@geekmidas/cli 10.0.0-alpha.12 → 10.0.0-alpha.120

package/dist/openapi.mjs

@@ -1,7 +1,210 @@
 #!/usr/bin/env -S npx tsx
-import "./discover-BYHQwQqu.mjs";
-import "./config-DTsVjKZD.mjs";
-import "./workspace-CtnZnWsa.mjs";
-import { OPENAPI_OUTPUT_PATH, generateOpenApi, generateOpenApiFrom, openApiPathFor, openapiCommand, resolveOpenApiConfig } from "./openapi-Bs3-5q_r.mjs";
+import { o as appConstructGlobs } from "./workspace-D1QbNd55.mjs";
+import { t as appKey } from "./derive-B4vDpzgP.mjs";
+import { c as parseTelemetryFlag, t as EndpointGenerator, u as telemetryArgs } from "./EndpointGenerator-CP_z_E3e.mjs";
+import { loadWorkspaceConfig } from "./config.mjs";
+import { t as OpenApiTsGenerator } from "./OpenApiTsGenerator-CsrukCE-.mjs";
+import { dirname, join, relative, resolve } from "node:path";
+import { mkdir, writeFile } from "node:fs/promises";
+import { spawn } from "node:child_process";
+import { kebabCase } from "@geekmidas/manifest";
+import { fileURLToPath } from "node:url";
+//#region src/openapi.ts
+/**
+* Where a surface's generated client lands, under the workspace root.
+*
+* Named from the surface, so `new RestApi('Webhooks')` writes
+* `.gkm/client/webhooks.ts` — the same kebab form that gives it its container
+* name and its `WEBHOOKS_URL` — and a site imports it as
+* `@<name>/client/webhooks`, through the alias its tsconfig maps.
+*/
+function openApiPathFor(surfaceId) {
+	return `./.gkm/client/${kebabCase(surfaceId)}.ts`;
+}
+/**
+* Resolve OpenAPI config from GkmConfig
+*/
+function resolveOpenApiConfig(config) {
+	if (config.openapi === false) return { enabled: false };
+	if (config.openapi === true || config.openapi === void 0) return {
+		enabled: true,
+		title: "API Documentation",
+		version: "1.0.0",
+		description: "Auto-generated API documentation from endpoints"
+	};
+	return {
+		enabled: config.openapi.enabled !== false,
+		title: config.openapi.title || "API Documentation",
+		version: config.openapi.version || "1.0.0",
+		description: config.openapi.description || "Auto-generated API documentation from endpoints"
+	};
+}
+/**
+* Load endpoints from a glob, then generate.
+*
+* For the callers that have no endpoints in hand — `gkm openapi`, and `gkm dev`
+* regenerating on reload. The glob is the app's derived one — the conventional
+* directories under it — not a `routes` field anybody wrote.
+*/
+async function generateOpenApiFrom(routes, options = {}) {
+	return generateOpenApi((await new EndpointGenerator().load(routes, void 0, options.bustCache)).map(({ construct }) => construct), options);
+}
+/**
+* Generate an OpenAPI spec for each surface these endpoints name.
+*
+* Takes the endpoints, not a glob to find them with. The build has already
+* loaded every one of them to generate handlers, so globbing again was a second
+* discovery pass over the same files — and the reason this function needed a
+* `routes` to be told where to look, which is how a retired config field stayed
+* load-bearing.
+*
+* @returns What was written, or null if disabled or there were none
+*/
+async function generateOpenApi(endpoints, options = {}) {
+	const root = options.root ?? process.cwd();
+	const logger = options.silent ? { log: () => {} } : console;
+	const openApiConfig = resolveOpenApiConfig({ openapi: options.openapi });
+	if (!openApiConfig.enabled) return null;
+	if (endpoints.length === 0) {
+		logger.log("No valid endpoints found for OpenAPI generation");
+		return null;
+	}
+	const bySurface = /* @__PURE__ */ new Map();
+	for (const endpoint of endpoints) {
+		const owner = endpoint.owner ?? endpoint.surface?.id;
+		if (!owner) continue;
+		const existing = bySurface.get(owner);
+		if (existing) existing.push(endpoint);
+		else bySurface.set(owner, [endpoint]);
+	}
+	if (bySurface.size === 0) {
+		logger.log("No endpoints named a surface, so no OpenAPI was generated");
+		return null;
+	}
+	const tsGenerator = new OpenApiTsGenerator();
+	const written = [];
+	for (const [surfaceId, surfaceEndpoints] of bySurface) {
+		const relative$1 = openApiPathFor(surfaceId);
+		const outputPath = join(root, relative$1);
+		await mkdir(dirname(outputPath), { recursive: true });
+		const tsContent = await tsGenerator.generate(surfaceEndpoints, {
+			title: openApiConfig.title ?? surfaceId,
+			version: openApiConfig.version,
+			description: openApiConfig.description,
+			...options.telemetry !== void 0 ? { telemetry: options.telemetry } : {}
+		});
+		await writeFile(outputPath, tsContent);
+		written.push(relative$1);
+		logger.log(`📄 OpenAPI client generated: ${relative(process.cwd(), outputPath)} (${surfaceEndpoints.length} endpoints)`);
+	}
+	return {
+		outputPath: join(root, written[0]),
+		outputPaths: written.map((r) => join(root, r)),
+		endpointCount: endpoints.length
+	};
+}
+async function openapiCommand(options = {}) {
+	const logger = console;
+	try {
+		const loadedConfig = await loadWorkspaceConfig(options.cwd);
+		if (loadedConfig.type === "single") {
+			const config = loadedConfig.raw;
+			if (!config.openapi) config.openapi = { enabled: true };
+			const result = await generateOpenApiFrom(config.constructs, {
+				openapi: config.openapi,
+				root: loadedConfig.workspace.root,
+				...options.telemetry !== void 0 ? { telemetry: options.telemetry } : {}
+			});
+			if (result) logger.log(`Found ${result.endpointCount} endpoints`);
+		} else {
+			const { workspace } = loadedConfig;
+			const workspaceRoot = workspace.root;
+			const backendApps = Object.entries(workspace.apps).filter(([_, app]) => app.type === "backend" && app.openapi !== false && (typeof app.openapi !== "object" || app.openapi.enabled !== false));
+			if (backendApps.length === 0) {
+				logger.log("No backend apps with OpenAPI enabled found");
+				return;
+			}
+			if (options.app) {
+				const entry = backendApps.find(([name]) => name === options.app);
+				if (!entry) throw new Error(`App "${options.app}" not found or has OpenAPI disabled`);
+				const [appName, app] = entry;
+				const result = await generateOpenApiForApp(workspace, appName, app, true, options.telemetry);
+				if (result) logger.log(`📄 [${appName}] Generated OpenAPI (${result.endpointCount} endpoints)`);
+				return;
+			}
+			for (const [appName, app] of backendApps) {
+				const appPath = join(workspaceRoot, app.path);
+				if (resolve(appPath) === resolve(workspaceRoot)) {
+					const result = await generateOpenApiForApp(workspace, appName, app, false, options.telemetry);
+					if (result) logger.log(`Found ${result.endpointCount} endpoints`);
+					continue;
+				}
+				await runOpenApiInSubprocess(appPath, appName, options.telemetry);
+			}
+		}
+	} catch (error) {
+		throw new Error(`OpenAPI generation failed: ${error.message}`);
+	}
+}
+/**
+* Generate OpenAPI for a single named app within a workspace.
+* Runs in-process. The caller is responsible for ensuring `process.cwd()`
+* is the app's directory so tsx loads the app's tsconfig path aliases.
+*
+* The endpoints are found the way the app's build finds them — through the
+* workspace's constructs globs — never by importing every `.ts` under the app,
+* which loaded its tests and gkm's own generated files with them.
+*/
+async function generateOpenApiForApp(workspace, appName, app, silent = true, telemetry) {
+	if (app.type !== "backend") return null;
+	return generateOpenApi((await new EndpointGenerator().load(appConstructGlobs(workspace, appName))).map(({ construct }) => construct).filter((endpoint) => {
+		const owner = endpoint.owner ?? endpoint.surface?.id;
+		if (!owner) return false;
+		const key = appKey(owner);
+		return key === appName || !workspace.apps[key];
+	}), {
+		openapi: app.openapi ?? { enabled: true },
+		silent,
+		root: workspace.root,
+		...telemetry !== void 0 ? { telemetry } : {}
+	});
+}
+/**
+* Resolve the gkm bin path. Tests can override via `GKM_BIN_PATH` env var
+* to avoid depending on the built dist.
+*/
+function resolveGkmBinPath() {
+	if (process.env.GKM_BIN_PATH) return process.env.GKM_BIN_PATH;
+	return fileURLToPath(new URL("../bin/gkm.mjs", import.meta.url));
+}
+/**
+* Spawn a subprocess that runs `gkm openapi --app <name>` with `cwd` set to
+* the app's directory. Inherits `NODE_OPTIONS` (which already contains
+* `--import tsx`), so the child gets a fresh tsx instance whose tsconfig
+* discovery picks up the app's tsconfig path aliases.
+*/
+async function runOpenApiInSubprocess(appCwd, appName, telemetry) {
+	const binPath = resolveGkmBinPath();
+	await new Promise((resolve, reject) => {
+		const child = spawn(process.execPath, [
+			binPath,
+			"openapi",
+			"--app",
+			appName,
+			...telemetryArgs(telemetry)
+		], {
+			cwd: appCwd,
+			stdio: "inherit",
+			env: process.env
+		});
+		child.on("error", reject);
+		child.on("close", (code) => {
+			if (code === 0) resolve();
+			else reject(/* @__PURE__ */ new Error(`OpenAPI generation for app "${appName}" exited with code ${code}`));
+		});
+	});
+}
+//#endregion
+export { generateOpenApi, generateOpenApiFrom, openApiPathFor, openapiCommand, parseTelemetryFlag, resolveOpenApiConfig };
 
-export { OPENAPI_OUTPUT_PATH, generateOpenApi, generateOpenApiFrom, openApiPathFor, openapiCommand, resolveOpenApiConfig };
+//# sourceMappingURL=openapi.mjs.map

package/dist/openapi.mjs.map

@@ -0,0 +1 @@
+{"version":3,"file":"openapi.mjs","names":["relative","relativePath"],"sources":["../src/openapi.ts"],"sourcesContent":["#!/usr/bin/env -S npx tsx\n\nimport { spawn } from 'node:child_process';\nimport { mkdir, writeFile } from 'node:fs/promises';\nimport { dirname, join, relative as relativePath, resolve } from 'node:path';\nimport { fileURLToPath } from 'node:url';\nimport type { Endpoint } from '@geekmidas/constructs/endpoints';\nimport { kebabCase } from '@geekmidas/manifest';\nimport { loadWorkspaceConfig } from './config.js';\nimport type { ClientTelemetryDefault } from './generators/clientTelemetry.js';\nimport { telemetryArgs } from './generators/clientTelemetry.js';\nimport { EndpointGenerator } from './generators/EndpointGenerator.js';\nimport { OpenApiTsGenerator } from './generators/OpenApiTsGenerator.js';\n\nexport { parseTelemetryFlag } from './generators/clientTelemetry.js';\n\nimport type { GkmConfig, OpenApiConfig, Routes } from './types.js';\nimport { appKey } from './workspace/derive.js';\nimport { appConstructGlobs } from './workspace/index.js';\nimport type {\n\tNormalizedAppConfig,\n\tNormalizedWorkspace,\n} from './workspace/types.js';\n\ninterface OpenAPIOptions {\n\tcwd?: string;\n\t/**\n\t * Workspace mode: generate for a single named backend app. When set,\n\t * generation runs in-process against the current CWD. When unset,\n\t * workspace mode spawns one subprocess per backend app so each gets a\n\t * fresh tsx that loads the app's own tsconfig (path aliases included).\n\t */\n\tapp?: string;\n\t/**\n\t * Trace propagation in the clients written, off when absent — see\n\t * {@link ClientTelemetryDefault}. `gkm openapi --telemetry [rate]`.\n\t */\n\ttelemetry?: ClientTelemetryDefault;\n}\n\n/**\n * Where a surface's generated client lands, under the workspace root.\n *\n * Named from the surface, so `new RestApi('Webhooks')` writes\n * `.gkm/client/webhooks.ts` — the same kebab form that gives it its container\n * name and its `WEBHOOKS_URL` — and a site imports it as\n * `@<name>/client/webhooks`, through the alias its tsconfig maps.\n */\nexport function openApiPathFor(surfaceId: string): string {\n\treturn `./.gkm/client/${kebabCase(surfaceId)}.ts`;\n}\n\n/**\n * Resolve OpenAPI config from GkmConfig\n */\nexport function resolveOpenApiConfig(config: {\n\topenapi?: boolean | OpenApiConfig;\n}): OpenApiConfig & { enabled: boolean } {\n\tif (config.openapi === false) {\n\t\treturn { enabled: false };\n\t}\n\n\tif (config.openapi === true || config.openapi === undefined) {\n\t\t// Enable by default when not explicitly set (undefined) or explicitly true\n\t\treturn {\n\t\t\tenabled: true,\n\t\t\ttitle: 'API Documentation',\n\t\t\tversion: '1.0.0',\n\t\t\tdescription: 'Auto-generated API documentation from endpoints',\n\t\t};\n\t}\n\n\treturn {\n\t\tenabled: config.openapi.enabled !== false,\n\t\ttitle: config.openapi.title || 'API Documentation',\n\t\tversion: config.openapi.version || '1.0.0',\n\t\tdescription:\n\t\t\tconfig.openapi.description ||\n\t\t\t'Auto-generated API documentation from endpoints',\n\t};\n}\n\n/** What a generation run wrote. */\nexport interface OpenApiResult {\n\t/** The first spec written — kept so existing callers still compile. */\n\toutputPath: string;\n\t/** Every spec written, one per surface. */\n\toutputPaths: string[];\n\t/** Endpoints across all of them. */\n\tendpointCount: number;\n}\n\n/**\n * Load endpoints from a glob, then generate.\n *\n * For the callers that have no endpoints in hand — `gkm openapi`, and `gkm dev`\n * regenerating on reload. The glob is the app's derived one — the conventional\n * directories under it — not a `routes` field anybody wrote.\n */\nexport async function generateOpenApiFrom(\n\troutes: Routes,\n\toptions: {\n\t\topenapi?: boolean | OpenApiConfig;\n\t\tsilent?: boolean;\n\t\tbustCache?: boolean;\n\t\troot?: string;\n\t\ttelemetry?: ClientTelemetryDefault;\n\t} = {},\n): Promise<OpenApiResult | null> {\n\tconst loaded = await new EndpointGenerator().load(\n\t\troutes,\n\t\tundefined,\n\t\toptions.bustCache,\n\t);\n\n\treturn generateOpenApi(\n\t\tloaded.map(({ construct }) => construct),\n\t\toptions,\n\t);\n}\n\n/**\n * Generate an OpenAPI spec for each surface these endpoints name.\n *\n * Takes the endpoints, not a glob to find them with. The build has already\n * loaded every one of them to generate handlers, so globbing again was a second\n * discovery pass over the same files — and the reason this function needed a\n * `routes` to be told where to look, which is how a retired config field stayed\n * load-bearing.\n *\n * @returns What was written, or null if disabled or there were none\n */\nexport async function generateOpenApi(\n\tendpoints: readonly Endpoint<any, any, any, any, any>[],\n\toptions: {\n\t\topenapi?: boolean | OpenApiConfig;\n\t\tsilent?: boolean;\n\t\t/**\n\t\t * The workspace root, whose `.gkm/client/` holds every surface's client.\n\t\t * The client is the application's, like its manifest — a site reaches it\n\t\t * as `@<name>/client/<surface>` — so it is written there whichever\n\t\t * directory the build happened to run in.\n\t\t */\n\t\troot?: string;\n\t\t/**\n\t\t * Whether the clients written propagate trace context by default. Off\n\t\t * when absent: the integration point for a site's edge to a\n\t\t * `Telemetry` construct, which decides it for the clients it imports.\n\t\t */\n\t\ttelemetry?: ClientTelemetryDefault;\n\t} = {},\n): Promise<OpenApiResult | null> {\n\tconst root = options.root ?? process.cwd();\n\tconst logger = options.silent ? { log: () => {} } : console;\n\tconst openApiConfig = resolveOpenApiConfig({ openapi: options.openapi });\n\n\tif (!openApiConfig.enabled) {\n\t\treturn null;\n\t}\n\n\tif (endpoints.length === 0) {\n\t\tlogger.log('No valid endpoints found for OpenAPI generation');\n\t\treturn null;\n\t}\n\n\t// One spec per surface, not one per glob.\n\t//\n\t// The glob is a directory, and a directory is not a surface: two `RestApi`s\n\t// whose endpoints live side by side produced a single spec describing both,\n\t// under a filename that named neither. Every endpoint carries the surface\n\t// that serves it, so that is what the spec is cut along — `Api` becomes\n\t// `api.ts`, `Webhooks` becomes `webhooks.ts`, by the same kebab rule that\n\t// gives the surface its container name and its environment keys.\n\tconst bySurface = new Map<string, Endpoint<any, any, any, any, any>[]>();\n\tfor (const endpoint of endpoints) {\n\t\tconst owner = endpoint.owner ?? endpoint.surface?.id;\n\t\tif (!owner) continue;\n\t\tconst existing = bySurface.get(owner);\n\t\tif (existing) existing.push(endpoint);\n\t\telse bySurface.set(owner, [endpoint]);\n\t}\n\n\tif (bySurface.size === 0) {\n\t\tlogger.log('No endpoints named a surface, so no OpenAPI was generated');\n\t\treturn null;\n\t}\n\n\tconst tsGenerator = new OpenApiTsGenerator();\n\tconst written: string[] = [];\n\n\tfor (const [surfaceId, surfaceEndpoints] of bySurface) {\n\t\tconst relative = openApiPathFor(surfaceId);\n\t\tconst outputPath = join(root, relative);\n\n\t\tawait mkdir(dirname(outputPath), { recursive: true });\n\n\t\tconst tsContent = await tsGenerator.generate(surfaceEndpoints, {\n\t\t\t// The surface's own name, so a spec says which API it describes\n\t\t\t// rather than repeating one title across all of them.\n\t\t\ttitle: openApiConfig.title ?? surfaceId,\n\t\t\tversion: openApiConfig.version!,\n\t\t\tdescription: openApiConfig.description!,\n\t\t\t...(options.telemetry !== undefined\n\t\t\t\t? { telemetry: options.telemetry }\n\t\t\t\t: {}),\n\t\t});\n\n\t\tawait writeFile(outputPath, tsContent);\n\t\twritten.push(relative);\n\t\tlogger.log(\n\t\t\t`📄 OpenAPI client generated: ${relativePath(process.cwd(), outputPath)} (${surfaceEndpoints.length} endpoints)`,\n\t\t);\n\t}\n\n\treturn {\n\t\t// The first, for a caller that wants one path. `outputPaths` has them all.\n\t\toutputPath: join(root, written[0]!),\n\t\toutputPaths: written.map((r) => join(root, r)),\n\t\tendpointCount: endpoints.length,\n\t};\n}\n\nexport async function openapiCommand(\n\toptions: OpenAPIOptions = {},\n): Promise<void> {\n\tconst logger = console;\n\n\ttry {\n\t\tconst loadedConfig = await loadWorkspaceConfig(options.cwd);\n\n\t\tif (loadedConfig.type === 'single') {\n\t\t\t// Single-app config - use existing behavior\n\t\t\tconst config = loadedConfig.raw as GkmConfig;\n\n\t\t\t// Enable openapi if not configured\n\t\t\tif (!config.openapi) {\n\t\t\t\tconfig.openapi = { enabled: true };\n\t\t\t}\n\n\t\t\tconst result = await generateOpenApiFrom(config.constructs, {\n\t\t\t\topenapi: config.openapi,\n\t\t\t\troot: loadedConfig.workspace.root,\n\t\t\t\t...(options.telemetry !== undefined\n\t\t\t\t\t? { telemetry: options.telemetry }\n\t\t\t\t\t: {}),\n\t\t\t});\n\n\t\t\tif (result) {\n\t\t\t\tlogger.log(`Found ${result.endpointCount} endpoints`);\n\t\t\t}\n\t\t} else {\n\t\t\t// Workspace config - generate for each backend app\n\t\t\tconst { workspace } = loadedConfig;\n\t\t\t// Always derive the workspace root from the loaded config rather than\n\t\t\t// CWD. Subprocesses run with CWD set to an app directory, and falling\n\t\t\t// back to CWD there causes `join(workspaceRoot, app.path)` to point at\n\t\t\t// a non-existent nested path (e.g. `apps/api/apps/api`).\n\t\t\tconst workspaceRoot = workspace.root;\n\n\t\t\t// Backend apps with openapi enabled — which is all of them that have\n\t\t\t// routes, unless one says otherwise.\n\t\t\t//\n\t\t\t// This used to require `openapi: true` written out, while the app's\n\t\t\t// own build generated a spec regardless. Two paths disagreeing about\n\t\t\t// the same flag: the app emitted `.gkm/openapi.ts` and this pass,\n\t\t\t// finding nothing \"enabled\", skipped copying it to the frontends that\n\t\t\t// consume it. A surface whose routes are declared rather than\n\t\t\t// discovered has no spec to generate, so it is not a candidate.\n\t\t\tconst backendApps = Object.entries(workspace.apps).filter(\n\t\t\t\t([_, app]) =>\n\t\t\t\t\tapp.type === 'backend' &&\n\t\t\t\t\tapp.openapi !== false &&\n\t\t\t\t\t(typeof app.openapi !== 'object' || app.openapi.enabled !== false),\n\t\t\t);\n\n\t\t\tif (backendApps.length === 0) {\n\t\t\t\tlogger.log('No backend apps with OpenAPI enabled found');\n\t\t\t\treturn;\n\t\t\t}\n\n\t\t\t// Single-app mode: generate in-process. The caller is expected to\n\t\t\t// have CWD set to the app's directory (e.g., when invoked as a\n\t\t\t// subprocess), so tsx picks up the app's tsconfig path aliases.\n\t\t\tif (options.app) {\n\t\t\t\tconst entry = backendApps.find(([name]) => name === options.app);\n\t\t\t\tif (!entry) {\n\t\t\t\t\tthrow new Error(\n\t\t\t\t\t\t`App \"${options.app}\" not found or has OpenAPI disabled`,\n\t\t\t\t\t);\n\t\t\t\t}\n\t\t\t\tconst [appName, app] = entry;\n\t\t\t\tconst result = await generateOpenApiForApp(\n\t\t\t\t\tworkspace,\n\t\t\t\t\tappName,\n\t\t\t\t\tapp,\n\t\t\t\t\ttrue,\n\t\t\t\t\toptions.telemetry,\n\t\t\t\t);\n\t\t\t\tif (result) {\n\t\t\t\t\tlogger.log(\n\t\t\t\t\t\t`📄 [${appName}] Generated OpenAPI (${result.endpointCount} endpoints)`,\n\t\t\t\t\t);\n\t\t\t\t}\n\t\t\t\treturn;\n\t\t\t}\n\n\t\t\t// Multi-app mode: spawn a subprocess per backend app. Each\n\t\t\t// subprocess starts with CWD at the app's directory so that\n\t\t\t// tsx's tsconfig discovery picks up the app's `paths` aliases\n\t\t\t// (e.g., `~/*`) instead of the workspace root's tsconfig.\n\t\t\tfor (const [appName, app] of backendApps) {\n\t\t\t\t// No `app.routes` check any more: the per-kind globs are gone, and\n\t\t\t\t// an app's code is found by one glob rather than by a field naming\n\t\t\t\t// endpoints. Guarding on `routes` here meant every app was skipped\n\t\t\t\t// the moment that field stopped existing — silently, because a loop\n\t\t\t\t// that runs zero times looks exactly like one with nothing to do.\n\t\t\t\tconst appPath = join(workspaceRoot, app.path);\n\n\t\t\t\t// A subprocess exists to put CWD inside the app, so tsx picks up\n\t\t\t\t// that app's tsconfig aliases instead of the workspace root's. When\n\t\t\t\t// the app *is* the root there is nothing to change: spawning would\n\t\t\t\t// re-enter the same directory, having paid for a process and a\n\t\t\t\t// module graph, and needing `tsx` resolvable from it.\n\t\t\t\tif (resolve(appPath) === resolve(workspaceRoot)) {\n\t\t\t\t\t// Not silent: silence is for a subprocess whose output the\n\t\t\t\t\t// parent relays, and there is no parent here to relay it. The\n\t\t\t\t\t// per-surface lines come from the generator; the count is this\n\t\t\t\t\t// command's own summary, as in the single-app path.\n\t\t\t\t\tconst result = await generateOpenApiForApp(\n\t\t\t\t\t\tworkspace,\n\t\t\t\t\t\tappName,\n\t\t\t\t\t\tapp,\n\t\t\t\t\t\tfalse,\n\t\t\t\t\t\toptions.telemetry,\n\t\t\t\t\t);\n\t\t\t\t\tif (result) {\n\t\t\t\t\t\tlogger.log(`Found ${result.endpointCount} endpoints`);\n\t\t\t\t\t}\n\t\t\t\t\tcontinue;\n\t\t\t\t}\n\n\t\t\t\tawait runOpenApiInSubprocess(appPath, appName, options.telemetry);\n\t\t\t}\n\t\t}\n\t} catch (error) {\n\t\tthrow new Error(`OpenAPI generation failed: ${(error as Error).message}`);\n\t}\n}\n\n/**\n * Generate OpenAPI for a single named app within a workspace.\n * Runs in-process. The caller is responsible for ensuring `process.cwd()`\n * is the app's directory so tsx loads the app's tsconfig path aliases.\n *\n * The endpoints are found the way the app's build finds them — through the\n * workspace's constructs globs — never by importing every `.ts` under the app,\n * which loaded its tests and gkm's own generated files with them.\n */\nasync function generateOpenApiForApp(\n\tworkspace: NormalizedWorkspace,\n\tappName: string,\n\tapp: NormalizedAppConfig,\n\t/**\n\t * Quiet by default, because the usual caller is a subprocess whose output\n\t * the parent relays. Generating in-process there is no parent to relay to,\n\t * and silence would swallow the only report of what happened.\n\t */\n\tsilent = true,\n\ttelemetry?: ClientTelemetryDefault,\n): Promise<{ outputPath: string; endpointCount: number } | null> {\n\tif (app.type !== 'backend') {\n\t\treturn null;\n\t}\n\n\tconst loaded = await new EndpointGenerator().load(\n\t\tappConstructGlobs(workspace, appName),\n\t);\n\n\t// The workspace's globs reach every app's code, so each app writes its own\n\t// surfaces' clients and no other's. An endpoint whose surface is no app of\n\t// this workspace's has nowhere else to go, and stays.\n\tconst endpoints = loaded\n\t\t.map(({ construct }) => construct)\n\t\t.filter((endpoint) => {\n\t\t\tconst owner = endpoint.owner ?? endpoint.surface?.id;\n\t\t\tif (!owner) return false;\n\t\t\tconst key = appKey(owner);\n\t\t\treturn key === appName || !workspace.apps[key];\n\t\t});\n\n\treturn generateOpenApi(endpoints, {\n\t\t// Absent means enabled, which is what the caller's filter already decided\n\t\t// when it kept this app: it skips one that says `openapi: false` and keeps\n\t\t// every other. Passing `undefined` through let `resolveOpenApiConfig`\n\t\t// default it to *disabled*, so an app selected for generation generated\n\t\t// nothing and said nothing — two places disagreeing about one flag, which\n\t\t// is the failure the filter above was written to describe.\n\t\topenapi: app.openapi ?? { enabled: true },\n\t\tsilent,\n\t\troot: workspace.root,\n\t\t...(telemetry !== undefined ? { telemetry } : {}),\n\t});\n}\n\n/**\n * Resolve the gkm bin path. Tests can override via `GKM_BIN_PATH` env var\n * to avoid depending on the built dist.\n */\nfunction resolveGkmBinPath(): string {\n\tif (process.env.GKM_BIN_PATH) {\n\t\treturn process.env.GKM_BIN_PATH;\n\t}\n\treturn fileURLToPath(new URL('../bin/gkm.mjs', import.meta.url));\n}\n\n/**\n * Spawn a subprocess that runs `gkm openapi --app <name>` with `cwd` set to\n * the app's directory. Inherits `NODE_OPTIONS` (which already contains\n * `--import tsx`), so the child gets a fresh tsx instance whose tsconfig\n * discovery picks up the app's tsconfig path aliases.\n */\nasync function runOpenApiInSubprocess(\n\tappCwd: string,\n\tappName: string,\n\ttelemetry?: ClientTelemetryDefault,\n): Promise<void> {\n\tconst binPath = resolveGkmBinPath();\n\n\tawait new Promise<void>((resolve, reject) => {\n\t\tconst child = spawn(\n\t\t\tprocess.execPath,\n\t\t\t[binPath, 'openapi', '--app', appName, ...telemetryArgs(telemetry)],\n\t\t\t{\n\t\t\t\tcwd: appCwd,\n\t\t\t\tstdio: 'inherit',\n\t\t\t\tenv: process.env,\n\t\t\t},\n\t\t);\n\n\t\tchild.on('error', reject);\n\t\tchild.on('close', (code) => {\n\t\t\tif (code === 0) {\n\t\t\t\tresolve();\n\t\t\t} else {\n\t\t\t\treject(\n\t\t\t\t\tnew Error(\n\t\t\t\t\t\t`OpenAPI generation for app \"${appName}\" exited with code ${code}`,\n\t\t\t\t\t),\n\t\t\t\t);\n\t\t\t}\n\t\t});\n\t});\n}\n"],"mappings":";;;;;;;;;;;;;;;;;;;;AAgDA,SAAgB,eAAe,WAA2B;CACzD,OAAO,iBAAiB,UAAU,SAAS,EAAE;AAC9C;;;;AAKA,SAAgB,qBAAqB,QAEI;CACxC,IAAI,OAAO,YAAY,OACtB,OAAO,EAAE,SAAS,MAAM;CAGzB,IAAI,OAAO,YAAY,QAAQ,OAAO,YAAY,KAAA,GAEjD,OAAO;EACN,SAAS;EACT,OAAO;EACP,SAAS;EACT,aAAa;CACd;CAGD,OAAO;EACN,SAAS,OAAO,QAAQ,YAAY;EACpC,OAAO,OAAO,QAAQ,SAAS;EAC/B,SAAS,OAAO,QAAQ,WAAW;EACnC,aACC,OAAO,QAAQ,eACf;CACF;AACD;;;;;;;;AAmBA,eAAsB,oBACrB,QACA,UAMI,CAAC,GAC2B;CAOhC,OAAO,iBACN,MAPoB,IAAI,kBAAkB,CAAC,CAAC,KAC5C,QACA,KAAA,GACA,QAAQ,SACT,EAAA,CAGQ,KAAK,EAAE,gBAAgB,SAAS,GACvC,OACD;AACD;;;;;;;;;;;;AAaA,eAAsB,gBACrB,WACA,UAgBI,CAAC,GAC2B;CAChC,MAAM,OAAO,QAAQ,QAAQ,QAAQ,IAAI;CACzC,MAAM,SAAS,QAAQ,SAAS,EAAE,WAAW,CAAC,EAAE,IAAI;CACpD,MAAM,gBAAgB,qBAAqB,EAAE,SAAS,QAAQ,QAAQ,CAAC;CAEvE,IAAI,CAAC,cAAc,SAClB,OAAO;CAGR,IAAI,UAAU,WAAW,GAAG;EAC3B,OAAO,IAAI,iDAAiD;EAC5D,OAAO;CACR;CAUA,MAAM,4BAAY,IAAI,IAAiD;CACvE,KAAK,MAAM,YAAY,WAAW;EACjC,MAAM,QAAQ,SAAS,SAAS,SAAS,SAAS;EAClD,IAAI,CAAC,OAAO;EACZ,MAAM,WAAW,UAAU,IAAI,KAAK;EACpC,IAAI,UAAU,SAAS,KAAK,QAAQ;OAC/B,UAAU,IAAI,OAAO,CAAC,QAAQ,CAAC;CACrC;CAEA,IAAI,UAAU,SAAS,GAAG;EACzB,OAAO,IAAI,2DAA2D;EACtE,OAAO;CACR;CAEA,MAAM,cAAc,IAAI,mBAAmB;CAC3C,MAAM,UAAoB,CAAC;CAE3B,KAAK,MAAM,CAAC,WAAW,qBAAqB,WAAW;EACtD,MAAMA,aAAW,eAAe,SAAS;EACzC,MAAM,aAAa,KAAK,MAAMA,UAAQ;EAEtC,MAAM,MAAM,QAAQ,UAAU,GAAG,EAAE,WAAW,KAAK,CAAC;EAEpD,MAAM,YAAY,MAAM,YAAY,SAAS,kBAAkB;GAG9D,OAAO,cAAc,SAAS;GAC9B,SAAS,cAAc;GACvB,aAAa,cAAc;GAC3B,GAAI,QAAQ,cAAc,KAAA,IACvB,EAAE,WAAW,QAAQ,UAAU,IAC/B,CAAC;EACL,CAAC;EAED,MAAM,UAAU,YAAY,SAAS;EACrC,QAAQ,KAAKA,UAAQ;EACrB,OAAO,IACN,gCAAgCC,SAAa,QAAQ,IAAI,GAAG,UAAU,EAAE,IAAI,iBAAiB,OAAO,YACrG;CACD;CAEA,OAAO;EAEN,YAAY,KAAK,MAAM,QAAQ,EAAG;EAClC,aAAa,QAAQ,KAAK,MAAM,KAAK,MAAM,CAAC,CAAC;EAC7C,eAAe,UAAU;CAC1B;AACD;AAEA,eAAsB,eACrB,UAA0B,CAAC,GACX;CAChB,MAAM,SAAS;CAEf,IAAI;EACH,MAAM,eAAe,MAAM,oBAAoB,QAAQ,GAAG;EAE1D,IAAI,aAAa,SAAS,UAAU;GAEnC,MAAM,SAAS,aAAa;GAG5B,IAAI,CAAC,OAAO,SACX,OAAO,UAAU,EAAE,SAAS,KAAK;GAGlC,MAAM,SAAS,MAAM,oBAAoB,OAAO,YAAY;IAC3D,SAAS,OAAO;IAChB,MAAM,aAAa,UAAU;IAC7B,GAAI,QAAQ,cAAc,KAAA,IACvB,EAAE,WAAW,QAAQ,UAAU,IAC/B,CAAC;GACL,CAAC;GAED,IAAI,QACH,OAAO,IAAI,SAAS,OAAO,cAAc,WAAW;EAEtD,OAAO;GAEN,MAAM,EAAE,cAAc;GAKtB,MAAM,gBAAgB,UAAU;GAWhC,MAAM,cAAc,OAAO,QAAQ,UAAU,IAAI,CAAC,CAAC,QACjD,CAAC,GAAG,SACJ,IAAI,SAAS,aACb,IAAI,YAAY,UACf,OAAO,IAAI,YAAY,YAAY,IAAI,QAAQ,YAAY,MAC9D;GAEA,IAAI,YAAY,WAAW,GAAG;IAC7B,OAAO,IAAI,4CAA4C;IACvD;GACD;GAKA,IAAI,QAAQ,KAAK;IAChB,MAAM,QAAQ,YAAY,MAAM,CAAC,UAAU,SAAS,QAAQ,GAAG;IAC/D,IAAI,CAAC,OACJ,MAAM,IAAI,MACT,QAAQ,QAAQ,IAAI,oCACrB;IAED,MAAM,CAAC,SAAS,OAAO;IACvB,MAAM,SAAS,MAAM,sBACpB,WACA,SACA,KACA,MACA,QAAQ,SACT;IACA,IAAI,QACH,OAAO,IACN,OAAO,QAAQ,uBAAuB,OAAO,cAAc,YAC5D;IAED;GACD;GAMA,KAAK,MAAM,CAAC,SAAS,QAAQ,aAAa;IAMzC,MAAM,UAAU,KAAK,eAAe,IAAI,IAAI;IAO5C,IAAI,QAAQ,OAAO,MAAM,QAAQ,aAAa,GAAG;KAKhD,MAAM,SAAS,MAAM,sBACpB,WACA,SACA,KACA,OACA,QAAQ,SACT;KACA,IAAI,QACH,OAAO,IAAI,SAAS,OAAO,cAAc,WAAW;KAErD;IACD;IAEA,MAAM,uBAAuB,SAAS,SAAS,QAAQ,SAAS;GACjE;EACD;CACD,SAAS,OAAO;EACf,MAAM,IAAI,MAAM,8BAA+B,MAAgB,SAAS;CACzE;AACD;;;;;;;;;;AAWA,eAAe,sBACd,WACA,SACA,KAMA,SAAS,MACT,WACgE;CAChE,IAAI,IAAI,SAAS,WAChB,OAAO;CAmBR,OAAO,iBATW,MAPG,IAAI,kBAAkB,CAAC,CAAC,KAC5C,kBAAkB,WAAW,OAAO,CACrC,EAAA,CAME,KAAK,EAAE,gBAAgB,SAAS,CAAC,CACjC,QAAQ,aAAa;EACrB,MAAM,QAAQ,SAAS,SAAS,SAAS,SAAS;EAClD,IAAI,CAAC,OAAO,OAAO;EACnB,MAAM,MAAM,OAAO,KAAK;EACxB,OAAO,QAAQ,WAAW,CAAC,UAAU,KAAK;CAC3C,CAE8B,GAAG;EAOjC,SAAS,IAAI,WAAW,EAAE,SAAS,KAAK;EACxC;EACA,MAAM,UAAU;EAChB,GAAI,cAAc,KAAA,IAAY,EAAE,UAAU,IAAI,CAAC;CAChD,CAAC;AACF;;;;;AAMA,SAAS,oBAA4B;CACpC,IAAI,QAAQ,IAAI,cACf,OAAO,QAAQ,IAAI;CAEpB,OAAO,cAAc,IAAI,IAAI,kBAAkB,YAAY,GAAG,CAAC;AAChE;;;;;;;AAQA,eAAe,uBACd,QACA,SACA,WACgB;CAChB,MAAM,UAAU,kBAAkB;CAElC,MAAM,IAAI,SAAe,SAAS,WAAW;EAC5C,MAAM,QAAQ,MACb,QAAQ,UACR;GAAC;GAAS;GAAW;GAAS;GAAS,GAAG,cAAc,SAAS;EAAC,GAClE;GACC,KAAK;GACL,OAAO;GACP,KAAK,QAAQ;EACd,CACD;EAEA,MAAM,GAAG,SAAS,MAAM;EACxB,MAAM,GAAG,UAAU,SAAS;GAC3B,IAAI,SAAS,GACZ,QAAQ;QAER,uBACC,IAAI,MACH,+BAA+B,QAAQ,qBAAqB,MAC7D,CACD;EAEF,CAAC;CACF,CAAC;AACF"}

package/dist/projectBucket-BBbQ1lHF.cjs

@@ -0,0 +1,263 @@
+const require_errors = require("./errors-DMC4Umsb.cjs");
+require("./identity-CbLfgQNT.cjs");
+let node_crypto = require("node:crypto");
+//#region src/providers/projectBucket.ts
+/**
+* The project bucket: one S3 bucket per project and AWS account, created and
+* owned by gkm, that holds what gkm keeps for every stage — the deploy state
+* under `<prefix>/<project>/<stage>/`, and anything else gkm writes per stage
+* beside it.
+*
+* Nothing can record its name — the deploy state lives in it — so the name is
+* worked out the same way every time: `gkm-<scope>-<account id>`, the scope
+* being the one the `s3` objects provider names its buckets with. The account
+* id keeps it from clashing with another account's project of the same name
+* without a random suffix; a clash that happens anyway (HeadBucket 403) is
+* refused, never adopted.
+*
+* Created with versioning, SSE-S3, every public access blocked, ownership
+* enforced for the bucket owner, a lifecycle that expires old versions, and
+* the tag `gkm:project=<identity key>`.
+*/
+/** What the project part may take: 63 less `gkm-`, `-` and a 12-digit id. */
+const SCOPE_MAX = 46;
+/** The tag the bucket is created with, as the `s3` provider tags its own. */
+const PROJECT_BUCKET_TAG = "gkm:project";
+/** The bucket's name is held by another account, or cannot be reached. */
+var ProjectBucketTaken = class extends require_errors.GkmError {
+	bucket;
+	status;
+	constructor(bucket, status) {
+		super(`The project bucket '${bucket}' ${status === 301 ? "is in another region than the one configured" : "exists and this account cannot reach it — another account holds the name"} (HTTP ${status}). Name a bucket you own instead — in gkm.config.ts: state: { provider: 's3', bucket: '<your bucket>', region: '<its region>' } — or run with the credentials of the account the name is for.`);
+		this.bucket = bucket;
+		this.status = status;
+		this.name = "ProjectBucketTaken";
+	}
+};
+/** The running credentials may not create the project bucket. */
+var ProjectBucketNotCreatable = class extends require_errors.GkmError {
+	bucket;
+	reason;
+	constructor(bucket, reason) {
+		super(`The project bucket '${bucket}' does not exist yet, and these credentials cannot create it (${reason}). Run the first deploy with credentials allowed s3:CreateBucket and the bucket put-config actions on it — \`gkm deploy:github\` grants them to the CI role — or name an existing bucket: state: { provider: 's3', bucket, region }.`);
+		this.bucket = bucket;
+		this.reason = reason;
+		this.name = "ProjectBucketNotCreatable";
+	}
+};
+/** {@link projectBucket}, from a deploy identity's scope. */
+function projectBucketName(scope, accountId) {
+	let part = scope.toLowerCase().replace(/[^a-z0-9]+/g, "-").replace(/^-+|-+$/g, "");
+	if (part.length > SCOPE_MAX) {
+		const hash = (0, node_crypto.createHash)("sha256").update(scope).digest("hex").slice(0, 6);
+		part = `${part.slice(0, 39).replace(/-+$/, "")}-${hash}`;
+	}
+	return `gkm-${part}-${accountId}`;
+}
+/** The account the credentials are in — what the bucket is named by. */
+async function callerAccountId(sts) {
+	const { GetCallerIdentityCommand } = await import("@aws-sdk/client-sts");
+	const { Account } = await sts.send(new GetCallerIdentityCommand({}));
+	return Account ?? "";
+}
+/**
+* The bucket's whole lifecycle configuration. A put replaces every rule the
+* bucket has, so this is the one place the set is built: the bucket's own
+* noncurrent-version expiry, and any per-prefix expiry passed in.
+*/
+function projectBucketLifecycle(expiries = []) {
+	return [{
+		ID: "gkm-noncurrent-versions",
+		Status: "Enabled",
+		Filter: { Prefix: "" },
+		NoncurrentVersionExpiration: { NoncurrentDays: 90 },
+		Expiration: { ExpiredObjectDeleteMarker: true }
+	}, ...expiries.map((expiry) => ({
+		ID: expiry.id,
+		Status: "Enabled",
+		Filter: { Prefix: expiry.prefix },
+		Expiration: { Days: expiry.days },
+		...expiry.abortIncompleteDays ? { AbortIncompleteMultipartUpload: { DaysAfterInitiation: expiry.abortIncompleteDays } } : {}
+	}))];
+}
+/** A lifecycle rule reduced to what gkm sets, for comparing with what is there. */
+function canonicalRule(rule) {
+	return JSON.stringify({
+		id: rule.ID ?? "",
+		status: rule.Status ?? "",
+		prefix: rule.Filter?.Prefix ?? rule.Prefix ?? "",
+		days: rule.Expiration?.Days ?? null,
+		markers: rule.Expiration?.ExpiredObjectDeleteMarker ?? null,
+		noncurrent: rule.NoncurrentVersionExpiration?.NoncurrentDays ?? null,
+		abort: rule.AbortIncompleteMultipartUpload?.DaysAfterInitiation ?? null
+	});
+}
+/** Whether two rule sets say the same thing, in any order. */
+function sameLifecycle(a, b) {
+	const canonical = (rules) => rules.map(canonicalRule).sort().join("\n");
+	return canonical(a) === canonical(b);
+}
+/**
+* The project bucket's lifecycle put to {@link projectBucketLifecycle} of
+* `expiries` — every stage's — when what it holds says anything else.
+* Returns whether it was put; with `dryRun`, whether it would be.
+*/
+async function reconcileProjectBucketLifecycle(s3, bucket, expiries, options = {}) {
+	const S3 = await import("@aws-sdk/client-s3");
+	const rules = projectBucketLifecycle(expiries);
+	let current = [];
+	try {
+		current = (await s3.send(new S3.GetBucketLifecycleConfigurationCommand({ Bucket: bucket }))).Rules ?? [];
+	} catch (error) {
+		const failure = error;
+		if ((failure.Code ?? failure.name) !== "NoSuchLifecycleConfiguration") throw error;
+	}
+	if (sameLifecycle(current, rules)) return false;
+	if (!options.dryRun) await s3.send(new S3.PutBucketLifecycleConfigurationCommand({
+		Bucket: bucket,
+		LifecycleConfiguration: { Rules: rules }
+	}));
+	return true;
+}
+/**
+* Whether `bucket` is this account's (`ours`) or does not exist (`none`).
+* Mapped by status: a HEAD has no body, so SDK v3 names a 301, 400 or 403
+* `Unknown`.
+*
+* @throws {ProjectBucketTaken} on a 403 or 301
+*/
+async function findProjectBucket(s3, bucket) {
+	const { HeadBucketCommand } = await import("@aws-sdk/client-s3");
+	try {
+		await s3.send(new HeadBucketCommand({ Bucket: bucket }));
+		return "ours";
+	} catch (error) {
+		const status = error.$metadata?.httpStatusCode;
+		if (status === 404) return "none";
+		if (status === 403 || status === 301) throw new ProjectBucketTaken(bucket, status);
+		throw error;
+	}
+}
+/**
+* The project bucket, created and configured if it does not exist yet.
+* Returns whether this call created it. One that exists is used as it is.
+*
+* @throws {ProjectBucketTaken} when another account holds the name
+* @throws {ProjectBucketNotCreatable} when the credentials may not create it
+*/
+async function ensureProjectBucket(s3, options) {
+	const { bucket: Bucket, region } = options;
+	if (await findProjectBucket(s3, Bucket) === "ours") return { created: false };
+	const S3 = await import("@aws-sdk/client-s3");
+	try {
+		await s3.send(new S3.CreateBucketCommand({
+			Bucket,
+			ObjectOwnership: "BucketOwnerEnforced",
+			...region === "us-east-1" ? {} : { CreateBucketConfiguration: { LocationConstraint: region } }
+		}));
+	} catch (error) {
+		const failure = error;
+		const code = failure.Code ?? failure.name;
+		if (code !== "BucketAlreadyOwnedByYou") {
+			if (code === "BucketAlreadyExists") throw new ProjectBucketTaken(Bucket, 409);
+			if (code === "AccessDenied" || failure.$metadata?.httpStatusCode === 403) throw new ProjectBucketNotCreatable(Bucket, failure.message ?? "AccessDenied");
+			throw error;
+		}
+	}
+	await s3.send(new S3.PutPublicAccessBlockCommand({
+		Bucket,
+		PublicAccessBlockConfiguration: {
+			BlockPublicAcls: true,
+			IgnorePublicAcls: true,
+			BlockPublicPolicy: true,
+			RestrictPublicBuckets: true
+		}
+	}));
+	await s3.send(new S3.PutBucketOwnershipControlsCommand({
+		Bucket,
+		OwnershipControls: { Rules: [{ ObjectOwnership: "BucketOwnerEnforced" }] }
+	}));
+	await s3.send(new S3.PutBucketEncryptionCommand({
+		Bucket,
+		ServerSideEncryptionConfiguration: { Rules: [{ ApplyServerSideEncryptionByDefault: { SSEAlgorithm: "AES256" } }] }
+	}));
+	await s3.send(new S3.PutBucketVersioningCommand({
+		Bucket,
+		VersioningConfiguration: { Status: "Enabled" }
+	}));
+	await s3.send(new S3.PutBucketLifecycleConfigurationCommand({
+		Bucket,
+		LifecycleConfiguration: { Rules: projectBucketLifecycle(options.expiries) }
+	}));
+	await s3.send(new S3.PutBucketTaggingCommand({
+		Bucket,
+		Tagging: { TagSet: [{
+			Key: PROJECT_BUCKET_TAG,
+			Value: options.identity.key
+		}] }
+	}));
+	return { created: true };
+}
+/**
+* The IAM actions creating and configuring the project bucket takes — what a
+* role that runs the first deploy needs on it, beside object access.
+*/
+const PROJECT_BUCKET_CREATE_ACTIONS = [
+	"s3:CreateBucket",
+	"s3:PutBucketVersioning",
+	"s3:PutEncryptionConfiguration",
+	"s3:PutBucketPublicAccessBlock",
+	"s3:PutBucketOwnershipControls",
+	"s3:PutLifecycleConfiguration",
+	"s3:PutBucketTagging"
+];
+/**
+* What keeping the project bucket's lifecycle takes on a bucket that exists:
+* reading it, to put it back only when it drifted.
+*/
+const PROJECT_BUCKET_LIFECYCLE_ACTIONS = ["s3:GetLifecycleConfiguration", "s3:PutLifecycleConfiguration"];
+//#endregion
+Object.defineProperty(exports, "PROJECT_BUCKET_CREATE_ACTIONS", {
+	enumerable: true,
+	get: function() {
+		return PROJECT_BUCKET_CREATE_ACTIONS;
+	}
+});
+Object.defineProperty(exports, "PROJECT_BUCKET_LIFECYCLE_ACTIONS", {
+	enumerable: true,
+	get: function() {
+		return PROJECT_BUCKET_LIFECYCLE_ACTIONS;
+	}
+});
+Object.defineProperty(exports, "callerAccountId", {
+	enumerable: true,
+	get: function() {
+		return callerAccountId;
+	}
+});
+Object.defineProperty(exports, "ensureProjectBucket", {
+	enumerable: true,
+	get: function() {
+		return ensureProjectBucket;
+	}
+});
+Object.defineProperty(exports, "findProjectBucket", {
+	enumerable: true,
+	get: function() {
+		return findProjectBucket;
+	}
+});
+Object.defineProperty(exports, "projectBucketName", {
+	enumerable: true,
+	get: function() {
+		return projectBucketName;
+	}
+});
+Object.defineProperty(exports, "reconcileProjectBucketLifecycle", {
+	enumerable: true,
+	get: function() {
+		return reconcileProjectBucketLifecycle;
+	}
+});
+
+//# sourceMappingURL=projectBucket-BBbQ1lHF.cjs.map

package/dist/projectBucket-BBbQ1lHF.cjs.map

@@ -0,0 +1 @@
+{"version":3,"file":"projectBucket-BBbQ1lHF.cjs","names":["GkmError","createHash"],"sources":["../src/providers/projectBucket.ts"],"sourcesContent":["/**\n * The project bucket: one S3 bucket per project and AWS account, created and\n * owned by gkm, that holds what gkm keeps for every stage — the deploy state\n * under `<prefix>/<project>/<stage>/`, and anything else gkm writes per stage\n * beside it.\n *\n * Nothing can record its name — the deploy state lives in it — so the name is\n * worked out the same way every time: `gkm-<scope>-<account id>`, the scope\n * being the one the `s3` objects provider names its buckets with. The account\n * id keeps it from clashing with another account's project of the same name\n * without a random suffix; a clash that happens anyway (HeadBucket 403) is\n * refused, never adopted.\n *\n * Created with versioning, SSE-S3, every public access blocked, ownership\n * enforced for the bucket owner, a lifecycle that expires old versions, and\n * the tag `gkm:project=<identity key>`.\n */\n\nimport { createHash } from 'node:crypto';\nimport type {\n\tBucketLocationConstraint,\n\tLifecycleRule,\n\tS3Client,\n} from '@aws-sdk/client-s3';\nimport type { STSClient } from '@aws-sdk/client-sts';\nimport { type DeployIdentity, deployIdentity } from '../deploy/identity.js';\nimport { GkmError } from '../errors';\n\n/** S3's limit on a bucket name. */\nconst BUCKET_NAME_MAX = 63;\n/** What the project part may take: 63 less `gkm-`, `-` and a 12-digit id. */\nconst SCOPE_MAX = BUCKET_NAME_MAX - 'gkm-'.length - 1 - 12;\n\n/** The tag the bucket is created with, as the `s3` provider tags its own. */\nexport const PROJECT_BUCKET_TAG = 'gkm:project';\n\n/** How long a replaced or deleted object's old version is kept. */\nexport const NONCURRENT_VERSION_DAYS = 90;\n\n/** The bucket's name is held by another account, or cannot be reached. */\nexport class ProjectBucketTaken extends GkmError {\n\tconstructor(\n\t\treadonly bucket: string,\n\t\t/** HeadBucket's status: 403 another account's, 301 another region's. */\n\t\treadonly status: number,\n\t) {\n\t\tconst why =\n\t\t\tstatus === 301\n\t\t\t\t? 'is in another region than the one configured'\n\t\t\t\t: 'exists and this account cannot reach it — another account holds the name';\n\t\tsuper(\n\t\t\t`The project bucket '${bucket}' ${why} (HTTP ${status}). Name a bucket ` +\n\t\t\t\t\"you own instead — in gkm.config.ts: state: { provider: 's3', \" +\n\t\t\t\t\"bucket: '<your bucket>', region: '<its region>' } — or run with the \" +\n\t\t\t\t'credentials of the account the name is for.',\n\t\t);\n\t\tthis.name = 'ProjectBucketTaken';\n\t}\n}\n\n/** The running credentials may not create the project bucket. */\nexport class ProjectBucketNotCreatable extends GkmError {\n\tconstructor(\n\t\treadonly bucket: string,\n\t\treadonly reason: string,\n\t) {\n\t\tsuper(\n\t\t\t`The project bucket '${bucket}' does not exist yet, and these ` +\n\t\t\t\t`credentials cannot create it (${reason}). Run the first deploy with ` +\n\t\t\t\t'credentials allowed s3:CreateBucket and the bucket put-config ' +\n\t\t\t\t'actions on it — `gkm deploy:github` grants them to the CI role — ' +\n\t\t\t\t\"or name an existing bucket: state: { provider: 's3', bucket, region }.\",\n\t\t);\n\t\tthis.name = 'ProjectBucketNotCreatable';\n\t}\n}\n\n/**\n * The project bucket's name: `gkm-<scope>-<account id>`, lowercase and\n * DNS-safe. A scope too long to fit keeps its start and ends in a hash of\n * the whole, so two long scopes never share a name.\n */\nexport function projectBucket(\n\tworkspace: { name: string; deploy?: { namespace?: string } },\n\toptions: { accountId: string },\n): string {\n\tconst { scope } = deployIdentity(workspace, '');\n\treturn projectBucketName(scope, options.accountId);\n}\n\n/** {@link projectBucket}, from a deploy identity's scope. */\nexport function projectBucketName(scope: string, accountId: string): string {\n\tlet part = scope\n\t\t.toLowerCase()\n\t\t.replace(/[^a-z0-9]+/g, '-')\n\t\t.replace(/^-+|-+$/g, '');\n\tif (part.length > SCOPE_MAX) {\n\t\tconst hash = createHash('sha256').update(scope).digest('hex').slice(0, 6);\n\t\tpart = `${part.slice(0, SCOPE_MAX - 7).replace(/-+$/, '')}-${hash}`;\n\t}\n\treturn `gkm-${part}-${accountId}`;\n}\n\n/** The account the credentials are in — what the bucket is named by. */\nexport async function callerAccountId(sts: STSClient): Promise<string> {\n\tconst { GetCallerIdentityCommand } = await import('@aws-sdk/client-sts');\n\tconst { Account } = await sts.send(new GetCallerIdentityCommand({}));\n\treturn Account ?? '';\n}\n\n/** An expiry for one stage's prefix, added beside the bucket's own rule. */\nexport interface PrefixExpiry {\n\t/** Rule id, unique in the bucket — e.g. `backups-production`. */\n\tid: string;\n\t/** Key prefix it applies to — e.g. `gkm/acme/production/backups/`. */\n\tprefix: string;\n\t/** Days after which a current object expires. */\n\tdays: number;\n\t/**\n\t * Days after which a multipart upload under the prefix that never\n\t * completed is aborted — its parts are stored, and billed, until it is.\n\t */\n\tabortIncompleteDays?: number;\n}\n\n/**\n * The bucket's whole lifecycle configuration. A put replaces every rule the\n * bucket has, so this is the one place the set is built: the bucket's own\n * noncurrent-version expiry, and any per-prefix expiry passed in.\n */\nexport function projectBucketLifecycle(\n\texpiries: readonly PrefixExpiry[] = [],\n): LifecycleRule[] {\n\treturn [\n\t\t{\n\t\t\tID: 'gkm-noncurrent-versions',\n\t\t\tStatus: 'Enabled',\n\t\t\tFilter: { Prefix: '' },\n\t\t\tNoncurrentVersionExpiration: { NoncurrentDays: NONCURRENT_VERSION_DAYS },\n\t\t\t// A lock is deleted every run; its markers go once nothing is under them.\n\t\t\tExpiration: { ExpiredObjectDeleteMarker: true },\n\t\t},\n\t\t...expiries.map(\n\t\t\t(expiry): LifecycleRule => ({\n\t\t\t\tID: expiry.id,\n\t\t\t\tStatus: 'Enabled',\n\t\t\t\tFilter: { Prefix: expiry.prefix },\n\t\t\t\tExpiration: { Days: expiry.days },\n\t\t\t\t...(expiry.abortIncompleteDays\n\t\t\t\t\t? {\n\t\t\t\t\t\t\tAbortIncompleteMultipartUpload: {\n\t\t\t\t\t\t\t\tDaysAfterInitiation: expiry.abortIncompleteDays,\n\t\t\t\t\t\t\t},\n\t\t\t\t\t\t}\n\t\t\t\t\t: {}),\n\t\t\t}),\n\t\t),\n\t];\n}\n\n/** A lifecycle rule reduced to what gkm sets, for comparing with what is there. */\nfunction canonicalRule(rule: LifecycleRule): string {\n\treturn JSON.stringify({\n\t\tid: rule.ID ?? '',\n\t\tstatus: rule.Status ?? '',\n\t\tprefix: rule.Filter?.Prefix ?? rule.Prefix ?? '',\n\t\tdays: rule.Expiration?.Days ?? null,\n\t\tmarkers: rule.Expiration?.ExpiredObjectDeleteMarker ?? null,\n\t\tnoncurrent: rule.NoncurrentVersionExpiration?.NoncurrentDays ?? null,\n\t\tabort: rule.AbortIncompleteMultipartUpload?.DaysAfterInitiation ?? null,\n\t});\n}\n\n/** Whether two rule sets say the same thing, in any order. */\nexport function sameLifecycle(\n\ta: readonly LifecycleRule[],\n\tb: readonly LifecycleRule[],\n): boolean {\n\tconst canonical = (rules: readonly LifecycleRule[]) =>\n\t\trules.map(canonicalRule).sort().join('\\n');\n\treturn canonical(a) === canonical(b);\n}\n\n/**\n * The project bucket's lifecycle put to {@link projectBucketLifecycle} of\n * `expiries` — every stage's — when what it holds says anything else.\n * Returns whether it was put; with `dryRun`, whether it would be.\n */\nexport async function reconcileProjectBucketLifecycle(\n\ts3: S3Client,\n\tbucket: string,\n\texpiries: readonly PrefixExpiry[],\n\toptions: { dryRun?: boolean } = {},\n): Promise<boolean> {\n\tconst S3 = await import('@aws-sdk/client-s3');\n\tconst rules = projectBucketLifecycle(expiries);\n\tlet current: LifecycleRule[] = [];\n\ttry {\n\t\tconst out = await s3.send(\n\t\t\tnew S3.GetBucketLifecycleConfigurationCommand({ Bucket: bucket }),\n\t\t);\n\t\tcurrent = out.Rules ?? [];\n\t} catch (error) {\n\t\tconst failure = error as S3Failure;\n\t\tconst code = failure.Code ?? failure.name;\n\t\tif (code !== 'NoSuchLifecycleConfiguration') throw error;\n\t}\n\tif (sameLifecycle(current, rules)) return false;\n\tif (!options.dryRun) {\n\t\tawait s3.send(\n\t\t\tnew S3.PutBucketLifecycleConfigurationCommand({\n\t\t\t\tBucket: bucket,\n\t\t\t\tLifecycleConfiguration: { Rules: rules },\n\t\t\t}),\n\t\t);\n\t}\n\treturn true;\n}\n\ninterface S3Failure {\n\tname?: string;\n\tCode?: string;\n\tmessage?: string;\n\t$metadata?: { httpStatusCode?: number };\n}\n\n/**\n * Whether `bucket` is this account's (`ours`) or does not exist (`none`).\n * Mapped by status: a HEAD has no body, so SDK v3 names a 301, 400 or 403\n * `Unknown`.\n *\n * @throws {ProjectBucketTaken} on a 403 or 301\n */\nexport async function findProjectBucket(\n\ts3: S3Client,\n\tbucket: string,\n): Promise<'ours' | 'none'> {\n\tconst { HeadBucketCommand } = await import('@aws-sdk/client-s3');\n\ttry {\n\t\tawait s3.send(new HeadBucketCommand({ Bucket: bucket }));\n\t\treturn 'ours';\n\t} catch (error) {\n\t\tconst status = (error as S3Failure).$metadata?.httpStatusCode;\n\t\tif (status === 404) return 'none';\n\t\tif (status === 403 || status === 301) {\n\t\t\tthrow new ProjectBucketTaken(bucket, status);\n\t\t}\n\t\tthrow error;\n\t}\n}\n\nexport interface EnsureProjectBucketOptions {\n\tbucket: string;\n\tregion: string;\n\t/** The deploy identity the bucket is tagged with. */\n\tidentity: Pick<DeployIdentity, 'key'>;\n\t/** Per-prefix expiries beside the bucket's own rule. */\n\texpiries?: readonly PrefixExpiry[];\n}\n\n/**\n * The project bucket, created and configured if it does not exist yet.\n * Returns whether this call created it. One that exists is used as it is.\n *\n * @throws {ProjectBucketTaken} when another account holds the name\n * @throws {ProjectBucketNotCreatable} when the credentials may not create it\n */\nexport async function ensureProjectBucket(\n\ts3: S3Client,\n\toptions: EnsureProjectBucketOptions,\n): Promise<{ created: boolean }> {\n\tconst { bucket: Bucket, region } = options;\n\tif ((await findProjectBucket(s3, Bucket)) === 'ours') {\n\t\treturn { created: false };\n\t}\n\n\tconst S3 = await import('@aws-sdk/client-s3');\n\ttry {\n\t\tawait s3.send(\n\t\t\tnew S3.CreateBucketCommand({\n\t\t\t\tBucket,\n\t\t\t\tObjectOwnership: 'BucketOwnerEnforced',\n\t\t\t\t// us-east-1 is the one region named by leaving it out.\n\t\t\t\t...(region === 'us-east-1'\n\t\t\t\t\t? {}\n\t\t\t\t\t: {\n\t\t\t\t\t\t\tCreateBucketConfiguration: {\n\t\t\t\t\t\t\t\tLocationConstraint: region as BucketLocationConstraint,\n\t\t\t\t\t\t\t},\n\t\t\t\t\t\t}),\n\t\t\t}),\n\t\t);\n\t} catch (error) {\n\t\tconst failure = error as S3Failure;\n\t\tconst code = failure.Code ?? failure.name;\n\t\t// Another run created it a moment ago: configure it all the same.\n\t\tif (code !== 'BucketAlreadyOwnedByYou') {\n\t\t\tif (code === 'BucketAlreadyExists') {\n\t\t\t\tthrow new ProjectBucketTaken(Bucket, 409);\n\t\t\t}\n\t\t\tif (\n\t\t\t\tcode === 'AccessDenied' ||\n\t\t\t\tfailure.$metadata?.httpStatusCode === 403\n\t\t\t) {\n\t\t\t\tthrow new ProjectBucketNotCreatable(\n\t\t\t\t\tBucket,\n\t\t\t\t\tfailure.message ?? 'AccessDenied',\n\t\t\t\t);\n\t\t\t}\n\t\t\tthrow error;\n\t\t}\n\t}\n\n\tawait s3.send(\n\t\tnew S3.PutPublicAccessBlockCommand({\n\t\t\tBucket,\n\t\t\tPublicAccessBlockConfiguration: {\n\t\t\t\tBlockPublicAcls: true,\n\t\t\t\tIgnorePublicAcls: true,\n\t\t\t\tBlockPublicPolicy: true,\n\t\t\t\tRestrictPublicBuckets: true,\n\t\t\t},\n\t\t}),\n\t);\n\tawait s3.send(\n\t\tnew S3.PutBucketOwnershipControlsCommand({\n\t\t\tBucket,\n\t\t\tOwnershipControls: {\n\t\t\t\tRules: [{ ObjectOwnership: 'BucketOwnerEnforced' }],\n\t\t\t},\n\t\t}),\n\t);\n\tawait s3.send(\n\t\tnew S3.PutBucketEncryptionCommand({\n\t\t\tBucket,\n\t\t\tServerSideEncryptionConfiguration: {\n\t\t\t\tRules: [\n\t\t\t\t\t{ ApplyServerSideEncryptionByDefault: { SSEAlgorithm: 'AES256' } },\n\t\t\t\t],\n\t\t\t},\n\t\t}),\n\t);\n\tawait s3.send(\n\t\tnew S3.PutBucketVersioningCommand({\n\t\t\tBucket,\n\t\t\tVersioningConfiguration: { Status: 'Enabled' },\n\t\t}),\n\t);\n\tawait s3.send(\n\t\tnew S3.PutBucketLifecycleConfigurationCommand({\n\t\t\tBucket,\n\t\t\tLifecycleConfiguration: {\n\t\t\t\tRules: projectBucketLifecycle(options.expiries),\n\t\t\t},\n\t\t}),\n\t);\n\tawait s3.send(\n\t\tnew S3.PutBucketTaggingCommand({\n\t\t\tBucket,\n\t\t\tTagging: {\n\t\t\t\tTagSet: [{ Key: PROJECT_BUCKET_TAG, Value: options.identity.key }],\n\t\t\t},\n\t\t}),\n\t);\n\treturn { created: true };\n}\n\n/**\n * The IAM actions creating and configuring the project bucket takes — what a\n * role that runs the first deploy needs on it, beside object access.\n */\nexport const PROJECT_BUCKET_CREATE_ACTIONS = [\n\t's3:CreateBucket',\n\t's3:PutBucketVersioning',\n\t's3:PutEncryptionConfiguration',\n\t's3:PutBucketPublicAccessBlock',\n\t's3:PutBucketOwnershipControls',\n\t's3:PutLifecycleConfiguration',\n\t's3:PutBucketTagging',\n] as const;\n\n/**\n * What keeping the project bucket's lifecycle takes on a bucket that exists:\n * reading it, to put it back only when it drifted.\n */\nexport const PROJECT_BUCKET_LIFECYCLE_ACTIONS = [\n\t's3:GetLifecycleConfiguration',\n\t's3:PutLifecycleConfiguration',\n] as const;\n"],"mappings":";;;;;;;;;;;;;;;;;;;;;;AA+BA,MAAM,YAAY;;AAGlB,MAAa,qBAAqB;;AAMlC,IAAa,qBAAb,cAAwCA,eAAAA,SAAS;CAEtC;CAEA;CAHV,YACC,QAEA,QACC;EAKD,MACC,uBAAuB,OAAO,IAJ9B,WAAW,MACR,iDACA,2EAEmC,SAAS,OAAO,8LAIvD;EAbS,KAAA,SAAA;EAEA,KAAA,SAAA;EAYT,KAAK,OAAO;CACb;AACD;;AAGA,IAAa,4BAAb,cAA+CA,eAAAA,SAAS;CAE7C;CACA;CAFV,YACC,QACA,QACC;EACD,MACC,uBAAuB,OAAO,gEACI,OAAO,qOAI1C;EATS,KAAA,SAAA;EACA,KAAA,SAAA;EAST,KAAK,OAAO;CACb;AACD;;AAgBA,SAAgB,kBAAkB,OAAe,WAA2B;CAC3E,IAAI,OAAO,MACT,YAAY,CAAC,CACb,QAAQ,eAAe,GAAG,CAAC,CAC3B,QAAQ,YAAY,EAAE;CACxB,IAAI,KAAK,SAAS,WAAW;EAC5B,MAAM,QAAA,GAAOC,YAAAA,WAAAA,CAAW,QAAQ,CAAC,CAAC,OAAO,KAAK,CAAC,CAAC,OAAO,KAAK,CAAC,CAAC,MAAM,GAAG,CAAC;EACxE,OAAO,GAAG,KAAK,MAAM,GAAG,EAAa,CAAC,CAAC,QAAQ,OAAO,EAAE,EAAE,GAAG;CAC9D;CACA,OAAO,OAAO,KAAK,GAAG;AACvB;;AAGA,eAAsB,gBAAgB,KAAiC;CACtE,MAAM,EAAE,6BAA6B,MAAM,OAAO;CAClD,MAAM,EAAE,YAAY,MAAM,IAAI,KAAK,IAAI,yBAAyB,CAAC,CAAC,CAAC;CACnE,OAAO,WAAW;AACnB;;;;;;AAsBA,SAAgB,uBACf,WAAoC,CAAC,GACnB;CAClB,OAAO,CACN;EACC,IAAI;EACJ,QAAQ;EACR,QAAQ,EAAE,QAAQ,GAAG;EACrB,6BAA6B,EAAE,gBAAA,GAAwC;EAEvE,YAAY,EAAE,2BAA2B,KAAK;CAC/C,GACA,GAAG,SAAS,KACV,YAA2B;EAC3B,IAAI,OAAO;EACX,QAAQ;EACR,QAAQ,EAAE,QAAQ,OAAO,OAAO;EAChC,YAAY,EAAE,MAAM,OAAO,KAAK;EAChC,GAAI,OAAO,sBACR,EACA,gCAAgC,EAC/B,qBAAqB,OAAO,oBAC7B,EACD,IACC,CAAC;CACL,EACD,CACD;AACD;;AAGA,SAAS,cAAc,MAA6B;CACnD,OAAO,KAAK,UAAU;EACrB,IAAI,KAAK,MAAM;EACf,QAAQ,KAAK,UAAU;EACvB,QAAQ,KAAK,QAAQ,UAAU,KAAK,UAAU;EAC9C,MAAM,KAAK,YAAY,QAAQ;EAC/B,SAAS,KAAK,YAAY,6BAA6B;EACvD,YAAY,KAAK,6BAA6B,kBAAkB;EAChE,OAAO,KAAK,gCAAgC,uBAAuB;CACpE,CAAC;AACF;;AAGA,SAAgB,cACf,GACA,GACU;CACV,MAAM,aAAa,UAClB,MAAM,IAAI,aAAa,CAAC,CAAC,KAAK,CAAC,CAAC,KAAK,IAAI;CAC1C,OAAO,UAAU,CAAC,MAAM,UAAU,CAAC;AACpC;;;;;;AAOA,eAAsB,gCACrB,IACA,QACA,UACA,UAAgC,CAAC,GACd;CACnB,MAAM,KAAK,MAAM,OAAO;CACxB,MAAM,QAAQ,uBAAuB,QAAQ;CAC7C,IAAI,UAA2B,CAAC;CAChC,IAAI;EAIH,WAAU,MAHQ,GAAG,KACpB,IAAI,GAAG,uCAAuC,EAAE,QAAQ,OAAO,CAAC,CACjE,EAAA,CACc,SAAS,CAAC;CACzB,SAAS,OAAO;EACf,MAAM,UAAU;EAEhB,KADa,QAAQ,QAAQ,QAAQ,UACxB,gCAAgC,MAAM;CACpD;CACA,IAAI,cAAc,SAAS,KAAK,GAAG,OAAO;CAC1C,IAAI,CAAC,QAAQ,QACZ,MAAM,GAAG,KACR,IAAI,GAAG,uCAAuC;EAC7C,QAAQ;EACR,wBAAwB,EAAE,OAAO,MAAM;CACxC,CAAC,CACF;CAED,OAAO;AACR;;;;;;;;AAgBA,eAAsB,kBACrB,IACA,QAC2B;CAC3B,MAAM,EAAE,sBAAsB,MAAM,OAAO;CAC3C,IAAI;EACH,MAAM,GAAG,KAAK,IAAI,kBAAkB,EAAE,QAAQ,OAAO,CAAC,CAAC;EACvD,OAAO;CACR,SAAS,OAAO;EACf,MAAM,SAAU,MAAoB,WAAW;EAC/C,IAAI,WAAW,KAAK,OAAO;EAC3B,IAAI,WAAW,OAAO,WAAW,KAChC,MAAM,IAAI,mBAAmB,QAAQ,MAAM;EAE5C,MAAM;CACP;AACD;;;;;;;;AAkBA,eAAsB,oBACrB,IACA,SACgC;CAChC,MAAM,EAAE,QAAQ,QAAQ,WAAW;CACnC,IAAK,MAAM,kBAAkB,IAAI,MAAM,MAAO,QAC7C,OAAO,EAAE,SAAS,MAAM;CAGzB,MAAM,KAAK,MAAM,OAAO;CACxB,IAAI;EACH,MAAM,GAAG,KACR,IAAI,GAAG,oBAAoB;GAC1B;GACA,iBAAiB;GAEjB,GAAI,WAAW,cACZ,CAAC,IACD,EACA,2BAA2B,EAC1B,oBAAoB,OACrB,EACD;EACH,CAAC,CACF;CACD,SAAS,OAAO;EACf,MAAM,UAAU;EAChB,MAAM,OAAO,QAAQ,QAAQ,QAAQ;EAErC,IAAI,SAAS,2BAA2B;GACvC,IAAI,SAAS,uBACZ,MAAM,IAAI,mBAAmB,QAAQ,GAAG;GAEzC,IACC,SAAS,kBACT,QAAQ,WAAW,mBAAmB,KAEtC,MAAM,IAAI,0BACT,QACA,QAAQ,WAAW,cACpB;GAED,MAAM;EACP;CACD;CAEA,MAAM,GAAG,KACR,IAAI,GAAG,4BAA4B;EAClC;EACA,gCAAgC;GAC/B,iBAAiB;GACjB,kBAAkB;GAClB,mBAAmB;GACnB,uBAAuB;EACxB;CACD,CAAC,CACF;CACA,MAAM,GAAG,KACR,IAAI,GAAG,kCAAkC;EACxC;EACA,mBAAmB,EAClB,OAAO,CAAC,EAAE,iBAAiB,sBAAsB,CAAC,EACnD;CACD,CAAC,CACF;CACA,MAAM,GAAG,KACR,IAAI,GAAG,2BAA2B;EACjC;EACA,mCAAmC,EAClC,OAAO,CACN,EAAE,oCAAoC,EAAE,cAAc,SAAS,EAAE,CAClE,EACD;CACD,CAAC,CACF;CACA,MAAM,GAAG,KACR,IAAI,GAAG,2BAA2B;EACjC;EACA,yBAAyB,EAAE,QAAQ,UAAU;CAC9C,CAAC,CACF;CACA,MAAM,GAAG,KACR,IAAI,GAAG,uCAAuC;EAC7C;EACA,wBAAwB,EACvB,OAAO,uBAAuB,QAAQ,QAAQ,EAC/C;CACD,CAAC,CACF;CACA,MAAM,GAAG,KACR,IAAI,GAAG,wBAAwB;EAC9B;EACA,SAAS,EACR,QAAQ,CAAC;GAAE,KAAK;GAAoB,OAAO,QAAQ,SAAS;EAAI,CAAC,EAClE;CACD,CAAC,CACF;CACA,OAAO,EAAE,SAAS,KAAK;AACxB;;;;;AAMA,MAAa,gCAAgC;CAC5C;CACA;CACA;CACA;CACA;CACA;CACA;AACD;;;;;AAMA,MAAa,mCAAmC,CAC/C,gCACA,8BACD"}