@geekmidas/cli 10.0.0-alpha.2 → 10.0.0-alpha.21

package/dist/{Route53Provider-RdpUDJQk.mjs → Route53Provider-Cvj40A8I.mjs}

@@ -1,8 +1,12 @@
 import { fromIni } from "@aws-sdk/credential-providers";
 import { ChangeResourceRecordSetsCommand, ListHostedZonesByNameCommand, ListResourceRecordSetsCommand, Route53Client } from "@aws-sdk/client-route-53";
-
 //#region src/deploy/dns/Route53Provider.ts
 /**
+* Route53 DNS Provider
+*
+* Implements DnsProvider interface using AWS Route53.
+*/
+/**
 * Route53 DNS provider implementation.
 *
 * Uses AWS default credential chain for authentication.
@@ -34,8 +38,7 @@ var Route53Provider = class {
 			DNSName: domain,
 			MaxItems: 1
 		});
-		const response = await this.client.send(command);
-		const zones = response.HostedZones ?? [];
+		const zones = (await this.client.send(command)).HostedZones ?? [];
 		const normalizedDomain = domain.endsWith(".") ? domain : `${domain}.`;
 		const zone = zones.find((z) => z.Name === normalizedDomain);
 		if (!zone?.Id) throw new Error(`No hosted zone found for domain: ${domain}. Create one in Route53 or provide hostedZoneId in config.`);
@@ -48,9 +51,8 @@ var Route53Provider = class {
 	* Excludes NS and SOA which are auto-managed by Route53 for the zone.
 	*/
 	toRecordType(type) {
-		const managedTypes = ["NS", "SOA"];
-		if (managedTypes.includes(type)) return null;
-		const validTypes = [
+		if (["NS", "SOA"].includes(type)) return null;
+		return [
 			"A",
 			"AAAA",
 			"CNAME",
@@ -58,8 +60,7 @@ var Route53Provider = class {
 			"TXT",
 			"SRV",
 			"CAA"
-		];
-		return validTypes.includes(type) ? type : null;
+		].includes(type) ? type : null;
 	}
 	/**
 	* Extract subdomain from full record name relative to domain.
@@ -68,8 +69,7 @@ var Route53Provider = class {
 		const normalizedDomain = domain.endsWith(".") ? domain : `${domain}.`;
 		const normalizedName = recordName.endsWith(".") ? recordName : `${recordName}.`;
 		if (normalizedName === normalizedDomain) return "@";
-		const subdomain = normalizedName.replace(`.${normalizedDomain}`, "");
-		return subdomain.replace(/\.$/, "");
+		return normalizedName.replace(`.${normalizedDomain}`, "").replace(/\.$/, "");
 	}
 	async getRecords(domain) {
 		const zoneId = await this.getHostedZoneId(domain);
@@ -203,7 +203,7 @@ var Route53Provider = class {
 		return results;
 	}
 };
-
 //#endregion
 export { Route53Provider };
-//# sourceMappingURL=Route53Provider-RdpUDJQk.mjs.map
+
+//# sourceMappingURL=Route53Provider-Cvj40A8I.mjs.map

package/dist/Route53Provider-Cvj40A8I.mjs.map

@@ -0,0 +1 @@
+{"version":3,"file":"Route53Provider-Cvj40A8I.mjs","names":[],"sources":["../src/deploy/dns/Route53Provider.ts"],"sourcesContent":["/**\n * Route53 DNS Provider\n *\n * Implements DnsProvider interface using AWS Route53.\n */\n\nimport {\n\tChangeResourceRecordSetsCommand,\n\tListHostedZonesByNameCommand,\n\tListResourceRecordSetsCommand,\n\tRoute53Client,\n\ttype RRType,\n} from '@aws-sdk/client-route-53';\nimport { fromIni } from '@aws-sdk/credential-providers';\nimport type {\n\tDeleteDnsRecord,\n\tDeleteResult,\n\tDnsProvider,\n\tDnsRecord,\n\tDnsRecordType,\n\tUpsertDnsRecord,\n\tUpsertResult,\n} from './DnsProvider';\n\nexport interface Route53ProviderOptions {\n\t/** AWS region (optional - uses AWS_REGION env var if not provided) */\n\tregion?: string;\n\t/** AWS profile name (optional - uses default credential chain if not provided) */\n\tprofile?: string;\n\t/** Hosted zone ID (optional - auto-detected from domain if not provided) */\n\thostedZoneId?: string;\n\t/** Custom endpoint for testing with localstack */\n\tendpoint?: string;\n}\n\n/**\n * Route53 DNS provider implementation.\n *\n * Uses AWS default credential chain for authentication.\n * Region can be specified or will use AWS_REGION/AWS_DEFAULT_REGION env vars.\n * Profile can be specified to use a named profile from ~/.aws/credentials.\n */\nexport class Route53Provider implements DnsProvider {\n\treadonly name = 'route53';\n\tprivate client: Route53Client;\n\tprivate hostedZoneId?: string;\n\tprivate hostedZoneCache: Map<string, string> = new Map();\n\n\tconstructor(options: Route53ProviderOptions = {}) {\n\t\t// Route53 is a global service, default to us-east-1 if no region specified\n\t\tconst region = options.region ?? process.env.AWS_REGION ?? 'us-east-1';\n\n\t\tthis.client = new Route53Client({\n\t\t\tregion,\n\t\t\t...(options.endpoint && { endpoint: options.endpoint }),\n\t\t\t...(options.profile && {\n\t\t\t\tcredentials: fromIni({ profile: options.profile }),\n\t\t\t}),\n\t\t});\n\t\tthis.hostedZoneId = options.hostedZoneId;\n\t}\n\n\t/**\n\t * Get the hosted zone ID for a domain.\n\t * Uses cache to avoid repeated API calls.\n\t */\n\tprivate async getHostedZoneId(domain: string): Promise<string> {\n\t\t// Use configured zone ID if provided\n\t\tif (this.hostedZoneId) {\n\t\t\treturn this.hostedZoneId;\n\t\t}\n\n\t\t// Check cache\n\t\tif (this.hostedZoneCache.has(domain)) {\n\t\t\treturn this.hostedZoneCache.get(domain)!;\n\t\t}\n\n\t\t// Auto-detect from domain\n\t\tconst command = new ListHostedZonesByNameCommand({\n\t\t\tDNSName: domain,\n\t\t\tMaxItems: 1,\n\t\t});\n\n\t\tconst response = await this.client.send(command);\n\t\tconst zones = response.HostedZones ?? [];\n\n\t\t// Find exact match (domain with trailing dot)\n\t\tconst normalizedDomain = domain.endsWith('.') ? domain : `${domain}.`;\n\t\tconst zone = zones.find((z) => z.Name === normalizedDomain);\n\n\t\tif (!zone?.Id) {\n\t\t\tthrow new Error(\n\t\t\t\t`No hosted zone found for domain: ${domain}. Create one in Route53 or provide hostedZoneId in config.`,\n\t\t\t);\n\t\t}\n\n\t\t// Zone ID comes as \"/hostedzone/Z1234567890\" - extract just the ID\n\t\tconst zoneId = zone.Id.replace('/hostedzone/', '');\n\t\tthis.hostedZoneCache.set(domain, zoneId);\n\t\treturn zoneId;\n\t}\n\n\t/**\n\t * Convert Route53 record type to our DnsRecordType.\n\t * Excludes NS and SOA which are auto-managed by Route53 for the zone.\n\t */\n\tprivate toRecordType(type: string): DnsRecordType | null {\n\t\t// Exclude NS and SOA which are auto-managed zone records\n\t\tconst managedTypes = ['NS', 'SOA'];\n\t\tif (managedTypes.includes(type)) {\n\t\t\treturn null;\n\t\t}\n\n\t\tconst validTypes: DnsRecordType[] = [\n\t\t\t'A',\n\t\t\t'AAAA',\n\t\t\t'CNAME',\n\t\t\t'MX',\n\t\t\t'TXT',\n\t\t\t'SRV',\n\t\t\t'CAA',\n\t\t];\n\t\treturn validTypes.includes(type as DnsRecordType)\n\t\t\t? (type as DnsRecordType)\n\t\t\t: null;\n\t}\n\n\t/**\n\t * Extract subdomain from full record name relative to domain.\n\t */\n\tprivate extractSubdomain(recordName: string, domain: string): string {\n\t\tconst normalizedDomain = domain.endsWith('.') ? domain : `${domain}.`;\n\t\tconst normalizedName = recordName.endsWith('.')\n\t\t\t? recordName\n\t\t\t: `${recordName}.`;\n\n\t\tif (normalizedName === normalizedDomain) {\n\t\t\treturn '@';\n\t\t}\n\n\t\t// Remove the domain suffix\n\t\tconst subdomain = normalizedName.replace(`.${normalizedDomain}`, '');\n\t\treturn subdomain.replace(/\\.$/, ''); // Remove trailing dot if any\n\t}\n\n\tasync getRecords(domain: string): Promise<DnsRecord[]> {\n\t\tconst zoneId = await this.getHostedZoneId(domain);\n\t\tconst records: DnsRecord[] = [];\n\n\t\tlet nextRecordName: string | undefined;\n\t\tlet nextRecordType: RRType | undefined;\n\n\t\t// Paginate through all records\n\t\tdo {\n\t\t\tconst command = new ListResourceRecordSetsCommand({\n\t\t\t\tHostedZoneId: zoneId,\n\t\t\t\tStartRecordName: nextRecordName,\n\t\t\t\tStartRecordType: nextRecordType,\n\t\t\t\tMaxItems: 100,\n\t\t\t});\n\n\t\t\tconst response = await this.client.send(command);\n\n\t\t\tfor (const recordSet of response.ResourceRecordSets ?? []) {\n\t\t\t\tconst type = this.toRecordType(recordSet.Type ?? '');\n\t\t\t\tif (!type || !recordSet.Name) continue;\n\n\t\t\t\tconst values = (recordSet.ResourceRecords ?? [])\n\t\t\t\t\t.map((r) => r.Value)\n\t\t\t\t\t.filter((v): v is string => !!v);\n\n\t\t\t\trecords.push({\n\t\t\t\t\tname: this.extractSubdomain(recordSet.Name, domain),\n\t\t\t\t\ttype,\n\t\t\t\t\tttl: recordSet.TTL ?? 300,\n\t\t\t\t\tvalues,\n\t\t\t\t});\n\t\t\t}\n\n\t\t\tif (response.IsTruncated) {\n\t\t\t\tnextRecordName = response.NextRecordName;\n\t\t\t\tnextRecordType = response.NextRecordType;\n\t\t\t} else {\n\t\t\t\tnextRecordName = undefined;\n\t\t\t}\n\t\t} while (nextRecordName);\n\n\t\treturn records;\n\t}\n\n\tasync upsertRecords(\n\t\tdomain: string,\n\t\trecords: UpsertDnsRecord[],\n\t): Promise<UpsertResult[]> {\n\t\tconst zoneId = await this.getHostedZoneId(domain);\n\t\tconst results: UpsertResult[] = [];\n\n\t\t// Get existing records to determine if creating or updating\n\t\tconst existingRecords = await this.getRecords(domain);\n\n\t\t// Process records in batches (Route53 allows max 1000 changes per request)\n\t\tconst batchSize = 100;\n\t\tfor (let i = 0; i < records.length; i += batchSize) {\n\t\t\tconst batch = records.slice(i, i + batchSize);\n\t\t\tconst changes = [];\n\n\t\t\tfor (const record of batch) {\n\t\t\t\tconst existing = existingRecords.find(\n\t\t\t\t\t(r) => r.name === record.name && r.type === record.type,\n\t\t\t\t);\n\n\t\t\t\tconst existingValue = existing?.values?.[0];\n\n\t\t\t\tif (existing && existingValue === record.value) {\n\t\t\t\t\t// Record exists with same value - unchanged\n\t\t\t\t\tresults.push({\n\t\t\t\t\t\trecord,\n\t\t\t\t\t\tcreated: false,\n\t\t\t\t\t\tunchanged: true,\n\t\t\t\t\t});\n\t\t\t\t\tcontinue;\n\t\t\t\t}\n\n\t\t\t\t// Build full record name\n\t\t\t\tconst recordName =\n\t\t\t\t\trecord.name === '@' ? domain : `${record.name}.${domain}`;\n\n\t\t\t\tchanges.push({\n\t\t\t\t\tAction: 'UPSERT' as const,\n\t\t\t\t\tResourceRecordSet: {\n\t\t\t\t\t\tName: recordName,\n\t\t\t\t\t\tType: record.type,\n\t\t\t\t\t\tTTL: record.ttl,\n\t\t\t\t\t\tResourceRecords: [{ Value: record.value }],\n\t\t\t\t\t},\n\t\t\t\t});\n\n\t\t\t\tresults.push({\n\t\t\t\t\trecord,\n\t\t\t\t\tcreated: !existing,\n\t\t\t\t\tunchanged: false,\n\t\t\t\t});\n\t\t\t}\n\n\t\t\t// Execute batch if there are changes\n\t\t\tif (changes.length > 0) {\n\t\t\t\tconst command = new ChangeResourceRecordSetsCommand({\n\t\t\t\t\tHostedZoneId: zoneId,\n\t\t\t\t\tChangeBatch: {\n\t\t\t\t\t\tComment: 'Upsert by gkm deploy',\n\t\t\t\t\t\tChanges: changes,\n\t\t\t\t\t},\n\t\t\t\t});\n\n\t\t\t\tawait this.client.send(command);\n\t\t\t}\n\t\t}\n\n\t\treturn results;\n\t}\n\n\tasync deleteRecords(\n\t\tdomain: string,\n\t\trecords: DeleteDnsRecord[],\n\t): Promise<DeleteResult[]> {\n\t\tconst zoneId = await this.getHostedZoneId(domain);\n\t\tconst results: DeleteResult[] = [];\n\n\t\t// Get existing records to find the ones to delete\n\t\tconst existingRecords = await this.getRecords(domain);\n\n\t\t// Process records in batches (Route53 allows max 1000 changes per request)\n\t\tconst batchSize = 100;\n\t\tfor (let i = 0; i < records.length; i += batchSize) {\n\t\t\tconst batch = records.slice(i, i + batchSize);\n\t\t\tconst changes = [];\n\n\t\t\tfor (const record of batch) {\n\t\t\t\tconst existing = existingRecords.find(\n\t\t\t\t\t(r) => r.name === record.name && r.type === record.type,\n\t\t\t\t);\n\n\t\t\t\tif (!existing) {\n\t\t\t\t\t// Record doesn't exist - already deleted\n\t\t\t\t\tresults.push({\n\t\t\t\t\t\trecord,\n\t\t\t\t\t\tdeleted: false,\n\t\t\t\t\t\tnotFound: true,\n\t\t\t\t\t});\n\t\t\t\t\tcontinue;\n\t\t\t\t}\n\n\t\t\t\t// Build full record name\n\t\t\t\tconst recordName =\n\t\t\t\t\trecord.name === '@' ? domain : `${record.name}.${domain}`;\n\n\t\t\t\tchanges.push({\n\t\t\t\t\tAction: 'DELETE' as const,\n\t\t\t\t\tResourceRecordSet: {\n\t\t\t\t\t\tName: recordName,\n\t\t\t\t\t\tType: record.type,\n\t\t\t\t\t\tTTL: existing.ttl,\n\t\t\t\t\t\tResourceRecords: existing.values.map((v) => ({ Value: v })),\n\t\t\t\t\t},\n\t\t\t\t});\n\n\t\t\t\tresults.push({\n\t\t\t\t\trecord,\n\t\t\t\t\tdeleted: true,\n\t\t\t\t\tnotFound: false,\n\t\t\t\t});\n\t\t\t}\n\n\t\t\t// Execute batch if there are changes\n\t\t\tif (changes.length > 0) {\n\t\t\t\ttry {\n\t\t\t\t\tconst command = new ChangeResourceRecordSetsCommand({\n\t\t\t\t\t\tHostedZoneId: zoneId,\n\t\t\t\t\t\tChangeBatch: {\n\t\t\t\t\t\t\tComment: 'Delete by gkm undeploy',\n\t\t\t\t\t\t\tChanges: changes,\n\t\t\t\t\t\t},\n\t\t\t\t\t});\n\n\t\t\t\t\tawait this.client.send(command);\n\t\t\t\t} catch (error) {\n\t\t\t\t\t// Mark all records in this batch as failed\n\t\t\t\t\tfor (const result of results.slice(-changes.length)) {\n\t\t\t\t\t\tif (result.deleted) {\n\t\t\t\t\t\t\tresult.deleted = false;\n\t\t\t\t\t\t\tresult.error = String(error);\n\t\t\t\t\t\t}\n\t\t\t\t\t}\n\t\t\t\t}\n\t\t\t}\n\t\t}\n\n\t\treturn results;\n\t}\n}\n"],"mappings":";;;;;;;;;;;;;;;AA0CA,IAAa,kBAAb,MAAoD;CACnD,OAAgB;CAChB;CACA;CACA,kCAA+C,IAAI,IAAI;CAEvD,YAAY,UAAkC,CAAC,GAAG;EAEjD,MAAM,SAAS,QAAQ,UAAU,QAAQ,IAAI,cAAc;EAE3D,KAAK,SAAS,IAAI,cAAc;GAC/B;GACA,GAAI,QAAQ,YAAY,EAAE,UAAU,QAAQ,SAAS;GACrD,GAAI,QAAQ,WAAW,EACtB,aAAa,QAAQ,EAAE,SAAS,QAAQ,QAAQ,CAAC,EAClD;EACD,CAAC;EACD,KAAK,eAAe,QAAQ;CAC7B;;;;;CAMA,MAAc,gBAAgB,QAAiC;EAE9D,IAAI,KAAK,cACR,OAAO,KAAK;EAIb,IAAI,KAAK,gBAAgB,IAAI,MAAM,GAClC,OAAO,KAAK,gBAAgB,IAAI,MAAM;EAIvC,MAAM,UAAU,IAAI,6BAA6B;GAChD,SAAS;GACT,UAAU;EACX,CAAC;EAGD,MAAM,SAAQ,MADS,KAAK,OAAO,KAAK,OAAO,EAAA,CACxB,eAAe,CAAC;EAGvC,MAAM,mBAAmB,OAAO,SAAS,GAAG,IAAI,SAAS,GAAG,OAAO;EACnE,MAAM,OAAO,MAAM,MAAM,MAAM,EAAE,SAAS,gBAAgB;EAE1D,IAAI,CAAC,MAAM,IACV,MAAM,IAAI,MACT,oCAAoC,OAAO,2DAC5C;EAID,MAAM,SAAS,KAAK,GAAG,QAAQ,gBAAgB,EAAE;EACjD,KAAK,gBAAgB,IAAI,QAAQ,MAAM;EACvC,OAAO;CACR;;;;;CAMA,aAAqB,MAAoC;EAGxD,IAAI,CADkB,MAAM,KACb,CAAC,CAAC,SAAS,IAAI,GAC7B,OAAO;EAYR,OAAO;GARN;GACA;GACA;GACA;GACA;GACA;GACA;EAEe,CAAC,CAAC,SAAS,IAAqB,IAC5C,OACD;CACJ;;;;CAKA,iBAAyB,YAAoB,QAAwB;EACpE,MAAM,mBAAmB,OAAO,SAAS,GAAG,IAAI,SAAS,GAAG,OAAO;EACnE,MAAM,iBAAiB,WAAW,SAAS,GAAG,IAC3C,aACA,GAAG,WAAW;EAEjB,IAAI,mBAAmB,kBACtB,OAAO;EAKR,OADkB,eAAe,QAAQ,IAAI,oBAAoB,EAClD,CAAC,CAAC,QAAQ,OAAO,EAAE;CACnC;CAEA,MAAM,WAAW,QAAsC;EACtD,MAAM,SAAS,MAAM,KAAK,gBAAgB,MAAM;EAChD,MAAM,UAAuB,CAAC;EAE9B,IAAI;EACJ,IAAI;EAGJ,GAAG;GACF,MAAM,UAAU,IAAI,8BAA8B;IACjD,cAAc;IACd,iBAAiB;IACjB,iBAAiB;IACjB,UAAU;GACX,CAAC;GAED,MAAM,WAAW,MAAM,KAAK,OAAO,KAAK,OAAO;GAE/C,KAAK,MAAM,aAAa,SAAS,sBAAsB,CAAC,GAAG;IAC1D,MAAM,OAAO,KAAK,aAAa,UAAU,QAAQ,EAAE;IACnD,IAAI,CAAC,QAAQ,CAAC,UAAU,MAAM;IAE9B,MAAM,UAAU,UAAU,mBAAmB,CAAC,EAAA,CAC5C,KAAK,MAAM,EAAE,KAAK,CAAC,CACnB,QAAQ,MAAmB,CAAC,CAAC,CAAC;IAEhC,QAAQ,KAAK;KACZ,MAAM,KAAK,iBAAiB,UAAU,MAAM,MAAM;KAClD;KACA,KAAK,UAAU,OAAO;KACtB;IACD,CAAC;GACF;GAEA,IAAI,SAAS,aAAa;IACzB,iBAAiB,SAAS;IAC1B,iBAAiB,SAAS;GAC3B,OACC,iBAAiB,KAAA;EAEnB,SAAS;EAET,OAAO;CACR;CAEA,MAAM,cACL,QACA,SAC0B;EAC1B,MAAM,SAAS,MAAM,KAAK,gBAAgB,MAAM;EAChD,MAAM,UAA0B,CAAC;EAGjC,MAAM,kBAAkB,MAAM,KAAK,WAAW,MAAM;EAGpD,MAAM,YAAY;EAClB,KAAK,IAAI,IAAI,GAAG,IAAI,QAAQ,QAAQ,KAAK,WAAW;GACnD,MAAM,QAAQ,QAAQ,MAAM,GAAG,IAAI,SAAS;GAC5C,MAAM,UAAU,CAAC;GAEjB,KAAK,MAAM,UAAU,OAAO;IAC3B,MAAM,WAAW,gBAAgB,MAC/B,MAAM,EAAE,SAAS,OAAO,QAAQ,EAAE,SAAS,OAAO,IACpD;IAEA,MAAM,gBAAgB,UAAU,SAAS;IAEzC,IAAI,YAAY,kBAAkB,OAAO,OAAO;KAE/C,QAAQ,KAAK;MACZ;MACA,SAAS;MACT,WAAW;KACZ,CAAC;KACD;IACD;IAGA,MAAM,aACL,OAAO,SAAS,MAAM,SAAS,GAAG,OAAO,KAAK,GAAG;IAElD,QAAQ,KAAK;KACZ,QAAQ;KACR,mBAAmB;MAClB,MAAM;MACN,MAAM,OAAO;MACb,KAAK,OAAO;MACZ,iBAAiB,CAAC,EAAE,OAAO,OAAO,MAAM,CAAC;KAC1C;IACD,CAAC;IAED,QAAQ,KAAK;KACZ;KACA,SAAS,CAAC;KACV,WAAW;IACZ,CAAC;GACF;GAGA,IAAI,QAAQ,SAAS,GAAG;IACvB,MAAM,UAAU,IAAI,gCAAgC;KACnD,cAAc;KACd,aAAa;MACZ,SAAS;MACT,SAAS;KACV;IACD,CAAC;IAED,MAAM,KAAK,OAAO,KAAK,OAAO;GAC/B;EACD;EAEA,OAAO;CACR;CAEA,MAAM,cACL,QACA,SAC0B;EAC1B,MAAM,SAAS,MAAM,KAAK,gBAAgB,MAAM;EAChD,MAAM,UAA0B,CAAC;EAGjC,MAAM,kBAAkB,MAAM,KAAK,WAAW,MAAM;EAGpD,MAAM,YAAY;EAClB,KAAK,IAAI,IAAI,GAAG,IAAI,QAAQ,QAAQ,KAAK,WAAW;GACnD,MAAM,QAAQ,QAAQ,MAAM,GAAG,IAAI,SAAS;GAC5C,MAAM,UAAU,CAAC;GAEjB,KAAK,MAAM,UAAU,OAAO;IAC3B,MAAM,WAAW,gBAAgB,MAC/B,MAAM,EAAE,SAAS,OAAO,QAAQ,EAAE,SAAS,OAAO,IACpD;IAEA,IAAI,CAAC,UAAU;KAEd,QAAQ,KAAK;MACZ;MACA,SAAS;MACT,UAAU;KACX,CAAC;KACD;IACD;IAGA,MAAM,aACL,OAAO,SAAS,MAAM,SAAS,GAAG,OAAO,KAAK,GAAG;IAElD,QAAQ,KAAK;KACZ,QAAQ;KACR,mBAAmB;MAClB,MAAM;MACN,MAAM,OAAO;MACb,KAAK,SAAS;MACd,iBAAiB,SAAS,OAAO,KAAK,OAAO,EAAE,OAAO,EAAE,EAAE;KAC3D;IACD,CAAC;IAED,QAAQ,KAAK;KACZ;KACA,SAAS;KACT,UAAU;IACX,CAAC;GACF;GAGA,IAAI,QAAQ,SAAS,GACpB,IAAI;IACH,MAAM,UAAU,IAAI,gCAAgC;KACnD,cAAc;KACd,aAAa;MACZ,SAAS;MACT,SAAS;KACV;IACD,CAAC;IAED,MAAM,KAAK,OAAO,KAAK,OAAO;GAC/B,SAAS,OAAO;IAEf,KAAK,MAAM,UAAU,QAAQ,MAAM,CAAC,QAAQ,MAAM,GACjD,IAAI,OAAO,SAAS;KACnB,OAAO,UAAU;KACjB,OAAO,QAAQ,OAAO,KAAK;IAC5B;GAEF;EAEF;EAEA,OAAO;CACR;AACD"}

package/dist/{Route53Provider-di2fMM5N.cjs → Route53Provider-DVILBsvV.cjs}

@@ -1,9 +1,12 @@
-const require_chunk = require('./chunk-CUT6urMc.cjs');
-const __aws_sdk_credential_providers = require_chunk.__toESM(require("@aws-sdk/credential-providers"));
-const __aws_sdk_client_route_53 = require_chunk.__toESM(require("@aws-sdk/client-route-53"));
-
+let _aws_sdk_credential_providers = require("@aws-sdk/credential-providers");
+let _aws_sdk_client_route_53 = require("@aws-sdk/client-route-53");
 //#region src/deploy/dns/Route53Provider.ts
 /**
+* Route53 DNS Provider
+*
+* Implements DnsProvider interface using AWS Route53.
+*/
+/**
 * Route53 DNS provider implementation.
 *
 * Uses AWS default credential chain for authentication.
@@ -17,10 +20,10 @@ var Route53Provider = class {
 	hostedZoneCache = /* @__PURE__ */ new Map();
 	constructor(options = {}) {
 		const region = options.region ?? process.env.AWS_REGION ?? "us-east-1";
-		this.client = new __aws_sdk_client_route_53.Route53Client({
+		this.client = new _aws_sdk_client_route_53.Route53Client({
 			region,
 			...options.endpoint && { endpoint: options.endpoint },
-			...options.profile && { credentials: (0, __aws_sdk_credential_providers.fromIni)({ profile: options.profile }) }
+			...options.profile && { credentials: (0, _aws_sdk_credential_providers.fromIni)({ profile: options.profile }) }
 		});
 		this.hostedZoneId = options.hostedZoneId;
 	}
@@ -31,12 +34,11 @@ var Route53Provider = class {
 	async getHostedZoneId(domain) {
 		if (this.hostedZoneId) return this.hostedZoneId;
 		if (this.hostedZoneCache.has(domain)) return this.hostedZoneCache.get(domain);
-		const command = new __aws_sdk_client_route_53.ListHostedZonesByNameCommand({
+		const command = new _aws_sdk_client_route_53.ListHostedZonesByNameCommand({
 			DNSName: domain,
 			MaxItems: 1
 		});
-		const response = await this.client.send(command);
-		const zones = response.HostedZones ?? [];
+		const zones = (await this.client.send(command)).HostedZones ?? [];
 		const normalizedDomain = domain.endsWith(".") ? domain : `${domain}.`;
 		const zone = zones.find((z) => z.Name === normalizedDomain);
 		if (!zone?.Id) throw new Error(`No hosted zone found for domain: ${domain}. Create one in Route53 or provide hostedZoneId in config.`);
@@ -49,9 +51,8 @@ var Route53Provider = class {
 	* Excludes NS and SOA which are auto-managed by Route53 for the zone.
 	*/
 	toRecordType(type) {
-		const managedTypes = ["NS", "SOA"];
-		if (managedTypes.includes(type)) return null;
-		const validTypes = [
+		if (["NS", "SOA"].includes(type)) return null;
+		return [
 			"A",
 			"AAAA",
 			"CNAME",
@@ -59,8 +60,7 @@ var Route53Provider = class {
 			"TXT",
 			"SRV",
 			"CAA"
-		];
-		return validTypes.includes(type) ? type : null;
+		].includes(type) ? type : null;
 	}
 	/**
 	* Extract subdomain from full record name relative to domain.
@@ -69,8 +69,7 @@ var Route53Provider = class {
 		const normalizedDomain = domain.endsWith(".") ? domain : `${domain}.`;
 		const normalizedName = recordName.endsWith(".") ? recordName : `${recordName}.`;
 		if (normalizedName === normalizedDomain) return "@";
-		const subdomain = normalizedName.replace(`.${normalizedDomain}`, "");
-		return subdomain.replace(/\.$/, "");
+		return normalizedName.replace(`.${normalizedDomain}`, "").replace(/\.$/, "");
 	}
 	async getRecords(domain) {
 		const zoneId = await this.getHostedZoneId(domain);
@@ -78,7 +77,7 @@ var Route53Provider = class {
 		let nextRecordName;
 		let nextRecordType;
 		do {
-			const command = new __aws_sdk_client_route_53.ListResourceRecordSetsCommand({
+			const command = new _aws_sdk_client_route_53.ListResourceRecordSetsCommand({
 				HostedZoneId: zoneId,
 				StartRecordName: nextRecordName,
 				StartRecordType: nextRecordType,
@@ -139,7 +138,7 @@ var Route53Provider = class {
 				});
 			}
 			if (changes.length > 0) {
-				const command = new __aws_sdk_client_route_53.ChangeResourceRecordSetsCommand({
+				const command = new _aws_sdk_client_route_53.ChangeResourceRecordSetsCommand({
 					HostedZoneId: zoneId,
 					ChangeBatch: {
 						Comment: "Upsert by gkm deploy",
@@ -186,7 +185,7 @@ var Route53Provider = class {
 				});
 			}
 			if (changes.length > 0) try {
-				const command = new __aws_sdk_client_route_53.ChangeResourceRecordSetsCommand({
+				const command = new _aws_sdk_client_route_53.ChangeResourceRecordSetsCommand({
 					HostedZoneId: zoneId,
 					ChangeBatch: {
 						Comment: "Delete by gkm undeploy",
@@ -204,7 +203,7 @@ var Route53Provider = class {
 		return results;
 	}
 };
-
 //#endregion
 exports.Route53Provider = Route53Provider;
-//# sourceMappingURL=Route53Provider-di2fMM5N.cjs.map
+
+//# sourceMappingURL=Route53Provider-DVILBsvV.cjs.map

package/dist/Route53Provider-DVILBsvV.cjs.map

@@ -0,0 +1 @@
+{"version":3,"file":"Route53Provider-DVILBsvV.cjs","names":["Route53Client","fromIni","ListHostedZonesByNameCommand","ListResourceRecordSetsCommand","ChangeResourceRecordSetsCommand"],"sources":["../src/deploy/dns/Route53Provider.ts"],"sourcesContent":["/**\n * Route53 DNS Provider\n *\n * Implements DnsProvider interface using AWS Route53.\n */\n\nimport {\n\tChangeResourceRecordSetsCommand,\n\tListHostedZonesByNameCommand,\n\tListResourceRecordSetsCommand,\n\tRoute53Client,\n\ttype RRType,\n} from '@aws-sdk/client-route-53';\nimport { fromIni } from '@aws-sdk/credential-providers';\nimport type {\n\tDeleteDnsRecord,\n\tDeleteResult,\n\tDnsProvider,\n\tDnsRecord,\n\tDnsRecordType,\n\tUpsertDnsRecord,\n\tUpsertResult,\n} from './DnsProvider';\n\nexport interface Route53ProviderOptions {\n\t/** AWS region (optional - uses AWS_REGION env var if not provided) */\n\tregion?: string;\n\t/** AWS profile name (optional - uses default credential chain if not provided) */\n\tprofile?: string;\n\t/** Hosted zone ID (optional - auto-detected from domain if not provided) */\n\thostedZoneId?: string;\n\t/** Custom endpoint for testing with localstack */\n\tendpoint?: string;\n}\n\n/**\n * Route53 DNS provider implementation.\n *\n * Uses AWS default credential chain for authentication.\n * Region can be specified or will use AWS_REGION/AWS_DEFAULT_REGION env vars.\n * Profile can be specified to use a named profile from ~/.aws/credentials.\n */\nexport class Route53Provider implements DnsProvider {\n\treadonly name = 'route53';\n\tprivate client: Route53Client;\n\tprivate hostedZoneId?: string;\n\tprivate hostedZoneCache: Map<string, string> = new Map();\n\n\tconstructor(options: Route53ProviderOptions = {}) {\n\t\t// Route53 is a global service, default to us-east-1 if no region specified\n\t\tconst region = options.region ?? process.env.AWS_REGION ?? 'us-east-1';\n\n\t\tthis.client = new Route53Client({\n\t\t\tregion,\n\t\t\t...(options.endpoint && { endpoint: options.endpoint }),\n\t\t\t...(options.profile && {\n\t\t\t\tcredentials: fromIni({ profile: options.profile }),\n\t\t\t}),\n\t\t});\n\t\tthis.hostedZoneId = options.hostedZoneId;\n\t}\n\n\t/**\n\t * Get the hosted zone ID for a domain.\n\t * Uses cache to avoid repeated API calls.\n\t */\n\tprivate async getHostedZoneId(domain: string): Promise<string> {\n\t\t// Use configured zone ID if provided\n\t\tif (this.hostedZoneId) {\n\t\t\treturn this.hostedZoneId;\n\t\t}\n\n\t\t// Check cache\n\t\tif (this.hostedZoneCache.has(domain)) {\n\t\t\treturn this.hostedZoneCache.get(domain)!;\n\t\t}\n\n\t\t// Auto-detect from domain\n\t\tconst command = new ListHostedZonesByNameCommand({\n\t\t\tDNSName: domain,\n\t\t\tMaxItems: 1,\n\t\t});\n\n\t\tconst response = await this.client.send(command);\n\t\tconst zones = response.HostedZones ?? [];\n\n\t\t// Find exact match (domain with trailing dot)\n\t\tconst normalizedDomain = domain.endsWith('.') ? domain : `${domain}.`;\n\t\tconst zone = zones.find((z) => z.Name === normalizedDomain);\n\n\t\tif (!zone?.Id) {\n\t\t\tthrow new Error(\n\t\t\t\t`No hosted zone found for domain: ${domain}. Create one in Route53 or provide hostedZoneId in config.`,\n\t\t\t);\n\t\t}\n\n\t\t// Zone ID comes as \"/hostedzone/Z1234567890\" - extract just the ID\n\t\tconst zoneId = zone.Id.replace('/hostedzone/', '');\n\t\tthis.hostedZoneCache.set(domain, zoneId);\n\t\treturn zoneId;\n\t}\n\n\t/**\n\t * Convert Route53 record type to our DnsRecordType.\n\t * Excludes NS and SOA which are auto-managed by Route53 for the zone.\n\t */\n\tprivate toRecordType(type: string): DnsRecordType | null {\n\t\t// Exclude NS and SOA which are auto-managed zone records\n\t\tconst managedTypes = ['NS', 'SOA'];\n\t\tif (managedTypes.includes(type)) {\n\t\t\treturn null;\n\t\t}\n\n\t\tconst validTypes: DnsRecordType[] = [\n\t\t\t'A',\n\t\t\t'AAAA',\n\t\t\t'CNAME',\n\t\t\t'MX',\n\t\t\t'TXT',\n\t\t\t'SRV',\n\t\t\t'CAA',\n\t\t];\n\t\treturn validTypes.includes(type as DnsRecordType)\n\t\t\t? (type as DnsRecordType)\n\t\t\t: null;\n\t}\n\n\t/**\n\t * Extract subdomain from full record name relative to domain.\n\t */\n\tprivate extractSubdomain(recordName: string, domain: string): string {\n\t\tconst normalizedDomain = domain.endsWith('.') ? domain : `${domain}.`;\n\t\tconst normalizedName = recordName.endsWith('.')\n\t\t\t? recordName\n\t\t\t: `${recordName}.`;\n\n\t\tif (normalizedName === normalizedDomain) {\n\t\t\treturn '@';\n\t\t}\n\n\t\t// Remove the domain suffix\n\t\tconst subdomain = normalizedName.replace(`.${normalizedDomain}`, '');\n\t\treturn subdomain.replace(/\\.$/, ''); // Remove trailing dot if any\n\t}\n\n\tasync getRecords(domain: string): Promise<DnsRecord[]> {\n\t\tconst zoneId = await this.getHostedZoneId(domain);\n\t\tconst records: DnsRecord[] = [];\n\n\t\tlet nextRecordName: string | undefined;\n\t\tlet nextRecordType: RRType | undefined;\n\n\t\t// Paginate through all records\n\t\tdo {\n\t\t\tconst command = new ListResourceRecordSetsCommand({\n\t\t\t\tHostedZoneId: zoneId,\n\t\t\t\tStartRecordName: nextRecordName,\n\t\t\t\tStartRecordType: nextRecordType,\n\t\t\t\tMaxItems: 100,\n\t\t\t});\n\n\t\t\tconst response = await this.client.send(command);\n\n\t\t\tfor (const recordSet of response.ResourceRecordSets ?? []) {\n\t\t\t\tconst type = this.toRecordType(recordSet.Type ?? '');\n\t\t\t\tif (!type || !recordSet.Name) continue;\n\n\t\t\t\tconst values = (recordSet.ResourceRecords ?? [])\n\t\t\t\t\t.map((r) => r.Value)\n\t\t\t\t\t.filter((v): v is string => !!v);\n\n\t\t\t\trecords.push({\n\t\t\t\t\tname: this.extractSubdomain(recordSet.Name, domain),\n\t\t\t\t\ttype,\n\t\t\t\t\tttl: recordSet.TTL ?? 300,\n\t\t\t\t\tvalues,\n\t\t\t\t});\n\t\t\t}\n\n\t\t\tif (response.IsTruncated) {\n\t\t\t\tnextRecordName = response.NextRecordName;\n\t\t\t\tnextRecordType = response.NextRecordType;\n\t\t\t} else {\n\t\t\t\tnextRecordName = undefined;\n\t\t\t}\n\t\t} while (nextRecordName);\n\n\t\treturn records;\n\t}\n\n\tasync upsertRecords(\n\t\tdomain: string,\n\t\trecords: UpsertDnsRecord[],\n\t): Promise<UpsertResult[]> {\n\t\tconst zoneId = await this.getHostedZoneId(domain);\n\t\tconst results: UpsertResult[] = [];\n\n\t\t// Get existing records to determine if creating or updating\n\t\tconst existingRecords = await this.getRecords(domain);\n\n\t\t// Process records in batches (Route53 allows max 1000 changes per request)\n\t\tconst batchSize = 100;\n\t\tfor (let i = 0; i < records.length; i += batchSize) {\n\t\t\tconst batch = records.slice(i, i + batchSize);\n\t\t\tconst changes = [];\n\n\t\t\tfor (const record of batch) {\n\t\t\t\tconst existing = existingRecords.find(\n\t\t\t\t\t(r) => r.name === record.name && r.type === record.type,\n\t\t\t\t);\n\n\t\t\t\tconst existingValue = existing?.values?.[0];\n\n\t\t\t\tif (existing && existingValue === record.value) {\n\t\t\t\t\t// Record exists with same value - unchanged\n\t\t\t\t\tresults.push({\n\t\t\t\t\t\trecord,\n\t\t\t\t\t\tcreated: false,\n\t\t\t\t\t\tunchanged: true,\n\t\t\t\t\t});\n\t\t\t\t\tcontinue;\n\t\t\t\t}\n\n\t\t\t\t// Build full record name\n\t\t\t\tconst recordName =\n\t\t\t\t\trecord.name === '@' ? domain : `${record.name}.${domain}`;\n\n\t\t\t\tchanges.push({\n\t\t\t\t\tAction: 'UPSERT' as const,\n\t\t\t\t\tResourceRecordSet: {\n\t\t\t\t\t\tName: recordName,\n\t\t\t\t\t\tType: record.type,\n\t\t\t\t\t\tTTL: record.ttl,\n\t\t\t\t\t\tResourceRecords: [{ Value: record.value }],\n\t\t\t\t\t},\n\t\t\t\t});\n\n\t\t\t\tresults.push({\n\t\t\t\t\trecord,\n\t\t\t\t\tcreated: !existing,\n\t\t\t\t\tunchanged: false,\n\t\t\t\t});\n\t\t\t}\n\n\t\t\t// Execute batch if there are changes\n\t\t\tif (changes.length > 0) {\n\t\t\t\tconst command = new ChangeResourceRecordSetsCommand({\n\t\t\t\t\tHostedZoneId: zoneId,\n\t\t\t\t\tChangeBatch: {\n\t\t\t\t\t\tComment: 'Upsert by gkm deploy',\n\t\t\t\t\t\tChanges: changes,\n\t\t\t\t\t},\n\t\t\t\t});\n\n\t\t\t\tawait this.client.send(command);\n\t\t\t}\n\t\t}\n\n\t\treturn results;\n\t}\n\n\tasync deleteRecords(\n\t\tdomain: string,\n\t\trecords: DeleteDnsRecord[],\n\t): Promise<DeleteResult[]> {\n\t\tconst zoneId = await this.getHostedZoneId(domain);\n\t\tconst results: DeleteResult[] = [];\n\n\t\t// Get existing records to find the ones to delete\n\t\tconst existingRecords = await this.getRecords(domain);\n\n\t\t// Process records in batches (Route53 allows max 1000 changes per request)\n\t\tconst batchSize = 100;\n\t\tfor (let i = 0; i < records.length; i += batchSize) {\n\t\t\tconst batch = records.slice(i, i + batchSize);\n\t\t\tconst changes = [];\n\n\t\t\tfor (const record of batch) {\n\t\t\t\tconst existing = existingRecords.find(\n\t\t\t\t\t(r) => r.name === record.name && r.type === record.type,\n\t\t\t\t);\n\n\t\t\t\tif (!existing) {\n\t\t\t\t\t// Record doesn't exist - already deleted\n\t\t\t\t\tresults.push({\n\t\t\t\t\t\trecord,\n\t\t\t\t\t\tdeleted: false,\n\t\t\t\t\t\tnotFound: true,\n\t\t\t\t\t});\n\t\t\t\t\tcontinue;\n\t\t\t\t}\n\n\t\t\t\t// Build full record name\n\t\t\t\tconst recordName =\n\t\t\t\t\trecord.name === '@' ? domain : `${record.name}.${domain}`;\n\n\t\t\t\tchanges.push({\n\t\t\t\t\tAction: 'DELETE' as const,\n\t\t\t\t\tResourceRecordSet: {\n\t\t\t\t\t\tName: recordName,\n\t\t\t\t\t\tType: record.type,\n\t\t\t\t\t\tTTL: existing.ttl,\n\t\t\t\t\t\tResourceRecords: existing.values.map((v) => ({ Value: v })),\n\t\t\t\t\t},\n\t\t\t\t});\n\n\t\t\t\tresults.push({\n\t\t\t\t\trecord,\n\t\t\t\t\tdeleted: true,\n\t\t\t\t\tnotFound: false,\n\t\t\t\t});\n\t\t\t}\n\n\t\t\t// Execute batch if there are changes\n\t\t\tif (changes.length > 0) {\n\t\t\t\ttry {\n\t\t\t\t\tconst command = new ChangeResourceRecordSetsCommand({\n\t\t\t\t\t\tHostedZoneId: zoneId,\n\t\t\t\t\t\tChangeBatch: {\n\t\t\t\t\t\t\tComment: 'Delete by gkm undeploy',\n\t\t\t\t\t\t\tChanges: changes,\n\t\t\t\t\t\t},\n\t\t\t\t\t});\n\n\t\t\t\t\tawait this.client.send(command);\n\t\t\t\t} catch (error) {\n\t\t\t\t\t// Mark all records in this batch as failed\n\t\t\t\t\tfor (const result of results.slice(-changes.length)) {\n\t\t\t\t\t\tif (result.deleted) {\n\t\t\t\t\t\t\tresult.deleted = false;\n\t\t\t\t\t\t\tresult.error = String(error);\n\t\t\t\t\t\t}\n\t\t\t\t\t}\n\t\t\t\t}\n\t\t\t}\n\t\t}\n\n\t\treturn results;\n\t}\n}\n"],"mappings":";;;;;;;;;;;;;;;AA0CA,IAAa,kBAAb,MAAoD;CACnD,OAAgB;CAChB;CACA;CACA,kCAA+C,IAAI,IAAI;CAEvD,YAAY,UAAkC,CAAC,GAAG;EAEjD,MAAM,SAAS,QAAQ,UAAU,QAAQ,IAAI,cAAc;EAE3D,KAAK,SAAS,IAAIA,yBAAAA,cAAc;GAC/B;GACA,GAAI,QAAQ,YAAY,EAAE,UAAU,QAAQ,SAAS;GACrD,GAAI,QAAQ,WAAW,EACtB,cAAA,GAAaC,8BAAAA,QAAAA,CAAQ,EAAE,SAAS,QAAQ,QAAQ,CAAC,EAClD;EACD,CAAC;EACD,KAAK,eAAe,QAAQ;CAC7B;;;;;CAMA,MAAc,gBAAgB,QAAiC;EAE9D,IAAI,KAAK,cACR,OAAO,KAAK;EAIb,IAAI,KAAK,gBAAgB,IAAI,MAAM,GAClC,OAAO,KAAK,gBAAgB,IAAI,MAAM;EAIvC,MAAM,UAAU,IAAIC,yBAAAA,6BAA6B;GAChD,SAAS;GACT,UAAU;EACX,CAAC;EAGD,MAAM,SAAQ,MADS,KAAK,OAAO,KAAK,OAAO,EAAA,CACxB,eAAe,CAAC;EAGvC,MAAM,mBAAmB,OAAO,SAAS,GAAG,IAAI,SAAS,GAAG,OAAO;EACnE,MAAM,OAAO,MAAM,MAAM,MAAM,EAAE,SAAS,gBAAgB;EAE1D,IAAI,CAAC,MAAM,IACV,MAAM,IAAI,MACT,oCAAoC,OAAO,2DAC5C;EAID,MAAM,SAAS,KAAK,GAAG,QAAQ,gBAAgB,EAAE;EACjD,KAAK,gBAAgB,IAAI,QAAQ,MAAM;EACvC,OAAO;CACR;;;;;CAMA,aAAqB,MAAoC;EAGxD,IAAI,CADkB,MAAM,KACb,CAAC,CAAC,SAAS,IAAI,GAC7B,OAAO;EAYR,OAAO;GARN;GACA;GACA;GACA;GACA;GACA;GACA;EAEe,CAAC,CAAC,SAAS,IAAqB,IAC5C,OACD;CACJ;;;;CAKA,iBAAyB,YAAoB,QAAwB;EACpE,MAAM,mBAAmB,OAAO,SAAS,GAAG,IAAI,SAAS,GAAG,OAAO;EACnE,MAAM,iBAAiB,WAAW,SAAS,GAAG,IAC3C,aACA,GAAG,WAAW;EAEjB,IAAI,mBAAmB,kBACtB,OAAO;EAKR,OADkB,eAAe,QAAQ,IAAI,oBAAoB,EAClD,CAAC,CAAC,QAAQ,OAAO,EAAE;CACnC;CAEA,MAAM,WAAW,QAAsC;EACtD,MAAM,SAAS,MAAM,KAAK,gBAAgB,MAAM;EAChD,MAAM,UAAuB,CAAC;EAE9B,IAAI;EACJ,IAAI;EAGJ,GAAG;GACF,MAAM,UAAU,IAAIC,yBAAAA,8BAA8B;IACjD,cAAc;IACd,iBAAiB;IACjB,iBAAiB;IACjB,UAAU;GACX,CAAC;GAED,MAAM,WAAW,MAAM,KAAK,OAAO,KAAK,OAAO;GAE/C,KAAK,MAAM,aAAa,SAAS,sBAAsB,CAAC,GAAG;IAC1D,MAAM,OAAO,KAAK,aAAa,UAAU,QAAQ,EAAE;IACnD,IAAI,CAAC,QAAQ,CAAC,UAAU,MAAM;IAE9B,MAAM,UAAU,UAAU,mBAAmB,CAAC,EAAA,CAC5C,KAAK,MAAM,EAAE,KAAK,CAAC,CACnB,QAAQ,MAAmB,CAAC,CAAC,CAAC;IAEhC,QAAQ,KAAK;KACZ,MAAM,KAAK,iBAAiB,UAAU,MAAM,MAAM;KAClD;KACA,KAAK,UAAU,OAAO;KACtB;IACD,CAAC;GACF;GAEA,IAAI,SAAS,aAAa;IACzB,iBAAiB,SAAS;IAC1B,iBAAiB,SAAS;GAC3B,OACC,iBAAiB,KAAA;EAEnB,SAAS;EAET,OAAO;CACR;CAEA,MAAM,cACL,QACA,SAC0B;EAC1B,MAAM,SAAS,MAAM,KAAK,gBAAgB,MAAM;EAChD,MAAM,UAA0B,CAAC;EAGjC,MAAM,kBAAkB,MAAM,KAAK,WAAW,MAAM;EAGpD,MAAM,YAAY;EAClB,KAAK,IAAI,IAAI,GAAG,IAAI,QAAQ,QAAQ,KAAK,WAAW;GACnD,MAAM,QAAQ,QAAQ,MAAM,GAAG,IAAI,SAAS;GAC5C,MAAM,UAAU,CAAC;GAEjB,KAAK,MAAM,UAAU,OAAO;IAC3B,MAAM,WAAW,gBAAgB,MAC/B,MAAM,EAAE,SAAS,OAAO,QAAQ,EAAE,SAAS,OAAO,IACpD;IAEA,MAAM,gBAAgB,UAAU,SAAS;IAEzC,IAAI,YAAY,kBAAkB,OAAO,OAAO;KAE/C,QAAQ,KAAK;MACZ;MACA,SAAS;MACT,WAAW;KACZ,CAAC;KACD;IACD;IAGA,MAAM,aACL,OAAO,SAAS,MAAM,SAAS,GAAG,OAAO,KAAK,GAAG;IAElD,QAAQ,KAAK;KACZ,QAAQ;KACR,mBAAmB;MAClB,MAAM;MACN,MAAM,OAAO;MACb,KAAK,OAAO;MACZ,iBAAiB,CAAC,EAAE,OAAO,OAAO,MAAM,CAAC;KAC1C;IACD,CAAC;IAED,QAAQ,KAAK;KACZ;KACA,SAAS,CAAC;KACV,WAAW;IACZ,CAAC;GACF;GAGA,IAAI,QAAQ,SAAS,GAAG;IACvB,MAAM,UAAU,IAAIC,yBAAAA,gCAAgC;KACnD,cAAc;KACd,aAAa;MACZ,SAAS;MACT,SAAS;KACV;IACD,CAAC;IAED,MAAM,KAAK,OAAO,KAAK,OAAO;GAC/B;EACD;EAEA,OAAO;CACR;CAEA,MAAM,cACL,QACA,SAC0B;EAC1B,MAAM,SAAS,MAAM,KAAK,gBAAgB,MAAM;EAChD,MAAM,UAA0B,CAAC;EAGjC,MAAM,kBAAkB,MAAM,KAAK,WAAW,MAAM;EAGpD,MAAM,YAAY;EAClB,KAAK,IAAI,IAAI,GAAG,IAAI,QAAQ,QAAQ,KAAK,WAAW;GACnD,MAAM,QAAQ,QAAQ,MAAM,GAAG,IAAI,SAAS;GAC5C,MAAM,UAAU,CAAC;GAEjB,KAAK,MAAM,UAAU,OAAO;IAC3B,MAAM,WAAW,gBAAgB,MAC/B,MAAM,EAAE,SAAS,OAAO,QAAQ,EAAE,SAAS,OAAO,IACpD;IAEA,IAAI,CAAC,UAAU;KAEd,QAAQ,KAAK;MACZ;MACA,SAAS;MACT,UAAU;KACX,CAAC;KACD;IACD;IAGA,MAAM,aACL,OAAO,SAAS,MAAM,SAAS,GAAG,OAAO,KAAK,GAAG;IAElD,QAAQ,KAAK;KACZ,QAAQ;KACR,mBAAmB;MAClB,MAAM;MACN,MAAM,OAAO;MACb,KAAK,SAAS;MACd,iBAAiB,SAAS,OAAO,KAAK,OAAO,EAAE,OAAO,EAAE,EAAE;KAC3D;IACD,CAAC;IAED,QAAQ,KAAK;KACZ;KACA,SAAS;KACT,UAAU;IACX,CAAC;GACF;GAGA,IAAI,QAAQ,SAAS,GACpB,IAAI;IACH,MAAM,UAAU,IAAIA,yBAAAA,gCAAgC;KACnD,cAAc;KACd,aAAa;MACZ,SAAS;MACT,SAAS;KACV;IACD,CAAC;IAED,MAAM,KAAK,OAAO,KAAK,OAAO;GAC/B,SAAS,OAAO;IAEf,KAAK,MAAM,UAAU,QAAQ,MAAM,CAAC,QAAQ,MAAM,GACjD,IAAI,OAAO,SAAS;KACnB,OAAO,UAAU;KACjB,OAAO,QAAQ,OAAO,KAAK;IAC5B;GAEF;EAEF;EAEA,OAAO;CACR;AACD"}

package/dist/{SSMStateProvider-BRt2py-A.mjs → SSMStateProvider-B0Hu1MKZ.mjs}

@@ -1,14 +1,23 @@
-import { __require } from "./chunk-Duj1WY3L.mjs";
+import { n as __require } from "./rolldown-runtime-BhDjJH2R.mjs";
 import { GetParameterCommand, ParameterNotFound, PutParameterCommand, SSMClient } from "@aws-sdk/client-ssm";
-
 //#region src/deploy/SSMStateProvider.ts
 /**
+* AWS SSM Parameter Store State Provider
+*
+* Stores deployment state as SecureString parameters in AWS SSM.
+* Uses AWS-managed KMS key for encryption (free tier).
+*
+* Parameter naming: /gkm/{workspaceName}/{stage}/state
+*/
+/**
 * AWS SSM Parameter Store state provider.
 *
 * Stores state as encrypted SecureString parameters.
 * Parameter path: /gkm/{workspaceName}/{stage}/state
 */
 var SSMStateProvider = class SSMStateProvider {
+	workspaceName;
+	client;
 	constructor(workspaceName, client) {
 		this.workspaceName = workspaceName;
 		this.client = client;
@@ -60,7 +69,7 @@ var SSMStateProvider = class SSMStateProvider {
 		}));
 	}
 };
-
 //#endregion
 export { SSMStateProvider };
-//# sourceMappingURL=SSMStateProvider-BRt2py-A.mjs.map
+
+//# sourceMappingURL=SSMStateProvider-B0Hu1MKZ.mjs.map

package/dist/SSMStateProvider-B0Hu1MKZ.mjs.map

@@ -0,0 +1 @@
+{"version":3,"file":"SSMStateProvider-B0Hu1MKZ.mjs","names":[],"sources":["../src/deploy/SSMStateProvider.ts"],"sourcesContent":["/**\n * AWS SSM Parameter Store State Provider\n *\n * Stores deployment state as SecureString parameters in AWS SSM.\n * Uses AWS-managed KMS key for encryption (free tier).\n *\n * Parameter naming: /gkm/{workspaceName}/{stage}/state\n */\n\nimport {\n\tGetParameterCommand,\n\tParameterNotFound,\n\tPutParameterCommand,\n\tSSMClient,\n\ttype SSMClientConfig,\n} from '@aws-sdk/client-ssm';\nimport type { AwsRegion, StateProvider } from './StateProvider';\nimport type { DokployStageState } from './state';\n\nexport interface SSMStateProviderOptions {\n\t/** Workspace name (used in parameter path) */\n\tworkspaceName: string;\n\t/** AWS region */\n\tregion?: AwsRegion;\n\t/** AWS profile name (optional - uses default credential chain if not provided) */\n\tprofile?: string;\n\t/** AWS credentials (optional - uses default credential chain if not provided) */\n\tcredentials?: SSMClientConfig['credentials'];\n\t/** Custom endpoint (for LocalStack or other S3-compatible services) */\n\tendpoint?: string;\n}\n\n/**\n * AWS SSM Parameter Store state provider.\n *\n * Stores state as encrypted SecureString parameters.\n * Parameter path: /gkm/{workspaceName}/{stage}/state\n */\nexport class SSMStateProvider implements StateProvider {\n\tconstructor(\n\t\treadonly workspaceName: string,\n\t\tprivate readonly client: SSMClient,\n\t) {}\n\n\t/**\n\t * Create an SSMStateProvider with a new SSMClient.\n\t */\n\tstatic create(options: SSMStateProviderOptions): SSMStateProvider {\n\t\tconst clientConfig: SSMClientConfig = {\n\t\t\tregion: options.region,\n\t\t\tendpoint: options.endpoint,\n\t\t};\n\n\t\t// Use profile credentials if specified, otherwise use provided credentials or default chain\n\t\tif (options.profile) {\n\t\t\t// Dynamic import to avoid requiring @aws-sdk/credential-providers when not using profiles\n\t\t\tconst { fromIni } = require('@aws-sdk/credential-providers');\n\t\t\tclientConfig.credentials = fromIni({ profile: options.profile });\n\t\t} else if (options.credentials) {\n\t\t\tclientConfig.credentials = options.credentials;\n\t\t}\n\n\t\tconst client = new SSMClient(clientConfig);\n\t\treturn new SSMStateProvider(options.workspaceName, client);\n\t}\n\n\t/**\n\t * Get the SSM parameter name for a stage.\n\t */\n\tprivate getParameterName(stage: string): string {\n\t\treturn `/gkm/${this.workspaceName}/${stage}/state`;\n\t}\n\n\tasync read(stage: string): Promise<DokployStageState | null> {\n\t\tconst parameterName = this.getParameterName(stage);\n\n\t\ttry {\n\t\t\tconst response = await this.client.send(\n\t\t\t\tnew GetParameterCommand({\n\t\t\t\t\tName: parameterName,\n\t\t\t\t\tWithDecryption: true,\n\t\t\t\t}),\n\t\t\t);\n\n\t\t\tif (!response.Parameter?.Value) {\n\t\t\t\treturn null;\n\t\t\t}\n\n\t\t\treturn JSON.parse(response.Parameter.Value) as DokployStageState;\n\t\t} catch (error) {\n\t\t\t// Parameter doesn't exist - return null (new deployment)\n\t\t\tif (error instanceof ParameterNotFound) {\n\t\t\t\treturn null;\n\t\t\t}\n\n\t\t\t// Re-throw other errors (permission denied, network, etc.)\n\t\t\tthrow error;\n\t\t}\n\t}\n\n\tasync write(stage: string, state: DokployStageState): Promise<void> {\n\t\tconst parameterName = this.getParameterName(stage);\n\n\t\t// Update last deployed timestamp\n\t\tstate.lastDeployedAt = new Date().toISOString();\n\n\t\tawait this.client.send(\n\t\t\tnew PutParameterCommand({\n\t\t\t\tName: parameterName,\n\t\t\t\tValue: JSON.stringify(state),\n\t\t\t\tType: 'SecureString',\n\t\t\t\tOverwrite: true,\n\t\t\t\tDescription: `GKM deployment state for ${this.workspaceName}/${stage}`,\n\t\t\t}),\n\t\t);\n\t}\n}\n"],"mappings":";;;;;;;;;;;;;;;;;AAsCA,IAAa,mBAAb,MAAa,iBAA0C;CAE5C;CACQ;CAFlB,YACC,eACA,QACC;EAFQ,KAAA,gBAAA;EACQ,KAAA,SAAA;CACf;;;;CAKH,OAAO,OAAO,SAAoD;EACjE,MAAM,eAAgC;GACrC,QAAQ,QAAQ;GAChB,UAAU,QAAQ;EACnB;EAGA,IAAI,QAAQ,SAAS;GAEpB,MAAM,EAAE,YAAA,UAAoB,+BAA+B;GAC3D,aAAa,cAAc,QAAQ,EAAE,SAAS,QAAQ,QAAQ,CAAC;EAChE,OAAO,IAAI,QAAQ,aAClB,aAAa,cAAc,QAAQ;EAGpC,MAAM,SAAS,IAAI,UAAU,YAAY;EACzC,OAAO,IAAI,iBAAiB,QAAQ,eAAe,MAAM;CAC1D;;;;CAKA,iBAAyB,OAAuB;EAC/C,OAAO,QAAQ,KAAK,cAAc,GAAG,MAAM;CAC5C;CAEA,MAAM,KAAK,OAAkD;EAC5D,MAAM,gBAAgB,KAAK,iBAAiB,KAAK;EAEjD,IAAI;GACH,MAAM,WAAW,MAAM,KAAK,OAAO,KAClC,IAAI,oBAAoB;IACvB,MAAM;IACN,gBAAgB;GACjB,CAAC,CACF;GAEA,IAAI,CAAC,SAAS,WAAW,OACxB,OAAO;GAGR,OAAO,KAAK,MAAM,SAAS,UAAU,KAAK;EAC3C,SAAS,OAAO;GAEf,IAAI,iBAAiB,mBACpB,OAAO;GAIR,MAAM;EACP;CACD;CAEA,MAAM,MAAM,OAAe,OAAyC;EACnE,MAAM,gBAAgB,KAAK,iBAAiB,KAAK;EAGjD,MAAM,kCAAiB,IAAI,KAAK,EAAA,CAAE,YAAY;EAE9C,MAAM,KAAK,OAAO,KACjB,IAAI,oBAAoB;GACvB,MAAM;GACN,OAAO,KAAK,UAAU,KAAK;GAC3B,MAAM;GACN,WAAW;GACX,aAAa,4BAA4B,KAAK,cAAc,GAAG;EAChE,CAAC,CACF;CACD;AACD"}

package/dist/{SSMStateProvider-DyX8s9HI.cjs → SSMStateProvider-VrQ-yeqd.cjs}

@@ -1,14 +1,22 @@
-const require_chunk = require('./chunk-CUT6urMc.cjs');
-const __aws_sdk_client_ssm = require_chunk.__toESM(require("@aws-sdk/client-ssm"));
-
+let _aws_sdk_client_ssm = require("@aws-sdk/client-ssm");
 //#region src/deploy/SSMStateProvider.ts
 /**
+* AWS SSM Parameter Store State Provider
+*
+* Stores deployment state as SecureString parameters in AWS SSM.
+* Uses AWS-managed KMS key for encryption (free tier).
+*
+* Parameter naming: /gkm/{workspaceName}/{stage}/state
+*/
+/**
 * AWS SSM Parameter Store state provider.
 *
 * Stores state as encrypted SecureString parameters.
 * Parameter path: /gkm/{workspaceName}/{stage}/state
 */
 var SSMStateProvider = class SSMStateProvider {
+	workspaceName;
+	client;
 	constructor(workspaceName, client) {
 		this.workspaceName = workspaceName;
 		this.client = client;
@@ -25,7 +33,7 @@ var SSMStateProvider = class SSMStateProvider {
 			const { fromIni } = require("@aws-sdk/credential-providers");
 			clientConfig.credentials = fromIni({ profile: options.profile });
 		} else if (options.credentials) clientConfig.credentials = options.credentials;
-		const client = new __aws_sdk_client_ssm.SSMClient(clientConfig);
+		const client = new _aws_sdk_client_ssm.SSMClient(clientConfig);
 		return new SSMStateProvider(options.workspaceName, client);
 	}
 	/**
@@ -37,21 +45,21 @@ var SSMStateProvider = class SSMStateProvider {
 	async read(stage) {
 		const parameterName = this.getParameterName(stage);
 		try {
-			const response = await this.client.send(new __aws_sdk_client_ssm.GetParameterCommand({
+			const response = await this.client.send(new _aws_sdk_client_ssm.GetParameterCommand({
 				Name: parameterName,
 				WithDecryption: true
 			}));
 			if (!response.Parameter?.Value) return null;
 			return JSON.parse(response.Parameter.Value);
 		} catch (error) {
-			if (error instanceof __aws_sdk_client_ssm.ParameterNotFound) return null;
+			if (error instanceof _aws_sdk_client_ssm.ParameterNotFound) return null;
 			throw error;
 		}
 	}
 	async write(stage, state) {
 		const parameterName = this.getParameterName(stage);
 		state.lastDeployedAt = (/* @__PURE__ */ new Date()).toISOString();
-		await this.client.send(new __aws_sdk_client_ssm.PutParameterCommand({
+		await this.client.send(new _aws_sdk_client_ssm.PutParameterCommand({
 			Name: parameterName,
 			Value: JSON.stringify(state),
 			Type: "SecureString",
@@ -60,7 +68,7 @@ var SSMStateProvider = class SSMStateProvider {
 		}));
 	}
 };
-
 //#endregion
 exports.SSMStateProvider = SSMStateProvider;
-//# sourceMappingURL=SSMStateProvider-DyX8s9HI.cjs.map
+
+//# sourceMappingURL=SSMStateProvider-VrQ-yeqd.cjs.map

package/dist/SSMStateProvider-VrQ-yeqd.cjs.map

@@ -0,0 +1 @@
+{"version":3,"file":"SSMStateProvider-VrQ-yeqd.cjs","names":["SSMClient","GetParameterCommand","ParameterNotFound","PutParameterCommand"],"sources":["../src/deploy/SSMStateProvider.ts"],"sourcesContent":["/**\n * AWS SSM Parameter Store State Provider\n *\n * Stores deployment state as SecureString parameters in AWS SSM.\n * Uses AWS-managed KMS key for encryption (free tier).\n *\n * Parameter naming: /gkm/{workspaceName}/{stage}/state\n */\n\nimport {\n\tGetParameterCommand,\n\tParameterNotFound,\n\tPutParameterCommand,\n\tSSMClient,\n\ttype SSMClientConfig,\n} from '@aws-sdk/client-ssm';\nimport type { AwsRegion, StateProvider } from './StateProvider';\nimport type { DokployStageState } from './state';\n\nexport interface SSMStateProviderOptions {\n\t/** Workspace name (used in parameter path) */\n\tworkspaceName: string;\n\t/** AWS region */\n\tregion?: AwsRegion;\n\t/** AWS profile name (optional - uses default credential chain if not provided) */\n\tprofile?: string;\n\t/** AWS credentials (optional - uses default credential chain if not provided) */\n\tcredentials?: SSMClientConfig['credentials'];\n\t/** Custom endpoint (for LocalStack or other S3-compatible services) */\n\tendpoint?: string;\n}\n\n/**\n * AWS SSM Parameter Store state provider.\n *\n * Stores state as encrypted SecureString parameters.\n * Parameter path: /gkm/{workspaceName}/{stage}/state\n */\nexport class SSMStateProvider implements StateProvider {\n\tconstructor(\n\t\treadonly workspaceName: string,\n\t\tprivate readonly client: SSMClient,\n\t) {}\n\n\t/**\n\t * Create an SSMStateProvider with a new SSMClient.\n\t */\n\tstatic create(options: SSMStateProviderOptions): SSMStateProvider {\n\t\tconst clientConfig: SSMClientConfig = {\n\t\t\tregion: options.region,\n\t\t\tendpoint: options.endpoint,\n\t\t};\n\n\t\t// Use profile credentials if specified, otherwise use provided credentials or default chain\n\t\tif (options.profile) {\n\t\t\t// Dynamic import to avoid requiring @aws-sdk/credential-providers when not using profiles\n\t\t\tconst { fromIni } = require('@aws-sdk/credential-providers');\n\t\t\tclientConfig.credentials = fromIni({ profile: options.profile });\n\t\t} else if (options.credentials) {\n\t\t\tclientConfig.credentials = options.credentials;\n\t\t}\n\n\t\tconst client = new SSMClient(clientConfig);\n\t\treturn new SSMStateProvider(options.workspaceName, client);\n\t}\n\n\t/**\n\t * Get the SSM parameter name for a stage.\n\t */\n\tprivate getParameterName(stage: string): string {\n\t\treturn `/gkm/${this.workspaceName}/${stage}/state`;\n\t}\n\n\tasync read(stage: string): Promise<DokployStageState | null> {\n\t\tconst parameterName = this.getParameterName(stage);\n\n\t\ttry {\n\t\t\tconst response = await this.client.send(\n\t\t\t\tnew GetParameterCommand({\n\t\t\t\t\tName: parameterName,\n\t\t\t\t\tWithDecryption: true,\n\t\t\t\t}),\n\t\t\t);\n\n\t\t\tif (!response.Parameter?.Value) {\n\t\t\t\treturn null;\n\t\t\t}\n\n\t\t\treturn JSON.parse(response.Parameter.Value) as DokployStageState;\n\t\t} catch (error) {\n\t\t\t// Parameter doesn't exist - return null (new deployment)\n\t\t\tif (error instanceof ParameterNotFound) {\n\t\t\t\treturn null;\n\t\t\t}\n\n\t\t\t// Re-throw other errors (permission denied, network, etc.)\n\t\t\tthrow error;\n\t\t}\n\t}\n\n\tasync write(stage: string, state: DokployStageState): Promise<void> {\n\t\tconst parameterName = this.getParameterName(stage);\n\n\t\t// Update last deployed timestamp\n\t\tstate.lastDeployedAt = new Date().toISOString();\n\n\t\tawait this.client.send(\n\t\t\tnew PutParameterCommand({\n\t\t\t\tName: parameterName,\n\t\t\t\tValue: JSON.stringify(state),\n\t\t\t\tType: 'SecureString',\n\t\t\t\tOverwrite: true,\n\t\t\t\tDescription: `GKM deployment state for ${this.workspaceName}/${stage}`,\n\t\t\t}),\n\t\t);\n\t}\n}\n"],"mappings":";;;;;;;;;;;;;;;;AAsCA,IAAa,mBAAb,MAAa,iBAA0C;CAE5C;CACQ;CAFlB,YACC,eACA,QACC;EAFQ,KAAA,gBAAA;EACQ,KAAA,SAAA;CACf;;;;CAKH,OAAO,OAAO,SAAoD;EACjE,MAAM,eAAgC;GACrC,QAAQ,QAAQ;GAChB,UAAU,QAAQ;EACnB;EAGA,IAAI,QAAQ,SAAS;GAEpB,MAAM,EAAE,YAAY,QAAQ,+BAA+B;GAC3D,aAAa,cAAc,QAAQ,EAAE,SAAS,QAAQ,QAAQ,CAAC;EAChE,OAAO,IAAI,QAAQ,aAClB,aAAa,cAAc,QAAQ;EAGpC,MAAM,SAAS,IAAIA,oBAAAA,UAAU,YAAY;EACzC,OAAO,IAAI,iBAAiB,QAAQ,eAAe,MAAM;CAC1D;;;;CAKA,iBAAyB,OAAuB;EAC/C,OAAO,QAAQ,KAAK,cAAc,GAAG,MAAM;CAC5C;CAEA,MAAM,KAAK,OAAkD;EAC5D,MAAM,gBAAgB,KAAK,iBAAiB,KAAK;EAEjD,IAAI;GACH,MAAM,WAAW,MAAM,KAAK,OAAO,KAClC,IAAIC,oBAAAA,oBAAoB;IACvB,MAAM;IACN,gBAAgB;GACjB,CAAC,CACF;GAEA,IAAI,CAAC,SAAS,WAAW,OACxB,OAAO;GAGR,OAAO,KAAK,MAAM,SAAS,UAAU,KAAK;EAC3C,SAAS,OAAO;GAEf,IAAI,iBAAiBC,oBAAAA,mBACpB,OAAO;GAIR,MAAM;EACP;CACD;CAEA,MAAM,MAAM,OAAe,OAAyC;EACnE,MAAM,gBAAgB,KAAK,iBAAiB,KAAK;EAGjD,MAAM,kCAAiB,IAAI,KAAK,EAAA,CAAE,YAAY;EAE9C,MAAM,KAAK,OAAO,KACjB,IAAIC,oBAAAA,oBAAoB;GACvB,MAAM;GACN,OAAO,KAAK,UAAU,KAAK;GAC3B,MAAM;GACN,WAAW;GACX,aAAa,4BAA4B,KAAK,cAAc,GAAG;EAChE,CAAC,CACF;CACD;AACD"}

package/dist/{backup-provisioner-BrsHwYG0.cjs → backup-provisioner-BmhIO_Yr.cjs}

@@ -1,9 +1,13 @@
-const require_chunk = require('./chunk-CUT6urMc.cjs');
-const __aws_sdk_client_s3 = require_chunk.__toESM(require("@aws-sdk/client-s3"));
-const __aws_sdk_client_iam = require_chunk.__toESM(require("@aws-sdk/client-iam"));
-
+let _aws_sdk_client_s3 = require("@aws-sdk/client-s3");
+let _aws_sdk_client_iam = require("@aws-sdk/client-iam");
 //#region src/deploy/backup-provisioner.ts
 /**
+* Backup Destination Provisioner
+*
+* Creates AWS resources (S3 bucket, IAM user, access keys) and configures
+* Dokploy backup destinations for database backups.
+*/
+/**
 * Generate a random suffix for unique resource names
 */
 function randomSuffix() {
@@ -33,8 +37,8 @@ async function createAwsClients(region, profile, endpoint) {
 		};
 	}
 	return {
-		s3: new __aws_sdk_client_s3.S3Client(config),
-		iam: new __aws_sdk_client_iam.IAMClient(config)
+		s3: new _aws_sdk_client_s3.S3Client(config),
+		iam: new _aws_sdk_client_iam.IAMClient(config)
 	};
 }
 /**
@@ -42,7 +46,7 @@ async function createAwsClients(region, profile, endpoint) {
 */
 async function bucketExists(s3, bucketName) {
 	try {
-		await s3.send(new __aws_sdk_client_s3.HeadBucketCommand({ Bucket: bucketName }));
+		await s3.send(new _aws_sdk_client_s3.HeadBucketCommand({ Bucket: bucketName }));
 		return true;
 	} catch (error) {
 		if (error.name === "NotFound") return false;
@@ -55,7 +59,7 @@ async function bucketExists(s3, bucketName) {
 */
 async function userExists(iam, userName) {
 	try {
-		await iam.send(new __aws_sdk_client_iam.GetUserCommand({ UserName: userName }));
+		await iam.send(new _aws_sdk_client_iam.GetUserCommand({ UserName: userName }));
 		return true;
 	} catch (error) {
 		const errorName = error.name;
@@ -81,22 +85,20 @@ async function provisionBackupDestination(options) {
 	const aws = await createAwsClients(config.region, config.profile, awsEndpoint);
 	const sanitizedProject = sanitizeName(projectName);
 	const bucketName = existingState?.bucketName ?? `${sanitizedProject}-${stage}-backups-${randomSuffix()}`;
-	const bucketAlreadyExists = await bucketExists(aws.s3, bucketName);
-	if (!bucketAlreadyExists) {
+	if (!await bucketExists(aws.s3, bucketName)) {
 		logger.log(`   Creating S3 bucket: ${bucketName}`);
 		const createBucketParams = { Bucket: bucketName };
 		if (config.region !== "us-east-1") createBucketParams.CreateBucketConfiguration = { LocationConstraint: config.region };
-		await aws.s3.send(new __aws_sdk_client_s3.CreateBucketCommand(createBucketParams));
-		await aws.s3.send(new __aws_sdk_client_s3.PutBucketVersioningCommand({
+		await aws.s3.send(new _aws_sdk_client_s3.CreateBucketCommand(createBucketParams));
+		await aws.s3.send(new _aws_sdk_client_s3.PutBucketVersioningCommand({
 			Bucket: bucketName,
 			VersioningConfiguration: { Status: "Enabled" }
 		}));
 	} else logger.log(`   Using existing S3 bucket: ${bucketName}`);
 	const iamUserName = existingState?.iamUserName ?? `dokploy-backup-${sanitizedProject}-${stage}`;
-	const iamUserAlreadyExists = await userExists(aws.iam, iamUserName);
-	if (!iamUserAlreadyExists) {
+	if (!await userExists(aws.iam, iamUserName)) {
 		logger.log(`   Creating IAM user: ${iamUserName}`);
-		await aws.iam.send(new __aws_sdk_client_iam.CreateUserCommand({ UserName: iamUserName }));
+		await aws.iam.send(new _aws_sdk_client_iam.CreateUserCommand({ UserName: iamUserName }));
 	} else logger.log(`   Using existing IAM user: ${iamUserName}`);
 	const policyDocument = {
 		Version: "2012-10-17",
@@ -113,7 +115,7 @@ async function provisionBackupDestination(options) {
 		}]
 	};
 	logger.log("   Updating IAM policy");
-	await aws.iam.send(new __aws_sdk_client_iam.PutUserPolicyCommand({
+	await aws.iam.send(new _aws_sdk_client_iam.PutUserPolicyCommand({
 		UserName: iamUserName,
 		PolicyName: "DokployBackupAccess",
 		PolicyDocument: JSON.stringify(policyDocument)
@@ -126,7 +128,7 @@ async function provisionBackupDestination(options) {
 		secretAccessKey = existingState.iamSecretAccessKey;
 	} else {
 		logger.log("   Creating IAM access key");
-		const accessKeyResult = await aws.iam.send(new __aws_sdk_client_iam.CreateAccessKeyCommand({ UserName: iamUserName }));
+		const accessKeyResult = await aws.iam.send(new _aws_sdk_client_iam.CreateAccessKeyCommand({ UserName: iamUserName }));
 		if (!accessKeyResult.AccessKey) throw new Error("Failed to create IAM access key");
 		accessKeyId = accessKeyResult.AccessKey.AccessKeyId;
 		secretAccessKey = accessKeyResult.AccessKey.SecretAccessKey;
@@ -158,7 +160,7 @@ async function provisionBackupDestination(options) {
 		createdAt: existingState?.createdAt ?? (/* @__PURE__ */ new Date()).toISOString()
 	};
 }
-
 //#endregion
 exports.provisionBackupDestination = provisionBackupDestination;
-//# sourceMappingURL=backup-provisioner-BrsHwYG0.cjs.map
+
+//# sourceMappingURL=backup-provisioner-BmhIO_Yr.cjs.map

package/dist/backup-provisioner-BmhIO_Yr.cjs.map

@@ -0,0 +1 @@
+{"version":3,"file":"backup-provisioner-BmhIO_Yr.cjs","names":["S3Client","IAMClient","HeadBucketCommand","GetUserCommand","CreateBucketCommand","PutBucketVersioningCommand","CreateUserCommand","PutUserPolicyCommand","CreateAccessKeyCommand"],"sources":["../src/deploy/backup-provisioner.ts"],"sourcesContent":["/**\n * Backup Destination Provisioner\n *\n * Creates AWS resources (S3 bucket, IAM user, access keys) and configures\n * Dokploy backup destinations for database backups.\n */\n\nimport {\n\tCreateAccessKeyCommand,\n\tCreateUserCommand,\n\tGetUserCommand,\n\tIAMClient,\n\ttype IAMClientConfig,\n\tPutUserPolicyCommand,\n} from '@aws-sdk/client-iam';\nimport {\n\ttype BucketLocationConstraint,\n\tCreateBucketCommand,\n\tHeadBucketCommand,\n\tPutBucketVersioningCommand,\n\tS3Client,\n\ttype S3ClientConfig,\n} from '@aws-sdk/client-s3';\nimport type { BackupsConfig } from '../workspace/types.js';\nimport type { DokployApi } from './dokploy-api.js';\nimport type { BackupState } from './state.js';\n\nexport interface ProvisionBackupOptions {\n\t/** Dokploy API client */\n\tapi: DokployApi;\n\t/** Dokploy project ID */\n\tprojectId: string;\n\t/** Workspace name (used for resource naming) */\n\tprojectName: string;\n\t/** Deploy stage (e.g., 'production', 'staging') */\n\tstage: string;\n\t/** Backup configuration */\n\tconfig: BackupsConfig;\n\t/** Existing backup state (if any) */\n\texistingState?: BackupState;\n\t/** Logger for progress output */\n\tlogger: { log: (msg: string) => void };\n\t/** AWS endpoint override (for testing with LocalStack) */\n\tawsEndpoint?: string;\n}\n\n/**\n * Generate a random suffix for unique resource names\n */\nfunction randomSuffix(): string {\n\treturn Math.random().toString(36).substring(2, 8);\n}\n\n/**\n * Sanitize a name for AWS resources (lowercase alphanumeric and hyphens)\n */\nfunction sanitizeName(name: string): string {\n\treturn name.toLowerCase().replace(/[^a-z0-9-]/g, '-');\n}\n\n/**\n * Create AWS clients with optional profile credentials\n */\nasync function createAwsClients(\n\tregion: string,\n\tprofile?: string,\n\tendpoint?: string,\n): Promise<{ s3: S3Client; iam: IAMClient }> {\n\tconst config: S3ClientConfig & IAMClientConfig = { region };\n\n\tif (profile) {\n\t\tconst { fromIni } = await import('@aws-sdk/credential-providers');\n\t\tconfig.credentials = fromIni({ profile });\n\t}\n\n\t// Support custom endpoint for testing (e.g., LocalStack)\n\tif (endpoint) {\n\t\tconfig.endpoint = endpoint;\n\t\t(config as S3ClientConfig).forcePathStyle = true;\n\t\t// Use test credentials when endpoint is specified\n\t\tconfig.credentials = {\n\t\t\taccessKeyId: 'test',\n\t\t\tsecretAccessKey: 'test',\n\t\t};\n\t}\n\n\treturn {\n\t\ts3: new S3Client(config),\n\t\tiam: new IAMClient(config),\n\t};\n}\n\n/**\n * Check if an S3 bucket exists\n */\nasync function bucketExists(\n\ts3: S3Client,\n\tbucketName: string,\n): Promise<boolean> {\n\ttry {\n\t\tawait s3.send(new HeadBucketCommand({ Bucket: bucketName }));\n\t\treturn true;\n\t} catch (error) {\n\t\tif ((error as { name?: string }).name === 'NotFound') {\n\t\t\treturn false;\n\t\t}\n\t\t// 403 means bucket exists but we don't have access\n\t\tif (\n\t\t\t(error as { $metadata?: { httpStatusCode?: number } }).$metadata\n\t\t\t\t?.httpStatusCode === 403\n\t\t) {\n\t\t\treturn true;\n\t\t}\n\t\tthrow error;\n\t}\n}\n\n/**\n * Check if an IAM user exists\n */\nasync function userExists(iam: IAMClient, userName: string): Promise<boolean> {\n\ttry {\n\t\tawait iam.send(new GetUserCommand({ UserName: userName }));\n\t\treturn true;\n\t} catch (error) {\n\t\tconst errorName = (error as { name?: string }).name;\n\t\t// AWS returns 'NoSuchEntity', LocalStack returns 'NoSuchEntityException'\n\t\tif (errorName === 'NoSuchEntity' || errorName === 'NoSuchEntityException') {\n\t\t\treturn false;\n\t\t}\n\t\tthrow error;\n\t}\n}\n\n/**\n * Provision backup destination for a deployment.\n *\n * Creates AWS resources (S3 bucket, IAM user) and Dokploy destination if needed.\n * Reuses existing resources from state when possible.\n */\nexport async function provisionBackupDestination(\n\toptions: ProvisionBackupOptions,\n): Promise<BackupState> {\n\tconst {\n\t\tapi,\n\t\tprojectName,\n\t\tstage,\n\t\tconfig,\n\t\texistingState,\n\t\tlogger,\n\t\tawsEndpoint,\n\t} = options;\n\n\t// If we have existing state, verify the Dokploy destination still exists\n\tif (existingState?.destinationId) {\n\t\ttry {\n\t\t\tawait api.getDestination(existingState.destinationId);\n\t\t\tlogger.log('   Using existing backup destination');\n\t\t\treturn existingState;\n\t\t} catch {\n\t\t\tlogger.log('   Existing destination not found, recreating...');\n\t\t}\n\t}\n\n\t// Create AWS clients\n\tconst aws = await createAwsClients(\n\t\tconfig.region,\n\t\tconfig.profile,\n\t\tawsEndpoint,\n\t);\n\tconst sanitizedProject = sanitizeName(projectName);\n\n\t// 1. Create or verify S3 bucket\n\tconst bucketName =\n\t\texistingState?.bucketName ??\n\t\t`${sanitizedProject}-${stage}-backups-${randomSuffix()}`;\n\n\tconst bucketAlreadyExists = await bucketExists(aws.s3, bucketName);\n\tif (!bucketAlreadyExists) {\n\t\tlogger.log(`   Creating S3 bucket: ${bucketName}`);\n\n\t\t// CreateBucket needs LocationConstraint for non-us-east-1 regions\n\t\tconst createBucketParams: {\n\t\t\tBucket: string;\n\t\t\tCreateBucketConfiguration?: {\n\t\t\t\tLocationConstraint: BucketLocationConstraint;\n\t\t\t};\n\t\t} = {\n\t\t\tBucket: bucketName,\n\t\t};\n\t\tif (config.region !== 'us-east-1') {\n\t\t\tcreateBucketParams.CreateBucketConfiguration = {\n\t\t\t\tLocationConstraint: config.region as BucketLocationConstraint,\n\t\t\t};\n\t\t}\n\n\t\tawait aws.s3.send(new CreateBucketCommand(createBucketParams));\n\n\t\t// Enable versioning for backup integrity\n\t\tawait aws.s3.send(\n\t\t\tnew PutBucketVersioningCommand({\n\t\t\t\tBucket: bucketName,\n\t\t\t\tVersioningConfiguration: { Status: 'Enabled' },\n\t\t\t}),\n\t\t);\n\t} else {\n\t\tlogger.log(`   Using existing S3 bucket: ${bucketName}`);\n\t}\n\n\t// 2. Create or verify IAM user\n\tconst iamUserName =\n\t\texistingState?.iamUserName ?? `dokploy-backup-${sanitizedProject}-${stage}`;\n\n\tconst iamUserAlreadyExists = await userExists(aws.iam, iamUserName);\n\tif (!iamUserAlreadyExists) {\n\t\tlogger.log(`   Creating IAM user: ${iamUserName}`);\n\t\tawait aws.iam.send(new CreateUserCommand({ UserName: iamUserName }));\n\t} else {\n\t\tlogger.log(`   Using existing IAM user: ${iamUserName}`);\n\t}\n\n\t// 3. Attach bucket policy to IAM user\n\tconst policyDocument = {\n\t\tVersion: '2012-10-17',\n\t\tStatement: [\n\t\t\t{\n\t\t\t\tEffect: 'Allow',\n\t\t\t\tAction: [\n\t\t\t\t\t's3:GetObject',\n\t\t\t\t\t's3:PutObject',\n\t\t\t\t\t's3:DeleteObject',\n\t\t\t\t\t's3:ListBucket',\n\t\t\t\t\t's3:GetBucketLocation',\n\t\t\t\t],\n\t\t\t\tResource: [\n\t\t\t\t\t`arn:aws:s3:::${bucketName}`,\n\t\t\t\t\t`arn:aws:s3:::${bucketName}/*`,\n\t\t\t\t],\n\t\t\t},\n\t\t],\n\t};\n\n\tlogger.log('   Updating IAM policy');\n\tawait aws.iam.send(\n\t\tnew PutUserPolicyCommand({\n\t\t\tUserName: iamUserName,\n\t\t\tPolicyName: 'DokployBackupAccess',\n\t\t\tPolicyDocument: JSON.stringify(policyDocument),\n\t\t}),\n\t);\n\n\t// 4. Create access key (or reuse existing if state has it and destination needs recreation)\n\tlet accessKeyId: string;\n\tlet secretAccessKey: string;\n\n\tif (existingState?.iamAccessKeyId && existingState?.iamSecretAccessKey) {\n\t\t// Reuse existing credentials\n\t\tlogger.log('   Using existing IAM access key');\n\t\taccessKeyId = existingState.iamAccessKeyId;\n\t\tsecretAccessKey = existingState.iamSecretAccessKey;\n\t} else {\n\t\t// Create new access key\n\t\tlogger.log('   Creating IAM access key');\n\t\tconst accessKeyResult = await aws.iam.send(\n\t\t\tnew CreateAccessKeyCommand({ UserName: iamUserName }),\n\t\t);\n\n\t\tif (!accessKeyResult.AccessKey) {\n\t\t\tthrow new Error('Failed to create IAM access key');\n\t\t}\n\n\t\taccessKeyId = accessKeyResult.AccessKey.AccessKeyId!;\n\t\tsecretAccessKey = accessKeyResult.AccessKey.SecretAccessKey!;\n\t}\n\n\t// 5. Create Dokploy destination\n\tconst destinationName = `${sanitizedProject}-${stage}-s3`;\n\tlogger.log(`   Creating Dokploy destination: ${destinationName}`);\n\n\tconst { destination, created } = await api.findOrCreateDestination(\n\t\tdestinationName,\n\t\t{\n\t\t\taccessKey: accessKeyId,\n\t\t\tsecretAccessKey: secretAccessKey,\n\t\t\tbucket: bucketName,\n\t\t\tregion: config.region,\n\t\t},\n\t);\n\n\tif (created) {\n\t\tlogger.log('   ✓ Dokploy destination created');\n\t} else {\n\t\tlogger.log('   ✓ Using existing Dokploy destination');\n\t}\n\n\t// 6. Test connection\n\ttry {\n\t\tawait api.testDestinationConnection(destination.destinationId);\n\t\tlogger.log('   ✓ Destination connection verified');\n\t} catch (error) {\n\t\tlogger.log(\n\t\t\t`   ⚠ Warning: Could not verify destination connection: ${error}`,\n\t\t);\n\t}\n\n\treturn {\n\t\tbucketName,\n\t\tbucketArn: `arn:aws:s3:::${bucketName}`,\n\t\tiamUserName,\n\t\tiamAccessKeyId: accessKeyId,\n\t\tiamSecretAccessKey: secretAccessKey,\n\t\tdestinationId: destination.destinationId,\n\t\tregion: config.region,\n\t\tcreatedAt: existingState?.createdAt ?? new Date().toISOString(),\n\t};\n}\n"],"mappings":";;;;;;;;;;;;AAiDA,SAAS,eAAuB;CAC/B,OAAO,KAAK,OAAO,CAAC,CAAC,SAAS,EAAE,CAAC,CAAC,UAAU,GAAG,CAAC;AACjD;;;;AAKA,SAAS,aAAa,MAAsB;CAC3C,OAAO,KAAK,YAAY,CAAC,CAAC,QAAQ,eAAe,GAAG;AACrD;;;;AAKA,eAAe,iBACd,QACA,SACA,UAC4C;CAC5C,MAAM,SAA2C,EAAE,OAAO;CAE1D,IAAI,SAAS;EACZ,MAAM,EAAE,YAAY,MAAM,OAAO;EACjC,OAAO,cAAc,QAAQ,EAAE,QAAQ,CAAC;CACzC;CAGA,IAAI,UAAU;EACb,OAAO,WAAW;EAClB,OAA2B,iBAAiB;EAE5C,OAAO,cAAc;GACpB,aAAa;GACb,iBAAiB;EAClB;CACD;CAEA,OAAO;EACN,IAAI,IAAIA,mBAAAA,SAAS,MAAM;EACvB,KAAK,IAAIC,oBAAAA,UAAU,MAAM;CAC1B;AACD;;;;AAKA,eAAe,aACd,IACA,YACmB;CACnB,IAAI;EACH,MAAM,GAAG,KAAK,IAAIC,mBAAAA,kBAAkB,EAAE,QAAQ,WAAW,CAAC,CAAC;EAC3D,OAAO;CACR,SAAS,OAAO;EACf,IAAK,MAA4B,SAAS,YACzC,OAAO;EAGR,IACE,MAAsD,WACpD,mBAAmB,KAEtB,OAAO;EAER,MAAM;CACP;AACD;;;;AAKA,eAAe,WAAW,KAAgB,UAAoC;CAC7E,IAAI;EACH,MAAM,IAAI,KAAK,IAAIC,oBAAAA,eAAe,EAAE,UAAU,SAAS,CAAC,CAAC;EACzD,OAAO;CACR,SAAS,OAAO;EACf,MAAM,YAAa,MAA4B;EAE/C,IAAI,cAAc,kBAAkB,cAAc,yBACjD,OAAO;EAER,MAAM;CACP;AACD;;;;;;;AAQA,eAAsB,2BACrB,SACuB;CACvB,MAAM,EACL,KACA,aACA,OACA,QACA,eACA,QACA,gBACG;CAGJ,IAAI,eAAe,eAClB,IAAI;EACH,MAAM,IAAI,eAAe,cAAc,aAAa;EACpD,OAAO,IAAI,sCAAsC;EACjD,OAAO;CACR,QAAQ;EACP,OAAO,IAAI,kDAAkD;CAC9D;CAID,MAAM,MAAM,MAAM,iBACjB,OAAO,QACP,OAAO,SACP,WACD;CACA,MAAM,mBAAmB,aAAa,WAAW;CAGjD,MAAM,aACL,eAAe,cACf,GAAG,iBAAiB,GAAG,MAAM,WAAW,aAAa;CAGtD,IAAI,CAAC,MAD6B,aAAa,IAAI,IAAI,UAAU,GACvC;EACzB,OAAO,IAAI,0BAA0B,YAAY;EAGjD,MAAM,qBAKF,EACH,QAAQ,WACT;EACA,IAAI,OAAO,WAAW,aACrB,mBAAmB,4BAA4B,EAC9C,oBAAoB,OAAO,OAC5B;EAGD,MAAM,IAAI,GAAG,KAAK,IAAIC,mBAAAA,oBAAoB,kBAAkB,CAAC;EAG7D,MAAM,IAAI,GAAG,KACZ,IAAIC,mBAAAA,2BAA2B;GAC9B,QAAQ;GACR,yBAAyB,EAAE,QAAQ,UAAU;EAC9C,CAAC,CACF;CACD,OACC,OAAO,IAAI,gCAAgC,YAAY;CAIxD,MAAM,cACL,eAAe,eAAe,kBAAkB,iBAAiB,GAAG;CAGrE,IAAI,CAAC,MAD8B,WAAW,IAAI,KAAK,WAAW,GACvC;EAC1B,OAAO,IAAI,yBAAyB,aAAa;EACjD,MAAM,IAAI,IAAI,KAAK,IAAIC,oBAAAA,kBAAkB,EAAE,UAAU,YAAY,CAAC,CAAC;CACpE,OACC,OAAO,IAAI,+BAA+B,aAAa;CAIxD,MAAM,iBAAiB;EACtB,SAAS;EACT,WAAW,CACV;GACC,QAAQ;GACR,QAAQ;IACP;IACA;IACA;IACA;IACA;GACD;GACA,UAAU,CACT,gBAAgB,cAChB,gBAAgB,WAAW,GAC5B;EACD,CACD;CACD;CAEA,OAAO,IAAI,wBAAwB;CACnC,MAAM,IAAI,IAAI,KACb,IAAIC,oBAAAA,qBAAqB;EACxB,UAAU;EACV,YAAY;EACZ,gBAAgB,KAAK,UAAU,cAAc;CAC9C,CAAC,CACF;CAGA,IAAI;CACJ,IAAI;CAEJ,IAAI,eAAe,kBAAkB,eAAe,oBAAoB;EAEvE,OAAO,IAAI,kCAAkC;EAC7C,cAAc,cAAc;EAC5B,kBAAkB,cAAc;CACjC,OAAO;EAEN,OAAO,IAAI,4BAA4B;EACvC,MAAM,kBAAkB,MAAM,IAAI,IAAI,KACrC,IAAIC,oBAAAA,uBAAuB,EAAE,UAAU,YAAY,CAAC,CACrD;EAEA,IAAI,CAAC,gBAAgB,WACpB,MAAM,IAAI,MAAM,iCAAiC;EAGlD,cAAc,gBAAgB,UAAU;EACxC,kBAAkB,gBAAgB,UAAU;CAC7C;CAGA,MAAM,kBAAkB,GAAG,iBAAiB,GAAG,MAAM;CACrD,OAAO,IAAI,oCAAoC,iBAAiB;CAEhE,MAAM,EAAE,aAAa,YAAY,MAAM,IAAI,wBAC1C,iBACA;EACC,WAAW;EACM;EACjB,QAAQ;EACR,QAAQ,OAAO;CAChB,CACD;CAEA,IAAI,SACH,OAAO,IAAI,kCAAkC;MAE7C,OAAO,IAAI,yCAAyC;CAIrD,IAAI;EACH,MAAM,IAAI,0BAA0B,YAAY,aAAa;EAC7D,OAAO,IAAI,sCAAsC;CAClD,SAAS,OAAO;EACf,OAAO,IACN,0DAA0D,OAC3D;CACD;CAEA,OAAO;EACN;EACA,WAAW,gBAAgB;EAC3B;EACA,gBAAgB;EAChB,oBAAoB;EACpB,eAAe,YAAY;EAC3B,QAAQ,OAAO;EACf,WAAW,eAAe,8BAAa,IAAI,KAAK,EAAA,CAAE,YAAY;CAC/D;AACD"}

package/dist/{backup-provisioner-Bgj5Vi_L.mjs → backup-provisioner-DIVCbfee.mjs}

@@ -1,8 +1,13 @@
 import { CreateBucketCommand, HeadBucketCommand, PutBucketVersioningCommand, S3Client } from "@aws-sdk/client-s3";
 import { CreateAccessKeyCommand, CreateUserCommand, GetUserCommand, IAMClient, PutUserPolicyCommand } from "@aws-sdk/client-iam";
-
 //#region src/deploy/backup-provisioner.ts
 /**
+* Backup Destination Provisioner
+*
+* Creates AWS resources (S3 bucket, IAM user, access keys) and configures
+* Dokploy backup destinations for database backups.
+*/
+/**
 * Generate a random suffix for unique resource names
 */
 function randomSuffix() {
@@ -80,8 +85,7 @@ async function provisionBackupDestination(options) {
 	const aws = await createAwsClients(config.region, config.profile, awsEndpoint);
 	const sanitizedProject = sanitizeName(projectName);
 	const bucketName = existingState?.bucketName ?? `${sanitizedProject}-${stage}-backups-${randomSuffix()}`;
-	const bucketAlreadyExists = await bucketExists(aws.s3, bucketName);
-	if (!bucketAlreadyExists) {
+	if (!await bucketExists(aws.s3, bucketName)) {
 		logger.log(`   Creating S3 bucket: ${bucketName}`);
 		const createBucketParams = { Bucket: bucketName };
 		if (config.region !== "us-east-1") createBucketParams.CreateBucketConfiguration = { LocationConstraint: config.region };
@@ -92,8 +96,7 @@ async function provisionBackupDestination(options) {
 		}));
 	} else logger.log(`   Using existing S3 bucket: ${bucketName}`);
 	const iamUserName = existingState?.iamUserName ?? `dokploy-backup-${sanitizedProject}-${stage}`;
-	const iamUserAlreadyExists = await userExists(aws.iam, iamUserName);
-	if (!iamUserAlreadyExists) {
+	if (!await userExists(aws.iam, iamUserName)) {
 		logger.log(`   Creating IAM user: ${iamUserName}`);
 		await aws.iam.send(new CreateUserCommand({ UserName: iamUserName }));
 	} else logger.log(`   Using existing IAM user: ${iamUserName}`);
@@ -157,7 +160,7 @@ async function provisionBackupDestination(options) {
 		createdAt: existingState?.createdAt ?? (/* @__PURE__ */ new Date()).toISOString()
 	};
 }
-
 //#endregion
 export { provisionBackupDestination };
-//# sourceMappingURL=backup-provisioner-Bgj5Vi_L.mjs.map
+
+//# sourceMappingURL=backup-provisioner-DIVCbfee.mjs.map

package/dist/backup-provisioner-DIVCbfee.mjs.map

@@ -0,0 +1 @@
+{"version":3,"file":"backup-provisioner-DIVCbfee.mjs","names":[],"sources":["../src/deploy/backup-provisioner.ts"],"sourcesContent":["/**\n * Backup Destination Provisioner\n *\n * Creates AWS resources (S3 bucket, IAM user, access keys) and configures\n * Dokploy backup destinations for database backups.\n */\n\nimport {\n\tCreateAccessKeyCommand,\n\tCreateUserCommand,\n\tGetUserCommand,\n\tIAMClient,\n\ttype IAMClientConfig,\n\tPutUserPolicyCommand,\n} from '@aws-sdk/client-iam';\nimport {\n\ttype BucketLocationConstraint,\n\tCreateBucketCommand,\n\tHeadBucketCommand,\n\tPutBucketVersioningCommand,\n\tS3Client,\n\ttype S3ClientConfig,\n} from '@aws-sdk/client-s3';\nimport type { BackupsConfig } from '../workspace/types.js';\nimport type { DokployApi } from './dokploy-api.js';\nimport type { BackupState } from './state.js';\n\nexport interface ProvisionBackupOptions {\n\t/** Dokploy API client */\n\tapi: DokployApi;\n\t/** Dokploy project ID */\n\tprojectId: string;\n\t/** Workspace name (used for resource naming) */\n\tprojectName: string;\n\t/** Deploy stage (e.g., 'production', 'staging') */\n\tstage: string;\n\t/** Backup configuration */\n\tconfig: BackupsConfig;\n\t/** Existing backup state (if any) */\n\texistingState?: BackupState;\n\t/** Logger for progress output */\n\tlogger: { log: (msg: string) => void };\n\t/** AWS endpoint override (for testing with LocalStack) */\n\tawsEndpoint?: string;\n}\n\n/**\n * Generate a random suffix for unique resource names\n */\nfunction randomSuffix(): string {\n\treturn Math.random().toString(36).substring(2, 8);\n}\n\n/**\n * Sanitize a name for AWS resources (lowercase alphanumeric and hyphens)\n */\nfunction sanitizeName(name: string): string {\n\treturn name.toLowerCase().replace(/[^a-z0-9-]/g, '-');\n}\n\n/**\n * Create AWS clients with optional profile credentials\n */\nasync function createAwsClients(\n\tregion: string,\n\tprofile?: string,\n\tendpoint?: string,\n): Promise<{ s3: S3Client; iam: IAMClient }> {\n\tconst config: S3ClientConfig & IAMClientConfig = { region };\n\n\tif (profile) {\n\t\tconst { fromIni } = await import('@aws-sdk/credential-providers');\n\t\tconfig.credentials = fromIni({ profile });\n\t}\n\n\t// Support custom endpoint for testing (e.g., LocalStack)\n\tif (endpoint) {\n\t\tconfig.endpoint = endpoint;\n\t\t(config as S3ClientConfig).forcePathStyle = true;\n\t\t// Use test credentials when endpoint is specified\n\t\tconfig.credentials = {\n\t\t\taccessKeyId: 'test',\n\t\t\tsecretAccessKey: 'test',\n\t\t};\n\t}\n\n\treturn {\n\t\ts3: new S3Client(config),\n\t\tiam: new IAMClient(config),\n\t};\n}\n\n/**\n * Check if an S3 bucket exists\n */\nasync function bucketExists(\n\ts3: S3Client,\n\tbucketName: string,\n): Promise<boolean> {\n\ttry {\n\t\tawait s3.send(new HeadBucketCommand({ Bucket: bucketName }));\n\t\treturn true;\n\t} catch (error) {\n\t\tif ((error as { name?: string }).name === 'NotFound') {\n\t\t\treturn false;\n\t\t}\n\t\t// 403 means bucket exists but we don't have access\n\t\tif (\n\t\t\t(error as { $metadata?: { httpStatusCode?: number } }).$metadata\n\t\t\t\t?.httpStatusCode === 403\n\t\t) {\n\t\t\treturn true;\n\t\t}\n\t\tthrow error;\n\t}\n}\n\n/**\n * Check if an IAM user exists\n */\nasync function userExists(iam: IAMClient, userName: string): Promise<boolean> {\n\ttry {\n\t\tawait iam.send(new GetUserCommand({ UserName: userName }));\n\t\treturn true;\n\t} catch (error) {\n\t\tconst errorName = (error as { name?: string }).name;\n\t\t// AWS returns 'NoSuchEntity', LocalStack returns 'NoSuchEntityException'\n\t\tif (errorName === 'NoSuchEntity' || errorName === 'NoSuchEntityException') {\n\t\t\treturn false;\n\t\t}\n\t\tthrow error;\n\t}\n}\n\n/**\n * Provision backup destination for a deployment.\n *\n * Creates AWS resources (S3 bucket, IAM user) and Dokploy destination if needed.\n * Reuses existing resources from state when possible.\n */\nexport async function provisionBackupDestination(\n\toptions: ProvisionBackupOptions,\n): Promise<BackupState> {\n\tconst {\n\t\tapi,\n\t\tprojectName,\n\t\tstage,\n\t\tconfig,\n\t\texistingState,\n\t\tlogger,\n\t\tawsEndpoint,\n\t} = options;\n\n\t// If we have existing state, verify the Dokploy destination still exists\n\tif (existingState?.destinationId) {\n\t\ttry {\n\t\t\tawait api.getDestination(existingState.destinationId);\n\t\t\tlogger.log('   Using existing backup destination');\n\t\t\treturn existingState;\n\t\t} catch {\n\t\t\tlogger.log('   Existing destination not found, recreating...');\n\t\t}\n\t}\n\n\t// Create AWS clients\n\tconst aws = await createAwsClients(\n\t\tconfig.region,\n\t\tconfig.profile,\n\t\tawsEndpoint,\n\t);\n\tconst sanitizedProject = sanitizeName(projectName);\n\n\t// 1. Create or verify S3 bucket\n\tconst bucketName =\n\t\texistingState?.bucketName ??\n\t\t`${sanitizedProject}-${stage}-backups-${randomSuffix()}`;\n\n\tconst bucketAlreadyExists = await bucketExists(aws.s3, bucketName);\n\tif (!bucketAlreadyExists) {\n\t\tlogger.log(`   Creating S3 bucket: ${bucketName}`);\n\n\t\t// CreateBucket needs LocationConstraint for non-us-east-1 regions\n\t\tconst createBucketParams: {\n\t\t\tBucket: string;\n\t\t\tCreateBucketConfiguration?: {\n\t\t\t\tLocationConstraint: BucketLocationConstraint;\n\t\t\t};\n\t\t} = {\n\t\t\tBucket: bucketName,\n\t\t};\n\t\tif (config.region !== 'us-east-1') {\n\t\t\tcreateBucketParams.CreateBucketConfiguration = {\n\t\t\t\tLocationConstraint: config.region as BucketLocationConstraint,\n\t\t\t};\n\t\t}\n\n\t\tawait aws.s3.send(new CreateBucketCommand(createBucketParams));\n\n\t\t// Enable versioning for backup integrity\n\t\tawait aws.s3.send(\n\t\t\tnew PutBucketVersioningCommand({\n\t\t\t\tBucket: bucketName,\n\t\t\t\tVersioningConfiguration: { Status: 'Enabled' },\n\t\t\t}),\n\t\t);\n\t} else {\n\t\tlogger.log(`   Using existing S3 bucket: ${bucketName}`);\n\t}\n\n\t// 2. Create or verify IAM user\n\tconst iamUserName =\n\t\texistingState?.iamUserName ?? `dokploy-backup-${sanitizedProject}-${stage}`;\n\n\tconst iamUserAlreadyExists = await userExists(aws.iam, iamUserName);\n\tif (!iamUserAlreadyExists) {\n\t\tlogger.log(`   Creating IAM user: ${iamUserName}`);\n\t\tawait aws.iam.send(new CreateUserCommand({ UserName: iamUserName }));\n\t} else {\n\t\tlogger.log(`   Using existing IAM user: ${iamUserName}`);\n\t}\n\n\t// 3. Attach bucket policy to IAM user\n\tconst policyDocument = {\n\t\tVersion: '2012-10-17',\n\t\tStatement: [\n\t\t\t{\n\t\t\t\tEffect: 'Allow',\n\t\t\t\tAction: [\n\t\t\t\t\t's3:GetObject',\n\t\t\t\t\t's3:PutObject',\n\t\t\t\t\t's3:DeleteObject',\n\t\t\t\t\t's3:ListBucket',\n\t\t\t\t\t's3:GetBucketLocation',\n\t\t\t\t],\n\t\t\t\tResource: [\n\t\t\t\t\t`arn:aws:s3:::${bucketName}`,\n\t\t\t\t\t`arn:aws:s3:::${bucketName}/*`,\n\t\t\t\t],\n\t\t\t},\n\t\t],\n\t};\n\n\tlogger.log('   Updating IAM policy');\n\tawait aws.iam.send(\n\t\tnew PutUserPolicyCommand({\n\t\t\tUserName: iamUserName,\n\t\t\tPolicyName: 'DokployBackupAccess',\n\t\t\tPolicyDocument: JSON.stringify(policyDocument),\n\t\t}),\n\t);\n\n\t// 4. Create access key (or reuse existing if state has it and destination needs recreation)\n\tlet accessKeyId: string;\n\tlet secretAccessKey: string;\n\n\tif (existingState?.iamAccessKeyId && existingState?.iamSecretAccessKey) {\n\t\t// Reuse existing credentials\n\t\tlogger.log('   Using existing IAM access key');\n\t\taccessKeyId = existingState.iamAccessKeyId;\n\t\tsecretAccessKey = existingState.iamSecretAccessKey;\n\t} else {\n\t\t// Create new access key\n\t\tlogger.log('   Creating IAM access key');\n\t\tconst accessKeyResult = await aws.iam.send(\n\t\t\tnew CreateAccessKeyCommand({ UserName: iamUserName }),\n\t\t);\n\n\t\tif (!accessKeyResult.AccessKey) {\n\t\t\tthrow new Error('Failed to create IAM access key');\n\t\t}\n\n\t\taccessKeyId = accessKeyResult.AccessKey.AccessKeyId!;\n\t\tsecretAccessKey = accessKeyResult.AccessKey.SecretAccessKey!;\n\t}\n\n\t// 5. Create Dokploy destination\n\tconst destinationName = `${sanitizedProject}-${stage}-s3`;\n\tlogger.log(`   Creating Dokploy destination: ${destinationName}`);\n\n\tconst { destination, created } = await api.findOrCreateDestination(\n\t\tdestinationName,\n\t\t{\n\t\t\taccessKey: accessKeyId,\n\t\t\tsecretAccessKey: secretAccessKey,\n\t\t\tbucket: bucketName,\n\t\t\tregion: config.region,\n\t\t},\n\t);\n\n\tif (created) {\n\t\tlogger.log('   ✓ Dokploy destination created');\n\t} else {\n\t\tlogger.log('   ✓ Using existing Dokploy destination');\n\t}\n\n\t// 6. Test connection\n\ttry {\n\t\tawait api.testDestinationConnection(destination.destinationId);\n\t\tlogger.log('   ✓ Destination connection verified');\n\t} catch (error) {\n\t\tlogger.log(\n\t\t\t`   ⚠ Warning: Could not verify destination connection: ${error}`,\n\t\t);\n\t}\n\n\treturn {\n\t\tbucketName,\n\t\tbucketArn: `arn:aws:s3:::${bucketName}`,\n\t\tiamUserName,\n\t\tiamAccessKeyId: accessKeyId,\n\t\tiamSecretAccessKey: secretAccessKey,\n\t\tdestinationId: destination.destinationId,\n\t\tregion: config.region,\n\t\tcreatedAt: existingState?.createdAt ?? new Date().toISOString(),\n\t};\n}\n"],"mappings":";;;;;;;;;;;;AAiDA,SAAS,eAAuB;CAC/B,OAAO,KAAK,OAAO,CAAC,CAAC,SAAS,EAAE,CAAC,CAAC,UAAU,GAAG,CAAC;AACjD;;;;AAKA,SAAS,aAAa,MAAsB;CAC3C,OAAO,KAAK,YAAY,CAAC,CAAC,QAAQ,eAAe,GAAG;AACrD;;;;AAKA,eAAe,iBACd,QACA,SACA,UAC4C;CAC5C,MAAM,SAA2C,EAAE,OAAO;CAE1D,IAAI,SAAS;EACZ,MAAM,EAAE,YAAY,MAAM,OAAO;EACjC,OAAO,cAAc,QAAQ,EAAE,QAAQ,CAAC;CACzC;CAGA,IAAI,UAAU;EACb,OAAO,WAAW;EAClB,OAA2B,iBAAiB;EAE5C,OAAO,cAAc;GACpB,aAAa;GACb,iBAAiB;EAClB;CACD;CAEA,OAAO;EACN,IAAI,IAAI,SAAS,MAAM;EACvB,KAAK,IAAI,UAAU,MAAM;CAC1B;AACD;;;;AAKA,eAAe,aACd,IACA,YACmB;CACnB,IAAI;EACH,MAAM,GAAG,KAAK,IAAI,kBAAkB,EAAE,QAAQ,WAAW,CAAC,CAAC;EAC3D,OAAO;CACR,SAAS,OAAO;EACf,IAAK,MAA4B,SAAS,YACzC,OAAO;EAGR,IACE,MAAsD,WACpD,mBAAmB,KAEtB,OAAO;EAER,MAAM;CACP;AACD;;;;AAKA,eAAe,WAAW,KAAgB,UAAoC;CAC7E,IAAI;EACH,MAAM,IAAI,KAAK,IAAI,eAAe,EAAE,UAAU,SAAS,CAAC,CAAC;EACzD,OAAO;CACR,SAAS,OAAO;EACf,MAAM,YAAa,MAA4B;EAE/C,IAAI,cAAc,kBAAkB,cAAc,yBACjD,OAAO;EAER,MAAM;CACP;AACD;;;;;;;AAQA,eAAsB,2BACrB,SACuB;CACvB,MAAM,EACL,KACA,aACA,OACA,QACA,eACA,QACA,gBACG;CAGJ,IAAI,eAAe,eAClB,IAAI;EACH,MAAM,IAAI,eAAe,cAAc,aAAa;EACpD,OAAO,IAAI,sCAAsC;EACjD,OAAO;CACR,QAAQ;EACP,OAAO,IAAI,kDAAkD;CAC9D;CAID,MAAM,MAAM,MAAM,iBACjB,OAAO,QACP,OAAO,SACP,WACD;CACA,MAAM,mBAAmB,aAAa,WAAW;CAGjD,MAAM,aACL,eAAe,cACf,GAAG,iBAAiB,GAAG,MAAM,WAAW,aAAa;CAGtD,IAAI,CAAC,MAD6B,aAAa,IAAI,IAAI,UAAU,GACvC;EACzB,OAAO,IAAI,0BAA0B,YAAY;EAGjD,MAAM,qBAKF,EACH,QAAQ,WACT;EACA,IAAI,OAAO,WAAW,aACrB,mBAAmB,4BAA4B,EAC9C,oBAAoB,OAAO,OAC5B;EAGD,MAAM,IAAI,GAAG,KAAK,IAAI,oBAAoB,kBAAkB,CAAC;EAG7D,MAAM,IAAI,GAAG,KACZ,IAAI,2BAA2B;GAC9B,QAAQ;GACR,yBAAyB,EAAE,QAAQ,UAAU;EAC9C,CAAC,CACF;CACD,OACC,OAAO,IAAI,gCAAgC,YAAY;CAIxD,MAAM,cACL,eAAe,eAAe,kBAAkB,iBAAiB,GAAG;CAGrE,IAAI,CAAC,MAD8B,WAAW,IAAI,KAAK,WAAW,GACvC;EAC1B,OAAO,IAAI,yBAAyB,aAAa;EACjD,MAAM,IAAI,IAAI,KAAK,IAAI,kBAAkB,EAAE,UAAU,YAAY,CAAC,CAAC;CACpE,OACC,OAAO,IAAI,+BAA+B,aAAa;CAIxD,MAAM,iBAAiB;EACtB,SAAS;EACT,WAAW,CACV;GACC,QAAQ;GACR,QAAQ;IACP;IACA;IACA;IACA;IACA;GACD;GACA,UAAU,CACT,gBAAgB,cAChB,gBAAgB,WAAW,GAC5B;EACD,CACD;CACD;CAEA,OAAO,IAAI,wBAAwB;CACnC,MAAM,IAAI,IAAI,KACb,IAAI,qBAAqB;EACxB,UAAU;EACV,YAAY;EACZ,gBAAgB,KAAK,UAAU,cAAc;CAC9C,CAAC,CACF;CAGA,IAAI;CACJ,IAAI;CAEJ,IAAI,eAAe,kBAAkB,eAAe,oBAAoB;EAEvE,OAAO,IAAI,kCAAkC;EAC7C,cAAc,cAAc;EAC5B,kBAAkB,cAAc;CACjC,OAAO;EAEN,OAAO,IAAI,4BAA4B;EACvC,MAAM,kBAAkB,MAAM,IAAI,IAAI,KACrC,IAAI,uBAAuB,EAAE,UAAU,YAAY,CAAC,CACrD;EAEA,IAAI,CAAC,gBAAgB,WACpB,MAAM,IAAI,MAAM,iCAAiC;EAGlD,cAAc,gBAAgB,UAAU;EACxC,kBAAkB,gBAAgB,UAAU;CAC7C;CAGA,MAAM,kBAAkB,GAAG,iBAAiB,GAAG,MAAM;CACrD,OAAO,IAAI,oCAAoC,iBAAiB;CAEhE,MAAM,EAAE,aAAa,YAAY,MAAM,IAAI,wBAC1C,iBACA;EACC,WAAW;EACM;EACjB,QAAQ;EACR,QAAQ,OAAO;CAChB,CACD;CAEA,IAAI,SACH,OAAO,IAAI,kCAAkC;MAE7C,OAAO,IAAI,yCAAyC;CAIrD,IAAI;EACH,MAAM,IAAI,0BAA0B,YAAY,aAAa;EAC7D,OAAO,IAAI,sCAAsC;CAClD,SAAS,OAAO;EACf,OAAO,IACN,0DAA0D,OAC3D;CACD;CAEA,OAAO;EACN;EACA,WAAW,gBAAgB;EAC3B;EACA,gBAAgB;EAChB,oBAAoB;EACpB,eAAe,YAAY;EAC3B,QAAQ,OAAO;EACf,WAAW,eAAe,8BAAa,IAAI,KAAK,EAAA,CAAE,YAAY;CAC/D;AACD"}