@deployfoundation/foundation-deploy 0.2.38 → 0.2.39

package/dist/bin/foundation-deploy.js

@@ -1,61 +1,464 @@
 #!/usr/bin/env node
 // @bun
-import {
-  AGENT_DOCKERFILE,
-  FOUNDATION_ROOT,
-  INFRA_ROOT,
-  PACKAGE_ASSETS,
-  argv,
-  aws,
-  awsContext,
-  awsMutate,
-  callerAccountId,
-  cdkEnv,
-  createSecretString,
-  foundationVersion,
-  hasFoundationWorkspace,
-  instanceBanner,
-  loadInstanceContext,
-  putSecretJson,
-  putSecretString,
-  readSecretJson,
-  readSecretString,
-  releaseContext,
-  releaseRequest,
-  resolveInstanceFilePath,
-  resolveRelease,
-  run,
-  runCapture,
-  secretExists,
-  stackExists,
-  stackOutput,
-  toolVersion
-} from "../chunk-8e2z4rhf.js";
 import {
   BASE_SLACK_EVENTS,
   CAPABILITY_IDS,
   CUSTOMIZATION_ARTIFACT_NAME,
+  RELEASE_BUCKET_ENV,
+  RELEASE_VERSION_RE,
   instanceNames,
   isScheduledJob,
   isWebhookJob,
   jobWebhookKey,
+  loadInstanceFile,
+  manifestKey,
   parseInstanceConfig,
   parseSchedule,
+  releaseCacheDir,
   requiredGithubPermissions,
   requiredSlackCommands,
   requiredSlackScopes,
   skillsKey,
   slackCommandPrefix,
+  verifyManifest,
   versionedConfigKey
-} from "../chunk-2ra18dqx.js";
+} from "../chunk-7rd8c1th.js";
+import {
+  DEFAULT_RELEASE_BUCKET,
+  expectedKeyArn
+} from "../chunk-dz91avrb.js";
 
-// src/deploy/config-sync.ts
-import { existsSync, mkdirSync, mkdtempSync, readdirSync } from "node:fs";
+// src/deploy/aws.ts
+import { mkdtempSync, rmSync, writeFileSync } from "node:fs";
 import { tmpdir } from "node:os";
-import { join, resolve } from "node:path";
+import { join } from "node:path";
+
+// src/deploy/instance.ts
+import { dirname } from "node:path";
+var INSTANCE_FILE_ENV = "FOUNDATION_INSTANCE_FILE";
+function resolveInstanceFilePath(argv = [], env = {}) {
+  for (let i = 0;i < argv.length; i++) {
+    const arg = argv[i] ?? "";
+    if (arg === "--instance") {
+      const next = argv[i + 1];
+      if (next === undefined || next.startsWith("-"))
+        throw new Error("--instance needs a path, e.g. --instance .foundation/instance.yaml");
+      return next;
+    }
+    if (arg.startsWith("--instance=")) {
+      const value = arg.slice("--instance=".length);
+      if (value === "")
+        throw new Error("--instance needs a path");
+      return value;
+    }
+  }
+  const fromEnv = env[INSTANCE_FILE_ENV];
+  if (fromEnv !== undefined && fromEnv !== "")
+    return fromEnv;
+  throw new Error(`--instance <path> is required (or set ${INSTANCE_FILE_ENV}); it is the path to the deployment's instance YAML`);
+}
+function loadInstanceContext(path, cwd = process.cwd()) {
+  const file = loadInstanceFile(path, cwd);
+  return { ...file, root: dirname(file.path) };
+}
+function loadInstanceFromArgs(argv = process.argv.slice(2), env = process.env) {
+  return loadInstanceContext(resolveInstanceFilePath(argv, env));
+}
+function instanceBanner(context) {
+  const { instance } = context;
+  return `instance: ${instance.name} (account ${instance.aws.account}, region ${instance.aws.region})
+  file: ${context.path}
+  config: ${context.configPath}`;
+}
+
+// src/deploy/sh.ts
+import { spawn as nodeSpawn } from "node:child_process";
+function formatCommand(cmd, env) {
+  const prefix = Object.entries(env ?? {}).map(([k, v]) => `${k}=${quote(v)}`).join(" ");
+  const body = cmd.map(quote).join(" ");
+  return prefix === "" ? body : `${prefix} ${body}`;
+}
+function quote(value) {
+  return /^[A-Za-z0-9_@%+=:,./-]+$/.test(value) ? value : `'${value.replaceAll("'", `'\\''`)}'`;
+}
+function start(cmd, opts, stdout) {
+  const [bin, ...rest] = cmd;
+  if (bin === undefined)
+    throw new Error("run: empty command");
+  const child = nodeSpawn(bin, rest, {
+    cwd: opts.cwd,
+    env: { ...process.env, ...opts.env },
+    stdio: [
+      opts.stdin === undefined ? "ignore" : "pipe",
+      stdout,
+      stdout === "inherit" ? "inherit" : "pipe"
+    ]
+  });
+  if (opts.stdin !== undefined && child.stdin !== null) {
+    child.stdin.end(opts.stdin);
+  }
+  return child;
+}
+function exited(child) {
+  return new Promise((resolve, reject) => {
+    child.once("error", reject);
+    child.once("close", (code, signal) => resolve(code ?? (signal === null ? 1 : 128)));
+  });
+}
+function collect(stream) {
+  if (stream === null)
+    return Promise.resolve("");
+  return new Promise((resolve, reject) => {
+    const chunks = [];
+    stream.on("data", (c) => chunks.push(c));
+    stream.once("error", reject);
+    stream.once("end", () => resolve(Buffer.concat(chunks).toString("utf8")));
+  });
+}
+async function run(cmd, opts = {}) {
+  if (opts.dryRun === true) {
+    console.log(`  $ ${formatCommand(cmd, opts.env)}`);
+    return;
+  }
+  const code = await exited(start(cmd, opts, "inherit"));
+  if (code !== 0)
+    throw new Error(`${formatCommand(cmd)} exited ${code}`);
+}
+async function runCapture(cmd, opts = {}) {
+  const child = start(cmd, opts, "pipe");
+  const [out, err, code] = await Promise.all([
+    collect(child.stdout),
+    collect(child.stderr),
+    exited(child)
+  ]);
+  if (code !== 0)
+    throw new Error(`${formatCommand(cmd)} exited ${code}: ${err.trim()}`);
+  return out.trim();
+}
+
+// src/deploy/aws.ts
+function resolveProfile(fallback, explicit, env = process.env) {
+  if (env.FOUNDATION_NO_PROFILE === "1")
+    return "";
+  if (explicit !== undefined)
+    return explicit;
+  if (env.AWS_PROFILE !== undefined && env.AWS_PROFILE !== "")
+    return env.AWS_PROFILE;
+  if (env.GITHUB_ACTIONS === "true")
+    return "";
+  return fallback;
+}
+function awsContext(overrides = {}) {
+  const env = overrides.env ?? process.env;
+  const paths = overrides.paths ?? loadInstanceFromArgs();
+  const instance = paths.instance;
+  return {
+    profile: resolveProfile(instance.aws.profile, overrides.profile, env),
+    region: overrides.region ?? env.AWS_REGION ?? instance.aws.region,
+    dryRun: overrides.dryRun ?? false,
+    instance,
+    paths,
+    names: instanceNames(instance)
+  };
+}
+function argv(ctx, args) {
+  const profile = ctx.profile === "" ? [] : ["--profile", ctx.profile];
+  return ["aws", ...args, ...profile, "--region", ctx.region];
+}
+function cdkEnv(ctx) {
+  return {
+    ...ctx.profile === "" ? {} : { AWS_PROFILE: ctx.profile },
+    AWS_REGION: ctx.region,
+    CDK_DEFAULT_REGION: ctx.region
+  };
+}
+async function aws(ctx, args, stdin) {
+  return runCapture(argv(ctx, args), { stdin });
+}
+async function awsMutate(ctx, args, stdin) {
+  if (ctx.dryRun === true) {
+    console.log(`  $ ${argv(ctx, args).join(" ")}${stdin === undefined ? "" : " < (stdin)"}`);
+    return;
+  }
+  await run(argv(ctx, args), { stdin });
+}
+async function stackOutput(ctx, stack, key) {
+  const value = await aws(ctx, [
+    "cloudformation",
+    "describe-stacks",
+    "--stack-name",
+    stack,
+    "--query",
+    `Stacks[0].Outputs[?OutputKey=='${key}'].OutputValue`,
+    "--output",
+    "text"
+  ]);
+  if (value === "" || value === "None")
+    throw new Error(`stack ${stack} has no output ${key} — has it been deployed?`);
+  return value;
+}
+async function stackExists(ctx, stack) {
+  try {
+    await aws(ctx, [
+      "cloudformation",
+      "describe-stacks",
+      "--stack-name",
+      stack,
+      "--output",
+      "text"
+    ]);
+    return true;
+  } catch {
+    return false;
+  }
+}
+async function secretExists(ctx, secretId) {
+  try {
+    await aws(ctx, [
+      "secretsmanager",
+      "describe-secret",
+      "--secret-id",
+      secretId,
+      "--output",
+      "text"
+    ]);
+    return true;
+  } catch {
+    return false;
+  }
+}
+async function readSecretString(ctx, secretId) {
+  return aws(ctx, [
+    "secretsmanager",
+    "get-secret-value",
+    "--secret-id",
+    secretId,
+    "--query",
+    "SecretString",
+    "--output",
+    "text"
+  ]);
+}
+async function readSecretJson(ctx, secretId) {
+  return JSON.parse(await readSecretString(ctx, secretId));
+}
+async function putSecretString(ctx, secretId, value) {
+  await throughSecretFile(value, (file) => awsMutate(ctx, [
+    "secretsmanager",
+    "put-secret-value",
+    "--secret-id",
+    secretId,
+    "--secret-string",
+    `file://${file}`
+  ]));
+}
+async function createSecretString(ctx, secretId, value, description) {
+  await throughSecretFile(value, (file) => awsMutate(ctx, [
+    "secretsmanager",
+    "create-secret",
+    "--name",
+    secretId,
+    "--description",
+    description,
+    "--secret-string",
+    `file://${file}`
+  ]));
+}
+async function throughSecretFile(value, body) {
+  const dir = mkdtempSync(join(tmpdir(), "foundation-secret-"));
+  const file = join(dir, "value.json");
+  try {
+    writeFileSync(file, value, { mode: 384 });
+    await body(file);
+  } finally {
+    rmSync(dir, { recursive: true, force: true });
+  }
+}
+async function putSecretJson(ctx, secretId, value) {
+  await putSecretString(ctx, secretId, JSON.stringify(value));
+}
+async function callerAccountId(ctx) {
+  return aws(ctx, ["sts", "get-caller-identity", "--query", "Account", "--output", "text"]);
+}
+
+// src/deploy/config-sync.ts
+import { existsSync as existsSync3, mkdirSync as mkdirSync2, mkdtempSync as mkdtempSync2, readdirSync } from "node:fs";
+import { tmpdir as tmpdir2 } from "node:os";
+import { join as join3, resolve as resolve3 } from "node:path";
+
+// src/deploy/paths.ts
+import { existsSync, readFileSync } from "node:fs";
+import { dirname as dirname2, resolve } from "node:path";
+import { fileURLToPath } from "node:url";
+var PACKAGE_NAME = "@deployfoundation/foundation-deploy";
+function packageRoot(from) {
+  let dir = from;
+  for (;; ) {
+    const manifest = resolve(dir, "package.json");
+    if (existsSync(manifest)) {
+      try {
+        const { name } = JSON.parse(readFileSync(manifest, "utf8"));
+        if (name === PACKAGE_NAME)
+          return dir;
+      } catch {}
+    }
+    const parent = dirname2(dir);
+    if (parent === dir)
+      throw new Error(`cannot find the ${PACKAGE_NAME} package root above ${from}`);
+    dir = parent;
+  }
+}
+var INFRA_ROOT = packageRoot(dirname2(fileURLToPath(import.meta.url)));
+var FOUNDATION_ROOT = resolve(INFRA_ROOT, "..", "..");
+var AGENT_DOCKERFILE = "packages/infra/agent-image/Dockerfile";
+var PACKAGE_ASSETS = resolve(INFRA_ROOT, "src", "deploy", "assets");
+
+// src/deploy/release.ts
+import { existsSync as existsSync2, mkdirSync, readFileSync as readFileSync2 } from "node:fs";
+import { dirname as dirname3, isAbsolute, join as join2, resolve as resolve2 } from "node:path";
+
+// src/release/kms.ts
+import { KMSClient, SignCommand, VerifyCommand } from "@aws-sdk/client-kms";
+function regionOfKeyArn(keyArn) {
+  const region = keyArn.split(":")[3];
+  if (region === undefined || region === "")
+    throw new Error(`not a KMS key ARN: ${keyArn} (expected arn:aws:kms:<region>:<account>:key/…)`);
+  return region;
+}
+function client(keyArn, options = {}) {
+  const profile = options.profile ?? "";
+  return new KMSClient({
+    region: regionOfKeyArn(keyArn),
+    ...profile === "" ? {} : { profile }
+  });
+}
+function kmsVerifier(keyArn, options = {}) {
+  const kms = client(keyArn, options);
+  return {
+    async verify(input) {
+      const result = await kms.send(new VerifyCommand(input));
+      return {
+        ...result.SignatureValid === undefined ? {} : { SignatureValid: result.SignatureValid }
+      };
+    }
+  };
+}
+
+// src/deploy/release.ts
+function flag(args, name) {
+  const index = args.indexOf(name);
+  const value = index === -1 ? undefined : args[index + 1];
+  if (value?.startsWith("-") === true)
+    throw new Error(`${name} needs a value, e.g. ${name} ${name === "--release" ? "v0.1.0" : "…"}`);
+  const inline = args.find((arg) => arg.startsWith(`${name}=`));
+  return value ?? (inline === undefined ? undefined : inline.slice(name.length + 1));
+}
+function toolVersion(infraRoot = INFRA_ROOT) {
+  const { version } = JSON.parse(readFileSync2(join2(infraRoot, "package.json"), "utf8"));
+  return version;
+}
+function foundationVersion(release) {
+  return release?.version ?? `v${toolVersion()}`;
+}
+function hasFoundationWorkspace(foundationRoot = FOUNDATION_ROOT) {
+  return existsSync2(join2(foundationRoot, "packages", "gateway", "package.json"));
+}
+function releaseRequest(args, options = {}) {
+  const env = options.env ?? process.env;
+  const bucket = flag(args, "--release-bucket") ?? env[RELEASE_BUCKET_ENV] ?? DEFAULT_RELEASE_BUCKET;
+  const manifestRef = flag(args, "--manifest");
+  const explicit = flag(args, "--release");
+  if (explicit !== undefined) {
+    if (!RELEASE_VERSION_RE.test(explicit))
+      throw new Error(`--release wants a version like v0.1.0, not "${explicit}"`);
+    return { version: explicit, bucket, ...manifestRef === undefined ? {} : { manifestRef } };
+  }
+  if (manifestRef !== undefined)
+    return { manifestRef, bucket };
+  const workspace = options.workspace ?? hasFoundationWorkspace();
+  if (workspace)
+    return;
+  const version = `v${options.version ?? toolVersion()}`;
+  if (!RELEASE_VERSION_RE.test(version))
+    throw new Error(`this copy of foundation-deploy is version ${version.slice(1)}, which is not a release; pass --release <version>`);
+  return { version, bucket };
+}
+async function s3Download(ctx, bucket, key, dest) {
+  mkdirSync(dirname3(dest), { recursive: true });
+  await aws(ctx, ["s3", "cp", `s3://${bucket}/${key}`, dest]);
+}
+async function verifyRelease(ctx, request, deps = {}) {
+  const env = deps.env ?? process.env;
+  const kmsKeyArn = deps.kmsKeyArn ?? expectedKeyArn(env);
+  const download = deps.download ?? s3Download;
+  const local = localManifestRef(request);
+  const version = request.version;
+  const cacheDir = deps.cacheDir ?? releaseCacheDir(version ?? "unversioned", env);
+  const manifestPath = local ?? join2(cacheDir, "manifest.json");
+  if (local === undefined) {
+    const source = s3ManifestRef(request);
+    await download(ctx, source.bucket, source.key, manifestPath);
+  }
+  const manifest = await verifyManifest(JSON.parse(readFileSync2(manifestPath, "utf8")), {
+    kmsKeyArn,
+    kms: deps.kms ?? kmsVerifier(kmsKeyArn, ctx.profile === "" ? {} : { profile: ctx.profile }),
+    ...version === undefined ? {} : { expectVersion: version },
+    ...deps.verifyArtifacts === false ? {} : {
+      readArtifact: async (key) => {
+        const dest = join2(cacheDir, "artifacts", key.split("/").slice(-1)[0] ?? "artifact");
+        await download(ctx, request.bucket, key, dest);
+        return readFileSync2(dest);
+      }
+    }
+  });
+  return { version: manifest.version, bucket: request.bucket, manifestPath, manifest };
+}
+async function resolveRelease(ctx, request, deps = {}) {
+  return ctx.dryRun === true ? plannedRelease(request) : verifyRelease(ctx, request, deps);
+}
+function plannedRelease(request) {
+  const version = request.version ?? "<from the manifest>";
+  const local = localManifestRef(request);
+  return {
+    version,
+    bucket: request.bucket,
+    manifestPath: local ?? join2(releaseCacheDir(version), "manifest.json")
+  };
+}
+function localManifestRef(request) {
+  const ref = request.manifestRef;
+  if (ref === undefined || ref.startsWith("s3://"))
+    return;
+  return isAbsolute(ref) ? ref : resolve2(process.cwd(), ref);
+}
+function s3ManifestRef(request) {
+  const ref = request.manifestRef;
+  if (ref?.startsWith("s3://") === true) {
+    const [bucket, ...rest] = ref.slice("s3://".length).split("/");
+    const key = rest.join("/");
+    if (bucket === undefined || bucket === "" || key === "")
+      throw new Error(`--manifest ${ref} is not an s3://bucket/key URI`);
+    return { bucket, key };
+  }
+  if (request.version === undefined)
+    throw new Error("a release needs a version or a manifest to fetch");
+  return { bucket: request.bucket, key: manifestKey(request.version) };
+}
+function releaseContext(release) {
+  return [
+    "-c",
+    `release=${release.version}`,
+    "-c",
+    `releaseManifest=${release.manifestPath}`,
+    "-c",
+    `releaseBucket=${release.bucket}`
+  ];
+}
+
+// src/deploy/config-sync.ts
 function productSkillsDir(foundationRoot = FOUNDATION_ROOT) {
-  const dir = resolve(foundationRoot, "skills");
-  if (!existsSync(dir))
+  const dir = resolve3(foundationRoot, "skills");
+  if (!existsSync3(dir))
     return;
   const entries = readdirSync(dir).filter((name) => name !== "README.md");
   return entries.length > 0 ? dir : undefined;
@@ -113,26 +516,26 @@ async function configSync(ctx, opts = {}) {
 }
 async function unpackReleaseSkills(ctx, release) {
   const key = release.manifest?.skills.key ?? skillsKey(release.version);
-  const dir = mkdtempSync(join(tmpdir(), "foundation-skills-"));
-  const tarball = join(dir, "skills.tar.gz");
+  const dir = mkdtempSync2(join3(tmpdir2(), "foundation-skills-"));
+  const tarball = join3(dir, "skills.tar.gz");
   await awsMutate(ctx, ["s3", "cp", `s3://${release.bucket}/${key}`, tarball]);
   return await extractSkillsTarball(tarball, dir, { dryRun: ctx.dryRun });
 }
 async function extractSkillsTarball(tarball, dir, opts = {}) {
-  const contents = join(dir, "skills");
+  const contents = join3(dir, "skills");
   await run(["tar", "-xzf", tarball, "-C", dir], { dryRun: opts.dryRun });
-  if (opts.dryRun !== true && !existsSync(contents))
+  if (opts.dryRun !== true && !existsSync3(contents))
     throw new Error(`${tarball} has no top-level skills/ directory`);
   if (opts.dryRun === true)
-    mkdirSync(contents, { recursive: true });
+    mkdirSync2(contents, { recursive: true });
   return contents;
 }
 
 // src/deploy/deploy.ts
 import { createHash } from "node:crypto";
-import { existsSync as existsSync2 } from "node:fs";
+import { existsSync as existsSync4 } from "node:fs";
 import { createRequire } from "node:module";
-import { join as join3 } from "node:path";
+import { join as join5 } from "node:path";
 
 // ../connectors/src/github.ts
 var GITHUB_TOKEN_RESPONSE_MAX_BYTES = 128 * 1024;
@@ -505,7 +908,7 @@ var UPWORK_GRAPHQL_DOCUMENTS = Object.freeze({
 var ETRADE_RESPONSE_MAX_BYTES = 1024 * 1024;
 var MAX_SECRET_JSON_LENGTH = 16 * 1024;
 // src/deploy/config.ts
-import { readFileSync } from "node:fs";
+import { readFileSync as readFileSync3 } from "node:fs";
 import { parse } from "yaml";
 function adminsCsv(yamlText, source = "runtime config") {
   const doc = parse(yamlText);
@@ -519,18 +922,18 @@ function adminsCsv(yamlText, source = "runtime config") {
   }).join(",");
 }
 function adminsCsvFromFile(path) {
-  return adminsCsv(readFileSync(path, "utf8"), path);
+  return adminsCsv(readFileSync3(path, "utf8"), path);
 }
 
 // src/deploy/endpoint.ts
 import { mkdtemp, readFile, rm } from "node:fs/promises";
-import { tmpdir as tmpdir2 } from "node:os";
-import { join as join2 } from "node:path";
+import { tmpdir as tmpdir3 } from "node:os";
+import { join as join4 } from "node:path";
 function cliRunner(ctx) {
   return {
     capture: (args) => aws(ctx, args),
     mutate: (args) => awsMutate(ctx, args),
-    sleep: (ms) => new Promise((resolve2) => setTimeout(resolve2, ms))
+    sleep: (ms) => new Promise((resolve4) => setTimeout(resolve4, ms))
   };
 }
 function runtimeIdFromArn(arn) {
@@ -658,8 +1061,8 @@ async function smokeInvoke(runner, opts) {
     await runner.mutate([...args, "/dev/stdout"]);
     return;
   }
-  const dir = await mkdtemp(join2(tmpdir2(), "foundation-smoke-"));
-  const outFile = join2(dir, "response.json");
+  const dir = await mkdtemp(join4(tmpdir3(), "foundation-smoke-"));
+  const outFile = join4(dir, "response.json");
   let out;
   try {
     const printed = await runner.capture([...args, outFile]);
@@ -996,14 +1399,14 @@ function composeRuntimeSecret(inputs) {
 // src/deploy/stage-customization.ts
 import {
   lstatSync,
-  mkdirSync as mkdirSync2,
-  readFileSync as readFileSync2,
+  mkdirSync as mkdirSync3,
+  readFileSync as readFileSync4,
   realpathSync,
-  rmSync,
+  rmSync as rmSync2,
   statSync,
-  writeFileSync
+  writeFileSync as writeFileSync2
 } from "node:fs";
-import { dirname, isAbsolute, posix, relative, resolve as resolve2, sep } from "node:path";
+import { dirname as dirname4, isAbsolute as isAbsolute2, posix, relative, resolve as resolve4, sep } from "node:path";
 import { isDeepStrictEqual } from "node:util";
 function sourceRootFor(sourceDir) {
   if (sourceDir === undefined || sourceDir === "")
@@ -1029,11 +1432,11 @@ function assertCustomizationPath(path, label = "Customization path") {
 }
 function isWithin(root, candidate) {
   const pathFromRoot = relative(root, candidate);
-  return pathFromRoot !== "" && pathFromRoot !== ".." && !pathFromRoot.startsWith(`..${sep}`) && !isAbsolute(pathFromRoot);
+  return pathFromRoot !== "" && pathFromRoot !== ".." && !pathFromRoot.startsWith(`..${sep}`) && !isAbsolute2(pathFromRoot);
 }
 function customizationFile(sourceRoot, configuredPath) {
   assertCustomizationPath(configuredPath);
-  const candidate = resolve2(sourceRoot, ...configuredPath.split("/"));
+  const candidate = resolve4(sourceRoot, ...configuredPath.split("/"));
   if (!isWithin(sourceRoot, candidate))
     throw new Error("Customization path escapes its source directory.");
   return candidate;
@@ -1043,7 +1446,7 @@ function resolvedCustomizationFile(sourceRoot, configuredPath) {
   const parts = configuredPath.split("/");
   let current = sourceRoot;
   for (const [index, part] of parts.entries()) {
-    const entry = resolve2(current, part);
+    const entry = resolve4(current, part);
     let entryStats;
     try {
       entryStats = lstatSync(entry);
@@ -1065,7 +1468,7 @@ function resolvedCustomizationFile(sourceRoot, configuredPath) {
   return current;
 }
 function stagedCustomizationPath(paths) {
-  return resolve2(paths.root, STAGING_DIRECTORY, `${paths.instance.name}.yaml`);
+  return resolve4(paths.root, STAGING_DIRECTORY, `${paths.instance.name}.yaml`);
 }
 var STAGING_DIRECTORY = ".foundation-staging";
 function assertUnchanged(path, platform, tenant) {
@@ -1107,7 +1510,7 @@ function stageCustomization(options) {
   const platformConfigPath = options.paths.configPath;
   const stagedPath = stagedCustomizationPath(options.paths);
   if (options.dryRun !== true)
-    rmSync(stagedPath, { force: true });
+    rmSync2(stagedPath, { force: true });
   const customization = instance.customization;
   if (customization === undefined)
     return { status: "not-configured", runtimeConfigPath: platformConfigPath };
@@ -1117,16 +1520,16 @@ function stageCustomization(options) {
   const sourceFile = resolvedCustomizationFile(sourceRoot, customization.path);
   if (sourceFile === undefined)
     return migrationFallback(customization.required, log, platformConfigPath);
-  const yaml = readFileSync2(sourceFile);
+  const yaml = readFileSync4(sourceFile);
   const tenantConfig = parseInstanceConfig(yaml.toString("utf8"));
-  const platformConfig = parseInstanceConfig(readFileSync2(platformConfigPath, "utf8"));
+  const platformConfig = parseInstanceConfig(readFileSync4(platformConfigPath, "utf8"));
   if (tenantConfig.name !== instance.displayName)
     throw new Error("Customization config name must match the selected instance.");
   assertValidTenantJobs(tenantConfig);
   assertProtectedPolicy(platformConfig, tenantConfig);
   if (options.dryRun !== true) {
-    mkdirSync2(dirname(stagedPath), { recursive: true });
-    writeFileSync(stagedPath, yaml);
+    mkdirSync3(dirname4(stagedPath), { recursive: true });
+    writeFileSync2(stagedPath, yaml);
   }
   return {
     status: "staged",
@@ -1203,10 +1606,10 @@ function cdkCommand() {
   }
 }
 function cdkAppCommand(infraRoot = INFRA_ROOT) {
-  const source = join3(infraRoot, "bin", "app.ts");
-  if (existsSync2(source))
+  const source = join5(infraRoot, "bin", "app.ts");
+  if (existsSync4(source))
     return `bun run ${source}`;
-  return `${process.execPath} ${join3(infraRoot, "dist", "bin", "app.js")}`;
+  return `${process.execPath} ${join5(infraRoot, "dist", "bin", "app.js")}`;
 }
 async function cdkDeploy(ctx, opts) {
   const context = [
@@ -1285,13 +1688,13 @@ async function syncKnockOAuthClient(ctx, options = {}) {
     if (existing.redirect_uri === redirectUri)
       return "unchanged";
   } catch {}
-  const client = await registerKnockPublicClient({
+  const client2 = await registerKnockPublicClient({
     redirectUri,
     ...options.fetchImpl === undefined ? {} : { fetchImpl: options.fetchImpl }
   });
   await putSecretJson(ctx, ctx.names.secretKnockOauthClient, {
-    client_id: client.client_id,
-    redirect_uri: client.redirect_uri
+    client_id: client2.client_id,
+    redirect_uri: client2.redirect_uri
   });
   return "registered";
 }
@@ -1476,10 +1879,10 @@ async function deploy(ctx, opts) {
 import { createServer } from "node:http";
 
 // src/deploy/github-app-manifest.ts
-import { readFileSync as readFileSync3 } from "node:fs";
-import { join as join4 } from "node:path";
+import { readFileSync as readFileSync5 } from "node:fs";
+import { join as join6 } from "node:path";
 import { parse as parseYaml } from "yaml";
-var GITHUB_APP_MANIFEST_PATH = join4(PACKAGE_ASSETS, "github-app-manifest.yml");
+var GITHUB_APP_MANIFEST_PATH = join6(PACKAGE_ASSETS, "github-app-manifest.yml");
 function manifestUrl(instance) {
   const repo = instance.github.defaultRepo ?? instanceNames(instance).defaultRepo;
   return `https://github.com/${repo === "" ? instance.github.org : repo}`;
@@ -1497,7 +1900,7 @@ function renderAppManifest(template, instance) {
   });
 }
 function loadAppManifest(instance, template) {
-  const text = template ?? readFileSync3(GITHUB_APP_MANIFEST_PATH, "utf8");
+  const text = template ?? readFileSync5(GITHUB_APP_MANIFEST_PATH, "utf8");
   const manifest = parseYaml(renderAppManifest(text, instance));
   if ("default_permissions" in manifest)
     throw new Error("app-manifest.yml: default_permissions are generated from the capability registry; remove them from the template");
@@ -1615,7 +2018,7 @@ async function githubAppCreate(options) {
 }
 
 // src/deploy/job-key.ts
-import { readFileSync as readFileSync4 } from "node:fs";
+import { readFileSync as readFileSync6 } from "node:fs";
 function jobWebhookOutputKey(jobId) {
   return `JobWebhookUrl${jobId.replace(/[^A-Za-z0-9]/g, "")}`;
 }
@@ -1623,7 +2026,7 @@ function jobsWebhookSecretName(secretPrefix) {
   return `${secretPrefix}/jobs/webhook`;
 }
 async function jobKey(ctx, jobId, options = {}) {
-  const config = parseInstanceConfig(readFileSync4(ctx.paths.configPath, "utf8"));
+  const config = parseInstanceConfig(readFileSync6(ctx.paths.configPath, "utf8"));
   const job = config.jobs.find((entry) => entry.id === jobId);
   if (job === undefined)
     throw new Error(`no job "${jobId}" in ${ctx.paths.configPath}`);
@@ -1689,14 +2092,14 @@ async function postDeploy(ctx, opts = {}) {
 }
 
 // src/deploy/setup.ts
-import { existsSync as existsSync3, readFileSync as readFileSync6 } from "node:fs";
-import { resolve as resolve3 } from "node:path";
+import { existsSync as existsSync5, readFileSync as readFileSync8 } from "node:fs";
+import { resolve as resolve5 } from "node:path";
 
 // src/deploy/slack-manifest.ts
-import { readFileSync as readFileSync5 } from "node:fs";
-import { join as join5 } from "node:path";
+import { readFileSync as readFileSync7 } from "node:fs";
+import { join as join7 } from "node:path";
 import { parse as parse2 } from "yaml";
-var SLACK_APP_MANIFEST_PATH = join5(PACKAGE_ASSETS, "slack-app-manifest.yml");
+var SLACK_APP_MANIFEST_PATH = join7(PACKAGE_ASSETS, "slack-app-manifest.yml");
 function buildSlackManifest(template, instance, env) {
   const events = env.EVENTS_REQUEST_URL;
   const commands = env.COMMANDS_REQUEST_URL ?? events?.replace(/\/events$/, "/commands");
@@ -1732,7 +2135,7 @@ function buildSlackManifest(template, instance, env) {
   return manifest;
 }
 function slackManifestFor(instance, env) {
-  return buildSlackManifest(readFileSync5(SLACK_APP_MANIFEST_PATH, "utf8"), {
+  return buildSlackManifest(readFileSync7(SLACK_APP_MANIFEST_PATH, "utf8"), {
     displayName: instance.displayName,
     commandPrefix: slackCommandPrefix(instance),
     pages: instance.integrations.pages
@@ -1883,7 +2286,7 @@ async function ensureTransactionSearch(runner, options = {}) {
 
 // src/deploy/setup.ts
 function defaultCodexFile(instanceRoot) {
-  return resolve3(instanceRoot, ".foundation-local", "codex.json");
+  return resolve5(instanceRoot, ".foundation-local", "codex.json");
 }
 function step(n, title) {
   console.log(`
@@ -1956,9 +2359,9 @@ async function writeRuntimeSecret(ctx) {
   console.log(`  keys: ${(await syncRuntimeSecret(ctx)).join(", ")}`);
 }
 async function seedCodex(ctx, codexFile) {
-  if (!existsSync3(codexFile))
+  if (!existsSync5(codexFile))
     throw new Error(`${codexFile} not found — sign in locally first, or pass --codex-file`);
-  const document = readFileSync6(codexFile, "utf8");
+  const document = readFileSync8(codexFile, "utf8");
   JSON.parse(document);
   await putSecretString(ctx, ctx.names.secretCodex, document);
   console.log(`  ${ctx.names.secretCodex} seeded from ${codexFile}`);
@@ -2197,7 +2600,7 @@ github-app-create options
   --org <org>          GitHub org (default: the instance's github.org)
   --port <n>           local callback port (default 8765)
   --secret <id>        Secrets Manager id (default: the instance's github/app)`;
-function flag(args, name) {
+function flag2(args, name) {
   const index = args.indexOf(name);
   return index === -1 ? undefined : args[index + 1];
 }
@@ -2205,8 +2608,8 @@ function contextFor(args) {
   const paths = loadInstanceContext(resolveInstanceFilePath(args, process.env));
   return awsContext({
     paths,
-    profile: flag(args, "--profile"),
-    region: flag(args, "--region"),
+    profile: flag2(args, "--profile"),
+    region: flag2(args, "--region"),
     dryRun: args.includes("--dry-run")
   });
 }
@@ -2255,7 +2658,7 @@ ${USAGE}`);
       return 1;
     }
     console.error(instanceBanner(ctx2.paths));
-    const putSecret = flag(args, "--put-secret");
+    const putSecret = flag2(args, "--put-secret");
     const result = await jobKey(ctx2, jobId, putSecret === undefined ? {} : { putSecret });
     console.log(JSON.stringify(result));
     return 0;
@@ -2263,14 +2666,14 @@ ${USAGE}`);
   if (command === "github-app-create") {
     const paths = loadInstanceContext(resolveInstanceFilePath(args, process.env));
     console.log(instanceBanner(paths));
-    const port = flag(args, "--port");
+    const port = flag2(args, "--port");
     await githubAppCreate({
       paths,
-      ...flag(args, "--org") === undefined ? {} : { org: flag(args, "--org") },
+      ...flag2(args, "--org") === undefined ? {} : { org: flag2(args, "--org") },
       ...port === undefined ? {} : { port: Number(port) },
-      ...flag(args, "--secret") === undefined ? {} : { secret: flag(args, "--secret") },
-      ...flag(args, "--profile") === undefined ? {} : { profile: flag(args, "--profile") },
-      ...flag(args, "--region") === undefined ? {} : { region: flag(args, "--region") },
+      ...flag2(args, "--secret") === undefined ? {} : { secret: flag2(args, "--secret") },
+      ...flag2(args, "--profile") === undefined ? {} : { profile: flag2(args, "--profile") },
+      ...flag2(args, "--region") === undefined ? {} : { region: flag2(args, "--region") },
       dryRun: args.includes("--dry-run")
     });
     return 0;
@@ -2281,8 +2684,8 @@ ${USAGE}`);
     console.log("dry run — no changes will be made");
   switch (command) {
     case "deploy": {
-      const tag = flag(args, "--tag");
-      const alarmEmail = flag(args, "--alarm-email");
+      const tag = flag2(args, "--tag");
+      const alarmEmail = flag2(args, "--alarm-email");
       const release = releaseRequest(args);
       await deploy(ctx, {
         ...tag === undefined ? {} : { tag },
@@ -2298,7 +2701,7 @@ ${USAGE}`);
       return 0;
     case "config:sync": {
       const customization = stageCustomization({ paths: ctx.paths, dryRun: ctx.dryRun });
-      const bucket = flag(args, "--bucket");
+      const bucket = flag2(args, "--bucket");
       const request = releaseRequest(args);
       const release = request === undefined ? undefined : await resolveRelease(ctx, request);
       const synced = await configSync(ctx, {
@@ -2310,8 +2713,8 @@ ${USAGE}`);
       return 0;
     }
     case "setup": {
-      const codexFile = flag(args, "--codex-file");
-      const alarmEmail = flag(args, "--alarm-email");
+      const codexFile = flag2(args, "--codex-file");
+      const alarmEmail = flag2(args, "--alarm-email");
       await setup(ctx, {
         seedCodex: args.includes("--seed-codex"),
         ...codexFile === undefined ? {} : { codexFile },