@deployfoundation/foundation-deploy 0.1.5 → 0.2.1

package/dist/bin/app.js

@@ -7,12 +7,12 @@ import {
   FoundationNetwork,
   FoundationPipeline,
   NewsletterStack
-} from "../chunk-m4pn6wc2.js";
+} from "../chunk-paf33z2h.js";
 import {
   adminsFor,
   instanceNames,
   loadInstanceFile
-} from "../chunk-t86rw0f2.js";
+} from "../chunk-gcg67ck3.js";
 
 // bin/app.ts
 import { execFileSync } from "node:child_process";

package/dist/bin/foundation-deploy.js

@@ -29,12 +29,15 @@ import {
   stackExists,
   stackOutput,
   toolVersion
-} from "../chunk-qc5d46ky.js";
+} from "../chunk-an8qhf3t.js";
 import {
   BASE_SLACK_EVENTS,
   CAPABILITY_IDS,
   CUSTOMIZATION_ARTIFACT_NAME,
   instanceNames,
+  isScheduledJob,
+  isWebhookJob,
+  jobWebhookKey,
   parseInstanceConfig,
   parseSchedule,
   requiredGithubPermissions,
@@ -42,7 +45,7 @@ import {
   requiredSlackScopes,
   skillsKey,
   slackCommandPrefix
-} from "../chunk-t86rw0f2.js";
+} from "../chunk-gcg67ck3.js";
 
 // src/deploy/config-sync.ts
 import { existsSync, mkdirSync, mkdtempSync, readdirSync } from "node:fs";
@@ -832,26 +835,25 @@ function assertUnchanged(path, platform, tenant) {
 }
 function protectedConfig(config) {
   const { digestHour: _digestHour, ...todos } = config.capabilities.todos;
-  const { defined: _defined, ...routines } = config.capabilities.routines;
   const { outreach: _outreach, ...crm2 } = config.capabilities.crm;
   return {
     ...config,
     capabilities: {
       ...config.capabilities,
       todos,
-      routines,
       crm: crm2
-    }
+    },
+    jobs: config.jobs.filter(isWebhookJob)
   };
 }
 function assertProtectedPolicy(platform, tenant) {
   assertUnchanged("config", protectedConfig(platform), protectedConfig(tenant));
 }
-function assertValidTenantRoutines(tenant) {
-  for (const routine of tenant.capabilities.routines.defined) {
-    const parsed = parseSchedule(routine.schedule);
+function assertValidTenantJobs(tenant) {
+  for (const job of tenant.jobs.filter(isScheduledJob)) {
+    const parsed = parseSchedule(job.on.schedule);
     if (!parsed.ok)
-      throw new Error(`Invalid defined routine "${routine.id}": ${parsed.reason}`);
+      throw new Error(`Invalid job schedule "${job.id}": ${parsed.reason}`);
   }
 }
 function migrationFallback(required, log, platformConfigPath) {
@@ -881,7 +883,7 @@ function stageCustomization(options) {
   const platformConfig = parseInstanceConfig(readFileSync2(platformConfigPath, "utf8"));
   if (tenantConfig.name !== instance.displayName)
     throw new Error("Customization config name must match the selected instance.");
-  assertValidTenantRoutines(tenantConfig);
+  assertValidTenantJobs(tenantConfig);
   assertProtectedPolicy(platformConfig, tenantConfig);
   if (options.dryRun !== true) {
     mkdirSync2(dirname(stagedPath), { recursive: true });
@@ -1295,6 +1297,37 @@ async function githubAppCreate(options) {
   }, 10 * 60000);
 }
 
+// src/deploy/job-key.ts
+import { readFileSync as readFileSync4 } from "node:fs";
+function jobWebhookOutputKey(jobId) {
+  return `JobWebhookUrl${jobId.replace(/[^A-Za-z0-9]/g, "")}`;
+}
+function jobsWebhookSecretName(secretPrefix) {
+  return `${secretPrefix}/jobs/webhook`;
+}
+async function jobKey(ctx, jobId, options = {}) {
+  const config = parseInstanceConfig(readFileSync4(ctx.paths.configPath, "utf8"));
+  const job = config.jobs.find((entry) => entry.id === jobId);
+  if (job === undefined)
+    throw new Error(`no job "${jobId}" in ${ctx.paths.configPath}`);
+  if (!isWebhookJob(job))
+    throw new Error(`job "${jobId}" is not triggered by a webhook`);
+  const url = await stackOutput(ctx, ctx.names.api, jobWebhookOutputKey(jobId));
+  const instanceSecret = await readSecretJson(ctx, jobsWebhookSecretName(ctx.paths.instance.naming.secretPrefix));
+  if (instanceSecret.secret === undefined || instanceSecret.secret.length < 32)
+    throw new Error("the jobs webhook secret has no value — has the API stack been deployed?");
+  const key = jobWebhookKey(instanceSecret.secret, jobId);
+  if (options.putSecret === undefined)
+    return { url, key };
+  const value = JSON.stringify({ url, key });
+  if (await secretExists(ctx, options.putSecret)) {
+    await putSecretString(ctx, options.putSecret, value);
+  } else {
+    await createSecretString(ctx, options.putSecret, value, `Webhook URL and signing key for Foundation job ${jobId} ({ url, key })`);
+  }
+  return { url, secret: options.putSecret };
+}
+
 // src/deploy/post-deploy.ts
 var LIVE = "live";
 var FS_PROBE_PAYLOAD = '{"_fs_probe":true}';
@@ -1339,11 +1372,11 @@ async function postDeploy(ctx, opts = {}) {
 }
 
 // src/deploy/setup.ts
-import { existsSync as existsSync3, readFileSync as readFileSync5 } from "node:fs";
+import { existsSync as existsSync3, readFileSync as readFileSync6 } from "node:fs";
 import { resolve as resolve3 } from "node:path";
 
 // src/deploy/slack-manifest.ts
-import { readFileSync as readFileSync4 } from "node:fs";
+import { readFileSync as readFileSync5 } from "node:fs";
 import { join as join5 } from "node:path";
 import { parse as parse2 } from "yaml";
 var SLACK_APP_MANIFEST_PATH = join5(PACKAGE_ASSETS, "slack-app-manifest.yml");
@@ -1374,7 +1407,7 @@ function buildSlackManifest(template, instance, env) {
   return manifest;
 }
 function slackManifestFor(instance, env) {
-  return buildSlackManifest(readFileSync4(SLACK_APP_MANIFEST_PATH, "utf8"), { displayName: instance.displayName, commandPrefix: slackCommandPrefix(instance) }, env);
+  return buildSlackManifest(readFileSync5(SLACK_APP_MANIFEST_PATH, "utf8"), { displayName: instance.displayName, commandPrefix: slackCommandPrefix(instance) }, env);
 }
 
 // src/deploy/tracing.ts
@@ -1594,7 +1627,7 @@ async function writeRuntimeSecret(ctx) {
 async function seedCodex(ctx, codexFile) {
   if (!existsSync3(codexFile))
     throw new Error(`${codexFile} not found — sign in locally first, or pass --codex-file`);
-  const document = readFileSync5(codexFile, "utf8");
+  const document = readFileSync6(codexFile, "utf8");
   JSON.parse(document);
   await putSecretString(ctx, ctx.names.secretCodex, document);
   console.log(`  ${ctx.names.secretCodex} seeded from ${codexFile}`);
@@ -1762,7 +1795,8 @@ var COMMANDS = [
   "setup",
   "github-app-create",
   "slack-manifest",
-  "stage-customization"
+  "stage-customization",
+  "job-key"
 ];
 var USAGE = `usage: foundation-deploy <command> --instance <path> [options]
 
@@ -1775,6 +1809,7 @@ commands
   github-app-create    create the instance's GitHub App from the shipped manifest
   slack-manifest       print the instance's Slack app manifest as JSON
   stage-customization  validate and stage a tenant-owned runtime config
+  job-key <id>         print a webhook job's URL and signing key as JSON
 
 options
   --instance <path>    REQUIRED: path to the deployment's instance YAML
@@ -1806,6 +1841,10 @@ setup options
   --codex-file <path>  where that credential is (default: beside the instance
                        file, .foundation-local/codex.json)
 
+job-key options
+  --put-secret <id>    write {url, key} into this Secrets Manager secret
+                       (created if absent) instead of printing the key
+
 github-app-create options
   --org <org>          GitHub org (default: the instance's github.org)
   --port <n>           local callback port (default 8765)
@@ -1857,6 +1896,21 @@ ${USAGE}`);
     })));
     return 0;
   }
+  if (command === "job-key") {
+    const ctx2 = contextFor(args);
+    const jobId = args[0];
+    if (jobId === undefined || jobId.startsWith("-")) {
+      console.error(`job-key needs a job id
+
+${USAGE}`);
+      return 1;
+    }
+    console.error(instanceBanner(ctx2.paths));
+    const putSecret = flag(args, "--put-secret");
+    const result = await jobKey(ctx2, jobId, putSecret === undefined ? {} : { putSecret });
+    console.log(JSON.stringify(result));
+    return 0;
+  }
   if (command === "github-app-create") {
     const paths = loadInstanceContext(resolveInstanceFilePath(args, process.env));
     console.log(instanceBanner(paths));

package/dist/bin/release-account.js

@@ -1,8 +1,8 @@
 #!/usr/bin/env bun
 import {
   DEFAULT_RELEASE_BUCKET
-} from "../chunk-qc5d46ky.js";
-import"../chunk-t86rw0f2.js";
+} from "../chunk-an8qhf3t.js";
+import"../chunk-gcg67ck3.js";
 
 // bin/release-account.ts
 import * as cdk2 from "aws-cdk-lib";

package/dist/{chunk-qc5d46ky.js → chunk-an8qhf3t.js}

@@ -6,7 +6,7 @@ import {
   manifestKey,
   releaseCacheDir,
   verifyManifest
-} from "./chunk-t86rw0f2.js";
+} from "./chunk-gcg67ck3.js";
 
 // src/deploy/release.ts
 import { existsSync as existsSync2, mkdirSync, readFileSync as readFileSync2 } from "node:fs";

package/dist/{chunk-t86rw0f2.js → chunk-gcg67ck3.js}

@@ -77,7 +77,13 @@ var RawGoogleDriveCapability = z.object({
 var RawCrmOutreach = z.object({
   weeklyLimit: z.number().int().min(1).max(20).default(5),
   eligibleStatuses: z.array(RawCrmValue).max(100).default([]),
-  blockedStatuses: z.array(RawCrmValue).max(100).default([])
+  blockedStatuses: z.array(RawCrmValue).max(100).default([]),
+  followUpAfterDays: z.number().int().min(1).max(60).default(7),
+  followUpLimit: z.number().int().min(0).max(20).default(5),
+  maxFollowUps: z.number().int().min(0).max(5).default(2),
+  rankAttribute: z.string().regex(/^[A-Za-z0-9_.-]{1,64}$/).default("score"),
+  followUpStatuses: z.array(RawCrmValue).max(100).default([]),
+  draftedStatus: RawCrmValue.optional()
 }).strict().default({});
 var RawCrmCapability = z.object({
   enabled: z.boolean().default(false),
@@ -138,6 +144,33 @@ var RawCrmCapability = z.object({
       }
     }
   }
+  const outreach = value.outreach;
+  const eligible = new Set(outreach.eligibleStatuses);
+  const followUpSeen = new Set;
+  for (const [index, status] of outreach.followUpStatuses.entries()) {
+    if (followUpSeen.has(status) || eligible.has(status) || !configuredStatuses.has(status)) {
+      ctx.addIssue({
+        code: z.ZodIssueCode.custom,
+        path: ["outreach", "followUpStatuses", index],
+        message: `CRM outreach follow-up status must be configured, unique and not eligible for a first touch: ${status}`
+      });
+    }
+    followUpSeen.add(status);
+  }
+  if (outreach.draftedStatus !== undefined && (!configuredStatuses.has(outreach.draftedStatus) || eligible.has(outreach.draftedStatus))) {
+    ctx.addIssue({
+      code: z.ZodIssueCode.custom,
+      path: ["outreach", "draftedStatus"],
+      message: `CRM outreach draftedStatus must be a configured status that is not eligible: ${outreach.draftedStatus}`
+    });
+  }
+  if (eligible.size > 0 && !value.activityTypes.includes("email_drafted")) {
+    ctx.addIssue({
+      code: z.ZodIssueCode.custom,
+      path: ["activityTypes"],
+      message: "CRM outreach requires the email_drafted activity type"
+    });
+  }
 }).default({});
 var RawObservabilityCapability = z.object({
   enabled: z.boolean().default(true),
@@ -181,31 +214,7 @@ var RawTodosCapability = z.object({
   enabled: z.boolean().default(true),
   digestHour: z.union([z.number().int().min(0).max(23), z.literal("off")]).default(8)
 }).strict().default({});
-var RawDefinedRoutine = z.object({
-  id: z.string().regex(/^[a-z0-9][a-z0-9-]{0,40}$/),
-  channel: z.string().regex(/^[CG][A-Z0-9]{8,}$/),
-  name: z.string().min(1).max(80),
-  kind: z.enum(["turn", "remind"]).default("turn"),
-  schedule: z.string().min(1),
-  prompt: z.string().min(1).max(2000),
-  quiet: z.boolean().default(false)
-}).strict();
-var RawRoutinesCapability = z.object({
-  enabled: z.boolean().default(true),
-  defined: z.array(RawDefinedRoutine).default([])
-}).strict().superRefine((value, ctx) => {
-  const seen = new Set;
-  for (const [index, entry] of value.defined.entries()) {
-    if (seen.has(entry.id)) {
-      ctx.addIssue({
-        code: z.ZodIssueCode.custom,
-        path: ["defined", index, "id"],
-        message: `duplicate defined routine id: ${entry.id}`
-      });
-    }
-    seen.add(entry.id);
-  }
-}).default({});
+var RawRoutinesCapability = z.object({ enabled: z.boolean().default(true) }).strict().default({});
 var NONE = {
   secrets: [],
   resources: [],
@@ -262,7 +271,7 @@ var CAPABILITIES = [
   },
   {
     id: "routines",
-    summary: "Scheduled turns and reminders, including routines the config defines.",
+    summary: "Scheduled turns and reminders people create in chat.",
     config: RawRoutinesCapability,
     ...NONE,
     resources: ["routineGroup", "routineSchedulerRole"]
@@ -767,13 +776,58 @@ var contextStorage = new AsyncLocalStorage;
 // ../core/src/config.ts
 import { createHash } from "node:crypto";
 import { parse as parseYaml2 } from "yaml";
+import { z as z4 } from "zod";
+
+// ../core/src/jobs.ts
+import { createHmac, timingSafeEqual } from "node:crypto";
 import { z as z3 } from "zod";
+var JOB_ID_PATTERN = /^[a-z0-9][a-z0-9-]{0,40}$/;
+var RawScheduleTrigger = z3.object({
+  schedule: z3.string().min(1)
+}).strict();
+var RawWebhookTrigger = z3.object({
+  webhook: z3.object({}).strict()
+}).strict();
+var RawJob = z3.object({
+  id: z3.string().regex(JOB_ID_PATTERN),
+  name: z3.string().min(1).max(80),
+  channel: z3.string().regex(/^[CG][A-Z0-9]{8,}$/, "a job runs in a Slack channel id"),
+  on: z3.union([RawScheduleTrigger, RawWebhookTrigger]),
+  prompt: z3.string().min(1).max(4000)
+}).strict();
+var RawJobs = z3.array(RawJob).default([]).superRefine((jobs, ctx) => {
+  const seen = new Set;
+  for (const [index, job] of jobs.entries()) {
+    if (seen.has(job.id)) {
+      ctx.addIssue({
+        code: z3.ZodIssueCode.custom,
+        path: [index, "id"],
+        message: `duplicate job id: ${job.id}`
+      });
+    }
+    seen.add(job.id);
+  }
+});
+function isScheduledJob(job) {
+  return "schedule" in job.on;
+}
+function isWebhookJob(job) {
+  return "webhook" in job.on;
+}
+function webhookJobBindings(jobs) {
+  return jobs.filter(isWebhookJob).map(({ id, name, channel, prompt }) => ({ id, name, channel, prompt }));
+}
+function jobWebhookKey(instanceSecret, jobId) {
+  return createHmac("sha256", instanceSecret).update(`foundation-job:${jobId}`).digest("hex");
+}
+
+// ../core/src/config.ts
 var MODEL_RE = /^([a-z0-9-]+)\/(.+)$/;
-var ThinkingLevel = z3.enum(["none", "low", "medium", "high", "xhigh", "max"]);
-var RawImages = z3.object({
-  backend: z3.enum(["gemini"]).default("gemini"),
-  model: z3.string().min(1).default("gemini-2.5-flash-image"),
-  dailyCap: z3.number().int().min(0).default(40)
+var ThinkingLevel = z4.enum(["none", "low", "medium", "high", "xhigh", "max"]);
+var RawImages = z4.object({
+  backend: z4.enum(["gemini"]).default("gemini"),
+  model: z4.string().min(1).default("gemini-2.5-flash-image"),
+  dailyCap: z4.number().int().min(0).default(40)
 }).strict().default({});
 var OMP_MODEL_ROLES = [
   "default",
@@ -786,49 +840,53 @@ var OMP_MODEL_ROLES = [
   "task",
   "advisor"
 ];
-var RawModelRoles = z3.record(z3.enum(OMP_MODEL_ROLES), z3.string().regex(MODEL_RE)).default({});
-var RawChannelModels = z3.record(z3.string().regex(/^[CG][A-Z0-9]+$/, "channelModels keys must be Slack channel ids"), z3.string().regex(MODEL_RE, "channel model must be provider/modelId")).default({});
-var RawSubagents = z3.object({
-  enabled: z3.boolean().default(true),
-  maxConcurrency: z3.number().int().min(1).max(8).default(3),
-  maxRecursionDepth: z3.number().int().min(1).max(3).default(2),
-  effort: z3.boolean().default(true)
+var RawModelRoles = z4.record(z4.enum(OMP_MODEL_ROLES), z4.string().regex(MODEL_RE)).default({});
+var RawChannelModels = z4.record(z4.string().regex(/^[CG][A-Z0-9]+$/, "channelModels keys must be Slack channel ids"), z4.string().regex(MODEL_RE, "channel model must be provider/modelId")).default({});
+var RawSubagents = z4.object({
+  enabled: z4.boolean().default(true),
+  maxConcurrency: z4.number().int().min(1).max(8).default(3),
+  maxRecursionDepth: z4.number().int().min(1).max(3).default(2),
+  effort: z4.boolean().default(true)
 }).strict().default({});
-var RawMemory = z3.object({ ompBackend: z3.enum(["off", "local"]).default("off") }).strict().default({});
+var RawMemory = z4.object({ ompBackend: z4.enum(["off", "local"]).default("off") }).strict().default({});
 var SKILL_SOURCE_SCOPES = ["shared", "instance"];
 var RawSkillSourceMetadata = {
-  owner: z3.string().min(1).optional(),
-  scope: z3.enum(SKILL_SOURCE_SCOPES).optional(),
-  requires: z3.array(z3.enum(CAPABILITY_IDS)).optional()
+  owner: z4.string().min(1).optional(),
+  scope: z4.enum(SKILL_SOURCE_SCOPES).optional(),
+  requires: z4.array(z4.enum(CAPABILITY_IDS)).optional()
 };
-var RawSkillSource = z3.union([
-  z3.object({
-    github: z3.string().min(1),
-    ref: z3.string().min(1).optional(),
-    path: z3.string().optional(),
+var RawSkillSource = z4.union([
+  z4.object({
+    github: z4.string().min(1),
+    ref: z4.string().min(1).optional(),
+    path: z4.string().optional(),
     ...RawSkillSourceMetadata
   }).strict(),
-  z3.object({ s3: z3.string().min(1), ...RawSkillSourceMetadata }).strict()
+  z4.object({ s3: z4.string().min(1), ...RawSkillSourceMetadata }).strict()
 ]);
-var RawSkills = z3.object({
-  sources: z3.array(RawSkillSource).optional(),
-  promoteTo: z3.string().min(1).optional()
+var RawSkills = z4.object({
+  sources: z4.array(RawSkillSource).optional(),
+  promoteTo: z4.string().min(1).optional()
 }).strict().default({});
-var RawInstanceConfig = z3.object({
-  name: z3.string().min(1),
-  model: z3.string().regex(MODEL_RE, "model must be provider/modelId"),
-  admins: z3.array(z3.string().min(1)).min(1, "admins must list at least one Slack user id"),
-  instructions: z3.string().default(""),
-  timezone: z3.string().default("UTC").refine(isValidTimezone, (tz) => ({ message: `unknown timezone: ${tz}` })),
+var RawInstanceConfig = z4.object({
+  name: z4.string().min(1),
+  model: z4.string().regex(MODEL_RE, "model must be provider/modelId"),
+  admins: z4.array(z4.string().min(1)).min(1, "admins must list at least one Slack user id"),
+  instructions: z4.string().default(""),
+  timezone: z4.string().default("UTC").refine(isValidTimezone, (tz) => ({ message: `unknown timezone: ${tz}` })),
   thinkingLevel: ThinkingLevel.optional(),
   skills: RawSkills,
   images: RawImages,
   modelRoles: RawModelRoles,
   channelModels: RawChannelModels,
   capabilities: RawCapabilities,
+  jobs: RawJobs,
   subagents: RawSubagents,
   memory: RawMemory
 }).strict();
+function crmOutreachConfigured(outreach) {
+  return outreach.eligibleStatuses.length > 0;
+}
 function crmPolicyFingerprint(config) {
   return createHash("sha256").update(JSON.stringify({
     channels: config.channels,
@@ -879,7 +937,8 @@ function parseInstanceConfig(yamlText) {
       effort: raw.subagents.effort
     },
     memory: { ompBackend: raw.memory.ompBackend },
-    capabilities: raw.capabilities
+    capabilities: raw.capabilities,
+    jobs: raw.jobs
   };
   if (raw.thinkingLevel !== undefined)
     cfg.thinkingLevel = raw.thinkingLevel;
@@ -1137,13 +1196,13 @@ var LIVE_ENDPOINT_NAME = "live";
 // src/release/manifest.ts
 import { createHash as createHash2 } from "node:crypto";
 import { readFileSync as readFileSync2, statSync } from "node:fs";
-import { z as z4 } from "zod";
+import { z as z5 } from "zod";
 var RELEASE_VERSION_RE = /^v\d+\.\d+\.\d+$/;
-var Sha256 = z4.string().regex(/^[0-9a-f]{64}$/, "must be a lowercase hex sha256");
-var ReleaseArtifactSchema = z4.object({
-  key: z4.string().min(1),
+var Sha256 = z5.string().regex(/^[0-9a-f]{64}$/, "must be a lowercase hex sha256");
+var ReleaseArtifactSchema = z5.object({
+  key: z5.string().min(1),
   sha256: Sha256,
-  bytes: z4.number().int().nonnegative()
+  bytes: z5.number().int().nonnegative()
 }).strict();
 var SIGNING_ALGORITHMS = [
   "RSASSA_PSS_SHA_256",
@@ -1156,21 +1215,21 @@ var SIGNING_ALGORITHMS = [
   "ECDSA_SHA_384",
   "ECDSA_SHA_512"
 ];
-var ReleaseManifestSchema = z4.object({
-  version: z4.string().regex(RELEASE_VERSION_RE, "must be vMAJOR.MINOR.PATCH"),
-  gitCommit: z4.string().regex(/^[0-9a-f]{40}$/, "must be a full commit sha"),
-  createdAt: z4.string().datetime(),
-  agentImage: z4.object({
-    repository: z4.string().min(1),
-    tag: z4.string().min(1),
-    digest: z4.string().regex(/^sha256:[0-9a-f]{64}$/)
+var ReleaseManifestSchema = z5.object({
+  version: z5.string().regex(RELEASE_VERSION_RE, "must be vMAJOR.MINOR.PATCH"),
+  gitCommit: z5.string().regex(/^[0-9a-f]{40}$/, "must be a full commit sha"),
+  createdAt: z5.string().datetime(),
+  agentImage: z5.object({
+    repository: z5.string().min(1),
+    tag: z5.string().min(1),
+    digest: z5.string().regex(/^sha256:[0-9a-f]{64}$/)
   }).strict(),
-  lambda: z4.record(ReleaseArtifactSchema),
-  skills: z4.object({ key: z4.string().min(1), sha256: Sha256 }).strict(),
-  signature: z4.object({
-    kmsKeyArn: z4.string().min(1),
-    algorithm: z4.enum(SIGNING_ALGORITHMS),
-    value: z4.string().min(1)
+  lambda: z5.record(ReleaseArtifactSchema),
+  skills: z5.object({ key: z5.string().min(1), sha256: Sha256 }).strict(),
+  signature: z5.object({
+    kmsKeyArn: z5.string().min(1),
+    algorithm: z5.enum(SIGNING_ALGORITHMS),
+    value: z5.string().min(1)
   }).strict().optional()
 }).strict();
 function parseManifest(json) {
@@ -1452,4 +1511,4 @@ function ecrRepositoryArn(repositoryUri) {
   return `arn:aws:ecr:${region}:${account}:repository/${name}`;
 }
 
-export { BASE_SLACK_EVENTS, CAPABILITY_IDS, requiredGithubPermissions, requiredSlackScopes, requiredSlackCommands, CUSTOMIZATION_ARTIFACT_NAME, newsletterManifestFor, instanceNames, slackCommandPrefix, slackCommandPrefixes, crmPolicyFingerprint, parseInstanceConfig, parseSchedule, loadInstanceFile, configPathFor, capabilityEnabled, requiresAuthenticatedQueue, enabledIntegrations, provisionsIntegration, adminsFor, WEB_SEARCH_TARGET, WEB_SEARCH_CONNECTOR_VERSION, LIVE_ENDPOINT_NAME, RELEASE_VERSION_RE, parseManifest, manifestKey, lambdaKey, skillsKey, buildManifest, manifestSigningPayload, verifyManifest, lambdaBundleContext, BUN_VERSION, LAMBDA_ENTRY_POINTS, skipBundle, RELEASE_BUCKET_ENV, RELEASE_DIR_ENV, releaseCacheDir, releaseSource, lambdaCode, agentImage, agentImageTagRequired, releaseImageRepositoryArn, ecrRepositoryArn };
+export { BASE_SLACK_EVENTS, CAPABILITY_IDS, requiredGithubPermissions, requiredSlackScopes, requiredSlackCommands, CUSTOMIZATION_ARTIFACT_NAME, newsletterManifestFor, instanceNames, slackCommandPrefix, slackCommandPrefixes, isScheduledJob, isWebhookJob, webhookJobBindings, jobWebhookKey, crmOutreachConfigured, crmPolicyFingerprint, parseInstanceConfig, parseSchedule, loadInstanceFile, configPathFor, capabilityEnabled, requiresAuthenticatedQueue, enabledIntegrations, provisionsIntegration, adminsFor, WEB_SEARCH_TARGET, WEB_SEARCH_CONNECTOR_VERSION, LIVE_ENDPOINT_NAME, RELEASE_VERSION_RE, parseManifest, manifestKey, lambdaKey, skillsKey, buildManifest, manifestSigningPayload, verifyManifest, lambdaBundleContext, BUN_VERSION, LAMBDA_ENTRY_POINTS, skipBundle, RELEASE_BUCKET_ENV, RELEASE_DIR_ENV, releaseCacheDir, releaseSource, lambdaCode, agentImage, agentImageTagRequired, releaseImageRepositoryArn, ecrRepositoryArn };

package/dist/{chunk-m4pn6wc2.js → chunk-paf33z2h.js}

@@ -5,6 +5,7 @@ import {
   agentImage,
   agentImageTagRequired,
   capabilityEnabled,
+  crmOutreachConfigured,
   crmPolicyFingerprint,
   instanceNames,
   lambdaCode,
@@ -13,8 +14,9 @@ import {
   provisionsIntegration,
   releaseImageRepositoryArn,
   requiresAuthenticatedQueue,
-  slackCommandPrefixes
-} from "./chunk-t86rw0f2.js";
+  slackCommandPrefixes,
+  webhookJobBindings
+} from "./chunk-gcg67ck3.js";
 
 // src/stacks/agent-stack.ts
 import * as cdk from "aws-cdk-lib";
@@ -618,6 +620,7 @@ import * as iam2 from "aws-cdk-lib/aws-iam";
 import * as lambda from "aws-cdk-lib/aws-lambda";
 import * as lambdaEventSources from "aws-cdk-lib/aws-lambda-event-sources";
 import * as scheduler from "aws-cdk-lib/aws-scheduler";
+import * as secretsmanager from "aws-cdk-lib/aws-secretsmanager";
 import * as sns from "aws-cdk-lib/aws-sns";
 import * as sqs from "aws-cdk-lib/aws-sqs";
 import { parse as parseYaml } from "yaml";
@@ -728,6 +731,20 @@ class FoundationApi extends cdk2.Stack {
       actions: ["kms:Decrypt", "kms:Encrypt", "kms:GenerateDataKey", "kms:DescribeKey"],
       resources: [props.dataKey.keyArn]
     }));
+    const webhookJobs = webhookJobsFor(props.configPath);
+    const jobsWebhookSecret = webhookJobs.length === 0 ? undefined : new secretsmanager.Secret(this, "JobsWebhookSecret", {
+      secretName: `${props.instance.naming.secretPrefix}/jobs/webhook`,
+      description: `${display} webhook job signing secret ({ secret }); sender keys derive from it`,
+      removalPolicy: cdk2.RemovalPolicy.DESTROY,
+      generateSecretString: {
+        secretStringTemplate: "{}",
+        generateStringKey: "secret",
+        passwordLength: 64,
+        excludePunctuation: true
+      }
+    });
+    if (jobsWebhookSecret !== undefined)
+      jobsWebhookSecret.grantRead(gatewayRole);
     const gatewayFunction = new lambda.Function(this, "GatewayFunction", {
       ...authenticatedQueue ? { functionName: names.slackGatewayFunctionName } : {},
       runtime: lambda.Runtime.NODEJS_22_X,
@@ -757,7 +774,11 @@ class FoundationApi extends cdk2.Stack {
         FOUNDATION_INSTANCE: props.instance.name,
         FOUNDATION_COMMAND_PREFIXES: slackCommandPrefixes(props.instance).join(","),
         FOUNDATION_PROACTIVE_CHANNELS: props.instance.proactive.channels.join(","),
-        FOUNDATION_PROACTIVE_MAX_PER_HOUR: String(props.instance.proactive.maxPerHour)
+        FOUNDATION_PROACTIVE_MAX_PER_HOUR: String(props.instance.proactive.maxPerHour),
+        ...jobsWebhookSecret === undefined ? {} : {
+          FOUNDATION_WEBHOOK_JOBS: JSON.stringify(webhookJobs),
+          FOUNDATION_JOBS_WEBHOOK_SECRET_ID: jobsWebhookSecret.secretName
+        }
       }
     });
     gatewayFunction.configureAsyncInvoke({
@@ -851,6 +872,15 @@ class FoundationApi extends cdk2.Stack {
       this.api.root.addResource("upwork").addResource("oauth").addResource("callback").addMethod("GET", integration);
       new cdk2.CfnOutput(this, "UpworkOAuthRedirectUrl", { value: upworkRedirectUri });
     }
+    if (webhookJobs.length > 0) {
+      this.api.root.addResource("jobs").addResource("{id}").addMethod("POST", integration);
+      for (const job of webhookJobs) {
+        new cdk2.CfnOutput(this, `JobWebhookUrl${job.id.replace(/[^A-Za-z0-9]/g, "")}`, {
+          description: `Webhook URL for job ${job.id}`,
+          value: this.api.urlForPath(`/jobs/${job.id}`)
+        });
+      }
+    }
     const emailProxyRole = new iam2.Role(this, "EmailProxyRole", {
       assumedBy: new iam2.ServicePrincipal("lambda.amazonaws.com"),
       description: `${display} email proxy Lambda role (the only reader of the mailbox secret)`,
@@ -1097,6 +1127,7 @@ class FoundationApi extends cdk2.Stack {
           "dynamodb:PutItem",
           "dynamodb:UpdateItem",
           "dynamodb:DeleteItem",
+          "dynamodb:BatchGetItem",
           "dynamodb:BatchWriteItem",
           "dynamodb:TransactWriteItems"
         ],
@@ -1123,7 +1154,11 @@ class FoundationApi extends cdk2.Stack {
           FOUNDATION_CRM_ALLOWED_CHANNELS: JSON.stringify(crm.channels),
           FOUNDATION_CRM_ALLOWED_STATUSES: JSON.stringify(crm.statuses),
           FOUNDATION_CRM_ACTIVITY_TYPES: JSON.stringify(crm.activityTypes),
-          FOUNDATION_CRM_MAX_BATCH_SIZE: String(crm.maxBatchSize)
+          FOUNDATION_CRM_MAX_BATCH_SIZE: String(crm.maxBatchSize),
+          ...crm.outreach === undefined ? {} : {
+            FOUNDATION_CRM_OUTREACH: JSON.stringify(crm.outreach),
+            FOUNDATION_CRM_TIMEZONE: crm.timezone
+          }
         }
       });
       new cdk2.CfnOutput(this, "CrmProxyFunctionArn", {
@@ -1221,7 +1256,9 @@ function crmConfigForProvisioning(configPath) {
     statuses: [...crm.statuses],
     activityTypes: [...crm.activityTypes],
     maxBatchSize: crm.maxBatchSize,
-    policyFingerprint: crmPolicyFingerprint(crm)
+    policyFingerprint: crmPolicyFingerprint(crm),
+    ...crmOutreachConfigured(crm.outreach) ? { outreach: crm.outreach } : {},
+    timezone: config.timezone
   };
 }
 function knockConfigForProvisioning(configPath) {
@@ -1248,6 +1285,15 @@ function emailIdentitiesFor(configPath) {
     return [];
   return email.identities;
 }
+var WEBHOOK_JOBS_MAX_ENV_BYTES = 2048;
+function webhookJobsFor(configPath) {
+  const jobs = webhookJobBindings(parseInstanceConfig(readFileSync(configPath, "utf8")).jobs);
+  const bytes = Buffer.byteLength(JSON.stringify(jobs));
+  if (bytes > WEBHOOK_JOBS_MAX_ENV_BYTES) {
+    throw new Error(`Webhook jobs take ${bytes} bytes of the gateway's environment; the limit is ${WEBHOOK_JOBS_MAX_ENV_BYTES}. Shorten their prompts and put the procedure in a skill.`);
+  }
+  return jobs;
+}
 function browserDomainsFor(configPath) {
   const browser = parseInstanceConfig(readFileSync(configPath, "utf8")).capabilities.browser;
   return browser.enabled && browser.mode === "read" ? [...browser.allowedDomains] : [];
@@ -1401,7 +1447,7 @@ import * as dynamodb from "aws-cdk-lib/aws-dynamodb";
 import * as iam5 from "aws-cdk-lib/aws-iam";
 import * as kms from "aws-cdk-lib/aws-kms";
 import * as s3 from "aws-cdk-lib/aws-s3";
-import * as secretsmanager from "aws-cdk-lib/aws-secretsmanager";
+import * as secretsmanager2 from "aws-cdk-lib/aws-secretsmanager";
 class FoundationData extends cdk4.Stack {
   dataKey;
   bucket;
@@ -1485,7 +1531,7 @@ class FoundationData extends cdk4.Stack {
       pointInTimeRecoverySpecification: { pointInTimeRecoveryEnabled: true },
       removalPolicy: cdk4.RemovalPolicy.DESTROY
     }) : undefined;
-    const secretShell = (constructId, name, description) => new secretsmanager.Secret(this, constructId, {
+    const secretShell = (constructId, name, description) => new secretsmanager2.Secret(this, constructId, {
       secretName: name,
       description,
       removalPolicy: cdk4.RemovalPolicy.RETAIN,
@@ -1494,7 +1540,7 @@ class FoundationData extends cdk4.Stack {
         generateStringKey: "placeholder"
       }
     });
-    const otterApi = provisionsIntegration(props.instance, "otter") ? new secretsmanager.Secret(this, "OtterApiSecret", {
+    const otterApi = provisionsIntegration(props.instance, "otter") ? new secretsmanager2.Secret(this, "OtterApiSecret", {
       secretName: names.secretOtterApi,
       description: `Otter Enterprise Public API key for ${display} ({ api_key })`,
       removalPolicy: cdk4.RemovalPolicy.DESTROY,
@@ -1503,7 +1549,7 @@ class FoundationData extends cdk4.Stack {
         generateStringKey: "placeholder"
       }
     }) : undefined;
-    const knockOauthClient = provisionsIntegration(props.instance, "knock") ? new secretsmanager.Secret(this, "KnockOauthClientSecret", {
+    const knockOauthClient = provisionsIntegration(props.instance, "knock") ? new secretsmanager2.Secret(this, "KnockOauthClientSecret", {
       secretName: names.secretKnockOauthClient,
       description: `Knock public OAuth client for ${display} ({ client_id, redirect_uri })`,
       removalPolicy: cdk4.RemovalPolicy.DESTROY,
@@ -1512,7 +1558,7 @@ class FoundationData extends cdk4.Stack {
         generateStringKey: "placeholder"
       }
     }) : undefined;
-    const knockCredential = provisionsIntegration(props.instance, "knock") ? new secretsmanager.Secret(this, "KnockCredentialSecret", {
+    const knockCredential = provisionsIntegration(props.instance, "knock") ? new secretsmanager2.Secret(this, "KnockCredentialSecret", {
       secretName: names.secretKnockCredential,
       description: `Knock OAuth credential for ${display}; callback writes and proxy alone reads`,
       removalPolicy: cdk4.RemovalPolicy.DESTROY,
@@ -1523,11 +1569,11 @@ class FoundationData extends cdk4.Stack {
     }) : undefined;
     const upwork = provisionsIntegration(props.instance, "upwork") ? secretShell("UpworkSecret", names.secretUpwork, `Upwork OAuth client and token store for ${display} ({ client_id, client_secret, access_token?, refresh_token?, expires_at?, tenant_id? })`) : undefined;
     this.secrets = {
-      signing: secretsmanager.Secret.fromSecretNameV2(this, "SlackSigningSecret", names.secretSlackSigning),
-      slackApp: secretsmanager.Secret.fromSecretNameV2(this, "SlackAppSecret", names.secretSlackApp),
-      githubApp: secretsmanager.Secret.fromSecretNameV2(this, "GithubAppSecret", names.secretGithubApp),
+      signing: secretsmanager2.Secret.fromSecretNameV2(this, "SlackSigningSecret", names.secretSlackSigning),
+      slackApp: secretsmanager2.Secret.fromSecretNameV2(this, "SlackAppSecret", names.secretSlackApp),
+      githubApp: secretsmanager2.Secret.fromSecretNameV2(this, "GithubAppSecret", names.secretGithubApp),
       codex: secretShell("CodexSecret", names.secretCodex, "OpenAI Codex credential store (rotated tokens are written back here)"),
-      googleAiStudio: new secretsmanager.Secret(this, "GoogleAiStudioSecret", {
+      googleAiStudio: new secretsmanager2.Secret(this, "GoogleAiStudioSecret", {
         secretName: names.secretGoogleAiStudio,
         encryptionKey: this.dataKey,
         description: "Google AI Studio API key for image generation ({ api_key })",
@@ -1537,7 +1583,7 @@ class FoundationData extends cdk4.Stack {
           generateStringKey: "placeholder"
         }
       }),
-      googleDrive: new secretsmanager.Secret(this, "GoogleDriveSecret", {
+      googleDrive: new secretsmanager2.Secret(this, "GoogleDriveSecret", {
         secretName: names.secretGoogleDrive,
         encryptionKey: this.dataKey,
         description: `Google Drive service identity: the company-owned Drive account ${display} reads as. JSON { client_email, private_key, token_uri? }, optionally nested under identities.default. Access is granted by sharing files/folders with client_email; scope is read-only.`,
@@ -1549,7 +1595,7 @@ class FoundationData extends cdk4.Stack {
       }),
       googleCalendar: secretShell("GoogleCalendarSecret", names.secretGoogleCalendar, `Google Calendar OAuth client for ${display}'s per-person calendar connections`),
       googleEmail: secretShell("GoogleEmailSecret", names.secretGoogleEmail, `Gmail identity for ${display}, connected from Slack — written by the gateway, read only by the email proxy`),
-      mongodbReadonly: new secretsmanager.Secret(this, "MongodbReadonlySecret", {
+      mongodbReadonly: new secretsmanager2.Secret(this, "MongodbReadonlySecret", {
         secretName: names.secretMongodbReadonly,
         encryptionKey: this.dataKey,
         description: `Read-only MongoDB Atlas credential for ${display}. JSON { uri, databases? } where uri authenticates an Atlas user provisioned with the \`read\` role, and databases (optional) narrows which databases the agent may name.`,
@@ -1799,7 +1845,7 @@ import * as lambda2 from "aws-cdk-lib/aws-lambda";
 import * as lambdaEventSources2 from "aws-cdk-lib/aws-lambda-event-sources";
 import * as route53 from "aws-cdk-lib/aws-route53";
 import * as route53Targets from "aws-cdk-lib/aws-route53-targets";
-import * as secretsmanager2 from "aws-cdk-lib/aws-secretsmanager";
+import * as secretsmanager3 from "aws-cdk-lib/aws-secretsmanager";
 import * as sns2 from "aws-cdk-lib/aws-sns";
 import * as snsSubscriptions from "aws-cdk-lib/aws-sns-subscriptions";
 import * as sqs2 from "aws-cdk-lib/aws-sqs";
@@ -1866,7 +1912,7 @@ class NewsletterStack extends cdk6.Stack {
       pointInTimeRecoverySpecification: { pointInTimeRecoveryEnabled: true },
       removalPolicy: cdk6.RemovalPolicy.RETAIN
     });
-    this.tokenSigningSecret = new secretsmanager2.Secret(this, "TokenSigningSecret", {
+    this.tokenSigningSecret = new secretsmanager3.Secret(this, "TokenSigningSecret", {
       secretName: names.newsletterTokenSigningSecret,
       description: "Newsletter confirmation and unsubscribe token HMAC secret",
       encryptionKey: newsletterKey,

package/dist/src/index.js

@@ -9,7 +9,7 @@ import {
   FoundationPipeline,
   NewsletterStack,
   deployStatements
-} from "../chunk-m4pn6wc2.js";
+} from "../chunk-paf33z2h.js";
 import {
   BUN_VERSION,
   LAMBDA_ENTRY_POINTS,
@@ -42,7 +42,7 @@ import {
   skillsKey,
   skipBundle,
   verifyManifest
-} from "../chunk-t86rw0f2.js";
+} from "../chunk-gcg67ck3.js";
 export {
   BUILD_TIMEOUT,
   BUN_VERSION,

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@deployfoundation/foundation-deploy",
-  "version": "0.1.5",
+  "version": "0.2.1",
   "description": "Deploys one Foundation instance from a published, signed release: the CDK app and the deploy tool.",
   "license": "UNLICENSED",
   "private": false,

package/src/deploy/cli.ts

@@ -16,6 +16,7 @@ import { configSync } from "./config-sync.ts";
 import { deploy } from "./deploy.ts";
 import { githubAppCreate } from "./github-app-create.ts";
 import { instanceBanner, loadInstanceContext, resolveInstanceFilePath } from "./instance.ts";
+import { jobKey } from "./job-key.ts";
 import { postDeploy } from "./post-deploy.ts";
 import { releaseRequest, resolveRelease } from "./release.ts";
 import { setup } from "./setup.ts";
@@ -30,6 +31,7 @@ export const COMMANDS = [
   "github-app-create",
   "slack-manifest",
   "stage-customization",
+  "job-key",
 ] as const;
 
 export type Command = (typeof COMMANDS)[number];
@@ -45,6 +47,7 @@ commands
   github-app-create    create the instance's GitHub App from the shipped manifest
   slack-manifest       print the instance's Slack app manifest as JSON
   stage-customization  validate and stage a tenant-owned runtime config
+  job-key <id>         print a webhook job's URL and signing key as JSON
 
 options
   --instance <path>    REQUIRED: path to the deployment's instance YAML
@@ -76,6 +79,10 @@ setup options
   --codex-file <path>  where that credential is (default: beside the instance
                        file, .foundation-local/codex.json)
 
+job-key options
+  --put-secret <id>    write {url, key} into this Secrets Manager secret
+                       (created if absent) instead of printing the key
+
 github-app-create options
   --org <org>          GitHub org (default: the instance's github.org)
   --port <n>           local callback port (default 8765)
@@ -148,6 +155,22 @@ export async function main(argv: readonly string[] = process.argv.slice(2)): Pro
     return 0;
   }
 
+  // Like `slack-manifest`, stdout is a machine-readable document, so the
+  // banner goes to stderr.
+  if (command === "job-key") {
+    const ctx = contextFor(args);
+    const jobId = args[0];
+    if (jobId === undefined || jobId.startsWith("-")) {
+      console.error(`job-key needs a job id\n\n${USAGE}`);
+      return 1;
+    }
+    console.error(instanceBanner(ctx.paths));
+    const putSecret = flag(args, "--put-secret");
+    const result = await jobKey(ctx, jobId, putSecret === undefined ? {} : { putSecret });
+    console.log(JSON.stringify(result));
+    return 0;
+  }
+
   if (command === "github-app-create") {
     const paths = loadInstanceContext(resolveInstanceFilePath(args, process.env));
     console.log(instanceBanner(paths));

package/src/deploy/job-key.ts

@@ -0,0 +1,76 @@
+import { readFileSync } from "node:fs";
+/**
+ * `foundation-deploy job-key <id>`: the URL and signing key one webhook job's
+ * sender needs.
+ *
+ * The instance holds one webhook secret; each job's key is derived from it
+ * (`jobWebhookKey`), so a sender can open only its own job and the operator
+ * never hands out the instance secret. With `--put-secret <id>` the pair is
+ * written into that secret (created if absent) and never printed, which is
+ * the way to wire a sender that already reads its settings from Secrets
+ * Manager.
+ */
+import {
+  type InstanceConfig,
+  isWebhookJob,
+  jobWebhookKey,
+  parseInstanceConfig,
+} from "@deployfoundation/foundation-core";
+import {
+  type AwsContext,
+  createSecretString,
+  putSecretString,
+  readSecretJson,
+  secretExists,
+  stackOutput,
+} from "./aws.ts";
+
+/** The CloudFormation output the API stack writes for one job's URL. */
+export function jobWebhookOutputKey(jobId: string): string {
+  return `JobWebhookUrl${jobId.replace(/[^A-Za-z0-9]/g, "")}`;
+}
+
+export function jobsWebhookSecretName(secretPrefix: string): string {
+  return `${secretPrefix}/jobs/webhook`;
+}
+
+export interface JobKeyResult {
+  url: string;
+  /** Absent when it went into `--put-secret` instead. */
+  key?: string;
+  secret?: string;
+}
+
+export async function jobKey(
+  ctx: AwsContext,
+  jobId: string,
+  options: { putSecret?: string } = {},
+): Promise<JobKeyResult> {
+  const config: InstanceConfig = parseInstanceConfig(readFileSync(ctx.paths.configPath, "utf8"));
+  const job = config.jobs.find((entry) => entry.id === jobId);
+  if (job === undefined) throw new Error(`no job "${jobId}" in ${ctx.paths.configPath}`);
+  if (!isWebhookJob(job)) throw new Error(`job "${jobId}" is not triggered by a webhook`);
+
+  const url = await stackOutput(ctx, ctx.names.api, jobWebhookOutputKey(jobId));
+  const instanceSecret = await readSecretJson<{ secret?: string }>(
+    ctx,
+    jobsWebhookSecretName(ctx.paths.instance.naming.secretPrefix),
+  );
+  if (instanceSecret.secret === undefined || instanceSecret.secret.length < 32)
+    throw new Error("the jobs webhook secret has no value — has the API stack been deployed?");
+  const key = jobWebhookKey(instanceSecret.secret, jobId);
+
+  if (options.putSecret === undefined) return { url, key };
+  const value = JSON.stringify({ url, key });
+  if (await secretExists(ctx, options.putSecret)) {
+    await putSecretString(ctx, options.putSecret, value);
+  } else {
+    await createSecretString(
+      ctx,
+      options.putSecret,
+      value,
+      `Webhook URL and signing key for Foundation job ${jobId} ({ url, key })`,
+    );
+  }
+  return { url, secret: options.putSecret };
+}

package/src/deploy/stage-customization.ts

@@ -19,6 +19,8 @@ import { dirname, isAbsolute, posix, relative, resolve, sep } from "node:path";
 import { isDeepStrictEqual } from "node:util";
 import {
   type InstanceConfig,
+  isScheduledJob,
+  isWebhookJob,
   parseInstanceConfig,
   parseSchedule,
 } from "@deployfoundation/foundation-core";
@@ -141,19 +143,22 @@ function assertUnchanged(path: string, platform: unknown, tenant: unknown): void
     );
 }
 
-/** Remove only the three tenant-editable leaves from a complete config. */
+/**
+ * Remove only the tenant-editable leaves from a complete config: the digest
+ * hour, CRM outreach policy and scheduled jobs. Webhook jobs stay protected:
+ * each is a public endpoint baked into the gateway at deploy.
+ */
 function protectedConfig(config: InstanceConfig): unknown {
   const { digestHour: _digestHour, ...todos } = config.capabilities.todos;
-  const { defined: _defined, ...routines } = config.capabilities.routines;
   const { outreach: _outreach, ...crm } = config.capabilities.crm;
   return {
     ...config,
     capabilities: {
       ...config.capabilities,
       todos,
-      routines,
       crm,
     },
+    jobs: config.jobs.filter(isWebhookJob),
   };
 }
 
@@ -161,10 +166,10 @@ function assertProtectedPolicy(platform: InstanceConfig, tenant: InstanceConfig)
   assertUnchanged("config", protectedConfig(platform), protectedConfig(tenant));
 }
 
-function assertValidTenantRoutines(tenant: InstanceConfig): void {
-  for (const routine of tenant.capabilities.routines.defined) {
-    const parsed = parseSchedule(routine.schedule);
-    if (!parsed.ok) throw new Error(`Invalid defined routine "${routine.id}": ${parsed.reason}`);
+function assertValidTenantJobs(tenant: InstanceConfig): void {
+  for (const job of tenant.jobs.filter(isScheduledJob)) {
+    const parsed = parseSchedule(job.on.schedule);
+    if (!parsed.ok) throw new Error(`Invalid job schedule "${job.id}": ${parsed.reason}`);
   }
 }
 
@@ -210,7 +215,7 @@ export function stageCustomization(options: StageCustomizationOptions): Customiz
   const platformConfig = parseInstanceConfig(readFileSync(platformConfigPath, "utf8"));
   if (tenantConfig.name !== instance.displayName)
     throw new Error("Customization config name must match the selected instance.");
-  assertValidTenantRoutines(tenantConfig);
+  assertValidTenantJobs(tenantConfig);
   assertProtectedPolicy(platformConfig, tenantConfig);
 
   if (options.dryRun !== true) {

package/src/stacks/api-stack.ts

@@ -1,5 +1,12 @@
 import { readFileSync } from "node:fs";
-import { crmPolicyFingerprint, parseInstanceConfig } from "@deployfoundation/foundation-core";
+import {
+  type CrmOutreachConfig,
+  type WebhookJobBinding,
+  crmOutreachConfigured,
+  crmPolicyFingerprint,
+  parseInstanceConfig,
+  webhookJobBindings,
+} from "@deployfoundation/foundation-core";
 import { slackCommandPrefixes } from "@deployfoundation/foundation-core/instance";
 import * as cdk from "aws-cdk-lib";
 import * as apigateway from "aws-cdk-lib/aws-apigateway";
@@ -11,7 +18,7 @@ import type * as kms from "aws-cdk-lib/aws-kms";
 import * as lambda from "aws-cdk-lib/aws-lambda";
 import * as lambdaEventSources from "aws-cdk-lib/aws-lambda-event-sources";
 import * as scheduler from "aws-cdk-lib/aws-scheduler";
-import type * as secretsmanager from "aws-cdk-lib/aws-secretsmanager";
+import * as secretsmanager from "aws-cdk-lib/aws-secretsmanager";
 import * as sns from "aws-cdk-lib/aws-sns";
 import * as sqs from "aws-cdk-lib/aws-sqs";
 import type { Construct } from "constructs";
@@ -255,6 +262,30 @@ export class FoundationApi extends cdk.Stack {
       }),
     );
 
+    // Webhook jobs are read at SYNTH, like the proactive channels: each one is a
+    // public endpoint, so declaring one is a deploy, not a config sync. The one
+    // instance secret exists only while some job needs it; each sender gets a
+    // key derived from it for its own job (`foundation-deploy job-key`).
+    const webhookJobs = webhookJobsFor(props.configPath);
+    const jobsWebhookSecret =
+      webhookJobs.length === 0
+        ? undefined
+        : new secretsmanager.Secret(this, "JobsWebhookSecret", {
+            secretName: `${props.instance.naming.secretPrefix}/jobs/webhook`,
+            description: `${display} webhook job signing secret ({ secret }); sender keys derive from it`,
+            // Destroyed with the last webhook job, like the opt-in integration
+            // secrets: a retained fixed-name secret could not be adopted when a
+            // job is added again. Senders get new keys then.
+            removalPolicy: cdk.RemovalPolicy.DESTROY,
+            generateSecretString: {
+              secretStringTemplate: "{}",
+              generateStringKey: "secret",
+              passwordLength: 64,
+              excludePunctuation: true,
+            },
+          });
+    if (jobsWebhookSecret !== undefined) jobsWebhookSecret.grantRead(gatewayRole);
+
     const gatewayFunction = new lambda.Function(this, "GatewayFunction", {
       ...(authenticatedQueue ? { functionName: names.slackGatewayFunctionName } : {}),
       runtime: lambda.Runtime.NODEJS_22_X,
@@ -305,6 +336,12 @@ export class FoundationApi extends cdk.Stack {
         // that omits the block.
         FOUNDATION_PROACTIVE_CHANNELS: props.instance.proactive.channels.join(","),
         FOUNDATION_PROACTIVE_MAX_PER_HOUR: String(props.instance.proactive.maxPerHour),
+        ...(jobsWebhookSecret === undefined
+          ? {}
+          : {
+              FOUNDATION_WEBHOOK_JOBS: JSON.stringify(webhookJobs),
+              FOUNDATION_JOBS_WEBHOOK_SECRET_ID: jobsWebhookSecret.secretName,
+            }),
       },
     });
     // One mention must produce one reply: Lambda's default of two async
@@ -463,6 +500,18 @@ export class FoundationApi extends cdk.Stack {
       new cdk.CfnOutput(this, "UpworkOAuthRedirectUrl", { value: upworkRedirectUri });
     }
 
+    if (webhookJobs.length > 0) {
+      // Authenticated by the job's own HMAC in the gateway, like the Slack
+      // routes are by Slack's signature.
+      this.api.root.addResource("jobs").addResource("{id}").addMethod("POST", integration);
+      for (const job of webhookJobs) {
+        new cdk.CfnOutput(this, `JobWebhookUrl${job.id.replace(/[^A-Za-z0-9]/g, "")}`, {
+          description: `Webhook URL for job ${job.id}`,
+          value: this.api.urlForPath(`/jobs/${job.id}`),
+        });
+      }
+    }
+
     // --- email proxy -----------------------------------------------------
     // The permission barrier for Gmail, and the reason the design puts it in
     // a Lambda rather than a broker inside the agent container: this role is
@@ -789,6 +838,7 @@ export class FoundationApi extends cdk.Stack {
             "dynamodb:PutItem",
             "dynamodb:UpdateItem",
             "dynamodb:DeleteItem",
+            "dynamodb:BatchGetItem",
             "dynamodb:BatchWriteItem",
             "dynamodb:TransactWriteItems",
           ],
@@ -819,6 +869,14 @@ export class FoundationApi extends cdk.Stack {
           FOUNDATION_CRM_ALLOWED_STATUSES: JSON.stringify(crm.statuses),
           FOUNDATION_CRM_ACTIVITY_TYPES: JSON.stringify(crm.activityTypes),
           FOUNDATION_CRM_MAX_BATCH_SIZE: String(crm.maxBatchSize),
+          // The outreach caps are enforced here, so they are baked like the
+          // rest of the policy: a config sync alone cannot lift them.
+          ...(crm.outreach === undefined
+            ? {}
+            : {
+                FOUNDATION_CRM_OUTREACH: JSON.stringify(crm.outreach),
+                FOUNDATION_CRM_TIMEZONE: crm.timezone,
+              }),
         },
       });
       new cdk.CfnOutput(this, "CrmProxyFunctionArn", {
@@ -921,6 +979,9 @@ interface ProvisionedCrmConfig {
   activityTypes: string[];
   maxBatchSize: number;
   policyFingerprint: string;
+  /** Absent when no status is eligible for outreach. */
+  outreach?: CrmOutreachConfig;
+  timezone: string;
 }
 
 function crmConfigForProvisioning(configPath: string): ProvisionedCrmConfig {
@@ -942,6 +1003,8 @@ function crmConfigForProvisioning(configPath: string): ProvisionedCrmConfig {
     activityTypes: [...crm.activityTypes],
     maxBatchSize: crm.maxBatchSize,
     policyFingerprint: crmPolicyFingerprint(crm),
+    ...(crmOutreachConfigured(crm.outreach) ? { outreach: crm.outreach } : {}),
+    timezone: config.timezone,
   };
 }
 
@@ -989,6 +1052,25 @@ export function emailIdentitiesFor(configPath: string): unknown[] {
   return email.identities;
 }
 
+/**
+ * Lambda environment variables share one 4KB budget with every other
+ * setting, so the webhook jobs baked into the gateway get a fixed slice of it.
+ * A long procedure belongs in a skill the prompt names.
+ */
+export const WEBHOOK_JOBS_MAX_ENV_BYTES = 2048;
+
+/** The config's webhook jobs, as the gateway is baked with them. */
+export function webhookJobsFor(configPath: string): WebhookJobBinding[] {
+  const jobs = webhookJobBindings(parseInstanceConfig(readFileSync(configPath, "utf8")).jobs);
+  const bytes = Buffer.byteLength(JSON.stringify(jobs));
+  if (bytes > WEBHOOK_JOBS_MAX_ENV_BYTES) {
+    throw new Error(
+      `Webhook jobs take ${bytes} bytes of the gateway's environment; the limit is ${WEBHOOK_JOBS_MAX_ENV_BYTES}. Shorten their prompts and put the procedure in a skill.`,
+    );
+  }
+  return jobs;
+}
+
 /** Server-side Browser allowlist baked into the isolated proxy at deploy time. */
 export function browserDomainsFor(configPath: string): string[] {
   const browser = parseInstanceConfig(readFileSync(configPath, "utf8")).capabilities.browser;