@deployfoundation/foundation-deploy 0.1.0

package/src/deploy/release.ts

@@ -0,0 +1,282 @@
+/**
+ * Deploying a published release rather than this checkout.
+ *
+ * A customer's pipeline runs one line — `npx @deployfoundation/foundation-deploy@X.Y.Z
+ * deploy --instance .foundation/instance.yaml` — and that pinned version *is*
+ * the release. Nothing is built: the manifest is fetched from Foundation's
+ * release bucket, its KMS signature and every artifact digest are checked, and
+ * only then is the CDK app invoked with `-c releaseManifest=…`.
+ *
+ * Which mode a run is in is not a flag a pipeline has to remember:
+ *
+ *   - `--release <version>` or `--manifest <path|s3://…>` — explicit.
+ *   - neither, and this install has no Foundation workspace to build from
+ *     (the published npm package) — the release matching the tool's own
+ *     version.
+ *   - neither, in a Foundation checkout — the local build, unchanged.
+ *
+ * The verification lives in `src/release/manifest.ts` and is pure; this module
+ * is the part that talks to S3 and KMS.
+ */
+import { existsSync, mkdirSync, readFileSync } from "node:fs";
+import { dirname, isAbsolute, join, resolve } from "node:path";
+import { RELEASE_BUCKET_ENV, releaseCacheDir } from "../artifacts.ts";
+import { kmsVerifier } from "../release/kms.ts";
+import {
+  type KmsVerifier,
+  RELEASE_VERSION_RE,
+  type ReleaseManifest,
+  manifestKey,
+  verifyManifest,
+} from "../release/manifest.ts";
+import { type AwsCallContext, aws } from "./aws.ts";
+import { FOUNDATION_ROOT, INFRA_ROOT } from "./paths.ts";
+
+/**
+ * The bucket a release is fetched from when nothing says otherwise.
+ *
+ * One name, owned by Foundry 41, created by `release-account-stack.ts`. A
+ * mirror is `--release-bucket` or `FOUNDATION_RELEASE_BUCKET`, and the
+ * signature is what makes a mirror safe to use.
+ */
+export const DEFAULT_RELEASE_BUCKET = "foundry41-foundation-releases";
+
+/** The env var that names the key a deployer will accept a manifest from. */
+export const RELEASE_KMS_KEY_ARN_ENV = "FOUNDATION_RELEASE_KMS_KEY_ARN";
+
+/**
+ * The Foundation release signing key, in the Foundry 41 release account
+ * (793593623536), created by `ReleaseAccountStack` on 2026-09-20.
+ *
+ * This constant is what makes signature verification mean anything: a
+ * deployer refuses a manifest signed by any other key. Changing it rotates
+ * the root of trust for every customer, so it changes only with a key
+ * rotation and a release that says so. {@link RELEASE_KMS_KEY_ARN_ENV}
+ * overrides it, for a private mirror or a test key.
+ */
+export const RELEASE_KMS_KEY_ARN: string | undefined =
+  "arn:aws:kms:us-east-1:793593623536:key/fba7d9f3-e9b6-49ae-b4a5-c8c5f1429231";
+
+/** What the caller asked for, before anything has been fetched. */
+export interface ReleaseRequest {
+  /** `vX.Y.Z`, when the caller named a version or one was implied. */
+  version?: string;
+  /** `--manifest`: a local path or an `s3://bucket/key` URI. */
+  manifestRef?: string;
+  bucket: string;
+}
+
+/** A release that has been fetched and verified (or, in a dry run, planned). */
+export interface ResolvedRelease {
+  version: string;
+  bucket: string;
+  /** The local manifest file the CDK app is pointed at. */
+  manifestPath: string;
+  /** Present once verified; absent in a dry run, which fetches nothing. */
+  manifest?: ReleaseManifest;
+}
+
+function flag(args: readonly string[], name: string): string | undefined {
+  const index = args.indexOf(name);
+  const value = index === -1 ? undefined : args[index + 1];
+  if (value?.startsWith("-") === true)
+    throw new Error(`${name} needs a value, e.g. ${name} ${name === "--release" ? "v0.1.0" : "…"}`);
+  const inline = args.find((arg) => arg.startsWith(`${name}=`));
+  return value ?? (inline === undefined ? undefined : inline.slice(name.length + 1));
+}
+
+/** This tool's own version, which is the release a published copy deploys. */
+export function toolVersion(infraRoot: string = INFRA_ROOT): string {
+  const { version } = JSON.parse(readFileSync(join(infraRoot, "package.json"), "utf8")) as {
+    version: string;
+  };
+  return version;
+}
+
+/**
+ * Is there a Foundation workspace here to build Lambda bundles from?
+ *
+ * The published package carries the CDK app and the deploy tool, not the
+ * product's source. Its absence is what makes a bare `deploy` a release
+ * deploy, so no pipeline has to pass a flag that duplicates the version it
+ * already pinned in `npx`.
+ */
+export function hasFoundationWorkspace(foundationRoot: string = FOUNDATION_ROOT): boolean {
+  return existsSync(join(foundationRoot, "packages", "gateway", "package.json"));
+}
+
+export interface ReleaseRequestOptions {
+  env?: Record<string, string | undefined>;
+  /** Overridable for tests. */
+  version?: string;
+  workspace?: boolean;
+}
+
+/**
+ * What release this command should deploy, or `undefined` for a local build.
+ */
+export function releaseRequest(
+  args: readonly string[],
+  options: ReleaseRequestOptions = {},
+): ReleaseRequest | undefined {
+  const env = options.env ?? process.env;
+  const bucket =
+    flag(args, "--release-bucket") ?? env[RELEASE_BUCKET_ENV] ?? DEFAULT_RELEASE_BUCKET;
+  const manifestRef = flag(args, "--manifest");
+  const explicit = flag(args, "--release");
+  if (explicit !== undefined) {
+    if (!RELEASE_VERSION_RE.test(explicit))
+      throw new Error(`--release wants a version like v0.1.0, not "${explicit}"`);
+    return { version: explicit, bucket, ...(manifestRef === undefined ? {} : { manifestRef }) };
+  }
+  if (manifestRef !== undefined) return { manifestRef, bucket };
+
+  const workspace = options.workspace ?? hasFoundationWorkspace();
+  if (workspace) return undefined;
+  const version = `v${options.version ?? toolVersion()}`;
+  if (!RELEASE_VERSION_RE.test(version))
+    throw new Error(
+      `this copy of foundation-deploy is version ${version.slice(1)}, which is not a release; pass --release <version>`,
+    );
+  return { version, bucket };
+}
+
+/** The key ARN a deployer will accept a manifest from. */
+export function expectedKeyArn(env: Record<string, string | undefined> = process.env): string {
+  const configured = env[RELEASE_KMS_KEY_ARN_ENV] ?? RELEASE_KMS_KEY_ARN;
+  if (configured === undefined || configured === "")
+    throw new Error(
+      `no Foundation release signing key is configured; set ${RELEASE_KMS_KEY_ARN_ENV} to the key ARN published with the release`,
+    );
+  return configured;
+}
+
+export interface ResolveReleaseDeps {
+  /** Defaults to the SDK-backed verifier for the expected key. */
+  kms?: KmsVerifier;
+  kmsKeyArn?: string;
+  /** Copies `s3://<bucket>/<key>` to a local path. Defaults to `aws s3 cp`. */
+  download?: (ctx: AwsCallContext, bucket: string, key: string, dest: string) => Promise<void>;
+  /** Where the verified manifest is cached for the CDK app. */
+  cacheDir?: string;
+  /**
+   * Check every artifact's digest, not only the signature. On by default:
+   * the signature says the list is Foundation's, the digests say the bytes
+   * the deploy will hand CloudFormation are the ones on the list.
+   */
+  verifyArtifacts?: boolean;
+  env?: Record<string, string | undefined>;
+}
+
+/** `aws s3 cp` — the same CLI every other read in the deploy tool uses. */
+export async function s3Download(
+  ctx: AwsCallContext,
+  bucket: string,
+  key: string,
+  dest: string,
+): Promise<void> {
+  mkdirSync(dirname(dest), { recursive: true });
+  await aws(ctx, ["s3", "cp", `s3://${bucket}/${key}`, dest]);
+}
+
+/**
+ * Fetch and verify the release a request names. Throws unless the manifest is
+ * signed by the expected key and every artifact hashes to what it claims.
+ *
+ * Nothing else in the deploy may run before this returns — that ordering is
+ * the whole point of a signed manifest, and `deploy.ts` is written so the
+ * image step, the CDK call and the config sync all sit after it.
+ */
+export async function verifyRelease(
+  ctx: AwsCallContext,
+  request: ReleaseRequest,
+  deps: ResolveReleaseDeps = {},
+): Promise<ResolvedRelease> {
+  const env = deps.env ?? process.env;
+  const kmsKeyArn = deps.kmsKeyArn ?? expectedKeyArn(env);
+  const download = deps.download ?? s3Download;
+  const local = localManifestRef(request);
+  const version = request.version;
+  const cacheDir =
+    deps.cacheDir ?? releaseCacheDir(version ?? "unversioned", env as NodeJS.ProcessEnv);
+  const manifestPath = local ?? join(cacheDir, "manifest.json");
+
+  if (local === undefined) {
+    const source = s3ManifestRef(request);
+    await download(ctx, source.bucket, source.key, manifestPath);
+  }
+
+  const manifest = await verifyManifest(JSON.parse(readFileSync(manifestPath, "utf8")), {
+    kmsKeyArn,
+    kms: deps.kms ?? kmsVerifier(kmsKeyArn, ctx.profile === "" ? {} : { profile: ctx.profile }),
+    ...(version === undefined ? {} : { expectVersion: version }),
+    ...(deps.verifyArtifacts === false
+      ? {}
+      : {
+          readArtifact: async (key: string) => {
+            const dest = join(cacheDir, "artifacts", key.split("/").slice(-1)[0] ?? "artifact");
+            await download(ctx, request.bucket, key, dest);
+            return readFileSync(dest);
+          },
+        }),
+  });
+  return { version: manifest.version, bucket: request.bucket, manifestPath, manifest };
+}
+
+/**
+ * The release a command will deploy: verified for real, or — in a dry run,
+ * which has neither credentials nor any business downloading megabytes —
+ * planned.
+ */
+export async function resolveRelease(
+  ctx: AwsCallContext,
+  request: ReleaseRequest,
+  deps: ResolveReleaseDeps = {},
+): Promise<ResolvedRelease> {
+  return ctx.dryRun === true ? plannedRelease(request) : verifyRelease(ctx, request, deps);
+}
+
+/** What a dry run reports: the release it would verify, fetching nothing. */
+export function plannedRelease(request: ReleaseRequest): ResolvedRelease {
+  const version = request.version ?? "<from the manifest>";
+  const local = localManifestRef(request);
+  return {
+    version,
+    bucket: request.bucket,
+    manifestPath: local ?? join(releaseCacheDir(version), "manifest.json"),
+  };
+}
+
+/** The manifest as a local path, when the caller gave one. */
+function localManifestRef(request: ReleaseRequest): string | undefined {
+  const ref = request.manifestRef;
+  if (ref === undefined || ref.startsWith("s3://")) return undefined;
+  return isAbsolute(ref) ? ref : resolve(process.cwd(), ref);
+}
+
+/** Where the manifest is fetched from: an explicit `s3://…`, else the version's key. */
+export function s3ManifestRef(request: ReleaseRequest): { bucket: string; key: string } {
+  const ref = request.manifestRef;
+  if (ref?.startsWith("s3://") === true) {
+    const [bucket, ...rest] = ref.slice("s3://".length).split("/");
+    const key = rest.join("/");
+    if (bucket === undefined || bucket === "" || key === "")
+      throw new Error(`--manifest ${ref} is not an s3://bucket/key URI`);
+    return { bucket, key };
+  }
+  if (request.version === undefined)
+    throw new Error("a release needs a version or a manifest to fetch");
+  return { bucket: request.bucket, key: manifestKey(request.version) };
+}
+
+/** The `-c` context a release deploy adds to the CDK invocation. */
+export function releaseContext(release: ResolvedRelease): string[] {
+  return [
+    "-c",
+    `release=${release.version}`,
+    "-c",
+    `releaseManifest=${release.manifestPath}`,
+    "-c",
+    `releaseBucket=${release.bucket}`,
+  ];
+}

package/src/deploy/runtime-secret.ts

@@ -0,0 +1,241 @@
+/**
+ * Composition of `<secretPrefix>/agent/runtime` — the one secret the container is told
+ * about (RUNTIME_SECRET_ID). server.ts fetches it at boot and setdefaults each
+ * key into the environment, so this object IS the runtime's env contract.
+ *
+ * The bot token lives here rather than being fetched separately so the agent
+ * needs exactly one Secrets Manager read at start.
+ */
+import {
+  type Instance,
+  type InstanceNames,
+  instanceNames as namesFor,
+  slackCommandPrefix,
+} from "@deployfoundation/foundation-core/instance";
+
+/** The pinned AgentCore endpoint a deploy promotes and the invoker calls. */
+export const LIVE_ENDPOINT = "live";
+
+export interface SlackAppSecret {
+  bot_token: string;
+  bot_user_id: string;
+  team_id?: string;
+  api_app_id?: string;
+}
+
+export interface RuntimeSecretInputs {
+  /** The instance being deployed: every secret id and default below is its own. */
+  instance: Instance;
+  slackApp: SlackAppSecret;
+  tableName: string;
+  /** `FoundationData.ItemsTableName` — the pk+sk table holding todos and routines. */
+  itemsTableName?: string;
+  bucketName: string;
+  /**
+   * `FoundationData.DocumentsBucketName` — absent before the dedicated bucket has
+   * been deployed, in which case the documents capability has no binding.
+   */
+  documentsBucketName?: string;
+  /** `FoundationAgent.WebSearchGatewayUrl` — omitted before the gateway exists. */
+  webSearchUrl?: string;
+  /** `FoundationApi.InvokeQueueUrl` — where a fired routine re-enqueues its turn. */
+  invokeQueueUrl?: string;
+  /** `FoundationApi.RoutineSchedulerRoleArn` — passed to EventBridge Scheduler. */
+  routineSchedulerRoleArn?: string;
+  /** `FoundationAgent.AgentRuntimeArn` — named by every schedule's target input. */
+  agentRuntimeArn?: string;
+  /**
+   * The pinned endpoint humans talk to. The container cannot learn it from
+   * inside AgentCore, and it is half the name of its own span log group
+   * (`<runtime id>-<endpoint>`), so the deploy tells it.
+   */
+  agentEndpoint?: string;
+  /**
+   * `FoundationAgent.ReadOnlyRoleArn` — the instance's OWN account, expressed as a
+   * role the agent assumes. Absent on a stack deployed before it existed;
+   * `aws-readonly` then offers nothing unless `config.yaml` names another role.
+   */
+  readOnlyRoleArn?: string;
+  /**
+   * `FoundationApi.EmailProxyFunctionArn` — the ONLY thing the container is told
+   * about email. No mailbox credential is ever in this secret, or reachable
+   * from the execution role: the agent can invoke the proxy and nothing more.
+   * Absent on a stack deployed before the proxy existed; the registry then
+   * offers no email tools.
+   */
+  emailProxyFunctionArn?: string;
+  /**
+   * `FoundationApi.BrowserProxyFunctionArn`; absent when managed browser is disabled.
+   * The runtime receives no Browser API grant or signing secret.
+   */
+  browserProxyFunctionArn?: string;
+  /**
+   * `FoundationApi.CrmProxyFunctionArn` — the sole CRM binding supplied to the
+   * shell-capable container. Storage remains reachable only through the proxy.
+   */
+  crmProxyFunctionArn?: string;
+  /** Hash of the CRM policy baked into the deployed proxy; never a credential. */
+  crmPolicyFingerprint?: string;
+  /**
+   * `FoundationApi.OtterProxyFunctionArn` — the ONLY Otter binding given to the
+   * shell-capable container. The API credential remains readable solely by
+   * the proxy role. Absent deployments offer no Otter tools.
+   */
+  otterProxyFunctionArn?: string;
+  /**
+   * `FoundationApi.KnockProxyFunctionArn` — the agent's sole Knock binding. OAuth
+   * client and credential secret ids never enter this runtime secret.
+   */
+  knockProxyFunctionArn?: string;
+  /**
+   * `FoundationApi.UpworkProxyFunctionArn` — the sole Upwork binding supplied to the
+   * shell-capable container. OAuth client and token state stay in the proxy.
+   */
+  upworkProxyFunctionArn?: string;
+  /** Trusted gateway ingress used instead of granting the agent normal-queue writes. */
+  routineIngressFunctionArn?: string;
+  defaultRepo?: string;
+}
+
+export function composeRuntimeSecret(inputs: RuntimeSecretInputs): Record<string, string> {
+  const { instance, slackApp, tableName, bucketName } = inputs;
+  const names: InstanceNames = namesFor(instance);
+  for (const [key, value] of [
+    ["bot_token", slackApp.bot_token],
+    ["bot_user_id", slackApp.bot_user_id],
+    ["table name", tableName],
+    ["bucket name", bucketName],
+  ] as const) {
+    if (typeof value !== "string" || value === "")
+      throw new Error(`runtime secret: missing ${key}`);
+  }
+  return {
+    // Which deployment this container is. Logs and the message footer say so;
+    // nothing else branches on it.
+    FOUNDATION_INSTANCE: instance.name,
+    // The prefix this deployment's slash commands carry. A tool that tells
+    // someone to run a connect command has to name the command their own
+    // workspace installed, not the reference instance's `/sky-*` set.
+    FOUNDATION_COMMAND_PREFIX: slackCommandPrefix(instance),
+    FOUNDATION_SLACK_BOT_TOKEN: slackApp.bot_token,
+    FOUNDATION_SLACK_BOT_USER_ID: slackApp.bot_user_id,
+    FOUNDATION_GITHUB_APP_SECRET_ID: names.secretGithubApp,
+    FOUNDATION_CODEX_SECRET_ID: names.secretCodex,
+    // The image key. Always named: server.ts reads it lazily, so a secret
+    // still holding the CDK placeholder costs nothing until an image is asked for.
+    FOUNDATION_GOOGLE_AI_STUDIO_SECRET_ID: names.secretGoogleAiStudio,
+    // Drive service account JSON. Its `client_email` is the address users
+    // share folders/files with; the private key is fetched only on tool use.
+    FOUNDATION_GOOGLE_DRIVE_SECRET_ID: names.secretGoogleDrive,
+    // Calendar OAuth *client*. Per-person refresh tokens live in FoundationItems,
+    // never in a secret and never in the runtime environment.
+    FOUNDATION_GOOGLE_CALENDAR_SECRET_ID: names.secretGoogleCalendar,
+    // The shared OAuth client. Preferred over the one Calendar historically
+    // kept inside its own secret, which stays a fallback.
+    FOUNDATION_GOOGLE_OAUTH_SECRET_ID: names.secretGoogleOauth,
+    FOUNDATION_TABLE_NAME: tableName,
+    // Absent on a stack deployed before the table existed; server.ts then
+    // offers neither the todo nor the routine tools.
+    ...(inputs.itemsTableName !== undefined && inputs.itemsTableName !== ""
+      ? { FOUNDATION_ITEMS_TABLE_NAME: inputs.itemsTableName }
+      : {}),
+    FOUNDATION_BUCKET_NAME: bucketName,
+    // Deliberately absent until FoundationData has exported the dedicated bucket:
+    // configuration alone must not expose document tools without storage.
+    ...(inputs.documentsBucketName !== undefined && inputs.documentsBucketName !== ""
+      ? { FOUNDATION_DOCUMENTS_BUCKET_NAME: inputs.documentsBucketName }
+      : {}),
+    FOUNDATION_CONFIG_KEY: names.configKey,
+    FOUNDATION_DEFAULT_REPO: inputs.defaultRepo ?? names.defaultRepo,
+    // The org the instance's GitHub App is installed on. The prompt names it
+    // and `gh repo list` is scoped by it; nothing in the image hard-codes one.
+    FOUNDATION_GITHUB_ORG: instance.github.org,
+    // Workflow-file changes are executable code, so pass the narrow repo
+    // allowlist only when this instance explicitly opts in.
+    ...(instance.github.workflowWriteRepos !== undefined &&
+    instance.github.workflowWriteRepos.length > 0
+      ? {
+          FOUNDATION_GITHUB_WORKFLOW_WRITE_REPOS: JSON.stringify(
+            instance.github.workflowWriteRepos,
+          ),
+        }
+      : {}),
+    // This instance's AgentCore runtime name. The commit author falls back to
+    // it while the GitHub App has no slug yet.
+    FOUNDATION_RUNTIME_NAME: names.runtimeName,
+    // The App's slug: the agent authors commits as `<slug>[bot]` so GitHub
+    // attributes them to the App. Absent until bootstrap has created the App.
+    ...(instance.github.appSlug !== "TBD"
+      ? { FOUNDATION_GITHUB_APP_SLUG: instance.github.appSlug }
+      : {}),
+    // Absent (rather than empty) when there is no gateway yet: server.ts
+    // treats a missing url as "no search_web tool".
+    ...(inputs.webSearchUrl !== undefined && inputs.webSearchUrl !== ""
+      ? { FOUNDATION_WEB_SEARCH_URL: inputs.webSearchUrl }
+      : {}),
+    // The routine trio: all three or none, and server.ts offers no
+    // `routine_*` tools until every one of them is present.
+    ...(inputs.invokeQueueUrl !== undefined && inputs.invokeQueueUrl !== ""
+      ? { FOUNDATION_INVOKE_QUEUE_URL: inputs.invokeQueueUrl }
+      : {}),
+    ...(inputs.routineSchedulerRoleArn !== undefined && inputs.routineSchedulerRoleArn !== ""
+      ? { FOUNDATION_ROUTINE_SCHEDULER_ROLE_ARN: inputs.routineSchedulerRoleArn }
+      : {}),
+    ...(inputs.agentRuntimeArn !== undefined && inputs.agentRuntimeArn !== ""
+      ? { FOUNDATION_AGENT_RUNTIME_ARN: inputs.agentRuntimeArn }
+      : {}),
+    // The EventBridge Scheduler group the runtime role is allowed to write
+    // (`<prefix>-routines`, api-stack RoutineGroup). Derived, never optional:
+    // without it the agent fell back to a hard-coded group name, which only
+    // one instance's role may touch, and every other instance logged
+    // AccessDenied on CreateSchedule (2026-09-07).
+    FOUNDATION_ROUTINE_GROUP: names.routineGroup,
+    // Always `live` today: every deploy promotes that one endpoint, and it is
+    // what the span log group is named after.
+    FOUNDATION_AGENT_ENDPOINT:
+      inputs.agentEndpoint !== undefined && inputs.agentEndpoint !== ""
+        ? inputs.agentEndpoint
+        : LIVE_ENDPOINT,
+    ...(inputs.readOnlyRoleArn !== undefined && inputs.readOnlyRoleArn !== ""
+      ? { FOUNDATION_AWS_READONLY_ROLE_ARN: inputs.readOnlyRoleArn }
+      : {}),
+    ...(inputs.emailProxyFunctionArn !== undefined && inputs.emailProxyFunctionArn !== ""
+      ? { FOUNDATION_EMAIL_PROXY_FUNCTION_ARN: inputs.emailProxyFunctionArn }
+      : {}),
+    ...(inputs.browserProxyFunctionArn !== undefined && inputs.browserProxyFunctionArn !== ""
+      ? { FOUNDATION_BROWSER_PROXY_FUNCTION_ARN: inputs.browserProxyFunctionArn }
+      : {}),
+    ...(inputs.crmProxyFunctionArn !== undefined && inputs.crmProxyFunctionArn !== ""
+      ? { FOUNDATION_CRM_PROXY_FUNCTION_ARN: inputs.crmProxyFunctionArn }
+      : {}),
+    ...(inputs.crmPolicyFingerprint !== undefined && inputs.crmPolicyFingerprint !== ""
+      ? { FOUNDATION_CRM_POLICY_FINGERPRINT: inputs.crmPolicyFingerprint }
+      : {}),
+    ...(inputs.otterProxyFunctionArn !== undefined && inputs.otterProxyFunctionArn !== ""
+      ? { FOUNDATION_OTTER_PROXY_FUNCTION_ARN: inputs.otterProxyFunctionArn }
+      : {}),
+    ...(inputs.knockProxyFunctionArn !== undefined && inputs.knockProxyFunctionArn !== ""
+      ? { FOUNDATION_KNOCK_PROXY_FUNCTION_ARN: inputs.knockProxyFunctionArn }
+      : {}),
+    ...(inputs.upworkProxyFunctionArn !== undefined && inputs.upworkProxyFunctionArn !== ""
+      ? { FOUNDATION_UPWORK_PROXY_ARN: inputs.upworkProxyFunctionArn }
+      : {}),
+    ...(inputs.routineIngressFunctionArn !== undefined && inputs.routineIngressFunctionArn !== ""
+      ? { FOUNDATION_ROUTINE_INGRESS_FUNCTION_ARN: inputs.routineIngressFunctionArn }
+      : {}),
+    // The read-only Atlas credential. Always named: server.ts reads it
+    // LAZILY, so a secret still holding the CDK placeholder costs nothing
+    // until someone asks a MongoDB question.
+    FOUNDATION_MONGODB_SECRET_ID: names.secretMongodbReadonly,
+    // CRM storage, the Otter credential, the Knock OAuth secrets, and the Upwork
+    // OAuth secret are intentionally absent here: the shell-capable agent receives
+    // only their fixed proxy ARNs.
+    // A routine fire builds its own session key, so the container needs the
+    // team id the gateway takes from the event. The app secret carries it
+    // when setup wrote one; the instance file is the fallback.
+    FOUNDATION_SLACK_TEAM_ID:
+      slackApp.team_id !== undefined && slackApp.team_id !== ""
+        ? slackApp.team_id
+        : instance.slack.teamId,
+  };
+}