@continuous-excellence/ze-great-dashboard-aws 0.31.41 → 0.31.42

package/dist/bootstrap.d.ts

@@ -85,11 +85,31 @@ export type BootstrapConsistency = {
     ok: boolean;
     mismatches: string[];
 };
+export type CloudFormationTemplateDocument = {
+    Metadata?: {
+        PackageManagedParameters?: unknown;
+    };
+    Outputs?: Record<string, {
+        Value?: unknown;
+    }>;
+    Parameters?: Record<string, {
+        Default?: unknown;
+    }>;
+    Resources?: Record<string, {
+        Type?: unknown;
+    }>;
+};
 export declare function requireComputeMode(persisted: Pick<BootstrapConfig, 'mode'>, explicit?: string): ComputeMode;
 export declare function bootstrapTemplatePath(kind: BootstrapKind, mode?: ComputeMode): Promise<string>;
 export declare function bootstrapTemplate(kind: BootstrapKind, mode?: ComputeMode): Promise<string>;
 /** Resolves the package-owned identity intended for a manifest at the selected compute mode. */
 export declare function installedBootstrapDesiredState(config?: Pick<BootstrapConfig, 'mode'>): Promise<BootstrapDesiredState>;
+/**
+ * Reads the structural portions of a CloudFormation YAML template that this package owns.
+ * CloudFormation's short-form intrinsic tags are intentionally opaque here: this package only
+ * inspects scalar metadata and declarations, and does not evaluate a template.
+ */
+export declare function parseCloudFormationTemplate(template: string): CloudFormationTemplateDocument;
 export declare function bootstrapContractVersion(template: string): string;
 export declare function bootstrapTemplateRevision(template: string): string;
 /** Returns installed templates and a reviewable, non-secret plan without external calls. */

package/dist/cli.js

@@ -4,17 +4,16 @@
 import { execFile as execFile2 } from "node:child_process";
 import { readFile as readFile7, writeFile as writeFile4 } from "node:fs/promises";
 import { promisify as promisify2 } from "node:util";
-import { parse as parse2 } from "yaml";
 
 // packages/aws/src/doctor.ts
 import { execFile } from "node:child_process";
 import { readFile as readFile6 } from "node:fs/promises";
 import { promisify } from "node:util";
-import { parse } from "yaml";
 
 // packages/aws/src/bootstrap.ts
 import { readFile as readFile3 } from "node:fs/promises";
 import { fileURLToPath } from "node:url";
+import { parseDocument } from "yaml";
 
 // packages/aws/src/compute-mode.ts
 function valid(value2, label) {
@@ -1225,35 +1224,60 @@ async function installedTemplateInspections(mode) {
     })
   );
 }
+function parseCloudFormationTemplate(template) {
+  const document = parseDocument(template);
+  if (document.errors.length)
+    throw new Error(`Invalid CloudFormation template: ${document.errors[0]}`);
+  const parsed = document.toJS();
+  if (!parsed || typeof parsed !== "object" || Array.isArray(parsed))
+    throw new Error("CloudFormation template must contain a YAML object");
+  return parsed;
+}
+function outputValue(template, name) {
+  const value2 = parseCloudFormationTemplate(template).Outputs?.[name]?.Value;
+  return typeof value2 === "string" ? value2 : void 0;
+}
 function bootstrapContractVersion(template) {
-  const version = template.match(/BootstrapContractVersion:\s*\{\s*Value:\s*'([^']+)'\s*}/)?.[1];
+  const version = outputValue(template, "BootstrapContractVersion");
   if (!version) throw new Error("Bootstrap template has no BootstrapContractVersion output");
   return version;
 }
 function bootstrapTemplateRevision(template) {
-  const revision = template.match(/BootstrapTemplateRevision:\s*\{\s*Value:\s*'([^']+)'\s*}/)?.[1];
+  const revision = outputValue(template, "BootstrapTemplateRevision");
   if (!revision) throw new Error("Bootstrap template has no BootstrapTemplateRevision output");
   return revision;
 }
-function templateRevisionIfPresent(template) {
-  return template.match(/BootstrapTemplateRevision:\s*\{\s*Value:\s*'([^']+)'\s*}/)?.[1];
-}
 function inspectTemplate(kind, path, template) {
-  const resourcesBlock = template.match(/^Resources:\n([\s\S]*?)(?=^[A-Za-z][A-Za-z0-9]*:\s*$)/m)?.[1] ?? "";
-  const resources = [
-    ...resourcesBlock.matchAll(/^ {2}([A-Za-z][A-Za-z0-9]+):\n {4}Type: ([^\n]+)$/gm)
-  ].map((match) => ({ logicalId: match[1], type: match[2] }));
-  const iamActions = [...template.matchAll(/^\s+Action: (?:\[([^\]]+)\]|([^\n]+))$/gm)].flatMap(([, list, scalar]) => (list ?? scalar ?? "").split(",").map((action) => action.trim())).filter(Boolean);
+  const document = parseCloudFormationTemplate(template);
+  const contractVersion = document.Outputs?.BootstrapContractVersion?.Value;
+  if (typeof contractVersion !== "string" || !contractVersion)
+    throw new Error("Bootstrap template has no BootstrapContractVersion output");
+  const resources = Object.entries(document.Resources ?? {}).flatMap(
+    ([logicalId, resource]) => typeof resource?.Type === "string" ? [{ logicalId, type: resource.Type }] : []
+  );
+  const iamActions = declaredIamActions(document.Resources);
   return {
     kind,
     path,
-    contractVersion: bootstrapContractVersion(template),
-    templateRevision: templateRevisionIfPresent(template),
+    contractVersion,
+    templateRevision: typeof document.Outputs?.BootstrapTemplateRevision?.Value === "string" ? document.Outputs.BootstrapTemplateRevision.Value : void 0,
     sha256: sha256(template),
     resources,
     iamActions: [...new Set(iamActions)]
   };
 }
+function declaredIamActions(value2) {
+  if (Array.isArray(value2)) return value2.flatMap(declaredIamActions);
+  if (!value2 || typeof value2 !== "object") return [];
+  const record = value2;
+  const actions = actionValues(record.Action);
+  return [...actions, ...Object.values(record).flatMap(declaredIamActions)];
+}
+function actionValues(value2) {
+  if (typeof value2 === "string") return [value2];
+  if (Array.isArray(value2)) return value2.flatMap(actionValues);
+  return [];
+}
 async function bootstrapPlan(config) {
   const packageManifest = JSON.parse(
     await readFile3(new URL("../package.json", import.meta.url), "utf8")
@@ -2150,7 +2174,7 @@ function zipSync(data, opts) {
 }
 
 // packages/aws/src/index.ts
-import { parseDocument, Scalar } from "yaml";
+import { parseDocument as parseDocument2, Scalar } from "yaml";
 
 // packages/aws/src/bootstrap-check.ts
 function formatBootstrapCheckText(result) {
@@ -3249,7 +3273,7 @@ function requireImageDigest(image) {
   return image;
 }
 function deploymentTemplate(template, values) {
-  const document = parseDocument(template);
+  const document = parseDocument2(template);
   if (document.errors.length)
     throw new Error(`Invalid CloudFormation template: ${document.errors[0]}`);
   const managedValue = document.toJS().Metadata?.PackageManagedParameters;
@@ -3414,16 +3438,9 @@ async function templateContract(parameters) {
     parameters.map((item) => [item.ParameterKey, item.ParameterValue])
   );
   const mode = computeMode({ mode: values.ComputeMode });
-  const template = await cloudFormationTemplate(mode);
-  const parametersBlock = template.match(
-    /^Parameters:\n[\s\S]*?(?=^[A-Za-z][A-Za-z0-9]*:\s*$)/m
-  )?.[0];
-  const metadataBlock = template.match(/^Metadata:\n[\s\S]*?(?=^Parameters:\s*$)/m)?.[0];
-  if (!parametersBlock) throw new Error("template has no Parameters block");
-  const parsedParameters = parse(parametersBlock);
-  const parsedMetadata = metadataBlock ? parse(metadataBlock) : {};
-  const definitions = parsedParameters.Parameters ?? {};
-  const managedValue = parsedMetadata.Metadata?.PackageManagedParameters ?? [];
+  const template = parseCloudFormationTemplate(await cloudFormationTemplate(mode));
+  const definitions = template.Parameters ?? {};
+  const managedValue = template.Metadata?.PackageManagedParameters ?? [];
   if (!Array.isArray(managedValue) || !managedValue.every((key) => typeof key === "string"))
     throw new Error("template has invalid PackageManagedParameters metadata");
   const managed = new Set(managedValue);
@@ -3677,24 +3694,20 @@ var preflightRunner = {
   }
 };
 async function templateParameters(mode = "lambda") {
-  const template = await cloudFormationTemplate(mode);
-  const block = template.match(/^Parameters:\n[\s\S]*?(?=^[A-Za-z][A-Za-z0-9]*:\s*$)/m)?.[0];
-  if (!block) throw new Error("Unable to read Parameters from the CloudFormation template");
-  const parsed = parse2(block);
-  if (!parsed.Parameters) throw new Error("CloudFormation template has no Parameters");
-  const metadataBlock = template.match(/^Metadata:\n[\s\S]*?(?=^Parameters:\s*$)/m)?.[0];
-  const metadata = metadataBlock ? parse2(metadataBlock).Metadata ?? {} : {};
+  const template = parseCloudFormationTemplate(await cloudFormationTemplate(mode));
+  if (!template.Parameters) throw new Error("CloudFormation template has no Parameters");
+  const metadata = template.Metadata ?? {};
   if (metadata.PackageManagedParameters !== void 0 && (!Array.isArray(metadata.PackageManagedParameters) || !metadata.PackageManagedParameters.every((key) => typeof key === "string")))
     throw new Error("CloudFormation template has invalid PackageManagedParameters metadata");
   const packageManaged = new Set(metadata.PackageManagedParameters ?? []);
   const unknownManaged = [...packageManaged].filter(
-    (key) => !Object.hasOwn(parsed.Parameters ?? {}, key)
+    (key) => !Object.hasOwn(template.Parameters ?? {}, key)
   );
   if (unknownManaged.length)
     throw new Error(
       `CloudFormation template has unknown package-managed parameters: ${unknownManaged.join(", ")}`
     );
-  return { definitions: parsed.Parameters, packageManaged };
+  return { definitions: template.Parameters, packageManaged };
 }
 function validateConsumerParameters(supplied, template) {
   const values = Object.fromEntries(

package/dist/index.d.ts

@@ -1,5 +1,5 @@
 import type { ComputeMode } from './bootstrap.js';
-export { type BootstrapConfig, type BootstrapConsistency, type BootstrapDesiredState, type BootstrapDesiredStateComparison, type BootstrapKind, type BootstrapPlan, type BootstrapTemplateInspection, bootstrapConsistency, bootstrapContractVersion, bootstrapPlan, bootstrapTemplate, bootstrapTemplatePath, bootstrapTemplateRevision, type CloudFormationParameterValue, type ComputeMode, computeMode, coreBootstrapOutputs, type DeployedBootstrapStack, deployedBootstrapStack, installedBootstrapDesiredState, mergeBootstrapParameters, requireComputeMode, requiredBootstrapParameters, resolveComputeMode, } from './bootstrap.js';
+export { type BootstrapConfig, type BootstrapConsistency, type BootstrapDesiredState, type BootstrapDesiredStateComparison, type BootstrapKind, type BootstrapPlan, type BootstrapTemplateInspection, bootstrapConsistency, bootstrapContractVersion, bootstrapPlan, bootstrapTemplate, bootstrapTemplatePath, bootstrapTemplateRevision, type CloudFormationParameterValue, type CloudFormationTemplateDocument, type ComputeMode, computeMode, coreBootstrapOutputs, type DeployedBootstrapStack, deployedBootstrapStack, installedBootstrapDesiredState, mergeBootstrapParameters, parseCloudFormationTemplate, requireComputeMode, requiredBootstrapParameters, resolveComputeMode, } from './bootstrap.js';
 export { type BootstrapCheck, type BootstrapCheckDependencies, type BootstrapResourceDifference, type BootstrapResourceDrift, type BootstrapResourceDriftResult, type BootstrapStackCheck, checkBootstrap, formatBootstrapCheckText, } from './bootstrap-check.js';
 export { type BootstrapCheckStatus, type BootstrapGuideReport, type BootstrapInitInput, type BootstrapManifestUpgrade, type BootstrapPreflight, type BootstrapPreflightCheck, bootstrapGuide, bootstrapGuideReport, bootstrapPreflight, scaffoldBootstrapManifest, upgradeBootstrapManifest, } from './guided.js';
 export { type BootstrapHandoff, type BootstrapPhase, type BootstrapProvider, type BootstrapVerification, bootstrapHandoff, type CommandRunner, githubOidcProvider, verifyBootstrap, } from './handoff.js';

package/dist/index.js

@@ -720,7 +720,7 @@ function zipSync(data, opts) {
 }
 
 // packages/aws/src/index.ts
-import { parseDocument, Scalar } from "yaml";
+import { parseDocument as parseDocument2, Scalar } from "yaml";
 
 // packages/aws/src/release.ts
 import { createHash } from "node:crypto";
@@ -1757,6 +1757,7 @@ function sha256(value2) {
 // packages/aws/src/bootstrap.ts
 import { readFile as readFile3 } from "node:fs/promises";
 import { fileURLToPath } from "node:url";
+import { parseDocument } from "yaml";
 
 // packages/aws/src/compute-mode.ts
 function valid(value2, label) {
@@ -1935,35 +1936,60 @@ async function installedTemplateInspections(mode) {
     })
   );
 }
+function parseCloudFormationTemplate(template) {
+  const document = parseDocument(template);
+  if (document.errors.length)
+    throw new Error(`Invalid CloudFormation template: ${document.errors[0]}`);
+  const parsed = document.toJS();
+  if (!parsed || typeof parsed !== "object" || Array.isArray(parsed))
+    throw new Error("CloudFormation template must contain a YAML object");
+  return parsed;
+}
+function outputValue(template, name) {
+  const value2 = parseCloudFormationTemplate(template).Outputs?.[name]?.Value;
+  return typeof value2 === "string" ? value2 : void 0;
+}
 function bootstrapContractVersion(template) {
-  const version = template.match(/BootstrapContractVersion:\s*\{\s*Value:\s*'([^']+)'\s*}/)?.[1];
+  const version = outputValue(template, "BootstrapContractVersion");
   if (!version) throw new Error("Bootstrap template has no BootstrapContractVersion output");
   return version;
 }
 function bootstrapTemplateRevision(template) {
-  const revision = template.match(/BootstrapTemplateRevision:\s*\{\s*Value:\s*'([^']+)'\s*}/)?.[1];
+  const revision = outputValue(template, "BootstrapTemplateRevision");
   if (!revision) throw new Error("Bootstrap template has no BootstrapTemplateRevision output");
   return revision;
 }
-function templateRevisionIfPresent(template) {
-  return template.match(/BootstrapTemplateRevision:\s*\{\s*Value:\s*'([^']+)'\s*}/)?.[1];
-}
 function inspectTemplate(kind, path, template) {
-  const resourcesBlock = template.match(/^Resources:\n([\s\S]*?)(?=^[A-Za-z][A-Za-z0-9]*:\s*$)/m)?.[1] ?? "";
-  const resources = [
-    ...resourcesBlock.matchAll(/^ {2}([A-Za-z][A-Za-z0-9]+):\n {4}Type: ([^\n]+)$/gm)
-  ].map((match) => ({ logicalId: match[1], type: match[2] }));
-  const iamActions = [...template.matchAll(/^\s+Action: (?:\[([^\]]+)\]|([^\n]+))$/gm)].flatMap(([, list, scalar]) => (list ?? scalar ?? "").split(",").map((action) => action.trim())).filter(Boolean);
+  const document = parseCloudFormationTemplate(template);
+  const contractVersion = document.Outputs?.BootstrapContractVersion?.Value;
+  if (typeof contractVersion !== "string" || !contractVersion)
+    throw new Error("Bootstrap template has no BootstrapContractVersion output");
+  const resources = Object.entries(document.Resources ?? {}).flatMap(
+    ([logicalId, resource]) => typeof resource?.Type === "string" ? [{ logicalId, type: resource.Type }] : []
+  );
+  const iamActions = declaredIamActions(document.Resources);
   return {
     kind,
     path,
-    contractVersion: bootstrapContractVersion(template),
-    templateRevision: templateRevisionIfPresent(template),
+    contractVersion,
+    templateRevision: typeof document.Outputs?.BootstrapTemplateRevision?.Value === "string" ? document.Outputs.BootstrapTemplateRevision.Value : void 0,
     sha256: sha256(template),
     resources,
     iamActions: [...new Set(iamActions)]
   };
 }
+function declaredIamActions(value2) {
+  if (Array.isArray(value2)) return value2.flatMap(declaredIamActions);
+  if (!value2 || typeof value2 !== "object") return [];
+  const record = value2;
+  const actions = actionValues(record.Action);
+  return [...actions, ...Object.values(record).flatMap(declaredIamActions)];
+}
+function actionValues(value2) {
+  if (typeof value2 === "string") return [value2];
+  if (Array.isArray(value2)) return value2.flatMap(actionValues);
+  return [];
+}
 async function bootstrapPlan(config) {
   const packageManifest = JSON.parse(
     await readFile3(new URL("../package.json", import.meta.url), "utf8")
@@ -3238,7 +3264,7 @@ function requireImageDigest(image) {
   return image;
 }
 function deploymentTemplate(template, values) {
-  const document = parseDocument(template);
+  const document = parseDocument2(template);
   if (document.errors.length)
     throw new Error(`Invalid CloudFormation template: ${document.errors[0]}`);
   const managedValue = document.toJS().Metadata?.PackageManagedParameters;
@@ -3398,6 +3424,7 @@ export {
   mergeBootstrapParameters,
   packageEcs,
   packageLambda,
+  parseCloudFormationTemplate,
   requireComputeMode,
   requiredBootstrapParameters,
   resolveComputeMode,

package/dist/lambda.mjs

@@ -1889,12 +1889,14 @@ var init_schemaLogFilter = __esm({
 });
 
 // node_modules/@smithy/core/dist-es/submodules/client/smithy-client/command.js
-var import_types2, Command, ClassBuilder;
+var import_types2, operationEventStreamMarker, Command, ClassBuilder;
 var init_command = __esm({
   "node_modules/@smithy/core/dist-es/submodules/client/smithy-client/command.js"() {
     import_types2 = __toESM(require_dist_cjs());
     init_MiddlewareStack();
     init_schemaLogFilter();
+    init_schema();
+    operationEventStreamMarker = /* @__PURE__ */ Symbol.for("@smithy/op-event-stream");
     Command = class {
       middlewareStack = constructStack();
       schema;
@@ -1928,9 +1930,20 @@ var init_command = __esm({
           requestOptions = { ...requestOptions };
           delete requestOptions.metricsRecorder;
         }
-        if (smithyContext.eventStream) {
+        let isEventStream;
+        const schema = this.schema;
+        const marker = schema?.[operationEventStreamMarker];
+        if (marker !== void 0) {
+          isEventStream = marker;
+        } else if (schema) {
+          if (Array.isArray(schema) && schema[0] === 9) {
+            const [, , , , input$, output$] = schema;
+            isEventStream = schema[operationEventStreamMarker] = Boolean(NormalizedSchema.of(input$).getEventStreamMember() || NormalizedSchema.of(output$).getEventStreamMember());
+          }
+        }
+        if (isEventStream) {
           requestOptions = {
-            isEventStream: true,
+            isEventStream,
             ...requestOptions
           };
         }
@@ -7908,7 +7921,7 @@ var init_Int64 = __esm({
 });
 
 // node_modules/@smithy/core/dist-es/submodules/event-streams/eventstream-codec/HeaderMarshaller.js
-var HeaderMarshaller, HEADER_VALUE_TYPE, BOOLEAN_TAG, BYTE_TAG, SHORT_TAG, INT_TAG, LONG_TAG, BINARY_TAG, STRING_TAG, TIMESTAMP_TAG, UUID_TAG, UUID_PATTERN;
+var HeaderMarshaller, HEADER_VALUE_TYPE, BOOLEAN_TAG, BYTE_TAG, SHORT_TAG, INT_TAG, LONG_TAG, BINARY_TAG, STRING_TAG, TIMESTAMP_TAG, UUID_TAG, UUID_PATTERN, MAX_HEADER_VALUE_BYTES;
 var init_HeaderMarshaller = __esm({
   "node_modules/@smithy/core/dist-es/submodules/event-streams/eventstream-codec/HeaderMarshaller.js"() {
     init_transport();
@@ -7927,6 +7940,9 @@ var init_HeaderMarshaller = __esm({
           if (!hasOwn(headers, headerName))
             continue;
           const bytes = this.fromUtf8(headerName);
+          if (bytes.byteLength > 255) {
+            throw new Error(`@smithy/core/event-streams - header name exceeds 255 bytes: ${bytes.byteLength}`);
+          }
           chunks.push(Uint8Array.from([bytes.byteLength]), bytes, this.formatHeaderValue(headers[headerName]));
         }
         const out = new Uint8Array(chunks.reduce((carry, bytes) => carry + bytes.byteLength, 0));
@@ -7959,6 +7975,9 @@ var init_HeaderMarshaller = __esm({
             longBytes.set(header.value.bytes, 1);
             return longBytes;
           case "binary":
+            if (header.value.byteLength > MAX_HEADER_VALUE_BYTES) {
+              throw new Error(`@smithy/core/event-streams - header value (binary) exceeds ${MAX_HEADER_VALUE_BYTES} bytes: ${header.value.byteLength}`);
+            }
             const binView = new DataView(new ArrayBuffer(3 + header.value.byteLength));
             binView.setUint8(0, 6);
             binView.setUint16(1, header.value.byteLength, false);
@@ -7967,6 +7986,9 @@ var init_HeaderMarshaller = __esm({
             return binBytes;
           case "string":
             const utf8Bytes = this.fromUtf8(header.value);
+            if (utf8Bytes.byteLength > MAX_HEADER_VALUE_BYTES) {
+              throw new Error(`@smithy/core/event-streams - header value (string) exceeds ${MAX_HEADER_VALUE_BYTES} bytes: ${utf8Bytes.byteLength}`);
+            }
             const strView = new DataView(new ArrayBuffer(3 + utf8Bytes.byteLength));
             strView.setUint8(0, 7);
             strView.setUint16(1, utf8Bytes.byteLength, false);
@@ -8097,6 +8119,7 @@ var init_HeaderMarshaller = __esm({
     TIMESTAMP_TAG = "timestamp";
     UUID_TAG = "uuid";
     UUID_PATTERN = /^[a-f0-9]{8}-[a-f0-9]{4}-[a-f0-9]{4}-[a-f0-9]{4}-[a-f0-9]{12}$/;
+    MAX_HEADER_VALUE_BYTES = 32767;
   }
 });
 
@@ -10811,9 +10834,9 @@ var init_JsonShapeSerializer2 = __esm({
         this.i = i5;
       }
       writeJsonString(s2) {
-        this.ensure(s2.length * 3 + 2);
-        this.json[this.i++] = QUOTE;
         const z2 = s2.length;
+        this.ensure(z2 * 3 + 2);
+        this.json[this.i++] = QUOTE;
         for (let j5 = 0; j5 < z2; ++j5) {
           const c5 = s2.charCodeAt(j5);
           if (c5 > 34 && c5 < 92) {
@@ -10821,7 +10844,7 @@ var init_JsonShapeSerializer2 = __esm({
           } else if (c5 < 128) {
             const esc2 = ESCAPE_TABLE[c5];
             if (esc2 !== null) {
-              this.ensure(esc2.length + 1);
+              this.ensure(esc2.length + 1 + (z2 - j5 - 1) * 3 + 1);
               this.json[this.i++] = BACKSLASH;
               for (let k5 = 0; k5 < esc2.length; k5++) {
                 this.json[this.i++] = esc2.charCodeAt(k5);
@@ -10837,11 +10860,11 @@ var init_JsonShapeSerializer2 = __esm({
               this.i += written;
               ++j5;
             } else {
-              this.ensure(6);
+              this.ensure(6 + (z2 - j5 - 1) * 3 + 1);
               this.writeUnicodeEscape(c5);
             }
           } else if (c5 >= 56320 && c5 <= 57343) {
-            this.ensure(6);
+            this.ensure(6 + (z2 - j5 - 1) * 3 + 1);
             this.writeUnicodeEscape(c5);
           } else {
             let { i: i5, json: json2 } = this;
@@ -17925,7 +17948,7 @@ var init_package = __esm({
   "node_modules/@aws-sdk/nested-clients/package.json"() {
     package_default = {
       name: "@aws-sdk/nested-clients",
-      version: "3.997.49",
+      version: "3.997.50",
       description: "Nested clients for AWS SDK packages.",
       homepage: "https://github.com/aws/aws-sdk-js-v3/tree/main/packages/nested-clients",
       license: "Apache-2.0",
@@ -18025,10 +18048,10 @@ var init_package = __esm({
         "test:watch": "yarn g:vitest watch"
       },
       dependencies: {
-        "@aws-sdk/core": "^3.978.4",
-        "@aws-sdk/signature-v4-multi-region": "^3.996.48",
-        "@aws-sdk/types": "^3.974.6",
-        "@smithy/core": "^3.36.0",
+        "@aws-sdk/core": "^3.978.5",
+        "@aws-sdk/signature-v4-multi-region": "^3.996.49",
+        "@aws-sdk/types": "^3.975.0",
+        "@smithy/core": "^3.36.1",
         "@smithy/fetch-http-handler": "^5.8.0",
         "@smithy/node-http-handler": "^4.12.1",
         "@smithy/types": "^4.19.0",
@@ -26418,7 +26441,7 @@ var require_dist_cjs16 = __commonJS({
       Region: { type: "builtInParams", name: "region" },
       UseDualStack: { type: "builtInParams", name: "useDualstackEndpoint" }
     };
-    var version2 = "3.1153.0";
+    var version2 = "3.1155.0";
     var packageInfo = {
       version: version2
     };
@@ -28209,7 +28232,7 @@ var require_dist_cjs17 = __commonJS({
       Region: { type: "builtInParams", name: "region" },
       UseDualStack: { type: "builtInParams", name: "useDualstackEndpoint" }
     };
-    var version2 = "3.1153.0";
+    var version2 = "3.1155.0";
     var packageInfo = {
       version: version2
     };

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@continuous-excellence/ze-great-dashboard-aws",
-  "version": "0.31.41",
+  "version": "0.31.42",
   "type": "module",
   "description": "AWS server runtime and CloudFormation deployment tooling for Ze Great Dashboard.",
   "keywords": [

package/template-ecs.yml

@@ -1,4 +1,4 @@
-AWSTemplateFormatVersion: '2010-09-09'
+AWSTemplateFormatVersion: "2010-09-09"
 Description: Ze Great Dashboard ECS/Fargate application (consumer-owned network and ingress)
 
 Metadata:
@@ -13,14 +13,14 @@ Parameters:
   Subnets: { Type: List<AWS::EC2::Subnet::Id> }
   SecurityGroups: { Type: List<AWS::EC2::SecurityGroup::Id> }
   DesiredCount: { Type: Number, Default: 1, MinValue: 1 }
-  Cpu: { Type: String, Default: '256' }
-  Memory: { Type: String, Default: '512' }
+  Cpu: { Type: String, Default: "256" }
+  Memory: { Type: String, Default: "512" }
   ContainerPort: { Type: Number, Default: 3000 }
   LogRetentionInDays: { Type: Number, Default: 14, MinValue: 1 }
-  SecretReference: { Type: String, Default: '' }
+  SecretReference: { Type: String, Default: "" }
 
 Conditions:
-  HasSecretReference: !Not [!Equals [!Ref SecretReference, '']]
+  HasSecretReference: !Not [!Equals [!Ref SecretReference, ""]]
 
 Resources:
   Cluster:
@@ -28,36 +28,68 @@ Resources:
     Properties: { ClusterName: !Ref Name }
   LogGroup:
     Type: AWS::Logs::LogGroup
-    Properties: { LogGroupName: !Sub '/aws/ecs/${Name}', RetentionInDays: !Ref LogRetentionInDays }
+    Properties: { LogGroupName: !Sub "/aws/ecs/${Name}", RetentionInDays: !Ref LogRetentionInDays }
   ExecutionRole:
     Type: AWS::IAM::Role
     Properties:
-      RoleName: !Sub '${Name}-execution'
-      AssumeRolePolicyDocument: { Version: '2012-10-17', Statement: [{ Effect: Allow, Principal: { Service: ecs-tasks.amazonaws.com }, Action: sts:AssumeRole }] }
+      RoleName: !Sub "${Name}-execution"
+      AssumeRolePolicyDocument:
+        {
+          Version: "2012-10-17",
+          Statement:
+            [
+              {
+                Effect: Allow,
+                Principal: { Service: ecs-tasks.amazonaws.com },
+                Action: sts:AssumeRole,
+              },
+            ],
+        }
       ManagedPolicyArns: [arn:aws:iam::aws:policy/service-role/AmazonECSTaskExecutionRolePolicy]
   TaskRole:
     Type: AWS::IAM::Role
     Properties:
-      RoleName: !Sub '${Name}-task'
-      AssumeRolePolicyDocument: { Version: '2012-10-17', Statement: [{ Effect: Allow, Principal: { Service: ecs-tasks.amazonaws.com }, Action: sts:AssumeRole }] }
+      RoleName: !Sub "${Name}-task"
+      AssumeRolePolicyDocument:
+        {
+          Version: "2012-10-17",
+          Statement:
+            [
+              {
+                Effect: Allow,
+                Principal: { Service: ecs-tasks.amazonaws.com },
+                Action: sts:AssumeRole,
+              },
+            ],
+        }
       Policies:
         - PolicyName: read-consumer-credentials
           PolicyDocument:
-            Version: '2012-10-17'
+            Version: "2012-10-17"
             Statement:
               - Effect: Allow
                 Action: [secretsmanager:DescribeSecret, secretsmanager:GetSecretValue]
-                Resource: !If [HasSecretReference, !Ref SecretReference, !Sub 'arn:${AWS::Partition}:secretsmanager:${AWS::Region}:${AWS::AccountId}:secret:ze-great-dashboard-no-secret-configured']
+                Resource:
+                  !If [
+                    HasSecretReference,
+                    !Ref SecretReference,
+                    !Sub "arn:${AWS::Partition}:secretsmanager:${AWS::Region}:${AWS::AccountId}:secret:ze-great-dashboard-no-secret-configured",
+                  ]
               - Effect: Allow
                 Action: ssm:GetParameter
-                Resource: !If [HasSecretReference, !Ref SecretReference, !Sub 'arn:${AWS::Partition}:ssm:${AWS::Region}:${AWS::AccountId}:parameter/ze-great-dashboard-no-credential-configured']
+                Resource:
+                  !If [
+                    HasSecretReference,
+                    !Ref SecretReference,
+                    !Sub "arn:${AWS::Partition}:ssm:${AWS::Region}:${AWS::AccountId}:parameter/ze-great-dashboard-no-credential-configured",
+                  ]
               - Effect: Allow
                 Action: kms:Decrypt
-                Resource: '*'
+                Resource: "*"
                 Condition:
                   StringEquals:
-                    'kms:ViaService': !Sub 'ssm.${AWS::Region}.amazonaws.com'
-                    'kms:EncryptionContext:PARAMETER_ARN': !Ref SecretReference
+                    "kms:ViaService": !Sub "ssm.${AWS::Region}.amazonaws.com"
+                    "kms:EncryptionContext:PARAMETER_ARN": !Ref SecretReference
   TaskDefinition:
     Type: AWS::ECS::TaskDefinition
     Properties:
@@ -77,10 +109,26 @@ Resources:
             - { Name: ASSET_PATH, Value: !Ref AssetPath }
             - { Name: BOARD_CONFIG_URL, Value: !Ref BoardConfigPath }
             - { Name: HOST, Value: 0.0.0.0 }
-            - { Name: PORT, Value: '3000' }
-            - { Name: SECRET_REFERENCE, Value: !If [HasSecretReference, !Ref SecretReference, ''] }
-          LogConfiguration: { LogDriver: awslogs, Options: { awslogs-group: !Ref LogGroup, awslogs-region: !Ref AWS::Region, awslogs-stream-prefix: dashboard } }
-          HealthCheck: { Command: [CMD-SHELL, 'node /app/docker-healthcheck.mjs'], Interval: 30, Timeout: 5, Retries: 3, StartPeriod: 20 }
+            - { Name: PORT, Value: "3000" }
+            - { Name: SECRET_REFERENCE, Value: !If [HasSecretReference, !Ref SecretReference, ""] }
+          LogConfiguration:
+            {
+              LogDriver: awslogs,
+              Options:
+                {
+                  awslogs-group: !Ref LogGroup,
+                  awslogs-region: !Ref AWS::Region,
+                  awslogs-stream-prefix: dashboard,
+                },
+            }
+          HealthCheck:
+            {
+              Command: [CMD-SHELL, "node /app/docker-healthcheck.mjs"],
+              Interval: 30,
+              Timeout: 5,
+              Retries: 3,
+              StartPeriod: 20,
+            }
   Service:
     Type: AWS::ECS::Service
     DependsOn: LogGroup
@@ -90,7 +138,15 @@ Resources:
       DesiredCount: !Ref DesiredCount
       LaunchType: FARGATE
       TaskDefinition: !Ref TaskDefinition
-      NetworkConfiguration: { AwsvpcConfiguration: { AssignPublicIp: DISABLED, Subnets: !Ref Subnets, SecurityGroups: !Ref SecurityGroups } }
+      NetworkConfiguration:
+        {
+          AwsvpcConfiguration:
+            {
+              AssignPublicIp: DISABLED,
+              Subnets: !Ref Subnets,
+              SecurityGroups: !Ref SecurityGroups,
+            },
+        }
 
 Outputs:
   ComputeMode: { Value: !Ref ComputeMode }