@empire-builder-kit/nx 1.0.0-beta.9 → 1.0.0-rc.2

package/src/workload-roles/registration.js

@@ -0,0 +1,457 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.WorkloadRoleRegistrationError = exports.WORKLOAD_ROLE_STORAGE_REGISTRATION_SCHEMA_VERSION = exports.PROVISIONED_WORKLOAD_ROLE_REGISTRATION_SCHEMA_VERSION = exports.REGISTERED_WORKLOAD_ROLE_MANIFEST_SCHEMA_VERSION = void 0;
+exports.requireRegisteredWorkloadRoleManifestDocument = requireRegisteredWorkloadRoleManifestDocument;
+exports.createRegisteredWorkloadRoleManifestDocument = createRegisteredWorkloadRoleManifestDocument;
+exports.requireProvisionedWorkloadRoleRegistrationDocument = requireProvisionedWorkloadRoleRegistrationDocument;
+exports.workloadRoleStorageRegistrationPath = workloadRoleStorageRegistrationPath;
+exports.registeredWorkloadRoleManifestObjectKey = registeredWorkloadRoleManifestObjectKey;
+exports.provisionedWorkloadRoleRegistrationObjectKey = provisionedWorkloadRoleRegistrationObjectKey;
+exports.workloadRoleHistoryObjectKey = workloadRoleHistoryObjectKey;
+exports.requireWorkloadRoleStorageRegistration = requireWorkloadRoleStorageRegistration;
+exports.createWorkloadRoleStorageRegistration = createWorkloadRoleStorageRegistration;
+exports.loadFixedWorkloadRoleProvisionerRequest = loadFixedWorkloadRoleProvisionerRequest;
+exports.validateWorkloadRolePreflight = validateWorkloadRolePreflight;
+const node_crypto_1 = require("node:crypto");
+const authority_js_1 = require("./authority.js");
+const boundary_js_1 = require("./boundary.js");
+const convergence_js_1 = require("./convergence.js");
+const effective_policy_js_1 = require("./effective-policy.js");
+const injection_js_1 = require("./injection.js");
+const manifest_js_1 = require("./manifest.js");
+exports.REGISTERED_WORKLOAD_ROLE_MANIFEST_SCHEMA_VERSION = 1;
+exports.PROVISIONED_WORKLOAD_ROLE_REGISTRATION_SCHEMA_VERSION = 1;
+exports.WORKLOAD_ROLE_STORAGE_REGISTRATION_SCHEMA_VERSION = 1;
+class WorkloadRoleRegistrationError extends Error {
+    classification;
+    constructor(classification, message) {
+        super(message);
+        this.classification = classification;
+        this.name = 'WorkloadRoleRegistrationError';
+    }
+}
+exports.WorkloadRoleRegistrationError = WorkloadRoleRegistrationError;
+const accountPattern = /^\d{12}$/;
+const digestPattern = /^[a-f0-9]{64}$/;
+const identifierPattern = /^(?:[a-z0-9][a-z0-9._-]{0,127}|@[a-z0-9][a-z0-9._-]{0,62}\/[a-z0-9][a-z0-9._-]{0,63})$/;
+const qualifiedLambdaArnPattern = /^arn:(aws|aws-us-gov|aws-cn):lambda:([a-z0-9-]+):(\d{12}):function:[A-Za-z0-9-_]+:[A-Za-z0-9-_]+$/;
+const roleArnPattern = /^arn:(aws|aws-us-gov|aws-cn):iam::(\d{12}):role\/([A-Za-z0-9+=,.@_-]{1,64})$/;
+const boundaryArnPattern = /^arn:(aws|aws-us-gov|aws-cn):iam::\d{12}:policy\/[A-Za-z0-9+=,.@_/-]+$/;
+const servicePrincipalPattern = /^[a-z0-9](?:[a-z0-9-]*\.)+[a-z0-9-]+$/;
+const bucketNamePattern = /^(?!\d{1,3}(?:\.\d{1,3}){3}$)[a-z0-9][a-z0-9.-]{1,61}[a-z0-9]$/;
+function isRecord(value) {
+    return typeof value === 'object' && value !== null && !Array.isArray(value);
+}
+function compareStrings(left, right) {
+    return left < right ? -1 : left > right ? 1 : 0;
+}
+function rejectUnexpectedProperties(value, allowed, label, classification) {
+    const unexpected = Object.keys(value).filter((property) => !allowed.includes(property));
+    if (unexpected.length > 0) {
+        throw new WorkloadRoleRegistrationError(classification, `${label} contains unsupported properties: ${unexpected.sort(compareStrings).join(', ')}.`);
+    }
+}
+function requireString(value, pattern, label, classification) {
+    if (typeof value !== 'string' || !pattern.test(value)) {
+        throw new WorkloadRoleRegistrationError(classification, `${label} is invalid.`);
+    }
+    return value;
+}
+function requireIntentSource(value, label) {
+    if (!isRecord(value)) {
+        throw new WorkloadRoleRegistrationError('registered-manifest-invalid', `${label} must be an object.`);
+    }
+    rejectUnexpectedProperties(value, ['kind', 'name'], label, 'registered-manifest-invalid');
+    return {
+        kind: requireString(value.kind, /^(framework|link|permissions|secret-link)$/, `${label}.kind`, 'registered-manifest-invalid'),
+        name: requireString(value.name, /^[A-Za-z0-9][A-Za-z0-9._/@:-]{0,255}$/, `${label}.name`, 'registered-manifest-invalid'),
+    };
+}
+function requireConditionValue(value, label) {
+    if (typeof value === 'string') {
+        return value;
+    }
+    if (Array.isArray(value) &&
+        value.length > 0 &&
+        value.every((entry) => typeof entry === 'string')) {
+        return [...value];
+    }
+    throw new WorkloadRoleRegistrationError('registered-manifest-invalid', `${label} must be a string or non-empty string array.`);
+}
+function requireConditions(value, label) {
+    if (value === undefined) {
+        return undefined;
+    }
+    if (!isRecord(value) || Object.keys(value).length === 0) {
+        throw new WorkloadRoleRegistrationError('registered-manifest-invalid', `${label} must be a non-empty object.`);
+    }
+    return Object.fromEntries(Object.keys(value)
+        .sort(compareStrings)
+        .map((operator) => {
+        const entries = value[operator];
+        if (!isRecord(entries) || Object.keys(entries).length === 0) {
+            throw new WorkloadRoleRegistrationError('registered-manifest-invalid', `${label}.${operator} must be a non-empty object.`);
+        }
+        return [
+            operator,
+            Object.fromEntries(Object.keys(entries)
+                .sort(compareStrings)
+                .map((key) => [
+                key,
+                requireConditionValue(entries[key], `${label}.${operator}.${key}`),
+            ])),
+        ];
+    }));
+}
+function requireStringArray(value, label, classification = 'registered-manifest-invalid') {
+    if (!Array.isArray(value) ||
+        value.length === 0 ||
+        value.some((entry) => typeof entry !== 'string')) {
+        throw new WorkloadRoleRegistrationError(classification, `${label} must be a non-empty string array.`);
+    }
+    return [...value];
+}
+function requirePermissionIntent(value, label) {
+    if (!isRecord(value)) {
+        throw new WorkloadRoleRegistrationError('registered-manifest-invalid', `${label} must be an object.`);
+    }
+    rejectUnexpectedProperties(value, [
+        'actions',
+        'conditions',
+        'id',
+        'resources',
+        'source',
+        'wildcardResourceJustification',
+    ], label, 'registered-manifest-invalid');
+    const conditions = requireConditions(value.conditions, `${label}.conditions`);
+    const wildcardResourceJustification = value.wildcardResourceJustification === undefined
+        ? undefined
+        : requireString(value.wildcardResourceJustification, /^.{20,}$/, `${label}.wildcardResourceJustification`, 'registered-manifest-invalid');
+    return {
+        actions: requireStringArray(value.actions, `${label}.actions`),
+        ...(conditions ? { conditions } : {}),
+        id: requireString(value.id, /^[a-z0-9][a-z0-9._-]{0,127}$/, `${label}.id`, 'registered-manifest-invalid'),
+        resources: requireStringArray(value.resources, `${label}.resources`),
+        source: requireIntentSource(value.source, `${label}.source`),
+        ...(wildcardResourceJustification ? { wildcardResourceJustification } : {}),
+    };
+}
+function requireIntentsByRole(value) {
+    if (!isRecord(value)) {
+        throw new WorkloadRoleRegistrationError('registered-manifest-invalid', 'Registered intentsByRole must be an object.');
+    }
+    return Object.fromEntries(Object.keys(value)
+        .sort(compareStrings)
+        .map((roleId) => {
+        const intents = value[roleId];
+        if (!Array.isArray(intents)) {
+            throw new WorkloadRoleRegistrationError('registered-manifest-invalid', `Registered intentsByRole.${roleId} must be an array.`);
+        }
+        return [
+            roleId,
+            intents.map((intent, index) => requirePermissionIntent(intent, `intentsByRole.${roleId}[${index}]`)),
+        ];
+    }));
+}
+function requireRegisteredWorkloadRoleManifestDocument(value) {
+    if (!isRecord(value)) {
+        throw new WorkloadRoleRegistrationError('registered-manifest-invalid', 'Registered workload-role manifest must be an object.');
+    }
+    rejectUnexpectedProperties(value, [
+        'accountId',
+        'intentsByRole',
+        'manifest',
+        'manifestDigest',
+        'partition',
+        'project',
+        'provisionerFunctionArn',
+        'schemaVersion',
+    ], 'Registered workload-role manifest', 'registered-manifest-invalid');
+    if (value.schemaVersion !== exports.REGISTERED_WORKLOAD_ROLE_MANIFEST_SCHEMA_VERSION) {
+        throw new WorkloadRoleRegistrationError('registered-manifest-invalid', `Registered workload-role manifest schemaVersion must equal ${exports.REGISTERED_WORKLOAD_ROLE_MANIFEST_SCHEMA_VERSION}.`);
+    }
+    const accountId = requireString(value.accountId, accountPattern, 'Registered accountId', 'registered-manifest-invalid');
+    const partition = requireString(value.partition, /^(aws|aws-cn|aws-us-gov)$/, 'Registered partition', 'registered-manifest-invalid');
+    const project = requireString(value.project, identifierPattern, 'Registered project', 'registered-manifest-invalid');
+    const provisionerFunctionArn = requireString(value.provisionerFunctionArn, qualifiedLambdaArnPattern, 'Registered provisionerFunctionArn', 'registered-manifest-invalid');
+    const provisionerMatch = qualifiedLambdaArnPattern.exec(provisionerFunctionArn);
+    if (!provisionerMatch ||
+        provisionerMatch[1] !== partition ||
+        provisionerMatch[3] !== accountId) {
+        throw new WorkloadRoleRegistrationError('registered-manifest-substitution', 'Registered provisioner function is not in the registered account and partition.');
+    }
+    let manifest;
+    try {
+        manifest = (0, manifest_js_1.canonicalizeWorkloadRoleManifest)(value.manifest);
+    }
+    catch {
+        throw new WorkloadRoleRegistrationError('registered-manifest-invalid', 'Registered workload-role manifest payload is invalid.');
+    }
+    const manifestDigest = requireString(value.manifestDigest, digestPattern, 'Registered manifestDigest', 'registered-manifest-invalid');
+    if ((0, manifest_js_1.digestWorkloadRoleManifest)(manifest) !== manifestDigest) {
+        throw new WorkloadRoleRegistrationError('registered-manifest-substitution', 'Registered manifest digest does not match the canonical manifest.');
+    }
+    const substitutedProjects = manifest.roles.filter(({ ownership }) => ownership.project !== project);
+    if (substitutedProjects.length > 0) {
+        throw new WorkloadRoleRegistrationError('registered-manifest-substitution', 'Registered manifest contains roles owned by another project.');
+    }
+    const intentsByRole = requireIntentsByRole(value.intentsByRole);
+    const bundle = (0, effective_policy_js_1.createWorkloadRoleEffectivePolicyBundle)({
+        intentsByRole,
+        manifest,
+    });
+    (0, boundary_js_1.createWorkloadRoleBoundaryContract)({
+        accountId,
+        bundle,
+        manifest,
+        partition,
+        stage: manifest.candidate.stage,
+    });
+    return {
+        accountId,
+        intentsByRole,
+        manifest,
+        manifestDigest,
+        partition,
+        project,
+        provisionerFunctionArn,
+        schemaVersion: exports.REGISTERED_WORKLOAD_ROLE_MANIFEST_SCHEMA_VERSION,
+    };
+}
+function createRegisteredWorkloadRoleManifestDocument(options) {
+    const manifest = (0, manifest_js_1.canonicalizeWorkloadRoleManifest)(options.manifest);
+    return requireRegisteredWorkloadRoleManifestDocument({
+        accountId: options.accountId,
+        intentsByRole: options.intentsByRole,
+        manifest,
+        manifestDigest: (0, manifest_js_1.digestWorkloadRoleManifest)(manifest),
+        partition: options.partition,
+        project: options.project,
+        provisionerFunctionArn: options.provisionerFunctionArn,
+        schemaVersion: exports.REGISTERED_WORKLOAD_ROLE_MANIFEST_SCHEMA_VERSION,
+    });
+}
+function requireProvisionedRole(value, index) {
+    if (!isRecord(value)) {
+        throw new WorkloadRoleRegistrationError('provisioned-registration-invalid', `Provisioned role ${index} must be an object.`);
+    }
+    rejectUnexpectedProperties(value, [
+        'boundaryArn',
+        'id',
+        'ownership',
+        'passDestinations',
+        'permissionPolicyDigest',
+        'roleArn',
+        'roleName',
+        'surface',
+        'trustClass',
+    ], `Provisioned role ${index}`, 'provisioned-registration-invalid');
+    if (!isRecord(value.ownership)) {
+        throw new WorkloadRoleRegistrationError('provisioned-registration-invalid', `Provisioned role ${index} ownership must be an object.`);
+    }
+    rejectUnexpectedProperties(value.ownership, ['project', 'resource'], `Provisioned role ${index} ownership`, 'provisioned-registration-invalid');
+    const boundaryArn = requireString(value.boundaryArn, boundaryArnPattern, `Provisioned role ${index} boundaryArn`, 'provisioned-registration-invalid');
+    const id = requireString(value.id, /^[a-z0-9][a-z0-9._-]{0,127}$/, `Provisioned role ${index} id`, 'provisioned-registration-invalid');
+    const project = requireString(value.ownership.project, identifierPattern, `Provisioned role ${index} ownership.project`, 'provisioned-registration-invalid');
+    const resource = requireString(value.ownership.resource, /^[a-z0-9][a-z0-9._-]{0,127}$/, `Provisioned role ${index} ownership.resource`, 'provisioned-registration-invalid');
+    const passDestinations = requireStringArray(value.passDestinations, `Provisioned role ${index} passDestinations`, 'provisioned-registration-invalid');
+    if (passDestinations.some((destination) => !servicePrincipalPattern.test(destination))) {
+        throw new WorkloadRoleRegistrationError('provisioned-registration-invalid', `Provisioned role ${index} passDestinations are invalid.`);
+    }
+    const permissionPolicyDigest = requireString(value.permissionPolicyDigest, digestPattern, `Provisioned role ${index} permissionPolicyDigest`, 'provisioned-registration-invalid');
+    const roleArn = requireString(value.roleArn, roleArnPattern, `Provisioned role ${index} roleArn`, 'provisioned-registration-invalid');
+    const roleName = requireString(value.roleName, /^[A-Za-z0-9+=,.@_-]{1,64}$/, `Provisioned role ${index} roleName`, 'provisioned-registration-invalid');
+    const surface = requireString(value.surface, new RegExp(`^(${manifest_js_1.WORKLOAD_ROLE_SURFACES.join('|')})$`), `Provisioned role ${index} surface`, 'provisioned-registration-invalid');
+    const trustClass = requireString(value.trustClass, new RegExp(`^(${manifest_js_1.WORKLOAD_ROLE_TRUST_CLASSES.join('|')})$`), `Provisioned role ${index} trustClass`, 'provisioned-registration-invalid');
+    return {
+        boundaryArn,
+        id,
+        ownership: { project, resource },
+        passDestinations,
+        permissionPolicyDigest,
+        roleArn,
+        roleName,
+        surface,
+        trustClass,
+    };
+}
+function requireProvisionedWorkloadRoleRegistrationDocument(value) {
+    if (!isRecord(value)) {
+        throw new WorkloadRoleRegistrationError('provisioned-registration-invalid', 'Provisioned workload-role registration must be an object.');
+    }
+    rejectUnexpectedProperties(value, ['registration', 'schemaVersion'], 'Provisioned workload-role registration', 'provisioned-registration-invalid');
+    if (value.schemaVersion !==
+        exports.PROVISIONED_WORKLOAD_ROLE_REGISTRATION_SCHEMA_VERSION) {
+        throw new WorkloadRoleRegistrationError('provisioned-registration-invalid', `Provisioned registration schemaVersion must equal ${exports.PROVISIONED_WORKLOAD_ROLE_REGISTRATION_SCHEMA_VERSION}.`);
+    }
+    if (!isRecord(value.registration)) {
+        throw new WorkloadRoleRegistrationError('provisioned-registration-invalid', 'Provisioned registration payload must be an object.');
+    }
+    const registration = value.registration;
+    rejectUnexpectedProperties(registration, [
+        'candidateIdentity',
+        'manifestDigest',
+        'provisionerFunctionArn',
+        'roles',
+        'stage',
+    ], 'Provisioned registration payload', 'provisioned-registration-invalid');
+    if (!Array.isArray(registration.roles) || registration.roles.length === 0) {
+        throw new WorkloadRoleRegistrationError('provisioned-registration-invalid', 'Provisioned registration roles must be an array.');
+    }
+    return {
+        registration: {
+            candidateIdentity: requireString(registration.candidateIdentity, /^[a-z0-9][a-z0-9._-]{0,127}$/, 'Provisioned registration candidateIdentity', 'provisioned-registration-invalid'),
+            manifestDigest: requireString(registration.manifestDigest, digestPattern, 'Provisioned registration manifestDigest', 'provisioned-registration-invalid'),
+            provisionerFunctionArn: requireString(registration.provisionerFunctionArn, qualifiedLambdaArnPattern, 'Provisioned registration provisionerFunctionArn', 'provisioned-registration-invalid'),
+            roles: registration.roles.map(requireProvisionedRole),
+            stage: requireString(registration.stage, /^[a-z0-9][a-z0-9._-]{0,127}$/, 'Provisioned registration stage', 'provisioned-registration-invalid'),
+        },
+        schemaVersion: exports.PROVISIONED_WORKLOAD_ROLE_REGISTRATION_SCHEMA_VERSION,
+    };
+}
+function workloadRoleStorageRegistrationPath(stage, project) {
+    requireString(stage, /^[a-z0-9][a-z0-9-]{0,62}$/, 'Workload-role registration stage', 'registered-manifest-invalid');
+    requireString(project, identifierPattern, 'Workload-role registration project', 'registered-manifest-invalid');
+    return `/ebk/${stage}/workload-roles/${project}/storage-registration`;
+}
+function workloadRoleObjectPrefix(stage, project) {
+    const registeredStage = requireString(stage, /^[a-z0-9][a-z0-9-]{0,62}$/, 'Workload-role registration stage', 'registered-manifest-invalid');
+    return `ebk/${registeredStage}/workload-roles/${requireString(project, identifierPattern, 'Workload-role registration project', 'registered-manifest-invalid')}`;
+}
+function registeredWorkloadRoleManifestObjectKey(options) {
+    const manifestDigest = requireString(options.manifestDigest, digestPattern, 'Workload-role manifest object digest', 'registered-manifest-invalid');
+    const provisionerDigest = (0, node_crypto_1.createHash)('sha256')
+        .update(requireString(options.provisionerFunctionArn, qualifiedLambdaArnPattern, 'Registered workload-role object provisioner', 'registered-manifest-invalid'), 'utf8')
+        .digest('hex');
+    return `${workloadRoleObjectPrefix(options.stage, options.project)}/candidates/${manifestDigest}/provisioners/${provisionerDigest}/registered-manifest.json`;
+}
+function provisionedWorkloadRoleRegistrationObjectKey(options) {
+    const manifestDigest = requireString(options.manifestDigest, digestPattern, 'Provisioned workload-role object digest', 'registered-manifest-invalid');
+    const provisionerDigest = (0, node_crypto_1.createHash)('sha256')
+        .update(requireString(options.provisionerFunctionArn, qualifiedLambdaArnPattern, 'Provisioned workload-role object provisioner', 'registered-manifest-invalid'), 'utf8')
+        .digest('hex');
+    return `${workloadRoleObjectPrefix(options.stage, options.project)}/candidates/${manifestDigest}/provisioners/${provisionerDigest}/provisioned-registration.json`;
+}
+function workloadRoleHistoryObjectKey(stage, project) {
+    return `${workloadRoleObjectPrefix(stage, project)}/history.json`;
+}
+function requireWorkloadRoleStorageRegistration(value) {
+    if (!isRecord(value)) {
+        throw new WorkloadRoleRegistrationError('registered-manifest-invalid', 'Workload-role storage registration must be an object.');
+    }
+    rejectUnexpectedProperties(value, [
+        'bucketName',
+        'candidateIdentity',
+        'manifestDigest',
+        'project',
+        'provisionerFunctionArn',
+        'schemaVersion',
+        'stage',
+    ], 'Workload-role storage registration', 'registered-manifest-invalid');
+    if (value.schemaVersion !== exports.WORKLOAD_ROLE_STORAGE_REGISTRATION_SCHEMA_VERSION) {
+        throw new WorkloadRoleRegistrationError('registered-manifest-invalid', `Workload-role storage registration schemaVersion must equal ${exports.WORKLOAD_ROLE_STORAGE_REGISTRATION_SCHEMA_VERSION}.`);
+    }
+    return {
+        bucketName: requireString(value.bucketName, bucketNamePattern, 'Workload-role storage bucketName', 'registered-manifest-invalid'),
+        candidateIdentity: requireString(value.candidateIdentity, /^[a-z0-9][a-z0-9._-]{0,127}$/, 'Workload-role storage candidateIdentity', 'registered-manifest-invalid'),
+        manifestDigest: requireString(value.manifestDigest, digestPattern, 'Workload-role storage manifestDigest', 'registered-manifest-invalid'),
+        project: requireString(value.project, identifierPattern, 'Workload-role storage project', 'registered-manifest-invalid'),
+        provisionerFunctionArn: requireString(value.provisionerFunctionArn, qualifiedLambdaArnPattern, 'Workload-role storage provisionerFunctionArn', 'registered-manifest-invalid'),
+        schemaVersion: exports.WORKLOAD_ROLE_STORAGE_REGISTRATION_SCHEMA_VERSION,
+        stage: requireString(value.stage, /^[a-z0-9][a-z0-9-]{0,62}$/, 'Workload-role storage stage', 'registered-manifest-invalid'),
+    };
+}
+function createWorkloadRoleStorageRegistration(options) {
+    return requireWorkloadRoleStorageRegistration({
+        ...options,
+        schemaVersion: exports.WORKLOAD_ROLE_STORAGE_REGISTRATION_SCHEMA_VERSION,
+    });
+}
+function requireProvisionerRequest(value) {
+    if (!isRecord(value)) {
+        throw new WorkloadRoleRegistrationError('registered-request-invalid', 'Fixed provisioner request must be an object.');
+    }
+    rejectUnexpectedProperties(value, ['candidateIdentity', 'manifestDigest', 'operation', 'stage'], 'Fixed provisioner request', 'registered-request-invalid');
+    const operation = requireString(value.operation, /^(converge|remove)$/, 'Fixed provisioner operation', 'registered-request-invalid');
+    if (!convergence_js_1.WORKLOAD_ROLE_PROVISIONER_OPERATIONS.includes(operation)) {
+        throw new WorkloadRoleRegistrationError('registered-request-invalid', 'Fixed provisioner operation is unsupported.');
+    }
+    return {
+        candidateIdentity: requireString(value.candidateIdentity, /^[a-z0-9][a-z0-9._-]{0,127}$/, 'Fixed provisioner candidateIdentity', 'registered-request-invalid'),
+        manifestDigest: requireString(value.manifestDigest, digestPattern, 'Fixed provisioner manifestDigest', 'registered-request-invalid'),
+        operation,
+        stage: requireString(value.stage, /^[a-z0-9][a-z0-9._-]{0,127}$/, 'Fixed provisioner stage', 'registered-request-invalid'),
+    };
+}
+async function loadFixedWorkloadRoleProvisionerRequest(options) {
+    const request = requireProvisionerRequest(options.request);
+    const document = requireRegisteredWorkloadRoleManifestDocument(await options.source.load());
+    if (request.candidateIdentity !== document.manifest.candidate.identity ||
+        request.stage !== document.manifest.candidate.stage ||
+        request.manifestDigest !== document.manifestDigest) {
+        throw new WorkloadRoleRegistrationError('registered-request-substitution', 'Fixed provisioner request does not match the baseline-selected manifest.');
+    }
+    const bundle = (0, effective_policy_js_1.createWorkloadRoleEffectivePolicyBundle)({
+        intentsByRole: document.intentsByRole,
+        manifest: document.manifest,
+    });
+    return {
+        boundary: (0, boundary_js_1.createWorkloadRoleBoundaryContract)({
+            accountId: document.accountId,
+            bundle,
+            manifest: document.manifest,
+            partition: document.partition,
+            stage: document.manifest.candidate.stage,
+        }),
+        document,
+        registration: {
+            candidateIdentity: document.manifest.candidate.identity,
+            manifestDigest: document.manifestDigest,
+            stage: document.manifest.candidate.stage,
+        },
+        request,
+    };
+}
+function validateWorkloadRolePreflight(options) {
+    const document = requireRegisteredWorkloadRoleManifestDocument(options.registeredManifest);
+    const storage = requireWorkloadRoleStorageRegistration(options.storageRegistration);
+    if (document.manifest.candidate.identity !==
+        options.expectedCandidateIdentity ||
+        document.manifest.candidate.stage !== options.expectedStage ||
+        document.project !== options.expectedProject ||
+        storage.candidateIdentity !== options.expectedCandidateIdentity ||
+        storage.stage !== options.expectedStage ||
+        storage.project !== options.expectedProject ||
+        storage.manifestDigest !== document.manifestDigest ||
+        storage.provisionerFunctionArn !== document.provisionerFunctionArn) {
+        throw new WorkloadRoleRegistrationError('registered-manifest-substitution', 'Registered workload-role candidate, stage, or project differs from the deployment expectation.');
+    }
+    const provisioned = requireProvisionedWorkloadRoleRegistrationDocument(options.provisionedRegistration);
+    if (provisioned.registration.provisionerFunctionArn !==
+        document.provisionerFunctionArn) {
+        throw new WorkloadRoleRegistrationError('provisioned-registration-invalid', 'Provisioned registration does not name the exact registered qualified provisioner.');
+    }
+    const registry = new injection_js_1.ExactProvisionedWorkloadRoleRegistry(document.manifest, provisioned.registration);
+    const provisioner = qualifiedLambdaArnPattern.exec(document.provisionerFunctionArn);
+    if (!provisioner) {
+        throw new WorkloadRoleRegistrationError('registered-manifest-invalid', 'Registered provisioner function identity is malformed.');
+    }
+    const objectIdentity = {
+        manifestDigest: document.manifestDigest,
+        project: document.project,
+        provisionerFunctionArn: document.provisionerFunctionArn,
+        stage: document.manifest.candidate.stage,
+    };
+    const registrationReadScope = {
+        provisionedRegistrationObjectArn: `arn:${document.partition}:s3:::${storage.bucketName}/${provisionedWorkloadRoleRegistrationObjectKey(objectIdentity)}`,
+        registeredManifestObjectArn: `arn:${document.partition}:s3:::${storage.bucketName}/${registeredWorkloadRoleManifestObjectKey(objectIdentity)}`,
+        storageRegistrationParameterArn: `arn:${document.partition}:ssm:${provisioner[2]}:${document.accountId}:parameter${workloadRoleStorageRegistrationPath(storage.stage, storage.project)}`,
+    };
+    const authorityPlan = (0, authority_js_1.createDeploymentRoleAuthorityPlan)(registry, registrationReadScope);
+    const validation = (0, authority_js_1.validateDeploymentRoleAuthorityPlan)(registry, authorityPlan, registrationReadScope);
+    if (!validation.valid) {
+        throw new WorkloadRoleRegistrationError('provisioned-registration-invalid', 'Generated ordinary deployment authority is not the exact registered plan.');
+    }
+    return { authorityPlan, document, registry, storage };
+}
+//# sourceMappingURL=registration.js.map

package/src/workload-roles/registration.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"registration.js","sourceRoot":"","sources":["../../../../../packages/nx/src/workload-roles/registration.ts"],"names":[],"mappings":";;;AA4VA,sGA2HC;AAED,oGAqBC;AA0HD,gHA+EC;AAED,kFAiBC;AAiBD,0FAwBC;AAED,oGAwBC;AAED,oEAKC;AAED,wFAsEC;AAED,sFAYC;AAoDD,0FAsCC;AAED,sEAkFC;AAxhCD,6CAAyC;AAEzC,iDAIwB;AACxB,+CAGuB;AACvB,qDAI0B;AAC1B,+DAG+B;AAC/B,iDAIwB;AACxB,+CAMuB;AAEV,QAAA,gDAAgD,GAAG,CAAU,CAAC;AAC9D,QAAA,qDAAqD,GAAG,CAAU,CAAC;AACnE,QAAA,iDAAiD,GAAG,CAAU,CAAC;AAS5E,MAAa,6BAA8B,SAAQ,KAAK;IAE3C;IADX,YACW,cAA6D,EACtE,OAAe;QAEf,KAAK,CAAC,OAAO,CAAC,CAAC;QAHN,mBAAc,GAAd,cAAc,CAA+C;QAItE,IAAI,CAAC,IAAI,GAAG,+BAA+B,CAAC;IAC9C,CAAC;CACF;AARD,sEAQC;AAoDD,MAAM,cAAc,GAAG,UAAU,CAAC;AAClC,MAAM,aAAa,GAAG,gBAAgB,CAAC;AACvC,MAAM,iBAAiB,GACrB,wFAAwF,CAAC;AAC3F,MAAM,yBAAyB,GAC7B,mGAAmG,CAAC;AACtG,MAAM,cAAc,GAClB,8EAA8E,CAAC;AACjF,MAAM,kBAAkB,GACtB,wEAAwE,CAAC;AAC3E,MAAM,uBAAuB,GAAG,uCAAuC,CAAC;AACxE,MAAM,iBAAiB,GACrB,gEAAgE,CAAC;AAEnE,SAAS,QAAQ,CAAC,KAAc;IAC9B,OAAO,OAAO,KAAK,KAAK,QAAQ,IAAI,KAAK,KAAK,IAAI,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC;AAC9E,CAAC;AAED,SAAS,cAAc,CAAC,IAAY,EAAE,KAAa;IACjD,OAAO,IAAI,GAAG,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,IAAI,GAAG,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;AAClD,CAAC;AAED,SAAS,0BAA0B,CACjC,KAA8B,EAC9B,OAA0B,EAC1B,KAAa,EACb,cAA6D;IAE7D,MAAM,UAAU,GAAG,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,MAAM,CAC1C,CAAC,QAAQ,EAAE,EAAE,CAAC,CAAC,OAAO,CAAC,QAAQ,CAAC,QAAQ,CAAC,CAC1C,CAAC;IACF,IAAI,UAAU,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;QAC1B,MAAM,IAAI,6BAA6B,CACrC,cAAc,EACd,GAAG,KAAK,qCAAqC,UAAU,CAAC,IAAI,CAAC,cAAc,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,GAAG,CAC3F,CAAC;IACJ,CAAC;AACH,CAAC;AAED,SAAS,aAAa,CACpB,KAAc,EACd,OAAe,EACf,KAAa,EACb,cAA6D;IAE7D,IAAI,OAAO,KAAK,KAAK,QAAQ,IAAI,CAAC,OAAO,CAAC,IAAI,CAAC,KAAK,CAAC,EAAE,CAAC;QACtD,MAAM,IAAI,6BAA6B,CACrC,cAAc,EACd,GAAG,KAAK,cAAc,CACvB,CAAC;IACJ,CAAC;IACD,OAAO,KAAK,CAAC;AACf,CAAC;AAED,SAAS,mBAAmB,CAAC,KAAc,EAAE,KAAa;IACxD,IAAI,CAAC,QAAQ,CAAC,KAAK,CAAC,EAAE,CAAC;QACrB,MAAM,IAAI,6BAA6B,CACrC,6BAA6B,EAC7B,GAAG,KAAK,qBAAqB,CAC9B,CAAC;IACJ,CAAC;IACD,0BAA0B,CACxB,KAAK,EACL,CAAC,MAAM,EAAE,MAAM,CAAC,EAChB,KAAK,EACL,6BAA6B,CAC9B,CAAC;IACF,OAAO;QACL,IAAI,EAAE,aAAa,CACjB,KAAK,CAAC,IAAI,EACV,4CAA4C,EAC5C,GAAG,KAAK,OAAO,EACf,6BAA6B,CACoB;QACnD,IAAI,EAAE,aAAa,CACjB,KAAK,CAAC,IAAI,EACV,uCAAuC,EACvC,GAAG,KAAK,OAAO,EACf,6BAA6B,CAC9B;KACF,CAAC;AACJ,CAAC;AAED,SAAS,qBAAqB,CAC5B,KAAc,EACd,KAAa;IAEb,IAAI,OAAO,KAAK,KAAK,QAAQ,EAAE,CAAC;QAC9B,OAAO,KAAK,CAAC;IACf,CAAC;IACD,IACE,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC;QACpB,KAAK,CAAC,MAAM,GAAG,CAAC;QAChB,KAAK,CAAC,KAAK,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,OAAO,KAAK,KAAK,QAAQ,CAAC,EACjD,CAAC;QACD,OAAO,CAAC,GAAG,KAAK,CAAa,CAAC;IAChC,CAAC;IACD,MAAM,IAAI,6BAA6B,CACrC,6BAA6B,EAC7B,GAAG,KAAK,8CAA8C,CACvD,CAAC;AACJ,CAAC;AAED,SAAS,iBAAiB,CACxB,KAAc,EACd,KAAa;IAEb,IAAI,KAAK,KAAK,SAAS,EAAE,CAAC;QACxB,OAAO,SAAS,CAAC;IACnB,CAAC;IACD,IAAI,CAAC,QAAQ,CAAC,KAAK,CAAC,IAAI,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QACxD,MAAM,IAAI,6BAA6B,CACrC,6BAA6B,EAC7B,GAAG,KAAK,8BAA8B,CACvC,CAAC;IACJ,CAAC;IACD,OAAO,MAAM,CAAC,WAAW,CACvB,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC;SACf,IAAI,CAAC,cAAc,CAAC;SACpB,GAAG,CAAC,CAAC,QAAQ,EAAE,EAAE;QAChB,MAAM,OAAO,GAAG,KAAK,CAAC,QAAQ,CAAC,CAAC;QAChC,IAAI,CAAC,QAAQ,CAAC,OAAO,CAAC,IAAI,MAAM,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;YAC5D,MAAM,IAAI,6BAA6B,CACrC,6BAA6B,EAC7B,GAAG,KAAK,IAAI,QAAQ,8BAA8B,CACnD,CAAC;QACJ,CAAC;QACD,OAAO;YACL,QAAQ;YACR,MAAM,CAAC,WAAW,CAChB,MAAM,CAAC,IAAI,CAAC,OAAO,CAAC;iBACjB,IAAI,CAAC,cAAc,CAAC;iBACpB,GAAG,CAAC,CAAC,GAAG,EAAE,EAAE,CAAC;gBACZ,GAAG;gBACH,qBAAqB,CACnB,OAAO,CAAC,GAAG,CAAC,EACZ,GAAG,KAAK,IAAI,QAAQ,IAAI,GAAG,EAAE,CAC9B;aACF,CAAC,CACL;SACF,CAAC;IACJ,CAAC,CAAC,CACL,CAAC;AACJ,CAAC;AAED,SAAS,kBAAkB,CACzB,KAAc,EACd,KAAa,EACb,iBAAgE,6BAA6B;IAE7F,IACE,CAAC,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC;QACrB,KAAK,CAAC,MAAM,KAAK,CAAC;QAClB,KAAK,CAAC,IAAI,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,OAAO,KAAK,KAAK,QAAQ,CAAC,EAChD,CAAC;QACD,MAAM,IAAI,6BAA6B,CACrC,cAAc,EACd,GAAG,KAAK,oCAAoC,CAC7C,CAAC;IACJ,CAAC;IACD,OAAO,CAAC,GAAG,KAAK,CAAa,CAAC;AAChC,CAAC;AAED,SAAS,uBAAuB,CAC9B,KAAc,EACd,KAAa;IAEb,IAAI,CAAC,QAAQ,CAAC,KAAK,CAAC,EAAE,CAAC;QACrB,MAAM,IAAI,6BAA6B,CACrC,6BAA6B,EAC7B,GAAG,KAAK,qBAAqB,CAC9B,CAAC;IACJ,CAAC;IACD,0BAA0B,CACxB,KAAK,EACL;QACE,SAAS;QACT,YAAY;QACZ,IAAI;QACJ,WAAW;QACX,QAAQ;QACR,+BAA+B;KAChC,EACD,KAAK,EACL,6BAA6B,CAC9B,CAAC;IACF,MAAM,UAAU,GAAG,iBAAiB,CAAC,KAAK,CAAC,UAAU,EAAE,GAAG,KAAK,aAAa,CAAC,CAAC;IAC9E,MAAM,6BAA6B,GACjC,KAAK,CAAC,6BAA6B,KAAK,SAAS;QAC/C,CAAC,CAAC,SAAS;QACX,CAAC,CAAC,aAAa,CACX,KAAK,CAAC,6BAA6B,EACnC,UAAU,EACV,GAAG,KAAK,gCAAgC,EACxC,6BAA6B,CAC9B,CAAC;IACR,OAAO;QACL,OAAO,EAAE,kBAAkB,CAAC,KAAK,CAAC,OAAO,EAAE,GAAG,KAAK,UAAU,CAAC;QAC9D,GAAG,CAAC,UAAU,CAAC,CAAC,CAAC,EAAE,UAAU,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QACrC,EAAE,EAAE,aAAa,CACf,KAAK,CAAC,EAAE,EACR,8BAA8B,EAC9B,GAAG,KAAK,KAAK,EACb,6BAA6B,CAC9B;QACD,SAAS,EAAE,kBAAkB,CAAC,KAAK,CAAC,SAAS,EAAE,GAAG,KAAK,YAAY,CAAC;QACpE,MAAM,EAAE,mBAAmB,CAAC,KAAK,CAAC,MAAM,EAAE,GAAG,KAAK,SAAS,CAAC;QAC5D,GAAG,CAAC,6BAA6B,CAAC,CAAC,CAAC,EAAE,6BAA6B,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;KAC5E,CAAC;AACJ,CAAC;AAED,SAAS,oBAAoB,CAC3B,KAAc;IAEd,IAAI,CAAC,QAAQ,CAAC,KAAK,CAAC,EAAE,CAAC;QACrB,MAAM,IAAI,6BAA6B,CACrC,6BAA6B,EAC7B,6CAA6C,CAC9C,CAAC;IACJ,CAAC;IACD,OAAO,MAAM,CAAC,WAAW,CACvB,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC;SACf,IAAI,CAAC,cAAc,CAAC;SACpB,GAAG,CAAC,CAAC,MAAM,EAAE,EAAE;QACd,MAAM,OAAO,GAAG,KAAK,CAAC,MAAM,CAAC,CAAC;QAC9B,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,OAAO,CAAC,EAAE,CAAC;YAC5B,MAAM,IAAI,6BAA6B,CACrC,6BAA6B,EAC7B,4BAA4B,MAAM,oBAAoB,CACvD,CAAC;QACJ,CAAC;QACD,OAAO;YACL,MAAM;YACN,OAAO,CAAC,GAAG,CAAC,CAAC,MAAM,EAAE,KAAK,EAAE,EAAE,CAC5B,uBAAuB,CACrB,MAAM,EACN,iBAAiB,MAAM,IAAI,KAAK,GAAG,CACpC,CACF;SACF,CAAC;IACJ,CAAC,CAAC,CACL,CAAC;AACJ,CAAC;AAED,SAAgB,6CAA6C,CAC3D,KAAc;IAEd,IAAI,CAAC,QAAQ,CAAC,KAAK,CAAC,EAAE,CAAC;QACrB,MAAM,IAAI,6BAA6B,CACrC,6BAA6B,EAC7B,sDAAsD,CACvD,CAAC;IACJ,CAAC;IACD,0BAA0B,CACxB,KAAK,EACL;QACE,WAAW;QACX,eAAe;QACf,UAAU;QACV,gBAAgB;QAChB,WAAW;QACX,SAAS;QACT,wBAAwB;QACxB,eAAe;KAChB,EACD,mCAAmC,EACnC,6BAA6B,CAC9B,CAAC;IACF,IACE,KAAK,CAAC,aAAa,KAAK,wDAAgD,EACxE,CAAC;QACD,MAAM,IAAI,6BAA6B,CACrC,6BAA6B,EAC7B,8DAA8D,wDAAgD,GAAG,CAClH,CAAC;IACJ,CAAC;IACD,MAAM,SAAS,GAAG,aAAa,CAC7B,KAAK,CAAC,SAAS,EACf,cAAc,EACd,sBAAsB,EACtB,6BAA6B,CAC9B,CAAC;IACF,MAAM,SAAS,GAAG,aAAa,CAC7B,KAAK,CAAC,SAAS,EACf,2BAA2B,EAC3B,sBAAsB,EACtB,6BAA6B,CACyB,CAAC;IACzD,MAAM,OAAO,GAAG,aAAa,CAC3B,KAAK,CAAC,OAAO,EACb,iBAAiB,EACjB,oBAAoB,EACpB,6BAA6B,CAC9B,CAAC;IACF,MAAM,sBAAsB,GAAG,aAAa,CAC1C,KAAK,CAAC,sBAAsB,EAC5B,yBAAyB,EACzB,mCAAmC,EACnC,6BAA6B,CAC9B,CAAC;IACF,MAAM,gBAAgB,GAAG,yBAAyB,CAAC,IAAI,CACrD,sBAAsB,CACvB,CAAC;IACF,IACE,CAAC,gBAAgB;QACjB,gBAAgB,CAAC,CAAC,CAAC,KAAK,SAAS;QACjC,gBAAgB,CAAC,CAAC,CAAC,KAAK,SAAS,EACjC,CAAC;QACD,MAAM,IAAI,6BAA6B,CACrC,kCAAkC,EAClC,iFAAiF,CAClF,CAAC;IACJ,CAAC;IAED,IAAI,QAA8B,CAAC;IACnC,IAAI,CAAC;QACH,QAAQ,GAAG,IAAA,8CAAgC,EAAC,KAAK,CAAC,QAAQ,CAAC,CAAC;IAC9D,CAAC;IAAC,MAAM,CAAC;QACP,MAAM,IAAI,6BAA6B,CACrC,6BAA6B,EAC7B,uDAAuD,CACxD,CAAC;IACJ,CAAC;IACD,MAAM,cAAc,GAAG,aAAa,CAClC,KAAK,CAAC,cAAc,EACpB,aAAa,EACb,2BAA2B,EAC3B,6BAA6B,CAC9B,CAAC;IACF,IAAI,IAAA,wCAA0B,EAAC,QAAQ,CAAC,KAAK,cAAc,EAAE,CAAC;QAC5D,MAAM,IAAI,6BAA6B,CACrC,kCAAkC,EAClC,mEAAmE,CACpE,CAAC;IACJ,CAAC;IACD,MAAM,mBAAmB,GAAG,QAAQ,CAAC,KAAK,CAAC,MAAM,CAC/C,CAAC,EAAE,SAAS,EAAE,EAAE,EAAE,CAAC,SAAS,CAAC,OAAO,KAAK,OAAO,CACjD,CAAC;IACF,IAAI,mBAAmB,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;QACnC,MAAM,IAAI,6BAA6B,CACrC,kCAAkC,EAClC,8DAA8D,CAC/D,CAAC;IACJ,CAAC;IAED,MAAM,aAAa,GAAG,oBAAoB,CAAC,KAAK,CAAC,aAAa,CAAC,CAAC;IAChE,MAAM,MAAM,GAAG,IAAA,6DAAuC,EAAC;QACrD,aAAa;QACb,QAAQ;KACT,CAAC,CAAC;IACH,IAAA,gDAAkC,EAAC;QACjC,SAAS;QACT,MAAM;QACN,QAAQ;QACR,SAAS;QACT,KAAK,EAAE,QAAQ,CAAC,SAAS,CAAC,KAAK;KAChC,CAAC,CAAC;IACH,OAAO;QACL,SAAS;QACT,aAAa;QACb,QAAQ;QACR,cAAc;QACd,SAAS;QACT,OAAO;QACP,sBAAsB;QACtB,aAAa,EAAE,wDAAgD;KAChE,CAAC;AACJ,CAAC;AAED,SAAgB,4CAA4C,CAAC,OAS5D;IACC,MAAM,QAAQ,GAAG,IAAA,8CAAgC,EAAC,OAAO,CAAC,QAAQ,CAAC,CAAC;IACpE,OAAO,6CAA6C,CAAC;QACnD,SAAS,EAAE,OAAO,CAAC,SAAS;QAC5B,aAAa,EAAE,OAAO,CAAC,aAAa;QACpC,QAAQ;QACR,cAAc,EAAE,IAAA,wCAA0B,EAAC,QAAQ,CAAC;QACpD,SAAS,EAAE,OAAO,CAAC,SAAS;QAC5B,OAAO,EAAE,OAAO,CAAC,OAAO;QACxB,sBAAsB,EAAE,OAAO,CAAC,sBAAsB;QACtD,aAAa,EAAE,wDAAgD;KAChE,CAAC,CAAC;AACL,CAAC;AAED,SAAS,sBAAsB,CAC7B,KAAc,EACd,KAAa;IAEb,IAAI,CAAC,QAAQ,CAAC,KAAK,CAAC,EAAE,CAAC;QACrB,MAAM,IAAI,6BAA6B,CACrC,kCAAkC,EAClC,oBAAoB,KAAK,qBAAqB,CAC/C,CAAC;IACJ,CAAC;IACD,0BAA0B,CACxB,KAAK,EACL;QACE,aAAa;QACb,IAAI;QACJ,WAAW;QACX,kBAAkB;QAClB,wBAAwB;QACxB,SAAS;QACT,UAAU;QACV,SAAS;QACT,YAAY;KACb,EACD,oBAAoB,KAAK,EAAE,EAC3B,kCAAkC,CACnC,CAAC;IACF,IAAI,CAAC,QAAQ,CAAC,KAAK,CAAC,SAAS,CAAC,EAAE,CAAC;QAC/B,MAAM,IAAI,6BAA6B,CACrC,kCAAkC,EAClC,oBAAoB,KAAK,+BAA+B,CACzD,CAAC;IACJ,CAAC;IACD,0BAA0B,CACxB,KAAK,CAAC,SAAS,EACf,CAAC,SAAS,EAAE,UAAU,CAAC,EACvB,oBAAoB,KAAK,YAAY,EACrC,kCAAkC,CACnC,CAAC;IACF,MAAM,WAAW,GAAG,aAAa,CAC/B,KAAK,CAAC,WAAW,EACjB,kBAAkB,EAClB,oBAAoB,KAAK,cAAc,EACvC,kCAAkC,CACnC,CAAC;IACF,MAAM,EAAE,GAAG,aAAa,CACtB,KAAK,CAAC,EAAE,EACR,8BAA8B,EAC9B,oBAAoB,KAAK,KAAK,EAC9B,kCAAkC,CACnC,CAAC;IACF,MAAM,OAAO,GAAG,aAAa,CAC3B,KAAK,CAAC,SAAS,CAAC,OAAO,EACvB,iBAAiB,EACjB,oBAAoB,KAAK,oBAAoB,EAC7C,kCAAkC,CACnC,CAAC;IACF,MAAM,QAAQ,GAAG,aAAa,CAC5B,KAAK,CAAC,SAAS,CAAC,QAAQ,EACxB,8BAA8B,EAC9B,oBAAoB,KAAK,qBAAqB,EAC9C,kCAAkC,CACnC,CAAC;IACF,MAAM,gBAAgB,GAAG,kBAAkB,CACzC,KAAK,CAAC,gBAAgB,EACtB,oBAAoB,KAAK,mBAAmB,EAC5C,kCAAkC,CACnC,CAAC;IACF,IACE,gBAAgB,CAAC,IAAI,CACnB,CAAC,WAAW,EAAE,EAAE,CAAC,CAAC,uBAAuB,CAAC,IAAI,CAAC,WAAW,CAAC,CAC5D,EACD,CAAC;QACD,MAAM,IAAI,6BAA6B,CACrC,kCAAkC,EAClC,oBAAoB,KAAK,gCAAgC,CAC1D,CAAC;IACJ,CAAC;IACD,MAAM,sBAAsB,GAAG,aAAa,CAC1C,KAAK,CAAC,sBAAsB,EAC5B,aAAa,EACb,oBAAoB,KAAK,yBAAyB,EAClD,kCAAkC,CACnC,CAAC;IACF,MAAM,OAAO,GAAG,aAAa,CAC3B,KAAK,CAAC,OAAO,EACb,cAAc,EACd,oBAAoB,KAAK,UAAU,EACnC,kCAAkC,CACnC,CAAC;IACF,MAAM,QAAQ,GAAG,aAAa,CAC5B,KAAK,CAAC,QAAQ,EACd,4BAA4B,EAC5B,oBAAoB,KAAK,WAAW,EACpC,kCAAkC,CACnC,CAAC;IACF,MAAM,OAAO,GAAG,aAAa,CAC3B,KAAK,CAAC,OAAO,EACb,IAAI,MAAM,CAAC,KAAK,oCAAsB,CAAC,IAAI,CAAC,GAAG,CAAC,IAAI,CAAC,EACrD,oBAAoB,KAAK,UAAU,EACnC,kCAAkC,CACG,CAAC;IACxC,MAAM,UAAU,GAAG,aAAa,CAC9B,KAAK,CAAC,UAAU,EAChB,IAAI,MAAM,CAAC,KAAK,yCAA2B,CAAC,IAAI,CAAC,GAAG,CAAC,IAAI,CAAC,EAC1D,oBAAoB,KAAK,aAAa,EACtC,kCAAkC,CACM,CAAC;IAC3C,OAAO;QACL,WAAW;QACX,EAAE;QACF,SAAS,EAAE,EAAE,OAAO,EAAE,QAAQ,EAAE;QAChC,gBAAgB;QAChB,sBAAsB;QACtB,OAAO;QACP,QAAQ;QACR,OAAO;QACP,UAAU;KACX,CAAC;AACJ,CAAC;AAED,SAAgB,kDAAkD,CAChE,KAAc;IAEd,IAAI,CAAC,QAAQ,CAAC,KAAK,CAAC,EAAE,CAAC;QACrB,MAAM,IAAI,6BAA6B,CACrC,kCAAkC,EAClC,2DAA2D,CAC5D,CAAC;IACJ,CAAC;IACD,0BAA0B,CACxB,KAAK,EACL,CAAC,cAAc,EAAE,eAAe,CAAC,EACjC,wCAAwC,EACxC,kCAAkC,CACnC,CAAC;IACF,IACE,KAAK,CAAC,aAAa;QACnB,6DAAqD,EACrD,CAAC;QACD,MAAM,IAAI,6BAA6B,CACrC,kCAAkC,EAClC,qDAAqD,6DAAqD,GAAG,CAC9G,CAAC;IACJ,CAAC;IACD,IAAI,CAAC,QAAQ,CAAC,KAAK,CAAC,YAAY,CAAC,EAAE,CAAC;QAClC,MAAM,IAAI,6BAA6B,CACrC,kCAAkC,EAClC,qDAAqD,CACtD,CAAC;IACJ,CAAC;IACD,MAAM,YAAY,GAAG,KAAK,CAAC,YAAY,CAAC;IACxC,0BAA0B,CACxB,YAAY,EACZ;QACE,mBAAmB;QACnB,gBAAgB;QAChB,wBAAwB;QACxB,OAAO;QACP,OAAO;KACR,EACD,kCAAkC,EAClC,kCAAkC,CACnC,CAAC;IACF,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,YAAY,CAAC,KAAK,CAAC,IAAI,YAAY,CAAC,KAAK,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QAC1E,MAAM,IAAI,6BAA6B,CACrC,kCAAkC,EAClC,kDAAkD,CACnD,CAAC;IACJ,CAAC;IACD,OAAO;QACL,YAAY,EAAE;YACZ,iBAAiB,EAAE,aAAa,CAC9B,YAAY,CAAC,iBAAiB,EAC9B,8BAA8B,EAC9B,4CAA4C,EAC5C,kCAAkC,CACnC;YACD,cAAc,EAAE,aAAa,CAC3B,YAAY,CAAC,cAAc,EAC3B,aAAa,EACb,yCAAyC,EACzC,kCAAkC,CACnC;YACD,sBAAsB,EAAE,aAAa,CACnC,YAAY,CAAC,sBAAsB,EACnC,yBAAyB,EACzB,iDAAiD,EACjD,kCAAkC,CACnC;YACD,KAAK,EAAE,YAAY,CAAC,KAAK,CAAC,GAAG,CAAC,sBAAsB,CAAC;YACrD,KAAK,EAAE,aAAa,CAClB,YAAY,CAAC,KAAK,EAClB,8BAA8B,EAC9B,gCAAgC,EAChC,kCAAkC,CACnC;SACF;QACD,aAAa,EAAE,6DAAqD;KACrE,CAAC;AACJ,CAAC;AAED,SAAgB,mCAAmC,CACjD,KAAa,EACb,OAAe;IAEf,aAAa,CACX,KAAK,EACL,2BAA2B,EAC3B,kCAAkC,EAClC,6BAA6B,CAC9B,CAAC;IACF,aAAa,CACX,OAAO,EACP,iBAAiB,EACjB,oCAAoC,EACpC,6BAA6B,CAC9B,CAAC;IACF,OAAO,QAAQ,KAAK,mBAAmB,OAAO,uBAAuB,CAAC;AACxE,CAAC;AAED,SAAS,wBAAwB,CAAC,KAAa,EAAE,OAAe;IAC9D,MAAM,eAAe,GAAG,aAAa,CACnC,KAAK,EACL,2BAA2B,EAC3B,kCAAkC,EAClC,6BAA6B,CAC9B,CAAC;IACF,OAAO,OAAO,eAAe,mBAAmB,aAAa,CAC3D,OAAO,EACP,iBAAiB,EACjB,oCAAoC,EACpC,6BAA6B,CAC9B,EAAE,CAAC;AACN,CAAC;AAED,SAAgB,uCAAuC,CAAC,OAKvD;IACC,MAAM,cAAc,GAAG,aAAa,CAClC,OAAO,CAAC,cAAc,EACtB,aAAa,EACb,sCAAsC,EACtC,6BAA6B,CAC9B,CAAC;IACF,MAAM,iBAAiB,GAAG,IAAA,wBAAU,EAAC,QAAQ,CAAC;SAC3C,MAAM,CACL,aAAa,CACX,OAAO,CAAC,sBAAsB,EAC9B,yBAAyB,EACzB,6CAA6C,EAC7C,6BAA6B,CAC9B,EACD,MAAM,CACP;SACA,MAAM,CAAC,KAAK,CAAC,CAAC;IACjB,OAAO,GAAG,wBAAwB,CAAC,OAAO,CAAC,KAAK,EAAE,OAAO,CAAC,OAAO,CAAC,eAAe,cAAc,iBAAiB,iBAAiB,2BAA2B,CAAC;AAC/J,CAAC;AAED,SAAgB,4CAA4C,CAAC,OAK5D;IACC,MAAM,cAAc,GAAG,aAAa,CAClC,OAAO,CAAC,cAAc,EACtB,aAAa,EACb,yCAAyC,EACzC,6BAA6B,CAC9B,CAAC;IACF,MAAM,iBAAiB,GAAG,IAAA,wBAAU,EAAC,QAAQ,CAAC;SAC3C,MAAM,CACL,aAAa,CACX,OAAO,CAAC,sBAAsB,EAC9B,yBAAyB,EACzB,8CAA8C,EAC9C,6BAA6B,CAC9B,EACD,MAAM,CACP;SACA,MAAM,CAAC,KAAK,CAAC,CAAC;IACjB,OAAO,GAAG,wBAAwB,CAAC,OAAO,CAAC,KAAK,EAAE,OAAO,CAAC,OAAO,CAAC,eAAe,cAAc,iBAAiB,iBAAiB,gCAAgC,CAAC;AACpK,CAAC;AAED,SAAgB,4BAA4B,CAC1C,KAAa,EACb,OAAe;IAEf,OAAO,GAAG,wBAAwB,CAAC,KAAK,EAAE,OAAO,CAAC,eAAe,CAAC;AACpE,CAAC;AAED,SAAgB,sCAAsC,CACpD,KAAc;IAEd,IAAI,CAAC,QAAQ,CAAC,KAAK,CAAC,EAAE,CAAC;QACrB,MAAM,IAAI,6BAA6B,CACrC,6BAA6B,EAC7B,uDAAuD,CACxD,CAAC;IACJ,CAAC;IACD,0BAA0B,CACxB,KAAK,EACL;QACE,YAAY;QACZ,mBAAmB;QACnB,gBAAgB;QAChB,SAAS;QACT,wBAAwB;QACxB,eAAe;QACf,OAAO;KACR,EACD,oCAAoC,EACpC,6BAA6B,CAC9B,CAAC;IACF,IACE,KAAK,CAAC,aAAa,KAAK,yDAAiD,EACzE,CAAC;QACD,MAAM,IAAI,6BAA6B,CACrC,6BAA6B,EAC7B,+DAA+D,yDAAiD,GAAG,CACpH,CAAC;IACJ,CAAC;IACD,OAAO;QACL,UAAU,EAAE,aAAa,CACvB,KAAK,CAAC,UAAU,EAChB,iBAAiB,EACjB,kCAAkC,EAClC,6BAA6B,CAC9B;QACD,iBAAiB,EAAE,aAAa,CAC9B,KAAK,CAAC,iBAAiB,EACvB,8BAA8B,EAC9B,yCAAyC,EACzC,6BAA6B,CAC9B;QACD,cAAc,EAAE,aAAa,CAC3B,KAAK,CAAC,cAAc,EACpB,aAAa,EACb,sCAAsC,EACtC,6BAA6B,CAC9B;QACD,OAAO,EAAE,aAAa,CACpB,KAAK,CAAC,OAAO,EACb,iBAAiB,EACjB,+BAA+B,EAC/B,6BAA6B,CAC9B;QACD,sBAAsB,EAAE,aAAa,CACnC,KAAK,CAAC,sBAAsB,EAC5B,yBAAyB,EACzB,8CAA8C,EAC9C,6BAA6B,CAC9B;QACD,aAAa,EAAE,yDAAiD;QAChE,KAAK,EAAE,aAAa,CAClB,KAAK,CAAC,KAAK,EACX,2BAA2B,EAC3B,6BAA6B,EAC7B,6BAA6B,CAC9B;KACF,CAAC;AACJ,CAAC;AAED,SAAgB,qCAAqC,CAAC,OAOrD;IACC,OAAO,sCAAsC,CAAC;QAC5C,GAAG,OAAO;QACV,aAAa,EAAE,yDAAiD;KACjE,CAAC,CAAC;AACL,CAAC;AAED,SAAS,yBAAyB,CAChC,KAAc;IAEd,IAAI,CAAC,QAAQ,CAAC,KAAK,CAAC,EAAE,CAAC;QACrB,MAAM,IAAI,6BAA6B,CACrC,4BAA4B,EAC5B,8CAA8C,CAC/C,CAAC;IACJ,CAAC;IACD,0BAA0B,CACxB,KAAK,EACL,CAAC,mBAAmB,EAAE,gBAAgB,EAAE,WAAW,EAAE,OAAO,CAAC,EAC7D,2BAA2B,EAC3B,4BAA4B,CAC7B,CAAC;IACF,MAAM,SAAS,GAAG,aAAa,CAC7B,KAAK,CAAC,SAAS,EACf,qBAAqB,EACrB,6BAA6B,EAC7B,4BAA4B,CACkB,CAAC;IACjD,IAAI,CAAC,qDAAoC,CAAC,QAAQ,CAAC,SAAS,CAAC,EAAE,CAAC;QAC9D,MAAM,IAAI,6BAA6B,CACrC,4BAA4B,EAC5B,6CAA6C,CAC9C,CAAC;IACJ,CAAC;IACD,OAAO;QACL,iBAAiB,EAAE,aAAa,CAC9B,KAAK,CAAC,iBAAiB,EACvB,8BAA8B,EAC9B,qCAAqC,EACrC,4BAA4B,CAC7B;QACD,cAAc,EAAE,aAAa,CAC3B,KAAK,CAAC,cAAc,EACpB,aAAa,EACb,kCAAkC,EAClC,4BAA4B,CAC7B;QACD,SAAS;QACT,KAAK,EAAE,aAAa,CAClB,KAAK,CAAC,KAAK,EACX,8BAA8B,EAC9B,yBAAyB,EACzB,4BAA4B,CAC7B;KACF,CAAC;AACJ,CAAC;AAEM,KAAK,UAAU,uCAAuC,CAAC,OAG7D;IACC,MAAM,OAAO,GAAG,yBAAyB,CAAC,OAAO,CAAC,OAAO,CAAC,CAAC;IAC3D,MAAM,QAAQ,GAAG,6CAA6C,CAC5D,MAAM,OAAO,CAAC,MAAM,CAAC,IAAI,EAAE,CAC5B,CAAC;IACF,IACE,OAAO,CAAC,iBAAiB,KAAK,QAAQ,CAAC,QAAQ,CAAC,SAAS,CAAC,QAAQ;QAClE,OAAO,CAAC,KAAK,KAAK,QAAQ,CAAC,QAAQ,CAAC,SAAS,CAAC,KAAK;QACnD,OAAO,CAAC,cAAc,KAAK,QAAQ,CAAC,cAAc,EAClD,CAAC;QACD,MAAM,IAAI,6BAA6B,CACrC,iCAAiC,EACjC,0EAA0E,CAC3E,CAAC;IACJ,CAAC;IACD,MAAM,MAAM,GAAG,IAAA,6DAAuC,EAAC;QACrD,aAAa,EAAE,QAAQ,CAAC,aAAa;QACrC,QAAQ,EAAE,QAAQ,CAAC,QAAQ;KAC5B,CAAC,CAAC;IACH,OAAO;QACL,QAAQ,EAAE,IAAA,gDAAkC,EAAC;YAC3C,SAAS,EAAE,QAAQ,CAAC,SAAS;YAC7B,MAAM;YACN,QAAQ,EAAE,QAAQ,CAAC,QAAQ;YAC3B,SAAS,EAAE,QAAQ,CAAC,SAAS;YAC7B,KAAK,EAAE,QAAQ,CAAC,QAAQ,CAAC,SAAS,CAAC,KAAK;SACzC,CAAC;QACF,QAAQ;QACR,YAAY,EAAE;YACZ,iBAAiB,EAAE,QAAQ,CAAC,QAAQ,CAAC,SAAS,CAAC,QAAQ;YACvD,cAAc,EAAE,QAAQ,CAAC,cAAc;YACvC,KAAK,EAAE,QAAQ,CAAC,QAAQ,CAAC,SAAS,CAAC,KAAK;SACzC;QACD,OAAO;KACR,CAAC;AACJ,CAAC;AAED,SAAgB,6BAA6B,CAAC,OAO7C;IACC,MAAM,QAAQ,GAAG,6CAA6C,CAC5D,OAAO,CAAC,kBAAkB,CAC3B,CAAC;IACF,MAAM,OAAO,GAAG,sCAAsC,CACpD,OAAO,CAAC,mBAAmB,CAC5B,CAAC;IACF,IACE,QAAQ,CAAC,QAAQ,CAAC,SAAS,CAAC,QAAQ;QAClC,OAAO,CAAC,yBAAyB;QACnC,QAAQ,CAAC,QAAQ,CAAC,SAAS,CAAC,KAAK,KAAK,OAAO,CAAC,aAAa;QAC3D,QAAQ,CAAC,OAAO,KAAK,OAAO,CAAC,eAAe;QAC5C,OAAO,CAAC,iBAAiB,KAAK,OAAO,CAAC,yBAAyB;QAC/D,OAAO,CAAC,KAAK,KAAK,OAAO,CAAC,aAAa;QACvC,OAAO,CAAC,OAAO,KAAK,OAAO,CAAC,eAAe;QAC3C,OAAO,CAAC,cAAc,KAAK,QAAQ,CAAC,cAAc;QAClD,OAAO,CAAC,sBAAsB,KAAK,QAAQ,CAAC,sBAAsB,EAClE,CAAC;QACD,MAAM,IAAI,6BAA6B,CACrC,kCAAkC,EAClC,gGAAgG,CACjG,CAAC;IACJ,CAAC;IACD,MAAM,WAAW,GAAG,kDAAkD,CACpE,OAAO,CAAC,uBAAuB,CAChC,CAAC;IACF,IACE,WAAW,CAAC,YAAY,CAAC,sBAAsB;QAC/C,QAAQ,CAAC,sBAAsB,EAC/B,CAAC;QACD,MAAM,IAAI,6BAA6B,CACrC,kCAAkC,EAClC,oFAAoF,CACrF,CAAC;IACJ,CAAC;IACD,MAAM,QAAQ,GAAG,IAAI,mDAAoC,CACvD,QAAQ,CAAC,QAAQ,EACjB,WAAW,CAAC,YAAY,CACzB,CAAC;IACF,MAAM,WAAW,GAAG,yBAAyB,CAAC,IAAI,CAChD,QAAQ,CAAC,sBAAsB,CAChC,CAAC;IACF,IAAI,CAAC,WAAW,EAAE,CAAC;QACjB,MAAM,IAAI,6BAA6B,CACrC,6BAA6B,EAC7B,wDAAwD,CACzD,CAAC;IACJ,CAAC;IACD,MAAM,cAAc,GAAG;QACrB,cAAc,EAAE,QAAQ,CAAC,cAAc;QACvC,OAAO,EAAE,QAAQ,CAAC,OAAO;QACzB,sBAAsB,EAAE,QAAQ,CAAC,sBAAsB;QACvD,KAAK,EAAE,QAAQ,CAAC,QAAQ,CAAC,SAAS,CAAC,KAAK;KACzC,CAAC;IACF,MAAM,qBAAqB,GAAG;QAC5B,gCAAgC,EAAE,OAAO,QAAQ,CAAC,SAAS,SAAS,OAAO,CAAC,UAAU,IAAI,4CAA4C,CAAC,cAAc,CAAC,EAAE;QACxJ,2BAA2B,EAAE,OAAO,QAAQ,CAAC,SAAS,SAAS,OAAO,CAAC,UAAU,IAAI,uCAAuC,CAAC,cAAc,CAAC,EAAE;QAC9I,+BAA+B,EAAE,OAAO,QAAQ,CAAC,SAAS,QAAQ,WAAW,CAAC,CAAC,CAAC,IAAI,QAAQ,CAAC,SAAS,aAAa,mCAAmC,CAAC,OAAO,CAAC,KAAK,EAAE,OAAO,CAAC,OAAO,CAAC,EAAE;KACzL,CAAC;IACF,MAAM,aAAa,GAAG,IAAA,gDAAiC,EACrD,QAAQ,EACR,qBAAqB,CACtB,CAAC;IACF,MAAM,UAAU,GAAG,IAAA,kDAAmC,EACpD,QAAQ,EACR,aAAa,EACb,qBAAqB,CACtB,CAAC;IACF,IAAI,CAAC,UAAU,CAAC,KAAK,EAAE,CAAC;QACtB,MAAM,IAAI,6BAA6B,CACrC,kCAAkC,EAClC,2EAA2E,CAC5E,CAAC;IACJ,CAAC;IACD,OAAO,EAAE,aAAa,EAAE,QAAQ,EAAE,QAAQ,EAAE,OAAO,EAAE,CAAC;AACxD,CAAC"}

package/src/workload-roles/stage-boundary.d.ts

@@ -0,0 +1,31 @@
+import { type WorkloadRoleBoundaryContract } from './boundary.js';
+import { type RegisteredWorkloadRoleManifestDocument } from './registration.js';
+export type StageWorkloadRoleBoundaryFailureClassification = 'stage-boundary-input-invalid' | 'stage-boundary-project-set-invalid' | 'stage-boundary-substitution';
+export declare class StageWorkloadRoleBoundaryError extends Error {
+    readonly classification: StageWorkloadRoleBoundaryFailureClassification;
+    constructor(classification: StageWorkloadRoleBoundaryFailureClassification, message: string);
+}
+export interface StageWorkloadRoleBoundaryContract extends WorkloadRoleBoundaryContract {
+    documents: RegisteredWorkloadRoleManifestDocument[];
+    manifestDigestsByProject: Readonly<Record<string, string>>;
+    policyCharacters: number;
+    projects: string[];
+}
+export declare const AWS_MANAGED_POLICY_MAXIMUM_CHARACTERS: 6144;
+/**
+ * Creates the one reviewed account/stage boundary from the complete project
+ * set. Exact resources and conditions remain in the digest-bound role inline
+ * policies, which are the grants. This singular stage boundary is a compact
+ * maximum-action cap: it unions non-IAM action names at Resource "*", retains
+ * only exact service-conditioned iam:PassRole exceptions, and emits the fixed
+ * privilege-construction deny once.
+ */
+export declare function createStageWorkloadRoleBoundaryContract(options: {
+    documents: readonly unknown[];
+    expectedAccountId: string;
+    expectedCandidateIdentity: string;
+    expectedManifestDigests: Readonly<Record<string, string>>;
+    expectedPartition: string;
+    expectedProjects: readonly string[];
+    expectedStage: string;
+}): StageWorkloadRoleBoundaryContract;