blogwright 0.1.0

package/dist/deploy.js

@@ -0,0 +1,247 @@
+import { randomUUID } from 'node:crypto';
+import { networkConnectors, pollUntil, sleep } from 'blogwright-core';
+import { formatDuration, spinnerFrame } from './render.js';
+import { resolveSeo } from './seo.js';
+function manifestKey(hash) {
+    return `build/manifests/${hash}.json`;
+}
+/**
+ * Nudge the MicroVM's endpoint to wake its event loop. A Firecracker-resumed process
+ * can sit idle with its poll timer pending until some I/O arrives; a connection here —
+ * even one the agent's HTTP/1 server can't fully parse — wakes the loop so the timer
+ * fires and the build starts. The wake-up, not the response, is the point: a missing
+ * endpoint or token means nothing to nudge, and a rejecting ping never fails the poll.
+ */
+async function nudge(ctx, endpoint, token) {
+    if (!endpoint || !token)
+        return;
+    await ctx.ports.ping(endpoint, token).catch(() => undefined);
+}
+/**
+ * Resolve the MicroVM build log group from bootstrapped state rather than re-deriving it.
+ * The image and the build-role IAM policy bake this name in at bootstrap, so if the derived
+ * name (`ctx.names.microvmLogGroup`) is renamed in code later, a deploy must still target
+ * the group the running stack actually logs to — otherwise the VM's logs land in (or are
+ * denied to) a different group and `pollBuild` waits on an empty one.
+ */
+export function microvmLogGroup(ctx) {
+    const recorded = ctx.state.resources['microvm-image']?.logGroup;
+    if (typeof recorded === 'string' && recorded)
+        return recorded;
+    const arn = ctx.state.resources['microvm-log-group']?.arn;
+    if (typeof arn === 'string') {
+        // arn:aws:logs:<region>:<acct>:log-group:<name>:*
+        const name = arn.split(':log-group:')[1]?.replace(/:\*$/, '');
+        if (name)
+            return name;
+    }
+    return ctx.names.microvmLogGroup;
+}
+/**
+ * Poll the CloudWatch build log group for the agent's output, streaming new lines and
+ * detecting the terminal marker (the source of truth). Each cycle also nudges the VM
+ * endpoint to keep the agent's event loop alive so the build triggers reliably.
+ * Exported for tests.
+ */
+export async function pollBuild(ctx, hash, startTime, endpoint, token) {
+    const seen = new Set();
+    // Anchored at VM launch (startTime), like the VM's own maximumDuration —
+    // anchoring at poll start would keep polling a VM that is already dead for
+    // however long the RUNNING-wait consumed. One grace minute for log delivery.
+    const deadline = startTime + ctx.config.microvm.maxDurationSeconds * 1000 + 60_000;
+    const { terminal } = ctx.ports;
+    let tick = 0;
+    try {
+        for (;;) {
+            terminal.status(`${spinnerFrame(tick++)} building ${hash} in MicroVM … ${formatDuration(Date.now() - startTime)}`);
+            await nudge(ctx, endpoint, token);
+            const events = await ctx.clients.logs
+                .filterEvents(microvmLogGroup(ctx), { startTime })
+                .catch(() => []);
+            events.sort((a, b) => a.timestamp - b.timestamp);
+            let result;
+            for (const e of events) {
+                if (seen.has(e.eventId))
+                    continue;
+                seen.add(e.eventId);
+                ctx.logger.info(`  ${e.message.trimEnd()}`);
+                // Hash-scoped structured markers so unrelated log lines (raw pnpm/astro output, or
+                // an orphaned VM from a different deploy) can't be mistaken for this build's result.
+                if (e.message.includes(`##build:done:${hash}`))
+                    result = { state: 'done' };
+                else if (e.message.includes(`##build:failed:${hash}`)) {
+                    result = {
+                        state: 'failed',
+                        message: e.message.split(`##build:failed:${hash}:`)[1]?.trim(),
+                    };
+                }
+            }
+            if (result)
+                return result;
+            // Log delivery can lag or drop (e.g. the VM logging to a group the deploy isn't tailing).
+            // The agent writes build/changed/<hash>.json as its final step, so treat that artifact as
+            // an authoritative completion signal too — a successful build then can't hang until the
+            // deadline just because its logs never reached CloudWatch. runBuild clears any stale copy
+            // before launch, so its presence means *this* build finished.
+            if (await ctx.clients.s3.objectExists(ctx.names.bucket, `build/changed/${hash}.json`)) {
+                return { state: 'done' };
+            }
+            if (Date.now() >= deadline)
+                return { state: 'failed', message: 'build timed out' };
+            await sleep(3000);
+        }
+    }
+    finally {
+        terminal.status('');
+    }
+}
+/**
+ * Run the builder MicroVM against a source zip already present at `sourceKey`, stream
+ * its logs, terminate it, and record a deployment manifest. Shared by deploy + rollback.
+ */
+export async function runBuild(ctx, opts) {
+    const sitePrefix = opts.sitePrefix ?? 'site/';
+    const seo = resolveSeo(ctx, opts.baseUrl);
+    const pendingKey = `build/pending/${opts.target ?? 'site'}.json`;
+    const imageArn = ctx.state.resources['microvm-image']?.arn;
+    const execRoleArn = ctx.state.resources['iam-exec-role']?.arn;
+    if (typeof imageArn !== 'string' || typeof execRoleArn !== 'string') {
+        throw new Error('infrastructure not bootstrapped (missing MicroVM image or exec role); run bootstrap first');
+    }
+    // Clear any stale completion manifest from a prior aborted build of this same hash, so its
+    // reappearance is an unambiguous "this build finished" signal for pollBuild's S3 fallback.
+    await ctx.clients.s3
+        .deleteObject(ctx.names.bucket, `build/changed/${opts.hash}.json`)
+        .catch(() => undefined);
+    const connectors = networkConnectors(ctx.config.region);
+    const startedAt = new Date();
+    ctx.logger.step(`running builder MicroVM for ${opts.hash}`);
+    // Launch first: if runMicrovm throws, no pending.json is left behind (a leaked job
+    // could otherwise be picked up during a later image bake and poison the snapshot).
+    // A MicroVM is ephemeral compute, so the client token is unique per launch — keying it
+    // on the hash would make a re-deploy (or workflow re-run) of the same source idempotently
+    // return the ALREADY-TERMINATED original VM instead of launching a fresh one. Generated
+    // once here so a network retry of this single call still dedupes.
+    const clientToken = `run-${opts.hash}-${randomUUID()}`;
+    const run = await ctx.clients.microvms.runMicrovm({
+        imageIdentifier: imageArn,
+        executionRoleArn: execRoleArn,
+        clientToken,
+        maximumDurationInSeconds: ctx.config.microvm.maxDurationSeconds,
+        idlePolicy: ctx.config.microvm.idle,
+        ingressNetworkConnectors: [connectors.allIngress],
+        egressNetworkConnectors: [connectors.internetEgress],
+        logGroupName: microvmLogGroup(ctx),
+    });
+    let result = { state: 'failed', message: 'did not start' };
+    try {
+        // The agent (booting ~30s) polls this for the job; write it now that the VM exists.
+        await ctx.clients.s3.putObject(ctx.names.bucket, pendingKey, JSON.stringify({
+            hash: opts.hash,
+            sourceKey: opts.sourceKey,
+            sitePrefix,
+            // Repo-relative build cwd and output dir (config paths.app/paths.dist);
+            // older agents ignore unknown fields and use their root/dist defaults.
+            appDir: ctx.config.paths.app,
+            distDir: ctx.config.paths.dist,
+            ...seo,
+        }), 'application/json');
+        // Confirm the MicroVM actually reached RUNNING (a FAILED launch must not fall through
+        // to the build poll, which would otherwise wait out the full maxDuration).
+        const ready = await pollUntil(() => ctx.clients.microvms.getMicrovm(run.microvmId), (vm) => Boolean(vm) && /RUNNING|FAILED|TERMINATED/i.test(vm?.state ?? ''), { intervalMs: 3000, timeoutMs: 300_000 });
+        if (!ready || !/RUNNING/i.test(ready.state)) {
+            throw new Error(`MicroVM did not reach RUNNING (state=${ready?.state ?? 'unknown'})`);
+        }
+        // Nudge the endpoint each cycle to keep the agent's event loop awake; the token must
+        // outlive the build window.
+        const endpoint = run.endpoint || ready.endpoint || '';
+        const tokenMinutes = Math.min(60, Math.ceil(ctx.config.microvm.maxDurationSeconds / 60) + 1);
+        const token = await ctx.clients.microvms
+            .createAuthToken(run.microvmId, tokenMinutes)
+            .catch(() => '');
+        result = await pollBuild(ctx, opts.hash, startedAt.getTime(), endpoint, token);
+    }
+    finally {
+        // The pending-job cleanup must survive a terminate failure: a leaked
+        // pending.json is the poison-the-next-image-bake hazard the launch
+        // ordering above exists to avoid. A failed terminate is only logged —
+        // the VM self-terminates at maxDuration, and the build outcome (already
+        // determined) must not be masked by a cleanup error.
+        await ctx.clients.microvms.terminateMicrovm(run.microvmId).catch((err) => {
+            ctx.logger.warn(`failed to terminate MicroVM ${run.microvmId} (it will expire on its own): ` +
+                (err instanceof Error ? err.message : String(err)));
+        });
+        // Clear the job so a future MicroVM does not re-run it.
+        await ctx.clients.s3.deleteObject(ctx.names.bucket, pendingKey).catch(() => undefined);
+    }
+    const finishedAt = new Date();
+    const manifest = {
+        hash: opts.hash,
+        sourceKey: opts.sourceKey,
+        status: result.state === 'done' ? 'succeeded' : 'failed',
+        startedAt: startedAt.toISOString(),
+        finishedAt: finishedAt.toISOString(),
+        durationMs: finishedAt.getTime() - startedAt.getTime(),
+        microvmId: run.microvmId,
+        ...(result.message ? { message: result.message } : {}),
+    };
+    await ctx.clients.s3.putObject(ctx.names.bucket, manifestKey(opts.hash), JSON.stringify(manifest, null, 2), 'application/json');
+    if (manifest.status === 'failed') {
+        throw new Error(`build failed for ${opts.hash}${manifest.message ? `: ${manifest.message}` : ''}`);
+    }
+    return manifest;
+}
+export async function invalidateCloudFront(ctx, paths = ['/*']) {
+    const id = ctx.state.resources['cloudfront-distribution']?.id;
+    if (typeof id !== 'string' || paths.length === 0)
+        return;
+    await ctx.clients.cloudfront.createInvalidation(id, paths, `inv-${Date.now()}`);
+    const shown = paths.length > 6
+        ? `${paths.slice(0, 6).join(', ')}, …(${paths.length} total)`
+        : paths.join(', ');
+    ctx.logger.ok(`CloudFront invalidation requested (${shown})`);
+}
+/**
+ * Invalidate only the URL paths that changed in this build (from the agent's manifest),
+ * so unchanged pages stay cached. Falls back to `/*` when the manifest is missing or the
+ * changed set is larger than the configured cap.
+ */
+export async function invalidateChanged(ctx, hash) {
+    const text = await ctx.clients.s3
+        .getObjectText(ctx.names.bucket, `build/changed/${hash}.json`)
+        .catch(() => undefined);
+    let paths;
+    if (text) {
+        try {
+            paths = JSON.parse(text).paths;
+        }
+        catch {
+            /* fall through to the /* fallback */
+        }
+    }
+    if (!paths) {
+        ctx.logger.warn('no changed-paths manifest — invalidating everything (/*)');
+        await invalidateCloudFront(ctx, ['/*']);
+        return { mode: 'all', count: 0 };
+    }
+    let summary;
+    if (paths.length === 0) {
+        ctx.logger.ok('no content changed — skipping CloudFront invalidation');
+        summary = { mode: 'none', count: 0 };
+    }
+    else if (paths.length > ctx.config.invalidationMaxPaths) {
+        ctx.logger.step(`${paths.length} paths changed (> cap) — invalidating everything (/*)`);
+        await invalidateCloudFront(ctx, ['/*']);
+        summary = { mode: 'all', count: paths.length };
+    }
+    else {
+        await invalidateCloudFront(ctx, paths);
+        summary = { mode: 'paths', count: paths.length };
+    }
+    await ctx.clients.s3
+        .deleteObject(ctx.names.bucket, `build/changed/${hash}.json`)
+        .catch(() => undefined);
+    return summary;
+}
+export { manifestKey };
+//# sourceMappingURL=deploy.js.map

package/dist/deploy.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"deploy.js","sourceRoot":"","sources":["../src/deploy.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,UAAU,EAAE,MAAM,aAAa,CAAC;AAEzC,OAAO,EAAE,iBAAiB,EAAE,SAAS,EAAE,KAAK,EAAiB,MAAM,iBAAiB,CAAC;AAGrF,OAAO,EAAE,cAAc,EAAE,YAAY,EAAE,MAAM,aAAa,CAAC;AAC3D,OAAO,EAAE,UAAU,EAAE,MAAM,UAAU,CAAC;AAmBtC,SAAS,WAAW,CAAC,IAAY;IAC/B,OAAO,mBAAmB,IAAI,OAAO,CAAC;AACxC,CAAC;AAED;;;;;;GAMG;AACH,KAAK,UAAU,KAAK,CAAC,GAAe,EAAE,QAAgB,EAAE,KAAa;IACnE,IAAI,CAAC,QAAQ,IAAI,CAAC,KAAK;QAAE,OAAO;IAChC,MAAM,GAAG,CAAC,KAAK,CAAC,IAAI,CAAC,QAAQ,EAAE,KAAK,CAAC,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,SAAS,CAAC,CAAC;AAC/D,CAAC;AAED;;;;;;GAMG;AACH,MAAM,UAAU,eAAe,CAAC,GAAe;IAC7C,MAAM,QAAQ,GAAG,GAAG,CAAC,KAAK,CAAC,SAAS,CAAC,eAAe,CAAC,EAAE,QAAQ,CAAC;IAChE,IAAI,OAAO,QAAQ,KAAK,QAAQ,IAAI,QAAQ;QAAE,OAAO,QAAQ,CAAC;IAC9D,MAAM,GAAG,GAAG,GAAG,CAAC,KAAK,CAAC,SAAS,CAAC,mBAAmB,CAAC,EAAE,GAAG,CAAC;IAC1D,IAAI,OAAO,GAAG,KAAK,QAAQ,EAAE,CAAC;QAC5B,kDAAkD;QAClD,MAAM,IAAI,GAAG,GAAG,CAAC,KAAK,CAAC,aAAa,CAAC,CAAC,CAAC,CAAC,EAAE,OAAO,CAAC,MAAM,EAAE,EAAE,CAAC,CAAC;QAC9D,IAAI,IAAI;YAAE,OAAO,IAAI,CAAC;IACxB,CAAC;IACD,OAAO,GAAG,CAAC,KAAK,CAAC,eAAe,CAAC;AACnC,CAAC;AAED;;;;;GAKG;AACH,MAAM,CAAC,KAAK,UAAU,SAAS,CAC7B,GAAe,EACf,IAAY,EACZ,SAAiB,EACjB,QAAgB,EAChB,KAAa;IAEb,MAAM,IAAI,GAAG,IAAI,GAAG,EAAU,CAAC;IAC/B,yEAAyE;IACzE,2EAA2E;IAC3E,6EAA6E;IAC7E,MAAM,QAAQ,GAAG,SAAS,GAAG,GAAG,CAAC,MAAM,CAAC,OAAO,CAAC,kBAAkB,GAAG,IAAI,GAAG,MAAM,CAAC;IACnF,MAAM,EAAE,QAAQ,EAAE,GAAG,GAAG,CAAC,KAAK,CAAC;IAC/B,IAAI,IAAI,GAAG,CAAC,CAAC;IAEb,IAAI,CAAC;QACH,SAAS,CAAC;YACR,QAAQ,CAAC,MAAM,CACb,GAAG,YAAY,CAAC,IAAI,EAAE,CAAC,aAAa,IAAI,iBAAiB,cAAc,CAAC,IAAI,CAAC,GAAG,EAAE,GAAG,SAAS,CAAC,EAAE,CAClG,CAAC;YACF,MAAM,KAAK,CAAC,GAAG,EAAE,QAAQ,EAAE,KAAK,CAAC,CAAC;YAClC,MAAM,MAAM,GAAG,MAAM,GAAG,CAAC,OAAO,CAAC,IAAI;iBAClC,YAAY,CAAC,eAAe,CAAC,GAAG,CAAC,EAAE,EAAE,SAAS,EAAE,CAAC;iBACjD,KAAK,CAAC,GAAG,EAAE,CAAC,EAAgB,CAAC,CAAC;YACjC,MAAM,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,SAAS,GAAG,CAAC,CAAC,SAAS,CAAC,CAAC;YAEjD,IAAI,MAA+B,CAAC;YACpC,KAAK,MAAM,CAAC,IAAI,MAAM,EAAE,CAAC;gBACvB,IAAI,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC,OAAO,CAAC;oBAAE,SAAS;gBAClC,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC;gBACpB,GAAG,CAAC,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,OAAO,CAAC,OAAO,EAAE,EAAE,CAAC,CAAC;gBAC5C,mFAAmF;gBACnF,qFAAqF;gBACrF,IAAI,CAAC,CAAC,OAAO,CAAC,QAAQ,CAAC,gBAAgB,IAAI,EAAE,CAAC;oBAAE,MAAM,GAAG,EAAE,KAAK,EAAE,MAAM,EAAE,CAAC;qBACtE,IAAI,CAAC,CAAC,OAAO,CAAC,QAAQ,CAAC,kBAAkB,IAAI,EAAE,CAAC,EAAE,CAAC;oBACtD,MAAM,GAAG;wBACP,KAAK,EAAE,QAAQ;wBACf,OAAO,EAAE,CAAC,CAAC,OAAO,CAAC,KAAK,CAAC,kBAAkB,IAAI,GAAG,CAAC,CAAC,CAAC,CAAC,EAAE,IAAI,EAAE;qBAC/D,CAAC;gBACJ,CAAC;YACH,CAAC;YACD,IAAI,MAAM;gBAAE,OAAO,MAAM,CAAC;YAC1B,0FAA0F;YAC1F,0FAA0F;YAC1F,wFAAwF;YACxF,0FAA0F;YAC1F,8DAA8D;YAC9D,IAAI,MAAM,GAAG,CAAC,OAAO,CAAC,EAAE,CAAC,YAAY,CAAC,GAAG,CAAC,KAAK,CAAC,MAAM,EAAE,iBAAiB,IAAI,OAAO,CAAC,EAAE,CAAC;gBACtF,OAAO,EAAE,KAAK,EAAE,MAAM,EAAE,CAAC;YAC3B,CAAC;YACD,IAAI,IAAI,CAAC,GAAG,EAAE,IAAI,QAAQ;gBAAE,OAAO,EAAE,KAAK,EAAE,QAAQ,EAAE,OAAO,EAAE,iBAAiB,EAAE,CAAC;YACnF,MAAM,KAAK,CAAC,IAAI,CAAC,CAAC;QACpB,CAAC;IACH,CAAC;YAAS,CAAC;QACT,QAAQ,CAAC,MAAM,CAAC,EAAE,CAAC,CAAC;IACtB,CAAC;AACH,CAAC;AAED;;;GAGG;AACH,MAAM,CAAC,KAAK,UAAU,QAAQ,CAC5B,GAAe,EACf,IAOC;IAED,MAAM,UAAU,GAAG,IAAI,CAAC,UAAU,IAAI,OAAO,CAAC;IAC9C,MAAM,GAAG,GAAG,UAAU,CAAC,GAAG,EAAE,IAAI,CAAC,OAAO,CAAC,CAAC;IAC1C,MAAM,UAAU,GAAG,iBAAiB,IAAI,CAAC,MAAM,IAAI,MAAM,OAAO,CAAC;IACjE,MAAM,QAAQ,GAAG,GAAG,CAAC,KAAK,CAAC,SAAS,CAAC,eAAe,CAAC,EAAE,GAAG,CAAC;IAC3D,MAAM,WAAW,GAAG,GAAG,CAAC,KAAK,CAAC,SAAS,CAAC,eAAe,CAAC,EAAE,GAAG,CAAC;IAC9D,IAAI,OAAO,QAAQ,KAAK,QAAQ,IAAI,OAAO,WAAW,KAAK,QAAQ,EAAE,CAAC;QACpE,MAAM,IAAI,KAAK,CACb,2FAA2F,CAC5F,CAAC;IACJ,CAAC;IAED,2FAA2F;IAC3F,2FAA2F;IAC3F,MAAM,GAAG,CAAC,OAAO,CAAC,EAAE;SACjB,YAAY,CAAC,GAAG,CAAC,KAAK,CAAC,MAAM,EAAE,iBAAiB,IAAI,CAAC,IAAI,OAAO,CAAC;SACjE,KAAK,CAAC,GAAG,EAAE,CAAC,SAAS,CAAC,CAAC;IAE1B,MAAM,UAAU,GAAG,iBAAiB,CAAC,GAAG,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC;IACxD,MAAM,SAAS,GAAG,IAAI,IAAI,EAAE,CAAC;IAC7B,GAAG,CAAC,MAAM,CAAC,IAAI,CAAC,+BAA+B,IAAI,CAAC,IAAI,EAAE,CAAC,CAAC;IAE5D,mFAAmF;IACnF,mFAAmF;IACnF,uFAAuF;IACvF,0FAA0F;IAC1F,wFAAwF;IACxF,kEAAkE;IAClE,MAAM,WAAW,GAAG,OAAO,IAAI,CAAC,IAAI,IAAI,UAAU,EAAE,EAAE,CAAC;IACvD,MAAM,GAAG,GAAG,MAAM,GAAG,CAAC,OAAO,CAAC,QAAQ,CAAC,UAAU,CAAC;QAChD,eAAe,EAAE,QAAQ;QACzB,gBAAgB,EAAE,WAAW;QAC7B,WAAW;QACX,wBAAwB,EAAE,GAAG,CAAC,MAAM,CAAC,OAAO,CAAC,kBAAkB;QAC/D,UAAU,EAAE,GAAG,CAAC,MAAM,CAAC,OAAO,CAAC,IAAI;QACnC,wBAAwB,EAAE,CAAC,UAAU,CAAC,UAAU,CAAC;QACjD,uBAAuB,EAAE,CAAC,UAAU,CAAC,cAAc,CAAC;QACpD,YAAY,EAAE,eAAe,CAAC,GAAG,CAAC;KACnC,CAAC,CAAC;IAEH,IAAI,MAAM,GAAgB,EAAE,KAAK,EAAE,QAAQ,EAAE,OAAO,EAAE,eAAe,EAAE,CAAC;IACxE,IAAI,CAAC;QACH,oFAAoF;QACpF,MAAM,GAAG,CAAC,OAAO,CAAC,EAAE,CAAC,SAAS,CAC5B,GAAG,CAAC,KAAK,CAAC,MAAM,EAChB,UAAU,EACV,IAAI,CAAC,SAAS,CAAC;YACb,IAAI,EAAE,IAAI,CAAC,IAAI;YACf,SAAS,EAAE,IAAI,CAAC,SAAS;YACzB,UAAU;YACV,wEAAwE;YACxE,uEAAuE;YACvE,MAAM,EAAE,GAAG,CAAC,MAAM,CAAC,KAAK,CAAC,GAAG;YAC5B,OAAO,EAAE,GAAG,CAAC,MAAM,CAAC,KAAK,CAAC,IAAI;YAC9B,GAAG,GAAG;SACP,CAAC,EACF,kBAAkB,CACnB,CAAC;QACF,sFAAsF;QACtF,2EAA2E;QAC3E,MAAM,KAAK,GAAG,MAAM,SAAS,CAC3B,GAAG,EAAE,CAAC,GAAG,CAAC,OAAO,CAAC,QAAQ,CAAC,UAAU,CAAC,GAAG,CAAC,SAAS,CAAC,EACpD,CAAC,EAAE,EAAE,EAAE,CAAC,OAAO,CAAC,EAAE,CAAC,IAAI,4BAA4B,CAAC,IAAI,CAAC,EAAE,EAAE,KAAK,IAAI,EAAE,CAAC,EACzE,EAAE,UAAU,EAAE,IAAI,EAAE,SAAS,EAAE,OAAO,EAAE,CACzC,CAAC;QACF,IAAI,CAAC,KAAK,IAAI,CAAC,UAAU,CAAC,IAAI,CAAC,KAAK,CAAC,KAAK,CAAC,EAAE,CAAC;YAC5C,MAAM,IAAI,KAAK,CAAC,wCAAwC,KAAK,EAAE,KAAK,IAAI,SAAS,GAAG,CAAC,CAAC;QACxF,CAAC;QACD,qFAAqF;QACrF,4BAA4B;QAC5B,MAAM,QAAQ,GAAG,GAAG,CAAC,QAAQ,IAAI,KAAK,CAAC,QAAQ,IAAI,EAAE,CAAC;QACtD,MAAM,YAAY,GAAG,IAAI,CAAC,GAAG,CAAC,EAAE,EAAE,IAAI,CAAC,IAAI,CAAC,GAAG,CAAC,MAAM,CAAC,OAAO,CAAC,kBAAkB,GAAG,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;QAC7F,MAAM,KAAK,GAAG,MAAM,GAAG,CAAC,OAAO,CAAC,QAAQ;aACrC,eAAe,CAAC,GAAG,CAAC,SAAS,EAAE,YAAY,CAAC;aAC5C,KAAK,CAAC,GAAG,EAAE,CAAC,EAAE,CAAC,CAAC;QACnB,MAAM,GAAG,MAAM,SAAS,CAAC,GAAG,EAAE,IAAI,CAAC,IAAI,EAAE,SAAS,CAAC,OAAO,EAAE,EAAE,QAAQ,EAAE,KAAK,CAAC,CAAC;IACjF,CAAC;YAAS,CAAC;QACT,qEAAqE;QACrE,mEAAmE;QACnE,sEAAsE;QACtE,wEAAwE;QACxE,qDAAqD;QACrD,MAAM,GAAG,CAAC,OAAO,CAAC,QAAQ,CAAC,gBAAgB,CAAC,GAAG,CAAC,SAAS,CAAC,CAAC,KAAK,CAAC,CAAC,GAAY,EAAE,EAAE;YAChF,GAAG,CAAC,MAAM,CAAC,IAAI,CACb,+BAA+B,GAAG,CAAC,SAAS,gCAAgC;gBAC1E,CAAC,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,CACrD,CAAC;QACJ,CAAC,CAAC,CAAC;QACH,wDAAwD;QACxD,MAAM,GAAG,CAAC,OAAO,CAAC,EAAE,CAAC,YAAY,CAAC,GAAG,CAAC,KAAK,CAAC,MAAM,EAAE,UAAU,CAAC,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,SAAS,CAAC,CAAC;IACzF,CAAC;IAED,MAAM,UAAU,GAAG,IAAI,IAAI,EAAE,CAAC;IAC9B,MAAM,QAAQ,GAAmB;QAC/B,IAAI,EAAE,IAAI,CAAC,IAAI;QACf,SAAS,EAAE,IAAI,CAAC,SAAS;QACzB,MAAM,EAAE,MAAM,CAAC,KAAK,KAAK,MAAM,CAAC,CAAC,CAAC,WAAW,CAAC,CAAC,CAAC,QAAQ;QACxD,SAAS,EAAE,SAAS,CAAC,WAAW,EAAE;QAClC,UAAU,EAAE,UAAU,CAAC,WAAW,EAAE;QACpC,UAAU,EAAE,UAAU,CAAC,OAAO,EAAE,GAAG,SAAS,CAAC,OAAO,EAAE;QACtD,SAAS,EAAE,GAAG,CAAC,SAAS;QACxB,GAAG,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC,CAAC,EAAE,OAAO,EAAE,MAAM,CAAC,OAAO,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;KACvD,CAAC;IACF,MAAM,GAAG,CAAC,OAAO,CAAC,EAAE,CAAC,SAAS,CAC5B,GAAG,CAAC,KAAK,CAAC,MAAM,EAChB,WAAW,CAAC,IAAI,CAAC,IAAI,CAAC,EACtB,IAAI,CAAC,SAAS,CAAC,QAAQ,EAAE,IAAI,EAAE,CAAC,CAAC,EACjC,kBAAkB,CACnB,CAAC;IAEF,IAAI,QAAQ,CAAC,MAAM,KAAK,QAAQ,EAAE,CAAC;QACjC,MAAM,IAAI,KAAK,CACb,oBAAoB,IAAI,CAAC,IAAI,GAAG,QAAQ,CAAC,OAAO,CAAC,CAAC,CAAC,KAAK,QAAQ,CAAC,OAAO,EAAE,CAAC,CAAC,CAAC,EAAE,EAAE,CAClF,CAAC;IACJ,CAAC;IACD,OAAO,QAAQ,CAAC;AAClB,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,oBAAoB,CAAC,GAAe,EAAE,KAAK,GAAG,CAAC,IAAI,CAAC;IACxE,MAAM,EAAE,GAAG,GAAG,CAAC,KAAK,CAAC,SAAS,CAAC,yBAAyB,CAAC,EAAE,EAAE,CAAC;IAC9D,IAAI,OAAO,EAAE,KAAK,QAAQ,IAAI,KAAK,CAAC,MAAM,KAAK,CAAC;QAAE,OAAO;IACzD,MAAM,GAAG,CAAC,OAAO,CAAC,UAAU,CAAC,kBAAkB,CAAC,EAAE,EAAE,KAAK,EAAE,OAAO,IAAI,CAAC,GAAG,EAAE,EAAE,CAAC,CAAC;IAChF,MAAM,KAAK,GACT,KAAK,CAAC,MAAM,GAAG,CAAC;QACd,CAAC,CAAC,GAAG,KAAK,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,OAAO,KAAK,CAAC,MAAM,SAAS;QAC7D,CAAC,CAAC,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;IACvB,GAAG,CAAC,MAAM,CAAC,EAAE,CAAC,sCAAsC,KAAK,GAAG,CAAC,CAAC;AAChE,CAAC;AAQD;;;;GAIG;AACH,MAAM,CAAC,KAAK,UAAU,iBAAiB,CACrC,GAAe,EACf,IAAY;IAEZ,MAAM,IAAI,GAAG,MAAM,GAAG,CAAC,OAAO,CAAC,EAAE;SAC9B,aAAa,CAAC,GAAG,CAAC,KAAK,CAAC,MAAM,EAAE,iBAAiB,IAAI,OAAO,CAAC;SAC7D,KAAK,CAAC,GAAG,EAAE,CAAC,SAAS,CAAC,CAAC;IAC1B,IAAI,KAA2B,CAAC;IAChC,IAAI,IAAI,EAAE,CAAC;QACT,IAAI,CAAC;YACH,KAAK,GAAI,IAAI,CAAC,KAAK,CAAC,IAAI,CAA0B,CAAC,KAAK,CAAC;QAC3D,CAAC;QAAC,MAAM,CAAC;YACP,qCAAqC;QACvC,CAAC;IACH,CAAC;IACD,IAAI,CAAC,KAAK,EAAE,CAAC;QACX,GAAG,CAAC,MAAM,CAAC,IAAI,CAAC,0DAA0D,CAAC,CAAC;QAC5E,MAAM,oBAAoB,CAAC,GAAG,EAAE,CAAC,IAAI,CAAC,CAAC,CAAC;QACxC,OAAO,EAAE,IAAI,EAAE,KAAK,EAAE,KAAK,EAAE,CAAC,EAAE,CAAC;IACnC,CAAC;IACD,IAAI,OAA4B,CAAC;IACjC,IAAI,KAAK,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QACvB,GAAG,CAAC,MAAM,CAAC,EAAE,CAAC,uDAAuD,CAAC,CAAC;QACvE,OAAO,GAAG,EAAE,IAAI,EAAE,MAAM,EAAE,KAAK,EAAE,CAAC,EAAE,CAAC;IACvC,CAAC;SAAM,IAAI,KAAK,CAAC,MAAM,GAAG,GAAG,CAAC,MAAM,CAAC,oBAAoB,EAAE,CAAC;QAC1D,GAAG,CAAC,MAAM,CAAC,IAAI,CAAC,GAAG,KAAK,CAAC,MAAM,uDAAuD,CAAC,CAAC;QACxF,MAAM,oBAAoB,CAAC,GAAG,EAAE,CAAC,IAAI,CAAC,CAAC,CAAC;QACxC,OAAO,GAAG,EAAE,IAAI,EAAE,KAAK,EAAE,KAAK,EAAE,KAAK,CAAC,MAAM,EAAE,CAAC;IACjD,CAAC;SAAM,CAAC;QACN,MAAM,oBAAoB,CAAC,GAAG,EAAE,KAAK,CAAC,CAAC;QACvC,OAAO,GAAG,EAAE,IAAI,EAAE,OAAO,EAAE,KAAK,EAAE,KAAK,CAAC,MAAM,EAAE,CAAC;IACnD,CAAC;IACD,MAAM,GAAG,CAAC,OAAO,CAAC,EAAE;SACjB,YAAY,CAAC,GAAG,CAAC,KAAK,CAAC,MAAM,EAAE,iBAAiB,IAAI,OAAO,CAAC;SAC5D,KAAK,CAAC,GAAG,EAAE,CAAC,SAAS,CAAC,CAAC;IAC1B,OAAO,OAAO,CAAC;AACjB,CAAC;AAED,OAAO,EAAE,WAAW,EAAE,CAAC"}

package/dist/graph.d.ts

@@ -0,0 +1,20 @@
+import type { OpsContext } from './context.js';
+/** A node in the infrastructure dependency graph. */
+export interface ResourceNode {
+    id: string;
+    dependsOn: string[];
+    /** Human label for logging. */
+    title: string;
+    /** Does the resource already exist? (Also hydrates outputs into ctx.state.) */
+    read(ctx: OpsContext): Promise<boolean>;
+    create(ctx: OpsContext): Promise<void>;
+    /** Reconcile an existing resource (optional). */
+    update?(ctx: OpsContext): Promise<void>;
+    delete(ctx: OpsContext): Promise<void>;
+}
+/** Topologically order nodes so dependencies come before dependents (Kahn's algorithm). */
+export declare function topoSort(nodes: ResourceNode[]): ResourceNode[];
+/** Reconcile the graph in dependency order (create missing, update existing). */
+export declare function applyGraph(nodes: ResourceNode[], ctx: OpsContext): Promise<void>;
+/** Tear down the graph in reverse dependency order. */
+export declare function destroyGraph(nodes: ResourceNode[], ctx: OpsContext): Promise<void>;

package/dist/graph.js

@@ -0,0 +1,73 @@
+/** Topologically order nodes so dependencies come before dependents (Kahn's algorithm). */
+export function topoSort(nodes) {
+    const byId = new Map(nodes.map((n) => [n.id, n]));
+    const indegree = new Map();
+    const dependents = new Map();
+    for (const node of nodes) {
+        indegree.set(node.id, 0);
+        dependents.set(node.id, []);
+    }
+    for (const node of nodes) {
+        for (const dep of node.dependsOn) {
+            if (!byId.has(dep))
+                throw new Error(`node "${node.id}" depends on unknown node "${dep}"`);
+            indegree.set(node.id, (indegree.get(node.id) ?? 0) + 1);
+            dependents.get(dep).push(node.id);
+        }
+    }
+    const queue = [...indegree.entries()]
+        .filter(([, d]) => d === 0)
+        .map(([id]) => id)
+        .sort();
+    const order = [];
+    while (queue.length > 0) {
+        const id = queue.shift();
+        order.push(byId.get(id));
+        for (const dependent of dependents.get(id)) {
+            const d = (indegree.get(dependent) ?? 0) - 1;
+            indegree.set(dependent, d);
+            if (d === 0) {
+                queue.push(dependent);
+                queue.sort();
+            }
+        }
+    }
+    if (order.length !== nodes.length)
+        throw new Error('dependency cycle detected in resource graph');
+    return order;
+}
+/** Reconcile the graph in dependency order (create missing, update existing). */
+export async function applyGraph(nodes, ctx) {
+    for (const node of topoSort(nodes)) {
+        const exists = await node.read(ctx);
+        if (exists) {
+            if (node.update) {
+                ctx.logger.step(`reconcile ${node.title}`);
+                await node.update(ctx);
+            }
+            else {
+                ctx.logger.ok(`${node.title} (exists)`);
+            }
+        }
+        else {
+            ctx.logger.step(`create ${node.title}`);
+            await node.create(ctx);
+            ctx.logger.ok(`created ${node.title}`);
+        }
+        await ctx.save();
+    }
+}
+/** Tear down the graph in reverse dependency order. */
+export async function destroyGraph(nodes, ctx) {
+    const order = topoSort(nodes).reverse();
+    for (const node of order) {
+        ctx.logger.step(`delete ${node.title}`);
+        await node.delete(ctx);
+        delete ctx.state.resources[node.id];
+        // The state lives in the bucket that is itself being deleted, so persisting it may
+        // fail (NoSuchBucket) once the bucket node is gone — never let that abort teardown.
+        await ctx.save().catch(() => undefined);
+        ctx.logger.ok(`deleted ${node.title}`);
+    }
+}
+//# sourceMappingURL=graph.js.map

package/dist/graph.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"graph.js","sourceRoot":"","sources":["../src/graph.ts"],"names":[],"mappings":"AAgBA,2FAA2F;AAC3F,MAAM,UAAU,QAAQ,CAAC,KAAqB;IAC5C,MAAM,IAAI,GAAG,IAAI,GAAG,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC;IAClD,MAAM,QAAQ,GAAG,IAAI,GAAG,EAAkB,CAAC;IAC3C,MAAM,UAAU,GAAG,IAAI,GAAG,EAAoB,CAAC;IAE/C,KAAK,MAAM,IAAI,IAAI,KAAK,EAAE,CAAC;QACzB,QAAQ,CAAC,GAAG,CAAC,IAAI,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC;QACzB,UAAU,CAAC,GAAG,CAAC,IAAI,CAAC,EAAE,EAAE,EAAE,CAAC,CAAC;IAC9B,CAAC;IACD,KAAK,MAAM,IAAI,IAAI,KAAK,EAAE,CAAC;QACzB,KAAK,MAAM,GAAG,IAAI,IAAI,CAAC,SAAS,EAAE,CAAC;YACjC,IAAI,CAAC,IAAI,CAAC,GAAG,CAAC,GAAG,CAAC;gBAAE,MAAM,IAAI,KAAK,CAAC,SAAS,IAAI,CAAC,EAAE,8BAA8B,GAAG,GAAG,CAAC,CAAC;YAC1F,QAAQ,CAAC,GAAG,CAAC,IAAI,CAAC,EAAE,EAAE,CAAC,QAAQ,CAAC,GAAG,CAAC,IAAI,CAAC,EAAE,CAAC,IAAI,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC;YACxD,UAAU,CAAC,GAAG,CAAC,GAAG,CAAE,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;QACrC,CAAC;IACH,CAAC;IAED,MAAM,KAAK,GAAG,CAAC,GAAG,QAAQ,CAAC,OAAO,EAAE,CAAC;SAClC,MAAM,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC;SAC1B,GAAG,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,EAAE,CAAC,EAAE,CAAC;SACjB,IAAI,EAAE,CAAC;IACV,MAAM,KAAK,GAAmB,EAAE,CAAC;IACjC,OAAO,KAAK,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;QACxB,MAAM,EAAE,GAAG,KAAK,CAAC,KAAK,EAAG,CAAC;QAC1B,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,GAAG,CAAC,EAAE,CAAE,CAAC,CAAC;QAC1B,KAAK,MAAM,SAAS,IAAI,UAAU,CAAC,GAAG,CAAC,EAAE,CAAE,EAAE,CAAC;YAC5C,MAAM,CAAC,GAAG,CAAC,QAAQ,CAAC,GAAG,CAAC,SAAS,CAAC,IAAI,CAAC,CAAC,GAAG,CAAC,CAAC;YAC7C,QAAQ,CAAC,GAAG,CAAC,SAAS,EAAE,CAAC,CAAC,CAAC;YAC3B,IAAI,CAAC,KAAK,CAAC,EAAE,CAAC;gBACZ,KAAK,CAAC,IAAI,CAAC,SAAS,CAAC,CAAC;gBACtB,KAAK,CAAC,IAAI,EAAE,CAAC;YACf,CAAC;QACH,CAAC;IACH,CAAC;IAED,IAAI,KAAK,CAAC,MAAM,KAAK,KAAK,CAAC,MAAM;QAAE,MAAM,IAAI,KAAK,CAAC,6CAA6C,CAAC,CAAC;IAClG,OAAO,KAAK,CAAC;AACf,CAAC;AAED,iFAAiF;AACjF,MAAM,CAAC,KAAK,UAAU,UAAU,CAAC,KAAqB,EAAE,GAAe;IACrE,KAAK,MAAM,IAAI,IAAI,QAAQ,CAAC,KAAK,CAAC,EAAE,CAAC;QACnC,MAAM,MAAM,GAAG,MAAM,IAAI,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;QACpC,IAAI,MAAM,EAAE,CAAC;YACX,IAAI,IAAI,CAAC,MAAM,EAAE,CAAC;gBAChB,GAAG,CAAC,MAAM,CAAC,IAAI,CAAC,aAAa,IAAI,CAAC,KAAK,EAAE,CAAC,CAAC;gBAC3C,MAAM,IAAI,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC;YACzB,CAAC;iBAAM,CAAC;gBACN,GAAG,CAAC,MAAM,CAAC,EAAE,CAAC,GAAG,IAAI,CAAC,KAAK,WAAW,CAAC,CAAC;YAC1C,CAAC;QACH,CAAC;aAAM,CAAC;YACN,GAAG,CAAC,MAAM,CAAC,IAAI,CAAC,UAAU,IAAI,CAAC,KAAK,EAAE,CAAC,CAAC;YACxC,MAAM,IAAI,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC;YACvB,GAAG,CAAC,MAAM,CAAC,EAAE,CAAC,WAAW,IAAI,CAAC,KAAK,EAAE,CAAC,CAAC;QACzC,CAAC;QACD,MAAM,GAAG,CAAC,IAAI,EAAE,CAAC;IACnB,CAAC;AACH,CAAC;AAED,uDAAuD;AACvD,MAAM,CAAC,KAAK,UAAU,YAAY,CAAC,KAAqB,EAAE,GAAe;IACvE,MAAM,KAAK,GAAG,QAAQ,CAAC,KAAK,CAAC,CAAC,OAAO,EAAE,CAAC;IACxC,KAAK,MAAM,IAAI,IAAI,KAAK,EAAE,CAAC;QACzB,GAAG,CAAC,MAAM,CAAC,IAAI,CAAC,UAAU,IAAI,CAAC,KAAK,EAAE,CAAC,CAAC;QACxC,MAAM,IAAI,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC;QACvB,OAAO,GAAG,CAAC,KAAK,CAAC,SAAS,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;QACpC,mFAAmF;QACnF,oFAAoF;QACpF,MAAM,GAAG,CAAC,IAAI,EAAE,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,SAAS,CAAC,CAAC;QACxC,GAAG,CAAC,MAAM,CAAC,EAAE,CAAC,WAAW,IAAI,CAAC,KAAK,EAAE,CAAC,CAAC;IACzC,CAAC;AACH,CAAC"}

package/dist/init.d.ts

@@ -0,0 +1,4 @@
+import { type FileSystem, type Terminal } from 'blogwright-core';
+import type { Logger } from './logger.js';
+/** Run the wizard. Returns a process exit code; never throws for expected refusals. */
+export declare function initSite(fs: FileSystem, terminal: Terminal, logger: Logger, root?: string): Promise<number>;

package/dist/init.js

@@ -0,0 +1,92 @@
+/*
+ * `blogwright init` — the first-run wizard. Asks the four questions a new site
+ * needs, writes a commented config/production.jsonc, and prints the path to a
+ * live site. Runs before any context exists (there is no config to load yet),
+ * so it takes its ports directly.
+ */
+import { colors, findRepoRoot } from 'blogwright-core';
+const SITE_NAME_PATTERN = /^[a-z0-9-]+$/;
+const GITHUB_REPO_PATTERN = /^[\w.-]+\/[\w.-]+$/;
+const MAX_ATTEMPTS = 3;
+async function ask(terminal, logger, q) {
+    for (let attempt = 0; attempt < MAX_ATTEMPTS; attempt++) {
+        const suffix = q.defaultValue ? ` [${q.defaultValue}]` : '';
+        const answer = (await terminal.question(`${q.prompt}${suffix}: `)).trim() || q.defaultValue;
+        if (!answer) {
+            if (!q.required)
+                return undefined;
+            logger.warn('a value is required');
+            continue;
+        }
+        const problem = q.validate?.(answer);
+        if (problem) {
+            logger.warn(problem);
+            continue;
+        }
+        return answer;
+    }
+    throw new Error(`no valid answer after ${MAX_ATTEMPTS} attempts — giving up`);
+}
+function renderConfig(opts) {
+    const entries = [
+        { prop: `"region": "${opts.region}"` },
+        {
+            prop: `"siteName": "${opts.siteName}"`,
+            comment: 'stable slug in every AWS resource name — never change it',
+        },
+    ];
+    if (opts.domain)
+        entries.push({ prop: `"domain": "${opts.domain}"` });
+    if (opts.githubRepo) {
+        entries.push({
+            prop: `"githubRepo": "${opts.githubRepo}"`,
+            comment: 'enables the GitHub OIDC deploy role',
+        });
+    }
+    const body = entries.map((e, i) => {
+        const comma = i < entries.length - 1 ? ',' : '';
+        return `  ${e.prop}${comma}${e.comment ? ` // ${e.comment}` : ''}`;
+    });
+    return ['// config/production.jsonc — created by `blogwright init`', '{', ...body, '}', ''].join('\n');
+}
+/** Run the wizard. Returns a process exit code; never throws for expected refusals. */
+export async function initSite(fs, terminal, logger, root) {
+    if (!terminal.isInteractive) {
+        logger.error('init is an interactive wizard; in CI or plain mode create config/production.jsonc ' +
+            'by hand instead (see README — only "region" and "siteName" are required)');
+        return 1;
+    }
+    const repoRoot = root ?? (await findRepoRoot(fs).catch(() => process.cwd()));
+    const configPath = `${repoRoot}/config/production.jsonc`;
+    if (await fs.exists(configPath)) {
+        logger.error(`${configPath} already exists — edit it directly, or pass --config elsewhere`);
+        return 1;
+    }
+    logger.info(colors.bold('Welcome to blogwright — four questions and you are live.'));
+    const siteName = await ask(terminal, logger, {
+        prompt: 'site name (lowercase slug, names every AWS resource)',
+        required: true,
+        validate: (v) => SITE_NAME_PATTERN.test(v) ? undefined : 'must be lowercase letters, digits, or dashes',
+    });
+    const region = await ask(terminal, logger, {
+        prompt: 'AWS region',
+        defaultValue: 'us-east-1',
+        required: true,
+    });
+    const domain = await ask(terminal, logger, {
+        prompt: 'custom domain (blank to use the CloudFront domain)',
+    });
+    const githubRepo = await ask(terminal, logger, {
+        prompt: 'GitHub repo for CI deploys, owner/repo (blank to skip)',
+        validate: (v) => (GITHUB_REPO_PATTERN.test(v) ? undefined : 'expected owner/repo'),
+    });
+    await fs.writeText(configPath, renderConfig({ region: region, siteName: siteName, domain, githubRepo }));
+    logger.ok(`wrote ${configPath}`);
+    logger.info('');
+    logger.info(colors.bold('Next steps:'));
+    logger.step(`blogwright bootstrap${domain ? '' : '   # add --domain later if you get one'}`);
+    logger.step('blogwright deploy');
+    logger.info(colors.dim('   (bootstrap prints ACM validation CNAMEs when a domain is set)'));
+    return 0;
+}
+//# sourceMappingURL=init.js.map

package/dist/init.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"init.js","sourceRoot":"","sources":["../src/init.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;AAEH,OAAO,EAAE,MAAM,EAAE,YAAY,EAAkC,MAAM,iBAAiB,CAAC;AAIvF,MAAM,iBAAiB,GAAG,cAAc,CAAC;AACzC,MAAM,mBAAmB,GAAG,oBAAoB,CAAC;AACjD,MAAM,YAAY,GAAG,CAAC,CAAC;AASvB,KAAK,UAAU,GAAG,CAAC,QAAkB,EAAE,MAAc,EAAE,CAAW;IAChE,KAAK,IAAI,OAAO,GAAG,CAAC,EAAE,OAAO,GAAG,YAAY,EAAE,OAAO,EAAE,EAAE,CAAC;QACxD,MAAM,MAAM,GAAG,CAAC,CAAC,YAAY,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,YAAY,GAAG,CAAC,CAAC,CAAC,EAAE,CAAC;QAC5D,MAAM,MAAM,GAAG,CAAC,MAAM,QAAQ,CAAC,QAAQ,CAAC,GAAG,CAAC,CAAC,MAAM,GAAG,MAAM,IAAI,CAAC,CAAC,CAAC,IAAI,EAAE,IAAI,CAAC,CAAC,YAAY,CAAC;QAC5F,IAAI,CAAC,MAAM,EAAE,CAAC;YACZ,IAAI,CAAC,CAAC,CAAC,QAAQ;gBAAE,OAAO,SAAS,CAAC;YAClC,MAAM,CAAC,IAAI,CAAC,qBAAqB,CAAC,CAAC;YACnC,SAAS;QACX,CAAC;QACD,MAAM,OAAO,GAAG,CAAC,CAAC,QAAQ,EAAE,CAAC,MAAM,CAAC,CAAC;QACrC,IAAI,OAAO,EAAE,CAAC;YACZ,MAAM,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC;YACrB,SAAS;QACX,CAAC;QACD,OAAO,MAAM,CAAC;IAChB,CAAC;IACD,MAAM,IAAI,KAAK,CAAC,yBAAyB,YAAY,uBAAuB,CAAC,CAAC;AAChF,CAAC;AAED,SAAS,YAAY,CAAC,IAKrB;IACC,MAAM,OAAO,GAA8C;QACzD,EAAE,IAAI,EAAE,cAAc,IAAI,CAAC,MAAM,GAAG,EAAE;QACtC;YACE,IAAI,EAAE,gBAAgB,IAAI,CAAC,QAAQ,GAAG;YACtC,OAAO,EAAE,0DAA0D;SACpE;KACF,CAAC;IACF,IAAI,IAAI,CAAC,MAAM;QAAE,OAAO,CAAC,IAAI,CAAC,EAAE,IAAI,EAAE,cAAc,IAAI,CAAC,MAAM,GAAG,EAAE,CAAC,CAAC;IACtE,IAAI,IAAI,CAAC,UAAU,EAAE,CAAC;QACpB,OAAO,CAAC,IAAI,CAAC;YACX,IAAI,EAAE,kBAAkB,IAAI,CAAC,UAAU,GAAG;YAC1C,OAAO,EAAE,qCAAqC;SAC/C,CAAC,CAAC;IACL,CAAC;IACD,MAAM,IAAI,GAAG,OAAO,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,EAAE;QAChC,MAAM,KAAK,GAAG,CAAC,GAAG,OAAO,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,CAAC;QAChD,OAAO,KAAK,CAAC,CAAC,IAAI,GAAG,KAAK,GAAG,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,OAAO,EAAE,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC;IACrE,CAAC,CAAC,CAAC;IACH,OAAO,CAAC,2DAA2D,EAAE,GAAG,EAAE,GAAG,IAAI,EAAE,GAAG,EAAE,EAAE,CAAC,CAAC,IAAI,CAC9F,IAAI,CACL,CAAC;AACJ,CAAC;AAED,uFAAuF;AACvF,MAAM,CAAC,KAAK,UAAU,QAAQ,CAC5B,EAAc,EACd,QAAkB,EAClB,MAAc,EACd,IAAa;IAEb,IAAI,CAAC,QAAQ,CAAC,aAAa,EAAE,CAAC;QAC5B,MAAM,CAAC,KAAK,CACV,oFAAoF;YAClF,0EAA0E,CAC7E,CAAC;QACF,OAAO,CAAC,CAAC;IACX,CAAC;IACD,MAAM,QAAQ,GAAG,IAAI,IAAI,CAAC,MAAM,YAAY,CAAC,EAAE,CAAC,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,OAAO,CAAC,GAAG,EAAE,CAAC,CAAC,CAAC;IAC7E,MAAM,UAAU,GAAG,GAAG,QAAQ,0BAA0B,CAAC;IACzD,IAAI,MAAM,EAAE,CAAC,MAAM,CAAC,UAAU,CAAC,EAAE,CAAC;QAChC,MAAM,CAAC,KAAK,CAAC,GAAG,UAAU,gEAAgE,CAAC,CAAC;QAC5F,OAAO,CAAC,CAAC;IACX,CAAC;IAED,MAAM,CAAC,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,0DAA0D,CAAC,CAAC,CAAC;IACrF,MAAM,QAAQ,GAAG,MAAM,GAAG,CAAC,QAAQ,EAAE,MAAM,EAAE;QAC3C,MAAM,EAAE,sDAAsD;QAC9D,QAAQ,EAAE,IAAI;QACd,QAAQ,EAAE,CAAC,CAAC,EAAE,EAAE,CACd,iBAAiB,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,8CAA8C;KACzF,CAAC,CAAC;IACH,MAAM,MAAM,GAAG,MAAM,GAAG,CAAC,QAAQ,EAAE,MAAM,EAAE;QACzC,MAAM,EAAE,YAAY;QACpB,YAAY,EAAE,WAAW;QACzB,QAAQ,EAAE,IAAI;KACf,CAAC,CAAC;IACH,MAAM,MAAM,GAAG,MAAM,GAAG,CAAC,QAAQ,EAAE,MAAM,EAAE;QACzC,MAAM,EAAE,oDAAoD;KAC7D,CAAC,CAAC;IACH,MAAM,UAAU,GAAG,MAAM,GAAG,CAAC,QAAQ,EAAE,MAAM,EAAE;QAC7C,MAAM,EAAE,wDAAwD;QAChE,QAAQ,EAAE,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,mBAAmB,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,qBAAqB,CAAC;KACnF,CAAC,CAAC;IAEH,MAAM,EAAE,CAAC,SAAS,CAAC,UAAU,EAAE,YAAY,CAAC,EAAE,MAAM,EAAE,MAAO,EAAE,QAAQ,EAAE,QAAS,EAAE,MAAM,EAAE,UAAU,EAAE,CAAC,CAAC,CAAC;IAC3G,MAAM,CAAC,EAAE,CAAC,SAAS,UAAU,EAAE,CAAC,CAAC;IACjC,MAAM,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;IAChB,MAAM,CAAC,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,aAAa,CAAC,CAAC,CAAC;IACxC,MAAM,CAAC,IAAI,CAAC,uBAAuB,MAAM,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,wCAAwC,EAAE,CAAC,CAAC;IAC7F,MAAM,CAAC,IAAI,CAAC,mBAAmB,CAAC,CAAC;IACjC,MAAM,CAAC,IAAI,CAAC,MAAM,CAAC,GAAG,CAAC,kEAAkE,CAAC,CAAC,CAAC;IAC5F,OAAO,CAAC,CAAC;AACX,CAAC"}

package/dist/logger.d.ts

@@ -0,0 +1,18 @@
+import { type Terminal } from 'blogwright-core';
+export interface Logger {
+    info(msg: string): void;
+    step(msg: string): void;
+    ok(msg: string): void;
+    warn(msg: string): void;
+    error(msg: string): void;
+}
+/** Build the leveled logger: info/step/ok to standard output, warn/error to standard error. */
+export declare function createLogger(terminal: Terminal): Logger;
+/**
+ * Ask a yes/no question on the terminal. Returns the default for a
+ * non-interactive session (CI or a piped invocation) so automation isn't left
+ * hanging on a prompt.
+ */
+export declare function confirm(terminal: Terminal, question: string, opts?: {
+    defaultYes?: boolean;
+}): Promise<boolean>;

package/dist/logger.js

@@ -0,0 +1,34 @@
+/*
+ * Leveled logger and confirm prompt over the Terminal port. Messages are
+ * composed with ANSI colour; the logger strips the codes for non-interactive
+ * sessions (piped output, CI) so they stay plain text.
+ */
+import { colors, stripColors } from 'blogwright-core';
+/** Build the leveled logger: info/step/ok to standard output, warn/error to standard error. */
+export function createLogger(terminal) {
+    const render = (msg) => (terminal.isInteractive ? msg : stripColors(msg));
+    return {
+        info: (msg) => terminal.write(render(msg)),
+        step: (msg) => terminal.write(render(`${colors.cyan('›')} ${msg}`)),
+        ok: (msg) => terminal.write(render(`${colors.green('✓')} ${msg}`)),
+        warn: (msg) => terminal.error(render(`${colors.yellow('!')} ${msg}`)),
+        error: (msg) => terminal.error(render(`${colors.red('✗')} ${msg}`)),
+    };
+}
+/**
+ * Ask a yes/no question on the terminal. Returns the default for a
+ * non-interactive session (CI or a piped invocation) so automation isn't left
+ * hanging on a prompt.
+ */
+export async function confirm(terminal, question, opts = {}) {
+    const defaultYes = opts.defaultYes ?? true;
+    if (!terminal.isInteractive)
+        return defaultYes;
+    const answer = (await terminal.question(`${question} [${defaultYes ? 'Y/n' : 'y/N'}] `))
+        .trim()
+        .toLowerCase();
+    if (answer === '')
+        return defaultYes;
+    return answer === 'y' || answer === 'yes';
+}
+//# sourceMappingURL=logger.js.map

package/dist/logger.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"logger.js","sourceRoot":"","sources":["../src/logger.ts"],"names":[],"mappings":"AAAA;;;;GAIG;AAEH,OAAO,EAAE,MAAM,EAAE,WAAW,EAAiB,MAAM,iBAAiB,CAAC;AAUrE,+FAA+F;AAC/F,MAAM,UAAU,YAAY,CAAC,QAAkB;IAC7C,MAAM,MAAM,GAAG,CAAC,GAAW,EAAE,EAAE,CAAC,CAAC,QAAQ,CAAC,aAAa,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,WAAW,CAAC,GAAG,CAAC,CAAC,CAAC;IAClF,OAAO;QACL,IAAI,EAAE,CAAC,GAAG,EAAE,EAAE,CAAC,QAAQ,CAAC,KAAK,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC;QAC1C,IAAI,EAAE,CAAC,GAAG,EAAE,EAAE,CAAC,QAAQ,CAAC,KAAK,CAAC,MAAM,CAAC,GAAG,MAAM,CAAC,IAAI,CAAC,GAAG,CAAC,IAAI,GAAG,EAAE,CAAC,CAAC;QACnE,EAAE,EAAE,CAAC,GAAG,EAAE,EAAE,CAAC,QAAQ,CAAC,KAAK,CAAC,MAAM,CAAC,GAAG,MAAM,CAAC,KAAK,CAAC,GAAG,CAAC,IAAI,GAAG,EAAE,CAAC,CAAC;QAClE,IAAI,EAAE,CAAC,GAAG,EAAE,EAAE,CAAC,QAAQ,CAAC,KAAK,CAAC,MAAM,CAAC,GAAG,MAAM,CAAC,MAAM,CAAC,GAAG,CAAC,IAAI,GAAG,EAAE,CAAC,CAAC;QACrE,KAAK,EAAE,CAAC,GAAG,EAAE,EAAE,CAAC,QAAQ,CAAC,KAAK,CAAC,MAAM,CAAC,GAAG,MAAM,CAAC,GAAG,CAAC,GAAG,CAAC,IAAI,GAAG,EAAE,CAAC,CAAC;KACpE,CAAC;AACJ,CAAC;AAED;;;;GAIG;AACH,MAAM,CAAC,KAAK,UAAU,OAAO,CAC3B,QAAkB,EAClB,QAAgB,EAChB,OAAiC,EAAE;IAEnC,MAAM,UAAU,GAAG,IAAI,CAAC,UAAU,IAAI,IAAI,CAAC;IAC3C,IAAI,CAAC,QAAQ,CAAC,aAAa;QAAE,OAAO,UAAU,CAAC;IAC/C,MAAM,MAAM,GAAG,CAAC,MAAM,QAAQ,CAAC,QAAQ,CAAC,GAAG,QAAQ,KAAK,UAAU,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,KAAK,IAAI,CAAC,CAAC;SACrF,IAAI,EAAE;SACN,WAAW,EAAE,CAAC;IACjB,IAAI,MAAM,KAAK,EAAE;QAAE,OAAO,UAAU,CAAC;IACrC,OAAO,MAAM,KAAK,GAAG,IAAI,MAAM,KAAK,KAAK,CAAC;AAC5C,CAAC"}

package/dist/microvms.d.ts

@@ -0,0 +1,15 @@
+import { type Microvm } from 'blogwright-core';
+import type { OpsContext } from './context.js';
+/**
+ * Active MicroVMs launched from *this* environment's builder image. Matches on the image
+ * ARN recorded in state, falling back to the (env-scoped) image name so a stack whose
+ * state predates the ARN still resolves — and a sibling env's VMs are never touched.
+ */
+export declare function runningStackMicrovms(ctx: OpsContext): Promise<Microvm[]>;
+/**
+ * Guard a destroy/teardown against running builder MicroVMs (deleting the image 400s while
+ * any are alive). Lists them, then interactively offers to terminate — default yes — or to
+ * wait, which cancels the destroy. Non-interactive callers get the default (terminate) so
+ * automation isn't blocked. Returns true to proceed with the destroy, false to abort.
+ */
+export declare function clearRunningMicrovms(ctx: OpsContext): Promise<boolean>;

package/dist/microvms.js

@@ -0,0 +1,56 @@
+import { colors, pollUntil } from 'blogwright-core';
+import { confirm } from './logger.js';
+/** A MicroVM keeps its image pinned until it fully terminates, so anything that isn't
+ *  already TERMINATED/TERMINATING still blocks deleting the builder image. */
+function isActive(vm) {
+    return !/TERMINATED|TERMINATING/i.test(vm.state);
+}
+/**
+ * Active MicroVMs launched from *this* environment's builder image. Matches on the image
+ * ARN recorded in state, falling back to the (env-scoped) image name so a stack whose
+ * state predates the ARN still resolves — and a sibling env's VMs are never touched.
+ */
+export async function runningStackMicrovms(ctx) {
+    const imageArn = ctx.state.resources['microvm-image']?.arn;
+    const imageName = ctx.names.microvmImage;
+    // Scope server-side by the builder image when we know its ARN; the client-side filter
+    // below is kept as a guard (and covers the name-only fallback when state has no ARN yet).
+    const all = await ctx.clients.microvms.listMicrovms(typeof imageArn === 'string' ? { imageIdentifier: imageArn } : {});
+    return all.filter((vm) => isActive(vm) &&
+        ((typeof imageArn === 'string' && vm.imageArn === imageArn) ||
+            (vm.imageArn?.includes(imageName) ?? false)));
+}
+/**
+ * Guard a destroy/teardown against running builder MicroVMs (deleting the image 400s while
+ * any are alive). Lists them, then interactively offers to terminate — default yes — or to
+ * wait, which cancels the destroy. Non-interactive callers get the default (terminate) so
+ * automation isn't blocked. Returns true to proceed with the destroy, false to abort.
+ */
+export async function clearRunningMicrovms(ctx) {
+    const running = await runningStackMicrovms(ctx);
+    if (running.length === 0)
+        return true;
+    ctx.logger.warn(colors.yellow(`${running.length} builder MicroVM(s) must be terminated before the image can be deleted:`));
+    for (const vm of running)
+        ctx.logger.info(`    ${vm.microvmId} (${vm.state})`);
+    const proceed = await confirm(ctx.ports.terminal, 'Terminate them and continue?', {
+        defaultYes: true,
+    });
+    if (!proceed) {
+        ctx.logger.info('Leaving MicroVMs running — destroy cancelled.');
+        return false;
+    }
+    for (const vm of running) {
+        ctx.logger.step(`terminating ${vm.microvmId}`);
+        await ctx.clients.microvms.terminateMicrovm(vm.microvmId);
+    }
+    // Wait for them to actually clear, so the image delete later in the graph doesn't 400.
+    ctx.logger.step('waiting for MicroVMs to terminate…');
+    const remaining = await pollUntil(() => runningStackMicrovms(ctx), (vms) => vms.length === 0, { intervalMs: 5000, timeoutMs: 180_000 });
+    if (remaining.length > 0) {
+        throw new Error(`${remaining.length} MicroVM(s) did not terminate in time; re-run destroy once they clear`);
+    }
+    ctx.logger.ok('MicroVMs terminated');
+    return true;
+}
+//# sourceMappingURL=microvms.js.map

package/dist/microvms.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"microvms.js","sourceRoot":"","sources":["../src/microvms.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,MAAM,EAAE,SAAS,EAAgB,MAAM,iBAAiB,CAAC;AAGlE,OAAO,EAAE,OAAO,EAAE,MAAM,aAAa,CAAC;AAEtC;8EAC8E;AAC9E,SAAS,QAAQ,CAAC,EAAW;IAC3B,OAAO,CAAC,yBAAyB,CAAC,IAAI,CAAC,EAAE,CAAC,KAAK,CAAC,CAAC;AACnD,CAAC;AAED;;;;GAIG;AACH,MAAM,CAAC,KAAK,UAAU,oBAAoB,CAAC,GAAe;IACxD,MAAM,QAAQ,GAAG,GAAG,CAAC,KAAK,CAAC,SAAS,CAAC,eAAe,CAAC,EAAE,GAAG,CAAC;IAC3D,MAAM,SAAS,GAAG,GAAG,CAAC,KAAK,CAAC,YAAY,CAAC;IACzC,sFAAsF;IACtF,0FAA0F;IAC1F,MAAM,GAAG,GAAG,MAAM,GAAG,CAAC,OAAO,CAAC,QAAQ,CAAC,YAAY,CACjD,OAAO,QAAQ,KAAK,QAAQ,CAAC,CAAC,CAAC,EAAE,eAAe,EAAE,QAAQ,EAAE,CAAC,CAAC,CAAC,EAAE,CAClE,CAAC;IACF,OAAO,GAAG,CAAC,MAAM,CACf,CAAC,EAAE,EAAE,EAAE,CACL,QAAQ,CAAC,EAAE,CAAC;QACZ,CAAC,CAAC,OAAO,QAAQ,KAAK,QAAQ,IAAI,EAAE,CAAC,QAAQ,KAAK,QAAQ,CAAC;YACzD,CAAC,EAAE,CAAC,QAAQ,EAAE,QAAQ,CAAC,SAAS,CAAC,IAAI,KAAK,CAAC,CAAC,CACjD,CAAC;AACJ,CAAC;AAED;;;;;GAKG;AACH,MAAM,CAAC,KAAK,UAAU,oBAAoB,CAAC,GAAe;IACxD,MAAM,OAAO,GAAG,MAAM,oBAAoB,CAAC,GAAG,CAAC,CAAC;IAChD,IAAI,OAAO,CAAC,MAAM,KAAK,CAAC;QAAE,OAAO,IAAI,CAAC;IAEtC,GAAG,CAAC,MAAM,CAAC,IAAI,CACb,MAAM,CAAC,MAAM,CACX,GAAG,OAAO,CAAC,MAAM,yEAAyE,CAC3F,CACF,CAAC;IACF,KAAK,MAAM,EAAE,IAAI,OAAO;QAAE,GAAG,CAAC,MAAM,CAAC,IAAI,CAAC,OAAO,EAAE,CAAC,SAAS,KAAK,EAAE,CAAC,KAAK,GAAG,CAAC,CAAC;IAE/E,MAAM,OAAO,GAAG,MAAM,OAAO,CAAC,GAAG,CAAC,KAAK,CAAC,QAAQ,EAAE,8BAA8B,EAAE;QAChF,UAAU,EAAE,IAAI;KACjB,CAAC,CAAC;IACH,IAAI,CAAC,OAAO,EAAE,CAAC;QACb,GAAG,CAAC,MAAM,CAAC,IAAI,CAAC,+CAA+C,CAAC,CAAC;QACjE,OAAO,KAAK,CAAC;IACf,CAAC;IAED,KAAK,MAAM,EAAE,IAAI,OAAO,EAAE,CAAC;QACzB,GAAG,CAAC,MAAM,CAAC,IAAI,CAAC,eAAe,EAAE,CAAC,SAAS,EAAE,CAAC,CAAC;QAC/C,MAAM,GAAG,CAAC,OAAO,CAAC,QAAQ,CAAC,gBAAgB,CAAC,EAAE,CAAC,SAAS,CAAC,CAAC;IAC5D,CAAC;IACD,uFAAuF;IACvF,GAAG,CAAC,MAAM,CAAC,IAAI,CAAC,oCAAoC,CAAC,CAAC;IACtD,MAAM,SAAS,GAAG,MAAM,SAAS,CAC/B,GAAG,EAAE,CAAC,oBAAoB,CAAC,GAAG,CAAC,EAC/B,CAAC,GAAG,EAAE,EAAE,CAAC,GAAG,CAAC,MAAM,KAAK,CAAC,EACzB,EAAE,UAAU,EAAE,IAAI,EAAE,SAAS,EAAE,OAAO,EAAE,CACzC,CAAC;IACF,IAAI,SAAS,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;QACzB,MAAM,IAAI,KAAK,CACb,GAAG,SAAS,CAAC,MAAM,uEAAuE,CAC3F,CAAC;IACJ,CAAC;IACD,GAAG,CAAC,MAAM,CAAC,EAAE,CAAC,qBAAqB,CAAC,CAAC;IACrC,OAAO,IAAI,CAAC;AACd,CAAC"}