hecks 3.4.2 → 3.6.0

data/lib/hecks/projections/deploy/template_diff/comparer.rb

@@ -1,3 +1,6 @@
+require_relative "normalizer"
+require_relative "value_diff"
+
 module Hecks
   module Projections
     module Deploy
@@ -14,13 +17,15 @@ module Hecks
           end
 
           ENTITY_SECTIONS = %w[Parameters Resources Outputs Conditions Mappings].freeze
-          IDENTITY_KEYS = %w[Name Id Key PolicyName PathPattern HeaderName ContainerName Sid Field].freeze
-          ORDERED_BY = %w[PathPattern].freeze
 
           # Diffs each entity section by name, with other top-level keys grouped under "Template".
+          #
+          # @param before [Hash] the template before, as loaded
+          # @param after [Hash] the template after, as loaded
+          # @return [Hash{String => SectionDiff, Array<Change>}] one diff per section present
           def compare(before, after)
-            before = normalize(before)
-            after = normalize(after)
+            before = Normalizer.normalize(before)
+            after = Normalizer.normalize(after)
             diff = ENTITY_SECTIONS.each_with_object({}) do |section, sections|
               next unless before.key?(section) || after.key?(section)
 
@@ -30,54 +35,21 @@ module Hecks
             diff
           end
 
-          def normalize(value)
-            case value
-            when Hash then normalize_hash(value)
-            when Array then value.map { |item| normalize(item) }
-            else value
-            end
-          end
-          private_class_method :normalize
-
-          def normalize_hash(hash)
-            result = hash.to_h { |key, item| [key, key == "DependsOn" ? depends_on(item) : normalize(item)] }
-            substitution?(result) ? simplify_sub(result) : result
-          end
-          private_class_method :normalize_hash
-
-          def depends_on(value)
-            Array(value).map(&:to_s).sort
-          end
-          private_class_method :depends_on
-
-          def substitution?(hash)
-            hash.size == 1 && hash["Fn::Sub"].is_a?(String)
-          end
-          private_class_method :substitution?
-
-          # `!Sub "${Name}"` is `!Ref Name`, `!Sub "${A.B}"` is `!GetAtt A.B`, and a `!Sub` with no
-          # variable is the plain string.
-          def simplify_sub(hash)
-            text = hash["Fn::Sub"]
-            return text unless text.include?("${")
-
-            match = text.match(/\A\$\{([^}!]+)\}\z/)
-            return hash unless match
-
-            name = match[1]
-            name.include?(".") && !name.start_with?("AWS::") ? { "Fn::GetAtt" => name.split(".", 2) } : { "Ref" => name }
-          end
-          private_class_method :simplify_sub
-
           def section_diff(section, before, after)
             SectionDiff.new(
-              added:   (after.keys - before.keys).sort.map { |name| [name, type_of(section, after[name])] },
-              removed: (before.keys - after.keys).sort.map { |name| [name, type_of(section, before[name])] },
+              added:   listed(section, after, before),
+              removed: listed(section, before, after),
               changed: (before.keys & after.keys).sort.filter_map { |name| entity_diff(section, name, before[name], after[name]) }
             )
           end
           private_class_method :section_diff
 
+          # The `[name, type]` of each entity in `side` that `other` lacks.
+          def listed(section, side, other)
+            (side.keys - other.keys).sort.map { |name| [name, type_of(section, side[name])] }
+          end
+          private_class_method :listed
+
           def type_of(section, entity)
             entity.is_a?(Hash) && %w[Resources Parameters].include?(section) ? entity["Type"] : nil
           end
@@ -87,7 +59,7 @@ module Hecks
             return nil if before == after
 
             changes = []
-            diff_values("", before, after, changes)
+            ValueDiff.diff_values("", before, after, changes)
             return nil if changes.empty?
 
             replaced = section == "Resources" && before.is_a?(Hash) && after.is_a?(Hash) && before["Type"] != after["Type"]
@@ -98,110 +70,12 @@ module Hecks
           def template_changes(before, after)
             changes = []
             others = (before.keys | after.keys) - ENTITY_SECTIONS
-            others.sort.each { |key| diff_values(key, before[key], after[key], changes) unless before[key] == after[key] }
+            others.sort.each do |key|
+              ValueDiff.diff_values(key, before[key], after[key], changes) unless before[key] == after[key]
+            end
             changes
           end
           private_class_method :template_changes
-
-          def diff_values(path, before, after, changes)
-            return if before == after
-
-            if before.is_a?(Hash) && after.is_a?(Hash)
-              diff_hashes(path, before, after, changes)
-            elsif before.is_a?(Array) && after.is_a?(Array)
-              diff_arrays(path, before, after, changes)
-            else
-              changes << Change.new(path: path, kind: :changed, before: before, after: after, cosmetic: same_text?(before, after))
-            end
-          end
-          private_class_method :diff_values
-
-          def diff_hashes(path, before, after, changes)
-            (before.keys | after.keys).sort.each do |key|
-              child = path.empty? ? key : "#{path}.#{key}"
-              if !after.key?(key)
-                changes << Change.new(path: child, kind: :removed, before: before[key])
-              elsif !before.key?(key)
-                changes << Change.new(path: child, kind: :added, after: after[key])
-              else
-                diff_values(child, before[key], after[key], changes)
-              end
-            end
-          end
-          private_class_method :diff_hashes
-
-          def diff_arrays(path, before, after, changes)
-            key = identity_key(before, after)
-            return diff_keyed(path, key, before, after, changes) if key
-            if before.sort_by(&:to_s) == after.sort_by(&:to_s)
-              return changes << Change.new(path: path, kind: :reordered, before: before, after: after,
-                                           cosmetic: true)
-            end
-
-            (0...[before.size, after.size].max).each do |index|
-              child = "#{path}[#{index}]"
-              if index >= after.size then changes << Change.new(path: child, kind: :removed, before: before[index])
-              elsif index >= before.size then changes << Change.new(path: child, kind: :added, after: after[index])
-              else diff_values(child, before[index], after[index], changes)
-              end
-            end
-          end
-          private_class_method :diff_arrays
-
-          def diff_keyed(path, key, before, after, changes)
-            left = before.to_h { |item| [item[key].to_s, item] }
-            right = after.to_h { |item| [item[key].to_s, item] }
-            (left.keys | right.keys).each do |name|
-              child = "#{path}[#{key}=#{name}]"
-              if !right.key?(name) then changes << Change.new(path: child, kind: :removed, before: left[name])
-              elsif !left.key?(name) then changes << Change.new(path: child, kind: :added, after: right[name])
-              else diff_values(child, left[name], right[name], changes)
-              end
-            end
-            check_order(path, key, left.keys, right.keys, changes)
-          end
-          private_class_method :diff_keyed
-
-          def check_order(path, key, left, right, changes)
-            return unless ORDERED_BY.include?(key)
-
-            common = left & right
-            return if left.select { |name| common.include?(name) } == right.select { |name| common.include?(name) }
-
-            changes << Change.new(path: path, kind: :reordered, before: left, after: right, cosmetic: false)
-          end
-          private_class_method :check_order
-
-          # A list of mappings is matched by a field only when every entry in both lists has it and
-          # no two entries share its value, so a match is never ambiguous.
-          def identity_key(before, after)
-            lists = [before, after]
-            return nil if lists.any? { |list| list.empty? || !list.all?(Hash) }
-
-            IDENTITY_KEYS.find do |key|
-              lists.all? do |list|
-                list.all? { |item| scalar?(item[key]) } && list.map do |item|
-                  item[key].to_s
-                end.uniq.size == list.size
-              end
-            end
-          end
-          private_class_method :identity_key
-
-          def scalar?(value)
-            value.is_a?(String) || value.is_a?(Integer)
-          end
-          private_class_method :scalar?
-
-          def same_text?(before, after)
-            scalars = [before, after].all? do |value|
-              [String, Integer, Float, TrueClass, FalseClass].any? do |type|
-                value.is_a?(type)
-              end
-            end
-            scalars && before.to_s == after.to_s
-          end
-          private_class_method :same_text?
         end
       end
     end

data/lib/hecks/projections/deploy/template_diff/normalizer.rb

@@ -0,0 +1,60 @@
+module Hecks
+  module Projections
+    module Deploy
+      module TemplateDiff
+        # Rewrites a loaded CloudFormation template into one canonical spelling so two templates
+        # that say the same thing compare equal: `DependsOn` sorted, and a `!Sub` of a single
+        # variable written as the `!Ref` or `!GetAtt` it stands for.
+        module Normalizer
+          module_function
+
+          # @param value [Object] a loaded template, or any node inside one
+          # @return [Object] the same shape with every node in its canonical spelling
+          def normalize(value)
+            case value
+            when Hash then normalize_hash(value)
+            when Array then value.map { |item| normalize(item) }
+            else value
+            end
+          end
+
+          def normalize_hash(hash)
+            result = hash.to_h { |key, item| [key, key == "DependsOn" ? depends_on(item) : normalize(item)] }
+            substitution?(result) ? simplify_sub(result) : result
+          end
+          private_class_method :normalize_hash
+
+          def depends_on(value)
+            Array(value).map(&:to_s).sort
+          end
+          private_class_method :depends_on
+
+          def substitution?(hash)
+            hash.size == 1 && hash["Fn::Sub"].is_a?(String)
+          end
+          private_class_method :substitution?
+
+          # `!Sub "${Name}"` is `!Ref Name`, `!Sub "${A.B}"` is `!GetAtt A.B`, and a `!Sub` with no
+          # variable is the plain string.
+          def simplify_sub(hash)
+            text = hash["Fn::Sub"]
+            return text unless text.include?("${")
+
+            match = text.match(/\A\$\{([^}!]+)\}\z/)
+            return hash unless match
+
+            intrinsic_for(match[1])
+          end
+          private_class_method :simplify_sub
+
+          def intrinsic_for(name)
+            return { "Ref" => name } unless name.include?(".") && !name.start_with?("AWS::")
+
+            { "Fn::GetAtt" => name.split(".", 2) }
+          end
+          private_class_method :intrinsic_for
+        end
+      end
+    end
+  end
+end

data/lib/hecks/projections/deploy/template_diff/value_diff.rb

@@ -0,0 +1,136 @@
+module Hecks
+  module Projections
+    module Deploy
+      module TemplateDiff
+        # Walks two normalized values side by side and appends a `Comparer::Change` for each
+        # difference: hashes by key, lists of mappings by an identity field, other lists by
+        # position.
+        module ValueDiff
+          module_function
+
+          IDENTITY_KEYS = %w[Name Id Key PolicyName PathPattern HeaderName ContainerName Sid Field].freeze
+          ORDERED_BY = %w[PathPattern].freeze
+          SCALAR_TYPES = [String, Integer, Float, TrueClass, FalseClass].freeze
+
+          # @param path [String] where the two values sit, dotted from the template root
+          # @param before [Object] the value before
+          # @param after [Object] the value after
+          # @param changes [Array<Comparer::Change>] receives one entry per difference
+          # @return [void]
+          def diff_values(path, before, after, changes)
+            return if before == after
+
+            if before.is_a?(Hash) && after.is_a?(Hash)
+              diff_hashes(path, before, after, changes)
+            elsif before.is_a?(Array) && after.is_a?(Array)
+              diff_arrays(path, before, after, changes)
+            else
+              changes << Comparer::Change.new(path: path, kind: :changed, before: before, after: after,
+                                              cosmetic: same_text?(before, after))
+            end
+          end
+
+          def diff_hashes(path, before, after, changes)
+            (before.keys | after.keys).sort.each do |key|
+              child = path.empty? ? key : "#{path}.#{key}"
+              diff_member(child, slot(before, key), slot(after, key), changes)
+            end
+          end
+          private_class_method :diff_hashes
+
+          # A member present on one side only is added or removed; on both sides it is compared.
+          # A side is a one-element list holding the member, or nil when it is absent.
+          def diff_member(child, before, after, changes)
+            return changes << Comparer::Change.new(path: child, kind: :removed, before: before.first) unless after
+            return changes << Comparer::Change.new(path: child, kind: :added, after: after.first) unless before
+
+            diff_values(child, before.first, after.first, changes)
+          end
+          private_class_method :diff_member
+
+          def slot(hash, key)
+            [hash[key]] if hash.key?(key)
+          end
+          private_class_method :slot
+
+          def diff_arrays(path, before, after, changes)
+            key = identity_key(before, after)
+            return diff_keyed(path, key, before, after, changes) if key
+            return changes << reordered(path, before, after, true) if before.sort_by(&:to_s) == after.sort_by(&:to_s)
+
+            diff_positional(path, before, after, changes)
+          end
+          private_class_method :diff_arrays
+
+          def diff_positional(path, before, after, changes)
+            (0...[before.size, after.size].max).each do |index|
+              diff_member("#{path}[#{index}]", at(before, index), at(after, index), changes)
+            end
+          end
+          private_class_method :diff_positional
+
+          def at(list, index)
+            [list[index]] if index < list.size
+          end
+          private_class_method :at
+
+          def diff_keyed(path, key, before, after, changes)
+            left = by_identity(before, key)
+            right = by_identity(after, key)
+            (left.keys | right.keys).each do |name|
+              diff_member("#{path}[#{key}=#{name}]", slot(left, name), slot(right, name), changes)
+            end
+            check_order(path, key, left.keys, right.keys, changes)
+          end
+          private_class_method :diff_keyed
+
+          def by_identity(list, key)
+            list.to_h { |item| [item[key].to_s, item] }
+          end
+          private_class_method :by_identity
+
+          def check_order(path, key, left, right, changes)
+            return unless ORDERED_BY.include?(key)
+
+            common = left & right
+            return if left.select { |name| common.include?(name) } == right.select { |name| common.include?(name) }
+
+            changes << reordered(path, left, right, false)
+          end
+          private_class_method :check_order
+
+          def reordered(path, before, after, cosmetic)
+            Comparer::Change.new(path: path, kind: :reordered, before: before, after: after, cosmetic: cosmetic)
+          end
+          private_class_method :reordered
+
+          # A list of mappings is matched by a field only when every entry in both lists has it and
+          # no two entries share its value, so a match is never ambiguous.
+          def identity_key(before, after)
+            lists = [before, after]
+            return nil if lists.any? { |list| list.empty? || !list.all?(Hash) }
+
+            IDENTITY_KEYS.find { |key| lists.all? { |list| identifies?(list, key) } }
+          end
+          private_class_method :identity_key
+
+          def identifies?(list, key)
+            list.all? { |item| scalar?(item[key]) } && list.map { |item| item[key].to_s }.uniq.size == list.size
+          end
+          private_class_method :identifies?
+
+          def scalar?(value)
+            value.is_a?(String) || value.is_a?(Integer)
+          end
+          private_class_method :scalar?
+
+          def same_text?(before, after)
+            scalars = [before, after].all? { |value| SCALAR_TYPES.any? { |type| value.is_a?(type) } }
+            scalars && before.to_s == after.to_s
+          end
+          private_class_method :same_text?
+        end
+      end
+    end
+  end
+end

data/lib/hecks/projections/deploy/template_diff.rb

@@ -73,7 +73,7 @@ module Hecks
         private_class_method :section_lines
 
         def entity_lines(entity, report)
-          head = "  ~ #{entity.name}#{" (#{entity.type})" if entity.type}#{'  REPLACEMENT: the type changed' if entity.replaced}"
+          head = "  ~ #{entity.name}#{" (#{entity.type})" if entity.type}#{"  REPLACEMENT: the type changed" if entity.replaced}"
           [head] + entity.changes.flat_map { |change| change_lines(change, report, "      ") }
         end
         private_class_method :entity_lines
@@ -83,12 +83,17 @@ module Hecks
           case change.kind
           when :added then ["#{indent}+ #{change.path}: #{show(change.after)}"]
           when :removed then ["#{indent}- #{change.path}: #{show(change.before)}"]
-          when :reordered then ["#{indent}~ #{change.path}: order #{show(change.before)} -> #{show(change.after)}#{marker}"]
-          else ["#{indent}~ #{change.path}: #{show(change.before)} -> #{show(change.after)}#{marker}"]
+          when :reordered then ["#{indent}~ #{change.path}: order #{transition(change)}#{marker}"]
+          else ["#{indent}~ #{change.path}: #{transition(change)}#{marker}"]
           end
         end
         private_class_method :change_lines
 
+        def transition(change)
+          "#{show(change.before)} -> #{show(change.after)}"
+        end
+        private_class_method :transition
+
         def show(value)
           text = value.is_a?(String) ? value.inspect : JSON.generate(value)
           text.length > 140 ? "#{text[0, 137]}..." : text

data/lib/hecks/projections/deploy/templates/fargate/Dockerfile.tmpl

@@ -0,0 +1,28 @@
+# GENERATED by hecks deploy project @@domain@@ — re-run it to refresh this
+# file rather than hand-editing. Modeled on a Ruby deployment's own
+# Dockerfile shape: build the binary outside the image (this directory's own
+# Makefile, before `docker build` runs), ship only the result — one COPY,
+# not a from-scratch toolchain install on every deploy.
+FROM debian:bookworm-slim
+
+# ca-certificates — real outbound TLS (Secrets Manager, any third-party
+# API this domain calls) needs a real system CA bundle.
+# libpq5 — Adapters::PostgresEra's own native `tokio_postgres`/libpq
+# linkage needs the actual shared library present at runtime, the same
+# reason Lambda's own generated Makefile patches libpq.so onto that
+# package's Ruby-side equivalent.
+RUN apt-get update -qq && apt-get install -y --no-install-recommends -qq ca-certificates libpq5 \
+    && rm -rf /var/lib/apt/lists/*
+
+COPY @@build_context_dir@@@@domain_name@@-host @@sidecar_dir@@/@@domain_name@@-host
+# The .wasm/.ir.json sidecars main.rs requires at boot —
+# HECKS_WASM_PATH/HECKS_IR_PATH (template.yaml's own
+# ContainerDefinitions Environment) point at these exact paths.
+COPY @@build_context_dir@@@@domain_name@@.wasm @@sidecar_dir@@/@@domain_name@@.wasm
+COPY @@build_context_dir@@@@domain_name@@.ir.json @@sidecar_dir@@/@@domain_name@@.ir.json
+
+ENV PORT=@@port@@
+ENV BIND=0.0.0.0
+EXPOSE @@port@@
+
+CMD ["@@cmd_binary@@-host"]

data/lib/hecks/projections/deploy/templates/fargate/Makefile.tmpl

@@ -0,0 +1,63 @@
+# GENERATED by hecks deploy project @@domain@@ — re-run it to refresh
+# this file rather than hand-editing.
+#
+# `make deploy` — builds rust/host for this domain, pushes it to this
+# stack's own ECR repository, and deploys the CloudFormation stack.
+# No SAM anywhere in this path.
+
+ROOT       := @@root@@
+DOMAIN     := @@domain@@
+STACK      := @@stack_name@@
+BASTION_STACK := @@stack_name@@-bastion
+REGION     := @@region@@
+IMAGE_TAG  := latest
+
+build:
+# aarch64, not x86_64 — matches template.yaml's own
+# RuntimePlatform: ARM64 (this Makefile has to build the same
+# architecture the task definition declares, or the container
+# fails at task start, not at build time), and reuses the same
+# working aarch64-unknown-linux-gnu toolchain the Lambda deploy
+# path already depends on, rather than standing up a second,
+# x86_64-only one.
+	@rustup target list --installed 2>/dev/null | grep -qx aarch64-unknown-linux-gnu || rustup target add aarch64-unknown-linux-gnu
+# GNU cross-linker, not Apple clang — rustc's aarch64-unknown-linux-gnu
+# target emits `-Wl,--fix-cortex-a53-843419`, which macOS ld rejects
+# (found live building a domain image). Same
+# toolchain Lambda's generated Makefile already documents.
+	@command -v aarch64-linux-gnu-gcc >/dev/null 2>&1 || { echo "aarch64-linux-gnu-gcc isn't on PATH. Install once with: brew tap messense/macos-cross-toolchains && brew install aarch64-unknown-linux-gnu"; exit 1; }
+# The .wasm/.ir.json sidecars main.rs requires at boot,
+# unconditionally — see template.yaml's own HECKS_WASM_PATH/
+# HECKS_IR_PATH comment for why. `hecks build_wasm` is the same
+# generator the Lambda deploy path already uses to produce
+# rust/dist/@@domain_name@@.wasm/.ir.json from this domain's own
+# .bluebook.
+	cd $(ROOT) && HECKS_ENVIRONMENT=memory ruby exe/hecks build.build_wasm domain=$(DOMAIN) --wait
+	cd $(ROOT)/rust/host && CARGO_TARGET_AARCH64_UNKNOWN_LINUX_GNU_LINKER=aarch64-linux-gnu-gcc rustup run stable cargo build --release --target aarch64-unknown-linux-gnu --bin bootstrap
+	cp $(ROOT)/rust/host/target/aarch64-unknown-linux-gnu/release/bootstrap @@domain_name@@-host
+	cp $(ROOT)/rust/dist/@@domain_name@@.wasm @@domain_name@@.wasm
+	cp $(ROOT)/rust/dist/@@domain_name@@.ir.json @@domain_name@@.ir.json
+
+.PHONY: ecr-login
+ecr-login:
+	aws ecr get-login-password --region $(REGION) | docker login --username AWS --password-stdin $$(aws sts get-caller-identity --query Account --output text).dkr.ecr.$(REGION).amazonaws.com
+
+.PHONY: docker-build
+docker-build: build
+# linux/arm64, not the generator's old amd64 default — has to
+# match RuntimePlatform/the binary this Makefile's own build:
+# step just cross-compiled, above.
+	docker build --platform linux/arm64 -t @@repository_name@@:$(IMAGE_TAG) .
+
+.PHONY: docker-push
+docker-push: ecr-login
+	ACCOUNT_ID=$$(aws sts get-caller-identity --query Account --output text); \
+		docker tag @@repository_name@@:$(IMAGE_TAG) $$ACCOUNT_ID.dkr.ecr.$(REGION).amazonaws.com/@@repository_name@@:$(IMAGE_TAG); \
+		docker push $$ACCOUNT_ID.dkr.ecr.$(REGION).amazonaws.com/@@repository_name@@:$(IMAGE_TAG)
+
+.PHONY: deploy
+deploy: docker-build docker-push
+@@deploy_command@@
+	$(MAKE) mint-era
+
+@@mint_era@@

data/lib/hecks/projections/deploy/templates/fargate/always_params.tmpl

@@ -0,0 +1,4 @@
+@@tag_parameter@@:
+  Type: String
+  Default: latest
+  Description: ECR image tag this task pulls — never hardcode latest in the TaskDefinition; a first deploy and a later rollout share this one parameter.

data/lib/hecks/projections/deploy/templates/fargate/deploy_plain.tmpl

@@ -0,0 +1 @@
+	aws cloudformation deploy --template-file template.yaml --stack-name $(STACK) --region $(REGION) --capabilities CAPABILITY_IAM --parameter-overrides @@tag_parameter@@=$(IMAGE_TAG)

data/lib/hecks/projections/deploy/templates/fargate/deploy_shared.tmpl

@@ -0,0 +1,11 @@
+	@echo "Looking up @@owner_stack_name@@'s shared VpcId/PrivateSubnetAId/PrivateSubnetBId/PublicSubnetId/BastionSubnetId/FunctionSecurityGroupId/DatabaseEndpoint/DatabaseSecretArn outputs to pass as $(STACK)'s Owning* parameters..."
+	OWNER_VPC_ID=$$(aws cloudformation describe-stacks --stack-name @@owner_stack_name@@ --query "Stacks[0].Outputs[?OutputKey=='VpcId'].OutputValue" --output text); \
+		OWNER_SUBNET_A_ID=$$(aws cloudformation describe-stacks --stack-name @@owner_stack_name@@ --query "Stacks[0].Outputs[?OutputKey=='PrivateSubnetAId'].OutputValue" --output text); \
+		OWNER_SUBNET_B_ID=$$(aws cloudformation describe-stacks --stack-name @@owner_stack_name@@ --query "Stacks[0].Outputs[?OutputKey=='PrivateSubnetBId'].OutputValue" --output text); \
+		OWNER_PUBLIC_SUBNET_A_ID=$$(aws cloudformation describe-stacks --stack-name @@owner_stack_name@@ --query "Stacks[0].Outputs[?OutputKey=='PublicSubnetId'].OutputValue" --output text); \
+		OWNER_PUBLIC_SUBNET_B_ID=$$(aws cloudformation describe-stacks --stack-name @@owner_stack_name@@ --query "Stacks[0].Outputs[?OutputKey=='BastionSubnetId'].OutputValue" --output text); \
+		OWNER_SG_ID=$$(aws cloudformation describe-stacks --stack-name @@owner_stack_name@@ --query "Stacks[0].Outputs[?OutputKey=='FunctionSecurityGroupId'].OutputValue" --output text); \
+		OWNER_DB_HOST=$$(aws cloudformation describe-stacks --stack-name @@owner_stack_name@@ --query "Stacks[0].Outputs[?OutputKey=='DatabaseEndpoint'].OutputValue" --output text); \
+		OWNER_DB_SECRET_ARN=$$(aws cloudformation describe-stacks --stack-name @@owner_stack_name@@ --query "Stacks[0].Outputs[?OutputKey=='DatabaseSecretArn'].OutputValue" --output text); \
+		aws cloudformation deploy --template-file template.yaml --stack-name $(STACK) --region $(REGION) --capabilities CAPABILITY_IAM \
+			--parameter-overrides @@tag_parameter@@=$(IMAGE_TAG) OwningVpcId=$$OWNER_VPC_ID OwningSubnetAId=$$OWNER_SUBNET_A_ID OwningSubnetBId=$$OWNER_SUBNET_B_ID OwningPublicSubnetAId=$$OWNER_PUBLIC_SUBNET_A_ID OwningPublicSubnetBId=$$OWNER_PUBLIC_SUBNET_B_ID OwningSecurityGroupId=$$OWNER_SG_ID OwningDatabaseEndpoint=$$OWNER_DB_HOST OwningDatabaseSecretArn=$$OWNER_DB_SECRET_ARN

data/lib/hecks/projections/deploy/templates/fargate/mint_era_own.tmpl

@@ -0,0 +1,44 @@
+# `make mint-era` — the same bastion/tunnel/retry/teardown chain
+# `Lambda`'s own generated Makefile uses (this directory's own
+# bastion.yaml, stood up and torn down for the one boot that mints
+# era 1), against this stack's own VPC/RDS instead of a Lambda's.
+.PHONY: mint-era
+mint-era:
+	@echo "Looking up $(STACK)'s VPC/security group..."
+	@@eval_lines@@
+	@echo "Deploying the temporary bastion stack $(BASTION_STACK)..."
+	aws cloudformation deploy --template-file bastion.yaml --stack-name $(BASTION_STACK) \
+		--parameter-overrides @@parameter_overrides@@ \
+		--capabilities CAPABILITY_IAM
+	@INSTANCE_ID=$$(aws cloudformation describe-stacks --stack-name $(BASTION_STACK) --query "Stacks[0].Outputs[?OutputKey=='InstanceId'].OutputValue" --output text); \
+		echo "Waiting for $$INSTANCE_ID to register with SSM..."; \
+		for i in $$(seq 1 30); do \
+			STATUS=$$(aws ssm describe-instance-information --filters "Key=InstanceIds,Values=$$INSTANCE_ID" --query "InstanceInformationList[0].PingStatus" --output text 2>/dev/null); \
+			if [ "$$STATUS" = "Online" ]; then break; fi; \
+			sleep 5; \
+		done; \
+		DB_PASS=$$(aws secretsmanager get-secret-value --secret-id $(DB_SECRET_ARN) --query SecretString --output text | ruby -rjson -e 'print JSON.parse(STDIN.read)["password"]'); \
+		DB_PASS_URLENC=$$(ruby -rerb -e 'print ERB::Util.url_encode(ARGV[0])' "$$DB_PASS"); \
+		BOOT_STATUS=1; \
+		for attempt in 1 2 3 4 5; do \
+			kill $$TUNNEL_PID 2>/dev/null; \
+			echo "Opening an SSM tunnel to $(DB_HOST):5432 and minting era 1 (attempt $$attempt/5)..."; \
+			aws ssm start-session --target $$INSTANCE_ID \
+				--document-name AWS-StartPortForwardingSessionToRemoteHost \
+				--parameters "{\"host\":[\"$(DB_HOST)\"],\"portNumber\":[\"5432\"],\"localPortNumber\":[\"15432\"]}" \
+				>/tmp/$(BASTION_STACK)-tunnel-$$attempt.log 2>&1 & \
+			TUNNEL_PID=$$!; \
+			for i in $$(seq 1 15); do \
+				nc -z localhost 15432 2>/dev/null && break; \
+				sleep 1; \
+			done; \
+			cd $(ROOT) && DATABASE_URL="postgres://postgres:$$DB_PASS_URLENC@localhost:15432/@@db_name@@" ruby -Ilib -e 'require "hecks"; require "hecks/ports/persistence/plugins/era"; loading = Hecks::Ports::Loading.bootstrap; directory = loading.bluebook_directory(ARGV[0]); root = loading.shared_root(nil, directory); registry = Hecks::Runtime::Registry.new(root: File.dirname(directory)); Hecks.with_registry(registry) { loading.load_library; loading.load_project(root); loading.load_domain(directory) }; bluebook = registry.bluebooks[@@declared_domain_literal@@] or abort "no @@declared_domain_name@@ bluebook loaded"; current_text = Hecks::Runtime::EraCheck.source_text_for(bluebook, directory); Hecks::Adapters::PostgresEra::LineageManager.check!(registry: registry, bluebook: bluebook, current_text: current_text, settings: { database: ENV["DATABASE_URL"]@@schema_setting@@ }); db = Hecks::Adapters::PostgresEra.connect_for(bluebook.name, { database: ENV["DATABASE_URL"]@@schema_setting@@ }); lineage = Hecks::Adapters::PostgresEra::Lineage.new(db, bluebook.name); (registry.bluebooks.values - [bluebook]).each { |other| other.aggregates.each { |aggregate| lineage.ensure_first_head!(aggregate.storage_name) } }; db.close; puts "booted OK -- era resolution ran"' $(DOMAIN) && { BOOT_STATUS=0; break; }; \
+			BOOT_STATUS=$$?; \
+			echo "boot check attempt $$attempt/5 failed (exit $$BOOT_STATUS) -- restarting the tunnel and retrying in 3s..."; \
+			sleep 3; \
+		done; \
+		kill $$TUNNEL_PID 2>/dev/null; \
+		echo "Tearing down the temporary bastion stack..."; \
+		aws cloudformation delete-stack --stack-name $(BASTION_STACK); \
+		aws cloudformation wait stack-delete-complete --stack-name $(BASTION_STACK); \
+		exit $$BOOT_STATUS

data/lib/hecks/projections/deploy/templates/fargate/mint_era_shared.tmpl

@@ -0,0 +1,8 @@
+# mint-era isn't automated yet for a Shared-mode domain (database
+# "Shared") — see @@owner_domain_name@@'s own deploy directory for
+# the manual tunnel path. Exits 0 (not 1) so a genuinely successful
+# `make deploy` still reports success.
+.PHONY: mint-era
+mint-era:
+	@echo "mint-era isn't automated yet for a Shared-mode domain (database \"Shared\") -- see @@owner_domain_name@@'s own deploy directory's tunnel path. This is NOT a failure."; \
+	exit 0

data/lib/hecks/projections/deploy/templates/fargate/missing_owner.tmpl

@@ -0,0 +1,9 @@
+@@world_file@@'s deployed_to("AwsFargate") declares database "Shared" but no owner. Add one, e.g.:
+
+    deployed_to("AwsFargate") do
+      ...
+      database "Shared"
+      owner "Core"
+    end
+
+naming the already-deployed domain whose Postgres instance this one borrows.

data/lib/hecks/projections/deploy/templates/fargate/oauth_params.tmpl

@@ -0,0 +1,7 @@
+# Same chicken-egg as Lambda's WebRedirectBaseUrl — CloudFront's
+# hostname does not exist until this stack does. Empty on a true
+# first deploy; `make deploy` looks up Outputs.CloudFrontDomain
+# after and self-heals.
+WebRedirectBaseUrl:
+  Type: String
+  Default: ""

data/lib/hecks/projections/deploy/templates/fargate/oauth_task_env.tmpl

@@ -0,0 +1,4 @@
+- Name: GOOGLE_OAUTH_SECRET_ID
+  Value: @@stack_name@@-web-google-oauth
+- Name: GOOGLE_REDIRECT_URI
+  Value: !Sub "${WebRedirectBaseUrl}/auth/google/callback"

data/lib/hecks/projections/deploy/templates/fargate/oauth_task_policy.tmpl

@@ -0,0 +1,7 @@
+- PolicyName: GoogleOauthSecretRead
+  PolicyDocument:
+    Version: '2012-10-17'
+    Statement:
+      - Effect: Allow
+        Action: secretsmanager:GetSecretValue
+        Resource: !Sub "arn:aws:secretsmanager:${AWS::Region}:${AWS::AccountId}:secret:@@stack_name@@-web-google-oauth-*"