@qpqjs/cli 0.0.0-stage → 0.2.1

package/lib/commonjs/platforms/aws/setup/buildGithubDeployRoleStep.js

@@ -0,0 +1,55 @@
+"use strict";
+var __awaiter = (this && this.__awaiter) || function (thisArg, _arguments, P, generator) {
+    function adopt(value) { return value instanceof P ? value : new P(function (resolve) { resolve(value); }); }
+    return new (P || (P = Promise))(function (resolve, reject) {
+        function fulfilled(value) { try { step(generator.next(value)); } catch (e) { reject(e); } }
+        function rejected(value) { try { step(generator["throw"](value)); } catch (e) { reject(e); } }
+        function step(result) { result.done ? resolve(result.value) : adopt(result.value).then(fulfilled, rejected); }
+        step((generator = generator.apply(thisArg, _arguments || [])).next());
+    });
+};
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.buildGithubDeployRoleStep = void 0;
+const actionprocessor_aws_1 = require("@qpqjs/actionprocessor-aws");
+const config_aws_1 = require("@qpqjs/config-aws");
+const client_iam_1 = require("@aws-sdk/client-iam");
+// The role itself is deployed by the bootstrap stack; this step tells you whether the config
+// declares it, whether it exists yet, and what to put in the GitHub Environment once it does.
+const checkDeployRole = (ctx) => __awaiter(void 0, void 0, void 0, function* () {
+    var _a;
+    const config = config_aws_1.qpqConfigAwsUtils.getAwsGithubDeployRoleConfig(ctx.bootstrapQpqConfig);
+    if (!config) {
+        return { done: false, detail: 'not declared: add defineAwsGithubDeployRole("owner/repo", { ownerId, repositoryId }) to bootstrap.qpq.ts' };
+    }
+    const roleName = actionprocessor_aws_1.awsNamingUtils.getGithubDeployRoleNameFromConfig(ctx.bootstrapQpqConfig);
+    const githubEnvironment = (_a = config.githubEnvironment) !== null && _a !== void 0 ? _a : ctx.environment;
+    try {
+        const { Role } = yield new client_iam_1.IAMClient({ region: ctx.region }).send(new client_iam_1.GetRoleCommand({ RoleName: roleName }));
+        return {
+            done: true,
+            detail: `${Role === null || Role === void 0 ? void 0 : Role.Arn}; GitHub Environment '${githubEnvironment}' needs DEPLOY_ROLE_ARN=<that arn> and AWS_REGION=${ctx.region}`,
+        };
+    }
+    catch (error) {
+        if (error instanceof Error && error.name === 'NoSuchEntityException') {
+            return { done: false, detail: `${roleName} not deployed yet (the bootstrap stack creates it)` };
+        }
+        throw error;
+    }
+});
+/** Check-only: the GitHub Actions deploy role is declared and deployed, with the values the GitHub Environment needs. */
+const buildGithubDeployRoleStep = (ctx) => ({
+    id: 'github-deploy-role',
+    name: 'GitHub Actions deploy role',
+    check: () => checkDeployRole(ctx),
+    run: () => __awaiter(void 0, void 0, void 0, function* () {
+        var _a;
+        const result = yield checkDeployRole(ctx);
+        if (!result.done) {
+            throw new Error((_a = result.detail) !== null && _a !== void 0 ? _a : 'deploy role missing');
+        }
+        console.log(result.detail);
+    }),
+});
+exports.buildGithubDeployRoleStep = buildGithubDeployRoleStep;
+//# sourceMappingURL=buildGithubDeployRoleStep.js.map

package/lib/commonjs/platforms/aws/setup/buildGithubDeployRoleStep.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"buildGithubDeployRoleStep.js","sourceRoot":"","sources":["../../../../../src/platforms/aws/setup/buildGithubDeployRoleStep.ts"],"names":[],"mappings":";;;;;;;;;;;;AAAA,oEAA4D;AAC5D,kDAAsD;AAEtD,oDAAgE;AAKhE,6FAA6F;AAC7F,8FAA8F;AAC9F,MAAM,eAAe,GAAG,CAAO,GAAoB,EAA6B,EAAE;;IAChF,MAAM,MAAM,GAAG,8BAAiB,CAAC,4BAA4B,CAAC,GAAG,CAAC,kBAAkB,CAAC,CAAC;IACtF,IAAI,CAAC,MAAM,EAAE,CAAC;QACZ,OAAO,EAAE,IAAI,EAAE,KAAK,EAAE,MAAM,EAAE,0GAA0G,EAAE,CAAC;IAC7I,CAAC;IAED,MAAM,QAAQ,GAAG,oCAAc,CAAC,iCAAiC,CAAC,GAAG,CAAC,kBAAkB,CAAC,CAAC;IAC1F,MAAM,iBAAiB,GAAG,MAAA,MAAM,CAAC,iBAAiB,mCAAI,GAAG,CAAC,WAAW,CAAC;IACtE,IAAI,CAAC;QACH,MAAM,EAAE,IAAI,EAAE,GAAG,MAAM,IAAI,sBAAS,CAAC,EAAE,MAAM,EAAE,GAAG,CAAC,MAAM,EAAE,CAAC,CAAC,IAAI,CAAC,IAAI,2BAAc,CAAC,EAAE,QAAQ,EAAE,QAAQ,EAAE,CAAC,CAAC,CAAC;QAC9G,OAAO;YACL,IAAI,EAAE,IAAI;YACV,MAAM,EAAE,GAAG,IAAI,aAAJ,IAAI,uBAAJ,IAAI,CAAE,GAAG,yBAAyB,iBAAiB,qDAAqD,GAAG,CAAC,MAAM,EAAE;SAChI,CAAC;IACJ,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,IAAI,KAAK,YAAY,KAAK,IAAI,KAAK,CAAC,IAAI,KAAK,uBAAuB,EAAE,CAAC;YACrE,OAAO,EAAE,IAAI,EAAE,KAAK,EAAE,MAAM,EAAE,GAAG,QAAQ,oDAAoD,EAAE,CAAC;QAClG,CAAC;QACD,MAAM,KAAK,CAAC;IACd,CAAC;AACH,CAAC,CAAA,CAAC;AAEF,yHAAyH;AAClH,MAAM,yBAAyB,GAAG,CAAC,GAAoB,EAAa,EAAE,CAAC,CAAC;IAC7E,EAAE,EAAE,oBAAoB;IACxB,IAAI,EAAE,4BAA4B;IAClC,KAAK,EAAE,GAAG,EAAE,CAAC,eAAe,CAAC,GAAG,CAAC;IACjC,GAAG,EAAE,GAAS,EAAE;;QACd,MAAM,MAAM,GAAG,MAAM,eAAe,CAAC,GAAG,CAAC,CAAC;QAC1C,IAAI,CAAC,MAAM,CAAC,IAAI,EAAE,CAAC;YACjB,MAAM,IAAI,KAAK,CAAC,MAAA,MAAM,CAAC,MAAM,mCAAI,qBAAqB,CAAC,CAAC;QAC1D,CAAC;QACD,OAAO,CAAC,GAAG,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC;IAC7B,CAAC,CAAA;CACF,CAAC,CAAC;AAXU,QAAA,yBAAyB,6BAWnC","sourcesContent":["import { awsNamingUtils } from '@qpqjs/actionprocessor-aws';\nimport { qpqConfigAwsUtils } from '@qpqjs/config-aws';\n\nimport { GetRoleCommand, IAMClient } from '@aws-sdk/client-iam';\n\nimport { SetupCheckResult, SetupStep } from '../../../lib/setupStep';\nimport { AwsSetupContext } from './awsSetupContext';\n\n// The role itself is deployed by the bootstrap stack; this step tells you whether the config\n// declares it, whether it exists yet, and what to put in the GitHub Environment once it does.\nconst checkDeployRole = async (ctx: AwsSetupContext): Promise<SetupCheckResult> => {\n  const config = qpqConfigAwsUtils.getAwsGithubDeployRoleConfig(ctx.bootstrapQpqConfig);\n  if (!config) {\n    return { done: false, detail: 'not declared: add defineAwsGithubDeployRole(\"owner/repo\", { ownerId, repositoryId }) to bootstrap.qpq.ts' };\n  }\n\n  const roleName = awsNamingUtils.getGithubDeployRoleNameFromConfig(ctx.bootstrapQpqConfig);\n  const githubEnvironment = config.githubEnvironment ?? ctx.environment;\n  try {\n    const { Role } = await new IAMClient({ region: ctx.region }).send(new GetRoleCommand({ RoleName: roleName }));\n    return {\n      done: true,\n      detail: `${Role?.Arn}; GitHub Environment '${githubEnvironment}' needs DEPLOY_ROLE_ARN=<that arn> and AWS_REGION=${ctx.region}`,\n    };\n  } catch (error) {\n    if (error instanceof Error && error.name === 'NoSuchEntityException') {\n      return { done: false, detail: `${roleName} not deployed yet (the bootstrap stack creates it)` };\n    }\n    throw error;\n  }\n};\n\n/** Check-only: the GitHub Actions deploy role is declared and deployed, with the values the GitHub Environment needs. */\nexport const buildGithubDeployRoleStep = (ctx: AwsSetupContext): SetupStep => ({\n  id: 'github-deploy-role',\n  name: 'GitHub Actions deploy role',\n  check: () => checkDeployRole(ctx),\n  run: async () => {\n    const result = await checkDeployRole(ctx);\n    if (!result.done) {\n      throw new Error(result.detail ?? 'deploy role missing');\n    }\n    console.log(result.detail);\n  },\n});\n"]}

package/lib/commonjs/platforms/aws/setup/buildGithubOidcProviderStep.d.ts

@@ -0,0 +1,4 @@
+import { SetupStep } from '../../../lib/setupStep';
+import { AwsSetupContext } from './awsSetupContext';
+/** Check-only: the account's GitHub Actions OIDC provider is declared in account.qpq.ts and deployed. */
+export declare const buildGithubOidcProviderStep: (ctx: AwsSetupContext) => SetupStep;

package/lib/commonjs/platforms/aws/setup/buildGithubOidcProviderStep.js

@@ -0,0 +1,54 @@
+"use strict";
+var __awaiter = (this && this.__awaiter) || function (thisArg, _arguments, P, generator) {
+    function adopt(value) { return value instanceof P ? value : new P(function (resolve) { resolve(value); }); }
+    return new (P || (P = Promise))(function (resolve, reject) {
+        function fulfilled(value) { try { step(generator.next(value)); } catch (e) { reject(e); } }
+        function rejected(value) { try { step(generator["throw"](value)); } catch (e) { reject(e); } }
+        function step(result) { result.done ? resolve(result.value) : adopt(result.value).then(fulfilled, rejected); }
+        step((generator = generator.apply(thisArg, _arguments || [])).next());
+    });
+};
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.buildGithubOidcProviderStep = void 0;
+const config_aws_1 = require("@qpqjs/config-aws");
+const client_iam_1 = require("@aws-sdk/client-iam");
+// The provider is created by the account stack (defineAccountGithubOidcProvider in
+// account.qpq.ts), so this only reports: declared or not, present or not.
+const checkProvider = (ctx) => __awaiter(void 0, void 0, void 0, function* () {
+    const declared = config_aws_1.qpqConfigAwsUtils.isAccountGithubOidcProviderDeclared(ctx.accountQpqConfig);
+    const arn = config_aws_1.qpqConfigAwsUtils.getGithubOidcProviderArn(ctx.accountId);
+    let exists = false;
+    try {
+        yield new client_iam_1.IAMClient({ region: ctx.region }).send(new client_iam_1.GetOpenIDConnectProviderCommand({ OpenIDConnectProviderArn: arn }));
+        exists = true;
+    }
+    catch (error) {
+        if (!(error instanceof Error && error.name === 'NoSuchEntityException')) {
+            throw error;
+        }
+    }
+    if (!declared) {
+        return {
+            done: false,
+            detail: exists
+                ? `${arn} exists but account.qpq.ts does not declare it: add defineAccountGithubOidcProvider() and delete the hand-made provider before deploying the account stack`
+                : 'not declared: add defineAccountGithubOidcProvider() to account.qpq.ts (the account stack creates it)',
+        };
+    }
+    return exists ? { done: true, detail: arn } : { done: false, detail: 'declared, not deployed yet (the account stack creates it)' };
+});
+/** Check-only: the account's GitHub Actions OIDC provider is declared in account.qpq.ts and deployed. */
+const buildGithubOidcProviderStep = (ctx) => ({
+    id: 'github-oidc-provider',
+    name: 'GitHub Actions OIDC provider',
+    check: () => checkProvider(ctx),
+    run: () => __awaiter(void 0, void 0, void 0, function* () {
+        var _a;
+        const result = yield checkProvider(ctx);
+        if (!result.done) {
+            throw new Error((_a = result.detail) !== null && _a !== void 0 ? _a : 'provider missing');
+        }
+    }),
+});
+exports.buildGithubOidcProviderStep = buildGithubOidcProviderStep;
+//# sourceMappingURL=buildGithubOidcProviderStep.js.map

package/lib/commonjs/platforms/aws/setup/buildGithubOidcProviderStep.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"buildGithubOidcProviderStep.js","sourceRoot":"","sources":["../../../../../src/platforms/aws/setup/buildGithubOidcProviderStep.ts"],"names":[],"mappings":";;;;;;;;;;;;AAAA,kDAAsD;AAEtD,oDAAiF;AAKjF,mFAAmF;AACnF,0EAA0E;AAC1E,MAAM,aAAa,GAAG,CAAO,GAAoB,EAA6B,EAAE;IAC9E,MAAM,QAAQ,GAAG,8BAAiB,CAAC,mCAAmC,CAAC,GAAG,CAAC,gBAAgB,CAAC,CAAC;IAC7F,MAAM,GAAG,GAAG,8BAAiB,CAAC,wBAAwB,CAAC,GAAG,CAAC,SAAS,CAAC,CAAC;IAEtE,IAAI,MAAM,GAAG,KAAK,CAAC;IACnB,IAAI,CAAC;QACH,MAAM,IAAI,sBAAS,CAAC,EAAE,MAAM,EAAE,GAAG,CAAC,MAAM,EAAE,CAAC,CAAC,IAAI,CAAC,IAAI,4CAA+B,CAAC,EAAE,wBAAwB,EAAE,GAAG,EAAE,CAAC,CAAC,CAAC;QACzH,MAAM,GAAG,IAAI,CAAC;IAChB,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,IAAI,CAAC,CAAC,KAAK,YAAY,KAAK,IAAI,KAAK,CAAC,IAAI,KAAK,uBAAuB,CAAC,EAAE,CAAC;YACxE,MAAM,KAAK,CAAC;QACd,CAAC;IACH,CAAC;IAED,IAAI,CAAC,QAAQ,EAAE,CAAC;QACd,OAAO;YACL,IAAI,EAAE,KAAK;YACX,MAAM,EAAE,MAAM;gBACZ,CAAC,CAAC,GAAG,GAAG,4JAA4J;gBACpK,CAAC,CAAC,sGAAsG;SAC3G,CAAC;IACJ,CAAC;IAED,OAAO,MAAM,CAAC,CAAC,CAAC,EAAE,IAAI,EAAE,IAAI,EAAE,MAAM,EAAE,GAAG,EAAE,CAAC,CAAC,CAAC,EAAE,IAAI,EAAE,KAAK,EAAE,MAAM,EAAE,2DAA2D,EAAE,CAAC;AACrI,CAAC,CAAA,CAAC;AAEF,yGAAyG;AAClG,MAAM,2BAA2B,GAAG,CAAC,GAAoB,EAAa,EAAE,CAAC,CAAC;IAC/E,EAAE,EAAE,sBAAsB;IAC1B,IAAI,EAAE,8BAA8B;IACpC,KAAK,EAAE,GAAG,EAAE,CAAC,aAAa,CAAC,GAAG,CAAC;IAC/B,GAAG,EAAE,GAAS,EAAE;;QACd,MAAM,MAAM,GAAG,MAAM,aAAa,CAAC,GAAG,CAAC,CAAC;QACxC,IAAI,CAAC,MAAM,CAAC,IAAI,EAAE,CAAC;YACjB,MAAM,IAAI,KAAK,CAAC,MAAA,MAAM,CAAC,MAAM,mCAAI,kBAAkB,CAAC,CAAC;QACvD,CAAC;IACH,CAAC,CAAA;CACF,CAAC,CAAC;AAVU,QAAA,2BAA2B,+BAUrC","sourcesContent":["import { qpqConfigAwsUtils } from '@qpqjs/config-aws';\n\nimport { GetOpenIDConnectProviderCommand, IAMClient } from '@aws-sdk/client-iam';\n\nimport { SetupCheckResult, SetupStep } from '../../../lib/setupStep';\nimport { AwsSetupContext } from './awsSetupContext';\n\n// The provider is created by the account stack (defineAccountGithubOidcProvider in\n// account.qpq.ts), so this only reports: declared or not, present or not.\nconst checkProvider = async (ctx: AwsSetupContext): Promise<SetupCheckResult> => {\n  const declared = qpqConfigAwsUtils.isAccountGithubOidcProviderDeclared(ctx.accountQpqConfig);\n  const arn = qpqConfigAwsUtils.getGithubOidcProviderArn(ctx.accountId);\n\n  let exists = false;\n  try {\n    await new IAMClient({ region: ctx.region }).send(new GetOpenIDConnectProviderCommand({ OpenIDConnectProviderArn: arn }));\n    exists = true;\n  } catch (error) {\n    if (!(error instanceof Error && error.name === 'NoSuchEntityException')) {\n      throw error;\n    }\n  }\n\n  if (!declared) {\n    return {\n      done: false,\n      detail: exists\n        ? `${arn} exists but account.qpq.ts does not declare it: add defineAccountGithubOidcProvider() and delete the hand-made provider before deploying the account stack`\n        : 'not declared: add defineAccountGithubOidcProvider() to account.qpq.ts (the account stack creates it)',\n    };\n  }\n\n  return exists ? { done: true, detail: arn } : { done: false, detail: 'declared, not deployed yet (the account stack creates it)' };\n};\n\n/** Check-only: the account's GitHub Actions OIDC provider is declared in account.qpq.ts and deployed. */\nexport const buildGithubOidcProviderStep = (ctx: AwsSetupContext): SetupStep => ({\n  id: 'github-oidc-provider',\n  name: 'GitHub Actions OIDC provider',\n  check: () => checkProvider(ctx),\n  run: async () => {\n    const result = await checkProvider(ctx);\n    if (!result.done) {\n      throw new Error(result.detail ?? 'provider missing');\n    }\n  },\n});\n"]}

package/lib/commonjs/platforms/aws/setup/buildHostedZonesStep.d.ts

@@ -0,0 +1,4 @@
+import { SetupStep } from '../../../lib/setupStep';
+import { AwsSetupContext } from './awsSetupContext';
+/** Check-only: the Route53 zones the deploy will write records into exist in this account. */
+export declare const buildHostedZonesStep: (ctx: AwsSetupContext) => SetupStep;

package/lib/commonjs/platforms/aws/setup/buildHostedZonesStep.js

@@ -0,0 +1,63 @@
+"use strict";
+var __awaiter = (this && this.__awaiter) || function (thisArg, _arguments, P, generator) {
+    function adopt(value) { return value instanceof P ? value : new P(function (resolve) { resolve(value); }); }
+    return new (P || (P = Promise))(function (resolve, reject) {
+        function fulfilled(value) { try { step(generator.next(value)); } catch (e) { reject(e); } }
+        function rejected(value) { try { step(generator["throw"](value)); } catch (e) { reject(e); } }
+        function step(result) { result.done ? resolve(result.value) : adopt(result.value).then(fulfilled, rejected); }
+        step((generator = generator.apply(thisArg, _arguments || [])).next());
+    });
+};
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.buildHostedZonesStep = void 0;
+const deploy_aws_1 = require("@qpqjs/deploy-aws");
+const webserver_1 = require("@qpqjs/webserver");
+const client_route_53_1 = require("@aws-sdk/client-route-53");
+// The zones the environment writes records into: one per root, chosen the way the
+// CDK chooses them (each root's site root under the app's resolver, or the root).
+const getRequiredZones = (ctx) => {
+    const config = ctx.bootstrapQpqConfig;
+    return [
+        ...new Set(webserver_1.qpqWebServerUtils
+            .getRootDomains(config)
+            .map((rootDomain) => deploy_aws_1.qpqDeployAwsUtils.resolveHostedZoneForHost(config, deploy_aws_1.qpqDeployAwsUtils.resolveDeployHostForRoot(config, rootDomain, {})))),
+    ];
+};
+const zoneExists = (client, zoneName) => __awaiter(void 0, void 0, void 0, function* () {
+    const { HostedZones } = yield client.send(new client_route_53_1.ListHostedZonesByNameCommand({ DNSName: zoneName, MaxItems: 1 }));
+    return (HostedZones !== null && HostedZones !== void 0 ? HostedZones : []).some((zone) => { var _a; return zone.Name === `${zoneName}.` && !((_a = zone.Config) === null || _a === void 0 ? void 0 : _a.PrivateZone); });
+});
+const checkHostedZones = (ctx) => __awaiter(void 0, void 0, void 0, function* () {
+    const required = getRequiredZones(ctx);
+    if (required.length === 0) {
+        return { done: true, detail: 'no domains declared' };
+    }
+    const client = new client_route_53_1.Route53Client({ region: ctx.region });
+    const missing = [];
+    for (const zoneName of required) {
+        if (!(yield zoneExists(client, zoneName))) {
+            missing.push(zoneName);
+        }
+    }
+    return missing.length === 0
+        ? { done: true, detail: required.join(', ') }
+        : {
+            done: false,
+            detail: `missing ${missing.join(', ')}: create each as a public hosted zone here and delegate it (NS record) from its parent zone`,
+        };
+});
+/** Check-only: the Route53 zones the deploy will write records into exist in this account. */
+const buildHostedZonesStep = (ctx) => ({
+    id: 'hosted-zones',
+    name: 'Route53 hosted zones',
+    check: () => checkHostedZones(ctx),
+    run: () => __awaiter(void 0, void 0, void 0, function* () {
+        var _a;
+        const result = yield checkHostedZones(ctx);
+        if (!result.done) {
+            throw new Error((_a = result.detail) !== null && _a !== void 0 ? _a : 'hosted zones missing');
+        }
+    }),
+});
+exports.buildHostedZonesStep = buildHostedZonesStep;
+//# sourceMappingURL=buildHostedZonesStep.js.map

package/lib/commonjs/platforms/aws/setup/buildHostedZonesStep.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"buildHostedZonesStep.js","sourceRoot":"","sources":["../../../../../src/platforms/aws/setup/buildHostedZonesStep.ts"],"names":[],"mappings":";;;;;;;;;;;;AAAA,kDAAsD;AACtD,gDAAqD;AAErD,8DAAuF;AAKvF,kFAAkF;AAClF,kFAAkF;AAClF,MAAM,gBAAgB,GAAG,CAAC,GAAoB,EAAY,EAAE;IAC1D,MAAM,MAAM,GAAG,GAAG,CAAC,kBAAkB,CAAC;IACtC,OAAO;QACL,GAAG,IAAI,GAAG,CACR,6BAAiB;aACd,cAAc,CAAC,MAAM,CAAC;aACtB,GAAG,CAAC,CAAC,UAAU,EAAE,EAAE,CAAC,8BAAiB,CAAC,wBAAwB,CAAC,MAAM,EAAE,8BAAiB,CAAC,wBAAwB,CAAC,MAAM,EAAE,UAAU,EAAE,EAAE,CAAC,CAAC,CAAC,CAC/I;KACF,CAAC;AACJ,CAAC,CAAC;AAEF,MAAM,UAAU,GAAG,CAAO,MAAqB,EAAE,QAAgB,EAAoB,EAAE;IACrF,MAAM,EAAE,WAAW,EAAE,GAAG,MAAM,MAAM,CAAC,IAAI,CAAC,IAAI,8CAA4B,CAAC,EAAE,OAAO,EAAE,QAAQ,EAAE,QAAQ,EAAE,CAAC,EAAE,CAAC,CAAC,CAAC;IAChH,OAAO,CAAC,WAAW,aAAX,WAAW,cAAX,WAAW,GAAI,EAAE,CAAC,CAAC,IAAI,CAAC,CAAC,IAAI,EAAE,EAAE,WAAC,OAAA,IAAI,CAAC,IAAI,KAAK,GAAG,QAAQ,GAAG,IAAI,CAAC,CAAA,MAAA,IAAI,CAAC,MAAM,0CAAE,WAAW,CAAA,CAAA,EAAA,CAAC,CAAC;AACvG,CAAC,CAAA,CAAC;AAEF,MAAM,gBAAgB,GAAG,CAAO,GAAoB,EAA6B,EAAE;IACjF,MAAM,QAAQ,GAAG,gBAAgB,CAAC,GAAG,CAAC,CAAC;IACvC,IAAI,QAAQ,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QAC1B,OAAO,EAAE,IAAI,EAAE,IAAI,EAAE,MAAM,EAAE,qBAAqB,EAAE,CAAC;IACvD,CAAC;IAED,MAAM,MAAM,GAAG,IAAI,+BAAa,CAAC,EAAE,MAAM,EAAE,GAAG,CAAC,MAAM,EAAE,CAAC,CAAC;IACzD,MAAM,OAAO,GAAa,EAAE,CAAC;IAC7B,KAAK,MAAM,QAAQ,IAAI,QAAQ,EAAE,CAAC;QAChC,IAAI,CAAC,CAAC,MAAM,UAAU,CAAC,MAAM,EAAE,QAAQ,CAAC,CAAC,EAAE,CAAC;YAC1C,OAAO,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC;QACzB,CAAC;IACH,CAAC;IAED,OAAO,OAAO,CAAC,MAAM,KAAK,CAAC;QACzB,CAAC,CAAC,EAAE,IAAI,EAAE,IAAI,EAAE,MAAM,EAAE,QAAQ,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE;QAC7C,CAAC,CAAC;YACE,IAAI,EAAE,KAAK;YACX,MAAM,EAAE,WAAW,OAAO,CAAC,IAAI,CAAC,IAAI,CAAC,6FAA6F;SACnI,CAAC;AACR,CAAC,CAAA,CAAC;AAEF,8FAA8F;AACvF,MAAM,oBAAoB,GAAG,CAAC,GAAoB,EAAa,EAAE,CAAC,CAAC;IACxE,EAAE,EAAE,cAAc;IAClB,IAAI,EAAE,sBAAsB;IAC5B,KAAK,EAAE,GAAG,EAAE,CAAC,gBAAgB,CAAC,GAAG,CAAC;IAClC,GAAG,EAAE,GAAS,EAAE;;QACd,MAAM,MAAM,GAAG,MAAM,gBAAgB,CAAC,GAAG,CAAC,CAAC;QAC3C,IAAI,CAAC,MAAM,CAAC,IAAI,EAAE,CAAC;YACjB,MAAM,IAAI,KAAK,CAAC,MAAA,MAAM,CAAC,MAAM,mCAAI,sBAAsB,CAAC,CAAC;QAC3D,CAAC;IACH,CAAC,CAAA;CACF,CAAC,CAAC;AAVU,QAAA,oBAAoB,wBAU9B","sourcesContent":["import { qpqDeployAwsUtils } from '@qpqjs/deploy-aws';\nimport { qpqWebServerUtils } from '@qpqjs/webserver';\n\nimport { ListHostedZonesByNameCommand, Route53Client } from '@aws-sdk/client-route-53';\n\nimport { SetupCheckResult, SetupStep } from '../../../lib/setupStep';\nimport { AwsSetupContext } from './awsSetupContext';\n\n// The zones the environment writes records into: one per root, chosen the way the\n// CDK chooses them (each root's site root under the app's resolver, or the root).\nconst getRequiredZones = (ctx: AwsSetupContext): string[] => {\n  const config = ctx.bootstrapQpqConfig;\n  return [\n    ...new Set(\n      qpqWebServerUtils\n        .getRootDomains(config)\n        .map((rootDomain) => qpqDeployAwsUtils.resolveHostedZoneForHost(config, qpqDeployAwsUtils.resolveDeployHostForRoot(config, rootDomain, {}))),\n    ),\n  ];\n};\n\nconst zoneExists = async (client: Route53Client, zoneName: string): Promise<boolean> => {\n  const { HostedZones } = await client.send(new ListHostedZonesByNameCommand({ DNSName: zoneName, MaxItems: 1 }));\n  return (HostedZones ?? []).some((zone) => zone.Name === `${zoneName}.` && !zone.Config?.PrivateZone);\n};\n\nconst checkHostedZones = async (ctx: AwsSetupContext): Promise<SetupCheckResult> => {\n  const required = getRequiredZones(ctx);\n  if (required.length === 0) {\n    return { done: true, detail: 'no domains declared' };\n  }\n\n  const client = new Route53Client({ region: ctx.region });\n  const missing: string[] = [];\n  for (const zoneName of required) {\n    if (!(await zoneExists(client, zoneName))) {\n      missing.push(zoneName);\n    }\n  }\n\n  return missing.length === 0\n    ? { done: true, detail: required.join(', ') }\n    : {\n        done: false,\n        detail: `missing ${missing.join(', ')}: create each as a public hosted zone here and delegate it (NS record) from its parent zone`,\n      };\n};\n\n/** Check-only: the Route53 zones the deploy will write records into exist in this account. */\nexport const buildHostedZonesStep = (ctx: AwsSetupContext): SetupStep => ({\n  id: 'hosted-zones',\n  name: 'Route53 hosted zones',\n  check: () => checkHostedZones(ctx),\n  run: async () => {\n    const result = await checkHostedZones(ctx);\n    if (!result.done) {\n      throw new Error(result.detail ?? 'hosted zones missing');\n    }\n  },\n});\n"]}

package/lib/commonjs/platforms/aws/setup/buildIamCapabilityStep.d.ts

@@ -0,0 +1,4 @@
+import { SetupStep } from '../../../lib/setupStep';
+import { AwsSetupContext } from './awsSetupContext';
+/** Check-only: the credentials can manage IAM, which every CDK deploy needs. */
+export declare const buildIamCapabilityStep: (ctx: AwsSetupContext) => SetupStep;

package/lib/commonjs/platforms/aws/setup/buildIamCapabilityStep.js

@@ -0,0 +1,48 @@
+"use strict";
+var __awaiter = (this && this.__awaiter) || function (thisArg, _arguments, P, generator) {
+    function adopt(value) { return value instanceof P ? value : new P(function (resolve) { resolve(value); }); }
+    return new (P || (P = Promise))(function (resolve, reject) {
+        function fulfilled(value) { try { step(generator.next(value)); } catch (e) { reject(e); } }
+        function rejected(value) { try { step(generator["throw"](value)); } catch (e) { reject(e); } }
+        function step(result) { result.done ? resolve(result.value) : adopt(result.value).then(fulfilled, rejected); }
+        step((generator = generator.apply(thisArg, _arguments || [])).next());
+    });
+};
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.buildIamCapabilityStep = void 0;
+const client_iam_1 = require("@aws-sdk/client-iam");
+// CDK bootstrap and every deploy create IAM roles. PowerUserAccess fails on the
+// first iam:GetRole for a cdk-* role, so probe exactly that: a NoSuchEntity
+// answer means the permission is there, AccessDenied means it is not.
+const checkIamCapability = (ctx) => __awaiter(void 0, void 0, void 0, function* () {
+    const roleName = `cdk-hnb659fds-cfn-exec-role-${ctx.accountId}-${ctx.region}`;
+    try {
+        yield new client_iam_1.IAMClient({ region: ctx.region }).send(new client_iam_1.GetRoleCommand({ RoleName: roleName }));
+        return { done: true, detail: 'iam:GetRole allowed' };
+    }
+    catch (error) {
+        const name = error instanceof Error ? error.name : '';
+        if (name === 'NoSuchEntityException') {
+            return { done: true, detail: 'iam:GetRole allowed' };
+        }
+        return {
+            done: false,
+            detail: `iam:GetRole denied (${name}); the permission set needs IAM rights (AdministratorAccess or a custom set adding iam:*)`,
+        };
+    }
+});
+/** Check-only: the credentials can manage IAM, which every CDK deploy needs. */
+const buildIamCapabilityStep = (ctx) => ({
+    id: 'iam',
+    name: 'IAM rights on the credentials',
+    check: () => checkIamCapability(ctx),
+    run: () => __awaiter(void 0, void 0, void 0, function* () {
+        var _a;
+        const result = yield checkIamCapability(ctx);
+        if (!result.done) {
+            throw new Error((_a = result.detail) !== null && _a !== void 0 ? _a : 'IAM rights missing');
+        }
+    }),
+});
+exports.buildIamCapabilityStep = buildIamCapabilityStep;
+//# sourceMappingURL=buildIamCapabilityStep.js.map

package/lib/commonjs/platforms/aws/setup/buildIamCapabilityStep.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"buildIamCapabilityStep.js","sourceRoot":"","sources":["../../../../../src/platforms/aws/setup/buildIamCapabilityStep.ts"],"names":[],"mappings":";;;;;;;;;;;;AAAA,oDAAgE;AAKhE,gFAAgF;AAChF,4EAA4E;AAC5E,sEAAsE;AACtE,MAAM,kBAAkB,GAAG,CAAO,GAAoB,EAA6B,EAAE;IACnF,MAAM,QAAQ,GAAG,+BAA+B,GAAG,CAAC,SAAS,IAAI,GAAG,CAAC,MAAM,EAAE,CAAC;IAC9E,IAAI,CAAC;QACH,MAAM,IAAI,sBAAS,CAAC,EAAE,MAAM,EAAE,GAAG,CAAC,MAAM,EAAE,CAAC,CAAC,IAAI,CAAC,IAAI,2BAAc,CAAC,EAAE,QAAQ,EAAE,QAAQ,EAAE,CAAC,CAAC,CAAC;QAC7F,OAAO,EAAE,IAAI,EAAE,IAAI,EAAE,MAAM,EAAE,qBAAqB,EAAE,CAAC;IACvD,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,MAAM,IAAI,GAAG,KAAK,YAAY,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC;QACtD,IAAI,IAAI,KAAK,uBAAuB,EAAE,CAAC;YACrC,OAAO,EAAE,IAAI,EAAE,IAAI,EAAE,MAAM,EAAE,qBAAqB,EAAE,CAAC;QACvD,CAAC;QACD,OAAO;YACL,IAAI,EAAE,KAAK;YACX,MAAM,EAAE,uBAAuB,IAAI,2FAA2F;SAC/H,CAAC;IACJ,CAAC;AACH,CAAC,CAAA,CAAC;AAEF,gFAAgF;AACzE,MAAM,sBAAsB,GAAG,CAAC,GAAoB,EAAa,EAAE,CAAC,CAAC;IAC1E,EAAE,EAAE,KAAK;IACT,IAAI,EAAE,+BAA+B;IACrC,KAAK,EAAE,GAAG,EAAE,CAAC,kBAAkB,CAAC,GAAG,CAAC;IACpC,GAAG,EAAE,GAAS,EAAE;;QACd,MAAM,MAAM,GAAG,MAAM,kBAAkB,CAAC,GAAG,CAAC,CAAC;QAC7C,IAAI,CAAC,MAAM,CAAC,IAAI,EAAE,CAAC;YACjB,MAAM,IAAI,KAAK,CAAC,MAAA,MAAM,CAAC,MAAM,mCAAI,oBAAoB,CAAC,CAAC;QACzD,CAAC;IACH,CAAC,CAAA;CACF,CAAC,CAAC;AAVU,QAAA,sBAAsB,0BAUhC","sourcesContent":["import { GetRoleCommand, IAMClient } from '@aws-sdk/client-iam';\n\nimport { SetupCheckResult, SetupStep } from '../../../lib/setupStep';\nimport { AwsSetupContext } from './awsSetupContext';\n\n// CDK bootstrap and every deploy create IAM roles. PowerUserAccess fails on the\n// first iam:GetRole for a cdk-* role, so probe exactly that: a NoSuchEntity\n// answer means the permission is there, AccessDenied means it is not.\nconst checkIamCapability = async (ctx: AwsSetupContext): Promise<SetupCheckResult> => {\n  const roleName = `cdk-hnb659fds-cfn-exec-role-${ctx.accountId}-${ctx.region}`;\n  try {\n    await new IAMClient({ region: ctx.region }).send(new GetRoleCommand({ RoleName: roleName }));\n    return { done: true, detail: 'iam:GetRole allowed' };\n  } catch (error) {\n    const name = error instanceof Error ? error.name : '';\n    if (name === 'NoSuchEntityException') {\n      return { done: true, detail: 'iam:GetRole allowed' };\n    }\n    return {\n      done: false,\n      detail: `iam:GetRole denied (${name}); the permission set needs IAM rights (AdministratorAccess or a custom set adding iam:*)`,\n    };\n  }\n};\n\n/** Check-only: the credentials can manage IAM, which every CDK deploy needs. */\nexport const buildIamCapabilityStep = (ctx: AwsSetupContext): SetupStep => ({\n  id: 'iam',\n  name: 'IAM rights on the credentials',\n  check: () => checkIamCapability(ctx),\n  run: async () => {\n    const result = await checkIamCapability(ctx);\n    if (!result.done) {\n      throw new Error(result.detail ?? 'IAM rights missing');\n    }\n  },\n});\n"]}

package/lib/commonjs/platforms/aws/setup/buildIdentityStep.d.ts

@@ -0,0 +1,4 @@
+import { SetupStep } from '../../../lib/setupStep';
+import { AwsSetupContext } from './awsSetupContext';
+/** Check-only: the active credentials belong to the environment's account. Catches a stale .env or SSO profile. */
+export declare const buildIdentityStep: (ctx: AwsSetupContext) => SetupStep;

package/lib/commonjs/platforms/aws/setup/buildIdentityStep.js

@@ -0,0 +1,39 @@
+"use strict";
+var __awaiter = (this && this.__awaiter) || function (thisArg, _arguments, P, generator) {
+    function adopt(value) { return value instanceof P ? value : new P(function (resolve) { resolve(value); }); }
+    return new (P || (P = Promise))(function (resolve, reject) {
+        function fulfilled(value) { try { step(generator.next(value)); } catch (e) { reject(e); } }
+        function rejected(value) { try { step(generator["throw"](value)); } catch (e) { reject(e); } }
+        function step(result) { result.done ? resolve(result.value) : adopt(result.value).then(fulfilled, rejected); }
+        step((generator = generator.apply(thisArg, _arguments || [])).next());
+    });
+};
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.buildIdentityStep = void 0;
+const client_sts_1 = require("@aws-sdk/client-sts");
+const checkIdentity = (ctx) => __awaiter(void 0, void 0, void 0, function* () {
+    try {
+        const { Account, Arn } = yield new client_sts_1.STSClient({ region: ctx.region }).send(new client_sts_1.GetCallerIdentityCommand({}));
+        if (Account !== ctx.accountId) {
+            return { done: false, detail: `credentials are for account ${Account}, environment '${ctx.environment}' deploys to ${ctx.accountId}` };
+        }
+        return { done: true, detail: `${Arn}` };
+    }
+    catch (error) {
+        return { done: false, detail: `no valid credentials: ${error instanceof Error ? error.message : String(error)}` };
+    }
+});
+/** Check-only: the active credentials belong to the environment's account. Catches a stale .env or SSO profile. */
+const buildIdentityStep = (ctx) => ({
+    id: 'identity',
+    name: `Credentials for account ${ctx.accountId}`,
+    check: () => checkIdentity(ctx),
+    run: () => __awaiter(void 0, void 0, void 0, function* () {
+        const result = yield checkIdentity(ctx);
+        if (!result.done) {
+            throw new Error(`${result.detail}. Log in to the right account (or fix the deployment in deploy.config.json) and rerun.`);
+        }
+    }),
+});
+exports.buildIdentityStep = buildIdentityStep;
+//# sourceMappingURL=buildIdentityStep.js.map

package/lib/commonjs/platforms/aws/setup/buildIdentityStep.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"buildIdentityStep.js","sourceRoot":"","sources":["../../../../../src/platforms/aws/setup/buildIdentityStep.ts"],"names":[],"mappings":";;;;;;;;;;;;AAAA,oDAA0E;AAK1E,MAAM,aAAa,GAAG,CAAO,GAAoB,EAA6B,EAAE;IAC9E,IAAI,CAAC;QACH,MAAM,EAAE,OAAO,EAAE,GAAG,EAAE,GAAG,MAAM,IAAI,sBAAS,CAAC,EAAE,MAAM,EAAE,GAAG,CAAC,MAAM,EAAE,CAAC,CAAC,IAAI,CAAC,IAAI,qCAAwB,CAAC,EAAE,CAAC,CAAC,CAAC;QAC5G,IAAI,OAAO,KAAK,GAAG,CAAC,SAAS,EAAE,CAAC;YAC9B,OAAO,EAAE,IAAI,EAAE,KAAK,EAAE,MAAM,EAAE,+BAA+B,OAAO,kBAAkB,GAAG,CAAC,WAAW,gBAAgB,GAAG,CAAC,SAAS,EAAE,EAAE,CAAC;QACzI,CAAC;QACD,OAAO,EAAE,IAAI,EAAE,IAAI,EAAE,MAAM,EAAE,GAAG,GAAG,EAAE,EAAE,CAAC;IAC1C,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,OAAO,EAAE,IAAI,EAAE,KAAK,EAAE,MAAM,EAAE,yBAAyB,KAAK,YAAY,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,EAAE,EAAE,CAAC;IACpH,CAAC;AACH,CAAC,CAAA,CAAC;AAEF,mHAAmH;AAC5G,MAAM,iBAAiB,GAAG,CAAC,GAAoB,EAAa,EAAE,CAAC,CAAC;IACrE,EAAE,EAAE,UAAU;IACd,IAAI,EAAE,2BAA2B,GAAG,CAAC,SAAS,EAAE;IAChD,KAAK,EAAE,GAAG,EAAE,CAAC,aAAa,CAAC,GAAG,CAAC;IAC/B,GAAG,EAAE,GAAS,EAAE;QACd,MAAM,MAAM,GAAG,MAAM,aAAa,CAAC,GAAG,CAAC,CAAC;QACxC,IAAI,CAAC,MAAM,CAAC,IAAI,EAAE,CAAC;YACjB,MAAM,IAAI,KAAK,CAAC,GAAG,MAAM,CAAC,MAAM,wFAAwF,CAAC,CAAC;QAC5H,CAAC;IACH,CAAC,CAAA;CACF,CAAC,CAAC;AAVU,QAAA,iBAAiB,qBAU3B","sourcesContent":["import { GetCallerIdentityCommand, STSClient } from '@aws-sdk/client-sts';\n\nimport { SetupCheckResult, SetupStep } from '../../../lib/setupStep';\nimport { AwsSetupContext } from './awsSetupContext';\n\nconst checkIdentity = async (ctx: AwsSetupContext): Promise<SetupCheckResult> => {\n  try {\n    const { Account, Arn } = await new STSClient({ region: ctx.region }).send(new GetCallerIdentityCommand({}));\n    if (Account !== ctx.accountId) {\n      return { done: false, detail: `credentials are for account ${Account}, environment '${ctx.environment}' deploys to ${ctx.accountId}` };\n    }\n    return { done: true, detail: `${Arn}` };\n  } catch (error) {\n    return { done: false, detail: `no valid credentials: ${error instanceof Error ? error.message : String(error)}` };\n  }\n};\n\n/** Check-only: the active credentials belong to the environment's account. Catches a stale .env or SSO profile. */\nexport const buildIdentityStep = (ctx: AwsSetupContext): SetupStep => ({\n  id: 'identity',\n  name: `Credentials for account ${ctx.accountId}`,\n  check: () => checkIdentity(ctx),\n  run: async () => {\n    const result = await checkIdentity(ctx);\n    if (!result.done) {\n      throw new Error(`${result.detail}. Log in to the right account (or fix the deployment in deploy.config.json) and rerun.`);\n    }\n  },\n});\n"]}

package/lib/commonjs/platforms/aws/setup/buildStackSteps.d.ts

@@ -0,0 +1,5 @@
+import { SetupStep } from '../../../lib/setupStep';
+import { AwsSetupContext } from './awsSetupContext';
+export declare const buildAccountStackStep: (ctx: AwsSetupContext) => SetupStep;
+export declare const buildDomainStackStep: (ctx: AwsSetupContext) => SetupStep;
+export declare const buildBootstrapStackStep: (ctx: AwsSetupContext) => SetupStep;

package/lib/commonjs/platforms/aws/setup/buildStackSteps.js

@@ -0,0 +1,32 @@
+"use strict";
+var __awaiter = (this && this.__awaiter) || function (thisArg, _arguments, P, generator) {
+    function adopt(value) { return value instanceof P ? value : new P(function (resolve) { resolve(value); }); }
+    return new (P || (P = Promise))(function (resolve, reject) {
+        function fulfilled(value) { try { step(generator.next(value)); } catch (e) { reject(e); } }
+        function rejected(value) { try { step(generator["throw"](value)); } catch (e) { reject(e); } }
+        function step(result) { result.done ? resolve(result.value) : adopt(result.value).then(fulfilled, rejected); }
+        step((generator = generator.apply(thisArg, _arguments || [])).next());
+    });
+};
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.buildBootstrapStackStep = exports.buildDomainStackStep = exports.buildAccountStackStep = void 0;
+const deploy_aws_1 = require("@qpqjs/deploy-aws");
+const stacks_1 = require("../stacks");
+const describeStackStatus_1 = require("./describeStackStatus");
+const buildStackStep = (id, name, stackName, region, run) => ({
+    id,
+    name: `${name} (${stackName})`,
+    check: () => __awaiter(void 0, void 0, void 0, function* () {
+        const status = yield (0, describeStackStatus_1.describeStackStatus)(stackName, region);
+        return status === null ? { done: false, detail: 'not deployed' } : { done: (0, describeStackStatus_1.isStackHealthy)(status), detail: status };
+    }),
+    run,
+});
+const buildAccountStackStep = (ctx) => buildStackStep('account-stack', 'Account guardrails stack', deploy_aws_1.qpqDeployAwsUtils.getAccountStackName(), ctx.region, () => (0, stacks_1.deployAccountStack)(ctx.appName));
+exports.buildAccountStackStep = buildAccountStackStep;
+// The domain stack deploys its cert stacks as dependencies, so one step covers certificates too.
+const buildDomainStackStep = (ctx) => buildStackStep('domain-stack', 'Domain stack: certificates + api domains', deploy_aws_1.qpqDeployAwsUtils.getDomainStackName(ctx.bootstrapQpqConfig), ctx.region, () => (0, stacks_1.deployDomainStack)(ctx.appName));
+exports.buildDomainStackStep = buildDomainStackStep;
+const buildBootstrapStackStep = (ctx) => buildStackStep('bootstrap-stack', 'Bootstrap stack: WAF and app-wide resources', deploy_aws_1.qpqDeployAwsUtils.getBootstrapStackName(ctx.bootstrapQpqConfig), ctx.region, () => (0, stacks_1.deployBootstrapStack)(ctx.appName));
+exports.buildBootstrapStackStep = buildBootstrapStackStep;
+//# sourceMappingURL=buildStackSteps.js.map

package/lib/commonjs/platforms/aws/setup/buildStackSteps.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"buildStackSteps.js","sourceRoot":"","sources":["../../../../../src/platforms/aws/setup/buildStackSteps.ts"],"names":[],"mappings":";;;;;;;;;;;;AAAA,kDAAsD;AAGtD,sCAAwF;AAExF,+DAA4E;AAE5E,MAAM,cAAc,GAAG,CAAC,EAAU,EAAE,IAAY,EAAE,SAAiB,EAAE,MAAc,EAAE,GAAwB,EAAa,EAAE,CAAC,CAAC;IAC5H,EAAE;IACF,IAAI,EAAE,GAAG,IAAI,KAAK,SAAS,GAAG;IAC9B,KAAK,EAAE,GAAS,EAAE;QAChB,MAAM,MAAM,GAAG,MAAM,IAAA,yCAAmB,EAAC,SAAS,EAAE,MAAM,CAAC,CAAC;QAC5D,OAAO,MAAM,KAAK,IAAI,CAAC,CAAC,CAAC,EAAE,IAAI,EAAE,KAAK,EAAE,MAAM,EAAE,cAAc,EAAE,CAAC,CAAC,CAAC,EAAE,IAAI,EAAE,IAAA,oCAAc,EAAC,MAAM,CAAC,EAAE,MAAM,EAAE,MAAM,EAAE,CAAC;IACtH,CAAC,CAAA;IACD,GAAG;CACJ,CAAC,CAAC;AAEI,MAAM,qBAAqB,GAAG,CAAC,GAAoB,EAAa,EAAE,CACvE,cAAc,CAAC,eAAe,EAAE,0BAA0B,EAAE,8BAAiB,CAAC,mBAAmB,EAAE,EAAE,GAAG,CAAC,MAAM,EAAE,GAAG,EAAE,CACpH,IAAA,2BAAkB,EAAC,GAAG,CAAC,OAAO,CAAC,CAChC,CAAC;AAHS,QAAA,qBAAqB,yBAG9B;AAEJ,iGAAiG;AAC1F,MAAM,oBAAoB,GAAG,CAAC,GAAoB,EAAa,EAAE,CACtE,cAAc,CACZ,cAAc,EACd,0CAA0C,EAC1C,8BAAiB,CAAC,kBAAkB,CAAC,GAAG,CAAC,kBAAkB,CAAC,EAC5D,GAAG,CAAC,MAAM,EACV,GAAG,EAAE,CAAC,IAAA,0BAAiB,EAAC,GAAG,CAAC,OAAO,CAAC,CACrC,CAAC;AAPS,QAAA,oBAAoB,wBAO7B;AAEG,MAAM,uBAAuB,GAAG,CAAC,GAAoB,EAAa,EAAE,CACzE,cAAc,CACZ,iBAAiB,EACjB,6CAA6C,EAC7C,8BAAiB,CAAC,qBAAqB,CAAC,GAAG,CAAC,kBAAkB,CAAC,EAC/D,GAAG,CAAC,MAAM,EACV,GAAG,EAAE,CAAC,IAAA,6BAAoB,EAAC,GAAG,CAAC,OAAO,CAAC,CACxC,CAAC;AAPS,QAAA,uBAAuB,2BAOhC","sourcesContent":["import { qpqDeployAwsUtils } from '@qpqjs/deploy-aws';\n\nimport { SetupStep } from '../../../lib/setupStep';\nimport { deployAccountStack, deployBootstrapStack, deployDomainStack } from '../stacks';\nimport { AwsSetupContext } from './awsSetupContext';\nimport { describeStackStatus, isStackHealthy } from './describeStackStatus';\n\nconst buildStackStep = (id: string, name: string, stackName: string, region: string, run: () => Promise<void>): SetupStep => ({\n  id,\n  name: `${name} (${stackName})`,\n  check: async () => {\n    const status = await describeStackStatus(stackName, region);\n    return status === null ? { done: false, detail: 'not deployed' } : { done: isStackHealthy(status), detail: status };\n  },\n  run,\n});\n\nexport const buildAccountStackStep = (ctx: AwsSetupContext): SetupStep =>\n  buildStackStep('account-stack', 'Account guardrails stack', qpqDeployAwsUtils.getAccountStackName(), ctx.region, () =>\n    deployAccountStack(ctx.appName),\n  );\n\n// The domain stack deploys its cert stacks as dependencies, so one step covers certificates too.\nexport const buildDomainStackStep = (ctx: AwsSetupContext): SetupStep =>\n  buildStackStep(\n    'domain-stack',\n    'Domain stack: certificates + api domains',\n    qpqDeployAwsUtils.getDomainStackName(ctx.bootstrapQpqConfig),\n    ctx.region,\n    () => deployDomainStack(ctx.appName),\n  );\n\nexport const buildBootstrapStackStep = (ctx: AwsSetupContext): SetupStep =>\n  buildStackStep(\n    'bootstrap-stack',\n    'Bootstrap stack: WAF and app-wide resources',\n    qpqDeployAwsUtils.getBootstrapStackName(ctx.bootstrapQpqConfig),\n    ctx.region,\n    () => deployBootstrapStack(ctx.appName),\n  );\n"]}

package/lib/commonjs/platforms/aws/setup/describeStackStatus.d.ts

@@ -0,0 +1,4 @@
+import { Nullable } from '@qpqjs/core';
+/** A stack's status, or null when it does not exist. */
+export declare const describeStackStatus: (stackName: string, region: string) => Promise<Nullable<string>>;
+export declare const isStackHealthy: (status: Nullable<string>) => boolean;

package/lib/commonjs/platforms/aws/setup/describeStackStatus.js

@@ -0,0 +1,32 @@
+"use strict";
+var __awaiter = (this && this.__awaiter) || function (thisArg, _arguments, P, generator) {
+    function adopt(value) { return value instanceof P ? value : new P(function (resolve) { resolve(value); }); }
+    return new (P || (P = Promise))(function (resolve, reject) {
+        function fulfilled(value) { try { step(generator.next(value)); } catch (e) { reject(e); } }
+        function rejected(value) { try { step(generator["throw"](value)); } catch (e) { reject(e); } }
+        function step(result) { result.done ? resolve(result.value) : adopt(result.value).then(fulfilled, rejected); }
+        step((generator = generator.apply(thisArg, _arguments || [])).next());
+    });
+};
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.isStackHealthy = exports.describeStackStatus = void 0;
+const client_cloudformation_1 = require("@aws-sdk/client-cloudformation");
+/** A stack's status, or null when it does not exist. */
+const describeStackStatus = (stackName, region) => __awaiter(void 0, void 0, void 0, function* () {
+    var _a, _b;
+    try {
+        const { Stacks } = yield new client_cloudformation_1.CloudFormationClient({ region }).send(new client_cloudformation_1.DescribeStacksCommand({ StackName: stackName }));
+        return (_b = (_a = Stacks === null || Stacks === void 0 ? void 0 : Stacks[0]) === null || _a === void 0 ? void 0 : _a.StackStatus) !== null && _b !== void 0 ? _b : null;
+    }
+    catch (error) {
+        if (error instanceof Error && /does not exist/.test(error.message)) {
+            return null;
+        }
+        throw error;
+    }
+});
+exports.describeStackStatus = describeStackStatus;
+const healthyStatuses = ['CREATE_COMPLETE', 'UPDATE_COMPLETE', 'IMPORT_COMPLETE'];
+const isStackHealthy = (status) => status !== null && healthyStatuses.includes(status);
+exports.isStackHealthy = isStackHealthy;
+//# sourceMappingURL=describeStackStatus.js.map

package/lib/commonjs/platforms/aws/setup/describeStackStatus.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"describeStackStatus.js","sourceRoot":"","sources":["../../../../../src/platforms/aws/setup/describeStackStatus.ts"],"names":[],"mappings":";;;;;;;;;;;;AAEA,0EAA6F;AAE7F,wDAAwD;AACjD,MAAM,mBAAmB,GAAG,CAAO,SAAiB,EAAE,MAAc,EAA6B,EAAE;;IACxG,IAAI,CAAC;QACH,MAAM,EAAE,MAAM,EAAE,GAAG,MAAM,IAAI,4CAAoB,CAAC,EAAE,MAAM,EAAE,CAAC,CAAC,IAAI,CAAC,IAAI,6CAAqB,CAAC,EAAE,SAAS,EAAE,SAAS,EAAE,CAAC,CAAC,CAAC;QACxH,OAAO,MAAA,MAAA,MAAM,aAAN,MAAM,uBAAN,MAAM,CAAG,CAAC,CAAC,0CAAE,WAAW,mCAAI,IAAI,CAAC;IAC1C,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,IAAI,KAAK,YAAY,KAAK,IAAI,gBAAgB,CAAC,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,EAAE,CAAC;YACnE,OAAO,IAAI,CAAC;QACd,CAAC;QACD,MAAM,KAAK,CAAC;IACd,CAAC;AACH,CAAC,CAAA,CAAC;AAVW,QAAA,mBAAmB,uBAU9B;AAEF,MAAM,eAAe,GAAG,CAAC,iBAAiB,EAAE,iBAAiB,EAAE,iBAAiB,CAAC,CAAC;AAE3E,MAAM,cAAc,GAAG,CAAC,MAAwB,EAAW,EAAE,CAAC,MAAM,KAAK,IAAI,IAAI,eAAe,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC;AAA5G,QAAA,cAAc,kBAA8F","sourcesContent":["import { Nullable } from '@qpqjs/core';\n\nimport { CloudFormationClient, DescribeStacksCommand } from '@aws-sdk/client-cloudformation';\n\n/** A stack's status, or null when it does not exist. */\nexport const describeStackStatus = async (stackName: string, region: string): Promise<Nullable<string>> => {\n  try {\n    const { Stacks } = await new CloudFormationClient({ region }).send(new DescribeStacksCommand({ StackName: stackName }));\n    return Stacks?.[0]?.StackStatus ?? null;\n  } catch (error) {\n    if (error instanceof Error && /does not exist/.test(error.message)) {\n      return null;\n    }\n    throw error;\n  }\n};\n\nconst healthyStatuses = ['CREATE_COMPLETE', 'UPDATE_COMPLETE', 'IMPORT_COMPLETE'];\n\nexport const isStackHealthy = (status: Nullable<string>): boolean => status !== null && healthyStatuses.includes(status);\n"]}

package/lib/commonjs/platforms/aws/setup/index.d.ts

@@ -0,0 +1 @@
+export * from './awsSetupSteps';

package/lib/commonjs/platforms/aws/setup/index.js

@@ -0,0 +1,18 @@
+"use strict";
+var __createBinding = (this && this.__createBinding) || (Object.create ? (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    var desc = Object.getOwnPropertyDescriptor(m, k);
+    if (!desc || ("get" in desc ? !m.__esModule : desc.writable || desc.configurable)) {
+      desc = { enumerable: true, get: function() { return m[k]; } };
+    }
+    Object.defineProperty(o, k2, desc);
+}) : (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    o[k2] = m[k];
+}));
+var __exportStar = (this && this.__exportStar) || function(m, exports) {
+    for (var p in m) if (p !== "default" && !Object.prototype.hasOwnProperty.call(exports, p)) __createBinding(exports, m, p);
+};
+Object.defineProperty(exports, "__esModule", { value: true });
+__exportStar(require("./awsSetupSteps"), exports);
+//# sourceMappingURL=index.js.map

package/lib/commonjs/platforms/aws/setup/index.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../../../../../src/platforms/aws/setup/index.ts"],"names":[],"mappings":";;;;;;;;;;;;;;;;AAAA,kDAAgC","sourcesContent":["export * from './awsSetupSteps';\n"]}

package/lib/commonjs/platforms/aws/stacks.d.ts

@@ -0,0 +1,7 @@
+export declare const deployStack: (stackName: string, env?: Record<string, string>) => Promise<void>;
+export declare const deployServiceStack: (serviceName: string, stackName: string, appName: string) => Promise<void>;
+export declare const destroyStack: (stackName: string, env?: Record<string, string>) => Promise<void>;
+export declare const destroyServiceStack: (serviceName: string, stackName: string, appName: string) => Promise<void>;
+export declare const deployDomainStack: (appName: string) => Promise<void>;
+export declare const deployAccountStack: (appName: string) => Promise<void>;
+export declare const deployBootstrapStack: (appName: string) => Promise<void>;

package/lib/commonjs/platforms/aws/stacks.js

@@ -0,0 +1,94 @@
+"use strict";
+var __awaiter = (this && this.__awaiter) || function (thisArg, _arguments, P, generator) {
+    function adopt(value) { return value instanceof P ? value : new P(function (resolve) { resolve(value); }); }
+    return new (P || (P = Promise))(function (resolve, reject) {
+        function fulfilled(value) { try { step(generator.next(value)); } catch (e) { reject(e); } }
+        function rejected(value) { try { step(generator["throw"](value)); } catch (e) { reject(e); } }
+        function step(result) { result.done ? resolve(result.value) : adopt(result.value).then(fulfilled, rejected); }
+        step((generator = generator.apply(thisArg, _arguments || [])).next());
+    });
+};
+var __importDefault = (this && this.__importDefault) || function (mod) {
+    return (mod && mod.__esModule) ? mod : { "default": mod };
+};
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.deployBootstrapStack = exports.deployAccountStack = exports.deployDomainStack = exports.destroyServiceStack = exports.destroyStack = exports.deployServiceStack = exports.deployStack = void 0;
+// Host-side `cdk deploy` helpers. No cdk.json anywhere: the CDK app command is
+// passed via --app and runs @qpqjs/deploy-aws's generic workspace app
+// (bin/qpq-cdk-app.js) under ts-node hooks. The child inherits the primed
+// deployment env (DEPLOY_APP_NAME / DEPLOY_NAME and everything resolveDeployment
+// set); only the per-invocation service is added here.
+const core_1 = require("@qpqjs/core");
+const deploy_aws_1 = require("@qpqjs/deploy-aws");
+const path_1 = __importDefault(require("path"));
+const discovery_1 = require("../../lib/discovery");
+const qpqConfigs_1 = require("../../lib/qpqConfigs");
+const runCommand_1 = require("../../lib/runCommand");
+const timing_1 = require("../../lib/timing");
+const cdkApp_1 = require("./cdkApp");
+const deployStack = (stackName_1, ...args_1) => __awaiter(void 0, [stackName_1, ...args_1], void 0, function* (stackName, env = {}) {
+    (0, timing_1.logTimeStart)(stackName);
+    yield (0, runCommand_1.runCommand)('npx', ['cdk', 'deploy', stackName, '--require-approval', 'never', '--app', `'${(0, cdkApp_1.getCdkAppCommand)()}'`, '--output', path_1.default.join('dist', 'qpq', 'cdk.out')], {
+        cwd: (0, discovery_1.getRoot)(),
+        env,
+    });
+    (0, timing_1.logTimeEnd)(stackName);
+});
+exports.deployStack = deployStack;
+const deployServiceStack = (serviceName, stackName, appName) => (0, exports.deployStack)(stackName, {
+    DEPLOY_SERVICE_NAME: serviceName,
+    DEPLOY_APP_NAME: appName,
+});
+exports.deployServiceStack = deployServiceStack;
+// `cdk destroy` still synths the app to find the stack, so it runs the same
+// generic workspace app with the same DEPLOY_* env as deploys — meaning the
+// service bundles under dist/ must exist for asset resolution to succeed.
+const destroyStack = (stackName_1, ...args_1) => __awaiter(void 0, [stackName_1, ...args_1], void 0, function* (stackName, env = {}) {
+    (0, timing_1.logTimeStart)(stackName);
+    yield (0, runCommand_1.runCommand)('npx', ['cdk', 'destroy', stackName, '--force', '--app', `'${(0, cdkApp_1.getCdkAppCommand)()}'`, '--output', path_1.default.join('dist', 'qpq', 'cdk.out')], {
+        cwd: (0, discovery_1.getRoot)(),
+        env,
+    });
+    (0, timing_1.logTimeEnd)(stackName);
+});
+exports.destroyStack = destroyStack;
+const destroyServiceStack = (serviceName, stackName, appName) => (0, exports.destroyStack)(stackName, {
+    DEPLOY_SERVICE_NAME: serviceName,
+    DEPLOY_APP_NAME: appName,
+});
+exports.destroyServiceStack = destroyServiceStack;
+const deployDomainStack = (appName) => __awaiter(void 0, void 0, void 0, function* () {
+    const qpqConfig = (0, qpqConfigs_1.loadServiceQpqConfig)(appName, (0, discovery_1.getServiceNames)(appName)[0]);
+    const stackName = deploy_aws_1.qpqDeployAwsUtils.getDomainStackName(qpqConfig);
+    console.log('Deploy Domain: ', stackName);
+    yield (0, exports.deployStack)(stackName, {
+        DEPLOY_SERVICE_NAME: '',
+        DEPLOY_APP_NAME: appName,
+    });
+});
+exports.deployDomainStack = deployDomainStack;
+// Account-level guardrails stack - statically named (one per AWS account,
+// app-agnostic), so no config load is needed to know the name. Callers decide
+// whether an actor deploy should include it (bootstrap skips it; the explicit
+// 'account' menu option always deploys).
+const deployAccountStack = (appName) => __awaiter(void 0, void 0, void 0, function* () {
+    const stackName = deploy_aws_1.qpqDeployAwsUtils.getAccountStackName();
+    console.log('Deploy Account: ', stackName);
+    yield (0, exports.deployStack)(stackName, {
+        DEPLOY_SERVICE_NAME: '',
+        DEPLOY_APP_NAME: appName,
+    });
+});
+exports.deployAccountStack = deployAccountStack;
+const deployBootstrapStack = (appName) => __awaiter(void 0, void 0, void 0, function* () {
+    const appPrefix = (0, qpqConfigs_1.getAppPrefix)(appName);
+    const environment = process.env[core_1.QpqDeployEnvVar.environment];
+    const feature = process.env[core_1.QpqDeployEnvVar.featureName];
+    const stackName = feature ? `${appPrefix}-${environment}-${feature}-bs` : `${appPrefix}-${environment}-bs`;
+    yield (0, exports.deployStack)(stackName, {
+        DEPLOY_SERVICE_NAME: '',
+        DEPLOY_APP_NAME: appName,
+    });
+});
+exports.deployBootstrapStack = deployBootstrapStack;
+//# sourceMappingURL=stacks.js.map

package/lib/commonjs/platforms/aws/stacks.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"stacks.js","sourceRoot":"","sources":["../../../../src/platforms/aws/stacks.ts"],"names":[],"mappings":";;;;;;;;;;;;;;;AAAA,+EAA+E;AAC/E,sEAAsE;AACtE,0EAA0E;AAC1E,iFAAiF;AACjF,uDAAuD;AACvD,sCAA8C;AAC9C,kDAAsD;AAEtD,gDAAwB;AAExB,mDAA+D;AAC/D,qDAA0E;AAC1E,qDAAkD;AAClD,6CAA4D;AAC5D,qCAA4C;AAErC,MAAM,WAAW,GAAG,yBAA2E,EAAE,gEAAtE,SAAiB,EAAE,MAA8B,EAAE;IACnF,IAAA,qBAAY,EAAC,SAAS,CAAC,CAAC;IACxB,MAAM,IAAA,uBAAU,EACd,KAAK,EACL,CAAC,KAAK,EAAE,QAAQ,EAAE,SAAS,EAAE,oBAAoB,EAAE,OAAO,EAAE,OAAO,EAAE,IAAI,IAAA,yBAAgB,GAAE,GAAG,EAAE,UAAU,EAAE,cAAI,CAAC,IAAI,CAAC,MAAM,EAAE,KAAK,EAAE,SAAS,CAAC,CAAC,EAChJ;QACE,GAAG,EAAE,IAAA,mBAAO,GAAE;QACd,GAAG;KACJ,CACF,CAAC;IACF,IAAA,mBAAU,EAAC,SAAS,CAAC,CAAC;AACxB,CAAC,CAAA,CAAC;AAXW,QAAA,WAAW,eAWtB;AAEK,MAAM,kBAAkB,GAAG,CAAC,WAAmB,EAAE,SAAiB,EAAE,OAAe,EAAiB,EAAE,CAC3G,IAAA,mBAAW,EAAC,SAAS,EAAE;IACrB,mBAAmB,EAAE,WAAW;IAChC,eAAe,EAAE,OAAO;CACzB,CAAC,CAAC;AAJQ,QAAA,kBAAkB,sBAI1B;AAEL,4EAA4E;AAC5E,4EAA4E;AAC5E,0EAA0E;AACnE,MAAM,YAAY,GAAG,yBAA2E,EAAE,gEAAtE,SAAiB,EAAE,MAA8B,EAAE;IACpF,IAAA,qBAAY,EAAC,SAAS,CAAC,CAAC;IACxB,MAAM,IAAA,uBAAU,EACd,KAAK,EACL,CAAC,KAAK,EAAE,SAAS,EAAE,SAAS,EAAE,SAAS,EAAE,OAAO,EAAE,IAAI,IAAA,yBAAgB,GAAE,GAAG,EAAE,UAAU,EAAE,cAAI,CAAC,IAAI,CAAC,MAAM,EAAE,KAAK,EAAE,SAAS,CAAC,CAAC,EAC7H;QACE,GAAG,EAAE,IAAA,mBAAO,GAAE;QACd,GAAG;KACJ,CACF,CAAC;IACF,IAAA,mBAAU,EAAC,SAAS,CAAC,CAAC;AACxB,CAAC,CAAA,CAAC;AAXW,QAAA,YAAY,gBAWvB;AAEK,MAAM,mBAAmB,GAAG,CAAC,WAAmB,EAAE,SAAiB,EAAE,OAAe,EAAiB,EAAE,CAC5G,IAAA,oBAAY,EAAC,SAAS,EAAE;IACtB,mBAAmB,EAAE,WAAW;IAChC,eAAe,EAAE,OAAO;CACzB,CAAC,CAAC;AAJQ,QAAA,mBAAmB,uBAI3B;AAEE,MAAM,iBAAiB,GAAG,CAAO,OAAe,EAAiB,EAAE;IACxE,MAAM,SAAS,GAAG,IAAA,iCAAoB,EAAC,OAAO,EAAE,IAAA,2BAAe,EAAC,OAAO,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;IAC7E,MAAM,SAAS,GAAG,8BAAiB,CAAC,kBAAkB,CAAC,SAAS,CAAC,CAAC;IAClE,OAAO,CAAC,GAAG,CAAC,iBAAiB,EAAE,SAAS,CAAC,CAAC;IAC1C,MAAM,IAAA,mBAAW,EAAC,SAAS,EAAE;QAC3B,mBAAmB,EAAE,EAAE;QACvB,eAAe,EAAE,OAAO;KACzB,CAAC,CAAC;AACL,CAAC,CAAA,CAAC;AARW,QAAA,iBAAiB,qBAQ5B;AAEF,0EAA0E;AAC1E,8EAA8E;AAC9E,8EAA8E;AAC9E,yCAAyC;AAClC,MAAM,kBAAkB,GAAG,CAAO,OAAe,EAAiB,EAAE;IACzE,MAAM,SAAS,GAAG,8BAAiB,CAAC,mBAAmB,EAAE,CAAC;IAC1D,OAAO,CAAC,GAAG,CAAC,kBAAkB,EAAE,SAAS,CAAC,CAAC;IAC3C,MAAM,IAAA,mBAAW,EAAC,SAAS,EAAE;QAC3B,mBAAmB,EAAE,EAAE;QACvB,eAAe,EAAE,OAAO;KACzB,CAAC,CAAC;AACL,CAAC,CAAA,CAAC;AAPW,QAAA,kBAAkB,sBAO7B;AAEK,MAAM,oBAAoB,GAAG,CAAO,OAAe,EAAiB,EAAE;IAC3E,MAAM,SAAS,GAAG,IAAA,yBAAY,EAAC,OAAO,CAAC,CAAC;IACxC,MAAM,WAAW,GAAG,OAAO,CAAC,GAAG,CAAC,sBAAe,CAAC,WAAW,CAAC,CAAC;IAC7D,MAAM,OAAO,GAAG,OAAO,CAAC,GAAG,CAAC,sBAAe,CAAC,WAAW,CAAC,CAAC;IACzD,MAAM,SAAS,GAAG,OAAO,CAAC,CAAC,CAAC,GAAG,SAAS,IAAI,WAAW,IAAI,OAAO,KAAK,CAAC,CAAC,CAAC,GAAG,SAAS,IAAI,WAAW,KAAK,CAAC;IAC3G,MAAM,IAAA,mBAAW,EAAC,SAAS,EAAE;QAC3B,mBAAmB,EAAE,EAAE;QACvB,eAAe,EAAE,OAAO;KACzB,CAAC,CAAC;AACL,CAAC,CAAA,CAAC;AATW,QAAA,oBAAoB,wBAS/B","sourcesContent":["// Host-side `cdk deploy` helpers. No cdk.json anywhere: the CDK app command is\n// passed via --app and runs @qpqjs/deploy-aws's generic workspace app\n// (bin/qpq-cdk-app.js) under ts-node hooks. The child inherits the primed\n// deployment env (DEPLOY_APP_NAME / DEPLOY_NAME and everything resolveDeployment\n// set); only the per-invocation service is added here.\nimport { QpqDeployEnvVar } from '@qpqjs/core';\nimport { qpqDeployAwsUtils } from '@qpqjs/deploy-aws';\n\nimport path from 'path';\n\nimport { getRoot, getServiceNames } from '../../lib/discovery';\nimport { getAppPrefix, loadServiceQpqConfig } from '../../lib/qpqConfigs';\nimport { runCommand } from '../../lib/runCommand';\nimport { logTimeEnd, logTimeStart } from '../../lib/timing';\nimport { getCdkAppCommand } from './cdkApp';\n\nexport const deployStack = async (stackName: string, env: Record<string, string> = {}): Promise<void> => {\n  logTimeStart(stackName);\n  await runCommand(\n    'npx',\n    ['cdk', 'deploy', stackName, '--require-approval', 'never', '--app', `'${getCdkAppCommand()}'`, '--output', path.join('dist', 'qpq', 'cdk.out')],\n    {\n      cwd: getRoot(),\n      env,\n    },\n  );\n  logTimeEnd(stackName);\n};\n\nexport const deployServiceStack = (serviceName: string, stackName: string, appName: string): Promise<void> =>\n  deployStack(stackName, {\n    DEPLOY_SERVICE_NAME: serviceName,\n    DEPLOY_APP_NAME: appName,\n  });\n\n// `cdk destroy` still synths the app to find the stack, so it runs the same\n// generic workspace app with the same DEPLOY_* env as deploys — meaning the\n// service bundles under dist/ must exist for asset resolution to succeed.\nexport const destroyStack = async (stackName: string, env: Record<string, string> = {}): Promise<void> => {\n  logTimeStart(stackName);\n  await runCommand(\n    'npx',\n    ['cdk', 'destroy', stackName, '--force', '--app', `'${getCdkAppCommand()}'`, '--output', path.join('dist', 'qpq', 'cdk.out')],\n    {\n      cwd: getRoot(),\n      env,\n    },\n  );\n  logTimeEnd(stackName);\n};\n\nexport const destroyServiceStack = (serviceName: string, stackName: string, appName: string): Promise<void> =>\n  destroyStack(stackName, {\n    DEPLOY_SERVICE_NAME: serviceName,\n    DEPLOY_APP_NAME: appName,\n  });\n\nexport const deployDomainStack = async (appName: string): Promise<void> => {\n  const qpqConfig = loadServiceQpqConfig(appName, getServiceNames(appName)[0]);\n  const stackName = qpqDeployAwsUtils.getDomainStackName(qpqConfig);\n  console.log('Deploy Domain: ', stackName);\n  await deployStack(stackName, {\n    DEPLOY_SERVICE_NAME: '',\n    DEPLOY_APP_NAME: appName,\n  });\n};\n\n// Account-level guardrails stack - statically named (one per AWS account,\n// app-agnostic), so no config load is needed to know the name. Callers decide\n// whether an actor deploy should include it (bootstrap skips it; the explicit\n// 'account' menu option always deploys).\nexport const deployAccountStack = async (appName: string): Promise<void> => {\n  const stackName = qpqDeployAwsUtils.getAccountStackName();\n  console.log('Deploy Account: ', stackName);\n  await deployStack(stackName, {\n    DEPLOY_SERVICE_NAME: '',\n    DEPLOY_APP_NAME: appName,\n  });\n};\n\nexport const deployBootstrapStack = async (appName: string): Promise<void> => {\n  const appPrefix = getAppPrefix(appName);\n  const environment = process.env[QpqDeployEnvVar.environment];\n  const feature = process.env[QpqDeployEnvVar.featureName];\n  const stackName = feature ? `${appPrefix}-${environment}-${feature}-bs` : `${appPrefix}-${environment}-bs`;\n  await deployStack(stackName, {\n    DEPLOY_SERVICE_NAME: '',\n    DEPLOY_APP_NAME: appName,\n  });\n};\n"]}

package/lib/commonjs/platforms/aws/teardown.d.ts

@@ -0,0 +1,2 @@
+import { TeardownPlan } from '../../lib/deployPrompts';
+export declare const awsTeardown: (appName: string, plan: TeardownPlan) => Promise<void>;