blogwright 0.4.0-beta.2 → 0.4.0-beta.4

package/agent/agent-manifest.json

@@ -1,3 +1,3 @@
 {
-  "hash": "b8c4ae39e46a"
+  "hash": "0163ca230569"
 }

package/dist/commands.d.ts

@@ -3,7 +3,7 @@ import type { OpsContext } from './context.js';
 import { type GraphContext } from './graph.js';
 import { type StatusEntry } from './render.js';
 /** Create the full infrastructure graph. */
-export declare function bootstrap(ctx: OpsContext): Promise<void>;
+export declare function bootstrap(ctx: OpsContext, nodes?: ResourceNode<OpsContext>[]): Promise<void>;
 /**
  * Refuse to destroy the site while any plugin's own state object still
  * exists in the bucket - §State → Scoped state stores' "`blogwright
@@ -22,8 +22,8 @@ export declare function bootstrap(ctx: OpsContext): Promise<void>;
  *
  * Reads the bucket, not the plugin registry, so the refusal holds even for
  * a plugin that has since been uninstalled. Runs inside the teardown verbs
- * themselves, not `createContext` - so no other command pays for the extra
- * `listObjects` call and plugin discovery stays lazy - and ahead of
+ * themselves, not `createContext`, sharing the listing with the post-bootstrap
+ * warning while plugin discovery stays lazy - and ahead of
  * `clearRunningMicrovms`/`destroyGraph` in each, so a refusal has zero side
  * effects: nothing is terminated, nothing is deleted.
  *

package/dist/commands.js

@@ -49,14 +49,15 @@ function siteBaseUrl(ctx) {
     return typeof cf === 'string' ? `https://${cf}` : undefined;
 }
 /** Create the full infrastructure graph. */
-export async function bootstrap(ctx) {
+export async function bootstrap(ctx, nodes = buildNodes(ctx)) {
     ctx.logger.info(colors.bold(`Bootstrapping "${ctx.env}" (bucket ${ctx.names.bucket})`));
     // The state bucket must exist before anything else can persist state.
-    await applyGraph(buildNodes(ctx), ctx);
+    await applyGraph(nodes, ctx);
     ctx.logger.ok(`bootstrap complete for "${ctx.env}"`);
     const domain = ctx.state.resources['cloudfront-distribution']?.domainName;
     if (typeof domain === 'string')
         ctx.logger.info(`Site will be served at https://${domain}`);
+    await warnAboutScopedState(ctx);
 }
 /**
  * The prefix every state object - scoped or not - is filed under
@@ -85,6 +86,27 @@ function scopedStateScopes(env, objects) {
         .map((key) => key.slice(prefix.length, -'.json'.length));
     return [...new Set(scopes)].sort();
 }
+/** Listing is strict; each caller decides whether a failure can be recovered. */
+async function listScopedStateScopes(ctx) {
+    const objects = await ctx.clients.s3.listObjects(ctx.names.bucket, STATE_PREFIX);
+    return scopedStateScopes(ctx.env, objects);
+}
+/** A never-bootstrapped plugin has no scoped key, so cannot produce a warning. */
+async function warnAboutScopedState(ctx) {
+    let scopes;
+    try {
+        scopes = await listScopedStateScopes(ctx);
+    }
+    catch (err) {
+        ctx.logger.warn(`could not check plugin state for "${ctx.env}" at s3://${ctx.names.bucket}/${STATE_PREFIX} ` +
+            `(bootstrap succeeded): ${String(err)}`);
+        return;
+    }
+    for (const scope of scopes) {
+        ctx.logger.warn(`plugin state for "${scope}" still exists in "${ctx.env}"; ` +
+            `run \`blogwright ${scope} bootstrap ${ctx.env}\` to reconcile its resources`);
+    }
+}
 /**
  * Refuse to destroy the site while any plugin's own state object still
  * exists in the bucket - §State → Scoped state stores' "`blogwright
@@ -103,8 +125,8 @@ function scopedStateScopes(env, objects) {
  *
  * Reads the bucket, not the plugin registry, so the refusal holds even for
  * a plugin that has since been uninstalled. Runs inside the teardown verbs
- * themselves, not `createContext` - so no other command pays for the extra
- * `listObjects` call and plugin discovery stays lazy - and ahead of
+ * themselves, not `createContext`, sharing the listing with the post-bootstrap
+ * warning while plugin discovery stays lazy - and ahead of
  * `clearRunningMicrovms`/`destroyGraph` in each, so a refusal has zero side
  * effects: nothing is terminated, nothing is deleted.
  *
@@ -134,9 +156,9 @@ function scopedStateScopes(env, objects) {
  * `destroy()` run over the entire production graph.
  */
 export async function assertNoScopedState(ctx) {
-    let objects;
+    let scopes;
     try {
-        objects = await ctx.clients.s3.listObjects(ctx.names.bucket, STATE_PREFIX);
+        scopes = await listScopedStateScopes(ctx);
     }
     catch (err) {
         // No bucket, no state objects - see this function's doc comment. Matched
@@ -152,7 +174,6 @@ export async function assertNoScopedState(ctx) {
             return;
         throw err;
     }
-    const scopes = scopedStateScopes(ctx.env, objects);
     if (scopes.length === 0)
         return;
     // The remedy MUST name the environment. `runPlugin` resolves a plugin

package/dist/nodes.js

@@ -788,7 +788,13 @@ const GITHUB_OIDC_THUMBPRINT = '6938fd4d98bab03faadb97b34396831e3780aea1';
 /**
  * IAM role a GitHub Actions workflow assumes via OIDC - to deploy/destroy previews
  * (preview stack, any ref) or to deploy production (main branch only, plus CloudFront
- * invalidation and read access to the PDS credentials secret).
+ * invalidation).
+ *
+ * The role carries the site's own grants and nothing else. A plugin needing the deploy
+ * role to reach one of *its* resources attaches its own **named** inline policy to this
+ * same role from its own graph, reconciled by its own `<plugin> bootstrap` - so this
+ * document never names a plugin's resource, and `applyOidcRole` rewriting it wholesale
+ * on every `blogwright bootstrap` cannot disturb the plugin's.
  */
 function githubOidcRoleNode(preview) {
     const roleName = (ctx) => ctx.names.githubRole;
@@ -879,33 +885,6 @@ export function oidcRolePolicyStatements(ctx) {
             Action: ['cloudfront:CreateInvalidation'],
             Resource: String(output(ctx, 'cloudfront-distribution').arn),
         });
-        if (ctx.config.pds) {
-            // The post-deploy PDS sync reads the OAuth secret and writes it back:
-            // refresh tokens are single-use, so every sync persists the rotated
-            // session (PutSecretValue via the upsert helper, which tries CreateSecret
-            // first when the secret is missing).
-            //
-            // The `??` default duplicates the pds plugin's own `resolvePdsSecretName`
-            // deliberately, and must NOT be replaced by an import of it: this
-            // resource graph carries no plugin knowledge, which is the whole point of
-            // the plugin owning its own node (`packages/pds/src/nodes.ts`). Core
-            // stopped defaulting `pds.secretName`, so without this default the
-            // template literal would happily interpolate `undefined` into a live IAM
-            // policy - `applyOidcRole` rewrites this whole document on every
-            // `blogwright bootstrap`, so a wrong ARN here is a broken permission and
-            // not a test failure. Task 59 deletes this statement together with the
-            // `ctx.config.pds` branch around it; the duplication lives only until
-            // then.
-            statements.push({
-                Effect: 'Allow',
-                Action: [
-                    'secretsmanager:GetSecretValue',
-                    'secretsmanager:PutSecretValue',
-                    'secretsmanager:CreateSecret',
-                ],
-                Resource: `arn:aws:secretsmanager:${ctx.config.region}:${ctx.accountId}:secret:${ctx.config.pds.secretName ?? `${ctx.config.siteName}/atproto`}-*`,
-            });
-        }
     }
     return statements;
 }

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "blogwright",
-  "version": "0.4.0-beta.2",
+  "version": "0.4.0-beta.4",
   "type": "module",
   "bin": {
     "blogwright": "./dist/bin.js",
@@ -17,8 +17,8 @@
     }
   },
   "dependencies": {
-    "blogwright-core": "0.4.0-beta.2",
-    "blogwright-pds": "0.4.0-beta.2",
+    "blogwright-core": "0.4.0-beta.4",
+    "blogwright-pds": "0.4.0-beta.4",
     "fflate": "^0.8.3"
   },
   "devDependencies": {