@qpqjs/cli 0.0.0-stage → 0.2.0

package/lib/commonjs/platforms/aws/goDockerManifest.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"goDockerManifest.js","sourceRoot":"","sources":["../../../../src/platforms/aws/goDockerManifest.ts"],"names":[],"mappings":";;;;;;AAMA,4CAAoB;AACpB,gDAAwB;AAGxB,mDAA8C;AA8B9C,MAAM,aAAa,GAAG,aAAa,CAAC;AAEpC,0FAA0F;AACnF,MAAM,mBAAmB,GAAG,CAAC,OAAe,EAAE,WAAmB,EAAU,EAAE,CAClF,cAAI,CAAC,IAAI,CAAC,IAAA,mBAAO,GAAE,EAAE,MAAM,EAAE,KAAK,EAAE,WAAW,EAAE,OAAO,EAAE,WAAW,CAAC,CAAC;AAD5D,QAAA,mBAAmB,uBACyC;AAEzE,qFAAqF;AAC9E,MAAM,sBAAsB,GAAG,CAAC,OAAe,EAAE,WAAmB,EAAU,EAAE,CACrF,cAAI,CAAC,IAAI,CAAC,IAAA,2BAAmB,EAAC,OAAO,EAAE,WAAW,CAAC,EAAE,UAAU,CAAC,CAAC;AADtD,QAAA,sBAAsB,0BACgC;AAEnE,iEAAiE;AAC1D,MAAM,cAAc,GAAG,CAAC,YAAoB,EAAU,EAAE,CAAC,cAAI,CAAC,QAAQ,CAAC,IAAA,mBAAO,GAAE,EAAE,YAAY,CAAC,CAAC,KAAK,CAAC,cAAI,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;AAApH,QAAA,cAAc,kBAAsG;AAEjI,oEAAoE;AAC7D,MAAM,gBAAgB,GAAG,CAAC,YAAoB,EAAU,EAAE,CAAC,cAAI,CAAC,OAAO,CAAC,IAAA,mBAAO,GAAE,EAAE,YAAY,CAAC,CAAC;AAA3F,QAAA,gBAAgB,oBAA2E;AAEjG,MAAM,0BAA0B,GAAG,CAAC,OAAe,EAAE,WAAmB,EAAE,QAA+B,EAAQ,EAAE;IACxH,MAAM,QAAQ,GAAG,IAAA,2BAAmB,EAAC,OAAO,EAAE,WAAW,CAAC,CAAC;IAC3D,YAAE,CAAC,SAAS,CAAC,QAAQ,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAC;IAC5C,YAAE,CAAC,aAAa,CAAC,cAAI,CAAC,IAAI,CAAC,QAAQ,EAAE,aAAa,CAAC,EAAE,IAAI,CAAC,SAAS,CAAC,QAAQ,EAAE,IAAI,EAAE,CAAC,CAAC,CAAC,CAAC;AAC1F,CAAC,CAAC;AAJW,QAAA,0BAA0B,8BAIrC;AAEF,uGAAuG;AAChG,MAAM,yBAAyB,GAAG,CAAC,OAAe,EAAE,WAAmB,EAAyB,EAAE;IACvG,MAAM,YAAY,GAAG,cAAI,CAAC,IAAI,CAAC,IAAA,2BAAmB,EAAC,OAAO,EAAE,WAAW,CAAC,EAAE,aAAa,CAAC,CAAC;IAEzF,IAAI,CAAC,YAAE,CAAC,UAAU,CAAC,YAAY,CAAC,EAAE,CAAC;QACjC,MAAM,IAAI,KAAK,CACb,uBAAuB,WAAW,cAAc,YAAY,2BAA2B,WAAW,+BAA+B,OAAO,UAAU,CACnJ,CAAC;IACJ,CAAC;IAED,OAAO,IAAI,CAAC,KAAK,CAAC,YAAE,CAAC,YAAY,CAAC,YAAY,EAAE,OAAO,CAAC,CAA0B,CAAC;AACrF,CAAC,CAAC;AAVW,QAAA,yBAAyB,6BAUpC","sourcesContent":["// The saved build `qpq go:docker --build-only` leaves behind and `--from-build`\n// deploys from. Per service it is the CDK cloud assembly plus a manifest under\n// dist/qpq/go-docker/<app>/<service>, with the views bundle and the federated\n// remote left where their bundlers write them and pointed at from the manifest.\nimport { Nullable } from '@qpqjs/core';\n\nimport fs from 'fs';\nimport path from 'path';\n\nimport { StackType } from '../../lib/deployPrompts';\nimport { getRoot } from '../../lib/discovery';\n\n/** The CloudFormation stack names of one service's assembly. */\nexport type GoDockerStackNames = { inf: string; api: string; web: string };\n\n/** A built views bundle and the S3 locations it syncs to. */\nexport type GoDockerViewsEntry = { dir: string; destinations: string[] };\n\n/** A built federated remote (its publish dir and the store it goes into). */\nexport type GoDockerRemoteEntry = { dir: string; manifestHash: string; bucketName: string; servicePrefix: string };\n\n/**\n * Everything the deploy half needs for one service that only the live config can\n * answer, resolved by the build half. Paths are relative to the consumer root with\n * forward slashes, so a build saved on one machine deploys from another checkout.\n */\nexport type GoDockerBuildManifest = {\n  // The aws-cdk that synthesized the assembly; the deploy half refuses any other.\n  cdkVersion: string;\n  deploymentName: string;\n  // The stack selection the build ran with: `all` can deploy any phase, anything else only its own.\n  builtFor: StackType;\n  // Null for a views-only build, which synthesizes nothing.\n  stacks: Nullable<GoDockerStackNames>;\n  // Null when the service has no views or they were not built.\n  views: Nullable<GoDockerViewsEntry>;\n  // Null when the service has no defineFederatedModuleStore(...) or the api was not built.\n  remote: Nullable<GoDockerRemoteEntry>;\n};\n\nconst MANIFEST_FILE = 'deploy.json';\n\n/** The per-service directory the build half owns: the cloud assembly and the manifest. */\nexport const getGoDockerBuildDir = (appName: string, serviceName: string): string =>\n  path.join(getRoot(), 'dist', 'qpq', 'go-docker', appName, serviceName);\n\n/** Where `cdk synth --output` writes the service's self-contained cloud assembly. */\nexport const getGoDockerAssemblyDir = (appName: string, serviceName: string): string =>\n  path.join(getGoDockerBuildDir(appName, serviceName), 'assembly');\n\n/** A path under the consumer root, as the manifest stores it. */\nexport const toManifestPath = (absolutePath: string): string => path.relative(getRoot(), absolutePath).split(path.sep).join('/');\n\n/** The absolute path a manifest entry points at on this machine. */\nexport const fromManifestPath = (manifestPath: string): string => path.resolve(getRoot(), manifestPath);\n\nexport const writeGoDockerBuildManifest = (appName: string, serviceName: string, manifest: GoDockerBuildManifest): void => {\n  const buildDir = getGoDockerBuildDir(appName, serviceName);\n  fs.mkdirSync(buildDir, { recursive: true });\n  fs.writeFileSync(path.join(buildDir, MANIFEST_FILE), JSON.stringify(manifest, null, 2));\n};\n\n/** Throws, naming the directory and the command that fills it, when the service has no saved build. */\nexport const readGoDockerBuildManifest = (appName: string, serviceName: string): GoDockerBuildManifest => {\n  const manifestPath = path.join(getGoDockerBuildDir(appName, serviceName), MANIFEST_FILE);\n\n  if (!fs.existsSync(manifestPath)) {\n    throw new Error(\n      `no saved build for [${serviceName}] (missing ${manifestPath}) - run \\`qpq go:docker ${serviceName} <stack> --build-only --app ${appName}\\` first`,\n    );\n  }\n\n  return JSON.parse(fs.readFileSync(manifestPath, 'utf-8')) as GoDockerBuildManifest;\n};\n"]}

package/lib/commonjs/platforms/aws/index.d.ts

@@ -0,0 +1,2 @@
+import { QpqPlatformDriver } from '../types';
+export declare const awsPlatformDriver: QpqPlatformDriver;

package/lib/commonjs/platforms/aws/index.js

@@ -0,0 +1,23 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.awsPlatformDriver = void 0;
+const clearResources_1 = require("./clearResources");
+const go_1 = require("./go");
+const goDocker_1 = require("./goDocker");
+const prepareDeployment_1 = require("./prepareDeployment");
+const publish_1 = require("./publish");
+const setup_1 = require("./setup");
+const teardown_1 = require("./teardown");
+exports.awsPlatformDriver = {
+    prepareDeployment: prepareDeployment_1.awsPrepareDeployment,
+    go: go_1.awsGo,
+    goDocker: goDocker_1.awsGoDocker,
+    teardown: teardown_1.awsTeardown,
+    clearResources: clearResources_1.awsClearResources,
+    setupSteps: setup_1.awsSetupSteps,
+    publish: publish_1.awsPublish,
+    publishBuild: publish_1.awsPublishBuild,
+    publishUpload: publish_1.awsPublishUpload,
+    publishDeploy: publish_1.awsPublishDeploy,
+};
+//# sourceMappingURL=index.js.map

package/lib/commonjs/platforms/aws/index.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../../../../src/platforms/aws/index.ts"],"names":[],"mappings":";;;AACA,qDAAqD;AACrD,6BAA6B;AAC7B,yCAAyC;AACzC,2DAA2D;AAC3D,uCAA4F;AAC5F,mCAAwC;AACxC,yCAAyC;AAE5B,QAAA,iBAAiB,GAAsB;IAClD,iBAAiB,EAAE,wCAAoB;IAEvC,EAAE,EAAE,UAAK;IACT,QAAQ,EAAE,sBAAW;IACrB,QAAQ,EAAE,sBAAW;IACrB,cAAc,EAAE,kCAAiB;IACjC,UAAU,EAAE,qBAAa;IAEzB,OAAO,EAAE,oBAAU;IACnB,YAAY,EAAE,yBAAe;IAC7B,aAAa,EAAE,0BAAgB;IAC/B,aAAa,EAAE,0BAAgB;CAChC,CAAC","sourcesContent":["import { QpqPlatformDriver } from '../types';\nimport { awsClearResources } from './clearResources';\nimport { awsGo } from './go';\nimport { awsGoDocker } from './goDocker';\nimport { awsPrepareDeployment } from './prepareDeployment';\nimport { awsPublish, awsPublishBuild, awsPublishDeploy, awsPublishUpload } from './publish';\nimport { awsSetupSteps } from './setup';\nimport { awsTeardown } from './teardown';\n\nexport const awsPlatformDriver: QpqPlatformDriver = {\n  prepareDeployment: awsPrepareDeployment,\n\n  go: awsGo,\n  goDocker: awsGoDocker,\n  teardown: awsTeardown,\n  clearResources: awsClearResources,\n  setupSteps: awsSetupSteps,\n\n  publish: awsPublish,\n  publishBuild: awsPublishBuild,\n  publishUpload: awsPublishUpload,\n  publishDeploy: awsPublishDeploy,\n};\n"]}

package/lib/commonjs/platforms/aws/prepareDeployment.d.ts

@@ -0,0 +1,3 @@
+import { QpqAppDeployment } from '@qpqjs/core';
+/** Checks the entry has an account and region, then primes AWS_DEFAULT_ACCOUNT / AWS_DEFAULT_REGION from it. */
+export declare const awsPrepareDeployment: (deploymentName: string, deployment: QpqAppDeployment) => void;

package/lib/commonjs/platforms/aws/prepareDeployment.js

@@ -0,0 +1,10 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.awsPrepareDeployment = void 0;
+const config_aws_1 = require("@qpqjs/config-aws");
+/** Checks the entry has an account and region, then primes AWS_DEFAULT_ACCOUNT / AWS_DEFAULT_REGION from it. */
+const awsPrepareDeployment = (deploymentName, deployment) => {
+    (0, config_aws_1.primeAwsDeploymentEnv)((0, config_aws_1.validateAwsDeployment)(deploymentName, deployment));
+};
+exports.awsPrepareDeployment = awsPrepareDeployment;
+//# sourceMappingURL=prepareDeployment.js.map

package/lib/commonjs/platforms/aws/prepareDeployment.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"prepareDeployment.js","sourceRoot":"","sources":["../../../../src/platforms/aws/prepareDeployment.ts"],"names":[],"mappings":";;;AAAA,kDAAiF;AAGjF,gHAAgH;AACzG,MAAM,oBAAoB,GAAG,CAAC,cAAsB,EAAE,UAA4B,EAAQ,EAAE;IACjG,IAAA,kCAAqB,EAAC,IAAA,kCAAqB,EAAC,cAAc,EAAE,UAAU,CAAC,CAAC,CAAC;AAC3E,CAAC,CAAC;AAFW,QAAA,oBAAoB,wBAE/B","sourcesContent":["import { primeAwsDeploymentEnv, validateAwsDeployment } from '@qpqjs/config-aws';\nimport { QpqAppDeployment } from '@qpqjs/core';\n\n/** Checks the entry has an account and region, then primes AWS_DEFAULT_ACCOUNT / AWS_DEFAULT_REGION from it. */\nexport const awsPrepareDeployment = (deploymentName: string, deployment: QpqAppDeployment): void => {\n  primeAwsDeploymentEnv(validateAwsDeployment(deploymentName, deployment));\n};\n"]}

package/lib/commonjs/platforms/aws/publish.d.ts

@@ -0,0 +1,4 @@
+export declare const awsPublishBuild: (appName: string, serviceNames: string[]) => Promise<void>;
+export declare const awsPublishUpload: (appName: string, serviceNames: string[]) => Promise<void>;
+export declare const awsPublishDeploy: (appName: string, serviceNames: string[]) => Promise<void>;
+export declare const awsPublish: (appName: string, serviceNames: string[]) => Promise<void>;

package/lib/commonjs/platforms/aws/publish.js

@@ -0,0 +1,66 @@
+"use strict";
+var __awaiter = (this && this.__awaiter) || function (thisArg, _arguments, P, generator) {
+    function adopt(value) { return value instanceof P ? value : new P(function (resolve) { resolve(value); }); }
+    return new (P || (P = Promise))(function (resolve, reject) {
+        function fulfilled(value) { try { step(generator.next(value)); } catch (e) { reject(e); } }
+        function rejected(value) { try { step(generator["throw"](value)); } catch (e) { reject(e); } }
+        function step(result) { result.done ? resolve(result.value) : adopt(result.value).then(fulfilled, rejected); }
+        step((generator = generator.apply(thisArg, _arguments || [])).next());
+    });
+};
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.awsPublish = exports.awsPublishDeploy = exports.awsPublishUpload = exports.awsPublishBuild = void 0;
+// AWS federated remote publishing — build each backend service as a
+// module-federation remote and publish it into that service's federated code
+// bucket (see ./remote for the three-phase mechanics).
+const awsCredentials_1 = require("./awsCredentials");
+const remote_1 = require("./remote");
+const requireAwsCredentials = () => __awaiter(void 0, void 0, void 0, function* () {
+    if (!(yield (0, awsCredentials_1.isAwsCredentialsValid)())) {
+        console.error('AWS credentials are not valid. Configure them and retry.');
+        process.exit(1);
+    }
+});
+const awsPublishBuild = (appName, serviceNames) => __awaiter(void 0, void 0, void 0, function* () {
+    console.log(`Building federated remotes for [${appName}]: ${serviceNames.join(', ')}`);
+    for (const serviceName of serviceNames) {
+        yield (0, remote_1.buildRemote)(appName, serviceName);
+    }
+    console.log('Done. Next: qpq publish:upload, then qpq publish:deploy.');
+});
+exports.awsPublishBuild = awsPublishBuild;
+const awsPublishUpload = (appName, serviceNames) => __awaiter(void 0, void 0, void 0, function* () {
+    yield requireAwsCredentials();
+    // Resolve every target up front - a missing build fails the whole step
+    // before a single byte is uploaded.
+    const targets = serviceNames.map((serviceName) => (0, remote_1.resolvePublishTarget)(appName, serviceName));
+    console.log(`Uploading federated remotes for [${appName}]: ${serviceNames.join(', ')}`);
+    yield Promise.all(targets.map((target) => (0, remote_1.uploadRemoteVersion)(target)));
+    console.log('Done. Run qpq publish:deploy to flip lambdas to the new versions.');
+});
+exports.awsPublishUpload = awsPublishUpload;
+const awsPublishDeploy = (appName, serviceNames) => __awaiter(void 0, void 0, void 0, function* () {
+    yield requireAwsCredentials();
+    const targets = serviceNames.map((serviceName) => (0, remote_1.resolvePublishTarget)(appName, serviceName));
+    console.log(`Deploying federated remote manifests for [${appName}]: ${serviceNames.join(', ')}`);
+    yield Promise.all(targets.map((target) => (0, remote_1.deployRemoteManifest)(target)));
+    console.log('Done. New lambda cold starts will federate these services from S3.');
+});
+exports.awsPublishDeploy = awsPublishDeploy;
+const awsPublish = (appName, serviceNames) => __awaiter(void 0, void 0, void 0, function* () {
+    yield requireAwsCredentials();
+    console.log(`Publishing federated remotes for [${appName}]: ${serviceNames.join(', ')}`);
+    // 1. Build everything first - any build failure bails before any upload,
+    // so the buckets never end up with a half-published set of services.
+    for (const serviceName of serviceNames) {
+        yield (0, remote_1.buildRemote)(appName, serviceName);
+    }
+    const targets = serviceNames.map((serviceName) => (0, remote_1.resolvePublishTarget)(appName, serviceName));
+    // 2. Upload all version dirs in parallel - manifests untouched, nothing live yet.
+    yield Promise.all(targets.map((target) => (0, remote_1.uploadRemoteVersion)(target)));
+    // 3. Every version dir is fully uploaded - flip the manifests, in parallel.
+    yield Promise.all(targets.map((target) => (0, remote_1.deployRemoteManifest)(target)));
+    console.log('Done. New lambda cold starts will federate these services from S3.');
+});
+exports.awsPublish = awsPublish;
+//# sourceMappingURL=publish.js.map

package/lib/commonjs/platforms/aws/publish.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"publish.js","sourceRoot":"","sources":["../../../../src/platforms/aws/publish.ts"],"names":[],"mappings":";;;;;;;;;;;;AAAA,oEAAoE;AACpE,6EAA6E;AAC7E,uDAAuD;AACvD,qDAAyD;AACzD,qCAAwG;AAExG,MAAM,qBAAqB,GAAG,GAAwB,EAAE;IACtD,IAAI,CAAC,CAAC,MAAM,IAAA,sCAAqB,GAAE,CAAC,EAAE,CAAC;QACrC,OAAO,CAAC,KAAK,CAAC,0DAA0D,CAAC,CAAC;QAC1E,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;IAClB,CAAC;AACH,CAAC,CAAA,CAAC;AAEK,MAAM,eAAe,GAAG,CAAO,OAAe,EAAE,YAAsB,EAAiB,EAAE;IAC9F,OAAO,CAAC,GAAG,CAAC,mCAAmC,OAAO,MAAM,YAAY,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;IAEvF,KAAK,MAAM,WAAW,IAAI,YAAY,EAAE,CAAC;QACvC,MAAM,IAAA,oBAAW,EAAC,OAAO,EAAE,WAAW,CAAC,CAAC;IAC1C,CAAC;IAED,OAAO,CAAC,GAAG,CAAC,0DAA0D,CAAC,CAAC;AAC1E,CAAC,CAAA,CAAC;AARW,QAAA,eAAe,mBAQ1B;AAEK,MAAM,gBAAgB,GAAG,CAAO,OAAe,EAAE,YAAsB,EAAiB,EAAE;IAC/F,MAAM,qBAAqB,EAAE,CAAC;IAE9B,uEAAuE;IACvE,oCAAoC;IACpC,MAAM,OAAO,GAAG,YAAY,CAAC,GAAG,CAAC,CAAC,WAAW,EAAE,EAAE,CAAC,IAAA,6BAAoB,EAAC,OAAO,EAAE,WAAW,CAAC,CAAC,CAAC;IAE9F,OAAO,CAAC,GAAG,CAAC,oCAAoC,OAAO,MAAM,YAAY,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;IACxF,MAAM,OAAO,CAAC,GAAG,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC,IAAA,4BAAmB,EAAC,MAAM,CAAC,CAAC,CAAC,CAAC;IAExE,OAAO,CAAC,GAAG,CAAC,mEAAmE,CAAC,CAAC;AACnF,CAAC,CAAA,CAAC;AAXW,QAAA,gBAAgB,oBAW3B;AAEK,MAAM,gBAAgB,GAAG,CAAO,OAAe,EAAE,YAAsB,EAAiB,EAAE;IAC/F,MAAM,qBAAqB,EAAE,CAAC;IAE9B,MAAM,OAAO,GAAG,YAAY,CAAC,GAAG,CAAC,CAAC,WAAW,EAAE,EAAE,CAAC,IAAA,6BAAoB,EAAC,OAAO,EAAE,WAAW,CAAC,CAAC,CAAC;IAE9F,OAAO,CAAC,GAAG,CAAC,6CAA6C,OAAO,MAAM,YAAY,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;IACjG,MAAM,OAAO,CAAC,GAAG,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC,IAAA,6BAAoB,EAAC,MAAM,CAAC,CAAC,CAAC,CAAC;IAEzE,OAAO,CAAC,GAAG,CAAC,oEAAoE,CAAC,CAAC;AACpF,CAAC,CAAA,CAAC;AATW,QAAA,gBAAgB,oBAS3B;AAEK,MAAM,UAAU,GAAG,CAAO,OAAe,EAAE,YAAsB,EAAiB,EAAE;IACzF,MAAM,qBAAqB,EAAE,CAAC;IAE9B,OAAO,CAAC,GAAG,CAAC,qCAAqC,OAAO,MAAM,YAAY,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;IAEzF,yEAAyE;IACzE,qEAAqE;IACrE,KAAK,MAAM,WAAW,IAAI,YAAY,EAAE,CAAC;QACvC,MAAM,IAAA,oBAAW,EAAC,OAAO,EAAE,WAAW,CAAC,CAAC;IAC1C,CAAC;IACD,MAAM,OAAO,GAAG,YAAY,CAAC,GAAG,CAAC,CAAC,WAAW,EAAE,EAAE,CAAC,IAAA,6BAAoB,EAAC,OAAO,EAAE,WAAW,CAAC,CAAC,CAAC;IAE9F,kFAAkF;IAClF,MAAM,OAAO,CAAC,GAAG,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC,IAAA,4BAAmB,EAAC,MAAM,CAAC,CAAC,CAAC,CAAC;IAExE,4EAA4E;IAC5E,MAAM,OAAO,CAAC,GAAG,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC,IAAA,6BAAoB,EAAC,MAAM,CAAC,CAAC,CAAC,CAAC;IAEzE,OAAO,CAAC,GAAG,CAAC,oEAAoE,CAAC,CAAC;AACpF,CAAC,CAAA,CAAC;AAnBW,QAAA,UAAU,cAmBrB","sourcesContent":["// AWS federated remote publishing — build each backend service as a\n// module-federation remote and publish it into that service's federated code\n// bucket (see ./remote for the three-phase mechanics).\nimport { isAwsCredentialsValid } from './awsCredentials';\nimport { buildRemote, deployRemoteManifest, resolvePublishTarget, uploadRemoteVersion } from './remote';\n\nconst requireAwsCredentials = async (): Promise<void> => {\n  if (!(await isAwsCredentialsValid())) {\n    console.error('AWS credentials are not valid. Configure them and retry.');\n    process.exit(1);\n  }\n};\n\nexport const awsPublishBuild = async (appName: string, serviceNames: string[]): Promise<void> => {\n  console.log(`Building federated remotes for [${appName}]: ${serviceNames.join(', ')}`);\n\n  for (const serviceName of serviceNames) {\n    await buildRemote(appName, serviceName);\n  }\n\n  console.log('Done. Next: qpq publish:upload, then qpq publish:deploy.');\n};\n\nexport const awsPublishUpload = async (appName: string, serviceNames: string[]): Promise<void> => {\n  await requireAwsCredentials();\n\n  // Resolve every target up front - a missing build fails the whole step\n  // before a single byte is uploaded.\n  const targets = serviceNames.map((serviceName) => resolvePublishTarget(appName, serviceName));\n\n  console.log(`Uploading federated remotes for [${appName}]: ${serviceNames.join(', ')}`);\n  await Promise.all(targets.map((target) => uploadRemoteVersion(target)));\n\n  console.log('Done. Run qpq publish:deploy to flip lambdas to the new versions.');\n};\n\nexport const awsPublishDeploy = async (appName: string, serviceNames: string[]): Promise<void> => {\n  await requireAwsCredentials();\n\n  const targets = serviceNames.map((serviceName) => resolvePublishTarget(appName, serviceName));\n\n  console.log(`Deploying federated remote manifests for [${appName}]: ${serviceNames.join(', ')}`);\n  await Promise.all(targets.map((target) => deployRemoteManifest(target)));\n\n  console.log('Done. New lambda cold starts will federate these services from S3.');\n};\n\nexport const awsPublish = async (appName: string, serviceNames: string[]): Promise<void> => {\n  await requireAwsCredentials();\n\n  console.log(`Publishing federated remotes for [${appName}]: ${serviceNames.join(', ')}`);\n\n  // 1. Build everything first - any build failure bails before any upload,\n  // so the buckets never end up with a half-published set of services.\n  for (const serviceName of serviceNames) {\n    await buildRemote(appName, serviceName);\n  }\n  const targets = serviceNames.map((serviceName) => resolvePublishTarget(appName, serviceName));\n\n  // 2. Upload all version dirs in parallel - manifests untouched, nothing live yet.\n  await Promise.all(targets.map((target) => uploadRemoteVersion(target)));\n\n  // 3. Every version dir is fully uploaded - flip the manifests, in parallel.\n  await Promise.all(targets.map((target) => deployRemoteManifest(target)));\n\n  console.log('Done. New lambda cold starts will federate these services from S3.');\n};\n"]}

package/lib/commonjs/platforms/aws/remote.d.ts

@@ -0,0 +1,11 @@
+export type RemotePublishTarget = {
+    serviceName: string;
+    publishPath: string;
+    manifestHash: string;
+    bucketName: string;
+    servicePrefix: string;
+};
+export declare const buildRemote: (appName: string, serviceName: string) => Promise<void>;
+export declare const resolvePublishTarget: (appName: string, serviceName: string) => RemotePublishTarget;
+export declare const uploadRemoteVersion: (target: RemotePublishTarget) => Promise<void>;
+export declare const deployRemoteManifest: (target: RemotePublishTarget) => Promise<void>;

package/lib/commonjs/platforms/aws/remote.js

@@ -0,0 +1,105 @@
+"use strict";
+var __awaiter = (this && this.__awaiter) || function (thisArg, _arguments, P, generator) {
+    function adopt(value) { return value instanceof P ? value : new P(function (resolve) { resolve(value); }); }
+    return new (P || (P = Promise))(function (resolve, reject) {
+        function fulfilled(value) { try { step(generator.next(value)); } catch (e) { reject(e); } }
+        function rejected(value) { try { step(generator["throw"](value)); } catch (e) { reject(e); } }
+        function step(result) { result.done ? resolve(result.value) : adopt(result.value).then(fulfilled, rejected); }
+        step((generator = generator.apply(thisArg, _arguments || [])).next());
+    });
+};
+var __importDefault = (this && this.__importDefault) || function (mod) {
+    return (mod && mod.__esModule) ? mod : { "default": mod };
+};
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.deployRemoteManifest = exports.uploadRemoteVersion = exports.resolvePublishTarget = exports.buildRemote = void 0;
+// Build a backend service as a module-federation remote and publish it into the
+// shared federated-code storage drive, under the service's own prefix. After this
+// runs, the already-deployed lambdas load their stories from the bucket (quidproquo's
+// dynamicModuleLoader tries the federated store first, falls back to the bundled
+// code when nothing's published).
+//
+// The store is one storage drive shared across services (via `owner`). Each service
+// opts in with defineFederatedModuleStore(<driveName>) and its lambdas read from
+// s3://<bucket>/<service>. Read access comes from the storage drive's own grants, so
+// the drive + a deploy of each service must exist before publishing. The bucket name
+// resolves from the same service config the deploy used, so it always matches.
+//
+// Publishing is split into three phases so they can run as separate commands
+// (publish:build / publish:upload / publish:deploy) or chained by `qpq publish`:
+//   buildRemote          - rspack the remote + lay out service-remote-published/
+//   uploadRemoteVersion  - sync the hashed version dir (everything BUT manifest.json)
+//   deployRemoteManifest - upload manifest.json, atomically flipping lambdas over
+// Version files always land before the manifest that references them, so a reading
+// lambda never sees a manifest whose files aren't all present yet.
+const actionprocessor_aws_1 = require("@qpqjs/actionprocessor-aws");
+const core_1 = require("@qpqjs/core");
+const deploy_rspack_1 = require("@qpqjs/deploy-rspack");
+const fs_1 = __importDefault(require("fs"));
+const path_1 = __importDefault(require("path"));
+const discovery_1 = require("../../lib/discovery");
+const qpqConfigs_1 = require("../../lib/qpqConfigs");
+const runCommand_1 = require("../../lib/runCommand");
+const getPublishPath = (appName, serviceName) => path_1.default.join((0, discovery_1.getRoot)(), 'dist', 'apps', appName, 'services', serviceName, 'service-remote-published');
+// Resolve the shared store bucket from the service's defineFederatedModuleStore
+// setting (same derivation the lambda env var uses) and the per-service prefix
+// so many services share one bucket.
+const resolveRemoteStore = (appName, serviceName) => {
+    var _a;
+    const qpqConfig = (0, qpqConfigs_1.loadServiceQpqConfig)(appName, serviceName);
+    const federatedStore = core_1.qpqCoreUtils.getFederatedModuleStore(qpqConfig);
+    if (!federatedStore) {
+        throw new Error(`service [${serviceName}] has no defineFederatedModuleStore(...) - add it (and the matching storage drive) to opt into federation`);
+    }
+    const storageDrive = core_1.qpqCoreUtils.getStorageDriveByName(federatedStore.storageDrive, qpqConfig);
+    if (!storageDrive) {
+        throw new Error(`defineFederatedModuleStore references storage drive [${federatedStore.storageDrive}] which service [${serviceName}] does not declare`);
+    }
+    const bucketName = actionprocessor_aws_1.awsNamingUtils.resolveConfigRuntimeResourceNameFromConfig(((_a = storageDrive.owner) === null || _a === void 0 ? void 0 : _a.resourceNameOverride) || storageDrive.storageDrive, qpqConfig, storageDrive.owner);
+    const servicePrefix = core_1.qpqCoreUtils.getApplicationModuleName(qpqConfig);
+    return { bucketName, servicePrefix };
+};
+// Phase 1: rspack the federated remote container and lay out the publishable
+// version dir + manifest.json under service-remote-published/. Validates the
+// federation config up front so a misconfigured service fails before the build.
+const buildRemote = (appName, serviceName) => __awaiter(void 0, void 0, void 0, function* () {
+    resolveRemoteStore(appName, serviceName);
+    const serviceDir = path_1.default.join((0, discovery_1.getServiceDirectory)(appName, serviceName), 'service');
+    const qpqConfig = (0, qpqConfigs_1.loadServiceQpqConfig)(appName, serviceName);
+    console.log(`Building federated remote: [${serviceName}]`);
+    const config = (0, deploy_rspack_1.getServiceRemoteRspackConfig)(qpqConfig, serviceDir);
+    yield (0, deploy_rspack_1.runRspack)(config);
+    const remoteBuildPath = config.output.path;
+    (0, deploy_rspack_1.publishFederatedRemote)(qpqConfig, remoteBuildPath, getPublishPath(appName, serviceName));
+});
+exports.buildRemote = buildRemote;
+// Resolve a publish target from a prior buildRemote's on-disk output.
+const resolvePublishTarget = (appName, serviceName) => {
+    const publishPath = getPublishPath(appName, serviceName);
+    const manifestPath = path_1.default.join(publishPath, 'manifest.json');
+    if (!fs_1.default.existsSync(manifestPath)) {
+        throw new Error(`no built remote found for [${serviceName}] (missing ${manifestPath}) - run \`qpq publish:build --app ${appName}\` first`);
+    }
+    const manifest = JSON.parse(fs_1.default.readFileSync(manifestPath, 'utf-8'));
+    return Object.assign({ serviceName,
+        publishPath, manifestHash: manifest.hash }, resolveRemoteStore(appName, serviceName));
+};
+exports.resolvePublishTarget = resolvePublishTarget;
+// Phase 2: upload the hashed version dir - everything EXCEPT manifest.json, so
+// nothing referenced by a live manifest changes. Safe to run concurrently across
+// services - each writes only under its own prefix.
+const uploadRemoteVersion = (target) => __awaiter(void 0, void 0, void 0, function* () {
+    const { serviceName, publishPath, manifestHash, bucketName, servicePrefix } = target;
+    console.log(`Uploading [${serviceName}] version [${manifestHash}] to [s3://${bucketName}/${servicePrefix}/${manifestHash}]`);
+    yield (0, runCommand_1.runCommand)('aws', ['s3', 'sync', path_1.default.join(publishPath, manifestHash), `s3://${bucketName}/${servicePrefix}/${manifestHash}`]);
+});
+exports.uploadRemoteVersion = uploadRemoteVersion;
+// Phase 3: upload manifest.json, the pointer lambdas read - this is the moment
+// the new version goes live. Only run once the version dir is fully uploaded.
+const deployRemoteManifest = (target) => __awaiter(void 0, void 0, void 0, function* () {
+    const { serviceName, publishPath, manifestHash, bucketName, servicePrefix } = target;
+    console.log(`Deploying [${serviceName}] manifest for version [${manifestHash}] to [s3://${bucketName}/${servicePrefix}/manifest.json]`);
+    yield (0, runCommand_1.runCommand)('aws', ['s3', 'cp', path_1.default.join(publishPath, 'manifest.json'), `s3://${bucketName}/${servicePrefix}/manifest.json`]);
+});
+exports.deployRemoteManifest = deployRemoteManifest;
+//# sourceMappingURL=remote.js.map

package/lib/commonjs/platforms/aws/remote.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"remote.js","sourceRoot":"","sources":["../../../../src/platforms/aws/remote.ts"],"names":[],"mappings":";;;;;;;;;;;;;;;AAAA,gFAAgF;AAChF,kFAAkF;AAClF,sFAAsF;AACtF,iFAAiF;AACjF,kCAAkC;AAClC,EAAE;AACF,oFAAoF;AACpF,iFAAiF;AACjF,qFAAqF;AACrF,qFAAqF;AACrF,+EAA+E;AAC/E,EAAE;AACF,6EAA6E;AAC7E,iFAAiF;AACjF,iFAAiF;AACjF,sFAAsF;AACtF,kFAAkF;AAClF,mFAAmF;AACnF,mEAAmE;AACnE,oEAA4D;AAC5D,sCAA2C;AAC3C,wDAAuG;AAEvG,4CAAoB;AACpB,gDAAwB;AAExB,mDAAmE;AACnE,qDAA4D;AAC5D,qDAAkD;AAalD,MAAM,cAAc,GAAG,CAAC,OAAe,EAAE,WAAmB,EAAU,EAAE,CACtE,cAAI,CAAC,IAAI,CAAC,IAAA,mBAAO,GAAE,EAAE,MAAM,EAAE,MAAM,EAAE,OAAO,EAAE,UAAU,EAAE,WAAW,EAAE,0BAA0B,CAAC,CAAC;AAErG,gFAAgF;AAChF,+EAA+E;AAC/E,qCAAqC;AACrC,MAAM,kBAAkB,GAAG,CAAC,OAAe,EAAE,WAAmB,EAAiD,EAAE;;IACjH,MAAM,SAAS,GAAG,IAAA,iCAAoB,EAAC,OAAO,EAAE,WAAW,CAAC,CAAC;IAE7D,MAAM,cAAc,GAAG,mBAAY,CAAC,uBAAuB,CAAC,SAAS,CAAC,CAAC;IACvE,IAAI,CAAC,cAAc,EAAE,CAAC;QACpB,MAAM,IAAI,KAAK,CACb,YAAY,WAAW,2GAA2G,CACnI,CAAC;IACJ,CAAC;IACD,MAAM,YAAY,GAAG,mBAAY,CAAC,qBAAqB,CAAC,cAAc,CAAC,YAAY,EAAE,SAAS,CAAC,CAAC;IAChG,IAAI,CAAC,YAAY,EAAE,CAAC;QAClB,MAAM,IAAI,KAAK,CACb,wDAAwD,cAAc,CAAC,YAAY,oBAAoB,WAAW,oBAAoB,CACvI,CAAC;IACJ,CAAC;IACD,MAAM,UAAU,GAAG,oCAAc,CAAC,0CAA0C,CAC1E,CAAA,MAAA,YAAY,CAAC,KAAK,0CAAE,oBAAoB,KAAI,YAAY,CAAC,YAAY,EACrE,SAAS,EACT,YAAY,CAAC,KAAK,CACnB,CAAC;IACF,MAAM,aAAa,GAAG,mBAAY,CAAC,wBAAwB,CAAC,SAAS,CAAC,CAAC;IAEvE,OAAO,EAAE,UAAU,EAAE,aAAa,EAAE,CAAC;AACvC,CAAC,CAAC;AAEF,6EAA6E;AAC7E,6EAA6E;AAC7E,gFAAgF;AACzE,MAAM,WAAW,GAAG,CAAO,OAAe,EAAE,WAAmB,EAAiB,EAAE;IACvF,kBAAkB,CAAC,OAAO,EAAE,WAAW,CAAC,CAAC;IAEzC,MAAM,UAAU,GAAG,cAAI,CAAC,IAAI,CAAC,IAAA,+BAAmB,EAAC,OAAO,EAAE,WAAW,CAAC,EAAE,SAAS,CAAC,CAAC;IACnF,MAAM,SAAS,GAAG,IAAA,iCAAoB,EAAC,OAAO,EAAE,WAAW,CAAC,CAAC;IAE7D,OAAO,CAAC,GAAG,CAAC,+BAA+B,WAAW,GAAG,CAAC,CAAC;IAC3D,MAAM,MAAM,GAAG,IAAA,4CAA4B,EAAC,SAAS,EAAE,UAAU,CAAC,CAAC;IACnE,MAAM,IAAA,yBAAS,EAAC,MAAM,CAAC,CAAC;IAExB,MAAM,eAAe,GAAG,MAAM,CAAC,MAAO,CAAC,IAAc,CAAC;IACtD,IAAA,sCAAsB,EAAC,SAAS,EAAE,eAAe,EAAE,cAAc,CAAC,OAAO,EAAE,WAAW,CAAC,CAAC,CAAC;AAC3F,CAAC,CAAA,CAAC;AAZW,QAAA,WAAW,eAYtB;AAEF,sEAAsE;AAC/D,MAAM,oBAAoB,GAAG,CAAC,OAAe,EAAE,WAAmB,EAAuB,EAAE;IAChG,MAAM,WAAW,GAAG,cAAc,CAAC,OAAO,EAAE,WAAW,CAAC,CAAC;IACzD,MAAM,YAAY,GAAG,cAAI,CAAC,IAAI,CAAC,WAAW,EAAE,eAAe,CAAC,CAAC;IAE7D,IAAI,CAAC,YAAE,CAAC,UAAU,CAAC,YAAY,CAAC,EAAE,CAAC;QACjC,MAAM,IAAI,KAAK,CAAC,8BAA8B,WAAW,cAAc,YAAY,qCAAqC,OAAO,UAAU,CAAC,CAAC;IAC7I,CAAC;IACD,MAAM,QAAQ,GAAG,IAAI,CAAC,KAAK,CAAC,YAAE,CAAC,YAAY,CAAC,YAAY,EAAE,OAAO,CAAC,CAEjE,CAAC;IAEF,uBACE,WAAW;QACX,WAAW,EACX,YAAY,EAAE,QAAQ,CAAC,IAAI,IACxB,kBAAkB,CAAC,OAAO,EAAE,WAAW,CAAC,EAC3C;AACJ,CAAC,CAAC;AAjBW,QAAA,oBAAoB,wBAiB/B;AAEF,+EAA+E;AAC/E,iFAAiF;AACjF,oDAAoD;AAC7C,MAAM,mBAAmB,GAAG,CAAO,MAA2B,EAAiB,EAAE;IACtF,MAAM,EAAE,WAAW,EAAE,WAAW,EAAE,YAAY,EAAE,UAAU,EAAE,aAAa,EAAE,GAAG,MAAM,CAAC;IAErF,OAAO,CAAC,GAAG,CAAC,cAAc,WAAW,cAAc,YAAY,cAAc,UAAU,IAAI,aAAa,IAAI,YAAY,GAAG,CAAC,CAAC;IAC7H,MAAM,IAAA,uBAAU,EAAC,KAAK,EAAE,CAAC,IAAI,EAAE,MAAM,EAAE,cAAI,CAAC,IAAI,CAAC,WAAW,EAAE,YAAY,CAAC,EAAE,QAAQ,UAAU,IAAI,aAAa,IAAI,YAAY,EAAE,CAAC,CAAC,CAAC;AACvI,CAAC,CAAA,CAAC;AALW,QAAA,mBAAmB,uBAK9B;AAEF,+EAA+E;AAC/E,8EAA8E;AACvE,MAAM,oBAAoB,GAAG,CAAO,MAA2B,EAAiB,EAAE;IACvF,MAAM,EAAE,WAAW,EAAE,WAAW,EAAE,YAAY,EAAE,UAAU,EAAE,aAAa,EAAE,GAAG,MAAM,CAAC;IAErF,OAAO,CAAC,GAAG,CAAC,cAAc,WAAW,2BAA2B,YAAY,cAAc,UAAU,IAAI,aAAa,iBAAiB,CAAC,CAAC;IACxI,MAAM,IAAA,uBAAU,EAAC,KAAK,EAAE,CAAC,IAAI,EAAE,IAAI,EAAE,cAAI,CAAC,IAAI,CAAC,WAAW,EAAE,eAAe,CAAC,EAAE,QAAQ,UAAU,IAAI,aAAa,gBAAgB,CAAC,CAAC,CAAC;AACtI,CAAC,CAAA,CAAC;AALW,QAAA,oBAAoB,wBAK/B","sourcesContent":["// Build a backend service as a module-federation remote and publish it into the\n// shared federated-code storage drive, under the service's own prefix. After this\n// runs, the already-deployed lambdas load their stories from the bucket (quidproquo's\n// dynamicModuleLoader tries the federated store first, falls back to the bundled\n// code when nothing's published).\n//\n// The store is one storage drive shared across services (via `owner`). Each service\n// opts in with defineFederatedModuleStore(<driveName>) and its lambdas read from\n// s3://<bucket>/<service>. Read access comes from the storage drive's own grants, so\n// the drive + a deploy of each service must exist before publishing. The bucket name\n// resolves from the same service config the deploy used, so it always matches.\n//\n// Publishing is split into three phases so they can run as separate commands\n// (publish:build / publish:upload / publish:deploy) or chained by `qpq publish`:\n//   buildRemote          - rspack the remote + lay out service-remote-published/\n//   uploadRemoteVersion  - sync the hashed version dir (everything BUT manifest.json)\n//   deployRemoteManifest - upload manifest.json, atomically flipping lambdas over\n// Version files always land before the manifest that references them, so a reading\n// lambda never sees a manifest whose files aren't all present yet.\nimport { awsNamingUtils } from '@qpqjs/actionprocessor-aws';\nimport { qpqCoreUtils } from '@qpqjs/core';\nimport { getServiceRemoteRspackConfig, publishFederatedRemote, runRspack } from '@qpqjs/deploy-rspack';\n\nimport fs from 'fs';\nimport path from 'path';\n\nimport { getRoot, getServiceDirectory } from '../../lib/discovery';\nimport { loadServiceQpqConfig } from '../../lib/qpqConfigs';\nimport { runCommand } from '../../lib/runCommand';\n\n// Everything the upload/deploy phases need to publish a built remote. Resolved\n// from the on-disk build output + service config, so each phase can run in its\n// own process without handing state between commands.\nexport type RemotePublishTarget = {\n  serviceName: string;\n  publishPath: string;\n  manifestHash: string;\n  bucketName: string;\n  servicePrefix: string;\n};\n\nconst getPublishPath = (appName: string, serviceName: string): string =>\n  path.join(getRoot(), 'dist', 'apps', appName, 'services', serviceName, 'service-remote-published');\n\n// Resolve the shared store bucket from the service's defineFederatedModuleStore\n// setting (same derivation the lambda env var uses) and the per-service prefix\n// so many services share one bucket.\nconst resolveRemoteStore = (appName: string, serviceName: string): { bucketName: string; servicePrefix: string } => {\n  const qpqConfig = loadServiceQpqConfig(appName, serviceName);\n\n  const federatedStore = qpqCoreUtils.getFederatedModuleStore(qpqConfig);\n  if (!federatedStore) {\n    throw new Error(\n      `service [${serviceName}] has no defineFederatedModuleStore(...) - add it (and the matching storage drive) to opt into federation`,\n    );\n  }\n  const storageDrive = qpqCoreUtils.getStorageDriveByName(federatedStore.storageDrive, qpqConfig);\n  if (!storageDrive) {\n    throw new Error(\n      `defineFederatedModuleStore references storage drive [${federatedStore.storageDrive}] which service [${serviceName}] does not declare`,\n    );\n  }\n  const bucketName = awsNamingUtils.resolveConfigRuntimeResourceNameFromConfig(\n    storageDrive.owner?.resourceNameOverride || storageDrive.storageDrive,\n    qpqConfig,\n    storageDrive.owner,\n  );\n  const servicePrefix = qpqCoreUtils.getApplicationModuleName(qpqConfig);\n\n  return { bucketName, servicePrefix };\n};\n\n// Phase 1: rspack the federated remote container and lay out the publishable\n// version dir + manifest.json under service-remote-published/. Validates the\n// federation config up front so a misconfigured service fails before the build.\nexport const buildRemote = async (appName: string, serviceName: string): Promise<void> => {\n  resolveRemoteStore(appName, serviceName);\n\n  const serviceDir = path.join(getServiceDirectory(appName, serviceName), 'service');\n  const qpqConfig = loadServiceQpqConfig(appName, serviceName);\n\n  console.log(`Building federated remote: [${serviceName}]`);\n  const config = getServiceRemoteRspackConfig(qpqConfig, serviceDir);\n  await runRspack(config);\n\n  const remoteBuildPath = config.output!.path as string;\n  publishFederatedRemote(qpqConfig, remoteBuildPath, getPublishPath(appName, serviceName));\n};\n\n// Resolve a publish target from a prior buildRemote's on-disk output.\nexport const resolvePublishTarget = (appName: string, serviceName: string): RemotePublishTarget => {\n  const publishPath = getPublishPath(appName, serviceName);\n  const manifestPath = path.join(publishPath, 'manifest.json');\n\n  if (!fs.existsSync(manifestPath)) {\n    throw new Error(`no built remote found for [${serviceName}] (missing ${manifestPath}) - run \\`qpq publish:build --app ${appName}\\` first`);\n  }\n  const manifest = JSON.parse(fs.readFileSync(manifestPath, 'utf-8')) as {\n    hash: string;\n  };\n\n  return {\n    serviceName,\n    publishPath,\n    manifestHash: manifest.hash,\n    ...resolveRemoteStore(appName, serviceName),\n  };\n};\n\n// Phase 2: upload the hashed version dir - everything EXCEPT manifest.json, so\n// nothing referenced by a live manifest changes. Safe to run concurrently across\n// services - each writes only under its own prefix.\nexport const uploadRemoteVersion = async (target: RemotePublishTarget): Promise<void> => {\n  const { serviceName, publishPath, manifestHash, bucketName, servicePrefix } = target;\n\n  console.log(`Uploading [${serviceName}] version [${manifestHash}] to [s3://${bucketName}/${servicePrefix}/${manifestHash}]`);\n  await runCommand('aws', ['s3', 'sync', path.join(publishPath, manifestHash), `s3://${bucketName}/${servicePrefix}/${manifestHash}`]);\n};\n\n// Phase 3: upload manifest.json, the pointer lambdas read - this is the moment\n// the new version goes live. Only run once the version dir is fully uploaded.\nexport const deployRemoteManifest = async (target: RemotePublishTarget): Promise<void> => {\n  const { serviceName, publishPath, manifestHash, bucketName, servicePrefix } = target;\n\n  console.log(`Deploying [${serviceName}] manifest for version [${manifestHash}] to [s3://${bucketName}/${servicePrefix}/manifest.json]`);\n  await runCommand('aws', ['s3', 'cp', path.join(publishPath, 'manifest.json'), `s3://${bucketName}/${servicePrefix}/manifest.json`]);\n};\n"]}

package/lib/commonjs/platforms/aws/setup/awsSetupContext.d.ts

@@ -0,0 +1,12 @@
+import { QPQConfig } from '@qpqjs/core';
+/** Everything the AWS setup steps share: the target account/region and the app's configs. */
+export type AwsSetupContext = {
+    appName: string;
+    environment: string;
+    accountId: string;
+    region: string;
+    accountQpqConfig: QPQConfig;
+    bootstrapQpqConfig: QPQConfig;
+    serviceQpqConfigs: QPQConfig[];
+};
+export declare const buildAwsSetupContext: (appName: string, deploymentName: string) => AwsSetupContext;

package/lib/commonjs/platforms/aws/setup/awsSetupContext.js

@@ -0,0 +1,20 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.buildAwsSetupContext = void 0;
+const deploy_aws_1 = require("@qpqjs/deploy-aws");
+const discovery_1 = require("../../../lib/discovery");
+const qpqConfigs_1 = require("../../../lib/qpqConfigs");
+const buildAwsSetupContext = (appName, deploymentName) => {
+    const ctx = (0, deploy_aws_1.getQpqAppDeployContext)((0, discovery_1.getRoot)(), appName, deploymentName);
+    return {
+        appName,
+        environment: ctx.environment,
+        accountId: ctx.accountId,
+        region: ctx.region,
+        accountQpqConfig: (0, deploy_aws_1.getWorkspaceAccountQpqConfig)(ctx),
+        bootstrapQpqConfig: (0, deploy_aws_1.getWorkspaceBootstrapQpqConfig)(ctx),
+        serviceQpqConfigs: (0, discovery_1.getServiceNames)(appName).map((service) => (0, qpqConfigs_1.loadServiceQpqConfig)(appName, service)),
+    };
+};
+exports.buildAwsSetupContext = buildAwsSetupContext;
+//# sourceMappingURL=awsSetupContext.js.map

package/lib/commonjs/platforms/aws/setup/awsSetupContext.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"awsSetupContext.js","sourceRoot":"","sources":["../../../../../src/platforms/aws/setup/awsSetupContext.ts"],"names":[],"mappings":";;;AACA,kDAAyH;AAEzH,sDAAkE;AAClE,wDAA+D;AAaxD,MAAM,oBAAoB,GAAG,CAAC,OAAe,EAAE,cAAsB,EAAmB,EAAE;IAC/F,MAAM,GAAG,GAAG,IAAA,mCAAsB,EAAC,IAAA,mBAAO,GAAE,EAAE,OAAO,EAAE,cAAc,CAAC,CAAC;IAEvE,OAAO;QACL,OAAO;QACP,WAAW,EAAE,GAAG,CAAC,WAAW;QAC5B,SAAS,EAAE,GAAG,CAAC,SAAS;QACxB,MAAM,EAAE,GAAG,CAAC,MAAM;QAClB,gBAAgB,EAAE,IAAA,yCAA4B,EAAC,GAAG,CAAC;QACnD,kBAAkB,EAAE,IAAA,2CAA8B,EAAC,GAAG,CAAC;QACvD,iBAAiB,EAAE,IAAA,2BAAe,EAAC,OAAO,CAAC,CAAC,GAAG,CAAC,CAAC,OAAO,EAAE,EAAE,CAAC,IAAA,iCAAoB,EAAC,OAAO,EAAE,OAAO,CAAC,CAAC;KACrG,CAAC;AACJ,CAAC,CAAC;AAZW,QAAA,oBAAoB,wBAY/B","sourcesContent":["import { QPQConfig } from '@qpqjs/core';\nimport { getQpqAppDeployContext, getWorkspaceAccountQpqConfig, getWorkspaceBootstrapQpqConfig } from '@qpqjs/deploy-aws';\n\nimport { getRoot, getServiceNames } from '../../../lib/discovery';\nimport { loadServiceQpqConfig } from '../../../lib/qpqConfigs';\n\n/** Everything the AWS setup steps share: the target account/region and the app's configs. */\nexport type AwsSetupContext = {\n  appName: string;\n  environment: string;\n  accountId: string;\n  region: string;\n  accountQpqConfig: QPQConfig;\n  bootstrapQpqConfig: QPQConfig;\n  serviceQpqConfigs: QPQConfig[];\n};\n\nexport const buildAwsSetupContext = (appName: string, deploymentName: string): AwsSetupContext => {\n  const ctx = getQpqAppDeployContext(getRoot(), appName, deploymentName);\n\n  return {\n    appName,\n    environment: ctx.environment,\n    accountId: ctx.accountId,\n    region: ctx.region,\n    accountQpqConfig: getWorkspaceAccountQpqConfig(ctx),\n    bootstrapQpqConfig: getWorkspaceBootstrapQpqConfig(ctx),\n    serviceQpqConfigs: getServiceNames(appName).map((service) => loadServiceQpqConfig(appName, service)),\n  };\n};\n"]}

package/lib/commonjs/platforms/aws/setup/awsSetupSteps.d.ts

@@ -0,0 +1,8 @@
+import { SetupStep } from '../../../lib/setupStep';
+/**
+ * The AWS checklist, in the order it must run: prerequisites that only check, the CDK
+ * toolkit per region, then the app-wide stacks (the account stack creates the GitHub OIDC
+ * provider, the bootstrap stack the GitHub deploy role). Services are deployed separately
+ * with `qpq go` / `qpq go:docker`, which is where the time goes and where parallelism lives.
+ */
+export declare const awsSetupSteps: (appName: string, deploymentName: string) => Promise<SetupStep[]>;

package/lib/commonjs/platforms/aws/setup/awsSetupSteps.js

@@ -0,0 +1,44 @@
+"use strict";
+var __awaiter = (this && this.__awaiter) || function (thisArg, _arguments, P, generator) {
+    function adopt(value) { return value instanceof P ? value : new P(function (resolve) { resolve(value); }); }
+    return new (P || (P = Promise))(function (resolve, reject) {
+        function fulfilled(value) { try { step(generator.next(value)); } catch (e) { reject(e); } }
+        function rejected(value) { try { step(generator["throw"](value)); } catch (e) { reject(e); } }
+        function step(result) { result.done ? resolve(result.value) : adopt(result.value).then(fulfilled, rejected); }
+        step((generator = generator.apply(thisArg, _arguments || [])).next());
+    });
+};
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.awsSetupSteps = void 0;
+const awsSetupContext_1 = require("./awsSetupContext");
+const buildBucketNamesStep_1 = require("./buildBucketNamesStep");
+const buildCdkBootstrapSteps_1 = require("./buildCdkBootstrapSteps");
+const buildGithubDeployRoleStep_1 = require("./buildGithubDeployRoleStep");
+const buildGithubOidcProviderStep_1 = require("./buildGithubOidcProviderStep");
+const buildHostedZonesStep_1 = require("./buildHostedZonesStep");
+const buildIamCapabilityStep_1 = require("./buildIamCapabilityStep");
+const buildIdentityStep_1 = require("./buildIdentityStep");
+const buildStackSteps_1 = require("./buildStackSteps");
+/**
+ * The AWS checklist, in the order it must run: prerequisites that only check, the CDK
+ * toolkit per region, then the app-wide stacks (the account stack creates the GitHub OIDC
+ * provider, the bootstrap stack the GitHub deploy role). Services are deployed separately
+ * with `qpq go` / `qpq go:docker`, which is where the time goes and where parallelism lives.
+ */
+const awsSetupSteps = (appName, deploymentName) => __awaiter(void 0, void 0, void 0, function* () {
+    const ctx = (0, awsSetupContext_1.buildAwsSetupContext)(appName, deploymentName);
+    return [
+        (0, buildIdentityStep_1.buildIdentityStep)(ctx),
+        (0, buildIamCapabilityStep_1.buildIamCapabilityStep)(ctx),
+        (0, buildHostedZonesStep_1.buildHostedZonesStep)(ctx),
+        (0, buildBucketNamesStep_1.buildBucketNamesStep)(ctx),
+        ...(0, buildCdkBootstrapSteps_1.buildCdkBootstrapSteps)(ctx),
+        (0, buildStackSteps_1.buildAccountStackStep)(ctx),
+        (0, buildGithubOidcProviderStep_1.buildGithubOidcProviderStep)(ctx),
+        (0, buildStackSteps_1.buildDomainStackStep)(ctx),
+        (0, buildStackSteps_1.buildBootstrapStackStep)(ctx),
+        (0, buildGithubDeployRoleStep_1.buildGithubDeployRoleStep)(ctx),
+    ];
+});
+exports.awsSetupSteps = awsSetupSteps;
+//# sourceMappingURL=awsSetupSteps.js.map

package/lib/commonjs/platforms/aws/setup/awsSetupSteps.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"awsSetupSteps.js","sourceRoot":"","sources":["../../../../../src/platforms/aws/setup/awsSetupSteps.ts"],"names":[],"mappings":";;;;;;;;;;;;AACA,uDAAyD;AACzD,iEAA8D;AAC9D,qEAAkE;AAClE,2EAAwE;AACxE,+EAA4E;AAC5E,iEAA8D;AAC9D,qEAAkE;AAClE,2DAAwD;AACxD,uDAAyG;AAEzG;;;;;GAKG;AACI,MAAM,aAAa,GAAG,CAAO,OAAe,EAAE,cAAsB,EAAwB,EAAE;IACnG,MAAM,GAAG,GAAG,IAAA,sCAAoB,EAAC,OAAO,EAAE,cAAc,CAAC,CAAC;IAE1D,OAAO;QACL,IAAA,qCAAiB,EAAC,GAAG,CAAC;QACtB,IAAA,+CAAsB,EAAC,GAAG,CAAC;QAC3B,IAAA,2CAAoB,EAAC,GAAG,CAAC;QACzB,IAAA,2CAAoB,EAAC,GAAG,CAAC;QACzB,GAAG,IAAA,+CAAsB,EAAC,GAAG,CAAC;QAC9B,IAAA,uCAAqB,EAAC,GAAG,CAAC;QAC1B,IAAA,yDAA2B,EAAC,GAAG,CAAC;QAChC,IAAA,sCAAoB,EAAC,GAAG,CAAC;QACzB,IAAA,yCAAuB,EAAC,GAAG,CAAC;QAC5B,IAAA,qDAAyB,EAAC,GAAG,CAAC;KAC/B,CAAC;AACJ,CAAC,CAAA,CAAC;AAfW,QAAA,aAAa,iBAexB","sourcesContent":["import { SetupStep } from '../../../lib/setupStep';\nimport { buildAwsSetupContext } from './awsSetupContext';\nimport { buildBucketNamesStep } from './buildBucketNamesStep';\nimport { buildCdkBootstrapSteps } from './buildCdkBootstrapSteps';\nimport { buildGithubDeployRoleStep } from './buildGithubDeployRoleStep';\nimport { buildGithubOidcProviderStep } from './buildGithubOidcProviderStep';\nimport { buildHostedZonesStep } from './buildHostedZonesStep';\nimport { buildIamCapabilityStep } from './buildIamCapabilityStep';\nimport { buildIdentityStep } from './buildIdentityStep';\nimport { buildAccountStackStep, buildBootstrapStackStep, buildDomainStackStep } from './buildStackSteps';\n\n/**\n * The AWS checklist, in the order it must run: prerequisites that only check, the CDK\n * toolkit per region, then the app-wide stacks (the account stack creates the GitHub OIDC\n * provider, the bootstrap stack the GitHub deploy role). Services are deployed separately\n * with `qpq go` / `qpq go:docker`, which is where the time goes and where parallelism lives.\n */\nexport const awsSetupSteps = async (appName: string, deploymentName: string): Promise<SetupStep[]> => {\n  const ctx = buildAwsSetupContext(appName, deploymentName);\n\n  return [\n    buildIdentityStep(ctx),\n    buildIamCapabilityStep(ctx),\n    buildHostedZonesStep(ctx),\n    buildBucketNamesStep(ctx),\n    ...buildCdkBootstrapSteps(ctx),\n    buildAccountStackStep(ctx),\n    buildGithubOidcProviderStep(ctx),\n    buildDomainStackStep(ctx),\n    buildBootstrapStackStep(ctx),\n    buildGithubDeployRoleStep(ctx),\n  ];\n};\n"]}

package/lib/commonjs/platforms/aws/setup/buildBucketNamesStep.d.ts

@@ -0,0 +1,4 @@
+import { SetupStep } from '../../../lib/setupStep';
+import { AwsSetupContext } from './awsSetupContext';
+/** Check-only: no bucket the deploy will create is already taken by another AWS account. */
+export declare const buildBucketNamesStep: (ctx: AwsSetupContext) => SetupStep;

package/lib/commonjs/platforms/aws/setup/buildBucketNamesStep.js

@@ -0,0 +1,77 @@
+"use strict";
+var __awaiter = (this && this.__awaiter) || function (thisArg, _arguments, P, generator) {
+    function adopt(value) { return value instanceof P ? value : new P(function (resolve) { resolve(value); }); }
+    return new (P || (P = Promise))(function (resolve, reject) {
+        function fulfilled(value) { try { step(generator.next(value)); } catch (e) { reject(e); } }
+        function rejected(value) { try { step(generator["throw"](value)); } catch (e) { reject(e); } }
+        function step(result) { result.done ? resolve(result.value) : adopt(result.value).then(fulfilled, rejected); }
+        step((generator = generator.apply(thisArg, _arguments || [])).next());
+    });
+};
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.buildBucketNamesStep = void 0;
+const actionprocessor_aws_1 = require("@qpqjs/actionprocessor-aws");
+const core_1 = require("@qpqjs/core");
+const webserver_1 = require("@qpqjs/webserver");
+const client_s3_1 = require("@aws-sdk/client-s3");
+// Every bucket a service deploy creates, named the way the constructs name them.
+const getServiceBucketNames = (qpqConfig) => [
+    ...core_1.qpqCoreUtils
+        .getOwnedItems(core_1.qpqCoreUtils.getStorageDrives(qpqConfig), qpqConfig)
+        .map((drive) => actionprocessor_aws_1.awsNamingUtils.getConfigRuntimeResourceNameFromConfig(drive.storageDrive, qpqConfig)),
+    ...webserver_1.qpqWebServerUtils
+        .getWebEntryConfigs(qpqConfig)
+        .filter((webEntry) => !webEntry.storageDrive.sourceStorageDrive)
+        .map((webEntry) => actionprocessor_aws_1.awsNamingUtils.getQpqRuntimeResourceNameFromConfig(webEntry.name, qpqConfig, 'we')),
+];
+// HeadBucket: 404 means free, 200 ours, 403 exists in another account.
+const getBucketOwner = (client, bucketName) => __awaiter(void 0, void 0, void 0, function* () {
+    var _a;
+    try {
+        yield client.send(new client_s3_1.HeadBucketCommand({ Bucket: bucketName }));
+        return 'ours';
+    }
+    catch (error) {
+        const status = (_a = error.$metadata) === null || _a === void 0 ? void 0 : _a.httpStatusCode;
+        if (status === 404) {
+            return 'free';
+        }
+        if (status === 403 || status === 301) {
+            return 'other';
+        }
+        throw error;
+    }
+});
+// S3 bucket names are global and the framework names them from app, service and
+// environment alone, so a second account cannot reuse a name the first still holds.
+const checkBucketNames = (ctx) => __awaiter(void 0, void 0, void 0, function* () {
+    const names = [...new Set(ctx.serviceQpqConfigs.flatMap(getServiceBucketNames))];
+    const client = new client_s3_1.S3Client({ region: ctx.region });
+    const taken = [];
+    let ours = 0;
+    for (const name of names) {
+        const owner = yield getBucketOwner(client, name);
+        if (owner === 'other')
+            taken.push(name);
+        if (owner === 'ours')
+            ours += 1;
+    }
+    return taken.length === 0
+        ? { done: true, detail: `${names.length} bucket name(s) available or already ours (${ours} existing)` }
+        : { done: false, detail: `held by another account: ${taken.join(', ')}; delete them there or change the app prefix` };
+});
+/** Check-only: no bucket the deploy will create is already taken by another AWS account. */
+const buildBucketNamesStep = (ctx) => ({
+    id: 'bucket-names',
+    name: 'S3 bucket names available',
+    check: () => checkBucketNames(ctx),
+    run: () => __awaiter(void 0, void 0, void 0, function* () {
+        var _a;
+        const result = yield checkBucketNames(ctx);
+        if (!result.done) {
+            throw new Error((_a = result.detail) !== null && _a !== void 0 ? _a : 'bucket names taken');
+        }
+    }),
+});
+exports.buildBucketNamesStep = buildBucketNamesStep;
+//# sourceMappingURL=buildBucketNamesStep.js.map

package/lib/commonjs/platforms/aws/setup/buildBucketNamesStep.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"buildBucketNamesStep.js","sourceRoot":"","sources":["../../../../../src/platforms/aws/setup/buildBucketNamesStep.ts"],"names":[],"mappings":";;;;;;;;;;;;AAAA,oEAA4D;AAC5D,sCAAsD;AACtD,gDAAqD;AAErD,kDAAiE;AAKjE,iFAAiF;AACjF,MAAM,qBAAqB,GAAG,CAAC,SAAoB,EAAY,EAAE,CAAC;IAChE,GAAG,mBAAY;SACZ,aAAa,CAAC,mBAAY,CAAC,gBAAgB,CAAC,SAAS,CAAC,EAAE,SAAS,CAAC;SAClE,GAAG,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,oCAAc,CAAC,sCAAsC,CAAC,KAAK,CAAC,YAAY,EAAE,SAAS,CAAC,CAAC;IACvG,GAAG,6BAAiB;SACjB,kBAAkB,CAAC,SAAS,CAAC;SAC7B,MAAM,CAAC,CAAC,QAAQ,EAAE,EAAE,CAAC,CAAC,QAAQ,CAAC,YAAY,CAAC,kBAAkB,CAAC;SAC/D,GAAG,CAAC,CAAC,QAAQ,EAAE,EAAE,CAAC,oCAAc,CAAC,mCAAmC,CAAC,QAAQ,CAAC,IAAI,EAAE,SAAS,EAAE,IAAI,CAAC,CAAC;CACzG,CAAC;AAIF,uEAAuE;AACvE,MAAM,cAAc,GAAG,CAAO,MAAgB,EAAE,UAAkB,EAAwB,EAAE;;IAC1F,IAAI,CAAC;QACH,MAAM,MAAM,CAAC,IAAI,CAAC,IAAI,6BAAiB,CAAC,EAAE,MAAM,EAAE,UAAU,EAAE,CAAC,CAAC,CAAC;QACjE,OAAO,MAAM,CAAC;IAChB,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,MAAM,MAAM,GAAG,MAAC,KAAqD,CAAC,SAAS,0CAAE,cAAc,CAAC;QAChG,IAAI,MAAM,KAAK,GAAG,EAAE,CAAC;YACnB,OAAO,MAAM,CAAC;QAChB,CAAC;QACD,IAAI,MAAM,KAAK,GAAG,IAAI,MAAM,KAAK,GAAG,EAAE,CAAC;YACrC,OAAO,OAAO,CAAC;QACjB,CAAC;QACD,MAAM,KAAK,CAAC;IACd,CAAC;AACH,CAAC,CAAA,CAAC;AAEF,gFAAgF;AAChF,oFAAoF;AACpF,MAAM,gBAAgB,GAAG,CAAO,GAAoB,EAA6B,EAAE;IACjF,MAAM,KAAK,GAAG,CAAC,GAAG,IAAI,GAAG,CAAC,GAAG,CAAC,iBAAiB,CAAC,OAAO,CAAC,qBAAqB,CAAC,CAAC,CAAC,CAAC;IACjF,MAAM,MAAM,GAAG,IAAI,oBAAQ,CAAC,EAAE,MAAM,EAAE,GAAG,CAAC,MAAM,EAAE,CAAC,CAAC;IAEpD,MAAM,KAAK,GAAa,EAAE,CAAC;IAC3B,IAAI,IAAI,GAAG,CAAC,CAAC;IACb,KAAK,MAAM,IAAI,IAAI,KAAK,EAAE,CAAC;QACzB,MAAM,KAAK,GAAG,MAAM,cAAc,CAAC,MAAM,EAAE,IAAI,CAAC,CAAC;QACjD,IAAI,KAAK,KAAK,OAAO;YAAE,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;QACxC,IAAI,KAAK,KAAK,MAAM;YAAE,IAAI,IAAI,CAAC,CAAC;IAClC,CAAC;IAED,OAAO,KAAK,CAAC,MAAM,KAAK,CAAC;QACvB,CAAC,CAAC,EAAE,IAAI,EAAE,IAAI,EAAE,MAAM,EAAE,GAAG,KAAK,CAAC,MAAM,8CAA8C,IAAI,YAAY,EAAE;QACvG,CAAC,CAAC,EAAE,IAAI,EAAE,KAAK,EAAE,MAAM,EAAE,4BAA4B,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,8CAA8C,EAAE,CAAC;AAC1H,CAAC,CAAA,CAAC;AAEF,4FAA4F;AACrF,MAAM,oBAAoB,GAAG,CAAC,GAAoB,EAAa,EAAE,CAAC,CAAC;IACxE,EAAE,EAAE,cAAc;IAClB,IAAI,EAAE,2BAA2B;IACjC,KAAK,EAAE,GAAG,EAAE,CAAC,gBAAgB,CAAC,GAAG,CAAC;IAClC,GAAG,EAAE,GAAS,EAAE;;QACd,MAAM,MAAM,GAAG,MAAM,gBAAgB,CAAC,GAAG,CAAC,CAAC;QAC3C,IAAI,CAAC,MAAM,CAAC,IAAI,EAAE,CAAC;YACjB,MAAM,IAAI,KAAK,CAAC,MAAA,MAAM,CAAC,MAAM,mCAAI,oBAAoB,CAAC,CAAC;QACzD,CAAC;IACH,CAAC,CAAA;CACF,CAAC,CAAC;AAVU,QAAA,oBAAoB,wBAU9B","sourcesContent":["import { awsNamingUtils } from '@qpqjs/actionprocessor-aws';\nimport { QPQConfig, qpqCoreUtils } from '@qpqjs/core';\nimport { qpqWebServerUtils } from '@qpqjs/webserver';\n\nimport { HeadBucketCommand, S3Client } from '@aws-sdk/client-s3';\n\nimport { SetupCheckResult, SetupStep } from '../../../lib/setupStep';\nimport { AwsSetupContext } from './awsSetupContext';\n\n// Every bucket a service deploy creates, named the way the constructs name them.\nconst getServiceBucketNames = (qpqConfig: QPQConfig): string[] => [\n  ...qpqCoreUtils\n    .getOwnedItems(qpqCoreUtils.getStorageDrives(qpqConfig), qpqConfig)\n    .map((drive) => awsNamingUtils.getConfigRuntimeResourceNameFromConfig(drive.storageDrive, qpqConfig)),\n  ...qpqWebServerUtils\n    .getWebEntryConfigs(qpqConfig)\n    .filter((webEntry) => !webEntry.storageDrive.sourceStorageDrive)\n    .map((webEntry) => awsNamingUtils.getQpqRuntimeResourceNameFromConfig(webEntry.name, qpqConfig, 'we')),\n];\n\ntype BucketOwner = 'free' | 'ours' | 'other';\n\n// HeadBucket: 404 means free, 200 ours, 403 exists in another account.\nconst getBucketOwner = async (client: S3Client, bucketName: string): Promise<BucketOwner> => {\n  try {\n    await client.send(new HeadBucketCommand({ Bucket: bucketName }));\n    return 'ours';\n  } catch (error) {\n    const status = (error as { $metadata?: { httpStatusCode?: number } }).$metadata?.httpStatusCode;\n    if (status === 404) {\n      return 'free';\n    }\n    if (status === 403 || status === 301) {\n      return 'other';\n    }\n    throw error;\n  }\n};\n\n// S3 bucket names are global and the framework names them from app, service and\n// environment alone, so a second account cannot reuse a name the first still holds.\nconst checkBucketNames = async (ctx: AwsSetupContext): Promise<SetupCheckResult> => {\n  const names = [...new Set(ctx.serviceQpqConfigs.flatMap(getServiceBucketNames))];\n  const client = new S3Client({ region: ctx.region });\n\n  const taken: string[] = [];\n  let ours = 0;\n  for (const name of names) {\n    const owner = await getBucketOwner(client, name);\n    if (owner === 'other') taken.push(name);\n    if (owner === 'ours') ours += 1;\n  }\n\n  return taken.length === 0\n    ? { done: true, detail: `${names.length} bucket name(s) available or already ours (${ours} existing)` }\n    : { done: false, detail: `held by another account: ${taken.join(', ')}; delete them there or change the app prefix` };\n};\n\n/** Check-only: no bucket the deploy will create is already taken by another AWS account. */\nexport const buildBucketNamesStep = (ctx: AwsSetupContext): SetupStep => ({\n  id: 'bucket-names',\n  name: 'S3 bucket names available',\n  check: () => checkBucketNames(ctx),\n  run: async () => {\n    const result = await checkBucketNames(ctx);\n    if (!result.done) {\n      throw new Error(result.detail ?? 'bucket names taken');\n    }\n  },\n});\n"]}

package/lib/commonjs/platforms/aws/setup/buildCdkBootstrapSteps.d.ts

@@ -0,0 +1,5 @@
+import { SetupStep } from '../../../lib/setupStep';
+import { AwsSetupContext } from './awsSetupContext';
+/** Every region the app deploys into: the deploy region plus each certificate region (us-east-1 for CloudFront). */
+export declare const getSetupRegions: (ctx: AwsSetupContext) => string[];
+export declare const buildCdkBootstrapSteps: (ctx: AwsSetupContext) => SetupStep[];

package/lib/commonjs/platforms/aws/setup/buildCdkBootstrapSteps.js

@@ -0,0 +1,38 @@
+"use strict";
+var __awaiter = (this && this.__awaiter) || function (thisArg, _arguments, P, generator) {
+    function adopt(value) { return value instanceof P ? value : new P(function (resolve) { resolve(value); }); }
+    return new (P || (P = Promise))(function (resolve, reject) {
+        function fulfilled(value) { try { step(generator.next(value)); } catch (e) { reject(e); } }
+        function rejected(value) { try { step(generator["throw"](value)); } catch (e) { reject(e); } }
+        function step(result) { result.done ? resolve(result.value) : adopt(result.value).then(fulfilled, rejected); }
+        step((generator = generator.apply(thisArg, _arguments || [])).next());
+    });
+};
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.buildCdkBootstrapSteps = exports.getSetupRegions = void 0;
+const config_aws_1 = require("@qpqjs/config-aws");
+const discovery_1 = require("../../../lib/discovery");
+const runCommand_1 = require("../../../lib/runCommand");
+const describeStackStatus_1 = require("./describeStackStatus");
+/** Every region the app deploys into: the deploy region plus each certificate region (us-east-1 for CloudFront). */
+const getSetupRegions = (ctx) => [
+    ...new Set([ctx.region, ...config_aws_1.qpqConfigAwsUtils.getDomainCertificateConfigs(ctx.bootstrapQpqConfig).map((cert) => cert.region)]),
+];
+exports.getSetupRegions = getSetupRegions;
+const buildCdkBootstrapStep = (ctx, region) => ({
+    id: `cdk-bootstrap-${region}`,
+    name: `CDK bootstrap ${region}`,
+    check: () => __awaiter(void 0, void 0, void 0, function* () {
+        const status = yield (0, describeStackStatus_1.describeStackStatus)('CDKToolkit', region);
+        if (status === null) {
+            return { done: false, detail: 'no CDKToolkit stack' };
+        }
+        return (0, describeStackStatus_1.isStackHealthy)(status)
+            ? { done: true, detail: `CDKToolkit ${status}` }
+            : { done: false, detail: `CDKToolkit is ${status}; delete the stack in ${region} before retrying` };
+    }),
+    run: () => (0, runCommand_1.runCommand)('npx', ['cdk', 'bootstrap', `aws://${ctx.accountId}/${region}`], { cwd: (0, discovery_1.getRoot)() }),
+});
+const buildCdkBootstrapSteps = (ctx) => (0, exports.getSetupRegions)(ctx).map((region) => buildCdkBootstrapStep(ctx, region));
+exports.buildCdkBootstrapSteps = buildCdkBootstrapSteps;
+//# sourceMappingURL=buildCdkBootstrapSteps.js.map

package/lib/commonjs/platforms/aws/setup/buildCdkBootstrapSteps.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"buildCdkBootstrapSteps.js","sourceRoot":"","sources":["../../../../../src/platforms/aws/setup/buildCdkBootstrapSteps.ts"],"names":[],"mappings":";;;;;;;;;;;;AAAA,kDAAsD;AAEtD,sDAAiD;AACjD,wDAAqD;AAGrD,+DAA4E;AAE5E,oHAAoH;AAC7G,MAAM,eAAe,GAAG,CAAC,GAAoB,EAAY,EAAE,CAAC;IACjE,GAAG,IAAI,GAAG,CAAC,CAAC,GAAG,CAAC,MAAM,EAAE,GAAG,8BAAiB,CAAC,2BAA2B,CAAC,GAAG,CAAC,kBAAkB,CAAC,CAAC,GAAG,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC,CAAC;CAC9H,CAAC;AAFW,QAAA,eAAe,mBAE1B;AAEF,MAAM,qBAAqB,GAAG,CAAC,GAAoB,EAAE,MAAc,EAAa,EAAE,CAAC,CAAC;IAClF,EAAE,EAAE,iBAAiB,MAAM,EAAE;IAC7B,IAAI,EAAE,iBAAiB,MAAM,EAAE;IAC/B,KAAK,EAAE,GAAS,EAAE;QAChB,MAAM,MAAM,GAAG,MAAM,IAAA,yCAAmB,EAAC,YAAY,EAAE,MAAM,CAAC,CAAC;QAC/D,IAAI,MAAM,KAAK,IAAI,EAAE,CAAC;YACpB,OAAO,EAAE,IAAI,EAAE,KAAK,EAAE,MAAM,EAAE,qBAAqB,EAAE,CAAC;QACxD,CAAC;QACD,OAAO,IAAA,oCAAc,EAAC,MAAM,CAAC;YAC3B,CAAC,CAAC,EAAE,IAAI,EAAE,IAAI,EAAE,MAAM,EAAE,cAAc,MAAM,EAAE,EAAE;YAChD,CAAC,CAAC,EAAE,IAAI,EAAE,KAAK,EAAE,MAAM,EAAE,iBAAiB,MAAM,yBAAyB,MAAM,kBAAkB,EAAE,CAAC;IACxG,CAAC,CAAA;IACD,GAAG,EAAE,GAAG,EAAE,CAAC,IAAA,uBAAU,EAAC,KAAK,EAAE,CAAC,KAAK,EAAE,WAAW,EAAE,SAAS,GAAG,CAAC,SAAS,IAAI,MAAM,EAAE,CAAC,EAAE,EAAE,GAAG,EAAE,IAAA,mBAAO,GAAE,EAAE,CAAC;CAC3G,CAAC,CAAC;AAEI,MAAM,sBAAsB,GAAG,CAAC,GAAoB,EAAe,EAAE,CAAC,IAAA,uBAAe,EAAC,GAAG,CAAC,CAAC,GAAG,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC,qBAAqB,CAAC,GAAG,EAAE,MAAM,CAAC,CAAC,CAAC;AAAzI,QAAA,sBAAsB,0BAAmH","sourcesContent":["import { qpqConfigAwsUtils } from '@qpqjs/config-aws';\n\nimport { getRoot } from '../../../lib/discovery';\nimport { runCommand } from '../../../lib/runCommand';\nimport { SetupStep } from '../../../lib/setupStep';\nimport { AwsSetupContext } from './awsSetupContext';\nimport { describeStackStatus, isStackHealthy } from './describeStackStatus';\n\n/** Every region the app deploys into: the deploy region plus each certificate region (us-east-1 for CloudFront). */\nexport const getSetupRegions = (ctx: AwsSetupContext): string[] => [\n  ...new Set([ctx.region, ...qpqConfigAwsUtils.getDomainCertificateConfigs(ctx.bootstrapQpqConfig).map((cert) => cert.region)]),\n];\n\nconst buildCdkBootstrapStep = (ctx: AwsSetupContext, region: string): SetupStep => ({\n  id: `cdk-bootstrap-${region}`,\n  name: `CDK bootstrap ${region}`,\n  check: async () => {\n    const status = await describeStackStatus('CDKToolkit', region);\n    if (status === null) {\n      return { done: false, detail: 'no CDKToolkit stack' };\n    }\n    return isStackHealthy(status)\n      ? { done: true, detail: `CDKToolkit ${status}` }\n      : { done: false, detail: `CDKToolkit is ${status}; delete the stack in ${region} before retrying` };\n  },\n  run: () => runCommand('npx', ['cdk', 'bootstrap', `aws://${ctx.accountId}/${region}`], { cwd: getRoot() }),\n});\n\nexport const buildCdkBootstrapSteps = (ctx: AwsSetupContext): SetupStep[] => getSetupRegions(ctx).map((region) => buildCdkBootstrapStep(ctx, region));\n"]}

package/lib/commonjs/platforms/aws/setup/buildGithubDeployRoleStep.d.ts

@@ -0,0 +1,4 @@
+import { SetupStep } from '../../../lib/setupStep';
+import { AwsSetupContext } from './awsSetupContext';
+/** Check-only: the GitHub Actions deploy role is declared and deployed, with the values the GitHub Environment needs. */
+export declare const buildGithubDeployRoleStep: (ctx: AwsSetupContext) => SetupStep;