hook-harness 0.0.0-stage → 0.1.0

package/dist/relay/template.yaml

@@ -0,0 +1,146 @@
+AWSTemplateFormatVersion: "2010-09-09"
+Description: hook-harness relay - webhook Lambda function URL backed by a DynamoDB table.
+
+Parameters:
+  WebhookSecret:
+    Type: String
+    NoEcho: true
+    MinLength: 1
+    Description: Secret configured on the webhook sender, used to verify X-Hub-Signature-256.
+  PayloadDrop:
+    Type: String
+    Default: repository,organization
+    Description: Comma-separated top-level payload keys not stored (installation is always dropped). Empty keeps them.
+  PayloadMaxBytes:
+    Type: Number
+    Default: 1000000
+    MinValue: 0
+    Description: Largest pruned payload, in JSON bytes, to store. 0 stores envelopes only.
+  BillingMode:
+    Type: String
+    Default: PROVISIONED
+    AllowedValues: [PROVISIONED, PAY_PER_REQUEST]
+  ReadCapacity:
+    Type: Number
+    Default: 25
+    MinValue: 1
+  WriteCapacity:
+    Type: Number
+    Default: 25
+    MinValue: 1
+
+Conditions:
+  IsProvisioned: !Equals [!Ref BillingMode, PROVISIONED]
+
+Resources:
+  Table:
+    Type: AWS::DynamoDB::Table
+    Properties:
+      TableName: !Sub "${AWS::StackName}-events"
+      BillingMode: !Ref BillingMode
+      ProvisionedThroughput: !If
+        - IsProvisioned
+        - ReadCapacityUnits: !Ref ReadCapacity
+          WriteCapacityUnits: !Ref WriteCapacity
+        - !Ref AWS::NoValue
+      AttributeDefinitions:
+        - AttributeName: PK
+          AttributeType: S
+        - AttributeName: SK
+          AttributeType: S
+      KeySchema:
+        - AttributeName: PK
+          KeyType: HASH
+        - AttributeName: SK
+          KeyType: RANGE
+      TimeToLiveSpecification:
+        AttributeName: expiresAt
+        Enabled: true
+      PointInTimeRecoverySpecification:
+        PointInTimeRecoveryEnabled: false
+
+  FunctionRole:
+    Type: AWS::IAM::Role
+    Properties:
+      AssumeRolePolicyDocument:
+        Version: "2012-10-17"
+        Statement:
+          - Effect: Allow
+            Principal:
+              Service: lambda.amazonaws.com
+            Action: sts:AssumeRole
+      ManagedPolicyArns:
+        - arn:aws:iam::aws:policy/service-role/AWSLambdaBasicExecutionRole
+      Policies:
+        - PolicyName: table-access
+          PolicyDocument:
+            Version: "2012-10-17"
+            Statement:
+              - Effect: Allow
+                Action:
+                  - dynamodb:GetItem
+                  - dynamodb:PutItem
+                  - dynamodb:Query
+                Resource: !GetAtt Table.Arn
+
+  LogGroup:
+    Type: AWS::Logs::LogGroup
+    Properties:
+      LogGroupName: !Sub "/aws/lambda/${AWS::StackName}-relay"
+      RetentionInDays: 1
+
+  Function:
+    Type: AWS::Lambda::Function
+    DependsOn: LogGroup
+    Properties:
+      FunctionName: !Sub "${AWS::StackName}-relay"
+      Runtime: nodejs24.x
+      Architectures: [arm64]
+      MemorySize: 256
+      Timeout: 10
+      Handler: index.handler
+      Role: !GetAtt FunctionRole.Arn
+      LoggingConfig:
+        LogFormat: JSON
+        SystemLogLevel: WARN
+        ApplicationLogLevel: INFO
+      Environment:
+        Variables:
+          TABLE_NAME: !Ref Table
+          WEBHOOK_SECRET: !Ref WebhookSecret
+          PAYLOAD_DROP: !Ref PayloadDrop
+          PAYLOAD_MAX_BYTES: !Ref PayloadMaxBytes
+      # Placeholder only: the CLI uploads the real bundle with UpdateFunctionCode after every stack update.
+      Code:
+        ZipFile: |
+          exports.handler = async () => ({ statusCode: 503, body: "not deployed" });
+
+  FunctionUrl:
+    Type: AWS::Lambda::Url
+    Properties:
+      TargetFunctionArn: !GetAtt Function.Arn
+      AuthType: NONE
+
+  UrlInvokePermission:
+    Type: AWS::Lambda::Permission
+    Properties:
+      FunctionName: !Ref Function
+      Action: lambda:InvokeFunctionUrl
+      Principal: "*"
+      FunctionUrlAuthType: NONE
+
+  InvokePermission:
+    Type: AWS::Lambda::Permission
+    Properties:
+      FunctionName: !Ref Function
+      Action: lambda:InvokeFunction
+      Principal: "*"
+      InvokedViaFunctionUrl: true
+
+Outputs:
+  FunctionUrl:
+    Value: !GetAtt FunctionUrl.FunctionUrl
+  FunctionName:
+    Value: !Ref Function
+  TableName:
+    Value: !Ref Table

package/package.json

@@ -1,6 +1,52 @@
 {
   "name": "hook-harness",
-  "version": "0.0.0-stage",
-  "stub": true,
-  "description": "Temporary package placeholder for staged publishing"
-}
+  "version": "0.1.0",
+  "description": "hook-harness CLI: deploy, update, teardown, status, tokens, and the runner service.",
+  "keywords": [
+    "agents",
+    "aws",
+    "claude-code",
+    "cli",
+    "codex",
+    "github",
+    "lambda",
+    "webhooks"
+  ],
+  "homepage": "https://github.com/jonathanong/hook-harness#readme",
+  "bugs": {
+    "url": "https://github.com/jonathanong/hook-harness/issues"
+  },
+  "license": "MIT",
+  "repository": {
+    "type": "git",
+    "url": "git+https://github.com/jonathanong/hook-harness.git",
+    "directory": "packages/cli"
+  },
+  "bin": {
+    "hook-harness": "./dist/bin.mjs"
+  },
+  "files": [
+    "dist"
+  ],
+  "type": "module",
+  "publishConfig": {
+    "access": "public",
+    "provenance": true
+  },
+  "scripts": {
+    "build": "node build.mjs"
+  },
+  "devDependencies": {
+    "@aws-sdk/client-cloudformation": "3.1165.0",
+    "@aws-sdk/client-dynamodb": "3.1165.0",
+    "@aws-sdk/client-lambda": "3.1165.0",
+    "@aws-sdk/lib-dynamodb": "3.1165.0",
+    "@hook-harness/protocol": "workspace:*",
+    "@hook-harness/relay": "workspace:*",
+    "aws-sdk-client-mock": "4.1.0",
+    "esbuild": "0.28.2"
+  },
+  "engines": {
+    "node": ">=24"
+  }
+}

package/README.md

@@ -1,3 +0,0 @@
-# Temporary Holding Version
-
-This version is a temporary placeholder for this package. An operational version to replace this has been submitted for review and is awaiting a staged release.