@nmakarov/cli-toolkit 0.27.0 → 0.32.0

package/README.md

@@ -51,6 +51,42 @@ Shipped as TypeScript sources under `scripts/ssm/` (included in the npm package)
 
 From a clone of this repo: `npm run ssm:list -- --prefix /your/prefix/`, `npm run ssm:pull -- --path /your/prefix/`.
 
+## Deploy ecosystem (`cli-deploy`)
+
+Manifest-driven release deploys to EC2: clone on the host, serve versioned
+releases out of `/apps/<service>/`, atomic `current` symlink switch, pm2 + nginx,
+and rollback. The engine is project-agnostic — projects only write a manifests
+module describing each app.
+
+```js
+// deploy/services.js
+export const services = {
+  web: {
+    name: "web",
+    appsRoot: "/apps/web",
+    repoUrl: "git@github.com:acme/web.git",
+    pm2: { script: "./src/index.js", port: 3000 },
+    nginx: { fqdn: "web.example.com" },
+    testCommand: "npm run test:ci", // optional
+  },
+};
+```
+
+```bash
+# from your laptop (SSH Host alias); add --host to run remotely
+cli-deploy setup    --service=web --host=web-prod   # bootstrap+init+provision+deploy
+cli-deploy deploy   --service=web --host=web-prod
+cli-deploy rollback --service=web --host=web-prod
+cli-deploy status   --service=web --host=web-prod
+
+# on the host (or a /tmp dry run): omit --host
+cli-deploy deploy --service=web --appsRoot=/tmp/web --dryRun
+```
+
+Programmatic API and a full field reference: `@nmakarov/cli-toolkit/deploy`
+(`deployService`, `provisionService`, `rollbackService`, `defineService`, …).
+Example manifest: `examples/deploy/services.js`.
+
 ## Quick Start
 
 ### Args - Parse Command Line Arguments
@@ -276,6 +312,8 @@ throw new CriticalRequestError('API endpoint unreachable');
 | **Screen** | Interactive terminal UIs with React/Ink | `@nmakarov/cli-toolkit/screen` |
 | **Logger** | Structured logging with progress tracking | `@nmakarov/cli-toolkit/logger` |
 | **Errors** | Custom error classes | `@nmakarov/cli-toolkit/errors` |
+| **AWS** | Discover AWS resources (VPC/subnets/Route53/…) | `@nmakarov/cli-toolkit/aws` |
+| **Deploy** | Manifest-driven EC2 release deploys (+ `cli-deploy`) | `@nmakarov/cli-toolkit/deploy` |
 
 ## Examples
 

package/dist/aws.cjs

@@ -0,0 +1,210 @@
+var __defProp = Object.defineProperty;
+var __getOwnPropDesc = Object.getOwnPropertyDescriptor;
+var __getOwnPropNames = Object.getOwnPropertyNames;
+var __hasOwnProp = Object.prototype.hasOwnProperty;
+var __export = (target, all) => {
+  for (var name in all)
+    __defProp(target, name, { get: all[name], enumerable: true });
+};
+var __copyProps = (to, from, except, desc) => {
+  if (from && typeof from === "object" || typeof from === "function") {
+    for (let key of __getOwnPropNames(from))
+      if (!__hasOwnProp.call(to, key) && key !== except)
+        __defProp(to, key, { get: () => from[key], enumerable: !(desc = __getOwnPropDesc(from, key)) || desc.enumerable });
+  }
+  return to;
+};
+var __toCommonJS = (mod) => __copyProps(__defProp({}, "__esModule", { value: true }), mod);
+
+// src/aws/index.js
+var aws_exports = {};
+__export(aws_exports, {
+  Aws: () => Aws
+});
+module.exports = __toCommonJS(aws_exports);
+var import_client_sts = require("@aws-sdk/client-sts");
+var import_client_ec2 = require("@aws-sdk/client-ec2");
+var import_client_route_53 = require("@aws-sdk/client-route-53");
+var DEFAULT_REGION = "us-east-1";
+var CANONICAL_OWNER_ID = "099720109477";
+var DEFAULT_UBUNTU_PATTERN = "ubuntu/images/hvm-ssd-gp3/ubuntu-noble-24.04-amd64-server-*";
+function nameTag(tags) {
+  const t = (tags ?? []).find((x) => x.Key === "Name");
+  return t?.Value ?? null;
+}
+var Aws = class _Aws {
+  /**
+   * Resolve credentials/region from params and return an Aws instance.
+   * Does not call AWS until you invoke a method (clients are lazy).
+   */
+  static async init(context, options = {}) {
+    const getOpt = async (k) => {
+      try {
+        const v = await context?.params?.get?.(k, "string");
+        return v != null && String(v).trim() !== "" ? v : void 0;
+      } catch {
+        return void 0;
+      }
+    };
+    const config = {
+      region: options.region ?? await getOpt("awsRegion") ?? DEFAULT_REGION,
+      accessKeyId: options.accessKeyId ?? await getOpt("awsAccessKeyId"),
+      secretAccessKey: options.secretAccessKey ?? await getOpt("awsSecretAccessKey"),
+      sessionToken: options.sessionToken ?? await getOpt("awsSessionToken")
+    };
+    const aws = new _Aws(context, config);
+    context?.logger?.debug?.(
+      `[aws] region=${config.region} credentials=${config.accessKeyId ? "explicit" : "default-chain"}`
+    );
+    return aws;
+  }
+  constructor(context, config) {
+    this.logger = context?.logger ?? console;
+    this.region = config.region || DEFAULT_REGION;
+    this._credentials = config.accessKeyId && config.secretAccessKey ? {
+      accessKeyId: config.accessKeyId,
+      secretAccessKey: config.secretAccessKey,
+      ...config.sessionToken ? { sessionToken: config.sessionToken } : {}
+    } : void 0;
+    process.env.AWS_SDK_JS_NODE_VERSION_SUPPORT_WARNING_DISABLED ??= "true";
+    this._clients = {};
+  }
+  // ── clients (lazy, optionally region-scoped) ──────────────────────────────
+  _clientConfig(region) {
+    const cfg = { region: region || this.region };
+    if (this._credentials) cfg.credentials = this._credentials;
+    return cfg;
+  }
+  _sts() {
+    return this._clients.sts ??= new import_client_sts.STSClient(this._clientConfig());
+  }
+  _ec2(region) {
+    const key = `ec2:${region || this.region}`;
+    return this._clients[key] ??= new import_client_ec2.EC2Client(this._clientConfig(region));
+  }
+  _route53() {
+    return this._clients.route53 ??= new import_client_route_53.Route53Client(this._clientConfig());
+  }
+  getRegion() {
+    return this.region;
+  }
+  // ── identity ──────────────────────────────────────────────────────────────
+  /** { account, arn, userId } — confirm which account/identity the keys belong to. */
+  async whoAmI() {
+    const out = await this._sts().send(new import_client_sts.GetCallerIdentityCommand({}));
+    return { account: out.Account, arn: out.Arn, userId: out.UserId };
+  }
+  // ── regions / AZs ──────────────────────────────────────────────────────────
+  /** Enabled region names, sorted. */
+  async listRegions({ allRegions = false } = {}) {
+    const out = await this._ec2().send(new import_client_ec2.DescribeRegionsCommand({ AllRegions: allRegions }));
+    return (out.Regions ?? []).map((r) => r.RegionName).sort();
+  }
+  /** Availability zone names for a region (defaults to the instance region). */
+  async listAvailabilityZones(region) {
+    const out = await this._ec2(region).send(new import_client_ec2.DescribeAvailabilityZonesCommand({}));
+    return (out.AvailabilityZones ?? []).filter((z) => z.State === "available").map((z) => z.ZoneName).sort();
+  }
+  // ── VPC / subnets / SGs / key pairs ────────────────────────────────────────
+  /** [{ id, cidr, isDefault, name }] in a region. */
+  async listVpcs(region) {
+    const out = await this._ec2(region).send(new import_client_ec2.DescribeVpcsCommand({}));
+    return (out.Vpcs ?? []).map((v) => ({
+      id: v.VpcId,
+      cidr: v.CidrBlock,
+      isDefault: !!v.IsDefault,
+      name: nameTag(v.Tags)
+    }));
+  }
+  /** [{ id, vpcId, az, cidr, public, name }]; pass vpcId to scope. */
+  async listSubnets({ vpcId, region } = {}) {
+    const Filters = vpcId ? [{ Name: "vpc-id", Values: [vpcId] }] : void 0;
+    const out = await this._ec2(region).send(new import_client_ec2.DescribeSubnetsCommand({ Filters }));
+    return (out.Subnets ?? []).map((s) => ({
+      id: s.SubnetId,
+      vpcId: s.VpcId,
+      az: s.AvailabilityZone,
+      cidr: s.CidrBlock,
+      public: !!s.MapPublicIpOnLaunch,
+      name: nameTag(s.Tags)
+    }));
+  }
+  /** [{ id, name, vpcId, description }]; pass vpcId to scope. */
+  async listSecurityGroups({ vpcId, region } = {}) {
+    const Filters = vpcId ? [{ Name: "vpc-id", Values: [vpcId] }] : void 0;
+    const out = await this._ec2(region).send(new import_client_ec2.DescribeSecurityGroupsCommand({ Filters }));
+    return (out.SecurityGroups ?? []).map((g) => ({
+      id: g.GroupId,
+      name: g.GroupName,
+      vpcId: g.VpcId,
+      description: g.Description
+    }));
+  }
+  /** [{ name, fingerprint }] EC2 key pairs in a region. */
+  async listKeyPairs(region) {
+    const out = await this._ec2(region).send(new import_client_ec2.DescribeKeyPairsCommand({}));
+    return (out.KeyPairs ?? []).map((k) => ({ name: k.KeyName, fingerprint: k.KeyFingerprint }));
+  }
+  // ── Route53 ────────────────────────────────────────────────────────────────
+  /** [{ id, name, private, recordCount }] — id is the bare zone id (no /hostedzone/). */
+  async listHostedZones() {
+    const zones = [];
+    let marker;
+    do {
+      const out = await this._route53().send(new import_client_route_53.ListHostedZonesCommand({ Marker: marker }));
+      for (const z of out.HostedZones ?? []) {
+        zones.push({
+          id: (z.Id ?? "").replace("/hostedzone/", ""),
+          name: (z.Name ?? "").replace(/\.$/, ""),
+          // strip trailing dot
+          private: !!z.Config?.PrivateZone,
+          recordCount: z.ResourceRecordSetCount
+        });
+      }
+      marker = out.IsTruncated ? out.NextMarker : void 0;
+    } while (marker);
+    return zones;
+  }
+  /**
+   * Best hosted zone for a domain: exact match, else the longest zone name that
+   * is a suffix of the domain (so "api.foo.com" matches the "foo.com" zone).
+   * Returns the zone object or null.
+   */
+  async findHostedZoneForDomain(domain) {
+    const target = String(domain ?? "").replace(/\.$/, "").toLowerCase();
+    if (!target) return null;
+    const zones = await this.listHostedZones();
+    const exact = zones.find((z) => z.name.toLowerCase() === target);
+    if (exact) return exact;
+    return zones.filter((z) => target.endsWith(`.${z.name.toLowerCase()}`)).sort((a, b) => b.name.length - a.name.length)[0] ?? null;
+  }
+  // ── AMI lookup ──────────────────────────────────────────────────────────────
+  /**
+   * Latest Ubuntu AMI matching a name pattern in a region.
+   * Returns { id, name, creationDate, architecture } or null.
+   */
+  async findLatestUbuntuAmi({ region, pattern = DEFAULT_UBUNTU_PATTERN, architecture = "x86_64" } = {}) {
+    const out = await this._ec2(region).send(new import_client_ec2.DescribeImagesCommand({
+      Owners: [CANONICAL_OWNER_ID],
+      Filters: [
+        { Name: "name", Values: [pattern] },
+        { Name: "virtualization-type", Values: ["hvm"] },
+        { Name: "state", Values: ["available"] },
+        ...architecture ? [{ Name: "architecture", Values: [architecture] }] : []
+      ]
+    }));
+    const newest = (out.Images ?? []).sort((a, b) => String(b.CreationDate).localeCompare(String(a.CreationDate)))[0];
+    if (!newest) return null;
+    return {
+      id: newest.ImageId,
+      name: newest.Name,
+      creationDate: newest.CreationDate,
+      architecture: newest.Architecture
+    };
+  }
+};
+// Annotate the CommonJS export names for ESM import in node:
+0 && (module.exports = {
+  Aws
+});
+//# sourceMappingURL=aws.cjs.map

package/dist/aws.cjs.map

@@ -0,0 +1 @@
+{"version":3,"sources":["../src/aws/index.js"],"sourcesContent":["/**\n * AWS discovery component\n *\n * A thin, read-only wrapper over a few AWS SDK v3 clients (STS, EC2, Route53)\n * with cli-toolkit conventions:\n *\n *   const aws = await Aws.init(context);\n *   const me  = await aws.whoAmI();\n *   const zones = await aws.listHostedZones();\n *\n * The whole point: given just an access key + secret (usually from .env), it can\n * *discover* the boring-to-look-up bits of an AWS account (account id, regions,\n * VPCs, subnets, security groups, key pairs, Route53 hosted zones, the latest\n * Ubuntu AMI) so scripts can pre-fill config (e.g. a terraform.tfvars) instead of\n * making you hunt through the console.\n *\n * Credentials + region are resolved via context.params, so they come from CLI,\n * env, or .env transparently:\n *   awsAccessKeyId      -> AWS_ACCESS_KEY_ID\n *   awsSecretAccessKey  -> AWS_SECRET_ACCESS_KEY\n *   awsSessionToken     -> AWS_SESSION_TOKEN      (optional, for temp creds)\n *   awsRegion           -> AWS_REGION             (default us-east-1)\n *\n * If no explicit keys are found, the SDK's default credential chain is used\n * (shared config/profile, instance role, etc.) — so AWS_PROFILE also works.\n *\n * Everything here is read-only (Describe / List / Get calls). It never mutates AWS.\n */\n\nimport {\n    STSClient,\n    GetCallerIdentityCommand,\n} from \"@aws-sdk/client-sts\";\nimport {\n    EC2Client,\n    DescribeRegionsCommand,\n    DescribeAvailabilityZonesCommand,\n    DescribeVpcsCommand,\n    DescribeSubnetsCommand,\n    DescribeSecurityGroupsCommand,\n    DescribeKeyPairsCommand,\n    DescribeImagesCommand,\n} from \"@aws-sdk/client-ec2\";\nimport {\n    Route53Client,\n    ListHostedZonesCommand,\n} from \"@aws-sdk/client-route-53\";\n\nconst DEFAULT_REGION = \"us-east-1\";\nconst CANONICAL_OWNER_ID = \"099720109477\"; // Ubuntu images\nconst DEFAULT_UBUNTU_PATTERN = \"ubuntu/images/hvm-ssd-gp3/ubuntu-noble-24.04-amd64-server-*\";\n\nfunction nameTag(tags) {\n    const t = (tags ?? []).find(x => x.Key === \"Name\");\n    return t?.Value ?? null;\n}\n\nexport class Aws {\n    /**\n     * Resolve credentials/region from params and return an Aws instance.\n     * Does not call AWS until you invoke a method (clients are lazy).\n     */\n    static async init(context, options = {}) {\n        // Tolerate blank/missing values (e.g. an env var present but empty, like\n        // a half-filled .env): treat them as \"not set\" rather than failing param\n        // validation, so we fall back cleanly to the SDK default credential chain.\n        const getOpt = async (k) => {\n            try {\n                const v = await context?.params?.get?.(k, \"string\");\n                return v != null && String(v).trim() !== \"\" ? v : undefined;\n            } catch {\n                return undefined;\n            }\n        };\n\n        const config = {\n            region: options.region ?? (await getOpt(\"awsRegion\")) ?? DEFAULT_REGION,\n            accessKeyId: options.accessKeyId ?? (await getOpt(\"awsAccessKeyId\")),\n            secretAccessKey: options.secretAccessKey ?? (await getOpt(\"awsSecretAccessKey\")),\n            sessionToken: options.sessionToken ?? (await getOpt(\"awsSessionToken\")),\n        };\n\n        const aws = new Aws(context, config);\n        context?.logger?.debug?.(\n            `[aws] region=${config.region} credentials=${config.accessKeyId ? \"explicit\" : \"default-chain\"}`,\n        );\n        return aws;\n    }\n\n    constructor(context, config) {\n        this.logger = context?.logger ?? console;\n        this.region = config.region || DEFAULT_REGION;\n\n        // Build an explicit credentials object only when keys were supplied;\n        // otherwise leave undefined so the SDK uses its default chain (profile,\n        // instance role, env, …).\n        this._credentials = config.accessKeyId && config.secretAccessKey\n            ? {\n                accessKeyId: config.accessKeyId,\n                secretAccessKey: config.secretAccessKey,\n                ...(config.sessionToken ? { sessionToken: config.sessionToken } : {}),\n            }\n            : undefined;\n\n        // Quiet the AWS SDK v3 \"node >=22 required after Jan 2027\" notice.\n        process.env.AWS_SDK_JS_NODE_VERSION_SUPPORT_WARNING_DISABLED ??= \"true\";\n\n        this._clients = {};\n    }\n\n    // ── clients (lazy, optionally region-scoped) ──────────────────────────────\n    _clientConfig(region) {\n        const cfg = { region: region || this.region };\n        if (this._credentials) cfg.credentials = this._credentials;\n        return cfg;\n    }\n\n    _sts() {\n        return (this._clients.sts ??= new STSClient(this._clientConfig()));\n    }\n\n    _ec2(region) {\n        const key = `ec2:${region || this.region}`;\n        return (this._clients[key] ??= new EC2Client(this._clientConfig(region)));\n    }\n\n    _route53() {\n        // Route53 is global; region is irrelevant but the client still wants one.\n        return (this._clients.route53 ??= new Route53Client(this._clientConfig()));\n    }\n\n    getRegion() { return this.region; }\n\n    // ── identity ──────────────────────────────────────────────────────────────\n    /** { account, arn, userId } — confirm which account/identity the keys belong to. */\n    async whoAmI() {\n        const out = await this._sts().send(new GetCallerIdentityCommand({}));\n        return { account: out.Account, arn: out.Arn, userId: out.UserId };\n    }\n\n    // ── regions / AZs ──────────────────────────────────────────────────────────\n    /** Enabled region names, sorted. */\n    async listRegions({ allRegions = false } = {}) {\n        const out = await this._ec2().send(new DescribeRegionsCommand({ AllRegions: allRegions }));\n        return (out.Regions ?? []).map(r => r.RegionName).sort();\n    }\n\n    /** Availability zone names for a region (defaults to the instance region). */\n    async listAvailabilityZones(region) {\n        const out = await this._ec2(region).send(new DescribeAvailabilityZonesCommand({}));\n        return (out.AvailabilityZones ?? [])\n            .filter(z => z.State === \"available\")\n            .map(z => z.ZoneName)\n            .sort();\n    }\n\n    // ── VPC / subnets / SGs / key pairs ────────────────────────────────────────\n    /** [{ id, cidr, isDefault, name }] in a region. */\n    async listVpcs(region) {\n        const out = await this._ec2(region).send(new DescribeVpcsCommand({}));\n        return (out.Vpcs ?? []).map(v => ({\n            id: v.VpcId,\n            cidr: v.CidrBlock,\n            isDefault: !!v.IsDefault,\n            name: nameTag(v.Tags),\n        }));\n    }\n\n    /** [{ id, vpcId, az, cidr, public, name }]; pass vpcId to scope. */\n    async listSubnets({ vpcId, region } = {}) {\n        const Filters = vpcId ? [{ Name: \"vpc-id\", Values: [vpcId] }] : undefined;\n        const out = await this._ec2(region).send(new DescribeSubnetsCommand({ Filters }));\n        return (out.Subnets ?? []).map(s => ({\n            id: s.SubnetId,\n            vpcId: s.VpcId,\n            az: s.AvailabilityZone,\n            cidr: s.CidrBlock,\n            public: !!s.MapPublicIpOnLaunch,\n            name: nameTag(s.Tags),\n        }));\n    }\n\n    /** [{ id, name, vpcId, description }]; pass vpcId to scope. */\n    async listSecurityGroups({ vpcId, region } = {}) {\n        const Filters = vpcId ? [{ Name: \"vpc-id\", Values: [vpcId] }] : undefined;\n        const out = await this._ec2(region).send(new DescribeSecurityGroupsCommand({ Filters }));\n        return (out.SecurityGroups ?? []).map(g => ({\n            id: g.GroupId,\n            name: g.GroupName,\n            vpcId: g.VpcId,\n            description: g.Description,\n        }));\n    }\n\n    /** [{ name, fingerprint }] EC2 key pairs in a region. */\n    async listKeyPairs(region) {\n        const out = await this._ec2(region).send(new DescribeKeyPairsCommand({}));\n        return (out.KeyPairs ?? []).map(k => ({ name: k.KeyName, fingerprint: k.KeyFingerprint }));\n    }\n\n    // ── Route53 ────────────────────────────────────────────────────────────────\n    /** [{ id, name, private, recordCount }] — id is the bare zone id (no /hostedzone/). */\n    async listHostedZones() {\n        const zones = [];\n        let marker;\n        do {\n            const out = await this._route53().send(new ListHostedZonesCommand({ Marker: marker }));\n            for (const z of out.HostedZones ?? []) {\n                zones.push({\n                    id: (z.Id ?? \"\").replace(\"/hostedzone/\", \"\"),\n                    name: (z.Name ?? \"\").replace(/\\.$/, \"\"), // strip trailing dot\n                    private: !!z.Config?.PrivateZone,\n                    recordCount: z.ResourceRecordSetCount,\n                });\n            }\n            marker = out.IsTruncated ? out.NextMarker : undefined;\n        } while (marker);\n        return zones;\n    }\n\n    /**\n     * Best hosted zone for a domain: exact match, else the longest zone name that\n     * is a suffix of the domain (so \"api.foo.com\" matches the \"foo.com\" zone).\n     * Returns the zone object or null.\n     */\n    async findHostedZoneForDomain(domain) {\n        const target = String(domain ?? \"\").replace(/\\.$/, \"\").toLowerCase();\n        if (!target) return null;\n        const zones = await this.listHostedZones();\n        const exact = zones.find(z => z.name.toLowerCase() === target);\n        if (exact) return exact;\n        return zones\n            .filter(z => target.endsWith(`.${z.name.toLowerCase()}`))\n            .sort((a, b) => b.name.length - a.name.length)[0] ?? null;\n    }\n\n    // ── AMI lookup ──────────────────────────────────────────────────────────────\n    /**\n     * Latest Ubuntu AMI matching a name pattern in a region.\n     * Returns { id, name, creationDate, architecture } or null.\n     */\n    async findLatestUbuntuAmi({ region, pattern = DEFAULT_UBUNTU_PATTERN, architecture = \"x86_64\" } = {}) {\n        const out = await this._ec2(region).send(new DescribeImagesCommand({\n            Owners: [CANONICAL_OWNER_ID],\n            Filters: [\n                { Name: \"name\", Values: [pattern] },\n                { Name: \"virtualization-type\", Values: [\"hvm\"] },\n                { Name: \"state\", Values: [\"available\"] },\n                ...(architecture ? [{ Name: \"architecture\", Values: [architecture] }] : []),\n            ],\n        }));\n        const newest = (out.Images ?? [])\n            .sort((a, b) => String(b.CreationDate).localeCompare(String(a.CreationDate)))[0];\n        if (!newest) return null;\n        return {\n            id: newest.ImageId,\n            name: newest.Name,\n            creationDate: newest.CreationDate,\n            architecture: newest.Architecture,\n        };\n    }\n}\n"],"mappings":";;;;;;;;;;;;;;;;;;;AAAA;AAAA;AAAA;AAAA;AAAA;AA6BA,wBAGO;AACP,wBASO;AACP,6BAGO;AAEP,IAAM,iBAAiB;AACvB,IAAM,qBAAqB;AAC3B,IAAM,yBAAyB;AAE/B,SAAS,QAAQ,MAAM;AACnB,QAAM,KAAK,QAAQ,CAAC,GAAG,KAAK,OAAK,EAAE,QAAQ,MAAM;AACjD,SAAO,GAAG,SAAS;AACvB;AAEO,IAAM,MAAN,MAAM,KAAI;AAAA;AAAA;AAAA;AAAA;AAAA,EAKb,aAAa,KAAK,SAAS,UAAU,CAAC,GAAG;AAIrC,UAAM,SAAS,OAAO,MAAM;AACxB,UAAI;AACA,cAAM,IAAI,MAAM,SAAS,QAAQ,MAAM,GAAG,QAAQ;AAClD,eAAO,KAAK,QAAQ,OAAO,CAAC,EAAE,KAAK,MAAM,KAAK,IAAI;AAAA,MACtD,QAAQ;AACJ,eAAO;AAAA,MACX;AAAA,IACJ;AAEA,UAAM,SAAS;AAAA,MACX,QAAQ,QAAQ,UAAW,MAAM,OAAO,WAAW,KAAM;AAAA,MACzD,aAAa,QAAQ,eAAgB,MAAM,OAAO,gBAAgB;AAAA,MAClE,iBAAiB,QAAQ,mBAAoB,MAAM,OAAO,oBAAoB;AAAA,MAC9E,cAAc,QAAQ,gBAAiB,MAAM,OAAO,iBAAiB;AAAA,IACzE;AAEA,UAAM,MAAM,IAAI,KAAI,SAAS,MAAM;AACnC,aAAS,QAAQ;AAAA,MACb,gBAAgB,OAAO,MAAM,gBAAgB,OAAO,cAAc,aAAa,eAAe;AAAA,IAClG;AACA,WAAO;AAAA,EACX;AAAA,EAEA,YAAY,SAAS,QAAQ;AACzB,SAAK,SAAS,SAAS,UAAU;AACjC,SAAK,SAAS,OAAO,UAAU;AAK/B,SAAK,eAAe,OAAO,eAAe,OAAO,kBAC3C;AAAA,MACE,aAAa,OAAO;AAAA,MACpB,iBAAiB,OAAO;AAAA,MACxB,GAAI,OAAO,eAAe,EAAE,cAAc,OAAO,aAAa,IAAI,CAAC;AAAA,IACvE,IACE;AAGN,YAAQ,IAAI,qDAAqD;AAEjE,SAAK,WAAW,CAAC;AAAA,EACrB;AAAA;AAAA,EAGA,cAAc,QAAQ;AAClB,UAAM,MAAM,EAAE,QAAQ,UAAU,KAAK,OAAO;AAC5C,QAAI,KAAK,aAAc,KAAI,cAAc,KAAK;AAC9C,WAAO;AAAA,EACX;AAAA,EAEA,OAAO;AACH,WAAQ,KAAK,SAAS,QAAQ,IAAI,4BAAU,KAAK,cAAc,CAAC;AAAA,EACpE;AAAA,EAEA,KAAK,QAAQ;AACT,UAAM,MAAM,OAAO,UAAU,KAAK,MAAM;AACxC,WAAQ,KAAK,SAAS,GAAG,MAAM,IAAI,4BAAU,KAAK,cAAc,MAAM,CAAC;AAAA,EAC3E;AAAA,EAEA,WAAW;AAEP,WAAQ,KAAK,SAAS,YAAY,IAAI,qCAAc,KAAK,cAAc,CAAC;AAAA,EAC5E;AAAA,EAEA,YAAY;AAAE,WAAO,KAAK;AAAA,EAAQ;AAAA;AAAA;AAAA,EAIlC,MAAM,SAAS;AACX,UAAM,MAAM,MAAM,KAAK,KAAK,EAAE,KAAK,IAAI,2CAAyB,CAAC,CAAC,CAAC;AACnE,WAAO,EAAE,SAAS,IAAI,SAAS,KAAK,IAAI,KAAK,QAAQ,IAAI,OAAO;AAAA,EACpE;AAAA;AAAA;AAAA,EAIA,MAAM,YAAY,EAAE,aAAa,MAAM,IAAI,CAAC,GAAG;AAC3C,UAAM,MAAM,MAAM,KAAK,KAAK,EAAE,KAAK,IAAI,yCAAuB,EAAE,YAAY,WAAW,CAAC,CAAC;AACzF,YAAQ,IAAI,WAAW,CAAC,GAAG,IAAI,OAAK,EAAE,UAAU,EAAE,KAAK;AAAA,EAC3D;AAAA;AAAA,EAGA,MAAM,sBAAsB,QAAQ;AAChC,UAAM,MAAM,MAAM,KAAK,KAAK,MAAM,EAAE,KAAK,IAAI,mDAAiC,CAAC,CAAC,CAAC;AACjF,YAAQ,IAAI,qBAAqB,CAAC,GAC7B,OAAO,OAAK,EAAE,UAAU,WAAW,EACnC,IAAI,OAAK,EAAE,QAAQ,EACnB,KAAK;AAAA,EACd;AAAA;AAAA;AAAA,EAIA,MAAM,SAAS,QAAQ;AACnB,UAAM,MAAM,MAAM,KAAK,KAAK,MAAM,EAAE,KAAK,IAAI,sCAAoB,CAAC,CAAC,CAAC;AACpE,YAAQ,IAAI,QAAQ,CAAC,GAAG,IAAI,QAAM;AAAA,MAC9B,IAAI,EAAE;AAAA,MACN,MAAM,EAAE;AAAA,MACR,WAAW,CAAC,CAAC,EAAE;AAAA,MACf,MAAM,QAAQ,EAAE,IAAI;AAAA,IACxB,EAAE;AAAA,EACN;AAAA;AAAA,EAGA,MAAM,YAAY,EAAE,OAAO,OAAO,IAAI,CAAC,GAAG;AACtC,UAAM,UAAU,QAAQ,CAAC,EAAE,MAAM,UAAU,QAAQ,CAAC,KAAK,EAAE,CAAC,IAAI;AAChE,UAAM,MAAM,MAAM,KAAK,KAAK,MAAM,EAAE,KAAK,IAAI,yCAAuB,EAAE,QAAQ,CAAC,CAAC;AAChF,YAAQ,IAAI,WAAW,CAAC,GAAG,IAAI,QAAM;AAAA,MACjC,IAAI,EAAE;AAAA,MACN,OAAO,EAAE;AAAA,MACT,IAAI,EAAE;AAAA,MACN,MAAM,EAAE;AAAA,MACR,QAAQ,CAAC,CAAC,EAAE;AAAA,MACZ,MAAM,QAAQ,EAAE,IAAI;AAAA,IACxB,EAAE;AAAA,EACN;AAAA;AAAA,EAGA,MAAM,mBAAmB,EAAE,OAAO,OAAO,IAAI,CAAC,GAAG;AAC7C,UAAM,UAAU,QAAQ,CAAC,EAAE,MAAM,UAAU,QAAQ,CAAC,KAAK,EAAE,CAAC,IAAI;AAChE,UAAM,MAAM,MAAM,KAAK,KAAK,MAAM,EAAE,KAAK,IAAI,gDAA8B,EAAE,QAAQ,CAAC,CAAC;AACvF,YAAQ,IAAI,kBAAkB,CAAC,GAAG,IAAI,QAAM;AAAA,MACxC,IAAI,EAAE;AAAA,MACN,MAAM,EAAE;AAAA,MACR,OAAO,EAAE;AAAA,MACT,aAAa,EAAE;AAAA,IACnB,EAAE;AAAA,EACN;AAAA;AAAA,EAGA,MAAM,aAAa,QAAQ;AACvB,UAAM,MAAM,MAAM,KAAK,KAAK,MAAM,EAAE,KAAK,IAAI,0CAAwB,CAAC,CAAC,CAAC;AACxE,YAAQ,IAAI,YAAY,CAAC,GAAG,IAAI,QAAM,EAAE,MAAM,EAAE,SAAS,aAAa,EAAE,eAAe,EAAE;AAAA,EAC7F;AAAA;AAAA;AAAA,EAIA,MAAM,kBAAkB;AACpB,UAAM,QAAQ,CAAC;AACf,QAAI;AACJ,OAAG;AACC,YAAM,MAAM,MAAM,KAAK,SAAS,EAAE,KAAK,IAAI,8CAAuB,EAAE,QAAQ,OAAO,CAAC,CAAC;AACrF,iBAAW,KAAK,IAAI,eAAe,CAAC,GAAG;AACnC,cAAM,KAAK;AAAA,UACP,KAAK,EAAE,MAAM,IAAI,QAAQ,gBAAgB,EAAE;AAAA,UAC3C,OAAO,EAAE,QAAQ,IAAI,QAAQ,OAAO,EAAE;AAAA;AAAA,UACtC,SAAS,CAAC,CAAC,EAAE,QAAQ;AAAA,UACrB,aAAa,EAAE;AAAA,QACnB,CAAC;AAAA,MACL;AACA,eAAS,IAAI,cAAc,IAAI,aAAa;AAAA,IAChD,SAAS;AACT,WAAO;AAAA,EACX;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAOA,MAAM,wBAAwB,QAAQ;AAClC,UAAM,SAAS,OAAO,UAAU,EAAE,EAAE,QAAQ,OAAO,EAAE,EAAE,YAAY;AACnE,QAAI,CAAC,OAAQ,QAAO;AACpB,UAAM,QAAQ,MAAM,KAAK,gBAAgB;AACzC,UAAM,QAAQ,MAAM,KAAK,OAAK,EAAE,KAAK,YAAY,MAAM,MAAM;AAC7D,QAAI,MAAO,QAAO;AAClB,WAAO,MACF,OAAO,OAAK,OAAO,SAAS,IAAI,EAAE,KAAK,YAAY,CAAC,EAAE,CAAC,EACvD,KAAK,CAAC,GAAG,MAAM,EAAE,KAAK,SAAS,EAAE,KAAK,MAAM,EAAE,CAAC,KAAK;AAAA,EAC7D;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAOA,MAAM,oBAAoB,EAAE,QAAQ,UAAU,wBAAwB,eAAe,SAAS,IAAI,CAAC,GAAG;AAClG,UAAM,MAAM,MAAM,KAAK,KAAK,MAAM,EAAE,KAAK,IAAI,wCAAsB;AAAA,MAC/D,QAAQ,CAAC,kBAAkB;AAAA,MAC3B,SAAS;AAAA,QACL,EAAE,MAAM,QAAQ,QAAQ,CAAC,OAAO,EAAE;AAAA,QAClC,EAAE,MAAM,uBAAuB,QAAQ,CAAC,KAAK,EAAE;AAAA,QAC/C,EAAE,MAAM,SAAS,QAAQ,CAAC,WAAW,EAAE;AAAA,QACvC,GAAI,eAAe,CAAC,EAAE,MAAM,gBAAgB,QAAQ,CAAC,YAAY,EAAE,CAAC,IAAI,CAAC;AAAA,MAC7E;AAAA,IACJ,CAAC,CAAC;AACF,UAAM,UAAU,IAAI,UAAU,CAAC,GAC1B,KAAK,CAAC,GAAG,MAAM,OAAO,EAAE,YAAY,EAAE,cAAc,OAAO,EAAE,YAAY,CAAC,CAAC,EAAE,CAAC;AACnF,QAAI,CAAC,OAAQ,QAAO;AACpB,WAAO;AAAA,MACH,IAAI,OAAO;AAAA,MACX,MAAM,OAAO;AAAA,MACb,cAAc,OAAO;AAAA,MACrB,cAAc,OAAO;AAAA,IACzB;AAAA,EACJ;AACJ;","names":[]}

package/dist/aws.js

@@ -0,0 +1,201 @@
+// src/aws/index.js
+import {
+  STSClient,
+  GetCallerIdentityCommand
+} from "@aws-sdk/client-sts";
+import {
+  EC2Client,
+  DescribeRegionsCommand,
+  DescribeAvailabilityZonesCommand,
+  DescribeVpcsCommand,
+  DescribeSubnetsCommand,
+  DescribeSecurityGroupsCommand,
+  DescribeKeyPairsCommand,
+  DescribeImagesCommand
+} from "@aws-sdk/client-ec2";
+import {
+  Route53Client,
+  ListHostedZonesCommand
+} from "@aws-sdk/client-route-53";
+var DEFAULT_REGION = "us-east-1";
+var CANONICAL_OWNER_ID = "099720109477";
+var DEFAULT_UBUNTU_PATTERN = "ubuntu/images/hvm-ssd-gp3/ubuntu-noble-24.04-amd64-server-*";
+function nameTag(tags) {
+  const t = (tags ?? []).find((x) => x.Key === "Name");
+  return t?.Value ?? null;
+}
+var Aws = class _Aws {
+  /**
+   * Resolve credentials/region from params and return an Aws instance.
+   * Does not call AWS until you invoke a method (clients are lazy).
+   */
+  static async init(context, options = {}) {
+    const getOpt = async (k) => {
+      try {
+        const v = await context?.params?.get?.(k, "string");
+        return v != null && String(v).trim() !== "" ? v : void 0;
+      } catch {
+        return void 0;
+      }
+    };
+    const config = {
+      region: options.region ?? await getOpt("awsRegion") ?? DEFAULT_REGION,
+      accessKeyId: options.accessKeyId ?? await getOpt("awsAccessKeyId"),
+      secretAccessKey: options.secretAccessKey ?? await getOpt("awsSecretAccessKey"),
+      sessionToken: options.sessionToken ?? await getOpt("awsSessionToken")
+    };
+    const aws = new _Aws(context, config);
+    context?.logger?.debug?.(
+      `[aws] region=${config.region} credentials=${config.accessKeyId ? "explicit" : "default-chain"}`
+    );
+    return aws;
+  }
+  constructor(context, config) {
+    this.logger = context?.logger ?? console;
+    this.region = config.region || DEFAULT_REGION;
+    this._credentials = config.accessKeyId && config.secretAccessKey ? {
+      accessKeyId: config.accessKeyId,
+      secretAccessKey: config.secretAccessKey,
+      ...config.sessionToken ? { sessionToken: config.sessionToken } : {}
+    } : void 0;
+    process.env.AWS_SDK_JS_NODE_VERSION_SUPPORT_WARNING_DISABLED ??= "true";
+    this._clients = {};
+  }
+  // ── clients (lazy, optionally region-scoped) ──────────────────────────────
+  _clientConfig(region) {
+    const cfg = { region: region || this.region };
+    if (this._credentials) cfg.credentials = this._credentials;
+    return cfg;
+  }
+  _sts() {
+    return this._clients.sts ??= new STSClient(this._clientConfig());
+  }
+  _ec2(region) {
+    const key = `ec2:${region || this.region}`;
+    return this._clients[key] ??= new EC2Client(this._clientConfig(region));
+  }
+  _route53() {
+    return this._clients.route53 ??= new Route53Client(this._clientConfig());
+  }
+  getRegion() {
+    return this.region;
+  }
+  // ── identity ──────────────────────────────────────────────────────────────
+  /** { account, arn, userId } — confirm which account/identity the keys belong to. */
+  async whoAmI() {
+    const out = await this._sts().send(new GetCallerIdentityCommand({}));
+    return { account: out.Account, arn: out.Arn, userId: out.UserId };
+  }
+  // ── regions / AZs ──────────────────────────────────────────────────────────
+  /** Enabled region names, sorted. */
+  async listRegions({ allRegions = false } = {}) {
+    const out = await this._ec2().send(new DescribeRegionsCommand({ AllRegions: allRegions }));
+    return (out.Regions ?? []).map((r) => r.RegionName).sort();
+  }
+  /** Availability zone names for a region (defaults to the instance region). */
+  async listAvailabilityZones(region) {
+    const out = await this._ec2(region).send(new DescribeAvailabilityZonesCommand({}));
+    return (out.AvailabilityZones ?? []).filter((z) => z.State === "available").map((z) => z.ZoneName).sort();
+  }
+  // ── VPC / subnets / SGs / key pairs ────────────────────────────────────────
+  /** [{ id, cidr, isDefault, name }] in a region. */
+  async listVpcs(region) {
+    const out = await this._ec2(region).send(new DescribeVpcsCommand({}));
+    return (out.Vpcs ?? []).map((v) => ({
+      id: v.VpcId,
+      cidr: v.CidrBlock,
+      isDefault: !!v.IsDefault,
+      name: nameTag(v.Tags)
+    }));
+  }
+  /** [{ id, vpcId, az, cidr, public, name }]; pass vpcId to scope. */
+  async listSubnets({ vpcId, region } = {}) {
+    const Filters = vpcId ? [{ Name: "vpc-id", Values: [vpcId] }] : void 0;
+    const out = await this._ec2(region).send(new DescribeSubnetsCommand({ Filters }));
+    return (out.Subnets ?? []).map((s) => ({
+      id: s.SubnetId,
+      vpcId: s.VpcId,
+      az: s.AvailabilityZone,
+      cidr: s.CidrBlock,
+      public: !!s.MapPublicIpOnLaunch,
+      name: nameTag(s.Tags)
+    }));
+  }
+  /** [{ id, name, vpcId, description }]; pass vpcId to scope. */
+  async listSecurityGroups({ vpcId, region } = {}) {
+    const Filters = vpcId ? [{ Name: "vpc-id", Values: [vpcId] }] : void 0;
+    const out = await this._ec2(region).send(new DescribeSecurityGroupsCommand({ Filters }));
+    return (out.SecurityGroups ?? []).map((g) => ({
+      id: g.GroupId,
+      name: g.GroupName,
+      vpcId: g.VpcId,
+      description: g.Description
+    }));
+  }
+  /** [{ name, fingerprint }] EC2 key pairs in a region. */
+  async listKeyPairs(region) {
+    const out = await this._ec2(region).send(new DescribeKeyPairsCommand({}));
+    return (out.KeyPairs ?? []).map((k) => ({ name: k.KeyName, fingerprint: k.KeyFingerprint }));
+  }
+  // ── Route53 ────────────────────────────────────────────────────────────────
+  /** [{ id, name, private, recordCount }] — id is the bare zone id (no /hostedzone/). */
+  async listHostedZones() {
+    const zones = [];
+    let marker;
+    do {
+      const out = await this._route53().send(new ListHostedZonesCommand({ Marker: marker }));
+      for (const z of out.HostedZones ?? []) {
+        zones.push({
+          id: (z.Id ?? "").replace("/hostedzone/", ""),
+          name: (z.Name ?? "").replace(/\.$/, ""),
+          // strip trailing dot
+          private: !!z.Config?.PrivateZone,
+          recordCount: z.ResourceRecordSetCount
+        });
+      }
+      marker = out.IsTruncated ? out.NextMarker : void 0;
+    } while (marker);
+    return zones;
+  }
+  /**
+   * Best hosted zone for a domain: exact match, else the longest zone name that
+   * is a suffix of the domain (so "api.foo.com" matches the "foo.com" zone).
+   * Returns the zone object or null.
+   */
+  async findHostedZoneForDomain(domain) {
+    const target = String(domain ?? "").replace(/\.$/, "").toLowerCase();
+    if (!target) return null;
+    const zones = await this.listHostedZones();
+    const exact = zones.find((z) => z.name.toLowerCase() === target);
+    if (exact) return exact;
+    return zones.filter((z) => target.endsWith(`.${z.name.toLowerCase()}`)).sort((a, b) => b.name.length - a.name.length)[0] ?? null;
+  }
+  // ── AMI lookup ──────────────────────────────────────────────────────────────
+  /**
+   * Latest Ubuntu AMI matching a name pattern in a region.
+   * Returns { id, name, creationDate, architecture } or null.
+   */
+  async findLatestUbuntuAmi({ region, pattern = DEFAULT_UBUNTU_PATTERN, architecture = "x86_64" } = {}) {
+    const out = await this._ec2(region).send(new DescribeImagesCommand({
+      Owners: [CANONICAL_OWNER_ID],
+      Filters: [
+        { Name: "name", Values: [pattern] },
+        { Name: "virtualization-type", Values: ["hvm"] },
+        { Name: "state", Values: ["available"] },
+        ...architecture ? [{ Name: "architecture", Values: [architecture] }] : []
+      ]
+    }));
+    const newest = (out.Images ?? []).sort((a, b) => String(b.CreationDate).localeCompare(String(a.CreationDate)))[0];
+    if (!newest) return null;
+    return {
+      id: newest.ImageId,
+      name: newest.Name,
+      creationDate: newest.CreationDate,
+      architecture: newest.Architecture
+    };
+  }
+};
+export {
+  Aws
+};
+//# sourceMappingURL=aws.js.map

package/dist/aws.js.map

@@ -0,0 +1 @@
+{"version":3,"sources":["../src/aws/index.js"],"sourcesContent":["/**\n * AWS discovery component\n *\n * A thin, read-only wrapper over a few AWS SDK v3 clients (STS, EC2, Route53)\n * with cli-toolkit conventions:\n *\n *   const aws = await Aws.init(context);\n *   const me  = await aws.whoAmI();\n *   const zones = await aws.listHostedZones();\n *\n * The whole point: given just an access key + secret (usually from .env), it can\n * *discover* the boring-to-look-up bits of an AWS account (account id, regions,\n * VPCs, subnets, security groups, key pairs, Route53 hosted zones, the latest\n * Ubuntu AMI) so scripts can pre-fill config (e.g. a terraform.tfvars) instead of\n * making you hunt through the console.\n *\n * Credentials + region are resolved via context.params, so they come from CLI,\n * env, or .env transparently:\n *   awsAccessKeyId      -> AWS_ACCESS_KEY_ID\n *   awsSecretAccessKey  -> AWS_SECRET_ACCESS_KEY\n *   awsSessionToken     -> AWS_SESSION_TOKEN      (optional, for temp creds)\n *   awsRegion           -> AWS_REGION             (default us-east-1)\n *\n * If no explicit keys are found, the SDK's default credential chain is used\n * (shared config/profile, instance role, etc.) — so AWS_PROFILE also works.\n *\n * Everything here is read-only (Describe / List / Get calls). It never mutates AWS.\n */\n\nimport {\n    STSClient,\n    GetCallerIdentityCommand,\n} from \"@aws-sdk/client-sts\";\nimport {\n    EC2Client,\n    DescribeRegionsCommand,\n    DescribeAvailabilityZonesCommand,\n    DescribeVpcsCommand,\n    DescribeSubnetsCommand,\n    DescribeSecurityGroupsCommand,\n    DescribeKeyPairsCommand,\n    DescribeImagesCommand,\n} from \"@aws-sdk/client-ec2\";\nimport {\n    Route53Client,\n    ListHostedZonesCommand,\n} from \"@aws-sdk/client-route-53\";\n\nconst DEFAULT_REGION = \"us-east-1\";\nconst CANONICAL_OWNER_ID = \"099720109477\"; // Ubuntu images\nconst DEFAULT_UBUNTU_PATTERN = \"ubuntu/images/hvm-ssd-gp3/ubuntu-noble-24.04-amd64-server-*\";\n\nfunction nameTag(tags) {\n    const t = (tags ?? []).find(x => x.Key === \"Name\");\n    return t?.Value ?? null;\n}\n\nexport class Aws {\n    /**\n     * Resolve credentials/region from params and return an Aws instance.\n     * Does not call AWS until you invoke a method (clients are lazy).\n     */\n    static async init(context, options = {}) {\n        // Tolerate blank/missing values (e.g. an env var present but empty, like\n        // a half-filled .env): treat them as \"not set\" rather than failing param\n        // validation, so we fall back cleanly to the SDK default credential chain.\n        const getOpt = async (k) => {\n            try {\n                const v = await context?.params?.get?.(k, \"string\");\n                return v != null && String(v).trim() !== \"\" ? v : undefined;\n            } catch {\n                return undefined;\n            }\n        };\n\n        const config = {\n            region: options.region ?? (await getOpt(\"awsRegion\")) ?? DEFAULT_REGION,\n            accessKeyId: options.accessKeyId ?? (await getOpt(\"awsAccessKeyId\")),\n            secretAccessKey: options.secretAccessKey ?? (await getOpt(\"awsSecretAccessKey\")),\n            sessionToken: options.sessionToken ?? (await getOpt(\"awsSessionToken\")),\n        };\n\n        const aws = new Aws(context, config);\n        context?.logger?.debug?.(\n            `[aws] region=${config.region} credentials=${config.accessKeyId ? \"explicit\" : \"default-chain\"}`,\n        );\n        return aws;\n    }\n\n    constructor(context, config) {\n        this.logger = context?.logger ?? console;\n        this.region = config.region || DEFAULT_REGION;\n\n        // Build an explicit credentials object only when keys were supplied;\n        // otherwise leave undefined so the SDK uses its default chain (profile,\n        // instance role, env, …).\n        this._credentials = config.accessKeyId && config.secretAccessKey\n            ? {\n                accessKeyId: config.accessKeyId,\n                secretAccessKey: config.secretAccessKey,\n                ...(config.sessionToken ? { sessionToken: config.sessionToken } : {}),\n            }\n            : undefined;\n\n        // Quiet the AWS SDK v3 \"node >=22 required after Jan 2027\" notice.\n        process.env.AWS_SDK_JS_NODE_VERSION_SUPPORT_WARNING_DISABLED ??= \"true\";\n\n        this._clients = {};\n    }\n\n    // ── clients (lazy, optionally region-scoped) ──────────────────────────────\n    _clientConfig(region) {\n        const cfg = { region: region || this.region };\n        if (this._credentials) cfg.credentials = this._credentials;\n        return cfg;\n    }\n\n    _sts() {\n        return (this._clients.sts ??= new STSClient(this._clientConfig()));\n    }\n\n    _ec2(region) {\n        const key = `ec2:${region || this.region}`;\n        return (this._clients[key] ??= new EC2Client(this._clientConfig(region)));\n    }\n\n    _route53() {\n        // Route53 is global; region is irrelevant but the client still wants one.\n        return (this._clients.route53 ??= new Route53Client(this._clientConfig()));\n    }\n\n    getRegion() { return this.region; }\n\n    // ── identity ──────────────────────────────────────────────────────────────\n    /** { account, arn, userId } — confirm which account/identity the keys belong to. */\n    async whoAmI() {\n        const out = await this._sts().send(new GetCallerIdentityCommand({}));\n        return { account: out.Account, arn: out.Arn, userId: out.UserId };\n    }\n\n    // ── regions / AZs ──────────────────────────────────────────────────────────\n    /** Enabled region names, sorted. */\n    async listRegions({ allRegions = false } = {}) {\n        const out = await this._ec2().send(new DescribeRegionsCommand({ AllRegions: allRegions }));\n        return (out.Regions ?? []).map(r => r.RegionName).sort();\n    }\n\n    /** Availability zone names for a region (defaults to the instance region). */\n    async listAvailabilityZones(region) {\n        const out = await this._ec2(region).send(new DescribeAvailabilityZonesCommand({}));\n        return (out.AvailabilityZones ?? [])\n            .filter(z => z.State === \"available\")\n            .map(z => z.ZoneName)\n            .sort();\n    }\n\n    // ── VPC / subnets / SGs / key pairs ────────────────────────────────────────\n    /** [{ id, cidr, isDefault, name }] in a region. */\n    async listVpcs(region) {\n        const out = await this._ec2(region).send(new DescribeVpcsCommand({}));\n        return (out.Vpcs ?? []).map(v => ({\n            id: v.VpcId,\n            cidr: v.CidrBlock,\n            isDefault: !!v.IsDefault,\n            name: nameTag(v.Tags),\n        }));\n    }\n\n    /** [{ id, vpcId, az, cidr, public, name }]; pass vpcId to scope. */\n    async listSubnets({ vpcId, region } = {}) {\n        const Filters = vpcId ? [{ Name: \"vpc-id\", Values: [vpcId] }] : undefined;\n        const out = await this._ec2(region).send(new DescribeSubnetsCommand({ Filters }));\n        return (out.Subnets ?? []).map(s => ({\n            id: s.SubnetId,\n            vpcId: s.VpcId,\n            az: s.AvailabilityZone,\n            cidr: s.CidrBlock,\n            public: !!s.MapPublicIpOnLaunch,\n            name: nameTag(s.Tags),\n        }));\n    }\n\n    /** [{ id, name, vpcId, description }]; pass vpcId to scope. */\n    async listSecurityGroups({ vpcId, region } = {}) {\n        const Filters = vpcId ? [{ Name: \"vpc-id\", Values: [vpcId] }] : undefined;\n        const out = await this._ec2(region).send(new DescribeSecurityGroupsCommand({ Filters }));\n        return (out.SecurityGroups ?? []).map(g => ({\n            id: g.GroupId,\n            name: g.GroupName,\n            vpcId: g.VpcId,\n            description: g.Description,\n        }));\n    }\n\n    /** [{ name, fingerprint }] EC2 key pairs in a region. */\n    async listKeyPairs(region) {\n        const out = await this._ec2(region).send(new DescribeKeyPairsCommand({}));\n        return (out.KeyPairs ?? []).map(k => ({ name: k.KeyName, fingerprint: k.KeyFingerprint }));\n    }\n\n    // ── Route53 ────────────────────────────────────────────────────────────────\n    /** [{ id, name, private, recordCount }] — id is the bare zone id (no /hostedzone/). */\n    async listHostedZones() {\n        const zones = [];\n        let marker;\n        do {\n            const out = await this._route53().send(new ListHostedZonesCommand({ Marker: marker }));\n            for (const z of out.HostedZones ?? []) {\n                zones.push({\n                    id: (z.Id ?? \"\").replace(\"/hostedzone/\", \"\"),\n                    name: (z.Name ?? \"\").replace(/\\.$/, \"\"), // strip trailing dot\n                    private: !!z.Config?.PrivateZone,\n                    recordCount: z.ResourceRecordSetCount,\n                });\n            }\n            marker = out.IsTruncated ? out.NextMarker : undefined;\n        } while (marker);\n        return zones;\n    }\n\n    /**\n     * Best hosted zone for a domain: exact match, else the longest zone name that\n     * is a suffix of the domain (so \"api.foo.com\" matches the \"foo.com\" zone).\n     * Returns the zone object or null.\n     */\n    async findHostedZoneForDomain(domain) {\n        const target = String(domain ?? \"\").replace(/\\.$/, \"\").toLowerCase();\n        if (!target) return null;\n        const zones = await this.listHostedZones();\n        const exact = zones.find(z => z.name.toLowerCase() === target);\n        if (exact) return exact;\n        return zones\n            .filter(z => target.endsWith(`.${z.name.toLowerCase()}`))\n            .sort((a, b) => b.name.length - a.name.length)[0] ?? null;\n    }\n\n    // ── AMI lookup ──────────────────────────────────────────────────────────────\n    /**\n     * Latest Ubuntu AMI matching a name pattern in a region.\n     * Returns { id, name, creationDate, architecture } or null.\n     */\n    async findLatestUbuntuAmi({ region, pattern = DEFAULT_UBUNTU_PATTERN, architecture = \"x86_64\" } = {}) {\n        const out = await this._ec2(region).send(new DescribeImagesCommand({\n            Owners: [CANONICAL_OWNER_ID],\n            Filters: [\n                { Name: \"name\", Values: [pattern] },\n                { Name: \"virtualization-type\", Values: [\"hvm\"] },\n                { Name: \"state\", Values: [\"available\"] },\n                ...(architecture ? [{ Name: \"architecture\", Values: [architecture] }] : []),\n            ],\n        }));\n        const newest = (out.Images ?? [])\n            .sort((a, b) => String(b.CreationDate).localeCompare(String(a.CreationDate)))[0];\n        if (!newest) return null;\n        return {\n            id: newest.ImageId,\n            name: newest.Name,\n            creationDate: newest.CreationDate,\n            architecture: newest.Architecture,\n        };\n    }\n}\n"],"mappings":";AA6BA;AAAA,EACI;AAAA,EACA;AAAA,OACG;AACP;AAAA,EACI;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,OACG;AACP;AAAA,EACI;AAAA,EACA;AAAA,OACG;AAEP,IAAM,iBAAiB;AACvB,IAAM,qBAAqB;AAC3B,IAAM,yBAAyB;AAE/B,SAAS,QAAQ,MAAM;AACnB,QAAM,KAAK,QAAQ,CAAC,GAAG,KAAK,OAAK,EAAE,QAAQ,MAAM;AACjD,SAAO,GAAG,SAAS;AACvB;AAEO,IAAM,MAAN,MAAM,KAAI;AAAA;AAAA;AAAA;AAAA;AAAA,EAKb,aAAa,KAAK,SAAS,UAAU,CAAC,GAAG;AAIrC,UAAM,SAAS,OAAO,MAAM;AACxB,UAAI;AACA,cAAM,IAAI,MAAM,SAAS,QAAQ,MAAM,GAAG,QAAQ;AAClD,eAAO,KAAK,QAAQ,OAAO,CAAC,EAAE,KAAK,MAAM,KAAK,IAAI;AAAA,MACtD,QAAQ;AACJ,eAAO;AAAA,MACX;AAAA,IACJ;AAEA,UAAM,SAAS;AAAA,MACX,QAAQ,QAAQ,UAAW,MAAM,OAAO,WAAW,KAAM;AAAA,MACzD,aAAa,QAAQ,eAAgB,MAAM,OAAO,gBAAgB;AAAA,MAClE,iBAAiB,QAAQ,mBAAoB,MAAM,OAAO,oBAAoB;AAAA,MAC9E,cAAc,QAAQ,gBAAiB,MAAM,OAAO,iBAAiB;AAAA,IACzE;AAEA,UAAM,MAAM,IAAI,KAAI,SAAS,MAAM;AACnC,aAAS,QAAQ;AAAA,MACb,gBAAgB,OAAO,MAAM,gBAAgB,OAAO,cAAc,aAAa,eAAe;AAAA,IAClG;AACA,WAAO;AAAA,EACX;AAAA,EAEA,YAAY,SAAS,QAAQ;AACzB,SAAK,SAAS,SAAS,UAAU;AACjC,SAAK,SAAS,OAAO,UAAU;AAK/B,SAAK,eAAe,OAAO,eAAe,OAAO,kBAC3C;AAAA,MACE,aAAa,OAAO;AAAA,MACpB,iBAAiB,OAAO;AAAA,MACxB,GAAI,OAAO,eAAe,EAAE,cAAc,OAAO,aAAa,IAAI,CAAC;AAAA,IACvE,IACE;AAGN,YAAQ,IAAI,qDAAqD;AAEjE,SAAK,WAAW,CAAC;AAAA,EACrB;AAAA;AAAA,EAGA,cAAc,QAAQ;AAClB,UAAM,MAAM,EAAE,QAAQ,UAAU,KAAK,OAAO;AAC5C,QAAI,KAAK,aAAc,KAAI,cAAc,KAAK;AAC9C,WAAO;AAAA,EACX;AAAA,EAEA,OAAO;AACH,WAAQ,KAAK,SAAS,QAAQ,IAAI,UAAU,KAAK,cAAc,CAAC;AAAA,EACpE;AAAA,EAEA,KAAK,QAAQ;AACT,UAAM,MAAM,OAAO,UAAU,KAAK,MAAM;AACxC,WAAQ,KAAK,SAAS,GAAG,MAAM,IAAI,UAAU,KAAK,cAAc,MAAM,CAAC;AAAA,EAC3E;AAAA,EAEA,WAAW;AAEP,WAAQ,KAAK,SAAS,YAAY,IAAI,cAAc,KAAK,cAAc,CAAC;AAAA,EAC5E;AAAA,EAEA,YAAY;AAAE,WAAO,KAAK;AAAA,EAAQ;AAAA;AAAA;AAAA,EAIlC,MAAM,SAAS;AACX,UAAM,MAAM,MAAM,KAAK,KAAK,EAAE,KAAK,IAAI,yBAAyB,CAAC,CAAC,CAAC;AACnE,WAAO,EAAE,SAAS,IAAI,SAAS,KAAK,IAAI,KAAK,QAAQ,IAAI,OAAO;AAAA,EACpE;AAAA;AAAA;AAAA,EAIA,MAAM,YAAY,EAAE,aAAa,MAAM,IAAI,CAAC,GAAG;AAC3C,UAAM,MAAM,MAAM,KAAK,KAAK,EAAE,KAAK,IAAI,uBAAuB,EAAE,YAAY,WAAW,CAAC,CAAC;AACzF,YAAQ,IAAI,WAAW,CAAC,GAAG,IAAI,OAAK,EAAE,UAAU,EAAE,KAAK;AAAA,EAC3D;AAAA;AAAA,EAGA,MAAM,sBAAsB,QAAQ;AAChC,UAAM,MAAM,MAAM,KAAK,KAAK,MAAM,EAAE,KAAK,IAAI,iCAAiC,CAAC,CAAC,CAAC;AACjF,YAAQ,IAAI,qBAAqB,CAAC,GAC7B,OAAO,OAAK,EAAE,UAAU,WAAW,EACnC,IAAI,OAAK,EAAE,QAAQ,EACnB,KAAK;AAAA,EACd;AAAA;AAAA;AAAA,EAIA,MAAM,SAAS,QAAQ;AACnB,UAAM,MAAM,MAAM,KAAK,KAAK,MAAM,EAAE,KAAK,IAAI,oBAAoB,CAAC,CAAC,CAAC;AACpE,YAAQ,IAAI,QAAQ,CAAC,GAAG,IAAI,QAAM;AAAA,MAC9B,IAAI,EAAE;AAAA,MACN,MAAM,EAAE;AAAA,MACR,WAAW,CAAC,CAAC,EAAE;AAAA,MACf,MAAM,QAAQ,EAAE,IAAI;AAAA,IACxB,EAAE;AAAA,EACN;AAAA;AAAA,EAGA,MAAM,YAAY,EAAE,OAAO,OAAO,IAAI,CAAC,GAAG;AACtC,UAAM,UAAU,QAAQ,CAAC,EAAE,MAAM,UAAU,QAAQ,CAAC,KAAK,EAAE,CAAC,IAAI;AAChE,UAAM,MAAM,MAAM,KAAK,KAAK,MAAM,EAAE,KAAK,IAAI,uBAAuB,EAAE,QAAQ,CAAC,CAAC;AAChF,YAAQ,IAAI,WAAW,CAAC,GAAG,IAAI,QAAM;AAAA,MACjC,IAAI,EAAE;AAAA,MACN,OAAO,EAAE;AAAA,MACT,IAAI,EAAE;AAAA,MACN,MAAM,EAAE;AAAA,MACR,QAAQ,CAAC,CAAC,EAAE;AAAA,MACZ,MAAM,QAAQ,EAAE,IAAI;AAAA,IACxB,EAAE;AAAA,EACN;AAAA;AAAA,EAGA,MAAM,mBAAmB,EAAE,OAAO,OAAO,IAAI,CAAC,GAAG;AAC7C,UAAM,UAAU,QAAQ,CAAC,EAAE,MAAM,UAAU,QAAQ,CAAC,KAAK,EAAE,CAAC,IAAI;AAChE,UAAM,MAAM,MAAM,KAAK,KAAK,MAAM,EAAE,KAAK,IAAI,8BAA8B,EAAE,QAAQ,CAAC,CAAC;AACvF,YAAQ,IAAI,kBAAkB,CAAC,GAAG,IAAI,QAAM;AAAA,MACxC,IAAI,EAAE;AAAA,MACN,MAAM,EAAE;AAAA,MACR,OAAO,EAAE;AAAA,MACT,aAAa,EAAE;AAAA,IACnB,EAAE;AAAA,EACN;AAAA;AAAA,EAGA,MAAM,aAAa,QAAQ;AACvB,UAAM,MAAM,MAAM,KAAK,KAAK,MAAM,EAAE,KAAK,IAAI,wBAAwB,CAAC,CAAC,CAAC;AACxE,YAAQ,IAAI,YAAY,CAAC,GAAG,IAAI,QAAM,EAAE,MAAM,EAAE,SAAS,aAAa,EAAE,eAAe,EAAE;AAAA,EAC7F;AAAA;AAAA;AAAA,EAIA,MAAM,kBAAkB;AACpB,UAAM,QAAQ,CAAC;AACf,QAAI;AACJ,OAAG;AACC,YAAM,MAAM,MAAM,KAAK,SAAS,EAAE,KAAK,IAAI,uBAAuB,EAAE,QAAQ,OAAO,CAAC,CAAC;AACrF,iBAAW,KAAK,IAAI,eAAe,CAAC,GAAG;AACnC,cAAM,KAAK;AAAA,UACP,KAAK,EAAE,MAAM,IAAI,QAAQ,gBAAgB,EAAE;AAAA,UAC3C,OAAO,EAAE,QAAQ,IAAI,QAAQ,OAAO,EAAE;AAAA;AAAA,UACtC,SAAS,CAAC,CAAC,EAAE,QAAQ;AAAA,UACrB,aAAa,EAAE;AAAA,QACnB,CAAC;AAAA,MACL;AACA,eAAS,IAAI,cAAc,IAAI,aAAa;AAAA,IAChD,SAAS;AACT,WAAO;AAAA,EACX;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAOA,MAAM,wBAAwB,QAAQ;AAClC,UAAM,SAAS,OAAO,UAAU,EAAE,EAAE,QAAQ,OAAO,EAAE,EAAE,YAAY;AACnE,QAAI,CAAC,OAAQ,QAAO;AACpB,UAAM,QAAQ,MAAM,KAAK,gBAAgB;AACzC,UAAM,QAAQ,MAAM,KAAK,OAAK,EAAE,KAAK,YAAY,MAAM,MAAM;AAC7D,QAAI,MAAO,QAAO;AAClB,WAAO,MACF,OAAO,OAAK,OAAO,SAAS,IAAI,EAAE,KAAK,YAAY,CAAC,EAAE,CAAC,EACvD,KAAK,CAAC,GAAG,MAAM,EAAE,KAAK,SAAS,EAAE,KAAK,MAAM,EAAE,CAAC,KAAK;AAAA,EAC7D;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAOA,MAAM,oBAAoB,EAAE,QAAQ,UAAU,wBAAwB,eAAe,SAAS,IAAI,CAAC,GAAG;AAClG,UAAM,MAAM,MAAM,KAAK,KAAK,MAAM,EAAE,KAAK,IAAI,sBAAsB;AAAA,MAC/D,QAAQ,CAAC,kBAAkB;AAAA,MAC3B,SAAS;AAAA,QACL,EAAE,MAAM,QAAQ,QAAQ,CAAC,OAAO,EAAE;AAAA,QAClC,EAAE,MAAM,uBAAuB,QAAQ,CAAC,KAAK,EAAE;AAAA,QAC/C,EAAE,MAAM,SAAS,QAAQ,CAAC,WAAW,EAAE;AAAA,QACvC,GAAI,eAAe,CAAC,EAAE,MAAM,gBAAgB,QAAQ,CAAC,YAAY,EAAE,CAAC,IAAI,CAAC;AAAA,MAC7E;AAAA,IACJ,CAAC,CAAC;AACF,UAAM,UAAU,IAAI,UAAU,CAAC,GAC1B,KAAK,CAAC,GAAG,MAAM,OAAO,EAAE,YAAY,EAAE,cAAc,OAAO,EAAE,YAAY,CAAC,CAAC,EAAE,CAAC;AACnF,QAAI,CAAC,OAAQ,QAAO;AACpB,WAAO;AAAA,MACH,IAAI,OAAO;AAAA,MACX,MAAM,OAAO;AAAA,MACb,cAAc,OAAO;AAAA,MACrB,cAAc,OAAO;AAAA,IACzB;AAAA,EACJ;AACJ;","names":[]}