@deployfoundation/foundation-deploy 0.1.0

package/dist/chunk-4aye5cee.js

@@ -0,0 +1,2416 @@
+import {
+  CUSTOMIZATION_ARTIFACT_NAME,
+  LIVE_ENDPOINT_NAME,
+  WEB_SEARCH_TARGET,
+  agentImage,
+  agentImageTagRequired,
+  capabilityEnabled,
+  crmPolicyFingerprint,
+  instanceNames,
+  lambdaCode,
+  newsletterManifestFor,
+  parseInstanceConfig,
+  provisionsIntegration,
+  releaseImageRepositoryArn,
+  requiresAuthenticatedQueue,
+  slackCommandPrefixes
+} from "./chunk-9ddxyvq2.js";
+
+// src/stacks/agent-stack.ts
+import * as cdk from "aws-cdk-lib";
+import * as ecr from "aws-cdk-lib/aws-ecr";
+import * as iam from "aws-cdk-lib/aws-iam";
+class FoundationAgent extends cdk.Stack {
+  repository;
+  executionRole;
+  accessPoint;
+  accessPointArn;
+  agentRuntimeArn;
+  webSearchUrl;
+  readOnlyRole;
+  names;
+  constructor(scope, id, props) {
+    super(scope, id, props);
+    const names = instanceNames(props.instance);
+    this.names = names;
+    const display = props.instance.displayName;
+    const deployRuntime = String(this.node.tryGetContext("deployRuntime") ?? "true") !== "false";
+    const imageTag = this.node.tryGetContext("agentImageTag");
+    this.repository = new ecr.Repository(this, "AgentRepository", {
+      repositoryName: names.ecrRepo,
+      imageScanOnPush: true,
+      imageTagMutability: ecr.TagMutability.IMMUTABLE,
+      encryption: ecr.RepositoryEncryption.KMS,
+      encryptionKey: props.dataKey,
+      lifecycleRules: [{ maxImageCount: 5 }]
+    });
+    const accessPoint = new cdk.CfnResource(this, "FoundationMountAccessPoint", {
+      type: "AWS::S3Files::AccessPoint",
+      properties: {
+        FileSystemId: props.fileSystemId,
+        PosixUser: { Uid: "10001", Gid: "10001" },
+        RootDirectory: {
+          Path: "/sky",
+          CreationPermissions: { OwnerUid: "10001", OwnerGid: "10001", Permissions: "0755" }
+        }
+      }
+    });
+    accessPoint.applyRemovalPolicy(cdk.RemovalPolicy.RETAIN);
+    this.accessPointArn = accessPoint.getAtt("AccessPointArn").toString();
+    new cdk.CfnOutput(this, "FoundationMountAccessPointArn", { value: this.accessPointArn });
+    this.accessPoint = accessPoint;
+    this.executionRole = this.buildExecutionRole(props);
+    this.readOnlyRole = this.buildReadOnlyRole(props);
+    const gateway = this.buildToolGateway(display);
+    this.webSearchUrl = gateway.getAtt("GatewayUrl").toString();
+    this.executionRole.addToPolicy(new iam.PolicyStatement({
+      sid: "InvokeToolGateway",
+      actions: ["bedrock-agentcore:InvokeGateway"],
+      resources: [gateway.getAtt("GatewayArn").toString()]
+    }));
+    if (!deployRuntime) {
+      this.agentRuntimeArn = `arn:${this.partition}:bedrock-agentcore:${this.region}:${this.account}:runtime/${names.runtimeName}-pending`;
+      this.outputs();
+      return;
+    }
+    if (!imageTag && agentImageTagRequired(this)) {
+      throw new Error(`${id}: -c agentImageTag=<tag> is required when deploying the runtime. Pass the tag of an image already pushed to the ${names.ecrRepo} repository, deploy a release with -c release=<version>, or run the bootstrap phase with -c deployRuntime=false.`);
+    }
+    const explicitSubnets = String(this.node.tryGetContext("agentSubnetIds") ?? "").split(",").map((s) => s.trim()).filter(Boolean);
+    const runtimeSubnets = explicitSubnets.length > 0 ? explicitSubnets : props.vpc.selectSubnets(props.egressSubnets).subnetIds;
+    const mountTargets = runtimeSubnets.map((subnetId, index) => new cdk.CfnResource(this, `MountTarget${index}`, {
+      type: "AWS::S3Files::MountTarget",
+      properties: {
+        FileSystemId: props.fileSystemId,
+        SubnetId: subnetId,
+        SecurityGroups: [props.mountTargetSecurityGroup.securityGroupId]
+      }
+    }));
+    const runtime = new cdk.CfnResource(this, "AgentRuntime", {
+      type: "AWS::BedrockAgentCore::Runtime",
+      properties: {
+        AgentRuntimeName: names.runtimeName,
+        Description: `${display} agent runtime (Codex + Slack, single workspace)`,
+        AgentRuntimeArtifact: {
+          ContainerConfiguration: {
+            ContainerUri: agentImage(this, this.repository, imageTag)
+          }
+        },
+        NetworkConfiguration: {
+          NetworkMode: "VPC",
+          NetworkModeConfig: {
+            Subnets: runtimeSubnets,
+            SecurityGroups: [props.agentSecurityGroup.securityGroupId]
+          }
+        },
+        FilesystemConfigurations: [
+          {
+            S3FilesAccessPoint: {
+              AccessPointArn: this.accessPointArn,
+              MountPath: "/mnt/sky"
+            }
+          }
+        ],
+        LifecycleConfiguration: {
+          IdleRuntimeSessionTimeout: 3600,
+          MaxLifetime: 28800
+        },
+        RoleArn: this.executionRole.roleArn,
+        EnvironmentVariables: {
+          RUNTIME_SECRET_ID: props.secrets.runtime.secretName,
+          AWS_REGION: this.region,
+          FOUNDATION_WORKSPACE_ROOT: "/workspace"
+        },
+        Tags: { project: props.instance.naming.secretPrefix }
+      }
+    });
+    runtime.node.addDependency(this.executionRole);
+    runtime.node.addDependency(accessPoint);
+    for (const mountTarget of mountTargets)
+      runtime.node.addDependency(mountTarget);
+    this.agentRuntimeArn = runtime.getAtt("AgentRuntimeArn").toString();
+    this.outputs();
+  }
+  outputs() {
+    new cdk.CfnOutput(this, "AgentRuntimeArn", { value: this.agentRuntimeArn });
+    new cdk.CfnOutput(this, "RepositoryUri", { value: this.repository.repositoryUri });
+    new cdk.CfnOutput(this, "WebSearchGatewayUrl", { value: this.webSearchUrl });
+    new cdk.CfnOutput(this, "ReadOnlyRoleArn", { value: this.readOnlyRole.roleArn });
+  }
+  buildToolGateway(display) {
+    const gatewayArnPattern = `arn:${this.partition}:bedrock-agentcore:${this.region}:${this.account}:gateway/*`;
+    const role = new iam.Role(this, "ToolGatewayRole", {
+      description: "AgentCore tool gateway service role (web search only)",
+      assumedBy: new iam.ServicePrincipal("bedrock-agentcore.amazonaws.com", {
+        conditions: {
+          StringEquals: { "aws:SourceAccount": this.account },
+          ArnLike: { "aws:SourceArn": gatewayArnPattern }
+        }
+      })
+    });
+    role.addToPolicy(new iam.PolicyStatement({
+      sid: "GatewayInvoke",
+      actions: ["bedrock-agentcore:InvokeGateway"],
+      resources: [gatewayArnPattern]
+    }));
+    role.addToPolicy(new iam.PolicyStatement({
+      sid: "WebSearchTool",
+      actions: ["bedrock-agentcore:InvokeWebSearch"],
+      resources: [`arn:aws:bedrock-agentcore:${this.region}:aws:tool/web-search.v1`]
+    }));
+    const gateway = new cdk.CfnResource(this, "ToolGateway", {
+      type: "AWS::BedrockAgentCore::Gateway",
+      properties: {
+        Name: this.names.gatewayName,
+        Description: `${display} managed tool gateway (web search)`,
+        ProtocolType: "MCP",
+        AuthorizerType: "AWS_IAM",
+        RoleArn: role.roleArn
+      }
+    });
+    gateway.node.addDependency(role);
+    const target = new cdk.CfnResource(this, "WebSearchTarget", {
+      type: "AWS::BedrockAgentCore::GatewayTarget",
+      properties: {
+        GatewayIdentifier: gateway.getAtt("GatewayIdentifier"),
+        Name: WEB_SEARCH_TARGET,
+        TargetConfiguration: {
+          Mcp: {
+            Connector: {
+              Source: { ConnectorId: "web-search" },
+              Configurations: [{ Name: "WebSearch", ParameterValues: {} }]
+            }
+          }
+        },
+        CredentialProviderConfigurations: [{ CredentialProviderType: "GATEWAY_IAM_ROLE" }]
+      }
+    });
+    target.node.addDependency(gateway);
+    return gateway;
+  }
+  denyDirectCrmTableAccess(role, instance, crmTable) {
+    if (!instance.integrations.crmStorage)
+      return;
+    const retainedTableArn = cdk.Stack.of(this).formatArn({
+      service: "dynamodb",
+      resource: "table",
+      resourceName: "*-CrmTable*"
+    });
+    const resources = [
+      retainedTableArn,
+      `${retainedTableArn}/index/*`,
+      ...crmTable === undefined ? [] : [crmTable.tableArn, `${crmTable.tableArn}/index/*`]
+    ];
+    role.addToPolicy(new iam.PolicyStatement({
+      sid: "DenyDirectCrmTableAccess",
+      effect: iam.Effect.DENY,
+      actions: [
+        "dynamodb:GetItem",
+        "dynamodb:BatchGetItem",
+        "dynamodb:TransactGetItems",
+        "dynamodb:Query",
+        "dynamodb:Scan",
+        "dynamodb:PartiQLSelect",
+        "dynamodb:ExecuteStatement",
+        "dynamodb:BatchExecuteStatement",
+        "dynamodb:ExportTableToPointInTime"
+      ],
+      resources
+    }));
+  }
+  denyDirectKnockSecretAccess(role, props) {
+    if (!provisionsIntegration(props.instance, "knock"))
+      return;
+    const { knockOauthClient, knockCredential } = props.secrets;
+    if (knockOauthClient === undefined || knockCredential === undefined)
+      throw new Error(`${this.stackName}: integrations.knock is enabled but FoundationData supplied no Knock secrets`);
+    role.addToPolicy(new iam.PolicyStatement({
+      sid: "DenyKnockSecrets",
+      effect: iam.Effect.DENY,
+      actions: ["secretsmanager:GetSecretValue", "secretsmanager:BatchGetSecretValue"],
+      resources: [secretArnPattern(knockOauthClient), secretArnPattern(knockCredential)]
+    }));
+  }
+  denyDirectUpworkApprovalAccess(role, upworkApprovalTable) {
+    if (upworkApprovalTable === undefined)
+      return;
+    role.addToPolicy(new iam.PolicyStatement({
+      sid: "DenyDirectUpworkApprovalAccess",
+      effect: iam.Effect.DENY,
+      actions: ["dynamodb:*"],
+      resources: [upworkApprovalTable.tableArn, `${upworkApprovalTable.tableArn}/index/*`]
+    }));
+  }
+  buildReadOnlyRole(props) {
+    const role = new iam.Role(this, "AgentReadOnlyRole", {
+      roleName: `${props.instance.naming.prefix}ReadOnlyRole`,
+      description: `${props.instance.displayName} read-only role assumed by the agent (aws-readonly)`,
+      assumedBy: new iam.ArnPrincipal(this.executionRole.roleArn),
+      maxSessionDuration: cdk.Duration.hours(1),
+      managedPolicies: [iam.ManagedPolicy.fromAwsManagedPolicyName("ReadOnlyAccess")]
+    });
+    this.denyDirectCrmTableAccess(role, props.instance, props.crmTable);
+    this.denyDirectKnockSecretAccess(role, props);
+    this.denyDirectUpworkApprovalAccess(role, props.upworkApprovalTable);
+    role.addToPolicy(new iam.PolicyStatement({
+      sid: "DenyAgentCoreBrowserMetadata",
+      effect: iam.Effect.DENY,
+      actions: ["bedrock-agentcore:*Browser*"],
+      resources: ["*"]
+    }));
+    role.addToPolicy(new iam.PolicyStatement({
+      sid: "LogsInsights",
+      actions: [
+        "logs:StartQuery",
+        "logs:StopQuery",
+        "logs:GetQueryResults",
+        "logs:FilterLogEvents",
+        "logs:DescribeLogGroups",
+        "logs:DescribeLogStreams"
+      ],
+      resources: ["*"]
+    }));
+    role.addToPolicy(new iam.PolicyStatement({
+      sid: "TraceRead",
+      actions: ["xray:GetTraceSummaries", "xray:BatchGetTraces"],
+      resources: ["*"]
+    }));
+    this.executionRole.addToPolicy(new iam.PolicyStatement({
+      sid: "AssumeReadOnlyRole",
+      actions: ["sts:AssumeRole"],
+      resources: [role.roleArn]
+    }));
+    return role;
+  }
+  buildExecutionRole(props) {
+    const role = new iam.Role(this, "AgentExecutionRole", {
+      assumedBy: new iam.ServicePrincipal("bedrock-agentcore.amazonaws.com"),
+      description: `${props.instance.displayName} AgentCore execution role (least privilege)`
+    });
+    this.denyDirectCrmTableAccess(role, props.instance, props.crmTable);
+    this.denyDirectKnockSecretAccess(role, props);
+    this.denyDirectUpworkApprovalAccess(role, props.upworkApprovalTable);
+    const releaseRepositoryArn = releaseImageRepositoryArn(this);
+    role.addToPolicy(new iam.PolicyStatement({
+      sid: "EcrPull",
+      actions: [
+        "ecr:BatchGetImage",
+        "ecr:GetDownloadUrlForLayer",
+        "ecr:BatchCheckLayerAvailability"
+      ],
+      resources: [
+        this.repository.repositoryArn,
+        ...releaseRepositoryArn === undefined ? [] : [releaseRepositoryArn]
+      ]
+    }));
+    role.addToPolicy(new iam.PolicyStatement({
+      sid: "EcrAuth",
+      actions: ["ecr:GetAuthorizationToken"],
+      resources: ["*"]
+    }));
+    role.addToPolicy(new iam.PolicyStatement({
+      sid: "AgentLogs",
+      actions: [
+        "logs:CreateLogGroup",
+        "logs:CreateLogStream",
+        "logs:PutLogEvents",
+        "logs:DescribeLogStreams"
+      ],
+      resources: [
+        `arn:${this.partition}:logs:${this.region}:${this.account}:log-group:/aws/bedrock-agentcore/runtimes/${this.names.runtimeName}-*`
+      ]
+    }));
+    role.addToPolicy(new iam.PolicyStatement({
+      sid: "TraceIngest",
+      actions: [
+        "xray:PutTraceSegments",
+        "xray:PutTelemetryRecords",
+        "xray:PutSpans",
+        "xray:PutSpansForIndexing"
+      ],
+      resources: ["*"]
+    }));
+    role.addToPolicy(new iam.PolicyStatement({
+      sid: "AgentSecrets",
+      actions: ["secretsmanager:GetSecretValue"],
+      resources: [
+        secretArnPattern(props.secrets.runtime),
+        secretArnPattern(props.secrets.codex),
+        secretArnPattern(props.secrets.googleAiStudio),
+        secretArnPattern(props.secrets.googleDrive),
+        secretArnPattern(props.secrets.googleCalendar),
+        secretArnPattern(props.secrets.googleOauth),
+        secretArnPattern(props.secrets.githubApp),
+        secretArnPattern(props.secrets.slackApp),
+        secretArnPattern(props.secrets.mongodbReadonly)
+      ]
+    }));
+    role.addToPolicy(new iam.PolicyStatement({
+      sid: "CodexCredentialWriteback",
+      actions: ["secretsmanager:PutSecretValue"],
+      resources: [secretArnPattern(props.secrets.codex)]
+    }));
+    role.addToPolicy(new iam.PolicyStatement({
+      sid: "DenySlackSigningSecret",
+      effect: iam.Effect.DENY,
+      actions: ["secretsmanager:GetSecretValue"],
+      resources: [secretArnPattern(props.secrets.signing)]
+    }));
+    role.addToPolicy(new iam.PolicyStatement({
+      sid: "DenyEmailSecret",
+      effect: iam.Effect.DENY,
+      actions: ["secretsmanager:GetSecretValue"],
+      resources: [secretArnPattern(props.secrets.googleEmail)]
+    }));
+    role.addToPolicy(new iam.PolicyStatement({
+      sid: "EmailProxyInvoke",
+      actions: ["lambda:InvokeFunction"],
+      resources: [
+        cdk.Stack.of(this).formatArn({
+          service: "lambda",
+          resource: "function",
+          resourceName: instanceNames(props.instance).emailProxyFunctionName,
+          arnFormat: cdk.ArnFormat.COLON_RESOURCE_NAME
+        })
+      ]
+    }));
+    role.addToPolicy(new iam.PolicyStatement({
+      sid: "DenyDirectAgentCoreBrowser",
+      effect: iam.Effect.DENY,
+      actions: ["bedrock-agentcore:*Browser*"],
+      resources: ["*"]
+    }));
+    if (provisionsIntegration(props.instance, "browser")) {
+      role.addToPolicy(new iam.PolicyStatement({
+        sid: "BrowserProxyInvoke",
+        actions: ["lambda:InvokeFunction"],
+        resources: [
+          cdk.Stack.of(this).formatArn({
+            service: "lambda",
+            resource: "function",
+            resourceName: this.names.browserProxyFunctionName,
+            arnFormat: cdk.ArnFormat.COLON_RESOURCE_NAME
+          })
+        ]
+      }));
+    }
+    if (provisionsIntegration(props.instance, "otter")) {
+      const otterApi = props.secrets.otterApi;
+      if (otterApi === undefined)
+        throw new Error(`${this.stackName}: integrations.otter is enabled but FoundationData supplied no Otter secret`);
+      role.addToPolicy(new iam.PolicyStatement({
+        sid: "DenyOtterSecret",
+        effect: iam.Effect.DENY,
+        actions: ["secretsmanager:GetSecretValue"],
+        resources: [secretArnPattern(otterApi)]
+      }));
+      role.addToPolicy(new iam.PolicyStatement({
+        sid: "OtterProxyInvoke",
+        actions: ["lambda:InvokeFunction"],
+        resources: [
+          cdk.Stack.of(this).formatArn({
+            service: "lambda",
+            resource: "function",
+            resourceName: this.names.otterProxyFunctionName,
+            arnFormat: cdk.ArnFormat.COLON_RESOURCE_NAME
+          })
+        ]
+      }));
+    }
+    if (provisionsIntegration(props.instance, "knock")) {
+      role.addToPolicy(new iam.PolicyStatement({
+        sid: "KnockProxyInvoke",
+        actions: ["lambda:InvokeFunction"],
+        resources: [
+          cdk.Stack.of(this).formatArn({
+            service: "lambda",
+            resource: "function",
+            resourceName: this.names.knockProxyFunctionName,
+            arnFormat: cdk.ArnFormat.COLON_RESOURCE_NAME
+          })
+        ]
+      }));
+    }
+    if (provisionsIntegration(props.instance, "upwork")) {
+      const upwork = props.secrets.upwork;
+      if (upwork === undefined)
+        throw new Error(`${this.stackName}: integrations.upwork is enabled but FoundationData supplied no Upwork secret`);
+      role.addToPolicy(new iam.PolicyStatement({
+        sid: "DenyUpworkSecret",
+        effect: iam.Effect.DENY,
+        actions: ["secretsmanager:GetSecretValue"],
+        resources: [secretArnPattern(upwork)]
+      }));
+      role.addToPolicy(new iam.PolicyStatement({
+        sid: "UpworkProxyInvoke",
+        actions: ["lambda:InvokeFunction"],
+        resources: [
+          cdk.Stack.of(this).formatArn({
+            service: "lambda",
+            resource: "function",
+            resourceName: this.names.upworkProxyFunctionName,
+            arnFormat: cdk.ArnFormat.COLON_RESOURCE_NAME
+          })
+        ]
+      }));
+    }
+    if (provisionsIntegration(props.instance, "crm")) {
+      role.addToPolicy(new iam.PolicyStatement({
+        sid: "CrmProxyInvoke",
+        actions: ["lambda:InvokeFunction"],
+        resources: [
+          cdk.Stack.of(this).formatArn({
+            service: "lambda",
+            resource: "function",
+            resourceName: this.names.crmProxyFunctionName,
+            arnFormat: cdk.ArnFormat.COLON_RESOURCE_NAME
+          })
+        ]
+      }));
+    }
+    role.addToPolicy(new iam.PolicyStatement({
+      sid: "ConfigAndSkills",
+      actions: ["s3:GetObject"],
+      resources: [props.bucket.arnForObjects("*")]
+    }));
+    role.addToPolicy(new iam.PolicyStatement({
+      sid: "MemoryWrite",
+      actions: ["s3:PutObject"],
+      resources: [props.bucket.arnForObjects("memory/*")]
+    }));
+    role.addToPolicy(new iam.PolicyStatement({
+      sid: "ConfigList",
+      actions: ["s3:ListBucket"],
+      resources: [props.bucket.bucketArn]
+    }));
+    role.addToPolicy(new iam.PolicyStatement({
+      sid: "DocumentsObjects",
+      actions: ["s3:GetObject", "s3:PutObject", "s3:DeleteObject"],
+      resources: [props.documentBucket.arnForObjects("*")]
+    }));
+    role.addToPolicy(new iam.PolicyStatement({
+      sid: "DocumentsList",
+      actions: ["s3:ListBucket"],
+      resources: [props.documentBucket.bucketArn]
+    }));
+    role.addToPolicy(new iam.PolicyStatement({
+      sid: "PersistentMount",
+      actions: ["s3files:ClientMount", "s3files:ClientWrite"],
+      resources: [
+        `arn:${this.partition}:s3files:${this.region}:${this.account}:file-system/${props.fileSystemId}`
+      ],
+      conditions: { ArnEquals: { "s3files:AccessPointArn": this.accessPointArn } }
+    }));
+    role.addToPolicy(new iam.PolicyStatement({
+      sid: "PersistentMountDescribe",
+      actions: ["s3files:Get*", "s3files:List*", "s3files:Describe*"],
+      resources: [
+        this.accessPointArn,
+        `arn:${this.partition}:s3files:${this.region}:${this.account}:file-system/${props.fileSystemId}`
+      ]
+    }));
+    role.addToPolicy(new iam.PolicyStatement({
+      sid: "StateTable",
+      actions: [
+        "dynamodb:GetItem",
+        "dynamodb:PutItem",
+        "dynamodb:UpdateItem",
+        "dynamodb:DeleteItem",
+        "dynamodb:Query"
+      ],
+      resources: [props.table.tableArn]
+    }));
+    role.addToPolicy(new iam.PolicyStatement({
+      sid: "ItemsTable",
+      actions: [
+        "dynamodb:GetItem",
+        "dynamodb:PutItem",
+        "dynamodb:UpdateItem",
+        "dynamodb:DeleteItem",
+        "dynamodb:Query"
+      ],
+      resources: [props.itemsTable.tableArn]
+    }));
+    role.addToPolicy(new iam.PolicyStatement({
+      sid: "DataKeyUsage",
+      actions: ["kms:Decrypt", "kms:Encrypt", "kms:GenerateDataKey", "kms:DescribeKey"],
+      resources: [props.dataKey.keyArn]
+    }));
+    role.addToPolicy(new iam.PolicyStatement({
+      sid: "RoutineSchedules",
+      actions: [
+        "scheduler:CreateSchedule",
+        "scheduler:UpdateSchedule",
+        "scheduler:DeleteSchedule",
+        "scheduler:GetSchedule"
+      ],
+      resources: [
+        `arn:${this.partition}:scheduler:${this.region}:${this.account}:schedule/${this.names.routineGroup}/*`
+      ]
+    }));
+    role.addToPolicy(new iam.PolicyStatement({
+      sid: "PassRoutineSchedulerRole",
+      actions: ["iam:PassRole"],
+      resources: [
+        `arn:${this.partition}:iam::${this.account}:role/${this.names.routineSchedulerRole}`
+      ],
+      conditions: { StringEquals: { "iam:PassedToService": "scheduler.amazonaws.com" } }
+    }));
+    if (requiresAuthenticatedQueue(props.instance)) {
+      role.addToPolicy(new iam.PolicyStatement({
+        sid: "RoutineIngressInvoke",
+        actions: ["lambda:InvokeFunction"],
+        resources: [
+          cdk.Stack.of(this).formatArn({
+            service: "lambda",
+            resource: "function",
+            resourceName: this.names.slackGatewayFunctionName,
+            arnFormat: cdk.ArnFormat.COLON_RESOURCE_NAME
+          })
+        ]
+      }));
+    } else {
+      role.addToPolicy(new iam.PolicyStatement({
+        sid: "InvokeQueueSend",
+        actions: ["sqs:SendMessage"],
+        resources: [
+          `arn:${this.partition}:sqs:${this.region}:${this.account}:${this.names.api}-InvokeQueue*`
+        ]
+      }));
+    }
+    role.addToPolicy(new iam.PolicyStatement({
+      sid: "SessionEni",
+      actions: [
+        "ec2:CreateNetworkInterface",
+        "ec2:DescribeNetworkInterfaces",
+        "ec2:DeleteNetworkInterface",
+        "ec2:DescribeSubnets",
+        "ec2:DescribeSecurityGroups",
+        "ec2:DescribeVpcs"
+      ],
+      resources: ["*"]
+    }));
+    role.addToPolicy(new iam.PolicyStatement({
+      sid: "WorkloadIdentity",
+      actions: [
+        "bedrock-agentcore:GetWorkloadAccessToken",
+        "bedrock-agentcore:GetWorkloadAccessTokenForJWT",
+        "bedrock-agentcore:GetWorkloadAccessTokenForUserId"
+      ],
+      resources: [
+        `arn:${this.partition}:bedrock-agentcore:${this.region}:${this.account}:workload-identity-directory/default*`
+      ]
+    }));
+    return role;
+  }
+}
+function secretArnPattern(secret) {
+  return secret.secretFullArn ?? `${secret.secretArn}-??????`;
+}
+
+// src/stacks/api-stack.ts
+import { readFileSync } from "node:fs";
+import * as cdk2 from "aws-cdk-lib";
+import * as apigateway from "aws-cdk-lib/aws-apigateway";
+import * as cloudwatch from "aws-cdk-lib/aws-cloudwatch";
+import * as cwActions from "aws-cdk-lib/aws-cloudwatch-actions";
+import * as iam2 from "aws-cdk-lib/aws-iam";
+import * as lambda from "aws-cdk-lib/aws-lambda";
+import * as lambdaEventSources from "aws-cdk-lib/aws-lambda-event-sources";
+import * as scheduler from "aws-cdk-lib/aws-scheduler";
+import * as sns from "aws-cdk-lib/aws-sns";
+import * as sqs from "aws-cdk-lib/aws-sqs";
+import { parse as parseYaml } from "yaml";
+class FoundationApi extends cdk2.Stack {
+  api;
+  gatewayDlq;
+  invokeQueue;
+  invokeDlq;
+  emailProxyFunction;
+  browserProxyFunction;
+  otterProxyFunction;
+  crmProxyFunction;
+  knockProxyFunction;
+  upworkProxyFunction;
+  constructor(scope, id, props) {
+    super(scope, id, props);
+    const names = instanceNames(props.instance);
+    const display = props.instance.displayName;
+    const upwork = provisionsIntegration(props.instance, "upwork") ? upworkConfigForProvisioning(props.configPath) : undefined;
+    const upworkSecret = upwork === undefined ? undefined : props.secrets.upwork;
+    const upworkApprovalTable = upwork === undefined ? undefined : props.upworkApprovalTable;
+    if (upwork !== undefined && (upworkSecret === undefined || upworkApprovalTable === undefined))
+      throw new Error(`${id}: integrations.upwork is enabled but its secret or approval table was not supplied by FoundationData`);
+    const authenticatedQueue = requiresAuthenticatedQueue(props.instance);
+    this.gatewayDlq = new sqs.Queue(this, "GatewayDlq", {
+      encryption: sqs.QueueEncryption.KMS,
+      encryptionMasterKey: props.dataKey,
+      enforceSSL: true,
+      retentionPeriod: cdk2.Duration.days(14)
+    });
+    this.invokeDlq = new sqs.Queue(this, "InvokeDlq", {
+      encryption: sqs.QueueEncryption.KMS,
+      encryptionMasterKey: props.dataKey,
+      enforceSSL: true,
+      retentionPeriod: cdk2.Duration.days(14)
+    });
+    this.invokeQueue = new sqs.Queue(this, "InvokeQueue", {
+      encryption: sqs.QueueEncryption.KMS,
+      encryptionMasterKey: props.dataKey,
+      enforceSSL: true,
+      visibilityTimeout: cdk2.Duration.seconds(900),
+      retentionPeriod: cdk2.Duration.hours(6),
+      deadLetterQueue: { queue: this.invokeDlq, maxReceiveCount: 1 }
+    });
+    const gatewayRole = new iam2.Role(this, "GatewayRole", {
+      assumedBy: new iam2.ServicePrincipal("lambda.amazonaws.com"),
+      description: `${display} gateway Lambda role (least privilege)`,
+      managedPolicies: [
+        iam2.ManagedPolicy.fromAwsManagedPolicyName("service-role/AWSLambdaBasicExecutionRole")
+      ]
+    });
+    gatewayRole.addToPolicy(new iam2.PolicyStatement({
+      sid: "GatewayCredentials",
+      actions: ["secretsmanager:GetSecretValue"],
+      resources: [
+        secretArnPattern2(props.secrets.signing),
+        secretArnPattern2(props.secrets.slackApp),
+        secretArnPattern2(props.secrets.googleCalendar),
+        secretArnPattern2(props.secrets.googleOauth),
+        ...props.secrets.knockOauthClient === undefined ? [] : [secretArnPattern2(props.secrets.knockOauthClient)]
+      ]
+    }));
+    gatewayRole.addToPolicy(new iam2.PolicyStatement({
+      sid: "DriveIdentityConnect",
+      actions: ["secretsmanager:PutSecretValue"],
+      resources: [secretArnPattern2(props.secrets.googleDrive)]
+    }));
+    gatewayRole.addToPolicy(new iam2.PolicyStatement({
+      sid: "EmailIdentityConnect",
+      actions: ["secretsmanager:PutSecretValue"],
+      resources: [secretArnPattern2(props.secrets.googleEmail)]
+    }));
+    if (props.secrets.knockCredential !== undefined) {
+      gatewayRole.addToPolicy(new iam2.PolicyStatement({
+        sid: "KnockCredentialConnect",
+        actions: ["secretsmanager:PutSecretValue"],
+        resources: [secretArnPattern2(props.secrets.knockCredential)]
+      }));
+    }
+    if (upworkSecret !== undefined) {
+      gatewayRole.addToPolicy(new iam2.PolicyStatement({
+        sid: "UpworkOAuth",
+        actions: [
+          "secretsmanager:GetSecretValue",
+          "secretsmanager:PutSecretValue",
+          "secretsmanager:UpdateSecretVersionStage"
+        ],
+        resources: [secretArnPattern2(upworkSecret)]
+      }));
+    }
+    gatewayRole.addToPolicy(new iam2.PolicyStatement({
+      sid: "DedupeAndThreadIndex",
+      actions: ["dynamodb:PutItem", "dynamodb:GetItem", "dynamodb:UpdateItem"],
+      resources: [props.table.tableArn]
+    }));
+    gatewayRole.addToPolicy(new iam2.PolicyStatement({
+      sid: "CalendarConnections",
+      actions: ["dynamodb:PutItem"],
+      resources: [props.itemsTable.tableArn]
+    }));
+    gatewayRole.addToPolicy(new iam2.PolicyStatement({
+      sid: "QueueSend",
+      actions: ["sqs:SendMessage"],
+      resources: [this.invokeQueue.queueArn]
+    }));
+    gatewayRole.addToPolicy(new iam2.PolicyStatement({
+      sid: "DataKeyUsage",
+      actions: ["kms:Decrypt", "kms:Encrypt", "kms:GenerateDataKey", "kms:DescribeKey"],
+      resources: [props.dataKey.keyArn]
+    }));
+    const gatewayFunction = new lambda.Function(this, "GatewayFunction", {
+      ...authenticatedQueue ? { functionName: names.slackGatewayFunctionName } : {},
+      runtime: lambda.Runtime.NODEJS_22_X,
+      handler: "index.handler",
+      code: lambdaCode(this, "gateway"),
+      role: gatewayRole,
+      timeout: cdk2.Duration.seconds(10),
+      memorySize: 256,
+      deadLetterQueue: this.gatewayDlq,
+      environment: {
+        FOUNDATION_TABLE_NAME: props.table.tableName,
+        FOUNDATION_INVOKE_QUEUE_URL: this.invokeQueue.queueUrl,
+        FOUNDATION_GATEWAY_DLQ_URL: this.gatewayDlq.queueUrl,
+        FOUNDATION_SLACK_SIGNING_SECRET_ID: props.secrets.signing.secretName,
+        FOUNDATION_SLACK_APP_SECRET_ID: props.secrets.slackApp.secretName,
+        FOUNDATION_ADMINS: props.admins,
+        FOUNDATION_AGENT_RUNTIME_ARN: props.agentRuntimeArn,
+        FOUNDATION_DISPLAY_NAME: props.instance.displayName,
+        FOUNDATION_ITEMS_TABLE_NAME: props.itemsTable.tableName,
+        FOUNDATION_GOOGLE_CALENDAR_SECRET_ID: props.secrets.googleCalendar.secretName,
+        FOUNDATION_GOOGLE_OAUTH_SECRET_ID: props.secrets.googleOauth.secretName,
+        FOUNDATION_GOOGLE_DRIVE_SECRET_ID: props.secrets.googleDrive.secretName,
+        FOUNDATION_GOOGLE_EMAIL_SECRET_ID: props.secrets.googleEmail.secretName,
+        ...props.secrets.knockOauthClient === undefined ? {} : { FOUNDATION_KNOCK_OAUTH_CLIENT_SECRET_ID: props.secrets.knockOauthClient.secretName },
+        ...props.secrets.knockCredential === undefined ? {} : { FOUNDATION_KNOCK_CREDENTIAL_SECRET_ID: props.secrets.knockCredential.secretName },
+        ...upworkSecret === undefined ? {} : { FOUNDATION_UPWORK_SECRET_ID: upworkSecret.secretName },
+        FOUNDATION_INSTANCE: props.instance.name,
+        FOUNDATION_COMMAND_PREFIXES: slackCommandPrefixes(props.instance).join(","),
+        FOUNDATION_PROACTIVE_CHANNELS: props.instance.proactive.channels.join(","),
+        FOUNDATION_PROACTIVE_MAX_PER_HOUR: String(props.instance.proactive.maxPerHour)
+      }
+    });
+    gatewayFunction.configureAsyncInvoke({
+      retryAttempts: 0,
+      maxEventAge: cdk2.Duration.seconds(60)
+    });
+    const invokerRole = new iam2.Role(this, "InvokerRole", {
+      assumedBy: new iam2.ServicePrincipal("lambda.amazonaws.com"),
+      description: `${display} invoker Lambda role (least privilege)`,
+      managedPolicies: [
+        iam2.ManagedPolicy.fromAwsManagedPolicyName("service-role/AWSLambdaBasicExecutionRole")
+      ]
+    });
+    invokerRole.addToPolicy(new iam2.PolicyStatement({
+      sid: "InvokeAgentRuntime",
+      actions: ["bedrock-agentcore:InvokeAgentRuntime"],
+      resources: [
+        `arn:${this.partition}:bedrock-agentcore:${this.region}:${this.account}:runtime/${names.runtimeName}*`,
+        `arn:${this.partition}:bedrock-agentcore:${this.region}:${this.account}:runtime/${names.runtimeName}*/runtime-endpoint/*`
+      ]
+    }));
+    invokerRole.addToPolicy(new iam2.PolicyStatement({
+      sid: "SlackBotToken",
+      actions: ["secretsmanager:GetSecretValue"],
+      resources: [secretArnPattern2(props.secrets.slackApp)]
+    }));
+    if (authenticatedQueue) {
+      invokerRole.addToPolicy(new iam2.PolicyStatement({
+        sid: "QueueEnvelopeVerification",
+        actions: ["secretsmanager:GetSecretValue"],
+        resources: [secretArnPattern2(props.secrets.signing)]
+      }));
+    } else {
+      invokerRole.addToPolicy(new iam2.PolicyStatement({
+        sid: "DenySlackSigningSecret",
+        effect: iam2.Effect.DENY,
+        actions: ["secretsmanager:GetSecretValue"],
+        resources: [
+          `arn:${this.partition}:secretsmanager:${this.region}:${this.account}:secret:${names.secretSlackSigning}-??????`
+        ]
+      }));
+    }
+    invokerRole.addToPolicy(new iam2.PolicyStatement({
+      sid: "DataKeyUsage",
+      actions: ["kms:Decrypt", "kms:GenerateDataKey"],
+      resources: [props.dataKey.keyArn]
+    }));
+    const invokerFunction = new lambda.Function(this, "InvokerFunction", {
+      runtime: lambda.Runtime.NODEJS_22_X,
+      handler: "index.handler",
+      code: lambdaCode(this, "invoker"),
+      role: invokerRole,
+      timeout: cdk2.Duration.seconds(900),
+      memorySize: 512,
+      environment: {
+        FOUNDATION_SLACK_APP_SECRET_ID: props.secrets.slackApp.secretName,
+        FOUNDATION_AWS_REGION: this.region,
+        FOUNDATION_AGENT_RUNTIME_QUALIFIER: LIVE_ENDPOINT_NAME,
+        ...authenticatedQueue ? { FOUNDATION_QUEUE_SIGNING_SECRET_ID: props.secrets.signing.secretName } : {}
+      }
+    });
+    invokerFunction.addEventSource(new lambdaEventSources.SqsEventSource(this.invokeQueue, {
+      batchSize: 1,
+      reportBatchItemFailures: false
+    }));
+    this.api = new apigateway.RestApi(this, "FoundationApi", {
+      restApiName: `${props.instance.naming.secretPrefix}-events`,
+      description: `${display} Slack ingress (events + slash commands + interactivity)`,
+      endpointTypes: [apigateway.EndpointType.REGIONAL],
+      deployOptions: {
+        stageName: "prod",
+        throttlingRateLimit: 50,
+        throttlingBurstLimit: 100,
+        metricsEnabled: true
+      },
+      cloudWatchRole: false
+    });
+    const slack = this.api.root.addResource("slack");
+    const integration = new apigateway.LambdaIntegration(gatewayFunction);
+    slack.addResource("events").addMethod("POST", integration);
+    slack.addResource("commands").addMethod("POST", integration);
+    slack.addResource("interactive").addMethod("POST", integration);
+    this.api.root.addResource("calendar").addResource("oauth").addResource("callback").addMethod("GET", integration);
+    this.api.root.addResource("drive").addResource("oauth").addResource("callback").addMethod("GET", integration);
+    this.api.root.addResource("email").addResource("oauth").addResource("callback").addMethod("GET", integration);
+    if (provisionsIntegration(props.instance, "knock")) {
+      this.api.root.addResource("knock").addResource("oauth").addResource("callback").addMethod("GET", integration);
+    }
+    if (upworkSecret !== undefined && upwork !== undefined) {
+      const upworkRedirectUri = this.api.urlForPath("/upwork/oauth/callback");
+      this.api.root.addResource("upwork").addResource("oauth").addResource("callback").addMethod("GET", integration);
+      new cdk2.CfnOutput(this, "UpworkOAuthRedirectUrl", { value: upworkRedirectUri });
+    }
+    const emailProxyRole = new iam2.Role(this, "EmailProxyRole", {
+      assumedBy: new iam2.ServicePrincipal("lambda.amazonaws.com"),
+      description: `${display} email proxy Lambda role (the only reader of the mailbox secret)`,
+      managedPolicies: [
+        iam2.ManagedPolicy.fromAwsManagedPolicyName("service-role/AWSLambdaBasicExecutionRole")
+      ]
+    });
+    emailProxyRole.addToPolicy(new iam2.PolicyStatement({
+      sid: "EmailProxyCredentials",
+      actions: ["secretsmanager:GetSecretValue"],
+      resources: [
+        secretArnPattern2(props.secrets.googleEmail),
+        secretArnPattern2(props.secrets.googleOauth)
+      ]
+    }));
+    emailProxyRole.addToPolicy(new iam2.PolicyStatement({
+      sid: "EmailProxyDataKey",
+      actions: ["kms:Decrypt"],
+      resources: [props.dataKey.keyArn]
+    }));
+    this.emailProxyFunction = new lambda.Function(this, "EmailProxyFunction", {
+      functionName: instanceNames(props.instance).emailProxyFunctionName,
+      runtime: lambda.Runtime.NODEJS_22_X,
+      handler: "index.handler",
+      code: lambdaCode(this, "email-proxy"),
+      role: emailProxyRole,
+      timeout: cdk2.Duration.seconds(30),
+      memorySize: 256,
+      environment: {
+        FOUNDATION_GOOGLE_EMAIL_SECRET_ID: props.secrets.googleEmail.secretName,
+        FOUNDATION_GOOGLE_OAUTH_SECRET_ID: props.secrets.googleOauth.secretName,
+        FOUNDATION_EMAIL_IDENTITIES: JSON.stringify(emailIdentitiesFor(props.configPath))
+      }
+    });
+    const browserDomains = provisionsIntegration(props.instance, "browser") ? browserDomainsFor(props.configPath) : [];
+    if (browserDomains.length > 0) {
+      const browserProxyRole = new iam2.Role(this, "BrowserProxyRole", {
+        assumedBy: new iam2.ServicePrincipal("lambda.amazonaws.com"),
+        description: `${display} policy-enforcing AgentCore Browser proxy role`,
+        managedPolicies: [
+          iam2.ManagedPolicy.fromAwsManagedPolicyName("service-role/AWSLambdaBasicExecutionRole")
+        ]
+      });
+      browserProxyRole.addToPolicy(new iam2.PolicyStatement({
+        sid: "BrowserProxySigningSecret",
+        actions: ["secretsmanager:GetSecretValue"],
+        resources: [secretArnPattern2(props.secrets.signing)]
+      }));
+      browserProxyRole.addToPolicy(new iam2.PolicyStatement({
+        sid: "BrowserProxyDataKey",
+        actions: ["kms:Decrypt", "kms:Encrypt", "kms:GenerateDataKey", "kms:DescribeKey"],
+        resources: [props.dataKey.keyArn]
+      }));
+      browserProxyRole.addToPolicy(new iam2.PolicyStatement({
+        sid: "BrowserProxySessions",
+        actions: [
+          "bedrock-agentcore:StartBrowserSession",
+          "bedrock-agentcore:StopBrowserSession",
+          "bedrock-agentcore:SaveBrowserSessionProfile",
+          "bedrock-agentcore:ConnectBrowserAutomationStream"
+        ],
+        resources: [
+          `arn:${this.partition}:bedrock-agentcore:${this.region}:aws:browser/aws.browser.v1`,
+          `arn:${this.partition}:bedrock-agentcore:${this.region}:${this.account}:browser-profile/*`
+        ]
+      }));
+      browserProxyRole.addToPolicy(new iam2.PolicyStatement({
+        sid: "BrowserProxyProfiles",
+        actions: [
+          "bedrock-agentcore:CreateBrowserProfile",
+          "bedrock-agentcore:GetBrowserProfile",
+          "bedrock-agentcore:ListBrowserProfiles"
+        ],
+        resources: ["*"]
+      }));
+      browserProxyRole.addToPolicy(new iam2.PolicyStatement({
+        sid: "BrowserProxyLease",
+        actions: ["dynamodb:PutItem", "dynamodb:DeleteItem"],
+        resources: [props.itemsTable.tableArn]
+      }));
+      this.browserProxyFunction = new lambda.Function(this, "BrowserProxyFunction", {
+        functionName: names.browserProxyFunctionName,
+        runtime: lambda.Runtime.NODEJS_22_X,
+        handler: "index.handler",
+        role: browserProxyRole,
+        timeout: cdk2.Duration.seconds(240),
+        code: lambdaCode(this, "browser-proxy"),
+        environment: {
+          FOUNDATION_BROWSER_ALLOWED_DOMAINS: JSON.stringify(browserDomains),
+          FOUNDATION_INSTANCE: props.instance.name,
+          FOUNDATION_ITEMS_TABLE_NAME: props.itemsTable.tableName,
+          FOUNDATION_SLACK_SIGNING_SECRET_ID: props.secrets.signing.secretName,
+          FOUNDATION_TEAM_ID: props.instance.slack.teamId
+        }
+      });
+    }
+    if (provisionsIntegration(props.instance, "otter")) {
+      const otterApi = props.secrets.otterApi;
+      if (otterApi === undefined)
+        throw new Error(`${id}: integrations.otter is enabled but FoundationData supplied no Otter secret`);
+      const otterProxyRole = new iam2.Role(this, "OtterProxyRole", {
+        assumedBy: new iam2.ServicePrincipal("lambda.amazonaws.com"),
+        description: `${display} Otter proxy Lambda role (the only reader of the API key)`,
+        managedPolicies: [
+          iam2.ManagedPolicy.fromAwsManagedPolicyName("service-role/AWSLambdaBasicExecutionRole")
+        ]
+      });
+      otterProxyRole.addToPolicy(new iam2.PolicyStatement({
+        sid: "OtterProxyCredentials",
+        actions: ["secretsmanager:GetSecretValue"],
+        resources: [secretArnPattern2(otterApi), secretArnPattern2(props.secrets.signing)]
+      }));
+      this.otterProxyFunction = new lambda.Function(this, "OtterProxyFunction", {
+        functionName: names.otterProxyFunctionName,
+        runtime: lambda.Runtime.NODEJS_22_X,
+        handler: "index.handler",
+        code: lambdaCode(this, "otter-proxy"),
+        role: otterProxyRole,
+        timeout: cdk2.Duration.seconds(30),
+        memorySize: 256,
+        environment: {
+          FOUNDATION_OTTER_API_SECRET_ID: otterApi.secretName,
+          FOUNDATION_SLACK_SIGNING_SECRET_ID: props.secrets.signing.secretName,
+          FOUNDATION_SLACK_TEAM_ID: props.instance.slack.teamId,
+          FOUNDATION_ADMINS: props.admins
+        }
+      });
+      new cdk2.CfnOutput(this, "OtterProxyFunctionArn", {
+        value: this.otterProxyFunction.functionArn
+      });
+    }
+    if (provisionsIntegration(props.instance, "knock")) {
+      const knockCredential = props.secrets.knockCredential;
+      if (knockCredential === undefined)
+        throw new Error(`${id}: integrations.knock is enabled but FoundationData supplied no Knock secret`);
+      const knock = knockConfigForProvisioning(props.configPath);
+      const knockProxyRole = new iam2.Role(this, "KnockProxyRole", {
+        assumedBy: new iam2.ServicePrincipal("lambda.amazonaws.com"),
+        description: `${display} Knock read-only MCP proxy Lambda`,
+        managedPolicies: [
+          iam2.ManagedPolicy.fromAwsManagedPolicyName("service-role/AWSLambdaBasicExecutionRole")
+        ]
+      });
+      knockProxyRole.addToPolicy(new iam2.PolicyStatement({
+        sid: "KnockProxyCredentialRead",
+        actions: ["secretsmanager:GetSecretValue"],
+        resources: [secretArnPattern2(knockCredential), secretArnPattern2(props.secrets.signing)]
+      }));
+      knockProxyRole.addToPolicy(new iam2.PolicyStatement({
+        sid: "KnockProxyCredentialRefresh",
+        actions: ["secretsmanager:PutSecretValue", "secretsmanager:UpdateSecretVersionStage"],
+        resources: [secretArnPattern2(knockCredential)]
+      }));
+      this.knockProxyFunction = new lambda.Function(this, "KnockProxyFunction", {
+        functionName: names.knockProxyFunctionName,
+        runtime: lambda.Runtime.NODEJS_22_X,
+        handler: "index.handler",
+        code: lambdaCode(this, "knock-proxy"),
+        role: knockProxyRole,
+        timeout: cdk2.Duration.seconds(30),
+        memorySize: 256,
+        environment: {
+          FOUNDATION_KNOCK_CREDENTIAL_SECRET_ID: knockCredential.secretName,
+          FOUNDATION_SLACK_SIGNING_SECRET_ID: props.secrets.signing.secretName,
+          FOUNDATION_SLACK_TEAM_ID: props.instance.slack.teamId,
+          FOUNDATION_ADMINS: props.admins,
+          FOUNDATION_KNOCK_DEBUG: String(knock.debug)
+        }
+      });
+      new cdk2.CfnOutput(this, "KnockProxyFunctionArn", {
+        value: this.knockProxyFunction.functionArn
+      });
+    }
+    if (upworkSecret !== undefined && upwork !== undefined && upworkApprovalTable !== undefined) {
+      const upworkProxyRole = new iam2.Role(this, "UpworkProxyRole", {
+        assumedBy: new iam2.ServicePrincipal("lambda.amazonaws.com"),
+        description: `${display} Upwork proxy Lambda role (fixed OAuth and proposal operations)`,
+        managedPolicies: [
+          iam2.ManagedPolicy.fromAwsManagedPolicyName("service-role/AWSLambdaBasicExecutionRole")
+        ]
+      });
+      upworkProxyRole.addToPolicy(new iam2.PolicyStatement({
+        sid: "UpworkProxySecret",
+        actions: [
+          "secretsmanager:GetSecretValue",
+          "secretsmanager:PutSecretValue",
+          "secretsmanager:UpdateSecretVersionStage"
+        ],
+        resources: [secretArnPattern2(upworkSecret)]
+      }));
+      upworkProxyRole.addToPolicy(new iam2.PolicyStatement({
+        sid: "UpworkProxySigningSecret",
+        actions: ["secretsmanager:GetSecretValue"],
+        resources: [secretArnPattern2(props.secrets.signing)]
+      }));
+      upworkProxyRole.addToPolicy(new iam2.PolicyStatement({
+        sid: "UpworkDraftState",
+        actions: ["dynamodb:GetItem", "dynamodb:PutItem", "dynamodb:DeleteItem"],
+        resources: [upworkApprovalTable.tableArn]
+      }));
+      this.upworkProxyFunction = new lambda.Function(this, "UpworkProxyFunction", {
+        functionName: names.upworkProxyFunctionName,
+        runtime: lambda.Runtime.NODEJS_22_X,
+        handler: "index.handler",
+        code: lambdaCode(this, "upwork-proxy"),
+        role: upworkProxyRole,
+        timeout: cdk2.Duration.seconds(30),
+        memorySize: 256,
+        environment: {
+          FOUNDATION_UPWORK_SECRET_ID: upworkSecret.secretName,
+          FOUNDATION_SLACK_SIGNING_SECRET_ID: props.secrets.signing.secretName,
+          FOUNDATION_TABLE_NAME: upworkApprovalTable.tableName,
+          FOUNDATION_SLACK_TEAM_ID: props.instance.slack.teamId,
+          FOUNDATION_UPWORK_ALLOWED_CHANNELS: JSON.stringify(upwork.channels),
+          FOUNDATION_ADMINS: props.admins,
+          FOUNDATION_INSTANCE: props.instance.name
+        }
+      });
+      new cdk2.CfnOutput(this, "UpworkProxyFunctionArn", {
+        value: this.upworkProxyFunction.functionArn
+      });
+    }
+    if (provisionsIntegration(props.instance, "crm")) {
+      const crm = crmConfigForProvisioning(props.configPath);
+      const crmTable = props.crmTable;
+      if (crmTable === undefined)
+        throw new Error(`${id}: integrations.crm is enabled but no CRM table was supplied by FoundationData`);
+      const crmProxyRole = new iam2.Role(this, "CrmProxyRole", {
+        assumedBy: new iam2.ServicePrincipal("lambda.amazonaws.com"),
+        description: `${display} CRM proxy Lambda role (self-hosted CRM table access only)`,
+        managedPolicies: [
+          iam2.ManagedPolicy.fromAwsManagedPolicyName("service-role/AWSLambdaBasicExecutionRole")
+        ]
+      });
+      crmProxyRole.addToPolicy(new iam2.PolicyStatement({
+        sid: "CrmProxySigningSecret",
+        actions: ["secretsmanager:GetSecretValue"],
+        resources: [secretArnPattern2(props.secrets.signing)]
+      }));
+      crmProxyRole.addToPolicy(new iam2.PolicyStatement({
+        sid: "CrmTableData",
+        actions: [
+          "dynamodb:GetItem",
+          "dynamodb:PutItem",
+          "dynamodb:UpdateItem",
+          "dynamodb:DeleteItem",
+          "dynamodb:BatchWriteItem",
+          "dynamodb:TransactWriteItems"
+        ],
+        resources: [crmTable.tableArn]
+      }));
+      crmProxyRole.addToPolicy(new iam2.PolicyStatement({
+        sid: "CrmRecordsIndex",
+        actions: ["dynamodb:Query"],
+        resources: [crmTable.tableArn, `${crmTable.tableArn}/index/RecordsIndex`]
+      }));
+      this.crmProxyFunction = new lambda.Function(this, "CrmProxyFunction", {
+        functionName: names.crmProxyFunctionName,
+        runtime: lambda.Runtime.NODEJS_22_X,
+        handler: "index.handler",
+        code: lambdaCode(this, "crm-proxy"),
+        role: crmProxyRole,
+        timeout: cdk2.Duration.seconds(30),
+        memorySize: 256,
+        environment: {
+          FOUNDATION_CRM_TABLE_NAME: crmTable.tableName,
+          FOUNDATION_SLACK_SIGNING_SECRET_ID: props.secrets.signing.secretName,
+          FOUNDATION_SLACK_TEAM_ID: props.instance.slack.teamId,
+          FOUNDATION_CRM_TENANT_ID: props.instance.name,
+          FOUNDATION_CRM_ALLOWED_CHANNELS: JSON.stringify(crm.channels),
+          FOUNDATION_CRM_ALLOWED_STATUSES: JSON.stringify(crm.statuses),
+          FOUNDATION_CRM_ACTIVITY_TYPES: JSON.stringify(crm.activityTypes),
+          FOUNDATION_CRM_MAX_BATCH_SIZE: String(crm.maxBatchSize)
+        }
+      });
+      new cdk2.CfnOutput(this, "CrmProxyFunctionArn", {
+        value: this.crmProxyFunction.functionArn
+      });
+      new cdk2.CfnOutput(this, "CrmPolicyFingerprint", {
+        value: crm.policyFingerprint
+      });
+    }
+    const alarmTopic = new sns.Topic(this, "AlarmTopic", {
+      displayName: `${display} alarms`
+    });
+    if (props.alarmEmail) {
+      new sns.Subscription(this, "AlarmEmail", {
+        topic: alarmTopic,
+        protocol: sns.SubscriptionProtocol.EMAIL,
+        endpoint: props.alarmEmail
+      });
+    }
+    const alarmAction = new cwActions.SnsAction(alarmTopic);
+    for (const [name, queue] of [
+      ["GatewayDlqDepthAlarm", this.gatewayDlq],
+      ["InvokeDlqDepthAlarm", this.invokeDlq]
+    ]) {
+      const alarm = new cloudwatch.Alarm(this, name, {
+        alarmDescription: `${name}: messages are sitting in the DLQ`,
+        metric: queue.metricApproximateNumberOfMessagesVisible({
+          period: cdk2.Duration.minutes(5),
+          statistic: "Maximum"
+        }),
+        threshold: 1,
+        evaluationPeriods: 1,
+        comparisonOperator: cloudwatch.ComparisonOperator.GREATER_THAN_OR_EQUAL_TO_THRESHOLD,
+        treatMissingData: cloudwatch.TreatMissingData.NOT_BREACHING
+      });
+      alarm.addAlarmAction(alarmAction);
+    }
+    new scheduler.CfnScheduleGroup(this, "RoutineGroup", { name: names.routineGroup });
+    const schedulerRole = new iam2.Role(this, "RoutineSchedulerRole", {
+      roleName: names.routineSchedulerRole,
+      description: "Assumed by EventBridge Scheduler to enqueue a routine fire",
+      assumedBy: new iam2.ServicePrincipal("scheduler.amazonaws.com", {
+        conditions: { StringEquals: { "aws:SourceAccount": this.account } }
+      })
+    });
+    this.invokeQueue.grantSendMessages(schedulerRole);
+    new cdk2.CfnOutput(this, "GoogleCalendarOAuthRedirectUrl", {
+      value: this.api.urlForPath("/calendar/oauth/callback")
+    });
+    new cdk2.CfnOutput(this, "GoogleDriveOAuthRedirectUrl", {
+      value: this.api.urlForPath("/drive/oauth/callback")
+    });
+    new cdk2.CfnOutput(this, "GoogleEmailOAuthRedirectUrl", {
+      value: this.api.urlForPath("/email/oauth/callback")
+    });
+    if (this.knockProxyFunction !== undefined) {
+      new cdk2.CfnOutput(this, "KnockOAuthRedirectUrl", {
+        value: this.api.urlForPath("/knock/oauth/callback")
+      });
+    }
+    new cdk2.CfnOutput(this, "EmailProxyFunctionArn", {
+      value: this.emailProxyFunction.functionArn
+    });
+    if (this.browserProxyFunction !== undefined) {
+      new cdk2.CfnOutput(this, "BrowserProxyFunctionArn", {
+        value: this.browserProxyFunction.functionArn
+      });
+    }
+    new cdk2.CfnOutput(this, "InvokeQueueUrl", { value: this.invokeQueue.queueUrl });
+    new cdk2.CfnOutput(this, "RoutineSchedulerRoleArn", { value: schedulerRole.roleArn });
+    if (authenticatedQueue)
+      new cdk2.CfnOutput(this, "RoutineIngressFunctionArn", {
+        value: gatewayFunction.functionArn
+      });
+    new cdk2.CfnOutput(this, "EventsUrl", { value: this.api.urlForPath("/slack/events") });
+    new cdk2.CfnOutput(this, "CommandsUrl", { value: this.api.urlForPath("/slack/commands") });
+    new cdk2.CfnOutput(this, "InteractiveUrl", {
+      value: this.api.urlForPath("/slack/interactive")
+    });
+  }
+}
+function crmConfigForProvisioning(configPath) {
+  const config = parseInstanceConfig(readFileSync(configPath, "utf8"));
+  const crm = config.capabilities.crm;
+  const missing = [
+    ...crm.enabled ? [] : ["capabilities.crm.enabled"],
+    ...crm.channels.length > 0 ? [] : ["capabilities.crm.channels"],
+    ...crm.statuses.length > 0 ? [] : ["capabilities.crm.statuses"],
+    ...crm.activityTypes.length > 0 ? [] : ["capabilities.crm.activityTypes"]
+  ];
+  if (missing.length > 0)
+    throw new Error(`${configPath}: integrations.crm requires a configured CRM capability (${missing.join(", ")})`);
+  return {
+    channels: [...crm.channels],
+    statuses: [...crm.statuses],
+    activityTypes: [...crm.activityTypes],
+    maxBatchSize: crm.maxBatchSize,
+    policyFingerprint: crmPolicyFingerprint(crm)
+  };
+}
+function knockConfigForProvisioning(configPath) {
+  const config = parseInstanceConfig(readFileSync(configPath, "utf8"));
+  return {
+    debug: config.capabilities.knock.enabled && config.capabilities.knock.debug
+  };
+}
+function upworkConfigForProvisioning(configPath) {
+  const config = parseInstanceConfig(readFileSync(configPath, "utf8"));
+  const upwork = config.capabilities.upwork;
+  const missing = [
+    ...upwork.enabled ? [] : ["capabilities.upwork.enabled"],
+    ...upwork.channels.length > 0 ? [] : ["capabilities.upwork.channels"]
+  ];
+  if (missing.length > 0)
+    throw new Error(`${configPath}: integrations.upwork requires a configured Upwork capability (${missing.join(", ")})`);
+  return { channels: [...upwork.channels] };
+}
+function emailIdentitiesFor(configPath) {
+  const doc = parseYaml(readFileSync(configPath, "utf8"));
+  const email = doc.capabilities?.email;
+  if (email?.enabled !== true || !Array.isArray(email.identities))
+    return [];
+  return email.identities;
+}
+function browserDomainsFor(configPath) {
+  const browser = parseInstanceConfig(readFileSync(configPath, "utf8")).capabilities.browser;
+  return browser.enabled && browser.mode === "read" ? [...browser.allowedDomains] : [];
+}
+function secretArnPattern2(secret) {
+  return secret.secretFullArn ?? `${secret.secretArn}-??????`;
+}
+
+// src/deploy-permissions.ts
+import * as iam3 from "aws-cdk-lib/aws-iam";
+function deployStatements(stack, names, targets, instance) {
+  const secretArn = (name) => `arn:${stack.partition}:secretsmanager:${stack.region}:${stack.account}:secret:${name}-??????`;
+  const runtimeSecret = secretArn(names.secretRuntime);
+  const knockOauthClient = secretArn(names.secretKnockOauthClient);
+  return [
+    new iam3.PolicyStatement({
+      sid: "AssumeCdkBootstrapRoles",
+      actions: ["sts:AssumeRole"],
+      resources: [`arn:${stack.partition}:iam::${stack.account}:role/cdk-*`]
+    }),
+    new iam3.PolicyStatement({
+      sid: "ReadStackOutputs",
+      actions: ["cloudformation:DescribeStacks"],
+      resources: ["*"]
+    }),
+    new iam3.PolicyStatement({
+      sid: "EcrLogin",
+      actions: ["ecr:GetAuthorizationToken"],
+      resources: ["*"]
+    }),
+    new iam3.PolicyStatement({
+      sid: "EcrPushAgentImage",
+      actions: [
+        "ecr:BatchCheckLayerAvailability",
+        "ecr:CompleteLayerUpload",
+        "ecr:InitiateLayerUpload",
+        "ecr:PutImage",
+        "ecr:UploadLayerPart",
+        "ecr:BatchGetImage",
+        "ecr:GetDownloadUrlForLayer",
+        "ecr:DescribeImages"
+      ],
+      resources: [
+        `arn:${stack.partition}:ecr:${stack.region}:${stack.account}:repository/${names.ecrRepo}`
+      ]
+    }),
+    new iam3.PolicyStatement({
+      sid: "ReadDeploySecrets",
+      actions: ["secretsmanager:GetSecretValue"],
+      resources: [secretArn(names.secretSlackApp), secretArn(names.secretGithubApp), runtimeSecret]
+    }),
+    new iam3.PolicyStatement({
+      sid: "WriteRuntimeSecret",
+      actions: ["secretsmanager:PutSecretValue"],
+      resources: [runtimeSecret]
+    }),
+    ...instance?.license === undefined ? [] : [
+      new iam3.PolicyStatement({
+        sid: "CacheLicenseVerification",
+        actions: [
+          "secretsmanager:CreateSecret",
+          "secretsmanager:DescribeSecret",
+          "secretsmanager:GetSecretValue",
+          "secretsmanager:PutSecretValue"
+        ],
+        resources: [secretArn(names.secretLicenseLastVerified)]
+      })
+    ],
+    ...instance !== undefined && provisionsIntegration(instance, "knock") ? [
+      new iam3.PolicyStatement({
+        sid: "RegisterKnockOauthClient",
+        actions: ["secretsmanager:GetSecretValue", "secretsmanager:PutSecretValue"],
+        resources: [knockOauthClient]
+      })
+    ] : [],
+    new iam3.PolicyStatement({
+      sid: "SyncConfigAndSkills",
+      actions: ["s3:PutObject", "s3:DeleteObject", "s3:ListBucket", "s3:GetObject"],
+      resources: [
+        targets.bucket.bucketArn,
+        targets.bucket.arnForObjects("config/*"),
+        targets.bucket.arnForObjects("skills/*")
+      ]
+    }),
+    new iam3.PolicyStatement({
+      sid: "UseDataKey",
+      actions: ["kms:Encrypt", "kms:Decrypt", "kms:GenerateDataKey*"],
+      resources: [targets.dataKey.keyArn]
+    }),
+    new iam3.PolicyStatement({
+      sid: "SmokeTestRuntime",
+      actions: [
+        "bedrock-agentcore:InvokeAgentRuntime",
+        "bedrock-agentcore:GetAgentRuntime",
+        "bedrock-agentcore:ListAgentRuntimeVersions",
+        "bedrock-agentcore:GetAgentRuntimeEndpoint",
+        "bedrock-agentcore:UpdateAgentRuntimeEndpoint"
+      ],
+      resources: [
+        `arn:${stack.partition}:bedrock-agentcore:${stack.region}:${stack.account}:runtime/${names.runtimeName}*`,
+        `arn:${stack.partition}:bedrock-agentcore:${stack.region}:${stack.account}:runtime/${names.runtimeName}*/runtime-endpoint/*`
+      ]
+    }),
+    new iam3.PolicyStatement({
+      sid: "WhoAmI",
+      actions: ["sts:GetCallerIdentity"],
+      resources: ["*"]
+    })
+  ];
+}
+
+// src/stacks/ci-stack.ts
+import * as cdk3 from "aws-cdk-lib";
+import * as iam4 from "aws-cdk-lib/aws-iam";
+class FoundationCi extends cdk3.Stack {
+  deployRole;
+  constructor(scope, id, props) {
+    super(scope, id, props);
+    const names = instanceNames(props.instance);
+    const repository = props.repository ?? props.instance.github.repo;
+    const ids = props.repositoryIds ?? props.instance.github.repoIds;
+    const [owner, repo] = repository.split("/");
+    const mainSubjects = [
+      `repo:${repository}:ref:refs/heads/main`,
+      `repo:${owner}@${ids.owner}/${repo}@${ids.repo}:ref:refs/heads/main`
+    ];
+    const provider = iam4.OpenIdConnectProvider.fromOpenIdConnectProviderArn(this, "GitHubOidc", `arn:${this.partition}:iam::${this.account}:oidc-provider/token.actions.githubusercontent.com`);
+    this.deployRole = new iam4.Role(this, "FoundationDeployRole", {
+      roleName: names.deployRole,
+      description: `GitHub Actions deploy role for ${repository} (main only)`,
+      maxSessionDuration: cdk3.Duration.hours(1),
+      assumedBy: new iam4.WebIdentityPrincipal(provider.openIdConnectProviderArn, {
+        StringEquals: { "token.actions.githubusercontent.com:aud": "sts.amazonaws.com" },
+        StringLike: {
+          "token.actions.githubusercontent.com:sub": mainSubjects
+        }
+      }),
+      inlinePolicies: {
+        FoundationDeploy: new iam4.PolicyDocument({
+          statements: deployStatements(this, names, { bucket: props.bucket, dataKey: props.dataKey }, props.instance)
+        })
+      }
+    });
+    new cdk3.CfnOutput(this, "DeployRoleArn", { value: this.deployRole.roleArn });
+  }
+}
+
+// src/stacks/data-stack.ts
+import * as cdk4 from "aws-cdk-lib";
+import * as dynamodb from "aws-cdk-lib/aws-dynamodb";
+import * as iam5 from "aws-cdk-lib/aws-iam";
+import * as kms from "aws-cdk-lib/aws-kms";
+import * as s3 from "aws-cdk-lib/aws-s3";
+import * as secretsmanager from "aws-cdk-lib/aws-secretsmanager";
+class FoundationData extends cdk4.Stack {
+  dataKey;
+  bucket;
+  documentBucket;
+  fileSystem;
+  table;
+  itemsTable;
+  crmTable;
+  upworkApprovalTable;
+  secrets;
+  constructor(scope, id, props) {
+    super(scope, id, props);
+    const names = instanceNames(props.instance);
+    const display = props.instance.displayName;
+    const crmStorage = props.instance.integrations.crmStorage;
+    this.dataKey = new kms.Key(this, "FoundationDataKey", {
+      description: `${display} CMK for the S3 buckets, DynamoDB table and SQS queues`,
+      enableKeyRotation: true,
+      alias: names.keyAlias
+    });
+    this.bucket = new s3.Bucket(this, "FoundationBucket", {
+      versioned: true,
+      encryption: s3.BucketEncryption.KMS,
+      encryptionKey: this.dataKey,
+      bucketKeyEnabled: true,
+      blockPublicAccess: s3.BlockPublicAccess.BLOCK_ALL,
+      enforceSSL: true,
+      removalPolicy: cdk4.RemovalPolicy.RETAIN
+    });
+    this.documentBucket = new s3.Bucket(this, "DocumentsBucket", {
+      versioned: true,
+      encryption: s3.BucketEncryption.KMS,
+      encryptionKey: this.dataKey,
+      bucketKeyEnabled: true,
+      blockPublicAccess: s3.BlockPublicAccess.BLOCK_ALL,
+      enforceSSL: true,
+      removalPolicy: cdk4.RemovalPolicy.RETAIN
+    });
+    this.table = new dynamodb.Table(this, "FoundationTable", {
+      partitionKey: { name: "pk", type: dynamodb.AttributeType.STRING },
+      timeToLiveAttribute: "ttl",
+      billingMode: dynamodb.BillingMode.PAY_PER_REQUEST,
+      encryption: dynamodb.TableEncryption.CUSTOMER_MANAGED,
+      encryptionKey: this.dataKey,
+      pointInTimeRecoverySpecification: { pointInTimeRecoveryEnabled: true },
+      removalPolicy: cdk4.RemovalPolicy.RETAIN
+    });
+    this.itemsTable = new dynamodb.Table(this, "FoundationItems", {
+      partitionKey: { name: "pk", type: dynamodb.AttributeType.STRING },
+      sortKey: { name: "sk", type: dynamodb.AttributeType.STRING },
+      timeToLiveAttribute: "ttl",
+      billingMode: dynamodb.BillingMode.PAY_PER_REQUEST,
+      encryption: dynamodb.TableEncryption.CUSTOMER_MANAGED,
+      encryptionKey: this.dataKey,
+      pointInTimeRecoverySpecification: { pointInTimeRecoveryEnabled: true },
+      removalPolicy: cdk4.RemovalPolicy.RETAIN
+    });
+    this.crmTable = crmStorage ? new dynamodb.Table(this, "CrmTable", {
+      partitionKey: { name: "pk", type: dynamodb.AttributeType.STRING },
+      sortKey: { name: "sk", type: dynamodb.AttributeType.STRING },
+      timeToLiveAttribute: "ttl",
+      billingMode: dynamodb.BillingMode.PAY_PER_REQUEST,
+      encryption: dynamodb.TableEncryption.CUSTOMER_MANAGED,
+      encryptionKey: this.dataKey,
+      pointInTimeRecoverySpecification: { pointInTimeRecoveryEnabled: true },
+      removalPolicy: cdk4.RemovalPolicy.RETAIN
+    }) : undefined;
+    this.crmTable?.addGlobalSecondaryIndex({
+      indexName: "RecordsIndex",
+      partitionKey: { name: "gsi1pk", type: dynamodb.AttributeType.STRING },
+      sortKey: { name: "gsi1sk", type: dynamodb.AttributeType.STRING },
+      projectionType: dynamodb.ProjectionType.INCLUDE,
+      nonKeyAttributes: ["recordType", "recordId"]
+    });
+    this.upworkApprovalTable = provisionsIntegration(props.instance, "upwork") ? new dynamodb.Table(this, "UpworkApprovalTable", {
+      partitionKey: { name: "pk", type: dynamodb.AttributeType.STRING },
+      timeToLiveAttribute: "ttl",
+      billingMode: dynamodb.BillingMode.PAY_PER_REQUEST,
+      encryption: dynamodb.TableEncryption.CUSTOMER_MANAGED,
+      encryptionKey: this.dataKey,
+      pointInTimeRecoverySpecification: { pointInTimeRecoveryEnabled: true },
+      removalPolicy: cdk4.RemovalPolicy.DESTROY
+    }) : undefined;
+    const secretShell = (constructId, name, description) => new secretsmanager.Secret(this, constructId, {
+      secretName: name,
+      description,
+      removalPolicy: cdk4.RemovalPolicy.RETAIN,
+      generateSecretString: {
+        secretStringTemplate: "{}",
+        generateStringKey: "placeholder"
+      }
+    });
+    const otterApi = provisionsIntegration(props.instance, "otter") ? new secretsmanager.Secret(this, "OtterApiSecret", {
+      secretName: names.secretOtterApi,
+      description: `Otter Enterprise Public API key for ${display} ({ api_key })`,
+      removalPolicy: cdk4.RemovalPolicy.DESTROY,
+      generateSecretString: {
+        secretStringTemplate: "{}",
+        generateStringKey: "placeholder"
+      }
+    }) : undefined;
+    const knockOauthClient = provisionsIntegration(props.instance, "knock") ? new secretsmanager.Secret(this, "KnockOauthClientSecret", {
+      secretName: names.secretKnockOauthClient,
+      description: `Knock public OAuth client for ${display} ({ client_id, redirect_uri })`,
+      removalPolicy: cdk4.RemovalPolicy.DESTROY,
+      generateSecretString: {
+        secretStringTemplate: "{}",
+        generateStringKey: "placeholder"
+      }
+    }) : undefined;
+    const knockCredential = provisionsIntegration(props.instance, "knock") ? new secretsmanager.Secret(this, "KnockCredentialSecret", {
+      secretName: names.secretKnockCredential,
+      description: `Knock OAuth credential for ${display}; callback writes and proxy alone reads`,
+      removalPolicy: cdk4.RemovalPolicy.DESTROY,
+      generateSecretString: {
+        secretStringTemplate: "{}",
+        generateStringKey: "placeholder"
+      }
+    }) : undefined;
+    const upwork = provisionsIntegration(props.instance, "upwork") ? secretShell("UpworkSecret", names.secretUpwork, `Upwork OAuth client and token store for ${display} ({ client_id, client_secret, access_token?, refresh_token?, expires_at?, tenant_id? })`) : undefined;
+    this.secrets = {
+      signing: secretsmanager.Secret.fromSecretNameV2(this, "SlackSigningSecret", names.secretSlackSigning),
+      slackApp: secretsmanager.Secret.fromSecretNameV2(this, "SlackAppSecret", names.secretSlackApp),
+      githubApp: secretsmanager.Secret.fromSecretNameV2(this, "GithubAppSecret", names.secretGithubApp),
+      codex: secretShell("CodexSecret", names.secretCodex, "OpenAI Codex credential store (rotated tokens are written back here)"),
+      googleAiStudio: new secretsmanager.Secret(this, "GoogleAiStudioSecret", {
+        secretName: names.secretGoogleAiStudio,
+        encryptionKey: this.dataKey,
+        description: "Google AI Studio API key for image generation ({ api_key })",
+        removalPolicy: cdk4.RemovalPolicy.RETAIN,
+        generateSecretString: {
+          secretStringTemplate: "{}",
+          generateStringKey: "placeholder"
+        }
+      }),
+      googleDrive: new secretsmanager.Secret(this, "GoogleDriveSecret", {
+        secretName: names.secretGoogleDrive,
+        encryptionKey: this.dataKey,
+        description: `Google Drive service identity: the company-owned Drive account ${display} reads as. JSON { client_email, private_key, token_uri? }, optionally nested under identities.default. Access is granted by sharing files/folders with client_email; scope is read-only.`,
+        removalPolicy: cdk4.RemovalPolicy.RETAIN,
+        generateSecretString: {
+          secretStringTemplate: "{}",
+          generateStringKey: "placeholder"
+        }
+      }),
+      googleCalendar: secretShell("GoogleCalendarSecret", names.secretGoogleCalendar, `Google Calendar OAuth client for ${display}'s per-person calendar connections`),
+      googleEmail: secretShell("GoogleEmailSecret", names.secretGoogleEmail, `Gmail identity for ${display}, connected from Slack — written by the gateway, read only by the email proxy`),
+      mongodbReadonly: new secretsmanager.Secret(this, "MongodbReadonlySecret", {
+        secretName: names.secretMongodbReadonly,
+        encryptionKey: this.dataKey,
+        description: `Read-only MongoDB Atlas credential for ${display}. JSON { uri, databases? } where uri authenticates an Atlas user provisioned with the \`read\` role, and databases (optional) narrows which databases the agent may name.`,
+        removalPolicy: cdk4.RemovalPolicy.RETAIN,
+        generateSecretString: {
+          secretStringTemplate: "{}",
+          generateStringKey: "placeholder"
+        }
+      }),
+      ...otterApi === undefined ? {} : { otterApi },
+      ...knockOauthClient === undefined ? {} : { knockOauthClient },
+      ...knockCredential === undefined ? {} : { knockCredential },
+      ...upwork === undefined ? {} : { upwork },
+      googleOauth: secretShell("GoogleOauthSecret", names.secretGoogleOauth, `Google OAuth client shared by ${display}'s Google capabilities ({ client_id, client_secret, redirect_uri })`),
+      runtime: secretShell("RuntimeSecret", names.secretRuntime, "Agent runtime env map, written by scripts/setup.ts after deploy")
+    };
+    this.fileSystem = this.buildFileSystem(display);
+    new cdk4.CfnOutput(this, "FoundationFileSystemId", {
+      value: this.fileSystem.getAtt("FileSystemId").toString()
+    });
+    new cdk4.CfnOutput(this, "BucketName", { value: this.bucket.bucketName });
+    new cdk4.CfnOutput(this, "DocumentsBucketName", { value: this.documentBucket.bucketName });
+    new cdk4.CfnOutput(this, "TableName", { value: this.table.tableName });
+    new cdk4.CfnOutput(this, "ItemsTableName", { value: this.itemsTable.tableName });
+  }
+  buildFileSystem(display) {
+    const role = new iam5.Role(this, "S3FilesServiceRole", {
+      description: `S3 Files service role for the ${display} persistent mount`,
+      assumedBy: new iam5.ServicePrincipal("elasticfilesystem.amazonaws.com", {
+        conditions: {
+          StringEquals: { "aws:SourceAccount": this.account },
+          ArnLike: {
+            "aws:SourceArn": `arn:${this.partition}:s3files:${this.region}:${this.account}:file-system/*`
+          }
+        }
+      })
+    });
+    role.addToPolicy(new iam5.PolicyStatement({
+      sid: "MountObjects",
+      actions: [
+        "s3:AbortMultipartUpload",
+        "s3:DeleteObject*",
+        "s3:GetObject*",
+        "s3:List*",
+        "s3:PutObject*"
+      ],
+      resources: [this.bucket.arnForObjects("fs/*")]
+    }));
+    role.addToPolicy(new iam5.PolicyStatement({
+      sid: "MountBucket",
+      actions: [
+        "s3:ListBucket",
+        "s3:ListBucketVersions",
+        "s3:GetBucketLocation",
+        "s3:ListBucketMultipartUploads"
+      ],
+      resources: [this.bucket.bucketArn]
+    }));
+    role.addToPolicy(new iam5.PolicyStatement({
+      sid: "MountKeyUsage",
+      actions: [
+        "kms:Decrypt",
+        "kms:Encrypt",
+        "kms:GenerateDataKey*",
+        "kms:ReEncryptFrom",
+        "kms:ReEncryptTo",
+        "kms:DescribeKey"
+      ],
+      resources: [this.dataKey.keyArn]
+    }));
+    role.addToPolicy(new iam5.PolicyStatement({
+      sid: "EventBridgeManage",
+      actions: [
+        "events:DeleteRule",
+        "events:DisableRule",
+        "events:EnableRule",
+        "events:PutRule",
+        "events:PutTargets",
+        "events:RemoveTargets"
+      ],
+      resources: [`arn:${this.partition}:events:*:*:rule/DO-NOT-DELETE-S3-Files*`],
+      conditions: { StringEquals: { "events:ManagedBy": "elasticfilesystem.amazonaws.com" } }
+    }));
+    role.addToPolicy(new iam5.PolicyStatement({
+      sid: "EventBridgeRead",
+      actions: [
+        "events:DescribeRule",
+        "events:ListRuleNamesByTarget",
+        "events:ListRules",
+        "events:ListTargetsByRule"
+      ],
+      resources: [`arn:${this.partition}:events:*:*:rule/*`]
+    }));
+    const fileSystem = new cdk4.CfnResource(this, "FoundationFileSystem", {
+      type: "AWS::S3Files::FileSystem",
+      properties: {
+        Bucket: this.bucket.bucketArn,
+        Prefix: "fs/",
+        KmsKeyId: this.dataKey.keyArn,
+        RoleArn: role.roleArn,
+        AcceptBucketWarning: true
+      }
+    });
+    fileSystem.node.addDependency(role);
+    fileSystem.applyRemovalPolicy(cdk4.RemovalPolicy.RETAIN);
+    return fileSystem;
+  }
+}
+
+// src/stacks/network-stack.ts
+import * as cdk5 from "aws-cdk-lib";
+import * as ec2 from "aws-cdk-lib/aws-ec2";
+import * as iam6 from "aws-cdk-lib/aws-iam";
+var MONGODB_PORT = 27017;
+
+class FoundationNetwork extends cdk5.Stack {
+  vpc;
+  endpointSecurityGroup;
+  egressSubnets;
+  agentSecurityGroup;
+  gatewaySecurityGroup;
+  mountTargetSecurityGroup;
+  constructor(scope, id, props) {
+    super(scope, id, props);
+    const { prefix } = props.instance.naming;
+    const importedVpcId = this.node.tryGetContext("vpcId");
+    const createVpcEndpoints = String(this.node.tryGetContext("createVpcEndpoints") ?? "true") !== "false";
+    if (importedVpcId) {
+      this.vpc = ec2.Vpc.fromLookup(this, "ImportedVpc", { vpcId: importedVpcId });
+      this.egressSubnets = { subnetType: ec2.SubnetType.PRIVATE_WITH_EGRESS };
+    } else {
+      this.vpc = new ec2.Vpc(this, "FoundationVpc", {
+        maxAzs: 2,
+        natGateways: 2,
+        subnetConfiguration: [
+          { name: "ingress", subnetType: ec2.SubnetType.PUBLIC, cidrMask: 24 },
+          { name: "egress", subnetType: ec2.SubnetType.PRIVATE_WITH_EGRESS, cidrMask: 24 },
+          { name: "app", subnetType: ec2.SubnetType.PRIVATE_ISOLATED, cidrMask: 24 }
+        ]
+      });
+      this.egressSubnets = { subnetGroupName: "egress" };
+      new cdk5.CfnOutput(this, "NatEgressIp", {
+        value: cdk5.Fn.join(",", this.vpc.publicSubnets.map((subnet) => subnet.node.tryFindChild("EIP")?.attrPublicIp ?? "").filter((value) => value !== "")),
+        description: "Public egress addresses (NAT gateway EIPs) for allowlisting this instance"
+      });
+    }
+    const egressOnly = (constructId, description) => {
+      const sg = new ec2.SecurityGroup(this, constructId, {
+        vpc: this.vpc,
+        description,
+        allowAllOutbound: false
+      });
+      sg.addEgressRule(ec2.Peer.anyIpv4(), ec2.Port.tcp(443), "HTTPS egress");
+      sg.addEgressRule(ec2.Peer.ipv4(this.vpc.vpcCidrBlock), ec2.Port.udp(53), "DNS to VPC resolver");
+      sg.addEgressRule(ec2.Peer.ipv4(this.vpc.vpcCidrBlock), ec2.Port.tcp(53), "DNS over TCP to VPC resolver");
+      return sg;
+    };
+    this.agentSecurityGroup = egressOnly("AgentSg", `${prefix} AgentCore session ENIs: 443 + DNS egress only`);
+    this.gatewaySecurityGroup = egressOnly("GatewaySg", `${prefix} gateway Lambda ENIs: 443 + DNS egress only`);
+    if (capabilityEnabled(props.configPath, "mongodbReadonly")) {
+      this.agentSecurityGroup.addEgressRule(ec2.Peer.anyIpv4(), ec2.Port.tcp(MONGODB_PORT), "MongoDB Atlas");
+    }
+    this.mountTargetSecurityGroup = new ec2.SecurityGroup(this, "MountTargetSg", {
+      vpc: this.vpc,
+      description: `${prefix} S3 Files mount targets: NFS from the agent ENIs only`,
+      allowAllOutbound: false
+    });
+    this.mountTargetSecurityGroup.addIngressRule(this.agentSecurityGroup, ec2.Port.tcp(2049), "NFS from the AgentCore session ENIs");
+    this.agentSecurityGroup.addEgressRule(this.mountTargetSecurityGroup, ec2.Port.tcp(2049), "NFS to the S3 Files mount targets");
+    if (!createVpcEndpoints)
+      return;
+    const endpointSg = new ec2.SecurityGroup(this, "EndpointSg", {
+      vpc: this.vpc,
+      description: `${prefix} interface VPC endpoints: HTTPS from within the VPC only`,
+      allowAllOutbound: false
+    });
+    endpointSg.addIngressRule(ec2.Peer.ipv4(this.vpc.vpcCidrBlock), ec2.Port.tcp(443), "HTTPS from VPC");
+    this.endpointSecurityGroup = endpointSg;
+    const endpointSubnets = importedVpcId ? { subnetType: ec2.SubnetType.PRIVATE_WITH_EGRESS } : { subnetGroupName: "app" };
+    const gatewayEndpointSubnets = importedVpcId ? [{ subnetType: ec2.SubnetType.PRIVATE_WITH_EGRESS }] : [{ subnetGroupName: "app" }, { subnetGroupName: "egress" }];
+    const sameAccountOnly = new iam6.PolicyStatement({
+      effect: iam6.Effect.ALLOW,
+      principals: [new iam6.AnyPrincipal],
+      actions: ["*"],
+      resources: ["*"],
+      conditions: { StringEquals: { "aws:PrincipalAccount": this.account } }
+    });
+    const skipEndpoints = new Set(String(this.node.tryGetContext("skipEndpoints") ?? "").split(",").map((s) => s.trim().toLowerCase()).filter(Boolean));
+    if (!skipEndpoints.has("s3")) {
+      const s3Endpoint = this.vpc.addGatewayEndpoint("S3Endpoint", {
+        service: ec2.GatewayVpcEndpointAwsService.S3,
+        subnets: gatewayEndpointSubnets
+      });
+      s3Endpoint.addToPolicy(sameAccountOnly);
+      s3Endpoint.addToPolicy(new iam6.PolicyStatement({
+        sid: "EcrLayerBucket",
+        effect: iam6.Effect.ALLOW,
+        principals: [new iam6.AnyPrincipal],
+        actions: ["s3:GetObject"],
+        resources: [`arn:${this.partition}:s3:::prod-${this.region}-starport-layer-bucket/*`]
+      }));
+    }
+    if (!skipEndpoints.has("dynamodb")) {
+      const dynamoEndpoint = this.vpc.addGatewayEndpoint("DynamoDbEndpoint", {
+        service: ec2.GatewayVpcEndpointAwsService.DYNAMODB,
+        subnets: gatewayEndpointSubnets
+      });
+      dynamoEndpoint.addToPolicy(sameAccountOnly);
+    }
+    const interfaceEndpoints = [
+      [
+        "BedrockAgentCoreEndpoint",
+        "bedrock-agentcore",
+        new ec2.InterfaceVpcEndpointService(`com.amazonaws.${this.region}.bedrock-agentcore`, 443)
+      ],
+      [
+        "SecretsManagerEndpoint",
+        "secretsmanager",
+        ec2.InterfaceVpcEndpointAwsService.SECRETS_MANAGER
+      ],
+      ["CloudWatchLogsEndpoint", "logs", ec2.InterfaceVpcEndpointAwsService.CLOUDWATCH_LOGS]
+    ];
+    for (const [endpointId, skipName, service] of interfaceEndpoints) {
+      if (skipEndpoints.has(skipName))
+        continue;
+      const endpoint = this.vpc.addInterfaceEndpoint(endpointId, {
+        service,
+        subnets: endpointSubnets,
+        securityGroups: [endpointSg],
+        privateDnsEnabled: true
+      });
+      endpoint.addToPolicy(sameAccountOnly);
+    }
+  }
+}
+
+// src/stacks/newsletter-stack.ts
+import * as cdk6 from "aws-cdk-lib";
+import * as apigateway2 from "aws-cdk-lib/aws-apigateway";
+import * as acm from "aws-cdk-lib/aws-certificatemanager";
+import * as cloudwatch2 from "aws-cdk-lib/aws-cloudwatch";
+import * as cloudwatchActions from "aws-cdk-lib/aws-cloudwatch-actions";
+import * as dynamodb2 from "aws-cdk-lib/aws-dynamodb";
+import * as iam7 from "aws-cdk-lib/aws-iam";
+import * as kms2 from "aws-cdk-lib/aws-kms";
+import * as lambda2 from "aws-cdk-lib/aws-lambda";
+import * as lambdaEventSources2 from "aws-cdk-lib/aws-lambda-event-sources";
+import * as route53 from "aws-cdk-lib/aws-route53";
+import * as route53Targets from "aws-cdk-lib/aws-route53-targets";
+import * as secretsmanager2 from "aws-cdk-lib/aws-secretsmanager";
+import * as sns2 from "aws-cdk-lib/aws-sns";
+import * as snsSubscriptions from "aws-cdk-lib/aws-sns-subscriptions";
+import * as sqs2 from "aws-cdk-lib/aws-sqs";
+import * as wafv2 from "aws-cdk-lib/aws-wafv2";
+var ACTIVE_SUBSCRIBER_INDEX = "ScopeStateIndex";
+
+class NewsletterStack extends cdk6.Stack {
+  subscriberTable;
+  campaignTable;
+  campaignQueue;
+  campaignDlq;
+  suppressionDlq;
+  api;
+  tokenSigningSecret;
+  campaignOperatorRole;
+  constructor(scope, id, props) {
+    super(scope, id, props);
+    if (!props.instance.newsletter.enabled)
+      throw new Error(`cannot create NewsletterStack: newsletter is disabled for ${props.instance.name}`);
+    const config = props.instance.newsletter;
+    const names = instanceNames(props.instance);
+    const manifest = JSON.stringify(newsletterManifestFor(props.instance));
+    if (Buffer.byteLength(manifest, "utf8") > 3000)
+      throw new Error("newsletter manifest exceeds the safe Lambda environment limit");
+    const publicPartitionKeys = config.scopes.flatMap(({ businessId, newsletterId }) => [
+      `SCOPE#${businessId}#${newsletterId}`,
+      `QUOTA#${businessId}#${newsletterId}`
+    ]);
+    const senderAddress = senderAddressFor(config.sender);
+    const identityArn = `arn:${this.partition}:ses:${this.region}:${this.account}:identity/${config.domainIdentity}`;
+    const configurationSetArn = `arn:${this.partition}:ses:${this.region}:${this.account}:configuration-set/${names.newsletterConfigurationSet}`;
+    const zone = route53.HostedZone.fromHostedZoneAttributes(this, "NewsletterHostedZone", {
+      hostedZoneId: config.hostedZoneId,
+      zoneName: config.hostedZoneName
+    });
+    const newsletterKey = new kms2.Key(this, "NewsletterKey", {
+      description: `${props.instance.displayName} newsletter PII and queue CMK`,
+      enableKeyRotation: true,
+      alias: names.newsletterKeyAlias,
+      removalPolicy: cdk6.RemovalPolicy.RETAIN
+    });
+    this.subscriberTable = new dynamodb2.Table(this, "SubscriberTable", {
+      partitionKey: { name: "pk", type: dynamodb2.AttributeType.STRING },
+      sortKey: { name: "sk", type: dynamodb2.AttributeType.STRING },
+      billingMode: dynamodb2.BillingMode.PAY_PER_REQUEST,
+      encryption: dynamodb2.TableEncryption.CUSTOMER_MANAGED,
+      encryptionKey: newsletterKey,
+      pointInTimeRecoverySpecification: { pointInTimeRecoveryEnabled: true },
+      timeToLiveAttribute: "ttl",
+      removalPolicy: cdk6.RemovalPolicy.RETAIN
+    });
+    this.subscriberTable.addGlobalSecondaryIndex({
+      indexName: ACTIVE_SUBSCRIBER_INDEX,
+      partitionKey: { name: "scopeState", type: dynamodb2.AttributeType.STRING },
+      sortKey: { name: "emailHash", type: dynamodb2.AttributeType.STRING },
+      projectionType: dynamodb2.ProjectionType.ALL
+    });
+    this.campaignTable = new dynamodb2.Table(this, "CampaignTable", {
+      partitionKey: { name: "pk", type: dynamodb2.AttributeType.STRING },
+      sortKey: { name: "sk", type: dynamodb2.AttributeType.STRING },
+      billingMode: dynamodb2.BillingMode.PAY_PER_REQUEST,
+      encryption: dynamodb2.TableEncryption.CUSTOMER_MANAGED,
+      encryptionKey: newsletterKey,
+      pointInTimeRecoverySpecification: { pointInTimeRecoveryEnabled: true },
+      removalPolicy: cdk6.RemovalPolicy.RETAIN
+    });
+    this.tokenSigningSecret = new secretsmanager2.Secret(this, "TokenSigningSecret", {
+      secretName: names.newsletterTokenSigningSecret,
+      description: "Newsletter confirmation and unsubscribe token HMAC secret",
+      encryptionKey: newsletterKey,
+      generateSecretString: { passwordLength: 64, excludePunctuation: true },
+      removalPolicy: cdk6.RemovalPolicy.RETAIN
+    });
+    this.campaignDlq = new sqs2.Queue(this, "CampaignDlq", {
+      queueName: `${props.instance.naming.secretPrefix}-newsletter-campaign-dlq.fifo`,
+      fifo: true,
+      encryption: sqs2.QueueEncryption.KMS,
+      encryptionMasterKey: newsletterKey,
+      enforceSSL: true,
+      retentionPeriod: cdk6.Duration.days(14)
+    });
+    this.campaignQueue = new sqs2.Queue(this, "CampaignQueue", {
+      queueName: `${props.instance.naming.secretPrefix}-newsletter-campaign.fifo`,
+      fifo: true,
+      contentBasedDeduplication: false,
+      encryption: sqs2.QueueEncryption.KMS,
+      encryptionMasterKey: newsletterKey,
+      enforceSSL: true,
+      visibilityTimeout: cdk6.Duration.minutes(15),
+      retentionPeriod: cdk6.Duration.days(14),
+      deadLetterQueue: { queue: this.campaignDlq, maxReceiveCount: 3 }
+    });
+    this.suppressionDlq = new sqs2.Queue(this, "SuppressionDlq", {
+      queueName: `${props.instance.naming.secretPrefix}-newsletter-suppression-dlq`,
+      encryption: sqs2.QueueEncryption.KMS,
+      encryptionMasterKey: newsletterKey,
+      enforceSSL: true,
+      retentionPeriod: cdk6.Duration.days(14)
+    });
+    const suppressionQueue = new sqs2.Queue(this, "SuppressionQueue", {
+      queueName: `${props.instance.naming.secretPrefix}-newsletter-suppression`,
+      encryption: sqs2.QueueEncryption.KMS,
+      encryptionMasterKey: newsletterKey,
+      enforceSSL: true,
+      visibilityTimeout: cdk6.Duration.minutes(5),
+      retentionPeriod: cdk6.Duration.days(14),
+      deadLetterQueue: { queue: this.suppressionDlq, maxReceiveCount: 3 }
+    });
+    const publicRole = lambdaRole(this, "PublicFunctionRole", "public newsletter opt-in Lambda");
+    publicRole.addToPolicy(new iam7.PolicyStatement({
+      sid: "SubscriberOptInState",
+      actions: ["dynamodb:GetItem", "dynamodb:PutItem", "dynamodb:UpdateItem"],
+      resources: [this.subscriberTable.tableArn],
+      conditions: {
+        "ForAllValues:StringEquals": {
+          "dynamodb:LeadingKeys": publicPartitionKeys
+        }
+      }
+    }));
+    this.tokenSigningSecret.grantRead(publicRole);
+    this.campaignQueue.grantSendMessages(publicRole);
+    const suppressionRole = lambdaRole(this, "SuppressionFunctionRole", "SES newsletter suppression Lambda");
+    suppressionRole.addToPolicy(new iam7.PolicyStatement({
+      sid: "SubscriberSuppressionState",
+      actions: ["dynamodb:GetItem", "dynamodb:PutItem"],
+      resources: [this.subscriberTable.tableArn]
+    }));
+    const campaignRole = lambdaRole(this, "CampaignFunctionRole", "newsletter campaign worker Lambda");
+    campaignRole.addToPolicy(new iam7.PolicyStatement({
+      sid: "ReadActiveSubscribers",
+      actions: ["dynamodb:GetItem", "dynamodb:Query"],
+      resources: [
+        this.subscriberTable.tableArn,
+        `${this.subscriberTable.tableArn}/index/${ACTIVE_SUBSCRIBER_INDEX}`
+      ]
+    }));
+    campaignRole.addToPolicy(new iam7.PolicyStatement({
+      sid: "CampaignDeliveryState",
+      actions: ["dynamodb:GetItem", "dynamodb:PutItem", "dynamodb:UpdateItem"],
+      resources: [this.campaignTable.tableArn]
+    }));
+    this.campaignQueue.grantConsumeMessages(campaignRole);
+    this.campaignQueue.grantSendMessages(campaignRole);
+    this.tokenSigningSecret.grantRead(campaignRole);
+    grantSesSend(campaignRole, identityArn, senderAddress);
+    const publicFunction = new lambda2.Function(this, "PublicFunction", {
+      runtime: lambda2.Runtime.NODEJS_22_X,
+      handler: "index.handler",
+      code: lambdaCode(this, "newsletter-public"),
+      role: publicRole,
+      timeout: cdk6.Duration.seconds(15),
+      memorySize: 256,
+      environment: {
+        NEWSLETTER_MANIFEST: manifest,
+        NEWSLETTER_SUBSCRIBER_TABLE_NAME: this.subscriberTable.tableName,
+        NEWSLETTER_TOKEN_SIGNING_SECRET_ID: this.tokenSigningSecret.secretName,
+        NEWSLETTER_CAMPAIGN_QUEUE_URL: this.campaignQueue.queueUrl
+      }
+    });
+    const suppressionFunction = new lambda2.Function(this, "SuppressionFunction", {
+      runtime: lambda2.Runtime.NODEJS_22_X,
+      handler: "index.handler",
+      code: lambdaCode(this, "newsletter-ses-events"),
+      role: suppressionRole,
+      timeout: cdk6.Duration.seconds(30),
+      memorySize: 256,
+      environment: {
+        NEWSLETTER_MANIFEST: manifest,
+        NEWSLETTER_SUBSCRIBER_TABLE_NAME: this.subscriberTable.tableName
+      }
+    });
+    suppressionFunction.addEventSource(new lambdaEventSources2.SqsEventSource(suppressionQueue, {
+      batchSize: 1,
+      reportBatchItemFailures: false
+    }));
+    const campaignFunction = new lambda2.Function(this, "CampaignFunction", {
+      runtime: lambda2.Runtime.NODEJS_22_X,
+      handler: "index.handler",
+      code: lambdaCode(this, "newsletter-campaign"),
+      role: campaignRole,
+      timeout: cdk6.Duration.minutes(15),
+      memorySize: 512,
+      environment: {
+        NEWSLETTER_MANIFEST: manifest,
+        NEWSLETTER_SUBSCRIBER_TABLE_NAME: this.subscriberTable.tableName,
+        NEWSLETTER_CAMPAIGN_TABLE_NAME: this.campaignTable.tableName,
+        NEWSLETTER_CAMPAIGN_QUEUE_URL: this.campaignQueue.queueUrl,
+        NEWSLETTER_TOKEN_SIGNING_SECRET_ID: this.tokenSigningSecret.secretName,
+        NEWSLETTER_CONFIGURATION_SET: names.newsletterConfigurationSet
+      }
+    });
+    campaignFunction.addEventSource(new lambdaEventSources2.SqsEventSource(this.campaignQueue, {
+      batchSize: 1,
+      reportBatchItemFailures: false,
+      maxConcurrency: 2
+    }));
+    const eventsTopicName = `${props.instance.naming.secretPrefix}-newsletter-ses-events`;
+    const eventsTopic = new sns2.Topic(this, "SesEventsTopic", {
+      displayName: `${props.instance.displayName} newsletter SES events`,
+      topicName: eventsTopicName,
+      masterKey: newsletterKey
+    });
+    newsletterKey.addToResourcePolicy(new iam7.PolicyStatement({
+      sid: "AllowSesToEncryptNewsletterEvents",
+      principals: [new iam7.ServicePrincipal("ses.amazonaws.com")],
+      actions: ["kms:GenerateDataKey*", "kms:Decrypt"],
+      resources: ["*"],
+      conditions: {
+        StringEquals: {
+          "aws:SourceAccount": this.account,
+          "kms:EncryptionContext:aws:sns:topicArn": `arn:${this.partition}:sns:${this.region}:${this.account}:${eventsTopicName}`
+        }
+      }
+    }));
+    eventsTopic.addToResourcePolicy(new iam7.PolicyStatement({
+      sid: "AllowOnlyThisSesIdentity",
+      effect: iam7.Effect.ALLOW,
+      principals: [new iam7.ServicePrincipal("ses.amazonaws.com")],
+      actions: ["sns:Publish"],
+      resources: [eventsTopic.topicArn],
+      conditions: {
+        StringEquals: { "aws:SourceAccount": this.account },
+        ArnLike: { "aws:SourceArn": configurationSetArn }
+      }
+    }));
+    eventsTopic.addSubscription(new snsSubscriptions.SqsSubscription(suppressionQueue, {
+      rawMessageDelivery: true
+    }));
+    const identity = new cdk6.CfnResource(this, "NewsletterDomainIdentity", {
+      type: "AWS::SES::EmailIdentity",
+      properties: {
+        EmailIdentity: config.domainIdentity,
+        DkimAttributes: { SigningEnabled: true }
+      }
+    });
+    const configurationSet = new cdk6.CfnResource(this, "NewsletterConfigurationSet", {
+      type: "AWS::SES::ConfigurationSet",
+      properties: { Name: names.newsletterConfigurationSet }
+    });
+    const eventDestination = new cdk6.CfnResource(this, "NewsletterEventDestination", {
+      type: "AWS::SES::ConfigurationSetEventDestination",
+      properties: {
+        ConfigurationSetName: names.newsletterConfigurationSet,
+        EventDestination: {
+          Name: "NewsletterDeliveryAndSuppressionEvents",
+          Enabled: true,
+          MatchingEventTypes: ["DELIVERY", "BOUNCE", "COMPLAINT"],
+          SnsDestination: { TopicARN: eventsTopic.topicArn }
+        }
+      }
+    });
+    eventDestination.addResourceDependency(configurationSet);
+    eventDestination.node.addDependency(eventsTopic);
+    for (const token of ["1", "2", "3"])
+      new route53.CfnRecordSet(this, `NewsletterDkim${token}`, {
+        hostedZoneId: config.hostedZoneId,
+        name: identity.getAtt(`DkimDNSTokenName${token}`).toString(),
+        type: "CNAME",
+        ttl: "1800",
+        resourceRecords: [identity.getAtt(`DkimDNSTokenValue${token}`).toString()]
+      });
+    configurationSet.node.addDependency(identity);
+    this.api = new apigateway2.RestApi(this, "NewsletterApi", {
+      restApiName: `${props.instance.naming.secretPrefix}-newsletter`,
+      description: `${props.instance.displayName} public confirmed newsletter API`,
+      endpointTypes: [apigateway2.EndpointType.REGIONAL],
+      disableExecuteApiEndpoint: true,
+      deployOptions: {
+        stageName: "prod",
+        throttlingRateLimit: 2,
+        throttlingBurstLimit: 4,
+        metricsEnabled: true
+      },
+      defaultCorsPreflightOptions: {
+        allowOrigins: [...config.allowedOrigins],
+        allowMethods: ["GET", "POST", "OPTIONS"],
+        allowHeaders: ["Content-Type"]
+      },
+      cloudWatchRole: false
+    });
+    const v1 = this.api.root.addResource("v1");
+    const businesses = v1.addResource("businesses");
+    const business = businesses.addResource("{businessId}");
+    const newsletters = business.addResource("newsletters");
+    const newsletter = newsletters.addResource("{newsletterId}");
+    const integration = new apigateway2.LambdaIntegration(publicFunction);
+    newsletter.addResource("subscribe").addMethod("POST", integration);
+    newsletter.addResource("confirm").addMethod("GET", integration);
+    newsletter.addResource("unsubscribe").addMethod("GET", integration);
+    newsletter.getResource("confirm")?.addMethod("POST", integration);
+    newsletter.getResource("unsubscribe")?.addMethod("POST", integration);
+    const webAcl = new wafv2.CfnWebACL(this, "NewsletterWebAcl", {
+      scope: "REGIONAL",
+      defaultAction: { allow: {} },
+      visibilityConfig: {
+        cloudWatchMetricsEnabled: true,
+        metricName: `${props.instance.naming.secretPrefix}-newsletter-api`,
+        sampledRequestsEnabled: false
+      },
+      rules: [
+        {
+          name: "PerIpSubscribeAbuseLimit",
+          priority: 0,
+          action: { block: {} },
+          statement: {
+            rateBasedStatement: {
+              aggregateKeyType: "IP",
+              limit: 10,
+              scopeDownStatement: {
+                byteMatchStatement: {
+                  fieldToMatch: { uriPath: {} },
+                  positionalConstraint: "ENDS_WITH",
+                  searchString: "/subscribe",
+                  textTransformations: [{ priority: 0, type: "NONE" }]
+                }
+              }
+            }
+          },
+          visibilityConfig: {
+            cloudWatchMetricsEnabled: true,
+            metricName: `${props.instance.naming.secretPrefix}-newsletter-subscribe-rate`,
+            sampledRequestsEnabled: false
+          }
+        }
+      ]
+    });
+    const webAclAssociation = new wafv2.CfnWebACLAssociation(this, "NewsletterWebAclAssociation", {
+      resourceArn: `arn:${this.partition}:apigateway:${this.region}::/restapis/${this.api.restApiId}/stages/${this.api.deploymentStage.stageName}`,
+      webAclArn: webAcl.attrArn
+    });
+    webAclAssociation.node.addDependency(this.api.deploymentStage);
+    const certificate = new acm.Certificate(this, "NewsletterCertificate", {
+      domainName: config.apiDomain,
+      validation: acm.CertificateValidation.fromDns(zone)
+    });
+    const domain = new apigateway2.DomainName(this, "NewsletterDomain", {
+      domainName: config.apiDomain,
+      certificate,
+      endpointType: apigateway2.EndpointType.REGIONAL,
+      securityPolicy: apigateway2.SecurityPolicy.TLS_1_2
+    });
+    new apigateway2.BasePathMapping(this, "NewsletterBasePath", {
+      domainName: domain,
+      restApi: this.api
+    });
+    new route53.ARecord(this, "NewsletterApiAlias", {
+      zone,
+      recordName: config.apiDomain,
+      target: route53.RecordTarget.fromAlias(new route53Targets.ApiGatewayDomain(domain))
+    });
+    this.campaignOperatorRole = new iam7.Role(this, "CampaignOperatorRole", {
+      roleName: names.newsletterCampaignOperatorRole,
+      description: "Human-only newsletter campaign draft, preview and approval role",
+      assumedBy: new iam7.AccountPrincipal(this.account),
+      maxSessionDuration: cdk6.Duration.hours(1)
+    });
+    this.campaignOperatorRole.addToPolicy(new iam7.PolicyStatement({
+      sid: "CampaignDraftAndApproval",
+      actions: ["dynamodb:GetItem", "dynamodb:PutItem", "dynamodb:UpdateItem"],
+      resources: [this.campaignTable.tableArn]
+    }));
+    this.campaignQueue.grantSendMessages(this.campaignOperatorRole);
+    this.campaignDlq.grantConsumeMessages(this.campaignOperatorRole);
+    this.campaignOperatorRole.addToPolicy(new iam7.PolicyStatement({
+      sid: "RedriveCampaignFailures",
+      actions: [
+        "sqs:StartMessageMoveTask",
+        "sqs:CancelMessageMoveTask",
+        "sqs:ListMessageMoveTasks"
+      ],
+      resources: [this.campaignDlq.queueArn]
+    }));
+    this.campaignOperatorRole.addToPolicy(new iam7.PolicyStatement({
+      sid: "ReadNewsletterStackOutputs",
+      actions: ["cloudformation:DescribeStacks"],
+      resources: ["*"]
+    }));
+    this.campaignOperatorRole.addToPolicy(new iam7.PolicyStatement({
+      sid: "RecordApprovalActor",
+      actions: ["sts:GetCallerIdentity"],
+      resources: ["*"]
+    }));
+    const alarmTopic = new sns2.Topic(this, "NewsletterAlarmTopic", {
+      displayName: `${props.instance.displayName} newsletter alarms`
+    });
+    if (props.alarmEmail !== undefined)
+      new sns2.Subscription(this, "NewsletterAlarmEmail", {
+        topic: alarmTopic,
+        protocol: sns2.SubscriptionProtocol.EMAIL,
+        endpoint: props.alarmEmail
+      });
+    const alarmAction = new cloudwatchActions.SnsAction(alarmTopic);
+    const alarms = [
+      new cloudwatch2.Alarm(this, "CampaignDlqDepthAlarm", {
+        alarmDescription: "Newsletter campaign messages are waiting in the DLQ",
+        metric: this.campaignDlq.metricApproximateNumberOfMessagesVisible({
+          period: cdk6.Duration.minutes(5),
+          statistic: "Maximum"
+        }),
+        threshold: 1,
+        evaluationPeriods: 1,
+        comparisonOperator: cloudwatch2.ComparisonOperator.GREATER_THAN_OR_EQUAL_TO_THRESHOLD,
+        treatMissingData: cloudwatch2.TreatMissingData.NOT_BREACHING
+      }),
+      new cloudwatch2.Alarm(this, "SuppressionDlqDepthAlarm", {
+        alarmDescription: "Newsletter suppression events are waiting in the DLQ",
+        metric: this.suppressionDlq.metricApproximateNumberOfMessagesVisible({
+          period: cdk6.Duration.minutes(5),
+          statistic: "Maximum"
+        }),
+        threshold: 1,
+        evaluationPeriods: 1,
+        comparisonOperator: cloudwatch2.ComparisonOperator.GREATER_THAN_OR_EQUAL_TO_THRESHOLD,
+        treatMissingData: cloudwatch2.TreatMissingData.NOT_BREACHING
+      }),
+      new cloudwatch2.Alarm(this, "CampaignWorkerErrorsAlarm", {
+        alarmDescription: "Newsletter campaign worker is failing",
+        metric: campaignFunction.metricErrors({
+          period: cdk6.Duration.minutes(5),
+          statistic: "Sum"
+        }),
+        threshold: 1,
+        evaluationPeriods: 1,
+        comparisonOperator: cloudwatch2.ComparisonOperator.GREATER_THAN_OR_EQUAL_TO_THRESHOLD,
+        treatMissingData: cloudwatch2.TreatMissingData.NOT_BREACHING
+      }),
+      new cloudwatch2.Alarm(this, "SuppressionWorkerErrorsAlarm", {
+        alarmDescription: "Newsletter suppression worker is failing",
+        metric: suppressionFunction.metricErrors({
+          period: cdk6.Duration.minutes(5),
+          statistic: "Sum"
+        }),
+        threshold: 1,
+        evaluationPeriods: 1,
+        comparisonOperator: cloudwatch2.ComparisonOperator.GREATER_THAN_OR_EQUAL_TO_THRESHOLD,
+        treatMissingData: cloudwatch2.TreatMissingData.NOT_BREACHING
+      }),
+      new cloudwatch2.Alarm(this, "PublicFunctionErrorsAlarm", {
+        alarmDescription: "Newsletter public Lambda is failing",
+        metric: publicFunction.metricErrors({ period: cdk6.Duration.minutes(5), statistic: "Sum" }),
+        threshold: 1,
+        evaluationPeriods: 1,
+        comparisonOperator: cloudwatch2.ComparisonOperator.GREATER_THAN_OR_EQUAL_TO_THRESHOLD,
+        treatMissingData: cloudwatch2.TreatMissingData.NOT_BREACHING
+      })
+    ];
+    for (const alarm of alarms)
+      alarm.addAlarmAction(alarmAction);
+    new cdk6.CfnOutput(this, "NewsletterApiUrl", { value: `https://${config.apiDomain}/v1` });
+    new cdk6.CfnOutput(this, "SubscriberTableName", { value: this.subscriberTable.tableName });
+    new cdk6.CfnOutput(this, "CampaignTableName", { value: this.campaignTable.tableName });
+    new cdk6.CfnOutput(this, "CampaignQueueUrl", { value: this.campaignQueue.queueUrl });
+    new cdk6.CfnOutput(this, "CampaignDlqArn", { value: this.campaignDlq.queueArn });
+    new cdk6.CfnOutput(this, "CampaignDlqUrl", { value: this.campaignDlq.queueUrl });
+    new cdk6.CfnOutput(this, "CampaignOperatorRoleArn", {
+      value: this.campaignOperatorRole.roleArn
+    });
+    new cdk6.CfnOutput(this, "NewsletterConfigurationSetName", {
+      value: names.newsletterConfigurationSet
+    });
+  }
+}
+function lambdaRole(scope, id, description) {
+  return new iam7.Role(scope, id, {
+    assumedBy: new iam7.ServicePrincipal("lambda.amazonaws.com"),
+    description,
+    managedPolicies: [
+      iam7.ManagedPolicy.fromAwsManagedPolicyName("service-role/AWSLambdaBasicExecutionRole")
+    ]
+  });
+}
+function grantSesSend(role, identityArn, senderAddress) {
+  role.addToPolicy(new iam7.PolicyStatement({
+    sid: "SendFromNewsletterIdentity",
+    actions: ["ses:SendEmail"],
+    resources: [identityArn],
+    conditions: { StringEquals: { "ses:FromAddress": senderAddress } }
+  }));
+}
+function senderAddressFor(sender) {
+  const address = /<([^>]+)>$/.exec(sender)?.[1];
+  if (address === undefined)
+    throw new Error("newsletter sender is not a mailbox");
+  return address;
+}
+
+// src/stacks/pipeline-stack.ts
+import * as cdk7 from "aws-cdk-lib";
+import * as codebuild from "aws-cdk-lib/aws-codebuild";
+import * as codepipeline from "aws-cdk-lib/aws-codepipeline";
+import * as actions from "aws-cdk-lib/aws-codepipeline-actions";
+import * as iam8 from "aws-cdk-lib/aws-iam";
+import * as sns3 from "aws-cdk-lib/aws-sns";
+import * as subscriptions from "aws-cdk-lib/aws-sns-subscriptions";
+var DEFAULT_BUILDSPEC_PATH = "buildspec.yml";
+var BUILD_TIMEOUT = cdk7.Duration.minutes(60);
+
+class FoundationPipeline extends cdk7.Stack {
+  pipeline;
+  buildRole;
+  constructor(scope, id, props) {
+    super(scope, id, props);
+    const names = instanceNames(props.instance);
+    const { deploy } = props.instance;
+    const customization = props.instance.customization;
+    if (deploy.connectionArn === undefined)
+      throw new Error(`instance ${props.instance.name}: deploy.connectionArn is required for a pipeline`);
+    const [owner = "", repo = ""] = props.instance.github.repo.split("/");
+    this.buildRole = new iam8.Role(this, "BuildRole", {
+      description: `CodePipeline deployer for ${props.instance.name}`,
+      assumedBy: new iam8.ServicePrincipal("codebuild.amazonaws.com"),
+      inlinePolicies: {
+        FoundationDeploy: new iam8.PolicyDocument({
+          statements: deployStatements(this, names, { bucket: props.bucket, dataKey: props.dataKey }, props.instance)
+        })
+      }
+    });
+    const failureTopic = new sns3.Topic(this, "FailureTopic", {
+      displayName: `${props.instance.displayName} deploy failures`
+    });
+    const alarmEmail = props.alarmEmail ?? props.instance.aws.alarmEmail;
+    if (alarmEmail !== undefined && alarmEmail !== "")
+      failureTopic.addSubscription(new subscriptions.EmailSubscription(alarmEmail));
+    const project = new codebuild.PipelineProject(this, "Build", {
+      projectName: `${props.instance.naming.prefix}Deploy`,
+      description: `Build and deploy ${props.instance.name} from ${props.instance.github.repo}@${deploy.branch}`,
+      role: this.buildRole,
+      timeout: BUILD_TIMEOUT,
+      environment: {
+        buildImage: codebuild.LinuxArmBuildImage.AMAZON_LINUX_2023_STANDARD_3_0,
+        computeType: codebuild.ComputeType.LARGE,
+        privileged: true
+      },
+      cache: codebuild.Cache.local(codebuild.LocalCacheMode.DOCKER_LAYER, codebuild.LocalCacheMode.SOURCE),
+      environmentVariables: {
+        FOUNDATION_INSTANCE_FILE: { value: props.instanceFilePath },
+        FOUNDATION_NO_PROFILE: { value: "1" },
+        FOUNDATION_IMAGE_CACHE: { value: "local" },
+        FOUNDATION_SKIP_POST_DEPLOY: { value: "1" }
+      },
+      buildSpec: codebuild.BuildSpec.fromSourceFilename(props.buildspecPath ?? DEFAULT_BUILDSPEC_PATH)
+    });
+    const source = new codepipeline.Artifact("Source");
+    const sourceActions = [
+      new actions.CodeStarConnectionsSourceAction({
+        actionName: "GitHub",
+        connectionArn: deploy.connectionArn,
+        owner,
+        repo,
+        branch: deploy.branch,
+        output: source,
+        triggerOnPush: true
+      })
+    ];
+    let customizationSource;
+    let customizationSourceAction;
+    if (customization !== undefined) {
+      const [customizationOwner = "", customizationRepo = ""] = customization.repository.split("/");
+      const customizationArtifact = new codepipeline.Artifact(CUSTOMIZATION_ARTIFACT_NAME);
+      customizationSource = customizationArtifact;
+      customizationSourceAction = new actions.CodeStarConnectionsSourceAction({
+        actionName: CUSTOMIZATION_ARTIFACT_NAME,
+        connectionArn: deploy.connectionArn,
+        owner: customizationOwner,
+        repo: customizationRepo,
+        branch: customization.branch,
+        output: customizationArtifact,
+        triggerOnPush: true
+      });
+      sourceActions.push(customizationSourceAction);
+    }
+    const stages = [{ stageName: "Source", actions: sourceActions }];
+    if (customization !== undefined && customizationSourceAction !== undefined) {
+      const customizationLinkPath = customization.path.split("/").map((segment) => encodeURIComponent(segment)).join("/");
+      stages.push({
+        stageName: "Approval",
+        actions: [
+          new actions.ManualApprovalAction({
+            actionName: "ReviewCustomization",
+            notificationTopic: failureTopic,
+            additionalInformation: `Review ${customization.path}: approve only intended runtime behavior; infrastructure and credentials stay deployment-owned.`,
+            externalEntityLink: `https://github.com/${customization.repository}/blob/${customizationSourceAction.variables.commitId}/${customizationLinkPath}`
+          })
+        ]
+      });
+    }
+    stages.push({
+      stageName: "Deploy",
+      actions: [
+        new actions.CodeBuildAction({
+          actionName: "BuildAndDeploy",
+          project,
+          input: source,
+          extraInputs: customizationSource === undefined ? undefined : [customizationSource]
+        })
+      ]
+    });
+    this.pipeline = new codepipeline.Pipeline(this, "Pipeline", {
+      pipelineName: `${props.instance.naming.prefix}Deploy`,
+      pipelineType: codepipeline.PipelineType.V2,
+      restartExecutionOnUpdate: false,
+      stages
+    });
+    this.pipeline.onStateChange("OnFailure", {
+      description: `${props.instance.name} deploy failed`,
+      eventPattern: { detail: { state: ["FAILED"] } },
+      target: new cdk7.aws_events_targets.SnsTopic(failureTopic)
+    });
+    new cdk7.CfnOutput(this, "PipelineName", { value: this.pipeline.pipelineName });
+    new cdk7.CfnOutput(this, "BuildRoleArn", { value: this.buildRole.roleArn });
+  }
+}
+
+export { FoundationAgent, FoundationApi, deployStatements, FoundationCi, FoundationData, FoundationNetwork, NewsletterStack, DEFAULT_BUILDSPEC_PATH, BUILD_TIMEOUT, FoundationPipeline };