@deployfoundation/foundation-deploy 0.1.0

package/src/deploy/setup.ts

@@ -0,0 +1,393 @@
+/**
+ * First-deploy orchestration. Idempotent: every step is safe to re-run, so on
+ * a failure you fix the cause and run the whole thing again.
+ *
+ *   foundation-deploy setup --instance .foundation/instance.yaml [--seed-codex]
+ *
+ * The two-phase shape exists because the AgentCore Runtime validates its
+ * container URI at create time: phase 1 deploys the stacks with
+ * `deployRuntime=false` (creating the ECR repository), the image is built and
+ * pushed, then phase 2 creates the runtime against a URI that resolves.
+ *
+ * `--seed-codex` copies a local Codex credential into the instance's Codex
+ * secret so the teammate is authenticated on day one without a Slack `login`.
+ */
+import { existsSync } from "node:fs";
+import { resolve } from "node:path";
+import {
+  type AwsContext,
+  aws,
+  callerAccountId,
+  cdkEnv,
+  putSecretString,
+  secretExists,
+  stackExists,
+  stackOutput,
+} from "./aws.ts";
+import { configSync } from "./config-sync.ts";
+import { adminsCsvFromFile } from "./config.ts";
+import {
+  alarmEmailFor,
+  buildAndPushImage,
+  cdkCommand,
+  cdkDeploy,
+  syncKnockOAuthClient,
+  syncRuntimeSecret,
+} from "./deploy.ts";
+import {
+  cliRunner,
+  currentRuntimeVersion,
+  ensureEndpoint,
+  runtimeIdFromArn,
+  smokeInvoke,
+  smokeSessionId,
+} from "./endpoint.ts";
+import { currentImageTag } from "./image.ts";
+import { FOUNDATION_ROOT, INFRA_ROOT } from "./paths.ts";
+import { run, runCapture } from "./sh.ts";
+import { slackManifestFor } from "./slack-manifest.ts";
+import { stageCustomization } from "./stage-customization.ts";
+import { cliTracingRunner, ensureTransactionSearch } from "./tracing.ts";
+
+/**
+ * Default location of a local Codex credential to seed, beside the instance
+ * file in an ignored directory. `--codex-file` overrides it.
+ */
+export function defaultCodexFile(instanceRoot: string): string {
+  return resolve(instanceRoot, ".foundation-local", "codex.json");
+}
+
+function step(n: number, title: string): void {
+  console.log(`\n▶ ${n}. ${title}`);
+}
+/** Register a first-deploy Knock client immediately after the API callback exists. */
+export async function syncSetupKnockOAuth(
+  ctx: AwsContext,
+  sync: typeof syncKnockOAuthClient = syncKnockOAuthClient,
+): Promise<"skipped" | "unchanged" | "registered"> {
+  return sync(ctx);
+}
+
+/** Stand-ins shaped like the real thing, so --dry-run gets past the parsers. */
+function placeholder(ctx: AwsContext, stack: string, key: string): string {
+  if (key === "RepositoryUri")
+    return `${ctx.instance.aws.account}.dkr.ecr.${ctx.region}.amazonaws.com/${ctx.names.ecrRepo}`;
+  return `<${stack}.${key}>`;
+}
+
+/**
+ * A stack output, tolerating a not-yet-deployed stack under --dry-run so the
+ * whole plan can be printed before anything exists.
+ */
+async function output(ctx: AwsContext, stack: string, key: string): Promise<string> {
+  if (ctx.dryRun !== true) return stackOutput(ctx, stack, key);
+  try {
+    return await stackOutput(ctx, stack, key);
+  } catch {
+    return placeholder(ctx, stack, key);
+  }
+}
+
+/**
+ * Install what the rest of the run shells out to. Idempotent and quick on an
+ * up-to-date checkout; a stale `node_modules` otherwise fails the Lambda
+ * bundling step several minutes in, with an error that names neither the cause
+ * nor the fix. One install now, rather than sky-tags' two: the CDK app is a
+ * workspace of this repo rather than a separate npm project.
+ */
+async function installDependencies(ctx: AwsContext): Promise<void> {
+  await run(["bun", "install", "--frozen-lockfile"], {
+    cwd: FOUNDATION_ROOT,
+    dryRun: ctx.dryRun,
+  });
+}
+
+async function preflight(ctx: AwsContext): Promise<void> {
+  await installDependencies(ctx);
+  const expected = ctx.instance.aws.account;
+  const account = await callerAccountId(ctx);
+  if (account !== expected)
+    throw new Error(
+      `profile ${ctx.profile} is account ${account}, expected ${expected} for instance ${ctx.instance.name}`,
+    );
+  console.log(`  account ${account} via profile ${ctx.profile} (${ctx.region})`);
+
+  if (ctx.dryRun === true) {
+    await run(["docker", "info"], { dryRun: true });
+  } else {
+    const docker = Bun.spawn(["docker", "info"], { stdout: "ignore", stderr: "ignore" });
+    if ((await docker.exited) !== 0) throw new Error("docker is not running");
+    console.log("  docker ✓");
+  }
+
+  for (const id of [
+    ctx.names.secretSlackSigning,
+    ctx.names.secretSlackApp,
+    ctx.names.secretGithubApp,
+  ]) {
+    if (!(await secretExists(ctx, id)))
+      throw new Error(`secret ${id} is missing — create it before running setup`);
+    console.log(`  secret ${id} ✓`);
+  }
+}
+
+async function bootstrap(ctx: AwsContext): Promise<void> {
+  if (ctx.dryRun !== true && (await stackExists(ctx, "CDKToolkit"))) {
+    console.log("  CDKToolkit already present — skipping bootstrap");
+    return;
+  }
+  await run([...cdkCommand(), "bootstrap", `aws://${ctx.instance.aws.account}/${ctx.region}`], {
+    cwd: INFRA_ROOT,
+    env: { AWS_PROFILE: ctx.profile, AWS_REGION: ctx.region, CDK_DEFAULT_REGION: ctx.region },
+    dryRun: ctx.dryRun,
+  });
+}
+
+async function writeRuntimeSecret(ctx: AwsContext): Promise<void> {
+  // Same composition `deploy.ts` re-runs after every deploy.
+  console.log(`  keys: ${(await syncRuntimeSecret(ctx)).join(", ")}`);
+}
+
+async function seedCodex(ctx: AwsContext, codexFile: string): Promise<void> {
+  if (!existsSync(codexFile))
+    throw new Error(`${codexFile} not found — sign in locally first, or pass --codex-file`);
+  const document = await Bun.file(codexFile).text();
+  JSON.parse(document); // fail here rather than storing a broken store document
+  await putSecretString(ctx, ctx.names.secretCodex, document);
+  console.log(`  ${ctx.names.secretCodex} seeded from ${codexFile}`);
+}
+
+/**
+ * Print the Slack app manifest for the deployed API, and the two commands that
+ * apply it.
+ *
+ * Foundation does not run the Slack CLI itself: the CLI is authed against the
+ * workspace from wherever the operator works, and its `get-manifest` hook
+ * belongs to the instance repository (pointing at `foundation-deploy
+ * slack-manifest`), not to the product. Printing the manifest and naming the
+ * commands keeps app-as-code without this package pretending to own an
+ * operator's Slack session.
+ */
+async function reportSlackManifest(ctx: AwsContext): Promise<void> {
+  const { appId, teamId } = ctx.instance.slack;
+  const manifest = slackManifestFor(ctx.instance, {
+    EVENTS_REQUEST_URL: await output(ctx, ctx.names.api, "EventsUrl"),
+    COMMANDS_REQUEST_URL: await output(ctx, ctx.names.api, "CommandsUrl"),
+    INTERACTIVE_REQUEST_URL: await output(ctx, ctx.names.api, "InteractiveUrl"),
+  });
+  console.log(`  manifest: ${JSON.stringify(manifest)}`);
+  console.log(
+    [
+      "  apply it from the instance repository, whose .slack/hooks.json runs",
+      "  `foundation-deploy slack-manifest --instance <path>`:",
+      `    slack manifest diff --app ${appId} --team ${teamId}`,
+      `    slack app install --app ${appId} --team ${teamId} --force`,
+      "  if scopes changed, re-approve in Slack when prompted",
+    ].join("\n"),
+  );
+}
+
+async function smokeTest(ctx: AwsContext): Promise<void> {
+  const arn = await output(ctx, ctx.names.agent, "AgentRuntimeArn");
+  await smokeInvoke(cliRunner(ctx), {
+    arn,
+    sessionId: smokeSessionId("smoke"),
+    dryRun: ctx.dryRun,
+  });
+}
+
+/**
+ * The pinned endpoint humans talk to. CDK does not manage it on purpose — a
+ * deploy creates a new runtime version and must not flip `live` onto it before
+ * the smoke tests pass — so `setup` creates it once, here, and every deploy
+ * after that only promotes it.
+ */
+async function ensureLiveEndpoint(ctx: AwsContext): Promise<void> {
+  const runner = cliRunner(ctx);
+  const arn = await output(ctx, ctx.names.agent, "AgentRuntimeArn");
+  const id = ctx.dryRun === true ? `<${ctx.names.agent}.runtimeId>` : runtimeIdFromArn(arn);
+  const version = ctx.dryRun === true ? "<version>" : await currentRuntimeVersion(runner, id);
+  await ensureEndpoint(runner, { id, name: "live", version, dryRun: ctx.dryRun });
+}
+
+/**
+ * Account-level, not per-instance: exported spans are only indexed — and only
+ * visible under Transaction Search and the GenAI Observability views — once
+ * this is on. Idempotent, so a second instance in the same account reads it and
+ * changes nothing.
+ */
+async function enableTransactionSearch(ctx: AwsContext): Promise<void> {
+  const result = await ensureTransactionSearch(cliTracingRunner(ctx), {
+    account: ctx.instance.aws.account,
+    region: ctx.region,
+    ...(ctx.dryRun === true ? { dryRun: true } : {}),
+  });
+  console.log(
+    `  ingestion policy: ${result.ingestionPolicy}; destination: ${result.destination}; indexing rule: ${result.indexing}`,
+  );
+}
+
+/**
+ * The CodeConnections connection's status, or `UNKNOWN` when the call fails.
+ * A new connection is `PENDING` until a human authorises the GitHub App in the
+ * console; nothing here can do that, and the pipeline cannot source until it
+ * is `AVAILABLE`.
+ */
+export async function connectionStatus(ctx: AwsContext, arn: string): Promise<string> {
+  try {
+    return await aws(ctx, [
+      "codeconnections",
+      "get-connection",
+      "--connection-arn",
+      arn,
+      "--query",
+      "Connection.ConnectionStatus",
+      "--output",
+      "text",
+    ]);
+  } catch {
+    return "UNKNOWN";
+  }
+}
+
+/** Where a human goes to authorise a pending connection. */
+export function connectionConsoleUrl(region: string): string {
+  return `https://${region}.console.aws.amazon.com/codesuite/settings/connections?region=${region}`;
+}
+
+/**
+ * Deploy the instance's own pipeline, once, from here. After this the pipeline
+ * deploys itself: its build runs `cdk deploy --all`, which includes this stack.
+ *
+ * Deploying it while the connection is still `PENDING` would create a pipeline
+ * whose every run fails on the source stage, so this stops and says who has to
+ * click what instead.
+ */
+async function deployPipelineStack(ctx: AwsContext): Promise<void> {
+  const { deploy } = ctx.instance;
+  if (deploy.via !== "codepipeline") {
+    console.log("  skipped — this instance is deployed by GitHub Actions");
+    return;
+  }
+  const arn = deploy.connectionArn ?? "";
+  const status = ctx.dryRun === true ? "AVAILABLE" : await connectionStatus(ctx, arn);
+  console.log(`  connection ${arn}\n  status: ${status}`);
+  if (status !== "AVAILABLE") {
+    console.log(
+      `  not deploying ${ctx.names.pipeline}: authorise the connection first, at\n  ${connectionConsoleUrl(ctx.region)}\n  then re-run setup.`,
+    );
+    return;
+  }
+  await run(
+    [
+      ...cdkCommand(),
+      "deploy",
+      ctx.names.pipeline,
+      "--require-approval",
+      "never",
+      "-c",
+      `instanceFile=${ctx.paths.path}`,
+    ],
+    { cwd: INFRA_ROOT, env: cdkEnv(ctx), dryRun: ctx.dryRun },
+  );
+}
+
+/** The workflow variable naming this instance's deploy role: `ACME_DEPLOY_ROLE_ARN`. */
+export function deployRoleVariableName(instanceName: string): string {
+  return `${instanceName.toUpperCase().replaceAll("-", "_")}_DEPLOY_ROLE_ARN`;
+}
+
+/**
+ * Hand the instance repository's workflow the role it assumes. Without the
+ * variable a deploy job falls back to a default role and deploys the wrong
+ * account, so it is part of bring-up rather than a follow-up chore.
+ */
+async function setDeployRoleVariable(ctx: AwsContext): Promise<void> {
+  const arn = await output(ctx, ctx.names.ci, "DeployRoleArn");
+  const name = deployRoleVariableName(ctx.instance.name);
+  const cmd = ["gh", "variable", "set", name, "--repo", ctx.instance.github.repo, "--body", arn];
+  if (ctx.dryRun !== true) {
+    try {
+      await runCapture(["gh", "auth", "status"]);
+    } catch {
+      console.log(`  gh is not authenticated — set it yourself: ${cmd.join(" ")}`);
+      return;
+    }
+  }
+  await run(cmd, { dryRun: ctx.dryRun });
+  console.log(`  ${name} = ${arn}`);
+}
+
+export async function setup(
+  ctx: AwsContext,
+  opts: { seedCodex?: boolean; codexFile?: string; alarmEmail?: string } = {},
+): Promise<void> {
+  const customization = stageCustomization({ paths: ctx.paths, dryRun: ctx.dryRun });
+  const runtimeConfigPath = customization.runtimeConfigPath;
+  const admins = adminsCsvFromFile(ctx.paths.configPath);
+  const alarmEmail = alarmEmailFor(ctx, opts.alarmEmail);
+
+  step(1, "preflight: dependencies, credentials, secrets");
+  await preflight(ctx);
+
+  step(2, "cdk bootstrap");
+  await bootstrap(ctx);
+
+  step(3, "enable CloudWatch Transaction Search");
+  await enableTransactionSearch(ctx);
+
+  step(4, "phase 1: deploy stacks without the AgentCore runtime");
+  await cdkDeploy(ctx, { admins, alarmEmail, phase1: true });
+  const knockOAuth = await syncSetupKnockOAuth(ctx);
+  if (knockOAuth !== "skipped") console.log(`  Knock OAuth: ${knockOAuth}`);
+
+  // Before phase 2, not after: the runtime's first container reads this secret
+  // at boot, and one written afterwards leaves that container serving the
+  // fallback config until something recycles it.
+  step(5, `write ${ctx.names.secretRuntime}`);
+  await writeRuntimeSecret(ctx);
+
+  // Likewise the bucket: the container fetches its config from S3 at boot.
+  step(6, "sync config + skills to S3");
+  const bucket = await configSync(ctx, {
+    bucket: await output(ctx, ctx.names.data, "BucketName"),
+    runtimeConfigPath,
+  });
+  console.log(`  s3://${bucket}/`);
+
+  step(7, "build + push the agent image");
+  const tag = await currentImageTag(FOUNDATION_ROOT);
+  const repositoryUri = await output(ctx, ctx.names.agent, "RepositoryUri");
+  console.log(`  ${repositoryUri}:${tag}`);
+  await buildAndPushImage(ctx, { tag, repositoryUri });
+
+  step(8, "phase 2: deploy the AgentCore runtime");
+  await cdkDeploy(ctx, { admins, alarmEmail, tag });
+
+  // Only FOUNDATION_AGENT_RUNTIME_ARN needs phase 2, but it is what a routine's
+  // schedule targets, so the secret is composed once more now that it exists.
+  step(9, `refresh ${ctx.names.secretRuntime} with the runtime arn`);
+  await writeRuntimeSecret(ctx);
+
+  step(10, "create the pinned `live` endpoint");
+  await ensureLiveEndpoint(ctx);
+
+  step(11, `seed ${ctx.names.secretCodex}`);
+  if (opts.seedCodex === true)
+    await seedCodex(ctx, opts.codexFile ?? defaultCodexFile(ctx.paths.root));
+  else console.log("  skipped (pass --seed-codex, or run `login` in Slack as an admin)");
+
+  step(12, "tell GitHub Actions which role to assume");
+  await setDeployRoleVariable(ctx);
+
+  step(13, "deploy the instance's own pipeline, if it has one");
+  await deployPipelineStack(ctx);
+
+  step(14, "the Slack app manifest for the deployed API");
+  await reportSlackManifest(ctx);
+
+  step(15, "smoke test the runtime");
+  await smokeTest(ctx);
+
+  console.log(`\nDone. Now say \`@${ctx.instance.displayName} hello\` in Slack.`);
+}

package/src/deploy/sh.ts

@@ -0,0 +1,74 @@
+/**
+ * Tiny process helpers shared by the deploy scripts.
+ *
+ * `run` streams the child's output straight to this terminal (cdk, docker and
+ * the slack CLI are all long-running and worth watching); `runCapture` keeps
+ * stdout for the caller and only surfaces stderr when the command fails.
+ */
+
+export interface RunOptions {
+  cwd?: string;
+  env?: Record<string, string>;
+  /** Print the command instead of executing it. */
+  dryRun?: boolean;
+  /** Fed to the child on stdin, then closed. */
+  stdin?: string;
+}
+
+/** A copy-pasteable rendering of a command, used for logs and `--dry-run`. */
+export function formatCommand(cmd: string[], env?: Record<string, string>): string {
+  const prefix = Object.entries(env ?? {})
+    .map(([k, v]) => `${k}=${quote(v)}`)
+    .join(" ");
+  const body = cmd.map(quote).join(" ");
+  return prefix === "" ? body : `${prefix} ${body}`;
+}
+
+function quote(value: string): string {
+  return /^[A-Za-z0-9_@%+=:,./-]+$/.test(value) ? value : `'${value.replaceAll("'", `'\\''`)}'`;
+}
+
+function spawn(cmd: string[], opts: RunOptions, stdout: "inherit" | "pipe") {
+  const [bin, ...rest] = cmd;
+  if (bin === undefined) throw new Error("run: empty command");
+  return Bun.spawn([bin, ...rest], {
+    cwd: opts.cwd,
+    env: { ...process.env, ...opts.env },
+    stdin: opts.stdin === undefined ? "ignore" : "pipe",
+    stdout,
+    stderr: stdout === "inherit" ? "inherit" : "pipe",
+  });
+}
+
+async function feed(proc: { stdin: unknown }, stdin: string | undefined): Promise<void> {
+  if (stdin === undefined) return;
+  const sink = proc.stdin as { write: (s: string) => void; end: () => void } | null;
+  if (sink === null) return;
+  sink.write(stdin);
+  sink.end();
+}
+
+/** Run a command with inherited stdio. Throws if it exits non-zero. */
+export async function run(cmd: string[], opts: RunOptions = {}): Promise<void> {
+  if (opts.dryRun === true) {
+    console.log(`  $ ${formatCommand(cmd, opts.env)}`);
+    return;
+  }
+  const proc = spawn(cmd, opts, "inherit");
+  await feed(proc, opts.stdin);
+  const code = await proc.exited;
+  if (code !== 0) throw new Error(`${formatCommand(cmd)} exited ${code}`);
+}
+
+/** Run a command and return its trimmed stdout. Throws with stderr on failure. */
+export async function runCapture(cmd: string[], opts: RunOptions = {}): Promise<string> {
+  const proc = spawn(cmd, opts, "pipe");
+  await feed(proc, opts.stdin);
+  const [out, err, code] = await Promise.all([
+    new Response(proc.stdout).text(),
+    new Response(proc.stderr).text(),
+    proc.exited,
+  ]);
+  if (code !== 0) throw new Error(`${formatCommand(cmd)} exited ${code}: ${err.trim()}`);
+  return out.trim();
+}

package/src/deploy/slack-manifest.ts

@@ -0,0 +1,112 @@
+/**
+ * Build the Slack app manifest for one instance.
+ *
+ * `assets/slack-app-manifest.yml` — a package asset, not a file in anyone's
+ * repository — carries the instance-facing text (names, descriptions, slash
+ * commands, app home). Bot scopes and event subscriptions come from the
+ * capability registry so a capability's scope needs live next to the
+ * capability, and a manifest can never be missing a scope a shipped capability
+ * requires. The app is installed once per workspace and capabilities toggle at
+ * runtime, so the manifest asks for every registered capability's scopes, not
+ * only the currently enabled ones.
+ *
+ * Request URLs are substituted from env. When they are unset (no API deployed
+ * yet) the URL-bearing sections are removed entirely, because Slack verifies
+ * request URLs on manifest create and would reject a placeholder.
+ */
+import { readFileSync } from "node:fs";
+import { join } from "node:path";
+import {
+  BASE_SLACK_EVENTS,
+  CAPABILITY_IDS,
+  requiredSlackCommands,
+  requiredSlackScopes,
+} from "@deployfoundation/foundation-core";
+import { type Instance, slackCommandPrefix } from "@deployfoundation/foundation-core/instance";
+import { parse } from "yaml";
+import { PACKAGE_ASSETS } from "./paths.ts";
+
+/** The Slack app manifest template this package ships. */
+export const SLACK_APP_MANIFEST_PATH = join(PACKAGE_ASSETS, "slack-app-manifest.yml");
+
+export interface SlackManifestInstance {
+  displayName: string;
+  /** Rendered into `/<prefix>-<suffix>` for every slash command. */
+  commandPrefix: string;
+}
+
+export interface SlackManifestEnv {
+  EVENTS_REQUEST_URL?: string;
+  COMMANDS_REQUEST_URL?: string;
+  INTERACTIVE_REQUEST_URL?: string;
+}
+
+export interface SlackManifest {
+  features: { slash_commands?: Array<{ command: string }> };
+  oauth_config: { scopes: { bot: string[] } };
+  settings: {
+    event_subscriptions?: { request_url: string; bot_events: string[] };
+    interactivity?: unknown;
+  };
+}
+
+export function buildSlackManifest(
+  template: string,
+  instance: SlackManifestInstance,
+  env: SlackManifestEnv,
+): SlackManifest {
+  const events = env.EVENTS_REQUEST_URL;
+  const commands = env.COMMANDS_REQUEST_URL ?? events?.replace(/\/events$/, "/commands");
+  const interactive = env.INTERACTIVE_REQUEST_URL ?? events?.replace(/\/events$/, "/interactive");
+
+  const manifest = parse(
+    template
+      .replaceAll("${DISPLAY_NAME}", instance.displayName)
+      // Slack rejects an uppercase bot display name.
+      .replaceAll("${BOT_NAME}", instance.displayName.toLowerCase())
+      .replaceAll("${COMMAND_PREFIX}", instance.commandPrefix)
+      .replaceAll("${EVENTS_REQUEST_URL}", events ?? "")
+      .replaceAll("${COMMANDS_REQUEST_URL}", commands ?? "")
+      .replaceAll("${INTERACTIVE_REQUEST_URL}", interactive ?? ""),
+  ) as SlackManifest & { oauth_config?: { scopes?: { bot?: unknown } } };
+
+  if (manifest.oauth_config?.scopes?.bot !== undefined)
+    throw new Error(
+      "app-manifest.yml: bot scopes are generated from the Foundation capability registry; remove them from the template",
+    );
+  manifest.oauth_config = { scopes: { bot: requiredSlackScopes(CAPABILITY_IDS) } };
+
+  // Every command a registered capability needs must be in the template; the
+  // template may carry more (help, drive) than the registry knows about.
+  const declared = new Set((manifest.features.slash_commands ?? []).map((c) => c.command));
+  for (const command of requiredSlackCommands(CAPABILITY_IDS, instance.commandPrefix))
+    if (!declared.has(command))
+      throw new Error(
+        `app-manifest.yml: missing slash command ${command} required by a capability`,
+      );
+
+  if (events === undefined) {
+    manifest.settings.event_subscriptions = undefined;
+  } else {
+    manifest.settings.event_subscriptions = {
+      request_url: events,
+      bot_events: [...BASE_SLACK_EVENTS],
+    };
+  }
+  if (commands === undefined || commands === "") manifest.features.slash_commands = undefined;
+  if (interactive === undefined || interactive === "") manifest.settings.interactivity = undefined;
+  return manifest;
+}
+
+/**
+ * The manifest for one instance, read from the shipped template. The command
+ * prefix is the instance's own, so one declaration renders `/<prefix>-help`
+ * for every deployment and a different one for each.
+ */
+export function slackManifestFor(instance: Instance, env: SlackManifestEnv): SlackManifest {
+  return buildSlackManifest(
+    readFileSync(SLACK_APP_MANIFEST_PATH, "utf8"),
+    { displayName: instance.displayName, commandPrefix: slackCommandPrefix(instance) },
+    env,
+  );
+}