@deployfoundation/foundation-deploy 0.2.1 → 0.2.3

package/src/stacks/agent-stack.ts

@@ -39,6 +39,8 @@ export interface FoundationAgentProps extends cdk.StackProps {
   crmTable?: dynamodb.ITable;
   /** Proxy-only proposal drafts; explicitly denied to every agent-assumable role. */
   upworkApprovalTable?: dynamodb.ITable;
+  /** Gateway-only E*TRADE OOB state; explicitly denied to every agent-assumable role. */
+  etradePendingTable?: dynamodb.ITable;
   secrets: {
     runtime: secretsmanager.ISecret;
     codex: secretsmanager.ISecret;
@@ -404,6 +406,45 @@ export class FoundationAgent extends cdk.Stack {
     );
   }
 
+  /**
+   * Both roles are shell-reachable. Deny the stable retained secret names even
+   * while the integration is disabled, so an opt-out cannot expose orphaned
+   * OAuth material through the account's broad read-only role.
+   */
+  private denyDirectEtradeAccess(role: iam.Role, props: FoundationAgentProps): void {
+    const retainedSecretArn = (name: string): string =>
+      cdk.Stack.of(this).formatArn({
+        service: "secretsmanager",
+        resource: "secret",
+        resourceName: `${name}-??????`,
+        arnFormat: cdk.ArnFormat.COLON_RESOURCE_NAME,
+      });
+    role.addToPolicy(
+      new iam.PolicyStatement({
+        sid: "DenyEtradeSecrets",
+        effect: iam.Effect.DENY,
+        actions: ["secretsmanager:*"],
+        resources: [
+          retainedSecretArn(this.names.secretEtradeClient),
+          retainedSecretArn(this.names.secretEtradeCredential),
+        ],
+      }),
+    );
+    if (!provisionsIntegration(props.instance, "etrade")) return;
+    const pending = props.etradePendingTable;
+    if (pending === undefined)
+      throw new Error(
+        `${this.stackName}: integrations.etrade is enabled but FoundationData supplied no E*TRADE pending-state table`,
+      );
+    role.addToPolicy(
+      new iam.PolicyStatement({
+        sid: "DenyEtradePendingState",
+        effect: iam.Effect.DENY,
+        actions: ["dynamodb:*"],
+        resources: [pending.tableArn, `${pending.tableArn}/index/*`],
+      }),
+    );
+  }
   /**
    * `<Prefix>ReadOnlyRole` — how the agent reads its OWN account.
    *
@@ -431,6 +472,7 @@ export class FoundationAgent extends cdk.Stack {
     this.denyDirectCrmTableAccess(role, props.instance, props.crmTable);
     this.denyDirectKnockSecretAccess(role, props);
     this.denyDirectUpworkApprovalAccess(role, props.upworkApprovalTable);
+    this.denyDirectEtradeAccess(role, props);
     role.addToPolicy(
       new iam.PolicyStatement({
         sid: "DenyAgentCoreBrowserMetadata",
@@ -480,6 +522,7 @@ export class FoundationAgent extends cdk.Stack {
     this.denyDirectCrmTableAccess(role, props.instance, props.crmTable);
     this.denyDirectKnockSecretAccess(role, props);
     this.denyDirectUpworkApprovalAccess(role, props.upworkApprovalTable);
+    this.denyDirectEtradeAccess(role, props);
 
     // Foundation's own repository when a release names the image, because the
     // runtime then pulls across accounts. The pull also needs Foundation's
@@ -721,6 +764,24 @@ export class FoundationAgent extends cdk.Stack {
         }),
       );
     }
+    if (provisionsIntegration(props.instance, "etrade")) {
+      // The entire financial-data surface is one fixed-operation Lambda. The
+      // explicit deny installed above prevents direct secret or pending-flow access.
+      role.addToPolicy(
+        new iam.PolicyStatement({
+          sid: "EtradeProxyInvoke",
+          actions: ["lambda:InvokeFunction"],
+          resources: [
+            cdk.Stack.of(this).formatArn({
+              service: "lambda",
+              resource: "function",
+              resourceName: this.names.etradeProxyFunctionName,
+              arnFormat: cdk.ArnFormat.COLON_RESOURCE_NAME,
+            }),
+          ],
+        }),
+      );
+    }
     if (provisionsIntegration(props.instance, "crm")) {
       // The CRM permission surface is one named proxy Lambda. Derive the ARN
       // locally so FoundationAgent never depends on FoundationApi's output and closes a
@@ -857,6 +918,13 @@ export class FoundationAgent extends cdk.Stack {
         ],
       }),
     );
+    role.addToPolicy(
+      new iam.PolicyStatement({
+        sid: "RoutineScheduleList",
+        actions: ["scheduler:ListSchedules"],
+        resources: ["*"],
+      }),
+    );
     role.addToPolicy(
       new iam.PolicyStatement({
         sid: "PassRoutineSchedulerRole",

package/src/stacks/api-stack.ts

@@ -1,13 +1,19 @@
 import { readFileSync } from "node:fs";
 import {
   type CrmOutreachConfig,
+  type ScheduledJobBinding,
+  type ScheduledJobConfig,
   type WebhookJobBinding,
   crmOutreachConfigured,
   crmPolicyFingerprint,
+  isScheduledJob,
   parseInstanceConfig,
+  scheduledJobBindings,
   webhookJobBindings,
 } from "@deployfoundation/foundation-core";
+import { JOB_ACTOR } from "@deployfoundation/foundation-core/actor-capability";
 import { slackCommandPrefixes } from "@deployfoundation/foundation-core/instance";
+import { parseSchedule } from "@deployfoundation/foundation-core/schedule";
 import * as cdk from "aws-cdk-lib";
 import * as apigateway from "aws-cdk-lib/aws-apigateway";
 import * as cloudwatch from "aws-cdk-lib/aws-cloudwatch";
@@ -50,6 +56,8 @@ export interface FoundationApiProps extends cdk.StackProps {
   crmTable?: dynamodb.ITable;
   /** Proxy-only one-hour proposal drafts; never granted to the agent runtime. */
   upworkApprovalTable?: dynamodb.ITable;
+  /** Gateway-only OOB E*TRADE request-token state, present with the integration. */
+  etradePendingTable?: dynamodb.ITable;
   secrets: {
     signing: secretsmanager.ISecret;
     slackApp: secretsmanager.ISecret;
@@ -68,6 +76,10 @@ export interface FoundationApiProps extends cdk.StackProps {
     knockCredential?: secretsmanager.ISecret;
     /** Combined Upwork OAuth client and token secret, present only for opted-in instances. */
     upwork?: secretsmanager.ISecret;
+    /** E*TRADE OAuth consumer; gateway reads it but the agent never can. */
+    etradeClient?: secretsmanager.ISecret;
+    /** Connected E*TRADE credential; gateway writes and fixed read proxy alone reads. */
+    etradeCredential?: secretsmanager.ISecret;
   };
   /**
    * The AgentCore runtime the invoker calls. On a phase-one deploy this is
@@ -113,6 +125,8 @@ export class FoundationApi extends cdk.Stack {
   public readonly knockProxyFunction?: lambda.Function;
   /** Fixed-operation Upwork proxy, present only when the instance opts in. */
   public readonly upworkProxyFunction?: lambda.Function;
+  /** Fixed-operation E*TRADE read proxy, present only for opted-in instances. */
+  public readonly etradeProxyFunction?: lambda.Function;
 
   constructor(scope: Construct, id: string, props: FoundationApiProps) {
     super(scope, id, props);
@@ -127,7 +141,28 @@ export class FoundationApi extends cdk.Stack {
       throw new Error(
         `${id}: integrations.upwork is enabled but its secret or approval table was not supplied by FoundationData`,
       );
+    const etrade = provisionsIntegration(props.instance, "etrade")
+      ? etradeConfigForProvisioning(props.configPath)
+      : undefined;
+    const etradeClientSecret = etrade === undefined ? undefined : props.secrets.etradeClient;
+    const etradeCredentialSecret =
+      etrade === undefined ? undefined : props.secrets.etradeCredential;
+    const etradePendingTable = etrade === undefined ? undefined : props.etradePendingTable;
+    if (
+      etrade !== undefined &&
+      (etradeClientSecret === undefined ||
+        etradeCredentialSecret === undefined ||
+        etradePendingTable === undefined)
+    )
+      throw new Error(
+        `${id}: integrations.etrade is enabled but its client secret, credential secret, or pending OAuth table was not supplied by FoundationData`,
+      );
     const authenticatedQueue = requiresAuthenticatedQueue(props.instance);
+    const configuredScheduledJobs = scheduledJobsFor(props.configPath);
+    const scheduledJobs = scheduledJobBindings(configuredScheduledJobs);
+    const scheduledJobTimezone = configTimezoneFor(props.configPath);
+    const etradeAllowedChannels = etrade === undefined ? "" : JSON.stringify(etrade.channels);
+    const etradeAllowedUsers = etrade === undefined ? "" : JSON.stringify(etrade.users);
 
     this.gatewayDlq = new sqs.Queue(this, "GatewayDlq", {
       encryption: sqs.QueueEncryption.KMS,
@@ -227,6 +262,50 @@ export class FoundationApi extends cdk.Stack {
         }),
       );
     }
+    if (
+      etradeClientSecret !== undefined &&
+      etradeCredentialSecret !== undefined &&
+      etradePendingTable !== undefined
+    ) {
+      gatewayRole.addToPolicy(
+        new iam.PolicyStatement({
+          sid: "EtradeOAuthClientRead",
+          actions: ["secretsmanager:GetSecretValue"],
+          resources: [secretArnPattern(etradeClientSecret)],
+        }),
+      );
+      gatewayRole.addToPolicy(
+        new iam.PolicyStatement({
+          sid: "EtradeOAuthCredentialWrite",
+          actions: [
+            "secretsmanager:DescribeSecret",
+            "secretsmanager:PutSecretValue",
+            "secretsmanager:UpdateSecretVersionStage",
+          ],
+          resources: [secretArnPattern(etradeCredentialSecret)],
+        }),
+      );
+      gatewayRole.addToPolicy(
+        new iam.PolicyStatement({
+          sid: "DenyEtradeOAuthCredentialRead",
+          effect: iam.Effect.DENY,
+          actions: ["secretsmanager:GetSecretValue", "secretsmanager:BatchGetSecretValue"],
+          resources: [secretArnPattern(etradeCredentialSecret)],
+        }),
+      );
+      gatewayRole.addToPolicy(
+        new iam.PolicyStatement({
+          sid: "EtradeOAuthPendingState",
+          actions: [
+            "dynamodb:GetItem",
+            "dynamodb:PutItem",
+            "dynamodb:UpdateItem",
+            "dynamodb:DeleteItem",
+          ],
+          resources: [etradePendingTable.tableArn],
+        }),
+      );
+    }
     gatewayRole.addToPolicy(
       new iam.PolicyStatement({
         sid: "DedupeAndThreadIndex",
@@ -286,6 +365,54 @@ export class FoundationApi extends cdk.Stack {
           });
     if (jobsWebhookSecret !== undefined) jobsWebhookSecret.grantRead(gatewayRole);
 
+    const gatewayEnvironment: Record<string, string> = {
+      FOUNDATION_TABLE_NAME: props.table.tableName,
+      FOUNDATION_INVOKE_QUEUE_URL: this.invokeQueue.queueUrl,
+      FOUNDATION_GATEWAY_DLQ_URL: this.gatewayDlq.queueUrl,
+      FOUNDATION_SLACK_SIGNING_SECRET_ID: props.secrets.signing.secretName,
+      FOUNDATION_SLACK_APP_SECRET_ID: props.secrets.slackApp.secretName,
+      FOUNDATION_ADMINS: props.admins,
+      FOUNDATION_AGENT_RUNTIME_ARN: props.agentRuntimeArn,
+      FOUNDATION_DISPLAY_NAME: props.instance.displayName,
+      FOUNDATION_ITEMS_TABLE_NAME: props.itemsTable.tableName,
+      FOUNDATION_GOOGLE_CALENDAR_SECRET_ID: props.secrets.googleCalendar.secretName,
+      FOUNDATION_GOOGLE_OAUTH_SECRET_ID: props.secrets.googleOauth.secretName,
+      FOUNDATION_GOOGLE_DRIVE_SECRET_ID: props.secrets.googleDrive.secretName,
+      FOUNDATION_GOOGLE_EMAIL_SECRET_ID: props.secrets.googleEmail.secretName,
+      ...(props.secrets.knockOauthClient === undefined
+        ? {}
+        : { FOUNDATION_KNOCK_OAUTH_CLIENT_SECRET_ID: props.secrets.knockOauthClient.secretName }),
+      ...(props.secrets.knockCredential === undefined
+        ? {}
+        : { FOUNDATION_KNOCK_CREDENTIAL_SECRET_ID: props.secrets.knockCredential.secretName }),
+      ...(upworkSecret === undefined
+        ? {}
+        : { FOUNDATION_UPWORK_SECRET_ID: upworkSecret.secretName }),
+      ...(etradeClientSecret === undefined ||
+      etradeCredentialSecret === undefined ||
+      etradePendingTable === undefined ||
+      etrade === undefined
+        ? {}
+        : {
+            FOUNDATION_ETRADE_CLIENT_SECRET_ID: etradeClientSecret.secretName,
+            FOUNDATION_ETRADE_CREDENTIAL_SECRET_ID: etradeCredentialSecret.secretName,
+            FOUNDATION_ETRADE_PENDING_TABLE_NAME: etradePendingTable.tableName,
+            FOUNDATION_ETRADE_ALLOWED_CHANNELS: etradeAllowedChannels,
+            FOUNDATION_ETRADE_ALLOWED_USERS: etradeAllowedUsers,
+          }),
+      FOUNDATION_INSTANCE: props.instance.name,
+      FOUNDATION_COMMAND_PREFIXES: slackCommandPrefixes(props.instance).join(","),
+      FOUNDATION_PROACTIVE_CHANNELS: props.instance.proactive.channels.join(","),
+      FOUNDATION_PROACTIVE_MAX_PER_HOUR: String(props.instance.proactive.maxPerHour),
+      ...(jobsWebhookSecret === undefined
+        ? {}
+        : {
+            FOUNDATION_WEBHOOK_JOBS: JSON.stringify(webhookJobs),
+            FOUNDATION_JOBS_WEBHOOK_SECRET_ID: jobsWebhookSecret.secretName,
+          }),
+      FOUNDATION_SCHEDULED_JOB_BINDINGS: JSON.stringify(scheduledJobs),
+    };
+    assertLambdaEnvironmentBudget(gatewayEnvironment);
     const gatewayFunction = new lambda.Function(this, "GatewayFunction", {
       ...(authenticatedQueue ? { functionName: names.slackGatewayFunctionName } : {}),
       runtime: lambda.Runtime.NODEJS_22_X,
@@ -295,54 +422,7 @@ export class FoundationApi extends cdk.Stack {
       timeout: cdk.Duration.seconds(10),
       memorySize: 256,
       deadLetterQueue: this.gatewayDlq,
-      environment: {
-        FOUNDATION_TABLE_NAME: props.table.tableName,
-        FOUNDATION_INVOKE_QUEUE_URL: this.invokeQueue.queueUrl,
-        FOUNDATION_GATEWAY_DLQ_URL: this.gatewayDlq.queueUrl,
-        FOUNDATION_SLACK_SIGNING_SECRET_ID: props.secrets.signing.secretName,
-        FOUNDATION_SLACK_APP_SECRET_ID: props.secrets.slackApp.secretName,
-        FOUNDATION_ADMINS: props.admins,
-        FOUNDATION_AGENT_RUNTIME_ARN: props.agentRuntimeArn,
-        // What the teammate is called. The gateway renders it in `/help`, in
-        // every "not configured" reply and in each OAuth result page, and
-        // `triggers.ts` uses it to tell a message addressed to the teammate
-        // from one addressed to a person. Without it the gateway falls back
-        // to a hard-coded name, wrong for every instance but one.
-        FOUNDATION_DISPLAY_NAME: props.instance.displayName,
-        FOUNDATION_ITEMS_TABLE_NAME: props.itemsTable.tableName,
-        FOUNDATION_GOOGLE_CALENDAR_SECRET_ID: props.secrets.googleCalendar.secretName,
-        FOUNDATION_GOOGLE_OAUTH_SECRET_ID: props.secrets.googleOauth.secretName,
-        FOUNDATION_GOOGLE_DRIVE_SECRET_ID: props.secrets.googleDrive.secretName,
-        FOUNDATION_GOOGLE_EMAIL_SECRET_ID: props.secrets.googleEmail.secretName,
-        ...(props.secrets.knockOauthClient === undefined
-          ? {}
-          : { FOUNDATION_KNOCK_OAUTH_CLIENT_SECRET_ID: props.secrets.knockOauthClient.secretName }),
-        ...(props.secrets.knockCredential === undefined
-          ? {}
-          : { FOUNDATION_KNOCK_CREDENTIAL_SECRET_ID: props.secrets.knockCredential.secretName }),
-        ...(upworkSecret === undefined
-          ? {}
-          : { FOUNDATION_UPWORK_SECRET_ID: upworkSecret.secretName }),
-        // Signed into every Drive and email consent link, so one instance's
-        // link cannot be redeemed against another's gateway.
-        FOUNDATION_INSTANCE: props.instance.name,
-        // Slash-command prefixes the gateway answers (current first, then legacy),
-        // from the instance file; the manifest renders the same prefix.
-        FOUNDATION_COMMAND_PREFIXES: slackCommandPrefixes(props.instance).join(","),
-        // Read at SYNTH from the instance file, like FOUNDATION_ADMINS: the gateway
-        // decides what starts a turn and never reads `config/<name>.yaml`, so
-        // making the teammate speak unasked in a channel is a deploy, not a config sync.
-        // Empty for an instance that watches nothing, which is every instance
-        // that omits the block.
-        FOUNDATION_PROACTIVE_CHANNELS: props.instance.proactive.channels.join(","),
-        FOUNDATION_PROACTIVE_MAX_PER_HOUR: String(props.instance.proactive.maxPerHour),
-        ...(jobsWebhookSecret === undefined
-          ? {}
-          : {
-              FOUNDATION_WEBHOOK_JOBS: JSON.stringify(webhookJobs),
-              FOUNDATION_JOBS_WEBHOOK_SECRET_ID: jobsWebhookSecret.secretName,
-            }),
-      },
+      environment: gatewayEnvironment,
     });
     // One mention must produce one reply: Lambda's default of two async
     // retries would re-run a slow turn into duplicate Slack messages.
@@ -806,6 +886,64 @@ export class FoundationApi extends cdk.Stack {
       });
     }
 
+    // --- E*TRADE proxy ---------------------------------------------------
+    // This boundary exposes only six fixed GET operations. It alone can read
+    // the split OAuth consumer and connected access token, verifies signed
+    // actor/session claims, and reactivates inactive same-day tokens in place.
+    if (
+      etradeClientSecret !== undefined &&
+      etradeCredentialSecret !== undefined &&
+      etrade !== undefined
+    ) {
+      const etradeProxyRole = new iam.Role(this, "EtradeProxyRole", {
+        assumedBy: new iam.ServicePrincipal("lambda.amazonaws.com"),
+        description: `${display} E*TRADE fixed read-only proxy Lambda`,
+        managedPolicies: [
+          iam.ManagedPolicy.fromAwsManagedPolicyName("service-role/AWSLambdaBasicExecutionRole"),
+        ],
+      });
+      etradeProxyRole.addToPolicy(
+        new iam.PolicyStatement({
+          sid: "EtradeProxyOAuthSecrets",
+          actions: ["secretsmanager:GetSecretValue"],
+          resources: [
+            secretArnPattern(etradeClientSecret),
+            secretArnPattern(etradeCredentialSecret),
+          ],
+        }),
+      );
+      etradeProxyRole.addToPolicy(
+        new iam.PolicyStatement({
+          sid: "EtradeProxySigningSecret",
+          actions: ["secretsmanager:GetSecretValue"],
+          resources: [secretArnPattern(props.secrets.signing)],
+        }),
+      );
+      const etradeProxyEnvironment: Record<string, string> = {
+        FOUNDATION_ETRADE_CLIENT_SECRET_ID: etradeClientSecret.secretName,
+        FOUNDATION_ETRADE_CREDENTIAL_SECRET_ID: etradeCredentialSecret.secretName,
+        FOUNDATION_SLACK_SIGNING_SECRET_ID: props.secrets.signing.secretName,
+        FOUNDATION_SLACK_TEAM_ID: props.instance.slack.teamId,
+        FOUNDATION_ETRADE_ALLOWED_CHANNELS: JSON.stringify(etrade.channels),
+        FOUNDATION_ETRADE_ALLOWED_USERS: JSON.stringify(etrade.users),
+        FOUNDATION_ADMINS: props.admins,
+      };
+      assertLambdaEnvironmentBudget(etradeProxyEnvironment);
+      this.etradeProxyFunction = new lambda.Function(this, "EtradeProxyFunction", {
+        functionName: names.etradeProxyFunctionName,
+        runtime: lambda.Runtime.NODEJS_22_X,
+        handler: "index.handler",
+        code: lambdaCode(this, "etrade-proxy"),
+        role: etradeProxyRole,
+        timeout: cdk.Duration.seconds(30),
+        memorySize: 256,
+        environment: etradeProxyEnvironment,
+      });
+      new cdk.CfnOutput(this, "EtradeProxyFunctionArn", {
+        value: this.etradeProxyFunction.functionArn,
+      });
+    }
+
     // --- CRM proxy -------------------------------------------------------
     // Fixed operations and deployment-baked policy over the instance's own
     // self-hosted CRM table.
@@ -841,6 +979,9 @@ export class FoundationApi extends cdk.Stack {
             "dynamodb:BatchGetItem",
             "dynamodb:BatchWriteItem",
             "dynamodb:TransactWriteItems",
+            // A transaction's ConditionCheck is its own IAM action; the
+            // repository guards every upsert and activity with one.
+            "dynamodb:ConditionCheckItem",
           ],
           resources: [crmTable.tableArn],
         }),
@@ -852,6 +993,16 @@ export class FoundationApi extends cdk.Stack {
           resources: [crmTable.tableArn, `${crmTable.tableArn}/index/RecordsIndex`],
         }),
       );
+      // The table is encrypted with the instance's data key, so every read and
+      // write needs it. Without this grant each call failed as `proxy_error`
+      // (KMS AccessDenied) the first time a deployment actually used its CRM.
+      crmProxyRole.addToPolicy(
+        new iam.PolicyStatement({
+          sid: "CrmTableKey",
+          actions: ["kms:Decrypt", "kms:Encrypt", "kms:GenerateDataKey", "kms:DescribeKey"],
+          resources: [(crmTable.encryptionKey ?? props.dataKey).keyArn],
+        }),
+      );
       this.crmProxyFunction = new lambda.Function(this, "CrmProxyFunction", {
         functionName: names.crmProxyFunctionName,
         runtime: lambda.Runtime.NODEJS_22_X,
@@ -918,6 +1069,75 @@ export class FoundationApi extends cdk.Stack {
       alarm.addAlarmAction(alarmAction);
     }
 
+    // --- deployment-owned scheduled jobs --------------------------------
+    // Config jobs never share the agent-managed routine group or pass role.
+    // Only this unexposed dispatcher can mint the HMAC that ingress accepts
+    // for JOB_ACTOR, so an agent shell cannot manufacture a privileged fire.
+    if (configuredScheduledJobs.length > 0) {
+      const dispatchRole = new iam.Role(this, "ScheduledJobDispatcherRole", {
+        assumedBy: new iam.ServicePrincipal("lambda.amazonaws.com"),
+        description: `${display} deployment-owned scheduled job dispatcher`,
+        managedPolicies: [
+          iam.ManagedPolicy.fromAwsManagedPolicyName("service-role/AWSLambdaBasicExecutionRole"),
+        ],
+      });
+      props.secrets.signing.grantRead(dispatchRole);
+      gatewayFunction.grantInvoke(dispatchRole);
+      const dispatchFunction = new lambda.Function(this, "ScheduledJobDispatcherFunction", {
+        runtime: lambda.Runtime.NODEJS_22_X,
+        handler: "index.scheduledJobDispatcherHandler",
+        code: lambdaCode(this, "gateway"),
+        role: dispatchRole,
+        timeout: cdk.Duration.seconds(30),
+        memorySize: 128,
+        deadLetterQueue: this.gatewayDlq,
+        environment: {
+          FOUNDATION_SLACK_SIGNING_SECRET_ID: props.secrets.signing.secretName,
+          FOUNDATION_GATEWAY_FUNCTION_NAME: gatewayFunction.functionName,
+        },
+      });
+      dispatchFunction.configureAsyncInvoke({
+        retryAttempts: 0,
+        maxEventAge: cdk.Duration.minutes(15),
+      });
+
+      const jobGroup = new scheduler.CfnScheduleGroup(this, "ScheduledJobGroup");
+      const jobSchedulerRole = new iam.Role(this, "ScheduledJobSchedulerRole", {
+        assumedBy: new iam.ServicePrincipal("scheduler.amazonaws.com", {
+          conditions: { StringEquals: { "aws:SourceAccount": this.account } },
+        }),
+        description: `${display} deployment-owned scheduled job invoker`,
+      });
+      dispatchFunction.grantInvoke(jobSchedulerRole);
+
+      for (const job of configuredScheduledJobs) {
+        const parsed = parseSchedule(job.on.schedule);
+        if (!parsed.ok) throw new Error(`Scheduled job ${job.id} has an invalid schedule`);
+        const schedule = new scheduler.CfnSchedule(this, `ScheduledJob-${job.id}`, {
+          groupName: jobGroup.ref,
+          scheduleExpression: job.on.schedule,
+          scheduleExpressionTimezone: scheduledJobTimezone,
+          flexibleTimeWindow: { mode: "OFF" },
+          ...(parsed.kind === "at" ? { actionAfterCompletion: "DELETE" } : {}),
+          target: {
+            arn: dispatchFunction.functionArn,
+            roleArn: jobSchedulerRole.roleArn,
+            input: JSON.stringify({
+              internal: "scheduled_job",
+              routineId: `job-${job.id}`,
+              name: job.name,
+              channel: job.channel,
+              prompt: job.prompt,
+              createdBy: JOB_ACTOR,
+              scheduledTime: "<aws.scheduler.scheduled-time>",
+            }),
+            retryPolicy: { maximumEventAgeInSeconds: 900, maximumRetryAttempts: 0 },
+          },
+        });
+        schedule.addResourceDependency(jobGroup);
+      }
+    }
+
     // --- routines --------------------------------------------------------
     // The group and the role live here because the queue does. The agent
     // creates schedules INSIDE the group and passes the role; it never needs
@@ -1034,6 +1254,48 @@ function upworkConfigForProvisioning(configPath: string): ProvisionedUpworkConfi
   return { channels: [...upwork.channels] };
 }
 
+interface ProvisionedEtradeConfig {
+  channels: string[];
+  users: string[];
+}
+
+/** Deployment-baked E*TRADE access policy; config sync cannot widen it. */
+export function etradeConfigForProvisioning(configPath: string): ProvisionedEtradeConfig {
+  const config = parseInstanceConfig(readFileSync(configPath, "utf8"));
+  const etrade = config.capabilities.etrade;
+  const missing = [
+    ...(etrade.enabled ? [] : ["capabilities.etrade.enabled"]),
+    ...(etrade.channels.length > 0 ? [] : ["capabilities.etrade.channels"]),
+    ...(etrade.users.length > 0 ? [] : ["capabilities.etrade.users"]),
+  ];
+  if (missing.length > 0)
+    throw new Error(
+      `${configPath}: integrations.etrade requires a configured E*TRADE capability (${missing.join(", ")})`,
+    );
+  const seenAdmins = new Set<string>();
+  const invalidAdmins = config.admins.filter((admin) => {
+    const invalid =
+      !/^[UW][A-Z0-9]{8,}$/.test(admin) || admin.length > 128 || seenAdmins.has(admin);
+    seenAdmins.add(admin);
+    return invalid;
+  });
+  if (invalidAdmins.length > 0) {
+    throw new Error(
+      `${configPath}: an E*TRADE deployment requires unique valid Slack user ids in admins`,
+    );
+  }
+  const nonAdmins = etrade.users.filter((user) => !config.admins.includes(user));
+  if (nonAdmins.length > 0)
+    throw new Error(
+      `${configPath}: capabilities.etrade.users must be instance admins (${nonAdmins.join(", ")})`,
+    );
+  return { channels: [...etrade.channels], users: [...etrade.users] };
+}
+
+function configTimezoneFor(configPath: string): string {
+  return parseInstanceConfig(readFileSync(configPath, "utf8")).timezone;
+}
+
 /**
  * The mailbox identities to bake into the proxy, read from the instance's own
  * config file at synth.
@@ -1071,6 +1333,42 @@ export function webhookJobsFor(configPath: string): WebhookJobBinding[] {
   return jobs;
 }
 
+export const LAMBDA_ENVIRONMENT_MAX_BYTES = 4_096;
+/** Conservative bound for generated names/ARNs after instance naming limits are applied. */
+export const LAMBDA_ENVIRONMENT_TOKEN_BYTES = 128;
+
+/** Enforce Lambda's aggregate 4 KiB environment limit over every key and value. */
+export function assertLambdaEnvironmentBudget(values: Readonly<Record<string, string>>): void {
+  let bytes = 2;
+  for (const [key, value] of Object.entries(values)) {
+    bytes += Buffer.byteLength(key) + 3;
+    bytes += cdk.Token.isUnresolved(value)
+      ? LAMBDA_ENVIRONMENT_TOKEN_BYTES
+      : Buffer.byteLength(value);
+  }
+  if (bytes > LAMBDA_ENVIRONMENT_MAX_BYTES) {
+    throw new Error(
+      `Gateway Lambda environment needs an estimated ${bytes} bytes; the AWS limit is ${LAMBDA_ENVIRONMENT_MAX_BYTES}. Shorten job prompts or reduce configured values.`,
+    );
+  }
+}
+
+/** Deployment-baked hashes stop routine ingress minting arbitrary JOB_ACTOR turns. */
+export function scheduledJobBindingsFor(configPath: string): ScheduledJobBinding[] {
+  return scheduledJobBindings(scheduledJobsFor(configPath));
+}
+
+/** Scheduled jobs are deployment-owned infrastructure, never agent-owned routines. */
+export function scheduledJobsFor(configPath: string): ScheduledJobConfig[] {
+  const jobs = parseInstanceConfig(readFileSync(configPath, "utf8")).jobs.filter(isScheduledJob);
+  for (const job of jobs) {
+    const parsed = parseSchedule(job.on.schedule);
+    if (!parsed.ok)
+      throw new Error(`Scheduled job ${job.id} has an invalid schedule: ${parsed.reason}`);
+  }
+  return jobs;
+}
+
 /** Server-side Browser allowlist baked into the isolated proxy at deploy time. */
 export function browserDomainsFor(configPath: string): string[] {
   const browser = parseInstanceConfig(readFileSync(configPath, "utf8")).capabilities.browser;

package/src/stacks/data-stack.ts

@@ -51,6 +51,8 @@ export class FoundationData extends cdk.Stack {
   public readonly crmTable?: dynamodb.Table;
   /** Ephemeral proposal drafts; accessible only to the credential-isolated Upwork proxy. */
   public readonly upworkApprovalTable?: dynamodb.Table;
+  /** Short-lived OOB request-token state; gateway-only and destroyed with the opt-in. */
+  public readonly etradePendingTable?: dynamodb.Table;
   public readonly secrets: {
     signing: secretsmanager.ISecret;
     slackApp: secretsmanager.ISecret;
@@ -69,6 +71,10 @@ export class FoundationData extends cdk.Stack {
     knockCredential?: secretsmanager.ISecret;
     /** Combined Upwork OAuth client and token secret, provisioned only when opted in. */
     upwork?: secretsmanager.ISecret;
+    /** Retained E*TRADE OAuth consumer; the gateway reads this to connect. */
+    etradeClient?: secretsmanager.ISecret;
+    /** Retained access credential; gateway writes and fixed read proxy alone reads. */
+    etradeCredential?: secretsmanager.ISecret;
     runtime: secretsmanager.ISecret;
   };
 
@@ -158,6 +164,16 @@ export class FoundationData extends cdk.Stack {
           removalPolicy: cdk.RemovalPolicy.DESTROY,
         })
       : undefined;
+    this.etradePendingTable = provisionsIntegration(props.instance, "etrade")
+      ? new dynamodb.Table(this, "EtradeOAuthPendingTable", {
+          partitionKey: { name: "pk", type: dynamodb.AttributeType.STRING },
+          timeToLiveAttribute: "ttl",
+          billingMode: dynamodb.BillingMode.PAY_PER_REQUEST,
+          encryption: dynamodb.TableEncryption.CUSTOMER_MANAGED,
+          encryptionKey: this.dataKey,
+          removalPolicy: cdk.RemovalPolicy.DESTROY,
+        })
+      : undefined;
 
     // An empty shell CDK is willing to synth without a real value; the real
     // value is written out of band and survives every later deploy because
@@ -225,6 +241,32 @@ export class FoundationData extends cdk.Stack {
         )
       : undefined;
 
+    // E*TRADE access tokens expire daily, and disabling the integration must
+    // not strand fixed-name retained secrets CloudFormation cannot adopt on a
+    // later re-enable. Operators deliberately repopulate the client and reconnect.
+    const etradeClient = provisionsIntegration(props.instance, "etrade")
+      ? new secretsmanager.Secret(this, "EtradeClientSecret", {
+          secretName: names.secretEtradeClient,
+          description: `E*TRADE OAuth consumer for ${display} ({ consumer_key, consumer_secret, environment })`,
+          removalPolicy: cdk.RemovalPolicy.DESTROY,
+          generateSecretString: {
+            secretStringTemplate: "{}",
+            generateStringKey: "placeholder",
+          },
+        })
+      : undefined;
+    const etradeCredential = provisionsIntegration(props.instance, "etrade")
+      ? new secretsmanager.Secret(this, "EtradeCredentialSecret", {
+          secretName: names.secretEtradeCredential,
+          description: `E*TRADE access token for ${display} ({ oauth_token, oauth_token_secret }); gateway writes and fixed read proxy alone reads`,
+          removalPolicy: cdk.RemovalPolicy.DESTROY,
+          generateSecretString: {
+            secretStringTemplate: "{}",
+            generateStringKey: "placeholder",
+          },
+        })
+      : undefined;
+
     this.secrets = {
       // Already created out of band — import, never manage.
       signing: secretsmanager.Secret.fromSecretNameV2(
@@ -305,6 +347,8 @@ export class FoundationData extends cdk.Stack {
       ...(knockOauthClient === undefined ? {} : { knockOauthClient }),
       ...(knockCredential === undefined ? {} : { knockCredential }),
       ...(upwork === undefined ? {} : { upwork }),
+      ...(etradeClient === undefined ? {} : { etradeClient }),
+      ...(etradeCredential === undefined ? {} : { etradeCredential }),
       // The OAuth client every Google capability shares: Calendar builds a
       // per-person consent link with it, Drive connects the company identity
       // with it. Never a refresh token. A placeholder is fine — an unparseable