@geekmidas/cli 10.0.0-alpha.95 → 10.0.0-alpha.96

package/dist/{deploy-B0drCD6s.mjs → deploy-DktQl7ti.mjs}

@@ -4,15 +4,15 @@ import { r as storedCredentials } from "./credentials-B5N5yKk6.mjs";
 import { f as withOutput, r as discover } from "./discover-qjFapetL.mjs";
 import { c as withSandbox } from "./sandbox-CbVB7uOD.mjs";
 import { n as derivedApps, t as appKey } from "./derive-B4vDpzgP.mjs";
-import { $ as RotationInProgress, G as checkS3Config, J as BucketNameUnavailable, K as AccessKeyLimit, L as resolveStageTelemetry, N as assertDeployedStage, Q as RecordedBucketUnreachable, U as stageProvider, W as S3_PROVISIONING, X as IamUserNotOwned, Y as BucketOwnedByAnotherProject, Z as ProvisionedBucketUnreachable, et as S3RegionRequired, q as BucketKeySetElsewhere, u as getAppBuildOrder } from "./workspace-DWK1PTXP.mjs";
+import { $ as IamUserNotOwned, G as checkS3Config, J as BucketNameUnavailable, K as AccessKeyLimit, L as resolveStageTelemetry, N as assertDeployedStage, Q as BucketRegionUnknown, U as stageProvider, W as S3_PROVISIONING, X as BucketProbeFailed, Y as BucketOwnedByAnotherProject, Z as BucketRegionMismatch, et as ProvisionedBucketUnreachable, nt as RotationInProgress, q as BucketKeySetElsewhere, rt as S3RegionRequired, tt as RecordedBucketUnreachable, u as getAppBuildOrder } from "./workspace-CqFUjObk.mjs";
 import { o as builtinTarget } from "./define-6poNqm5O.mjs";
 import { findWorkspaceRoot, loadWorkspaceConfig } from "./config.mjs";
-import { E as reportDevServices, F as DeployJournal, H as createComposeState, In as applicationName, It as appEnvKeys, Ln as deployIdentity, N as stageProviderNotes, O as stageServiceDeclarations, On as secretsStoreFor, P as PROVIDER_KINDS, T as externalServices, U as createEmptyState, Wn as initStageSecrets, b as DevServicesNeedServerTarget, ct as constructGlobs, fn as usesTelemetry, j as assertStageProvidersEnabled, nr as isMainFrontendApp, rr as resolveHost, tr as NoDomainForStage, w as devServicesUsed, x as ExternalServicesNotConfigured } from "./seeds-CoKkrSny.mjs";
-import { a as parseTargetOptions, o as resolveTarget } from "./resolve-DakDhr6Z.mjs";
+import { E as reportDevServices, F as DeployJournal, H as createComposeState, In as applicationName, It as appEnvKeys, Ln as deployIdentity, N as stageProviderNotes, O as stageServiceDeclarations, On as secretsStoreFor, P as PROVIDER_KINDS, T as externalServices, U as createEmptyState, Wn as initStageSecrets, b as DevServicesNeedServerTarget, ct as constructGlobs, fn as usesTelemetry, j as assertStageProvidersEnabled, nr as isMainFrontendApp, rr as resolveHost, tr as NoDomainForStage, w as devServicesUsed, x as ExternalServicesNotConfigured } from "./seeds-CbJSne1A.mjs";
+import { a as parseTargetOptions, o as resolveTarget } from "./resolve-CUne0qOm.mjs";
 import { t as LocalSandbox } from "./local-BwC2v2Y8.mjs";
-import { S as eventError, _ as assertStateOutlivesRun, y as createStateStore } from "./sniffer-CFRzIrby.mjs";
-import { c as stageDnsDomains, n as dnsCredentials } from "./dns-idXfyCay.mjs";
-import { t as deploysWithCompose } from "./dns-X3oqEV4C.mjs";
+import { S as eventError, _ as assertStateOutlivesRun, y as createStateStore } from "./sniffer-DQGBYY8i.mjs";
+import { c as stageDnsDomains, n as dnsCredentials } from "./dns-C2EeR6n2.mjs";
+import { t as deploysWithCompose } from "./dns-BjHECDO7.mjs";
 import { n as assertStageCredentials } from "./credentialSchemas-BJFvfkaz.mjs";
 import { resolve } from "node:path";
 import { dependentsOf, kebabCase, provideKey, providedKeyFor } from "@geekmidas/manifest";
@@ -447,6 +447,74 @@ function errorName(error) {
 	const e = error;
 	return e?.Code ?? e?.name ?? "";
 }
+/** The answer an SDK call failed with. */
+function s3Answer(error) {
+	const e = error;
+	const headers = Object.fromEntries(Object.entries(e?.$response?.headers ?? {}).map(([k, v]) => [k.toLowerCase(), v]));
+	const status = e?.$metadata?.httpStatusCode ?? e?.$response?.statusCode;
+	const region = headers["x-amz-bucket-region"];
+	const requestId = e?.$metadata?.requestId ?? headers["x-amz-request-id"];
+	const id2 = e?.$metadata?.extendedRequestId ?? headers["x-amz-id-2"];
+	return {
+		...status !== void 0 ? { status } : {},
+		name: errorName(error) || "Error",
+		message: e?.message ?? String(error),
+		...region ? { region } : {},
+		...requestId ? { requestId } : {},
+		...id2 ? { id2 } : {}
+	};
+}
+/**
+* `HTTP 403 Unknown: UnknownError [x-amz-bucket-region: eu-west-1,
+* x-amz-request-id: …, x-amz-id-2: …]` — everything S3 said, for a message.
+*/
+function describeAnswer(answer) {
+	const said = answer.message && answer.message !== answer.name ? `${answer.name}: ${answer.message}` : answer.name;
+	const headers = [
+		answer.region && `x-amz-bucket-region: ${answer.region}`,
+		answer.requestId && `x-amz-request-id: ${answer.requestId}`,
+		answer.id2 && `x-amz-id-2: ${answer.id2}`
+	].filter(Boolean);
+	return `${answer.status === void 0 ? "no response" : `HTTP ${answer.status}`} ${said}` + (headers.length > 0 ? ` [${headers.join(", ")}]` : "");
+}
+/** `HeadBucket`: the bucket's region when it answers, else what S3 said. */
+async function headBucket(S3, client, bucket) {
+	try {
+		const out = await client.send(new S3.HeadBucketCommand({ Bucket: bucket }));
+		return {
+			ok: true,
+			...out.BucketRegion ? { region: out.BucketRegion } : {}
+		};
+	} catch (error) {
+		return {
+			ok: false,
+			...s3Answer(error)
+		};
+	}
+}
+/** `GetBucketLocation`'s answer as a region: none is us-east-1, `EU` eu-west-1. */
+async function bucketLocation(S3, client, bucket) {
+	try {
+		const location = (await client.send(new S3.GetBucketLocationCommand({ Bucket: bucket }))).LocationConstraint;
+		return { region: !location ? "us-east-1" : location === "EU" ? "eu-west-1" : location };
+	} catch (error) {
+		return { failed: s3Answer(error) };
+	}
+}
+/**
+* Where `bucket` is: `HeadBucket`'s `x-amz-bucket-region` — on a 200, a 301
+* or a 400 alike — else `GetBucketLocation`.
+*
+* @throws {BucketRegionUnknown}
+*/
+async function bucketRegion(clients, bucket) {
+	const { S3, s3 } = clients;
+	const head = await headBucket(S3, s3, bucket);
+	if (head.region) return head.region;
+	const location = await bucketLocation(S3, s3, bucket);
+	if ("region" in location) return location.region;
+	throw new BucketRegionUnknown(bucket, head.ok ? "HTTP 200 without x-amz-bucket-region" : describeAnswer(head), describeAnswer(location.failed));
+}
 /** A read whose "there is none" answer is one of `missing`. */
 async function readOr(read, missing) {
 	try {
@@ -500,7 +568,7 @@ function identityTags(ctx, id) {
 		}
 	];
 }
-async function ensureBucket(ctx, clients, construct) {
+async function ensureBucket(ctx, stageClients, construct) {
 	const { id } = construct;
 	const nameInput = {
 		scope: ctx.identity.scope,
@@ -509,7 +577,13 @@ async function ensureBucket(ctx, clients, construct) {
 	};
 	const versioning = ctx.config.versioning ?? construct.versioned;
 	const open = [...new Set(construct.servers.flatMap((s) => s.open))].sort();
-	const { bucket, exists } = await ensureBucketName(ctx, clients, id, bucketName(nameInput));
+	const located = await ensureBucketName(ctx, stageClients, id, bucketName(nameInput));
+	const { bucket, exists } = located;
+	let clients = stageClients;
+	if (located.region !== stageClients.region) {
+		clients = await makeClients(ctx.credential, located.region);
+		ctx.log(`   '${bucket}' is in ${located.region}, not ${stageClients.region}: '${id}' is reached and addressed there`);
+	}
 	await ensureBucketSettings(ctx, clients, {
 		id,
 		bucket,
@@ -517,10 +591,11 @@ async function ensureBucket(ctx, clients, construct) {
 		versioning,
 		open
 	});
+	const user = await ensureUser(ctx, clients, id, iamUserName(nameInput), userPolicy(bucket, { versioning }));
 	await ensureAccessKey(ctx, clients, {
 		id,
 		bucket,
-		...await ensureUser(ctx, clients, id, iamUserName(nameInput), userPolicy(bucket, { versioning }))
+		...user
 	});
 	const publicUrl = bucketPublicUrl(bucket, clients.region, clients.endpoint);
 	for (const server of construct.servers) {
@@ -557,26 +632,32 @@ async function ensureBucketName(ctx, clients, id, good) {
 	const { S3, s3, region } = clients;
 	const key = `s3-bucket:${id}`;
 	const record = ctx.state.record(key);
-	const entry = (name) => ({
+	const entry = (name, where) => ({
 		key,
 		type: "s3-bucket",
 		data: {
 			name,
-			region
+			region: where
 		}
 	});
-	/** Whether this account holds `name`: yes, no, or someone else does. */
+	/**
+	* Whether this account holds `name`: yes, no, or someone else does. Read
+	* by status — a `HEAD` has no body, so its error is named `Unknown` — and,
+	* when S3 says the bucket is in another region, asked again there.
+	*/
 	const probe = async (name) => {
-		try {
-			await s3.send(new S3.HeadBucketCommand({ Bucket: name }));
-			return "ours";
-		} catch (error) {
-			const name = errorName(error);
-			if (name === "NotFound" || name === "NoSuchBucket") return "none";
-			if (name === "Forbidden" || name === "AccessDenied") return "taken";
-			throw error;
+		let head = await headBucket(S3, s3, name);
+		if (!head.ok && head.region && head.region !== region && (head.status === 301 || head.status === 400)) {
+			const there = await makeClients(ctx.credential, head.region);
+			head = await headBucket(there.S3, there.s3, name);
 		}
+		if (head.ok) return "ours";
+		if (head.status === 404) return "none";
+		if (head.status === 403) return "taken";
+		throw new BucketProbeFailed(name, describeAnswer(head));
 	};
+	/** Where the bucket is now — read, not assumed: it may be adopted. */
+	const located = async (name, made) => ctx.dryRun && made === "created" ? region : bucketRegion(clients, name);
 	const create = async (name) => {
 		if (ctx.dryRun) {
 			const found = await probe(name);
@@ -590,7 +671,7 @@ async function ensureBucketName(ctx, clients, id, good) {
 			}
 			return found;
 		}
-		await ctx.state.pending(entry(name));
+		await ctx.state.pending(entry(name, region));
 		try {
 			await s3.send(new S3.CreateBucketCommand({
 				Bucket: name,
@@ -609,23 +690,22 @@ async function ensureBucketName(ctx, clients, id, good) {
 		}, async () => {});
 		return "created";
 	};
-	const adopt = async (name) => {
-		const owner = (await readOr(() => s3.send(new S3.GetBucketTaggingCommand({ Bucket: name })), ["NoSuchTagSet", "NoSuchTagSetError"]))?.TagSet?.find((t) => t.Key === TAG_PROJECT)?.Value;
+	const adopt = async (name, where) => {
+		const there = where === region ? clients : await makeClients(ctx.credential, where);
+		const owner = (await readOr(() => there.s3.send(new there.S3.GetBucketTaggingCommand({ Bucket: name })), ["NoSuchTagSet", "NoSuchTagSetError"]))?.TagSet?.find((t) => t.Key === TAG_PROJECT)?.Value;
 		if (owner && owner !== ctx.identity.key) throw new BucketOwnedByAnotherProject(name, owner, ctx.identity.key);
 	};
 	if (record?.status === "ready" && record.id) {
 		const found = await probe(record.id);
-		if (found === "ours") return {
-			bucket: record.id,
-			exists: true
-		};
 		if (found === "taken") throw new RecordedBucketUnreachable(id, record.id);
-		const made = await create(record.id);
+		const made = found === "ours" ? "ours" : await create(record.id);
 		if (made === "taken") throw new RecordedBucketUnreachable(id, record.id);
-		if (!ctx.dryRun) await ctx.state.ready(entry(record.id), record.id);
+		const where = await located(record.id, made);
+		if (!ctx.dryRun) await ctx.state.ready(entry(record.id, where), record.id);
 		return {
 			bucket: record.id,
-			exists: made === "ours"
+			exists: made === "ours",
+			region: where
 		};
 	}
 	const pending = record?.data?.name;
@@ -639,12 +719,14 @@ async function ensureBucketName(ctx, clients, id, good) {
 		tried.push(name);
 		const made = await create(name);
 		if (made === "taken") continue;
-		if (made === "ours") await adopt(name);
-		if (!ctx.dryRun) await ctx.state.ready(entry(name), name);
+		const where = await located(name, made);
+		if (made === "ours") await adopt(name, where);
+		if (!ctx.dryRun) await ctx.state.ready(entry(name, where), name);
 		if (name !== good) ctx.log(`   '${good}' is taken by another account; '${id}' is '${name}', recorded in the stage's state`);
 		return {
 			bucket: name,
-			exists: made === "ours"
+			exists: made === "ours",
+			region: where
 		};
 	}
 	throw new BucketNameUnavailable(id, tried.filter((n) => n !== pending));
@@ -808,8 +890,8 @@ async function ensureAccessKey(ctx, clients, input) {
 	const record = ctx.state.record(entryKey);
 	const given = ctx.secrets[urlKey];
 	let inUrl;
+	let parsed;
 	if (given !== void 0) {
-		let parsed;
 		try {
 			parsed = s3Url.parse(given);
 		} catch {
@@ -853,7 +935,20 @@ async function ensureAccessKey(ctx, clients, input) {
 		await ctx.state.ready(entry(), inUrl);
 		current = inUrl;
 	}
-	if (current !== void 0 && listed.includes(current) && inUrl === current && !ctx.rotateKeys) return;
+	if (current !== void 0 && listed.includes(current) && inUrl === current && !ctx.rotateKeys) {
+		if (parsed && parsed.region !== clients.region) {
+			const address = parsed;
+			await ctx.change({
+				construct: id,
+				resource: urlKey,
+				change: `name ${clients.region}, the bucket's region (it said ${address.region ?? "none"})`
+			}, () => ctx.writeSecrets({ [urlKey]: s3Url.build({
+				...address,
+				region: clients.region
+			}) }));
+		}
+		return;
+	}
 	if (ctx.rotateKeys && previous) throw new RotationInProgress(id, previous, ctx.stage);
 	const outgoing = current && listed.includes(current) ? current : void 0;
 	if (listed.length >= 2) throw new AccessKeyLimit(user, listed);
@@ -875,28 +970,58 @@ async function ensureAccessKey(ctx, clients, input) {
 			accessKeyId: key.AccessKeyId,
 			secretAccessKey: key.SecretAccessKey
 		}) });
+		const issuedAt = (/* @__PURE__ */ new Date()).toISOString();
 		await ctx.state.ready(entry(outgoing ? {
 			previous: outgoing,
-			rotatedAt: (/* @__PURE__ */ new Date()).toISOString()
-		} : {}), key.AccessKeyId);
+			rotatedAt: issuedAt,
+			issuedAt
+		} : { issuedAt }), key.AccessKeyId);
 	});
 	if (outgoing) ctx.log(`   ${urlKey} holds the new key. This deploy moves '${ctx.stage}' onto it; the next deploy after it deletes the old key ${outgoing}`);
 }
+/** How long a key issued this recently counts as new to IAM. */
+const NEW_KEY_WINDOW_MS = 6e5;
+/** The waits between asks while a new key becomes usable: about a minute. */
+let newKeyWaits = [
+	2e3,
+	4e3,
+	8e3,
+	15e3,
+	15e3,
+	15e3
+];
+/** When the key in the URL was issued, if the stage's state says it was just now. */
+function issuedJustNow(ctx, id, accessKeyId) {
+	const record = ctx.resources?.[`iam-access-key:${id}`];
+	const issuedAt = record?.data?.issuedAt;
+	if (record?.id !== accessKeyId || typeof issuedAt !== "string") return;
+	const age = Date.now() - Date.parse(issuedAt);
+	return age >= 0 && age < NEW_KEY_WINDOW_MS ? issuedAt : void 0;
+}
 /**
 * Each provisioned bucket answers `HeadBucket` to the key in the stage's
 * secrets — the one the apps will use. A bucket whose URL carries no key is
 * not one this provider wrote, and the deploy's own check covers a URL that
 * is missing.
+*
+* A failure is read by its status, never its name — a `HEAD` has no body,
+* so SDK v3 calls a 301, 400 or 403 `Unknown` — and the message carries
+* everything S3 said: status, error, region, request ids.
+*
+* @throws {BucketRegionMismatch} the bucket is in another region than its URL says
+* @throws {ProvisionedBucketUnreachable}
 */
 async function verifyS3(ctx) {
 	const S3 = await import("@aws-sdk/client-s3");
 	for (const { id } of bucketConstructs(ctx.manifest)) {
-		const url = ctx.secrets[provideKey(id, "url")];
+		const urlKey = provideKey(id, "url");
+		const url = ctx.secrets[urlKey];
 		if (url === void 0) continue;
 		const address = s3Url.parse(url);
 		if (!address.accessKeyId || !address.secretAccessKey) continue;
+		const asked = address.region ?? ctx.config.region ?? "us-east-1";
 		const client = new S3.S3Client({
-			region: address.region ?? ctx.config.region ?? "us-east-1",
+			region: asked,
 			credentials: {
 				accessKeyId: address.accessKeyId,
 				secretAccessKey: address.secretAccessKey
@@ -905,10 +1030,35 @@ async function verifyS3(ctx) {
 			...address.forcePathStyle ? { forcePathStyle: true } : {}
 		});
 		try {
-			await client.send(new S3.HeadBucketCommand({ Bucket: address.bucket }));
-		} catch (error) {
-			const name = errorName(error);
-			throw new ProvisionedBucketUnreachable(id, address.bucket, ctx.stage, name === "NotFound" ? "it does not exist" : name === "Forbidden" ? "the key is refused" : name || String(error));
+			let head = await headBucket(S3, client, address.bucket);
+			const issuedAt = issuedJustNow(ctx, id, address.accessKeyId);
+			let waited = 0;
+			if (!head.ok && head.status === 403 && issuedAt) {
+				ctx.log?.(`   ${id}: waiting for the new key ${address.accessKeyId} to become active…`);
+				for (const wait of newKeyWaits) {
+					await new Promise((resolve) => setTimeout(resolve, wait));
+					waited += wait;
+					head = await headBucket(S3, client, address.bucket);
+					if (head.ok || head.status !== 403) break;
+				}
+			}
+			if (head.ok) continue;
+			const fail = (reason) => new ProvisionedBucketUnreachable(id, address.bucket, ctx.stage, reason);
+			const said = describeAnswer(head);
+			if (head.status === 301 || head.status === 400 && head.region && head.region !== asked) {
+				let where = head.region;
+				let located = "";
+				if (!where) {
+					const location = await bucketLocation(S3, client, address.bucket);
+					if ("region" in location) where = location.region;
+					else located = `; GetBucketLocation answered ${describeAnswer(location.failed)}`;
+				}
+				if (where && where !== asked) throw new BucketRegionMismatch(id, address.bucket, ctx.stage, urlKey, where, address.region, asked, said);
+				throw fail(`S3 redirected the request (${said}${located})`);
+			}
+			if (head.status === 404) throw fail(`it does not exist (${said})`);
+			if (head.status === 403) throw fail(`the key is refused — AccessDenied, or an invalid or not-yet-active key (${said})` + (issuedAt ? `. The key was issued at ${issuedAt} by this deploy, and IAM keys take seconds to become usable: it was still refused after waiting ${Math.round(waited / 1e3)}s` : ""));
+			throw fail(said);
 		} finally {
 			client.destroy();
 		}
@@ -961,7 +1111,9 @@ async function verifyStageProviders(input) {
 			manifest: input.manifest,
 			stage: input.stage,
 			config: choice.config,
-			secrets: input.secrets
+			secrets: input.secrets,
+			...input.resources ? { resources: input.resources } : {},
+			...input.log ? { log: input.log } : {}
 		});
 		verified.push(`${kind}: ${provider.name}`);
 	}
@@ -1255,7 +1407,9 @@ async function assertStageReady(ctx) {
 			workspace,
 			manifest,
 			stage,
-			secrets: supplied
+			secrets: supplied,
+			resources: (await ctx.state.read(stage))?.resources ?? {},
+			log: (line) => ctx.logger.info(line)
 		});
 		for (const line of verified) ctx.logger.info(`✓ ${line} verified`);
 	}
@@ -1851,4 +2005,4 @@ async function load(input, sandbox) {
 //#endregion
 export { UnknownDeployApps as a, iamUserName as c, TargetBuildsNothing as i, NoDeployableApps as n, IAM_USER_PATH as o, RollbackFailed as r, bucketName as s, deploy as t };
 
-//# sourceMappingURL=deploy-B0drCD6s.mjs.map
+//# sourceMappingURL=deploy-DktQl7ti.mjs.map