@geekmidas/cli 10.0.0-alpha.6 → 10.0.0-alpha.61

package/dist/appPorts-Cu79hJF6.cjs

@@ -0,0 +1,264 @@
+const require_rolldown_runtime = require("./rolldown-runtime-C0BPl7ul.cjs");
+let node_path = require("node:path");
+let node_fs = require("node:fs");
+let node_fs_promises = require("node:fs/promises");
+let node_child_process = require("node:child_process");
+//#region src/dev/appPorts.ts
+/**
+* Which local port each app answers on — and what to do when it is taken.
+*
+* An app's port used to be fixed: 3000, 3001, … and `gkm dev` refused to start
+* if anything held one. That is right when the holder is this same app, left
+* running by a previous `gkm dev` — moving would start a second copy beside it.
+* It is wrong when the holder is another project's dev server, which also
+* defaults to 3000: two projects could not run at once, and nothing about the
+* app needs that port. A browser reaches it through the edge, whose URL carries
+* no app port, and every address a phone or a route uses is derived on each
+* start.
+*
+* So the holder is asked who it is. Every app process gkm starts is tagged with
+* {@link APP_TAG_ENV} — the workspace and the app — and children inherit it, so
+* whatever actually binds the port (`next-server`, a Metro worker, the tsx
+* server) carries it — or, when its own can't be read, one of its parents does.
+* A held port whose holder carries this app's tag is a
+* leftover, and is refused; anything else — untagged, another workspace's,
+* unreadable — is not ours, and the app moves to the next free port.
+*
+* The choice is kept in `.gkm/app-ports.json`, not recomputed: an app that
+* moved stays where it moved, so a bookmark or a phone's saved address does not
+* break the next time the other project happens to be stopped. Local only —
+* `gkm deploy` and `gkm docker` never read it.
+*/
+var appPorts_exports = /* @__PURE__ */ require_rolldown_runtime.__exportAll({
+	APP_TAG_ENV: () => APP_TAG_ENV,
+	appTag: () => appTag,
+	assignAppPorts: () => assignAppPorts,
+	describeHolder: () => describeHolder,
+	holderOf: () => holderOf,
+	savedAppPorts: () => savedAppPorts,
+	withAppPorts: () => withAppPorts
+});
+/** Carried by every app process gkm starts: `<workspace root>#<app>`. */
+const APP_TAG_ENV = "GKM_DEV_APP";
+const APP_PORTS_PATH = ".gkm/app-ports.json";
+/** The tag an app's processes carry. The root is encoded, so it has no spaces. */
+function appTag(root, app) {
+	return `${encodeURIComponent((0, node_path.resolve)(root))}#${app}`;
+}
+/** Says, as `command (pid N)`, what holds a port. */
+function describeHolder(holder) {
+	if (!holder) return "another process";
+	return `${holder.command ?? "a process"} (pid ${holder.pid})`;
+}
+/**
+* Who is listening on a port, read the way a person would: `lsof` for the
+* pid, then that process's environment for its tag — `/proc/<pid>/environ` on
+* Linux, `ps eww` elsewhere. Both work for the user's own processes, which is
+* every process gkm starts; one that cannot be read has no tag, so is not ours.
+*/
+function holderOf(port) {
+	let out;
+	try {
+		out = (0, node_child_process.execFileSync)("lsof", [
+			"-nP",
+			`-iTCP:${port}`,
+			"-sTCP:LISTEN",
+			"-Fpc"
+		], {
+			encoding: "utf8",
+			stdio: [
+				"ignore",
+				"pipe",
+				"ignore"
+			]
+		});
+	} catch {
+		return;
+	}
+	const pid = Number(out.match(/^p(\d+)/m)?.[1]);
+	if (!pid) return void 0;
+	const command = out.match(/^c(.+)$/m)?.[1];
+	const tag = lineageTagOf(pid);
+	return {
+		pid,
+		...command ? { command } : {},
+		...tag ? { tag } : {}
+	};
+}
+/** How far up a holder's parents to look before calling it untagged. */
+const MAX_ANCESTORS = 8;
+/**
+* The tag of `pid`, or of its nearest parent that has one.
+*
+* A process can hide the tag it inherited: `next-server` renames itself, which
+* on macOS overwrites the memory `ps eww` reads its environment from, so `ps`
+* shows only its title. Its parent, the `next dev` gkm started, still carries
+* the tag. A child is only ever started by its parent, so a tagged parent makes
+* the holder this app's.
+*/
+function lineageTagOf(pid) {
+	let current = pid;
+	for (let depth = 0; current && current > 1; depth += 1) {
+		const tag = tagOf(current);
+		if (tag || depth === MAX_ANCESTORS) return tag;
+		current = parentOf(current);
+	}
+}
+function tagOf(pid) {
+	const prefix = `${APP_TAG_ENV}=`;
+	try {
+		return (process.platform === "linux" ? (0, node_fs.readFileSync)(`/proc/${pid}/environ`, "utf8").split("\0") : (0, node_child_process.execFileSync)("ps", [
+			"eww",
+			"-o",
+			"command=",
+			"-p",
+			String(pid)
+		], {
+			encoding: "utf8",
+			stdio: [
+				"ignore",
+				"pipe",
+				"ignore"
+			]
+		}).split(/\s+/)).find((entry) => entry.startsWith(prefix))?.slice(prefix.length);
+	} catch {
+		return;
+	}
+}
+function parentOf(pid) {
+	try {
+		const ppid = Number((0, node_child_process.execFileSync)("ps", [
+			"-o",
+			"ppid=",
+			"-p",
+			String(pid)
+		], {
+			encoding: "utf8",
+			stdio: [
+				"ignore",
+				"pipe",
+				"ignore"
+			]
+		}).trim());
+		return ppid > 0 ? ppid : void 0;
+	} catch {
+		return;
+	}
+}
+/** The ports apps were given before, by app name. */
+async function savedAppPorts(root) {
+	try {
+		return JSON.parse(await (0, node_fs_promises.readFile)((0, node_path.join)(root, APP_PORTS_PATH), "utf8"));
+	} catch {
+		return {};
+	}
+}
+async function saveAppPorts(root, ports) {
+	await (0, node_fs_promises.mkdir)((0, node_path.join)(root, ".gkm"), { recursive: true });
+	await (0, node_fs_promises.writeFile)((0, node_path.join)(root, APP_PORTS_PATH), `${JSON.stringify(ports, null, 2)}\n`);
+}
+/** The workspace, with each app on the port it was given locally. */
+function withAppPorts(workspace, ports) {
+	const apps = Object.fromEntries(Object.entries(workspace.apps).map(([name, app]) => [name, ports[name] ? {
+		...app,
+		port: ports[name]
+	} : app]));
+	return {
+		...workspace,
+		apps
+	};
+}
+/**
+* Give each named app a local port: the one it had, or its usual one, unless
+* another project holds it — then the next free one, which is kept.
+*
+* @returns every app's port, the apps that moved, and the apps this workspace
+*   already has running (the caller refuses to start those).
+*/
+async function assignAppPorts(workspace, names, deps) {
+	const saved = await savedAppPorts(workspace.root);
+	const wanted = {};
+	for (const name of names) {
+		const port = saved[name] ?? workspace.apps[name]?.port;
+		if (port) wanted[name] = port;
+	}
+	const taken = /* @__PURE__ */ new Set([...Object.values(saved), ...Object.values(wanted)]);
+	const ports = { ...saved };
+	const moved = [];
+	const running = [];
+	for (const name of Object.keys(wanted).sort()) {
+		const want = wanted[name];
+		ports[name] = want;
+		if (await deps.free(want)) continue;
+		const holder = deps.holder(want);
+		if (holder?.tag === appTag(workspace.root, name)) {
+			running.push({
+				app: name,
+				port: want,
+				holder
+			});
+			continue;
+		}
+		let next = want + 1;
+		while (taken.has(next) || !await deps.free(next)) next += 1;
+		taken.add(next);
+		ports[name] = next;
+		moved.push({
+			app: name,
+			from: want,
+			to: next,
+			holder
+		});
+	}
+	await saveAppPorts(workspace.root, ports);
+	return {
+		ports,
+		moved,
+		running
+	};
+}
+//#endregion
+Object.defineProperty(exports, "APP_TAG_ENV", {
+	enumerable: true,
+	get: function() {
+		return APP_TAG_ENV;
+	}
+});
+Object.defineProperty(exports, "appPorts_exports", {
+	enumerable: true,
+	get: function() {
+		return appPorts_exports;
+	}
+});
+Object.defineProperty(exports, "appTag", {
+	enumerable: true,
+	get: function() {
+		return appTag;
+	}
+});
+Object.defineProperty(exports, "assignAppPorts", {
+	enumerable: true,
+	get: function() {
+		return assignAppPorts;
+	}
+});
+Object.defineProperty(exports, "describeHolder", {
+	enumerable: true,
+	get: function() {
+		return describeHolder;
+	}
+});
+Object.defineProperty(exports, "holderOf", {
+	enumerable: true,
+	get: function() {
+		return holderOf;
+	}
+});
+Object.defineProperty(exports, "withAppPorts", {
+	enumerable: true,
+	get: function() {
+		return withAppPorts;
+	}
+});
+
+//# sourceMappingURL=appPorts-Cu79hJF6.cjs.map

package/dist/appPorts-Cu79hJF6.cjs.map

@@ -0,0 +1 @@
+{"version":3,"file":"appPorts-Cu79hJF6.cjs","names":["resolve","execFileSync","readFileSync","readFile","join","mkdir","writeFile"],"sources":["../src/dev/appPorts.ts"],"sourcesContent":["/**\n * Which local port each app answers on — and what to do when it is taken.\n *\n * An app's port used to be fixed: 3000, 3001, … and `gkm dev` refused to start\n * if anything held one. That is right when the holder is this same app, left\n * running by a previous `gkm dev` — moving would start a second copy beside it.\n * It is wrong when the holder is another project's dev server, which also\n * defaults to 3000: two projects could not run at once, and nothing about the\n * app needs that port. A browser reaches it through the edge, whose URL carries\n * no app port, and every address a phone or a route uses is derived on each\n * start.\n *\n * So the holder is asked who it is. Every app process gkm starts is tagged with\n * {@link APP_TAG_ENV} — the workspace and the app — and children inherit it, so\n * whatever actually binds the port (`next-server`, a Metro worker, the tsx\n * server) carries it — or, when its own can't be read, one of its parents does.\n * A held port whose holder carries this app's tag is a\n * leftover, and is refused; anything else — untagged, another workspace's,\n * unreadable — is not ours, and the app moves to the next free port.\n *\n * The choice is kept in `.gkm/app-ports.json`, not recomputed: an app that\n * moved stays where it moved, so a bookmark or a phone's saved address does not\n * break the next time the other project happens to be stopped. Local only —\n * `gkm deploy` and `gkm docker` never read it.\n */\n\nimport { execFileSync } from 'node:child_process';\nimport { readFileSync } from 'node:fs';\nimport { mkdir, readFile, writeFile } from 'node:fs/promises';\nimport { join, resolve } from 'node:path';\nimport type { NormalizedWorkspace } from '../workspace/types.js';\n\n/** Carried by every app process gkm starts: `<workspace root>#<app>`. */\nexport const APP_TAG_ENV = 'GKM_DEV_APP';\n\nconst APP_PORTS_PATH = '.gkm/app-ports.json';\n\n/** The tag an app's processes carry. The root is encoded, so it has no spaces. */\nexport function appTag(root: string, app: string): string {\n\treturn `${encodeURIComponent(resolve(root))}#${app}`;\n}\n\n/** What listens on a port, and the tag it carries if it can be read. */\nexport interface PortHolder {\n\tpid: number;\n\tcommand?: string;\n\ttag?: string;\n}\n\n/** Says, as `command (pid N)`, what holds a port. */\nexport function describeHolder(holder: PortHolder | undefined): string {\n\tif (!holder) return 'another process';\n\treturn `${holder.command ?? 'a process'} (pid ${holder.pid})`;\n}\n\n/**\n * Who is listening on a port, read the way a person would: `lsof` for the\n * pid, then that process's environment for its tag — `/proc/<pid>/environ` on\n * Linux, `ps eww` elsewhere. Both work for the user's own processes, which is\n * every process gkm starts; one that cannot be read has no tag, so is not ours.\n */\nexport function holderOf(port: number): PortHolder | undefined {\n\tlet out: string;\n\ttry {\n\t\tout = execFileSync(\n\t\t\t'lsof',\n\t\t\t['-nP', `-iTCP:${port}`, '-sTCP:LISTEN', '-Fpc'],\n\t\t\t{ encoding: 'utf8', stdio: ['ignore', 'pipe', 'ignore'] },\n\t\t);\n\t} catch {\n\t\treturn undefined;\n\t}\n\n\tconst pid = Number(out.match(/^p(\\d+)/m)?.[1]);\n\tif (!pid) return undefined;\n\tconst command = out.match(/^c(.+)$/m)?.[1];\n\tconst tag = lineageTagOf(pid);\n\n\treturn {\n\t\tpid,\n\t\t...(command ? { command } : {}),\n\t\t...(tag ? { tag } : {}),\n\t};\n}\n\n/** How far up a holder's parents to look before calling it untagged. */\nconst MAX_ANCESTORS = 8;\n\n/**\n * The tag of `pid`, or of its nearest parent that has one.\n *\n * A process can hide the tag it inherited: `next-server` renames itself, which\n * on macOS overwrites the memory `ps eww` reads its environment from, so `ps`\n * shows only its title. Its parent, the `next dev` gkm started, still carries\n * the tag. A child is only ever started by its parent, so a tagged parent makes\n * the holder this app's.\n */\nfunction lineageTagOf(pid: number): string | undefined {\n\tlet current: number | undefined = pid;\n\tfor (let depth = 0; current && current > 1; depth += 1) {\n\t\tconst tag = tagOf(current);\n\t\tif (tag || depth === MAX_ANCESTORS) return tag;\n\t\tcurrent = parentOf(current);\n\t}\n\treturn undefined;\n}\n\nfunction tagOf(pid: number): string | undefined {\n\tconst prefix = `${APP_TAG_ENV}=`;\n\ttry {\n\t\tconst entries =\n\t\t\tprocess.platform === 'linux'\n\t\t\t\t? readFileSync(`/proc/${pid}/environ`, 'utf8').split('\\0')\n\t\t\t\t: execFileSync('ps', ['eww', '-o', 'command=', '-p', String(pid)], {\n\t\t\t\t\t\tencoding: 'utf8',\n\t\t\t\t\t\tstdio: ['ignore', 'pipe', 'ignore'],\n\t\t\t\t\t}).split(/\\s+/);\n\t\treturn entries\n\t\t\t.find((entry) => entry.startsWith(prefix))\n\t\t\t?.slice(prefix.length);\n\t} catch {\n\t\treturn undefined;\n\t}\n}\n\nfunction parentOf(pid: number): number | undefined {\n\ttry {\n\t\tconst ppid = Number(\n\t\t\texecFileSync('ps', ['-o', 'ppid=', '-p', String(pid)], {\n\t\t\t\tencoding: 'utf8',\n\t\t\t\tstdio: ['ignore', 'pipe', 'ignore'],\n\t\t\t}).trim(),\n\t\t);\n\t\treturn ppid > 0 ? ppid : undefined;\n\t} catch {\n\t\treturn undefined;\n\t}\n}\n\n/** The ports apps were given before, by app name. */\nexport async function savedAppPorts(\n\troot: string,\n): Promise<Record<string, number>> {\n\ttry {\n\t\treturn JSON.parse(await readFile(join(root, APP_PORTS_PATH), 'utf8'));\n\t} catch {\n\t\treturn {};\n\t}\n}\n\nasync function saveAppPorts(\n\troot: string,\n\tports: Record<string, number>,\n): Promise<void> {\n\tawait mkdir(join(root, '.gkm'), { recursive: true });\n\tawait writeFile(\n\t\tjoin(root, APP_PORTS_PATH),\n\t\t`${JSON.stringify(ports, null, 2)}\\n`,\n\t);\n}\n\n/** The workspace, with each app on the port it was given locally. */\nexport function withAppPorts(\n\tworkspace: NormalizedWorkspace,\n\tports: Readonly<Record<string, number>>,\n): NormalizedWorkspace {\n\tconst apps = Object.fromEntries(\n\t\tObject.entries(workspace.apps).map(([name, app]) => [\n\t\t\tname,\n\t\t\tports[name] ? { ...app, port: ports[name] } : app,\n\t\t]),\n\t);\n\treturn { ...workspace, apps };\n}\n\n/** An app this workspace already has running — left by a previous start. */\nexport interface AppRunning {\n\tapp: string;\n\tport: number;\n\tholder: PortHolder;\n}\n\n/** An app that moved, because another project holds its port. */\nexport interface AppMoved {\n\tapp: string;\n\tfrom: number;\n\tto: number;\n\tholder: PortHolder | undefined;\n}\n\nexport interface AppPortsDeps {\n\t/** Whether a port can be bound right now. */\n\tfree: (port: number) => Promise<boolean>;\n\t/** Who holds a port. */\n\tholder: (port: number) => PortHolder | undefined;\n}\n\n/**\n * Give each named app a local port: the one it had, or its usual one, unless\n * another project holds it — then the next free one, which is kept.\n *\n * @returns every app's port, the apps that moved, and the apps this workspace\n *   already has running (the caller refuses to start those).\n */\nexport async function assignAppPorts(\n\tworkspace: NormalizedWorkspace,\n\tnames: readonly string[],\n\tdeps: AppPortsDeps,\n): Promise<{\n\tports: Record<string, number>;\n\tmoved: AppMoved[];\n\trunning: AppRunning[];\n}> {\n\tconst saved = await savedAppPorts(workspace.root);\n\tconst wanted: Record<string, number> = {};\n\tfor (const name of names) {\n\t\tconst port = saved[name] ?? workspace.apps[name]?.port;\n\t\tif (port) wanted[name] = port;\n\t}\n\n\t// Every app's wanted port is reserved before any moves, so one that moves\n\t// never lands on a sibling's.\n\tconst taken = new Set([...Object.values(saved), ...Object.values(wanted)]);\n\tconst ports: Record<string, number> = { ...saved };\n\tconst moved: AppMoved[] = [];\n\tconst running: AppRunning[] = [];\n\n\t// Sorted, so which app moves first — and where — does not depend on order.\n\tfor (const name of Object.keys(wanted).sort()) {\n\t\tconst want = wanted[name]!;\n\t\tports[name] = want;\n\t\tif (await deps.free(want)) continue;\n\n\t\tconst holder = deps.holder(want);\n\t\tif (holder?.tag === appTag(workspace.root, name)) {\n\t\t\trunning.push({ app: name, port: want, holder });\n\t\t\tcontinue;\n\t\t}\n\n\t\tlet next = want + 1;\n\t\twhile (taken.has(next) || !(await deps.free(next))) next += 1;\n\t\ttaken.add(next);\n\t\tports[name] = next;\n\t\tmoved.push({ app: name, from: want, to: next, holder });\n\t}\n\n\tawait saveAppPorts(workspace.root, ports);\n\treturn { ports, moved, running };\n}\n"],"mappings":";;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;AAiCA,MAAa,cAAc;AAE3B,MAAM,iBAAiB;;AAGvB,SAAgB,OAAO,MAAc,KAAqB;CACzD,OAAO,GAAG,oBAAA,GAAmBA,UAAAA,QAAAA,CAAQ,IAAI,CAAC,EAAE,GAAG;AAChD;;AAUA,SAAgB,eAAe,QAAwC;CACtE,IAAI,CAAC,QAAQ,OAAO;CACpB,OAAO,GAAG,OAAO,WAAW,YAAY,QAAQ,OAAO,IAAI;AAC5D;;;;;;;AAQA,SAAgB,SAAS,MAAsC;CAC9D,IAAI;CACJ,IAAI;EACH,OAAA,GAAMC,mBAAAA,aAAAA,CACL,QACA;GAAC;GAAO,SAAS;GAAQ;GAAgB;EAAM,GAC/C;GAAE,UAAU;GAAQ,OAAO;IAAC;IAAU;IAAQ;GAAQ;EAAE,CACzD;CACD,QAAQ;EACP;CACD;CAEA,MAAM,MAAM,OAAO,IAAI,MAAM,UAAU,CAAC,GAAG,EAAE;CAC7C,IAAI,CAAC,KAAK,OAAO,KAAA;CACjB,MAAM,UAAU,IAAI,MAAM,UAAU,CAAC,GAAG;CACxC,MAAM,MAAM,aAAa,GAAG;CAE5B,OAAO;EACN;EACA,GAAI,UAAU,EAAE,QAAQ,IAAI,CAAC;EAC7B,GAAI,MAAM,EAAE,IAAI,IAAI,CAAC;CACtB;AACD;;AAGA,MAAM,gBAAgB;;;;;;;;;;AAWtB,SAAS,aAAa,KAAiC;CACtD,IAAI,UAA8B;CAClC,KAAK,IAAI,QAAQ,GAAG,WAAW,UAAU,GAAG,SAAS,GAAG;EACvD,MAAM,MAAM,MAAM,OAAO;EACzB,IAAI,OAAO,UAAU,eAAe,OAAO;EAC3C,UAAU,SAAS,OAAO;CAC3B;AAED;AAEA,SAAS,MAAM,KAAiC;CAC/C,MAAM,SAAS,GAAG,YAAY;CAC9B,IAAI;EAQH,QANC,QAAQ,aAAa,WAAA,GAClBC,QAAAA,aAAAA,CAAa,SAAS,IAAI,WAAW,MAAM,CAAC,CAAC,MAAM,IAAI,KAAA,GACvDD,mBAAAA,aAAAA,CAAa,MAAM;GAAC;GAAO;GAAM;GAAY;GAAM,OAAO,GAAG;EAAC,GAAG;GACjE,UAAU;GACV,OAAO;IAAC;IAAU;IAAQ;GAAQ;EACnC,CAAC,CAAC,CAAC,MAAM,KAAK,EAAA,CAEf,MAAM,UAAU,MAAM,WAAW,MAAM,CAAC,CAAC,EACxC,MAAM,OAAO,MAAM;CACvB,QAAQ;EACP;CACD;AACD;AAEA,SAAS,SAAS,KAAiC;CAClD,IAAI;EACH,MAAM,OAAO,QAAA,GACZA,mBAAAA,aAAAA,CAAa,MAAM;GAAC;GAAM;GAAS;GAAM,OAAO,GAAG;EAAC,GAAG;GACtD,UAAU;GACV,OAAO;IAAC;IAAU;IAAQ;GAAQ;EACnC,CAAC,CAAC,CAAC,KAAK,CACT;EACA,OAAO,OAAO,IAAI,OAAO,KAAA;CAC1B,QAAQ;EACP;CACD;AACD;;AAGA,eAAsB,cACrB,MACkC;CAClC,IAAI;EACH,OAAO,KAAK,MAAM,OAAA,GAAME,iBAAAA,SAAAA,EAAAA,GAASC,UAAAA,KAAAA,CAAK,MAAM,cAAc,GAAG,MAAM,CAAC;CACrE,QAAQ;EACP,OAAO,CAAC;CACT;AACD;AAEA,eAAe,aACd,MACA,OACgB;CAChB,OAAA,GAAMC,iBAAAA,MAAAA,EAAAA,GAAMD,UAAAA,KAAAA,CAAK,MAAM,MAAM,GAAG,EAAE,WAAW,KAAK,CAAC;CACnD,OAAA,GAAME,iBAAAA,UAAAA,EAAAA,GACLF,UAAAA,KAAAA,CAAK,MAAM,cAAc,GACzB,GAAG,KAAK,UAAU,OAAO,MAAM,CAAC,EAAE,GACnC;AACD;;AAGA,SAAgB,aACf,WACA,OACsB;CACtB,MAAM,OAAO,OAAO,YACnB,OAAO,QAAQ,UAAU,IAAI,CAAC,CAAC,KAAK,CAAC,MAAM,SAAS,CACnD,MACA,MAAM,QAAQ;EAAE,GAAG;EAAK,MAAM,MAAM;CAAM,IAAI,GAC/C,CAAC,CACF;CACA,OAAO;EAAE,GAAG;EAAW;CAAK;AAC7B;;;;;;;;AA+BA,eAAsB,eACrB,WACA,OACA,MAKE;CACF,MAAM,QAAQ,MAAM,cAAc,UAAU,IAAI;CAChD,MAAM,SAAiC,CAAC;CACxC,KAAK,MAAM,QAAQ,OAAO;EACzB,MAAM,OAAO,MAAM,SAAS,UAAU,KAAK,KAAK,EAAE;EAClD,IAAI,MAAM,OAAO,QAAQ;CAC1B;CAIA,MAAM,wBAAQ,IAAI,IAAI,CAAC,GAAG,OAAO,OAAO,KAAK,GAAG,GAAG,OAAO,OAAO,MAAM,CAAC,CAAC;CACzE,MAAM,QAAgC,EAAE,GAAG,MAAM;CACjD,MAAM,QAAoB,CAAC;CAC3B,MAAM,UAAwB,CAAC;CAG/B,KAAK,MAAM,QAAQ,OAAO,KAAK,MAAM,CAAC,CAAC,KAAK,GAAG;EAC9C,MAAM,OAAO,OAAO;EACpB,MAAM,QAAQ;EACd,IAAI,MAAM,KAAK,KAAK,IAAI,GAAG;EAE3B,MAAM,SAAS,KAAK,OAAO,IAAI;EAC/B,IAAI,QAAQ,QAAQ,OAAO,UAAU,MAAM,IAAI,GAAG;GACjD,QAAQ,KAAK;IAAE,KAAK;IAAM,MAAM;IAAM;GAAO,CAAC;GAC9C;EACD;EAEA,IAAI,OAAO,OAAO;EAClB,OAAO,MAAM,IAAI,IAAI,KAAK,CAAE,MAAM,KAAK,KAAK,IAAI,GAAI,QAAQ;EAC5D,MAAM,IAAI,IAAI;EACd,MAAM,QAAQ;EACd,MAAM,KAAK;GAAE,KAAK;GAAM,MAAM;GAAM,IAAI;GAAM;EAAO,CAAC;CACvD;CAEA,MAAM,aAAa,UAAU,MAAM,KAAK;CACxC,OAAO;EAAE;EAAO;EAAO;CAAQ;AAChC"}

package/dist/aws-DkHdTV-p.cjs

@@ -0,0 +1,61 @@
+let _aws_sdk_client_ssm = require("@aws-sdk/client-ssm");
+//#region src/secrets/aws.ts
+/**
+* A stage's secrets in SSM Parameter Store, in the stage's own AWS account.
+*
+* One parameter per stage, `/gkm/<project>/<stage>/secrets`, a SecureString —
+* encrypted at rest by KMS, so nothing about it needs a key file anywhere.
+* Which account it is in is whichever credentials are active: the stage's
+* OIDC role in a deploy job, or `--profile` on a developer's machine. With
+* staging and production in different accounts, each stage's secrets sit
+* beside its infrastructure, and a staging role cannot read production's.
+*/
+/** The parameter a stage's secrets are kept in. */
+function secretsParameterName(project, stage) {
+	return `/gkm/${project}/${stage}/secrets`;
+}
+var AwsSecretsStore = class {
+	options;
+	name = "ssm";
+	client;
+	constructor(options) {
+		this.options = options;
+	}
+	async ssm() {
+		if (this.client) return this.client;
+		const config = { region: this.options.region };
+		if (this.options.profile) {
+			const { fromIni } = await import("@aws-sdk/credential-providers");
+			config.credentials = fromIni({ profile: this.options.profile });
+		}
+		if (this.options.endpoint) config.endpoint = this.options.endpoint;
+		this.client = new _aws_sdk_client_ssm.SSMClient(config);
+		return this.client;
+	}
+	async read(stage) {
+		const ssm = await this.ssm();
+		try {
+			const { Parameter } = await ssm.send(new _aws_sdk_client_ssm.GetParameterCommand({
+				Name: secretsParameterName(this.options.project, stage),
+				WithDecryption: true
+			}));
+			return Parameter?.Value ? JSON.parse(Parameter.Value) : null;
+		} catch (error) {
+			if (error instanceof _aws_sdk_client_ssm.ParameterNotFound) return null;
+			throw error;
+		}
+	}
+	async write(stage, secrets) {
+		await (await this.ssm()).send(new _aws_sdk_client_ssm.PutParameterCommand({
+			Name: secretsParameterName(this.options.project, stage),
+			Value: JSON.stringify(secrets),
+			Type: "SecureString",
+			Overwrite: true,
+			Description: `gkm secrets for ${this.options.project}/${stage}`
+		}));
+	}
+};
+//#endregion
+exports.AwsSecretsStore = AwsSecretsStore;
+
+//# sourceMappingURL=aws-DkHdTV-p.cjs.map

package/dist/aws-DkHdTV-p.cjs.map

@@ -0,0 +1 @@
+{"version":3,"file":"aws-DkHdTV-p.cjs","names":["SSMClient","GetParameterCommand","ParameterNotFound","PutParameterCommand"],"sources":["../src/secrets/aws.ts"],"sourcesContent":["/**\n * A stage's secrets in SSM Parameter Store, in the stage's own AWS account.\n *\n * One parameter per stage, `/gkm/<project>/<stage>/secrets`, a SecureString —\n * encrypted at rest by KMS, so nothing about it needs a key file anywhere.\n * Which account it is in is whichever credentials are active: the stage's\n * OIDC role in a deploy job, or `--profile` on a developer's machine. With\n * staging and production in different accounts, each stage's secrets sit\n * beside its infrastructure, and a staging role cannot read production's.\n */\n\nimport {\n\tGetParameterCommand,\n\tParameterNotFound,\n\tPutParameterCommand,\n\tSSMClient,\n\ttype SSMClientConfig,\n} from '@aws-sdk/client-ssm';\nimport type { SecretsStore } from './store.js';\nimport type { StageSecrets } from './types.js';\n\nexport interface AwsSecretsStoreOptions {\n\t/** The workspace name, which scopes the parameter path. */\n\tproject: string;\n\tregion: string;\n\t/**\n\t * A named AWS profile, resolved with `fromIni` only. The default chain\n\t * reads AWS_* from the environment first, so exported staging keys would\n\t * win over `--profile prod` and put production's secrets in staging.\n\t */\n\tprofile?: string;\n\t/** For tests: an endpoint such as the AWS emulator. */\n\tendpoint?: string;\n}\n\n/** The parameter a stage's secrets are kept in. */\nexport function secretsParameterName(project: string, stage: string): string {\n\treturn `/gkm/${project}/${stage}/secrets`;\n}\n\nexport class AwsSecretsStore implements SecretsStore {\n\treadonly name = 'ssm';\n\n\tprivate client?: SSMClient;\n\n\tconstructor(private readonly options: AwsSecretsStoreOptions) {}\n\n\tprivate async ssm(): Promise<SSMClient> {\n\t\tif (this.client) return this.client;\n\n\t\tconst config: SSMClientConfig = { region: this.options.region };\n\t\tif (this.options.profile) {\n\t\t\tconst { fromIni } = await import('@aws-sdk/credential-providers');\n\t\t\tconfig.credentials = fromIni({ profile: this.options.profile });\n\t\t}\n\t\tif (this.options.endpoint) {\n\t\t\tconfig.endpoint = this.options.endpoint;\n\t\t}\n\n\t\tthis.client = new SSMClient(config);\n\t\treturn this.client;\n\t}\n\n\tasync read(stage: string): Promise<StageSecrets | null> {\n\t\tconst ssm = await this.ssm();\n\n\t\ttry {\n\t\t\tconst { Parameter } = await ssm.send(\n\t\t\t\tnew GetParameterCommand({\n\t\t\t\t\tName: secretsParameterName(this.options.project, stage),\n\t\t\t\t\tWithDecryption: true,\n\t\t\t\t}),\n\t\t\t);\n\t\t\treturn Parameter?.Value\n\t\t\t\t? (JSON.parse(Parameter.Value) as StageSecrets)\n\t\t\t\t: null;\n\t\t} catch (error) {\n\t\t\tif (error instanceof ParameterNotFound) return null;\n\t\t\tthrow error;\n\t\t}\n\t}\n\n\tasync write(stage: string, secrets: StageSecrets): Promise<void> {\n\t\tconst ssm = await this.ssm();\n\n\t\tawait ssm.send(\n\t\t\tnew PutParameterCommand({\n\t\t\t\tName: secretsParameterName(this.options.project, stage),\n\t\t\t\tValue: JSON.stringify(secrets),\n\t\t\t\tType: 'SecureString',\n\t\t\t\tOverwrite: true,\n\t\t\t\tDescription: `gkm secrets for ${this.options.project}/${stage}`,\n\t\t\t}),\n\t\t);\n\t}\n}\n"],"mappings":";;;;;;;;;;;;;AAoCA,SAAgB,qBAAqB,SAAiB,OAAuB;CAC5E,OAAO,QAAQ,QAAQ,GAAG,MAAM;AACjC;AAEA,IAAa,kBAAb,MAAqD;CAKvB;CAJ7B,OAAgB;CAEhB;CAEA,YAAY,SAAkD;EAAjC,KAAA,UAAA;CAAkC;CAE/D,MAAc,MAA0B;EACvC,IAAI,KAAK,QAAQ,OAAO,KAAK;EAE7B,MAAM,SAA0B,EAAE,QAAQ,KAAK,QAAQ,OAAO;EAC9D,IAAI,KAAK,QAAQ,SAAS;GACzB,MAAM,EAAE,YAAY,MAAM,OAAO;GACjC,OAAO,cAAc,QAAQ,EAAE,SAAS,KAAK,QAAQ,QAAQ,CAAC;EAC/D;EACA,IAAI,KAAK,QAAQ,UAChB,OAAO,WAAW,KAAK,QAAQ;EAGhC,KAAK,SAAS,IAAIA,oBAAAA,UAAU,MAAM;EAClC,OAAO,KAAK;CACb;CAEA,MAAM,KAAK,OAA6C;EACvD,MAAM,MAAM,MAAM,KAAK,IAAI;EAE3B,IAAI;GACH,MAAM,EAAE,cAAc,MAAM,IAAI,KAC/B,IAAIC,oBAAAA,oBAAoB;IACvB,MAAM,qBAAqB,KAAK,QAAQ,SAAS,KAAK;IACtD,gBAAgB;GACjB,CAAC,CACF;GACA,OAAO,WAAW,QACd,KAAK,MAAM,UAAU,KAAK,IAC3B;EACJ,SAAS,OAAO;GACf,IAAI,iBAAiBC,oBAAAA,mBAAmB,OAAO;GAC/C,MAAM;EACP;CACD;CAEA,MAAM,MAAM,OAAe,SAAsC;EAGhE,OAAM,MAFY,KAAK,IAAI,EAAA,CAEjB,KACT,IAAIC,oBAAAA,oBAAoB;GACvB,MAAM,qBAAqB,KAAK,QAAQ,SAAS,KAAK;GACtD,OAAO,KAAK,UAAU,OAAO;GAC7B,MAAM;GACN,WAAW;GACX,aAAa,mBAAmB,KAAK,QAAQ,QAAQ,GAAG;EACzD,CAAC,CACF;CACD;AACD"}

package/dist/aws-DojzQnLd.mjs

@@ -0,0 +1,61 @@
+import { GetParameterCommand, ParameterNotFound, PutParameterCommand, SSMClient } from "@aws-sdk/client-ssm";
+//#region src/secrets/aws.ts
+/**
+* A stage's secrets in SSM Parameter Store, in the stage's own AWS account.
+*
+* One parameter per stage, `/gkm/<project>/<stage>/secrets`, a SecureString —
+* encrypted at rest by KMS, so nothing about it needs a key file anywhere.
+* Which account it is in is whichever credentials are active: the stage's
+* OIDC role in a deploy job, or `--profile` on a developer's machine. With
+* staging and production in different accounts, each stage's secrets sit
+* beside its infrastructure, and a staging role cannot read production's.
+*/
+/** The parameter a stage's secrets are kept in. */
+function secretsParameterName(project, stage) {
+	return `/gkm/${project}/${stage}/secrets`;
+}
+var AwsSecretsStore = class {
+	options;
+	name = "ssm";
+	client;
+	constructor(options) {
+		this.options = options;
+	}
+	async ssm() {
+		if (this.client) return this.client;
+		const config = { region: this.options.region };
+		if (this.options.profile) {
+			const { fromIni } = await import("@aws-sdk/credential-providers");
+			config.credentials = fromIni({ profile: this.options.profile });
+		}
+		if (this.options.endpoint) config.endpoint = this.options.endpoint;
+		this.client = new SSMClient(config);
+		return this.client;
+	}
+	async read(stage) {
+		const ssm = await this.ssm();
+		try {
+			const { Parameter } = await ssm.send(new GetParameterCommand({
+				Name: secretsParameterName(this.options.project, stage),
+				WithDecryption: true
+			}));
+			return Parameter?.Value ? JSON.parse(Parameter.Value) : null;
+		} catch (error) {
+			if (error instanceof ParameterNotFound) return null;
+			throw error;
+		}
+	}
+	async write(stage, secrets) {
+		await (await this.ssm()).send(new PutParameterCommand({
+			Name: secretsParameterName(this.options.project, stage),
+			Value: JSON.stringify(secrets),
+			Type: "SecureString",
+			Overwrite: true,
+			Description: `gkm secrets for ${this.options.project}/${stage}`
+		}));
+	}
+};
+//#endregion
+export { AwsSecretsStore };
+
+//# sourceMappingURL=aws-DojzQnLd.mjs.map

package/dist/aws-DojzQnLd.mjs.map

@@ -0,0 +1 @@
+{"version":3,"file":"aws-DojzQnLd.mjs","names":[],"sources":["../src/secrets/aws.ts"],"sourcesContent":["/**\n * A stage's secrets in SSM Parameter Store, in the stage's own AWS account.\n *\n * One parameter per stage, `/gkm/<project>/<stage>/secrets`, a SecureString —\n * encrypted at rest by KMS, so nothing about it needs a key file anywhere.\n * Which account it is in is whichever credentials are active: the stage's\n * OIDC role in a deploy job, or `--profile` on a developer's machine. With\n * staging and production in different accounts, each stage's secrets sit\n * beside its infrastructure, and a staging role cannot read production's.\n */\n\nimport {\n\tGetParameterCommand,\n\tParameterNotFound,\n\tPutParameterCommand,\n\tSSMClient,\n\ttype SSMClientConfig,\n} from '@aws-sdk/client-ssm';\nimport type { SecretsStore } from './store.js';\nimport type { StageSecrets } from './types.js';\n\nexport interface AwsSecretsStoreOptions {\n\t/** The workspace name, which scopes the parameter path. */\n\tproject: string;\n\tregion: string;\n\t/**\n\t * A named AWS profile, resolved with `fromIni` only. The default chain\n\t * reads AWS_* from the environment first, so exported staging keys would\n\t * win over `--profile prod` and put production's secrets in staging.\n\t */\n\tprofile?: string;\n\t/** For tests: an endpoint such as the AWS emulator. */\n\tendpoint?: string;\n}\n\n/** The parameter a stage's secrets are kept in. */\nexport function secretsParameterName(project: string, stage: string): string {\n\treturn `/gkm/${project}/${stage}/secrets`;\n}\n\nexport class AwsSecretsStore implements SecretsStore {\n\treadonly name = 'ssm';\n\n\tprivate client?: SSMClient;\n\n\tconstructor(private readonly options: AwsSecretsStoreOptions) {}\n\n\tprivate async ssm(): Promise<SSMClient> {\n\t\tif (this.client) return this.client;\n\n\t\tconst config: SSMClientConfig = { region: this.options.region };\n\t\tif (this.options.profile) {\n\t\t\tconst { fromIni } = await import('@aws-sdk/credential-providers');\n\t\t\tconfig.credentials = fromIni({ profile: this.options.profile });\n\t\t}\n\t\tif (this.options.endpoint) {\n\t\t\tconfig.endpoint = this.options.endpoint;\n\t\t}\n\n\t\tthis.client = new SSMClient(config);\n\t\treturn this.client;\n\t}\n\n\tasync read(stage: string): Promise<StageSecrets | null> {\n\t\tconst ssm = await this.ssm();\n\n\t\ttry {\n\t\t\tconst { Parameter } = await ssm.send(\n\t\t\t\tnew GetParameterCommand({\n\t\t\t\t\tName: secretsParameterName(this.options.project, stage),\n\t\t\t\t\tWithDecryption: true,\n\t\t\t\t}),\n\t\t\t);\n\t\t\treturn Parameter?.Value\n\t\t\t\t? (JSON.parse(Parameter.Value) as StageSecrets)\n\t\t\t\t: null;\n\t\t} catch (error) {\n\t\t\tif (error instanceof ParameterNotFound) return null;\n\t\t\tthrow error;\n\t\t}\n\t}\n\n\tasync write(stage: string, secrets: StageSecrets): Promise<void> {\n\t\tconst ssm = await this.ssm();\n\n\t\tawait ssm.send(\n\t\t\tnew PutParameterCommand({\n\t\t\t\tName: secretsParameterName(this.options.project, stage),\n\t\t\t\tValue: JSON.stringify(secrets),\n\t\t\t\tType: 'SecureString',\n\t\t\t\tOverwrite: true,\n\t\t\t\tDescription: `gkm secrets for ${this.options.project}/${stage}`,\n\t\t\t}),\n\t\t);\n\t}\n}\n"],"mappings":";;;;;;;;;;;;;AAoCA,SAAgB,qBAAqB,SAAiB,OAAuB;CAC5E,OAAO,QAAQ,QAAQ,GAAG,MAAM;AACjC;AAEA,IAAa,kBAAb,MAAqD;CAKvB;CAJ7B,OAAgB;CAEhB;CAEA,YAAY,SAAkD;EAAjC,KAAA,UAAA;CAAkC;CAE/D,MAAc,MAA0B;EACvC,IAAI,KAAK,QAAQ,OAAO,KAAK;EAE7B,MAAM,SAA0B,EAAE,QAAQ,KAAK,QAAQ,OAAO;EAC9D,IAAI,KAAK,QAAQ,SAAS;GACzB,MAAM,EAAE,YAAY,MAAM,OAAO;GACjC,OAAO,cAAc,QAAQ,EAAE,SAAS,KAAK,QAAQ,QAAQ,CAAC;EAC/D;EACA,IAAI,KAAK,QAAQ,UAChB,OAAO,WAAW,KAAK,QAAQ;EAGhC,KAAK,SAAS,IAAI,UAAU,MAAM;EAClC,OAAO,KAAK;CACb;CAEA,MAAM,KAAK,OAA6C;EACvD,MAAM,MAAM,MAAM,KAAK,IAAI;EAE3B,IAAI;GACH,MAAM,EAAE,cAAc,MAAM,IAAI,KAC/B,IAAI,oBAAoB;IACvB,MAAM,qBAAqB,KAAK,QAAQ,SAAS,KAAK;IACtD,gBAAgB;GACjB,CAAC,CACF;GACA,OAAO,WAAW,QACd,KAAK,MAAM,UAAU,KAAK,IAC3B;EACJ,SAAS,OAAO;GACf,IAAI,iBAAiB,mBAAmB,OAAO;GAC/C,MAAM;EACP;CACD;CAEA,MAAM,MAAM,OAAe,SAAsC;EAGhE,OAAM,MAFY,KAAK,IAAI,EAAA,CAEjB,KACT,IAAI,oBAAoB;GACvB,MAAM,qBAAqB,KAAK,QAAQ,SAAS,KAAK;GACtD,OAAO,KAAK,UAAU,OAAO;GAC7B,MAAM;GACN,WAAW;GACX,aAAa,mBAAmB,KAAK,QAAQ,QAAQ,GAAG;EACzD,CAAC,CACF;CACD;AACD"}

package/dist/{backup-provisioner-BrsHwYG0.cjs → backup-provisioner-BmhIO_Yr.cjs}

@@ -1,9 +1,13 @@
-const require_chunk = require('./chunk-CUT6urMc.cjs');
-const __aws_sdk_client_s3 = require_chunk.__toESM(require("@aws-sdk/client-s3"));
-const __aws_sdk_client_iam = require_chunk.__toESM(require("@aws-sdk/client-iam"));
-
+let _aws_sdk_client_s3 = require("@aws-sdk/client-s3");
+let _aws_sdk_client_iam = require("@aws-sdk/client-iam");
 //#region src/deploy/backup-provisioner.ts
 /**
+* Backup Destination Provisioner
+*
+* Creates AWS resources (S3 bucket, IAM user, access keys) and configures
+* Dokploy backup destinations for database backups.
+*/
+/**
 * Generate a random suffix for unique resource names
 */
 function randomSuffix() {
@@ -33,8 +37,8 @@ async function createAwsClients(region, profile, endpoint) {
 		};
 	}
 	return {
-		s3: new __aws_sdk_client_s3.S3Client(config),
-		iam: new __aws_sdk_client_iam.IAMClient(config)
+		s3: new _aws_sdk_client_s3.S3Client(config),
+		iam: new _aws_sdk_client_iam.IAMClient(config)
 	};
 }
 /**
@@ -42,7 +46,7 @@ async function createAwsClients(region, profile, endpoint) {
 */
 async function bucketExists(s3, bucketName) {
 	try {
-		await s3.send(new __aws_sdk_client_s3.HeadBucketCommand({ Bucket: bucketName }));
+		await s3.send(new _aws_sdk_client_s3.HeadBucketCommand({ Bucket: bucketName }));
 		return true;
 	} catch (error) {
 		if (error.name === "NotFound") return false;
@@ -55,7 +59,7 @@ async function bucketExists(s3, bucketName) {
 */
 async function userExists(iam, userName) {
 	try {
-		await iam.send(new __aws_sdk_client_iam.GetUserCommand({ UserName: userName }));
+		await iam.send(new _aws_sdk_client_iam.GetUserCommand({ UserName: userName }));
 		return true;
 	} catch (error) {
 		const errorName = error.name;
@@ -81,22 +85,20 @@ async function provisionBackupDestination(options) {
 	const aws = await createAwsClients(config.region, config.profile, awsEndpoint);
 	const sanitizedProject = sanitizeName(projectName);
 	const bucketName = existingState?.bucketName ?? `${sanitizedProject}-${stage}-backups-${randomSuffix()}`;
-	const bucketAlreadyExists = await bucketExists(aws.s3, bucketName);
-	if (!bucketAlreadyExists) {
+	if (!await bucketExists(aws.s3, bucketName)) {
 		logger.log(`   Creating S3 bucket: ${bucketName}`);
 		const createBucketParams = { Bucket: bucketName };
 		if (config.region !== "us-east-1") createBucketParams.CreateBucketConfiguration = { LocationConstraint: config.region };
-		await aws.s3.send(new __aws_sdk_client_s3.CreateBucketCommand(createBucketParams));
-		await aws.s3.send(new __aws_sdk_client_s3.PutBucketVersioningCommand({
+		await aws.s3.send(new _aws_sdk_client_s3.CreateBucketCommand(createBucketParams));
+		await aws.s3.send(new _aws_sdk_client_s3.PutBucketVersioningCommand({
 			Bucket: bucketName,
 			VersioningConfiguration: { Status: "Enabled" }
 		}));
 	} else logger.log(`   Using existing S3 bucket: ${bucketName}`);
 	const iamUserName = existingState?.iamUserName ?? `dokploy-backup-${sanitizedProject}-${stage}`;
-	const iamUserAlreadyExists = await userExists(aws.iam, iamUserName);
-	if (!iamUserAlreadyExists) {
+	if (!await userExists(aws.iam, iamUserName)) {
 		logger.log(`   Creating IAM user: ${iamUserName}`);
-		await aws.iam.send(new __aws_sdk_client_iam.CreateUserCommand({ UserName: iamUserName }));
+		await aws.iam.send(new _aws_sdk_client_iam.CreateUserCommand({ UserName: iamUserName }));
 	} else logger.log(`   Using existing IAM user: ${iamUserName}`);
 	const policyDocument = {
 		Version: "2012-10-17",
@@ -113,7 +115,7 @@ async function provisionBackupDestination(options) {
 		}]
 	};
 	logger.log("   Updating IAM policy");
-	await aws.iam.send(new __aws_sdk_client_iam.PutUserPolicyCommand({
+	await aws.iam.send(new _aws_sdk_client_iam.PutUserPolicyCommand({
 		UserName: iamUserName,
 		PolicyName: "DokployBackupAccess",
 		PolicyDocument: JSON.stringify(policyDocument)
@@ -126,7 +128,7 @@ async function provisionBackupDestination(options) {
 		secretAccessKey = existingState.iamSecretAccessKey;
 	} else {
 		logger.log("   Creating IAM access key");
-		const accessKeyResult = await aws.iam.send(new __aws_sdk_client_iam.CreateAccessKeyCommand({ UserName: iamUserName }));
+		const accessKeyResult = await aws.iam.send(new _aws_sdk_client_iam.CreateAccessKeyCommand({ UserName: iamUserName }));
 		if (!accessKeyResult.AccessKey) throw new Error("Failed to create IAM access key");
 		accessKeyId = accessKeyResult.AccessKey.AccessKeyId;
 		secretAccessKey = accessKeyResult.AccessKey.SecretAccessKey;
@@ -158,7 +160,7 @@ async function provisionBackupDestination(options) {
 		createdAt: existingState?.createdAt ?? (/* @__PURE__ */ new Date()).toISOString()
 	};
 }
-
 //#endregion
 exports.provisionBackupDestination = provisionBackupDestination;
-//# sourceMappingURL=backup-provisioner-BrsHwYG0.cjs.map
+
+//# sourceMappingURL=backup-provisioner-BmhIO_Yr.cjs.map

package/dist/backup-provisioner-BmhIO_Yr.cjs.map

@@ -0,0 +1 @@
+{"version":3,"file":"backup-provisioner-BmhIO_Yr.cjs","names":["S3Client","IAMClient","HeadBucketCommand","GetUserCommand","CreateBucketCommand","PutBucketVersioningCommand","CreateUserCommand","PutUserPolicyCommand","CreateAccessKeyCommand"],"sources":["../src/deploy/backup-provisioner.ts"],"sourcesContent":["/**\n * Backup Destination Provisioner\n *\n * Creates AWS resources (S3 bucket, IAM user, access keys) and configures\n * Dokploy backup destinations for database backups.\n */\n\nimport {\n\tCreateAccessKeyCommand,\n\tCreateUserCommand,\n\tGetUserCommand,\n\tIAMClient,\n\ttype IAMClientConfig,\n\tPutUserPolicyCommand,\n} from '@aws-sdk/client-iam';\nimport {\n\ttype BucketLocationConstraint,\n\tCreateBucketCommand,\n\tHeadBucketCommand,\n\tPutBucketVersioningCommand,\n\tS3Client,\n\ttype S3ClientConfig,\n} from '@aws-sdk/client-s3';\nimport type { BackupsConfig } from '../workspace/types.js';\nimport type { DokployApi } from './dokploy-api.js';\nimport type { BackupState } from './state.js';\n\nexport interface ProvisionBackupOptions {\n\t/** Dokploy API client */\n\tapi: DokployApi;\n\t/** Dokploy project ID */\n\tprojectId: string;\n\t/** Workspace name (used for resource naming) */\n\tprojectName: string;\n\t/** Deploy stage (e.g., 'production', 'staging') */\n\tstage: string;\n\t/** Backup configuration */\n\tconfig: BackupsConfig;\n\t/** Existing backup state (if any) */\n\texistingState?: BackupState;\n\t/** Logger for progress output */\n\tlogger: { log: (msg: string) => void };\n\t/** AWS endpoint override (for testing with LocalStack) */\n\tawsEndpoint?: string;\n}\n\n/**\n * Generate a random suffix for unique resource names\n */\nfunction randomSuffix(): string {\n\treturn Math.random().toString(36).substring(2, 8);\n}\n\n/**\n * Sanitize a name for AWS resources (lowercase alphanumeric and hyphens)\n */\nfunction sanitizeName(name: string): string {\n\treturn name.toLowerCase().replace(/[^a-z0-9-]/g, '-');\n}\n\n/**\n * Create AWS clients with optional profile credentials\n */\nasync function createAwsClients(\n\tregion: string,\n\tprofile?: string,\n\tendpoint?: string,\n): Promise<{ s3: S3Client; iam: IAMClient }> {\n\tconst config: S3ClientConfig & IAMClientConfig = { region };\n\n\tif (profile) {\n\t\tconst { fromIni } = await import('@aws-sdk/credential-providers');\n\t\tconfig.credentials = fromIni({ profile });\n\t}\n\n\t// Support custom endpoint for testing (e.g., LocalStack)\n\tif (endpoint) {\n\t\tconfig.endpoint = endpoint;\n\t\t(config as S3ClientConfig).forcePathStyle = true;\n\t\t// Use test credentials when endpoint is specified\n\t\tconfig.credentials = {\n\t\t\taccessKeyId: 'test',\n\t\t\tsecretAccessKey: 'test',\n\t\t};\n\t}\n\n\treturn {\n\t\ts3: new S3Client(config),\n\t\tiam: new IAMClient(config),\n\t};\n}\n\n/**\n * Check if an S3 bucket exists\n */\nasync function bucketExists(\n\ts3: S3Client,\n\tbucketName: string,\n): Promise<boolean> {\n\ttry {\n\t\tawait s3.send(new HeadBucketCommand({ Bucket: bucketName }));\n\t\treturn true;\n\t} catch (error) {\n\t\tif ((error as { name?: string }).name === 'NotFound') {\n\t\t\treturn false;\n\t\t}\n\t\t// 403 means bucket exists but we don't have access\n\t\tif (\n\t\t\t(error as { $metadata?: { httpStatusCode?: number } }).$metadata\n\t\t\t\t?.httpStatusCode === 403\n\t\t) {\n\t\t\treturn true;\n\t\t}\n\t\tthrow error;\n\t}\n}\n\n/**\n * Check if an IAM user exists\n */\nasync function userExists(iam: IAMClient, userName: string): Promise<boolean> {\n\ttry {\n\t\tawait iam.send(new GetUserCommand({ UserName: userName }));\n\t\treturn true;\n\t} catch (error) {\n\t\tconst errorName = (error as { name?: string }).name;\n\t\t// AWS returns 'NoSuchEntity', LocalStack returns 'NoSuchEntityException'\n\t\tif (errorName === 'NoSuchEntity' || errorName === 'NoSuchEntityException') {\n\t\t\treturn false;\n\t\t}\n\t\tthrow error;\n\t}\n}\n\n/**\n * Provision backup destination for a deployment.\n *\n * Creates AWS resources (S3 bucket, IAM user) and Dokploy destination if needed.\n * Reuses existing resources from state when possible.\n */\nexport async function provisionBackupDestination(\n\toptions: ProvisionBackupOptions,\n): Promise<BackupState> {\n\tconst {\n\t\tapi,\n\t\tprojectName,\n\t\tstage,\n\t\tconfig,\n\t\texistingState,\n\t\tlogger,\n\t\tawsEndpoint,\n\t} = options;\n\n\t// If we have existing state, verify the Dokploy destination still exists\n\tif (existingState?.destinationId) {\n\t\ttry {\n\t\t\tawait api.getDestination(existingState.destinationId);\n\t\t\tlogger.log('   Using existing backup destination');\n\t\t\treturn existingState;\n\t\t} catch {\n\t\t\tlogger.log('   Existing destination not found, recreating...');\n\t\t}\n\t}\n\n\t// Create AWS clients\n\tconst aws = await createAwsClients(\n\t\tconfig.region,\n\t\tconfig.profile,\n\t\tawsEndpoint,\n\t);\n\tconst sanitizedProject = sanitizeName(projectName);\n\n\t// 1. Create or verify S3 bucket\n\tconst bucketName =\n\t\texistingState?.bucketName ??\n\t\t`${sanitizedProject}-${stage}-backups-${randomSuffix()}`;\n\n\tconst bucketAlreadyExists = await bucketExists(aws.s3, bucketName);\n\tif (!bucketAlreadyExists) {\n\t\tlogger.log(`   Creating S3 bucket: ${bucketName}`);\n\n\t\t// CreateBucket needs LocationConstraint for non-us-east-1 regions\n\t\tconst createBucketParams: {\n\t\t\tBucket: string;\n\t\t\tCreateBucketConfiguration?: {\n\t\t\t\tLocationConstraint: BucketLocationConstraint;\n\t\t\t};\n\t\t} = {\n\t\t\tBucket: bucketName,\n\t\t};\n\t\tif (config.region !== 'us-east-1') {\n\t\t\tcreateBucketParams.CreateBucketConfiguration = {\n\t\t\t\tLocationConstraint: config.region as BucketLocationConstraint,\n\t\t\t};\n\t\t}\n\n\t\tawait aws.s3.send(new CreateBucketCommand(createBucketParams));\n\n\t\t// Enable versioning for backup integrity\n\t\tawait aws.s3.send(\n\t\t\tnew PutBucketVersioningCommand({\n\t\t\t\tBucket: bucketName,\n\t\t\t\tVersioningConfiguration: { Status: 'Enabled' },\n\t\t\t}),\n\t\t);\n\t} else {\n\t\tlogger.log(`   Using existing S3 bucket: ${bucketName}`);\n\t}\n\n\t// 2. Create or verify IAM user\n\tconst iamUserName =\n\t\texistingState?.iamUserName ?? `dokploy-backup-${sanitizedProject}-${stage}`;\n\n\tconst iamUserAlreadyExists = await userExists(aws.iam, iamUserName);\n\tif (!iamUserAlreadyExists) {\n\t\tlogger.log(`   Creating IAM user: ${iamUserName}`);\n\t\tawait aws.iam.send(new CreateUserCommand({ UserName: iamUserName }));\n\t} else {\n\t\tlogger.log(`   Using existing IAM user: ${iamUserName}`);\n\t}\n\n\t// 3. Attach bucket policy to IAM user\n\tconst policyDocument = {\n\t\tVersion: '2012-10-17',\n\t\tStatement: [\n\t\t\t{\n\t\t\t\tEffect: 'Allow',\n\t\t\t\tAction: [\n\t\t\t\t\t's3:GetObject',\n\t\t\t\t\t's3:PutObject',\n\t\t\t\t\t's3:DeleteObject',\n\t\t\t\t\t's3:ListBucket',\n\t\t\t\t\t's3:GetBucketLocation',\n\t\t\t\t],\n\t\t\t\tResource: [\n\t\t\t\t\t`arn:aws:s3:::${bucketName}`,\n\t\t\t\t\t`arn:aws:s3:::${bucketName}/*`,\n\t\t\t\t],\n\t\t\t},\n\t\t],\n\t};\n\n\tlogger.log('   Updating IAM policy');\n\tawait aws.iam.send(\n\t\tnew PutUserPolicyCommand({\n\t\t\tUserName: iamUserName,\n\t\t\tPolicyName: 'DokployBackupAccess',\n\t\t\tPolicyDocument: JSON.stringify(policyDocument),\n\t\t}),\n\t);\n\n\t// 4. Create access key (or reuse existing if state has it and destination needs recreation)\n\tlet accessKeyId: string;\n\tlet secretAccessKey: string;\n\n\tif (existingState?.iamAccessKeyId && existingState?.iamSecretAccessKey) {\n\t\t// Reuse existing credentials\n\t\tlogger.log('   Using existing IAM access key');\n\t\taccessKeyId = existingState.iamAccessKeyId;\n\t\tsecretAccessKey = existingState.iamSecretAccessKey;\n\t} else {\n\t\t// Create new access key\n\t\tlogger.log('   Creating IAM access key');\n\t\tconst accessKeyResult = await aws.iam.send(\n\t\t\tnew CreateAccessKeyCommand({ UserName: iamUserName }),\n\t\t);\n\n\t\tif (!accessKeyResult.AccessKey) {\n\t\t\tthrow new Error('Failed to create IAM access key');\n\t\t}\n\n\t\taccessKeyId = accessKeyResult.AccessKey.AccessKeyId!;\n\t\tsecretAccessKey = accessKeyResult.AccessKey.SecretAccessKey!;\n\t}\n\n\t// 5. Create Dokploy destination\n\tconst destinationName = `${sanitizedProject}-${stage}-s3`;\n\tlogger.log(`   Creating Dokploy destination: ${destinationName}`);\n\n\tconst { destination, created } = await api.findOrCreateDestination(\n\t\tdestinationName,\n\t\t{\n\t\t\taccessKey: accessKeyId,\n\t\t\tsecretAccessKey: secretAccessKey,\n\t\t\tbucket: bucketName,\n\t\t\tregion: config.region,\n\t\t},\n\t);\n\n\tif (created) {\n\t\tlogger.log('   ✓ Dokploy destination created');\n\t} else {\n\t\tlogger.log('   ✓ Using existing Dokploy destination');\n\t}\n\n\t// 6. Test connection\n\ttry {\n\t\tawait api.testDestinationConnection(destination.destinationId);\n\t\tlogger.log('   ✓ Destination connection verified');\n\t} catch (error) {\n\t\tlogger.log(\n\t\t\t`   ⚠ Warning: Could not verify destination connection: ${error}`,\n\t\t);\n\t}\n\n\treturn {\n\t\tbucketName,\n\t\tbucketArn: `arn:aws:s3:::${bucketName}`,\n\t\tiamUserName,\n\t\tiamAccessKeyId: accessKeyId,\n\t\tiamSecretAccessKey: secretAccessKey,\n\t\tdestinationId: destination.destinationId,\n\t\tregion: config.region,\n\t\tcreatedAt: existingState?.createdAt ?? new Date().toISOString(),\n\t};\n}\n"],"mappings":";;;;;;;;;;;;AAiDA,SAAS,eAAuB;CAC/B,OAAO,KAAK,OAAO,CAAC,CAAC,SAAS,EAAE,CAAC,CAAC,UAAU,GAAG,CAAC;AACjD;;;;AAKA,SAAS,aAAa,MAAsB;CAC3C,OAAO,KAAK,YAAY,CAAC,CAAC,QAAQ,eAAe,GAAG;AACrD;;;;AAKA,eAAe,iBACd,QACA,SACA,UAC4C;CAC5C,MAAM,SAA2C,EAAE,OAAO;CAE1D,IAAI,SAAS;EACZ,MAAM,EAAE,YAAY,MAAM,OAAO;EACjC,OAAO,cAAc,QAAQ,EAAE,QAAQ,CAAC;CACzC;CAGA,IAAI,UAAU;EACb,OAAO,WAAW;EAClB,OAA2B,iBAAiB;EAE5C,OAAO,cAAc;GACpB,aAAa;GACb,iBAAiB;EAClB;CACD;CAEA,OAAO;EACN,IAAI,IAAIA,mBAAAA,SAAS,MAAM;EACvB,KAAK,IAAIC,oBAAAA,UAAU,MAAM;CAC1B;AACD;;;;AAKA,eAAe,aACd,IACA,YACmB;CACnB,IAAI;EACH,MAAM,GAAG,KAAK,IAAIC,mBAAAA,kBAAkB,EAAE,QAAQ,WAAW,CAAC,CAAC;EAC3D,OAAO;CACR,SAAS,OAAO;EACf,IAAK,MAA4B,SAAS,YACzC,OAAO;EAGR,IACE,MAAsD,WACpD,mBAAmB,KAEtB,OAAO;EAER,MAAM;CACP;AACD;;;;AAKA,eAAe,WAAW,KAAgB,UAAoC;CAC7E,IAAI;EACH,MAAM,IAAI,KAAK,IAAIC,oBAAAA,eAAe,EAAE,UAAU,SAAS,CAAC,CAAC;EACzD,OAAO;CACR,SAAS,OAAO;EACf,MAAM,YAAa,MAA4B;EAE/C,IAAI,cAAc,kBAAkB,cAAc,yBACjD,OAAO;EAER,MAAM;CACP;AACD;;;;;;;AAQA,eAAsB,2BACrB,SACuB;CACvB,MAAM,EACL,KACA,aACA,OACA,QACA,eACA,QACA,gBACG;CAGJ,IAAI,eAAe,eAClB,IAAI;EACH,MAAM,IAAI,eAAe,cAAc,aAAa;EACpD,OAAO,IAAI,sCAAsC;EACjD,OAAO;CACR,QAAQ;EACP,OAAO,IAAI,kDAAkD;CAC9D;CAID,MAAM,MAAM,MAAM,iBACjB,OAAO,QACP,OAAO,SACP,WACD;CACA,MAAM,mBAAmB,aAAa,WAAW;CAGjD,MAAM,aACL,eAAe,cACf,GAAG,iBAAiB,GAAG,MAAM,WAAW,aAAa;CAGtD,IAAI,CAAC,MAD6B,aAAa,IAAI,IAAI,UAAU,GACvC;EACzB,OAAO,IAAI,0BAA0B,YAAY;EAGjD,MAAM,qBAKF,EACH,QAAQ,WACT;EACA,IAAI,OAAO,WAAW,aACrB,mBAAmB,4BAA4B,EAC9C,oBAAoB,OAAO,OAC5B;EAGD,MAAM,IAAI,GAAG,KAAK,IAAIC,mBAAAA,oBAAoB,kBAAkB,CAAC;EAG7D,MAAM,IAAI,GAAG,KACZ,IAAIC,mBAAAA,2BAA2B;GAC9B,QAAQ;GACR,yBAAyB,EAAE,QAAQ,UAAU;EAC9C,CAAC,CACF;CACD,OACC,OAAO,IAAI,gCAAgC,YAAY;CAIxD,MAAM,cACL,eAAe,eAAe,kBAAkB,iBAAiB,GAAG;CAGrE,IAAI,CAAC,MAD8B,WAAW,IAAI,KAAK,WAAW,GACvC;EAC1B,OAAO,IAAI,yBAAyB,aAAa;EACjD,MAAM,IAAI,IAAI,KAAK,IAAIC,oBAAAA,kBAAkB,EAAE,UAAU,YAAY,CAAC,CAAC;CACpE,OACC,OAAO,IAAI,+BAA+B,aAAa;CAIxD,MAAM,iBAAiB;EACtB,SAAS;EACT,WAAW,CACV;GACC,QAAQ;GACR,QAAQ;IACP;IACA;IACA;IACA;IACA;GACD;GACA,UAAU,CACT,gBAAgB,cAChB,gBAAgB,WAAW,GAC5B;EACD,CACD;CACD;CAEA,OAAO,IAAI,wBAAwB;CACnC,MAAM,IAAI,IAAI,KACb,IAAIC,oBAAAA,qBAAqB;EACxB,UAAU;EACV,YAAY;EACZ,gBAAgB,KAAK,UAAU,cAAc;CAC9C,CAAC,CACF;CAGA,IAAI;CACJ,IAAI;CAEJ,IAAI,eAAe,kBAAkB,eAAe,oBAAoB;EAEvE,OAAO,IAAI,kCAAkC;EAC7C,cAAc,cAAc;EAC5B,kBAAkB,cAAc;CACjC,OAAO;EAEN,OAAO,IAAI,4BAA4B;EACvC,MAAM,kBAAkB,MAAM,IAAI,IAAI,KACrC,IAAIC,oBAAAA,uBAAuB,EAAE,UAAU,YAAY,CAAC,CACrD;EAEA,IAAI,CAAC,gBAAgB,WACpB,MAAM,IAAI,MAAM,iCAAiC;EAGlD,cAAc,gBAAgB,UAAU;EACxC,kBAAkB,gBAAgB,UAAU;CAC7C;CAGA,MAAM,kBAAkB,GAAG,iBAAiB,GAAG,MAAM;CACrD,OAAO,IAAI,oCAAoC,iBAAiB;CAEhE,MAAM,EAAE,aAAa,YAAY,MAAM,IAAI,wBAC1C,iBACA;EACC,WAAW;EACM;EACjB,QAAQ;EACR,QAAQ,OAAO;CAChB,CACD;CAEA,IAAI,SACH,OAAO,IAAI,kCAAkC;MAE7C,OAAO,IAAI,yCAAyC;CAIrD,IAAI;EACH,MAAM,IAAI,0BAA0B,YAAY,aAAa;EAC7D,OAAO,IAAI,sCAAsC;CAClD,SAAS,OAAO;EACf,OAAO,IACN,0DAA0D,OAC3D;CACD;CAEA,OAAO;EACN;EACA,WAAW,gBAAgB;EAC3B;EACA,gBAAgB;EAChB,oBAAoB;EACpB,eAAe,YAAY;EAC3B,QAAQ,OAAO;EACf,WAAW,eAAe,8BAAa,IAAI,KAAK,EAAA,CAAE,YAAY;CAC/D;AACD"}

package/dist/{backup-provisioner-Bgj5Vi_L.mjs → backup-provisioner-DIVCbfee.mjs}

@@ -1,8 +1,13 @@
 import { CreateBucketCommand, HeadBucketCommand, PutBucketVersioningCommand, S3Client } from "@aws-sdk/client-s3";
 import { CreateAccessKeyCommand, CreateUserCommand, GetUserCommand, IAMClient, PutUserPolicyCommand } from "@aws-sdk/client-iam";
-
 //#region src/deploy/backup-provisioner.ts
 /**
+* Backup Destination Provisioner
+*
+* Creates AWS resources (S3 bucket, IAM user, access keys) and configures
+* Dokploy backup destinations for database backups.
+*/
+/**
 * Generate a random suffix for unique resource names
 */
 function randomSuffix() {
@@ -80,8 +85,7 @@ async function provisionBackupDestination(options) {
 	const aws = await createAwsClients(config.region, config.profile, awsEndpoint);
 	const sanitizedProject = sanitizeName(projectName);
 	const bucketName = existingState?.bucketName ?? `${sanitizedProject}-${stage}-backups-${randomSuffix()}`;
-	const bucketAlreadyExists = await bucketExists(aws.s3, bucketName);
-	if (!bucketAlreadyExists) {
+	if (!await bucketExists(aws.s3, bucketName)) {
 		logger.log(`   Creating S3 bucket: ${bucketName}`);
 		const createBucketParams = { Bucket: bucketName };
 		if (config.region !== "us-east-1") createBucketParams.CreateBucketConfiguration = { LocationConstraint: config.region };
@@ -92,8 +96,7 @@ async function provisionBackupDestination(options) {
 		}));
 	} else logger.log(`   Using existing S3 bucket: ${bucketName}`);
 	const iamUserName = existingState?.iamUserName ?? `dokploy-backup-${sanitizedProject}-${stage}`;
-	const iamUserAlreadyExists = await userExists(aws.iam, iamUserName);
-	if (!iamUserAlreadyExists) {
+	if (!await userExists(aws.iam, iamUserName)) {
 		logger.log(`   Creating IAM user: ${iamUserName}`);
 		await aws.iam.send(new CreateUserCommand({ UserName: iamUserName }));
 	} else logger.log(`   Using existing IAM user: ${iamUserName}`);
@@ -157,7 +160,7 @@ async function provisionBackupDestination(options) {
 		createdAt: existingState?.createdAt ?? (/* @__PURE__ */ new Date()).toISOString()
 	};
 }
-
 //#endregion
 export { provisionBackupDestination };
-//# sourceMappingURL=backup-provisioner-Bgj5Vi_L.mjs.map
+
+//# sourceMappingURL=backup-provisioner-DIVCbfee.mjs.map

package/dist/backup-provisioner-DIVCbfee.mjs.map

@@ -0,0 +1 @@
+{"version":3,"file":"backup-provisioner-DIVCbfee.mjs","names":[],"sources":["../src/deploy/backup-provisioner.ts"],"sourcesContent":["/**\n * Backup Destination Provisioner\n *\n * Creates AWS resources (S3 bucket, IAM user, access keys) and configures\n * Dokploy backup destinations for database backups.\n */\n\nimport {\n\tCreateAccessKeyCommand,\n\tCreateUserCommand,\n\tGetUserCommand,\n\tIAMClient,\n\ttype IAMClientConfig,\n\tPutUserPolicyCommand,\n} from '@aws-sdk/client-iam';\nimport {\n\ttype BucketLocationConstraint,\n\tCreateBucketCommand,\n\tHeadBucketCommand,\n\tPutBucketVersioningCommand,\n\tS3Client,\n\ttype S3ClientConfig,\n} from '@aws-sdk/client-s3';\nimport type { BackupsConfig } from '../workspace/types.js';\nimport type { DokployApi } from './dokploy-api.js';\nimport type { BackupState } from './state.js';\n\nexport interface ProvisionBackupOptions {\n\t/** Dokploy API client */\n\tapi: DokployApi;\n\t/** Dokploy project ID */\n\tprojectId: string;\n\t/** Workspace name (used for resource naming) */\n\tprojectName: string;\n\t/** Deploy stage (e.g., 'production', 'staging') */\n\tstage: string;\n\t/** Backup configuration */\n\tconfig: BackupsConfig;\n\t/** Existing backup state (if any) */\n\texistingState?: BackupState;\n\t/** Logger for progress output */\n\tlogger: { log: (msg: string) => void };\n\t/** AWS endpoint override (for testing with LocalStack) */\n\tawsEndpoint?: string;\n}\n\n/**\n * Generate a random suffix for unique resource names\n */\nfunction randomSuffix(): string {\n\treturn Math.random().toString(36).substring(2, 8);\n}\n\n/**\n * Sanitize a name for AWS resources (lowercase alphanumeric and hyphens)\n */\nfunction sanitizeName(name: string): string {\n\treturn name.toLowerCase().replace(/[^a-z0-9-]/g, '-');\n}\n\n/**\n * Create AWS clients with optional profile credentials\n */\nasync function createAwsClients(\n\tregion: string,\n\tprofile?: string,\n\tendpoint?: string,\n): Promise<{ s3: S3Client; iam: IAMClient }> {\n\tconst config: S3ClientConfig & IAMClientConfig = { region };\n\n\tif (profile) {\n\t\tconst { fromIni } = await import('@aws-sdk/credential-providers');\n\t\tconfig.credentials = fromIni({ profile });\n\t}\n\n\t// Support custom endpoint for testing (e.g., LocalStack)\n\tif (endpoint) {\n\t\tconfig.endpoint = endpoint;\n\t\t(config as S3ClientConfig).forcePathStyle = true;\n\t\t// Use test credentials when endpoint is specified\n\t\tconfig.credentials = {\n\t\t\taccessKeyId: 'test',\n\t\t\tsecretAccessKey: 'test',\n\t\t};\n\t}\n\n\treturn {\n\t\ts3: new S3Client(config),\n\t\tiam: new IAMClient(config),\n\t};\n}\n\n/**\n * Check if an S3 bucket exists\n */\nasync function bucketExists(\n\ts3: S3Client,\n\tbucketName: string,\n): Promise<boolean> {\n\ttry {\n\t\tawait s3.send(new HeadBucketCommand({ Bucket: bucketName }));\n\t\treturn true;\n\t} catch (error) {\n\t\tif ((error as { name?: string }).name === 'NotFound') {\n\t\t\treturn false;\n\t\t}\n\t\t// 403 means bucket exists but we don't have access\n\t\tif (\n\t\t\t(error as { $metadata?: { httpStatusCode?: number } }).$metadata\n\t\t\t\t?.httpStatusCode === 403\n\t\t) {\n\t\t\treturn true;\n\t\t}\n\t\tthrow error;\n\t}\n}\n\n/**\n * Check if an IAM user exists\n */\nasync function userExists(iam: IAMClient, userName: string): Promise<boolean> {\n\ttry {\n\t\tawait iam.send(new GetUserCommand({ UserName: userName }));\n\t\treturn true;\n\t} catch (error) {\n\t\tconst errorName = (error as { name?: string }).name;\n\t\t// AWS returns 'NoSuchEntity', LocalStack returns 'NoSuchEntityException'\n\t\tif (errorName === 'NoSuchEntity' || errorName === 'NoSuchEntityException') {\n\t\t\treturn false;\n\t\t}\n\t\tthrow error;\n\t}\n}\n\n/**\n * Provision backup destination for a deployment.\n *\n * Creates AWS resources (S3 bucket, IAM user) and Dokploy destination if needed.\n * Reuses existing resources from state when possible.\n */\nexport async function provisionBackupDestination(\n\toptions: ProvisionBackupOptions,\n): Promise<BackupState> {\n\tconst {\n\t\tapi,\n\t\tprojectName,\n\t\tstage,\n\t\tconfig,\n\t\texistingState,\n\t\tlogger,\n\t\tawsEndpoint,\n\t} = options;\n\n\t// If we have existing state, verify the Dokploy destination still exists\n\tif (existingState?.destinationId) {\n\t\ttry {\n\t\t\tawait api.getDestination(existingState.destinationId);\n\t\t\tlogger.log('   Using existing backup destination');\n\t\t\treturn existingState;\n\t\t} catch {\n\t\t\tlogger.log('   Existing destination not found, recreating...');\n\t\t}\n\t}\n\n\t// Create AWS clients\n\tconst aws = await createAwsClients(\n\t\tconfig.region,\n\t\tconfig.profile,\n\t\tawsEndpoint,\n\t);\n\tconst sanitizedProject = sanitizeName(projectName);\n\n\t// 1. Create or verify S3 bucket\n\tconst bucketName =\n\t\texistingState?.bucketName ??\n\t\t`${sanitizedProject}-${stage}-backups-${randomSuffix()}`;\n\n\tconst bucketAlreadyExists = await bucketExists(aws.s3, bucketName);\n\tif (!bucketAlreadyExists) {\n\t\tlogger.log(`   Creating S3 bucket: ${bucketName}`);\n\n\t\t// CreateBucket needs LocationConstraint for non-us-east-1 regions\n\t\tconst createBucketParams: {\n\t\t\tBucket: string;\n\t\t\tCreateBucketConfiguration?: {\n\t\t\t\tLocationConstraint: BucketLocationConstraint;\n\t\t\t};\n\t\t} = {\n\t\t\tBucket: bucketName,\n\t\t};\n\t\tif (config.region !== 'us-east-1') {\n\t\t\tcreateBucketParams.CreateBucketConfiguration = {\n\t\t\t\tLocationConstraint: config.region as BucketLocationConstraint,\n\t\t\t};\n\t\t}\n\n\t\tawait aws.s3.send(new CreateBucketCommand(createBucketParams));\n\n\t\t// Enable versioning for backup integrity\n\t\tawait aws.s3.send(\n\t\t\tnew PutBucketVersioningCommand({\n\t\t\t\tBucket: bucketName,\n\t\t\t\tVersioningConfiguration: { Status: 'Enabled' },\n\t\t\t}),\n\t\t);\n\t} else {\n\t\tlogger.log(`   Using existing S3 bucket: ${bucketName}`);\n\t}\n\n\t// 2. Create or verify IAM user\n\tconst iamUserName =\n\t\texistingState?.iamUserName ?? `dokploy-backup-${sanitizedProject}-${stage}`;\n\n\tconst iamUserAlreadyExists = await userExists(aws.iam, iamUserName);\n\tif (!iamUserAlreadyExists) {\n\t\tlogger.log(`   Creating IAM user: ${iamUserName}`);\n\t\tawait aws.iam.send(new CreateUserCommand({ UserName: iamUserName }));\n\t} else {\n\t\tlogger.log(`   Using existing IAM user: ${iamUserName}`);\n\t}\n\n\t// 3. Attach bucket policy to IAM user\n\tconst policyDocument = {\n\t\tVersion: '2012-10-17',\n\t\tStatement: [\n\t\t\t{\n\t\t\t\tEffect: 'Allow',\n\t\t\t\tAction: [\n\t\t\t\t\t's3:GetObject',\n\t\t\t\t\t's3:PutObject',\n\t\t\t\t\t's3:DeleteObject',\n\t\t\t\t\t's3:ListBucket',\n\t\t\t\t\t's3:GetBucketLocation',\n\t\t\t\t],\n\t\t\t\tResource: [\n\t\t\t\t\t`arn:aws:s3:::${bucketName}`,\n\t\t\t\t\t`arn:aws:s3:::${bucketName}/*`,\n\t\t\t\t],\n\t\t\t},\n\t\t],\n\t};\n\n\tlogger.log('   Updating IAM policy');\n\tawait aws.iam.send(\n\t\tnew PutUserPolicyCommand({\n\t\t\tUserName: iamUserName,\n\t\t\tPolicyName: 'DokployBackupAccess',\n\t\t\tPolicyDocument: JSON.stringify(policyDocument),\n\t\t}),\n\t);\n\n\t// 4. Create access key (or reuse existing if state has it and destination needs recreation)\n\tlet accessKeyId: string;\n\tlet secretAccessKey: string;\n\n\tif (existingState?.iamAccessKeyId && existingState?.iamSecretAccessKey) {\n\t\t// Reuse existing credentials\n\t\tlogger.log('   Using existing IAM access key');\n\t\taccessKeyId = existingState.iamAccessKeyId;\n\t\tsecretAccessKey = existingState.iamSecretAccessKey;\n\t} else {\n\t\t// Create new access key\n\t\tlogger.log('   Creating IAM access key');\n\t\tconst accessKeyResult = await aws.iam.send(\n\t\t\tnew CreateAccessKeyCommand({ UserName: iamUserName }),\n\t\t);\n\n\t\tif (!accessKeyResult.AccessKey) {\n\t\t\tthrow new Error('Failed to create IAM access key');\n\t\t}\n\n\t\taccessKeyId = accessKeyResult.AccessKey.AccessKeyId!;\n\t\tsecretAccessKey = accessKeyResult.AccessKey.SecretAccessKey!;\n\t}\n\n\t// 5. Create Dokploy destination\n\tconst destinationName = `${sanitizedProject}-${stage}-s3`;\n\tlogger.log(`   Creating Dokploy destination: ${destinationName}`);\n\n\tconst { destination, created } = await api.findOrCreateDestination(\n\t\tdestinationName,\n\t\t{\n\t\t\taccessKey: accessKeyId,\n\t\t\tsecretAccessKey: secretAccessKey,\n\t\t\tbucket: bucketName,\n\t\t\tregion: config.region,\n\t\t},\n\t);\n\n\tif (created) {\n\t\tlogger.log('   ✓ Dokploy destination created');\n\t} else {\n\t\tlogger.log('   ✓ Using existing Dokploy destination');\n\t}\n\n\t// 6. Test connection\n\ttry {\n\t\tawait api.testDestinationConnection(destination.destinationId);\n\t\tlogger.log('   ✓ Destination connection verified');\n\t} catch (error) {\n\t\tlogger.log(\n\t\t\t`   ⚠ Warning: Could not verify destination connection: ${error}`,\n\t\t);\n\t}\n\n\treturn {\n\t\tbucketName,\n\t\tbucketArn: `arn:aws:s3:::${bucketName}`,\n\t\tiamUserName,\n\t\tiamAccessKeyId: accessKeyId,\n\t\tiamSecretAccessKey: secretAccessKey,\n\t\tdestinationId: destination.destinationId,\n\t\tregion: config.region,\n\t\tcreatedAt: existingState?.createdAt ?? new Date().toISOString(),\n\t};\n}\n"],"mappings":";;;;;;;;;;;;AAiDA,SAAS,eAAuB;CAC/B,OAAO,KAAK,OAAO,CAAC,CAAC,SAAS,EAAE,CAAC,CAAC,UAAU,GAAG,CAAC;AACjD;;;;AAKA,SAAS,aAAa,MAAsB;CAC3C,OAAO,KAAK,YAAY,CAAC,CAAC,QAAQ,eAAe,GAAG;AACrD;;;;AAKA,eAAe,iBACd,QACA,SACA,UAC4C;CAC5C,MAAM,SAA2C,EAAE,OAAO;CAE1D,IAAI,SAAS;EACZ,MAAM,EAAE,YAAY,MAAM,OAAO;EACjC,OAAO,cAAc,QAAQ,EAAE,QAAQ,CAAC;CACzC;CAGA,IAAI,UAAU;EACb,OAAO,WAAW;EAClB,OAA2B,iBAAiB;EAE5C,OAAO,cAAc;GACpB,aAAa;GACb,iBAAiB;EAClB;CACD;CAEA,OAAO;EACN,IAAI,IAAI,SAAS,MAAM;EACvB,KAAK,IAAI,UAAU,MAAM;CAC1B;AACD;;;;AAKA,eAAe,aACd,IACA,YACmB;CACnB,IAAI;EACH,MAAM,GAAG,KAAK,IAAI,kBAAkB,EAAE,QAAQ,WAAW,CAAC,CAAC;EAC3D,OAAO;CACR,SAAS,OAAO;EACf,IAAK,MAA4B,SAAS,YACzC,OAAO;EAGR,IACE,MAAsD,WACpD,mBAAmB,KAEtB,OAAO;EAER,MAAM;CACP;AACD;;;;AAKA,eAAe,WAAW,KAAgB,UAAoC;CAC7E,IAAI;EACH,MAAM,IAAI,KAAK,IAAI,eAAe,EAAE,UAAU,SAAS,CAAC,CAAC;EACzD,OAAO;CACR,SAAS,OAAO;EACf,MAAM,YAAa,MAA4B;EAE/C,IAAI,cAAc,kBAAkB,cAAc,yBACjD,OAAO;EAER,MAAM;CACP;AACD;;;;;;;AAQA,eAAsB,2BACrB,SACuB;CACvB,MAAM,EACL,KACA,aACA,OACA,QACA,eACA,QACA,gBACG;CAGJ,IAAI,eAAe,eAClB,IAAI;EACH,MAAM,IAAI,eAAe,cAAc,aAAa;EACpD,OAAO,IAAI,sCAAsC;EACjD,OAAO;CACR,QAAQ;EACP,OAAO,IAAI,kDAAkD;CAC9D;CAID,MAAM,MAAM,MAAM,iBACjB,OAAO,QACP,OAAO,SACP,WACD;CACA,MAAM,mBAAmB,aAAa,WAAW;CAGjD,MAAM,aACL,eAAe,cACf,GAAG,iBAAiB,GAAG,MAAM,WAAW,aAAa;CAGtD,IAAI,CAAC,MAD6B,aAAa,IAAI,IAAI,UAAU,GACvC;EACzB,OAAO,IAAI,0BAA0B,YAAY;EAGjD,MAAM,qBAKF,EACH,QAAQ,WACT;EACA,IAAI,OAAO,WAAW,aACrB,mBAAmB,4BAA4B,EAC9C,oBAAoB,OAAO,OAC5B;EAGD,MAAM,IAAI,GAAG,KAAK,IAAI,oBAAoB,kBAAkB,CAAC;EAG7D,MAAM,IAAI,GAAG,KACZ,IAAI,2BAA2B;GAC9B,QAAQ;GACR,yBAAyB,EAAE,QAAQ,UAAU;EAC9C,CAAC,CACF;CACD,OACC,OAAO,IAAI,gCAAgC,YAAY;CAIxD,MAAM,cACL,eAAe,eAAe,kBAAkB,iBAAiB,GAAG;CAGrE,IAAI,CAAC,MAD8B,WAAW,IAAI,KAAK,WAAW,GACvC;EAC1B,OAAO,IAAI,yBAAyB,aAAa;EACjD,MAAM,IAAI,IAAI,KAAK,IAAI,kBAAkB,EAAE,UAAU,YAAY,CAAC,CAAC;CACpE,OACC,OAAO,IAAI,+BAA+B,aAAa;CAIxD,MAAM,iBAAiB;EACtB,SAAS;EACT,WAAW,CACV;GACC,QAAQ;GACR,QAAQ;IACP;IACA;IACA;IACA;IACA;GACD;GACA,UAAU,CACT,gBAAgB,cAChB,gBAAgB,WAAW,GAC5B;EACD,CACD;CACD;CAEA,OAAO,IAAI,wBAAwB;CACnC,MAAM,IAAI,IAAI,KACb,IAAI,qBAAqB;EACxB,UAAU;EACV,YAAY;EACZ,gBAAgB,KAAK,UAAU,cAAc;CAC9C,CAAC,CACF;CAGA,IAAI;CACJ,IAAI;CAEJ,IAAI,eAAe,kBAAkB,eAAe,oBAAoB;EAEvE,OAAO,IAAI,kCAAkC;EAC7C,cAAc,cAAc;EAC5B,kBAAkB,cAAc;CACjC,OAAO;EAEN,OAAO,IAAI,4BAA4B;EACvC,MAAM,kBAAkB,MAAM,IAAI,IAAI,KACrC,IAAI,uBAAuB,EAAE,UAAU,YAAY,CAAC,CACrD;EAEA,IAAI,CAAC,gBAAgB,WACpB,MAAM,IAAI,MAAM,iCAAiC;EAGlD,cAAc,gBAAgB,UAAU;EACxC,kBAAkB,gBAAgB,UAAU;CAC7C;CAGA,MAAM,kBAAkB,GAAG,iBAAiB,GAAG,MAAM;CACrD,OAAO,IAAI,oCAAoC,iBAAiB;CAEhE,MAAM,EAAE,aAAa,YAAY,MAAM,IAAI,wBAC1C,iBACA;EACC,WAAW;EACM;EACjB,QAAQ;EACR,QAAQ,OAAO;CAChB,CACD;CAEA,IAAI,SACH,OAAO,IAAI,kCAAkC;MAE7C,OAAO,IAAI,yCAAyC;CAIrD,IAAI;EACH,MAAM,IAAI,0BAA0B,YAAY,aAAa;EAC7D,OAAO,IAAI,sCAAsC;CAClD,SAAS,OAAO;EACf,OAAO,IACN,0DAA0D,OAC3D;CACD;CAEA,OAAO;EACN;EACA,WAAW,gBAAgB;EAC3B;EACA,gBAAgB;EAChB,oBAAoB;EACpB,eAAe,YAAY;EAC3B,QAAQ,OAAO;EACf,WAAW,eAAe,8BAAa,IAAI,KAAK,EAAA,CAAE,YAAY;CAC/D;AACD"}