@deployfoundation/foundation-deploy 0.2.38 → 0.2.39

package/dist/bin/release-account.js

@@ -1,8 +1,7 @@
 #!/usr/bin/env bun
 import {
   DEFAULT_RELEASE_BUCKET
-} from "../chunk-8e2z4rhf.js";
-import"../chunk-2ra18dqx.js";
+} from "../chunk-dz91avrb.js";
 
 // bin/release-account.ts
 import * as cdk2 from "aws-cdk-lib";

package/dist/{chunk-j52g7bsc.js → chunk-6v0ewr5b.js}

@@ -17,13 +17,14 @@ import {
   parseInstanceConfig,
   parseSchedule,
   provisionsIntegration,
+  releaseAccess,
   releaseImageRepositoryArn,
   releaseSource,
   requiresAuthenticatedQueue,
   scheduledJobBindings,
   slackCommandPrefixes,
   webhookJobBindings
-} from "./chunk-2ra18dqx.js";
+} from "./chunk-7rd8c1th.js";
 
 // src/stacks/agent-stack.ts
 import * as cdk from "aws-cdk-lib";
@@ -1846,6 +1847,18 @@ function deployStatements(stack, names, targets, instance) {
   const runtimeSecret = secretArn(names.secretRuntime);
   const knockOauthClient = secretArn(names.secretKnockOauthClient);
   return [
+    new iam3.PolicyStatement({
+      sid: "ReadFoundationRelease",
+      actions: ["s3:GetObject"],
+      resources: [`arn:${stack.partition}:s3:::${targets.release.bucket}/releases/*`]
+    }),
+    ...targets.release.signingKeyArn === undefined ? [] : [
+      new iam3.PolicyStatement({
+        sid: "VerifyReleaseSignature",
+        actions: ["kms:Verify"],
+        resources: [targets.release.signingKeyArn]
+      })
+    ],
     new iam3.PolicyStatement({
       sid: "AssumeCdkBootstrapRoles",
       actions: ["sts:AssumeRole"],
@@ -1927,7 +1940,8 @@ function deployStatements(stack, names, targets, instance) {
         "bedrock-agentcore:GetAgentRuntime",
         "bedrock-agentcore:ListAgentRuntimeVersions",
         "bedrock-agentcore:GetAgentRuntimeEndpoint",
-        "bedrock-agentcore:UpdateAgentRuntimeEndpoint"
+        "bedrock-agentcore:UpdateAgentRuntimeEndpoint",
+        "bedrock-agentcore:CreateAgentRuntimeEndpoint"
       ],
       resources: [
         `arn:${stack.partition}:bedrock-agentcore:${stack.region}:${stack.account}:runtime/${names.runtimeName}*`,
@@ -1970,7 +1984,7 @@ class FoundationCi extends cdk3.Stack {
       }),
       inlinePolicies: {
         FoundationDeploy: new iam4.PolicyDocument({
-          statements: deployStatements(this, names, { bucket: props.bucket, dataKey: props.dataKey }, props.instance)
+          statements: deployStatements(this, names, { bucket: props.bucket, dataKey: props.dataKey, release: releaseAccess(this) }, props.instance)
         })
       }
     });
@@ -3453,7 +3467,7 @@ class FoundationPipeline extends cdk8.Stack {
       assumedBy: new iam9.ServicePrincipal("codebuild.amazonaws.com"),
       inlinePolicies: {
         FoundationDeploy: new iam9.PolicyDocument({
-          statements: deployStatements(this, names, { bucket: props.bucket, dataKey: props.dataKey }, props.instance)
+          statements: deployStatements(this, names, { bucket: props.bucket, dataKey: props.dataKey, release: releaseAccess(this) }, props.instance)
         })
       }
     });

package/dist/{chunk-2ra18dqx.js → chunk-7rd8c1th.js}

@@ -1,3 +1,8 @@
+import {
+  DEFAULT_RELEASE_BUCKET,
+  configuredKeyArn
+} from "./chunk-dz91avrb.js";
+
 // ../core/src/instance.ts
 import { parse as parseYaml } from "yaml";
 import { z as z2 } from "zod";
@@ -1816,6 +1821,14 @@ function releaseSource(scope) {
     throw new Error(`-c releaseBucket=<name> is required when deploying a release (or set ${RELEASE_BUCKET_ENV}); it is the bucket holding ${manifest.lambda.gateway?.key ?? "the release artifacts"}`);
   return { version: manifest.version, bucket, manifest };
 }
+function releaseAccess(scope, env = process.env) {
+  const context = scope.node.tryGetContext("releaseBucket");
+  const fromContext = typeof context === "string" && context !== "" ? context : undefined;
+  const fromEnv = env[RELEASE_BUCKET_ENV];
+  const bucket = fromContext ?? (fromEnv !== undefined && fromEnv !== "" ? fromEnv : DEFAULT_RELEASE_BUCKET);
+  const signingKeyArn = configuredKeyArn(env);
+  return { bucket, ...signingKeyArn === undefined ? {} : { signingKeyArn } };
+}
 function releaseBucket(scope, source) {
   const stack = cdk.Stack.of(scope);
   const existing = stack.node.tryFindChild("FoundationReleaseBucket");
@@ -1899,4 +1912,4 @@ function ecrRepositoryArn(repositoryUri) {
   return `arn:aws:ecr:${region}:${account}:repository/${name}`;
 }
 
-export { parseSchedule, BASE_SLACK_EVENTS, CAPABILITY_IDS, requiredGithubPermissions, requiredSlackScopes, requiredSlackCommands, encodeProactiveChannels, CUSTOMIZATION_ARTIFACT_NAME, newsletterManifestFor, FOUNDATION_VERSION_RE, versionedConfigKey, instanceNames, slackCommandPrefix, slackCommandPrefixes, isScheduledJob, isWebhookJob, webhookJobBindings, scheduledJobBindings, jobWebhookKey, capabilityScheduledJobs, crmOutreachConfigured, crmPolicyFingerprint, parseInstanceConfig, loadInstanceFile, configPathFor, capabilityEnabled, requiresAuthenticatedQueue, enabledIntegrations, provisionsIntegration, adminsFor, WEB_SEARCH_TARGET, WEB_SEARCH_CONNECTOR_VERSION, LIVE_ENDPOINT_NAME, RELEASE_VERSION_RE, parseManifest, manifestKey, lambdaKey, skillsKey, buildManifest, manifestSigningPayload, verifyManifest, lambdaBundleContext, BUN_VERSION, LAMBDA_ENTRY_POINTS, skipBundle, RELEASE_BUCKET_ENV, RELEASE_DIR_ENV, releaseCacheDir, releaseSource, lambdaCode, agentImage, agentImageTagRequired, releaseImageRepositoryArn, ecrRepositoryArn };
+export { parseSchedule, BASE_SLACK_EVENTS, CAPABILITY_IDS, requiredGithubPermissions, requiredSlackScopes, requiredSlackCommands, encodeProactiveChannels, CUSTOMIZATION_ARTIFACT_NAME, newsletterManifestFor, FOUNDATION_VERSION_RE, versionedConfigKey, instanceNames, slackCommandPrefix, slackCommandPrefixes, isScheduledJob, isWebhookJob, webhookJobBindings, scheduledJobBindings, jobWebhookKey, capabilityScheduledJobs, crmOutreachConfigured, crmPolicyFingerprint, parseInstanceConfig, loadInstanceFile, configPathFor, capabilityEnabled, requiresAuthenticatedQueue, enabledIntegrations, provisionsIntegration, adminsFor, WEB_SEARCH_TARGET, WEB_SEARCH_CONNECTOR_VERSION, LIVE_ENDPOINT_NAME, RELEASE_VERSION_RE, parseManifest, manifestKey, lambdaKey, skillsKey, buildManifest, manifestSigningPayload, verifyManifest, lambdaBundleContext, BUN_VERSION, LAMBDA_ENTRY_POINTS, skipBundle, RELEASE_BUCKET_ENV, RELEASE_DIR_ENV, releaseCacheDir, releaseSource, releaseAccess, lambdaCode, agentImage, agentImageTagRequired, releaseImageRepositoryArn, ecrRepositoryArn };

package/dist/chunk-dz91avrb.js

@@ -0,0 +1,16 @@
+// src/release/trust.ts
+var DEFAULT_RELEASE_BUCKET = "foundry41-foundation-releases";
+var RELEASE_KMS_KEY_ARN_ENV = "FOUNDATION_RELEASE_KMS_KEY_ARN";
+var RELEASE_KMS_KEY_ARN = "arn:aws:kms:us-east-1:793593623536:key/fba7d9f3-e9b6-49ae-b4a5-c8c5f1429231";
+function configuredKeyArn(env = process.env) {
+  const configured = env[RELEASE_KMS_KEY_ARN_ENV] ?? RELEASE_KMS_KEY_ARN;
+  return configured === undefined || configured === "" ? undefined : configured;
+}
+function expectedKeyArn(env = process.env) {
+  const configured = configuredKeyArn(env);
+  if (configured === undefined)
+    throw new Error(`no Foundation release signing key is configured; set ${RELEASE_KMS_KEY_ARN_ENV} to the key ARN published with the release`);
+  return configured;
+}
+
+export { DEFAULT_RELEASE_BUCKET, configuredKeyArn, expectedKeyArn };

package/dist/src/index.js

@@ -10,7 +10,7 @@ import {
   FoundationPipeline,
   NewsletterStack,
   deployStatements
-} from "../chunk-j52g7bsc.js";
+} from "../chunk-6v0ewr5b.js";
 import {
   BUN_VERSION,
   LAMBDA_ENTRY_POINTS,
@@ -36,6 +36,7 @@ import {
   manifestSigningPayload,
   parseManifest,
   provisionsIntegration,
+  releaseAccess,
   releaseCacheDir,
   releaseImageRepositoryArn,
   releaseSource,
@@ -43,7 +44,8 @@ import {
   skillsKey,
   skipBundle,
   verifyManifest
-} from "../chunk-2ra18dqx.js";
+} from "../chunk-7rd8c1th.js";
+import"../chunk-dz91avrb.js";
 export {
   BUILD_TIMEOUT,
   BUN_VERSION,
@@ -80,6 +82,7 @@ export {
   instanceNames as namesFor,
   parseManifest,
   provisionsIntegration,
+  releaseAccess,
   releaseCacheDir,
   releaseImageRepositoryArn,
   releaseSource,

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@deployfoundation/foundation-deploy",
-  "version": "0.2.38",
+  "version": "0.2.39",
   "description": "Deploys one Foundation instance from a published, signed release: the CDK app and the deploy tool.",
   "license": "UNLICENSED",
   "private": false,

package/src/artifacts.ts

@@ -41,6 +41,7 @@ import * as s3 from "aws-cdk-lib/aws-s3";
 import type { Construct } from "constructs";
 import { lambdaBundleContext } from "./lambda-bundle-context.ts";
 import { type ReleaseManifest, parseManifest } from "./release/manifest.ts";
+import { DEFAULT_RELEASE_BUCKET, configuredKeyArn } from "./release/trust.ts";
 
 /** Pinned Bun used to bundle every Lambda (and the docker fallback image tag). */
 export const BUN_VERSION = "1.4.0";
@@ -174,6 +175,38 @@ export function releaseSource(scope: Construct): ReleaseSource | undefined {
   return { version: manifest.version, bucket, manifest };
 }
 
+/**
+ * What a deployer of this app reads from Foundation's release account: the
+ * bucket the tool fetches `releases/*` from and the key whose signature it
+ * checks. The deployer roles (`deploy-permissions.ts`) are granted exactly
+ * these, cross-account, so a CodePipeline or GitHub Actions deploy can verify
+ * a release the way an admin's laptop can.
+ *
+ * Resolved the way `foundation-deploy` resolves them — `-c releaseBucket`
+ * (which the tool passes on a release deploy) or `FOUNDATION_RELEASE_BUCKET`,
+ * else the default bucket; `FOUNDATION_RELEASE_KMS_KEY_ARN`, else the pinned
+ * key — and resolved on EVERY synth, release or local build, so the grant does
+ * not come and go with how the last deploy was run.
+ */
+export interface ReleaseAccess {
+  bucket: string;
+  /** Absent only when no signing key is configured at all; nothing is verified then. */
+  signingKeyArn?: string;
+}
+
+export function releaseAccess(
+  scope: Construct,
+  env: Record<string, string | undefined> = process.env,
+): ReleaseAccess {
+  const context: unknown = scope.node.tryGetContext("releaseBucket");
+  const fromContext = typeof context === "string" && context !== "" ? context : undefined;
+  const fromEnv = env[RELEASE_BUCKET_ENV];
+  const bucket =
+    fromContext ?? (fromEnv !== undefined && fromEnv !== "" ? fromEnv : DEFAULT_RELEASE_BUCKET);
+  const signingKeyArn = configuredKeyArn(env);
+  return { bucket, ...(signingKeyArn === undefined ? {} : { signingKeyArn }) };
+}
+
 /**
  * The release bucket as one imported construct per stack. Every Lambda in a
  * stack references the same bucket, and importing it once keeps the template's

package/src/deploy/release.ts

@@ -29,34 +29,10 @@ import {
   manifestKey,
   verifyManifest,
 } from "../release/manifest.ts";
+import { DEFAULT_RELEASE_BUCKET, expectedKeyArn } from "../release/trust.ts";
 import { type AwsCallContext, aws } from "./aws.ts";
 import { FOUNDATION_ROOT, INFRA_ROOT } from "./paths.ts";
 
-/**
- * The bucket a release is fetched from when nothing says otherwise.
- *
- * One name, owned by Foundry 41, created by `release-account-stack.ts`. A
- * mirror is `--release-bucket` or `FOUNDATION_RELEASE_BUCKET`, and the
- * signature is what makes a mirror safe to use.
- */
-export const DEFAULT_RELEASE_BUCKET = "foundry41-foundation-releases";
-
-/** The env var that names the key a deployer will accept a manifest from. */
-export const RELEASE_KMS_KEY_ARN_ENV = "FOUNDATION_RELEASE_KMS_KEY_ARN";
-
-/**
- * The Foundation release signing key, in the Foundry 41 release account
- * (793593623536), created by `ReleaseAccountStack` on 2026-09-20.
- *
- * This constant is what makes signature verification mean anything: a
- * deployer refuses a manifest signed by any other key. Changing it rotates
- * the root of trust for every customer, so it changes only with a key
- * rotation and a release that says so. {@link RELEASE_KMS_KEY_ARN_ENV}
- * overrides it, for a private mirror or a test key.
- */
-export const RELEASE_KMS_KEY_ARN: string | undefined =
-  "arn:aws:kms:us-east-1:793593623536:key/fba7d9f3-e9b6-49ae-b4a5-c8c5f1429231";
-
 /** What the caller asked for, before anything has been fetched. */
 export interface ReleaseRequest {
   /** `vX.Y.Z`, when the caller named a version or one was implied. */
@@ -149,16 +125,6 @@ export function releaseRequest(
   return { version, bucket };
 }
 
-/** The key ARN a deployer will accept a manifest from. */
-export function expectedKeyArn(env: Record<string, string | undefined> = process.env): string {
-  const configured = env[RELEASE_KMS_KEY_ARN_ENV] ?? RELEASE_KMS_KEY_ARN;
-  if (configured === undefined || configured === "")
-    throw new Error(
-      `no Foundation release signing key is configured; set ${RELEASE_KMS_KEY_ARN_ENV} to the key ARN published with the release`,
-    );
-  return configured;
-}
-
 export interface ResolveReleaseDeps {
   /** Defaults to the SDK-backed verifier for the expected key. */
   kms?: KmsVerifier;

package/src/deploy-permissions.ts

@@ -17,6 +17,7 @@ import type * as cdk from "aws-cdk-lib";
 import * as iam from "aws-cdk-lib/aws-iam";
 import type * as kms from "aws-cdk-lib/aws-kms";
 import type * as s3 from "aws-cdk-lib/aws-s3";
+import type { ReleaseAccess } from "./artifacts.ts";
 import { type Instance, type InstanceNames, provisionsIntegration } from "./names.ts";
 
 export interface DeployTargets {
@@ -24,6 +25,13 @@ export interface DeployTargets {
   bucket: s3.IBucket;
   /** The CMK that bucket is encrypted with. */
   dataKey: kms.IKey;
+  /**
+   * Foundation's release bucket and signing key, in the release account
+   * (`releaseAccess()` in `artifacts.ts`). Cross-account access needs BOTH
+   * sides to allow it: the release account's bucket and key policies name the
+   * customer account, and the statements below are this account's half.
+   */
+  release: ReleaseAccess;
 }
 
 /**
@@ -49,6 +57,30 @@ export function deployStatements(
   const knockOauthClient = secretArn(names.secretKnockOauthClient);
 
   return [
+    // A release deploy, before anything else: `aws s3 cp` of
+    // `releases/<v>/manifest.json`, then of every Lambda zip and
+    // `skills.tar.gz` the manifest names (the digest check in `verifyRelease`),
+    // and of `skills.tar.gz` again for the config sync (`unpackReleaseSkills`).
+    // HeadObject is authorized by s3:GetObject. The bucket is SSE-S3, so there
+    // is no key to grant for it.
+    new iam.PolicyStatement({
+      sid: "ReadFoundationRelease",
+      actions: ["s3:GetObject"],
+      resources: [`arn:${stack.partition}:s3:::${targets.release.bucket}/releases/*`],
+    }),
+    // ...and the manifest's signature, checked with one KMS `Verify` against
+    // the pinned key (`src/release/kms.ts`); nothing calls GetPublicKey or
+    // DescribeKey. By key ARN, not alias: an identity policy cannot name
+    // another account's key by its alias.
+    ...(targets.release.signingKeyArn === undefined
+      ? []
+      : [
+          new iam.PolicyStatement({
+            sid: "VerifyReleaseSignature",
+            actions: ["kms:Verify"],
+            resources: [targets.release.signingKeyArn],
+          }),
+        ]),
     // How `cdk deploy` does everything else: it assumes the bootstrap roles for
     // lookup, asset publishing and the CloudFormation call.
     new iam.PolicyStatement({
@@ -140,8 +172,10 @@ export function deployStatements(
       actions: ["kms:Encrypt", "kms:Decrypt", "kms:GenerateDataKey*"],
       resources: [targets.dataKey.keyArn],
     }),
-    // `foundation-deploy post-deploy`: the smoke test (`_smoke_test`,
-    // `_fs_probe`) against DEFAULT, then promotion of the new version onto `live`.
+    // `foundation-deploy post-deploy` (and `deploy`'s inline promotion): the
+    // smoke test (`_smoke_test`, `_fs_probe`) against DEFAULT, then promotion
+    // of the new version onto `live`, which CREATES `live` when an instance
+    // brought up by `deploy` alone has none yet (`promoteEndpoint`).
     new iam.PolicyStatement({
       sid: "SmokeTestRuntime",
       actions: [
@@ -150,6 +184,7 @@ export function deployStatements(
         "bedrock-agentcore:ListAgentRuntimeVersions",
         "bedrock-agentcore:GetAgentRuntimeEndpoint",
         "bedrock-agentcore:UpdateAgentRuntimeEndpoint",
+        "bedrock-agentcore:CreateAgentRuntimeEndpoint",
       ],
       resources: [
         `arn:${stack.partition}:bedrock-agentcore:${stack.region}:${stack.account}:runtime/${names.runtimeName}*`,

package/src/index.ts

@@ -4,11 +4,13 @@ export {
   RELEASE_BUCKET_ENV,
   RELEASE_DIR_ENV,
   type LambdaArtifactId,
+  type ReleaseAccess,
   type ReleaseSource,
   agentImage,
   agentImageTagRequired,
   ecrRepositoryArn,
   lambdaCode,
+  releaseAccess,
   releaseCacheDir,
   releaseImageRepositoryArn,
   releaseSource,

package/src/release/trust.ts

@@ -0,0 +1,52 @@
+/**
+ * Where a deployer gets a release from, and whose signature it accepts.
+ *
+ * Pure, like `manifest.ts`: the deploy tool reads these to fetch and verify a
+ * release, and the CDK app reads them to give the deployer roles
+ * (`deploy-permissions.ts`) the release-account permissions that fetch needs.
+ * Both must resolve to the same bucket and the same key, so the resolution
+ * lives here once rather than in each.
+ */
+
+/**
+ * The bucket a release is fetched from when nothing says otherwise.
+ *
+ * One name, owned by Foundry 41, created by `release-account-stack.ts`. A
+ * mirror is `--release-bucket` or `FOUNDATION_RELEASE_BUCKET`, and the
+ * signature is what makes a mirror safe to use.
+ */
+export const DEFAULT_RELEASE_BUCKET = "foundry41-foundation-releases";
+
+/** The env var that names the key a deployer will accept a manifest from. */
+export const RELEASE_KMS_KEY_ARN_ENV = "FOUNDATION_RELEASE_KMS_KEY_ARN";
+
+/**
+ * The Foundation release signing key, in the Foundry 41 release account
+ * (793593623536), created by `ReleaseAccountStack` on 2026-09-20.
+ *
+ * This constant is what makes signature verification mean anything: a
+ * deployer refuses a manifest signed by any other key. Changing it rotates
+ * the root of trust for every customer, so it changes only with a key
+ * rotation and a release that says so. {@link RELEASE_KMS_KEY_ARN_ENV}
+ * overrides it, for a private mirror or a test key.
+ */
+export const RELEASE_KMS_KEY_ARN: string | undefined =
+  "arn:aws:kms:us-east-1:793593623536:key/fba7d9f3-e9b6-49ae-b4a5-c8c5f1429231";
+
+/** The key ARN a deployer will accept a manifest from, or `undefined` when none is configured. */
+export function configuredKeyArn(
+  env: Record<string, string | undefined> = process.env,
+): string | undefined {
+  const configured = env[RELEASE_KMS_KEY_ARN_ENV] ?? RELEASE_KMS_KEY_ARN;
+  return configured === undefined || configured === "" ? undefined : configured;
+}
+
+/** The key ARN a deployer will accept a manifest from. Throws when none is configured. */
+export function expectedKeyArn(env: Record<string, string | undefined> = process.env): string {
+  const configured = configuredKeyArn(env);
+  if (configured === undefined)
+    throw new Error(
+      `no Foundation release signing key is configured; set ${RELEASE_KMS_KEY_ARN_ENV} to the key ARN published with the release`,
+    );
+  return configured;
+}

package/src/stacks/ci-stack.ts

@@ -3,6 +3,7 @@ import * as iam from "aws-cdk-lib/aws-iam";
 import type * as kms from "aws-cdk-lib/aws-kms";
 import type * as s3 from "aws-cdk-lib/aws-s3";
 import type { Construct } from "constructs";
+import { releaseAccess } from "../artifacts.ts";
 import { deployStatements } from "../deploy-permissions.ts";
 import { type Instance, namesFor } from "../names.ts";
 
@@ -84,7 +85,7 @@ export class FoundationCi extends cdk.Stack {
           statements: deployStatements(
             this,
             names,
-            { bucket: props.bucket, dataKey: props.dataKey },
+            { bucket: props.bucket, dataKey: props.dataKey, release: releaseAccess(this) },
             props.instance,
           ),
         }),

package/src/stacks/pipeline-stack.ts

@@ -40,6 +40,7 @@ import type * as s3 from "aws-cdk-lib/aws-s3";
 import * as sns from "aws-cdk-lib/aws-sns";
 import * as subscriptions from "aws-cdk-lib/aws-sns-subscriptions";
 import type { Construct } from "constructs";
+import { releaseAccess } from "../artifacts.ts";
 import { deployStatements } from "../deploy-permissions.ts";
 import { type Instance, namesFor } from "../names.ts";
 
@@ -101,7 +102,7 @@ export class FoundationPipeline extends cdk.Stack {
           statements: deployStatements(
             this,
             names,
-            { bucket: props.bucket, dataKey: props.dataKey },
+            { bucket: props.bucket, dataKey: props.dataKey, release: releaseAccess(this) },
             props.instance,
           ),
         }),