@epilot/cli 0.1.107 → 0.1.109

package/dist/add-function-VRVBRNY3.js

@@ -0,0 +1,184 @@
+#!/usr/bin/env node
+import {
+  log,
+  readManifest,
+  validateScheduleExpression,
+  writeManifest
+} from "./chunk-UDGF4AVJ.js";
+import "./chunk-M3M3C5WH.js";
+import "./chunk-YHQA2AVG.js";
+import "./chunk-7ZQ666ZQ.js";
+
+// src/commands/app/add-function.ts
+import { defineCommand } from "citty";
+import { existsSync, mkdirSync, writeFileSync } from "fs";
+import { join, resolve } from "path";
+var NAME_PATTERN = /^[a-z0-9][a-z0-9-]{0,63}$/;
+var add_function_default = defineCommand({
+  meta: {
+    name: "add-function",
+    description: "Add a server-side function (optionally scheduled) to the app"
+  },
+  args: {
+    name: { type: "positional", description: "Function name (kebab-case)", required: true },
+    type: {
+      type: "string",
+      description: '"workflow" (selectable as flow action) or "scheduled" (cron per installation). Default: scheduled when --schedule is given, workflow otherwise'
+    },
+    schedule: {
+      type: "string",
+      description: 'Cron ("0 3 * * *") or rate ("rate(30 minutes)") expression to run the function once per installation'
+    },
+    label: { type: "string", description: "Display name shown to org admins (e.g. in the flow builder)" },
+    timezone: { type: "string", description: "IANA timezone for cron schedules (default: Europe/Berlin)" },
+    path: { type: "string", description: "Path to manifest.json (default: manifest.json)" }
+  },
+  run: ({ args }) => {
+    const name = args.name;
+    if (!NAME_PATTERN.test(name)) {
+      log.error(`Invalid function name "${name}" \u2014 use kebab-case (a-z, 0-9, dashes; max 64 chars)`);
+      process.exit(1);
+    }
+    const fnType = args.type ?? (args.schedule ? "scheduled" : "workflow");
+    if (fnType !== "workflow" && fnType !== "scheduled") {
+      log.error(`Invalid --type "${args.type}" \u2014 use "workflow" or "scheduled"`);
+      process.exit(1);
+    }
+    if (fnType === "scheduled" && !args.schedule) {
+      log.error("Scheduled functions require --schedule (cron or rate expression)");
+      process.exit(1);
+    }
+    if (fnType === "workflow" && args.schedule) {
+      log.error("Workflow functions cannot have a schedule \u2014 drop --schedule or use --type scheduled");
+      process.exit(1);
+    }
+    if (args.schedule) {
+      const result = validateScheduleExpression(args.schedule);
+      if (!result.valid) {
+        log.error(`Invalid schedule: ${result.error}`);
+        process.exit(1);
+      }
+    }
+    const manifestPath = resolve(args.path ?? "manifest.json");
+    const manifest = readManifest(manifestPath);
+    const rootDir = resolve(manifestPath, "..");
+    if (manifest.functions?.some((fn2) => fn2.name === name)) {
+      log.error(`Function "${name}" already exists in the manifest`);
+      process.exit(1);
+    }
+    const fnDir = join(rootDir, "functions", name);
+    if (existsSync(fnDir)) {
+      log.error(`Directory already exists: ${fnDir}`);
+      process.exit(1);
+    }
+    mkdirSync(join(fnDir, "src"), { recursive: true });
+    writeFileSync(
+      join(fnDir, "package.json"),
+      `${JSON.stringify(
+        {
+          name,
+          private: true,
+          version: "0.0.1",
+          type: "module",
+          scripts: { build: "tsc", dev: "tsx watch src/handler.ts" },
+          devDependencies: { typescript: "~5.8.3", tsx: "^4.0.0" }
+        },
+        null,
+        2
+      )}
+`
+    );
+    writeFileSync(
+      join(fnDir, "tsconfig.json"),
+      `${JSON.stringify(
+        {
+          compilerOptions: {
+            target: "ES2022",
+            lib: ["ES2022", "DOM"],
+            module: "ESNext",
+            moduleResolution: "bundler",
+            strict: true,
+            rootDir: "src",
+            outDir: "dist",
+            esModuleInterop: true,
+            skipLibCheck: true
+          },
+          include: ["src"]
+        },
+        null,
+        2
+      )}
+`
+    );
+    writeFileSync(join(fnDir, "src", "handler.ts"), handlerTemplate(name, fnType, args.schedule));
+    const fn = {
+      name,
+      type: fnType,
+      ...args.label ? { label: { de: args.label } } : {},
+      handler: `./functions/${name}/dist/handler.js`,
+      ...args.schedule ? { schedule: args.schedule } : {},
+      ...args.timezone ? { schedule_timezone: args.timezone } : {}
+    };
+    manifest.functions = [...manifest.functions ?? [], fn];
+    writeManifest(manifestPath, manifest);
+    log.success(`Added ${fnType} function "${name}"`);
+    log.info(`Code:     functions/${name}/src/handler.ts`);
+    if (args.schedule) {
+      log.info(`Schedule: ${args.schedule} (runs once per installation, max 60s per run)`);
+    } else {
+      log.info("Selectable as an action in the flow builder once the app is installed");
+    }
+    log.dim('Build with "npm run build", then "epilot app deploy"');
+  }
+});
+var handlerTemplate = (name, fnType, schedule) => `// App function: ${name}
+//${fnType === "scheduled" ? `
+// Runs automatically ${schedule?.startsWith("rate(") ? `every ${schedule.slice(5, -1)}` : `on "${schedule}"`} \u2014 once per installation,
+// inside the epilot code-execution sandbox with a 60 second budget. Do a
+// bounded amount of work per run; the next tick picks up the rest.` : `
+// Selectable as an action in the flow builder. Runs inside the epilot
+// code-execution sandbox with the triggering entity in \`input.entity\`.`}
+//
+// Runtime contract:
+//   - top-level \`async function handler(input, context)\` \u2014 no \`export\`.
+//   - \`input.trigger\` \u2192 { type: '${fnType === "scheduled" ? "schedule" : "workflow"}', ... }.${fnType === "workflow" ? `
+//   - \`input.entity\` \u2192 the entity the flow ran on.
+//   - \`input.action_config\` \u2192 the action's configuration from the flow builder.` : `
+//   - \`input.org_id\` / \`input.app_id\` \u2192 the installation this run belongs to.`}
+//   - \`context.epilot\` \u2192 the bundled @epilot/sdk, pre-authorized with the app token
+//     (scoped to the app's permissions): \`await context.epilot.entity.searchEntities(...)\`.
+//   - \`context.fetch\` \u2192 plain fetch, e.g. for the app's API proxy or non-prod stages
+//     (derive base URLs from \`input.app_options.stage\`).
+//   - \`input.app_options.token\` \u2192 the raw app token, if you need it for fetch calls.
+//   - Return \`{ skip_reason }\` to skip, \`{ error_reason }\` to fail the run.
+
+interface FunctionInput {
+  trigger?: { type: string; schedule?: string; scheduled_time?: string };
+  org_id?: string;
+  app_id?: string;${fnType === "workflow" ? `
+  entity?: Record<string, unknown>;
+  action_config?: Record<string, unknown>;` : ""}
+  app_options?: { token?: string; stage?: string } & Record<string, unknown>;
+}
+
+interface FunctionContext {
+  /** Bundled @epilot/sdk, pre-authorized \u2014 e.g. context.epilot.entity.searchEntities(...) */
+  epilot: Record<string, any>;
+  fetch: typeof fetch;
+}
+
+async function handler(input: FunctionInput, context: FunctionContext) {
+  const token = input.app_options?.token;
+  if (!token) {
+    return { error_reason: 'Missing app token in execution context.' };
+  }
+
+  // TODO: implement your logic here
+  console.log('${name} run', { trigger: input.trigger?.type, org: input.org_id });
+
+  return { success: true };
+}
+`;
+export {
+  add_function_default as default
+};

package/dist/app-NATUF3YX.js

@@ -0,0 +1,26 @@
+#!/usr/bin/env node
+
+// src/commands/app/index.ts
+import { defineCommand } from "citty";
+var app_default = defineCommand({
+  meta: {
+    name: "app",
+    description: "Manage epilot Apps \u2014 create, deploy, and manage app manifests"
+  },
+  subCommands: {
+    init: () => import("./init-C66L5GFR.js").then((m) => m.default),
+    "add-component": () => import("./add-component-TCF7V3KU.js").then((m) => m.default),
+    "remove-component": () => import("./remove-component-7C7MPSBF.js").then((m) => m.default),
+    "add-function": () => import("./add-function-VRVBRNY3.js").then((m) => m.default),
+    validate: () => import("./validate-J35DJW3H.js").then((m) => m.default),
+    deploy: () => import("./deploy-2U5FVEE7.js").then((m) => m.default),
+    dev: () => import("./dev-JEAHUYQU.js").then((m) => m.default),
+    export: () => import("./export-VLAY2KZP.js").then((m) => m.default),
+    versions: () => import("./versions-2TMTHO7W.js").then((m) => m.default),
+    review: () => import("./review-JZTMQNU3.js").then((m) => m.default),
+    api: () => import("./api-5W2UMWCW.js").then((m) => m.default)
+  }
+});
+export {
+  app_default as default
+};

package/dist/bin/epilot.js

@@ -11,7 +11,7 @@ import { defineCommand } from "citty";
 var main = defineCommand({
   meta: {
     name: "epilot",
-    version: "0.1.107",
+    version: "0.1.109",
     description: "CLI for epilot APIs"
   },
   args: {
@@ -31,12 +31,12 @@ var main = defineCommand({
     profile: () => import("../profile-OZJL5ZPT.js").then((m) => m.default),
     config: () => import("../config-DGZIMLZK.js").then((m) => m.default),
     completion: () => import("../completion-TFHA4W2J.js").then((m) => m.default),
-    upgrade: () => import("../upgrade-BAXQEZ2I.js").then((m) => m.default),
+    upgrade: () => import("../upgrade-5RFPLKLG.js").then((m) => m.default),
     "access-token": () => import("../access-token-WWE6BDJH.js").then((m) => m.default),
     address: () => import("../address-EH3C4CVB.js").then((m) => m.default),
     "address-suggestions": () => import("../address-suggestions-RRSLOBFW.js").then((m) => m.default),
     "ai-agents": () => import("../ai-agents-53M2KHPI.js").then((m) => m.default),
-    app: () => import("../app-RULTIGMJ.js").then((m) => m.default),
+    app: () => import("../app-NATUF3YX.js").then((m) => m.default),
     "audit-logs": () => import("../audit-logs-YFRK3EFU.js").then((m) => m.default),
     automation: () => import("../automation-4DEE3TUI.js").then((m) => m.default),
     billing: () => import("../billing-XX4VVOPI.js").then((m) => m.default),
@@ -134,7 +134,7 @@ process.stderr.on("error", (err) => {
   if (err.code === "EPIPE") process.exit(0);
   throw err;
 });
-var VERSION = true ? "0.1.107" : (await null).default.version;
+var VERSION = true ? "0.1.109" : (await null).default.version;
 var reorderedArgv = hoistFlagsAfterSubcommand(process.argv.slice(2));
 process.argv = [process.argv[0], process.argv[1], ...reorderedArgv];
 var args = process.argv.slice(2);

package/dist/{chunk-QOD77YLW.js → chunk-UDGF4AVJ.js}

@@ -15,6 +15,179 @@ import {
   YELLOW
 } from "./chunk-7ZQ666ZQ.js";
 
+// src/commands/app/schedule.ts
+var MIN_SCHEDULE_INTERVAL_MINUTES = 15;
+var RATE_PATTERN = /^rate\((\d+)\s+(minute|minutes|hour|hours|day|days)\)$/;
+function validateScheduleExpression(expression, minIntervalMinutes = MIN_SCHEDULE_INTERVAL_MINUTES) {
+  const expr = expression.trim();
+  const rate = expr.match(RATE_PATTERN);
+  if (rate) {
+    const value = Number(rate[1]);
+    const unit = rate[2];
+    if (value < 1) {
+      return { valid: false, error: "rate() value must be at least 1" };
+    }
+    const minutes = unit.startsWith("minute") ? value : unit.startsWith("hour") ? value * 60 : value * 24 * 60;
+    if (minutes < minIntervalMinutes) {
+      return {
+        valid: false,
+        error: `Schedule fires every ${minutes} minute(s) \u2014 the minimum interval is ${minIntervalMinutes} minutes`,
+        minIntervalMinutes: minutes
+      };
+    }
+    return { valid: true, minIntervalMinutes: minutes };
+  }
+  if (expr.startsWith("rate(")) {
+    return { valid: false, error: 'Invalid rate expression \u2014 expected e.g. "rate(30 minutes)"' };
+  }
+  let cron;
+  try {
+    cron = parseCron(expr);
+  } catch (err) {
+    return { valid: false, error: err.message };
+  }
+  if (cron.domRestricted && cron.dowRestricted) {
+    return {
+      valid: false,
+      error: "Restricting both day-of-month and day-of-week is not supported \u2014 set one of them to *"
+    };
+  }
+  const gap = minFireGapMinutes(cron, minIntervalMinutes);
+  if (gap === null) {
+    return { valid: false, error: "Schedule never fires" };
+  }
+  if (gap < minIntervalMinutes) {
+    return {
+      valid: false,
+      error: `Schedule fires ${gap} minute(s) apart \u2014 the minimum interval is ${minIntervalMinutes} minutes`,
+      minIntervalMinutes: gap
+    };
+  }
+  return { valid: true, minIntervalMinutes: gap };
+}
+var FIELD_RANGES = [
+  ["minute", 0, 59],
+  ["hour", 0, 23],
+  ["day of month", 1, 31],
+  ["month", 1, 12],
+  ["day of week", 0, 7]
+];
+var MONTH_NAMES = {
+  jan: 1,
+  feb: 2,
+  mar: 3,
+  apr: 4,
+  may: 5,
+  jun: 6,
+  jul: 7,
+  aug: 8,
+  sep: 9,
+  oct: 10,
+  nov: 11,
+  dec: 12
+};
+var DOW_NAMES = { sun: 0, mon: 1, tue: 2, wed: 3, thu: 4, fri: 5, sat: 6 };
+function parseCron(expr) {
+  const fields = expr.split(/\s+/);
+  if (fields.length !== 5) {
+    throw new Error(
+      `Invalid cron expression "${expr}" \u2014 expected 5 fields (minute hour day-of-month month day-of-week)`
+    );
+  }
+  const sets = fields.map((field, i) => {
+    const [label, min, max] = FIELD_RANGES[i];
+    const names = i === 3 ? MONTH_NAMES : i === 4 ? DOW_NAMES : void 0;
+    return parseField(field, label, min, max, names);
+  });
+  const dayOfWeek = sets[4];
+  if (dayOfWeek.has(7)) {
+    dayOfWeek.delete(7);
+    dayOfWeek.add(0);
+  }
+  return {
+    minute: sets[0],
+    hour: sets[1],
+    dayOfMonth: sets[2],
+    month: sets[3],
+    dayOfWeek,
+    domRestricted: fields[2] !== "*",
+    dowRestricted: fields[4] !== "*"
+  };
+}
+function parseField(field, label, min, max, names) {
+  const values = /* @__PURE__ */ new Set();
+  for (const part of field.split(",")) {
+    const [rangePart, stepPart, ...rest] = part.split("/");
+    if (rest.length > 0 || stepPart === "") {
+      throw new Error(`Invalid ${label} field "${field}"`);
+    }
+    const step = stepPart === void 0 ? 1 : Number(stepPart);
+    if (!Number.isInteger(step) || step < 1) {
+      throw new Error(`Invalid step in ${label} field "${field}"`);
+    }
+    let lo;
+    let hi;
+    if (rangePart === "*") {
+      lo = min;
+      hi = max;
+    } else if (rangePart.includes("-")) {
+      const [a, b] = rangePart.split("-");
+      lo = parseValue(a, label, names);
+      hi = parseValue(b, label, names);
+      if (lo > hi) throw new Error(`Invalid range in ${label} field "${field}"`);
+    } else {
+      lo = parseValue(rangePart, label, names);
+      hi = stepPart === void 0 ? lo : max;
+    }
+    if (lo < min || hi > max) {
+      throw new Error(`Value out of range in ${label} field "${field}" (allowed ${min}-${max})`);
+    }
+    for (let v = lo; v <= hi; v += step) values.add(v);
+  }
+  if (values.size === 0) throw new Error(`Empty ${label} field "${field}"`);
+  return values;
+}
+function parseValue(raw, label, names) {
+  if (names) {
+    const named = names[raw.toLowerCase()];
+    if (named !== void 0) return named;
+  }
+  const value = Number(raw);
+  if (!Number.isInteger(value)) {
+    throw new Error(`Invalid value "${raw}" in ${label} field`);
+  }
+  return value;
+}
+function minFireGapMinutes(cron, threshold) {
+  const start = Date.UTC(2024, 0, 1);
+  const totalMinutes = (366 + 60) * 24 * 60;
+  let previous = null;
+  let minGap = Number.POSITIVE_INFINITY;
+  for (let m = 0; m < totalMinutes; m++) {
+    const date = new Date(start + m * 6e4);
+    if (!matches(cron, date)) continue;
+    if (previous !== null) {
+      const gap = m - previous;
+      if (gap < minGap) minGap = gap;
+      if (minGap < threshold) return minGap;
+    }
+    previous = m;
+  }
+  if (previous === null) return null;
+  return minGap === Number.POSITIVE_INFINITY ? 366 * 24 * 60 : minGap;
+}
+function matches(cron, date) {
+  if (!cron.minute.has(date.getUTCMinutes())) return false;
+  if (!cron.hour.has(date.getUTCHours())) return false;
+  if (!cron.month.has(date.getUTCMonth() + 1)) return false;
+  const domMatch = cron.dayOfMonth.has(date.getUTCDate());
+  const dowMatch = cron.dayOfWeek.has(date.getUTCDay());
+  if (cron.domRestricted && cron.dowRestricted) return domMatch || dowMatch;
+  if (cron.domRestricted) return domMatch;
+  if (cron.dowRestricted) return dowMatch;
+  return true;
+}
+
 // src/commands/app/manifest.ts
 import { readFileSync, writeFileSync, existsSync, statSync } from "fs";
 import { resolve, extname } from "path";
@@ -78,9 +251,72 @@ function validateManifest(data) {
       }
     }
   }
+  if (obj.functions !== void 0) {
+    if (!Array.isArray(obj.functions)) {
+      errors.push({ path: "/functions", message: "Must be an array" });
+    } else {
+      validateFunctions(obj.functions, errors);
+    }
+  }
   if (errors.length > 0) return { valid: false, errors };
   return { valid: true, errors: [], manifest: data };
 }
+var FUNCTION_NAME_PATTERN = /^[a-z0-9][a-z0-9-]{0,63}$/;
+var MAX_FUNCTIONS = 10;
+var MAX_SCHEDULED_FUNCTIONS = 5;
+function validateFunctions(functions, errors) {
+  if (functions.length > MAX_FUNCTIONS) {
+    errors.push({ path: "/functions", message: `At most ${MAX_FUNCTIONS} functions per app` });
+  }
+  const seen = /* @__PURE__ */ new Set();
+  let scheduled = 0;
+  for (let i = 0; i < functions.length; i++) {
+    const fn = functions[i];
+    const path = `/functions/${i}`;
+    if (fn.type !== "workflow" && fn.type !== "scheduled") {
+      errors.push({ path: `${path}/type`, message: 'Required: "workflow" or "scheduled"' });
+    }
+    if (fn.type === "scheduled" && fn.schedule === void 0) {
+      errors.push({ path: `${path}/schedule`, message: "Scheduled functions require a schedule expression" });
+    }
+    if (fn.type !== "scheduled" && fn.schedule !== void 0) {
+      errors.push({ path: `${path}/schedule`, message: 'Only functions of type "scheduled" may declare a schedule' });
+    }
+    if (fn.type !== "workflow" && fn.wait_for_callback !== void 0) {
+      errors.push({ path: `${path}/wait_for_callback`, message: "Only valid for workflow functions" });
+    }
+    if (typeof fn.name !== "string" || !FUNCTION_NAME_PATTERN.test(fn.name)) {
+      errors.push({ path: `${path}/name`, message: "Required kebab-case string (a-z, 0-9, dashes; max 64 chars)" });
+    } else if (seen.has(fn.name)) {
+      errors.push({ path: `${path}/name`, message: `Duplicate function name "${fn.name}"` });
+    } else {
+      seen.add(fn.name);
+    }
+    if (typeof fn.handler !== "string" || fn.handler.length === 0) {
+      errors.push({ path: `${path}/handler`, message: "Required path to the bundled handler JS" });
+    }
+    if (fn.schedule !== void 0) {
+      scheduled++;
+      if (typeof fn.schedule !== "string") {
+        errors.push({ path: `${path}/schedule`, message: "Must be a cron or rate() expression string" });
+      } else {
+        const result = validateScheduleExpression(fn.schedule);
+        if (!result.valid) {
+          errors.push({ path: `${path}/schedule`, message: result.error ?? "Invalid schedule expression" });
+        }
+      }
+    }
+    if (fn.schedule_overlap !== void 0 && fn.schedule_overlap !== "skip") {
+      errors.push({ path: `${path}/schedule_overlap`, message: 'Only "skip" is supported' });
+    }
+  }
+  if (scheduled > MAX_SCHEDULED_FUNCTIONS) {
+    errors.push({
+      path: "/functions",
+      message: `At most ${MAX_SCHEDULED_FUNCTIONS} scheduled functions per app (schedules run once per installation)`
+    });
+  }
+}
 function readManifest(path) {
   const absPath = resolve(path);
   if (!existsSync(absPath)) {
@@ -101,6 +337,15 @@ function writeManifest(path, manifest) {
 `, "utf-8");
 }
 var DEFAULT_BASE_URL = "https://app.sls.epilot.io";
+function bumpPatchVersion(version) {
+  const parts = version.split(".");
+  const patch = Number.parseInt(parts[parts.length - 1], 10);
+  if (Number.isNaN(patch)) {
+    throw new Error(`Cannot derive next version from "${version}" \u2014 pass an explicit target version`);
+  }
+  parts[parts.length - 1] = String(patch + 1);
+  return parts.join(".");
+}
 async function request(baseUrl, token, method, path, body) {
   const url = `${baseUrl}${path}`;
   const headers = {
@@ -203,13 +448,27 @@ function createAppApiClient(opts) {
       });
       return roleId;
     },
-    async cloneVersion(appId, version) {
-      return request(
+    async cloneVersion(appId, sourceVersion, targetVersion) {
+      const target = targetVersion ?? bumpPatchVersion(sourceVersion);
+      await request(
         baseUrl,
         getToken(),
         "POST",
-        `/v1/app-configurations/${appId}/versions/${version}/clone`
+        `/v1/app-configurations/${appId}/versions/${sourceVersion}/clone-to/${target}`
       );
+      return { version: target };
+    },
+    /** Returns the app's installation in the caller's org, or null if not installed. */
+    async getInstallation(appId) {
+      try {
+        return await request(baseUrl, getToken(), "GET", `/v1/app/${appId}`);
+      } catch (err) {
+        if (err.message.includes("(404)")) return null;
+        throw err;
+      }
+    },
+    async patchInstallation(appId, payload) {
+      return request(baseUrl, getToken(), "PATCH", `/v1/app/${appId}`, payload);
     },
     async upsertComponent(appId, version, component) {
       const componentId = component.id;
@@ -407,6 +666,7 @@ function toManifest(config, version) {
 }
 
 export {
+  validateScheduleExpression,
   log,
   validateManifest,
   readManifest,

package/dist/{deploy-NRQHZ635.js → deploy-2U5FVEE7.js}

@@ -8,7 +8,7 @@ import {
   uploadDirectoryAsZip,
   uploadFileToPresignedUrl,
   writeManifest
-} from "./chunk-QOD77YLW.js";
+} from "./chunk-UDGF4AVJ.js";
 import "./chunk-M3M3C5WH.js";
 import "./chunk-YHQA2AVG.js";
 import "./chunk-7ZQ666ZQ.js";
@@ -105,15 +105,67 @@ var deploy_default = defineCommand({
         log.warn(`Logo not found: ${logoPath}`);
       }
     }
-    if (manifest.permissions?.length || manifest.blueprint?.manifest_id) {
+    let functionsPayload;
+    if (manifest.functions) {
+      functionsPayload = [];
+      for (const fn of manifest.functions) {
+        const handlerPath = resolve(manifestDir, fn.handler);
+        if (!existsSync(handlerPath)) {
+          log.error(`Handler not found for function "${fn.name}": ${handlerPath} \u2014 run "npm run build" first`);
+          process.exit(1);
+        }
+        const { handler, assets: fnAssets, ...rest } = fn;
+        const payload = { ...rest, code: readFileSync(handlerPath, "utf-8") };
+        if (fnAssets?.zip) {
+          const zipPath = resolve(manifestDir, fnAssets.zip);
+          if (!existsSync(zipPath)) {
+            log.warn(`Config UI directory not found for function "${fn.name}": ${zipPath} \u2014 skipping surface`);
+          } else if (dryRun) {
+            log.info(`[dry-run] Would zip and upload config UI for function ${fn.name}`);
+          } else {
+            const { upload_url, artifact_url } = await client.createZipUploadUrl(
+              appId,
+              targetVersion,
+              `fn-${fn.name}`
+            );
+            const zipSize = await uploadDirectoryAsZip(upload_url, zipPath);
+            log.success(`Uploaded config UI for function ${fn.name} (${formatFileSize(zipSize)})`);
+            payload.surfaces = {
+              flow_action_config: {
+                app_url: artifact_url.replace(/\/[^/]+$/, "/index.html"),
+                zip_url: artifact_url
+              }
+            };
+          }
+        }
+        functionsPayload.push(payload);
+        if (dryRun) {
+          log.info(
+            `[dry-run] Would deploy ${fn.type} function ${fn.name}${fn.schedule ? ` (schedule: ${fn.schedule})` : ""}`
+          );
+        }
+      }
+    }
+    if (manifest.permissions?.length || manifest.blueprint?.manifest_id || functionsPayload) {
       if (dryRun) {
         if (manifest.permissions?.length) {
-          log.info("[dry-run] Would upsert app role in developer org");
+          log.info("[dry-run] Would upsert app role in developer org (if grants changed)");
         }
         log.info("[dry-run] Would update version permissions/blueprint");
       } else {
+        let grantsChanged = true;
+        if (!isNew && manifest.permissions?.length) {
+          try {
+            const remoteVersion = await client.getVersion(appId, targetVersion);
+            const remoteGrants = remoteVersion.role?.grants;
+            grantsChanged = normalizeGrants(remoteGrants) !== normalizeGrants(manifest.permissions);
+          } catch {
+          }
+        }
         let roleId;
-        if (manifest.permissions?.length) {
+        if (manifest.permissions?.length && !grantsChanged) {
+          log.dim("Permissions unchanged \u2014 skipping grant re-provisioning");
+        } else if (manifest.permissions?.length) {
           const orgId = resolveOrgId(args.token, args.profile);
           if (orgId) {
             try {
@@ -131,11 +183,17 @@ var deploy_default = defineCommand({
             log.warn("Could not resolve org id \u2014 attaching grants without a developer-org role");
           }
         }
-        await client.patchVersion(appId, targetVersion, {
-          ...manifest.permissions?.length ? { grants: manifest.permissions, ...roleId ? { role_id: roleId } : {} } : {},
-          ...manifest.blueprint?.manifest_id ? { manifest_id: manifest.blueprint.manifest_id } : {}
-        });
-        log.success(`Updated version ${targetVersion} (permissions/blueprint)`);
+        const sendGrants = Boolean(manifest.permissions?.length && grantsChanged);
+        if (sendGrants || manifest.blueprint?.manifest_id || functionsPayload) {
+          await client.patchVersion(appId, targetVersion, {
+            ...sendGrants ? { grants: manifest.permissions, ...roleId ? { role_id: roleId } : {} } : {},
+            ...manifest.blueprint?.manifest_id ? { manifest_id: manifest.blueprint.manifest_id } : {},
+            ...functionsPayload ? { functions: functionsPayload } : {}
+          });
+          log.success(
+            `Updated version ${targetVersion} (permissions/blueprint${functionsPayload ? `, ${functionsPayload.length} function(s)` : ""})`
+          );
+        }
       }
     }
     for (const comp of manifest.components) {
@@ -222,6 +280,24 @@ var deploy_default = defineCommand({
         }
       }
     }
+    if (!isNew) {
+      if (dryRun) {
+        log.info("[dry-run] Would re-sync the installation in this org (if installed)");
+      } else {
+        try {
+          const installation = await client.getInstallation(appId);
+          if (installation) {
+            await client.patchInstallation(appId, { version: targetVersion });
+            log.success(`Re-synced installation in this org to v${targetVersion}`);
+            log.warn(
+              "Re-syncing disables the installation \u2014 open the app in epilot (Settings \u2192 Apps) and save its configuration to re-enable it."
+            );
+          }
+        } catch (err) {
+          log.warn(`Could not re-sync installation: ${err.message}`);
+        }
+      }
+    }
     if (dryRun) {
       log.header("Dry run complete. No changes were made.");
     } else {
@@ -229,6 +305,11 @@ var deploy_default = defineCommand({
     }
   }
 });
+function normalizeGrants(grants = []) {
+  return JSON.stringify(
+    grants.map((g) => ({ action: g.action, resource: g.resource ?? null })).sort((a, b) => `${a.action}|${a.resource}`.localeCompare(`${b.action}|${b.resource}`))
+  );
+}
 export {
   deploy_default as default
 };