blogwright-pds 0.4.0-beta.3 → 0.4.0-beta.4

This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.
Files changed (3) hide show
  1. package/dist/nodes.d.ts +17 -16
  2. package/dist/nodes.js +17 -16
  3. package/package.json +2 -2
package/dist/nodes.d.ts CHANGED
@@ -4,16 +4,17 @@
4
4
  * role, granting Secrets Manager access to the plugin's own secret.
5
5
  *
6
6
  * The grant lives here rather than in the site's resource graph because it is
7
- * plugin topography: the site graph currently branches on `ctx.config.pds` and
8
- * interpolates this plugin's secret name into an IAM ARN
9
- * (`packages/cli/src/nodes.ts`), which is the CLI knowing something only this
10
- * package should know. Moving it here is safe because IAM inline policies are
7
+ * plugin topography: the site graph used to branch on `ctx.config.pds` and
8
+ * interpolate this plugin's secret name into an IAM ARN
9
+ * (`packages/cli/src/nodes.ts`), which was the CLI knowing something only this
10
+ * package should know. That branch is gone, and this node is now the only
11
+ * thing that grants it. The move was safe because IAM inline policies are
11
12
  * *named*: the site's `<env>-deploy` document and this plugin's
12
13
  * `blogwright-pds` document are independent objects on the same role, created,
13
- * reconciled and removed with no read of each other. That is what makes the
14
- * migration additive - both grants are live at once until the site's statement
15
- * is removed a release later - and it is why `delete()` can safely remove this
16
- * document without touching the role's own.
14
+ * reconciled and removed with no read of each other. That is what made the
15
+ * migration additive - both grants were live at once for the release between
16
+ * this node landing and the site's statement being removed - and it is why
17
+ * `delete()` can safely remove this document without touching the role's own.
17
18
  *
18
19
  * The node's own state (the site's deploy role) is not something this plugin
19
20
  * creates, so `read()` never reports the role - only whether the policy this
@@ -45,14 +46,14 @@ type PdsNode = ResourceNode<PluginContext<PdsConfig>>;
45
46
  * (`buildNodes` adds `githubOidcRoleNode(true)` for it unconditionally),
46
47
  * but its OIDC trust policy accepts the subject claim `repo:<owner>/<repo>:*`
47
48
  * - **any ref** - where production accepts only the release-gated
48
- * `repo:...:environment:production` (`oidcSubClaim`). The site's own graph
49
- * withholds exactly this Secrets Manager statement from that role for that
50
- * reason, and `resolvePdsSecretName` is environment-independent
51
- * (`<siteName>/atproto`), so there is ONE PDS credential for the whole
52
- * site: granting it here would let anyone who can push a branch read or
53
- * rotate the site's ATProto session. `staging` is NOT a preview stack -
54
- * the site already grants it this statement - so the skip is on the
55
- * preview environment specifically, never on "not production".
49
+ * `repo:...:environment:production` (`oidcSubClaim`). `resolvePdsSecretName`
50
+ * is environment-independent (`<siteName>/atproto`), so there is ONE PDS
51
+ * credential for the whole site: granting it here would let anyone who can
52
+ * push a branch read or rotate the site's ATProto session. The site's own
53
+ * graph withheld exactly this Secrets Manager statement from that role for
54
+ * that reason, for as long as it carried the statement at all. `staging` is
55
+ * NOT a preview stack - the site granted it this statement - so the skip is
56
+ * on the preview environment specifically, never on "not production".
56
57
  *
57
58
  * The preview check is `ctx.env === PREVIEW_ENV` and deliberately **not**
58
59
  * `ctx.preview`, which would be dead code here: `runPlugin` builds its
package/dist/nodes.js CHANGED
@@ -4,16 +4,17 @@
4
4
  * role, granting Secrets Manager access to the plugin's own secret.
5
5
  *
6
6
  * The grant lives here rather than in the site's resource graph because it is
7
- * plugin topography: the site graph currently branches on `ctx.config.pds` and
8
- * interpolates this plugin's secret name into an IAM ARN
9
- * (`packages/cli/src/nodes.ts`), which is the CLI knowing something only this
10
- * package should know. Moving it here is safe because IAM inline policies are
7
+ * plugin topography: the site graph used to branch on `ctx.config.pds` and
8
+ * interpolate this plugin's secret name into an IAM ARN
9
+ * (`packages/cli/src/nodes.ts`), which was the CLI knowing something only this
10
+ * package should know. That branch is gone, and this node is now the only
11
+ * thing that grants it. The move was safe because IAM inline policies are
11
12
  * *named*: the site's `<env>-deploy` document and this plugin's
12
13
  * `blogwright-pds` document are independent objects on the same role, created,
13
- * reconciled and removed with no read of each other. That is what makes the
14
- * migration additive - both grants are live at once until the site's statement
15
- * is removed a release later - and it is why `delete()` can safely remove this
16
- * document without touching the role's own.
14
+ * reconciled and removed with no read of each other. That is what made the
15
+ * migration additive - both grants were live at once for the release between
16
+ * this node landing and the site's statement being removed - and it is why
17
+ * `delete()` can safely remove this document without touching the role's own.
17
18
  *
18
19
  * The node's own state (the site's deploy role) is not something this plugin
19
20
  * creates, so `read()` never reports the role - only whether the policy this
@@ -146,14 +147,14 @@ function oidcPolicyNode(secretName) {
146
147
  * (`buildNodes` adds `githubOidcRoleNode(true)` for it unconditionally),
147
148
  * but its OIDC trust policy accepts the subject claim `repo:<owner>/<repo>:*`
148
149
  * - **any ref** - where production accepts only the release-gated
149
- * `repo:...:environment:production` (`oidcSubClaim`). The site's own graph
150
- * withholds exactly this Secrets Manager statement from that role for that
151
- * reason, and `resolvePdsSecretName` is environment-independent
152
- * (`<siteName>/atproto`), so there is ONE PDS credential for the whole
153
- * site: granting it here would let anyone who can push a branch read or
154
- * rotate the site's ATProto session. `staging` is NOT a preview stack -
155
- * the site already grants it this statement - so the skip is on the
156
- * preview environment specifically, never on "not production".
150
+ * `repo:...:environment:production` (`oidcSubClaim`). `resolvePdsSecretName`
151
+ * is environment-independent (`<siteName>/atproto`), so there is ONE PDS
152
+ * credential for the whole site: granting it here would let anyone who can
153
+ * push a branch read or rotate the site's ATProto session. The site's own
154
+ * graph withheld exactly this Secrets Manager statement from that role for
155
+ * that reason, for as long as it carried the statement at all. `staging` is
156
+ * NOT a preview stack - the site granted it this statement - so the skip is
157
+ * on the preview environment specifically, never on "not production".
157
158
  *
158
159
  * The preview check is `ctx.env === PREVIEW_ENV` and deliberately **not**
159
160
  * `ctx.preview`, which would be dead code here: `runPlugin` builds its
package/package.json CHANGED
@@ -1,6 +1,6 @@
1
1
  {
2
2
  "name": "blogwright-pds",
3
- "version": "0.4.0-beta.3",
3
+ "version": "0.4.0-beta.4",
4
4
  "type": "module",
5
5
  "sideEffects": false,
6
6
  "blogwright": {
@@ -21,7 +21,7 @@
21
21
  },
22
22
  "dependencies": {
23
23
  "@atproto/oauth-client-node": "^0.4.7",
24
- "blogwright-core": "0.4.0-beta.3"
24
+ "blogwright-core": "0.4.0-beta.4"
25
25
  },
26
26
  "devDependencies": {
27
27
  "@types/node": "^26.1.0",