@deployfoundation/foundation-deploy 0.2.51 → 0.2.53

package/dist/chunk-pxhftba1.js

@@ -0,0 +1,336 @@
+import {
+  DEFAULT_RELEASE_BUCKET,
+  configuredKeyArn
+} from "./chunk-dz91avrb.js";
+
+// src/release/manifest.ts
+import { createHash } from "node:crypto";
+import { readFileSync, statSync } from "node:fs";
+import { z } from "zod";
+var RELEASE_VERSION_RE = /^v\d+\.\d+\.\d+$/;
+var Sha256 = z.string().regex(/^[0-9a-f]{64}$/, "must be a lowercase hex sha256");
+var ReleaseArtifactSchema = z.object({
+  key: z.string().min(1),
+  sha256: Sha256,
+  bytes: z.number().int().nonnegative()
+}).strict();
+var SIGNING_ALGORITHMS = [
+  "RSASSA_PSS_SHA_256",
+  "RSASSA_PSS_SHA_384",
+  "RSASSA_PSS_SHA_512",
+  "RSASSA_PKCS1_V1_5_SHA_256",
+  "RSASSA_PKCS1_V1_5_SHA_384",
+  "RSASSA_PKCS1_V1_5_SHA_512",
+  "ECDSA_SHA_256",
+  "ECDSA_SHA_384",
+  "ECDSA_SHA_512"
+];
+var ReleaseManifestSchema = z.object({
+  version: z.string().regex(RELEASE_VERSION_RE, "must be vMAJOR.MINOR.PATCH"),
+  gitCommit: z.string().regex(/^[0-9a-f]{40}$/, "must be a full commit sha"),
+  createdAt: z.string().datetime(),
+  agentImage: z.object({
+    repository: z.string().min(1),
+    tag: z.string().min(1),
+    digest: z.string().regex(/^sha256:[0-9a-f]{64}$/)
+  }).strict(),
+  lambda: z.record(ReleaseArtifactSchema),
+  skills: z.object({ key: z.string().min(1), sha256: Sha256 }).strict(),
+  signature: z.object({
+    kmsKeyArn: z.string().min(1),
+    algorithm: z.enum(SIGNING_ALGORITHMS),
+    value: z.string().min(1)
+  }).strict().optional()
+}).strict();
+function parseManifest(json) {
+  return ReleaseManifestSchema.parse(typeof json === "string" ? JSON.parse(json) : json);
+}
+function releasePrefix(version) {
+  return `releases/${version}`;
+}
+function manifestKey(version) {
+  return `${releasePrefix(version)}/manifest.json`;
+}
+function lambdaKey(version, id) {
+  return `${releasePrefix(version)}/lambda/${id}.zip`;
+}
+function skillsKey(version) {
+  return `${releasePrefix(version)}/skills.tar.gz`;
+}
+function sha256Hex(bytes) {
+  return createHash("sha256").update(bytes).digest("hex");
+}
+function sha256File(path) {
+  return sha256Hex(readFileSync(path));
+}
+function buildManifest(input) {
+  const lambda = {};
+  for (const [id, path] of Object.entries(input.lambda).sort(([a], [b]) => a < b ? -1 : 1))
+    lambda[id] = {
+      key: lambdaKey(input.version, id),
+      sha256: sha256File(path),
+      bytes: statSync(path).size
+    };
+  return parseManifest({
+    version: input.version,
+    gitCommit: input.gitCommit,
+    createdAt: input.createdAt ?? new Date().toISOString(),
+    agentImage: input.agentImage,
+    lambda,
+    skills: { key: skillsKey(input.version), sha256: sha256File(input.skills) }
+  });
+}
+function manifestSigningPayload(manifest) {
+  const { signature: _signature, ...unsigned } = manifest;
+  return new TextEncoder().encode(canonicalJson(unsigned));
+}
+function canonicalJson(value) {
+  if (value === null || typeof value !== "object")
+    return JSON.stringify(value) ?? "null";
+  if (Array.isArray(value))
+    return `[${value.map(canonicalJson).join(",")}]`;
+  const entries = Object.entries(value).filter(([, v]) => v !== undefined).sort(([a], [b]) => a < b ? -1 : a > b ? 1 : 0);
+  return `{${entries.map(([k, v]) => `${JSON.stringify(k)}:${canonicalJson(v)}`).join(",")}}`;
+}
+async function verifyManifest(manifest, options) {
+  const parsed = parseManifest(manifest);
+  if (options.expectVersion !== undefined && parsed.version !== options.expectVersion)
+    throw new Error(`release manifest is ${parsed.version}, not the requested ${options.expectVersion}`);
+  const signature = parsed.signature;
+  if (signature === undefined)
+    throw new Error(`release ${parsed.version} carries an unsigned manifest; refusing to deploy`);
+  if (signature.kmsKeyArn !== options.kmsKeyArn)
+    throw new Error(`release ${parsed.version} is signed by ${signature.kmsKeyArn}, not the expected ${options.kmsKeyArn}`);
+  const result = await options.kms.verify({
+    KeyId: options.kmsKeyArn,
+    Message: manifestSigningPayload(parsed),
+    MessageType: "RAW",
+    Signature: Uint8Array.from(Buffer.from(signature.value, "base64")),
+    SigningAlgorithm: signature.algorithm
+  });
+  if (result.SignatureValid !== true)
+    throw new Error(`release ${parsed.version}: KMS rejected the manifest signature`);
+  const readArtifact = options.readArtifact;
+  if (readArtifact === undefined)
+    return parsed;
+  for (const [id, artifact] of Object.entries(parsed.lambda)) {
+    const bytes = await readArtifact(artifact.key);
+    if (bytes.byteLength !== artifact.bytes)
+      throw new Error(`release ${parsed.version}: ${id} is ${bytes.byteLength} bytes, manifest says ${artifact.bytes}`);
+    assertDigest(`${parsed.version}: ${id}`, bytes, artifact.sha256);
+  }
+  assertDigest(`${parsed.version}: skills`, await readArtifact(parsed.skills.key), parsed.skills.sha256);
+  return parsed;
+}
+function assertDigest(what, bytes, expected) {
+  const actual = sha256Hex(bytes);
+  if (actual !== expected)
+    throw new Error(`release ${what}: sha256 ${actual}, manifest says ${expected}`);
+}
+
+// src/lambda-bundle-context.ts
+import { copyFileSync, cpSync, lstatSync, mkdtempSync, rmSync } from "node:fs";
+import { tmpdir } from "node:os";
+import * as path from "node:path";
+var contextByRoot = new Map;
+var IGNORED_DIRECTORIES = {
+  ".git": true,
+  "cdk.out": true,
+  dist: true,
+  node_modules: true
+};
+var WORKSPACE_FILES = ["package.json", "bun.lock", "bunfig.toml", "tsconfig.json"];
+function copySourceTree(source, destination) {
+  cpSync(source, destination, {
+    recursive: true,
+    filter(candidate) {
+      const relative2 = path.relative(source, candidate);
+      if (relative2 === "")
+        return true;
+      if (relative2.split(path.sep).some((component) => (component in IGNORED_DIRECTORIES)))
+        return false;
+      if (lstatSync(candidate).isSymbolicLink())
+        throw new Error(`Lambda bundle input contains a symlink: ${candidate}`);
+      return true;
+    }
+  });
+}
+function lambdaBundleContext(workspaceRoot) {
+  const existing = contextByRoot.get(workspaceRoot);
+  if (existing !== undefined)
+    return existing;
+  const context = mkdtempSync(path.join(tmpdir(), "foundation-lambda-bundle-"));
+  try {
+    for (const file of WORKSPACE_FILES)
+      copyFileSync(path.join(workspaceRoot, file), path.join(context, file));
+    copySourceTree(path.join(workspaceRoot, "packages"), path.join(context, "packages"));
+  } catch (error) {
+    rmSync(context, { recursive: true, force: true });
+    throw error;
+  }
+  contextByRoot.set(workspaceRoot, context);
+  return context;
+}
+
+// src/artifacts.ts
+import { spawnSync } from "node:child_process";
+import { readFileSync as readFileSync2 } from "node:fs";
+import { tmpdir as tmpdir2 } from "node:os";
+import { dirname, isAbsolute, join as join2, resolve } from "node:path";
+import { fileURLToPath } from "node:url";
+import * as cdk from "aws-cdk-lib";
+import * as lambda from "aws-cdk-lib/aws-lambda";
+import * as s3 from "aws-cdk-lib/aws-s3";
+var BUN_VERSION = "1.4.0";
+var WORKSPACE_ROOT = resolve(dirname(fileURLToPath(import.meta.url)), "..", "..", "..");
+var LAMBDA_ENTRY_POINTS = {
+  gateway: { entry: "packages/gateway/src/lambda.ts" },
+  invoker: { entry: "packages/gateway/src/invoker.ts" },
+  "email-proxy": { entry: "packages/capability-email/src/proxy/handler.ts" },
+  "google-docs-proxy": { entry: "packages/capability-google-docs/src/proxy/handler.ts" },
+  "otter-proxy": { entry: "packages/capability-otter/src/proxy/handler.ts" },
+  "knock-proxy": { entry: "packages/capability-knock/src/proxy/handler.ts" },
+  "crm-proxy": { entry: "packages/capability-crm/src/proxy/handler.ts" },
+  "upwork-proxy": { entry: "packages/capability-upwork/src/proxy/handler.ts" },
+  "etrade-proxy": { entry: "packages/capability-etrade/src/proxy/handler.ts" },
+  "pages-api": { entry: "packages/capability-pages/src/proxy/handler.ts" },
+  "pages-auth": { entry: "packages/capability-pages/src/auth/lambda.ts" },
+  "browser-proxy": { entry: "packages/gateway/src/browser-proxy.ts", playwright: true },
+  "newsletter-public": { entry: "packages/newsletter/src/lambda-public.ts" },
+  "newsletter-campaign": { entry: "packages/newsletter/src/lambda-campaign.ts" },
+  "newsletter-ses-events": { entry: "packages/newsletter/src/lambda-ses-events.ts" }
+};
+function skipBundle(env = process.env) {
+  return env.FOUNDATION_SKIP_BUNDLE === "1";
+}
+var RELEASE_BUCKET_ENV = "FOUNDATION_RELEASE_BUCKET";
+var RELEASE_DIR_ENV = "FOUNDATION_RELEASE_DIR";
+function releaseCacheDir(version, env = process.env) {
+  const configured = env[RELEASE_DIR_ENV];
+  if (configured !== undefined && configured !== "")
+    return configured;
+  return join2(tmpdir2(), "foundation-release", version);
+}
+var manifestCache = new Map;
+function readManifestFile(path2) {
+  const absolute = isAbsolute(path2) ? path2 : resolve(process.cwd(), path2);
+  const cached = manifestCache.get(absolute);
+  if (cached !== undefined)
+    return cached;
+  let text;
+  try {
+    text = readFileSync2(absolute, "utf8");
+  } catch {
+    throw new Error(`no release manifest at ${absolute}`);
+  }
+  const manifest = parseManifest(text);
+  manifestCache.set(absolute, manifest);
+  return manifest;
+}
+function releaseSource(scope) {
+  const node = scope.node;
+  const version = node.tryGetContext("release");
+  const manifestPath = node.tryGetContext("releaseManifest");
+  if ((version === undefined || version === "") && (manifestPath === undefined || manifestPath === ""))
+    return;
+  const path2 = manifestPath !== undefined && manifestPath !== "" ? manifestPath : join2(releaseCacheDir(version), "manifest.json");
+  const manifest = readManifestFile(path2);
+  if (version !== undefined && version !== "" && manifest.version !== version)
+    throw new Error(`-c release=${version} but ${path2} describes ${manifest.version}; pass the manifest for the version you are deploying`);
+  const bucket = node.tryGetContext("releaseBucket") ?? process.env[RELEASE_BUCKET_ENV] ?? "";
+  if (bucket === "")
+    throw new Error(`-c releaseBucket=<name> is required when deploying a release (or set ${RELEASE_BUCKET_ENV}); it is the bucket holding ${manifest.lambda.gateway?.key ?? "the release artifacts"}`);
+  return { version: manifest.version, bucket, manifest };
+}
+function releaseAccess(scope, env = process.env) {
+  const context = scope.node.tryGetContext("releaseBucket");
+  const fromContext = typeof context === "string" && context !== "" ? context : undefined;
+  const fromEnv = env[RELEASE_BUCKET_ENV];
+  const bucket = fromContext ?? (fromEnv !== undefined && fromEnv !== "" ? fromEnv : DEFAULT_RELEASE_BUCKET);
+  const signingKeyArn = configuredKeyArn(env);
+  return { bucket, ...signingKeyArn === undefined ? {} : { signingKeyArn } };
+}
+function releaseBucket(scope, source) {
+  const stack = cdk.Stack.of(scope);
+  const existing = stack.node.tryFindChild("FoundationReleaseBucket");
+  if (existing !== undefined)
+    return existing;
+  return s3.Bucket.fromBucketName(stack, "FoundationReleaseBucket", source.bucket);
+}
+function lambdaCode(scope, id) {
+  const source = releaseSource(scope);
+  if (source !== undefined) {
+    const artifact2 = source.manifest.lambda[id];
+    if (artifact2 === undefined)
+      throw new Error(`release ${source.version} carries no Lambda bundle for "${id}"; it was built by an older Foundation`);
+    return lambda.Code.fromBucket(releaseBucket(scope, source), artifact2.key);
+  }
+  if (skipBundle())
+    return lambda.Code.fromInline("export const handler = async () => ({statusCode: 200});");
+  const artifact = LAMBDA_ENTRY_POINTS[id];
+  const bundleRoot = lambdaBundleContext(WORKSPACE_ROOT);
+  return lambda.Code.fromAsset(bundleRoot, {
+    exclude: ["**/node_modules", "**/dist", "cdk.out"],
+    bundling: {
+      image: cdk.DockerImage.fromRegistry(`oven/bun:${BUN_VERSION}`),
+      command: [
+        "bash",
+        "-c",
+        `cd /asset-input && bun install --frozen-lockfile && ${bunBuild(artifact, "/asset-output").join(" ")}`
+      ],
+      local: {
+        tryBundle(outputDir) {
+          const bun = process.env.BUN_BIN ?? `${process.env.HOME}/.bun/bin/bun`;
+          const [, ...args] = bunBuild(artifact, outputDir);
+          const result = spawnSync(bun, args, { cwd: WORKSPACE_ROOT, stdio: "inherit" });
+          if (result.error !== undefined)
+            return false;
+          return result.status === 0;
+        }
+      }
+    }
+  });
+}
+function bunBuild(artifact, outputDir) {
+  return [
+    "bun",
+    "build",
+    artifact.entry,
+    "--target=node",
+    "--format=esm",
+    ...artifact.playwright === true ? [
+      "--external",
+      "electron",
+      "--external",
+      "chromium-bidi",
+      `--outdir=${outputDir}`,
+      "--entry-naming=index.mjs"
+    ] : [`--outfile=${join2(outputDir, "index.mjs")}`]
+  ];
+}
+function agentImage(scope, repository, tag) {
+  const source = releaseSource(scope);
+  if (source !== undefined)
+    return `${source.manifest.agentImage.repository}@${source.manifest.agentImage.digest}`;
+  if (tag === undefined || tag === "")
+    throw new Error("agentImage: a tag is required outside release mode");
+  return `${repository.repositoryUri}:${tag}`;
+}
+function agentImageTagRequired(scope) {
+  return releaseSource(scope) === undefined;
+}
+function releaseImageRepositoryArn(scope) {
+  const source = releaseSource(scope);
+  if (source === undefined)
+    return;
+  return ecrRepositoryArn(source.manifest.agentImage.repository);
+}
+function ecrRepositoryArn(repositoryUri) {
+  const match = /^(\d{12})\.dkr\.ecr\.([a-z0-9-]+)\.amazonaws\.com\/(.+)$/.exec(repositoryUri);
+  if (match === null)
+    throw new Error(`not an ECR repository URI: ${repositoryUri} (expected <account>.dkr.ecr.<region>.amazonaws.com/<name>)`);
+  const [, account, region, name] = match;
+  return `arn:aws:ecr:${region}:${account}:repository/${name}`;
+}
+
+export { RELEASE_VERSION_RE, parseManifest, manifestKey, lambdaKey, skillsKey, buildManifest, manifestSigningPayload, verifyManifest, lambdaBundleContext, BUN_VERSION, LAMBDA_ENTRY_POINTS, skipBundle, RELEASE_BUCKET_ENV, RELEASE_DIR_ENV, releaseCacheDir, releaseSource, releaseAccess, lambdaCode, agentImage, agentImageTagRequired, releaseImageRepositoryArn, ecrRepositoryArn };