hecks 3.4.2 → 3.6.0

data/lib/hecks/projections/deploy/lambda.rb

@@ -1,5 +1,8 @@
 require_relative "../../projector"
 require_relative "shared"
+require_relative "text_template"
+require_relative "lambda/stack"
+require_relative "lambda/pii"
 
 module Hecks
   module Projections
@@ -22,1901 +25,90 @@ module Hecks
         # @return [Hash{String => String}] generated file contents by filename
         # @raise [ArgumentError] if `deployed_to("AwsLambda")` is invalid
         def call(bluebook:, options: {})
-          world                 = options.fetch(:world)
-          domain                = options.fetch(:domain_dir)
-          root                  = options.fetch(:root)
-          world_file            = options.fetch(:world_file)
-          cross_domain_registry = options.fetch(:cross_domain_registry)
-          tenant_options        = options[:tenant] || {}
-
-          domain_name          = File.basename(domain)
-          declared_domain_name = world.domain
-
-          deploy_settings = world.for_verb("deployed_to")
-
-          # Structural-only load (no `run_boot_gates!`/live persistence adapter)
-          # populates `registry.pending_privacy_markings` for pii detection below
-          # without requiring a real Postgres connection to generate a template.
-          pii_registry = Hecks::Runtime::Registry.new(root: File.expand_path(domain))
-          Hecks.with_registry(pii_registry) do
-            bootstrap = Hecks::Ports::Loading.bootstrap
-            bluebook_dir = File.join(domain, "bluebook")
-            bootstrap.load_library
-            bootstrap.load_project(bootstrap.shared_root(nil, bluebook_dir))
-            bootstrap.load_bluebooks(bluebook_dir)
-            Dir.glob(File.join(bluebook_dir, "*.hecksagon")).each { |file| Kernel.load(file) }
-          end
-
-          # Only `category: "pii"` triggers CloudFront/WAF provisioning; other
-          # marking categories (e.g. "phi") stay a Governance/redaction concern.
-          pii_detected = pii_registry.pending_privacy_markings.any? { |marking| marking[:category].to_s == "pii" }
-
-          # Applied before infra_name/hecks_schema below, so both read the
-          # override the same way they read any other `deployed_to` setting.
-          if tenant_options[:tenant]
-            base_stack_name = deploy_settings[:stack_name] || domain_name
-            deploy_settings = deploy_settings.merge(
-              stack_name: "#{base_stack_name}-#{tenant_options[:tenant]}",
-              schema:     tenant_options[:schema] || tenant_options[:tenant]
-            )
-          end
-
-          # Every AWS-facing name (stack, logical ids, S3 prefixes, secrets)
-          # reads `infra_name`, not `domain_name`, so a `stack_name` override
-          # survives a later `formerly_known_as` rename of the declared identity
-          # without renaming (and disconnecting from) the live AWS stack.
-          infra_name = deploy_settings[:stack_name] || domain_name
-
-          # RDS's own DBName/DatabaseName parameter refuses non-alphanumeric
-          # characters; every downstream consumer (Environment vars, Makefile
-          # shell commands) has to read the same sanitized spelling.
-          db_name = infra_name.gsub(/[^a-zA-Z0-9]/, "")
-
-          # Dispatches into LambdaTarget.Declare's given/invariant machinery for
-          # named, corpus-testable refusals (memory/timeout checked as real
-          # Integers against Lambda's 128-10240 MB / 900s ceilings).
-          deploy_dispatcher = Hecks.boot(File.expand_path("../../deploy", __dir__))
-          begin
-            target = deploy_dispatcher.dispatch(
-              "Deploy::LambdaTarget.Declare",
-              with: {
-                domain:   { value: declared_domain_name },
-                region:   { value: deploy_settings[:region] },
-                memory:   { value: deploy_settings.fetch(:memory, 512) },
-                timeout:  { value: deploy_settings.fetch(:timeout, 10) },
-                database: { value: deploy_settings.fetch(:database, "Postgres") },
-                web: { value: deploy_settings.fetch(:web, "None") },
-                **%i[dispatch handler_module secret_env].select { |key| deploy_settings.key?(key) }
-                                                        .to_h { |key| [key, { value: deploy_settings[key].to_s }] }
-              }
-            ).instance
-          rescue *Hecks::Runtime::DOMAIN_REFUSALS => e
-            raise ArgumentError, "#{world_file}'s deployed_to(\"AwsLambda\") is invalid: #{e.message}"
-          end
-
-          # `dispatch "None"` skips generating a rust/host dispatch Lambda for a
-          # domain with no `.bluebook` command surface to dispatch through (e.g.
-          # QualityControl's GitHub webhook, dispatching straight into Ruby);
-          # such a domain's WebFunction becomes its only Lambda.
-          dispatch_none = deploy_settings[:dispatch].to_s == "None"
-
-          # Names the env var WebFunction's `lambda_handler.rb` finds the fetched
-          # secret's plaintext under, once it resolves `#{secret_env}_ARN`.
-          webhook_secret_env = deploy_settings[:secret_env]
-
-          # The module name `lambda_handler.rb` actually defines; named here
-          # since `dispatch "None"` domains may each pick their own.
-          webhook_handler_module = deploy_settings.fetch(:handler_module, "WebLambdaHandler")
-
-          # Scans every loaded chapter, not just this domain's own — a
-          # `attaches`-attached chapter can itself declare a cross-domain
-          # policy, including one nested inside `aggregate "X" do ... end`.
-          cross_domain_lambda_targets = cross_domain_registry.bluebooks.flat_map { |chapter_name, bluebook|
-            bluebook.policies.select(&:target_domain).map(&:target_domain)
-          }.uniq.sort
-
-
-          region   = target.state[:region].value
-          memory   = target.state[:memory].value
-          timeout  = target.state[:timeout].value
-          database = target.state[:database].value
-          aurora   = database == "Aurora"
-          shared   = database == "Shared"
-          rust_web = target.state[:web].value == "Rust"
-
-          # AWS::WAFv2::WebACL with Scope: CLOUDFRONT is refused by
-          # CloudFormation outside us-east-1; refused here before writing a file.
-          if pii_detected && region != "us-east-1"
-            raise ArgumentError, "#{world_file} marks a field \"pii\" but deployed_to(\"AwsLambda\") sets region " \
-                                  "#{region.inspect} — a CloudFront-scoped WAFv2 WebACL can only be created in " \
-                                  "us-east-1. Set region \"us-east-1\", or remove the pii marking if this domain " \
-                                  "genuinely holds none."
-          end
-
-          # Read off `deploy_settings` directly, not `target` — these two are
-          # optional and pii-only, unlike every always-validated `target.state`.
-          geo_restriction_type      = deploy_settings[:geo_restriction] || "none"
-          geo_restriction_countries = deploy_settings[:geo_restriction_countries] || []
-
-          # Shared mode provisions no RDS/VPC of its own; it borrows another
-          # already-deployed domain's instance, isolated by Postgres schema.
-          if shared
-            owner_domain_name = deploy_settings[:owner] or raise ArgumentError, <<~MSG
-              #{world_file}'s deployed_to("AwsLambda") declares database "Shared" but no owner. Add one, e.g.:
-
-                  deployed_to("AwsLambda") do
-                    ...
-                    database "Shared"
-                    owner "Core"
-                  end
-
-              naming the already-deployed domain whose Postgres instance this one borrows.
-            MSG
-            # `owner_stack` is the escape hatch for an owner whose live stack
-            # name predates the "hecks-<lowercase name>" convention below.
-            owner_stack_name = deploy_settings[:owner_stack] || "hecks-#{owner_domain_name.downcase}"
-            owner_db_name     = owner_domain_name.downcase
-          end
-
-          # rust/host's optional counterpart to Ruby's `settings[:schema]`.
-          # Automatic (this domain's lowercase name) in Shared mode; otherwise
-          # explicit via `deployed_to("AwsLambda") { schema "..." }`.
-          hecks_schema = shared ? infra_name : deploy_settings[:schema]
-
-          logical_id = "#{infra_name.split(/[_-]/).map(&:capitalize).join}Function"
-          # The "hecks-" half of this domain's own stack name; overridable for a
-          # live stack that predates the convention. Everything downstream
-          # (FunctionNames, OAuth secret, bastion stack, samconfig) reads
-          # `stack_name`; `infra_name` (logical ids, DB name) is untouched.
-          stack_prefix = deploy_settings[:stack_prefix] || "hecks"
-          stack_name = "#{stack_prefix}-#{infra_name}"
-
-          db_id = "#{logical_id.sub(/Function\z/, '')}Db"
-          # Aurora splits the database into a DBCluster plus DBInstance(s), so
-          # every `.Endpoint.Address`/`.MasterUserSecret` reference below has to
-          # point at the cluster, not `db_id`, when Aurora is chosen.
-          db_ref_id = aurora ? "#{db_id}Cluster" : db_id
-
-          # Aurora uses a self-managed secret (ManageMasterUserPassword rotation
-          # would break a Lambda's static Environment); plain RDS uses its own
-          # MasterUserSecret attribute. `secret_sub` is for `!Sub "${...}"`
-          # interpolation; `secret_intrinsic` is the same fact as a bare value.
-          secret_sub       = aurora ? "#{db_id}Secret" : "#{db_ref_id}.MasterUserSecret.SecretArn"
-          secret_intrinsic = aurora ? "!Ref #{db_id}Secret" : "!GetAtt #{db_ref_id}.MasterUserSecret.SecretArn"
-          # Shared mode has no `secret_sub` of its own; `OwningDatabaseSecretArn`
-          # (this template's Parameter) is already a bare ARN string.
-          db_secret_ref = shared ? "OwningDatabaseSecretArn" : secret_sub
-
-          # Opt-in by file presence: a domain wanting its own web app on Lambda
-          # drops a `lambda_handler.rb` (the Rack-to-Function-URL-event adapter
-          # Sinatra runs through) at its own root. No separate .world verb.
-          web_handler_present = File.exist?(File.join(domain, "lambda_handler.rb"))
-
-          # A domain declares one web story, not both.
-          if rust_web && web_handler_present
-            raise ArgumentError, "#{domain} declares both web \"Rust\" (#{world_file}) and a lambda_handler.rb (#{File.join(domain, 'lambda_handler.rb')}) — pick one."
-          end
-
-          # Read from the domain's own Gemfile.lock, not hardcoded — the
-          # `patch-pg-native` build recipe below must fetch the same pg version
-          # Bundler resolved, or the from-source extension can drift from it.
-          pg_version = nil
-          if web_handler_present
-            # `dispatch "None"` reads this project's own root Gemfile.lock, not
-            # #{domain}'s: #{domain} has no Gemfile of its own to bundle (it
-            # needs `lib/hecks` from one level up), so CodeUri is `root` there.
-            pg_version_path = File.join(dispatch_none ? root : domain, "Gemfile.lock")
-            pg_version = File.read(pg_version_path)[/^\s+pg \(([\d.]+)\)/, 1]
-          end
-          web_logical_id = "WebFunction"
-
-          # Same `dispatch "None"` split as `pg_version_path` above: #{domain}
-          # alone has no Gemfile/lib/hecks to zip, so CodeUri is `root` instead.
-          web_code_uri = dispatch_none ? root : domain
-          web_handler_relpath = dispatch_none ? "#{domain}/lambda_handler" : "lambda_handler"
-
-          # `.env.local` is #{domain}'s gitignored local-dev secrets file, read
-          # only to detect the key is present; `make sync-google-oauth` syncs
-          # the real value into Secrets Manager at deploy time.
-          google_oauth_present = (web_handler_present || rust_web) &&
-            File.exist?(File.join(domain, ".env.local")) &&
-            File.read(File.join(domain, ".env.local")).match?(/^GOOGLE_CLIENT_ID=\S/)
+          stack = Stack.new(options)
+          files = { "template.yaml" => template_yaml(stack) }
+          # A separate, sibling stack for the few minutes `make mint-era` needs it, then deleted:
+          # SSM Session Manager only, never SSH, no inbound rule at all. Skipped when `shared`:
+          # era-minting reuses the owner's own standing infrastructure instead.
+          files["bastion.yaml"] = bastion_yaml(stack) unless stack.shared
+          files["Makefile"] = TextTemplate.render_from("lambda/Makefile.tmpl", stack)
+          # Everything `sam deploy --guided` would ask interactively is already known from the
+          # domain's own `deployed_to("AwsLambda")` block.
+          files["samconfig.toml"] = TextTemplate.render_from("lambda/samconfig.toml.tmpl", stack)
+          files
+        end
 
-          # A shared-instance Ruby WebFunction needs cross-stack DATABASE_URL
-          # wiring this generator doesn't build yet.
-          if shared && web_handler_present
-            raise ArgumentError, "#{domain} declares both database \"Shared\" and a lambda_handler.rb — a shared-instance Ruby WebFunction isn't supported yet."
-          end
+        # Builds the CloudFront/WAFv2/logging resources a pii-marked domain is fronted by.
+        #
+        # @param fronted_logical_id [String] the function the distribution fronts
+        # @param use_oac [Boolean] whether the distribution signs its requests to the function
+        # @param geo_restriction_type [String] `none`, `whitelist` or `blacklist`
+        # @param geo_restriction_countries [Array<String>] the country codes the restriction lists
+        # @return [String] the resources, indented two spaces under `Resources:`
+        def pii_cloudfront_yaml(fronted_logical_id:, use_oac:, geo_restriction_type:, geo_restriction_countries:)
+          Pii.cloudfront_yaml(fronted_logical_id: fronted_logical_id, use_oac: use_oac,
+                              geo_restriction_type: geo_restriction_type,
+                              geo_restriction_countries: geo_restriction_countries)
+        end
 
-          # `dispatch "None"` means WebFunction is the domain's only Lambda.
-          if dispatch_none && !web_handler_present
-            raise ArgumentError, "#{domain} declares dispatch \"None\" but has no lambda_handler.rb — dispatch \"None\" means no rust/host dispatch Lambda at all, so a WebFunction (lambda_handler.rb) has to exist to be the domain's only Lambda."
-          end
-          if dispatch_none && rust_web
-            raise ArgumentError, "#{domain} declares both dispatch \"None\" and web \"Rust\" — dispatch \"None\" already means there is no rust/host Lambda for rust_web's own in-process web UI to run inside."
+        # Renders `template.yaml`, then the edits that are made after it renders, not interpolated
+        # inside it: a `#{...}` marker at column 0 would drag the template's own dedent computation
+        # to zero and leave every other line un-stripped.
+        #
+        # @param stack [Stack] the stack the world declares
+        # @return [String] the SAM template
+        def template_yaml(stack)
+          text = TextTemplate.render_from("lambda/template.yaml.tmpl", stack)
+          text = text.sub(/^([ \t]*)# TMPL:cross_domain_lambda_policies\n/) do
+            Shared.cross_domain_invoke_policy_yaml(stack.cross_domain_targets, Regexp.last_match(1))
           end
+          text = with_pii_distribution(text, stack) if stack.pii_detected
+          stack.dispatch_none ? without_dispatch_function(text, stack) : text
+        end
 
-          # A Shared-mode rust_web domain with OAuth needs no new NAT Gateway:
-          # it already runs inside the owner's borrowed private subnets and
-          # security group, which already route to the internet for OAuth.
-
-          # The stack-bastion contract and the least-privilege cross-domain
-          # invoke grant are shared with `Fargate` — see `Shared`'s header.
-          stack_outputs = Shared.stack_outputs(
-            shared: shared, db_id: db_id, db_ref_id: db_ref_id, secret_intrinsic: secret_intrinsic,
-            compute_security_group_ref: "!Ref #{logical_id}SecurityGroup", google_oauth_present: google_oauth_present
+        # Operates on the already-rendered string: the pii resources are built correctly indented,
+        # so nothing here interacts with a template's own dedent computation.
+        def with_pii_distribution(text, stack)
+          resources = pii_cloudfront_yaml(
+            fronted_logical_id: stack.web_handler_present ? stack.web_logical_id : stack.logical_id,
+            use_oac: !stack.web_handler_present && !stack.rust_web,
+            geo_restriction_type: stack.geo_restriction_type, geo_restriction_countries: stack.geo_restriction_countries
           )
-          bastion_parameters = Shared.bastion_parameters(shared: shared, google_oauth_present: google_oauth_present)
-          Shared.check_bastion_parameters!(bastion_parameters, stack_outputs)
-
-          # A plain local, not two heredocs opened side by side inside the
-          # template heredoc's own interpolation — a heredoc body starts on the
-          # line after it opens, so an if/else here keeps each one unambiguous.
-          web_google_oauth_env_yaml =
-            if google_oauth_present
-              <<~GOOGLE.each_line.with_index.map { |l, i| i.zero? ? l : "        " + l }.join.rstrip
-                # BY NAME, not `!Ref`/`!GetAtt` -- #{web_logical_id}GoogleOauth
-                # is deliberately NOT declared as a CloudFormation resource
-                # here (would need either GenerateSecretString, which can't
-                # invent a real Google client_id/secret, or a value baked
-                # into this git-TRACKED template as plaintext). `make
-                # sync-google-oauth` owns this secret's whole lifecycle
-                # instead, straight from #{domain}'s own gitignored
-                # .env.local, outside CloudFormation entirely. GetSecretValue
-                # accepts a bare name directly, no ARN needed -- same
-                # generator-only caveat as DB_SECRET_ARN's own comment above.
-                GOOGLE_OAUTH_SECRET_ID: #{stack_name}-web-google-oauth
-                GOOGLE_REDIRECT_URI: !Sub "${WebRedirectBaseUrl}/auth/google/callback"
-              GOOGLE
-            else
-              <<~NOOAUTH.each_line.with_index.map { |l, i| i.zero? ? l : "        " + l }.join.rstrip
-                # GOOGLE_CLIENT_ID/GOOGLE_CLIENT_SECRET/GOOGLE_REDIRECT_URI
-                # deliberately NOT set here — #{domain}'s own .env.local has
-                # no real GOOGLE_CLIENT_ID yet, matching Fly's own current
-                # reality (its secrets list holds only
-                # DATABASE_URL and SESSION_SECRET) that nobody has configured
-                # OAuth for this app at all. Drop real credentials into
-                # .env.local and regenerate to wire this up.
-              NOOAUTH
-            end
-
-          template_yaml = <<~YAML
-            # GENERATED by hecks deploy project #{domain} — re-run it to refresh
-            # this file rather than hand-editing. Source: #{world_file}'s own
-            # deployed_to("AwsLambda") block.
-            #
-            # SELF-CONTAINED, ON PURPOSE — this stack owns its own private VPC,
-            # subnets, security groups, and RDS Postgres instance, not just the
-            # Lambda. No externally-supplied VPC/database parameters, no
-            # DatabaseUrl secret anyone has to type: RDS's own
-            # ManageMasterUserPassword generates and stores the password in
-            # Secrets Manager, and DATABASE_URL is composed from it via a
-            # CloudFormation dynamic reference — resolved at deploy time, never
-            # visible in this template, a parameter, or any tool's output.
-            #
-            # NO NAT GATEWAY for #{logical_id} — deliberately. Its own subnets
-            # have no route to the internet at all, only to the RDS instance
-            # inside the same VPC: dispatch a command, read/write the journal.
-            # CloudWatch Logs delivery doesn't go through the function's own VPC
-            # networking, so it needs no route either.
-            #{google_oauth_present ? "  #\n  # #{web_logical_id} is the ONE exception -- real Google OAuth token\n  # exchange (hecks's own GoogleAuthentication adapter posting to\n  # https://oauth2.googleapis.com/token) is a genuine third-party HTTPS\n  # call with no AWS PrivateLink/VPC Endpoint option (unlike\n  # lambda:InvokeFunction, above), and #{web_logical_id} is ALSO\n  # VPC-attached (Member's own permanent Postgres binding needs the\n  # private RDS instance directly). A real, live 15-second Lambda\n  # timeout caught this -- the token-exchange POST had nowhere to\n  # route to and just hung. #{db_id}NatGateway below is the real,\n  # ongoing-cost fix (one NAT Gateway, one public subnet) -- opt-in,\n  # the SAME google_oauth_present signal that wires\n  # GOOGLE_CLIENT_ID/SECRET, since nothing else in this stack needs\n  # outbound internet at all." : "  # Real outbound internet access from here (a future external API\n  # call, say) would need a NAT Gateway added -- a real, ongoing cost\n  # this template doesn't take on until something actually needs it."}
-            AWSTemplateFormatVersion: '2010-09-09'
-            Transform: AWS::Serverless-2016-10-31
-            Description: >
-              #{infra_name} — dispatched through hecks's rust/host, a
-              wasmtime-sandboxed Rust binary with a rehydrate-and-replay Postgres
-              journal (docs/decisions/0018), backed by its own private RDS
-              Postgres instance. PackageType Zip, no container.
-            #{
-              # google_oauth_present and shared are independent and collected
-              # into one array under a single `Parameters:` header, not an
-              # if/elsif/else — both can be true at once (a Shared-mode
-              # rust_web domain with real Google OAuth).
-              param_blocks = []
-              if google_oauth_present
-                param_blocks << <<~OAUTHPARAMS.rstrip
-                  # Lambda Function URLs get a random, un-derivable hostname at
-                  # creation -- #{web_logical_id}'s own GOOGLE_REDIRECT_URI can't
-                  # reference `!GetAtt #{web_logical_id}Url.FunctionUrl` from inside
-                  # #{web_logical_id}'s OWN Environment (that's a real circular
-                  # dependency CloudFormation rejects: the value doesn't exist until
-                  # the function+URL do). Resolved OUTSIDE the stack instead --
-                  # `make deploy`'s own recipe looks up the CURRENTLY deployed
-                  # Function URL (empty on a true first deploy, before the URL
-                  # exists at all) and passes it as `--parameter-overrides`; every
-                  # deploy after the first self-heals this correctly.
-                  WebRedirectBaseUrl:
-                    Type: String
-                    Default: ""
-                OAUTHPARAMS
-              end
-              if shared
-                param_blocks << <<~SHAREDPARAMS.rstrip
-                  # THE STOREHOUSE — #{owner_domain_name}'s own live stack Outputs,
-                  # looked up at deploy time (Makefile's own `deploy:`/`mint-era`
-                  # targets, below) via the SAME `aws cloudformation describe-stacks`
-                  # pattern `mint-era` already used for a bastion, one stack over
-                  # instead of one sibling stack over. Never a CloudFormation
-                  # Export/ImportValue -- this codebase uses none anywhere (hecks
-                  # deploy project's own header on why: a live shell lookup keeps
-                  # this stack independently deployable/deletable, never coupled to
-                  # #{owner_domain_name}'s own stack through CloudFormation itself).
-                  OwningVpcId:
-                    Type: AWS::EC2::VPC::Id
-                  OwningSubnetAId:
-                    Type: AWS::EC2::Subnet::Id
-                  OwningSubnetBId:
-                    Type: AWS::EC2::Subnet::Id
-                  # #{owner_domain_name}'s own Lambda security group, NOT its
-                  # DB-facing one -- reused whole, not copied, the same shape
-                  # this codebase already trusts elsewhere (a WebFunction sharing
-                  # its own dispatch Lambda's security group rather than minting
-                  # a second one), one stack over instead of one resource over.
-                  # #{owner_domain_name}'s own DB security group already permits
-                  # ingress FROM this group (every member of it, regardless of
-                  # which stack minted the member -- security group references
-                  # match on GROUP MEMBERSHIP, not resource identity), so joining
-                  # it is what actually grants this Lambda access, not a new
-                  # ingress rule #{owner_domain_name}'s own stack would otherwise
-                  # need to add.
-                  OwningSecurityGroupId:
-                    Type: AWS::EC2::SecurityGroup::Id
-                  OwningDatabaseEndpoint:
-                    Type: String
-                  OwningDatabaseSecretArn:
-                    Type: String
-                SHAREDPARAMS
-              end
-              if param_blocks.empty?
-                ""
-              else
-                # Indented 2: the heredocs above dedent to column 0, but these
-                # are Parameters: children, which YAML requires indented under it.
-                "Parameters:\n" + param_blocks.join("\n").each_line.map { |l| "  #{l}" }.join
-              end
-            }
-            Resources:
-              #{shared ? "" : Shared.vpc_and_database_yaml(
-                db_id: db_id, db_name: db_name, infra_name: infra_name, aurora: aurora,
-                google_oauth_present: google_oauth_present, compute_logical_id: logical_id,
-                compute_description: "#{logical_id} - no inbound (Lambda receives no traffic via its VPC ENI), egress rule attached separately below"
-              ).each_line.with_index.map { |l, i| (i.zero? ? "" : "  ") + l }.join.rstrip}
-
-              #{rust_web && google_oauth_present ? <<~RUSTSECRET.each_line.with_index.map { |l, i| (i.zero? ? "" : "  ") + l }.join.rstrip : ""}
-              # Auto-generated, never typed or seen -- rust/host's own
-              # auth.rs signs both the session cookie and the OAuth `state`
-              # token with this. Same ManageMasterUserPassword-style pattern
-              # #{db_id} already uses for its own password.
-              #{logical_id}SessionSecret:
-                Type: AWS::SecretsManager::Secret
-                Properties:
-                  GenerateSecretString:
-                    SecretStringTemplate: '{}'
-                    GenerateStringKey: session_secret
-                    PasswordLength: 64
-                    ExcludePunctuation: true
-
-              RUSTSECRET
-              #{logical_id}:
-                Type: AWS::Serverless::Function#{aurora ? "\n    # `{{resolve:secretsmanager:...}}` dynamic references do NOT\n    # create an implicit CloudFormation dependency on the referenced\n    # resource (documented AWS behavior) -- #{logical_id}'s own\n    # Environment resolves one against #{db_id}Secret below. A plain\n    # `DependsOn: #{db_id}Secret` alone (CREATE_COMPLETE before this\n    # resource's own update starts) still hit a real, live, repeatable\n    # \"Secrets Manager can't find the specified secret\n    # (ResourceNotFoundException)\" -- CREATE_COMPLETE from\n    # CloudFormation's own perspective doesn't guarantee the secret is\n    # yet READABLE via a dynamic reference from a DIFFERENT resource's\n    # own concurrent update (AWS-side eventual consistency, not a\n    # CloudFormation ordering bug `DependsOn` alone can close).\n    # Chaining through #{db_id}Cluster too -- which ALSO reads this\n    # secret, and whose own RDS-side update takes real, substantial\n    # wall-clock time to apply -- gives that propagation window time\n    # to close before #{logical_id}'s own resolution is attempted.\n    DependsOn: [#{db_id}Secret, #{db_id}Cluster]" : ""}
-                Metadata:
-                  BuildMethod: makefile
-                Properties:
-                  # PINNED, not SAM's own auto-suffixed default — a Ruby-side
-                  # LambdaClient needs to know this function's name AHEAD OF a
-                  # first deploy (there's no chicken-egg lookup step), the same
-                  # "configured for me, in the projection" standard every other
-                  # piece of generated deploy config already holds to. Matches
-                  # `stack_name` above exactly — one name, two places it's read
-                  # from, never out of sync since both derive from `infra_name`.
-                  FunctionName: #{stack_name}
-                  # EXPLICIT, not omitted -- `sam build WebFunction` and
-                  # `sam build --use-container WebFunction` run as TWO SEPARATE
-                  # single-resource invocations (deploy:'s own comment on why:
-                  # cargo-lambda cross-compiles on this host directly, pg's
-                  # native extension needs the container -- `--use-container` is
-                  # a global sam build flag, can't be scoped per-resource). Each
-                  # invocation regenerates .aws-sam/build/template.yaml from
-                  # THIS source template for every resource, not just the one it
-                  # builds -- a resource with no CodeUri here reverts to
-                  # CodeUri-less after the SECOND invocation, and `sam deploy`
-                  # then defaults a missing CodeUri to the template's own
-                  # containing directory (deploy/#{infra_name}/ itself),
-                  # zipping the whole project tree -- including WebFunction's
-                  # own source -- as this function's code. A real, live deploy
-                  # shipped exactly that broken artifact (confirmed via
-                  # `aws lambda get-function` + downloading the actual deployed
-                  # zip). Pinning CodeUri here survives that regeneration: it
-                  # still resolves to `.aws-sam/build/#{logical_id}/`, where
-                  # build-#{logical_id}'s own `cp ... $(ARTIFACTS_DIR)` already
-                  # placed the real bootstrap+wasm, regardless of which of the
-                  # two sam build calls ran most recently.
-                  # "." NOT "#{logical_id}" -- SAM's Makefile build workflow
-                  # requires the Makefile to live INSIDE CodeUri itself
-                  # (confirmed live: "Makefile not found at
-                  # .../WebFunction/Makefile" when CodeUri named a
-                  # directory of its own). This project's one Makefile lives at
-                  # the deploy directory's own root, alongside this template --
-                  # "." is where it actually is.
-                  CodeUri: .
-                  PackageType: Zip
-                  Runtime: provided.al2023
-                  Architectures: [arm64]
-                  Handler: bootstrap
-                  MemorySize: #{memory}
-                  Timeout: #{timeout}
-                  Environment:
-                    Variables:
-                      # NOT a `{{resolve:secretsmanager:...}}`-composed DATABASE_URL
-                      # anymore (the WebFunction handler below still uses that
-                      # mechanism, unchanged) -- that dynamic reference genuinely
-                      # IS resolved fresh at deploy time and never rendered into
-                      # this template, this tool's output, or the CloudFormation
-                      # console. But once it resolves INTO a Lambda's own
-                      # Environment.Variables entry, the resolved PLAINTEXT is
-                      # stored in the function's OWN configuration:
-                      # `lambda:GetFunctionConfiguration` returns it decrypted,
-                      # and the Lambda console's Configuration tab displays it, to
-                      # ANY principal holding read-only account access (AWS's own
-                      # managed ReadOnlyAccess policy included) -- caught
-                      # reviewing this template, not live; AWS's own guidance is
-                      # to fetch a secret from Secrets Manager at RUNTIME instead,
-                      # precisely to avoid this. DB_HOST/DB_NAME/DB_SECRET_ARN
-                      # below are not secrets themselves -- an endpoint address, a
-                      # database name, and a Secrets Manager ARN authenticate
-                      # nothing on their own -- so sitting here as plain
-                      # Environment.Variables values costs nothing; main.rs itself
-                      # fetches the actual password from Secrets Manager at cold
-                      # start, over the AWS SDK, and never hands it back to
-                      # CloudFormation or Lambda's own configuration at all.
-                      # #{logical_id}'s own least-privilege Policies grant (below,
-                      # sibling of VpcConfig) is the one runtime IAM permission
-                      # that fetch needs, scoped to this one secret ARN.
-                      #{if shared
-                          # Owner's live Endpoint/Secret, looked up into
-                          # OwningDatabaseEndpoint/OwningDatabaseSecretArn.
-                          "DB_HOST: !Ref OwningDatabaseEndpoint\n" \
-                          "          DB_NAME: #{owner_db_name}\n" \
-                          "          DB_SECRET_ARN: !Sub \"${OwningDatabaseSecretArn}\""
-                        else
-                          "DB_HOST: !GetAtt #{db_ref_id}.Endpoint.Address\n" \
-                          "          DB_NAME: #{db_name}\n" \
-                          "          DB_SECRET_ARN: !Sub \"${#{secret_sub}}\""
-                        end}
-                      # `domain_name`, NOT `infra_name` — this names the actual
-                      # .wasm FILE `hecks build_wasm` writes (rust/dist/#{domain_name}.wasm,
-                      # its own target_mod_name convention, a Rust-build-pipeline
-                      # concern unrelated to AWS resource identity) and what the
-                      # Makefile below actually bundles into the Lambda package
-                      # under. Confirmed the hard way: pinning this to infra_name
-                      # alongside the real AWS-identity fields left it looking for
-                      # a file `hecks build_wasm` never produces.
-                      HECKS_WASM_PATH: !Sub "/var/task/#{domain_name}.wasm"
-                      # STATIC, not a deploy-time parameter — HECKS_DOMAIN is this
-                      # domain's own declared name, known at generation time the
-                      # same way DBName/HECKS_WASM_PATH already are. HECKS_ERA is
-                      # "1" because that's what a FRESH database always gets:
-                      # PostgresEra::LineageManager::EraResolver#check! mints era 1
-                      # unconditionally the first time any Ruby process boots
-                      # against an empty `hecks_eras` (era_resolver.rb's own
-                      # `held.empty?` branch) — deterministic, not guessed. `make
-                      # mint-era` (this directory's own Makefile) is what actually
-                      # triggers that first boot; a LATER real schema evolution
-                      # (era 2+) is a separate, later re-generation, not this one.
-                      HECKS_DOMAIN: #{declared_domain_name}
-                      # UNCONDITIONAL, not gated on `rust_web` — `rust/host/src/main.rs`'s
-                      # own boot sequence reads `ir::ir().ok_or(...)?` for every domain
-                      # regardless of web mode (era-lineage bookkeeping needs the IR, not
-                      # just the optional in-process web UI), so a Shared-mode domain with
-                      # no web layer still needs this sidecar path to boot at all. Previously
-                      # gated on `rust_web`, which left every such domain's Lambda crashing
-                      # on cold start — checkout.rs's own header flagged this exact
-                      # contradiction, confirmed live against Banking's committed template.
-                      HECKS_IR_PATH: !Sub "/var/task/#{domain_name}.ir.json"
-                      HECKS_ERA: "1"#{hecks_schema ? %(\n          HECKS_SCHEMA: #{hecks_schema}) : ""}#{rust_web && google_oauth_present ? <<~RUSTOAUTH.each_line.with_index.map { |l, i| i.zero? ? "\n          " + l : "          " + l }.join.rstrip : ""}
-                      # NOT `{{resolve:secretsmanager:...}}` composing
-                      # GOOGLE_CLIENT_ID/GOOGLE_CLIENT_SECRET/SESSION_SECRET
-                      # directly anymore -- the identical GetFunctionConfiguration
-                      # exposure DATABASE_URL's own comment above documents
-                      # applied here too. main.rs's own cold start fetches both
-                      # secrets itself and `set_var`s the real GOOGLE_CLIENT_ID/
-                      # GOOGLE_CLIENT_SECRET/SESSION_SECRET keys before anything
-                      # else runs -- auth.rs/web.rs still read those exact keys,
-                      # unchanged. GOOGLE_OAUTH_SECRET_ID is a bare NAME (`make
-                      # sync-google-oauth` owns #{stack_name}-web-google-oauth's
-                      # whole lifecycle outside CloudFormation, straight from
-                      # #{domain}'s own gitignored .env.local, never baked into
-                      # this generated, git-tracked template as plaintext) --
-                      # GetSecretValue accepts a name directly, no ARN needed.
-                      GOOGLE_OAUTH_SECRET_ID: #{stack_name}-web-google-oauth
-                      GOOGLE_REDIRECT_URI: !Sub "${WebRedirectBaseUrl}/auth/google/callback"
-                      SESSION_SECRET_ARN: !Sub "${#{logical_id}SessionSecret}"
-                      RUSTOAUTH
-                  # LEAST-PRIVILEGE -- #{logical_id}'s own execution role is
-                  # otherwise SAM's bare default (logging only); this is the one
-                  # runtime AWS permission the DB_SECRET_ARN handling above needs,
-                  # scoped to the single secret ARN this stack itself depends on,
-                  # never `Resource: "*"`.
-                  Policies:
-                    - Statement:
-                        - Effect: Allow
-                          Action: secretsmanager:GetSecretValue
-                          Resource: !Sub "${#{db_secret_ref}}"
-                    #{rust_web && google_oauth_present ? <<~OAUTHPOLICY.each_line.with_index.map { |l, i| i.zero? ? l : "        " + l }.join.rstrip : ""}
-                      - Statement:
-                          - Effect: Allow
-                            Action: secretsmanager:GetSecretValue
-                            # NAME-BASED, not `!Ref`/`!GetAtt` -- this secret is
-                            # never a stack resource (RUSTOAUTH's own Environment
-                            # comment, above, has the full story), so there is no
-                            # exact ARN to point at. The trailing `-*` is AWS's
-                            # own documented pattern for granting a secret known
-                            # only by name: every real ARN Secrets Manager mints
-                            # is this name plus a random 6-character suffix,
-                            # which can't be predicted at template-render time.
-                            Resource: !Sub "arn:aws:secretsmanager:${AWS::Region}:${AWS::AccountId}:secret:#{stack_name}-web-google-oauth-*"
-                      - Statement:
-                          - Effect: Allow
-                            Action: secretsmanager:GetSecretValue
-                            Resource: !Sub "${#{logical_id}SessionSecret}"
-                      OAUTHPOLICY
-                    # TMPL:cross_domain_lambda_policies
-                  VpcConfig:
-                    #{if shared
-                        "SubnetIds: [!Ref OwningSubnetAId, !Ref OwningSubnetBId]\n        SecurityGroupIds: [!Ref OwningSecurityGroupId]"
-                      else
-                        "SubnetIds: [!Ref #{db_id}SubnetA, !Ref #{db_id}SubnetB]\n        SecurityGroupIds: [!Ref #{logical_id}SecurityGroup]"
-                      end}
-                  # AWS_IAM by default — this dispatches real domain commands
-                  # (cap-table/governance-shaped data);
-                  # an unauthenticated public URL is the wrong default for that,
-                  # even though it's the simpler one to demo with. NONE only when
-                  # `web "Rust"` (rust/host/src/web.rs) makes this the public web
-                  # UI itself — safe even though the SAME Function URL also
-                  # carries the internal {"verb"}/{"read"} dispatch shapes,
-                  # because a Function-URL HTTP event can never be crafted into
-                  # that raw top-level shape (Function URLs always wrap the real
-                  # HTTP body inside requestContext.http/rawPath/event.body,
-                  # unconditionally); that raw shape is reachable only through
-                  # the AWS SDK's own IAM-authenticated Invoke API, which never
-                  # goes through a Function URL at all.
-                  FunctionUrlConfig:
-                    AuthType: #{rust_web ? "NONE" : "AWS_IAM"}
-            #{web_handler_present ? <<~WEB.each_line.map { |l| "  " + l }.join : ""}
-            # THE WEB APP'S OWN LAMBDA — opt-in, see `web_handler_present` above.
-            # VPC-attached for the SAME reason #{logical_id} is (Member's own
-            # persistence needs the private RDS instance directly, permanently —
-            # the hecksagon's own comment on why), sharing
-            # #{logical_id}SecurityGroup rather than minting a second one, since
-            # both need the identical egress-to-DB rule. That VPC attachment
-            # ALSO cuts off the public internet by default (this stack's own "NO
-            # NAT GATEWAY" design) — but this function has to reach
-            # #{logical_id} itself via `lambda:InvokeFunction`, a public AWS API
-            # call. #{web_logical_id}LambdaEndpoint below is the targeted fix: a
-            # VPC Interface Endpoint for the Lambda service ONLY (not a NAT
-            # Gateway) — a few dollars a month, not a general internet route.
-            #{db_id}LambdaEndpointSecurityGroup:
-              Type: AWS::EC2::SecurityGroup
-              Properties:
-                VpcId: !Ref #{db_id}Vpc
-                # EC2's own GroupDescription character set excludes apostrophes
-                # too, not just em-dashes -- "this stack's own" was a real,
-                # live rejection ("Invalid security group description").
-                GroupDescription: #{db_id}LambdaEndpoint - HTTPS from this stacks own Lambdas only
-
-            #{db_id}LambdaEndpointIngress:
-              Type: AWS::EC2::SecurityGroupIngress
-              Properties:
-                GroupId: !Ref #{db_id}LambdaEndpointSecurityGroup
-                IpProtocol: tcp
-                FromPort: 443
-                ToPort: 443
-                SourceSecurityGroupId: !Ref #{logical_id}SecurityGroup
-
-            #{db_id}LambdaEndpoint:
-              Type: AWS::EC2::VPCEndpoint
-              Properties:
-                VpcId: !Ref #{db_id}Vpc
-                ServiceName: !Sub "com.amazonaws.${AWS::Region}.lambda"
-                VpcEndpointType: Interface
-                PrivateDnsEnabled: true
-                SubnetIds: [!Ref #{db_id}SubnetA, !Ref #{db_id}SubnetB]
-                SecurityGroupIds: [!Ref #{db_id}LambdaEndpointSecurityGroup]
-
-            # Auto-generated, never typed or seen — the SAME
-            # ManageMasterUserPassword pattern #{db_id} already uses for its own
-            # password, applied to Sinatra's own session-signing secret instead.
-            #{web_logical_id}SessionSecret:
-              Type: AWS::SecretsManager::Secret
-              Properties:
-                GenerateSecretString:
-                  SecretStringTemplate: '{}'
-                  GenerateStringKey: session_secret
-                  PasswordLength: 64
-                  ExcludePunctuation: true
-
-            #{webhook_secret_env ? <<~WEBHOOKSECRET.rstrip : ""}
-          # Auto-generated, never typed or seen — the SAME
-          # ManageMasterUserPassword/SessionSecret pattern above, applied to
-          # `secret_env`'s own webhook secret instead (deploy_settings' own
-          # `secret_env`, read far above). #{web_logical_id}'s own
-          # `lambda_handler.rb` fetches this by ARN at cold start (the
-          # `#{webhook_secret_env}_ARN` Environment variable below) and exposes
-          # its plaintext under `ENV["#{webhook_secret_env}"]` itself — the
-          # SAME two-step indirection DB_SECRET_ARN/SESSION_SECRET_ARN already
-          # use, and for the identical reason (this Environment block's own
-          # header comment on why a resolved plaintext must never land in
-          # Lambda's own configuration).
-          #{web_logical_id}WebhookSecret:
-            Type: AWS::SecretsManager::Secret
-            Properties:
-              GenerateSecretString:
-                SecretStringTemplate: '{}'
-                GenerateStringKey: value
-                PasswordLength: 64
-                ExcludePunctuation: true
-
-            WEBHOOKSECRET
-            #{web_logical_id}:
-              Type: AWS::Serverless::Function
-              # NO Metadata.BuildMethod — "bundler" isn't a real SAM value (a
-              # real, live UnsupportedBuilderException caught this); `Runtime:
-              # ruby3.2` alone is enough for SAM to select its own built-in Ruby
-              # bundler workflow automatically. #{logical_id}'s own `BuildMethod:
-              # makefile` above is different: rust/host isn't a runtime SAM
-              # knows how to build at all, so it needs an explicit custom
-              # workflow — this function doesn't. STAYS `ruby3.2` deliberately,
-              # even though `sam validate --lint` now flags it deprecated
-              # (2026-03-31, creation disabled 2027-02-01, still comfortably
-              # ahead of today) — `patch-pg-native`'s own build-ruby3.2 container
-              # image and `lib/3.2/pg_ext.so` path glob (this Makefile, below)
-              # are BOTH hardcoded to this exact runtime; bumping Runtime alone
-              # without reworking that whole from-source pg build for a newer
-              # image is a real, separate undertaking (untested container image
-              # availability, a different vendor/bundle native-extension path)
-              # out of scope here. Matches the live, currently-
-              # deployed choice exactly, so both consumers of this one shared
-              # WebFunction code path stay on the same, PROVEN runtime.
-              Properties:
-                FunctionName: #{stack_name}-web
-                Runtime: ruby3.2
-                Architectures: [arm64]
-                # THREE parts (file.Class.method), not two — aws-lambda-ric's own
-                # 2-part form calls a plain TOP-LEVEL function via __send__, not
-                # a module method; #{web_handler_relpath}.rb's own comment on
-                # why its module is named the way it is explains the rest — a
-                # real, live "LambdaHandler is not a module" caught both halves
-                # of this the hard way. `web_handler_relpath` (not a bare
-                # "lambda_handler") whenever `dispatch "None"` moved CodeUri off
-                # #{domain} itself — see that variable's own comment, above.
-                Handler: #{web_handler_relpath}.#{webhook_handler_module}.lambda_handler
-                CodeUri: #{web_code_uri}
-                MemorySize: 512
-                Timeout: 15
-                Environment:
-                  Variables:
-                    DOMAIN_ROOT: /var/task
-                    # NOT `declared_domain_name` — `Adapters::Lambda`/
-                    # `RemoteDispatcher` both read this to compute WHICH
-                    # deployed Lambda function to invoke (`hecks-\#{...}`,
-                    # matching this stack's own name), a question `infra_name`
-                    # answers and a domain's own business identity does not.
-                    # Real, live, and confirmed the hard way: this was still
-                    # wired to `declared_domain_name` when a client app
-                    # first deployed, and WebFunction immediately threw
-                    # `ResourceNotFoundException: Function not found:
-                    # hecks-<domain>` on every read AND on the
-                    # Google OAuth callback itself — a real signed-in user hit
-                    # this within minutes of the deploy that introduced it.
-                    DOMAIN_NAME: #{infra_name}
-                    HECKS_LAMBDA_ROUTING: "true"
-                    HECKS_LAMBDA_REGION: #{region}#{hecks_schema ? %(\n        HECKS_SCHEMA: #{hecks_schema}) : ""}
-                    # SAME setting #{domain}'s own fly.toml/Dockerfile already
-                    # sets for the Fly deployment this one replaces — Sinatra's
-                    # own `host_authorization` default is only PERMISSIVE in
-                    # production mode (an empty `permitted_hosts` list means
-                    # "allow any host" — checked directly in rack-protection's
-                    # own source); its DEVELOPMENT default is the restrictive
-                    # one (only localhost/.test), which is what Sinatra falls
-                    # back to when NEITHER RACK_ENV nor APP_ENV is set. A real,
-                    # live "Host not permitted" 403 against this function's own
-                    # unpredictable *.lambda-url.*.on.aws hostname caught the
-                    # gap — this function's Environment never set either var.
-                    RACK_ENV: production
-                    # The precompiled `pg` gem's aarch64-linux native extension
-                    # needs GLIBC 2.29+; Lambda's ruby3.2 MANAGED runtime is
-                    # Amazon Linux 2 (glibc 2.26) -- a real, live "Init<NameError>:
-                    # uninitialized constant PG::Error" caught this (rescuing
-                    # PG::Error itself failed to resolve, because pg's own
-                    # require died before reaching the file that defines it).
-                    # `make deploy`'s own `patch-pg-native` step (this directory's
-                    # Makefile) replaces the broken precompiled extension with one
-                    # compiled from source, in-container, against a real
-                    # SSL-enabled libpq -- and drops that libpq's .so beside it at
-                    # /var/task/lib, found by the dynamic loader with NO explicit
-                    # LD_LIBRARY_PATH override needed: the base ruby3.2 image's
-                    # own baked-in default (`docker inspect
-                    # public.ecr.aws/lambda/ruby:3.2-arm64`) is already
-                    # "/var/lang/lib:/lib64:/usr/lib64:/var/runtime:/var/runtime/lib:/var/task:/var/task/lib:/opt/lib"
-                    # -- setting LD_LIBRARY_PATH here as a Lambda env var
-                    # REPLACES that whole list rather than extending it (a real,
-                    # live gotcha: Lambda env vars always fully override a
-                    # same-named baked-in image env, never merge with it), which
-                    # is exactly what broke Ruby's OWN interpreter startup
-                    # ("libcrypt.so.1: cannot open shared object file") the one
-                    # time this was set explicitly, before libpq.so.5.16 itself
-                    # ever got a chance to matter.
-                    # Member's own permanent Postgres connection — the SAME RDS
-                    # instance #{logical_id} itself writes rust/host's flat
-                    # journal into, different database engine role (Ruby's own
-                    # era/lineage schema, not rust/host's), never the real
-                    # Fly-hosted Postgres this whole effort is retiring away from.
-                    #
-                    # GENERATOR-ONLY FIX, NOT YET SAFE TO DEPLOY — DB_HOST/DB_NAME/
-                    # DB_SECRET_ARN/SESSION_SECRET_ARN/GOOGLE_OAUTH_SECRET_ID below
-                    # replace the SAME `{{resolve:secretsmanager:...}}`-into-
-                    # Environment.Variables shape rust/host's own main.rs (this
-                    # template's own #{logical_id}) used to have -- readable in
-                    # plaintext by any read-only account principal via
-                    # lambda:GetFunctionConfiguration, the exact exposure
-                    # #{logical_id}'s own comment above the Policies section
-                    # documents. But THIS function's consumer (`lambda_handler.rb`)
-                    # is not a file this generator writes or this repo carries --
-                    # it lives in the deploying app's own domain directory (real,
-                    # live example: a Sinatra app), outside this
-                    # codebase entirely. Redeploying a domain with an existing
-                    # `lambda_handler.rb` BEFORE that handler is updated to fetch
-                    # these itself (`aws-sdk-secretsmanager`, not yet in this
-                    # project's own Gemfile) breaks it: it still expects
-                    # `ENV["DATABASE_URL"]`/`ENV["SESSION_SECRET"]`/
-                    # `ENV["GOOGLE_CLIENT_ID"]`/`ENV["GOOGLE_CLIENT_SECRET"]`
-                    # already resolved, and none of those keys exist below anymore.
-                    DB_HOST: !GetAtt #{db_ref_id}.Endpoint.Address
-                    DB_NAME: #{db_name}
-                    DB_SECRET_ARN: !Sub "${#{secret_sub}}"
-                    SESSION_SECRET_ARN: !Sub "${#{web_logical_id}SessionSecret}"#{webhook_secret_env ? %(\n        #{webhook_secret_env}_ARN: !Sub "${#{web_logical_id}WebhookSecret}") : ""}
-                    #{web_google_oauth_env_yaml}
-                VpcConfig:
-                  SubnetIds: [!Ref #{db_id}SubnetA, !Ref #{db_id}SubnetB]
-                  SecurityGroupIds: [!Ref #{logical_id}SecurityGroup]
-                # LEAST-PRIVILEGE, scoped to #{logical_id}'s own ARN specifically
-                # (SAM's own LambdaInvokePolicy template) — WebFunctionRole is
-                # otherwise SAM's bare default execution role (logging only), and
-                # had NO lambda:InvokeFunction permission at all until this: a
-                # real, live AccessDeniedException caught it, the same request
-                # that also caught the wrong-function-name bug just above
-                # (WebFunctionRole is not authorized... on resource
-                # hecks-task — this stack has never had ANY policy granting
-                # that action, so the fix isn't complete without adding one).
-                # THE SAME secretsmanager:GetSecretValue GRANTS #{logical_id}'s
-                # own Policies section (above) needed, once this function's own
-                # `lambda_handler.rb` fetches DB_SECRET_ARN/SESSION_SECRET_ARN/
-                # GOOGLE_OAUTH_SECRET_ID itself instead of relying on a resolved
-                # Environment.Variables value -- see this Environment block's own
-                # comment for why that consumer-side change isn't in this repo.
-                Policies:
-                  - LambdaInvokePolicy:
-                      FunctionName: !Ref #{logical_id}
-                  - Statement:
-                      - Effect: Allow
-                        Action: secretsmanager:GetSecretValue
-                        Resource: !Sub "${#{secret_sub}}"
-                  - Statement:
-                      - Effect: Allow
-                        Action: secretsmanager:GetSecretValue
-                        Resource: !Sub "${#{web_logical_id}SessionSecret}"#{webhook_secret_env ? %(\n      - Statement:\n          - Effect: Allow\n            Action: secretsmanager:GetSecretValue\n            Resource: !Sub "${#{web_logical_id}WebhookSecret}") : ""}
-                  #{google_oauth_present ? <<~WEBOAUTHPOLICY.each_line.with_index.map { |l, i| i.zero? ? l : "      " + l }.join.rstrip : ""}
-                    - Statement:
-                        - Effect: Allow
-                          Action: secretsmanager:GetSecretValue
-                          Resource: !Sub "arn:aws:secretsmanager:${AWS::Region}:${AWS::AccountId}:secret:#{stack_name}-web-google-oauth-*"
-                    WEBOAUTHPOLICY
-                # NONE, not AWS_IAM — real users need to reach sign-in over
-                # plain HTTPS, unlike #{logical_id}'s own AWS_IAM-protected URL
-                # (this function is the ONLY thing meant to call that one).
-                FunctionUrlConfig:
-                  AuthType: NONE
-            WEB
-
-            Outputs:
-              FunctionUrl:
-                Value: !GetAtt #{logical_id}Url.FunctionUrl#{web_handler_present ? "\n  WebFunctionUrl:\n    Value: !GetAtt #{web_logical_id}Url.FunctionUrl" : ""}
-              # stack_outputs (hecks deploy project, above the heredocs) is the ONE
-              # place these four names live — DatabaseEndpoint/DatabaseSecretArn
-              # feed `make mint-era`'s own boot step directly; VpcId/
-              # DbSecurityGroupId ALSO feed bastion.yaml's own Parameters (a
-              # separate, sibling stack, created only for the few minutes a mint
-              # takes and destroyed right after, attaching into the SAME private
-              # network without this main template ever knowing a bastion
-              # exists) and the Makefile's own --parameter-overrides. Rename a
-              # key in that table and every consumer follows; reference one that
-              # doesn't exist there and hecks deploy project refuses before
-              # writing a single file, instead of a bastion.yaml whose Parameter
-              # nothing could ever fill. (`PrivateSubnetId` used to sit here too
-              # — dropped, nothing ever consumed it; bastion.yaml mints its own
-              # subnet instead.)
-              #{stack_outputs.map { |o| "#{o[:key]}:\n    Value: #{o[:ref]}" }.join("\n  ")}
-          YAML
-
-          # Spliced in after the heredoc renders, not interpolated inside it —
-          # a `#{...}` marker at column 0 would drag the heredoc's own dedent
-          # computation to zero and leave every other line un-stripped.
-          template_yaml = template_yaml.sub(/^([ \t]*)# TMPL:cross_domain_lambda_policies\n/) { Shared.cross_domain_invoke_policy_yaml(cross_domain_lambda_targets, $1) }
-
-          # Operates on the already-rendered string — `pii_cloudfront_yaml`
-          # builds its own correctly-indented text, so nothing here interacts
-          # with a heredoc's own dedent computation.
-          if pii_detected
-            fronted_logical_id = web_handler_present ? web_logical_id : logical_id
-            use_oac             = !web_handler_present && !rust_web
-
-            pii_resources = pii_cloudfront_yaml(
-              fronted_logical_id: fronted_logical_id, use_oac: use_oac,
-              geo_restriction_type: geo_restriction_type, geo_restriction_countries: geo_restriction_countries
-            )
-            template_yaml = template_yaml.sub(/^Outputs:\n/) { "#{pii_resources}Outputs:\n  PiiDistributionDomainName:\n    Value: !GetAtt PiiDistribution.DomainName\n" }
-          end
-
-          # Surgical removal, post-render, not a nested heredoc — a conditional
-          # nested heredoc broke embedded multi-line `#{shared ? ... : ...}`
-          # strings inside the resource block, which assume exactly one
-          # reindentation layer (confirmed regenerating examples/banking).
-          if dispatch_none
-            # Non-greedy through the resource's own FunctionUrlConfig/AuthType
-            # closing pair, so WebFunction's own later "AuthType:" can't match.
-            template_yaml = template_yaml.sub(
-              /^  #{Regexp.escape(logical_id)}:\n.*?\n        AuthType: (?:NONE|AWS_IAM)\n/m, ""
-            )
-            # Removes the now-dangling `!Ref` to the resource just deleted above
-            # — SAM refuses an unresolved Ref at package time, not silently.
-            template_yaml = template_yaml.sub(
-              /^        - LambdaInvokePolicy:\n            FunctionName: !Ref #{Regexp.escape(logical_id)}\n/, ""
-            )
-            # WebFunction's own URL becomes the stack's only "FunctionUrl".
-            template_yaml = template_yaml.sub(
-              /^  FunctionUrl:\n    Value: !GetAtt #{Regexp.escape(logical_id)}Url\.FunctionUrl\n  WebFunctionUrl:\n    Value: !GetAtt #{Regexp.escape(web_logical_id)}Url\.FunctionUrl\n/,
-              "  FunctionUrl:\n    Value: !GetAtt #{web_logical_id}Url.FunctionUrl\n"
-            )
-          end
-
-
-
-          # A separate, sibling stack for the few minutes `make mint-era`
-          # needs it, then deleted — SSM Session Manager only, never SSH, no
-          # inbound rule at all. Skipped when `shared`: era-minting reuses the
-          # owner's own standing infrastructure instead.
-bastion_yaml = shared ? nil : Shared.bastion_yaml(
-  domain: domain, infra_name: infra_name, stack_name: stack_name, db_id: db_id,
-  google_oauth_present: google_oauth_present, bastion_parameters: bastion_parameters
-)
-
-          # A top-level variable, not inlined in the Makefile heredoc below —
-          # Make recipe lines need a literal leading tab, and a nested
-          # interpolation's re-indent pass would corrupt that detection.
-          mint_era_recipe =
-            if shared
-              <<~SHAREDMINT.rstrip
-              # NOT AUTOMATED YET for a Shared-mode domain — it has no RDS/VPC
-              # of its own to stand a temporary bastion next to (bastion.yaml
-              # itself isn't even generated here — hecks deploy project's own
-              # comment on why). Minting era 1 for #{infra_name}'s own schema
-              # needs a tunnel to #{owner_domain_name}'s ALREADY-EXISTING RDS
-              # instance instead -- reuse #{owner_domain_name}'s own deploy
-              # directory's `make mint-era` machinery (or an already-open
-              # tunnel to it) to run this domain's own boot against
-              # `postgres://...@<tunnel-host>:<port>/#{owner_db_name}` with
-              # `schema: #{infra_name.inspect}` in LineageManager.check!'s own
-              # settings -- the exact same call this target runs automatically
-              # for a domain with its own dedicated instance.
-              #
-              # IF THIS DOMAIN VENDORS/ATTACHES ANOTHER BLUEBOOK (attaches,
-              # attaches ... from: :vendor), `check!` alone leaves THAT chapter's own
-              # aggregates with no snapshot table at all -- it only provisions the
-              # ONE bluebook it's called with (era_resolver.rb's own `bluebook.
-              # aggregates.each`), never the whole registry. Found live minting
-              # a client site's own era: `Payments::Payment.Initiate` refused with
-              # "relation \\"payment_head_snapshot_1\\" does not exist" the first
-              # time this domain's own checkout route ran for real. The automated
-              # (non-Shared) recipe below now does this correctly for every OTHER
-              # loaded bluebook, using ONE `Lineage` keyed by THIS domain's own
-              # name (never each chapter's own -- a vendored chapter's aggregates
-              # share THIS domain's single `hecks_journal_#{infra_name}` and
-              # snapshot tables, they do not get a separate journal of their own).
-              # Reproduce the same shape manually here: after `LineageManager.
-              # check!` returns, `db = PostgresEra.connect_for(bluebook.name,
-              # settings)`, `lineage = Lineage.new(db, bluebook.name)`, then for
-              # every OTHER loaded bluebook's own aggregates, `lineage.
-              # ensure_first_head!(aggregate.storage_name)`.
-              #
-              # EXIT 0, NOT 1 -- `deploy:`'s own last line (below) always chains
-              # `$(MAKE) mint-era` unconditionally, even for a Shared-mode domain,
-              # so a nonzero exit here used to mean a fully successful `sam
-              # deploy` still left `make deploy` exiting nonzero -- confirmed
-              # live: CI and any scripted caller read every Shared-mode deploy as
-              # failed, which trains operators to ignore a red `make deploy` on
-              # exactly the domains where a real failure most needs to stand out.
-              # This step never fails at its own job (it has no automated job to
-              # fail at -- it only reports that a manual step remains), so it
-              # reports success and leaves the manual-step reminder in the echo
-              # text above, not in the exit code. A human running `make mint-era`
-              # directly still SEES the same message; they just don't get a
-              # misleading "command failed" on top of it either.
-              \t@echo "mint-era isn't automated yet for a Shared-mode domain (database \\"Shared\\") -- see this target's own comment in the generated Makefile for the manual path through #{owner_domain_name}'s own tunnel. This is NOT a failure -- exiting 0 so a genuinely successful \\"make deploy\\" still reports success; era-minting for this domain remains a separate manual step."; \\
-              \texit 0
-              SHAREDMINT
-            else
-              <<~OWNMINT.rstrip
-              \t@echo "Looking up $(STACK)'s VPC/security group..."
-              # stack_outputs/bastion_parameters (hecks deploy project) are the ONE
-              # place these OutputKey strings and parameter names live — this eval
-              # chain and the --parameter-overrides line just below are both
-              # generated from the SAME table template.yaml's Outputs and
-              # bastion.yaml's Parameters already read from.
-              \t#{stack_outputs.map { |o| %($(eval #{o[:var]} := $(shell aws cloudformation describe-stacks --stack-name $(STACK) --query "Stacks[0].Outputs[?OutputKey=='#{o[:key]}'].OutputValue" --output text))) }.join("\n\t")}
-              \t@echo "Deploying the temporary bastion stack $(BASTION_STACK)..."
-              \taws cloudformation deploy --template-file bastion.yaml --stack-name $(BASTION_STACK) \\
-              \t\t--parameter-overrides #{bastion_parameters.map { |p| "#{p[:name]}=$(#{stack_outputs.find { |o| o[:key] == p[:from_output] }[:var]})" }.join(" ")} \\
-              \t\t--capabilities CAPABILITY_IAM
-              # ONE continuous shell invocation from here on (every line ends in
-              # \\, joining it to the next) — INSTANCE_ID is a SHELL variable, not
-              # a Make one: a Make-level $$(eval $$(shell ...)) expands at parse
-              # time, BEFORE the `aws cloudformation deploy` line above ever runs,
-              # which would make INSTANCE_ID permanently empty. It can only be
-              # computed here, after the bastion stack genuinely exists.
-              #
-              # A COMMENT LINE MUST NEVER SIT BETWEEN TWO \\-CONTINUED RECIPE
-              # LINES — confirmed live, the hard way: a `#`-prefixed line inserted
-              # between `DB_PASS=...; \\` and the line that used it silently
-              # corrupted Make's own assembly of this whole block into one shell
-              # script, and `DB_PASS` came out empty on the far side despite
-              # printing correctly one line earlier. Every explanatory comment for
-              # this whole chain belongs HERE, before it starts, same as this one —
-              # never spliced into the middle of it.
-              #
-              # BASTION TEARDOWN IS PART OF THIS SAME CHAIN, ALL THE WAY THROUGH —
-              # a prior version of this recipe ended at `exit $$BOOT_STATUS` with
-              # no trailing `\\`, which made Make treat the delete-stack lines
-              # after it as a SEPARATE recipe line, reached only on a zero exit.
-              # A failed boot (bad tunnel, bad `ruby -e` invocation, anything) left
-              # the bastion stack standing forever — including a live 5432 ingress
-              # rule punched into the PRODUCTION RDS security group. Teardown now
-              # runs unconditionally, with BOOT_STATUS captured up front and
-              # returned last, so `make mint-era`'s own exit code still reflects
-              # whether era 1 actually got minted.
-              #
-              # `LineageManager.check!` directly below, NOT `Hecks.boot` — also
-              # confirmed live (the very first real invoke: "relation
-              # \\"hecks_eras\\" does not exist", despite this step itself
-              # reporting success): `Hecks.boot` always dispatches persistence
-              # through whatever the domain's OWN .world file declares
-              # (`persisted_by("Heki")` for a domain that hasn't opted into
-              # Postgres for local dev), by EXPLICIT design — loader.rb's own
-              # comment: "persisted_by(\\"PostgresEra\\") is never inferred from
-              # anything else." `EraCheck.check!` (what `Hecks.boot` runs) is
-              # itself adapter-capability-gated on that same declaration and simply
-              # no-ops for a non-lineage-capable adapter — it never touches
-              # hecks_eras at all. The fix reuses the SAME loading pipeline
-              # `Loader.boot` itself does (`Ports::Loading.bootstrap`/
-              # `load_library`/`load_project`/`load_domain`) to build a real,
-              # fully-loaded registry (bluebook + any attaches attachments),
-              # then calls straight into PostgresEra's own `LineageManager.check!`
-              # with THIS deploy's actual `DATABASE_URL` — bypassing the world
-              # file's own adapter choice entirely, the same targeted pattern
-              # spec/adapters/driven/postgres_era/lineage_spec.rb's own `check!` helper
-              # already uses.
-              #
-              # THE WHOLE TUNNEL IS RESTARTED PER ATTEMPT, not just the boot
-              # check retried through one long-lived tunnel — confirmed live,
-              # the hard way: an SSM port-forwarding session can start and then
-              # exit again within the first few seconds (visible in its own log
-              # as a session ID that both starts AND exits before the retries
-              # even finish), not merely "slow to become ready". Retrying a
-              # Postgres connection five times against a tunnel process that has
-              # already died is retrying against a corpse — it fails identically
-              # every time, for a different reason than the one the retry was
-              # built for. Each attempt below kills whatever tunnel the LAST
-              # attempt opened (a no-op the first time) and opens a fresh one,
-              # so a dead session gets a real replacement, not just more patience.
-              #
-              # DB_PASS_URLENC, DERIVED RIGHT AFTER DB_PASS BELOW, IS WHAT ACTUALLY
-              # GOES INTO THE `postgres://` URL FURTHER DOWN — not DB_PASS itself.
-              # RDS/Secrets-Manager-generated passwords are not guaranteed free of
-              # `%`, and libpq's own connection-URI parser treats a bare `%` as an
-              # invalid token (percent-encoding is the one escape libpq's URI form
-              # actually documents and decodes; a raw `%` is not) -- roughly 29% of
-              # 32-char generated passwords contain at least one `%`, so this was
-              # silently unreachable until it wasn't. `ERB::Util.url_encode`
-              # percent-encodes everything outside RFC 3986's unreserved set,
-              # exactly what a URI password component needs -- a strict superset
-              # of the ExcludeCharacters the Aurora path below already excludes
-              # (a no-op there), and the actual fix for the plain-RDS
-              # ManageMasterUserPassword path, whose generated character set this
-              # template has no control over at all. This comment sits HERE,
-              # before the chain starts, on purpose -- see the note further below
-              # on why a comment line can never be spliced between two
-              # `\`-continued recipe lines.
-              \t@INSTANCE_ID=$$(aws cloudformation describe-stacks --stack-name $(BASTION_STACK) --query "Stacks[0].Outputs[?OutputKey=='InstanceId'].OutputValue" --output text); \\
-              \techo "Waiting for $$INSTANCE_ID to register with SSM..."; \\
-              \tfor i in $$(seq 1 30); do \\
-              \t\tSTATUS=$$(aws ssm describe-instance-information --filters "Key=InstanceIds,Values=$$INSTANCE_ID" --query "InstanceInformationList[0].PingStatus" --output text 2>/dev/null); \\
-              \t\tif [ "$$STATUS" = "Online" ]; then break; fi; \\
-              \t\tsleep 5; \\
-              \tdone; \\
-              \tDB_PASS=$$(aws secretsmanager get-secret-value --secret-id $(DB_SECRET_ARN) --query SecretString --output text | ruby -rjson -e 'print JSON.parse(STDIN.read)["password"]'); \\
-              \tDB_PASS_URLENC=$$(ruby -rerb -e 'print ERB::Util.url_encode(ARGV[0])' "$$DB_PASS"); \\
-              \tBOOT_STATUS=1; \\
-              \tfor attempt in 1 2 3 4 5; do \\
-              \t\tkill $$TUNNEL_PID 2>/dev/null; \\
-              \t\techo "Opening an SSM tunnel to $(DB_HOST):5432 and minting era 1 (attempt $$attempt/5)..."; \\
-              \t\taws ssm start-session --target $$INSTANCE_ID \\
-              \t\t\t--document-name AWS-StartPortForwardingSessionToRemoteHost \\
-              \t\t\t--parameters "{\\"host\\":[\\"$(DB_HOST)\\"],\\"portNumber\\":[\\"5432\\"],\\"localPortNumber\\":[\\"15432\\"]}" \\
-              \t\t\t>/tmp/$(BASTION_STACK)-tunnel-$$attempt.log 2>&1 & \\
-              \t\tTUNNEL_PID=$$!; \\
-              \t\tfor i in $$(seq 1 15); do \\
-              \t\t\tnc -z localhost 15432 2>/dev/null && break; \\
-              \t\t\tsleep 1; \\
-              \t\tdone; \\
-              \t\tcd $(ROOT) && DATABASE_URL="postgres://postgres:$$DB_PASS_URLENC@localhost:15432/#{db_name}" ruby -Ilib -e 'require "hecks"; require "hecks/ports/persistence/plugins/era"; loading = Hecks::Ports::Loading.bootstrap; directory = loading.bluebook_directory(ARGV[0]); root = loading.shared_root(nil, directory); registry = Hecks::Runtime::Registry.new(root: File.dirname(directory)); Hecks.with_registry(registry) { loading.load_library; loading.load_project(root); loading.load_domain(directory) }; bluebook = registry.bluebooks[#{declared_domain_name.inspect}] or abort "no #{declared_domain_name} bluebook loaded"; current_text = Hecks::Runtime::EraCheck.source_text_for(bluebook, directory); Hecks::Adapters::PostgresEra::LineageManager.check!(registry: registry, bluebook: bluebook, current_text: current_text, settings: { database: ENV["DATABASE_URL"]#{hecks_schema ? ", schema: #{hecks_schema.inspect}" : ""} }); db = Hecks::Adapters::PostgresEra.connect_for(bluebook.name, { database: ENV["DATABASE_URL"]#{hecks_schema ? ", schema: #{hecks_schema.inspect}" : ""} }); lineage = Hecks::Adapters::PostgresEra::Lineage.new(db, bluebook.name); (registry.bluebooks.values - [bluebook]).each { |other| other.aggregates.each { |aggregate| lineage.ensure_first_head!(aggregate.storage_name) } }; db.close; puts "booted OK — era resolution ran"' $(DOMAIN) && { BOOT_STATUS=0; break; }; \\
-              \t\tBOOT_STATUS=$$?; \\
-              \t\techo "boot check attempt $$attempt/5 failed (exit $$BOOT_STATUS) -- restarting the tunnel and retrying in 3s..."; \\
-              \t\tsleep 3; \\
-              \tdone; \\
-              \tkill $$TUNNEL_PID 2>/dev/null; \\
-              \techo "Tearing down the temporary bastion stack..."; \\
-              \taws cloudformation delete-stack --stack-name $(BASTION_STACK); \\
-              \taws cloudformation wait stack-delete-complete --stack-name $(BASTION_STACK); \\
-              \techo "$(BASTION_STACK) deleted. Era 1 should now be held if BOOT_STATUS was 0 — verify with hecks console or a Postgres query against hecks_eras."; \\
-              \texit $$BOOT_STATUS
-              OWNMINT
-            end
-
-          # Shares mint_era_recipe's bastion/tunnel/retry/teardown chain but
-          # runs `hecks query era.scaffold_translation` or
-          # `hecks query era.audit_translation` over it.
-          #
-          # Neither script actually reads DATABASE_URL/HECKS_SCHEMA (both call
-          # `registry.binding_settings`, a lookup against the literal `database
-          # "..."` in #{domain}'s `.world`) — without `db_env_blind:`, this
-          # recipe would open a real tunnel to production and silently
-          # scaffold/audit the local dev database instead, reporting success.
-          # `db_env_blind` refuses unless `ALLOW_LOCAL_DB=1` is set.
-          translation_recipe = lambda do |verb, script, extra_args = "", cwd: "$(ROOT)", run_prefix: "ruby -Ilib", db_env_blind: false,
-                                          domain_arg: "$(DOMAIN) "|
-            if shared
-              <<~SHAREDTRANSLATION.rstrip
-              \t@echo "#{verb} isn't automated yet for a Shared-mode domain (database \\"Shared\\") -- see mint-era's own comment in the generated Makefile for the manual path through #{owner_domain_name}'s own tunnel."; \\
-              \texit 1
-              SHAREDTRANSLATION
-            else
-              <<~OWNTRANSLATION.rstrip
-              #{db_env_blind ? <<~ENVBLINDGUARD.rstrip
-              \t@if [ -z "$$ALLOW_LOCAL_DB" ]; then \\
-              \t\techo "REFUSING: #{script} resolves its OWN database connection from #{domain}'s .world file, NOT from DATABASE_URL/HECKS_SCHEMA -- opening a real tunnel to #{stack_name}'s production RDS instance below would silently scaffold/audit the LOCAL dev database instead and report success (see this recipe's own comment, above, for the confirmed root cause). Set ALLOW_LOCAL_DB=1 to run #{verb} against #{domain}'s local .world-declared database on purpose (e.g. to exercise the scaffold/audit logic itself); otherwise run this for real against production via the manual tunnel path mint-era's own comment describes."; \\
-              \t\texit 1; \\
-              \tfi
-              ENVBLINDGUARD
-              : ""}
-              \t@echo "Looking up $(STACK)'s VPC/security group..."
-              \t#{stack_outputs.map { |o| %($(eval #{o[:var]} := $(shell aws cloudformation describe-stacks --stack-name $(STACK) --query "Stacks[0].Outputs[?OutputKey=='#{o[:key]}'].OutputValue" --output text))) }.join("\n\t")}
-              \t@echo "Deploying the temporary bastion stack $(BASTION_STACK)..."
-              \taws cloudformation deploy --template-file bastion.yaml --stack-name $(BASTION_STACK) \\
-              \t\t--parameter-overrides #{bastion_parameters.map { |p| "#{p[:name]}=$(#{stack_outputs.find { |o| o[:key] == p[:from_output] }[:var]})" }.join(" ")} \\
-              \t\t--capabilities CAPABILITY_IAM
-              # DB_PASS_URLENC -- same percent-encoding fix as mint_era_recipe's
-              # own comment above the equivalent line in that recipe (libpq's URI
-              # parser rejects a bare `%`, which a generated RDS password isn't
-              # guaranteed to be free of); this recipe's DATABASE_URL below uses
-              # the encoded form for the same reason, even though the script it
-              # feeds doesn't currently read it (see db_env_blind above).
-              \t@INSTANCE_ID=$$(aws cloudformation describe-stacks --stack-name $(BASTION_STACK) --query "Stacks[0].Outputs[?OutputKey=='InstanceId'].OutputValue" --output text); \\
-              \techo "Waiting for $$INSTANCE_ID to register with SSM..."; \\
-              \tfor i in $$(seq 1 30); do \\
-              \t\tSTATUS=$$(aws ssm describe-instance-information --filters "Key=InstanceIds,Values=$$INSTANCE_ID" --query "InstanceInformationList[0].PingStatus" --output text 2>/dev/null); \\
-              \t\tif [ "$$STATUS" = "Online" ]; then break; fi; \\
-              \t\tsleep 5; \\
-              \tdone; \\
-              \tDB_PASS=$$(aws secretsmanager get-secret-value --secret-id $(DB_SECRET_ARN) --query SecretString --output text | ruby -rjson -e 'print JSON.parse(STDIN.read)["password"]'); \\
-              \tDB_PASS_URLENC=$$(ruby -rerb -e 'print ERB::Util.url_encode(ARGV[0])' "$$DB_PASS"); \\
-              \tRUN_STATUS=1; \\
-              \tfor attempt in 1 2 3 4 5; do \\
-              \t\tkill $$TUNNEL_PID 2>/dev/null; \\
-              \t\techo "Opening an SSM tunnel to $(DB_HOST):5432 and running #{verb} (attempt $$attempt/5)..."; \\
-              \t\taws ssm start-session --target $$INSTANCE_ID \\
-              \t\t\t--document-name AWS-StartPortForwardingSessionToRemoteHost \\
-              \t\t\t--parameters "{\\"host\\":[\\"$(DB_HOST)\\"],\\"portNumber\\":[\\"5432\\"],\\"localPortNumber\\":[\\"15432\\"]}" \\
-              \t\t\t>/tmp/$(BASTION_STACK)-tunnel-$$attempt.log 2>&1 & \\
-              \t\tTUNNEL_PID=$$!; \\
-              \t\tfor i in $$(seq 1 15); do \\
-              \t\t\tnc -z localhost 15432 2>/dev/null && break; \\
-              \t\t\tsleep 1; \\
-              \t\tdone; \\
-              \t\tcd #{cwd} && DATABASE_URL="postgres://postgres:$$DB_PASS_URLENC@localhost:15432/#{db_name}" HECKS_SCHEMA="#{hecks_schema}" #{run_prefix} #{script} #{cwd == "$(ROOT)" ? domain_arg : ""}#{extra_args}&& { RUN_STATUS=0; break; }; \\
-              \t\tRUN_STATUS=$$?; \\
-              \t\techo "#{verb} attempt $$attempt/5 failed (exit $$RUN_STATUS) -- restarting the tunnel and retrying in 3s..."; \\
-              \t\tsleep 3; \\
-              \tdone; \\
-              \tkill $$TUNNEL_PID 2>/dev/null; \\
-              \techo "Tearing down the temporary bastion stack..."; \\
-              \taws cloudformation delete-stack --stack-name $(BASTION_STACK); \\
-              \taws cloudformation wait stack-delete-complete --stack-name $(BASTION_STACK); \\
-              \techo "$(BASTION_STACK) deleted."; \\
-              \texit $$RUN_STATUS
-              OWNTRANSLATION
-            end
+          text.sub(/^Outputs:\n/) do
+            "#{resources}Outputs:\n  PiiDistributionDomainName:\n    Value: !GetAtt PiiDistribution.DomainName\n"
           end
-
-          # `hecks ask` answers the scaffold as text, and refuses (exit 1) where the script aborted.
-          scaffold_translation_recipe = translation_recipe.call(
-            "scaffold-translation", "exe/hecks query era.scaffold_translation", db_env_blind: true,
-            run_prefix: "HECKS_ENVIRONMENT=memory ruby", domain_arg: "domain=$(DOMAIN) "
-          )
-          # A refused audit is a refused query: `hecks ask` exits 1, so the target fails too.
-          translation_audit_recipe = translation_recipe.call(
-            "translation-audit", "exe/hecks query era.audit_translation", db_env_blind: true,
-            run_prefix: "HECKS_ENVIRONMENT=memory ruby", domain_arg: "domain=$(DOMAIN) "
-          )
-
-          # Same chain, running an app-owned one-time migration script instead
-          # of a hecks tool. `bin/migrate_console_settings` belongs to the domain's own
-          # application, not to hecks, so it stays a `bin/` path when hecks drops its own.
-          # Harmless when the domain has none: `bundle exec ruby` on a missing file just fails
-          # loudly.
-          migrate_console_settings_recipe = translation_recipe.call(
-            "migrate-console-settings", "bin/migrate_console_settings", "",
-            cwd: "$(DOMAIN)", run_prefix: "bundle exec ruby"
-          )
-
-          # `OLD`/`NEW` are Make command-line variables (`make rename-schema
-          # OLD=old NEW=new`), reusable across whichever domain owns this
-          # stack's RDS instance. Idempotent by inspection (checks which schema
-          # exists first), not by catching a Postgres error.
-          rename_schema_recipe =
-            if shared
-              <<~SHAREDRENAME.rstrip
-              # NOT AUTOMATED for a Shared-mode domain, same reason mint-era
-              # isn't: there is no bastion.yaml here to stand up next to (this
-              # domain has no RDS/VPC of its own). This domain's own schema
-              # lives inside #{owner_domain_name}'s database — run this same
-              # target from #{owner_domain_name}'s own deploy directory instead.
-              \t@echo "rename-schema isn't automated for a Shared-mode domain (database \\"Shared\\") -- run it from #{owner_domain_name}'s own deploy directory instead, which owns the RDS instance this domain's schema actually lives on."; \\
-              \texit 1
-              SHAREDRENAME
-            else
-              <<~OWNRENAME.rstrip
-              # THE WHOLE TUNNEL IS RESTARTED PER ATTEMPT, not just probed once
-              # through a single long-lived session — confirmed live, the hard
-              # way: an SSM port-forwarding session can start and then exit
-              # again within seconds, not merely "slow to become ready". Probing
-              # the same dead tunnel five times fails identically every time,
-              # for a different reason than the retry was built for. Without
-              # this restart, a still-dead tunnel also doesn't just fail loudly
-              # — `EXISTS_OLD`/`EXISTS_NEW` would both come back empty, which the
-              # branch below reads as "neither schema exists" and reports as if
-              # that were the real answer, not a connectivity failure wearing
-              # its name — which is exactly why `TUNNEL_READY` gates that branch
-              # explicitly rather than trusting empty results at face value.
-              #
-              # OLD/NEW ARE ALLOWLISTED AS BARE IDENTIFIERS, not SQL-escaped, before
-              # either one reaches a psql command line: both get interpolated
-              # straight into the `nspname = '...'` lookups above and the
-              # `ALTER SCHEMA "..." RENAME TO "..."` below, and a schema name can't
-              # be bound as a parameter the way a value can — quoting/escaping an
-              # identifier is exactly the kind of thing that's easy to get subtly
-              # wrong, so instead of trying, this refuses anything that isn't
-              # `^[A-Za-z_][A-Za-z0-9_]*$` outright. `make` runs this recipe as an
-              # operator command, not user-facing web input, but it still executes
-              # against production RDS, so a typo'd or copy-pasted `OLD`/`NEW`
-              # containing quotes or `;` must fail loudly here, before either
-              # tunnel or query, rather than run as-is.
-              #
-              # `$$OLD`/`$$NEW` HERE, NOT `$(OLD)`/`$(NEW)`: this check itself has
-              # to read the value without Make ever splicing its raw text into the
-              # recipe line, or a value containing `;`/`"` would break out of THIS
-              # line's shell command and run before the pattern match ever sees it
-              # — confirmed live, the same way the tunnel-restart behavior above
-              # was. `$$OLD` instead reads the real shell environment variable
-              # `make` already exports for command-line-assigned vars, so the
-              # value is one opaque string to the shell no matter what characters
-              # it contains. Once a value's passed this gate it's provably just
-              # `[A-Za-z0-9_]`, so the existing `$(OLD)`/`$(NEW)` splices further
-              # below (already written before this fix, reused as-is) are safe.
-              \t@[ -n "$$OLD" ] && [ -n "$$NEW" ] || { echo "usage: make rename-schema OLD=<old-schema> NEW=<new-schema>"; exit 1; }
-              \t@echo "$$OLD" | grep -Eq '^[A-Za-z_][A-Za-z0-9_]*$$' || { echo "invalid OLD schema name -- schema names must match ^[A-Za-z_][A-Za-z0-9_]*$$, refusing to touch SQL"; exit 1; }
-              \t@echo "$$NEW" | grep -Eq '^[A-Za-z_][A-Za-z0-9_]*$$' || { echo "invalid NEW schema name -- schema names must match ^[A-Za-z_][A-Za-z0-9_]*$$, refusing to touch SQL"; exit 1; }
-              \t@echo "Looking up $(STACK)'s VPC/security group..."
-              \t#{stack_outputs.map { |o| %($(eval #{o[:var]} := $(shell aws cloudformation describe-stacks --stack-name $(STACK) --query "Stacks[0].Outputs[?OutputKey=='#{o[:key]}'].OutputValue" --output text))) }.join("\n\t")}
-              \t@echo "Deploying the temporary bastion stack $(BASTION_STACK)..."
-              \taws cloudformation deploy --template-file bastion.yaml --stack-name $(BASTION_STACK) \\
-              \t\t--parameter-overrides #{bastion_parameters.map { |p| "#{p[:name]}=$(#{stack_outputs.find { |o| o[:key] == p[:from_output] }[:var]})" }.join(" ")} \\
-              \t\t--capabilities CAPABILITY_IAM
-              \t@INSTANCE_ID=$$(aws cloudformation describe-stacks --stack-name $(BASTION_STACK) --query "Stacks[0].Outputs[?OutputKey=='InstanceId'].OutputValue" --output text); \\
-              \techo "Waiting for $$INSTANCE_ID to register with SSM..."; \\
-              \tfor i in $$(seq 1 30); do \\
-              \t\tSTATUS=$$(aws ssm describe-instance-information --filters "Key=InstanceIds,Values=$$INSTANCE_ID" --query "InstanceInformationList[0].PingStatus" --output text 2>/dev/null); \\
-              \t\tif [ "$$STATUS" = "Online" ]; then break; fi; \\
-              \t\tsleep 5; \\
-              \tdone; \\
-              \tDB_PASS=$$(aws secretsmanager get-secret-value --secret-id $(DB_SECRET_ARN) --query SecretString --output text | ruby -rjson -e 'print JSON.parse(STDIN.read)["password"]'); \\
-              \tTUNNEL_READY=1; \\
-              \tfor attempt in 1 2 3 4 5; do \\
-              \t\tkill $$TUNNEL_PID 2>/dev/null; \\
-              \t\techo "Opening an SSM tunnel to $(DB_HOST):5432 (attempt $$attempt/5)..."; \\
-              \t\taws ssm start-session --target $$INSTANCE_ID \\
-              \t\t\t--document-name AWS-StartPortForwardingSessionToRemoteHost \\
-              \t\t\t--parameters "{\\"host\\":[\\"$(DB_HOST)\\"],\\"portNumber\\":[\\"5432\\"],\\"localPortNumber\\":[\\"15432\\"]}" \\
-              \t\t\t>/tmp/$(BASTION_STACK)-tunnel-$$attempt.log 2>&1 & \\
-              \t\tTUNNEL_PID=$$!; \\
-              \t\tfor i in $$(seq 1 15); do \\
-              \t\t\tnc -z localhost 15432 2>/dev/null && break; \\
-              \t\t\tsleep 1; \\
-              \t\tdone; \\
-              \t\tPGPASSWORD=$$DB_PASS psql -h localhost -p 15432 -U postgres -d #{db_name} -tAc "SELECT 1" >/dev/null 2>&1 && { TUNNEL_READY=0; break; }; \\
-              \t\techo "tunnel not carrying real traffic yet (attempt $$attempt/5) -- restarting the tunnel and retrying in 3s..."; \\
-              \t\tsleep 3; \\
-              \tdone; \\
-              \tEXISTS_OLD=$$(PGPASSWORD=$$DB_PASS psql -h localhost -p 15432 -U postgres -d #{db_name} -tAc "SELECT 1 FROM pg_namespace WHERE nspname = '$(OLD)'"); \\
-              \tEXISTS_NEW=$$(PGPASSWORD=$$DB_PASS psql -h localhost -p 15432 -U postgres -d #{db_name} -tAc "SELECT 1 FROM pg_namespace WHERE nspname = '$(NEW)'"); \\
-              \tif [ "$$TUNNEL_READY" != "0" ]; then \\
-              \t\techo "tunnel never carried a real connection -- aborting without touching either schema"; \\
-              \t\tBOOT_STATUS=1; \\
-              \telif [ "$$EXISTS_NEW" = "1" ]; then \\
-              \t\techo "schema $(NEW) already exists -- already renamed, no-op"; \\
-              \t\tBOOT_STATUS=0; \\
-              \telif [ "$$EXISTS_OLD" = "1" ]; then \\
-              \t\tPGPASSWORD=$$DB_PASS psql -h localhost -p 15432 -U postgres -d #{db_name} -v ON_ERROR_STOP=1 -c "ALTER SCHEMA \\"$(OLD)\\" RENAME TO \\"$(NEW)\\""; \\
-              \t\tBOOT_STATUS=$$?; \\
-              \t\techo "renamed schema $(OLD) to $(NEW) (exit $$BOOT_STATUS)"; \\
-              \telse \\
-              \t\techo "neither schema $(OLD) nor $(NEW) exists on #{db_name} -- nothing to rename"; \\
-              \t\tBOOT_STATUS=1; \\
-              \tfi; \\
-              \tkill $$TUNNEL_PID 2>/dev/null; \\
-              \techo "Tearing down the temporary bastion stack..."; \\
-              \taws cloudformation delete-stack --stack-name $(BASTION_STACK); \\
-              \taws cloudformation wait stack-delete-complete --stack-name $(BASTION_STACK); \\
-              \techo "$(BASTION_STACK) deleted."; \\
-              \texit $$BOOT_STATUS
-              OWNRENAME
-            end
-
-          # `google_oauth_present` and `shared` are independent facts, not
-          # alternatives — an elsif would silently drop Owning* overrides
-          # whenever OAuth is also present. `@` (Make's "don't echo" prefix)
-          # is only meaningful on the chain's true first line, so lines are
-          # built unprefixed and `@` is added once, right before joining.
-          owner_lookup_lines = shared ? [
-            %(OWNER_VPC_ID=$$(aws cloudformation describe-stacks --stack-name #{owner_stack_name} --query "Stacks[0].Outputs[?OutputKey=='VpcId'].OutputValue" --output text); \\),
-            %(OWNER_SUBNET_A_ID=$$(aws cloudformation describe-stacks --stack-name #{owner_stack_name} --query "Stacks[0].Outputs[?OutputKey=='PrivateSubnetAId'].OutputValue" --output text); \\),
-            %(OWNER_SUBNET_B_ID=$$(aws cloudformation describe-stacks --stack-name #{owner_stack_name} --query "Stacks[0].Outputs[?OutputKey=='PrivateSubnetBId'].OutputValue" --output text); \\),
-            %(OWNER_SG_ID=$$(aws cloudformation describe-stacks --stack-name #{owner_stack_name} --query "Stacks[0].Outputs[?OutputKey=='FunctionSecurityGroupId'].OutputValue" --output text); \\),
-            %(OWNER_DB_HOST=$$(aws cloudformation describe-stacks --stack-name #{owner_stack_name} --query "Stacks[0].Outputs[?OutputKey=='DatabaseEndpoint'].OutputValue" --output text); \\),
-            %(OWNER_DB_SECRET_ARN=$$(aws cloudformation describe-stacks --stack-name #{owner_stack_name} --query "Stacks[0].Outputs[?OutputKey=='DatabaseSecretArn'].OutputValue" --output text); \\),
-          ] : []
-          owning_overrides = "OwningVpcId=$$OWNER_VPC_ID OwningSubnetAId=$$OWNER_SUBNET_A_ID OwningSubnetBId=$$OWNER_SUBNET_B_ID OwningSecurityGroupId=$$OWNER_SG_ID OwningDatabaseEndpoint=$$OWNER_DB_HOST OwningDatabaseSecretArn=$$OWNER_DB_SECRET_ARN"
-
-          sam_deploy_lines =
-            if google_oauth_present && shared
-              [
-                %(WEB_URL=$$(aws lambda get-function-url-config --function-name #{rust_web ? stack_name : "#{stack_name}-web"} --query FunctionUrl --output text 2>/dev/null | sed 's:/$$::'); \\),
-                "if [ -n \"$$WEB_URL\" ]; then \\",
-                %(\tsam deploy --parameter-overrides WebRedirectBaseUrl="$$WEB_URL" #{owning_overrides}; \\),
-                "else \\",
-                "\tsam deploy --parameter-overrides #{owning_overrides}; \\",
-                "fi",
-              ]
-            elsif google_oauth_present
-              [
-                %(WEB_URL=$$(aws lambda get-function-url-config --function-name #{rust_web ? stack_name : "#{stack_name}-web"} --query FunctionUrl --output text 2>/dev/null | sed 's:/$$::'); \\),
-                "if [ -n \"$$WEB_URL\" ]; then \\",
-                %(\tsam deploy --parameter-overrides WebRedirectBaseUrl="$$WEB_URL"; \\),
-                "else \\",
-                "\tsam deploy; \\",
-                "fi",
-              ]
-            elsif shared
-              ["sam deploy --parameter-overrides #{owning_overrides}"]
-            else
-              ["sam deploy"]
-            end
-
-          deploy_shell_chain = owner_lookup_lines + sam_deploy_lines
-          deploy_shell_chain = ["@#{deploy_shell_chain.first}"] + deploy_shell_chain.drop(1) if deploy_shell_chain.first&.match?(/=\$\$\(/)
-
-          # Google OAuth newly added to an existing stack would deadlock this
-          # bridge: PublicSubnetId/BastionSubnetId don't exist on the live stack
-          # until the upcoming `sam deploy` creates them, so the pre-check's own
-          # `mint-era` call would hand bastion.yaml an empty Subnet::Id and
-          # CloudFormation would refuse it before `sam deploy` ever runs. Skip
-          # the bridge in exactly that case; the unconditional `mint-era` call
-          # at the end of `deploy:` still covers it afterward.
-          predeploy_bridge_shell =
-            if google_oauth_present
-              <<~OAUTHBRIDGE.rstrip
-              @echo "Checking whether $(STACK) already exists, and if so whether it already has Google OAuth's PublicSubnetId/BastionSubnetId outputs, before deciding whether to bridge era history now or let this deploy create them first..."
-              @if aws cloudformation describe-stacks --stack-name $(STACK) >/dev/null 2>&1; then \\
-              \tOAUTH_OUTPUTS_READY=$$(aws cloudformation describe-stacks --stack-name $(STACK) --query "Stacks[0].Outputs[?OutputKey=='PublicSubnetId'].OutputValue" --output text 2>/dev/null); \\
-              \tif [ -z "$$OAUTH_OUTPUTS_READY" ]; then \\
-              \t\techo "Existing stack found, but Google OAuth is newly being added -- PublicSubnetId/BastionSubnetId don't exist on it yet (sam deploy, below, is what creates them); skipping the pre-deploy bridge this one time so THIS deploy can actually run. mint-era still runs once, after sam deploy, same as a genuine first deploy."; \\
-              \telse \\
-              \t\techo "Existing stack found -- bridging era history before this deploy flips $(STACK) over, not after."; \\
-              \t\t$(MAKE) mint-era || exit 1; \\
-              \tfi; \\
-              else \\
-              \techo "No existing stack -- first deploy, nothing to bridge yet; mint-era runs once, below, after the stack (and its RDS instance) exist."; \\
-              fi
-              OAUTHBRIDGE
-            else
-              <<~PLAINBRIDGE.rstrip
-              @echo "Checking whether $(STACK) already exists, to decide whether this deploy needs to bridge era history before it flips the stack over..."
-              @if aws cloudformation describe-stacks --stack-name $(STACK) >/dev/null 2>&1; then \\
-              \techo "Existing stack found -- bridging era history before this deploy flips $(STACK) over, not after."; \\
-              \t$(MAKE) mint-era || exit 1; \\
-              else \\
-              \techo "No existing stack -- first deploy, nothing to bridge yet; mint-era runs once, below, after the stack (and its RDS instance) exist."; \\
-              fi
-              PLAINBRIDGE
-            end
-
-          deploy_recipe_lines = (
-            (google_oauth_present ? ["$(MAKE) sync-google-oauth"] : []) +
-            (shared ? [%(@echo "Looking up #{owner_stack_name}'s shared VpcId/PrivateSubnetAId/PrivateSubnetBId/FunctionSecurityGroupId/DatabaseEndpoint/DatabaseSecretArn outputs to pass as $(STACK)'s Owning* parameters...")] : []) +
-            deploy_shell_chain
-          ).map { |l| "\t#{l}" }.join("\n")
-
-          makefile_content = <<~MAKE
-            # GENERATED by hecks deploy project #{domain} — re-run it to refresh
-            # this file rather than hand-editing.
-            #
-            # `sam build` invokes the build-<LogicalId> target below (SAM's own
-            # BuildMethod: makefile convention — see template.yaml's Metadata).
-            # `cargo lambda` (https://www.cargo-lambda.info) cross-compiles
-            # rust/host for arm64 Lambda without Docker or a hand-configured
-            # cross-linker — install once with `pip3 install cargo-lambda` or
-            # `brew install cargo-lambda`.
-
-            HOST_DIR := #{File.join(root, "rust", "host")}
-            # `domain_name`, matching `hecks build_wasm`'s own target_mod_name
-            # (a Rust-build-pipeline naming convention, not AWS resource
-            # identity — see HECKS_WASM_PATH's own comment above).
-            WASM     := #{File.join(root, "rust", "dist", "#{domain_name}.wasm")}
-
-            build-#{logical_id}:
-            \t@command -v cargo-lambda >/dev/null 2>&1 || { \\
-            \t\techo "cargo-lambda isn't installed. Install it once with: pip3 install cargo-lambda"; \\
-            \t\texit 1; \\
-            \t}
-            # ALWAYS rebuilt, never `test -f $(WASM) || ...` — that guard only
-            # checked EXISTENCE, not staleness, so a wasm built once at the
-            # start of a work session silently kept getting deployed through
-            # every later kernel change (a real, live bug: this cost a stale
-            # deploy against a wasm that predated the kernel's own "mutations"
-            # field). `hecks build_wasm` recompiles fast enough that "always
-            # rebuild" is the safe default, matching rust/host's own bootstrap
-            # build just below, which was never guarded this way to begin with.
-            \tcd #{root} && HECKS_ENVIRONMENT=memory ruby exe/hecks build.build_wasm domain=#{domain} --wait
-            \t@rustup target list --installed 2>/dev/null | grep -qx aarch64-unknown-linux-gnu || rustup target add aarch64-unknown-linux-gnu
-            # `rustup run stable`, not a bare `cargo lambda` — same reasoning
-            # `hecks build_wasm`'s own Makefile-equivalent line holds itself to: a
-            # `cargo`/`rustc` earlier on PATH than rustup's own shims (Homebrew
-            # installs one; common on this kind of machine) is a DIFFERENT
-            # toolchain that never saw `rustup target add`, and fails with
-            # "can't find crate for \`core\`" for the cross target even though
-            # `rustup target list --installed` reports it present.
-            # macOS -> Linux arm64 cross-compiling by default routes through
-            # zig (cargo-lambda's own bundled cargo-zigbuild) — every zig
-            # release checked so far (0.15.2, 0.16.0) rejects
-            # `-Wl,--fix-cortex-a53-843419`, a flag rustc's own
-            # aarch64-unknown-linux-gnu target emits unconditionally: "error:
-            # unsupported linker arg: --fix-cortex-a53-843419", found live on
-            # THIS domain's own very first real deploy attempt (upstream:
-            # https://github.com/ziglang/zig/issues, no fix released yet as of
-            # this comment). Not fixable by a flag here — it's zig's own `zig
-            # cc` argument-translation layer refusing before rustc's link step
-            # ever runs. If this build fails with that error, cargo-lambda has
-            # a real, documented non-zig, non-Docker fallback: `-c cargo` (or
-            # `CARGO_LAMBDA_COMPILER=cargo`) plus a real GNU cross-toolchain —
-            # `brew tap messense/macos-cross-toolchains && brew install
-            # aarch64-unknown-linux-gnu` (this flag has worked in real
-            # binutils/LLD since 2018; only zig's own translation of it is the
-            # gap), then set `CARGO_TARGET_AARCH64_UNKNOWN_LINUX_GNU_LINKER=
-            # aarch64-linux-gnu-gcc` with that toolchain's own bin/ on PATH.
-            # Confirmed working end to end (a real `sam deploy` against a real
-            # Lambda) the same day this comment was written.
-            \tcd $(HOST_DIR) && rustup run stable cargo lambda build --release --arm64
-            \tcp $(HOST_DIR)/target/lambda/bootstrap/bootstrap $(ARTIFACTS_DIR)/bootstrap
-            # UNCONDITIONAL, not gated on rust_web -- same reason HECKS_IR_PATH
-            # itself is unconditional above: main.rs's own boot sequence reads
-            # the IR for every domain regardless of web mode, so the sidecar
-            # file this env var points to has to actually be in the package
-            # too, or the env var alone just changes the crash from "not set"
-            # to "not found".
-            \tcp $(WASM) $(ARTIFACTS_DIR)/#{domain_name}.wasm
-            \tcp #{File.join(root, "rust", "dist", "#{domain_name}.ir.json")} $(ARTIFACTS_DIR)/#{domain_name}.ir.json
-
-            # `sam build <resource>` WIPES .aws-sam/build/ entirely before
-            # building just the one resource named -- confirmed live: building
-            # #{web_logical_id} second left NO #{logical_id}/ directory behind at
-            # all, and reverted its OWN built CodeUri back to the raw, unbuilt
-            # source value ("../.." -- CodeUri: . resolved two directories up
-            # from .aws-sam/build/template.yaml). `sam deploy` then zips THAT
-            # directory verbatim as #{logical_id}'s own code -- a real, live
-            # deploy shipped #{web_logical_id}'s own source tree (Gemfile,
-            # lambda_handler.rb, even .env.local) as #{logical_id}'s Lambda
-            # package this way, caught by downloading the actually-deployed
-            # code and finding #{web_logical_id}'s file tree inside it.
-            # `deploy:`'s own two separate `sam build <resource>` calls can
-            # never both survive in .aws-sam/build/ at once — this target
-            # re-populates #{logical_id}'s build directory from the SAME
-            # already-built bootstrap+wasm build-#{logical_id} just produced
-            # (untouched by the second sam build call — only .aws-sam/build/
-            # itself gets wiped, never $(HOST_DIR)/target or $(WASM)) and
-            # repoints the built template's CodeUri back at it.
-            .PHONY: restore-#{logical_id}-build
-            restore-#{logical_id}-build:
-            \t@mkdir -p .aws-sam/build/#{logical_id}
-            \tcp $(HOST_DIR)/target/lambda/bootstrap/bootstrap .aws-sam/build/#{logical_id}/bootstrap
-            \tcp $(WASM) .aws-sam/build/#{logical_id}/#{domain_name}.wasm
-            \tcp #{File.join(root, "rust", "dist", "#{domain_name}.ir.json")} .aws-sam/build/#{logical_id}/#{domain_name}.ir.json
-            \truby -e 'lines = File.readlines(".aws-sam/build/template.yaml"); start = lines.index { |l| l.strip == "#{logical_id}:" } or raise "restore-#{logical_id}-build: #{logical_id} resource not found in built template"; idx = (start+1...lines.length).find { |i| lines[i] =~ /CodeUri:/ } or raise "restore-#{logical_id}-build: no CodeUri line found under #{logical_id}"; lines[idx] = lines[idx].sub(/CodeUri:.*/, "CodeUri: #{logical_id}"); File.write(".aws-sam/build/template.yaml", lines.join)'
-
-            # `make verify-parity-#{logical_id}` — closes the exact gap the
-            # equivalence-gap plan's own Phase 8 named: parity was checked ONLY
-            # against CI's fixed test corpus, completely decoupled from what a
-            # real `sam deploy` actually ships — `hecks check_conformance` (the
-            # differential harness, docs/decisions/0010-ruby-is-the-reference-
-            # implementation.md) had never once been run against a specific
-            # compiled deploy artifact. Runs it here, for real, against
-            # $(WASM) -- the EXACT file `build-#{logical_id}` (above) just built
-            # and `deploy:` (below) is about to ship -- not a corpus-wide `cargo
-            # build`'s own separate binary. `hecks check_conformance --wait` exits non-zero
-            # on any mismatch, which this target lets propagate uncaught: a real
-            # divergence between THIS artifact and Ruby's own reading of the
-            # identical source blocks `make deploy` before `sam deploy` ever
-            # runs, the same way a failing build already would.
-            #
-            # `spec/corpus/#{domain_name}.json` is this domain's OWN pinned
-            # fuzzer-replay script (the same shape `hecks fuzz`/`hecks run` already
-            # use) -- if a domain doesn't have one yet, this warns LOUDLY and
-            # continues rather than either silently skipping (this project's own
-            # standing rule against a silent gap reading as full coverage) or
-            # blocking every deploy of a domain nobody has written one for yet.
-            #
-            # SECOND HALF, BELOW — `hecks fuzz_conformance`, ADR 0037's own fuzz
-            # bridge pointed at this exact $(WASM). A pinned script only proves
-            # "matches Ruby on the cases we thought to write down" (ADR 0039's own
-            # honest framing); the fuzz bridge is what actually FOUND Findings 1-6.
-            # Deliberately WARN-ONLY (`-@`, not `@`) for now: ADR 0037 already
-            # catalogues real, confirmed, not-yet-fixed divergences (Findings 3 and
-            # 5) that fire on ordinary generated sequences for more than one real
-            # domain today, so making this a hard blocker before those are closed
-            # would turn every affected domain's `make deploy` red for a reason
-            # this target can't yet point at a fix for. Flip `-@` to `@` once ADR
-            # 0037's open findings are closed and this stops firing in practice.
-            .PHONY: verify-parity-#{logical_id}
-            verify-parity-#{logical_id}:
-            \t@if [ -f #{root}/spec/corpus/#{domain_name}.json ]; then \\
-            \t\tcd #{root} && HECKS_ENVIRONMENT=memory ruby exe/hecks build.check_conformance domain=#{domain} script=spec/corpus/#{domain_name}.json artifact=$(WASM) --wait; \\
-            \telse \\
-            \t\techo "verify-parity-#{logical_id}: no spec/corpus/#{domain_name}.json -- SKIPPING the pre-deploy Ruby/Rust parity check, nothing to compare $(WASM) against. Write one (hecks fuzz/hecks run's own script shape) before this domain's next deploy."; \\
-            \tfi
-            \t@echo "verify-parity-#{logical_id}: fuzzing $(WASM) against generated sequences (ADR 0037's bridge, WARN-ONLY -- see this target's own comment)..."
-            \t-@cd #{root} && HECKS_ENVIRONMENT=memory ruby exe/hecks build.fuzz_conformance domain=#{domain} artifact=$(WASM) --wait
-
-            # `make mint-era` — takes #{stack_name}'s RDS instance from freshly
-            # created to "era 1 minted, ready for HECKS_DOMAIN/HECKS_ERA to
-            # resolve" (template.yaml's own env vars already assume era 1 —
-            # this is what makes that true). Run ONCE per fresh database, before
-            # the first real `sam deploy` of the Lambda itself; safe to re-run
-            # (a second boot against an already-held era 1 is a no-op — see
-            # era_resolver.rb's own quiet-reboot branch). Stands up bastion.yaml
-            # as its own sibling stack, uses it for one Ruby boot over an SSM
-            # tunnel, then deletes it — nothing from this target is left running
-            # afterward.
-            ROOT      := #{root}
-            DOMAIN    := #{domain}
-            STACK     := #{stack_name}
-            BASTION_STACK := #{stack_name}-bastion
-
-            mint-era:
-            #{mint_era_recipe}
-
-            # `make scaffold-translation` — run this when a deploy's own
-            # pre-flight boot check (or `make mint-era` directly) refuses with
-            # "the shape changed (era N) and no translation edge covers it".
-            # Diffs the held era against the current bluebook over the same
-            # bastion tunnel mint-era uses and WRITES a translations/*.bluebook
-            # edge file into this domain's own repo — confident rules inline,
-            # genuine ambiguities as `unresolved` lines a human has to resolve by
-            # hand (a rename, a drop, a compute — never guessed). Review the
-            # written file, then `make translation-audit`.
-            scaffold-translation:
-            #{scaffold_translation_recipe}
-
-            # `make translation-audit` — verifies a written (or still-pending)
-            # translation edge over the same tunnel: every translated state
-            # against the new era's own types/invariants/lifecycle, the compiled
-            # SQL against the port's own reference transform, and a before/after
-            # sample of real records printed for human review. Re-run
-            # `make deploy` (or `make mint-era`) once this passes — that's what
-            # actually applies the edge; this only checks it.
-            translation-audit:
-            #{translation_audit_recipe}
-
-            # `make migrate-console-settings` — runs this domain's own
-            # bin/migrate_console_settings (if it has one) over the same bastion
-            # tunnel every other Postgres-touching target here uses, against the
-            # real deployed database instead of local dev. A one-time data
-            # migration, not a repeatable ops procedure like mint-era/scaffold-
-            # translation — generated the same way regardless, per this
-            # project's own standing rule against hand-run ops steps.
-            migrate-console-settings:
-            #{migrate_console_settings_recipe}
-
-            # `make rename-schema OLD=<old> NEW=<new>` — a native `ALTER SCHEMA
-            # ... RENAME TO ...` over the same bastion tunnel mint-era uses,
-            # for when this domain's own declared identity changes
-            # (`formerly_known_as`) and its storage schema should follow. Purely
-            # a Postgres namespace rename: every table/row/sequence inside it is
-            # untouched, so this is safe to run against a live, in-use database
-            # — the only requirement is that nothing else names the schema by
-            # its OLD name at the moment this runs (this domain's own deployed
-            # Lambda's HECKS_SCHEMA env var, most directly — run `make deploy`
-            # right before or right after this, not with a long gap either way).
-            rename-schema:
-            #{rename_schema_recipe}
-
-            #{pg_version ? <<~PGNATIVE : ""}
-            # #{web_logical_id}'s own `pg` gem needs a native extension SAM's
-            # default Ruby builder can't produce correctly: the precompiled
-            # aarch64-linux binary needs GLIBC 2.29+, but Lambda's ruby3.2
-            # MANAGED runtime is Amazon Linux 2 (glibc 2.26) — a real, live
-            # "Init<NameError>: uninitialized constant PG::Error" caught this
-            # (rescuing PG::Error itself failed to resolve, because pg's own
-            # `require` died before ever reaching the file that defines it).
-            # Built once, from source, in the SAME container `sam build
-            # --use-container` itself uses (its glibc, not the host's, is what
-            # has to match the deployed runtime) — then cached under
-            # PG_NATIVE_DIR so every later `make deploy` skips straight to the
-            # fast path. Delete that directory to force a clean rebuild.
-            #
-            # OpenSSL is built `no-shared` and linked STATICALLY into libpq, so
-            # the libpq.so this produces carries no runtime dependency on
-            # whatever OpenSSL (if any) happens to already be on the Lambda
-            # execution image — sidesteps the AL2 package conflict between
-            # `openssl-libs` and the build image's own pre-installed
-            # `openssl-snapsafe-libs` entirely, rather than fighting it.
-            PG_NATIVE_DIR := #{root}/tmp/pg-native-arm64-ruby3.2
-
-            $(PG_NATIVE_DIR)/pg_ext.so:
-            \t@mkdir -p $(PG_NATIVE_DIR)
-            \t@echo "Building #{web_logical_id}'s pg native extension from source (cached under $(PG_NATIVE_DIR) after this — a few minutes, one time only)..."
-            \tdocker run --rm --platform linux/arm64 -v $(PG_NATIVE_DIR):/out \\
-            \t\t--entrypoint /bin/bash public.ecr.aws/sam/build-ruby3.2:latest-arm64 -c ' \\
-            \t\t\tset -e; \\
-            \t\t\tyum install -y perl-IPC-Cmd >/dev/null; \\
-            \t\t\tcd /tmp; \\
-            \t\t\tcurl -sL https://www.openssl.org/source/openssl-3.0.15.tar.gz | tar xz; \\
-            \t\t\tcd openssl-3.0.15; \\
-            \t\t\t./Configure linux-aarch64 no-shared no-tests --prefix=/tmp/openssl-install >/dev/null; \\
-            \t\t\tmake -j$$(nproc) >/dev/null; \\
-            \t\t\tmake install_sw >/dev/null; \\
-            \t\t\tcd /tmp; \\
-            \t\t\tcurl -sL https://ftp.postgresql.org/pub/source/v16.4/postgresql-16.4.tar.gz | tar xz; \\
-            \t\t\tcd postgresql-16.4; \\
-            \t\t\tCPPFLAGS="-I/tmp/openssl-install/include" LDFLAGS="-L/tmp/openssl-install/lib" \\
-            \t\t\t\t./configure --without-readline --without-zlib --without-icu --with-ssl=openssl --prefix=/tmp/pg-install >/dev/null; \\
-            \t\t\tmake -C src/include install >/dev/null; \\
-            \t\t\tmake -C src/interfaces/libpq -j$$(nproc) install >/dev/null; \\
-            \t\t\tcd /tmp; \\
-            \t\t\tgem fetch pg -v #{pg_version} --platform ruby >/dev/null; \\
-            \t\t\tgem unpack pg-#{pg_version}.gem --target=/tmp/gemsrc >/dev/null; \\
-            \t\t\tcd /tmp/gemsrc/pg-#{pg_version}/ext; \\
-            \t\t\truby -I.. -I../lib extconf.rb --with-pg-include=/tmp/pg-install/include --with-pg-lib=/tmp/pg-install/lib >/dev/null; \\
-            \t\t\tmake >/dev/null; \\
-            \t\t\tcp pg_ext.so /out/pg_ext.so; \\
-            \t\t\tcp /tmp/pg-install/lib/libpq.so.5.16 /out/libpq.so.5.16; \\
-            \t\t'
-
-            # `find`, not a hardcoded gem-version path — survives #{domain}'s
-            # own pg version bumping in its Gemfile.lock without this Makefile
-            # needing regeneration to match. libpq.so.5.16 lands beside the
-            # rest of #{web_logical_id}'s code at /var/task/lib — the ruby3.2
-            # base image's OWN baked-in LD_LIBRARY_PATH default already searches
-            # that exact path, so no rpath patching AND no explicit
-            # LD_LIBRARY_PATH override belongs in template.yaml (setting one
-            # there REPLACES the image's full default list instead of extending
-            # it — a real, live "libcrypt.so.1: cannot open shared object file"
-            # caught this — #{web_logical_id}'s own Environment no longer sets
-            # it at all, on purpose).
-            .PHONY: patch-pg-native
-            patch-pg-native: $(PG_NATIVE_DIR)/pg_ext.so
-            \t@PG_EXT=$$(find .aws-sam/build/#{web_logical_id}/vendor/bundle -path "*/pg-*/lib/3.2/pg_ext.so" | head -1); \\
-            \t\ttest -n "$$PG_EXT" || { echo "patch-pg-native: no pg_ext.so found under .aws-sam/build/#{web_logical_id} — run sam build --use-container #{web_logical_id} first"; exit 1; }; \\
-            \t\tcp $(PG_NATIVE_DIR)/pg_ext.so "$$PG_EXT"
-            \t@mkdir -p .aws-sam/build/#{web_logical_id}/lib
-            \tcp $(PG_NATIVE_DIR)/libpq.so.5.16 .aws-sam/build/#{web_logical_id}/lib/libpq.so.5.16
-            \tln -sf libpq.so.5.16 .aws-sam/build/#{web_logical_id}/lib/libpq.so.5
-
-            PGNATIVE
-            #{google_oauth_present ? <<~SYNCOAUTH : ""}
-            # Owns #{stack_name}-web-google-oauth's WHOLE lifecycle (create on
-            # first run, update every run after — idempotent, cheap, no reason
-            # to cache the way patch-pg-native's own multi-minute build does) —
-            # deliberately OUTSIDE CloudFormation, straight from #{domain}'s own
-            # gitignored .env.local, so the real client_id/secret never lands in
-            # this generated, git-TRACKED template.yaml as plaintext. Read by
-            # name (`{{resolve:secretsmanager:#{stack_name}-web-google-oauth:...}}`,
-            # template.yaml's own Environment — #{rust_web ? logical_id : web_logical_id}'s
-            # own), not by `!Ref` — see that comment for why this secret isn't a
-            # stack resource at all. NOT nested inside patch-pg-native's own
-            # pg_version gate above -- a real, live "No rule to make target
-            # `sync-google-oauth'" caught that this target used to only exist
-            # when a Ruby WebFunction (with its own pg gem) was also present,
-            # even though Google OAuth itself has nothing to do with pg at all.
-            .PHONY: sync-google-oauth
-            sync-google-oauth:
-            \t@CLIENT_ID=$$(grep '^GOOGLE_CLIENT_ID=' #{domain}/.env.local | cut -d= -f2-); \\
-            \t\tCLIENT_SECRET=$$(grep '^GOOGLE_CLIENT_SECRET=' #{domain}/.env.local | cut -d= -f2-); \\
-            \t\ttest -n "$$CLIENT_ID" -a -n "$$CLIENT_SECRET" || { echo "sync-google-oauth: #{domain}/.env.local is missing GOOGLE_CLIENT_ID/GOOGLE_CLIENT_SECRET"; exit 1; }; \\
-            \t\tSECRET_JSON=$$(ruby -rjson -e 'puts JSON.generate({client_id: ARGV[0], client_secret: ARGV[1]})' "$$CLIENT_ID" "$$CLIENT_SECRET"); \\
-            \t\taws secretsmanager put-secret-value --secret-id #{stack_name}-web-google-oauth --secret-string "$$SECRET_JSON" >/dev/null 2>&1 || \\
-            \t\taws secretsmanager create-secret --name #{stack_name}-web-google-oauth --secret-string "$$SECRET_JSON" >/dev/null
-
-            SYNCOAUTH
-            # `make deploy` — THE one command. Chains `sam build`, `sam deploy`
-            # (creates/updates the VPC+RDS+Lambda stack), then `mint-era` (safe
-            # to run every time — a second boot against an already-held era 1
-            # is a no-op, era_resolver.rb's own quiet-reboot branch) so a fresh
-            # database always ends this command with era 1 actually held, not a
-            # separate step someone has to remember. No hand-run AWS CLI
-            # sequence anywhere in this path.
-            #{google_oauth_present ? <<~OAUTHNOTE : ""}
-            # deploy's own last step below looks up #{web_logical_id}'s
-            # CURRENTLY deployed Function URL live (not tracked anywhere
-            # generated) and passes it as WebRedirectBaseUrl -- see that
-            # Parameter's own comment, above, for why GOOGLE_REDIRECT_URI can't
-            # just be a CloudFormation intrinsic. Empty on a genuine first
-            # deploy (before the Url exists at all); every deploy after that
-            # finds the real, STABLE hostname (confirmed unchanged across every
-            # redeploy this session) and self-heals GOOGLE_REDIRECT_URI to match.
-            OAUTHNOTE
-            #{shared ? <<~SHAREDNOTE : ""}
-            # deploy's own last step below looks up #{owner_domain_name}'s live
-            # stack Outputs (never tracked anywhere generated -- same reasoning
-            # as WebRedirectBaseUrl's own live lookup above, and the SAME
-            # `aws cloudformation describe-stacks` pattern mint-era's own eval
-            # chain, below, already proves works against a sibling stack) and
-            # passes them as this template's own Owning* Parameters.
-            SHAREDNOTE
-            .PHONY: deploy mint-era
-            deploy:
-            #{if dispatch_none
-                "\t# ONE build only -- dispatch \"None\" means there is no\n\t# #{logical_id} of any kind (no cargo-lambda, no rust artifact, no\n\t# verify-parity: nothing rust/host-shaped for this domain at all),\n\t# so unlike every other WebFunction-carrying domain there is no\n\t# second build to protect from `sam build <resource>`'s own\n\t# WIPES-.aws-sam/build/-first behavior (build-#{logical_id}'s own\n\t# sibling comment on why that matters for domains that DO have one)\n\t# and nothing to restore afterward.\n\tsam build --use-container #{web_logical_id}\n\t$(MAKE) patch-pg-native"
-              elsif pg_version
-                "\t# TWO SEPARATE builds, not one `--use-container` run -- that flag is\n\t# global to `sam build`, but #{logical_id} deliberately builds on\n\t# THIS machine's own toolchain (cargo-lambda already cross-compiles\n\t# to arm64 without a container -- build-#{logical_id}'s own comment\n\t# on why), which a generic provided.al2023 container doesn't have\n\t# at all (a real, live \"Make Failed\" caught this). Only #{web_logical_id}\n\t# needs the container, to cross-compile pg's native extension for\n\t# Amazon Linux -- `sam build <resource>` WIPES .aws-sam/build/ before\n\t# building just the one named, so #{logical_id}'s own build gets\n\t# restored below (restore-#{logical_id}-build's own comment on why).\n\tsam build #{logical_id}\n\tsam build --use-container #{web_logical_id}\n\t$(MAKE) restore-#{logical_id}-build\n\t$(MAKE) patch-pg-native\n\t$(MAKE) verify-parity-#{logical_id}"
-              elsif web_handler_present
-                "\t# TWO SEPARATE builds -- #{web_logical_id} has no native extension to\n\t# cross-compile (no `pg` in #{domain}/Gemfile.lock), so a plain `sam\n\t# build` targets it fine; #{logical_id} still gets its own `sam build\n\t# <resource>` first, then restored below -- `sam build <resource>`\n\t# WIPES .aws-sam/build/ before building just the one named, so the\n\t# second call here would otherwise erase #{logical_id}'s own build\n\t# (restore-#{logical_id}-build's own comment on why).\n\tsam build #{logical_id}\n\tsam build #{web_logical_id}\n\t$(MAKE) restore-#{logical_id}-build\n\t$(MAKE) verify-parity-#{logical_id}"
-              else
-                "\tsam build\n\t$(MAKE) verify-parity-#{logical_id}"
-              end}
-            #{shared ? "" : <<~PREDEPLOYBRIDGE.each_line.map { |l| "\t" + l }.join.rstrip
-                # THE TRANSACTION-SAFETY GAP, closed for the case that actually
-                # matters: `sam deploy` below is what flips this Lambda's own
-                # HECKS_DOMAIN/HECKS_SCHEMA env vars live — the INSTANT it
-                # completes, real traffic can hit a domain/schema combination
-                # whose era history hasn't been bridged yet if THIS domain was
-                # just renamed (formerly_known_as) or its schema just moved.
-                # `mint-era` already bridges that (era_resolver.rb's own
-                # rename_domain! path, idempotent either way) — it only ran
-                # AFTER `sam deploy` before this existed, which is exactly the
-                # order that left a real live window open the one time this was
-                # actually run in anger (an SSM tunnel flaked mid-bridge, after
-                # the Lambda had already flipped over).
-                #
-                # STILL RUNS AFTER TOO (unchanged, below) — this pre-check
-                # cannot replace that: a domain's VERY FIRST deploy has no
-                # stack, hence no RDS, hence nothing to tunnel to yet, so
-                # mint-era's real first run has to stay where it always was,
-                # once `sam deploy` has just created that RDS instance. This
-                # only ADDS a second, EARLIER run for a domain that already has
-                # a live stack (a rename or an ordinary redeploy) — cheap and
-                # safe either way, since mint-era's own quiet-reboot path is a
-                # no-op the moment nothing has actually changed.
-                #
-                # See predeploy_bridge_shell's own comment (hecks deploy project,
-                # above, right before deploy_recipe_lines) for why this branches
-                # on google_oauth_present at all -- the short version: adding
-                # Google OAuth to an EXISTING stack would otherwise deadlock this
-                # exact pre-check against outputs the upcoming sam deploy (not
-                # yet run) hasn't created.
-                #{predeploy_bridge_shell}
-                PREDEPLOYBRIDGE
-            }
-            #{deploy_recipe_lines}
-            \t$(MAKE) mint-era
-          MAKE
-
-          # Everything `sam deploy --guided` would ask interactively is already
-          # known from the domain's own `deployed_to("AwsLambda")` block.
-          samconfig_toml = <<~TOML
-            # GENERATED by hecks deploy project #{domain} — re-run it to refresh
-            # this file rather than hand-editing.
-            version = 0.1
-
-            [default.deploy.parameters]
-            stack_name = "#{stack_name}"
-            region = "#{region}"
-            resolve_s3 = true
-            s3_prefix = "#{stack_name}"
-            capabilities = "CAPABILITY_IAM"
-            confirm_changeset = false
-            disable_rollback = false
-          TOML
-
-          files = { "template.yaml" => template_yaml }
-          files["bastion.yaml"] = bastion_yaml if bastion_yaml
-          files["Makefile"] = makefile_content
-          files["samconfig.toml"] = samconfig_toml
-          files
         end
+        private_class_method :with_pii_distribution
+
+        # Surgical removal, post-render, not a nested conditional heredoc: a conditional nested
+        # heredoc broke embedded multi-line `#{shared ? ... : ...}` strings inside the resource
+        # block, which assume exactly one reindentation layer.
+        def without_dispatch_function(text, stack)
+          function = Regexp.escape(stack.logical_id)
+          # Non-greedy through the resource's own FunctionUrlConfig/AuthType closing pair, so
+          # WebFunction's own later "AuthType:" can't match.
+          text = text.sub(/^  #{function}:\n.*?\n        AuthType: (?:NONE|AWS_IAM)\n/m, "")
+          # Removes the now-dangling `!Ref` to the resource just deleted above: SAM refuses an
+          # unresolved Ref at package time, not silently.
+          text = text.sub(/^        - LambdaInvokePolicy:\n            FunctionName: !Ref #{function}\n/, "")
+          # WebFunction's own URL becomes the stack's only "FunctionUrl".
+          text.sub(web_url_output(stack), "  FunctionUrl:\n    Value: !GetAtt #{stack.web_logical_id}Url.FunctionUrl\n")
+        end
+        private_class_method :without_dispatch_function
 
-        # Builds the CloudFront/WAFv2/logging resources a pii-marked domain is
-        # fronted by. `use_oac` signs requests only for the AWS_IAM case; the
-        # already-public WebFunction/rust_web Function URL stays as reachable
-        # as before. Managed cache/origin-request policy ids are AWS's own
-        # permanent `Managed-CachingDisabled`/`Managed-AllViewer` ids.
-        def pii_cloudfront_yaml(fronted_logical_id:, use_oac:, geo_restriction_type:, geo_restriction_countries:)
-          reindent = ->(text) { text.each_line.map { |line| line.strip.empty? ? line : "  #{line}" }.join }
-
-          # Not pre-reindented (unlike the return value as a whole, below) — each
-          # is spliced back into the still-being-dedented `RESOURCES` heredoc via
-          # `#{...}`, which the outer `reindent.call` already shifts by 2
-          # spaces once; reindenting here too would double it.
-          origin_access_control = use_oac ? <<~OAC : ""
-            PiiOriginAccessControl:
-              Type: AWS::CloudFront::OriginAccessControl
-              Properties:
-                OriginAccessControlConfig:
-                  Name: !Sub "${AWS::StackName}-pii-oac"
-                  OriginAccessControlOriginType: lambda
-                  SigningBehavior: always
-                  SigningProtocol: sigv4
-          OAC
-
-          invoke_permission = <<~PERMISSION
-            PiiLambdaInvokePermission:
-              Type: AWS::Lambda::Permission
-              Properties:
-                Action: lambda:InvokeFunctionUrl
-                FunctionName: !Ref #{fronted_logical_id}
-                Principal: cloudfront.amazonaws.com
-                SourceArn: !Sub "arn:aws:cloudfront::${AWS::AccountId}:distribution/${PiiDistribution}"
-                FunctionUrlAuthType: #{use_oac ? "AWS_IAM" : "NONE"}
-          PERMISSION
-
-          countries_yaml = geo_restriction_countries.map { |code| "              - #{code}" }.join("\n")
-
-          reindent.call(<<~RESOURCES)
-            PiiAccessLogsBucket:
-              Type: AWS::S3::Bucket
-              Properties:
-                # `BucketOwnerPreferred`, not the newer `BucketOwnerEnforced`
-                # default — CloudFront's own classic access-log delivery
-                # (`Logging:`, on PiiDistribution below) still authorizes itself
-                # via a canned ACL (`AccessControlTranslation` between accounts is
-                # a distinct, newer mechanism this bucket has no other account to
-                # need), which an ACLs-disabled bucket refuses outright.
-                OwnershipControls:
-                  Rules:
-                    - ObjectOwnership: BucketOwnerPreferred
-                AccessControl: LogDeliveryWrite
-                LifecycleConfiguration:
-                  Rules:
-                    - Id: ExpirePiiAccessLogs
-                      Status: Enabled
-                      ExpirationInDays: 365
-
-            PiiResponseHeadersPolicy:
-              Type: AWS::CloudFront::ResponseHeadersPolicy
-              Properties:
-                ResponseHeadersPolicyConfig:
-                  Name: !Sub "${AWS::StackName}-pii-headers"
-                  SecurityHeadersConfig:
-                    StrictTransportSecurity:
-                      AccessControlMaxAgeSec: 63072000
-                      IncludeSubdomains: true
-                      Override: true
-                    ContentTypeOptions:
-                      Override: true
-                    FrameOptions:
-                      FrameOption: DENY
-                      Override: true
-                    ReferrerPolicy:
-                      ReferrerPolicy: same-origin
-                      Override: true
-                    XSSProtection:
-                      ModeBlock: true
-                      Protection: true
-                      Override: true
-
-            PiiWebAcl:
-              Type: AWS::WAFv2::WebACL
-              Properties:
-                Name: !Sub "${AWS::StackName}-pii-waf"
-                Scope: CLOUDFRONT
-                DefaultAction:
-                  Allow: {}
-                VisibilityConfig:
-                  SampledRequestsEnabled: true
-                  CloudWatchMetricsEnabled: true
-                  MetricName: !Sub "${AWS::StackName}PiiWebAcl"
-                Rules:
-                  - Name: AWSManagedRulesCommonRuleSet
-                    Priority: 0
-                    OverrideAction:
-                      None: {}
-                    Statement:
-                      ManagedRuleGroupStatement:
-                        VendorName: AWS
-                        Name: AWSManagedRulesCommonRuleSet
-                    VisibilityConfig:
-                      SampledRequestsEnabled: true
-                      CloudWatchMetricsEnabled: true
-                      MetricName: !Sub "${AWS::StackName}PiiCommonRuleSet"
-                  - Name: AWSManagedRulesKnownBadInputsRuleSet
-                    Priority: 1
-                    OverrideAction:
-                      None: {}
-                    Statement:
-                      ManagedRuleGroupStatement:
-                        VendorName: AWS
-                        Name: AWSManagedRulesKnownBadInputsRuleSet
-                    VisibilityConfig:
-                      SampledRequestsEnabled: true
-                      CloudWatchMetricsEnabled: true
-                      MetricName: !Sub "${AWS::StackName}PiiKnownBadInputs"
-
-            #{origin_access_control}
-            PiiDistribution:
-              Type: AWS::CloudFront::Distribution
-              Properties:
-                DistributionConfig:
-                  Enabled: true
-                  HttpVersion: http2
-                  WebACLId: !GetAtt PiiWebAcl.Arn
-                  Restrictions:
-                    GeoRestriction:
-                      RestrictionType: #{geo_restriction_type}
-                      Locations:#{geo_restriction_type == "none" ? " []" : "\n" + countries_yaml}
-                  Logging:
-                    Bucket: !GetAtt PiiAccessLogsBucket.RegionalDomainName
-                    IncludeCookies: false
-                    Prefix: cloudfront/
-                  Origins:
-                    - Id: PiiOrigin
-                      # `!Select [2, !Split ["/", ...]]` — the standard AWS-documented
-                      # way to pull the bare hostname out of a Function URL's own
-                      # `https://<id>.lambda-url.<region>.on.aws/` shape for use as a
-                      # CustomOriginConfig DomainName, which admits no scheme or path.
-                      DomainName: !Select [2, !Split ["/", !GetAtt #{fronted_logical_id}Url.FunctionUrl]]
-                      CustomOriginConfig:
-                        OriginProtocolPolicy: https-only
-                        OriginSSLProtocols: [TLSv1.2]
-            #{use_oac ? "          OriginAccessControlId: !Ref PiiOriginAccessControl" : ""}
-                  DefaultCacheBehavior:
-                    TargetOriginId: PiiOrigin
-                    ViewerProtocolPolicy: redirect-to-https
-                    AllowedMethods: [GET, HEAD, OPTIONS, PUT, PATCH, POST, DELETE]
-                    CachedMethods: [GET, HEAD]
-                    CachePolicyId: 4135ea2d-6df8-44a3-9df3-4b5a84be39ad
-                    OriginRequestPolicyId: 216adef6-5c7f-47e4-b989-5492eafa07d3
-                    ResponseHeadersPolicyId: !Ref PiiResponseHeadersPolicy
-
-            #{invoke_permission}
-          RESOURCES
+        def web_url_output(stack)
+          function = Regexp.escape(stack.logical_id)
+          web = Regexp.escape(stack.web_logical_id)
+          Regexp.new(["^  FunctionUrl:\\n    Value: !GetAtt #{function}Url\\.FunctionUrl\\n",
+                      "  WebFunctionUrl:\\n    Value: !GetAtt #{web}Url\\.FunctionUrl\\n"].join)
         end
+        private_class_method :web_url_output
 
+        def bastion_yaml(stack)
+          Shared.bastion_yaml(stack.network, domain: stack.domain, stack_name: stack.stack_name,
+                                             bastion_parameters: stack.bastion_parameters)
+        end
+        private_class_method :bastion_yaml
       end
     end
   end