@geekmidas/cli 10.0.0-alpha.94 → 10.0.0-alpha.96

package/dist/providers-BFeP_mYw.cjs

@@ -1,1098 +0,0 @@
-const require_rolldown_runtime = require("./rolldown-runtime-C0BPl7ul.cjs");
-const require_errors = require("./errors-DMC4Umsb.cjs");
-const require_credentials = require("./credentials-D7XJypNd.cjs");
-const require_derive = require("./derive-DAbo49sm.cjs");
-const require_workspace = require("./workspace-cSyi5nb1.cjs");
-const require_seeds = require("./seeds-BCg8X36S.cjs");
-let _geekmidas_manifest = require("@geekmidas/manifest");
-let _geekmidas_storage_s3_url = require("@geekmidas/storage/s3-url");
-_geekmidas_storage_s3_url = require_rolldown_runtime.__toESM(_geekmidas_storage_s3_url, 1);
-//#region src/deploy/journal.ts
-var DeployJournal = class DeployJournal {
-	store;
-	stage;
-	state;
-	resources;
-	version;
-	existed;
-	constructor(store, stage, state, resources, version, existed) {
-		this.store = store;
-		this.stage = stage;
-		this.state = state;
-		this.resources = resources;
-		this.version = version;
-		this.existed = existed;
-	}
-	static async open(store, stage, initial, adopt = (stored) => stored) {
-		const stored = await store.read(stage);
-		if (stored) return new DeployJournal(store, stage, adopt(stored.state), stored.resources, stored.version, true);
-		const state = initial();
-		const version = await store.write(stage, state, { expectedVersion: null });
-		return new DeployJournal(store, stage, state, {}, version, false);
-	}
-	record(key) {
-		return this.resources[key];
-	}
-	/** The keys a previous run marked `pending` and never saw created. */
-	unfinished() {
-		return Object.values(this.resources).filter((record) => record.status === "pending").map((record) => record.key);
-	}
-	/** Records that `entry` is about to be created. */
-	async pending(entry) {
-		await this.put({
-			...entry,
-			status: "pending"
-		});
-	}
-	/**
-	* Records `entry` as existing with `id`; a no-op if it already is, with
-	* the same data.
-	*/
-	async ready(entry, id) {
-		const current = this.resources[entry.key];
-		if (current?.status === "ready" && current.id === id && JSON.stringify(current.data) === JSON.stringify(entry.data)) return;
-		await this.put({
-			...entry,
-			status: "ready",
-			id
-		});
-	}
-	/**
-	* The resource `entry` names: by its recorded id, else by looking it up,
-	* else created — with `pending` written before the create and `ready`
-	* after, so a run that dies in between leaves a record the next run
-	* resolves by looking the resource up rather than creating another.
-	*/
-	async ensure(entry, steps) {
-		const record = this.resources[entry.key];
-		let staleId;
-		if (record?.status === "ready" && record.id && steps.get) {
-			const known = await steps.get(record.id);
-			if (known) {
-				await this.ready(entry, steps.id(known));
-				return {
-					resource: known,
-					via: "recorded"
-				};
-			}
-			staleId = record.id;
-		}
-		const existing = await steps.find();
-		if (existing) {
-			await this.ready(entry, steps.id(existing));
-			return {
-				resource: existing,
-				via: record?.status === "pending" ? "resumed" : "found",
-				...staleId ? { staleId } : {}
-			};
-		}
-		await this.pending(entry);
-		const created = await steps.create();
-		await this.ready(entry, steps.id(created));
-		return {
-			resource: created,
-			via: "created",
-			...staleId ? { staleId } : {}
-		};
-	}
-	/** Removes `key`'s record — a resource that no longer exists. */
-	async forget(key) {
-		if (!(key in this.resources)) return;
-		this.version = await this.store.deleteResource(this.stage, key, { expectedVersion: this.version });
-		const { [key]: _removed, ...resources } = this.resources;
-		this.resources = resources;
-	}
-	/** Every record, as the journal last wrote or read it. */
-	records() {
-		return this.resources;
-	}
-	/** Writes the stage's state, keeping its resource records. */
-	async save() {
-		this.state.lastDeployedAt = (/* @__PURE__ */ new Date()).toISOString();
-		this.version = await this.store.write(this.stage, this.state, { expectedVersion: this.version });
-	}
-	async put(record) {
-		this.version = await this.store.putResource(this.stage, record, { expectedVersion: this.version });
-		this.resources = {
-			...this.resources,
-			[record.key]: {
-				...record,
-				updatedAt: (/* @__PURE__ */ new Date()).toISOString()
-			}
-		};
-	}
-};
-//#endregion
-//#region src/providers/aws.ts
-/**
-* The AWS account a provider provisions in — the stage's, found the way the
-* SSM and Secrets Manager stores find it.
-*
-* 1. `--profile`, resolved on its own: exported keys left over from another
-*    account never win over a profile someone named.
-* 2. `AWS_PROFILE`, else `AWS_ACCESS_KEY_ID`/`AWS_SECRET_ACCESS_KEY` — the
-*    deploy's own `aws` credential kind (`storedCredentials`).
-* 3. The SDK's default chain: `~/.aws` default profile, SSO, a role. In CI,
-*    whatever `aws-actions/configure-aws-credentials` exported.
-*
-* None of them: the provider has no provisioning credentials, and the stage
-* is treated as `external`.
-*/
-async function awsProvisioningCredentials(lookup) {
-	const region = lookup.env.AWS_REGION ?? lookup.env.AWS_DEFAULT_REGION;
-	const where = region ? { region } : {};
-	if (lookup.profile) return {
-		profile: lookup.profile,
-		...where
-	};
-	const stored = await require_credentials.storedCredentials({
-		env: lookup.env,
-		...lookup.home ? { home: lookup.home } : {}
-	}).get({
-		kind: "aws",
-		stage: lookup.stage
-	});
-	if (stored) return stored;
-	try {
-		const { fromNodeProviderChain } = await import("@aws-sdk/credential-providers");
-		await fromNodeProviderChain({
-			timeout: 1e3,
-			maxRetries: 0
-		})();
-		return {
-			chain: true,
-			...where
-		};
-	} catch {
-		return;
-	}
-}
-/**
-* An S3-compatible endpoint the environment points the SDK at — the AWS
-* emulator in tests. The SDK reads it itself; it is read here too, because
-* an emulator takes path-style requests, and a key written for one has to
-* say where it is.
-*/
-function awsEndpoint(env, service) {
-	return env[`AWS_ENDPOINT_URL_${service}`] ?? env.AWS_ENDPOINT_URL;
-}
-/** An SDK client's config for a provisioning credential. */
-async function awsClientConfig(credential, region) {
-	if ("profile" in credential) {
-		const { fromIni } = await import("@aws-sdk/credential-providers");
-		return {
-			region,
-			credentials: fromIni({ profile: credential.profile })
-		};
-	}
-	if ("accessKeyId" in credential) return {
-		region,
-		credentials: {
-			accessKeyId: credential.accessKeyId,
-			secretAccessKey: credential.secretAccessKey,
-			...credential.sessionToken ? { sessionToken: credential.sessionToken } : {}
-		}
-	};
-	return { region };
-}
-//#endregion
-//#region src/providers/s3/origins.ts
-/**
-* Which browser origins may call a bucket: the stage's sites that depend on
-* an API using it.
-*
-* The same reading of the graph an API's own CORS origins are — its callers —
-* taken one step further: a site that calls an API which hands it a presigned
-* upload URL is a site whose browser PUTs to the bucket. A site that reads the
-* bucket (or a file server over it) itself is one too. Nothing is written
-* down: add a site that calls the API and the next provision run allows it.
-*/
-/** The keys a reader of this bucket holds: its URL, and each server's over it. */
-function bucketKeys(manifest, bucket) {
-	return [(0, _geekmidas_manifest.provideKey)(bucket, "url"), ...Object.entries(manifest).filter(([, d]) => d.kind === "file-server" && d.of === bucket).map(([id]) => (0, _geekmidas_manifest.provideKey)(id, "url"))];
-}
-function bucketOrigins(input) {
-	const { manifest, workspace, stage } = input;
-	const keys = bucketKeys(manifest, input.bucket);
-	const readers = Object.entries(manifest).filter(([, d]) => d.kind === "rest-api" || d.kind === "site").filter(([id]) => {
-		const env = require_seeds.appEnvKeys(manifest, require_derive.appKey(id), input.runnables);
-		return env !== void 0 && keys.some((key) => env.has(key));
-	});
-	const sites = /* @__PURE__ */ new Set();
-	for (const [id, declaration] of readers) {
-		if (declaration.kind === "site") {
-			sites.add(id);
-			continue;
-		}
-		for (const caller of (0, _geekmidas_manifest.dependentsOf)(manifest, id)) if (manifest[caller]?.kind === "site") sites.add(caller);
-	}
-	const origins = /* @__PURE__ */ new Set();
-	const unresolved = [];
-	for (const id of [...sites].sort()) {
-		const name = require_derive.appKey(id);
-		const app = workspace.apps[name];
-		if (!app) {
-			unresolved.push(name);
-			continue;
-		}
-		try {
-			const host = require_seeds.resolveHost(name, app, stage, workspace.domains, require_seeds.isMainFrontendApp(name, app, workspace.apps));
-			origins.add(`https://${host}`);
-		} catch (error) {
-			if (!(error instanceof require_seeds.NoDomainForStage)) throw error;
-			unresolved.push(name);
-		}
-	}
-	return {
-		origins: [...origins].sort(),
-		unresolved
-	};
-}
-//#endregion
-//#region src/providers/s3/policy.ts
-const bucketArn = (bucket) => `arn:aws:s3:::${bucket}`;
-/**
-* What the app's key may do: objects in this bucket, and listing it — and
-* nothing else in the account.
-*
-* Multipart uploads are in it because a presigned upload of a large file is
-* one, and an abandoned one is cleaned up by the app. Reading old versions is
-* added only when the bucket keeps them.
-*/
-function userPolicy(bucket, options = {}) {
-	return {
-		Version: "2012-10-17",
-		Statement: [{
-			Sid: "GkmObjects",
-			Effect: "Allow",
-			Action: [
-				"s3:GetObject",
-				"s3:PutObject",
-				"s3:DeleteObject",
-				"s3:AbortMultipartUpload",
-				"s3:ListMultipartUploadParts",
-				...options.versioning ? ["s3:GetObjectVersion"] : []
-			],
-			Resource: `${bucketArn(bucket)}/*`
-		}, {
-			Sid: "GkmBucket",
-			Effect: "Allow",
-			Action: [
-				"s3:ListBucket",
-				"s3:GetBucketLocation",
-				"s3:ListBucketMultipartUploads"
-			],
-			Resource: bucketArn(bucket)
-		}]
-	};
-}
-/**
-* One open pattern as the resource it is public on. A `**` is S3's `*`; a
-* single `*` is too, which crosses `/` where the construct's own check does
-* not — the construct is the stricter of the two (see `bucketPolicy` in
-* reconcile, which the local MinIO is given the same way).
-*/
-function openResource(bucket, pattern) {
-	const path = pattern.replace(/^\/+/, "").replace(/\*\*/g, "*");
-	return `${bucketArn(bucket)}/${path}`;
-}
-/**
-* The bucket's own policy: every request refused unless it came over TLS,
-* and — only when a file server opens paths on it — anonymous `s3:GetObject`
-* on exactly those prefixes.
-*/
-function bucketPolicy(bucket, open = []) {
-	const statements = [{
-		Sid: "GkmDenyInsecureTransport",
-		Effect: "Deny",
-		Principal: "*",
-		Action: "s3:*",
-		Resource: [bucketArn(bucket), `${bucketArn(bucket)}/*`],
-		Condition: { Bool: { "aws:SecureTransport": "false" } }
-	}];
-	if (open.length > 0) statements.push({
-		Sid: "GkmOpenPaths",
-		Effect: "Allow",
-		Principal: "*",
-		Action: "s3:GetObject",
-		Resource: [...new Set(open.map((p) => openResource(bucket, p)))].sort()
-	});
-	return {
-		Version: "2012-10-17",
-		Statement: statements
-	};
-}
-/**
-* Block Public Access. All four flags on, unless the bucket has open paths:
-* then a *policy* may make it public (`BlockPublicPolicy`,
-* `RestrictPublicBuckets` off), and ACLs still may not.
-*/
-function publicAccessBlock(open) {
-	return {
-		BlockPublicAcls: true,
-		IgnorePublicAcls: true,
-		BlockPublicPolicy: !open,
-		RestrictPublicBuckets: !open
-	};
-}
-function corsRule(origins) {
-	return {
-		AllowedMethods: [
-			"GET",
-			"HEAD",
-			"POST",
-			"PUT"
-		],
-		AllowedOrigins: [...new Set(origins)].sort(),
-		AllowedHeaders: ["*"],
-		ExposeHeaders: ["ETag"],
-		MaxAgeSeconds: 3e3
-	};
-}
-/**
-* A policy document in one canonical form — keys sorted, a lone string a
-* one-element list, lists sorted — so one AWS reformatted reads as the same
-* document rather than as drift.
-*/
-function canonicalPolicy(value) {
-	return JSON.stringify(canonical(value));
-}
-function canonical(value, key) {
-	if (Array.isArray(value)) {
-		const items = value.map((v) => canonical(v));
-		return key === "Statement" ? items : items.map((v) => JSON.stringify(v)).sort();
-	}
-	if (value && typeof value === "object") return Object.fromEntries(Object.keys(value).sort().map((k) => {
-		const v = value[k];
-		return [k, canonical(k === "Action" || k === "Resource" || k === "AWS" ? Array.isArray(v) ? v : [v] : v, k)];
-	}));
-	return value;
-}
-//#endregion
-//#region src/providers/s3/index.ts
-/** The tags gkm finds its own buckets and users by. */
-const TAG_PROJECT = "gkm:project";
-const TAG_STAGE = "gkm:stage";
-const TAG_CONSTRUCT = "gkm:construct";
-function bucketConstructs(manifest) {
-	return Object.entries(manifest).filter(([, d]) => d.kind === "objects").map(([id, d]) => ({
-		id,
-		versioned: d.versioned === true,
-		servers: Object.entries(manifest).filter(([, s]) => s.kind === "file-server" && s.of === id).map(([sid, s]) => ({
-			id: sid,
-			open: s.open ?? []
-		})).sort((a, b) => a.id.localeCompare(b.id))
-	})).sort((a, b) => a.id.localeCompare(b.id));
-}
-/**
-* The region the stage's buckets are created in: the entry's, the secrets
-* store's when it is in AWS, the credential's, `AWS_REGION`.
-*/
-function s3Region(ctx, env = process.env) {
-	const store = ctx.workspace.secrets?.store;
-	const storeRegion = store && typeof store === "object" && "region" in store ? store.region : void 0;
-	const region = ctx.config.region ?? storeRegion ?? ctx.credential?.region ?? env.AWS_REGION ?? env.AWS_DEFAULT_REGION;
-	if (!region) throw new require_workspace.S3RegionRequired(ctx.stage);
-	return region;
-}
-/**
-* The address a file server over `bucket` serves on: the bucket's regional
-* virtual-host endpoint, which is what `FileServer.url(key)` appends a key to
-* — `https://<bucket>.s3.<region>.amazonaws.com/<key>`. Against an emulator,
-* its path-style address.
-*/
-function bucketPublicUrl(bucket, region, endpoint) {
-	if (endpoint) return `${endpoint.replace(/\/+$/, "")}/${bucket}`;
-	return `https://${bucket}.s3.${region}.amazonaws.com`;
-}
-/** What an AWS SDK error is called, whichever field carries it. */
-function errorName(error) {
-	const e = error;
-	return e?.Code ?? e?.name ?? "";
-}
-/** A read whose "there is none" answer is one of `missing`. */
-async function readOr(read, missing) {
-	try {
-		return await read();
-	} catch (error) {
-		if (missing.includes(errorName(error))) return void 0;
-		throw error;
-	}
-}
-const defaultClients = async (credential, region) => {
-	const S3 = await import("@aws-sdk/client-s3");
-	const IAM = await import("@aws-sdk/client-iam");
-	const config = await awsClientConfig(credential, region);
-	const endpoint = awsEndpoint(process.env, "S3");
-	return {
-		S3,
-		IAM,
-		s3: new S3.S3Client({
-			...config,
-			...endpoint ? {
-				endpoint,
-				forcePathStyle: true
-			} : {}
-		}),
-		iam: new IAM.IAMClient(config),
-		region,
-		...endpoint ? { endpoint } : {}
-	};
-};
-/** For tests: what makes the clients. */
-let makeClients = defaultClients;
-async function ensureS3(ctx) {
-	const region = s3Region(ctx);
-	const clients = await makeClients(ctx.credential, region);
-	for (const construct of bucketConstructs(ctx.manifest)) await ensureBucket(ctx, clients, construct);
-}
-/** The keys gkm tags a bucket and a user with. */
-function identityTags(ctx, id) {
-	return [
-		{
-			Key: TAG_PROJECT,
-			Value: ctx.identity.key
-		},
-		{
-			Key: TAG_STAGE,
-			Value: ctx.stage
-		},
-		{
-			Key: TAG_CONSTRUCT,
-			Value: id
-		}
-	];
-}
-async function ensureBucket(ctx, clients, construct) {
-	const { id } = construct;
-	const nameInput = {
-		scope: ctx.identity.scope,
-		stage: ctx.stage,
-		id: require_derive.appKey(id)
-	};
-	const versioning = ctx.config.versioning ?? construct.versioned;
-	const open = [...new Set(construct.servers.flatMap((s) => s.open))].sort();
-	const { bucket, exists } = await ensureBucketName(ctx, clients, id, require_seeds.bucketName(nameInput));
-	await ensureBucketSettings(ctx, clients, {
-		id,
-		bucket,
-		exists,
-		versioning,
-		open
-	});
-	await ensureAccessKey(ctx, clients, {
-		id,
-		bucket,
-		...await ensureUser(ctx, clients, id, require_seeds.iamUserName(nameInput), userPolicy(bucket, { versioning }))
-	});
-	const publicUrl = bucketPublicUrl(bucket, clients.region, clients.endpoint);
-	for (const server of construct.servers) {
-		const key = (0, _geekmidas_manifest.provideKey)(server.id, "url");
-		const entry = {
-			key: `file-server:${server.id}`,
-			type: "url"
-		};
-		const recorded = ctx.state.record(entry.key)?.id;
-		const current = ctx.secrets[key];
-		if (current === publicUrl) {
-			await ctx.state.ready(entry, publicUrl);
-			continue;
-		}
-		if (current !== void 0 && current !== recorded) {
-			ctx.log(`   ${key} is set to ${current} by you, and kept — the bucket's own address is ${publicUrl}`);
-			continue;
-		}
-		await ctx.change({
-			construct: server.id,
-			resource: key,
-			change: `set to ${publicUrl}`
-		}, async () => {
-			await ctx.writeSecrets({ [key]: publicUrl });
-			await ctx.state.ready(entry, publicUrl);
-		});
-	}
-}
-/**
-* The bucket's name: the recorded one, else the good name, else the good
-* name with a random suffix — up to {@link SUFFIX_ATTEMPTS} times.
-*/
-async function ensureBucketName(ctx, clients, id, good) {
-	const { S3, s3, region } = clients;
-	const key = `s3-bucket:${id}`;
-	const record = ctx.state.record(key);
-	const entry = (name) => ({
-		key,
-		type: "s3-bucket",
-		data: {
-			name,
-			region
-		}
-	});
-	/** Whether this account holds `name`: yes, no, or someone else does. */
-	const probe = async (name) => {
-		try {
-			await s3.send(new S3.HeadBucketCommand({ Bucket: name }));
-			return "ours";
-		} catch (error) {
-			const name = errorName(error);
-			if (name === "NotFound" || name === "NoSuchBucket") return "none";
-			if (name === "Forbidden" || name === "AccessDenied") return "taken";
-			throw error;
-		}
-	};
-	const create = async (name) => {
-		if (ctx.dryRun) {
-			const found = await probe(name);
-			if (found === "none") {
-				await ctx.change({
-					construct: id,
-					resource: `bucket ${name}`,
-					change: `create in ${region}`
-				}, async () => {});
-				return "created";
-			}
-			return found;
-		}
-		await ctx.state.pending(entry(name));
-		try {
-			await s3.send(new S3.CreateBucketCommand({
-				Bucket: name,
-				...region === "us-east-1" ? {} : { CreateBucketConfiguration: { LocationConstraint: region } }
-			}));
-		} catch (error) {
-			const code = errorName(error);
-			if (code === "BucketAlreadyOwnedByYou") return "ours";
-			if (code === "BucketAlreadyExists") return "taken";
-			throw error;
-		}
-		await ctx.change({
-			construct: id,
-			resource: `bucket ${name}`,
-			change: `create in ${region}`
-		}, async () => {});
-		return "created";
-	};
-	const adopt = async (name) => {
-		const owner = (await readOr(() => s3.send(new S3.GetBucketTaggingCommand({ Bucket: name })), ["NoSuchTagSet", "NoSuchTagSetError"]))?.TagSet?.find((t) => t.Key === TAG_PROJECT)?.Value;
-		if (owner && owner !== ctx.identity.key) throw new require_workspace.BucketOwnedByAnotherProject(name, owner, ctx.identity.key);
-	};
-	if (record?.status === "ready" && record.id) {
-		const found = await probe(record.id);
-		if (found === "ours") return {
-			bucket: record.id,
-			exists: true
-		};
-		if (found === "taken") throw new require_workspace.RecordedBucketUnreachable(id, record.id);
-		const made = await create(record.id);
-		if (made === "taken") throw new require_workspace.RecordedBucketUnreachable(id, record.id);
-		if (!ctx.dryRun) await ctx.state.ready(entry(record.id), record.id);
-		return {
-			bucket: record.id,
-			exists: made === "ours"
-		};
-	}
-	const pending = record?.data?.name;
-	const names = [
-		...typeof pending === "string" && pending !== good ? [pending] : [],
-		good,
-		...Array.from({ length: 5 }, () => require_seeds.suffixedBucketName(good, require_seeds.randomSuffix()))
-	];
-	const tried = [];
-	for (const name of names) {
-		tried.push(name);
-		const made = await create(name);
-		if (made === "taken") continue;
-		if (made === "ours") await adopt(name);
-		if (!ctx.dryRun) await ctx.state.ready(entry(name), name);
-		if (name !== good) ctx.log(`   '${good}' is taken by another account; '${id}' is '${name}', recorded in the stage's state`);
-		return {
-			bucket: name,
-			exists: made === "ours"
-		};
-	}
-	throw new require_workspace.BucketNameUnavailable(id, tried.filter((n) => n !== pending));
-}
-/** Tags, Block Public Access, encryption, policy, versioning and CORS. */
-async function ensureBucketSettings(ctx, clients, input) {
-	const { S3, s3 } = clients;
-	const { id, bucket } = input;
-	const Bucket = bucket;
-	const fresh = ctx.dryRun && !input.exists;
-	const read = async (fn, missing) => fresh ? void 0 : readOr(fn, missing);
-	const set = (change, apply) => ctx.change({
-		construct: id,
-		resource: `bucket ${bucket}`,
-		change
-	}, () => apply().then(() => void 0));
-	const tagged = await read(() => s3.send(new S3.GetBucketTaggingCommand({ Bucket })), ["NoSuchTagSet", "NoSuchTagSetError"]);
-	const ours = identityTags(ctx, id);
-	const others = (tagged?.TagSet ?? []).filter((t) => !ours.some((o) => o.Key === t.Key));
-	if (ours.some((o) => !tagged?.TagSet?.some((t) => t.Key === o.Key && t.Value === o.Value))) await set("tag", () => s3.send(new S3.PutBucketTaggingCommand({
-		Bucket,
-		Tagging: { TagSet: [...others, ...ours].map((t) => ({
-			Key: t.Key,
-			Value: t.Value
-		})) }
-	})));
-	const isOpen = input.open.length > 0;
-	const block = publicAccessBlock(isOpen);
-	const ensureBlock = async () => {
-		const now = (await read(() => s3.send(new S3.GetPublicAccessBlockCommand({ Bucket })), ["NoSuchPublicAccessBlockConfiguration"]))?.PublicAccessBlockConfiguration;
-		if (!(now && Object.keys(block).every((k) => (now[k] ?? false) === block[k]))) await set(isOpen ? "block public access (ACLs; the policy opens the open paths)" : "block all public access", () => s3.send(new S3.PutPublicAccessBlockCommand({
-			Bucket,
-			PublicAccessBlockConfiguration: block
-		})));
-	};
-	const policy = bucketPolicy(bucket, input.open);
-	const ensurePolicy = async () => {
-		const current = await read(() => s3.send(new S3.GetBucketPolicyCommand({ Bucket })), ["NoSuchBucketPolicy"]);
-		if (!(current?.Policy !== void 0 && canonicalPolicy(JSON.parse(current.Policy)) === canonicalPolicy(policy))) await set(isOpen ? `policy: TLS only, public read on ${input.open.join(", ")}` : "policy: TLS only", () => s3.send(new S3.PutBucketPolicyCommand({
-			Bucket,
-			Policy: JSON.stringify(policy)
-		})));
-	};
-	if (isOpen) {
-		await ensureBlock();
-		await ensurePolicy();
-	} else {
-		await ensurePolicy();
-		await ensureBlock();
-	}
-	if ((await read(() => s3.send(new S3.GetBucketEncryptionCommand({ Bucket })), ["ServerSideEncryptionConfigurationNotFoundError"]))?.ServerSideEncryptionConfiguration?.Rules?.[0]?.ApplyServerSideEncryptionByDefault?.SSEAlgorithm !== "AES256" && !fresh) await set("encrypt by default (SSE-S3)", () => s3.send(new S3.PutBucketEncryptionCommand({
-		Bucket,
-		ServerSideEncryptionConfiguration: { Rules: [{ ApplyServerSideEncryptionByDefault: { SSEAlgorithm: "AES256" } }] }
-	})));
-	const status = (await read(() => s3.send(new S3.GetBucketVersioningCommand({ Bucket })), []))?.Status;
-	if (input.versioning && status !== "Enabled") await set("enable versioning", () => s3.send(new S3.PutBucketVersioningCommand({
-		Bucket,
-		VersioningConfiguration: { Status: "Enabled" }
-	})));
-	else if (!input.versioning && status === "Enabled") await set("suspend versioning", () => s3.send(new S3.PutBucketVersioningCommand({
-		Bucket,
-		VersioningConfiguration: { Status: "Suspended" }
-	})));
-	const { origins, unresolved } = bucketOrigins({
-		workspace: ctx.workspace,
-		manifest: ctx.manifest,
-		runnables: ctx.runnables,
-		stage: ctx.stage,
-		bucket: id
-	});
-	if (unresolved.length > 0) ctx.log(`   ${unresolved.join(", ")} ${unresolved.length === 1 ? "has" : "have"} no address on '${ctx.stage}' (domains.${ctx.stage}), so ${unresolved.length === 1 ? "is" : "are"} not in '${bucket}''s CORS`);
-	if (origins.length === 0) return;
-	const rule = corsRule(origins);
-	const cors = await read(() => s3.send(new S3.GetBucketCorsCommand({ Bucket })), ["NoSuchCORSConfiguration"]);
-	if (!(cors?.CORSRules?.length === 1 && canonicalCors(cors.CORSRules[0]) === canonicalCors(rule))) await set(`CORS for ${origins.join(", ")}`, () => s3.send(new S3.PutBucketCorsCommand({
-		Bucket,
-		CORSConfiguration: { CORSRules: [rule] }
-	})));
-}
-function canonicalCors(rule) {
-	const sorted = (list) => [...list ?? []].sort();
-	return JSON.stringify({
-		AllowedMethods: sorted(rule.AllowedMethods),
-		AllowedOrigins: sorted(rule.AllowedOrigins),
-		AllowedHeaders: sorted(rule.AllowedHeaders),
-		ExposeHeaders: sorted(rule.ExposeHeaders),
-		MaxAgeSeconds: rule.MaxAgeSeconds ?? null
-	});
-}
-/** The bucket's IAM user and its inline policy. */
-async function ensureUser(ctx, clients, id, user, policy) {
-	const { IAM, iam } = clients;
-	const entry = {
-		key: `iam-user:${id}`,
-		type: "iam-user"
-	};
-	const found = await readOr(() => iam.send(new IAM.GetUserCommand({ UserName: user })), ["NoSuchEntity", "NoSuchEntityException"]);
-	if (found?.User) {
-		const tags = await iam.send(new IAM.ListUserTagsCommand({ UserName: user }));
-		const tag = (key) => tags.Tags?.find((t) => t.Key === key)?.Value;
-		if (found.User.Path !== "/gkm/" || tag("gkm:project") !== ctx.identity.key || tag("gkm:stage") !== ctx.stage) throw new require_workspace.IamUserNotOwned(user, ctx.identity.key, ctx.stage);
-		await ctx.state.ready(entry, user);
-	} else await ctx.change({
-		construct: id,
-		resource: `IAM user ${user}`,
-		change: `create under ${require_seeds.IAM_USER_PATH}`
-	}, async () => {
-		await ctx.state.pending(entry);
-		await iam.send(new IAM.CreateUserCommand({
-			UserName: user,
-			Path: require_seeds.IAM_USER_PATH,
-			Tags: identityTags(ctx, id)
-		}));
-		await ctx.state.ready(entry, user);
-	});
-	const exists = Boolean(found?.User) || !ctx.dryRun;
-	const current = exists ? await readOr(() => iam.send(new IAM.GetUserPolicyCommand({
-		UserName: user,
-		PolicyName: require_seeds.IAM_POLICY_NAME
-	})), ["NoSuchEntity", "NoSuchEntityException"]) : void 0;
-	const document = current?.PolicyDocument ? JSON.parse(decodePolicy(current.PolicyDocument)) : void 0;
-	if (!document || canonicalPolicy(document) !== canonicalPolicy(policy)) await ctx.change({
-		construct: id,
-		resource: `IAM user ${user}`,
-		change: `policy ${require_seeds.IAM_POLICY_NAME}: this bucket only`
-	}, async () => {
-		await iam.send(new IAM.PutUserPolicyCommand({
-			UserName: user,
-			PolicyName: require_seeds.IAM_POLICY_NAME,
-			PolicyDocument: JSON.stringify(policy)
-		}));
-	});
-	return {
-		user,
-		exists
-	};
-}
-/** IAM returns a policy document URL-encoded; an emulator may not. */
-function decodePolicy(document) {
-	try {
-		return decodeURIComponent(document);
-	} catch {
-		return document;
-	}
-}
-/**
-* The user's access key, in the stage's secrets as the bucket's URL.
-*
-* - First run: one key, written into the stage's secrets.
-* - `--rotate-keys`: a second key, written in place of the first; the first
-*   stays active until the stage has deployed with the second, and the next
-*   run after that deploy — or `--retire-old-keys` — deletes it.
-* - A key the secrets no longer hold (a store emptied by hand): replaced the
-*   same way, since its secret cannot be read back.
-*/
-async function ensureAccessKey(ctx, clients, input) {
-	const { IAM, iam } = clients;
-	const { id, bucket, user } = input;
-	const urlKey = (0, _geekmidas_manifest.provideKey)(id, "url");
-	const entryKey = `iam-access-key:${id}`;
-	const record = ctx.state.record(entryKey);
-	const given = ctx.secrets[urlKey];
-	let inUrl;
-	if (given !== void 0) {
-		let parsed;
-		try {
-			parsed = _geekmidas_storage_s3_url.parse(given);
-		} catch {
-			parsed = void 0;
-		}
-		if (parsed?.bucket !== bucket) throw new require_workspace.BucketKeySetElsewhere(urlKey, bucket, parsed?.bucket ?? given.replace(/\/\/[^@]*@/, "//"), ctx.stage);
-		inUrl = parsed.accessKeyId;
-	}
-	const listed = input.exists ? (await iam.send(new IAM.ListAccessKeysCommand({ UserName: user }))).AccessKeyMetadata?.map((k) => k.AccessKeyId) ?? [] : [];
-	let current = record?.status === "ready" ? record.id : void 0;
-	let previous = typeof record?.data?.previous === "string" ? record.data.previous : void 0;
-	const rotatedAt = typeof record?.data?.rotatedAt === "string" ? record.data.rotatedAt : void 0;
-	const entry = (data = {}) => ({
-		key: entryKey,
-		type: "iam-access-key",
-		data: {
-			user,
-			...data
-		}
-	});
-	if (previous && current) {
-		const deployed = rotatedAt !== void 0 && ctx.state.lastDeployedAt !== void 0 && ctx.state.lastDeployedAt > rotatedAt;
-		if (ctx.retireOldKeys || deployed) {
-			const old = previous;
-			const keep = current;
-			await ctx.change({
-				construct: id,
-				resource: `IAM user ${user}`,
-				change: `delete the rotated-out access key ${old}`
-			}, async () => {
-				if (listed.includes(old)) await iam.send(new IAM.DeleteAccessKeyCommand({
-					UserName: user,
-					AccessKeyId: old
-				}));
-				await ctx.state.ready(entry(), keep);
-			});
-			previous = void 0;
-		} else ctx.log(`   ${id}: the old access key ${previous} stays active until '${ctx.stage}' is deployed with the new one; the next deploy after that deletes it (or pass --retire-old-keys)`);
-	}
-	if (!current && inUrl && listed.includes(inUrl)) {
-		await ctx.state.ready(entry(), inUrl);
-		current = inUrl;
-	}
-	if (current !== void 0 && listed.includes(current) && inUrl === current && !ctx.rotateKeys) return;
-	if (ctx.rotateKeys && previous) throw new require_workspace.RotationInProgress(id, previous, ctx.stage);
-	const outgoing = current && listed.includes(current) ? current : void 0;
-	if (listed.length >= 2) throw new require_workspace.AccessKeyLimit(user, listed);
-	const why = !current ? "create an access key" : ctx.rotateKeys ? "rotate: issue a new access key" : "issue a new access key (the secrets no longer hold the recorded one)";
-	await ctx.change({
-		construct: id,
-		resource: `IAM user ${user}`,
-		change: why
-	}, async () => {
-		await ctx.state.pending(entry(outgoing ? { previous: outgoing } : {}));
-		const key = (await iam.send(new IAM.CreateAccessKeyCommand({ UserName: user }))).AccessKey;
-		await ctx.writeSecrets({ [urlKey]: _geekmidas_storage_s3_url.build({
-			bucket,
-			region: clients.region,
-			...clients.endpoint ? {
-				endpoint: clients.endpoint,
-				forcePathStyle: true
-			} : {},
-			accessKeyId: key.AccessKeyId,
-			secretAccessKey: key.SecretAccessKey
-		}) });
-		await ctx.state.ready(entry(outgoing ? {
-			previous: outgoing,
-			rotatedAt: (/* @__PURE__ */ new Date()).toISOString()
-		} : {}), key.AccessKeyId);
-	});
-	if (outgoing) ctx.log(`   ${urlKey} holds the new key. This deploy moves '${ctx.stage}' onto it; the next deploy after it deletes the old key ${outgoing}`);
-}
-/**
-* Each provisioned bucket answers `HeadBucket` to the key in the stage's
-* secrets — the one the apps will use. A bucket whose URL carries no key is
-* not one this provider wrote, and the deploy's own check covers a URL that
-* is missing.
-*/
-async function verifyS3(ctx) {
-	const S3 = await import("@aws-sdk/client-s3");
-	for (const { id } of bucketConstructs(ctx.manifest)) {
-		const url = ctx.secrets[(0, _geekmidas_manifest.provideKey)(id, "url")];
-		if (url === void 0) continue;
-		const address = _geekmidas_storage_s3_url.parse(url);
-		if (!address.accessKeyId || !address.secretAccessKey) continue;
-		const client = new S3.S3Client({
-			region: address.region ?? ctx.config.region ?? "us-east-1",
-			credentials: {
-				accessKeyId: address.accessKeyId,
-				secretAccessKey: address.secretAccessKey
-			},
-			...address.endpoint ? { endpoint: address.endpoint } : {},
-			...address.forcePathStyle ? { forcePathStyle: true } : {}
-		});
-		try {
-			await client.send(new S3.HeadBucketCommand({ Bucket: address.bucket }));
-		} catch (error) {
-			const name = errorName(error);
-			throw new require_workspace.ProvisionedBucketUnreachable(id, address.bucket, ctx.stage, name === "NotFound" ? "it does not exist" : name === "Forbidden" ? "the key is refused" : name || String(error));
-		} finally {
-			client.destroy();
-		}
-	}
-}
-//#endregion
-//#region src/providers/registry.ts
-/**
-* The providers gkm ships, by kind and name — registered the way a deploy
-* target's built-ins are (`target/builtins.ts`). A provider from a package is
-* one more entry here once there is a loading story for it.
-*/
-const BUILTIN_PROVIDERS = { objects: { s3: {
-	kind: "objects",
-	name: "s3",
-	check: require_workspace.checkS3Config,
-	provisioning: require_workspace.S3_PROVISIONING,
-	credentials: awsProvisioningCredentials,
-	runtimeKeys(manifest) {
-		return bucketConstructs(manifest).flatMap((b) => [(0, _geekmidas_manifest.provideKey)(b.id, "url"), ...b.servers.map((s) => (0, _geekmidas_manifest.provideKey)(s.id, "url"))]);
-	},
-	ensure: ensureS3,
-	verify: verifyS3
-} } };
-/** The provider `kind` names `name`, if gkm has one. */
-function builtinProvider(kind, name) {
-	return Object.hasOwn(BUILTIN_PROVIDERS[kind], name) ? BUILTIN_PROVIDERS[kind][name] : void 0;
-}
-//#endregion
-//#region src/providers/index.ts
-/** The constructs of a kind: `objects` is every bucket. */
-function constructsOf(manifest, kind) {
-	return Object.entries(manifest).filter(([, d]) => d.kind === kind).map(([id]) => id).sort();
-}
-/**
-* What every deploy runs: each provider's `verify()` — the cheap check that
-* what it created is still there and the stage's key reaches it. Nothing on
-* the local stage, and nothing for a kind on `external`.
-*
-* @throws {StageProviderDisabled} for a declared kind the stage has none of
-*/
-async function verifyStageProviders(input) {
-	require_seeds.assertStageProvidersEnabled(input.workspace, input.manifest, input.stage);
-	const verified = [];
-	for (const kind of require_seeds.PROVIDER_KINDS) {
-		if (constructsOf(input.manifest, kind).length === 0) continue;
-		const choice = require_workspace.stageProvider(input.workspace, kind, input.stage);
-		if (choice.mode !== "provider") continue;
-		const provider = builtinProvider(kind, choice.name);
-		await provider.verify({
-			workspace: input.workspace,
-			manifest: input.manifest,
-			stage: input.stage,
-			config: choice.config,
-			secrets: input.secrets
-		});
-		verified.push(`${kind}: ${provider.name}`);
-	}
-	return verified;
-}
-/**
-* A stage whose provider creates its resources, and no credentials to create
-* them with. Raised before anything is created, built or started.
-*/
-var ProviderCredentialsMissing = class extends require_errors.GkmError {
-	stage;
-	kind;
-	provider;
-	ids;
-	env;
-	describe;
-	login;
-	constructor(stage, kind, provider, ids, env, describe, login) {
-		super(`deploy.${kind}.${stage} is ${provider}, so the deploy creates what ${ids.join(", ")} ${ids.length === 1 ? "is" : "are"} backed by on '${stage}' and writes ${ids.length === 1 ? "its key" : "their keys"} into the stage's secrets — and it found no ${provider} credentials to do it with. On this machine, supply ${describe}` + (login ? `, or run gkm login --provider ${login}` : "") + `. In CI, the step that runs the deploy (or gkm deploy --resources-only) needs them: the '${stage}' environment's role (AWS_ROLE_ARN, from gkm deploy:github), assumed before that step. With the keys set by hand instead, set deploy.${kind}.${stage} to 'external'.`);
-		this.stage = stage;
-		this.kind = kind;
-		this.provider = provider;
-		this.ids = ids;
-		this.env = env;
-		this.describe = describe;
-		this.login = login;
-		this.name = "ProviderCredentialsMissing";
-	}
-};
-/**
-* `ensure()` for every provider the stage configures — find or create, fix
-* drift, record in the stage's state, write the runtime keys into its
-* secrets. Run by the deploy, which holds the stage's lock. A provider with
-* no provisioning credentials stops the run with
-* {@link ProviderCredentialsMissing} before anything is created.
-*/
-async function provisionStage(options) {
-	const { workspace, stage, manifest } = options;
-	const dryRun = options.dryRun === true;
-	const env = options.env ?? process.env;
-	const log = options.log ?? ((line) => console.log(line));
-	const runnables = options.runnables ?? {};
-	const reports = [];
-	const configured = [];
-	for (const kind of require_seeds.PROVIDER_KINDS) {
-		const choice = require_workspace.stageProvider(workspace, kind, stage);
-		if (choice.mode !== "provider") {
-			reports.push({
-				kind,
-				mode: choice.mode,
-				actions: [],
-				planned: []
-			});
-			continue;
-		}
-		const provider = builtinProvider(kind, choice.name);
-		const report = {
-			kind,
-			mode: "provider",
-			provider: provider.name,
-			actions: [],
-			planned: []
-		};
-		reports.push(report);
-		const ids = constructsOf(manifest, kind);
-		if (ids.length === 0) continue;
-		const credential = await provider.credentials({
-			stage,
-			env,
-			...options.profile ? { profile: options.profile } : {},
-			...options.home ? { home: options.home } : {}
-		});
-		if (credential === void 0) throw new ProviderCredentialsMissing(stage, kind, provider.name, ids, provider.provisioning.env, provider.provisioning.describe, provider.provisioning.login);
-		configured.push({
-			kind,
-			provider,
-			config: choice.config,
-			credential,
-			report
-		});
-	}
-	if (configured.length === 0) return reports;
-	const identity = require_seeds.deployIdentity(workspace, stage);
-	let secrets = (await options.secrets.read())?.custom ?? {};
-	for (const entry of configured) entry.report.planned = entry.provider.runtimeKeys(manifest).filter((key) => secrets[key] === void 0);
-	const state = dryRun ? await readOnlyState(options.state, stage) : journalState(await DeployJournal.open(options.state, stage, () => require_seeds.deploysWithCompose(workspace) ? require_seeds.createComposeState(stage) : require_seeds.createEmptyState(stage, "", "")));
-	const writeSecrets = async (values) => {
-		if (dryRun) return;
-		const stored = await options.secrets.read() ?? require_seeds.initStageSecrets(stage);
-		const next = {
-			...stored,
-			custom: {
-				...stored.custom,
-				...values
-			},
-			updatedAt: (/* @__PURE__ */ new Date()).toISOString()
-		};
-		await options.secrets.write(next);
-		secrets = next.custom;
-	};
-	for (const entry of configured) {
-		log(`☁️  ${entry.kind}: ${entry.provider.name}${dryRun ? " (dry run)" : ""}`);
-		await entry.provider.ensure({
-			workspace,
-			manifest,
-			runnables,
-			stage,
-			identity,
-			config: entry.config,
-			credential: entry.credential,
-			get secrets() {
-				return secrets;
-			},
-			state,
-			dryRun,
-			rotateKeys: options.rotateKeys === true,
-			retireOldKeys: options.retireOldKeys === true,
-			async change(action, apply) {
-				if (!dryRun) await apply();
-				entry.report.actions.push(action);
-				log(`   ${dryRun ? "would " : ""}${action.change} — ${action.resource}`);
-			},
-			writeSecrets,
-			log
-		});
-		if (entry.report.actions.length === 0) log("   up to date");
-	}
-	return reports;
-}
-/** The journal as `ensure()` sees it. */
-function journalState(journal) {
-	return {
-		record: (key) => journal.record(key),
-		pending: (entry) => journal.pending(entry),
-		ready: (entry, id) => journal.ready(entry, id),
-		lastDeployedAt: journal.existed ? journal.state.lastDeployedAt : void 0
-	};
-}
-/** What a dry run reads, and the writes it does not make. */
-async function readOnlyState(store, stage) {
-	const stored = await store.read(stage);
-	return {
-		record: (key) => stored?.resources[key],
-		pending: async () => {},
-		ready: async () => {},
-		...stored ? { lastDeployedAt: stored.state.lastDeployedAt } : {}
-	};
-}
-//#endregion
-Object.defineProperty(exports, "DeployJournal", {
-	enumerable: true,
-	get: function() {
-		return DeployJournal;
-	}
-});
-Object.defineProperty(exports, "provisionStage", {
-	enumerable: true,
-	get: function() {
-		return provisionStage;
-	}
-});
-Object.defineProperty(exports, "verifyStageProviders", {
-	enumerable: true,
-	get: function() {
-		return verifyStageProviders;
-	}
-});
-
-//# sourceMappingURL=providers-BFeP_mYw.cjs.map