@geekmidas/cli 10.0.0-alpha.12 → 10.0.0-alpha.121

package/dist/awsStore-Bx5nCFnS.mjs.map

@@ -0,0 +1 @@
+{"version":3,"file":"awsStore-Bx5nCFnS.mjs","names":[],"sources":["../src/secrets/awsStore.ts"],"sourcesContent":["/**\n * What the AWS secrets stores share: how a client finds its credentials, what\n * it says when it has none, and — for SSM and Secrets Manager, which hold a\n * stage in one value of a fixed size — how big a stage may be before AWS\n * would refuse it. S3 has no such limit.\n */\n\nimport { GkmError } from '../errors';\n\nexport interface AwsStoreOptions {\n\t/** The workspace name, which scopes where the stage is kept. */\n\tproject: string;\n\tregion: string;\n\t/**\n\t * A named AWS profile, resolved with `fromIni` only. The default chain\n\t * reads AWS_* from the environment first, so exported staging keys would\n\t * win over `--profile prod` and put production's secrets in staging.\n\t */\n\tprofile?: string;\n\t/** For tests: an endpoint such as the AWS emulator. */\n\tendpoint?: string;\n}\n\n/** The client config both stores build their SDK client from. */\nexport async function awsClientConfig(options: AwsStoreOptions): Promise<{\n\tregion: string;\n\tendpoint?: string;\n\tcredentials?: ReturnType<\n\t\ttypeof import('@aws-sdk/credential-providers').fromIni\n\t>;\n}> {\n\tconst config: Awaited<ReturnType<typeof awsClientConfig>> = {\n\t\tregion: options.region,\n\t};\n\tif (options.profile) {\n\t\tconst { fromIni } = await import('@aws-sdk/credential-providers');\n\t\tconfig.credentials = fromIni({ profile: options.profile });\n\t}\n\tif (options.endpoint) {\n\t\tconfig.endpoint = options.endpoint;\n\t}\n\treturn config;\n}\n\n/**\n * A stage's secrets, serialized, are larger than the store can hold: 8 KB for\n * an SSM parameter (advanced tier), 64 KB for a Secrets Manager secret.\n *\n * Refused before AWS is called, so nothing half-written is left behind and\n * the answer is not a bare `ValidationException`.\n */\nexport class StageSecretsTooLarge extends GkmError {\n\tconstructor(\n\t\treadonly stage: string,\n\t\treadonly store: string,\n\t\treadonly bytes: number,\n\t\treadonly limit: number,\n\t) {\n\t\tsuper(\n\t\t\t`The secrets for stage \"${stage}\" are ${bytes} bytes, more than the ${limit} bytes ${store} holds in one ${store === 'ssm' ? 'parameter' : 'secret'}. ` +\n\t\t\t\t(store === 'ssm'\n\t\t\t\t\t? `Keep them in S3 instead, which has no such limit: copy the stage with gkm secrets:migrate --stage ${stage} --to s3, then set secrets.store to { provider: 's3' } in gkm.config.ts.`\n\t\t\t\t\t: 'Remove credentials the stage no longer uses, or keep the largest ones somewhere they are fetched from at runtime.'),\n\t\t);\n\t\tthis.name = 'StageSecretsTooLarge';\n\t}\n}\n\n/** The stage serialized, refused if it is larger than `limit` bytes. */\nexport function serializeWithin(\n\tstage: string,\n\tstore: string,\n\tvalue: unknown,\n\tlimit: number,\n): string {\n\tconst serialized = JSON.stringify(value);\n\tconst bytes = Buffer.byteLength(serialized, 'utf8');\n\tif (bytes > limit) {\n\t\tthrow new StageSecretsTooLarge(stage, store, bytes, limit);\n\t}\n\treturn serialized;\n}\n\n/** Where each AWS store keeps a stage's secrets, as a person reads it. */\nconst AWS_STORES: Record<string, string> = {\n\tssm: 'SSM Parameter Store',\n\t'secrets-manager': 'Secrets Manager',\n\ts3: 'S3',\n};\n\n/** Why the stage's account could not be reached. */\nexport type StageSecretsUnreadableReason = 'no-credentials' | 'expired';\n\nexport interface StageSecretsUnreadableInput {\n\tstage: string;\n\t/** The store's name: `ssm`, `secrets-manager`, `s3`. */\n\tstore: string;\n\t/** The AWS profile the credentials were looked up with, where one was. */\n\tprofile?: string;\n\t/** Whether the stage was being read or written. */\n\taccess?: 'read' | 'write';\n\treason?: StageSecretsUnreadableReason;\n}\n\n/**\n * A deployed stage's secrets are kept in its AWS account, and no AWS\n * credentials were found to reach them with — or the ones found have expired.\n *\n * Raised by the AWS stores themselves, on a read or a write, so every command\n * that touches a stage's secrets says it the same way.\n */\nexport class StageSecretsUnreadable extends GkmError {\n\treadonly stage: string;\n\treadonly store: string;\n\treadonly profile: string | undefined;\n\treadonly access: 'read' | 'write';\n\treadonly reason: StageSecretsUnreadableReason;\n\n\tconstructor(input: StageSecretsUnreadableInput, cause?: unknown) {\n\t\tconst { stage, store, profile } = input;\n\t\tconst access = input.access ?? 'read';\n\t\tconst reason = input.reason ?? 'no-credentials';\n\t\tconst where = AWS_STORES[store] ?? `the '${store}' store`;\n\t\t// How to name the account: the command's --profile, where it takes\n\t\t// one, or the SDK's own variable.\n\t\tconst named =\n\t\t\t'--profile <profile> where the command takes it, or AWS_PROFILE=<profile>';\n\t\tconst lacking =\n\t\t\treason === 'expired'\n\t\t\t\t? profile\n\t\t\t\t\t? `the AWS profile '${profile}' signed in, but its session has expired. `\n\t\t\t\t\t: 'the AWS credentials found have expired. '\n\t\t\t\t: profile\n\t\t\t\t\t? `the AWS profile '${profile}' has no credentials to ${access} them with. `\n\t\t\t\t\t: `no AWS credentials were found to ${access} them with. `;\n\t\tconst fix = profile\n\t\t\t? `Sign in to it (aws sso login --profile ${profile}) or name another: ${named}.`\n\t\t\t: reason === 'expired'\n\t\t\t\t? `Export fresh ones, or name the account's profile: ${named}.`\n\t\t\t\t: `Name the account's profile: ${named}.`;\n\t\tsuper(\n\t\t\t`The '${stage}' stage's secrets are kept in ${where}, in the stage's AWS account, and ` +\n\t\t\t\tlacking +\n\t\t\t\tfix,\n\t\t\tcause === undefined ? undefined : { cause },\n\t\t);\n\t\tthis.name = 'StageSecretsUnreadable';\n\t\tthis.stage = stage;\n\t\tthis.store = store;\n\t\tthis.profile = profile;\n\t\tthis.access = access;\n\t\tthis.reason = reason;\n\t}\n}\n\n/**\n * Why an AWS call failed for want of credentials, by the SDK's error name —\n * its message being free to change — or undefined when it failed for any\n * other reason.\n *\n * - `CredentialsProviderError`: the credential chain found nothing, or a\n *   profile's SSO session is missing or expired (the SSO provider wraps its\n *   token errors in this one).\n * - `TokenProviderError`: an SSO token, should one reach here unwrapped.\n * - `ExpiredTokenException`/`ExpiredToken`: credentials were found, and AWS\n *   refused them as expired.\n */\nexport function credentialsFailure(\n\terror: unknown,\n): StageSecretsUnreadableReason | undefined {\n\tconst name = (error as Error | undefined)?.name;\n\tif (name === 'CredentialsProviderError' || name === 'TokenProviderError') {\n\t\treturn 'no-credentials';\n\t}\n\tif (name === 'ExpiredTokenException' || name === 'ExpiredToken') {\n\t\treturn 'expired';\n\t}\n\treturn undefined;\n}\n\n/**\n * Run one AWS call of a store, refusing a failure for want of credentials\n * with {@link StageSecretsUnreadable}. Any other failure is the store's own,\n * and passes through.\n */\nexport async function withStageCredentials<T>(\n\tcontext: {\n\t\tstage: string;\n\t\tstore: string;\n\t\tprofile: string | undefined;\n\t\taccess: 'read' | 'write';\n\t},\n\tcall: () => Promise<T>,\n): Promise<T> {\n\ttry {\n\t\treturn await call();\n\t} catch (error) {\n\t\tconst reason = credentialsFailure(error);\n\t\tif (reason === undefined) throw error;\n\t\tthrow new StageSecretsUnreadable(\n\t\t\t{\n\t\t\t\t...context,\n\t\t\t\t// The profile the SDK's default chain read, when none was named.\n\t\t\t\tprofile: context.profile ?? (process.env.AWS_PROFILE || undefined),\n\t\t\t\treason,\n\t\t\t},\n\t\t\terror,\n\t\t);\n\t}\n}\n"],"mappings":";;;;;;;;;AAwBA,eAAsB,gBAAgB,SAMnC;CACF,MAAM,SAAsD,EAC3D,QAAQ,QAAQ,OACjB;CACA,IAAI,QAAQ,SAAS;EACpB,MAAM,EAAE,YAAY,MAAM,OAAO;EACjC,OAAO,cAAc,QAAQ,EAAE,SAAS,QAAQ,QAAQ,CAAC;CAC1D;CACA,IAAI,QAAQ,UACX,OAAO,WAAW,QAAQ;CAE3B,OAAO;AACR;;;;;;;;AASA,IAAa,uBAAb,cAA0C,SAAS;CAExC;CACA;CACA;CACA;CAJV,YACC,OACA,OACA,OACA,OACC;EACD,MACC,0BAA0B,MAAM,QAAQ,MAAM,wBAAwB,MAAM,SAAS,MAAM,gBAAgB,UAAU,QAAQ,cAAc,SAAS,OAClJ,UAAU,QACR,qGAAqG,MAAM,4EAC3G,oHACL;EAVS,KAAA,QAAA;EACA,KAAA,QAAA;EACA,KAAA,QAAA;EACA,KAAA,QAAA;EAQT,KAAK,OAAO;CACb;AACD;;AAGA,SAAgB,gBACf,OACA,OACA,OACA,OACS;CACT,MAAM,aAAa,KAAK,UAAU,KAAK;CACvC,MAAM,QAAQ,OAAO,WAAW,YAAY,MAAM;CAClD,IAAI,QAAQ,OACX,MAAM,IAAI,qBAAqB,OAAO,OAAO,OAAO,KAAK;CAE1D,OAAO;AACR;;AAGA,MAAM,aAAqC;CAC1C,KAAK;CACL,mBAAmB;CACnB,IAAI;AACL;;;;;;;;AAuBA,IAAa,yBAAb,cAA4C,SAAS;CACpD;CACA;CACA;CACA;CACA;CAEA,YAAY,OAAoC,OAAiB;EAChE,MAAM,EAAE,OAAO,OAAO,YAAY;EAClC,MAAM,SAAS,MAAM,UAAU;EAC/B,MAAM,SAAS,MAAM,UAAU;EAC/B,MAAM,QAAQ,WAAW,UAAU,QAAQ,MAAM;EAGjD,MAAM,QACL;EACD,MAAM,UACL,WAAW,YACR,UACC,oBAAoB,QAAQ,8CAC5B,6CACD,UACC,oBAAoB,QAAQ,0BAA0B,OAAO,gBAC7D,oCAAoC,OAAO;EAChD,MAAM,MAAM,UACT,0CAA0C,QAAQ,qBAAqB,MAAM,KAC7E,WAAW,YACV,qDAAqD,MAAM,KAC3D,+BAA+B,MAAM;EACzC,MACC,QAAQ,MAAM,gCAAgC,MAAM,sCACnD,UACA,KACD,UAAU,KAAA,IAAY,KAAA,IAAY,EAAE,MAAM,CAC3C;EACA,KAAK,OAAO;EACZ,KAAK,QAAQ;EACb,KAAK,QAAQ;EACb,KAAK,UAAU;EACf,KAAK,SAAS;EACd,KAAK,SAAS;CACf;AACD;;;;;;;;;;;;;AAcA,SAAgB,mBACf,OAC2C;CAC3C,MAAM,OAAQ,OAA6B;CAC3C,IAAI,SAAS,8BAA8B,SAAS,sBACnD,OAAO;CAER,IAAI,SAAS,2BAA2B,SAAS,gBAChD,OAAO;AAGT;;;;;;AAOA,eAAsB,qBACrB,SAMA,MACa;CACb,IAAI;EACH,OAAO,MAAM,KAAK;CACnB,SAAS,OAAO;EACf,MAAM,SAAS,mBAAmB,KAAK;EACvC,IAAI,WAAW,KAAA,GAAW,MAAM;EAChC,MAAM,IAAI,uBACT;GACC,GAAG;GAEH,SAAS,QAAQ,YAAY,QAAQ,IAAI,eAAe,KAAA;GACxD;EACD,GACA,KACD;CACD;AACD"}

package/dist/awsStore-u3ehhMoY.cjs

@@ -0,0 +1,138 @@
+const require_errors = require("./errors-DMC4Umsb.cjs");
+//#region src/secrets/awsStore.ts
+/**
+* What the AWS secrets stores share: how a client finds its credentials, what
+* it says when it has none, and — for SSM and Secrets Manager, which hold a
+* stage in one value of a fixed size — how big a stage may be before AWS
+* would refuse it. S3 has no such limit.
+*/
+/** The client config both stores build their SDK client from. */
+async function awsClientConfig(options) {
+	const config = { region: options.region };
+	if (options.profile) {
+		const { fromIni } = await import("@aws-sdk/credential-providers");
+		config.credentials = fromIni({ profile: options.profile });
+	}
+	if (options.endpoint) config.endpoint = options.endpoint;
+	return config;
+}
+/**
+* A stage's secrets, serialized, are larger than the store can hold: 8 KB for
+* an SSM parameter (advanced tier), 64 KB for a Secrets Manager secret.
+*
+* Refused before AWS is called, so nothing half-written is left behind and
+* the answer is not a bare `ValidationException`.
+*/
+var StageSecretsTooLarge = class extends require_errors.GkmError {
+	stage;
+	store;
+	bytes;
+	limit;
+	constructor(stage, store, bytes, limit) {
+		super(`The secrets for stage "${stage}" are ${bytes} bytes, more than the ${limit} bytes ${store} holds in one ${store === "ssm" ? "parameter" : "secret"}. ` + (store === "ssm" ? `Keep them in S3 instead, which has no such limit: copy the stage with gkm secrets:migrate --stage ${stage} --to s3, then set secrets.store to { provider: 's3' } in gkm.config.ts.` : "Remove credentials the stage no longer uses, or keep the largest ones somewhere they are fetched from at runtime."));
+		this.stage = stage;
+		this.store = store;
+		this.bytes = bytes;
+		this.limit = limit;
+		this.name = "StageSecretsTooLarge";
+	}
+};
+/** The stage serialized, refused if it is larger than `limit` bytes. */
+function serializeWithin(stage, store, value, limit) {
+	const serialized = JSON.stringify(value);
+	const bytes = Buffer.byteLength(serialized, "utf8");
+	if (bytes > limit) throw new StageSecretsTooLarge(stage, store, bytes, limit);
+	return serialized;
+}
+/** Where each AWS store keeps a stage's secrets, as a person reads it. */
+const AWS_STORES = {
+	ssm: "SSM Parameter Store",
+	"secrets-manager": "Secrets Manager",
+	s3: "S3"
+};
+/**
+* A deployed stage's secrets are kept in its AWS account, and no AWS
+* credentials were found to reach them with — or the ones found have expired.
+*
+* Raised by the AWS stores themselves, on a read or a write, so every command
+* that touches a stage's secrets says it the same way.
+*/
+var StageSecretsUnreadable = class extends require_errors.GkmError {
+	stage;
+	store;
+	profile;
+	access;
+	reason;
+	constructor(input, cause) {
+		const { stage, store, profile } = input;
+		const access = input.access ?? "read";
+		const reason = input.reason ?? "no-credentials";
+		const where = AWS_STORES[store] ?? `the '${store}' store`;
+		const named = "--profile <profile> where the command takes it, or AWS_PROFILE=<profile>";
+		const lacking = reason === "expired" ? profile ? `the AWS profile '${profile}' signed in, but its session has expired. ` : "the AWS credentials found have expired. " : profile ? `the AWS profile '${profile}' has no credentials to ${access} them with. ` : `no AWS credentials were found to ${access} them with. `;
+		const fix = profile ? `Sign in to it (aws sso login --profile ${profile}) or name another: ${named}.` : reason === "expired" ? `Export fresh ones, or name the account's profile: ${named}.` : `Name the account's profile: ${named}.`;
+		super(`The '${stage}' stage's secrets are kept in ${where}, in the stage's AWS account, and ` + lacking + fix, cause === void 0 ? void 0 : { cause });
+		this.name = "StageSecretsUnreadable";
+		this.stage = stage;
+		this.store = store;
+		this.profile = profile;
+		this.access = access;
+		this.reason = reason;
+	}
+};
+/**
+* Why an AWS call failed for want of credentials, by the SDK's error name —
+* its message being free to change — or undefined when it failed for any
+* other reason.
+*
+* - `CredentialsProviderError`: the credential chain found nothing, or a
+*   profile's SSO session is missing or expired (the SSO provider wraps its
+*   token errors in this one).
+* - `TokenProviderError`: an SSO token, should one reach here unwrapped.
+* - `ExpiredTokenException`/`ExpiredToken`: credentials were found, and AWS
+*   refused them as expired.
+*/
+function credentialsFailure(error) {
+	const name = error?.name;
+	if (name === "CredentialsProviderError" || name === "TokenProviderError") return "no-credentials";
+	if (name === "ExpiredTokenException" || name === "ExpiredToken") return "expired";
+}
+/**
+* Run one AWS call of a store, refusing a failure for want of credentials
+* with {@link StageSecretsUnreadable}. Any other failure is the store's own,
+* and passes through.
+*/
+async function withStageCredentials(context, call) {
+	try {
+		return await call();
+	} catch (error) {
+		const reason = credentialsFailure(error);
+		if (reason === void 0) throw error;
+		throw new StageSecretsUnreadable({
+			...context,
+			profile: context.profile ?? (process.env.AWS_PROFILE || void 0),
+			reason
+		}, error);
+	}
+}
+//#endregion
+Object.defineProperty(exports, "awsClientConfig", {
+	enumerable: true,
+	get: function() {
+		return awsClientConfig;
+	}
+});
+Object.defineProperty(exports, "serializeWithin", {
+	enumerable: true,
+	get: function() {
+		return serializeWithin;
+	}
+});
+Object.defineProperty(exports, "withStageCredentials", {
+	enumerable: true,
+	get: function() {
+		return withStageCredentials;
+	}
+});
+
+//# sourceMappingURL=awsStore-u3ehhMoY.cjs.map

package/dist/awsStore-u3ehhMoY.cjs.map

@@ -0,0 +1 @@
+{"version":3,"file":"awsStore-u3ehhMoY.cjs","names":["GkmError"],"sources":["../src/secrets/awsStore.ts"],"sourcesContent":["/**\n * What the AWS secrets stores share: how a client finds its credentials, what\n * it says when it has none, and — for SSM and Secrets Manager, which hold a\n * stage in one value of a fixed size — how big a stage may be before AWS\n * would refuse it. S3 has no such limit.\n */\n\nimport { GkmError } from '../errors';\n\nexport interface AwsStoreOptions {\n\t/** The workspace name, which scopes where the stage is kept. */\n\tproject: string;\n\tregion: string;\n\t/**\n\t * A named AWS profile, resolved with `fromIni` only. The default chain\n\t * reads AWS_* from the environment first, so exported staging keys would\n\t * win over `--profile prod` and put production's secrets in staging.\n\t */\n\tprofile?: string;\n\t/** For tests: an endpoint such as the AWS emulator. */\n\tendpoint?: string;\n}\n\n/** The client config both stores build their SDK client from. */\nexport async function awsClientConfig(options: AwsStoreOptions): Promise<{\n\tregion: string;\n\tendpoint?: string;\n\tcredentials?: ReturnType<\n\t\ttypeof import('@aws-sdk/credential-providers').fromIni\n\t>;\n}> {\n\tconst config: Awaited<ReturnType<typeof awsClientConfig>> = {\n\t\tregion: options.region,\n\t};\n\tif (options.profile) {\n\t\tconst { fromIni } = await import('@aws-sdk/credential-providers');\n\t\tconfig.credentials = fromIni({ profile: options.profile });\n\t}\n\tif (options.endpoint) {\n\t\tconfig.endpoint = options.endpoint;\n\t}\n\treturn config;\n}\n\n/**\n * A stage's secrets, serialized, are larger than the store can hold: 8 KB for\n * an SSM parameter (advanced tier), 64 KB for a Secrets Manager secret.\n *\n * Refused before AWS is called, so nothing half-written is left behind and\n * the answer is not a bare `ValidationException`.\n */\nexport class StageSecretsTooLarge extends GkmError {\n\tconstructor(\n\t\treadonly stage: string,\n\t\treadonly store: string,\n\t\treadonly bytes: number,\n\t\treadonly limit: number,\n\t) {\n\t\tsuper(\n\t\t\t`The secrets for stage \"${stage}\" are ${bytes} bytes, more than the ${limit} bytes ${store} holds in one ${store === 'ssm' ? 'parameter' : 'secret'}. ` +\n\t\t\t\t(store === 'ssm'\n\t\t\t\t\t? `Keep them in S3 instead, which has no such limit: copy the stage with gkm secrets:migrate --stage ${stage} --to s3, then set secrets.store to { provider: 's3' } in gkm.config.ts.`\n\t\t\t\t\t: 'Remove credentials the stage no longer uses, or keep the largest ones somewhere they are fetched from at runtime.'),\n\t\t);\n\t\tthis.name = 'StageSecretsTooLarge';\n\t}\n}\n\n/** The stage serialized, refused if it is larger than `limit` bytes. */\nexport function serializeWithin(\n\tstage: string,\n\tstore: string,\n\tvalue: unknown,\n\tlimit: number,\n): string {\n\tconst serialized = JSON.stringify(value);\n\tconst bytes = Buffer.byteLength(serialized, 'utf8');\n\tif (bytes > limit) {\n\t\tthrow new StageSecretsTooLarge(stage, store, bytes, limit);\n\t}\n\treturn serialized;\n}\n\n/** Where each AWS store keeps a stage's secrets, as a person reads it. */\nconst AWS_STORES: Record<string, string> = {\n\tssm: 'SSM Parameter Store',\n\t'secrets-manager': 'Secrets Manager',\n\ts3: 'S3',\n};\n\n/** Why the stage's account could not be reached. */\nexport type StageSecretsUnreadableReason = 'no-credentials' | 'expired';\n\nexport interface StageSecretsUnreadableInput {\n\tstage: string;\n\t/** The store's name: `ssm`, `secrets-manager`, `s3`. */\n\tstore: string;\n\t/** The AWS profile the credentials were looked up with, where one was. */\n\tprofile?: string;\n\t/** Whether the stage was being read or written. */\n\taccess?: 'read' | 'write';\n\treason?: StageSecretsUnreadableReason;\n}\n\n/**\n * A deployed stage's secrets are kept in its AWS account, and no AWS\n * credentials were found to reach them with — or the ones found have expired.\n *\n * Raised by the AWS stores themselves, on a read or a write, so every command\n * that touches a stage's secrets says it the same way.\n */\nexport class StageSecretsUnreadable extends GkmError {\n\treadonly stage: string;\n\treadonly store: string;\n\treadonly profile: string | undefined;\n\treadonly access: 'read' | 'write';\n\treadonly reason: StageSecretsUnreadableReason;\n\n\tconstructor(input: StageSecretsUnreadableInput, cause?: unknown) {\n\t\tconst { stage, store, profile } = input;\n\t\tconst access = input.access ?? 'read';\n\t\tconst reason = input.reason ?? 'no-credentials';\n\t\tconst where = AWS_STORES[store] ?? `the '${store}' store`;\n\t\t// How to name the account: the command's --profile, where it takes\n\t\t// one, or the SDK's own variable.\n\t\tconst named =\n\t\t\t'--profile <profile> where the command takes it, or AWS_PROFILE=<profile>';\n\t\tconst lacking =\n\t\t\treason === 'expired'\n\t\t\t\t? profile\n\t\t\t\t\t? `the AWS profile '${profile}' signed in, but its session has expired. `\n\t\t\t\t\t: 'the AWS credentials found have expired. '\n\t\t\t\t: profile\n\t\t\t\t\t? `the AWS profile '${profile}' has no credentials to ${access} them with. `\n\t\t\t\t\t: `no AWS credentials were found to ${access} them with. `;\n\t\tconst fix = profile\n\t\t\t? `Sign in to it (aws sso login --profile ${profile}) or name another: ${named}.`\n\t\t\t: reason === 'expired'\n\t\t\t\t? `Export fresh ones, or name the account's profile: ${named}.`\n\t\t\t\t: `Name the account's profile: ${named}.`;\n\t\tsuper(\n\t\t\t`The '${stage}' stage's secrets are kept in ${where}, in the stage's AWS account, and ` +\n\t\t\t\tlacking +\n\t\t\t\tfix,\n\t\t\tcause === undefined ? undefined : { cause },\n\t\t);\n\t\tthis.name = 'StageSecretsUnreadable';\n\t\tthis.stage = stage;\n\t\tthis.store = store;\n\t\tthis.profile = profile;\n\t\tthis.access = access;\n\t\tthis.reason = reason;\n\t}\n}\n\n/**\n * Why an AWS call failed for want of credentials, by the SDK's error name —\n * its message being free to change — or undefined when it failed for any\n * other reason.\n *\n * - `CredentialsProviderError`: the credential chain found nothing, or a\n *   profile's SSO session is missing or expired (the SSO provider wraps its\n *   token errors in this one).\n * - `TokenProviderError`: an SSO token, should one reach here unwrapped.\n * - `ExpiredTokenException`/`ExpiredToken`: credentials were found, and AWS\n *   refused them as expired.\n */\nexport function credentialsFailure(\n\terror: unknown,\n): StageSecretsUnreadableReason | undefined {\n\tconst name = (error as Error | undefined)?.name;\n\tif (name === 'CredentialsProviderError' || name === 'TokenProviderError') {\n\t\treturn 'no-credentials';\n\t}\n\tif (name === 'ExpiredTokenException' || name === 'ExpiredToken') {\n\t\treturn 'expired';\n\t}\n\treturn undefined;\n}\n\n/**\n * Run one AWS call of a store, refusing a failure for want of credentials\n * with {@link StageSecretsUnreadable}. Any other failure is the store's own,\n * and passes through.\n */\nexport async function withStageCredentials<T>(\n\tcontext: {\n\t\tstage: string;\n\t\tstore: string;\n\t\tprofile: string | undefined;\n\t\taccess: 'read' | 'write';\n\t},\n\tcall: () => Promise<T>,\n): Promise<T> {\n\ttry {\n\t\treturn await call();\n\t} catch (error) {\n\t\tconst reason = credentialsFailure(error);\n\t\tif (reason === undefined) throw error;\n\t\tthrow new StageSecretsUnreadable(\n\t\t\t{\n\t\t\t\t...context,\n\t\t\t\t// The profile the SDK's default chain read, when none was named.\n\t\t\t\tprofile: context.profile ?? (process.env.AWS_PROFILE || undefined),\n\t\t\t\treason,\n\t\t\t},\n\t\t\terror,\n\t\t);\n\t}\n}\n"],"mappings":";;;;;;;;;AAwBA,eAAsB,gBAAgB,SAMnC;CACF,MAAM,SAAsD,EAC3D,QAAQ,QAAQ,OACjB;CACA,IAAI,QAAQ,SAAS;EACpB,MAAM,EAAE,YAAY,MAAM,OAAO;EACjC,OAAO,cAAc,QAAQ,EAAE,SAAS,QAAQ,QAAQ,CAAC;CAC1D;CACA,IAAI,QAAQ,UACX,OAAO,WAAW,QAAQ;CAE3B,OAAO;AACR;;;;;;;;AASA,IAAa,uBAAb,cAA0CA,eAAAA,SAAS;CAExC;CACA;CACA;CACA;CAJV,YACC,OACA,OACA,OACA,OACC;EACD,MACC,0BAA0B,MAAM,QAAQ,MAAM,wBAAwB,MAAM,SAAS,MAAM,gBAAgB,UAAU,QAAQ,cAAc,SAAS,OAClJ,UAAU,QACR,qGAAqG,MAAM,4EAC3G,oHACL;EAVS,KAAA,QAAA;EACA,KAAA,QAAA;EACA,KAAA,QAAA;EACA,KAAA,QAAA;EAQT,KAAK,OAAO;CACb;AACD;;AAGA,SAAgB,gBACf,OACA,OACA,OACA,OACS;CACT,MAAM,aAAa,KAAK,UAAU,KAAK;CACvC,MAAM,QAAQ,OAAO,WAAW,YAAY,MAAM;CAClD,IAAI,QAAQ,OACX,MAAM,IAAI,qBAAqB,OAAO,OAAO,OAAO,KAAK;CAE1D,OAAO;AACR;;AAGA,MAAM,aAAqC;CAC1C,KAAK;CACL,mBAAmB;CACnB,IAAI;AACL;;;;;;;;AAuBA,IAAa,yBAAb,cAA4CA,eAAAA,SAAS;CACpD;CACA;CACA;CACA;CACA;CAEA,YAAY,OAAoC,OAAiB;EAChE,MAAM,EAAE,OAAO,OAAO,YAAY;EAClC,MAAM,SAAS,MAAM,UAAU;EAC/B,MAAM,SAAS,MAAM,UAAU;EAC/B,MAAM,QAAQ,WAAW,UAAU,QAAQ,MAAM;EAGjD,MAAM,QACL;EACD,MAAM,UACL,WAAW,YACR,UACC,oBAAoB,QAAQ,8CAC5B,6CACD,UACC,oBAAoB,QAAQ,0BAA0B,OAAO,gBAC7D,oCAAoC,OAAO;EAChD,MAAM,MAAM,UACT,0CAA0C,QAAQ,qBAAqB,MAAM,KAC7E,WAAW,YACV,qDAAqD,MAAM,KAC3D,+BAA+B,MAAM;EACzC,MACC,QAAQ,MAAM,gCAAgC,MAAM,sCACnD,UACA,KACD,UAAU,KAAA,IAAY,KAAA,IAAY,EAAE,MAAM,CAC3C;EACA,KAAK,OAAO;EACZ,KAAK,QAAQ;EACb,KAAK,QAAQ;EACb,KAAK,UAAU;EACf,KAAK,SAAS;EACd,KAAK,SAAS;CACf;AACD;;;;;;;;;;;;;AAcA,SAAgB,mBACf,OAC2C;CAC3C,MAAM,OAAQ,OAA6B;CAC3C,IAAI,SAAS,8BAA8B,SAAS,sBACnD,OAAO;CAER,IAAI,SAAS,2BAA2B,SAAS,gBAChD,OAAO;AAGT;;;;;;AAOA,eAAsB,qBACrB,SAMA,MACa;CACb,IAAI;EACH,OAAO,MAAM,KAAK;CACnB,SAAS,OAAO;EACf,MAAM,SAAS,mBAAmB,KAAK;EACvC,IAAI,WAAW,KAAA,GAAW,MAAM;EAChC,MAAM,IAAI,uBACT;GACC,GAAG;GAEH,SAAS,QAAQ,YAAY,QAAQ,IAAI,eAAe,KAAA;GACxD;EACD,GACA,KACD;CACD;AACD"}

package/dist/{backup-provisioner-DXXg6FIL.mjs → backup-provisioner-C8DnCmxK.mjs}

@@ -1,7 +1,12 @@
 import { CreateBucketCommand, HeadBucketCommand, PutBucketVersioningCommand, S3Client } from "@aws-sdk/client-s3";
 import { CreateAccessKeyCommand, CreateUserCommand, GetUserCommand, IAMClient, PutUserPolicyCommand } from "@aws-sdk/client-iam";
-
-//#region src/deploy/backup-provisioner.ts
+//#region src/target/dokploy/backup-provisioner.ts
+/**
+* Backup Destination Provisioner
+*
+* Creates AWS resources (S3 bucket, IAM user, access keys) and configures
+* Dokploy backup destinations for database backups.
+*/
 /**
 * Generate a random suffix for unique resource names
 */
@@ -80,8 +85,7 @@ async function provisionBackupDestination(options) {
 	const aws = await createAwsClients(config.region, config.profile, awsEndpoint);
 	const sanitizedProject = sanitizeName(projectName);
 	const bucketName = existingState?.bucketName ?? `${sanitizedProject}-${stage}-backups-${randomSuffix()}`;
-	const bucketAlreadyExists = await bucketExists(aws.s3, bucketName);
-	if (!bucketAlreadyExists) {
+	if (!await bucketExists(aws.s3, bucketName)) {
 		logger.log(`   Creating S3 bucket: ${bucketName}`);
 		const createBucketParams = { Bucket: bucketName };
 		if (config.region !== "us-east-1") createBucketParams.CreateBucketConfiguration = { LocationConstraint: config.region };
@@ -92,8 +96,7 @@ async function provisionBackupDestination(options) {
 		}));
 	} else logger.log(`   Using existing S3 bucket: ${bucketName}`);
 	const iamUserName = existingState?.iamUserName ?? `dokploy-backup-${sanitizedProject}-${stage}`;
-	const iamUserAlreadyExists = await userExists(aws.iam, iamUserName);
-	if (!iamUserAlreadyExists) {
+	if (!await userExists(aws.iam, iamUserName)) {
 		logger.log(`   Creating IAM user: ${iamUserName}`);
 		await aws.iam.send(new CreateUserCommand({ UserName: iamUserName }));
 	} else logger.log(`   Using existing IAM user: ${iamUserName}`);
@@ -157,7 +160,7 @@ async function provisionBackupDestination(options) {
 		createdAt: existingState?.createdAt ?? (/* @__PURE__ */ new Date()).toISOString()
 	};
 }
-
 //#endregion
 export { provisionBackupDestination };
-//# sourceMappingURL=backup-provisioner-DXXg6FIL.mjs.map
+
+//# sourceMappingURL=backup-provisioner-C8DnCmxK.mjs.map

package/dist/backup-provisioner-C8DnCmxK.mjs.map

@@ -0,0 +1 @@
+{"version":3,"file":"backup-provisioner-C8DnCmxK.mjs","names":[],"sources":["../src/target/dokploy/backup-provisioner.ts"],"sourcesContent":["/**\n * Backup Destination Provisioner\n *\n * Creates AWS resources (S3 bucket, IAM user, access keys) and configures\n * Dokploy backup destinations for database backups.\n */\n\nimport {\n\tCreateAccessKeyCommand,\n\tCreateUserCommand,\n\tGetUserCommand,\n\tIAMClient,\n\ttype IAMClientConfig,\n\tPutUserPolicyCommand,\n} from '@aws-sdk/client-iam';\nimport {\n\ttype BucketLocationConstraint,\n\tCreateBucketCommand,\n\tHeadBucketCommand,\n\tPutBucketVersioningCommand,\n\tS3Client,\n\ttype S3ClientConfig,\n} from '@aws-sdk/client-s3';\nimport type { BackupState } from '../../deploy/state.js';\nimport type { DokployBackupsConfig } from '../../workspace/types.js';\nimport type { DokployApi } from './dokploy-api.js';\n\nexport interface ProvisionBackupOptions {\n\t/** Dokploy API client */\n\tapi: DokployApi;\n\t/** Dokploy project ID */\n\tprojectId: string;\n\t/** Workspace name (used for resource naming) */\n\tprojectName: string;\n\t/** Deploy stage (e.g., 'production', 'staging') */\n\tstage: string;\n\t/** Backup configuration */\n\tconfig: DokployBackupsConfig;\n\t/** Existing backup state (if any) */\n\texistingState?: BackupState;\n\t/** Logger for progress output */\n\tlogger: { log: (msg: string) => void };\n\t/** AWS endpoint override (for testing with LocalStack) */\n\tawsEndpoint?: string;\n}\n\n/**\n * Generate a random suffix for unique resource names\n */\nfunction randomSuffix(): string {\n\treturn Math.random().toString(36).substring(2, 8);\n}\n\n/**\n * Sanitize a name for AWS resources (lowercase alphanumeric and hyphens)\n */\nfunction sanitizeName(name: string): string {\n\treturn name.toLowerCase().replace(/[^a-z0-9-]/g, '-');\n}\n\n/**\n * Create AWS clients with optional profile credentials\n */\nasync function createAwsClients(\n\tregion: string,\n\tprofile?: string,\n\tendpoint?: string,\n): Promise<{ s3: S3Client; iam: IAMClient }> {\n\tconst config: S3ClientConfig & IAMClientConfig = { region };\n\n\tif (profile) {\n\t\tconst { fromIni } = await import('@aws-sdk/credential-providers');\n\t\tconfig.credentials = fromIni({ profile });\n\t}\n\n\t// Support custom endpoint for testing (e.g., LocalStack)\n\tif (endpoint) {\n\t\tconfig.endpoint = endpoint;\n\t\t(config as S3ClientConfig).forcePathStyle = true;\n\t\t// Use test credentials when endpoint is specified\n\t\tconfig.credentials = {\n\t\t\taccessKeyId: 'test',\n\t\t\tsecretAccessKey: 'test',\n\t\t};\n\t}\n\n\treturn {\n\t\ts3: new S3Client(config),\n\t\tiam: new IAMClient(config),\n\t};\n}\n\n/**\n * Check if an S3 bucket exists\n */\nasync function bucketExists(\n\ts3: S3Client,\n\tbucketName: string,\n): Promise<boolean> {\n\ttry {\n\t\tawait s3.send(new HeadBucketCommand({ Bucket: bucketName }));\n\t\treturn true;\n\t} catch (error) {\n\t\tif ((error as { name?: string }).name === 'NotFound') {\n\t\t\treturn false;\n\t\t}\n\t\t// 403 means bucket exists but we don't have access\n\t\tif (\n\t\t\t(error as { $metadata?: { httpStatusCode?: number } }).$metadata\n\t\t\t\t?.httpStatusCode === 403\n\t\t) {\n\t\t\treturn true;\n\t\t}\n\t\tthrow error;\n\t}\n}\n\n/**\n * Check if an IAM user exists\n */\nasync function userExists(iam: IAMClient, userName: string): Promise<boolean> {\n\ttry {\n\t\tawait iam.send(new GetUserCommand({ UserName: userName }));\n\t\treturn true;\n\t} catch (error) {\n\t\tconst errorName = (error as { name?: string }).name;\n\t\t// AWS returns 'NoSuchEntity', LocalStack returns 'NoSuchEntityException'\n\t\tif (errorName === 'NoSuchEntity' || errorName === 'NoSuchEntityException') {\n\t\t\treturn false;\n\t\t}\n\t\tthrow error;\n\t}\n}\n\n/**\n * Provision backup destination for a deployment.\n *\n * Creates AWS resources (S3 bucket, IAM user) and Dokploy destination if needed.\n * Reuses existing resources from state when possible.\n */\nexport async function provisionBackupDestination(\n\toptions: ProvisionBackupOptions,\n): Promise<BackupState> {\n\tconst {\n\t\tapi,\n\t\tprojectName,\n\t\tstage,\n\t\tconfig,\n\t\texistingState,\n\t\tlogger,\n\t\tawsEndpoint,\n\t} = options;\n\n\t// If we have existing state, verify the Dokploy destination still exists\n\tif (existingState?.destinationId) {\n\t\ttry {\n\t\t\tawait api.getDestination(existingState.destinationId);\n\t\t\tlogger.log('   Using existing backup destination');\n\t\t\treturn existingState;\n\t\t} catch {\n\t\t\tlogger.log('   Existing destination not found, recreating...');\n\t\t}\n\t}\n\n\t// Create AWS clients\n\tconst aws = await createAwsClients(\n\t\tconfig.region,\n\t\tconfig.profile,\n\t\tawsEndpoint,\n\t);\n\tconst sanitizedProject = sanitizeName(projectName);\n\n\t// 1. Create or verify S3 bucket\n\tconst bucketName =\n\t\texistingState?.bucketName ??\n\t\t`${sanitizedProject}-${stage}-backups-${randomSuffix()}`;\n\n\tconst bucketAlreadyExists = await bucketExists(aws.s3, bucketName);\n\tif (!bucketAlreadyExists) {\n\t\tlogger.log(`   Creating S3 bucket: ${bucketName}`);\n\n\t\t// CreateBucket needs LocationConstraint for non-us-east-1 regions\n\t\tconst createBucketParams: {\n\t\t\tBucket: string;\n\t\t\tCreateBucketConfiguration?: {\n\t\t\t\tLocationConstraint: BucketLocationConstraint;\n\t\t\t};\n\t\t} = {\n\t\t\tBucket: bucketName,\n\t\t};\n\t\tif (config.region !== 'us-east-1') {\n\t\t\tcreateBucketParams.CreateBucketConfiguration = {\n\t\t\t\tLocationConstraint: config.region as BucketLocationConstraint,\n\t\t\t};\n\t\t}\n\n\t\tawait aws.s3.send(new CreateBucketCommand(createBucketParams));\n\n\t\t// Enable versioning for backup integrity\n\t\tawait aws.s3.send(\n\t\t\tnew PutBucketVersioningCommand({\n\t\t\t\tBucket: bucketName,\n\t\t\t\tVersioningConfiguration: { Status: 'Enabled' },\n\t\t\t}),\n\t\t);\n\t} else {\n\t\tlogger.log(`   Using existing S3 bucket: ${bucketName}`);\n\t}\n\n\t// 2. Create or verify IAM user\n\tconst iamUserName =\n\t\texistingState?.iamUserName ?? `dokploy-backup-${sanitizedProject}-${stage}`;\n\n\tconst iamUserAlreadyExists = await userExists(aws.iam, iamUserName);\n\tif (!iamUserAlreadyExists) {\n\t\tlogger.log(`   Creating IAM user: ${iamUserName}`);\n\t\tawait aws.iam.send(new CreateUserCommand({ UserName: iamUserName }));\n\t} else {\n\t\tlogger.log(`   Using existing IAM user: ${iamUserName}`);\n\t}\n\n\t// 3. Attach bucket policy to IAM user\n\tconst policyDocument = {\n\t\tVersion: '2012-10-17',\n\t\tStatement: [\n\t\t\t{\n\t\t\t\tEffect: 'Allow',\n\t\t\t\tAction: [\n\t\t\t\t\t's3:GetObject',\n\t\t\t\t\t's3:PutObject',\n\t\t\t\t\t's3:DeleteObject',\n\t\t\t\t\t's3:ListBucket',\n\t\t\t\t\t's3:GetBucketLocation',\n\t\t\t\t],\n\t\t\t\tResource: [\n\t\t\t\t\t`arn:aws:s3:::${bucketName}`,\n\t\t\t\t\t`arn:aws:s3:::${bucketName}/*`,\n\t\t\t\t],\n\t\t\t},\n\t\t],\n\t};\n\n\tlogger.log('   Updating IAM policy');\n\tawait aws.iam.send(\n\t\tnew PutUserPolicyCommand({\n\t\t\tUserName: iamUserName,\n\t\t\tPolicyName: 'DokployBackupAccess',\n\t\t\tPolicyDocument: JSON.stringify(policyDocument),\n\t\t}),\n\t);\n\n\t// 4. Create access key (or reuse existing if state has it and destination needs recreation)\n\tlet accessKeyId: string;\n\tlet secretAccessKey: string;\n\n\tif (existingState?.iamAccessKeyId && existingState?.iamSecretAccessKey) {\n\t\t// Reuse existing credentials\n\t\tlogger.log('   Using existing IAM access key');\n\t\taccessKeyId = existingState.iamAccessKeyId;\n\t\tsecretAccessKey = existingState.iamSecretAccessKey;\n\t} else {\n\t\t// Create new access key\n\t\tlogger.log('   Creating IAM access key');\n\t\tconst accessKeyResult = await aws.iam.send(\n\t\t\tnew CreateAccessKeyCommand({ UserName: iamUserName }),\n\t\t);\n\n\t\tif (!accessKeyResult.AccessKey) {\n\t\t\tthrow new Error('Failed to create IAM access key');\n\t\t}\n\n\t\taccessKeyId = accessKeyResult.AccessKey.AccessKeyId!;\n\t\tsecretAccessKey = accessKeyResult.AccessKey.SecretAccessKey!;\n\t}\n\n\t// 5. Create Dokploy destination\n\tconst destinationName = `${sanitizedProject}-${stage}-s3`;\n\tlogger.log(`   Creating Dokploy destination: ${destinationName}`);\n\n\tconst { destination, created } = await api.findOrCreateDestination(\n\t\tdestinationName,\n\t\t{\n\t\t\taccessKey: accessKeyId,\n\t\t\tsecretAccessKey: secretAccessKey,\n\t\t\tbucket: bucketName,\n\t\t\tregion: config.region,\n\t\t},\n\t);\n\n\tif (created) {\n\t\tlogger.log('   ✓ Dokploy destination created');\n\t} else {\n\t\tlogger.log('   ✓ Using existing Dokploy destination');\n\t}\n\n\t// 6. Test connection\n\ttry {\n\t\tawait api.testDestinationConnection(destination.destinationId);\n\t\tlogger.log('   ✓ Destination connection verified');\n\t} catch (error) {\n\t\tlogger.log(\n\t\t\t`   ⚠ Warning: Could not verify destination connection: ${error}`,\n\t\t);\n\t}\n\n\treturn {\n\t\tbucketName,\n\t\tbucketArn: `arn:aws:s3:::${bucketName}`,\n\t\tiamUserName,\n\t\tiamAccessKeyId: accessKeyId,\n\t\tiamSecretAccessKey: secretAccessKey,\n\t\tdestinationId: destination.destinationId,\n\t\tregion: config.region,\n\t\tcreatedAt: existingState?.createdAt ?? new Date().toISOString(),\n\t};\n}\n"],"mappings":";;;;;;;;;;;;AAiDA,SAAS,eAAuB;CAC/B,OAAO,KAAK,OAAO,CAAC,CAAC,SAAS,EAAE,CAAC,CAAC,UAAU,GAAG,CAAC;AACjD;;;;AAKA,SAAS,aAAa,MAAsB;CAC3C,OAAO,KAAK,YAAY,CAAC,CAAC,QAAQ,eAAe,GAAG;AACrD;;;;AAKA,eAAe,iBACd,QACA,SACA,UAC4C;CAC5C,MAAM,SAA2C,EAAE,OAAO;CAE1D,IAAI,SAAS;EACZ,MAAM,EAAE,YAAY,MAAM,OAAO;EACjC,OAAO,cAAc,QAAQ,EAAE,QAAQ,CAAC;CACzC;CAGA,IAAI,UAAU;EACb,OAAO,WAAW;EAClB,OAA2B,iBAAiB;EAE5C,OAAO,cAAc;GACpB,aAAa;GACb,iBAAiB;EAClB;CACD;CAEA,OAAO;EACN,IAAI,IAAI,SAAS,MAAM;EACvB,KAAK,IAAI,UAAU,MAAM;CAC1B;AACD;;;;AAKA,eAAe,aACd,IACA,YACmB;CACnB,IAAI;EACH,MAAM,GAAG,KAAK,IAAI,kBAAkB,EAAE,QAAQ,WAAW,CAAC,CAAC;EAC3D,OAAO;CACR,SAAS,OAAO;EACf,IAAK,MAA4B,SAAS,YACzC,OAAO;EAGR,IACE,MAAsD,WACpD,mBAAmB,KAEtB,OAAO;EAER,MAAM;CACP;AACD;;;;AAKA,eAAe,WAAW,KAAgB,UAAoC;CAC7E,IAAI;EACH,MAAM,IAAI,KAAK,IAAI,eAAe,EAAE,UAAU,SAAS,CAAC,CAAC;EACzD,OAAO;CACR,SAAS,OAAO;EACf,MAAM,YAAa,MAA4B;EAE/C,IAAI,cAAc,kBAAkB,cAAc,yBACjD,OAAO;EAER,MAAM;CACP;AACD;;;;;;;AAQA,eAAsB,2BACrB,SACuB;CACvB,MAAM,EACL,KACA,aACA,OACA,QACA,eACA,QACA,gBACG;CAGJ,IAAI,eAAe,eAClB,IAAI;EACH,MAAM,IAAI,eAAe,cAAc,aAAa;EACpD,OAAO,IAAI,sCAAsC;EACjD,OAAO;CACR,QAAQ;EACP,OAAO,IAAI,kDAAkD;CAC9D;CAID,MAAM,MAAM,MAAM,iBACjB,OAAO,QACP,OAAO,SACP,WACD;CACA,MAAM,mBAAmB,aAAa,WAAW;CAGjD,MAAM,aACL,eAAe,cACf,GAAG,iBAAiB,GAAG,MAAM,WAAW,aAAa;CAGtD,IAAI,CAAC,MAD6B,aAAa,IAAI,IAAI,UAAU,GACvC;EACzB,OAAO,IAAI,0BAA0B,YAAY;EAGjD,MAAM,qBAKF,EACH,QAAQ,WACT;EACA,IAAI,OAAO,WAAW,aACrB,mBAAmB,4BAA4B,EAC9C,oBAAoB,OAAO,OAC5B;EAGD,MAAM,IAAI,GAAG,KAAK,IAAI,oBAAoB,kBAAkB,CAAC;EAG7D,MAAM,IAAI,GAAG,KACZ,IAAI,2BAA2B;GAC9B,QAAQ;GACR,yBAAyB,EAAE,QAAQ,UAAU;EAC9C,CAAC,CACF;CACD,OACC,OAAO,IAAI,gCAAgC,YAAY;CAIxD,MAAM,cACL,eAAe,eAAe,kBAAkB,iBAAiB,GAAG;CAGrE,IAAI,CAAC,MAD8B,WAAW,IAAI,KAAK,WAAW,GACvC;EAC1B,OAAO,IAAI,yBAAyB,aAAa;EACjD,MAAM,IAAI,IAAI,KAAK,IAAI,kBAAkB,EAAE,UAAU,YAAY,CAAC,CAAC;CACpE,OACC,OAAO,IAAI,+BAA+B,aAAa;CAIxD,MAAM,iBAAiB;EACtB,SAAS;EACT,WAAW,CACV;GACC,QAAQ;GACR,QAAQ;IACP;IACA;IACA;IACA;IACA;GACD;GACA,UAAU,CACT,gBAAgB,cAChB,gBAAgB,WAAW,GAC5B;EACD,CACD;CACD;CAEA,OAAO,IAAI,wBAAwB;CACnC,MAAM,IAAI,IAAI,KACb,IAAI,qBAAqB;EACxB,UAAU;EACV,YAAY;EACZ,gBAAgB,KAAK,UAAU,cAAc;CAC9C,CAAC,CACF;CAGA,IAAI;CACJ,IAAI;CAEJ,IAAI,eAAe,kBAAkB,eAAe,oBAAoB;EAEvE,OAAO,IAAI,kCAAkC;EAC7C,cAAc,cAAc;EAC5B,kBAAkB,cAAc;CACjC,OAAO;EAEN,OAAO,IAAI,4BAA4B;EACvC,MAAM,kBAAkB,MAAM,IAAI,IAAI,KACrC,IAAI,uBAAuB,EAAE,UAAU,YAAY,CAAC,CACrD;EAEA,IAAI,CAAC,gBAAgB,WACpB,MAAM,IAAI,MAAM,iCAAiC;EAGlD,cAAc,gBAAgB,UAAU;EACxC,kBAAkB,gBAAgB,UAAU;CAC7C;CAGA,MAAM,kBAAkB,GAAG,iBAAiB,GAAG,MAAM;CACrD,OAAO,IAAI,oCAAoC,iBAAiB;CAEhE,MAAM,EAAE,aAAa,YAAY,MAAM,IAAI,wBAC1C,iBACA;EACC,WAAW;EACM;EACjB,QAAQ;EACR,QAAQ,OAAO;CAChB,CACD;CAEA,IAAI,SACH,OAAO,IAAI,kCAAkC;MAE7C,OAAO,IAAI,yCAAyC;CAIrD,IAAI;EACH,MAAM,IAAI,0BAA0B,YAAY,aAAa;EAC7D,OAAO,IAAI,sCAAsC;CAClD,SAAS,OAAO;EACf,OAAO,IACN,0DAA0D,OAC3D;CACD;CAEA,OAAO;EACN;EACA,WAAW,gBAAgB;EAC3B;EACA,gBAAgB;EAChB,oBAAoB;EACpB,eAAe,YAAY;EAC3B,QAAQ,OAAO;EACf,WAAW,eAAe,8BAAa,IAAI,KAAK,EAAA,CAAE,YAAY;CAC/D;AACD"}

package/dist/{backup-provisioner-cE2PuCTb.cjs → backup-provisioner-oDEsPj02.cjs}

@@ -1,8 +1,12 @@
-const require_chunk = require('./chunk-CUT6urMc.cjs');
-const __aws_sdk_client_s3 = require_chunk.__toESM(require("@aws-sdk/client-s3"));
-const __aws_sdk_client_iam = require_chunk.__toESM(require("@aws-sdk/client-iam"));
-
-//#region src/deploy/backup-provisioner.ts
+let _aws_sdk_client_s3 = require("@aws-sdk/client-s3");
+let _aws_sdk_client_iam = require("@aws-sdk/client-iam");
+//#region src/target/dokploy/backup-provisioner.ts
+/**
+* Backup Destination Provisioner
+*
+* Creates AWS resources (S3 bucket, IAM user, access keys) and configures
+* Dokploy backup destinations for database backups.
+*/
 /**
 * Generate a random suffix for unique resource names
 */
@@ -33,8 +37,8 @@ async function createAwsClients(region, profile, endpoint) {
 		};
 	}
 	return {
-		s3: new __aws_sdk_client_s3.S3Client(config),
-		iam: new __aws_sdk_client_iam.IAMClient(config)
+		s3: new _aws_sdk_client_s3.S3Client(config),
+		iam: new _aws_sdk_client_iam.IAMClient(config)
 	};
 }
 /**
@@ -42,7 +46,7 @@ async function createAwsClients(region, profile, endpoint) {
 */
 async function bucketExists(s3, bucketName) {
 	try {
-		await s3.send(new __aws_sdk_client_s3.HeadBucketCommand({ Bucket: bucketName }));
+		await s3.send(new _aws_sdk_client_s3.HeadBucketCommand({ Bucket: bucketName }));
 		return true;
 	} catch (error) {
 		if (error.name === "NotFound") return false;
@@ -55,7 +59,7 @@ async function bucketExists(s3, bucketName) {
 */
 async function userExists(iam, userName) {
 	try {
-		await iam.send(new __aws_sdk_client_iam.GetUserCommand({ UserName: userName }));
+		await iam.send(new _aws_sdk_client_iam.GetUserCommand({ UserName: userName }));
 		return true;
 	} catch (error) {
 		const errorName = error.name;
@@ -81,22 +85,20 @@ async function provisionBackupDestination(options) {
 	const aws = await createAwsClients(config.region, config.profile, awsEndpoint);
 	const sanitizedProject = sanitizeName(projectName);
 	const bucketName = existingState?.bucketName ?? `${sanitizedProject}-${stage}-backups-${randomSuffix()}`;
-	const bucketAlreadyExists = await bucketExists(aws.s3, bucketName);
-	if (!bucketAlreadyExists) {
+	if (!await bucketExists(aws.s3, bucketName)) {
 		logger.log(`   Creating S3 bucket: ${bucketName}`);
 		const createBucketParams = { Bucket: bucketName };
 		if (config.region !== "us-east-1") createBucketParams.CreateBucketConfiguration = { LocationConstraint: config.region };
-		await aws.s3.send(new __aws_sdk_client_s3.CreateBucketCommand(createBucketParams));
-		await aws.s3.send(new __aws_sdk_client_s3.PutBucketVersioningCommand({
+		await aws.s3.send(new _aws_sdk_client_s3.CreateBucketCommand(createBucketParams));
+		await aws.s3.send(new _aws_sdk_client_s3.PutBucketVersioningCommand({
 			Bucket: bucketName,
 			VersioningConfiguration: { Status: "Enabled" }
 		}));
 	} else logger.log(`   Using existing S3 bucket: ${bucketName}`);
 	const iamUserName = existingState?.iamUserName ?? `dokploy-backup-${sanitizedProject}-${stage}`;
-	const iamUserAlreadyExists = await userExists(aws.iam, iamUserName);
-	if (!iamUserAlreadyExists) {
+	if (!await userExists(aws.iam, iamUserName)) {
 		logger.log(`   Creating IAM user: ${iamUserName}`);
-		await aws.iam.send(new __aws_sdk_client_iam.CreateUserCommand({ UserName: iamUserName }));
+		await aws.iam.send(new _aws_sdk_client_iam.CreateUserCommand({ UserName: iamUserName }));
 	} else logger.log(`   Using existing IAM user: ${iamUserName}`);
 	const policyDocument = {
 		Version: "2012-10-17",
@@ -113,7 +115,7 @@ async function provisionBackupDestination(options) {
 		}]
 	};
 	logger.log("   Updating IAM policy");
-	await aws.iam.send(new __aws_sdk_client_iam.PutUserPolicyCommand({
+	await aws.iam.send(new _aws_sdk_client_iam.PutUserPolicyCommand({
 		UserName: iamUserName,
 		PolicyName: "DokployBackupAccess",
 		PolicyDocument: JSON.stringify(policyDocument)
@@ -126,7 +128,7 @@ async function provisionBackupDestination(options) {
 		secretAccessKey = existingState.iamSecretAccessKey;
 	} else {
 		logger.log("   Creating IAM access key");
-		const accessKeyResult = await aws.iam.send(new __aws_sdk_client_iam.CreateAccessKeyCommand({ UserName: iamUserName }));
+		const accessKeyResult = await aws.iam.send(new _aws_sdk_client_iam.CreateAccessKeyCommand({ UserName: iamUserName }));
 		if (!accessKeyResult.AccessKey) throw new Error("Failed to create IAM access key");
 		accessKeyId = accessKeyResult.AccessKey.AccessKeyId;
 		secretAccessKey = accessKeyResult.AccessKey.SecretAccessKey;
@@ -158,7 +160,7 @@ async function provisionBackupDestination(options) {
 		createdAt: existingState?.createdAt ?? (/* @__PURE__ */ new Date()).toISOString()
 	};
 }
-
 //#endregion
 exports.provisionBackupDestination = provisionBackupDestination;
-//# sourceMappingURL=backup-provisioner-cE2PuCTb.cjs.map
+
+//# sourceMappingURL=backup-provisioner-oDEsPj02.cjs.map

package/dist/backup-provisioner-oDEsPj02.cjs.map

@@ -0,0 +1 @@
+{"version":3,"file":"backup-provisioner-oDEsPj02.cjs","names":["S3Client","IAMClient","HeadBucketCommand","GetUserCommand","CreateBucketCommand","PutBucketVersioningCommand","CreateUserCommand","PutUserPolicyCommand","CreateAccessKeyCommand"],"sources":["../src/target/dokploy/backup-provisioner.ts"],"sourcesContent":["/**\n * Backup Destination Provisioner\n *\n * Creates AWS resources (S3 bucket, IAM user, access keys) and configures\n * Dokploy backup destinations for database backups.\n */\n\nimport {\n\tCreateAccessKeyCommand,\n\tCreateUserCommand,\n\tGetUserCommand,\n\tIAMClient,\n\ttype IAMClientConfig,\n\tPutUserPolicyCommand,\n} from '@aws-sdk/client-iam';\nimport {\n\ttype BucketLocationConstraint,\n\tCreateBucketCommand,\n\tHeadBucketCommand,\n\tPutBucketVersioningCommand,\n\tS3Client,\n\ttype S3ClientConfig,\n} from '@aws-sdk/client-s3';\nimport type { BackupState } from '../../deploy/state.js';\nimport type { DokployBackupsConfig } from '../../workspace/types.js';\nimport type { DokployApi } from './dokploy-api.js';\n\nexport interface ProvisionBackupOptions {\n\t/** Dokploy API client */\n\tapi: DokployApi;\n\t/** Dokploy project ID */\n\tprojectId: string;\n\t/** Workspace name (used for resource naming) */\n\tprojectName: string;\n\t/** Deploy stage (e.g., 'production', 'staging') */\n\tstage: string;\n\t/** Backup configuration */\n\tconfig: DokployBackupsConfig;\n\t/** Existing backup state (if any) */\n\texistingState?: BackupState;\n\t/** Logger for progress output */\n\tlogger: { log: (msg: string) => void };\n\t/** AWS endpoint override (for testing with LocalStack) */\n\tawsEndpoint?: string;\n}\n\n/**\n * Generate a random suffix for unique resource names\n */\nfunction randomSuffix(): string {\n\treturn Math.random().toString(36).substring(2, 8);\n}\n\n/**\n * Sanitize a name for AWS resources (lowercase alphanumeric and hyphens)\n */\nfunction sanitizeName(name: string): string {\n\treturn name.toLowerCase().replace(/[^a-z0-9-]/g, '-');\n}\n\n/**\n * Create AWS clients with optional profile credentials\n */\nasync function createAwsClients(\n\tregion: string,\n\tprofile?: string,\n\tendpoint?: string,\n): Promise<{ s3: S3Client; iam: IAMClient }> {\n\tconst config: S3ClientConfig & IAMClientConfig = { region };\n\n\tif (profile) {\n\t\tconst { fromIni } = await import('@aws-sdk/credential-providers');\n\t\tconfig.credentials = fromIni({ profile });\n\t}\n\n\t// Support custom endpoint for testing (e.g., LocalStack)\n\tif (endpoint) {\n\t\tconfig.endpoint = endpoint;\n\t\t(config as S3ClientConfig).forcePathStyle = true;\n\t\t// Use test credentials when endpoint is specified\n\t\tconfig.credentials = {\n\t\t\taccessKeyId: 'test',\n\t\t\tsecretAccessKey: 'test',\n\t\t};\n\t}\n\n\treturn {\n\t\ts3: new S3Client(config),\n\t\tiam: new IAMClient(config),\n\t};\n}\n\n/**\n * Check if an S3 bucket exists\n */\nasync function bucketExists(\n\ts3: S3Client,\n\tbucketName: string,\n): Promise<boolean> {\n\ttry {\n\t\tawait s3.send(new HeadBucketCommand({ Bucket: bucketName }));\n\t\treturn true;\n\t} catch (error) {\n\t\tif ((error as { name?: string }).name === 'NotFound') {\n\t\t\treturn false;\n\t\t}\n\t\t// 403 means bucket exists but we don't have access\n\t\tif (\n\t\t\t(error as { $metadata?: { httpStatusCode?: number } }).$metadata\n\t\t\t\t?.httpStatusCode === 403\n\t\t) {\n\t\t\treturn true;\n\t\t}\n\t\tthrow error;\n\t}\n}\n\n/**\n * Check if an IAM user exists\n */\nasync function userExists(iam: IAMClient, userName: string): Promise<boolean> {\n\ttry {\n\t\tawait iam.send(new GetUserCommand({ UserName: userName }));\n\t\treturn true;\n\t} catch (error) {\n\t\tconst errorName = (error as { name?: string }).name;\n\t\t// AWS returns 'NoSuchEntity', LocalStack returns 'NoSuchEntityException'\n\t\tif (errorName === 'NoSuchEntity' || errorName === 'NoSuchEntityException') {\n\t\t\treturn false;\n\t\t}\n\t\tthrow error;\n\t}\n}\n\n/**\n * Provision backup destination for a deployment.\n *\n * Creates AWS resources (S3 bucket, IAM user) and Dokploy destination if needed.\n * Reuses existing resources from state when possible.\n */\nexport async function provisionBackupDestination(\n\toptions: ProvisionBackupOptions,\n): Promise<BackupState> {\n\tconst {\n\t\tapi,\n\t\tprojectName,\n\t\tstage,\n\t\tconfig,\n\t\texistingState,\n\t\tlogger,\n\t\tawsEndpoint,\n\t} = options;\n\n\t// If we have existing state, verify the Dokploy destination still exists\n\tif (existingState?.destinationId) {\n\t\ttry {\n\t\t\tawait api.getDestination(existingState.destinationId);\n\t\t\tlogger.log('   Using existing backup destination');\n\t\t\treturn existingState;\n\t\t} catch {\n\t\t\tlogger.log('   Existing destination not found, recreating...');\n\t\t}\n\t}\n\n\t// Create AWS clients\n\tconst aws = await createAwsClients(\n\t\tconfig.region,\n\t\tconfig.profile,\n\t\tawsEndpoint,\n\t);\n\tconst sanitizedProject = sanitizeName(projectName);\n\n\t// 1. Create or verify S3 bucket\n\tconst bucketName =\n\t\texistingState?.bucketName ??\n\t\t`${sanitizedProject}-${stage}-backups-${randomSuffix()}`;\n\n\tconst bucketAlreadyExists = await bucketExists(aws.s3, bucketName);\n\tif (!bucketAlreadyExists) {\n\t\tlogger.log(`   Creating S3 bucket: ${bucketName}`);\n\n\t\t// CreateBucket needs LocationConstraint for non-us-east-1 regions\n\t\tconst createBucketParams: {\n\t\t\tBucket: string;\n\t\t\tCreateBucketConfiguration?: {\n\t\t\t\tLocationConstraint: BucketLocationConstraint;\n\t\t\t};\n\t\t} = {\n\t\t\tBucket: bucketName,\n\t\t};\n\t\tif (config.region !== 'us-east-1') {\n\t\t\tcreateBucketParams.CreateBucketConfiguration = {\n\t\t\t\tLocationConstraint: config.region as BucketLocationConstraint,\n\t\t\t};\n\t\t}\n\n\t\tawait aws.s3.send(new CreateBucketCommand(createBucketParams));\n\n\t\t// Enable versioning for backup integrity\n\t\tawait aws.s3.send(\n\t\t\tnew PutBucketVersioningCommand({\n\t\t\t\tBucket: bucketName,\n\t\t\t\tVersioningConfiguration: { Status: 'Enabled' },\n\t\t\t}),\n\t\t);\n\t} else {\n\t\tlogger.log(`   Using existing S3 bucket: ${bucketName}`);\n\t}\n\n\t// 2. Create or verify IAM user\n\tconst iamUserName =\n\t\texistingState?.iamUserName ?? `dokploy-backup-${sanitizedProject}-${stage}`;\n\n\tconst iamUserAlreadyExists = await userExists(aws.iam, iamUserName);\n\tif (!iamUserAlreadyExists) {\n\t\tlogger.log(`   Creating IAM user: ${iamUserName}`);\n\t\tawait aws.iam.send(new CreateUserCommand({ UserName: iamUserName }));\n\t} else {\n\t\tlogger.log(`   Using existing IAM user: ${iamUserName}`);\n\t}\n\n\t// 3. Attach bucket policy to IAM user\n\tconst policyDocument = {\n\t\tVersion: '2012-10-17',\n\t\tStatement: [\n\t\t\t{\n\t\t\t\tEffect: 'Allow',\n\t\t\t\tAction: [\n\t\t\t\t\t's3:GetObject',\n\t\t\t\t\t's3:PutObject',\n\t\t\t\t\t's3:DeleteObject',\n\t\t\t\t\t's3:ListBucket',\n\t\t\t\t\t's3:GetBucketLocation',\n\t\t\t\t],\n\t\t\t\tResource: [\n\t\t\t\t\t`arn:aws:s3:::${bucketName}`,\n\t\t\t\t\t`arn:aws:s3:::${bucketName}/*`,\n\t\t\t\t],\n\t\t\t},\n\t\t],\n\t};\n\n\tlogger.log('   Updating IAM policy');\n\tawait aws.iam.send(\n\t\tnew PutUserPolicyCommand({\n\t\t\tUserName: iamUserName,\n\t\t\tPolicyName: 'DokployBackupAccess',\n\t\t\tPolicyDocument: JSON.stringify(policyDocument),\n\t\t}),\n\t);\n\n\t// 4. Create access key (or reuse existing if state has it and destination needs recreation)\n\tlet accessKeyId: string;\n\tlet secretAccessKey: string;\n\n\tif (existingState?.iamAccessKeyId && existingState?.iamSecretAccessKey) {\n\t\t// Reuse existing credentials\n\t\tlogger.log('   Using existing IAM access key');\n\t\taccessKeyId = existingState.iamAccessKeyId;\n\t\tsecretAccessKey = existingState.iamSecretAccessKey;\n\t} else {\n\t\t// Create new access key\n\t\tlogger.log('   Creating IAM access key');\n\t\tconst accessKeyResult = await aws.iam.send(\n\t\t\tnew CreateAccessKeyCommand({ UserName: iamUserName }),\n\t\t);\n\n\t\tif (!accessKeyResult.AccessKey) {\n\t\t\tthrow new Error('Failed to create IAM access key');\n\t\t}\n\n\t\taccessKeyId = accessKeyResult.AccessKey.AccessKeyId!;\n\t\tsecretAccessKey = accessKeyResult.AccessKey.SecretAccessKey!;\n\t}\n\n\t// 5. Create Dokploy destination\n\tconst destinationName = `${sanitizedProject}-${stage}-s3`;\n\tlogger.log(`   Creating Dokploy destination: ${destinationName}`);\n\n\tconst { destination, created } = await api.findOrCreateDestination(\n\t\tdestinationName,\n\t\t{\n\t\t\taccessKey: accessKeyId,\n\t\t\tsecretAccessKey: secretAccessKey,\n\t\t\tbucket: bucketName,\n\t\t\tregion: config.region,\n\t\t},\n\t);\n\n\tif (created) {\n\t\tlogger.log('   ✓ Dokploy destination created');\n\t} else {\n\t\tlogger.log('   ✓ Using existing Dokploy destination');\n\t}\n\n\t// 6. Test connection\n\ttry {\n\t\tawait api.testDestinationConnection(destination.destinationId);\n\t\tlogger.log('   ✓ Destination connection verified');\n\t} catch (error) {\n\t\tlogger.log(\n\t\t\t`   ⚠ Warning: Could not verify destination connection: ${error}`,\n\t\t);\n\t}\n\n\treturn {\n\t\tbucketName,\n\t\tbucketArn: `arn:aws:s3:::${bucketName}`,\n\t\tiamUserName,\n\t\tiamAccessKeyId: accessKeyId,\n\t\tiamSecretAccessKey: secretAccessKey,\n\t\tdestinationId: destination.destinationId,\n\t\tregion: config.region,\n\t\tcreatedAt: existingState?.createdAt ?? new Date().toISOString(),\n\t};\n}\n"],"mappings":";;;;;;;;;;;;AAiDA,SAAS,eAAuB;CAC/B,OAAO,KAAK,OAAO,CAAC,CAAC,SAAS,EAAE,CAAC,CAAC,UAAU,GAAG,CAAC;AACjD;;;;AAKA,SAAS,aAAa,MAAsB;CAC3C,OAAO,KAAK,YAAY,CAAC,CAAC,QAAQ,eAAe,GAAG;AACrD;;;;AAKA,eAAe,iBACd,QACA,SACA,UAC4C;CAC5C,MAAM,SAA2C,EAAE,OAAO;CAE1D,IAAI,SAAS;EACZ,MAAM,EAAE,YAAY,MAAM,OAAO;EACjC,OAAO,cAAc,QAAQ,EAAE,QAAQ,CAAC;CACzC;CAGA,IAAI,UAAU;EACb,OAAO,WAAW;EAClB,OAA2B,iBAAiB;EAE5C,OAAO,cAAc;GACpB,aAAa;GACb,iBAAiB;EAClB;CACD;CAEA,OAAO;EACN,IAAI,IAAIA,mBAAAA,SAAS,MAAM;EACvB,KAAK,IAAIC,oBAAAA,UAAU,MAAM;CAC1B;AACD;;;;AAKA,eAAe,aACd,IACA,YACmB;CACnB,IAAI;EACH,MAAM,GAAG,KAAK,IAAIC,mBAAAA,kBAAkB,EAAE,QAAQ,WAAW,CAAC,CAAC;EAC3D,OAAO;CACR,SAAS,OAAO;EACf,IAAK,MAA4B,SAAS,YACzC,OAAO;EAGR,IACE,MAAsD,WACpD,mBAAmB,KAEtB,OAAO;EAER,MAAM;CACP;AACD;;;;AAKA,eAAe,WAAW,KAAgB,UAAoC;CAC7E,IAAI;EACH,MAAM,IAAI,KAAK,IAAIC,oBAAAA,eAAe,EAAE,UAAU,SAAS,CAAC,CAAC;EACzD,OAAO;CACR,SAAS,OAAO;EACf,MAAM,YAAa,MAA4B;EAE/C,IAAI,cAAc,kBAAkB,cAAc,yBACjD,OAAO;EAER,MAAM;CACP;AACD;;;;;;;AAQA,eAAsB,2BACrB,SACuB;CACvB,MAAM,EACL,KACA,aACA,OACA,QACA,eACA,QACA,gBACG;CAGJ,IAAI,eAAe,eAClB,IAAI;EACH,MAAM,IAAI,eAAe,cAAc,aAAa;EACpD,OAAO,IAAI,sCAAsC;EACjD,OAAO;CACR,QAAQ;EACP,OAAO,IAAI,kDAAkD;CAC9D;CAID,MAAM,MAAM,MAAM,iBACjB,OAAO,QACP,OAAO,SACP,WACD;CACA,MAAM,mBAAmB,aAAa,WAAW;CAGjD,MAAM,aACL,eAAe,cACf,GAAG,iBAAiB,GAAG,MAAM,WAAW,aAAa;CAGtD,IAAI,CAAC,MAD6B,aAAa,IAAI,IAAI,UAAU,GACvC;EACzB,OAAO,IAAI,0BAA0B,YAAY;EAGjD,MAAM,qBAKF,EACH,QAAQ,WACT;EACA,IAAI,OAAO,WAAW,aACrB,mBAAmB,4BAA4B,EAC9C,oBAAoB,OAAO,OAC5B;EAGD,MAAM,IAAI,GAAG,KAAK,IAAIC,mBAAAA,oBAAoB,kBAAkB,CAAC;EAG7D,MAAM,IAAI,GAAG,KACZ,IAAIC,mBAAAA,2BAA2B;GAC9B,QAAQ;GACR,yBAAyB,EAAE,QAAQ,UAAU;EAC9C,CAAC,CACF;CACD,OACC,OAAO,IAAI,gCAAgC,YAAY;CAIxD,MAAM,cACL,eAAe,eAAe,kBAAkB,iBAAiB,GAAG;CAGrE,IAAI,CAAC,MAD8B,WAAW,IAAI,KAAK,WAAW,GACvC;EAC1B,OAAO,IAAI,yBAAyB,aAAa;EACjD,MAAM,IAAI,IAAI,KAAK,IAAIC,oBAAAA,kBAAkB,EAAE,UAAU,YAAY,CAAC,CAAC;CACpE,OACC,OAAO,IAAI,+BAA+B,aAAa;CAIxD,MAAM,iBAAiB;EACtB,SAAS;EACT,WAAW,CACV;GACC,QAAQ;GACR,QAAQ;IACP;IACA;IACA;IACA;IACA;GACD;GACA,UAAU,CACT,gBAAgB,cAChB,gBAAgB,WAAW,GAC5B;EACD,CACD;CACD;CAEA,OAAO,IAAI,wBAAwB;CACnC,MAAM,IAAI,IAAI,KACb,IAAIC,oBAAAA,qBAAqB;EACxB,UAAU;EACV,YAAY;EACZ,gBAAgB,KAAK,UAAU,cAAc;CAC9C,CAAC,CACF;CAGA,IAAI;CACJ,IAAI;CAEJ,IAAI,eAAe,kBAAkB,eAAe,oBAAoB;EAEvE,OAAO,IAAI,kCAAkC;EAC7C,cAAc,cAAc;EAC5B,kBAAkB,cAAc;CACjC,OAAO;EAEN,OAAO,IAAI,4BAA4B;EACvC,MAAM,kBAAkB,MAAM,IAAI,IAAI,KACrC,IAAIC,oBAAAA,uBAAuB,EAAE,UAAU,YAAY,CAAC,CACrD;EAEA,IAAI,CAAC,gBAAgB,WACpB,MAAM,IAAI,MAAM,iCAAiC;EAGlD,cAAc,gBAAgB,UAAU;EACxC,kBAAkB,gBAAgB,UAAU;CAC7C;CAGA,MAAM,kBAAkB,GAAG,iBAAiB,GAAG,MAAM;CACrD,OAAO,IAAI,oCAAoC,iBAAiB;CAEhE,MAAM,EAAE,aAAa,YAAY,MAAM,IAAI,wBAC1C,iBACA;EACC,WAAW;EACM;EACjB,QAAQ;EACR,QAAQ,OAAO;CAChB,CACD;CAEA,IAAI,SACH,OAAO,IAAI,kCAAkC;MAE7C,OAAO,IAAI,yCAAyC;CAIrD,IAAI;EACH,MAAM,IAAI,0BAA0B,YAAY,aAAa;EAC7D,OAAO,IAAI,sCAAsC;CAClD,SAAS,OAAO;EACf,OAAO,IACN,0DAA0D,OAC3D;CACD;CAEA,OAAO;EACN;EACA,WAAW,gBAAgB;EAC3B;EACA,gBAAgB;EAChB,oBAAoB;EACpB,eAAe,YAAY;EAC3B,QAAQ,OAAO;EACf,WAAW,eAAe,8BAAa,IAAI,KAAK,EAAA,CAAE,YAAY;CAC/D;AACD"}