anton-bakker-deploy-engine 0.1.0

package/dist/index.d.ts

@@ -0,0 +1,7 @@
+/**
+ * anton-bakker-deploy-engine
+ *
+ * Self-validating AWS deployment engine.
+ * 4-layer verification: exists → configured → functional → project-specific.
+ */
+export { verifyAmplifyOutputs, verifyBuildArtifact, parseTableCount, assertTableCount, parseEcsStatus, assertCognitoGroups, assertApiHealth, deriveExpectations, summarize, type CheckResult, type PostBuildResult, type PostDeployResult, type DeployExpectations, } from './verify.js';

package/dist/index.js

@@ -0,0 +1,15 @@
+/**
+ * anton-bakker-deploy-engine
+ *
+ * Self-validating AWS deployment engine.
+ * 4-layer verification: exists → configured → functional → project-specific.
+ */
+export { 
+// Post-build verification
+verifyAmplifyOutputs, verifyBuildArtifact, 
+// Post-deploy assertions
+parseTableCount, assertTableCount, parseEcsStatus, assertCognitoGroups, assertApiHealth, 
+// Expectations derivation
+deriveExpectations, 
+// Summary
+summarize, } from './verify.js';

package/dist/verify.d.ts

@@ -0,0 +1,79 @@
+/**
+ * verify.ts
+ * Location: anton-bakker-deploy-engine/src/verify.ts
+ *
+ * Generic AWS deployment verification functions.
+ * Validates amplify_outputs.json, build artifacts, DynamoDB, ECS, Cognito, and API health.
+ * Project-agnostic — works with any AWS CDK project.
+ */
+export interface PostBuildResult {
+    passed: boolean;
+    checks: CheckResult[];
+}
+export interface CheckResult {
+    name: string;
+    passed: boolean;
+    expected?: string;
+    actual?: string;
+    error?: string;
+}
+/**
+ * Verify amplify_outputs.json has all required fields.
+ */
+export declare function verifyAmplifyOutputs(outputsPath: string): CheckResult[];
+/**
+ * Scan built JS for environment leaks.
+ */
+export declare function verifyBuildArtifact(distDir: string): CheckResult[];
+export interface PostDeployResult {
+    passed: boolean;
+    checks: CheckResult[];
+    tableCount: number;
+}
+/**
+ * Parse table count from AWS CLI JSON output.
+ */
+export declare function parseTableCount(awsOutput: string | null, prefix: string): CheckResult & {
+    count: number;
+};
+/**
+ * Verify table count meets expected minimum.
+ */
+export declare function assertTableCount(actual: number, expected: number): CheckResult;
+/**
+ * Parse ECS service status from AWS CLI JSON output.
+ */
+export declare function parseEcsStatus(awsOutput: string | null): CheckResult;
+/**
+ * Verify Cognito groups contain all required groups.
+ */
+export declare function assertCognitoGroups(actualGroups: string[], requiredGroups: string[]): CheckResult;
+/**
+ * Verify API health check response.
+ */
+export declare function assertApiHealth(response: string | null): CheckResult;
+export interface DeployExpectations {
+    tableCount: number;
+    tableNames: string[];
+    cognitoGroups: string[];
+    apiDomain: string;
+}
+/**
+ * Derive expected values from source of truth files.
+ * Pass the paths to your schema, auth stack, and config — no assumptions about project layout.
+ */
+export declare function deriveExpectations(opts: {
+    schemaPath: string;
+    authStackPath?: string;
+    configPath: string;
+    envShort: string;
+}): DeployExpectations;
+/**
+ * Aggregate check results into a pass/fail summary.
+ */
+export declare function summarize(checks: CheckResult[]): {
+    passed: boolean;
+    total: number;
+    failed: number;
+    errors: string[];
+};

package/dist/verify.js

@@ -0,0 +1,239 @@
+/**
+ * verify.ts
+ * Location: anton-bakker-deploy-engine/src/verify.ts
+ *
+ * Generic AWS deployment verification functions.
+ * Validates amplify_outputs.json, build artifacts, DynamoDB, ECS, Cognito, and API health.
+ * Project-agnostic — works with any AWS CDK project.
+ */
+import { readFileSync, readdirSync } from 'fs';
+import { join } from 'path';
+/**
+ * Verify amplify_outputs.json has all required fields.
+ */
+export function verifyAmplifyOutputs(outputsPath) {
+    const results = [];
+    let outputs;
+    try {
+        outputs = JSON.parse(readFileSync(outputsPath, 'utf-8'));
+    }
+    catch (err) {
+        return [{ name: 'amplify_outputs.json readable', passed: false, error: `Cannot read: ${err.message}` }];
+    }
+    results.push({
+        name: 'version field present',
+        passed: !!outputs.version,
+        expected: '"1.4"',
+        actual: outputs.version ? String(outputs.version) : 'missing',
+    });
+    results.push({
+        name: 'version is 1.4',
+        passed: outputs.version === '1.4',
+        expected: '1.4',
+        actual: String(outputs.version ?? 'missing'),
+    });
+    const dataUrl = outputs.data?.url;
+    results.push({
+        name: 'data.url present',
+        passed: !!dataUrl,
+        expected: 'https://...',
+        actual: dataUrl || 'missing',
+    });
+    results.push({
+        name: 'data.url is HTTPS',
+        passed: !!dataUrl?.startsWith('https://'),
+        expected: 'starts with https://',
+        actual: dataUrl ? dataUrl.substring(0, 30) : 'missing',
+    });
+    const authPoolId = outputs.auth?.user_pool_id;
+    results.push({
+        name: 'auth.user_pool_id present',
+        passed: !!authPoolId,
+        expected: 'eu-central-1_...',
+        actual: authPoolId || 'missing',
+    });
+    const authClientId = outputs.auth?.user_pool_client_id;
+    results.push({
+        name: 'auth.user_pool_client_id present',
+        passed: !!authClientId,
+        expected: 'non-empty string',
+        actual: authClientId ? `${authClientId.substring(0, 8)}...` : 'missing',
+    });
+    return results;
+}
+/**
+ * Scan built JS for environment leaks.
+ */
+export function verifyBuildArtifact(distDir) {
+    const results = [];
+    const assetsDir = join(distDir, 'assets');
+    let files;
+    try {
+        files = readdirSync(assetsDir);
+    }
+    catch {
+        return [{ name: 'dist/assets readable', passed: false, error: `Cannot read ${assetsDir}` }];
+    }
+    const indexJs = files.find(f => f.startsWith('index-') && f.endsWith('.js'));
+    if (!indexJs) {
+        return [{ name: 'index JS bundle exists', passed: false, error: 'No index-*.js found in dist/assets' }];
+    }
+    const content = readFileSync(join(assetsDir, indexJs), 'utf-8');
+    results.push({
+        name: 'no localhost:4000 in build',
+        passed: !content.includes('localhost:4000'),
+        expected: 'absent',
+        actual: content.includes('localhost:4000') ? 'FOUND — .env.local leaked' : 'absent',
+    });
+    results.push({
+        name: 'no localhost:5173 in build',
+        passed: !content.includes('localhost:5173'),
+        expected: 'absent',
+        actual: content.includes('localhost:5173') ? 'FOUND' : 'absent',
+    });
+    const httpAlbMatch = content.match(/http:\/\/[^"]*\.elb\.amazonaws\.com/);
+    results.push({
+        name: 'no HTTP ALB URLs in build',
+        passed: !httpAlbMatch,
+        expected: 'absent',
+        actual: httpAlbMatch ? `FOUND: ${httpAlbMatch[0]}` : 'absent',
+    });
+    return results;
+}
+/**
+ * Parse table count from AWS CLI JSON output.
+ */
+export function parseTableCount(awsOutput, prefix) {
+    if (!awsOutput) {
+        return { name: 'DynamoDB table count', passed: false, count: 0, error: 'No output from AWS CLI' };
+    }
+    try {
+        const tables = JSON.parse(awsOutput);
+        const prefixed = tables.filter(t => t.startsWith(`${prefix}-`));
+        return {
+            name: 'DynamoDB table count',
+            passed: true,
+            count: prefixed.length,
+            actual: String(prefixed.length),
+        };
+    }
+    catch {
+        const count = parseInt(awsOutput.trim(), 10);
+        return {
+            name: 'DynamoDB table count',
+            passed: !isNaN(count),
+            count: isNaN(count) ? 0 : count,
+            actual: awsOutput.trim(),
+        };
+    }
+}
+/**
+ * Verify table count meets expected minimum.
+ */
+export function assertTableCount(actual, expected) {
+    return {
+        name: `DynamoDB tables ≥ ${expected}`,
+        passed: actual >= expected,
+        expected: String(expected),
+        actual: String(actual),
+        error: actual < expected ? `${expected - actual} tables missing` : undefined,
+    };
+}
+/**
+ * Parse ECS service status from AWS CLI JSON output.
+ */
+export function parseEcsStatus(awsOutput) {
+    if (!awsOutput) {
+        return { name: 'ECS service status', passed: false, error: 'No output from AWS CLI' };
+    }
+    try {
+        const ecs = JSON.parse(awsOutput);
+        const running = ecs.running ?? ecs.runningCount ?? 0;
+        const desired = ecs.desired ?? ecs.desiredCount ?? 0;
+        const status = ecs.status ?? 'UNKNOWN';
+        return {
+            name: 'ECS service healthy',
+            passed: status === 'ACTIVE' && running >= desired && desired > 0,
+            expected: `ACTIVE, running ≥ ${desired}`,
+            actual: `${status}, running=${running}, desired=${desired}`,
+            error: running < desired ? `${desired - running} tasks not running` : undefined,
+        };
+    }
+    catch {
+        return { name: 'ECS service status', passed: false, error: `Invalid JSON: ${awsOutput.substring(0, 100)}` };
+    }
+}
+/**
+ * Verify Cognito groups contain all required groups.
+ */
+export function assertCognitoGroups(actualGroups, requiredGroups) {
+    const missing = requiredGroups.filter(g => !actualGroups.includes(g));
+    return {
+        name: 'Cognito required groups',
+        passed: missing.length === 0,
+        expected: requiredGroups.join(', '),
+        actual: actualGroups.join(', '),
+        error: missing.length > 0 ? `Missing: ${missing.join(', ')}` : undefined,
+    };
+}
+/**
+ * Verify API health check response.
+ */
+export function assertApiHealth(response) {
+    return {
+        name: 'API health (__typename)',
+        passed: !!response?.includes('__typename'),
+        expected: 'contains __typename',
+        actual: response ? response.substring(0, 100) : 'no response',
+    };
+}
+/**
+ * Derive expected values from source of truth files.
+ * Pass the paths to your schema, auth stack, and config — no assumptions about project layout.
+ */
+export function deriveExpectations(opts) {
+    const config = JSON.parse(readFileSync(opts.configPath, 'utf-8'));
+    // Count models from GraphQL schema — these become DynamoDB tables
+    const schema = readFileSync(opts.schemaPath, 'utf-8');
+    const allTypes = (schema.match(/^type (\w+) \{/gm) || []).map(m => m.match(/^type (\w+)/)[1]);
+    const tableNames = allTypes.filter(n => !['Query', 'Mutation', 'Subscription'].includes(n) &&
+        !n.endsWith('Input') && !n.endsWith('Connection'));
+    // Cognito groups from auth stack (optional)
+    let cognitoGroups = [];
+    if (opts.authStackPath) {
+        try {
+            const authStack = readFileSync(opts.authStackPath, 'utf-8');
+            // Match: groupName: 'X' (direct assignment)
+            const direct = [...authStack.matchAll(/groupName:\s*'(\w+)'/g)].map(m => m[1]);
+            // Match: for (... of ['X', 'Y', 'Z']) pattern used for group creation
+            const loopMatch = authStack.match(/\[([^\]]*)\].*?(?:groupName|Group)/s)
+                || authStack.match(/(?:groupName|Group).*?\[([^\]]*)\]/s)
+                || authStack.match(/for\s*\([^)]*of\s*\[([^\]]*)\]/);
+            const fromLoop = loopMatch
+                ? [...loopMatch[1].matchAll(/'(\w+)'/g)].map(m => m[1])
+                : [];
+            cognitoGroups = [...new Set([...direct, ...fromLoop])];
+        }
+        catch { /* auth stack may not exist yet */ }
+    }
+    const apiDomain = `${config.dns?.apiSubdomain || 'api'}.${config.dns?.zoneName || 'example.com'}`;
+    return {
+        tableCount: tableNames.length,
+        tableNames,
+        cognitoGroups,
+        apiDomain,
+    };
+}
+// ── Summary ─────────────────────────────────────────────────────────────
+/**
+ * Aggregate check results into a pass/fail summary.
+ */
+export function summarize(checks) {
+    const failed = checks.filter(c => !c.passed);
+    return {
+        passed: failed.length === 0,
+        total: checks.length,
+        failed: failed.length,
+        errors: failed.map(c => c.error || `${c.name}: expected ${c.expected}, got ${c.actual}`),
+    };
+}

package/package.json

@@ -0,0 +1,36 @@
+{
+  "name": "anton-bakker-deploy-engine",
+  "version": "0.1.0",
+  "description": "Self-validating AWS deployment engine with 4-layer verification: exists, configured, functional, project-specific",
+  "main": "dist/index.js",
+  "types": "dist/index.d.ts",
+  "type": "module",
+  "scripts": {
+    "build": "tsc",
+    "test": "vitest run",
+    "lint": "eslint src/ --max-warnings 0",
+    "prepublishOnly": "npm run build",
+    "release:publish": "bash scripts/publish.sh",
+    "release:publish:latest": "NPM_TAG=latest bash scripts/publish.sh"
+  },
+  "keywords": [
+    "aws",
+    "deployment",
+    "verification",
+    "cdk",
+    "devops"
+  ],
+  "author": "Anton Bakker",
+  "license": "MIT",
+  "files": [
+    "dist/"
+  ],
+  "engines": {
+    "node": ">=20"
+  },
+  "devDependencies": {
+    "typescript": "^5.8.3",
+    "vitest": "^4.1.2",
+    "@types/node": "^20.0.0"
+  }
+}