@qpqjs/cli 0.0.0-stage → 0.2.1

package/lib/esm/platforms/aws/index.js

@@ -0,0 +1,20 @@
+import { awsClearResources } from './clearResources';
+import { awsGo } from './go';
+import { awsGoDocker } from './goDocker';
+import { awsPrepareDeployment } from './prepareDeployment';
+import { awsPublish, awsPublishBuild, awsPublishDeploy, awsPublishUpload } from './publish';
+import { awsSetupSteps } from './setup';
+import { awsTeardown } from './teardown';
+export const awsPlatformDriver = {
+    prepareDeployment: awsPrepareDeployment,
+    go: awsGo,
+    goDocker: awsGoDocker,
+    teardown: awsTeardown,
+    clearResources: awsClearResources,
+    setupSteps: awsSetupSteps,
+    publish: awsPublish,
+    publishBuild: awsPublishBuild,
+    publishUpload: awsPublishUpload,
+    publishDeploy: awsPublishDeploy,
+};
+//# sourceMappingURL=index.js.map

package/lib/esm/platforms/aws/index.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../../../../src/platforms/aws/index.ts"],"names":[],"mappings":"AACA,OAAO,EAAE,iBAAiB,EAAE,MAAM,kBAAkB,CAAC;AACrD,OAAO,EAAE,KAAK,EAAE,MAAM,MAAM,CAAC;AAC7B,OAAO,EAAE,WAAW,EAAE,MAAM,YAAY,CAAC;AACzC,OAAO,EAAE,oBAAoB,EAAE,MAAM,qBAAqB,CAAC;AAC3D,OAAO,EAAE,UAAU,EAAE,eAAe,EAAE,gBAAgB,EAAE,gBAAgB,EAAE,MAAM,WAAW,CAAC;AAC5F,OAAO,EAAE,aAAa,EAAE,MAAM,SAAS,CAAC;AACxC,OAAO,EAAE,WAAW,EAAE,MAAM,YAAY,CAAC;AAEzC,MAAM,CAAC,MAAM,iBAAiB,GAAsB;IAClD,iBAAiB,EAAE,oBAAoB;IAEvC,EAAE,EAAE,KAAK;IACT,QAAQ,EAAE,WAAW;IACrB,QAAQ,EAAE,WAAW;IACrB,cAAc,EAAE,iBAAiB;IACjC,UAAU,EAAE,aAAa;IAEzB,OAAO,EAAE,UAAU;IACnB,YAAY,EAAE,eAAe;IAC7B,aAAa,EAAE,gBAAgB;IAC/B,aAAa,EAAE,gBAAgB;CAChC,CAAC","sourcesContent":["import { QpqPlatformDriver } from '../types';\nimport { awsClearResources } from './clearResources';\nimport { awsGo } from './go';\nimport { awsGoDocker } from './goDocker';\nimport { awsPrepareDeployment } from './prepareDeployment';\nimport { awsPublish, awsPublishBuild, awsPublishDeploy, awsPublishUpload } from './publish';\nimport { awsSetupSteps } from './setup';\nimport { awsTeardown } from './teardown';\n\nexport const awsPlatformDriver: QpqPlatformDriver = {\n  prepareDeployment: awsPrepareDeployment,\n\n  go: awsGo,\n  goDocker: awsGoDocker,\n  teardown: awsTeardown,\n  clearResources: awsClearResources,\n  setupSteps: awsSetupSteps,\n\n  publish: awsPublish,\n  publishBuild: awsPublishBuild,\n  publishUpload: awsPublishUpload,\n  publishDeploy: awsPublishDeploy,\n};\n"]}

package/lib/esm/platforms/aws/prepareDeployment.d.ts

@@ -0,0 +1,3 @@
+import { QpqAppDeployment } from '@qpqjs/core';
+/** Checks the entry has an account and region, then primes AWS_DEFAULT_ACCOUNT / AWS_DEFAULT_REGION from it. */
+export declare const awsPrepareDeployment: (deploymentName: string, deployment: QpqAppDeployment) => void;

package/lib/esm/platforms/aws/prepareDeployment.js

@@ -0,0 +1,6 @@
+import { primeAwsDeploymentEnv, validateAwsDeployment } from '@qpqjs/config-aws';
+/** Checks the entry has an account and region, then primes AWS_DEFAULT_ACCOUNT / AWS_DEFAULT_REGION from it. */
+export const awsPrepareDeployment = (deploymentName, deployment) => {
+    primeAwsDeploymentEnv(validateAwsDeployment(deploymentName, deployment));
+};
+//# sourceMappingURL=prepareDeployment.js.map

package/lib/esm/platforms/aws/prepareDeployment.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"prepareDeployment.js","sourceRoot":"","sources":["../../../../src/platforms/aws/prepareDeployment.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,qBAAqB,EAAE,qBAAqB,EAAE,MAAM,mBAAmB,CAAC;AAGjF,gHAAgH;AAChH,MAAM,CAAC,MAAM,oBAAoB,GAAG,CAAC,cAAsB,EAAE,UAA4B,EAAQ,EAAE;IACjG,qBAAqB,CAAC,qBAAqB,CAAC,cAAc,EAAE,UAAU,CAAC,CAAC,CAAC;AAC3E,CAAC,CAAC","sourcesContent":["import { primeAwsDeploymentEnv, validateAwsDeployment } from '@qpqjs/config-aws';\nimport { QpqAppDeployment } from '@qpqjs/core';\n\n/** Checks the entry has an account and region, then primes AWS_DEFAULT_ACCOUNT / AWS_DEFAULT_REGION from it. */\nexport const awsPrepareDeployment = (deploymentName: string, deployment: QpqAppDeployment): void => {\n  primeAwsDeploymentEnv(validateAwsDeployment(deploymentName, deployment));\n};\n"]}

package/lib/esm/platforms/aws/publish.d.ts

@@ -0,0 +1,4 @@
+export declare const awsPublishBuild: (appName: string, serviceNames: string[]) => Promise<void>;
+export declare const awsPublishUpload: (appName: string, serviceNames: string[]) => Promise<void>;
+export declare const awsPublishDeploy: (appName: string, serviceNames: string[]) => Promise<void>;
+export declare const awsPublish: (appName: string, serviceNames: string[]) => Promise<void>;

package/lib/esm/platforms/aws/publish.js

@@ -0,0 +1,50 @@
+// AWS federated remote publishing — build each backend service as a
+// module-federation remote and publish it into that service's federated code
+// bucket (see ./remote for the three-phase mechanics).
+import { isAwsCredentialsValid } from './awsCredentials';
+import { buildRemote, deployRemoteManifest, resolvePublishTarget, uploadRemoteVersion } from './remote';
+const requireAwsCredentials = async () => {
+    if (!(await isAwsCredentialsValid())) {
+        console.error('AWS credentials are not valid. Configure them and retry.');
+        process.exit(1);
+    }
+};
+export const awsPublishBuild = async (appName, serviceNames) => {
+    console.log(`Building federated remotes for [${appName}]: ${serviceNames.join(', ')}`);
+    for (const serviceName of serviceNames) {
+        await buildRemote(appName, serviceName);
+    }
+    console.log('Done. Next: qpq publish:upload, then qpq publish:deploy.');
+};
+export const awsPublishUpload = async (appName, serviceNames) => {
+    await requireAwsCredentials();
+    // Resolve every target up front - a missing build fails the whole step
+    // before a single byte is uploaded.
+    const targets = serviceNames.map((serviceName) => resolvePublishTarget(appName, serviceName));
+    console.log(`Uploading federated remotes for [${appName}]: ${serviceNames.join(', ')}`);
+    await Promise.all(targets.map((target) => uploadRemoteVersion(target)));
+    console.log('Done. Run qpq publish:deploy to flip lambdas to the new versions.');
+};
+export const awsPublishDeploy = async (appName, serviceNames) => {
+    await requireAwsCredentials();
+    const targets = serviceNames.map((serviceName) => resolvePublishTarget(appName, serviceName));
+    console.log(`Deploying federated remote manifests for [${appName}]: ${serviceNames.join(', ')}`);
+    await Promise.all(targets.map((target) => deployRemoteManifest(target)));
+    console.log('Done. New lambda cold starts will federate these services from S3.');
+};
+export const awsPublish = async (appName, serviceNames) => {
+    await requireAwsCredentials();
+    console.log(`Publishing federated remotes for [${appName}]: ${serviceNames.join(', ')}`);
+    // 1. Build everything first - any build failure bails before any upload,
+    // so the buckets never end up with a half-published set of services.
+    for (const serviceName of serviceNames) {
+        await buildRemote(appName, serviceName);
+    }
+    const targets = serviceNames.map((serviceName) => resolvePublishTarget(appName, serviceName));
+    // 2. Upload all version dirs in parallel - manifests untouched, nothing live yet.
+    await Promise.all(targets.map((target) => uploadRemoteVersion(target)));
+    // 3. Every version dir is fully uploaded - flip the manifests, in parallel.
+    await Promise.all(targets.map((target) => deployRemoteManifest(target)));
+    console.log('Done. New lambda cold starts will federate these services from S3.');
+};
+//# sourceMappingURL=publish.js.map

package/lib/esm/platforms/aws/publish.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"publish.js","sourceRoot":"","sources":["../../../../src/platforms/aws/publish.ts"],"names":[],"mappings":"AAAA,oEAAoE;AACpE,6EAA6E;AAC7E,uDAAuD;AACvD,OAAO,EAAE,qBAAqB,EAAE,MAAM,kBAAkB,CAAC;AACzD,OAAO,EAAE,WAAW,EAAE,oBAAoB,EAAE,oBAAoB,EAAE,mBAAmB,EAAE,MAAM,UAAU,CAAC;AAExG,MAAM,qBAAqB,GAAG,KAAK,IAAmB,EAAE;IACtD,IAAI,CAAC,CAAC,MAAM,qBAAqB,EAAE,CAAC,EAAE,CAAC;QACrC,OAAO,CAAC,KAAK,CAAC,0DAA0D,CAAC,CAAC;QAC1E,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;IAClB,CAAC;AACH,CAAC,CAAC;AAEF,MAAM,CAAC,MAAM,eAAe,GAAG,KAAK,EAAE,OAAe,EAAE,YAAsB,EAAiB,EAAE;IAC9F,OAAO,CAAC,GAAG,CAAC,mCAAmC,OAAO,MAAM,YAAY,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;IAEvF,KAAK,MAAM,WAAW,IAAI,YAAY,EAAE,CAAC;QACvC,MAAM,WAAW,CAAC,OAAO,EAAE,WAAW,CAAC,CAAC;IAC1C,CAAC;IAED,OAAO,CAAC,GAAG,CAAC,0DAA0D,CAAC,CAAC;AAC1E,CAAC,CAAC;AAEF,MAAM,CAAC,MAAM,gBAAgB,GAAG,KAAK,EAAE,OAAe,EAAE,YAAsB,EAAiB,EAAE;IAC/F,MAAM,qBAAqB,EAAE,CAAC;IAE9B,uEAAuE;IACvE,oCAAoC;IACpC,MAAM,OAAO,GAAG,YAAY,CAAC,GAAG,CAAC,CAAC,WAAW,EAAE,EAAE,CAAC,oBAAoB,CAAC,OAAO,EAAE,WAAW,CAAC,CAAC,CAAC;IAE9F,OAAO,CAAC,GAAG,CAAC,oCAAoC,OAAO,MAAM,YAAY,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;IACxF,MAAM,OAAO,CAAC,GAAG,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC,mBAAmB,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC;IAExE,OAAO,CAAC,GAAG,CAAC,mEAAmE,CAAC,CAAC;AACnF,CAAC,CAAC;AAEF,MAAM,CAAC,MAAM,gBAAgB,GAAG,KAAK,EAAE,OAAe,EAAE,YAAsB,EAAiB,EAAE;IAC/F,MAAM,qBAAqB,EAAE,CAAC;IAE9B,MAAM,OAAO,GAAG,YAAY,CAAC,GAAG,CAAC,CAAC,WAAW,EAAE,EAAE,CAAC,oBAAoB,CAAC,OAAO,EAAE,WAAW,CAAC,CAAC,CAAC;IAE9F,OAAO,CAAC,GAAG,CAAC,6CAA6C,OAAO,MAAM,YAAY,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;IACjG,MAAM,OAAO,CAAC,GAAG,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC,oBAAoB,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC;IAEzE,OAAO,CAAC,GAAG,CAAC,oEAAoE,CAAC,CAAC;AACpF,CAAC,CAAC;AAEF,MAAM,CAAC,MAAM,UAAU,GAAG,KAAK,EAAE,OAAe,EAAE,YAAsB,EAAiB,EAAE;IACzF,MAAM,qBAAqB,EAAE,CAAC;IAE9B,OAAO,CAAC,GAAG,CAAC,qCAAqC,OAAO,MAAM,YAAY,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;IAEzF,yEAAyE;IACzE,qEAAqE;IACrE,KAAK,MAAM,WAAW,IAAI,YAAY,EAAE,CAAC;QACvC,MAAM,WAAW,CAAC,OAAO,EAAE,WAAW,CAAC,CAAC;IAC1C,CAAC;IACD,MAAM,OAAO,GAAG,YAAY,CAAC,GAAG,CAAC,CAAC,WAAW,EAAE,EAAE,CAAC,oBAAoB,CAAC,OAAO,EAAE,WAAW,CAAC,CAAC,CAAC;IAE9F,kFAAkF;IAClF,MAAM,OAAO,CAAC,GAAG,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC,mBAAmB,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC;IAExE,4EAA4E;IAC5E,MAAM,OAAO,CAAC,GAAG,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC,oBAAoB,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC;IAEzE,OAAO,CAAC,GAAG,CAAC,oEAAoE,CAAC,CAAC;AACpF,CAAC,CAAC","sourcesContent":["// AWS federated remote publishing — build each backend service as a\n// module-federation remote and publish it into that service's federated code\n// bucket (see ./remote for the three-phase mechanics).\nimport { isAwsCredentialsValid } from './awsCredentials';\nimport { buildRemote, deployRemoteManifest, resolvePublishTarget, uploadRemoteVersion } from './remote';\n\nconst requireAwsCredentials = async (): Promise<void> => {\n  if (!(await isAwsCredentialsValid())) {\n    console.error('AWS credentials are not valid. Configure them and retry.');\n    process.exit(1);\n  }\n};\n\nexport const awsPublishBuild = async (appName: string, serviceNames: string[]): Promise<void> => {\n  console.log(`Building federated remotes for [${appName}]: ${serviceNames.join(', ')}`);\n\n  for (const serviceName of serviceNames) {\n    await buildRemote(appName, serviceName);\n  }\n\n  console.log('Done. Next: qpq publish:upload, then qpq publish:deploy.');\n};\n\nexport const awsPublishUpload = async (appName: string, serviceNames: string[]): Promise<void> => {\n  await requireAwsCredentials();\n\n  // Resolve every target up front - a missing build fails the whole step\n  // before a single byte is uploaded.\n  const targets = serviceNames.map((serviceName) => resolvePublishTarget(appName, serviceName));\n\n  console.log(`Uploading federated remotes for [${appName}]: ${serviceNames.join(', ')}`);\n  await Promise.all(targets.map((target) => uploadRemoteVersion(target)));\n\n  console.log('Done. Run qpq publish:deploy to flip lambdas to the new versions.');\n};\n\nexport const awsPublishDeploy = async (appName: string, serviceNames: string[]): Promise<void> => {\n  await requireAwsCredentials();\n\n  const targets = serviceNames.map((serviceName) => resolvePublishTarget(appName, serviceName));\n\n  console.log(`Deploying federated remote manifests for [${appName}]: ${serviceNames.join(', ')}`);\n  await Promise.all(targets.map((target) => deployRemoteManifest(target)));\n\n  console.log('Done. New lambda cold starts will federate these services from S3.');\n};\n\nexport const awsPublish = async (appName: string, serviceNames: string[]): Promise<void> => {\n  await requireAwsCredentials();\n\n  console.log(`Publishing federated remotes for [${appName}]: ${serviceNames.join(', ')}`);\n\n  // 1. Build everything first - any build failure bails before any upload,\n  // so the buckets never end up with a half-published set of services.\n  for (const serviceName of serviceNames) {\n    await buildRemote(appName, serviceName);\n  }\n  const targets = serviceNames.map((serviceName) => resolvePublishTarget(appName, serviceName));\n\n  // 2. Upload all version dirs in parallel - manifests untouched, nothing live yet.\n  await Promise.all(targets.map((target) => uploadRemoteVersion(target)));\n\n  // 3. Every version dir is fully uploaded - flip the manifests, in parallel.\n  await Promise.all(targets.map((target) => deployRemoteManifest(target)));\n\n  console.log('Done. New lambda cold starts will federate these services from S3.');\n};\n"]}

package/lib/esm/platforms/aws/remote.d.ts

@@ -0,0 +1,11 @@
+export type RemotePublishTarget = {
+    serviceName: string;
+    publishPath: string;
+    manifestHash: string;
+    bucketName: string;
+    servicePrefix: string;
+};
+export declare const buildRemote: (appName: string, serviceName: string) => Promise<void>;
+export declare const resolvePublishTarget: (appName: string, serviceName: string) => RemotePublishTarget;
+export declare const uploadRemoteVersion: (target: RemotePublishTarget) => Promise<void>;
+export declare const deployRemoteManifest: (target: RemotePublishTarget) => Promise<void>;

package/lib/esm/platforms/aws/remote.js

@@ -0,0 +1,89 @@
+// Build a backend service as a module-federation remote and publish it into the
+// shared federated-code storage drive, under the service's own prefix. After this
+// runs, the already-deployed lambdas load their stories from the bucket (quidproquo's
+// dynamicModuleLoader tries the federated store first, falls back to the bundled
+// code when nothing's published).
+//
+// The store is one storage drive shared across services (via `owner`). Each service
+// opts in with defineFederatedModuleStore(<driveName>) and its lambdas read from
+// s3://<bucket>/<service>. Read access comes from the storage drive's own grants, so
+// the drive + a deploy of each service must exist before publishing. The bucket name
+// resolves from the same service config the deploy used, so it always matches.
+//
+// Publishing is split into three phases so they can run as separate commands
+// (publish:build / publish:upload / publish:deploy) or chained by `qpq publish`:
+//   buildRemote          - rspack the remote + lay out service-remote-published/
+//   uploadRemoteVersion  - sync the hashed version dir (everything BUT manifest.json)
+//   deployRemoteManifest - upload manifest.json, atomically flipping lambdas over
+// Version files always land before the manifest that references them, so a reading
+// lambda never sees a manifest whose files aren't all present yet.
+import { awsNamingUtils } from '@qpqjs/actionprocessor-aws';
+import { qpqCoreUtils } from '@qpqjs/core';
+import { getServiceRemoteRspackConfig, publishFederatedRemote, runRspack } from '@qpqjs/deploy-rspack';
+import fs from 'fs';
+import path from 'path';
+import { getRoot, getServiceDirectory } from '../../lib/discovery';
+import { loadServiceQpqConfig } from '../../lib/qpqConfigs';
+import { runCommand } from '../../lib/runCommand';
+const getPublishPath = (appName, serviceName) => path.join(getRoot(), 'dist', 'apps', appName, 'services', serviceName, 'service-remote-published');
+// Resolve the shared store bucket from the service's defineFederatedModuleStore
+// setting (same derivation the lambda env var uses) and the per-service prefix
+// so many services share one bucket.
+const resolveRemoteStore = (appName, serviceName) => {
+    const qpqConfig = loadServiceQpqConfig(appName, serviceName);
+    const federatedStore = qpqCoreUtils.getFederatedModuleStore(qpqConfig);
+    if (!federatedStore) {
+        throw new Error(`service [${serviceName}] has no defineFederatedModuleStore(...) - add it (and the matching storage drive) to opt into federation`);
+    }
+    const storageDrive = qpqCoreUtils.getStorageDriveByName(federatedStore.storageDrive, qpqConfig);
+    if (!storageDrive) {
+        throw new Error(`defineFederatedModuleStore references storage drive [${federatedStore.storageDrive}] which service [${serviceName}] does not declare`);
+    }
+    const bucketName = awsNamingUtils.resolveConfigRuntimeResourceNameFromConfig(storageDrive.owner?.resourceNameOverride || storageDrive.storageDrive, qpqConfig, storageDrive.owner);
+    const servicePrefix = qpqCoreUtils.getApplicationModuleName(qpqConfig);
+    return { bucketName, servicePrefix };
+};
+// Phase 1: rspack the federated remote container and lay out the publishable
+// version dir + manifest.json under service-remote-published/. Validates the
+// federation config up front so a misconfigured service fails before the build.
+export const buildRemote = async (appName, serviceName) => {
+    resolveRemoteStore(appName, serviceName);
+    const serviceDir = path.join(getServiceDirectory(appName, serviceName), 'service');
+    const qpqConfig = loadServiceQpqConfig(appName, serviceName);
+    console.log(`Building federated remote: [${serviceName}]`);
+    const config = getServiceRemoteRspackConfig(qpqConfig, serviceDir);
+    await runRspack(config);
+    const remoteBuildPath = config.output.path;
+    publishFederatedRemote(qpqConfig, remoteBuildPath, getPublishPath(appName, serviceName));
+};
+// Resolve a publish target from a prior buildRemote's on-disk output.
+export const resolvePublishTarget = (appName, serviceName) => {
+    const publishPath = getPublishPath(appName, serviceName);
+    const manifestPath = path.join(publishPath, 'manifest.json');
+    if (!fs.existsSync(manifestPath)) {
+        throw new Error(`no built remote found for [${serviceName}] (missing ${manifestPath}) - run \`qpq publish:build --app ${appName}\` first`);
+    }
+    const manifest = JSON.parse(fs.readFileSync(manifestPath, 'utf-8'));
+    return {
+        serviceName,
+        publishPath,
+        manifestHash: manifest.hash,
+        ...resolveRemoteStore(appName, serviceName),
+    };
+};
+// Phase 2: upload the hashed version dir - everything EXCEPT manifest.json, so
+// nothing referenced by a live manifest changes. Safe to run concurrently across
+// services - each writes only under its own prefix.
+export const uploadRemoteVersion = async (target) => {
+    const { serviceName, publishPath, manifestHash, bucketName, servicePrefix } = target;
+    console.log(`Uploading [${serviceName}] version [${manifestHash}] to [s3://${bucketName}/${servicePrefix}/${manifestHash}]`);
+    await runCommand('aws', ['s3', 'sync', path.join(publishPath, manifestHash), `s3://${bucketName}/${servicePrefix}/${manifestHash}`]);
+};
+// Phase 3: upload manifest.json, the pointer lambdas read - this is the moment
+// the new version goes live. Only run once the version dir is fully uploaded.
+export const deployRemoteManifest = async (target) => {
+    const { serviceName, publishPath, manifestHash, bucketName, servicePrefix } = target;
+    console.log(`Deploying [${serviceName}] manifest for version [${manifestHash}] to [s3://${bucketName}/${servicePrefix}/manifest.json]`);
+    await runCommand('aws', ['s3', 'cp', path.join(publishPath, 'manifest.json'), `s3://${bucketName}/${servicePrefix}/manifest.json`]);
+};
+//# sourceMappingURL=remote.js.map

package/lib/esm/platforms/aws/remote.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"remote.js","sourceRoot":"","sources":["../../../../src/platforms/aws/remote.ts"],"names":[],"mappings":"AAAA,gFAAgF;AAChF,kFAAkF;AAClF,sFAAsF;AACtF,iFAAiF;AACjF,kCAAkC;AAClC,EAAE;AACF,oFAAoF;AACpF,iFAAiF;AACjF,qFAAqF;AACrF,qFAAqF;AACrF,+EAA+E;AAC/E,EAAE;AACF,6EAA6E;AAC7E,iFAAiF;AACjF,iFAAiF;AACjF,sFAAsF;AACtF,kFAAkF;AAClF,mFAAmF;AACnF,mEAAmE;AACnE,OAAO,EAAE,cAAc,EAAE,MAAM,4BAA4B,CAAC;AAC5D,OAAO,EAAE,YAAY,EAAE,MAAM,aAAa,CAAC;AAC3C,OAAO,EAAE,4BAA4B,EAAE,sBAAsB,EAAE,SAAS,EAAE,MAAM,sBAAsB,CAAC;AAEvG,OAAO,EAAE,MAAM,IAAI,CAAC;AACpB,OAAO,IAAI,MAAM,MAAM,CAAC;AAExB,OAAO,EAAE,OAAO,EAAE,mBAAmB,EAAE,MAAM,qBAAqB,CAAC;AACnE,OAAO,EAAE,oBAAoB,EAAE,MAAM,sBAAsB,CAAC;AAC5D,OAAO,EAAE,UAAU,EAAE,MAAM,sBAAsB,CAAC;AAalD,MAAM,cAAc,GAAG,CAAC,OAAe,EAAE,WAAmB,EAAU,EAAE,CACtE,IAAI,CAAC,IAAI,CAAC,OAAO,EAAE,EAAE,MAAM,EAAE,MAAM,EAAE,OAAO,EAAE,UAAU,EAAE,WAAW,EAAE,0BAA0B,CAAC,CAAC;AAErG,gFAAgF;AAChF,+EAA+E;AAC/E,qCAAqC;AACrC,MAAM,kBAAkB,GAAG,CAAC,OAAe,EAAE,WAAmB,EAAiD,EAAE;IACjH,MAAM,SAAS,GAAG,oBAAoB,CAAC,OAAO,EAAE,WAAW,CAAC,CAAC;IAE7D,MAAM,cAAc,GAAG,YAAY,CAAC,uBAAuB,CAAC,SAAS,CAAC,CAAC;IACvE,IAAI,CAAC,cAAc,EAAE,CAAC;QACpB,MAAM,IAAI,KAAK,CACb,YAAY,WAAW,2GAA2G,CACnI,CAAC;IACJ,CAAC;IACD,MAAM,YAAY,GAAG,YAAY,CAAC,qBAAqB,CAAC,cAAc,CAAC,YAAY,EAAE,SAAS,CAAC,CAAC;IAChG,IAAI,CAAC,YAAY,EAAE,CAAC;QAClB,MAAM,IAAI,KAAK,CACb,wDAAwD,cAAc,CAAC,YAAY,oBAAoB,WAAW,oBAAoB,CACvI,CAAC;IACJ,CAAC;IACD,MAAM,UAAU,GAAG,cAAc,CAAC,0CAA0C,CAC1E,YAAY,CAAC,KAAK,EAAE,oBAAoB,IAAI,YAAY,CAAC,YAAY,EACrE,SAAS,EACT,YAAY,CAAC,KAAK,CACnB,CAAC;IACF,MAAM,aAAa,GAAG,YAAY,CAAC,wBAAwB,CAAC,SAAS,CAAC,CAAC;IAEvE,OAAO,EAAE,UAAU,EAAE,aAAa,EAAE,CAAC;AACvC,CAAC,CAAC;AAEF,6EAA6E;AAC7E,6EAA6E;AAC7E,gFAAgF;AAChF,MAAM,CAAC,MAAM,WAAW,GAAG,KAAK,EAAE,OAAe,EAAE,WAAmB,EAAiB,EAAE;IACvF,kBAAkB,CAAC,OAAO,EAAE,WAAW,CAAC,CAAC;IAEzC,MAAM,UAAU,GAAG,IAAI,CAAC,IAAI,CAAC,mBAAmB,CAAC,OAAO,EAAE,WAAW,CAAC,EAAE,SAAS,CAAC,CAAC;IACnF,MAAM,SAAS,GAAG,oBAAoB,CAAC,OAAO,EAAE,WAAW,CAAC,CAAC;IAE7D,OAAO,CAAC,GAAG,CAAC,+BAA+B,WAAW,GAAG,CAAC,CAAC;IAC3D,MAAM,MAAM,GAAG,4BAA4B,CAAC,SAAS,EAAE,UAAU,CAAC,CAAC;IACnE,MAAM,SAAS,CAAC,MAAM,CAAC,CAAC;IAExB,MAAM,eAAe,GAAG,MAAM,CAAC,MAAO,CAAC,IAAc,CAAC;IACtD,sBAAsB,CAAC,SAAS,EAAE,eAAe,EAAE,cAAc,CAAC,OAAO,EAAE,WAAW,CAAC,CAAC,CAAC;AAC3F,CAAC,CAAC;AAEF,sEAAsE;AACtE,MAAM,CAAC,MAAM,oBAAoB,GAAG,CAAC,OAAe,EAAE,WAAmB,EAAuB,EAAE;IAChG,MAAM,WAAW,GAAG,cAAc,CAAC,OAAO,EAAE,WAAW,CAAC,CAAC;IACzD,MAAM,YAAY,GAAG,IAAI,CAAC,IAAI,CAAC,WAAW,EAAE,eAAe,CAAC,CAAC;IAE7D,IAAI,CAAC,EAAE,CAAC,UAAU,CAAC,YAAY,CAAC,EAAE,CAAC;QACjC,MAAM,IAAI,KAAK,CAAC,8BAA8B,WAAW,cAAc,YAAY,qCAAqC,OAAO,UAAU,CAAC,CAAC;IAC7I,CAAC;IACD,MAAM,QAAQ,GAAG,IAAI,CAAC,KAAK,CAAC,EAAE,CAAC,YAAY,CAAC,YAAY,EAAE,OAAO,CAAC,CAEjE,CAAC;IAEF,OAAO;QACL,WAAW;QACX,WAAW;QACX,YAAY,EAAE,QAAQ,CAAC,IAAI;QAC3B,GAAG,kBAAkB,CAAC,OAAO,EAAE,WAAW,CAAC;KAC5C,CAAC;AACJ,CAAC,CAAC;AAEF,+EAA+E;AAC/E,iFAAiF;AACjF,oDAAoD;AACpD,MAAM,CAAC,MAAM,mBAAmB,GAAG,KAAK,EAAE,MAA2B,EAAiB,EAAE;IACtF,MAAM,EAAE,WAAW,EAAE,WAAW,EAAE,YAAY,EAAE,UAAU,EAAE,aAAa,EAAE,GAAG,MAAM,CAAC;IAErF,OAAO,CAAC,GAAG,CAAC,cAAc,WAAW,cAAc,YAAY,cAAc,UAAU,IAAI,aAAa,IAAI,YAAY,GAAG,CAAC,CAAC;IAC7H,MAAM,UAAU,CAAC,KAAK,EAAE,CAAC,IAAI,EAAE,MAAM,EAAE,IAAI,CAAC,IAAI,CAAC,WAAW,EAAE,YAAY,CAAC,EAAE,QAAQ,UAAU,IAAI,aAAa,IAAI,YAAY,EAAE,CAAC,CAAC,CAAC;AACvI,CAAC,CAAC;AAEF,+EAA+E;AAC/E,8EAA8E;AAC9E,MAAM,CAAC,MAAM,oBAAoB,GAAG,KAAK,EAAE,MAA2B,EAAiB,EAAE;IACvF,MAAM,EAAE,WAAW,EAAE,WAAW,EAAE,YAAY,EAAE,UAAU,EAAE,aAAa,EAAE,GAAG,MAAM,CAAC;IAErF,OAAO,CAAC,GAAG,CAAC,cAAc,WAAW,2BAA2B,YAAY,cAAc,UAAU,IAAI,aAAa,iBAAiB,CAAC,CAAC;IACxI,MAAM,UAAU,CAAC,KAAK,EAAE,CAAC,IAAI,EAAE,IAAI,EAAE,IAAI,CAAC,IAAI,CAAC,WAAW,EAAE,eAAe,CAAC,EAAE,QAAQ,UAAU,IAAI,aAAa,gBAAgB,CAAC,CAAC,CAAC;AACtI,CAAC,CAAC","sourcesContent":["// Build a backend service as a module-federation remote and publish it into the\n// shared federated-code storage drive, under the service's own prefix. After this\n// runs, the already-deployed lambdas load their stories from the bucket (quidproquo's\n// dynamicModuleLoader tries the federated store first, falls back to the bundled\n// code when nothing's published).\n//\n// The store is one storage drive shared across services (via `owner`). Each service\n// opts in with defineFederatedModuleStore(<driveName>) and its lambdas read from\n// s3://<bucket>/<service>. Read access comes from the storage drive's own grants, so\n// the drive + a deploy of each service must exist before publishing. The bucket name\n// resolves from the same service config the deploy used, so it always matches.\n//\n// Publishing is split into three phases so they can run as separate commands\n// (publish:build / publish:upload / publish:deploy) or chained by `qpq publish`:\n//   buildRemote          - rspack the remote + lay out service-remote-published/\n//   uploadRemoteVersion  - sync the hashed version dir (everything BUT manifest.json)\n//   deployRemoteManifest - upload manifest.json, atomically flipping lambdas over\n// Version files always land before the manifest that references them, so a reading\n// lambda never sees a manifest whose files aren't all present yet.\nimport { awsNamingUtils } from '@qpqjs/actionprocessor-aws';\nimport { qpqCoreUtils } from '@qpqjs/core';\nimport { getServiceRemoteRspackConfig, publishFederatedRemote, runRspack } from '@qpqjs/deploy-rspack';\n\nimport fs from 'fs';\nimport path from 'path';\n\nimport { getRoot, getServiceDirectory } from '../../lib/discovery';\nimport { loadServiceQpqConfig } from '../../lib/qpqConfigs';\nimport { runCommand } from '../../lib/runCommand';\n\n// Everything the upload/deploy phases need to publish a built remote. Resolved\n// from the on-disk build output + service config, so each phase can run in its\n// own process without handing state between commands.\nexport type RemotePublishTarget = {\n  serviceName: string;\n  publishPath: string;\n  manifestHash: string;\n  bucketName: string;\n  servicePrefix: string;\n};\n\nconst getPublishPath = (appName: string, serviceName: string): string =>\n  path.join(getRoot(), 'dist', 'apps', appName, 'services', serviceName, 'service-remote-published');\n\n// Resolve the shared store bucket from the service's defineFederatedModuleStore\n// setting (same derivation the lambda env var uses) and the per-service prefix\n// so many services share one bucket.\nconst resolveRemoteStore = (appName: string, serviceName: string): { bucketName: string; servicePrefix: string } => {\n  const qpqConfig = loadServiceQpqConfig(appName, serviceName);\n\n  const federatedStore = qpqCoreUtils.getFederatedModuleStore(qpqConfig);\n  if (!federatedStore) {\n    throw new Error(\n      `service [${serviceName}] has no defineFederatedModuleStore(...) - add it (and the matching storage drive) to opt into federation`,\n    );\n  }\n  const storageDrive = qpqCoreUtils.getStorageDriveByName(federatedStore.storageDrive, qpqConfig);\n  if (!storageDrive) {\n    throw new Error(\n      `defineFederatedModuleStore references storage drive [${federatedStore.storageDrive}] which service [${serviceName}] does not declare`,\n    );\n  }\n  const bucketName = awsNamingUtils.resolveConfigRuntimeResourceNameFromConfig(\n    storageDrive.owner?.resourceNameOverride || storageDrive.storageDrive,\n    qpqConfig,\n    storageDrive.owner,\n  );\n  const servicePrefix = qpqCoreUtils.getApplicationModuleName(qpqConfig);\n\n  return { bucketName, servicePrefix };\n};\n\n// Phase 1: rspack the federated remote container and lay out the publishable\n// version dir + manifest.json under service-remote-published/. Validates the\n// federation config up front so a misconfigured service fails before the build.\nexport const buildRemote = async (appName: string, serviceName: string): Promise<void> => {\n  resolveRemoteStore(appName, serviceName);\n\n  const serviceDir = path.join(getServiceDirectory(appName, serviceName), 'service');\n  const qpqConfig = loadServiceQpqConfig(appName, serviceName);\n\n  console.log(`Building federated remote: [${serviceName}]`);\n  const config = getServiceRemoteRspackConfig(qpqConfig, serviceDir);\n  await runRspack(config);\n\n  const remoteBuildPath = config.output!.path as string;\n  publishFederatedRemote(qpqConfig, remoteBuildPath, getPublishPath(appName, serviceName));\n};\n\n// Resolve a publish target from a prior buildRemote's on-disk output.\nexport const resolvePublishTarget = (appName: string, serviceName: string): RemotePublishTarget => {\n  const publishPath = getPublishPath(appName, serviceName);\n  const manifestPath = path.join(publishPath, 'manifest.json');\n\n  if (!fs.existsSync(manifestPath)) {\n    throw new Error(`no built remote found for [${serviceName}] (missing ${manifestPath}) - run \\`qpq publish:build --app ${appName}\\` first`);\n  }\n  const manifest = JSON.parse(fs.readFileSync(manifestPath, 'utf-8')) as {\n    hash: string;\n  };\n\n  return {\n    serviceName,\n    publishPath,\n    manifestHash: manifest.hash,\n    ...resolveRemoteStore(appName, serviceName),\n  };\n};\n\n// Phase 2: upload the hashed version dir - everything EXCEPT manifest.json, so\n// nothing referenced by a live manifest changes. Safe to run concurrently across\n// services - each writes only under its own prefix.\nexport const uploadRemoteVersion = async (target: RemotePublishTarget): Promise<void> => {\n  const { serviceName, publishPath, manifestHash, bucketName, servicePrefix } = target;\n\n  console.log(`Uploading [${serviceName}] version [${manifestHash}] to [s3://${bucketName}/${servicePrefix}/${manifestHash}]`);\n  await runCommand('aws', ['s3', 'sync', path.join(publishPath, manifestHash), `s3://${bucketName}/${servicePrefix}/${manifestHash}`]);\n};\n\n// Phase 3: upload manifest.json, the pointer lambdas read - this is the moment\n// the new version goes live. Only run once the version dir is fully uploaded.\nexport const deployRemoteManifest = async (target: RemotePublishTarget): Promise<void> => {\n  const { serviceName, publishPath, manifestHash, bucketName, servicePrefix } = target;\n\n  console.log(`Deploying [${serviceName}] manifest for version [${manifestHash}] to [s3://${bucketName}/${servicePrefix}/manifest.json]`);\n  await runCommand('aws', ['s3', 'cp', path.join(publishPath, 'manifest.json'), `s3://${bucketName}/${servicePrefix}/manifest.json`]);\n};\n"]}

package/lib/esm/platforms/aws/setup/awsSetupContext.d.ts

@@ -0,0 +1,12 @@
+import { QPQConfig } from '@qpqjs/core';
+/** Everything the AWS setup steps share: the target account/region and the app's configs. */
+export type AwsSetupContext = {
+    appName: string;
+    environment: string;
+    accountId: string;
+    region: string;
+    accountQpqConfig: QPQConfig;
+    bootstrapQpqConfig: QPQConfig;
+    serviceQpqConfigs: QPQConfig[];
+};
+export declare const buildAwsSetupContext: (appName: string, deploymentName: string) => AwsSetupContext;

package/lib/esm/platforms/aws/setup/awsSetupContext.js

@@ -0,0 +1,16 @@
+import { getQpqAppDeployContext, getWorkspaceAccountQpqConfig, getWorkspaceBootstrapQpqConfig } from '@qpqjs/deploy-aws';
+import { getRoot, getServiceNames } from '../../../lib/discovery';
+import { loadServiceQpqConfig } from '../../../lib/qpqConfigs';
+export const buildAwsSetupContext = (appName, deploymentName) => {
+    const ctx = getQpqAppDeployContext(getRoot(), appName, deploymentName);
+    return {
+        appName,
+        environment: ctx.environment,
+        accountId: ctx.accountId,
+        region: ctx.region,
+        accountQpqConfig: getWorkspaceAccountQpqConfig(ctx),
+        bootstrapQpqConfig: getWorkspaceBootstrapQpqConfig(ctx),
+        serviceQpqConfigs: getServiceNames(appName).map((service) => loadServiceQpqConfig(appName, service)),
+    };
+};
+//# sourceMappingURL=awsSetupContext.js.map

package/lib/esm/platforms/aws/setup/awsSetupContext.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"awsSetupContext.js","sourceRoot":"","sources":["../../../../../src/platforms/aws/setup/awsSetupContext.ts"],"names":[],"mappings":"AACA,OAAO,EAAE,sBAAsB,EAAE,4BAA4B,EAAE,8BAA8B,EAAE,MAAM,mBAAmB,CAAC;AAEzH,OAAO,EAAE,OAAO,EAAE,eAAe,EAAE,MAAM,wBAAwB,CAAC;AAClE,OAAO,EAAE,oBAAoB,EAAE,MAAM,yBAAyB,CAAC;AAa/D,MAAM,CAAC,MAAM,oBAAoB,GAAG,CAAC,OAAe,EAAE,cAAsB,EAAmB,EAAE;IAC/F,MAAM,GAAG,GAAG,sBAAsB,CAAC,OAAO,EAAE,EAAE,OAAO,EAAE,cAAc,CAAC,CAAC;IAEvE,OAAO;QACL,OAAO;QACP,WAAW,EAAE,GAAG,CAAC,WAAW;QAC5B,SAAS,EAAE,GAAG,CAAC,SAAS;QACxB,MAAM,EAAE,GAAG,CAAC,MAAM;QAClB,gBAAgB,EAAE,4BAA4B,CAAC,GAAG,CAAC;QACnD,kBAAkB,EAAE,8BAA8B,CAAC,GAAG,CAAC;QACvD,iBAAiB,EAAE,eAAe,CAAC,OAAO,CAAC,CAAC,GAAG,CAAC,CAAC,OAAO,EAAE,EAAE,CAAC,oBAAoB,CAAC,OAAO,EAAE,OAAO,CAAC,CAAC;KACrG,CAAC;AACJ,CAAC,CAAC","sourcesContent":["import { QPQConfig } from '@qpqjs/core';\nimport { getQpqAppDeployContext, getWorkspaceAccountQpqConfig, getWorkspaceBootstrapQpqConfig } from '@qpqjs/deploy-aws';\n\nimport { getRoot, getServiceNames } from '../../../lib/discovery';\nimport { loadServiceQpqConfig } from '../../../lib/qpqConfigs';\n\n/** Everything the AWS setup steps share: the target account/region and the app's configs. */\nexport type AwsSetupContext = {\n  appName: string;\n  environment: string;\n  accountId: string;\n  region: string;\n  accountQpqConfig: QPQConfig;\n  bootstrapQpqConfig: QPQConfig;\n  serviceQpqConfigs: QPQConfig[];\n};\n\nexport const buildAwsSetupContext = (appName: string, deploymentName: string): AwsSetupContext => {\n  const ctx = getQpqAppDeployContext(getRoot(), appName, deploymentName);\n\n  return {\n    appName,\n    environment: ctx.environment,\n    accountId: ctx.accountId,\n    region: ctx.region,\n    accountQpqConfig: getWorkspaceAccountQpqConfig(ctx),\n    bootstrapQpqConfig: getWorkspaceBootstrapQpqConfig(ctx),\n    serviceQpqConfigs: getServiceNames(appName).map((service) => loadServiceQpqConfig(appName, service)),\n  };\n};\n"]}

package/lib/esm/platforms/aws/setup/awsSetupSteps.d.ts

@@ -0,0 +1,8 @@
+import { SetupStep } from '../../../lib/setupStep';
+/**
+ * The AWS checklist, in the order it must run: prerequisites that only check, the CDK
+ * toolkit per region, then the app-wide stacks (the account stack creates the GitHub OIDC
+ * provider, the bootstrap stack the GitHub deploy role). Services are deployed separately
+ * with `qpq go` / `qpq go:docker`, which is where the time goes and where parallelism lives.
+ */
+export declare const awsSetupSteps: (appName: string, deploymentName: string) => Promise<SetupStep[]>;

package/lib/esm/platforms/aws/setup/awsSetupSteps.js

@@ -0,0 +1,31 @@
+import { buildAwsSetupContext } from './awsSetupContext';
+import { buildBucketNamesStep } from './buildBucketNamesStep';
+import { buildCdkBootstrapSteps } from './buildCdkBootstrapSteps';
+import { buildGithubDeployRoleStep } from './buildGithubDeployRoleStep';
+import { buildGithubOidcProviderStep } from './buildGithubOidcProviderStep';
+import { buildHostedZonesStep } from './buildHostedZonesStep';
+import { buildIamCapabilityStep } from './buildIamCapabilityStep';
+import { buildIdentityStep } from './buildIdentityStep';
+import { buildAccountStackStep, buildBootstrapStackStep, buildDomainStackStep } from './buildStackSteps';
+/**
+ * The AWS checklist, in the order it must run: prerequisites that only check, the CDK
+ * toolkit per region, then the app-wide stacks (the account stack creates the GitHub OIDC
+ * provider, the bootstrap stack the GitHub deploy role). Services are deployed separately
+ * with `qpq go` / `qpq go:docker`, which is where the time goes and where parallelism lives.
+ */
+export const awsSetupSteps = async (appName, deploymentName) => {
+    const ctx = buildAwsSetupContext(appName, deploymentName);
+    return [
+        buildIdentityStep(ctx),
+        buildIamCapabilityStep(ctx),
+        buildHostedZonesStep(ctx),
+        buildBucketNamesStep(ctx),
+        ...buildCdkBootstrapSteps(ctx),
+        buildAccountStackStep(ctx),
+        buildGithubOidcProviderStep(ctx),
+        buildDomainStackStep(ctx),
+        buildBootstrapStackStep(ctx),
+        buildGithubDeployRoleStep(ctx),
+    ];
+};
+//# sourceMappingURL=awsSetupSteps.js.map

package/lib/esm/platforms/aws/setup/awsSetupSteps.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"awsSetupSteps.js","sourceRoot":"","sources":["../../../../../src/platforms/aws/setup/awsSetupSteps.ts"],"names":[],"mappings":"AACA,OAAO,EAAE,oBAAoB,EAAE,MAAM,mBAAmB,CAAC;AACzD,OAAO,EAAE,oBAAoB,EAAE,MAAM,wBAAwB,CAAC;AAC9D,OAAO,EAAE,sBAAsB,EAAE,MAAM,0BAA0B,CAAC;AAClE,OAAO,EAAE,yBAAyB,EAAE,MAAM,6BAA6B,CAAC;AACxE,OAAO,EAAE,2BAA2B,EAAE,MAAM,+BAA+B,CAAC;AAC5E,OAAO,EAAE,oBAAoB,EAAE,MAAM,wBAAwB,CAAC;AAC9D,OAAO,EAAE,sBAAsB,EAAE,MAAM,0BAA0B,CAAC;AAClE,OAAO,EAAE,iBAAiB,EAAE,MAAM,qBAAqB,CAAC;AACxD,OAAO,EAAE,qBAAqB,EAAE,uBAAuB,EAAE,oBAAoB,EAAE,MAAM,mBAAmB,CAAC;AAEzG;;;;;GAKG;AACH,MAAM,CAAC,MAAM,aAAa,GAAG,KAAK,EAAE,OAAe,EAAE,cAAsB,EAAwB,EAAE;IACnG,MAAM,GAAG,GAAG,oBAAoB,CAAC,OAAO,EAAE,cAAc,CAAC,CAAC;IAE1D,OAAO;QACL,iBAAiB,CAAC,GAAG,CAAC;QACtB,sBAAsB,CAAC,GAAG,CAAC;QAC3B,oBAAoB,CAAC,GAAG,CAAC;QACzB,oBAAoB,CAAC,GAAG,CAAC;QACzB,GAAG,sBAAsB,CAAC,GAAG,CAAC;QAC9B,qBAAqB,CAAC,GAAG,CAAC;QAC1B,2BAA2B,CAAC,GAAG,CAAC;QAChC,oBAAoB,CAAC,GAAG,CAAC;QACzB,uBAAuB,CAAC,GAAG,CAAC;QAC5B,yBAAyB,CAAC,GAAG,CAAC;KAC/B,CAAC;AACJ,CAAC,CAAC","sourcesContent":["import { SetupStep } from '../../../lib/setupStep';\nimport { buildAwsSetupContext } from './awsSetupContext';\nimport { buildBucketNamesStep } from './buildBucketNamesStep';\nimport { buildCdkBootstrapSteps } from './buildCdkBootstrapSteps';\nimport { buildGithubDeployRoleStep } from './buildGithubDeployRoleStep';\nimport { buildGithubOidcProviderStep } from './buildGithubOidcProviderStep';\nimport { buildHostedZonesStep } from './buildHostedZonesStep';\nimport { buildIamCapabilityStep } from './buildIamCapabilityStep';\nimport { buildIdentityStep } from './buildIdentityStep';\nimport { buildAccountStackStep, buildBootstrapStackStep, buildDomainStackStep } from './buildStackSteps';\n\n/**\n * The AWS checklist, in the order it must run: prerequisites that only check, the CDK\n * toolkit per region, then the app-wide stacks (the account stack creates the GitHub OIDC\n * provider, the bootstrap stack the GitHub deploy role). Services are deployed separately\n * with `qpq go` / `qpq go:docker`, which is where the time goes and where parallelism lives.\n */\nexport const awsSetupSteps = async (appName: string, deploymentName: string): Promise<SetupStep[]> => {\n  const ctx = buildAwsSetupContext(appName, deploymentName);\n\n  return [\n    buildIdentityStep(ctx),\n    buildIamCapabilityStep(ctx),\n    buildHostedZonesStep(ctx),\n    buildBucketNamesStep(ctx),\n    ...buildCdkBootstrapSteps(ctx),\n    buildAccountStackStep(ctx),\n    buildGithubOidcProviderStep(ctx),\n    buildDomainStackStep(ctx),\n    buildBootstrapStackStep(ctx),\n    buildGithubDeployRoleStep(ctx),\n  ];\n};\n"]}

package/lib/esm/platforms/aws/setup/buildBucketNamesStep.d.ts

@@ -0,0 +1,4 @@
+import { SetupStep } from '../../../lib/setupStep';
+import { AwsSetupContext } from './awsSetupContext';
+/** Check-only: no bucket the deploy will create is already taken by another AWS account. */
+export declare const buildBucketNamesStep: (ctx: AwsSetupContext) => SetupStep;

package/lib/esm/platforms/aws/setup/buildBucketNamesStep.js

@@ -0,0 +1,62 @@
+import { awsNamingUtils } from '@qpqjs/actionprocessor-aws';
+import { qpqCoreUtils } from '@qpqjs/core';
+import { qpqWebServerUtils } from '@qpqjs/webserver';
+import { HeadBucketCommand, S3Client } from '@aws-sdk/client-s3';
+// Every bucket a service deploy creates, named the way the constructs name them.
+const getServiceBucketNames = (qpqConfig) => [
+    ...qpqCoreUtils
+        .getOwnedItems(qpqCoreUtils.getStorageDrives(qpqConfig), qpqConfig)
+        .map((drive) => awsNamingUtils.getConfigRuntimeResourceNameFromConfig(drive.storageDrive, qpqConfig)),
+    ...qpqWebServerUtils
+        .getWebEntryConfigs(qpqConfig)
+        .filter((webEntry) => !webEntry.storageDrive.sourceStorageDrive)
+        .map((webEntry) => awsNamingUtils.getQpqRuntimeResourceNameFromConfig(webEntry.name, qpqConfig, 'we')),
+];
+// HeadBucket: 404 means free, 200 ours, 403 exists in another account.
+const getBucketOwner = async (client, bucketName) => {
+    try {
+        await client.send(new HeadBucketCommand({ Bucket: bucketName }));
+        return 'ours';
+    }
+    catch (error) {
+        const status = error.$metadata?.httpStatusCode;
+        if (status === 404) {
+            return 'free';
+        }
+        if (status === 403 || status === 301) {
+            return 'other';
+        }
+        throw error;
+    }
+};
+// S3 bucket names are global and the framework names them from app, service and
+// environment alone, so a second account cannot reuse a name the first still holds.
+const checkBucketNames = async (ctx) => {
+    const names = [...new Set(ctx.serviceQpqConfigs.flatMap(getServiceBucketNames))];
+    const client = new S3Client({ region: ctx.region });
+    const taken = [];
+    let ours = 0;
+    for (const name of names) {
+        const owner = await getBucketOwner(client, name);
+        if (owner === 'other')
+            taken.push(name);
+        if (owner === 'ours')
+            ours += 1;
+    }
+    return taken.length === 0
+        ? { done: true, detail: `${names.length} bucket name(s) available or already ours (${ours} existing)` }
+        : { done: false, detail: `held by another account: ${taken.join(', ')}; delete them there or change the app prefix` };
+};
+/** Check-only: no bucket the deploy will create is already taken by another AWS account. */
+export const buildBucketNamesStep = (ctx) => ({
+    id: 'bucket-names',
+    name: 'S3 bucket names available',
+    check: () => checkBucketNames(ctx),
+    run: async () => {
+        const result = await checkBucketNames(ctx);
+        if (!result.done) {
+            throw new Error(result.detail ?? 'bucket names taken');
+        }
+    },
+});
+//# sourceMappingURL=buildBucketNamesStep.js.map

package/lib/esm/platforms/aws/setup/buildBucketNamesStep.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"buildBucketNamesStep.js","sourceRoot":"","sources":["../../../../../src/platforms/aws/setup/buildBucketNamesStep.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,cAAc,EAAE,MAAM,4BAA4B,CAAC;AAC5D,OAAO,EAAa,YAAY,EAAE,MAAM,aAAa,CAAC;AACtD,OAAO,EAAE,iBAAiB,EAAE,MAAM,kBAAkB,CAAC;AAErD,OAAO,EAAE,iBAAiB,EAAE,QAAQ,EAAE,MAAM,oBAAoB,CAAC;AAKjE,iFAAiF;AACjF,MAAM,qBAAqB,GAAG,CAAC,SAAoB,EAAY,EAAE,CAAC;IAChE,GAAG,YAAY;SACZ,aAAa,CAAC,YAAY,CAAC,gBAAgB,CAAC,SAAS,CAAC,EAAE,SAAS,CAAC;SAClE,GAAG,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,cAAc,CAAC,sCAAsC,CAAC,KAAK,CAAC,YAAY,EAAE,SAAS,CAAC,CAAC;IACvG,GAAG,iBAAiB;SACjB,kBAAkB,CAAC,SAAS,CAAC;SAC7B,MAAM,CAAC,CAAC,QAAQ,EAAE,EAAE,CAAC,CAAC,QAAQ,CAAC,YAAY,CAAC,kBAAkB,CAAC;SAC/D,GAAG,CAAC,CAAC,QAAQ,EAAE,EAAE,CAAC,cAAc,CAAC,mCAAmC,CAAC,QAAQ,CAAC,IAAI,EAAE,SAAS,EAAE,IAAI,CAAC,CAAC;CACzG,CAAC;AAIF,uEAAuE;AACvE,MAAM,cAAc,GAAG,KAAK,EAAE,MAAgB,EAAE,UAAkB,EAAwB,EAAE;IAC1F,IAAI,CAAC;QACH,MAAM,MAAM,CAAC,IAAI,CAAC,IAAI,iBAAiB,CAAC,EAAE,MAAM,EAAE,UAAU,EAAE,CAAC,CAAC,CAAC;QACjE,OAAO,MAAM,CAAC;IAChB,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,MAAM,MAAM,GAAI,KAAqD,CAAC,SAAS,EAAE,cAAc,CAAC;QAChG,IAAI,MAAM,KAAK,GAAG,EAAE,CAAC;YACnB,OAAO,MAAM,CAAC;QAChB,CAAC;QACD,IAAI,MAAM,KAAK,GAAG,IAAI,MAAM,KAAK,GAAG,EAAE,CAAC;YACrC,OAAO,OAAO,CAAC;QACjB,CAAC;QACD,MAAM,KAAK,CAAC;IACd,CAAC;AACH,CAAC,CAAC;AAEF,gFAAgF;AAChF,oFAAoF;AACpF,MAAM,gBAAgB,GAAG,KAAK,EAAE,GAAoB,EAA6B,EAAE;IACjF,MAAM,KAAK,GAAG,CAAC,GAAG,IAAI,GAAG,CAAC,GAAG,CAAC,iBAAiB,CAAC,OAAO,CAAC,qBAAqB,CAAC,CAAC,CAAC,CAAC;IACjF,MAAM,MAAM,GAAG,IAAI,QAAQ,CAAC,EAAE,MAAM,EAAE,GAAG,CAAC,MAAM,EAAE,CAAC,CAAC;IAEpD,MAAM,KAAK,GAAa,EAAE,CAAC;IAC3B,IAAI,IAAI,GAAG,CAAC,CAAC;IACb,KAAK,MAAM,IAAI,IAAI,KAAK,EAAE,CAAC;QACzB,MAAM,KAAK,GAAG,MAAM,cAAc,CAAC,MAAM,EAAE,IAAI,CAAC,CAAC;QACjD,IAAI,KAAK,KAAK,OAAO;YAAE,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;QACxC,IAAI,KAAK,KAAK,MAAM;YAAE,IAAI,IAAI,CAAC,CAAC;IAClC,CAAC;IAED,OAAO,KAAK,CAAC,MAAM,KAAK,CAAC;QACvB,CAAC,CAAC,EAAE,IAAI,EAAE,IAAI,EAAE,MAAM,EAAE,GAAG,KAAK,CAAC,MAAM,8CAA8C,IAAI,YAAY,EAAE;QACvG,CAAC,CAAC,EAAE,IAAI,EAAE,KAAK,EAAE,MAAM,EAAE,4BAA4B,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,8CAA8C,EAAE,CAAC;AAC1H,CAAC,CAAC;AAEF,4FAA4F;AAC5F,MAAM,CAAC,MAAM,oBAAoB,GAAG,CAAC,GAAoB,EAAa,EAAE,CAAC,CAAC;IACxE,EAAE,EAAE,cAAc;IAClB,IAAI,EAAE,2BAA2B;IACjC,KAAK,EAAE,GAAG,EAAE,CAAC,gBAAgB,CAAC,GAAG,CAAC;IAClC,GAAG,EAAE,KAAK,IAAI,EAAE;QACd,MAAM,MAAM,GAAG,MAAM,gBAAgB,CAAC,GAAG,CAAC,CAAC;QAC3C,IAAI,CAAC,MAAM,CAAC,IAAI,EAAE,CAAC;YACjB,MAAM,IAAI,KAAK,CAAC,MAAM,CAAC,MAAM,IAAI,oBAAoB,CAAC,CAAC;QACzD,CAAC;IACH,CAAC;CACF,CAAC,CAAC","sourcesContent":["import { awsNamingUtils } from '@qpqjs/actionprocessor-aws';\nimport { QPQConfig, qpqCoreUtils } from '@qpqjs/core';\nimport { qpqWebServerUtils } from '@qpqjs/webserver';\n\nimport { HeadBucketCommand, S3Client } from '@aws-sdk/client-s3';\n\nimport { SetupCheckResult, SetupStep } from '../../../lib/setupStep';\nimport { AwsSetupContext } from './awsSetupContext';\n\n// Every bucket a service deploy creates, named the way the constructs name them.\nconst getServiceBucketNames = (qpqConfig: QPQConfig): string[] => [\n  ...qpqCoreUtils\n    .getOwnedItems(qpqCoreUtils.getStorageDrives(qpqConfig), qpqConfig)\n    .map((drive) => awsNamingUtils.getConfigRuntimeResourceNameFromConfig(drive.storageDrive, qpqConfig)),\n  ...qpqWebServerUtils\n    .getWebEntryConfigs(qpqConfig)\n    .filter((webEntry) => !webEntry.storageDrive.sourceStorageDrive)\n    .map((webEntry) => awsNamingUtils.getQpqRuntimeResourceNameFromConfig(webEntry.name, qpqConfig, 'we')),\n];\n\ntype BucketOwner = 'free' | 'ours' | 'other';\n\n// HeadBucket: 404 means free, 200 ours, 403 exists in another account.\nconst getBucketOwner = async (client: S3Client, bucketName: string): Promise<BucketOwner> => {\n  try {\n    await client.send(new HeadBucketCommand({ Bucket: bucketName }));\n    return 'ours';\n  } catch (error) {\n    const status = (error as { $metadata?: { httpStatusCode?: number } }).$metadata?.httpStatusCode;\n    if (status === 404) {\n      return 'free';\n    }\n    if (status === 403 || status === 301) {\n      return 'other';\n    }\n    throw error;\n  }\n};\n\n// S3 bucket names are global and the framework names them from app, service and\n// environment alone, so a second account cannot reuse a name the first still holds.\nconst checkBucketNames = async (ctx: AwsSetupContext): Promise<SetupCheckResult> => {\n  const names = [...new Set(ctx.serviceQpqConfigs.flatMap(getServiceBucketNames))];\n  const client = new S3Client({ region: ctx.region });\n\n  const taken: string[] = [];\n  let ours = 0;\n  for (const name of names) {\n    const owner = await getBucketOwner(client, name);\n    if (owner === 'other') taken.push(name);\n    if (owner === 'ours') ours += 1;\n  }\n\n  return taken.length === 0\n    ? { done: true, detail: `${names.length} bucket name(s) available or already ours (${ours} existing)` }\n    : { done: false, detail: `held by another account: ${taken.join(', ')}; delete them there or change the app prefix` };\n};\n\n/** Check-only: no bucket the deploy will create is already taken by another AWS account. */\nexport const buildBucketNamesStep = (ctx: AwsSetupContext): SetupStep => ({\n  id: 'bucket-names',\n  name: 'S3 bucket names available',\n  check: () => checkBucketNames(ctx),\n  run: async () => {\n    const result = await checkBucketNames(ctx);\n    if (!result.done) {\n      throw new Error(result.detail ?? 'bucket names taken');\n    }\n  },\n});\n"]}

package/lib/esm/platforms/aws/setup/buildCdkBootstrapSteps.d.ts

@@ -0,0 +1,5 @@
+import { SetupStep } from '../../../lib/setupStep';
+import { AwsSetupContext } from './awsSetupContext';
+/** Every region the app deploys into: the deploy region plus each certificate region (us-east-1 for CloudFront). */
+export declare const getSetupRegions: (ctx: AwsSetupContext) => string[];
+export declare const buildCdkBootstrapSteps: (ctx: AwsSetupContext) => SetupStep[];

package/lib/esm/platforms/aws/setup/buildCdkBootstrapSteps.js

@@ -0,0 +1,24 @@
+import { qpqConfigAwsUtils } from '@qpqjs/config-aws';
+import { getRoot } from '../../../lib/discovery';
+import { runCommand } from '../../../lib/runCommand';
+import { describeStackStatus, isStackHealthy } from './describeStackStatus';
+/** Every region the app deploys into: the deploy region plus each certificate region (us-east-1 for CloudFront). */
+export const getSetupRegions = (ctx) => [
+    ...new Set([ctx.region, ...qpqConfigAwsUtils.getDomainCertificateConfigs(ctx.bootstrapQpqConfig).map((cert) => cert.region)]),
+];
+const buildCdkBootstrapStep = (ctx, region) => ({
+    id: `cdk-bootstrap-${region}`,
+    name: `CDK bootstrap ${region}`,
+    check: async () => {
+        const status = await describeStackStatus('CDKToolkit', region);
+        if (status === null) {
+            return { done: false, detail: 'no CDKToolkit stack' };
+        }
+        return isStackHealthy(status)
+            ? { done: true, detail: `CDKToolkit ${status}` }
+            : { done: false, detail: `CDKToolkit is ${status}; delete the stack in ${region} before retrying` };
+    },
+    run: () => runCommand('npx', ['cdk', 'bootstrap', `aws://${ctx.accountId}/${region}`], { cwd: getRoot() }),
+});
+export const buildCdkBootstrapSteps = (ctx) => getSetupRegions(ctx).map((region) => buildCdkBootstrapStep(ctx, region));
+//# sourceMappingURL=buildCdkBootstrapSteps.js.map

package/lib/esm/platforms/aws/setup/buildCdkBootstrapSteps.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"buildCdkBootstrapSteps.js","sourceRoot":"","sources":["../../../../../src/platforms/aws/setup/buildCdkBootstrapSteps.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,iBAAiB,EAAE,MAAM,mBAAmB,CAAC;AAEtD,OAAO,EAAE,OAAO,EAAE,MAAM,wBAAwB,CAAC;AACjD,OAAO,EAAE,UAAU,EAAE,MAAM,yBAAyB,CAAC;AAGrD,OAAO,EAAE,mBAAmB,EAAE,cAAc,EAAE,MAAM,uBAAuB,CAAC;AAE5E,oHAAoH;AACpH,MAAM,CAAC,MAAM,eAAe,GAAG,CAAC,GAAoB,EAAY,EAAE,CAAC;IACjE,GAAG,IAAI,GAAG,CAAC,CAAC,GAAG,CAAC,MAAM,EAAE,GAAG,iBAAiB,CAAC,2BAA2B,CAAC,GAAG,CAAC,kBAAkB,CAAC,CAAC,GAAG,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC,CAAC;CAC9H,CAAC;AAEF,MAAM,qBAAqB,GAAG,CAAC,GAAoB,EAAE,MAAc,EAAa,EAAE,CAAC,CAAC;IAClF,EAAE,EAAE,iBAAiB,MAAM,EAAE;IAC7B,IAAI,EAAE,iBAAiB,MAAM,EAAE;IAC/B,KAAK,EAAE,KAAK,IAAI,EAAE;QAChB,MAAM,MAAM,GAAG,MAAM,mBAAmB,CAAC,YAAY,EAAE,MAAM,CAAC,CAAC;QAC/D,IAAI,MAAM,KAAK,IAAI,EAAE,CAAC;YACpB,OAAO,EAAE,IAAI,EAAE,KAAK,EAAE,MAAM,EAAE,qBAAqB,EAAE,CAAC;QACxD,CAAC;QACD,OAAO,cAAc,CAAC,MAAM,CAAC;YAC3B,CAAC,CAAC,EAAE,IAAI,EAAE,IAAI,EAAE,MAAM,EAAE,cAAc,MAAM,EAAE,EAAE;YAChD,CAAC,CAAC,EAAE,IAAI,EAAE,KAAK,EAAE,MAAM,EAAE,iBAAiB,MAAM,yBAAyB,MAAM,kBAAkB,EAAE,CAAC;IACxG,CAAC;IACD,GAAG,EAAE,GAAG,EAAE,CAAC,UAAU,CAAC,KAAK,EAAE,CAAC,KAAK,EAAE,WAAW,EAAE,SAAS,GAAG,CAAC,SAAS,IAAI,MAAM,EAAE,CAAC,EAAE,EAAE,GAAG,EAAE,OAAO,EAAE,EAAE,CAAC;CAC3G,CAAC,CAAC;AAEH,MAAM,CAAC,MAAM,sBAAsB,GAAG,CAAC,GAAoB,EAAe,EAAE,CAAC,eAAe,CAAC,GAAG,CAAC,CAAC,GAAG,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC,qBAAqB,CAAC,GAAG,EAAE,MAAM,CAAC,CAAC,CAAC","sourcesContent":["import { qpqConfigAwsUtils } from '@qpqjs/config-aws';\n\nimport { getRoot } from '../../../lib/discovery';\nimport { runCommand } from '../../../lib/runCommand';\nimport { SetupStep } from '../../../lib/setupStep';\nimport { AwsSetupContext } from './awsSetupContext';\nimport { describeStackStatus, isStackHealthy } from './describeStackStatus';\n\n/** Every region the app deploys into: the deploy region plus each certificate region (us-east-1 for CloudFront). */\nexport const getSetupRegions = (ctx: AwsSetupContext): string[] => [\n  ...new Set([ctx.region, ...qpqConfigAwsUtils.getDomainCertificateConfigs(ctx.bootstrapQpqConfig).map((cert) => cert.region)]),\n];\n\nconst buildCdkBootstrapStep = (ctx: AwsSetupContext, region: string): SetupStep => ({\n  id: `cdk-bootstrap-${region}`,\n  name: `CDK bootstrap ${region}`,\n  check: async () => {\n    const status = await describeStackStatus('CDKToolkit', region);\n    if (status === null) {\n      return { done: false, detail: 'no CDKToolkit stack' };\n    }\n    return isStackHealthy(status)\n      ? { done: true, detail: `CDKToolkit ${status}` }\n      : { done: false, detail: `CDKToolkit is ${status}; delete the stack in ${region} before retrying` };\n  },\n  run: () => runCommand('npx', ['cdk', 'bootstrap', `aws://${ctx.accountId}/${region}`], { cwd: getRoot() }),\n});\n\nexport const buildCdkBootstrapSteps = (ctx: AwsSetupContext): SetupStep[] => getSetupRegions(ctx).map((region) => buildCdkBootstrapStep(ctx, region));\n"]}

package/lib/esm/platforms/aws/setup/buildGithubDeployRoleStep.d.ts

@@ -0,0 +1,4 @@
+import { SetupStep } from '../../../lib/setupStep';
+import { AwsSetupContext } from './awsSetupContext';
+/** Check-only: the GitHub Actions deploy role is declared and deployed, with the values the GitHub Environment needs. */
+export declare const buildGithubDeployRoleStep: (ctx: AwsSetupContext) => SetupStep;

package/lib/esm/platforms/aws/setup/buildGithubDeployRoleStep.js

@@ -0,0 +1,40 @@
+import { awsNamingUtils } from '@qpqjs/actionprocessor-aws';
+import { qpqConfigAwsUtils } from '@qpqjs/config-aws';
+import { GetRoleCommand, IAMClient } from '@aws-sdk/client-iam';
+// The role itself is deployed by the bootstrap stack; this step tells you whether the config
+// declares it, whether it exists yet, and what to put in the GitHub Environment once it does.
+const checkDeployRole = async (ctx) => {
+    const config = qpqConfigAwsUtils.getAwsGithubDeployRoleConfig(ctx.bootstrapQpqConfig);
+    if (!config) {
+        return { done: false, detail: 'not declared: add defineAwsGithubDeployRole("owner/repo", { ownerId, repositoryId }) to bootstrap.qpq.ts' };
+    }
+    const roleName = awsNamingUtils.getGithubDeployRoleNameFromConfig(ctx.bootstrapQpqConfig);
+    const githubEnvironment = config.githubEnvironment ?? ctx.environment;
+    try {
+        const { Role } = await new IAMClient({ region: ctx.region }).send(new GetRoleCommand({ RoleName: roleName }));
+        return {
+            done: true,
+            detail: `${Role?.Arn}; GitHub Environment '${githubEnvironment}' needs DEPLOY_ROLE_ARN=<that arn> and AWS_REGION=${ctx.region}`,
+        };
+    }
+    catch (error) {
+        if (error instanceof Error && error.name === 'NoSuchEntityException') {
+            return { done: false, detail: `${roleName} not deployed yet (the bootstrap stack creates it)` };
+        }
+        throw error;
+    }
+};
+/** Check-only: the GitHub Actions deploy role is declared and deployed, with the values the GitHub Environment needs. */
+export const buildGithubDeployRoleStep = (ctx) => ({
+    id: 'github-deploy-role',
+    name: 'GitHub Actions deploy role',
+    check: () => checkDeployRole(ctx),
+    run: async () => {
+        const result = await checkDeployRole(ctx);
+        if (!result.done) {
+            throw new Error(result.detail ?? 'deploy role missing');
+        }
+        console.log(result.detail);
+    },
+});
+//# sourceMappingURL=buildGithubDeployRoleStep.js.map

package/lib/esm/platforms/aws/setup/buildGithubDeployRoleStep.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"buildGithubDeployRoleStep.js","sourceRoot":"","sources":["../../../../../src/platforms/aws/setup/buildGithubDeployRoleStep.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,cAAc,EAAE,MAAM,4BAA4B,CAAC;AAC5D,OAAO,EAAE,iBAAiB,EAAE,MAAM,mBAAmB,CAAC;AAEtD,OAAO,EAAE,cAAc,EAAE,SAAS,EAAE,MAAM,qBAAqB,CAAC;AAKhE,6FAA6F;AAC7F,8FAA8F;AAC9F,MAAM,eAAe,GAAG,KAAK,EAAE,GAAoB,EAA6B,EAAE;IAChF,MAAM,MAAM,GAAG,iBAAiB,CAAC,4BAA4B,CAAC,GAAG,CAAC,kBAAkB,CAAC,CAAC;IACtF,IAAI,CAAC,MAAM,EAAE,CAAC;QACZ,OAAO,EAAE,IAAI,EAAE,KAAK,EAAE,MAAM,EAAE,0GAA0G,EAAE,CAAC;IAC7I,CAAC;IAED,MAAM,QAAQ,GAAG,cAAc,CAAC,iCAAiC,CAAC,GAAG,CAAC,kBAAkB,CAAC,CAAC;IAC1F,MAAM,iBAAiB,GAAG,MAAM,CAAC,iBAAiB,IAAI,GAAG,CAAC,WAAW,CAAC;IACtE,IAAI,CAAC;QACH,MAAM,EAAE,IAAI,EAAE,GAAG,MAAM,IAAI,SAAS,CAAC,EAAE,MAAM,EAAE,GAAG,CAAC,MAAM,EAAE,CAAC,CAAC,IAAI,CAAC,IAAI,cAAc,CAAC,EAAE,QAAQ,EAAE,QAAQ,EAAE,CAAC,CAAC,CAAC;QAC9G,OAAO;YACL,IAAI,EAAE,IAAI;YACV,MAAM,EAAE,GAAG,IAAI,EAAE,GAAG,yBAAyB,iBAAiB,qDAAqD,GAAG,CAAC,MAAM,EAAE;SAChI,CAAC;IACJ,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,IAAI,KAAK,YAAY,KAAK,IAAI,KAAK,CAAC,IAAI,KAAK,uBAAuB,EAAE,CAAC;YACrE,OAAO,EAAE,IAAI,EAAE,KAAK,EAAE,MAAM,EAAE,GAAG,QAAQ,oDAAoD,EAAE,CAAC;QAClG,CAAC;QACD,MAAM,KAAK,CAAC;IACd,CAAC;AACH,CAAC,CAAC;AAEF,yHAAyH;AACzH,MAAM,CAAC,MAAM,yBAAyB,GAAG,CAAC,GAAoB,EAAa,EAAE,CAAC,CAAC;IAC7E,EAAE,EAAE,oBAAoB;IACxB,IAAI,EAAE,4BAA4B;IAClC,KAAK,EAAE,GAAG,EAAE,CAAC,eAAe,CAAC,GAAG,CAAC;IACjC,GAAG,EAAE,KAAK,IAAI,EAAE;QACd,MAAM,MAAM,GAAG,MAAM,eAAe,CAAC,GAAG,CAAC,CAAC;QAC1C,IAAI,CAAC,MAAM,CAAC,IAAI,EAAE,CAAC;YACjB,MAAM,IAAI,KAAK,CAAC,MAAM,CAAC,MAAM,IAAI,qBAAqB,CAAC,CAAC;QAC1D,CAAC;QACD,OAAO,CAAC,GAAG,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC;IAC7B,CAAC;CACF,CAAC,CAAC","sourcesContent":["import { awsNamingUtils } from '@qpqjs/actionprocessor-aws';\nimport { qpqConfigAwsUtils } from '@qpqjs/config-aws';\n\nimport { GetRoleCommand, IAMClient } from '@aws-sdk/client-iam';\n\nimport { SetupCheckResult, SetupStep } from '../../../lib/setupStep';\nimport { AwsSetupContext } from './awsSetupContext';\n\n// The role itself is deployed by the bootstrap stack; this step tells you whether the config\n// declares it, whether it exists yet, and what to put in the GitHub Environment once it does.\nconst checkDeployRole = async (ctx: AwsSetupContext): Promise<SetupCheckResult> => {\n  const config = qpqConfigAwsUtils.getAwsGithubDeployRoleConfig(ctx.bootstrapQpqConfig);\n  if (!config) {\n    return { done: false, detail: 'not declared: add defineAwsGithubDeployRole(\"owner/repo\", { ownerId, repositoryId }) to bootstrap.qpq.ts' };\n  }\n\n  const roleName = awsNamingUtils.getGithubDeployRoleNameFromConfig(ctx.bootstrapQpqConfig);\n  const githubEnvironment = config.githubEnvironment ?? ctx.environment;\n  try {\n    const { Role } = await new IAMClient({ region: ctx.region }).send(new GetRoleCommand({ RoleName: roleName }));\n    return {\n      done: true,\n      detail: `${Role?.Arn}; GitHub Environment '${githubEnvironment}' needs DEPLOY_ROLE_ARN=<that arn> and AWS_REGION=${ctx.region}`,\n    };\n  } catch (error) {\n    if (error instanceof Error && error.name === 'NoSuchEntityException') {\n      return { done: false, detail: `${roleName} not deployed yet (the bootstrap stack creates it)` };\n    }\n    throw error;\n  }\n};\n\n/** Check-only: the GitHub Actions deploy role is declared and deployed, with the values the GitHub Environment needs. */\nexport const buildGithubDeployRoleStep = (ctx: AwsSetupContext): SetupStep => ({\n  id: 'github-deploy-role',\n  name: 'GitHub Actions deploy role',\n  check: () => checkDeployRole(ctx),\n  run: async () => {\n    const result = await checkDeployRole(ctx);\n    if (!result.done) {\n      throw new Error(result.detail ?? 'deploy role missing');\n    }\n    console.log(result.detail);\n  },\n});\n"]}

package/lib/esm/platforms/aws/setup/buildGithubOidcProviderStep.d.ts

@@ -0,0 +1,4 @@
+import { SetupStep } from '../../../lib/setupStep';
+import { AwsSetupContext } from './awsSetupContext';
+/** Check-only: the account's GitHub Actions OIDC provider is declared in account.qpq.ts and deployed. */
+export declare const buildGithubOidcProviderStep: (ctx: AwsSetupContext) => SetupStep;

package/lib/esm/platforms/aws/setup/buildGithubOidcProviderStep.js

@@ -0,0 +1,40 @@
+import { qpqConfigAwsUtils } from '@qpqjs/config-aws';
+import { GetOpenIDConnectProviderCommand, IAMClient } from '@aws-sdk/client-iam';
+// The provider is created by the account stack (defineAccountGithubOidcProvider in
+// account.qpq.ts), so this only reports: declared or not, present or not.
+const checkProvider = async (ctx) => {
+    const declared = qpqConfigAwsUtils.isAccountGithubOidcProviderDeclared(ctx.accountQpqConfig);
+    const arn = qpqConfigAwsUtils.getGithubOidcProviderArn(ctx.accountId);
+    let exists = false;
+    try {
+        await new IAMClient({ region: ctx.region }).send(new GetOpenIDConnectProviderCommand({ OpenIDConnectProviderArn: arn }));
+        exists = true;
+    }
+    catch (error) {
+        if (!(error instanceof Error && error.name === 'NoSuchEntityException')) {
+            throw error;
+        }
+    }
+    if (!declared) {
+        return {
+            done: false,
+            detail: exists
+                ? `${arn} exists but account.qpq.ts does not declare it: add defineAccountGithubOidcProvider() and delete the hand-made provider before deploying the account stack`
+                : 'not declared: add defineAccountGithubOidcProvider() to account.qpq.ts (the account stack creates it)',
+        };
+    }
+    return exists ? { done: true, detail: arn } : { done: false, detail: 'declared, not deployed yet (the account stack creates it)' };
+};
+/** Check-only: the account's GitHub Actions OIDC provider is declared in account.qpq.ts and deployed. */
+export const buildGithubOidcProviderStep = (ctx) => ({
+    id: 'github-oidc-provider',
+    name: 'GitHub Actions OIDC provider',
+    check: () => checkProvider(ctx),
+    run: async () => {
+        const result = await checkProvider(ctx);
+        if (!result.done) {
+            throw new Error(result.detail ?? 'provider missing');
+        }
+    },
+});
+//# sourceMappingURL=buildGithubOidcProviderStep.js.map

package/lib/esm/platforms/aws/setup/buildGithubOidcProviderStep.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"buildGithubOidcProviderStep.js","sourceRoot":"","sources":["../../../../../src/platforms/aws/setup/buildGithubOidcProviderStep.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,iBAAiB,EAAE,MAAM,mBAAmB,CAAC;AAEtD,OAAO,EAAE,+BAA+B,EAAE,SAAS,EAAE,MAAM,qBAAqB,CAAC;AAKjF,mFAAmF;AACnF,0EAA0E;AAC1E,MAAM,aAAa,GAAG,KAAK,EAAE,GAAoB,EAA6B,EAAE;IAC9E,MAAM,QAAQ,GAAG,iBAAiB,CAAC,mCAAmC,CAAC,GAAG,CAAC,gBAAgB,CAAC,CAAC;IAC7F,MAAM,GAAG,GAAG,iBAAiB,CAAC,wBAAwB,CAAC,GAAG,CAAC,SAAS,CAAC,CAAC;IAEtE,IAAI,MAAM,GAAG,KAAK,CAAC;IACnB,IAAI,CAAC;QACH,MAAM,IAAI,SAAS,CAAC,EAAE,MAAM,EAAE,GAAG,CAAC,MAAM,EAAE,CAAC,CAAC,IAAI,CAAC,IAAI,+BAA+B,CAAC,EAAE,wBAAwB,EAAE,GAAG,EAAE,CAAC,CAAC,CAAC;QACzH,MAAM,GAAG,IAAI,CAAC;IAChB,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,IAAI,CAAC,CAAC,KAAK,YAAY,KAAK,IAAI,KAAK,CAAC,IAAI,KAAK,uBAAuB,CAAC,EAAE,CAAC;YACxE,MAAM,KAAK,CAAC;QACd,CAAC;IACH,CAAC;IAED,IAAI,CAAC,QAAQ,EAAE,CAAC;QACd,OAAO;YACL,IAAI,EAAE,KAAK;YACX,MAAM,EAAE,MAAM;gBACZ,CAAC,CAAC,GAAG,GAAG,4JAA4J;gBACpK,CAAC,CAAC,sGAAsG;SAC3G,CAAC;IACJ,CAAC;IAED,OAAO,MAAM,CAAC,CAAC,CAAC,EAAE,IAAI,EAAE,IAAI,EAAE,MAAM,EAAE,GAAG,EAAE,CAAC,CAAC,CAAC,EAAE,IAAI,EAAE,KAAK,EAAE,MAAM,EAAE,2DAA2D,EAAE,CAAC;AACrI,CAAC,CAAC;AAEF,yGAAyG;AACzG,MAAM,CAAC,MAAM,2BAA2B,GAAG,CAAC,GAAoB,EAAa,EAAE,CAAC,CAAC;IAC/E,EAAE,EAAE,sBAAsB;IAC1B,IAAI,EAAE,8BAA8B;IACpC,KAAK,EAAE,GAAG,EAAE,CAAC,aAAa,CAAC,GAAG,CAAC;IAC/B,GAAG,EAAE,KAAK,IAAI,EAAE;QACd,MAAM,MAAM,GAAG,MAAM,aAAa,CAAC,GAAG,CAAC,CAAC;QACxC,IAAI,CAAC,MAAM,CAAC,IAAI,EAAE,CAAC;YACjB,MAAM,IAAI,KAAK,CAAC,MAAM,CAAC,MAAM,IAAI,kBAAkB,CAAC,CAAC;QACvD,CAAC;IACH,CAAC;CACF,CAAC,CAAC","sourcesContent":["import { qpqConfigAwsUtils } from '@qpqjs/config-aws';\n\nimport { GetOpenIDConnectProviderCommand, IAMClient } from '@aws-sdk/client-iam';\n\nimport { SetupCheckResult, SetupStep } from '../../../lib/setupStep';\nimport { AwsSetupContext } from './awsSetupContext';\n\n// The provider is created by the account stack (defineAccountGithubOidcProvider in\n// account.qpq.ts), so this only reports: declared or not, present or not.\nconst checkProvider = async (ctx: AwsSetupContext): Promise<SetupCheckResult> => {\n  const declared = qpqConfigAwsUtils.isAccountGithubOidcProviderDeclared(ctx.accountQpqConfig);\n  const arn = qpqConfigAwsUtils.getGithubOidcProviderArn(ctx.accountId);\n\n  let exists = false;\n  try {\n    await new IAMClient({ region: ctx.region }).send(new GetOpenIDConnectProviderCommand({ OpenIDConnectProviderArn: arn }));\n    exists = true;\n  } catch (error) {\n    if (!(error instanceof Error && error.name === 'NoSuchEntityException')) {\n      throw error;\n    }\n  }\n\n  if (!declared) {\n    return {\n      done: false,\n      detail: exists\n        ? `${arn} exists but account.qpq.ts does not declare it: add defineAccountGithubOidcProvider() and delete the hand-made provider before deploying the account stack`\n        : 'not declared: add defineAccountGithubOidcProvider() to account.qpq.ts (the account stack creates it)',\n    };\n  }\n\n  return exists ? { done: true, detail: arn } : { done: false, detail: 'declared, not deployed yet (the account stack creates it)' };\n};\n\n/** Check-only: the account's GitHub Actions OIDC provider is declared in account.qpq.ts and deployed. */\nexport const buildGithubOidcProviderStep = (ctx: AwsSetupContext): SetupStep => ({\n  id: 'github-oidc-provider',\n  name: 'GitHub Actions OIDC provider',\n  check: () => checkProvider(ctx),\n  run: async () => {\n    const result = await checkProvider(ctx);\n    if (!result.done) {\n      throw new Error(result.detail ?? 'provider missing');\n    }\n  },\n});\n"]}

package/lib/esm/platforms/aws/setup/buildHostedZonesStep.d.ts

@@ -0,0 +1,4 @@
+import { SetupStep } from '../../../lib/setupStep';
+import { AwsSetupContext } from './awsSetupContext';
+/** Check-only: the Route53 zones the deploy will write records into exist in this account. */
+export declare const buildHostedZonesStep: (ctx: AwsSetupContext) => SetupStep;