quidproquo-cli 0.1.18 → 0.1.20

package/lib/esm/platforms/aws/setup/buildIamCapabilityStep.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"buildIamCapabilityStep.js","sourceRoot":"","sources":["../../../../../src/platforms/aws/setup/buildIamCapabilityStep.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,cAAc,EAAE,SAAS,EAAE,MAAM,qBAAqB,CAAC;AAKhE,gFAAgF;AAChF,4EAA4E;AAC5E,sEAAsE;AACtE,MAAM,kBAAkB,GAAG,KAAK,EAAE,GAAoB,EAA6B,EAAE;IACnF,MAAM,QAAQ,GAAG,+BAA+B,GAAG,CAAC,SAAS,IAAI,GAAG,CAAC,MAAM,EAAE,CAAC;IAC9E,IAAI,CAAC;QACH,MAAM,IAAI,SAAS,CAAC,EAAE,MAAM,EAAE,GAAG,CAAC,MAAM,EAAE,CAAC,CAAC,IAAI,CAAC,IAAI,cAAc,CAAC,EAAE,QAAQ,EAAE,QAAQ,EAAE,CAAC,CAAC,CAAC;QAC7F,OAAO,EAAE,IAAI,EAAE,IAAI,EAAE,MAAM,EAAE,qBAAqB,EAAE,CAAC;IACvD,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,MAAM,IAAI,GAAG,KAAK,YAAY,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC;QACtD,IAAI,IAAI,KAAK,uBAAuB,EAAE,CAAC;YACrC,OAAO,EAAE,IAAI,EAAE,IAAI,EAAE,MAAM,EAAE,qBAAqB,EAAE,CAAC;QACvD,CAAC;QACD,OAAO;YACL,IAAI,EAAE,KAAK;YACX,MAAM,EAAE,uBAAuB,IAAI,2FAA2F;SAC/H,CAAC;IACJ,CAAC;AACH,CAAC,CAAC;AAEF,gFAAgF;AAChF,MAAM,CAAC,MAAM,sBAAsB,GAAG,CAAC,GAAoB,EAAa,EAAE,CAAC,CAAC;IAC1E,EAAE,EAAE,KAAK;IACT,IAAI,EAAE,+BAA+B;IACrC,KAAK,EAAE,GAAG,EAAE,CAAC,kBAAkB,CAAC,GAAG,CAAC;IACpC,GAAG,EAAE,KAAK,IAAI,EAAE;QACd,MAAM,MAAM,GAAG,MAAM,kBAAkB,CAAC,GAAG,CAAC,CAAC;QAC7C,IAAI,CAAC,MAAM,CAAC,IAAI,EAAE,CAAC;YACjB,MAAM,IAAI,KAAK,CAAC,MAAM,CAAC,MAAM,IAAI,oBAAoB,CAAC,CAAC;QACzD,CAAC;IACH,CAAC;CACF,CAAC,CAAC","sourcesContent":["import { GetRoleCommand, IAMClient } from '@aws-sdk/client-iam';\n\nimport { SetupCheckResult, SetupStep } from '../../../lib/setupStep';\nimport { AwsSetupContext } from './awsSetupContext';\n\n// CDK bootstrap and every deploy create IAM roles. PowerUserAccess fails on the\n// first iam:GetRole for a cdk-* role, so probe exactly that: a NoSuchEntity\n// answer means the permission is there, AccessDenied means it is not.\nconst checkIamCapability = async (ctx: AwsSetupContext): Promise<SetupCheckResult> => {\n  const roleName = `cdk-hnb659fds-cfn-exec-role-${ctx.accountId}-${ctx.region}`;\n  try {\n    await new IAMClient({ region: ctx.region }).send(new GetRoleCommand({ RoleName: roleName }));\n    return { done: true, detail: 'iam:GetRole allowed' };\n  } catch (error) {\n    const name = error instanceof Error ? error.name : '';\n    if (name === 'NoSuchEntityException') {\n      return { done: true, detail: 'iam:GetRole allowed' };\n    }\n    return {\n      done: false,\n      detail: `iam:GetRole denied (${name}); the permission set needs IAM rights (AdministratorAccess or a custom set adding iam:*)`,\n    };\n  }\n};\n\n/** Check-only: the credentials can manage IAM, which every CDK deploy needs. */\nexport const buildIamCapabilityStep = (ctx: AwsSetupContext): SetupStep => ({\n  id: 'iam',\n  name: 'IAM rights on the credentials',\n  check: () => checkIamCapability(ctx),\n  run: async () => {\n    const result = await checkIamCapability(ctx);\n    if (!result.done) {\n      throw new Error(result.detail ?? 'IAM rights missing');\n    }\n  },\n});\n"]}

package/lib/esm/platforms/aws/setup/buildIdentityStep.d.ts

@@ -0,0 +1,4 @@
+import { SetupStep } from '../../../lib/setupStep';
+import { AwsSetupContext } from './awsSetupContext';
+/** Check-only: the active credentials belong to the environment's account. Catches a stale .env or SSO profile. */
+export declare const buildIdentityStep: (ctx: AwsSetupContext) => SetupStep;

package/lib/esm/platforms/aws/setup/buildIdentityStep.js

@@ -0,0 +1,26 @@
+import { GetCallerIdentityCommand, STSClient } from '@aws-sdk/client-sts';
+const checkIdentity = async (ctx) => {
+    try {
+        const { Account, Arn } = await new STSClient({ region: ctx.region }).send(new GetCallerIdentityCommand({}));
+        if (Account !== ctx.accountId) {
+            return { done: false, detail: `credentials are for account ${Account}, environment '${ctx.environment}' deploys to ${ctx.accountId}` };
+        }
+        return { done: true, detail: `${Arn}` };
+    }
+    catch (error) {
+        return { done: false, detail: `no valid credentials: ${error instanceof Error ? error.message : String(error)}` };
+    }
+};
+/** Check-only: the active credentials belong to the environment's account. Catches a stale .env or SSO profile. */
+export const buildIdentityStep = (ctx) => ({
+    id: 'identity',
+    name: `Credentials for account ${ctx.accountId}`,
+    check: () => checkIdentity(ctx),
+    run: async () => {
+        const result = await checkIdentity(ctx);
+        if (!result.done) {
+            throw new Error(`${result.detail}. Log in to the right account (or fix AWS_DEFAULT_ACCOUNT / deploy.config.json) and rerun.`);
+        }
+    },
+});
+//# sourceMappingURL=buildIdentityStep.js.map

package/lib/esm/platforms/aws/setup/buildIdentityStep.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"buildIdentityStep.js","sourceRoot":"","sources":["../../../../../src/platforms/aws/setup/buildIdentityStep.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,wBAAwB,EAAE,SAAS,EAAE,MAAM,qBAAqB,CAAC;AAK1E,MAAM,aAAa,GAAG,KAAK,EAAE,GAAoB,EAA6B,EAAE;IAC9E,IAAI,CAAC;QACH,MAAM,EAAE,OAAO,EAAE,GAAG,EAAE,GAAG,MAAM,IAAI,SAAS,CAAC,EAAE,MAAM,EAAE,GAAG,CAAC,MAAM,EAAE,CAAC,CAAC,IAAI,CAAC,IAAI,wBAAwB,CAAC,EAAE,CAAC,CAAC,CAAC;QAC5G,IAAI,OAAO,KAAK,GAAG,CAAC,SAAS,EAAE,CAAC;YAC9B,OAAO,EAAE,IAAI,EAAE,KAAK,EAAE,MAAM,EAAE,+BAA+B,OAAO,kBAAkB,GAAG,CAAC,WAAW,gBAAgB,GAAG,CAAC,SAAS,EAAE,EAAE,CAAC;QACzI,CAAC;QACD,OAAO,EAAE,IAAI,EAAE,IAAI,EAAE,MAAM,EAAE,GAAG,GAAG,EAAE,EAAE,CAAC;IAC1C,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,OAAO,EAAE,IAAI,EAAE,KAAK,EAAE,MAAM,EAAE,yBAAyB,KAAK,YAAY,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,EAAE,EAAE,CAAC;IACpH,CAAC;AACH,CAAC,CAAC;AAEF,mHAAmH;AACnH,MAAM,CAAC,MAAM,iBAAiB,GAAG,CAAC,GAAoB,EAAa,EAAE,CAAC,CAAC;IACrE,EAAE,EAAE,UAAU;IACd,IAAI,EAAE,2BAA2B,GAAG,CAAC,SAAS,EAAE;IAChD,KAAK,EAAE,GAAG,EAAE,CAAC,aAAa,CAAC,GAAG,CAAC;IAC/B,GAAG,EAAE,KAAK,IAAI,EAAE;QACd,MAAM,MAAM,GAAG,MAAM,aAAa,CAAC,GAAG,CAAC,CAAC;QACxC,IAAI,CAAC,MAAM,CAAC,IAAI,EAAE,CAAC;YACjB,MAAM,IAAI,KAAK,CAAC,GAAG,MAAM,CAAC,MAAM,4FAA4F,CAAC,CAAC;QAChI,CAAC;IACH,CAAC;CACF,CAAC,CAAC","sourcesContent":["import { GetCallerIdentityCommand, STSClient } from '@aws-sdk/client-sts';\n\nimport { SetupCheckResult, SetupStep } from '../../../lib/setupStep';\nimport { AwsSetupContext } from './awsSetupContext';\n\nconst checkIdentity = async (ctx: AwsSetupContext): Promise<SetupCheckResult> => {\n  try {\n    const { Account, Arn } = await new STSClient({ region: ctx.region }).send(new GetCallerIdentityCommand({}));\n    if (Account !== ctx.accountId) {\n      return { done: false, detail: `credentials are for account ${Account}, environment '${ctx.environment}' deploys to ${ctx.accountId}` };\n    }\n    return { done: true, detail: `${Arn}` };\n  } catch (error) {\n    return { done: false, detail: `no valid credentials: ${error instanceof Error ? error.message : String(error)}` };\n  }\n};\n\n/** Check-only: the active credentials belong to the environment's account. Catches a stale .env or SSO profile. */\nexport const buildIdentityStep = (ctx: AwsSetupContext): SetupStep => ({\n  id: 'identity',\n  name: `Credentials for account ${ctx.accountId}`,\n  check: () => checkIdentity(ctx),\n  run: async () => {\n    const result = await checkIdentity(ctx);\n    if (!result.done) {\n      throw new Error(`${result.detail}. Log in to the right account (or fix AWS_DEFAULT_ACCOUNT / deploy.config.json) and rerun.`);\n    }\n  },\n});\n"]}

package/lib/esm/platforms/aws/setup/buildStackSteps.d.ts

@@ -0,0 +1,5 @@
+import { SetupStep } from '../../../lib/setupStep';
+import { AwsSetupContext } from './awsSetupContext';
+export declare const buildAccountStackStep: (ctx: AwsSetupContext) => SetupStep;
+export declare const buildDomainStackStep: (ctx: AwsSetupContext) => SetupStep;
+export declare const buildBootstrapStackStep: (ctx: AwsSetupContext) => SetupStep;

package/lib/esm/platforms/aws/setup/buildStackSteps.js

@@ -0,0 +1,17 @@
+import { qpqDeployAwsCdkUtils } from 'quidproquo-deploy-awscdk';
+import { deployAccountStack, deployBootstrapStack, deployDomainStack } from '../stacks';
+import { describeStackStatus, isStackHealthy } from './describeStackStatus';
+const buildStackStep = (id, name, stackName, region, run) => ({
+    id,
+    name: `${name} (${stackName})`,
+    check: async () => {
+        const status = await describeStackStatus(stackName, region);
+        return status === null ? { done: false, detail: 'not deployed' } : { done: isStackHealthy(status), detail: status };
+    },
+    run,
+});
+export const buildAccountStackStep = (ctx) => buildStackStep('account-stack', 'Account guardrails stack', qpqDeployAwsCdkUtils.getAccountStackName(), ctx.region, () => deployAccountStack(ctx.appName));
+// The domain stack deploys its cert stacks as dependencies, so one step covers certificates too.
+export const buildDomainStackStep = (ctx) => buildStackStep('domain-stack', 'Domain stack: certificates + api domains', qpqDeployAwsCdkUtils.getDomainStackName(ctx.bootstrapQpqConfig), ctx.region, () => deployDomainStack(ctx.appName));
+export const buildBootstrapStackStep = (ctx) => buildStackStep('bootstrap-stack', 'Bootstrap stack: WAF and app-wide resources', qpqDeployAwsCdkUtils.getBootstrapStackName(ctx.bootstrapQpqConfig), ctx.region, () => deployBootstrapStack(ctx.appName));
+//# sourceMappingURL=buildStackSteps.js.map

package/lib/esm/platforms/aws/setup/buildStackSteps.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"buildStackSteps.js","sourceRoot":"","sources":["../../../../../src/platforms/aws/setup/buildStackSteps.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,oBAAoB,EAAE,MAAM,0BAA0B,CAAC;AAGhE,OAAO,EAAE,kBAAkB,EAAE,oBAAoB,EAAE,iBAAiB,EAAE,MAAM,WAAW,CAAC;AAExF,OAAO,EAAE,mBAAmB,EAAE,cAAc,EAAE,MAAM,uBAAuB,CAAC;AAE5E,MAAM,cAAc,GAAG,CAAC,EAAU,EAAE,IAAY,EAAE,SAAiB,EAAE,MAAc,EAAE,GAAwB,EAAa,EAAE,CAAC,CAAC;IAC5H,EAAE;IACF,IAAI,EAAE,GAAG,IAAI,KAAK,SAAS,GAAG;IAC9B,KAAK,EAAE,KAAK,IAAI,EAAE;QAChB,MAAM,MAAM,GAAG,MAAM,mBAAmB,CAAC,SAAS,EAAE,MAAM,CAAC,CAAC;QAC5D,OAAO,MAAM,KAAK,IAAI,CAAC,CAAC,CAAC,EAAE,IAAI,EAAE,KAAK,EAAE,MAAM,EAAE,cAAc,EAAE,CAAC,CAAC,CAAC,EAAE,IAAI,EAAE,cAAc,CAAC,MAAM,CAAC,EAAE,MAAM,EAAE,MAAM,EAAE,CAAC;IACtH,CAAC;IACD,GAAG;CACJ,CAAC,CAAC;AAEH,MAAM,CAAC,MAAM,qBAAqB,GAAG,CAAC,GAAoB,EAAa,EAAE,CACvE,cAAc,CAAC,eAAe,EAAE,0BAA0B,EAAE,oBAAoB,CAAC,mBAAmB,EAAE,EAAE,GAAG,CAAC,MAAM,EAAE,GAAG,EAAE,CACvH,kBAAkB,CAAC,GAAG,CAAC,OAAO,CAAC,CAChC,CAAC;AAEJ,iGAAiG;AACjG,MAAM,CAAC,MAAM,oBAAoB,GAAG,CAAC,GAAoB,EAAa,EAAE,CACtE,cAAc,CACZ,cAAc,EACd,0CAA0C,EAC1C,oBAAoB,CAAC,kBAAkB,CAAC,GAAG,CAAC,kBAAkB,CAAC,EAC/D,GAAG,CAAC,MAAM,EACV,GAAG,EAAE,CAAC,iBAAiB,CAAC,GAAG,CAAC,OAAO,CAAC,CACrC,CAAC;AAEJ,MAAM,CAAC,MAAM,uBAAuB,GAAG,CAAC,GAAoB,EAAa,EAAE,CACzE,cAAc,CACZ,iBAAiB,EACjB,6CAA6C,EAC7C,oBAAoB,CAAC,qBAAqB,CAAC,GAAG,CAAC,kBAAkB,CAAC,EAClE,GAAG,CAAC,MAAM,EACV,GAAG,EAAE,CAAC,oBAAoB,CAAC,GAAG,CAAC,OAAO,CAAC,CACxC,CAAC","sourcesContent":["import { qpqDeployAwsCdkUtils } from 'quidproquo-deploy-awscdk';\n\nimport { SetupStep } from '../../../lib/setupStep';\nimport { deployAccountStack, deployBootstrapStack, deployDomainStack } from '../stacks';\nimport { AwsSetupContext } from './awsSetupContext';\nimport { describeStackStatus, isStackHealthy } from './describeStackStatus';\n\nconst buildStackStep = (id: string, name: string, stackName: string, region: string, run: () => Promise<void>): SetupStep => ({\n  id,\n  name: `${name} (${stackName})`,\n  check: async () => {\n    const status = await describeStackStatus(stackName, region);\n    return status === null ? { done: false, detail: 'not deployed' } : { done: isStackHealthy(status), detail: status };\n  },\n  run,\n});\n\nexport const buildAccountStackStep = (ctx: AwsSetupContext): SetupStep =>\n  buildStackStep('account-stack', 'Account guardrails stack', qpqDeployAwsCdkUtils.getAccountStackName(), ctx.region, () =>\n    deployAccountStack(ctx.appName),\n  );\n\n// The domain stack deploys its cert stacks as dependencies, so one step covers certificates too.\nexport const buildDomainStackStep = (ctx: AwsSetupContext): SetupStep =>\n  buildStackStep(\n    'domain-stack',\n    'Domain stack: certificates + api domains',\n    qpqDeployAwsCdkUtils.getDomainStackName(ctx.bootstrapQpqConfig),\n    ctx.region,\n    () => deployDomainStack(ctx.appName),\n  );\n\nexport const buildBootstrapStackStep = (ctx: AwsSetupContext): SetupStep =>\n  buildStackStep(\n    'bootstrap-stack',\n    'Bootstrap stack: WAF and app-wide resources',\n    qpqDeployAwsCdkUtils.getBootstrapStackName(ctx.bootstrapQpqConfig),\n    ctx.region,\n    () => deployBootstrapStack(ctx.appName),\n  );\n"]}

package/lib/esm/platforms/aws/setup/describeStackStatus.d.ts

@@ -0,0 +1,4 @@
+import { Nullable } from 'quidproquo-core';
+/** A stack's status, or null when it does not exist. */
+export declare const describeStackStatus: (stackName: string, region: string) => Promise<Nullable<string>>;
+export declare const isStackHealthy: (status: Nullable<string>) => boolean;

package/lib/esm/platforms/aws/setup/describeStackStatus.js

@@ -0,0 +1,17 @@
+import { CloudFormationClient, DescribeStacksCommand } from '@aws-sdk/client-cloudformation';
+/** A stack's status, or null when it does not exist. */
+export const describeStackStatus = async (stackName, region) => {
+    try {
+        const { Stacks } = await new CloudFormationClient({ region }).send(new DescribeStacksCommand({ StackName: stackName }));
+        return Stacks?.[0]?.StackStatus ?? null;
+    }
+    catch (error) {
+        if (error instanceof Error && /does not exist/.test(error.message)) {
+            return null;
+        }
+        throw error;
+    }
+};
+const healthyStatuses = ['CREATE_COMPLETE', 'UPDATE_COMPLETE', 'IMPORT_COMPLETE'];
+export const isStackHealthy = (status) => status !== null && healthyStatuses.includes(status);
+//# sourceMappingURL=describeStackStatus.js.map

package/lib/esm/platforms/aws/setup/describeStackStatus.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"describeStackStatus.js","sourceRoot":"","sources":["../../../../../src/platforms/aws/setup/describeStackStatus.ts"],"names":[],"mappings":"AAEA,OAAO,EAAE,oBAAoB,EAAE,qBAAqB,EAAE,MAAM,gCAAgC,CAAC;AAE7F,wDAAwD;AACxD,MAAM,CAAC,MAAM,mBAAmB,GAAG,KAAK,EAAE,SAAiB,EAAE,MAAc,EAA6B,EAAE;IACxG,IAAI,CAAC;QACH,MAAM,EAAE,MAAM,EAAE,GAAG,MAAM,IAAI,oBAAoB,CAAC,EAAE,MAAM,EAAE,CAAC,CAAC,IAAI,CAAC,IAAI,qBAAqB,CAAC,EAAE,SAAS,EAAE,SAAS,EAAE,CAAC,CAAC,CAAC;QACxH,OAAO,MAAM,EAAE,CAAC,CAAC,CAAC,EAAE,WAAW,IAAI,IAAI,CAAC;IAC1C,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,IAAI,KAAK,YAAY,KAAK,IAAI,gBAAgB,CAAC,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,EAAE,CAAC;YACnE,OAAO,IAAI,CAAC;QACd,CAAC;QACD,MAAM,KAAK,CAAC;IACd,CAAC;AACH,CAAC,CAAC;AAEF,MAAM,eAAe,GAAG,CAAC,iBAAiB,EAAE,iBAAiB,EAAE,iBAAiB,CAAC,CAAC;AAElF,MAAM,CAAC,MAAM,cAAc,GAAG,CAAC,MAAwB,EAAW,EAAE,CAAC,MAAM,KAAK,IAAI,IAAI,eAAe,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC","sourcesContent":["import { Nullable } from 'quidproquo-core';\n\nimport { CloudFormationClient, DescribeStacksCommand } from '@aws-sdk/client-cloudformation';\n\n/** A stack's status, or null when it does not exist. */\nexport const describeStackStatus = async (stackName: string, region: string): Promise<Nullable<string>> => {\n  try {\n    const { Stacks } = await new CloudFormationClient({ region }).send(new DescribeStacksCommand({ StackName: stackName }));\n    return Stacks?.[0]?.StackStatus ?? null;\n  } catch (error) {\n    if (error instanceof Error && /does not exist/.test(error.message)) {\n      return null;\n    }\n    throw error;\n  }\n};\n\nconst healthyStatuses = ['CREATE_COMPLETE', 'UPDATE_COMPLETE', 'IMPORT_COMPLETE'];\n\nexport const isStackHealthy = (status: Nullable<string>): boolean => status !== null && healthyStatuses.includes(status);\n"]}

package/lib/esm/platforms/aws/setup/index.d.ts

@@ -0,0 +1 @@
+export * from './awsSetupSteps';

package/lib/esm/platforms/aws/setup/index.js

@@ -0,0 +1,2 @@
+export * from './awsSetupSteps';
+//# sourceMappingURL=index.js.map

package/lib/esm/platforms/aws/setup/index.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../../../../../src/platforms/aws/setup/index.ts"],"names":[],"mappings":"AAAA,cAAc,iBAAiB,CAAC","sourcesContent":["export * from './awsSetupSteps';\n"]}

package/lib/esm/platforms/types.d.ts

@@ -1,6 +1,7 @@
 import { QpqAppDeployEnvironment } from 'quidproquo-deploy-awscdk';
 import { ClearResourcesPlan } from '../lib/clearResourcesPlan';
 import { DeployPlan, TeardownPlan } from '../lib/deployPrompts';
+import { SetupStep } from '../lib/setupStep';
 export declare enum QpqDeployPlatform {
     aws = "aws",
     docker = "docker"
@@ -11,6 +12,7 @@ export interface QpqPlatformDriver {
     goDocker?: (appName: string, plan: DeployPlan) => Promise<void>;
     teardown?: (appName: string, plan: TeardownPlan) => Promise<void>;
     clearResources?: (appName: string, plan: ClearResourcesPlan) => Promise<void>;
+    setupSteps?: (appName: string, environment: string) => Promise<SetupStep[]>;
     publish: (appName: string, serviceNames: string[]) => Promise<void>;
     publishBuild: (appName: string, serviceNames: string[]) => Promise<void>;
     publishUpload: (appName: string, serviceNames: string[]) => Promise<void>;

package/lib/esm/platforms/types.js.map

@@ -1 +1 @@
-{"version":3,"file":"types.js","sourceRoot":"","sources":["../../../src/platforms/types.ts"],"names":[],"mappings":"AAKA,MAAM,CAAN,IAAY,iBAGX;AAHD,WAAY,iBAAiB;IAC3B,gCAAW,CAAA;IACX,sCAAiB,CAAA;AACnB,CAAC,EAHW,iBAAiB,KAAjB,iBAAiB,QAG5B","sourcesContent":["import { QpqAppDeployEnvironment } from 'quidproquo-deploy-awscdk';\n\nimport { ClearResourcesPlan } from '../lib/clearResourcesPlan';\nimport { DeployPlan, TeardownPlan } from '../lib/deployPrompts';\n\nexport enum QpqDeployPlatform {\n  aws = 'aws',\n  docker = 'docker',\n}\n\n// A deploy platform driver — everything that happens after \"what to deploy\"\n// has been decided. `qpq go` resolves the app + environment, prompts the plan,\n// then hands off here; the platform comes from the environment's entry in\n// apps/<app>/deploy.config.json (default aws), so an app can move platforms\n// with a config change instead of a different command.\nexport interface QpqPlatformDriver {\n  // Prime process.env with this platform's deploy identity from the resolved\n  // environment target (already-set env vars win). Service configs read these\n  // vars at load time, so this runs before any infrastructure.ts is required.\n  // Returns human-readable descriptions of anything still missing — deploys\n  // treat that as fatal, local dev commands ignore it.\n  primeDeployIdentity: (target: QpqAppDeployEnvironment | undefined) => string[];\n\n  // Sequential deploy (`qpq go`).\n  go: (appName: string, plan: DeployPlan) => Promise<void>;\n\n  // Parallel containerized deploy (`qpq go:docker`) — optional; drivers that\n  // have no docker strategy simply omit it.\n  goDocker?: (appName: string, plan: DeployPlan) => Promise<void>;\n\n  // Destroy the web/api/inf stacks for selected services (`qpq teardown`) —\n  // optional; drivers with no teardown strategy simply omit it.\n  teardown?: (appName: string, plan: TeardownPlan) => Promise<void>;\n\n  // Empty the stored data of selected resources without touching the stacks\n  // (`qpq clear-resources`) — optional; drivers with no strategy omit it.\n  clearResources?: (appName: string, plan: ClearResourcesPlan) => Promise<void>;\n\n  // Federated remote publishing (`qpq publish[:build|:upload|:deploy]`).\n  publish: (appName: string, serviceNames: string[]) => Promise<void>;\n  publishBuild: (appName: string, serviceNames: string[]) => Promise<void>;\n  publishUpload: (appName: string, serviceNames: string[]) => Promise<void>;\n  publishDeploy: (appName: string, serviceNames: string[]) => Promise<void>;\n}\n"]}
+{"version":3,"file":"types.js","sourceRoot":"","sources":["../../../src/platforms/types.ts"],"names":[],"mappings":"AAMA,MAAM,CAAN,IAAY,iBAGX;AAHD,WAAY,iBAAiB;IAC3B,gCAAW,CAAA;IACX,sCAAiB,CAAA;AACnB,CAAC,EAHW,iBAAiB,KAAjB,iBAAiB,QAG5B","sourcesContent":["import { QpqAppDeployEnvironment } from 'quidproquo-deploy-awscdk';\n\nimport { ClearResourcesPlan } from '../lib/clearResourcesPlan';\nimport { DeployPlan, TeardownPlan } from '../lib/deployPrompts';\nimport { SetupStep } from '../lib/setupStep';\n\nexport enum QpqDeployPlatform {\n  aws = 'aws',\n  docker = 'docker',\n}\n\n// A deploy platform driver — everything that happens after \"what to deploy\"\n// has been decided. `qpq go` resolves the app + environment, prompts the plan,\n// then hands off here; the platform comes from the environment's entry in\n// apps/<app>/deploy.config.json (default aws), so an app can move platforms\n// with a config change instead of a different command.\nexport interface QpqPlatformDriver {\n  // Prime process.env with this platform's deploy identity from the resolved\n  // environment target (already-set env vars win). Service configs read these\n  // vars at load time, so this runs before any infrastructure.ts is required.\n  // Returns human-readable descriptions of anything still missing — deploys\n  // treat that as fatal, local dev commands ignore it.\n  primeDeployIdentity: (target: QpqAppDeployEnvironment | undefined) => string[];\n\n  // Sequential deploy (`qpq go`).\n  go: (appName: string, plan: DeployPlan) => Promise<void>;\n\n  // Parallel containerized deploy (`qpq go:docker`) — optional; drivers that\n  // have no docker strategy simply omit it.\n  goDocker?: (appName: string, plan: DeployPlan) => Promise<void>;\n\n  // Destroy the web/api/inf stacks for selected services (`qpq teardown`) —\n  // optional; drivers with no teardown strategy simply omit it.\n  teardown?: (appName: string, plan: TeardownPlan) => Promise<void>;\n\n  // Empty the stored data of selected resources without touching the stacks\n  // (`qpq clear-resources`) — optional; drivers with no strategy omit it.\n  clearResources?: (appName: string, plan: ClearResourcesPlan) => Promise<void>;\n\n  // The ordered checklist that takes an empty cloud environment to a deployed\n  // one (`qpq setup`) — optional; drivers with nothing to set up omit it.\n  setupSteps?: (appName: string, environment: string) => Promise<SetupStep[]>;\n\n  // Federated remote publishing (`qpq publish[:build|:upload|:deploy]`).\n  publish: (appName: string, serviceNames: string[]) => Promise<void>;\n  publishBuild: (appName: string, serviceNames: string[]) => Promise<void>;\n  publishUpload: (appName: string, serviceNames: string[]) => Promise<void>;\n  publishDeploy: (appName: string, serviceNames: string[]) => Promise<void>;\n}\n"]}

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "quidproquo-cli",
-  "version": "0.1.18",
+  "version": "0.1.20",
   "description": "The qpq CLI — build, dev and deploy orchestration for QPQ apps",
   "main": "./lib/commonjs/index.js",
   "module": "./lib/esm/index.js",
@@ -37,28 +37,31 @@
   },
   "homepage": "https://github.com/qpqjs/quidproquo#readme",
   "dependencies": {
+    "@aws-sdk/client-cloudformation": "^3.1093.0",
     "@aws-sdk/client-dynamodb": "^3.1093.0",
+    "@aws-sdk/client-iam": "^3.1093.0",
+    "@aws-sdk/client-route-53": "^3.1093.0",
     "@aws-sdk/client-s3": "^3.1093.0",
     "@aws-sdk/client-sts": "^3.1093.0",
     "@inquirer/prompts": "^8.5.2",
     "@rspack/dev-server": "^2.1.0",
     "aws-cdk": "^2.1132.1",
     "madge": "^8.0.0",
-    "quidproquo": "0.1.18",
-    "quidproquo-actionprocessor-awslambda": "0.1.18",
-    "quidproquo-config-aws": "0.1.18",
-    "quidproquo-core": "0.1.18",
-    "quidproquo-deploy-awscdk": "0.1.18",
-    "quidproquo-deploy-rspack": "0.1.18",
-    "quidproquo-dev-server": "0.1.18",
-    "quidproquo-webserver": "0.1.18",
+    "quidproquo": "0.1.20",
+    "quidproquo-actionprocessor-awslambda": "0.1.20",
+    "quidproquo-config-aws": "0.1.20",
+    "quidproquo-core": "0.1.20",
+    "quidproquo-deploy-awscdk": "0.1.20",
+    "quidproquo-deploy-rspack": "0.1.20",
+    "quidproquo-dev-server": "0.1.20",
+    "quidproquo-webserver": "0.1.20",
     "ts-node": "^10.9.1",
     "typescript": "^5.8.2"
   },
   "devDependencies": {
     "@rspack/core": "^2.1.2",
     "@types/node": "^22.13.13",
-    "quidproquo-tsconfig": "0.1.18"
+    "quidproquo-tsconfig": "0.1.20"
   },
   "bin": {
     "qpq": "./lib/commonjs/bin/qpq.js"