@deployfoundation/foundation-deploy 0.2.51 → 0.2.52

package/dist/chunk-rxetj2p9.js

@@ -0,0 +1,466 @@
+import {
+  INTEGRATION_CAPABILITY_IDS,
+  PROACTIVE_CHANNEL_MODES,
+  SLACK_COMMAND_PREFIX_RE
+} from "./chunk-96fjaysn.js";
+
+// ../core/src/instance.ts
+import { parse as parseYaml } from "yaml";
+import { z } from "zod";
+var PENDING = "TBD";
+var CUSTOMIZATION_ARTIFACT_NAME = "Customization";
+var RawAws = z.object({
+  account: z.string().regex(/^\d{12}$/),
+  region: z.string().min(1),
+  profile: z.string().min(1),
+  alarmEmail: z.string().email().optional()
+}).strict();
+var RawSlack = z.object({
+  teamId: z.string().min(1).max(128),
+  appId: z.string().min(1).max(128),
+  commandPrefix: z.string().regex(SLACK_COMMAND_PREFIX_RE).optional(),
+  legacyCommandPrefixes: z.array(z.string().regex(SLACK_COMMAND_PREFIX_RE)).max(3).default([])
+}).strict();
+var REPO_RE = /^[^/\s]+\/[^/\s]+$/;
+var RawGithub = z.object({
+  org: z.string().min(1),
+  repo: z.string().regex(REPO_RE),
+  defaultRepo: z.string().regex(REPO_RE).optional(),
+  repoIds: z.object({ owner: z.number().int().positive(), repo: z.number().int().positive() }).strict(),
+  appId: z.union([z.number().int().positive(), z.literal(PENDING)]),
+  appSlug: z.union([z.string().regex(/^[a-z0-9][a-z0-9-]*$/), z.literal(PENDING)]),
+  workflowWriteRepos: z.array(z.string().regex(REPO_RE)).optional()
+}).strict();
+var RawDeploy = z.object({
+  via: z.enum(["github-actions", "codepipeline"]).default("github-actions"),
+  branch: z.string().min(1).default("main"),
+  connectionArn: z.string().regex(/^arn:aws:code(star-)?connections:[a-z0-9-]+:\d{12}:connection\/[0-9a-f-]+$/).optional()
+}).strict().superRefine((deploy, ctx) => {
+  if (deploy.via === "codepipeline" && deploy.connectionArn === undefined)
+    ctx.addIssue({
+      code: z.ZodIssueCode.custom,
+      path: ["connectionArn"],
+      message: "deploy.connectionArn is required when deploy.via is codepipeline"
+    });
+});
+var UNSAFE_GIT_BRANCH_CHAR_RE = /[\x00-\x20\x7f~^:?*\[\\]/;
+var UNSAFE_CUSTOMIZATION_PATH_CHAR_RE = /[\\\x00-\x1f\x7f]/;
+function safeGitBranch(value) {
+  return value !== "" && value !== "@" && !value.startsWith("-") && !value.startsWith("/") && !value.endsWith("/") && !value.endsWith(".") && !value.includes("..") && !value.includes("//") && !value.includes("@{") && !UNSAFE_GIT_BRANCH_CHAR_RE.test(value) && !value.split("/").some((component) => component.endsWith(".lock"));
+}
+function normalizedRelativePosixPath(value) {
+  return value !== "" && !value.startsWith("/") && !value.endsWith("/") && !value.includes("..") && !UNSAFE_CUSTOMIZATION_PATH_CHAR_RE.test(value) && value.split("/").every((component) => component !== "" && component !== ".");
+}
+var RawCustomization = z.object({
+  repository: z.string().regex(REPO_RE),
+  branch: z.string().refine(safeGitBranch, "customization.branch must be a safe Git branch name").default("main"),
+  path: z.string().refine(normalizedRelativePosixPath, "customization.path must be a normalized relative POSIX path"),
+  required: z.boolean().default(true)
+}).strict();
+var ProactiveChannelId = z.string().regex(/^[CG][A-Z0-9]{8,}$/);
+var RawProactiveChannel = z.union([
+  ProactiveChannelId.transform((id) => ({ id, mode: "triage" })),
+  z.object({ id: ProactiveChannelId, mode: z.enum(PROACTIVE_CHANNEL_MODES).default("triage") }).strict()
+]);
+var RawProactive = z.object({
+  channels: z.array(RawProactiveChannel).default([]).refine((channels) => new Set(channels.map((c) => c.id)).size === channels.length, {
+    message: "a channel may be listed only once"
+  }),
+  maxPerHour: z.number().int().min(1).max(500).default(20)
+}).strict().default({ channels: [] });
+var RawRuntime = z.object({
+  idleTimeoutMinutes: z.number().int().min(5).max(480).default(15),
+  maxLifetimeHours: z.number().int().min(1).max(8).default(8)
+}).strict().default({});
+var RawNetwork = z.object({
+  natGateways: z.union([z.literal(1), z.literal(2)]).default(1),
+  endpointAzs: z.union([z.literal(1), z.literal(2)]).default(1)
+}).strict().default({});
+var RawNaming = z.object({
+  prefix: z.string().min(1).max(32).regex(/^[A-Z][A-Za-z0-9]*$/),
+  secretPrefix: z.string().min(1).max(40).regex(/^[a-z][a-z0-9-]*$/),
+  runtimeName: z.string().regex(/^[a-zA-Z][a-zA-Z0-9_]{0,47}$/)
+}).strict();
+var INSTANCE_ID_RE = /^[a-z][a-z0-9-]*$/;
+var DOMAIN_RE = /^(?:[a-z0-9](?:[a-z0-9-]{0,61}[a-z0-9])?\.)+[a-z]{2,63}$/;
+var HOSTED_ZONE_ID_RE = /^Z[A-Z0-9]{1,32}$/;
+var MAILBOX_RE = /^[^<>\r\n]+ <[A-Z0-9._%+-]+@[A-Z0-9.-]+\.[A-Z]{2,}>$/i;
+function httpsOrigin(value) {
+  try {
+    const url = new URL(value);
+    return url.protocol === "https:" && url.username === "" && url.password === "" && url.pathname === "/" && url.search === "" && url.hash === "" && value === url.origin;
+  } catch {
+    return false;
+  }
+}
+function safeHttpsUrl(value) {
+  try {
+    const url = new URL(value);
+    return url.protocol === "https:" && url.username === "" && url.password === "";
+  } catch {
+    return false;
+  }
+}
+var RawNewsletterScope = z.object({
+  businessId: z.string().regex(INSTANCE_ID_RE),
+  newsletterId: z.string().regex(INSTANCE_ID_RE),
+  displayName: z.string().min(1).max(120),
+  consentVersion: z.string().regex(/^[A-Za-z0-9][A-Za-z0-9._-]{0,63}$/),
+  confirmationTtlHours: z.number().int().min(1).max(168).default(72)
+}).strict();
+var RawNewsletterDisabled = z.object({ enabled: z.literal(false) }).strict();
+var RawNewsletterEnabled = z.object({
+  enabled: z.literal(true),
+  hostedZoneId: z.string().regex(HOSTED_ZONE_ID_RE),
+  hostedZoneName: z.string().regex(DOMAIN_RE),
+  apiDomain: z.string().regex(DOMAIN_RE),
+  domainIdentity: z.string().regex(DOMAIN_RE),
+  allowedOrigins: z.array(z.string().refine(httpsOrigin, "must be an HTTPS origin")).min(1),
+  resultUrl: z.string().refine(safeHttpsUrl, "must be an HTTPS URL"),
+  sender: z.string().regex(MAILBOX_RE),
+  replyTo: z.string().email(),
+  scopes: z.array(RawNewsletterScope).min(1)
+}).strict().superRefine((newsletter, ctx) => {
+  const hostedZone = newsletter.hostedZoneName.toLowerCase();
+  const identity = newsletter.domainIdentity.toLowerCase();
+  if (hostedZone !== identity)
+    ctx.addIssue({
+      code: z.ZodIssueCode.custom,
+      path: ["domainIdentity"],
+      message: "newsletter.domainIdentity must equal newsletter.hostedZoneName"
+    });
+  if (newsletter.apiDomain.toLowerCase() !== hostedZone && !newsletter.apiDomain.toLowerCase().endsWith(`.${hostedZone}`))
+    ctx.addIssue({
+      code: z.ZodIssueCode.custom,
+      path: ["apiDomain"],
+      message: "newsletter.apiDomain must be inside newsletter.hostedZoneName"
+    });
+  let result;
+  try {
+    result = new URL(newsletter.resultUrl);
+  } catch {
+    return;
+  }
+  const tenantHost = result.hostname.toLowerCase();
+  if (tenantHost !== hostedZone && !tenantHost.endsWith(`.${hostedZone}`))
+    ctx.addIssue({
+      code: z.ZodIssueCode.custom,
+      path: ["resultUrl"],
+      message: "newsletter.resultUrl must stay inside newsletter.hostedZoneName"
+    });
+  if (!newsletter.allowedOrigins.includes(result.origin))
+    ctx.addIssue({
+      code: z.ZodIssueCode.custom,
+      path: ["resultUrl"],
+      message: "newsletter.resultUrl must belong to an allowed origin"
+    });
+  for (const [index, origin] of newsletter.allowedOrigins.entries()) {
+    let originUrl;
+    try {
+      originUrl = new URL(origin);
+    } catch {
+      continue;
+    }
+    const originHost = originUrl.hostname.toLowerCase();
+    if (originHost !== hostedZone && !originHost.endsWith(`.${hostedZone}`))
+      ctx.addIssue({
+        code: z.ZodIssueCode.custom,
+        path: ["allowedOrigins", index],
+        message: "newsletter.allowedOrigins must stay inside newsletter.hostedZoneName"
+      });
+  }
+  const senderEmail = /<([^>]+)>$/.exec(newsletter.sender)?.[1]?.toLowerCase();
+  if (senderEmail === undefined || !senderEmail.endsWith(`@${identity}`))
+    ctx.addIssue({
+      code: z.ZodIssueCode.custom,
+      path: ["sender"],
+      message: "newsletter.sender must use newsletter.domainIdentity"
+    });
+  const seen = new Set;
+  for (const [index, scope] of newsletter.scopes.entries()) {
+    const key = `${scope.businessId}/${scope.newsletterId}`;
+    if (seen.has(key))
+      ctx.addIssue({
+        code: z.ZodIssueCode.custom,
+        path: ["scopes", index],
+        message: `duplicate newsletter scope ${key}`
+      });
+    seen.add(key);
+  }
+});
+var RawNewsletter = z.union([RawNewsletterDisabled, RawNewsletterEnabled]).default({ enabled: false });
+var RawIntegrations = z.object({
+  otter: z.boolean().default(false),
+  browser: z.boolean().default(false),
+  knock: z.boolean().default(false),
+  upwork: z.boolean().default(false),
+  etrade: z.boolean().default(false),
+  pages: z.boolean().default(false),
+  crm: z.boolean().default(false),
+  crmStorage: z.boolean().optional()
+}).strict().default({}).transform((integrations) => ({
+  ...integrations,
+  crmStorage: integrations.crmStorage ?? integrations.crm
+}));
+var RawLicense = z.object({ key: z.string().min(1) }).strict();
+var PAGES_DOMAIN_RE = /^(?=.{1,253}$)(?:[a-z0-9](?:[a-z0-9-]{0,61}[a-z0-9])?\.)+[a-z]{2,63}$/;
+var RawPages = z.object({
+  domain: z.string().regex(PAGES_DOMAIN_RE, "pages.domain must be a lowercase host name without a scheme or path").optional(),
+  hostedZoneId: z.string().regex(HOSTED_ZONE_ID_RE, "pages.hostedZoneId must be a Route 53 hosted zone id (Z…)").optional()
+}).strict().superRefine((pages, ctx) => {
+  if (pages.hostedZoneId !== undefined && pages.domain === undefined)
+    ctx.addIssue({
+      code: z.ZodIssueCode.custom,
+      path: ["hostedZoneId"],
+      message: "pages.hostedZoneId needs pages.domain"
+    });
+}).default({});
+function crmHttpBaseUrl(value) {
+  if (value.includes("?") || value.includes("#"))
+    return false;
+  try {
+    const url = new URL(value);
+    return url.protocol === "https:" && url.username === "" && url.password === "" && url.search === "" && url.hash === "";
+  } catch {
+    return false;
+  }
+}
+var RawCrmProvider = z.discriminatedUnion("kind", [
+  z.object({ kind: z.literal("dynamodb") }).strict(),
+  z.object({
+    kind: z.literal("http"),
+    baseUrl: z.string().max(2048).refine(crmHttpBaseUrl, "crm.provider.baseUrl must be an HTTPS URL with no userinfo, query or fragment"),
+    expectedTenant: z.string().min(1).max(256).regex(/^[\x21-\x7e]+$/, "crm.provider.expectedTenant must be visible ASCII")
+  }).strict()
+]);
+var RawCrm = z.object({ provider: RawCrmProvider.default({ kind: "dynamodb" }) }).strict().default({});
+var RawInstance = z.object({
+  name: z.string().min(1).max(63).regex(/^[a-z][a-z0-9-]*$/),
+  displayName: z.string().min(1).max(120),
+  pending: z.boolean().default(false),
+  aws: RawAws,
+  slack: RawSlack,
+  github: RawGithub,
+  naming: RawNaming,
+  deploy: RawDeploy.default({}),
+  customization: RawCustomization.optional(),
+  license: RawLicense.optional(),
+  config: z.string().min(1),
+  proactive: RawProactive,
+  runtime: RawRuntime,
+  network: RawNetwork,
+  integrations: RawIntegrations,
+  newsletter: RawNewsletter,
+  pages: RawPages,
+  crm: RawCrm
+}).strict().superRefine((doc, ctx) => {
+  if (doc.crm.provider.kind === "http" && !doc.integrations.crm)
+    ctx.addIssue({
+      code: z.ZodIssueCode.custom,
+      path: ["crm", "provider"],
+      message: "crm.provider kind http needs integrations.crm: true"
+    });
+  if (doc.integrations.pages && doc.pages.domain === undefined)
+    ctx.addIssue({
+      code: z.ZodIssueCode.custom,
+      path: ["pages", "domain"],
+      message: "integrations.pages needs pages.domain: each page is served from its own subdomain of it (docs/pages.md)"
+    });
+  if (doc.pages.domain !== undefined && !doc.integrations.pages)
+    ctx.addIssue({
+      code: z.ZodIssueCode.custom,
+      path: ["pages", "domain"],
+      message: "pages.domain needs integrations.pages: true"
+    });
+  if (doc.customization !== undefined && doc.deploy.via !== "codepipeline")
+    ctx.addIssue({
+      code: z.ZodIssueCode.custom,
+      path: ["customization"],
+      message: "customization is only supported when deploy.via is codepipeline"
+    });
+  if (doc.pending)
+    return;
+  for (const [path, value] of [
+    [["slack", "teamId"], doc.slack.teamId],
+    [["slack", "appId"], doc.slack.appId],
+    [["github", "appId"], String(doc.github.appId)],
+    [["github", "appSlug"], doc.github.appSlug]
+  ]) {
+    if (value === PENDING)
+      ctx.addIssue({
+        code: z.ZodIssueCode.custom,
+        path: [...path],
+        message: `${path.join(".")} is still ${PENDING}; set it or mark the instance pending: true`
+      });
+  }
+});
+function parseInstance(yamlText) {
+  return RawInstance.parse(parseYaml(yamlText));
+}
+function newsletterManifestFor(instance) {
+  const newsletter = instance.newsletter;
+  if (!newsletter.enabled)
+    throw new Error(`newsletter is not enabled for instance ${instance.name}`);
+  return {
+    apiBaseUrl: `https://${newsletter.apiDomain}`,
+    allowedOrigins: [...newsletter.allowedOrigins],
+    scopes: newsletter.scopes.map((scope) => ({
+      businessId: scope.businessId,
+      newsletterId: scope.newsletterId,
+      displayName: scope.displayName,
+      consentVersion: scope.consentVersion,
+      confirmationTtlSeconds: scope.confirmationTtlHours * 60 * 60,
+      resultUrl: newsletter.resultUrl,
+      sender: newsletter.sender,
+      replyTo: newsletter.replyTo
+    }))
+  };
+}
+var FOUNDATION_VERSION_RE = /^v\d+\.\d+\.\d+(?:-[0-9A-Za-z.-]+)?$/;
+function versionedConfigKey(configKey, version) {
+  if (!FOUNDATION_VERSION_RE.test(version))
+    throw new Error(`not a Foundation version: "${version}" (expected one like v0.2.34)`);
+  return `config/${version}/${configKey.slice(configKey.lastIndexOf("/") + 1)}`;
+}
+function instanceNames(instance) {
+  const { prefix, secretPrefix, runtimeName } = instance.naming;
+  const stack = (suffix) => `${prefix}${suffix}`;
+  const secret = (suffix) => `${secretPrefix}/${suffix}`;
+  const [network, data, api, agent, newsletter, pages] = [
+    stack("Network"),
+    stack("Data"),
+    stack("Api"),
+    stack("Agent"),
+    stack("Newsletter"),
+    stack("Pages")
+  ];
+  return {
+    network,
+    data,
+    agent,
+    api,
+    ci: stack("Ci"),
+    newsletter,
+    pages,
+    pipeline: stack("Pipeline"),
+    allStacks: [
+      network,
+      data,
+      ...instance.integrations.pages ? [pages] : [],
+      api,
+      agent,
+      ...instance.newsletter.enabled ? [newsletter] : []
+    ],
+    secretSlackSigning: secret("slack/signing"),
+    secretSlackApp: secret("slack/app"),
+    secretGithubApp: secret("github/app"),
+    secretCodex: secret("openai/codex"),
+    secretGoogleAiStudio: secret("google/ai-studio"),
+    secretGoogleDrive: secret("google/drive"),
+    secretGoogleCalendar: secret("google/calendar"),
+    secretGoogleOauth: secret("google/oauth"),
+    secretGoogleEmail: secret("google/email"),
+    secretGoogleDocs: secret("google/docs"),
+    secretMongodbReadonly: secret("mongodb/readonly"),
+    secretOtterApi: secret("otter/api"),
+    secretKnockOauthClient: secret("knock/oauth-client"),
+    secretKnockCredential: secret("knock/credential"),
+    secretUpwork: secret("upwork/oauth"),
+    secretEtradeClient: secret("etrade/oauth-client"),
+    secretEtradeCredential: secret("etrade/credential"),
+    secretCrmHttp: secret("crm/http"),
+    secretRuntime: secret("agent/runtime"),
+    secretLicenseLastVerified: secret("license/last-verified"),
+    newsletterTokenSigningSecret: secret("newsletter/token-signing"),
+    newsletterKeyAlias: secret("newsletter"),
+    newsletterConfigurationSet: `${secretPrefix}-newsletter`,
+    newsletterCampaignOperatorRole: stack("NewsletterCampaignOperator"),
+    runtimeName,
+    ecrRepo: runtimeName.replaceAll("_", "-"),
+    keyAlias: secret("data"),
+    gatewayName: `${secretPrefix}-tools`,
+    slackGatewayFunctionName: stack("SlackGateway"),
+    routineGroup: `${secretPrefix}-routines`,
+    routineSchedulerRole: stack("RoutineScheduler"),
+    deployRole: stack("DeployRole"),
+    configKey: instance.config,
+    emailProxyFunctionName: stack("EmailProxy"),
+    googleDocsProxyFunctionName: stack("GoogleDocsProxy"),
+    otterProxyFunctionName: stack("OtterProxy"),
+    crmProxyFunctionName: stack("CrmProxy"),
+    pagesApiFunctionName: stack("PagesApi"),
+    secretPagesCookieKey: secret("pages/cookie-key"),
+    browserProxyFunctionName: stack("BrowserProxy"),
+    knockProxyFunctionName: stack("KnockProxy"),
+    upworkProxyFunctionName: stack("UpworkProxy"),
+    etradeProxyFunctionName: stack("EtradeProxy"),
+    defaultRepo: instance.github.defaultRepo ?? instance.github.repo
+  };
+}
+function slackCommandPrefix(instance) {
+  if (instance.slack.commandPrefix !== undefined)
+    return instance.slack.commandPrefix;
+  const derived = instance.displayName.toLowerCase().replace(/[^a-z0-9]+/g, "-").replace(/^-+|-+$/g, "").slice(0, 21).replace(/-+$/, "");
+  if (!SLACK_COMMAND_PREFIX_RE.test(derived))
+    throw new Error(`cannot derive a Slack command prefix from displayName "${instance.displayName}"; set slack.commandPrefix`);
+  return derived;
+}
+function slackCommandPrefixes(instance) {
+  return [slackCommandPrefix(instance), ...instance.slack.legacyCommandPrefixes];
+}
+
+// src/names.ts
+import { readFileSync } from "node:fs";
+import { dirname, isAbsolute, resolve } from "node:path";
+import { parse as parseYaml2 } from "yaml";
+function loadInstanceFile(path, cwd = process.cwd()) {
+  const absolute = isAbsolute(path) ? path : resolve(cwd, path);
+  let text;
+  try {
+    text = readFileSync(absolute, "utf8");
+  } catch {
+    throw new Error(`no instance file at ${absolute}`);
+  }
+  const instance = parseInstance(text);
+  return { instance, path: absolute, configPath: configPathFor(instance, absolute) };
+}
+function configPathFor(instance, instanceFilePath) {
+  return isAbsolute(instance.config) ? instance.config : resolve(dirname(instanceFilePath), instance.config);
+}
+function configDocument(configPath) {
+  const doc = parseYaml2(readFileSync(configPath, "utf8"));
+  return doc ?? {};
+}
+function capabilityEnabled(configPath, capability) {
+  const doc = configDocument(configPath);
+  const enabled = doc.capabilities?.[capability]?.enabled;
+  if (enabled !== undefined && typeof enabled !== "boolean")
+    throw new Error(`${configPath}: capabilities.${capability}.enabled must be a boolean`);
+  return enabled ?? false;
+}
+function requiresAuthenticatedQueue(instance) {
+  return enabledIntegrations(instance).length > 0;
+}
+function enabledIntegrations(instance) {
+  const integrations = instance.integrations;
+  return INTEGRATION_CAPABILITY_IDS.filter((id) => integrations[id] === true);
+}
+function provisionsIntegration(instance, id) {
+  if (!INTEGRATION_CAPABILITY_IDS.includes(id))
+    throw new Error(`${id} is not an integration capability in the registry`);
+  return instance.integrations[id] === true;
+}
+function adminsFor(configPath) {
+  const doc = configDocument(configPath);
+  const admins = doc.admins;
+  if (admins === undefined || admins === null)
+    return "";
+  if (!Array.isArray(admins) || admins.some((id) => typeof id !== "string"))
+    throw new Error(`${configPath}: admins must be a list of Slack user ids`);
+  return admins.join(",");
+}
+var WEB_SEARCH_TARGET = "websearch";
+var WEB_SEARCH_CONNECTOR_VERSION = "1.2.0";
+var LIVE_ENDPOINT_NAME = "live";
+
+export { CUSTOMIZATION_ARTIFACT_NAME, newsletterManifestFor, FOUNDATION_VERSION_RE, versionedConfigKey, instanceNames, slackCommandPrefix, slackCommandPrefixes, loadInstanceFile, configPathFor, capabilityEnabled, requiresAuthenticatedQueue, enabledIntegrations, provisionsIntegration, adminsFor, WEB_SEARCH_TARGET, WEB_SEARCH_CONNECTOR_VERSION, LIVE_ENDPOINT_NAME };