@openhi/platform 0.0.0 → 0.0.2

package/lib/index.js

@@ -1,19 +1,827 @@
 "use strict";
-var __createBinding = (this && this.__createBinding) || (Object.create ? (function(o, m, k, k2) {
-    if (k2 === undefined) k2 = k;
-    var desc = Object.getOwnPropertyDescriptor(m, k);
-    if (!desc || ("get" in desc ? !m.__esModule : desc.writable || desc.configurable)) {
-      desc = { enumerable: true, get: function() { return m[k]; } };
+var __create = Object.create;
+var __defProp = Object.defineProperty;
+var __getOwnPropDesc = Object.getOwnPropertyDescriptor;
+var __getOwnPropNames = Object.getOwnPropertyNames;
+var __getProtoOf = Object.getPrototypeOf;
+var __hasOwnProp = Object.prototype.hasOwnProperty;
+var __commonJS = (cb, mod) => function __require() {
+  return mod || (0, cb[__getOwnPropNames(cb)[0]])((mod = { exports: {} }).exports, mod), mod.exports;
+};
+var __export = (target, all) => {
+  for (var name in all)
+    __defProp(target, name, { get: all[name], enumerable: true });
+};
+var __copyProps = (to, from, except, desc) => {
+  if (from && typeof from === "object" || typeof from === "function") {
+    for (let key of __getOwnPropNames(from))
+      if (!__hasOwnProp.call(to, key) && key !== except)
+        __defProp(to, key, { get: () => from[key], enumerable: !(desc = __getOwnPropDesc(from, key)) || desc.enumerable });
+  }
+  return to;
+};
+var __toESM = (mod, isNodeMode, target) => (target = mod != null ? __create(__getProtoOf(mod)) : {}, __copyProps(
+  // If the importer is in node compatibility mode or this is not an ESM
+  // file that has been converted to a CommonJS file using a Babel-
+  // compatible transform (i.e. "__esModule" has not been set), then set
+  // "default" to the CommonJS "module.exports" for node compatibility.
+  isNodeMode || !mod || !mod.__esModule ? __defProp(target, "default", { value: mod, enumerable: true }) : target,
+  mod
+));
+var __toCommonJS = (mod) => __copyProps(__defProp({}, "__esModule", { value: true }), mod);
+
+// ../config/lib/open-hi-config.js
+var require_open_hi_config = __commonJS({
+  "../config/lib/open-hi-config.js"(exports2) {
+    "use strict";
+    Object.defineProperty(exports2, "__esModule", { value: true });
+    exports2.OPEN_HI_DEPLOYMENT_TARGET_ROLE = exports2.OPEN_HI_STAGE = void 0;
+    exports2.OPEN_HI_STAGE = {
+      /**
+       * Development environment, typically used for testing and development.
+       */
+      DEV: "dev",
+      /**
+       * Staging environment, used for pre-production testing.
+       */
+      STAGE: "stage",
+      /**
+       * Production environment, used for live deployments.
+       */
+      PROD: "prod"
+    };
+    exports2.OPEN_HI_DEPLOYMENT_TARGET_ROLE = {
+      /**
+       * The primary deployment target for this stage (main account/region).
+       * For example, the base DynamoDB region for global tables.
+       */
+      PRIMARY: "primary",
+      /**
+       * A secondary deployment target for this stage (additional account/region).
+       * For example, a replica region for a global DynamoDB table, or another cell in the same region.
+       */
+      SECONDARY: "secondary"
+    };
+  }
+});
+
+// ../config/lib/index.js
+var require_lib = __commonJS({
+  "../config/lib/index.js"(exports2) {
+    "use strict";
+    var __createBinding = exports2 && exports2.__createBinding || (Object.create ? (function(o, m, k, k2) {
+      if (k2 === void 0) k2 = k;
+      var desc = Object.getOwnPropertyDescriptor(m, k);
+      if (!desc || ("get" in desc ? !m.__esModule : desc.writable || desc.configurable)) {
+        desc = { enumerable: true, get: function() {
+          return m[k];
+        } };
+      }
+      Object.defineProperty(o, k2, desc);
+    }) : (function(o, m, k, k2) {
+      if (k2 === void 0) k2 = k;
+      o[k2] = m[k];
+    }));
+    var __exportStar = exports2 && exports2.__exportStar || function(m, exports3) {
+      for (var p in m) if (p !== "default" && !Object.prototype.hasOwnProperty.call(exports3, p)) __createBinding(exports3, m, p);
+    };
+    Object.defineProperty(exports2, "__esModule", { value: true });
+    __exportStar(require_open_hi_config(), exports2);
+  }
+});
+
+// src/index.ts
+var index_exports = {};
+__export(index_exports, {
+  OPEN_HI_SERVICE_TYPE: () => OPEN_HI_SERVICE_TYPE,
+  OpenHi: () => OpenHi,
+  OpenHiService: () => OpenHiService
+});
+module.exports = __toCommonJS(index_exports);
+
+// src/openhi.ts
+var import_ts_deepmerge = require("ts-deepmerge");
+
+// src/service.ts
+var import_path = require("path");
+var import_configulator = require("@codedrifters/configulator");
+var import_config2 = __toESM(require_lib());
+var import_change_case = require("change-case");
+var import_projen3 = require("projen");
+var import_javascript = require("projen/lib/javascript");
+
+// src/templates/service-template.ts
+var import_node_fs = require("fs");
+var import_node_path = require("path");
+var import_projen = require("projen");
+var ServiceTemplate = class {
+  constructor(service, options) {
+    this.service = service;
+    this.options = options;
+    this.fullFilePath = [
+      this.service.project.outdir,
+      this.options.filePath
+    ].join(import_node_path.sep);
+    this.createTemplate();
+  }
+  createTemplate() {
+    if (this.options.overwrite) {
+      this.overwriteTemplate();
+    }
+    this.file = new import_projen.SampleFile(this.service.project, this.options.filePath, {
+      contents: this.options.contents.join("\n")
+    });
+  }
+  overwriteTemplate() {
+    if ((0, import_node_fs.existsSync)(this.fullFilePath)) {
+      (0, import_node_fs.unlinkSync)(this.fullFilePath);
     }
-    Object.defineProperty(o, k2, desc);
-}) : (function(o, m, k, k2) {
-    if (k2 === undefined) k2 = k;
-    o[k2] = m[k];
-}));
-var __exportStar = (this && this.__exportStar) || function(m, exports) {
-    for (var p in m) if (p !== "default" && !Object.prototype.hasOwnProperty.call(exports, p)) __createBinding(exports, m, p);
-};
-Object.defineProperty(exports, "__esModule", { value: true });
-__exportStar(require("./openhi"), exports);
-__exportStar(require("./service"), exports);
-//# sourceMappingURL=data:application/json;base64,eyJ2ZXJzaW9uIjozLCJmaWxlIjoiaW5kZXguanMiLCJzb3VyY2VSb290IjoiIiwic291cmNlcyI6WyIuLi9zcmMvaW5kZXgudHMiXSwibmFtZXMiOltdLCJtYXBwaW5ncyI6Ijs7Ozs7Ozs7Ozs7Ozs7OztBQUFBLDJDQUF5QjtBQUN6Qiw0Q0FBMEIiLCJzb3VyY2VzQ29udGVudCI6WyJleHBvcnQgKiBmcm9tIFwiLi9vcGVuaGlcIjtcbmV4cG9ydCAqIGZyb20gXCIuL3NlcnZpY2VcIjtcbiJdfQ==
+    this.file = void 0;
+  }
+};
+
+// src/templates/src/app.ts
+var SrcApp = class extends ServiceTemplate {
+  constructor(service, options) {
+    super(service, {
+      ...options,
+      filePath: "src/app.ts",
+      contents: [
+        `import { OpenHiApp, ${service.constructName} } from "@openhi/constructs";`,
+        `import { CONFIG } from "./config";`,
+        ``,
+        `const app = new OpenHiApp({ config: CONFIG });`,
+        ``,
+        `const stacks = app.environments.map((e) => {`,
+        `  return new ${service.constructName}(e, { config: e.config });`,
+        `});`,
+        ``,
+        `export { app, stacks };`,
+        ``
+      ]
+    });
+  }
+};
+
+// src/templates/src/app-test.ts
+var SrcAppTest = class extends ServiceTemplate {
+  constructor(service, options) {
+    super(service, {
+      ...options,
+      filePath: "src/app.test.ts",
+      contents: [
+        `import { Template } from "aws-cdk-lib/assertions";`,
+        `import { Code, type CodeConfig } from "aws-cdk-lib/aws-lambda";`,
+        `import { stacks } from "./app"`,
+        ``,
+        `/** Replace volatile CDK asset S3 keys/buckets with static values for snapshot stability. */`,
+        `function normalizeTemplateForSnapshot(template: Record<string, unknown>): Record<string, unknown> {`,
+        `  const staticBucket = "mock-assets-bucket";`,
+        `  const staticKey = "mock-asset-key.zip";`,
+        `  const json = JSON.stringify(template);`,
+        `  const normalized = json`,
+        `    .replace(/"S3Key":\\s*"[^"]+\\.zip"/g, \\\`"S3Key": "\${staticKey}"\\\`)`,
+        `    .replace(/"S3Bucket":\\s*"[^"]+"/g, \\\`"S3Bucket": "\${staticBucket}"\\\`);`,
+        `  return JSON.parse(normalized) as Record<string, unknown>;`,
+        `}`,
+        ``,
+        `let fromAssetMock: jest.SpyInstance;`,
+        ``,
+        `beforeAll(() => {`,
+        `  fromAssetMock = jest.spyOn(Code, "fromAsset").mockReturnValue({`,
+        `    isInline: false,`,
+        `    bind: (): CodeConfig => ({`,
+        `      s3Location: {`,
+        `        bucketName: "mock-assets-bucket",`,
+        `        objectKey: "mock-asset-key.zip",`,
+        `      },`,
+        `    }),`,
+        `    bindToResource: () => {`,
+        `      return;`,
+        `    },`,
+        `  } as any);`,
+        `});`,
+        ``,
+        `afterAll(() => {`,
+        `  fromAssetMock?.mockRestore();`,
+        `});`,
+        ``,
+        `describe("Smoke Test", () => {`,
+        `  it("should match previous snapshots", () => {`,
+        `    stacks.forEach((s) => {`,
+        `      const template = Template.fromStack(s).toJSON();`,
+        `      expect(normalizeTemplateForSnapshot(template)).toMatchSnapshot();`,
+        `    });`,
+        `  });`,
+        `});`,
+        ``
+      ]
+    });
+  }
+};
+
+// src/templates/src/config.ts
+var import_projen2 = require("projen");
+var SrcConfig = class extends import_projen2.SourceCode {
+  constructor(service) {
+    super(service.project, "src/config.ts");
+    this.line(`import { OpenHiConfig } from "@openhi/config";`);
+    this.line("");
+    const start = "export const CONFIG: OpenHiConfig = ";
+    const mid = JSON.stringify(service.options?.config, null, 2);
+    const end = " as const;";
+    this.line(`${start}${mid}${end}`);
+  }
+};
+
+// src/templates/src/data/models/README.md.ts
+var DataModelsReadMe = class extends ServiceTemplate {
+  constructor(service, options) {
+    super(service, {
+      ...options,
+      filePath: "src/data/models/README.md",
+      contents: [
+        `# ${service.serviceName}: Data Models`,
+        ``,
+        `This directory contains data model definitions and other related files for the ${service.serviceName} service.`
+      ]
+    });
+  }
+};
+
+// src/templates/src/data/README.md.ts
+var DataReadMe = class extends ServiceTemplate {
+  constructor(service, options) {
+    super(service, {
+      ...options,
+      filePath: "src/data/README.md",
+      contents: [
+        `# ${service.serviceName}: Data`,
+        ``,
+        `This directory contains data models and other related files for the ${service.serviceName} service.`
+      ]
+    });
+  }
+};
+
+// src/templates/src/infrastructure/README.md.ts
+var InfrastructureReadMe = class extends ServiceTemplate {
+  constructor(service, options) {
+    super(service, {
+      ...options,
+      filePath: "src/infrastructure/README.md",
+      contents: [
+        `# ${service.serviceName}: Infrastructure`,
+        ``,
+        `This directory contains infrastructure definitions and other related files for the ${service.serviceName} service.`
+      ]
+    });
+  }
+};
+
+// src/templates/src/integrations/README.md.ts
+var IntegrationsReadMe = class extends ServiceTemplate {
+  constructor(service, options) {
+    super(service, {
+      ...options,
+      filePath: "src/integrations/README.md",
+      contents: [
+        `# ${service.serviceName}: Integrations`,
+        ``,
+        `This directory contains integration definitions and other related files for the ${service.serviceName} service.`
+      ]
+    });
+  }
+};
+
+// src/templates/src/main.ts
+var SrcMain = class extends ServiceTemplate {
+  constructor(service, options) {
+    super(service, {
+      ...options,
+      filePath: "src/main.ts",
+      contents: [`import { app } from "./app";`, ``, `app.synth();`, ``]
+    });
+  }
+};
+
+// src/templates/src/README.md.ts
+var SrcReadMe = class extends ServiceTemplate {
+  constructor(service, options) {
+    super(service, {
+      ...options,
+      filePath: "src/README.md",
+      contents: [
+        `# ${service.serviceName}: Service Overview`,
+        ``,
+        `This directory contains the main entry point for the ${service.serviceName} service.`
+      ]
+    });
+  }
+};
+
+// src/templates/src/workflows/README.md.ts
+var WorkflowsReadMe = class extends ServiceTemplate {
+  constructor(service, options) {
+    super(service, {
+      ...options,
+      filePath: "src/workflows/README.md",
+      contents: [
+        `# ${service.serviceName}: Workflows`,
+        ``,
+        `This directory contains workflow definitions and other related files for the ${service.serviceName} service.`
+      ]
+    });
+  }
+};
+
+// src/templates/generate-templates.ts
+var GenerateTemplates = class {
+  constructor(service) {
+    this.service = service;
+    new SrcApp(this.service);
+    new SrcAppTest(this.service);
+    new SrcConfig(this.service);
+    new SrcMain(this.service);
+    new SrcReadMe(this.service);
+    new DataReadMe(this.service);
+    new DataModelsReadMe(this.service);
+    new InfrastructureReadMe(this.service);
+    new IntegrationsReadMe(this.service);
+    new WorkflowsReadMe(this.service);
+  }
+};
+
+// src/service.ts
+var OPEN_HI_SERVICE_TYPE = {
+  AUTH: "auth",
+  DATA_SERVICE: "data",
+  GLOBAL: "global",
+  INTEGRATION: "integration",
+  REST_API: "rest-api"
+};
+var OpenHiService = class {
+  constructor(openHi, id, options) {
+    this.openHi = openHi;
+    this.id = id;
+    this.options = options;
+    this.addDeploymentTarget = (awsStageType, awsEnvironmentType, envConfig) => {
+      new import_configulator.AwsDeploymentTarget(this.project, {
+        account: envConfig.account,
+        region: envConfig.region,
+        awsStageType,
+        awsEnvironmentType,
+        localDeployment: true,
+        localDeploymentConfig: {
+          stackPattern: `${awsStageType}/${awsEnvironmentType}/*-${envConfig.account}-${envConfig.region}`,
+          roleName: "poweruseraccess"
+        },
+        ciDeployment: true,
+        ciDeploymentConfig: {
+          roleArn: `arn:aws:iam::${envConfig.account}:role/GitHubOpenHiDeployer`,
+          stackPattern: `${awsStageType}/${awsEnvironmentType}/*-${envConfig.account}-${envConfig.region}`
+        },
+        branches: awsStageType === import_config2.OPEN_HI_STAGE.DEV ? [
+          {
+            branch: "feat/*",
+            description: [
+              "Feature branches for OpenHI (short form).",
+              "These branches are used for developing new features."
+            ]
+          },
+          {
+            branch: "feature/*",
+            description: [
+              "Feature branches for OpenHI.",
+              "These branches are used for developing new features."
+            ]
+          },
+          {
+            branch: "fix/*",
+            description: [
+              "Fix branches for OpenHI.",
+              "This branch pattern is used when a developer is working on a fix on the project."
+            ]
+          }
+        ] : [
+          {
+            branch: "main",
+            description: [
+              "Main branch for OpenHI.",
+              "This branch is used for the main branch."
+            ]
+          }
+        ]
+      });
+    };
+    this.project = new import_projen3.awscdk.AwsCdkTypeScriptApp({
+      /**
+       * Top level project config options
+       */
+      defaultReleaseBranch: "main",
+      name: this.serviceName,
+      outdir: this.outDir,
+      parent: this.openHi.rootProject,
+      cdkVersion: this.options?.config?.versions?.cdk?.cdkLibVersion ?? import_configulator.VERSION.AWS_CDK_LIB_VERSION,
+      cdkCliVersion: this.options?.config?.versions?.cdk?.cdkCliVersion ?? import_configulator.VERSION.AWS_CDK_CLI_VERSION,
+      /**
+       * Packaging options
+       *
+       * TODO: Figure out license for monorepo vs per package?
+       */
+      licensed: false,
+      /**
+       * Node configs
+       */
+      packageManager: import_javascript.NodePackageManager.PNPM,
+      /**
+       * Turn on prettier formatting
+       */
+      prettier: true,
+      /**
+       * Don't generate sample code.
+       */
+      sampleCode: false,
+      /**
+       * Make sure jest config is stored outside of package.json and use SWC
+       * for faster tests.
+       */
+      jestOptions: {
+        configFilePath: "jest.config.json",
+        jestConfig: {
+          transform: {
+            ["^.+\\.[t]sx?$"]: new import_javascript.Transform("@swc/jest")
+          }
+        }
+      },
+      /**
+       * SWC for faster testing
+       */
+      devDeps: ["@swc/jest", "@swc/core"],
+      /**
+       * Don't package test files.
+       */
+      npmIgnoreOptions: {
+        ignorePatterns: ["*.spec.*", "*.test.*"]
+      }
+    });
+    this.project.deps.removeDependency("ts-jest");
+    this.project.addDeps(
+      "@openhi/config@workspace:*",
+      "@openhi/constructs@workspace:*"
+    );
+    new import_configulator.TurboRepo(this.project);
+    new GenerateTemplates(this);
+    [import_config2.OPEN_HI_STAGE.DEV, import_config2.OPEN_HI_STAGE.STAGE, import_config2.OPEN_HI_STAGE.PROD].forEach(
+      (stage) => {
+        const targets = this.options?.config?.deploymentTargets?.[stage];
+        if (targets?.primary) {
+          this.addDeploymentTarget(
+            stage,
+            import_config2.OPEN_HI_DEPLOYMENT_TARGET_ROLE.PRIMARY,
+            targets.primary
+          );
+        }
+        targets?.secondary?.forEach((env) => {
+          this.addDeploymentTarget(
+            stage,
+            import_config2.OPEN_HI_DEPLOYMENT_TARGET_ROLE.SECONDARY,
+            env
+          );
+        });
+      }
+    );
+  }
+  get constructName() {
+    return (0, import_change_case.pascalCase)(["open", "hi", this.id, "service"].join("-"));
+  }
+  get outDir() {
+    return [(0, import_change_case.paramCase)(this.openHi.id), (0, import_change_case.paramCase)(this.id)].join(import_path.sep);
+  }
+  get serviceName() {
+    return [(0, import_change_case.paramCase)(this.openHi.id), (0, import_change_case.paramCase)(this.id)].join("-");
+  }
+};
+
+// src/workflows/aws-teardown-workflow.ts
+var import_configulator2 = require("@codedrifters/configulator");
+var import_config3 = __toESM(require_lib());
+var import_projen4 = require("projen");
+var import_github = require("projen/lib/github");
+var import_workflows_model = require("projen/lib/github/workflows-model");
+var AwsTeardownWorkflow = class extends import_projen4.Component {
+  constructor(rootProject, options) {
+    super(rootProject);
+    this.rootProject = rootProject;
+    const { openhi } = options;
+    if (!(rootProject instanceof import_configulator2.MonorepoProject)) {
+      throw new Error(
+        "AwsTeardownWorkflow requires the root project to be a MonorepoProject"
+      );
+    }
+    const github = import_github.GitHub.of(this.rootProject);
+    if (!github) {
+      throw new Error(
+        "AwsTeardownWorkflow requires a GitHub component in the root project"
+      );
+    }
+    const devTargetsFor = (service) => import_configulator2.AwsDeploymentConfig.of(service.project)?.awsDeploymentTargets.filter(
+      (target) => target.awsStageType === import_config3.OPEN_HI_STAGE.DEV && target.ciDeployment
+    ) ?? [];
+    const awsDestructionTargets = devTargetsFor(openhi.global);
+    const workflow = new import_github.GithubWorkflow(github, "teardown-dev");
+    workflow.on({
+      workflowDispatch: {},
+      schedule: [
+        {
+          cron: "32 6 * * *"
+          // Every Sunday at 6:32 AM UTC
+        }
+      ],
+      delete: {
+        branches: ["feature/*", "feat/*", "fix/*"]
+      }
+      /* for debugging 
+      push: {
+        branches: ["feature/*"],
+      },
+      */
+    });
+    awsDestructionTargets.forEach((target) => {
+      const {
+        awsStageType,
+        awsEnvironmentType,
+        account,
+        region,
+        ciDeploymentConfig
+      } = target;
+      const { roleArn } = ciDeploymentConfig ?? {};
+      workflow.addJob(`teardown-${account}-${region}`.toLowerCase(), {
+        name: `Teardown Stacks in ${target.account}/${target.region}`,
+        //if: "github.event.ref_type == 'branch'",
+        runsOn: ["ubuntu-latest"],
+        permissions: {
+          contents: import_workflows_model.JobPermission.READ,
+          idToken: import_workflows_model.JobPermission.WRITE
+        },
+        env: {
+          REPO: "${{ github.repository }}",
+          REGIONS: [region].join(" ")
+        },
+        steps: [
+          /**
+           * Configure AWS creds.
+           */
+          {
+            name: `AWS Creds ${awsStageType}/${awsEnvironmentType}/${account}/${region}`,
+            uses: "aws-actions/configure-aws-credentials@v4",
+            with: {
+              "role-to-assume": roleArn,
+              "aws-region": region,
+              "role-duration-seconds": 900
+              // 15 minutes
+            }
+          },
+          /**
+           * Fetch all branch names in the repo
+           */
+          {
+            name: "Fetch All Branches",
+            id: "fetch_branches",
+            uses: "actions/github-script@v7",
+            with: {
+              script: [
+                "const all = await github.paginate(github.rest.repos.listBranches, {",
+                "  owner: context.repo.owner,",
+                "  repo: context.repo.repo,",
+                "  per_page: 100",
+                "});",
+                "const names = all.map(b => b.name);",
+                "console.log(`Found branches: ${names}`);",
+                'core.setOutput("json", JSON.stringify(names));'
+              ].join("\n")
+            }
+          },
+          /**
+           * Save branches to a file
+           */
+          {
+            name: "Save Branches to File",
+            run: [
+              'echo "Saving branches to file"',
+              "echo '${{ steps.fetch_branches.outputs.json }}' | jq -r '.[]' | sort -u > branches.txt",
+              'echo "Branches:"',
+              "cat branches.txt"
+            ].join("\n")
+          },
+          /**
+           * Find all stacks tagged with a stage of dev. for this repo. return
+           * tag and resource arn.
+           */
+          {
+            name: "Find Stacks by Tag",
+            id: "find_stacks",
+            run: [
+              "set -euo pipefail",
+              ": > candidates.txt  # columns: arn region branchTag",
+              "# Build tag filters",
+              'TAG_FILTERS=( "Key=openhi:repo-name,Values=$REPO" )',
+              `TAG_FILTERS+=( "Key=openhi:stage-type,Values=${import_config3.OPEN_HI_STAGE.DEV}" )`,
+              "for r in $REGIONS; do",
+              `  echo "Scanning region: $r"`,
+              "  aws resourcegroupstaggingapi get-resources \\",
+              '    --region "$r" \\',
+              '    --resource-type-filters "cloudformation:stack" \\',
+              '    --tag-filters "${TAG_FILTERS[@]}" \\',
+              ` | jq -r --arg r "$r" '`,
+              "    .ResourceTagMappingList[]",
+              "    | . as $res",
+              '    | ($res.Tags[] | select(.Key=="openhi:branch-name") | .Value) as $branch',
+              '    | [$res.ResourceARN, $r, ($branch // "")]',
+              "    | @tsv",
+              "    ' >> candidates.txt",
+              "done",
+              "echo 'Tagged stacks:'",
+              `(echo -e "ARN\\tREGION\\tBRANCH"; cat candidates.txt) | column -t -s $'\\t'`
+            ].join("\n")
+          },
+          /**
+           * Determine which stacks are orphans that no longer have a matching branch.
+           * Save those to a file for the next step.
+           */
+          {
+            name: "Determine Orphan Stacks (No Matching Branch)",
+            run: [
+              "set -euo pipefail",
+              ": > orphans.txt  # arn region branch",
+              "while IFS=$'\\t' read -r arn region branch; do",
+              '  [ -z "$arn" ] && continue',
+              '  if [ -z "$branch" ]; then',
+              "    # If no Branch tag, treat as not-a-preview; skip (or flip to delete if you want)",
+              "    continue",
+              "  fi",
+              '  if ! grep -Fxq "$branch" branches.txt; then',
+              '    echo -e "$arn\\t$region\\t$branch" >> orphans.txt',
+              "  fi",
+              "done < candidates.txt",
+              "",
+              "if [ -s orphans.txt ]; then",
+              '  echo "Orphan stacks (no matching branch):"',
+              `  (echo -e "ARN\\tREGION\\tBRANCH"; cat orphans.txt) | column -t -s $'\\t'`,
+              "else",
+              '  echo "No orphan stacks found."',
+              "fi"
+            ].join("\n")
+          },
+          /**
+           * Delete orphan stacks.
+           */
+          {
+            name: "Delete Orphan Stacks",
+            if: "hashFiles('orphans.txt') != ''",
+            run: [
+              "set -euo pipefail",
+              "while IFS=$'\\t' read -r arn region branch; do",
+              '  [ -z "$arn" ] && continue',
+              `  stack_name=$(cut -d'/' -f2 <<<"$arn")`,
+              '  echo "Deleting $stack_name (branch=$branch) in $region"',
+              '  aws cloudformation delete-stack --region "$region" --stack-name "$stack_name" || true',
+              "done < orphans.txt"
+            ].join("\n")
+          }
+        ]
+      });
+    });
+  }
+};
+
+// src/workflows/build-dev-workflow.ts
+var import_configulator3 = require("@codedrifters/configulator");
+var import_projen5 = require("projen");
+var BuildDevelopmentWorkflow = class extends import_projen5.Component {
+  constructor(parent, options) {
+    super(parent, "dev-workflow");
+    const { openhi } = options;
+    const { awsDeploymentTargets: globalTargets } = new import_configulator3.AwsDeployWorkflow(
+      openhi.global.project,
+      {
+        buildWorkflow: parent.buildWorkflow
+      }
+    );
+    const { awsDeploymentTargets: authTargets } = new import_configulator3.AwsDeployWorkflow(
+      openhi.auth.project,
+      {
+        buildWorkflow: parent.buildWorkflow,
+        deployAfterTargets: [...globalTargets]
+      }
+    );
+    const { awsDeploymentTargets: dataTargets } = new import_configulator3.AwsDeployWorkflow(
+      openhi.data.project,
+      {
+        buildWorkflow: parent.buildWorkflow,
+        deployAfterTargets: [...globalTargets, ...authTargets]
+      }
+    );
+    new import_configulator3.AwsDeployWorkflow(openhi.restApi.project, {
+      buildWorkflow: parent.buildWorkflow,
+      deployAfterTargets: [...globalTargets, ...authTargets, ...dataTargets]
+    });
+  }
+};
+
+// src/workflows/build-stage-workflow.ts
+var import_configulator4 = require("@codedrifters/configulator");
+var import_config4 = __toESM(require_lib());
+var import_projen6 = require("projen");
+var BuildStageWorkflow = class extends import_projen6.Component {
+  constructor(parent, options) {
+    super(parent, "stage-workflow");
+    const { openhi } = options;
+    const { awsDeploymentTargets: globalTargets, buildWorkflow } = new import_configulator4.AwsDeployWorkflow(openhi.global.project, {
+      awsStageType: import_config4.OPEN_HI_STAGE.STAGE,
+      buildWorkflowOptions: {
+        name: "deploy-stage",
+        workflowTriggers: {
+          push: {
+            branches: ["main"]
+          },
+          workflowDispatch: {}
+        }
+      }
+    });
+    const { awsDeploymentTargets: authTargets } = new import_configulator4.AwsDeployWorkflow(
+      openhi.auth.project,
+      {
+        awsStageType: import_config4.OPEN_HI_STAGE.STAGE,
+        buildWorkflow,
+        deployAfterTargets: [...globalTargets]
+      }
+    );
+    const { awsDeploymentTargets: dataTargets } = new import_configulator4.AwsDeployWorkflow(
+      openhi.data.project,
+      {
+        awsStageType: import_config4.OPEN_HI_STAGE.STAGE,
+        buildWorkflow,
+        deployAfterTargets: [...globalTargets, ...authTargets]
+      }
+    );
+    new import_configulator4.AwsDeployWorkflow(openhi.restApi.project, {
+      awsStageType: import_config4.OPEN_HI_STAGE.STAGE,
+      buildWorkflow,
+      deployAfterTargets: [...globalTargets, ...authTargets, ...dataTargets]
+    });
+  }
+};
+
+// src/openhi.ts
+var OpenHi = class {
+  constructor(options = {}) {
+    this.options = (0, import_ts_deepmerge.merge)({ name: "openhi" }, options);
+    this.rootProject = this.options.rootProject;
+    this.id = this.options.rootProject?.name ?? "openhi";
+    if (!this.rootProject) {
+      throw new Error(
+        "OpenHi requires a MonorepoProject to be passed in via the rootProject option"
+      );
+    }
+    const rootProject = this.rootProject;
+    this.global = new OpenHiService(this, "global", {
+      type: OPEN_HI_SERVICE_TYPE.GLOBAL,
+      config: (0, import_ts_deepmerge.merge)(
+        this.options?.defaultConfig ?? {},
+        this.options?.globalServiceConfig ?? {}
+      )
+    });
+    this.auth = new OpenHiService(this, "auth", {
+      type: OPEN_HI_SERVICE_TYPE.AUTH,
+      config: (0, import_ts_deepmerge.merge)(
+        this.options?.defaultConfig ?? {},
+        this.options?.authServiceConfig ?? {}
+      )
+    });
+    this.restApi = new OpenHiService(this, "rest-api", {
+      type: OPEN_HI_SERVICE_TYPE.REST_API,
+      config: (0, import_ts_deepmerge.merge)(
+        this.options?.defaultConfig ?? {},
+        this.options?.restApiServiceConfig ?? {}
+      )
+    });
+    this.data = new OpenHiService(this, "data", {
+      type: OPEN_HI_SERVICE_TYPE.DATA_SERVICE,
+      config: (0, import_ts_deepmerge.merge)(
+        this.options?.defaultConfig ?? {},
+        this.options?.dataServiceConfig ?? {}
+      )
+    });
+    new BuildDevelopmentWorkflow(rootProject, { openhi: this });
+    new BuildStageWorkflow(rootProject, { openhi: this });
+    new AwsTeardownWorkflow(rootProject, { openhi: this });
+  }
+};
+// Annotate the CommonJS export names for ESM import in node:
+0 && (module.exports = {
+  OPEN_HI_SERVICE_TYPE,
+  OpenHi,
+  OpenHiService
+});
+//# sourceMappingURL=index.js.map