@empire-builder-kit/nx 1.0.0-beta.9 → 1.0.0-rc.2

package/src/workload-roles/boundary.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"boundary.js","sourceRoot":"","sources":["../../../../../packages/nx/src/workload-roles/boundary.ts"],"names":[],"mappings":";;;AAwGA,4DAQC;AAED,0DAOC;AAkCD,gFAuDC;AAlND,6CAAyC;AACzC,+DAM+B;AAC/B,+CAGuB;AAEV,QAAA,kCAAkC,GAAG,MAAe,CAAC;AACrD,QAAA,kCAAkC,GAC7C,wBAAiC,CAAC;AAEvB,QAAA,qCAAqC,GAAG;IACnD,sBAAsB;IACtB,kBAAkB;IAClB,yBAAyB;IACzB,gBAAgB;IAChB,kBAAkB;IAClB,yBAAyB;IACzB,gBAAgB;IAChB,mCAAmC;IACnC,sBAAsB;IACtB,sBAAsB;IACtB,gCAAgC;IAChC,mBAAmB;IACnB,6BAA6B;IAC7B,aAAa;IACb,eAAe;IACf,4BAA4B;IAC5B,gBAAgB;IAChB,2BAA2B;IAC3B,6BAA6B;IAC7B,4BAA4B;IAC5B,iCAAiC;IACjC,gBAAgB;CACR,CAAC;AAmBX,MAAa,iCAAkC,SAAQ,KAAK;IAE/C;IADX,YACW,cAAyD,EAClE,OAAe;QAEf,KAAK,CAAC,OAAO,CAAC,CAAC;QAHN,mBAAc,GAAd,cAAc,CAA2C;QAIlE,IAAI,CAAC,IAAI,GAAG,mCAAmC,CAAC;IAClD,CAAC;CACF;AARD,8EAQC;AAED,MAAM,YAAY,GAAG,2BAA2B,CAAC;AACjD,MAAM,cAAc,GAAG,UAAU,CAAC;AAElC,SAAS,cAAc,CAAC,IAAY,EAAE,KAAa;IACjD,OAAO,IAAI,GAAG,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,IAAI,GAAG,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;AAClD,CAAC;AAED,SAAS,eAAe,CAAC,OAIxB;IAKC,IACE,CAAC,cAAc,CAAC,IAAI,CAAC,OAAO,CAAC,SAAS,CAAC;QACvC,CAAC,YAAY,CAAC,IAAI,CAAC,OAAO,CAAC,KAAK,CAAC;QACjC,CAAE,CAAC,KAAK,EAAE,QAAQ,EAAE,YAAY,CAAW,CAAC,QAAQ,CAClD,OAAO,CAAC,SAA4C,CACrD,EACD,CAAC;QACD,MAAM,IAAI,iCAAiC,CACzC,2BAA2B,EAC3B,sGAAsG,CACvG,CAAC;IACJ,CAAC;IACD,OAAO,OAIN,CAAC;AACJ,CAAC;AAED,SAAgB,wBAAwB,CAAC,KAAa;IACpD,IAAI,CAAC,YAAY,CAAC,IAAI,CAAC,KAAK,CAAC,EAAE,CAAC;QAC9B,MAAM,IAAI,iCAAiC,CACzC,2BAA2B,EAC3B,gCAAgC,KAAK,qBAAqB,CAC3D,CAAC;IACJ,CAAC;IACD,OAAO,GAAG,0CAAkC,IAAI,KAAK,GAAG,CAAC;AAC3D,CAAC;AAED,SAAgB,uBAAuB,CAAC,OAIvC;IACC,MAAM,QAAQ,GAAG,eAAe,CAAC,OAAO,CAAC,CAAC;IAC1C,OAAO,OAAO,QAAQ,CAAC,SAAS,SAAS,QAAQ,CAAC,SAAS,UAAU,wBAAwB,CAAC,QAAQ,CAAC,KAAK,CAAC,GAAG,0CAAkC,EAAE,CAAC;AACvJ,CAAC;AAED,SAAS,uBAAuB,CAC9B,QAA6D,EAC7D,MAAyC;IAEzC,MAAM,UAAU,GAAkC,EAAE,CAAC;IACrD,KAAK,MAAM,WAAW,IAAI,QAAQ,CAAC,KAAK,EAAE,CAAC;QACzC,MAAM,MAAM,GAAG,IAAA,4CAAsB,EAAC,MAAM,EAAE,WAAW,CAAC,EAAE,CAAC,CAAC;QAC9D,IAAI,MAAM,CAAC,MAAM,KAAK,WAAW,CAAC,sBAAsB,EAAE,CAAC;YACzD,MAAM,IAAI,iCAAiC,CACzC,uBAAuB,EACvB,wBAAwB,WAAW,CAAC,EAAE,sCAAsC,CAC7E,CAAC;QACJ,CAAC;QACD,KAAK,MAAM,SAAS,IAAI,MAAM,CAAC,QAAQ,CAAC,SAAS,EAAE,CAAC;YAClD,UAAU,CAAC,IAAI,CAAC;gBACd,GAAG,SAAS;gBACZ,GAAG,EAAE,OAAO,IAAA,wBAAU,EAAC,QAAQ,CAAC;qBAC7B,MAAM,CAAC,GAAG,WAAW,CAAC,EAAE,IAAI,SAAS,CAAC,GAAG,EAAE,EAAE,MAAM,CAAC;qBACpD,MAAM,CAAC,KAAK,CAAC;qBACb,KAAK,CAAC,CAAC,EAAE,EAAE,CAAC,EAAE;aAClB,CAAC,CAAC;QACL,CAAC;IACH,CAAC;IACD,IAAI,UAAU,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QAC5B,MAAM,IAAI,iCAAiC,CACzC,4BAA4B,EAC5B,gFAAgF,CACjF,CAAC;IACJ,CAAC;IACD,OAAO,UAAU,CAAC,IAAI,CAAC,CAAC,IAAI,EAAE,KAAK,EAAE,EAAE,CAAC,cAAc,CAAC,IAAI,CAAC,GAAG,EAAE,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC;AAC/E,CAAC;AAED,SAAgB,kCAAkC,CAAC,OAMlD;IACC,MAAM,QAAQ,GAAG,eAAe,CAAC,OAAO,CAAC,CAAC;IAC1C,MAAM,QAAQ,GAAG,IAAA,8CAAgC,EAAC,OAAO,CAAC,QAAQ,CAAC,CAAC;IACpE,MAAM,cAAc,GAAG,IAAA,wCAA0B,EAAC,QAAQ,CAAC,CAAC;IAC5D,IACE,QAAQ,CAAC,SAAS,CAAC,KAAK,KAAK,QAAQ,CAAC,KAAK;QAC3C,OAAO,CAAC,MAAM,CAAC,KAAK,KAAK,QAAQ,CAAC,KAAK;QACvC,OAAO,CAAC,MAAM,CAAC,iBAAiB,KAAK,QAAQ,CAAC,SAAS,CAAC,QAAQ;QAChE,OAAO,CAAC,MAAM,CAAC,cAAc,KAAK,cAAc,EAChD,CAAC;QACD,MAAM,IAAI,iCAAiC,CACzC,uBAAuB,EACvB,0EAA0E,CAC3E,CAAC;IACJ,CAAC;IACD,MAAM,GAAG,GAAG,uBAAuB,CAAC,QAAQ,CAAC,CAAC;IAC9C,MAAM,WAAW,GAAG,QAAQ,CAAC,KAAK,CAAC,MAAM,CACvC,CAAC,EAAE,WAAW,EAAE,EAAE,EAAE,CAAC,WAAW,KAAK,GAAG,CACzC,CAAC;IACF,IAAI,WAAW,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;QAC3B,MAAM,IAAI,iCAAiC,CACzC,uBAAuB,EACvB,uDAAuD,WAAW,CAAC,GAAG,CAAC,CAAC,EAAE,EAAE,EAAE,EAAE,EAAE,CAAC,EAAE,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,GAAG,CACrG,CAAC;IACJ,CAAC;IACD,MAAM,MAAM,GAA+B;QACzC,SAAS,EAAE;YACT,GAAG,uBAAuB,CAAC,QAAQ,EAAE,OAAO,CAAC,MAAM,CAAC;YACpD;gBACE,MAAM,EAAE,CAAC,GAAG,6CAAqC,CAAC;gBAClD,MAAM,EAAE,MAAM;gBACd,QAAQ,EAAE,CAAC,GAAG,CAAC;gBACf,GAAG,EAAE,2BAA2B;aACjC;SACF;QACD,OAAO,EAAE,wCAAkB;KAC5B,CAAC;IACF,MAAM,UAAU,GAAG,IAAI,CAAC,SAAS,CAAC,MAAM,CAAC,CAAC;IAC1C,OAAO;QACL,SAAS,EAAE,QAAQ,CAAC,SAAS;QAC7B,GAAG;QACH,iBAAiB,EAAE,QAAQ,CAAC,SAAS,CAAC,QAAQ;QAC9C,MAAM,EAAE,IAAA,wBAAU,EAAC,QAAQ,CAAC,CAAC,MAAM,CAAC,UAAU,EAAE,MAAM,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC;QACrE,SAAS,EAAE,QAAQ,CAAC,SAAS;QAC7B,IAAI,EAAE,wBAAwB,CAAC,QAAQ,CAAC,KAAK,CAAC;QAC9C,MAAM;QACN,UAAU,EAAE,0CAAkC;QAC9C,KAAK,EAAE,QAAQ,CAAC,KAAK;KACtB,CAAC;AACJ,CAAC"}

package/src/workload-roles/convergence.d.ts

@@ -0,0 +1,66 @@
+import { type WorkloadRoleDeclaration, type WorkloadRoleOwnership, type WorkloadRoleTrustClass } from './manifest.js';
+export declare const WORKLOAD_ROLE_PROVISIONER_OWNER: "empire-builder-kit/workload-role-provisioner";
+export declare const WORKLOAD_ROLE_PROVISIONER_OPERATIONS: readonly ["converge", "remove"];
+export type WorkloadRoleProvisionerOperation = (typeof WORKLOAD_ROLE_PROVISIONER_OPERATIONS)[number];
+export type WorkloadRoleProvisionerFailureClassification = 'observed-role-ambiguous' | 'observed-role-substitution' | 'registration-substitution' | 'request-substitution';
+export declare class WorkloadRoleProvisionerContractError extends Error {
+    readonly classification: WorkloadRoleProvisionerFailureClassification;
+    constructor(classification: WorkloadRoleProvisionerFailureClassification, message: string);
+}
+export interface WorkloadRoleManifestRegistration {
+    candidateIdentity: string;
+    manifestDigest: string;
+    stage: string;
+}
+export interface WorkloadRoleProvisionerRequest {
+    candidateIdentity: string;
+    manifestDigest: string;
+    operation: WorkloadRoleProvisionerOperation;
+    stage: string;
+}
+/**
+ * The adapter must return only exact-name lookups derived from the registered
+ * manifest. Arbitrary caller-selected IAM roles are never planner input.
+ */
+export interface ObservedWorkloadRole {
+    boundaryArn: string | null;
+    candidateIdentity?: string;
+    managedBy?: string;
+    manifestDigest?: string;
+    ownership?: WorkloadRoleOwnership;
+    passDestinations: string[];
+    permissionPolicyDigest: string;
+    roleArn: string;
+    roleName: string;
+    stage?: string;
+    trustClass: WorkloadRoleTrustClass;
+}
+export type WorkloadRoleUpdateField = 'boundaryArn' | 'candidateIdentity' | 'manifestDigest' | 'passDestinations' | 'permissionPolicyDigest' | 'trustClass';
+export type WorkloadRoleConvergenceOperation = {
+    desired: WorkloadRoleDeclaration;
+    kind: 'create';
+} | {
+    before: ObservedWorkloadRole;
+    changes: WorkloadRoleUpdateField[];
+    desired: WorkloadRoleDeclaration;
+    kind: 'update';
+} | {
+    before: ObservedWorkloadRole;
+    declaration: WorkloadRoleDeclaration;
+    kind: 'remove';
+};
+export interface WorkloadRoleConvergencePlan {
+    candidateIdentity: string;
+    manifestDigest: string;
+    operation: WorkloadRoleProvisionerOperation;
+    operations: WorkloadRoleConvergenceOperation[];
+    stage: string;
+    unchangedRoleIds: string[];
+}
+export declare function digestObservedWorkloadRole(role: ObservedWorkloadRole): string;
+export declare function createWorkloadRoleConvergencePlan(options: {
+    manifest: unknown;
+    observedRoles: readonly ObservedWorkloadRole[];
+    registration: WorkloadRoleManifestRegistration;
+    request: WorkloadRoleProvisionerRequest;
+}): WorkloadRoleConvergencePlan;

package/src/workload-roles/convergence.js

@@ -0,0 +1,186 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.WorkloadRoleProvisionerContractError = exports.WORKLOAD_ROLE_PROVISIONER_OPERATIONS = exports.WORKLOAD_ROLE_PROVISIONER_OWNER = void 0;
+exports.digestObservedWorkloadRole = digestObservedWorkloadRole;
+exports.createWorkloadRoleConvergencePlan = createWorkloadRoleConvergencePlan;
+const node_crypto_1 = require("node:crypto");
+const manifest_js_1 = require("./manifest.js");
+exports.WORKLOAD_ROLE_PROVISIONER_OWNER = 'empire-builder-kit/workload-role-provisioner';
+exports.WORKLOAD_ROLE_PROVISIONER_OPERATIONS = [
+    'converge',
+    'remove',
+];
+class WorkloadRoleProvisionerContractError extends Error {
+    classification;
+    constructor(classification, message) {
+        super(message);
+        this.classification = classification;
+        this.name = 'WorkloadRoleProvisionerContractError';
+    }
+}
+exports.WorkloadRoleProvisionerContractError = WorkloadRoleProvisionerContractError;
+function compareStrings(left, right) {
+    return left < right ? -1 : left > right ? 1 : 0;
+}
+function normalizeObservedRole(role) {
+    return {
+        boundaryArn: role.boundaryArn,
+        ...(role.candidateIdentity === undefined
+            ? {}
+            : { candidateIdentity: role.candidateIdentity }),
+        ...(role.managedBy === undefined ? {} : { managedBy: role.managedBy }),
+        ...(role.manifestDigest === undefined
+            ? {}
+            : { manifestDigest: role.manifestDigest }),
+        ...(role.ownership === undefined
+            ? {}
+            : {
+                ownership: {
+                    project: role.ownership.project,
+                    resource: role.ownership.resource,
+                },
+            }),
+        passDestinations: [...role.passDestinations].sort(compareStrings),
+        permissionPolicyDigest: role.permissionPolicyDigest,
+        roleArn: role.roleArn,
+        roleName: role.roleName,
+        ...(role.stage === undefined ? {} : { stage: role.stage }),
+        trustClass: role.trustClass,
+    };
+}
+function digestObservedWorkloadRole(role) {
+    return (0, node_crypto_1.createHash)('sha256')
+        .update(JSON.stringify(normalizeObservedRole(role)), 'utf8')
+        .digest('hex');
+}
+function assertRegisteredRequest(manifest, registration, request) {
+    const manifestDigest = (0, manifest_js_1.digestWorkloadRoleManifest)(manifest);
+    if (registration.candidateIdentity !== manifest.candidate.identity ||
+        registration.stage !== manifest.candidate.stage ||
+        registration.manifestDigest !== manifestDigest) {
+        throw new WorkloadRoleProvisionerContractError('registration-substitution', 'The baseline registration does not match the exact workload-role manifest candidate, stage, and digest.');
+    }
+    if (request.candidateIdentity !== registration.candidateIdentity ||
+        request.stage !== registration.stage ||
+        request.manifestDigest !== registration.manifestDigest) {
+        throw new WorkloadRoleProvisionerContractError('request-substitution', 'The provisioner request does not match the registered candidate, stage, and manifest digest.');
+    }
+    if (!exports.WORKLOAD_ROLE_PROVISIONER_OPERATIONS.includes(request.operation)) {
+        throw new WorkloadRoleProvisionerContractError('request-substitution', `The provisioner request operation ${String(request.operation)} is not supported.`);
+    }
+    return manifestDigest;
+}
+function indexObservedRoles(declarations, observedRoles) {
+    const declarationsByName = new Map(declarations.map((declaration) => [declaration.roleName, declaration]));
+    const observedByName = new Map();
+    for (const role of observedRoles) {
+        const declaration = declarationsByName.get(role.roleName);
+        if (!declaration) {
+            throw new WorkloadRoleProvisionerContractError('observed-role-substitution', `Observed role ${role.roleName} was not derived from the registered manifest.`);
+        }
+        assertObservedRoleArn(declaration, role);
+        if (observedByName.has(role.roleName)) {
+            throw new WorkloadRoleProvisionerContractError('observed-role-ambiguous', `Observed role ${role.roleName} was returned more than once.`);
+        }
+        observedByName.set(role.roleName, normalizeObservedRole(role));
+    }
+    return observedByName;
+}
+const roleArnPattern = /^arn:(aws|aws-us-gov|aws-cn):iam::(\d{12}):role\/([A-Za-z0-9+=,.@_-]{1,64})$/;
+const boundaryArnPattern = /^arn:(aws|aws-us-gov|aws-cn):iam::(\d{12}):policy\/[A-Za-z0-9+=,.@_/-]+$/;
+function assertObservedRoleArn(declaration, observed) {
+    const role = roleArnPattern.exec(observed.roleArn);
+    const boundary = boundaryArnPattern.exec(declaration.boundaryArn);
+    if (!role ||
+        !boundary ||
+        role[1] !== boundary[1] ||
+        role[2] !== boundary[2] ||
+        role[3] !== declaration.roleName) {
+        throw new WorkloadRoleProvisionerContractError('observed-role-substitution', `Observed role ARN ${observed.roleArn} does not match the registered account, partition, and role name for ${declaration.id}.`);
+    }
+}
+function sameOwnership(left, right) {
+    return left?.project === right.project && left.resource === right.resource;
+}
+function assertManagedRoleIdentity(declaration, observed, stage) {
+    if (observed.managedBy !== exports.WORKLOAD_ROLE_PROVISIONER_OWNER ||
+        observed.stage !== stage ||
+        !sameOwnership(observed.ownership, declaration.ownership)) {
+        throw new WorkloadRoleProvisionerContractError('observed-role-substitution', `Role ${observed.roleName} is not owned by this provisioner, stage, and manifest resource.`);
+    }
+}
+function findUpdateFields(declaration, observed, candidateIdentity, manifestDigest) {
+    const changes = [];
+    if (observed.boundaryArn !== declaration.boundaryArn) {
+        changes.push('boundaryArn');
+    }
+    if (observed.candidateIdentity !== candidateIdentity) {
+        changes.push('candidateIdentity');
+    }
+    if (observed.manifestDigest !== manifestDigest) {
+        changes.push('manifestDigest');
+    }
+    if (JSON.stringify(observed.passDestinations) !==
+        JSON.stringify([...declaration.passDestinations].sort(compareStrings))) {
+        changes.push('passDestinations');
+    }
+    if (observed.permissionPolicyDigest !== declaration.permissionPolicyDigest) {
+        changes.push('permissionPolicyDigest');
+    }
+    if (observed.trustClass !== declaration.trustClass) {
+        changes.push('trustClass');
+    }
+    return changes;
+}
+function createWorkloadRoleConvergencePlan(options) {
+    const manifest = (0, manifest_js_1.canonicalizeWorkloadRoleManifest)(options.manifest);
+    const manifestDigest = assertRegisteredRequest(manifest, options.registration, options.request);
+    const observedByName = indexObservedRoles(manifest.roles, options.observedRoles);
+    const operations = [];
+    const unchangedRoleIds = [];
+    for (const declaration of manifest.roles) {
+        const observed = observedByName.get(declaration.roleName);
+        if (options.request.operation === 'remove') {
+            if (!observed) {
+                unchangedRoleIds.push(declaration.id);
+                continue;
+            }
+            assertManagedRoleIdentity(declaration, observed, manifest.candidate.stage);
+            const substitutions = findUpdateFields(declaration, observed, manifest.candidate.identity, manifestDigest);
+            if (substitutions.length > 0) {
+                throw new WorkloadRoleProvisionerContractError('observed-role-substitution', `Role ${observed.roleName} differs from the exact registered removal candidate in ${substitutions.join(', ')}.`);
+            }
+            operations.push({
+                before: observed,
+                declaration,
+                kind: 'remove',
+            });
+            continue;
+        }
+        if (!observed) {
+            operations.push({ desired: declaration, kind: 'create' });
+            continue;
+        }
+        assertManagedRoleIdentity(declaration, observed, manifest.candidate.stage);
+        const changes = findUpdateFields(declaration, observed, manifest.candidate.identity, manifestDigest);
+        if (changes.length === 0) {
+            unchangedRoleIds.push(declaration.id);
+            continue;
+        }
+        operations.push({
+            before: observed,
+            changes,
+            desired: declaration,
+            kind: 'update',
+        });
+    }
+    return {
+        candidateIdentity: manifest.candidate.identity,
+        manifestDigest,
+        operation: options.request.operation,
+        operations,
+        stage: manifest.candidate.stage,
+        unchangedRoleIds,
+    };
+}
+//# sourceMappingURL=convergence.js.map

package/src/workload-roles/convergence.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"convergence.js","sourceRoot":"","sources":["../../../../../packages/nx/src/workload-roles/convergence.ts"],"names":[],"mappings":";;;AAuIA,gEAIC;AAiJD,8EAmFC;AA/WD,6CAAyC;AACzC,+CAOuB;AAEV,QAAA,+BAA+B,GAC1C,8CAAuD,CAAC;AAE7C,QAAA,oCAAoC,GAAG;IAClD,UAAU;IACV,QAAQ;CACA,CAAC;AAWX,MAAa,oCAAqC,SAAQ,KAAK;IAElD;IADX,YACW,cAA4D,EACrE,OAAe;QAEf,KAAK,CAAC,OAAO,CAAC,CAAC;QAHN,mBAAc,GAAd,cAAc,CAA8C;QAIrE,IAAI,CAAC,IAAI,GAAG,sCAAsC,CAAC;IACrD,CAAC;CACF;AARD,oFAQC;AAmED,SAAS,cAAc,CAAC,IAAY,EAAE,KAAa;IACjD,OAAO,IAAI,GAAG,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,IAAI,GAAG,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;AAClD,CAAC;AAED,SAAS,qBAAqB,CAC5B,IAA0B;IAE1B,OAAO;QACL,WAAW,EAAE,IAAI,CAAC,WAAW;QAC7B,GAAG,CAAC,IAAI,CAAC,iBAAiB,KAAK,SAAS;YACtC,CAAC,CAAC,EAAE;YACJ,CAAC,CAAC,EAAE,iBAAiB,EAAE,IAAI,CAAC,iBAAiB,EAAE,CAAC;QAClD,GAAG,CAAC,IAAI,CAAC,SAAS,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,SAAS,EAAE,IAAI,CAAC,SAAS,EAAE,CAAC;QACtE,GAAG,CAAC,IAAI,CAAC,cAAc,KAAK,SAAS;YACnC,CAAC,CAAC,EAAE;YACJ,CAAC,CAAC,EAAE,cAAc,EAAE,IAAI,CAAC,cAAc,EAAE,CAAC;QAC5C,GAAG,CAAC,IAAI,CAAC,SAAS,KAAK,SAAS;YAC9B,CAAC,CAAC,EAAE;YACJ,CAAC,CAAC;gBACE,SAAS,EAAE;oBACT,OAAO,EAAE,IAAI,CAAC,SAAS,CAAC,OAAO;oBAC/B,QAAQ,EAAE,IAAI,CAAC,SAAS,CAAC,QAAQ;iBAClC;aACF,CAAC;QACN,gBAAgB,EAAE,CAAC,GAAG,IAAI,CAAC,gBAAgB,CAAC,CAAC,IAAI,CAAC,cAAc,CAAC;QACjE,sBAAsB,EAAE,IAAI,CAAC,sBAAsB;QACnD,OAAO,EAAE,IAAI,CAAC,OAAO;QACrB,QAAQ,EAAE,IAAI,CAAC,QAAQ;QACvB,GAAG,CAAC,IAAI,CAAC,KAAK,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,KAAK,EAAE,IAAI,CAAC,KAAK,EAAE,CAAC;QAC1D,UAAU,EAAE,IAAI,CAAC,UAAU;KAC5B,CAAC;AACJ,CAAC;AAED,SAAgB,0BAA0B,CAAC,IAA0B;IACnE,OAAO,IAAA,wBAAU,EAAC,QAAQ,CAAC;SACxB,MAAM,CAAC,IAAI,CAAC,SAAS,CAAC,qBAAqB,CAAC,IAAI,CAAC,CAAC,EAAE,MAAM,CAAC;SAC3D,MAAM,CAAC,KAAK,CAAC,CAAC;AACnB,CAAC;AAED,SAAS,uBAAuB,CAC9B,QAA8B,EAC9B,YAA8C,EAC9C,OAAuC;IAEvC,MAAM,cAAc,GAAG,IAAA,wCAA0B,EAAC,QAAQ,CAAC,CAAC;IAC5D,IACE,YAAY,CAAC,iBAAiB,KAAK,QAAQ,CAAC,SAAS,CAAC,QAAQ;QAC9D,YAAY,CAAC,KAAK,KAAK,QAAQ,CAAC,SAAS,CAAC,KAAK;QAC/C,YAAY,CAAC,cAAc,KAAK,cAAc,EAC9C,CAAC;QACD,MAAM,IAAI,oCAAoC,CAC5C,2BAA2B,EAC3B,yGAAyG,CAC1G,CAAC;IACJ,CAAC;IACD,IACE,OAAO,CAAC,iBAAiB,KAAK,YAAY,CAAC,iBAAiB;QAC5D,OAAO,CAAC,KAAK,KAAK,YAAY,CAAC,KAAK;QACpC,OAAO,CAAC,cAAc,KAAK,YAAY,CAAC,cAAc,EACtD,CAAC;QACD,MAAM,IAAI,oCAAoC,CAC5C,sBAAsB,EACtB,8FAA8F,CAC/F,CAAC;IACJ,CAAC;IACD,IAAI,CAAC,4CAAoC,CAAC,QAAQ,CAAC,OAAO,CAAC,SAAS,CAAC,EAAE,CAAC;QACtE,MAAM,IAAI,oCAAoC,CAC5C,sBAAsB,EACtB,qCAAqC,MAAM,CAAC,OAAO,CAAC,SAAS,CAAC,oBAAoB,CACnF,CAAC;IACJ,CAAC;IACD,OAAO,cAAc,CAAC;AACxB,CAAC;AAED,SAAS,kBAAkB,CACzB,YAAgD,EAChD,aAA8C;IAE9C,MAAM,kBAAkB,GAAG,IAAI,GAAG,CAChC,YAAY,CAAC,GAAG,CAAC,CAAC,WAAW,EAAE,EAAE,CAAC,CAAC,WAAW,CAAC,QAAQ,EAAE,WAAW,CAAC,CAAC,CACvE,CAAC;IACF,MAAM,cAAc,GAAG,IAAI,GAAG,EAAgC,CAAC;IAC/D,KAAK,MAAM,IAAI,IAAI,aAAa,EAAE,CAAC;QACjC,MAAM,WAAW,GAAG,kBAAkB,CAAC,GAAG,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC;QAC1D,IAAI,CAAC,WAAW,EAAE,CAAC;YACjB,MAAM,IAAI,oCAAoC,CAC5C,4BAA4B,EAC5B,iBAAiB,IAAI,CAAC,QAAQ,gDAAgD,CAC/E,CAAC;QACJ,CAAC;QACD,qBAAqB,CAAC,WAAW,EAAE,IAAI,CAAC,CAAC;QACzC,IAAI,cAAc,CAAC,GAAG,CAAC,IAAI,CAAC,QAAQ,CAAC,EAAE,CAAC;YACtC,MAAM,IAAI,oCAAoC,CAC5C,yBAAyB,EACzB,iBAAiB,IAAI,CAAC,QAAQ,+BAA+B,CAC9D,CAAC;QACJ,CAAC;QACD,cAAc,CAAC,GAAG,CAAC,IAAI,CAAC,QAAQ,EAAE,qBAAqB,CAAC,IAAI,CAAC,CAAC,CAAC;IACjE,CAAC;IACD,OAAO,cAAc,CAAC;AACxB,CAAC;AAED,MAAM,cAAc,GAClB,8EAA8E,CAAC;AACjF,MAAM,kBAAkB,GACtB,0EAA0E,CAAC;AAE7E,SAAS,qBAAqB,CAC5B,WAAoC,EACpC,QAA8B;IAE9B,MAAM,IAAI,GAAG,cAAc,CAAC,IAAI,CAAC,QAAQ,CAAC,OAAO,CAAC,CAAC;IACnD,MAAM,QAAQ,GAAG,kBAAkB,CAAC,IAAI,CAAC,WAAW,CAAC,WAAW,CAAC,CAAC;IAClE,IACE,CAAC,IAAI;QACL,CAAC,QAAQ;QACT,IAAI,CAAC,CAAC,CAAC,KAAK,QAAQ,CAAC,CAAC,CAAC;QACvB,IAAI,CAAC,CAAC,CAAC,KAAK,QAAQ,CAAC,CAAC,CAAC;QACvB,IAAI,CAAC,CAAC,CAAC,KAAK,WAAW,CAAC,QAAQ,EAChC,CAAC;QACD,MAAM,IAAI,oCAAoC,CAC5C,4BAA4B,EAC5B,qBAAqB,QAAQ,CAAC,OAAO,wEAAwE,WAAW,CAAC,EAAE,GAAG,CAC/H,CAAC;IACJ,CAAC;AACH,CAAC;AAED,SAAS,aAAa,CACpB,IAAuC,EACvC,KAA4B;IAE5B,OAAO,IAAI,EAAE,OAAO,KAAK,KAAK,CAAC,OAAO,IAAI,IAAI,CAAC,QAAQ,KAAK,KAAK,CAAC,QAAQ,CAAC;AAC7E,CAAC;AAED,SAAS,yBAAyB,CAChC,WAAoC,EACpC,QAA8B,EAC9B,KAAa;IAEb,IACE,QAAQ,CAAC,SAAS,KAAK,uCAA+B;QACtD,QAAQ,CAAC,KAAK,KAAK,KAAK;QACxB,CAAC,aAAa,CAAC,QAAQ,CAAC,SAAS,EAAE,WAAW,CAAC,SAAS,CAAC,EACzD,CAAC;QACD,MAAM,IAAI,oCAAoC,CAC5C,4BAA4B,EAC5B,QAAQ,QAAQ,CAAC,QAAQ,kEAAkE,CAC5F,CAAC;IACJ,CAAC;AACH,CAAC;AAED,SAAS,gBAAgB,CACvB,WAAoC,EACpC,QAA8B,EAC9B,iBAAyB,EACzB,cAAsB;IAEtB,MAAM,OAAO,GAA8B,EAAE,CAAC;IAC9C,IAAI,QAAQ,CAAC,WAAW,KAAK,WAAW,CAAC,WAAW,EAAE,CAAC;QACrD,OAAO,CAAC,IAAI,CAAC,aAAa,CAAC,CAAC;IAC9B,CAAC;IACD,IAAI,QAAQ,CAAC,iBAAiB,KAAK,iBAAiB,EAAE,CAAC;QACrD,OAAO,CAAC,IAAI,CAAC,mBAAmB,CAAC,CAAC;IACpC,CAAC;IACD,IAAI,QAAQ,CAAC,cAAc,KAAK,cAAc,EAAE,CAAC;QAC/C,OAAO,CAAC,IAAI,CAAC,gBAAgB,CAAC,CAAC;IACjC,CAAC;IACD,IACE,IAAI,CAAC,SAAS,CAAC,QAAQ,CAAC,gBAAgB,CAAC;QACzC,IAAI,CAAC,SAAS,CAAC,CAAC,GAAG,WAAW,CAAC,gBAAgB,CAAC,CAAC,IAAI,CAAC,cAAc,CAAC,CAAC,EACtE,CAAC;QACD,OAAO,CAAC,IAAI,CAAC,kBAAkB,CAAC,CAAC;IACnC,CAAC;IACD,IAAI,QAAQ,CAAC,sBAAsB,KAAK,WAAW,CAAC,sBAAsB,EAAE,CAAC;QAC3E,OAAO,CAAC,IAAI,CAAC,wBAAwB,CAAC,CAAC;IACzC,CAAC;IACD,IAAI,QAAQ,CAAC,UAAU,KAAK,WAAW,CAAC,UAAU,EAAE,CAAC;QACnD,OAAO,CAAC,IAAI,CAAC,YAAY,CAAC,CAAC;IAC7B,CAAC;IACD,OAAO,OAAO,CAAC;AACjB,CAAC;AAED,SAAgB,iCAAiC,CAAC,OAKjD;IACC,MAAM,QAAQ,GAAG,IAAA,8CAAgC,EAAC,OAAO,CAAC,QAAQ,CAAC,CAAC;IACpE,MAAM,cAAc,GAAG,uBAAuB,CAC5C,QAAQ,EACR,OAAO,CAAC,YAAY,EACpB,OAAO,CAAC,OAAO,CAChB,CAAC;IACF,MAAM,cAAc,GAAG,kBAAkB,CACvC,QAAQ,CAAC,KAAK,EACd,OAAO,CAAC,aAAa,CACtB,CAAC;IACF,MAAM,UAAU,GAAuC,EAAE,CAAC;IAC1D,MAAM,gBAAgB,GAAa,EAAE,CAAC;IAEtC,KAAK,MAAM,WAAW,IAAI,QAAQ,CAAC,KAAK,EAAE,CAAC;QACzC,MAAM,QAAQ,GAAG,cAAc,CAAC,GAAG,CAAC,WAAW,CAAC,QAAQ,CAAC,CAAC;QAC1D,IAAI,OAAO,CAAC,OAAO,CAAC,SAAS,KAAK,QAAQ,EAAE,CAAC;YAC3C,IAAI,CAAC,QAAQ,EAAE,CAAC;gBACd,gBAAgB,CAAC,IAAI,CAAC,WAAW,CAAC,EAAE,CAAC,CAAC;gBACtC,SAAS;YACX,CAAC;YACD,yBAAyB,CACvB,WAAW,EACX,QAAQ,EACR,QAAQ,CAAC,SAAS,CAAC,KAAK,CACzB,CAAC;YACF,MAAM,aAAa,GAAG,gBAAgB,CACpC,WAAW,EACX,QAAQ,EACR,QAAQ,CAAC,SAAS,CAAC,QAAQ,EAC3B,cAAc,CACf,CAAC;YACF,IAAI,aAAa,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;gBAC7B,MAAM,IAAI,oCAAoC,CAC5C,4BAA4B,EAC5B,QAAQ,QAAQ,CAAC,QAAQ,2DAA2D,aAAa,CAAC,IAAI,CAAC,IAAI,CAAC,GAAG,CAChH,CAAC;YACJ,CAAC;YACD,UAAU,CAAC,IAAI,CAAC;gBACd,MAAM,EAAE,QAAQ;gBAChB,WAAW;gBACX,IAAI,EAAE,QAAQ;aACf,CAAC,CAAC;YACH,SAAS;QACX,CAAC;QAED,IAAI,CAAC,QAAQ,EAAE,CAAC;YACd,UAAU,CAAC,IAAI,CAAC,EAAE,OAAO,EAAE,WAAW,EAAE,IAAI,EAAE,QAAQ,EAAE,CAAC,CAAC;YAC1D,SAAS;QACX,CAAC;QAED,yBAAyB,CAAC,WAAW,EAAE,QAAQ,EAAE,QAAQ,CAAC,SAAS,CAAC,KAAK,CAAC,CAAC;QAC3E,MAAM,OAAO,GAAG,gBAAgB,CAC9B,WAAW,EACX,QAAQ,EACR,QAAQ,CAAC,SAAS,CAAC,QAAQ,EAC3B,cAAc,CACf,CAAC;QACF,IAAI,OAAO,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;YACzB,gBAAgB,CAAC,IAAI,CAAC,WAAW,CAAC,EAAE,CAAC,CAAC;YACtC,SAAS;QACX,CAAC;QACD,UAAU,CAAC,IAAI,CAAC;YACd,MAAM,EAAE,QAAQ;YAChB,OAAO;YACP,OAAO,EAAE,WAAW;YACpB,IAAI,EAAE,QAAQ;SACf,CAAC,CAAC;IACL,CAAC;IAED,OAAO;QACL,iBAAiB,EAAE,QAAQ,CAAC,SAAS,CAAC,QAAQ;QAC9C,cAAc;QACd,SAAS,EAAE,OAAO,CAAC,OAAO,CAAC,SAAS;QACpC,UAAU;QACV,KAAK,EAAE,QAAQ,CAAC,SAAS,CAAC,KAAK;QAC/B,gBAAgB;KACjB,CAAC;AACJ,CAAC"}

package/src/workload-roles/effective-policy.d.ts

@@ -0,0 +1,51 @@
+import { type WorkloadRoleDeclaration } from './manifest.js';
+export declare const IAM_POLICY_VERSION: "2012-10-17";
+export declare const WORKLOAD_ROLE_PERMISSION_INTENT_KINDS: readonly ["framework", "link", "permissions", "secret-link"];
+export type WorkloadRolePermissionIntentKind = (typeof WORKLOAD_ROLE_PERMISSION_INTENT_KINDS)[number];
+export interface WorkloadRolePermissionIntentSource {
+    kind: WorkloadRolePermissionIntentKind;
+    name: string;
+}
+export interface WorkloadRolePermissionIntent {
+    actions: string[];
+    conditions?: Record<string, Record<string, string | string[]>>;
+    id: string;
+    resources: string[];
+    source: WorkloadRolePermissionIntentSource;
+    wildcardResourceJustification?: string;
+}
+export interface CanonicalIamPolicyStatement {
+    Action: string[];
+    Condition?: Record<string, Record<string, string | string[]>>;
+    Effect: 'Allow' | 'Deny';
+    Resource: string[];
+    Sid: string;
+}
+export interface CanonicalIamPolicyDocument {
+    Statement: CanonicalIamPolicyStatement[];
+    Version: typeof IAM_POLICY_VERSION;
+}
+export interface WorkloadRoleEffectivePolicy {
+    digest: string;
+    document: CanonicalIamPolicyDocument;
+    intentIds: string[];
+    roleId: string;
+    sources: WorkloadRolePermissionIntentSource[];
+}
+export interface WorkloadRoleEffectivePolicyBundle {
+    candidateIdentity: string;
+    manifestDigest: string;
+    policies: WorkloadRoleEffectivePolicy[];
+    stage: string;
+}
+export type EffectivePolicyFailureClassification = 'effective-policy-incomplete' | 'effective-policy-invalid' | 'effective-policy-substitution';
+export declare class EffectivePolicyContractError extends Error {
+    readonly classification: EffectivePolicyFailureClassification;
+    constructor(classification: EffectivePolicyFailureClassification, message: string);
+}
+export declare function createWorkloadRoleEffectivePolicy(declaration: WorkloadRoleDeclaration, intents: readonly WorkloadRolePermissionIntent[]): WorkloadRoleEffectivePolicy;
+export declare function createWorkloadRoleEffectivePolicyBundle(options: {
+    intentsByRole: Readonly<Record<string, readonly WorkloadRolePermissionIntent[]>>;
+    manifest: unknown;
+}): WorkloadRoleEffectivePolicyBundle;
+export declare function requireEffectivePolicy(bundle: WorkloadRoleEffectivePolicyBundle, roleId: string): WorkloadRoleEffectivePolicy;

package/src/workload-roles/effective-policy.js

@@ -0,0 +1,183 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.EffectivePolicyContractError = exports.WORKLOAD_ROLE_PERMISSION_INTENT_KINDS = exports.IAM_POLICY_VERSION = void 0;
+exports.createWorkloadRoleEffectivePolicy = createWorkloadRoleEffectivePolicy;
+exports.createWorkloadRoleEffectivePolicyBundle = createWorkloadRoleEffectivePolicyBundle;
+exports.requireEffectivePolicy = requireEffectivePolicy;
+const node_crypto_1 = require("node:crypto");
+const manifest_js_1 = require("./manifest.js");
+exports.IAM_POLICY_VERSION = '2012-10-17';
+exports.WORKLOAD_ROLE_PERMISSION_INTENT_KINDS = [
+    'framework',
+    'link',
+    'permissions',
+    'secret-link',
+];
+class EffectivePolicyContractError extends Error {
+    classification;
+    constructor(classification, message) {
+        super(message);
+        this.classification = classification;
+        this.name = 'EffectivePolicyContractError';
+    }
+}
+exports.EffectivePolicyContractError = EffectivePolicyContractError;
+const actionPattern = /^[a-z0-9-]+:[A-Za-z0-9]+$/;
+const intentIdPattern = /^[a-z0-9][a-z0-9._-]{0,127}$/;
+const sourceNamePattern = /^[A-Za-z0-9][A-Za-z0-9._/@:-]{0,255}$/;
+const iamArnPattern = /^arn:(aws|aws-us-gov|aws-cn):[a-z0-9-]+:[a-z0-9-]*:\d{0,12}:[^\s]+$/;
+function compareStrings(left, right) {
+    return left < right ? -1 : left > right ? 1 : 0;
+}
+function canonicalStrings(values) {
+    return [...new Set(values)].sort(compareStrings);
+}
+function canonicalConditions(value) {
+    if (!value) {
+        return undefined;
+    }
+    const result = {};
+    for (const operator of Object.keys(value).sort(compareStrings)) {
+        const entries = value[operator];
+        if (!entries || Object.keys(entries).length === 0) {
+            throw new EffectivePolicyContractError('effective-policy-invalid', `Condition operator ${operator} must contain at least one key.`);
+        }
+        result[operator] = {};
+        for (const key of Object.keys(entries).sort(compareStrings)) {
+            const conditionValue = entries[key];
+            if (typeof conditionValue !== 'string' &&
+                (!Array.isArray(conditionValue) ||
+                    conditionValue.length === 0 ||
+                    conditionValue.some((entry) => typeof entry !== 'string'))) {
+                throw new EffectivePolicyContractError('effective-policy-invalid', `Condition ${operator}.${key} must be a string or non-empty string array.`);
+            }
+            result[operator][key] = Array.isArray(conditionValue)
+                ? canonicalStrings(conditionValue)
+                : conditionValue;
+        }
+    }
+    return result;
+}
+function requireIntent(declaration, intent) {
+    if (!intentIdPattern.test(intent.id)) {
+        throw new EffectivePolicyContractError('effective-policy-invalid', `Permission intent ${intent.id} for ${declaration.id} has an invalid stable identifier.`);
+    }
+    if (!exports.WORKLOAD_ROLE_PERMISSION_INTENT_KINDS.includes(intent.source.kind) ||
+        !sourceNamePattern.test(intent.source.name)) {
+        throw new EffectivePolicyContractError('effective-policy-invalid', `Permission intent ${intent.id} for ${declaration.id} has invalid provenance.`);
+    }
+    if (intent.actions.length === 0 ||
+        intent.actions.some((action) => !actionPattern.test(action))) {
+        throw new EffectivePolicyContractError('effective-policy-invalid', `Permission intent ${intent.id} for ${declaration.id} must use exact non-wildcard IAM actions.`);
+    }
+    const forbiddenIamActions = intent.actions.filter((action) => action.startsWith('iam:') && action !== 'iam:PassRole');
+    if (forbiddenIamActions.length > 0) {
+        throw new EffectivePolicyContractError('effective-policy-invalid', `Permission intent ${intent.id} for ${declaration.id} contains forbidden IAM mutation actions: ${forbiddenIamActions.join(', ')}.`);
+    }
+    if (intent.resources.length === 0 ||
+        intent.resources.some((resource) => resource !== '*' && !iamArnPattern.test(resource))) {
+        throw new EffectivePolicyContractError('effective-policy-invalid', `Permission intent ${intent.id} for ${declaration.id} must use exact ARNs or an explicitly justified wildcard resource.`);
+    }
+    if (intent.resources.includes('*') &&
+        (!intent.wildcardResourceJustification ||
+            intent.wildcardResourceJustification.trim().length < 20)) {
+        throw new EffectivePolicyContractError('effective-policy-invalid', `Permission intent ${intent.id} for ${declaration.id} must justify wildcard resource scope.`);
+    }
+    const conditions = canonicalConditions(intent.conditions);
+    if (intent.actions.includes('iam:PassRole')) {
+        const destinations = conditions?.StringEquals?.['iam:PassedToService'];
+        const normalizedDestinations = typeof destinations === 'string' ? [destinations] : destinations;
+        if (!normalizedDestinations ||
+            normalizedDestinations.some((destination) => !/^[a-z0-9](?:[a-z0-9-]*\.)+[a-z0-9-]+$/.test(destination))) {
+            throw new EffectivePolicyContractError('effective-policy-invalid', `Permission intent ${intent.id} for ${declaration.id} must constrain iam:PassRole to explicit service principals.`);
+        }
+    }
+    return {
+        actions: canonicalStrings(intent.actions),
+        ...(conditions ? { conditions } : {}),
+        id: intent.id,
+        resources: canonicalStrings(intent.resources),
+        source: { ...intent.source },
+        ...(intent.wildcardResourceJustification
+            ? {
+                wildcardResourceJustification: intent.wildcardResourceJustification.trim(),
+            }
+            : {}),
+    };
+}
+function statementSid(intentId) {
+    return `Intent${(0, node_crypto_1.createHash)('sha256')
+        .update(intentId, 'utf8')
+        .digest('hex')
+        .slice(0, 20)}`;
+}
+function createWorkloadRoleEffectivePolicy(declaration, intents) {
+    const normalized = intents
+        .map((intent) => requireIntent(declaration, intent))
+        .sort((left, right) => compareStrings(left.id, right.id));
+    if (new Set(normalized.map(({ id }) => id)).size !== normalized.length) {
+        throw new EffectivePolicyContractError('effective-policy-invalid', `Workload role ${declaration.id} has duplicate permission-intent identities.`);
+    }
+    const document = {
+        Statement: normalized
+            .map((intent) => ({
+            Action: intent.actions,
+            ...(intent.conditions ? { Condition: intent.conditions } : {}),
+            Effect: 'Allow',
+            Resource: intent.resources,
+            Sid: statementSid(intent.id),
+        }))
+            .sort((left, right) => compareStrings(left.Sid, right.Sid)),
+        Version: exports.IAM_POLICY_VERSION,
+    };
+    const digest = (0, node_crypto_1.createHash)('sha256')
+        .update(JSON.stringify(document), 'utf8')
+        .digest('hex');
+    return {
+        digest,
+        document,
+        intentIds: normalized.map(({ id }) => id),
+        roleId: declaration.id,
+        sources: normalized.map(({ source }) => ({ ...source })),
+    };
+}
+function createWorkloadRoleEffectivePolicyBundle(options) {
+    const manifest = (0, manifest_js_1.canonicalizeWorkloadRoleManifest)(options.manifest);
+    const declarationIds = new Set(manifest.roles.map(({ id }) => id));
+    const unexpected = Object.keys(options.intentsByRole).filter((roleId) => !declarationIds.has(roleId));
+    if (unexpected.length > 0) {
+        throw new EffectivePolicyContractError('effective-policy-substitution', `Effective policies contain undeclared role identities: ${unexpected.sort(compareStrings).join(', ')}.`);
+    }
+    const missing = manifest.roles
+        .map(({ id }) => id)
+        .filter((roleId) => !Object.prototype.hasOwnProperty.call(options.intentsByRole, roleId));
+    if (missing.length > 0) {
+        throw new EffectivePolicyContractError('effective-policy-incomplete', `Effective policies are missing declared role identities: ${missing.sort(compareStrings).join(', ')}.`);
+    }
+    const policies = manifest.roles.map((declaration) => {
+        const policy = createWorkloadRoleEffectivePolicy(declaration, options.intentsByRole[declaration.id] ?? []);
+        if (policy.digest !== declaration.permissionPolicyDigest) {
+            throw new EffectivePolicyContractError('effective-policy-substitution', `Effective policy digest for ${declaration.id} does not match the registered manifest.`);
+        }
+        return policy;
+    });
+    const manifestDigest = (0, node_crypto_1.createHash)('sha256')
+        .update(JSON.stringify(manifest), 'utf8')
+        .digest('hex');
+    return {
+        candidateIdentity: manifest.candidate.identity,
+        manifestDigest,
+        policies,
+        stage: manifest.candidate.stage,
+    };
+}
+function requireEffectivePolicy(bundle, roleId) {
+    const matches = bundle.policies.filter((policy) => policy.roleId === roleId);
+    if (matches.length !== 1) {
+        throw new EffectivePolicyContractError(matches.length === 0
+            ? 'effective-policy-incomplete'
+            : 'effective-policy-substitution', `Effective policy bundle must contain exactly one policy for ${roleId}.`);
+    }
+    return matches[0];
+}
+//# sourceMappingURL=effective-policy.js.map

package/src/workload-roles/effective-policy.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"effective-policy.js","sourceRoot":"","sources":["../../../../../packages/nx/src/workload-roles/effective-policy.ts"],"names":[],"mappings":";;;AAgOA,8EAmCC;AAED,0FAmDC;AAED,wDAcC;AAxUD,6CAAyC;AACzC,+CAGuB;AAEV,QAAA,kBAAkB,GAAG,YAAqB,CAAC;AAE3C,QAAA,qCAAqC,GAAG;IACnD,WAAW;IACX,MAAM;IACN,aAAa;IACb,aAAa;CACL,CAAC;AAoDX,MAAa,4BAA6B,SAAQ,KAAK;IAE1C;IADX,YACW,cAAoD,EAC7D,OAAe;QAEf,KAAK,CAAC,OAAO,CAAC,CAAC;QAHN,mBAAc,GAAd,cAAc,CAAsC;QAI7D,IAAI,CAAC,IAAI,GAAG,8BAA8B,CAAC;IAC7C,CAAC;CACF;AARD,oEAQC;AAED,MAAM,aAAa,GAAG,2BAA2B,CAAC;AAClD,MAAM,eAAe,GAAG,8BAA8B,CAAC;AACvD,MAAM,iBAAiB,GAAG,uCAAuC,CAAC;AAClE,MAAM,aAAa,GACjB,qEAAqE,CAAC;AAExE,SAAS,cAAc,CAAC,IAAY,EAAE,KAAa;IACjD,OAAO,IAAI,GAAG,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,IAAI,GAAG,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;AAClD,CAAC;AAED,SAAS,gBAAgB,CAAC,MAAyB;IACjD,OAAO,CAAC,GAAG,IAAI,GAAG,CAAC,MAAM,CAAC,CAAC,CAAC,IAAI,CAAC,cAAc,CAAC,CAAC;AACnD,CAAC;AAED,SAAS,mBAAmB,CAC1B,KAAoE;IAEpE,IAAI,CAAC,KAAK,EAAE,CAAC;QACX,OAAO,SAAS,CAAC;IACnB,CAAC;IACD,MAAM,MAAM,GAAsD,EAAE,CAAC;IACrE,KAAK,MAAM,QAAQ,IAAI,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,IAAI,CAAC,cAAc,CAAC,EAAE,CAAC;QAC/D,MAAM,OAAO,GAAG,KAAK,CAAC,QAAQ,CAAC,CAAC;QAChC,IAAI,CAAC,OAAO,IAAI,MAAM,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;YAClD,MAAM,IAAI,4BAA4B,CACpC,0BAA0B,EAC1B,sBAAsB,QAAQ,iCAAiC,CAChE,CAAC;QACJ,CAAC;QACD,MAAM,CAAC,QAAQ,CAAC,GAAG,EAAE,CAAC;QACtB,KAAK,MAAM,GAAG,IAAI,MAAM,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC,IAAI,CAAC,cAAc,CAAC,EAAE,CAAC;YAC5D,MAAM,cAAc,GAAG,OAAO,CAAC,GAAG,CAAC,CAAC;YACpC,IACE,OAAO,cAAc,KAAK,QAAQ;gBAClC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,cAAc,CAAC;oBAC7B,cAAc,CAAC,MAAM,KAAK,CAAC;oBAC3B,cAAc,CAAC,IAAI,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,OAAO,KAAK,KAAK,QAAQ,CAAC,CAAC,EAC5D,CAAC;gBACD,MAAM,IAAI,4BAA4B,CACpC,0BAA0B,EAC1B,aAAa,QAAQ,IAAI,GAAG,8CAA8C,CAC3E,CAAC;YACJ,CAAC;YACD,MAAM,CAAC,QAAQ,CAAC,CAAC,GAAG,CAAC,GAAG,KAAK,CAAC,OAAO,CAAC,cAAc,CAAC;gBACnD,CAAC,CAAC,gBAAgB,CAAC,cAAc,CAAC;gBAClC,CAAC,CAAC,cAAc,CAAC;QACrB,CAAC;IACH,CAAC;IACD,OAAO,MAAM,CAAC;AAChB,CAAC;AAED,SAAS,aAAa,CACpB,WAAoC,EACpC,MAAoC;IAEpC,IAAI,CAAC,eAAe,CAAC,IAAI,CAAC,MAAM,CAAC,EAAE,CAAC,EAAE,CAAC;QACrC,MAAM,IAAI,4BAA4B,CACpC,0BAA0B,EAC1B,qBAAqB,MAAM,CAAC,EAAE,QAAQ,WAAW,CAAC,EAAE,oCAAoC,CACzF,CAAC;IACJ,CAAC;IACD,IACE,CAAC,6CAAqC,CAAC,QAAQ,CAAC,MAAM,CAAC,MAAM,CAAC,IAAI,CAAC;QACnE,CAAC,iBAAiB,CAAC,IAAI,CAAC,MAAM,CAAC,MAAM,CAAC,IAAI,CAAC,EAC3C,CAAC;QACD,MAAM,IAAI,4BAA4B,CACpC,0BAA0B,EAC1B,qBAAqB,MAAM,CAAC,EAAE,QAAQ,WAAW,CAAC,EAAE,0BAA0B,CAC/E,CAAC;IACJ,CAAC;IACD,IACE,MAAM,CAAC,OAAO,CAAC,MAAM,KAAK,CAAC;QAC3B,MAAM,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC,CAAC,aAAa,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC,EAC5D,CAAC;QACD,MAAM,IAAI,4BAA4B,CACpC,0BAA0B,EAC1B,qBAAqB,MAAM,CAAC,EAAE,QAAQ,WAAW,CAAC,EAAE,2CAA2C,CAChG,CAAC;IACJ,CAAC;IACD,MAAM,mBAAmB,GAAG,MAAM,CAAC,OAAO,CAAC,MAAM,CAC/C,CAAC,MAAM,EAAE,EAAE,CAAC,MAAM,CAAC,UAAU,CAAC,MAAM,CAAC,IAAI,MAAM,KAAK,cAAc,CACnE,CAAC;IACF,IAAI,mBAAmB,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;QACnC,MAAM,IAAI,4BAA4B,CACpC,0BAA0B,EAC1B,qBAAqB,MAAM,CAAC,EAAE,QAAQ,WAAW,CAAC,EAAE,6CAA6C,mBAAmB,CAAC,IAAI,CAAC,IAAI,CAAC,GAAG,CACnI,CAAC;IACJ,CAAC;IACD,IACE,MAAM,CAAC,SAAS,CAAC,MAAM,KAAK,CAAC;QAC7B,MAAM,CAAC,SAAS,CAAC,IAAI,CACnB,CAAC,QAAQ,EAAE,EAAE,CAAC,QAAQ,KAAK,GAAG,IAAI,CAAC,aAAa,CAAC,IAAI,CAAC,QAAQ,CAAC,CAChE,EACD,CAAC;QACD,MAAM,IAAI,4BAA4B,CACpC,0BAA0B,EAC1B,qBAAqB,MAAM,CAAC,EAAE,QAAQ,WAAW,CAAC,EAAE,oEAAoE,CACzH,CAAC;IACJ,CAAC;IACD,IACE,MAAM,CAAC,SAAS,CAAC,QAAQ,CAAC,GAAG,CAAC;QAC9B,CAAC,CAAC,MAAM,CAAC,6BAA6B;YACpC,MAAM,CAAC,6BAA6B,CAAC,IAAI,EAAE,CAAC,MAAM,GAAG,EAAE,CAAC,EAC1D,CAAC;QACD,MAAM,IAAI,4BAA4B,CACpC,0BAA0B,EAC1B,qBAAqB,MAAM,CAAC,EAAE,QAAQ,WAAW,CAAC,EAAE,wCAAwC,CAC7F,CAAC;IACJ,CAAC;IACD,MAAM,UAAU,GAAG,mBAAmB,CAAC,MAAM,CAAC,UAAU,CAAC,CAAC;IAC1D,IAAI,MAAM,CAAC,OAAO,CAAC,QAAQ,CAAC,cAAc,CAAC,EAAE,CAAC;QAC5C,MAAM,YAAY,GAAG,UAAU,EAAE,YAAY,EAAE,CAAC,qBAAqB,CAAC,CAAC;QACvE,MAAM,sBAAsB,GAC1B,OAAO,YAAY,KAAK,QAAQ,CAAC,CAAC,CAAC,CAAC,YAAY,CAAC,CAAC,CAAC,CAAC,YAAY,CAAC;QACnE,IACE,CAAC,sBAAsB;YACvB,sBAAsB,CAAC,IAAI,CACzB,CAAC,WAAW,EAAE,EAAE,CACd,CAAC,uCAAuC,CAAC,IAAI,CAAC,WAAW,CAAC,CAC7D,EACD,CAAC;YACD,MAAM,IAAI,4BAA4B,CACpC,0BAA0B,EAC1B,qBAAqB,MAAM,CAAC,EAAE,QAAQ,WAAW,CAAC,EAAE,8DAA8D,CACnH,CAAC;QACJ,CAAC;IACH,CAAC;IACD,OAAO;QACL,OAAO,EAAE,gBAAgB,CAAC,MAAM,CAAC,OAAO,CAAC;QACzC,GAAG,CAAC,UAAU,CAAC,CAAC,CAAC,EAAE,UAAU,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QACrC,EAAE,EAAE,MAAM,CAAC,EAAE;QACb,SAAS,EAAE,gBAAgB,CAAC,MAAM,CAAC,SAAS,CAAC;QAC7C,MAAM,EAAE,EAAE,GAAG,MAAM,CAAC,MAAM,EAAE;QAC5B,GAAG,CAAC,MAAM,CAAC,6BAA6B;YACtC,CAAC,CAAC;gBACE,6BAA6B,EAC3B,MAAM,CAAC,6BAA6B,CAAC,IAAI,EAAE;aAC9C;YACH,CAAC,CAAC,EAAE,CAAC;KACR,CAAC;AACJ,CAAC;AAED,SAAS,YAAY,CAAC,QAAgB;IACpC,OAAO,SAAS,IAAA,wBAAU,EAAC,QAAQ,CAAC;SACjC,MAAM,CAAC,QAAQ,EAAE,MAAM,CAAC;SACxB,MAAM,CAAC,KAAK,CAAC;SACb,KAAK,CAAC,CAAC,EAAE,EAAE,CAAC,EAAE,CAAC;AACpB,CAAC;AAED,SAAgB,iCAAiC,CAC/C,WAAoC,EACpC,OAAgD;IAEhD,MAAM,UAAU,GAAG,OAAO;SACvB,GAAG,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC,aAAa,CAAC,WAAW,EAAE,MAAM,CAAC,CAAC;SACnD,IAAI,CAAC,CAAC,IAAI,EAAE,KAAK,EAAE,EAAE,CAAC,cAAc,CAAC,IAAI,CAAC,EAAE,EAAE,KAAK,CAAC,EAAE,CAAC,CAAC,CAAC;IAC5D,IAAI,IAAI,GAAG,CAAC,UAAU,CAAC,GAAG,CAAC,CAAC,EAAE,EAAE,EAAE,EAAE,EAAE,CAAC,EAAE,CAAC,CAAC,CAAC,IAAI,KAAK,UAAU,CAAC,MAAM,EAAE,CAAC;QACvE,MAAM,IAAI,4BAA4B,CACpC,0BAA0B,EAC1B,iBAAiB,WAAW,CAAC,EAAE,8CAA8C,CAC9E,CAAC;IACJ,CAAC;IACD,MAAM,QAAQ,GAA+B;QAC3C,SAAS,EAAE,UAAU;aAClB,GAAG,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC,CAAC;YAChB,MAAM,EAAE,MAAM,CAAC,OAAO;YACtB,GAAG,CAAC,MAAM,CAAC,UAAU,CAAC,CAAC,CAAC,EAAE,SAAS,EAAE,MAAM,CAAC,UAAU,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;YAC9D,MAAM,EAAE,OAAgB;YACxB,QAAQ,EAAE,MAAM,CAAC,SAAS;YAC1B,GAAG,EAAE,YAAY,CAAC,MAAM,CAAC,EAAE,CAAC;SAC7B,CAAC,CAAC;aACF,IAAI,CAAC,CAAC,IAAI,EAAE,KAAK,EAAE,EAAE,CAAC,cAAc,CAAC,IAAI,CAAC,GAAG,EAAE,KAAK,CAAC,GAAG,CAAC,CAAC;QAC7D,OAAO,EAAE,0BAAkB;KAC5B,CAAC;IACF,MAAM,MAAM,GAAG,IAAA,wBAAU,EAAC,QAAQ,CAAC;SAChC,MAAM,CAAC,IAAI,CAAC,SAAS,CAAC,QAAQ,CAAC,EAAE,MAAM,CAAC;SACxC,MAAM,CAAC,KAAK,CAAC,CAAC;IACjB,OAAO;QACL,MAAM;QACN,QAAQ;QACR,SAAS,EAAE,UAAU,CAAC,GAAG,CAAC,CAAC,EAAE,EAAE,EAAE,EAAE,EAAE,CAAC,EAAE,CAAC;QACzC,MAAM,EAAE,WAAW,CAAC,EAAE;QACtB,OAAO,EAAE,UAAU,CAAC,GAAG,CAAC,CAAC,EAAE,MAAM,EAAE,EAAE,EAAE,CAAC,CAAC,EAAE,GAAG,MAAM,EAAE,CAAC,CAAC;KACzD,CAAC;AACJ,CAAC;AAED,SAAgB,uCAAuC,CAAC,OAKvD;IACC,MAAM,QAAQ,GAAG,IAAA,8CAAgC,EAAC,OAAO,CAAC,QAAQ,CAAC,CAAC;IACpE,MAAM,cAAc,GAAG,IAAI,GAAG,CAAC,QAAQ,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,EAAE,EAAE,EAAE,EAAE,EAAE,CAAC,EAAE,CAAC,CAAC,CAAC;IACnE,MAAM,UAAU,GAAG,MAAM,CAAC,IAAI,CAAC,OAAO,CAAC,aAAa,CAAC,CAAC,MAAM,CAC1D,CAAC,MAAM,EAAE,EAAE,CAAC,CAAC,cAAc,CAAC,GAAG,CAAC,MAAM,CAAC,CACxC,CAAC;IACF,IAAI,UAAU,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;QAC1B,MAAM,IAAI,4BAA4B,CACpC,+BAA+B,EAC/B,0DAA0D,UAAU,CAAC,IAAI,CAAC,cAAc,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,GAAG,CACxG,CAAC;IACJ,CAAC;IACD,MAAM,OAAO,GAAG,QAAQ,CAAC,KAAK;SAC3B,GAAG,CAAC,CAAC,EAAE,EAAE,EAAE,EAAE,EAAE,CAAC,EAAE,CAAC;SACnB,MAAM,CACL,CAAC,MAAM,EAAE,EAAE,CACT,CAAC,MAAM,CAAC,SAAS,CAAC,cAAc,CAAC,IAAI,CAAC,OAAO,CAAC,aAAa,EAAE,MAAM,CAAC,CACvE,CAAC;IACJ,IAAI,OAAO,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;QACvB,MAAM,IAAI,4BAA4B,CACpC,6BAA6B,EAC7B,4DAA4D,OAAO,CAAC,IAAI,CAAC,cAAc,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,GAAG,CACvG,CAAC;IACJ,CAAC;IACD,MAAM,QAAQ,GAAG,QAAQ,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,WAAW,EAAE,EAAE;QAClD,MAAM,MAAM,GAAG,iCAAiC,CAC9C,WAAW,EACX,OAAO,CAAC,aAAa,CAAC,WAAW,CAAC,EAAE,CAAC,IAAI,EAAE,CAC5C,CAAC;QACF,IAAI,MAAM,CAAC,MAAM,KAAK,WAAW,CAAC,sBAAsB,EAAE,CAAC;YACzD,MAAM,IAAI,4BAA4B,CACpC,+BAA+B,EAC/B,+BAA+B,WAAW,CAAC,EAAE,0CAA0C,CACxF,CAAC;QACJ,CAAC;QACD,OAAO,MAAM,CAAC;IAChB,CAAC,CAAC,CAAC;IACH,MAAM,cAAc,GAAG,IAAA,wBAAU,EAAC,QAAQ,CAAC;SACxC,MAAM,CAAC,IAAI,CAAC,SAAS,CAAC,QAAQ,CAAC,EAAE,MAAM,CAAC;SACxC,MAAM,CAAC,KAAK,CAAC,CAAC;IACjB,OAAO;QACL,iBAAiB,EAAE,QAAQ,CAAC,SAAS,CAAC,QAAQ;QAC9C,cAAc;QACd,QAAQ;QACR,KAAK,EAAE,QAAQ,CAAC,SAAS,CAAC,KAAK;KAChC,CAAC;AACJ,CAAC;AAED,SAAgB,sBAAsB,CACpC,MAAyC,EACzC,MAAc;IAEd,MAAM,OAAO,GAAG,MAAM,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC,MAAM,CAAC,MAAM,KAAK,MAAM,CAAC,CAAC;IAC7E,IAAI,OAAO,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QACzB,MAAM,IAAI,4BAA4B,CACpC,OAAO,CAAC,MAAM,KAAK,CAAC;YAClB,CAAC,CAAC,6BAA6B;YAC/B,CAAC,CAAC,+BAA+B,EACnC,+DAA+D,MAAM,GAAG,CACzE,CAAC;IACJ,CAAC;IACD,OAAO,OAAO,CAAC,CAAC,CAAgC,CAAC;AACnD,CAAC"}

package/src/workload-roles/handler.d.ts

@@ -0,0 +1,43 @@
+import type { WorkloadRoleHistory } from './history.js';
+import { FIXED_WORKLOAD_ROLE_PROVISIONER_PROTOCOL_VERSION, type FixedWorkloadRoleProvisionerAdapter } from './provisioner.js';
+import { type FixedRegisteredManifestSource, type ProvisionedWorkloadRoleRegistrationDocument } from './registration.js';
+export declare const FIXED_WORKLOAD_ROLE_PROVISIONER_RESULT_SCHEMA_VERSION: 2;
+export interface FixedWorkloadRoleProvisionerStateStore {
+    loadHistory(): Promise<unknown | undefined>;
+    saveHistory(history: WorkloadRoleHistory): Promise<void>;
+    saveProvisionedRegistration(document: ProvisionedWorkloadRoleRegistrationDocument | undefined): Promise<void>;
+}
+export interface FixedWorkloadRoleProvisionerSuccess {
+    candidateIdentity: string;
+    historyDigest: string;
+    manifestDigest: string;
+    ok: true;
+    operation: 'converge' | 'remove';
+    operationCounts: {
+        create: number;
+        remove: number;
+        update: number;
+    };
+    protocolVersion: typeof FIXED_WORKLOAD_ROLE_PROVISIONER_PROTOCOL_VERSION;
+    provisionedRegistration?: ProvisionedWorkloadRoleRegistrationDocument;
+    resultSchemaVersion: typeof FIXED_WORKLOAD_ROLE_PROVISIONER_RESULT_SCHEMA_VERSION;
+    stage: string;
+}
+export interface FixedWorkloadRoleProvisionerFailure {
+    classification: string;
+    ok: false;
+    protocolVersion: typeof FIXED_WORKLOAD_ROLE_PROVISIONER_PROTOCOL_VERSION;
+    resultSchemaVersion: typeof FIXED_WORKLOAD_ROLE_PROVISIONER_RESULT_SCHEMA_VERSION;
+}
+export type FixedWorkloadRoleProvisionerHandlerResult = FixedWorkloadRoleProvisionerFailure | FixedWorkloadRoleProvisionerSuccess;
+/**
+ * Creates the fixed Lambda handler. Its registered-manifest source and IAM
+ * adapter are closed over at construction; the event cannot select either.
+ * Failures return only a bounded classification and never an exception
+ * message, stack, policy, trust document, authorization, or observed IAM body.
+ */
+export declare function createFixedWorkloadRoleProvisionerHandler(options: {
+    adapter: FixedWorkloadRoleProvisionerAdapter;
+    source: FixedRegisteredManifestSource;
+    state: FixedWorkloadRoleProvisionerStateStore;
+}): (request: unknown) => Promise<FixedWorkloadRoleProvisionerHandlerResult>;