Add AMI artifact management tool

flake.nix

@@ -26,11 +26,65 @@
 
       packages = forAllSystems (system:
         let
+          pkgs = import nixpkgs { inherit system; };
           config = self.nixosConfigurations."baseline-${system}".config;
+          ami-artifacts-script = pkgs.stdenvNoCC.mkDerivation {
+            pname = "ami-artifacts-script";
+            version = "0.1.0";
+            src = ./manage-amis.ts;
+            nativeBuildInputs = [ pkgs.esbuild ];
+            dontUnpack = true;
+            buildPhase = ''
+              runHook preBuild
+              esbuild "$src" \
+                --bundle \
+                --platform=node \
+                --target=node24 \
+                --format=esm \
+                --outfile=manage-amis.mjs
+              runHook postBuild
+            '';
+            installPhase = ''
+              runHook preInstall
+              install -Dm755 manage-amis.mjs "$out/libexec/ami-artifacts/manage-amis.mjs"
+              runHook postInstall
+            '';
+          };
+          ami-artifacts = pkgs.writeShellApplication {
+            name = "ami-artifacts";
+            runtimeInputs = [
+              pkgs.awscli2
+              pkgs.git
+              pkgs.nodejs_24
+              pkgs.opentofu
+            ];
+            text = ''
+              git_root="$(git rev-parse --show-toplevel 2>/dev/null || pwd)"
+              if [ -d "$git_root/tofu/ami-builder" ]; then
+                repo_root="$git_root"
+                ami_builder_dir="$git_root/tofu/ami-builder"
+              else
+                repo_root="$(cd "$git_root/../.." && pwd)"
+                ami_builder_dir="$git_root"
+              fi
+              export QUIXOS_REPO_ROOT="$repo_root"
+              export QUIXOS_AMI_BUILDER_DIR="$ami_builder_dir"
+              exec ${pkgs.nodejs_24}/bin/node ${ami-artifacts-script}/libexec/ami-artifacts/manage-amis.mjs "$@"
+            '';
+          };
         in
         {
           rootImage = config.system.build.images.amazon;
           systemClosure = config.system.build.toplevel;
+          ami-artifacts = ami-artifacts;
+          default = ami-artifacts;
         });
+
+      apps = forAllSystems (system: {
+        ami-artifacts = {
+          type = "app";
+          program = "${self.packages.${system}.ami-artifacts}/bin/ami-artifacts";
+        };
+      });
     };
 }