hecks 3.1.3 → 3.2.1

data/lib/hecks/hecks/hecks.hecksagon

@@ -368,6 +368,14 @@ Hecks.hecksagon "Hecks" do
     end
   end
 
+  Deploy::CostCheck.port "CostExplorer" do
+    asks "Measure", to: CostCheck do
+      attribute :run, RunKey
+      answers "CostAnswered"
+      refuses "CostRefused"
+    end
+  end
+
   Deploy::TemplateComparison.port "DeployToolchain" do
     asks "Compare", to: TemplateComparison do
       attribute :run, RunKey

data/lib/hecks/language/bluebook/vocabulary.bluebook

@@ -625,16 +625,16 @@ Hecks.bluebook "Bluebook" do
              pattern: '^lib/hecks/runtime/', push: "skip",
              label: "does this change touch lib/hecks/runtime/**?"
       member name: "postgres_io_relevant_changed", workflow: "ci-postgres-io-parallel.yml", mode: "skips_unless",
-             pattern: '^(docs/|editors/|release/|deploy/|\.claude/|\.githooks/|rust/(parser|codegen|host|build|lsp|web|tests|project)/|rust/project\.rb$|rust/project_rust_pipeline\.rb$|\.rubocop\.yml$|\.rubocop_todo\.yml$|\.mcp\.json$|\.rspec-local\.example$|README\.md$|CHANGELOG\.md$|CONTRIBUTING\.md$|SECURITY\.md$|LICENSE$|\.gitignore$)',
+             pattern: '^(docs/|editors/|release/|deploy/|\.claude/|\.githooks/|rust/(parser|codegen|host|build|lsp|web|tests)/|\.rubocop\.yml$|\.rubocop_todo\.yml$|\.mcp\.json$|\.rspec-local\.example$|README\.md$|CHANGELOG\.md$|CONTRIBUTING\.md$|SECURITY\.md$|LICENSE$|\.gitignore$)',
              push: "before_sha",
              label: "does this change touch anything rspec_postgres_io_parallel covers?"
     end
 
     # Rust keywords (strict + reserved) a generated identifier must not
-    # collide with. RustProjection::Projector::RUST_KEYWORDS reads this;
-    # hecks project_reserved_names projects it into
-    # rust/codegen/src/reserved_names.rs, so Ruby and Rust escape or refuse
-    # the same words from one declaration instead of two hand-typed copies.
+    # collide with. ModelCheck reads this; hecks project_reserved_names
+    # projects it into rust/codegen/src/reserved_names.rs, so Ruby and Rust
+    # escape or refuse the same words from one declaration instead of two
+    # hand-typed copies.
     value_object "RustReservedWord" do
       attribute :word, String,
                 one_of: ["as", "break", "const", "continue", "crate", "dyn", "else", "enum", "extern", "false",
@@ -648,8 +648,8 @@ Hecks.bluebook "Bluebook" do
     # as a Cargo `[features]` key: every key rust/Cargo.toml already uses
     # outside `[features]` (`[package]`, `[lib]`, `[[bin]]`) plus `default`,
     # which Cargo reserves for the auto-enabled feature set. Read by
-    # RustProjection::Projector::CARGO_RESERVED_DOMAIN_NAMES and projected by
-    # hecks project_reserved_names, same as RustReservedWord above.
+    # Hecks::RustBuild::DomainName and projected by hecks
+    # project_reserved_names, same as RustReservedWord above.
     value_object "CargoReservedName" do
       attribute :name, String,
                 one_of: ["name", "version", "edition", "path", "authors", "license", "description", "default",

data/lib/hecks/language/hecksagon/hecksagon.bluebook

@@ -83,7 +83,7 @@ Hecks.bluebook "Hecksagon" do
       member word: "hecksagon",       context: "File",     body: "keywords", inner: "Hecksagon",      opens: "Hecksagon",      fills: ""
       member word: "subscribe",       context: "Hecksagon", body: "none", inner: "", opens: "", fills: "subscriptions"
       member word: "attaches",        context: "Hecksagon", body: "none", inner: "", opens: "", fills: "attachments"
-      # Deprecated spellings of `attaches`; they warn and are removed in 3.2.0.
+      # Deprecated spellings of `attaches`; they warn and are removed in 3.3.0.
       member word: "uses_framework",  context: "Hecksagon", body: "none", inner: "", opens: "", fills: "attachments", status: "deprecated"
       member word: "uses_embryonaut_bluebook", context: "Hecksagon", body: "none", inner: "", opens: "", fills: "attachments", status: "deprecated"
       member word: "port",            context: "Hecksagon",     body: "keywords", inner: "DomainPort",    opens: "DomainPort",    fills: "", calls: "port_impl"

data/lib/hecks/ports/persistence/plugins/era/expected_era.rb

@@ -58,7 +58,7 @@ module Hecks
         # @return [String] the `era` the host's `/version` document carries
         # @raise [Unreachable] if the request fails or the status is not `200`
         # @raise [BadResponse] if the body is not JSON or its `era` is not a non-empty string
-        def fetch_era(url, timeout: 10)
+        def fetch_era(url, timeout:)
           fetch_version(url, timeout: timeout).fetch("era")
         end
 
@@ -70,7 +70,7 @@ module Hecks
         #   host reports none)
         # @raise [Unreachable] if the request fails or the status is not `200`
         # @raise [BadResponse] if the body is not JSON or its `era` is not a non-empty string
-        def fetch_version(url, timeout: 10)
+        def fetch_version(url, timeout:)
           response = get(version_url(url), timeout)
           raise Unreachable, "#{version_url(url)} answered #{response.code}" unless response.code == "200"
 
@@ -105,7 +105,7 @@ module Hecks
         # @raise [Errno::ENOENT] if the allow-list file does not exist
         # @raise [Unreachable] see `fetch_era`
         # @raise [BadResponse] see `fetch_era`
-        def check(url, file, timeout: 10)
+        def check(url, file, timeout:)
           allowed = parse(File.read(file))
           verdict(fetch_era(url, timeout: timeout), allowed)
         end

data/lib/hecks/projections/deploy/box/settings.rb

@@ -34,6 +34,8 @@ module Hecks
                          "@sha256:226d1f059b75399fe19182893c7184591c07b97afc8dfcf44eeb80c9a77a530f".freeze
           TUNNEL_SHAPE = "tunnel: a hash needs `to` (the container it forwards to) and `token_secret` " \
                          "(the secret holding the tunnel token)".freeze
+          ORIGIN_ENV_SHAPE = "origin_env: the container environment variable names that hold the origin secret " \
+                             "need an origin_secret and a task_definition to compare against".freeze
           ORIGIN_PAIR = "origin_header and origin_secret go together: the header a CDN sends, " \
                         "and the secret that holds its value".freeze
 
@@ -79,7 +81,7 @@ module Hecks
             :infra_name, :stack_prefix, :instance_type, :volume_gb, :swap_gb, :database_class,
             :storage_gb, :backup_days, :snapshots_keep, :database_name, :engine_version,
             :containers, :routes, :default_container, :origin_header, :origin_secret,
-            :secret_prefixes, :writable_secrets, :tunnel, :tunnel_service, :proxy_image, :task_definition,
+            :secret_prefixes, :writable_secrets, :origin_env, :tunnel, :tunnel_service, :proxy_image, :task_definition,
             :migration, :s3_buckets, keyword_init: true
           ) do
             # @return [String] the CloudFormation stack that holds the database
@@ -110,6 +112,7 @@ module Hecks
             task_definition = read_task_definition(s[:task_definition], listed)
             containers = read_containers(listed, infra_name)
             header, secret = read_origin(s)
+            origin_env = read_origin_env(s, secret, task_definition)
             tunnel, tunnel_service = read_tunnel(s.fetch(:tunnel, false), containers)
 
             Plan.new(
@@ -118,7 +121,7 @@ module Hecks
               engine_version: check(:engine_version, s.fetch(:engine_version, "16").to_s, ENGINE),
               containers: containers, routes: read_routes(s.fetch(:routes, []), containers),
               default_container: read_default(s[:default_container], containers), origin_header: header,
-              origin_secret: secret, secret_prefixes: read_prefixes(s, infra_name),
+              origin_secret: secret, origin_env: origin_env, secret_prefixes: read_prefixes(s, infra_name),
               writable_secrets: read_writable_secrets(s),
               tunnel: tunnel, tunnel_service: tunnel_service,
               proxy_image: check(:proxy_image, s.fetch(:proxy_image, PROXY_IMAGE), IMAGE),
@@ -263,6 +266,24 @@ module Hecks
             [check(:origin_header, header, HEADER), check(:origin_secret, secret, SECRET_NAME)]
           end
 
+          # The container environment variables that hold the origin secret in the task
+          # definition. Only Caddy reads the named secret; the containers keep the task
+          # definition's copy, so a copy that differs makes every request through the CDN
+          # fail. Naming them lets deploy refuse a mismatch.
+          #
+          # @param settings [Hash{Symbol => Object}] the world's `AwsBox` settings
+          # @param secret [String, nil] the declared origin secret
+          # @param task_definition [String, nil] the declared task definition family
+          # @return [Array<String>] the variable names, empty when none are declared
+          # @raise [ArgumentError] when named without an origin secret and a task definition
+          def read_origin_env(settings, secret, task_definition)
+            names = Array(settings.fetch(:origin_env, []))
+            return [] if names.empty?
+            raise ArgumentError, ORIGIN_ENV_SHAPE if secret.nil? || task_definition.nil?
+
+            names.map { |name| check(:origin_env, name, ENV_KEY) }.uniq
+          end
+
           # `tunnel true` only opens the outbound port; a hash also runs cloudflared as a service.
           #
           # @param value [Boolean, Hash{Symbol => Object}] the world's `tunnel` setting

data/lib/hecks/projections/deploy/box/templates/deploy-box.sh.tmpl

@@ -55,6 +55,7 @@ ROLL=$(jq -n --arg compose "$(B64 "$WORK/compose.json")" --arg secrets "$(B64 "$
   --arg registry "$ACCOUNT.dkr.ecr.$REGION.amazonaws.com" --arg dir "$DIR" '
   {commands: ["cloud-init status --wait >/dev/null 2>&1 || true",
     "set -e", "mkdir -p \($dir)/caddy-extra && cd \($dir)", "umask 077",
+    "CADDY_BEFORE=$(cat Caddyfile 2>/dev/null | sha256sum)",
     "echo \($compose) | base64 -d > compose.json; echo \($secrets) | base64 -d > secrets.json",
     "echo \($caddy) | base64 -d > Caddyfile; echo \($fetch) | base64 -d > fetch-secrets.sh",
     "bash fetch-secrets.sh",
@@ -62,7 +63,8 @@ ROLL=$(jq -n --arg compose "$(B64 "$WORK/compose.json")" --arg secrets "$(B64 "$
     "aws ecr get-login-password --region '"$REGION"' | docker login --username AWS --password-stdin \($registry) >/dev/null",
     "docker compose -f compose.json pull --quiet",
     "docker compose -f compose.json up -d --remove-orphans",
-    "sleep 20; docker compose -f compose.json ps --format \"table {{.Service}}\\t{{.Status}}\""],
+    "[ \"$(sha256sum < Caddyfile)\" = \"$CADDY_BEFORE\" ] || docker compose -f compose.json restart caddy",
+    "for i in $(seq 1 40); do docker compose -f compose.json ps --format \"{{.Status}}\" | grep -qE \"^Up (Less than a second|[0-4] seconds?)|Restarting|Created|Exited\" || break; sleep 1; done; docker compose -f compose.json ps --format \"table {{.Service}}\\t{{.Status}}\""],
    executionTimeout: ["900"]}')
 
 echo "==> rolling $BOX_STACK ($BOX) at $(date -u +%H:%M:%SZ)"

data/lib/hecks/projections/deploy/box/templates/render-compose-taskdef.sh.tmpl

@@ -9,6 +9,10 @@
 # are replaced with the RDS stack's values where the task defines them, and every container runs on
 # the box's own network, so the proxy reaches each one on 127.0.0.1:<port>. Secrets (name + valueFrom)
 # are written to secrets.json for fetch-secrets.sh to resolve on the box.
+#
+# When the world names origin_env, the named origin secret is compared with those variables in the
+# task definition and the render refuses on any difference (Caddy checks the CDN's header against
+# the secret; the containers check it against their own copy). Values are never printed.
 set -euo pipefail
 HERE=$(cd "$(dirname "$0")" && pwd)
 DB_HOST=${1:?rds endpoint}
@@ -18,6 +22,19 @@ TD=${3:-@@FAMILY@@}
 DEF=$(aws ecs describe-task-definition --task-definition "$TD" --query 'taskDefinition.containerDefinitions' --output json)
 echo "rendering from task definition $TD" >&2
 
+ORIGIN_ENV=$(jq -r '.origin.env // [] | .[]' "$HERE/services.json")
+if [ -n "$ORIGIN_ENV" ]; then
+  ORIGIN_SECRET_ID=$(jq -r '.origin.secret' "$HERE/services.json")
+  ORIGIN_VALUE=$(aws secretsmanager get-secret-value --secret-id "$ORIGIN_SECRET_ID" --query SecretString --output text)
+  for NAME in $ORIGIN_ENV; do
+    HOLDERS=$(echo "$DEF" | jq -r --arg n "$NAME" '[.[] | select(any((.environment // [])[]; .name == $n)) | .name] | join(" ")')
+    [ -n "$HOLDERS" ] || { echo "refusing to render: origin_env names $NAME, which no container in $TD sets" >&2; exit 1; }
+    DIFFERENT=$(echo "$DEF" | jq -r --arg n "$NAME" --arg v "$ORIGIN_VALUE" \
+      '[.[] | select(any((.environment // [])[]; .name == $n and .value != $v)) | .name] | join(" ")')
+    [ -z "$DIFFERENT" ] || { echo "refusing to render: $NAME in $TD (container: $DIFFERENT) differs from the origin secret $ORIGIN_SECRET_ID; the proxy would refuse every request from the CDN. Make them equal." >&2; exit 1; }
+  done
+fi
+
 jq --argjson def "$DEF" --arg host "$DB_HOST" --arg secret "$DB_SECRET" '
   def log: {driver: "json-file", options: {"max-size": "10m", "max-file": "3"}};
   def env(c): ((c.environment // []) | map({(.name): .value}) | add // {})

data/lib/hecks/projections/deploy/box.rb

@@ -379,9 +379,19 @@ module Hecks
         def route_blocks(plan)
           routes = plan.routes.each_with_index.map do |route, i|
             port = plan.containers.find { |c| c.name == route.container }.port
-            "@r#{i + 1} path #{route.paths.join(' ')}\nhandle @r#{i + 1} {\n\treverse_proxy 127.0.0.1:#{port}\n}\n\n"
+            "@r#{i + 1} path #{route.paths.join(' ')}\nhandle @r#{i + 1} {\n#{upstream(port)}}\n\n"
           end
-          "#{routes.join}handle {\n\treverse_proxy 127.0.0.1:#{plan.default.port}\n}\n"
+          "#{routes.join}handle {\n#{upstream(plan.default.port)}}\n"
+        end
+
+        # One upstream. A request that arrives while its container is being replaced
+        # waits, and is tried again every quarter second for up to 15 seconds, so a
+        # deploy shows a visitor a slow page instead of a 502.
+        #
+        # @param port [Integer] the container's port
+        # @return [String] the `reverse_proxy` block, one tab in, ending in a newline
+        def upstream(port)
+          "\treverse_proxy 127.0.0.1:#{port} {\n\t\tlb_try_duration 15s\n\t\tlb_try_interval 250ms\n\t}\n"
         end
 
         # @param plan [Settings::Plan] the resolved settings
@@ -425,6 +435,7 @@ module Hecks
         def services_json(plan)
           services = plan.containers.to_h { |c| [c.name, service_entry(plan, c)] }
           origin = plan.origin_secret ? { "header" => plan.origin_header, "secret" => plan.origin_secret } : nil
+          origin["env"] = plan.origin_env if origin && plan.origin_env.any?
           document = { "services" => services, "origin" => origin }
           document["task_definition"] = plan.task_definition if plan.task_definition
           document["tunnel"] = tunnel_entry(plan.tunnel_service) if plan.tunnel_service

data/lib/hecks/projections/site/edge/behaviours.rb

@@ -63,9 +63,11 @@ module Hecks
 
           def reference(text) = text.nil? || text == "none" ? nil : Checks.resolve(text)
 
-          # CloudFront takes three sets of methods: read, read with `OPTIONS`, and all.
+          # CloudFront takes three sets of methods: read, read with `OPTIONS`, and all. A route's
+          # `edge_methods` are the verbs the edge lets through; they are its own `methods` unless
+          # the row says more.
           def methods(rows)
-            verbs = rows.flat_map(&:verbs).uniq
+            verbs = rows.flat_map(&:edge_verbs).uniq
             return Deploy::Fargate::Cdn::METHODS.fetch("all") unless (verbs - ["GET"]).empty?
 
             assets = rows.all? { |row| row.origin == "assets" }
@@ -76,7 +78,7 @@ module Hecks
           # http and redirected; anything else (a form, an API, a signed or admin page, a route of
           # the cms or the domain) is served over https only.
           def protocol(row)
-            plain = row.auth == "public" && row.verbs == ["GET"] && %w[website assets].include?(row.origin)
+            plain = row.auth == "public" && row.edge_verbs == ["GET"] && %w[website assets].include?(row.origin)
             plain ? "redirect-to-https" : "https-only"
           end
 

data/lib/hecks/projections/site/edge/checks.rb

@@ -28,7 +28,9 @@ module Hecks
           # @param rows [Array<Table::Row>] the route table's rows
           # @param vocabulary [Hash{Symbol => Array<String>}] the Site chapter's closed sets
           # @param problems [Array<String>] collects each problem found, one line each
-          def initialize(edge, rows, vocabulary, problems)
+          # @param template_named [Boolean] whether the caller names the template itself
+          def initialize(edge, rows, vocabulary, problems, template_named: false)
+            @template_named = template_named
             @edge = edge
             @rows = rows
             @vocabulary = vocabulary
@@ -48,15 +50,21 @@ module Hecks
 
           def check_setting
             setting = @edge.setting
-            return problem("Edge", "has no row naming the template; declare one member with template:") unless setting
+            return problem("Edge", "has no row; declare one member with template:") unless setting
+
+            check_template(setting.template) if setting.template || !@template_named
 
-            template = setting.template.to_s
-            problem("Edge", "template #{template.inspect} must be a path inside the project") if
-              template.empty? || template.start_with?("/") || template.split("/").include?("..")
             problem("Edge", "has secret_header but no secret_value") if setting.secret_header && !setting.secret_value
             problem("Edge", "has secret_value but no secret_header") if setting.secret_value && !setting.secret_header
           end
 
+          def check_template(template)
+            template = template.to_s
+            problem("Edge", "has no template; declare template: or name the file to the tool") if template.empty?
+            problem("Edge", "template #{template.inspect} must be a path inside the project") if
+              template.start_with?("/") || template.split("/").include?("..")
+          end
+
           def check_policies
             @edge.policies.each do |policy|
               label = "EdgePolicy #{policy.cache_class}#{" on #{policy.origin}" if policy.origin}"
@@ -86,12 +94,30 @@ module Hecks
           end
 
           def check_rules
+            return check_no_alb unless @edge.alb?
+
             problem("EdgeRule", "rows need an Edge row with listener:") if @edge.rules.any? && !@edge.setting&.listener
             @edge.rules.each { |rule| check_rule(rule) }
             repeated(@edge.rules.map(&:rule), "EdgeRule", &:itself)
             repeated(@edge.rules.map(&:priority), "EdgeRule priority", &:to_s)
           end
 
+          # With `alb: false` nothing routes by listener rule, so a rule row, or a route that names
+          # one, describes a load balancer the project says it does not have. Every route that is
+          # served by a server behind the edge still needs the origin that reaches it.
+          def check_no_alb
+            problem("EdgeRule", "rows describe a load balancer, and the Edge row says alb: false") if @edge.rules.any?
+            @rows.select(&:alb_rule).each do |row|
+              problem(row.path, "names alb_rule #{row.alb_rule}, and the Edge row says alb: false")
+            end
+            @rows.each do |row|
+              next if row.cdn || !%w[cms domain].include?(row.origin) || @edge.upstream(row.origin)
+
+              problem(row.path, "is served from #{row.origin}, which no EdgeOrigin maps, and with alb: false " \
+                                "nothing else reaches it")
+            end
+          end
+
           def check_rule(rule)
             label = "EdgeRule #{rule.rule}"
             member_of(label, "origin", rule.origin, :origin)

data/lib/hecks/projections/site/edge.rb

@@ -19,7 +19,7 @@ module Hecks
       # `EdgePolicy`, `EdgeOrigin` and `EdgeRule`. `docs/site-routes.md` lists their fields. A
       # project that declares none of the four has no edge to project.
       class Edge
-        Setting  = Struct.new(:template, :listener, :secret_header, :secret_value, keyword_init: true)
+        Setting  = Struct.new(:template, :listener, :secret_header, :secret_value, :alb, keyword_init: true)
         Policy   = Struct.new(:cache_class, :origin, :cache, :origin_request, :response_headers, keyword_init: true)
         Upstream = Struct.new(:origin, :id, :target_group, keyword_init: true)
         Rule     = Struct.new(:rule, :priority, :origin, keyword_init: true)
@@ -29,15 +29,15 @@ module Hecks
 
         # The fields each kind of row may carry, with the Ruby class each takes.
         FIELDS = {
-          setting:  { template: String, listener: String, secret_header: String, secret_value: String },
+          setting:  { template: String, listener: String, secret_header: String, secret_value: String, alb: :bool },
           policy:   { cache_class: String, origin: String, cache: String, origin_request: String,
                     response_headers: String },
           upstream: { origin: String, id: String, target_group: String },
           rule:     { rule: String, priority: Integer, origin: String }
         }.freeze
 
-        # The fields a row of each kind must carry.
-        REQUIRED = { setting: [:template], policy: %i[cache_class cache], upstream: %i[origin id],
+        # The fields a row of each kind must carry. The template may instead be named to the tool.
+        REQUIRED = { setting: [], policy: %i[cache_class cache], upstream: %i[origin id],
                      rule: %i[rule priority origin] }.freeze
 
         STRUCTS = { setting: Setting, policy: Policy, upstream: Upstream, rule: Rule }.freeze
@@ -62,15 +62,17 @@ module Hecks
         # @param chapter [Bluebook::Chapter] the chapter that declares the route table
         # @param table [Table] the checked route table
         # @param vocabulary [Hash{Symbol => Array<String>}] the Site chapter's closed sets
+        # @param template [String, nil] the template the caller names, which stands in for the
+        #   `Edge` row's own `template:`
         # @return [Edge, nil] the checked edge, or nil when the chapter declares none
         # @raise [Table::Invalid] when a row is refused or the edge contradicts the routes
-        def self.read(chapter, table:, vocabulary:)
+        def self.read(chapter, table:, vocabulary:, template: nil)
           declared = OBJECTS.transform_values { |name| Table.rows_of(chapter, name) }
           return nil if declared.values.all?(&:empty?)
 
           problems = []
           records = declared.to_h { |kind, members| [kind, build(kind, members, problems)] }
-          new(records, table: table, vocabulary: vocabulary, problems: problems)
+          new(records, table: table, vocabulary: vocabulary, problems: problems, template: template)
         end
 
         # @param kind [Symbol] a key of `OBJECTS`
@@ -86,27 +88,35 @@ module Hecks
             end
             (REQUIRED.fetch(kind) - member.keys).each { |field| problems << "#{label} needs #{field}" }
             typed = member.slice(*FIELDS.fetch(kind).keys).select do |field, value|
-              value.is_a?(FIELDS.fetch(kind).fetch(field)) || (problems << "#{label} has #{field} #{value.inspect}; " \
-                                                                           "#{field} is a #{FIELDS.fetch(kind).fetch(field)}")
+              typed?(value, FIELDS.fetch(kind).fetch(field)) ||
+                (problems << "#{label} has #{field} #{value.inspect}; " \
+                             "#{field} is #{type_name(FIELDS.fetch(kind).fetch(field))}")
             end
             STRUCTS.fetch(kind).new(**typed)
           end
         end
         private_class_method :build
 
+        def self.typed?(value, type) = type == :bool ? [true, false].include?(value) : value.is_a?(type)
+        private_class_method :typed?
+
+        def self.type_name(type) = type == :bool ? "true or false" : "a #{type}"
+        private_class_method :type_name
+
         # @param records [Hash{Symbol => Array<Struct>}] the rows of each kind
         # @param table [Table] the checked route table
         # @param vocabulary [Hash{Symbol => Array<String>}] the closed sets
         # @param problems [Array<String>] the problems already found in reading the rows
+        # @param template [String, nil] the template the caller names, if any
         # @raise [Table::Invalid] naming every problem when there is one
-        def initialize(records, table:, vocabulary:, problems:)
+        def initialize(records, table:, vocabulary:, problems:, template: nil)
           @setting = records.fetch(:setting).first
           @policies = records.fetch(:policy)
           @upstreams = records.fetch(:upstream)
           @rules = records.fetch(:rule)
-          Checks.new(self, table.rows, vocabulary, problems).call
+          Checks.new(self, table.rows, vocabulary, problems, template_named: !template.nil?).call
           if problems.empty?
-            @listener_rules = Rules.new(self, table.rows, problems).call
+            @listener_rules = alb? ? Rules.new(self, table.rows, problems).call : []
             built = Behaviours.new(self, table.rows, problems).call
             @default_behaviour = built.fetch(:default)
             @behaviours = built.fetch(:list)
@@ -116,6 +126,10 @@ module Hecks
           raise Table::Invalid, "the edge is refused:\n#{problems.map { |line| "  - #{line}" }.join("\n")}"
         end
 
+        # @return [Boolean] whether the project has a load balancer, and so listener rules; true
+        #   unless the `Edge` row says `alb: false`
+        def alb? = setting.nil? || setting.alb != false
+
         # @param origin [String] an origin of the Origin set
         # @return [Upstream, nil] its CloudFront origin and target group
         def upstream(origin) = upstreams.find { |candidate| candidate.origin == origin }

data/lib/hecks/projections/site/routes_ts.rb

@@ -77,10 +77,12 @@ module Hecks
         end
 
         def route_fields(row)
-          { path: row.path, kind: row.kind, render: row.render, auth: row.auth, methods: row.verbs,
-            cache: row.cache, origin: row.origin, source: row.source, indexable: row.indexable,
-            switch: blank_to_nil(row.switch), off: row.off, preview: row.preview,
-            label: blank_to_nil(row.label), seo: blank_to_nil(row.seo), redirectTo: row.redirect_to }
+          fields = { path: row.path, kind: row.kind, render: row.render, auth: row.auth, methods: row.verbs,
+                     cache: row.cache, origin: row.origin, source: row.source, indexable: row.indexable,
+                     switch: blank_to_nil(row.switch), off: row.off, preview: row.preview,
+                     label: blank_to_nil(row.label), seo: blank_to_nil(row.seo), redirectTo: row.redirect_to }
+          fields[:seoTitle] = row.seo_title if row.seo_title
+          fields
         end
 
         def switches(rows)
@@ -112,13 +114,16 @@ module Hecks
           TS
         end
 
+        # The navigation arrays hold every entry that has a slot, a switched-off page's too: an
+        # entry of an off page carries its `switch` and `on: false`, and the site drops it while
+        # `pageIsOn(switch)` is false. An entry of a page that is on carries neither.
         def navigation(table)
-          rows = live(table.rows)
+          items = table.rows + table.links
           [nav_const("NAV_DESKTOP", "The desktop navigation: a page with no group is its own entry; a group holds its pages.",
-                     desktop(rows)),
-           nav_const("NAV_MOBILE", "The mobile navigation, in its own order.", mobile(rows)),
-           nav_const("NAV_FOOTER", "The footer columns, left to right, each with its links.", footer(rows)),
-           nav_const("NAV_ADMIN", "The admin navigation: each admin page under its key.", admin(rows))].join("\n\n")
+                     desktop(items)),
+           nav_const("NAV_MOBILE", "The mobile navigation, in its own order.", mobile(items)),
+           nav_const("NAV_FOOTER", "The footer columns, left to right, each with its links.", footer(items)),
+           nav_const("NAV_ADMIN", "The admin navigation: each admin page under its key.", admin(items))].join("\n\n")
         end
 
         def nav_const(name, comment, entries)
@@ -126,32 +131,41 @@ module Hecks
           "// #{comment}\nexport const #{name} = #{body.empty? ? '[]' : "[\n#{body.join("\n")}\n]"} as const;"
         end
 
-        def desktop(rows)
-          items = rows.reject { |row| row.nav_order.nil? }.sort_by { |row| [row.nav_order, row.path] }
+        # One link: a row's or a link's path and label, the fragment a link names, and for a page
+        # that is off the switch that turns it on.
+        def entry(item, **before)
+          link = { **before, path: item.path, label: item.label }
+          link[:fragment] = item.fragment if item.respond_to?(:fragment) && item.fragment
+          link.merge!(switch: item.switch, on: false) if item.off
+          link
+        end
+
+        def order_key(item, order) = [order, item.path, item.respond_to?(:fragment) ? item.fragment.to_s : ""]
+
+        def desktop(items)
           entries = []
-          items.each do |row|
-            item = { path: row.path, label: row.label }
-            group = row.nav_group
-            slot = group && entries.find { |entry| entry[:group] == group }
-            slot ? slot[:items] << item : entries << { group: group, items: [item] }
+          items.reject { |item| item.nav_order.nil? }.sort_by { |item| order_key(item, item.nav_order) }.each do |item|
+            group = item.nav_group
+            slot = group && entries.find { |candidate| candidate[:group] == group }
+            slot ? slot[:items] << entry(item) : entries << { group: group, items: [entry(item)] }
           end
           entries
         end
 
-        def mobile(rows)
-          rows.reject { |row| row.mobile_order.nil? }.sort_by { |row| [row.mobile_order, row.path] }
-              .map { |row| { path: row.path, label: row.label } }
+        def mobile(items)
+          items.reject { |item| item.mobile_order.nil? }.sort_by { |item| order_key(item, item.mobile_order) }
+               .map { |item| item.mobile_heading ? entry(item, heading: item.mobile_heading) : entry(item) }
         end
 
-        def footer(rows)
-          columns = rows.select(&:footer_column).sort_by { |row| [row.footer_order, row.path] }.group_by(&:footer_column)
+        def footer(items)
+          columns = items.select(&:footer_column).sort_by { |item| order_key(item, item.footer_order) }.group_by(&:footer_column)
           columns.sort_by { |name, group| [group.first.footer_order, name] }
-                 .map { |name, group| { column: name, items: group.map { |row| { path: row.path, label: row.label } } } }
+                 .map { |name, group| { column: name, items: group.map { |item| entry(item) } } }
         end
 
-        def admin(rows)
-          rows.select(&:admin_key).sort_by { |row| [row.admin_order, row.admin_key] }
-              .map { |row| { key: row.admin_key, path: row.path, label: row.label } }
+        def admin(items)
+          items.select(&:admin_key).sort_by { |item| [item.admin_order, item.admin_key] }
+               .map { |item| entry(item, key: item.admin_key) }
         end
 
         def search(rows)
@@ -216,13 +230,22 @@ module Hecks
               const source = stripHtml(pattern)
                 .split("/")
                 .map((part) =>
-                  part === "*" ? ".*" : part.startsWith(":") ? "[^/]+" : part.replace(/[.*+?^${}()|[\]\\]/g, "\\$&"),
+                  part.startsWith(":")
+                    ? "[^/]+"
+                    : part
+                        .split("*")
+                        .map((piece) => piece.replace(/[.+?^${}()|[\]\\]/g, "\\$&"))
+                        .join(".*"),
                 )
                 .join("/");
               return new RegExp("^" + source + "$");
             }
 
-            /** Whether a pathname is one a route pattern (`/blog/:slug.html`, `/pay/*`) describes, with or without `.html`. */
+            /**
+             * Whether a pathname is one a route pattern describes, with or without `.html`. A `:name` is one
+             * segment; a `*` is any run of characters, `/` included, wherever it stands, as in a CDN's path
+             * pattern: `/pay/*` matches `/pay/7` and `/admin*` matches `/admin`, `/admin-inbox` and `/admin/x`.
+             */
             export function matchesPath(pattern: string, pathname: string): boolean {
               return toRegExp(pattern).test(stripHtml(pathname));
             }

data/lib/hecks/projections/site/site_cdn.rb

@@ -11,9 +11,10 @@ module Hecks
       # on it: the distribution's cache behaviours and the load balancer's listener rules.
       #
       # The blocks are returned by name, `"behaviors"` and `"listener_rules"`, as text from the
-      # left margin. `Regions` puts each between the markers of the same name in the project's
-      # template, at the markers' indentation. The text is a pure function of the table and the
-      # edge rows.
+      # left margin; a project whose `Edge` row says `alb: false` has no load balancer and gets
+      # `"behaviors"` alone. `Regions` puts each between the markers of the same name in the
+      # project's template, at the markers' indentation. The text is a pure function of the table
+      # and the edge rows.
       module SiteCdn
         extend Projector::Target
 
@@ -25,7 +26,7 @@ module Hecks
         # @param options [Hash{Symbol => Object}] `:registry` (Runtime::Registry) the project booted
         #   into; or `:table` (Table) and `:edge` (Edge), already read
         # @return [Hash{String => String}] each region's name to its text; empty when the chapter
-        #   declares no edge
+        #   declares no edge, and without `"listener_rules"` when the edge has no load balancer
         # @raise [Table::Invalid] when the table or the edge is refused
         def call(bluebook:, options: {})
           registry = options[:registry]
@@ -33,6 +34,8 @@ module Hecks
           edge = options[:edge] || Edge.read(bluebook, table: table, vocabulary: Table.vocabulary(registry))
           return {} unless edge
 
+          return { "behaviors" => behaviors(edge) } unless edge.alb?
+
           { "behaviors" => behaviors(edge), "listener_rules" => listener_rules(edge) }
         end