@deployfoundation/foundation-deploy 0.2.38 → 0.2.40

package/dist/bin/release-account.js

@@ -1,8 +1,7 @@
 #!/usr/bin/env bun
 import {
   DEFAULT_RELEASE_BUCKET
-} from "../chunk-8e2z4rhf.js";
-import"../chunk-2ra18dqx.js";
+} from "../chunk-dz91avrb.js";
 
 // bin/release-account.ts
 import * as cdk2 from "aws-cdk-lib";

package/dist/chunk-dz91avrb.js

@@ -0,0 +1,16 @@
+// src/release/trust.ts
+var DEFAULT_RELEASE_BUCKET = "foundry41-foundation-releases";
+var RELEASE_KMS_KEY_ARN_ENV = "FOUNDATION_RELEASE_KMS_KEY_ARN";
+var RELEASE_KMS_KEY_ARN = "arn:aws:kms:us-east-1:793593623536:key/fba7d9f3-e9b6-49ae-b4a5-c8c5f1429231";
+function configuredKeyArn(env = process.env) {
+  const configured = env[RELEASE_KMS_KEY_ARN_ENV] ?? RELEASE_KMS_KEY_ARN;
+  return configured === undefined || configured === "" ? undefined : configured;
+}
+function expectedKeyArn(env = process.env) {
+  const configured = configuredKeyArn(env);
+  if (configured === undefined)
+    throw new Error(`no Foundation release signing key is configured; set ${RELEASE_KMS_KEY_ARN_ENV} to the key ARN published with the release`);
+  return configured;
+}
+
+export { DEFAULT_RELEASE_BUCKET, configuredKeyArn, expectedKeyArn };

package/dist/{chunk-j52g7bsc.js → chunk-fwqmac5n.js}

@@ -17,13 +17,14 @@ import {
   parseInstanceConfig,
   parseSchedule,
   provisionsIntegration,
+  releaseAccess,
   releaseImageRepositoryArn,
   releaseSource,
   requiresAuthenticatedQueue,
   scheduledJobBindings,
   slackCommandPrefixes,
   webhookJobBindings
-} from "./chunk-2ra18dqx.js";
+} from "./chunk-g56mqyfx.js";
 
 // src/stacks/agent-stack.ts
 import * as cdk from "aws-cdk-lib";
@@ -1846,6 +1847,18 @@ function deployStatements(stack, names, targets, instance) {
   const runtimeSecret = secretArn(names.secretRuntime);
   const knockOauthClient = secretArn(names.secretKnockOauthClient);
   return [
+    new iam3.PolicyStatement({
+      sid: "ReadFoundationRelease",
+      actions: ["s3:GetObject"],
+      resources: [`arn:${stack.partition}:s3:::${targets.release.bucket}/releases/*`]
+    }),
+    ...targets.release.signingKeyArn === undefined ? [] : [
+      new iam3.PolicyStatement({
+        sid: "VerifyReleaseSignature",
+        actions: ["kms:Verify"],
+        resources: [targets.release.signingKeyArn]
+      })
+    ],
     new iam3.PolicyStatement({
       sid: "AssumeCdkBootstrapRoles",
       actions: ["sts:AssumeRole"],
@@ -1927,7 +1940,8 @@ function deployStatements(stack, names, targets, instance) {
         "bedrock-agentcore:GetAgentRuntime",
         "bedrock-agentcore:ListAgentRuntimeVersions",
         "bedrock-agentcore:GetAgentRuntimeEndpoint",
-        "bedrock-agentcore:UpdateAgentRuntimeEndpoint"
+        "bedrock-agentcore:UpdateAgentRuntimeEndpoint",
+        "bedrock-agentcore:CreateAgentRuntimeEndpoint"
       ],
       resources: [
         `arn:${stack.partition}:bedrock-agentcore:${stack.region}:${stack.account}:runtime/${names.runtimeName}*`,
@@ -1970,7 +1984,7 @@ class FoundationCi extends cdk3.Stack {
       }),
       inlinePolicies: {
         FoundationDeploy: new iam4.PolicyDocument({
-          statements: deployStatements(this, names, { bucket: props.bucket, dataKey: props.dataKey }, props.instance)
+          statements: deployStatements(this, names, { bucket: props.bucket, dataKey: props.dataKey, release: releaseAccess(this) }, props.instance)
         })
       }
     });
@@ -3453,7 +3467,7 @@ class FoundationPipeline extends cdk8.Stack {
       assumedBy: new iam9.ServicePrincipal("codebuild.amazonaws.com"),
       inlinePolicies: {
         FoundationDeploy: new iam9.PolicyDocument({
-          statements: deployStatements(this, names, { bucket: props.bucket, dataKey: props.dataKey }, props.instance)
+          statements: deployStatements(this, names, { bucket: props.bucket, dataKey: props.dataKey, release: releaseAccess(this) }, props.instance)
         })
       }
     });

package/dist/{chunk-2ra18dqx.js → chunk-g56mqyfx.js}

@@ -1,3 +1,8 @@
+import {
+  DEFAULT_RELEASE_BUCKET,
+  configuredKeyArn
+} from "./chunk-dz91avrb.js";
+
 // ../core/src/instance.ts
 import { parse as parseYaml } from "yaml";
 import { z as z2 } from "zod";
@@ -1256,31 +1261,45 @@ var contextStorage = new AsyncLocalStorage;
 // ../core/src/config.ts
 import { createHash as createHash2 } from "node:crypto";
 import { parse as parseYaml2 } from "yaml";
-import { z as z4 } from "zod";
+import { z as z5 } from "zod";
 
 // ../core/src/jobs.ts
 import { createHash, createHmac, timingSafeEqual } from "node:crypto";
+import { z as z4 } from "zod";
+
+// ../core/src/thinking-level.ts
 import { z as z3 } from "zod";
+var ThinkingLevel = z3.enum(["none", "low", "medium", "high", "xhigh", "max"]);
+
+// ../core/src/jobs.ts
 var JOB_ID_PATTERN = /^[a-z0-9][a-z0-9-]{0,40}$/;
-var RawScheduleTrigger = z3.object({
-  schedule: z3.string().min(1)
+var RawScheduleTrigger = z4.object({
+  schedule: z4.string().min(1)
 }).strict();
-var RawWebhookTrigger = z3.object({
-  webhook: z3.object({}).strict()
+var RawWebhookTrigger = z4.object({
+  webhook: z4.object({}).strict()
 }).strict();
-var RawJob = z3.object({
-  id: z3.string().regex(JOB_ID_PATTERN),
-  name: z3.string().min(1).max(80),
-  channel: z3.string().regex(/^[CG][A-Z0-9]{8,}$/, "a job runs in a Slack channel id"),
-  on: z3.union([RawScheduleTrigger, RawWebhookTrigger]),
-  prompt: z3.string().min(1).max(4000)
-}).strict();
-var RawJobs = z3.array(RawJob).default([]).superRefine((jobs, ctx) => {
+var RawJob = z4.object({
+  id: z4.string().regex(JOB_ID_PATTERN),
+  name: z4.string().min(1).max(80),
+  channel: z4.string().regex(/^[CG][A-Z0-9]{8,}$/, "a job runs in a Slack channel id"),
+  on: z4.union([RawScheduleTrigger, RawWebhookTrigger]),
+  prompt: z4.string().min(1).max(4000),
+  thinkingLevel: ThinkingLevel.optional()
+}).strict().superRefine((job, ctx) => {
+  if (job.thinkingLevel !== undefined && !("schedule" in job.on))
+    ctx.addIssue({
+      code: z4.ZodIssueCode.custom,
+      path: ["thinkingLevel"],
+      message: "thinkingLevel applies to scheduled jobs only"
+    });
+});
+var RawJobs = z4.array(RawJob).default([]).superRefine((jobs, ctx) => {
   const seen = new Set;
   for (const [index, job] of jobs.entries()) {
     if (seen.has(job.id)) {
       ctx.addIssue({
-        code: z3.ZodIssueCode.custom,
+        code: z4.ZodIssueCode.custom,
         path: [index, "id"],
         message: `duplicate job id: ${job.id}`
       });
@@ -1301,9 +1320,13 @@ function scheduledJobFingerprint(input) {
   return createHash("sha256").update(JSON.stringify([input.routineId, input.name, input.channel, input.prompt])).digest("hex");
 }
 function scheduledJobBindings(jobs) {
-  return jobs.filter(isScheduledJob).map(({ id, name, channel, prompt }) => {
+  return jobs.filter(isScheduledJob).map(({ id, name, channel, prompt, thinkingLevel }) => {
     const input = { routineId: `job-${id}`, name, channel, prompt };
-    return { routineId: input.routineId, fingerprint: scheduledJobFingerprint(input) };
+    return {
+      routineId: input.routineId,
+      fingerprint: scheduledJobFingerprint(input),
+      ...thinkingLevel === undefined ? {} : { thinkingLevel }
+    };
   });
 }
 function jobWebhookKey(instanceSecret, jobId) {
@@ -1369,11 +1392,10 @@ function capabilityScheduledJobs(config) {
 
 // ../core/src/config.ts
 var MODEL_RE = /^([a-z0-9-]+)\/(.+)$/;
-var ThinkingLevel = z4.enum(["none", "low", "medium", "high", "xhigh", "max"]);
-var RawImages = z4.object({
-  backend: z4.enum(["gemini"]).default("gemini"),
-  model: z4.string().min(1).default("gemini-2.5-flash-image"),
-  dailyCap: z4.number().int().min(0).default(40)
+var RawImages = z5.object({
+  backend: z5.enum(["gemini"]).default("gemini"),
+  model: z5.string().min(1).default("gemini-2.5-flash-image"),
+  dailyCap: z5.number().int().min(0).default(40)
 }).strict().default({});
 var OMP_MODEL_ROLES = [
   "default",
@@ -1386,40 +1408,40 @@ var OMP_MODEL_ROLES = [
   "task",
   "advisor"
 ];
-var RawModelRoles = z4.record(z4.enum(OMP_MODEL_ROLES), z4.string().regex(MODEL_RE)).default({});
-var RawChannelModels = z4.record(z4.string().regex(/^[CDG][A-Z0-9]+$/, "channelModels keys must be Slack conversation ids"), z4.string().regex(MODEL_RE, "channel model must be provider/modelId")).default({});
-var RawSubagents = z4.object({
-  enabled: z4.boolean().default(true),
-  maxConcurrency: z4.number().int().min(1).max(8).default(3),
-  maxRecursionDepth: z4.number().int().min(1).max(3).default(2),
-  effort: z4.boolean().default(true)
+var RawModelRoles = z5.record(z5.enum(OMP_MODEL_ROLES), z5.string().regex(MODEL_RE)).default({});
+var RawChannelModels = z5.record(z5.string().regex(/^[CDG][A-Z0-9]+$/, "channelModels keys must be Slack conversation ids"), z5.string().regex(MODEL_RE, "channel model must be provider/modelId")).default({});
+var RawSubagents = z5.object({
+  enabled: z5.boolean().default(true),
+  maxConcurrency: z5.number().int().min(1).max(8).default(3),
+  maxRecursionDepth: z5.number().int().min(1).max(3).default(2),
+  effort: z5.boolean().default(true)
 }).strict().default({});
-var RawMemory = z4.object({ ompBackend: z4.enum(["off", "local"]).default("off") }).strict().default({});
+var RawMemory = z5.object({ ompBackend: z5.enum(["off", "local"]).default("off") }).strict().default({});
 var SKILL_SOURCE_SCOPES = ["shared", "instance"];
 var RawSkillSourceMetadata = {
-  owner: z4.string().min(1).optional(),
-  scope: z4.enum(SKILL_SOURCE_SCOPES).optional(),
-  requires: z4.array(z4.enum(CAPABILITY_IDS)).optional()
+  owner: z5.string().min(1).optional(),
+  scope: z5.enum(SKILL_SOURCE_SCOPES).optional(),
+  requires: z5.array(z5.enum(CAPABILITY_IDS)).optional()
 };
-var RawSkillSource = z4.union([
-  z4.object({
-    github: z4.string().min(1),
-    ref: z4.string().min(1).optional(),
-    path: z4.string().optional(),
+var RawSkillSource = z5.union([
+  z5.object({
+    github: z5.string().min(1),
+    ref: z5.string().min(1).optional(),
+    path: z5.string().optional(),
     ...RawSkillSourceMetadata
   }).strict(),
-  z4.object({ s3: z4.string().min(1), ...RawSkillSourceMetadata }).strict()
+  z5.object({ s3: z5.string().min(1), ...RawSkillSourceMetadata }).strict()
 ]);
-var RawSkills = z4.object({
-  sources: z4.array(RawSkillSource).optional(),
-  promoteTo: z4.string().min(1).optional()
+var RawSkills = z5.object({
+  sources: z5.array(RawSkillSource).optional(),
+  promoteTo: z5.string().min(1).optional()
 }).strict().default({});
-var RawInstanceConfig = z4.object({
-  name: z4.string().min(1),
-  model: z4.string().regex(MODEL_RE, "model must be provider/modelId"),
-  admins: z4.array(z4.string().min(1)).min(1, "admins must list at least one Slack user id"),
-  instructions: z4.string().default(""),
-  timezone: z4.string().default("UTC").refine(isValidTimezone, (tz) => ({ message: `unknown timezone: ${tz}` })),
+var RawInstanceConfig = z5.object({
+  name: z5.string().min(1),
+  model: z5.string().regex(MODEL_RE, "model must be provider/modelId"),
+  admins: z5.array(z5.string().min(1)).min(1, "admins must list at least one Slack user id"),
+  instructions: z5.string().default(""),
+  timezone: z5.string().default("UTC").refine(isValidTimezone, (tz) => ({ message: `unknown timezone: ${tz}` })),
   thinkingLevel: ThinkingLevel.optional(),
   skills: RawSkills,
   images: RawImages,
@@ -1496,24 +1518,24 @@ function parseInstanceConfig(yamlText) {
 }
 // ../core/src/company-capabilities.ts
 import { parse as parseYaml3 } from "yaml";
-import { z as z5 } from "zod";
+import { z as z6 } from "zod";
 var COMPANY_CAPABILITY_DECLARATION_VERSION = 1;
 var COMPANY_CAPABILITY_DECLARATION_MAX_COUNT = CAPABILITY_IDS.length;
 var COMPANY_CAPABILITY_DESCRIPTION_MAX_CHARS = 280;
 var COMPANY_CAPABILITY_DECLARATION_MAX_BYTES = 16 * 1024;
-var RawCompanyCapabilityDeclaration = z5.object({
-  id: z5.enum(CAPABILITY_IDS),
-  description: z5.string().min(1).max(COMPANY_CAPABILITY_DESCRIPTION_MAX_CHARS).refine((value) => value.trim() === value && !Array.from(value).some((char) => char.charCodeAt(0) < 32 || char.charCodeAt(0) === 127), "description must not have surrounding whitespace or control characters")
+var RawCompanyCapabilityDeclaration = z6.object({
+  id: z6.enum(CAPABILITY_IDS),
+  description: z6.string().min(1).max(COMPANY_CAPABILITY_DESCRIPTION_MAX_CHARS).refine((value) => value.trim() === value && !Array.from(value).some((char) => char.charCodeAt(0) < 32 || char.charCodeAt(0) === 127), "description must not have surrounding whitespace or control characters")
 }).strict();
-var RawCompanyCapabilityDeclarations = z5.object({
-  version: z5.literal(COMPANY_CAPABILITY_DECLARATION_VERSION),
-  capabilities: z5.array(RawCompanyCapabilityDeclaration).max(COMPANY_CAPABILITY_DECLARATION_MAX_COUNT)
+var RawCompanyCapabilityDeclarations = z6.object({
+  version: z6.literal(COMPANY_CAPABILITY_DECLARATION_VERSION),
+  capabilities: z6.array(RawCompanyCapabilityDeclaration).max(COMPANY_CAPABILITY_DECLARATION_MAX_COUNT)
 }).strict().superRefine((document, ctx) => {
   const seen = new Set;
   for (const [index, declaration] of document.capabilities.entries()) {
     if (seen.has(declaration.id)) {
       ctx.addIssue({
-        code: z5.ZodIssueCode.custom,
+        code: z6.ZodIssueCode.custom,
         path: ["capabilities", index, "id"],
         message: `duplicate capability declaration: ${declaration.id}`
       });
@@ -1580,13 +1602,13 @@ var LIVE_ENDPOINT_NAME = "live";
 // src/release/manifest.ts
 import { createHash as createHash3 } from "node:crypto";
 import { readFileSync as readFileSync2, statSync } from "node:fs";
-import { z as z6 } from "zod";
+import { z as z7 } from "zod";
 var RELEASE_VERSION_RE = /^v\d+\.\d+\.\d+$/;
-var Sha256 = z6.string().regex(/^[0-9a-f]{64}$/, "must be a lowercase hex sha256");
-var ReleaseArtifactSchema = z6.object({
-  key: z6.string().min(1),
+var Sha256 = z7.string().regex(/^[0-9a-f]{64}$/, "must be a lowercase hex sha256");
+var ReleaseArtifactSchema = z7.object({
+  key: z7.string().min(1),
   sha256: Sha256,
-  bytes: z6.number().int().nonnegative()
+  bytes: z7.number().int().nonnegative()
 }).strict();
 var SIGNING_ALGORITHMS = [
   "RSASSA_PSS_SHA_256",
@@ -1599,21 +1621,21 @@ var SIGNING_ALGORITHMS = [
   "ECDSA_SHA_384",
   "ECDSA_SHA_512"
 ];
-var ReleaseManifestSchema = z6.object({
-  version: z6.string().regex(RELEASE_VERSION_RE, "must be vMAJOR.MINOR.PATCH"),
-  gitCommit: z6.string().regex(/^[0-9a-f]{40}$/, "must be a full commit sha"),
-  createdAt: z6.string().datetime(),
-  agentImage: z6.object({
-    repository: z6.string().min(1),
-    tag: z6.string().min(1),
-    digest: z6.string().regex(/^sha256:[0-9a-f]{64}$/)
+var ReleaseManifestSchema = z7.object({
+  version: z7.string().regex(RELEASE_VERSION_RE, "must be vMAJOR.MINOR.PATCH"),
+  gitCommit: z7.string().regex(/^[0-9a-f]{40}$/, "must be a full commit sha"),
+  createdAt: z7.string().datetime(),
+  agentImage: z7.object({
+    repository: z7.string().min(1),
+    tag: z7.string().min(1),
+    digest: z7.string().regex(/^sha256:[0-9a-f]{64}$/)
   }).strict(),
-  lambda: z6.record(ReleaseArtifactSchema),
-  skills: z6.object({ key: z6.string().min(1), sha256: Sha256 }).strict(),
-  signature: z6.object({
-    kmsKeyArn: z6.string().min(1),
-    algorithm: z6.enum(SIGNING_ALGORITHMS),
-    value: z6.string().min(1)
+  lambda: z7.record(ReleaseArtifactSchema),
+  skills: z7.object({ key: z7.string().min(1), sha256: Sha256 }).strict(),
+  signature: z7.object({
+    kmsKeyArn: z7.string().min(1),
+    algorithm: z7.enum(SIGNING_ALGORITHMS),
+    value: z7.string().min(1)
   }).strict().optional()
 }).strict();
 function parseManifest(json) {
@@ -1816,6 +1838,14 @@ function releaseSource(scope) {
     throw new Error(`-c releaseBucket=<name> is required when deploying a release (or set ${RELEASE_BUCKET_ENV}); it is the bucket holding ${manifest.lambda.gateway?.key ?? "the release artifacts"}`);
   return { version: manifest.version, bucket, manifest };
 }
+function releaseAccess(scope, env = process.env) {
+  const context = scope.node.tryGetContext("releaseBucket");
+  const fromContext = typeof context === "string" && context !== "" ? context : undefined;
+  const fromEnv = env[RELEASE_BUCKET_ENV];
+  const bucket = fromContext ?? (fromEnv !== undefined && fromEnv !== "" ? fromEnv : DEFAULT_RELEASE_BUCKET);
+  const signingKeyArn = configuredKeyArn(env);
+  return { bucket, ...signingKeyArn === undefined ? {} : { signingKeyArn } };
+}
 function releaseBucket(scope, source) {
   const stack = cdk.Stack.of(scope);
   const existing = stack.node.tryFindChild("FoundationReleaseBucket");
@@ -1899,4 +1929,4 @@ function ecrRepositoryArn(repositoryUri) {
   return `arn:aws:ecr:${region}:${account}:repository/${name}`;
 }
 
-export { parseSchedule, BASE_SLACK_EVENTS, CAPABILITY_IDS, requiredGithubPermissions, requiredSlackScopes, requiredSlackCommands, encodeProactiveChannels, CUSTOMIZATION_ARTIFACT_NAME, newsletterManifestFor, FOUNDATION_VERSION_RE, versionedConfigKey, instanceNames, slackCommandPrefix, slackCommandPrefixes, isScheduledJob, isWebhookJob, webhookJobBindings, scheduledJobBindings, jobWebhookKey, capabilityScheduledJobs, crmOutreachConfigured, crmPolicyFingerprint, parseInstanceConfig, loadInstanceFile, configPathFor, capabilityEnabled, requiresAuthenticatedQueue, enabledIntegrations, provisionsIntegration, adminsFor, WEB_SEARCH_TARGET, WEB_SEARCH_CONNECTOR_VERSION, LIVE_ENDPOINT_NAME, RELEASE_VERSION_RE, parseManifest, manifestKey, lambdaKey, skillsKey, buildManifest, manifestSigningPayload, verifyManifest, lambdaBundleContext, BUN_VERSION, LAMBDA_ENTRY_POINTS, skipBundle, RELEASE_BUCKET_ENV, RELEASE_DIR_ENV, releaseCacheDir, releaseSource, lambdaCode, agentImage, agentImageTagRequired, releaseImageRepositoryArn, ecrRepositoryArn };
+export { parseSchedule, BASE_SLACK_EVENTS, CAPABILITY_IDS, requiredGithubPermissions, requiredSlackScopes, requiredSlackCommands, encodeProactiveChannels, CUSTOMIZATION_ARTIFACT_NAME, newsletterManifestFor, FOUNDATION_VERSION_RE, versionedConfigKey, instanceNames, slackCommandPrefix, slackCommandPrefixes, isScheduledJob, isWebhookJob, webhookJobBindings, scheduledJobBindings, jobWebhookKey, capabilityScheduledJobs, crmOutreachConfigured, crmPolicyFingerprint, parseInstanceConfig, loadInstanceFile, configPathFor, capabilityEnabled, requiresAuthenticatedQueue, enabledIntegrations, provisionsIntegration, adminsFor, WEB_SEARCH_TARGET, WEB_SEARCH_CONNECTOR_VERSION, LIVE_ENDPOINT_NAME, RELEASE_VERSION_RE, parseManifest, manifestKey, lambdaKey, skillsKey, buildManifest, manifestSigningPayload, verifyManifest, lambdaBundleContext, BUN_VERSION, LAMBDA_ENTRY_POINTS, skipBundle, RELEASE_BUCKET_ENV, RELEASE_DIR_ENV, releaseCacheDir, releaseSource, releaseAccess, lambdaCode, agentImage, agentImageTagRequired, releaseImageRepositoryArn, ecrRepositoryArn };

package/dist/src/index.js

@@ -10,7 +10,7 @@ import {
   FoundationPipeline,
   NewsletterStack,
   deployStatements
-} from "../chunk-j52g7bsc.js";
+} from "../chunk-fwqmac5n.js";
 import {
   BUN_VERSION,
   LAMBDA_ENTRY_POINTS,
@@ -36,6 +36,7 @@ import {
   manifestSigningPayload,
   parseManifest,
   provisionsIntegration,
+  releaseAccess,
   releaseCacheDir,
   releaseImageRepositoryArn,
   releaseSource,
@@ -43,7 +44,8 @@ import {
   skillsKey,
   skipBundle,
   verifyManifest
-} from "../chunk-2ra18dqx.js";
+} from "../chunk-g56mqyfx.js";
+import"../chunk-dz91avrb.js";
 export {
   BUILD_TIMEOUT,
   BUN_VERSION,
@@ -80,6 +82,7 @@ export {
   instanceNames as namesFor,
   parseManifest,
   provisionsIntegration,
+  releaseAccess,
   releaseCacheDir,
   releaseImageRepositoryArn,
   releaseSource,

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@deployfoundation/foundation-deploy",
-  "version": "0.2.38",
+  "version": "0.2.40",
   "description": "Deploys one Foundation instance from a published, signed release: the CDK app and the deploy tool.",
   "license": "UNLICENSED",
   "private": false,

package/src/artifacts.ts

@@ -41,6 +41,7 @@ import * as s3 from "aws-cdk-lib/aws-s3";
 import type { Construct } from "constructs";
 import { lambdaBundleContext } from "./lambda-bundle-context.ts";
 import { type ReleaseManifest, parseManifest } from "./release/manifest.ts";
+import { DEFAULT_RELEASE_BUCKET, configuredKeyArn } from "./release/trust.ts";
 
 /** Pinned Bun used to bundle every Lambda (and the docker fallback image tag). */
 export const BUN_VERSION = "1.4.0";
@@ -174,6 +175,38 @@ export function releaseSource(scope: Construct): ReleaseSource | undefined {
   return { version: manifest.version, bucket, manifest };
 }
 
+/**
+ * What a deployer of this app reads from Foundation's release account: the
+ * bucket the tool fetches `releases/*` from and the key whose signature it
+ * checks. The deployer roles (`deploy-permissions.ts`) are granted exactly
+ * these, cross-account, so a CodePipeline or GitHub Actions deploy can verify
+ * a release the way an admin's laptop can.
+ *
+ * Resolved the way `foundation-deploy` resolves them — `-c releaseBucket`
+ * (which the tool passes on a release deploy) or `FOUNDATION_RELEASE_BUCKET`,
+ * else the default bucket; `FOUNDATION_RELEASE_KMS_KEY_ARN`, else the pinned
+ * key — and resolved on EVERY synth, release or local build, so the grant does
+ * not come and go with how the last deploy was run.
+ */
+export interface ReleaseAccess {
+  bucket: string;
+  /** Absent only when no signing key is configured at all; nothing is verified then. */
+  signingKeyArn?: string;
+}
+
+export function releaseAccess(
+  scope: Construct,
+  env: Record<string, string | undefined> = process.env,
+): ReleaseAccess {
+  const context: unknown = scope.node.tryGetContext("releaseBucket");
+  const fromContext = typeof context === "string" && context !== "" ? context : undefined;
+  const fromEnv = env[RELEASE_BUCKET_ENV];
+  const bucket =
+    fromContext ?? (fromEnv !== undefined && fromEnv !== "" ? fromEnv : DEFAULT_RELEASE_BUCKET);
+  const signingKeyArn = configuredKeyArn(env);
+  return { bucket, ...(signingKeyArn === undefined ? {} : { signingKeyArn }) };
+}
+
 /**
  * The release bucket as one imported construct per stack. Every Lambda in a
  * stack references the same bucket, and importing it once keeps the template's

package/src/deploy/release.ts

@@ -29,34 +29,10 @@ import {
   manifestKey,
   verifyManifest,
 } from "../release/manifest.ts";
+import { DEFAULT_RELEASE_BUCKET, expectedKeyArn } from "../release/trust.ts";
 import { type AwsCallContext, aws } from "./aws.ts";
 import { FOUNDATION_ROOT, INFRA_ROOT } from "./paths.ts";
 
-/**
- * The bucket a release is fetched from when nothing says otherwise.
- *
- * One name, owned by Foundry 41, created by `release-account-stack.ts`. A
- * mirror is `--release-bucket` or `FOUNDATION_RELEASE_BUCKET`, and the
- * signature is what makes a mirror safe to use.
- */
-export const DEFAULT_RELEASE_BUCKET = "foundry41-foundation-releases";
-
-/** The env var that names the key a deployer will accept a manifest from. */
-export const RELEASE_KMS_KEY_ARN_ENV = "FOUNDATION_RELEASE_KMS_KEY_ARN";
-
-/**
- * The Foundation release signing key, in the Foundry 41 release account
- * (793593623536), created by `ReleaseAccountStack` on 2026-09-20.
- *
- * This constant is what makes signature verification mean anything: a
- * deployer refuses a manifest signed by any other key. Changing it rotates
- * the root of trust for every customer, so it changes only with a key
- * rotation and a release that says so. {@link RELEASE_KMS_KEY_ARN_ENV}
- * overrides it, for a private mirror or a test key.
- */
-export const RELEASE_KMS_KEY_ARN: string | undefined =
-  "arn:aws:kms:us-east-1:793593623536:key/fba7d9f3-e9b6-49ae-b4a5-c8c5f1429231";
-
 /** What the caller asked for, before anything has been fetched. */
 export interface ReleaseRequest {
   /** `vX.Y.Z`, when the caller named a version or one was implied. */
@@ -149,16 +125,6 @@ export function releaseRequest(
   return { version, bucket };
 }
 
-/** The key ARN a deployer will accept a manifest from. */
-export function expectedKeyArn(env: Record<string, string | undefined> = process.env): string {
-  const configured = env[RELEASE_KMS_KEY_ARN_ENV] ?? RELEASE_KMS_KEY_ARN;
-  if (configured === undefined || configured === "")
-    throw new Error(
-      `no Foundation release signing key is configured; set ${RELEASE_KMS_KEY_ARN_ENV} to the key ARN published with the release`,
-    );
-  return configured;
-}
-
 export interface ResolveReleaseDeps {
   /** Defaults to the SDK-backed verifier for the expected key. */
   kms?: KmsVerifier;

package/src/deploy-permissions.ts

@@ -17,6 +17,7 @@ import type * as cdk from "aws-cdk-lib";
 import * as iam from "aws-cdk-lib/aws-iam";
 import type * as kms from "aws-cdk-lib/aws-kms";
 import type * as s3 from "aws-cdk-lib/aws-s3";
+import type { ReleaseAccess } from "./artifacts.ts";
 import { type Instance, type InstanceNames, provisionsIntegration } from "./names.ts";
 
 export interface DeployTargets {
@@ -24,6 +25,13 @@ export interface DeployTargets {
   bucket: s3.IBucket;
   /** The CMK that bucket is encrypted with. */
   dataKey: kms.IKey;
+  /**
+   * Foundation's release bucket and signing key, in the release account
+   * (`releaseAccess()` in `artifacts.ts`). Cross-account access needs BOTH
+   * sides to allow it: the release account's bucket and key policies name the
+   * customer account, and the statements below are this account's half.
+   */
+  release: ReleaseAccess;
 }
 
 /**
@@ -49,6 +57,30 @@ export function deployStatements(
   const knockOauthClient = secretArn(names.secretKnockOauthClient);
 
   return [
+    // A release deploy, before anything else: `aws s3 cp` of
+    // `releases/<v>/manifest.json`, then of every Lambda zip and
+    // `skills.tar.gz` the manifest names (the digest check in `verifyRelease`),
+    // and of `skills.tar.gz` again for the config sync (`unpackReleaseSkills`).
+    // HeadObject is authorized by s3:GetObject. The bucket is SSE-S3, so there
+    // is no key to grant for it.
+    new iam.PolicyStatement({
+      sid: "ReadFoundationRelease",
+      actions: ["s3:GetObject"],
+      resources: [`arn:${stack.partition}:s3:::${targets.release.bucket}/releases/*`],
+    }),
+    // ...and the manifest's signature, checked with one KMS `Verify` against
+    // the pinned key (`src/release/kms.ts`); nothing calls GetPublicKey or
+    // DescribeKey. By key ARN, not alias: an identity policy cannot name
+    // another account's key by its alias.
+    ...(targets.release.signingKeyArn === undefined
+      ? []
+      : [
+          new iam.PolicyStatement({
+            sid: "VerifyReleaseSignature",
+            actions: ["kms:Verify"],
+            resources: [targets.release.signingKeyArn],
+          }),
+        ]),
     // How `cdk deploy` does everything else: it assumes the bootstrap roles for
     // lookup, asset publishing and the CloudFormation call.
     new iam.PolicyStatement({
@@ -140,8 +172,10 @@ export function deployStatements(
       actions: ["kms:Encrypt", "kms:Decrypt", "kms:GenerateDataKey*"],
       resources: [targets.dataKey.keyArn],
     }),
-    // `foundation-deploy post-deploy`: the smoke test (`_smoke_test`,
-    // `_fs_probe`) against DEFAULT, then promotion of the new version onto `live`.
+    // `foundation-deploy post-deploy` (and `deploy`'s inline promotion): the
+    // smoke test (`_smoke_test`, `_fs_probe`) against DEFAULT, then promotion
+    // of the new version onto `live`, which CREATES `live` when an instance
+    // brought up by `deploy` alone has none yet (`promoteEndpoint`).
     new iam.PolicyStatement({
       sid: "SmokeTestRuntime",
       actions: [
@@ -150,6 +184,7 @@ export function deployStatements(
         "bedrock-agentcore:ListAgentRuntimeVersions",
         "bedrock-agentcore:GetAgentRuntimeEndpoint",
         "bedrock-agentcore:UpdateAgentRuntimeEndpoint",
+        "bedrock-agentcore:CreateAgentRuntimeEndpoint",
       ],
       resources: [
         `arn:${stack.partition}:bedrock-agentcore:${stack.region}:${stack.account}:runtime/${names.runtimeName}*`,

package/src/index.ts

@@ -4,11 +4,13 @@ export {
   RELEASE_BUCKET_ENV,
   RELEASE_DIR_ENV,
   type LambdaArtifactId,
+  type ReleaseAccess,
   type ReleaseSource,
   agentImage,
   agentImageTagRequired,
   ecrRepositoryArn,
   lambdaCode,
+  releaseAccess,
   releaseCacheDir,
   releaseImageRepositoryArn,
   releaseSource,

package/src/release/trust.ts

@@ -0,0 +1,52 @@
+/**
+ * Where a deployer gets a release from, and whose signature it accepts.
+ *
+ * Pure, like `manifest.ts`: the deploy tool reads these to fetch and verify a
+ * release, and the CDK app reads them to give the deployer roles
+ * (`deploy-permissions.ts`) the release-account permissions that fetch needs.
+ * Both must resolve to the same bucket and the same key, so the resolution
+ * lives here once rather than in each.
+ */
+
+/**
+ * The bucket a release is fetched from when nothing says otherwise.
+ *
+ * One name, owned by Foundry 41, created by `release-account-stack.ts`. A
+ * mirror is `--release-bucket` or `FOUNDATION_RELEASE_BUCKET`, and the
+ * signature is what makes a mirror safe to use.
+ */
+export const DEFAULT_RELEASE_BUCKET = "foundry41-foundation-releases";
+
+/** The env var that names the key a deployer will accept a manifest from. */
+export const RELEASE_KMS_KEY_ARN_ENV = "FOUNDATION_RELEASE_KMS_KEY_ARN";
+
+/**
+ * The Foundation release signing key, in the Foundry 41 release account
+ * (793593623536), created by `ReleaseAccountStack` on 2026-09-20.
+ *
+ * This constant is what makes signature verification mean anything: a
+ * deployer refuses a manifest signed by any other key. Changing it rotates
+ * the root of trust for every customer, so it changes only with a key
+ * rotation and a release that says so. {@link RELEASE_KMS_KEY_ARN_ENV}
+ * overrides it, for a private mirror or a test key.
+ */
+export const RELEASE_KMS_KEY_ARN: string | undefined =
+  "arn:aws:kms:us-east-1:793593623536:key/fba7d9f3-e9b6-49ae-b4a5-c8c5f1429231";
+
+/** The key ARN a deployer will accept a manifest from, or `undefined` when none is configured. */
+export function configuredKeyArn(
+  env: Record<string, string | undefined> = process.env,
+): string | undefined {
+  const configured = env[RELEASE_KMS_KEY_ARN_ENV] ?? RELEASE_KMS_KEY_ARN;
+  return configured === undefined || configured === "" ? undefined : configured;
+}
+
+/** The key ARN a deployer will accept a manifest from. Throws when none is configured. */
+export function expectedKeyArn(env: Record<string, string | undefined> = process.env): string {
+  const configured = configuredKeyArn(env);
+  if (configured === undefined)
+    throw new Error(
+      `no Foundation release signing key is configured; set ${RELEASE_KMS_KEY_ARN_ENV} to the key ARN published with the release`,
+    );
+  return configured;
+}