@deployfoundation/foundation-deploy 0.2.51 → 0.2.53

package/README.md

@@ -54,9 +54,12 @@ bun run packages/infra/bin/foundation-deploy.ts <command> --instance <path>
 | `github-app-create` | Create the instance's GitHub App from the shipped manifest template. |
 | `slack-manifest` | Print the instance's Slack app manifest as JSON (the Slack CLI's `get-manifest` hook contract). |
 | `stage-customization` | Validate and stage a tenant-owned runtime config. |
+| `crm-key` | Write the company CRM's `crm/1` key, piped in with `--stdin`, into `<secretPrefix>/crm/http` (`crm.provider` kind `http`). |
+| `crm-check` | Run the `crm/1` conformance suite: the read cases against the instance's CRM with its stored key, or, with `--base-url --tenant --key-stdin` and no instance, any server, write cases included. |
+| `crm-replay` | Replay the agent's CRM writes (JSONL) into the instance's own table after a rollback to the DynamoDB provider. |
 
 `--instance <path>` is required for every command (or `FOUNDATION_INSTANCE_FILE`
-in a pipeline). There is no instance *name*, no `instances/` directory and no
+in a pipeline), except `crm-check --base-url`, which checks a server rather than a deployment. There is no instance *name*, no `instances/` directory and no
 default: a deploy that guessed its target would be a deploy into the wrong
 account.
 

package/dist/bin/app.js

@@ -8,14 +8,17 @@ import {
   FoundationPages,
   FoundationPipeline,
   NewsletterStack
-} from "../chunk-efqdhd2e.js";
+} from "../chunk-spq5kr1t.js";
+import"../chunk-pxhftba1.js";
+import"../chunk-dz91avrb.js";
 import {
   adminsFor,
   instanceNames,
   loadInstanceFile,
   provisionsIntegration
-} from "../chunk-gnz747z2.js";
-import"../chunk-dz91avrb.js";
+} from "../chunk-fjdgxw8h.js";
+import"../chunk-96fjaysn.js";
+import"../chunk-5wgwscd0.js";
 
 // bin/app.ts
 import * as cdk from "aws-cdk-lib";

package/dist/bin/foundation-deploy.js

@@ -1,297 +1,74 @@
 #!/usr/bin/env node
 // @bun
 import {
-  BASE_SLACK_EVENTS,
-  CAPABILITY_IDS,
-  CUSTOMIZATION_ARTIFACT_NAME,
   RELEASE_BUCKET_ENV,
   RELEASE_VERSION_RE,
+  manifestKey,
+  releaseCacheDir,
+  skillsKey,
+  verifyManifest
+} from "../chunk-pxhftba1.js";
+import {
+  DEFAULT_RELEASE_BUCKET,
+  expectedKeyArn
+} from "../chunk-dz91avrb.js";
+import {
+  argv,
+  aws,
+  awsContext,
+  awsMutate,
+  callerAccountId,
+  cdkEnv,
+  createSecretString,
+  instanceBanner,
+  loadInstanceContext,
+  putSecretJson,
+  putSecretString,
+  readSecretJson,
+  readSecretString,
+  resolveInstanceFilePath,
+  run,
+  runCapture,
+  secretExists,
+  stackExists,
+  stackOutput
+} from "../chunk-nvsj7bbw.js";
+import {
+  CUSTOMIZATION_ARTIFACT_NAME,
   instanceNames,
+  mongoCollectionPolicyEnv,
+  slackCommandPrefix,
+  versionedConfigKey
+} from "../chunk-fjdgxw8h.js";
+import"../chunk-m76jt5rc.js";
+import"../chunk-3614v9rr.js";
+import {
+  BASE_SLACK_EVENTS,
+  CAPABILITY_IDS,
   isScheduledJob,
   isWebhookJob,
   jobWebhookKey,
-  loadInstanceFile,
-  manifestKey,
   parseInstanceConfig,
   parseSchedule,
-  releaseCacheDir,
   requiredGithubPermissions,
   requiredSlackCommands,
-  requiredSlackScopes,
-  skillsKey,
-  slackCommandPrefix,
-  verifyManifest,
-  versionedConfigKey
-} from "../chunk-gnz747z2.js";
+  requiredSlackScopes
+} from "../chunk-96fjaysn.js";
 import {
-  DEFAULT_RELEASE_BUCKET,
-  expectedKeyArn
-} from "../chunk-dz91avrb.js";
+  __require
+} from "../chunk-5wgwscd0.js";
 
 // src/deploy/cli.ts
 import { readFileSync as readFileSync10 } from "node:fs";
 
-// src/deploy/aws.ts
-import { mkdtempSync, rmSync, writeFileSync } from "node:fs";
-import { tmpdir } from "node:os";
-import { join } from "node:path";
-
-// src/deploy/instance.ts
-import { dirname } from "node:path";
-var INSTANCE_FILE_ENV = "FOUNDATION_INSTANCE_FILE";
-function resolveInstanceFilePath(argv = [], env = {}) {
-  for (let i = 0;i < argv.length; i++) {
-    const arg = argv[i] ?? "";
-    if (arg === "--instance") {
-      const next = argv[i + 1];
-      if (next === undefined || next.startsWith("-"))
-        throw new Error("--instance needs a path, e.g. --instance .foundation/instance.yaml");
-      return next;
-    }
-    if (arg.startsWith("--instance=")) {
-      const value = arg.slice("--instance=".length);
-      if (value === "")
-        throw new Error("--instance needs a path");
-      return value;
-    }
-  }
-  const fromEnv = env[INSTANCE_FILE_ENV];
-  if (fromEnv !== undefined && fromEnv !== "")
-    return fromEnv;
-  throw new Error(`--instance <path> is required (or set ${INSTANCE_FILE_ENV}); it is the path to the deployment's instance YAML`);
-}
-function loadInstanceContext(path, cwd = process.cwd()) {
-  const file = loadInstanceFile(path, cwd);
-  return { ...file, root: dirname(file.path) };
-}
-function loadInstanceFromArgs(argv = process.argv.slice(2), env = process.env) {
-  return loadInstanceContext(resolveInstanceFilePath(argv, env));
-}
-function instanceBanner(context) {
-  const { instance } = context;
-  return `instance: ${instance.name} (account ${instance.aws.account}, region ${instance.aws.region})
-  file: ${context.path}
-  config: ${context.configPath}`;
-}
-
-// src/deploy/sh.ts
-import { spawn as nodeSpawn } from "node:child_process";
-function formatCommand(cmd, env) {
-  const prefix = Object.entries(env ?? {}).map(([k, v]) => `${k}=${quote(v)}`).join(" ");
-  const body = cmd.map(quote).join(" ");
-  return prefix === "" ? body : `${prefix} ${body}`;
-}
-function quote(value) {
-  return /^[A-Za-z0-9_@%+=:,./-]+$/.test(value) ? value : `'${value.replaceAll("'", `'\\''`)}'`;
-}
-function start(cmd, opts, stdout) {
-  const [bin, ...rest] = cmd;
-  if (bin === undefined)
-    throw new Error("run: empty command");
-  const child = nodeSpawn(bin, rest, {
-    cwd: opts.cwd,
-    env: { ...process.env, ...opts.env },
-    stdio: [
-      opts.stdin === undefined ? "ignore" : "pipe",
-      stdout,
-      stdout === "inherit" ? "inherit" : "pipe"
-    ]
-  });
-  if (opts.stdin !== undefined && child.stdin !== null) {
-    child.stdin.end(opts.stdin);
-  }
-  return child;
-}
-function exited(child) {
-  return new Promise((resolve, reject) => {
-    child.once("error", reject);
-    child.once("close", (code, signal) => resolve(code ?? (signal === null ? 1 : 128)));
-  });
-}
-function collect(stream) {
-  if (stream === null)
-    return Promise.resolve("");
-  return new Promise((resolve, reject) => {
-    const chunks = [];
-    stream.on("data", (c) => chunks.push(c));
-    stream.once("error", reject);
-    stream.once("end", () => resolve(Buffer.concat(chunks).toString("utf8")));
-  });
-}
-async function run(cmd, opts = {}) {
-  if (opts.dryRun === true) {
-    console.log(`  $ ${formatCommand(cmd, opts.env)}`);
-    return;
-  }
-  const code = await exited(start(cmd, opts, "inherit"));
-  if (code !== 0)
-    throw new Error(`${formatCommand(cmd)} exited ${code}`);
-}
-async function runCapture(cmd, opts = {}) {
-  const child = start(cmd, opts, "pipe");
-  const [out, err, code] = await Promise.all([
-    collect(child.stdout),
-    collect(child.stderr),
-    exited(child)
-  ]);
-  if (code !== 0)
-    throw new Error(`${formatCommand(cmd)} exited ${code}: ${err.trim()}`);
-  return out.trim();
-}
-
-// src/deploy/aws.ts
-function resolveProfile(fallback, explicit, env = process.env) {
-  if (env.FOUNDATION_NO_PROFILE === "1")
-    return "";
-  if (explicit !== undefined)
-    return explicit;
-  if (env.AWS_PROFILE !== undefined && env.AWS_PROFILE !== "")
-    return env.AWS_PROFILE;
-  if (env.GITHUB_ACTIONS === "true")
-    return "";
-  return fallback;
-}
-function awsContext(overrides = {}) {
-  const env = overrides.env ?? process.env;
-  const paths = overrides.paths ?? loadInstanceFromArgs();
-  const instance = paths.instance;
-  return {
-    profile: resolveProfile(instance.aws.profile, overrides.profile, env),
-    region: overrides.region ?? env.AWS_REGION ?? instance.aws.region,
-    dryRun: overrides.dryRun ?? false,
-    instance,
-    paths,
-    names: instanceNames(instance)
-  };
-}
-function argv(ctx, args) {
-  const profile = ctx.profile === "" ? [] : ["--profile", ctx.profile];
-  return ["aws", ...args, ...profile, "--region", ctx.region];
-}
-function cdkEnv(ctx) {
-  return {
-    ...ctx.profile === "" ? {} : { AWS_PROFILE: ctx.profile },
-    AWS_REGION: ctx.region,
-    CDK_DEFAULT_REGION: ctx.region
-  };
-}
-async function aws(ctx, args, stdin) {
-  return runCapture(argv(ctx, args), { stdin });
-}
-async function awsMutate(ctx, args, stdin) {
-  if (ctx.dryRun === true) {
-    console.log(`  $ ${argv(ctx, args).join(" ")}${stdin === undefined ? "" : " < (stdin)"}`);
-    return;
-  }
-  await run(argv(ctx, args), { stdin });
-}
-async function stackOutput(ctx, stack, key) {
-  const value = await aws(ctx, [
-    "cloudformation",
-    "describe-stacks",
-    "--stack-name",
-    stack,
-    "--query",
-    `Stacks[0].Outputs[?OutputKey=='${key}'].OutputValue`,
-    "--output",
-    "text"
-  ]);
-  if (value === "" || value === "None")
-    throw new Error(`stack ${stack} has no output ${key} — has it been deployed?`);
-  return value;
-}
-async function stackExists(ctx, stack) {
-  try {
-    await aws(ctx, [
-      "cloudformation",
-      "describe-stacks",
-      "--stack-name",
-      stack,
-      "--output",
-      "text"
-    ]);
-    return true;
-  } catch {
-    return false;
-  }
-}
-async function secretExists(ctx, secretId) {
-  try {
-    await aws(ctx, [
-      "secretsmanager",
-      "describe-secret",
-      "--secret-id",
-      secretId,
-      "--output",
-      "text"
-    ]);
-    return true;
-  } catch {
-    return false;
-  }
-}
-async function readSecretString(ctx, secretId) {
-  return aws(ctx, [
-    "secretsmanager",
-    "get-secret-value",
-    "--secret-id",
-    secretId,
-    "--query",
-    "SecretString",
-    "--output",
-    "text"
-  ]);
-}
-async function readSecretJson(ctx, secretId) {
-  return JSON.parse(await readSecretString(ctx, secretId));
-}
-async function putSecretString(ctx, secretId, value) {
-  await throughSecretFile(value, (file) => awsMutate(ctx, [
-    "secretsmanager",
-    "put-secret-value",
-    "--secret-id",
-    secretId,
-    "--secret-string",
-    `file://${file}`
-  ]));
-}
-async function createSecretString(ctx, secretId, value, description) {
-  await throughSecretFile(value, (file) => awsMutate(ctx, [
-    "secretsmanager",
-    "create-secret",
-    "--name",
-    secretId,
-    "--description",
-    description,
-    "--secret-string",
-    `file://${file}`
-  ]));
-}
-async function throughSecretFile(value, body) {
-  const dir = mkdtempSync(join(tmpdir(), "foundation-secret-"));
-  const file = join(dir, "value.json");
-  try {
-    writeFileSync(file, value, { mode: 384 });
-    await body(file);
-  } finally {
-    rmSync(dir, { recursive: true, force: true });
-  }
-}
-async function putSecretJson(ctx, secretId, value) {
-  await putSecretString(ctx, secretId, JSON.stringify(value));
-}
-async function callerAccountId(ctx) {
-  return aws(ctx, ["sts", "get-caller-identity", "--query", "Account", "--output", "text"]);
-}
-
 // src/deploy/config-sync.ts
-import { existsSync as existsSync3, mkdirSync as mkdirSync2, mkdtempSync as mkdtempSync2, readFileSync as readFileSync3, readdirSync } from "node:fs";
-import { tmpdir as tmpdir2 } from "node:os";
-import { join as join3, resolve as resolve3 } from "node:path";
+import { existsSync as existsSync3, mkdirSync as mkdirSync2, mkdtempSync, readFileSync as readFileSync3, readdirSync } from "node:fs";
+import { tmpdir } from "node:os";
+import { join as join2, resolve as resolve3 } from "node:path";
 
 // src/deploy/paths.ts
 import { existsSync, readFileSync } from "node:fs";
-import { dirname as dirname2, resolve } from "node:path";
+import { dirname, resolve } from "node:path";
 import { fileURLToPath } from "node:url";
 var PACKAGE_NAME = "@deployfoundation/foundation-deploy";
 function packageRoot(from) {
@@ -305,20 +82,20 @@ function packageRoot(from) {
           return dir;
       } catch {}
     }
-    const parent = dirname2(dir);
+    const parent = dirname(dir);
     if (parent === dir)
       throw new Error(`cannot find the ${PACKAGE_NAME} package root above ${from}`);
     dir = parent;
   }
 }
-var INFRA_ROOT = packageRoot(dirname2(fileURLToPath(import.meta.url)));
+var INFRA_ROOT = packageRoot(dirname(fileURLToPath(import.meta.url)));
 var FOUNDATION_ROOT = resolve(INFRA_ROOT, "..", "..");
 var AGENT_DOCKERFILE = "packages/infra/agent-image/Dockerfile";
 var PACKAGE_ASSETS = resolve(INFRA_ROOT, "src", "deploy", "assets");
 
 // src/deploy/release.ts
 import { existsSync as existsSync2, mkdirSync, readFileSync as readFileSync2 } from "node:fs";
-import { dirname as dirname3, isAbsolute, join as join2, resolve as resolve2 } from "node:path";
+import { dirname as dirname2, isAbsolute, join, resolve as resolve2 } from "node:path";
 
 // src/release/kms.ts
 import { KMSClient, SignCommand, VerifyCommand } from "@aws-sdk/client-kms";
@@ -357,14 +134,14 @@ function flag(args, name) {
   return value ?? (inline === undefined ? undefined : inline.slice(name.length + 1));
 }
 function toolVersion(infraRoot = INFRA_ROOT) {
-  const { version } = JSON.parse(readFileSync2(join2(infraRoot, "package.json"), "utf8"));
+  const { version } = JSON.parse(readFileSync2(join(infraRoot, "package.json"), "utf8"));
   return version;
 }
 function foundationVersion(release) {
   return release?.version ?? `v${toolVersion()}`;
 }
 function hasFoundationWorkspace(foundationRoot = FOUNDATION_ROOT) {
-  return existsSync2(join2(foundationRoot, "packages", "gateway", "package.json"));
+  return existsSync2(join(foundationRoot, "packages", "gateway", "package.json"));
 }
 function releaseRequest(args, options = {}) {
   const env = options.env ?? process.env;
@@ -387,7 +164,7 @@ function releaseRequest(args, options = {}) {
   return { version, bucket };
 }
 async function s3Download(ctx, bucket, key, dest) {
-  mkdirSync(dirname3(dest), { recursive: true });
+  mkdirSync(dirname2(dest), { recursive: true });
   await aws(ctx, ["s3", "cp", `s3://${bucket}/${key}`, dest]);
 }
 async function verifyRelease(ctx, request, deps = {}) {
@@ -397,7 +174,7 @@ async function verifyRelease(ctx, request, deps = {}) {
   const local = localManifestRef(request);
   const version = request.version;
   const cacheDir = deps.cacheDir ?? releaseCacheDir(version ?? "unversioned", env);
-  const manifestPath = local ?? join2(cacheDir, "manifest.json");
+  const manifestPath = local ?? join(cacheDir, "manifest.json");
   if (local === undefined) {
     const source = s3ManifestRef(request);
     await download(ctx, source.bucket, source.key, manifestPath);
@@ -408,7 +185,7 @@ async function verifyRelease(ctx, request, deps = {}) {
     ...version === undefined ? {} : { expectVersion: version },
     ...deps.verifyArtifacts === false ? {} : {
       readArtifact: async (key) => {
-        const dest = join2(cacheDir, "artifacts", key.split("/").slice(-1)[0] ?? "artifact");
+        const dest = join(cacheDir, "artifacts", key.split("/").slice(-1)[0] ?? "artifact");
         await download(ctx, request.bucket, key, dest);
         return readFileSync2(dest);
       }
@@ -425,7 +202,7 @@ function plannedRelease(request) {
   return {
     version,
     bucket: request.bucket,
-    manifestPath: local ?? join2(releaseCacheDir(version), "manifest.json")
+    manifestPath: local ?? join(releaseCacheDir(version), "manifest.json")
   };
 }
 function localManifestRef(request) {
@@ -524,13 +301,13 @@ async function configSync(ctx, opts = {}) {
 }
 async function unpackReleaseSkills(ctx, release) {
   const key = release.manifest?.skills.key ?? skillsKey(release.version);
-  const dir = mkdtempSync2(join3(tmpdir2(), "foundation-skills-"));
-  const tarball = join3(dir, "skills.tar.gz");
+  const dir = mkdtempSync(join2(tmpdir(), "foundation-skills-"));
+  const tarball = join2(dir, "skills.tar.gz");
   await awsMutate(ctx, ["s3", "cp", `s3://${release.bucket}/${key}`, tarball]);
   return await extractSkillsTarball(tarball, dir, { dryRun: ctx.dryRun });
 }
 async function extractSkillsTarball(tarball, dir, opts = {}) {
-  const contents = join3(dir, "skills");
+  const contents = join2(dir, "skills");
   await run(["tar", "-xzf", tarball, "-C", dir], { dryRun: opts.dryRun });
   if (opts.dryRun !== true && !existsSync3(contents))
     throw new Error(`${tarball} has no top-level skills/ directory`);
@@ -543,7 +320,7 @@ async function extractSkillsTarball(tarball, dir, opts = {}) {
 import { createHash } from "node:crypto";
 import { existsSync as existsSync4 } from "node:fs";
 import { createRequire } from "node:module";
-import { join as join5 } from "node:path";
+import { join as join4 } from "node:path";
 
 // ../connectors/src/github.ts
 var GITHUB_TOKEN_RESPONSE_MAX_BYTES = 128 * 1024;
@@ -773,9 +550,6 @@ function isSafeOpaqueString(value, max) {
 function isPlainObject(value) {
   return typeof value === "object" && value !== null && !Array.isArray(value);
 }
-// ../connectors/src/crm.ts
-var CRM_MAX_REQUEST_BYTES = 512 * 1024;
-var CRM_MAX_RESPONSE_BYTES = 512 * 1024;
 // ../connectors/src/upwork.ts
 var UPWORK_MAX_RESPONSE_BYTES = 1024 * 1024;
 var UPWORK_MAX_ACCESS_TOKEN_TTL_SECONDS = 24 * 60 * 60;
@@ -962,8 +736,8 @@ function adminsCsvFromFile(path) {
 
 // src/deploy/endpoint.ts
 import { mkdtemp, readFile, rm } from "node:fs/promises";
-import { tmpdir as tmpdir3 } from "node:os";
-import { join as join4 } from "node:path";
+import { tmpdir as tmpdir2 } from "node:os";
+import { join as join3 } from "node:path";
 function cliRunner(ctx) {
   return {
     capture: (args) => aws(ctx, args),
@@ -1111,8 +885,8 @@ async function smokeInvoke(runner, opts) {
     await runner.mutate([...args, "/dev/stdout"]);
     return;
   }
-  const dir = await mkdtemp(join4(tmpdir3(), "foundation-smoke-"));
-  const outFile = join4(dir, "response.json");
+  const dir = await mkdtemp(join3(tmpdir2(), "foundation-smoke-"));
+  const outFile = join3(dir, "response.json");
   let out;
   try {
     const printed = await runner.capture([...args, outFile]);
@@ -1443,6 +1217,7 @@ function composeRuntimeSecret(inputs) {
     ...inputs.etradeProxyFunctionArn !== undefined && inputs.etradeProxyFunctionArn !== "" ? { FOUNDATION_ETRADE_PROXY_ARN: inputs.etradeProxyFunctionArn } : {},
     ...inputs.routineIngressFunctionArn !== undefined && inputs.routineIngressFunctionArn !== "" ? { FOUNDATION_ROUTINE_INGRESS_FUNCTION_ARN: inputs.routineIngressFunctionArn } : {},
     FOUNDATION_MONGODB_SECRET_ID: names.secretMongodbReadonly,
+    ...instance.mongodbReadonly.deniedCollections.length > 0 || instance.mongodbReadonly.unsafeReadDefaultDeniedCollections.length > 0 ? { FOUNDATION_MONGODB_COLLECTION_POLICY: mongoCollectionPolicyEnv(instance.mongodbReadonly) } : {},
     FOUNDATION_SLACK_TEAM_ID: slackApp.team_id !== undefined && slackApp.team_id !== "" ? slackApp.team_id : instance.slack.teamId
   };
 }
@@ -1453,11 +1228,11 @@ import {
   mkdirSync as mkdirSync3,
   readFileSync as readFileSync5,
   realpathSync,
-  rmSync as rmSync2,
+  rmSync,
   statSync,
-  writeFileSync as writeFileSync2
+  writeFileSync
 } from "node:fs";
-import { dirname as dirname4, isAbsolute as isAbsolute2, posix, relative, resolve as resolve4, sep } from "node:path";
+import { dirname as dirname3, isAbsolute as isAbsolute2, posix, relative, resolve as resolve4, sep } from "node:path";
 import { isDeepStrictEqual } from "node:util";
 function sourceRootFor(sourceDir) {
   if (sourceDir === undefined || sourceDir === "")
@@ -1561,7 +1336,7 @@ function stageCustomization(options) {
   const platformConfigPath = options.paths.configPath;
   const stagedPath = stagedCustomizationPath(options.paths);
   if (options.dryRun !== true)
-    rmSync2(stagedPath, { force: true });
+    rmSync(stagedPath, { force: true });
   const customization = instance.customization;
   if (customization === undefined)
     return { status: "not-configured", runtimeConfigPath: platformConfigPath };
@@ -1579,8 +1354,8 @@ function stageCustomization(options) {
   assertValidTenantJobs(tenantConfig);
   assertProtectedPolicy(platformConfig, tenantConfig);
   if (options.dryRun !== true) {
-    mkdirSync3(dirname4(stagedPath), { recursive: true });
-    writeFileSync2(stagedPath, yaml);
+    mkdirSync3(dirname3(stagedPath), { recursive: true });
+    writeFileSync(stagedPath, yaml);
   }
   return {
     status: "staged",
@@ -1657,10 +1432,10 @@ function cdkCommand() {
   }
 }
 function cdkAppCommand(infraRoot = INFRA_ROOT) {
-  const source = join5(infraRoot, "bin", "app.ts");
+  const source = join4(infraRoot, "bin", "app.ts");
   if (existsSync4(source))
     return `bun run ${source}`;
-  return `${process.execPath} ${join5(infraRoot, "dist", "bin", "app.js")}`;
+  return `${process.execPath} ${join4(infraRoot, "dist", "bin", "app.js")}`;
 }
 async function cdkDeploy(ctx, opts) {
   const context = [
@@ -1931,9 +1706,9 @@ import { createServer } from "node:http";
 
 // src/deploy/github-app-manifest.ts
 import { readFileSync as readFileSync6 } from "node:fs";
-import { join as join6 } from "node:path";
+import { join as join5 } from "node:path";
 import { parse as parseYaml } from "yaml";
-var GITHUB_APP_MANIFEST_PATH = join6(PACKAGE_ASSETS, "github-app-manifest.yml");
+var GITHUB_APP_MANIFEST_PATH = join5(PACKAGE_ASSETS, "github-app-manifest.yml");
 function manifestUrl(instance) {
   const repo = instance.github.defaultRepo ?? instanceNames(instance).defaultRepo;
   return `https://github.com/${repo === "" ? instance.github.org : repo}`;
@@ -2148,9 +1923,9 @@ import { resolve as resolve5 } from "node:path";
 
 // src/deploy/slack-manifest.ts
 import { readFileSync as readFileSync8 } from "node:fs";
-import { join as join7 } from "node:path";
+import { join as join6 } from "node:path";
 import { parse as parse2 } from "yaml";
-var SLACK_APP_MANIFEST_PATH = join7(PACKAGE_ASSETS, "slack-app-manifest.yml");
+var SLACK_APP_MANIFEST_PATH = join6(PACKAGE_ASSETS, "slack-app-manifest.yml");
 function buildSlackManifest(template, instance, env) {
   const events = env.EVENTS_REQUEST_URL;
   const commands = env.COMMANDS_REQUEST_URL ?? events?.replace(/\/events$/, "/commands");
@@ -2598,7 +2373,10 @@ var COMMANDS = [
   "github-app-create",
   "slack-manifest",
   "stage-customization",
-  "job-key"
+  "job-key",
+  "crm-key",
+  "crm-check",
+  "crm-replay"
 ];
 var USAGE = `usage: foundation-deploy <command> --instance <path> [options]
 
@@ -2617,6 +2395,12 @@ commands
   slack-manifest       print the instance's Slack app manifest as JSON
   stage-customization  validate and stage a tenant-owned runtime config
   job-key <id>         print a webhook job's URL and signing key as JSON
+  crm-key              write the company CRM's crm/1 key, read from stdin, into
+                       the instance's <secretPrefix>/crm/http secret
+  crm-check            run the crm/1 conformance suite against the instance's
+                       CRM (crm.provider kind http) with its stored key
+  crm-replay           replay the agent's CRM writes (JSONL) into the
+                       instance's own table after a rollback to dynamodb
 
 options
   --instance <path>    REQUIRED: path to the deployment's instance YAML
@@ -2652,6 +2436,24 @@ job-key options
   --put-secret <id>    write {url, key} into this Secrets Manager secret
                        (created if absent) instead of printing the key
 
+crm-key options
+  --stdin              REQUIRED: read the key from a pipe, never argv, e.g.
+                       pbpaste | foundation-deploy crm-key --instance <path> --stdin
+
+crm-check options
+  --allow-skips        pass despite cases only a person can set up (they need
+                       the CRM's own harness); without it they count as failed
+  --base-url <url>     check any crm/1 server instead of the instance's: needs
+  --tenant <id>        the tenant its /meta names, and the key on stdin
+  --key-stdin          (--key-stdin). No --instance in this form.
+  --write              with --base-url only: also run the write cases, which
+                       create records and spend the week's outreach allowance;
+                       point it at a sandbox tenant
+
+crm-replay options
+  --from <file>        REQUIRED: the writes to replay, one JSON object per line
+                       (docs/crm-provider-contract.md); --dry-run validates only
+
 github-app-create options
   --org <org>          GitHub org (default: the instance's github.org)
   --port <n>           local callback port (default 8765)
@@ -2731,6 +2533,21 @@ ${USAGE}`);
     console.log(JSON.stringify(result));
     return 0;
   }
+  if (command === "crm-check" && args.includes("--base-url")) {
+    if (args.some((arg) => arg === "--instance" || arg.startsWith("--instance=")))
+      throw new Error("crm-check takes --instance or --base-url, not both");
+    const baseUrl = flag2(args, "--base-url");
+    const tenantId = flag2(args, "--tenant");
+    if (baseUrl === undefined || tenantId === undefined || !args.includes("--key-stdin"))
+      throw new Error("crm-check --base-url needs --tenant <id> and --key-stdin");
+    const { crmCheckTarget, defaultCrmCommandDeps } = await import("../chunk-1pww63wd.js");
+    return crmCheckTarget({
+      baseUrl,
+      tenantId,
+      write: args.includes("--write"),
+      allowSkips: args.includes("--allow-skips")
+    }, defaultCrmCommandDeps());
+  }
   if (command === "github-app-create") {
     const paths = loadInstanceContext(resolveInstanceFilePath(args, process.env));
     console.log(instanceBanner(paths));
@@ -2795,6 +2612,25 @@ ${USAGE}`);
       console.log(`  ${result.status}: ${result.runtimeConfigPath}`);
       return 0;
     }
+    case "crm-key": {
+      const { crmKey, defaultCrmCommandDeps } = await import("../chunk-1pww63wd.js");
+      await crmKey(ctx, { stdin: args.includes("--stdin") }, defaultCrmCommandDeps());
+      return 0;
+    }
+    case "crm-check": {
+      if (args.includes("--write"))
+        throw new Error("crm-check --write creates records and spends the week's outreach allowance, so it never runs against the instance's own tenant: use --base-url with a sandbox tenant");
+      const { crmCheck, defaultCrmCommandDeps } = await import("../chunk-1pww63wd.js");
+      return crmCheck(ctx, { allowSkips: args.includes("--allow-skips") }, defaultCrmCommandDeps());
+    }
+    case "crm-replay": {
+      const from = flag2(args, "--from");
+      if (from === undefined || from.startsWith("-"))
+        throw new Error("crm-replay needs --from <file>: the writes to replay, as JSONL");
+      const { crmReplay, defaultCrmCommandDeps } = await import("../chunk-1pww63wd.js");
+      const result = await crmReplay(ctx, { from }, defaultCrmCommandDeps());
+      return result.refused.length > 0 ? 1 : 0;
+    }
     default:
       console.error(`unhandled command: ${command}