hecks 3.4.2 → 3.6.0

data/lib/hecks/projections/deploy/lambda/pii.rb

@@ -0,0 +1,49 @@
+require_relative "../text_template"
+
+module Hecks
+  module Projections
+    module Deploy
+      module Lambda
+        # The CloudFront, WAFv2 and logging resources a pii-marked domain is fronted by.
+        module Pii
+          module_function
+
+          # Builds the resources. `use_oac` signs requests only for the AWS_IAM case; the
+          # already-public WebFunction/rust_web Function URL stays as reachable as before. Managed
+          # cache/origin-request policy ids are AWS's own permanent `Managed-CachingDisabled`/
+          # `Managed-AllViewer` ids.
+          #
+          # @param fronted_logical_id [String] the function the distribution fronts
+          # @param use_oac [Boolean] whether the distribution signs its requests to the function
+          # @param geo_restriction_type [String] `none`, `whitelist` or `blacklist`
+          # @param geo_restriction_countries [Array<String>] the country codes the restriction lists
+          # @return [String] the resources, indented two spaces under `Resources:`
+          def cloudfront_yaml(fronted_logical_id:, use_oac:, geo_restriction_type:, geo_restriction_countries:)
+            text = TextTemplate.render(
+              "lambda/pii_resources.tmpl",
+              fronted_logical_id: fronted_logical_id, geo_restriction_type: geo_restriction_type,
+              geo_locations: geo_locations(geo_restriction_type, geo_restriction_countries),
+              oac_reference: use_oac ? "          OriginAccessControlId: !Ref PiiOriginAccessControl" : "",
+              origin_access_control: use_oac ? TextTemplate.render("lambda/pii_oac.tmpl") : "",
+              invoke_permission: invoke_permission(fronted_logical_id, use_oac)
+            )
+            text.each_line.map { |line| line.strip.empty? ? line : "  #{line}" }.join
+          end
+
+          def geo_locations(type, countries)
+            return " []" if type == "none"
+
+            "\n#{countries.map { |code| "              - #{code}" }.join("\n")}"
+          end
+          private_class_method :geo_locations
+
+          def invoke_permission(fronted_logical_id, use_oac)
+            auth_type = use_oac ? "AWS_IAM" : "NONE"
+            TextTemplate.render("lambda/pii_permission.tmpl", fronted_logical_id: fronted_logical_id, invoke_auth_type: auth_type)
+          end
+          private_class_method :invoke_permission
+        end
+      end
+    end
+  end
+end

data/lib/hecks/projections/deploy/lambda/stack/blocks.rb

@@ -0,0 +1,118 @@
+module Hecks
+  module Projections
+    module Deploy
+      module Lambda
+        class Stack
+          # The multi-line pieces of `template.yaml` that depend on the stack's shape: its comments,
+          # parameters, the VPC and database it owns, and the Google OAuth wiring. Included into
+          # `Stack`; each method is also the value of the template marker of the same name.
+          module Blocks
+            # Real outbound internet access needs a NAT Gateway: opt-in, the same
+            # `google_oauth_present` signal that wires GOOGLE_CLIENT_ID/secret.
+            def nat_comment
+              file = google_oauth_present ? "lambda/nat_comment_oauth.tmpl" : "lambda/nat_comment_plain.tmpl"
+              TextTemplate.render_from(file, self)
+            end
+
+            # `google_oauth_present` and `shared` are independent and collected into one array under
+            # a single `Parameters:` header, not an if/elsif/else: both can be true at once (a
+            # Shared-mode rust_web domain with real Google OAuth).
+            def parameters_section
+              blocks = []
+              blocks << render_block("params_oauth") if google_oauth_present
+              blocks << render_block("params_shared") if shared
+              return "" if blocks.empty?
+
+              # Indented 2: the blocks dedent to column 0, but these are Parameters: children, which
+              # YAML requires indented under it.
+              "Parameters:\n#{blocks.join("\n").each_line.map { |line| "  #{line}" }.join}"
+            end
+
+            def network_resources
+              return "" if shared
+
+              description = compute_description
+              yaml = Shared.vpc_and_database_yaml(network, compute_logical_id: logical_id, compute_description: description)
+              tail_indent(yaml, "  ")
+            end
+
+            def rust_session_secret
+              return "" unless rust_web && google_oauth_present
+
+              tail_indent(TextTemplate.render_from("lambda/rust_session_secret.tmpl", self), "  ")
+            end
+
+            # `{{resolve:secretsmanager:...}}` dynamic references do not create an implicit
+            # CloudFormation dependency on the referenced resource, so Aurora's function waits on
+            # its secret and cluster explicitly.
+            def aurora_depends
+              aurora ? TextTemplate.render_from("lambda/aurora_depends.tmpl", self) : ""
+            end
+
+            def db_env
+              lines =
+                if shared
+                  ["DB_HOST: !Ref OwningDatabaseEndpoint", "DB_NAME: #{owner_db_name}",
+                   "DB_SECRET_ARN: !Sub \"${OwningDatabaseSecretArn}\""]
+                else
+                  ["DB_HOST: !GetAtt #{db_ref_id}.Endpoint.Address", "DB_NAME: #{db_name}",
+                   "DB_SECRET_ARN: !Sub \"${#{secret_sub}}\""]
+                end
+              lines.join("\n          ")
+            end
+
+            def schema_env
+              hecks_schema ? "\n          HECKS_SCHEMA: #{hecks_schema}" : ""
+            end
+
+            def rust_oauth_env
+              return "" unless rust_web && google_oauth_present
+
+              tail_indent(TextTemplate.render_from("lambda/rust_oauth_env.tmpl", self), "          ", "\n          ")
+            end
+
+            def rust_oauth_policy
+              return "" unless rust_web && google_oauth_present
+
+              tail_indent(TextTemplate.render_from("lambda/rust_oauth_policy.tmpl", self), "        ")
+            end
+
+            def vpc_config
+              lines =
+                if shared
+                  ["SubnetIds: [!Ref OwningSubnetAId, !Ref OwningSubnetBId]", "SecurityGroupIds: [!Ref OwningSecurityGroupId]"]
+                else
+                  ["SubnetIds: [!Ref #{db_id}SubnetA, !Ref #{db_id}SubnetB]",
+                   "SecurityGroupIds: [!Ref #{logical_id}SecurityGroup]"]
+                end
+              lines.join("\n        ")
+            end
+
+            def web_function_url_output
+              return "" unless web_handler_present
+
+              "\n  WebFunctionUrl:\n    Value: !GetAtt #{web_logical_id}Url.FunctionUrl"
+            end
+
+            private
+
+            def render_block(name)
+              TextTemplate.render_from("lambda/#{name}.tmpl", self).rstrip
+            end
+
+            def compute_description
+              "#{logical_id} - no inbound (Lambda receives no traffic via its VPC ENI), " \
+                "egress rule attached separately below"
+            end
+
+            # Prefixes every line after the first with `pad` (the first with `head`), then drops the
+            # trailing blank lines: a multi-line value spliced into an indented line of a template.
+            def tail_indent(text, pad, head = "")
+              text.each_line.with_index.map { |line, i| (i.zero? ? head : pad) + line }.join.rstrip
+            end
+          end
+        end
+      end
+    end
+  end
+end

data/lib/hecks/projections/deploy/lambda/stack/checks.rb

@@ -0,0 +1,64 @@
+module Hecks
+  module Projections
+    module Deploy
+      module Lambda
+        class Stack
+          # The combinations of settings a Lambda stack refuses, each before any file is written.
+          # Included into `Stack`.
+          module Checks
+            private
+
+            # AWS::WAFv2::WebACL with Scope: CLOUDFRONT is refused by CloudFormation outside
+            # us-east-1; refused here before writing a file.
+            def check_pii_region
+              return unless pii_detected && region != "us-east-1"
+
+              raise ArgumentError, "#{world_file} marks a field \"pii\" but deployed_to(\"AwsLambda\") sets region " \
+                                   "#{region.inspect} — a CloudFront-scoped WAFv2 WebACL can only be created in " \
+                                   "us-east-1. Set region \"us-east-1\", or remove the pii marking if this domain " \
+                                   "genuinely holds none."
+            end
+
+            # A domain declares one web story, not both.
+            def check_one_web_story
+              return unless rust_web && web_handler_present
+
+              raise ArgumentError, "#{domain} declares both web \"Rust\" (#{world_file}) and a lambda_handler.rb " \
+                                   "(#{File.join(domain, "lambda_handler.rb")}) — pick one."
+            end
+
+            def check_web
+              check_shared_handler
+              check_dispatch_none
+            end
+
+            # A shared-instance Ruby WebFunction needs cross-stack DATABASE_URL wiring this
+            # generator doesn't build yet.
+            def check_shared_handler
+              return unless shared && web_handler_present
+
+              raise ArgumentError, "#{domain} declares both database \"Shared\" and a lambda_handler.rb — " \
+                                   "a shared-instance Ruby WebFunction isn't supported yet."
+            end
+
+            # `dispatch "None"` means WebFunction is the domain's only Lambda.
+            def check_dispatch_none
+              return unless dispatch_none
+
+              unless web_handler_present
+                raise ArgumentError, "#{domain} declares dispatch \"None\" but has no lambda_handler.rb — dispatch " \
+                                     "\"None\" means no rust/host dispatch Lambda at all, so a WebFunction " \
+                                     "(lambda_handler.rb) has to exist to be the domain's only Lambda."
+              end
+              return unless rust_web
+
+              raise ArgumentError, "#{domain} declares both dispatch \"None\" and web \"Rust\" — dispatch \"None\" " \
+                                   "already means there is no rust/host Lambda for rust_web's own in-process web " \
+                                   "UI to run inside."
+            end
+          end
+        end
+      end
+    end
+  end
+end

data/lib/hecks/projections/deploy/lambda/stack/deploy_chain.rb

@@ -0,0 +1,119 @@
+module Hecks
+  module Projections
+    module Deploy
+      module Lambda
+        class Stack
+          # The `deploy:` target of the generated Makefile: the builds, the pre-deploy era bridge
+          # and the `sam deploy` chain. Included into `Stack`; each method is also the value of the
+          # template marker of the same name.
+          module DeployChain
+            OWNER_LOOKUPS = {
+              "OWNER_VPC_ID"        => "VpcId",
+              "OWNER_SUBNET_A_ID"   => "PrivateSubnetAId",
+              "OWNER_SUBNET_B_ID"   => "PrivateSubnetBId",
+              "OWNER_SG_ID"         => "FunctionSecurityGroupId",
+              "OWNER_DB_HOST"       => "DatabaseEndpoint",
+              "OWNER_DB_SECRET_ARN" => "DatabaseSecretArn"
+            }.freeze
+            OWNING_OVERRIDES = "OwningVpcId=$$OWNER_VPC_ID OwningSubnetAId=$$OWNER_SUBNET_A_ID " \
+                               "OwningSubnetBId=$$OWNER_SUBNET_B_ID OwningSecurityGroupId=$$OWNER_SG_ID " \
+                               "OwningDatabaseEndpoint=$$OWNER_DB_HOST OwningDatabaseSecretArn=$$OWNER_DB_SECRET_ARN".freeze
+
+            # The builds `make deploy` runs, which depend on which Lambdas the stack has.
+            def build_recipe
+              file =
+                if dispatch_none then "build_dispatch_none"
+                elsif pg_version then "build_pg"
+                elsif web_handler_present then "build_web"
+                else "build_plain"
+                end
+              TextTemplate.render_from("lambda/#{file}.tmpl", self)
+            end
+
+            # The transaction-safety gap, closed for the case that actually matters: `sam deploy` is
+            # what flips this Lambda's own HECKS_DOMAIN/HECKS_SCHEMA env vars live, so the era
+            # history is bridged before it, as well as after. Tab-indented for a Makefile recipe.
+            def predeploy_bridge
+              return "" if shared
+
+              bridge = TextTemplate.render_from("lambda/predeploy_bridge.tmpl", self)
+              bridge.each_line.map { |line| "\t#{line}" }.join.rstrip
+            end
+
+            # Google OAuth newly added to an existing stack would deadlock this bridge:
+            # PublicSubnetId/BastionSubnetId don't exist on the live stack until the upcoming
+            # `sam deploy` creates them, so the pre-check's own `mint-era` call would hand
+            # bastion.yaml an empty Subnet::Id and CloudFormation would refuse it before
+            # `sam deploy` ever runs. Skip the bridge in exactly that case; the unconditional
+            # `mint-era` call at the end of `deploy:` still covers it afterward.
+            def predeploy_bridge_shell
+              file = google_oauth_present ? "predeploy_bridge_oauth" : "predeploy_bridge_plain"
+              TextTemplate.render_from("lambda/#{file}.tmpl", self).rstrip
+            end
+
+            def deploy_recipe_lines
+              lines = []
+              lines << "$(MAKE) sync-google-oauth" if google_oauth_present
+              lines << shared_lookup_note if shared
+              (lines + deploy_shell_chain).map { |line| "\t#{line}" }.join("\n")
+            end
+
+            private
+
+            def shared_lookup_note
+              "@echo \"Looking up #{owner_stack_name}'s shared VpcId/PrivateSubnetAId/PrivateSubnetBId/" \
+                "FunctionSecurityGroupId/DatabaseEndpoint/DatabaseSecretArn outputs to pass as $(STACK)'s " \
+                "Owning* parameters...\""
+            end
+
+            # `@` (Make's "don't echo" prefix) is only meaningful on the chain's true first line, so
+            # lines are built unprefixed and `@` is added once, right before joining.
+            def deploy_shell_chain
+              chain = owner_lookup_lines + sam_deploy_lines
+              return chain unless chain.first&.include?("=$$(")
+
+              ["@#{chain.first}"] + chain.drop(1)
+            end
+
+            def owner_lookup_lines
+              return [] unless shared
+
+              OWNER_LOOKUPS.map do |variable, key|
+                "#{variable}=$$(aws cloudformation describe-stacks --stack-name #{owner_stack_name} " \
+                  "--query \"Stacks[0].Outputs[?OutputKey=='#{key}'].OutputValue\" --output text); \\"
+              end
+            end
+
+            # `google_oauth_present` and `shared` are independent facts, not alternatives: an elsif
+            # would silently drop Owning* overrides whenever OAuth is also present.
+            def sam_deploy_lines
+              overrides = shared ? OWNING_OVERRIDES : nil
+              return oauth_deploy_lines(overrides) if google_oauth_present
+
+              [shared ? "sam deploy --parameter-overrides #{overrides}" : "sam deploy"]
+            end
+
+            def oauth_deploy_lines(overrides)
+              extra = overrides ? " #{overrides}" : ""
+              plain = overrides ? " --parameter-overrides #{overrides}" : ""
+              [
+                web_url_lookup,
+                "if [ -n \"$$WEB_URL\" ]; then \\",
+                "\tsam deploy --parameter-overrides WebRedirectBaseUrl=\"$$WEB_URL\"#{extra}; \\",
+                "else \\",
+                "\tsam deploy#{plain}; \\",
+                "fi"
+              ]
+            end
+
+            def web_url_lookup
+              function = rust_web ? stack_name : "#{stack_name}-web"
+              "WEB_URL=$$(aws lambda get-function-url-config --function-name #{function} --query FunctionUrl " \
+                "--output text 2>/dev/null | sed 's:/$$::'); \\"
+            end
+          end
+        end
+      end
+    end
+  end
+end

data/lib/hecks/projections/deploy/lambda/stack/readers.rb

@@ -0,0 +1,62 @@
+module Hecks
+  module Projections
+    module Deploy
+      module Lambda
+        class Stack
+          # The ids and references derived from a stack's declared facts. Each method is also the
+          # value of the template marker of the same name.
+          module Readers
+            def db_id = "#{logical_id.delete_suffix("Function")}Db"
+
+            # Aurora splits the database into a DBCluster plus DBInstance(s), so every
+            # `.Endpoint.Address`/`.MasterUserSecret` reference has to point at the cluster, not
+            # `db_id`, when Aurora is chosen.
+            def db_ref_id = aurora ? "#{db_id}Cluster" : db_id
+
+            # Aurora uses a self-managed secret (ManageMasterUserPassword rotation would break a
+            # Lambda's static Environment); plain RDS uses its own MasterUserSecret attribute.
+            # `secret_sub` is for `!Sub "${...}"` interpolation; `secret_intrinsic` is the same fact
+            # as a bare value.
+            def secret_sub = aurora ? "#{db_id}Secret" : "#{db_ref_id}.MasterUserSecret.SecretArn"
+            def secret_intrinsic = aurora ? "!Ref #{db_id}Secret" : "!GetAtt #{db_ref_id}.MasterUserSecret.SecretArn"
+
+            # Shared mode has no `secret_sub` of its own; `OwningDatabaseSecretArn` (the template's
+            # Parameter) is already a bare ARN string.
+            def db_secret_ref = shared ? "OwningDatabaseSecretArn" : secret_sub
+
+            def host_dir = File.join(root, "rust", "host")
+            def wasm_path = File.join(root, "rust", "dist", "#{domain_name}.wasm")
+            def ir_path = File.join(root, "rust", "dist", "#{domain_name}.ir.json")
+            def infra_name_literal = infra_name.inspect
+            def declared_domain_literal = declared_domain_name.inspect
+            def schema_setting = hecks_schema ? ", schema: #{hecks_schema.inspect}" : ""
+            def function_url_auth = rust_web ? "NONE" : "AWS_IAM"
+            def oauth_function_id = rust_web ? logical_id : web_logical_id
+
+            def network
+              Shared::Network.new(shared: shared, db_id: db_id, db_ref_id: db_ref_id, db_name: db_name,
+                                  infra_name: infra_name, aurora: aurora, google_oauth_present: google_oauth_present)
+            end
+
+            # The stack-to-bastion contract: one table `template.yaml`'s Outputs, `bastion.yaml`'s
+            # Parameters and the Makefile's overrides all read from.
+            def stack_outputs
+              group = "!Ref #{logical_id}SecurityGroup"
+              outputs = Shared.stack_outputs(network, secret_intrinsic: secret_intrinsic, compute_security_group_ref: group)
+              Shared.check_bastion_parameters!(bastion_parameters, outputs)
+              outputs
+            end
+
+            def bastion_parameters
+              Shared.bastion_parameters(shared: shared, google_oauth_present: google_oauth_present)
+            end
+
+            def output_lines
+              stack_outputs.map { |output| "#{output[:key]}:\n    Value: #{output[:ref]}" }.join("\n  ")
+            end
+          end
+        end
+      end
+    end
+  end
+end

data/lib/hecks/projections/deploy/lambda/stack/reading.rb

@@ -0,0 +1,170 @@
+module Hecks
+  module Projections
+    module Deploy
+      module Lambda
+        class Stack
+          # Reads a stack's facts from the options, the world and the files beside it. Included into
+          # `Stack`; each step is one move of its constructor.
+          module Reading
+            private
+
+            def read_options(options)
+              world = options.fetch(:world)
+              @domain = options.fetch(:domain_dir)
+              @root = options.fetch(:root)
+              @world_file = options.fetch(:world_file)
+              @registry = options.fetch(:cross_domain_registry)
+              @tenant_options = options[:tenant] || {}
+              @domain_name = File.basename(domain)
+              @declared_domain_name = world.domain
+              @deploy_settings = world.for_verb("deployed_to")
+            end
+
+            # Structural-only load (no `run_boot_gates!`/live persistence adapter) populates
+            # `registry.pending_privacy_markings` for pii detection without requiring a real
+            # Postgres connection to generate a template.
+            #
+            # Only `category: "pii"` triggers CloudFront/WAF provisioning; other marking categories
+            # (e.g. "phi") stay a Governance/redaction concern.
+            def detect_pii
+              pii_registry = Hecks::Runtime::Registry.new(root: File.expand_path(domain))
+              Hecks.with_registry(pii_registry) { load_structure(File.join(domain, "bluebook")) }
+              @pii_detected = pii_registry.pending_privacy_markings.any? { |marking| marking[:category].to_s == "pii" }
+            end
+
+            def load_structure(bluebook_dir)
+              bootstrap = Hecks::Ports::Loading.bootstrap
+              bootstrap.load_library
+              bootstrap.load_project(bootstrap.shared_root(nil, bluebook_dir))
+              bootstrap.load_bluebooks(bluebook_dir)
+              Dir.glob(File.join(bluebook_dir, "*.hecksagon")).each { |file| Kernel.load(file) }
+            end
+
+            # Applied before infra_name/hecks_schema below, so both read the override the same way
+            # they read any other `deployed_to` setting.
+            def read_names
+              apply_tenant
+              # Every AWS-facing name (stack, logical ids, S3 prefixes, secrets) reads `infra_name`,
+              # not `domain_name`, so a `stack_name` override survives a later `formerly_known_as`
+              # rename of the declared identity without renaming (and disconnecting from) the live
+              # AWS stack.
+              @infra_name = deploy_settings[:stack_name] || domain_name
+              # RDS's own DBName/DatabaseName parameter refuses non-alphanumeric characters; every
+              # downstream consumer (Environment vars, Makefile shell commands) has to read the same
+              # sanitized spelling.
+              @db_name = infra_name.gsub(/[^a-zA-Z0-9]/, "")
+            end
+
+            def apply_tenant
+              return unless @tenant_options[:tenant]
+
+              base_stack_name = deploy_settings[:stack_name] || domain_name
+              schema = @tenant_options.key?(:schema) ? @tenant_options[:schema] : @tenant_options[:tenant]
+              @deploy_settings = deploy_settings.merge(stack_name: "#{base_stack_name}-#{@tenant_options[:tenant]}",
+                                                       schema:     schema)
+            end
+
+            # Dispatches into LambdaTarget.Declare's given/invariant machinery for named,
+            # corpus-testable refusals (memory/timeout checked as real Integers against Lambda's
+            # 128-10240 MB / 900s ceilings).
+            def declare_target
+              dispatcher = Hecks.boot(File.expand_path("../../../../deploy", __dir__))
+              target = dispatcher.dispatch("Deploy::LambdaTarget.Declare", with: declare_arguments).instance
+              read_target(target.state)
+            rescue *Hecks::Runtime::DOMAIN_REFUSALS => e
+              raise ArgumentError, "#{world_file}'s deployed_to(\"AwsLambda\") is invalid: #{e.message}"
+            end
+
+            def declare_arguments
+              {
+                domain:   { value: declared_domain_name },
+                region:   { value: deploy_settings[:region] },
+                memory:   { value: deploy_settings.fetch(:memory, 512) },
+                timeout:  { value: deploy_settings.fetch(:timeout, 10) },
+                database: { value: deploy_settings.fetch(:database, "Postgres") },
+                web:      { value: deploy_settings.fetch(:web, "None") },
+                **declared_strings
+              }
+            end
+
+            def declared_strings
+              %i[dispatch handler_module secret_env].select { |key| deploy_settings.key?(key) }
+                                                    .to_h { |key| [key, { value: deploy_settings[key].to_s }] }
+            end
+
+            def read_target(state)
+              read_dispatch
+              @region = state[:region].value
+              @memory = state[:memory].value
+              @timeout = state[:timeout].value
+              @aurora = state[:database].value == "Aurora"
+              @shared = state[:database].value == "Shared"
+              @rust_web = state[:web].value == "Rust"
+            end
+
+            def read_dispatch
+              # `dispatch "None"` skips generating a rust/host dispatch Lambda for a domain with no
+              # `.bluebook` command surface to dispatch through (e.g. QualityControl's GitHub
+              # webhook, dispatching straight into Ruby); such a domain's WebFunction becomes its
+              # only Lambda.
+              @dispatch_none = deploy_settings[:dispatch].to_s == "None"
+              # Names the env var WebFunction's `lambda_handler.rb` finds the fetched secret's
+              # plaintext under, once it resolves `#{secret_env}_ARN`.
+              @webhook_secret_env = deploy_settings[:secret_env]
+              # The module name `lambda_handler.rb` actually defines; named here since
+              # `dispatch "None"` domains may each pick their own.
+              @webhook_handler_module = deploy_settings.fetch(:handler_module, "WebLambdaHandler")
+              read_cross_domain_targets
+            end
+
+            # Scans every loaded chapter, not just this domain's own: an `attaches`-attached chapter
+            # can itself declare a cross-domain policy, including one nested inside
+            # `aggregate "X" do ... end`.
+            def read_cross_domain_targets
+              @cross_domain_targets = @registry.bluebooks.flat_map do |_name, bluebook|
+                bluebook.policies.select(&:target_domain).map(&:target_domain)
+              end.uniq.sort
+            end
+
+            # Shared mode provisions no RDS/VPC of its own; it borrows another already-deployed
+            # domain's instance, isolated by Postgres schema.
+            def read_owner
+              read_geo_restriction
+              read_shared_owner if shared
+              @hecks_schema = shared ? infra_name : deploy_settings[:schema]
+            end
+
+            # Read off `deploy_settings` directly, not the declared target: these two are optional
+            # and pii-only, unlike every always-validated target state.
+            def read_geo_restriction
+              @geo_restriction_type = deploy_settings[:geo_restriction] || "none"
+              @geo_restriction_countries = deploy_settings[:geo_restriction_countries] || []
+            end
+
+            def read_shared_owner
+              @owner_domain_name = deploy_settings[:owner] or raise ArgumentError, missing_owner_message
+              # `owner_stack` is the escape hatch for an owner whose live stack name predates the
+              # "hecks-<lowercase name>" convention below.
+              @owner_stack_name = deploy_settings[:owner_stack] || "hecks-#{owner_domain_name.downcase}"
+              @owner_db_name = owner_domain_name.downcase
+            end
+
+            def missing_owner_message
+              TextTemplate.render_from("lambda/missing_owner.tmpl", self)
+            end
+
+            # The "hecks-" half of this domain's own stack name is overridable for a live stack that
+            # predates the convention. Everything downstream (FunctionNames, OAuth secret, bastion
+            # stack, samconfig) reads `stack_name`; `infra_name` (logical ids, DB name) is
+            # untouched.
+            def derive_ids
+              @logical_id = "#{infra_name.split(/[_-]/).map(&:capitalize).join}Function"
+              @stack_prefix = deploy_settings[:stack_prefix] || "hecks"
+              @stack_name = "#{stack_prefix}-#{infra_name}"
+            end
+          end
+        end
+      end
+    end
+  end
+end

data/lib/hecks/projections/deploy/lambda/stack/reading_web.rb

@@ -0,0 +1,53 @@
+module Hecks
+  module Projections
+    module Deploy
+      module Lambda
+        class Stack
+          # Reads the facts about the domain's own web function from the files beside the world.
+          # Included into `Stack`; each step is one move of its constructor.
+          module ReadingWeb
+            private
+
+            # Opt-in by file presence: a domain wanting its own web app on Lambda drops a
+            # `lambda_handler.rb` (the Rack-to-Function-URL-event adapter Sinatra runs through) at
+            # its own root. No separate .world verb.
+            def read_web
+              @web_handler_present = File.exist?(File.join(domain, "lambda_handler.rb"))
+              check_one_web_story
+              @pg_version = read_pg_version
+              @web_logical_id = "WebFunction"
+              read_web_paths
+              read_google_oauth
+            end
+
+            # Read from the domain's own Gemfile.lock, not hardcoded: the `patch-pg-native` build
+            # recipe must fetch the same pg version Bundler resolved, or the from-source extension
+            # can drift from it. `dispatch "None"` reads this project's own root Gemfile.lock, not
+            # the domain's: the domain has no Gemfile of its own to bundle.
+            def read_pg_version
+              return nil unless web_handler_present
+
+              File.read(File.join(dispatch_none ? root : domain, "Gemfile.lock"))[/^\s+pg \(([\d.]+)\)/, 1]
+            end
+
+            # `dispatch "None"` means the domain alone has no Gemfile/lib/hecks to zip, so CodeUri
+            # is `root` there instead.
+            def read_web_paths
+              @web_code_uri = dispatch_none ? root : domain
+              @web_handler_relpath = dispatch_none ? "#{domain}/lambda_handler" : "lambda_handler"
+            end
+
+            # `.env.local` is the domain's gitignored local-dev secrets file, read only to detect
+            # the key is present; `make sync-google-oauth` syncs the real value into Secrets Manager
+            # at deploy time.
+            def read_google_oauth
+              env_file = File.join(domain, ".env.local")
+              @google_oauth_present = (web_handler_present || rust_web) && File.exist?(env_file) &&
+                                      File.read(env_file).match?(/^GOOGLE_CLIENT_ID=\S/)
+            end
+          end
+        end
+      end
+    end
+  end
+end