hecks 5.0.0 → 6.0.0

data/lib/hecks/projections/deploy/fargate/settings/tuning.rb

@@ -6,6 +6,15 @@ module Hecks
           # The optional service and build settings written onto a plan. Extended onto `Settings`,
           # which supplies the defaults.
           module Tuning
+            # An absolute path that does not end in a slash.
+            ABSOLUTE_DIR = %r{\A/[A-Za-z0-9_./-]*[A-Za-z0-9_.-]\z}
+            # An absolute directory path of path characters.
+            ABSOLUTE_PATH = %r{\A/[A-Za-z0-9_.-]+(/[A-Za-z0-9_.-]+)*\z}
+            # A relative directory path of path characters.
+            RELATIVE_PATH = %r{\A[A-Za-z0-9_.-]+(/[A-Za-z0-9_.-]+)*\z}
+            # A relative directory path that ends in a slash.
+            RELATIVE_DIR = %r{\A[A-Za-z0-9_.-]+(/[A-Za-z0-9_.-]+)*/\z}
+
             private
 
             def check_alerts!(alerts, cdn)
@@ -58,7 +67,7 @@ module Hecks
 
             def install_dir(value)
               text = value.to_s
-              return text if text.match?(%r{\A/[A-Za-z0-9_./-]*[A-Za-z0-9_.-]\z})
+              return text if text.match?(ABSOLUTE_DIR)
 
               raise ArgumentError, "install_dir must be an absolute path without a trailing slash, got #{value.inspect}"
             end
@@ -69,8 +78,8 @@ module Hecks
             def host_dir(value)
               text = value.to_s
               return text if text == DEFAULT_HOST_DIR
-              return text if text.match?(%r{\A/[A-Za-z0-9_.-]+(/[A-Za-z0-9_.-]+)*\z})
-              return "$(ROOT)/#{text}" if text.match?(%r{\A[A-Za-z0-9_.-]+(/[A-Za-z0-9_.-]+)*\z})
+              return text if text.match?(ABSOLUTE_PATH)
+              return "$(ROOT)/#{text}" if text.match?(RELATIVE_PATH)
 
               raise ArgumentError,
                     "host_crate must be a directory path of letters, digits, . _ - and /, absolute or relative to the " \
@@ -79,7 +88,7 @@ module Hecks
 
             def build_context_dir(value)
               text = value.to_s
-              return text if text.empty? || text.match?(%r{\A[A-Za-z0-9_.-]+(/[A-Za-z0-9_.-]+)*/\z})
+              return text if text.empty? || text.match?(RELATIVE_DIR)
 
               raise ArgumentError,
                     "build_context_dir must be a relative directory ending in /, such as \"build/\", got #{value.inspect}"

data/lib/hecks/projections/deploy/fargate/stack/blocks.rb

@@ -42,7 +42,7 @@ module Hecks
               compute_id = ids[:compute_prefix]
               description = compute_description
               yaml = Shared.vpc_and_database_yaml(network, compute_logical_id: compute_id, compute_description: description)
-              yaml.each_line.with_index.map { |line, i| (i.zero? ? "" : "  ") + line }.join.rstrip
+              indented_after_first_line(yaml)
             end
 
             # Built outside the template so re-indenting it cannot shift this YAML out of sync with
@@ -64,6 +64,11 @@ module Hecks
 
             private
 
+            def indented_after_first_line(yaml)
+              lines = yaml.each_line.with_index.map { |line, i| (i.zero? ? "" : "  ") + line }
+              lines.join.rstrip
+            end
+
             def compute_description
               "#{logical_id} - inbound from #{alb_sg_id} only, egress rules attached separately below"
             end

data/lib/hecks/projections/deploy/fargate/stack/readers.rb

@@ -40,7 +40,8 @@ module Hecks
             def distribution_id = ids[:distribution]
             def session_secret_id = ids[:session_secret]
             def ingress_from_alb_id = ids[:ingress_from_alb]
-            def default_target_group_id = layout.default.target_group_id
+            def default_container = layout.default
+            def default_target_group_id = default_container.target_group_id
 
             def cluster_name = names[:cluster]
             def log_group_name = names[:log_group]

data/lib/hecks/projections/deploy/fargate/stack.rb

@@ -17,6 +17,13 @@ module Hecks
           include Blocks
           include Recipes
 
+          # Any character a database name may not hold.
+          NOT_ALPHANUMERIC = /[^a-zA-Z0-9]/
+          # A `.env.local` line that sets a Google client id.
+          GOOGLE_CLIENT_ID_LINE = /^GOOGLE_CLIENT_ID=\S/
+          # The separators between the words of a stack name.
+          NAME_SEPARATOR = /[_-]/
+
           attr_reader :domain, :root, :world_file, :domain_name, :declared_domain_name, :deploy_settings, :infra_name,
                       :db_name, :region, :cpu, :memory, :port, :web, :aurora, :shared, :google_oauth_present,
                       :owner_domain_name, :owner_stack_name, :owner_db_name, :hecks_schema, :logical_id,
@@ -48,10 +55,8 @@ module Hecks
 
           def read_names(registry)
             @infra_name = deploy_settings[:stack_name] || domain_name
-            @db_name = infra_name.gsub(/[^a-zA-Z0-9]/, "")
-            @cross_domain_targets = registry.bluebooks.flat_map do |_name, chapter|
-              chapter.policies.select(&:target_domain).map(&:target_domain)
-            end.uniq.sort
+            @db_name = infra_name.gsub(NOT_ALPHANUMERIC, "")
+            @cross_domain_targets = Shared.cross_domain_targets(registry)
           end
 
           # Same tenant override `Lambda.call` applies; see that method's comment.
@@ -100,7 +105,7 @@ module Hecks
           def read_flags
             env_file = File.join(domain, ".env.local")
             @google_oauth_present = web == "Rust" && File.exist?(env_file) &&
-                                    File.read(env_file).match?(/^GOOGLE_CLIENT_ID=\S/)
+                                    File.read(env_file).match?(GOOGLE_CLIENT_ID_LINE)
           end
 
           # Same "Shared" borrowing `Lambda.call` supports. `owner`/`owner_stack` stay plain
@@ -120,7 +125,7 @@ module Hecks
           end
 
           def derive_names
-            @logical_id = "#{infra_name.split(/[_-]/).map(&:capitalize).join}Service"
+            @logical_id = "#{infra_name.split(NAME_SEPARATOR).map(&:capitalize).join}Service"
             @stack_prefix = deploy_settings[:stack_prefix] || "hecks"
             @stack_name = "#{stack_prefix}-#{infra_name}"
             @desired_count = deploy_settings.fetch(:desired_count, 1)

data/lib/hecks/projections/deploy/fargate/yaml.rb

@@ -9,6 +9,13 @@ module Hecks
         module Yaml
           module_function
 
+          # A word YAML reads as a plain string without quotes.
+          BARE_WORD = /\A[A-Za-z][A-Za-z0-9_.-]*\z/
+          # A run of characters a CloudFormation logical id may not hold.
+          NOT_ALPHANUMERIC_RUN = /[^a-zA-Z0-9]+/
+          # The words YAML would read as a boolean or null rather than a string.
+          YAML_KEYWORDS = %w[true false null yes no on off].freeze
+
           # Writes one value as a YAML scalar; a leading `!` marks a CloudFormation
           # intrinsic (`!Ref`, `!Sub`, `!GetAtt`) and is left unquoted.
           def scalar(value)
@@ -34,8 +41,7 @@ module Hecks
           end
 
           def plain_word?(value)
-            value.is_a?(String) && value.match?(/\A[A-Za-z][A-Za-z0-9_.-]*\z/) && !%w[true false null yes no on
-                                                                                      off].include?(value.downcase)
+            value.is_a?(String) && value.match?(BARE_WORD) && !YAML_KEYWORDS.include?(value.downcase)
           end
           private_class_method :plain_word?
 
@@ -55,7 +61,8 @@ module Hecks
           # Turns a name such as `mock-payments` into a CloudFormation-safe
           # logical id part: `MockPayments`.
           def camel(name)
-            name.to_s.split(/[^a-zA-Z0-9]+/).reject(&:empty?).map { |part| part[0].upcase + part[1..] }.join
+            parts = name.to_s.split(NOT_ALPHANUMERIC_RUN).reject(&:empty?)
+            parts.map { |part| part[0].upcase + part[1..] }.join
           end
 
           # Finds keys declared more than once at one indentation in a section, since

data/lib/hecks/projections/deploy/fargate.rb

@@ -17,12 +17,17 @@ module Hecks
 
         projects_as :aws_fargate, needs_world: true, emits: :files
 
+        # The template line that marks where the database environment goes, capturing its indent.
+        DB_ENV_MARKER = /^([ \t]*)# TMPL:db_env\n/
+        # The template line that marks where cross-domain policies go, capturing its indent.
+        CROSS_DOMAIN_MARKER = /^([ \t]*)# TMPL:cross_domain_fargate_policies\n/
+
         module_function
 
         # Generates `template.yaml`, `Makefile`, `Dockerfile`, and — unless
         # this domain borrows another domain's RDS instance — `bastion.yaml`.
         #
-        # @param bluebook [Bluebook::Behaviour::Chapter] the domain's own booted chapter
+        # @param bluebook [Bluebook::Behaviour::Bluebook] the domain's own booted bluebook
         # @param options [Hash] generation options; same shape as `Lambda.call`'s
         # @return [Hash{String => String}] the generated file contents, keyed by filename
         # @raise [ArgumentError] if the domain's deploy settings conflict
@@ -68,12 +73,12 @@ module Hecks
         private_class_method :with_previews_and_scripts
 
         def splice_database_env(text, stack)
-          text.sub(/^([ \t]*)# TMPL:db_env\n/) { stack.db_env_yaml(Regexp.last_match(1)) }
+          text.sub(DB_ENV_MARKER) { stack.db_env_yaml(Regexp.last_match(1)) }
         end
         private_class_method :splice_database_env
 
         def splice_cross_domain_policies(text, stack)
-          text.sub(/^([ \t]*)# TMPL:cross_domain_fargate_policies\n/) do
+          text.sub(CROSS_DOMAIN_MARKER) do
             stack.cross_domain_targets.empty? ? "" : stack.cross_domain_policy_yaml(Regexp.last_match(1))
           end
         end

data/lib/hecks/projections/deploy/lambda/stack/blocks.rb

@@ -25,7 +25,8 @@ module Hecks
 
               # Indented 2: the blocks dedent to column 0, but these are Parameters: children, which
               # YAML requires indented under it.
-              "Parameters:\n#{blocks.join("\n").each_line.map { |line| "  #{line}" }.join}"
+              params = blocks.join("\n")
+              "Parameters:\n#{params.each_line.map { |line| "  #{line}" }.join}"
             end
 
             def network_resources
@@ -108,7 +109,8 @@ module Hecks
             # Prefixes every line after the first with `pad` (the first with `head`), then drops the
             # trailing blank lines: a multi-line value spliced into an indented line of a template.
             def tail_indent(text, pad, head = "")
-              text.each_line.with_index.map { |line, i| (i.zero? ? head : pad) + line }.join.rstrip
+              lines = text.each_line.with_index.map { |line, i| (i.zero? ? head : pad) + line }
+              lines.join.rstrip
             end
           end
         end

data/lib/hecks/projections/deploy/lambda/stack/deploy_chain.rb

@@ -37,7 +37,8 @@ module Hecks
               return "" if shared
 
               bridge = TextTemplate.render_from("lambda/predeploy_bridge.tmpl", self)
-              bridge.each_line.map { |line| "\t#{line}" }.join.rstrip
+              lines = bridge.each_line.map { |line| "\t#{line}" }
+              lines.join.rstrip
             end
 
             # Google OAuth newly added to an existing stack would deadlock this bridge:

data/lib/hecks/projections/deploy/lambda/stack/reading.rb

@@ -6,6 +6,11 @@ module Hecks
           # Reads a stack's facts from the options, the world and the files beside it. Included into
           # `Stack`; each step is one move of its constructor.
           module Reading
+            # Any character a database name may not hold.
+            NOT_ALPHANUMERIC = /[^a-zA-Z0-9]/
+            # The separators between the words of a stack name.
+            NAME_SEPARATOR = /[_-]/
+
             private
 
             def read_options(options)
@@ -52,16 +57,15 @@ module Hecks
               # RDS's own DBName/DatabaseName parameter refuses non-alphanumeric characters; every
               # downstream consumer (Environment vars, Makefile shell commands) has to read the same
               # sanitized spelling.
-              @db_name = infra_name.gsub(/[^a-zA-Z0-9]/, "")
+              @db_name = infra_name.gsub(NOT_ALPHANUMERIC, "")
             end
 
             def apply_tenant
               return unless @tenant_options[:tenant]
 
-              base_stack_name = deploy_settings[:stack_name] || domain_name
+              stack_name = "#{deploy_settings[:stack_name] || domain_name}-#{@tenant_options[:tenant]}"
               schema = @tenant_options.key?(:schema) ? @tenant_options[:schema] : @tenant_options[:tenant]
-              @deploy_settings = deploy_settings.merge(stack_name: "#{base_stack_name}-#{@tenant_options[:tenant]}",
-                                                       schema:     schema)
+              @deploy_settings = deploy_settings.merge(stack_name: stack_name, schema: schema)
             end
 
             # Dispatches into LambdaTarget.Declare's given/invariant machinery for named,
@@ -117,13 +121,12 @@ module Hecks
               read_cross_domain_targets
             end
 
-            # Scans every loaded chapter, not just this domain's own: an `attaches`-attached chapter
+            # Scans every loaded bluebook, not just this domain's own: an `attaches`-attached
+            # bluebook
             # can itself declare a cross-domain policy, including one nested inside
             # `aggregate "X" do ... end`.
             def read_cross_domain_targets
-              @cross_domain_targets = @registry.bluebooks.flat_map do |_name, bluebook|
-                bluebook.policies.select(&:target_domain).map(&:target_domain)
-              end.uniq.sort
+              @cross_domain_targets = Shared.cross_domain_targets(@registry)
             end
 
             # Shared mode provisions no RDS/VPC of its own; it borrows another already-deployed
@@ -158,7 +161,7 @@ module Hecks
             # stack, samconfig) reads `stack_name`; `infra_name` (logical ids, DB name) is
             # untouched.
             def derive_ids
-              @logical_id = "#{infra_name.split(/[_-]/).map(&:capitalize).join}Function"
+              @logical_id = "#{infra_name.split(NAME_SEPARATOR).map(&:capitalize).join}Function"
               @stack_prefix = deploy_settings[:stack_prefix] || "hecks"
               @stack_name = "#{stack_prefix}-#{infra_name}"
             end

data/lib/hecks/projections/deploy/lambda/stack/reading_web.rb

@@ -6,6 +6,11 @@ module Hecks
           # Reads the facts about the domain's own web function from the files beside the world.
           # Included into `Stack`; each step is one move of its constructor.
           module ReadingWeb
+            # The `pg` line of a Gemfile.lock, capturing its version.
+            PG_LOCK_LINE = /^\s+pg \(([\d.]+)\)/
+            # A `.env.local` line that sets a Google client id.
+            GOOGLE_CLIENT_ID_LINE = /^GOOGLE_CLIENT_ID=\S/
+
             private
 
             # Opt-in by file presence: a domain wanting its own web app on Lambda drops a
@@ -27,7 +32,7 @@ module Hecks
             def read_pg_version
               return nil unless web_handler_present
 
-              File.read(File.join(dispatch_none ? root : domain, "Gemfile.lock"))[/^\s+pg \(([\d.]+)\)/, 1]
+              File.read(File.join(dispatch_none ? root : domain, "Gemfile.lock"))[PG_LOCK_LINE, 1]
             end
 
             # `dispatch "None"` means the domain alone has no Gemfile/lib/hecks to zip, so CodeUri
@@ -43,7 +48,7 @@ module Hecks
             def read_google_oauth
               env_file = File.join(domain, ".env.local")
               @google_oauth_present = (web_handler_present || rust_web) && File.exist?(env_file) &&
-                                      File.read(env_file).match?(/^GOOGLE_CLIENT_ID=\S/)
+                                      File.read(env_file).match?(GOOGLE_CLIENT_ID_LINE)
             end
           end
         end

data/lib/hecks/projections/deploy/lambda/stack/web.rb

@@ -11,7 +11,8 @@ module Hecks
             def web_function
               return "" unless web_handler_present
 
-              TextTemplate.render_from("lambda/web_function.tmpl", self).each_line.map { |line| "  #{line}" }.join
+              function = TextTemplate.render_from("lambda/web_function.tmpl", self)
+              function.each_line.map { |line| "  #{line}" }.join
             end
 
             def web_schema_env

data/lib/hecks/projections/deploy/lambda.rb

@@ -14,12 +14,17 @@ module Hecks
 
         projects_as :aws_lambda, needs_world: true, emits: :files
 
+        # The template line that marks where cross-domain policies go, capturing its indent.
+        CROSS_DOMAIN_MARKER = /^([ \t]*)# TMPL:cross_domain_lambda_policies\n/
+        # The line that opens a template's `Outputs` section.
+        OUTPUTS_HEADING = /^Outputs:\n/
+
         module_function
 
         # Renders `template.yaml`, `Makefile`, `samconfig.toml`, and (unless
         # this domain shares another domain's RDS instance) `bastion.yaml`.
         #
-        # @param bluebook [Bluebook::Behaviour::Chapter] the domain's booted chapter
+        # @param bluebook [Bluebook::Behaviour::Bluebook] the domain's booted bluebook
         # @param options [Hash] :world, :domain_dir, :root, :world_file, and
         #   :cross_domain_registry are required; :tenant is optional
         # @return [Hash{String => String}] generated file contents by filename
@@ -59,7 +64,7 @@ module Hecks
         # @return [String] the SAM template
         def template_yaml(stack)
           text = TextTemplate.render_from("lambda/template.yaml.tmpl", stack)
-          text = text.sub(/^([ \t]*)# TMPL:cross_domain_lambda_policies\n/) do
+          text = text.sub(CROSS_DOMAIN_MARKER) do
             Shared.cross_domain_invoke_policy_yaml(stack.cross_domain_targets, Regexp.last_match(1))
           end
           text = with_pii_distribution(text, stack) if stack.pii_detected
@@ -74,7 +79,7 @@ module Hecks
             use_oac: !stack.web_handler_present && !stack.rust_web,
             geo_restriction_type: stack.geo_restriction_type, geo_restriction_countries: stack.geo_restriction_countries
           )
-          text.sub(/^Outputs:\n/) do
+          text.sub(OUTPUTS_HEADING) do
             "#{resources}Outputs:\n  PiiDistributionDomainName:\n    Value: !GetAtt PiiDistribution.DomainName\n"
           end
         end

data/lib/hecks/projections/deploy/preview/containers.rb

@@ -18,6 +18,12 @@ module Hecks
           PATH_PATTERN = %r{\A/[A-Za-z0-9._~/*?%-]*\z}
           IMAGE_PATTERN = %r{\A[A-Za-z0-9._/:@-]+\z}
           ENV_NAME_PATTERN = /\A[A-Z_][A-Z0-9_]*\z/
+          # A run of characters a container name may not hold.
+          NOT_NAME_RUN = /[^a-z0-9]+/
+          # The characters before a name's first letter.
+          LEADING_NON_LETTERS = /\A[^a-z]+/
+          # The dashes a name ends with.
+          TRAILING_DASHES = /-+\z/
 
           module_function
 
@@ -35,10 +41,17 @@ module Hecks
           end
 
           def single(main)
-            name = main.fetch(:name).to_s.downcase.gsub(/[^a-z0-9]+/, "-").sub(/\A[^a-z]+/, "")[0, 30].sub(/-+\z/, "")
+            name = container_name(main.fetch(:name))
             { name: name, port: main.fetch(:port), host: true, default: true, image: main[:image] }
           end
 
+          # @param raw [Object] the main stack's name
+          # @return [String] the name as a container name: lower-case, dashed, at most 30 characters
+          def container_name(raw)
+            dashed = raw.to_s.downcase.gsub(NOT_NAME_RUN, "-")
+            dashed.sub(LEADING_NON_LETTERS, "")[0, 30].sub(TRAILING_DASHES, "")
+          end
+
           def normalize(item)
             raise ArgumentError, "preview container #{item.inspect} must be a Hash" unless item.is_a?(Hash)
 

data/lib/hecks/projections/deploy/preview/preview.sh.erb

@@ -281,7 +281,7 @@ cmd_deploy() {
 # preview's own database. The credential is a purpose-bound token minted from the
 # preview's session secret, so only someone with AWS access to the account can
 # sign anyone up. It needs a domain image whose host serves the signup route and
-# a domain that attaches the signups chapter; the warnings below say which is missing.
+# a domain that attaches the signups bluebook; the warnings below say which is missing.
 
 # Who becomes the preview's first admin: the person deploying it. PREVIEW_ADMIN_EMAIL
 # and PREVIEW_ADMIN_NAME override; the default is your git identity.
@@ -342,7 +342,7 @@ signup_admin() {
           echo "    already signed up"
         else
           warn "the domain refused the signup: $(cat "$response")"
-          warn "does this domain attach the signups chapter?"
+          warn "does this domain attach the signups bluebook?"
         fi
         rm -f "$response"; return 0 ;;
       302|404)

data/lib/hecks/projections/deploy/preview/routing_yaml.rb

@@ -48,14 +48,15 @@ module Hecks
 
           # The default action goes to the default container.
           def listener(settings)
-            TextTemplate.render("preview/listener.tmpl", default_logical: settings.default_container.logical).chomp
+            default = settings.default_container
+            TextTemplate.render("preview/listener.tmpl", default_logical: default.logical).chomp
           end
 
           def rule_specs(settings)
-            settings.containers.reject(&:default).select(&:routed?).flat_map do |c|
-              c.paths.each_slice(PATHS_PER_RULE).with_index.map do |slice, n|
-                { container: c, paths: slice, id: rule_id(c, n) }
-              end
+            routed = settings.containers.reject(&:default).select(&:routed?)
+            routed.flat_map do |c|
+              slices = c.paths.each_slice(PATHS_PER_RULE)
+              slices.with_index.map { |slice, n| { container: c, paths: slice, id: rule_id(c, n) } }
             end
           end
 
@@ -81,7 +82,8 @@ module Hecks
           end
 
           def service_load_balancers(settings)
-            settings.containers.select(&:routed?).map do |c|
+            routed = settings.containers.select(&:routed?)
+            routed.map do |c|
               "- ContainerName: #{c.name}\n  ContainerPort: #{c.port}\n  TargetGroupArn: !Ref #{c.logical}TargetGroup"
             end.join("\n")
           end

data/lib/hecks/projections/deploy/preview/settings.rb

@@ -21,6 +21,18 @@ module Hecks
           PATH_PATTERN = Containers::PATH_PATTERN
           COOKIE_PATTERN = /\A[A-Za-z0-9_.-]+\z/
           RETENTION_DAYS = [1, 3, 5, 7, 14, 30, 60, 90].freeze
+          # An image reference the database-init task may pull.
+          DB_INIT_IMAGE_PATTERN = %r{\A[A-Za-z0-9./:_@-]+\z}
+          # A run of characters a stack prefix may not hold.
+          NOT_PREFIX_RUN = /[^a-z0-9-]+/
+          # Any character an ALB prefix may not hold.
+          NOT_ALPHANUMERIC = /[^a-z0-9]/
+          # A run of characters a database prefix may not hold.
+          NOT_ALPHANUMERIC_RUN = /[^a-z0-9]+/
+          # The characters before a name's first letter.
+          LEADING_NON_LETTERS = Containers::LEADING_NON_LETTERS
+          # The underscores a database prefix ends with.
+          TRAILING_UNDERSCORES = /_+\z/
 
           attr_reader(*KEYS, :region, :stack_name, :infra_name, :main)
 
@@ -52,12 +64,14 @@ module Hecks
 
           def default_container = containers.find(&:default)
 
+          def host_port = host.port
+
           private
 
           def assign_names(raw, main)
-            prefix_default = "#{main.fetch(:stack_prefix)}-#{infra_name}-preview".downcase.gsub(/[^a-z0-9-]+/, "-")
+            prefix_default = "#{main.fetch(:stack_prefix)}-#{infra_name}-preview".downcase.gsub(NOT_PREFIX_RUN, "-")
             @prefix = pick(raw, :prefix, prefix_default, PREFIX_PATTERN)
-            @alb_prefix = pick(raw, :alb_prefix, "#{infra_name.downcase.gsub(/[^a-z0-9]/, "")[0, 8]}pv", ALB_PREFIX_PATTERN)
+            @alb_prefix = pick(raw, :alb_prefix, "#{infra_name.downcase.gsub(NOT_ALPHANUMERIC, "")[0, 8]}pv", ALB_PREFIX_PATTERN)
             assign_stacks(raw, main)
           end
 
@@ -69,12 +83,16 @@ module Hecks
           end
 
           def assign_database(raw, main)
-            db_default = infra_name.downcase.gsub(/[^a-z0-9]+/, "_").sub(/\A[^a-z]+/, "")[0, 30].sub(/_+\z/, "")
-            @db_prefix = pick(raw, :db_prefix, db_default, DB_PREFIX_PATTERN)
+            @db_prefix = pick(raw, :db_prefix, default_db_prefix, DB_PREFIX_PATTERN)
             extra = Array(raw[:protected_databases]).map(&:to_s)
             @protected_databases = ([main.fetch(:db_name).to_s.downcase, "postgres", "template0", "template1"] + extra).uniq
           end
 
+          def default_db_prefix
+            underscored = infra_name.downcase.gsub(NOT_ALPHANUMERIC_RUN, "_")
+            underscored.sub(LEADING_NON_LETTERS, "")[0, 30].sub(TRAILING_UNDERSCORES, "")
+          end
+
           def assign_sizing(raw, main)
             @cpu = Integer(raw.fetch(:cpu, main.fetch(:cpu)))
             @memory = Integer(raw.fetch(:memory, main.fetch(:memory)))
@@ -94,7 +112,7 @@ module Hecks
             @first_admin = raw.fetch(:first_admin, true) != false
             @signup_path = pick(raw, :signup_path, "/signups", PATH_PATTERN)
             @landing_path = pick(raw, :landing_path, "/", PATH_PATTERN)
-            @db_init_image = pick(raw, :db_init_image, DEFAULT_DB_INIT_IMAGE, %r{\A[A-Za-z0-9./:_@-]+\z})
+            @db_init_image = pick(raw, :db_init_image, DEFAULT_DB_INIT_IMAGE, DB_INIT_IMAGE_PATTERN)
           end
 
           def pick(raw, key, default, pattern)

data/lib/hecks/projections/deploy/preview/task_yaml.rb

@@ -83,7 +83,7 @@ module Hecks
           def host_serving(settings, main)
             {
               "HECKS_DOMAIN" => scalar(main.fetch(:domain)), "HECKS_ERA" => scalar("1"),
-              "PORT" => scalar(settings.host.port.to_s), "BIND" => scalar("0.0.0.0"),
+              "PORT" => scalar(settings.host_port.to_s), "BIND" => scalar("0.0.0.0"),
               "HECKS_SERVE_MODE" => scalar("1"), "HECKS_WEB" => scalar(main.fetch(:web))
             }
           end

data/lib/hecks/projections/deploy/preview/yaml_text.rb

@@ -38,7 +38,8 @@ module Hecks
           # @param name [String] the environment variable name
           # @return [String] the logical id, ending in `Secret`
           def secret_id(container, name)
-            stem = "#{container.logical}#{name.delete_suffix("_ARN").split("_").map(&:capitalize).join}"
+            words = name.delete_suffix("_ARN").split("_")
+            stem = "#{container.logical}#{words.map(&:capitalize).join}"
             stem.end_with?("Secret") ? stem : "#{stem}Secret"
           end
         end

data/lib/hecks/projections/deploy/scripts/settings.rb

@@ -16,6 +16,8 @@ module Hecks
           EDGE      = "edge".freeze
           SOURCE    = %r{\A[\w.@:/~-]+\z}
           MAKE_PATH = /\A[^\s#]+\z/
+          # An http(s) URL with no whitespace or shell-quoting characters.
+          PUBLIC_URL = %r{\Ahttps?://[^\s'"$`\\]+\z}
 
           DEFAULT_SOURCE = "https://github.com/heckslabs/hecks.git".freeze
           DEFAULT_CACHE_DIR = "$(HOME)/.cache/hecks".freeze
@@ -32,7 +34,7 @@ module Hecks
             read_hecks
             read_smoke
             @expected_eras = list(:expected_eras, []).each { |era| check(:expected_eras, era, ERA) }
-            @public_url = optional(:public_url, %r{\Ahttps?://[^\s'"$`\\]+\z})
+            @public_url = optional(:public_url, PUBLIC_URL)
           end
 
           private
@@ -40,7 +42,8 @@ module Hecks
           def read_ecs(plan)
             @cluster = check(:ecs_cluster, fetch(:ecs_cluster, plan.names.fetch(:cluster)), RESOURCE)
             @service = check(:ecs_service, fetch(:ecs_service, plan.names.fetch(:service)), RESOURCE)
-            @containers = plan.layout.all
+            layout = plan.layout
+            @containers = layout.all
           end
 
           def read_hecks

data/lib/hecks/projections/deploy/shared.rb

@@ -77,6 +77,16 @@ module Hecks
           end
         end
 
+        # Every domain a cross-domain policy targets, across every loaded bluebook, so an attached
+        # bluebook's policies count as well as the domain's own.
+        #
+        # @param registry [Hecks::Runtime::Registry] the registry holding the loaded bluebooks
+        # @return [Array<String>] the target domain names, sorted and without repeats
+        def cross_domain_targets(registry)
+          targets = registry.bluebooks.flat_map { |_name, declaration| declaration.policies.filter_map(&:target_domain) }
+          targets.uniq.sort
+        end
+
         # Renders one `lambda:InvokeFunction` IAM statement per `across:` target,
         # to append to the compute role's `Policies:` list.
         # An ARN for a not-yet-deployed function is valid IAM; the call just fails until then.
@@ -159,7 +169,8 @@ module Hecks
         def bastion_public_subnet(network)
           name = network.google_oauth_present ? "bastion_reuse_public" : "bastion_own_public"
           text = TextTemplate.render("shared/#{name}.tmpl", db_id: network.db_id)
-          text.each_line.with_index.map { |line, i| (i.zero? ? "" : "  ") + line }.join.rstrip
+          lines = text.each_line.with_index.map { |line, i| (i.zero? ? "" : "  ") + line }
+          lines.join.rstrip
         end
         private_class_method :bastion_public_subnet
       end

data/lib/hecks/projections/deploy/shared_database_instance.rb

@@ -27,7 +27,7 @@ module Hecks
 
         module_function
 
-        # @param bluebook [Bluebook::Behaviour::Chapter] the domain's own booted chapter
+        # @param bluebook [Bluebook::Behaviour::Bluebook] the domain's own booted bluebook
         # @param options [Hash] generation options; same shape as `Box.call`'s
         # @return [Hash{String => String}] the generated file contents, keyed by filename
         # @raise [ArgumentError] if the domain's deploy settings are invalid

data/lib/hecks/projections/deploy/smoke.rb

@@ -27,6 +27,8 @@ module Hecks
           setup:        /\A[^\r\n]+\z/
         }.freeze
         REQUIRED = %i[role_arn secret_id site_url region].freeze
+        # The template line that holds the setup step.
+        SETUP_LINE = /^@@setup@@\n/
 
         module_function
 
@@ -82,7 +84,7 @@ module Hecks
 
         # A placeholder line that resolves to nothing disappears whole, not as a blank line.
         def render(template, values)
-          filled = template.gsub(/^@@setup@@\n/) { setup_step(values[:setup]) }
+          filled = template.gsub(SETUP_LINE) { setup_step(values[:setup]) }
           filled = filled.gsub("@@secret_field_pipe@@") { secret_field_pipe(values[:secret_field]) }
           values.except(:setup, :secret_field).each { |key, value| filled = filled.gsub("@@#{key}@@") { value.to_s } }
           raise ArgumentError, "unfilled placeholder in the smoke workflow" if filled.include?("@@")

data/lib/hecks/projections/deploy/template_diff/normalizer.rb

@@ -8,6 +8,9 @@ module Hecks
         module Normalizer
           module_function
 
+          # A `!Sub` string that is one whole variable, `${Name}` or `${A.B}`, capturing its name.
+          WHOLE_VARIABLE = /\A\$\{([^}!]+)\}\z/
+
           # @param value [Object] a loaded template, or any node inside one
           # @return [Object] the same shape with every node in its canonical spelling
           def normalize(value)
@@ -40,7 +43,7 @@ module Hecks
             text = hash["Fn::Sub"]
             return text unless text.include?("${")
 
-            match = text.match(/\A\$\{([^}!]+)\}\z/)
+            match = text.match(WHOLE_VARIABLE)
             return hash unless match
 
             intrinsic_for(match[1])