@deployfoundation/foundation-deploy 0.2.1 → 0.2.3

package/dist/{chunk-paf33z2h.js → chunk-my0awr1g.js}

@@ -8,15 +8,18 @@ import {
   crmOutreachConfigured,
   crmPolicyFingerprint,
   instanceNames,
+  isScheduledJob,
   lambdaCode,
   newsletterManifestFor,
   parseInstanceConfig,
+  parseSchedule,
   provisionsIntegration,
   releaseImageRepositoryArn,
   requiresAuthenticatedQueue,
+  scheduledJobBindings,
   slackCommandPrefixes,
   webhookJobBindings
-} from "./chunk-gcg67ck3.js";
+} from "./chunk-kf1yvx1w.js";
 
 // src/stacks/agent-stack.ts
 import * as cdk from "aws-cdk-lib";
@@ -243,6 +246,34 @@ class FoundationAgent extends cdk.Stack {
       resources: [upworkApprovalTable.tableArn, `${upworkApprovalTable.tableArn}/index/*`]
     }));
   }
+  denyDirectEtradeAccess(role, props) {
+    const retainedSecretArn = (name) => cdk.Stack.of(this).formatArn({
+      service: "secretsmanager",
+      resource: "secret",
+      resourceName: `${name}-??????`,
+      arnFormat: cdk.ArnFormat.COLON_RESOURCE_NAME
+    });
+    role.addToPolicy(new iam.PolicyStatement({
+      sid: "DenyEtradeSecrets",
+      effect: iam.Effect.DENY,
+      actions: ["secretsmanager:*"],
+      resources: [
+        retainedSecretArn(this.names.secretEtradeClient),
+        retainedSecretArn(this.names.secretEtradeCredential)
+      ]
+    }));
+    if (!provisionsIntegration(props.instance, "etrade"))
+      return;
+    const pending = props.etradePendingTable;
+    if (pending === undefined)
+      throw new Error(`${this.stackName}: integrations.etrade is enabled but FoundationData supplied no E*TRADE pending-state table`);
+    role.addToPolicy(new iam.PolicyStatement({
+      sid: "DenyEtradePendingState",
+      effect: iam.Effect.DENY,
+      actions: ["dynamodb:*"],
+      resources: [pending.tableArn, `${pending.tableArn}/index/*`]
+    }));
+  }
   buildReadOnlyRole(props) {
     const role = new iam.Role(this, "AgentReadOnlyRole", {
       roleName: `${props.instance.naming.prefix}ReadOnlyRole`,
@@ -254,6 +285,7 @@ class FoundationAgent extends cdk.Stack {
     this.denyDirectCrmTableAccess(role, props.instance, props.crmTable);
     this.denyDirectKnockSecretAccess(role, props);
     this.denyDirectUpworkApprovalAccess(role, props.upworkApprovalTable);
+    this.denyDirectEtradeAccess(role, props);
     role.addToPolicy(new iam.PolicyStatement({
       sid: "DenyAgentCoreBrowserMetadata",
       effect: iam.Effect.DENY,
@@ -292,6 +324,7 @@ class FoundationAgent extends cdk.Stack {
     this.denyDirectCrmTableAccess(role, props.instance, props.crmTable);
     this.denyDirectKnockSecretAccess(role, props);
     this.denyDirectUpworkApprovalAccess(role, props.upworkApprovalTable);
+    this.denyDirectEtradeAccess(role, props);
     const releaseRepositoryArn = releaseImageRepositoryArn(this);
     role.addToPolicy(new iam.PolicyStatement({
       sid: "EcrPull",
@@ -456,6 +489,20 @@ class FoundationAgent extends cdk.Stack {
         ]
       }));
     }
+    if (provisionsIntegration(props.instance, "etrade")) {
+      role.addToPolicy(new iam.PolicyStatement({
+        sid: "EtradeProxyInvoke",
+        actions: ["lambda:InvokeFunction"],
+        resources: [
+          cdk.Stack.of(this).formatArn({
+            service: "lambda",
+            resource: "function",
+            resourceName: this.names.etradeProxyFunctionName,
+            arnFormat: cdk.ArnFormat.COLON_RESOURCE_NAME
+          })
+        ]
+      }));
+    }
     if (provisionsIntegration(props.instance, "crm")) {
       role.addToPolicy(new iam.PolicyStatement({
         sid: "CrmProxyInvoke",
@@ -550,6 +597,11 @@ class FoundationAgent extends cdk.Stack {
         `arn:${this.partition}:scheduler:${this.region}:${this.account}:schedule/${this.names.routineGroup}/*`
       ]
     }));
+    role.addToPolicy(new iam.PolicyStatement({
+      sid: "RoutineScheduleList",
+      actions: ["scheduler:ListSchedules"],
+      resources: ["*"]
+    }));
     role.addToPolicy(new iam.PolicyStatement({
       sid: "PassRoutineSchedulerRole",
       actions: ["iam:PassRole"],
@@ -612,6 +664,13 @@ function secretArnPattern(secret) {
 
 // src/stacks/api-stack.ts
 import { readFileSync } from "node:fs";
+
+// ../core/src/actor-capability.ts
+var ACTOR_CAPABILITY_TTL_SECONDS = 15 * 60;
+var JOB_ACTOR = "config";
+var JOB_ACTOR_CAPABILITY_TTL_SECONDS = 60 * 60;
+
+// src/stacks/api-stack.ts
 import * as cdk2 from "aws-cdk-lib";
 import * as apigateway from "aws-cdk-lib/aws-apigateway";
 import * as cloudwatch from "aws-cdk-lib/aws-cloudwatch";
@@ -635,6 +694,7 @@ class FoundationApi extends cdk2.Stack {
   crmProxyFunction;
   knockProxyFunction;
   upworkProxyFunction;
+  etradeProxyFunction;
   constructor(scope, id, props) {
     super(scope, id, props);
     const names = instanceNames(props.instance);
@@ -644,7 +704,18 @@ class FoundationApi extends cdk2.Stack {
     const upworkApprovalTable = upwork === undefined ? undefined : props.upworkApprovalTable;
     if (upwork !== undefined && (upworkSecret === undefined || upworkApprovalTable === undefined))
       throw new Error(`${id}: integrations.upwork is enabled but its secret or approval table was not supplied by FoundationData`);
+    const etrade = provisionsIntegration(props.instance, "etrade") ? etradeConfigForProvisioning(props.configPath) : undefined;
+    const etradeClientSecret = etrade === undefined ? undefined : props.secrets.etradeClient;
+    const etradeCredentialSecret = etrade === undefined ? undefined : props.secrets.etradeCredential;
+    const etradePendingTable = etrade === undefined ? undefined : props.etradePendingTable;
+    if (etrade !== undefined && (etradeClientSecret === undefined || etradeCredentialSecret === undefined || etradePendingTable === undefined))
+      throw new Error(`${id}: integrations.etrade is enabled but its client secret, credential secret, or pending OAuth table was not supplied by FoundationData`);
     const authenticatedQueue = requiresAuthenticatedQueue(props.instance);
+    const configuredScheduledJobs = scheduledJobsFor(props.configPath);
+    const scheduledJobs = scheduledJobBindings(configuredScheduledJobs);
+    const scheduledJobTimezone = configTimezoneFor(props.configPath);
+    const etradeAllowedChannels = etrade === undefined ? "" : JSON.stringify(etrade.channels);
+    const etradeAllowedUsers = etrade === undefined ? "" : JSON.stringify(etrade.users);
     this.gatewayDlq = new sqs.Queue(this, "GatewayDlq", {
       encryption: sqs.QueueEncryption.KMS,
       encryptionMasterKey: props.dataKey,
@@ -711,6 +782,38 @@ class FoundationApi extends cdk2.Stack {
         resources: [secretArnPattern2(upworkSecret)]
       }));
     }
+    if (etradeClientSecret !== undefined && etradeCredentialSecret !== undefined && etradePendingTable !== undefined) {
+      gatewayRole.addToPolicy(new iam2.PolicyStatement({
+        sid: "EtradeOAuthClientRead",
+        actions: ["secretsmanager:GetSecretValue"],
+        resources: [secretArnPattern2(etradeClientSecret)]
+      }));
+      gatewayRole.addToPolicy(new iam2.PolicyStatement({
+        sid: "EtradeOAuthCredentialWrite",
+        actions: [
+          "secretsmanager:DescribeSecret",
+          "secretsmanager:PutSecretValue",
+          "secretsmanager:UpdateSecretVersionStage"
+        ],
+        resources: [secretArnPattern2(etradeCredentialSecret)]
+      }));
+      gatewayRole.addToPolicy(new iam2.PolicyStatement({
+        sid: "DenyEtradeOAuthCredentialRead",
+        effect: iam2.Effect.DENY,
+        actions: ["secretsmanager:GetSecretValue", "secretsmanager:BatchGetSecretValue"],
+        resources: [secretArnPattern2(etradeCredentialSecret)]
+      }));
+      gatewayRole.addToPolicy(new iam2.PolicyStatement({
+        sid: "EtradeOAuthPendingState",
+        actions: [
+          "dynamodb:GetItem",
+          "dynamodb:PutItem",
+          "dynamodb:UpdateItem",
+          "dynamodb:DeleteItem"
+        ],
+        resources: [etradePendingTable.tableArn]
+      }));
+    }
     gatewayRole.addToPolicy(new iam2.PolicyStatement({
       sid: "DedupeAndThreadIndex",
       actions: ["dynamodb:PutItem", "dynamodb:GetItem", "dynamodb:UpdateItem"],
@@ -745,6 +848,41 @@ class FoundationApi extends cdk2.Stack {
     });
     if (jobsWebhookSecret !== undefined)
       jobsWebhookSecret.grantRead(gatewayRole);
+    const gatewayEnvironment = {
+      FOUNDATION_TABLE_NAME: props.table.tableName,
+      FOUNDATION_INVOKE_QUEUE_URL: this.invokeQueue.queueUrl,
+      FOUNDATION_GATEWAY_DLQ_URL: this.gatewayDlq.queueUrl,
+      FOUNDATION_SLACK_SIGNING_SECRET_ID: props.secrets.signing.secretName,
+      FOUNDATION_SLACK_APP_SECRET_ID: props.secrets.slackApp.secretName,
+      FOUNDATION_ADMINS: props.admins,
+      FOUNDATION_AGENT_RUNTIME_ARN: props.agentRuntimeArn,
+      FOUNDATION_DISPLAY_NAME: props.instance.displayName,
+      FOUNDATION_ITEMS_TABLE_NAME: props.itemsTable.tableName,
+      FOUNDATION_GOOGLE_CALENDAR_SECRET_ID: props.secrets.googleCalendar.secretName,
+      FOUNDATION_GOOGLE_OAUTH_SECRET_ID: props.secrets.googleOauth.secretName,
+      FOUNDATION_GOOGLE_DRIVE_SECRET_ID: props.secrets.googleDrive.secretName,
+      FOUNDATION_GOOGLE_EMAIL_SECRET_ID: props.secrets.googleEmail.secretName,
+      ...props.secrets.knockOauthClient === undefined ? {} : { FOUNDATION_KNOCK_OAUTH_CLIENT_SECRET_ID: props.secrets.knockOauthClient.secretName },
+      ...props.secrets.knockCredential === undefined ? {} : { FOUNDATION_KNOCK_CREDENTIAL_SECRET_ID: props.secrets.knockCredential.secretName },
+      ...upworkSecret === undefined ? {} : { FOUNDATION_UPWORK_SECRET_ID: upworkSecret.secretName },
+      ...etradeClientSecret === undefined || etradeCredentialSecret === undefined || etradePendingTable === undefined || etrade === undefined ? {} : {
+        FOUNDATION_ETRADE_CLIENT_SECRET_ID: etradeClientSecret.secretName,
+        FOUNDATION_ETRADE_CREDENTIAL_SECRET_ID: etradeCredentialSecret.secretName,
+        FOUNDATION_ETRADE_PENDING_TABLE_NAME: etradePendingTable.tableName,
+        FOUNDATION_ETRADE_ALLOWED_CHANNELS: etradeAllowedChannels,
+        FOUNDATION_ETRADE_ALLOWED_USERS: etradeAllowedUsers
+      },
+      FOUNDATION_INSTANCE: props.instance.name,
+      FOUNDATION_COMMAND_PREFIXES: slackCommandPrefixes(props.instance).join(","),
+      FOUNDATION_PROACTIVE_CHANNELS: props.instance.proactive.channels.join(","),
+      FOUNDATION_PROACTIVE_MAX_PER_HOUR: String(props.instance.proactive.maxPerHour),
+      ...jobsWebhookSecret === undefined ? {} : {
+        FOUNDATION_WEBHOOK_JOBS: JSON.stringify(webhookJobs),
+        FOUNDATION_JOBS_WEBHOOK_SECRET_ID: jobsWebhookSecret.secretName
+      },
+      FOUNDATION_SCHEDULED_JOB_BINDINGS: JSON.stringify(scheduledJobs)
+    };
+    assertLambdaEnvironmentBudget(gatewayEnvironment);
     const gatewayFunction = new lambda.Function(this, "GatewayFunction", {
       ...authenticatedQueue ? { functionName: names.slackGatewayFunctionName } : {},
       runtime: lambda.Runtime.NODEJS_22_X,
@@ -754,32 +892,7 @@ class FoundationApi extends cdk2.Stack {
       timeout: cdk2.Duration.seconds(10),
       memorySize: 256,
       deadLetterQueue: this.gatewayDlq,
-      environment: {
-        FOUNDATION_TABLE_NAME: props.table.tableName,
-        FOUNDATION_INVOKE_QUEUE_URL: this.invokeQueue.queueUrl,
-        FOUNDATION_GATEWAY_DLQ_URL: this.gatewayDlq.queueUrl,
-        FOUNDATION_SLACK_SIGNING_SECRET_ID: props.secrets.signing.secretName,
-        FOUNDATION_SLACK_APP_SECRET_ID: props.secrets.slackApp.secretName,
-        FOUNDATION_ADMINS: props.admins,
-        FOUNDATION_AGENT_RUNTIME_ARN: props.agentRuntimeArn,
-        FOUNDATION_DISPLAY_NAME: props.instance.displayName,
-        FOUNDATION_ITEMS_TABLE_NAME: props.itemsTable.tableName,
-        FOUNDATION_GOOGLE_CALENDAR_SECRET_ID: props.secrets.googleCalendar.secretName,
-        FOUNDATION_GOOGLE_OAUTH_SECRET_ID: props.secrets.googleOauth.secretName,
-        FOUNDATION_GOOGLE_DRIVE_SECRET_ID: props.secrets.googleDrive.secretName,
-        FOUNDATION_GOOGLE_EMAIL_SECRET_ID: props.secrets.googleEmail.secretName,
-        ...props.secrets.knockOauthClient === undefined ? {} : { FOUNDATION_KNOCK_OAUTH_CLIENT_SECRET_ID: props.secrets.knockOauthClient.secretName },
-        ...props.secrets.knockCredential === undefined ? {} : { FOUNDATION_KNOCK_CREDENTIAL_SECRET_ID: props.secrets.knockCredential.secretName },
-        ...upworkSecret === undefined ? {} : { FOUNDATION_UPWORK_SECRET_ID: upworkSecret.secretName },
-        FOUNDATION_INSTANCE: props.instance.name,
-        FOUNDATION_COMMAND_PREFIXES: slackCommandPrefixes(props.instance).join(","),
-        FOUNDATION_PROACTIVE_CHANNELS: props.instance.proactive.channels.join(","),
-        FOUNDATION_PROACTIVE_MAX_PER_HOUR: String(props.instance.proactive.maxPerHour),
-        ...jobsWebhookSecret === undefined ? {} : {
-          FOUNDATION_WEBHOOK_JOBS: JSON.stringify(webhookJobs),
-          FOUNDATION_JOBS_WEBHOOK_SECRET_ID: jobsWebhookSecret.secretName
-        }
-      }
+      environment: gatewayEnvironment
     });
     gatewayFunction.configureAsyncInvoke({
       retryAttempts: 0,
@@ -1103,6 +1216,51 @@ class FoundationApi extends cdk2.Stack {
         value: this.upworkProxyFunction.functionArn
       });
     }
+    if (etradeClientSecret !== undefined && etradeCredentialSecret !== undefined && etrade !== undefined) {
+      const etradeProxyRole = new iam2.Role(this, "EtradeProxyRole", {
+        assumedBy: new iam2.ServicePrincipal("lambda.amazonaws.com"),
+        description: `${display} E*TRADE fixed read-only proxy Lambda`,
+        managedPolicies: [
+          iam2.ManagedPolicy.fromAwsManagedPolicyName("service-role/AWSLambdaBasicExecutionRole")
+        ]
+      });
+      etradeProxyRole.addToPolicy(new iam2.PolicyStatement({
+        sid: "EtradeProxyOAuthSecrets",
+        actions: ["secretsmanager:GetSecretValue"],
+        resources: [
+          secretArnPattern2(etradeClientSecret),
+          secretArnPattern2(etradeCredentialSecret)
+        ]
+      }));
+      etradeProxyRole.addToPolicy(new iam2.PolicyStatement({
+        sid: "EtradeProxySigningSecret",
+        actions: ["secretsmanager:GetSecretValue"],
+        resources: [secretArnPattern2(props.secrets.signing)]
+      }));
+      const etradeProxyEnvironment = {
+        FOUNDATION_ETRADE_CLIENT_SECRET_ID: etradeClientSecret.secretName,
+        FOUNDATION_ETRADE_CREDENTIAL_SECRET_ID: etradeCredentialSecret.secretName,
+        FOUNDATION_SLACK_SIGNING_SECRET_ID: props.secrets.signing.secretName,
+        FOUNDATION_SLACK_TEAM_ID: props.instance.slack.teamId,
+        FOUNDATION_ETRADE_ALLOWED_CHANNELS: JSON.stringify(etrade.channels),
+        FOUNDATION_ETRADE_ALLOWED_USERS: JSON.stringify(etrade.users),
+        FOUNDATION_ADMINS: props.admins
+      };
+      assertLambdaEnvironmentBudget(etradeProxyEnvironment);
+      this.etradeProxyFunction = new lambda.Function(this, "EtradeProxyFunction", {
+        functionName: names.etradeProxyFunctionName,
+        runtime: lambda.Runtime.NODEJS_22_X,
+        handler: "index.handler",
+        code: lambdaCode(this, "etrade-proxy"),
+        role: etradeProxyRole,
+        timeout: cdk2.Duration.seconds(30),
+        memorySize: 256,
+        environment: etradeProxyEnvironment
+      });
+      new cdk2.CfnOutput(this, "EtradeProxyFunctionArn", {
+        value: this.etradeProxyFunction.functionArn
+      });
+    }
     if (provisionsIntegration(props.instance, "crm")) {
       const crm = crmConfigForProvisioning(props.configPath);
       const crmTable = props.crmTable;
@@ -1129,7 +1287,8 @@ class FoundationApi extends cdk2.Stack {
           "dynamodb:DeleteItem",
           "dynamodb:BatchGetItem",
           "dynamodb:BatchWriteItem",
-          "dynamodb:TransactWriteItems"
+          "dynamodb:TransactWriteItems",
+          "dynamodb:ConditionCheckItem"
         ],
         resources: [crmTable.tableArn]
       }));
@@ -1138,6 +1297,11 @@ class FoundationApi extends cdk2.Stack {
         actions: ["dynamodb:Query"],
         resources: [crmTable.tableArn, `${crmTable.tableArn}/index/RecordsIndex`]
       }));
+      crmProxyRole.addToPolicy(new iam2.PolicyStatement({
+        sid: "CrmTableKey",
+        actions: ["kms:Decrypt", "kms:Encrypt", "kms:GenerateDataKey", "kms:DescribeKey"],
+        resources: [(crmTable.encryptionKey ?? props.dataKey).keyArn]
+      }));
       this.crmProxyFunction = new lambda.Function(this, "CrmProxyFunction", {
         functionName: names.crmProxyFunctionName,
         runtime: lambda.Runtime.NODEJS_22_X,
@@ -1196,6 +1360,69 @@ class FoundationApi extends cdk2.Stack {
       });
       alarm.addAlarmAction(alarmAction);
     }
+    if (configuredScheduledJobs.length > 0) {
+      const dispatchRole = new iam2.Role(this, "ScheduledJobDispatcherRole", {
+        assumedBy: new iam2.ServicePrincipal("lambda.amazonaws.com"),
+        description: `${display} deployment-owned scheduled job dispatcher`,
+        managedPolicies: [
+          iam2.ManagedPolicy.fromAwsManagedPolicyName("service-role/AWSLambdaBasicExecutionRole")
+        ]
+      });
+      props.secrets.signing.grantRead(dispatchRole);
+      gatewayFunction.grantInvoke(dispatchRole);
+      const dispatchFunction = new lambda.Function(this, "ScheduledJobDispatcherFunction", {
+        runtime: lambda.Runtime.NODEJS_22_X,
+        handler: "index.scheduledJobDispatcherHandler",
+        code: lambdaCode(this, "gateway"),
+        role: dispatchRole,
+        timeout: cdk2.Duration.seconds(30),
+        memorySize: 128,
+        deadLetterQueue: this.gatewayDlq,
+        environment: {
+          FOUNDATION_SLACK_SIGNING_SECRET_ID: props.secrets.signing.secretName,
+          FOUNDATION_GATEWAY_FUNCTION_NAME: gatewayFunction.functionName
+        }
+      });
+      dispatchFunction.configureAsyncInvoke({
+        retryAttempts: 0,
+        maxEventAge: cdk2.Duration.minutes(15)
+      });
+      const jobGroup = new scheduler.CfnScheduleGroup(this, "ScheduledJobGroup");
+      const jobSchedulerRole = new iam2.Role(this, "ScheduledJobSchedulerRole", {
+        assumedBy: new iam2.ServicePrincipal("scheduler.amazonaws.com", {
+          conditions: { StringEquals: { "aws:SourceAccount": this.account } }
+        }),
+        description: `${display} deployment-owned scheduled job invoker`
+      });
+      dispatchFunction.grantInvoke(jobSchedulerRole);
+      for (const job of configuredScheduledJobs) {
+        const parsed = parseSchedule(job.on.schedule);
+        if (!parsed.ok)
+          throw new Error(`Scheduled job ${job.id} has an invalid schedule`);
+        const schedule = new scheduler.CfnSchedule(this, `ScheduledJob-${job.id}`, {
+          groupName: jobGroup.ref,
+          scheduleExpression: job.on.schedule,
+          scheduleExpressionTimezone: scheduledJobTimezone,
+          flexibleTimeWindow: { mode: "OFF" },
+          ...parsed.kind === "at" ? { actionAfterCompletion: "DELETE" } : {},
+          target: {
+            arn: dispatchFunction.functionArn,
+            roleArn: jobSchedulerRole.roleArn,
+            input: JSON.stringify({
+              internal: "scheduled_job",
+              routineId: `job-${job.id}`,
+              name: job.name,
+              channel: job.channel,
+              prompt: job.prompt,
+              createdBy: JOB_ACTOR,
+              scheduledTime: "<aws.scheduler.scheduled-time>"
+            }),
+            retryPolicy: { maximumEventAgeInSeconds: 900, maximumRetryAttempts: 0 }
+          }
+        });
+        schedule.addResourceDependency(jobGroup);
+      }
+    }
     new scheduler.CfnScheduleGroup(this, "RoutineGroup", { name: names.routineGroup });
     const schedulerRole = new iam2.Role(this, "RoutineSchedulerRole", {
       roleName: names.routineSchedulerRole,
@@ -1278,6 +1505,33 @@ function upworkConfigForProvisioning(configPath) {
     throw new Error(`${configPath}: integrations.upwork requires a configured Upwork capability (${missing.join(", ")})`);
   return { channels: [...upwork.channels] };
 }
+function etradeConfigForProvisioning(configPath) {
+  const config = parseInstanceConfig(readFileSync(configPath, "utf8"));
+  const etrade = config.capabilities.etrade;
+  const missing = [
+    ...etrade.enabled ? [] : ["capabilities.etrade.enabled"],
+    ...etrade.channels.length > 0 ? [] : ["capabilities.etrade.channels"],
+    ...etrade.users.length > 0 ? [] : ["capabilities.etrade.users"]
+  ];
+  if (missing.length > 0)
+    throw new Error(`${configPath}: integrations.etrade requires a configured E*TRADE capability (${missing.join(", ")})`);
+  const seenAdmins = new Set;
+  const invalidAdmins = config.admins.filter((admin) => {
+    const invalid = !/^[UW][A-Z0-9]{8,}$/.test(admin) || admin.length > 128 || seenAdmins.has(admin);
+    seenAdmins.add(admin);
+    return invalid;
+  });
+  if (invalidAdmins.length > 0) {
+    throw new Error(`${configPath}: an E*TRADE deployment requires unique valid Slack user ids in admins`);
+  }
+  const nonAdmins = etrade.users.filter((user) => !config.admins.includes(user));
+  if (nonAdmins.length > 0)
+    throw new Error(`${configPath}: capabilities.etrade.users must be instance admins (${nonAdmins.join(", ")})`);
+  return { channels: [...etrade.channels], users: [...etrade.users] };
+}
+function configTimezoneFor(configPath) {
+  return parseInstanceConfig(readFileSync(configPath, "utf8")).timezone;
+}
 function emailIdentitiesFor(configPath) {
   const doc = parseYaml(readFileSync(configPath, "utf8"));
   const email = doc.capabilities?.email;
@@ -1294,6 +1548,27 @@ function webhookJobsFor(configPath) {
   }
   return jobs;
 }
+var LAMBDA_ENVIRONMENT_MAX_BYTES = 4096;
+var LAMBDA_ENVIRONMENT_TOKEN_BYTES = 128;
+function assertLambdaEnvironmentBudget(values) {
+  let bytes = 2;
+  for (const [key, value] of Object.entries(values)) {
+    bytes += Buffer.byteLength(key) + 3;
+    bytes += cdk2.Token.isUnresolved(value) ? LAMBDA_ENVIRONMENT_TOKEN_BYTES : Buffer.byteLength(value);
+  }
+  if (bytes > LAMBDA_ENVIRONMENT_MAX_BYTES) {
+    throw new Error(`Gateway Lambda environment needs an estimated ${bytes} bytes; the AWS limit is ${LAMBDA_ENVIRONMENT_MAX_BYTES}. Shorten job prompts or reduce configured values.`);
+  }
+}
+function scheduledJobsFor(configPath) {
+  const jobs = parseInstanceConfig(readFileSync(configPath, "utf8")).jobs.filter(isScheduledJob);
+  for (const job of jobs) {
+    const parsed = parseSchedule(job.on.schedule);
+    if (!parsed.ok)
+      throw new Error(`Scheduled job ${job.id} has an invalid schedule: ${parsed.reason}`);
+  }
+  return jobs;
+}
 function browserDomainsFor(configPath) {
   const browser = parseInstanceConfig(readFileSync(configPath, "utf8")).capabilities.browser;
   return browser.enabled && browser.mode === "read" ? [...browser.allowedDomains] : [];
@@ -1457,6 +1732,7 @@ class FoundationData extends cdk4.Stack {
   itemsTable;
   crmTable;
   upworkApprovalTable;
+  etradePendingTable;
   secrets;
   constructor(scope, id, props) {
     super(scope, id, props);
@@ -1531,6 +1807,14 @@ class FoundationData extends cdk4.Stack {
       pointInTimeRecoverySpecification: { pointInTimeRecoveryEnabled: true },
       removalPolicy: cdk4.RemovalPolicy.DESTROY
     }) : undefined;
+    this.etradePendingTable = provisionsIntegration(props.instance, "etrade") ? new dynamodb.Table(this, "EtradeOAuthPendingTable", {
+      partitionKey: { name: "pk", type: dynamodb.AttributeType.STRING },
+      timeToLiveAttribute: "ttl",
+      billingMode: dynamodb.BillingMode.PAY_PER_REQUEST,
+      encryption: dynamodb.TableEncryption.CUSTOMER_MANAGED,
+      encryptionKey: this.dataKey,
+      removalPolicy: cdk4.RemovalPolicy.DESTROY
+    }) : undefined;
     const secretShell = (constructId, name, description) => new secretsmanager2.Secret(this, constructId, {
       secretName: name,
       description,
@@ -1568,6 +1852,24 @@ class FoundationData extends cdk4.Stack {
       }
     }) : undefined;
     const upwork = provisionsIntegration(props.instance, "upwork") ? secretShell("UpworkSecret", names.secretUpwork, `Upwork OAuth client and token store for ${display} ({ client_id, client_secret, access_token?, refresh_token?, expires_at?, tenant_id? })`) : undefined;
+    const etradeClient = provisionsIntegration(props.instance, "etrade") ? new secretsmanager2.Secret(this, "EtradeClientSecret", {
+      secretName: names.secretEtradeClient,
+      description: `E*TRADE OAuth consumer for ${display} ({ consumer_key, consumer_secret, environment })`,
+      removalPolicy: cdk4.RemovalPolicy.DESTROY,
+      generateSecretString: {
+        secretStringTemplate: "{}",
+        generateStringKey: "placeholder"
+      }
+    }) : undefined;
+    const etradeCredential = provisionsIntegration(props.instance, "etrade") ? new secretsmanager2.Secret(this, "EtradeCredentialSecret", {
+      secretName: names.secretEtradeCredential,
+      description: `E*TRADE access token for ${display} ({ oauth_token, oauth_token_secret }); gateway writes and fixed read proxy alone reads`,
+      removalPolicy: cdk4.RemovalPolicy.DESTROY,
+      generateSecretString: {
+        secretStringTemplate: "{}",
+        generateStringKey: "placeholder"
+      }
+    }) : undefined;
     this.secrets = {
       signing: secretsmanager2.Secret.fromSecretNameV2(this, "SlackSigningSecret", names.secretSlackSigning),
       slackApp: secretsmanager2.Secret.fromSecretNameV2(this, "SlackAppSecret", names.secretSlackApp),
@@ -1609,6 +1911,8 @@ class FoundationData extends cdk4.Stack {
       ...knockOauthClient === undefined ? {} : { knockOauthClient },
       ...knockCredential === undefined ? {} : { knockCredential },
       ...upwork === undefined ? {} : { upwork },
+      ...etradeClient === undefined ? {} : { etradeClient },
+      ...etradeCredential === undefined ? {} : { etradeCredential },
       googleOauth: secretShell("GoogleOauthSecret", names.secretGoogleOauth, `Google OAuth client shared by ${display}'s Google capabilities ({ client_id, client_secret, redirect_uri })`),
       runtime: secretShell("RuntimeSecret", names.secretRuntime, "Agent runtime env map, written by scripts/setup.ts after deploy")
     };

package/dist/src/index.js

@@ -9,7 +9,7 @@ import {
   FoundationPipeline,
   NewsletterStack,
   deployStatements
-} from "../chunk-paf33z2h.js";
+} from "../chunk-my0awr1g.js";
 import {
   BUN_VERSION,
   LAMBDA_ENTRY_POINTS,
@@ -42,7 +42,7 @@ import {
   skillsKey,
   skipBundle,
   verifyManifest
-} from "../chunk-gcg67ck3.js";
+} from "../chunk-kf1yvx1w.js";
 export {
   BUILD_TIMEOUT,
   BUN_VERSION,

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@deployfoundation/foundation-deploy",
-  "version": "0.2.1",
+  "version": "0.2.3",
   "description": "Deploys one Foundation instance from a published, signed release: the CDK app and the deploy tool.",
   "license": "UNLICENSED",
   "private": false,

package/src/artifacts.ts

@@ -65,6 +65,7 @@ export const LAMBDA_ENTRY_POINTS = {
   "knock-proxy": { entry: "packages/capability-knock/src/proxy/handler.ts" },
   "crm-proxy": { entry: "packages/capability-crm/src/proxy/handler.ts" },
   "upwork-proxy": { entry: "packages/capability-upwork/src/proxy/handler.ts" },
+  "etrade-proxy": { entry: "packages/capability-etrade/src/proxy/handler.ts" },
   "browser-proxy": { entry: "packages/gateway/src/browser-proxy.ts", playwright: true },
   "newsletter-public": { entry: "packages/newsletter/src/lambda-public.ts" },
   "newsletter-campaign": { entry: "packages/newsletter/src/lambda-campaign.ts" },

package/src/deploy/assets/slack-app-manifest.yml

@@ -78,6 +78,12 @@ features:
       url: ${COMMANDS_REQUEST_URL}
       description: Connect the Upwork account ${DISPLAY_NAME} uses (admins)
       should_escape: false
+    # Admins only: E*TRADE OAuth completes with an out-of-band verifier in
+    # the configured private channel; financial credentials never enter Slack.
+    - command: /${COMMAND_PREFIX}-etrade-connect
+      url: ${COMMANDS_REQUEST_URL}
+      description: Connect ${DISPLAY_NAME} to E*TRADE read-only tools (admins)
+      should_escape: false
 
 # oauth_config.scopes.bot and settings.event_subscriptions.bot_events are
 # GENERATED from the capability registry by `slack-manifest.ts`

package/src/deploy/deploy.ts

@@ -369,6 +369,11 @@ export async function syncRuntimeSecret(ctx: AwsContext): Promise<string[]> {
       ? `<${api}.UpworkProxyFunctionArn>`
       : await optionalOutput(ctx, api, "UpworkProxyFunctionArn")
     : undefined;
+  const etradeProxyFunctionArn = ctx.instance.integrations.etrade
+    ? dry
+      ? `<${api}.EtradeProxyFunctionArn>`
+      : await optionalOutput(ctx, api, "EtradeProxyFunctionArn")
+    : undefined;
   const routineIngressFunctionArn = dry
     ? `<${api}.RoutineIngressFunctionArn>`
     : await optionalOutput(ctx, api, "RoutineIngressFunctionArn");
@@ -398,6 +403,7 @@ export async function syncRuntimeSecret(ctx: AwsContext): Promise<string[]> {
     ...(otterProxyFunctionArn === undefined ? {} : { otterProxyFunctionArn }),
     ...(knockProxyFunctionArn === undefined ? {} : { knockProxyFunctionArn }),
     ...(upworkProxyFunctionArn === undefined ? {} : { upworkProxyFunctionArn }),
+    ...(etradeProxyFunctionArn === undefined ? {} : { etradeProxyFunctionArn }),
     ...(routineIngressFunctionArn === undefined ? {} : { routineIngressFunctionArn }),
   });
   await putSecretJson(ctx, secretRuntime, value);

package/src/deploy/runtime-secret.ts

@@ -92,6 +92,12 @@ export interface RuntimeSecretInputs {
    * shell-capable container. OAuth client and token state stay in the proxy.
    */
   upworkProxyFunctionArn?: string;
+  /**
+   * `FoundationApi.EtradeProxyFunctionArn` — the agent's sole E*TRADE binding.
+   * Consumer/access credentials and OOB pending-state identifiers never enter
+   * this runtime secret.
+   */
+  etradeProxyFunctionArn?: string;
   /** Trusted gateway ingress used instead of granting the agent normal-queue writes. */
   routineIngressFunctionArn?: string;
   defaultRepo?: string;
@@ -220,6 +226,9 @@ export function composeRuntimeSecret(inputs: RuntimeSecretInputs): Record<string
     ...(inputs.upworkProxyFunctionArn !== undefined && inputs.upworkProxyFunctionArn !== ""
       ? { FOUNDATION_UPWORK_PROXY_ARN: inputs.upworkProxyFunctionArn }
       : {}),
+    ...(inputs.etradeProxyFunctionArn !== undefined && inputs.etradeProxyFunctionArn !== ""
+      ? { FOUNDATION_ETRADE_PROXY_ARN: inputs.etradeProxyFunctionArn }
+      : {}),
     ...(inputs.routineIngressFunctionArn !== undefined && inputs.routineIngressFunctionArn !== ""
       ? { FOUNDATION_ROUTINE_INGRESS_FUNCTION_ARN: inputs.routineIngressFunctionArn }
       : {}),
@@ -227,9 +236,9 @@ export function composeRuntimeSecret(inputs: RuntimeSecretInputs): Record<string
     // LAZILY, so a secret still holding the CDK placeholder costs nothing
     // until someone asks a MongoDB question.
     FOUNDATION_MONGODB_SECRET_ID: names.secretMongodbReadonly,
-    // CRM storage, the Otter credential, the Knock OAuth secrets, and the Upwork
-    // OAuth secret are intentionally absent here: the shell-capable agent receives
-    // only their fixed proxy ARNs.
+    // CRM storage, the Otter credential, the Knock OAuth secrets, and the
+    // Upwork/E*TRADE OAuth secrets are intentionally absent here: the
+    // shell-capable agent receives only their fixed proxy ARNs.
     // A routine fire builds its own session key, so the container needs the
     // team id the gateway takes from the event. The app secret carries it
     // when setup wrote one; the instance file is the fallback.