@deployfoundation/foundation-deploy 0.2.1 → 0.2.3

package/agent-image/Dockerfile

@@ -214,6 +214,7 @@ COPY packages/capability-browser/ ./packages/capability-browser/
 COPY packages/capability-email/ ./packages/capability-email/
 COPY packages/capability-crm/ ./packages/capability-crm/
 COPY packages/capability-upwork/ ./packages/capability-upwork/
+COPY packages/capability-etrade/ ./packages/capability-etrade/
 COPY packages/agent/ ./packages/agent/
 # Manifest only: the gateway and every proxy are Lambdas, the newsletter is a
 # Lambda service, and the infra package is the CDK app a pipeline runs. None of

package/dist/bin/app.js

@@ -7,12 +7,12 @@ import {
   FoundationNetwork,
   FoundationPipeline,
   NewsletterStack
-} from "../chunk-paf33z2h.js";
+} from "../chunk-my0awr1g.js";
 import {
   adminsFor,
   instanceNames,
   loadInstanceFile
-} from "../chunk-gcg67ck3.js";
+} from "../chunk-kf1yvx1w.js";
 
 // bin/app.ts
 import { execFileSync } from "node:child_process";
@@ -48,6 +48,7 @@ var agent = new FoundationAgent(app, names.agent, {
   itemsTable: data.itemsTable,
   ...data.crmTable === undefined ? {} : { crmTable: data.crmTable },
   ...data.upworkApprovalTable === undefined ? {} : { upworkApprovalTable: data.upworkApprovalTable },
+  ...data.etradePendingTable === undefined ? {} : { etradePendingTable: data.etradePendingTable },
   secrets: data.secrets
 });
 new FoundationCi(app, names.ci, { env, instance, bucket: data.bucket, dataKey: data.dataKey });
@@ -69,6 +70,7 @@ var api = new FoundationApi(app, names.api, {
   itemsTable: data.itemsTable,
   ...data.crmTable === undefined ? {} : { crmTable: data.crmTable },
   ...data.upworkApprovalTable === undefined ? {} : { upworkApprovalTable: data.upworkApprovalTable },
+  ...data.etradePendingTable === undefined ? {} : { etradePendingTable: data.etradePendingTable },
   secrets: {
     signing: data.secrets.signing,
     slackApp: data.secrets.slackApp,
@@ -79,7 +81,9 @@ var api = new FoundationApi(app, names.api, {
     ...data.secrets.otterApi === undefined ? {} : { otterApi: data.secrets.otterApi },
     ...data.secrets.knockOauthClient === undefined ? {} : { knockOauthClient: data.secrets.knockOauthClient },
     ...data.secrets.knockCredential === undefined ? {} : { knockCredential: data.secrets.knockCredential },
-    ...data.secrets.upwork === undefined ? {} : { upwork: data.secrets.upwork }
+    ...data.secrets.upwork === undefined ? {} : { upwork: data.secrets.upwork },
+    ...data.secrets.etradeClient === undefined ? {} : { etradeClient: data.secrets.etradeClient },
+    ...data.secrets.etradeCredential === undefined ? {} : { etradeCredential: data.secrets.etradeCredential }
   },
   agentRuntimeArn: agent.agentRuntimeArn,
   admins,

package/dist/bin/foundation-deploy.js

@@ -29,7 +29,7 @@ import {
   stackExists,
   stackOutput,
   toolVersion
-} from "../chunk-an8qhf3t.js";
+} from "../chunk-7h6zgsa5.js";
 import {
   BASE_SLACK_EVENTS,
   CAPABILITY_IDS,
@@ -45,7 +45,7 @@ import {
   requiredSlackScopes,
   skillsKey,
   slackCommandPrefix
-} from "../chunk-gcg67ck3.js";
+} from "../chunk-kf1yvx1w.js";
 
 // src/deploy/config-sync.ts
 import { existsSync, mkdirSync, mkdtempSync, readdirSync } from "node:fs";
@@ -326,6 +326,9 @@ var UPWORK_GRAPHQL_DOCUMENTS = Object.freeze({
 }`
   })
 });
+// ../connectors/src/etrade.ts
+var ETRADE_RESPONSE_MAX_BYTES = 1024 * 1024;
+var MAX_SECRET_JSON_LENGTH = 16 * 1024;
 // src/deploy/config.ts
 import { readFileSync } from "node:fs";
 import { parse } from "yaml";
@@ -748,6 +751,7 @@ function composeRuntimeSecret(inputs) {
     ...inputs.otterProxyFunctionArn !== undefined && inputs.otterProxyFunctionArn !== "" ? { FOUNDATION_OTTER_PROXY_FUNCTION_ARN: inputs.otterProxyFunctionArn } : {},
     ...inputs.knockProxyFunctionArn !== undefined && inputs.knockProxyFunctionArn !== "" ? { FOUNDATION_KNOCK_PROXY_FUNCTION_ARN: inputs.knockProxyFunctionArn } : {},
     ...inputs.upworkProxyFunctionArn !== undefined && inputs.upworkProxyFunctionArn !== "" ? { FOUNDATION_UPWORK_PROXY_ARN: inputs.upworkProxyFunctionArn } : {},
+    ...inputs.etradeProxyFunctionArn !== undefined && inputs.etradeProxyFunctionArn !== "" ? { FOUNDATION_ETRADE_PROXY_ARN: inputs.etradeProxyFunctionArn } : {},
     ...inputs.routineIngressFunctionArn !== undefined && inputs.routineIngressFunctionArn !== "" ? { FOUNDATION_ROUTINE_INGRESS_FUNCTION_ARN: inputs.routineIngressFunctionArn } : {},
     FOUNDATION_MONGODB_SECRET_ID: names.secretMongodbReadonly,
     FOUNDATION_SLACK_TEAM_ID: slackApp.team_id !== undefined && slackApp.team_id !== "" ? slackApp.team_id : instance.slack.teamId
@@ -1047,6 +1051,7 @@ async function syncRuntimeSecret(ctx) {
   const otterProxyFunctionArn = dry ? `<${api}.OtterProxyFunctionArn>` : await optionalOutput(ctx, api, "OtterProxyFunctionArn");
   const knockProxyFunctionArn = ctx.instance.integrations.knock ? dry ? `<${api}.KnockProxyFunctionArn>` : await optionalOutput(ctx, api, "KnockProxyFunctionArn") : undefined;
   const upworkProxyFunctionArn = ctx.instance.integrations.upwork ? dry ? `<${api}.UpworkProxyFunctionArn>` : await optionalOutput(ctx, api, "UpworkProxyFunctionArn") : undefined;
+  const etradeProxyFunctionArn = ctx.instance.integrations.etrade ? dry ? `<${api}.EtradeProxyFunctionArn>` : await optionalOutput(ctx, api, "EtradeProxyFunctionArn") : undefined;
   const routineIngressFunctionArn = dry ? `<${api}.RoutineIngressFunctionArn>` : await optionalOutput(ctx, api, "RoutineIngressFunctionArn");
   const slackApp = dry ? {
     bot_token: `<${secretSlackApp}.bot_token>`,
@@ -1071,6 +1076,7 @@ async function syncRuntimeSecret(ctx) {
     ...otterProxyFunctionArn === undefined ? {} : { otterProxyFunctionArn },
     ...knockProxyFunctionArn === undefined ? {} : { knockProxyFunctionArn },
     ...upworkProxyFunctionArn === undefined ? {} : { upworkProxyFunctionArn },
+    ...etradeProxyFunctionArn === undefined ? {} : { etradeProxyFunctionArn },
     ...routineIngressFunctionArn === undefined ? {} : { routineIngressFunctionArn }
   });
   await putSecretJson(ctx, secretRuntime, value);

package/dist/bin/release-account.js

@@ -1,8 +1,8 @@
 #!/usr/bin/env bun
 import {
   DEFAULT_RELEASE_BUCKET
-} from "../chunk-an8qhf3t.js";
-import"../chunk-gcg67ck3.js";
+} from "../chunk-7h6zgsa5.js";
+import"../chunk-kf1yvx1w.js";
 
 // bin/release-account.ts
 import * as cdk2 from "aws-cdk-lib";

package/dist/{chunk-an8qhf3t.js → chunk-7h6zgsa5.js}

@@ -6,7 +6,7 @@ import {
   manifestKey,
   releaseCacheDir,
   verifyManifest
-} from "./chunk-gcg67ck3.js";
+} from "./chunk-kf1yvx1w.js";
 
 // src/deploy/release.ts
 import { existsSync as existsSync2, mkdirSync, readFileSync as readFileSync2 } from "node:fs";

package/dist/{chunk-gcg67ck3.js → chunk-kf1yvx1w.js}

@@ -50,6 +50,8 @@ var RawCrmValue = z.string().min(1).max(64).refine(isCleanCrmValue, {
   message: "CRM values must not have surrounding whitespace or control characters"
 });
 var RawSlackChannel = z.string().regex(/^[CG][A-Z0-9]{8,}$/).max(64);
+var RawPrivateSlackChannel = z.string().regex(/^G[A-Z0-9]{8,}$/).max(64);
+var RawSlackUser = z.string().regex(/^[UW][A-Z0-9]{8,}$/).max(64);
 var RawUpworkCapability = z.object({
   enabled: z.boolean().default(false),
   channels: z.array(RawSlackChannel).max(100).default([])
@@ -66,6 +68,40 @@ var RawUpworkCapability = z.object({
     seen.add(channel);
   }
 }).default({});
+var RawEtradeCapability = z.object({
+  enabled: z.boolean().default(false),
+  channels: z.array(RawPrivateSlackChannel).max(100).default([]),
+  users: z.array(RawSlackUser).max(100).default([])
+}).strict().superRefine((value, ctx) => {
+  if (value.enabled && value.channels.length === 0)
+    ctx.addIssue({
+      code: z.ZodIssueCode.custom,
+      path: ["channels"],
+      message: "an enabled E*TRADE capability needs at least one private channel"
+    });
+  if (value.enabled && value.users.length === 0)
+    ctx.addIssue({
+      code: z.ZodIssueCode.custom,
+      path: ["users"],
+      message: "an enabled E*TRADE capability needs at least one allowed user"
+    });
+  for (const [field, values] of [
+    ["channels", value.channels],
+    ["users", value.users]
+  ]) {
+    const seen = new Set;
+    for (const [index, entry] of values.entries()) {
+      if (seen.has(entry)) {
+        ctx.addIssue({
+          code: z.ZodIssueCode.custom,
+          path: [field, index],
+          message: `duplicate E*TRADE ${field.slice(0, -1)}: ${entry}`
+        });
+      }
+      seen.add(entry);
+    }
+  }
+}).default({});
 var RawAmazonSearchCapability = z.object({
   enabled: z.boolean().default(true),
   marketplace: z.string().min(1).optional()
@@ -409,6 +445,16 @@ var CAPABILITIES = [
     secrets: ["upwork/oauth"],
     resources: ["upworkProxyFunctionName"],
     slackCommands: ["upwork-connect"]
+  },
+  {
+    id: "etrade",
+    summary: "E*TRADE account data through six fixed reads for named admins and deployment jobs in configured private channels.",
+    config: RawEtradeCapability,
+    integration: true,
+    ...NONE,
+    secrets: ["etrade/oauth-client", "etrade/credential"],
+    resources: ["etradeProxyFunctionName"],
+    slackCommands: ["etrade-connect"]
   }
 ];
 var CAPABILITY_IDS = CAPABILITIES.map((capability) => capability.id);
@@ -466,8 +512,8 @@ var RawAws = z2.object({
   alarmEmail: z2.string().email().optional()
 }).strict();
 var RawSlack = z2.object({
-  teamId: z2.string().min(1),
-  appId: z2.string().min(1),
+  teamId: z2.string().min(1).max(128),
+  appId: z2.string().min(1).max(128),
   commandPrefix: z2.string().regex(SLACK_COMMAND_PREFIX_RE).optional(),
   legacyCommandPrefixes: z2.array(z2.string().regex(SLACK_COMMAND_PREFIX_RE)).max(3).default([])
 }).strict();
@@ -512,8 +558,8 @@ var RawProactive = z2.object({
   maxPerHour: z2.number().int().min(1).max(500).default(20)
 }).strict().default({ channels: [] });
 var RawNaming = z2.object({
-  prefix: z2.string().regex(/^[A-Z][A-Za-z0-9]*$/),
-  secretPrefix: z2.string().regex(/^[a-z][a-z0-9-]*$/),
+  prefix: z2.string().min(1).max(32).regex(/^[A-Z][A-Za-z0-9]*$/),
+  secretPrefix: z2.string().min(1).max(40).regex(/^[a-z][a-z0-9-]*$/),
   runtimeName: z2.string().regex(/^[a-zA-Z][a-zA-Z0-9_]{0,47}$/)
 }).strict();
 var INSTANCE_ID_RE = /^[a-z][a-z0-9-]*$/;
@@ -629,6 +675,7 @@ var RawIntegrations = z2.object({
   browser: z2.boolean().default(false),
   knock: z2.boolean().default(false),
   upwork: z2.boolean().default(false),
+  etrade: z2.boolean().default(false),
   crm: z2.boolean().default(false),
   crmStorage: z2.boolean().optional()
 }).strict().default({}).transform((integrations) => ({
@@ -637,8 +684,8 @@ var RawIntegrations = z2.object({
 }));
 var RawLicense = z2.object({ key: z2.string().min(1) }).strict();
 var RawInstance = z2.object({
-  name: z2.string().regex(/^[a-z][a-z0-9-]*$/),
-  displayName: z2.string().min(1),
+  name: z2.string().min(1).max(63).regex(/^[a-z][a-z0-9-]*$/),
+  displayName: z2.string().min(1).max(120),
   pending: z2.boolean().default(false),
   aws: RawAws,
   slack: RawSlack,
@@ -730,6 +777,8 @@ function instanceNames(instance) {
     secretKnockOauthClient: secret("knock/oauth-client"),
     secretKnockCredential: secret("knock/credential"),
     secretUpwork: secret("upwork/oauth"),
+    secretEtradeClient: secret("etrade/oauth-client"),
+    secretEtradeCredential: secret("etrade/credential"),
     secretRuntime: secret("agent/runtime"),
     secretLicenseLastVerified: secret("license/last-verified"),
     newsletterTokenSigningSecret: secret("newsletter/token-signing"),
@@ -751,6 +800,7 @@ function instanceNames(instance) {
     browserProxyFunctionName: stack("BrowserProxy"),
     knockProxyFunctionName: stack("KnockProxy"),
     upworkProxyFunctionName: stack("UpworkProxy"),
+    etradeProxyFunctionName: stack("EtradeProxy"),
     defaultRepo: instance.github.defaultRepo ?? instance.github.repo
   };
 }
@@ -774,12 +824,12 @@ import { dirname, isAbsolute, resolve } from "node:path";
 import { AsyncLocalStorage } from "node:async_hooks";
 var contextStorage = new AsyncLocalStorage;
 // ../core/src/config.ts
-import { createHash } from "node:crypto";
+import { createHash as createHash2 } from "node:crypto";
 import { parse as parseYaml2 } from "yaml";
 import { z as z4 } from "zod";
 
 // ../core/src/jobs.ts
-import { createHmac, timingSafeEqual } from "node:crypto";
+import { createHash, createHmac, timingSafeEqual } from "node:crypto";
 import { z as z3 } from "zod";
 var JOB_ID_PATTERN = /^[a-z0-9][a-z0-9-]{0,40}$/;
 var RawScheduleTrigger = z3.object({
@@ -817,6 +867,15 @@ function isWebhookJob(job) {
 function webhookJobBindings(jobs) {
   return jobs.filter(isWebhookJob).map(({ id, name, channel, prompt }) => ({ id, name, channel, prompt }));
 }
+function scheduledJobFingerprint(input) {
+  return createHash("sha256").update(JSON.stringify([input.routineId, input.name, input.channel, input.prompt])).digest("hex");
+}
+function scheduledJobBindings(jobs) {
+  return jobs.filter(isScheduledJob).map(({ id, name, channel, prompt }) => {
+    const input = { routineId: `job-${id}`, name, channel, prompt };
+    return { routineId: input.routineId, fingerprint: scheduledJobFingerprint(input) };
+  });
+}
 function jobWebhookKey(instanceSecret, jobId) {
   return createHmac("sha256", instanceSecret).update(`foundation-job:${jobId}`).digest("hex");
 }
@@ -888,7 +947,7 @@ function crmOutreachConfigured(outreach) {
   return outreach.eligibleStatuses.length > 0;
 }
 function crmPolicyFingerprint(config) {
-  return createHash("sha256").update(JSON.stringify({
+  return createHash2("sha256").update(JSON.stringify({
     channels: config.channels,
     statuses: config.statuses,
     activityTypes: config.activityTypes,
@@ -1194,7 +1253,7 @@ var WEB_SEARCH_CONNECTOR_VERSION = "1.2.0";
 var LIVE_ENDPOINT_NAME = "live";
 
 // src/release/manifest.ts
-import { createHash as createHash2 } from "node:crypto";
+import { createHash as createHash3 } from "node:crypto";
 import { readFileSync as readFileSync2, statSync } from "node:fs";
 import { z as z5 } from "zod";
 var RELEASE_VERSION_RE = /^v\d+\.\d+\.\d+$/;
@@ -1248,7 +1307,7 @@ function skillsKey(version) {
   return `${releasePrefix(version)}/skills.tar.gz`;
 }
 function sha256Hex(bytes) {
-  return createHash2("sha256").update(bytes).digest("hex");
+  return createHash3("sha256").update(bytes).digest("hex");
 }
 function sha256File(path) {
   return sha256Hex(readFileSync2(path));
@@ -1381,6 +1440,7 @@ var LAMBDA_ENTRY_POINTS = {
   "knock-proxy": { entry: "packages/capability-knock/src/proxy/handler.ts" },
   "crm-proxy": { entry: "packages/capability-crm/src/proxy/handler.ts" },
   "upwork-proxy": { entry: "packages/capability-upwork/src/proxy/handler.ts" },
+  "etrade-proxy": { entry: "packages/capability-etrade/src/proxy/handler.ts" },
   "browser-proxy": { entry: "packages/gateway/src/browser-proxy.ts", playwright: true },
   "newsletter-public": { entry: "packages/newsletter/src/lambda-public.ts" },
   "newsletter-campaign": { entry: "packages/newsletter/src/lambda-campaign.ts" },
@@ -1511,4 +1571,4 @@ function ecrRepositoryArn(repositoryUri) {
   return `arn:aws:ecr:${region}:${account}:repository/${name}`;
 }
 
-export { BASE_SLACK_EVENTS, CAPABILITY_IDS, requiredGithubPermissions, requiredSlackScopes, requiredSlackCommands, CUSTOMIZATION_ARTIFACT_NAME, newsletterManifestFor, instanceNames, slackCommandPrefix, slackCommandPrefixes, isScheduledJob, isWebhookJob, webhookJobBindings, jobWebhookKey, crmOutreachConfigured, crmPolicyFingerprint, parseInstanceConfig, parseSchedule, loadInstanceFile, configPathFor, capabilityEnabled, requiresAuthenticatedQueue, enabledIntegrations, provisionsIntegration, adminsFor, WEB_SEARCH_TARGET, WEB_SEARCH_CONNECTOR_VERSION, LIVE_ENDPOINT_NAME, RELEASE_VERSION_RE, parseManifest, manifestKey, lambdaKey, skillsKey, buildManifest, manifestSigningPayload, verifyManifest, lambdaBundleContext, BUN_VERSION, LAMBDA_ENTRY_POINTS, skipBundle, RELEASE_BUCKET_ENV, RELEASE_DIR_ENV, releaseCacheDir, releaseSource, lambdaCode, agentImage, agentImageTagRequired, releaseImageRepositoryArn, ecrRepositoryArn };
+export { BASE_SLACK_EVENTS, CAPABILITY_IDS, requiredGithubPermissions, requiredSlackScopes, requiredSlackCommands, CUSTOMIZATION_ARTIFACT_NAME, newsletterManifestFor, instanceNames, slackCommandPrefix, slackCommandPrefixes, isScheduledJob, isWebhookJob, webhookJobBindings, scheduledJobBindings, jobWebhookKey, crmOutreachConfigured, crmPolicyFingerprint, parseInstanceConfig, parseSchedule, loadInstanceFile, configPathFor, capabilityEnabled, requiresAuthenticatedQueue, enabledIntegrations, provisionsIntegration, adminsFor, WEB_SEARCH_TARGET, WEB_SEARCH_CONNECTOR_VERSION, LIVE_ENDPOINT_NAME, RELEASE_VERSION_RE, parseManifest, manifestKey, lambdaKey, skillsKey, buildManifest, manifestSigningPayload, verifyManifest, lambdaBundleContext, BUN_VERSION, LAMBDA_ENTRY_POINTS, skipBundle, RELEASE_BUCKET_ENV, RELEASE_DIR_ENV, releaseCacheDir, releaseSource, lambdaCode, agentImage, agentImageTagRequired, releaseImageRepositoryArn, ecrRepositoryArn };