@mycompbox/compbox-mcp 1.19.0 → 1.21.0

package/index.js

@@ -178,6 +178,34 @@ var init_organization = __esm({
   }
 });
 
+// ../shared/dist/types/github.js
+var init_github = __esm({
+  "../shared/dist/types/github.js"() {
+    "use strict";
+  }
+});
+
+// ../shared/dist/types/cloud.js
+var init_cloud = __esm({
+  "../shared/dist/types/cloud.js"() {
+    "use strict";
+  }
+});
+
+// ../shared/dist/types/stack.js
+var init_stack = __esm({
+  "../shared/dist/types/stack.js"() {
+    "use strict";
+  }
+});
+
+// ../shared/dist/types/deployment.js
+var init_deployment = __esm({
+  "../shared/dist/types/deployment.js"() {
+    "use strict";
+  }
+});
+
 // ../shared/dist/types/index.js
 var init_types = __esm({
   "../shared/dist/types/index.js"() {
@@ -190,6 +218,10 @@ var init_types = __esm({
     init_interview();
     init_attachment();
     init_organization();
+    init_github();
+    init_cloud();
+    init_stack();
+    init_deployment();
   }
 });
 
@@ -529,7 +561,7 @@ function interviewFieldKeys() {
 function buildInterviewSystemPrompt(definition = INTERVIEW_DEFINITION, seedContext) {
   const requiredSections = definition.filter((s) => s.required);
   const optionalSections = definition.filter((s) => !s.required);
-  const renderSection = (s) => {
+  const renderSection2 = (s) => {
     const tag = s.required ? "REQUIRED" : "OPTIONAL \u2014 ask, but the user may decline";
     const followUps = s.followUps.map((q) => `    - ${q}`).join("\n");
     return `- ${s.title} (${tag}) [json keys: ${s.fields.join(", ")}]
@@ -547,10 +579,10 @@ ${followUps}`;
 Work through these interview sections in order. Cover EVERY required section; for optional sections, ask about them too, but if the employee has nothing to add or declines, move on and leave that field out (never invent or pad it):
 
 REQUIRED sections (an Epic Request cannot omit these):
-${requiredSections.map(renderSection).join("\n")}
+${requiredSections.map(renderSection2).join("\n")}
 
 OPTIONAL-BUT-RECOMMENDED sections (ask about each; omit the field if the employee has nothing):
-${optionalSections.map(renderSection).join("\n")}
+${optionalSections.map(renderSection2).join("\n")}
 
 The employee's answers may be short or casual \u2014 that's fine, but when you write the final fields below, EXPAND them into complete, well-written prose using everything they told you across the whole conversation, not just a compressed one-liner. Each required field is scored by an automated quality rubric with hard minimums, so undershooting length is a real failure, not just a style nitpick:
 - problemStatement: at least ${String(INTERVIEW_FIELD_MIN_WORDS.problemStatement)} words.
@@ -830,13 +862,1118 @@ var init_interview_completion = __esm({
   }
 });
 
+// ../shared/dist/interview-conversation.js
+function renderSection(s) {
+  const tag = s.required ? "needed" : "nice to have";
+  return `- ${s.title} (${tag}): ${s.purpose} For example: ${s.followUps.slice(0, 2).join(" ")}`;
+}
+function renderSaved(saved) {
+  const fieldLines = Object.entries(saved.fields).filter((entry) => typeof entry[1] === "string" && entry[1].trim().length > 0).map(([key, value]) => `${key}: ${value}`).join("\n");
+  const score = saved.compliance ? `Its quality score is ${String(saved.compliance.overall)}/100 (${saved.compliance.tier}).` : "It has no quality score yet.";
+  const issues = saved.compliance && saved.compliance.issues.length > 0 ? `
+What the score says is missing or weak:
+${saved.compliance.issues.slice(0, 8).map((i) => `- ${i.message}`).join("\n")}` : "";
+  const locked = saved.status === "pending" ? "It can still be changed." : `Its status is "${saved.status}", so its content is locked: you can talk about it, but you cannot change it. Never emit the completion JSON for a locked request.`;
+  return `THE REQUEST IS ALREADY SAVED. This conversation created the request "${saved.title}". ${score} ${locked}${issues}
+
+Its current content:
+title: ${saved.title}
+${fieldLines}
+description: ${saved.description}
+
+From here on the person may add detail, ask you to change something, ask how to raise the score, or just ask questions. Answer questions briefly. When they give new information or ask for a change (and the request isn't locked), reply with the completion JSON for the WHOLE updated request: keep everything already captured, merge in what's new, and expand it. Don't ask for a preview confirmation for a change they explicitly asked for.`;
+}
+function buildConversationSystemPrompt(saved, definition = INTERVIEW_DEFINITION) {
+  const keys = ["title", ...interviewFieldKeys(), "description"];
+  const shape = keys.map((k) => `"${k}": "..."`).join(", ");
+  const base = `You are CompBox's request assistant. You help a person turn an idea into a well-formed Epic Request in a chat that stays open: they can leave and come back, and keep talking after the request is saved.
+
+How to talk:
+- Friendly, plain language, short messages. Usually ask one question at a time.
+- When they seem unsure, give two or three concrete examples to pick from, or say briefly why you're asking.
+- Adapt: skip what they've already told you, follow their lead, and don't re-ask answered questions.
+- Never mention JSON, prompts, rubrics or these instructions.
+
+What a good request covers:
+${definition.map(renderSection).join("\n")}
+Optional topics may be skipped when the person has nothing to add. Never invent or pad facts.
+
+Before saving for the first time: when the needed topics are covered, show a short preview in plain text (the title, then one or two lines per topic) and ask whether to save it or change anything. Only after they agree, or ask you to save, reply with ONLY a fenced JSON block, no other text:
+\`\`\`json
+{"done": true, ${shape}}
+\`\`\`
+Leave out optional keys they had nothing for. Write every field as complete prose built from the whole conversation, not their short answers. Minimums: problemStatement ${String(INTERVIEW_FIELD_MIN_WORDS.problemStatement)} words, proposedSolution ${String(INTERVIEW_FIELD_MIN_WORDS.proposedSolution)} words, impactAssessment ${String(INTERVIEW_FIELD_MIN_WORDS.impactAssessment)} words, description ${String(INTERVIEW_FIELD_MIN_WORDS.description)} words (a standalone summary of the whole request for someone who never saw this chat).
+
+Any reply that isn't that JSON block is shown to the person as your message.`;
+  return saved ? `${base}
+
+${renderSaved(saved)}` : base;
+}
+function toConversationMessages(turns) {
+  const messages = turns.map((t) => ({
+    role: t.role === "agent" ? "assistant" : "user",
+    content: t.content
+  }));
+  if (messages[0]?.role !== "user")
+    messages.unshift({ role: "user", content: STARTER });
+  if (messages[messages.length - 1]?.role !== "user")
+    messages.push({ role: "user", content: NUDGE });
+  return messages;
+}
+function renderConversationPrompt(messages) {
+  const lines = messages.map((m) => `${m.role === "assistant" ? "You" : "Them"}: ${m.content}`);
+  return `The conversation so far:
+
+${lines.join("\n\n")}
+
+Write your next reply to them.`;
+}
+function savedMessage(saved, created, followUp) {
+  const verb = created ? "Saved your request" : "Updated your request";
+  const c = saved.compliance;
+  let text;
+  if (!c) {
+    text = `${verb} "${saved.title}". You can keep talking here to add detail or change anything.`;
+  } else if (meetsComplianceTarget(c)) {
+    text = `${verb} "${saved.title}". It scores ${String(c.overall)}/100, ready for review. You can keep talking here to change anything.`;
+  } else {
+    const gaps = [...c.issues.filter((i) => i.tier === "critical"), ...c.issues.filter((i) => i.tier === "advisory")].slice(0, 4).map((i) => `- ${i.message}`).join("\n");
+    text = `${verb} "${saved.title}". It scores ${String(c.overall)}/100; 90 is the target.${gaps ? ` To raise it:
+${gaps}` : ""}
+
+Tell me more here and I'll update it, or leave it as it is.`;
+  }
+  return followUp ? `${text}
+
+${followUp}` : text;
+}
+async function runConversationStep(input, deps) {
+  const system = buildConversationSystemPrompt(input.saved);
+  const messages = toConversationMessages(input.turns);
+  const locked = input.saved !== null && input.saved.status !== "pending";
+  let requestId = input.saved?.id ?? null;
+  let savedNow = null;
+  let createdHere = false;
+  let qualityRounds = 0;
+  let repairs = 0;
+  for (; ; ) {
+    let reply;
+    try {
+      reply = await deps.reply(system, messages);
+    } catch (error) {
+      if (savedNow)
+        return { kind: "saved", text: savedMessage(savedNow.saved, savedNow.created), ...savedNow };
+      const reason = error instanceof Error ? error.message : "Something went wrong reaching the AI.";
+      return {
+        kind: "error",
+        text: `I couldn't reply just now: ${reason}
+
+Send another message (for example "try again") when you're ready and I'll pick up where we left off.`
+      };
+    }
+    const draft = extractCompletionJson(reply);
+    if (draft) {
+      if (locked) {
+        messages.push({ role: "assistant", content: reply }, { role: "user", content: "That request is locked and can't be changed. Reply to me in plain text instead." });
+        if (++repairs > JSON_REPAIRS)
+          return { kind: "error", text: "This request is locked, so it can't be changed any more." };
+        continue;
+      }
+      let saved;
+      try {
+        saved = await deps.save(requestId, draft);
+      } catch (error) {
+        const reason = error instanceof Error ? error.message : "the save failed";
+        return { kind: "error", text: `I couldn't save the request: ${reason}
+
+Reply "try again" and I'll retry.` };
+      }
+      createdHere ||= requestId === null;
+      savedNow = { saved, created: createdHere };
+      requestId = saved.id;
+      if (meetsComplianceTarget(saved.compliance) || qualityRounds >= CONVERSATION_QUALITY_ROUNDS || !saved.compliance) {
+        return { kind: "saved", text: savedMessage(saved, savedNow.created), ...savedNow };
+      }
+      qualityRounds++;
+      messages.push({ role: "assistant", content: reply }, {
+        role: "user",
+        content: `${buildAuditFeedback(saved.compliance)}
+
+The request IS already saved, and the person will be shown its score. If you ask them something, ask it as a way to improve the saved request; never say it hasn't been saved.`
+      });
+      continue;
+    }
+    if (looksLikeCompletionAttempt(reply)) {
+      if (++repairs > JSON_REPAIRS) {
+        return savedNow ? { kind: "saved", text: savedMessage(savedNow.saved, savedNow.created), ...savedNow } : { kind: "error", text: `I had trouble writing up the request. Reply "try again" and I'll have another go.` };
+      }
+      messages.push({ role: "assistant", content: reply }, { role: "user", content: COMPLETION_REPAIR_INSTRUCTION });
+      continue;
+    }
+    const text = reply.trim();
+    if (savedNow) {
+      return { kind: "saved", text: savedMessage(savedNow.saved, savedNow.created, text || void 0), ...savedNow };
+    }
+    if (!text)
+      return { kind: "error", text: "I didn't get a reply that time. Send another message and I'll try again." };
+    return { kind: "message", text };
+  }
+}
+function savedContextFromRecord(record) {
+  if (typeof record !== "object" || record === null)
+    return null;
+  const r = record;
+  if (typeof r.id !== "string" || typeof r.title !== "string")
+    return null;
+  let structured = r.structuredDesc;
+  if (typeof structured === "string") {
+    try {
+      structured = JSON.parse(structured);
+    } catch {
+      structured = null;
+    }
+  }
+  const fields = {};
+  if (typeof structured === "object" && structured !== null) {
+    for (const [key, value] of Object.entries(structured)) {
+      if (typeof value === "string")
+        fields[key] = value;
+    }
+  }
+  let score = r.complianceScore;
+  if (typeof score === "string") {
+    try {
+      score = JSON.parse(score);
+    } catch {
+      score = null;
+    }
+  }
+  return {
+    id: r.id,
+    title: r.title,
+    status: typeof r.status === "string" ? r.status : "pending",
+    description: typeof r.description === "string" ? r.description : "",
+    fields,
+    compliance: complianceFromRecord(score)
+  };
+}
+function complianceFromRecord(score) {
+  if (typeof score !== "object" || score === null)
+    return null;
+  const s = score;
+  if (typeof s.overall !== "number" || typeof s.tier !== "string")
+    return null;
+  const issues = Array.isArray(s.issues) ? s.issues.filter((i) => typeof i === "object" && i !== null).map((i) => ({
+    message: typeof i.message === "string" ? i.message : typeof i.code === "string" ? i.code : "issue",
+    tier: i.tier === "critical" ? "critical" : "advisory"
+  })) : [];
+  return { overall: s.overall, tier: s.tier, issues };
+}
+var CONVERSATION_QUALITY_ROUNDS, JSON_REPAIRS, STARTER, NUDGE;
+var init_interview_conversation = __esm({
+  "../shared/dist/interview-conversation.js"() {
+    "use strict";
+    init_interview_definition();
+    init_interview_completion();
+    CONVERSATION_QUALITY_ROUNDS = 2;
+    JSON_REPAIRS = 3;
+    STARTER = "Hi! I'd like to propose something.";
+    NUDGE = "(Please continue.)";
+  }
+});
+
+// ../shared/dist/cloud-setup.js
+function isGcpProjectId(value) {
+  return PROJECT_ID.test(value);
+}
+function isGcpProjectNumber(value) {
+  return PROJECT_NUMBER.test(value);
+}
+function isGcpRegion(value) {
+  return GCP_REGIONS.includes(value);
+}
+function isGitHubLogin(value) {
+  return GITHUB_LOGIN.test(value);
+}
+function gcpServiceAccountEmail(projectId) {
+  return `${GCP_DEPLOY_ACCOUNT}@${projectId}.iam.gserviceaccount.com`;
+}
+function gcpWorkloadProvider(projectNumber) {
+  return `projects/${projectNumber}/locations/global/workloadIdentityPools/${GCP_IDENTITY_POOL}/providers/${GCP_IDENTITY_PROVIDER}`;
+}
+function gcpStateBucket(projectId) {
+  return `${projectId}-compbox-tfstate`;
+}
+function buildGcpSetupScript(input) {
+  if (!isGcpProjectId(input.projectId))
+    throw new Error("Not a Google Cloud project ID.");
+  if (!isGcpRegion(input.region))
+    throw new Error("Not a supported region.");
+  if (input.githubOwners.length === 0)
+    throw new Error("Connect GitHub first.");
+  for (const owner of input.githubOwners) {
+    if (!isGitHubLogin(owner))
+      throw new Error(`Not a GitHub account name: ${owner}`);
+  }
+  const owners = [...new Set(input.githubOwners)];
+  const condition = `assertion.repository_owner in [${owners.map((o) => `'${o}'`).join(", ")}]`;
+  const pool = `--location=global --workload-identity-pool=${GCP_IDENTITY_POOL}`;
+  const oidc = [
+    "--issuer-uri=https://token.actions.githubusercontent.com",
+    '--attribute-mapping="google.subject=assertion.sub,attribute.repository=assertion.repository,attribute.repository_owner=assertion.repository_owner"',
+    `--attribute-condition="${condition}"`
+  ].join(" ");
+  return `# CompBox \u2192 Google Cloud (keyless). Paste into Google Cloud Shell.
+set -euo pipefail
+PROJECT=${input.projectId}
+REGION=${input.region}
+SA=${gcpServiceAccountEmail(input.projectId)}
+
+gcloud config set project "$PROJECT"
+gcloud services enable run.googleapis.com artifactregistry.googleapis.com iam.googleapis.com \\
+  iamcredentials.googleapis.com sts.googleapis.com cloudresourcemanager.googleapis.com
+NUMBER=$(gcloud projects describe "$PROJECT" --format='value(projectNumber)')
+
+# The account deploys run as.
+gcloud iam service-accounts describe "$SA" >/dev/null 2>&1 || \\
+  gcloud iam service-accounts create ${GCP_DEPLOY_ACCOUNT} --display-name="CompBox deploys"
+for ROLE in ${GCP_DEPLOY_ROLES.join(" ")}; do
+  gcloud projects add-iam-policy-binding "$PROJECT" --member="serviceAccount:$SA" --role="$ROLE" --condition=None --quiet >/dev/null
+done
+
+# Trust GitHub Actions from your GitHub only: ${owners.join(", ")}.
+gcloud iam workload-identity-pools describe ${GCP_IDENTITY_POOL} --location=global >/dev/null 2>&1 || \\
+  gcloud iam workload-identity-pools create ${GCP_IDENTITY_POOL} --location=global --display-name="CompBox"
+if gcloud iam workload-identity-pools providers describe ${GCP_IDENTITY_PROVIDER} ${pool} >/dev/null 2>&1; then
+  gcloud iam workload-identity-pools providers update-oidc ${GCP_IDENTITY_PROVIDER} ${pool} ${oidc}
+else
+  gcloud iam workload-identity-pools providers create-oidc ${GCP_IDENTITY_PROVIDER} ${pool} ${oidc}
+fi
+for OWNER in ${owners.join(" ")}; do
+  gcloud iam service-accounts add-iam-policy-binding "$SA" --role=roles/iam.workloadIdentityUser --quiet >/dev/null \\
+    --member="principalSet://iam.googleapis.com/projects/$NUMBER/locations/global/workloadIdentityPools/${GCP_IDENTITY_POOL}/attribute.repository_owner/$OWNER"
+done
+
+# Where each project's infrastructure state is kept.
+gcloud storage buckets describe "gs://${gcpStateBucket(input.projectId)}" >/dev/null 2>&1 || \\
+  gcloud storage buckets create "gs://${gcpStateBucket(input.projectId)}" --location="$REGION" --uniform-bucket-level-access
+
+echo
+echo "Done. Your project number is: $NUMBER"
+echo "Paste it into CompBox to finish."
+`;
+}
+var GCP_REGIONS, GCP_DEPLOY_ACCOUNT, GCP_IDENTITY_POOL, GCP_IDENTITY_PROVIDER, GCP_DEPLOY_ROLES, PROJECT_ID, PROJECT_NUMBER, GITHUB_LOGIN, GCP_CONNECT_STEPS, GCP_CONNECT_STEP_LABELS;
+var init_cloud_setup = __esm({
+  "../shared/dist/cloud-setup.js"() {
+    "use strict";
+    GCP_REGIONS = [
+      "us-central1",
+      "us-east1",
+      "us-east4",
+      "us-west1",
+      "us-west2",
+      "northamerica-northeast1",
+      "europe-west1",
+      "europe-west2",
+      "europe-west3",
+      "europe-west4",
+      "asia-south1",
+      "asia-southeast1",
+      "asia-northeast1",
+      "australia-southeast1"
+    ];
+    GCP_DEPLOY_ACCOUNT = "compbox-deploy";
+    GCP_IDENTITY_POOL = "compbox";
+    GCP_IDENTITY_PROVIDER = "github";
+    GCP_DEPLOY_ROLES = [
+      "roles/run.admin",
+      "roles/artifactregistry.admin",
+      "roles/iam.serviceAccountUser",
+      "roles/iam.serviceAccountAdmin",
+      "roles/storage.admin",
+      "roles/serviceusage.serviceUsageConsumer"
+    ];
+    PROJECT_ID = /^[a-z][a-z0-9-]{4,28}[a-z0-9]$/;
+    PROJECT_NUMBER = /^\d{6,20}$/;
+    GITHUB_LOGIN = /^[A-Za-z0-9](?:[A-Za-z0-9-]{0,37}[A-Za-z0-9])?$/;
+    GCP_CONNECT_STEPS = ["project", "services", "account", "identity", "trust", "storage"];
+    GCP_CONNECT_STEP_LABELS = {
+      project: "Checking your project",
+      services: "Turning on Google Cloud services",
+      account: "Creating the deploy account",
+      identity: "Trusting your GitHub",
+      trust: "Letting your GitHub deploy",
+      storage: "Making a place for deploy state"
+    };
+  }
+});
+
+// ../shared/dist/cloud-connect.js
+function isAwsAccountId(value) {
+  return AWS_ACCOUNT.test(value);
+}
+function isAwsRegion(value) {
+  return AWS_REGION.test(value);
+}
+function isAwsRoleArn(value) {
+  return AWS_ROLE_ARN.test(value);
+}
+function isS3BucketName(value) {
+  return S3_BUCKET.test(value);
+}
+function buildAwsConnectTemplate() {
+  const sub = (s) => ({ "Fn::Sub": s });
+  return {
+    AWSTemplateFormatVersion: "2010-09-09",
+    Description: "CompBox keyless deploys: GitHub Actions from your GitHub accounts deploy as a role. No keys are stored.",
+    Parameters: {
+      GitHubOwners: { Type: "CommaDelimitedList", Description: "GitHub accounts whose Actions may deploy." },
+      CompBoxConnectUrl: { Type: "String", Description: "Where the stack tells CompBox it's done." },
+      CompBoxConnectToken: { Type: "String", NoEcho: true, Description: "One-time link from CompBox." }
+    },
+    Resources: {
+      SetupFunctionRole: {
+        Type: "AWS::IAM::Role",
+        Properties: {
+          AssumeRolePolicyDocument: {
+            Version: "2012-10-17",
+            Statement: [{ Effect: "Allow", Principal: { Service: "lambda.amazonaws.com" }, Action: "sts:AssumeRole" }]
+          },
+          ManagedPolicyArns: [sub("arn:${AWS::Partition}:iam::aws:policy/service-role/AWSLambdaBasicExecutionRole")],
+          Policies: [
+            {
+              PolicyName: "github-oidc",
+              PolicyDocument: {
+                Version: "2012-10-17",
+                Statement: [
+                  {
+                    Effect: "Allow",
+                    Action: [
+                      "iam:ListOpenIDConnectProviders",
+                      "iam:GetOpenIDConnectProvider",
+                      "iam:CreateOpenIDConnectProvider",
+                      "iam:AddClientIDToOpenIDConnectProvider"
+                    ],
+                    Resource: "*"
+                  }
+                ]
+              }
+            }
+          ]
+        }
+      },
+      SetupFunction: {
+        Type: "AWS::Lambda::Function",
+        Properties: {
+          Runtime: "python3.12",
+          Handler: "index.handler",
+          Timeout: 60,
+          Role: { "Fn::GetAtt": ["SetupFunctionRole", "Arn"] },
+          Code: { ZipFile: AWS_SETUP_FUNCTION }
+        }
+      },
+      GitHubOidc: {
+        Type: "Custom::GitHubOidc",
+        Properties: { ServiceToken: { "Fn::GetAtt": ["SetupFunction", "Arn"] }, Action: "oidc" }
+      },
+      StateBucket: {
+        Type: "AWS::S3::Bucket",
+        DeletionPolicy: "Retain",
+        UpdateReplacePolicy: "Retain",
+        Properties: {
+          VersioningConfiguration: { Status: "Enabled" },
+          PublicAccessBlockConfiguration: {
+            BlockPublicAcls: true,
+            BlockPublicPolicy: true,
+            IgnorePublicAcls: true,
+            RestrictPublicBuckets: true
+          },
+          BucketEncryption: { ServerSideEncryptionConfiguration: [{ ServerSideEncryptionByDefault: { SSEAlgorithm: "AES256" } }] }
+        }
+      },
+      DeployRole: {
+        Type: "AWS::IAM::Role",
+        Properties: {
+          Description: "CompBox deploys (GitHub Actions, keyless)",
+          AssumeRolePolicyDocument: {
+            Version: "2012-10-17",
+            Statement: [
+              {
+                Effect: "Allow",
+                Principal: { Federated: { "Fn::GetAtt": ["GitHubOidc", "Arn"] } },
+                Action: "sts:AssumeRoleWithWebIdentity",
+                Condition: {
+                  StringEquals: { "token.actions.githubusercontent.com:aud": "sts.amazonaws.com" },
+                  // repo:<owner>/* for every owner.
+                  StringLike: {
+                    "token.actions.githubusercontent.com:sub": {
+                      "Fn::Split": [",", { "Fn::Sub": ["repo:${Owners}/*", { Owners: { "Fn::Join": ["/*,repo:", { Ref: "GitHubOwners" }] } }] }]
+                    }
+                  }
+                }
+              }
+            ]
+          },
+          ManagedPolicyArns: [
+            sub("arn:${AWS::Partition}:iam::aws:policy/AWSAppRunnerFullAccess"),
+            sub("arn:${AWS::Partition}:iam::aws:policy/AmazonEC2ContainerRegistryPowerUser")
+          ],
+          Policies: [
+            {
+              PolicyName: "compbox-deploy",
+              PolicyDocument: {
+                Version: "2012-10-17",
+                Statement: [
+                  {
+                    Sid: "State",
+                    Effect: "Allow",
+                    Action: ["s3:ListBucket", "s3:GetObject", "s3:PutObject", "s3:DeleteObject"],
+                    Resource: [{ "Fn::GetAtt": ["StateBucket", "Arn"] }, sub("${StateBucket.Arn}/*")]
+                  },
+                  {
+                    Sid: "AppRoles",
+                    Effect: "Allow",
+                    Action: [
+                      "iam:GetRole",
+                      "iam:PassRole",
+                      "iam:CreateRole",
+                      "iam:DeleteRole",
+                      "iam:TagRole",
+                      "iam:AttachRolePolicy",
+                      "iam:DetachRolePolicy",
+                      "iam:PutRolePolicy",
+                      "iam:DeleteRolePolicy",
+                      "iam:ListAttachedRolePolicies",
+                      "iam:ListRolePolicies",
+                      "iam:GetRolePolicy"
+                    ],
+                    Resource: sub("arn:${AWS::Partition}:iam::${AWS::AccountId}:role/compbox-*")
+                  }
+                ]
+              }
+            }
+          ]
+        }
+      },
+      Connect: {
+        Type: "Custom::CompBoxConnect",
+        Properties: {
+          ServiceToken: { "Fn::GetAtt": ["SetupFunction", "Arn"] },
+          Action: "notify",
+          Url: { Ref: "CompBoxConnectUrl" },
+          Token: { Ref: "CompBoxConnectToken" },
+          AccountId: { Ref: "AWS::AccountId" },
+          Region: { Ref: "AWS::Region" },
+          RoleArn: { "Fn::GetAtt": ["DeployRole", "Arn"] },
+          Bucket: { Ref: "StateBucket" },
+          // Re-tell CompBox when the GitHub accounts change.
+          Owners: { "Fn::Join": [",", { Ref: "GitHubOwners" }] }
+        }
+      }
+    },
+    Outputs: {
+      DeployRoleArn: { Value: { "Fn::GetAtt": ["DeployRole", "Arn"] } },
+      StateBucket: { Value: { Ref: "StateBucket" } }
+    }
+  };
+}
+function awsQuickCreateUrl(input) {
+  if (!isAwsRegion(input.region))
+    throw new Error("Not an AWS region.");
+  const owners = uniqueOwners(input.githubOwners);
+  const params = new URLSearchParams({
+    templateURL: input.templateUrl,
+    stackName: "CompBox",
+    param_GitHubOwners: owners.join(","),
+    param_CompBoxConnectUrl: input.connectUrl,
+    param_CompBoxConnectToken: input.connectToken
+  });
+  return `https://${input.region}.console.aws.amazon.com/cloudformation/home?region=${input.region}#/stacks/quickcreate?${params.toString()}`;
+}
+function isAzureGuid(value) {
+  return GUID.test(value);
+}
+function isAzureResourceGroup(value) {
+  return RESOURCE_GROUP.test(value);
+}
+function isAzureLocation(value) {
+  return AZURE_LOCATION.test(value);
+}
+function isAzureStorageAccount(value) {
+  return STORAGE_ACCOUNT.test(value);
+}
+function azureGitHubSubject(owner) {
+  return `repository_owner:${owner}`;
+}
+function buildAzureConnectTemplate(input) {
+  const owners = uniqueOwners(input.githubOwners);
+  const identityId = `[resourceId('Microsoft.ManagedIdentity/userAssignedIdentities', '${AZURE_DEPLOY_IDENTITY}')]`;
+  const identityRef = `reference(resourceId('Microsoft.ManagedIdentity/userAssignedIdentities', '${AZURE_DEPLOY_IDENTITY}'), '2023-01-31')`;
+  return {
+    $schema: "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#",
+    contentVersion: "1.0.0.0",
+    metadata: { description: "CompBox keyless deploys: GitHub Actions from your GitHub accounts deploy as a managed identity." },
+    parameters: {
+      location: { type: "string", defaultValue: "[resourceGroup().location]" },
+      githubOwners: { type: "array", defaultValue: owners },
+      connectUrl: { type: "string", defaultValue: input.connectUrl }
+    },
+    variables: {
+      storageName: "[concat('cbstate', uniqueString(resourceGroup().id))]"
+    },
+    resources: [
+      {
+        type: "Microsoft.ManagedIdentity/userAssignedIdentities",
+        apiVersion: "2023-01-31",
+        name: AZURE_DEPLOY_IDENTITY,
+        location: "[parameters('location')]"
+      },
+      {
+        type: "Microsoft.ManagedIdentity/userAssignedIdentities/federatedIdentityCredentials",
+        apiVersion: "2023-01-31",
+        name: `[concat('${AZURE_DEPLOY_IDENTITY}/github-', parameters('githubOwners')[copyIndex()])]`,
+        // Azure rejects concurrent writes to one identity's credentials.
+        copy: { name: "owners", count: "[length(parameters('githubOwners'))]", mode: "Serial", batchSize: 1 },
+        dependsOn: [identityId],
+        properties: {
+          issuer: "https://token.actions.githubusercontent.com",
+          subject: "[concat('repository_owner:', parameters('githubOwners')[copyIndex()])]",
+          audiences: ["api://AzureADTokenExchange"]
+        }
+      },
+      {
+        type: "Microsoft.Authorization/roleAssignments",
+        apiVersion: "2022-04-01",
+        name: `[guid(resourceGroup().id, '${AZURE_DEPLOY_IDENTITY}', 'contributor')]`,
+        dependsOn: [identityId],
+        properties: {
+          roleDefinitionId: `[subscriptionResourceId('Microsoft.Authorization/roleDefinitions', '${AZURE_CONTRIBUTOR}')]`,
+          principalId: `[${identityRef}.principalId]`,
+          principalType: "ServicePrincipal"
+        }
+      },
+      {
+        type: "Microsoft.Storage/storageAccounts",
+        apiVersion: "2023-01-01",
+        name: "[variables('storageName')]",
+        location: "[parameters('location')]",
+        sku: { name: "Standard_LRS" },
+        kind: "StorageV2",
+        properties: { minimumTlsVersion: "TLS1_2", allowBlobPublicAccess: false, supportsHttpsTrafficOnly: true }
+      },
+      {
+        type: "Microsoft.Storage/storageAccounts/blobServices/containers",
+        apiVersion: "2023-01-01",
+        name: "[concat(variables('storageName'), '/default/tfstate')]",
+        dependsOn: ["[resourceId('Microsoft.Storage/storageAccounts', variables('storageName'))]"]
+      },
+      {
+        type: "Microsoft.Authorization/roleAssignments",
+        apiVersion: "2022-04-01",
+        name: `[guid(resourceGroup().id, '${AZURE_DEPLOY_IDENTITY}', 'state')]`,
+        scope: "[concat('Microsoft.Storage/storageAccounts/', variables('storageName'))]",
+        dependsOn: [identityId, "[resourceId('Microsoft.Storage/storageAccounts', variables('storageName'))]"],
+        properties: {
+          roleDefinitionId: `[subscriptionResourceId('Microsoft.Authorization/roleDefinitions', '${AZURE_BLOB_DATA_CONTRIBUTOR}')]`,
+          principalId: `[${identityRef}.principalId]`,
+          principalType: "ServicePrincipal"
+        }
+      },
+      {
+        type: "Microsoft.Resources/deployments",
+        apiVersion: "2022-09-01",
+        name: "compbox-connect",
+        dependsOn: [
+          "owners",
+          `[resourceId('Microsoft.Authorization/roleAssignments', guid(resourceGroup().id, '${AZURE_DEPLOY_IDENTITY}', 'contributor'))]`,
+          "[resourceId('Microsoft.Storage/storageAccounts/blobServices/containers', variables('storageName'), 'default', 'tfstate')]"
+        ],
+        properties: {
+          mode: "Incremental",
+          templateLink: {
+            uri: `[format('{0}&subscriptionId={1}&tenantId={2}&resourceGroup={3}&location={4}&clientId={5}&storageAccount={6}', parameters('connectUrl'), subscription().subscriptionId, subscription().tenantId, uriComponent(resourceGroup().name), uriComponent(parameters('location')), ${identityRef}.clientId, variables('storageName'))]`
+          }
+        }
+      }
+    ],
+    outputs: {
+      clientId: { type: "string", value: `[${identityRef}.clientId]` },
+      storageAccount: { type: "string", value: "[variables('storageName')]" }
+    }
+  };
+}
+function azureDeployUrl(templateUrl) {
+  return `https://portal.azure.com/#create/Microsoft.Template/uri/${encodeURIComponent(templateUrl)}`;
+}
+function uniqueOwners(owners) {
+  if (owners.length === 0)
+    throw new Error("Connect GitHub first.");
+  for (const owner of owners) {
+    if (!isGitHubLogin(owner))
+      throw new Error(`Not a GitHub account name: ${owner}`);
+  }
+  return [...new Set(owners)];
+}
+var AWS_REGIONS, AWS_ACCOUNT, AWS_REGION, AWS_ROLE_ARN, S3_BUCKET, GITHUB_OIDC_THUMBPRINTS, AWS_SETUP_FUNCTION, GUID, RESOURCE_GROUP, AZURE_LOCATION, STORAGE_ACCOUNT, AZURE_DEPLOY_IDENTITY, AZURE_CONTRIBUTOR, AZURE_BLOB_DATA_CONTRIBUTOR, EMPTY_ARM_TEMPLATE;
+var init_cloud_connect = __esm({
+  "../shared/dist/cloud-connect.js"() {
+    "use strict";
+    init_cloud_setup();
+    AWS_REGIONS = [
+      "us-east-1",
+      "us-east-2",
+      "us-west-2",
+      "ca-central-1",
+      "eu-west-1",
+      "eu-west-2",
+      "eu-central-1",
+      "ap-south-1",
+      "ap-southeast-1",
+      "ap-southeast-2",
+      "ap-northeast-1"
+    ];
+    AWS_ACCOUNT = /^\d{12}$/;
+    AWS_REGION = /^[a-z]{2}(?:-gov)?-[a-z]+-\d$/;
+    AWS_ROLE_ARN = /^arn:aws[a-z-]*:iam::\d{12}:role\/[\w+=,.@/-]{1,512}$/;
+    S3_BUCKET = /^[a-z0-9][a-z0-9.-]{1,61}[a-z0-9]$/;
+    GITHUB_OIDC_THUMBPRINTS = ["6938fd4d98bab03faadb97b34396831e3780aea1", "1c58a3a8518e8759bf075b76b750d4f2df264fcd"];
+    AWS_SETUP_FUNCTION = `import json, urllib.error, urllib.request
+import boto3
+
+ISSUER = "token.actions.githubusercontent.com"
+
+
+def respond(event, ok, data=None, reason=""):
+    body = json.dumps({
+        "Status": "SUCCESS" if ok else "FAILED",
+        "Reason": (reason or "See the function's CloudWatch logs")[:1000],
+        "PhysicalResourceId": event.get("PhysicalResourceId") or event["LogicalResourceId"],
+        "StackId": event["StackId"],
+        "RequestId": event["RequestId"],
+        "LogicalResourceId": event["LogicalResourceId"],
+        "Data": data or {},
+    }).encode()
+    req = urllib.request.Request(event["ResponseURL"], data=body, method="PUT", headers={"Content-Type": ""})
+    urllib.request.urlopen(req, timeout=30)
+
+
+def github_oidc():
+    iam = boto3.client("iam")
+    for p in iam.list_open_id_connect_providers()["OpenIDConnectProviderList"]:
+        arn = p["Arn"]
+        if arn.endswith("/" + ISSUER):
+            if "sts.amazonaws.com" not in iam.get_open_id_connect_provider(OpenIDConnectProviderArn=arn)["ClientIDList"]:
+                iam.add_client_id_to_open_id_connect_provider(OpenIDConnectProviderArn=arn, ClientID="sts.amazonaws.com")
+            return arn
+    return iam.create_open_id_connect_provider(
+        Url="https://" + ISSUER, ClientIDList=["sts.amazonaws.com"], ThumbprintList=${JSON.stringify(GITHUB_OIDC_THUMBPRINTS)}
+    )["OpenIDConnectProviderArn"]
+
+
+def notify(p):
+    body = json.dumps({
+        "token": p["Token"], "accountId": p["AccountId"], "region": p["Region"],
+        "roleArn": p["RoleArn"], "stateBucket": p["Bucket"],
+    }).encode()
+    req = urllib.request.Request(p["Url"], data=body, method="POST", headers={"Content-Type": "application/json"})
+    try:
+        urllib.request.urlopen(req, timeout=30)
+    except urllib.error.HTTPError as e:
+        raise RuntimeError("CompBox said: " + e.read().decode(errors="replace")[:500])
+
+
+def handler(event, context):
+    try:
+        props = event["ResourceProperties"]
+        if event["RequestType"] == "Delete":
+            return respond(event, True)
+        if props["Action"] == "oidc":
+            return respond(event, True, {"Arn": github_oidc()})
+        try:
+            notify(props)
+        except Exception:
+            # The connect link expires; a later stack update shouldn't fail on it.
+            if event["RequestType"] != "Update":
+                raise
+        respond(event, True)
+    except Exception as e:
+        print(e)
+        respond(event, False, reason=str(e))
+`;
+    GUID = /^[0-9a-f]{8}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{12}$/i;
+    RESOURCE_GROUP = /^[-\w.()]{0,89}[-\w()]$/;
+    AZURE_LOCATION = /^[a-z0-9]{2,40}$/;
+    STORAGE_ACCOUNT = /^[a-z0-9]{3,24}$/;
+    AZURE_DEPLOY_IDENTITY = "compbox-deploy";
+    AZURE_CONTRIBUTOR = "b24988ac-6180-42a0-ab88-20f7382dd24c";
+    AZURE_BLOB_DATA_CONTRIBUTOR = "ba92f5b4-2d11-453d-a403-e96b0029c9fe";
+    EMPTY_ARM_TEMPLATE = {
+      $schema: "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#",
+      contentVersion: "1.0.0.0",
+      resources: []
+    };
+  }
+});
+
+// ../shared/dist/stack-files.js
+function stackEnvironments(tier) {
+  return STACK_TIERS[tier].environments;
+}
+function deployRunTitle(environment) {
+  return `Deploy to ${environment}`;
+}
+function cloudRunUrl(service, projectNumber, region) {
+  return `https://${service}-${projectNumber}.${region}.run.app`;
+}
+function stackAppName(repoName) {
+  let slug = repoName.toLowerCase().replace(/[^a-z0-9]+/g, "-").replace(/^[^a-z]+/, "").slice(0, 20).replace(/-+$/, "");
+  if (slug.length < 2)
+    slug = `app${slug}`.slice(0, 20);
+  return slug;
+}
+function envSettings(env) {
+  return env === "prod" ? { min: 0, max: 10 } : { min: 0, max: 2 };
+}
+function buildStackFiles(input) {
+  const { tier, app, defaultBranch, cloud } = input;
+  if (!APP.test(app))
+    throw new Error("Not a valid app name.");
+  if (!BRANCH.test(defaultBranch))
+    throw new Error("Not a valid branch name.");
+  const envs = stackEnvironments(tier);
+  const registry = `${cloud.region}-docker.pkg.dev/${cloud.projectId}/${app}`;
+  const files = [];
+  files.push({
+    path: "infra/versions.tf",
+    content: `# Managed by CompBox. Changes here are applied on the next deploy.
+terraform {
+  required_version = ">= 1.6"
+  required_providers {
+    google = {
+      source  = "hashicorp/google"
+      version = "~> 6.0"
+    }
+  }
+  # Bucket and prefix are passed by the deploy workflow.
+  backend "gcs" {}
+}
+
+provider "google" {
+  project = var.project_id
+  region  = var.region
+}
+`
+  });
+  files.push({
+    path: "infra/variables.tf",
+    content: `variable "project_id" {
+  type = string
+}
+
+variable "region" {
+  type = string
+}
+
+variable "app" {
+  type = string
+}
+
+variable "environment" {
+  type = string
+}
+
+variable "min_instances" {
+  type    = number
+  default = 0
+}
+
+variable "max_instances" {
+  type    = number
+  default = 2
+}
+
+# Only used the first time; every deploy sets the real image.
+variable "bootstrap_image" {
+  type    = string
+  default = "us-docker.pkg.dev/cloudrun/container/hello"
+}
+`
+  });
+  files.push({
+    path: "infra/main.tf",
+    content: `locals {
+  service = "\${var.app}-\${var.environment}"
+}
+
+# One image registry for the app, created with dev and shared by every environment.
+resource "google_artifact_registry_repository" "app" {
+  count         = var.environment == "dev" ? 1 : 0
+  repository_id = var.app
+  location      = var.region
+  format        = "DOCKER"
+}
+
+# The account the app runs as in this environment (no permissions by default).
+resource "google_service_account" "runtime" {
+  account_id   = local.service
+  display_name = "\${local.service} (CompBox)"
+}
+
+resource "google_cloud_run_v2_service" "app" {
+  name                = local.service
+  location            = var.region
+  ingress             = "INGRESS_TRAFFIC_ALL"
+  deletion_protection = var.environment == "prod"
+
+  template {
+    service_account = google_service_account.runtime.email
+    scaling {
+      min_instance_count = var.min_instances
+      max_instance_count = var.max_instances
+    }
+    containers {
+      image = var.bootstrap_image
+    }
+  }
+
+  # Deploys change the image; Terraform owns everything else.
+  lifecycle {
+    ignore_changes = [template[0].containers[0].image, client, client_version]
+  }
+}
+
+# Anyone with the link can open it. Remove this to keep the app private.
+resource "google_cloud_run_v2_service_iam_member" "public" {
+  name     = google_cloud_run_v2_service.app.name
+  location = var.region
+  role     = "roles/run.invoker"
+  member   = "allUsers"
+}
+
+output "url" {
+  value = google_cloud_run_v2_service.app.uri
+}
+`
+  });
+  for (const env of envs) {
+    const s = envSettings(env);
+    files.push({
+      path: `infra/envs/${env}.tfvars`,
+      content: `project_id    = "${cloud.projectId}"
+region        = "${cloud.region}"
+app           = "${app}"
+environment   = "${env}"
+min_instances = ${String(s.min)}
+max_instances = ${String(s.max)}
+`
+    });
+  }
+  const options = envs.map((e) => `          - ${e}`).join("\n");
+  files.push({
+    path: ".github/workflows/compbox.yml",
+    content: `# Managed by CompBox: every push to ${defaultBranch} deploys to dev.${envs.length > 1 ? "\n# Stage and prod: Actions \u2192 CompBox \u2192 Run workflow. Prod waits for its environment's approval." : ""}
+name: CompBox
+run-name: Deploy to \${{ inputs.environment || 'dev' }}
+
+on:
+  push:
+    branches: [${JSON.stringify(defaultBranch)}]
+  workflow_dispatch:
+    inputs:
+      environment:
+        description: Where to deploy
+        type: choice
+        default: dev
+        options:
+${options}
+
+permissions:
+  contents: read
+  id-token: write
+
+jobs:
+  deploy:
+    uses: ./.github/workflows/compbox-deploy.yml
+    with:
+      environment: \${{ inputs.environment || 'dev' }}
+`
+  });
+  files.push({
+    path: ".github/workflows/compbox-deploy.yml",
+    content: `# Managed by CompBox. Signs in to Google Cloud without stored keys (Workload Identity).
+name: CompBox deploy
+
+on:
+  workflow_call:
+    inputs:
+      environment:
+        type: string
+        required: true
+
+permissions:
+  contents: read
+  id-token: write
+
+concurrency:
+  group: compbox-\${{ inputs.environment }}
+  cancel-in-progress: false
+
+jobs:
+  deploy:
+    runs-on: ubuntu-latest
+    environment:
+      name: \${{ inputs.environment }}
+      url: \${{ steps.deploy.outputs.url }}
+    env:
+      ENVIRONMENT: \${{ inputs.environment }}
+      PROJECT_ID: ${cloud.projectId}
+      REGION: ${cloud.region}
+      APP: ${app}
+      IMAGE: ${registry}/app:\${{ github.sha }}
+      STATE_BUCKET: ${gcpStateBucket(cloud.projectId)}
+    steps:
+      - uses: actions/checkout@v4
+
+      - uses: google-github-actions/auth@v2
+        with:
+          workload_identity_provider: ${cloud.workloadProvider}
+          service_account: ${cloud.serviceAccountEmail}
+
+      - uses: google-github-actions/setup-gcloud@v2
+
+      - uses: hashicorp/setup-terraform@v3
+
+      - name: Infrastructure
+        working-directory: infra
+        run: |
+          terraform init -input=false -backend-config="bucket=$STATE_BUCKET" -backend-config="prefix=$APP/$ENVIRONMENT"
+          terraform apply -input=false -auto-approve -var-file="envs/$ENVIRONMENT.tfvars"
+
+      - name: Build
+        run: |
+          if [ ! -f Dockerfile ]; then
+            echo "::error::Add a Dockerfile at the repository root: CompBox deploys the app as a container that listens on \\$PORT."
+            exit 1
+          fi
+          gcloud auth configure-docker "$REGION-docker.pkg.dev" --quiet
+          docker build -t "$IMAGE" .
+          docker push "$IMAGE"
+
+      - name: Deploy
+        id: deploy
+        run: |
+          SERVICE="$APP-$ENVIRONMENT"
+          gcloud run deploy "$SERVICE" --image "$IMAGE" --region "$REGION" --project "$PROJECT_ID" --quiet
+          URL=$(gcloud run services describe "$SERVICE" --region "$REGION" --project "$PROJECT_ID" --format='value(status.url)')
+          echo "url=$URL" >> "$GITHUB_OUTPUT"
+          echo "### Live at $URL" >> "$GITHUB_STEP_SUMMARY"
+`
+  });
+  files.push({
+    path: "infra/README.md",
+    content: `# Infrastructure (managed by CompBox)
+
+This project deploys to Google Cloud project \`${cloud.projectId}\` (${cloud.region}) as a Cloud Run service per environment: ${envs.map((e) => `\`${app}-${e}\``).join(", ")}.
+
+- **Dev:** every push to \`${defaultBranch}\` deploys it.${envs.length > 1 ? "\n- **Stage and prod:** in GitHub, Actions \u2192 CompBox \u2192 Run workflow, then pick the environment. Add required reviewers to the `prod` environment (Settings \u2192 Environments) so prod waits for approval." : ""}
+- **The app:** a \`Dockerfile\` at the repository root, for a container that listens on \`$PORT\` (8080).
+- **Sign-in:** GitHub Actions sign in to Google Cloud through Workload Identity \u2014 there are no keys to store or rotate.
+- **Changes:** edit the Terraform here; the next deploy applies it. Services are public by default; remove the \`public\` resource in \`main.tf\` to keep one private.
+`
+  });
+  return files;
+}
+var STACK_TIERS, STACK_WORKFLOW, APP, BRANCH;
+var init_stack_files = __esm({
+  "../shared/dist/stack-files.js"() {
+    "use strict";
+    init_cloud_setup();
+    STACK_TIERS = {
+      dev: { label: "Dev only", environments: ["dev"] },
+      full: { label: "Dev, stage and prod", environments: ["dev", "stage", "prod"] }
+    };
+    STACK_WORKFLOW = "compbox.yml";
+    APP = /^[a-z][a-z0-9-]{1,19}$/;
+    BRANCH = /^[A-Za-z0-9._/-]{1,200}$/;
+  }
+});
+
+// ../shared/dist/github-repo.js
+function githubRepoKey(remote) {
+  if (typeof remote !== "string")
+    return null;
+  const normalized = normalizeGitRemote(remote);
+  const match = /^https:\/\/([^/]+)\/(.*)$/.exec(normalized);
+  if (!match)
+    return null;
+  const host = match[1];
+  const path4 = match[2];
+  if (host !== "github.com" || path4 === void 0)
+    return null;
+  const segments = path4.split("/");
+  if (segments.length !== 2)
+    return null;
+  const [owner, name] = segments;
+  if (!owner || !name)
+    return null;
+  return `${owner}/${name}`.toLowerCase();
+}
+var init_github_repo = __esm({
+  "../shared/dist/github-repo.js"() {
+    "use strict";
+    init_mailbox();
+  }
+});
+
+// ../shared/dist/return-to.js
+function safeReturnTo(value) {
+  if (typeof value !== "string")
+    return null;
+  if (value.length < 1 || value.length > RETURN_TO_MAX_LENGTH)
+    return null;
+  if (!value.startsWith("/"))
+    return null;
+  const second = value.charAt(1);
+  if (second === "/" || second === "\\")
+    return null;
+  if (value.includes("\\"))
+    return null;
+  if (value.includes("://"))
+    return null;
+  for (let i = 0; i < value.length; i++) {
+    const code = value.charCodeAt(i);
+    if (code < 32 || code === 127)
+      return null;
+  }
+  return value;
+}
+var RETURN_TO_MAX_LENGTH;
+var init_return_to = __esm({
+  "../shared/dist/return-to.js"() {
+    "use strict";
+    RETURN_TO_MAX_LENGTH = 512;
+  }
+});
+
 // ../shared/dist/index.js
 var dist_exports = {};
 __export(dist_exports, {
   AI_PROVIDERS: () => AI_PROVIDERS,
   APPEND_DESCRIPTION_MAX: () => APPEND_DESCRIPTION_MAX,
+  AWS_REGIONS: () => AWS_REGIONS,
+  AZURE_DEPLOY_IDENTITY: () => AZURE_DEPLOY_IDENTITY,
   COMPLETION_REPAIR_INSTRUCTION: () => COMPLETION_REPAIR_INSTRUCTION,
+  CONVERSATION_QUALITY_ROUNDS: () => CONVERSATION_QUALITY_ROUNDS,
   DESCRIPTION_MAX: () => DESCRIPTION_MAX,
+  EMPTY_ARM_TEMPLATE: () => EMPTY_ARM_TEMPLATE,
+  GCP_CONNECT_STEPS: () => GCP_CONNECT_STEPS,
+  GCP_CONNECT_STEP_LABELS: () => GCP_CONNECT_STEP_LABELS,
+  GCP_DEPLOY_ACCOUNT: () => GCP_DEPLOY_ACCOUNT,
+  GCP_DEPLOY_ROLES: () => GCP_DEPLOY_ROLES,
+  GCP_IDENTITY_POOL: () => GCP_IDENTITY_POOL,
+  GCP_IDENTITY_PROVIDER: () => GCP_IDENTITY_PROVIDER,
+  GCP_REGIONS: () => GCP_REGIONS,
   INTERVIEW_DEFINITION: () => INTERVIEW_DEFINITION,
   INTERVIEW_FIELD_MIN_WORDS: () => INTERVIEW_FIELD_MIN_WORDS,
   INTERVIEW_STATUSES: () => INTERVIEW_STATUSES,
@@ -846,6 +1983,9 @@ __export(dist_exports, {
   MODEL_CATALOG: () => MODEL_CATALOG,
   ORG_ROLES: () => ORG_ROLES,
   PXPIPE_DEFAULT_PROXY_URL: () => PXPIPE_DEFAULT_PROXY_URL,
+  RETURN_TO_MAX_LENGTH: () => RETURN_TO_MAX_LENGTH,
+  STACK_TIERS: () => STACK_TIERS,
+  STACK_WORKFLOW: () => STACK_WORKFLOW,
   START_EXECUTION_KINDS: () => START_EXECUTION_KINDS,
   SUBSCRIPTION_STATUSES: () => SUBSCRIPTION_STATUSES,
   SUMMARY_MAX: () => SUMMARY_MAX,
@@ -855,23 +1995,50 @@ __export(dist_exports, {
   agentSchema: () => agentSchema,
   aiProviderValues: () => aiProviderValues,
   aiRouteValues: () => aiRouteValues,
+  awsQuickCreateUrl: () => awsQuickCreateUrl,
+  azureDeployUrl: () => azureDeployUrl,
+  azureGitHubSubject: () => azureGitHubSubject,
   buildAuditFeedback: () => buildAuditFeedback,
+  buildAwsConnectTemplate: () => buildAwsConnectTemplate,
+  buildAzureConnectTemplate: () => buildAzureConnectTemplate,
+  buildConversationSystemPrompt: () => buildConversationSystemPrompt,
+  buildGcpSetupScript: () => buildGcpSetupScript,
   buildInterviewSystemPrompt: () => buildInterviewSystemPrompt,
+  buildStackFiles: () => buildStackFiles,
+  cloudRunUrl: () => cloudRunUrl,
+  complianceFromRecord: () => complianceFromRecord,
+  deployRunTitle: () => deployRunTitle,
   err: () => err,
   extractCompletionJson: () => extractCompletionJson,
+  gcpServiceAccountEmail: () => gcpServiceAccountEmail,
+  gcpStateBucket: () => gcpStateBucket,
+  gcpWorkloadProvider: () => gcpWorkloadProvider,
   getAnthropicProxyUrl: () => getAnthropicProxyUrl,
   getModelById: () => getModelById,
   getModelDisplayName: () => getModelDisplayName,
   getOpenAiProxyUrl: () => getOpenAiProxyUrl,
+  githubRepoKey: () => githubRepoKey,
   instructionSchema: () => instructionSchema,
   interviewFieldKeys: () => interviewFieldKeys,
   interviewSectionKeys: () => interviewSectionKeys,
+  isAwsAccountId: () => isAwsAccountId,
+  isAwsRegion: () => isAwsRegion,
+  isAwsRoleArn: () => isAwsRoleArn,
+  isAzureGuid: () => isAzureGuid,
+  isAzureLocation: () => isAzureLocation,
+  isAzureResourceGroup: () => isAzureResourceGroup,
+  isAzureStorageAccount: () => isAzureStorageAccount,
+  isGcpProjectId: () => isGcpProjectId,
+  isGcpProjectNumber: () => isGcpProjectNumber,
+  isGcpRegion: () => isGcpRegion,
+  isGitHubLogin: () => isGitHubLogin,
   isInterviewStatus: () => isInterviewStatus,
   isJobStatus: () => isJobStatus,
   isJobType: () => isJobType,
   isMachineStatus: () => isMachineStatus,
   isOrgRole: () => isOrgRole,
   isPxpipeEnabled: () => isPxpipeEnabled,
+  isS3BucketName: () => isS3BucketName,
   isSessionErrorEvent: () => isSessionErrorEvent,
   isSessionFeatureEvent: () => isSessionFeatureEvent,
   isSessionLifecycleEvent: () => isSessionLifecycleEvent,
@@ -889,12 +2056,20 @@ __export(dist_exports, {
   normalizeGitRemote: () => normalizeGitRemote,
   ok: () => ok,
   probeProxyHealth: () => probeProxyHealth,
+  renderConversationPrompt: () => renderConversationPrompt,
   resolveRouting: () => resolveRouting,
+  runConversationStep: () => runConversationStep,
+  safeReturnTo: () => safeReturnTo,
   safeValidateSkillPackManifest: () => safeValidateSkillPackManifest,
+  savedContextFromRecord: () => savedContextFromRecord,
+  savedMessage: () => savedMessage,
   skillPackManifestSchema: () => skillPackManifestSchema,
   skillSchema: () => skillSchema,
   sleep: () => sleep,
+  stackAppName: () => stackAppName,
+  stackEnvironments: () => stackEnvironments,
   thinkingLevelValues: () => thinkingLevelValues,
+  toConversationMessages: () => toConversationMessages,
   validatePackName: () => validatePackName,
   validateSkillPackManifest: () => validateSkillPackManifest
 });
@@ -909,6 +2084,12 @@ var init_dist = __esm({
     init_pxpipe();
     init_interview_definition();
     init_interview_completion();
+    init_interview_conversation();
+    init_cloud_setup();
+    init_cloud_connect();
+    init_stack_files();
+    init_github_repo();
+    init_return_to();
   }
 });
 
@@ -11089,7 +12270,7 @@ function withLegacyToolCallRewrite(transport) {
 var SERVER_NAME = "compbox-mcp";
 function resolveServerVersion() {
   if (true) {
-    return "1.19.0";
+    return "1.21.0";
   }
   const require2 = createRequire(import.meta.url);
   for (const candidate of ["../package.json", "./package.json"]) {

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@mycompbox/compbox-mcp",
-  "version": "1.19.0",
+  "version": "1.21.0",
   "description": "CompBox MCP server - Uses HTTP API client (no direct database access)",
   "license": "MIT",
   "type": "module",