quidproquo-cli 0.1.19 → 0.1.21

package/lib/esm/platforms/aws/setup/buildCdkBootstrapSteps.js

@@ -0,0 +1,24 @@
+import { qpqConfigAwsUtils } from 'quidproquo-config-aws';
+import { getRoot } from '../../../lib/discovery';
+import { runCommand } from '../../../lib/runCommand';
+import { describeStackStatus, isStackHealthy } from './describeStackStatus';
+/** Every region the app deploys into: the deploy region plus each certificate region (us-east-1 for CloudFront). */
+export const getSetupRegions = (ctx) => [
+    ...new Set([ctx.region, ...qpqConfigAwsUtils.getDomainCertificateConfigs(ctx.bootstrapQpqConfig).map((cert) => cert.region)]),
+];
+const buildCdkBootstrapStep = (ctx, region) => ({
+    id: `cdk-bootstrap-${region}`,
+    name: `CDK bootstrap ${region}`,
+    check: async () => {
+        const status = await describeStackStatus('CDKToolkit', region);
+        if (status === null) {
+            return { done: false, detail: 'no CDKToolkit stack' };
+        }
+        return isStackHealthy(status)
+            ? { done: true, detail: `CDKToolkit ${status}` }
+            : { done: false, detail: `CDKToolkit is ${status}; delete the stack in ${region} before retrying` };
+    },
+    run: () => runCommand('npx', ['cdk', 'bootstrap', `aws://${ctx.accountId}/${region}`], { cwd: getRoot() }),
+});
+export const buildCdkBootstrapSteps = (ctx) => getSetupRegions(ctx).map((region) => buildCdkBootstrapStep(ctx, region));
+//# sourceMappingURL=buildCdkBootstrapSteps.js.map

package/lib/esm/platforms/aws/setup/buildCdkBootstrapSteps.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"buildCdkBootstrapSteps.js","sourceRoot":"","sources":["../../../../../src/platforms/aws/setup/buildCdkBootstrapSteps.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,iBAAiB,EAAE,MAAM,uBAAuB,CAAC;AAE1D,OAAO,EAAE,OAAO,EAAE,MAAM,wBAAwB,CAAC;AACjD,OAAO,EAAE,UAAU,EAAE,MAAM,yBAAyB,CAAC;AAGrD,OAAO,EAAE,mBAAmB,EAAE,cAAc,EAAE,MAAM,uBAAuB,CAAC;AAE5E,oHAAoH;AACpH,MAAM,CAAC,MAAM,eAAe,GAAG,CAAC,GAAoB,EAAY,EAAE,CAAC;IACjE,GAAG,IAAI,GAAG,CAAC,CAAC,GAAG,CAAC,MAAM,EAAE,GAAG,iBAAiB,CAAC,2BAA2B,CAAC,GAAG,CAAC,kBAAkB,CAAC,CAAC,GAAG,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC,CAAC;CAC9H,CAAC;AAEF,MAAM,qBAAqB,GAAG,CAAC,GAAoB,EAAE,MAAc,EAAa,EAAE,CAAC,CAAC;IAClF,EAAE,EAAE,iBAAiB,MAAM,EAAE;IAC7B,IAAI,EAAE,iBAAiB,MAAM,EAAE;IAC/B,KAAK,EAAE,KAAK,IAAI,EAAE;QAChB,MAAM,MAAM,GAAG,MAAM,mBAAmB,CAAC,YAAY,EAAE,MAAM,CAAC,CAAC;QAC/D,IAAI,MAAM,KAAK,IAAI,EAAE,CAAC;YACpB,OAAO,EAAE,IAAI,EAAE,KAAK,EAAE,MAAM,EAAE,qBAAqB,EAAE,CAAC;QACxD,CAAC;QACD,OAAO,cAAc,CAAC,MAAM,CAAC;YAC3B,CAAC,CAAC,EAAE,IAAI,EAAE,IAAI,EAAE,MAAM,EAAE,cAAc,MAAM,EAAE,EAAE;YAChD,CAAC,CAAC,EAAE,IAAI,EAAE,KAAK,EAAE,MAAM,EAAE,iBAAiB,MAAM,yBAAyB,MAAM,kBAAkB,EAAE,CAAC;IACxG,CAAC;IACD,GAAG,EAAE,GAAG,EAAE,CAAC,UAAU,CAAC,KAAK,EAAE,CAAC,KAAK,EAAE,WAAW,EAAE,SAAS,GAAG,CAAC,SAAS,IAAI,MAAM,EAAE,CAAC,EAAE,EAAE,GAAG,EAAE,OAAO,EAAE,EAAE,CAAC;CAC3G,CAAC,CAAC;AAEH,MAAM,CAAC,MAAM,sBAAsB,GAAG,CAAC,GAAoB,EAAe,EAAE,CAAC,eAAe,CAAC,GAAG,CAAC,CAAC,GAAG,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC,qBAAqB,CAAC,GAAG,EAAE,MAAM,CAAC,CAAC,CAAC","sourcesContent":["import { qpqConfigAwsUtils } from 'quidproquo-config-aws';\n\nimport { getRoot } from '../../../lib/discovery';\nimport { runCommand } from '../../../lib/runCommand';\nimport { SetupStep } from '../../../lib/setupStep';\nimport { AwsSetupContext } from './awsSetupContext';\nimport { describeStackStatus, isStackHealthy } from './describeStackStatus';\n\n/** Every region the app deploys into: the deploy region plus each certificate region (us-east-1 for CloudFront). */\nexport const getSetupRegions = (ctx: AwsSetupContext): string[] => [\n  ...new Set([ctx.region, ...qpqConfigAwsUtils.getDomainCertificateConfigs(ctx.bootstrapQpqConfig).map((cert) => cert.region)]),\n];\n\nconst buildCdkBootstrapStep = (ctx: AwsSetupContext, region: string): SetupStep => ({\n  id: `cdk-bootstrap-${region}`,\n  name: `CDK bootstrap ${region}`,\n  check: async () => {\n    const status = await describeStackStatus('CDKToolkit', region);\n    if (status === null) {\n      return { done: false, detail: 'no CDKToolkit stack' };\n    }\n    return isStackHealthy(status)\n      ? { done: true, detail: `CDKToolkit ${status}` }\n      : { done: false, detail: `CDKToolkit is ${status}; delete the stack in ${region} before retrying` };\n  },\n  run: () => runCommand('npx', ['cdk', 'bootstrap', `aws://${ctx.accountId}/${region}`], { cwd: getRoot() }),\n});\n\nexport const buildCdkBootstrapSteps = (ctx: AwsSetupContext): SetupStep[] => getSetupRegions(ctx).map((region) => buildCdkBootstrapStep(ctx, region));\n"]}

package/lib/esm/platforms/aws/setup/buildGithubDeployRoleStep.d.ts

@@ -0,0 +1,4 @@
+import { SetupStep } from '../../../lib/setupStep';
+import { AwsSetupContext } from './awsSetupContext';
+/** Check-only: the GitHub Actions deploy role is declared and deployed, with the values the GitHub Environment needs. */
+export declare const buildGithubDeployRoleStep: (ctx: AwsSetupContext) => SetupStep;

package/lib/esm/platforms/aws/setup/buildGithubDeployRoleStep.js

@@ -0,0 +1,40 @@
+import { awsNamingUtils } from 'quidproquo-actionprocessor-awslambda';
+import { qpqConfigAwsUtils } from 'quidproquo-config-aws';
+import { GetRoleCommand, IAMClient } from '@aws-sdk/client-iam';
+// The role itself is deployed by the bootstrap stack; this step tells you whether the config
+// declares it, whether it exists yet, and what to put in the GitHub Environment once it does.
+const checkDeployRole = async (ctx) => {
+    const config = qpqConfigAwsUtils.getAwsGithubDeployRoleConfig(ctx.bootstrapQpqConfig);
+    if (!config) {
+        return { done: false, detail: 'not declared: add defineAwsGithubDeployRole("owner/repo", { ownerId, repositoryId }) to bootstrap.qpq.ts' };
+    }
+    const roleName = awsNamingUtils.getGithubDeployRoleNameFromConfig(ctx.bootstrapQpqConfig);
+    const githubEnvironment = config.githubEnvironment ?? ctx.environment;
+    try {
+        const { Role } = await new IAMClient({ region: ctx.region }).send(new GetRoleCommand({ RoleName: roleName }));
+        return {
+            done: true,
+            detail: `${Role?.Arn}; GitHub Environment '${githubEnvironment}' needs DEPLOY_ROLE_ARN=<that arn> and AWS_REGION=${ctx.region}`,
+        };
+    }
+    catch (error) {
+        if (error instanceof Error && error.name === 'NoSuchEntityException') {
+            return { done: false, detail: `${roleName} not deployed yet (the bootstrap stack creates it)` };
+        }
+        throw error;
+    }
+};
+/** Check-only: the GitHub Actions deploy role is declared and deployed, with the values the GitHub Environment needs. */
+export const buildGithubDeployRoleStep = (ctx) => ({
+    id: 'github-deploy-role',
+    name: 'GitHub Actions deploy role',
+    check: () => checkDeployRole(ctx),
+    run: async () => {
+        const result = await checkDeployRole(ctx);
+        if (!result.done) {
+            throw new Error(result.detail ?? 'deploy role missing');
+        }
+        console.log(result.detail);
+    },
+});
+//# sourceMappingURL=buildGithubDeployRoleStep.js.map

package/lib/esm/platforms/aws/setup/buildGithubDeployRoleStep.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"buildGithubDeployRoleStep.js","sourceRoot":"","sources":["../../../../../src/platforms/aws/setup/buildGithubDeployRoleStep.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,cAAc,EAAE,MAAM,sCAAsC,CAAC;AACtE,OAAO,EAAE,iBAAiB,EAAE,MAAM,uBAAuB,CAAC;AAE1D,OAAO,EAAE,cAAc,EAAE,SAAS,EAAE,MAAM,qBAAqB,CAAC;AAKhE,6FAA6F;AAC7F,8FAA8F;AAC9F,MAAM,eAAe,GAAG,KAAK,EAAE,GAAoB,EAA6B,EAAE;IAChF,MAAM,MAAM,GAAG,iBAAiB,CAAC,4BAA4B,CAAC,GAAG,CAAC,kBAAkB,CAAC,CAAC;IACtF,IAAI,CAAC,MAAM,EAAE,CAAC;QACZ,OAAO,EAAE,IAAI,EAAE,KAAK,EAAE,MAAM,EAAE,0GAA0G,EAAE,CAAC;IAC7I,CAAC;IAED,MAAM,QAAQ,GAAG,cAAc,CAAC,iCAAiC,CAAC,GAAG,CAAC,kBAAkB,CAAC,CAAC;IAC1F,MAAM,iBAAiB,GAAG,MAAM,CAAC,iBAAiB,IAAI,GAAG,CAAC,WAAW,CAAC;IACtE,IAAI,CAAC;QACH,MAAM,EAAE,IAAI,EAAE,GAAG,MAAM,IAAI,SAAS,CAAC,EAAE,MAAM,EAAE,GAAG,CAAC,MAAM,EAAE,CAAC,CAAC,IAAI,CAAC,IAAI,cAAc,CAAC,EAAE,QAAQ,EAAE,QAAQ,EAAE,CAAC,CAAC,CAAC;QAC9G,OAAO;YACL,IAAI,EAAE,IAAI;YACV,MAAM,EAAE,GAAG,IAAI,EAAE,GAAG,yBAAyB,iBAAiB,qDAAqD,GAAG,CAAC,MAAM,EAAE;SAChI,CAAC;IACJ,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,IAAI,KAAK,YAAY,KAAK,IAAI,KAAK,CAAC,IAAI,KAAK,uBAAuB,EAAE,CAAC;YACrE,OAAO,EAAE,IAAI,EAAE,KAAK,EAAE,MAAM,EAAE,GAAG,QAAQ,oDAAoD,EAAE,CAAC;QAClG,CAAC;QACD,MAAM,KAAK,CAAC;IACd,CAAC;AACH,CAAC,CAAC;AAEF,yHAAyH;AACzH,MAAM,CAAC,MAAM,yBAAyB,GAAG,CAAC,GAAoB,EAAa,EAAE,CAAC,CAAC;IAC7E,EAAE,EAAE,oBAAoB;IACxB,IAAI,EAAE,4BAA4B;IAClC,KAAK,EAAE,GAAG,EAAE,CAAC,eAAe,CAAC,GAAG,CAAC;IACjC,GAAG,EAAE,KAAK,IAAI,EAAE;QACd,MAAM,MAAM,GAAG,MAAM,eAAe,CAAC,GAAG,CAAC,CAAC;QAC1C,IAAI,CAAC,MAAM,CAAC,IAAI,EAAE,CAAC;YACjB,MAAM,IAAI,KAAK,CAAC,MAAM,CAAC,MAAM,IAAI,qBAAqB,CAAC,CAAC;QAC1D,CAAC;QACD,OAAO,CAAC,GAAG,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC;IAC7B,CAAC;CACF,CAAC,CAAC","sourcesContent":["import { awsNamingUtils } from 'quidproquo-actionprocessor-awslambda';\nimport { qpqConfigAwsUtils } from 'quidproquo-config-aws';\n\nimport { GetRoleCommand, IAMClient } from '@aws-sdk/client-iam';\n\nimport { SetupCheckResult, SetupStep } from '../../../lib/setupStep';\nimport { AwsSetupContext } from './awsSetupContext';\n\n// The role itself is deployed by the bootstrap stack; this step tells you whether the config\n// declares it, whether it exists yet, and what to put in the GitHub Environment once it does.\nconst checkDeployRole = async (ctx: AwsSetupContext): Promise<SetupCheckResult> => {\n  const config = qpqConfigAwsUtils.getAwsGithubDeployRoleConfig(ctx.bootstrapQpqConfig);\n  if (!config) {\n    return { done: false, detail: 'not declared: add defineAwsGithubDeployRole(\"owner/repo\", { ownerId, repositoryId }) to bootstrap.qpq.ts' };\n  }\n\n  const roleName = awsNamingUtils.getGithubDeployRoleNameFromConfig(ctx.bootstrapQpqConfig);\n  const githubEnvironment = config.githubEnvironment ?? ctx.environment;\n  try {\n    const { Role } = await new IAMClient({ region: ctx.region }).send(new GetRoleCommand({ RoleName: roleName }));\n    return {\n      done: true,\n      detail: `${Role?.Arn}; GitHub Environment '${githubEnvironment}' needs DEPLOY_ROLE_ARN=<that arn> and AWS_REGION=${ctx.region}`,\n    };\n  } catch (error) {\n    if (error instanceof Error && error.name === 'NoSuchEntityException') {\n      return { done: false, detail: `${roleName} not deployed yet (the bootstrap stack creates it)` };\n    }\n    throw error;\n  }\n};\n\n/** Check-only: the GitHub Actions deploy role is declared and deployed, with the values the GitHub Environment needs. */\nexport const buildGithubDeployRoleStep = (ctx: AwsSetupContext): SetupStep => ({\n  id: 'github-deploy-role',\n  name: 'GitHub Actions deploy role',\n  check: () => checkDeployRole(ctx),\n  run: async () => {\n    const result = await checkDeployRole(ctx);\n    if (!result.done) {\n      throw new Error(result.detail ?? 'deploy role missing');\n    }\n    console.log(result.detail);\n  },\n});\n"]}

package/lib/esm/platforms/aws/setup/buildGithubOidcProviderStep.d.ts

@@ -0,0 +1,4 @@
+import { SetupStep } from '../../../lib/setupStep';
+import { AwsSetupContext } from './awsSetupContext';
+/** Check-only: the account's GitHub Actions OIDC provider is declared in account.qpq.ts and deployed. */
+export declare const buildGithubOidcProviderStep: (ctx: AwsSetupContext) => SetupStep;

package/lib/esm/platforms/aws/setup/buildGithubOidcProviderStep.js

@@ -0,0 +1,40 @@
+import { qpqConfigAwsUtils } from 'quidproquo-config-aws';
+import { GetOpenIDConnectProviderCommand, IAMClient } from '@aws-sdk/client-iam';
+// The provider is created by the account stack (defineAccountGithubOidcProvider in
+// account.qpq.ts), so this only reports: declared or not, present or not.
+const checkProvider = async (ctx) => {
+    const declared = qpqConfigAwsUtils.isAccountGithubOidcProviderDeclared(ctx.accountQpqConfig);
+    const arn = qpqConfigAwsUtils.getGithubOidcProviderArn(ctx.accountId);
+    let exists = false;
+    try {
+        await new IAMClient({ region: ctx.region }).send(new GetOpenIDConnectProviderCommand({ OpenIDConnectProviderArn: arn }));
+        exists = true;
+    }
+    catch (error) {
+        if (!(error instanceof Error && error.name === 'NoSuchEntityException')) {
+            throw error;
+        }
+    }
+    if (!declared) {
+        return {
+            done: false,
+            detail: exists
+                ? `${arn} exists but account.qpq.ts does not declare it: add defineAccountGithubOidcProvider() and delete the hand-made provider before deploying the account stack`
+                : 'not declared: add defineAccountGithubOidcProvider() to account.qpq.ts (the account stack creates it)',
+        };
+    }
+    return exists ? { done: true, detail: arn } : { done: false, detail: 'declared, not deployed yet (the account stack creates it)' };
+};
+/** Check-only: the account's GitHub Actions OIDC provider is declared in account.qpq.ts and deployed. */
+export const buildGithubOidcProviderStep = (ctx) => ({
+    id: 'github-oidc-provider',
+    name: 'GitHub Actions OIDC provider',
+    check: () => checkProvider(ctx),
+    run: async () => {
+        const result = await checkProvider(ctx);
+        if (!result.done) {
+            throw new Error(result.detail ?? 'provider missing');
+        }
+    },
+});
+//# sourceMappingURL=buildGithubOidcProviderStep.js.map

package/lib/esm/platforms/aws/setup/buildGithubOidcProviderStep.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"buildGithubOidcProviderStep.js","sourceRoot":"","sources":["../../../../../src/platforms/aws/setup/buildGithubOidcProviderStep.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,iBAAiB,EAAE,MAAM,uBAAuB,CAAC;AAE1D,OAAO,EAAE,+BAA+B,EAAE,SAAS,EAAE,MAAM,qBAAqB,CAAC;AAKjF,mFAAmF;AACnF,0EAA0E;AAC1E,MAAM,aAAa,GAAG,KAAK,EAAE,GAAoB,EAA6B,EAAE;IAC9E,MAAM,QAAQ,GAAG,iBAAiB,CAAC,mCAAmC,CAAC,GAAG,CAAC,gBAAgB,CAAC,CAAC;IAC7F,MAAM,GAAG,GAAG,iBAAiB,CAAC,wBAAwB,CAAC,GAAG,CAAC,SAAS,CAAC,CAAC;IAEtE,IAAI,MAAM,GAAG,KAAK,CAAC;IACnB,IAAI,CAAC;QACH,MAAM,IAAI,SAAS,CAAC,EAAE,MAAM,EAAE,GAAG,CAAC,MAAM,EAAE,CAAC,CAAC,IAAI,CAAC,IAAI,+BAA+B,CAAC,EAAE,wBAAwB,EAAE,GAAG,EAAE,CAAC,CAAC,CAAC;QACzH,MAAM,GAAG,IAAI,CAAC;IAChB,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,IAAI,CAAC,CAAC,KAAK,YAAY,KAAK,IAAI,KAAK,CAAC,IAAI,KAAK,uBAAuB,CAAC,EAAE,CAAC;YACxE,MAAM,KAAK,CAAC;QACd,CAAC;IACH,CAAC;IAED,IAAI,CAAC,QAAQ,EAAE,CAAC;QACd,OAAO;YACL,IAAI,EAAE,KAAK;YACX,MAAM,EAAE,MAAM;gBACZ,CAAC,CAAC,GAAG,GAAG,4JAA4J;gBACpK,CAAC,CAAC,sGAAsG;SAC3G,CAAC;IACJ,CAAC;IAED,OAAO,MAAM,CAAC,CAAC,CAAC,EAAE,IAAI,EAAE,IAAI,EAAE,MAAM,EAAE,GAAG,EAAE,CAAC,CAAC,CAAC,EAAE,IAAI,EAAE,KAAK,EAAE,MAAM,EAAE,2DAA2D,EAAE,CAAC;AACrI,CAAC,CAAC;AAEF,yGAAyG;AACzG,MAAM,CAAC,MAAM,2BAA2B,GAAG,CAAC,GAAoB,EAAa,EAAE,CAAC,CAAC;IAC/E,EAAE,EAAE,sBAAsB;IAC1B,IAAI,EAAE,8BAA8B;IACpC,KAAK,EAAE,GAAG,EAAE,CAAC,aAAa,CAAC,GAAG,CAAC;IAC/B,GAAG,EAAE,KAAK,IAAI,EAAE;QACd,MAAM,MAAM,GAAG,MAAM,aAAa,CAAC,GAAG,CAAC,CAAC;QACxC,IAAI,CAAC,MAAM,CAAC,IAAI,EAAE,CAAC;YACjB,MAAM,IAAI,KAAK,CAAC,MAAM,CAAC,MAAM,IAAI,kBAAkB,CAAC,CAAC;QACvD,CAAC;IACH,CAAC;CACF,CAAC,CAAC","sourcesContent":["import { qpqConfigAwsUtils } from 'quidproquo-config-aws';\n\nimport { GetOpenIDConnectProviderCommand, IAMClient } from '@aws-sdk/client-iam';\n\nimport { SetupCheckResult, SetupStep } from '../../../lib/setupStep';\nimport { AwsSetupContext } from './awsSetupContext';\n\n// The provider is created by the account stack (defineAccountGithubOidcProvider in\n// account.qpq.ts), so this only reports: declared or not, present or not.\nconst checkProvider = async (ctx: AwsSetupContext): Promise<SetupCheckResult> => {\n  const declared = qpqConfigAwsUtils.isAccountGithubOidcProviderDeclared(ctx.accountQpqConfig);\n  const arn = qpqConfigAwsUtils.getGithubOidcProviderArn(ctx.accountId);\n\n  let exists = false;\n  try {\n    await new IAMClient({ region: ctx.region }).send(new GetOpenIDConnectProviderCommand({ OpenIDConnectProviderArn: arn }));\n    exists = true;\n  } catch (error) {\n    if (!(error instanceof Error && error.name === 'NoSuchEntityException')) {\n      throw error;\n    }\n  }\n\n  if (!declared) {\n    return {\n      done: false,\n      detail: exists\n        ? `${arn} exists but account.qpq.ts does not declare it: add defineAccountGithubOidcProvider() and delete the hand-made provider before deploying the account stack`\n        : 'not declared: add defineAccountGithubOidcProvider() to account.qpq.ts (the account stack creates it)',\n    };\n  }\n\n  return exists ? { done: true, detail: arn } : { done: false, detail: 'declared, not deployed yet (the account stack creates it)' };\n};\n\n/** Check-only: the account's GitHub Actions OIDC provider is declared in account.qpq.ts and deployed. */\nexport const buildGithubOidcProviderStep = (ctx: AwsSetupContext): SetupStep => ({\n  id: 'github-oidc-provider',\n  name: 'GitHub Actions OIDC provider',\n  check: () => checkProvider(ctx),\n  run: async () => {\n    const result = await checkProvider(ctx);\n    if (!result.done) {\n      throw new Error(result.detail ?? 'provider missing');\n    }\n  },\n});\n"]}

package/lib/esm/platforms/aws/setup/buildHostedZonesStep.d.ts

@@ -0,0 +1,4 @@
+import { SetupStep } from '../../../lib/setupStep';
+import { AwsSetupContext } from './awsSetupContext';
+/** Check-only: the Route53 zones the deploy will write records into exist in this account. */
+export declare const buildHostedZonesStep: (ctx: AwsSetupContext) => SetupStep;

package/lib/esm/platforms/aws/setup/buildHostedZonesStep.js

@@ -0,0 +1,49 @@
+import { qpqDeployAwsCdkUtils } from 'quidproquo-deploy-awscdk';
+import { qpqWebServerUtils } from 'quidproquo-webserver';
+import { ListHostedZonesByNameCommand, Route53Client } from '@aws-sdk/client-route-53';
+// The zones the environment writes records into: one per root, chosen the way the
+// CDK chooses them (each root's site root under the app's resolver, or the root).
+const getRequiredZones = (ctx) => {
+    const config = ctx.bootstrapQpqConfig;
+    return [
+        ...new Set(qpqWebServerUtils
+            .getRootDomains(config)
+            .map((rootDomain) => qpqDeployAwsCdkUtils.resolveHostedZoneForHost(config, qpqDeployAwsCdkUtils.resolveDeployHostForRoot(config, rootDomain, {})))),
+    ];
+};
+const zoneExists = async (client, zoneName) => {
+    const { HostedZones } = await client.send(new ListHostedZonesByNameCommand({ DNSName: zoneName, MaxItems: 1 }));
+    return (HostedZones ?? []).some((zone) => zone.Name === `${zoneName}.` && !zone.Config?.PrivateZone);
+};
+const checkHostedZones = async (ctx) => {
+    const required = getRequiredZones(ctx);
+    if (required.length === 0) {
+        return { done: true, detail: 'no domains declared' };
+    }
+    const client = new Route53Client({ region: ctx.region });
+    const missing = [];
+    for (const zoneName of required) {
+        if (!(await zoneExists(client, zoneName))) {
+            missing.push(zoneName);
+        }
+    }
+    return missing.length === 0
+        ? { done: true, detail: required.join(', ') }
+        : {
+            done: false,
+            detail: `missing ${missing.join(', ')}: create each as a public hosted zone here and delegate it (NS record) from its parent zone`,
+        };
+};
+/** Check-only: the Route53 zones the deploy will write records into exist in this account. */
+export const buildHostedZonesStep = (ctx) => ({
+    id: 'hosted-zones',
+    name: 'Route53 hosted zones',
+    check: () => checkHostedZones(ctx),
+    run: async () => {
+        const result = await checkHostedZones(ctx);
+        if (!result.done) {
+            throw new Error(result.detail ?? 'hosted zones missing');
+        }
+    },
+});
+//# sourceMappingURL=buildHostedZonesStep.js.map

package/lib/esm/platforms/aws/setup/buildHostedZonesStep.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"buildHostedZonesStep.js","sourceRoot":"","sources":["../../../../../src/platforms/aws/setup/buildHostedZonesStep.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,oBAAoB,EAAE,MAAM,0BAA0B,CAAC;AAChE,OAAO,EAAE,iBAAiB,EAAE,MAAM,sBAAsB,CAAC;AAEzD,OAAO,EAAE,4BAA4B,EAAE,aAAa,EAAE,MAAM,0BAA0B,CAAC;AAKvF,kFAAkF;AAClF,kFAAkF;AAClF,MAAM,gBAAgB,GAAG,CAAC,GAAoB,EAAY,EAAE;IAC1D,MAAM,MAAM,GAAG,GAAG,CAAC,kBAAkB,CAAC;IACtC,OAAO;QACL,GAAG,IAAI,GAAG,CACR,iBAAiB;aACd,cAAc,CAAC,MAAM,CAAC;aACtB,GAAG,CAAC,CAAC,UAAU,EAAE,EAAE,CAClB,oBAAoB,CAAC,wBAAwB,CAAC,MAAM,EAAE,oBAAoB,CAAC,wBAAwB,CAAC,MAAM,EAAE,UAAU,EAAE,EAAE,CAAC,CAAC,CAC7H,CACJ;KACF,CAAC;AACJ,CAAC,CAAC;AAEF,MAAM,UAAU,GAAG,KAAK,EAAE,MAAqB,EAAE,QAAgB,EAAoB,EAAE;IACrF,MAAM,EAAE,WAAW,EAAE,GAAG,MAAM,MAAM,CAAC,IAAI,CAAC,IAAI,4BAA4B,CAAC,EAAE,OAAO,EAAE,QAAQ,EAAE,QAAQ,EAAE,CAAC,EAAE,CAAC,CAAC,CAAC;IAChH,OAAO,CAAC,WAAW,IAAI,EAAE,CAAC,CAAC,IAAI,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,IAAI,CAAC,IAAI,KAAK,GAAG,QAAQ,GAAG,IAAI,CAAC,IAAI,CAAC,MAAM,EAAE,WAAW,CAAC,CAAC;AACvG,CAAC,CAAC;AAEF,MAAM,gBAAgB,GAAG,KAAK,EAAE,GAAoB,EAA6B,EAAE;IACjF,MAAM,QAAQ,GAAG,gBAAgB,CAAC,GAAG,CAAC,CAAC;IACvC,IAAI,QAAQ,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QAC1B,OAAO,EAAE,IAAI,EAAE,IAAI,EAAE,MAAM,EAAE,qBAAqB,EAAE,CAAC;IACvD,CAAC;IAED,MAAM,MAAM,GAAG,IAAI,aAAa,CAAC,EAAE,MAAM,EAAE,GAAG,CAAC,MAAM,EAAE,CAAC,CAAC;IACzD,MAAM,OAAO,GAAa,EAAE,CAAC;IAC7B,KAAK,MAAM,QAAQ,IAAI,QAAQ,EAAE,CAAC;QAChC,IAAI,CAAC,CAAC,MAAM,UAAU,CAAC,MAAM,EAAE,QAAQ,CAAC,CAAC,EAAE,CAAC;YAC1C,OAAO,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC;QACzB,CAAC;IACH,CAAC;IAED,OAAO,OAAO,CAAC,MAAM,KAAK,CAAC;QACzB,CAAC,CAAC,EAAE,IAAI,EAAE,IAAI,EAAE,MAAM,EAAE,QAAQ,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE;QAC7C,CAAC,CAAC;YACE,IAAI,EAAE,KAAK;YACX,MAAM,EAAE,WAAW,OAAO,CAAC,IAAI,CAAC,IAAI,CAAC,6FAA6F;SACnI,CAAC;AACR,CAAC,CAAC;AAEF,8FAA8F;AAC9F,MAAM,CAAC,MAAM,oBAAoB,GAAG,CAAC,GAAoB,EAAa,EAAE,CAAC,CAAC;IACxE,EAAE,EAAE,cAAc;IAClB,IAAI,EAAE,sBAAsB;IAC5B,KAAK,EAAE,GAAG,EAAE,CAAC,gBAAgB,CAAC,GAAG,CAAC;IAClC,GAAG,EAAE,KAAK,IAAI,EAAE;QACd,MAAM,MAAM,GAAG,MAAM,gBAAgB,CAAC,GAAG,CAAC,CAAC;QAC3C,IAAI,CAAC,MAAM,CAAC,IAAI,EAAE,CAAC;YACjB,MAAM,IAAI,KAAK,CAAC,MAAM,CAAC,MAAM,IAAI,sBAAsB,CAAC,CAAC;QAC3D,CAAC;IACH,CAAC;CACF,CAAC,CAAC","sourcesContent":["import { qpqDeployAwsCdkUtils } from 'quidproquo-deploy-awscdk';\nimport { qpqWebServerUtils } from 'quidproquo-webserver';\n\nimport { ListHostedZonesByNameCommand, Route53Client } from '@aws-sdk/client-route-53';\n\nimport { SetupCheckResult, SetupStep } from '../../../lib/setupStep';\nimport { AwsSetupContext } from './awsSetupContext';\n\n// The zones the environment writes records into: one per root, chosen the way the\n// CDK chooses them (each root's site root under the app's resolver, or the root).\nconst getRequiredZones = (ctx: AwsSetupContext): string[] => {\n  const config = ctx.bootstrapQpqConfig;\n  return [\n    ...new Set(\n      qpqWebServerUtils\n        .getRootDomains(config)\n        .map((rootDomain) =>\n          qpqDeployAwsCdkUtils.resolveHostedZoneForHost(config, qpqDeployAwsCdkUtils.resolveDeployHostForRoot(config, rootDomain, {})),\n        ),\n    ),\n  ];\n};\n\nconst zoneExists = async (client: Route53Client, zoneName: string): Promise<boolean> => {\n  const { HostedZones } = await client.send(new ListHostedZonesByNameCommand({ DNSName: zoneName, MaxItems: 1 }));\n  return (HostedZones ?? []).some((zone) => zone.Name === `${zoneName}.` && !zone.Config?.PrivateZone);\n};\n\nconst checkHostedZones = async (ctx: AwsSetupContext): Promise<SetupCheckResult> => {\n  const required = getRequiredZones(ctx);\n  if (required.length === 0) {\n    return { done: true, detail: 'no domains declared' };\n  }\n\n  const client = new Route53Client({ region: ctx.region });\n  const missing: string[] = [];\n  for (const zoneName of required) {\n    if (!(await zoneExists(client, zoneName))) {\n      missing.push(zoneName);\n    }\n  }\n\n  return missing.length === 0\n    ? { done: true, detail: required.join(', ') }\n    : {\n        done: false,\n        detail: `missing ${missing.join(', ')}: create each as a public hosted zone here and delegate it (NS record) from its parent zone`,\n      };\n};\n\n/** Check-only: the Route53 zones the deploy will write records into exist in this account. */\nexport const buildHostedZonesStep = (ctx: AwsSetupContext): SetupStep => ({\n  id: 'hosted-zones',\n  name: 'Route53 hosted zones',\n  check: () => checkHostedZones(ctx),\n  run: async () => {\n    const result = await checkHostedZones(ctx);\n    if (!result.done) {\n      throw new Error(result.detail ?? 'hosted zones missing');\n    }\n  },\n});\n"]}

package/lib/esm/platforms/aws/setup/buildIamCapabilityStep.d.ts

@@ -0,0 +1,4 @@
+import { SetupStep } from '../../../lib/setupStep';
+import { AwsSetupContext } from './awsSetupContext';
+/** Check-only: the credentials can manage IAM, which every CDK deploy needs. */
+export declare const buildIamCapabilityStep: (ctx: AwsSetupContext) => SetupStep;

package/lib/esm/platforms/aws/setup/buildIamCapabilityStep.js

@@ -0,0 +1,34 @@
+import { GetRoleCommand, IAMClient } from '@aws-sdk/client-iam';
+// CDK bootstrap and every deploy create IAM roles. PowerUserAccess fails on the
+// first iam:GetRole for a cdk-* role, so probe exactly that: a NoSuchEntity
+// answer means the permission is there, AccessDenied means it is not.
+const checkIamCapability = async (ctx) => {
+    const roleName = `cdk-hnb659fds-cfn-exec-role-${ctx.accountId}-${ctx.region}`;
+    try {
+        await new IAMClient({ region: ctx.region }).send(new GetRoleCommand({ RoleName: roleName }));
+        return { done: true, detail: 'iam:GetRole allowed' };
+    }
+    catch (error) {
+        const name = error instanceof Error ? error.name : '';
+        if (name === 'NoSuchEntityException') {
+            return { done: true, detail: 'iam:GetRole allowed' };
+        }
+        return {
+            done: false,
+            detail: `iam:GetRole denied (${name}); the permission set needs IAM rights (AdministratorAccess or a custom set adding iam:*)`,
+        };
+    }
+};
+/** Check-only: the credentials can manage IAM, which every CDK deploy needs. */
+export const buildIamCapabilityStep = (ctx) => ({
+    id: 'iam',
+    name: 'IAM rights on the credentials',
+    check: () => checkIamCapability(ctx),
+    run: async () => {
+        const result = await checkIamCapability(ctx);
+        if (!result.done) {
+            throw new Error(result.detail ?? 'IAM rights missing');
+        }
+    },
+});
+//# sourceMappingURL=buildIamCapabilityStep.js.map

package/lib/esm/platforms/aws/setup/buildIamCapabilityStep.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"buildIamCapabilityStep.js","sourceRoot":"","sources":["../../../../../src/platforms/aws/setup/buildIamCapabilityStep.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,cAAc,EAAE,SAAS,EAAE,MAAM,qBAAqB,CAAC;AAKhE,gFAAgF;AAChF,4EAA4E;AAC5E,sEAAsE;AACtE,MAAM,kBAAkB,GAAG,KAAK,EAAE,GAAoB,EAA6B,EAAE;IACnF,MAAM,QAAQ,GAAG,+BAA+B,GAAG,CAAC,SAAS,IAAI,GAAG,CAAC,MAAM,EAAE,CAAC;IAC9E,IAAI,CAAC;QACH,MAAM,IAAI,SAAS,CAAC,EAAE,MAAM,EAAE,GAAG,CAAC,MAAM,EAAE,CAAC,CAAC,IAAI,CAAC,IAAI,cAAc,CAAC,EAAE,QAAQ,EAAE,QAAQ,EAAE,CAAC,CAAC,CAAC;QAC7F,OAAO,EAAE,IAAI,EAAE,IAAI,EAAE,MAAM,EAAE,qBAAqB,EAAE,CAAC;IACvD,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,MAAM,IAAI,GAAG,KAAK,YAAY,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC;QACtD,IAAI,IAAI,KAAK,uBAAuB,EAAE,CAAC;YACrC,OAAO,EAAE,IAAI,EAAE,IAAI,EAAE,MAAM,EAAE,qBAAqB,EAAE,CAAC;QACvD,CAAC;QACD,OAAO;YACL,IAAI,EAAE,KAAK;YACX,MAAM,EAAE,uBAAuB,IAAI,2FAA2F;SAC/H,CAAC;IACJ,CAAC;AACH,CAAC,CAAC;AAEF,gFAAgF;AAChF,MAAM,CAAC,MAAM,sBAAsB,GAAG,CAAC,GAAoB,EAAa,EAAE,CAAC,CAAC;IAC1E,EAAE,EAAE,KAAK;IACT,IAAI,EAAE,+BAA+B;IACrC,KAAK,EAAE,GAAG,EAAE,CAAC,kBAAkB,CAAC,GAAG,CAAC;IACpC,GAAG,EAAE,KAAK,IAAI,EAAE;QACd,MAAM,MAAM,GAAG,MAAM,kBAAkB,CAAC,GAAG,CAAC,CAAC;QAC7C,IAAI,CAAC,MAAM,CAAC,IAAI,EAAE,CAAC;YACjB,MAAM,IAAI,KAAK,CAAC,MAAM,CAAC,MAAM,IAAI,oBAAoB,CAAC,CAAC;QACzD,CAAC;IACH,CAAC;CACF,CAAC,CAAC","sourcesContent":["import { GetRoleCommand, IAMClient } from '@aws-sdk/client-iam';\n\nimport { SetupCheckResult, SetupStep } from '../../../lib/setupStep';\nimport { AwsSetupContext } from './awsSetupContext';\n\n// CDK bootstrap and every deploy create IAM roles. PowerUserAccess fails on the\n// first iam:GetRole for a cdk-* role, so probe exactly that: a NoSuchEntity\n// answer means the permission is there, AccessDenied means it is not.\nconst checkIamCapability = async (ctx: AwsSetupContext): Promise<SetupCheckResult> => {\n  const roleName = `cdk-hnb659fds-cfn-exec-role-${ctx.accountId}-${ctx.region}`;\n  try {\n    await new IAMClient({ region: ctx.region }).send(new GetRoleCommand({ RoleName: roleName }));\n    return { done: true, detail: 'iam:GetRole allowed' };\n  } catch (error) {\n    const name = error instanceof Error ? error.name : '';\n    if (name === 'NoSuchEntityException') {\n      return { done: true, detail: 'iam:GetRole allowed' };\n    }\n    return {\n      done: false,\n      detail: `iam:GetRole denied (${name}); the permission set needs IAM rights (AdministratorAccess or a custom set adding iam:*)`,\n    };\n  }\n};\n\n/** Check-only: the credentials can manage IAM, which every CDK deploy needs. */\nexport const buildIamCapabilityStep = (ctx: AwsSetupContext): SetupStep => ({\n  id: 'iam',\n  name: 'IAM rights on the credentials',\n  check: () => checkIamCapability(ctx),\n  run: async () => {\n    const result = await checkIamCapability(ctx);\n    if (!result.done) {\n      throw new Error(result.detail ?? 'IAM rights missing');\n    }\n  },\n});\n"]}

package/lib/esm/platforms/aws/setup/buildIdentityStep.d.ts

@@ -0,0 +1,4 @@
+import { SetupStep } from '../../../lib/setupStep';
+import { AwsSetupContext } from './awsSetupContext';
+/** Check-only: the active credentials belong to the environment's account. Catches a stale .env or SSO profile. */
+export declare const buildIdentityStep: (ctx: AwsSetupContext) => SetupStep;

package/lib/esm/platforms/aws/setup/buildIdentityStep.js

@@ -0,0 +1,26 @@
+import { GetCallerIdentityCommand, STSClient } from '@aws-sdk/client-sts';
+const checkIdentity = async (ctx) => {
+    try {
+        const { Account, Arn } = await new STSClient({ region: ctx.region }).send(new GetCallerIdentityCommand({}));
+        if (Account !== ctx.accountId) {
+            return { done: false, detail: `credentials are for account ${Account}, environment '${ctx.environment}' deploys to ${ctx.accountId}` };
+        }
+        return { done: true, detail: `${Arn}` };
+    }
+    catch (error) {
+        return { done: false, detail: `no valid credentials: ${error instanceof Error ? error.message : String(error)}` };
+    }
+};
+/** Check-only: the active credentials belong to the environment's account. Catches a stale .env or SSO profile. */
+export const buildIdentityStep = (ctx) => ({
+    id: 'identity',
+    name: `Credentials for account ${ctx.accountId}`,
+    check: () => checkIdentity(ctx),
+    run: async () => {
+        const result = await checkIdentity(ctx);
+        if (!result.done) {
+            throw new Error(`${result.detail}. Log in to the right account (or fix AWS_DEFAULT_ACCOUNT / deploy.config.json) and rerun.`);
+        }
+    },
+});
+//# sourceMappingURL=buildIdentityStep.js.map

package/lib/esm/platforms/aws/setup/buildIdentityStep.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"buildIdentityStep.js","sourceRoot":"","sources":["../../../../../src/platforms/aws/setup/buildIdentityStep.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,wBAAwB,EAAE,SAAS,EAAE,MAAM,qBAAqB,CAAC;AAK1E,MAAM,aAAa,GAAG,KAAK,EAAE,GAAoB,EAA6B,EAAE;IAC9E,IAAI,CAAC;QACH,MAAM,EAAE,OAAO,EAAE,GAAG,EAAE,GAAG,MAAM,IAAI,SAAS,CAAC,EAAE,MAAM,EAAE,GAAG,CAAC,MAAM,EAAE,CAAC,CAAC,IAAI,CAAC,IAAI,wBAAwB,CAAC,EAAE,CAAC,CAAC,CAAC;QAC5G,IAAI,OAAO,KAAK,GAAG,CAAC,SAAS,EAAE,CAAC;YAC9B,OAAO,EAAE,IAAI,EAAE,KAAK,EAAE,MAAM,EAAE,+BAA+B,OAAO,kBAAkB,GAAG,CAAC,WAAW,gBAAgB,GAAG,CAAC,SAAS,EAAE,EAAE,CAAC;QACzI,CAAC;QACD,OAAO,EAAE,IAAI,EAAE,IAAI,EAAE,MAAM,EAAE,GAAG,GAAG,EAAE,EAAE,CAAC;IAC1C,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,OAAO,EAAE,IAAI,EAAE,KAAK,EAAE,MAAM,EAAE,yBAAyB,KAAK,YAAY,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,EAAE,EAAE,CAAC;IACpH,CAAC;AACH,CAAC,CAAC;AAEF,mHAAmH;AACnH,MAAM,CAAC,MAAM,iBAAiB,GAAG,CAAC,GAAoB,EAAa,EAAE,CAAC,CAAC;IACrE,EAAE,EAAE,UAAU;IACd,IAAI,EAAE,2BAA2B,GAAG,CAAC,SAAS,EAAE;IAChD,KAAK,EAAE,GAAG,EAAE,CAAC,aAAa,CAAC,GAAG,CAAC;IAC/B,GAAG,EAAE,KAAK,IAAI,EAAE;QACd,MAAM,MAAM,GAAG,MAAM,aAAa,CAAC,GAAG,CAAC,CAAC;QACxC,IAAI,CAAC,MAAM,CAAC,IAAI,EAAE,CAAC;YACjB,MAAM,IAAI,KAAK,CAAC,GAAG,MAAM,CAAC,MAAM,4FAA4F,CAAC,CAAC;QAChI,CAAC;IACH,CAAC;CACF,CAAC,CAAC","sourcesContent":["import { GetCallerIdentityCommand, STSClient } from '@aws-sdk/client-sts';\n\nimport { SetupCheckResult, SetupStep } from '../../../lib/setupStep';\nimport { AwsSetupContext } from './awsSetupContext';\n\nconst checkIdentity = async (ctx: AwsSetupContext): Promise<SetupCheckResult> => {\n  try {\n    const { Account, Arn } = await new STSClient({ region: ctx.region }).send(new GetCallerIdentityCommand({}));\n    if (Account !== ctx.accountId) {\n      return { done: false, detail: `credentials are for account ${Account}, environment '${ctx.environment}' deploys to ${ctx.accountId}` };\n    }\n    return { done: true, detail: `${Arn}` };\n  } catch (error) {\n    return { done: false, detail: `no valid credentials: ${error instanceof Error ? error.message : String(error)}` };\n  }\n};\n\n/** Check-only: the active credentials belong to the environment's account. Catches a stale .env or SSO profile. */\nexport const buildIdentityStep = (ctx: AwsSetupContext): SetupStep => ({\n  id: 'identity',\n  name: `Credentials for account ${ctx.accountId}`,\n  check: () => checkIdentity(ctx),\n  run: async () => {\n    const result = await checkIdentity(ctx);\n    if (!result.done) {\n      throw new Error(`${result.detail}. Log in to the right account (or fix AWS_DEFAULT_ACCOUNT / deploy.config.json) and rerun.`);\n    }\n  },\n});\n"]}

package/lib/esm/platforms/aws/setup/buildStackSteps.d.ts

@@ -0,0 +1,5 @@
+import { SetupStep } from '../../../lib/setupStep';
+import { AwsSetupContext } from './awsSetupContext';
+export declare const buildAccountStackStep: (ctx: AwsSetupContext) => SetupStep;
+export declare const buildDomainStackStep: (ctx: AwsSetupContext) => SetupStep;
+export declare const buildBootstrapStackStep: (ctx: AwsSetupContext) => SetupStep;

package/lib/esm/platforms/aws/setup/buildStackSteps.js

@@ -0,0 +1,17 @@
+import { qpqDeployAwsCdkUtils } from 'quidproquo-deploy-awscdk';
+import { deployAccountStack, deployBootstrapStack, deployDomainStack } from '../stacks';
+import { describeStackStatus, isStackHealthy } from './describeStackStatus';
+const buildStackStep = (id, name, stackName, region, run) => ({
+    id,
+    name: `${name} (${stackName})`,
+    check: async () => {
+        const status = await describeStackStatus(stackName, region);
+        return status === null ? { done: false, detail: 'not deployed' } : { done: isStackHealthy(status), detail: status };
+    },
+    run,
+});
+export const buildAccountStackStep = (ctx) => buildStackStep('account-stack', 'Account guardrails stack', qpqDeployAwsCdkUtils.getAccountStackName(), ctx.region, () => deployAccountStack(ctx.appName));
+// The domain stack deploys its cert stacks as dependencies, so one step covers certificates too.
+export const buildDomainStackStep = (ctx) => buildStackStep('domain-stack', 'Domain stack: certificates + api domains', qpqDeployAwsCdkUtils.getDomainStackName(ctx.bootstrapQpqConfig), ctx.region, () => deployDomainStack(ctx.appName));
+export const buildBootstrapStackStep = (ctx) => buildStackStep('bootstrap-stack', 'Bootstrap stack: WAF and app-wide resources', qpqDeployAwsCdkUtils.getBootstrapStackName(ctx.bootstrapQpqConfig), ctx.region, () => deployBootstrapStack(ctx.appName));
+//# sourceMappingURL=buildStackSteps.js.map

package/lib/esm/platforms/aws/setup/buildStackSteps.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"buildStackSteps.js","sourceRoot":"","sources":["../../../../../src/platforms/aws/setup/buildStackSteps.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,oBAAoB,EAAE,MAAM,0BAA0B,CAAC;AAGhE,OAAO,EAAE,kBAAkB,EAAE,oBAAoB,EAAE,iBAAiB,EAAE,MAAM,WAAW,CAAC;AAExF,OAAO,EAAE,mBAAmB,EAAE,cAAc,EAAE,MAAM,uBAAuB,CAAC;AAE5E,MAAM,cAAc,GAAG,CAAC,EAAU,EAAE,IAAY,EAAE,SAAiB,EAAE,MAAc,EAAE,GAAwB,EAAa,EAAE,CAAC,CAAC;IAC5H,EAAE;IACF,IAAI,EAAE,GAAG,IAAI,KAAK,SAAS,GAAG;IAC9B,KAAK,EAAE,KAAK,IAAI,EAAE;QAChB,MAAM,MAAM,GAAG,MAAM,mBAAmB,CAAC,SAAS,EAAE,MAAM,CAAC,CAAC;QAC5D,OAAO,MAAM,KAAK,IAAI,CAAC,CAAC,CAAC,EAAE,IAAI,EAAE,KAAK,EAAE,MAAM,EAAE,cAAc,EAAE,CAAC,CAAC,CAAC,EAAE,IAAI,EAAE,cAAc,CAAC,MAAM,CAAC,EAAE,MAAM,EAAE,MAAM,EAAE,CAAC;IACtH,CAAC;IACD,GAAG;CACJ,CAAC,CAAC;AAEH,MAAM,CAAC,MAAM,qBAAqB,GAAG,CAAC,GAAoB,EAAa,EAAE,CACvE,cAAc,CAAC,eAAe,EAAE,0BAA0B,EAAE,oBAAoB,CAAC,mBAAmB,EAAE,EAAE,GAAG,CAAC,MAAM,EAAE,GAAG,EAAE,CACvH,kBAAkB,CAAC,GAAG,CAAC,OAAO,CAAC,CAChC,CAAC;AAEJ,iGAAiG;AACjG,MAAM,CAAC,MAAM,oBAAoB,GAAG,CAAC,GAAoB,EAAa,EAAE,CACtE,cAAc,CACZ,cAAc,EACd,0CAA0C,EAC1C,oBAAoB,CAAC,kBAAkB,CAAC,GAAG,CAAC,kBAAkB,CAAC,EAC/D,GAAG,CAAC,MAAM,EACV,GAAG,EAAE,CAAC,iBAAiB,CAAC,GAAG,CAAC,OAAO,CAAC,CACrC,CAAC;AAEJ,MAAM,CAAC,MAAM,uBAAuB,GAAG,CAAC,GAAoB,EAAa,EAAE,CACzE,cAAc,CACZ,iBAAiB,EACjB,6CAA6C,EAC7C,oBAAoB,CAAC,qBAAqB,CAAC,GAAG,CAAC,kBAAkB,CAAC,EAClE,GAAG,CAAC,MAAM,EACV,GAAG,EAAE,CAAC,oBAAoB,CAAC,GAAG,CAAC,OAAO,CAAC,CACxC,CAAC","sourcesContent":["import { qpqDeployAwsCdkUtils } from 'quidproquo-deploy-awscdk';\n\nimport { SetupStep } from '../../../lib/setupStep';\nimport { deployAccountStack, deployBootstrapStack, deployDomainStack } from '../stacks';\nimport { AwsSetupContext } from './awsSetupContext';\nimport { describeStackStatus, isStackHealthy } from './describeStackStatus';\n\nconst buildStackStep = (id: string, name: string, stackName: string, region: string, run: () => Promise<void>): SetupStep => ({\n  id,\n  name: `${name} (${stackName})`,\n  check: async () => {\n    const status = await describeStackStatus(stackName, region);\n    return status === null ? { done: false, detail: 'not deployed' } : { done: isStackHealthy(status), detail: status };\n  },\n  run,\n});\n\nexport const buildAccountStackStep = (ctx: AwsSetupContext): SetupStep =>\n  buildStackStep('account-stack', 'Account guardrails stack', qpqDeployAwsCdkUtils.getAccountStackName(), ctx.region, () =>\n    deployAccountStack(ctx.appName),\n  );\n\n// The domain stack deploys its cert stacks as dependencies, so one step covers certificates too.\nexport const buildDomainStackStep = (ctx: AwsSetupContext): SetupStep =>\n  buildStackStep(\n    'domain-stack',\n    'Domain stack: certificates + api domains',\n    qpqDeployAwsCdkUtils.getDomainStackName(ctx.bootstrapQpqConfig),\n    ctx.region,\n    () => deployDomainStack(ctx.appName),\n  );\n\nexport const buildBootstrapStackStep = (ctx: AwsSetupContext): SetupStep =>\n  buildStackStep(\n    'bootstrap-stack',\n    'Bootstrap stack: WAF and app-wide resources',\n    qpqDeployAwsCdkUtils.getBootstrapStackName(ctx.bootstrapQpqConfig),\n    ctx.region,\n    () => deployBootstrapStack(ctx.appName),\n  );\n"]}

package/lib/esm/platforms/aws/setup/describeStackStatus.d.ts

@@ -0,0 +1,4 @@
+import { Nullable } from 'quidproquo-core';
+/** A stack's status, or null when it does not exist. */
+export declare const describeStackStatus: (stackName: string, region: string) => Promise<Nullable<string>>;
+export declare const isStackHealthy: (status: Nullable<string>) => boolean;

package/lib/esm/platforms/aws/setup/describeStackStatus.js

@@ -0,0 +1,17 @@
+import { CloudFormationClient, DescribeStacksCommand } from '@aws-sdk/client-cloudformation';
+/** A stack's status, or null when it does not exist. */
+export const describeStackStatus = async (stackName, region) => {
+    try {
+        const { Stacks } = await new CloudFormationClient({ region }).send(new DescribeStacksCommand({ StackName: stackName }));
+        return Stacks?.[0]?.StackStatus ?? null;
+    }
+    catch (error) {
+        if (error instanceof Error && /does not exist/.test(error.message)) {
+            return null;
+        }
+        throw error;
+    }
+};
+const healthyStatuses = ['CREATE_COMPLETE', 'UPDATE_COMPLETE', 'IMPORT_COMPLETE'];
+export const isStackHealthy = (status) => status !== null && healthyStatuses.includes(status);
+//# sourceMappingURL=describeStackStatus.js.map

package/lib/esm/platforms/aws/setup/describeStackStatus.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"describeStackStatus.js","sourceRoot":"","sources":["../../../../../src/platforms/aws/setup/describeStackStatus.ts"],"names":[],"mappings":"AAEA,OAAO,EAAE,oBAAoB,EAAE,qBAAqB,EAAE,MAAM,gCAAgC,CAAC;AAE7F,wDAAwD;AACxD,MAAM,CAAC,MAAM,mBAAmB,GAAG,KAAK,EAAE,SAAiB,EAAE,MAAc,EAA6B,EAAE;IACxG,IAAI,CAAC;QACH,MAAM,EAAE,MAAM,EAAE,GAAG,MAAM,IAAI,oBAAoB,CAAC,EAAE,MAAM,EAAE,CAAC,CAAC,IAAI,CAAC,IAAI,qBAAqB,CAAC,EAAE,SAAS,EAAE,SAAS,EAAE,CAAC,CAAC,CAAC;QACxH,OAAO,MAAM,EAAE,CAAC,CAAC,CAAC,EAAE,WAAW,IAAI,IAAI,CAAC;IAC1C,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,IAAI,KAAK,YAAY,KAAK,IAAI,gBAAgB,CAAC,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,EAAE,CAAC;YACnE,OAAO,IAAI,CAAC;QACd,CAAC;QACD,MAAM,KAAK,CAAC;IACd,CAAC;AACH,CAAC,CAAC;AAEF,MAAM,eAAe,GAAG,CAAC,iBAAiB,EAAE,iBAAiB,EAAE,iBAAiB,CAAC,CAAC;AAElF,MAAM,CAAC,MAAM,cAAc,GAAG,CAAC,MAAwB,EAAW,EAAE,CAAC,MAAM,KAAK,IAAI,IAAI,eAAe,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC","sourcesContent":["import { Nullable } from 'quidproquo-core';\n\nimport { CloudFormationClient, DescribeStacksCommand } from '@aws-sdk/client-cloudformation';\n\n/** A stack's status, or null when it does not exist. */\nexport const describeStackStatus = async (stackName: string, region: string): Promise<Nullable<string>> => {\n  try {\n    const { Stacks } = await new CloudFormationClient({ region }).send(new DescribeStacksCommand({ StackName: stackName }));\n    return Stacks?.[0]?.StackStatus ?? null;\n  } catch (error) {\n    if (error instanceof Error && /does not exist/.test(error.message)) {\n      return null;\n    }\n    throw error;\n  }\n};\n\nconst healthyStatuses = ['CREATE_COMPLETE', 'UPDATE_COMPLETE', 'IMPORT_COMPLETE'];\n\nexport const isStackHealthy = (status: Nullable<string>): boolean => status !== null && healthyStatuses.includes(status);\n"]}

package/lib/esm/platforms/aws/setup/index.d.ts

@@ -0,0 +1 @@
+export * from './awsSetupSteps';

package/lib/esm/platforms/aws/setup/index.js

@@ -0,0 +1,2 @@
+export * from './awsSetupSteps';
+//# sourceMappingURL=index.js.map

package/lib/esm/platforms/aws/setup/index.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../../../../../src/platforms/aws/setup/index.ts"],"names":[],"mappings":"AAAA,cAAc,iBAAiB,CAAC","sourcesContent":["export * from './awsSetupSteps';\n"]}

package/lib/esm/platforms/types.d.ts

@@ -1,6 +1,7 @@
 import { QpqAppDeployEnvironment } from 'quidproquo-deploy-awscdk';
 import { ClearResourcesPlan } from '../lib/clearResourcesPlan';
 import { DeployPlan, TeardownPlan } from '../lib/deployPrompts';
+import { SetupStep } from '../lib/setupStep';
 export declare enum QpqDeployPlatform {
     aws = "aws",
     docker = "docker"
@@ -11,6 +12,7 @@ export interface QpqPlatformDriver {
     goDocker?: (appName: string, plan: DeployPlan) => Promise<void>;
     teardown?: (appName: string, plan: TeardownPlan) => Promise<void>;
     clearResources?: (appName: string, plan: ClearResourcesPlan) => Promise<void>;
+    setupSteps?: (appName: string, environment: string) => Promise<SetupStep[]>;
     publish: (appName: string, serviceNames: string[]) => Promise<void>;
     publishBuild: (appName: string, serviceNames: string[]) => Promise<void>;
     publishUpload: (appName: string, serviceNames: string[]) => Promise<void>;

package/lib/esm/platforms/types.js.map

@@ -1 +1 @@
-{"version":3,"file":"types.js","sourceRoot":"","sources":["../../../src/platforms/types.ts"],"names":[],"mappings":"AAKA,MAAM,CAAN,IAAY,iBAGX;AAHD,WAAY,iBAAiB;IAC3B,gCAAW,CAAA;IACX,sCAAiB,CAAA;AACnB,CAAC,EAHW,iBAAiB,KAAjB,iBAAiB,QAG5B","sourcesContent":["import { QpqAppDeployEnvironment } from 'quidproquo-deploy-awscdk';\n\nimport { ClearResourcesPlan } from '../lib/clearResourcesPlan';\nimport { DeployPlan, TeardownPlan } from '../lib/deployPrompts';\n\nexport enum QpqDeployPlatform {\n  aws = 'aws',\n  docker = 'docker',\n}\n\n// A deploy platform driver — everything that happens after \"what to deploy\"\n// has been decided. `qpq go` resolves the app + environment, prompts the plan,\n// then hands off here; the platform comes from the environment's entry in\n// apps/<app>/deploy.config.json (default aws), so an app can move platforms\n// with a config change instead of a different command.\nexport interface QpqPlatformDriver {\n  // Prime process.env with this platform's deploy identity from the resolved\n  // environment target (already-set env vars win). Service configs read these\n  // vars at load time, so this runs before any infrastructure.ts is required.\n  // Returns human-readable descriptions of anything still missing — deploys\n  // treat that as fatal, local dev commands ignore it.\n  primeDeployIdentity: (target: QpqAppDeployEnvironment | undefined) => string[];\n\n  // Sequential deploy (`qpq go`).\n  go: (appName: string, plan: DeployPlan) => Promise<void>;\n\n  // Parallel containerized deploy (`qpq go:docker`) — optional; drivers that\n  // have no docker strategy simply omit it.\n  goDocker?: (appName: string, plan: DeployPlan) => Promise<void>;\n\n  // Destroy the web/api/inf stacks for selected services (`qpq teardown`) —\n  // optional; drivers with no teardown strategy simply omit it.\n  teardown?: (appName: string, plan: TeardownPlan) => Promise<void>;\n\n  // Empty the stored data of selected resources without touching the stacks\n  // (`qpq clear-resources`) — optional; drivers with no strategy omit it.\n  clearResources?: (appName: string, plan: ClearResourcesPlan) => Promise<void>;\n\n  // Federated remote publishing (`qpq publish[:build|:upload|:deploy]`).\n  publish: (appName: string, serviceNames: string[]) => Promise<void>;\n  publishBuild: (appName: string, serviceNames: string[]) => Promise<void>;\n  publishUpload: (appName: string, serviceNames: string[]) => Promise<void>;\n  publishDeploy: (appName: string, serviceNames: string[]) => Promise<void>;\n}\n"]}
+{"version":3,"file":"types.js","sourceRoot":"","sources":["../../../src/platforms/types.ts"],"names":[],"mappings":"AAMA,MAAM,CAAN,IAAY,iBAGX;AAHD,WAAY,iBAAiB;IAC3B,gCAAW,CAAA;IACX,sCAAiB,CAAA;AACnB,CAAC,EAHW,iBAAiB,KAAjB,iBAAiB,QAG5B","sourcesContent":["import { QpqAppDeployEnvironment } from 'quidproquo-deploy-awscdk';\n\nimport { ClearResourcesPlan } from '../lib/clearResourcesPlan';\nimport { DeployPlan, TeardownPlan } from '../lib/deployPrompts';\nimport { SetupStep } from '../lib/setupStep';\n\nexport enum QpqDeployPlatform {\n  aws = 'aws',\n  docker = 'docker',\n}\n\n// A deploy platform driver — everything that happens after \"what to deploy\"\n// has been decided. `qpq go` resolves the app + environment, prompts the plan,\n// then hands off here; the platform comes from the environment's entry in\n// apps/<app>/deploy.config.json (default aws), so an app can move platforms\n// with a config change instead of a different command.\nexport interface QpqPlatformDriver {\n  // Prime process.env with this platform's deploy identity from the resolved\n  // environment target (already-set env vars win). Service configs read these\n  // vars at load time, so this runs before any infrastructure.ts is required.\n  // Returns human-readable descriptions of anything still missing — deploys\n  // treat that as fatal, local dev commands ignore it.\n  primeDeployIdentity: (target: QpqAppDeployEnvironment | undefined) => string[];\n\n  // Sequential deploy (`qpq go`).\n  go: (appName: string, plan: DeployPlan) => Promise<void>;\n\n  // Parallel containerized deploy (`qpq go:docker`) — optional; drivers that\n  // have no docker strategy simply omit it.\n  goDocker?: (appName: string, plan: DeployPlan) => Promise<void>;\n\n  // Destroy the web/api/inf stacks for selected services (`qpq teardown`) —\n  // optional; drivers with no teardown strategy simply omit it.\n  teardown?: (appName: string, plan: TeardownPlan) => Promise<void>;\n\n  // Empty the stored data of selected resources without touching the stacks\n  // (`qpq clear-resources`) — optional; drivers with no strategy omit it.\n  clearResources?: (appName: string, plan: ClearResourcesPlan) => Promise<void>;\n\n  // The ordered checklist that takes an empty cloud environment to a deployed\n  // one (`qpq setup`) — optional; drivers with nothing to set up omit it.\n  setupSteps?: (appName: string, environment: string) => Promise<SetupStep[]>;\n\n  // Federated remote publishing (`qpq publish[:build|:upload|:deploy]`).\n  publish: (appName: string, serviceNames: string[]) => Promise<void>;\n  publishBuild: (appName: string, serviceNames: string[]) => Promise<void>;\n  publishUpload: (appName: string, serviceNames: string[]) => Promise<void>;\n  publishDeploy: (appName: string, serviceNames: string[]) => Promise<void>;\n}\n"]}

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "quidproquo-cli",
-  "version": "0.1.19",
+  "version": "0.1.21",
   "description": "The qpq CLI — build, dev and deploy orchestration for QPQ apps",
   "main": "./lib/commonjs/index.js",
   "module": "./lib/esm/index.js",
@@ -37,28 +37,31 @@
   },
   "homepage": "https://github.com/qpqjs/quidproquo#readme",
   "dependencies": {
+    "@aws-sdk/client-cloudformation": "^3.1093.0",
     "@aws-sdk/client-dynamodb": "^3.1093.0",
+    "@aws-sdk/client-iam": "^3.1093.0",
+    "@aws-sdk/client-route-53": "^3.1093.0",
     "@aws-sdk/client-s3": "^3.1093.0",
     "@aws-sdk/client-sts": "^3.1093.0",
     "@inquirer/prompts": "^8.5.2",
     "@rspack/dev-server": "^2.1.0",
     "aws-cdk": "^2.1132.1",
     "madge": "^8.0.0",
-    "quidproquo": "0.1.19",
-    "quidproquo-actionprocessor-awslambda": "0.1.19",
-    "quidproquo-config-aws": "0.1.19",
-    "quidproquo-core": "0.1.19",
-    "quidproquo-deploy-awscdk": "0.1.19",
-    "quidproquo-deploy-rspack": "0.1.19",
-    "quidproquo-dev-server": "0.1.19",
-    "quidproquo-webserver": "0.1.19",
+    "quidproquo": "0.1.21",
+    "quidproquo-actionprocessor-awslambda": "0.1.21",
+    "quidproquo-config-aws": "0.1.21",
+    "quidproquo-core": "0.1.21",
+    "quidproquo-deploy-awscdk": "0.1.21",
+    "quidproquo-deploy-rspack": "0.1.21",
+    "quidproquo-dev-server": "0.1.21",
+    "quidproquo-webserver": "0.1.21",
     "ts-node": "^10.9.1",
     "typescript": "^5.8.2"
   },
   "devDependencies": {
     "@rspack/core": "^2.1.2",
     "@types/node": "^22.13.13",
-    "quidproquo-tsconfig": "0.1.19"
+    "quidproquo-tsconfig": "0.1.21"
   },
   "bin": {
     "qpq": "./lib/commonjs/bin/qpq.js"