@empire-builder-kit/nx 1.0.0-beta.9 → 1.0.0-rc.2

package/src/workload-roles/manifest.d.ts

@@ -0,0 +1,54 @@
+import { type ValidationResult } from '../validation.js';
+/** Stable v1 workload-role manifest schema. */
+export declare const WORKLOAD_ROLE_MANIFEST_SCHEMA_VERSION: 1;
+export declare const WORKLOAD_ROLE_TRUST_CLASSES: readonly ["appconfig", "ec2", "lambda", "ecs-task", "step-functions"];
+export declare const WORKLOAD_ROLE_SURFACES: readonly ["appconfig-monitor", "lambda-function", "foundation-nat-instance", "api-route", "queue-consumer", "next-server", "next-image-optimizer", "next-revalidation-seeder", "next-revalidation-subscriber", "service-task", "service-execution", "job-task", "job-execution", "job-orchestration", "bootstrap-task", "bootstrap-execution", "migration-task", "migration-execution", "retirement-task", "retirement-execution", "migration-orchestration", "retirement-orchestration"];
+export type WorkloadRoleTrustClass = (typeof WORKLOAD_ROLE_TRUST_CLASSES)[number];
+export type WorkloadRoleSurface = (typeof WORKLOAD_ROLE_SURFACES)[number];
+export declare const CURRENT_GENERATED_ROLE_EXCLUSIONS: readonly [{
+    readonly reason: "Development bastion reuses the configured NAT EC2 instance; other current stages disable the bastion.";
+    readonly surface: "foundation-bastion";
+}, {
+    readonly reason: "The generated Aurora configuration does not enable the database proxy.";
+    readonly surface: "foundation-aurora-proxy";
+}, {
+    readonly reason: "The generated Router and Next.js configuration does not enable edge-signing protection.";
+    readonly surface: "router-edge-signing";
+}, {
+    readonly reason: "AWS-managed service-linked roles are outside the framework workload-role contract.";
+    readonly surface: "aws-service-linked-roles";
+}];
+export interface WorkloadRoleCandidate {
+    identity: string;
+    stage: string;
+}
+export interface WorkloadRoleOwnership {
+    project: string;
+    resource: string;
+}
+export interface WorkloadRoleDeclaration {
+    boundaryArn: string;
+    id: string;
+    ownership: WorkloadRoleOwnership;
+    passDestinations: string[];
+    permissionPolicyDigest: string;
+    roleName: string;
+    surface: WorkloadRoleSurface;
+    trustClass: WorkloadRoleTrustClass;
+}
+export interface WorkloadRoleManifest {
+    candidate: WorkloadRoleCandidate;
+    schemaVersion: typeof WORKLOAD_ROLE_MANIFEST_SCHEMA_VERSION;
+    roles: WorkloadRoleDeclaration[];
+}
+interface WorkloadRoleSurfaceContract {
+    passDestination: string;
+    trustClass: WorkloadRoleTrustClass;
+}
+export declare const WORKLOAD_ROLE_SURFACE_CONTRACTS: Readonly<Record<WorkloadRoleSurface, WorkloadRoleSurfaceContract>>;
+export declare function validateWorkloadRoleManifest(value: unknown): ValidationResult<WorkloadRoleManifest>;
+export declare function requireWorkloadRoleManifest(value: unknown): WorkloadRoleManifest;
+export declare function canonicalizeWorkloadRoleManifest(value: unknown): WorkloadRoleManifest;
+export declare function serializeWorkloadRoleManifest(value: unknown): string;
+export declare function digestWorkloadRoleManifest(value: unknown): string;
+export {};

package/src/workload-roles/manifest.js

@@ -0,0 +1,343 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.WORKLOAD_ROLE_SURFACE_CONTRACTS = exports.CURRENT_GENERATED_ROLE_EXCLUSIONS = exports.WORKLOAD_ROLE_SURFACES = exports.WORKLOAD_ROLE_TRUST_CLASSES = exports.WORKLOAD_ROLE_MANIFEST_SCHEMA_VERSION = void 0;
+exports.validateWorkloadRoleManifest = validateWorkloadRoleManifest;
+exports.requireWorkloadRoleManifest = requireWorkloadRoleManifest;
+exports.canonicalizeWorkloadRoleManifest = canonicalizeWorkloadRoleManifest;
+exports.serializeWorkloadRoleManifest = serializeWorkloadRoleManifest;
+exports.digestWorkloadRoleManifest = digestWorkloadRoleManifest;
+const node_crypto_1 = require("node:crypto");
+const validation_js_1 = require("../validation.js");
+/** Stable v1 workload-role manifest schema. */
+exports.WORKLOAD_ROLE_MANIFEST_SCHEMA_VERSION = 1;
+exports.WORKLOAD_ROLE_TRUST_CLASSES = [
+    'appconfig',
+    'ec2',
+    'lambda',
+    'ecs-task',
+    'step-functions',
+];
+exports.WORKLOAD_ROLE_SURFACES = [
+    'appconfig-monitor',
+    'lambda-function',
+    'foundation-nat-instance',
+    'api-route',
+    'queue-consumer',
+    'next-server',
+    'next-image-optimizer',
+    'next-revalidation-seeder',
+    'next-revalidation-subscriber',
+    'service-task',
+    'service-execution',
+    'job-task',
+    'job-execution',
+    'job-orchestration',
+    'bootstrap-task',
+    'bootstrap-execution',
+    'migration-task',
+    'migration-execution',
+    'retirement-task',
+    'retirement-execution',
+    'migration-orchestration',
+    'retirement-orchestration',
+];
+exports.CURRENT_GENERATED_ROLE_EXCLUSIONS = [
+    {
+        reason: 'Development bastion reuses the configured NAT EC2 instance; other current stages disable the bastion.',
+        surface: 'foundation-bastion',
+    },
+    {
+        reason: 'The generated Aurora configuration does not enable the database proxy.',
+        surface: 'foundation-aurora-proxy',
+    },
+    {
+        reason: 'The generated Router and Next.js configuration does not enable edge-signing protection.',
+        surface: 'router-edge-signing',
+    },
+    {
+        reason: 'AWS-managed service-linked roles are outside the framework workload-role contract.',
+        surface: 'aws-service-linked-roles',
+    },
+];
+const identifierPattern = /^[a-z0-9][a-z0-9._-]{0,127}$/;
+const projectIdentifierPattern = /^(?:[a-z0-9][a-z0-9._-]{0,127}|@[a-z0-9][a-z0-9._-]{0,62}\/[a-z0-9][a-z0-9._-]{0,63})$/;
+const roleNamePattern = /^[A-Za-z0-9+=,.@_-]{1,64}$/;
+const sha256Pattern = /^[a-f0-9]{64}$/;
+const servicePrincipalPattern = /^[a-z0-9](?:[a-z0-9-]*\.)+[a-z0-9-]+$/;
+const iamPolicyArnPattern = /^arn:(aws|aws-us-gov|aws-cn):iam::\d{12}:policy\/[A-Za-z0-9+=,.@_/-]+$/;
+exports.WORKLOAD_ROLE_SURFACE_CONTRACTS = {
+    'appconfig-monitor': {
+        passDestination: 'appconfig.amazonaws.com',
+        trustClass: 'appconfig',
+    },
+    'api-route': {
+        passDestination: 'lambda.amazonaws.com',
+        trustClass: 'lambda',
+    },
+    'foundation-nat-instance': {
+        passDestination: 'ec2.amazonaws.com',
+        trustClass: 'ec2',
+    },
+    'bootstrap-execution': {
+        passDestination: 'ecs-tasks.amazonaws.com',
+        trustClass: 'ecs-task',
+    },
+    'bootstrap-task': {
+        passDestination: 'ecs-tasks.amazonaws.com',
+        trustClass: 'ecs-task',
+    },
+    'job-execution': {
+        passDestination: 'ecs-tasks.amazonaws.com',
+        trustClass: 'ecs-task',
+    },
+    'job-task': {
+        passDestination: 'ecs-tasks.amazonaws.com',
+        trustClass: 'ecs-task',
+    },
+    'job-orchestration': {
+        passDestination: 'states.amazonaws.com',
+        trustClass: 'step-functions',
+    },
+    'lambda-function': {
+        passDestination: 'lambda.amazonaws.com',
+        trustClass: 'lambda',
+    },
+    'migration-execution': {
+        passDestination: 'ecs-tasks.amazonaws.com',
+        trustClass: 'ecs-task',
+    },
+    'migration-orchestration': {
+        passDestination: 'states.amazonaws.com',
+        trustClass: 'step-functions',
+    },
+    'migration-task': {
+        passDestination: 'ecs-tasks.amazonaws.com',
+        trustClass: 'ecs-task',
+    },
+    'next-image-optimizer': {
+        passDestination: 'lambda.amazonaws.com',
+        trustClass: 'lambda',
+    },
+    'next-revalidation-seeder': {
+        passDestination: 'lambda.amazonaws.com',
+        trustClass: 'lambda',
+    },
+    'next-revalidation-subscriber': {
+        passDestination: 'lambda.amazonaws.com',
+        trustClass: 'lambda',
+    },
+    'next-server': {
+        passDestination: 'lambda.amazonaws.com',
+        trustClass: 'lambda',
+    },
+    'queue-consumer': {
+        passDestination: 'lambda.amazonaws.com',
+        trustClass: 'lambda',
+    },
+    'retirement-execution': {
+        passDestination: 'ecs-tasks.amazonaws.com',
+        trustClass: 'ecs-task',
+    },
+    'retirement-orchestration': {
+        passDestination: 'states.amazonaws.com',
+        trustClass: 'step-functions',
+    },
+    'retirement-task': {
+        passDestination: 'ecs-tasks.amazonaws.com',
+        trustClass: 'ecs-task',
+    },
+    'service-execution': {
+        passDestination: 'ecs-tasks.amazonaws.com',
+        trustClass: 'ecs-task',
+    },
+    'service-task': {
+        passDestination: 'ecs-tasks.amazonaws.com',
+        trustClass: 'ecs-task',
+    },
+};
+function rejectUnexpectedProperties(value, allowed, path, issues) {
+    for (const property of Object.keys(value)) {
+        if (!allowed.includes(property)) {
+            issues.push({
+                message: 'is not an allowed property',
+                path: `${path}.${property}`,
+            });
+        }
+    }
+}
+function requireMatchingString(value, pattern, path, description, issues) {
+    if (typeof value !== 'string' || !pattern.test(value)) {
+        issues.push({ message: `must be ${description}`, path });
+    }
+}
+function validateCandidate(value, issues) {
+    if (!(0, validation_js_1.isRecord)(value)) {
+        issues.push({ message: 'must be an object', path: 'manifest.candidate' });
+        return;
+    }
+    rejectUnexpectedProperties(value, ['identity', 'stage'], 'manifest.candidate', issues);
+    requireMatchingString(value.identity, identifierPattern, 'manifest.candidate.identity', 'a normalized candidate identifier', issues);
+    requireMatchingString(value.stage, identifierPattern, 'manifest.candidate.stage', 'a normalized stage identifier', issues);
+}
+function validateOwnership(value, path, issues) {
+    if (!(0, validation_js_1.isRecord)(value)) {
+        issues.push({ message: 'must be an object', path });
+        return;
+    }
+    rejectUnexpectedProperties(value, ['project', 'resource'], path, issues);
+    requireMatchingString(value.project, projectIdentifierPattern, `${path}.project`, 'a normalized unscoped or scoped Nx project identifier', issues);
+    requireMatchingString(value.resource, identifierPattern, `${path}.resource`, 'a normalized resource identifier', issues);
+}
+function validatePassDestinations(value, path, issues) {
+    if (!Array.isArray(value) || value.length === 0) {
+        issues.push({
+            message: 'must contain at least one AWS service principal',
+            path,
+        });
+        return;
+    }
+    value.forEach((destination, index) => requireMatchingString(destination, servicePrincipalPattern, `${path}[${index}]`, 'an AWS service principal', issues));
+    if (new Set(value).size !== value.length) {
+        issues.push({ message: 'must not contain duplicates', path });
+    }
+}
+function validateRole(value, index, issues) {
+    const path = `manifest.roles[${index}]`;
+    if (!(0, validation_js_1.isRecord)(value)) {
+        issues.push({ message: 'must be an object', path });
+        return;
+    }
+    rejectUnexpectedProperties(value, [
+        'boundaryArn',
+        'id',
+        'ownership',
+        'passDestinations',
+        'permissionPolicyDigest',
+        'roleName',
+        'surface',
+        'trustClass',
+    ], path, issues);
+    requireMatchingString(value.boundaryArn, iamPolicyArnPattern, `${path}.boundaryArn`, 'an IAM policy ARN', issues);
+    requireMatchingString(value.id, identifierPattern, `${path}.id`, 'a normalized stable identifier', issues);
+    validateOwnership(value.ownership, `${path}.ownership`, issues);
+    validatePassDestinations(value.passDestinations, `${path}.passDestinations`, issues);
+    requireMatchingString(value.permissionPolicyDigest, sha256Pattern, `${path}.permissionPolicyDigest`, 'a lowercase SHA-256 digest', issues);
+    requireMatchingString(value.roleName, roleNamePattern, `${path}.roleName`, 'a valid IAM role name', issues);
+    if (typeof value.surface !== 'string' ||
+        !exports.WORKLOAD_ROLE_SURFACES.includes(value.surface)) {
+        issues.push({
+            message: 'must identify a supported pinned-SST role surface',
+            path: `${path}.surface`,
+        });
+        return;
+    }
+    const contract = exports.WORKLOAD_ROLE_SURFACE_CONTRACTS[value.surface];
+    if (value.trustClass !== contract.trustClass) {
+        issues.push({
+            message: `must equal ${contract.trustClass} for ${value.surface}`,
+            path: `${path}.trustClass`,
+        });
+    }
+    if (Array.isArray(value.passDestinations) &&
+        (value.passDestinations.length !== 1 ||
+            value.passDestinations[0] !== contract.passDestination)) {
+        issues.push({
+            message: `must contain only ${contract.passDestination} for ${value.surface}`,
+            path: `${path}.passDestinations`,
+        });
+    }
+}
+function validateWorkloadRoleManifest(value) {
+    const issues = [];
+    if (!(0, validation_js_1.isRecord)(value)) {
+        return {
+            issues: [{ message: 'must be an object', path: 'manifest' }],
+            valid: false,
+        };
+    }
+    rejectUnexpectedProperties(value, ['candidate', 'schemaVersion', 'roles'], 'manifest', issues);
+    if (value.schemaVersion !== exports.WORKLOAD_ROLE_MANIFEST_SCHEMA_VERSION) {
+        issues.push({
+            message: `must equal ${exports.WORKLOAD_ROLE_MANIFEST_SCHEMA_VERSION}`,
+            path: 'manifest.schemaVersion',
+        });
+    }
+    validateCandidate(value.candidate, issues);
+    if (!Array.isArray(value.roles) || value.roles.length === 0) {
+        issues.push({
+            message: 'must contain at least one workload role',
+            path: 'manifest.roles',
+        });
+    }
+    else {
+        value.roles.forEach((role, index) => validateRole(role, index, issues));
+        for (const property of ['id', 'roleName']) {
+            const entries = value.roles
+                .filter(validation_js_1.isRecord)
+                .map((role) => role[property])
+                .filter((entry) => typeof entry === 'string')
+                .map((entry) => property === 'roleName' ? entry.toLowerCase() : entry);
+            if (new Set(entries).size !== entries.length) {
+                issues.push({
+                    message: `must not contain duplicate ${property} values`,
+                    path: 'manifest.roles',
+                });
+            }
+        }
+        const boundaries = value.roles
+            .filter(validation_js_1.isRecord)
+            .map(({ boundaryArn }) => boundaryArn)
+            .filter((entry) => typeof entry === 'string');
+        if (new Set(boundaries).size > 1) {
+            issues.push({
+                message: 'must use one identical stage permissions boundary ARN',
+                path: 'manifest.roles',
+            });
+        }
+    }
+    return (0, validation_js_1.validationResult)(value, issues);
+}
+function requireWorkloadRoleManifest(value) {
+    const result = validateWorkloadRoleManifest(value);
+    if (!result.valid) {
+        const detail = result.issues
+            .map(({ message, path }) => `${path} ${message}`)
+            .join('; ');
+        throw new Error(`Invalid workload-role manifest: ${detail}`);
+    }
+    return result.value;
+}
+function canonicalizeWorkloadRoleManifest(value) {
+    const manifest = requireWorkloadRoleManifest(value);
+    return {
+        candidate: {
+            identity: manifest.candidate.identity,
+            stage: manifest.candidate.stage,
+        },
+        schemaVersion: exports.WORKLOAD_ROLE_MANIFEST_SCHEMA_VERSION,
+        roles: manifest.roles
+            .map((role) => ({
+            boundaryArn: role.boundaryArn,
+            id: role.id,
+            ownership: {
+                project: role.ownership.project,
+                resource: role.ownership.resource,
+            },
+            passDestinations: [...role.passDestinations].sort(),
+            permissionPolicyDigest: role.permissionPolicyDigest,
+            roleName: role.roleName,
+            surface: role.surface,
+            trustClass: role.trustClass,
+        }))
+            .sort((left, right) => left.id < right.id ? -1 : left.id > right.id ? 1 : 0),
+    };
+}
+function serializeWorkloadRoleManifest(value) {
+    return JSON.stringify(canonicalizeWorkloadRoleManifest(value));
+}
+function digestWorkloadRoleManifest(value) {
+    return (0, node_crypto_1.createHash)('sha256')
+        .update(serializeWorkloadRoleManifest(value), 'utf8')
+        .digest('hex');
+}
+//# sourceMappingURL=manifest.js.map

package/src/workload-roles/manifest.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"manifest.js","sourceRoot":"","sources":["../../../../../packages/nx/src/workload-roles/manifest.ts"],"names":[],"mappings":";;;AAuZA,oEA4DC;AAED,kEAWC;AAED,4EA4BC;AAED,sEAEC;AAED,gEAIC;AAxgBD,6CAAyC;AACzC,oDAK0B;AAE1B,+CAA+C;AAClC,QAAA,qCAAqC,GAAG,CAAU,CAAC;AAEnD,QAAA,2BAA2B,GAAG;IACzC,WAAW;IACX,KAAK;IACL,QAAQ;IACR,UAAU;IACV,gBAAgB;CACR,CAAC;AAEE,QAAA,sBAAsB,GAAG;IACpC,mBAAmB;IACnB,iBAAiB;IACjB,yBAAyB;IACzB,WAAW;IACX,gBAAgB;IAChB,aAAa;IACb,sBAAsB;IACtB,0BAA0B;IAC1B,8BAA8B;IAC9B,cAAc;IACd,mBAAmB;IACnB,UAAU;IACV,eAAe;IACf,mBAAmB;IACnB,gBAAgB;IAChB,qBAAqB;IACrB,gBAAgB;IAChB,qBAAqB;IACrB,iBAAiB;IACjB,sBAAsB;IACtB,yBAAyB;IACzB,0BAA0B;CAClB,CAAC;AAME,QAAA,iCAAiC,GAAG;IAC/C;QACE,MAAM,EACJ,uGAAuG;QACzG,OAAO,EAAE,oBAAoB;KAC9B;IACD;QACE,MAAM,EACJ,wEAAwE;QAC1E,OAAO,EAAE,yBAAyB;KACnC;IACD;QACE,MAAM,EACJ,yFAAyF;QAC3F,OAAO,EAAE,qBAAqB;KAC/B;IACD;QACE,MAAM,EACJ,oFAAoF;QACtF,OAAO,EAAE,0BAA0B;KACpC;CACO,CAAC;AA6BX,MAAM,iBAAiB,GAAG,8BAA8B,CAAC;AACzD,MAAM,wBAAwB,GAC5B,wFAAwF,CAAC;AAC3F,MAAM,eAAe,GAAG,4BAA4B,CAAC;AACrD,MAAM,aAAa,GAAG,gBAAgB,CAAC;AACvC,MAAM,uBAAuB,GAAG,uCAAuC,CAAC;AACxE,MAAM,mBAAmB,GACvB,wEAAwE,CAAC;AAO9D,QAAA,+BAA+B,GAExC;IACF,mBAAmB,EAAE;QACnB,eAAe,EAAE,yBAAyB;QAC1C,UAAU,EAAE,WAAW;KACxB;IACD,WAAW,EAAE;QACX,eAAe,EAAE,sBAAsB;QACvC,UAAU,EAAE,QAAQ;KACrB;IACD,yBAAyB,EAAE;QACzB,eAAe,EAAE,mBAAmB;QACpC,UAAU,EAAE,KAAK;KAClB;IACD,qBAAqB,EAAE;QACrB,eAAe,EAAE,yBAAyB;QAC1C,UAAU,EAAE,UAAU;KACvB;IACD,gBAAgB,EAAE;QAChB,eAAe,EAAE,yBAAyB;QAC1C,UAAU,EAAE,UAAU;KACvB;IACD,eAAe,EAAE;QACf,eAAe,EAAE,yBAAyB;QAC1C,UAAU,EAAE,UAAU;KACvB;IACD,UAAU,EAAE;QACV,eAAe,EAAE,yBAAyB;QAC1C,UAAU,EAAE,UAAU;KACvB;IACD,mBAAmB,EAAE;QACnB,eAAe,EAAE,sBAAsB;QACvC,UAAU,EAAE,gBAAgB;KAC7B;IACD,iBAAiB,EAAE;QACjB,eAAe,EAAE,sBAAsB;QACvC,UAAU,EAAE,QAAQ;KACrB;IACD,qBAAqB,EAAE;QACrB,eAAe,EAAE,yBAAyB;QAC1C,UAAU,EAAE,UAAU;KACvB;IACD,yBAAyB,EAAE;QACzB,eAAe,EAAE,sBAAsB;QACvC,UAAU,EAAE,gBAAgB;KAC7B;IACD,gBAAgB,EAAE;QAChB,eAAe,EAAE,yBAAyB;QAC1C,UAAU,EAAE,UAAU;KACvB;IACD,sBAAsB,EAAE;QACtB,eAAe,EAAE,sBAAsB;QACvC,UAAU,EAAE,QAAQ;KACrB;IACD,0BAA0B,EAAE;QAC1B,eAAe,EAAE,sBAAsB;QACvC,UAAU,EAAE,QAAQ;KACrB;IACD,8BAA8B,EAAE;QAC9B,eAAe,EAAE,sBAAsB;QACvC,UAAU,EAAE,QAAQ;KACrB;IACD,aAAa,EAAE;QACb,eAAe,EAAE,sBAAsB;QACvC,UAAU,EAAE,QAAQ;KACrB;IACD,gBAAgB,EAAE;QAChB,eAAe,EAAE,sBAAsB;QACvC,UAAU,EAAE,QAAQ;KACrB;IACD,sBAAsB,EAAE;QACtB,eAAe,EAAE,yBAAyB;QAC1C,UAAU,EAAE,UAAU;KACvB;IACD,0BAA0B,EAAE;QAC1B,eAAe,EAAE,sBAAsB;QACvC,UAAU,EAAE,gBAAgB;KAC7B;IACD,iBAAiB,EAAE;QACjB,eAAe,EAAE,yBAAyB;QAC1C,UAAU,EAAE,UAAU;KACvB;IACD,mBAAmB,EAAE;QACnB,eAAe,EAAE,yBAAyB;QAC1C,UAAU,EAAE,UAAU;KACvB;IACD,cAAc,EAAE;QACd,eAAe,EAAE,yBAAyB;QAC1C,UAAU,EAAE,UAAU;KACvB;CACF,CAAC;AAEF,SAAS,0BAA0B,CACjC,KAA8B,EAC9B,OAA0B,EAC1B,IAAY,EACZ,MAAyB;IAEzB,KAAK,MAAM,QAAQ,IAAI,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,EAAE,CAAC;QAC1C,IAAI,CAAC,OAAO,CAAC,QAAQ,CAAC,QAAQ,CAAC,EAAE,CAAC;YAChC,MAAM,CAAC,IAAI,CAAC;gBACV,OAAO,EAAE,4BAA4B;gBACrC,IAAI,EAAE,GAAG,IAAI,IAAI,QAAQ,EAAE;aAC5B,CAAC,CAAC;QACL,CAAC;IACH,CAAC;AACH,CAAC;AAED,SAAS,qBAAqB,CAC5B,KAAc,EACd,OAAe,EACf,IAAY,EACZ,WAAmB,EACnB,MAAyB;IAEzB,IAAI,OAAO,KAAK,KAAK,QAAQ,IAAI,CAAC,OAAO,CAAC,IAAI,CAAC,KAAK,CAAC,EAAE,CAAC;QACtD,MAAM,CAAC,IAAI,CAAC,EAAE,OAAO,EAAE,WAAW,WAAW,EAAE,EAAE,IAAI,EAAE,CAAC,CAAC;IAC3D,CAAC;AACH,CAAC;AAED,SAAS,iBAAiB,CAAC,KAAc,EAAE,MAAyB;IAClE,IAAI,CAAC,IAAA,wBAAQ,EAAC,KAAK,CAAC,EAAE,CAAC;QACrB,MAAM,CAAC,IAAI,CAAC,EAAE,OAAO,EAAE,mBAAmB,EAAE,IAAI,EAAE,oBAAoB,EAAE,CAAC,CAAC;QAC1E,OAAO;IACT,CAAC;IAED,0BAA0B,CACxB,KAAK,EACL,CAAC,UAAU,EAAE,OAAO,CAAC,EACrB,oBAAoB,EACpB,MAAM,CACP,CAAC;IACF,qBAAqB,CACnB,KAAK,CAAC,QAAQ,EACd,iBAAiB,EACjB,6BAA6B,EAC7B,mCAAmC,EACnC,MAAM,CACP,CAAC;IACF,qBAAqB,CACnB,KAAK,CAAC,KAAK,EACX,iBAAiB,EACjB,0BAA0B,EAC1B,+BAA+B,EAC/B,MAAM,CACP,CAAC;AACJ,CAAC;AAED,SAAS,iBAAiB,CACxB,KAAc,EACd,IAAY,EACZ,MAAyB;IAEzB,IAAI,CAAC,IAAA,wBAAQ,EAAC,KAAK,CAAC,EAAE,CAAC;QACrB,MAAM,CAAC,IAAI,CAAC,EAAE,OAAO,EAAE,mBAAmB,EAAE,IAAI,EAAE,CAAC,CAAC;QACpD,OAAO;IACT,CAAC;IAED,0BAA0B,CAAC,KAAK,EAAE,CAAC,SAAS,EAAE,UAAU,CAAC,EAAE,IAAI,EAAE,MAAM,CAAC,CAAC;IACzE,qBAAqB,CACnB,KAAK,CAAC,OAAO,EACb,wBAAwB,EACxB,GAAG,IAAI,UAAU,EACjB,uDAAuD,EACvD,MAAM,CACP,CAAC;IACF,qBAAqB,CACnB,KAAK,CAAC,QAAQ,EACd,iBAAiB,EACjB,GAAG,IAAI,WAAW,EAClB,kCAAkC,EAClC,MAAM,CACP,CAAC;AACJ,CAAC;AAED,SAAS,wBAAwB,CAC/B,KAAc,EACd,IAAY,EACZ,MAAyB;IAEzB,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC,IAAI,KAAK,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QAChD,MAAM,CAAC,IAAI,CAAC;YACV,OAAO,EAAE,iDAAiD;YAC1D,IAAI;SACL,CAAC,CAAC;QACH,OAAO;IACT,CAAC;IAED,KAAK,CAAC,OAAO,CAAC,CAAC,WAAW,EAAE,KAAK,EAAE,EAAE,CACnC,qBAAqB,CACnB,WAAW,EACX,uBAAuB,EACvB,GAAG,IAAI,IAAI,KAAK,GAAG,EACnB,0BAA0B,EAC1B,MAAM,CACP,CACF,CAAC;IACF,IAAI,IAAI,GAAG,CAAC,KAAK,CAAC,CAAC,IAAI,KAAK,KAAK,CAAC,MAAM,EAAE,CAAC;QACzC,MAAM,CAAC,IAAI,CAAC,EAAE,OAAO,EAAE,6BAA6B,EAAE,IAAI,EAAE,CAAC,CAAC;IAChE,CAAC;AACH,CAAC;AAED,SAAS,YAAY,CACnB,KAAc,EACd,KAAa,EACb,MAAyB;IAEzB,MAAM,IAAI,GAAG,kBAAkB,KAAK,GAAG,CAAC;IACxC,IAAI,CAAC,IAAA,wBAAQ,EAAC,KAAK,CAAC,EAAE,CAAC;QACrB,MAAM,CAAC,IAAI,CAAC,EAAE,OAAO,EAAE,mBAAmB,EAAE,IAAI,EAAE,CAAC,CAAC;QACpD,OAAO;IACT,CAAC;IAED,0BAA0B,CACxB,KAAK,EACL;QACE,aAAa;QACb,IAAI;QACJ,WAAW;QACX,kBAAkB;QAClB,wBAAwB;QACxB,UAAU;QACV,SAAS;QACT,YAAY;KACb,EACD,IAAI,EACJ,MAAM,CACP,CAAC;IACF,qBAAqB,CACnB,KAAK,CAAC,WAAW,EACjB,mBAAmB,EACnB,GAAG,IAAI,cAAc,EACrB,mBAAmB,EACnB,MAAM,CACP,CAAC;IACF,qBAAqB,CACnB,KAAK,CAAC,EAAE,EACR,iBAAiB,EACjB,GAAG,IAAI,KAAK,EACZ,gCAAgC,EAChC,MAAM,CACP,CAAC;IACF,iBAAiB,CAAC,KAAK,CAAC,SAAS,EAAE,GAAG,IAAI,YAAY,EAAE,MAAM,CAAC,CAAC;IAChE,wBAAwB,CACtB,KAAK,CAAC,gBAAgB,EACtB,GAAG,IAAI,mBAAmB,EAC1B,MAAM,CACP,CAAC;IACF,qBAAqB,CACnB,KAAK,CAAC,sBAAsB,EAC5B,aAAa,EACb,GAAG,IAAI,yBAAyB,EAChC,4BAA4B,EAC5B,MAAM,CACP,CAAC;IACF,qBAAqB,CACnB,KAAK,CAAC,QAAQ,EACd,eAAe,EACf,GAAG,IAAI,WAAW,EAClB,uBAAuB,EACvB,MAAM,CACP,CAAC;IAEF,IACE,OAAO,KAAK,CAAC,OAAO,KAAK,QAAQ;QACjC,CAAC,8BAAsB,CAAC,QAAQ,CAAC,KAAK,CAAC,OAA8B,CAAC,EACtE,CAAC;QACD,MAAM,CAAC,IAAI,CAAC;YACV,OAAO,EAAE,mDAAmD;YAC5D,IAAI,EAAE,GAAG,IAAI,UAAU;SACxB,CAAC,CAAC;QACH,OAAO;IACT,CAAC;IAED,MAAM,QAAQ,GACZ,uCAA+B,CAAC,KAAK,CAAC,OAA8B,CAAC,CAAC;IACxE,IAAI,KAAK,CAAC,UAAU,KAAK,QAAQ,CAAC,UAAU,EAAE,CAAC;QAC7C,MAAM,CAAC,IAAI,CAAC;YACV,OAAO,EAAE,cAAc,QAAQ,CAAC,UAAU,QAAQ,KAAK,CAAC,OAAO,EAAE;YACjE,IAAI,EAAE,GAAG,IAAI,aAAa;SAC3B,CAAC,CAAC;IACL,CAAC;IACD,IACE,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC,gBAAgB,CAAC;QACrC,CAAC,KAAK,CAAC,gBAAgB,CAAC,MAAM,KAAK,CAAC;YAClC,KAAK,CAAC,gBAAgB,CAAC,CAAC,CAAC,KAAK,QAAQ,CAAC,eAAe,CAAC,EACzD,CAAC;QACD,MAAM,CAAC,IAAI,CAAC;YACV,OAAO,EAAE,qBAAqB,QAAQ,CAAC,eAAe,QAAQ,KAAK,CAAC,OAAO,EAAE;YAC7E,IAAI,EAAE,GAAG,IAAI,mBAAmB;SACjC,CAAC,CAAC;IACL,CAAC;AACH,CAAC;AAED,SAAgB,4BAA4B,CAC1C,KAAc;IAEd,MAAM,MAAM,GAAsB,EAAE,CAAC;IACrC,IAAI,CAAC,IAAA,wBAAQ,EAAC,KAAK,CAAC,EAAE,CAAC;QACrB,OAAO;YACL,MAAM,EAAE,CAAC,EAAE,OAAO,EAAE,mBAAmB,EAAE,IAAI,EAAE,UAAU,EAAE,CAAC;YAC5D,KAAK,EAAE,KAAK;SACb,CAAC;IACJ,CAAC;IAED,0BAA0B,CACxB,KAAK,EACL,CAAC,WAAW,EAAE,eAAe,EAAE,OAAO,CAAC,EACvC,UAAU,EACV,MAAM,CACP,CAAC;IACF,IAAI,KAAK,CAAC,aAAa,KAAK,6CAAqC,EAAE,CAAC;QAClE,MAAM,CAAC,IAAI,CAAC;YACV,OAAO,EAAE,cAAc,6CAAqC,EAAE;YAC9D,IAAI,EAAE,wBAAwB;SAC/B,CAAC,CAAC;IACL,CAAC;IACD,iBAAiB,CAAC,KAAK,CAAC,SAAS,EAAE,MAAM,CAAC,CAAC;IAC3C,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC,KAAK,CAAC,IAAI,KAAK,CAAC,KAAK,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QAC5D,MAAM,CAAC,IAAI,CAAC;YACV,OAAO,EAAE,yCAAyC;YAClD,IAAI,EAAE,gBAAgB;SACvB,CAAC,CAAC;IACL,CAAC;SAAM,CAAC;QACN,KAAK,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,IAAI,EAAE,KAAK,EAAE,EAAE,CAAC,YAAY,CAAC,IAAI,EAAE,KAAK,EAAE,MAAM,CAAC,CAAC,CAAC;QAExE,KAAK,MAAM,QAAQ,IAAI,CAAC,IAAI,EAAE,UAAU,CAAU,EAAE,CAAC;YACnD,MAAM,OAAO,GAAG,KAAK,CAAC,KAAK;iBACxB,MAAM,CAAC,wBAAQ,CAAC;iBAChB,GAAG,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC;iBAC7B,MAAM,CAAC,CAAC,KAAK,EAAmB,EAAE,CAAC,OAAO,KAAK,KAAK,QAAQ,CAAC;iBAC7D,GAAG,CAAC,CAAC,KAAK,EAAE,EAAE,CACb,QAAQ,KAAK,UAAU,CAAC,CAAC,CAAC,KAAK,CAAC,WAAW,EAAE,CAAC,CAAC,CAAC,KAAK,CACtD,CAAC;YACJ,IAAI,IAAI,GAAG,CAAC,OAAO,CAAC,CAAC,IAAI,KAAK,OAAO,CAAC,MAAM,EAAE,CAAC;gBAC7C,MAAM,CAAC,IAAI,CAAC;oBACV,OAAO,EAAE,8BAA8B,QAAQ,SAAS;oBACxD,IAAI,EAAE,gBAAgB;iBACvB,CAAC,CAAC;YACL,CAAC;QACH,CAAC;QACD,MAAM,UAAU,GAAG,KAAK,CAAC,KAAK;aAC3B,MAAM,CAAC,wBAAQ,CAAC;aAChB,GAAG,CAAC,CAAC,EAAE,WAAW,EAAE,EAAE,EAAE,CAAC,WAAW,CAAC;aACrC,MAAM,CAAC,CAAC,KAAK,EAAmB,EAAE,CAAC,OAAO,KAAK,KAAK,QAAQ,CAAC,CAAC;QACjE,IAAI,IAAI,GAAG,CAAC,UAAU,CAAC,CAAC,IAAI,GAAG,CAAC,EAAE,CAAC;YACjC,MAAM,CAAC,IAAI,CAAC;gBACV,OAAO,EAAE,uDAAuD;gBAChE,IAAI,EAAE,gBAAgB;aACvB,CAAC,CAAC;QACL,CAAC;IACH,CAAC;IAED,OAAO,IAAA,gCAAgB,EAAuB,KAAK,EAAE,MAAM,CAAC,CAAC;AAC/D,CAAC;AAED,SAAgB,2BAA2B,CACzC,KAAc;IAEd,MAAM,MAAM,GAAG,4BAA4B,CAAC,KAAK,CAAC,CAAC;IACnD,IAAI,CAAC,MAAM,CAAC,KAAK,EAAE,CAAC;QAClB,MAAM,MAAM,GAAG,MAAM,CAAC,MAAM;aACzB,GAAG,CAAC,CAAC,EAAE,OAAO,EAAE,IAAI,EAAE,EAAE,EAAE,CAAC,GAAG,IAAI,IAAI,OAAO,EAAE,CAAC;aAChD,IAAI,CAAC,IAAI,CAAC,CAAC;QACd,MAAM,IAAI,KAAK,CAAC,mCAAmC,MAAM,EAAE,CAAC,CAAC;IAC/D,CAAC;IACD,OAAO,MAAM,CAAC,KAAK,CAAC;AACtB,CAAC;AAED,SAAgB,gCAAgC,CAC9C,KAAc;IAEd,MAAM,QAAQ,GAAG,2BAA2B,CAAC,KAAK,CAAC,CAAC;IACpD,OAAO;QACL,SAAS,EAAE;YACT,QAAQ,EAAE,QAAQ,CAAC,SAAS,CAAC,QAAQ;YACrC,KAAK,EAAE,QAAQ,CAAC,SAAS,CAAC,KAAK;SAChC;QACD,aAAa,EAAE,6CAAqC;QACpD,KAAK,EAAE,QAAQ,CAAC,KAAK;aAClB,GAAG,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,CAAC;YACd,WAAW,EAAE,IAAI,CAAC,WAAW;YAC7B,EAAE,EAAE,IAAI,CAAC,EAAE;YACX,SAAS,EAAE;gBACT,OAAO,EAAE,IAAI,CAAC,SAAS,CAAC,OAAO;gBAC/B,QAAQ,EAAE,IAAI,CAAC,SAAS,CAAC,QAAQ;aAClC;YACD,gBAAgB,EAAE,CAAC,GAAG,IAAI,CAAC,gBAAgB,CAAC,CAAC,IAAI,EAAE;YACnD,sBAAsB,EAAE,IAAI,CAAC,sBAAsB;YACnD,QAAQ,EAAE,IAAI,CAAC,QAAQ;YACvB,OAAO,EAAE,IAAI,CAAC,OAAO;YACrB,UAAU,EAAE,IAAI,CAAC,UAAU;SAC5B,CAAC,CAAC;aACF,IAAI,CAAC,CAAC,IAAI,EAAE,KAAK,EAAE,EAAE,CACpB,IAAI,CAAC,EAAE,GAAG,KAAK,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,EAAE,GAAG,KAAK,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CACrD;KACJ,CAAC;AACJ,CAAC;AAED,SAAgB,6BAA6B,CAAC,KAAc;IAC1D,OAAO,IAAI,CAAC,SAAS,CAAC,gCAAgC,CAAC,KAAK,CAAC,CAAC,CAAC;AACjE,CAAC;AAED,SAAgB,0BAA0B,CAAC,KAAc;IACvD,OAAO,IAAA,wBAAU,EAAC,QAAQ,CAAC;SACxB,MAAM,CAAC,6BAA6B,CAAC,KAAK,CAAC,EAAE,MAAM,CAAC;SACpD,MAAM,CAAC,KAAK,CAAC,CAAC;AACnB,CAAC"}

package/src/workload-roles/provisioner.d.ts

@@ -0,0 +1,70 @@
+import { type ObservedWorkloadRole, type WorkloadRoleConvergenceOperation, type WorkloadRoleManifestRegistration, type WorkloadRoleProvisionerRequest } from './convergence.js';
+import type { WorkloadRoleBoundaryContract } from './boundary.js';
+import { type CanonicalIamPolicyDocument, type WorkloadRolePermissionIntent } from './effective-policy.js';
+import { type WorkloadRoleHistory } from './history.js';
+import { type ProvisionedWorkloadRoleRegistration } from './injection.js';
+import { type WorkloadRoleDeclaration, type WorkloadRoleTrustClass } from './manifest.js';
+export declare const FIXED_WORKLOAD_ROLE_PROVISIONER_PROTOCOL_VERSION: 1;
+export type FixedWorkloadRoleProvisionerFailureClassification = 'provisioner-boundary-substitution' | 'provisioner-history-required' | 'provisioner-observation-incomplete' | 'provisioner-result-substitution';
+export declare class FixedWorkloadRoleProvisionerError extends Error {
+    readonly classification: FixedWorkloadRoleProvisionerFailureClassification;
+    constructor(classification: FixedWorkloadRoleProvisionerFailureClassification, message: string);
+}
+export interface AssumeRolePolicyDocument {
+    Statement: [
+        {
+            Action: 'sts:AssumeRole';
+            Effect: 'Allow';
+            Principal: {
+                Service: string;
+            };
+        }
+    ];
+    Version: '2012-10-17';
+}
+export interface FixedWorkloadRoleMutation {
+    assumeRolePolicy: AssumeRolePolicyDocument;
+    boundaryArn: string;
+    candidateIdentity: string;
+    declaration: WorkloadRoleDeclaration;
+    manifestDigest: string;
+    permissionPolicy: CanonicalIamPolicyDocument;
+    stage: string;
+    tags: Record<string, string>;
+}
+export interface FixedNatInstanceProfileMutation {
+    instanceProfileName: string;
+    roleName: string;
+}
+/**
+ * Implemented by the baseline-owned AWS-internal function. Each method accepts
+ * only data constructed from the registered manifest; request payloads never
+ * supply IAM names, policies, trust, tags, boundaries, or pass destinations.
+ */
+export interface FixedWorkloadRoleProvisionerAdapter {
+    create(mutation: FixedWorkloadRoleMutation): Promise<void>;
+    ensureNatInstanceProfile(mutation: FixedNatInstanceProfileMutation): Promise<void>;
+    observeExact(roleNames: readonly string[]): Promise<ObservedWorkloadRole[]>;
+    remove(declaration: WorkloadRoleDeclaration, observed: ObservedWorkloadRole): Promise<void>;
+    update(mutation: FixedWorkloadRoleMutation, observed: ObservedWorkloadRole): Promise<void>;
+}
+export interface ExecuteFixedWorkloadRoleProvisionerOptions {
+    adapter: FixedWorkloadRoleProvisionerAdapter;
+    boundary: WorkloadRoleBoundaryContract;
+    history?: unknown;
+    intentsByRole: Readonly<Record<string, readonly WorkloadRolePermissionIntent[]>>;
+    manifest: unknown;
+    provisionerFunctionArn: string;
+    registration: WorkloadRoleManifestRegistration;
+    request: WorkloadRoleProvisionerRequest;
+}
+export interface FixedWorkloadRoleProvisionerResult {
+    history: WorkloadRoleHistory;
+    historyDigest: string;
+    manifestDigest: string;
+    operationKinds: WorkloadRoleConvergenceOperation['kind'][];
+    protocolVersion: typeof FIXED_WORKLOAD_ROLE_PROVISIONER_PROTOCOL_VERSION;
+    registration?: ProvisionedWorkloadRoleRegistration;
+}
+export declare function createWorkloadRoleTrustPolicy(trustClass: WorkloadRoleTrustClass): AssumeRolePolicyDocument;
+export declare function executeFixedWorkloadRoleProvisioner(options: ExecuteFixedWorkloadRoleProvisionerOptions): Promise<FixedWorkloadRoleProvisionerResult>;