@webship.co/workspace-aws 0.0.0-stage → 1.0.0-alpha1

package/README.md

@@ -1,3 +1,61 @@
-# Temporary Holding Version
+# @webship.co/workspace-aws
 
-This version is a temporary placeholder for this package. An operational version to replace this has been submitted for review and is awaiting a staged release.
+AWS for the [Webship Workspace](https://github.com/webship/workspace) dashboard: the **AWS**
+menu on every site row, a live-site chip on the project card, "Link to AWS" when a new folder is
+made, and the `cmd-tools-aws.sh` command in every site workspace. A provider of
+[`@webship.co/workspace-hosting`](https://github.com/webship/workspace-hosting), which draws the menu,
+the environments modal, the get-database-and-files flow and the New-folder section for every host.
+
+Elastic Beanstalk is the AWS product that has environments the way the family understands them: an application with named environments, each with a URL, a status and a health. A deploy zips the code, uploads it to the Beanstalk bucket, creates an application version and updates the environment. The database (RDS) is not reachable generically from a laptop, so there is no `--pull-db`; the public files come from an S3 bucket named once with `--files-bucket`.
+
+## Use it
+
+```bash
+cd ~/workspace
+bash core/scripts/plugins.sh --require github:webship/workspace-aws
+bash core/scripts/plugins.sh --activate aws
+bash core/scripts/plugins.sh --install aws
+bash core/scripts/plugins.sh --configure aws      # core/config/plugin.aws.settings.yml
+```
+
+The same four steps are buttons on the dashboard's **Settings → Plugins** page.
+
+## The command
+
+```bash
+cd ~/workspace/dev
+bash cmd-tools-aws.sh <project> [verb]
+```
+
+| Verb | What it does |
+| --- | --- |
+| `--link` <value> | Link the project to an Elastic Beanstalk application by name (aws elasticbeanstalk describe-applications). Add --region to pin its region. |
+| `--region` <value> | The region of the application, remembered by --link. Default: the plugin's setting. |
+| `--files-bucket` <value> | Remember the S3 bucket (and optional prefix: bucket/prefix) --pull-files syncs the public files from. |
+| `--push` | Deploy: zip the current code (git archive), upload it to the Beanstalk storage bucket, create an application version and update the selected environment to it. Outward-facing: asks before updating. |
+| `--environment` <value> | Environment for THIS run: the --push target, the --logs and --pull-files source. Default: the one remembered by --select. |
+| `--environments` | List the application's environments with their status, health and URL. |
+| `--select` <value> | Remember which environment this project works against (in .aws/workspace.yml, git-excluded). Checked against the real list. |
+| `--pull-files` | aws s3 sync the files bucket into the local docroot's sites/default/files (adds and overwrites, never deletes). Client data. |
+| `--logs` | Fetch the selected environment's tail logs (request-environment-info tail, then retrieve). |
+| `--activities` | List the application's last 10 events. |
+| `--force` | Allow --link to relink a project that already points at a different application. |
+
+The link lives in the project's `.aws/workspace.yml` (git-excluded); the dashboard reads it to know
+the project is linked and which environment it works against.
+
+## What the package holds
+
+| Path | What it is |
+| --- | --- |
+| `src/index.ts` | `register(api)`: `registerHosting(api, awsProvider(api))` |
+| `src/lib/provider.ts` | The AWS provider: the credentials, the environments and their URLs, the verbs, the pulls, the console |
+| `src/lib/link.ts` | The link file reader |
+| `commands/cmd-tools-aws.sh` | The per-workspace command |
+| `scripts/functions/fun-aws.sh` | The provider's bash hooks (aws) |
+| `scripts/functions/fun-aws-tool.sh` | The family's dispatcher: link file, environment selection, safety export, status |
+| `scripts/args/arg-aws.sh` | Its argparse |
+| `scripts/host-install.sh` | The host side: the CLI and the credential check |
+| `config/plugin.aws.settings.yml` | The settings template |
+
+The `workspacePlugin` block in `package.json` is the manifest the installer reads.

package/commands/cmd-tools-aws.sh

@@ -0,0 +1,22 @@
+#!/usr/bin/env bash
+
+# Installed by the AWS plugin (plugins.sh --install aws); __WORKSPACE__ is the workspace it was installed into.
+#
+# The local ⇄ cloud bridge for one project on AWS: show its link and environments, link it,
+# bring a database and files down into DDEV, deploy, read logs.
+
+# Bootstrap.
+# Find the workspace tooling from this script, so a fresh clone needs no setup.
+WORKSPACE_SCRIPTS="${WORKSPACE_SCRIPTS:-$(cd "$(dirname "${BASH_SOURCE[0]}")/../core/scripts" && pwd)}";
+source ${WORKSPACE_SCRIPTS}/bootstrap.sh || exit 1 ;
+
+# Load workspace settings and extra lists.
+eval $(parse_yaml ${WORKSPACE_CONFIG}/workspace.__WORKSPACE__.settings.yml);
+
+ARGPARSE_DESCRIPTION="Show, link, pull from or deploy a __WORKSPACE__ project on AWS"
+# The args file comes with the plugin: core/scripts/plugins/aws/ is where plugins.sh --install puts it.
+source ${WORKSPACE_SCRIPTS}/plugins/aws/args/arg-aws.sh || exit 1 ;
+
+shift $#;
+
+aws_project_tool ;

package/config/plugin.aws.settings.yml

@@ -0,0 +1,11 @@
+# AWS — core/config/plugin.aws.settings.yml
+#
+# The aws CLI inside the dashboard container. Either the host's ~/.aws profile (mounted) or an access key for the dashboard; injected only into AWS jobs, never printed.
+# The named profile in ~/.aws (mounted from the host) the dashboard and the tool use. Ignored when an access key is set below.
+profile: default
+# The region the applications live in, unless the project's link says otherwise.
+region: eu-west-1
+# An IAM access key for the dashboard (optional when the host profile is mounted). Read by the CLI as AWS_ACCESS_KEY_ID.
+access_key_id: CHANGE_ME
+# The secret of that key. Read by the CLI as AWS_SECRET_ACCESS_KEY.
+secret_access_key: CHANGE_ME

package/config/settings.labels.yml

@@ -0,0 +1,13 @@
+# Labels for core/config/plugin.aws.settings.yml, merged into the Settings page.
+profile:
+  label: AWS profile
+  info: 'The named profile in ~/.aws (mounted from the host) the dashboard and the tool use. Ignored when an access key is set below.'
+region:
+  label: AWS region
+  info: 'The region the applications live in, unless the project''s link says otherwise.'
+access_key_id:
+  label: Access key id
+  info: 'An IAM access key for the dashboard (optional when the host profile is mounted). Read by the CLI as AWS_ACCESS_KEY_ID.'
+secret_access_key:
+  label: Secret access key
+  info: 'The secret of that key. Read by the CLI as AWS_SECRET_ACCESS_KEY.'

package/ddev/docker-compose.aws-cli.yaml

@@ -0,0 +1,9 @@
+# The aws CLI and its session, shared FROM THE HOST: one login, token refreshes land on
+# the host, rebuilds keep it. The bin DIRECTORY is mounted, not the file, so an update on the host
+# is live in the container at once. A machine without the CLI mounts an empty dir and the actions
+# say so.
+services:
+  web:
+    volumes:
+      - "${HOME}/.local/bin:/host-local-bin:ro"
+      - "${HOME}/.aws:/home/${USER}/.aws:rw"

package/dist/src/index.d.ts

@@ -0,0 +1,16 @@
+/**
+ * AWS for Webship Workspace.
+ *
+ * The AWS menu on every site row, a live-site chip, the New-folder link option and the
+ * `/aws-site/<workspace>/<project>` jump: all of it is the hosting family's surface
+ * (@webship.co/workspace-hosting). This package is the AWS provider plus what the installer places
+ * (the per-workspace command, its bash functions, the settings template, the host install).
+ *
+ * Everything the dashboard is asked for goes through `api`; this package requires nothing from
+ * the dashboard's own files.
+ */
+import type { PluginApi } from '@webship.co/workspace-plugin-api';
+import { awsProvider } from './lib/provider';
+export { awsProvider };
+export { awsLinkOf } from './lib/link';
+export declare function register(api: PluginApi): void;

package/dist/src/index.js

@@ -0,0 +1,24 @@
+"use strict";
+/**
+ * AWS for Webship Workspace.
+ *
+ * The AWS menu on every site row, a live-site chip, the New-folder link option and the
+ * `/aws-site/<workspace>/<project>` jump: all of it is the hosting family's surface
+ * (@webship.co/workspace-hosting). This package is the AWS provider plus what the installer places
+ * (the per-workspace command, its bash functions, the settings template, the host install).
+ *
+ * Everything the dashboard is asked for goes through `api`; this package requires nothing from
+ * the dashboard's own files.
+ */
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.awsLinkOf = exports.awsProvider = void 0;
+exports.register = register;
+const workspace_hosting_1 = require("@webship.co/workspace-hosting");
+const provider_1 = require("./lib/provider");
+Object.defineProperty(exports, "awsProvider", { enumerable: true, get: function () { return provider_1.awsProvider; } });
+var link_1 = require("./lib/link");
+Object.defineProperty(exports, "awsLinkOf", { enumerable: true, get: function () { return link_1.awsLinkOf; } });
+function register(api) {
+    (0, workspace_hosting_1.registerHosting)(api, (0, provider_1.awsProvider)(api));
+}
+//# sourceMappingURL=index.js.map

package/dist/src/index.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../../src/index.ts"],"names":[],"mappings":";AAAA;;;;;;;;;;GAUG;;;AAUH,4BAEC;AATD,qEAAgE;AAEhE,6CAA6C;AAEpC,4FAFA,sBAAW,OAEA;AACpB,mCAAuC;AAA9B,iGAAA,SAAS,OAAA;AAElB,SAAgB,QAAQ,CAAC,GAAc;IACrC,IAAA,mCAAe,EAAC,GAAG,EAAE,IAAA,sBAAW,EAAC,GAAG,CAAC,CAAC,CAAC;AACzC,CAAC"}

package/dist/src/lib/link.d.ts

@@ -0,0 +1,11 @@
+/**
+ * Whether a project is linked to AWS, and to what: the `.aws/workspace.yml` file that
+ * `cmd-tools-aws.sh --link` writes (git-excluded), plus the branch the local code is on.
+ */
+import type { HostingLink } from '@webship.co/workspace-hosting';
+export interface AWSLink extends HostingLink {
+    /** Every key of the link file, for the provider's own needs (region, resource group, host…). */
+    fields: Record<string, string>;
+}
+export declare function readLinkFile(projectDir: string): Record<string, string> | null;
+export declare function awsLinkOf(projectDir: string): AWSLink | null;

package/dist/src/lib/link.js

@@ -0,0 +1,42 @@
+"use strict";
+/**
+ * Whether a project is linked to AWS, and to what: the `.aws/workspace.yml` file that
+ * `cmd-tools-aws.sh --link` writes (git-excluded), plus the branch the local code is on.
+ */
+var __importDefault = (this && this.__importDefault) || function (mod) {
+    return (mod && mod.__esModule) ? mod : { "default": mod };
+};
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.readLinkFile = readLinkFile;
+exports.awsLinkOf = awsLinkOf;
+const fs_1 = __importDefault(require("fs"));
+const path_1 = __importDefault(require("path"));
+function readLinkFile(projectDir) {
+    let text;
+    try {
+        text = fs_1.default.readFileSync(path_1.default.join(projectDir, '.aws', 'workspace.yml'), 'utf8');
+    }
+    catch (_) {
+        return null;
+    }
+    const fields = {};
+    for (const line of text.split('\n')) {
+        const m = line.match(/^([a-z_]+):\s*(.*?)\s*$/);
+        if (m)
+            fields[m[1]] = m[2].replace(/^["']|["']$/g, '');
+    }
+    return fields;
+}
+function awsLinkOf(projectDir) {
+    const fields = readLinkFile(projectDir);
+    if (!fields || !fields.id)
+        return null;
+    let branch = null;
+    try {
+        const head = fs_1.default.readFileSync(path_1.default.join(projectDir, '.git', 'HEAD'), 'utf8').trim();
+        branch = (head.match(/^ref: refs\/heads\/(.+)$/) || [])[1] || null;
+    }
+    catch (_) { /* not a git clone */ }
+    return { id: fields.id, env: fields.env || null, branch, fields };
+}
+//# sourceMappingURL=link.js.map

package/dist/src/lib/link.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"link.js","sourceRoot":"","sources":["../../../src/lib/link.ts"],"names":[],"mappings":";AAAA;;;GAGG;;;;;AAWH,oCASC;AAED,8BASC;AA7BD,4CAAoB;AACpB,gDAAwB;AAQxB,SAAgB,YAAY,CAAC,UAAkB;IAC7C,IAAI,IAAY,CAAC;IACjB,IAAI,CAAC;QAAC,IAAI,GAAG,YAAE,CAAC,YAAY,CAAC,cAAI,CAAC,IAAI,CAAC,UAAU,EAAE,MAAM,EAAE,eAAe,CAAC,EAAE,MAAM,CAAC,CAAC;IAAC,CAAC;IAAC,OAAO,CAAC,EAAE,CAAC;QAAC,OAAO,IAAI,CAAC;IAAC,CAAC;IAClH,MAAM,MAAM,GAA2B,EAAE,CAAC;IAC1C,KAAK,MAAM,IAAI,IAAI,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,EAAE,CAAC;QACpC,MAAM,CAAC,GAAG,IAAI,CAAC,KAAK,CAAC,yBAAyB,CAAC,CAAC;QAChD,IAAI,CAAC;YAAE,MAAM,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,cAAc,EAAE,EAAE,CAAC,CAAC;IACzD,CAAC;IACD,OAAO,MAAM,CAAC;AAChB,CAAC;AAED,SAAgB,SAAS,CAAC,UAAkB;IAC1C,MAAM,MAAM,GAAG,YAAY,CAAC,UAAU,CAAC,CAAC;IACxC,IAAI,CAAC,MAAM,IAAI,CAAC,MAAM,CAAC,EAAE;QAAE,OAAO,IAAI,CAAC;IACvC,IAAI,MAAM,GAAkB,IAAI,CAAC;IACjC,IAAI,CAAC;QACH,MAAM,IAAI,GAAG,YAAE,CAAC,YAAY,CAAC,cAAI,CAAC,IAAI,CAAC,UAAU,EAAE,MAAM,EAAE,MAAM,CAAC,EAAE,MAAM,CAAC,CAAC,IAAI,EAAE,CAAC;QACnF,MAAM,GAAG,CAAC,IAAI,CAAC,KAAK,CAAC,0BAA0B,CAAC,IAAI,EAAE,CAAC,CAAC,CAAC,CAAC,IAAI,IAAI,CAAC;IACrE,CAAC;IAAC,OAAO,CAAC,EAAE,CAAC,CAAC,qBAAqB,CAAC,CAAC;IACrC,OAAO,EAAE,EAAE,EAAE,MAAM,CAAC,EAAE,EAAE,GAAG,EAAE,MAAM,CAAC,GAAG,IAAI,IAAI,EAAE,MAAM,EAAE,MAAM,EAAE,CAAC;AACpE,CAAC"}

package/dist/src/lib/provider.d.ts

@@ -0,0 +1,11 @@
+/**
+ * AWS Elastic Beanstalk, as a hosting provider.
+ *
+ * The link is `.aws/workspace.yml` (application name, region, files bucket); the environments come
+ * from `aws elasticbeanstalk describe-environments` with the host profile or the access key from
+ * plugin.aws.settings.yml; the deploy, the logs, the events and the files sync go through
+ * cmd-tools-aws.sh in a screen session. No database pull: RDS is not reachable generically.
+ */
+import type { PluginApi } from '@webship.co/workspace-plugin-api';
+import type { HostingProvider } from '@webship.co/workspace-hosting';
+export declare function awsProvider(api: PluginApi): HostingProvider;

package/dist/src/lib/provider.js

@@ -0,0 +1,97 @@
+"use strict";
+/**
+ * AWS Elastic Beanstalk, as a hosting provider.
+ *
+ * The link is `.aws/workspace.yml` (application name, region, files bucket); the environments come
+ * from `aws elasticbeanstalk describe-environments` with the host profile or the access key from
+ * plugin.aws.settings.yml; the deploy, the logs, the events and the files sync go through
+ * cmd-tools-aws.sh in a screen session. No database pull: RDS is not reachable generically.
+ */
+var __importDefault = (this && this.__importDefault) || function (mod) {
+    return (mod && mod.__esModule) ? mod : { "default": mod };
+};
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.awsProvider = awsProvider;
+const fs_1 = __importDefault(require("fs"));
+const path_1 = __importDefault(require("path"));
+const workspace_hosting_1 = require("@webship.co/workspace-hosting");
+const link_1 = require("./link");
+function awsProvider(api) {
+    const settings = () => api.settings.read() || {};
+    const bin = () => (0, workspace_hosting_1.findCli)('aws') || 'aws';
+    // Either the dashboard's own key, or the host's ~/.aws mounted into the container.
+    const jobEnv = () => {
+        const s = settings();
+        const key = (0, workspace_hosting_1.configured)(s.access_key_id);
+        const secret = (0, workspace_hosting_1.configured)(s.secret_access_key);
+        const base = { ...process.env, AWS_DEFAULT_REGION: String(s.region || 'eu-west-1'), AWS_PAGER: '' };
+        if (key && secret)
+            return { ...base, AWS_ACCESS_KEY_ID: key, AWS_SECRET_ACCESS_KEY: secret };
+        const profile = String(s.profile || 'default');
+        const creds = path_1.default.join(process.env.HOME || '', '.aws', 'credentials');
+        const config = path_1.default.join(process.env.HOME || '', '.aws', 'config');
+        if (fs_1.default.existsSync(creds) || fs_1.default.existsSync(config))
+            return { ...base, AWS_PROFILE: profile };
+        return null;
+    };
+    async function environments(link, lib, env) {
+        const id = link.id;
+        const region = (link.fields && link.fields.region) || env.AWS_DEFAULT_REGION;
+        const out = await lib.run(bin(), ['elasticbeanstalk', 'describe-environments', '--application-name', id, '--no-include-deleted', '--region', String(region), '--output', 'json'], process.env.HOME, { timeoutMs: 60 * 1000, env });
+        if (!out.ok)
+            return { id, rows: [], why: 'list failed' };
+        let list = [];
+        try {
+            list = JSON.parse(String(out.stdout)).Environments || [];
+        }
+        catch (_) {
+            return { id, rows: [], why: 'list failed' };
+        }
+        const rows = list.map((e) => ({
+            title: `${e.EnvironmentName}${e.Health ? ` (${e.Health.toLowerCase()})` : ''}`,
+            envId: e.EnvironmentName,
+            status: /^ready$/i.test(e.Status) ? 'active' : String(e.Status || 'unknown').toLowerCase(),
+            url: e.CNAME ? `http://${e.CNAME}` : (e.EndpointURL ? `http://${e.EndpointURL}` : undefined),
+        }));
+        return { id, rows };
+    }
+    return {
+        id: 'aws',
+        label: 'AWS',
+        title: 'AWS',
+        cli: 'aws',
+        script: 'cmd-tools-aws.sh',
+        detect: (projectDir) => (0, link_1.awsLinkOf)(projectDir),
+        linkHint: (project) => `bash cmd-tools-aws.sh ${project} --link <beanstalk-application> --region <region>`,
+        consoleUrl: (link) => {
+            if (!link.id)
+                return null;
+            const region = (link.fields && link.fields.region) || String(settings().region || 'eu-west-1');
+            return `https://${region}.console.aws.amazon.com/elasticbeanstalk/home?region=${region}#/application/overview?applicationName=${encodeURIComponent(link.id)}`;
+        },
+        jobEnv,
+        tokenHint: 'the host ~/.aws profile, or access_key_id and secret_access_key in core/config/plugin.aws.settings.yml',
+        environments,
+        tools: {
+            status: { verb: 'aws', label: 'Link and environments', icon: 'info', args: [] },
+            activities: { verb: 'aws-activities', label: 'Last 10 events', icon: 'list', args: ['--activities'] },
+            logs: { verb: 'aws-logs', label: 'Tail logs of the environment', icon: 'file-text', args: ['--logs'] },
+            deploy: { verb: 'aws-push', label: 'Deploy a version (zip → Beanstalk)…', icon: 'push', args: ['--push'] },
+        },
+        pull: {
+            db: false, files: true,
+            dbArgs: () => [],
+            filesArgs: (e) => ['--environment', e, '--pull-files'],
+        },
+        errorHint: (msg) => (/InvalidClientTokenId|SignatureDoesNotMatch|Unable to locate credentials|ExpiredToken/i.test(msg)
+            ? `${msg}\n\nThe dashboard reaches AWS with the host's ~/.aws profile (mounted) or access_key_id and secret_access_key in core/config/plugin.aws.settings.yml.`
+            : msg),
+        folder: {
+            idPattern: /^[A-Za-z0-9][A-Za-z0-9 _.-]{0,99}$/,
+            idPlaceholder: 'webship-demo',
+            idHelp: 'An Elastic Beanstalk application name: letters, digits, spaces, dots, dashes and underscores, up to 100 characters.',
+        },
+        menuNote: 'RDS is not pulled from here (no --pull-db); files come from the S3 bucket named with --files-bucket',
+    };
+}
+//# sourceMappingURL=provider.js.map

package/dist/src/lib/provider.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"provider.js","sourceRoot":"","sources":["../../../src/lib/provider.ts"],"names":[],"mappings":";AAAA;;;;;;;GAOG;;;;;AAYH,kCAuEC;AAjFD,4CAAoB;AACpB,gDAAwB;AAExB,qEAAoE;AAGpE,iCAAmC;AAInC,SAAgB,WAAW,CAAC,GAAc;IACxC,MAAM,QAAQ,GAAG,GAAG,EAAE,CAAC,GAAG,CAAC,QAAQ,CAAC,IAAI,EAAE,IAAI,EAAE,CAAC;IACjD,MAAM,GAAG,GAAG,GAAG,EAAE,CAAC,IAAA,2BAAO,EAAC,KAAK,CAAC,IAAI,KAAK,CAAC;IAE1C,mFAAmF;IACnF,MAAM,MAAM,GAAG,GAA6B,EAAE;QAC5C,MAAM,CAAC,GAAG,QAAQ,EAAE,CAAC;QACrB,MAAM,GAAG,GAAG,IAAA,8BAAU,EAAC,CAAC,CAAC,aAAa,CAAC,CAAC;QAAC,MAAM,MAAM,GAAG,IAAA,8BAAU,EAAC,CAAC,CAAC,iBAAiB,CAAC,CAAC;QACxF,MAAM,IAAI,GAAsB,EAAE,GAAG,OAAO,CAAC,GAAG,EAAE,kBAAkB,EAAE,MAAM,CAAC,CAAC,CAAC,MAAM,IAAI,WAAW,CAAC,EAAE,SAAS,EAAE,EAAE,EAAE,CAAC;QACvH,IAAI,GAAG,IAAI,MAAM;YAAE,OAAO,EAAE,GAAG,IAAI,EAAE,iBAAiB,EAAE,GAAG,EAAE,qBAAqB,EAAE,MAAM,EAAE,CAAC;QAC7F,MAAM,OAAO,GAAG,MAAM,CAAC,CAAC,CAAC,OAAO,IAAI,SAAS,CAAC,CAAC;QAC/C,MAAM,KAAK,GAAG,cAAI,CAAC,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,IAAI,IAAI,EAAE,EAAE,MAAM,EAAE,aAAa,CAAC,CAAC;QACvE,MAAM,MAAM,GAAG,cAAI,CAAC,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,IAAI,IAAI,EAAE,EAAE,MAAM,EAAE,QAAQ,CAAC,CAAC;QACnE,IAAI,YAAE,CAAC,UAAU,CAAC,KAAK,CAAC,IAAI,YAAE,CAAC,UAAU,CAAC,MAAM,CAAC;YAAE,OAAO,EAAE,GAAG,IAAI,EAAE,WAAW,EAAE,OAAO,EAAE,CAAC;QAC5F,OAAO,IAAI,CAAC;IACd,CAAC,CAAC;IAEF,KAAK,UAAU,YAAY,CAAC,IAAiB,EAAE,GAAc,EAAE,GAAsB;QACnF,MAAM,EAAE,GAAG,IAAI,CAAC,EAAY,CAAC;QAC7B,MAAM,MAAM,GAAG,CAAE,IAAY,CAAC,MAAM,IAAK,IAAY,CAAC,MAAM,CAAC,MAAM,CAAC,IAAI,GAAG,CAAC,kBAAkB,CAAC;QAC/F,MAAM,GAAG,GAAG,MAAM,GAAG,CAAC,GAAG,CAAC,GAAG,EAAE,EAAE,CAAC,kBAAkB,EAAE,uBAAuB,EAAE,oBAAoB,EAAE,EAAE,EAAE,sBAAsB,EAAE,UAAU,EAAE,MAAM,CAAC,MAAM,CAAC,EAAE,UAAU,EAAE,MAAM,CAAC,EAC9K,OAAO,CAAC,GAAG,CAAC,IAAI,EAAE,EAAE,SAAS,EAAE,EAAE,GAAG,IAAI,EAAE,GAAG,EAAE,CAAC,CAAC;QACnD,IAAI,CAAC,GAAG,CAAC,EAAE;YAAE,OAAO,EAAE,EAAE,EAAE,IAAI,EAAE,EAAE,EAAE,GAAG,EAAE,aAAa,EAAE,CAAC;QACzD,IAAI,IAAI,GAAY,EAAE,CAAC;QACvB,IAAI,CAAC;YAAC,IAAI,GAAG,IAAI,CAAC,KAAK,CAAC,MAAM,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC,CAAC,YAAY,IAAI,EAAE,CAAC;QAAC,CAAC;QAAC,OAAO,CAAC,EAAE,CAAC;YAAC,OAAO,EAAE,EAAE,EAAE,IAAI,EAAE,EAAE,EAAE,GAAG,EAAE,aAAa,EAAE,CAAC;QAAC,CAAC;QAC5H,MAAM,IAAI,GAAa,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC;YACtC,KAAK,EAAE,GAAG,CAAC,CAAC,eAAe,GAAG,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,MAAM,CAAC,WAAW,EAAE,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE;YAC9E,KAAK,EAAE,CAAC,CAAC,eAAe;YACxB,MAAM,EAAE,UAAU,CAAC,IAAI,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,MAAM,IAAI,SAAS,CAAC,CAAC,WAAW,EAAE;YAC1F,GAAG,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,UAAU,CAAC,CAAC,KAAK,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,WAAW,CAAC,CAAC,CAAC,UAAU,CAAC,CAAC,WAAW,EAAE,CAAC,CAAC,CAAC,SAAS,CAAC;SAC7F,CAAC,CAAC,CAAC;QACJ,OAAO,EAAE,EAAE,EAAE,IAAI,EAAE,CAAC;IACtB,CAAC;IAED,OAAO;QACL,EAAE,EAAE,KAAK;QACT,KAAK,EAAE,KAAK;QACZ,KAAK,EAAE,KAAK;QACZ,GAAG,EAAE,KAAK;QACV,MAAM,EAAE,kBAAkB;QAC1B,MAAM,EAAE,CAAC,UAAU,EAAE,EAAE,CAAC,IAAA,gBAAS,EAAC,UAAU,CAAC;QAC7C,QAAQ,EAAE,CAAC,OAAO,EAAE,EAAE,CAAC,yBAAyB,OAAO,mDAAmD;QAC1G,UAAU,EAAE,CAAC,IAAI,EAAE,EAAE;YACnB,IAAI,CAAC,IAAI,CAAC,EAAE;gBAAE,OAAO,IAAI,CAAC;YAC1B,MAAM,MAAM,GAAG,CAAE,IAAY,CAAC,MAAM,IAAK,IAAY,CAAC,MAAM,CAAC,MAAM,CAAC,IAAI,MAAM,CAAC,QAAQ,EAAE,CAAC,MAAM,IAAI,WAAW,CAAC,CAAC;YACjH,OAAO,WAAW,MAAM,wDAAwD,MAAM,0CAA0C,kBAAkB,CAAC,IAAI,CAAC,EAAE,CAAC,EAAE,CAAC;QAChK,CAAC;QACD,MAAM;QACN,SAAS,EAAE,wGAAwG;QACnH,YAAY;QACZ,KAAK,EAAE;YACL,MAAM,EAAE,EAAE,IAAI,EAAE,KAAK,EAAE,KAAK,EAAE,uBAAuB,EAAE,IAAI,EAAE,MAAM,EAAE,IAAI,EAAE,EAAE,EAAE;YAC/E,UAAU,EAAE,EAAE,IAAI,EAAE,gBAAgB,EAAE,KAAK,EAAE,gBAAgB,EAAE,IAAI,EAAE,MAAM,EAAE,IAAI,EAAE,CAAC,cAAc,CAAC,EAAE;YACrG,IAAI,EAAE,EAAE,IAAI,EAAE,UAAU,EAAE,KAAK,EAAE,8BAA8B,EAAE,IAAI,EAAE,WAAW,EAAE,IAAI,EAAE,CAAC,QAAQ,CAAC,EAAE;YACtG,MAAM,EAAE,EAAE,IAAI,EAAE,UAAU,EAAE,KAAK,EAAE,qCAAqC,EAAE,IAAI,EAAE,MAAM,EAAE,IAAI,EAAE,CAAC,QAAQ,CAAC,EAAE;SAC3G;QACD,IAAI,EAAE;YACJ,EAAE,EAAE,KAAK,EAAE,KAAK,EAAE,IAAI;YACtB,MAAM,EAAE,GAAG,EAAE,CAAC,EAAE;YAChB,SAAS,EAAE,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,eAAe,EAAE,CAAC,EAAE,cAAc,CAAC;SACvD;QACD,SAAS,EAAE,CAAC,GAAG,EAAE,EAAE,CAAC,CAAC,uFAAuF,CAAC,IAAI,CAAC,GAAG,CAAC;YACpH,CAAC,CAAC,GAAG,GAAG,uJAAuJ;YAC/J,CAAC,CAAC,GAAG,CAAC;QACR,MAAM,EAAE;YACN,SAAS,EAAE,oCAAoC;YAC/C,aAAa,EAAE,cAAc;YAC7B,MAAM,EAAE,qHAAqH;SAC9H;QACD,QAAQ,EAAE,qGAAqG;KAChH,CAAC;AACJ,CAAC"}

package/features/aws.feature

@@ -0,0 +1,20 @@
+Feature: The AWS plugin on a project row
+  Once the plugin is activated and installed, every site row carries the AWS menu, and the Plugins
+  page lists the plugin with its four steps.
+
+  Scenario: A site row offers the AWS menu, captioned with its link state
+    Given I am on "/dev"
+     Then the element ".act-menu-aws" should be displayed
+      And I should see "AWS"
+      And the element ".act-menu-aws + .act-status" should be displayed
+
+  Scenario: An unlinked project's menu opens and says how to link it
+    Given I am on "/dev"
+      And I click on the element ".project-row .act-menu-aws button"
+     Then ".uk-dropdown.uk-open" should be visible
+      And I should see "Not linked to AWS"
+
+  Scenario: The plugin is listed on the Plugins page
+    Given I am on "/settings/plugins"
+     Then I should see "AWS"
+      And I should see "@webship.co/workspace-aws"

package/host-mounts.txt

@@ -0,0 +1,2 @@
+# Directories the dashboard container bind-mounts for this plugin; host-mounts.sh creates them as you first.
+~/.aws

package/package.json

@@ -1,6 +1,88 @@
 {
   "name": "@webship.co/workspace-aws",
-  "version": "0.0.0-stage",
-  "stub": true,
-  "description": "Temporary package placeholder for staged publishing"
-}
+  "version": "1.0.0-alpha1",
+  "description": "AWS Elastic Beanstalk for Webship Workspace: the AWS menu on every site row, the application's environments and their URLs, deploy a version, tail the logs, recent events, public files from S3. A provider of @webship.co/workspace-hosting.",
+  "main": "dist/src/index.js",
+  "types": "dist/src/index.d.ts",
+  "license": "ISC",
+  "repository": {
+    "type": "git",
+    "url": "https://github.com/webship/workspace-aws.git"
+  },
+  "files": [
+    "dist/src",
+    "commands",
+    "config",
+    "features",
+    "scripts",
+    "README.md",
+    "ddev",
+    "host-mounts.txt"
+  ],
+  "scripts": {
+    "build": "tsc -p tsconfig.json",
+    "prepare": "npm run build",
+    "test": "npm run build && node --test dist/tests/*.test.js",
+    "lint": "tsc -p tsconfig.json --noEmit"
+  },
+  "workspacePlugin": {
+    "name": "aws",
+    "label": "AWS",
+    "settingsFile": "plugin.aws.settings.yml",
+    "settingsTemplate": "config/plugin.aws.settings.yml",
+    "labels": "config/settings.labels.yml",
+    "legacySettingsKey": "aws",
+    "typeActions": {
+      "aws": [
+        "sites"
+      ]
+    },
+    "commands": {
+      "types": [
+        "sites"
+      ],
+      "workspaces": [
+        "dev",
+        "test",
+        "demos",
+        "sandboxes",
+        "projects"
+      ],
+      "files": [
+        "commands/cmd-tools-aws.sh"
+      ]
+    },
+    "scripts": {
+      "functions": [
+        "scripts/functions/fun-aws.sh",
+        "scripts/functions/fun-aws-tool.sh"
+      ],
+      "args": [
+        "scripts/args/arg-aws.sh"
+      ],
+      "hostInstall": "scripts/host-install.sh"
+    },
+    "features": [
+      "features/aws.feature"
+    ],
+    "ddev": {
+      "compose": [
+        "ddev/docker-compose.aws-cli.yaml"
+      ],
+      "hostMounts": [
+        "~/.aws"
+      ]
+    }
+  },
+  "dependencies": {
+    "@webship.co/workspace-hosting": "^1.0.0-alpha1"
+  },
+  "devDependencies": {
+    "@types/node": "^24.0.0",
+    "@webship.co/workspace-plugin-api": "^1.0.0-alpha1",
+    "typescript": "^5.9.0"
+  },
+  "publishConfig": {
+    "access": "public"
+  }
+}

package/scripts/args/arg-aws.sh

@@ -0,0 +1,45 @@
+#!/usr/bin/env bash
+
+argparse "$@" <<ARGEOF || exit 1
+parser.add_argument('PROJECT_NAME',
+                    help='The project directory in this workspace.')
+parser.add_argument('-l', '--link',
+                    default="_none_",
+                    help='Link the project to an Elastic Beanstalk application by name (aws elasticbeanstalk describe-applications). Add --region to pin its region.')
+parser.add_argument('-r', '--region',
+                    default="_none_",
+                    help='The region of the application, remembered by --link. Default: the plugin's setting.')
+parser.add_argument('-b', '--files-bucket',
+                    default="_none_",
+                    help='Remember the S3 bucket (and optional prefix: bucket/prefix) --pull-files syncs the public files from.')
+parser.add_argument('-p', '--push',
+                    action='store_true',
+                    default=False,
+                    help='Deploy: zip the current code (git archive), upload it to the Beanstalk storage bucket, create an application version and update the selected environment to it. Outward-facing: asks before updating.')
+parser.add_argument('-e', '--environment',
+                    default="_none_",
+                    help='Environment for THIS run: the --push target, the --logs and --pull-files source. Default: the one remembered by --select.')
+parser.add_argument('-E', '--environments',
+                    action='store_true',
+                    default=False,
+                    help='List the application's environments with their status, health and URL.')
+parser.add_argument('-s', '--select',
+                    default="_none_",
+                    help='Remember which environment this project works against (in .aws/workspace.yml, git-excluded). Checked against the real list.')
+parser.add_argument('-F', '--pull-files',
+                    action='store_true',
+                    default=False,
+                    help='aws s3 sync the files bucket into the local docroot's sites/default/files (adds and overwrites, never deletes). Client data.')
+parser.add_argument('-g', '--logs',
+                    action='store_true',
+                    default=False,
+                    help='Fetch the selected environment's tail logs (request-environment-info tail, then retrieve).')
+parser.add_argument('-a', '--activities',
+                    action='store_true',
+                    default=False,
+                    help='List the application's last 10 events.')
+parser.add_argument('-f', '--force',
+                    action='store_true',
+                    default=False,
+                    help='Allow --link to relink a project that already points at a different application.')
+ARGEOF

package/scripts/functions/fun-aws-tool.sh

@@ -0,0 +1,173 @@
+#!/usr/bin/env bash
+
+# The AWS tool's dispatcher: generated by the hosting family's scaffolder, the same for every
+# provider. The provider's own hooks live in fun-aws.sh:
+#   ensure_aws                              the CLI and credentials are usable, or say how
+#   aws_do_link <project_path> <id>         link the project (writes the link file through aws_link_set)
+#   aws_list_environments <id>              one environment id per line (for --select's check)
+#   aws_do_environments <id>                print the environments for a person
+#   aws_pull_db <project_path> <id> <env>   dump the environment's database to stdout path given in $1… (see fun-aws.sh)
+#   aws_pull_files <project_path> <id> <env>
+#   aws_do_push <project_path> <id> <env>   deploy
+#   aws_do_logs <project_path> <id> <env>
+#   aws_do_activities <project_path> <id>
+#   aws_status <project_path> <id>          the closing status block
+
+AWS_LINK_FILE=".aws/workspace.yml";
+
+# One key of the link file, or nothing.
+function aws_link_get() {
+  local project_path="$1" key="$2";
+  [ -f "${project_path}/${AWS_LINK_FILE}" ] || return 0 ;
+  grep -E "^${key}:" "${project_path}/${AWS_LINK_FILE}" | head -1 | sed -E 's/^[a-z_]+:[[:space:]]*//; s/^"//; s/"$//' ;
+}
+
+# Set one key of the link file, creating it (git-excluded: it is this machine's, not the repo's).
+function aws_link_set() {
+  local project_path="$1" key="$2" value="$3" file;
+  file="${project_path}/${AWS_LINK_FILE}";
+  mkdir -p "$(dirname "${file}")" ;
+  touch "${file}" ;
+  if grep -qE "^${key}:" "${file}" ; then
+    sed -i -E "s|^${key}:.*|${key}: ${value}|" "${file}" ;
+  else
+    printf '%s: %s\n' "${key}" "${value}" >> "${file}" ;
+  fi
+  if [ -d "${project_path}/.git" ] && ! grep -qx "/.aws/" "${project_path}/.git/info/exclude" 2>/dev/null ; then
+    mkdir -p "${project_path}/.git/info" && printf '/.aws/\n' >> "${project_path}/.git/info/exclude" ;
+  fi
+}
+
+function aws_linked_id() { aws_link_get "$1" id ; }
+function aws_selected_env() { aws_link_get "$1" env ; }
+
+# Which environment a run acts on: --environment for this run, else the remembered selection, else
+# nothing. Deliberately NOT defaulting to production: pulling live data because nobody said
+# otherwise is exactly the accident worth preventing.
+function aws_target_env() {
+  if [ ! "${ENVIRONMENT:-_none_}" == '_none_' ] ; then printf '%s' "${ENVIRONMENT}"; return 0 ; fi
+  aws_selected_env "$1";
+}
+
+# Where this project serves from: Drupal's two conventions, plus the flat case.
+function aws_docroot() {
+  for candidate in web docroot ; do
+    [ -d "$1/${candidate}" ] && { printf '%s' "${candidate}"; return 0 ; }
+  done
+  printf '%s' "";
+}
+
+# The local database is replaced by a pull, so it is exported first unless --no-safety-backup.
+function aws_safety_export() {
+  local project_path="$1" safety="$2";
+  if [ "${NO_SAFETY_BACKUP:-no}" == 'yes' ] ; then
+    echo "Skipping the local database export, as asked. The current local data will be lost.";
+  else
+    echo "Exporting the current local database first.";
+    (cd "${project_path}" && ddev export-db --file="${safety}") \
+      || echo "  (no local database to export yet — continuing)";
+  fi
+}
+
+function aws_import_dump() {
+  local project_path="$1" dump="$2";
+  echo "Importing it into DDEV.";
+  (cd "${project_path}" && ddev start -y > /dev/null && ddev import-db --file="${dump}") || return 1 ;
+  echo "  Drupal sites usually need: ddev drush updb -y && ddev drush cr";
+}
+
+function aws_project_tool() {
+  local project_path="${WORKSPACE_ROOT}/${doc_name}/${PROJECT_NAME}";
+  local linked_id="";
+
+  if [ ! -d "${project_path}" ]; then
+    echo "No such project: ${project_path}";
+    return 1 ;
+  fi
+  cd "${project_path}" ;
+  linked_id="$(aws_linked_id "${project_path}")" ;
+
+  if [ ! "${LINK:-_none_}" == '_none_' ] ; then
+    ensure_aws || return 1 ;
+    if [ -n "${linked_id}" ] && [ ! "${linked_id}" == "${LINK}" ] && [ ! "${FORCE:-no}" == 'yes' ] ; then
+      echo "${doc_name}/${PROJECT_NAME} is already linked to AWS ${linked_id}." ;
+      echo "Re-run with --force to relink it to ${LINK}." ;
+      return 1 ;
+    fi
+    aws_do_link "${project_path}" "${LINK}" || return 1 ;
+    linked_id="$(aws_linked_id "${project_path}")" ;
+    echo "Linked ${doc_name}/${PROJECT_NAME} → ${linked_id}." ;
+  fi
+
+  local needs_link="";
+  for flag in "${ENVIRONMENTS:-no}" "${PULL_DB:-no}" "${PULL_FILES:-no}" "${PUSH:-no}" "${LOGS:-no}" "${ACTIVITIES:-no}" ; do
+    [ "${flag}" == 'yes' ] && needs_link=yes ;
+  done
+  [ ! "${SELECT:-_none_}" == '_none_' ] && needs_link=yes ;
+  if [ -n "${needs_link}" ] ; then
+    if [ -z "${linked_id}" ] ; then
+      echo "Not linked to AWS — run with --link <id> first." ;
+      return 1 ;
+    fi
+    ensure_aws || return 1 ;
+  fi
+
+  if [ "${ENVIRONMENTS:-no}" == 'yes' ] ; then
+    aws_do_environments "${project_path}" "${linked_id}" || return 1 ;
+    echo "";
+    echo "  Select one:  bash cmd-tools-aws.sh ${PROJECT_NAME} --select <environment>";
+  fi
+
+  if [ ! "${SELECT:-_none_}" == '_none_' ] ; then
+    # Checked against the real list rather than taken on trust: a typo would otherwise be
+    # discovered by a pull that dumps the wrong environment, or none.
+    if ! aws_list_environments "${project_path}" "${linked_id}" 2>/dev/null | grep -qx "${SELECT}" ; then
+      echo "AWS ${linked_id} has no environment called '${SELECT}'." ;
+      echo "  List them: bash cmd-tools-aws.sh ${PROJECT_NAME} --environments" ;
+      return 1 ;
+    fi
+    aws_link_set "${project_path}" env "${SELECT}" ;
+    echo "${doc_name}/${PROJECT_NAME} now works against the ${SELECT} environment." ;
+  fi
+
+  if [ "${PULL_DB:-no}" == 'yes' ] || [ "${PULL_FILES:-no}" == 'yes' ] || [ "${PUSH:-no}" == 'yes' ] ; then
+    local target_env;
+    target_env="$(aws_target_env "${project_path}")";
+    if [ -z "${target_env}" ] ; then
+      echo "No environment selected. Pick one first — a pull or a deploy must never guess which environment it targets:" ;
+      echo "  bash cmd-tools-aws.sh ${PROJECT_NAME} --environments" ;
+      echo "  bash cmd-tools-aws.sh ${PROJECT_NAME} --select <environment>" ;
+      echo "  (or name it for this run: --environment <environment>)" ;
+      return 1 ;
+    fi
+    [ "${PULL_DB:-no}" == 'yes' ] && { aws_pull_db "${project_path}" "${linked_id}" "${target_env}" || return 1 ; }
+    [ "${PULL_FILES:-no}" == 'yes' ] && { aws_pull_files "${project_path}" "${linked_id}" "${target_env}" || return 1 ; }
+    [ "${PUSH:-no}" == 'yes' ] && { aws_do_push "${project_path}" "${linked_id}" "${target_env}" || return 1 ; }
+  fi
+
+  if [ "${LOGS:-no}" == 'yes' ] ; then
+    aws_do_logs "${project_path}" "${linked_id}" "$(aws_target_env "${project_path}")" || true ;
+  fi
+  if [ "${ACTIVITIES:-no}" == 'yes' ] ; then
+    aws_do_activities "${project_path}" "${linked_id}" || true ;
+  fi
+
+  # Default (and after any verb): status.
+  echo "";
+  echo "*---------------------------------------------------------------------*";
+  echo "  ${doc_name}/${PROJECT_NAME} on AWS";
+  if [ -z "${linked_id}" ]; then
+    echo "    not linked. Link it with:";
+    echo "      bash cmd-tools-aws.sh ${PROJECT_NAME} --link <id>";
+    aws_status "${project_path}" "" ;
+  else
+    echo "    linked:  ${linked_id}";
+    local selected;
+    selected="$(aws_selected_env "${project_path}")";
+    echo "    env:     ${selected:-none selected — --environments then --select <name>}";
+    aws_status "${project_path}" "${linked_id}" ;
+  fi
+  echo "*---------------------------------------------------------------------*";
+
+  cd "${WORKSPACE_ROOT}/${doc_name}";
+}

package/scripts/functions/fun-aws.sh

@@ -0,0 +1,115 @@
+#!/usr/bin/env bash
+
+# AWS Elastic Beanstalk through the aws CLI. The hooks the hosting dispatcher (fun-aws-tool.sh)
+# calls for one project directory. Everything defaults to read-only; --link, --push and
+# --pull-files each demand their flag, and nothing here ever creates or terminates an environment.
+
+function aws_region() {
+  local r; r="$(aws_link_get "$1" region)";
+  printf '%s' "${r:-${AWS_DEFAULT_REGION:-${region:-eu-west-1}}}";
+}
+
+function ensure_aws() {
+  if command -v aws > /dev/null 2>&1 ; then
+    if ! aws sts get-caller-identity > /dev/null 2>&1 ; then
+      echo "aws is installed but has no usable credentials. On the host: aws configure (or an SSO login); in the dashboard: the plugin settings." ;
+      return 1 ;
+    fi
+    return 0 ;
+  fi
+  echo "The aws CLI is not installed. Install it first: https://docs.aws.amazon.com/cli/ (the v2 installer, or pipx install awscli)" ;
+  return 1 ;
+}
+
+function aws_do_link() {
+  local project_path="$1" app="$2" r;
+  r="${REGION:-_none_}"; [ "${r}" == '_none_' ] && r="$(aws_region "${project_path}")";
+  aws elasticbeanstalk describe-applications --application-names "${app}" --region "${r}" --output text --query 'Applications[0].ApplicationName' 2>/dev/null | grep -qx "${app}" \
+    || { echo "No Elastic Beanstalk application '${app}' in ${r} (aws elasticbeanstalk describe-applications)."; return 1; } ;
+  aws_link_set "${project_path}" id "${app}" ;
+  aws_link_set "${project_path}" region "${r}" ;
+  if [ ! "${FILES_BUCKET:-_none_}" == '_none_' ] ; then
+    aws_link_set "${project_path}" files_bucket "${FILES_BUCKET}" ;
+    echo "  --pull-files will sync s3://${FILES_BUCKET}." ;
+  fi
+}
+
+function aws_list_environments() {
+  aws elasticbeanstalk describe-environments --application-name "$2" --no-include-deleted --region "$(aws_region "$1")" --output text --query 'Environments[].EnvironmentName' 2>/dev/null | tr '\t' '\n' ;
+}
+
+function aws_do_environments() {
+  aws elasticbeanstalk describe-environments --application-name "$2" --no-include-deleted --region "$(aws_region "$1")" --output json 2>/dev/null | python3 -c 'import json,sys
+for e in json.load(sys.stdin).get("Environments",[]):
+    print("  %-28s %-10s %-8s %-18s %s" % (e.get("EnvironmentName",""), e.get("Status",""), e.get("Health",""), (e.get("VersionLabel") or "")[:18], ("http://"+e["CNAME"]) if e.get("CNAME") else ""))' \
+    || { echo "  (could not list the environments — check aws sts get-caller-identity)"; return 1; } ;
+}
+
+function aws_pull_db() {
+  echo "RDS is not reachable generically from this machine: there is no --pull-db here.";
+  echo "  The shape of it, from a host that can reach the instance: mysqldump -h <rds-endpoint> -u <user> -p <db> | gzip > dump.sql.gz && ddev import-db --file=dump.sql.gz";
+  return 1 ;
+}
+
+function aws_pull_files() {
+  local project_path="$1" app="$2" env="$3" docroot bucket;
+  bucket="$(aws_link_get "${project_path}" files_bucket)";
+  [ -z "${bucket}" ] && { echo "No files bucket is linked. Name it once: bash cmd-tools-aws.sh ${PROJECT_NAME} --link ${app} --files-bucket <bucket[/prefix]> --force"; return 1; } ;
+  docroot="$(aws_docroot "${project_path}")";
+  [ -z "${docroot}" ] && { echo "No web/ or docroot/ in ${doc_name}/${PROJECT_NAME} — nothing to pull files into."; return 1; } ;
+  echo "";
+  echo "aws s3 sync s3://${bucket}/ → ${docroot}/sites/default/files (adds and overwrites, never deletes). Client data.";
+  mkdir -p "${project_path}/${docroot}/sites/default/files" ;
+  aws s3 sync "s3://${bucket}/" "${project_path}/${docroot}/sites/default/files/" --region "$(aws_region "${project_path}")" || return 1 ;
+  echo "  If Drupal still shows broken images: ddev drush cr";
+}
+
+function aws_do_push() {
+  local project_path="$1" app="$2" env="$3" r label zip bucket key a;
+  r="$(aws_region "${project_path}")";
+  label="$(cd "${project_path}" && git rev-parse --short HEAD 2>/dev/null || date +%s)-$(date +%Y%m%d%H%M%S)";
+  echo "Deploy ${doc_name}/${PROJECT_NAME} (${label}) → environment ${env} of application ${app} in ${r}";
+  echo "  git archive HEAD → zip → the Beanstalk storage bucket → application version → update-environment. The live environment changes.";
+  read -r -p "  Continue? [y/N] " a < /dev/tty || return 1 ;
+  [[ "${a}" =~ ^[Yy] ]] || { echo "Not deployed."; return 1; } ;
+  zip="$(mktemp -d)/${PROJECT_NAME}-${label}.zip";
+  (cd "${project_path}" && git archive --format=zip -o "${zip}" HEAD) || { echo "git archive failed — the deploy ships the committed tree."; return 1; } ;
+  bucket="$(aws elasticbeanstalk create-storage-location --region "${r}" --output text --query S3Bucket)" || return 1 ;
+  key="${app}/${PROJECT_NAME}-${label}.zip";
+  aws s3 cp "${zip}" "s3://${bucket}/${key}" --region "${r}" || return 1 ;
+  aws elasticbeanstalk create-application-version --application-name "${app}" --version-label "${label}" --source-bundle "S3Bucket=${bucket},S3Key=${key}" --region "${r}" > /dev/null || return 1 ;
+  aws elasticbeanstalk update-environment --application-name "${app}" --environment-name "${env}" --version-label "${label}" --region "${r}" > /dev/null || return 1 ;
+  echo "  Version ${label} is deploying to ${env}. Follow it with --activities, or in the console.";
+}
+
+function aws_do_logs() {
+  local project_path="$1" app="$2" env="$3" r url;
+  [ -z "${env}" ] && { echo "Select an environment first (--select) to fetch its logs."; return 1; } ;
+  r="$(aws_region "${project_path}")";
+  aws elasticbeanstalk request-environment-info --environment-name "${env}" --info-type tail --region "${r}" > /dev/null || return 1 ;
+  sleep 8 ;
+  url="$(aws elasticbeanstalk retrieve-environment-info --environment-name "${env}" --info-type tail --region "${r}" --output text --query 'EnvironmentInfo[-1].Message')" || return 1 ;
+  [ -n "${url}" ] && [ ! "${url}" == 'None' ] && curl -sS "${url}" | tail -200 || echo "  (no tail yet — run again in a moment)";
+}
+
+function aws_do_activities() {
+  aws elasticbeanstalk describe-events --application-name "$2" --max-items 10 --region "$(aws_region "$1")" --output json 2>/dev/null | python3 -c 'import json,sys
+for e in json.load(sys.stdin).get("Events",[])[:10]:
+    print("  %-20s %-6s %-24s %s" % ((e.get("EventDate") or "")[:19], e.get("Severity",""), (e.get("EnvironmentName") or "")[:24], e.get("Message","")))' \
+    || echo "  (could not list the events)" ;
+}
+
+function aws_status() {
+  local project_path="$1" app="$2";
+  if [ -z "${app}" ] ; then
+    echo "    (find applications with: aws elasticbeanstalk describe-applications)";
+    return 0 ;
+  fi
+  echo "    region:  $(aws_region "${project_path}")";
+  echo "    files:   $(aws_link_get "${project_path}" files_bucket)";
+  echo "";
+  aws_do_environments "${project_path}" "${app}" ;
+  echo "";
+  echo "  Console: https://$(aws_region "${project_path}").console.aws.amazon.com/elasticbeanstalk/home#/application/overview?applicationName=${app}";
+  echo "  --push deploys a version; --pull-files syncs the S3 files bucket; RDS is not pulled from here.";
+}

package/scripts/host-install.sh

@@ -0,0 +1,31 @@
+#!/usr/bin/env bash
+## The host side of the AWS plugin: the CLI on this machine and the dashboard's credentials.
+## Run by core/scripts/plugins.sh --install aws, and by core/scripts/install.sh for every installed
+## plugin that ships one. Idempotent: whatever is already there is reported, not redone. Offered,
+## never automatic: a hosting CLI carries cloud credentials for real environments.
+set -u
+WORKSPACE_ROOT="${WORKSPACE_ROOT:-$(cd "$(dirname "${BASH_SOURCE[0]}")/../../../../.." && pwd)}";
+
+# The aws CLI on this machine, mounted into the dashboard from ~/.local/bin or found on PATH.
+BIN='';
+for candidate in "$(command -v aws 2>/dev/null)" "${HOME}/.local/bin/aws" ; do
+  [ -n "${candidate}" ] && [ -x "${candidate}" ] && { BIN="${candidate}"; break; }
+done
+if [ -n "${BIN}" ] ; then
+  printf '  ✓ %-16s %s\n' "aws" "${BIN}" ;
+else
+  printf '  ✗ %-16s %s\n' "aws" "missing — the AWS menu needs it (docs.aws.amazon.com/cli — the v2 installer, or pipx install awscli)" ;
+fi
+
+STATE="$(grep -E '^access_key_id:' "${WORKSPACE_ROOT}/core/config/plugin.aws.settings.yml" 2>/dev/null | head -1 | sed -E 's/^[a-z_]+:[[:space:]]*//')";
+case "${STATE}" in
+  ''|CHANGE_ME|"''"|'""') printf '  ✗ %-16s %s\n' "access_key_id" "not set in plugin.aws.settings.yml — the dashboard cannot reach AWS" ;;
+  *)                       printf '  ✓ %-16s %s\n' "access_key_id" "set (plugin.aws.settings.yml)" ;;
+esac
+
+STATE="$(grep -E '^secret_access_key:' "${WORKSPACE_ROOT}/core/config/plugin.aws.settings.yml" 2>/dev/null | head -1 | sed -E 's/^[a-z_]+:[[:space:]]*//')";
+case "${STATE}" in
+  ''|CHANGE_ME|"''"|'""') printf '  ✗ %-16s %s\n' "secret_access_key" "not set in plugin.aws.settings.yml — the dashboard cannot reach AWS" ;;
+  *)                       printf '  ✓ %-16s %s\n' "secret_access_key" "set (plugin.aws.settings.yml)" ;;
+esac
+