@geekmidas/cli 10.0.0-alpha.95 → 10.0.0-alpha.96

package/dist/config.cjs

@@ -4,7 +4,7 @@ const require_schemas = require("./schemas-BObwxB_t.cjs");
 const require_discover = require("./discover-DPgu-ScS.cjs");
 const require_sandbox = require("./sandbox-CHv3OYXg.cjs");
 const require_derive = require("./derive-DAbo49sm.cjs");
-const require_workspace = require("./workspace-cSyi5nb1.cjs");
+const require_workspace = require("./workspace-DDkm4y6D.cjs");
 let node_path = require("node:path");
 let node_fs = require("node:fs");
 //#region src/config.ts

package/dist/config.mjs

@@ -3,7 +3,7 @@ import { a as discriminatedUnion, d as record, f as string, h as unknown, n as a
 import { c as runWorker, d as output, r as discover } from "./discover-qjFapetL.mjs";
 import { i as activeSandbox } from "./sandbox-CbVB7uOD.mjs";
 import { n as derivedApps } from "./derive-B4vDpzgP.mjs";
-import { a as allConstructGlobs, b as isWorkspaceConfig, d as getAppGkmConfig, l as defineWorkspace, m as processConfig } from "./workspace-DWK1PTXP.mjs";
+import { a as allConstructGlobs, b as isWorkspaceConfig, d as getAppGkmConfig, l as defineWorkspace, m as processConfig } from "./workspace-CqFUjObk.mjs";
 import { dirname, join, parse, resolve, sep } from "node:path";
 import { existsSync, realpathSync } from "node:fs";
 //#region src/config.ts

package/dist/deploy/public.cjs

@@ -4,16 +4,16 @@ const require_run = require("../run-fVZ-rLnc.cjs");
 const require_credentials = require("../credentials-Zqr3QQYB.cjs");
 const require_discover = require("../discover-DPgu-ScS.cjs");
 const require_sandbox = require("../sandbox-CHv3OYXg.cjs");
-const require_workspace = require("../workspace-cSyi5nb1.cjs");
+const require_workspace = require("../workspace-DDkm4y6D.cjs");
 const require_define = require("../define-crmMcXFS.cjs");
 const require_config = require("../config.cjs");
-const require_seeds = require("../seeds-CnXkgKUv.cjs");
-const require_resolve = require("../resolve-CFb4Navi.cjs");
+const require_seeds = require("../seeds-BjXW-Krf.cjs");
+const require_resolve = require("../resolve-BDatNOoG.cjs");
 const require_local = require("../local-DNhnkugT.cjs");
-const require_sniffer = require("../sniffer-vbiQ2Isn.cjs");
-const require_deploy = require("../deploy-Bw1FjX_x.cjs");
-const require_engine = require("../engine-WY6j_kvA.cjs");
-const require_rollback = require("../rollback-B-1dPP0m.cjs");
+const require_sniffer = require("../sniffer-NPD1dyab.cjs");
+const require_deploy = require("../deploy-BdN0ym2i.cjs");
+const require_engine = require("../engine-OVVKtPmW.cjs");
+const require_rollback = require("../rollback-CuG3DkTY.cjs");
 const require_provider = require("../provider-BqpjG9QM.cjs");
 const require_sst = require("../sst-DGuHDxVU.cjs");
 let node_path = require("node:path");

package/dist/deploy/public.mjs

@@ -3,16 +3,16 @@ import { n as CommandTimedOut, o as GKM_HOME_ENV, s as gkmHome, t as CommandFail
 import { n as chainCredentials, r as storedCredentials, t as MissingCredential } from "../credentials-B5N5yKk6.mjs";
 import { n as ConstructsNotSerializable, o as SandboxWorkerFailed, t as ConstructDiscoveryFailed } from "../discover-qjFapetL.mjs";
 import { n as SandboxCwdEscape, o as confineCwd, r as SecretNameInvalid, t as SECRETS_DIR_ENV } from "../sandbox-CbVB7uOD.mjs";
-import { V as UnknownStageProvider, Z as ProvisionedBucketUnreachable } from "../workspace-DWK1PTXP.mjs";
+import { V as UnknownStageProvider, et as ProvisionedBucketUnreachable } from "../workspace-CqFUjObk.mjs";
 import { a as UnknownDeployTarget, i as DeployTargetNotYetSupported } from "../define-6poNqm5O.mjs";
 import { ConfigLoadFailed, ConfigObjectNotSerializable } from "../config.mjs";
-import { A as StageProviderDisabled, Kt as detectPackageManager, Ln as deployIdentity, b as DevServicesNeedServerTarget, t as DeploySeedsFailed, v as AllowDevServicesTakesNoValue, x as ExternalServicesNotConfigured, y as DEV_SERVICES } from "../seeds-CoKkrSny.mjs";
-import { i as TargetRuntimeMismatch, l as TargetPackageNotFound, n as TargetEntryInvalid, r as TargetPackageInvalid, s as TargetRuntimeUndeclared, t as InvalidTargetOptions } from "../resolve-DakDhr6Z.mjs";
+import { A as StageProviderDisabled, Kt as detectPackageManager, Ln as deployIdentity, b as DevServicesNeedServerTarget, t as DeploySeedsFailed, v as AllowDevServicesTakesNoValue, x as ExternalServicesNotConfigured, y as DEV_SERVICES } from "../seeds-CbJSne1A.mjs";
+import { i as TargetRuntimeMismatch, l as TargetPackageNotFound, n as TargetEntryInvalid, r as TargetPackageInvalid, s as TargetRuntimeUndeclared, t as InvalidTargetOptions } from "../resolve-CUne0qOm.mjs";
 import { n as SANDBOX_ENV_ALLOWLIST, r as allowlistedEnv, t as LocalSandbox } from "../local-BwC2v2Y8.mjs";
-import { a as DeploymentTimedOut, f as StateLocked, h as StateVersionConflict, i as DeploymentFailed, u as LocalStateInCi } from "../sniffer-CFRzIrby.mjs";
-import { a as UnknownDeployApps, i as TargetBuildsNothing, n as NoDeployableApps, r as RollbackFailed, t as deploy } from "../deploy-B0drCD6s.mjs";
-import { _ as RegistryNotConfigured, g as RegistryAmbiguous, h as HealthCheckTimedOut, m as DeployMigrationsFailed, n as FrontendDeployFailed, r as MissingEnvVars, t as BackendDeployFailed, v as RegistryNotFound, y as ProjectNotOwned } from "../engine-BcuhnyQO.mjs";
-import { i as rollbackStage, n as RollbackNeedsApp, r as StageNeverDeployed, t as NothingToRollBack } from "../rollback-B1TIpjdE.mjs";
+import { a as DeploymentTimedOut, f as StateLocked, h as StateVersionConflict, i as DeploymentFailed, u as LocalStateInCi } from "../sniffer-DQGBYY8i.mjs";
+import { a as UnknownDeployApps, i as TargetBuildsNothing, n as NoDeployableApps, r as RollbackFailed, t as deploy } from "../deploy-DktQl7ti.mjs";
+import { _ as RegistryNotConfigured, g as RegistryAmbiguous, h as HealthCheckTimedOut, m as DeployMigrationsFailed, n as FrontendDeployFailed, r as MissingEnvVars, t as BackendDeployFailed, v as RegistryNotFound, y as ProjectNotOwned } from "../engine-YlXzlTUl.mjs";
+import { i as rollbackStage, n as RollbackNeedsApp, r as StageNeverDeployed, t as NothingToRollBack } from "../rollback-CCdEEEcF.mjs";
 import { t as ProviderRemoved } from "../provider-CEOKk8NS.mjs";
 import { i as SurfacesUnhealthy, r as SstOutputsUnreadable, t as SstConfigNotFound } from "../sst-CGdjHn2A.mjs";
 import { join, resolve } from "node:path";

package/dist/{deploy-Bw1FjX_x.cjs → deploy-BdN0ym2i.cjs}

@@ -5,15 +5,15 @@ const require_credentials = require("./credentials-Zqr3QQYB.cjs");
 const require_discover = require("./discover-DPgu-ScS.cjs");
 const require_sandbox = require("./sandbox-CHv3OYXg.cjs");
 const require_derive = require("./derive-DAbo49sm.cjs");
-const require_workspace = require("./workspace-cSyi5nb1.cjs");
+const require_workspace = require("./workspace-DDkm4y6D.cjs");
 const require_define = require("./define-crmMcXFS.cjs");
 const require_config = require("./config.cjs");
-const require_seeds = require("./seeds-CnXkgKUv.cjs");
-const require_resolve = require("./resolve-CFb4Navi.cjs");
+const require_seeds = require("./seeds-BjXW-Krf.cjs");
+const require_resolve = require("./resolve-BDatNOoG.cjs");
 const require_local = require("./local-DNhnkugT.cjs");
-const require_sniffer = require("./sniffer-vbiQ2Isn.cjs");
-const require_dns = require("./dns-Bmk7P9c2.cjs");
-const require_dns$1 = require("./dns-CyMIq6to.cjs");
+const require_sniffer = require("./sniffer-NPD1dyab.cjs");
+const require_dns = require("./dns-C-X6PLkV.cjs");
+const require_dns$1 = require("./dns-ClI7-d5g.cjs");
 const require_credentialSchemas = require("./credentialSchemas-CAPKFkrG.cjs");
 let node_path = require("node:path");
 let _geekmidas_manifest = require("@geekmidas/manifest");
@@ -449,6 +449,74 @@ function errorName(error) {
 	const e = error;
 	return e?.Code ?? e?.name ?? "";
 }
+/** The answer an SDK call failed with. */
+function s3Answer(error) {
+	const e = error;
+	const headers = Object.fromEntries(Object.entries(e?.$response?.headers ?? {}).map(([k, v]) => [k.toLowerCase(), v]));
+	const status = e?.$metadata?.httpStatusCode ?? e?.$response?.statusCode;
+	const region = headers["x-amz-bucket-region"];
+	const requestId = e?.$metadata?.requestId ?? headers["x-amz-request-id"];
+	const id2 = e?.$metadata?.extendedRequestId ?? headers["x-amz-id-2"];
+	return {
+		...status !== void 0 ? { status } : {},
+		name: errorName(error) || "Error",
+		message: e?.message ?? String(error),
+		...region ? { region } : {},
+		...requestId ? { requestId } : {},
+		...id2 ? { id2 } : {}
+	};
+}
+/**
+* `HTTP 403 Unknown: UnknownError [x-amz-bucket-region: eu-west-1,
+* x-amz-request-id: …, x-amz-id-2: …]` — everything S3 said, for a message.
+*/
+function describeAnswer(answer) {
+	const said = answer.message && answer.message !== answer.name ? `${answer.name}: ${answer.message}` : answer.name;
+	const headers = [
+		answer.region && `x-amz-bucket-region: ${answer.region}`,
+		answer.requestId && `x-amz-request-id: ${answer.requestId}`,
+		answer.id2 && `x-amz-id-2: ${answer.id2}`
+	].filter(Boolean);
+	return `${answer.status === void 0 ? "no response" : `HTTP ${answer.status}`} ${said}` + (headers.length > 0 ? ` [${headers.join(", ")}]` : "");
+}
+/** `HeadBucket`: the bucket's region when it answers, else what S3 said. */
+async function headBucket(S3, client, bucket) {
+	try {
+		const out = await client.send(new S3.HeadBucketCommand({ Bucket: bucket }));
+		return {
+			ok: true,
+			...out.BucketRegion ? { region: out.BucketRegion } : {}
+		};
+	} catch (error) {
+		return {
+			ok: false,
+			...s3Answer(error)
+		};
+	}
+}
+/** `GetBucketLocation`'s answer as a region: none is us-east-1, `EU` eu-west-1. */
+async function bucketLocation(S3, client, bucket) {
+	try {
+		const location = (await client.send(new S3.GetBucketLocationCommand({ Bucket: bucket }))).LocationConstraint;
+		return { region: !location ? "us-east-1" : location === "EU" ? "eu-west-1" : location };
+	} catch (error) {
+		return { failed: s3Answer(error) };
+	}
+}
+/**
+* Where `bucket` is: `HeadBucket`'s `x-amz-bucket-region` — on a 200, a 301
+* or a 400 alike — else `GetBucketLocation`.
+*
+* @throws {BucketRegionUnknown}
+*/
+async function bucketRegion(clients, bucket) {
+	const { S3, s3 } = clients;
+	const head = await headBucket(S3, s3, bucket);
+	if (head.region) return head.region;
+	const location = await bucketLocation(S3, s3, bucket);
+	if ("region" in location) return location.region;
+	throw new require_workspace.BucketRegionUnknown(bucket, head.ok ? "HTTP 200 without x-amz-bucket-region" : describeAnswer(head), describeAnswer(location.failed));
+}
 /** A read whose "there is none" answer is one of `missing`. */
 async function readOr(read, missing) {
 	try {
@@ -502,7 +570,7 @@ function identityTags(ctx, id) {
 		}
 	];
 }
-async function ensureBucket(ctx, clients, construct) {
+async function ensureBucket(ctx, stageClients, construct) {
 	const { id } = construct;
 	const nameInput = {
 		scope: ctx.identity.scope,
@@ -511,7 +579,13 @@ async function ensureBucket(ctx, clients, construct) {
 	};
 	const versioning = ctx.config.versioning ?? construct.versioned;
 	const open = [...new Set(construct.servers.flatMap((s) => s.open))].sort();
-	const { bucket, exists } = await ensureBucketName(ctx, clients, id, bucketName(nameInput));
+	const located = await ensureBucketName(ctx, stageClients, id, bucketName(nameInput));
+	const { bucket, exists } = located;
+	let clients = stageClients;
+	if (located.region !== stageClients.region) {
+		clients = await makeClients(ctx.credential, located.region);
+		ctx.log(`   '${bucket}' is in ${located.region}, not ${stageClients.region}: '${id}' is reached and addressed there`);
+	}
 	await ensureBucketSettings(ctx, clients, {
 		id,
 		bucket,
@@ -519,10 +593,11 @@ async function ensureBucket(ctx, clients, construct) {
 		versioning,
 		open
 	});
+	const user = await ensureUser(ctx, clients, id, iamUserName(nameInput), userPolicy(bucket, { versioning }));
 	await ensureAccessKey(ctx, clients, {
 		id,
 		bucket,
-		...await ensureUser(ctx, clients, id, iamUserName(nameInput), userPolicy(bucket, { versioning }))
+		...user
 	});
 	const publicUrl = bucketPublicUrl(bucket, clients.region, clients.endpoint);
 	for (const server of construct.servers) {
@@ -559,26 +634,32 @@ async function ensureBucketName(ctx, clients, id, good) {
 	const { S3, s3, region } = clients;
 	const key = `s3-bucket:${id}`;
 	const record = ctx.state.record(key);
-	const entry = (name) => ({
+	const entry = (name, where) => ({
 		key,
 		type: "s3-bucket",
 		data: {
 			name,
-			region
+			region: where
 		}
 	});
-	/** Whether this account holds `name`: yes, no, or someone else does. */
+	/**
+	* Whether this account holds `name`: yes, no, or someone else does. Read
+	* by status — a `HEAD` has no body, so its error is named `Unknown` — and,
+	* when S3 says the bucket is in another region, asked again there.
+	*/
 	const probe = async (name) => {
-		try {
-			await s3.send(new S3.HeadBucketCommand({ Bucket: name }));
-			return "ours";
-		} catch (error) {
-			const name = errorName(error);
-			if (name === "NotFound" || name === "NoSuchBucket") return "none";
-			if (name === "Forbidden" || name === "AccessDenied") return "taken";
-			throw error;
+		let head = await headBucket(S3, s3, name);
+		if (!head.ok && head.region && head.region !== region && (head.status === 301 || head.status === 400)) {
+			const there = await makeClients(ctx.credential, head.region);
+			head = await headBucket(there.S3, there.s3, name);
 		}
+		if (head.ok) return "ours";
+		if (head.status === 404) return "none";
+		if (head.status === 403) return "taken";
+		throw new require_workspace.BucketProbeFailed(name, describeAnswer(head));
 	};
+	/** Where the bucket is now — read, not assumed: it may be adopted. */
+	const located = async (name, made) => ctx.dryRun && made === "created" ? region : bucketRegion(clients, name);
 	const create = async (name) => {
 		if (ctx.dryRun) {
 			const found = await probe(name);
@@ -592,7 +673,7 @@ async function ensureBucketName(ctx, clients, id, good) {
 			}
 			return found;
 		}
-		await ctx.state.pending(entry(name));
+		await ctx.state.pending(entry(name, region));
 		try {
 			await s3.send(new S3.CreateBucketCommand({
 				Bucket: name,
@@ -611,23 +692,22 @@ async function ensureBucketName(ctx, clients, id, good) {
 		}, async () => {});
 		return "created";
 	};
-	const adopt = async (name) => {
-		const owner = (await readOr(() => s3.send(new S3.GetBucketTaggingCommand({ Bucket: name })), ["NoSuchTagSet", "NoSuchTagSetError"]))?.TagSet?.find((t) => t.Key === TAG_PROJECT)?.Value;
+	const adopt = async (name, where) => {
+		const there = where === region ? clients : await makeClients(ctx.credential, where);
+		const owner = (await readOr(() => there.s3.send(new there.S3.GetBucketTaggingCommand({ Bucket: name })), ["NoSuchTagSet", "NoSuchTagSetError"]))?.TagSet?.find((t) => t.Key === TAG_PROJECT)?.Value;
 		if (owner && owner !== ctx.identity.key) throw new require_workspace.BucketOwnedByAnotherProject(name, owner, ctx.identity.key);
 	};
 	if (record?.status === "ready" && record.id) {
 		const found = await probe(record.id);
-		if (found === "ours") return {
-			bucket: record.id,
-			exists: true
-		};
 		if (found === "taken") throw new require_workspace.RecordedBucketUnreachable(id, record.id);
-		const made = await create(record.id);
+		const made = found === "ours" ? "ours" : await create(record.id);
 		if (made === "taken") throw new require_workspace.RecordedBucketUnreachable(id, record.id);
-		if (!ctx.dryRun) await ctx.state.ready(entry(record.id), record.id);
+		const where = await located(record.id, made);
+		if (!ctx.dryRun) await ctx.state.ready(entry(record.id, where), record.id);
 		return {
 			bucket: record.id,
-			exists: made === "ours"
+			exists: made === "ours",
+			region: where
 		};
 	}
 	const pending = record?.data?.name;
@@ -641,12 +721,14 @@ async function ensureBucketName(ctx, clients, id, good) {
 		tried.push(name);
 		const made = await create(name);
 		if (made === "taken") continue;
-		if (made === "ours") await adopt(name);
-		if (!ctx.dryRun) await ctx.state.ready(entry(name), name);
+		const where = await located(name, made);
+		if (made === "ours") await adopt(name, where);
+		if (!ctx.dryRun) await ctx.state.ready(entry(name, where), name);
 		if (name !== good) ctx.log(`   '${good}' is taken by another account; '${id}' is '${name}', recorded in the stage's state`);
 		return {
 			bucket: name,
-			exists: made === "ours"
+			exists: made === "ours",
+			region: where
 		};
 	}
 	throw new require_workspace.BucketNameUnavailable(id, tried.filter((n) => n !== pending));
@@ -810,8 +892,8 @@ async function ensureAccessKey(ctx, clients, input) {
 	const record = ctx.state.record(entryKey);
 	const given = ctx.secrets[urlKey];
 	let inUrl;
+	let parsed;
 	if (given !== void 0) {
-		let parsed;
 		try {
 			parsed = _geekmidas_storage_s3_url.parse(given);
 		} catch {
@@ -855,7 +937,20 @@ async function ensureAccessKey(ctx, clients, input) {
 		await ctx.state.ready(entry(), inUrl);
 		current = inUrl;
 	}
-	if (current !== void 0 && listed.includes(current) && inUrl === current && !ctx.rotateKeys) return;
+	if (current !== void 0 && listed.includes(current) && inUrl === current && !ctx.rotateKeys) {
+		if (parsed && parsed.region !== clients.region) {
+			const address = parsed;
+			await ctx.change({
+				construct: id,
+				resource: urlKey,
+				change: `name ${clients.region}, the bucket's region (it said ${address.region ?? "none"})`
+			}, () => ctx.writeSecrets({ [urlKey]: _geekmidas_storage_s3_url.build({
+				...address,
+				region: clients.region
+			}) }));
+		}
+		return;
+	}
 	if (ctx.rotateKeys && previous) throw new require_workspace.RotationInProgress(id, previous, ctx.stage);
 	const outgoing = current && listed.includes(current) ? current : void 0;
 	if (listed.length >= 2) throw new require_workspace.AccessKeyLimit(user, listed);
@@ -877,28 +972,58 @@ async function ensureAccessKey(ctx, clients, input) {
 			accessKeyId: key.AccessKeyId,
 			secretAccessKey: key.SecretAccessKey
 		}) });
+		const issuedAt = (/* @__PURE__ */ new Date()).toISOString();
 		await ctx.state.ready(entry(outgoing ? {
 			previous: outgoing,
-			rotatedAt: (/* @__PURE__ */ new Date()).toISOString()
-		} : {}), key.AccessKeyId);
+			rotatedAt: issuedAt,
+			issuedAt
+		} : { issuedAt }), key.AccessKeyId);
 	});
 	if (outgoing) ctx.log(`   ${urlKey} holds the new key. This deploy moves '${ctx.stage}' onto it; the next deploy after it deletes the old key ${outgoing}`);
 }
+/** How long a key issued this recently counts as new to IAM. */
+const NEW_KEY_WINDOW_MS = 6e5;
+/** The waits between asks while a new key becomes usable: about a minute. */
+let newKeyWaits = [
+	2e3,
+	4e3,
+	8e3,
+	15e3,
+	15e3,
+	15e3
+];
+/** When the key in the URL was issued, if the stage's state says it was just now. */
+function issuedJustNow(ctx, id, accessKeyId) {
+	const record = ctx.resources?.[`iam-access-key:${id}`];
+	const issuedAt = record?.data?.issuedAt;
+	if (record?.id !== accessKeyId || typeof issuedAt !== "string") return;
+	const age = Date.now() - Date.parse(issuedAt);
+	return age >= 0 && age < NEW_KEY_WINDOW_MS ? issuedAt : void 0;
+}
 /**
 * Each provisioned bucket answers `HeadBucket` to the key in the stage's
 * secrets — the one the apps will use. A bucket whose URL carries no key is
 * not one this provider wrote, and the deploy's own check covers a URL that
 * is missing.
+*
+* A failure is read by its status, never its name — a `HEAD` has no body,
+* so SDK v3 calls a 301, 400 or 403 `Unknown` — and the message carries
+* everything S3 said: status, error, region, request ids.
+*
+* @throws {BucketRegionMismatch} the bucket is in another region than its URL says
+* @throws {ProvisionedBucketUnreachable}
 */
 async function verifyS3(ctx) {
 	const S3 = await import("@aws-sdk/client-s3");
 	for (const { id } of bucketConstructs(ctx.manifest)) {
-		const url = ctx.secrets[(0, _geekmidas_manifest.provideKey)(id, "url")];
+		const urlKey = (0, _geekmidas_manifest.provideKey)(id, "url");
+		const url = ctx.secrets[urlKey];
 		if (url === void 0) continue;
 		const address = _geekmidas_storage_s3_url.parse(url);
 		if (!address.accessKeyId || !address.secretAccessKey) continue;
+		const asked = address.region ?? ctx.config.region ?? "us-east-1";
 		const client = new S3.S3Client({
-			region: address.region ?? ctx.config.region ?? "us-east-1",
+			region: asked,
 			credentials: {
 				accessKeyId: address.accessKeyId,
 				secretAccessKey: address.secretAccessKey
@@ -907,10 +1032,35 @@ async function verifyS3(ctx) {
 			...address.forcePathStyle ? { forcePathStyle: true } : {}
 		});
 		try {
-			await client.send(new S3.HeadBucketCommand({ Bucket: address.bucket }));
-		} catch (error) {
-			const name = errorName(error);
-			throw new require_workspace.ProvisionedBucketUnreachable(id, address.bucket, ctx.stage, name === "NotFound" ? "it does not exist" : name === "Forbidden" ? "the key is refused" : name || String(error));
+			let head = await headBucket(S3, client, address.bucket);
+			const issuedAt = issuedJustNow(ctx, id, address.accessKeyId);
+			let waited = 0;
+			if (!head.ok && head.status === 403 && issuedAt) {
+				ctx.log?.(`   ${id}: waiting for the new key ${address.accessKeyId} to become active…`);
+				for (const wait of newKeyWaits) {
+					await new Promise((resolve) => setTimeout(resolve, wait));
+					waited += wait;
+					head = await headBucket(S3, client, address.bucket);
+					if (head.ok || head.status !== 403) break;
+				}
+			}
+			if (head.ok) continue;
+			const fail = (reason) => new require_workspace.ProvisionedBucketUnreachable(id, address.bucket, ctx.stage, reason);
+			const said = describeAnswer(head);
+			if (head.status === 301 || head.status === 400 && head.region && head.region !== asked) {
+				let where = head.region;
+				let located = "";
+				if (!where) {
+					const location = await bucketLocation(S3, client, address.bucket);
+					if ("region" in location) where = location.region;
+					else located = `; GetBucketLocation answered ${describeAnswer(location.failed)}`;
+				}
+				if (where && where !== asked) throw new require_workspace.BucketRegionMismatch(id, address.bucket, ctx.stage, urlKey, where, address.region, asked, said);
+				throw fail(`S3 redirected the request (${said}${located})`);
+			}
+			if (head.status === 404) throw fail(`it does not exist (${said})`);
+			if (head.status === 403) throw fail(`the key is refused — AccessDenied, or an invalid or not-yet-active key (${said})` + (issuedAt ? `. The key was issued at ${issuedAt} by this deploy, and IAM keys take seconds to become usable: it was still refused after waiting ${Math.round(waited / 1e3)}s` : ""));
+			throw fail(said);
 		} finally {
 			client.destroy();
 		}
@@ -963,7 +1113,9 @@ async function verifyStageProviders(input) {
 			manifest: input.manifest,
 			stage: input.stage,
 			config: choice.config,
-			secrets: input.secrets
+			secrets: input.secrets,
+			...input.resources ? { resources: input.resources } : {},
+			...input.log ? { log: input.log } : {}
 		});
 		verified.push(`${kind}: ${provider.name}`);
 	}
@@ -1257,7 +1409,9 @@ async function assertStageReady(ctx) {
 			workspace,
 			manifest,
 			stage,
-			secrets: supplied
+			secrets: supplied,
+			resources: (await ctx.state.read(stage))?.resources ?? {},
+			log: (line) => ctx.logger.info(line)
 		});
 		for (const line of verified) ctx.logger.info(`✓ ${line} verified`);
 	}
@@ -1900,4 +2054,4 @@ Object.defineProperty(exports, "iamUserName", {
 	}
 });
 
-//# sourceMappingURL=deploy-Bw1FjX_x.cjs.map
+//# sourceMappingURL=deploy-BdN0ym2i.cjs.map