@thejoseki/clawform 2.3.0 → 2.3.2

package/src/hooks/session-context-eval.js

@@ -1,81 +1,81 @@
-// Pure decision logic for the SessionStart context hook. Emits a single terse
-// block (customer, envs, region, legacy-prefix count, catalog freshness) when
-// the current project resolves an clawform.config.json; silent otherwise, so
-// a non-clawform project never sees noise.
-//
-// Never includes account IDs or AWS profile — CLAUDE.md's identity rule says
-// "Never echo the resolved values back in chat", and those live in
-// clawform.config.json `accounts` / .claude/settings.local.json, not here.
-//
-// Stays pure: takes (deps) and returns { shouldEmit, text }. The shim
-// supplies real findConfigPath/loadProjectConfig/statSync; tests inject fakes.
-
-import { STALE_HOURS, resolveCatalogPath } from './check-catalog-fresh-eval.js';
-import { STALE_CHANGESET_DAYS } from '../lib/session-state.js';
-
-// readState defaults to a no-op empty state so existing callers/tests that
-// don't care about in-flight state keep working; the shim injects the real one.
-export function evaluate({
-  cwd,
-  now,
-  findConfigPath,
-  loadProjectConfig,
-  statSync,
-  readState = () => ({ pendingChangesets: [] }),
-}) {
-  const configPath = findConfigPath(cwd);
-  if (!configPath) return { shouldEmit: false, text: '' };
-
-  const cfg = loadProjectConfig({ projectDir: cwd });
-  const customer = cfg.customer || '(unset)';
-  const envs = Array.isArray(cfg.envs) && cfg.envs.length ? cfg.envs.join(',') : '(none)';
-  const region = cfg.region || '(unset)';
-  const legacyCount = Array.isArray(cfg.legacy_prefixes) ? cfg.legacy_prefixes.length : 0;
-
-  const parts = [
-    `customer=${customer}`,
-    `envs=${envs}`,
-    `region=${region}`,
-    `legacy-prefixes=${legacyCount}`,
-    catalogFreshnessPart(cwd, now, statSync),
-  ];
-
-  const pending = pendingChangesetPart(cwd, now, readState);
-  if (pending) parts.push(pending);
-
-  return { shouldEmit: true, text: `[clawform] ${parts.join(' ')}` };
-}
-
-// Warn about any changeset created but not executed (survives /clear) — the
-// next operator sees it and can execute or clean it up. Fail-open: a bad
-// state file yields no line, never an exception.
-function pendingChangesetPart(cwd, now, readState) {
-  let state;
-  try {
-    state = readState(cwd);
-  } catch {
-    return '';
-  }
-  const pending = Array.isArray(state?.pendingChangesets) ? state.pendingChangesets : [];
-  if (pending.length === 0) return '';
-  const descs = pending.map((e) => {
-    const ageDays = (now - new Date(e.createdAt).getTime()) / 86_400_000;
-    // A corrupt/hand-edited createdAt yields NaN — show it as stale rather than
-    // "(NaNd)" so the operator still gets a "clean this up" signal.
-    if (!Number.isFinite(ageDays)) return `${e.stack}/${e.changeSetName}(?!stale)`;
-    const stale = ageDays > STALE_CHANGESET_DAYS ? '!stale' : '';
-    return `${e.stack}/${e.changeSetName}(${Math.max(0, Math.round(ageDays))}d${stale})`;
-  });
-  return `pending-changesets=${descs.join(',')}`;
-}
-
-function catalogFreshnessPart(cwd, now, statSync) {
-  let stat;
-  try {
-    stat = statSync(resolveCatalogPath(cwd));
-  } catch {
-    return 'catalog=missing';
-  }
-  const ageHours = (now - new Date(stat.mtime).getTime()) / 3_600_000;
-  return ageHours > STALE_HOURS ? `catalog=stale(${Math.round(ageHours)}h)` : 'catalog=fresh';
-}
+// Pure decision logic for the SessionStart context hook. Emits a single terse
+// block (customer, envs, region, legacy-prefix count, catalog freshness) when
+// the current project resolves an clawform.config.json; silent otherwise, so
+// a non-clawform project never sees noise.
+//
+// Never includes account IDs or AWS profile — CLAUDE.md's identity rule says
+// "Never echo the resolved values back in chat", and those live in
+// clawform.config.json `accounts` / .claude/settings.local.json, not here.
+//
+// Stays pure: takes (deps) and returns { shouldEmit, text }. The shim
+// supplies real findConfigPath/loadProjectConfig/statSync; tests inject fakes.
+
+import { STALE_HOURS, resolveCatalogPath } from './check-catalog-fresh-eval.js';
+import { STALE_CHANGESET_DAYS } from '../lib/session-state.js';
+
+// readState defaults to a no-op empty state so existing callers/tests that
+// don't care about in-flight state keep working; the shim injects the real one.
+export function evaluate({
+  cwd,
+  now,
+  findConfigPath,
+  loadProjectConfig,
+  statSync,
+  readState = () => ({ pendingChangesets: [] }),
+}) {
+  const configPath = findConfigPath(cwd);
+  if (!configPath) return { shouldEmit: false, text: '' };
+
+  const cfg = loadProjectConfig({ projectDir: cwd });
+  const customer = cfg.customer || '(unset)';
+  const envs = Array.isArray(cfg.envs) && cfg.envs.length ? cfg.envs.join(',') : '(none)';
+  const region = cfg.region || '(unset)';
+  const legacyCount = Array.isArray(cfg.legacy_prefixes) ? cfg.legacy_prefixes.length : 0;
+
+  const parts = [
+    `customer=${customer}`,
+    `envs=${envs}`,
+    `region=${region}`,
+    `legacy-prefixes=${legacyCount}`,
+    catalogFreshnessPart(cwd, now, statSync),
+  ];
+
+  const pending = pendingChangesetPart(cwd, now, readState);
+  if (pending) parts.push(pending);
+
+  return { shouldEmit: true, text: `[clawform] ${parts.join(' ')}` };
+}
+
+// Warn about any changeset created but not executed (survives /clear) — the
+// next operator sees it and can execute or clean it up. Fail-open: a bad
+// state file yields no line, never an exception.
+function pendingChangesetPart(cwd, now, readState) {
+  let state;
+  try {
+    state = readState(cwd);
+  } catch {
+    return '';
+  }
+  const pending = Array.isArray(state?.pendingChangesets) ? state.pendingChangesets : [];
+  if (pending.length === 0) return '';
+  const descs = pending.map((e) => {
+    const ageDays = (now - new Date(e.createdAt).getTime()) / 86_400_000;
+    // A corrupt/hand-edited createdAt yields NaN — show it as stale rather than
+    // "(NaNd)" so the operator still gets a "clean this up" signal.
+    if (!Number.isFinite(ageDays)) return `${e.stack}/${e.changeSetName}(?!stale)`;
+    const stale = ageDays > STALE_CHANGESET_DAYS ? '!stale' : '';
+    return `${e.stack}/${e.changeSetName}(${Math.max(0, Math.round(ageDays))}d${stale})`;
+  });
+  return `pending-changesets=${descs.join(',')}`;
+}
+
+function catalogFreshnessPart(cwd, now, statSync) {
+  let stat;
+  try {
+    stat = statSync(resolveCatalogPath(cwd));
+  } catch {
+    return 'catalog=missing';
+  }
+  const ageHours = (now - new Date(stat.mtime).getTime()) / 3_600_000;
+  return ageHours > STALE_HOURS ? `catalog=stale(${Math.round(ageHours)}h)` : 'catalog=fresh';
+}

package/src/hooks/session-context.js

@@ -1,41 +1,41 @@
-#!/usr/bin/env node
-/**
- * Clawform SessionStart hook — prints a terse config+catalog context block
- * when the current project resolves an clawform.config.json; silent (exit 0,
- * no output) for any other project, so a bare dir sees nothing.
- *
- * Resolves the project dir the same way block-dangerous.js does: prefer the
- * hook event's own `cwd`, then CLAUDE_PROJECT_DIR, then process.cwd().
- *
- * Fail-LOUD on event-parse error, and on consumer-config load error (bad
- * JSON / wrong-shaped keys — project-config.js throws loudly on both), both
- * stderr + exit 0 — never blocks the session; SessionStart output is
- * advisory only.
- */
-
-import { readFileSync, statSync } from 'node:fs';
-import { evaluate } from './session-context-eval.js';
-import { findConfigPath, loadProjectConfig } from '../lib/project-config.js';
-import { readState } from '../lib/session-state.js';
-
-let event;
-try {
-  event = JSON.parse(readFileSync(0, 'utf8'));
-} catch (err) {
-  process.stderr.write(`[clawform session-context] event parse failed (silent): ${err.message}\n`);
-  process.exit(0);
-}
-
-const cwd = (typeof event?.cwd === 'string' && event.cwd) || process.env.CLAUDE_PROJECT_DIR || process.cwd();
-
-let shouldEmit = false;
-let text = '';
-try {
-  ({ shouldEmit, text } = evaluate({ cwd, now: Date.now(), findConfigPath, loadProjectConfig, statSync, readState }));
-} catch (err) {
-  process.stderr.write(`[clawform session-context] consumer config load failed at ${cwd} (silent): ${err.message}\n`);
-}
-
-if (shouldEmit) {
-  console.log(text);
-}
+#!/usr/bin/env node
+/**
+ * Clawform SessionStart hook — prints a terse config+catalog context block
+ * when the current project resolves an clawform.config.json; silent (exit 0,
+ * no output) for any other project, so a bare dir sees nothing.
+ *
+ * Resolves the project dir the same way block-dangerous.js does: prefer the
+ * hook event's own `cwd`, then CLAUDE_PROJECT_DIR, then process.cwd().
+ *
+ * Fail-LOUD on event-parse error, and on consumer-config load error (bad
+ * JSON / wrong-shaped keys — project-config.js throws loudly on both), both
+ * stderr + exit 0 — never blocks the session; SessionStart output is
+ * advisory only.
+ */
+
+import { readFileSync, statSync } from 'node:fs';
+import { evaluate } from './session-context-eval.js';
+import { findConfigPath, loadProjectConfig } from '../lib/project-config.js';
+import { readState } from '../lib/session-state.js';
+
+let event;
+try {
+  event = JSON.parse(readFileSync(0, 'utf8'));
+} catch (err) {
+  process.stderr.write(`[clawform session-context] event parse failed (silent): ${err.message}\n`);
+  process.exit(0);
+}
+
+const cwd = (typeof event?.cwd === 'string' && event.cwd) || process.env.CLAUDE_PROJECT_DIR || process.cwd();
+
+let shouldEmit = false;
+let text = '';
+try {
+  ({ shouldEmit, text } = evaluate({ cwd, now: Date.now(), findConfigPath, loadProjectConfig, statSync, readState }));
+} catch (err) {
+  process.stderr.write(`[clawform session-context] consumer config load failed at ${cwd} (silent): ${err.message}\n`);
+}
+
+if (shouldEmit) {
+  console.log(text);
+}

package/src/hooks/subagent-context-eval.js

@@ -1,44 +1,44 @@
-// Pure decision logic for the SubagentStart rule-injection hook. When the
-// current project resolves an clawform.config.json, every spawned subagent
-// receives Clawform's 6 hard rules + naming convention as injected context —
-// so a subagent generating or reviewing CloudFormation inherits the same
-// invariants the main session operates under, WITHOUT each workflow having to
-// embed them in every prompt by hand.
-//
-// Silent when no config resolves (a non-clawform project's subagents see
-// nothing). Never emits account IDs, AWS profile, or raw legacy-prefix values
-// (per CLAUDE.md identity rule) — only the customer shortname, which is
-// already public in every stack name.
-//
-// Stays pure: takes injected findConfigPath/loadProjectConfig; the shim
-// supplies the real implementations, tests supply fakes.
-
-// The 6 hard rules from CLAUDE.md, compressed to one line each. This is the
-// canonical terse copy; workflows/audit-all-stacks.js keeps its own embedded
-// copy as a defense-in-depth fallback (the hook can be disabled) — keep the
-// two in rough sync, but this one is what subagents actually receive.
-export const HARD_RULES_TERSE = `Clawform hard rules — all subagent work must comply:
-1. Never modify legacy stacks (frozen prefixes in clawform.config.json legacy_prefixes) without a "# FORCE LEGACY: <reason>" line.
-2. Never hardcode credentials in CFN Parameters — use {{resolve:secretsmanager:<name>:SecretString:<key>}}.
-3. Never "!ImportValue !Sub" (invalid YAML) — use long form Fn::ImportValue: !Sub "\${EnvName}-...".
-4. Stateful resources (RDS/S3/DynamoDB/EFS/ElastiCache/Logs::LogGroup/SecretsManager::Secret/KMS::Key/Cognito) need DeletionPolicy + UpdateReplacePolicy set to a non-destroy value.
-5. No direct deploy — CreateChangeSet -> describe -> confirm -> ExecuteChangeSet.
-6. No "aws cloudformation delete-stack" outside the /rollback command.
-Full rules: CLAUDE.md.`;
-
-function namingLine(customer, envs) {
-  const c = customer || '<customer>';
-  // Emit the consumer's actual env list (matching session-context's fidelity)
-  // so a subagent doesn't propose an env the consumer narrowed away.
-  const envList = Array.isArray(envs) && envs.length ? envs.join('/') : 'd/stg/p';
-  return `Naming: <env>-${c}-<pri|pub>-<service>-<project>-<feature>-[zone] (env ${envList}; service shortnames in rules/cfn-standards.md).`;
-}
-
-export function evaluate({ cwd, findConfigPath, loadProjectConfig }) {
-  const configPath = findConfigPath(cwd);
-  if (!configPath) return { shouldEmit: false, text: '' };
-
-  const cfg = loadProjectConfig({ projectDir: cwd });
-  const text = `${HARD_RULES_TERSE}\n${namingLine(cfg.customer, cfg.envs)}`;
-  return { shouldEmit: true, text };
-}
+// Pure decision logic for the SubagentStart rule-injection hook. When the
+// current project resolves an clawform.config.json, every spawned subagent
+// receives Clawform's 6 hard rules + naming convention as injected context —
+// so a subagent generating or reviewing CloudFormation inherits the same
+// invariants the main session operates under, WITHOUT each workflow having to
+// embed them in every prompt by hand.
+//
+// Silent when no config resolves (a non-clawform project's subagents see
+// nothing). Never emits account IDs, AWS profile, or raw legacy-prefix values
+// (per CLAUDE.md identity rule) — only the customer shortname, which is
+// already public in every stack name.
+//
+// Stays pure: takes injected findConfigPath/loadProjectConfig; the shim
+// supplies the real implementations, tests supply fakes.
+
+// The 6 hard rules from CLAUDE.md, compressed to one line each. This is the
+// canonical terse copy; workflows/audit-all-stacks.js keeps its own embedded
+// copy as a defense-in-depth fallback (the hook can be disabled) — keep the
+// two in rough sync, but this one is what subagents actually receive.
+export const HARD_RULES_TERSE = `Clawform hard rules — all subagent work must comply:
+1. Never modify legacy stacks (frozen prefixes in clawform.config.json legacy_prefixes) without a "# FORCE LEGACY: <reason>" line.
+2. Never hardcode credentials in CFN Parameters — use {{resolve:secretsmanager:<name>:SecretString:<key>}}.
+3. Never "!ImportValue !Sub" (invalid YAML) — use long form Fn::ImportValue: !Sub "\${EnvName}-...".
+4. Stateful resources (RDS/S3/DynamoDB/EFS/ElastiCache/Logs::LogGroup/SecretsManager::Secret/KMS::Key/Cognito) need DeletionPolicy + UpdateReplacePolicy set to a non-destroy value.
+5. No direct deploy — CreateChangeSet -> describe -> confirm -> ExecuteChangeSet.
+6. No "aws cloudformation delete-stack" outside the /rollback command.
+Full rules: CLAUDE.md.`;
+
+function namingLine(customer, envs) {
+  const c = customer || '<customer>';
+  // Emit the consumer's actual env list (matching session-context's fidelity)
+  // so a subagent doesn't propose an env the consumer narrowed away.
+  const envList = Array.isArray(envs) && envs.length ? envs.join('/') : 'd/stg/p';
+  return `Naming: <env>-${c}-<pri|pub>-<service>-<project>-<feature>-[zone] (env ${envList}; service shortnames in rules/cfn-standards.md).`;
+}
+
+export function evaluate({ cwd, findConfigPath, loadProjectConfig }) {
+  const configPath = findConfigPath(cwd);
+  if (!configPath) return { shouldEmit: false, text: '' };
+
+  const cfg = loadProjectConfig({ projectDir: cwd });
+  const text = `${HARD_RULES_TERSE}\n${namingLine(cfg.customer, cfg.envs)}`;
+  return { shouldEmit: true, text };
+}

package/src/hooks/subagent-context.js

@@ -1,48 +1,48 @@
-#!/usr/bin/env node
-/**
- * Clawform SubagentStart hook — injects the 6 hard rules + naming convention
- * into every subagent when the current project resolves an clawform.config.json;
- * silent (exit 0, no output) for any other project.
- *
- * SubagentStart requires the structured envelope
- *   { hookSpecificOutput: { hookEventName: "SubagentStart", additionalContext } }
- * on stdout — plain stdout (as SessionStart accepts) is NOT injected here.
- *
- * Resolves the project dir like the other hooks: prefer the event's own `cwd`,
- * then CLAUDE_PROJECT_DIR, then process.cwd().
- *
- * Fail-LOUD on event-parse error, and on consumer-config load error (bad JSON /
- * wrong-shaped keys — project-config.js throws on both), both stderr + exit 0 —
- * never blocks the subagent; injected context is advisory only.
- */
-
-import { readFileSync } from 'node:fs';
-import { evaluate } from './subagent-context-eval.js';
-import { findConfigPath, loadProjectConfig } from '../lib/project-config.js';
-
-let event;
-try {
-  event = JSON.parse(readFileSync(0, 'utf8'));
-} catch (err) {
-  process.stderr.write(`[clawform subagent-context] event parse failed (silent): ${err.message}\n`);
-  process.exit(0);
-}
-
-const cwd = (typeof event?.cwd === 'string' && event.cwd) || process.env.CLAUDE_PROJECT_DIR || process.cwd();
-
-let shouldEmit = false;
-let text = '';
-try {
-  ({ shouldEmit, text } = evaluate({ cwd, findConfigPath, loadProjectConfig }));
-} catch (err) {
-  process.stderr.write(`[clawform subagent-context] consumer config load failed at ${cwd} (silent): ${err.message}\n`);
-}
-
-if (shouldEmit) {
-  console.log(JSON.stringify({
-    hookSpecificOutput: {
-      hookEventName: 'SubagentStart',
-      additionalContext: text,
-    },
-  }));
-}
+#!/usr/bin/env node
+/**
+ * Clawform SubagentStart hook — injects the 6 hard rules + naming convention
+ * into every subagent when the current project resolves an clawform.config.json;
+ * silent (exit 0, no output) for any other project.
+ *
+ * SubagentStart requires the structured envelope
+ *   { hookSpecificOutput: { hookEventName: "SubagentStart", additionalContext } }
+ * on stdout — plain stdout (as SessionStart accepts) is NOT injected here.
+ *
+ * Resolves the project dir like the other hooks: prefer the event's own `cwd`,
+ * then CLAUDE_PROJECT_DIR, then process.cwd().
+ *
+ * Fail-LOUD on event-parse error, and on consumer-config load error (bad JSON /
+ * wrong-shaped keys — project-config.js throws on both), both stderr + exit 0 —
+ * never blocks the subagent; injected context is advisory only.
+ */
+
+import { readFileSync } from 'node:fs';
+import { evaluate } from './subagent-context-eval.js';
+import { findConfigPath, loadProjectConfig } from '../lib/project-config.js';
+
+let event;
+try {
+  event = JSON.parse(readFileSync(0, 'utf8'));
+} catch (err) {
+  process.stderr.write(`[clawform subagent-context] event parse failed (silent): ${err.message}\n`);
+  process.exit(0);
+}
+
+const cwd = (typeof event?.cwd === 'string' && event.cwd) || process.env.CLAUDE_PROJECT_DIR || process.cwd();
+
+let shouldEmit = false;
+let text = '';
+try {
+  ({ shouldEmit, text } = evaluate({ cwd, findConfigPath, loadProjectConfig }));
+} catch (err) {
+  process.stderr.write(`[clawform subagent-context] consumer config load failed at ${cwd} (silent): ${err.message}\n`);
+}
+
+if (shouldEmit) {
+  console.log(JSON.stringify({
+    hookSpecificOutput: {
+      hookEventName: 'SubagentStart',
+      additionalContext: text,
+    },
+  }));
+}

package/src/lib/audit-synthesis.js

@@ -1,24 +1,24 @@
-// Pure merge/rank logic for the project-audit workflow (workflows/audit-all-stacks.js).
-// Kept separate from the workflow body because agent-call orchestration isn't
-// unit-testable — this is. Each stack's review-stack / iam-audit / cost-guard
-// verdict rolls up to that resource's worst finding, matching the existing
-// iam-audit convention ("Score the whole resource at its worst finding").
-
-const SEVERITY_RANK = { '🔴': 3, '🟡': 2, '✅': 1 };
-
-export function rollupStackSeverity(perStack) {
-  const severities = [perStack.review?.severity, perStack.iam?.severity, perStack.cost?.severity].filter(Boolean);
-  if (severities.length === 0) return '✅';
-  return severities.reduce((worst, s) => (SEVERITY_RANK[s] > SEVERITY_RANK[worst] ? s : worst), '✅');
-}
-
-export function synthesizeAudit(perStackResults) {
-  const stacks = perStackResults
-    .map((r) => ({ ...r, severity: rollupStackSeverity(r) }))
-    .sort((a, b) => SEVERITY_RANK[b.severity] - SEVERITY_RANK[a.severity] || a.stack.localeCompare(b.stack));
-
-  const summary = { total: stacks.length, '🔴': 0, '🟡': 0, '✅': 0 };
-  for (const s of stacks) summary[s.severity] += 1;
-
-  return { summary, stacks };
-}
+// Pure merge/rank logic for the project-audit workflow (workflows/audit-all-stacks.js).
+// Kept separate from the workflow body because agent-call orchestration isn't
+// unit-testable — this is. Each stack's review-stack / iam-audit / cost-guard
+// verdict rolls up to that resource's worst finding, matching the existing
+// iam-audit convention ("Score the whole resource at its worst finding").
+
+const SEVERITY_RANK = { '🔴': 3, '🟡': 2, '✅': 1 };
+
+export function rollupStackSeverity(perStack) {
+  const severities = [perStack.review?.severity, perStack.iam?.severity, perStack.cost?.severity].filter(Boolean);
+  if (severities.length === 0) return '✅';
+  return severities.reduce((worst, s) => (SEVERITY_RANK[s] > SEVERITY_RANK[worst] ? s : worst), '✅');
+}
+
+export function synthesizeAudit(perStackResults) {
+  const stacks = perStackResults
+    .map((r) => ({ ...r, severity: rollupStackSeverity(r) }))
+    .sort((a, b) => SEVERITY_RANK[b.severity] - SEVERITY_RANK[a.severity] || a.stack.localeCompare(b.stack));
+
+  const summary = { total: stacks.length, '🔴': 0, '🟡': 0, '✅': 0 };
+  for (const s of stacks) summary[s.severity] += 1;
+
+  return { summary, stacks };
+}

package/src/lib/aws-client.js

@@ -1,15 +1,15 @@
-import { CloudFormationClient } from '@aws-sdk/client-cloudformation';
-import { loadConfig } from './config.js';
-
-/**
- * Return a CloudFormation client bound to the user's profile & region.
- * Profile is propagated via `AWS_PROFILE` env var so both the SDK's default
- * credential chain AND any `execa`-spawned `aws` CLI child inherit it.
- */
-export function cfnClient(cliOverrides = {}) {
-  const cfg = loadConfig(cliOverrides);
-  // Mutate process.env so any execa-spawned `aws` CLI child inherits the same profile.
-  // Last-write-wins across callers; acceptable for a short-lived CLI process.
-  if (cfg.AWS_PROFILE) process.env.AWS_PROFILE = cfg.AWS_PROFILE;
-  return new CloudFormationClient({ region: cfg.AWS_REGION });
-}
+import { CloudFormationClient } from '@aws-sdk/client-cloudformation';
+import { loadConfig } from './config.js';
+
+/**
+ * Return a CloudFormation client bound to the user's profile & region.
+ * Profile is propagated via `AWS_PROFILE` env var so both the SDK's default
+ * credential chain AND any `execa`-spawned `aws` CLI child inherit it.
+ */
+export function cfnClient(cliOverrides = {}) {
+  const cfg = loadConfig(cliOverrides);
+  // Mutate process.env so any execa-spawned `aws` CLI child inherits the same profile.
+  // Last-write-wins across callers; acceptable for a short-lived CLI process.
+  if (cfg.AWS_PROFILE) process.env.AWS_PROFILE = cfg.AWS_PROFILE;
+  return new CloudFormationClient({ region: cfg.AWS_REGION });
+}