@geekmidas/cli 10.0.0-alpha.93 → 10.0.0-alpha.94

package/dist/providers-BFeP_mYw.cjs

@@ -0,0 +1,1098 @@
+const require_rolldown_runtime = require("./rolldown-runtime-C0BPl7ul.cjs");
+const require_errors = require("./errors-DMC4Umsb.cjs");
+const require_credentials = require("./credentials-D7XJypNd.cjs");
+const require_derive = require("./derive-DAbo49sm.cjs");
+const require_workspace = require("./workspace-cSyi5nb1.cjs");
+const require_seeds = require("./seeds-BCg8X36S.cjs");
+let _geekmidas_manifest = require("@geekmidas/manifest");
+let _geekmidas_storage_s3_url = require("@geekmidas/storage/s3-url");
+_geekmidas_storage_s3_url = require_rolldown_runtime.__toESM(_geekmidas_storage_s3_url, 1);
+//#region src/deploy/journal.ts
+var DeployJournal = class DeployJournal {
+	store;
+	stage;
+	state;
+	resources;
+	version;
+	existed;
+	constructor(store, stage, state, resources, version, existed) {
+		this.store = store;
+		this.stage = stage;
+		this.state = state;
+		this.resources = resources;
+		this.version = version;
+		this.existed = existed;
+	}
+	static async open(store, stage, initial, adopt = (stored) => stored) {
+		const stored = await store.read(stage);
+		if (stored) return new DeployJournal(store, stage, adopt(stored.state), stored.resources, stored.version, true);
+		const state = initial();
+		const version = await store.write(stage, state, { expectedVersion: null });
+		return new DeployJournal(store, stage, state, {}, version, false);
+	}
+	record(key) {
+		return this.resources[key];
+	}
+	/** The keys a previous run marked `pending` and never saw created. */
+	unfinished() {
+		return Object.values(this.resources).filter((record) => record.status === "pending").map((record) => record.key);
+	}
+	/** Records that `entry` is about to be created. */
+	async pending(entry) {
+		await this.put({
+			...entry,
+			status: "pending"
+		});
+	}
+	/**
+	* Records `entry` as existing with `id`; a no-op if it already is, with
+	* the same data.
+	*/
+	async ready(entry, id) {
+		const current = this.resources[entry.key];
+		if (current?.status === "ready" && current.id === id && JSON.stringify(current.data) === JSON.stringify(entry.data)) return;
+		await this.put({
+			...entry,
+			status: "ready",
+			id
+		});
+	}
+	/**
+	* The resource `entry` names: by its recorded id, else by looking it up,
+	* else created — with `pending` written before the create and `ready`
+	* after, so a run that dies in between leaves a record the next run
+	* resolves by looking the resource up rather than creating another.
+	*/
+	async ensure(entry, steps) {
+		const record = this.resources[entry.key];
+		let staleId;
+		if (record?.status === "ready" && record.id && steps.get) {
+			const known = await steps.get(record.id);
+			if (known) {
+				await this.ready(entry, steps.id(known));
+				return {
+					resource: known,
+					via: "recorded"
+				};
+			}
+			staleId = record.id;
+		}
+		const existing = await steps.find();
+		if (existing) {
+			await this.ready(entry, steps.id(existing));
+			return {
+				resource: existing,
+				via: record?.status === "pending" ? "resumed" : "found",
+				...staleId ? { staleId } : {}
+			};
+		}
+		await this.pending(entry);
+		const created = await steps.create();
+		await this.ready(entry, steps.id(created));
+		return {
+			resource: created,
+			via: "created",
+			...staleId ? { staleId } : {}
+		};
+	}
+	/** Removes `key`'s record — a resource that no longer exists. */
+	async forget(key) {
+		if (!(key in this.resources)) return;
+		this.version = await this.store.deleteResource(this.stage, key, { expectedVersion: this.version });
+		const { [key]: _removed, ...resources } = this.resources;
+		this.resources = resources;
+	}
+	/** Every record, as the journal last wrote or read it. */
+	records() {
+		return this.resources;
+	}
+	/** Writes the stage's state, keeping its resource records. */
+	async save() {
+		this.state.lastDeployedAt = (/* @__PURE__ */ new Date()).toISOString();
+		this.version = await this.store.write(this.stage, this.state, { expectedVersion: this.version });
+	}
+	async put(record) {
+		this.version = await this.store.putResource(this.stage, record, { expectedVersion: this.version });
+		this.resources = {
+			...this.resources,
+			[record.key]: {
+				...record,
+				updatedAt: (/* @__PURE__ */ new Date()).toISOString()
+			}
+		};
+	}
+};
+//#endregion
+//#region src/providers/aws.ts
+/**
+* The AWS account a provider provisions in — the stage's, found the way the
+* SSM and Secrets Manager stores find it.
+*
+* 1. `--profile`, resolved on its own: exported keys left over from another
+*    account never win over a profile someone named.
+* 2. `AWS_PROFILE`, else `AWS_ACCESS_KEY_ID`/`AWS_SECRET_ACCESS_KEY` — the
+*    deploy's own `aws` credential kind (`storedCredentials`).
+* 3. The SDK's default chain: `~/.aws` default profile, SSO, a role. In CI,
+*    whatever `aws-actions/configure-aws-credentials` exported.
+*
+* None of them: the provider has no provisioning credentials, and the stage
+* is treated as `external`.
+*/
+async function awsProvisioningCredentials(lookup) {
+	const region = lookup.env.AWS_REGION ?? lookup.env.AWS_DEFAULT_REGION;
+	const where = region ? { region } : {};
+	if (lookup.profile) return {
+		profile: lookup.profile,
+		...where
+	};
+	const stored = await require_credentials.storedCredentials({
+		env: lookup.env,
+		...lookup.home ? { home: lookup.home } : {}
+	}).get({
+		kind: "aws",
+		stage: lookup.stage
+	});
+	if (stored) return stored;
+	try {
+		const { fromNodeProviderChain } = await import("@aws-sdk/credential-providers");
+		await fromNodeProviderChain({
+			timeout: 1e3,
+			maxRetries: 0
+		})();
+		return {
+			chain: true,
+			...where
+		};
+	} catch {
+		return;
+	}
+}
+/**
+* An S3-compatible endpoint the environment points the SDK at — the AWS
+* emulator in tests. The SDK reads it itself; it is read here too, because
+* an emulator takes path-style requests, and a key written for one has to
+* say where it is.
+*/
+function awsEndpoint(env, service) {
+	return env[`AWS_ENDPOINT_URL_${service}`] ?? env.AWS_ENDPOINT_URL;
+}
+/** An SDK client's config for a provisioning credential. */
+async function awsClientConfig(credential, region) {
+	if ("profile" in credential) {
+		const { fromIni } = await import("@aws-sdk/credential-providers");
+		return {
+			region,
+			credentials: fromIni({ profile: credential.profile })
+		};
+	}
+	if ("accessKeyId" in credential) return {
+		region,
+		credentials: {
+			accessKeyId: credential.accessKeyId,
+			secretAccessKey: credential.secretAccessKey,
+			...credential.sessionToken ? { sessionToken: credential.sessionToken } : {}
+		}
+	};
+	return { region };
+}
+//#endregion
+//#region src/providers/s3/origins.ts
+/**
+* Which browser origins may call a bucket: the stage's sites that depend on
+* an API using it.
+*
+* The same reading of the graph an API's own CORS origins are — its callers —
+* taken one step further: a site that calls an API which hands it a presigned
+* upload URL is a site whose browser PUTs to the bucket. A site that reads the
+* bucket (or a file server over it) itself is one too. Nothing is written
+* down: add a site that calls the API and the next provision run allows it.
+*/
+/** The keys a reader of this bucket holds: its URL, and each server's over it. */
+function bucketKeys(manifest, bucket) {
+	return [(0, _geekmidas_manifest.provideKey)(bucket, "url"), ...Object.entries(manifest).filter(([, d]) => d.kind === "file-server" && d.of === bucket).map(([id]) => (0, _geekmidas_manifest.provideKey)(id, "url"))];
+}
+function bucketOrigins(input) {
+	const { manifest, workspace, stage } = input;
+	const keys = bucketKeys(manifest, input.bucket);
+	const readers = Object.entries(manifest).filter(([, d]) => d.kind === "rest-api" || d.kind === "site").filter(([id]) => {
+		const env = require_seeds.appEnvKeys(manifest, require_derive.appKey(id), input.runnables);
+		return env !== void 0 && keys.some((key) => env.has(key));
+	});
+	const sites = /* @__PURE__ */ new Set();
+	for (const [id, declaration] of readers) {
+		if (declaration.kind === "site") {
+			sites.add(id);
+			continue;
+		}
+		for (const caller of (0, _geekmidas_manifest.dependentsOf)(manifest, id)) if (manifest[caller]?.kind === "site") sites.add(caller);
+	}
+	const origins = /* @__PURE__ */ new Set();
+	const unresolved = [];
+	for (const id of [...sites].sort()) {
+		const name = require_derive.appKey(id);
+		const app = workspace.apps[name];
+		if (!app) {
+			unresolved.push(name);
+			continue;
+		}
+		try {
+			const host = require_seeds.resolveHost(name, app, stage, workspace.domains, require_seeds.isMainFrontendApp(name, app, workspace.apps));
+			origins.add(`https://${host}`);
+		} catch (error) {
+			if (!(error instanceof require_seeds.NoDomainForStage)) throw error;
+			unresolved.push(name);
+		}
+	}
+	return {
+		origins: [...origins].sort(),
+		unresolved
+	};
+}
+//#endregion
+//#region src/providers/s3/policy.ts
+const bucketArn = (bucket) => `arn:aws:s3:::${bucket}`;
+/**
+* What the app's key may do: objects in this bucket, and listing it — and
+* nothing else in the account.
+*
+* Multipart uploads are in it because a presigned upload of a large file is
+* one, and an abandoned one is cleaned up by the app. Reading old versions is
+* added only when the bucket keeps them.
+*/
+function userPolicy(bucket, options = {}) {
+	return {
+		Version: "2012-10-17",
+		Statement: [{
+			Sid: "GkmObjects",
+			Effect: "Allow",
+			Action: [
+				"s3:GetObject",
+				"s3:PutObject",
+				"s3:DeleteObject",
+				"s3:AbortMultipartUpload",
+				"s3:ListMultipartUploadParts",
+				...options.versioning ? ["s3:GetObjectVersion"] : []
+			],
+			Resource: `${bucketArn(bucket)}/*`
+		}, {
+			Sid: "GkmBucket",
+			Effect: "Allow",
+			Action: [
+				"s3:ListBucket",
+				"s3:GetBucketLocation",
+				"s3:ListBucketMultipartUploads"
+			],
+			Resource: bucketArn(bucket)
+		}]
+	};
+}
+/**
+* One open pattern as the resource it is public on. A `**` is S3's `*`; a
+* single `*` is too, which crosses `/` where the construct's own check does
+* not — the construct is the stricter of the two (see `bucketPolicy` in
+* reconcile, which the local MinIO is given the same way).
+*/
+function openResource(bucket, pattern) {
+	const path = pattern.replace(/^\/+/, "").replace(/\*\*/g, "*");
+	return `${bucketArn(bucket)}/${path}`;
+}
+/**
+* The bucket's own policy: every request refused unless it came over TLS,
+* and — only when a file server opens paths on it — anonymous `s3:GetObject`
+* on exactly those prefixes.
+*/
+function bucketPolicy(bucket, open = []) {
+	const statements = [{
+		Sid: "GkmDenyInsecureTransport",
+		Effect: "Deny",
+		Principal: "*",
+		Action: "s3:*",
+		Resource: [bucketArn(bucket), `${bucketArn(bucket)}/*`],
+		Condition: { Bool: { "aws:SecureTransport": "false" } }
+	}];
+	if (open.length > 0) statements.push({
+		Sid: "GkmOpenPaths",
+		Effect: "Allow",
+		Principal: "*",
+		Action: "s3:GetObject",
+		Resource: [...new Set(open.map((p) => openResource(bucket, p)))].sort()
+	});
+	return {
+		Version: "2012-10-17",
+		Statement: statements
+	};
+}
+/**
+* Block Public Access. All four flags on, unless the bucket has open paths:
+* then a *policy* may make it public (`BlockPublicPolicy`,
+* `RestrictPublicBuckets` off), and ACLs still may not.
+*/
+function publicAccessBlock(open) {
+	return {
+		BlockPublicAcls: true,
+		IgnorePublicAcls: true,
+		BlockPublicPolicy: !open,
+		RestrictPublicBuckets: !open
+	};
+}
+function corsRule(origins) {
+	return {
+		AllowedMethods: [
+			"GET",
+			"HEAD",
+			"POST",
+			"PUT"
+		],
+		AllowedOrigins: [...new Set(origins)].sort(),
+		AllowedHeaders: ["*"],
+		ExposeHeaders: ["ETag"],
+		MaxAgeSeconds: 3e3
+	};
+}
+/**
+* A policy document in one canonical form — keys sorted, a lone string a
+* one-element list, lists sorted — so one AWS reformatted reads as the same
+* document rather than as drift.
+*/
+function canonicalPolicy(value) {
+	return JSON.stringify(canonical(value));
+}
+function canonical(value, key) {
+	if (Array.isArray(value)) {
+		const items = value.map((v) => canonical(v));
+		return key === "Statement" ? items : items.map((v) => JSON.stringify(v)).sort();
+	}
+	if (value && typeof value === "object") return Object.fromEntries(Object.keys(value).sort().map((k) => {
+		const v = value[k];
+		return [k, canonical(k === "Action" || k === "Resource" || k === "AWS" ? Array.isArray(v) ? v : [v] : v, k)];
+	}));
+	return value;
+}
+//#endregion
+//#region src/providers/s3/index.ts
+/** The tags gkm finds its own buckets and users by. */
+const TAG_PROJECT = "gkm:project";
+const TAG_STAGE = "gkm:stage";
+const TAG_CONSTRUCT = "gkm:construct";
+function bucketConstructs(manifest) {
+	return Object.entries(manifest).filter(([, d]) => d.kind === "objects").map(([id, d]) => ({
+		id,
+		versioned: d.versioned === true,
+		servers: Object.entries(manifest).filter(([, s]) => s.kind === "file-server" && s.of === id).map(([sid, s]) => ({
+			id: sid,
+			open: s.open ?? []
+		})).sort((a, b) => a.id.localeCompare(b.id))
+	})).sort((a, b) => a.id.localeCompare(b.id));
+}
+/**
+* The region the stage's buckets are created in: the entry's, the secrets
+* store's when it is in AWS, the credential's, `AWS_REGION`.
+*/
+function s3Region(ctx, env = process.env) {
+	const store = ctx.workspace.secrets?.store;
+	const storeRegion = store && typeof store === "object" && "region" in store ? store.region : void 0;
+	const region = ctx.config.region ?? storeRegion ?? ctx.credential?.region ?? env.AWS_REGION ?? env.AWS_DEFAULT_REGION;
+	if (!region) throw new require_workspace.S3RegionRequired(ctx.stage);
+	return region;
+}
+/**
+* The address a file server over `bucket` serves on: the bucket's regional
+* virtual-host endpoint, which is what `FileServer.url(key)` appends a key to
+* — `https://<bucket>.s3.<region>.amazonaws.com/<key>`. Against an emulator,
+* its path-style address.
+*/
+function bucketPublicUrl(bucket, region, endpoint) {
+	if (endpoint) return `${endpoint.replace(/\/+$/, "")}/${bucket}`;
+	return `https://${bucket}.s3.${region}.amazonaws.com`;
+}
+/** What an AWS SDK error is called, whichever field carries it. */
+function errorName(error) {
+	const e = error;
+	return e?.Code ?? e?.name ?? "";
+}
+/** A read whose "there is none" answer is one of `missing`. */
+async function readOr(read, missing) {
+	try {
+		return await read();
+	} catch (error) {
+		if (missing.includes(errorName(error))) return void 0;
+		throw error;
+	}
+}
+const defaultClients = async (credential, region) => {
+	const S3 = await import("@aws-sdk/client-s3");
+	const IAM = await import("@aws-sdk/client-iam");
+	const config = await awsClientConfig(credential, region);
+	const endpoint = awsEndpoint(process.env, "S3");
+	return {
+		S3,
+		IAM,
+		s3: new S3.S3Client({
+			...config,
+			...endpoint ? {
+				endpoint,
+				forcePathStyle: true
+			} : {}
+		}),
+		iam: new IAM.IAMClient(config),
+		region,
+		...endpoint ? { endpoint } : {}
+	};
+};
+/** For tests: what makes the clients. */
+let makeClients = defaultClients;
+async function ensureS3(ctx) {
+	const region = s3Region(ctx);
+	const clients = await makeClients(ctx.credential, region);
+	for (const construct of bucketConstructs(ctx.manifest)) await ensureBucket(ctx, clients, construct);
+}
+/** The keys gkm tags a bucket and a user with. */
+function identityTags(ctx, id) {
+	return [
+		{
+			Key: TAG_PROJECT,
+			Value: ctx.identity.key
+		},
+		{
+			Key: TAG_STAGE,
+			Value: ctx.stage
+		},
+		{
+			Key: TAG_CONSTRUCT,
+			Value: id
+		}
+	];
+}
+async function ensureBucket(ctx, clients, construct) {
+	const { id } = construct;
+	const nameInput = {
+		scope: ctx.identity.scope,
+		stage: ctx.stage,
+		id: require_derive.appKey(id)
+	};
+	const versioning = ctx.config.versioning ?? construct.versioned;
+	const open = [...new Set(construct.servers.flatMap((s) => s.open))].sort();
+	const { bucket, exists } = await ensureBucketName(ctx, clients, id, require_seeds.bucketName(nameInput));
+	await ensureBucketSettings(ctx, clients, {
+		id,
+		bucket,
+		exists,
+		versioning,
+		open
+	});
+	await ensureAccessKey(ctx, clients, {
+		id,
+		bucket,
+		...await ensureUser(ctx, clients, id, require_seeds.iamUserName(nameInput), userPolicy(bucket, { versioning }))
+	});
+	const publicUrl = bucketPublicUrl(bucket, clients.region, clients.endpoint);
+	for (const server of construct.servers) {
+		const key = (0, _geekmidas_manifest.provideKey)(server.id, "url");
+		const entry = {
+			key: `file-server:${server.id}`,
+			type: "url"
+		};
+		const recorded = ctx.state.record(entry.key)?.id;
+		const current = ctx.secrets[key];
+		if (current === publicUrl) {
+			await ctx.state.ready(entry, publicUrl);
+			continue;
+		}
+		if (current !== void 0 && current !== recorded) {
+			ctx.log(`   ${key} is set to ${current} by you, and kept — the bucket's own address is ${publicUrl}`);
+			continue;
+		}
+		await ctx.change({
+			construct: server.id,
+			resource: key,
+			change: `set to ${publicUrl}`
+		}, async () => {
+			await ctx.writeSecrets({ [key]: publicUrl });
+			await ctx.state.ready(entry, publicUrl);
+		});
+	}
+}
+/**
+* The bucket's name: the recorded one, else the good name, else the good
+* name with a random suffix — up to {@link SUFFIX_ATTEMPTS} times.
+*/
+async function ensureBucketName(ctx, clients, id, good) {
+	const { S3, s3, region } = clients;
+	const key = `s3-bucket:${id}`;
+	const record = ctx.state.record(key);
+	const entry = (name) => ({
+		key,
+		type: "s3-bucket",
+		data: {
+			name,
+			region
+		}
+	});
+	/** Whether this account holds `name`: yes, no, or someone else does. */
+	const probe = async (name) => {
+		try {
+			await s3.send(new S3.HeadBucketCommand({ Bucket: name }));
+			return "ours";
+		} catch (error) {
+			const name = errorName(error);
+			if (name === "NotFound" || name === "NoSuchBucket") return "none";
+			if (name === "Forbidden" || name === "AccessDenied") return "taken";
+			throw error;
+		}
+	};
+	const create = async (name) => {
+		if (ctx.dryRun) {
+			const found = await probe(name);
+			if (found === "none") {
+				await ctx.change({
+					construct: id,
+					resource: `bucket ${name}`,
+					change: `create in ${region}`
+				}, async () => {});
+				return "created";
+			}
+			return found;
+		}
+		await ctx.state.pending(entry(name));
+		try {
+			await s3.send(new S3.CreateBucketCommand({
+				Bucket: name,
+				...region === "us-east-1" ? {} : { CreateBucketConfiguration: { LocationConstraint: region } }
+			}));
+		} catch (error) {
+			const code = errorName(error);
+			if (code === "BucketAlreadyOwnedByYou") return "ours";
+			if (code === "BucketAlreadyExists") return "taken";
+			throw error;
+		}
+		await ctx.change({
+			construct: id,
+			resource: `bucket ${name}`,
+			change: `create in ${region}`
+		}, async () => {});
+		return "created";
+	};
+	const adopt = async (name) => {
+		const owner = (await readOr(() => s3.send(new S3.GetBucketTaggingCommand({ Bucket: name })), ["NoSuchTagSet", "NoSuchTagSetError"]))?.TagSet?.find((t) => t.Key === TAG_PROJECT)?.Value;
+		if (owner && owner !== ctx.identity.key) throw new require_workspace.BucketOwnedByAnotherProject(name, owner, ctx.identity.key);
+	};
+	if (record?.status === "ready" && record.id) {
+		const found = await probe(record.id);
+		if (found === "ours") return {
+			bucket: record.id,
+			exists: true
+		};
+		if (found === "taken") throw new require_workspace.RecordedBucketUnreachable(id, record.id);
+		const made = await create(record.id);
+		if (made === "taken") throw new require_workspace.RecordedBucketUnreachable(id, record.id);
+		if (!ctx.dryRun) await ctx.state.ready(entry(record.id), record.id);
+		return {
+			bucket: record.id,
+			exists: made === "ours"
+		};
+	}
+	const pending = record?.data?.name;
+	const names = [
+		...typeof pending === "string" && pending !== good ? [pending] : [],
+		good,
+		...Array.from({ length: 5 }, () => require_seeds.suffixedBucketName(good, require_seeds.randomSuffix()))
+	];
+	const tried = [];
+	for (const name of names) {
+		tried.push(name);
+		const made = await create(name);
+		if (made === "taken") continue;
+		if (made === "ours") await adopt(name);
+		if (!ctx.dryRun) await ctx.state.ready(entry(name), name);
+		if (name !== good) ctx.log(`   '${good}' is taken by another account; '${id}' is '${name}', recorded in the stage's state`);
+		return {
+			bucket: name,
+			exists: made === "ours"
+		};
+	}
+	throw new require_workspace.BucketNameUnavailable(id, tried.filter((n) => n !== pending));
+}
+/** Tags, Block Public Access, encryption, policy, versioning and CORS. */
+async function ensureBucketSettings(ctx, clients, input) {
+	const { S3, s3 } = clients;
+	const { id, bucket } = input;
+	const Bucket = bucket;
+	const fresh = ctx.dryRun && !input.exists;
+	const read = async (fn, missing) => fresh ? void 0 : readOr(fn, missing);
+	const set = (change, apply) => ctx.change({
+		construct: id,
+		resource: `bucket ${bucket}`,
+		change
+	}, () => apply().then(() => void 0));
+	const tagged = await read(() => s3.send(new S3.GetBucketTaggingCommand({ Bucket })), ["NoSuchTagSet", "NoSuchTagSetError"]);
+	const ours = identityTags(ctx, id);
+	const others = (tagged?.TagSet ?? []).filter((t) => !ours.some((o) => o.Key === t.Key));
+	if (ours.some((o) => !tagged?.TagSet?.some((t) => t.Key === o.Key && t.Value === o.Value))) await set("tag", () => s3.send(new S3.PutBucketTaggingCommand({
+		Bucket,
+		Tagging: { TagSet: [...others, ...ours].map((t) => ({
+			Key: t.Key,
+			Value: t.Value
+		})) }
+	})));
+	const isOpen = input.open.length > 0;
+	const block = publicAccessBlock(isOpen);
+	const ensureBlock = async () => {
+		const now = (await read(() => s3.send(new S3.GetPublicAccessBlockCommand({ Bucket })), ["NoSuchPublicAccessBlockConfiguration"]))?.PublicAccessBlockConfiguration;
+		if (!(now && Object.keys(block).every((k) => (now[k] ?? false) === block[k]))) await set(isOpen ? "block public access (ACLs; the policy opens the open paths)" : "block all public access", () => s3.send(new S3.PutPublicAccessBlockCommand({
+			Bucket,
+			PublicAccessBlockConfiguration: block
+		})));
+	};
+	const policy = bucketPolicy(bucket, input.open);
+	const ensurePolicy = async () => {
+		const current = await read(() => s3.send(new S3.GetBucketPolicyCommand({ Bucket })), ["NoSuchBucketPolicy"]);
+		if (!(current?.Policy !== void 0 && canonicalPolicy(JSON.parse(current.Policy)) === canonicalPolicy(policy))) await set(isOpen ? `policy: TLS only, public read on ${input.open.join(", ")}` : "policy: TLS only", () => s3.send(new S3.PutBucketPolicyCommand({
+			Bucket,
+			Policy: JSON.stringify(policy)
+		})));
+	};
+	if (isOpen) {
+		await ensureBlock();
+		await ensurePolicy();
+	} else {
+		await ensurePolicy();
+		await ensureBlock();
+	}
+	if ((await read(() => s3.send(new S3.GetBucketEncryptionCommand({ Bucket })), ["ServerSideEncryptionConfigurationNotFoundError"]))?.ServerSideEncryptionConfiguration?.Rules?.[0]?.ApplyServerSideEncryptionByDefault?.SSEAlgorithm !== "AES256" && !fresh) await set("encrypt by default (SSE-S3)", () => s3.send(new S3.PutBucketEncryptionCommand({
+		Bucket,
+		ServerSideEncryptionConfiguration: { Rules: [{ ApplyServerSideEncryptionByDefault: { SSEAlgorithm: "AES256" } }] }
+	})));
+	const status = (await read(() => s3.send(new S3.GetBucketVersioningCommand({ Bucket })), []))?.Status;
+	if (input.versioning && status !== "Enabled") await set("enable versioning", () => s3.send(new S3.PutBucketVersioningCommand({
+		Bucket,
+		VersioningConfiguration: { Status: "Enabled" }
+	})));
+	else if (!input.versioning && status === "Enabled") await set("suspend versioning", () => s3.send(new S3.PutBucketVersioningCommand({
+		Bucket,
+		VersioningConfiguration: { Status: "Suspended" }
+	})));
+	const { origins, unresolved } = bucketOrigins({
+		workspace: ctx.workspace,
+		manifest: ctx.manifest,
+		runnables: ctx.runnables,
+		stage: ctx.stage,
+		bucket: id
+	});
+	if (unresolved.length > 0) ctx.log(`   ${unresolved.join(", ")} ${unresolved.length === 1 ? "has" : "have"} no address on '${ctx.stage}' (domains.${ctx.stage}), so ${unresolved.length === 1 ? "is" : "are"} not in '${bucket}''s CORS`);
+	if (origins.length === 0) return;
+	const rule = corsRule(origins);
+	const cors = await read(() => s3.send(new S3.GetBucketCorsCommand({ Bucket })), ["NoSuchCORSConfiguration"]);
+	if (!(cors?.CORSRules?.length === 1 && canonicalCors(cors.CORSRules[0]) === canonicalCors(rule))) await set(`CORS for ${origins.join(", ")}`, () => s3.send(new S3.PutBucketCorsCommand({
+		Bucket,
+		CORSConfiguration: { CORSRules: [rule] }
+	})));
+}
+function canonicalCors(rule) {
+	const sorted = (list) => [...list ?? []].sort();
+	return JSON.stringify({
+		AllowedMethods: sorted(rule.AllowedMethods),
+		AllowedOrigins: sorted(rule.AllowedOrigins),
+		AllowedHeaders: sorted(rule.AllowedHeaders),
+		ExposeHeaders: sorted(rule.ExposeHeaders),
+		MaxAgeSeconds: rule.MaxAgeSeconds ?? null
+	});
+}
+/** The bucket's IAM user and its inline policy. */
+async function ensureUser(ctx, clients, id, user, policy) {
+	const { IAM, iam } = clients;
+	const entry = {
+		key: `iam-user:${id}`,
+		type: "iam-user"
+	};
+	const found = await readOr(() => iam.send(new IAM.GetUserCommand({ UserName: user })), ["NoSuchEntity", "NoSuchEntityException"]);
+	if (found?.User) {
+		const tags = await iam.send(new IAM.ListUserTagsCommand({ UserName: user }));
+		const tag = (key) => tags.Tags?.find((t) => t.Key === key)?.Value;
+		if (found.User.Path !== "/gkm/" || tag("gkm:project") !== ctx.identity.key || tag("gkm:stage") !== ctx.stage) throw new require_workspace.IamUserNotOwned(user, ctx.identity.key, ctx.stage);
+		await ctx.state.ready(entry, user);
+	} else await ctx.change({
+		construct: id,
+		resource: `IAM user ${user}`,
+		change: `create under ${require_seeds.IAM_USER_PATH}`
+	}, async () => {
+		await ctx.state.pending(entry);
+		await iam.send(new IAM.CreateUserCommand({
+			UserName: user,
+			Path: require_seeds.IAM_USER_PATH,
+			Tags: identityTags(ctx, id)
+		}));
+		await ctx.state.ready(entry, user);
+	});
+	const exists = Boolean(found?.User) || !ctx.dryRun;
+	const current = exists ? await readOr(() => iam.send(new IAM.GetUserPolicyCommand({
+		UserName: user,
+		PolicyName: require_seeds.IAM_POLICY_NAME
+	})), ["NoSuchEntity", "NoSuchEntityException"]) : void 0;
+	const document = current?.PolicyDocument ? JSON.parse(decodePolicy(current.PolicyDocument)) : void 0;
+	if (!document || canonicalPolicy(document) !== canonicalPolicy(policy)) await ctx.change({
+		construct: id,
+		resource: `IAM user ${user}`,
+		change: `policy ${require_seeds.IAM_POLICY_NAME}: this bucket only`
+	}, async () => {
+		await iam.send(new IAM.PutUserPolicyCommand({
+			UserName: user,
+			PolicyName: require_seeds.IAM_POLICY_NAME,
+			PolicyDocument: JSON.stringify(policy)
+		}));
+	});
+	return {
+		user,
+		exists
+	};
+}
+/** IAM returns a policy document URL-encoded; an emulator may not. */
+function decodePolicy(document) {
+	try {
+		return decodeURIComponent(document);
+	} catch {
+		return document;
+	}
+}
+/**
+* The user's access key, in the stage's secrets as the bucket's URL.
+*
+* - First run: one key, written into the stage's secrets.
+* - `--rotate-keys`: a second key, written in place of the first; the first
+*   stays active until the stage has deployed with the second, and the next
+*   run after that deploy — or `--retire-old-keys` — deletes it.
+* - A key the secrets no longer hold (a store emptied by hand): replaced the
+*   same way, since its secret cannot be read back.
+*/
+async function ensureAccessKey(ctx, clients, input) {
+	const { IAM, iam } = clients;
+	const { id, bucket, user } = input;
+	const urlKey = (0, _geekmidas_manifest.provideKey)(id, "url");
+	const entryKey = `iam-access-key:${id}`;
+	const record = ctx.state.record(entryKey);
+	const given = ctx.secrets[urlKey];
+	let inUrl;
+	if (given !== void 0) {
+		let parsed;
+		try {
+			parsed = _geekmidas_storage_s3_url.parse(given);
+		} catch {
+			parsed = void 0;
+		}
+		if (parsed?.bucket !== bucket) throw new require_workspace.BucketKeySetElsewhere(urlKey, bucket, parsed?.bucket ?? given.replace(/\/\/[^@]*@/, "//"), ctx.stage);
+		inUrl = parsed.accessKeyId;
+	}
+	const listed = input.exists ? (await iam.send(new IAM.ListAccessKeysCommand({ UserName: user }))).AccessKeyMetadata?.map((k) => k.AccessKeyId) ?? [] : [];
+	let current = record?.status === "ready" ? record.id : void 0;
+	let previous = typeof record?.data?.previous === "string" ? record.data.previous : void 0;
+	const rotatedAt = typeof record?.data?.rotatedAt === "string" ? record.data.rotatedAt : void 0;
+	const entry = (data = {}) => ({
+		key: entryKey,
+		type: "iam-access-key",
+		data: {
+			user,
+			...data
+		}
+	});
+	if (previous && current) {
+		const deployed = rotatedAt !== void 0 && ctx.state.lastDeployedAt !== void 0 && ctx.state.lastDeployedAt > rotatedAt;
+		if (ctx.retireOldKeys || deployed) {
+			const old = previous;
+			const keep = current;
+			await ctx.change({
+				construct: id,
+				resource: `IAM user ${user}`,
+				change: `delete the rotated-out access key ${old}`
+			}, async () => {
+				if (listed.includes(old)) await iam.send(new IAM.DeleteAccessKeyCommand({
+					UserName: user,
+					AccessKeyId: old
+				}));
+				await ctx.state.ready(entry(), keep);
+			});
+			previous = void 0;
+		} else ctx.log(`   ${id}: the old access key ${previous} stays active until '${ctx.stage}' is deployed with the new one; the next deploy after that deletes it (or pass --retire-old-keys)`);
+	}
+	if (!current && inUrl && listed.includes(inUrl)) {
+		await ctx.state.ready(entry(), inUrl);
+		current = inUrl;
+	}
+	if (current !== void 0 && listed.includes(current) && inUrl === current && !ctx.rotateKeys) return;
+	if (ctx.rotateKeys && previous) throw new require_workspace.RotationInProgress(id, previous, ctx.stage);
+	const outgoing = current && listed.includes(current) ? current : void 0;
+	if (listed.length >= 2) throw new require_workspace.AccessKeyLimit(user, listed);
+	const why = !current ? "create an access key" : ctx.rotateKeys ? "rotate: issue a new access key" : "issue a new access key (the secrets no longer hold the recorded one)";
+	await ctx.change({
+		construct: id,
+		resource: `IAM user ${user}`,
+		change: why
+	}, async () => {
+		await ctx.state.pending(entry(outgoing ? { previous: outgoing } : {}));
+		const key = (await iam.send(new IAM.CreateAccessKeyCommand({ UserName: user }))).AccessKey;
+		await ctx.writeSecrets({ [urlKey]: _geekmidas_storage_s3_url.build({
+			bucket,
+			region: clients.region,
+			...clients.endpoint ? {
+				endpoint: clients.endpoint,
+				forcePathStyle: true
+			} : {},
+			accessKeyId: key.AccessKeyId,
+			secretAccessKey: key.SecretAccessKey
+		}) });
+		await ctx.state.ready(entry(outgoing ? {
+			previous: outgoing,
+			rotatedAt: (/* @__PURE__ */ new Date()).toISOString()
+		} : {}), key.AccessKeyId);
+	});
+	if (outgoing) ctx.log(`   ${urlKey} holds the new key. This deploy moves '${ctx.stage}' onto it; the next deploy after it deletes the old key ${outgoing}`);
+}
+/**
+* Each provisioned bucket answers `HeadBucket` to the key in the stage's
+* secrets — the one the apps will use. A bucket whose URL carries no key is
+* not one this provider wrote, and the deploy's own check covers a URL that
+* is missing.
+*/
+async function verifyS3(ctx) {
+	const S3 = await import("@aws-sdk/client-s3");
+	for (const { id } of bucketConstructs(ctx.manifest)) {
+		const url = ctx.secrets[(0, _geekmidas_manifest.provideKey)(id, "url")];
+		if (url === void 0) continue;
+		const address = _geekmidas_storage_s3_url.parse(url);
+		if (!address.accessKeyId || !address.secretAccessKey) continue;
+		const client = new S3.S3Client({
+			region: address.region ?? ctx.config.region ?? "us-east-1",
+			credentials: {
+				accessKeyId: address.accessKeyId,
+				secretAccessKey: address.secretAccessKey
+			},
+			...address.endpoint ? { endpoint: address.endpoint } : {},
+			...address.forcePathStyle ? { forcePathStyle: true } : {}
+		});
+		try {
+			await client.send(new S3.HeadBucketCommand({ Bucket: address.bucket }));
+		} catch (error) {
+			const name = errorName(error);
+			throw new require_workspace.ProvisionedBucketUnreachable(id, address.bucket, ctx.stage, name === "NotFound" ? "it does not exist" : name === "Forbidden" ? "the key is refused" : name || String(error));
+		} finally {
+			client.destroy();
+		}
+	}
+}
+//#endregion
+//#region src/providers/registry.ts
+/**
+* The providers gkm ships, by kind and name — registered the way a deploy
+* target's built-ins are (`target/builtins.ts`). A provider from a package is
+* one more entry here once there is a loading story for it.
+*/
+const BUILTIN_PROVIDERS = { objects: { s3: {
+	kind: "objects",
+	name: "s3",
+	check: require_workspace.checkS3Config,
+	provisioning: require_workspace.S3_PROVISIONING,
+	credentials: awsProvisioningCredentials,
+	runtimeKeys(manifest) {
+		return bucketConstructs(manifest).flatMap((b) => [(0, _geekmidas_manifest.provideKey)(b.id, "url"), ...b.servers.map((s) => (0, _geekmidas_manifest.provideKey)(s.id, "url"))]);
+	},
+	ensure: ensureS3,
+	verify: verifyS3
+} } };
+/** The provider `kind` names `name`, if gkm has one. */
+function builtinProvider(kind, name) {
+	return Object.hasOwn(BUILTIN_PROVIDERS[kind], name) ? BUILTIN_PROVIDERS[kind][name] : void 0;
+}
+//#endregion
+//#region src/providers/index.ts
+/** The constructs of a kind: `objects` is every bucket. */
+function constructsOf(manifest, kind) {
+	return Object.entries(manifest).filter(([, d]) => d.kind === kind).map(([id]) => id).sort();
+}
+/**
+* What every deploy runs: each provider's `verify()` — the cheap check that
+* what it created is still there and the stage's key reaches it. Nothing on
+* the local stage, and nothing for a kind on `external`.
+*
+* @throws {StageProviderDisabled} for a declared kind the stage has none of
+*/
+async function verifyStageProviders(input) {
+	require_seeds.assertStageProvidersEnabled(input.workspace, input.manifest, input.stage);
+	const verified = [];
+	for (const kind of require_seeds.PROVIDER_KINDS) {
+		if (constructsOf(input.manifest, kind).length === 0) continue;
+		const choice = require_workspace.stageProvider(input.workspace, kind, input.stage);
+		if (choice.mode !== "provider") continue;
+		const provider = builtinProvider(kind, choice.name);
+		await provider.verify({
+			workspace: input.workspace,
+			manifest: input.manifest,
+			stage: input.stage,
+			config: choice.config,
+			secrets: input.secrets
+		});
+		verified.push(`${kind}: ${provider.name}`);
+	}
+	return verified;
+}
+/**
+* A stage whose provider creates its resources, and no credentials to create
+* them with. Raised before anything is created, built or started.
+*/
+var ProviderCredentialsMissing = class extends require_errors.GkmError {
+	stage;
+	kind;
+	provider;
+	ids;
+	env;
+	describe;
+	login;
+	constructor(stage, kind, provider, ids, env, describe, login) {
+		super(`deploy.${kind}.${stage} is ${provider}, so the deploy creates what ${ids.join(", ")} ${ids.length === 1 ? "is" : "are"} backed by on '${stage}' and writes ${ids.length === 1 ? "its key" : "their keys"} into the stage's secrets — and it found no ${provider} credentials to do it with. On this machine, supply ${describe}` + (login ? `, or run gkm login --provider ${login}` : "") + `. In CI, the step that runs the deploy (or gkm deploy --resources-only) needs them: the '${stage}' environment's role (AWS_ROLE_ARN, from gkm deploy:github), assumed before that step. With the keys set by hand instead, set deploy.${kind}.${stage} to 'external'.`);
+		this.stage = stage;
+		this.kind = kind;
+		this.provider = provider;
+		this.ids = ids;
+		this.env = env;
+		this.describe = describe;
+		this.login = login;
+		this.name = "ProviderCredentialsMissing";
+	}
+};
+/**
+* `ensure()` for every provider the stage configures — find or create, fix
+* drift, record in the stage's state, write the runtime keys into its
+* secrets. Run by the deploy, which holds the stage's lock. A provider with
+* no provisioning credentials stops the run with
+* {@link ProviderCredentialsMissing} before anything is created.
+*/
+async function provisionStage(options) {
+	const { workspace, stage, manifest } = options;
+	const dryRun = options.dryRun === true;
+	const env = options.env ?? process.env;
+	const log = options.log ?? ((line) => console.log(line));
+	const runnables = options.runnables ?? {};
+	const reports = [];
+	const configured = [];
+	for (const kind of require_seeds.PROVIDER_KINDS) {
+		const choice = require_workspace.stageProvider(workspace, kind, stage);
+		if (choice.mode !== "provider") {
+			reports.push({
+				kind,
+				mode: choice.mode,
+				actions: [],
+				planned: []
+			});
+			continue;
+		}
+		const provider = builtinProvider(kind, choice.name);
+		const report = {
+			kind,
+			mode: "provider",
+			provider: provider.name,
+			actions: [],
+			planned: []
+		};
+		reports.push(report);
+		const ids = constructsOf(manifest, kind);
+		if (ids.length === 0) continue;
+		const credential = await provider.credentials({
+			stage,
+			env,
+			...options.profile ? { profile: options.profile } : {},
+			...options.home ? { home: options.home } : {}
+		});
+		if (credential === void 0) throw new ProviderCredentialsMissing(stage, kind, provider.name, ids, provider.provisioning.env, provider.provisioning.describe, provider.provisioning.login);
+		configured.push({
+			kind,
+			provider,
+			config: choice.config,
+			credential,
+			report
+		});
+	}
+	if (configured.length === 0) return reports;
+	const identity = require_seeds.deployIdentity(workspace, stage);
+	let secrets = (await options.secrets.read())?.custom ?? {};
+	for (const entry of configured) entry.report.planned = entry.provider.runtimeKeys(manifest).filter((key) => secrets[key] === void 0);
+	const state = dryRun ? await readOnlyState(options.state, stage) : journalState(await DeployJournal.open(options.state, stage, () => require_seeds.deploysWithCompose(workspace) ? require_seeds.createComposeState(stage) : require_seeds.createEmptyState(stage, "", "")));
+	const writeSecrets = async (values) => {
+		if (dryRun) return;
+		const stored = await options.secrets.read() ?? require_seeds.initStageSecrets(stage);
+		const next = {
+			...stored,
+			custom: {
+				...stored.custom,
+				...values
+			},
+			updatedAt: (/* @__PURE__ */ new Date()).toISOString()
+		};
+		await options.secrets.write(next);
+		secrets = next.custom;
+	};
+	for (const entry of configured) {
+		log(`☁️  ${entry.kind}: ${entry.provider.name}${dryRun ? " (dry run)" : ""}`);
+		await entry.provider.ensure({
+			workspace,
+			manifest,
+			runnables,
+			stage,
+			identity,
+			config: entry.config,
+			credential: entry.credential,
+			get secrets() {
+				return secrets;
+			},
+			state,
+			dryRun,
+			rotateKeys: options.rotateKeys === true,
+			retireOldKeys: options.retireOldKeys === true,
+			async change(action, apply) {
+				if (!dryRun) await apply();
+				entry.report.actions.push(action);
+				log(`   ${dryRun ? "would " : ""}${action.change} — ${action.resource}`);
+			},
+			writeSecrets,
+			log
+		});
+		if (entry.report.actions.length === 0) log("   up to date");
+	}
+	return reports;
+}
+/** The journal as `ensure()` sees it. */
+function journalState(journal) {
+	return {
+		record: (key) => journal.record(key),
+		pending: (entry) => journal.pending(entry),
+		ready: (entry, id) => journal.ready(entry, id),
+		lastDeployedAt: journal.existed ? journal.state.lastDeployedAt : void 0
+	};
+}
+/** What a dry run reads, and the writes it does not make. */
+async function readOnlyState(store, stage) {
+	const stored = await store.read(stage);
+	return {
+		record: (key) => stored?.resources[key],
+		pending: async () => {},
+		ready: async () => {},
+		...stored ? { lastDeployedAt: stored.state.lastDeployedAt } : {}
+	};
+}
+//#endregion
+Object.defineProperty(exports, "DeployJournal", {
+	enumerable: true,
+	get: function() {
+		return DeployJournal;
+	}
+});
+Object.defineProperty(exports, "provisionStage", {
+	enumerable: true,
+	get: function() {
+		return provisionStage;
+	}
+});
+Object.defineProperty(exports, "verifyStageProviders", {
+	enumerable: true,
+	get: function() {
+		return verifyStageProviders;
+	}
+});
+
+//# sourceMappingURL=providers-BFeP_mYw.cjs.map