@empire-builder-kit/nx 1.0.0-beta.9 → 1.0.0-rc.2

package/src/workload-roles/provisioner.js

@@ -0,0 +1,231 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.FixedWorkloadRoleProvisionerError = exports.FIXED_WORKLOAD_ROLE_PROVISIONER_PROTOCOL_VERSION = void 0;
+exports.createWorkloadRoleTrustPolicy = createWorkloadRoleTrustPolicy;
+exports.executeFixedWorkloadRoleProvisioner = executeFixedWorkloadRoleProvisioner;
+const convergence_js_1 = require("./convergence.js");
+const effective_policy_js_1 = require("./effective-policy.js");
+const history_js_1 = require("./history.js");
+const injection_js_1 = require("./injection.js");
+const manifest_js_1 = require("./manifest.js");
+exports.FIXED_WORKLOAD_ROLE_PROVISIONER_PROTOCOL_VERSION = 1;
+class FixedWorkloadRoleProvisionerError extends Error {
+    classification;
+    constructor(classification, message) {
+        super(message);
+        this.classification = classification;
+        this.name = 'FixedWorkloadRoleProvisionerError';
+    }
+}
+exports.FixedWorkloadRoleProvisionerError = FixedWorkloadRoleProvisionerError;
+const serviceByTrustClass = {
+    appconfig: 'appconfig.amazonaws.com',
+    ec2: 'ec2.amazonaws.com',
+    'ecs-task': 'ecs-tasks.amazonaws.com',
+    lambda: 'lambda.amazonaws.com',
+    'step-functions': 'states.amazonaws.com',
+};
+function createWorkloadRoleTrustPolicy(trustClass) {
+    return {
+        Statement: [
+            {
+                Action: 'sts:AssumeRole',
+                Effect: 'Allow',
+                Principal: { Service: serviceByTrustClass[trustClass] },
+            },
+        ],
+        Version: '2012-10-17',
+    };
+}
+function requireBoundary(manifest, bundle, boundary) {
+    if (boundary.candidateIdentity !== manifest.candidate.identity ||
+        boundary.stage !== manifest.candidate.stage ||
+        bundle.candidateIdentity !== manifest.candidate.identity ||
+        bundle.stage !== manifest.candidate.stage ||
+        boundary.digest.trim() === '' ||
+        manifest.roles.some(({ boundaryArn }) => boundaryArn !== boundary.arn)) {
+        throw new FixedWorkloadRoleProvisionerError('provisioner-boundary-substitution', 'The fixed provisioner requires the exact registered candidate and stage boundary.');
+    }
+}
+function mutationFor(declaration, manifestDigest, candidateIdentity, stage, bundle) {
+    const policy = (0, effective_policy_js_1.requireEffectivePolicy)(bundle, declaration.id);
+    return {
+        assumeRolePolicy: createWorkloadRoleTrustPolicy(declaration.trustClass),
+        boundaryArn: declaration.boundaryArn,
+        candidateIdentity,
+        declaration,
+        manifestDigest,
+        permissionPolicy: policy.document,
+        stage,
+        tags: {
+            'ebk:candidate': candidateIdentity,
+            'ebk:managed-by': convergence_js_1.WORKLOAD_ROLE_PROVISIONER_OWNER,
+            'ebk:manifest': manifestDigest,
+            'ebk:project': declaration.ownership.project,
+            'ebk:resource': declaration.ownership.resource,
+            'ebk:stage': stage,
+        },
+    };
+}
+function natProfile(declaration) {
+    if (declaration.surface !== 'foundation-nat-instance') {
+        return undefined;
+    }
+    return {
+        instanceProfileName: `${declaration.roleName}-profile`,
+        roleName: declaration.roleName,
+    };
+}
+function provisionedRole(declaration, observed) {
+    return {
+        boundaryArn: declaration.boundaryArn,
+        id: declaration.id,
+        ownership: { ...declaration.ownership },
+        passDestinations: [...declaration.passDestinations],
+        permissionPolicyDigest: declaration.permissionPolicyDigest,
+        roleArn: observed.roleArn,
+        roleName: declaration.roleName,
+        surface: declaration.surface,
+        trustClass: declaration.trustClass,
+    };
+}
+async function applyOperation(adapter, operation, mutation) {
+    const declaration = operation.kind === 'remove' ? operation.declaration : operation.desired;
+    if (operation.kind === 'remove') {
+        await adapter.remove(operation.declaration, operation.before);
+        return;
+    }
+    if (!mutation) {
+        throw new FixedWorkloadRoleProvisionerError('provisioner-result-substitution', 'A create or update operation is missing its fixed registered mutation.');
+    }
+    const profile = natProfile(declaration);
+    if (operation.kind === 'create') {
+        await adapter.create(mutation);
+    }
+    else {
+        await adapter.update(mutation, operation.before);
+    }
+    if (profile) {
+        await adapter.ensureNatInstanceProfile(profile);
+    }
+}
+async function executeFixedWorkloadRoleProvisioner(options) {
+    const manifest = (0, manifest_js_1.canonicalizeWorkloadRoleManifest)(options.manifest);
+    const manifestDigest = (0, manifest_js_1.digestWorkloadRoleManifest)(manifest);
+    const bundle = (0, effective_policy_js_1.createWorkloadRoleEffectivePolicyBundle)({
+        intentsByRole: options.intentsByRole,
+        manifest,
+    });
+    requireBoundary(manifest, bundle, options.boundary);
+    const previousHistory = options.history === undefined
+        ? undefined
+        : (0, history_js_1.requireWorkloadRoleHistory)(options.history);
+    const history = (0, history_js_1.advanceWorkloadRoleHistory)({
+        manifest,
+        ...(previousHistory ? { previous: previousHistory } : {}),
+    });
+    const previousManifest = previousHistory
+        ? (0, history_js_1.workloadRoleManifestFromHistory)(previousHistory)
+        : undefined;
+    const currentById = new Map(manifest.roles.map((declaration) => [declaration.id, declaration]));
+    const retiredDeclarations = previousManifest?.roles.filter((declaration) => currentById.get(declaration.id)?.roleName !== declaration.roleName) ?? [];
+    const currentRoleNames = new Set(manifest.roles.map(({ roleName }) => roleName));
+    const retiredRoleNames = new Set(retiredDeclarations.map(({ roleName }) => roleName));
+    const observedRoleNames = [
+        ...new Set([...currentRoleNames, ...retiredRoleNames]),
+    ].sort();
+    // All caller-controlled identities and every effective policy are validated
+    // before the first adapter method capable of IAM mutation is invoked.
+    const observed = await options.adapter.observeExact(observedRoleNames);
+    if (observed.some(({ roleName }) => !observedRoleNames.includes(roleName))) {
+        throw new FixedWorkloadRoleProvisionerError('provisioner-observation-incomplete', 'Exact workload-role observation returned an unregistered role name.');
+    }
+    const plan = (0, convergence_js_1.createWorkloadRoleConvergencePlan)({
+        manifest,
+        observedRoles: observed.filter(({ roleName }) => currentRoleNames.has(roleName)),
+        registration: options.registration,
+        request: options.request,
+    });
+    const retirementPlan = previousManifest && previousHistory && retiredDeclarations.length > 0
+        ? (0, convergence_js_1.createWorkloadRoleConvergencePlan)({
+            manifest: previousManifest,
+            observedRoles: observed.filter(({ roleName }) => retiredRoleNames.has(roleName)),
+            registration: {
+                candidateIdentity: previousManifest.candidate.identity,
+                manifestDigest: previousHistory.currentManifestDigest,
+                stage: previousManifest.candidate.stage,
+            },
+            request: {
+                candidateIdentity: previousManifest.candidate.identity,
+                manifestDigest: previousHistory.currentManifestDigest,
+                operation: 'remove',
+                stage: previousManifest.candidate.stage,
+            },
+        })
+        : undefined;
+    if (!previousHistory &&
+        plan.operations.some((operation) => operation.kind === 'update' &&
+            (operation.before.candidateIdentity !== manifest.candidate.identity ||
+                operation.before.manifestDigest !== manifestDigest))) {
+        throw new FixedWorkloadRoleProvisionerError('provisioner-history-required', 'A prior candidate workload role cannot be updated without exact v1 history.');
+    }
+    if (retirementPlan?.operations.some((operation) => operation.kind !== 'remove' ||
+        !retiredRoleNames.has(operation.declaration.roleName))) {
+        throw new FixedWorkloadRoleProvisionerError('provisioner-result-substitution', 'Cross-revision retirement selected a role outside the exact dropped-role set.');
+    }
+    for (const operation of plan.operations) {
+        const declaration = operation.kind === 'remove' ? operation.declaration : operation.desired;
+        await applyOperation(options.adapter, operation, mutationFor(declaration, manifestDigest, manifest.candidate.identity, manifest.candidate.stage, bundle));
+    }
+    for (const operation of retirementPlan?.operations ?? []) {
+        await applyOperation(options.adapter, operation);
+    }
+    const operationKinds = [
+        ...plan.operations,
+        ...(retirementPlan?.operations ?? []),
+    ].map(({ kind }) => kind);
+    if (options.request.operation === 'remove') {
+        const remaining = await options.adapter.observeExact(observedRoleNames);
+        if (remaining.length > 0) {
+            throw new FixedWorkloadRoleProvisionerError('provisioner-result-substitution', `Removed workload roles remain observable: ${remaining.map(({ roleName }) => roleName).join(', ')}.`);
+        }
+        return {
+            history,
+            historyDigest: history.historyDigest,
+            manifestDigest,
+            operationKinds,
+            protocolVersion: exports.FIXED_WORKLOAD_ROLE_PROVISIONER_PROTOCOL_VERSION,
+        };
+    }
+    const converged = await options.adapter.observeExact(observedRoleNames);
+    const retiredRemaining = converged.filter(({ roleName }) => retiredRoleNames.has(roleName));
+    if (retiredRemaining.length > 0) {
+        throw new FixedWorkloadRoleProvisionerError('provisioner-result-substitution', `Retired workload roles remain observable: ${retiredRemaining.map(({ roleName }) => roleName).join(', ')}.`);
+    }
+    const observedByName = new Map(converged
+        .filter(({ roleName }) => currentRoleNames.has(roleName))
+        .map((role) => [role.roleName, role]));
+    const missing = manifest.roles.filter(({ roleName }) => !observedByName.has(roleName));
+    if (missing.length > 0 || observedByName.size !== manifest.roles.length) {
+        throw new FixedWorkloadRoleProvisionerError('provisioner-observation-incomplete', `Provisioner result did not contain exactly the registered roles: ${missing.map(({ id }) => id).join(', ') || 'unexpected role count'}.`);
+    }
+    const registration = {
+        candidateIdentity: manifest.candidate.identity,
+        manifestDigest,
+        provisionerFunctionArn: options.provisionerFunctionArn,
+        roles: manifest.roles.map((declaration) => provisionedRole(declaration, observedByName.get(declaration.roleName))),
+        stage: manifest.candidate.stage,
+    };
+    // Reuse the injection contract as the final independently implemented exact
+    // registration check. No partial or substituted result is returned.
+    new injection_js_1.ExactProvisionedWorkloadRoleRegistry(manifest, registration);
+    return {
+        history,
+        historyDigest: history.historyDigest,
+        manifestDigest,
+        operationKinds,
+        protocolVersion: exports.FIXED_WORKLOAD_ROLE_PROVISIONER_PROTOCOL_VERSION,
+        registration,
+    };
+}
+//# sourceMappingURL=provisioner.js.map

package/src/workload-roles/provisioner.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"provisioner.js","sourceRoot":"","sources":["../../../../../packages/nx/src/workload-roles/provisioner.ts"],"names":[],"mappings":";;;AAkIA,sEAaC;AA0GD,kFA4LC;AArbD,qDAO0B;AAE1B,+DAM+B;AAC/B,6CAKsB;AACtB,iDAIwB;AACxB,+CAKuB;AAEV,QAAA,gDAAgD,GAAG,CAAU,CAAC;AAQ3E,MAAa,iCAAkC,SAAQ,KAAK;IAE/C;IADX,YACW,cAAiE,EAC1E,OAAe;QAEf,KAAK,CAAC,OAAO,CAAC,CAAC;QAHN,mBAAc,GAAd,cAAc,CAAmD;QAI1E,IAAI,CAAC,IAAI,GAAG,mCAAmC,CAAC;IAClD,CAAC;CACF;AARD,8EAQC;AAwED,MAAM,mBAAmB,GAAqD;IAC5E,SAAS,EAAE,yBAAyB;IACpC,GAAG,EAAE,mBAAmB;IACxB,UAAU,EAAE,yBAAyB;IACrC,MAAM,EAAE,sBAAsB;IAC9B,gBAAgB,EAAE,sBAAsB;CACzC,CAAC;AAEF,SAAgB,6BAA6B,CAC3C,UAAkC;IAElC,OAAO;QACL,SAAS,EAAE;YACT;gBACE,MAAM,EAAE,gBAAgB;gBACxB,MAAM,EAAE,OAAO;gBACf,SAAS,EAAE,EAAE,OAAO,EAAE,mBAAmB,CAAC,UAAU,CAAC,EAAE;aACxD;SACF;QACD,OAAO,EAAE,YAAY;KACtB,CAAC;AACJ,CAAC;AAED,SAAS,eAAe,CACtB,QAA6D,EAC7D,MAAyC,EACzC,QAAsC;IAEtC,IACE,QAAQ,CAAC,iBAAiB,KAAK,QAAQ,CAAC,SAAS,CAAC,QAAQ;QAC1D,QAAQ,CAAC,KAAK,KAAK,QAAQ,CAAC,SAAS,CAAC,KAAK;QAC3C,MAAM,CAAC,iBAAiB,KAAK,QAAQ,CAAC,SAAS,CAAC,QAAQ;QACxD,MAAM,CAAC,KAAK,KAAK,QAAQ,CAAC,SAAS,CAAC,KAAK;QACzC,QAAQ,CAAC,MAAM,CAAC,IAAI,EAAE,KAAK,EAAE;QAC7B,QAAQ,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC,EAAE,WAAW,EAAE,EAAE,EAAE,CAAC,WAAW,KAAK,QAAQ,CAAC,GAAG,CAAC,EACtE,CAAC;QACD,MAAM,IAAI,iCAAiC,CACzC,mCAAmC,EACnC,mFAAmF,CACpF,CAAC;IACJ,CAAC;AACH,CAAC;AAED,SAAS,WAAW,CAClB,WAAoC,EACpC,cAAsB,EACtB,iBAAyB,EACzB,KAAa,EACb,MAAyC;IAEzC,MAAM,MAAM,GAAG,IAAA,4CAAsB,EAAC,MAAM,EAAE,WAAW,CAAC,EAAE,CAAC,CAAC;IAC9D,OAAO;QACL,gBAAgB,EAAE,6BAA6B,CAAC,WAAW,CAAC,UAAU,CAAC;QACvE,WAAW,EAAE,WAAW,CAAC,WAAW;QACpC,iBAAiB;QACjB,WAAW;QACX,cAAc;QACd,gBAAgB,EAAE,MAAM,CAAC,QAAQ;QACjC,KAAK;QACL,IAAI,EAAE;YACJ,eAAe,EAAE,iBAAiB;YAClC,gBAAgB,EAAE,gDAA+B;YACjD,cAAc,EAAE,cAAc;YAC9B,aAAa,EAAE,WAAW,CAAC,SAAS,CAAC,OAAO;YAC5C,cAAc,EAAE,WAAW,CAAC,SAAS,CAAC,QAAQ;YAC9C,WAAW,EAAE,KAAK;SACnB;KACF,CAAC;AACJ,CAAC;AAED,SAAS,UAAU,CACjB,WAAoC;IAEpC,IAAI,WAAW,CAAC,OAAO,KAAK,yBAAyB,EAAE,CAAC;QACtD,OAAO,SAAS,CAAC;IACnB,CAAC;IACD,OAAO;QACL,mBAAmB,EAAE,GAAG,WAAW,CAAC,QAAQ,UAAU;QACtD,QAAQ,EAAE,WAAW,CAAC,QAAQ;KAC/B,CAAC;AACJ,CAAC;AAED,SAAS,eAAe,CACtB,WAAoC,EACpC,QAA8B;IAE9B,OAAO;QACL,WAAW,EAAE,WAAW,CAAC,WAAW;QACpC,EAAE,EAAE,WAAW,CAAC,EAAE;QAClB,SAAS,EAAE,EAAE,GAAG,WAAW,CAAC,SAAS,EAAE;QACvC,gBAAgB,EAAE,CAAC,GAAG,WAAW,CAAC,gBAAgB,CAAC;QACnD,sBAAsB,EAAE,WAAW,CAAC,sBAAsB;QAC1D,OAAO,EAAE,QAAQ,CAAC,OAAO;QACzB,QAAQ,EAAE,WAAW,CAAC,QAAQ;QAC9B,OAAO,EAAE,WAAW,CAAC,OAAO;QAC5B,UAAU,EAAE,WAAW,CAAC,UAAU;KACnC,CAAC;AACJ,CAAC;AAED,KAAK,UAAU,cAAc,CAC3B,OAA4C,EAC5C,SAA2C,EAC3C,QAAoC;IAEpC,MAAM,WAAW,GACf,SAAS,CAAC,IAAI,KAAK,QAAQ,CAAC,CAAC,CAAC,SAAS,CAAC,WAAW,CAAC,CAAC,CAAC,SAAS,CAAC,OAAO,CAAC;IAC1E,IAAI,SAAS,CAAC,IAAI,KAAK,QAAQ,EAAE,CAAC;QAChC,MAAM,OAAO,CAAC,MAAM,CAAC,SAAS,CAAC,WAAW,EAAE,SAAS,CAAC,MAAM,CAAC,CAAC;QAC9D,OAAO;IACT,CAAC;IACD,IAAI,CAAC,QAAQ,EAAE,CAAC;QACd,MAAM,IAAI,iCAAiC,CACzC,iCAAiC,EACjC,wEAAwE,CACzE,CAAC;IACJ,CAAC;IACD,MAAM,OAAO,GAAG,UAAU,CAAC,WAAW,CAAC,CAAC;IACxC,IAAI,SAAS,CAAC,IAAI,KAAK,QAAQ,EAAE,CAAC;QAChC,MAAM,OAAO,CAAC,MAAM,CAAC,QAAQ,CAAC,CAAC;IACjC,CAAC;SAAM,CAAC;QACN,MAAM,OAAO,CAAC,MAAM,CAAC,QAAQ,EAAE,SAAS,CAAC,MAAM,CAAC,CAAC;IACnD,CAAC;IACD,IAAI,OAAO,EAAE,CAAC;QACZ,MAAM,OAAO,CAAC,wBAAwB,CAAC,OAAO,CAAC,CAAC;IAClD,CAAC;AACH,CAAC;AAEM,KAAK,UAAU,mCAAmC,CACvD,OAAmD;IAEnD,MAAM,QAAQ,GAAG,IAAA,8CAAgC,EAAC,OAAO,CAAC,QAAQ,CAAC,CAAC;IACpE,MAAM,cAAc,GAAG,IAAA,wCAA0B,EAAC,QAAQ,CAAC,CAAC;IAC5D,MAAM,MAAM,GAAG,IAAA,6DAAuC,EAAC;QACrD,aAAa,EAAE,OAAO,CAAC,aAAa;QACpC,QAAQ;KACT,CAAC,CAAC;IACH,eAAe,CAAC,QAAQ,EAAE,MAAM,EAAE,OAAO,CAAC,QAAQ,CAAC,CAAC;IACpD,MAAM,eAAe,GACnB,OAAO,CAAC,OAAO,KAAK,SAAS;QAC3B,CAAC,CAAC,SAAS;QACX,CAAC,CAAC,IAAA,uCAA0B,EAAC,OAAO,CAAC,OAAO,CAAC,CAAC;IAClD,MAAM,OAAO,GAAG,IAAA,uCAA0B,EAAC;QACzC,QAAQ;QACR,GAAG,CAAC,eAAe,CAAC,CAAC,CAAC,EAAE,QAAQ,EAAE,eAAe,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;KAC1D,CAAC,CAAC;IACH,MAAM,gBAAgB,GAAG,eAAe;QACtC,CAAC,CAAC,IAAA,4CAA+B,EAAC,eAAe,CAAC;QAClD,CAAC,CAAC,SAAS,CAAC;IACd,MAAM,WAAW,GAAG,IAAI,GAAG,CACzB,QAAQ,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,WAAW,EAAE,EAAE,CAAC,CAAC,WAAW,CAAC,EAAE,EAAE,WAAW,CAAC,CAAC,CACnE,CAAC;IACF,MAAM,mBAAmB,GACvB,gBAAgB,EAAE,KAAK,CAAC,MAAM,CAC5B,CAAC,WAAW,EAAE,EAAE,CACd,WAAW,CAAC,GAAG,CAAC,WAAW,CAAC,EAAE,CAAC,EAAE,QAAQ,KAAK,WAAW,CAAC,QAAQ,CACrE,IAAI,EAAE,CAAC;IACV,MAAM,gBAAgB,GAAG,IAAI,GAAG,CAC9B,QAAQ,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,EAAE,QAAQ,EAAE,EAAE,EAAE,CAAC,QAAQ,CAAC,CAC/C,CAAC;IACF,MAAM,gBAAgB,GAAG,IAAI,GAAG,CAC9B,mBAAmB,CAAC,GAAG,CAAC,CAAC,EAAE,QAAQ,EAAE,EAAE,EAAE,CAAC,QAAQ,CAAC,CACpD,CAAC;IACF,MAAM,iBAAiB,GAAG;QACxB,GAAG,IAAI,GAAG,CAAC,CAAC,GAAG,gBAAgB,EAAE,GAAG,gBAAgB,CAAC,CAAC;KACvD,CAAC,IAAI,EAAE,CAAC;IAET,4EAA4E;IAC5E,sEAAsE;IACtE,MAAM,QAAQ,GAAG,MAAM,OAAO,CAAC,OAAO,CAAC,YAAY,CAAC,iBAAiB,CAAC,CAAC;IACvE,IAAI,QAAQ,CAAC,IAAI,CAAC,CAAC,EAAE,QAAQ,EAAE,EAAE,EAAE,CAAC,CAAC,iBAAiB,CAAC,QAAQ,CAAC,QAAQ,CAAC,CAAC,EAAE,CAAC;QAC3E,MAAM,IAAI,iCAAiC,CACzC,oCAAoC,EACpC,qEAAqE,CACtE,CAAC;IACJ,CAAC;IACD,MAAM,IAAI,GAAG,IAAA,kDAAiC,EAAC;QAC7C,QAAQ;QACR,aAAa,EAAE,QAAQ,CAAC,MAAM,CAAC,CAAC,EAAE,QAAQ,EAAE,EAAE,EAAE,CAC9C,gBAAgB,CAAC,GAAG,CAAC,QAAQ,CAAC,CAC/B;QACD,YAAY,EAAE,OAAO,CAAC,YAAY;QAClC,OAAO,EAAE,OAAO,CAAC,OAAO;KACzB,CAAC,CAAC;IACH,MAAM,cAAc,GAClB,gBAAgB,IAAI,eAAe,IAAI,mBAAmB,CAAC,MAAM,GAAG,CAAC;QACnE,CAAC,CAAC,IAAA,kDAAiC,EAAC;YAChC,QAAQ,EAAE,gBAAgB;YAC1B,aAAa,EAAE,QAAQ,CAAC,MAAM,CAAC,CAAC,EAAE,QAAQ,EAAE,EAAE,EAAE,CAC9C,gBAAgB,CAAC,GAAG,CAAC,QAAQ,CAAC,CAC/B;YACD,YAAY,EAAE;gBACZ,iBAAiB,EAAE,gBAAgB,CAAC,SAAS,CAAC,QAAQ;gBACtD,cAAc,EAAE,eAAe,CAAC,qBAAqB;gBACrD,KAAK,EAAE,gBAAgB,CAAC,SAAS,CAAC,KAAK;aACxC;YACD,OAAO,EAAE;gBACP,iBAAiB,EAAE,gBAAgB,CAAC,SAAS,CAAC,QAAQ;gBACtD,cAAc,EAAE,eAAe,CAAC,qBAAqB;gBACrD,SAAS,EAAE,QAAQ;gBACnB,KAAK,EAAE,gBAAgB,CAAC,SAAS,CAAC,KAAK;aACxC;SACF,CAAC;QACJ,CAAC,CAAC,SAAS,CAAC;IAChB,IACE,CAAC,eAAe;QAChB,IAAI,CAAC,UAAU,CAAC,IAAI,CAClB,CAAC,SAAS,EAAE,EAAE,CACZ,SAAS,CAAC,IAAI,KAAK,QAAQ;YAC3B,CAAC,SAAS,CAAC,MAAM,CAAC,iBAAiB,KAAK,QAAQ,CAAC,SAAS,CAAC,QAAQ;gBACjE,SAAS,CAAC,MAAM,CAAC,cAAc,KAAK,cAAc,CAAC,CACxD,EACD,CAAC;QACD,MAAM,IAAI,iCAAiC,CACzC,8BAA8B,EAC9B,6EAA6E,CAC9E,CAAC;IACJ,CAAC;IACD,IACE,cAAc,EAAE,UAAU,CAAC,IAAI,CAC7B,CAAC,SAAS,EAAE,EAAE,CACZ,SAAS,CAAC,IAAI,KAAK,QAAQ;QAC3B,CAAC,gBAAgB,CAAC,GAAG,CAAC,SAAS,CAAC,WAAW,CAAC,QAAQ,CAAC,CACxD,EACD,CAAC;QACD,MAAM,IAAI,iCAAiC,CACzC,iCAAiC,EACjC,+EAA+E,CAChF,CAAC;IACJ,CAAC;IACD,KAAK,MAAM,SAAS,IAAI,IAAI,CAAC,UAAU,EAAE,CAAC;QACxC,MAAM,WAAW,GACf,SAAS,CAAC,IAAI,KAAK,QAAQ,CAAC,CAAC,CAAC,SAAS,CAAC,WAAW,CAAC,CAAC,CAAC,SAAS,CAAC,OAAO,CAAC;QAC1E,MAAM,cAAc,CAClB,OAAO,CAAC,OAAO,EACf,SAAS,EACT,WAAW,CACT,WAAW,EACX,cAAc,EACd,QAAQ,CAAC,SAAS,CAAC,QAAQ,EAC3B,QAAQ,CAAC,SAAS,CAAC,KAAK,EACxB,MAAM,CACP,CACF,CAAC;IACJ,CAAC;IACD,KAAK,MAAM,SAAS,IAAI,cAAc,EAAE,UAAU,IAAI,EAAE,EAAE,CAAC;QACzD,MAAM,cAAc,CAAC,OAAO,CAAC,OAAO,EAAE,SAAS,CAAC,CAAC;IACnD,CAAC;IACD,MAAM,cAAc,GAAG;QACrB,GAAG,IAAI,CAAC,UAAU;QAClB,GAAG,CAAC,cAAc,EAAE,UAAU,IAAI,EAAE,CAAC;KACtC,CAAC,GAAG,CAAC,CAAC,EAAE,IAAI,EAAE,EAAE,EAAE,CAAC,IAAI,CAAC,CAAC;IAC1B,IAAI,OAAO,CAAC,OAAO,CAAC,SAAS,KAAK,QAAQ,EAAE,CAAC;QAC3C,MAAM,SAAS,GAAG,MAAM,OAAO,CAAC,OAAO,CAAC,YAAY,CAAC,iBAAiB,CAAC,CAAC;QACxE,IAAI,SAAS,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;YACzB,MAAM,IAAI,iCAAiC,CACzC,iCAAiC,EACjC,6CAA6C,SAAS,CAAC,GAAG,CAAC,CAAC,EAAE,QAAQ,EAAE,EAAE,EAAE,CAAC,QAAQ,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,GAAG,CACrG,CAAC;QACJ,CAAC;QACD,OAAO;YACL,OAAO;YACP,aAAa,EAAE,OAAO,CAAC,aAAa;YACpC,cAAc;YACd,cAAc;YACd,eAAe,EAAE,wDAAgD;SAClE,CAAC;IACJ,CAAC;IAED,MAAM,SAAS,GAAG,MAAM,OAAO,CAAC,OAAO,CAAC,YAAY,CAAC,iBAAiB,CAAC,CAAC;IACxE,MAAM,gBAAgB,GAAG,SAAS,CAAC,MAAM,CAAC,CAAC,EAAE,QAAQ,EAAE,EAAE,EAAE,CACzD,gBAAgB,CAAC,GAAG,CAAC,QAAQ,CAAC,CAC/B,CAAC;IACF,IAAI,gBAAgB,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;QAChC,MAAM,IAAI,iCAAiC,CACzC,iCAAiC,EACjC,6CAA6C,gBAAgB,CAAC,GAAG,CAAC,CAAC,EAAE,QAAQ,EAAE,EAAE,EAAE,CAAC,QAAQ,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,GAAG,CAC5G,CAAC;IACJ,CAAC;IACD,MAAM,cAAc,GAAG,IAAI,GAAG,CAC5B,SAAS;SACN,MAAM,CAAC,CAAC,EAAE,QAAQ,EAAE,EAAE,EAAE,CAAC,gBAAgB,CAAC,GAAG,CAAC,QAAQ,CAAC,CAAC;SACxD,GAAG,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,CAAC,IAAI,CAAC,QAAQ,EAAE,IAAI,CAAC,CAAC,CACxC,CAAC;IACF,MAAM,OAAO,GAAG,QAAQ,CAAC,KAAK,CAAC,MAAM,CACnC,CAAC,EAAE,QAAQ,EAAE,EAAE,EAAE,CAAC,CAAC,cAAc,CAAC,GAAG,CAAC,QAAQ,CAAC,CAChD,CAAC;IACF,IAAI,OAAO,CAAC,MAAM,GAAG,CAAC,IAAI,cAAc,CAAC,IAAI,KAAK,QAAQ,CAAC,KAAK,CAAC,MAAM,EAAE,CAAC;QACxE,MAAM,IAAI,iCAAiC,CACzC,oCAAoC,EACpC,oEAAoE,OAAO,CAAC,GAAG,CAAC,CAAC,EAAE,EAAE,EAAE,EAAE,EAAE,CAAC,EAAE,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,IAAI,uBAAuB,GAAG,CACzI,CAAC;IACJ,CAAC;IACD,MAAM,YAAY,GAAwC;QACxD,iBAAiB,EAAE,QAAQ,CAAC,SAAS,CAAC,QAAQ;QAC9C,cAAc;QACd,sBAAsB,EAAE,OAAO,CAAC,sBAAsB;QACtD,KAAK,EAAE,QAAQ,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,WAAW,EAAE,EAAE,CACxC,eAAe,CACb,WAAW,EACX,cAAc,CAAC,GAAG,CAAC,WAAW,CAAC,QAAQ,CAAyB,CACjE,CACF;QACD,KAAK,EAAE,QAAQ,CAAC,SAAS,CAAC,KAAK;KAChC,CAAC;IACF,4EAA4E;IAC5E,oEAAoE;IACpE,IAAI,mDAAoC,CAAC,QAAQ,EAAE,YAAY,CAAC,CAAC;IACjE,OAAO;QACL,OAAO;QACP,aAAa,EAAE,OAAO,CAAC,aAAa;QACpC,cAAc;QACd,cAAc;QACd,eAAe,EAAE,wDAAgD;QACjE,YAAY;KACb,CAAC;AACJ,CAAC"}

package/src/workload-roles/registration.d.ts

@@ -0,0 +1,101 @@
+import { type DeploymentRoleAuthorityPlan } from './authority.js';
+import { type WorkloadRoleBoundaryContract } from './boundary.js';
+import { type WorkloadRoleManifestRegistration, type WorkloadRoleProvisionerRequest } from './convergence.js';
+import { type WorkloadRolePermissionIntent } from './effective-policy.js';
+import { ExactProvisionedWorkloadRoleRegistry, type ProvisionedWorkloadRoleRegistration } from './injection.js';
+import { type WorkloadRoleManifest } from './manifest.js';
+export declare const REGISTERED_WORKLOAD_ROLE_MANIFEST_SCHEMA_VERSION: 1;
+export declare const PROVISIONED_WORKLOAD_ROLE_REGISTRATION_SCHEMA_VERSION: 1;
+export declare const WORKLOAD_ROLE_STORAGE_REGISTRATION_SCHEMA_VERSION: 1;
+export type WorkloadRoleRegistrationFailureClassification = 'provisioned-registration-invalid' | 'registered-manifest-invalid' | 'registered-manifest-substitution' | 'registered-request-invalid' | 'registered-request-substitution';
+export declare class WorkloadRoleRegistrationError extends Error {
+    readonly classification: WorkloadRoleRegistrationFailureClassification;
+    constructor(classification: WorkloadRoleRegistrationFailureClassification, message: string);
+}
+export interface RegisteredWorkloadRoleManifestDocument {
+    accountId: string;
+    intentsByRole: Readonly<Record<string, readonly WorkloadRolePermissionIntent[]>>;
+    manifest: WorkloadRoleManifest;
+    manifestDigest: string;
+    partition: 'aws' | 'aws-cn' | 'aws-us-gov';
+    project: string;
+    provisionerFunctionArn: string;
+    schemaVersion: typeof REGISTERED_WORKLOAD_ROLE_MANIFEST_SCHEMA_VERSION;
+}
+export interface ProvisionedWorkloadRoleRegistrationDocument {
+    registration: ProvisionedWorkloadRoleRegistration;
+    schemaVersion: typeof PROVISIONED_WORKLOAD_ROLE_REGISTRATION_SCHEMA_VERSION;
+}
+export interface WorkloadRoleStorageRegistration {
+    bucketName: string;
+    candidateIdentity: string;
+    manifestDigest: string;
+    project: string;
+    provisionerFunctionArn: string;
+    schemaVersion: typeof WORKLOAD_ROLE_STORAGE_REGISTRATION_SCHEMA_VERSION;
+    stage: string;
+}
+export interface FixedRegisteredManifestSource {
+    /**
+     * Loads one baseline-selected value. The invocation request cannot supply a
+     * path, parameter name, object key, manifest, policy, or role identity.
+     */
+    load(): Promise<unknown>;
+}
+export interface LoadedFixedWorkloadRoleProvisionerRequest {
+    boundary: WorkloadRoleBoundaryContract;
+    document: RegisteredWorkloadRoleManifestDocument;
+    registration: WorkloadRoleManifestRegistration;
+    request: WorkloadRoleProvisionerRequest;
+}
+export interface WorkloadRolePreflight {
+    authorityPlan: DeploymentRoleAuthorityPlan;
+    document: RegisteredWorkloadRoleManifestDocument;
+    registry: ExactProvisionedWorkloadRoleRegistry;
+    storage: WorkloadRoleStorageRegistration;
+}
+export declare function requireRegisteredWorkloadRoleManifestDocument(value: unknown): RegisteredWorkloadRoleManifestDocument;
+export declare function createRegisteredWorkloadRoleManifestDocument(options: {
+    accountId: string;
+    intentsByRole: Readonly<Record<string, readonly WorkloadRolePermissionIntent[]>>;
+    manifest: unknown;
+    partition: string;
+    project: string;
+    provisionerFunctionArn: string;
+}): RegisteredWorkloadRoleManifestDocument;
+export declare function requireProvisionedWorkloadRoleRegistrationDocument(value: unknown): ProvisionedWorkloadRoleRegistrationDocument;
+export declare function workloadRoleStorageRegistrationPath(stage: string, project: string): string;
+export declare function registeredWorkloadRoleManifestObjectKey(options: {
+    manifestDigest: string;
+    project: string;
+    provisionerFunctionArn: string;
+    stage: string;
+}): string;
+export declare function provisionedWorkloadRoleRegistrationObjectKey(options: {
+    manifestDigest: string;
+    project: string;
+    provisionerFunctionArn: string;
+    stage: string;
+}): string;
+export declare function workloadRoleHistoryObjectKey(stage: string, project: string): string;
+export declare function requireWorkloadRoleStorageRegistration(value: unknown): WorkloadRoleStorageRegistration;
+export declare function createWorkloadRoleStorageRegistration(options: {
+    bucketName: string;
+    candidateIdentity: string;
+    manifestDigest: string;
+    project: string;
+    provisionerFunctionArn: string;
+    stage: string;
+}): WorkloadRoleStorageRegistration;
+export declare function loadFixedWorkloadRoleProvisionerRequest(options: {
+    request: unknown;
+    source: FixedRegisteredManifestSource;
+}): Promise<LoadedFixedWorkloadRoleProvisionerRequest>;
+export declare function validateWorkloadRolePreflight(options: {
+    expectedCandidateIdentity: string;
+    expectedProject: string;
+    expectedStage: string;
+    provisionedRegistration: unknown;
+    registeredManifest: unknown;
+    storageRegistration: unknown;
+}): WorkloadRolePreflight;