stratactl 1.0.0__tar.gz

stratactl-1.0.0/PKG-INFO

@@ -0,0 +1,119 @@
+Metadata-Version: 2.4
+Name: stratactl
+Version: 1.0.0
+Summary: StrataCTL — bootstrap StrataCI into a customer AWS account and install/update/uninstall StrataBI modules via an ephemeral CodeBuild runner.
+Author-email: Shaleio LLC <info@shaleio.com>
+License: Apache-2.0
+Project-URL: Homepage, https://shaleio.com
+Project-URL: Documentation, https://shaleio.com/docs
+Project-URL: Source, https://github.com/shaleio/stratactl
+Project-URL: Issues, https://github.com/shaleio/stratactl/issues
+Keywords: stratabi,aws,codebuild,opentofu,terraform,cli,analytics
+Classifier: Development Status :: 4 - Beta
+Classifier: Environment :: Console
+Classifier: Intended Audience :: Developers
+Classifier: Intended Audience :: System Administrators
+Classifier: License :: OSI Approved :: Apache Software License
+Classifier: Operating System :: OS Independent
+Classifier: Programming Language :: Python :: 3
+Classifier: Programming Language :: Python :: 3.11
+Classifier: Programming Language :: Python :: 3.12
+Classifier: Topic :: System :: Installation/Setup
+Classifier: Topic :: System :: Systems Administration
+Requires-Python: >=3.11
+Description-Content-Type: text/markdown
+Requires-Dist: boto3>=1.34
+Requires-Dist: pyyaml>=6
+Requires-Dist: platformdirs>=4
+Provides-Extra: runner
+Requires-Dist: cryptography>=42; extra == "runner"
+Provides-Extra: dev
+Requires-Dist: pytest>=8; extra == "dev"
+Requires-Dist: build>=1; extra == "dev"
+Requires-Dist: twine>=5; extra == "dev"
+
+# StrataCTL
+
+The local command-line tool for operators. It installs, updates, and removes
+StrataBI modules and the StrataBI platform in **your** AWS account, fetches the
+account-entitled runtime, and version-controls dashboards. It runs on your machine
+with your own AWS credentials — it is not a hosted service.
+
+The same `strata` package is also the **runner program** that executes inside the
+ephemeral CodeBuild runner (`python -m strata.runner`).
+
+## Install
+
+```bash
+python3 -m venv ~/.venvs/strata && source ~/.venvs/strata/bin/activate
+pip install -e .            # from this directory; exposes the `stratactl` command
+stratactl --help
+```
+
+## Configure
+
+`strata init` collects a deployment's configuration into `strata.yaml` (the source
+of truth) and generates the Terraform variable files — you don't hand-edit `.tfvars`.
+
+```bash
+stratactl init                     # interactive; re-run to reuse answers + fill gaps
+stratactl init --non-interactive   # config + defaults only (automation)
+```
+
+Settings resolve in this precedence (highest first): **CLI flag → env (`STRATA_*`)
+→ `./.stratactl.toml` → `~/.stratactl/config.toml` → AWS SSM (`/strataci/hq/*`) →
+packaged defaults**. Point it at a customer account by pasting the
+`stratactl_customer_config` output from `strataci-runner` into your config, and set
+your license token:
+
+```bash
+export STRATA_HQ_TOKEN=<your license token>
+```
+
+AWS credentials come from your normal profile/keys (`--profile`, `AWS_PROFILE`, env).
+What you can deploy is governed by your own IAM in the target account.
+
+## Commands
+
+```bash
+stratactl init                            # configure a deployment (writes strata.yaml + tfvars)
+stratactl fetch-runtime --version 1.0.0   # pull the account-entitled runtime wheel -> ./dist (verified)
+stratactl install <module>                # entitlement -> runner -> tofu apply, in your account
+stratactl install-stratabi                # install the StrataBI platform (Enterprise)
+stratactl install-stratabi-dev            # install the Developer/Community edition
+stratactl update <module> --to <version>
+stratactl uninstall <module>              # runs the module's tofu destroy (always available)
+stratactl list                            # what's installed + delivery mode
+stratactl logs <job-id>                   # tail/replay a runner build
+stratactl dashboards pull|push|list|diff  # git-sync dashboards (no runner needed)
+```
+
+`--source stratahq` (default) fetches a signed bundle from Shaleio's control plane;
+`--source customer_s3` installs from your own bucket (offline / air-gapped).
+
+## End-to-end: deploy StrataBI Enterprise
+
+```bash
+# 0. one-time per account: scaffold the runner  (see ../strataci-runner)
+# 1. build the runtime container image          (see ../build_template)  -> ECR image URI
+# 2. configure + deploy:
+export STRATA_HQ_TOKEN=<token>
+stratactl init            # set stratabi_image=<ECR URI>, vpc_id, subnets, allowed_ip_cidrs
+stratactl install-stratabi
+stratactl list
+```
+
+Your `strata init` values ride through to the ephemeral runner automatically (the
+CLI uploads them; the runner applies them over the bundle's baked defaults), so the
+platform deploys with your networking/image without any manual `.tfvars` on the runner.
+
+## Layout
+
+| Path | What |
+|------|------|
+| `src/strata/commands/` | CLI subcommands (`init`, `install`, `fetch_runtime`, `dashboards`, …) |
+| `src/strata/hq/` | StrataHQ client (SigV4-signed entitlement calls) |
+| `src/strata/runner/` | the program that runs inside CodeBuild |
+| `src/strata/install/` | the `strata init` wizard (schema / prompt / store / tfvars) |
+| `src/strata/artifacts/` | bundle download / verify / manifest |
+| `tests/` | unit tests (`pytest`) |

stratactl-1.0.0/README.md

@@ -0,0 +1,85 @@
+# StrataCTL
+
+The local command-line tool for operators. It installs, updates, and removes
+StrataBI modules and the StrataBI platform in **your** AWS account, fetches the
+account-entitled runtime, and version-controls dashboards. It runs on your machine
+with your own AWS credentials — it is not a hosted service.
+
+The same `strata` package is also the **runner program** that executes inside the
+ephemeral CodeBuild runner (`python -m strata.runner`).
+
+## Install
+
+```bash
+python3 -m venv ~/.venvs/strata && source ~/.venvs/strata/bin/activate
+pip install -e .            # from this directory; exposes the `stratactl` command
+stratactl --help
+```
+
+## Configure
+
+`strata init` collects a deployment's configuration into `strata.yaml` (the source
+of truth) and generates the Terraform variable files — you don't hand-edit `.tfvars`.
+
+```bash
+stratactl init                     # interactive; re-run to reuse answers + fill gaps
+stratactl init --non-interactive   # config + defaults only (automation)
+```
+
+Settings resolve in this precedence (highest first): **CLI flag → env (`STRATA_*`)
+→ `./.stratactl.toml` → `~/.stratactl/config.toml` → AWS SSM (`/strataci/hq/*`) →
+packaged defaults**. Point it at a customer account by pasting the
+`stratactl_customer_config` output from `strataci-runner` into your config, and set
+your license token:
+
+```bash
+export STRATA_HQ_TOKEN=<your license token>
+```
+
+AWS credentials come from your normal profile/keys (`--profile`, `AWS_PROFILE`, env).
+What you can deploy is governed by your own IAM in the target account.
+
+## Commands
+
+```bash
+stratactl init                            # configure a deployment (writes strata.yaml + tfvars)
+stratactl fetch-runtime --version 1.0.0   # pull the account-entitled runtime wheel -> ./dist (verified)
+stratactl install <module>                # entitlement -> runner -> tofu apply, in your account
+stratactl install-stratabi                # install the StrataBI platform (Enterprise)
+stratactl install-stratabi-dev            # install the Developer/Community edition
+stratactl update <module> --to <version>
+stratactl uninstall <module>              # runs the module's tofu destroy (always available)
+stratactl list                            # what's installed + delivery mode
+stratactl logs <job-id>                   # tail/replay a runner build
+stratactl dashboards pull|push|list|diff  # git-sync dashboards (no runner needed)
+```
+
+`--source stratahq` (default) fetches a signed bundle from Shaleio's control plane;
+`--source customer_s3` installs from your own bucket (offline / air-gapped).
+
+## End-to-end: deploy StrataBI Enterprise
+
+```bash
+# 0. one-time per account: scaffold the runner  (see ../strataci-runner)
+# 1. build the runtime container image          (see ../build_template)  -> ECR image URI
+# 2. configure + deploy:
+export STRATA_HQ_TOKEN=<token>
+stratactl init            # set stratabi_image=<ECR URI>, vpc_id, subnets, allowed_ip_cidrs
+stratactl install-stratabi
+stratactl list
+```
+
+Your `strata init` values ride through to the ephemeral runner automatically (the
+CLI uploads them; the runner applies them over the bundle's baked defaults), so the
+platform deploys with your networking/image without any manual `.tfvars` on the runner.
+
+## Layout
+
+| Path | What |
+|------|------|
+| `src/strata/commands/` | CLI subcommands (`init`, `install`, `fetch_runtime`, `dashboards`, …) |
+| `src/strata/hq/` | StrataHQ client (SigV4-signed entitlement calls) |
+| `src/strata/runner/` | the program that runs inside CodeBuild |
+| `src/strata/install/` | the `strata init` wizard (schema / prompt / store / tfvars) |
+| `src/strata/artifacts/` | bundle download / verify / manifest |
+| `tests/` | unit tests (`pytest`) |

stratactl-1.0.0/pyproject.toml

@@ -0,0 +1,73 @@
+[build-system]
+requires = ["setuptools>=68"]
+build-backend = "setuptools.build_meta"
+
+[project]
+# PyPI distribution name (intended; verify availability before first publish).
+name = "stratactl"
+# Versioning is Major.Sprint.Patch (Shaleio ecosystem sprint clock), not SemVer.
+# Sprint 0 begins 2026-07-27. See "Versioning" in the README.
+version = "1.0.0"
+description = "StrataCTL — bootstrap StrataCI into a customer AWS account and install/update/uninstall StrataBI modules via an ephemeral CodeBuild runner."
+readme = "README.md"
+requires-python = ">=3.11"
+license = { text = "Apache-2.0" }
+authors = [{ name = "Shaleio LLC", email = "info@shaleio.com" }]
+keywords = ["stratabi", "aws", "codebuild", "opentofu", "terraform", "cli", "analytics"]
+classifiers = [
+    "Development Status :: 4 - Beta",
+    "Environment :: Console",
+    "Intended Audience :: Developers",
+    "Intended Audience :: System Administrators",
+    "License :: OSI Approved :: Apache Software License",
+    "Operating System :: OS Independent",
+    "Programming Language :: Python :: 3",
+    "Programming Language :: Python :: 3.11",
+    "Programming Language :: Python :: 3.12",
+    "Topic :: System :: Installation/Setup",
+    "Topic :: System :: Systems Administration",
+]
+dependencies = [
+    "boto3>=1.34",
+    "pyyaml>=6",
+    "platformdirs>=4",
+]
+
+[project.optional-dependencies]
+# Installed in the runner image/buildspec — needed for offline bundle-signature
+# verification (Decision C). The CLI itself does not require it.
+runner = ["cryptography>=42"]
+# Development / test tooling.
+dev = [
+    "pytest>=8",
+    "build>=1",
+    "twine>=5",
+]
+
+[project.urls]
+Homepage = "https://shaleio.com"
+Documentation = "https://shaleio.com/docs"
+Source = "https://github.com/shaleio/stratactl"
+Issues = "https://github.com/shaleio/stratactl/issues"
+
+[project.scripts]
+stratactl = "strata.cli:main"
+
+[tool.setuptools.packages.find]
+where = ["src"]
+
+[tool.setuptools.package-data]
+# Ship every non-.py asset the CLI + bootstrap need at runtime: config defaults,
+# bundled OpenTofu templates, install schemas, and the packaged StrataCI bootstrap
+# infrastructure (see src/strata/bootstrap/infra/ — versioned, immutable package data).
+strata = [
+    "config/*.toml",
+    "bootstrap/**/*",
+    "install/**/*.json",
+    "**/*.tf",
+    "**/*.tftpl",
+    "**/*.json",
+]
+
+[tool.pytest.ini_options]
+testpaths = ["tests"]

stratactl-1.0.0/setup.cfg

@@ -0,0 +1,4 @@
+[egg_info]
+tag_build = 
+tag_date = 0
+

stratactl-1.0.0/src/strata/__init__.py

@@ -0,0 +1,8 @@
+"""StrataCTL / StrataCI shared package.
+
+One codebase, two entry points:
+  * `strata.cli`    — the local operator CLI (`stratactl ...`)
+  * `strata.runner` — the program that runs inside the ephemeral CodeBuild runner
+"""
+
+__version__ = "0.1.0"

stratactl-1.0.0/src/strata/__main__.py

@@ -0,0 +1,4 @@
+from strata.cli import main
+
+if __name__ == "__main__":
+    raise SystemExit(main())

stratactl-1.0.0/src/strata/artifacts/__init__.py

@@ -0,0 +1,4 @@
+from strata.artifacts.manifest import Manifest, load_and_validate
+from strata.artifacts.source import SourceSpec, resolve_source
+
+__all__ = ["Manifest", "load_and_validate", "SourceSpec", "resolve_source"]

stratactl-1.0.0/src/strata/artifacts/bundle.py

@@ -0,0 +1,111 @@
+"""Artifact bundle handling, used by the runner: download, verify, safe-extract.
+
+Bundle layout:
+    module.zip
+      ├── stratabi-module.json
+      ├── tofu/{main,variables,outputs,versions}.tf
+      ├── config/defaults.json
+      └── README.md
+"""
+
+from __future__ import annotations
+
+import hashlib
+import urllib.request
+import zipfile
+from pathlib import Path
+from typing import Optional
+
+from strata.errors import ArtifactError
+
+MAX_BUNDLE_BYTES = 256 * 1024 * 1024   # 256 MB cap
+MAX_FILES = 5000
+
+
+def download_url(url: str, dest: Path, timeout: int = 60) -> Path:
+    """Download a presigned (or any) URL to dest. Never logs the URL."""
+    try:
+        with urllib.request.urlopen(url, timeout=timeout) as resp, open(dest, "wb") as fh:
+            total = 0
+            while chunk := resp.read(1024 * 256):
+                total += len(chunk)
+                if total > MAX_BUNDLE_BYTES:
+                    raise ArtifactError("bundle exceeds size cap")
+                fh.write(chunk)
+    except OSError as exc:
+        raise ArtifactError(f"failed to download artifact: {exc}") from exc
+    return dest
+
+
+def download_s3(s3_client, s3_uri: str, dest: Path) -> Path:
+    if not s3_uri.startswith("s3://"):
+        raise ArtifactError(f"not an s3 uri: {s3_uri}")
+    bucket, key = s3_uri[len("s3://"):].split("/", 1)
+    try:
+        s3_client.download_file(bucket, key, str(dest))
+    except Exception as exc:
+        raise ArtifactError(f"failed to download {s3_uri}: {exc}") from exc
+    return dest
+
+
+def verify_sha256(path: Path, expected: Optional[str]) -> str:
+    h = hashlib.sha256()
+    with open(path, "rb") as fh:
+        while chunk := fh.read(1024 * 256):
+            h.update(chunk)
+    actual = h.hexdigest()
+    if expected and actual.lower() != expected.lower():
+        raise ArtifactError(
+            f"artifact checksum mismatch (expected {expected[:12]}…, got {actual[:12]}…)"
+        )
+    return actual
+
+
+def safe_extract(zip_path: Path, workdir: Path) -> Path:
+    """Extract a zip, rejecting absolute paths / traversal / overlarge bundles."""
+    workdir.mkdir(parents=True, exist_ok=True)
+    try:
+        with zipfile.ZipFile(zip_path) as zf:
+            members = zf.namelist()
+            if len(members) > MAX_FILES:
+                raise ArtifactError("bundle has too many entries")
+            for name in members:
+                target = (workdir / name).resolve()
+                if not str(target).startswith(str(workdir.resolve())):
+                    raise ArtifactError(f"unsafe path in bundle: {name}")
+            zf.extractall(workdir)
+    except zipfile.BadZipFile as exc:
+        raise ArtifactError(f"corrupt bundle: {exc}") from exc
+    return workdir
+
+
+def verify_signature(digest_hex: str, signature_b64: str, public_key_b64der: str) -> None:
+    """Offline verify a KMS ECDSA-P256 signature over the bundle's sha256 digest
+    (Decision C). No AWS call, no cross-account KMS. Raises ArtifactError on
+    failure. `cryptography` is imported lazily — only needed when verifying."""
+    import base64
+
+    try:
+        from cryptography.hazmat.primitives import hashes
+        from cryptography.hazmat.primitives.asymmetric import ec, utils
+        from cryptography.hazmat.primitives.serialization import load_der_public_key
+    except ModuleNotFoundError as exc:  # pragma: no cover
+        raise ArtifactError("signature verification requires the 'cryptography' package") from exc
+
+    try:
+        pub = load_der_public_key(base64.b64decode(public_key_b64der))
+        pub.verify(
+            base64.b64decode(signature_b64),
+            bytes.fromhex(digest_hex),
+            ec.ECDSA(utils.Prehashed(hashes.SHA256())),
+        )
+    except Exception as exc:  # invalid signature or key
+        raise ArtifactError(f"bundle signature verification failed: {exc}") from exc
+
+
+def cache_to_customer_s3(s3_client, bucket: str, module_id: str, version: str,
+                         zip_path: Path) -> str:
+    """Store the verified bundle so uninstall/update work without StrataHQ."""
+    key = f"artifacts/{module_id}/{version}/module.zip"
+    s3_client.upload_file(str(zip_path), bucket, key)
+    return f"s3://{bucket}/{key}"

stratactl-1.0.0/src/strata/artifacts/manifest.py

@@ -0,0 +1,125 @@
+"""stratabi-module.json parsing + validation.
+
+`required_permissions` drives least-privilege deploys (Decision A): the runner
+builds an IAM session policy from it and assumes a deploy role scoped DOWN to
+exactly what the module declares. Two accepted forms:
+
+  Structured (preferred — enables tight scoping; module authors MUST use this for
+  third-party modules):
+      "required_permissions": [
+        {"service": "s3",
+         "actions": ["s3:CreateBucket", "s3:PutObject", "s3:DeleteObject"],
+         "resources": ["arn:aws:s3:::acme-iceberg-*", "arn:aws:s3:::acme-iceberg-*/*"]}
+      ]
+
+  Simple (legacy / Shaleio-internal only — results in a BROAD service:* grant):
+      "required_permissions": ["s3", "lambda", "dynamodb"]
+"""
+
+from __future__ import annotations
+
+import json
+from dataclasses import dataclass, field
+from pathlib import Path
+from typing import Any
+
+from strata.errors import ManifestError
+
+VALID_ENTRYPOINTS = {"tofu"}
+
+# Delivery mode governs whether the tofu bundle is persisted into the customer's
+# environment. "local": the runner caches the verified bundle to the customer
+# bucket, so teardown works offline/airgapped and without HQ. "managed": the
+# bundle is never persisted; uninstall re-fetches it from HQ (destroy is always
+# permitted, even for a lapsed/retired grant). Default local.
+VALID_DELIVERY = {"local", "managed"}
+
+
+@dataclass
+class Manifest:
+    module_id: str
+    version: str
+    entrypoint: str
+    state_key: str
+    delivery: str = "local"
+    required_permissions: list[Any] = field(default_factory=list)
+    supports_destroy: bool = False
+    raw: dict[str, Any] = field(default_factory=dict)
+
+    @property
+    def permissions_are_scoped(self) -> bool:
+        """True when every permission entry is structured (service/actions/resources)."""
+        if not self.required_permissions:
+            return False
+        return all(isinstance(p, dict) for p in self.required_permissions)
+
+
+def load_and_validate(path: Path) -> Manifest:
+    if not path.is_file():
+        raise ManifestError(f"manifest not found: {path}")
+    try:
+        data = json.loads(path.read_text("utf-8"))
+    except json.JSONDecodeError as exc:
+        raise ManifestError(f"manifest is not valid JSON: {exc}") from exc
+    return validate(data)
+
+
+def validate(data: dict[str, Any]) -> Manifest:
+    for required in ("module_id", "version", "entrypoint", "state_key"):
+        if not data.get(required):
+            raise ManifestError(f"manifest missing required field '{required}'")
+
+    entrypoint = data["entrypoint"]
+    if entrypoint not in VALID_ENTRYPOINTS:
+        raise ManifestError(
+            f"unsupported entrypoint '{entrypoint}' (expected one of {sorted(VALID_ENTRYPOINTS)})"
+        )
+
+    state_key = data["state_key"]
+    if state_key.startswith("/") or ".." in state_key:
+        raise ManifestError(f"unsafe state_key '{state_key}'")
+
+    delivery = data.get("delivery", "local")
+    if delivery not in VALID_DELIVERY:
+        raise ManifestError(
+            f"delivery must be one of {sorted(VALID_DELIVERY)}, got '{delivery}'"
+        )
+
+    perms = data.get("required_permissions", [])
+    if not isinstance(perms, list):
+        raise ManifestError("required_permissions must be a list")
+    for entry in perms:
+        _validate_perm_entry(entry)
+
+    return Manifest(
+        module_id=data["module_id"],
+        version=str(data["version"]),
+        entrypoint=entrypoint,
+        state_key=state_key,
+        delivery=delivery,
+        required_permissions=perms,
+        supports_destroy=bool(data.get("supports_destroy", False)),
+        raw=data,
+    )
+
+
+def _validate_perm_entry(entry: Any) -> None:
+    if isinstance(entry, str):
+        if not entry:
+            raise ManifestError("empty permission entry")
+        return
+    if isinstance(entry, dict):
+        if not entry.get("service"):
+            raise ManifestError("structured permission entry missing 'service'")
+        actions = entry.get("actions")
+        if not isinstance(actions, list) or not actions:
+            raise ManifestError(
+                f"permission entry for '{entry.get('service')}' needs a non-empty 'actions' list"
+            )
+        resources = entry.get("resources", ["*"])
+        if not isinstance(resources, list) or not resources:
+            raise ManifestError(
+                f"permission entry for '{entry.get('service')}' needs a non-empty 'resources' list"
+            )
+        return
+    raise ManifestError(f"invalid permission entry: {entry!r}")

stratactl-1.0.0/src/strata/artifacts/source.py

@@ -0,0 +1,60 @@
+"""Resolve where a module artifact comes from.
+
+A module spec can be:
+  * "iceberg-explorer"            -> use the default source from config
+  * "stratahq/iceberg-explorer"   -> force StrataHQ (entitlement required)
+  * "customer_s3/iceberg-explorer"-> force customer S3
+  * "s3://bucket/key/module.zip"  -> explicit customer S3 object
+  * "https://.../module.zip"      -> explicit PUBLIC artifact (no StrataHQ contact,
+                                     no entitlement) — e.g. a GitHub release of the
+                                     source-available Developer / Community edition.
+"""
+
+from __future__ import annotations
+
+from dataclasses import dataclass
+from typing import Optional
+
+from strata.config.models import Settings
+
+KIND_STRATAHQ = "stratahq"
+KIND_CUSTOMER = "customer_s3"
+KIND_PUBLIC = "public"
+
+
+@dataclass
+class SourceSpec:
+    kind: str               # "stratahq" | "customer_s3" | "public"
+    module_id: str
+    customer_s3_uri: Optional[str] = None   # set when kind == customer_s3 and explicit
+    public_url: Optional[str] = None        # set when kind == public (http/https)
+    sha256: Optional[str] = None
+
+
+def _norm_module_id(name: str) -> str:
+    return name.replace("-", "_")
+
+
+def resolve_source(module_spec: str, settings: Settings,
+                   cli_source: Optional[str] = None) -> SourceSpec:
+    # Explicit http(s) URL is a PUBLIC artifact — fetched directly, no StrataHQ,
+    # no entitlement (used by the source-available dev/community edition).
+    if module_spec.startswith(("http://", "https://")):
+        tail = module_spec.split("/")[-1].split("?")[0]
+        module_id = _norm_module_id(tail.removesuffix(".zip"))
+        return SourceSpec(kind=KIND_PUBLIC, module_id=module_id, public_url=module_spec)
+
+    # Explicit s3:// URI is unambiguously a customer artifact.
+    if module_spec.startswith("s3://"):
+        tail = module_spec.split("/")[-1]
+        module_id = _norm_module_id(tail.removesuffix(".zip"))
+        return SourceSpec(kind=KIND_CUSTOMER, module_id=module_id, customer_s3_uri=module_spec)
+
+    kind = cli_source or settings.source
+    module_name = module_spec
+    if "/" in module_spec:
+        prefix, module_name = module_spec.split("/", 1)
+        if prefix in (KIND_STRATAHQ, KIND_CUSTOMER, KIND_PUBLIC):
+            kind = prefix
+
+    return SourceSpec(kind=kind, module_id=_norm_module_id(module_name))

stratactl-1.0.0/src/strata/aws/session.py

@@ -0,0 +1,34 @@
+"""boto3 session/clients for the TARGET (customer) account.
+
+The operator's own AWS credentials drive everything here — Shaleio never holds
+customer-account credentials.
+"""
+
+from __future__ import annotations
+
+from functools import lru_cache
+from typing import Optional
+
+import boto3
+
+from strata.config.models import Settings
+
+
+def make_session(settings: Settings) -> boto3.Session:
+    return boto3.Session(profile_name=settings.profile, region_name=settings.region)
+
+
+@lru_cache(maxsize=1)
+def account_id(session: boto3.Session) -> str:
+    return session.client("sts").get_caller_identity()["Account"]
+
+
+def client(session: boto3.Session, service: str):
+    return session.client(service)
+
+
+def caller_arn(session: boto3.Session) -> Optional[str]:
+    try:
+        return session.client("sts").get_caller_identity()["Arn"]
+    except Exception:
+        return None

stratactl-1.0.0/src/strata/bootstrap/__init__.py

@@ -0,0 +1,29 @@
+"""Packaged StrataCI bootstrap infrastructure (immutable, version-matched).
+
+The OpenTofu that stands StrataCI up inside a customer account ships as package
+data under ``strata/bootstrap/infra/`` so a pipx-installed ``stratactl`` is fully
+self-contained (no repo checkout needed). ``bootstrap_infra_files()`` returns the
+packaged ``.tf`` files; the ``bootstrap`` command copies them into a per-account
+working directory before running tofu — the packaged copy is never mutated.
+"""
+
+from __future__ import annotations
+
+from importlib import resources
+from importlib.abc import Traversable
+
+__all__ = ["bootstrap_infra_root", "bootstrap_infra_files"]
+
+
+def bootstrap_infra_root() -> Traversable:
+    """The packaged bootstrap infra directory as an importlib.resources Traversable."""
+    return resources.files(__package__).joinpath("infra")
+
+
+def bootstrap_infra_files() -> list[str]:
+    """Names of the packaged infra files (Terraform/OpenTofu sources + lock)."""
+    root = bootstrap_infra_root()
+    return sorted(
+        p.name for p in root.iterdir()
+        if p.name.endswith((".tf", ".tftpl", ".hcl")) or p.name.endswith(".example")
+    )