@qpqjs/cli 0.0.0-stage → 0.2.1

package/lib/commonjs/platforms/aws/goDocker.js

@@ -0,0 +1,457 @@
+"use strict";
+var __awaiter = (this && this.__awaiter) || function (thisArg, _arguments, P, generator) {
+    function adopt(value) { return value instanceof P ? value : new P(function (resolve) { resolve(value); }); }
+    return new (P || (P = Promise))(function (resolve, reject) {
+        function fulfilled(value) { try { step(generator.next(value)); } catch (e) { reject(e); } }
+        function rejected(value) { try { step(generator["throw"](value)); } catch (e) { reject(e); } }
+        function step(result) { result.done ? resolve(result.value) : adopt(result.value).then(fulfilled, rejected); }
+        step((generator = generator.apply(thisArg, _arguments || [])).next());
+    });
+};
+var __importDefault = (this && this.__importDefault) || function (mod) {
+    return (mod && mod.__esModule) ? mod : { "default": mod };
+};
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.awsGoDocker = void 0;
+// `qpq go:docker` — asks the same questions as `qpq go`, then builds locally
+// and deploys in parallel via docker. The two halves can run on different
+// machines, which is what lets a CI deploy run one job per service and phase:
+//
+//   qpq go:docker <svc> <stack>                build, then deploy
+//   qpq go:docker <svc> <stack> --build-only   build and save; no docker needed
+//   qpq go:docker <svc> <stack> --from-build   deploy the saved build; the
+//                                              workspace need not be built
+//
+// The build half: QPQ config synth, rspack api bundles, rspack view bundles,
+// rspack federated-remote bundles, and one self-contained CDK cloud assembly
+// per service (`cdk synth --output`, which stages the api bundle as assets).
+// It ends by writing a manifest per service with everything the deploy half
+// needs that only the live config can answer (stack names, views destinations,
+// the federated store), so the deploy half never loads a service config. The
+// saved build for a service is:
+//   dist/qpq/go-docker/<app>/<svc>/assembly                  the cloud assembly
+//   dist/qpq/go-docker/<app>/<svc>/deploy.json               the manifest
+//   dist/apps/<app>/services/<svc>/views                     the views bundle
+//   dist/apps/<app>/services/<svc>/service-remote-published  the federated remote
+//
+// The deploy half, from the manifests:
+//   wave 1 (inf): one docker container per service deploys its inf stack, all
+//     concurrently. Containers run only the CDK CLI against the mounted
+//     assembly — the workspace (and its npm-linked quidproquo packages) never
+//     needs to exist inside the image.
+//   wave 2 (api + web): once every inf stack is done, api and web stacks for
+//     all services deploy concurrently (they depend only on inf, not on each
+//     other).
+//   views: the built bundles are synced to S3, one aws-cli container per
+//     service, all concurrently.
+//   publish: the built federated remotes (backends that opt in with
+//     defineFederatedModuleStore(...)) are synced to S3 and their manifests
+//     flipped, one aws-cli container per service, all concurrently. Follows
+//     every api deploy, so a lambda never runs a previous release's stories.
+//
+// domain/bootstrap menu options deploy host-side exactly like `qpq go` —
+// a single stack gains nothing from docker.
+//
+// Requires the same env as `go` (the build half included: `cdk synth` still
+// looks up hosted zones and VPCs) plus a running docker daemon for the deploy
+// half. Knobs: GO_DOCKER_BUILD_CONCURRENCY (default: the machine's core count —
+// local builds are CPU-bound) and GO_DOCKER_DEPLOY_CONCURRENCY (default
+// unlimited — deploys just wait on CloudFormation).
+const core_1 = require("@qpqjs/core");
+const deploy_aws_1 = require("@qpqjs/deploy-aws");
+const deploy_rspack_1 = require("@qpqjs/deploy-rspack");
+const fs_1 = __importDefault(require("fs"));
+const os_1 = __importDefault(require("os"));
+const path_1 = __importDefault(require("path"));
+const synth_1 = require("../../commands/synth");
+const discovery_1 = require("../../lib/discovery");
+const getDefaultHookJobs_1 = require("../../lib/getDefaultHookJobs");
+const hooks_1 = require("../../lib/hooks");
+const qpqConfigs_1 = require("../../lib/qpqConfigs");
+const runCommand_1 = require("../../lib/runCommand");
+const runTasks_1 = require("../../lib/runTasks");
+const timing_1 = require("../../lib/timing");
+const views_1 = require("../../lib/views");
+const awsCredentials_1 = require("./awsCredentials");
+const cdkApp_1 = require("./cdkApp");
+const goDockerManifest_1 = require("./goDockerManifest");
+const remote_1 = require("./remote");
+const stacks_1 = require("./stacks");
+const viewsSync_1 = require("./viewsSync");
+const IMAGE_TAG = 'qpq-cdk-deployer';
+const AWS_CLI_IMAGE = 'amazon/aws-cli';
+const BUILD_CONCURRENCY = Number(process.env.GO_DOCKER_BUILD_CONCURRENCY) || os_1.default.availableParallelism();
+const DEPLOY_CONCURRENCY = Number(process.env.GO_DOCKER_DEPLOY_CONCURRENCY) || Infinity;
+// Credentials/region reach the containers via `docker run -e NAME` (value
+// inherited from this process's env, never on the docker command line).
+const AWS_ENV_PASSTHROUGH = [
+    'AWS_ACCESS_KEY_ID',
+    'AWS_SECRET_ACCESS_KEY',
+    'AWS_SESSION_TOKEN',
+    'AWS_REGION',
+    'AWS_DEFAULT_REGION',
+    'AWS_DEFAULT_ACCOUNT',
+];
+const getStackNeeds = (stacks) => ({
+    inf: stacks === 'all' || stacks === 'inf',
+    api: stacks === 'all' || stacks === 'api',
+    web: stacks === 'all' || stacks === 'web',
+    views: stacks === 'all' || stacks === 'views',
+});
+// A container left behind by an interrupted run would block reusing its name.
+// Clear it first, best-effort: a missing container (exit 1) must not fail the
+// deploy. Was a `docker rm -f … >/dev/null 2>&1 ;` prefix on the run command,
+// but that only worked under `shell: true`; as a separate call it's shell-free.
+const removeContainer = (containerName) => (0, runCommand_1.runCommandBestEffort)('docker', ['rm', '-f', containerName]);
+const assertDockerRunning = () => __awaiter(void 0, void 0, void 0, function* () {
+    try {
+        yield (0, runCommand_1.runCommand)('docker', ['info', '--format', 'docker daemon ok — server {{.ServerVersion}}']);
+    }
+    catch (_a) {
+        throw new Error('Docker daemon is not running (start Docker Desktop and retry).');
+    }
+});
+// Pin the image's CDK CLI to the CLI's own aws-cdk version so it can always
+// read the assembly schema the host synthesized.
+const buildDeployerImage = (cdkVersion) => __awaiter(void 0, void 0, void 0, function* () {
+    console.log(`Building deployer image [${IMAGE_TAG}] (aws-cdk ${cdkVersion})`);
+    yield (0, runCommand_1.runCommand)('docker', ['build', '-t', IMAGE_TAG, '--build-arg', `CDK_VERSION=${cdkVersion}`, (0, cdkApp_1.getDockerDir)()]);
+});
+// Deploy one stack from a pre-synthesized assembly in a throwaway container
+// named <service>-<stackType> (e.g. mini-web) so `docker ps` reads cleanly.
+// The assembly mounts read-only and is copied container-local first — the CDK
+// CLI writes lock files next to the assembly it reads, and the copy keeps
+// parallel api/web deploys of the same service fully isolated.
+const dockerDeployStack = (color, serviceName, stackType, stackName, assemblyDir) => __awaiter(void 0, void 0, void 0, function* () {
+    const containerName = `${serviceName}-${stackType}`;
+    yield removeContainer(containerName);
+    yield (0, runCommand_1.runCommandPrefixed)(`${stackType}:${serviceName}`, 'docker', [
+        'run',
+        '--rm',
+        '--name',
+        containerName,
+        '-v',
+        `${assemblyDir}:/assembly:ro`,
+        ...AWS_ENV_PASSTHROUGH.flatMap((name) => ['-e', name]),
+        IMAGE_TAG,
+        'bash',
+        '-c',
+        `cp -r /assembly /work/assembly && cdk deploy ${stackName} --app /work/assembly --require-approval never --progress events`,
+    ], { color });
+});
+// Sync one service's pre-built views to S3 in a throwaway aws-cli container
+// named <service>-views. The official image's entrypoint is `aws`. Multiple
+// destinations (shell → website root + views prefix) run sequentially within
+// the service, reusing the container name. Mirrors the host-side syncViewsToS3
+// cache policy: hashed assets immutable, the fixed-name entry points re-uploaded
+// with no-cache every deploy (see NO_CACHE_FILES).
+const dockerSyncViews = (color, serviceName, views) => __awaiter(void 0, void 0, void 0, function* () {
+    const containerName = `${serviceName}-views`;
+    const distDir = (0, goDockerManifest_1.fromManifestPath)(views.dir);
+    const runAwsCli = (awsArgs) => __awaiter(void 0, void 0, void 0, function* () {
+        yield removeContainer(containerName);
+        yield (0, runCommand_1.runCommandPrefixed)(`views:${serviceName}`, 'docker', [
+            'run',
+            '--rm',
+            '--name',
+            containerName,
+            '-v',
+            `${distDir}:/views:ro`,
+            ...AWS_ENV_PASSTHROUGH.flatMap((name) => ['-e', name]),
+            AWS_CLI_IMAGE,
+            ...awsArgs,
+        ], { color });
+    });
+    for (const destination of views.destinations) {
+        yield runAwsCli([
+            's3',
+            'sync',
+            '/views',
+            destination,
+            '--cache-control',
+            'public,max-age=31536000,immutable',
+            ...viewsSync_1.NO_CACHE_FILES.flatMap((file) => ['--exclude', file]),
+        ]);
+        for (const file of viewsSync_1.NO_CACHE_FILES) {
+            if (!fs_1.default.existsSync(path_1.default.join(distDir, file))) {
+                continue;
+            }
+            yield runAwsCli(['s3', 'cp', `/views/${file}`, `${destination}/${file}`, '--cache-control', 'no-cache']);
+        }
+    }
+});
+// Publish one service's already-built federated remote to S3 in a throwaway
+// aws-cli container named <service>-publish. The version dir (everything the
+// manifest references) syncs first, then the manifest.json is copied last —
+// same ordering guarantee as the host-side publish, so a reading lambda never
+// sees a manifest whose files aren't all present yet.
+const dockerPublishRemote = (color, serviceName, remote) => __awaiter(void 0, void 0, void 0, function* () {
+    const { manifestHash, bucketName, servicePrefix } = remote;
+    const publishPath = (0, goDockerManifest_1.fromManifestPath)(remote.dir);
+    const containerName = `${serviceName}-publish`;
+    // /publish is the service-remote-published dir; the hashed version subdir and
+    // manifest.json both live directly under it.
+    const s3Operations = [
+        ['s3', 'sync', `/publish/${manifestHash}`, `s3://${bucketName}/${servicePrefix}/${manifestHash}`],
+        ['s3', 'cp', '/publish/manifest.json', `s3://${bucketName}/${servicePrefix}/manifest.json`],
+    ];
+    for (const s3Operation of s3Operations) {
+        yield removeContainer(containerName);
+        yield (0, runCommand_1.runCommandPrefixed)(`publish:${serviceName}`, 'docker', [
+            'run',
+            '--rm',
+            '--name',
+            containerName,
+            '-v',
+            `${publishPath}:/publish:ro`,
+            ...AWS_ENV_PASSTHROUGH.flatMap((name) => ['-e', name]),
+            AWS_CLI_IMAGE,
+            ...s3Operation,
+        ], { color });
+    }
+});
+const resolveRemoteEntry = (appName, service) => {
+    const { publishPath, manifestHash, bucketName, servicePrefix } = (0, remote_1.resolvePublishTarget)(appName, service);
+    return { dir: (0, goDockerManifest_1.toManifestPath)(publishPath), manifestHash, bucketName, servicePrefix };
+};
+// Everything the deploy half needs that only the live config can answer,
+// resolved here while the workspace is built and the config loads.
+const resolveBuildManifest = (appName, deploymentName, service, stacks, hasViews, hasRemote, cdkVersion) => {
+    const qpqConfig = (0, qpqConfigs_1.loadServiceQpqConfig)(appName, service);
+    return {
+        cdkVersion,
+        deploymentName,
+        builtFor: stacks,
+        stacks: stacks === 'views'
+            ? null
+            : {
+                inf: deploy_aws_1.qpqDeployAwsUtils.getInfStackName(qpqConfig),
+                api: deploy_aws_1.qpqDeployAwsUtils.getApiStackName(qpqConfig),
+                web: deploy_aws_1.qpqDeployAwsUtils.getWebStackName(qpqConfig),
+            },
+        views: hasViews ? { dir: (0, goDockerManifest_1.toManifestPath)((0, views_1.getViewsDistDir)(appName, service)), destinations: (0, viewsSync_1.getViewsS3Destinations)(appName, service) } : null,
+        remote: hasRemote ? resolveRemoteEntry(appName, service) : null,
+    };
+};
+// The directories a CI job uploads to carry one service's saved build to the
+// deploy job, root-relative.
+const getSavedBuildDirs = (appName, service, manifest) => [
+    (0, goDockerManifest_1.toManifestPath)((0, goDockerManifest_1.getGoDockerBuildDir)(appName, service)),
+    ...(manifest.views ? [manifest.views.dir] : []),
+    ...(manifest.remote ? [manifest.remote.dir] : []),
+];
+const buildGoDockerOutput = (appName, deploymentName, plan) => __awaiter(void 0, void 0, void 0, function* () {
+    const { services, stacks } = plan;
+    const need = getStackNeeds(stacks);
+    const needCdkSynth = stacks !== 'views';
+    const viewServices = need.views ? services.filter((service) => (0, discovery_1.getServiceNamesWithViews)(appName).includes(service)) : [];
+    console.log('\n=== Build ===\n');
+    // A stale assembly or manifest from an earlier build must not outlive a
+    // change of stack selection, so every selected service starts empty.
+    for (const service of services) {
+        fs_1.default.rmSync((0, goDockerManifest_1.getGoDockerBuildDir)(appName, service), { recursive: true, force: true });
+    }
+    yield (0, hooks_1.runAppHook)(appName, 'predeploy');
+    // Workspace packages resolve through their built dist/ (package.json main),
+    // so bundles would ship stale code unless every lib is tsc'd first. Other
+    // apps' packages are skipped: nothing this app deploys can import them
+    // unless it declares them, and declared ones are built.
+    console.log('Building workspace packages');
+    (0, runTasks_1.assertNoFailures)('Workspace build', yield (0, hooks_1.runHookForAppPackages)('build', appName, (0, getDefaultHookJobs_1.getDefaultHookJobs)()));
+    // Synth the selected services' QPQ configs (and shell's, which the views
+    // destinations resolve from) so a config that fails to load fails here,
+    // before any bundling. In-process: it's just config loads + JSON writes.
+    const qpqSynthServices = [...new Set([...services, ...(need.views ? ['shell'] : [])])];
+    for (const service of qpqSynthServices) {
+        yield (0, synth_1.synthCommand)([service, '--app', appName]);
+    }
+    // Federated remotes are the backend story code, so they are rebuilt (and
+    // later republished) whenever the api stack is. Skips services without
+    // defineFederatedModuleStore(...). Detected here (after the workspace build)
+    // because it loads each service's config.
+    const federatedServices = need.api ? (0, qpqConfigs_1.getServiceNamesWithFederation)(appName, services) : [];
+    if (needCdkSynth) {
+        (0, runTasks_1.assertNoFailures)('API bundling', yield (0, runTasks_1.runTasks)(services.map((service) => ({
+            label: `bundle-api:${service}`,
+            run: () => __awaiter(void 0, void 0, void 0, function* () {
+                console.log(`Bundling api: [${service}]`);
+                const qpqConfig = (0, qpqConfigs_1.loadServiceQpqConfig)(appName, service);
+                yield (0, deploy_rspack_1.runRspack)((0, deploy_rspack_1.getServiceRspackConfig)(qpqConfig, path_1.default.join((0, discovery_1.getServiceDirectory)(appName, service), 'service')));
+            }),
+        })), BUILD_CONCURRENCY));
+    }
+    (0, runTasks_1.assertNoFailures)('Views bundling', yield (0, runTasks_1.runTasks)(viewServices.map((service) => ({
+        label: `bundle-views:${service}`,
+        run: () => __awaiter(void 0, void 0, void 0, function* () {
+            console.log(`Bundling views: [${service}]`);
+            yield (0, views_1.bundleViews)(appName, service);
+        }),
+    })), BUILD_CONCURRENCY));
+    // Build the federated remotes now (rspack needs the workspace), so the
+    // publish wave only has to sync the already-built output — mirroring how
+    // views are bundled here and synced later.
+    (0, runTasks_1.assertNoFailures)('Remote bundling', yield (0, runTasks_1.runTasks)(federatedServices.map((service) => ({
+        label: `bundle-remote:${service}`,
+        run: () => __awaiter(void 0, void 0, void 0, function* () {
+            console.log(`Bundling federated remote: [${service}]`);
+            yield (0, remote_1.buildRemote)(appName, service);
+        }),
+    })), BUILD_CONCURRENCY));
+    if (needCdkSynth) {
+        // One self-contained cloud assembly per service (all its stacks + staged
+        // assets) — separate --output dirs so synths can run in parallel and
+        // containers never share mutable state.
+        (0, runTasks_1.assertNoFailures)('CDK synth', yield (0, runTasks_1.runTasks)(services.map((service) => ({
+            label: `cdk-synth:${service}`,
+            run: () => (0, runCommand_1.runCommandPrefixed)(`cdk-synth:${service}`, 'npx', ['cdk', 'synth', '--quiet', '--app', (0, cdkApp_1.getCdkAppCommand)(), '--output', (0, goDockerManifest_1.getGoDockerAssemblyDir)(appName, service)], {
+                cwd: (0, discovery_1.getRoot)(),
+                env: { DEPLOY_SERVICE_NAME: service, DEPLOY_APP_NAME: appName },
+                color: (0, runCommand_1.nextPrefixColor)(),
+            }),
+        })), BUILD_CONCURRENCY));
+    }
+    // Manifests are written last, so one only ever exists beside a complete build.
+    const cdkVersion = (0, cdkApp_1.getCdkCliVersion)();
+    for (const service of services) {
+        const manifest = resolveBuildManifest(appName, deploymentName, service, stacks, viewServices.includes(service), federatedServices.includes(service), cdkVersion);
+        (0, goDockerManifest_1.writeGoDockerBuildManifest)(appName, service, manifest);
+        console.log(`Saved build for [${service}]:`);
+        for (const dir of getSavedBuildDirs(appName, service, manifest)) {
+            console.log(`  ${dir}`);
+        }
+    }
+});
+// A deploy phase runs from a saved build only when that build was made for it:
+// `all` covers every phase, any other selection only its own. A build made for
+// `inf` has an assembly the api stack could deploy from, but no remote to
+// publish after it, which is exactly the stale-stories deploy the publish
+// ordering exists to prevent.
+const readCheckedManifest = (appName, deploymentName, service, stacks, cdkVersion) => {
+    const manifest = (0, goDockerManifest_1.readGoDockerBuildManifest)(appName, service);
+    const rebuild = `rebuild it with \`qpq go:docker ${service} ${stacks} --build-only --app ${appName} --deployment ${deploymentName}\``;
+    if (manifest.cdkVersion !== cdkVersion) {
+        throw new Error(`saved build for [${service}] was synthesized with aws-cdk ${manifest.cdkVersion}, this qpq has ${cdkVersion}; ${rebuild}`);
+    }
+    if (manifest.deploymentName !== deploymentName) {
+        throw new Error(`saved build for [${service}] is for deployment '${manifest.deploymentName}', not '${deploymentName}'; ${rebuild}`);
+    }
+    if (manifest.builtFor !== 'all' && manifest.builtFor !== stacks) {
+        throw new Error(`saved build for [${service}] was built for '${manifest.builtFor}' stacks and cannot deploy '${stacks}'; ${rebuild}`);
+    }
+    return manifest;
+};
+const getStackName = (manifest, service, stackType) => {
+    if (!manifest.stacks) {
+        throw new Error(`saved build for [${service}] has no cloud assembly (it was built for views only)`);
+    }
+    return manifest.stacks[stackType];
+};
+const deployGoDockerOutput = (appName, deploymentName, plan) => __awaiter(void 0, void 0, void 0, function* () {
+    const { services, stacks } = plan;
+    const need = getStackNeeds(stacks);
+    const needCdkDeploys = stacks !== 'views';
+    // Every manifest is read and checked up front, so one missing or mismatched
+    // build fails the run before any container starts.
+    const cdkVersion = (0, cdkApp_1.getCdkCliVersion)();
+    const manifests = new Map(services.map((service) => [service, readCheckedManifest(appName, deploymentName, service, stacks, cdkVersion)]));
+    const manifestFor = (service) => manifests.get(service);
+    const viewServices = need.views ? services.filter((service) => manifestFor(service).views !== null) : [];
+    const federatedServices = need.api ? services.filter((service) => manifestFor(service).remote !== null) : [];
+    // Federated publish needs the api stack (need.api ⇒ needCdkDeploys), so any
+    // docker preflight it requires is already covered by these two checks.
+    if (needCdkDeploys || viewServices.length > 0) {
+        yield assertDockerRunning();
+    }
+    if (needCdkDeploys) {
+        yield buildDeployerImage(cdkVersion);
+    }
+    // The aws-cli image backs both the views sync and the federated publish
+    // waves. Pull once now so those waves don't race N containers into pulling
+    // the same image.
+    if (viewServices.length > 0 || federatedServices.length > 0) {
+        yield (0, runCommand_1.runCommand)('docker', ['pull', AWS_CLI_IMAGE]);
+    }
+    // ---- Wave 1: inf stacks, one container per service, all concurrent ----
+    if (need.inf) {
+        console.log('\n=== Deploy inf stacks (docker) ===\n');
+        (0, timing_1.logTimeStart)('infWave');
+        (0, runTasks_1.assertNoFailures)('Inf deploy', yield (0, runTasks_1.runTasks)(services.map((service) => ({
+            label: `inf:${service}`,
+            run: () => dockerDeployStack((0, runCommand_1.nextPrefixColor)(), service, 'inf', getStackName(manifestFor(service), service, 'inf'), (0, goDockerManifest_1.getGoDockerAssemblyDir)(appName, service)),
+        })), DEPLOY_CONCURRENCY));
+        (0, timing_1.logTimeEnd)('infWave');
+    }
+    // ---- Wave 2: api + web stacks, all concurrent ----
+    if (need.api || need.web) {
+        console.log('\n=== Deploy api + web stacks (docker) ===\n');
+        (0, timing_1.logTimeStart)('apiWebWave');
+        (0, runTasks_1.assertNoFailures)('Api/Web deploy', yield (0, runTasks_1.runTasks)(['api', 'web']
+            .filter((stackType) => (stackType === 'api' ? need.api : need.web))
+            .flatMap((stackType) => services.map((service) => ({
+            label: `${stackType}:${service}`,
+            run: () => dockerDeployStack((0, runCommand_1.nextPrefixColor)(), service, stackType, getStackName(manifestFor(service), service, stackType), (0, goDockerManifest_1.getGoDockerAssemblyDir)(appName, service)),
+        }))), DEPLOY_CONCURRENCY));
+        (0, timing_1.logTimeEnd)('apiWebWave');
+    }
+    // ---- Views: sync the pre-built bundles to S3, all concurrent ----
+    if (viewServices.length > 0) {
+        console.log('\n=== Sync views to S3 (docker) ===\n');
+        (0, timing_1.logTimeStart)('viewsWave');
+        (0, runTasks_1.assertNoFailures)('Views sync', yield (0, runTasks_1.runTasks)(viewServices.map((service) => ({
+            label: `views:${service}`,
+            run: () => dockerSyncViews((0, runCommand_1.nextPrefixColor)(), service, manifestFor(service).views),
+        })), DEPLOY_CONCURRENCY));
+        (0, timing_1.logTimeEnd)('viewsWave');
+    }
+    // ---- Publish: the pre-built federated remotes to S3, all concurrent ----
+    if (federatedServices.length > 0) {
+        console.log('\n=== Publish federated remotes to S3 (docker) ===\n');
+        (0, timing_1.logTimeStart)('publishWave');
+        (0, runTasks_1.assertNoFailures)('Federated publish', yield (0, runTasks_1.runTasks)(federatedServices.map((service) => ({
+            label: `publish:${service}`,
+            run: () => dockerPublishRemote((0, runCommand_1.nextPrefixColor)(), service, manifestFor(service).remote),
+        })), DEPLOY_CONCURRENCY));
+        (0, timing_1.logTimeEnd)('publishWave');
+    }
+});
+const awsGoDocker = (appName, plan, mode) => __awaiter(void 0, void 0, void 0, function* () {
+    if (plan.kind === 'cancelled') {
+        return;
+    }
+    if ((yield (0, awsCredentials_1.isAwsCredentialsValid)()) === false) {
+        console.log('Credentials are expired or invalid.');
+        return;
+    }
+    (0, timing_1.logTimeStart)('totalTime');
+    if (plan.kind === 'account') {
+        yield (0, stacks_1.deployAccountStack)(plan.appName);
+        (0, timing_1.logTimeEnd)('totalTime');
+        return;
+    }
+    if (plan.kind === 'bootstrap') {
+        if (plan.includeDomain) {
+            yield (0, stacks_1.deployDomainStack)(plan.appName);
+        }
+        yield (0, stacks_1.deployBootstrapStack)(plan.appName);
+        (0, timing_1.logTimeEnd)('totalTime');
+        return;
+    }
+    // resolveDeployment primed the selection before this driver ran. The manifest
+    // records it so a build for one deployment can never deploy to another.
+    const deploymentName = process.env[core_1.QpqDeployEnvVar.deployName];
+    if (!deploymentName) {
+        throw new Error(`no deployment selected (${core_1.QpqDeployEnvVar.deployName} is unset)`);
+    }
+    console.log(`\n\nRunning dockerized deploy (${mode})\n\n`);
+    console.log('Executing for services');
+    console.log(plan.services.join(', '));
+    if (mode !== 'from-build') {
+        yield buildGoDockerOutput(appName, deploymentName, plan);
+    }
+    if (mode !== 'build-only') {
+        yield deployGoDockerOutput(appName, deploymentName, plan);
+    }
+    (0, timing_1.logTimeEnd)('totalTime');
+});
+exports.awsGoDocker = awsGoDocker;
+//# sourceMappingURL=goDocker.js.map

package/lib/commonjs/platforms/aws/goDocker.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"goDocker.js","sourceRoot":"","sources":["../../../../src/platforms/aws/goDocker.ts"],"names":[],"mappings":";;;;;;;;;;;;;;;AAAA,6EAA6E;AAC7E,0EAA0E;AAC1E,8EAA8E;AAC9E,EAAE;AACF,kEAAkE;AAClE,gFAAgF;AAChF,2EAA2E;AAC3E,2EAA2E;AAC3E,EAAE;AACF,6EAA6E;AAC7E,6EAA6E;AAC7E,6EAA6E;AAC7E,4EAA4E;AAC5E,+EAA+E;AAC/E,6EAA6E;AAC7E,gCAAgC;AAChC,gFAAgF;AAChF,0EAA0E;AAC1E,8EAA8E;AAC9E,kFAAkF;AAClF,EAAE;AACF,uCAAuC;AACvC,8EAA8E;AAC9E,wEAAwE;AACxE,8EAA8E;AAC9E,uCAAuC;AACvC,6EAA6E;AAC7E,6EAA6E;AAC7E,cAAc;AACd,yEAAyE;AACzE,iCAAiC;AACjC,oEAAoE;AACpE,4EAA4E;AAC5E,4EAA4E;AAC5E,6EAA6E;AAC7E,EAAE;AACF,yEAAyE;AACzE,4CAA4C;AAC5C,EAAE;AACF,4EAA4E;AAC5E,8EAA8E;AAC9E,gFAAgF;AAChF,wEAAwE;AACxE,oDAAoD;AACpD,sCAA8C;AAC9C,kDAAsD;AACtD,wDAAyE;AAEzE,4CAAoB;AACpB,4CAAoB;AACpB,gDAAwB;AAExB,gDAAoD;AAEpD,mDAA6F;AAC7F,qEAAkE;AAElE,2CAAoE;AACpE,qDAA2F;AAC3F,qDAA6G;AAC7G,iDAAgE;AAChE,6CAA4D;AAC5D,2CAA+D;AAC/D,qDAAyD;AACzD,qCAA4E;AAC5E,yDAU4B;AAC5B,qCAA6D;AAC7D,qCAAuF;AACvF,2CAAqE;AAErE,MAAM,SAAS,GAAG,kBAAkB,CAAC;AACrC,MAAM,aAAa,GAAG,gBAAgB,CAAC;AAEvC,MAAM,iBAAiB,GAAG,MAAM,CAAC,OAAO,CAAC,GAAG,CAAC,2BAA2B,CAAC,IAAI,YAAE,CAAC,oBAAoB,EAAE,CAAC;AACvG,MAAM,kBAAkB,GAAG,MAAM,CAAC,OAAO,CAAC,GAAG,CAAC,4BAA4B,CAAC,IAAI,QAAQ,CAAC;AAExF,0EAA0E;AAC1E,wEAAwE;AACxE,MAAM,mBAAmB,GAAG;IAC1B,mBAAmB;IACnB,uBAAuB;IACvB,mBAAmB;IACnB,YAAY;IACZ,oBAAoB;IACpB,qBAAqB;CACtB,CAAC;AAMF,MAAM,aAAa,GAAG,CAAC,MAAiB,EAAc,EAAE,CAAC,CAAC;IACxD,GAAG,EAAE,MAAM,KAAK,KAAK,IAAI,MAAM,KAAK,KAAK;IACzC,GAAG,EAAE,MAAM,KAAK,KAAK,IAAI,MAAM,KAAK,KAAK;IACzC,GAAG,EAAE,MAAM,KAAK,KAAK,IAAI,MAAM,KAAK,KAAK;IACzC,KAAK,EAAE,MAAM,KAAK,KAAK,IAAI,MAAM,KAAK,OAAO;CAC9C,CAAC,CAAC;AAEH,8EAA8E;AAC9E,8EAA8E;AAC9E,8EAA8E;AAC9E,gFAAgF;AAChF,MAAM,eAAe,GAAG,CAAC,aAAqB,EAAiB,EAAE,CAAC,IAAA,iCAAoB,EAAC,QAAQ,EAAE,CAAC,IAAI,EAAE,IAAI,EAAE,aAAa,CAAC,CAAC,CAAC;AAE9H,MAAM,mBAAmB,GAAG,GAAwB,EAAE;IACpD,IAAI,CAAC;QACH,MAAM,IAAA,uBAAU,EAAC,QAAQ,EAAE,CAAC,MAAM,EAAE,UAAU,EAAE,8CAA8C,CAAC,CAAC,CAAC;IACnG,CAAC;IAAC,WAAM,CAAC;QACP,MAAM,IAAI,KAAK,CAAC,gEAAgE,CAAC,CAAC;IACpF,CAAC;AACH,CAAC,CAAA,CAAC;AAEF,4EAA4E;AAC5E,iDAAiD;AACjD,MAAM,kBAAkB,GAAG,CAAO,UAAkB,EAAiB,EAAE;IACrE,OAAO,CAAC,GAAG,CAAC,4BAA4B,SAAS,cAAc,UAAU,GAAG,CAAC,CAAC;IAC9E,MAAM,IAAA,uBAAU,EAAC,QAAQ,EAAE,CAAC,OAAO,EAAE,IAAI,EAAE,SAAS,EAAE,aAAa,EAAE,eAAe,UAAU,EAAE,EAAE,IAAA,qBAAY,GAAE,CAAC,CAAC,CAAC;AACrH,CAAC,CAAA,CAAC;AAEF,4EAA4E;AAC5E,4EAA4E;AAC5E,8EAA8E;AAC9E,0EAA0E;AAC1E,+DAA+D;AAC/D,MAAM,iBAAiB,GAAG,CACxB,KAAa,EACb,WAAmB,EACnB,SAAgC,EAChC,SAAiB,EACjB,WAAmB,EACJ,EAAE;IACjB,MAAM,aAAa,GAAG,GAAG,WAAW,IAAI,SAAS,EAAE,CAAC;IACpD,MAAM,eAAe,CAAC,aAAa,CAAC,CAAC;IACrC,MAAM,IAAA,+BAAkB,EACtB,GAAG,SAAS,IAAI,WAAW,EAAE,EAC7B,QAAQ,EACR;QACE,KAAK;QACL,MAAM;QACN,QAAQ;QACR,aAAa;QACb,IAAI;QACJ,GAAG,WAAW,eAAe;QAC7B,GAAG,mBAAmB,CAAC,OAAO,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,CAAC,IAAI,EAAE,IAAI,CAAC,CAAC;QACtD,SAAS;QACT,MAAM;QACN,IAAI;QACJ,gDAAgD,SAAS,kEAAkE;KAC5H,EACD,EAAE,KAAK,EAAE,CACV,CAAC;AACJ,CAAC,CAAA,CAAC;AAEF,4EAA4E;AAC5E,4EAA4E;AAC5E,6EAA6E;AAC7E,+EAA+E;AAC/E,iFAAiF;AACjF,mDAAmD;AACnD,MAAM,eAAe,GAAG,CAAO,KAAa,EAAE,WAAmB,EAAE,KAAyB,EAAiB,EAAE;IAC7G,MAAM,aAAa,GAAG,GAAG,WAAW,QAAQ,CAAC;IAC7C,MAAM,OAAO,GAAG,IAAA,mCAAgB,EAAC,KAAK,CAAC,GAAG,CAAC,CAAC;IAE5C,MAAM,SAAS,GAAG,CAAO,OAAiB,EAAiB,EAAE;QAC3D,MAAM,eAAe,CAAC,aAAa,CAAC,CAAC;QACrC,MAAM,IAAA,+BAAkB,EACtB,SAAS,WAAW,EAAE,EACtB,QAAQ,EACR;YACE,KAAK;YACL,MAAM;YACN,QAAQ;YACR,aAAa;YACb,IAAI;YACJ,GAAG,OAAO,YAAY;YACtB,GAAG,mBAAmB,CAAC,OAAO,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,CAAC,IAAI,EAAE,IAAI,CAAC,CAAC;YACtD,aAAa;YACb,GAAG,OAAO;SACX,EACD,EAAE,KAAK,EAAE,CACV,CAAC;IACJ,CAAC,CAAA,CAAC;IAEF,KAAK,MAAM,WAAW,IAAI,KAAK,CAAC,YAAY,EAAE,CAAC;QAC7C,MAAM,SAAS,CAAC;YACd,IAAI;YACJ,MAAM;YACN,QAAQ;YACR,WAAW;YACX,iBAAiB;YACjB,mCAAmC;YACnC,GAAG,0BAAc,CAAC,OAAO,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,CAAC,WAAW,EAAE,IAAI,CAAC,CAAC;SACzD,CAAC,CAAC;QAEH,KAAK,MAAM,IAAI,IAAI,0BAAc,EAAE,CAAC;YAClC,IAAI,CAAC,YAAE,CAAC,UAAU,CAAC,cAAI,CAAC,IAAI,CAAC,OAAO,EAAE,IAAI,CAAC,CAAC,EAAE,CAAC;gBAC7C,SAAS;YACX,CAAC;YAED,MAAM,SAAS,CAAC,CAAC,IAAI,EAAE,IAAI,EAAE,UAAU,IAAI,EAAE,EAAE,GAAG,WAAW,IAAI,IAAI,EAAE,EAAE,iBAAiB,EAAE,UAAU,CAAC,CAAC,CAAC;QAC3G,CAAC;IACH,CAAC;AACH,CAAC,CAAA,CAAC;AAEF,4EAA4E;AAC5E,6EAA6E;AAC7E,4EAA4E;AAC5E,8EAA8E;AAC9E,sDAAsD;AACtD,MAAM,mBAAmB,GAAG,CAAO,KAAa,EAAE,WAAmB,EAAE,MAA2B,EAAiB,EAAE;IACnH,MAAM,EAAE,YAAY,EAAE,UAAU,EAAE,aAAa,EAAE,GAAG,MAAM,CAAC;IAC3D,MAAM,WAAW,GAAG,IAAA,mCAAgB,EAAC,MAAM,CAAC,GAAG,CAAC,CAAC;IACjD,MAAM,aAAa,GAAG,GAAG,WAAW,UAAU,CAAC;IAE/C,8EAA8E;IAC9E,6CAA6C;IAC7C,MAAM,YAAY,GAAe;QAC/B,CAAC,IAAI,EAAE,MAAM,EAAE,YAAY,YAAY,EAAE,EAAE,QAAQ,UAAU,IAAI,aAAa,IAAI,YAAY,EAAE,CAAC;QACjG,CAAC,IAAI,EAAE,IAAI,EAAE,wBAAwB,EAAE,QAAQ,UAAU,IAAI,aAAa,gBAAgB,CAAC;KAC5F,CAAC;IAEF,KAAK,MAAM,WAAW,IAAI,YAAY,EAAE,CAAC;QACvC,MAAM,eAAe,CAAC,aAAa,CAAC,CAAC;QACrC,MAAM,IAAA,+BAAkB,EACtB,WAAW,WAAW,EAAE,EACxB,QAAQ,EACR;YACE,KAAK;YACL,MAAM;YACN,QAAQ;YACR,aAAa;YACb,IAAI;YACJ,GAAG,WAAW,cAAc;YAC5B,GAAG,mBAAmB,CAAC,OAAO,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,CAAC,IAAI,EAAE,IAAI,CAAC,CAAC;YACtD,aAAa;YACb,GAAG,WAAW;SACf,EACD,EAAE,KAAK,EAAE,CACV,CAAC;IACJ,CAAC;AACH,CAAC,CAAA,CAAC;AAEF,MAAM,kBAAkB,GAAG,CAAC,OAAe,EAAE,OAAe,EAAuB,EAAE;IACnF,MAAM,EAAE,WAAW,EAAE,YAAY,EAAE,UAAU,EAAE,aAAa,EAAE,GAAG,IAAA,6BAAoB,EAAC,OAAO,EAAE,OAAO,CAAC,CAAC;IACxG,OAAO,EAAE,GAAG,EAAE,IAAA,iCAAc,EAAC,WAAW,CAAC,EAAE,YAAY,EAAE,UAAU,EAAE,aAAa,EAAE,CAAC;AACvF,CAAC,CAAC;AAEF,yEAAyE;AACzE,mEAAmE;AACnE,MAAM,oBAAoB,GAAG,CAC3B,OAAe,EACf,cAAsB,EACtB,OAAe,EACf,MAAiB,EACjB,QAAiB,EACjB,SAAkB,EAClB,UAAkB,EACK,EAAE;IACzB,MAAM,SAAS,GAAG,IAAA,iCAAoB,EAAC,OAAO,EAAE,OAAO,CAAC,CAAC;IAEzD,OAAO;QACL,UAAU;QACV,cAAc;QACd,QAAQ,EAAE,MAAM;QAChB,MAAM,EACJ,MAAM,KAAK,OAAO;YAChB,CAAC,CAAC,IAAI;YACN,CAAC,CAAC;gBACE,GAAG,EAAE,8BAAiB,CAAC,eAAe,CAAC,SAAS,CAAC;gBACjD,GAAG,EAAE,8BAAiB,CAAC,eAAe,CAAC,SAAS,CAAC;gBACjD,GAAG,EAAE,8BAAiB,CAAC,eAAe,CAAC,SAAS,CAAC;aAClD;QACP,KAAK,EAAE,QAAQ,CAAC,CAAC,CAAC,EAAE,GAAG,EAAE,IAAA,iCAAc,EAAC,IAAA,uBAAe,EAAC,OAAO,EAAE,OAAO,CAAC,CAAC,EAAE,YAAY,EAAE,IAAA,kCAAsB,EAAC,OAAO,EAAE,OAAO,CAAC,EAAE,CAAC,CAAC,CAAC,IAAI;QAC3I,MAAM,EAAE,SAAS,CAAC,CAAC,CAAC,kBAAkB,CAAC,OAAO,EAAE,OAAO,CAAC,CAAC,CAAC,CAAC,IAAI;KAChE,CAAC;AACJ,CAAC,CAAC;AAEF,6EAA6E;AAC7E,6BAA6B;AAC7B,MAAM,iBAAiB,GAAG,CAAC,OAAe,EAAE,OAAe,EAAE,QAA+B,EAAY,EAAE,CAAC;IACzG,IAAA,iCAAc,EAAC,IAAA,sCAAmB,EAAC,OAAO,EAAE,OAAO,CAAC,CAAC;IACrD,GAAG,CAAC,QAAQ,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,QAAQ,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC;IAC/C,GAAG,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,QAAQ,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC;CAClD,CAAC;AAEF,MAAM,mBAAmB,GAAG,CAAO,OAAe,EAAE,cAAsB,EAAE,IAAkB,EAAiB,EAAE;IAC/G,MAAM,EAAE,QAAQ,EAAE,MAAM,EAAE,GAAG,IAAI,CAAC;IAClC,MAAM,IAAI,GAAG,aAAa,CAAC,MAAM,CAAC,CAAC;IACnC,MAAM,YAAY,GAAG,MAAM,KAAK,OAAO,CAAC;IAExC,MAAM,YAAY,GAAG,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC,OAAO,EAAE,EAAE,CAAC,IAAA,oCAAwB,EAAC,OAAO,CAAC,CAAC,QAAQ,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC;IAEzH,OAAO,CAAC,GAAG,CAAC,mBAAmB,CAAC,CAAC;IAEjC,wEAAwE;IACxE,qEAAqE;IACrE,KAAK,MAAM,OAAO,IAAI,QAAQ,EAAE,CAAC;QAC/B,YAAE,CAAC,MAAM,CAAC,IAAA,sCAAmB,EAAC,OAAO,EAAE,OAAO,CAAC,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,KAAK,EAAE,IAAI,EAAE,CAAC,CAAC;IACrF,CAAC;IAED,MAAM,IAAA,kBAAU,EAAC,OAAO,EAAE,WAAW,CAAC,CAAC;IAEvC,4EAA4E;IAC5E,0EAA0E;IAC1E,uEAAuE;IACvE,wDAAwD;IACxD,OAAO,CAAC,GAAG,CAAC,6BAA6B,CAAC,CAAC;IAC3C,IAAA,2BAAgB,EAAC,iBAAiB,EAAE,MAAM,IAAA,6BAAqB,EAAC,OAAO,EAAE,OAAO,EAAE,IAAA,uCAAkB,GAAE,CAAC,CAAC,CAAC;IAEzG,yEAAyE;IACzE,wEAAwE;IACxE,yEAAyE;IACzE,MAAM,gBAAgB,GAAG,CAAC,GAAG,IAAI,GAAG,CAAC,CAAC,GAAG,QAAQ,EAAE,GAAG,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC;IACvF,KAAK,MAAM,OAAO,IAAI,gBAAgB,EAAE,CAAC;QACvC,MAAM,IAAA,oBAAY,EAAC,CAAC,OAAO,EAAE,OAAO,EAAE,OAAO,CAAC,CAAC,CAAC;IAClD,CAAC;IAED,yEAAyE;IACzE,uEAAuE;IACvE,6EAA6E;IAC7E,0CAA0C;IAC1C,MAAM,iBAAiB,GAAG,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC,IAAA,0CAA6B,EAAC,OAAO,EAAE,QAAQ,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC;IAE3F,IAAI,YAAY,EAAE,CAAC;QACjB,IAAA,2BAAgB,EACd,cAAc,EACd,MAAM,IAAA,mBAAQ,EACZ,QAAQ,CAAC,GAAG,CAAC,CAAC,OAAO,EAAE,EAAE,CAAC,CAAC;YACzB,KAAK,EAAE,cAAc,OAAO,EAAE;YAC9B,GAAG,EAAE,GAAS,EAAE;gBACd,OAAO,CAAC,GAAG,CAAC,kBAAkB,OAAO,GAAG,CAAC,CAAC;gBAC1C,MAAM,SAAS,GAAG,IAAA,iCAAoB,EAAC,OAAO,EAAE,OAAO,CAAC,CAAC;gBACzD,MAAM,IAAA,yBAAS,EAAC,IAAA,sCAAsB,EAAC,SAAS,EAAE,cAAI,CAAC,IAAI,CAAC,IAAA,+BAAmB,EAAC,OAAO,EAAE,OAAO,CAAC,EAAE,SAAS,CAAC,CAAC,CAAC,CAAC;YAClH,CAAC,CAAA;SACF,CAAC,CAAC,EACH,iBAAiB,CAClB,CACF,CAAC;IACJ,CAAC;IAED,IAAA,2BAAgB,EACd,gBAAgB,EAChB,MAAM,IAAA,mBAAQ,EACZ,YAAY,CAAC,GAAG,CAAC,CAAC,OAAO,EAAE,EAAE,CAAC,CAAC;QAC7B,KAAK,EAAE,gBAAgB,OAAO,EAAE;QAChC,GAAG,EAAE,GAAS,EAAE;YACd,OAAO,CAAC,GAAG,CAAC,oBAAoB,OAAO,GAAG,CAAC,CAAC;YAC5C,MAAM,IAAA,mBAAW,EAAC,OAAO,EAAE,OAAO,CAAC,CAAC;QACtC,CAAC,CAAA;KACF,CAAC,CAAC,EACH,iBAAiB,CAClB,CACF,CAAC;IAEF,uEAAuE;IACvE,yEAAyE;IACzE,2CAA2C;IAC3C,IAAA,2BAAgB,EACd,iBAAiB,EACjB,MAAM,IAAA,mBAAQ,EACZ,iBAAiB,CAAC,GAAG,CAAC,CAAC,OAAO,EAAE,EAAE,CAAC,CAAC;QAClC,KAAK,EAAE,iBAAiB,OAAO,EAAE;QACjC,GAAG,EAAE,GAAS,EAAE;YACd,OAAO,CAAC,GAAG,CAAC,+BAA+B,OAAO,GAAG,CAAC,CAAC;YACvD,MAAM,IAAA,oBAAW,EAAC,OAAO,EAAE,OAAO,CAAC,CAAC;QACtC,CAAC,CAAA;KACF,CAAC,CAAC,EACH,iBAAiB,CAClB,CACF,CAAC;IAEF,IAAI,YAAY,EAAE,CAAC;QACjB,yEAAyE;QACzE,qEAAqE;QACrE,wCAAwC;QACxC,IAAA,2BAAgB,EACd,WAAW,EACX,MAAM,IAAA,mBAAQ,EACZ,QAAQ,CAAC,GAAG,CAAC,CAAC,OAAO,EAAE,EAAE,CAAC,CAAC;YACzB,KAAK,EAAE,aAAa,OAAO,EAAE;YAC7B,GAAG,EAAE,GAAG,EAAE,CACR,IAAA,+BAAkB,EAChB,aAAa,OAAO,EAAE,EACtB,KAAK,EACL,CAAC,KAAK,EAAE,OAAO,EAAE,SAAS,EAAE,OAAO,EAAE,IAAA,yBAAgB,GAAE,EAAE,UAAU,EAAE,IAAA,yCAAsB,EAAC,OAAO,EAAE,OAAO,CAAC,CAAC,EAC9G;gBACE,GAAG,EAAE,IAAA,mBAAO,GAAE;gBACd,GAAG,EAAE,EAAE,mBAAmB,EAAE,OAAO,EAAE,eAAe,EAAE,OAAO,EAAE;gBAC/D,KAAK,EAAE,IAAA,4BAAe,GAAE;aACzB,CACF;SACJ,CAAC,CAAC,EACH,iBAAiB,CAClB,CACF,CAAC;IACJ,CAAC;IAED,+EAA+E;IAC/E,MAAM,UAAU,GAAG,IAAA,yBAAgB,GAAE,CAAC;IACtC,KAAK,MAAM,OAAO,IAAI,QAAQ,EAAE,CAAC;QAC/B,MAAM,QAAQ,GAAG,oBAAoB,CACnC,OAAO,EACP,cAAc,EACd,OAAO,EACP,MAAM,EACN,YAAY,CAAC,QAAQ,CAAC,OAAO,CAAC,EAC9B,iBAAiB,CAAC,QAAQ,CAAC,OAAO,CAAC,EACnC,UAAU,CACX,CAAC;QACF,IAAA,6CAA0B,EAAC,OAAO,EAAE,OAAO,EAAE,QAAQ,CAAC,CAAC;QAEvD,OAAO,CAAC,GAAG,CAAC,oBAAoB,OAAO,IAAI,CAAC,CAAC;QAC7C,KAAK,MAAM,GAAG,IAAI,iBAAiB,CAAC,OAAO,EAAE,OAAO,EAAE,QAAQ,CAAC,EAAE,CAAC;YAChE,OAAO,CAAC,GAAG,CAAC,KAAK,GAAG,EAAE,CAAC,CAAC;QAC1B,CAAC;IACH,CAAC;AACH,CAAC,CAAA,CAAC;AAEF,+EAA+E;AAC/E,+EAA+E;AAC/E,0EAA0E;AAC1E,0EAA0E;AAC1E,8BAA8B;AAC9B,MAAM,mBAAmB,GAAG,CAC1B,OAAe,EACf,cAAsB,EACtB,OAAe,EACf,MAAiB,EACjB,UAAkB,EACK,EAAE;IACzB,MAAM,QAAQ,GAAG,IAAA,4CAAyB,EAAC,OAAO,EAAE,OAAO,CAAC,CAAC;IAC7D,MAAM,OAAO,GAAG,mCAAmC,OAAO,IAAI,MAAM,uBAAuB,OAAO,iBAAiB,cAAc,IAAI,CAAC;IAEtI,IAAI,QAAQ,CAAC,UAAU,KAAK,UAAU,EAAE,CAAC;QACvC,MAAM,IAAI,KAAK,CAAC,oBAAoB,OAAO,kCAAkC,QAAQ,CAAC,UAAU,kBAAkB,UAAU,KAAK,OAAO,EAAE,CAAC,CAAC;IAC9I,CAAC;IACD,IAAI,QAAQ,CAAC,cAAc,KAAK,cAAc,EAAE,CAAC;QAC/C,MAAM,IAAI,KAAK,CAAC,oBAAoB,OAAO,wBAAwB,QAAQ,CAAC,cAAc,WAAW,cAAc,MAAM,OAAO,EAAE,CAAC,CAAC;IACtI,CAAC;IACD,IAAI,QAAQ,CAAC,QAAQ,KAAK,KAAK,IAAI,QAAQ,CAAC,QAAQ,KAAK,MAAM,EAAE,CAAC;QAChE,MAAM,IAAI,KAAK,CAAC,oBAAoB,OAAO,oBAAoB,QAAQ,CAAC,QAAQ,+BAA+B,MAAM,MAAM,OAAO,EAAE,CAAC,CAAC;IACxI,CAAC;IAED,OAAO,QAAQ,CAAC;AAClB,CAAC,CAAC;AAEF,MAAM,YAAY,GAAG,CAAC,QAA+B,EAAE,OAAe,EAAE,SAAgC,EAAU,EAAE;IAClH,IAAI,CAAC,QAAQ,CAAC,MAAM,EAAE,CAAC;QACrB,MAAM,IAAI,KAAK,CAAC,oBAAoB,OAAO,uDAAuD,CAAC,CAAC;IACtG,CAAC;IACD,OAAO,QAAQ,CAAC,MAAM,CAAC,SAAS,CAAC,CAAC;AACpC,CAAC,CAAC;AAEF,MAAM,oBAAoB,GAAG,CAAO,OAAe,EAAE,cAAsB,EAAE,IAAkB,EAAiB,EAAE;IAChH,MAAM,EAAE,QAAQ,EAAE,MAAM,EAAE,GAAG,IAAI,CAAC;IAClC,MAAM,IAAI,GAAG,aAAa,CAAC,MAAM,CAAC,CAAC;IACnC,MAAM,cAAc,GAAG,MAAM,KAAK,OAAO,CAAC;IAE1C,4EAA4E;IAC5E,mDAAmD;IACnD,MAAM,UAAU,GAAG,IAAA,yBAAgB,GAAE,CAAC;IACtC,MAAM,SAAS,GAAG,IAAI,GAAG,CAAC,QAAQ,CAAC,GAAG,CAAC,CAAC,OAAO,EAAE,EAAE,CAAC,CAAC,OAAO,EAAE,mBAAmB,CAAC,OAAO,EAAE,cAAc,EAAE,OAAO,EAAE,MAAM,EAAE,UAAU,CAAC,CAAC,CAAC,CAAC,CAAC;IAC3I,MAAM,WAAW,GAAG,CAAC,OAAe,EAAyB,EAAE,CAAC,SAAS,CAAC,GAAG,CAAC,OAAO,CAAE,CAAC;IAExF,MAAM,YAAY,GAAG,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC,OAAO,EAAE,EAAE,CAAC,WAAW,CAAC,OAAO,CAAC,CAAC,KAAK,KAAK,IAAI,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC;IACzG,MAAM,iBAAiB,GAAG,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC,OAAO,EAAE,EAAE,CAAC,WAAW,CAAC,OAAO,CAAC,CAAC,MAAM,KAAK,IAAI,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC;IAE7G,4EAA4E;IAC5E,uEAAuE;IACvE,IAAI,cAAc,IAAI,YAAY,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;QAC9C,MAAM,mBAAmB,EAAE,CAAC;IAC9B,CAAC;IACD,IAAI,cAAc,EAAE,CAAC;QACnB,MAAM,kBAAkB,CAAC,UAAU,CAAC,CAAC;IACvC,CAAC;IAED,wEAAwE;IACxE,2EAA2E;IAC3E,kBAAkB;IAClB,IAAI,YAAY,CAAC,MAAM,GAAG,CAAC,IAAI,iBAAiB,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;QAC5D,MAAM,IAAA,uBAAU,EAAC,QAAQ,EAAE,CAAC,MAAM,EAAE,aAAa,CAAC,CAAC,CAAC;IACtD,CAAC;IAED,0EAA0E;IAC1E,IAAI,IAAI,CAAC,GAAG,EAAE,CAAC;QACb,OAAO,CAAC,GAAG,CAAC,wCAAwC,CAAC,CAAC;QACtD,IAAA,qBAAY,EAAC,SAAS,CAAC,CAAC;QACxB,IAAA,2BAAgB,EACd,YAAY,EACZ,MAAM,IAAA,mBAAQ,EACZ,QAAQ,CAAC,GAAG,CAAC,CAAC,OAAO,EAAE,EAAE,CAAC,CAAC;YACzB,KAAK,EAAE,OAAO,OAAO,EAAE;YACvB,GAAG,EAAE,GAAG,EAAE,CACR,iBAAiB,CACf,IAAA,4BAAe,GAAE,EACjB,OAAO,EACP,KAAK,EACL,YAAY,CAAC,WAAW,CAAC,OAAO,CAAC,EAAE,OAAO,EAAE,KAAK,CAAC,EAClD,IAAA,yCAAsB,EAAC,OAAO,EAAE,OAAO,CAAC,CACzC;SACJ,CAAC,CAAC,EACH,kBAAkB,CACnB,CACF,CAAC;QACF,IAAA,mBAAU,EAAC,SAAS,CAAC,CAAC;IACxB,CAAC;IAED,qDAAqD;IACrD,IAAI,IAAI,CAAC,GAAG,IAAI,IAAI,CAAC,GAAG,EAAE,CAAC;QACzB,OAAO,CAAC,GAAG,CAAC,8CAA8C,CAAC,CAAC;QAC5D,IAAA,qBAAY,EAAC,YAAY,CAAC,CAAC;QAC3B,IAAA,2BAAgB,EACd,gBAAgB,EAChB,MAAM,IAAA,mBAAQ,EACX,CAAC,KAAK,EAAE,KAAK,CAAW;aACtB,MAAM,CAAC,CAAC,SAAS,EAAE,EAAE,CAAC,CAAC,SAAS,KAAK,KAAK,CAAC,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;aAClE,OAAO,CAAC,CAAC,SAAS,EAAE,EAAE,CACrB,QAAQ,CAAC,GAAG,CAAC,CAAC,OAAO,EAAE,EAAE,CAAC,CAAC;YACzB,KAAK,EAAE,GAAG,SAAS,IAAI,OAAO,EAAE;YAChC,GAAG,EAAE,GAAG,EAAE,CACR,iBAAiB,CACf,IAAA,4BAAe,GAAE,EACjB,OAAO,EACP,SAAS,EACT,YAAY,CAAC,WAAW,CAAC,OAAO,CAAC,EAAE,OAAO,EAAE,SAAS,CAAC,EACtD,IAAA,yCAAsB,EAAC,OAAO,EAAE,OAAO,CAAC,CACzC;SACJ,CAAC,CAAC,CACJ,EACH,kBAAkB,CACnB,CACF,CAAC;QACF,IAAA,mBAAU,EAAC,YAAY,CAAC,CAAC;IAC3B,CAAC;IAED,oEAAoE;IACpE,IAAI,YAAY,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;QAC5B,OAAO,CAAC,GAAG,CAAC,uCAAuC,CAAC,CAAC;QACrD,IAAA,qBAAY,EAAC,WAAW,CAAC,CAAC;QAC1B,IAAA,2BAAgB,EACd,YAAY,EACZ,MAAM,IAAA,mBAAQ,EACZ,YAAY,CAAC,GAAG,CAAC,CAAC,OAAO,EAAE,EAAE,CAAC,CAAC;YAC7B,KAAK,EAAE,SAAS,OAAO,EAAE;YACzB,GAAG,EAAE,GAAG,EAAE,CAAC,eAAe,CAAC,IAAA,4BAAe,GAAE,EAAE,OAAO,EAAE,WAAW,CAAC,OAAO,CAAC,CAAC,KAAM,CAAC;SACpF,CAAC,CAAC,EACH,kBAAkB,CACnB,CACF,CAAC;QACF,IAAA,mBAAU,EAAC,WAAW,CAAC,CAAC;IAC1B,CAAC;IAED,2EAA2E;IAC3E,IAAI,iBAAiB,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;QACjC,OAAO,CAAC,GAAG,CAAC,sDAAsD,CAAC,CAAC;QACpE,IAAA,qBAAY,EAAC,aAAa,CAAC,CAAC;QAC5B,IAAA,2BAAgB,EACd,mBAAmB,EACnB,MAAM,IAAA,mBAAQ,EACZ,iBAAiB,CAAC,GAAG,CAAC,CAAC,OAAO,EAAE,EAAE,CAAC,CAAC;YAClC,KAAK,EAAE,WAAW,OAAO,EAAE;YAC3B,GAAG,EAAE,GAAG,EAAE,CAAC,mBAAmB,CAAC,IAAA,4BAAe,GAAE,EAAE,OAAO,EAAE,WAAW,CAAC,OAAO,CAAC,CAAC,MAAO,CAAC;SACzF,CAAC,CAAC,EACH,kBAAkB,CACnB,CACF,CAAC;QACF,IAAA,mBAAU,EAAC,aAAa,CAAC,CAAC;IAC5B,CAAC;AACH,CAAC,CAAA,CAAC;AAEK,MAAM,WAAW,GAAG,CAAO,OAAe,EAAE,IAAgB,EAAE,IAAkB,EAAiB,EAAE;IACxG,IAAI,IAAI,CAAC,IAAI,KAAK,WAAW,EAAE,CAAC;QAC9B,OAAO;IACT,CAAC;IAED,IAAI,CAAC,MAAM,IAAA,sCAAqB,GAAE,CAAC,KAAK,KAAK,EAAE,CAAC;QAC9C,OAAO,CAAC,GAAG,CAAC,qCAAqC,CAAC,CAAC;QACnD,OAAO;IACT,CAAC;IAED,IAAA,qBAAY,EAAC,WAAW,CAAC,CAAC;IAE1B,IAAI,IAAI,CAAC,IAAI,KAAK,SAAS,EAAE,CAAC;QAC5B,MAAM,IAAA,2BAAkB,EAAC,IAAI,CAAC,OAAO,CAAC,CAAC;QACvC,IAAA,mBAAU,EAAC,WAAW,CAAC,CAAC;QACxB,OAAO;IACT,CAAC;IAED,IAAI,IAAI,CAAC,IAAI,KAAK,WAAW,EAAE,CAAC;QAC9B,IAAI,IAAI,CAAC,aAAa,EAAE,CAAC;YACvB,MAAM,IAAA,0BAAiB,EAAC,IAAI,CAAC,OAAO,CAAC,CAAC;QACxC,CAAC;QACD,MAAM,IAAA,6BAAoB,EAAC,IAAI,CAAC,OAAO,CAAC,CAAC;QACzC,IAAA,mBAAU,EAAC,WAAW,CAAC,CAAC;QACxB,OAAO;IACT,CAAC;IAED,8EAA8E;IAC9E,wEAAwE;IACxE,MAAM,cAAc,GAAG,OAAO,CAAC,GAAG,CAAC,sBAAe,CAAC,UAAU,CAAC,CAAC;IAC/D,IAAI,CAAC,cAAc,EAAE,CAAC;QACpB,MAAM,IAAI,KAAK,CAAC,2BAA2B,sBAAe,CAAC,UAAU,YAAY,CAAC,CAAC;IACrF,CAAC;IAED,OAAO,CAAC,GAAG,CAAC,kCAAkC,IAAI,OAAO,CAAC,CAAC;IAC3D,OAAO,CAAC,GAAG,CAAC,wBAAwB,CAAC,CAAC;IACtC,OAAO,CAAC,GAAG,CAAC,IAAI,CAAC,QAAQ,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC;IAEtC,IAAI,IAAI,KAAK,YAAY,EAAE,CAAC;QAC1B,MAAM,mBAAmB,CAAC,OAAO,EAAE,cAAc,EAAE,IAAI,CAAC,CAAC;IAC3D,CAAC;IACD,IAAI,IAAI,KAAK,YAAY,EAAE,CAAC;QAC1B,MAAM,oBAAoB,CAAC,OAAO,EAAE,cAAc,EAAE,IAAI,CAAC,CAAC;IAC5D,CAAC;IAED,IAAA,mBAAU,EAAC,WAAW,CAAC,CAAC;AAC1B,CAAC,CAAA,CAAC;AA9CW,QAAA,WAAW,eA8CtB","sourcesContent":["// `qpq go:docker` — asks the same questions as `qpq go`, then builds locally\n// and deploys in parallel via docker. The two halves can run on different\n// machines, which is what lets a CI deploy run one job per service and phase:\n//\n//   qpq go:docker <svc> <stack>                build, then deploy\n//   qpq go:docker <svc> <stack> --build-only   build and save; no docker needed\n//   qpq go:docker <svc> <stack> --from-build   deploy the saved build; the\n//                                              workspace need not be built\n//\n// The build half: QPQ config synth, rspack api bundles, rspack view bundles,\n// rspack federated-remote bundles, and one self-contained CDK cloud assembly\n// per service (`cdk synth --output`, which stages the api bundle as assets).\n// It ends by writing a manifest per service with everything the deploy half\n// needs that only the live config can answer (stack names, views destinations,\n// the federated store), so the deploy half never loads a service config. The\n// saved build for a service is:\n//   dist/qpq/go-docker/<app>/<svc>/assembly                  the cloud assembly\n//   dist/qpq/go-docker/<app>/<svc>/deploy.json               the manifest\n//   dist/apps/<app>/services/<svc>/views                     the views bundle\n//   dist/apps/<app>/services/<svc>/service-remote-published  the federated remote\n//\n// The deploy half, from the manifests:\n//   wave 1 (inf): one docker container per service deploys its inf stack, all\n//     concurrently. Containers run only the CDK CLI against the mounted\n//     assembly — the workspace (and its npm-linked quidproquo packages) never\n//     needs to exist inside the image.\n//   wave 2 (api + web): once every inf stack is done, api and web stacks for\n//     all services deploy concurrently (they depend only on inf, not on each\n//     other).\n//   views: the built bundles are synced to S3, one aws-cli container per\n//     service, all concurrently.\n//   publish: the built federated remotes (backends that opt in with\n//     defineFederatedModuleStore(...)) are synced to S3 and their manifests\n//     flipped, one aws-cli container per service, all concurrently. Follows\n//     every api deploy, so a lambda never runs a previous release's stories.\n//\n// domain/bootstrap menu options deploy host-side exactly like `qpq go` —\n// a single stack gains nothing from docker.\n//\n// Requires the same env as `go` (the build half included: `cdk synth` still\n// looks up hosted zones and VPCs) plus a running docker daemon for the deploy\n// half. Knobs: GO_DOCKER_BUILD_CONCURRENCY (default: the machine's core count —\n// local builds are CPU-bound) and GO_DOCKER_DEPLOY_CONCURRENCY (default\n// unlimited — deploys just wait on CloudFormation).\nimport { QpqDeployEnvVar } from '@qpqjs/core';\nimport { qpqDeployAwsUtils } from '@qpqjs/deploy-aws';\nimport { getServiceRspackConfig, runRspack } from '@qpqjs/deploy-rspack';\n\nimport fs from 'fs';\nimport os from 'os';\nimport path from 'path';\n\nimport { synthCommand } from '../../commands/synth';\nimport { DeployPlan, StackType } from '../../lib/deployPrompts';\nimport { getRoot, getServiceDirectory, getServiceNamesWithViews } from '../../lib/discovery';\nimport { getDefaultHookJobs } from '../../lib/getDefaultHookJobs';\nimport { GoDockerMode } from '../../lib/goDockerMode';\nimport { runAppHook, runHookForAppPackages } from '../../lib/hooks';\nimport { getServiceNamesWithFederation, loadServiceQpqConfig } from '../../lib/qpqConfigs';\nimport { nextPrefixColor, runCommand, runCommandBestEffort, runCommandPrefixed } from '../../lib/runCommand';\nimport { assertNoFailures, runTasks } from '../../lib/runTasks';\nimport { logTimeEnd, logTimeStart } from '../../lib/timing';\nimport { bundleViews, getViewsDistDir } from '../../lib/views';\nimport { isAwsCredentialsValid } from './awsCredentials';\nimport { getCdkAppCommand, getCdkCliVersion, getDockerDir } from './cdkApp';\nimport {\n  fromManifestPath,\n  getGoDockerAssemblyDir,\n  getGoDockerBuildDir,\n  GoDockerBuildManifest,\n  GoDockerRemoteEntry,\n  GoDockerViewsEntry,\n  readGoDockerBuildManifest,\n  toManifestPath,\n  writeGoDockerBuildManifest,\n} from './goDockerManifest';\nimport { buildRemote, resolvePublishTarget } from './remote';\nimport { deployAccountStack, deployBootstrapStack, deployDomainStack } from './stacks';\nimport { getViewsS3Destinations, NO_CACHE_FILES } from './viewsSync';\n\nconst IMAGE_TAG = 'qpq-cdk-deployer';\nconst AWS_CLI_IMAGE = 'amazon/aws-cli';\n\nconst BUILD_CONCURRENCY = Number(process.env.GO_DOCKER_BUILD_CONCURRENCY) || os.availableParallelism();\nconst DEPLOY_CONCURRENCY = Number(process.env.GO_DOCKER_DEPLOY_CONCURRENCY) || Infinity;\n\n// Credentials/region reach the containers via `docker run -e NAME` (value\n// inherited from this process's env, never on the docker command line).\nconst AWS_ENV_PASSTHROUGH = [\n  'AWS_ACCESS_KEY_ID',\n  'AWS_SECRET_ACCESS_KEY',\n  'AWS_SESSION_TOKEN',\n  'AWS_REGION',\n  'AWS_DEFAULT_REGION',\n  'AWS_DEFAULT_ACCOUNT',\n];\n\ntype ServicesPlan = Extract<DeployPlan, { kind: 'services' }>;\n\ntype StackNeeds = { inf: boolean; api: boolean; web: boolean; views: boolean };\n\nconst getStackNeeds = (stacks: StackType): StackNeeds => ({\n  inf: stacks === 'all' || stacks === 'inf',\n  api: stacks === 'all' || stacks === 'api',\n  web: stacks === 'all' || stacks === 'web',\n  views: stacks === 'all' || stacks === 'views',\n});\n\n// A container left behind by an interrupted run would block reusing its name.\n// Clear it first, best-effort: a missing container (exit 1) must not fail the\n// deploy. Was a `docker rm -f … >/dev/null 2>&1 ;` prefix on the run command,\n// but that only worked under `shell: true`; as a separate call it's shell-free.\nconst removeContainer = (containerName: string): Promise<void> => runCommandBestEffort('docker', ['rm', '-f', containerName]);\n\nconst assertDockerRunning = async (): Promise<void> => {\n  try {\n    await runCommand('docker', ['info', '--format', 'docker daemon ok — server {{.ServerVersion}}']);\n  } catch {\n    throw new Error('Docker daemon is not running (start Docker Desktop and retry).');\n  }\n};\n\n// Pin the image's CDK CLI to the CLI's own aws-cdk version so it can always\n// read the assembly schema the host synthesized.\nconst buildDeployerImage = async (cdkVersion: string): Promise<void> => {\n  console.log(`Building deployer image [${IMAGE_TAG}] (aws-cdk ${cdkVersion})`);\n  await runCommand('docker', ['build', '-t', IMAGE_TAG, '--build-arg', `CDK_VERSION=${cdkVersion}`, getDockerDir()]);\n};\n\n// Deploy one stack from a pre-synthesized assembly in a throwaway container\n// named <service>-<stackType> (e.g. mini-web) so `docker ps` reads cleanly.\n// The assembly mounts read-only and is copied container-local first — the CDK\n// CLI writes lock files next to the assembly it reads, and the copy keeps\n// parallel api/web deploys of the same service fully isolated.\nconst dockerDeployStack = async (\n  color: number,\n  serviceName: string,\n  stackType: 'inf' | 'api' | 'web',\n  stackName: string,\n  assemblyDir: string,\n): Promise<void> => {\n  const containerName = `${serviceName}-${stackType}`;\n  await removeContainer(containerName);\n  await runCommandPrefixed(\n    `${stackType}:${serviceName}`,\n    'docker',\n    [\n      'run',\n      '--rm',\n      '--name',\n      containerName,\n      '-v',\n      `${assemblyDir}:/assembly:ro`,\n      ...AWS_ENV_PASSTHROUGH.flatMap((name) => ['-e', name]),\n      IMAGE_TAG,\n      'bash',\n      '-c',\n      `cp -r /assembly /work/assembly && cdk deploy ${stackName} --app /work/assembly --require-approval never --progress events`,\n    ],\n    { color },\n  );\n};\n\n// Sync one service's pre-built views to S3 in a throwaway aws-cli container\n// named <service>-views. The official image's entrypoint is `aws`. Multiple\n// destinations (shell → website root + views prefix) run sequentially within\n// the service, reusing the container name. Mirrors the host-side syncViewsToS3\n// cache policy: hashed assets immutable, the fixed-name entry points re-uploaded\n// with no-cache every deploy (see NO_CACHE_FILES).\nconst dockerSyncViews = async (color: number, serviceName: string, views: GoDockerViewsEntry): Promise<void> => {\n  const containerName = `${serviceName}-views`;\n  const distDir = fromManifestPath(views.dir);\n\n  const runAwsCli = async (awsArgs: string[]): Promise<void> => {\n    await removeContainer(containerName);\n    await runCommandPrefixed(\n      `views:${serviceName}`,\n      'docker',\n      [\n        'run',\n        '--rm',\n        '--name',\n        containerName,\n        '-v',\n        `${distDir}:/views:ro`,\n        ...AWS_ENV_PASSTHROUGH.flatMap((name) => ['-e', name]),\n        AWS_CLI_IMAGE,\n        ...awsArgs,\n      ],\n      { color },\n    );\n  };\n\n  for (const destination of views.destinations) {\n    await runAwsCli([\n      's3',\n      'sync',\n      '/views',\n      destination,\n      '--cache-control',\n      'public,max-age=31536000,immutable',\n      ...NO_CACHE_FILES.flatMap((file) => ['--exclude', file]),\n    ]);\n\n    for (const file of NO_CACHE_FILES) {\n      if (!fs.existsSync(path.join(distDir, file))) {\n        continue;\n      }\n\n      await runAwsCli(['s3', 'cp', `/views/${file}`, `${destination}/${file}`, '--cache-control', 'no-cache']);\n    }\n  }\n};\n\n// Publish one service's already-built federated remote to S3 in a throwaway\n// aws-cli container named <service>-publish. The version dir (everything the\n// manifest references) syncs first, then the manifest.json is copied last —\n// same ordering guarantee as the host-side publish, so a reading lambda never\n// sees a manifest whose files aren't all present yet.\nconst dockerPublishRemote = async (color: number, serviceName: string, remote: GoDockerRemoteEntry): Promise<void> => {\n  const { manifestHash, bucketName, servicePrefix } = remote;\n  const publishPath = fromManifestPath(remote.dir);\n  const containerName = `${serviceName}-publish`;\n\n  // /publish is the service-remote-published dir; the hashed version subdir and\n  // manifest.json both live directly under it.\n  const s3Operations: string[][] = [\n    ['s3', 'sync', `/publish/${manifestHash}`, `s3://${bucketName}/${servicePrefix}/${manifestHash}`],\n    ['s3', 'cp', '/publish/manifest.json', `s3://${bucketName}/${servicePrefix}/manifest.json`],\n  ];\n\n  for (const s3Operation of s3Operations) {\n    await removeContainer(containerName);\n    await runCommandPrefixed(\n      `publish:${serviceName}`,\n      'docker',\n      [\n        'run',\n        '--rm',\n        '--name',\n        containerName,\n        '-v',\n        `${publishPath}:/publish:ro`,\n        ...AWS_ENV_PASSTHROUGH.flatMap((name) => ['-e', name]),\n        AWS_CLI_IMAGE,\n        ...s3Operation,\n      ],\n      { color },\n    );\n  }\n};\n\nconst resolveRemoteEntry = (appName: string, service: string): GoDockerRemoteEntry => {\n  const { publishPath, manifestHash, bucketName, servicePrefix } = resolvePublishTarget(appName, service);\n  return { dir: toManifestPath(publishPath), manifestHash, bucketName, servicePrefix };\n};\n\n// Everything the deploy half needs that only the live config can answer,\n// resolved here while the workspace is built and the config loads.\nconst resolveBuildManifest = (\n  appName: string,\n  deploymentName: string,\n  service: string,\n  stacks: StackType,\n  hasViews: boolean,\n  hasRemote: boolean,\n  cdkVersion: string,\n): GoDockerBuildManifest => {\n  const qpqConfig = loadServiceQpqConfig(appName, service);\n\n  return {\n    cdkVersion,\n    deploymentName,\n    builtFor: stacks,\n    stacks:\n      stacks === 'views'\n        ? null\n        : {\n            inf: qpqDeployAwsUtils.getInfStackName(qpqConfig),\n            api: qpqDeployAwsUtils.getApiStackName(qpqConfig),\n            web: qpqDeployAwsUtils.getWebStackName(qpqConfig),\n          },\n    views: hasViews ? { dir: toManifestPath(getViewsDistDir(appName, service)), destinations: getViewsS3Destinations(appName, service) } : null,\n    remote: hasRemote ? resolveRemoteEntry(appName, service) : null,\n  };\n};\n\n// The directories a CI job uploads to carry one service's saved build to the\n// deploy job, root-relative.\nconst getSavedBuildDirs = (appName: string, service: string, manifest: GoDockerBuildManifest): string[] => [\n  toManifestPath(getGoDockerBuildDir(appName, service)),\n  ...(manifest.views ? [manifest.views.dir] : []),\n  ...(manifest.remote ? [manifest.remote.dir] : []),\n];\n\nconst buildGoDockerOutput = async (appName: string, deploymentName: string, plan: ServicesPlan): Promise<void> => {\n  const { services, stacks } = plan;\n  const need = getStackNeeds(stacks);\n  const needCdkSynth = stacks !== 'views';\n\n  const viewServices = need.views ? services.filter((service) => getServiceNamesWithViews(appName).includes(service)) : [];\n\n  console.log('\\n=== Build ===\\n');\n\n  // A stale assembly or manifest from an earlier build must not outlive a\n  // change of stack selection, so every selected service starts empty.\n  for (const service of services) {\n    fs.rmSync(getGoDockerBuildDir(appName, service), { recursive: true, force: true });\n  }\n\n  await runAppHook(appName, 'predeploy');\n\n  // Workspace packages resolve through their built dist/ (package.json main),\n  // so bundles would ship stale code unless every lib is tsc'd first. Other\n  // apps' packages are skipped: nothing this app deploys can import them\n  // unless it declares them, and declared ones are built.\n  console.log('Building workspace packages');\n  assertNoFailures('Workspace build', await runHookForAppPackages('build', appName, getDefaultHookJobs()));\n\n  // Synth the selected services' QPQ configs (and shell's, which the views\n  // destinations resolve from) so a config that fails to load fails here,\n  // before any bundling. In-process: it's just config loads + JSON writes.\n  const qpqSynthServices = [...new Set([...services, ...(need.views ? ['shell'] : [])])];\n  for (const service of qpqSynthServices) {\n    await synthCommand([service, '--app', appName]);\n  }\n\n  // Federated remotes are the backend story code, so they are rebuilt (and\n  // later republished) whenever the api stack is. Skips services without\n  // defineFederatedModuleStore(...). Detected here (after the workspace build)\n  // because it loads each service's config.\n  const federatedServices = need.api ? getServiceNamesWithFederation(appName, services) : [];\n\n  if (needCdkSynth) {\n    assertNoFailures(\n      'API bundling',\n      await runTasks(\n        services.map((service) => ({\n          label: `bundle-api:${service}`,\n          run: async () => {\n            console.log(`Bundling api: [${service}]`);\n            const qpqConfig = loadServiceQpqConfig(appName, service);\n            await runRspack(getServiceRspackConfig(qpqConfig, path.join(getServiceDirectory(appName, service), 'service')));\n          },\n        })),\n        BUILD_CONCURRENCY,\n      ),\n    );\n  }\n\n  assertNoFailures(\n    'Views bundling',\n    await runTasks(\n      viewServices.map((service) => ({\n        label: `bundle-views:${service}`,\n        run: async () => {\n          console.log(`Bundling views: [${service}]`);\n          await bundleViews(appName, service);\n        },\n      })),\n      BUILD_CONCURRENCY,\n    ),\n  );\n\n  // Build the federated remotes now (rspack needs the workspace), so the\n  // publish wave only has to sync the already-built output — mirroring how\n  // views are bundled here and synced later.\n  assertNoFailures(\n    'Remote bundling',\n    await runTasks(\n      federatedServices.map((service) => ({\n        label: `bundle-remote:${service}`,\n        run: async () => {\n          console.log(`Bundling federated remote: [${service}]`);\n          await buildRemote(appName, service);\n        },\n      })),\n      BUILD_CONCURRENCY,\n    ),\n  );\n\n  if (needCdkSynth) {\n    // One self-contained cloud assembly per service (all its stacks + staged\n    // assets) — separate --output dirs so synths can run in parallel and\n    // containers never share mutable state.\n    assertNoFailures(\n      'CDK synth',\n      await runTasks(\n        services.map((service) => ({\n          label: `cdk-synth:${service}`,\n          run: () =>\n            runCommandPrefixed(\n              `cdk-synth:${service}`,\n              'npx',\n              ['cdk', 'synth', '--quiet', '--app', getCdkAppCommand(), '--output', getGoDockerAssemblyDir(appName, service)],\n              {\n                cwd: getRoot(),\n                env: { DEPLOY_SERVICE_NAME: service, DEPLOY_APP_NAME: appName },\n                color: nextPrefixColor(),\n              },\n            ),\n        })),\n        BUILD_CONCURRENCY,\n      ),\n    );\n  }\n\n  // Manifests are written last, so one only ever exists beside a complete build.\n  const cdkVersion = getCdkCliVersion();\n  for (const service of services) {\n    const manifest = resolveBuildManifest(\n      appName,\n      deploymentName,\n      service,\n      stacks,\n      viewServices.includes(service),\n      federatedServices.includes(service),\n      cdkVersion,\n    );\n    writeGoDockerBuildManifest(appName, service, manifest);\n\n    console.log(`Saved build for [${service}]:`);\n    for (const dir of getSavedBuildDirs(appName, service, manifest)) {\n      console.log(`  ${dir}`);\n    }\n  }\n};\n\n// A deploy phase runs from a saved build only when that build was made for it:\n// `all` covers every phase, any other selection only its own. A build made for\n// `inf` has an assembly the api stack could deploy from, but no remote to\n// publish after it, which is exactly the stale-stories deploy the publish\n// ordering exists to prevent.\nconst readCheckedManifest = (\n  appName: string,\n  deploymentName: string,\n  service: string,\n  stacks: StackType,\n  cdkVersion: string,\n): GoDockerBuildManifest => {\n  const manifest = readGoDockerBuildManifest(appName, service);\n  const rebuild = `rebuild it with \\`qpq go:docker ${service} ${stacks} --build-only --app ${appName} --deployment ${deploymentName}\\``;\n\n  if (manifest.cdkVersion !== cdkVersion) {\n    throw new Error(`saved build for [${service}] was synthesized with aws-cdk ${manifest.cdkVersion}, this qpq has ${cdkVersion}; ${rebuild}`);\n  }\n  if (manifest.deploymentName !== deploymentName) {\n    throw new Error(`saved build for [${service}] is for deployment '${manifest.deploymentName}', not '${deploymentName}'; ${rebuild}`);\n  }\n  if (manifest.builtFor !== 'all' && manifest.builtFor !== stacks) {\n    throw new Error(`saved build for [${service}] was built for '${manifest.builtFor}' stacks and cannot deploy '${stacks}'; ${rebuild}`);\n  }\n\n  return manifest;\n};\n\nconst getStackName = (manifest: GoDockerBuildManifest, service: string, stackType: 'inf' | 'api' | 'web'): string => {\n  if (!manifest.stacks) {\n    throw new Error(`saved build for [${service}] has no cloud assembly (it was built for views only)`);\n  }\n  return manifest.stacks[stackType];\n};\n\nconst deployGoDockerOutput = async (appName: string, deploymentName: string, plan: ServicesPlan): Promise<void> => {\n  const { services, stacks } = plan;\n  const need = getStackNeeds(stacks);\n  const needCdkDeploys = stacks !== 'views';\n\n  // Every manifest is read and checked up front, so one missing or mismatched\n  // build fails the run before any container starts.\n  const cdkVersion = getCdkCliVersion();\n  const manifests = new Map(services.map((service) => [service, readCheckedManifest(appName, deploymentName, service, stacks, cdkVersion)]));\n  const manifestFor = (service: string): GoDockerBuildManifest => manifests.get(service)!;\n\n  const viewServices = need.views ? services.filter((service) => manifestFor(service).views !== null) : [];\n  const federatedServices = need.api ? services.filter((service) => manifestFor(service).remote !== null) : [];\n\n  // Federated publish needs the api stack (need.api ⇒ needCdkDeploys), so any\n  // docker preflight it requires is already covered by these two checks.\n  if (needCdkDeploys || viewServices.length > 0) {\n    await assertDockerRunning();\n  }\n  if (needCdkDeploys) {\n    await buildDeployerImage(cdkVersion);\n  }\n\n  // The aws-cli image backs both the views sync and the federated publish\n  // waves. Pull once now so those waves don't race N containers into pulling\n  // the same image.\n  if (viewServices.length > 0 || federatedServices.length > 0) {\n    await runCommand('docker', ['pull', AWS_CLI_IMAGE]);\n  }\n\n  // ---- Wave 1: inf stacks, one container per service, all concurrent ----\n  if (need.inf) {\n    console.log('\\n=== Deploy inf stacks (docker) ===\\n');\n    logTimeStart('infWave');\n    assertNoFailures(\n      'Inf deploy',\n      await runTasks(\n        services.map((service) => ({\n          label: `inf:${service}`,\n          run: () =>\n            dockerDeployStack(\n              nextPrefixColor(),\n              service,\n              'inf',\n              getStackName(manifestFor(service), service, 'inf'),\n              getGoDockerAssemblyDir(appName, service),\n            ),\n        })),\n        DEPLOY_CONCURRENCY,\n      ),\n    );\n    logTimeEnd('infWave');\n  }\n\n  // ---- Wave 2: api + web stacks, all concurrent ----\n  if (need.api || need.web) {\n    console.log('\\n=== Deploy api + web stacks (docker) ===\\n');\n    logTimeStart('apiWebWave');\n    assertNoFailures(\n      'Api/Web deploy',\n      await runTasks(\n        (['api', 'web'] as const)\n          .filter((stackType) => (stackType === 'api' ? need.api : need.web))\n          .flatMap((stackType) =>\n            services.map((service) => ({\n              label: `${stackType}:${service}`,\n              run: () =>\n                dockerDeployStack(\n                  nextPrefixColor(),\n                  service,\n                  stackType,\n                  getStackName(manifestFor(service), service, stackType),\n                  getGoDockerAssemblyDir(appName, service),\n                ),\n            })),\n          ),\n        DEPLOY_CONCURRENCY,\n      ),\n    );\n    logTimeEnd('apiWebWave');\n  }\n\n  // ---- Views: sync the pre-built bundles to S3, all concurrent ----\n  if (viewServices.length > 0) {\n    console.log('\\n=== Sync views to S3 (docker) ===\\n');\n    logTimeStart('viewsWave');\n    assertNoFailures(\n      'Views sync',\n      await runTasks(\n        viewServices.map((service) => ({\n          label: `views:${service}`,\n          run: () => dockerSyncViews(nextPrefixColor(), service, manifestFor(service).views!),\n        })),\n        DEPLOY_CONCURRENCY,\n      ),\n    );\n    logTimeEnd('viewsWave');\n  }\n\n  // ---- Publish: the pre-built federated remotes to S3, all concurrent ----\n  if (federatedServices.length > 0) {\n    console.log('\\n=== Publish federated remotes to S3 (docker) ===\\n');\n    logTimeStart('publishWave');\n    assertNoFailures(\n      'Federated publish',\n      await runTasks(\n        federatedServices.map((service) => ({\n          label: `publish:${service}`,\n          run: () => dockerPublishRemote(nextPrefixColor(), service, manifestFor(service).remote!),\n        })),\n        DEPLOY_CONCURRENCY,\n      ),\n    );\n    logTimeEnd('publishWave');\n  }\n};\n\nexport const awsGoDocker = async (appName: string, plan: DeployPlan, mode: GoDockerMode): Promise<void> => {\n  if (plan.kind === 'cancelled') {\n    return;\n  }\n\n  if ((await isAwsCredentialsValid()) === false) {\n    console.log('Credentials are expired or invalid.');\n    return;\n  }\n\n  logTimeStart('totalTime');\n\n  if (plan.kind === 'account') {\n    await deployAccountStack(plan.appName);\n    logTimeEnd('totalTime');\n    return;\n  }\n\n  if (plan.kind === 'bootstrap') {\n    if (plan.includeDomain) {\n      await deployDomainStack(plan.appName);\n    }\n    await deployBootstrapStack(plan.appName);\n    logTimeEnd('totalTime');\n    return;\n  }\n\n  // resolveDeployment primed the selection before this driver ran. The manifest\n  // records it so a build for one deployment can never deploy to another.\n  const deploymentName = process.env[QpqDeployEnvVar.deployName];\n  if (!deploymentName) {\n    throw new Error(`no deployment selected (${QpqDeployEnvVar.deployName} is unset)`);\n  }\n\n  console.log(`\\n\\nRunning dockerized deploy (${mode})\\n\\n`);\n  console.log('Executing for services');\n  console.log(plan.services.join(', '));\n\n  if (mode !== 'from-build') {\n    await buildGoDockerOutput(appName, deploymentName, plan);\n  }\n  if (mode !== 'build-only') {\n    await deployGoDockerOutput(appName, deploymentName, plan);\n  }\n\n  logTimeEnd('totalTime');\n};\n"]}

package/lib/commonjs/platforms/aws/goDockerManifest.d.ts

@@ -0,0 +1,44 @@
+import { Nullable } from '@qpqjs/core';
+import { StackType } from '../../lib/deployPrompts';
+/** The CloudFormation stack names of one service's assembly. */
+export type GoDockerStackNames = {
+    inf: string;
+    api: string;
+    web: string;
+};
+/** A built views bundle and the S3 locations it syncs to. */
+export type GoDockerViewsEntry = {
+    dir: string;
+    destinations: string[];
+};
+/** A built federated remote (its publish dir and the store it goes into). */
+export type GoDockerRemoteEntry = {
+    dir: string;
+    manifestHash: string;
+    bucketName: string;
+    servicePrefix: string;
+};
+/**
+ * Everything the deploy half needs for one service that only the live config can
+ * answer, resolved by the build half. Paths are relative to the consumer root with
+ * forward slashes, so a build saved on one machine deploys from another checkout.
+ */
+export type GoDockerBuildManifest = {
+    cdkVersion: string;
+    deploymentName: string;
+    builtFor: StackType;
+    stacks: Nullable<GoDockerStackNames>;
+    views: Nullable<GoDockerViewsEntry>;
+    remote: Nullable<GoDockerRemoteEntry>;
+};
+/** The per-service directory the build half owns: the cloud assembly and the manifest. */
+export declare const getGoDockerBuildDir: (appName: string, serviceName: string) => string;
+/** Where `cdk synth --output` writes the service's self-contained cloud assembly. */
+export declare const getGoDockerAssemblyDir: (appName: string, serviceName: string) => string;
+/** A path under the consumer root, as the manifest stores it. */
+export declare const toManifestPath: (absolutePath: string) => string;
+/** The absolute path a manifest entry points at on this machine. */
+export declare const fromManifestPath: (manifestPath: string) => string;
+export declare const writeGoDockerBuildManifest: (appName: string, serviceName: string, manifest: GoDockerBuildManifest) => void;
+/** Throws, naming the directory and the command that fills it, when the service has no saved build. */
+export declare const readGoDockerBuildManifest: (appName: string, serviceName: string) => GoDockerBuildManifest;

package/lib/commonjs/platforms/aws/goDockerManifest.js

@@ -0,0 +1,38 @@
+"use strict";
+var __importDefault = (this && this.__importDefault) || function (mod) {
+    return (mod && mod.__esModule) ? mod : { "default": mod };
+};
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.readGoDockerBuildManifest = exports.writeGoDockerBuildManifest = exports.fromManifestPath = exports.toManifestPath = exports.getGoDockerAssemblyDir = exports.getGoDockerBuildDir = void 0;
+const fs_1 = __importDefault(require("fs"));
+const path_1 = __importDefault(require("path"));
+const discovery_1 = require("../../lib/discovery");
+const MANIFEST_FILE = 'deploy.json';
+/** The per-service directory the build half owns: the cloud assembly and the manifest. */
+const getGoDockerBuildDir = (appName, serviceName) => path_1.default.join((0, discovery_1.getRoot)(), 'dist', 'qpq', 'go-docker', appName, serviceName);
+exports.getGoDockerBuildDir = getGoDockerBuildDir;
+/** Where `cdk synth --output` writes the service's self-contained cloud assembly. */
+const getGoDockerAssemblyDir = (appName, serviceName) => path_1.default.join((0, exports.getGoDockerBuildDir)(appName, serviceName), 'assembly');
+exports.getGoDockerAssemblyDir = getGoDockerAssemblyDir;
+/** A path under the consumer root, as the manifest stores it. */
+const toManifestPath = (absolutePath) => path_1.default.relative((0, discovery_1.getRoot)(), absolutePath).split(path_1.default.sep).join('/');
+exports.toManifestPath = toManifestPath;
+/** The absolute path a manifest entry points at on this machine. */
+const fromManifestPath = (manifestPath) => path_1.default.resolve((0, discovery_1.getRoot)(), manifestPath);
+exports.fromManifestPath = fromManifestPath;
+const writeGoDockerBuildManifest = (appName, serviceName, manifest) => {
+    const buildDir = (0, exports.getGoDockerBuildDir)(appName, serviceName);
+    fs_1.default.mkdirSync(buildDir, { recursive: true });
+    fs_1.default.writeFileSync(path_1.default.join(buildDir, MANIFEST_FILE), JSON.stringify(manifest, null, 2));
+};
+exports.writeGoDockerBuildManifest = writeGoDockerBuildManifest;
+/** Throws, naming the directory and the command that fills it, when the service has no saved build. */
+const readGoDockerBuildManifest = (appName, serviceName) => {
+    const manifestPath = path_1.default.join((0, exports.getGoDockerBuildDir)(appName, serviceName), MANIFEST_FILE);
+    if (!fs_1.default.existsSync(manifestPath)) {
+        throw new Error(`no saved build for [${serviceName}] (missing ${manifestPath}) - run \`qpq go:docker ${serviceName} <stack> --build-only --app ${appName}\` first`);
+    }
+    return JSON.parse(fs_1.default.readFileSync(manifestPath, 'utf-8'));
+};
+exports.readGoDockerBuildManifest = readGoDockerBuildManifest;
+//# sourceMappingURL=goDockerManifest.js.map