template.yaml

AWSTemplateFormatVersion: '2010-09-09'
Transform: AWS::Serverless-2016-10-31
Description: Code-configured serverless automation runner

Parameters:
  TeamSecretsTable:
    Type: String
    Default: dataops-v1-secrets
  TeamSecretsKeyId:
    Type: String
    Default: 420b802e-1d2c-4a51-95e7-f798381303bb
  YouTubeWebhookSecretName:
    Type: String
    Default: youtubewebhooksecret-ehtsdest4scz
  AdminSecretName:
    Type: String
    Default: dapier.admin
  AwsAssumableRoleArns:
    Type: CommaDelimitedList
    Default: arn:aws:iam::387546586013:role/dapier-mailchimp-backup
    AllowedPattern: 'arn:aws(-us-gov|-cn)?:iam::[0-9]{12}:role/[A-Za-z0-9+=,.@_/-]+'
    Description: IAM roles operators may configure for provider access

  DomainName:
    Type: String
    Default: dapier.dtcdev.click
  DeveloperWebhookSecret:
    Type: String
    Default: ""
    Description: Optional DataOps team store name for /hooks/developer shared secret (empty disables)
  HubIntakeTokenSecret:
    Type: String
    Default: dapier.hub
    Description: DataOps team store name holding the Hub service bearer token for the hub_session action
  HubIntakeUrl:
    Type: String
    Default: https://hub.dtcdev.click/api/intake/tasks
    Description: Hub intake create URL used by /hooks/developer and the hub_session action

  DomainCertificateArn:
    Type: String
  HostedZoneId:
    Type: String
    Default: Z05963572WVWFHDQZH5NE
  HtmlRendererImageUri:
    Type: String
  DatamailerInboundBucketName:
    Type: String
    Default: relay-sandbox-817685572750-eu-west-1-inbound-mail
  InboundEmailTopicArn:
    Type: String
    Default: arn:aws:sns:eu-west-1:817685572750:relay-sandbox-inbound-email-events
  DataOpsEmailDocumentsBucket:
    Type: String
    Default: dataops-v1-emaildocumentsbucket-1dbv70hrd4al
    Description: >
      DataOps intake documents bucket; the worker stages files under its
      transfer/ prefix because the intake verifies each document's S3 source
  AuthBaseUrl:
    Type: String
    Default: https://auth.dtcdev.click
  AuthClientId:
    Type: String
  AuthCliClientId:
    Type: String
    Default: ''
    Description: DTC shared-auth public client ID for the dapier CLI (empty disables CLI token issuance)
  AuthIssuer:
    Type: String
  AuthJwksUrl:
    Type: String
  OperatorEmails:
    Type: String
    Default: ''
    Description: Comma-separated DTC accounts allowed to administer connections (empty means any signed-in DTC account)
  OperatorSubjects:
    Type: String
    Default: ''
    Description: Comma-separated stable DTC subjects allowed to administer connections
  GmailScopes:
    Type: String
    Default: gmail.modify
    Description: >
      Extra Gmail OAuth scopes (GMAIL_SCOPES) added to the grant of any
      Google connection that touches Gmail, comma- or whitespace-separated
      full URLs or short names (gmail.modify backs `dapier gmail mark` and
      label changes); empty grants only the connector's declared
      gmail.readonly and gmail.send
  TriggerEmailDomain:
    Type: String
    Default: dtcdev.click
    Description: Domain for operator-created email trigger addresses
  EmailSender:
    Type: String
    Default: no-reply@dtcdev.click
    Description: From address for email_send workflow actions (must be SES-verified)
  AlertEmailSender:
    Type: String
    Default: 'DTC Alerts <alerts@dtcdev.click>'
    Description: >
      From address for operator alert emails (alarm notify, failure
      notices, error/connection digests, and backup notices).
  NotifyEmail:
    Type: String
    Default: dev@dtcdev.click
    Description: >
      Operator inbox for failed-run notices, CloudWatch alarms, and the
      daily error digest. Alarms go to the dev@ mailbox so they reach
      Developer directly (dev-mailbox forwards them to the Developer bot
      webhook). Distinct from EmailSender, which is the SES
      From identity and is not a mailbox anyone reads.
  EmailSendRegion:
    Type: String
    Default: us-east-1
    Description: SES region with the verified completion-email sender identity
  GithubWorkflowsTokenSecret:
    Type: String
    Default: ''
    Description: >
      DataOps team store entry name holding a GitHub token (Contents: read/write
      on the workflows repo). Set to let the console designer commit
      workflows/*.yaml straight to the repo; empty disables designer saves.
  SesNotificationTopics:
    Type: String
    Default: ''
    Description: >
      Comma-separated SNS TopicArns the SES feedback hook accepts
      (SES_NOTIFICATION_TOPICS allowlist); empty accepts any topic — set
      the configuration set's feedback destination topics in production
  SesConfigurationSet:
    Type: String
    Default: ''
    Description: >
      SES configuration set attached to workflow email sends
      (SES_CONFIGURATION_SET) — the switch that makes SES report bounce and
      complaint feedback at all; create the set with an event destination
      whose SNS topic subscribes https://<domain>/hooks/ses-notifications,
      then list that topic in SesNotificationTopics. Empty sends untagged.
  BackupAlertEmail:
    Type: String
    Default: alexey.s.grigoriev@gmail.com
    Description: Recipient of the DynamoDB backup failure email


Globals:
  Function:
    Timeout: 30
    MemorySize: 256
    Tracing: Active
    Environment:
      Variables:
        TEAM_SECRETS_TABLE: !Ref TeamSecretsTable
        TEAM_SECRETS_KEY_ID: !Ref TeamSecretsKeyId
        TEAM_SECRETS_REGION: eu-west-1
        AWS_ASSUMABLE_ROLE_ARNS: !Join [",", !Ref AwsAssumableRoleArns]
        S3_RUNTIME_UPLOAD_BUCKETS: !Ref ZoomTranscriptsBucket
        EVENT_QUEUE_URL: !Ref EventQueue
        CONNECTIONS_TABLE: !Ref ConnectionsTable
        CREDENTIALS_TABLE: !Ref CredentialsTable
        CURSORS_TABLE: !Ref CursorsTable
        EXECUTIONS_TABLE: !Ref ExecutionsTable
        GRANTS_TABLE: !Ref GrantsTable
        TASK_USAGE_TABLE: !Ref TaskUsageTable
        PAID_API_USAGE_TABLE: !Ref PaidApiUsageTable
        STORAGE_TABLE: !Ref StorageTable
        DIGESTS_TABLE: !Ref DigestsTable
        AUDIT_TABLE: !Ref AuditTable
        RENDER_QUEUE_URL: !Ref RenderQueue
        RENDER_ARTIFACTS_BUCKET: !Ref RenderArtifactsBucket
        DATAOPS_EMAIL_DOCUMENTS_BUCKET: !Ref DataOpsEmailDocumentsBucket
        AUTH_BASE_URL: !Ref AuthBaseUrl
        AUTH_CLIENT_ID: !Ref AuthClientId
        AUTH_CLI_CLIENT_ID: !Ref AuthCliClientId
        AUTH_CALLBACK_URL: !Sub https://${DomainName}/auth/callback
        AUTH_LOGOUT_URL: !Sub https://${DomainName}/
        OAUTH_CALLBACK_URL: !Sub https://${DomainName}/oauth/callback
        # Extra Gmail scopes (connectors.gmail GMAIL_SCOPES) beyond the
        # declared gmail.readonly/gmail.send; empty keeps the declaration.
        GMAIL_SCOPES: !Ref GmailScopes
        AUTH_ISSUER: !Ref AuthIssuer
        AUTH_JWKS_URL: !Ref AuthJwksUrl
        OPERATOR_EMAILS: !Ref OperatorEmails
        OPERATOR_SUBJECTS: !Ref OperatorSubjects
        TRIGGER_EMAIL_DOMAIN: !Ref TriggerEmailDomain
        EMAIL_FROM_TABLE: !Ref EmailFromTable
        DAPIER_EMAIL_REGION: !Ref EmailSendRegion
        DAPIER_ALERT_SENDER: !Ref AlertEmailSender
        DAPIER_NOTIFY_EMAIL: !Ref NotifyEmail
        HOOK_TRIGGERS_TABLE: !Ref HookTriggersTable
        TRIGGER_INBOX_TABLE: !Ref TriggerInboxTable
        SCHEDULE_TRIGGERS_TABLE: !Ref ScheduleTriggersTable
        POLL_TRIGGERS_TABLE: !Ref PollTriggersTable
        PUBLISHED_WORKFLOWS_TABLE: !Ref PublishedWorkflowsTable
        API_TOKENS_TABLE: !Ref ApiTokensTable
        DEVICE_SESSIONS_TABLE: !Ref DeviceSessionsTable
        HOOKS_BASE_URL: !Sub https://${DomainName}

Resources:
  # ACM certificate for dapier.dtcdev.click, issued DNS-validated and in use
  # by the API custom domain (via the DomainCertificateArn parameter below).
  # Brought under IaC 2026-10-27 during the sandbox IaC sweep by importing
  # the live issued certificate; properties mirror live config. Retain on
  # both policies: the cert is shared (also referenced outside this stack)
  # and must never be deleted or replaced with the stack.
  DomainCertificate:
    Type: AWS::CertificateManager::Certificate
    DeletionPolicy: Retain
    UpdateReplacePolicy: Retain
    Properties:
      DomainName: dapier.dtcdev.click
      ValidationMethod: DNS
      KeyAlgorithm: RSA_2048
      CertificateTransparencyLoggingPreference: ENABLED

  Api:
    Type: AWS::Serverless::HttpApi
    Properties:
      CorsConfiguration:
        AllowOrigins: ['*']
        # Bearer token: GET /internal/ops/status is read by a browser-hosted
        # console, so its Authorization header has to survive the preflight.
        AllowHeaders: [content-type, x-dropbox-signature, authorization]
        AllowMethods: [GET, POST]
      Domain:
        DomainName: !Ref DomainName
        CertificateArn: !Ref DomainCertificateArn
        EndpointConfiguration: REGIONAL
        Route53:
          HostedZoneId: !Ref HostedZoneId
          EvaluateTargetHealth: false

  # JavaScript code steps run on an embedded V8 (py_mini_racer). Its wheel is
  # manylinux_2_27-only, which SAM's PythonPipBuilder refuses to cross-resolve
  # for arm64, so it ships as a prebuilt layer — `make layer` produces the zip
  # under .aws-sam/layers-src/, which SAM's repo copy skips — rather than a
  # requirements.txt entry. Attached only to the functions that can execute a
  # chain: the API (test-run with execute=true) and the worker (real runs).
  JsRuntimeLayer:
    Type: AWS::Serverless::LayerVersion
    Properties:
      LayerName: dapier-js-runtime
      Description: py_mini_racer (embedded V8) for JavaScript code steps
      ContentUri: .aws-sam/layers-src/js-runtime.zip
      CompatibleRuntimes:
        - python3.12
      CompatibleArchitectures:
        - arm64
      RetentionPolicy: Retain

  # The API's execution role, explicit and named. The implicit role this
  # replaces accumulated inline policy documents deploy after deploy until
  # its total crossed IAM's 10240-byte cap — from then on every PutRolePolicy
  # failed with ServiceLimitExceeded, the role drifted from the template
  # (the connections table's dynamodb grants vanished; every connections
  # route answered 500), and no deploy could repair it. A new role starts
  # with an empty budget. The statements below consolidate the previous
  # per-table policy documents (identical actions, identical tables —
  # DynamoDBCrudPolicy/DynamoDBReadPolicy spelled out) into a handful of
  # documents, leaving years of headroom under the cap. If this role ever
  # fills again, the repair is the same: a new logical id here mints a
  # fresh role on the next deploy.
  ApiExecutionRole:
    Type: AWS::IAM::Role
    Properties:
      AssumeRolePolicyDocument:
        Version: '2012-10-17'
        Statement:
          - Effect: Allow
            Principal: {Service: lambda.amazonaws.com}
            Action: sts:AssumeRole
      # The managed policies SAM attaches to an implicit execution role:
      # function logs and X-Ray tracing. Managed policies never count
      # against the inline-policy budget.
      ManagedPolicyArns:
        - !Sub arn:aws:iam::aws:policy/service-role/AWSLambdaBasicExecutionRole
        - !Sub arn:aws:iam::aws:policy/AWSXRayDaemonWriteAccess
      Policies:
        # Named inline documents (an explicit role takes raw policy
        # documents, not SAM policy templates). Same grants the implicit
        # role carried, consolidated into a handful of documents.
        - PolicyName: dapier-api-assume-configured-roles
          PolicyDocument:
            Version: '2012-10-17'
            Statement:
              - Effect: Allow
                Action: sts:AssumeRole
                Resource: !Ref AwsAssumableRoleArns
        - PolicyName: dapier-api-enqueue-work
          PolicyDocument:
            Version: '2012-10-17'
            Statement:
              - Effect: Allow
                Action: sqs:SendMessage
                Resource:
                  - !GetAtt EventQueue.Arn
                  - !GetAtt DropboxQueue.Arn
              # Inline designer/CLI tests execute render_html_to_pdf in the
              # API process. Its queue URL is supplied by the stack.
              - Effect: Allow
                Action: sqs:SendMessage
                Resource: !GetAtt RenderQueue.Arn
        - PolicyName: dapier-api-provider-secrets
          PolicyDocument:
            Version: '2012-10-17'
            Statement:
              - Effect: Allow
                Action: dynamodb:GetItem
                Resource: !Sub arn:aws:dynamodb:eu-west-1:${AWS::AccountId}:table/${TeamSecretsTable}
              - Effect: Allow
                Action: kms:Decrypt
                Resource: !Sub arn:aws:kms:eu-west-1:${AWS::AccountId}:key/${TeamSecretsKeyId}
                Condition:
                  StringEquals:
                    kms:EncryptionContext:secret:
                      - !Ref AdminSecretName
                      - dapier.dataops
                      - !Ref YouTubeWebhookSecretName
                      - !Ref DeveloperWebhookSecret
                      - !Ref HubIntakeTokenSecret
                      - !Ref GithubWorkflowsTokenSecret
        - PolicyName: dapier-api-dataops-intake-stage
          PolicyDocument:
            Version: '2012-10-17'
            Statement:
              - Effect: Allow
                Action: s3:PutObject
                Resource: !Sub 'arn:aws:s3:::${DataOpsEmailDocumentsBucket}/transfer/*'
        - PolicyName: dapier-api-transcript-upload
          PolicyDocument:
            Version: '2012-10-17'
            Statement:
              - Effect: Allow
                Action: s3:PutObject
                Resource: !Sub '${ZoomTranscriptsBucket.Arn}/*'
        # Every table the API reads and writes at full CRUD, one document.
        # The per-table DynamoDBCrudPolicy documents carried exactly these
        # actions (streams reads included for parity with the SAM policy).
        - PolicyName: dapier-api-dynamodb-crud
          PolicyDocument:
            Version: '2012-10-17'
            Statement:
              - Effect: Allow
                Action: [dynamodb:BatchGetItem, dynamodb:BatchWriteItem,
                         dynamodb:ConditionCheckItem, dynamodb:DeleteItem,
                         dynamodb:DescribeTable, dynamodb:GetItem,
                         dynamodb:GetRecords, dynamodb:GetShardIterator,
                         dynamodb:Query, dynamodb:Scan, dynamodb:PutItem,
                         dynamodb:UpdateItem]
                Resource:
                  - !GetAtt ConnectionsTable.Arn
                  - !GetAtt ExecutionsTable.Arn
                  # The runs-by-run-id GSI behind every run detail read
                  # (DynamoDBCrudPolicy granted <table>/index/* implicitly).
                  - !Sub '${ExecutionsTable.Arn}/index/*'
                  - !GetAtt GrantsTable.Arn
                  - !GetAtt AuditTable.Arn
                  - !GetAtt EmailFromTable.Arn
                  - !GetAtt HookTriggersTable.Arn
                  - !GetAtt ApiTokensTable.Arn
                  - !GetAtt DeviceSessionsTable.Arn
                  - !GetAtt ScheduleTriggersTable.Arn
                  - !GetAtt PollTriggersTable.Arn
                  - !GetAtt PublishedWorkflowsTable.Arn
                  - !GetAtt StorageTable.Arn
                  - !GetAtt DigestsTable.Arn
                  # The zoom webhook intake records refused deliveries here
                  # (triggers.inbox.record/ignore) — writes, not just reads.
                  - !GetAtt TriggerInboxTable.Arn
        # Read-only tables: cursor failure counts, the usage rollup
        # (DynamoDBReadPolicy, one document).
        - PolicyName: dapier-api-dynamodb-read
          PolicyDocument:
            Version: '2012-10-17'
            Statement:
              - Effect: Allow
                Action: [dynamodb:BatchGetItem, dynamodb:ConditionCheckItem,
                         dynamodb:DescribeTable, dynamodb:GetItem,
                         dynamodb:GetRecords, dynamodb:GetShardIterator,
                         dynamodb:Query, dynamodb:Scan]
                Resource:
                  - !GetAtt CursorsTable.Arn
                  - !GetAtt TaskUsageTable.Arn
                  - !GetAtt PaidApiUsageTable.Arn
              # Inline decisions and OpenRouter health probes run on the API.
              - Effect: Allow
                Action: [dynamodb:PutItem]
                Resource: !GetAtt PaidApiUsageTable.Arn
        # Operator teardown and authenticated hook retry claims share this
        # table. Keep writes within trigger cursor/seen keys.
        - PolicyName: dapier-api-cursor-scoped-writes
          PolicyDocument:
            Version: '2012-10-17'
            Statement:
              - Effect: Allow
                Action: [dynamodb:PutItem, dynamodb:UpdateItem, dynamodb:DeleteItem]
                Resource: !GetAtt CursorsTable.Arn
                Condition:
                  ForAllValues:StringLike:
                    dynamodb:LeadingKeys: ['poll#*', 'seen#poll#*', 'seen#hook#*']
        - PolicyName: dapier-api-credentials-store
          PolicyDocument:
            Version: '2012-10-17'
            Statement:
              - Effect: Allow
                Action: [dynamodb:GetItem, dynamodb:PutItem, dynamodb:Scan]
                Resource: !GetAtt CredentialsTable.Arn
        - PolicyName: dapier-api-send-email
          PolicyDocument:
            Version: '2012-10-17'
            Statement:
              - Effect: Allow
                Action: [ses:SendEmail, ses:SendRawEmail]
                Resource: '*'
        - PolicyName: dapier-api-trigger-rules
          PolicyDocument:
            Version: '2012-10-17'
            Statement:
              - Effect: Allow
                Action: [events:PutRule, events:PutTargets, events:DeleteRule,
                         events:RemoveTargets, events:DescribeRule]
                Resource:
                  - !Sub arn:aws:events:${AWS::Region}:${AWS::AccountId}:rule/dapier-schedule-*
                  - !Sub arn:aws:events:${AWS::Region}:${AWS::AccountId}:rule/dapier-poll-*
        # Inbound email normalization reads the raw message when replaying
        # a clipped trigger from the raw email copy its S3 pointer names.
        - PolicyName: dapier-api-read-inbound-buckets
          PolicyDocument:
            Version: '2012-10-17'
            Statement:
              - Effect: Allow
                Action: [s3:GetObject, s3:ListBucket]
                Resource:
                  - !Sub arn:aws:s3:::${DatamailerInboundBucketName}
                  - !Sub arn:aws:s3:::${DatamailerInboundBucketName}/*
                  - !Sub arn:aws:s3:::${MailBucket}
                  - !Sub arn:aws:s3:::${MailBucket}/*
        # Designer/CLI execution tests run file-read steps in the API process.
        # Stage and read their bytes just as the worker does.
        - PolicyName: dapier-api-render-artifacts
          PolicyDocument:
            Version: '2012-10-17'
            Statement:
              - Effect: Allow
                Action: [s3:GetObject, s3:PutObject]
                Resource: !Sub '${RenderArtifactsBucket.Arn}/*'

  # Separate attachment avoids a role -> worker -> publisher role cycle.
  ApiWorkerInvokePolicy:
    Type: AWS::IAM::Policy
    Properties:
      PolicyName: dapier-api-test-worker-connections
      Roles: [!Ref ApiExecutionRole]
      PolicyDocument:
        Version: '2012-10-17'
        Statement:
          - Effect: Allow
            Action: lambda:InvokeFunction
            Resource: !GetAtt WorkerFunction.Arn

  IngressFunction:
    Type: AWS::Serverless::Function
    Properties:
      CodeUri: .
      Handler: src.dapier.api.router.handler
      Runtime: python3.12
      Architectures: [arm64]
      Layers:
        - Ref: JsRuntimeLayer
      Role: !GetAtt ApiExecutionRole.Arn
      Environment:
        Variables:
          YOUTUBE_WEBHOOK_SECRET_NAME: !Ref YouTubeWebhookSecretName
          # The save path subscribes/unsubscribes WebSub topics on designer
          # saves, toggles, and deletes (designer_store._sync_youtube).
          YOUTUBE_CALLBACK_URL: !Sub https://${DomainName}/hooks/youtube
          # TopicArn allowlist for the SES feedback hook
          # (triggers.intake.ses_notifications); empty accepts any topic.
          SES_NOTIFICATION_TOPICS: !Ref SesNotificationTopics
          ADMIN_SECRET_NAME: !Ref AdminSecretName
          # Optional Developer notify hook (/hooks/developer) + Hub intake.
          # Secrets created out-of-band; empty IDs leave the hook 503.
          DEVELOPER_WEBHOOK_SECRET_NAME: !Ref DeveloperWebhookSecret
          HUB_INTAKE_TOKEN_SECRET_NAME: !Ref HubIntakeTokenSecret
          HUB_INTAKE_URL: !Ref HubIntakeUrl
          DAPIER_EMAIL_SENDER: !Ref EmailSender
          DAPIER_ALERT_SENDER: !Ref AlertEmailSender
          GITHUB_WORKFLOWS_TOKEN_SECRET: !Ref GithubWorkflowsTokenSecret
          WORKER_FUNCTION_ARN: !GetAtt WorkerFunction.Arn
          DROPBOX_QUEUE_URL: !Ref DropboxQueue
      Events:
        Root:
          Type: HttpApi
          Properties: {ApiId: !Ref Api, Path: /, Method: GET}
        PublicHome:
          Type: HttpApi
          Properties: {ApiId: !Ref Api, Path: /about, Method: GET}
        PrivacyPolicy:
          Type: HttpApi
          Properties: {ApiId: !Ref Api, Path: /privacy, Method: GET}
        TermsOfService:
          Type: HttpApi
          Properties: {ApiId: !Ref Api, Path: /terms, Method: GET}
        ConsoleWorkflows:
          Type: HttpApi
          Properties: {ApiId: !Ref Api, Path: /workflows, Method: GET}
        ConsoleTemplates:
          Type: HttpApi
          Properties: {ApiId: !Ref Api, Path: /templates, Method: GET}
        # Workflow deep links (/workflows/<id>) serve the console shell; the
        # client router resolves the workflow.
        ConsoleWorkflowDetail:
          Type: HttpApi
          Properties: {ApiId: !Ref Api, Path: '/workflows/{proxy+}', Method: GET}
        ConsoleConnections:
          Type: HttpApi
          Properties: {ApiId: !Ref Api, Path: /connections, Method: GET}
        ConsoleEmails:
          Type: HttpApi
          Properties: {ApiId: !Ref Api, Path: /emails, Method: GET}
        ConsoleCredentials:
          Type: HttpApi
          Properties: {ApiId: !Ref Api, Path: /credentials, Method: GET}
        ConsoleTokens:
          Type: HttpApi
          Properties: {ApiId: !Ref Api, Path: /tokens, Method: GET}
        ConsoleRuns:
          Type: HttpApi
          Properties: {ApiId: !Ref Api, Path: /runs, Method: GET}
        ConsoleCosts:
          Type: HttpApi
          Properties: {ApiId: !Ref Api, Path: /costs, Method: GET}
        ConsoleAudit:
          Type: HttpApi
          Properties: {ApiId: !Ref Api, Path: /audit, Method: GET}
        ConsoleSchedules:
          Type: HttpApi
          Properties: {ApiId: !Ref Api, Path: /schedules, Method: GET}
        # One greedy route for every static asset; the console Lambda's
        # allowlist (router._static) decides what is actually served.
        ConsoleAssets:
          Type: HttpApi
          Properties: {ApiId: !Ref Api, Path: '/assets/{proxy+}', Method: GET}
        # The designer app shell under /designer/app, framed by the console's
        # designer view (/workflows/<id>); the router._static allowlist decides what is served.
        DesignerEmbed:
          Type: HttpApi
          Properties: {ApiId: !Ref Api, Path: '/designer/{proxy+}', Method: GET}
        # The CLI device-pairing page (dapier auth login).
        DevicePairing:
          Type: HttpApi
          Properties: {ApiId: !Ref Api, Path: /device, Method: GET}
        AdminApi:
          Type: HttpApi
          Properties: {ApiId: !Ref Api, Path: '/api/admin/{proxy+}', Method: ANY}
        AgentApi:
          Type: HttpApi
          Properties: {ApiId: !Ref Api, Path: '/api/agent/{proxy+}', Method: ANY}
        OAuthCallback:
          Type: HttpApi
          Properties: {ApiId: !Ref Api, Path: /oauth/callback, Method: GET}
        AuthLogin:
          Type: HttpApi
          Properties: {ApiId: !Ref Api, Path: /auth/login, Method: GET}
        AuthCallback:
          Type: HttpApi
          Properties: {ApiId: !Ref Api, Path: /auth/callback, Method: GET}
        AuthError:
          Type: HttpApi
          Properties: {ApiId: !Ref Api, Path: /auth/error, Method: GET}
        AuthLogout:
          Type: HttpApi
          Properties: {ApiId: !Ref Api, Path: /auth/logout, Method: GET}
        Health:
          Type: HttpApi
          Properties: {ApiId: !Ref Api, Path: /health, Method: GET}
        # Public, read-only action/trigger/logic catalog (registry.catalog());
        # the gateway needs the explicit route or it 404s before the router.
        Catalog:
          Type: HttpApi
          Properties: {ApiId: !Ref Api, Path: /api/catalog, Method: GET}
        # The taskdeck status contract the cross-project console polls.
        # Bearer-gated, and answered by the router before any admin gate.
        OpsStatus:
          Type: HttpApi
          Properties: {ApiId: !Ref Api, Path: '/internal/ops/status', Method: GET}
        CustomHook:
          Type: HttpApi
          Properties:
            ApiId: !Ref Api
            Path: '/hooks/custom/{source}'
            Method: POST
        DropboxGet:
          Type: HttpApi
          Properties: {ApiId: !Ref Api, Path: /hooks/dropbox, Method: GET}
        DropboxPost:
          Type: HttpApi
          Properties: {ApiId: !Ref Api, Path: /hooks/dropbox, Method: POST}
        YouTubeGet:
          Type: HttpApi
          Properties: {ApiId: !Ref Api, Path: /hooks/youtube, Method: GET}
        YouTubePost:
          Type: HttpApi
          Properties: {ApiId: !Ref Api, Path: /hooks/youtube, Method: POST}
        SesNotificationsGet:
          Type: HttpApi
          Properties: {ApiId: !Ref Api, Path: /hooks/ses-notifications, Method: GET}
        SesNotificationsPost:
          Type: HttpApi
          Properties: {ApiId: !Ref Api, Path: /hooks/ses-notifications, Method: POST}
        ZoomRecordingHook:
          Type: HttpApi
          Properties:
            ApiId: !Ref Api
            Path: '/hooks/zoom/{proxy+}'
            Method: POST
        SlackEventsHook:
          Type: HttpApi
          Properties:
            ApiId: !Ref Api
            Path: '/hooks/slack/{proxy+}'
            Method: POST
        WebhookTriggerHook:
          Type: HttpApi
          Properties:
            ApiId: !Ref Api
            Path: '/hooks/webhook/{proxy+}'
            Method: POST
        TelegramTriggerHook:
          Type: HttpApi
          Properties:
            ApiId: !Ref Api
            Path: '/hooks/telegram/{proxy+}'
            Method: POST
        DeveloperHook:
          Type: HttpApi
          Properties:
            ApiId: !Ref Api
            Path: /hooks/developer
            Method: POST

  EmailIngressFunction:
    Type: AWS::Serverless::Function
    Properties:
      CodeUri: src/
      Handler: dapier.triggers.intake.email_ingress.handler
      Runtime: python3.12
      Architectures: [arm64]
      Policies:
        - SQSSendMessagePolicy:
            QueueName: !GetAtt EventQueue.QueueName
        - S3ReadPolicy:
            BucketName: !Sub ${AWS::StackName}-mail-${AWS::AccountId}
      Events:
        MailStored:
          Type: S3
          Properties:
            Bucket: !Ref MailBucket
            Events: s3:ObjectCreated:*

  YouTubeSubscriptionFunction:
    Type: AWS::Serverless::Function
    Properties:
      CodeUri: .
      Handler: src.dapier.triggers.intake.youtube_subscriptions.handler
      Runtime: python3.12
      Architectures: [arm64]
      Environment:
        Variables:
          YOUTUBE_CALLBACK_URL: !Sub https://${DomainName}/hooks/youtube
          YOUTUBE_WEBHOOK_SECRET_NAME: !Ref YouTubeWebhookSecretName
      Policies:
        - Statement:
            - Effect: Allow
              Action: dynamodb:GetItem
              Resource: !Sub arn:aws:dynamodb:eu-west-1:${AWS::AccountId}:table/${TeamSecretsTable}
            - Effect: Allow
              Action: kms:Decrypt
              Resource: !Sub arn:aws:kms:eu-west-1:${AWS::AccountId}:key/${TeamSecretsKeyId}
              Condition:
                StringEquals:
                  kms:EncryptionContext:secret:
                    - !Ref YouTubeWebhookSecretName

        # all_workflows reads the managed definitions plus operator triggers.
        - DynamoDBReadPolicy:
            TableName: !Ref PublishedWorkflowsTable
        - DynamoDBReadPolicy:
            TableName: !Ref HookTriggersTable
        - DynamoDBReadPolicy:
            TableName: !Ref ScheduleTriggersTable
        - DynamoDBReadPolicy:
            TableName: !Ref PollTriggersTable
      Events:
        Renewal:
          Type: Schedule
          Properties:
            Schedule: rate(4 days)
            Enabled: true

  WorkerFunction:
    Type: AWS::Serverless::Function
    DependsOn: EventQueuePolicy
    Properties:
      CodeUri: .
      Handler: src.dapier.engine.worker.handler
      Runtime: python3.12
      Architectures: [arm64]
      Layers:
        - Ref: JsRuntimeLayer
      Timeout: 300  # dataops document_step waits up to 180 s for a cold render
      MemorySize: 512
      Environment:
        Variables:
          INBOUND_EMAIL_QUEUE_ARN: !GetAtt EventQueue.Arn
          EMAIL_PUBLISHER_ROLE_IDS: !Join
            - ','
            - - !GetAtt EmailIngressFunctionRole.RoleId
              - !GetAtt ApiExecutionRole.RoleId
              - !GetAtt WorkerFunctionRole.RoleId
          INBOUND_EMAIL_TOPICS: !Ref InboundEmailTopicArn
          YOUTUBE_WEBHOOK_SECRET_NAME: !Ref YouTubeWebhookSecretName
          DEVELOPER_WEBHOOK_SECRET_NAME: !Ref DeveloperWebhookSecret
          HUB_INTAKE_TOKEN_SECRET_NAME: !Ref HubIntakeTokenSecret
          HUB_INTAKE_URL: !Ref HubIntakeUrl
          CONNECTIONS_TABLE: !Ref ConnectionsTable
          DAPIER_EMAIL_SENDER: !Ref EmailSender
          DAPIER_ALERT_SENDER: !Ref AlertEmailSender
          # Configuration set attached to every workflow send
          # (engine.actions.email) so SES reports bounce/complaint feedback
          # into the ses-notifications hook; empty sends untagged.
          SES_CONFIGURATION_SET: !Ref SesConfigurationSet
          # Staging bucket for attachment parts rehydrated from Relay's
          # slim inbound events (connectors.ingress._stage_attachments).
          MAIL_BUCKET: !Ref MailBucket
          TASK_USAGE_TABLE: !Ref TaskUsageTable
          PAID_API_USAGE_TABLE: !Ref PaidApiUsageTable
          STORAGE_TABLE: !Ref StorageTable
          DIGESTS_TABLE: !Ref DigestsTable
      Policies:
        - Statement:
            Effect: Allow
            Action: sts:AssumeRole
            Resource: !Ref AwsAssumableRoleArns
        - Statement:
            # Feeds EmailEventsQuietAlarm: one datapoint per email event the
            # engine consumes, so twelve quiet hours page the alarm topic.
            Effect: Allow
            Action: [cloudwatch:PutMetricData]
            Resource: '*'
        - Statement:
            - Effect: Allow
              Action: dynamodb:GetItem
              Resource: !Sub arn:aws:dynamodb:eu-west-1:${AWS::AccountId}:table/${TeamSecretsTable}
            - Effect: Allow
              Action: kms:Decrypt
              Resource: !Sub arn:aws:kms:eu-west-1:${AWS::AccountId}:key/${TeamSecretsKeyId}
              Condition:
                StringEquals:
                  kms:EncryptionContext:secret:
                    - dapier.dataops
                    - !Ref YouTubeWebhookSecretName
                    - !Ref DeveloperWebhookSecret
                    - !Ref HubIntakeTokenSecret

        # Outbound identity for verified Anthropic LLM connections. Only the worker
        # may mint these tokens; the Anthropic rule pins this role's exact ARN.
        - Statement:
            Sid: WorkerAnthropicIdentityToken
            Effect: Allow
            Action: [sts:GetWebIdentityToken]
            Resource: '*'
            Condition:
              ForAllValues:StringEquals:
                sts:IdentityTokenAudience: [https://api.anthropic.com]
              'Null':
                sts:IdentityTokenAudience: 'false'
              StringEquals:
                sts:SigningAlgorithm: RS256
              NumericLessThanEquals:
                sts:DurationSeconds: 900
        - Statement:
            Effect: Allow
            Action: [ses:SendEmail, ses:SendRawEmail]
            Resource: '*'
        - Statement:
            Effect: Allow
            Action: [dynamodb:GetItem]
            Resource: !GetAtt CredentialsTable.Arn
        # Provider tokens expire during unattended runs. The worker persists
        # version-conditional refreshes, but cannot edit operator credentials.
        - Statement:
            Sid: WorkerOAuthCredentialRefresh
            Effect: Allow
            Action: [dynamodb:PutItem]
            Resource: !GetAtt CredentialsTable.Arn
            Condition:
              ForAllValues:StringLike:
                dynamodb:LeadingKeys: ["oauth#*"]
        - Statement:
            Effect: Allow
            Action: [dynamodb:PutItem]
            Resource: !GetAtt PaidApiUsageTable.Arn
        - DynamoDBCrudPolicy:
            TableName: !Ref TaskUsageTable
        - Statement:
            Effect: Allow
            Action: [dynamodb:GetItem, dynamodb:PutItem, dynamodb:DeleteItem,
                     dynamodb:Query]
            Resource: !GetAtt StorageTable.Arn
        - Statement:
            Sid: HubCompletionNotificationLease
            Effect: Allow
            Action: [dynamodb:UpdateItem]
            Resource: !GetAtt StorageTable.Arn
            Condition:
              ForAllValues:StringEquals:
                dynamodb:LeadingKeys: ["system:hub-sessions"]
        - Statement:
            Effect: Allow
            Action: [dynamodb:GetItem, dynamodb:PutItem, dynamodb:DeleteItem,
                     dynamodb:UpdateItem, dynamodb:Query]
            Resource: !GetAtt DigestsTable.Arn
        - DynamoDBReadPolicy:
            TableName: !Ref ConnectionsTable
        - DynamoDBReadPolicy:
            TableName: !Ref HookTriggersTable
        - DynamoDBCrudPolicy:
            TableName: !Ref TriggerInboxTable
        # Crud, not Read: each fire is noted on its schedule's history.
        - DynamoDBCrudPolicy:
            TableName: !Ref ScheduleTriggersTable
        - DynamoDBReadPolicy:
            TableName: !Ref PollTriggersTable
        - DynamoDBReadPolicy:
            TableName: !Ref PublishedWorkflowsTable
        - DynamoDBCrudPolicy:
            TableName: !Ref CursorsTable
        # A run parked on a long delay re-enters through the event queue
        # (worker._enqueue_resume): the worker itself enqueues the parked
        # continuation, hop by hop for waits past SQS's 15-minute cap.
        - SQSSendMessagePolicy:
            QueueName: !GetAtt EventQueue.QueueName
        - SQSSendMessagePolicy:
            QueueName: !GetAtt RenderQueue.QueueName
        - DynamoDBReadPolicy:
            TableName: !Ref EmailFromTable
        - DynamoDBCrudPolicy:
            TableName: !Ref ExecutionsTable
        - S3CrudPolicy:
            BucketName: !Ref RenderArtifactsBucket
        - Statement:
            Effect: Allow
            Action: s3:PutObject
            Resource: !Sub '${ZoomTranscriptsBucket.Arn}/*'
        - S3CrudPolicy:
            BucketName: !Ref DataOpsEmailDocumentsBucket
        - S3ReadPolicy:
            BucketName: !Ref DatamailerInboundBucketName
        - S3CrudPolicy:
            BucketName: !Ref MailBucket
      Events:
        Queue:
          Type: SQS
          Properties:
            Queue: !GetAtt EventQueue.Arn
            BatchSize: 1  # Worker records are serial; a render wait may take 180 seconds.
            FunctionResponseTypes: [ReportBatchItemFailures]

  # Standalone (not inline) because schedule rules are created and deleted at
  # runtime; the permission is provisioned once for the whole rule family so
  # trigger saves only ever call the Events API.
  ScheduleInvokePermission:
    Type: AWS::Lambda::Permission
    Properties:
      FunctionName: !Ref WorkerFunction
      Action: lambda:InvokeFunction
      Principal: events.amazonaws.com
      SourceArn: !Sub arn:aws:events:${AWS::Region}:${AWS::AccountId}:rule/dapier-schedule-*

  # Same bargain as ScheduleInvokePermission, for the poll trigger rule family.
  PollInvokePermission:
    Type: AWS::Lambda::Permission
    Properties:
      FunctionName: !Ref WorkerFunction
      Action: lambda:InvokeFunction
      Principal: events.amazonaws.com
      SourceArn: !Sub arn:aws:events:${AWS::Region}:${AWS::AccountId}:rule/dapier-poll-*

  DropboxResolverFunction:
    Type: AWS::Serverless::Function
    Properties:
      CodeUri: .
      Handler: src.dapier.triggers.intake.dropbox_resolver.handler
      Runtime: python3.12
      Architectures: [arm64]
      Timeout: 120
      MemorySize: 256
      Policies:
        - SQSSendMessagePolicy:
            QueueName: !GetAtt EventQueue.QueueName
        - DynamoDBCrudPolicy:
            TableName: !Ref ConnectionsTable
        - DynamoDBCrudPolicy:
            TableName: !Ref CursorsTable
        - Statement:
            Effect: Allow
            Action: [dynamodb:GetItem, dynamodb:PutItem]
            Resource: !GetAtt CredentialsTable.Arn
      Events:
        Notifications:
          Type: SQS
          Properties:
            Queue: !GetAtt DropboxQueue.Arn
            BatchSize: 5
            FunctionResponseTypes: [ReportBatchItemFailures]

  EventQueue:
    Type: AWS::SQS::Queue
    Properties:
      VisibilityTimeout: 1800  # >= 6x WorkerFunction Timeout (300)
      RedrivePolicy:
        deadLetterTargetArn: !GetAtt DeadLetterQueue.Arn
        maxReceiveCount: 5

  EventQueuePolicy:
    Type: AWS::SQS::QueuePolicy
    Properties:
      Queues: [!Ref EventQueue]
      PolicyDocument:
        Version: '2012-10-17'
        Statement:
          # Explicit deny overrides operator/agent identity-policy SendMessage
          # grants. Raw SNS deliveries are authenticated by this queue boundary.
          - Sid: DenyUntrustedPublishers
            Effect: Deny
            Principal: '*'
            Action: sqs:SendMessage
            Resource: !GetAtt EventQueue.Arn
            Condition:
              BoolIfExists:
                aws:PrincipalIsAWSService: 'false'
              ArnNotEquals:
                aws:PrincipalArn:
                  - !GetAtt ApiExecutionRole.Arn
                  - !GetAtt EmailIngressFunctionRole.Arn
                  - !GetAtt WorkerFunctionRole.Arn
                  - !GetAtt DropboxResolverFunctionRole.Arn
                  - !GetAtt HtmlRendererFunctionRole.Arn
          - Sid: AllowInboundEmailEvents
            Effect: Allow
            Principal: {Service: sns.amazonaws.com}
            Action: sqs:SendMessage
            Resource: !GetAtt EventQueue.Arn
            Condition:
              ArnEquals:
                aws:SourceArn: !Ref InboundEmailTopicArn

  DeadLetterQueue:
    Type: AWS::SQS::Queue

  AlarmTopic:
    Type: AWS::SNS::Topic

  # Email intake has no queue backlog to alarm on when it breaks upstream:
  # nothing arrives, so every queue metric reads zero and healthy. The
  # worker emits one EmailEventsReceived datapoint per email event it
  # consumes; twelve quiet hours page the operator.
  EmailEventsQuietAlarm:
    Type: AWS::CloudWatch::Alarm
    Properties:
      AlarmDescription: >
        No email event reached the workflow engine for 12 hours — email
        intake is dark somewhere between SES receipt, the raw-mail bucket,
        the intake Lambda, and the event queue.
      Namespace: Dapier/Triggers
      MetricName: EmailEventsReceived
      Statistic: Sum
      Period: 3600
      EvaluationPeriods: 12
      Threshold: 1
      ComparisonOperator: LessThanThreshold
      TreatMissingData: breaching
      AlarmActions: [!Ref AlarmTopic]
      OKActions: [!Ref AlarmTopic]

  # One shared alarm stays active while any hour in the last day contains
  # refusals. Per-address/sender cursor claims bound datapoints to 24h;
  # operator notice emails cannot feed this metric (email_refusals.py).
  EmailSenderPolicyRefusalAlarm:
    Type: AWS::CloudWatch::Alarm
    Properties:
      AlarmDescription: >
        Inbound email was refused by sender policy at an enabled workflow
        mailbox. The alert lists recipient, sender, rule, workflow, and inbox/event
        id (no run starts for a refused delivery). Inspect the sender allowlist
        through dapier emails from.
      Namespace: Dapier/Triggers
      MetricName: EmailSenderPolicyRefused
      Statistic: Sum
      Period: 3600
      EvaluationPeriods: 24
      DatapointsToAlarm: 1
      Threshold: 1
      ComparisonOperator: GreaterThanOrEqualToThreshold
      TreatMissingData: notBreaching
      AlarmActions: [!Ref AlarmTopic]

  # Explicit zeros prevent sparse-metric lookback retaining an old refusal.
  # Sum still includes every real refusal; no alarm setting changes.
  EmailRefusalHeartbeatFunction:
    Type: AWS::Serverless::Function
    Properties:
      CodeUri: .
      Handler: src.dapier.triggers.email_refusals.heartbeat
      Runtime: python3.12
      Architectures: [arm64]
      Timeout: 15
      MemorySize: 128
      Policies:
        - Statement:
            Effect: Allow
            Action: cloudwatch:PutMetricData
            Resource: '*'
            Condition:
              StringEquals:
                cloudwatch:namespace: Dapier/Triggers
      Events:
        Heartbeat:
          Type: Schedule
          Properties:
            Schedule: rate(1 minute)
            Enabled: true

  AlarmNotifyFunction:
    Type: AWS::Serverless::Function
    Properties:
      CodeUri: .
      Handler: src.dapier.alarm_notify.handler
      Runtime: python3.12
      Architectures: [arm64]
      Timeout: 30
      MemorySize: 128
      Environment:
        Variables:
          DAPIER_EMAIL_SENDER: !Ref EmailSender
          DAPIER_ALERT_SENDER: !Ref AlertEmailSender
      Policies:
        - Statement:
            Effect: Allow
            Action: [ses:SendEmail]
            Resource: '*'
        - DynamoDBReadPolicy:
            TableName: !Ref TriggerInboxTable
        - DynamoDBReadPolicy:
            TableName: !Ref PublishedWorkflowsTable
      Events:
        Alarm:
          Type: SNS
          Properties:
            Topic: !Ref AlarmTopic

  DropboxQueue:
    Type: AWS::SQS::Queue
    Properties:
      VisibilityTimeout: 600
      RedrivePolicy:
        deadLetterTargetArn: !GetAtt DropboxDeadLetterQueue.Arn
        maxReceiveCount: 5

  DropboxDeadLetterQueue:
    Type: AWS::SQS::Queue

  RenderQueue:
    Type: AWS::SQS::Queue
    Properties:
      VisibilityTimeout: 300
      RedrivePolicy:
        deadLetterTargetArn: !GetAtt RenderDeadLetterQueue.Arn
        maxReceiveCount: 3

  RenderDeadLetterQueue:
    Type: AWS::SQS::Queue

  EventDeadLetterAlarm:
    Type: AWS::CloudWatch::Alarm
    Properties:
      AlarmDescription: Dapier events are waiting in the dead-letter queue
      AlarmActions: [!Ref AlarmTopic]
      Namespace: AWS/SQS
      MetricName: ApproximateNumberOfMessagesVisible
      Dimensions:
        - Name: QueueName
          Value: !GetAtt DeadLetterQueue.QueueName
      Statistic: Maximum
      Period: 60
      EvaluationPeriods: 1
      Threshold: 1
      ComparisonOperator: GreaterThanOrEqualToThreshold
      TreatMissingData: notBreaching

  # 900s is a full redrive cycle (5 receives x 180s visibility): past it a
  # message is wedged without erroring, so EventDeadLetterAlarm stays quiet.
  EventQueueAgeAlarm:
    Type: AWS::CloudWatch::Alarm
    Properties:
      AlarmDescription: Dapier events are stuck in the event queue
      AlarmActions: [!Ref AlarmTopic]
      Namespace: AWS/SQS
      MetricName: ApproximateAgeOfOldestMessage
      Dimensions:
        - Name: QueueName
          Value: !GetAtt EventQueue.QueueName
      Statistic: Maximum
      Period: 60
      EvaluationPeriods: 1
      Threshold: 900
      ComparisonOperator: GreaterThanOrEqualToThreshold
      TreatMissingData: notBreaching

  EventQueueDepthAlarm:
    Type: AWS::CloudWatch::Alarm
    Properties:
      AlarmDescription: Dapier events are piling up in the event queue
      AlarmActions: [!Ref AlarmTopic]
      Namespace: AWS/SQS
      MetricName: ApproximateNumberOfMessagesVisible
      Dimensions:
        - Name: QueueName
          Value: !GetAtt EventQueue.QueueName
      Statistic: Maximum
      Period: 300
      EvaluationPeriods: 1
      Threshold: 100
      ComparisonOperator: GreaterThanOrEqualToThreshold
      TreatMissingData: notBreaching

  DropboxDeadLetterAlarm:
    Type: AWS::CloudWatch::Alarm
    Properties:
      AlarmDescription: Dropbox notifications are waiting in the dead-letter queue
      AlarmActions: [!Ref AlarmTopic]
      Namespace: AWS/SQS
      MetricName: ApproximateNumberOfMessagesVisible
      Dimensions:
        - Name: QueueName
          Value: !GetAtt DropboxDeadLetterQueue.QueueName
      Statistic: Maximum
      Period: 60
      EvaluationPeriods: 1
      Threshold: 1
      ComparisonOperator: GreaterThanOrEqualToThreshold
      TreatMissingData: notBreaching

  RenderDeadLetterAlarm:
    Type: AWS::CloudWatch::Alarm
    Properties:
      AlarmDescription: HTML render jobs are waiting in the dead-letter queue
      AlarmActions: [!Ref AlarmTopic]
      Namespace: AWS/SQS
      MetricName: ApproximateNumberOfMessagesVisible
      Dimensions:
        - Name: QueueName
          Value: !GetAtt RenderDeadLetterQueue.QueueName
      Statistic: Maximum
      Period: 60
      EvaluationPeriods: 1
      Threshold: 1
      ComparisonOperator: GreaterThanOrEqualToThreshold
      TreatMissingData: notBreaching

  WorkerErrorAlarm:
    Type: AWS::CloudWatch::Alarm
    Properties:
      AlarmDescription: Dapier workflow worker Lambda errors
      AlarmActions: [!Ref AlarmTopic]
      Namespace: AWS/Lambda
      MetricName: Errors
      Dimensions:
        - Name: FunctionName
          Value: !Ref WorkerFunction
      Statistic: Sum
      Period: 300
      EvaluationPeriods: 1
      Threshold: 1
      ComparisonOperator: GreaterThanOrEqualToThreshold
      TreatMissingData: notBreaching

  # Manually created ECR repository backing HtmlRendererFunction's image
  # (HtmlRendererImageUri parameter). Imported into the stack 2026-10-27
  # during the sandbox IaC sweep; properties mirror the live repository.
  HtmlRendererRepository:
    Type: AWS::ECR::Repository
    DeletionPolicy: Retain
    UpdateReplacePolicy: Retain
    Properties:
      RepositoryName: dapier-html-renderer
      ImageTagMutability: MUTABLE
      ImageScanningConfiguration:
        ScanOnPush: true
      EncryptionConfiguration:
        EncryptionType: AES256
      RepositoryPolicyText:
        Version: "2012-10-17"
        Statement:
          - Sid: AllowDapierLambdaImagePull
            Effect: Allow
            Principal:
              Service: lambda.amazonaws.com
            Action:
              - ecr:BatchGetImage
              - ecr:GetDownloadUrlForLayer
            Condition:
              ArnLike:
                aws:SourceArn: !Sub arn:${AWS::Partition}:lambda:${AWS::Region}:${AWS::AccountId}:function:dapier-*
          - Sid: AllowDapierDeploymentRoleImageAccess
            Effect: Allow
            Principal:
              AWS: !Sub arn:aws:iam::${AWS::AccountId}:role/dapier-cloudformation-service
            Action:
              - ecr:GetRepositoryPolicy
              - ecr:SetRepositoryPolicy
              - ecr:BatchGetImage
              - ecr:GetDownloadUrlForLayer

  HtmlRendererFunction:
    Type: AWS::Serverless::Function
    Properties:
      PackageType: Image
      ImageUri: !Ref HtmlRendererImageUri
      ImageConfig:
        Command: [banner_generator.html_renderer_handler.handler]
      Timeout: 180
      MemorySize: 2048
      Architectures: [x86_64]
      Environment:
        Variables:
          HTML_RENDERER_COMPLETION_QUEUE_URL: !Ref EventQueue
      Policies:
        - S3CrudPolicy:
            BucketName: !Ref RenderArtifactsBucket
        - SQSSendMessagePolicy:
            QueueName: !GetAtt EventQueue.QueueName
        - Statement:
            - Effect: Allow
              Action:
                - ecr:BatchGetImage
                - ecr:GetDownloadUrlForLayer
              Resource: !GetAtt HtmlRendererRepository.Arn
      Events:
        Jobs:
          Type: SQS
          Properties:
            Queue: !GetAtt RenderQueue.Arn
            BatchSize: 1
            FunctionResponseTypes: [ReportBatchItemFailures]

  ConnectionsTable:
    Type: AWS::DynamoDB::Table
    Properties:
      BillingMode: PAY_PER_REQUEST
      DeletionProtectionEnabled: true
      AttributeDefinitions:
        - {AttributeName: connection_id, AttributeType: S}
      KeySchema:
        - {AttributeName: connection_id, KeyType: HASH}
      PointInTimeRecoverySpecification: {PointInTimeRecoveryEnabled: true}

  PaidApiUsageTable:
    Type: AWS::DynamoDB::Table
    DeletionPolicy: Retain
    UpdateReplacePolicy: Retain
    Properties:
      BillingMode: PAY_PER_REQUEST
      DeletionProtectionEnabled: true
      AttributeDefinitions:
        - {AttributeName: month, AttributeType: S}
        - {AttributeName: request_key, AttributeType: S}
      KeySchema:
        - {AttributeName: month, KeyType: HASH}
        - {AttributeName: request_key, KeyType: RANGE}
      PointInTimeRecoverySpecification: {PointInTimeRecoveryEnabled: true}

  TaskUsageTable:
    Type: AWS::DynamoDB::Table
    Properties:
      BillingMode: PAY_PER_REQUEST
      DeletionProtectionEnabled: true
      AttributeDefinitions:
        - {AttributeName: month, AttributeType: S}
        - {AttributeName: workflow_id, AttributeType: S}
      KeySchema:
        - {AttributeName: month, KeyType: HASH}
        - {AttributeName: workflow_id, KeyType: RANGE}
      PointInTimeRecoverySpecification: {PointInTimeRecoveryEnabled: true}

  CredentialsTable:
    Type: AWS::DynamoDB::Table
    DeletionPolicy: Retain
    UpdateReplacePolicy: Retain
    Properties:
      BillingMode: PAY_PER_REQUEST
      DeletionProtectionEnabled: true
      AttributeDefinitions:
        - {AttributeName: credential_id, AttributeType: S}
      KeySchema:
        - {AttributeName: credential_id, KeyType: HASH}
      PointInTimeRecoverySpecification: {PointInTimeRecoveryEnabled: true}

  CursorsTable:
    Type: AWS::DynamoDB::Table
    Properties:
      BillingMode: PAY_PER_REQUEST
      DeletionProtectionEnabled: true
      AttributeDefinitions:
        - {AttributeName: cursor_id, AttributeType: S}
      KeySchema:
        - {AttributeName: cursor_id, KeyType: HASH}
      TimeToLiveSpecification:
        AttributeName: expires_at
        Enabled: true
      PointInTimeRecoverySpecification: {PointInTimeRecoveryEnabled: true}

  ExecutionsTable:
    Type: AWS::DynamoDB::Table
    Properties:
      BillingMode: PAY_PER_REQUEST
      DeletionProtectionEnabled: true
      AttributeDefinitions:
        - {AttributeName: execution_id, AttributeType: S}
        - {AttributeName: run_id, AttributeType: S}
      KeySchema:
        - {AttributeName: execution_id, KeyType: HASH}
      GlobalSecondaryIndexes:
        - IndexName: runs-by-run-id
          KeySchema:
            - {AttributeName: run_id, KeyType: HASH}
          Projection: {ProjectionType: ALL}
      TimeToLiveSpecification:
        AttributeName: expires_at
        Enabled: true
      PointInTimeRecoverySpecification: {PointInTimeRecoveryEnabled: true}

  GrantsTable:
    Type: AWS::DynamoDB::Table
    Properties:
      BillingMode: PAY_PER_REQUEST
      DeletionProtectionEnabled: true
      AttributeDefinitions:
        - {AttributeName: connection_id, AttributeType: S}
        - {AttributeName: grantee, AttributeType: S}
      KeySchema:
        - {AttributeName: connection_id, KeyType: HASH}
        - {AttributeName: grantee, KeyType: RANGE}
      TimeToLiveSpecification:
        AttributeName: expires_at
        Enabled: true
      PointInTimeRecoverySpecification: {PointInTimeRecoveryEnabled: true}

  AuditTable:
    Type: AWS::DynamoDB::Table
    Properties:
      BillingMode: PAY_PER_REQUEST
      DeletionProtectionEnabled: true
      AttributeDefinitions:
        - {AttributeName: audit_id, AttributeType: S}
      KeySchema:
        - {AttributeName: audit_id, KeyType: HASH}
      TimeToLiveSpecification:
        AttributeName: expires_at
        Enabled: true
      PointInTimeRecoverySpecification: {PointInTimeRecoveryEnabled: true}

  EmailFromTable:
    Type: AWS::DynamoDB::Table
    Properties:
      BillingMode: PAY_PER_REQUEST
      DeletionProtectionEnabled: true
      AttributeDefinitions:
        - {AttributeName: id, AttributeType: S}
      KeySchema:
        - {AttributeName: id, KeyType: HASH}
      PointInTimeRecoverySpecification: {PointInTimeRecoveryEnabled: true}

  HostTasksTable:
    Type: AWS::DynamoDB::Table
    # Keep historical task records when retiring the host-agent runner.
    DeletionPolicy: Retain
    UpdateReplacePolicy: Retain
    Properties:
      BillingMode: PAY_PER_REQUEST
      DeletionProtectionEnabled: true
      AttributeDefinitions:
        - {AttributeName: task_id, AttributeType: S}
        - {AttributeName: status, AttributeType: S}
      KeySchema:
        - {AttributeName: task_id, KeyType: HASH}
      GlobalSecondaryIndexes:
        - IndexName: by-status
          KeySchema:
            - {AttributeName: status, KeyType: HASH}
          Projection:
            ProjectionType: INCLUDE
            NonKeyAttributes: [kind, engine, requires, created_at, lease_until, notify_to, notified_at]
      TimeToLiveSpecification:
        AttributeName: expires_at
        Enabled: true
      PointInTimeRecoverySpecification: {PointInTimeRecoveryEnabled: true}

  HookTriggersTable:
    Type: AWS::DynamoDB::Table
    Properties:
      BillingMode: PAY_PER_REQUEST
      DeletionProtectionEnabled: true
      AttributeDefinitions:
        - {AttributeName: hook_id, AttributeType: S}
      KeySchema:
        - {AttributeName: hook_id, KeyType: HASH}
      PointInTimeRecoverySpecification: {PointInTimeRecoveryEnabled: true}

  TriggerInboxTable:
    Type: AWS::DynamoDB::Table
    Properties:
      BillingMode: PAY_PER_REQUEST
      DeletionProtectionEnabled: true
      AttributeDefinitions:
        - {AttributeName: inbox_id, AttributeType: S}
      KeySchema:
        - {AttributeName: inbox_id, KeyType: HASH}
      TimeToLiveSpecification:
        AttributeName: expires_at
        Enabled: true
      PointInTimeRecoverySpecification: {PointInTimeRecoveryEnabled: true}

  ScheduleTriggersTable:
    Type: AWS::DynamoDB::Table
    Properties:
      BillingMode: PAY_PER_REQUEST
      DeletionProtectionEnabled: true
      AttributeDefinitions:
        - {AttributeName: schedule_id, AttributeType: S}
      KeySchema:
        - {AttributeName: schedule_id, KeyType: HASH}
      PointInTimeRecoverySpecification: {PointInTimeRecoveryEnabled: true}

  PollTriggersTable:
    Type: AWS::DynamoDB::Table
    Properties:
      BillingMode: PAY_PER_REQUEST
      DeletionProtectionEnabled: true
      AttributeDefinitions:
        - {AttributeName: poll_id, AttributeType: S}
      KeySchema:
        - {AttributeName: poll_id, KeyType: HASH}
      PointInTimeRecoverySpecification: {PointInTimeRecoveryEnabled: true}

  PublishedWorkflowsTable:
    Type: AWS::DynamoDB::Table
    Properties:
      BillingMode: PAY_PER_REQUEST
      DeletionProtectionEnabled: true
      AttributeDefinitions:
        - {AttributeName: workflow_id, AttributeType: S}
      KeySchema:
        - {AttributeName: workflow_id, KeyType: HASH}
      PointInTimeRecoverySpecification: {PointInTimeRecoveryEnabled: true}

  ApiTokensTable:
    Type: AWS::DynamoDB::Table
    DeletionPolicy: Retain
    UpdateReplacePolicy: Retain
    Properties:
      BillingMode: PAY_PER_REQUEST
      DeletionProtectionEnabled: true
      AttributeDefinitions:
        - {AttributeName: token_hash, AttributeType: S}
      KeySchema:
        - {AttributeName: token_hash, KeyType: HASH}
      PointInTimeRecoverySpecification: {PointInTimeRecoveryEnabled: true}

  # Per-workflow key-value state for the storage_* actions
  # (src/dapier/engine/actions/storage.py): the workflow's id is the
  # partition, the stored key the sort; optional per-item TTL on expires.
  StorageTable:
    Type: AWS::DynamoDB::Table
    Properties:
      BillingMode: PAY_PER_REQUEST
      DeletionProtectionEnabled: true
      AttributeDefinitions:
        - {AttributeName: scope, AttributeType: S}
        - {AttributeName: key, AttributeType: S}
      KeySchema:
        - {AttributeName: scope, KeyType: HASH}
        - {AttributeName: key, KeyType: RANGE}
      TimeToLiveSpecification: {AttributeName: expires, Enabled: true}
      PointInTimeRecoverySpecification: {PointInTimeRecoveryEnabled: true}

  # Accumulated digest items for the digest logic step
  # (src/dapier/engine/actions/digests.py): the workflow's id is the
  # partition, the digest's key the sort. A flush claims the batch by
  # deleting the item (ReturnValues=ALL_OLD), so concurrent flushes never
  # double-send; appends recreate the item from empty.
  DigestsTable:
    Type: AWS::DynamoDB::Table
    Properties:
      BillingMode: PAY_PER_REQUEST
      DeletionProtectionEnabled: true
      AttributeDefinitions:
        - {AttributeName: scope, AttributeType: S}
        - {AttributeName: key, AttributeType: S}
      KeySchema:
        - {AttributeName: scope, KeyType: HASH}
        - {AttributeName: key, KeyType: RANGE}
      PointInTimeRecoverySpecification: {PointInTimeRecoveryEnabled: true}

  # Pending CLI device pairings and issued CLI device sessions
  # (src/dapier/auth/device_sessions.py). Everything carries a TTL.
  DeviceSessionsTable:
    Type: AWS::DynamoDB::Table
    Properties:
      BillingMode: PAY_PER_REQUEST
      DeletionProtectionEnabled: true
      AttributeDefinitions:
        - {AttributeName: pk, AttributeType: S}
      KeySchema:
        - {AttributeName: pk, KeyType: HASH}
      TimeToLiveSpecification: {AttributeName: ttl, Enabled: true}
      PointInTimeRecoverySpecification: {PointInTimeRecoveryEnabled: true}

  ZoomTranscriptsBucket:
    Type: AWS::S3::Bucket
    DeletionPolicy: Retain
    UpdateReplacePolicy: Retain
    Properties:
      BucketName: !Sub ${AWS::StackName}-zoom-transcripts-${AWS::AccountId}
      PublicAccessBlockConfiguration:
        BlockPublicAcls: true
        BlockPublicPolicy: true
        IgnorePublicAcls: true
        RestrictPublicBuckets: true
      OwnershipControls:
        Rules:
          - ObjectOwnership: BucketOwnerEnforced
      BucketEncryption:
        ServerSideEncryptionConfiguration:
          - ServerSideEncryptionByDefault: {SSEAlgorithm: AES256}
      VersioningConfiguration:
        Status: Enabled

  MailBucket:
    Type: AWS::S3::Bucket
    Properties:
      BucketName: !Sub ${AWS::StackName}-mail-${AWS::AccountId}
      PublicAccessBlockConfiguration:
        BlockPublicAcls: true
        BlockPublicPolicy: true
        IgnorePublicAcls: true
        RestrictPublicBuckets: true
      LifecycleConfiguration:
        Rules:
          - Id: expire-mail
            Status: Enabled
            ExpirationInDays: 30

  RenderArtifactsBucket:
    Type: AWS::S3::Bucket
    Properties:
      PublicAccessBlockConfiguration:
        BlockPublicAcls: true
        BlockPublicPolicy: true
        IgnorePublicAcls: true
        RestrictPublicBuckets: true
      BucketEncryption:
        ServerSideEncryptionConfiguration:
          - ServerSideEncryptionByDefault: {SSEAlgorithm: AES256}
      LifecycleConfiguration:
        Rules:
          - Id: expire-render-artifacts
            Status: Enabled
            ExpirationInDays: 30

  # Daily DynamoDB snapshots (src/dapier/backup.py). Retained even if the
  # stack is deleted — losing the backups together with the tables they
  # exist for would defeat the point.
  BackupBucket:
    Type: AWS::S3::Bucket
    DeletionPolicy: Retain
    UpdateReplacePolicy: Retain
    Properties:
      BucketName: !Sub ${AWS::StackName}-backups-${AWS::AccountId}
      PublicAccessBlockConfiguration:
        BlockPublicAcls: true
        BlockPublicPolicy: true
        IgnorePublicAcls: true
        RestrictPublicBuckets: true
      BucketEncryption:
        ServerSideEncryptionConfiguration:
          - ServerSideEncryptionByDefault: {SSEAlgorithm: AES256}
      LifecycleConfiguration:
        Rules:
          - Id: expire-backups
            Status: Enabled
            ExpirationInDays: 30

  BackupFunction:
    Type: AWS::Serverless::Function
    Properties:
      CodeUri: .
      Handler: src.dapier.backup.handler
      Runtime: python3.12
      Architectures: [arm64]
      Timeout: 300
      Environment:
        Variables:
          BACKUP_BUCKET: !Ref BackupBucket
          DAPIER_EMAIL_SENDER: !Ref EmailSender
          DAPIER_ALERT_SENDER: !Ref AlertEmailSender
          DAPIER_EMAIL_REGION: !Ref EmailSendRegion
          BACKUP_ALERT_EMAIL: !Ref BackupAlertEmail
      Policies:
        - DynamoDBCrudPolicy:
            TableName: !Ref ExecutionsTable
        - Statement:
            Effect: Allow
            Action: [ses:SendEmail]
            Resource: '*'
        - S3CrudPolicy:
            BucketName: !Ref BackupBucket
        # Scan access to every table the stack owns, including future ones.
        - Statement:
            Effect: Allow
            Action: [dynamodb:Scan]
            Resource: !Sub arn:aws:dynamodb:${AWS::Region}:${AWS::AccountId}:table/${AWS::StackName}-*
      Events:
        Daily:
          Type: Schedule
          Properties:
            Schedule: cron(0 3 * * ? *)

  BackupErrorAlarm:
    Type: AWS::CloudWatch::Alarm
    Properties:
      AlarmDescription: Dapier daily DynamoDB backup Lambda errors
      AlarmActions: [!Ref AlarmTopic]
      Namespace: AWS/Lambda
      MetricName: Errors
      Dimensions:
        - Name: FunctionName
          Value: !Ref BackupFunction
      Statistic: Sum
      Period: 300
      EvaluationPeriods: 1
      Threshold: 1
      ComparisonOperator: GreaterThanOrEqualToThreshold
      TreatMissingData: notBreaching

  # Daily operator error digest (src/dapier/error_digest.py): renders the
  # errors summary (api/errors.py api_summary) into one short SES email to
  # the operator address; a window with zero failed runs sends nothing.
  # POST /api/{admin,agent}/errors/digest and `dapier errors send-digest`
  # call the same send() for send-now parity.
  ErrorDigestFunction:
    Type: AWS::Serverless::Function
    Properties:
      CodeUri: .
      Handler: src.dapier.error_digest.handler
      Runtime: python3.12
      Architectures: [arm64]
      Timeout: 120
      MemorySize: 512
      Environment:
        Variables:
          DAPIER_EMAIL_SENDER: !Ref EmailSender
          DAPIER_ALERT_SENDER: !Ref AlertEmailSender
          EXECUTIONS_TABLE: !Ref ExecutionsTable
          DAPIER_ERROR_DIGEST_DAYS: '1'
      Policies:
        - Statement:
            Effect: Allow
            Action: [ses:SendEmail]
            Resource: '*'
        - DynamoDBReadPolicy:
            TableName: !Ref ExecutionsTable
      Events:
        Daily:
          Type: Schedule
          Properties:
            Schedule: cron(0 7 * * ? *)

  # A digest that dies silently is the failure mode it exists to prevent:
  # function errors page the same alarm chain the alarms use.
  ErrorDigestErrorAlarm:
    Type: AWS::CloudWatch::Alarm
    Properties:
      AlarmDescription: Dapier daily error digest Lambda errors
      AlarmActions: [!Ref AlarmTopic]
      Namespace: AWS/Lambda
      MetricName: Errors
      Dimensions:
        - Name: FunctionName
          Value: !Ref ErrorDigestFunction
      Statistic: Sum
      Period: 300
      EvaluationPeriods: 1
      Threshold: 1
      ComparisonOperator: GreaterThanOrEqualToThreshold
      TreatMissingData: notBreaching

  # A token that lapses takes its workflows down with it: the daily
  # connection digest warns while re-consent is still cheap.
  ConnectionDigestFunction:
    Type: AWS::Serverless::Function
    Properties:
      CodeUri: .
      Handler: src.dapier.connection_digest.handler
      Runtime: python3.12
      Architectures: [arm64]
      Timeout: 30
      MemorySize: 128
      Environment:
        Variables:
          DAPIER_EMAIL_SENDER: !Ref EmailSender
          DAPIER_ALERT_SENDER: !Ref AlertEmailSender
          DAPIER_NOTIFY_EMAIL: !Ref NotifyEmail
          CONNECTIONS_TABLE: !Ref ConnectionsTable
          CREDENTIALS_TABLE: !Ref CredentialsTable
          # The one-click re-auth links in the digest email point at the
          # same origin the OAuth callback is registered on.
          OAUTH_CALLBACK_URL: !Sub https://${DomainName}/oauth/callback
          DAPIER_CONNECTION_DIGEST_HOURS: '48'
      Policies:
        - Statement:
            Effect: Allow
            Action: [ses:SendEmail]
            Resource: '*'
        - DynamoDBReadPolicy:
            TableName: !Ref ConnectionsTable
        - DynamoDBReadPolicy:
            TableName: !Ref CredentialsTable
      Events:
        Daily:
          Type: Schedule
          Properties:
            Schedule: cron(30 7 * * ? *)

  # Same failure mode as the error digest: a silent digest hides the
  # lapses it exists to surface, so errors page the alarm chain.
  ConnectionDigestErrorAlarm:
    Type: AWS::CloudWatch::Alarm
    Properties:
      AlarmDescription: Dapier daily connection expiry digest Lambda errors
      AlarmActions: [!Ref AlarmTopic]
      Namespace: AWS/Lambda
      MetricName: Errors
      Dimensions:
        - Name: FunctionName
          Value: !Ref ConnectionDigestFunction
      Statistic: Sum
      Period: 300
      EvaluationPeriods: 1
      Threshold: 1
      ComparisonOperator: GreaterThanOrEqualToThreshold
      TreatMissingData: notBreaching

Outputs:
  ApiUrl:
    Value: !Sub https://${DomainName}
  MailBucketName:
    Value: !Ref MailBucket
  EmailIngressFunctionArn:
    Value: !GetAtt EmailIngressFunction.Arn
  EventQueueUrl:
    Value: !Ref EventQueue
  RenderQueueUrl:
    Value: !Ref RenderQueue
  RenderArtifactsBucketName:
    Value: !Ref RenderArtifactsBucket
  YouTubeSubscriptionFunctionName:
    Value: !Ref YouTubeSubscriptionFunction
  AdminSecretName:
    Value: !Ref AdminSecretName
  CredentialsTableName:
    Value: !Ref CredentialsTable
  CredentialsTableArn:
    Value: !GetAtt CredentialsTable.Arn
  GrantsTableName:
    Value: !Ref GrantsTable
  CursorsTableName:
    Value: !Ref CursorsTable
  PollTriggersTableName:
    Value: !Ref PollTriggersTable
  AuditTableName:
    Value: !Ref AuditTable
  BackupBucketName:
    Value: !Ref BackupBucket