@deployfoundation/foundation-deploy 0.2.51 → 0.2.53

package/dist/{chunk-efqdhd2e.js → chunk-spq5kr1t.js}

@@ -1,36 +1,104 @@
+import {
+  agentImage,
+  agentImageTagRequired,
+  lambdaCode,
+  releaseAccess,
+  releaseImageRepositoryArn,
+  releaseSource
+} from "./chunk-pxhftba1.js";
 import {
   CUSTOMIZATION_ARTIFACT_NAME,
   FOUNDATION_VERSION_RE,
   LIVE_ENDPOINT_NAME,
   WEB_SEARCH_TARGET,
-  agentImage,
-  agentImageTagRequired,
   capabilityEnabled,
+  instanceNames,
+  newsletterManifestFor,
+  provisionsIntegration,
+  requiresAuthenticatedQueue,
+  slackCommandPrefixes
+} from "./chunk-fjdgxw8h.js";
+import {
   capabilityScheduledJobs,
   crmOutreachConfigured,
   crmPolicyFingerprint,
   encodeProactiveChannels,
-  instanceNames,
   isScheduledJob,
-  lambdaCode,
-  newsletterManifestFor,
   parseInstanceConfig,
   parseSchedule,
-  provisionsIntegration,
-  releaseAccess,
-  releaseImageRepositoryArn,
-  releaseSource,
-  requiresAuthenticatedQueue,
   scheduledJobBindings,
-  slackCommandPrefixes,
   webhookJobBindings
-} from "./chunk-gnz747z2.js";
+} from "./chunk-96fjaysn.js";
 
 // src/stacks/agent-stack.ts
 import * as cdk from "aws-cdk-lib";
 import * as ecr from "aws-cdk-lib/aws-ecr";
 import * as iam from "aws-cdk-lib/aws-iam";
 import * as logs from "aws-cdk-lib/aws-logs";
+
+// src/stacks/secret-bearing-reads.ts
+var SECRET_BEARING_READ_ACTIONS = [
+  "wafv2:GetSampledRequests",
+  "waf:GetSampledRequests",
+  "waf-regional:GetSampledRequests",
+  "lambda:GetFunction",
+  "lambda:GetFunctionConfiguration",
+  "lambda:ListFunctions",
+  "lambda:ListVersionsByFunction",
+  "lambda:GetLayerVersion",
+  "lambda:GetLayerVersionByArn",
+  "ecs:DescribeTaskDefinition",
+  "apprunner:DescribeService",
+  "batch:DescribeJobDefinitions",
+  "batch:DescribeJobs",
+  "codebuild:BatchGetProjects",
+  "codebuild:BatchGetBuilds",
+  "codebuild:BatchGetBuildBatches",
+  "amplify:GetApp",
+  "amplify:ListApps",
+  "amplify:GetBranch",
+  "amplify:ListBranches",
+  "amplify:GetBackendEnvironment",
+  "elasticbeanstalk:DescribeConfigurationSettings",
+  "ec2:DescribeLaunchTemplateVersions",
+  "ec2:DescribeInstanceAttribute",
+  "ssm:GetParameter",
+  "ssm:GetParameters",
+  "ssm:GetParametersByPath",
+  "ssm:GetParameterHistory",
+  "cloudformation:GetTemplate",
+  "appconfig:GetConfiguration",
+  "appconfig:GetHostedConfigurationVersion",
+  "glue:GetJob",
+  "glue:GetJobs",
+  "glue:BatchGetJobs",
+  "glue:GetConnection",
+  "glue:GetConnections",
+  "glue:GetDevEndpoint",
+  "glue:GetDevEndpoints",
+  "glue:BatchGetDevEndpoints",
+  "sagemaker:DescribeModel",
+  "sagemaker:DescribeTrainingJob",
+  "sagemaker:DescribeProcessingJob",
+  "sagemaker:DescribeTransformJob",
+  "datapipeline:GetPipelineDefinition",
+  "appsync:ListApiKeys",
+  "appsync:GetDataSource",
+  "appsync:ListDataSources",
+  "kinesisanalytics:DescribeApplication",
+  "lightsail:GetBucketAccessKeys",
+  "lightsail:GetContainerServices",
+  "lightsail:GetContainerServiceDeployments",
+  "opsworks:DescribeApps",
+  "opsworks:DescribeStacks",
+  "cognito-identity:GetCredentialsForIdentity",
+  "cognito-identity:GetOpenIdToken",
+  "cognito-identity:GetOpenIdTokenForDeveloperIdentity",
+  "connect:GetFederationToken",
+  "codeartifact:GetAuthorizationToken"
+];
+
+// src/stacks/agent-stack.ts
 class FoundationAgent extends cdk.Stack {
   repository;
   executionRole;
@@ -73,6 +141,7 @@ class FoundationAgent extends cdk.Stack {
     this.accessPoint = accessPoint;
     this.executionRole = this.buildExecutionRole(props);
     this.readOnlyRole = this.buildReadOnlyRole(props);
+    this.secretBearingReadsPolicy(props.instance, [this.executionRole, this.readOnlyRole]);
     this.buildSpansIngestionPolicy();
     const gateway = this.buildToolGateway(display);
     this.webSearchUrl = gateway.getAtt("GatewayUrl").toString();
@@ -221,20 +290,27 @@ class FoundationAgent extends cdk.Stack {
     role.addToPolicy(new iam.PolicyStatement({
       sid: "DenyDirectCrmTableAccess",
       effect: iam.Effect.DENY,
-      actions: [
-        "dynamodb:GetItem",
-        "dynamodb:BatchGetItem",
-        "dynamodb:TransactGetItems",
-        "dynamodb:Query",
-        "dynamodb:Scan",
-        "dynamodb:PartiQLSelect",
-        "dynamodb:ExecuteStatement",
-        "dynamodb:BatchExecuteStatement",
-        "dynamodb:ExportTableToPointInTime"
-      ],
+      actions: ["dynamodb:*"],
       resources
     }));
   }
+  denyDirectCrmHttpSecretAccess(role, instance) {
+    if (!provisionsIntegration(instance, "crm") || instance.crm.provider.kind !== "http")
+      return;
+    role.addToPolicy(new iam.PolicyStatement({
+      sid: "DenyCrmHttpSecret",
+      effect: iam.Effect.DENY,
+      actions: ["secretsmanager:*"],
+      resources: [
+        cdk.Stack.of(this).formatArn({
+          service: "secretsmanager",
+          resource: "secret",
+          resourceName: `${this.names.secretCrmHttp}-??????`,
+          arnFormat: cdk.ArnFormat.COLON_RESOURCE_NAME
+        })
+      ]
+    }));
+  }
   denyDirectKnockSecretAccess(role, props) {
     if (!provisionsIntegration(props.instance, "knock"))
       return;
@@ -385,6 +461,7 @@ class FoundationAgent extends cdk.Stack {
       managedPolicies: [iam.ManagedPolicy.fromAwsManagedPolicyName("ReadOnlyAccess")]
     });
     this.denyDirectCrmTableAccess(role, props.instance, props.crmTable);
+    this.denyDirectCrmHttpSecretAccess(role, props.instance);
     this.denyDirectKnockSecretAccess(role, props);
     this.denyDirectEmailSecretAccess(role, props.secrets.googleEmail, instanceNames(props.instance).secretGoogleEmail);
     this.denyDirectDocsSecretAccess(role, instanceNames(props.instance).secretGoogleDocs);
@@ -427,6 +504,20 @@ class FoundationAgent extends cdk.Stack {
     }));
     return role;
   }
+  secretBearingReadsPolicy(instance, roles) {
+    new iam.ManagedPolicy(this, "AgentSecretBearingReadsDeny", {
+      description: `${instance.displayName} agent: no AWS read whose response carries a secret`,
+      roles,
+      statements: [
+        new iam.PolicyStatement({
+          sid: "DenySecretBearingReads",
+          effect: iam.Effect.DENY,
+          actions: [...SECRET_BEARING_READ_ACTIONS],
+          resources: ["*"]
+        })
+      ]
+    });
+  }
   buildSpansIngestionPolicy() {
     return new logs.ResourcePolicy(this, "AgentSpansIngestion", {
       resourcePolicyName: `${this.stackName}-AgentSpansFromXray`,
@@ -454,6 +545,7 @@ class FoundationAgent extends cdk.Stack {
       description: `${props.instance.displayName} AgentCore execution role (least privilege)`
     });
     this.denyDirectCrmTableAccess(role, props.instance, props.crmTable);
+    this.denyDirectCrmHttpSecretAccess(role, props.instance);
     this.denyDirectKnockSecretAccess(role, props);
     this.denyDirectUpworkApprovalAccess(role, props.upworkApprovalTable);
     this.denyDirectEmailSecretAccess(role, props.secrets.googleEmail, instanceNames(props.instance).secretGoogleEmail);
@@ -1550,12 +1642,14 @@ class FoundationApi extends cdk2.Stack {
     }
     if (provisionsIntegration(props.instance, "crm")) {
       const crm = crmConfigForProvisioning(props.configPath);
+      const provider = props.instance.crm.provider;
       const crmTable = props.crmTable;
       if (crmTable === undefined)
         throw new Error(`${id}: integrations.crm is enabled but no CRM table was supplied by FoundationData`);
+      const usesTable = provider.kind === "dynamodb" || crm.outreach !== undefined;
       const crmProxyRole = new iam2.Role(this, "CrmProxyRole", {
         assumedBy: new iam2.ServicePrincipal("lambda.amazonaws.com"),
-        description: `${display} CRM proxy Lambda role (self-hosted CRM table access only)`,
+        description: provider.kind === "dynamodb" ? `${display} CRM proxy Lambda role (self-hosted CRM table access only)` : `${display} CRM proxy Lambda role (crm/1 key and outreach ledger only)`,
         managedPolicies: [
           iam2.ManagedPolicy.fromAwsManagedPolicyName("service-role/AWSLambdaBasicExecutionRole")
         ]
@@ -1565,30 +1659,83 @@ class FoundationApi extends cdk2.Stack {
         actions: ["secretsmanager:GetSecretValue"],
         resources: [secretArnPattern2(props.secrets.signing)]
       }));
-      crmProxyRole.addToPolicy(new iam2.PolicyStatement({
-        sid: "CrmTableData",
-        actions: [
-          "dynamodb:GetItem",
-          "dynamodb:PutItem",
-          "dynamodb:UpdateItem",
-          "dynamodb:DeleteItem",
-          "dynamodb:BatchGetItem",
-          "dynamodb:BatchWriteItem",
-          "dynamodb:TransactWriteItems",
-          "dynamodb:ConditionCheckItem"
-        ],
-        resources: [crmTable.tableArn]
-      }));
-      crmProxyRole.addToPolicy(new iam2.PolicyStatement({
-        sid: "CrmRecordsIndex",
-        actions: ["dynamodb:Query"],
-        resources: [crmTable.tableArn, `${crmTable.tableArn}/index/RecordsIndex`]
-      }));
-      crmProxyRole.addToPolicy(new iam2.PolicyStatement({
-        sid: "CrmTableKey",
-        actions: ["kms:Decrypt", "kms:Encrypt", "kms:GenerateDataKey", "kms:DescribeKey"],
-        resources: [(crmTable.encryptionKey ?? props.dataKey).keyArn]
-      }));
+      if (provider.kind === "dynamodb") {
+        crmProxyRole.addToPolicy(new iam2.PolicyStatement({
+          sid: "CrmTableData",
+          actions: [
+            "dynamodb:GetItem",
+            "dynamodb:PutItem",
+            "dynamodb:UpdateItem",
+            "dynamodb:DeleteItem",
+            "dynamodb:BatchGetItem",
+            "dynamodb:BatchWriteItem",
+            "dynamodb:TransactWriteItems",
+            "dynamodb:ConditionCheckItem"
+          ],
+          resources: [crmTable.tableArn]
+        }));
+        crmProxyRole.addToPolicy(new iam2.PolicyStatement({
+          sid: "CrmRecordsIndex",
+          actions: ["dynamodb:Query"],
+          resources: [crmTable.tableArn, `${crmTable.tableArn}/index/RecordsIndex`]
+        }));
+      } else {
+        crmProxyRole.addToPolicy(new iam2.PolicyStatement({
+          sid: "CrmHttpSecret",
+          actions: ["secretsmanager:GetSecretValue"],
+          resources: [
+            secretArnPattern2(secretsmanager.Secret.fromSecretNameV2(this, "CrmHttpSecret", names.secretCrmHttp))
+          ]
+        }));
+        if (usesTable)
+          crmProxyRole.addToPolicy(new iam2.PolicyStatement({
+            sid: "CrmOutreachLedger",
+            actions: [
+              "dynamodb:GetItem",
+              "dynamodb:PutItem",
+              "dynamodb:UpdateItem",
+              "dynamodb:DeleteItem",
+              "dynamodb:TransactWriteItems"
+            ],
+            resources: [crmTable.tableArn],
+            conditions: {
+              "ForAllValues:StringEquals": {
+                "dynamodb:LeadingKeys": [crmOutreachLedgerPartition(props.instance.name)]
+              }
+            }
+          }));
+      }
+      if (usesTable)
+        crmProxyRole.addToPolicy(new iam2.PolicyStatement({
+          sid: "CrmTableKey",
+          actions: ["kms:Decrypt", "kms:Encrypt", "kms:GenerateDataKey", "kms:DescribeKey"],
+          resources: [(crmTable.encryptionKey ?? props.dataKey).keyArn]
+        }));
+      const release = releaseVersionContext(this);
+      const crmProxyEnvironment = {
+        FOUNDATION_CRM_TABLE_NAME: crmTable.tableName,
+        FOUNDATION_SLACK_SIGNING_SECRET_ID: props.secrets.signing.secretName,
+        FOUNDATION_SLACK_TEAM_ID: props.instance.slack.teamId,
+        FOUNDATION_CRM_TENANT_ID: props.instance.name,
+        FOUNDATION_CRM_ALLOWED_CHANNELS: JSON.stringify(crm.channels),
+        FOUNDATION_CRM_ALLOWED_STATUSES: JSON.stringify(crm.statuses),
+        FOUNDATION_CRM_ACTIVITY_TYPES: JSON.stringify(crm.activityTypes),
+        FOUNDATION_CRM_MAX_BATCH_SIZE: String(crm.maxBatchSize),
+        FOUNDATION_CRM_STATUS_POLICY: JSON.stringify(crm.statusPolicy),
+        FOUNDATION_CRM_DELETES: String(crm.deletes),
+        ...crm.outreach === undefined ? {} : {
+          FOUNDATION_CRM_OUTREACH: JSON.stringify(crm.outreach),
+          FOUNDATION_CRM_TIMEZONE: crm.timezone
+        },
+        ...provider.kind === "http" ? {
+          FOUNDATION_CRM_PROVIDER: "http",
+          FOUNDATION_CRM_HTTP_BASE_URL: provider.baseUrl,
+          FOUNDATION_CRM_HTTP_SECRET_ID: names.secretCrmHttp,
+          FOUNDATION_CRM_HTTP_EXPECTED_TENANT: provider.expectedTenant,
+          ...release === undefined ? {} : { FOUNDATION_RELEASE: release }
+        } : {}
+      };
+      assertLambdaEnvironmentBudget(crmProxyEnvironment);
       this.crmProxyFunction = new lambda.Function(this, "CrmProxyFunction", {
         functionName: names.crmProxyFunctionName,
         runtime: lambda.Runtime.NODEJS_22_X,
@@ -1597,20 +1744,7 @@ class FoundationApi extends cdk2.Stack {
         role: crmProxyRole,
         timeout: cdk2.Duration.seconds(30),
         memorySize: 256,
-        environment: {
-          FOUNDATION_CRM_TABLE_NAME: crmTable.tableName,
-          FOUNDATION_SLACK_SIGNING_SECRET_ID: props.secrets.signing.secretName,
-          FOUNDATION_SLACK_TEAM_ID: props.instance.slack.teamId,
-          FOUNDATION_CRM_TENANT_ID: props.instance.name,
-          FOUNDATION_CRM_ALLOWED_CHANNELS: JSON.stringify(crm.channels),
-          FOUNDATION_CRM_ALLOWED_STATUSES: JSON.stringify(crm.statuses),
-          FOUNDATION_CRM_ACTIVITY_TYPES: JSON.stringify(crm.activityTypes),
-          FOUNDATION_CRM_MAX_BATCH_SIZE: String(crm.maxBatchSize),
-          ...crm.outreach === undefined ? {} : {
-            FOUNDATION_CRM_OUTREACH: JSON.stringify(crm.outreach),
-            FOUNDATION_CRM_TIMEZONE: crm.timezone
-          }
-        }
+        environment: crmProxyEnvironment
       });
       new cdk2.CfnOutput(this, "CrmProxyFunctionArn", {
         value: this.crmProxyFunction.functionArn
@@ -1660,6 +1794,12 @@ class FoundationApi extends cdk2.Stack {
       agentRuntimeArn: props.agentRuntimeArn,
       alarmAction
     });
+    if (this.crmProxyFunction !== undefined && props.instance.crm.provider.kind === "http")
+      addCrmProviderAlarms(this, {
+        instance: props.instance,
+        functionName: names.crmProxyFunctionName,
+        alarmAction
+      });
     let dispatcherFunctionName;
     if (configuredScheduledJobs.length > 0) {
       const dispatchRole = new iam2.Role(this, "ScheduledJobDispatcherRole", {
@@ -1782,34 +1922,13 @@ function addConfigLoadAlarm(stack, args) {
     return;
   const runtimeId = cdk2.Fn.select(1, cdk2.Fn.split("/", args.agentRuntimeArn));
   const logGroupName = `/aws/bedrock-agentcore/runtimes/${runtimeId}-${LIVE_ENDPOINT_NAME}`;
-  const role = new iam2.Role(stack, "AgentLiveLogGroupRole", {
-    assumedBy: new iam2.ServicePrincipal("lambda.amazonaws.com"),
-    description: `${args.instance.displayName} creates the runtime's live log group when missing`,
-    managedPolicies: [
-      iam2.ManagedPolicy.fromAwsManagedPolicyName("service-role/AWSLambdaBasicExecutionRole")
-    ]
-  });
-  role.addToPolicy(new iam2.PolicyStatement({
+  const ensureLogGroup = ensureLogGroupExists(stack, {
+    id: "AgentLiveLogGroup",
     sid: "CreateRuntimeLiveLogGroup",
-    actions: ["logs:CreateLogGroup"],
-    resources: [
-      `arn:${stack.partition}:logs:${stack.region}:${stack.account}:log-group:${logGroupName}`
-    ]
-  }));
-  const ensureFunction = new lambda.Function(stack, "AgentLiveLogGroupFunction", {
-    runtime: lambda.Runtime.NODEJS_22_X,
-    handler: "index.runtimeLogGroupHandler",
-    code: lambdaCode(stack, "gateway"),
-    role,
-    timeout: cdk2.Duration.seconds(30),
-    memorySize: 128
-  });
-  const ensureLogGroup = new cdk2.CustomResource(stack, "AgentLiveLogGroup", {
-    serviceToken: ensureFunction.functionArn,
     resourceType: "Custom::FoundationRuntimeLogGroup",
-    properties: { LogGroupName: logGroupName }
+    description: `${args.instance.displayName} creates the runtime's live log group when missing`,
+    logGroupName
   });
-  ensureLogGroup.node.addDependency(role);
   const filter = new logs2.MetricFilter(stack, "ConfigLoadFailureMetricFilter", {
     logGroup: logs2.LogGroup.fromLogGroupName(stack, "AgentLiveLogs", logGroupName),
     filterPattern: logs2.FilterPattern.any(...CONFIG_LOAD_FAILURE_EVENTS.map((event) => logs2.FilterPattern.stringValue("$.event", "=", event))),
@@ -1835,22 +1954,136 @@ function addConfigLoadAlarm(stack, args) {
   alarm.addAlarmAction(args.alarmAction);
   return alarm;
 }
+function ensureLogGroupExists(stack, args) {
+  const role = new iam2.Role(stack, `${args.id}Role`, {
+    assumedBy: new iam2.ServicePrincipal("lambda.amazonaws.com"),
+    description: args.description,
+    managedPolicies: [
+      iam2.ManagedPolicy.fromAwsManagedPolicyName("service-role/AWSLambdaBasicExecutionRole")
+    ]
+  });
+  role.addToPolicy(new iam2.PolicyStatement({
+    sid: args.sid,
+    actions: ["logs:CreateLogGroup"],
+    resources: [
+      `arn:${stack.partition}:logs:${stack.region}:${stack.account}:log-group:${args.logGroupName}`
+    ]
+  }));
+  const ensureFunction = new lambda.Function(stack, `${args.id}Function`, {
+    runtime: lambda.Runtime.NODEJS_22_X,
+    handler: "index.runtimeLogGroupHandler",
+    code: lambdaCode(stack, "gateway"),
+    role,
+    timeout: cdk2.Duration.seconds(30),
+    memorySize: 128
+  });
+  const ensureLogGroup = new cdk2.CustomResource(stack, args.id, {
+    serviceToken: ensureFunction.functionArn,
+    resourceType: args.resourceType,
+    properties: { LogGroupName: args.logGroupName }
+  });
+  ensureLogGroup.node.addDependency(role);
+  return ensureLogGroup;
+}
+var CRM_PROVIDER_ALARMS = [
+  {
+    event: "crm_proxy",
+    code: "tenant_mismatch",
+    name: "TenantMismatch",
+    description: "The CRM answered as a different tenant from crm.provider.expectedTenant, so the CRM proxy refused the reply and the CRM tools fail closed. Check that the key written with crm-key was issued for that tenant, and that expectedTenant is right."
+  },
+  {
+    event: "crm_proxy",
+    code: "upstream_unauthorized",
+    name: "UpstreamUnauthorized",
+    description: "The CRM refused the CRM proxy's key (401), even after the proxy re-read it: revoked, expired or wrong. Issue a new key in the CRM and run foundation-deploy crm-key; the proxy picks it up on its next call."
+  },
+  {
+    event: "crm_proxy",
+    code: "upstream_forbidden",
+    name: "UpstreamForbidden",
+    description: "The CRM answered 403: a scope the key lacks, the CRM's kill switch, or a WAF in front of it blocking the proxy. Check the key's scopes, the switch and the WAF's logs."
+  },
+  {
+    event: "crm_proxy",
+    code: "unconfigured",
+    name: "Unconfigured",
+    description: "The CRM proxy is unconfigured, so every CRM tool fails closed: no key written yet (run foundation-deploy crm-key), or the CRM's /meta does not match the deployment. The log line's check field names which: contract, statuses, activity_types, batch_size or operations."
+  },
+  {
+    event: "crm_proxy_warning",
+    code: "ledger_kept",
+    name: "LedgerKept",
+    description: "A draft's outreach reservation was kept because the CRM's answer was unknown (a timeout, a 5xx, a 429 or a reply without the contract header). The weekly cap counts it, failing closed. Check in the CRM whether that draft was logged."
+  },
+  {
+    event: "crm_proxy_warning",
+    code: "policy_mismatch",
+    name: "PolicyMismatch",
+    description: "The CRM's own policy in /meta differs from the deployment's capabilities.crm (the log line's fields name which). Each side enforces its own, so the stricter wins; align the two."
+  }
+];
+function addCrmProviderAlarms(stack, args) {
+  const logGroupName = `/aws/lambda/${args.functionName}`;
+  const ensureLogGroup = ensureLogGroupExists(stack, {
+    id: "CrmProxyLogGroup",
+    sid: "CreateCrmProxyLogGroup",
+    resourceType: "Custom::FoundationLambdaLogGroup",
+    description: `${args.instance.displayName} creates the CRM proxy's log group when missing`,
+    logGroupName
+  });
+  const logGroup = logs2.LogGroup.fromLogGroupName(stack, "CrmProxyLogs", logGroupName);
+  return CRM_PROVIDER_ALARMS.map((entry) => {
+    const filter = new logs2.MetricFilter(stack, `CrmProxy${entry.name}MetricFilter`, {
+      logGroup,
+      filterPattern: logs2.FilterPattern.all(logs2.FilterPattern.stringValue("$.event", "=", entry.event), logs2.FilterPattern.stringValue("$.code", "=", entry.code)),
+      metricNamespace: `Foundation/${args.instance.naming.prefix}`,
+      metricName: `CrmProxy${entry.name}`,
+      metricValue: "1"
+    });
+    filter.node.addDependency(ensureLogGroup);
+    const alarm = new cloudwatch.Alarm(stack, `CrmProxy${entry.name}Alarm`, {
+      alarmDescription: `${args.instance.displayName} CRM proxy logged ${entry.code}. ${entry.description}`,
+      metric: filter.metric({
+        statistic: "Sum",
+        period: cdk2.Duration.minutes(entry.code === "policy_mismatch" ? 60 : 5)
+      }),
+      threshold: 1,
+      evaluationPeriods: 1,
+      comparisonOperator: cloudwatch.ComparisonOperator.GREATER_THAN_OR_EQUAL_TO_THRESHOLD,
+      treatMissingData: cloudwatch.TreatMissingData.NOT_BREACHING
+    });
+    alarm.addAlarmAction(args.alarmAction);
+    return alarm;
+  });
+}
+function crmOutreachLedgerPartition(tenantId) {
+  return `TENANT#${tenantId}#OUTREACH`;
+}
+function releaseVersionContext(scope) {
+  const explicit = String(scope.node.tryGetContext("foundationVersion") ?? "");
+  const version = explicit !== "" ? explicit : releaseSource(scope)?.version;
+  return version !== undefined && FOUNDATION_VERSION_RE.test(version) ? version : undefined;
+}
 function crmConfigForProvisioning(configPath) {
   const config = parseInstanceConfig(readFileSync(configPath, "utf8"));
   const crm = config.capabilities.crm;
   const missing = [
     ...crm.enabled ? [] : ["capabilities.crm.enabled"],
     ...crm.channels.length > 0 ? [] : ["capabilities.crm.channels"],
-    ...crm.statuses.length > 0 ? [] : ["capabilities.crm.statuses"],
+    ...crm.statuses.company.length > 0 ? [] : ["capabilities.crm.statuses.company"],
+    ...crm.statuses.contact.length > 0 ? [] : ["capabilities.crm.statuses.contact"],
     ...crm.activityTypes.length > 0 ? [] : ["capabilities.crm.activityTypes"]
   ];
   if (missing.length > 0)
     throw new Error(`${configPath}: integrations.crm requires a configured CRM capability (${missing.join(", ")})`);
   return {
     channels: [...crm.channels],
-    statuses: [...crm.statuses],
+    statuses: { company: [...crm.statuses.company], contact: [...crm.statuses.contact] },
     activityTypes: [...crm.activityTypes],
     maxBatchSize: crm.maxBatchSize,
+    statusPolicy: crm.statusPolicy,
+    deletes: crm.deletes,
     policyFingerprint: crmPolicyFingerprint(crm),
     ...crmOutreachConfigured(crm.outreach) ? { outreach: crm.outreach } : {},
     timezone: config.timezone
@@ -1929,7 +2162,7 @@ function assertLambdaEnvironmentBudget(values) {
     bytes += cdk2.Token.isUnresolved(value) ? LAMBDA_ENVIRONMENT_TOKEN_BYTES : Buffer.byteLength(value);
   }
   if (bytes > LAMBDA_ENVIRONMENT_MAX_BYTES) {
-    throw new Error(`Gateway Lambda environment needs an estimated ${bytes} bytes; the AWS limit is ${LAMBDA_ENVIRONMENT_MAX_BYTES}. Shorten job prompts or reduce configured values.`);
+    throw new Error(`A Lambda environment needs an estimated ${bytes} bytes; the AWS limit is ${LAMBDA_ENVIRONMENT_MAX_BYTES}. Shorten job prompts or reduce configured values.`);
   }
 }
 function scheduledJobsFor(configPath) {
@@ -2120,6 +2353,7 @@ class FoundationData extends cdk4.Stack {
   crmTable;
   upworkApprovalTable;
   etradePendingTable;
+  crmHttpSecret;
   secrets;
   constructor(scope, id, props) {
     super(scope, id, props);
@@ -2238,6 +2472,15 @@ class FoundationData extends cdk4.Stack {
         generateStringKey: "placeholder"
       }
     }) : undefined;
+    this.crmHttpSecret = provisionsIntegration(props.instance, "crm") && props.instance.crm.provider.kind === "http" ? new secretsmanager2.Secret(this, "CrmHttpSecret", {
+      secretName: names.secretCrmHttp,
+      description: `crm/1 key for ${display}'s CRM ({ api_key }); written by foundation-deploy crm-key, read only by the CRM proxy`,
+      removalPolicy: cdk4.RemovalPolicy.DESTROY,
+      generateSecretString: {
+        secretStringTemplate: "{}",
+        generateStringKey: "placeholder"
+      }
+    }) : undefined;
     const upwork = provisionsIntegration(props.instance, "upwork") ? secretShell("UpworkSecret", names.secretUpwork, `Upwork OAuth client and token store for ${display} ({ client_id, client_secret, access_token?, refresh_token?, expires_at?, tenant_id? })`) : undefined;
     const etradeClient = provisionsIntegration(props.instance, "etrade") ? new secretsmanager2.Secret(this, "EtradeClientSecret", {
       secretName: names.secretEtradeClient,

package/dist/chunk-tey0gh86.js

@@ -0,0 +1,38 @@
+// ../capability-crm/src/proxy/errors.ts
+class CrmOutreachUnconfiguredError extends Error {
+  constructor() {
+    super("CRM outreach is not configured");
+    this.name = "CrmOutreachUnconfiguredError";
+  }
+}
+
+class CrmRecordNotFoundError extends Error {
+  constructor() {
+    super("CRM record does not exist");
+    this.name = "CrmRecordNotFoundError";
+  }
+}
+
+class CrmIdempotencyConflictError extends Error {
+  constructor() {
+    super("CRM idempotency key conflicts with an earlier request");
+    this.name = "CrmIdempotencyConflictError";
+  }
+}
+
+class CrmStorageError extends Error {
+  constructor() {
+    super("CRM storage operation failed");
+    this.name = "CrmStorageError";
+  }
+}
+class CrmStaleWriteError extends Error {
+  code;
+  constructor(code) {
+    super(`CRM record changed since it was read: ${code}`);
+    this.code = code;
+    this.name = "CrmStaleWriteError";
+  }
+}
+
+export { CrmOutreachUnconfiguredError, CrmRecordNotFoundError, CrmIdempotencyConflictError, CrmStorageError, CrmStaleWriteError };

package/dist/src/index.js

@@ -10,42 +10,46 @@ import {
   FoundationPipeline,
   NewsletterStack,
   deployStatements
-} from "../chunk-efqdhd2e.js";
+} from "../chunk-spq5kr1t.js";
 import {
   BUN_VERSION,
   LAMBDA_ENTRY_POINTS,
-  LIVE_ENDPOINT_NAME,
   RELEASE_BUCKET_ENV,
   RELEASE_DIR_ENV,
-  WEB_SEARCH_CONNECTOR_VERSION,
-  WEB_SEARCH_TARGET,
-  adminsFor,
   agentImage,
   agentImageTagRequired,
   buildManifest,
-  capabilityEnabled,
-  configPathFor,
   ecrRepositoryArn,
-  enabledIntegrations,
-  instanceNames,
   lambdaBundleContext,
   lambdaCode,
   lambdaKey,
-  loadInstanceFile,
   manifestKey,
   manifestSigningPayload,
   parseManifest,
-  provisionsIntegration,
   releaseAccess,
   releaseCacheDir,
   releaseImageRepositoryArn,
   releaseSource,
-  requiresAuthenticatedQueue,
   skillsKey,
   skipBundle,
   verifyManifest
-} from "../chunk-gnz747z2.js";
+} from "../chunk-pxhftba1.js";
 import"../chunk-dz91avrb.js";
+import {
+  LIVE_ENDPOINT_NAME,
+  WEB_SEARCH_CONNECTOR_VERSION,
+  WEB_SEARCH_TARGET,
+  adminsFor,
+  capabilityEnabled,
+  configPathFor,
+  enabledIntegrations,
+  instanceNames,
+  loadInstanceFile,
+  provisionsIntegration,
+  requiresAuthenticatedQueue
+} from "../chunk-fjdgxw8h.js";
+import"../chunk-96fjaysn.js";
+import"../chunk-5wgwscd0.js";
 export {
   BUILD_TIMEOUT,
   BUN_VERSION,

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@deployfoundation/foundation-deploy",
-  "version": "0.2.51",
+  "version": "0.2.53",
   "description": "Deploys one Foundation instance from a published, signed release: the CDK app and the deploy tool.",
   "license": "UNLICENSED",
   "private": false,
@@ -28,7 +28,9 @@
     "synth": "cdk synth --quiet"
   },
   "dependencies": {
+    "@aws-sdk/client-dynamodb": "3.1111.0",
     "@aws-sdk/client-kms": "3.1111.0",
+    "@aws-sdk/lib-dynamodb": "3.1111.0",
     "aws-cdk": "2.1142.0",
     "aws-cdk-lib": "2.270.0",
     "constructs": "10.8.1",