blogwright-core 0.4.0-beta.2 → 0.4.0-beta.4

package/dist/aws/logs.d.ts

@@ -35,6 +35,12 @@ export declare class LogsClient {
     constructor(client: SigningClient);
     private call;
     ensureLogGroup(name: string, tags?: ResourceTags): Promise<void>;
+    /**
+     * Create a log stream inside a log group, treating an existing stream as success.
+     * `CreateLogStream` takes no tags, so this carries none: a stream is tagged only
+     * through the group that holds it.
+     */
+    ensureLogStream(logGroupName: string, logStreamName: string): Promise<void>;
     putRetentionPolicy(name: string, retentionInDays: number): Promise<void>;
     logGroupExists(name: string): Promise<boolean>;
     deleteLogGroup(name: string): Promise<void>;

package/dist/aws/logs.js

@@ -33,6 +33,21 @@ export class LogsClient {
             throw err;
         }
     }
+    /**
+     * Create a log stream inside a log group, treating an existing stream as success.
+     * `CreateLogStream` takes no tags, so this carries none: a stream is tagged only
+     * through the group that holds it.
+     */
+    async ensureLogStream(logGroupName, logStreamName) {
+        try {
+            await this.call('CreateLogStream', { logGroupName, logStreamName });
+        }
+        catch (err) {
+            if (err instanceof AwsError && err.isAlreadyExists)
+                return;
+            throw err;
+        }
+    }
     async putRetentionPolicy(name, retentionInDays) {
         await this.call('PutRetentionPolicy', { logGroupName: name, retentionInDays });
     }

package/dist/config.d.ts

@@ -30,9 +30,12 @@ export interface SeoConfig {
  * A *shape*, not a contract core enforces: `blogwright-pds` owns this key end
  * to end - it validates the block (`validatePdsConfig`) and derives the
  * `<siteName>/atproto` default `secretName` (`resolvePdsSecretName`). Core
- * parses the block through untouched. The type stays here only because
- * `OpsConfig.pds` is still declared, which is what lets the CLI's deploy-role
- * statement read it until that statement moves to the plugin.
+ * parses the block through untouched. The CLI's own resource graph no longer
+ * reads the block at all: its deploy-role statement for the secret is gone,
+ * and that grant is now the plugin's own named inline policy
+ * (`buildPdsNodes`, `packages/pds/src/nodes.ts`). The type stays here because
+ * `OpsConfig.pds` is still a declared member, and it is through
+ * `ctx.config.pds` that the plugin itself reads the block.
  */
 export interface PdsConfig {
     /** Publication display name (site.standard.publication `name`). */

package/dist/plugin.d.ts

@@ -272,7 +272,7 @@ export interface ConfigBlockEntry {
 /**
  * Namespace pattern shared by `Plugin.name` and {@link PluginManifest}'s
  * `plugin` field, so the JSON Schema fragment
- * (`.specs/changes/2026-07-26-cli_plugin_system.md` §Type changes) and this
+ * (`.specs/changes/merged/2026-07-26-cli_plugin_system.md` §Type changes) and this
  * runtime check cannot drift apart. Lowercase alphanumerics and dashes.
  */
 export declare const PLUGIN_NAME_PATTERN: RegExp;

package/dist/plugin.js

@@ -14,7 +14,7 @@
 /**
  * Namespace pattern shared by `Plugin.name` and {@link PluginManifest}'s
  * `plugin` field, so the JSON Schema fragment
- * (`.specs/changes/2026-07-26-cli_plugin_system.md` §Type changes) and this
+ * (`.specs/changes/merged/2026-07-26-cli_plugin_system.md` §Type changes) and this
  * runtime check cannot drift apart. Lowercase alphanumerics and dashes.
  */
 export const PLUGIN_NAME_PATTERN = /^[a-z0-9-]+$/;

package/dist/state.d.ts

@@ -1,3 +1,4 @@
+/** S3-backed topology state and validation of its persisted boundary. */
 import type { S3Client } from './aws/s3.js';
 export type ResourceOutputs = Record<string, string | number | boolean | string[]>;
 export interface OpsState {

package/dist/state.js

@@ -1,6 +1,43 @@
 export function emptyState(env) {
     return { version: 1, env, updatedAt: undefined, resources: {} };
 }
+function isRecord(value) {
+    return typeof value === 'object' && value !== null && !Array.isArray(value);
+}
+function isOutputValue(value) {
+    return (typeof value === 'string' ||
+        typeof value === 'number' ||
+        typeof value === 'boolean' ||
+        (Array.isArray(value) && value.every((item) => typeof item === 'string')));
+}
+function invalidStateField(value) {
+    if (!isRecord(value))
+        return 'state';
+    if (typeof value.version !== 'number')
+        return 'version';
+    if (typeof value.env !== 'string')
+        return 'env';
+    if (value.updatedAt !== undefined && typeof value.updatedAt !== 'string')
+        return 'updatedAt';
+    if (!isRecord(value.resources))
+        return 'resources';
+    for (const [nodeId, outputs] of Object.entries(value.resources)) {
+        const field = `resources[${JSON.stringify(nodeId)}]`;
+        if (!isRecord(outputs))
+            return field;
+        for (const [name, output] of Object.entries(outputs)) {
+            if (!isOutputValue(output))
+                return `${field}[${JSON.stringify(name)}]`;
+        }
+    }
+    return undefined;
+}
+function validateState(value, location) {
+    const field = invalidStateField(value);
+    if (field !== undefined) {
+        throw new Error(`${location} has invalid state field ${field} - refusing to proceed with empty state`);
+    }
+}
 /** Namespace shape a plugin manifest declares - reused here so a scope can't smuggle a `/` or `..` into the key. */
 const SCOPE_PATTERN = /^[a-z0-9-]+$/;
 function stateKey(env, scope) {
@@ -53,12 +90,15 @@ export class StateStore {
         // corruption, not a fresh environment, and must hit the guard below.
         if (text === undefined)
             return emptyState(this.env);
+        let state;
         try {
-            return JSON.parse(text);
+            state = JSON.parse(text);
         }
         catch (err) {
             throw new Error(`${this.key} in s3://${this.bucket} is not valid JSON - refusing to proceed with empty state`, { cause: err });
         }
+        validateState(state, `${this.key} in s3://${this.bucket}`);
+        return state;
     }
     async save(state) {
         state.updatedAt = new Date().toISOString();

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "blogwright-core",
-  "version": "0.4.0-beta.2",
+  "version": "0.4.0-beta.4",
   "type": "module",
   "sideEffects": false,
   "files": [