adam/seahaven-slack-bot
Archived
1
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions
77 commits 3 branches 0 tags 2.4 MiB
Commit graph

77 commits

This branch
This branch
All branches
Author SHA1 Message Date
amoussa1229
3704fa0292 chore: upgrade Lambda runtime from nodejs22.x to nodejs24.x 
Replace NODEJS_22_X with NODEJS_24_X across all nine Lambda NodejsFunction
definitions in lib/constructs/ (bedrock-agent, slack-handler, notion-sync,
po-sync, workorder-sync). Also add dependabot ignore for @types/node >=26
to prevent premature major bumps while we stay on the nodejs24.x runtime.

Both package.json files already carry @types/node ^24 — no pin change needed.

Refs #72
 2026-07-04 05:26:03 +00:00
Adam Moussa
58be1563e5
Pin @types/node to ^24 in socket-mode to match runtime (#57) 
Dependabot proposed @types/node 22->25 (#55); 25 is odd/non-LTS and not a
Lambda/Node runtime here. Pin to ^24 to track the actual runtime per the
house rule (see dependabot-triage notes).
 2026-06-11 14:38:39 -04:00
dependabot[bot]
0e7943df90
build(deps-dev): bump typescript in /services/socket-mode (#54) 
Bumps [typescript](https://github.com/microsoft/TypeScript) from 5.7.3 to 6.0.3.
- [Release notes](https://github.com/microsoft/TypeScript/releases)
- [Commits](https://github.com/microsoft/TypeScript/compare/v5.7.3...v6.0.3)

---
updated-dependencies:
- dependency-name: typescript
  dependency-version: 6.0.3
  dependency-type: direct:development
  update-type: version-update:semver-major
...

Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
 2026-06-11 14:33:03 -04:00
dependabot[bot]
535e6c1988
build(deps): bump the minor-and-patch group across 1 directory with 5 updates (#56) 
Bumps the minor-and-patch group with 5 updates in the / directory:

| Package | From | To |
| --- | --- | --- |
| [aws-cdk-lib](https://github.com/aws/aws-cdk/tree/HEAD/packages/aws-cdk-lib) | `2.258.0` | `2.258.1` |
| [@aws-sdk/client-dynamodb](https://github.com/aws/aws-sdk-js-v3/tree/HEAD/clients/client-dynamodb) | `3.1062.0` | `3.1066.0` |
| [@aws-sdk/lib-dynamodb](https://github.com/aws/aws-sdk-js-v3/tree/HEAD/lib/lib-dynamodb) | `3.1062.0` | `3.1066.0` |
| [@types/aws-lambda](https://github.com/DefinitelyTyped/DefinitelyTyped/tree/HEAD/types/aws-lambda) | `8.10.161` | `8.10.162` |
| [@types/node](https://github.com/DefinitelyTyped/DefinitelyTyped/tree/HEAD/types/node) | `24.13.0` | `24.13.2` |



Updates `aws-cdk-lib` from 2.258.0 to 2.258.1
- [Release notes](https://github.com/aws/aws-cdk/releases)
- [Changelog](https://github.com/aws/aws-cdk/blob/main/CHANGELOG.v2.alpha.md)
- [Commits](https://github.com/aws/aws-cdk/commits/v2.258.1/packages/aws-cdk-lib)

Updates `@aws-sdk/client-dynamodb` from 3.1062.0 to 3.1066.0
- [Release notes](https://github.com/aws/aws-sdk-js-v3/releases)
- [Changelog](https://github.com/aws/aws-sdk-js-v3/blob/main/clients/client-dynamodb/CHANGELOG.md)
- [Commits](https://github.com/aws/aws-sdk-js-v3/commits/v3.1066.0/clients/client-dynamodb)

Updates `@aws-sdk/lib-dynamodb` from 3.1062.0 to 3.1066.0
- [Release notes](https://github.com/aws/aws-sdk-js-v3/releases)
- [Changelog](https://github.com/aws/aws-sdk-js-v3/blob/main/lib/lib-dynamodb/CHANGELOG.md)
- [Commits](https://github.com/aws/aws-sdk-js-v3/commits/v3.1066.0/lib/lib-dynamodb)

Updates `@types/aws-lambda` from 8.10.161 to 8.10.162
- [Release notes](https://github.com/DefinitelyTyped/DefinitelyTyped/releases)
- [Commits](https://github.com/DefinitelyTyped/DefinitelyTyped/commits/HEAD/types/aws-lambda)

Updates `@types/node` from 24.13.0 to 24.13.2
- [Release notes](https://github.com/DefinitelyTyped/DefinitelyTyped/releases)
- [Commits](https://github.com/DefinitelyTyped/DefinitelyTyped/commits/HEAD/types/node)

---
updated-dependencies:
- dependency-name: aws-cdk-lib
  dependency-version: 2.258.1
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: minor-and-patch
- dependency-name: "@aws-sdk/client-dynamodb"
  dependency-version: 3.1066.0
  dependency-type: direct:development
  update-type: version-update:semver-minor
  dependency-group: minor-and-patch
- dependency-name: "@aws-sdk/lib-dynamodb"
  dependency-version: 3.1066.0
  dependency-type: direct:development
  update-type: version-update:semver-minor
  dependency-group: minor-and-patch
- dependency-name: "@types/aws-lambda"
  dependency-version: 8.10.162
  dependency-type: direct:development
  update-type: version-update:semver-patch
  dependency-group: minor-and-patch
- dependency-name: "@types/node"
  dependency-version: 24.13.2
  dependency-type: direct:development
  update-type: version-update:semver-patch
  dependency-group: minor-and-patch
...

Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
 2026-06-11 14:31:42 -04:00
dependabot[bot]
7ae9c92f1e
build(deps): bump the minor-and-patch group (#53) 
Bumps the minor-and-patch group in /services/socket-mode with 3 updates: [@slack/web-api](https://github.com/slackapi/node-slack-sdk), [@aws-sdk/client-lambda](https://github.com/aws/aws-sdk-js-v3/tree/HEAD/clients/client-lambda) and [@aws-sdk/client-secrets-manager](https://github.com/aws/aws-sdk-js-v3/tree/HEAD/clients/client-secrets-manager).


Updates `@slack/web-api` from 7.15.1 to 7.17.0
- [Release notes](https://github.com/slackapi/node-slack-sdk/releases)
- [Commits](https://github.com/slackapi/node-slack-sdk/compare/@slack/web-api@7.15.1...@slack/web-api@7.17.0)

Updates `@aws-sdk/client-lambda` from 3.1040.0 to 3.1066.0
- [Release notes](https://github.com/aws/aws-sdk-js-v3/releases)
- [Changelog](https://github.com/aws/aws-sdk-js-v3/blob/main/clients/client-lambda/CHANGELOG.md)
- [Commits](https://github.com/aws/aws-sdk-js-v3/commits/v3.1066.0/clients/client-lambda)

Updates `@aws-sdk/client-secrets-manager` from 3.1040.0 to 3.1066.0
- [Release notes](https://github.com/aws/aws-sdk-js-v3/releases)
- [Changelog](https://github.com/aws/aws-sdk-js-v3/blob/main/clients/client-secrets-manager/CHANGELOG.md)
- [Commits](https://github.com/aws/aws-sdk-js-v3/commits/v3.1066.0/clients/client-secrets-manager)

---
updated-dependencies:
- dependency-name: "@slack/web-api"
  dependency-version: 7.17.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: minor-and-patch
- dependency-name: "@aws-sdk/client-lambda"
  dependency-version: 3.1066.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: minor-and-patch
- dependency-name: "@aws-sdk/client-secrets-manager"
  dependency-version: 3.1066.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: minor-and-patch
...

Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
 2026-06-11 14:31:37 -04:00
Adam Moussa
750f0a9061
Repo hygiene: PR labeler + README badges + dependabot (INFRA-56/57/66) (#52) 2026-06-11 14:14:04 -04:00
Adam Moussa
46f568f6ea
feat(slack-bot): codify kms:Decrypt grants for CMK'd DynamoDB readers (INFRA-95 / M-3) (#51) 
wo-po-lookup, po-sync, and workorder-sync read WorkOrders,
WorkOrderComments, purchase-orders and PaymentsDashboard, which are now
SSE-encrypted with alias/seahaven-dynamodb. Tables are imported by name
so grantReadData adds no KMS perms; grant kms:Decrypt explicitly via the
CMK imported from SSM /seahaven/dynamodb/cmk-arn. Replaces the interim
CLI inline policy (Sid Infra95DynamoDbCmkDecrypt) with IaC.

INFRA-95
 2026-06-09 12:33:06 -04:00
dependabot[bot]
9a158dcd52
build(deps-dev): bump @types/node from 22.19.19 to 24.13.0 (#42) 
Bumps [@types/node](https://github.com/DefinitelyTyped/DefinitelyTyped/tree/HEAD/types/node) from 22.19.19 to 24.13.0.
- [Release notes](https://github.com/DefinitelyTyped/DefinitelyTyped/releases)
- [Commits](https://github.com/DefinitelyTyped/DefinitelyTyped/commits/HEAD/types/node)

---
updated-dependencies:
- dependency-name: "@types/node"
  dependency-version: 24.13.0
  dependency-type: direct:development
  update-type: version-update:semver-major
...

Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
Co-authored-by: Adam Moussa <166072409+amoussa1229@users.noreply.github.com>
 2026-06-08 18:34:01 -04:00
Adam Moussa
5175d39eb9
fix(kb): lock AOSS network policy to private with Bedrock source service (#49) 
The @cdklabs/generative-ai-cdk-constructs VectorKnowledgeBase hardcodes
AllowFromPublic: true on the auto-created AOSS network policy and exposes
no prop to change it. Override the underlying CfnSecurityPolicy to set the
collection rule to AllowFromPublic: false with
SourceServices: ['bedrock.amazonaws.com'] — the latter is required to keep
Bedrock-managed retrieval working once public access is removed (a
SourceVPCEs-only policy returns 401 for Bedrock retrieve). Dashboard rule
kept public for console access; AWS services cannot reach Dashboards.

Same end state was applied live via update-security-policy and smoke-tested
(retrieve returns hits, top score ~0.40) so this deploy is a no-op convergence.

INFRA-92
 2026-06-08 18:01:08 -04:00
Adam Moussa
b3c75c88d2
Fix notion-sync header crash on non-ASCII titles (#48) 
S3 user-metadata values are sent as HTTP headers, which must be
US-ASCII. Notion page titles routinely contain em dashes and other
non-ASCII characters, causing ERR_INVALID_CHAR and a daily sync
failure. Sanitize the notion-title metadata to printable ASCII.

Also treat a Bedrock ConflictException from StartIngestionJob as
benign (an ingestion job is already running and will pick up the
freshly uploaded files) instead of failing the whole invocation.
 2026-06-08 15:42:40 -04:00
Adam Moussa
de55c0eeca
feat(api): add access logging and throttling to webhook HTTP API (#46) 
Adds an access log group (/aws/apigateway/seahaven-slack-webhook, 90-day
retention) with JSON access-log format and DefaultRouteSettings throttling
(rate 2 rps, burst 5) on the seahaven-slack-webhook HTTP API default stage,
applied via CfnStage property overrides. Matches the pattern landed on
seahaven-door-unlock-api.

Refs INFRA-29 (AWS audit M-18)
 2026-06-05 17:47:44 -04:00
Adam Moussa
cacda7c57b
Note read-only purchase-orders consumption (INFRA-1) (#45) 
Mark the purchase-orders DynamoDB table as read-only and owned by
procurement-ingest, and add a Shared Resources note recording the
cross-repo schema-coordination rule.
 2026-06-05 17:26:26 -04:00
dependabot[bot]
4bfe02c000
build(deps): bump aws-cdk-lib in the minor-and-patch group (#44) 
Bumps the minor-and-patch group with 1 update: [aws-cdk-lib](https://github.com/aws/aws-cdk/tree/HEAD/packages/aws-cdk-lib).


Updates `aws-cdk-lib` from 2.257.0 to 2.258.0
- [Release notes](https://github.com/aws/aws-cdk/releases)
- [Changelog](https://github.com/aws/aws-cdk/blob/main/CHANGELOG.v2.alpha.md)
- [Commits](https://github.com/aws/aws-cdk/commits/v2.258.0/packages/aws-cdk-lib)

---
updated-dependencies:
- dependency-name: aws-cdk-lib
  dependency-version: 2.258.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: minor-and-patch
...

Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
 2026-06-05 14:41:13 -04:00
Adam Moussa
03b86acfd1
chore(deps): remove blanket aws-cdk-lib dependabot ignore (#43) 
Per handbook Pinning Principle: exact pins are kept current by Dependabot version updates gated by CI + dependency review. Blanket ignores let pins rot (see today's fast-uri incident).
 2026-06-05 13:51:08 -04:00
Adam Moussa
62b450ce6d
fix(deps): pin aws-cdk-lib to ==2.257.0 (#41) 
* fix(deps): re-pin aws-cdk-lib to ==2.253.1

* fix(deps): pin aws-cdk-lib to 2.257.0 (exact)
 2026-06-05 12:55:52 -04:00
Adam Moussa
b4e2db3b99
Add dependency-review caller workflow (#40) 
* Add dependency-review caller workflow

Add a pull_request-triggered caller that invokes the org-level
callable-dependency-review workflow to scan dependency changes and
fail on high-severity advisories.

* chore: retrigger checks

* chore: retrigger dep review

* chore: retrigger dep review (post-fix)
 2026-06-05 12:26:28 -04:00
Adam Moussa
307a5ed661
fix: grant bedrock:GetGuardrail to agent execution role (#39) 
The Bedrock Agents service fetches the guardrail config via GetGuardrail
before applying it. The role only had ApplyGuardrail, so every agent
invocation logged an AccessDenied and tripped the CIS 4.1
UnauthorizedAPICalls alarm.

Scoped to the same guardrail ARNs already granted for ApplyGuardrail.
Cross-reviewed (IAM change): APPROVE, no findings.
 2026-06-04 16:50:19 -04:00
dependabot[bot]
d7b37e7ad0
build(deps): bump the minor-and-patch group across 1 directory with 4 updates (#36) 
Bumps the minor-and-patch group with 4 updates in the / directory: [aws-cdk-lib](https://github.com/aws/aws-cdk/tree/HEAD/packages/aws-cdk-lib), [@aws-sdk/client-dynamodb](https://github.com/aws/aws-sdk-js-v3/tree/HEAD/clients/client-dynamodb), [@aws-sdk/lib-dynamodb](https://github.com/aws/aws-sdk-js-v3/tree/HEAD/lib/lib-dynamodb) and [aws-cdk](https://github.com/aws/aws-cdk-cli/tree/HEAD/packages/aws-cdk).


Updates `aws-cdk-lib` from 2.255.0 to 2.257.0
- [Release notes](https://github.com/aws/aws-cdk/releases)
- [Changelog](https://github.com/aws/aws-cdk/blob/main/CHANGELOG.v2.alpha.md)
- [Commits](https://github.com/aws/aws-cdk/commits/v2.257.0/packages/aws-cdk-lib)

Updates `@aws-sdk/client-dynamodb` from 3.1050.0 to 3.1061.0
- [Release notes](https://github.com/aws/aws-sdk-js-v3/releases)
- [Changelog](https://github.com/aws/aws-sdk-js-v3/blob/main/clients/client-dynamodb/CHANGELOG.md)
- [Commits](https://github.com/aws/aws-sdk-js-v3/commits/v3.1061.0/clients/client-dynamodb)

Updates `@aws-sdk/lib-dynamodb` from 3.1050.0 to 3.1061.0
- [Release notes](https://github.com/aws/aws-sdk-js-v3/releases)
- [Changelog](https://github.com/aws/aws-sdk-js-v3/blob/main/lib/lib-dynamodb/CHANGELOG.md)
- [Commits](https://github.com/aws/aws-sdk-js-v3/commits/v3.1061.0/lib/lib-dynamodb)

Updates `aws-cdk` from 2.1123.0 to 2.1126.0
- [Release notes](https://github.com/aws/aws-cdk-cli/releases)
- [Commits](https://github.com/aws/aws-cdk-cli/commits/aws-cdk@v2.1126.0/packages/aws-cdk)

---
updated-dependencies:
- dependency-name: "@aws-sdk/client-dynamodb"
  dependency-version: 3.1053.0
  dependency-type: direct:development
  update-type: version-update:semver-minor
  dependency-group: minor-and-patch
- dependency-name: "@aws-sdk/lib-dynamodb"
  dependency-version: 3.1053.0
  dependency-type: direct:development
  update-type: version-update:semver-minor
  dependency-group: minor-and-patch
- dependency-name: aws-cdk
  dependency-version: 2.1124.1
  dependency-type: direct:development
  update-type: version-update:semver-minor
  dependency-group: minor-and-patch
- dependency-name: aws-cdk-lib
  dependency-version: 2.257.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: minor-and-patch
...

Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
 2026-06-03 23:02:16 +00:00
Adam Moussa
a3457be911
Add guardrail to seahaven-alex agent (#38) 
Audit finding M-19: the employee-facing assistant had no guardrail
despite access to QBO, payments, WO/PO, and HR/SA8000 data.

Adds prompt-attack (HIGH input), content filters, and masking of
credential/financial identifiers (SSN, cards, bank numbers, keys).
Names/emails/phones deliberately unmasked - vendor contact lookup is
the bot's core function. MISCONDUCT output at MEDIUM so SA8000
misconduct-reporting questions are not suppressed.

Cross-reviewed (1 BLOCK fixed: ApplyGuardrail now covers version-
suffixed ARNs; explicit guardrail->version->agent dependencies added).
Alias description bump forces a new agent version (v10) so the live
alias snapshots the guardrail config.
 2026-06-03 15:16:06 -04:00
dependabot[bot]
2df2362304
build(deps): bump axios from 1.15.2 to 1.16.1 in /services/socket-mode (#37) 
Bumps [axios](https://github.com/axios/axios) from 1.15.2 to 1.16.1.
- [Release notes](https://github.com/axios/axios/releases)
- [Changelog](https://github.com/axios/axios/blob/v1.x/CHANGELOG.md)
- [Commits](https://github.com/axios/axios/compare/v1.15.2...v1.16.1)

---
updated-dependencies:
- dependency-name: axios
  dependency-version: 1.16.1
  dependency-type: indirect
...

Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
 2026-05-29 16:46:57 +00:00
dependabot[bot]
91bafda72e
build(deps): bump ws from 8.20.0 to 8.20.1 in /services/socket-mode (#35) 
Bumps [ws](https://github.com/websockets/ws) from 8.20.0 to 8.20.1.
- [Release notes](https://github.com/websockets/ws/releases)
- [Commits](https://github.com/websockets/ws/compare/8.20.0...8.20.1)

---
updated-dependencies:
- dependency-name: ws
  dependency-version: 8.20.1
  dependency-type: indirect
...

Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
 2026-05-19 20:07:59 +00:00
dependabot[bot]
1877c3c2b2
build(deps): bump the minor-and-patch group with 6 updates (#34) 
Bumps the minor-and-patch group with 6 updates:

| Package | From | To |
| --- | --- | --- |
| [@cdklabs/generative-ai-cdk-constructs](https://github.com/awslabs/generative-ai-cdk-constructs) | `0.1.316` | `0.1.317` |
| [@notionhq/client](https://github.com/makenotion/notion-sdk-js) | `5.21.0` | `5.22.0` |
| [aws-cdk-lib](https://github.com/aws/aws-cdk/tree/HEAD/packages/aws-cdk-lib) | `2.253.1` | `2.255.0` |
| [@aws-sdk/client-dynamodb](https://github.com/aws/aws-sdk-js-v3/tree/HEAD/clients/client-dynamodb) | `3.1045.0` | `3.1050.0` |
| [@aws-sdk/lib-dynamodb](https://github.com/aws/aws-sdk-js-v3/tree/HEAD/lib/lib-dynamodb) | `3.1045.0` | `3.1050.0` |
| [aws-cdk](https://github.com/aws/aws-cdk-cli/tree/HEAD/packages/aws-cdk) | `2.1121.0` | `2.1123.0` |


Updates `@cdklabs/generative-ai-cdk-constructs` from 0.1.316 to 0.1.317
- [Release notes](https://github.com/awslabs/generative-ai-cdk-constructs/releases)
- [Changelog](https://github.com/awslabs/generative-ai-cdk-constructs/blob/main/CHANGELOG.md)
- [Commits](https://github.com/awslabs/generative-ai-cdk-constructs/compare/v0.1.316...v0.1.317)

Updates `@notionhq/client` from 5.21.0 to 5.22.0
- [Release notes](https://github.com/makenotion/notion-sdk-js/releases)
- [Commits](https://github.com/makenotion/notion-sdk-js/compare/v5.21.0...v5.22.0)

Updates `aws-cdk-lib` from 2.253.1 to 2.255.0
- [Release notes](https://github.com/aws/aws-cdk/releases)
- [Changelog](https://github.com/aws/aws-cdk/blob/main/CHANGELOG.v2.alpha.md)
- [Commits](https://github.com/aws/aws-cdk/commits/v2.255.0/packages/aws-cdk-lib)

Updates `@aws-sdk/client-dynamodb` from 3.1045.0 to 3.1050.0
- [Release notes](https://github.com/aws/aws-sdk-js-v3/releases)
- [Changelog](https://github.com/aws/aws-sdk-js-v3/blob/main/clients/client-dynamodb/CHANGELOG.md)
- [Commits](https://github.com/aws/aws-sdk-js-v3/commits/v3.1050.0/clients/client-dynamodb)

Updates `@aws-sdk/lib-dynamodb` from 3.1045.0 to 3.1050.0
- [Release notes](https://github.com/aws/aws-sdk-js-v3/releases)
- [Changelog](https://github.com/aws/aws-sdk-js-v3/blob/main/lib/lib-dynamodb/CHANGELOG.md)
- [Commits](https://github.com/aws/aws-sdk-js-v3/commits/v3.1050.0/lib/lib-dynamodb)

Updates `aws-cdk` from 2.1121.0 to 2.1123.0
- [Release notes](https://github.com/aws/aws-cdk-cli/releases)
- [Commits](https://github.com/aws/aws-cdk-cli/commits/aws-cdk@v2.1123.0/packages/aws-cdk)

---
updated-dependencies:
- dependency-name: "@cdklabs/generative-ai-cdk-constructs"
  dependency-version: 0.1.317
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: minor-and-patch
- dependency-name: "@notionhq/client"
  dependency-version: 5.22.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: minor-and-patch
- dependency-name: aws-cdk-lib
  dependency-version: 2.255.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: minor-and-patch
- dependency-name: "@aws-sdk/client-dynamodb"
  dependency-version: 3.1050.0
  dependency-type: direct:development
  update-type: version-update:semver-minor
  dependency-group: minor-and-patch
- dependency-name: "@aws-sdk/lib-dynamodb"
  dependency-version: 3.1050.0
  dependency-type: direct:development
  update-type: version-update:semver-minor
  dependency-group: minor-and-patch
- dependency-name: aws-cdk
  dependency-version: 2.1123.0
  dependency-type: direct:development
  update-type: version-update:semver-minor
  dependency-group: minor-and-patch
...

Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
 2026-05-19 20:03:28 +00:00
dependabot[bot]
96b9587fe1
build(deps): bump @notionhq/client in the minor-and-patch group (#32) 
Bumps the minor-and-patch group with 1 update: [@notionhq/client](https://github.com/makenotion/notion-sdk-js).


Updates `@notionhq/client` from 5.20.0 to 5.21.0
- [Release notes](https://github.com/makenotion/notion-sdk-js/releases)
- [Commits](https://github.com/makenotion/notion-sdk-js/compare/v5.20.0...v5.21.0)

---
updated-dependencies:
- dependency-name: "@notionhq/client"
  dependency-version: 5.21.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: minor-and-patch
...

Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
 2026-05-12 12:32:30 +00:00
dependabot[bot]
ae899b9d6f
build(deps): bump fast-xml-builder from 1.1.5 to 1.2.0 (#26) 
Bumps [fast-xml-builder](https://github.com/NaturalIntelligence/fast-xml-builder) from 1.1.5 to 1.2.0.
- [Changelog](https://github.com/NaturalIntelligence/fast-xml-builder/blob/main/CHANGELOG.md)
- [Commits](https://github.com/NaturalIntelligence/fast-xml-builder/compare/v1.1.5...v1.2.0)

---
updated-dependencies:
- dependency-name: fast-xml-builder
  dependency-version: 1.2.0
  dependency-type: indirect
...

Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
 2026-05-08 22:27:58 +00:00
dependabot[bot]
8394d6c21c
build(deps): bump the minor-and-patch group with 5 updates (#24) 
Bumps the minor-and-patch group with 5 updates:

| Package | From | To |
| --- | --- | --- |
| [aws-cdk-lib](https://github.com/aws/aws-cdk/tree/HEAD/packages/aws-cdk-lib) | `2.252.0` | `2.253.1` |
| [@aws-sdk/client-dynamodb](https://github.com/aws/aws-sdk-js-v3/tree/HEAD/clients/client-dynamodb) | `3.1041.0` | `3.1045.0` |
| [@aws-sdk/lib-dynamodb](https://github.com/aws/aws-sdk-js-v3/tree/HEAD/lib/lib-dynamodb) | `3.1041.0` | `3.1045.0` |
| [aws-cdk](https://github.com/aws/aws-cdk-cli/tree/HEAD/packages/aws-cdk) | `2.1120.0` | `2.1121.0` |
| [esbuild](https://github.com/evanw/esbuild) | `0.25.12` | `0.28.0` |


Updates `aws-cdk-lib` from 2.252.0 to 2.253.1
- [Release notes](https://github.com/aws/aws-cdk/releases)
- [Changelog](https://github.com/aws/aws-cdk/blob/v2.253.1/CHANGELOG.v2.alpha.md)
- [Commits](https://github.com/aws/aws-cdk/commits/v2.253.1/packages/aws-cdk-lib)

Updates `@aws-sdk/client-dynamodb` from 3.1041.0 to 3.1045.0
- [Release notes](https://github.com/aws/aws-sdk-js-v3/releases)
- [Changelog](https://github.com/aws/aws-sdk-js-v3/blob/main/clients/client-dynamodb/CHANGELOG.md)
- [Commits](https://github.com/aws/aws-sdk-js-v3/commits/v3.1045.0/clients/client-dynamodb)

Updates `@aws-sdk/lib-dynamodb` from 3.1041.0 to 3.1045.0
- [Release notes](https://github.com/aws/aws-sdk-js-v3/releases)
- [Changelog](https://github.com/aws/aws-sdk-js-v3/blob/main/lib/lib-dynamodb/CHANGELOG.md)
- [Commits](https://github.com/aws/aws-sdk-js-v3/commits/v3.1045.0/lib/lib-dynamodb)

Updates `aws-cdk` from 2.1120.0 to 2.1121.0
- [Release notes](https://github.com/aws/aws-cdk-cli/releases)
- [Commits](https://github.com/aws/aws-cdk-cli/commits/aws-cdk@v2.1121.0/packages/aws-cdk)

Updates `esbuild` from 0.25.12 to 0.28.0
- [Release notes](https://github.com/evanw/esbuild/releases)
- [Changelog](https://github.com/evanw/esbuild/blob/main/CHANGELOG-2025.md)
- [Commits](https://github.com/evanw/esbuild/compare/v0.25.12...v0.28.0)

---
updated-dependencies:
- dependency-name: aws-cdk-lib
  dependency-version: 2.253.1
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: minor-and-patch
- dependency-name: "@aws-sdk/client-dynamodb"
  dependency-version: 3.1045.0
  dependency-type: direct:development
  update-type: version-update:semver-minor
  dependency-group: minor-and-patch
- dependency-name: "@aws-sdk/lib-dynamodb"
  dependency-version: 3.1045.0
  dependency-type: direct:development
  update-type: version-update:semver-minor
  dependency-group: minor-and-patch
- dependency-name: aws-cdk
  dependency-version: 2.1121.0
  dependency-type: direct:development
  update-type: version-update:semver-minor
  dependency-group: minor-and-patch
- dependency-name: esbuild
  dependency-version: 0.28.0
  dependency-type: direct:development
  update-type: version-update:semver-minor
  dependency-group: minor-and-patch
...

Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
 2026-05-08 22:27:48 +00:00
dependabot[bot]
54d5aa8a20
build(deps): bump fast-xml-builder in /services/socket-mode (#23) 
Bumps [fast-xml-builder](https://github.com/NaturalIntelligence/fast-xml-builder) from 1.1.5 to 1.2.0.
- [Changelog](https://github.com/NaturalIntelligence/fast-xml-builder/blob/main/CHANGELOG.md)
- [Commits](https://github.com/NaturalIntelligence/fast-xml-builder/compare/v1.1.5...v1.2.0)

---
updated-dependencies:
- dependency-name: fast-xml-builder
  dependency-version: 1.2.0
  dependency-type: indirect
...

Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
 2026-05-08 22:27:09 +00:00
Adam Moussa
50da33712b
Set explicit arm64 platform on Docker image build (#30) 
fromAsset() builds for the host architecture by default. On x86_64
GitHub Actions runners, this produces an x86 image even with QEMU
installed — the Fargate ARM64 task then fails with exec format error.
 2026-05-08 17:58:28 -04:00
Adam Moussa
94a837c08c
Enable QEMU for arm64 Docker builds (#29) 
Fargate task runs ARM64 but GHA runner is x86_64 — without QEMU
the Docker image gets built for the wrong architecture, causing
exec format error at container startup.
 2026-05-08 17:48:19 -04:00
Adam Moussa
78ecba68ae
Add GitHub Actions deploy workflow (#28) 
* Add GitHub Actions deploy workflow (OIDC)

* Add permissions block for OIDC token exchange

* Add concurrency control to prevent parallel deploys
 2026-05-08 17:08:12 -04:00
Adam Moussa
bcd01d9918
Add CI workflow (#27) 2026-05-08 15:52:56 -04:00
Adam Moussa
a75dbfd359
Update Dependabot: remove assignees, group minor/patch updates (#22) 2026-05-08 14:22:03 -04:00
Adam Moussa
11b5ccbf7f
Remove wrapper workflow — using required workflow via org ruleset (#21) 2026-05-06 19:58:56 -04:00
Adam Moussa
77e7dcfe46
Upgrade to TypeScript ~6.0.3 (#19) 
* Upgrade to TypeScript 6.0.3 and @types/node 25.6.0

TS 6 requires explicit node type resolution — added "types": ["node"]
to tsconfig.json to resolve path and __dirname globals.

* Pin typescript to ~6.0.3 and @types/node to ^22

TS doesn't follow semver — use tilde to avoid surprise minor-release
breakage. Keep @types/node on v22 to match Lambda NODEJS_22_X runtime.

* Regenerate lockfile with npm 11.14.0

Fixes corrupted peer:true flags on direct dependencies caused by
npm <11.6.3 bug (npm/cli#8690).

* Trigger CI

* Trigger CI

* Trigger CI

* Add id-token: write permission for claude-code-action

* Trigger CI
 2026-05-06 19:56:57 -04:00
Adam Moussa
a2477f4c57
Add id-token: write permission for claude-code-action (#20) 2026-05-06 19:47:30 -04:00
dependabot[bot]
95115dcf38
build(deps): bump @notionhq/client from 2.3.0 to 5.20.0 (#15) 
Bumps [@notionhq/client](https://github.com/makenotion/notion-sdk-js) from 2.3.0 to 5.20.0.
- [Release notes](https://github.com/makenotion/notion-sdk-js/releases)
- [Commits](https://github.com/makenotion/notion-sdk-js/compare/v2.3.0...v5.20.0)

---
updated-dependencies:
- dependency-name: "@notionhq/client"
  dependency-version: 5.20.0
  dependency-type: direct:production
  update-type: version-update:semver-major
...

Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
 2026-05-06 18:37:05 -04:00
dependabot[bot]
1fd51c9f18
build(deps): bump aws-cdk-lib from 2.248.0 to 2.252.0 (#11) 
Bumps [aws-cdk-lib](https://github.com/aws/aws-cdk/tree/HEAD/packages/aws-cdk-lib) from 2.248.0 to 2.252.0.
- [Release notes](https://github.com/aws/aws-cdk/releases)
- [Changelog](https://github.com/aws/aws-cdk/blob/main/CHANGELOG.v2.alpha.md)
- [Commits](https://github.com/aws/aws-cdk/commits/v2.252.0/packages/aws-cdk-lib)

---
updated-dependencies:
- dependency-name: aws-cdk-lib
  dependency-version: 2.252.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
...

Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
Co-authored-by: Adam Moussa <166072409+amoussa1229@users.noreply.github.com>
 2026-05-06 18:22:53 -04:00
dependabot[bot]
ab80e6c251
build(deps-dev): bump aws-cdk from 2.1118.0 to 2.1120.0 (#12) 
Bumps [aws-cdk](https://github.com/aws/aws-cdk-cli/tree/HEAD/packages/aws-cdk) from 2.1118.0 to 2.1120.0.
- [Release notes](https://github.com/aws/aws-cdk-cli/releases)
- [Commits](https://github.com/aws/aws-cdk-cli/commits/aws-cdk@v2.1120.0/packages/aws-cdk)

---
updated-dependencies:
- dependency-name: aws-cdk
  dependency-version: 2.1120.0
  dependency-type: direct:development
  update-type: version-update:semver-minor
...

Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
Co-authored-by: Adam Moussa <166072409+amoussa1229@users.noreply.github.com>
 2026-05-06 18:22:49 -04:00
Adam Moussa
f011108971
Add Claude Code review workflow (#18) 2026-05-06 18:12:07 -04:00
Adam Moussa
52d26e89c0
Merge pull request #16 from Sea-Haven-Industries/feature/dependabot-auto-assign 
Auto-assign Dependabot PRs
 2026-05-02 17:28:09 -04:00
Adam Moussa
9bdfceca28 Auto-assign Dependabot PRs to amoussa1229 2026-05-02 17:26:17 -04:00
Adam Moussa
1f243e2ab1
Merge pull request #14 from Sea-Haven-Industries/dependabot/npm_and_yarn/aws-sdk/lib-dynamodb-3.1041.0 
build(deps-dev): bump @aws-sdk/lib-dynamodb from 3.1030.0 to 3.1041.0
 2026-05-02 17:23:36 -04:00
dependabot[bot]
9115495f3a
build(deps-dev): bump @aws-sdk/lib-dynamodb from 3.1030.0 to 3.1041.0 
Bumps [@aws-sdk/lib-dynamodb](https://github.com/aws/aws-sdk-js-v3/tree/HEAD/lib/lib-dynamodb) from 3.1030.0 to 3.1041.0.
- [Release notes](https://github.com/aws/aws-sdk-js-v3/releases)
- [Changelog](https://github.com/aws/aws-sdk-js-v3/blob/main/lib/lib-dynamodb/CHANGELOG.md)
- [Commits](https://github.com/aws/aws-sdk-js-v3/commits/v3.1041.0/lib/lib-dynamodb)

---
updated-dependencies:
- dependency-name: "@aws-sdk/lib-dynamodb"
  dependency-version: 3.1041.0
  dependency-type: direct:development
  update-type: version-update:semver-minor
...

Signed-off-by: dependabot[bot] <support@github.com>
 2026-05-02 21:17:42 +00:00
Adam Moussa
d4c1973004
Merge pull request #10 from Sea-Haven-Industries/feature/add-dependabot-config 
Add Dependabot version update configuration
 2026-05-02 17:15:44 -04:00
Adam Moussa
d43b7974b4 Add Dependabot version update configuration 2026-05-02 17:14:23 -04:00
Adam Moussa
423c68584f
Merge pull request #9 from Sea-Haven-Industries/feature/alex-rollout 
feat: Alex rollout — persona, Socket Mode, payments, channels, App Home, unanswered questions
 2026-04-30 18:57:23 -04:00
Adam Moussa
e7b421e4cf fix: flat DM replies, clean up debug logging 
DMs now reply flat in conversation instead of threading. Channel
@mentions still thread. Removed verbose debug logging from socket-mode
service, kept minimal operational logs. Added .DS_Store to gitignore.
 2026-04-30 18:37:08 -04:00
Adam Moussa
5a9d588ebe fix: add package-lock.json for socket-mode Docker build 2026-04-30 16:44:55 -04:00
Adam Moussa
006dbf7c6b feat: Alex rollout — persona, Socket Mode, payments, channels, App Home, unanswered questions 
- Rename bot to Alex with friendly/professional persona (Bedrock Agent instruction rewrite)
- Replace HTTP webhook Lambda with ECS Fargate Socket Mode service (persistent WebSocket)
- Add payment/invoice lookup via PaymentsDashboard table (vendor, invoice, check search)
- Switch from manual SiteAssignments to auto-populated verified-sites table
- Add channel support via app_mention events (threaded replies)
- Add App Home tab with Block Kit capabilities view
- Add unanswered questions logging to seahaven-unanswered-questions DynamoDB table
- Fix pre-existing compliance: add arm64 + 60-day log retention to all Lambdas
- Remove webhook Lambda and seed-sites script (both obsolete)
 2026-04-30 16:38:54 -04:00
Adam Moussa
3a3e2dc14f
Merge pull request #8 from Sea-Haven-Industries/dependabot/npm_and_yarn/multi-b112b4ff1d 
build(deps): bump fast-xml-parser and @aws-sdk/xml-builder
 2026-04-30 12:55:39 -04:00
dependabot[bot]
36e202d7fe
build(deps): bump fast-xml-parser and @aws-sdk/xml-builder 
Bumps [fast-xml-parser](https://github.com/NaturalIntelligence/fast-xml-parser) and [@aws-sdk/xml-builder](https://github.com/aws/aws-sdk-js-v3/tree/HEAD/packages-internal/xml-builder). These dependencies needed to be updated together.

Updates `fast-xml-parser` from 5.5.8 to 5.7.2
- [Release notes](https://github.com/NaturalIntelligence/fast-xml-parser/releases)
- [Changelog](https://github.com/NaturalIntelligence/fast-xml-parser/blob/master/CHANGELOG.md)
- [Commits](https://github.com/NaturalIntelligence/fast-xml-parser/compare/v5.5.8...v5.7.2)

Updates `@aws-sdk/xml-builder` from 3.972.17 to 3.972.21
- [Release notes](https://github.com/aws/aws-sdk-js-v3/releases)
- [Changelog](https://github.com/aws/aws-sdk-js-v3/blob/main/packages-internal/xml-builder/CHANGELOG.md)
- [Commits](https://github.com/aws/aws-sdk-js-v3/commits/HEAD/packages-internal/xml-builder)

---
updated-dependencies:
- dependency-name: fast-xml-parser
  dependency-version: 5.7.2
  dependency-type: indirect
- dependency-name: "@aws-sdk/xml-builder"
  dependency-version: 3.972.21
  dependency-type: indirect
...

Signed-off-by: dependabot[bot] <support@github.com>
 2026-04-28 18:26:26 +00:00