stage's channel (`eas update`), which only builds of
+*   that runtime receive.
+* - **A store build**, otherwise, submitted to the store as the stage's
+*   submit profile says (`eas build --auto-submit`): Android to its Play
+*   track; iOS to App Store Connect once `submit.<stage>.ios.ascAppId` is
+*   set — without it, iOS is built and not submitted, and gkm says so,
+*   rather than leave a prompt nobody in CI can answer.
+*
+* `--build` or `--update` decides instead. An update with no store build to
+* receive it reaches nobody, so `--update` without one is refused.
+*/
+const logger = console;
+/** `--update`, and no store build has this native code. */
+var NoStoreBuildForUpdate = class extends GkmError {
+	platform;
+	stage;
+	fingerprint;
+	constructor(platform, stage, fingerprint) {
+		super(`No ${platform} store build of '${stage}' has this native code (fingerprint ${fingerprint}), so an update would reach nobody: a phone only takes updates for the runtime it was built with. Build one: gkm publish --stage ${stage} --platform ${platform} --build.`);
+		this.platform = platform;
+		this.stage = stage;
+		this.fingerprint = fingerprint;
+		this.name = "NoStoreBuildForUpdate";
+	}
+};
+/** `--build` and `--update` together. */
+var PublishModeConflict = class extends GkmError {
+	constructor() {
+		super("Pass --build or --update, not both: one release per platform.");
+		this.name = "PublishModeConflict";
+	}
+};
+/**
+* Ship a mobile app for a deployed stage.
+*
+* @throws {NoStoreBuildForUpdate} — and what `easSync` throws
+*/
+async function publish(options, eas) {
+	const synced = await easSync(options, eas);
+	const cli = eas ?? easCli(synced.root, synced.values);
+	const { dir, stage } = synced;
+	const profile = stage.stage;
+	const easJson = existsSync(join(dir, "eas.json")) ? JSON.parse(readFileSync(join(dir, "eas.json"), "utf8")) : {};
+	const iosSubmits = Boolean(easJson.submit?.[profile]?.ios?.ascAppId);
+	const platforms = !options.platform || options.platform === "all" ? ["ios", "android"] : [options.platform];
+	const releases = [];
+	for (const platform of platforms) {
+		const fingerprint = await cli.fingerprint(dir, {
+			platform,
+			profile
+		});
+		const storeBuild = options.mode === "build" ? void 0 : await cli.storeBuild(dir, {
+			platform,
+			profile,
+			fingerprint
+		});
+		if (options.mode === "update" && !storeBuild) throw new NoStoreBuildForUpdate(platform, profile, fingerprint);
+		const release = options.mode ?? (storeBuild ? "update" : "build");
+		const submit = platform === "android" || iosSubmits;
+		releases.push({
+			platform,
+			fingerprint,
+			...storeBuild ? { storeBuild } : {},
+			release,
+			submit: release === "build" && submit
+		});
+		const why = storeBuild ? `store build ${storeBuild} has this native code` : "no store build has this native code";
+		if (release === "update") {
+			logger.log(`🔁 ${platform}: an update on '${stage.channel}' (${why})${options.dryRun ? " (dry run)" : ""}`);
+			if (options.dryRun) continue;
+			await cli.update(dir, {
+				platform,
+				channel: stage.channel,
+				environment: stage.environment,
+				message: options.message ?? commitSubject(synced.root, profile)
+			});
+			continue;
+		}
+		const where = platform === "android" ? `submitted to Play's ${stage.android.track} track (${stage.android.releaseStatus})` : iosSubmits ? "submitted to App Store Connect" : `not submitted: submit.${profile}.ios.ascAppId is not set in eas.json`;
+		logger.log(`📦 ${platform}: a store build of '${profile}', ${where} (${why})${options.dryRun ? " (dry run)" : ""}`);
+		if (options.dryRun) continue;
+		await cli.build(dir, {
+			platform,
+			profile,
+			submit,
+			wait: options.wait ?? false
+		});
+	}
+	return releases;
+}
+/** The current commit's subject, for an update's message. */
+function commitSubject(root, stage) {
+	const result = spawnSync("git", [
+		"log",
+		"-1",
+		"--format=%s"
+	], {
+		cwd: root,
+		encoding: "utf8"
+	});
+	return (result.status === 0 ? result.stdout.trim() : "") || `gkm publish --stage ${stage}`;
+}
+//#endregion
+export { PublishModeConflict, publish };
+
+//# sourceMappingURL=publish-B-EIjfQ0.mjs.map

package/dist/publish-B-EIjfQ0.mjs.map

@@ -0,0 +1 @@
+{"version":3,"file":"publish-B-EIjfQ0.mjs","names":[],"sources":["../src/mobile/publish.ts"],"sourcesContent":["/**\n * `gkm publish --stage <stage>`: a mobile app shipped for a deployed stage.\n *\n * First the stage's EAS project is synced (`gkm eas:sync`), so what is built\n * reads the stage's values. Then, per platform, the cheapest release that\n * gets the app's current code to the stage's users:\n *\n * - **An update**, when a store build with the same native code is already\n *   out: the fingerprint `runtimeVersion: { policy: 'fingerprint' }` gives a\n *   build is computed with the stage's profile, and a finished store build\n *   of that profile with that fingerprint means only JavaScript changed. It\n *   goes out on the stage's channel (`eas update`), which only builds of\n *   that runtime receive.\n * - **A store build**, otherwise, submitted to the store as the stage's\n *   submit profile says (`eas build --auto-submit`): Android to its Play\n *   track; iOS to App Store Connect once `submit.<stage>.ios.ascAppId` is\n *   set — without it, iOS is built and not submitted, and gkm says so,\n *   rather than leave a prompt nobody in CI can answer.\n *\n * `--build` or `--update` decides instead. An update with no store build to\n * receive it reaches nobody, so `--update` without one is refused.\n */\n\nimport { spawnSync } from 'node:child_process';\nimport { existsSync, readFileSync } from 'node:fs';\nimport { join } from 'node:path';\nimport { GkmError } from '../errors';\nimport {\n\ttype EasCli,\n\ttype EasPlatform,\n\ttype EasSyncOptions,\n\teasCli,\n\teasSync,\n} from './eas.js';\n\nconst logger = console;\n\n/** `--update`, and no store build has this native code. */\nexport class NoStoreBuildForUpdate extends GkmError {\n\tconstructor(\n\t\treadonly platform: EasPlatform,\n\t\treadonly stage: string,\n\t\treadonly fingerprint: string,\n\t) {\n\t\tsuper(\n\t\t\t`No ${platform} store build of '${stage}' has this native code ` +\n\t\t\t\t`(fingerprint ${fingerprint}), so an update would reach nobody: a phone ` +\n\t\t\t\t'only takes updates for the runtime it was built with. Build one: ' +\n\t\t\t\t`gkm publish --stage ${stage} --platform ${platform} --build.`,\n\t\t);\n\t\tthis.name = 'NoStoreBuildForUpdate';\n\t}\n}\n\n/** `--build` and `--update` together. */\nexport class PublishModeConflict extends GkmError {\n\tconstructor() {\n\t\tsuper('Pass --build or --update, not both: one release per platform.');\n\t\tthis.name = 'PublishModeConflict';\n\t}\n}\n\nexport interface PublishOptions extends EasSyncOptions {\n\t/** `ios`, `android`, or both (the default). */\n\tplatform?: EasPlatform | 'all';\n\t/** Build, or update, whatever the fingerprint says. */\n\tmode?: 'build' | 'update';\n\t/** Wait for a build to finish (and submit), rather than leave it on EAS. */\n\twait?: boolean;\n\t/** The update's message: the commit's subject by default. */\n\tmessage?: string;\n}\n\n/** What one platform's release was — or, dry, would be. */\nexport interface PlatformRelease {\n\tplatform: EasPlatform;\n\tfingerprint: string;\n\t/** The store build that already has this native code, if one does. */\n\tstoreBuild?: string;\n\trelease: 'build' | 'update';\n\t/** Whether a build is submitted to its store. */\n\tsubmit: boolean;\n}\n\n/**\n * Ship a mobile app for a deployed stage.\n *\n * @throws {NoStoreBuildForUpdate} — and what `easSync` throws\n */\nexport async function publish(\n\toptions: PublishOptions,\n\teas?: EasCli,\n): Promise<PlatformRelease[]> {\n\tconst synced = await easSync(options, eas);\n\tconst cli = eas ?? easCli(synced.root, synced.values);\n\tconst { dir, stage } = synced;\n\tconst profile = stage.stage;\n\n\tconst easJson = existsSync(join(dir, 'eas.json'))\n\t\t? (JSON.parse(readFileSync(join(dir, 'eas.json'), 'utf8')) as {\n\t\t\t\tsubmit?: Record<string, { ios?: { ascAppId?: string } }>;\n\t\t\t})\n\t\t: {};\n\tconst iosSubmits = Boolean(easJson.submit?.[profile]?.ios?.ascAppId);\n\n\tconst platforms: EasPlatform[] =\n\t\t!options.platform || options.platform === 'all'\n\t\t\t? ['ios', 'android']\n\t\t\t: [options.platform];\n\n\tconst releases: PlatformRelease[] = [];\n\tfor (const platform of platforms) {\n\t\tconst fingerprint = await cli.fingerprint(dir, { platform, profile });\n\t\tconst storeBuild =\n\t\t\toptions.mode === 'build'\n\t\t\t\t? undefined\n\t\t\t\t: await cli.storeBuild(dir, { platform, profile, fingerprint });\n\t\tif (options.mode === 'update' && !storeBuild) {\n\t\t\tthrow new NoStoreBuildForUpdate(platform, profile, fingerprint);\n\t\t}\n\t\tconst release = options.mode ?? (storeBuild ? 'update' : 'build');\n\t\tconst submit = platform === 'android' || iosSubmits;\n\t\treleases.push({\n\t\t\tplatform,\n\t\t\tfingerprint,\n\t\t\t...(storeBuild ? { storeBuild } : {}),\n\t\t\trelease,\n\t\t\tsubmit: release === 'build' && submit,\n\t\t});\n\n\t\tconst why = storeBuild\n\t\t\t? `store build ${storeBuild} has this native code`\n\t\t\t: 'no store build has this native code';\n\t\tif (release === 'update') {\n\t\t\tlogger.log(\n\t\t\t\t`🔁 ${platform}: an update on '${stage.channel}' (${why})${options.dryRun ? ' (dry run)' : ''}`,\n\t\t\t);\n\t\t\tif (options.dryRun) continue;\n\t\t\tawait cli.update(dir, {\n\t\t\t\tplatform,\n\t\t\t\tchannel: stage.channel,\n\t\t\t\tenvironment: stage.environment,\n\t\t\t\tmessage: options.message ?? commitSubject(synced.root, profile),\n\t\t\t});\n\t\t\tcontinue;\n\t\t}\n\n\t\tconst where =\n\t\t\tplatform === 'android'\n\t\t\t\t? `submitted to Play's ${stage.android.track} track (${stage.android.releaseStatus})`\n\t\t\t\t: iosSubmits\n\t\t\t\t\t? 'submitted to App Store Connect'\n\t\t\t\t\t: `not submitted: submit.${profile}.ios.ascAppId is not set in eas.json`;\n\t\tlogger.log(\n\t\t\t`📦 ${platform}: a store build of '${profile}', ${where} (${why})${options.dryRun ? ' (dry run)' : ''}`,\n\t\t);\n\t\tif (options.dryRun) continue;\n\t\tawait cli.build(dir, {\n\t\t\tplatform,\n\t\t\tprofile,\n\t\t\tsubmit,\n\t\t\twait: options.wait ?? false,\n\t\t});\n\t}\n\treturn releases;\n}\n\n/** The current commit's subject, for an update's message. */\nfunction commitSubject(root: string, stage: string): string {\n\tconst result = spawnSync('git', ['log', '-1', '--format=%s'], {\n\t\tcwd: root,\n\t\tencoding: 'utf8',\n\t});\n\tconst subject = result.status === 0 ? result.stdout.trim() : '';\n\treturn subject || `gkm publish --stage ${stage}`;\n}\n"],"mappings":";;;;;;;;;;;;;;;;;;;;;;;;;;;;AAmCA,MAAM,SAAS;;AAGf,IAAa,wBAAb,cAA2C,SAAS;CAEzC;CACA;CACA;CAHV,YACC,UACA,OACA,aACC;EACD,MACC,MAAM,SAAS,mBAAmB,MAAM,sCACvB,YAAY,mIAEL,MAAM,cAAc,SAAS,UACtD;EATS,KAAA,WAAA;EACA,KAAA,QAAA;EACA,KAAA,cAAA;EAQT,KAAK,OAAO;CACb;AACD;;AAGA,IAAa,sBAAb,cAAyC,SAAS;CACjD,cAAc;EACb,MAAM,+DAA+D;EACrE,KAAK,OAAO;CACb;AACD;;;;;;AA6BA,eAAsB,QACrB,SACA,KAC6B;CAC7B,MAAM,SAAS,MAAM,QAAQ,SAAS,GAAG;CACzC,MAAM,MAAM,OAAO,OAAO,OAAO,MAAM,OAAO,MAAM;CACpD,MAAM,EAAE,KAAK,UAAU;CACvB,MAAM,UAAU,MAAM;CAEtB,MAAM,UAAU,WAAW,KAAK,KAAK,UAAU,CAAC,IAC5C,KAAK,MAAM,aAAa,KAAK,KAAK,UAAU,GAAG,MAAM,CAAC,IAGvD,CAAC;CACJ,MAAM,aAAa,QAAQ,QAAQ,SAAS,QAAQ,EAAE,KAAK,QAAQ;CAEnE,MAAM,YACL,CAAC,QAAQ,YAAY,QAAQ,aAAa,QACvC,CAAC,OAAO,SAAS,IACjB,CAAC,QAAQ,QAAQ;CAErB,MAAM,WAA8B,CAAC;CACrC,KAAK,MAAM,YAAY,WAAW;EACjC,MAAM,cAAc,MAAM,IAAI,YAAY,KAAK;GAAE;GAAU;EAAQ,CAAC;EACpE,MAAM,aACL,QAAQ,SAAS,UACd,KAAA,IACA,MAAM,IAAI,WAAW,KAAK;GAAE;GAAU;GAAS;EAAY,CAAC;EAChE,IAAI,QAAQ,SAAS,YAAY,CAAC,YACjC,MAAM,IAAI,sBAAsB,UAAU,SAAS,WAAW;EAE/D,MAAM,UAAU,QAAQ,SAAS,aAAa,WAAW;EACzD,MAAM,SAAS,aAAa,aAAa;EACzC,SAAS,KAAK;GACb;GACA;GACA,GAAI,aAAa,EAAE,WAAW,IAAI,CAAC;GACnC;GACA,QAAQ,YAAY,WAAW;EAChC,CAAC;EAED,MAAM,MAAM,aACT,eAAe,WAAW,yBAC1B;EACH,IAAI,YAAY,UAAU;GACzB,OAAO,IACN,MAAM,SAAS,kBAAkB,MAAM,QAAQ,KAAK,IAAI,GAAG,QAAQ,SAAS,eAAe,IAC5F;GACA,IAAI,QAAQ,QAAQ;GACpB,MAAM,IAAI,OAAO,KAAK;IACrB;IACA,SAAS,MAAM;IACf,aAAa,MAAM;IACnB,SAAS,QAAQ,WAAW,cAAc,OAAO,MAAM,OAAO;GAC/D,CAAC;GACD;EACD;EAEA,MAAM,QACL,aAAa,YACV,uBAAuB,MAAM,QAAQ,MAAM,UAAU,MAAM,QAAQ,cAAc,KACjF,aACC,mCACA,yBAAyB,QAAQ;EACtC,OAAO,IACN,MAAM,SAAS,sBAAsB,QAAQ,KAAK,MAAM,IAAI,IAAI,GAAG,QAAQ,SAAS,eAAe,IACpG;EACA,IAAI,QAAQ,QAAQ;EACpB,MAAM,IAAI,MAAM,KAAK;GACpB;GACA;GACA;GACA,MAAM,QAAQ,QAAQ;EACvB,CAAC;CACF;CACA,OAAO;AACR;;AAGA,SAAS,cAAc,MAAc,OAAuB;CAC3D,MAAM,SAAS,UAAU,OAAO;EAAC;EAAO;EAAM;CAAa,GAAG;EAC7D,KAAK;EACL,UAAU;CACX,CAAC;CAED,QADgB,OAAO,WAAW,IAAI,OAAO,OAAO,KAAK,IAAI,OAC3C,uBAAuB;AAC1C"}

package/dist/publish-CPgSbtcs.cjs

@@ -0,0 +1,124 @@
+const require_errors = require("./errors-DMC4Umsb.cjs");
+const require_eas = require("./eas-BkLA60P2.cjs");
+let node_path = require("node:path");
+let node_fs = require("node:fs");
+let node_child_process = require("node:child_process");
+//#region src/mobile/publish.ts
+/**
+* `gkm publish --stage <stage>`: a mobile app shipped for a deployed stage.
+*
+* First the stage's EAS project is synced (`gkm eas:sync`), so what is built
+* reads the stage's values. Then, per platform, the cheapest release that
+* gets the app's current code to the stage's users:
+*
+* - **An update**, when a store build with the same native code is already
+*   out: the fingerprint `runtimeVersion: { policy: 'fingerprint' }` gives a
+*   build is computed with the stage's profile, and a finished store build
+*   of that profile with that fingerprint means only JavaScript changed. It
+*   goes out on the stage's channel (`eas update`), which only builds of
+*   that runtime receive.
+* - **A store build**, otherwise, submitted to the store as the stage's
+*   submit profile says (`eas build --auto-submit`): Android to its Play
+*   track; iOS to App Store Connect once `submit.<stage>.ios.ascAppId` is
+*   set — without it, iOS is built and not submitted, and gkm says so,
+*   rather than leave a prompt nobody in CI can answer.
+*
+* `--build` or `--update` decides instead. An update with no store build to
+* receive it reaches nobody, so `--update` without one is refused.
+*/
+const logger = console;
+/** `--update`, and no store build has this native code. */
+var NoStoreBuildForUpdate = class extends require_errors.GkmError {
+	platform;
+	stage;
+	fingerprint;
+	constructor(platform, stage, fingerprint) {
+		super(`No ${platform} store build of '${stage}' has this native code (fingerprint ${fingerprint}), so an update would reach nobody: a phone only takes updates for the runtime it was built with. Build one: gkm publish --stage ${stage} --platform ${platform} --build.`);
+		this.platform = platform;
+		this.stage = stage;
+		this.fingerprint = fingerprint;
+		this.name = "NoStoreBuildForUpdate";
+	}
+};
+/** `--build` and `--update` together. */
+var PublishModeConflict = class extends require_errors.GkmError {
+	constructor() {
+		super("Pass --build or --update, not both: one release per platform.");
+		this.name = "PublishModeConflict";
+	}
+};
+/**
+* Ship a mobile app for a deployed stage.
+*
+* @throws {NoStoreBuildForUpdate} — and what `easSync` throws
+*/
+async function publish(options, eas) {
+	const synced = await require_eas.easSync(options, eas);
+	const cli = eas ?? require_eas.easCli(synced.root, synced.values);
+	const { dir, stage } = synced;
+	const profile = stage.stage;
+	const easJson = (0, node_fs.existsSync)((0, node_path.join)(dir, "eas.json")) ? JSON.parse((0, node_fs.readFileSync)((0, node_path.join)(dir, "eas.json"), "utf8")) : {};
+	const iosSubmits = Boolean(easJson.submit?.[profile]?.ios?.ascAppId);
+	const platforms = !options.platform || options.platform === "all" ? ["ios", "android"] : [options.platform];
+	const releases = [];
+	for (const platform of platforms) {
+		const fingerprint = await cli.fingerprint(dir, {
+			platform,
+			profile
+		});
+		const storeBuild = options.mode === "build" ? void 0 : await cli.storeBuild(dir, {
+			platform,
+			profile,
+			fingerprint
+		});
+		if (options.mode === "update" && !storeBuild) throw new NoStoreBuildForUpdate(platform, profile, fingerprint);
+		const release = options.mode ?? (storeBuild ? "update" : "build");
+		const submit = platform === "android" || iosSubmits;
+		releases.push({
+			platform,
+			fingerprint,
+			...storeBuild ? { storeBuild } : {},
+			release,
+			submit: release === "build" && submit
+		});
+		const why = storeBuild ? `store build ${storeBuild} has this native code` : "no store build has this native code";
+		if (release === "update") {
+			logger.log(`🔁 ${platform}: an update on '${stage.channel}' (${why})${options.dryRun ? " (dry run)" : ""}`);
+			if (options.dryRun) continue;
+			await cli.update(dir, {
+				platform,
+				channel: stage.channel,
+				environment: stage.environment,
+				message: options.message ?? commitSubject(synced.root, profile)
+			});
+			continue;
+		}
+		const where = platform === "android" ? `submitted to Play's ${stage.android.track} track (${stage.android.releaseStatus})` : iosSubmits ? "submitted to App Store Connect" : `not submitted: submit.${profile}.ios.ascAppId is not set in eas.json`;
+		logger.log(`📦 ${platform}: a store build of '${profile}', ${where} (${why})${options.dryRun ? " (dry run)" : ""}`);
+		if (options.dryRun) continue;
+		await cli.build(dir, {
+			platform,
+			profile,
+			submit,
+			wait: options.wait ?? false
+		});
+	}
+	return releases;
+}
+/** The current commit's subject, for an update's message. */
+function commitSubject(root, stage) {
+	const result = (0, node_child_process.spawnSync)("git", [
+		"log",
+		"-1",
+		"--format=%s"
+	], {
+		cwd: root,
+		encoding: "utf8"
+	});
+	return (result.status === 0 ? result.stdout.trim() : "") || `gkm publish --stage ${stage}`;
+}
+//#endregion
+exports.PublishModeConflict = PublishModeConflict;
+exports.publish = publish;
+
+//# sourceMappingURL=publish-CPgSbtcs.cjs.map