Initial commit: meal ordering automation system (#1)

Playwright-based menu scraper for Redefine Meals, self-contained HTML order form with S3/CloudFront hosting, DynamoDB-backed order submission via API Gateway, and automated payroll deduction reports via SES.
2026-10-06 17:01:58 +00:00 · 2026-05-12 18:25:15 -04:00 · 2026-05-12 18:25:15 -04:00 · d332affd56
commit d332affd56
parent cd36ed8018
33 changed files with 2604 additions and 0 deletions
--- a/.github/workflows/ci.yml
+++ b/.github/workflows/ci.yml
@ -0,0 +1,9 @@
 name: CI
 on:
  pull_request:
    branches: [main]
 jobs:
  ci:
    uses: Sea-Haven-Industries/.github/.github/workflows/ci-python-sam.yaml@main
--- a/.github/workflows/deploy.yml
+++ b/.github/workflows/deploy.yml
@ -0,0 +1,13 @@
 name: Deploy
 on:
  push:
    branches: [main]
 jobs:
  deploy:
    uses: Sea-Haven-Industries/.github/.github/workflows/cd-sam.yaml@main
    with:
      stack-name: meal-order-manager
    secrets:
      cfn-role-arn: ${{ secrets.AWS_DEPLOY_ROLE_ARN }}
--- a/.github/workflows/weekly-menu.yml
+++ b/.github/workflows/weekly-menu.yml
@ -0,0 +1,102 @@
 name: Weekly Menu Scrape & Publish
 on:
  schedule:
    # Monday 8am EST = 13:00 UTC
    - cron: '0 13 * * 1'
    # Monday 8am EDT = 12:00 UTC
    - cron: '0 12 * * 1'
  workflow_dispatch:
 permissions:
  id-token: write
  contents: read
 jobs:
  scrape-and-publish:
    runs-on: ubuntu-latest
    env:
      AWS_REGION: us-east-1
    steps:
      - uses: actions/checkout@v6
      - uses: actions/setup-python@v5
        with:
          python-version: '3.12'
      - name: Install dependencies
        run: |
          pip install playwright boto3
          playwright install chromium --with-deps
      - name: Configure AWS credentials
        uses: aws-actions/configure-aws-credentials@v4
        with:
          role-to-assume: ${{ secrets.AWS_DEPLOY_ROLE_ARN }}
          aws-region: us-east-1
      - name: Scrape menu
        run: python3 src/scraper/scrape_menu.py
      - name: Get stack outputs
        id: stack
        run: |
          API_URL=$(aws cloudformation describe-stacks \
            --stack-name meal-order-manager \
            --query 'Stacks[0].Outputs[?OutputKey==`ApiUrl`].OutputValue' \
            --output text)
          FORM_BUCKET=$(aws cloudformation describe-stacks \
            --stack-name meal-order-manager \
            --query 'Stacks[0].Outputs[?OutputKey==`FormBucketName`].OutputValue' \
            --output text)
          DIST_ID=$(aws cloudformation describe-stacks \
            --stack-name meal-order-manager \
            --query 'Stacks[0].Outputs[?OutputKey==`DistributionId`].OutputValue' \
            --output text)
          FORM_URL=$(aws cloudformation describe-stacks \
            --stack-name meal-order-manager \
            --query 'Stacks[0].Outputs[?OutputKey==`FormUrl`].OutputValue' \
            --output text)
          echo "api_url=$API_URL" >> $GITHUB_OUTPUT
          echo "form_bucket=$FORM_BUCKET" >> $GITHUB_OUTPUT
          echo "dist_id=$DIST_ID" >> $GITHUB_OUTPUT
          echo "form_url=$FORM_URL" >> $GITHUB_OUTPUT
      - name: Get API key
        id: apikey
        run: |
          API_KEY=$(aws secretsmanager get-secret-value \
            --secret-id meal-order-manager/form-api-key \
            --query 'SecretString' --output text)
          echo "::add-mask::$API_KEY"
          echo "api_key=$API_KEY" >> $GITHUB_OUTPUT
      - name: Generate order form
        run: |
          python3 src/server/generate_form.py \
            --api-url "${{ steps.stack.outputs.api_url }}" \
            --api-key "${{ steps.apikey.outputs.api_key }}"
      - name: Upload menu to DynamoDB
        run: python3 scripts/upload_menu.py
      - name: Upload form to S3
        run: |
          WEEK=$(date +%Y-W%U)
          aws s3 cp "output/order-form-$WEEK.html" \
            "s3://${{ steps.stack.outputs.form_bucket }}/index.html" \
            --content-type "text/html" \
            --cache-control "no-cache"
          aws s3 cp "output/order-form-$WEEK.html" \
            "s3://${{ steps.stack.outputs.form_bucket }}/archive/$WEEK.html" \
            --content-type "text/html"
      - name: Invalidate CloudFront cache
        run: |
          aws cloudfront create-invalidation \
            --distribution-id "${{ steps.stack.outputs.dist_id }}" \
            --paths "/index.html"
      - name: Notify Slack
        run: python3 scripts/notify_slack.py "${{ steps.stack.outputs.form_url }}"
--- a/.gitignore
+++ b/.gitignore
@ -0,0 +1,9 @@
 .venv/
 __pycache__/
 *.pyc
 .env
 orders/
 output/
 .DS_Store
 .aws-sam/
 samconfig.toml
--- a/README.md
+++ b/README.md
@ -1 +1,125 @@
 # meal-order-manager
 Automates weekly meal ordering from [Redefine Meals](https://www.redefinemeals.com) for Sea Haven Industries employees. Scrapes the menu, generates an order form, collects individual orders, and produces payroll deduction reports.
 ## Architecture
 ```
 Monday 8am ET                        Employees (Mon–Thu)               Thursday 6pm ET
 ┌─────────────────┐                  ┌──────────────────┐              ┌──────────────────┐
 │  GitHub Actions  │                 │  orders.seahaven │              │  EventBridge      │
 │  - Scrape menu   │────S3 upload───▶│  ind.com         │              │  - Close form     │
 │  - Generate form │  + DynamoDB     │  (CloudFront+S3) │──POST───┐    │  - Aggregate      │
 │  - Slack notify  │                 └──────────────────┘         │    │  - Slack summary  │
 └─────────────────┘                                               ▼    └──────────────────┘
                                                          ┌──────────┐
 Monday 7am ET                                             │ API GW + │
 ┌──────────────────┐                                      │ Lambda   │
 │  EventBridge     │                                      │ submit   │
 │  - Email payroll │                                      └────┬─────┘
 │    deductions    │                                           ▼
 └──────────────────┘                                      ┌──────────┐
                                                          │ DynamoDB │
 Thu 10am: Slack DM                                        │ orders   │
 reminders to employees                                    └──────────┘
 who haven't ordered
 ```
 ## Weekly Flow
 | When | What | How |
 |------|------|-----|
 | Monday 7am ET | Email previous week's payroll deductions to `payroll@` | EventBridge → Lambda → SES |
 | Monday 8am ET | Scrape menu, generate form, upload to S3, post link to Slack | GitHub Actions cron |
 | Mon–Thu | Employees visit `orders.seahavenind.com` and submit orders | S3 static form → API Gateway → Lambda → DynamoDB |
 | Thursday 10am ET | DM employees who haven't ordered yet | EventBridge → Lambda → Slack DM |
 | Thursday 6pm ET | Close form, aggregate orders, post Redefine order summary to Slack | EventBridge → Lambda chain |
 ## AWS Resources
 Stack name: `meal-order-manager` (us-east-1)
 - **S3** — `meal-order-manager-form-*` (static form hosting), `meal-order-manager-reports-*` (CSV reports)
 - **CloudFront** — HTTPS distribution with custom domain `orders.seahavenind.com`
 - **DynamoDB** — `meal-order-manager-orders` (orders, menu, roster, config)
 - **API Gateway** — HttpApi for order submission
 - **Lambda** — 5 functions: submit-order, close-form, aggregate-orders, slack-notifier, email-report
 - **EventBridge** — scheduled rules (dual EST/EDT) for close, reminders, payroll email
 - **Secrets Manager** — Slack bot token, form API key
 - **SES** — payroll deduction emails
 ## Setup
 ### Local development
 ```bash
 python3 -m venv .venv
 source .venv/bin/activate
 pip install -r requirements.txt
 playwright install chromium
 ```
 ### Deploy to AWS
 ```bash
 cp samconfig.toml.example samconfig.toml
 # Edit samconfig.toml with your certificate ARN, API key, etc.
 sam build
 sam deploy
 ```
 ### Post-deploy
 1. Create the Slack bot token secret: `aws secretsmanager create-secret --name meal-order-manager/slack-bot-token --secret-string "xoxb-..."`
 2. Create the form API key secret: `aws secretsmanager create-secret --name meal-order-manager/form-api-key --secret-string "$(openssl rand -hex 32)"`
 3. Update the Slack channel SSM parameter: `aws ssm put-parameter --name /meal-order-manager/slack-channel-id --value "C0XXXXXXX" --overwrite`
 4. Verify SES sender identity for `adam@seahavenind.com`
 5. Set up DNS: CNAME `orders.seahavenind.com` → CloudFront distribution domain
 6. Populate employee roster: edit `config.json` and run `python3 scripts/seed_roster.py`
 ## Local Workflow (no AWS)
 The scraper, form generator, Flask server, and aggregator still work locally:
 ```bash
 python3 src/scraper/scrape_menu.py        # scrape menu
 python3 src/server/generate_form.py       # generate form (local mode)
 python3 src/server/app.py                 # serve on localhost:5050
 python3 src/aggregator/aggregate.py       # generate CSV reports
 ```
 ## Configuration
 `config.json` (local dev):
 - `menu_url` — Redefine Meals menu URL
 - `order_deadline` — displayed on the form
 - `roster` — employee list (name, email, slack_user_id)
 - `output_dir` / `orders_dir` — local output paths
 ## Project Structure
 ```
 meal-order-manager/
 ├── .github/workflows/
 │   ├── weekly-menu.yml          # Monday cron: scrape + publish + notify
 │   ├── ci.yml                   # PR checks
 │   └── deploy.yml               # Push to main: sam deploy
 ├── src/
 │   ├── scraper/                 # Playwright menu scraper
 │   ├── server/                  # Form generator + local Flask server
 │   ├── aggregator/              # Order aggregation + CSV reports
 │   └── shared/python/shared/    # Lambda layer (db, secrets, slack helpers)
 ├── functions/                   # Lambda handlers
 │   ├── submit_order/
 │   ├── close_form/
 │   ├── aggregate_orders/
 │   ├── slack_notifier/
 │   └── email_report/
 ├── scripts/                     # CI/CD helper scripts
 │   ├── upload_menu.py
 │   ├── notify_slack.py
 │   └── seed_roster.py
 ├── template.yaml                # SAM template
 ├── samconfig.toml.example
 └── config.json
 ```
--- a/config.json
+++ b/config.json
@ -0,0 +1,9 @@
 {
  "menu_url": "https://redefinemeals.com/menu",
  "order_deadline": "Wednesday 11:59 PM",
  "output_dir": "output",
  "orders_dir": "orders",
  "roster": [
    {"name": "Example Employee", "email": "example@seahavenind.com"}
  ]
 }
--- a/functions/aggregate_orders/handler.py
+++ b/functions/aggregate_orders/handler.py
@ -0,0 +1,115 @@
 import csv
 import io
 import json
 import os
 from collections import defaultdict
 from datetime import datetime
 from decimal import Decimal
 from zoneinfo import ZoneInfo
 import boto3
 from shared.db import current_week, get_orders, get_summary, put_summary
 EASTERN = ZoneInfo("America/New_York")
 _s3 = boto3.client("s3")
 _lambda = boto3.client("lambda")
 class DecimalEncoder(json.JSONEncoder):
    def default(self, o):
        if isinstance(o, Decimal):
            return float(o)
        return super().default(o)
 def lambda_handler(event, context):
    week = event.get("week", current_week())
    existing = get_summary(week)
    if existing:
        return {"status": "already_aggregated", "week": week}
    orders = get_orders(week)
    if not orders:
        return {"status": "no_orders", "week": week}
    summary = build_summary(orders, week)
    order_csv = build_order_summary_csv(summary)
    payroll_csv = build_payroll_csv(orders)
    bucket = os.environ["REPORTS_BUCKET"]
    order_csv_key = f"reports/{week}/order-summary.csv"
    payroll_csv_key = f"reports/{week}/payroll-deductions.csv"
    _s3.put_object(Bucket=bucket, Key=order_csv_key, Body=order_csv, ContentType="text/csv")
    _s3.put_object(Bucket=bucket, Key=payroll_csv_key, Body=payroll_csv, ContentType="text/csv")
    summary["order_csv_s3_key"] = order_csv_key
    summary["payroll_csv_s3_key"] = payroll_csv_key
    put_summary(week, summary)
    _lambda.invoke(
        FunctionName=os.environ["SLACK_NOTIFIER_ARN"],
        InvocationType="Event",
        Payload=json.dumps({"event": "orders_aggregated", "week": week}, cls=DecimalEncoder),
    )
    return {"status": "aggregated", "week": week, "total_employees": len(orders)}
 def build_summary(orders: list[dict], week: str) -> dict:
    meal_totals = defaultdict(lambda: {"quantity": 0, "unit_price": 0})
    for order in orders:
        for item in order.get("items", []):
            name = item["name"]
            qty = int(item.get("quantity", 0))
            meal_totals[name]["quantity"] += qty
            meal_totals[name]["unit_price"] = float(item.get("price", 0))
    meals = []
    for name, data in sorted(meal_totals.items()):
        meals.append({
            "meal": name,
            "quantity": data["quantity"],
            "unit_price": data["unit_price"],
            "line_total": round(data["unit_price"] * data["quantity"], 2),
        })
    return {
        "week": week,
        "generated_at": datetime.now(EASTERN).isoformat(),
        "total_employees": len(orders),
        "total_meals": sum(m["quantity"] for m in meals),
        "grand_total": round(sum(m["line_total"] for m in meals), 2),
        "meals": meals,
    }
 def build_order_summary_csv(summary: dict) -> str:
    buf = io.StringIO()
    writer = csv.writer(buf)
    writer.writerow(["Meal", "Quantity", "Unit Price", "Line Total"])
    for meal in summary["meals"]:
        writer.writerow([meal["meal"], meal["quantity"], f"${meal['unit_price']:.2f}", f"${meal['line_total']:.2f}"])
    writer.writerow([])
    writer.writerow(["TOTAL", summary["total_meals"], "", f"${summary['grand_total']:.2f}"])
    return buf.getvalue()
 def build_payroll_csv(orders: list[dict]) -> str:
    buf = io.StringIO()
    writer = csv.writer(buf)
    writer.writerow(["Employee Name", "Employee Email", "Items Ordered", "Total Deduction"])
    for order in sorted(orders, key=lambda o: o["employee_name"]):
        items_str = "; ".join(
            f"{item['name']} x{int(item['quantity'])} (${float(item.get('subtotal', float(item.get('price', 0)) * int(item.get('quantity', 0)))):.2f})"
            for item in order.get("items", [])
        )
        writer.writerow([
            order["employee_name"],
            order["employee_email"],
            items_str,
            f"${float(order['total']):.2f}",
        ])
    return buf.getvalue()
--- a/functions/aggregate_orders/requirements.txt
+++ b/functions/aggregate_orders/requirements.txt
@ -0,0 +1 @@
 boto3
--- a/functions/close_form/handler.py
+++ b/functions/close_form/handler.py
@ -0,0 +1,26 @@
 import json
 import os
 import boto3
 from shared.db import current_week, get_form_status, set_form_status
 _lambda = boto3.client("lambda")
 def lambda_handler(event, context):
    week = event.get("week", current_week())
    status = get_form_status(week)
    if status == "closed":
        return {"status": "already_closed", "week": week}
    set_form_status(week, "closed")
    _lambda.invoke(
        FunctionName=os.environ["AGGREGATE_FUNCTION_ARN"],
        InvocationType="Event",
        Payload=json.dumps({"week": week}),
    )
    return {"status": "closed", "week": week, "aggregate_triggered": True}
--- a/functions/close_form/requirements.txt
+++ b/functions/close_form/requirements.txt
@ -0,0 +1 @@
 boto3
--- a/functions/email_report/handler.py
+++ b/functions/email_report/handler.py
@ -0,0 +1,56 @@
 import os
 from email.mime.application import MIMEApplication
 from email.mime.multipart import MIMEMultipart
 from email.mime.text import MIMEText
 import boto3
 from shared.db import get_summary, previous_week
 _ses = boto3.client("ses")
 _s3 = boto3.client("s3")
 def lambda_handler(event, context):
    week = event.get("week", previous_week())
    summary = get_summary(week)
    if not summary:
        return {"status": "no_summary", "week": week}
    payroll_key = summary.get("payroll_csv_s3_key")
    if not payroll_key:
        return {"status": "no_payroll_csv", "week": week}
    bucket = os.environ["REPORTS_BUCKET"]
    csv_obj = _s3.get_object(Bucket=bucket, Key=payroll_key)
    csv_content = csv_obj["Body"].read()
    total_employees = int(summary.get("total_employees", 0))
    grand_total = float(summary.get("grand_total", 0))
    msg = MIMEMultipart("mixed")
    msg["Subject"] = f"Meal Order Payroll Deductions — {week}"
    msg["From"] = os.environ["SENDER_EMAIL"]
    msg["To"] = os.environ["PAYROLL_EMAIL"]
    body = MIMEText(
        f"Attached is the meal order payroll deduction report for {week}.\n\n"
        f"Employees: {total_employees}\n"
        f"Total deductions: ${grand_total:.2f}\n\n"
        f"Please apply these deductions in the next pay period.\n",
        "plain",
    )
    msg.attach(body)
    attachment = MIMEApplication(csv_content)
    attachment.add_header("Content-Disposition", "attachment", filename=f"payroll-deductions-{week}.csv")
    msg.attach(attachment)
    _ses.send_raw_email(
        Source=os.environ["SENDER_EMAIL"],
        Destinations=[os.environ["PAYROLL_EMAIL"]],
        RawMessage={"Data": msg.as_string()},
    )
    return {"status": "sent", "week": week, "to": os.environ["PAYROLL_EMAIL"]}
--- a/functions/email_report/requirements.txt
+++ b/functions/email_report/requirements.txt
@ -0,0 +1 @@
 boto3
--- a/functions/slack_notifier/handler.py
+++ b/functions/slack_notifier/handler.py
@ -0,0 +1,137 @@
 import json
 import os
 from decimal import Decimal
 from shared.db import current_week, get_orders, get_roster, get_summary
 from shared.slack import post_channel_message, send_dm
 class DecimalEncoder(json.JSONEncoder):
    def default(self, o):
        if isinstance(o, Decimal):
            return float(o)
        return super().default(o)
 def lambda_handler(event, context):
    event_type = event.get("event", "")
    if event_type == "menu_published":
        return handle_menu_published(event)
    elif event_type == "orders_aggregated":
        return handle_orders_aggregated(event)
    elif event_type == "reminder":
        return handle_reminder(event)
    return {"error": f"Unknown event type: {event_type}"}
 def handle_menu_published(event):
    form_url = os.environ.get("FORM_URL", "")
    week = event.get("week", current_week())
    meal_count = event.get("meal_count", "")
    text = f"This week's meal order is open! Deadline: Thursday 6pm."
    blocks = [
        {
            "type": "header",
            "text": {"type": "plain_text", "text": "Meal Order Open"},
        },
        {
            "type": "section",
            "text": {
                "type": "mrkdwn",
                "text": (
                    f"*<{form_url}|Place your order>*\n\n"
                    f"*Deadline:* Thursday 6pm\n"
                    f"*Menu:* {meal_count} meals available"
                ),
            },
        },
    ]
    post_channel_message(text, blocks)
    return {"status": "notified", "event": "menu_published", "week": week}
 def handle_orders_aggregated(event):
    week = event.get("week", current_week())
    summary = get_summary(week)
    if not summary:
        return {"status": "no_summary", "week": week}
    total_employees = int(summary.get("total_employees", 0))
    total_meals = int(summary.get("total_meals", 0))
    grand_total = float(summary.get("grand_total", 0))
    meal_lines = []
    for m in summary.get("meals", []):
        meal_lines.append(f"{m['meal']}: *{int(m['quantity'])}*")
    meal_list = "\n".join(meal_lines)
    text = f"Meal orders closed for {week}. {total_employees} employees, {total_meals} meals, ${grand_total:.2f} total."
    blocks = [
        {
            "type": "header",
            "text": {"type": "plain_text", "text": f"Meal Orders Closed — {week}"},
        },
        {
            "type": "section",
            "text": {
                "type": "mrkdwn",
                "text": (
                    f"*{total_employees}* employees ordered\n"
                    f"*{total_meals}* total meals\n"
                    f"*${grand_total:.2f}* grand total"
                ),
            },
        },
        {"type": "divider"},
        {
            "type": "section",
            "text": {
                "type": "mrkdwn",
                "text": f"*Order for Redefine Meals:*\n{meal_list}",
            },
        },
    ]
    post_channel_message(text, blocks)
    return {"status": "notified", "event": "orders_aggregated", "week": week}
 def handle_reminder(event):
    week = event.get("week", current_week())
    form_url = os.environ.get("FORM_URL", "")
    roster = get_roster()
    if not roster:
        return {"status": "no_roster"}
    orders = get_orders(week)
    ordered_emails = {o["employee_email"].lower() for o in orders}
    missing = [emp for emp in roster if emp["email"].lower() not in ordered_emails]
    dm_count = 0
    for emp in missing:
        slack_id = emp.get("slack_user_id")
        if not slack_id:
            continue
        send_dm(
            slack_id,
            f"Meal orders close at 6pm today. Place your order: {form_url}",
            blocks=[{
                "type": "section",
                "text": {
                    "type": "mrkdwn",
                    "text": (
                        f"Hey {emp['name'].split()[0]}! Meal orders close at *6pm today*.\n\n"
                        f"*<{form_url}|Place your order>*"
                    ),
                },
            }],
        )
        dm_count += 1
    return {"status": "reminders_sent", "week": week, "dm_count": dm_count, "missing_count": len(missing)}
--- a/functions/slack_notifier/requirements.txt
+++ b/functions/slack_notifier/requirements.txt
@ -0,0 +1 @@
 boto3
--- a/functions/submit_order/handler.py
+++ b/functions/submit_order/handler.py
@ -0,0 +1,82 @@
 import json
 import os
 from datetime import datetime
 from zoneinfo import ZoneInfo
 from shared.db import current_week, get_form_status, put_order
 EASTERN = ZoneInfo("America/New_York")
 API_KEY = os.environ.get("FORM_API_KEY", "")
 def lambda_handler(event, context):
    method = event.get("requestContext", {}).get("http", {}).get("method", "GET")
    path = event.get("rawPath", "")
    if "/form-status/" in path:
        return handle_form_status(event)
    if method == "POST":
        return handle_submit(event)
    return response(405, {"error": "Method not allowed"})
 def handle_form_status(event):
    week = event.get("pathParameters", {}).get("week", current_week())
    status = get_form_status(week)
    return response(200, {"week": week, "status": status})
 def handle_submit(event):
    api_key = event.get("headers", {}).get("x-api-key", "")
    if API_KEY and api_key != API_KEY:
        return response(403, {"error": "Invalid API key"})
    try:
        body = json.loads(event.get("body", "{}"))
    except json.JSONDecodeError:
        return response(400, {"error": "Invalid JSON"})
    name = body.get("employee_name", "").strip()
    email = body.get("employee_email", "").strip()
    items = body.get("items", [])
    if not name:
        return response(400, {"error": "Employee name is required"})
    if not email:
        return response(400, {"error": "Employee email is required"})
    if not items or not any(i.get("quantity", 0) > 0 for i in items):
        return response(400, {"error": "Please select at least one meal"})
    week = current_week()
    status = get_form_status(week)
    if status == "closed":
        return response(410, {"error": "Orders are closed for this week"})
    if status == "not_found":
        return response(404, {"error": "No menu available for this week"})
    filtered_items = [i for i in items if i.get("quantity", 0) > 0]
    total = sum((i.get("price", 0) or 0) * i.get("quantity", 0) for i in filtered_items)
    slug = "".join(c if c.isalnum() or c in "- " else "" for c in name).strip().replace(" ", "-").lower()
    order_data = {
        "employee_name": name,
        "employee_email": email,
        "submitted_at": datetime.now(EASTERN).isoformat(),
        "items": filtered_items,
        "total": round(total, 2),
    }
    put_order(week, slug, order_data)
    return response(200, {"status": "ok", "message": f"Order saved for {name}", "total": order_data["total"]})
 def response(status_code: int, body: dict) -> dict:
    return {
        "statusCode": status_code,
        "headers": {"Content-Type": "application/json"},
        "body": json.dumps(body),
    }
--- a/functions/submit_order/requirements.txt
+++ b/functions/submit_order/requirements.txt
@ -0,0 +1 @@
 boto3
--- a/requirements.txt
+++ b/requirements.txt
@ -0,0 +1,2 @@
 playwright>=1.40
 flask>=3.0
--- a/samconfig.toml.example
+++ b/samconfig.toml.example
@ -0,0 +1,10 @@
 version = 0.1
 [default.deploy.parameters]
 stack_name = "meal-order-manager"
 resolve_s3 = true
 s3_prefix = "meal-order-manager"
 region = "us-east-1"
 confirm_changeset = true
 capabilities = "CAPABILITY_IAM"
 parameter_overrides = "CustomDomain=orders.seahavenind.com CertificateArn=arn:aws:acm:us-east-1:328440206208:certificate/CHANGE-ME FormApiKey=CHANGE-ME PayrollEmail=payroll@seahavenind.com SenderEmail=adam@seahavenind.com"
--- a/scripts/notify_slack.py
+++ b/scripts/notify_slack.py
@ -0,0 +1,74 @@
 """
 Posts the weekly menu notification to Slack.
 Used by GitHub Actions after uploading the form to S3.
 Usage: python3 scripts/notify_slack.py <form_url>
 """
 import json
 import os
 import sys
 import urllib.request
 SLACK_BOT_TOKEN_SECRET = os.environ.get("SLACK_BOT_TOKEN_SECRET", "meal-order-manager/slack-bot-token")
 SLACK_CHANNEL_PARAM = os.environ.get("SLACK_CHANNEL_PARAM", "/meal-order-manager/slack-channel-id")
 def get_secret(secret_id):
    import boto3
    return boto3.client("secretsmanager").get_secret_value(SecretId=secret_id)["SecretString"]
 def get_parameter(name):
    import boto3
    return boto3.client("ssm").get_parameter(Name=name, WithDecryption=True)["Parameter"]["Value"]
 def main():
    if len(sys.argv) < 2:
        print("Usage: notify_slack.py <form_url>", file=sys.stderr)
        sys.exit(1)
    form_url = sys.argv[1]
    token = get_secret(SLACK_BOT_TOKEN_SECRET)
    channel = get_parameter(SLACK_CHANNEL_PARAM)
    text = f"This week's meal order is open! Deadline: Thursday 6pm."
    blocks = [
        {
            "type": "header",
            "text": {"type": "plain_text", "text": "Meal Order Open"},
        },
        {
            "type": "section",
            "text": {
                "type": "mrkdwn",
                "text": (
                    f"*<{form_url}|Place your order>*\n\n"
                    f"*Deadline:* Thursday 6pm\n"
                ),
            },
        },
    ]
    payload = json.dumps({"channel": channel, "text": text, "blocks": blocks}).encode()
    req = urllib.request.Request(
        "https://slack.com/api/chat.postMessage",
        data=payload,
        headers={
            "Authorization": f"Bearer {token}",
            "Content-Type": "application/json",
        },
    )
    with urllib.request.urlopen(req) as resp:
        result = json.loads(resp.read())
    if result.get("ok"):
        print(f"Slack notification sent to channel {channel}")
    else:
        print(f"Slack API error: {result.get('error')}", file=sys.stderr)
        sys.exit(1)
 if __name__ == "__main__":
    main()
--- a/scripts/seed_roster.py
+++ b/scripts/seed_roster.py
@ -0,0 +1,55 @@
 """
 Seeds the employee roster into DynamoDB from config.json.
 Usage: python3 scripts/seed_roster.py
 Each employee needs: name, email, and slack_user_id (for DM reminders).
 To find Slack user IDs, use the Slack API:
  curl -s -H "Authorization: Bearer $TOKEN" \
    "https://slack.com/api/users.lookupByEmail?email=name@seahavenind.com" \
    | jq .user.id
 """
 import json
 import os
 import sys
 from pathlib import Path
 import boto3
 PROJECT_ROOT = Path(__file__).resolve().parents[1]
 CONFIG_PATH = PROJECT_ROOT / "config.json"
 TABLE_NAME = os.environ.get("TABLE_NAME", "meal-order-manager-orders")
 def main():
    with open(CONFIG_PATH) as f:
        config = json.load(f)
    roster = config.get("roster", [])
    if not roster:
        print("No roster found in config.json", file=sys.stderr)
        sys.exit(1)
    for emp in roster:
        if "slack_user_id" not in emp:
            emp["slack_user_id"] = ""
    table = boto3.resource("dynamodb").Table(TABLE_NAME)
    from datetime import datetime
    table.put_item(Item={
        "PK": "CONFIG",
        "SK": "ROSTER",
        "employees": roster,
        "updated_at": datetime.now().isoformat(),
    })
    print(f"Seeded {len(roster)} employees to DynamoDB")
    for emp in roster:
        sid = emp.get("slack_user_id", "")
        status = "ready" if sid else "MISSING slack_user_id"
        print(f"  {emp['name']} ({emp['email']}) — {status}")
 if __name__ == "__main__":
    main()
--- a/scripts/upload_menu.py
+++ b/scripts/upload_menu.py
@ -0,0 +1,59 @@
 """
 Uploads the latest scraped menu JSON to DynamoDB.
 Used by the GitHub Actions weekly workflow after scraping.
 """
 import json
 import os
 import sys
 from datetime import datetime
 from decimal import Decimal
 from pathlib import Path
 import boto3
 PROJECT_ROOT = Path(__file__).resolve().parents[1]
 OUTPUT_DIR = PROJECT_ROOT / "output"
 TABLE_NAME = os.environ.get("TABLE_NAME", "meal-order-manager-orders")
 def convert_floats(obj):
    if isinstance(obj, float):
        return Decimal(str(obj))
    if isinstance(obj, dict):
        return {k: convert_floats(v) for k, v in obj.items()}
    if isinstance(obj, list):
        return [convert_floats(i) for i in obj]
    return obj
 def main():
    files = sorted(OUTPUT_DIR.glob("menu-*.json"), reverse=True)
    if not files:
        print("Error: No menu JSON found. Run scrape_menu.py first.", file=sys.stderr)
        sys.exit(1)
    with open(files[0]) as f:
        menu = json.load(f)
    week = datetime.now().strftime("%Y-W%U")
    table = boto3.resource("dynamodb").Table(TABLE_NAME)
    import time
    item = {
        "PK": f"WEEK#{week}",
        "SK": "MENU",
        "form_status": "open",
        "scraped_at": menu.get("scraped_at"),
        "menu_url": menu.get("menu_url"),
        "meal_count": menu.get("meal_count"),
        "meals": convert_floats(menu.get("meals", [])),
        "ttl": int(time.time()) + (90 * 86400),
    }
    table.put_item(Item=item)
    print(f"Uploaded menu for {week} to DynamoDB ({len(menu.get('meals', []))} meals)")
 if __name__ == "__main__":
    main()
--- a/src/aggregator/aggregate.py
+++ b/src/aggregator/aggregate.py
@ -0,0 +1,152 @@
 """
 Order aggregation script.
 Reads all submitted orders for a given week and produces:
 1. Order summary — total quantity of each meal (for submitting to Redefine Meals)
 2. Payroll deduction report — CSV with employee name, email, itemized meals, total amount
 """
 import csv
 import json
 import sys
 from collections import defaultdict
 from datetime import datetime
 from pathlib import Path
 PROJECT_ROOT = Path(__file__).resolve().parents[2]
 CONFIG_PATH = PROJECT_ROOT / "config.json"
 ORDERS_DIR = PROJECT_ROOT / "orders"
 OUTPUT_DIR = PROJECT_ROOT / "output"
 def load_config():
    with open(CONFIG_PATH) as f:
        return json.load(f)
 def current_week() -> str:
    return datetime.now().strftime("%Y-W%U")
 def load_orders(week: str) -> list[dict]:
    week_dir = ORDERS_DIR / week
    if not week_dir.exists():
        return []
    orders = []
    for f in sorted(week_dir.glob("*.json")):
        with open(f) as fh:
            orders.append(json.load(fh))
    return orders
 def generate_order_summary(orders: list[dict]) -> dict:
    """Aggregate all meals across employees into a single order for Redefine."""
    meal_totals = defaultdict(lambda: {"quantity": 0, "unit_price": 0})
    for order in orders:
        for item in order.get("items", []):
            name = item["name"]
            meal_totals[name]["quantity"] += item.get("quantity", 0)
            meal_totals[name]["unit_price"] = item.get("price", 0)
    summary = []
    for name, data in sorted(meal_totals.items()):
        summary.append({
            "meal": name,
            "quantity": data["quantity"],
            "unit_price": data["unit_price"],
            "line_total": round(data["unit_price"] * data["quantity"], 2),
        })
    grand_total = sum(s["line_total"] for s in summary)
    total_meals = sum(s["quantity"] for s in summary)
    return {
        "week": orders[0]["week"] if orders else "",
        "generated_at": datetime.now().isoformat(),
        "total_employees": len(orders),
        "total_meals": total_meals,
        "grand_total": round(grand_total, 2),
        "meals": summary,
    }
 def generate_payroll_csv(orders: list[dict], output_path: Path):
    """Write a CSV for payroll with one row per employee."""
    with open(output_path, "w", newline="") as f:
        writer = csv.writer(f)
        writer.writerow(["Employee Name", "Employee Email", "Items Ordered", "Total Deduction"])
        for order in sorted(orders, key=lambda o: o["employee_name"]):
            items_str = "; ".join(
                f"{item['name']} x{item['quantity']} (${item['subtotal']:.2f})"
                for item in order.get("items", [])
            )
            writer.writerow([
                order["employee_name"],
                order["employee_email"],
                items_str,
                f"${order['total']:.2f}",
            ])
 def generate_order_summary_csv(summary: dict, output_path: Path):
    """Write a CSV of the aggregated order for submitting to Redefine."""
    with open(output_path, "w", newline="") as f:
        writer = csv.writer(f)
        writer.writerow(["Meal", "Quantity", "Unit Price", "Line Total"])
        for meal in summary["meals"]:
            writer.writerow([
                meal["meal"],
                meal["quantity"],
                f"${meal['unit_price']:.2f}",
                f"${meal['line_total']:.2f}",
            ])
        writer.writerow([])
        writer.writerow(["TOTAL", summary["total_meals"], "", f"${summary['grand_total']:.2f}"])
 def main():
    week = sys.argv[1] if len(sys.argv) > 1 else current_week()
    orders = load_orders(week)
    if not orders:
        print(f"No orders found for week {week}")
        print(f"  Expected directory: {ORDERS_DIR / week}")
        sys.exit(1)
    print(f"Processing {len(orders)} orders for week {week}")
    summary = generate_order_summary(orders)
    OUTPUT_DIR.mkdir(exist_ok=True)
    # Save order summary
    summary_json = OUTPUT_DIR / f"order-summary-{week}.json"
    with open(summary_json, "w") as f:
        json.dump(summary, f, indent=2)
    summary_csv = OUTPUT_DIR / f"order-summary-{week}.csv"
    generate_order_summary_csv(summary, summary_csv)
    # Save payroll report
    payroll_csv = OUTPUT_DIR / f"payroll-deductions-{week}.csv"
    generate_payroll_csv(orders, payroll_csv)
    # Print summary
    print(f"\n{'='*60}")
    print(f"ORDER SUMMARY — Week {week}")
    print(f"{'='*60}")
    print(f"{'Meal':<45} {'Qty':>4} {'Total':>8}")
    print("-" * 60)
    for meal in summary["meals"]:
        print(f"{meal['meal']:<45} {meal['quantity']:>4} ${meal['line_total']:>7.2f}")
    print("-" * 60)
    print(f"{'TOTAL':<45} {summary['total_meals']:>4} ${summary['grand_total']:>7.2f}")
    print(f"\n{summary['total_employees']} employees ordered")
    print(f"\nFiles generated:")
    print(f"  Order summary: {summary_csv}")
    print(f"  Payroll report: {payroll_csv}")
    print(f"  Raw JSON:       {summary_json}")
 if __name__ == "__main__":
    main()
--- a/src/scraper/recon.py
+++ b/src/scraper/recon.py
@ -0,0 +1,122 @@
 """
 Reconnaissance script: loads redefinemeals.com/menu in a real browser,
 intercepts all network requests, and dumps the page structure.
 Run this once to understand the site before building the production scraper.
 """
 import json
 import sys
 from playwright.sync_api import sync_playwright
 def run_recon():
    api_responses = []
    all_requests = []
    with sync_playwright() as p:
        browser = p.chromium.launch(headless=True)
        context = browser.new_context(
            user_agent="Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.0.0 Safari/537.36"
        )
        page = context.new_page()
        def handle_response(response):
            url = response.url
            content_type = response.headers.get("content-type", "")
            all_requests.append({
                "url": url,
                "status": response.status,
                "content_type": content_type,
            })
            if "json" in content_type or "graphql" in url.lower():
                try:
                    body = response.json()
                    api_responses.append({
                        "url": url,
                        "status": response.status,
                        "body_preview": json.dumps(body)[:2000],
                    })
                except Exception:
                    pass
            elif url.endswith(".json") or "/api/" in url:
                try:
                    body = response.text()
                    api_responses.append({
                        "url": url,
                        "status": response.status,
                        "body_preview": body[:2000],
                    })
                except Exception:
                    pass
        page.on("response", handle_response)
        print("Navigating to https://redefinemeals.com/menu ...")
        page.goto("https://redefinemeals.com/menu", wait_until="networkidle", timeout=60000)
        page.wait_for_timeout(5000)
        print(f"\n{'='*60}")
        print("PAGE TITLE:", page.title())
        print(f"{'='*60}")
        print(f"\n--- All network requests ({len(all_requests)} total) ---")
        for req in all_requests:
            if any(ext in req["url"] for ext in [".png", ".jpg", ".jpeg", ".gif", ".svg", ".ico", ".woff", ".woff2", ".ttf", ".css"]):
                continue
            print(f"  [{req['status']}] {req['content_type'][:30]:30s} {req['url'][:120]}")
        print(f"\n--- JSON/API responses ({len(api_responses)} found) ---")
        for resp in api_responses:
            print(f"\n  URL: {resp['url']}")
            print(f"  Status: {resp['status']}")
            print(f"  Body preview:\n    {resp['body_preview'][:500]}")
        print(f"\n--- Page structure (meal-related elements) ---")
        for selector in [
            "[class*='meal']", "[class*='menu']", "[class*='product']",
            "[class*='item']", "[class*='card']", "[data-product]",
            "[data-item]", ".grid > div", "article",
        ]:
            elements = page.query_selector_all(selector)
            if elements:
                print(f"\n  Selector '{selector}': {len(elements)} elements")
                if elements:
                    first = elements[0]
                    print(f"    Tag: {first.evaluate('el => el.tagName')}")
                    print(f"    Classes: {first.evaluate('el => el.className')}")
                    inner = first.inner_text()
                    print(f"    Text preview: {inner[:200]}")
        # Also dump outer HTML of likely meal containers
        print(f"\n--- Raw HTML sample (first product/card element) ---")
        for selector in ["[class*='product']", "[class*='card']", "[class*='meal']", "[class*='menu-item']"]:
            els = page.query_selector_all(selector)
            if els:
                html = els[0].evaluate("el => el.outerHTML")
                print(f"\n  Selector: {selector}")
                print(f"  Count: {len(els)}")
                print(f"  First element HTML:\n{html[:1500]}")
                break
        # Check for Shopify, WooCommerce, or other known platforms
        print(f"\n--- Platform detection ---")
        platform_checks = {
            "Shopify": "Shopify" in page.content(),
            "WooCommerce": "woocommerce" in page.content().lower(),
            "Squarespace": "squarespace" in page.content().lower(),
            "Wix": "wix" in page.content().lower(),
        }
        for name, found in platform_checks.items():
            if found:
                print(f"  Detected: {name}")
        # Try to get the full page URL after any redirects
        print(f"\n  Final URL: {page.url}")
        browser.close()
    return api_responses
 if __name__ == "__main__":
    run_recon()
--- a/src/scraper/recon_deep.py
+++ b/src/scraper/recon_deep.py
@ -0,0 +1,106 @@
 """
 Deep recon: extract the full structure of a single meal card
 and check for menu-related API endpoints.
 """
 import json
 from playwright.sync_api import sync_playwright
 def run():
    api_hits = []
    with sync_playwright() as p:
        browser = p.chromium.launch(headless=True)
        context = browser.new_context(
            user_agent="Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36"
        )
        page = context.new_page()
        def capture_response(response):
            ct = response.headers.get("content-type", "")
            if "json" in ct or "/api/" in response.url:
                try:
                    body = response.json()
                    api_hits.append({"url": response.url, "body": body})
                except Exception:
                    pass
        page.on("response", capture_response)
        page.goto("https://www.redefinemeals.com/menu", wait_until="networkidle", timeout=60000)
        page.wait_for_timeout(3000)
        # Extract detailed structure from first few article cards
        articles = page.query_selector_all("article.editorial_card")
        print(f"Found {len(articles)} article.editorial_card elements\n")
        for i, article in enumerate(articles[:3]):
            html = article.evaluate("el => el.outerHTML")
            text = article.inner_text()
            print(f"--- Article {i} ---")
            print(f"Text:\n{text}\n")
            print(f"HTML:\n{html[:3000]}\n")
        # Check for dietary tag elements
        print("\n--- Dietary/tag elements ---")
        for sel in ["[class*='tag']", "[class*='diet']", "[class*='label']", "[class*='badge']", "[class*='filter']"]:
            els = page.query_selector_all(sel)
            if els:
                texts = [e.inner_text().strip() for e in els[:10] if e.inner_text().strip()]
                print(f"  {sel}: {len(els)} elements, samples: {texts}")
        # Check for filter/category buttons
        print("\n--- Filter/category buttons ---")
        for sel in ["button", "[class*='filter']", "[class*='category']", "[class*='tab']"]:
            els = page.query_selector_all(sel)
            if els:
                texts = [e.inner_text().strip() for e in els[:20] if e.inner_text().strip()]
                print(f"  {sel}: {texts}")
        # Try known API patterns
        print("\n--- Trying API endpoints ---")
        for path in ["/api/menu", "/api/products", "/api/meals", "/api/items", "/api/categories"]:
            try:
                resp = page.evaluate(f"""
                    async () => {{
                        const r = await fetch('{path}');
                        if (r.ok) return await r.text();
                        return `${{r.status}}`;
                    }}
                """)
                if resp and resp not in ["404", "500", "403"]:
                    print(f"  {path}: {resp[:500]}")
                else:
                    print(f"  {path}: {resp}")
            except Exception as e:
                print(f"  {path}: error - {e}")
        # Check for Quick View modal data
        print("\n--- Quick View data (click first meal) ---")
        quick_view_btns = page.query_selector_all("[class*='quick']")
        if quick_view_btns:
            print(f"  Found {len(quick_view_btns)} Quick View buttons")
            try:
                quick_view_btns[0].click()
                page.wait_for_timeout(2000)
                # Look for modal content
                for sel in [".modal", "[class*='modal']", "[class*='popup']", "[class*='quick-view']", "[class*='quickview']"]:
                    modal = page.query_selector(sel)
                    if modal and modal.is_visible():
                        print(f"  Modal selector: {sel}")
                        print(f"  Modal text:\n{modal.inner_text()[:1000]}")
                        break
            except Exception as e:
                print(f"  Quick View click failed: {e}")
        print(f"\n--- API calls captured ---")
        for hit in api_hits:
            print(f"  {hit['url']}")
            print(f"  {json.dumps(hit['body'])[:500]}\n")
        browser.close()
 if __name__ == "__main__":
    run()
--- a/src/scraper/scrape_menu.py
+++ b/src/scraper/scrape_menu.py
@ -0,0 +1,259 @@
 """
 Redefine Meals menu scraper.
 Navigates to the menu page using a headless browser, waits for the
 Vue.js SPA to render, and extracts structured meal data from the DOM.
 Also intercepts network requests to detect any JSON API that could
 replace the browser scrape in the future.
 """
 import json
 import sys
 import os
 from datetime import datetime
 from pathlib import Path
 from playwright.sync_api import sync_playwright, TimeoutError as PwTimeout
 CONFIG_PATH = Path(__file__).resolve().parents[2] / "config.json"
 def load_config():
    with open(CONFIG_PATH) as f:
        return json.load(f)
 def scrape_menu(url: str, *, headless: bool = True, timeout_ms: int = 60_000) -> dict:
    """
    Returns {
        "scraped_at": ISO timestamp,
        "menu_url": str,
        "api_endpoints_found": [str],
        "meals": [ { name, price, calories, protein, dietary_tags,
                      image_url, is_new, description } ]
    }
    Raises RuntimeError if the page fails to load or no meals are found.
    """
    api_endpoints = []
    with sync_playwright() as p:
        browser = p.chromium.launch(headless=headless)
        context = browser.new_context(
            user_agent=(
                "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) "
                "AppleWebKit/537.36 (KHTML, like Gecko) "
                "Chrome/120.0.0.0 Safari/537.36"
            )
        )
        page = context.new_page()
        def on_response(response):
            ct = response.headers.get("content-type", "")
            if "json" in ct and "/api/" in response.url and "cart" not in response.url:
                api_endpoints.append(response.url)
        page.on("response", on_response)
        try:
            page.goto(url, wait_until="networkidle", timeout=timeout_ms)
        except PwTimeout:
            browser.close()
            raise RuntimeError(f"Timed out loading {url}")
        page.wait_for_timeout(3000)
        articles = page.query_selector_all("article.editorial_card")
        if not articles:
            browser.close()
            raise RuntimeError(
                "No meal cards found on page. The site layout may have changed. "
                "Run recon.py to inspect the current structure."
            )
        meals = []
        for article in articles:
            meal = _extract_card(article)
            if meal:
                meals.append(meal)
        # Try to get descriptions via Quick View modals
        _enrich_with_descriptions(page, articles, meals)
        browser.close()
    if not meals:
        raise RuntimeError("Scraped 0 meals — extraction selectors are likely broken.")
    for meal in meals:
        meal["dietary_tags"] = _clean_tags(meal["dietary_tags"])
    return {
        "scraped_at": datetime.now().isoformat(),
        "menu_url": url,
        "api_endpoints_found": api_endpoints,
        "meal_count": len(meals),
        "meals": meals,
    }
 def _extract_card(article) -> dict | None:
    try:
        name_el = article.query_selector("h2.meal_title")
        if not name_el:
            return None
        name = name_el.inner_text().strip()
        price_el = article.query_selector(".meal_price")
        price_text = price_el.inner_text().strip() if price_el else ""
        price = _parse_price(price_text)
        cal_el = article.query_selector(".card_macros_brief")
        calories = None
        protein = None
        if cal_el:
            macros_text = cal_el.inner_text()
            calories, protein = _parse_macros(macros_text)
        tag_els = article.query_selector_all(".diet_mini_tag")
        dietary_tags = [t.inner_text().strip().title() for t in tag_els if t.inner_text().strip()]
        img_el = article.query_selector("img.main_meal_img")
        image_url = img_el.get_attribute("src") if img_el else None
        is_new = article.query_selector(".new_badge_pulse") is not None
        return {
            "name": name,
            "price": price,
            "calories": calories,
            "protein": protein,
            "dietary_tags": dietary_tags,
            "image_url": image_url,
            "is_new": is_new,
            "description": None,
        }
    except Exception as e:
        print(f"  Warning: failed to extract a card: {e}", file=sys.stderr)
        return None
 def _enrich_with_descriptions(page, articles, meals):
    """Click each meal's Quick View overlay to grab the description."""
    for i, article in enumerate(articles):
        if i >= len(meals):
            break
        try:
            overlay = article.query_selector(".card_overlay")
            if not overlay:
                continue
            article.query_selector(".card_media_wrap").click()
            page.wait_for_timeout(800)
            modal = page.query_selector(".modal.show, [class*='modal'][class*='show'], [class*='quickview']")
            if not modal:
                # Try broader selector
                modal = page.query_selector("[class*='modal']:not([style*='display: none'])")
            if modal and modal.is_visible():
                desc_el = modal.query_selector("[class*='description'], [class*='desc'], .meal_description")
                if desc_el:
                    desc_text = desc_el.inner_text().strip()
                    # Filter out price strings and very short text
                    if desc_text and len(desc_text) > 10 and not desc_text.startswith("$"):
                        meals[i]["description"] = desc_text
                # Grab full macro details if available
                detail_tags = modal.query_selector_all(".diet_mini_tag, [class*='lifestyle'] span")
                for tag_el in detail_tags:
                    tag_text = tag_el.inner_text().strip().title()
                    if tag_text and tag_text not in meals[i]["dietary_tags"]:
                        meals[i]["dietary_tags"].append(tag_text)
                # Close modal
                close_btn = modal.query_selector("button[class*='close'], [aria-label='Close'], .btn-close")
                if close_btn:
                    close_btn.click()
                else:
                    page.keyboard.press("Escape")
                page.wait_for_timeout(300)
        except Exception as e:
            print(f"  Warning: Quick View failed for meal {i} ({meals[i]['name']}): {e}", file=sys.stderr)
            try:
                page.keyboard.press("Escape")
                page.wait_for_timeout(300)
            except Exception:
                pass
 KNOWN_TAGS = ["Gluten Free", "Dairy Free", "Grass-Fed", "Low Carb", "Keto", "Vegan", "Vegetarian", "Nut Free"]
 def _clean_tags(raw_tags: list[str]) -> list[str]:
    """Split concatenated tags and deduplicate."""
    import re
    cleaned = set()
    for raw in raw_tags:
        # Split on known tag boundaries (e.g., "Gluten Freedairy Free" → "Gluten Free", "Dairy Free")
        remaining = raw
        for known in KNOWN_TAGS:
            if known.lower() in remaining.lower():
                cleaned.add(known)
                remaining = re.sub(re.escape(known), "", remaining, flags=re.IGNORECASE).strip()
        if remaining and len(remaining) > 2:
            cleaned.add(remaining.strip().title())
    return sorted(cleaned)
 def _parse_price(text: str) -> float | None:
    text = text.replace("$", "").replace(",", "").strip()
    try:
        return float(text)
    except ValueError:
        return None
 def _parse_macros(text: str) -> tuple[int | None, str | None]:
    """Parse '570cal • 39gP' into (570, '39g')."""
    import re
    cal_match = re.search(r"(\d+)\s*cal", text, re.IGNORECASE)
    prot_match = re.search(r"(\d+g?)\s*P", text)
    calories = int(cal_match.group(1)) if cal_match else None
    protein = prot_match.group(1) if prot_match else None
    if protein and not protein.endswith("g"):
        protein += "g"
    return calories, protein
 def main():
    config = load_config()
    url = config.get("menu_url", "https://www.redefinemeals.com/menu")
    output_dir = Path(__file__).resolve().parents[2] / config.get("output_dir", "output")
    output_dir.mkdir(exist_ok=True)
    print(f"Scraping menu from {url} ...")
    result = scrape_menu(url)
    week_str = datetime.now().strftime("%Y-W%U")
    output_file = output_dir / f"menu-{week_str}.json"
    with open(output_file, "w") as f:
        json.dump(result, f, indent=2)
    print(f"\nScraped {result['meal_count']} meals")
    if result["api_endpoints_found"]:
        print(f"API endpoints detected (potential future shortcut):")
        for ep in result["api_endpoints_found"]:
            print(f"  {ep}")
    print(f"Output saved to {output_file}")
    # Print summary table
    print(f"\n{'Name':<40} {'Price':>7} {'Cal':>5} {'Prot':>5} {'Tags'}")
    print("-" * 90)
    for m in result["meals"]:
        tags = ", ".join(m["dietary_tags"]) if m["dietary_tags"] else ""
        new = " *NEW*" if m["is_new"] else ""
        price = f"${m['price']:.2f}" if m["price"] else "?"
        cal = str(m["calories"]) if m["calories"] else "?"
        prot = m["protein"] or "?"
        print(f"{(m['name'] + new):<40} {price:>7} {cal:>5} {prot:>5} {tags}")
 if __name__ == "__main__":
    main()
--- a/src/server/app.py
+++ b/src/server/app.py
@ -0,0 +1,121 @@
 """
 Lightweight Flask server for the meal order form.
 Serves the generated HTML form and handles order submissions.
 Orders are saved as JSON files in the orders directory, one per employee per week.
 """
 import json
 import os
 from datetime import datetime
 from pathlib import Path
 from flask import Flask, jsonify, request, send_file
 PROJECT_ROOT = Path(__file__).resolve().parents[2]
 CONFIG_PATH = PROJECT_ROOT / "config.json"
 OUTPUT_DIR = PROJECT_ROOT / "output"
 ORDERS_DIR = PROJECT_ROOT / "orders"
 app = Flask(__name__)
 def load_config():
    with open(CONFIG_PATH) as f:
        return json.load(f)
 def current_week() -> str:
    return datetime.now().strftime("%Y-W%U")
 def latest_menu_file() -> Path | None:
    files = sorted(OUTPUT_DIR.glob("menu-*.json"), reverse=True)
    return files[0] if files else None
@app.route("/")
 def index():
    form_file = OUTPUT_DIR / f"order-form-{current_week()}.html"
    if not form_file.exists():
        return "No order form generated for this week. Run generate_form.py first.", 404
    return send_file(form_file)
@app.route("/api/menu")
 def get_menu():
    menu_file = latest_menu_file()
    if not menu_file:
        return jsonify({"error": "No menu data available. Run scrape_menu.py first."}), 404
    with open(menu_file) as f:
        return jsonify(json.load(f))
@app.route("/api/roster")
 def get_roster():
    config = load_config()
    return jsonify(config.get("roster", []))
@app.route("/api/submit-order", methods=["POST"])
 def submit_order():
    data = request.get_json()
    if not data:
        return jsonify({"error": "No data received"}), 400
    name = data.get("employee_name", "").strip()
    email = data.get("employee_email", "").strip()
    items = data.get("items", [])
    if not name:
        return jsonify({"error": "Employee name is required"}), 400
    if not email:
        return jsonify({"error": "Employee email is required"}), 400
    if not items or not any(i.get("quantity", 0) > 0 for i in items):
        return jsonify({"error": "Please select at least one meal"}), 400
    week = current_week()
    week_dir = ORDERS_DIR / week
    week_dir.mkdir(parents=True, exist_ok=True)
    safe_name = "".join(c if c.isalnum() or c in "-_ " else "" for c in name).strip().replace(" ", "-").lower()
    order_file = week_dir / f"{safe_name}.json"
    order = {
        "employee_name": name,
        "employee_email": email,
        "week": week,
        "submitted_at": datetime.now().isoformat(),
        "items": [i for i in items if i.get("quantity", 0) > 0],
        "total": sum(
            (i.get("price", 0) or 0) * i.get("quantity", 0)
            for i in items
            if i.get("quantity", 0) > 0
        ),
    }
    with open(order_file, "w") as f:
        json.dump(order, f, indent=2)
    return jsonify({"status": "ok", "message": f"Order saved for {name}", "total": order["total"]})
@app.route("/api/orders/<week>")
 def get_orders(week: str):
    week_dir = ORDERS_DIR / week
    if not week_dir.exists():
        return jsonify({"orders": [], "week": week})
    orders = []
    for f in sorted(week_dir.glob("*.json")):
        with open(f) as fh:
            orders.append(json.load(fh))
    return jsonify({"orders": orders, "week": week})
 if __name__ == "__main__":
    ORDERS_DIR.mkdir(exist_ok=True)
    print(f"Menu file: {latest_menu_file()}")
    print(f"Orders dir: {ORDERS_DIR}")
    app.run(host="0.0.0.0", port=5050, debug=True)
--- a/src/server/generate_form.py
+++ b/src/server/generate_form.py
@ -0,0 +1,321 @@
 """
 Generates a self-contained HTML order form from the latest scraped menu.
 The form shows this week's meals with quantity selectors, a running total,
 and submits orders to the backend (local Flask or cloud API Gateway).
 Usage:
  python3 generate_form.py                                    # local mode
  python3 generate_form.py --api-url URL --api-key KEY        # cloud mode
 """
 import argparse
 import json
 import sys
 from datetime import datetime
 from pathlib import Path
 PROJECT_ROOT = Path(__file__).resolve().parents[2]
 OUTPUT_DIR = PROJECT_ROOT / "output"
 CONFIG_PATH = PROJECT_ROOT / "config.json"
 def load_config():
    with open(CONFIG_PATH) as f:
        return json.load(f)
 def latest_menu() -> dict:
    files = sorted(OUTPUT_DIR.glob("menu-*.json"), reverse=True)
    if not files:
        print("Error: No menu JSON found. Run scrape_menu.py first.", file=sys.stderr)
        sys.exit(1)
    with open(files[0]) as f:
        return json.load(f)
 def generate_form(menu: dict, config: dict, api_url: str = "", api_key: str = "") -> str:
    meals_json = json.dumps(menu["meals"])
    roster_json = json.dumps(config.get("roster", []))
    deadline = config.get("order_deadline", "Thursday 6:00 PM")
    week = datetime.now().strftime("%Y-W%U")
    scraped_at = menu.get("scraped_at", "unknown")
    submit_url = f"{api_url}/api/submit-order" if api_url else "/api/submit-order"
    status_url = f"{api_url}/api/form-status/{week}" if api_url else ""
    api_key_json = json.dumps(api_key)
    return f"""<!DOCTYPE html>
 <html lang="en">
 <head>
 <meta charset="UTF-8">
 <meta name="viewport" content="width=device-width, initial-scale=1.0">
 <title>Sea Haven — Meal Order ({week})</title>
 <style>
 * {{ margin: 0; padding: 0; box-sizing: border-box; }}
 body {{ font-family: -apple-system, BlinkMacSystemFont, 'Segoe UI', Roboto, sans-serif; background: #f5f5f7; color: #1d1d1f; }}
 .container {{ max-width: 800px; margin: 0 auto; padding: 16px; }}
 header {{ background: #1a1a2e; color: #fff; padding: 24px 16px; text-align: center; margin-bottom: 24px; border-radius: 12px; }}
 header h1 {{ font-size: 1.5rem; margin-bottom: 4px; }}
 header p {{ font-size: 0.85rem; opacity: 0.8; }}
 .deadline {{ background: #fef3c7; color: #92400e; padding: 10px 16px; border-radius: 8px; margin-bottom: 20px; font-size: 0.9rem; text-align: center; font-weight: 500; }}
 .employee-info {{ background: #fff; border-radius: 12px; padding: 16px; margin-bottom: 20px; box-shadow: 0 1px 3px rgba(0,0,0,0.08); }}
 .employee-info label {{ display: block; font-weight: 600; margin-bottom: 4px; font-size: 0.85rem; }}
 .employee-info input, .employee-info select {{ width: 100%; padding: 10px 12px; border: 1px solid #d1d5db; border-radius: 8px; font-size: 1rem; margin-bottom: 12px; }}
 .filters {{ display: flex; flex-wrap: wrap; gap: 8px; margin-bottom: 16px; }}
 .filters button {{ padding: 6px 14px; border: 1px solid #d1d5db; border-radius: 20px; background: #fff; font-size: 0.8rem; cursor: pointer; transition: all 0.2s; }}
 .filters button.active {{ background: #1a1a2e; color: #fff; border-color: #1a1a2e; }}
 .meal-card {{ background: #fff; border-radius: 12px; padding: 12px; margin-bottom: 12px; box-shadow: 0 1px 3px rgba(0,0,0,0.08); display: flex; gap: 12px; align-items: center; }}
 .meal-img {{ width: 80px; height: 80px; border-radius: 8px; object-fit: cover; flex-shrink: 0; }}
 .meal-info {{ flex: 1; min-width: 0; }}
 .meal-name {{ font-weight: 600; font-size: 0.95rem; margin-bottom: 2px; }}
 .meal-meta {{ font-size: 0.8rem; color: #6b7280; margin-bottom: 4px; }}
 .meal-tags {{ display: flex; flex-wrap: wrap; gap: 4px; margin-bottom: 4px; }}
 .meal-tags span {{ font-size: 0.7rem; padding: 2px 8px; border-radius: 10px; background: #e0f2fe; color: #0369a1; font-weight: 500; }}
 .meal-tags span.new {{ background: #dcfce7; color: #15803d; }}
 .qty-control {{ display: flex; align-items: center; gap: 0; flex-shrink: 0; }}
 .qty-control button {{ width: 32px; height: 32px; border: 1px solid #d1d5db; background: #f9fafb; font-size: 1.1rem; cursor: pointer; display: flex; align-items: center; justify-content: center; }}
 .qty-control button:first-child {{ border-radius: 8px 0 0 8px; }}
 .qty-control button:last-child {{ border-radius: 0 8px 8px 0; }}
 .qty-control .qty {{ width: 36px; height: 32px; text-align: center; border: 1px solid #d1d5db; border-left: 0; border-right: 0; font-size: 0.95rem; font-weight: 600; }}
 .meal-card.selected {{ border: 2px solid #1a1a2e; }}
 .sticky-footer {{ position: fixed; bottom: 0; left: 0; right: 0; background: #fff; border-top: 1px solid #e5e7eb; padding: 12px 16px; box-shadow: 0 -2px 8px rgba(0,0,0,0.1); z-index: 100; }}
 .sticky-footer .inner {{ max-width: 800px; margin: 0 auto; display: flex; justify-content: space-between; align-items: center; }}
 .total {{ font-size: 1.1rem; font-weight: 700; }}
 .submit-btn {{ background: #1a1a2e; color: #fff; border: none; padding: 12px 32px; border-radius: 8px; font-size: 1rem; font-weight: 600; cursor: pointer; transition: opacity 0.2s; }}
 .submit-btn:disabled {{ opacity: 0.4; cursor: not-allowed; }}
 .submit-btn:hover:not(:disabled) {{ opacity: 0.85; }}
 .success-msg {{ text-align: center; padding: 60px 20px; }}
 .success-msg h2 {{ color: #15803d; margin-bottom: 8px; }}
 .meal-desc {{ font-size: 0.8rem; color: #6b7280; margin-bottom: 4px; }}
 .search-bar {{ width: 100%; padding: 10px 12px; border: 1px solid #d1d5db; border-radius: 8px; font-size: 1rem; margin-bottom: 16px; }}
 body {{ padding-bottom: 80px; }}
 .closed-banner {{ background: #fee2e2; color: #991b1b; padding: 16px; border-radius: 8px; margin-bottom: 20px; text-align: center; font-weight: 600; font-size: 1rem; }}
 </style>
 </head>
 <body>
 <div class="container" id="app">
  <header>
    <h1>Sea Haven Meal Order</h1>
    <p>Week of {week} &middot; Menu scraped {scraped_at[:10]}</p>
  </header>
  <div class="deadline">Order deadline: {deadline}</div>
  <div class="employee-info">
    <label for="emp-name">Your Name</label>
    <input type="text" id="emp-name" placeholder="Full name" autocomplete="name">
    <label for="emp-email">Your Email</label>
    <input type="email" id="emp-email" placeholder="you@seahavenind.com" autocomplete="email">
  </div>
  <input type="text" class="search-bar" id="search" placeholder="Search meals...">
  <div class="filters" id="filters"></div>
  <div id="meals-list"></div>
  <div class="sticky-footer">
    <div class="inner">
      <div>
        <span class="total" id="total-display">$0.00</span>
        <span style="font-size:0.8rem;color:#6b7280;margin-left:8px;" id="count-display">0 meals</span>
      </div>
      <button class="submit-btn" id="submit-btn" disabled>Submit Order</button>
    </div>
  </div>
  <div id="success" class="success-msg" style="display:none;">
    <h2>Order submitted!</h2>
    <p id="success-detail"></p>
  </div>
 </div>
 <script>
 const MEALS = {meals_json};
 const ROSTER = {roster_json};
 const SUBMIT_URL = '{submit_url}';
 const STATUS_URL = '{status_url}';
 const API_KEY = {api_key_json};
 const WEEK = '{week}';
 const quantities = {{}};
 let formClosed = false;
 function init() {{
  checkFormStatus();
  // Build filter buttons
  const tags = new Set();
  MEALS.forEach(m => (m.dietary_tags || []).forEach(t => tags.add(t)));
  const cats = ['All Meals', ...Array.from(tags).sort()];
  const filtersEl = document.getElementById('filters');
  cats.forEach(cat => {{
    const btn = document.createElement('button');
    btn.textContent = cat;
    if (cat === 'All Meals') btn.classList.add('active');
    btn.onclick = () => {{
      filtersEl.querySelectorAll('button').forEach(b => b.classList.remove('active'));
      btn.classList.add('active');
      renderMeals();
    }};
    filtersEl.appendChild(btn);
  }});
  document.getElementById('search').addEventListener('input', renderMeals);
  document.getElementById('submit-btn').addEventListener('click', submitOrder);
  renderMeals();
 }}
 function renderMeals() {{
  const activeFilter = document.querySelector('.filters button.active')?.textContent || 'All Meals';
  const search = document.getElementById('search').value.toLowerCase();
  const list = document.getElementById('meals-list');
  list.innerHTML = '';
  MEALS.forEach((meal, i) => {{
    if (activeFilter !== 'All Meals' && !(meal.dietary_tags || []).includes(activeFilter)) return;
    if (search && !meal.name.toLowerCase().includes(search)) return;
    const qty = quantities[i] || 0;
    const card = document.createElement('div');
    card.className = 'meal-card' + (qty > 0 ? ' selected' : '');
    let tagsHtml = '';
    if (meal.is_new) tagsHtml += '<span class="new">NEW</span>';
    (meal.dietary_tags || []).forEach(t => {{ tagsHtml += `<span>${{t}}</span>`; }});
    const descHtml = meal.description ? `<div class="meal-desc">${{meal.description}}</div>` : '';
    const price = meal.price ? `$${{meal.price.toFixed(2)}}` : '—';
    card.innerHTML = `
      ${{meal.image_url ? `<img class="meal-img" src="${{meal.image_url}}" alt="${{meal.name}}" loading="lazy">` : ''}}
      <div class="meal-info">
        <div class="meal-name">${{meal.name}}</div>
        ${{descHtml}}
        <div class="meal-meta">${{price}} &middot; ${{meal.calories || '?'}} cal &middot; ${{meal.protein || '?'}} protein</div>
        <div class="meal-tags">${{tagsHtml}}</div>
      </div>
      <div class="qty-control">
        <button onclick="changeQty(${{i}}, -1)">&minus;</button>
        <input class="qty" type="text" value="${{qty}}" readonly>
        <button onclick="changeQty(${{i}}, 1)">+</button>
      </div>
    `;
    list.appendChild(card);
  }});
  updateTotal();
 }}
 function changeQty(index, delta) {{
  const current = quantities[index] || 0;
  const next = Math.max(0, current + delta);
  if (next === 0) delete quantities[index]; else quantities[index] = next;
  renderMeals();
 }}
 function updateTotal() {{
  let total = 0, count = 0;
  Object.entries(quantities).forEach(([i, qty]) => {{
    total += (MEALS[i].price || 0) * qty;
    count += qty;
  }});
  document.getElementById('total-display').textContent = `$${{total.toFixed(2)}}`;
  document.getElementById('count-display').textContent = `${{count}} meal${{count !== 1 ? 's' : ''}}`;
  document.getElementById('submit-btn').disabled = count === 0;
 }}
 async function submitOrder() {{
  const name = document.getElementById('emp-name').value.trim();
  const email = document.getElementById('emp-email').value.trim();
  if (!name) {{ alert('Please enter your name.'); return; }}
  if (!email) {{ alert('Please enter your email.'); return; }}
  const items = Object.entries(quantities).map(([i, qty]) => ({{
    name: MEALS[i].name,
    price: MEALS[i].price,
    quantity: qty,
    subtotal: (MEALS[i].price || 0) * qty,
  }}));
  const btn = document.getElementById('submit-btn');
  btn.disabled = true;
  btn.textContent = 'Submitting...';
  try {{
    const headers = {{ 'Content-Type': 'application/json' }};
    if (API_KEY) headers['x-api-key'] = API_KEY;
    const res = await fetch(SUBMIT_URL, {{
      method: 'POST',
      headers,
      body: JSON.stringify({{ employee_name: name, employee_email: email, items }}),
    }});
    const data = await res.json();
    if (res.ok) {{
      document.getElementById('app').querySelectorAll(':not(#success)').forEach(el => el.style.display = 'none');
      document.getElementById('success').style.display = 'block';
      document.getElementById('success-detail').textContent = `${{name}} — $${{data.total.toFixed(2)}} total. You're all set!`;
      document.querySelector('.sticky-footer').style.display = 'none';
    }} else {{
      alert(data.error || 'Something went wrong.');
      btn.disabled = false;
      btn.textContent = 'Submit Order';
    }}
  }} catch (e) {{
    alert('Failed to submit. Check your connection and try again.');
    btn.disabled = false;
    btn.textContent = 'Submit Order';
  }}
 }}
 async function checkFormStatus() {{
  if (!STATUS_URL) return;
  try {{
    const res = await fetch(STATUS_URL);
    const data = await res.json();
    if (data.status === 'closed') {{
      formClosed = true;
      const banner = document.createElement('div');
      banner.className = 'closed-banner';
      banner.textContent = 'Orders are closed for this week.';
      const deadline = document.querySelector('.deadline');
      if (deadline) deadline.replaceWith(banner);
      document.getElementById('submit-btn').disabled = true;
      document.getElementById('submit-btn').textContent = 'Closed';
      document.querySelectorAll('.qty-control button').forEach(b => b.disabled = true);
    }}
  }} catch (e) {{}}
 }}
 init();
 </script>
 </body>
 </html>"""
 def main():
    parser = argparse.ArgumentParser(description="Generate meal order form HTML")
    parser.add_argument("--api-url", default="", help="API Gateway base URL (cloud mode)")
    parser.add_argument("--api-key", default="", help="API key for order submission (cloud mode)")
    args = parser.parse_args()
    config = load_config()
    menu = latest_menu()
    html = generate_form(menu, config, api_url=args.api_url, api_key=args.api_key)
    week = datetime.now().strftime("%Y-W%U")
    output_file = OUTPUT_DIR / f"order-form-{week}.html"
    with open(output_file, "w") as f:
        f.write(html)
    mode = "cloud" if args.api_url else "local"
    print(f"Generated order form ({mode} mode): {output_file}")
    print(f"  {menu['meal_count']} meals from menu scraped {menu['scraped_at'][:10]}")
    if mode == "local":
        print(f"  Start the server with: python3 src/server/app.py")
    else:
        print(f"  API endpoint: {args.api_url}")
 if __name__ == "__main__":
    main()
--- a/src/shared/python/shared/init.py
+++ b/src/shared/python/shared/init.py
--- a/src/shared/python/shared/db.py
+++ b/src/shared/python/shared/db.py
@ -0,0 +1,112 @@
 import os
 import time
 from datetime import datetime
 from zoneinfo import ZoneInfo
 from boto3.dynamodb.conditions import Key
 import boto3
 EASTERN = ZoneInfo("America/New_York")
 _table = None
 def _get_table():
    global _table
    if _table is None:
        _table = boto3.resource("dynamodb").Table(os.environ["TABLE_NAME"])
    return _table
 def current_week() -> str:
    return datetime.now(EASTERN).strftime("%Y-W%U")
 def previous_week() -> str:
    now = datetime.now(EASTERN)
    prev = now - __import__("datetime").timedelta(weeks=1)
    return prev.strftime("%Y-W%U")
 def ttl_days(days: int) -> int:
    return int(time.time()) + (days * 86400)
 def put_menu(week: str, menu_data: dict):
    _get_table().put_item(Item={
        "PK": f"WEEK#{week}",
        "SK": "MENU",
        "form_status": "open",
        "scraped_at": menu_data.get("scraped_at"),
        "menu_url": menu_data.get("menu_url"),
        "meal_count": menu_data.get("meal_count"),
        "meals": menu_data.get("meals"),
        "ttl": ttl_days(90),
    })
 def get_menu(week: str) -> dict | None:
    resp = _get_table().get_item(Key={"PK": f"WEEK#{week}", "SK": "MENU"})
    return resp.get("Item")
 def set_form_status(week: str, status: str):
    _get_table().update_item(
        Key={"PK": f"WEEK#{week}", "SK": "MENU"},
        UpdateExpression="SET form_status = :s",
        ExpressionAttributeValues={":s": status},
    )
 def get_form_status(week: str) -> str:
    menu = get_menu(week)
    if not menu:
        return "not_found"
    return menu.get("form_status", "closed")
 def put_order(week: str, employee_slug: str, order_data: dict):
    _get_table().put_item(Item={
        "PK": f"WEEK#{week}",
        "SK": f"ORDER#{employee_slug}",
        "employee_name": order_data["employee_name"],
        "employee_email": order_data["employee_email"],
        "submitted_at": order_data["submitted_at"],
        "items": order_data["items"],
        "total": order_data["total"],
        "ttl": ttl_days(90),
    })
 def get_orders(week: str) -> list[dict]:
    resp = _get_table().query(
        KeyConditionExpression=Key("PK").eq(f"WEEK#{week}") & Key("SK").begins_with("ORDER#"),
    )
    return resp.get("Items", [])
 def put_summary(week: str, summary: dict):
    _get_table().put_item(Item={
        "PK": f"WEEK#{week}",
        "SK": "SUMMARY",
        "ttl": ttl_days(90),
        **summary,
    })
 def get_summary(week: str) -> dict | None:
    resp = _get_table().get_item(Key={"PK": f"WEEK#{week}", "SK": "SUMMARY"})
    return resp.get("Item")
 def get_roster() -> list[dict]:
    resp = _get_table().get_item(Key={"PK": "CONFIG", "SK": "ROSTER"})
    item = resp.get("Item")
    return item.get("employees", []) if item else []
 def put_roster(employees: list[dict]):
    _get_table().put_item(Item={
        "PK": "CONFIG",
        "SK": "ROSTER",
        "employees": employees,
        "updated_at": datetime.now(EASTERN).isoformat(),
    })
--- a/src/shared/python/shared/secrets.py
+++ b/src/shared/python/shared/secrets.py
@ -0,0 +1,20 @@
 import os
 import boto3
 _cache = {}
 _sm = boto3.client("secretsmanager")
 _ssm = boto3.client("ssm")
 def get_secret(secret_id: str) -> str:
    if secret_id not in _cache:
        resp = _sm.get_secret_value(SecretId=secret_id)
        _cache[secret_id] = resp["SecretString"]
    return _cache[secret_id]
 def get_parameter(name: str, decrypt: bool = True) -> str:
    if name not in _cache:
        resp = _ssm.get_parameter(Name=name, WithDecryption=decrypt)
        _cache[name] = resp["Parameter"]["Value"]
    return _cache[name]
--- a/src/shared/python/shared/slack.py
+++ b/src/shared/python/shared/slack.py
@ -0,0 +1,62 @@
 import json
 import os
 import urllib.request
 import urllib.error
 from shared.secrets import get_secret, get_parameter
 _token = None
 def _get_token() -> str:
    global _token
    if _token is None:
        _token = get_secret(os.environ["SLACK_BOT_TOKEN_SECRET"])
    return _token
 def _get_channel() -> str:
    return get_parameter(os.environ["SLACK_CHANNEL_PARAM"])
 def _api_call(method: str, payload: dict) -> dict:
    data = json.dumps(payload).encode()
    req = urllib.request.Request(
        f"https://slack.com/api/{method}",
        data=data,
        headers={
            "Authorization": f"Bearer {_get_token()}",
            "Content-Type": "application/json",
        },
    )
    with urllib.request.urlopen(req) as resp:
        return json.loads(resp.read())
 def post_channel_message(text: str, blocks: list[dict] | None = None):
    payload = {"channel": _get_channel(), "text": text}
    if blocks:
        payload["blocks"] = blocks
    return _api_call("chat.postMessage", payload)
 def send_dm(user_id: str, text: str, blocks: list[dict] | None = None):
    open_resp = _api_call("conversations.open", {"users": user_id})
    if not open_resp.get("ok"):
        return open_resp
    channel = open_resp["channel"]["id"]
    payload = {"channel": channel, "text": text}
    if blocks:
        payload["blocks"] = blocks
    return _api_call("chat.postMessage", payload)
 def upload_file(channel: str | None, filename: str, content: str, title: str = ""):
    if channel is None:
        channel = _get_channel()
    payload = {
        "channels": channel,
        "content": content,
        "filename": filename,
        "title": title or filename,
    }
    return _api_call("files.upload", payload)
--- a/src/shared/requirements.txt
+++ b/src/shared/requirements.txt
@ -0,0 +1 @@
 boto3
--- a/template.yaml
+++ b/template.yaml
@ -0,0 +1,441 @@
 AWSTemplateFormatVersion: '2010-09-09'
 Transform: AWS::Serverless-2016-10-31
 Description: >
  meal-order-manager — automated weekly meal ordering from Redefine Meals
  with employee order collection, Slack notifications, and payroll deduction reports.
 Parameters:
  CustomDomain:
    Type: String
    Default: orders.seahavenind.com
    Description: Custom domain for the order form (requires ACM cert)
  CertificateArn:
    Type: String
    Default: ''
    Description: ACM certificate ARN for the custom domain (us-east-1)
  PayrollEmail:
    Type: String
    Default: payroll@seahavenind.com
    Description: Email address for payroll deduction reports
  SenderEmail:
    Type: String
    Default: adam@seahavenind.com
    Description: SES verified sender email for payroll reports
  FormApiKey:
    Type: String
    NoEcho: true
    Description: API key embedded in the order form for submission auth
 Conditions:
  HasCustomDomain: !Not [!Equals [!Ref CertificateArn, '']]
 Globals:
  Function:
    Runtime: python3.12
    Architectures:
      - arm64
    Timeout: 30
    MemorySize: 256
    Environment:
      Variables:
        TABLE_NAME: !Ref OrdersTable
        REPORTS_BUCKET: !Ref ReportsBucket
        SLACK_BOT_TOKEN_SECRET: meal-order-manager/slack-bot-token
        SLACK_CHANNEL_PARAM: /meal-order-manager/slack-channel-id
        FORM_URL: !If
          - HasCustomDomain
          - !Sub 'https://${CustomDomain}'
          - !Sub 'https://${FormDistribution.DomainName}'
    Layers:
      - !Ref SharedLayer
 Resources:
  # ─── Shared Layer ───────────────────────────────────────────────
  SharedLayer:
    Type: AWS::Serverless::LayerVersion
    Properties:
      LayerName: meal-order-manager-shared
      ContentUri: src/shared/
      CompatibleRuntimes:
        - python3.12
      CompatibleArchitectures:
        - arm64
    Metadata:
      BuildMethod: python3.12
      BuildArchitecture: arm64
  # ─── DynamoDB ───────────────────────────────────────────────────
  OrdersTable:
    Type: AWS::DynamoDB::Table
    Properties:
      TableName: meal-order-manager-orders
      BillingMode: PAY_PER_REQUEST
      AttributeDefinitions:
        - AttributeName: PK
          AttributeType: S
        - AttributeName: SK
          AttributeType: S
      KeySchema:
        - AttributeName: PK
          KeyType: HASH
        - AttributeName: SK
          KeyType: RANGE
      TimeToLiveSpecification:
        AttributeName: ttl
        Enabled: true
  # ─── S3 Buckets ────────────────────────────────────────────────
  FormBucket:
    Type: AWS::S3::Bucket
    Properties:
      BucketName: !Sub 'meal-order-manager-form-${AWS::AccountId}'
      PublicAccessBlockConfiguration:
        BlockPublicAcls: true
        BlockPublicPolicy: true
        IgnorePublicAcls: true
        RestrictPublicBuckets: true
      LifecycleConfiguration:
        Rules:
          - Id: delete-old-archives
            Prefix: archive/
            Status: Enabled
            ExpirationInDays: 90
      Tags:
        - Key: Purpose
          Value: meal-order-form-hosting
        - Key: ManagedBy
          Value: meal-order-manager
  FormBucketPolicy:
    Type: AWS::S3::BucketPolicy
    Properties:
      Bucket: !Ref FormBucket
      PolicyDocument:
        Version: '2012-10-17'
        Statement:
          - Sid: AllowCloudFrontOAC
            Effect: Allow
            Principal:
              Service: cloudfront.amazonaws.com
            Action: s3:GetObject
            Resource: !Sub '${FormBucket.Arn}/*'
            Condition:
              StringEquals:
                AWS:SourceArn: !Sub 'arn:aws:cloudfront::${AWS::AccountId}:distribution/${FormDistribution}'
  ReportsBucket:
    Type: AWS::S3::Bucket
    Properties:
      BucketName: !Sub 'meal-order-manager-reports-${AWS::AccountId}'
      PublicAccessBlockConfiguration:
        BlockPublicAcls: true
        BlockPublicPolicy: true
        IgnorePublicAcls: true
        RestrictPublicBuckets: true
      LifecycleConfiguration:
        Rules:
          - Id: archive-old-reports
            Status: Enabled
            Transitions:
              - StorageClass: GLACIER_IR
                TransitionInDays: 90
      Tags:
        - Key: Purpose
          Value: meal-order-reports
        - Key: ManagedBy
          Value: meal-order-manager
  # ─── CloudFront ────────────────────────────────────────────────
  FormOAC:
    Type: AWS::CloudFront::OriginAccessControl
    Properties:
      OriginAccessControlConfig:
        Name: meal-order-manager-oac
        OriginAccessControlOriginType: s3
        SigningBehavior: always
        SigningProtocol: sigv4
  FormDistribution:
    Type: AWS::CloudFront::Distribution
    Properties:
      DistributionConfig:
        Enabled: true
        DefaultRootObject: index.html
        Comment: meal-order-manager form hosting
        PriceClass: PriceClass_100
        HttpVersion: http2and3
        Aliases: !If
          - HasCustomDomain
          - [!Ref CustomDomain]
          - !Ref AWS::NoValue
        ViewerCertificate: !If
          - HasCustomDomain
          - AcmCertificateArn: !Ref CertificateArn
            SslSupportMethod: sni-only
            MinimumProtocolVersion: TLSv1.2_2021
          - CloudFrontDefaultCertificate: true
        Origins:
          - Id: S3FormOrigin
            DomainName: !GetAtt FormBucket.RegionalDomainName
            OriginAccessControlId: !Ref FormOAC
            S3OriginConfig:
              OriginAccessIdentity: ''
        DefaultCacheBehavior:
          TargetOriginId: S3FormOrigin
          ViewerProtocolPolicy: redirect-to-https
          CachePolicyId: 4135ea2d-6df8-44a3-9df3-4b5a84be39ad  # CachingDisabled
          Compress: true
          AllowedMethods:
            - GET
            - HEAD
          CachedMethods:
            - GET
            - HEAD
        CustomErrorResponses:
          - ErrorCode: 403
            ResponseCode: 200
            ResponsePagePath: /index.html
  # ─── API Gateway ───────────────────────────────────────────────
  OrderApi:
    Type: AWS::Serverless::HttpApi
    Properties:
      StageName: $default
      CorsConfiguration:
        AllowOrigins:
          - !If
            - HasCustomDomain
            - !Sub 'https://${CustomDomain}'
            - !Sub 'https://${FormDistribution.DomainName}'
        AllowMethods:
          - GET
          - POST
          - OPTIONS
        AllowHeaders:
          - Content-Type
          - x-api-key
        MaxAge: 3600
  # ─── Lambda Functions ──────────────────────────────────────────
  SubmitOrderFunction:
    Type: AWS::Serverless::Function
    Properties:
      FunctionName: meal-order-manager-submit-order
      Handler: handler.lambda_handler
      CodeUri: functions/submit_order/
      MemorySize: 128
      Timeout: 10
      Environment:
        Variables:
          FORM_API_KEY: !Ref FormApiKey
      Policies:
        - DynamoDBCrudPolicy:
            TableName: !Ref OrdersTable
      Events:
        SubmitOrder:
          Type: HttpApi
          Properties:
            ApiId: !Ref OrderApi
            Path: /api/submit-order
            Method: POST
        FormStatus:
          Type: HttpApi
          Properties:
            ApiId: !Ref OrderApi
            Path: /api/form-status/{week}
            Method: GET
  CloseFormFunction:
    Type: AWS::Serverless::Function
    Properties:
      FunctionName: meal-order-manager-close-form
      Handler: handler.lambda_handler
      CodeUri: functions/close_form/
      MemorySize: 128
      Timeout: 30
      Policies:
        - DynamoDBCrudPolicy:
            TableName: !Ref OrdersTable
        - Statement:
            - Effect: Allow
              Action: lambda:InvokeFunction
              Resource: !GetAtt AggregateOrdersFunction.Arn
      Environment:
        Variables:
          AGGREGATE_FUNCTION_ARN: !GetAtt AggregateOrdersFunction.Arn
      Events:
        CloseEST:
          Type: Schedule
          Properties:
            Schedule: cron(0 23 ? * THU *)
            Description: 'Close form Thursday 6pm EST (23:00 UTC)'
            Enabled: true
        CloseEDT:
          Type: Schedule
          Properties:
            Schedule: cron(0 22 ? * THU *)
            Description: 'Close form Thursday 6pm EDT (22:00 UTC)'
            Enabled: true
  AggregateOrdersFunction:
    Type: AWS::Serverless::Function
    Properties:
      FunctionName: meal-order-manager-aggregate-orders
      Handler: handler.lambda_handler
      CodeUri: functions/aggregate_orders/
      MemorySize: 256
      Timeout: 60
      Policies:
        - DynamoDBCrudPolicy:
            TableName: !Ref OrdersTable
        - S3CrudPolicy:
            BucketName: !Ref ReportsBucket
        - Statement:
            - Effect: Allow
              Action: lambda:InvokeFunction
              Resource: !GetAtt SlackNotifierFunction.Arn
      Environment:
        Variables:
          SLACK_NOTIFIER_ARN: !GetAtt SlackNotifierFunction.Arn
  SlackNotifierFunction:
    Type: AWS::Serverless::Function
    Properties:
      FunctionName: meal-order-manager-slack-notifier
      Handler: handler.lambda_handler
      CodeUri: functions/slack_notifier/
      MemorySize: 128
      Timeout: 30
      Policies:
        - DynamoDBReadPolicy:
            TableName: !Ref OrdersTable
        - Statement:
            - Effect: Allow
              Action: secretsmanager:GetSecretValue
              Resource: !Sub 'arn:aws:secretsmanager:${AWS::Region}:${AWS::AccountId}:secret:meal-order-manager/*'
            - Effect: Allow
              Action: ssm:GetParameter
              Resource: !Sub 'arn:aws:ssm:${AWS::Region}:${AWS::AccountId}:parameter/meal-order-manager/*'
      Events:
        ReminderEST:
          Type: Schedule
          Properties:
            Schedule: cron(0 15 ? * THU *)
            Description: 'DM reminders Thursday 10am EST (15:00 UTC)'
            Enabled: true
            Input: '{"event": "reminder"}'
        ReminderEDT:
          Type: Schedule
          Properties:
            Schedule: cron(0 14 ? * THU *)
            Description: 'DM reminders Thursday 10am EDT (14:00 UTC)'
            Enabled: true
            Input: '{"event": "reminder"}'
  EmailReportFunction:
    Type: AWS::Serverless::Function
    Properties:
      FunctionName: meal-order-manager-email-report
      Handler: handler.lambda_handler
      CodeUri: functions/email_report/
      MemorySize: 128
      Timeout: 30
      Environment:
        Variables:
          PAYROLL_EMAIL: !Ref PayrollEmail
          SENDER_EMAIL: !Ref SenderEmail
      Policies:
        - DynamoDBReadPolicy:
            TableName: !Ref OrdersTable
        - S3ReadPolicy:
            BucketName: !Ref ReportsBucket
        - Statement:
            - Effect: Allow
              Action:
                - ses:SendRawEmail
              Resource: '*'
      Events:
        PayrollEmailEST:
          Type: Schedule
          Properties:
            Schedule: cron(0 12 ? * MON *)
            Description: 'Email payroll deductions Monday 7am EST (12:00 UTC)'
            Enabled: true
        PayrollEmailEDT:
          Type: Schedule
          Properties:
            Schedule: cron(0 11 ? * MON *)
            Description: 'Email payroll deductions Monday 7am EDT (11:00 UTC)'
            Enabled: true
  # ─── CloudWatch Log Groups (60-day retention) ──────────────────
  SubmitOrderLogGroup:
    Type: AWS::Logs::LogGroup
    Properties:
      LogGroupName: !Sub '/aws/lambda/${SubmitOrderFunction}'
      RetentionInDays: 60
  CloseFormLogGroup:
    Type: AWS::Logs::LogGroup
    Properties:
      LogGroupName: !Sub '/aws/lambda/${CloseFormFunction}'
      RetentionInDays: 60
  AggregateOrdersLogGroup:
    Type: AWS::Logs::LogGroup
    Properties:
      LogGroupName: !Sub '/aws/lambda/${AggregateOrdersFunction}'
      RetentionInDays: 60
  SlackNotifierLogGroup:
    Type: AWS::Logs::LogGroup
    Properties:
      LogGroupName: !Sub '/aws/lambda/${SlackNotifierFunction}'
      RetentionInDays: 60
  EmailReportLogGroup:
    Type: AWS::Logs::LogGroup
    Properties:
      LogGroupName: !Sub '/aws/lambda/${EmailReportFunction}'
      RetentionInDays: 60
  # ─── SSM Parameters ────────────────────────────────────────────
  SlackChannelParam:
    Type: AWS::SSM::Parameter
    Properties:
      Name: /meal-order-manager/slack-channel-id
      Type: String
      Value: CHANGE_ME
      Description: Slack channel ID for meal order notifications
 Outputs:
  ApiUrl:
    Description: API Gateway endpoint URL
    Value: !Sub 'https://${OrderApi}.execute-api.${AWS::Region}.amazonaws.com'
  FormUrl:
    Description: Order form URL
    Value: !If
      - HasCustomDomain
      - !Sub 'https://${CustomDomain}'
      - !Sub 'https://${FormDistribution.DomainName}'
  DistributionId:
    Description: CloudFront distribution ID (for cache invalidation)
    Value: !Ref FormDistribution
  FormBucketName:
    Description: S3 bucket for form HTML
    Value: !Ref FormBucket
  ReportsBucketName:
    Description: S3 bucket for CSV reports
    Value: !Ref ReportsBucket
  OrdersTableName:
    Description: DynamoDB table name
    Value: !Ref OrdersTable