quidproquo-cli 0.1.18 → 0.1.20

package/lib/commonjs/platforms/aws/setup/buildGithubDeployRoleStep.js

@@ -0,0 +1,55 @@
+"use strict";
+var __awaiter = (this && this.__awaiter) || function (thisArg, _arguments, P, generator) {
+    function adopt(value) { return value instanceof P ? value : new P(function (resolve) { resolve(value); }); }
+    return new (P || (P = Promise))(function (resolve, reject) {
+        function fulfilled(value) { try { step(generator.next(value)); } catch (e) { reject(e); } }
+        function rejected(value) { try { step(generator["throw"](value)); } catch (e) { reject(e); } }
+        function step(result) { result.done ? resolve(result.value) : adopt(result.value).then(fulfilled, rejected); }
+        step((generator = generator.apply(thisArg, _arguments || [])).next());
+    });
+};
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.buildGithubDeployRoleStep = void 0;
+const quidproquo_actionprocessor_awslambda_1 = require("quidproquo-actionprocessor-awslambda");
+const quidproquo_config_aws_1 = require("quidproquo-config-aws");
+const client_iam_1 = require("@aws-sdk/client-iam");
+// The role itself is deployed by the bootstrap stack; this step tells you whether the config
+// declares it, whether it exists yet, and what to put in the GitHub Environment once it does.
+const checkDeployRole = (ctx) => __awaiter(void 0, void 0, void 0, function* () {
+    var _a;
+    const config = quidproquo_config_aws_1.qpqConfigAwsUtils.getAwsGithubDeployRoleConfig(ctx.bootstrapQpqConfig);
+    if (!config) {
+        return { done: false, detail: 'not declared: add defineAwsGithubDeployRole("owner/repo", { ownerId, repositoryId }) to bootstrap.qpq.ts' };
+    }
+    const roleName = quidproquo_actionprocessor_awslambda_1.awsNamingUtils.getGithubDeployRoleNameFromConfig(ctx.bootstrapQpqConfig);
+    const githubEnvironment = (_a = config.githubEnvironment) !== null && _a !== void 0 ? _a : ctx.environment;
+    try {
+        const { Role } = yield new client_iam_1.IAMClient({ region: ctx.region }).send(new client_iam_1.GetRoleCommand({ RoleName: roleName }));
+        return {
+            done: true,
+            detail: `${Role === null || Role === void 0 ? void 0 : Role.Arn}; GitHub Environment '${githubEnvironment}' needs DEPLOY_ROLE_ARN=<that arn> and AWS_REGION=${ctx.region}`,
+        };
+    }
+    catch (error) {
+        if (error instanceof Error && error.name === 'NoSuchEntityException') {
+            return { done: false, detail: `${roleName} not deployed yet (the bootstrap stack creates it)` };
+        }
+        throw error;
+    }
+});
+/** Check-only: the GitHub Actions deploy role is declared and deployed, with the values the GitHub Environment needs. */
+const buildGithubDeployRoleStep = (ctx) => ({
+    id: 'github-deploy-role',
+    name: 'GitHub Actions deploy role',
+    check: () => checkDeployRole(ctx),
+    run: () => __awaiter(void 0, void 0, void 0, function* () {
+        var _a;
+        const result = yield checkDeployRole(ctx);
+        if (!result.done) {
+            throw new Error((_a = result.detail) !== null && _a !== void 0 ? _a : 'deploy role missing');
+        }
+        console.log(result.detail);
+    }),
+});
+exports.buildGithubDeployRoleStep = buildGithubDeployRoleStep;
+//# sourceMappingURL=buildGithubDeployRoleStep.js.map

package/lib/commonjs/platforms/aws/setup/buildGithubDeployRoleStep.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"buildGithubDeployRoleStep.js","sourceRoot":"","sources":["../../../../../src/platforms/aws/setup/buildGithubDeployRoleStep.ts"],"names":[],"mappings":";;;;;;;;;;;;AAAA,+FAAsE;AACtE,iEAA0D;AAE1D,oDAAgE;AAKhE,6FAA6F;AAC7F,8FAA8F;AAC9F,MAAM,eAAe,GAAG,CAAO,GAAoB,EAA6B,EAAE;;IAChF,MAAM,MAAM,GAAG,yCAAiB,CAAC,4BAA4B,CAAC,GAAG,CAAC,kBAAkB,CAAC,CAAC;IACtF,IAAI,CAAC,MAAM,EAAE,CAAC;QACZ,OAAO,EAAE,IAAI,EAAE,KAAK,EAAE,MAAM,EAAE,0GAA0G,EAAE,CAAC;IAC7I,CAAC;IAED,MAAM,QAAQ,GAAG,qDAAc,CAAC,iCAAiC,CAAC,GAAG,CAAC,kBAAkB,CAAC,CAAC;IAC1F,MAAM,iBAAiB,GAAG,MAAA,MAAM,CAAC,iBAAiB,mCAAI,GAAG,CAAC,WAAW,CAAC;IACtE,IAAI,CAAC;QACH,MAAM,EAAE,IAAI,EAAE,GAAG,MAAM,IAAI,sBAAS,CAAC,EAAE,MAAM,EAAE,GAAG,CAAC,MAAM,EAAE,CAAC,CAAC,IAAI,CAAC,IAAI,2BAAc,CAAC,EAAE,QAAQ,EAAE,QAAQ,EAAE,CAAC,CAAC,CAAC;QAC9G,OAAO;YACL,IAAI,EAAE,IAAI;YACV,MAAM,EAAE,GAAG,IAAI,aAAJ,IAAI,uBAAJ,IAAI,CAAE,GAAG,yBAAyB,iBAAiB,qDAAqD,GAAG,CAAC,MAAM,EAAE;SAChI,CAAC;IACJ,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,IAAI,KAAK,YAAY,KAAK,IAAI,KAAK,CAAC,IAAI,KAAK,uBAAuB,EAAE,CAAC;YACrE,OAAO,EAAE,IAAI,EAAE,KAAK,EAAE,MAAM,EAAE,GAAG,QAAQ,oDAAoD,EAAE,CAAC;QAClG,CAAC;QACD,MAAM,KAAK,CAAC;IACd,CAAC;AACH,CAAC,CAAA,CAAC;AAEF,yHAAyH;AAClH,MAAM,yBAAyB,GAAG,CAAC,GAAoB,EAAa,EAAE,CAAC,CAAC;IAC7E,EAAE,EAAE,oBAAoB;IACxB,IAAI,EAAE,4BAA4B;IAClC,KAAK,EAAE,GAAG,EAAE,CAAC,eAAe,CAAC,GAAG,CAAC;IACjC,GAAG,EAAE,GAAS,EAAE;;QACd,MAAM,MAAM,GAAG,MAAM,eAAe,CAAC,GAAG,CAAC,CAAC;QAC1C,IAAI,CAAC,MAAM,CAAC,IAAI,EAAE,CAAC;YACjB,MAAM,IAAI,KAAK,CAAC,MAAA,MAAM,CAAC,MAAM,mCAAI,qBAAqB,CAAC,CAAC;QAC1D,CAAC;QACD,OAAO,CAAC,GAAG,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC;IAC7B,CAAC,CAAA;CACF,CAAC,CAAC;AAXU,QAAA,yBAAyB,6BAWnC","sourcesContent":["import { awsNamingUtils } from 'quidproquo-actionprocessor-awslambda';\nimport { qpqConfigAwsUtils } from 'quidproquo-config-aws';\n\nimport { GetRoleCommand, IAMClient } from '@aws-sdk/client-iam';\n\nimport { SetupCheckResult, SetupStep } from '../../../lib/setupStep';\nimport { AwsSetupContext } from './awsSetupContext';\n\n// The role itself is deployed by the bootstrap stack; this step tells you whether the config\n// declares it, whether it exists yet, and what to put in the GitHub Environment once it does.\nconst checkDeployRole = async (ctx: AwsSetupContext): Promise<SetupCheckResult> => {\n  const config = qpqConfigAwsUtils.getAwsGithubDeployRoleConfig(ctx.bootstrapQpqConfig);\n  if (!config) {\n    return { done: false, detail: 'not declared: add defineAwsGithubDeployRole(\"owner/repo\", { ownerId, repositoryId }) to bootstrap.qpq.ts' };\n  }\n\n  const roleName = awsNamingUtils.getGithubDeployRoleNameFromConfig(ctx.bootstrapQpqConfig);\n  const githubEnvironment = config.githubEnvironment ?? ctx.environment;\n  try {\n    const { Role } = await new IAMClient({ region: ctx.region }).send(new GetRoleCommand({ RoleName: roleName }));\n    return {\n      done: true,\n      detail: `${Role?.Arn}; GitHub Environment '${githubEnvironment}' needs DEPLOY_ROLE_ARN=<that arn> and AWS_REGION=${ctx.region}`,\n    };\n  } catch (error) {\n    if (error instanceof Error && error.name === 'NoSuchEntityException') {\n      return { done: false, detail: `${roleName} not deployed yet (the bootstrap stack creates it)` };\n    }\n    throw error;\n  }\n};\n\n/** Check-only: the GitHub Actions deploy role is declared and deployed, with the values the GitHub Environment needs. */\nexport const buildGithubDeployRoleStep = (ctx: AwsSetupContext): SetupStep => ({\n  id: 'github-deploy-role',\n  name: 'GitHub Actions deploy role',\n  check: () => checkDeployRole(ctx),\n  run: async () => {\n    const result = await checkDeployRole(ctx);\n    if (!result.done) {\n      throw new Error(result.detail ?? 'deploy role missing');\n    }\n    console.log(result.detail);\n  },\n});\n"]}

package/lib/commonjs/platforms/aws/setup/buildGithubOidcProviderStep.d.ts

@@ -0,0 +1,4 @@
+import { SetupStep } from '../../../lib/setupStep';
+import { AwsSetupContext } from './awsSetupContext';
+/** Check-only: the account's GitHub Actions OIDC provider is declared in account.qpq.ts and deployed. */
+export declare const buildGithubOidcProviderStep: (ctx: AwsSetupContext) => SetupStep;

package/lib/commonjs/platforms/aws/setup/buildGithubOidcProviderStep.js

@@ -0,0 +1,54 @@
+"use strict";
+var __awaiter = (this && this.__awaiter) || function (thisArg, _arguments, P, generator) {
+    function adopt(value) { return value instanceof P ? value : new P(function (resolve) { resolve(value); }); }
+    return new (P || (P = Promise))(function (resolve, reject) {
+        function fulfilled(value) { try { step(generator.next(value)); } catch (e) { reject(e); } }
+        function rejected(value) { try { step(generator["throw"](value)); } catch (e) { reject(e); } }
+        function step(result) { result.done ? resolve(result.value) : adopt(result.value).then(fulfilled, rejected); }
+        step((generator = generator.apply(thisArg, _arguments || [])).next());
+    });
+};
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.buildGithubOidcProviderStep = void 0;
+const quidproquo_config_aws_1 = require("quidproquo-config-aws");
+const client_iam_1 = require("@aws-sdk/client-iam");
+// The provider is created by the account stack (defineAccountGithubOidcProvider in
+// account.qpq.ts), so this only reports: declared or not, present or not.
+const checkProvider = (ctx) => __awaiter(void 0, void 0, void 0, function* () {
+    const declared = quidproquo_config_aws_1.qpqConfigAwsUtils.isAccountGithubOidcProviderDeclared(ctx.accountQpqConfig);
+    const arn = quidproquo_config_aws_1.qpqConfigAwsUtils.getGithubOidcProviderArn(ctx.accountId);
+    let exists = false;
+    try {
+        yield new client_iam_1.IAMClient({ region: ctx.region }).send(new client_iam_1.GetOpenIDConnectProviderCommand({ OpenIDConnectProviderArn: arn }));
+        exists = true;
+    }
+    catch (error) {
+        if (!(error instanceof Error && error.name === 'NoSuchEntityException')) {
+            throw error;
+        }
+    }
+    if (!declared) {
+        return {
+            done: false,
+            detail: exists
+                ? `${arn} exists but account.qpq.ts does not declare it: add defineAccountGithubOidcProvider() and delete the hand-made provider before deploying the account stack`
+                : 'not declared: add defineAccountGithubOidcProvider() to account.qpq.ts (the account stack creates it)',
+        };
+    }
+    return exists ? { done: true, detail: arn } : { done: false, detail: 'declared, not deployed yet (the account stack creates it)' };
+});
+/** Check-only: the account's GitHub Actions OIDC provider is declared in account.qpq.ts and deployed. */
+const buildGithubOidcProviderStep = (ctx) => ({
+    id: 'github-oidc-provider',
+    name: 'GitHub Actions OIDC provider',
+    check: () => checkProvider(ctx),
+    run: () => __awaiter(void 0, void 0, void 0, function* () {
+        var _a;
+        const result = yield checkProvider(ctx);
+        if (!result.done) {
+            throw new Error((_a = result.detail) !== null && _a !== void 0 ? _a : 'provider missing');
+        }
+    }),
+});
+exports.buildGithubOidcProviderStep = buildGithubOidcProviderStep;
+//# sourceMappingURL=buildGithubOidcProviderStep.js.map

package/lib/commonjs/platforms/aws/setup/buildGithubOidcProviderStep.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"buildGithubOidcProviderStep.js","sourceRoot":"","sources":["../../../../../src/platforms/aws/setup/buildGithubOidcProviderStep.ts"],"names":[],"mappings":";;;;;;;;;;;;AAAA,iEAA0D;AAE1D,oDAAiF;AAKjF,mFAAmF;AACnF,0EAA0E;AAC1E,MAAM,aAAa,GAAG,CAAO,GAAoB,EAA6B,EAAE;IAC9E,MAAM,QAAQ,GAAG,yCAAiB,CAAC,mCAAmC,CAAC,GAAG,CAAC,gBAAgB,CAAC,CAAC;IAC7F,MAAM,GAAG,GAAG,yCAAiB,CAAC,wBAAwB,CAAC,GAAG,CAAC,SAAS,CAAC,CAAC;IAEtE,IAAI,MAAM,GAAG,KAAK,CAAC;IACnB,IAAI,CAAC;QACH,MAAM,IAAI,sBAAS,CAAC,EAAE,MAAM,EAAE,GAAG,CAAC,MAAM,EAAE,CAAC,CAAC,IAAI,CAAC,IAAI,4CAA+B,CAAC,EAAE,wBAAwB,EAAE,GAAG,EAAE,CAAC,CAAC,CAAC;QACzH,MAAM,GAAG,IAAI,CAAC;IAChB,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,IAAI,CAAC,CAAC,KAAK,YAAY,KAAK,IAAI,KAAK,CAAC,IAAI,KAAK,uBAAuB,CAAC,EAAE,CAAC;YACxE,MAAM,KAAK,CAAC;QACd,CAAC;IACH,CAAC;IAED,IAAI,CAAC,QAAQ,EAAE,CAAC;QACd,OAAO;YACL,IAAI,EAAE,KAAK;YACX,MAAM,EAAE,MAAM;gBACZ,CAAC,CAAC,GAAG,GAAG,4JAA4J;gBACpK,CAAC,CAAC,sGAAsG;SAC3G,CAAC;IACJ,CAAC;IAED,OAAO,MAAM,CAAC,CAAC,CAAC,EAAE,IAAI,EAAE,IAAI,EAAE,MAAM,EAAE,GAAG,EAAE,CAAC,CAAC,CAAC,EAAE,IAAI,EAAE,KAAK,EAAE,MAAM,EAAE,2DAA2D,EAAE,CAAC;AACrI,CAAC,CAAA,CAAC;AAEF,yGAAyG;AAClG,MAAM,2BAA2B,GAAG,CAAC,GAAoB,EAAa,EAAE,CAAC,CAAC;IAC/E,EAAE,EAAE,sBAAsB;IAC1B,IAAI,EAAE,8BAA8B;IACpC,KAAK,EAAE,GAAG,EAAE,CAAC,aAAa,CAAC,GAAG,CAAC;IAC/B,GAAG,EAAE,GAAS,EAAE;;QACd,MAAM,MAAM,GAAG,MAAM,aAAa,CAAC,GAAG,CAAC,CAAC;QACxC,IAAI,CAAC,MAAM,CAAC,IAAI,EAAE,CAAC;YACjB,MAAM,IAAI,KAAK,CAAC,MAAA,MAAM,CAAC,MAAM,mCAAI,kBAAkB,CAAC,CAAC;QACvD,CAAC;IACH,CAAC,CAAA;CACF,CAAC,CAAC;AAVU,QAAA,2BAA2B,+BAUrC","sourcesContent":["import { qpqConfigAwsUtils } from 'quidproquo-config-aws';\n\nimport { GetOpenIDConnectProviderCommand, IAMClient } from '@aws-sdk/client-iam';\n\nimport { SetupCheckResult, SetupStep } from '../../../lib/setupStep';\nimport { AwsSetupContext } from './awsSetupContext';\n\n// The provider is created by the account stack (defineAccountGithubOidcProvider in\n// account.qpq.ts), so this only reports: declared or not, present or not.\nconst checkProvider = async (ctx: AwsSetupContext): Promise<SetupCheckResult> => {\n  const declared = qpqConfigAwsUtils.isAccountGithubOidcProviderDeclared(ctx.accountQpqConfig);\n  const arn = qpqConfigAwsUtils.getGithubOidcProviderArn(ctx.accountId);\n\n  let exists = false;\n  try {\n    await new IAMClient({ region: ctx.region }).send(new GetOpenIDConnectProviderCommand({ OpenIDConnectProviderArn: arn }));\n    exists = true;\n  } catch (error) {\n    if (!(error instanceof Error && error.name === 'NoSuchEntityException')) {\n      throw error;\n    }\n  }\n\n  if (!declared) {\n    return {\n      done: false,\n      detail: exists\n        ? `${arn} exists but account.qpq.ts does not declare it: add defineAccountGithubOidcProvider() and delete the hand-made provider before deploying the account stack`\n        : 'not declared: add defineAccountGithubOidcProvider() to account.qpq.ts (the account stack creates it)',\n    };\n  }\n\n  return exists ? { done: true, detail: arn } : { done: false, detail: 'declared, not deployed yet (the account stack creates it)' };\n};\n\n/** Check-only: the account's GitHub Actions OIDC provider is declared in account.qpq.ts and deployed. */\nexport const buildGithubOidcProviderStep = (ctx: AwsSetupContext): SetupStep => ({\n  id: 'github-oidc-provider',\n  name: 'GitHub Actions OIDC provider',\n  check: () => checkProvider(ctx),\n  run: async () => {\n    const result = await checkProvider(ctx);\n    if (!result.done) {\n      throw new Error(result.detail ?? 'provider missing');\n    }\n  },\n});\n"]}

package/lib/commonjs/platforms/aws/setup/buildHostedZonesStep.d.ts

@@ -0,0 +1,4 @@
+import { SetupStep } from '../../../lib/setupStep';
+import { AwsSetupContext } from './awsSetupContext';
+/** Check-only: the Route53 zones the deploy will write records into exist in this account. */
+export declare const buildHostedZonesStep: (ctx: AwsSetupContext) => SetupStep;

package/lib/commonjs/platforms/aws/setup/buildHostedZonesStep.js

@@ -0,0 +1,63 @@
+"use strict";
+var __awaiter = (this && this.__awaiter) || function (thisArg, _arguments, P, generator) {
+    function adopt(value) { return value instanceof P ? value : new P(function (resolve) { resolve(value); }); }
+    return new (P || (P = Promise))(function (resolve, reject) {
+        function fulfilled(value) { try { step(generator.next(value)); } catch (e) { reject(e); } }
+        function rejected(value) { try { step(generator["throw"](value)); } catch (e) { reject(e); } }
+        function step(result) { result.done ? resolve(result.value) : adopt(result.value).then(fulfilled, rejected); }
+        step((generator = generator.apply(thisArg, _arguments || [])).next());
+    });
+};
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.buildHostedZonesStep = void 0;
+const quidproquo_deploy_awscdk_1 = require("quidproquo-deploy-awscdk");
+const quidproquo_webserver_1 = require("quidproquo-webserver");
+const client_route_53_1 = require("@aws-sdk/client-route-53");
+// The zones the environment writes records into: one per root, chosen the way the
+// CDK chooses them (each root's site root under the app's resolver, or the root).
+const getRequiredZones = (ctx) => {
+    const config = ctx.bootstrapQpqConfig;
+    return [
+        ...new Set(quidproquo_webserver_1.qpqWebServerUtils
+            .getRootDomains(config)
+            .map((rootDomain) => quidproquo_deploy_awscdk_1.qpqDeployAwsCdkUtils.resolveHostedZoneForHost(config, quidproquo_deploy_awscdk_1.qpqDeployAwsCdkUtils.resolveDeployHostForRoot(config, rootDomain, {})))),
+    ];
+};
+const zoneExists = (client, zoneName) => __awaiter(void 0, void 0, void 0, function* () {
+    const { HostedZones } = yield client.send(new client_route_53_1.ListHostedZonesByNameCommand({ DNSName: zoneName, MaxItems: 1 }));
+    return (HostedZones !== null && HostedZones !== void 0 ? HostedZones : []).some((zone) => { var _a; return zone.Name === `${zoneName}.` && !((_a = zone.Config) === null || _a === void 0 ? void 0 : _a.PrivateZone); });
+});
+const checkHostedZones = (ctx) => __awaiter(void 0, void 0, void 0, function* () {
+    const required = getRequiredZones(ctx);
+    if (required.length === 0) {
+        return { done: true, detail: 'no domains declared' };
+    }
+    const client = new client_route_53_1.Route53Client({ region: ctx.region });
+    const missing = [];
+    for (const zoneName of required) {
+        if (!(yield zoneExists(client, zoneName))) {
+            missing.push(zoneName);
+        }
+    }
+    return missing.length === 0
+        ? { done: true, detail: required.join(', ') }
+        : {
+            done: false,
+            detail: `missing ${missing.join(', ')}: create each as a public hosted zone here and delegate it (NS record) from its parent zone`,
+        };
+});
+/** Check-only: the Route53 zones the deploy will write records into exist in this account. */
+const buildHostedZonesStep = (ctx) => ({
+    id: 'hosted-zones',
+    name: 'Route53 hosted zones',
+    check: () => checkHostedZones(ctx),
+    run: () => __awaiter(void 0, void 0, void 0, function* () {
+        var _a;
+        const result = yield checkHostedZones(ctx);
+        if (!result.done) {
+            throw new Error((_a = result.detail) !== null && _a !== void 0 ? _a : 'hosted zones missing');
+        }
+    }),
+});
+exports.buildHostedZonesStep = buildHostedZonesStep;
+//# sourceMappingURL=buildHostedZonesStep.js.map

package/lib/commonjs/platforms/aws/setup/buildHostedZonesStep.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"buildHostedZonesStep.js","sourceRoot":"","sources":["../../../../../src/platforms/aws/setup/buildHostedZonesStep.ts"],"names":[],"mappings":";;;;;;;;;;;;AAAA,uEAAgE;AAChE,+DAAyD;AAEzD,8DAAuF;AAKvF,kFAAkF;AAClF,kFAAkF;AAClF,MAAM,gBAAgB,GAAG,CAAC,GAAoB,EAAY,EAAE;IAC1D,MAAM,MAAM,GAAG,GAAG,CAAC,kBAAkB,CAAC;IACtC,OAAO;QACL,GAAG,IAAI,GAAG,CACR,wCAAiB;aACd,cAAc,CAAC,MAAM,CAAC;aACtB,GAAG,CAAC,CAAC,UAAU,EAAE,EAAE,CAClB,+CAAoB,CAAC,wBAAwB,CAAC,MAAM,EAAE,+CAAoB,CAAC,wBAAwB,CAAC,MAAM,EAAE,UAAU,EAAE,EAAE,CAAC,CAAC,CAC7H,CACJ;KACF,CAAC;AACJ,CAAC,CAAC;AAEF,MAAM,UAAU,GAAG,CAAO,MAAqB,EAAE,QAAgB,EAAoB,EAAE;IACrF,MAAM,EAAE,WAAW,EAAE,GAAG,MAAM,MAAM,CAAC,IAAI,CAAC,IAAI,8CAA4B,CAAC,EAAE,OAAO,EAAE,QAAQ,EAAE,QAAQ,EAAE,CAAC,EAAE,CAAC,CAAC,CAAC;IAChH,OAAO,CAAC,WAAW,aAAX,WAAW,cAAX,WAAW,GAAI,EAAE,CAAC,CAAC,IAAI,CAAC,CAAC,IAAI,EAAE,EAAE,WAAC,OAAA,IAAI,CAAC,IAAI,KAAK,GAAG,QAAQ,GAAG,IAAI,CAAC,CAAA,MAAA,IAAI,CAAC,MAAM,0CAAE,WAAW,CAAA,CAAA,EAAA,CAAC,CAAC;AACvG,CAAC,CAAA,CAAC;AAEF,MAAM,gBAAgB,GAAG,CAAO,GAAoB,EAA6B,EAAE;IACjF,MAAM,QAAQ,GAAG,gBAAgB,CAAC,GAAG,CAAC,CAAC;IACvC,IAAI,QAAQ,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QAC1B,OAAO,EAAE,IAAI,EAAE,IAAI,EAAE,MAAM,EAAE,qBAAqB,EAAE,CAAC;IACvD,CAAC;IAED,MAAM,MAAM,GAAG,IAAI,+BAAa,CAAC,EAAE,MAAM,EAAE,GAAG,CAAC,MAAM,EAAE,CAAC,CAAC;IACzD,MAAM,OAAO,GAAa,EAAE,CAAC;IAC7B,KAAK,MAAM,QAAQ,IAAI,QAAQ,EAAE,CAAC;QAChC,IAAI,CAAC,CAAC,MAAM,UAAU,CAAC,MAAM,EAAE,QAAQ,CAAC,CAAC,EAAE,CAAC;YAC1C,OAAO,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC;QACzB,CAAC;IACH,CAAC;IAED,OAAO,OAAO,CAAC,MAAM,KAAK,CAAC;QACzB,CAAC,CAAC,EAAE,IAAI,EAAE,IAAI,EAAE,MAAM,EAAE,QAAQ,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE;QAC7C,CAAC,CAAC;YACE,IAAI,EAAE,KAAK;YACX,MAAM,EAAE,WAAW,OAAO,CAAC,IAAI,CAAC,IAAI,CAAC,6FAA6F;SACnI,CAAC;AACR,CAAC,CAAA,CAAC;AAEF,8FAA8F;AACvF,MAAM,oBAAoB,GAAG,CAAC,GAAoB,EAAa,EAAE,CAAC,CAAC;IACxE,EAAE,EAAE,cAAc;IAClB,IAAI,EAAE,sBAAsB;IAC5B,KAAK,EAAE,GAAG,EAAE,CAAC,gBAAgB,CAAC,GAAG,CAAC;IAClC,GAAG,EAAE,GAAS,EAAE;;QACd,MAAM,MAAM,GAAG,MAAM,gBAAgB,CAAC,GAAG,CAAC,CAAC;QAC3C,IAAI,CAAC,MAAM,CAAC,IAAI,EAAE,CAAC;YACjB,MAAM,IAAI,KAAK,CAAC,MAAA,MAAM,CAAC,MAAM,mCAAI,sBAAsB,CAAC,CAAC;QAC3D,CAAC;IACH,CAAC,CAAA;CACF,CAAC,CAAC;AAVU,QAAA,oBAAoB,wBAU9B","sourcesContent":["import { qpqDeployAwsCdkUtils } from 'quidproquo-deploy-awscdk';\nimport { qpqWebServerUtils } from 'quidproquo-webserver';\n\nimport { ListHostedZonesByNameCommand, Route53Client } from '@aws-sdk/client-route-53';\n\nimport { SetupCheckResult, SetupStep } from '../../../lib/setupStep';\nimport { AwsSetupContext } from './awsSetupContext';\n\n// The zones the environment writes records into: one per root, chosen the way the\n// CDK chooses them (each root's site root under the app's resolver, or the root).\nconst getRequiredZones = (ctx: AwsSetupContext): string[] => {\n  const config = ctx.bootstrapQpqConfig;\n  return [\n    ...new Set(\n      qpqWebServerUtils\n        .getRootDomains(config)\n        .map((rootDomain) =>\n          qpqDeployAwsCdkUtils.resolveHostedZoneForHost(config, qpqDeployAwsCdkUtils.resolveDeployHostForRoot(config, rootDomain, {})),\n        ),\n    ),\n  ];\n};\n\nconst zoneExists = async (client: Route53Client, zoneName: string): Promise<boolean> => {\n  const { HostedZones } = await client.send(new ListHostedZonesByNameCommand({ DNSName: zoneName, MaxItems: 1 }));\n  return (HostedZones ?? []).some((zone) => zone.Name === `${zoneName}.` && !zone.Config?.PrivateZone);\n};\n\nconst checkHostedZones = async (ctx: AwsSetupContext): Promise<SetupCheckResult> => {\n  const required = getRequiredZones(ctx);\n  if (required.length === 0) {\n    return { done: true, detail: 'no domains declared' };\n  }\n\n  const client = new Route53Client({ region: ctx.region });\n  const missing: string[] = [];\n  for (const zoneName of required) {\n    if (!(await zoneExists(client, zoneName))) {\n      missing.push(zoneName);\n    }\n  }\n\n  return missing.length === 0\n    ? { done: true, detail: required.join(', ') }\n    : {\n        done: false,\n        detail: `missing ${missing.join(', ')}: create each as a public hosted zone here and delegate it (NS record) from its parent zone`,\n      };\n};\n\n/** Check-only: the Route53 zones the deploy will write records into exist in this account. */\nexport const buildHostedZonesStep = (ctx: AwsSetupContext): SetupStep => ({\n  id: 'hosted-zones',\n  name: 'Route53 hosted zones',\n  check: () => checkHostedZones(ctx),\n  run: async () => {\n    const result = await checkHostedZones(ctx);\n    if (!result.done) {\n      throw new Error(result.detail ?? 'hosted zones missing');\n    }\n  },\n});\n"]}

package/lib/commonjs/platforms/aws/setup/buildIamCapabilityStep.d.ts

@@ -0,0 +1,4 @@
+import { SetupStep } from '../../../lib/setupStep';
+import { AwsSetupContext } from './awsSetupContext';
+/** Check-only: the credentials can manage IAM, which every CDK deploy needs. */
+export declare const buildIamCapabilityStep: (ctx: AwsSetupContext) => SetupStep;

package/lib/commonjs/platforms/aws/setup/buildIamCapabilityStep.js

@@ -0,0 +1,48 @@
+"use strict";
+var __awaiter = (this && this.__awaiter) || function (thisArg, _arguments, P, generator) {
+    function adopt(value) { return value instanceof P ? value : new P(function (resolve) { resolve(value); }); }
+    return new (P || (P = Promise))(function (resolve, reject) {
+        function fulfilled(value) { try { step(generator.next(value)); } catch (e) { reject(e); } }
+        function rejected(value) { try { step(generator["throw"](value)); } catch (e) { reject(e); } }
+        function step(result) { result.done ? resolve(result.value) : adopt(result.value).then(fulfilled, rejected); }
+        step((generator = generator.apply(thisArg, _arguments || [])).next());
+    });
+};
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.buildIamCapabilityStep = void 0;
+const client_iam_1 = require("@aws-sdk/client-iam");
+// CDK bootstrap and every deploy create IAM roles. PowerUserAccess fails on the
+// first iam:GetRole for a cdk-* role, so probe exactly that: a NoSuchEntity
+// answer means the permission is there, AccessDenied means it is not.
+const checkIamCapability = (ctx) => __awaiter(void 0, void 0, void 0, function* () {
+    const roleName = `cdk-hnb659fds-cfn-exec-role-${ctx.accountId}-${ctx.region}`;
+    try {
+        yield new client_iam_1.IAMClient({ region: ctx.region }).send(new client_iam_1.GetRoleCommand({ RoleName: roleName }));
+        return { done: true, detail: 'iam:GetRole allowed' };
+    }
+    catch (error) {
+        const name = error instanceof Error ? error.name : '';
+        if (name === 'NoSuchEntityException') {
+            return { done: true, detail: 'iam:GetRole allowed' };
+        }
+        return {
+            done: false,
+            detail: `iam:GetRole denied (${name}); the permission set needs IAM rights (AdministratorAccess or a custom set adding iam:*)`,
+        };
+    }
+});
+/** Check-only: the credentials can manage IAM, which every CDK deploy needs. */
+const buildIamCapabilityStep = (ctx) => ({
+    id: 'iam',
+    name: 'IAM rights on the credentials',
+    check: () => checkIamCapability(ctx),
+    run: () => __awaiter(void 0, void 0, void 0, function* () {
+        var _a;
+        const result = yield checkIamCapability(ctx);
+        if (!result.done) {
+            throw new Error((_a = result.detail) !== null && _a !== void 0 ? _a : 'IAM rights missing');
+        }
+    }),
+});
+exports.buildIamCapabilityStep = buildIamCapabilityStep;
+//# sourceMappingURL=buildIamCapabilityStep.js.map

package/lib/commonjs/platforms/aws/setup/buildIamCapabilityStep.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"buildIamCapabilityStep.js","sourceRoot":"","sources":["../../../../../src/platforms/aws/setup/buildIamCapabilityStep.ts"],"names":[],"mappings":";;;;;;;;;;;;AAAA,oDAAgE;AAKhE,gFAAgF;AAChF,4EAA4E;AAC5E,sEAAsE;AACtE,MAAM,kBAAkB,GAAG,CAAO,GAAoB,EAA6B,EAAE;IACnF,MAAM,QAAQ,GAAG,+BAA+B,GAAG,CAAC,SAAS,IAAI,GAAG,CAAC,MAAM,EAAE,CAAC;IAC9E,IAAI,CAAC;QACH,MAAM,IAAI,sBAAS,CAAC,EAAE,MAAM,EAAE,GAAG,CAAC,MAAM,EAAE,CAAC,CAAC,IAAI,CAAC,IAAI,2BAAc,CAAC,EAAE,QAAQ,EAAE,QAAQ,EAAE,CAAC,CAAC,CAAC;QAC7F,OAAO,EAAE,IAAI,EAAE,IAAI,EAAE,MAAM,EAAE,qBAAqB,EAAE,CAAC;IACvD,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,MAAM,IAAI,GAAG,KAAK,YAAY,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC;QACtD,IAAI,IAAI,KAAK,uBAAuB,EAAE,CAAC;YACrC,OAAO,EAAE,IAAI,EAAE,IAAI,EAAE,MAAM,EAAE,qBAAqB,EAAE,CAAC;QACvD,CAAC;QACD,OAAO;YACL,IAAI,EAAE,KAAK;YACX,MAAM,EAAE,uBAAuB,IAAI,2FAA2F;SAC/H,CAAC;IACJ,CAAC;AACH,CAAC,CAAA,CAAC;AAEF,gFAAgF;AACzE,MAAM,sBAAsB,GAAG,CAAC,GAAoB,EAAa,EAAE,CAAC,CAAC;IAC1E,EAAE,EAAE,KAAK;IACT,IAAI,EAAE,+BAA+B;IACrC,KAAK,EAAE,GAAG,EAAE,CAAC,kBAAkB,CAAC,GAAG,CAAC;IACpC,GAAG,EAAE,GAAS,EAAE;;QACd,MAAM,MAAM,GAAG,MAAM,kBAAkB,CAAC,GAAG,CAAC,CAAC;QAC7C,IAAI,CAAC,MAAM,CAAC,IAAI,EAAE,CAAC;YACjB,MAAM,IAAI,KAAK,CAAC,MAAA,MAAM,CAAC,MAAM,mCAAI,oBAAoB,CAAC,CAAC;QACzD,CAAC;IACH,CAAC,CAAA;CACF,CAAC,CAAC;AAVU,QAAA,sBAAsB,0BAUhC","sourcesContent":["import { GetRoleCommand, IAMClient } from '@aws-sdk/client-iam';\n\nimport { SetupCheckResult, SetupStep } from '../../../lib/setupStep';\nimport { AwsSetupContext } from './awsSetupContext';\n\n// CDK bootstrap and every deploy create IAM roles. PowerUserAccess fails on the\n// first iam:GetRole for a cdk-* role, so probe exactly that: a NoSuchEntity\n// answer means the permission is there, AccessDenied means it is not.\nconst checkIamCapability = async (ctx: AwsSetupContext): Promise<SetupCheckResult> => {\n  const roleName = `cdk-hnb659fds-cfn-exec-role-${ctx.accountId}-${ctx.region}`;\n  try {\n    await new IAMClient({ region: ctx.region }).send(new GetRoleCommand({ RoleName: roleName }));\n    return { done: true, detail: 'iam:GetRole allowed' };\n  } catch (error) {\n    const name = error instanceof Error ? error.name : '';\n    if (name === 'NoSuchEntityException') {\n      return { done: true, detail: 'iam:GetRole allowed' };\n    }\n    return {\n      done: false,\n      detail: `iam:GetRole denied (${name}); the permission set needs IAM rights (AdministratorAccess or a custom set adding iam:*)`,\n    };\n  }\n};\n\n/** Check-only: the credentials can manage IAM, which every CDK deploy needs. */\nexport const buildIamCapabilityStep = (ctx: AwsSetupContext): SetupStep => ({\n  id: 'iam',\n  name: 'IAM rights on the credentials',\n  check: () => checkIamCapability(ctx),\n  run: async () => {\n    const result = await checkIamCapability(ctx);\n    if (!result.done) {\n      throw new Error(result.detail ?? 'IAM rights missing');\n    }\n  },\n});\n"]}

package/lib/commonjs/platforms/aws/setup/buildIdentityStep.d.ts

@@ -0,0 +1,4 @@
+import { SetupStep } from '../../../lib/setupStep';
+import { AwsSetupContext } from './awsSetupContext';
+/** Check-only: the active credentials belong to the environment's account. Catches a stale .env or SSO profile. */
+export declare const buildIdentityStep: (ctx: AwsSetupContext) => SetupStep;

package/lib/commonjs/platforms/aws/setup/buildIdentityStep.js

@@ -0,0 +1,39 @@
+"use strict";
+var __awaiter = (this && this.__awaiter) || function (thisArg, _arguments, P, generator) {
+    function adopt(value) { return value instanceof P ? value : new P(function (resolve) { resolve(value); }); }
+    return new (P || (P = Promise))(function (resolve, reject) {
+        function fulfilled(value) { try { step(generator.next(value)); } catch (e) { reject(e); } }
+        function rejected(value) { try { step(generator["throw"](value)); } catch (e) { reject(e); } }
+        function step(result) { result.done ? resolve(result.value) : adopt(result.value).then(fulfilled, rejected); }
+        step((generator = generator.apply(thisArg, _arguments || [])).next());
+    });
+};
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.buildIdentityStep = void 0;
+const client_sts_1 = require("@aws-sdk/client-sts");
+const checkIdentity = (ctx) => __awaiter(void 0, void 0, void 0, function* () {
+    try {
+        const { Account, Arn } = yield new client_sts_1.STSClient({ region: ctx.region }).send(new client_sts_1.GetCallerIdentityCommand({}));
+        if (Account !== ctx.accountId) {
+            return { done: false, detail: `credentials are for account ${Account}, environment '${ctx.environment}' deploys to ${ctx.accountId}` };
+        }
+        return { done: true, detail: `${Arn}` };
+    }
+    catch (error) {
+        return { done: false, detail: `no valid credentials: ${error instanceof Error ? error.message : String(error)}` };
+    }
+});
+/** Check-only: the active credentials belong to the environment's account. Catches a stale .env or SSO profile. */
+const buildIdentityStep = (ctx) => ({
+    id: 'identity',
+    name: `Credentials for account ${ctx.accountId}`,
+    check: () => checkIdentity(ctx),
+    run: () => __awaiter(void 0, void 0, void 0, function* () {
+        const result = yield checkIdentity(ctx);
+        if (!result.done) {
+            throw new Error(`${result.detail}. Log in to the right account (or fix AWS_DEFAULT_ACCOUNT / deploy.config.json) and rerun.`);
+        }
+    }),
+});
+exports.buildIdentityStep = buildIdentityStep;
+//# sourceMappingURL=buildIdentityStep.js.map

package/lib/commonjs/platforms/aws/setup/buildIdentityStep.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"buildIdentityStep.js","sourceRoot":"","sources":["../../../../../src/platforms/aws/setup/buildIdentityStep.ts"],"names":[],"mappings":";;;;;;;;;;;;AAAA,oDAA0E;AAK1E,MAAM,aAAa,GAAG,CAAO,GAAoB,EAA6B,EAAE;IAC9E,IAAI,CAAC;QACH,MAAM,EAAE,OAAO,EAAE,GAAG,EAAE,GAAG,MAAM,IAAI,sBAAS,CAAC,EAAE,MAAM,EAAE,GAAG,CAAC,MAAM,EAAE,CAAC,CAAC,IAAI,CAAC,IAAI,qCAAwB,CAAC,EAAE,CAAC,CAAC,CAAC;QAC5G,IAAI,OAAO,KAAK,GAAG,CAAC,SAAS,EAAE,CAAC;YAC9B,OAAO,EAAE,IAAI,EAAE,KAAK,EAAE,MAAM,EAAE,+BAA+B,OAAO,kBAAkB,GAAG,CAAC,WAAW,gBAAgB,GAAG,CAAC,SAAS,EAAE,EAAE,CAAC;QACzI,CAAC;QACD,OAAO,EAAE,IAAI,EAAE,IAAI,EAAE,MAAM,EAAE,GAAG,GAAG,EAAE,EAAE,CAAC;IAC1C,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,OAAO,EAAE,IAAI,EAAE,KAAK,EAAE,MAAM,EAAE,yBAAyB,KAAK,YAAY,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,EAAE,EAAE,CAAC;IACpH,CAAC;AACH,CAAC,CAAA,CAAC;AAEF,mHAAmH;AAC5G,MAAM,iBAAiB,GAAG,CAAC,GAAoB,EAAa,EAAE,CAAC,CAAC;IACrE,EAAE,EAAE,UAAU;IACd,IAAI,EAAE,2BAA2B,GAAG,CAAC,SAAS,EAAE;IAChD,KAAK,EAAE,GAAG,EAAE,CAAC,aAAa,CAAC,GAAG,CAAC;IAC/B,GAAG,EAAE,GAAS,EAAE;QACd,MAAM,MAAM,GAAG,MAAM,aAAa,CAAC,GAAG,CAAC,CAAC;QACxC,IAAI,CAAC,MAAM,CAAC,IAAI,EAAE,CAAC;YACjB,MAAM,IAAI,KAAK,CAAC,GAAG,MAAM,CAAC,MAAM,4FAA4F,CAAC,CAAC;QAChI,CAAC;IACH,CAAC,CAAA;CACF,CAAC,CAAC;AAVU,QAAA,iBAAiB,qBAU3B","sourcesContent":["import { GetCallerIdentityCommand, STSClient } from '@aws-sdk/client-sts';\n\nimport { SetupCheckResult, SetupStep } from '../../../lib/setupStep';\nimport { AwsSetupContext } from './awsSetupContext';\n\nconst checkIdentity = async (ctx: AwsSetupContext): Promise<SetupCheckResult> => {\n  try {\n    const { Account, Arn } = await new STSClient({ region: ctx.region }).send(new GetCallerIdentityCommand({}));\n    if (Account !== ctx.accountId) {\n      return { done: false, detail: `credentials are for account ${Account}, environment '${ctx.environment}' deploys to ${ctx.accountId}` };\n    }\n    return { done: true, detail: `${Arn}` };\n  } catch (error) {\n    return { done: false, detail: `no valid credentials: ${error instanceof Error ? error.message : String(error)}` };\n  }\n};\n\n/** Check-only: the active credentials belong to the environment's account. Catches a stale .env or SSO profile. */\nexport const buildIdentityStep = (ctx: AwsSetupContext): SetupStep => ({\n  id: 'identity',\n  name: `Credentials for account ${ctx.accountId}`,\n  check: () => checkIdentity(ctx),\n  run: async () => {\n    const result = await checkIdentity(ctx);\n    if (!result.done) {\n      throw new Error(`${result.detail}. Log in to the right account (or fix AWS_DEFAULT_ACCOUNT / deploy.config.json) and rerun.`);\n    }\n  },\n});\n"]}

package/lib/commonjs/platforms/aws/setup/buildStackSteps.d.ts

@@ -0,0 +1,5 @@
+import { SetupStep } from '../../../lib/setupStep';
+import { AwsSetupContext } from './awsSetupContext';
+export declare const buildAccountStackStep: (ctx: AwsSetupContext) => SetupStep;
+export declare const buildDomainStackStep: (ctx: AwsSetupContext) => SetupStep;
+export declare const buildBootstrapStackStep: (ctx: AwsSetupContext) => SetupStep;

package/lib/commonjs/platforms/aws/setup/buildStackSteps.js

@@ -0,0 +1,32 @@
+"use strict";
+var __awaiter = (this && this.__awaiter) || function (thisArg, _arguments, P, generator) {
+    function adopt(value) { return value instanceof P ? value : new P(function (resolve) { resolve(value); }); }
+    return new (P || (P = Promise))(function (resolve, reject) {
+        function fulfilled(value) { try { step(generator.next(value)); } catch (e) { reject(e); } }
+        function rejected(value) { try { step(generator["throw"](value)); } catch (e) { reject(e); } }
+        function step(result) { result.done ? resolve(result.value) : adopt(result.value).then(fulfilled, rejected); }
+        step((generator = generator.apply(thisArg, _arguments || [])).next());
+    });
+};
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.buildBootstrapStackStep = exports.buildDomainStackStep = exports.buildAccountStackStep = void 0;
+const quidproquo_deploy_awscdk_1 = require("quidproquo-deploy-awscdk");
+const stacks_1 = require("../stacks");
+const describeStackStatus_1 = require("./describeStackStatus");
+const buildStackStep = (id, name, stackName, region, run) => ({
+    id,
+    name: `${name} (${stackName})`,
+    check: () => __awaiter(void 0, void 0, void 0, function* () {
+        const status = yield (0, describeStackStatus_1.describeStackStatus)(stackName, region);
+        return status === null ? { done: false, detail: 'not deployed' } : { done: (0, describeStackStatus_1.isStackHealthy)(status), detail: status };
+    }),
+    run,
+});
+const buildAccountStackStep = (ctx) => buildStackStep('account-stack', 'Account guardrails stack', quidproquo_deploy_awscdk_1.qpqDeployAwsCdkUtils.getAccountStackName(), ctx.region, () => (0, stacks_1.deployAccountStack)(ctx.appName));
+exports.buildAccountStackStep = buildAccountStackStep;
+// The domain stack deploys its cert stacks as dependencies, so one step covers certificates too.
+const buildDomainStackStep = (ctx) => buildStackStep('domain-stack', 'Domain stack: certificates + api domains', quidproquo_deploy_awscdk_1.qpqDeployAwsCdkUtils.getDomainStackName(ctx.bootstrapQpqConfig), ctx.region, () => (0, stacks_1.deployDomainStack)(ctx.appName));
+exports.buildDomainStackStep = buildDomainStackStep;
+const buildBootstrapStackStep = (ctx) => buildStackStep('bootstrap-stack', 'Bootstrap stack: WAF and app-wide resources', quidproquo_deploy_awscdk_1.qpqDeployAwsCdkUtils.getBootstrapStackName(ctx.bootstrapQpqConfig), ctx.region, () => (0, stacks_1.deployBootstrapStack)(ctx.appName));
+exports.buildBootstrapStackStep = buildBootstrapStackStep;
+//# sourceMappingURL=buildStackSteps.js.map

package/lib/commonjs/platforms/aws/setup/buildStackSteps.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"buildStackSteps.js","sourceRoot":"","sources":["../../../../../src/platforms/aws/setup/buildStackSteps.ts"],"names":[],"mappings":";;;;;;;;;;;;AAAA,uEAAgE;AAGhE,sCAAwF;AAExF,+DAA4E;AAE5E,MAAM,cAAc,GAAG,CAAC,EAAU,EAAE,IAAY,EAAE,SAAiB,EAAE,MAAc,EAAE,GAAwB,EAAa,EAAE,CAAC,CAAC;IAC5H,EAAE;IACF,IAAI,EAAE,GAAG,IAAI,KAAK,SAAS,GAAG;IAC9B,KAAK,EAAE,GAAS,EAAE;QAChB,MAAM,MAAM,GAAG,MAAM,IAAA,yCAAmB,EAAC,SAAS,EAAE,MAAM,CAAC,CAAC;QAC5D,OAAO,MAAM,KAAK,IAAI,CAAC,CAAC,CAAC,EAAE,IAAI,EAAE,KAAK,EAAE,MAAM,EAAE,cAAc,EAAE,CAAC,CAAC,CAAC,EAAE,IAAI,EAAE,IAAA,oCAAc,EAAC,MAAM,CAAC,EAAE,MAAM,EAAE,MAAM,EAAE,CAAC;IACtH,CAAC,CAAA;IACD,GAAG;CACJ,CAAC,CAAC;AAEI,MAAM,qBAAqB,GAAG,CAAC,GAAoB,EAAa,EAAE,CACvE,cAAc,CAAC,eAAe,EAAE,0BAA0B,EAAE,+CAAoB,CAAC,mBAAmB,EAAE,EAAE,GAAG,CAAC,MAAM,EAAE,GAAG,EAAE,CACvH,IAAA,2BAAkB,EAAC,GAAG,CAAC,OAAO,CAAC,CAChC,CAAC;AAHS,QAAA,qBAAqB,yBAG9B;AAEJ,iGAAiG;AAC1F,MAAM,oBAAoB,GAAG,CAAC,GAAoB,EAAa,EAAE,CACtE,cAAc,CACZ,cAAc,EACd,0CAA0C,EAC1C,+CAAoB,CAAC,kBAAkB,CAAC,GAAG,CAAC,kBAAkB,CAAC,EAC/D,GAAG,CAAC,MAAM,EACV,GAAG,EAAE,CAAC,IAAA,0BAAiB,EAAC,GAAG,CAAC,OAAO,CAAC,CACrC,CAAC;AAPS,QAAA,oBAAoB,wBAO7B;AAEG,MAAM,uBAAuB,GAAG,CAAC,GAAoB,EAAa,EAAE,CACzE,cAAc,CACZ,iBAAiB,EACjB,6CAA6C,EAC7C,+CAAoB,CAAC,qBAAqB,CAAC,GAAG,CAAC,kBAAkB,CAAC,EAClE,GAAG,CAAC,MAAM,EACV,GAAG,EAAE,CAAC,IAAA,6BAAoB,EAAC,GAAG,CAAC,OAAO,CAAC,CACxC,CAAC;AAPS,QAAA,uBAAuB,2BAOhC","sourcesContent":["import { qpqDeployAwsCdkUtils } from 'quidproquo-deploy-awscdk';\n\nimport { SetupStep } from '../../../lib/setupStep';\nimport { deployAccountStack, deployBootstrapStack, deployDomainStack } from '../stacks';\nimport { AwsSetupContext } from './awsSetupContext';\nimport { describeStackStatus, isStackHealthy } from './describeStackStatus';\n\nconst buildStackStep = (id: string, name: string, stackName: string, region: string, run: () => Promise<void>): SetupStep => ({\n  id,\n  name: `${name} (${stackName})`,\n  check: async () => {\n    const status = await describeStackStatus(stackName, region);\n    return status === null ? { done: false, detail: 'not deployed' } : { done: isStackHealthy(status), detail: status };\n  },\n  run,\n});\n\nexport const buildAccountStackStep = (ctx: AwsSetupContext): SetupStep =>\n  buildStackStep('account-stack', 'Account guardrails stack', qpqDeployAwsCdkUtils.getAccountStackName(), ctx.region, () =>\n    deployAccountStack(ctx.appName),\n  );\n\n// The domain stack deploys its cert stacks as dependencies, so one step covers certificates too.\nexport const buildDomainStackStep = (ctx: AwsSetupContext): SetupStep =>\n  buildStackStep(\n    'domain-stack',\n    'Domain stack: certificates + api domains',\n    qpqDeployAwsCdkUtils.getDomainStackName(ctx.bootstrapQpqConfig),\n    ctx.region,\n    () => deployDomainStack(ctx.appName),\n  );\n\nexport const buildBootstrapStackStep = (ctx: AwsSetupContext): SetupStep =>\n  buildStackStep(\n    'bootstrap-stack',\n    'Bootstrap stack: WAF and app-wide resources',\n    qpqDeployAwsCdkUtils.getBootstrapStackName(ctx.bootstrapQpqConfig),\n    ctx.region,\n    () => deployBootstrapStack(ctx.appName),\n  );\n"]}

package/lib/commonjs/platforms/aws/setup/describeStackStatus.d.ts

@@ -0,0 +1,4 @@
+import { Nullable } from 'quidproquo-core';
+/** A stack's status, or null when it does not exist. */
+export declare const describeStackStatus: (stackName: string, region: string) => Promise<Nullable<string>>;
+export declare const isStackHealthy: (status: Nullable<string>) => boolean;

package/lib/commonjs/platforms/aws/setup/describeStackStatus.js

@@ -0,0 +1,32 @@
+"use strict";
+var __awaiter = (this && this.__awaiter) || function (thisArg, _arguments, P, generator) {
+    function adopt(value) { return value instanceof P ? value : new P(function (resolve) { resolve(value); }); }
+    return new (P || (P = Promise))(function (resolve, reject) {
+        function fulfilled(value) { try { step(generator.next(value)); } catch (e) { reject(e); } }
+        function rejected(value) { try { step(generator["throw"](value)); } catch (e) { reject(e); } }
+        function step(result) { result.done ? resolve(result.value) : adopt(result.value).then(fulfilled, rejected); }
+        step((generator = generator.apply(thisArg, _arguments || [])).next());
+    });
+};
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.isStackHealthy = exports.describeStackStatus = void 0;
+const client_cloudformation_1 = require("@aws-sdk/client-cloudformation");
+/** A stack's status, or null when it does not exist. */
+const describeStackStatus = (stackName, region) => __awaiter(void 0, void 0, void 0, function* () {
+    var _a, _b;
+    try {
+        const { Stacks } = yield new client_cloudformation_1.CloudFormationClient({ region }).send(new client_cloudformation_1.DescribeStacksCommand({ StackName: stackName }));
+        return (_b = (_a = Stacks === null || Stacks === void 0 ? void 0 : Stacks[0]) === null || _a === void 0 ? void 0 : _a.StackStatus) !== null && _b !== void 0 ? _b : null;
+    }
+    catch (error) {
+        if (error instanceof Error && /does not exist/.test(error.message)) {
+            return null;
+        }
+        throw error;
+    }
+});
+exports.describeStackStatus = describeStackStatus;
+const healthyStatuses = ['CREATE_COMPLETE', 'UPDATE_COMPLETE', 'IMPORT_COMPLETE'];
+const isStackHealthy = (status) => status !== null && healthyStatuses.includes(status);
+exports.isStackHealthy = isStackHealthy;
+//# sourceMappingURL=describeStackStatus.js.map

package/lib/commonjs/platforms/aws/setup/describeStackStatus.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"describeStackStatus.js","sourceRoot":"","sources":["../../../../../src/platforms/aws/setup/describeStackStatus.ts"],"names":[],"mappings":";;;;;;;;;;;;AAEA,0EAA6F;AAE7F,wDAAwD;AACjD,MAAM,mBAAmB,GAAG,CAAO,SAAiB,EAAE,MAAc,EAA6B,EAAE;;IACxG,IAAI,CAAC;QACH,MAAM,EAAE,MAAM,EAAE,GAAG,MAAM,IAAI,4CAAoB,CAAC,EAAE,MAAM,EAAE,CAAC,CAAC,IAAI,CAAC,IAAI,6CAAqB,CAAC,EAAE,SAAS,EAAE,SAAS,EAAE,CAAC,CAAC,CAAC;QACxH,OAAO,MAAA,MAAA,MAAM,aAAN,MAAM,uBAAN,MAAM,CAAG,CAAC,CAAC,0CAAE,WAAW,mCAAI,IAAI,CAAC;IAC1C,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,IAAI,KAAK,YAAY,KAAK,IAAI,gBAAgB,CAAC,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,EAAE,CAAC;YACnE,OAAO,IAAI,CAAC;QACd,CAAC;QACD,MAAM,KAAK,CAAC;IACd,CAAC;AACH,CAAC,CAAA,CAAC;AAVW,QAAA,mBAAmB,uBAU9B;AAEF,MAAM,eAAe,GAAG,CAAC,iBAAiB,EAAE,iBAAiB,EAAE,iBAAiB,CAAC,CAAC;AAE3E,MAAM,cAAc,GAAG,CAAC,MAAwB,EAAW,EAAE,CAAC,MAAM,KAAK,IAAI,IAAI,eAAe,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC;AAA5G,QAAA,cAAc,kBAA8F","sourcesContent":["import { Nullable } from 'quidproquo-core';\n\nimport { CloudFormationClient, DescribeStacksCommand } from '@aws-sdk/client-cloudformation';\n\n/** A stack's status, or null when it does not exist. */\nexport const describeStackStatus = async (stackName: string, region: string): Promise<Nullable<string>> => {\n  try {\n    const { Stacks } = await new CloudFormationClient({ region }).send(new DescribeStacksCommand({ StackName: stackName }));\n    return Stacks?.[0]?.StackStatus ?? null;\n  } catch (error) {\n    if (error instanceof Error && /does not exist/.test(error.message)) {\n      return null;\n    }\n    throw error;\n  }\n};\n\nconst healthyStatuses = ['CREATE_COMPLETE', 'UPDATE_COMPLETE', 'IMPORT_COMPLETE'];\n\nexport const isStackHealthy = (status: Nullable<string>): boolean => status !== null && healthyStatuses.includes(status);\n"]}

package/lib/commonjs/platforms/aws/setup/index.d.ts

@@ -0,0 +1 @@
+export * from './awsSetupSteps';

package/lib/commonjs/platforms/aws/setup/index.js

@@ -0,0 +1,18 @@
+"use strict";
+var __createBinding = (this && this.__createBinding) || (Object.create ? (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    var desc = Object.getOwnPropertyDescriptor(m, k);
+    if (!desc || ("get" in desc ? !m.__esModule : desc.writable || desc.configurable)) {
+      desc = { enumerable: true, get: function() { return m[k]; } };
+    }
+    Object.defineProperty(o, k2, desc);
+}) : (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    o[k2] = m[k];
+}));
+var __exportStar = (this && this.__exportStar) || function(m, exports) {
+    for (var p in m) if (p !== "default" && !Object.prototype.hasOwnProperty.call(exports, p)) __createBinding(exports, m, p);
+};
+Object.defineProperty(exports, "__esModule", { value: true });
+__exportStar(require("./awsSetupSteps"), exports);
+//# sourceMappingURL=index.js.map

package/lib/commonjs/platforms/aws/setup/index.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../../../../../src/platforms/aws/setup/index.ts"],"names":[],"mappings":";;;;;;;;;;;;;;;;AAAA,kDAAgC","sourcesContent":["export * from './awsSetupSteps';\n"]}

package/lib/commonjs/platforms/types.d.ts

@@ -1,6 +1,7 @@
 import { QpqAppDeployEnvironment } from 'quidproquo-deploy-awscdk';
 import { ClearResourcesPlan } from '../lib/clearResourcesPlan';
 import { DeployPlan, TeardownPlan } from '../lib/deployPrompts';
+import { SetupStep } from '../lib/setupStep';
 export declare enum QpqDeployPlatform {
     aws = "aws",
     docker = "docker"
@@ -11,6 +12,7 @@ export interface QpqPlatformDriver {
     goDocker?: (appName: string, plan: DeployPlan) => Promise<void>;
     teardown?: (appName: string, plan: TeardownPlan) => Promise<void>;
     clearResources?: (appName: string, plan: ClearResourcesPlan) => Promise<void>;
+    setupSteps?: (appName: string, environment: string) => Promise<SetupStep[]>;
     publish: (appName: string, serviceNames: string[]) => Promise<void>;
     publishBuild: (appName: string, serviceNames: string[]) => Promise<void>;
     publishUpload: (appName: string, serviceNames: string[]) => Promise<void>;

package/lib/commonjs/platforms/types.js.map

@@ -1 +1 @@
-{"version":3,"file":"types.js","sourceRoot":"","sources":["../../../src/platforms/types.ts"],"names":[],"mappings":";;;AAKA,IAAY,iBAGX;AAHD,WAAY,iBAAiB;IAC3B,gCAAW,CAAA;IACX,sCAAiB,CAAA;AACnB,CAAC,EAHW,iBAAiB,iCAAjB,iBAAiB,QAG5B","sourcesContent":["import { QpqAppDeployEnvironment } from 'quidproquo-deploy-awscdk';\n\nimport { ClearResourcesPlan } from '../lib/clearResourcesPlan';\nimport { DeployPlan, TeardownPlan } from '../lib/deployPrompts';\n\nexport enum QpqDeployPlatform {\n  aws = 'aws',\n  docker = 'docker',\n}\n\n// A deploy platform driver — everything that happens after \"what to deploy\"\n// has been decided. `qpq go` resolves the app + environment, prompts the plan,\n// then hands off here; the platform comes from the environment's entry in\n// apps/<app>/deploy.config.json (default aws), so an app can move platforms\n// with a config change instead of a different command.\nexport interface QpqPlatformDriver {\n  // Prime process.env with this platform's deploy identity from the resolved\n  // environment target (already-set env vars win). Service configs read these\n  // vars at load time, so this runs before any infrastructure.ts is required.\n  // Returns human-readable descriptions of anything still missing — deploys\n  // treat that as fatal, local dev commands ignore it.\n  primeDeployIdentity: (target: QpqAppDeployEnvironment | undefined) => string[];\n\n  // Sequential deploy (`qpq go`).\n  go: (appName: string, plan: DeployPlan) => Promise<void>;\n\n  // Parallel containerized deploy (`qpq go:docker`) — optional; drivers that\n  // have no docker strategy simply omit it.\n  goDocker?: (appName: string, plan: DeployPlan) => Promise<void>;\n\n  // Destroy the web/api/inf stacks for selected services (`qpq teardown`) —\n  // optional; drivers with no teardown strategy simply omit it.\n  teardown?: (appName: string, plan: TeardownPlan) => Promise<void>;\n\n  // Empty the stored data of selected resources without touching the stacks\n  // (`qpq clear-resources`) — optional; drivers with no strategy omit it.\n  clearResources?: (appName: string, plan: ClearResourcesPlan) => Promise<void>;\n\n  // Federated remote publishing (`qpq publish[:build|:upload|:deploy]`).\n  publish: (appName: string, serviceNames: string[]) => Promise<void>;\n  publishBuild: (appName: string, serviceNames: string[]) => Promise<void>;\n  publishUpload: (appName: string, serviceNames: string[]) => Promise<void>;\n  publishDeploy: (appName: string, serviceNames: string[]) => Promise<void>;\n}\n"]}
+{"version":3,"file":"types.js","sourceRoot":"","sources":["../../../src/platforms/types.ts"],"names":[],"mappings":";;;AAMA,IAAY,iBAGX;AAHD,WAAY,iBAAiB;IAC3B,gCAAW,CAAA;IACX,sCAAiB,CAAA;AACnB,CAAC,EAHW,iBAAiB,iCAAjB,iBAAiB,QAG5B","sourcesContent":["import { QpqAppDeployEnvironment } from 'quidproquo-deploy-awscdk';\n\nimport { ClearResourcesPlan } from '../lib/clearResourcesPlan';\nimport { DeployPlan, TeardownPlan } from '../lib/deployPrompts';\nimport { SetupStep } from '../lib/setupStep';\n\nexport enum QpqDeployPlatform {\n  aws = 'aws',\n  docker = 'docker',\n}\n\n// A deploy platform driver — everything that happens after \"what to deploy\"\n// has been decided. `qpq go` resolves the app + environment, prompts the plan,\n// then hands off here; the platform comes from the environment's entry in\n// apps/<app>/deploy.config.json (default aws), so an app can move platforms\n// with a config change instead of a different command.\nexport interface QpqPlatformDriver {\n  // Prime process.env with this platform's deploy identity from the resolved\n  // environment target (already-set env vars win). Service configs read these\n  // vars at load time, so this runs before any infrastructure.ts is required.\n  // Returns human-readable descriptions of anything still missing — deploys\n  // treat that as fatal, local dev commands ignore it.\n  primeDeployIdentity: (target: QpqAppDeployEnvironment | undefined) => string[];\n\n  // Sequential deploy (`qpq go`).\n  go: (appName: string, plan: DeployPlan) => Promise<void>;\n\n  // Parallel containerized deploy (`qpq go:docker`) — optional; drivers that\n  // have no docker strategy simply omit it.\n  goDocker?: (appName: string, plan: DeployPlan) => Promise<void>;\n\n  // Destroy the web/api/inf stacks for selected services (`qpq teardown`) —\n  // optional; drivers with no teardown strategy simply omit it.\n  teardown?: (appName: string, plan: TeardownPlan) => Promise<void>;\n\n  // Empty the stored data of selected resources without touching the stacks\n  // (`qpq clear-resources`) — optional; drivers with no strategy omit it.\n  clearResources?: (appName: string, plan: ClearResourcesPlan) => Promise<void>;\n\n  // The ordered checklist that takes an empty cloud environment to a deployed\n  // one (`qpq setup`) — optional; drivers with nothing to set up omit it.\n  setupSteps?: (appName: string, environment: string) => Promise<SetupStep[]>;\n\n  // Federated remote publishing (`qpq publish[:build|:upload|:deploy]`).\n  publish: (appName: string, serviceNames: string[]) => Promise<void>;\n  publishBuild: (appName: string, serviceNames: string[]) => Promise<void>;\n  publishUpload: (appName: string, serviceNames: string[]) => Promise<void>;\n  publishDeploy: (appName: string, serviceNames: string[]) => Promise<void>;\n}\n"]}

package/lib/esm/cli/commandRegistry.js

@@ -23,6 +23,12 @@ export const cliCommands = [
         ],
         run: (a) => require('../commands/go').goCommand(a),
     },
+    {
+        name: 'setup',
+        summary: 'Take a cloud environment from empty to deployed: checked steps, run in order (interactive)',
+        usageExtra: ["--check prints each step's status; --yes runs them all; --only <ids> runs a subset."],
+        run: (a) => require('../commands/setup').setupCommand(a),
+    },
     {
         name: 'go:docker',
         summary: 'Same as go (incl. positional args), but deploys in parallel via docker',

package/lib/esm/cli/commandRegistry.js.map

@@ -1 +1 @@
-{"version":3,"file":"commandRegistry.js","sourceRoot":"","sources":["../../../src/cli/commandRegistry.ts"],"names":[],"mappings":"AAAA,uEAAuE;AACvE,wEAAwE;AACxE,EAAE;AACF,qEAAqE;AACrE,wEAAwE;AACxE,wEAAwE;AACxE,OAAO,EAAE,UAAU,EAAE,MAAM,gBAAgB,CAAC;AAe5C,yEAAyE;AACzE,8BAA8B;AAC9B,MAAM,cAAc,GAAG,KAAK,IAAuB,EAAE,CAAC;IACpD,MAAM,UAAU,CAAC,qFAAqF,CAAC;CACxG,CAAC;AAEF,0DAA0D;AAC1D,MAAM,CAAC,MAAM,WAAW,GAAiB;IACvC;QACE,IAAI,EAAE,IAAI;QACV,SAAS,EAAE,eAAe;QAC1B,OAAO,EAAE,+EAA+E;QACxF,UAAU,EAAE;YACV,oEAAoE;YACpE,oFAAoF;YACpF,2EAA2E;SAC5E;QACD,GAAG,EAAE,CAAC,CAAC,EAAE,EAAE,CAAC,OAAO,CAAC,gBAAgB,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC;KACnD;IACD;QACE,IAAI,EAAE,WAAW;QACjB,OAAO,EAAE,wEAAwE;QACjF,GAAG,EAAE,CAAC,CAAC,EAAE,EAAE,CAAC,OAAO,CAAC,sBAAsB,CAAC,CAAC,eAAe,CAAC,CAAC,CAAC;KAC/D;IACD;QACE,IAAI,EAAE,QAAQ;QACd,OAAO,EAAE,yDAAyD;QAClE,GAAG,EAAE,CAAC,CAAC,EAAE,EAAE,CAAC,OAAO,CAAC,mBAAmB,CAAC,CAAC,YAAY,CAAC,CAAC,CAAC;KACzD;IACD;QACE,IAAI,EAAE,YAAY;QAClB,OAAO,EAAE,2CAA2C;QACpD,GAAG,EAAE,CAAC,CAAC,EAAE,EAAE,CAAC,OAAO,CAAC,sBAAsB,CAAC,CAAC,eAAe,CAAC,CAAC,CAAC;KAC/D;IACD;QACE,IAAI,EAAE,YAAY;QAClB,OAAO,EAAE,0CAA0C;QACnD,GAAG,EAAE,CAAC,CAAC,EAAE,EAAE,CAAC,OAAO,CAAC,sBAAsB,CAAC,CAAC,eAAe,CAAC,CAAC,CAAC;KAC/D;IACD;QACE,IAAI,EAAE,SAAS;QACf,SAAS,EAAE,OAAO;QAClB,OAAO,EAAE,sEAAsE;QAC/E,UAAU,EAAE;YACV,4EAA4E;YAC5E,6EAA6E;YAC7E,yBAAyB;SAC1B;QACD,GAAG,EAAE,CAAC,CAAC,EAAE,EAAE,CAAC,OAAO,CAAC,qBAAqB,CAAC,CAAC,cAAc,CAAC,CAAC,CAAC;KAC7D;IACD;QACE,IAAI,EAAE,UAAU;QAChB,OAAO,EAAE,gEAAgE;QACzE,GAAG,EAAE,CAAC,CAAC,EAAE,EAAE,CAAC,OAAO,CAAC,sBAAsB,CAAC,CAAC,eAAe,CAAC,CAAC,CAAC;KAC/D;IACD;QACE,IAAI,EAAE,iBAAiB;QACvB,OAAO,EAAE,0EAA0E;QACnF,GAAG,EAAE,CAAC,CAAC,EAAE,EAAE,CAAC,OAAO,CAAC,4BAA4B,CAAC,CAAC,qBAAqB,CAAC,CAAC,CAAC;KAC3E;IACD;QACE,IAAI,EAAE,OAAO;QACb,SAAS,EAAE,WAAW;QACtB,OAAO,EAAE,qDAAqD;QAC9D,GAAG,EAAE,CAAC,CAAC,EAAE,EAAE,CAAC,OAAO,CAAC,mBAAmB,CAAC,CAAC,YAAY,CAAC,CAAC,CAAC;KACzD;IACD;QACE,IAAI,EAAE,MAAM;QACZ,OAAO,EAAE,+CAA+C;QACxD,GAAG,EAAE,CAAC,CAAC,EAAE,EAAE,CAAC,OAAO,CAAC,kBAAkB,CAAC,CAAC,WAAW,CAAC,CAAC,CAAC;KACvD;IACD;QACE,IAAI,EAAE,SAAS;QACf,OAAO,EAAE,2CAA2C;QACpD,GAAG,EAAE,CAAC,CAAC,EAAE,EAAE,CAAC,OAAO,CAAC,qBAAqB,CAAC,CAAC,cAAc,CAAC,CAAC,CAAC;KAC7D;IACD;QACE,IAAI,EAAE,eAAe;QACrB,OAAO,EAAE,iCAAiC;QAC1C,GAAG,EAAE,CAAC,CAAC,EAAE,EAAE,CAAC,OAAO,CAAC,qBAAqB,CAAC,CAAC,mBAAmB,CAAC,CAAC,CAAC;KAClE;IACD;QACE,IAAI,EAAE,gBAAgB;QACtB,OAAO,EAAE,+CAA+C;QACxD,GAAG,EAAE,CAAC,CAAC,EAAE,EAAE,CAAC,OAAO,CAAC,qBAAqB,CAAC,CAAC,oBAAoB,CAAC,CAAC,CAAC;KACnE;IACD;QACE,IAAI,EAAE,gBAAgB;QACtB,OAAO,EAAE,yCAAyC;QAClD,GAAG,EAAE,CAAC,CAAC,EAAE,EAAE,CAAC,OAAO,CAAC,qBAAqB,CAAC,CAAC,oBAAoB,CAAC,CAAC,CAAC;KACnE;IACD;QACE,IAAI,EAAE,gBAAgB;QACtB,OAAO,EAAE,sFAAsF;QAC/F,GAAG,EAAE,CAAC,CAAC,EAAE,EAAE,CAAC,OAAO,CAAC,2BAA2B,CAAC,CAAC,oBAAoB,CAAC,CAAC,CAAC;KACzE;IACD;QACE,IAAI,EAAE,OAAO;QACb,SAAS,EAAE,QAAQ;QACnB,OAAO,EAAE,gHAAgH;QACzH,UAAU,EAAE,cAAc;QAC1B,GAAG,EAAE,CAAC,CAAC,EAAE,EAAE,CAAC,OAAO,CAAC,mBAAmB,CAAC,CAAC,YAAY,CAAC,CAAC,CAAC;KACzD;CACF,CAAC;AACF,yDAAyD;AAEzD,uDAAuD;AACvD,MAAM,gBAAgB,GAAG,EAAE,CAAC;AAE5B,MAAM,CAAC,MAAM,UAAU,GAAG,GAAW,EAAE;IACrC,MAAM,YAAY,GAAG,WAAW,CAAC,OAAO,CAAC,CAAC,OAAO,EAAE,EAAE;QACnD,MAAM,WAAW,GAAG,OAAO,CAAC,SAAS,CAAC,CAAC,CAAC,GAAG,OAAO,CAAC,IAAI,IAAI,OAAO,CAAC,SAAS,EAAE,CAAC,CAAC,CAAC,OAAO,CAAC,IAAI,CAAC;QAC9F,MAAM,UAAU,GAAG,CAAC,OAAO,CAAC,UAAU,IAAI,EAAE,CAAC,CAAC,GAAG,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,KAAK,EAAE,CAAC,MAAM,CAAC,gBAAgB,CAAC,GAAG,IAAI,EAAE,CAAC,CAAC;QACvG,OAAO,CAAC,KAAK,WAAW,CAAC,MAAM,CAAC,gBAAgB,CAAC,GAAG,OAAO,CAAC,OAAO,EAAE,EAAE,GAAG,UAAU,CAAC,CAAC;IACxF,CAAC,CAAC,CAAC;IAEH,OAAO;QACL,wDAAwD;QACxD,EAAE;QACF,wEAAwE;QACxE,8DAA8D;QAC9D,EAAE;QACF,WAAW;QACX,GAAG,YAAY;QACf,EAAE;KACH,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;AACf,CAAC,CAAC","sourcesContent":["// Single source of truth for every qpq command: its name, the one-line\n// summary (shared by `qpq help` and the interactive menu) and a runner.\n//\n// Command modules are required lazily inside each runner so a simple\n// `qpq help` doesn't pay for the whole toolchain, and so ts-node can be\n// registered before any command module (or anything it requires) loads.\nimport { promptText } from '../lib/prompts';\n\nexport type CliCommand = {\n  name: string;\n  // Argument hint shown in the usage text, e.g. '[svc] [stack]'.\n  usageArgs?: string;\n  summary: string;\n  // Extra usage-only detail lines, indented under the summary.\n  usageExtra?: string[];\n  // Menu-only: commands that need a positional argument (which the menu has\n  // no argv to carry) gather it here before running.\n  promptArgs?: () => Promise<string[]>;\n  run: (commandArgv: string[]) => Promise<void>;\n};\n\n// `qpq hooks` needs a hook name; when launched from the menu there is no\n// argv to pass it in, so ask.\nconst promptHookName = async (): Promise<string[]> => [\n  await promptText('Hook name (runs qpq:<name>, or plain <name>, in every app/package that defines it):'),\n];\n\n/* eslint-disable @typescript-eslint/no-require-imports */\nexport const cliCommands: CliCommand[] = [\n  {\n    name: 'go',\n    usageArgs: '[svc] [stack]',\n    summary: 'Deploy services (interactive; platform from deploy.config.json, default aws).',\n    usageExtra: [\n      'Pass positional args to skip prompts, e.g. qpq go all all — svc is',\n      \"'all' | comma-list | account | domain | bootstrap; stack is all|inf|api|web|views.\",\n      \"A full 'all all' (or 'all api') deploy also publishes federated backends.\",\n    ],\n    run: (a) => require('../commands/go').goCommand(a),\n  },\n  {\n    name: 'go:docker',\n    summary: 'Same as go (incl. positional args), but deploys in parallel via docker',\n    run: (a) => require('../commands/goDocker').goDockerCommand(a),\n  },\n  {\n    name: 'go:dev',\n    summary: 'Run the full local dev stack (api + web) in one process',\n    run: (a) => require('../commands/goDev').goDevCommand(a),\n  },\n  {\n    name: 'go:dev:api',\n    summary: 'Run the local API dev server (hot reload)',\n    run: (a) => require('../commands/goDevApi').goDevApiCommand(a),\n  },\n  {\n    name: 'go:dev:web',\n    summary: 'Run every views microfrontend dev server',\n    run: (a) => require('../commands/goDevWeb').goDevWebCommand(a),\n  },\n  {\n    name: 'migrate',\n    usageArgs: '[app]',\n    summary: 'Run pending migrations against the LOCAL dev store, once, then exit.',\n    usageExtra: [\n      'Deployed, migrations run on a stack update; nothing local ever deploys, so',\n      'this is how you exercise one before shipping it. Records what it runs, so a',\n      'second call is a no-op.',\n    ],\n    run: (a) => require('../commands/migrate').migrateCommand(a),\n  },\n  {\n    name: 'teardown',\n    summary: 'Destroy web/api/inf stacks for selected services (interactive)',\n    run: (a) => require('../commands/teardown').teardownCommand(a),\n  },\n  {\n    name: 'clear-resources',\n    summary: 'Empty selected buckets/tables (data only, stacks untouched; interactive)',\n    run: (a) => require('../commands/clearResources').clearResourcesCommand(a),\n  },\n  {\n    name: 'synth',\n    usageArgs: '[service]',\n    summary: 'Synth QPQ configs to dist/apps/<app>/infrastructure',\n    run: (a) => require('../commands/synth').synthCommand(a),\n  },\n  {\n    name: 'prep',\n    summary: 'Regenerate apps/<app>/tsconfig.federated.json',\n    run: (a) => require('../commands/prep').prepCommand(a),\n  },\n  {\n    name: 'publish',\n    summary: 'Build + upload + deploy federated remotes',\n    run: (a) => require('../commands/publish').publishCommand(a),\n  },\n  {\n    name: 'publish:build',\n    summary: 'Build federated remotes locally',\n    run: (a) => require('../commands/publish').publishBuildCommand(a),\n  },\n  {\n    name: 'publish:upload',\n    summary: 'Upload built version dirs (nothing goes live)',\n    run: (a) => require('../commands/publish').publishUploadCommand(a),\n  },\n  {\n    name: 'publish:deploy',\n    summary: 'Flip manifests to the uploaded versions',\n    run: (a) => require('../commands/publish').publishDeployCommand(a),\n  },\n  {\n    name: 'check:circular',\n    summary: 'Scan workspace sources for circular imports (fails on cycles; --warn to only report)',\n    run: (a) => require('../commands/checkCircular').checkCircularCommand(a),\n  },\n  {\n    name: 'hooks',\n    usageArgs: '<name>',\n    summary: 'Run qpq:<name> (or plain <name>) in every app/package that defines it (dependency ordered, parallel; --jobs=N)',\n    promptArgs: promptHookName,\n    run: (a) => require('../commands/hooks').hooksCommand(a),\n  },\n];\n/* eslint-enable @typescript-eslint/no-require-imports */\n\n// Width of the \"name [args]\" column in the usage text.\nconst usageColumnWidth = 17;\n\nexport const buildUsage = (): string => {\n  const commandLines = cliCommands.flatMap((command) => {\n    const nameAndArgs = command.usageArgs ? `${command.name} ${command.usageArgs}` : command.name;\n    const extraLines = (command.usageExtra ?? []).map((line) => `  ${''.padEnd(usageColumnWidth)}${line}`);\n    return [`  ${nameAndArgs.padEnd(usageColumnWidth)}${command.summary}`, ...extraLines];\n  });\n\n  return [\n    'qpq — build, dev and deploy orchestration for QPQ apps',\n    '',\n    'Usage: qpq <command> [--app <name>] [--env <name>] [--platform <name>]',\n    '       qpq            (no command opens an interactive menu)',\n    '',\n    'Commands:',\n    ...commandLines,\n    '',\n  ].join('\\n');\n};\n"]}
+{"version":3,"file":"commandRegistry.js","sourceRoot":"","sources":["../../../src/cli/commandRegistry.ts"],"names":[],"mappings":"AAAA,uEAAuE;AACvE,wEAAwE;AACxE,EAAE;AACF,qEAAqE;AACrE,wEAAwE;AACxE,wEAAwE;AACxE,OAAO,EAAE,UAAU,EAAE,MAAM,gBAAgB,CAAC;AAe5C,yEAAyE;AACzE,8BAA8B;AAC9B,MAAM,cAAc,GAAG,KAAK,IAAuB,EAAE,CAAC;IACpD,MAAM,UAAU,CAAC,qFAAqF,CAAC;CACxG,CAAC;AAEF,0DAA0D;AAC1D,MAAM,CAAC,MAAM,WAAW,GAAiB;IACvC;QACE,IAAI,EAAE,IAAI;QACV,SAAS,EAAE,eAAe;QAC1B,OAAO,EAAE,+EAA+E;QACxF,UAAU,EAAE;YACV,oEAAoE;YACpE,oFAAoF;YACpF,2EAA2E;SAC5E;QACD,GAAG,EAAE,CAAC,CAAC,EAAE,EAAE,CAAC,OAAO,CAAC,gBAAgB,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC;KACnD;IACD;QACE,IAAI,EAAE,OAAO;QACb,OAAO,EAAE,4FAA4F;QACrG,UAAU,EAAE,CAAC,qFAAqF,CAAC;QACnG,GAAG,EAAE,CAAC,CAAC,EAAE,EAAE,CAAC,OAAO,CAAC,mBAAmB,CAAC,CAAC,YAAY,CAAC,CAAC,CAAC;KACzD;IACD;QACE,IAAI,EAAE,WAAW;QACjB,OAAO,EAAE,wEAAwE;QACjF,GAAG,EAAE,CAAC,CAAC,EAAE,EAAE,CAAC,OAAO,CAAC,sBAAsB,CAAC,CAAC,eAAe,CAAC,CAAC,CAAC;KAC/D;IACD;QACE,IAAI,EAAE,QAAQ;QACd,OAAO,EAAE,yDAAyD;QAClE,GAAG,EAAE,CAAC,CAAC,EAAE,EAAE,CAAC,OAAO,CAAC,mBAAmB,CAAC,CAAC,YAAY,CAAC,CAAC,CAAC;KACzD;IACD;QACE,IAAI,EAAE,YAAY;QAClB,OAAO,EAAE,2CAA2C;QACpD,GAAG,EAAE,CAAC,CAAC,EAAE,EAAE,CAAC,OAAO,CAAC,sBAAsB,CAAC,CAAC,eAAe,CAAC,CAAC,CAAC;KAC/D;IACD;QACE,IAAI,EAAE,YAAY;QAClB,OAAO,EAAE,0CAA0C;QACnD,GAAG,EAAE,CAAC,CAAC,EAAE,EAAE,CAAC,OAAO,CAAC,sBAAsB,CAAC,CAAC,eAAe,CAAC,CAAC,CAAC;KAC/D;IACD;QACE,IAAI,EAAE,SAAS;QACf,SAAS,EAAE,OAAO;QAClB,OAAO,EAAE,sEAAsE;QAC/E,UAAU,EAAE;YACV,4EAA4E;YAC5E,6EAA6E;YAC7E,yBAAyB;SAC1B;QACD,GAAG,EAAE,CAAC,CAAC,EAAE,EAAE,CAAC,OAAO,CAAC,qBAAqB,CAAC,CAAC,cAAc,CAAC,CAAC,CAAC;KAC7D;IACD;QACE,IAAI,EAAE,UAAU;QAChB,OAAO,EAAE,gEAAgE;QACzE,GAAG,EAAE,CAAC,CAAC,EAAE,EAAE,CAAC,OAAO,CAAC,sBAAsB,CAAC,CAAC,eAAe,CAAC,CAAC,CAAC;KAC/D;IACD;QACE,IAAI,EAAE,iBAAiB;QACvB,OAAO,EAAE,0EAA0E;QACnF,GAAG,EAAE,CAAC,CAAC,EAAE,EAAE,CAAC,OAAO,CAAC,4BAA4B,CAAC,CAAC,qBAAqB,CAAC,CAAC,CAAC;KAC3E;IACD;QACE,IAAI,EAAE,OAAO;QACb,SAAS,EAAE,WAAW;QACtB,OAAO,EAAE,qDAAqD;QAC9D,GAAG,EAAE,CAAC,CAAC,EAAE,EAAE,CAAC,OAAO,CAAC,mBAAmB,CAAC,CAAC,YAAY,CAAC,CAAC,CAAC;KACzD;IACD;QACE,IAAI,EAAE,MAAM;QACZ,OAAO,EAAE,+CAA+C;QACxD,GAAG,EAAE,CAAC,CAAC,EAAE,EAAE,CAAC,OAAO,CAAC,kBAAkB,CAAC,CAAC,WAAW,CAAC,CAAC,CAAC;KACvD;IACD;QACE,IAAI,EAAE,SAAS;QACf,OAAO,EAAE,2CAA2C;QACpD,GAAG,EAAE,CAAC,CAAC,EAAE,EAAE,CAAC,OAAO,CAAC,qBAAqB,CAAC,CAAC,cAAc,CAAC,CAAC,CAAC;KAC7D;IACD;QACE,IAAI,EAAE,eAAe;QACrB,OAAO,EAAE,iCAAiC;QAC1C,GAAG,EAAE,CAAC,CAAC,EAAE,EAAE,CAAC,OAAO,CAAC,qBAAqB,CAAC,CAAC,mBAAmB,CAAC,CAAC,CAAC;KAClE;IACD;QACE,IAAI,EAAE,gBAAgB;QACtB,OAAO,EAAE,+CAA+C;QACxD,GAAG,EAAE,CAAC,CAAC,EAAE,EAAE,CAAC,OAAO,CAAC,qBAAqB,CAAC,CAAC,oBAAoB,CAAC,CAAC,CAAC;KACnE;IACD;QACE,IAAI,EAAE,gBAAgB;QACtB,OAAO,EAAE,yCAAyC;QAClD,GAAG,EAAE,CAAC,CAAC,EAAE,EAAE,CAAC,OAAO,CAAC,qBAAqB,CAAC,CAAC,oBAAoB,CAAC,CAAC,CAAC;KACnE;IACD;QACE,IAAI,EAAE,gBAAgB;QACtB,OAAO,EAAE,sFAAsF;QAC/F,GAAG,EAAE,CAAC,CAAC,EAAE,EAAE,CAAC,OAAO,CAAC,2BAA2B,CAAC,CAAC,oBAAoB,CAAC,CAAC,CAAC;KACzE;IACD;QACE,IAAI,EAAE,OAAO;QACb,SAAS,EAAE,QAAQ;QACnB,OAAO,EAAE,gHAAgH;QACzH,UAAU,EAAE,cAAc;QAC1B,GAAG,EAAE,CAAC,CAAC,EAAE,EAAE,CAAC,OAAO,CAAC,mBAAmB,CAAC,CAAC,YAAY,CAAC,CAAC,CAAC;KACzD;CACF,CAAC;AACF,yDAAyD;AAEzD,uDAAuD;AACvD,MAAM,gBAAgB,GAAG,EAAE,CAAC;AAE5B,MAAM,CAAC,MAAM,UAAU,GAAG,GAAW,EAAE;IACrC,MAAM,YAAY,GAAG,WAAW,CAAC,OAAO,CAAC,CAAC,OAAO,EAAE,EAAE;QACnD,MAAM,WAAW,GAAG,OAAO,CAAC,SAAS,CAAC,CAAC,CAAC,GAAG,OAAO,CAAC,IAAI,IAAI,OAAO,CAAC,SAAS,EAAE,CAAC,CAAC,CAAC,OAAO,CAAC,IAAI,CAAC;QAC9F,MAAM,UAAU,GAAG,CAAC,OAAO,CAAC,UAAU,IAAI,EAAE,CAAC,CAAC,GAAG,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,KAAK,EAAE,CAAC,MAAM,CAAC,gBAAgB,CAAC,GAAG,IAAI,EAAE,CAAC,CAAC;QACvG,OAAO,CAAC,KAAK,WAAW,CAAC,MAAM,CAAC,gBAAgB,CAAC,GAAG,OAAO,CAAC,OAAO,EAAE,EAAE,GAAG,UAAU,CAAC,CAAC;IACxF,CAAC,CAAC,CAAC;IAEH,OAAO;QACL,wDAAwD;QACxD,EAAE;QACF,wEAAwE;QACxE,8DAA8D;QAC9D,EAAE;QACF,WAAW;QACX,GAAG,YAAY;QACf,EAAE;KACH,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;AACf,CAAC,CAAC","sourcesContent":["// Single source of truth for every qpq command: its name, the one-line\n// summary (shared by `qpq help` and the interactive menu) and a runner.\n//\n// Command modules are required lazily inside each runner so a simple\n// `qpq help` doesn't pay for the whole toolchain, and so ts-node can be\n// registered before any command module (or anything it requires) loads.\nimport { promptText } from '../lib/prompts';\n\nexport type CliCommand = {\n  name: string;\n  // Argument hint shown in the usage text, e.g. '[svc] [stack]'.\n  usageArgs?: string;\n  summary: string;\n  // Extra usage-only detail lines, indented under the summary.\n  usageExtra?: string[];\n  // Menu-only: commands that need a positional argument (which the menu has\n  // no argv to carry) gather it here before running.\n  promptArgs?: () => Promise<string[]>;\n  run: (commandArgv: string[]) => Promise<void>;\n};\n\n// `qpq hooks` needs a hook name; when launched from the menu there is no\n// argv to pass it in, so ask.\nconst promptHookName = async (): Promise<string[]> => [\n  await promptText('Hook name (runs qpq:<name>, or plain <name>, in every app/package that defines it):'),\n];\n\n/* eslint-disable @typescript-eslint/no-require-imports */\nexport const cliCommands: CliCommand[] = [\n  {\n    name: 'go',\n    usageArgs: '[svc] [stack]',\n    summary: 'Deploy services (interactive; platform from deploy.config.json, default aws).',\n    usageExtra: [\n      'Pass positional args to skip prompts, e.g. qpq go all all — svc is',\n      \"'all' | comma-list | account | domain | bootstrap; stack is all|inf|api|web|views.\",\n      \"A full 'all all' (or 'all api') deploy also publishes federated backends.\",\n    ],\n    run: (a) => require('../commands/go').goCommand(a),\n  },\n  {\n    name: 'setup',\n    summary: 'Take a cloud environment from empty to deployed: checked steps, run in order (interactive)',\n    usageExtra: [\"--check prints each step's status; --yes runs them all; --only <ids> runs a subset.\"],\n    run: (a) => require('../commands/setup').setupCommand(a),\n  },\n  {\n    name: 'go:docker',\n    summary: 'Same as go (incl. positional args), but deploys in parallel via docker',\n    run: (a) => require('../commands/goDocker').goDockerCommand(a),\n  },\n  {\n    name: 'go:dev',\n    summary: 'Run the full local dev stack (api + web) in one process',\n    run: (a) => require('../commands/goDev').goDevCommand(a),\n  },\n  {\n    name: 'go:dev:api',\n    summary: 'Run the local API dev server (hot reload)',\n    run: (a) => require('../commands/goDevApi').goDevApiCommand(a),\n  },\n  {\n    name: 'go:dev:web',\n    summary: 'Run every views microfrontend dev server',\n    run: (a) => require('../commands/goDevWeb').goDevWebCommand(a),\n  },\n  {\n    name: 'migrate',\n    usageArgs: '[app]',\n    summary: 'Run pending migrations against the LOCAL dev store, once, then exit.',\n    usageExtra: [\n      'Deployed, migrations run on a stack update; nothing local ever deploys, so',\n      'this is how you exercise one before shipping it. Records what it runs, so a',\n      'second call is a no-op.',\n    ],\n    run: (a) => require('../commands/migrate').migrateCommand(a),\n  },\n  {\n    name: 'teardown',\n    summary: 'Destroy web/api/inf stacks for selected services (interactive)',\n    run: (a) => require('../commands/teardown').teardownCommand(a),\n  },\n  {\n    name: 'clear-resources',\n    summary: 'Empty selected buckets/tables (data only, stacks untouched; interactive)',\n    run: (a) => require('../commands/clearResources').clearResourcesCommand(a),\n  },\n  {\n    name: 'synth',\n    usageArgs: '[service]',\n    summary: 'Synth QPQ configs to dist/apps/<app>/infrastructure',\n    run: (a) => require('../commands/synth').synthCommand(a),\n  },\n  {\n    name: 'prep',\n    summary: 'Regenerate apps/<app>/tsconfig.federated.json',\n    run: (a) => require('../commands/prep').prepCommand(a),\n  },\n  {\n    name: 'publish',\n    summary: 'Build + upload + deploy federated remotes',\n    run: (a) => require('../commands/publish').publishCommand(a),\n  },\n  {\n    name: 'publish:build',\n    summary: 'Build federated remotes locally',\n    run: (a) => require('../commands/publish').publishBuildCommand(a),\n  },\n  {\n    name: 'publish:upload',\n    summary: 'Upload built version dirs (nothing goes live)',\n    run: (a) => require('../commands/publish').publishUploadCommand(a),\n  },\n  {\n    name: 'publish:deploy',\n    summary: 'Flip manifests to the uploaded versions',\n    run: (a) => require('../commands/publish').publishDeployCommand(a),\n  },\n  {\n    name: 'check:circular',\n    summary: 'Scan workspace sources for circular imports (fails on cycles; --warn to only report)',\n    run: (a) => require('../commands/checkCircular').checkCircularCommand(a),\n  },\n  {\n    name: 'hooks',\n    usageArgs: '<name>',\n    summary: 'Run qpq:<name> (or plain <name>) in every app/package that defines it (dependency ordered, parallel; --jobs=N)',\n    promptArgs: promptHookName,\n    run: (a) => require('../commands/hooks').hooksCommand(a),\n  },\n];\n/* eslint-enable @typescript-eslint/no-require-imports */\n\n// Width of the \"name [args]\" column in the usage text.\nconst usageColumnWidth = 17;\n\nexport const buildUsage = (): string => {\n  const commandLines = cliCommands.flatMap((command) => {\n    const nameAndArgs = command.usageArgs ? `${command.name} ${command.usageArgs}` : command.name;\n    const extraLines = (command.usageExtra ?? []).map((line) => `  ${''.padEnd(usageColumnWidth)}${line}`);\n    return [`  ${nameAndArgs.padEnd(usageColumnWidth)}${command.summary}`, ...extraLines];\n  });\n\n  return [\n    'qpq — build, dev and deploy orchestration for QPQ apps',\n    '',\n    'Usage: qpq <command> [--app <name>] [--env <name>] [--platform <name>]',\n    '       qpq            (no command opens an interactive menu)',\n    '',\n    'Commands:',\n    ...commandLines,\n    '',\n  ].join('\\n');\n};\n"]}