@deployfoundation/foundation-deploy 0.2.36 → 0.2.38

package/dist/bin/app.js

@@ -8,13 +8,13 @@ import {
   FoundationPages,
   FoundationPipeline,
   NewsletterStack
-} from "../chunk-zbw2awg7.js";
+} from "../chunk-j52g7bsc.js";
 import {
   adminsFor,
   instanceNames,
   loadInstanceFile,
   provisionsIntegration
-} from "../chunk-hps5vshg.js";
+} from "../chunk-2ra18dqx.js";
 
 // bin/app.ts
 import { execFileSync } from "node:child_process";

package/dist/bin/foundation-deploy.js

@@ -30,7 +30,7 @@ import {
   stackExists,
   stackOutput,
   toolVersion
-} from "../chunk-gmdzzrc4.js";
+} from "../chunk-8e2z4rhf.js";
 import {
   BASE_SLACK_EVENTS,
   CAPABILITY_IDS,
@@ -47,7 +47,7 @@ import {
   skillsKey,
   slackCommandPrefix,
   versionedConfigKey
-} from "../chunk-hps5vshg.js";
+} from "../chunk-2ra18dqx.js";
 
 // src/deploy/config-sync.ts
 import { existsSync, mkdirSync, mkdtempSync, readdirSync } from "node:fs";

package/dist/bin/release-account.js

@@ -1,8 +1,8 @@
 #!/usr/bin/env bun
 import {
   DEFAULT_RELEASE_BUCKET
-} from "../chunk-gmdzzrc4.js";
-import"../chunk-hps5vshg.js";
+} from "../chunk-8e2z4rhf.js";
+import"../chunk-2ra18dqx.js";
 
 // bin/release-account.ts
 import * as cdk2 from "aws-cdk-lib";

package/dist/{chunk-hps5vshg.js → chunk-2ra18dqx.js}

@@ -864,6 +864,12 @@ function requiredSlackCommandSuffixes(enabled) {
   return [...suffixes].sort();
 }
 
+// ../core/src/proactive.ts
+var PROACTIVE_CHANNEL_MODES = ["triage", "alerts"];
+function encodeProactiveChannels(channels) {
+  return channels.map((channel) => channel.mode === "triage" ? channel.id : `${channel.id}:${channel.mode}`).join(",");
+}
+
 // ../core/src/instance.ts
 var PENDING = "TBD";
 var CUSTOMIZATION_ARTIFACT_NAME = "Customization";
@@ -915,8 +921,15 @@ var RawCustomization = z2.object({
   path: z2.string().refine(normalizedRelativePosixPath, "customization.path must be a normalized relative POSIX path"),
   required: z2.boolean().default(true)
 }).strict();
+var ProactiveChannelId = z2.string().regex(/^[CG][A-Z0-9]{8,}$/);
+var RawProactiveChannel = z2.union([
+  ProactiveChannelId.transform((id) => ({ id, mode: "triage" })),
+  z2.object({ id: ProactiveChannelId, mode: z2.enum(PROACTIVE_CHANNEL_MODES).default("triage") }).strict()
+]);
 var RawProactive = z2.object({
-  channels: z2.array(z2.string().regex(/^[CG][A-Z0-9]{8,}$/)).default([]),
+  channels: z2.array(RawProactiveChannel).default([]).refine((channels) => new Set(channels.map((c) => c.id)).size === channels.length, {
+    message: "a channel may be listed only once"
+  }),
   maxPerHour: z2.number().int().min(1).max(500).default(20)
 }).strict().default({ channels: [] });
 var RawRuntime = z2.object({
@@ -1886,4 +1899,4 @@ function ecrRepositoryArn(repositoryUri) {
   return `arn:aws:ecr:${region}:${account}:repository/${name}`;
 }
 
-export { parseSchedule, BASE_SLACK_EVENTS, CAPABILITY_IDS, requiredGithubPermissions, requiredSlackScopes, requiredSlackCommands, CUSTOMIZATION_ARTIFACT_NAME, newsletterManifestFor, FOUNDATION_VERSION_RE, versionedConfigKey, instanceNames, slackCommandPrefix, slackCommandPrefixes, isScheduledJob, isWebhookJob, webhookJobBindings, scheduledJobBindings, jobWebhookKey, capabilityScheduledJobs, crmOutreachConfigured, crmPolicyFingerprint, parseInstanceConfig, loadInstanceFile, configPathFor, capabilityEnabled, requiresAuthenticatedQueue, enabledIntegrations, provisionsIntegration, adminsFor, WEB_SEARCH_TARGET, WEB_SEARCH_CONNECTOR_VERSION, LIVE_ENDPOINT_NAME, RELEASE_VERSION_RE, parseManifest, manifestKey, lambdaKey, skillsKey, buildManifest, manifestSigningPayload, verifyManifest, lambdaBundleContext, BUN_VERSION, LAMBDA_ENTRY_POINTS, skipBundle, RELEASE_BUCKET_ENV, RELEASE_DIR_ENV, releaseCacheDir, releaseSource, lambdaCode, agentImage, agentImageTagRequired, releaseImageRepositoryArn, ecrRepositoryArn };
+export { parseSchedule, BASE_SLACK_EVENTS, CAPABILITY_IDS, requiredGithubPermissions, requiredSlackScopes, requiredSlackCommands, encodeProactiveChannels, CUSTOMIZATION_ARTIFACT_NAME, newsletterManifestFor, FOUNDATION_VERSION_RE, versionedConfigKey, instanceNames, slackCommandPrefix, slackCommandPrefixes, isScheduledJob, isWebhookJob, webhookJobBindings, scheduledJobBindings, jobWebhookKey, capabilityScheduledJobs, crmOutreachConfigured, crmPolicyFingerprint, parseInstanceConfig, loadInstanceFile, configPathFor, capabilityEnabled, requiresAuthenticatedQueue, enabledIntegrations, provisionsIntegration, adminsFor, WEB_SEARCH_TARGET, WEB_SEARCH_CONNECTOR_VERSION, LIVE_ENDPOINT_NAME, RELEASE_VERSION_RE, parseManifest, manifestKey, lambdaKey, skillsKey, buildManifest, manifestSigningPayload, verifyManifest, lambdaBundleContext, BUN_VERSION, LAMBDA_ENTRY_POINTS, skipBundle, RELEASE_BUCKET_ENV, RELEASE_DIR_ENV, releaseCacheDir, releaseSource, lambdaCode, agentImage, agentImageTagRequired, releaseImageRepositoryArn, ecrRepositoryArn };

package/dist/{chunk-gmdzzrc4.js → chunk-8e2z4rhf.js}

@@ -6,7 +6,7 @@ import {
   manifestKey,
   releaseCacheDir,
   verifyManifest
-} from "./chunk-hps5vshg.js";
+} from "./chunk-2ra18dqx.js";
 
 // src/deploy/release.ts
 import { existsSync as existsSync2, mkdirSync, readFileSync as readFileSync2 } from "node:fs";

package/dist/{chunk-zbw2awg7.js → chunk-j52g7bsc.js}

@@ -9,6 +9,7 @@ import {
   capabilityScheduledJobs,
   crmOutreachConfigured,
   crmPolicyFingerprint,
+  encodeProactiveChannels,
   instanceNames,
   isScheduledJob,
   lambdaCode,
@@ -22,7 +23,7 @@ import {
   scheduledJobBindings,
   slackCommandPrefixes,
   webhookJobBindings
-} from "./chunk-hps5vshg.js";
+} from "./chunk-2ra18dqx.js";
 
 // src/stacks/agent-stack.ts
 import * as cdk from "aws-cdk-lib";
@@ -1063,7 +1064,7 @@ class FoundationApi extends cdk2.Stack {
       },
       FOUNDATION_INSTANCE: props.instance.name,
       FOUNDATION_COMMAND_PREFIXES: slackCommandPrefixes(props.instance).join(","),
-      FOUNDATION_PROACTIVE_CHANNELS: props.instance.proactive.channels.join(","),
+      FOUNDATION_PROACTIVE_CHANNELS: encodeProactiveChannels(props.instance.proactive.channels),
       FOUNDATION_PROACTIVE_MAX_PER_HOUR: String(props.instance.proactive.maxPerHour),
       ...jobsWebhookSecret === undefined ? {} : {
         FOUNDATION_WEBHOOK_JOBS: JSON.stringify(webhookJobs),
@@ -1106,6 +1107,7 @@ class FoundationApi extends cdk2.Stack {
       sid: "ReadRuntimeEndpointVersion",
       actions: ["bedrock-agentcore:GetAgentRuntimeEndpoint"],
       resources: [
+        `arn:${this.partition}:bedrock-agentcore:${this.region}:${this.account}:runtime/${names.runtimeName}*`,
         `arn:${this.partition}:bedrock-agentcore:${this.region}:${this.account}:runtime/${names.runtimeName}*/runtime-endpoint/*`
       ]
     }));
@@ -1438,6 +1440,11 @@ class FoundationApi extends cdk2.Stack {
         actions: ["dynamodb:GetItem", "dynamodb:PutItem", "dynamodb:DeleteItem"],
         resources: [upworkApprovalTable.tableArn]
       }));
+      upworkProxyRole.addToPolicy(new iam2.PolicyStatement({
+        sid: "UpworkDraftDataKey",
+        actions: ["kms:Decrypt", "kms:Encrypt", "kms:GenerateDataKey", "kms:DescribeKey"],
+        resources: [props.dataKey.keyArn]
+      }));
       this.upworkProxyFunction = new lambda.Function(this, "UpworkProxyFunction", {
         functionName: names.upworkProxyFunctionName,
         runtime: lambda.Runtime.NODEJS_22_X,

package/dist/src/index.js

@@ -10,7 +10,7 @@ import {
   FoundationPipeline,
   NewsletterStack,
   deployStatements
-} from "../chunk-zbw2awg7.js";
+} from "../chunk-j52g7bsc.js";
 import {
   BUN_VERSION,
   LAMBDA_ENTRY_POINTS,
@@ -43,7 +43,7 @@ import {
   skillsKey,
   skipBundle,
   verifyManifest
-} from "../chunk-hps5vshg.js";
+} from "../chunk-2ra18dqx.js";
 export {
   BUILD_TIMEOUT,
   BUN_VERSION,

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@deployfoundation/foundation-deploy",
-  "version": "0.2.36",
+  "version": "0.2.38",
   "description": "Deploys one Foundation instance from a published, signed release: the CDK app and the deploy tool.",
   "license": "UNLICENSED",
   "private": false,

package/src/stacks/api-stack.ts

@@ -9,6 +9,7 @@ import {
   capabilityScheduledJobs,
   crmOutreachConfigured,
   crmPolicyFingerprint,
+  encodeProactiveChannels,
   isScheduledJob,
   parseInstanceConfig,
   scheduledJobBindings,
@@ -479,7 +480,7 @@ export class FoundationApi extends cdk.Stack {
           }),
       FOUNDATION_INSTANCE: props.instance.name,
       FOUNDATION_COMMAND_PREFIXES: slackCommandPrefixes(props.instance).join(","),
-      FOUNDATION_PROACTIVE_CHANNELS: props.instance.proactive.channels.join(","),
+      FOUNDATION_PROACTIVE_CHANNELS: encodeProactiveChannels(props.instance.proactive.channels),
       FOUNDATION_PROACTIVE_MAX_PER_HOUR: String(props.instance.proactive.maxPerHour),
       ...(jobsWebhookSecret === undefined
         ? {}
@@ -534,7 +535,10 @@ export class FoundationApi extends cdk.Stack {
       new iam.PolicyStatement({
         sid: "ReadRuntimeEndpointVersion",
         actions: ["bedrock-agentcore:GetAgentRuntimeEndpoint"],
+        // AgentCore authorizes this call against BOTH the runtime and the
+        // endpoint (CloudTrail, 2026-10-11): the endpoint alone is denied.
         resources: [
+          `arn:${this.partition}:bedrock-agentcore:${this.region}:${this.account}:runtime/${names.runtimeName}*`,
           `arn:${this.partition}:bedrock-agentcore:${this.region}:${this.account}:runtime/${names.runtimeName}*/runtime-endpoint/*`,
         ],
       }),
@@ -1006,6 +1010,15 @@ export class FoundationApi extends cdk.Stack {
           resources: [upworkApprovalTable.tableArn],
         }),
       );
+      // The approval table is encrypted with the instance data key: without it
+      // every draft write fails (Sky, 2026-10-11, prepare_proposal proxy_error).
+      upworkProxyRole.addToPolicy(
+        new iam.PolicyStatement({
+          sid: "UpworkDraftDataKey",
+          actions: ["kms:Decrypt", "kms:Encrypt", "kms:GenerateDataKey", "kms:DescribeKey"],
+          resources: [props.dataKey.keyArn],
+        }),
+      );
       this.upworkProxyFunction = new lambda.Function(this, "UpworkProxyFunction", {
         functionName: names.upworkProxyFunctionName,
         runtime: lambda.Runtime.NODEJS_22_X,