@lsts_tech/infra 1.0.0 → 1.0.2

package/scripts/ensure-pipelines.sh

@@ -4,7 +4,9 @@ set -euo pipefail
 # ensure-pipelines.sh
 #
 # AWS-only helper (v1.0.0) to ensure configured CodePipelines exist.
-# Missing pipelines are created by triggering an SST deploy for their mapped stage.
+# Missing pipelines are created by triggering an explicit production deploy with:
+#   INFRA_CREATE_PIPELINES=true
+#   INFRA_PIPELINES=<missing-stage>
 #
 # Usage:
 #   APPROVE=true bash scripts/ensure-pipelines.sh
@@ -25,47 +27,145 @@ if [ -z "$DOMAIN_ROOT" ]; then
   exit 1
 fi
 
+if ! command -v aws >/dev/null 2>&1; then
+  echo "aws CLI not found in PATH" >&2
+  exit 1
+fi
+
+if ! command -v node >/dev/null 2>&1; then
+  echo "node is required for parsing pipeline config" >&2
+  exit 1
+fi
+
 REGION=${AWS_REGION:-us-east-1}
 PIPELINE_PREFIX=${INFRA_PIPELINE_PREFIX:-myapp}
-PIPELINES_CSV=${INFRA_PIPELINES:-production,dev,mobile}
+PIPELINES_RAW=${INFRA_PIPELINES:-production,dev}
+PIPELINES_CONFIG_PATH=${INFRA_PIPELINES_CONFIG_PATH:-$INFRA_DIR/config/pipelines.json}
 REPO_DEFAULT=${INFRA_PIPELINE_REPO:-myorg/myrepo}
-BRANCH_PROD=${INFRA_PIPELINE_BRANCH_PROD:-main}
-BRANCH_DEV=${INFRA_PIPELINE_BRANCH_DEV:-develop}
-BRANCH_MOBILE=${INFRA_PIPELINE_BRANCH_MOBILE:-mobile}
+
+BRANCH_PROD_DEFAULT=${INFRA_PIPELINE_BRANCH_PROD:-main}
+BRANCH_DEV_DEFAULT=${INFRA_PIPELINE_BRANCH_DEV:-develop}
+BRANCH_MOBILE_DEFAULT=${INFRA_PIPELINE_BRANCH_MOBILE:-mobile}
+
+declare -A STAGE_ENABLED=(
+  [production]=false
+  [dev]=false
+  [mobile]=false
+)
+
+declare -A STAGE_BRANCH=(
+  [production]="$BRANCH_PROD_DEFAULT"
+  [dev]="$BRANCH_DEV_DEFAULT"
+  [mobile]="$BRANCH_MOBILE_DEFAULT"
+)
+
+declare -A STAGE_REPO=(
+  [production]="$REPO_DEFAULT"
+  [dev]="$REPO_DEFAULT"
+  [mobile]="$REPO_DEFAULT"
+)
+
+declare -A STAGE_SUFFIX=(
+  [production]="prod"
+  [dev]="dev"
+  [mobile]="mobile"
+)
+
+normalize_stage() {
+  local input
+  input=$(echo "$1" | tr '[:upper:]' '[:lower:]' | xargs)
+  case "$input" in
+    prod) echo "production" ;;
+    production|dev|mobile) echo "$input" ;;
+    *) echo "" ;;
+  esac
+}
+
+for token in $(echo "$PIPELINES_RAW" | tr ',' ' '); do
+  stage=$(normalize_stage "$token")
+  if [ -n "$stage" ]; then
+    STAGE_ENABLED["$stage"]=true
+  fi
+done
+
+if [ -f "$PIPELINES_CONFIG_PATH" ]; then
+  echo "Loading runtime pipeline config from $PIPELINES_CONFIG_PATH"
+  while IFS=$'\t' read -r stage enabled branch repo; do
+    stage=$(normalize_stage "$stage")
+    if [ -z "$stage" ]; then
+      continue
+    fi
+
+    if [ "$enabled" = "true" ]; then
+      STAGE_ENABLED["$stage"]=true
+    elif [ "$enabled" = "false" ]; then
+      STAGE_ENABLED["$stage"]=false
+    fi
+
+    if [ -n "$branch" ]; then
+      STAGE_BRANCH["$stage"]="$branch"
+    fi
+
+    if [ -n "$repo" ]; then
+      STAGE_REPO["$stage"]="$repo"
+    fi
+  done < <(node -e '
+const fs = require("fs");
+const path = process.argv[1];
+const raw = JSON.parse(fs.readFileSync(path, "utf8"));
+const src = raw.pipelines ?? raw;
+function toStage(v) {
+  const n = String(v || "").trim().toLowerCase();
+  if (n === "prod") return "production";
+  if (n === "production" || n === "dev" || n === "mobile") return n;
+  return "";
+}
+function emit(stage, cfg) {
+  const enabled = cfg && typeof cfg.enabled !== "undefined" ? Boolean(cfg.enabled) : true;
+  const branch = cfg && typeof cfg.branch === "string" ? cfg.branch.trim() : "";
+  const repo = cfg && typeof cfg.repo === "string" ? cfg.repo.trim() : "";
+  process.stdout.write([stage, String(enabled), branch, repo].join("\t") + "\n");
+}
+if (Array.isArray(src)) {
+  for (const item of src) {
+    const stage = toStage(item && item.stage);
+    if (!stage) continue;
+    emit(stage, item || {});
+  }
+} else if (src && typeof src === "object") {
+  for (const [key, value] of Object.entries(src)) {
+    const stage = toStage(key);
+    if (!stage) continue;
+    emit(stage, value || {});
+  }
+}
+' "$PIPELINES_CONFIG_PATH")
+else
+  echo "Runtime pipeline config not found at $PIPELINES_CONFIG_PATH; using env defaults"
+fi
 
 declare -A PIPELINE_STAGE=()
 declare -A PIPELINE_REPO=()
 declare -A PIPELINE_BRANCH=()
 
-add_pipeline() {
-  local stage=$1
-  local name="${PIPELINE_PREFIX}-${stage}"
-  local branch=${2:-main}
-
-  if [ "$stage" = "production" ]; then
-    name="${PIPELINE_PREFIX}-prod"
+for stage in production dev mobile; do
+  if [ "${STAGE_ENABLED[$stage]}" != "true" ]; then
+    continue
   fi
 
-  PIPELINE_STAGE["$name"]="$stage"
-  PIPELINE_REPO["$name"]="$REPO_DEFAULT"
-  PIPELINE_BRANCH["$name"]="$branch"
-}
+  suffix=${STAGE_SUFFIX[$stage]}
+  name="${PIPELINE_PREFIX}-${suffix}"
 
-IFS=',' read -r -a STAGE_LIST <<< "$PIPELINES_CSV"
-for raw in "${STAGE_LIST[@]}"; do
-  stage=$(echo "$raw" | xargs)
-  case "$stage" in
-    production) add_pipeline "production" "$BRANCH_PROD" ;;
-    dev) add_pipeline "dev" "$BRANCH_DEV" ;;
-    mobile) add_pipeline "mobile" "$BRANCH_MOBILE" ;;
-    ""|none) ;;
-    *)
-      # Allow custom stage names while defaulting to main branch.
-      add_pipeline "$stage" "main"
-      ;;
-  esac
+  PIPELINE_STAGE["$name"]="$stage"
+  PIPELINE_REPO["$name"]="${STAGE_REPO[$stage]}"
+  PIPELINE_BRANCH["$name"]="${STAGE_BRANCH[$stage]}"
 done
 
+if [ ${#PIPELINE_STAGE[@]} -eq 0 ]; then
+  echo "No pipelines configured. Set INFRA_PIPELINES and/or config/pipelines.json."
+  exit 0
+fi
+
 resolve_sst_deploy_script() {
   local candidates=(
     "$SCRIPT_DIR/sst-deploy.sh"
@@ -83,16 +183,6 @@ resolve_sst_deploy_script() {
   return 1
 }
 
-if ! command -v aws >/dev/null 2>&1; then
-  echo "aws CLI not found in PATH" >&2
-  exit 1
-fi
-
-if [ ${#PIPELINE_STAGE[@]} -eq 0 ]; then
-  echo "No pipelines configured in scripts/ensure-pipelines.sh. Nothing to do."
-  exit 0
-fi
-
 SST_DEPLOY_SCRIPT=${SST_DEPLOY_SCRIPT:-}
 if [ -z "$SST_DEPLOY_SCRIPT" ]; then
   SST_DEPLOY_SCRIPT=$(resolve_sst_deploy_script || true)
@@ -131,13 +221,31 @@ if [ "${APPROVE:-}" != "true" ]; then
   exit 1
 fi
 
+declare -A PROCESSED_STAGE=()
 for NAME in "${MISSING[@]}"; do
-  STAGE=${PIPELINE_STAGE[$NAME]:-production}
+  STAGE=${PIPELINE_STAGE[$NAME]}
+
+  if [ "${PROCESSED_STAGE[$STAGE]:-false}" = "true" ]; then
+    continue
+  fi
+
   REPO=${PIPELINE_REPO[$NAME]:-$REPO_DEFAULT}
-  BRANCH=${PIPELINE_BRANCH[$NAME]:-main}
 
-  echo "Creating pipeline '$NAME' via SST deploy (stage: $STAGE, repo: $REPO, branch: $BRANCH)"
-  APPROVE=true STACK="$STAGE" bash "$SST_DEPLOY_SCRIPT"
+  echo "Creating pipeline for stage '$STAGE' via production deploy"
+  echo "  repo   : $REPO"
+  echo "  branch : ${PIPELINE_BRANCH[$NAME]}"
+
+  APPROVE=true \
+  STACK="production" \
+  INFRA_CREATE_PIPELINES=true \
+  INFRA_PIPELINES="$STAGE" \
+  INFRA_PIPELINE_REPO="$REPO" \
+  INFRA_PIPELINE_BRANCH_PROD="${STAGE_BRANCH[production]}" \
+  INFRA_PIPELINE_BRANCH_DEV="${STAGE_BRANCH[dev]}" \
+  INFRA_PIPELINE_BRANCH_MOBILE="${STAGE_BRANCH[mobile]}" \
+  bash "$SST_DEPLOY_SCRIPT"
+
+  PROCESSED_STAGE[$STAGE]=true
 done
 
 echo "Done. Current pipelines:"

package/scripts/postdeploy-update-dns.sh

@@ -38,6 +38,33 @@ DOMAIN=$(resolve_stage_domain)
 
 echo "Post-deploy DNS sync: stage=$STAGE domain=$DOMAIN region=$REGION"
 
+# Resolve the best hosted zone by progressively walking up parent domains.
+# Example: dev.airs.alternun.co -> airs.alternun.co -> alternun.co
+find_hosted_zone() {
+  local domain=$1
+  local clean=${domain%.}
+  IFS='.' read -r -a labels <<< "$clean"
+
+  if [ "${#labels[@]}" -lt 2 ]; then
+    return 1
+  fi
+
+  for ((i=0; i<=${#labels[@]}-2; i++)); do
+    local candidate
+    candidate=$(IFS='.'; echo "${labels[*]:i}")
+    local hz
+    hz=$(aws route53 list-hosted-zones-by-name --dns-name "$candidate" --query "HostedZones[?Name=='${candidate}.']|[0].Id" --output text 2>/dev/null || true)
+    if [ -n "$hz" ] && [ "$hz" != "None" ]; then
+      hz=${hz##*/}
+      hz=${hz##*/}
+      echo "${hz}|${candidate}"
+      return 0
+    fi
+  done
+
+  return 1
+}
+
 # Find and wait for the CloudFront distribution that has this alias
 echo "Searching for CloudFront distribution with alias ${DOMAIN} (will wait up to ${POLL_TIMEOUT}s)..."
 END=$((SECONDS + POLL_TIMEOUT))
@@ -88,13 +115,14 @@ if [ -z "$FOUND_DIST_ID" ]; then
 
   # Route53 hosted zone and apex records
   echo "\n-- Route53 apex records for ${DOMAIN_ROOT} --"
-  HZ=$(aws route53 list-hosted-zones-by-name --dns-name "${DOMAIN_ROOT}" --query 'HostedZones[0].Id' --output text || true)
-  if [ -n "$HZ" ] && [ "$HZ" != "None" ]; then
-    HZ_ID=${HZ##*/}
-    echo "Hosted zone ID: $HZ_ID"
+  HZ=$(find_hosted_zone "${DOMAIN}" || true)
+  if [ -n "$HZ" ]; then
+    HZ_ID=${HZ%%|*}
+    HZ_NAME=${HZ##*|}
+    echo "Hosted zone ID: $HZ_ID (zone: $HZ_NAME)"
     aws route53 list-resource-record-sets --hosted-zone-id "$HZ_ID" --query "ResourceRecordSets[?Name=='${DOMAIN}.']" --output json || true
   else
-    echo "No hosted zone for ${DOMAIN_ROOT} found in this account/region"
+    echo "No hosted zone for ${DOMAIN} (or parent domains) found in this account"
   fi
 
   echo "\nIf SST reported creating a site but no distribution exists, ensure SST had permissions to create CloudFront and ACM resources and that the deploy completed successfully."
@@ -120,15 +148,18 @@ if [ -z "$DIST_DOMAIN" ] || [ "$DIST_DOMAIN" = "null" ]; then
   fi
 fi
 
-# Lookup hosted zone id for base domain
-HOSTED_ZONE_ID=$(aws route53 list-hosted-zones-by-name --dns-name "${DOMAIN_ROOT}" --query 'HostedZones[0].Id' --output text)
-if [ -z "$HOSTED_ZONE_ID" ] || [ "$HOSTED_ZONE_ID" = "None" ]; then
-  echo "Hosted zone for ${DOMAIN_ROOT} not found. Exiting." >&2
+# Lookup hosted zone id by exact domain, then parent fallback
+HOSTED_ZONE_INFO=$(find_hosted_zone "${DOMAIN}" || true)
+if [ -z "$HOSTED_ZONE_INFO" ]; then
+  echo "Hosted zone for ${DOMAIN} (or parent domains) not found. Exiting." >&2
   exit 1
 fi
 
-# Strip /hostedzone/ prefix if present
-HOSTED_ZONE_ID=${HOSTED_ZONE_ID#/hostedzone/}
+HOSTED_ZONE_ID=${HOSTED_ZONE_INFO%%|*}
+HOSTED_ZONE_NAME=${HOSTED_ZONE_INFO##*|}
+if [ "$HOSTED_ZONE_NAME" != "$DOMAIN_ROOT" ]; then
+  echo "Using parent hosted zone ${HOSTED_ZONE_NAME} for ${DOMAIN}"
+fi
 
 CHANGE_BATCH=$(mktemp)
 cat > "$CHANGE_BATCH" <<EOF

package/scripts/predeploy-checks.sh

@@ -40,15 +40,48 @@ AUTO_REMOVE_CONFLICTING_DNS=${AUTO_REMOVE_CONFLICTING_DNS:-false}
 
 echo "Pre-deploy checks: region=$AWS_REGION stage=$STAGE domain=$DOMAIN_ROOT"
 
+# Resolve the best hosted zone by progressively walking up parent domains.
+# Example: dev.airs.alternun.co -> airs.alternun.co -> alternun.co
+find_hosted_zone() {
+  local domain=$1
+  local clean=${domain%.}
+  IFS='.' read -r -a labels <<< "$clean"
+
+  if [ "${#labels[@]}" -lt 2 ]; then
+    return 1
+  fi
+
+  for ((i=0; i<=${#labels[@]}-2; i++)); do
+    local candidate
+    candidate=$(IFS='.'; echo "${labels[*]:i}")
+    local hz
+    hz=$(aws route53 list-hosted-zones-by-name --dns-name "$candidate" --query "HostedZones[?Name=='${candidate}.']|[0].Id" --output text 2>/dev/null || true)
+    if [ -n "$hz" ] && [ "$hz" != "None" ]; then
+      hz=${hz##*/}
+      hz=${hz##*/}
+      echo "${hz}|${candidate}"
+      return 0
+    fi
+  done
+
+  return 1
+}
+
 check_route53_conflict() {
   local name=$1
-  hz=$(aws route53 list-hosted-zones-by-name --dns-name "$DOMAIN_ROOT" --query 'HostedZones[0].Id' --output text 2>/dev/null || true)
-  if [ -z "$hz" ]; then
-    echo "WARN: Hosted zone for $DOMAIN_ROOT not found in $AWS_REGION"
+  local hz
+  local zone_domain
+  local resolved
+  resolved=$(find_hosted_zone "$name" || true)
+  if [ -z "$resolved" ]; then
+    echo "WARN: Hosted zone for $name (or parent) not found in $AWS_REGION"
     return 0
   fi
-  hz=${hz##*/}
-  hz=${hz##*/}
+  hz=${resolved%%|*}
+  zone_domain=${resolved##*|}
+  if [ "$zone_domain" != "$DOMAIN_ROOT" ]; then
+    echo "INFO: Using parent hosted zone '$zone_domain' for record '$name'"
+  fi
   # Only treat A/AAAA/CNAME or alias records as blocking records for web deploys.
   # Keep MX/TXT/NS/SOA since they are often required for email/zone setup and
   # should not block CloudFront/website deploys.

package/templates/buildspec.yml

@@ -17,6 +17,11 @@ env:
     DOMAIN_DEV: "dev.__ROOT_DOMAIN__"
     DOMAIN_MOBILE: "mobile.__ROOT_DOMAIN__"
 
+    # Pipeline safety defaults
+    INFRA_CREATE_PIPELINES: "false"
+    INFRA_PIPELINE_PERMISSIONS_MODE: "__PIPELINE_PERMISSIONS_MODE__"
+    INFRA_PIPELINES_CONFIG_PATH: "config/pipelines.json"
+
     # Check controls
     SKIP_DNS_CHECK: "false"
     AUTO_REMOVE_CONFLICTING_DNS: "true"
@@ -39,6 +44,19 @@ phases:
       - echo "Node     = $(node --version)"
       - echo "pnpm     = $(pnpm --version)"
       - echo "Infra    = ${INFRA_PATH}"
+      - echo "Running infra doctor"
+      - |
+        if [ -f "${INFRA_PATH}/dist/bin/init.js" ]; then
+          node "${INFRA_PATH}/dist/bin/init.js" doctor --target "${INFRA_PATH}" || (echo "infra doctor failed" && exit 1)
+        elif [ -f "${INFRA_PATH}/bin/init.ts" ]; then
+          echo "Building local infra CLI for doctor..."
+          (cd "${INFRA_PATH}" && pnpm run build)
+          node "${INFRA_PATH}/dist/bin/init.js" doctor --target "${INFRA_PATH}" || (echo "infra doctor failed" && exit 1)
+        elif [ -f "./node_modules/@lsts_tech/infra/dist/bin/init.js" ]; then
+          node "./node_modules/@lsts_tech/infra/dist/bin/init.js" doctor --target "${INFRA_PATH}" || (echo "infra doctor failed" && exit 1)
+        else
+          echo "Could not locate an infra doctor binary." && exit 1
+        fi
       - echo "Running pre-deploy checks..."
       - |
         if [ -f "${INFRA_PATH}/scripts/predeploy-checks.sh" ]; then
@@ -58,6 +76,11 @@ phases:
 
   post_build:
     commands:
+      - |
+        if [ "${CODEBUILD_BUILD_SUCCEEDING:-0}" != "1" ]; then
+          echo "Build failed; skipping post-deploy DNS sync."
+          exit 0
+        fi
       - echo "SST deploy completed for stage ${SST_STAGE}"
       - echo "Running post-deploy DNS sync"
       - |

package/templates/ensure-pipelines.sh

@@ -4,7 +4,9 @@ set -euo pipefail
 # ensure-pipelines.sh (template)
 #
 # AWS-only helper (v1.0.0) to ensure configured CodePipelines exist.
-# Missing pipelines are created by triggering an SST deploy for their mapped stage.
+# Missing pipelines are created by triggering an explicit production deploy with:
+#   INFRA_CREATE_PIPELINES=true
+#   INFRA_PIPELINES=<missing-stage>
 #
 # Usage:
 #   APPROVE=true bash scripts/ensure-pipelines.sh
@@ -25,20 +27,145 @@ if [ -z "$DOMAIN_ROOT" ]; then
   exit 1
 fi
 
+if ! command -v aws >/dev/null 2>&1; then
+  echo "aws CLI not found in PATH" >&2
+  exit 1
+fi
+
+if ! command -v node >/dev/null 2>&1; then
+  echo "node is required for parsing pipeline config" >&2
+  exit 1
+fi
+
 REGION=${AWS_REGION:-us-east-1}
+PIPELINE_PREFIX=${INFRA_PIPELINE_PREFIX:-__PROJECT_PREFIX__}
+PIPELINES_RAW=${INFRA_PIPELINES:-__PIPELINES_DEFAULT__}
+PIPELINES_CONFIG_PATH=${INFRA_PIPELINES_CONFIG_PATH:-$INFRA_DIR/config/pipelines.json}
 REPO_DEFAULT=${INFRA_PIPELINE_REPO:-__PIPELINE_REPO__}
 
-# Pipeline definitions (generated by init)
-declare -A PIPELINE_STAGE=(
-__PIPELINE_STAGE_MAP__
+BRANCH_PROD_DEFAULT=${INFRA_PIPELINE_BRANCH_PROD:-__BRANCH_PROD__}
+BRANCH_DEV_DEFAULT=${INFRA_PIPELINE_BRANCH_DEV:-__BRANCH_DEV__}
+BRANCH_MOBILE_DEFAULT=${INFRA_PIPELINE_BRANCH_MOBILE:-__BRANCH_MOBILE__}
+
+declare -A STAGE_ENABLED=(
+  [production]=false
+  [dev]=false
+  [mobile]=false
+)
+
+declare -A STAGE_BRANCH=(
+  [production]="$BRANCH_PROD_DEFAULT"
+  [dev]="$BRANCH_DEV_DEFAULT"
+  [mobile]="$BRANCH_MOBILE_DEFAULT"
 )
-declare -A PIPELINE_REPO=(
-__PIPELINE_REPO_MAP__
+
+declare -A STAGE_REPO=(
+  [production]="$REPO_DEFAULT"
+  [dev]="$REPO_DEFAULT"
+  [mobile]="$REPO_DEFAULT"
 )
-declare -A PIPELINE_BRANCH=(
-__PIPELINE_BRANCH_MAP__
+
+declare -A STAGE_SUFFIX=(
+  [production]="prod"
+  [dev]="dev"
+  [mobile]="mobile"
 )
 
+normalize_stage() {
+  local input
+  input=$(echo "$1" | tr '[:upper:]' '[:lower:]' | xargs)
+  case "$input" in
+    prod) echo "production" ;;
+    production|dev|mobile) echo "$input" ;;
+    *) echo "" ;;
+  esac
+}
+
+for token in $(echo "$PIPELINES_RAW" | tr ',' ' '); do
+  stage=$(normalize_stage "$token")
+  if [ -n "$stage" ]; then
+    STAGE_ENABLED["$stage"]=true
+  fi
+done
+
+if [ -f "$PIPELINES_CONFIG_PATH" ]; then
+  echo "Loading runtime pipeline config from $PIPELINES_CONFIG_PATH"
+  while IFS=$'\t' read -r stage enabled branch repo; do
+    stage=$(normalize_stage "$stage")
+    if [ -z "$stage" ]; then
+      continue
+    fi
+
+    if [ "$enabled" = "true" ]; then
+      STAGE_ENABLED["$stage"]=true
+    elif [ "$enabled" = "false" ]; then
+      STAGE_ENABLED["$stage"]=false
+    fi
+
+    if [ -n "$branch" ]; then
+      STAGE_BRANCH["$stage"]="$branch"
+    fi
+
+    if [ -n "$repo" ]; then
+      STAGE_REPO["$stage"]="$repo"
+    fi
+  done < <(node -e '
+const fs = require("fs");
+const path = process.argv[1];
+const raw = JSON.parse(fs.readFileSync(path, "utf8"));
+const src = raw.pipelines ?? raw;
+function toStage(v) {
+  const n = String(v || "").trim().toLowerCase();
+  if (n === "prod") return "production";
+  if (n === "production" || n === "dev" || n === "mobile") return n;
+  return "";
+}
+function emit(stage, cfg) {
+  const enabled = cfg && typeof cfg.enabled !== "undefined" ? Boolean(cfg.enabled) : true;
+  const branch = cfg && typeof cfg.branch === "string" ? cfg.branch.trim() : "";
+  const repo = cfg && typeof cfg.repo === "string" ? cfg.repo.trim() : "";
+  process.stdout.write([stage, String(enabled), branch, repo].join("\t") + "\n");
+}
+if (Array.isArray(src)) {
+  for (const item of src) {
+    const stage = toStage(item && item.stage);
+    if (!stage) continue;
+    emit(stage, item || {});
+  }
+} else if (src && typeof src === "object") {
+  for (const [key, value] of Object.entries(src)) {
+    const stage = toStage(key);
+    if (!stage) continue;
+    emit(stage, value || {});
+  }
+}
+' "$PIPELINES_CONFIG_PATH")
+else
+  echo "Runtime pipeline config not found at $PIPELINES_CONFIG_PATH; using env defaults"
+fi
+
+declare -A PIPELINE_STAGE=()
+declare -A PIPELINE_REPO=()
+declare -A PIPELINE_BRANCH=()
+
+for stage in production dev mobile; do
+  if [ "${STAGE_ENABLED[$stage]}" != "true" ]; then
+    continue
+  fi
+
+  suffix=${STAGE_SUFFIX[$stage]}
+  name="${PIPELINE_PREFIX}-${suffix}"
+
+  PIPELINE_STAGE["$name"]="$stage"
+  PIPELINE_REPO["$name"]="${STAGE_REPO[$stage]}"
+  PIPELINE_BRANCH["$name"]="${STAGE_BRANCH[$stage]}"
+done
+
+if [ ${#PIPELINE_STAGE[@]} -eq 0 ]; then
+  echo "No pipelines configured. Set INFRA_PIPELINES and/or config/pipelines.json."
+  exit 0
+fi
+
 resolve_sst_deploy_script() {
   local candidates=(
     "$SCRIPT_DIR/sst-deploy.sh"
@@ -56,16 +183,6 @@ resolve_sst_deploy_script() {
   return 1
 }
 
-if ! command -v aws >/dev/null 2>&1; then
-  echo "aws CLI not found in PATH" >&2
-  exit 1
-fi
-
-if [ ${#PIPELINE_STAGE[@]} -eq 0 ]; then
-  echo "No pipelines configured in scripts/ensure-pipelines.sh. Nothing to do."
-  exit 0
-fi
-
 SST_DEPLOY_SCRIPT=${SST_DEPLOY_SCRIPT:-}
 if [ -z "$SST_DEPLOY_SCRIPT" ]; then
   SST_DEPLOY_SCRIPT=$(resolve_sst_deploy_script || true)
@@ -104,13 +221,31 @@ if [ "${APPROVE:-}" != "true" ]; then
   exit 1
 fi
 
+declare -A PROCESSED_STAGE=()
 for NAME in "${MISSING[@]}"; do
-  STAGE=${PIPELINE_STAGE[$NAME]:-production}
+  STAGE=${PIPELINE_STAGE[$NAME]}
+
+  if [ "${PROCESSED_STAGE[$STAGE]:-false}" = "true" ]; then
+    continue
+  fi
+
   REPO=${PIPELINE_REPO[$NAME]:-$REPO_DEFAULT}
-  BRANCH=${PIPELINE_BRANCH[$NAME]:-main}
 
-  echo "Creating pipeline '$NAME' via SST deploy (stage: $STAGE, repo: $REPO, branch: $BRANCH)"
-  APPROVE=true STACK="$STAGE" bash "$SST_DEPLOY_SCRIPT"
+  echo "Creating pipeline for stage '$STAGE' via production deploy"
+  echo "  repo   : $REPO"
+  echo "  branch : ${PIPELINE_BRANCH[$NAME]}"
+
+  APPROVE=true \
+  STACK="production" \
+  INFRA_CREATE_PIPELINES=true \
+  INFRA_PIPELINES="$STAGE" \
+  INFRA_PIPELINE_REPO="$REPO" \
+  INFRA_PIPELINE_BRANCH_PROD="${STAGE_BRANCH[production]}" \
+  INFRA_PIPELINE_BRANCH_DEV="${STAGE_BRANCH[dev]}" \
+  INFRA_PIPELINE_BRANCH_MOBILE="${STAGE_BRANCH[mobile]}" \
+  bash "$SST_DEPLOY_SCRIPT"
+
+  PROCESSED_STAGE[$STAGE]=true
 done
 
 echo "Done. Current pipelines:"

package/templates/env.example

@@ -1,11 +1,16 @@
 # Provider support in v1.0.0: AWS only
 INFRA_PROVIDER=__PROVIDER__
 
+# Deployment profile: next-only | next-expo | expo-web
+INFRA_PROFILE=__PROFILE__
+
 # SST app identity
 INFRA_APP_NAME=__APP_NAME__
+INFRA_USE_EXTERNAL_CERTS=false
 
 # Core domain and repository
 INFRA_ROOT_DOMAIN=__ROOT_DOMAIN__
+INFRA_HOSTED_ZONE_DOMAIN=
 INFRA_PIPELINE_REPO=__PIPELINE_REPO__
 INFRA_PIPELINE_PREFIX=__PROJECT_PREFIX__
 INFRA_PROJECT_TAG=__PROJECT_PREFIX__
@@ -16,6 +21,16 @@ INFRA_PIPELINE_BRANCH_PROD=__BRANCH_PROD__
 INFRA_PIPELINE_BRANCH_DEV=__BRANCH_DEV__
 INFRA_PIPELINE_BRANCH_MOBILE=__BRANCH_MOBILE__
 
+# Pipeline definitions can be provided in local config/pipelines.json
+INFRA_PIPELINES_CONFIG_PATH=config/pipelines.json
+
+# Explicit control: keep false for normal deploys.
+# Set true only when intentionally creating/updating CodePipelines.
+INFRA_CREATE_PIPELINES=__CREATE_PIPELINES_DEFAULT__
+
+# CodeBuild role mode: admin | least-privilege
+INFRA_PIPELINE_PERMISSIONS_MODE=__PIPELINE_PERMISSIONS_MODE__
+
 # Optional Expo static site deployment
 INFRA_ENABLE_EXPO_SITE=__ENABLE_EXPO_SITE__