npm - @deployfoundation/foundation-deploy - Versions diffs - 0.1.0 → 0.1.2 - Mend

@deployfoundation/foundation-deploy 0.1.0 → 0.1.2

This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.

Files changed (12) hide show

package/dist/bin/app.js +2 -2
package/dist/bin/foundation-deploy.js +76 -57
package/dist/bin/release-account.js +2 -2
package/dist/{chunk-4aye5cee.js → chunk-m4pn6wc2.js} +1 -1
package/dist/{chunk-v7tz8g50.js → chunk-qc5d46ky.js} +34 -23
package/dist/src/index.js +2 -2
package/package.json +1 -1
package/src/deploy/config-sync.ts +24 -3
package/src/deploy/github-app-create.ts +70 -61
package/src/deploy/setup.ts +18 -5
package/src/deploy/sh.ts +41 -19
/package/dist/{chunk-9ddxyvq2.js → chunk-t86rw0f2.js} +0 -0

package/dist/bin/app.js CHANGED Viewed

@@ -7,12 +7,12 @@ import {
   FoundationNetwork,
   FoundationPipeline,
   NewsletterStack
-} from "../chunk-4aye5cee.js";
+} from "../chunk-m4pn6wc2.js";
 import {
   adminsFor,
   instanceNames,
   loadInstanceFile
-} from "../chunk-9ddxyvq2.js";
+} from "../chunk-t86rw0f2.js";
 // bin/app.ts
 import { execFileSync } from "node:child_process";

package/dist/bin/foundation-deploy.js CHANGED Viewed

@@ -12,6 +12,7 @@ import {
   callerAccountId,
   cdkEnv,
   createSecretString,
+  hasFoundationWorkspace,
   instanceBanner,
   loadInstanceContext,
   putSecretJson,
@@ -28,7 +29,7 @@ import {
   stackExists,
   stackOutput,
   toolVersion
-} from "../chunk-v7tz8g50.js";
+} from "../chunk-qc5d46ky.js";
 import {
   BASE_SLACK_EVENTS,
   CAPABILITY_IDS,
@@ -41,7 +42,7 @@ import {
   requiredSlackScopes,
   skillsKey,
   slackCommandPrefix
-} from "../chunk-9ddxyvq2.js";
+} from "../chunk-t86rw0f2.js";
 // src/deploy/config-sync.ts
 import { existsSync, mkdirSync, mkdtempSync, readdirSync } from "node:fs";
@@ -69,10 +70,16 @@ async function unpackReleaseSkills(ctx, release) {
   const key = release.manifest?.skills.key ?? skillsKey(release.version);
   const dir = mkdtempSync(join(tmpdir(), "foundation-skills-"));
   const tarball = join(dir, "skills.tar.gz");
-  const contents = join(dir, "skills");
-  mkdirSync(contents, { recursive: true });
   await awsMutate(ctx, ["s3", "cp", `s3://${release.bucket}/${key}`, tarball]);
-  await run(["tar", "-xzf", tarball, "-C", contents], { dryRun: ctx.dryRun });
+  return await extractSkillsTarball(tarball, dir, { dryRun: ctx.dryRun });
+}
+async function extractSkillsTarball(tarball, dir, opts = {}) {
+  const contents = join(dir, "skills");
+  await run(["tar", "-xzf", tarball, "-C", dir], { dryRun: opts.dryRun });
+  if (opts.dryRun !== true && !existsSync(contents))
+    throw new Error(`${tarball} has no top-level skills/ directory`);
+  if (opts.dryRun === true)
+    mkdirSync(contents, { recursive: true });
   return contents;
 }
@@ -1142,6 +1149,9 @@ async function deploy(ctx, opts) {
   }
 }
+// src/deploy/github-app-create.ts
+import { createServer } from "node:http";
 // src/deploy/github-app-manifest.ts
 import { readFileSync as readFileSync3 } from "node:fs";
 import { join as join4 } from "node:path";
@@ -1193,15 +1203,14 @@ async function githubAppCreate(options) {
   const body = JSON.stringify({ ...manifest, redirect_url: redirectUrl });
   async function writeSecret(value) {
     const run2 = async (cmd) => {
-      const p = Bun.spawn(["aws", ...cmd, "--profile", profile, "--region", region], {
-        stdin: "pipe",
-        stdout: "pipe",
-        stderr: "pipe"
-      });
-      p.stdin.write(value);
-      p.stdin.end();
-      const code = await p.exited;
-      return { code, err: await new Response(p.stderr).text() };
+      try {
+        await runCapture(["aws", ...cmd, "--profile", profile, "--region", region], {
+          stdin: value
+        });
+        return { code: 0, err: "" };
+      } catch (error) {
+        return { code: 1, err: error instanceof Error ? error.message : String(error) };
+      }
     };
     let r = await run2([
       "secretsmanager",
@@ -1225,50 +1234,56 @@ async function githubAppCreate(options) {
     if (r.code !== 0)
       throw new Error(`aws secretsmanager failed: ${r.err.trim()}`);
   }
-  const server = Bun.serve({
-    port,
-    async fetch(req) {
-      const url = new URL(req.url);
-      if (url.pathname === "/") {
-        const html = `<!doctype html><title>Create ${instance.displayName} GitHub App</title><body style="font-family:system-ui;padding:2rem">
+  const handler = async (req) => {
+    const url = new URL(req.url);
+    if (url.pathname === "/") {
+      const html = `<!doctype html><title>Create ${instance.displayName} GitHub App</title><body style="font-family:system-ui;padding:2rem">
 <h2>Creating the <b>${instance.displayName}</b> GitHub App on <b>${org}</b>…</h2><p>If nothing happens, click the button.</p>
 <form id="f" method="post" action="https://github.com/organizations/${org}/settings/apps/new?state=${state}">
 <input type="hidden" name="manifest" id="m"><button>Create GitHub App</button></form>
 <script>document.getElementById('m').value=${JSON.stringify(body)};document.getElementById('f').submit();</script></body>`;
-        return new Response(html, { headers: { "content-type": "text/html" } });
-      }
-      if (url.pathname === "/callback") {
-        const code = url.searchParams.get("code");
-        if (url.searchParams.get("state") !== state || code === null)
-          return new Response("bad state/code", { status: 400 });
-        const res = await fetch(`https://api.github.com/app-manifests/${encodeURIComponent(code)}/conversions`, {
-          method: "POST",
-          headers: {
-            Accept: "application/vnd.github+json",
-            "X-GitHub-Api-Version": "2022-11-28"
-          }
-        });
-        if (!res.ok)
-          return new Response(`conversion failed: HTTP ${res.status}`, { status: 502 });
-        const app = await res.json();
-        await writeSecret(JSON.stringify({ app_id: String(app.id), installation_id: "", private_key: app.pem }));
-        const installUrl = `https://github.com/apps/${app.slug}/installations/new`;
-        console.log(JSON.stringify({
-          app_id: app.id,
-          slug: app.slug,
-          html_url: app.html_url,
-          install_url: installUrl,
-          secret: secretName
-        }));
-        setTimeout(() => {
-          server.stop(true);
-          process.exit(0);
-        }, 500);
-        return new Response(`<!doctype html><body style="font-family:system-ui;padding:2rem"><h2>✅ App "${app.slug}" created (id ${app.id}); private key stored in Secrets Manager ${secretName}.</h2><p>Next: <a href="${installUrl}">install it on your repos</a>.</p></body>`, { headers: { "content-type": "text/html" } });
-      }
-      return new Response("not found", { status: 404 });
+      return new Response(html, { headers: { "content-type": "text/html" } });
+    }
+    if (url.pathname === "/callback") {
+      const code = url.searchParams.get("code");
+      if (url.searchParams.get("state") !== state || code === null)
+        return new Response("bad state/code", { status: 400 });
+      const res = await fetch(`https://api.github.com/app-manifests/${encodeURIComponent(code)}/conversions`, {
+        method: "POST",
+        headers: {
+          Accept: "application/vnd.github+json",
+          "X-GitHub-Api-Version": "2022-11-28"
+        }
+      });
+      if (!res.ok)
+        return new Response(`conversion failed: HTTP ${res.status}`, { status: 502 });
+      const app = await res.json();
+      await writeSecret(JSON.stringify({ app_id: String(app.id), installation_id: "", private_key: app.pem }));
+      const installUrl = `https://github.com/apps/${app.slug}/installations/new`;
+      console.log(JSON.stringify({
+        app_id: app.id,
+        slug: app.slug,
+        html_url: app.html_url,
+        install_url: installUrl,
+        secret: secretName
+      }));
+      setTimeout(() => {
+        server.close();
+        process.exit(0);
+      }, 500);
+      return new Response(`<!doctype html><body style="font-family:system-ui;padding:2rem"><h2>✅ App "${app.slug}" created (id ${app.id}); private key stored in Secrets Manager ${secretName}.</h2><p>Next: <a href="${installUrl}">install it on your repos</a>.</p></body>`, { headers: { "content-type": "text/html" } });
     }
+    return new Response("not found", { status: 404 });
+  };
+  const server = createServer(async (req, res) => {
+    const request = new Request(`http://localhost:${port}${req.url ?? "/"}`, {
+      method: req.method ?? "GET"
+    });
+    const response = await handler(request);
+    res.writeHead(response.status, Object.fromEntries(response.headers));
+    res.end(await response.text());
   });
+  server.listen(port);
   console.log(`Open http://localhost:${port}/ to create the app (waiting up to 10 minutes)…`);
   setTimeout(() => {
     console.error("timed out");
@@ -1320,7 +1335,7 @@ async function postDeploy(ctx, opts = {}) {
 }
 // src/deploy/setup.ts
-import { existsSync as existsSync3 } from "node:fs";
+import { existsSync as existsSync3, readFileSync as readFileSync5 } from "node:fs";
 import { resolve as resolve3 } from "node:path";
 // src/deploy/slack-manifest.ts
@@ -1524,6 +1539,8 @@ async function output(ctx, stack, key) {
   }
 }
 async function installDependencies(ctx) {
+  if (!hasFoundationWorkspace())
+    return;
   await run(["bun", "install", "--frozen-lockfile"], {
     cwd: FOUNDATION_ROOT,
     dryRun: ctx.dryRun
@@ -1536,12 +1553,14 @@ async function preflight(ctx) {
   if (account !== expected)
     throw new Error(`profile ${ctx.profile} is account ${account}, expected ${expected} for instance ${ctx.instance.name}`);
   console.log(`  account ${account} via profile ${ctx.profile} (${ctx.region})`);
-  if (ctx.dryRun === true) {
+  if (!hasFoundationWorkspace()) {} else if (ctx.dryRun === true) {
     await run(["docker", "info"], { dryRun: true });
   } else {
-    const docker = Bun.spawn(["docker", "info"], { stdout: "ignore", stderr: "ignore" });
-    if (await docker.exited !== 0)
+    try {
+      await runCapture(["docker", "info"]);
+    } catch {
       throw new Error("docker is not running");
+    }
     console.log("  docker ✓");
   }
   for (const id of [
@@ -1571,7 +1590,7 @@ async function writeRuntimeSecret(ctx) {
 async function seedCodex(ctx, codexFile) {
   if (!existsSync3(codexFile))
     throw new Error(`${codexFile} not found — sign in locally first, or pass --codex-file`);
-  const document = await Bun.file(codexFile).text();
+  const document = readFileSync5(codexFile, "utf8");
   JSON.parse(document);
   await putSecretString(ctx, ctx.names.secretCodex, document);
   console.log(`  ${ctx.names.secretCodex} seeded from ${codexFile}`);

package/dist/bin/release-account.js CHANGED Viewed

@@ -1,8 +1,8 @@
 #!/usr/bin/env bun
 import {
   DEFAULT_RELEASE_BUCKET
-} from "../chunk-v7tz8g50.js";
-import"../chunk-9ddxyvq2.js";
+} from "../chunk-qc5d46ky.js";
+import"../chunk-t86rw0f2.js";
 // bin/release-account.ts
 import * as cdk2 from "aws-cdk-lib";

package/dist/{chunk-4aye5cee.js → chunk-m4pn6wc2.js} RENAMED Viewed

@@ -14,7 +14,7 @@ import {
   releaseImageRepositoryArn,
   requiresAuthenticatedQueue,
   slackCommandPrefixes
-} from "./chunk-9ddxyvq2.js";
+} from "./chunk-t86rw0f2.js";
 // src/stacks/agent-stack.ts
 import * as cdk from "aws-cdk-lib";

package/dist/{chunk-v7tz8g50.js → chunk-qc5d46ky.js} RENAMED Viewed

@@ -6,7 +6,7 @@ import {
   manifestKey,
   releaseCacheDir,
   verifyManifest
-} from "./chunk-9ddxyvq2.js";
+} from "./chunk-t86rw0f2.js";
 // src/deploy/release.ts
 import { existsSync as existsSync2, mkdirSync, readFileSync as readFileSync2 } from "node:fs";
@@ -83,6 +83,7 @@ function instanceBanner(context) {
 }
 // src/deploy/sh.ts
+import { spawn as nodeSpawn } from "node:child_process";
 function formatCommand(cmd, env) {
   const prefix = Object.entries(env ?? {}).map(([k, v]) => `${k}=${quote(v)}`).join(" ");
   const body = cmd.map(quote).join(" ");
@@ -91,45 +92,55 @@ function formatCommand(cmd, env) {
 function quote(value) {
   return /^[A-Za-z0-9_@%+=:,./-]+$/.test(value) ? value : `'${value.replaceAll("'", `'\\''`)}'`;
 }
-function spawn(cmd, opts, stdout) {
+function start(cmd, opts, stdout) {
   const [bin, ...rest] = cmd;
   if (bin === undefined)
     throw new Error("run: empty command");
-  return Bun.spawn([bin, ...rest], {
+  const child = nodeSpawn(bin, rest, {
     cwd: opts.cwd,
     env: { ...process.env, ...opts.env },
-    stdin: opts.stdin === undefined ? "ignore" : "pipe",
-    stdout,
-    stderr: stdout === "inherit" ? "inherit" : "pipe"
+    stdio: [
+      opts.stdin === undefined ? "ignore" : "pipe",
+      stdout,
+      stdout === "inherit" ? "inherit" : "pipe"
+    ]
   });
+  if (opts.stdin !== undefined && child.stdin !== null) {
+    child.stdin.end(opts.stdin);
+  }
+  return child;
 }
-async function feed(proc, stdin) {
-  if (stdin === undefined)
-    return;
-  const sink = proc.stdin;
-  if (sink === null)
-    return;
-  sink.write(stdin);
-  sink.end();
+function exited(child) {
+  return new Promise((resolve, reject) => {
+    child.once("error", reject);
+    child.once("close", (code, signal) => resolve(code ?? (signal === null ? 1 : 128)));
+  });
+}
+function collect(stream) {
+  if (stream === null)
+    return Promise.resolve("");
+  return new Promise((resolve, reject) => {
+    const chunks = [];
+    stream.on("data", (c) => chunks.push(c));
+    stream.once("error", reject);
+    stream.once("end", () => resolve(Buffer.concat(chunks).toString("utf8")));
+  });
 }
 async function run(cmd, opts = {}) {
   if (opts.dryRun === true) {
     console.log(`  $ ${formatCommand(cmd, opts.env)}`);
     return;
   }
-  const proc = spawn(cmd, opts, "inherit");
-  await feed(proc, opts.stdin);
-  const code = await proc.exited;
+  const code = await exited(start(cmd, opts, "inherit"));
   if (code !== 0)
     throw new Error(`${formatCommand(cmd)} exited ${code}`);
 }
 async function runCapture(cmd, opts = {}) {
-  const proc = spawn(cmd, opts, "pipe");
-  await feed(proc, opts.stdin);
+  const child = start(cmd, opts, "pipe");
   const [out, err, code] = await Promise.all([
-    new Response(proc.stdout).text(),
-    new Response(proc.stderr).text(),
-    proc.exited
+    collect(child.stdout),
+    collect(child.stderr),
+    exited(child)
   ]);
   if (code !== 0)
     throw new Error(`${formatCommand(cmd)} exited ${code}: ${err.trim()}`);
@@ -425,4 +436,4 @@ function releaseContext(release) {
   ];
 }
-export { resolveInstanceFilePath, loadInstanceContext, instanceBanner, run, runCapture, awsContext, argv, cdkEnv, aws, awsMutate, stackOutput, stackExists, secretExists, readSecretString, readSecretJson, putSecretString, createSecretString, putSecretJson, callerAccountId, INFRA_ROOT, FOUNDATION_ROOT, AGENT_DOCKERFILE, PACKAGE_ASSETS, DEFAULT_RELEASE_BUCKET, toolVersion, releaseRequest, resolveRelease, releaseContext };
+export { resolveInstanceFilePath, loadInstanceContext, instanceBanner, run, runCapture, awsContext, argv, cdkEnv, aws, awsMutate, stackOutput, stackExists, secretExists, readSecretString, readSecretJson, putSecretString, createSecretString, putSecretJson, callerAccountId, INFRA_ROOT, FOUNDATION_ROOT, AGENT_DOCKERFILE, PACKAGE_ASSETS, DEFAULT_RELEASE_BUCKET, toolVersion, hasFoundationWorkspace, releaseRequest, resolveRelease, releaseContext };

package/dist/src/index.js CHANGED Viewed

@@ -9,7 +9,7 @@ import {
   FoundationPipeline,
   NewsletterStack,
   deployStatements
-} from "../chunk-4aye5cee.js";
+} from "../chunk-m4pn6wc2.js";
 import {
   BUN_VERSION,
   LAMBDA_ENTRY_POINTS,
@@ -42,7 +42,7 @@ import {
   skillsKey,
   skipBundle,
   verifyManifest
-} from "../chunk-9ddxyvq2.js";
+} from "../chunk-t86rw0f2.js";
 export {
   BUILD_TIMEOUT,
   BUN_VERSION,

package/package.json CHANGED Viewed

@@ -1,6 +1,6 @@
 {
   "name": "@deployfoundation/foundation-deploy",
-  "version": "0.1.0",
+  "version": "0.1.2",
   "description": "Deploys one Foundation instance from a published, signed release: the CDK app and the deploy tool.",
   "license": "UNLICENSED",
   "private": false,

package/src/deploy/config-sync.ts CHANGED Viewed

@@ -83,11 +83,32 @@ export async function unpackReleaseSkills(
   const key = release.manifest?.skills.key ?? skillsKey(release.version);
   const dir = mkdtempSync(join(tmpdir(), "foundation-skills-"));
   const tarball = join(dir, "skills.tar.gz");
-  const contents = join(dir, "skills");
-  mkdirSync(contents, { recursive: true });
   // `awsMutate` rather than a plain read, only so a dry run prints the copy
   // instead of performing it.
   await awsMutate(ctx, ["s3", "cp", `s3://${release.bucket}/${key}`, tarball]);
-  await run(["tar", "-xzf", tarball, "-C", contents], { dryRun: ctx.dryRun });
+  return await extractSkillsTarball(tarball, dir, { dryRun: ctx.dryRun });
+}
+/**
+ * Unpack a release's `skills.tar.gz` and return the directory holding the
+ * skills themselves.
+ *
+ * `release-build` runs `tar -czf skills.tar.gz skills`, so the archive's top
+ * level is a `skills/` directory. It is extracted INTO `dir`, landing at
+ * `dir/skills`. v0.1.0 and v0.1.1 extracted into `dir/skills` instead, which
+ * produced `dir/skills/skills/…` and synced every product skill to
+ * `s3://…/skills/skills/`, one level below where the agent looks — so a release
+ * deploy silently shipped no product skills at all.
+ */
+export async function extractSkillsTarball(
+  tarball: string,
+  dir: string,
+  opts: { dryRun?: boolean } = {},
+): Promise<string> {
+  const contents = join(dir, "skills");
+  await run(["tar", "-xzf", tarball, "-C", dir], { dryRun: opts.dryRun });
+  if (opts.dryRun !== true && !existsSync(contents))
+    throw new Error(`${tarball} has no top-level skills/ directory`);
+  if (opts.dryRun === true) mkdirSync(contents, { recursive: true });
   return contents;
 }

package/src/deploy/github-app-create.ts CHANGED Viewed

@@ -20,9 +20,11 @@
  *
  * Record the installation_id in the same secret after installing the App.
  */
+import { createServer } from "node:http";
 import { instanceNames } from "@deployfoundation/foundation-core/instance";
 import { loadAppManifest } from "./github-app-manifest.ts";
 import type { InstanceContext } from "./instance.ts";
+import { runCapture } from "./sh.ts";
 export interface GithubAppCreateOptions {
   paths: InstanceContext;
@@ -56,15 +58,14 @@ export async function githubAppCreate(options: GithubAppCreateOptions): Promise<
   async function writeSecret(value: string): Promise<void> {
     const run = async (cmd: string[]) => {
-      const p = Bun.spawn(["aws", ...cmd, "--profile", profile, "--region", region], {
-        stdin: "pipe",
-        stdout: "pipe",
-        stderr: "pipe",
-      });
-      p.stdin.write(value);
-      p.stdin.end();
-      const code = await p.exited;
-      return { code, err: await new Response(p.stderr).text() };
+      try {
+        await runCapture(["aws", ...cmd, "--profile", profile, "--region", region], {
+          stdin: value,
+        });
+        return { code: 0, err: "" };
+      } catch (error) {
+        return { code: 1, err: error instanceof Error ? error.message : String(error) };
+      }
     };
     let r = await run([
       "secretsmanager",
@@ -88,64 +89,72 @@ export async function githubAppCreate(options: GithubAppCreateOptions): Promise<
     if (r.code !== 0) throw new Error(`aws secretsmanager failed: ${r.err.trim()}`);
   }
-  const server = Bun.serve({
-    port,
-    async fetch(req) {
-      const url = new URL(req.url);
-      if (url.pathname === "/") {
-        const html = `<!doctype html><title>Create ${instance.displayName} GitHub App</title><body style="font-family:system-ui;padding:2rem">
+  const handler = async (req: Request): Promise<Response> => {
+    const url = new URL(req.url);
+    if (url.pathname === "/") {
+      const html = `<!doctype html><title>Create ${instance.displayName} GitHub App</title><body style="font-family:system-ui;padding:2rem">
 <h2>Creating the <b>${instance.displayName}</b> GitHub App on <b>${org}</b>…</h2><p>If nothing happens, click the button.</p>
 <form id="f" method="post" action="https://github.com/organizations/${org}/settings/apps/new?state=${state}">
 <input type="hidden" name="manifest" id="m"><button>Create GitHub App</button></form>
 <script>document.getElementById('m').value=${JSON.stringify(body)};document.getElementById('f').submit();</script></body>`;
-        return new Response(html, { headers: { "content-type": "text/html" } });
-      }
-      if (url.pathname === "/callback") {
-        const code = url.searchParams.get("code");
-        if (url.searchParams.get("state") !== state || code === null)
-          return new Response("bad state/code", { status: 400 });
-        const res = await fetch(
-          `https://api.github.com/app-manifests/${encodeURIComponent(code)}/conversions`,
-          {
-            method: "POST",
-            headers: {
-              Accept: "application/vnd.github+json",
-              "X-GitHub-Api-Version": "2022-11-28",
-            },
+      return new Response(html, { headers: { "content-type": "text/html" } });
+    }
+    if (url.pathname === "/callback") {
+      const code = url.searchParams.get("code");
+      if (url.searchParams.get("state") !== state || code === null)
+        return new Response("bad state/code", { status: 400 });
+      const res = await fetch(
+        `https://api.github.com/app-manifests/${encodeURIComponent(code)}/conversions`,
+        {
+          method: "POST",
+          headers: {
+            Accept: "application/vnd.github+json",
+            "X-GitHub-Api-Version": "2022-11-28",
           },
-        );
-        if (!res.ok) return new Response(`conversion failed: HTTP ${res.status}`, { status: 502 });
-        const app = (await res.json()) as {
-          id: number;
-          slug: string;
-          pem: string;
-          html_url: string;
-        };
-        await writeSecret(
-          JSON.stringify({ app_id: String(app.id), installation_id: "", private_key: app.pem }),
-        );
-        const installUrl = `https://github.com/apps/${app.slug}/installations/new`;
-        console.log(
-          JSON.stringify({
-            app_id: app.id,
-            slug: app.slug,
-            html_url: app.html_url,
-            install_url: installUrl,
-            secret: secretName,
-          }),
-        );
-        setTimeout(() => {
-          server.stop(true);
-          process.exit(0);
-        }, 500);
-        return new Response(
-          `<!doctype html><body style="font-family:system-ui;padding:2rem"><h2>✅ App "${app.slug}" created (id ${app.id}); private key stored in Secrets Manager ${secretName}.</h2><p>Next: <a href="${installUrl}">install it on your repos</a>.</p></body>`,
-          { headers: { "content-type": "text/html" } },
-        );
-      }
-      return new Response("not found", { status: 404 });
-    },
+        },
+      );
+      if (!res.ok) return new Response(`conversion failed: HTTP ${res.status}`, { status: 502 });
+      const app = (await res.json()) as {
+        id: number;
+        slug: string;
+        pem: string;
+        html_url: string;
+      };
+      await writeSecret(
+        JSON.stringify({ app_id: String(app.id), installation_id: "", private_key: app.pem }),
+      );
+      const installUrl = `https://github.com/apps/${app.slug}/installations/new`;
+      console.log(
+        JSON.stringify({
+          app_id: app.id,
+          slug: app.slug,
+          html_url: app.html_url,
+          install_url: installUrl,
+          secret: secretName,
+        }),
+      );
+      setTimeout(() => {
+        server.close();
+        process.exit(0);
+      }, 500);
+      return new Response(
+        `<!doctype html><body style="font-family:system-ui;padding:2rem"><h2>✅ App "${app.slug}" created (id ${app.id}); private key stored in Secrets Manager ${secretName}.</h2><p>Next: <a href="${installUrl}">install it on your repos</a>.</p></body>`,
+        { headers: { "content-type": "text/html" } },
+      );
+    }
+    return new Response("not found", { status: 404 });
+  };
+  // Node's `http`, not `Bun.serve`: this command ships in the npm package and
+  // runs under Node. The handler keeps the fetch-style Request/Response shape.
+  const server = createServer(async (req, res) => {
+    const request = new Request(`http://localhost:${port}${req.url ?? "/"}`, {
+      method: req.method ?? "GET",
+    });
+    const response = await handler(request);
+    res.writeHead(response.status, Object.fromEntries(response.headers));
+    res.end(await response.text());
   });
+  server.listen(port);
   console.log(`Open http://localhost:${port}/ to create the app (waiting up to 10 minutes)…`);
   setTimeout(() => {
     console.error("timed out");

package/src/deploy/setup.ts CHANGED Viewed

@@ -12,7 +12,7 @@
  * `--seed-codex` copies a local Codex credential into the instance's Codex
  * secret so the teammate is authenticated on day one without a Slack `login`.
  */
-import { existsSync } from "node:fs";
+import { existsSync, readFileSync } from "node:fs";
 import { resolve } from "node:path";
 import {
   type AwsContext,
@@ -44,6 +44,7 @@ import {
 } from "./endpoint.ts";
 import { currentImageTag } from "./image.ts";
 import { FOUNDATION_ROOT, INFRA_ROOT } from "./paths.ts";
+import { hasFoundationWorkspace } from "./release.ts";
 import { run, runCapture } from "./sh.ts";
 import { slackManifestFor } from "./slack-manifest.ts";
 import { stageCustomization } from "./stage-customization.ts";
@@ -96,6 +97,11 @@ async function output(ctx: AwsContext, stack: string, key: string): Promise<stri
  * workspace of this repo rather than a separate npm project.
  */
 async function installDependencies(ctx: AwsContext): Promise<void> {
+  // Only a Foundation checkout has a workspace to install. A copy of this tool
+  // installed from npm carries its dependencies already, and has neither Bun
+  // nor a lockfile beside it; running `bun install` there failed setup before
+  // it did anything, for every instance that is not Foundation itself.
+  if (!hasFoundationWorkspace()) return;
   await run(["bun", "install", "--frozen-lockfile"], {
     cwd: FOUNDATION_ROOT,
     dryRun: ctx.dryRun,
@@ -112,11 +118,18 @@ async function preflight(ctx: AwsContext): Promise<void> {
     );
   console.log(`  account ${account} via profile ${ctx.profile} (${ctx.region})`);
-  if (ctx.dryRun === true) {
+  // Docker builds the agent image locally, which only a checkout does. A
+  // release deploy pulls the signed image the manifest names instead.
+  if (!hasFoundationWorkspace()) {
+    // nothing to build
+  } else if (ctx.dryRun === true) {
     await run(["docker", "info"], { dryRun: true });
   } else {
-    const docker = Bun.spawn(["docker", "info"], { stdout: "ignore", stderr: "ignore" });
-    if ((await docker.exited) !== 0) throw new Error("docker is not running");
+    try {
+      await runCapture(["docker", "info"]);
+    } catch {
+      throw new Error("docker is not running");
+    }
     console.log("  docker ✓");
   }
@@ -151,7 +164,7 @@ async function writeRuntimeSecret(ctx: AwsContext): Promise<void> {
 async function seedCodex(ctx: AwsContext, codexFile: string): Promise<void> {
   if (!existsSync(codexFile))
     throw new Error(`${codexFile} not found — sign in locally first, or pass --codex-file`);
-  const document = await Bun.file(codexFile).text();
+  const document = readFileSync(codexFile, "utf8");
   JSON.parse(document); // fail here rather than storing a broken store document
   await putSecretString(ctx, ctx.names.secretCodex, document);
   console.log(`  ${ctx.names.secretCodex} seeded from ${codexFile}`);

package/src/deploy/sh.ts CHANGED Viewed

@@ -6,6 +6,9 @@
  * stdout for the caller and only surfaces stderr when the command fails.
  */
+import { type ChildProcess, spawn as nodeSpawn } from "node:child_process";
+import type { Readable } from "node:stream";
 export interface RunOptions {
   cwd?: string;
   env?: Record<string, string>;
@@ -28,24 +31,46 @@ function quote(value: string): string {
   return /^[A-Za-z0-9_@%+=:,./-]+$/.test(value) ? value : `'${value.replaceAll("'", `'\\''`)}'`;
 }
-function spawn(cmd: string[], opts: RunOptions, stdout: "inherit" | "pipe") {
+/**
+ * Node's `child_process`, not `Bun.spawn`. This file ships in
+ * `@deployfoundation/foundation-deploy`, which an instance's buildspec runs
+ * with `npx` under Node; a Bun-only API here made every command die with
+ * "Bun is not defined" before doing anything. `node:child_process` works under
+ * both runtimes, so the Bun-run tests and the Node-run tool share one path.
+ */
+function start(cmd: string[], opts: RunOptions, stdout: "inherit" | "pipe"): ChildProcess {
   const [bin, ...rest] = cmd;
   if (bin === undefined) throw new Error("run: empty command");
-  return Bun.spawn([bin, ...rest], {
+  const child = nodeSpawn(bin, rest, {
     cwd: opts.cwd,
     env: { ...process.env, ...opts.env },
-    stdin: opts.stdin === undefined ? "ignore" : "pipe",
-    stdout,
-    stderr: stdout === "inherit" ? "inherit" : "pipe",
+    stdio: [
+      opts.stdin === undefined ? "ignore" : "pipe",
+      stdout,
+      stdout === "inherit" ? "inherit" : "pipe",
+    ],
+  });
+  if (opts.stdin !== undefined && child.stdin !== null) {
+    child.stdin.end(opts.stdin);
+  }
+  return child;
+}
+function exited(child: ChildProcess): Promise<number> {
+  return new Promise((resolve, reject) => {
+    child.once("error", reject);
+    child.once("close", (code, signal) => resolve(code ?? (signal === null ? 1 : 128)));
   });
 }
-async function feed(proc: { stdin: unknown }, stdin: string | undefined): Promise<void> {
-  if (stdin === undefined) return;
-  const sink = proc.stdin as { write: (s: string) => void; end: () => void } | null;
-  if (sink === null) return;
-  sink.write(stdin);
-  sink.end();
+function collect(stream: Readable | null): Promise<string> {
+  if (stream === null) return Promise.resolve("");
+  return new Promise((resolve, reject) => {
+    const chunks: Buffer[] = [];
+    stream.on("data", (c: Buffer) => chunks.push(c));
+    stream.once("error", reject);
+    stream.once("end", () => resolve(Buffer.concat(chunks).toString("utf8")));
+  });
 }
 /** Run a command with inherited stdio. Throws if it exits non-zero. */
@@ -54,20 +79,17 @@ export async function run(cmd: string[], opts: RunOptions = {}): Promise<void> {
     console.log(`  $ ${formatCommand(cmd, opts.env)}`);
     return;
   }
-  const proc = spawn(cmd, opts, "inherit");
-  await feed(proc, opts.stdin);
-  const code = await proc.exited;
+  const code = await exited(start(cmd, opts, "inherit"));
   if (code !== 0) throw new Error(`${formatCommand(cmd)} exited ${code}`);
 }
 /** Run a command and return its trimmed stdout. Throws with stderr on failure. */
 export async function runCapture(cmd: string[], opts: RunOptions = {}): Promise<string> {
-  const proc = spawn(cmd, opts, "pipe");
-  await feed(proc, opts.stdin);
+  const child = start(cmd, opts, "pipe");
   const [out, err, code] = await Promise.all([
-    new Response(proc.stdout).text(),
-    new Response(proc.stderr).text(),
-    proc.exited,
+    collect(child.stdout),
+    collect(child.stderr),
+    exited(child),
   ]);
   if (code !== 0) throw new Error(`${formatCommand(cmd)} exited ${code}: ${err.trim()}`);
   return out.trim();

/package/dist/{chunk-9ddxyvq2.js → chunk-t86rw0f2.js} RENAMED Viewed

File without changes