@empire-builder-kit/nx 1.0.0-beta.9 → 1.0.0-rc.2

package/src/workload-roles/account-baseline.js

@@ -0,0 +1,743 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.WorkloadRoleAccountBaselineError = exports.WORKLOAD_ROLE_ACCOUNT_BASELINE_SCHEMA_VERSION = exports.WORKLOAD_ROLE_DEPLOYMENT_POLICY_NAME = void 0;
+exports.workloadRoleProvisionerAliasArn = workloadRoleProvisionerAliasArn;
+exports.createWorkloadRoleStageAccountBaselinePlan = createWorkloadRoleStageAccountBaselinePlan;
+exports.createWorkloadRoleStageDeploymentPromotion = createWorkloadRoleStageDeploymentPromotion;
+exports.publishReviewedStageWorkloadRoleCandidate = publishReviewedStageWorkloadRoleCandidate;
+const node_crypto_1 = require("node:crypto");
+const handler_js_1 = require("./handler.js");
+const provisioner_js_1 = require("./provisioner.js");
+const history_js_1 = require("./history.js");
+const registration_js_1 = require("./registration.js");
+const stage_boundary_js_1 = require("./stage-boundary.js");
+exports.WORKLOAD_ROLE_DEPLOYMENT_POLICY_NAME = 'ebk-workload-role-deployment-v1';
+exports.WORKLOAD_ROLE_ACCOUNT_BASELINE_SCHEMA_VERSION = 1;
+class WorkloadRoleAccountBaselineError extends Error {
+    classification;
+    constructor(classification, message) {
+        super(message);
+        this.classification = classification;
+        this.name = 'WorkloadRoleAccountBaselineError';
+    }
+}
+exports.WorkloadRoleAccountBaselineError = WorkloadRoleAccountBaselineError;
+const accountPattern = /^\d{12}$/;
+const bucketPattern = /^(?!\d{1,3}(?:\.\d{1,3}){3}$)[a-z0-9][a-z0-9.-]{1,61}[a-z0-9]$/;
+const candidatePattern = /^[a-z0-9][a-z0-9._-]{0,127}$/;
+const digestPattern = /^[a-f0-9]{64}$/;
+const projectPattern = /^[a-z0-9][a-z0-9-]{0,62}$/;
+const regionPattern = /^[a-z]{2}(?:-gov)?-[a-z]+-\d$/;
+const stagePattern = /^[a-z0-9][a-z0-9-]{0,62}$/;
+const deploymentRoleArnPattern = /^arn:(aws|aws-cn|aws-us-gov):iam::(\d{12}):role\/(?:[A-Za-z0-9+=,.@_-]+\/)*([A-Za-z0-9+=,.@_-]{1,64})$/;
+const publisherPrincipalArnPattern = /^arn:(aws|aws-cn|aws-us-gov):(iam|sts)::(\d{12}):(?:role|user|assumed-role)\/[A-Za-z0-9+=,.@_/-]+$/;
+function compareStrings(left, right) {
+    return left < right ? -1 : left > right ? 1 : 0;
+}
+function requireMatch(value, pattern, label) {
+    if (!pattern.test(value)) {
+        throw new WorkloadRoleAccountBaselineError('account-baseline-input-invalid', `${label} is invalid.`);
+    }
+    return value;
+}
+function stableName(components, maximumLength) {
+    const value = components.join('-').toLowerCase();
+    if (value.length <= maximumLength)
+        return value;
+    const digest = (0, node_crypto_1.createHash)('sha256')
+        .update(value, 'utf8')
+        .digest('hex')
+        .slice(0, 12);
+    return `${value.slice(0, maximumLength - 13)}-${digest}`;
+}
+function logicalId(project, suffix) {
+    const digest = (0, node_crypto_1.createHash)('sha256')
+        .update(project, 'utf8')
+        .digest('hex')
+        .slice(0, 12);
+    return `Project${digest}${suffix}`;
+}
+function provisionerFunctionName(stage, project) {
+    return stableName(['ebk', stage, project, 'role-provisioner'], 64);
+}
+function provisionerRoleName(stage) {
+    return stableName(['ebk', stage, 'workload-role-provisioner'], 64);
+}
+function stateBucketName(accountId, region, stage) {
+    return stableName(['ebk', 'wr', accountId, region, stage], 63);
+}
+function stackName(stage) {
+    return stableName(['ebk', stage, 'workload-role-account-baseline'], 128);
+}
+function workloadRoleProvisionerAliasArn(options) {
+    requireMatch(options.accountId, accountPattern, 'Account ID');
+    requireMatch(options.manifestDigest, digestPattern, 'Manifest digest');
+    requireMatch(options.project, projectPattern, 'Project');
+    requireMatch(options.region, regionPattern, 'Region');
+    requireMatch(options.stage, stagePattern, 'Stage');
+    if (!['aws', 'aws-cn', 'aws-us-gov'].includes(options.partition)) {
+        throw new WorkloadRoleAccountBaselineError('account-baseline-input-invalid', 'Partition is invalid.');
+    }
+    return `arn:${options.partition}:lambda:${options.region}:${options.accountId}:function:${provisionerFunctionName(options.stage, options.project)}:candidate-${options.manifestDigest}`;
+}
+function requireCodeLocation(value) {
+    if (!bucketPattern.test(value.bucketName) ||
+        value.objectKey.trim() === '' ||
+        value.objectKey.startsWith('/') ||
+        value.objectVersion.trim() === '') {
+        throw new WorkloadRoleAccountBaselineError('account-baseline-input-invalid', 'Provisioner code must use an exact protected S3 bucket, key, and object version.');
+    }
+    return { ...value };
+}
+function exactRoleArns(boundary) {
+    return boundary.documents
+        .flatMap(({ accountId, manifest, partition }) => manifest.roles.map(({ roleName }) => `arn:${partition}:iam::${accountId}:role/${roleName}`))
+        .sort(compareStrings);
+}
+function priorTransitionAuthority(options) {
+    if ((options.expectedPriorHistories === undefined) !==
+        (options.reviewedPriorHistories === undefined)) {
+        throw new WorkloadRoleAccountBaselineError('account-baseline-input-invalid', 'Reviewed prior histories and their independent expectations must be supplied together.');
+    }
+    if (!options.expectedPriorHistories || !options.reviewedPriorHistories) {
+        return { histories: {}, instanceProfileArns: [], roleArns: [] };
+    }
+    const expectedProjects = Object.keys(options.expectedPriorHistories).sort(compareStrings);
+    const reviewedProjects = Object.keys(options.reviewedPriorHistories).sort(compareStrings);
+    if (JSON.stringify(expectedProjects) !== JSON.stringify(reviewedProjects) ||
+        expectedProjects.some((project) => !options.boundary.projects.includes(project))) {
+        throw new WorkloadRoleAccountBaselineError('account-baseline-project-set-invalid', 'Prior histories must name one exact reviewed subset of current projects.');
+    }
+    const currentByProject = new Map(options.boundary.documents.map((document) => [
+        document.project,
+        new Map(document.manifest.roles.map((role) => [role.id, role])),
+    ]));
+    const currentNames = new Set(options.boundary.documents.flatMap((document) => document.manifest.roles.map(({ roleName }) => roleName.toLowerCase())));
+    const transitionNames = new Set();
+    const roleArns = [];
+    const instanceProfileArns = [];
+    const histories = {};
+    for (const project of expectedProjects) {
+        const expectation = options.expectedPriorHistories[project];
+        if (!expectation ||
+            !candidatePattern.test(expectation.candidateIdentity) ||
+            !digestPattern.test(expectation.historyDigest) ||
+            !digestPattern.test(expectation.manifestDigest)) {
+            throw new WorkloadRoleAccountBaselineError('account-baseline-input-invalid', `Prior history expectation for ${project} is invalid.`);
+        }
+        let history;
+        try {
+            history = (0, history_js_1.requireWorkloadRoleHistory)(options.reviewedPriorHistories[project]);
+        }
+        catch {
+            throw new WorkloadRoleAccountBaselineError('account-baseline-substitution', `Prior history for ${project} is malformed or differs from its reviewed manifest.`);
+        }
+        if (history.stage !== options.boundary.stage ||
+            history.currentCandidateIdentity !== expectation.candidateIdentity ||
+            history.historyDigest !== expectation.historyDigest ||
+            history.currentManifestDigest !== expectation.manifestDigest ||
+            [...history.active, ...history.tombstones].some(({ boundaryArn, ownership }) => ownership.project !== project || boundaryArn !== options.boundary.arn)) {
+            throw new WorkloadRoleAccountBaselineError('account-baseline-substitution', `Prior history for ${project} differs from its reviewed candidate, digest, stage, project, or boundary.`);
+        }
+        const currentById = currentByProject.get(project);
+        if (!currentById) {
+            throw new WorkloadRoleAccountBaselineError('account-baseline-project-set-invalid', `Current project ${project} is absent.`);
+        }
+        for (const prior of history.active) {
+            if (currentById.get(prior.id)?.roleName === prior.roleName)
+                continue;
+            const normalizedName = prior.roleName.toLowerCase();
+            if (currentNames.has(normalizedName) ||
+                transitionNames.has(normalizedName)) {
+                throw new WorkloadRoleAccountBaselineError('account-baseline-substitution', `Prior transition role ${prior.roleName} collides with a current or reviewed transition role.`);
+            }
+            transitionNames.add(normalizedName);
+            const roleArn = `arn:${options.boundary.partition}:iam::${options.boundary.accountId}:role/${prior.roleName}`;
+            roleArns.push(roleArn);
+            if (prior.surface === 'foundation-nat-instance') {
+                instanceProfileArns.push(`arn:${options.boundary.partition}:iam::${options.boundary.accountId}:instance-profile/${prior.roleName}-profile`);
+            }
+        }
+        histories[project] = history;
+    }
+    return {
+        histories,
+        instanceProfileArns: instanceProfileArns.sort(compareStrings),
+        roleArns: roleArns.sort(compareStrings),
+    };
+}
+function exactInstanceProfileArns(boundary) {
+    return boundary.documents
+        .flatMap(({ accountId, manifest, partition }) => manifest.roles
+        .filter(({ surface }) => surface === 'foundation-nat-instance')
+        .map(({ roleName }) => `arn:${partition}:iam::${accountId}:instance-profile/${roleName}-profile`))
+        .sort(compareStrings);
+}
+function provisionerPolicy(options) {
+    const currentRoleArns = exactRoleArns(options.boundary);
+    const roleArns = [...currentRoleArns, ...options.transitionalRoleArns].sort(compareStrings);
+    const profileArns = [
+        ...exactInstanceProfileArns(options.boundary),
+        ...options.transitionalInstanceProfileArns,
+    ].sort(compareStrings);
+    return {
+        Statement: [
+            {
+                Action: ['logs:CreateLogStream', 'logs:PutLogEvents'],
+                Effect: 'Allow',
+                Resource: options.logGroupArns
+                    .map((arn) => `${arn}:*`)
+                    .sort(compareStrings),
+                Sid: 'WriteProvisionerLogs',
+            },
+            {
+                Action: ['s3:GetObject'],
+                Effect: 'Allow',
+                Resource: [
+                    ...options.registeredObjectArns,
+                    ...options.stateObjectArns,
+                ].sort(compareStrings),
+                Sid: 'ReadExactRegisteredState',
+            },
+            {
+                Action: ['s3:DeleteObject', 's3:PutObject'],
+                Effect: 'Allow',
+                Resource: [...options.stateObjectArns].sort(compareStrings),
+                Sid: 'WriteExactProvisionedState',
+            },
+            {
+                Action: ['iam:CreateRole', 'iam:PutRolePermissionsBoundary'],
+                Condition: {
+                    StringEquals: {
+                        'iam:PermissionsBoundary': options.boundary.arn,
+                    },
+                },
+                Effect: 'Allow',
+                Resource: currentRoleArns,
+                Sid: 'CreateExactBoundedRoles',
+            },
+            {
+                Action: [
+                    'iam:DeleteRole',
+                    'iam:DeleteRolePolicy',
+                    'iam:DetachRolePolicy',
+                    'iam:GetRole',
+                    'iam:GetRolePolicy',
+                    'iam:ListAttachedRolePolicies',
+                    'iam:ListRolePolicies',
+                    'iam:PutRolePolicy',
+                    'iam:TagRole',
+                    'iam:UntagRole',
+                    'iam:UpdateAssumeRolePolicy',
+                ],
+                Effect: 'Allow',
+                Resource: roleArns,
+                Sid: 'ConvergeExactRegisteredRoles',
+            },
+            ...(profileArns.length === 0
+                ? []
+                : [
+                    {
+                        Action: [
+                            'iam:AddRoleToInstanceProfile',
+                            'iam:CreateInstanceProfile',
+                            'iam:DeleteInstanceProfile',
+                            'iam:GetInstanceProfile',
+                            'iam:RemoveRoleFromInstanceProfile',
+                        ],
+                        Effect: 'Allow',
+                        Resource: [...roleArns, ...profileArns].sort(compareStrings),
+                        Sid: 'ConvergeExactNatInstanceProfiles',
+                    },
+                ]),
+        ],
+        Version: '2012-10-17',
+    };
+}
+function bucketPolicy(partition, bucketName) {
+    const bucketArn = `arn:${partition}:s3:::${bucketName}`;
+    const objectArn = `${bucketArn}/*`;
+    return {
+        Statement: [
+            {
+                Action: 's3:*',
+                Condition: { Bool: { 'aws:SecureTransport': 'false' } },
+                Effect: 'Deny',
+                Principal: '*',
+                Resource: [bucketArn, objectArn],
+                Sid: 'DenyInsecureTransport',
+            },
+            {
+                Action: 's3:PutObject',
+                Condition: {
+                    Null: { 's3:x-amz-server-side-encryption': 'true' },
+                },
+                Effect: 'Deny',
+                Principal: '*',
+                Resource: objectArn,
+                Sid: 'DenyMissingEncryptionHeader',
+            },
+            {
+                Action: 's3:PutObject',
+                Condition: {
+                    StringNotEquals: {
+                        's3:x-amz-server-side-encryption': 'AES256',
+                    },
+                },
+                Effect: 'Deny',
+                Principal: '*',
+                Resource: objectArn,
+                Sid: 'DenyUnexpectedEncryption',
+            },
+        ],
+        Version: '2012-10-17',
+    };
+}
+function projectLambdaResources(options) {
+    const functionId = logicalId(options.plan.project, 'ProvisionerFunction');
+    const logId = logicalId(options.plan.project, 'ProvisionerLogGroup');
+    const versionId = logicalId(options.plan.project, 'ProvisionerVersion');
+    const aliasId = logicalId(options.plan.project, 'ProvisionerAlias');
+    return {
+        [logId]: {
+            DeletionPolicy: 'Retain',
+            Properties: {
+                LogGroupName: `/aws/lambda/${options.plan.functionName}`,
+                RetentionInDays: 30,
+            },
+            Type: 'AWS::Logs::LogGroup',
+            UpdateReplacePolicy: 'Retain',
+        },
+        [functionId]: {
+            DependsOn: [logId, 'WorkloadRoleStateBucketPolicy'],
+            Properties: {
+                Code: {
+                    S3Bucket: options.code.bucketName,
+                    S3Key: options.code.objectKey,
+                    S3ObjectVersion: options.code.objectVersion,
+                },
+                Environment: {
+                    Variables: {
+                        EBK_WORKLOAD_ROLE_BUCKET: options.plan.storage.bucketName,
+                        EBK_WORKLOAD_ROLE_MANIFEST_DIGEST: options.plan.manifestDigest,
+                        EBK_WORKLOAD_ROLE_PROJECT: options.plan.project,
+                        EBK_WORKLOAD_ROLE_PROVISIONER_ALIAS_ARN: options.plan.provisionerAliasArn,
+                        EBK_WORKLOAD_ROLE_STAGE: options.plan.registeredDocument.manifest.candidate.stage,
+                    },
+                },
+                FunctionName: options.plan.functionName,
+                Handler: 'index.handler',
+                MemorySize: 512,
+                ReservedConcurrentExecutions: 1,
+                Role: {
+                    'Fn::GetAtt': [options.provisionerRoleLogicalId, 'Arn'],
+                },
+                Runtime: 'nodejs22.x',
+                Timeout: 900,
+            },
+            Type: 'AWS::Lambda::Function',
+        },
+        [versionId]: {
+            Properties: {
+                Description: `Candidate ${options.plan.manifestDigest}`,
+                FunctionName: { Ref: functionId },
+            },
+            Type: 'AWS::Lambda::Version',
+        },
+        [aliasId]: {
+            Properties: {
+                FunctionName: { Ref: functionId },
+                FunctionVersion: { 'Fn::GetAtt': [versionId, 'Version'] },
+                Name: options.plan.provisionerAliasName,
+            },
+            Type: 'AWS::Lambda::Alias',
+        },
+    };
+}
+function cloudFormationTemplate(options) {
+    const registeredObjectArns = options.projectPlans.map(({ registeredManifestObjectKey }) => `arn:${options.boundary.partition}:s3:::${options.stateBucketName}/${registeredManifestObjectKey}`);
+    const stateObjectArns = options.projectPlans.flatMap(({ project }) => [
+        `arn:${options.boundary.partition}:s3:::${options.stateBucketName}/${(0, registration_js_1.provisionedWorkloadRoleRegistrationObjectKey)({
+            manifestDigest: options.boundary.manifestDigestsByProject[project],
+            project,
+            provisionerFunctionArn: options.projectPlans.find((plan) => plan.project === project)?.provisionerAliasArn,
+            stage: options.boundary.stage,
+        })}`,
+        `arn:${options.boundary.partition}:s3:::${options.stateBucketName}/${(0, registration_js_1.workloadRoleHistoryObjectKey)(options.boundary.stage, project)}`,
+    ]);
+    const logGroupArns = options.projectPlans.map(({ functionName }) => `arn:${options.boundary.partition}:logs:${options.region}:${options.boundary.accountId}:log-group:/aws/lambda/${functionName}`);
+    const policy = provisionerPolicy({
+        boundary: options.boundary,
+        logGroupArns,
+        registeredObjectArns,
+        stateObjectArns,
+        transitionalInstanceProfileArns: options.transitionalInstanceProfileArns,
+        transitionalRoleArns: options.transitionalRoleArns,
+    });
+    const resources = {
+        WorkloadRoleBoundary: {
+            Properties: {
+                Description: 'Exact reviewed aggregate maximum-permission boundary for this stage.',
+                ManagedPolicyName: options.boundary.policyName,
+                Path: options.boundary.path,
+                PolicyDocument: options.boundary.policy,
+            },
+            Type: 'AWS::IAM::ManagedPolicy',
+        },
+        WorkloadRoleProvisionerRole: {
+            Properties: {
+                AssumeRolePolicyDocument: {
+                    Statement: [
+                        {
+                            Action: 'sts:AssumeRole',
+                            Effect: 'Allow',
+                            Principal: { Service: 'lambda.amazonaws.com' },
+                        },
+                    ],
+                    Version: '2012-10-17',
+                },
+                Policies: [
+                    {
+                        PolicyDocument: policy,
+                        PolicyName: 'ebk-fixed-workload-role-provisioner-v1',
+                    },
+                ],
+                RoleName: options.provisionerRoleName,
+                Tags: [
+                    { Key: 'ebk:managed-by', Value: 'account-baseline' },
+                    { Key: 'ebk:stage', Value: options.boundary.stage },
+                ],
+            },
+            Type: 'AWS::IAM::Role',
+        },
+        WorkloadRoleStateBucket: {
+            DeletionPolicy: 'Retain',
+            Properties: {
+                BucketEncryption: {
+                    ServerSideEncryptionConfiguration: [
+                        {
+                            ServerSideEncryptionByDefault: {
+                                SSEAlgorithm: 'AES256',
+                            },
+                        },
+                    ],
+                },
+                BucketName: options.stateBucketName,
+                OwnershipControls: {
+                    Rules: [{ ObjectOwnership: 'BucketOwnerEnforced' }],
+                },
+                PublicAccessBlockConfiguration: {
+                    BlockPublicAcls: true,
+                    BlockPublicPolicy: true,
+                    IgnorePublicAcls: true,
+                    RestrictPublicBuckets: true,
+                },
+                VersioningConfiguration: { Status: 'Enabled' },
+            },
+            Type: 'AWS::S3::Bucket',
+            UpdateReplacePolicy: 'Retain',
+        },
+        WorkloadRoleStateBucketPolicy: {
+            Properties: {
+                Bucket: { Ref: 'WorkloadRoleStateBucket' },
+                PolicyDocument: bucketPolicy(options.boundary.partition, options.stateBucketName),
+            },
+            Type: 'AWS::S3::BucketPolicy',
+        },
+    };
+    for (const plan of options.projectPlans) {
+        Object.assign(resources, projectLambdaResources({
+            code: options.code,
+            plan,
+            provisionerRoleLogicalId: 'WorkloadRoleProvisionerRole',
+        }));
+    }
+    return {
+        AWSTemplateFormatVersion: '2010-09-09',
+        Description: 'Protected Empire Builder Kit v1 stage workload-role account baseline. Apply only with external account-baseline authority.',
+        Resources: resources,
+    };
+}
+function createWorkloadRoleStageAccountBaselinePlan(options) {
+    requireMatch(options.expectedAccountId, accountPattern, 'Expected account ID');
+    requireMatch(options.expectedCandidateIdentity, candidatePattern, 'Expected candidate identity');
+    requireMatch(options.expectedStage, stagePattern, 'Expected stage');
+    requireMatch(options.region, regionPattern, 'Region');
+    const code = requireCodeLocation(options.code);
+    const deploymentRole = deploymentRoleArnPattern.exec(options.reviewedDeploymentRoleArn);
+    if (!deploymentRole ||
+        deploymentRole[1] !== options.expectedPartition ||
+        deploymentRole[2] !== options.expectedAccountId) {
+        throw new WorkloadRoleAccountBaselineError('account-baseline-substitution', 'Deployment role must be one exact role in the reviewed account and partition.');
+    }
+    const publisherPrincipal = publisherPrincipalArnPattern.exec(options.reviewedPublisherPrincipalArn);
+    if (!publisherPrincipal ||
+        publisherPrincipal[1] !== options.expectedPartition ||
+        publisherPrincipal[3] !== options.expectedAccountId ||
+        options.reviewedPublisherPrincipalArn === options.reviewedDeploymentRoleArn) {
+        throw new WorkloadRoleAccountBaselineError('account-baseline-substitution', 'Publisher principal must be one distinct exact externally reviewed principal in the expected account and partition.');
+    }
+    const boundary = (0, stage_boundary_js_1.createStageWorkloadRoleBoundaryContract)({
+        documents: options.registeredDocuments,
+        expectedAccountId: options.expectedAccountId,
+        expectedCandidateIdentity: options.expectedCandidateIdentity,
+        expectedManifestDigests: options.expectedManifestDigests,
+        expectedPartition: options.expectedPartition,
+        expectedProjects: options.expectedProjects,
+        expectedStage: options.expectedStage,
+    });
+    const transitionAuthority = priorTransitionAuthority({
+        boundary,
+        ...(options.expectedPriorHistories
+            ? { expectedPriorHistories: options.expectedPriorHistories }
+            : {}),
+        ...(options.reviewedPriorHistories
+            ? { reviewedPriorHistories: options.reviewedPriorHistories }
+            : {}),
+    });
+    const bucketName = stateBucketName(options.expectedAccountId, options.region, options.expectedStage);
+    const projectPlans = boundary.documents.map((document) => {
+        const expectedProvisionerArn = workloadRoleProvisionerAliasArn({
+            accountId: document.accountId,
+            manifestDigest: document.manifestDigest,
+            partition: document.partition,
+            project: document.project,
+            region: options.region,
+            stage: document.manifest.candidate.stage,
+        });
+        if (document.provisionerFunctionArn !== expectedProvisionerArn) {
+            throw new WorkloadRoleAccountBaselineError('account-baseline-substitution', `Registered project ${document.project} does not name its exact candidate-qualified provisioner.`);
+        }
+        const storage = (0, registration_js_1.createWorkloadRoleStorageRegistration)({
+            bucketName,
+            candidateIdentity: document.manifest.candidate.identity,
+            manifestDigest: document.manifestDigest,
+            project: document.project,
+            provisionerFunctionArn: expectedProvisionerArn,
+            stage: document.manifest.candidate.stage,
+        });
+        return {
+            candidateIdentity: document.manifest.candidate.identity,
+            functionName: provisionerFunctionName(document.manifest.candidate.stage, document.project),
+            manifestDigest: document.manifestDigest,
+            project: document.project,
+            provisionerAliasArn: expectedProvisionerArn,
+            provisionerAliasName: `candidate-${document.manifestDigest}`,
+            provisionerRequest: {
+                candidateIdentity: document.manifest.candidate.identity,
+                manifestDigest: document.manifestDigest,
+                operation: 'converge',
+                stage: document.manifest.candidate.stage,
+            },
+            registeredDocument: document,
+            registeredManifestObjectKey: (0, registration_js_1.registeredWorkloadRoleManifestObjectKey)({
+                manifestDigest: document.manifestDigest,
+                project: document.project,
+                provisionerFunctionArn: expectedProvisionerArn,
+                stage: document.manifest.candidate.stage,
+            }),
+            storage,
+            storageParameterName: (0, registration_js_1.workloadRoleStorageRegistrationPath)(document.manifest.candidate.stage, document.project),
+        };
+    });
+    const roleName = provisionerRoleName(options.expectedStage);
+    return {
+        boundary,
+        candidateIdentity: options.expectedCandidateIdentity,
+        deploymentRoleArn: options.reviewedDeploymentRoleArn,
+        deploymentRoleName: deploymentRole[3],
+        projectPlans,
+        provisionerRoleName: roleName,
+        publisherPrincipalArn: options.reviewedPublisherPrincipalArn,
+        region: options.region,
+        schemaVersion: exports.WORKLOAD_ROLE_ACCOUNT_BASELINE_SCHEMA_VERSION,
+        stackName: stackName(options.expectedStage),
+        stage: options.expectedStage,
+        stateBucketName: bucketName,
+        settledCloudFormationTemplate: cloudFormationTemplate({
+            boundary,
+            code,
+            projectPlans,
+            provisionerRoleName: roleName,
+            region: options.region,
+            stateBucketName: bucketName,
+            transitionalInstanceProfileArns: [],
+            transitionalRoleArns: [],
+        }),
+        transitionalCloudFormationTemplate: cloudFormationTemplate({
+            boundary,
+            code,
+            projectPlans,
+            provisionerRoleName: roleName,
+            region: options.region,
+            stateBucketName: bucketName,
+            transitionalInstanceProfileArns: transitionAuthority.instanceProfileArns,
+            transitionalRoleArns: transitionAuthority.roleArns,
+        }),
+        transitionalInstanceProfileArns: transitionAuthority.instanceProfileArns,
+        transitionalRoleArns: transitionAuthority.roleArns,
+    };
+}
+function requireSuccessResult(plan, value) {
+    if (typeof value !== 'object' ||
+        value === null ||
+        Array.isArray(value) ||
+        !('ok' in value) ||
+        value.ok !== true) {
+        throw new WorkloadRoleAccountBaselineError('account-baseline-result-invalid', `Fixed provisioner for ${plan.project} did not return sanitized success.`);
+    }
+    const result = value;
+    const allowed = [
+        'candidateIdentity',
+        'historyDigest',
+        'manifestDigest',
+        'ok',
+        'operation',
+        'operationCounts',
+        'protocolVersion',
+        'provisionedRegistration',
+        'resultSchemaVersion',
+        'stage',
+    ];
+    if (Object.keys(result).some((property) => !allowed.includes(property)) ||
+        result.candidateIdentity !== plan.candidateIdentity ||
+        typeof result.historyDigest !== 'string' ||
+        !digestPattern.test(result.historyDigest) ||
+        result.manifestDigest !== plan.manifestDigest ||
+        result.operation !== 'converge' ||
+        result.protocolVersion !==
+            provisioner_js_1.FIXED_WORKLOAD_ROLE_PROVISIONER_PROTOCOL_VERSION ||
+        result.resultSchemaVersion !==
+            handler_js_1.FIXED_WORKLOAD_ROLE_PROVISIONER_RESULT_SCHEMA_VERSION ||
+        result.stage !== plan.registeredDocument.manifest.candidate.stage ||
+        typeof result.operationCounts !== 'object' ||
+        result.operationCounts === null ||
+        Array.isArray(result.operationCounts)) {
+        throw new WorkloadRoleAccountBaselineError('account-baseline-result-invalid', `Fixed provisioner success envelope for ${plan.project} was substituted.`);
+    }
+    const counts = result.operationCounts;
+    if (Object.keys(counts).sort().join(',') !== 'create,remove,update' ||
+        Object.values(counts).some((count) => !Number.isSafeInteger(count) || count < 0)) {
+        throw new WorkloadRoleAccountBaselineError('account-baseline-result-invalid', `Fixed provisioner operation counts for ${plan.project} are invalid.`);
+    }
+    const provisionedRegistration = (0, registration_js_1.requireProvisionedWorkloadRoleRegistrationDocument)(result.provisionedRegistration);
+    if (provisionedRegistration.registration.provisionerFunctionArn !==
+        plan.provisionerAliasArn) {
+        throw new WorkloadRoleAccountBaselineError('account-baseline-result-invalid', `Fixed provisioner result for ${plan.project} names another alias.`);
+    }
+    return {
+        ...value,
+        provisionedRegistration,
+    };
+}
+function deploymentStatementSid(project, sid) {
+    const projectDigest = (0, node_crypto_1.createHash)('sha256')
+        .update(project, 'utf8')
+        .digest('hex')
+        .slice(0, 12);
+    return `Project${projectDigest}${sid}`;
+}
+function createWorkloadRoleStageDeploymentPromotion(options) {
+    const resultProjects = Object.keys(options.provisionerResults).sort(compareStrings);
+    const expectedProjects = options.plan.projectPlans
+        .map(({ project }) => project)
+        .sort(compareStrings);
+    if (JSON.stringify(resultProjects) !== JSON.stringify(expectedProjects)) {
+        throw new WorkloadRoleAccountBaselineError('account-baseline-project-set-invalid', 'Provisioner results must contain the complete reviewed project set.');
+    }
+    const deploymentStatements = [];
+    const projectPromotions = {};
+    const sanitizedProjects = [];
+    for (const plan of options.plan.projectPlans) {
+        const result = requireSuccessResult(plan, options.provisionerResults[plan.project]);
+        const preflight = (0, registration_js_1.validateWorkloadRolePreflight)({
+            expectedCandidateIdentity: options.plan.candidateIdentity,
+            expectedProject: plan.project,
+            expectedStage: options.plan.stage,
+            provisionedRegistration: result.provisionedRegistration,
+            registeredManifest: plan.registeredDocument,
+            storageRegistration: plan.storage,
+        });
+        deploymentStatements.push(...preflight.authorityPlan.statements.map((statement) => ({
+            Action: [...statement.actions],
+            ...(statement.conditions ? { Condition: statement.conditions } : {}),
+            Effect: statement.effect,
+            Resource: [...statement.resources],
+            Sid: deploymentStatementSid(plan.project, statement.sid),
+        })));
+        projectPromotions[plan.project] = {
+            provisionedRegistration: result.provisionedRegistration,
+            storageParameterName: plan.storageParameterName,
+            storageParameterValue: JSON.stringify(plan.storage),
+        };
+        sanitizedProjects.push({
+            historyDigest: result.historyDigest,
+            manifestDigest: plan.manifestDigest,
+            operationCounts: {
+                create: result.operationCounts.create,
+                remove: result.operationCounts.remove,
+                update: result.operationCounts.update,
+            },
+            project: plan.project,
+        });
+    }
+    deploymentStatements.sort((left, right) => compareStrings(left.Sid, right.Sid));
+    return {
+        deploymentPolicy: {
+            Statement: deploymentStatements,
+            Version: '2012-10-17',
+        },
+        deploymentPolicyName: exports.WORKLOAD_ROLE_DEPLOYMENT_POLICY_NAME,
+        projectPromotions,
+        sanitizedResult: {
+            candidateIdentity: options.plan.candidateIdentity,
+            projects: sanitizedProjects,
+            stage: options.plan.stage,
+        },
+    };
+}
+/**
+ * Protected stage promotion ordering. The aggregate boundary and narrowly
+ * reviewed transition authority are updated first, then every exact registered
+ * project converges. The settled baseline removes transition authority before
+ * the ordinary deployment policy or any project pointer is promoted. Those
+ * promotion surfaces remain unchanged unless every project returns an exact
+ * sanitized success and the settled baseline applies.
+ */
+async function publishReviewedStageWorkloadRoleCandidate(options) {
+    await options.controlPlane.applyAccountBaseline(options.plan.transitionalCloudFormationTemplate, options.plan.stackName);
+    for (const project of options.plan.projectPlans) {
+        await options.controlPlane.putRegisteredDocument({
+            bucketName: project.storage.bucketName,
+            key: project.registeredManifestObjectKey,
+            value: project.registeredDocument,
+        });
+    }
+    const provisionerResults = {};
+    for (const project of options.plan.projectPlans) {
+        provisionerResults[project.project] =
+            await options.controlPlane.invokeQualifiedProvisioner(project.provisionerAliasArn, project.provisionerRequest);
+    }
+    const promotion = createWorkloadRoleStageDeploymentPromotion({
+        plan: options.plan,
+        provisionerResults,
+    });
+    await options.controlPlane.applyAccountBaseline(options.plan.settledCloudFormationTemplate, options.plan.stackName);
+    await options.controlPlane.putDeploymentRolePolicy({
+        policy: promotion.deploymentPolicy,
+        policyName: promotion.deploymentPolicyName,
+        roleName: options.plan.deploymentRoleName,
+    });
+    for (const project of options.plan.projectPlans) {
+        const promoted = promotion.projectPromotions[project.project];
+        if (!promoted) {
+            throw new WorkloadRoleAccountBaselineError('account-baseline-result-invalid', `Promotion result for ${project.project} is absent.`);
+        }
+        await options.controlPlane.putStoragePointer({
+            name: promoted.storageParameterName,
+            value: promoted.storageParameterValue,
+        });
+    }
+    return promotion.sanitizedResult;
+}
+//# sourceMappingURL=account-baseline.js.map