@deployfoundation/foundation-deploy 0.1.0

package/dist/chunk-v7tz8g50.js

@@ -0,0 +1,428 @@
+import {
+  RELEASE_BUCKET_ENV,
+  RELEASE_VERSION_RE,
+  instanceNames,
+  loadInstanceFile,
+  manifestKey,
+  releaseCacheDir,
+  verifyManifest
+} from "./chunk-9ddxyvq2.js";
+
+// src/deploy/release.ts
+import { existsSync as existsSync2, mkdirSync, readFileSync as readFileSync2 } from "node:fs";
+import { dirname as dirname3, isAbsolute, join as join2, resolve as resolve2 } from "node:path";
+
+// src/release/kms.ts
+import { KMSClient, SignCommand, VerifyCommand } from "@aws-sdk/client-kms";
+function regionOfKeyArn(keyArn) {
+  const region = keyArn.split(":")[3];
+  if (region === undefined || region === "")
+    throw new Error(`not a KMS key ARN: ${keyArn} (expected arn:aws:kms:<region>:<account>:key/…)`);
+  return region;
+}
+function client(keyArn, options = {}) {
+  const profile = options.profile ?? "";
+  return new KMSClient({
+    region: regionOfKeyArn(keyArn),
+    ...profile === "" ? {} : { profile }
+  });
+}
+function kmsVerifier(keyArn, options = {}) {
+  const kms = client(keyArn, options);
+  return {
+    async verify(input) {
+      const result = await kms.send(new VerifyCommand(input));
+      return {
+        ...result.SignatureValid === undefined ? {} : { SignatureValid: result.SignatureValid }
+      };
+    }
+  };
+}
+
+// src/deploy/aws.ts
+import { mkdtempSync, rmSync, writeFileSync } from "node:fs";
+import { tmpdir } from "node:os";
+import { join } from "node:path";
+
+// src/deploy/instance.ts
+import { dirname } from "node:path";
+var INSTANCE_FILE_ENV = "FOUNDATION_INSTANCE_FILE";
+function resolveInstanceFilePath(argv = [], env = {}) {
+  for (let i = 0;i < argv.length; i++) {
+    const arg = argv[i] ?? "";
+    if (arg === "--instance") {
+      const next = argv[i + 1];
+      if (next === undefined || next.startsWith("-"))
+        throw new Error("--instance needs a path, e.g. --instance .foundation/instance.yaml");
+      return next;
+    }
+    if (arg.startsWith("--instance=")) {
+      const value = arg.slice("--instance=".length);
+      if (value === "")
+        throw new Error("--instance needs a path");
+      return value;
+    }
+  }
+  const fromEnv = env[INSTANCE_FILE_ENV];
+  if (fromEnv !== undefined && fromEnv !== "")
+    return fromEnv;
+  throw new Error(`--instance <path> is required (or set ${INSTANCE_FILE_ENV}); it is the path to the deployment's instance YAML`);
+}
+function loadInstanceContext(path, cwd = process.cwd()) {
+  const file = loadInstanceFile(path, cwd);
+  return { ...file, root: dirname(file.path) };
+}
+function loadInstanceFromArgs(argv = process.argv.slice(2), env = process.env) {
+  return loadInstanceContext(resolveInstanceFilePath(argv, env));
+}
+function instanceBanner(context) {
+  const { instance } = context;
+  return `instance: ${instance.name} (account ${instance.aws.account}, region ${instance.aws.region})
+  file: ${context.path}
+  config: ${context.configPath}`;
+}
+
+// src/deploy/sh.ts
+function formatCommand(cmd, env) {
+  const prefix = Object.entries(env ?? {}).map(([k, v]) => `${k}=${quote(v)}`).join(" ");
+  const body = cmd.map(quote).join(" ");
+  return prefix === "" ? body : `${prefix} ${body}`;
+}
+function quote(value) {
+  return /^[A-Za-z0-9_@%+=:,./-]+$/.test(value) ? value : `'${value.replaceAll("'", `'\\''`)}'`;
+}
+function spawn(cmd, opts, stdout) {
+  const [bin, ...rest] = cmd;
+  if (bin === undefined)
+    throw new Error("run: empty command");
+  return Bun.spawn([bin, ...rest], {
+    cwd: opts.cwd,
+    env: { ...process.env, ...opts.env },
+    stdin: opts.stdin === undefined ? "ignore" : "pipe",
+    stdout,
+    stderr: stdout === "inherit" ? "inherit" : "pipe"
+  });
+}
+async function feed(proc, stdin) {
+  if (stdin === undefined)
+    return;
+  const sink = proc.stdin;
+  if (sink === null)
+    return;
+  sink.write(stdin);
+  sink.end();
+}
+async function run(cmd, opts = {}) {
+  if (opts.dryRun === true) {
+    console.log(`  $ ${formatCommand(cmd, opts.env)}`);
+    return;
+  }
+  const proc = spawn(cmd, opts, "inherit");
+  await feed(proc, opts.stdin);
+  const code = await proc.exited;
+  if (code !== 0)
+    throw new Error(`${formatCommand(cmd)} exited ${code}`);
+}
+async function runCapture(cmd, opts = {}) {
+  const proc = spawn(cmd, opts, "pipe");
+  await feed(proc, opts.stdin);
+  const [out, err, code] = await Promise.all([
+    new Response(proc.stdout).text(),
+    new Response(proc.stderr).text(),
+    proc.exited
+  ]);
+  if (code !== 0)
+    throw new Error(`${formatCommand(cmd)} exited ${code}: ${err.trim()}`);
+  return out.trim();
+}
+
+// src/deploy/aws.ts
+function resolveProfile(fallback, explicit, env = process.env) {
+  if (env.FOUNDATION_NO_PROFILE === "1")
+    return "";
+  if (explicit !== undefined)
+    return explicit;
+  if (env.AWS_PROFILE !== undefined && env.AWS_PROFILE !== "")
+    return env.AWS_PROFILE;
+  if (env.GITHUB_ACTIONS === "true")
+    return "";
+  return fallback;
+}
+function awsContext(overrides = {}) {
+  const env = overrides.env ?? process.env;
+  const paths = overrides.paths ?? loadInstanceFromArgs();
+  const instance = paths.instance;
+  return {
+    profile: resolveProfile(instance.aws.profile, overrides.profile, env),
+    region: overrides.region ?? env.AWS_REGION ?? instance.aws.region,
+    dryRun: overrides.dryRun ?? false,
+    instance,
+    paths,
+    names: instanceNames(instance)
+  };
+}
+function argv(ctx, args) {
+  const profile = ctx.profile === "" ? [] : ["--profile", ctx.profile];
+  return ["aws", ...args, ...profile, "--region", ctx.region];
+}
+function cdkEnv(ctx) {
+  return {
+    ...ctx.profile === "" ? {} : { AWS_PROFILE: ctx.profile },
+    AWS_REGION: ctx.region,
+    CDK_DEFAULT_REGION: ctx.region
+  };
+}
+async function aws(ctx, args, stdin) {
+  return runCapture(argv(ctx, args), { stdin });
+}
+async function awsMutate(ctx, args, stdin) {
+  if (ctx.dryRun === true) {
+    console.log(`  $ ${argv(ctx, args).join(" ")}${stdin === undefined ? "" : " < (stdin)"}`);
+    return;
+  }
+  await run(argv(ctx, args), { stdin });
+}
+async function stackOutput(ctx, stack, key) {
+  const value = await aws(ctx, [
+    "cloudformation",
+    "describe-stacks",
+    "--stack-name",
+    stack,
+    "--query",
+    `Stacks[0].Outputs[?OutputKey=='${key}'].OutputValue`,
+    "--output",
+    "text"
+  ]);
+  if (value === "" || value === "None")
+    throw new Error(`stack ${stack} has no output ${key} — has it been deployed?`);
+  return value;
+}
+async function stackExists(ctx, stack) {
+  try {
+    await aws(ctx, [
+      "cloudformation",
+      "describe-stacks",
+      "--stack-name",
+      stack,
+      "--output",
+      "text"
+    ]);
+    return true;
+  } catch {
+    return false;
+  }
+}
+async function secretExists(ctx, secretId) {
+  try {
+    await aws(ctx, [
+      "secretsmanager",
+      "describe-secret",
+      "--secret-id",
+      secretId,
+      "--output",
+      "text"
+    ]);
+    return true;
+  } catch {
+    return false;
+  }
+}
+async function readSecretString(ctx, secretId) {
+  return aws(ctx, [
+    "secretsmanager",
+    "get-secret-value",
+    "--secret-id",
+    secretId,
+    "--query",
+    "SecretString",
+    "--output",
+    "text"
+  ]);
+}
+async function readSecretJson(ctx, secretId) {
+  return JSON.parse(await readSecretString(ctx, secretId));
+}
+async function putSecretString(ctx, secretId, value) {
+  await throughSecretFile(value, (file) => awsMutate(ctx, [
+    "secretsmanager",
+    "put-secret-value",
+    "--secret-id",
+    secretId,
+    "--secret-string",
+    `file://${file}`
+  ]));
+}
+async function createSecretString(ctx, secretId, value, description) {
+  await throughSecretFile(value, (file) => awsMutate(ctx, [
+    "secretsmanager",
+    "create-secret",
+    "--name",
+    secretId,
+    "--description",
+    description,
+    "--secret-string",
+    `file://${file}`
+  ]));
+}
+async function throughSecretFile(value, body) {
+  const dir = mkdtempSync(join(tmpdir(), "foundation-secret-"));
+  const file = join(dir, "value.json");
+  try {
+    writeFileSync(file, value, { mode: 384 });
+    await body(file);
+  } finally {
+    rmSync(dir, { recursive: true, force: true });
+  }
+}
+async function putSecretJson(ctx, secretId, value) {
+  await putSecretString(ctx, secretId, JSON.stringify(value));
+}
+async function callerAccountId(ctx) {
+  return aws(ctx, ["sts", "get-caller-identity", "--query", "Account", "--output", "text"]);
+}
+
+// src/deploy/paths.ts
+import { existsSync, readFileSync } from "node:fs";
+import { dirname as dirname2, resolve } from "node:path";
+import { fileURLToPath } from "node:url";
+var PACKAGE_NAME = "@deployfoundation/foundation-deploy";
+function packageRoot(from) {
+  let dir = from;
+  for (;; ) {
+    const manifest = resolve(dir, "package.json");
+    if (existsSync(manifest)) {
+      try {
+        const { name } = JSON.parse(readFileSync(manifest, "utf8"));
+        if (name === PACKAGE_NAME)
+          return dir;
+      } catch {}
+    }
+    const parent = dirname2(dir);
+    if (parent === dir)
+      throw new Error(`cannot find the ${PACKAGE_NAME} package root above ${from}`);
+    dir = parent;
+  }
+}
+var INFRA_ROOT = packageRoot(dirname2(fileURLToPath(import.meta.url)));
+var FOUNDATION_ROOT = resolve(INFRA_ROOT, "..", "..");
+var AGENT_DOCKERFILE = "packages/infra/agent-image/Dockerfile";
+var PACKAGE_ASSETS = resolve(INFRA_ROOT, "src", "deploy", "assets");
+
+// src/deploy/release.ts
+var DEFAULT_RELEASE_BUCKET = "foundry41-foundation-releases";
+var RELEASE_KMS_KEY_ARN_ENV = "FOUNDATION_RELEASE_KMS_KEY_ARN";
+var RELEASE_KMS_KEY_ARN = "arn:aws:kms:us-east-1:793593623536:key/fba7d9f3-e9b6-49ae-b4a5-c8c5f1429231";
+function flag(args, name) {
+  const index = args.indexOf(name);
+  const value = index === -1 ? undefined : args[index + 1];
+  if (value?.startsWith("-") === true)
+    throw new Error(`${name} needs a value, e.g. ${name} ${name === "--release" ? "v0.1.0" : "…"}`);
+  const inline = args.find((arg) => arg.startsWith(`${name}=`));
+  return value ?? (inline === undefined ? undefined : inline.slice(name.length + 1));
+}
+function toolVersion(infraRoot = INFRA_ROOT) {
+  const { version } = JSON.parse(readFileSync2(join2(infraRoot, "package.json"), "utf8"));
+  return version;
+}
+function hasFoundationWorkspace(foundationRoot = FOUNDATION_ROOT) {
+  return existsSync2(join2(foundationRoot, "packages", "gateway", "package.json"));
+}
+function releaseRequest(args, options = {}) {
+  const env = options.env ?? process.env;
+  const bucket = flag(args, "--release-bucket") ?? env[RELEASE_BUCKET_ENV] ?? DEFAULT_RELEASE_BUCKET;
+  const manifestRef = flag(args, "--manifest");
+  const explicit = flag(args, "--release");
+  if (explicit !== undefined) {
+    if (!RELEASE_VERSION_RE.test(explicit))
+      throw new Error(`--release wants a version like v0.1.0, not "${explicit}"`);
+    return { version: explicit, bucket, ...manifestRef === undefined ? {} : { manifestRef } };
+  }
+  if (manifestRef !== undefined)
+    return { manifestRef, bucket };
+  const workspace = options.workspace ?? hasFoundationWorkspace();
+  if (workspace)
+    return;
+  const version = `v${options.version ?? toolVersion()}`;
+  if (!RELEASE_VERSION_RE.test(version))
+    throw new Error(`this copy of foundation-deploy is version ${version.slice(1)}, which is not a release; pass --release <version>`);
+  return { version, bucket };
+}
+function expectedKeyArn(env = process.env) {
+  const configured = env[RELEASE_KMS_KEY_ARN_ENV] ?? RELEASE_KMS_KEY_ARN;
+  if (configured === undefined || configured === "")
+    throw new Error(`no Foundation release signing key is configured; set ${RELEASE_KMS_KEY_ARN_ENV} to the key ARN published with the release`);
+  return configured;
+}
+async function s3Download(ctx, bucket, key, dest) {
+  mkdirSync(dirname3(dest), { recursive: true });
+  await aws(ctx, ["s3", "cp", `s3://${bucket}/${key}`, dest]);
+}
+async function verifyRelease(ctx, request, deps = {}) {
+  const env = deps.env ?? process.env;
+  const kmsKeyArn = deps.kmsKeyArn ?? expectedKeyArn(env);
+  const download = deps.download ?? s3Download;
+  const local = localManifestRef(request);
+  const version = request.version;
+  const cacheDir = deps.cacheDir ?? releaseCacheDir(version ?? "unversioned", env);
+  const manifestPath = local ?? join2(cacheDir, "manifest.json");
+  if (local === undefined) {
+    const source = s3ManifestRef(request);
+    await download(ctx, source.bucket, source.key, manifestPath);
+  }
+  const manifest = await verifyManifest(JSON.parse(readFileSync2(manifestPath, "utf8")), {
+    kmsKeyArn,
+    kms: deps.kms ?? kmsVerifier(kmsKeyArn, ctx.profile === "" ? {} : { profile: ctx.profile }),
+    ...version === undefined ? {} : { expectVersion: version },
+    ...deps.verifyArtifacts === false ? {} : {
+      readArtifact: async (key) => {
+        const dest = join2(cacheDir, "artifacts", key.split("/").slice(-1)[0] ?? "artifact");
+        await download(ctx, request.bucket, key, dest);
+        return readFileSync2(dest);
+      }
+    }
+  });
+  return { version: manifest.version, bucket: request.bucket, manifestPath, manifest };
+}
+async function resolveRelease(ctx, request, deps = {}) {
+  return ctx.dryRun === true ? plannedRelease(request) : verifyRelease(ctx, request, deps);
+}
+function plannedRelease(request) {
+  const version = request.version ?? "<from the manifest>";
+  const local = localManifestRef(request);
+  return {
+    version,
+    bucket: request.bucket,
+    manifestPath: local ?? join2(releaseCacheDir(version), "manifest.json")
+  };
+}
+function localManifestRef(request) {
+  const ref = request.manifestRef;
+  if (ref === undefined || ref.startsWith("s3://"))
+    return;
+  return isAbsolute(ref) ? ref : resolve2(process.cwd(), ref);
+}
+function s3ManifestRef(request) {
+  const ref = request.manifestRef;
+  if (ref?.startsWith("s3://") === true) {
+    const [bucket, ...rest] = ref.slice("s3://".length).split("/");
+    const key = rest.join("/");
+    if (bucket === undefined || bucket === "" || key === "")
+      throw new Error(`--manifest ${ref} is not an s3://bucket/key URI`);
+    return { bucket, key };
+  }
+  if (request.version === undefined)
+    throw new Error("a release needs a version or a manifest to fetch");
+  return { bucket: request.bucket, key: manifestKey(request.version) };
+}
+function releaseContext(release) {
+  return [
+    "-c",
+    `release=${release.version}`,
+    "-c",
+    `releaseManifest=${release.manifestPath}`,
+    "-c",
+    `releaseBucket=${release.bucket}`
+  ];
+}
+
+export { resolveInstanceFilePath, loadInstanceContext, instanceBanner, run, runCapture, awsContext, argv, cdkEnv, aws, awsMutate, stackOutput, stackExists, secretExists, readSecretString, readSecretJson, putSecretString, createSecretString, putSecretJson, callerAccountId, INFRA_ROOT, FOUNDATION_ROOT, AGENT_DOCKERFILE, PACKAGE_ASSETS, DEFAULT_RELEASE_BUCKET, toolVersion, releaseRequest, resolveRelease, releaseContext };

package/dist/src/index.js

@@ -0,0 +1,88 @@
+import {
+  BUILD_TIMEOUT,
+  DEFAULT_BUILDSPEC_PATH,
+  FoundationAgent,
+  FoundationApi,
+  FoundationCi,
+  FoundationData,
+  FoundationNetwork,
+  FoundationPipeline,
+  NewsletterStack,
+  deployStatements
+} from "../chunk-4aye5cee.js";
+import {
+  BUN_VERSION,
+  LAMBDA_ENTRY_POINTS,
+  LIVE_ENDPOINT_NAME,
+  RELEASE_BUCKET_ENV,
+  RELEASE_DIR_ENV,
+  WEB_SEARCH_CONNECTOR_VERSION,
+  WEB_SEARCH_TARGET,
+  adminsFor,
+  agentImage,
+  agentImageTagRequired,
+  buildManifest,
+  capabilityEnabled,
+  configPathFor,
+  ecrRepositoryArn,
+  enabledIntegrations,
+  instanceNames,
+  lambdaBundleContext,
+  lambdaCode,
+  lambdaKey,
+  loadInstanceFile,
+  manifestKey,
+  manifestSigningPayload,
+  parseManifest,
+  provisionsIntegration,
+  releaseCacheDir,
+  releaseImageRepositoryArn,
+  releaseSource,
+  requiresAuthenticatedQueue,
+  skillsKey,
+  skipBundle,
+  verifyManifest
+} from "../chunk-9ddxyvq2.js";
+export {
+  BUILD_TIMEOUT,
+  BUN_VERSION,
+  DEFAULT_BUILDSPEC_PATH,
+  FoundationAgent,
+  FoundationApi,
+  FoundationCi,
+  FoundationData,
+  FoundationNetwork,
+  FoundationPipeline,
+  LAMBDA_ENTRY_POINTS,
+  LIVE_ENDPOINT_NAME,
+  NewsletterStack,
+  RELEASE_BUCKET_ENV,
+  RELEASE_DIR_ENV,
+  WEB_SEARCH_CONNECTOR_VERSION,
+  WEB_SEARCH_TARGET,
+  adminsFor,
+  agentImage,
+  agentImageTagRequired,
+  buildManifest,
+  capabilityEnabled,
+  configPathFor,
+  deployStatements,
+  ecrRepositoryArn,
+  enabledIntegrations,
+  lambdaBundleContext,
+  lambdaCode,
+  lambdaKey,
+  loadInstanceFile,
+  manifestKey,
+  manifestSigningPayload,
+  instanceNames as namesFor,
+  parseManifest,
+  provisionsIntegration,
+  releaseCacheDir,
+  releaseImageRepositoryArn,
+  releaseSource,
+  requiresAuthenticatedQueue,
+  skillsKey,
+  skipBundle,
+  verifyManifest
+};

package/package.json

@@ -0,0 +1,38 @@
+{
+  "name": "@deployfoundation/foundation-deploy",
+  "version": "0.1.0",
+  "description": "Deploys one Foundation instance from a published, signed release: the CDK app and the deploy tool.",
+  "license": "UNLICENSED",
+  "private": false,
+  "type": "module",
+  "bin": {
+    "foundation-deploy": "./dist/bin/foundation-deploy.js"
+  },
+  "exports": {
+    ".": "./dist/src/index.js"
+  },
+  "files": [
+    "dist",
+    "src",
+    "agent-image",
+    "!agent-image/test",
+    "pipeline/buildspec.yml",
+    "cdk.json",
+    "README.md"
+  ],
+  "publishConfig": {
+    "access": "public"
+  },
+  "scripts": {
+    "build": "bun run scripts/build.ts",
+    "synth": "cdk synth --quiet"
+  },
+  "dependencies": {
+    "@aws-sdk/client-kms": "3.1111.0",
+    "aws-cdk": "2.1142.0",
+    "aws-cdk-lib": "2.270.0",
+    "constructs": "10.8.1",
+    "yaml": "2.9.0",
+    "zod": "3.24.1"
+  }
+}

package/pipeline/buildspec.yml

@@ -0,0 +1,34 @@
+# Reference buildspec for an instance's own CodePipeline.
+#
+# This file is NOT read from Foundation: CodeBuild reads it from the INSTANCE
+# repository the pipeline sources (`pipeline-stack.ts` names the path, default
+# `buildspec.yml` at that repo's root). An instance repo copies this once and
+# owns it from then on, because its build is its own.
+#
+# It is two lines because the instance repository builds nothing. The pinned
+# version in `foundation.version` IS the Foundation release: `npx` fetches the
+# deploy tool at that version, and the tool fetches the release's manifest,
+# verifies its signature and every artifact digest, and deploys the image and
+# bundles it names. No Foundation checkout, no Docker, no Bun.
+#
+# Everything that could differ between deployers — the AWS profile, which step
+# promotes `live` — is an environment variable the pipeline stack sets, not a
+# difference in the steps. `FOUNDATION_INSTANCE_FILE` is one of them, which is
+# why neither command passes `--instance`.
+#
+# `cdk deploy --all` inside `deploy` includes the pipeline stack, so a change
+# to the pipeline applies on the next run.
+version: 0.2
+
+phases:
+  install:
+    runtime-versions:
+      nodejs: 22
+
+  build:
+    commands:
+      # Verify the release, cdk deploy --all, runtime secret, config sync.
+      - npx --yes @deployfoundation/foundation-deploy@$(cat foundation.version) deploy
+      # Smoke DEFAULT, probe the persistent mount, promote `live`, smoke `live`.
+      # A failure here fails the build, and `live` keeps serving the old version.
+      - npx --yes @deployfoundation/foundation-deploy@$(cat foundation.version) post-deploy