@qpqjs/cli 0.0.0-stage → 0.2.1

package/lib/esm/platforms/aws/setup/buildHostedZonesStep.js

@@ -0,0 +1,49 @@
+import { qpqDeployAwsUtils } from '@qpqjs/deploy-aws';
+import { qpqWebServerUtils } from '@qpqjs/webserver';
+import { ListHostedZonesByNameCommand, Route53Client } from '@aws-sdk/client-route-53';
+// The zones the environment writes records into: one per root, chosen the way the
+// CDK chooses them (each root's site root under the app's resolver, or the root).
+const getRequiredZones = (ctx) => {
+    const config = ctx.bootstrapQpqConfig;
+    return [
+        ...new Set(qpqWebServerUtils
+            .getRootDomains(config)
+            .map((rootDomain) => qpqDeployAwsUtils.resolveHostedZoneForHost(config, qpqDeployAwsUtils.resolveDeployHostForRoot(config, rootDomain, {})))),
+    ];
+};
+const zoneExists = async (client, zoneName) => {
+    const { HostedZones } = await client.send(new ListHostedZonesByNameCommand({ DNSName: zoneName, MaxItems: 1 }));
+    return (HostedZones ?? []).some((zone) => zone.Name === `${zoneName}.` && !zone.Config?.PrivateZone);
+};
+const checkHostedZones = async (ctx) => {
+    const required = getRequiredZones(ctx);
+    if (required.length === 0) {
+        return { done: true, detail: 'no domains declared' };
+    }
+    const client = new Route53Client({ region: ctx.region });
+    const missing = [];
+    for (const zoneName of required) {
+        if (!(await zoneExists(client, zoneName))) {
+            missing.push(zoneName);
+        }
+    }
+    return missing.length === 0
+        ? { done: true, detail: required.join(', ') }
+        : {
+            done: false,
+            detail: `missing ${missing.join(', ')}: create each as a public hosted zone here and delegate it (NS record) from its parent zone`,
+        };
+};
+/** Check-only: the Route53 zones the deploy will write records into exist in this account. */
+export const buildHostedZonesStep = (ctx) => ({
+    id: 'hosted-zones',
+    name: 'Route53 hosted zones',
+    check: () => checkHostedZones(ctx),
+    run: async () => {
+        const result = await checkHostedZones(ctx);
+        if (!result.done) {
+            throw new Error(result.detail ?? 'hosted zones missing');
+        }
+    },
+});
+//# sourceMappingURL=buildHostedZonesStep.js.map

package/lib/esm/platforms/aws/setup/buildHostedZonesStep.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"buildHostedZonesStep.js","sourceRoot":"","sources":["../../../../../src/platforms/aws/setup/buildHostedZonesStep.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,iBAAiB,EAAE,MAAM,mBAAmB,CAAC;AACtD,OAAO,EAAE,iBAAiB,EAAE,MAAM,kBAAkB,CAAC;AAErD,OAAO,EAAE,4BAA4B,EAAE,aAAa,EAAE,MAAM,0BAA0B,CAAC;AAKvF,kFAAkF;AAClF,kFAAkF;AAClF,MAAM,gBAAgB,GAAG,CAAC,GAAoB,EAAY,EAAE;IAC1D,MAAM,MAAM,GAAG,GAAG,CAAC,kBAAkB,CAAC;IACtC,OAAO;QACL,GAAG,IAAI,GAAG,CACR,iBAAiB;aACd,cAAc,CAAC,MAAM,CAAC;aACtB,GAAG,CAAC,CAAC,UAAU,EAAE,EAAE,CAAC,iBAAiB,CAAC,wBAAwB,CAAC,MAAM,EAAE,iBAAiB,CAAC,wBAAwB,CAAC,MAAM,EAAE,UAAU,EAAE,EAAE,CAAC,CAAC,CAAC,CAC/I;KACF,CAAC;AACJ,CAAC,CAAC;AAEF,MAAM,UAAU,GAAG,KAAK,EAAE,MAAqB,EAAE,QAAgB,EAAoB,EAAE;IACrF,MAAM,EAAE,WAAW,EAAE,GAAG,MAAM,MAAM,CAAC,IAAI,CAAC,IAAI,4BAA4B,CAAC,EAAE,OAAO,EAAE,QAAQ,EAAE,QAAQ,EAAE,CAAC,EAAE,CAAC,CAAC,CAAC;IAChH,OAAO,CAAC,WAAW,IAAI,EAAE,CAAC,CAAC,IAAI,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,IAAI,CAAC,IAAI,KAAK,GAAG,QAAQ,GAAG,IAAI,CAAC,IAAI,CAAC,MAAM,EAAE,WAAW,CAAC,CAAC;AACvG,CAAC,CAAC;AAEF,MAAM,gBAAgB,GAAG,KAAK,EAAE,GAAoB,EAA6B,EAAE;IACjF,MAAM,QAAQ,GAAG,gBAAgB,CAAC,GAAG,CAAC,CAAC;IACvC,IAAI,QAAQ,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QAC1B,OAAO,EAAE,IAAI,EAAE,IAAI,EAAE,MAAM,EAAE,qBAAqB,EAAE,CAAC;IACvD,CAAC;IAED,MAAM,MAAM,GAAG,IAAI,aAAa,CAAC,EAAE,MAAM,EAAE,GAAG,CAAC,MAAM,EAAE,CAAC,CAAC;IACzD,MAAM,OAAO,GAAa,EAAE,CAAC;IAC7B,KAAK,MAAM,QAAQ,IAAI,QAAQ,EAAE,CAAC;QAChC,IAAI,CAAC,CAAC,MAAM,UAAU,CAAC,MAAM,EAAE,QAAQ,CAAC,CAAC,EAAE,CAAC;YAC1C,OAAO,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC;QACzB,CAAC;IACH,CAAC;IAED,OAAO,OAAO,CAAC,MAAM,KAAK,CAAC;QACzB,CAAC,CAAC,EAAE,IAAI,EAAE,IAAI,EAAE,MAAM,EAAE,QAAQ,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE;QAC7C,CAAC,CAAC;YACE,IAAI,EAAE,KAAK;YACX,MAAM,EAAE,WAAW,OAAO,CAAC,IAAI,CAAC,IAAI,CAAC,6FAA6F;SACnI,CAAC;AACR,CAAC,CAAC;AAEF,8FAA8F;AAC9F,MAAM,CAAC,MAAM,oBAAoB,GAAG,CAAC,GAAoB,EAAa,EAAE,CAAC,CAAC;IACxE,EAAE,EAAE,cAAc;IAClB,IAAI,EAAE,sBAAsB;IAC5B,KAAK,EAAE,GAAG,EAAE,CAAC,gBAAgB,CAAC,GAAG,CAAC;IAClC,GAAG,EAAE,KAAK,IAAI,EAAE;QACd,MAAM,MAAM,GAAG,MAAM,gBAAgB,CAAC,GAAG,CAAC,CAAC;QAC3C,IAAI,CAAC,MAAM,CAAC,IAAI,EAAE,CAAC;YACjB,MAAM,IAAI,KAAK,CAAC,MAAM,CAAC,MAAM,IAAI,sBAAsB,CAAC,CAAC;QAC3D,CAAC;IACH,CAAC;CACF,CAAC,CAAC","sourcesContent":["import { qpqDeployAwsUtils } from '@qpqjs/deploy-aws';\nimport { qpqWebServerUtils } from '@qpqjs/webserver';\n\nimport { ListHostedZonesByNameCommand, Route53Client } from '@aws-sdk/client-route-53';\n\nimport { SetupCheckResult, SetupStep } from '../../../lib/setupStep';\nimport { AwsSetupContext } from './awsSetupContext';\n\n// The zones the environment writes records into: one per root, chosen the way the\n// CDK chooses them (each root's site root under the app's resolver, or the root).\nconst getRequiredZones = (ctx: AwsSetupContext): string[] => {\n  const config = ctx.bootstrapQpqConfig;\n  return [\n    ...new Set(\n      qpqWebServerUtils\n        .getRootDomains(config)\n        .map((rootDomain) => qpqDeployAwsUtils.resolveHostedZoneForHost(config, qpqDeployAwsUtils.resolveDeployHostForRoot(config, rootDomain, {}))),\n    ),\n  ];\n};\n\nconst zoneExists = async (client: Route53Client, zoneName: string): Promise<boolean> => {\n  const { HostedZones } = await client.send(new ListHostedZonesByNameCommand({ DNSName: zoneName, MaxItems: 1 }));\n  return (HostedZones ?? []).some((zone) => zone.Name === `${zoneName}.` && !zone.Config?.PrivateZone);\n};\n\nconst checkHostedZones = async (ctx: AwsSetupContext): Promise<SetupCheckResult> => {\n  const required = getRequiredZones(ctx);\n  if (required.length === 0) {\n    return { done: true, detail: 'no domains declared' };\n  }\n\n  const client = new Route53Client({ region: ctx.region });\n  const missing: string[] = [];\n  for (const zoneName of required) {\n    if (!(await zoneExists(client, zoneName))) {\n      missing.push(zoneName);\n    }\n  }\n\n  return missing.length === 0\n    ? { done: true, detail: required.join(', ') }\n    : {\n        done: false,\n        detail: `missing ${missing.join(', ')}: create each as a public hosted zone here and delegate it (NS record) from its parent zone`,\n      };\n};\n\n/** Check-only: the Route53 zones the deploy will write records into exist in this account. */\nexport const buildHostedZonesStep = (ctx: AwsSetupContext): SetupStep => ({\n  id: 'hosted-zones',\n  name: 'Route53 hosted zones',\n  check: () => checkHostedZones(ctx),\n  run: async () => {\n    const result = await checkHostedZones(ctx);\n    if (!result.done) {\n      throw new Error(result.detail ?? 'hosted zones missing');\n    }\n  },\n});\n"]}

package/lib/esm/platforms/aws/setup/buildIamCapabilityStep.d.ts

@@ -0,0 +1,4 @@
+import { SetupStep } from '../../../lib/setupStep';
+import { AwsSetupContext } from './awsSetupContext';
+/** Check-only: the credentials can manage IAM, which every CDK deploy needs. */
+export declare const buildIamCapabilityStep: (ctx: AwsSetupContext) => SetupStep;

package/lib/esm/platforms/aws/setup/buildIamCapabilityStep.js

@@ -0,0 +1,34 @@
+import { GetRoleCommand, IAMClient } from '@aws-sdk/client-iam';
+// CDK bootstrap and every deploy create IAM roles. PowerUserAccess fails on the
+// first iam:GetRole for a cdk-* role, so probe exactly that: a NoSuchEntity
+// answer means the permission is there, AccessDenied means it is not.
+const checkIamCapability = async (ctx) => {
+    const roleName = `cdk-hnb659fds-cfn-exec-role-${ctx.accountId}-${ctx.region}`;
+    try {
+        await new IAMClient({ region: ctx.region }).send(new GetRoleCommand({ RoleName: roleName }));
+        return { done: true, detail: 'iam:GetRole allowed' };
+    }
+    catch (error) {
+        const name = error instanceof Error ? error.name : '';
+        if (name === 'NoSuchEntityException') {
+            return { done: true, detail: 'iam:GetRole allowed' };
+        }
+        return {
+            done: false,
+            detail: `iam:GetRole denied (${name}); the permission set needs IAM rights (AdministratorAccess or a custom set adding iam:*)`,
+        };
+    }
+};
+/** Check-only: the credentials can manage IAM, which every CDK deploy needs. */
+export const buildIamCapabilityStep = (ctx) => ({
+    id: 'iam',
+    name: 'IAM rights on the credentials',
+    check: () => checkIamCapability(ctx),
+    run: async () => {
+        const result = await checkIamCapability(ctx);
+        if (!result.done) {
+            throw new Error(result.detail ?? 'IAM rights missing');
+        }
+    },
+});
+//# sourceMappingURL=buildIamCapabilityStep.js.map

package/lib/esm/platforms/aws/setup/buildIamCapabilityStep.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"buildIamCapabilityStep.js","sourceRoot":"","sources":["../../../../../src/platforms/aws/setup/buildIamCapabilityStep.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,cAAc,EAAE,SAAS,EAAE,MAAM,qBAAqB,CAAC;AAKhE,gFAAgF;AAChF,4EAA4E;AAC5E,sEAAsE;AACtE,MAAM,kBAAkB,GAAG,KAAK,EAAE,GAAoB,EAA6B,EAAE;IACnF,MAAM,QAAQ,GAAG,+BAA+B,GAAG,CAAC,SAAS,IAAI,GAAG,CAAC,MAAM,EAAE,CAAC;IAC9E,IAAI,CAAC;QACH,MAAM,IAAI,SAAS,CAAC,EAAE,MAAM,EAAE,GAAG,CAAC,MAAM,EAAE,CAAC,CAAC,IAAI,CAAC,IAAI,cAAc,CAAC,EAAE,QAAQ,EAAE,QAAQ,EAAE,CAAC,CAAC,CAAC;QAC7F,OAAO,EAAE,IAAI,EAAE,IAAI,EAAE,MAAM,EAAE,qBAAqB,EAAE,CAAC;IACvD,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,MAAM,IAAI,GAAG,KAAK,YAAY,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC;QACtD,IAAI,IAAI,KAAK,uBAAuB,EAAE,CAAC;YACrC,OAAO,EAAE,IAAI,EAAE,IAAI,EAAE,MAAM,EAAE,qBAAqB,EAAE,CAAC;QACvD,CAAC;QACD,OAAO;YACL,IAAI,EAAE,KAAK;YACX,MAAM,EAAE,uBAAuB,IAAI,2FAA2F;SAC/H,CAAC;IACJ,CAAC;AACH,CAAC,CAAC;AAEF,gFAAgF;AAChF,MAAM,CAAC,MAAM,sBAAsB,GAAG,CAAC,GAAoB,EAAa,EAAE,CAAC,CAAC;IAC1E,EAAE,EAAE,KAAK;IACT,IAAI,EAAE,+BAA+B;IACrC,KAAK,EAAE,GAAG,EAAE,CAAC,kBAAkB,CAAC,GAAG,CAAC;IACpC,GAAG,EAAE,KAAK,IAAI,EAAE;QACd,MAAM,MAAM,GAAG,MAAM,kBAAkB,CAAC,GAAG,CAAC,CAAC;QAC7C,IAAI,CAAC,MAAM,CAAC,IAAI,EAAE,CAAC;YACjB,MAAM,IAAI,KAAK,CAAC,MAAM,CAAC,MAAM,IAAI,oBAAoB,CAAC,CAAC;QACzD,CAAC;IACH,CAAC;CACF,CAAC,CAAC","sourcesContent":["import { GetRoleCommand, IAMClient } from '@aws-sdk/client-iam';\n\nimport { SetupCheckResult, SetupStep } from '../../../lib/setupStep';\nimport { AwsSetupContext } from './awsSetupContext';\n\n// CDK bootstrap and every deploy create IAM roles. PowerUserAccess fails on the\n// first iam:GetRole for a cdk-* role, so probe exactly that: a NoSuchEntity\n// answer means the permission is there, AccessDenied means it is not.\nconst checkIamCapability = async (ctx: AwsSetupContext): Promise<SetupCheckResult> => {\n  const roleName = `cdk-hnb659fds-cfn-exec-role-${ctx.accountId}-${ctx.region}`;\n  try {\n    await new IAMClient({ region: ctx.region }).send(new GetRoleCommand({ RoleName: roleName }));\n    return { done: true, detail: 'iam:GetRole allowed' };\n  } catch (error) {\n    const name = error instanceof Error ? error.name : '';\n    if (name === 'NoSuchEntityException') {\n      return { done: true, detail: 'iam:GetRole allowed' };\n    }\n    return {\n      done: false,\n      detail: `iam:GetRole denied (${name}); the permission set needs IAM rights (AdministratorAccess or a custom set adding iam:*)`,\n    };\n  }\n};\n\n/** Check-only: the credentials can manage IAM, which every CDK deploy needs. */\nexport const buildIamCapabilityStep = (ctx: AwsSetupContext): SetupStep => ({\n  id: 'iam',\n  name: 'IAM rights on the credentials',\n  check: () => checkIamCapability(ctx),\n  run: async () => {\n    const result = await checkIamCapability(ctx);\n    if (!result.done) {\n      throw new Error(result.detail ?? 'IAM rights missing');\n    }\n  },\n});\n"]}

package/lib/esm/platforms/aws/setup/buildIdentityStep.d.ts

@@ -0,0 +1,4 @@
+import { SetupStep } from '../../../lib/setupStep';
+import { AwsSetupContext } from './awsSetupContext';
+/** Check-only: the active credentials belong to the environment's account. Catches a stale .env or SSO profile. */
+export declare const buildIdentityStep: (ctx: AwsSetupContext) => SetupStep;

package/lib/esm/platforms/aws/setup/buildIdentityStep.js

@@ -0,0 +1,26 @@
+import { GetCallerIdentityCommand, STSClient } from '@aws-sdk/client-sts';
+const checkIdentity = async (ctx) => {
+    try {
+        const { Account, Arn } = await new STSClient({ region: ctx.region }).send(new GetCallerIdentityCommand({}));
+        if (Account !== ctx.accountId) {
+            return { done: false, detail: `credentials are for account ${Account}, environment '${ctx.environment}' deploys to ${ctx.accountId}` };
+        }
+        return { done: true, detail: `${Arn}` };
+    }
+    catch (error) {
+        return { done: false, detail: `no valid credentials: ${error instanceof Error ? error.message : String(error)}` };
+    }
+};
+/** Check-only: the active credentials belong to the environment's account. Catches a stale .env or SSO profile. */
+export const buildIdentityStep = (ctx) => ({
+    id: 'identity',
+    name: `Credentials for account ${ctx.accountId}`,
+    check: () => checkIdentity(ctx),
+    run: async () => {
+        const result = await checkIdentity(ctx);
+        if (!result.done) {
+            throw new Error(`${result.detail}. Log in to the right account (or fix the deployment in deploy.config.json) and rerun.`);
+        }
+    },
+});
+//# sourceMappingURL=buildIdentityStep.js.map

package/lib/esm/platforms/aws/setup/buildIdentityStep.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"buildIdentityStep.js","sourceRoot":"","sources":["../../../../../src/platforms/aws/setup/buildIdentityStep.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,wBAAwB,EAAE,SAAS,EAAE,MAAM,qBAAqB,CAAC;AAK1E,MAAM,aAAa,GAAG,KAAK,EAAE,GAAoB,EAA6B,EAAE;IAC9E,IAAI,CAAC;QACH,MAAM,EAAE,OAAO,EAAE,GAAG,EAAE,GAAG,MAAM,IAAI,SAAS,CAAC,EAAE,MAAM,EAAE,GAAG,CAAC,MAAM,EAAE,CAAC,CAAC,IAAI,CAAC,IAAI,wBAAwB,CAAC,EAAE,CAAC,CAAC,CAAC;QAC5G,IAAI,OAAO,KAAK,GAAG,CAAC,SAAS,EAAE,CAAC;YAC9B,OAAO,EAAE,IAAI,EAAE,KAAK,EAAE,MAAM,EAAE,+BAA+B,OAAO,kBAAkB,GAAG,CAAC,WAAW,gBAAgB,GAAG,CAAC,SAAS,EAAE,EAAE,CAAC;QACzI,CAAC;QACD,OAAO,EAAE,IAAI,EAAE,IAAI,EAAE,MAAM,EAAE,GAAG,GAAG,EAAE,EAAE,CAAC;IAC1C,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,OAAO,EAAE,IAAI,EAAE,KAAK,EAAE,MAAM,EAAE,yBAAyB,KAAK,YAAY,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,EAAE,EAAE,CAAC;IACpH,CAAC;AACH,CAAC,CAAC;AAEF,mHAAmH;AACnH,MAAM,CAAC,MAAM,iBAAiB,GAAG,CAAC,GAAoB,EAAa,EAAE,CAAC,CAAC;IACrE,EAAE,EAAE,UAAU;IACd,IAAI,EAAE,2BAA2B,GAAG,CAAC,SAAS,EAAE;IAChD,KAAK,EAAE,GAAG,EAAE,CAAC,aAAa,CAAC,GAAG,CAAC;IAC/B,GAAG,EAAE,KAAK,IAAI,EAAE;QACd,MAAM,MAAM,GAAG,MAAM,aAAa,CAAC,GAAG,CAAC,CAAC;QACxC,IAAI,CAAC,MAAM,CAAC,IAAI,EAAE,CAAC;YACjB,MAAM,IAAI,KAAK,CAAC,GAAG,MAAM,CAAC,MAAM,wFAAwF,CAAC,CAAC;QAC5H,CAAC;IACH,CAAC;CACF,CAAC,CAAC","sourcesContent":["import { GetCallerIdentityCommand, STSClient } from '@aws-sdk/client-sts';\n\nimport { SetupCheckResult, SetupStep } from '../../../lib/setupStep';\nimport { AwsSetupContext } from './awsSetupContext';\n\nconst checkIdentity = async (ctx: AwsSetupContext): Promise<SetupCheckResult> => {\n  try {\n    const { Account, Arn } = await new STSClient({ region: ctx.region }).send(new GetCallerIdentityCommand({}));\n    if (Account !== ctx.accountId) {\n      return { done: false, detail: `credentials are for account ${Account}, environment '${ctx.environment}' deploys to ${ctx.accountId}` };\n    }\n    return { done: true, detail: `${Arn}` };\n  } catch (error) {\n    return { done: false, detail: `no valid credentials: ${error instanceof Error ? error.message : String(error)}` };\n  }\n};\n\n/** Check-only: the active credentials belong to the environment's account. Catches a stale .env or SSO profile. */\nexport const buildIdentityStep = (ctx: AwsSetupContext): SetupStep => ({\n  id: 'identity',\n  name: `Credentials for account ${ctx.accountId}`,\n  check: () => checkIdentity(ctx),\n  run: async () => {\n    const result = await checkIdentity(ctx);\n    if (!result.done) {\n      throw new Error(`${result.detail}. Log in to the right account (or fix the deployment in deploy.config.json) and rerun.`);\n    }\n  },\n});\n"]}

package/lib/esm/platforms/aws/setup/buildStackSteps.d.ts

@@ -0,0 +1,5 @@
+import { SetupStep } from '../../../lib/setupStep';
+import { AwsSetupContext } from './awsSetupContext';
+export declare const buildAccountStackStep: (ctx: AwsSetupContext) => SetupStep;
+export declare const buildDomainStackStep: (ctx: AwsSetupContext) => SetupStep;
+export declare const buildBootstrapStackStep: (ctx: AwsSetupContext) => SetupStep;

package/lib/esm/platforms/aws/setup/buildStackSteps.js

@@ -0,0 +1,17 @@
+import { qpqDeployAwsUtils } from '@qpqjs/deploy-aws';
+import { deployAccountStack, deployBootstrapStack, deployDomainStack } from '../stacks';
+import { describeStackStatus, isStackHealthy } from './describeStackStatus';
+const buildStackStep = (id, name, stackName, region, run) => ({
+    id,
+    name: `${name} (${stackName})`,
+    check: async () => {
+        const status = await describeStackStatus(stackName, region);
+        return status === null ? { done: false, detail: 'not deployed' } : { done: isStackHealthy(status), detail: status };
+    },
+    run,
+});
+export const buildAccountStackStep = (ctx) => buildStackStep('account-stack', 'Account guardrails stack', qpqDeployAwsUtils.getAccountStackName(), ctx.region, () => deployAccountStack(ctx.appName));
+// The domain stack deploys its cert stacks as dependencies, so one step covers certificates too.
+export const buildDomainStackStep = (ctx) => buildStackStep('domain-stack', 'Domain stack: certificates + api domains', qpqDeployAwsUtils.getDomainStackName(ctx.bootstrapQpqConfig), ctx.region, () => deployDomainStack(ctx.appName));
+export const buildBootstrapStackStep = (ctx) => buildStackStep('bootstrap-stack', 'Bootstrap stack: WAF and app-wide resources', qpqDeployAwsUtils.getBootstrapStackName(ctx.bootstrapQpqConfig), ctx.region, () => deployBootstrapStack(ctx.appName));
+//# sourceMappingURL=buildStackSteps.js.map

package/lib/esm/platforms/aws/setup/buildStackSteps.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"buildStackSteps.js","sourceRoot":"","sources":["../../../../../src/platforms/aws/setup/buildStackSteps.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,iBAAiB,EAAE,MAAM,mBAAmB,CAAC;AAGtD,OAAO,EAAE,kBAAkB,EAAE,oBAAoB,EAAE,iBAAiB,EAAE,MAAM,WAAW,CAAC;AAExF,OAAO,EAAE,mBAAmB,EAAE,cAAc,EAAE,MAAM,uBAAuB,CAAC;AAE5E,MAAM,cAAc,GAAG,CAAC,EAAU,EAAE,IAAY,EAAE,SAAiB,EAAE,MAAc,EAAE,GAAwB,EAAa,EAAE,CAAC,CAAC;IAC5H,EAAE;IACF,IAAI,EAAE,GAAG,IAAI,KAAK,SAAS,GAAG;IAC9B,KAAK,EAAE,KAAK,IAAI,EAAE;QAChB,MAAM,MAAM,GAAG,MAAM,mBAAmB,CAAC,SAAS,EAAE,MAAM,CAAC,CAAC;QAC5D,OAAO,MAAM,KAAK,IAAI,CAAC,CAAC,CAAC,EAAE,IAAI,EAAE,KAAK,EAAE,MAAM,EAAE,cAAc,EAAE,CAAC,CAAC,CAAC,EAAE,IAAI,EAAE,cAAc,CAAC,MAAM,CAAC,EAAE,MAAM,EAAE,MAAM,EAAE,CAAC;IACtH,CAAC;IACD,GAAG;CACJ,CAAC,CAAC;AAEH,MAAM,CAAC,MAAM,qBAAqB,GAAG,CAAC,GAAoB,EAAa,EAAE,CACvE,cAAc,CAAC,eAAe,EAAE,0BAA0B,EAAE,iBAAiB,CAAC,mBAAmB,EAAE,EAAE,GAAG,CAAC,MAAM,EAAE,GAAG,EAAE,CACpH,kBAAkB,CAAC,GAAG,CAAC,OAAO,CAAC,CAChC,CAAC;AAEJ,iGAAiG;AACjG,MAAM,CAAC,MAAM,oBAAoB,GAAG,CAAC,GAAoB,EAAa,EAAE,CACtE,cAAc,CACZ,cAAc,EACd,0CAA0C,EAC1C,iBAAiB,CAAC,kBAAkB,CAAC,GAAG,CAAC,kBAAkB,CAAC,EAC5D,GAAG,CAAC,MAAM,EACV,GAAG,EAAE,CAAC,iBAAiB,CAAC,GAAG,CAAC,OAAO,CAAC,CACrC,CAAC;AAEJ,MAAM,CAAC,MAAM,uBAAuB,GAAG,CAAC,GAAoB,EAAa,EAAE,CACzE,cAAc,CACZ,iBAAiB,EACjB,6CAA6C,EAC7C,iBAAiB,CAAC,qBAAqB,CAAC,GAAG,CAAC,kBAAkB,CAAC,EAC/D,GAAG,CAAC,MAAM,EACV,GAAG,EAAE,CAAC,oBAAoB,CAAC,GAAG,CAAC,OAAO,CAAC,CACxC,CAAC","sourcesContent":["import { qpqDeployAwsUtils } from '@qpqjs/deploy-aws';\n\nimport { SetupStep } from '../../../lib/setupStep';\nimport { deployAccountStack, deployBootstrapStack, deployDomainStack } from '../stacks';\nimport { AwsSetupContext } from './awsSetupContext';\nimport { describeStackStatus, isStackHealthy } from './describeStackStatus';\n\nconst buildStackStep = (id: string, name: string, stackName: string, region: string, run: () => Promise<void>): SetupStep => ({\n  id,\n  name: `${name} (${stackName})`,\n  check: async () => {\n    const status = await describeStackStatus(stackName, region);\n    return status === null ? { done: false, detail: 'not deployed' } : { done: isStackHealthy(status), detail: status };\n  },\n  run,\n});\n\nexport const buildAccountStackStep = (ctx: AwsSetupContext): SetupStep =>\n  buildStackStep('account-stack', 'Account guardrails stack', qpqDeployAwsUtils.getAccountStackName(), ctx.region, () =>\n    deployAccountStack(ctx.appName),\n  );\n\n// The domain stack deploys its cert stacks as dependencies, so one step covers certificates too.\nexport const buildDomainStackStep = (ctx: AwsSetupContext): SetupStep =>\n  buildStackStep(\n    'domain-stack',\n    'Domain stack: certificates + api domains',\n    qpqDeployAwsUtils.getDomainStackName(ctx.bootstrapQpqConfig),\n    ctx.region,\n    () => deployDomainStack(ctx.appName),\n  );\n\nexport const buildBootstrapStackStep = (ctx: AwsSetupContext): SetupStep =>\n  buildStackStep(\n    'bootstrap-stack',\n    'Bootstrap stack: WAF and app-wide resources',\n    qpqDeployAwsUtils.getBootstrapStackName(ctx.bootstrapQpqConfig),\n    ctx.region,\n    () => deployBootstrapStack(ctx.appName),\n  );\n"]}

package/lib/esm/platforms/aws/setup/describeStackStatus.d.ts

@@ -0,0 +1,4 @@
+import { Nullable } from '@qpqjs/core';
+/** A stack's status, or null when it does not exist. */
+export declare const describeStackStatus: (stackName: string, region: string) => Promise<Nullable<string>>;
+export declare const isStackHealthy: (status: Nullable<string>) => boolean;

package/lib/esm/platforms/aws/setup/describeStackStatus.js

@@ -0,0 +1,17 @@
+import { CloudFormationClient, DescribeStacksCommand } from '@aws-sdk/client-cloudformation';
+/** A stack's status, or null when it does not exist. */
+export const describeStackStatus = async (stackName, region) => {
+    try {
+        const { Stacks } = await new CloudFormationClient({ region }).send(new DescribeStacksCommand({ StackName: stackName }));
+        return Stacks?.[0]?.StackStatus ?? null;
+    }
+    catch (error) {
+        if (error instanceof Error && /does not exist/.test(error.message)) {
+            return null;
+        }
+        throw error;
+    }
+};
+const healthyStatuses = ['CREATE_COMPLETE', 'UPDATE_COMPLETE', 'IMPORT_COMPLETE'];
+export const isStackHealthy = (status) => status !== null && healthyStatuses.includes(status);
+//# sourceMappingURL=describeStackStatus.js.map

package/lib/esm/platforms/aws/setup/describeStackStatus.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"describeStackStatus.js","sourceRoot":"","sources":["../../../../../src/platforms/aws/setup/describeStackStatus.ts"],"names":[],"mappings":"AAEA,OAAO,EAAE,oBAAoB,EAAE,qBAAqB,EAAE,MAAM,gCAAgC,CAAC;AAE7F,wDAAwD;AACxD,MAAM,CAAC,MAAM,mBAAmB,GAAG,KAAK,EAAE,SAAiB,EAAE,MAAc,EAA6B,EAAE;IACxG,IAAI,CAAC;QACH,MAAM,EAAE,MAAM,EAAE,GAAG,MAAM,IAAI,oBAAoB,CAAC,EAAE,MAAM,EAAE,CAAC,CAAC,IAAI,CAAC,IAAI,qBAAqB,CAAC,EAAE,SAAS,EAAE,SAAS,EAAE,CAAC,CAAC,CAAC;QACxH,OAAO,MAAM,EAAE,CAAC,CAAC,CAAC,EAAE,WAAW,IAAI,IAAI,CAAC;IAC1C,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,IAAI,KAAK,YAAY,KAAK,IAAI,gBAAgB,CAAC,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,EAAE,CAAC;YACnE,OAAO,IAAI,CAAC;QACd,CAAC;QACD,MAAM,KAAK,CAAC;IACd,CAAC;AACH,CAAC,CAAC;AAEF,MAAM,eAAe,GAAG,CAAC,iBAAiB,EAAE,iBAAiB,EAAE,iBAAiB,CAAC,CAAC;AAElF,MAAM,CAAC,MAAM,cAAc,GAAG,CAAC,MAAwB,EAAW,EAAE,CAAC,MAAM,KAAK,IAAI,IAAI,eAAe,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC","sourcesContent":["import { Nullable } from '@qpqjs/core';\n\nimport { CloudFormationClient, DescribeStacksCommand } from '@aws-sdk/client-cloudformation';\n\n/** A stack's status, or null when it does not exist. */\nexport const describeStackStatus = async (stackName: string, region: string): Promise<Nullable<string>> => {\n  try {\n    const { Stacks } = await new CloudFormationClient({ region }).send(new DescribeStacksCommand({ StackName: stackName }));\n    return Stacks?.[0]?.StackStatus ?? null;\n  } catch (error) {\n    if (error instanceof Error && /does not exist/.test(error.message)) {\n      return null;\n    }\n    throw error;\n  }\n};\n\nconst healthyStatuses = ['CREATE_COMPLETE', 'UPDATE_COMPLETE', 'IMPORT_COMPLETE'];\n\nexport const isStackHealthy = (status: Nullable<string>): boolean => status !== null && healthyStatuses.includes(status);\n"]}

package/lib/esm/platforms/aws/setup/index.d.ts

@@ -0,0 +1 @@
+export * from './awsSetupSteps';

package/lib/esm/platforms/aws/setup/index.js

@@ -0,0 +1,2 @@
+export * from './awsSetupSteps';
+//# sourceMappingURL=index.js.map

package/lib/esm/platforms/aws/setup/index.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../../../../../src/platforms/aws/setup/index.ts"],"names":[],"mappings":"AAAA,cAAc,iBAAiB,CAAC","sourcesContent":["export * from './awsSetupSteps';\n"]}

package/lib/esm/platforms/aws/stacks.d.ts

@@ -0,0 +1,7 @@
+export declare const deployStack: (stackName: string, env?: Record<string, string>) => Promise<void>;
+export declare const deployServiceStack: (serviceName: string, stackName: string, appName: string) => Promise<void>;
+export declare const destroyStack: (stackName: string, env?: Record<string, string>) => Promise<void>;
+export declare const destroyServiceStack: (serviceName: string, stackName: string, appName: string) => Promise<void>;
+export declare const deployDomainStack: (appName: string) => Promise<void>;
+export declare const deployAccountStack: (appName: string) => Promise<void>;
+export declare const deployBootstrapStack: (appName: string) => Promise<void>;

package/lib/esm/platforms/aws/stacks.js

@@ -0,0 +1,72 @@
+// Host-side `cdk deploy` helpers. No cdk.json anywhere: the CDK app command is
+// passed via --app and runs @qpqjs/deploy-aws's generic workspace app
+// (bin/qpq-cdk-app.js) under ts-node hooks. The child inherits the primed
+// deployment env (DEPLOY_APP_NAME / DEPLOY_NAME and everything resolveDeployment
+// set); only the per-invocation service is added here.
+import { QpqDeployEnvVar } from '@qpqjs/core';
+import { qpqDeployAwsUtils } from '@qpqjs/deploy-aws';
+import path from 'path';
+import { getRoot, getServiceNames } from '../../lib/discovery';
+import { getAppPrefix, loadServiceQpqConfig } from '../../lib/qpqConfigs';
+import { runCommand } from '../../lib/runCommand';
+import { logTimeEnd, logTimeStart } from '../../lib/timing';
+import { getCdkAppCommand } from './cdkApp';
+export const deployStack = async (stackName, env = {}) => {
+    logTimeStart(stackName);
+    await runCommand('npx', ['cdk', 'deploy', stackName, '--require-approval', 'never', '--app', `'${getCdkAppCommand()}'`, '--output', path.join('dist', 'qpq', 'cdk.out')], {
+        cwd: getRoot(),
+        env,
+    });
+    logTimeEnd(stackName);
+};
+export const deployServiceStack = (serviceName, stackName, appName) => deployStack(stackName, {
+    DEPLOY_SERVICE_NAME: serviceName,
+    DEPLOY_APP_NAME: appName,
+});
+// `cdk destroy` still synths the app to find the stack, so it runs the same
+// generic workspace app with the same DEPLOY_* env as deploys — meaning the
+// service bundles under dist/ must exist for asset resolution to succeed.
+export const destroyStack = async (stackName, env = {}) => {
+    logTimeStart(stackName);
+    await runCommand('npx', ['cdk', 'destroy', stackName, '--force', '--app', `'${getCdkAppCommand()}'`, '--output', path.join('dist', 'qpq', 'cdk.out')], {
+        cwd: getRoot(),
+        env,
+    });
+    logTimeEnd(stackName);
+};
+export const destroyServiceStack = (serviceName, stackName, appName) => destroyStack(stackName, {
+    DEPLOY_SERVICE_NAME: serviceName,
+    DEPLOY_APP_NAME: appName,
+});
+export const deployDomainStack = async (appName) => {
+    const qpqConfig = loadServiceQpqConfig(appName, getServiceNames(appName)[0]);
+    const stackName = qpqDeployAwsUtils.getDomainStackName(qpqConfig);
+    console.log('Deploy Domain: ', stackName);
+    await deployStack(stackName, {
+        DEPLOY_SERVICE_NAME: '',
+        DEPLOY_APP_NAME: appName,
+    });
+};
+// Account-level guardrails stack - statically named (one per AWS account,
+// app-agnostic), so no config load is needed to know the name. Callers decide
+// whether an actor deploy should include it (bootstrap skips it; the explicit
+// 'account' menu option always deploys).
+export const deployAccountStack = async (appName) => {
+    const stackName = qpqDeployAwsUtils.getAccountStackName();
+    console.log('Deploy Account: ', stackName);
+    await deployStack(stackName, {
+        DEPLOY_SERVICE_NAME: '',
+        DEPLOY_APP_NAME: appName,
+    });
+};
+export const deployBootstrapStack = async (appName) => {
+    const appPrefix = getAppPrefix(appName);
+    const environment = process.env[QpqDeployEnvVar.environment];
+    const feature = process.env[QpqDeployEnvVar.featureName];
+    const stackName = feature ? `${appPrefix}-${environment}-${feature}-bs` : `${appPrefix}-${environment}-bs`;
+    await deployStack(stackName, {
+        DEPLOY_SERVICE_NAME: '',
+        DEPLOY_APP_NAME: appName,
+    });
+};
+//# sourceMappingURL=stacks.js.map

package/lib/esm/platforms/aws/stacks.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"stacks.js","sourceRoot":"","sources":["../../../../src/platforms/aws/stacks.ts"],"names":[],"mappings":"AAAA,+EAA+E;AAC/E,sEAAsE;AACtE,0EAA0E;AAC1E,iFAAiF;AACjF,uDAAuD;AACvD,OAAO,EAAE,eAAe,EAAE,MAAM,aAAa,CAAC;AAC9C,OAAO,EAAE,iBAAiB,EAAE,MAAM,mBAAmB,CAAC;AAEtD,OAAO,IAAI,MAAM,MAAM,CAAC;AAExB,OAAO,EAAE,OAAO,EAAE,eAAe,EAAE,MAAM,qBAAqB,CAAC;AAC/D,OAAO,EAAE,YAAY,EAAE,oBAAoB,EAAE,MAAM,sBAAsB,CAAC;AAC1E,OAAO,EAAE,UAAU,EAAE,MAAM,sBAAsB,CAAC;AAClD,OAAO,EAAE,UAAU,EAAE,YAAY,EAAE,MAAM,kBAAkB,CAAC;AAC5D,OAAO,EAAE,gBAAgB,EAAE,MAAM,UAAU,CAAC;AAE5C,MAAM,CAAC,MAAM,WAAW,GAAG,KAAK,EAAE,SAAiB,EAAE,MAA8B,EAAE,EAAiB,EAAE;IACtG,YAAY,CAAC,SAAS,CAAC,CAAC;IACxB,MAAM,UAAU,CACd,KAAK,EACL,CAAC,KAAK,EAAE,QAAQ,EAAE,SAAS,EAAE,oBAAoB,EAAE,OAAO,EAAE,OAAO,EAAE,IAAI,gBAAgB,EAAE,GAAG,EAAE,UAAU,EAAE,IAAI,CAAC,IAAI,CAAC,MAAM,EAAE,KAAK,EAAE,SAAS,CAAC,CAAC,EAChJ;QACE,GAAG,EAAE,OAAO,EAAE;QACd,GAAG;KACJ,CACF,CAAC;IACF,UAAU,CAAC,SAAS,CAAC,CAAC;AACxB,CAAC,CAAC;AAEF,MAAM,CAAC,MAAM,kBAAkB,GAAG,CAAC,WAAmB,EAAE,SAAiB,EAAE,OAAe,EAAiB,EAAE,CAC3G,WAAW,CAAC,SAAS,EAAE;IACrB,mBAAmB,EAAE,WAAW;IAChC,eAAe,EAAE,OAAO;CACzB,CAAC,CAAC;AAEL,4EAA4E;AAC5E,4EAA4E;AAC5E,0EAA0E;AAC1E,MAAM,CAAC,MAAM,YAAY,GAAG,KAAK,EAAE,SAAiB,EAAE,MAA8B,EAAE,EAAiB,EAAE;IACvG,YAAY,CAAC,SAAS,CAAC,CAAC;IACxB,MAAM,UAAU,CACd,KAAK,EACL,CAAC,KAAK,EAAE,SAAS,EAAE,SAAS,EAAE,SAAS,EAAE,OAAO,EAAE,IAAI,gBAAgB,EAAE,GAAG,EAAE,UAAU,EAAE,IAAI,CAAC,IAAI,CAAC,MAAM,EAAE,KAAK,EAAE,SAAS,CAAC,CAAC,EAC7H;QACE,GAAG,EAAE,OAAO,EAAE;QACd,GAAG;KACJ,CACF,CAAC;IACF,UAAU,CAAC,SAAS,CAAC,CAAC;AACxB,CAAC,CAAC;AAEF,MAAM,CAAC,MAAM,mBAAmB,GAAG,CAAC,WAAmB,EAAE,SAAiB,EAAE,OAAe,EAAiB,EAAE,CAC5G,YAAY,CAAC,SAAS,EAAE;IACtB,mBAAmB,EAAE,WAAW;IAChC,eAAe,EAAE,OAAO;CACzB,CAAC,CAAC;AAEL,MAAM,CAAC,MAAM,iBAAiB,GAAG,KAAK,EAAE,OAAe,EAAiB,EAAE;IACxE,MAAM,SAAS,GAAG,oBAAoB,CAAC,OAAO,EAAE,eAAe,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;IAC7E,MAAM,SAAS,GAAG,iBAAiB,CAAC,kBAAkB,CAAC,SAAS,CAAC,CAAC;IAClE,OAAO,CAAC,GAAG,CAAC,iBAAiB,EAAE,SAAS,CAAC,CAAC;IAC1C,MAAM,WAAW,CAAC,SAAS,EAAE;QAC3B,mBAAmB,EAAE,EAAE;QACvB,eAAe,EAAE,OAAO;KACzB,CAAC,CAAC;AACL,CAAC,CAAC;AAEF,0EAA0E;AAC1E,8EAA8E;AAC9E,8EAA8E;AAC9E,yCAAyC;AACzC,MAAM,CAAC,MAAM,kBAAkB,GAAG,KAAK,EAAE,OAAe,EAAiB,EAAE;IACzE,MAAM,SAAS,GAAG,iBAAiB,CAAC,mBAAmB,EAAE,CAAC;IAC1D,OAAO,CAAC,GAAG,CAAC,kBAAkB,EAAE,SAAS,CAAC,CAAC;IAC3C,MAAM,WAAW,CAAC,SAAS,EAAE;QAC3B,mBAAmB,EAAE,EAAE;QACvB,eAAe,EAAE,OAAO;KACzB,CAAC,CAAC;AACL,CAAC,CAAC;AAEF,MAAM,CAAC,MAAM,oBAAoB,GAAG,KAAK,EAAE,OAAe,EAAiB,EAAE;IAC3E,MAAM,SAAS,GAAG,YAAY,CAAC,OAAO,CAAC,CAAC;IACxC,MAAM,WAAW,GAAG,OAAO,CAAC,GAAG,CAAC,eAAe,CAAC,WAAW,CAAC,CAAC;IAC7D,MAAM,OAAO,GAAG,OAAO,CAAC,GAAG,CAAC,eAAe,CAAC,WAAW,CAAC,CAAC;IACzD,MAAM,SAAS,GAAG,OAAO,CAAC,CAAC,CAAC,GAAG,SAAS,IAAI,WAAW,IAAI,OAAO,KAAK,CAAC,CAAC,CAAC,GAAG,SAAS,IAAI,WAAW,KAAK,CAAC;IAC3G,MAAM,WAAW,CAAC,SAAS,EAAE;QAC3B,mBAAmB,EAAE,EAAE;QACvB,eAAe,EAAE,OAAO;KACzB,CAAC,CAAC;AACL,CAAC,CAAC","sourcesContent":["// Host-side `cdk deploy` helpers. No cdk.json anywhere: the CDK app command is\n// passed via --app and runs @qpqjs/deploy-aws's generic workspace app\n// (bin/qpq-cdk-app.js) under ts-node hooks. The child inherits the primed\n// deployment env (DEPLOY_APP_NAME / DEPLOY_NAME and everything resolveDeployment\n// set); only the per-invocation service is added here.\nimport { QpqDeployEnvVar } from '@qpqjs/core';\nimport { qpqDeployAwsUtils } from '@qpqjs/deploy-aws';\n\nimport path from 'path';\n\nimport { getRoot, getServiceNames } from '../../lib/discovery';\nimport { getAppPrefix, loadServiceQpqConfig } from '../../lib/qpqConfigs';\nimport { runCommand } from '../../lib/runCommand';\nimport { logTimeEnd, logTimeStart } from '../../lib/timing';\nimport { getCdkAppCommand } from './cdkApp';\n\nexport const deployStack = async (stackName: string, env: Record<string, string> = {}): Promise<void> => {\n  logTimeStart(stackName);\n  await runCommand(\n    'npx',\n    ['cdk', 'deploy', stackName, '--require-approval', 'never', '--app', `'${getCdkAppCommand()}'`, '--output', path.join('dist', 'qpq', 'cdk.out')],\n    {\n      cwd: getRoot(),\n      env,\n    },\n  );\n  logTimeEnd(stackName);\n};\n\nexport const deployServiceStack = (serviceName: string, stackName: string, appName: string): Promise<void> =>\n  deployStack(stackName, {\n    DEPLOY_SERVICE_NAME: serviceName,\n    DEPLOY_APP_NAME: appName,\n  });\n\n// `cdk destroy` still synths the app to find the stack, so it runs the same\n// generic workspace app with the same DEPLOY_* env as deploys — meaning the\n// service bundles under dist/ must exist for asset resolution to succeed.\nexport const destroyStack = async (stackName: string, env: Record<string, string> = {}): Promise<void> => {\n  logTimeStart(stackName);\n  await runCommand(\n    'npx',\n    ['cdk', 'destroy', stackName, '--force', '--app', `'${getCdkAppCommand()}'`, '--output', path.join('dist', 'qpq', 'cdk.out')],\n    {\n      cwd: getRoot(),\n      env,\n    },\n  );\n  logTimeEnd(stackName);\n};\n\nexport const destroyServiceStack = (serviceName: string, stackName: string, appName: string): Promise<void> =>\n  destroyStack(stackName, {\n    DEPLOY_SERVICE_NAME: serviceName,\n    DEPLOY_APP_NAME: appName,\n  });\n\nexport const deployDomainStack = async (appName: string): Promise<void> => {\n  const qpqConfig = loadServiceQpqConfig(appName, getServiceNames(appName)[0]);\n  const stackName = qpqDeployAwsUtils.getDomainStackName(qpqConfig);\n  console.log('Deploy Domain: ', stackName);\n  await deployStack(stackName, {\n    DEPLOY_SERVICE_NAME: '',\n    DEPLOY_APP_NAME: appName,\n  });\n};\n\n// Account-level guardrails stack - statically named (one per AWS account,\n// app-agnostic), so no config load is needed to know the name. Callers decide\n// whether an actor deploy should include it (bootstrap skips it; the explicit\n// 'account' menu option always deploys).\nexport const deployAccountStack = async (appName: string): Promise<void> => {\n  const stackName = qpqDeployAwsUtils.getAccountStackName();\n  console.log('Deploy Account: ', stackName);\n  await deployStack(stackName, {\n    DEPLOY_SERVICE_NAME: '',\n    DEPLOY_APP_NAME: appName,\n  });\n};\n\nexport const deployBootstrapStack = async (appName: string): Promise<void> => {\n  const appPrefix = getAppPrefix(appName);\n  const environment = process.env[QpqDeployEnvVar.environment];\n  const feature = process.env[QpqDeployEnvVar.featureName];\n  const stackName = feature ? `${appPrefix}-${environment}-${feature}-bs` : `${appPrefix}-${environment}-bs`;\n  await deployStack(stackName, {\n    DEPLOY_SERVICE_NAME: '',\n    DEPLOY_APP_NAME: appName,\n  });\n};\n"]}

package/lib/esm/platforms/aws/teardown.d.ts

@@ -0,0 +1,2 @@
+import { TeardownPlan } from '../../lib/deployPrompts';
+export declare const awsTeardown: (appName: string, plan: TeardownPlan) => Promise<void>;

package/lib/esm/platforms/aws/teardown.js

@@ -0,0 +1,46 @@
+// AWS sequential teardown (`qpq teardown`) — the stack phases of `qpq go` in
+// reverse. Per phase it destroys every selected service's web, then api, then
+// inf CDK stacks. Phases don't cross-reference each other's CFN outputs
+// (values flow through SSM), so this order is prudence, not a hard dependency.
+// Bootstrap, domain and account stacks are deliberately out of scope — they
+// outlive any one service and are torn down by hand if ever.
+import { qpqDeployAwsUtils } from '@qpqjs/deploy-aws';
+import { synthCommand } from '../../commands/synth';
+import { loadServiceQpqConfig } from '../../lib/qpqConfigs';
+import { logTimeEnd, logTimeStart } from '../../lib/timing';
+import { isAwsCredentialsValid } from './awsCredentials';
+import { destroyServiceStack } from './stacks';
+const teardownPhases = [
+    { label: 'Web', getStackName: qpqDeployAwsUtils.getWebStackName },
+    { label: 'Api', getStackName: qpqDeployAwsUtils.getApiStackName },
+    { label: 'Inf', getStackName: qpqDeployAwsUtils.getInfStackName },
+];
+export const awsTeardown = async (appName, plan) => {
+    if (plan.kind === 'cancelled') {
+        return;
+    }
+    const { services } = plan;
+    console.log('\n\nRunning automated teardown\n\n');
+    console.log('Executing for services');
+    console.log(services.join(', '));
+    if ((await isAwsCredentialsValid()) === false) {
+        console.log('Credentials are expired or invalid.');
+        return;
+    }
+    logTimeStart('totalTime');
+    // The stack-name utils and the cdk app both read the synthed QPQ configs.
+    await services.reduce(async (cur, service) => {
+        await cur;
+        await synthCommand([service, '--app', appName]);
+    }, Promise.resolve());
+    for (const { label, getStackName } of teardownPhases) {
+        await services.reduce(async (cur, service) => {
+            await cur;
+            const qpqConfigForService = loadServiceQpqConfig(appName, service);
+            console.log(`Destroy ${label}: `, service);
+            await destroyServiceStack(service, getStackName(qpqConfigForService), appName);
+        }, Promise.resolve());
+    }
+    logTimeEnd('totalTime');
+};
+//# sourceMappingURL=teardown.js.map

package/lib/esm/platforms/aws/teardown.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"teardown.js","sourceRoot":"","sources":["../../../../src/platforms/aws/teardown.ts"],"names":[],"mappings":"AAAA,6EAA6E;AAC7E,8EAA8E;AAC9E,wEAAwE;AACxE,+EAA+E;AAC/E,4EAA4E;AAC5E,6DAA6D;AAC7D,OAAO,EAAE,iBAAiB,EAAE,MAAM,mBAAmB,CAAC;AAEtD,OAAO,EAAE,YAAY,EAAE,MAAM,sBAAsB,CAAC;AAEpD,OAAO,EAAE,oBAAoB,EAAE,MAAM,sBAAsB,CAAC;AAC5D,OAAO,EAAE,UAAU,EAAE,YAAY,EAAE,MAAM,kBAAkB,CAAC;AAC5D,OAAO,EAAE,qBAAqB,EAAE,MAAM,kBAAkB,CAAC;AACzD,OAAO,EAAE,mBAAmB,EAAE,MAAM,UAAU,CAAC;AAE/C,MAAM,cAAc,GAAG;IACrB,EAAE,KAAK,EAAE,KAAK,EAAE,YAAY,EAAE,iBAAiB,CAAC,eAAe,EAAE;IACjE,EAAE,KAAK,EAAE,KAAK,EAAE,YAAY,EAAE,iBAAiB,CAAC,eAAe,EAAE;IACjE,EAAE,KAAK,EAAE,KAAK,EAAE,YAAY,EAAE,iBAAiB,CAAC,eAAe,EAAE;CAClE,CAAC;AAEF,MAAM,CAAC,MAAM,WAAW,GAAG,KAAK,EAAE,OAAe,EAAE,IAAkB,EAAiB,EAAE;IACtF,IAAI,IAAI,CAAC,IAAI,KAAK,WAAW,EAAE,CAAC;QAC9B,OAAO;IACT,CAAC;IAED,MAAM,EAAE,QAAQ,EAAE,GAAG,IAAI,CAAC;IAE1B,OAAO,CAAC,GAAG,CAAC,oCAAoC,CAAC,CAAC;IAClD,OAAO,CAAC,GAAG,CAAC,wBAAwB,CAAC,CAAC;IACtC,OAAO,CAAC,GAAG,CAAC,QAAQ,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC;IAEjC,IAAI,CAAC,MAAM,qBAAqB,EAAE,CAAC,KAAK,KAAK,EAAE,CAAC;QAC9C,OAAO,CAAC,GAAG,CAAC,qCAAqC,CAAC,CAAC;QACnD,OAAO;IACT,CAAC;IAED,YAAY,CAAC,WAAW,CAAC,CAAC;IAE1B,0EAA0E;IAC1E,MAAM,QAAQ,CAAC,MAAM,CAAC,KAAK,EAAE,GAAG,EAAE,OAAO,EAAE,EAAE;QAC3C,MAAM,GAAG,CAAC;QACV,MAAM,YAAY,CAAC,CAAC,OAAO,EAAE,OAAO,EAAE,OAAO,CAAC,CAAC,CAAC;IAClD,CAAC,EAAE,OAAO,CAAC,OAAO,EAAE,CAAC,CAAC;IAEtB,KAAK,MAAM,EAAE,KAAK,EAAE,YAAY,EAAE,IAAI,cAAc,EAAE,CAAC;QACrD,MAAM,QAAQ,CAAC,MAAM,CAAC,KAAK,EAAE,GAAG,EAAE,OAAO,EAAE,EAAE;YAC3C,MAAM,GAAG,CAAC;YACV,MAAM,mBAAmB,GAAG,oBAAoB,CAAC,OAAO,EAAE,OAAO,CAAC,CAAC;YACnE,OAAO,CAAC,GAAG,CAAC,WAAW,KAAK,IAAI,EAAE,OAAO,CAAC,CAAC;YAC3C,MAAM,mBAAmB,CAAC,OAAO,EAAE,YAAY,CAAC,mBAAmB,CAAC,EAAE,OAAO,CAAC,CAAC;QACjF,CAAC,EAAE,OAAO,CAAC,OAAO,EAAE,CAAC,CAAC;IACxB,CAAC;IAED,UAAU,CAAC,WAAW,CAAC,CAAC;AAC1B,CAAC,CAAC","sourcesContent":["// AWS sequential teardown (`qpq teardown`) — the stack phases of `qpq go` in\n// reverse. Per phase it destroys every selected service's web, then api, then\n// inf CDK stacks. Phases don't cross-reference each other's CFN outputs\n// (values flow through SSM), so this order is prudence, not a hard dependency.\n// Bootstrap, domain and account stacks are deliberately out of scope — they\n// outlive any one service and are torn down by hand if ever.\nimport { qpqDeployAwsUtils } from '@qpqjs/deploy-aws';\n\nimport { synthCommand } from '../../commands/synth';\nimport { TeardownPlan } from '../../lib/deployPrompts';\nimport { loadServiceQpqConfig } from '../../lib/qpqConfigs';\nimport { logTimeEnd, logTimeStart } from '../../lib/timing';\nimport { isAwsCredentialsValid } from './awsCredentials';\nimport { destroyServiceStack } from './stacks';\n\nconst teardownPhases = [\n  { label: 'Web', getStackName: qpqDeployAwsUtils.getWebStackName },\n  { label: 'Api', getStackName: qpqDeployAwsUtils.getApiStackName },\n  { label: 'Inf', getStackName: qpqDeployAwsUtils.getInfStackName },\n];\n\nexport const awsTeardown = async (appName: string, plan: TeardownPlan): Promise<void> => {\n  if (plan.kind === 'cancelled') {\n    return;\n  }\n\n  const { services } = plan;\n\n  console.log('\\n\\nRunning automated teardown\\n\\n');\n  console.log('Executing for services');\n  console.log(services.join(', '));\n\n  if ((await isAwsCredentialsValid()) === false) {\n    console.log('Credentials are expired or invalid.');\n    return;\n  }\n\n  logTimeStart('totalTime');\n\n  // The stack-name utils and the cdk app both read the synthed QPQ configs.\n  await services.reduce(async (cur, service) => {\n    await cur;\n    await synthCommand([service, '--app', appName]);\n  }, Promise.resolve());\n\n  for (const { label, getStackName } of teardownPhases) {\n    await services.reduce(async (cur, service) => {\n      await cur;\n      const qpqConfigForService = loadServiceQpqConfig(appName, service);\n      console.log(`Destroy ${label}: `, service);\n      await destroyServiceStack(service, getStackName(qpqConfigForService), appName);\n    }, Promise.resolve());\n  }\n\n  logTimeEnd('totalTime');\n};\n"]}

package/lib/esm/platforms/aws/viewsSync.d.ts

@@ -0,0 +1,3 @@
+export declare const NO_CACHE_FILES: string[];
+export declare const getViewsS3Destinations: (appName: string, serviceName: string) => string[];
+export declare const syncViewsToS3: (appName: string, serviceName: string) => Promise<void>;

package/lib/esm/platforms/aws/viewsSync.js

@@ -0,0 +1,60 @@
+// Views upload to S3. Every service's views go to its prefix in the shared
+// 'views' bucket (owned by shell). A service can also be a standalone host on
+// its own domain: each of its web entries marked `storageDrive.syncServiceViews`
+// gets the bundle at its drive's root. shell is the root website, which predates
+// that flag, so it keeps its 'website' bucket root when it declares none.
+import { awsNamingUtils } from '@qpqjs/actionprocessor-aws';
+import { qpqWebServerUtils } from '@qpqjs/webserver';
+import fs from 'fs';
+import path from 'path';
+import { loadServiceQpqConfig } from '../../lib/qpqConfigs';
+import { runCommand } from '../../lib/runCommand';
+import { getViewsDistDir } from '../../lib/views';
+// The mutable entry points: fixed names whose CONTENT changes every deploy. They
+// must never be cached without revalidation — a browser holding a stale
+// mf-manifest.json or remoteEntry.js keeps running the previous deploy's bundle
+// (the module-reload hot-swap and plain page refreshes both depend on these being
+// fresh). Everything else in a views dist is content-hashed and safely immutable.
+export const NO_CACHE_FILES = ['mf-manifest.json', 'remoteEntry.js', 'index.html', 'favicon.ico'];
+export const getViewsS3Destinations = (appName, serviceName) => {
+    const shellConfig = loadServiceQpqConfig(appName, 'shell');
+    const viewsBucketName = awsNamingUtils.getConfigRuntimeResourceNameFromConfig('views', shellConfig);
+    const destinations = [`s3://${viewsBucketName}/${serviceName}`];
+    const serviceConfig = serviceName === 'shell' ? shellConfig : loadServiceQpqConfig(appName, serviceName);
+    const hostDrives = qpqWebServerUtils
+        .getWebEntryConfigs(serviceConfig)
+        .filter((webEntry) => webEntry.storageDrive.syncServiceViews && webEntry.storageDrive.sourceStorageDrive)
+        .map((webEntry) => webEntry.storageDrive.sourceStorageDrive);
+    if (serviceName === 'shell' && hostDrives.length === 0) {
+        hostDrives.push('website');
+    }
+    for (const drive of hostDrives) {
+        destinations.push(`s3://${awsNamingUtils.getConfigRuntimeResourceNameFromConfig(drive, serviceConfig)}`);
+    }
+    return destinations;
+};
+export const syncViewsToS3 = async (appName, serviceName) => {
+    const distDir = getViewsDistDir(appName, serviceName);
+    for (const destination of getViewsS3Destinations(appName, serviceName)) {
+        console.log(`Copying [${serviceName}] views to [${destination}]`);
+        // Content-hashed assets: cache forever.
+        await runCommand('aws', [
+            's3',
+            'sync',
+            distDir,
+            destination,
+            '--cache-control',
+            'public,max-age=31536000,immutable',
+            ...NO_CACHE_FILES.flatMap((file) => ['--exclude', file]),
+        ]);
+        // Entry points: cp (not sync) so the no-cache header is (re)applied on every
+        // deploy even when a body happens to be byte-identical.
+        for (const file of NO_CACHE_FILES) {
+            if (!fs.existsSync(path.join(distDir, file))) {
+                continue;
+            }
+            await runCommand('aws', ['s3', 'cp', path.join(distDir, file), `${destination}/${file}`, '--cache-control', 'no-cache']);
+        }
+    }
+};
+//# sourceMappingURL=viewsSync.js.map

package/lib/esm/platforms/aws/viewsSync.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"viewsSync.js","sourceRoot":"","sources":["../../../../src/platforms/aws/viewsSync.ts"],"names":[],"mappings":"AAAA,2EAA2E;AAC3E,8EAA8E;AAC9E,iFAAiF;AACjF,iFAAiF;AACjF,0EAA0E;AAC1E,OAAO,EAAE,cAAc,EAAE,MAAM,4BAA4B,CAAC;AAC5D,OAAO,EAAE,iBAAiB,EAAE,MAAM,kBAAkB,CAAC;AAErD,OAAO,EAAE,MAAM,IAAI,CAAC;AACpB,OAAO,IAAI,MAAM,MAAM,CAAC;AAExB,OAAO,EAAE,oBAAoB,EAAE,MAAM,sBAAsB,CAAC;AAC5D,OAAO,EAAE,UAAU,EAAE,MAAM,sBAAsB,CAAC;AAClD,OAAO,EAAE,eAAe,EAAE,MAAM,iBAAiB,CAAC;AAElD,iFAAiF;AACjF,wEAAwE;AACxE,gFAAgF;AAChF,kFAAkF;AAClF,kFAAkF;AAClF,MAAM,CAAC,MAAM,cAAc,GAAG,CAAC,kBAAkB,EAAE,gBAAgB,EAAE,YAAY,EAAE,aAAa,CAAC,CAAC;AAElG,MAAM,CAAC,MAAM,sBAAsB,GAAG,CAAC,OAAe,EAAE,WAAmB,EAAY,EAAE;IACvF,MAAM,WAAW,GAAG,oBAAoB,CAAC,OAAO,EAAE,OAAO,CAAC,CAAC;IAC3D,MAAM,eAAe,GAAG,cAAc,CAAC,sCAAsC,CAAC,OAAO,EAAE,WAAW,CAAC,CAAC;IAEpG,MAAM,YAAY,GAAG,CAAC,QAAQ,eAAe,IAAI,WAAW,EAAE,CAAC,CAAC;IAEhE,MAAM,aAAa,GAAG,WAAW,KAAK,OAAO,CAAC,CAAC,CAAC,WAAW,CAAC,CAAC,CAAC,oBAAoB,CAAC,OAAO,EAAE,WAAW,CAAC,CAAC;IACzG,MAAM,UAAU,GAAG,iBAAiB;SACjC,kBAAkB,CAAC,aAAa,CAAC;SACjC,MAAM,CAAC,CAAC,QAAQ,EAAE,EAAE,CAAC,QAAQ,CAAC,YAAY,CAAC,gBAAgB,IAAI,QAAQ,CAAC,YAAY,CAAC,kBAAkB,CAAC;SACxG,GAAG,CAAC,CAAC,QAAQ,EAAE,EAAE,CAAC,QAAQ,CAAC,YAAY,CAAC,kBAAmB,CAAC,CAAC;IAEhE,IAAI,WAAW,KAAK,OAAO,IAAI,UAAU,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QACvD,UAAU,CAAC,IAAI,CAAC,SAAS,CAAC,CAAC;IAC7B,CAAC;IAED,KAAK,MAAM,KAAK,IAAI,UAAU,EAAE,CAAC;QAC/B,YAAY,CAAC,IAAI,CAAC,QAAQ,cAAc,CAAC,sCAAsC,CAAC,KAAK,EAAE,aAAa,CAAC,EAAE,CAAC,CAAC;IAC3G,CAAC;IAED,OAAO,YAAY,CAAC;AACtB,CAAC,CAAC;AAEF,MAAM,CAAC,MAAM,aAAa,GAAG,KAAK,EAAE,OAAe,EAAE,WAAmB,EAAiB,EAAE;IACzF,MAAM,OAAO,GAAG,eAAe,CAAC,OAAO,EAAE,WAAW,CAAC,CAAC;IAEtD,KAAK,MAAM,WAAW,IAAI,sBAAsB,CAAC,OAAO,EAAE,WAAW,CAAC,EAAE,CAAC;QACvE,OAAO,CAAC,GAAG,CAAC,YAAY,WAAW,eAAe,WAAW,GAAG,CAAC,CAAC;QAElE,wCAAwC;QACxC,MAAM,UAAU,CAAC,KAAK,EAAE;YACtB,IAAI;YACJ,MAAM;YACN,OAAO;YACP,WAAW;YACX,iBAAiB;YACjB,mCAAmC;YACnC,GAAG,cAAc,CAAC,OAAO,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,CAAC,WAAW,EAAE,IAAI,CAAC,CAAC;SACzD,CAAC,CAAC;QAEH,6EAA6E;QAC7E,wDAAwD;QACxD,KAAK,MAAM,IAAI,IAAI,cAAc,EAAE,CAAC;YAClC,IAAI,CAAC,EAAE,CAAC,UAAU,CAAC,IAAI,CAAC,IAAI,CAAC,OAAO,EAAE,IAAI,CAAC,CAAC,EAAE,CAAC;gBAC7C,SAAS;YACX,CAAC;YAED,MAAM,UAAU,CAAC,KAAK,EAAE,CAAC,IAAI,EAAE,IAAI,EAAE,IAAI,CAAC,IAAI,CAAC,OAAO,EAAE,IAAI,CAAC,EAAE,GAAG,WAAW,IAAI,IAAI,EAAE,EAAE,iBAAiB,EAAE,UAAU,CAAC,CAAC,CAAC;QAC3H,CAAC;IACH,CAAC;AACH,CAAC,CAAC","sourcesContent":["// Views upload to S3. Every service's views go to its prefix in the shared\n// 'views' bucket (owned by shell). A service can also be a standalone host on\n// its own domain: each of its web entries marked `storageDrive.syncServiceViews`\n// gets the bundle at its drive's root. shell is the root website, which predates\n// that flag, so it keeps its 'website' bucket root when it declares none.\nimport { awsNamingUtils } from '@qpqjs/actionprocessor-aws';\nimport { qpqWebServerUtils } from '@qpqjs/webserver';\n\nimport fs from 'fs';\nimport path from 'path';\n\nimport { loadServiceQpqConfig } from '../../lib/qpqConfigs';\nimport { runCommand } from '../../lib/runCommand';\nimport { getViewsDistDir } from '../../lib/views';\n\n// The mutable entry points: fixed names whose CONTENT changes every deploy. They\n// must never be cached without revalidation — a browser holding a stale\n// mf-manifest.json or remoteEntry.js keeps running the previous deploy's bundle\n// (the module-reload hot-swap and plain page refreshes both depend on these being\n// fresh). Everything else in a views dist is content-hashed and safely immutable.\nexport const NO_CACHE_FILES = ['mf-manifest.json', 'remoteEntry.js', 'index.html', 'favicon.ico'];\n\nexport const getViewsS3Destinations = (appName: string, serviceName: string): string[] => {\n  const shellConfig = loadServiceQpqConfig(appName, 'shell');\n  const viewsBucketName = awsNamingUtils.getConfigRuntimeResourceNameFromConfig('views', shellConfig);\n\n  const destinations = [`s3://${viewsBucketName}/${serviceName}`];\n\n  const serviceConfig = serviceName === 'shell' ? shellConfig : loadServiceQpqConfig(appName, serviceName);\n  const hostDrives = qpqWebServerUtils\n    .getWebEntryConfigs(serviceConfig)\n    .filter((webEntry) => webEntry.storageDrive.syncServiceViews && webEntry.storageDrive.sourceStorageDrive)\n    .map((webEntry) => webEntry.storageDrive.sourceStorageDrive!);\n\n  if (serviceName === 'shell' && hostDrives.length === 0) {\n    hostDrives.push('website');\n  }\n\n  for (const drive of hostDrives) {\n    destinations.push(`s3://${awsNamingUtils.getConfigRuntimeResourceNameFromConfig(drive, serviceConfig)}`);\n  }\n\n  return destinations;\n};\n\nexport const syncViewsToS3 = async (appName: string, serviceName: string): Promise<void> => {\n  const distDir = getViewsDistDir(appName, serviceName);\n\n  for (const destination of getViewsS3Destinations(appName, serviceName)) {\n    console.log(`Copying [${serviceName}] views to [${destination}]`);\n\n    // Content-hashed assets: cache forever.\n    await runCommand('aws', [\n      's3',\n      'sync',\n      distDir,\n      destination,\n      '--cache-control',\n      'public,max-age=31536000,immutable',\n      ...NO_CACHE_FILES.flatMap((file) => ['--exclude', file]),\n    ]);\n\n    // Entry points: cp (not sync) so the no-cache header is (re)applied on every\n    // deploy even when a body happens to be byte-identical.\n    for (const file of NO_CACHE_FILES) {\n      if (!fs.existsSync(path.join(distDir, file))) {\n        continue;\n      }\n\n      await runCommand('aws', ['s3', 'cp', path.join(distDir, file), `${destination}/${file}`, '--cache-control', 'no-cache']);\n    }\n  }\n};\n"]}

package/lib/esm/platforms/docker/QpqDockerPlatformSettings.d.ts

@@ -0,0 +1,10 @@
+/** The docker entry's `platformSettings`: how the image is named, built and mapped onto a host. */
+export type QpqDockerPlatformSettings = {
+    portMappings?: string;
+    registry?: string;
+    arch?: string;
+    tag?: string;
+    publicHost?: string;
+    dataPath?: string;
+    mounts?: string;
+};

package/lib/esm/platforms/docker/QpqDockerPlatformSettings.js

@@ -0,0 +1,2 @@
+export {};
+//# sourceMappingURL=QpqDockerPlatformSettings.js.map

package/lib/esm/platforms/docker/QpqDockerPlatformSettings.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"QpqDockerPlatformSettings.js","sourceRoot":"","sources":["../../../../src/platforms/docker/QpqDockerPlatformSettings.ts"],"names":[],"mappings":"","sourcesContent":["/** The docker entry's `platformSettings`: how the image is named, built and mapped onto a host. */\nexport type QpqDockerPlatformSettings = {\n  // Comma-separated docker `host:container` pairs, e.g. \"80:8080, 8888:8888, 3090:3090\". Container\n  // ports are 8080 (api + site), 8888 (websockets), 3001 (file storage), plus the port of every\n  // web entry listed in a service's defineDevServerOptions. Default: 80 to the site and every\n  // container port to itself. The host side is baked into the frontend, so a host must map the\n  // same ports.\n  portMappings?: string;\n\n  // Registry to push the image to, e.g. \"192.168.8.88:5000\" or \"ghcr.io/me\". Without it the image\n  // only lands in the local docker store.\n  registry?: string;\n\n  // Target platform for the image, e.g. \"linux/amd64\" for an x86 host built from an arm Mac.\n  // Default: the building machine's own.\n  arch?: string;\n\n  // Image tag. Default: the deployment's environment.\n  tag?: string;\n\n  // The address browsers reach the host on, e.g. \"192.168.8.88\" or \"unraid.local\". Secure file\n  // upload/download urls are absolute and point here. Default: localhost.\n  publicHost?: string;\n\n  // Host directory for the app's state (key-value stores, file storage), e.g.\n  // \"/mnt/user/appdata/qpq-myapp\". Default: a docker named volume.\n  dataPath?: string;\n\n  // Comma-separated host folders to mount into the container, as docker `host:container` pairs\n  // with both absolute, optionally ending \":ro\" for read-only, e.g.\n  // \"/mnt/user/media/downloads:/mnt/user/media/downloads, /mnt/user/tv:/tv:ro\". For apps that\n  // read or write files on the host outside their own state. Default: none.\n  mounts?: string;\n};\n"]}

package/lib/esm/platforms/docker/getContainerPorts.d.ts

@@ -0,0 +1,4 @@
+import { WebEntryHost } from '@qpqjs/dev-server';
+import { ResolvedDevServerPorts } from '../../lib/devServerPorts';
+/** Every port the image listens on: the app's dev-server ports plus one per hosted web entry. */
+export declare const getContainerPorts: (devServerPorts: ResolvedDevServerPorts, hosts: WebEntryHost[]) => number[];

package/lib/esm/platforms/docker/getContainerPorts.js

@@ -0,0 +1,8 @@
+/** Every port the image listens on: the app's dev-server ports plus one per hosted web entry. */
+export const getContainerPorts = (devServerPorts, hosts) => [
+    devServerPorts.api,
+    devServerPorts.webSocket,
+    devServerPorts.fileStorage,
+    ...hosts.map((host) => host.port),
+];
+//# sourceMappingURL=getContainerPorts.js.map

package/lib/esm/platforms/docker/getContainerPorts.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"getContainerPorts.js","sourceRoot":"","sources":["../../../../src/platforms/docker/getContainerPorts.ts"],"names":[],"mappings":"AAIA,iGAAiG;AACjG,MAAM,CAAC,MAAM,iBAAiB,GAAG,CAAC,cAAsC,EAAE,KAAqB,EAAY,EAAE,CAAC;IAC5G,cAAc,CAAC,GAAG;IAClB,cAAc,CAAC,SAAS;IACxB,cAAc,CAAC,WAAW;IAC1B,GAAG,KAAK,CAAC,GAAG,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,IAAI,CAAC,IAAI,CAAC;CAClC,CAAC","sourcesContent":["import { WebEntryHost } from '@qpqjs/dev-server';\n\nimport { ResolvedDevServerPorts } from '../../lib/devServerPorts';\n\n/** Every port the image listens on: the app's dev-server ports plus one per hosted web entry. */\nexport const getContainerPorts = (devServerPorts: ResolvedDevServerPorts, hosts: WebEntryHost[]): number[] => [\n  devServerPorts.api,\n  devServerPorts.webSocket,\n  devServerPorts.fileStorage,\n  ...hosts.map((host) => host.port),\n];\n"]}

package/lib/esm/platforms/docker/getDefaultPortMappings.d.ts

@@ -0,0 +1,3 @@
+import { PortMapping } from './parsePortMappings';
+/** Each container port on the same host port, plus 80 for the site, when the deployment sets no `portMappings`. */
+export declare const getDefaultPortMappings: (apiPort: number, containerPorts: number[]) => PortMapping[];

package/lib/esm/platforms/docker/getDefaultPortMappings.js

@@ -0,0 +1,6 @@
+/** Each container port on the same host port, plus 80 for the site, when the deployment sets no `portMappings`. */
+export const getDefaultPortMappings = (apiPort, containerPorts) => [
+    { host: 80, container: apiPort },
+    ...containerPorts.map((port) => ({ host: port, container: port })),
+];
+//# sourceMappingURL=getDefaultPortMappings.js.map

package/lib/esm/platforms/docker/getDefaultPortMappings.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"getDefaultPortMappings.js","sourceRoot":"","sources":["../../../../src/platforms/docker/getDefaultPortMappings.ts"],"names":[],"mappings":"AAEA,mHAAmH;AACnH,MAAM,CAAC,MAAM,sBAAsB,GAAG,CAAC,OAAe,EAAE,cAAwB,EAAiB,EAAE,CAAC;IAClG,EAAE,IAAI,EAAE,EAAE,EAAE,SAAS,EAAE,OAAO,EAAE;IAChC,GAAG,cAAc,CAAC,GAAG,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,CAAC,EAAE,IAAI,EAAE,IAAI,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAC;CACnE,CAAC","sourcesContent":["import { PortMapping } from './parsePortMappings';\n\n/** Each container port on the same host port, plus 80 for the site, when the deployment sets no `portMappings`. */\nexport const getDefaultPortMappings = (apiPort: number, containerPorts: number[]): PortMapping[] => [\n  { host: 80, container: apiPort },\n  ...containerPorts.map((port) => ({ host: port, container: port })),\n];\n"]}

package/lib/esm/platforms/docker/getDockerPlatformSettings.d.ts

@@ -0,0 +1,14 @@
+import { QpqAppDeployment } from '@qpqjs/core';
+import { Mount } from './parseMounts';
+import { PortMapping } from './parsePortMappings';
+export type ParsedDockerPlatformSettings = {
+    portMappings?: PortMapping[];
+    registry?: string;
+    arch?: string;
+    tag: string;
+    publicHost?: string;
+    dataPath?: string;
+    mounts?: Mount[];
+};
+/** The docker entry's platform settings, parsed; throws for a malformed value, naming the deployment. */
+export declare const getDockerPlatformSettings: (deploymentName: string, deployment: QpqAppDeployment) => ParsedDockerPlatformSettings;

package/lib/esm/platforms/docker/getDockerPlatformSettings.js

@@ -0,0 +1,34 @@
+import { parseMounts } from './parseMounts';
+import { parsePortMappings } from './parsePortMappings';
+const asOptionalString = (deploymentName, name, value) => {
+    if (value === undefined) {
+        return undefined;
+    }
+    if (typeof value !== 'string' || value.trim() === '') {
+        throw new Error(`Invalid docker deployment '${deploymentName}': platformSettings.${name} must be a non-empty string`);
+    }
+    return value.trim().replace(/\/+$/, '');
+};
+/** The docker entry's platform settings, parsed; throws for a malformed value, naming the deployment. */
+export const getDockerPlatformSettings = (deploymentName, deployment) => {
+    const settings = deployment.platformSettings ?? {};
+    let portMappings;
+    let mounts;
+    try {
+        portMappings = settings.portMappings === undefined ? undefined : parsePortMappings(settings.portMappings);
+        mounts = settings.mounts === undefined ? undefined : parseMounts(settings.mounts);
+    }
+    catch (error) {
+        throw new Error(`Invalid docker deployment '${deploymentName}': ${error instanceof Error ? error.message : String(error)}`);
+    }
+    return {
+        portMappings,
+        registry: asOptionalString(deploymentName, 'registry', settings.registry),
+        arch: asOptionalString(deploymentName, 'arch', settings.arch),
+        tag: asOptionalString(deploymentName, 'tag', settings.tag) ?? deployment.environment,
+        publicHost: asOptionalString(deploymentName, 'publicHost', settings.publicHost),
+        dataPath: asOptionalString(deploymentName, 'dataPath', settings.dataPath),
+        mounts,
+    };
+};
+//# sourceMappingURL=getDockerPlatformSettings.js.map

package/lib/esm/platforms/docker/getDockerPlatformSettings.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"getDockerPlatformSettings.js","sourceRoot":"","sources":["../../../../src/platforms/docker/getDockerPlatformSettings.ts"],"names":[],"mappings":"AAEA,OAAO,EAAS,WAAW,EAAE,MAAM,eAAe,CAAC;AACnD,OAAO,EAAE,iBAAiB,EAAe,MAAM,qBAAqB,CAAC;AAcrE,MAAM,gBAAgB,GAAG,CAAC,cAAsB,EAAE,IAAY,EAAE,KAAc,EAAsB,EAAE;IACpG,IAAI,KAAK,KAAK,SAAS,EAAE,CAAC;QACxB,OAAO,SAAS,CAAC;IACnB,CAAC;IACD,IAAI,OAAO,KAAK,KAAK,QAAQ,IAAI,KAAK,CAAC,IAAI,EAAE,KAAK,EAAE,EAAE,CAAC;QACrD,MAAM,IAAI,KAAK,CAAC,8BAA8B,cAAc,uBAAuB,IAAI,6BAA6B,CAAC,CAAC;IACxH,CAAC;IACD,OAAO,KAAK,CAAC,IAAI,EAAE,CAAC,OAAO,CAAC,MAAM,EAAE,EAAE,CAAC,CAAC;AAC1C,CAAC,CAAC;AAEF,yGAAyG;AACzG,MAAM,CAAC,MAAM,yBAAyB,GAAG,CAAC,cAAsB,EAAE,UAA4B,EAAgC,EAAE;IAC9H,MAAM,QAAQ,GAAG,UAAU,CAAC,gBAAgB,IAAI,EAAE,CAAC;IAEnD,IAAI,YAAuC,CAAC;IAC5C,IAAI,MAA2B,CAAC;IAChC,IAAI,CAAC;QACH,YAAY,GAAG,QAAQ,CAAC,YAAY,KAAK,SAAS,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,iBAAiB,CAAC,QAAQ,CAAC,YAAY,CAAC,CAAC;QAC1G,MAAM,GAAG,QAAQ,CAAC,MAAM,KAAK,SAAS,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,WAAW,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC;IACpF,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,MAAM,IAAI,KAAK,CAAC,8BAA8B,cAAc,MAAM,KAAK,YAAY,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,EAAE,CAAC,CAAC;IAC9H,CAAC;IAED,OAAO;QACL,YAAY;QACZ,QAAQ,EAAE,gBAAgB,CAAC,cAAc,EAAE,UAAU,EAAE,QAAQ,CAAC,QAAQ,CAAC;QACzE,IAAI,EAAE,gBAAgB,CAAC,cAAc,EAAE,MAAM,EAAE,QAAQ,CAAC,IAAI,CAAC;QAC7D,GAAG,EAAE,gBAAgB,CAAC,cAAc,EAAE,KAAK,EAAE,QAAQ,CAAC,GAAG,CAAC,IAAI,UAAU,CAAC,WAAW;QACpF,UAAU,EAAE,gBAAgB,CAAC,cAAc,EAAE,YAAY,EAAE,QAAQ,CAAC,UAAU,CAAC;QAC/E,QAAQ,EAAE,gBAAgB,CAAC,cAAc,EAAE,UAAU,EAAE,QAAQ,CAAC,QAAQ,CAAC;QACzE,MAAM;KACP,CAAC;AACJ,CAAC,CAAC","sourcesContent":["import { QpqAppDeployment } from '@qpqjs/core';\n\nimport { Mount, parseMounts } from './parseMounts';\nimport { parsePortMappings, PortMapping } from './parsePortMappings';\n\nexport type ParsedDockerPlatformSettings = {\n  // Absent when the deployment sets no `portMappings`; the defaults depend on the app's config.\n  portMappings?: PortMapping[];\n  registry?: string;\n  arch?: string;\n  tag: string;\n  publicHost?: string;\n  dataPath?: string;\n  // Absent when the deployment mounts nothing beyond its state directory.\n  mounts?: Mount[];\n};\n\nconst asOptionalString = (deploymentName: string, name: string, value: unknown): string | undefined => {\n  if (value === undefined) {\n    return undefined;\n  }\n  if (typeof value !== 'string' || value.trim() === '') {\n    throw new Error(`Invalid docker deployment '${deploymentName}': platformSettings.${name} must be a non-empty string`);\n  }\n  return value.trim().replace(/\\/+$/, '');\n};\n\n/** The docker entry's platform settings, parsed; throws for a malformed value, naming the deployment. */\nexport const getDockerPlatformSettings = (deploymentName: string, deployment: QpqAppDeployment): ParsedDockerPlatformSettings => {\n  const settings = deployment.platformSettings ?? {};\n\n  let portMappings: PortMapping[] | undefined;\n  let mounts: Mount[] | undefined;\n  try {\n    portMappings = settings.portMappings === undefined ? undefined : parsePortMappings(settings.portMappings);\n    mounts = settings.mounts === undefined ? undefined : parseMounts(settings.mounts);\n  } catch (error) {\n    throw new Error(`Invalid docker deployment '${deploymentName}': ${error instanceof Error ? error.message : String(error)}`);\n  }\n\n  return {\n    portMappings,\n    registry: asOptionalString(deploymentName, 'registry', settings.registry),\n    arch: asOptionalString(deploymentName, 'arch', settings.arch),\n    tag: asOptionalString(deploymentName, 'tag', settings.tag) ?? deployment.environment,\n    publicHost: asOptionalString(deploymentName, 'publicHost', settings.publicHost),\n    dataPath: asOptionalString(deploymentName, 'dataPath', settings.dataPath),\n    mounts,\n  };\n};\n"]}