@deployfoundation/foundation-deploy 0.2.34 → 0.2.35

package/README.md

@@ -49,7 +49,7 @@ bun run packages/infra/bin/foundation-deploy.ts <command> --instance <path>
 | --- | --- |
 | `deploy` | Build and push the agent image, `cdk deploy --all`, refresh the runtime secret (and `cdk deploy` once more when that changed it, so no container boots on the old one), sync config. |
 | `post-deploy` | Smoke DEFAULT, probe the persistent mount, promote `live`, smoke `live`. |
-| `config:sync` | Upload the runtime config and Foundation's product skills to S3. |
+| `config:sync` | Upload the runtime config (for the deployed Foundation version, which must be this tool's) and Foundation's product skills to S3. |
 | `setup` | First-deploy orchestration, idempotent. |
 | `github-app-create` | Create the instance's GitHub App from the shipped manifest template. |
 | `slack-manifest` | Print the instance's Slack app manifest as JSON (the Slack CLI's `get-manifest` hook contract). |

package/dist/bin/app.js

@@ -8,13 +8,13 @@ import {
   FoundationPages,
   FoundationPipeline,
   NewsletterStack
-} from "../chunk-nn1v23ar.js";
+} from "../chunk-zbw2awg7.js";
 import {
   adminsFor,
   instanceNames,
   loadInstanceFile,
   provisionsIntegration
-} from "../chunk-x093sh8z.js";
+} from "../chunk-hps5vshg.js";
 
 // bin/app.ts
 import { execFileSync } from "node:child_process";

package/dist/bin/foundation-deploy.js

@@ -12,6 +12,7 @@ import {
   callerAccountId,
   cdkEnv,
   createSecretString,
+  foundationVersion,
   hasFoundationWorkspace,
   instanceBanner,
   loadInstanceContext,
@@ -29,7 +30,7 @@ import {
   stackExists,
   stackOutput,
   toolVersion
-} from "../chunk-k5wwqj2j.js";
+} from "../chunk-gmdzzrc4.js";
 import {
   BASE_SLACK_EVENTS,
   CAPABILITY_IDS,
@@ -44,8 +45,9 @@ import {
   requiredSlackCommands,
   requiredSlackScopes,
   skillsKey,
-  slackCommandPrefix
-} from "../chunk-x093sh8z.js";
+  slackCommandPrefix,
+  versionedConfigKey
+} from "../chunk-hps5vshg.js";
 
 // src/deploy/config-sync.ts
 import { existsSync, mkdirSync, mkdtempSync, readdirSync } from "node:fs";
@@ -58,12 +60,52 @@ function productSkillsDir(foundationRoot = FOUNDATION_ROOT) {
   const entries = readdirSync(dir).filter((name) => name !== "README.md");
   return entries.length > 0 ? dir : undefined;
 }
-async function configSync(ctx, opts = {}) {
+async function deployedFoundationVersion(ctx) {
+  try {
+    return await stackOutput(ctx, ctx.names.agent, "FoundationVersion");
+  } catch (error) {
+    if (error instanceof Error && error.message.includes("has no output"))
+      return;
+    throw error;
+  }
+}
+function syncVersion(ctx, deployed, tool, release) {
+  if (deployed === undefined)
+    throw new Error(`config:sync refused: ${ctx.names.agent} records no Foundation version, so its runtime predates per-version config. Deploy ${tool} first; the deploy writes this config itself.`);
+  for (const [what, version] of [
+    ["this foundation-deploy", tool],
+    ["--release", release]
+  ]) {
+    if (version === undefined || version === deployed)
+      continue;
+    throw new Error(`config:sync refused: ${what} is ${version}, but ${ctx.names.agent} runs Foundation ${deployed}, whose runtime may refuse a config ${version} accepts. Run config:sync with foundation-deploy@${deployed.slice(1)}, or deploy ${version} first.`);
+  }
+  return deployed;
+}
+async function dataBucket(ctx, bucket) {
+  if (bucket !== undefined)
+    return bucket;
+  return ctx.dryRun === true ? `<${ctx.names.data}.BucketName>` : await stackOutput(ctx, ctx.names.data, "BucketName");
+}
+async function uploadRuntimeConfig(ctx, opts) {
   if (opts.runtimeConfigPath === undefined && ctx.instance.customization !== undefined)
     throw new Error("customized instances require a freshly validated runtimeConfigPath; run through `deploy` or `config:sync`");
   const source = opts.runtimeConfigPath ?? ctx.paths.configPath;
-  const bucket = opts.bucket ?? (ctx.dryRun === true ? `<${ctx.names.data}.BucketName>` : await stackOutput(ctx, ctx.names.data, "BucketName"));
-  await awsMutate(ctx, ["s3", "cp", source, `s3://${bucket}/${ctx.names.configKey}`]);
+  const key = versionedConfigKey(ctx.names.configKey, opts.version);
+  await awsMutate(ctx, ["s3", "cp", source, `s3://${opts.bucket}/${key}`]);
+  return key;
+}
+async function configSync(ctx, opts = {}) {
+  if (opts.runtimeConfigPath === undefined && ctx.instance.customization !== undefined)
+    throw new Error("customized instances require a freshly validated runtimeConfigPath; run through `deploy` or `config:sync`");
+  const tool = opts.toolVersion ?? `v${toolVersion()}`;
+  const version = opts.version ?? (ctx.dryRun === true ? tool : syncVersion(ctx, await (opts.deployedVersion ?? deployedFoundationVersion)(ctx), tool, opts.release?.version));
+  const bucket = await dataBucket(ctx, opts.bucket);
+  await uploadRuntimeConfig(ctx, {
+    bucket,
+    version,
+    ...opts.runtimeConfigPath === undefined ? {} : { runtimeConfigPath: opts.runtimeConfigPath }
+  });
   const skills = opts.release === undefined ? productSkillsDir(opts.foundationRoot) : await (opts.releaseSkillsDir ?? unpackReleaseSkills)(ctx, opts.release);
   if (skills !== undefined)
     await awsMutate(ctx, ["s3", "sync", `${skills}/`, `s3://${bucket}/skills/`, "--delete"]);
@@ -104,10 +146,11 @@ var MAX_GOOGLE_TOKEN_RESPONSE_BYTES = 128 * 1024;
 var GMAIL_LIST_SUMMARY_MAX_BYTES = 1024 * 1024;
 var MAX_GMAIL_ATTACHMENT_BYTES = 3.5 * 1024 * 1024;
 var MAX_GMAIL_ATTACHMENT_RESPONSE_BYTES = 5 * 1024 * 1024;
-var GMAIL_SCOPES = [
+var GMAIL_PERSONAL_SCOPES = [
   "https://www.googleapis.com/auth/gmail.compose",
   "https://www.googleapis.com/auth/gmail.modify"
 ].join(" ");
+var GMAIL_SCOPES = `${GMAIL_PERSONAL_SCOPES} https://www.googleapis.com/auth/gmail.settings.basic`;
 var MAX_PART_TEXT_BYTES = 200 * 1024;
 var MAX_GMAIL_DECODED_TEXT_BYTES = 512 * 1024;
 var MAX_GMAIL_JSON_RESPONSE_BYTES = 2 * 1024 * 1024;
@@ -1175,6 +1218,8 @@ async function cdkDeploy(ctx, opts) {
     ...opts.phase1 === true ? ["-c", "deployRuntime=false"] : [],
     ...opts.tag === undefined || opts.release !== undefined ? [] : ["-c", `agentImageTag=${opts.tag}`],
     ...opts.release === undefined ? [] : releaseContext(opts.release),
+    "-c",
+    `foundationVersion=${foundationVersion(opts.release)}`,
     ...opts.runtimeSecretDigest === undefined ? [] : ["-c", `runtimeSecretDigest=${opts.runtimeSecretDigest}`],
     ...await pagesDomainContext(ctx)
   ];
@@ -1357,7 +1402,7 @@ async function checkLicense(ctx, opts, release) {
   const verify = opts.verifyLicense ?? (ctx.dryRun === true ? plannedLicenseCheck : verifyLicense);
   const result = await verify(ctx.instance.license?.key, {
     instanceId: ctx.instance.name,
-    version: release?.version ?? `v${toolVersion()}`,
+    version: foundationVersion(release),
     cache: secretsManagerLicenseCache(ctx)
   });
   console.log(`▶ license: ${result.message}`);
@@ -1381,6 +1426,17 @@ async function deploy(ctx, opts) {
     console.log(`▶ build + push agent image (${tag})`);
     console.log(`  ${await buildAndPushImage(ctx, { tag })}`);
   }
+  const version = foundationVersion(release);
+  const bucket = phase1 ? undefined : ctx.dryRun === true ? `<${ctx.names.data}.BucketName>` : await optionalOutput(ctx, ctx.names.data, "BucketName");
+  if (bucket !== undefined) {
+    console.log(`▶ config for ${version}, ahead of the runtime version that reads it`);
+    const key = await uploadRuntimeConfig(ctx, {
+      bucket,
+      version,
+      runtimeConfigPath: customization.runtimeConfigPath
+    });
+    console.log(`  s3://${bucket}/${key}`);
+  }
   console.log(`▶ cdk deploy --all${phase1 ? " (phase 1: no runtime)" : release !== undefined ? ` (release ${release.version})` : ` (image ${tag})`}`);
   const deployed = await currentRuntimeSecretDigest(ctx);
   const deployStacks = (runtimeSecretDigest2) => cdkDeploy(ctx, {
@@ -1403,12 +1459,13 @@ async function deploy(ctx, opts) {
     digest: async () => phase1 ? undefined : currentRuntimeSecretDigest(ctx),
     redeploy: (digest) => deployStacks(digest)
   });
-  console.log("▶ config sync");
-  const bucket = await configSync(ctx, {
+  console.log(`▶ config sync (${version})`);
+  const synced = await configSync(ctx, {
+    version,
     runtimeConfigPath: customization.runtimeConfigPath,
     ...release === undefined ? {} : { release }
   });
-  console.log(`config + skills synced to s3://${bucket}/`);
+  console.log(`config + skills synced to s3://${synced}/`);
   if (!phase1 && promotesInline()) {
     console.log("▶ smoke test, then promote the `live` endpoint");
     await promoteLive(ctx);
@@ -2033,7 +2090,8 @@ async function setup(ctx, opts = {}) {
   step(6, "sync config + skills to S3");
   const bucket = await configSync(ctx, {
     bucket: await output(ctx, ctx.names.data, "BucketName"),
-    runtimeConfigPath
+    runtimeConfigPath,
+    version: foundationVersion()
   });
   console.log(`  s3://${bucket}/`);
   step(7, "build + push the agent image");
@@ -2093,7 +2151,8 @@ commands
   deploy               build and push the agent image, cdk deploy --all, refresh
                        the runtime secret, sync config
   post-deploy          smoke DEFAULT, probe the mount, promote \`live\`, smoke \`live\`
-  config:sync          upload the runtime config and product skills to S3
+  config:sync          upload the deployed version's runtime config and the
+                       product skills to S3
   setup                first-deploy orchestration (idempotent)
   github-app-create    create the instance's GitHub App from the shipped manifest
   slack-manifest       print the instance's Slack app manifest as JSON

package/dist/bin/release-account.js

@@ -1,8 +1,8 @@
 #!/usr/bin/env bun
 import {
   DEFAULT_RELEASE_BUCKET
-} from "../chunk-k5wwqj2j.js";
-import"../chunk-x093sh8z.js";
+} from "../chunk-gmdzzrc4.js";
+import"../chunk-hps5vshg.js";
 
 // bin/release-account.ts
 import * as cdk2 from "aws-cdk-lib";

package/dist/{chunk-k5wwqj2j.js → chunk-gmdzzrc4.js}

@@ -6,7 +6,7 @@ import {
   manifestKey,
   releaseCacheDir,
   verifyManifest
-} from "./chunk-x093sh8z.js";
+} from "./chunk-hps5vshg.js";
 
 // src/deploy/release.ts
 import { existsSync as existsSync2, mkdirSync, readFileSync as readFileSync2 } from "node:fs";
@@ -335,6 +335,9 @@ function toolVersion(infraRoot = INFRA_ROOT) {
   const { version } = JSON.parse(readFileSync2(join2(infraRoot, "package.json"), "utf8"));
   return version;
 }
+function foundationVersion(release) {
+  return release?.version ?? `v${toolVersion()}`;
+}
 function hasFoundationWorkspace(foundationRoot = FOUNDATION_ROOT) {
   return existsSync2(join2(foundationRoot, "packages", "gateway", "package.json"));
 }
@@ -436,4 +439,4 @@ function releaseContext(release) {
   ];
 }
 
-export { resolveInstanceFilePath, loadInstanceContext, instanceBanner, run, runCapture, awsContext, argv, cdkEnv, aws, awsMutate, stackOutput, stackExists, secretExists, readSecretString, readSecretJson, putSecretString, createSecretString, putSecretJson, callerAccountId, INFRA_ROOT, FOUNDATION_ROOT, AGENT_DOCKERFILE, PACKAGE_ASSETS, DEFAULT_RELEASE_BUCKET, toolVersion, hasFoundationWorkspace, releaseRequest, resolveRelease, releaseContext };
+export { resolveInstanceFilePath, loadInstanceContext, instanceBanner, run, runCapture, awsContext, argv, cdkEnv, aws, awsMutate, stackOutput, stackExists, secretExists, readSecretString, readSecretJson, putSecretString, createSecretString, putSecretJson, callerAccountId, INFRA_ROOT, FOUNDATION_ROOT, AGENT_DOCKERFILE, PACKAGE_ASSETS, DEFAULT_RELEASE_BUCKET, toolVersion, foundationVersion, hasFoundationWorkspace, releaseRequest, resolveRelease, releaseContext };

package/dist/{chunk-x093sh8z.js → chunk-hps5vshg.js}

@@ -504,6 +504,7 @@ var RawEmailIdentity = z.object({
   channel: z.string().regex(/^[CGD][A-Z0-9]{8,}$/),
   owner: z.string().regex(/^U[A-Z0-9]{8,}$/, "owner must be a Slack U id").optional(),
   signature: z.string().min(1).max(2000),
+  organization: z.boolean().optional(),
   sendAsAddresses: z.array(z.string().regex(/^[a-z0-9._%+-]+@[a-z0-9.-]+\.[a-z]{2,}$/i)).max(20).default([]).refine((addresses) => new Set(addresses.map((address) => address.toLowerCase())).size === addresses.length, "duplicate send-as address")
 }).strict().superRefine((identity, ctx) => {
   if (identity.channel.startsWith("D") && identity.owner === undefined) {
@@ -513,12 +514,26 @@ var RawEmailIdentity = z.object({
       message: "personal email identities in D channels require an owner"
     });
   }
+  if (identity.organization === true && identity.owner !== undefined) {
+    ctx.addIssue({
+      code: z.ZodIssueCode.custom,
+      path: ["organization"],
+      message: "mailbox organization is shared-only"
+    });
+  }
 });
 var RawEmailCapability = z.object({
   enabled: z.boolean().default(false),
   identities: z.array(RawEmailIdentity).default([]),
   inboxCheck: z.enum(["hourly", "off"]).default("hourly")
 }).strict().superRefine((value, ctx) => {
+  if (value.identities.filter((identity) => identity.organization === true).length > 1) {
+    ctx.addIssue({
+      code: z.ZodIssueCode.custom,
+      path: ["identities"],
+      message: "only one shared identity may have mailbox-wide organization access"
+    });
+  }
   for (const field of ["address", "channel"]) {
     const seen = new Set;
     for (const [index, identity] of value.identities.entries()) {
@@ -727,7 +742,7 @@ var CAPABILITIES = [
   },
   {
     id: "email",
-    summary: "Read a company mailbox and draft replies; sending stays with a person.",
+    summary: "Read, draft and organize company mail; sending stays with a person.",
     config: RawEmailCapability,
     ...NONE,
     secrets: ["google/email", GOOGLE_OAUTH_SECRET],
@@ -736,6 +751,7 @@ var CAPABILITIES = [
     googleScopes: [
       "https://www.googleapis.com/auth/gmail.compose",
       "https://www.googleapis.com/auth/gmail.modify",
+      "https://www.googleapis.com/auth/gmail.settings.basic",
       ...GOOGLE_IDENTITY_SCOPES
     ]
   },
@@ -1125,6 +1141,12 @@ function newsletterManifestFor(instance) {
     }))
   };
 }
+var FOUNDATION_VERSION_RE = /^v\d+\.\d+\.\d+(?:-[0-9A-Za-z.-]+)?$/;
+function versionedConfigKey(configKey, version) {
+  if (!FOUNDATION_VERSION_RE.test(version))
+    throw new Error(`not a Foundation version: "${version}" (expected one like v0.2.34)`);
+  return `config/${version}/${configKey.slice(configKey.lastIndexOf("/") + 1)}`;
+}
 function instanceNames(instance) {
   const { prefix, secretPrefix, runtimeName } = instance.naming;
   const stack = (suffix) => `${prefix}${suffix}`;
@@ -1864,4 +1886,4 @@ function ecrRepositoryArn(repositoryUri) {
   return `arn:aws:ecr:${region}:${account}:repository/${name}`;
 }
 
-export { parseSchedule, BASE_SLACK_EVENTS, CAPABILITY_IDS, requiredGithubPermissions, requiredSlackScopes, requiredSlackCommands, CUSTOMIZATION_ARTIFACT_NAME, newsletterManifestFor, instanceNames, slackCommandPrefix, slackCommandPrefixes, isScheduledJob, isWebhookJob, webhookJobBindings, scheduledJobBindings, jobWebhookKey, capabilityScheduledJobs, crmOutreachConfigured, crmPolicyFingerprint, parseInstanceConfig, loadInstanceFile, configPathFor, capabilityEnabled, requiresAuthenticatedQueue, enabledIntegrations, provisionsIntegration, adminsFor, WEB_SEARCH_TARGET, WEB_SEARCH_CONNECTOR_VERSION, LIVE_ENDPOINT_NAME, RELEASE_VERSION_RE, parseManifest, manifestKey, lambdaKey, skillsKey, buildManifest, manifestSigningPayload, verifyManifest, lambdaBundleContext, BUN_VERSION, LAMBDA_ENTRY_POINTS, skipBundle, RELEASE_BUCKET_ENV, RELEASE_DIR_ENV, releaseCacheDir, releaseSource, lambdaCode, agentImage, agentImageTagRequired, releaseImageRepositoryArn, ecrRepositoryArn };
+export { parseSchedule, BASE_SLACK_EVENTS, CAPABILITY_IDS, requiredGithubPermissions, requiredSlackScopes, requiredSlackCommands, CUSTOMIZATION_ARTIFACT_NAME, newsletterManifestFor, FOUNDATION_VERSION_RE, versionedConfigKey, instanceNames, slackCommandPrefix, slackCommandPrefixes, isScheduledJob, isWebhookJob, webhookJobBindings, scheduledJobBindings, jobWebhookKey, capabilityScheduledJobs, crmOutreachConfigured, crmPolicyFingerprint, parseInstanceConfig, loadInstanceFile, configPathFor, capabilityEnabled, requiresAuthenticatedQueue, enabledIntegrations, provisionsIntegration, adminsFor, WEB_SEARCH_TARGET, WEB_SEARCH_CONNECTOR_VERSION, LIVE_ENDPOINT_NAME, RELEASE_VERSION_RE, parseManifest, manifestKey, lambdaKey, skillsKey, buildManifest, manifestSigningPayload, verifyManifest, lambdaBundleContext, BUN_VERSION, LAMBDA_ENTRY_POINTS, skipBundle, RELEASE_BUCKET_ENV, RELEASE_DIR_ENV, releaseCacheDir, releaseSource, lambdaCode, agentImage, agentImageTagRequired, releaseImageRepositoryArn, ecrRepositoryArn };

package/dist/{chunk-nn1v23ar.js → chunk-zbw2awg7.js}

@@ -1,5 +1,6 @@
 import {
   CUSTOMIZATION_ARTIFACT_NAME,
+  FOUNDATION_VERSION_RE,
   LIVE_ENDPOINT_NAME,
   WEB_SEARCH_TARGET,
   agentImage,
@@ -16,11 +17,12 @@ import {
   parseSchedule,
   provisionsIntegration,
   releaseImageRepositoryArn,
+  releaseSource,
   requiresAuthenticatedQueue,
   scheduledJobBindings,
   slackCommandPrefixes,
   webhookJobBindings
-} from "./chunk-x093sh8z.js";
+} from "./chunk-hps5vshg.js";
 
 // src/stacks/agent-stack.ts
 import * as cdk from "aws-cdk-lib";
@@ -85,6 +87,7 @@ class FoundationAgent extends cdk.Stack {
     if (!imageTag && agentImageTagRequired(this)) {
       throw new Error(`${id}: -c agentImageTag=<tag> is required when deploying the runtime. Pass the tag of an image already pushed to the ${names.ecrRepo} repository, deploy a release with -c release=<version>, or run the bootstrap phase with -c deployRuntime=false.`);
     }
+    const foundationVersion = foundationVersionContext(this, id);
     const explicitSubnets = String(this.node.tryGetContext("agentSubnetIds") ?? "").split(",").map((s) => s.trim()).filter(Boolean);
     const runtimeSubnets = explicitSubnets.length > 0 ? explicitSubnets : props.vpc.selectSubnets(props.egressSubnets).subnetIds;
     const mountTargets = runtimeSubnets.map((subnetId, index) => new cdk.CfnResource(this, `MountTarget${index}`, {
@@ -129,6 +132,7 @@ class FoundationAgent extends cdk.Stack {
           RUNTIME_SECRET_ID: props.secrets.runtime.secretName,
           AWS_REGION: this.region,
           FOUNDATION_WORKSPACE_ROOT: "/workspace",
+          FOUNDATION_VERSION: foundationVersion,
           ...secretDigest === undefined ? {} : { FOUNDATION_RUNTIME_SECRET_DIGEST: secretDigest }
         },
         Tags: { project: props.instance.naming.secretPrefix }
@@ -140,6 +144,7 @@ class FoundationAgent extends cdk.Stack {
       runtime.node.addDependency(mountTarget);
     this.agentRuntimeArn = runtime.getAtt("AgentRuntimeArn").toString();
     this.outputs();
+    new cdk.CfnOutput(this, "FoundationVersion", { value: foundationVersion });
   }
   outputs() {
     new cdk.CfnOutput(this, "AgentRuntimeArn", { value: this.agentRuntimeArn });
@@ -783,6 +788,18 @@ class FoundationAgent extends cdk.Stack {
 function secretArnPattern(secret) {
   return secret.secretFullArn ?? `${secret.secretArn}-??????`;
 }
+function foundationVersionContext(scope, id) {
+  const explicit = String(scope.node.tryGetContext("foundationVersion") ?? "");
+  const release = releaseSource(scope)?.version;
+  if (explicit !== "" && release !== undefined && explicit !== release)
+    throw new Error(`${id}: -c foundationVersion=${explicit} but the release being deployed is ${release}`);
+  const version = explicit !== "" ? explicit : release ?? "";
+  if (version === "")
+    throw new Error(`${id}: -c foundationVersion=<vX.Y.Z> is required when deploying the runtime: it reads only its own version's config. foundation-deploy passes it.`);
+  if (!FOUNDATION_VERSION_RE.test(version))
+    throw new Error(`${id}: foundationVersion must look like v0.2.34, got "${version}"`);
+  return version;
+}
 function runtimeSecretDigestContext(value) {
   if (value === undefined || value === "")
     return;

package/dist/src/index.js

@@ -10,7 +10,7 @@ import {
   FoundationPipeline,
   NewsletterStack,
   deployStatements
-} from "../chunk-nn1v23ar.js";
+} from "../chunk-zbw2awg7.js";
 import {
   BUN_VERSION,
   LAMBDA_ENTRY_POINTS,
@@ -43,7 +43,7 @@ import {
   skillsKey,
   skipBundle,
   verifyManifest
-} from "../chunk-x093sh8z.js";
+} from "../chunk-hps5vshg.js";
 export {
   BUILD_TIMEOUT,
   BUN_VERSION,

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@deployfoundation/foundation-deploy",
-  "version": "0.2.34",
+  "version": "0.2.35",
   "description": "Deploys one Foundation instance from a published, signed release: the CDK app and the deploy tool.",
   "license": "UNLICENSED",
   "private": false,

package/src/deploy/cli.ts

@@ -42,7 +42,8 @@ commands
   deploy               build and push the agent image, cdk deploy --all, refresh
                        the runtime secret, sync config
   post-deploy          smoke DEFAULT, probe the mount, promote \`live\`, smoke \`live\`
-  config:sync          upload the runtime config and product skills to S3
+  config:sync          upload the deployed version's runtime config and the
+                       product skills to S3
   setup                first-deploy orchestration (idempotent)
   github-app-create    create the instance's GitHub App from the shipped manifest
   slack-manifest       print the instance's Slack app manifest as JSON

package/src/deploy/config-sync.ts

@@ -7,6 +7,11 @@
  * redeploy — except for `admins`, which is also baked into the gateway
  * Lambda's environment.
  *
+ * The config goes to ONE Foundation version's object (`versionedConfigKey`),
+ * which only that version's runtime reads. `deploy` names the version it
+ * deploys. A standalone `config:sync` writes for the version the Agent stack
+ * last deployed, and refuses unless it is that version itself.
+ *
  * Product skills are part of the product, not of the deployment: they come
  * from the release's `skills.tar.gz` when one is being deployed, and from this
  * checkout's `skills/` otherwise. A company's own skills are a source in its
@@ -15,10 +20,11 @@
 import { existsSync, mkdirSync, mkdtempSync, readdirSync } from "node:fs";
 import { tmpdir } from "node:os";
 import { join, resolve } from "node:path";
+import { versionedConfigKey } from "@deployfoundation/foundation-core/instance";
 import { skillsKey } from "../release/manifest.ts";
 import { type AwsContext, awsMutate, stackOutput } from "./aws.ts";
 import { FOUNDATION_ROOT } from "./paths.ts";
-import type { ResolvedRelease } from "./release.ts";
+import { type ResolvedRelease, toolVersion } from "./release.ts";
 import { run } from "./sh.ts";
 
 /**
@@ -43,22 +49,115 @@ export interface ConfigSyncOptions {
   release?: ResolvedRelease;
   /** Test seam for the download-and-unpack above. */
   releaseSkillsDir?: (ctx: AwsContext, release: ResolvedRelease) => Promise<string>;
+  /**
+   * The Foundation version whose config this writes. `deploy` and `setup`
+   * pass the version they deploy. Absent, it is the deployed version, which
+   * {@link syncVersion} checks against this tool's own.
+   */
+  version?: string;
+  /** Test seam: the Agent stack's `FoundationVersion` output. */
+  deployedVersion?: (ctx: AwsContext) => Promise<string | undefined>;
+  /** Test seam: this tool's own version, as `vX.Y.Z`. */
+  toolVersion?: string;
 }
 
-export async function configSync(ctx: AwsContext, opts: ConfigSyncOptions = {}): Promise<string> {
+/**
+ * The Foundation version the Agent stack last deployed, from its
+ * `FoundationVersion` output. `undefined` when the stack has none: a runtime
+ * deployed before config was kept per version.
+ */
+export async function deployedFoundationVersion(ctx: AwsContext): Promise<string | undefined> {
+  try {
+    return await stackOutput(ctx, ctx.names.agent, "FoundationVersion");
+  } catch (error) {
+    if (error instanceof Error && error.message.includes("has no output")) return undefined;
+    throw error;
+  }
+}
+
+/**
+ * The version a standalone `config:sync` may write for: the deployed one, and
+ * only when this tool (and the release it was asked for, if any) is that same
+ * version. The tool validated the config with its own schema; the deployed
+ * runtime parses it with its own, and those must be one schema.
+ */
+export function syncVersion(
+  ctx: AwsContext,
+  deployed: string | undefined,
+  tool: string,
+  release?: string,
+): string {
+  if (deployed === undefined)
+    throw new Error(
+      `config:sync refused: ${ctx.names.agent} records no Foundation version, so its runtime predates per-version config. Deploy ${tool} first; the deploy writes this config itself.`,
+    );
+  for (const [what, version] of [
+    ["this foundation-deploy", tool],
+    ["--release", release],
+  ] as const) {
+    if (version === undefined || version === deployed) continue;
+    throw new Error(
+      `config:sync refused: ${what} is ${version}, but ${ctx.names.agent} runs Foundation ${deployed}, whose runtime may refuse a config ${version} accepts. Run config:sync with foundation-deploy@${deployed.slice(1)}, or deploy ${version} first.`,
+    );
+  }
+  return deployed;
+}
+
+/**
+ * The data bucket. A dry run has no credentials to read a stack output with,
+ * and printing the placeholder is what every other dry-run path here does.
+ */
+async function dataBucket(ctx: AwsContext, bucket: string | undefined): Promise<string> {
+  if (bucket !== undefined) return bucket;
+  return ctx.dryRun === true
+    ? `<${ctx.names.data}.BucketName>`
+    : await stackOutput(ctx, ctx.names.data, "BucketName");
+}
+
+/**
+ * Upload the runtime config to `version`'s own object, and nothing else.
+ *
+ * Safe at any point of a deploy, because no runtime of another version reads
+ * this object. `deploy` therefore also calls it BEFORE `cdk deploy`, so the
+ * new version's pre-warmed containers find their config at boot.
+ */
+export async function uploadRuntimeConfig(
+  ctx: AwsContext,
+  opts: { bucket: string; version: string; runtimeConfigPath?: string },
+): Promise<string> {
   if (opts.runtimeConfigPath === undefined && ctx.instance.customization !== undefined)
     throw new Error(
       "customized instances require a freshly validated runtimeConfigPath; run through `deploy` or `config:sync`",
     );
   const source = opts.runtimeConfigPath ?? ctx.paths.configPath;
-  // A dry run has no credentials to read a stack output with, and printing
-  // the placeholder is what every other dry-run path here does.
-  const bucket =
-    opts.bucket ??
+  const key = versionedConfigKey(ctx.names.configKey, opts.version);
+  await awsMutate(ctx, ["s3", "cp", source, `s3://${opts.bucket}/${key}`]);
+  return key;
+}
+
+export async function configSync(ctx: AwsContext, opts: ConfigSyncOptions = {}): Promise<string> {
+  if (opts.runtimeConfigPath === undefined && ctx.instance.customization !== undefined)
+    throw new Error(
+      "customized instances require a freshly validated runtimeConfigPath; run through `deploy` or `config:sync`",
+    );
+  const tool = opts.toolVersion ?? `v${toolVersion()}`;
+  // A dry run cannot read the stack output either, so it plans this tool's.
+  const version =
+    opts.version ??
     (ctx.dryRun === true
-      ? `<${ctx.names.data}.BucketName>`
-      : await stackOutput(ctx, ctx.names.data, "BucketName"));
-  await awsMutate(ctx, ["s3", "cp", source, `s3://${bucket}/${ctx.names.configKey}`]);
+      ? tool
+      : syncVersion(
+          ctx,
+          await (opts.deployedVersion ?? deployedFoundationVersion)(ctx),
+          tool,
+          opts.release?.version,
+        ));
+  const bucket = await dataBucket(ctx, opts.bucket);
+  await uploadRuntimeConfig(ctx, {
+    bucket,
+    version,
+    ...(opts.runtimeConfigPath === undefined ? {} : { runtimeConfigPath: opts.runtimeConfigPath }),
+  });
   const skills =
     opts.release === undefined
       ? productSkillsDir(opts.foundationRoot)

package/src/deploy/deploy.ts

@@ -28,7 +28,7 @@ import {
   readSecretString,
   stackOutput,
 } from "./aws.ts";
-import { configSync } from "./config-sync.ts";
+import { configSync, uploadRuntimeConfig } from "./config-sync.ts";
 import { adminsCsvFromFile } from "./config.ts";
 import {
   cliRunner,
@@ -57,9 +57,9 @@ import { AGENT_DOCKERFILE, FOUNDATION_ROOT, INFRA_ROOT } from "./paths.ts";
 import {
   type ReleaseRequest,
   type ResolvedRelease,
+  foundationVersion,
   releaseContext,
   resolveRelease,
-  toolVersion,
 } from "./release.ts";
 import { type SlackAppSecret, composeRuntimeSecret } from "./runtime-secret.ts";
 import { run } from "./sh.ts";
@@ -243,6 +243,9 @@ export async function cdkDeploy(ctx: AwsContext, opts: CdkDeployOptions): Promis
       ? []
       : ["-c", `agentImageTag=${opts.tag}`]),
     ...(opts.release === undefined ? [] : releaseContext(opts.release)),
+    // The runtime's own version, and so the one config object it reads.
+    "-c",
+    `foundationVersion=${foundationVersion(opts.release)}`,
     ...(opts.runtimeSecretDigest === undefined
       ? []
       : ["-c", `runtimeSecretDigest=${opts.runtimeSecretDigest}`]),
@@ -604,7 +607,7 @@ async function checkLicense(
   const verify = opts.verifyLicense ?? (ctx.dryRun === true ? plannedLicenseCheck : verifyLicense);
   const result = await verify(ctx.instance.license?.key, {
     instanceId: ctx.instance.name,
-    version: release?.version ?? `v${toolVersion()}`,
+    version: foundationVersion(release),
     cache: secretsManagerLicenseCache(ctx),
   });
   console.log(`▶ license: ${result.message}`);
@@ -666,6 +669,28 @@ export async function deploy(ctx: AwsContext, opts: DeployOptions): Promise<void
     console.log(`▶ build + push agent image (${tag})`);
     console.log(`  ${await buildAndPushImage(ctx, { tag })}`);
   }
+
+  // The config of the version going in, written BEFORE `cdk deploy` creates
+  // that version, so its pre-warmed containers boot with it rather than with
+  // the fallback. Nothing else reads this object: the version serving now
+  // reads its own, which this deploy never touches. A brand-new instance has
+  // no bucket yet; the config sync after `cdk deploy` covers it.
+  const version = foundationVersion(release);
+  const bucket = phase1
+    ? undefined
+    : ctx.dryRun === true
+      ? `<${ctx.names.data}.BucketName>`
+      : await optionalOutput(ctx, ctx.names.data, "BucketName");
+  if (bucket !== undefined) {
+    console.log(`▶ config for ${version}, ahead of the runtime version that reads it`);
+    const key = await uploadRuntimeConfig(ctx, {
+      bucket,
+      version,
+      runtimeConfigPath: customization.runtimeConfigPath,
+    });
+    console.log(`  s3://${bucket}/${key}`);
+  }
+
   console.log(
     `▶ cdk deploy --all${
       phase1
@@ -700,12 +725,13 @@ export async function deploy(ctx: AwsContext, opts: DeployOptions): Promise<void
     redeploy: (digest) => deployStacks(digest),
   });
 
-  console.log("▶ config sync");
-  const bucket = await configSync(ctx, {
+  console.log(`▶ config sync (${version})`);
+  const synced = await configSync(ctx, {
+    version,
     runtimeConfigPath: customization.runtimeConfigPath,
     ...(release === undefined ? {} : { release }),
   });
-  console.log(`config + skills synced to s3://${bucket}/`);
+  console.log(`config + skills synced to s3://${synced}/`);
 
   if (!phase1 && promotesInline()) {
     console.log("▶ smoke test, then promote the `live` endpoint");

package/src/deploy/release.ts

@@ -93,6 +93,14 @@ export function toolVersion(infraRoot: string = INFRA_ROOT): string {
   return version;
 }
 
+/**
+ * The Foundation version a deploy puts in: the release's, or this tool's own
+ * for a local build, whose image is built from this same checkout.
+ */
+export function foundationVersion(release?: { version: string }): string {
+  return release?.version ?? `v${toolVersion()}`;
+}
+
 /**
  * Is there a Foundation workspace here to build Lambda bundles from?
  *

package/src/deploy/setup.ts

@@ -47,7 +47,7 @@ import {
 } from "./endpoint.ts";
 import { currentImageTag } from "./image.ts";
 import { FOUNDATION_ROOT, INFRA_ROOT } from "./paths.ts";
-import { hasFoundationWorkspace } from "./release.ts";
+import { foundationVersion, hasFoundationWorkspace } from "./release.ts";
 import { run, runCapture } from "./sh.ts";
 import { slackManifestFor } from "./slack-manifest.ts";
 import { stageCustomization } from "./stage-customization.ts";
@@ -374,6 +374,8 @@ export async function setup(
   const bucket = await configSync(ctx, {
     bucket: await output(ctx, ctx.names.data, "BucketName"),
     runtimeConfigPath,
+    // Setup builds the image from this checkout, so it is this tool's version.
+    version: foundationVersion(),
   });
   console.log(`  s3://${bucket}/`);
 

package/src/stacks/agent-stack.ts

@@ -1,3 +1,4 @@
+import { FOUNDATION_VERSION_RE } from "@deployfoundation/foundation-core/instance";
 import * as cdk from "aws-cdk-lib";
 import type * as dynamodb from "aws-cdk-lib/aws-dynamodb";
 import type * as ec2 from "aws-cdk-lib/aws-ec2";
@@ -8,7 +9,12 @@ import * as logs from "aws-cdk-lib/aws-logs";
 import type * as s3 from "aws-cdk-lib/aws-s3";
 import type * as secretsmanager from "aws-cdk-lib/aws-secretsmanager";
 import type { Construct } from "constructs";
-import { agentImage, agentImageTagRequired, releaseImageRepositoryArn } from "../artifacts.ts";
+import {
+  agentImage,
+  agentImageTagRequired,
+  releaseImageRepositoryArn,
+  releaseSource,
+} from "../artifacts.ts";
 import {
   type Instance,
   type InstanceNames,
@@ -177,6 +183,7 @@ export class FoundationAgent extends cdk.Stack {
         `${id}: -c agentImageTag=<tag> is required when deploying the runtime. Pass the tag of an image already pushed to the ${names.ecrRepo} repository, deploy a release with -c release=<version>, or run the bootstrap phase with -c deployRuntime=false.`,
       );
     }
+    const foundationVersion = foundationVersionContext(this, id);
 
     const explicitSubnets = String(this.node.tryGetContext("agentSubnetIds") ?? "")
       .split(",")
@@ -242,6 +249,11 @@ export class FoundationAgent extends cdk.Stack {
           RUNTIME_SECRET_ID: props.secrets.runtime.secretName,
           AWS_REGION: this.region,
           FOUNDATION_WORKSPACE_ROOT: "/workspace",
+          // Which Foundation this version runs, and so the one config object
+          // it reads (`config/<version>/…`). Here and not in the runtime
+          // secret: that secret is shared by every version still serving,
+          // while this map belongs to one runtime version.
+          FOUNDATION_VERSION: foundationVersion,
           // Which runtime secret the containers of this version boot with.
           // Nothing reads it: it is here so that a deploy whose secret refresh
           // changed the secret can cut a new version through CloudFormation
@@ -260,6 +272,9 @@ export class FoundationAgent extends cdk.Stack {
 
     this.agentRuntimeArn = runtime.getAtt("AgentRuntimeArn").toString();
     this.outputs();
+    // What `config:sync` writes for, and refuses to write past: the version of
+    // the runtime this stack last deployed.
+    new cdk.CfnOutput(this, "FoundationVersion", { value: foundationVersion });
   }
 
   private outputs(): void {
@@ -999,7 +1014,9 @@ export class FoundationAgent extends cdk.Stack {
     }
     // Config and curated skills are deployment-owned: direct S3 API writes are
     // limited to memory/*. The separate fs/* persistent mount remains writable
-    // through S3 Files for workspace state and learned skills.
+    // through S3 Files for workspace state and learned skills. Reads are not
+    // scoped to one version's `config/<version>/`: this one role serves every
+    // runtime version still running, the outgoing one included.
     role.addToPolicy(
       new iam.PolicyStatement({
         sid: "ConfigAndSkills",
@@ -1201,6 +1218,28 @@ function secretArnPattern(secret: secretsmanager.ISecret): string {
   return secret.secretFullArn ?? `${secret.secretArn}-??????`;
 }
 
+/**
+ * The Foundation version this runtime version runs, which picks the one config
+ * object it reads (`versionedConfigKey`). `-c foundationVersion=vX.Y.Z` comes
+ * from the deploy tool; a release synth may omit it and use the release's own.
+ */
+function foundationVersionContext(scope: Construct, id: string): string {
+  const explicit = String(scope.node.tryGetContext("foundationVersion") ?? "");
+  const release = releaseSource(scope)?.version;
+  if (explicit !== "" && release !== undefined && explicit !== release)
+    throw new Error(
+      `${id}: -c foundationVersion=${explicit} but the release being deployed is ${release}`,
+    );
+  const version = explicit !== "" ? explicit : (release ?? "");
+  if (version === "")
+    throw new Error(
+      `${id}: -c foundationVersion=<vX.Y.Z> is required when deploying the runtime: it reads only its own version's config. foundation-deploy passes it.`,
+    );
+  if (!FOUNDATION_VERSION_RE.test(version))
+    throw new Error(`${id}: foundationVersion must look like v0.2.34, got "${version}"`);
+  return version;
+}
+
 /**
  * `-c runtimeSecretDigest=<16 hex>`, from `runtimeSecretDigest()` in the
  * deploy tool. Absent means "not known", which a first `cdk deploy` of a