@mycompbox/compbox-mcp 1.20.0 → 1.21.1

package/index.js

@@ -178,6 +178,34 @@ var init_organization = __esm({
   }
 });
 
+// ../shared/dist/types/github.js
+var init_github = __esm({
+  "../shared/dist/types/github.js"() {
+    "use strict";
+  }
+});
+
+// ../shared/dist/types/cloud.js
+var init_cloud = __esm({
+  "../shared/dist/types/cloud.js"() {
+    "use strict";
+  }
+});
+
+// ../shared/dist/types/stack.js
+var init_stack = __esm({
+  "../shared/dist/types/stack.js"() {
+    "use strict";
+  }
+});
+
+// ../shared/dist/types/deployment.js
+var init_deployment = __esm({
+  "../shared/dist/types/deployment.js"() {
+    "use strict";
+  }
+});
+
 // ../shared/dist/types/index.js
 var init_types = __esm({
   "../shared/dist/types/index.js"() {
@@ -190,6 +218,10 @@ var init_types = __esm({
     init_interview();
     init_attachment();
     init_organization();
+    init_github();
+    init_cloud();
+    init_stack();
+    init_deployment();
   }
 });
 
@@ -1050,14 +1082,898 @@ var init_interview_conversation = __esm({
   }
 });
 
+// ../shared/dist/cloud-setup.js
+function isGcpProjectId(value) {
+  return PROJECT_ID.test(value);
+}
+function isGcpProjectNumber(value) {
+  return PROJECT_NUMBER.test(value);
+}
+function isGcpRegion(value) {
+  return GCP_REGIONS.includes(value);
+}
+function isGitHubLogin(value) {
+  return GITHUB_LOGIN.test(value);
+}
+function gcpServiceAccountEmail(projectId) {
+  return `${GCP_DEPLOY_ACCOUNT}@${projectId}.iam.gserviceaccount.com`;
+}
+function gcpWorkloadProvider(projectNumber) {
+  return `projects/${projectNumber}/locations/global/workloadIdentityPools/${GCP_IDENTITY_POOL}/providers/${GCP_IDENTITY_PROVIDER}`;
+}
+function gcpStateBucket(projectId) {
+  return `${projectId}-compbox-tfstate`;
+}
+function buildGcpSetupScript(input) {
+  if (!isGcpProjectId(input.projectId))
+    throw new Error("Not a Google Cloud project ID.");
+  if (!isGcpRegion(input.region))
+    throw new Error("Not a supported region.");
+  if (input.githubOwners.length === 0)
+    throw new Error("Connect GitHub first.");
+  for (const owner of input.githubOwners) {
+    if (!isGitHubLogin(owner))
+      throw new Error(`Not a GitHub account name: ${owner}`);
+  }
+  const owners = [...new Set(input.githubOwners)];
+  const condition = `assertion.repository_owner in [${owners.map((o) => `'${o}'`).join(", ")}]`;
+  const pool = `--location=global --workload-identity-pool=${GCP_IDENTITY_POOL}`;
+  const oidc = [
+    "--issuer-uri=https://token.actions.githubusercontent.com",
+    '--attribute-mapping="google.subject=assertion.sub,attribute.repository=assertion.repository,attribute.repository_owner=assertion.repository_owner"',
+    `--attribute-condition="${condition}"`
+  ].join(" ");
+  return `# CompBox \u2192 Google Cloud (keyless). Paste into Google Cloud Shell.
+set -euo pipefail
+PROJECT=${input.projectId}
+REGION=${input.region}
+SA=${gcpServiceAccountEmail(input.projectId)}
+
+gcloud config set project "$PROJECT"
+gcloud services enable run.googleapis.com artifactregistry.googleapis.com iam.googleapis.com \\
+  iamcredentials.googleapis.com sts.googleapis.com cloudresourcemanager.googleapis.com
+NUMBER=$(gcloud projects describe "$PROJECT" --format='value(projectNumber)')
+
+# The account deploys run as.
+gcloud iam service-accounts describe "$SA" >/dev/null 2>&1 || \\
+  gcloud iam service-accounts create ${GCP_DEPLOY_ACCOUNT} --display-name="CompBox deploys"
+for ROLE in ${GCP_DEPLOY_ROLES.join(" ")}; do
+  gcloud projects add-iam-policy-binding "$PROJECT" --member="serviceAccount:$SA" --role="$ROLE" --condition=None --quiet >/dev/null
+done
+
+# Trust GitHub Actions from your GitHub only: ${owners.join(", ")}.
+gcloud iam workload-identity-pools describe ${GCP_IDENTITY_POOL} --location=global >/dev/null 2>&1 || \\
+  gcloud iam workload-identity-pools create ${GCP_IDENTITY_POOL} --location=global --display-name="CompBox"
+if gcloud iam workload-identity-pools providers describe ${GCP_IDENTITY_PROVIDER} ${pool} >/dev/null 2>&1; then
+  gcloud iam workload-identity-pools providers update-oidc ${GCP_IDENTITY_PROVIDER} ${pool} ${oidc}
+else
+  gcloud iam workload-identity-pools providers create-oidc ${GCP_IDENTITY_PROVIDER} ${pool} ${oidc}
+fi
+for OWNER in ${owners.join(" ")}; do
+  gcloud iam service-accounts add-iam-policy-binding "$SA" --role=roles/iam.workloadIdentityUser --quiet >/dev/null \\
+    --member="principalSet://iam.googleapis.com/projects/$NUMBER/locations/global/workloadIdentityPools/${GCP_IDENTITY_POOL}/attribute.repository_owner/$OWNER"
+done
+
+# Where each project's infrastructure state is kept.
+gcloud storage buckets describe "gs://${gcpStateBucket(input.projectId)}" >/dev/null 2>&1 || \\
+  gcloud storage buckets create "gs://${gcpStateBucket(input.projectId)}" --location="$REGION" --uniform-bucket-level-access
+
+echo
+echo "Done. Your project number is: $NUMBER"
+echo "Paste it into CompBox to finish."
+`;
+}
+var GCP_REGIONS, GCP_DEPLOY_ACCOUNT, GCP_IDENTITY_POOL, GCP_IDENTITY_PROVIDER, GCP_DEPLOY_ROLES, PROJECT_ID, PROJECT_NUMBER, GITHUB_LOGIN, GCP_CONNECT_STEPS, GCP_CONNECT_STEP_LABELS;
+var init_cloud_setup = __esm({
+  "../shared/dist/cloud-setup.js"() {
+    "use strict";
+    GCP_REGIONS = [
+      "us-central1",
+      "us-east1",
+      "us-east4",
+      "us-west1",
+      "us-west2",
+      "northamerica-northeast1",
+      "europe-west1",
+      "europe-west2",
+      "europe-west3",
+      "europe-west4",
+      "asia-south1",
+      "asia-southeast1",
+      "asia-northeast1",
+      "australia-southeast1"
+    ];
+    GCP_DEPLOY_ACCOUNT = "compbox-deploy";
+    GCP_IDENTITY_POOL = "compbox";
+    GCP_IDENTITY_PROVIDER = "github";
+    GCP_DEPLOY_ROLES = [
+      "roles/run.admin",
+      "roles/artifactregistry.admin",
+      "roles/iam.serviceAccountUser",
+      "roles/iam.serviceAccountAdmin",
+      "roles/storage.admin",
+      "roles/serviceusage.serviceUsageConsumer"
+    ];
+    PROJECT_ID = /^[a-z][a-z0-9-]{4,28}[a-z0-9]$/;
+    PROJECT_NUMBER = /^\d{6,20}$/;
+    GITHUB_LOGIN = /^[A-Za-z0-9](?:[A-Za-z0-9-]{0,37}[A-Za-z0-9])?$/;
+    GCP_CONNECT_STEPS = ["project", "services", "account", "identity", "trust", "storage"];
+    GCP_CONNECT_STEP_LABELS = {
+      project: "Checking your project",
+      services: "Turning on Google Cloud services",
+      account: "Creating the deploy account",
+      identity: "Trusting your GitHub",
+      trust: "Letting your GitHub deploy",
+      storage: "Making a place for deploy state"
+    };
+  }
+});
+
+// ../shared/dist/cloud-connect.js
+function isAwsAccountId(value) {
+  return AWS_ACCOUNT.test(value);
+}
+function isAwsRegion(value) {
+  return AWS_REGION.test(value);
+}
+function isAwsRoleArn(value) {
+  return AWS_ROLE_ARN.test(value);
+}
+function isS3BucketName(value) {
+  return S3_BUCKET.test(value);
+}
+function buildAwsConnectTemplate() {
+  const sub = (s) => ({ "Fn::Sub": s });
+  return {
+    AWSTemplateFormatVersion: "2010-09-09",
+    Description: "CompBox keyless deploys: GitHub Actions from your GitHub accounts deploy as a role. No keys are stored.",
+    Parameters: {
+      GitHubOwners: { Type: "CommaDelimitedList", Description: "GitHub accounts whose Actions may deploy." },
+      CompBoxConnectUrl: { Type: "String", Description: "Where the stack tells CompBox it's done." },
+      CompBoxConnectToken: { Type: "String", NoEcho: true, Description: "One-time link from CompBox." }
+    },
+    Resources: {
+      SetupFunctionRole: {
+        Type: "AWS::IAM::Role",
+        Properties: {
+          AssumeRolePolicyDocument: {
+            Version: "2012-10-17",
+            Statement: [{ Effect: "Allow", Principal: { Service: "lambda.amazonaws.com" }, Action: "sts:AssumeRole" }]
+          },
+          ManagedPolicyArns: [sub("arn:${AWS::Partition}:iam::aws:policy/service-role/AWSLambdaBasicExecutionRole")],
+          Policies: [
+            {
+              PolicyName: "github-oidc",
+              PolicyDocument: {
+                Version: "2012-10-17",
+                Statement: [
+                  {
+                    Effect: "Allow",
+                    Action: [
+                      "iam:ListOpenIDConnectProviders",
+                      "iam:GetOpenIDConnectProvider",
+                      "iam:CreateOpenIDConnectProvider",
+                      "iam:AddClientIDToOpenIDConnectProvider"
+                    ],
+                    Resource: "*"
+                  }
+                ]
+              }
+            }
+          ]
+        }
+      },
+      SetupFunction: {
+        Type: "AWS::Lambda::Function",
+        Properties: {
+          Runtime: "python3.12",
+          Handler: "index.handler",
+          Timeout: 60,
+          Role: { "Fn::GetAtt": ["SetupFunctionRole", "Arn"] },
+          Code: { ZipFile: AWS_SETUP_FUNCTION }
+        }
+      },
+      GitHubOidc: {
+        Type: "Custom::GitHubOidc",
+        Properties: { ServiceToken: { "Fn::GetAtt": ["SetupFunction", "Arn"] }, Action: "oidc" }
+      },
+      StateBucket: {
+        Type: "AWS::S3::Bucket",
+        DeletionPolicy: "Retain",
+        UpdateReplacePolicy: "Retain",
+        Properties: {
+          VersioningConfiguration: { Status: "Enabled" },
+          PublicAccessBlockConfiguration: {
+            BlockPublicAcls: true,
+            BlockPublicPolicy: true,
+            IgnorePublicAcls: true,
+            RestrictPublicBuckets: true
+          },
+          BucketEncryption: { ServerSideEncryptionConfiguration: [{ ServerSideEncryptionByDefault: { SSEAlgorithm: "AES256" } }] }
+        }
+      },
+      DeployRole: {
+        Type: "AWS::IAM::Role",
+        Properties: {
+          Description: "CompBox deploys (GitHub Actions, keyless)",
+          AssumeRolePolicyDocument: {
+            Version: "2012-10-17",
+            Statement: [
+              {
+                Effect: "Allow",
+                Principal: { Federated: { "Fn::GetAtt": ["GitHubOidc", "Arn"] } },
+                Action: "sts:AssumeRoleWithWebIdentity",
+                Condition: {
+                  StringEquals: { "token.actions.githubusercontent.com:aud": "sts.amazonaws.com" },
+                  // repo:<owner>/* for every owner.
+                  StringLike: {
+                    "token.actions.githubusercontent.com:sub": {
+                      "Fn::Split": [",", { "Fn::Sub": ["repo:${Owners}/*", { Owners: { "Fn::Join": ["/*,repo:", { Ref: "GitHubOwners" }] } }] }]
+                    }
+                  }
+                }
+              }
+            ]
+          },
+          ManagedPolicyArns: [
+            sub("arn:${AWS::Partition}:iam::aws:policy/AWSAppRunnerFullAccess"),
+            sub("arn:${AWS::Partition}:iam::aws:policy/AmazonEC2ContainerRegistryPowerUser")
+          ],
+          Policies: [
+            {
+              PolicyName: "compbox-deploy",
+              PolicyDocument: {
+                Version: "2012-10-17",
+                Statement: [
+                  {
+                    Sid: "State",
+                    Effect: "Allow",
+                    Action: ["s3:ListBucket", "s3:GetObject", "s3:PutObject", "s3:DeleteObject"],
+                    Resource: [{ "Fn::GetAtt": ["StateBucket", "Arn"] }, sub("${StateBucket.Arn}/*")]
+                  },
+                  {
+                    Sid: "AppRoles",
+                    Effect: "Allow",
+                    Action: [
+                      "iam:GetRole",
+                      "iam:PassRole",
+                      "iam:CreateRole",
+                      "iam:DeleteRole",
+                      "iam:TagRole",
+                      "iam:AttachRolePolicy",
+                      "iam:DetachRolePolicy",
+                      "iam:PutRolePolicy",
+                      "iam:DeleteRolePolicy",
+                      "iam:ListAttachedRolePolicies",
+                      "iam:ListRolePolicies",
+                      "iam:GetRolePolicy"
+                    ],
+                    Resource: sub("arn:${AWS::Partition}:iam::${AWS::AccountId}:role/compbox-*")
+                  }
+                ]
+              }
+            }
+          ]
+        }
+      },
+      Connect: {
+        Type: "Custom::CompBoxConnect",
+        Properties: {
+          ServiceToken: { "Fn::GetAtt": ["SetupFunction", "Arn"] },
+          Action: "notify",
+          Url: { Ref: "CompBoxConnectUrl" },
+          Token: { Ref: "CompBoxConnectToken" },
+          AccountId: { Ref: "AWS::AccountId" },
+          Region: { Ref: "AWS::Region" },
+          RoleArn: { "Fn::GetAtt": ["DeployRole", "Arn"] },
+          Bucket: { Ref: "StateBucket" },
+          // Re-tell CompBox when the GitHub accounts change.
+          Owners: { "Fn::Join": [",", { Ref: "GitHubOwners" }] }
+        }
+      }
+    },
+    Outputs: {
+      DeployRoleArn: { Value: { "Fn::GetAtt": ["DeployRole", "Arn"] } },
+      StateBucket: { Value: { Ref: "StateBucket" } }
+    }
+  };
+}
+function awsQuickCreateUrl(input) {
+  if (!isAwsRegion(input.region))
+    throw new Error("Not an AWS region.");
+  const owners = uniqueOwners(input.githubOwners);
+  const params = new URLSearchParams({
+    templateURL: input.templateUrl,
+    stackName: "CompBox",
+    param_GitHubOwners: owners.join(","),
+    param_CompBoxConnectUrl: input.connectUrl,
+    param_CompBoxConnectToken: input.connectToken
+  });
+  return `https://${input.region}.console.aws.amazon.com/cloudformation/home?region=${input.region}#/stacks/quickcreate?${params.toString()}`;
+}
+function isAzureGuid(value) {
+  return GUID.test(value);
+}
+function isAzureResourceGroup(value) {
+  return RESOURCE_GROUP.test(value);
+}
+function isAzureLocation(value) {
+  return AZURE_LOCATION.test(value);
+}
+function isAzureStorageAccount(value) {
+  return STORAGE_ACCOUNT.test(value);
+}
+function azureGitHubSubject(owner) {
+  return `repository_owner:${owner}`;
+}
+function buildAzureConnectTemplate(input) {
+  const owners = uniqueOwners(input.githubOwners);
+  const identityId = `[resourceId('Microsoft.ManagedIdentity/userAssignedIdentities', '${AZURE_DEPLOY_IDENTITY}')]`;
+  const identityRef = `reference(resourceId('Microsoft.ManagedIdentity/userAssignedIdentities', '${AZURE_DEPLOY_IDENTITY}'), '2023-01-31')`;
+  return {
+    $schema: "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#",
+    contentVersion: "1.0.0.0",
+    metadata: { description: "CompBox keyless deploys: GitHub Actions from your GitHub accounts deploy as a managed identity." },
+    parameters: {
+      location: { type: "string", defaultValue: "[resourceGroup().location]" },
+      githubOwners: { type: "array", defaultValue: owners },
+      connectUrl: { type: "string", defaultValue: input.connectUrl }
+    },
+    variables: {
+      storageName: "[concat('cbstate', uniqueString(resourceGroup().id))]"
+    },
+    resources: [
+      {
+        type: "Microsoft.ManagedIdentity/userAssignedIdentities",
+        apiVersion: "2023-01-31",
+        name: AZURE_DEPLOY_IDENTITY,
+        location: "[parameters('location')]"
+      },
+      {
+        type: "Microsoft.ManagedIdentity/userAssignedIdentities/federatedIdentityCredentials",
+        apiVersion: "2023-01-31",
+        name: `[concat('${AZURE_DEPLOY_IDENTITY}/github-', parameters('githubOwners')[copyIndex()])]`,
+        // Azure rejects concurrent writes to one identity's credentials.
+        copy: { name: "owners", count: "[length(parameters('githubOwners'))]", mode: "Serial", batchSize: 1 },
+        dependsOn: [identityId],
+        properties: {
+          issuer: "https://token.actions.githubusercontent.com",
+          subject: "[concat('repository_owner:', parameters('githubOwners')[copyIndex()])]",
+          audiences: ["api://AzureADTokenExchange"]
+        }
+      },
+      {
+        type: "Microsoft.Authorization/roleAssignments",
+        apiVersion: "2022-04-01",
+        name: `[guid(resourceGroup().id, '${AZURE_DEPLOY_IDENTITY}', 'contributor')]`,
+        dependsOn: [identityId],
+        properties: {
+          roleDefinitionId: `[subscriptionResourceId('Microsoft.Authorization/roleDefinitions', '${AZURE_CONTRIBUTOR}')]`,
+          principalId: `[${identityRef}.principalId]`,
+          principalType: "ServicePrincipal"
+        }
+      },
+      {
+        type: "Microsoft.Storage/storageAccounts",
+        apiVersion: "2023-01-01",
+        name: "[variables('storageName')]",
+        location: "[parameters('location')]",
+        sku: { name: "Standard_LRS" },
+        kind: "StorageV2",
+        properties: { minimumTlsVersion: "TLS1_2", allowBlobPublicAccess: false, supportsHttpsTrafficOnly: true }
+      },
+      {
+        type: "Microsoft.Storage/storageAccounts/blobServices/containers",
+        apiVersion: "2023-01-01",
+        name: "[concat(variables('storageName'), '/default/tfstate')]",
+        dependsOn: ["[resourceId('Microsoft.Storage/storageAccounts', variables('storageName'))]"]
+      },
+      {
+        type: "Microsoft.Authorization/roleAssignments",
+        apiVersion: "2022-04-01",
+        name: `[guid(resourceGroup().id, '${AZURE_DEPLOY_IDENTITY}', 'state')]`,
+        scope: "[concat('Microsoft.Storage/storageAccounts/', variables('storageName'))]",
+        dependsOn: [identityId, "[resourceId('Microsoft.Storage/storageAccounts', variables('storageName'))]"],
+        properties: {
+          roleDefinitionId: `[subscriptionResourceId('Microsoft.Authorization/roleDefinitions', '${AZURE_BLOB_DATA_CONTRIBUTOR}')]`,
+          principalId: `[${identityRef}.principalId]`,
+          principalType: "ServicePrincipal"
+        }
+      },
+      {
+        type: "Microsoft.Resources/deployments",
+        apiVersion: "2022-09-01",
+        name: "compbox-connect",
+        dependsOn: [
+          "owners",
+          `[resourceId('Microsoft.Authorization/roleAssignments', guid(resourceGroup().id, '${AZURE_DEPLOY_IDENTITY}', 'contributor'))]`,
+          "[resourceId('Microsoft.Storage/storageAccounts/blobServices/containers', variables('storageName'), 'default', 'tfstate')]"
+        ],
+        properties: {
+          mode: "Incremental",
+          templateLink: {
+            uri: `[format('{0}&subscriptionId={1}&tenantId={2}&resourceGroup={3}&location={4}&clientId={5}&storageAccount={6}', parameters('connectUrl'), subscription().subscriptionId, subscription().tenantId, uriComponent(resourceGroup().name), uriComponent(parameters('location')), ${identityRef}.clientId, variables('storageName'))]`
+          }
+        }
+      }
+    ],
+    outputs: {
+      clientId: { type: "string", value: `[${identityRef}.clientId]` },
+      storageAccount: { type: "string", value: "[variables('storageName')]" }
+    }
+  };
+}
+function azureDeployUrl(templateUrl) {
+  return `https://portal.azure.com/#create/Microsoft.Template/uri/${encodeURIComponent(templateUrl)}`;
+}
+function uniqueOwners(owners) {
+  if (owners.length === 0)
+    throw new Error("Connect GitHub first.");
+  for (const owner of owners) {
+    if (!isGitHubLogin(owner))
+      throw new Error(`Not a GitHub account name: ${owner}`);
+  }
+  return [...new Set(owners)];
+}
+var AWS_REGIONS, AWS_ACCOUNT, AWS_REGION, AWS_ROLE_ARN, S3_BUCKET, GITHUB_OIDC_THUMBPRINTS, AWS_SETUP_FUNCTION, GUID, RESOURCE_GROUP, AZURE_LOCATION, STORAGE_ACCOUNT, AZURE_DEPLOY_IDENTITY, AZURE_CONTRIBUTOR, AZURE_BLOB_DATA_CONTRIBUTOR, EMPTY_ARM_TEMPLATE;
+var init_cloud_connect = __esm({
+  "../shared/dist/cloud-connect.js"() {
+    "use strict";
+    init_cloud_setup();
+    AWS_REGIONS = [
+      "us-east-1",
+      "us-east-2",
+      "us-west-2",
+      "ca-central-1",
+      "eu-west-1",
+      "eu-west-2",
+      "eu-central-1",
+      "ap-south-1",
+      "ap-southeast-1",
+      "ap-southeast-2",
+      "ap-northeast-1"
+    ];
+    AWS_ACCOUNT = /^\d{12}$/;
+    AWS_REGION = /^[a-z]{2}(?:-gov)?-[a-z]+-\d$/;
+    AWS_ROLE_ARN = /^arn:aws[a-z-]*:iam::\d{12}:role\/[\w+=,.@/-]{1,512}$/;
+    S3_BUCKET = /^[a-z0-9][a-z0-9.-]{1,61}[a-z0-9]$/;
+    GITHUB_OIDC_THUMBPRINTS = ["6938fd4d98bab03faadb97b34396831e3780aea1", "1c58a3a8518e8759bf075b76b750d4f2df264fcd"];
+    AWS_SETUP_FUNCTION = `import json, urllib.error, urllib.request
+import boto3
+
+ISSUER = "token.actions.githubusercontent.com"
+
+
+def respond(event, ok, data=None, reason=""):
+    body = json.dumps({
+        "Status": "SUCCESS" if ok else "FAILED",
+        "Reason": (reason or "See the function's CloudWatch logs")[:1000],
+        "PhysicalResourceId": event.get("PhysicalResourceId") or event["LogicalResourceId"],
+        "StackId": event["StackId"],
+        "RequestId": event["RequestId"],
+        "LogicalResourceId": event["LogicalResourceId"],
+        "Data": data or {},
+    }).encode()
+    req = urllib.request.Request(event["ResponseURL"], data=body, method="PUT", headers={"Content-Type": ""})
+    urllib.request.urlopen(req, timeout=30)
+
+
+def github_oidc():
+    iam = boto3.client("iam")
+    for p in iam.list_open_id_connect_providers()["OpenIDConnectProviderList"]:
+        arn = p["Arn"]
+        if arn.endswith("/" + ISSUER):
+            if "sts.amazonaws.com" not in iam.get_open_id_connect_provider(OpenIDConnectProviderArn=arn)["ClientIDList"]:
+                iam.add_client_id_to_open_id_connect_provider(OpenIDConnectProviderArn=arn, ClientID="sts.amazonaws.com")
+            return arn
+    return iam.create_open_id_connect_provider(
+        Url="https://" + ISSUER, ClientIDList=["sts.amazonaws.com"], ThumbprintList=${JSON.stringify(GITHUB_OIDC_THUMBPRINTS)}
+    )["OpenIDConnectProviderArn"]
+
+
+def notify(p):
+    body = json.dumps({
+        "token": p["Token"], "accountId": p["AccountId"], "region": p["Region"],
+        "roleArn": p["RoleArn"], "stateBucket": p["Bucket"],
+    }).encode()
+    req = urllib.request.Request(p["Url"], data=body, method="POST", headers={"Content-Type": "application/json"})
+    try:
+        urllib.request.urlopen(req, timeout=30)
+    except urllib.error.HTTPError as e:
+        raise RuntimeError("CompBox said: " + e.read().decode(errors="replace")[:500])
+
+
+def handler(event, context):
+    try:
+        props = event["ResourceProperties"]
+        if event["RequestType"] == "Delete":
+            return respond(event, True)
+        if props["Action"] == "oidc":
+            return respond(event, True, {"Arn": github_oidc()})
+        try:
+            notify(props)
+        except Exception:
+            # The connect link expires; a later stack update shouldn't fail on it.
+            if event["RequestType"] != "Update":
+                raise
+        respond(event, True)
+    except Exception as e:
+        print(e)
+        respond(event, False, reason=str(e))
+`;
+    GUID = /^[0-9a-f]{8}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{12}$/i;
+    RESOURCE_GROUP = /^[-\w.()]{0,89}[-\w()]$/;
+    AZURE_LOCATION = /^[a-z0-9]{2,40}$/;
+    STORAGE_ACCOUNT = /^[a-z0-9]{3,24}$/;
+    AZURE_DEPLOY_IDENTITY = "compbox-deploy";
+    AZURE_CONTRIBUTOR = "b24988ac-6180-42a0-ab88-20f7382dd24c";
+    AZURE_BLOB_DATA_CONTRIBUTOR = "ba92f5b4-2d11-453d-a403-e96b0029c9fe";
+    EMPTY_ARM_TEMPLATE = {
+      $schema: "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#",
+      contentVersion: "1.0.0.0",
+      resources: []
+    };
+  }
+});
+
+// ../shared/dist/stack-files.js
+function stackEnvironments(tier) {
+  return STACK_TIERS[tier].environments;
+}
+function deployRunTitle(environment) {
+  return `Deploy to ${environment}`;
+}
+function cloudRunUrl(service, projectNumber, region) {
+  return `https://${service}-${projectNumber}.${region}.run.app`;
+}
+function stackAppName(repoName) {
+  let slug = repoName.toLowerCase().replace(/[^a-z0-9]+/g, "-").replace(/^[^a-z]+/, "").slice(0, 20).replace(/-+$/, "");
+  if (slug.length < 2)
+    slug = `app${slug}`.slice(0, 20);
+  return slug;
+}
+function envSettings(env) {
+  return env === "prod" ? { min: 0, max: 10 } : { min: 0, max: 2 };
+}
+function buildStackFiles(input) {
+  const { tier, app, defaultBranch, cloud } = input;
+  if (!APP.test(app))
+    throw new Error("Not a valid app name.");
+  if (!BRANCH.test(defaultBranch))
+    throw new Error("Not a valid branch name.");
+  const envs = stackEnvironments(tier);
+  const registry = `${cloud.region}-docker.pkg.dev/${cloud.projectId}/${app}`;
+  const files = [];
+  files.push({
+    path: "infra/versions.tf",
+    content: `# Managed by CompBox. Changes here are applied on the next deploy.
+terraform {
+  required_version = ">= 1.6"
+  required_providers {
+    google = {
+      source  = "hashicorp/google"
+      version = "~> 6.0"
+    }
+  }
+  # Bucket and prefix are passed by the deploy workflow.
+  backend "gcs" {}
+}
+
+provider "google" {
+  project = var.project_id
+  region  = var.region
+}
+`
+  });
+  files.push({
+    path: "infra/variables.tf",
+    content: `variable "project_id" {
+  type = string
+}
+
+variable "region" {
+  type = string
+}
+
+variable "app" {
+  type = string
+}
+
+variable "environment" {
+  type = string
+}
+
+variable "min_instances" {
+  type    = number
+  default = 0
+}
+
+variable "max_instances" {
+  type    = number
+  default = 2
+}
+
+# Only used the first time; every deploy sets the real image.
+variable "bootstrap_image" {
+  type    = string
+  default = "us-docker.pkg.dev/cloudrun/container/hello"
+}
+`
+  });
+  files.push({
+    path: "infra/main.tf",
+    content: `locals {
+  service = "\${var.app}-\${var.environment}"
+}
+
+# One image registry for the app, created with dev and shared by every environment.
+resource "google_artifact_registry_repository" "app" {
+  count         = var.environment == "dev" ? 1 : 0
+  repository_id = var.app
+  location      = var.region
+  format        = "DOCKER"
+}
+
+# The account the app runs as in this environment (no permissions by default).
+resource "google_service_account" "runtime" {
+  account_id   = local.service
+  display_name = "\${local.service} (CompBox)"
+}
+
+resource "google_cloud_run_v2_service" "app" {
+  name                = local.service
+  location            = var.region
+  ingress             = "INGRESS_TRAFFIC_ALL"
+  deletion_protection = var.environment == "prod"
+
+  template {
+    service_account = google_service_account.runtime.email
+    scaling {
+      min_instance_count = var.min_instances
+      max_instance_count = var.max_instances
+    }
+    containers {
+      image = var.bootstrap_image
+    }
+  }
+
+  # Deploys change the image; Terraform owns everything else.
+  lifecycle {
+    ignore_changes = [template[0].containers[0].image, client, client_version]
+  }
+}
+
+# Anyone with the link can open it. Remove this to keep the app private.
+resource "google_cloud_run_v2_service_iam_member" "public" {
+  name     = google_cloud_run_v2_service.app.name
+  location = var.region
+  role     = "roles/run.invoker"
+  member   = "allUsers"
+}
+
+output "url" {
+  value = google_cloud_run_v2_service.app.uri
+}
+`
+  });
+  for (const env of envs) {
+    const s = envSettings(env);
+    files.push({
+      path: `infra/envs/${env}.tfvars`,
+      content: `project_id    = "${cloud.projectId}"
+region        = "${cloud.region}"
+app           = "${app}"
+environment   = "${env}"
+min_instances = ${String(s.min)}
+max_instances = ${String(s.max)}
+`
+    });
+  }
+  const options = envs.map((e) => `          - ${e}`).join("\n");
+  files.push({
+    path: ".github/workflows/compbox.yml",
+    content: `# Managed by CompBox: every push to ${defaultBranch} deploys to dev.${envs.length > 1 ? "\n# Stage and prod: Actions \u2192 CompBox \u2192 Run workflow. Prod waits for its environment's approval." : ""}
+name: CompBox
+run-name: Deploy to \${{ inputs.environment || 'dev' }}
+
+on:
+  push:
+    branches: [${JSON.stringify(defaultBranch)}]
+  workflow_dispatch:
+    inputs:
+      environment:
+        description: Where to deploy
+        type: choice
+        default: dev
+        options:
+${options}
+
+permissions:
+  contents: read
+  id-token: write
+
+jobs:
+  deploy:
+    uses: ./.github/workflows/compbox-deploy.yml
+    with:
+      environment: \${{ inputs.environment || 'dev' }}
+`
+  });
+  files.push({
+    path: ".github/workflows/compbox-deploy.yml",
+    content: `# Managed by CompBox. Signs in to Google Cloud without stored keys (Workload Identity).
+name: CompBox deploy
+
+on:
+  workflow_call:
+    inputs:
+      environment:
+        type: string
+        required: true
+
+permissions:
+  contents: read
+  id-token: write
+
+concurrency:
+  group: compbox-\${{ inputs.environment }}
+  cancel-in-progress: false
+
+jobs:
+  deploy:
+    runs-on: ubuntu-latest
+    environment:
+      name: \${{ inputs.environment }}
+      url: \${{ steps.deploy.outputs.url }}
+    env:
+      ENVIRONMENT: \${{ inputs.environment }}
+      PROJECT_ID: ${cloud.projectId}
+      REGION: ${cloud.region}
+      APP: ${app}
+      IMAGE: ${registry}/app:\${{ github.sha }}
+      STATE_BUCKET: ${gcpStateBucket(cloud.projectId)}
+    steps:
+      - uses: actions/checkout@v4
+
+      - uses: google-github-actions/auth@v2
+        with:
+          workload_identity_provider: ${cloud.workloadProvider}
+          service_account: ${cloud.serviceAccountEmail}
+
+      - uses: google-github-actions/setup-gcloud@v2
+
+      - uses: hashicorp/setup-terraform@v3
+
+      - name: Infrastructure
+        working-directory: infra
+        run: |
+          terraform init -input=false -backend-config="bucket=$STATE_BUCKET" -backend-config="prefix=$APP/$ENVIRONMENT"
+          terraform apply -input=false -auto-approve -var-file="envs/$ENVIRONMENT.tfvars"
+
+      - name: Build
+        run: |
+          if [ ! -f Dockerfile ]; then
+            echo "::error::Add a Dockerfile at the repository root: CompBox deploys the app as a container that listens on \\$PORT."
+            exit 1
+          fi
+          gcloud auth configure-docker "$REGION-docker.pkg.dev" --quiet
+          docker build -t "$IMAGE" .
+          docker push "$IMAGE"
+
+      - name: Deploy
+        id: deploy
+        run: |
+          SERVICE="$APP-$ENVIRONMENT"
+          gcloud run deploy "$SERVICE" --image "$IMAGE" --region "$REGION" --project "$PROJECT_ID" --quiet
+          URL=$(gcloud run services describe "$SERVICE" --region "$REGION" --project "$PROJECT_ID" --format='value(status.url)')
+          echo "url=$URL" >> "$GITHUB_OUTPUT"
+          echo "### Live at $URL" >> "$GITHUB_STEP_SUMMARY"
+`
+  });
+  files.push({
+    path: "infra/README.md",
+    content: `# Infrastructure (managed by CompBox)
+
+This project deploys to Google Cloud project \`${cloud.projectId}\` (${cloud.region}) as a Cloud Run service per environment: ${envs.map((e) => `\`${app}-${e}\``).join(", ")}.
+
+- **Dev:** every push to \`${defaultBranch}\` deploys it.${envs.length > 1 ? "\n- **Stage and prod:** in GitHub, Actions \u2192 CompBox \u2192 Run workflow, then pick the environment. Add required reviewers to the `prod` environment (Settings \u2192 Environments) so prod waits for approval." : ""}
+- **The app:** a \`Dockerfile\` at the repository root, for a container that listens on \`$PORT\` (8080).
+- **Sign-in:** GitHub Actions sign in to Google Cloud through Workload Identity \u2014 there are no keys to store or rotate.
+- **Changes:** edit the Terraform here; the next deploy applies it. Services are public by default; remove the \`public\` resource in \`main.tf\` to keep one private.
+`
+  });
+  return files;
+}
+var STACK_TIERS, STACK_WORKFLOW, APP, BRANCH;
+var init_stack_files = __esm({
+  "../shared/dist/stack-files.js"() {
+    "use strict";
+    init_cloud_setup();
+    STACK_TIERS = {
+      dev: { label: "Dev only", environments: ["dev"] },
+      full: { label: "Dev, stage and prod", environments: ["dev", "stage", "prod"] }
+    };
+    STACK_WORKFLOW = "compbox.yml";
+    APP = /^[a-z][a-z0-9-]{1,19}$/;
+    BRANCH = /^[A-Za-z0-9._/-]{1,200}$/;
+  }
+});
+
+// ../shared/dist/github-repo.js
+function githubRepoKey(remote) {
+  if (typeof remote !== "string")
+    return null;
+  const normalized = normalizeGitRemote(remote);
+  const match = /^https:\/\/([^/]+)\/(.*)$/.exec(normalized);
+  if (!match)
+    return null;
+  const host = match[1];
+  const path4 = match[2];
+  if (host !== "github.com" || path4 === void 0)
+    return null;
+  const segments = path4.split("/");
+  if (segments.length !== 2)
+    return null;
+  const [owner, name] = segments;
+  if (!owner || !name)
+    return null;
+  return `${owner}/${name}`.toLowerCase();
+}
+var init_github_repo = __esm({
+  "../shared/dist/github-repo.js"() {
+    "use strict";
+    init_mailbox();
+  }
+});
+
+// ../shared/dist/return-to.js
+function safeReturnTo(value) {
+  if (typeof value !== "string")
+    return null;
+  if (value.length < 1 || value.length > RETURN_TO_MAX_LENGTH)
+    return null;
+  if (!value.startsWith("/"))
+    return null;
+  const second = value.charAt(1);
+  if (second === "/" || second === "\\")
+    return null;
+  if (value.includes("\\"))
+    return null;
+  if (value.includes("://"))
+    return null;
+  for (let i = 0; i < value.length; i++) {
+    const code = value.charCodeAt(i);
+    if (code < 32 || code === 127)
+      return null;
+  }
+  return value;
+}
+var RETURN_TO_MAX_LENGTH;
+var init_return_to = __esm({
+  "../shared/dist/return-to.js"() {
+    "use strict";
+    RETURN_TO_MAX_LENGTH = 512;
+  }
+});
+
 // ../shared/dist/index.js
 var dist_exports = {};
 __export(dist_exports, {
   AI_PROVIDERS: () => AI_PROVIDERS,
   APPEND_DESCRIPTION_MAX: () => APPEND_DESCRIPTION_MAX,
+  AWS_REGIONS: () => AWS_REGIONS,
+  AZURE_DEPLOY_IDENTITY: () => AZURE_DEPLOY_IDENTITY,
   COMPLETION_REPAIR_INSTRUCTION: () => COMPLETION_REPAIR_INSTRUCTION,
   CONVERSATION_QUALITY_ROUNDS: () => CONVERSATION_QUALITY_ROUNDS,
   DESCRIPTION_MAX: () => DESCRIPTION_MAX,
+  EMPTY_ARM_TEMPLATE: () => EMPTY_ARM_TEMPLATE,
+  GCP_CONNECT_STEPS: () => GCP_CONNECT_STEPS,
+  GCP_CONNECT_STEP_LABELS: () => GCP_CONNECT_STEP_LABELS,
+  GCP_DEPLOY_ACCOUNT: () => GCP_DEPLOY_ACCOUNT,
+  GCP_DEPLOY_ROLES: () => GCP_DEPLOY_ROLES,
+  GCP_IDENTITY_POOL: () => GCP_IDENTITY_POOL,
+  GCP_IDENTITY_PROVIDER: () => GCP_IDENTITY_PROVIDER,
+  GCP_REGIONS: () => GCP_REGIONS,
   INTERVIEW_DEFINITION: () => INTERVIEW_DEFINITION,
   INTERVIEW_FIELD_MIN_WORDS: () => INTERVIEW_FIELD_MIN_WORDS,
   INTERVIEW_STATUSES: () => INTERVIEW_STATUSES,
@@ -1067,6 +1983,9 @@ __export(dist_exports, {
   MODEL_CATALOG: () => MODEL_CATALOG,
   ORG_ROLES: () => ORG_ROLES,
   PXPIPE_DEFAULT_PROXY_URL: () => PXPIPE_DEFAULT_PROXY_URL,
+  RETURN_TO_MAX_LENGTH: () => RETURN_TO_MAX_LENGTH,
+  STACK_TIERS: () => STACK_TIERS,
+  STACK_WORKFLOW: () => STACK_WORKFLOW,
   START_EXECUTION_KINDS: () => START_EXECUTION_KINDS,
   SUBSCRIPTION_STATUSES: () => SUBSCRIPTION_STATUSES,
   SUMMARY_MAX: () => SUMMARY_MAX,
@@ -1076,25 +1995,50 @@ __export(dist_exports, {
   agentSchema: () => agentSchema,
   aiProviderValues: () => aiProviderValues,
   aiRouteValues: () => aiRouteValues,
+  awsQuickCreateUrl: () => awsQuickCreateUrl,
+  azureDeployUrl: () => azureDeployUrl,
+  azureGitHubSubject: () => azureGitHubSubject,
   buildAuditFeedback: () => buildAuditFeedback,
+  buildAwsConnectTemplate: () => buildAwsConnectTemplate,
+  buildAzureConnectTemplate: () => buildAzureConnectTemplate,
   buildConversationSystemPrompt: () => buildConversationSystemPrompt,
+  buildGcpSetupScript: () => buildGcpSetupScript,
   buildInterviewSystemPrompt: () => buildInterviewSystemPrompt,
+  buildStackFiles: () => buildStackFiles,
+  cloudRunUrl: () => cloudRunUrl,
   complianceFromRecord: () => complianceFromRecord,
+  deployRunTitle: () => deployRunTitle,
   err: () => err,
   extractCompletionJson: () => extractCompletionJson,
+  gcpServiceAccountEmail: () => gcpServiceAccountEmail,
+  gcpStateBucket: () => gcpStateBucket,
+  gcpWorkloadProvider: () => gcpWorkloadProvider,
   getAnthropicProxyUrl: () => getAnthropicProxyUrl,
   getModelById: () => getModelById,
   getModelDisplayName: () => getModelDisplayName,
   getOpenAiProxyUrl: () => getOpenAiProxyUrl,
+  githubRepoKey: () => githubRepoKey,
   instructionSchema: () => instructionSchema,
   interviewFieldKeys: () => interviewFieldKeys,
   interviewSectionKeys: () => interviewSectionKeys,
+  isAwsAccountId: () => isAwsAccountId,
+  isAwsRegion: () => isAwsRegion,
+  isAwsRoleArn: () => isAwsRoleArn,
+  isAzureGuid: () => isAzureGuid,
+  isAzureLocation: () => isAzureLocation,
+  isAzureResourceGroup: () => isAzureResourceGroup,
+  isAzureStorageAccount: () => isAzureStorageAccount,
+  isGcpProjectId: () => isGcpProjectId,
+  isGcpProjectNumber: () => isGcpProjectNumber,
+  isGcpRegion: () => isGcpRegion,
+  isGitHubLogin: () => isGitHubLogin,
   isInterviewStatus: () => isInterviewStatus,
   isJobStatus: () => isJobStatus,
   isJobType: () => isJobType,
   isMachineStatus: () => isMachineStatus,
   isOrgRole: () => isOrgRole,
   isPxpipeEnabled: () => isPxpipeEnabled,
+  isS3BucketName: () => isS3BucketName,
   isSessionErrorEvent: () => isSessionErrorEvent,
   isSessionFeatureEvent: () => isSessionFeatureEvent,
   isSessionLifecycleEvent: () => isSessionLifecycleEvent,
@@ -1115,12 +2059,15 @@ __export(dist_exports, {
   renderConversationPrompt: () => renderConversationPrompt,
   resolveRouting: () => resolveRouting,
   runConversationStep: () => runConversationStep,
+  safeReturnTo: () => safeReturnTo,
   safeValidateSkillPackManifest: () => safeValidateSkillPackManifest,
   savedContextFromRecord: () => savedContextFromRecord,
   savedMessage: () => savedMessage,
   skillPackManifestSchema: () => skillPackManifestSchema,
   skillSchema: () => skillSchema,
   sleep: () => sleep,
+  stackAppName: () => stackAppName,
+  stackEnvironments: () => stackEnvironments,
   thinkingLevelValues: () => thinkingLevelValues,
   toConversationMessages: () => toConversationMessages,
   validatePackName: () => validatePackName,
@@ -1138,6 +2085,11 @@ var init_dist = __esm({
     init_interview_definition();
     init_interview_completion();
     init_interview_conversation();
+    init_cloud_setup();
+    init_cloud_connect();
+    init_stack_files();
+    init_github_repo();
+    init_return_to();
   }
 });
 
@@ -11318,7 +12270,7 @@ function withLegacyToolCallRewrite(transport) {
 var SERVER_NAME = "compbox-mcp";
 function resolveServerVersion() {
   if (true) {
-    return "1.20.0";
+    return "1.21.1";
   }
   const require2 = createRequire(import.meta.url);
   for (const candidate of ["../package.json", "./package.json"]) {

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@mycompbox/compbox-mcp",
-  "version": "1.20.0",
+  "version": "1.21.1",
   "description": "CompBox MCP server - Uses HTTP API client (no direct database access)",
   "license": "MIT",
   "type": "module",