@empire-builder-kit/nx 1.0.0-beta.9 → 1.0.0-rc.2

package/src/workload-roles/stage-boundary.js

@@ -0,0 +1,208 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.AWS_MANAGED_POLICY_MAXIMUM_CHARACTERS = exports.StageWorkloadRoleBoundaryError = void 0;
+exports.createStageWorkloadRoleBoundaryContract = createStageWorkloadRoleBoundaryContract;
+const node_crypto_1 = require("node:crypto");
+const boundary_js_1 = require("./boundary.js");
+const effective_policy_js_1 = require("./effective-policy.js");
+const registration_js_1 = require("./registration.js");
+class StageWorkloadRoleBoundaryError extends Error {
+    classification;
+    constructor(classification, message) {
+        super(message);
+        this.classification = classification;
+        this.name = 'StageWorkloadRoleBoundaryError';
+    }
+}
+exports.StageWorkloadRoleBoundaryError = StageWorkloadRoleBoundaryError;
+exports.AWS_MANAGED_POLICY_MAXIMUM_CHARACTERS = 6_144;
+const accountPattern = /^\d{12}$/;
+const candidatePattern = /^[a-z0-9][a-z0-9._-]{0,127}$/;
+const digestPattern = /^[a-f0-9]{64}$/;
+const projectPattern = /^[a-z0-9][a-z0-9-]{0,62}$/;
+const stagePattern = /^[a-z0-9][a-z0-9-]{0,62}$/;
+function compareStrings(left, right) {
+    return left < right ? -1 : left > right ? 1 : 0;
+}
+function requireMatch(value, pattern, label) {
+    if (!pattern.test(value)) {
+        throw new StageWorkloadRoleBoundaryError('stage-boundary-input-invalid', `${label} is invalid.`);
+    }
+    return value;
+}
+function requireExpectedProjects(options) {
+    if (options.expectedProjects.length === 0) {
+        throw new StageWorkloadRoleBoundaryError('stage-boundary-project-set-invalid', 'A stage boundary requires at least one reviewed project.');
+    }
+    const projects = options.expectedProjects.map((project) => requireMatch(project, projectPattern, 'Expected project'));
+    if (new Set(projects).size !== projects.length) {
+        throw new StageWorkloadRoleBoundaryError('stage-boundary-project-set-invalid', 'Expected stage projects must be unique.');
+    }
+    const digestProjects = Object.keys(options.expectedManifestDigests).sort(compareStrings);
+    const expected = [...projects].sort(compareStrings);
+    if (JSON.stringify(digestProjects) !== JSON.stringify(expected) ||
+        digestProjects.some((project) => !digestPattern.test(options.expectedManifestDigests[project]))) {
+        throw new StageWorkloadRoleBoundaryError('stage-boundary-project-set-invalid', 'Reviewed manifest digests must name the exact expected project set.');
+    }
+    return expected;
+}
+/**
+ * Creates the one reviewed account/stage boundary from the complete project
+ * set. Exact resources and conditions remain in the digest-bound role inline
+ * policies, which are the grants. This singular stage boundary is a compact
+ * maximum-action cap: it unions non-IAM action names at Resource "*", retains
+ * only exact service-conditioned iam:PassRole exceptions, and emits the fixed
+ * privilege-construction deny once.
+ */
+function createStageWorkloadRoleBoundaryContract(options) {
+    requireMatch(options.expectedAccountId, accountPattern, 'Expected account');
+    requireMatch(options.expectedCandidateIdentity, candidatePattern, 'Expected candidate identity');
+    requireMatch(options.expectedStage, stagePattern, 'Expected stage');
+    if (!['aws', 'aws-cn', 'aws-us-gov'].includes(options.expectedPartition)) {
+        throw new StageWorkloadRoleBoundaryError('stage-boundary-input-invalid', 'Expected partition is invalid.');
+    }
+    const expectedProjects = requireExpectedProjects(options);
+    const documents = options.documents
+        .map(registration_js_1.requireRegisteredWorkloadRoleManifestDocument)
+        .sort((left, right) => compareStrings(left.project, right.project));
+    const documentProjects = documents.map(({ project }) => project);
+    if (JSON.stringify(documentProjects) !== JSON.stringify(expectedProjects)) {
+        throw new StageWorkloadRoleBoundaryError('stage-boundary-project-set-invalid', 'Registered documents must contain the complete reviewed project set exactly once.');
+    }
+    const roleIds = new Set();
+    const roleNames = new Set();
+    const nonIamActions = new Set();
+    const passRoleResourcesByService = new Map();
+    const expectedBoundaryArn = (0, boundary_js_1.workloadRoleBoundaryArn)({
+        accountId: options.expectedAccountId,
+        partition: options.expectedPartition,
+        stage: options.expectedStage,
+    });
+    for (const document of documents) {
+        if (document.accountId !== options.expectedAccountId ||
+            document.partition !== options.expectedPartition ||
+            document.manifest.candidate.identity !==
+                options.expectedCandidateIdentity ||
+            document.manifest.candidate.stage !== options.expectedStage ||
+            document.manifestDigest !==
+                options.expectedManifestDigests[document.project]) {
+            throw new StageWorkloadRoleBoundaryError('stage-boundary-substitution', `Registered project ${document.project} differs from the reviewed stage identity or digest.`);
+        }
+        if (document.manifest.roles.some(({ boundaryArn }) => boundaryArn !== expectedBoundaryArn)) {
+            throw new StageWorkloadRoleBoundaryError('stage-boundary-substitution', `Registered project ${document.project} substituted the stage boundary.`);
+        }
+        for (const role of document.manifest.roles) {
+            const normalizedRoleName = role.roleName.toLowerCase();
+            if (roleIds.has(role.id) || roleNames.has(normalizedRoleName)) {
+                throw new StageWorkloadRoleBoundaryError('stage-boundary-project-set-invalid', `Registered project ${document.project} duplicates workload role identity ${role.id} or ${role.roleName}.`);
+            }
+            roleIds.add(role.id);
+            roleNames.add(normalizedRoleName);
+        }
+        const bundle = (0, effective_policy_js_1.createWorkloadRoleEffectivePolicyBundle)({
+            intentsByRole: document.intentsByRole,
+            manifest: document.manifest,
+        });
+        const projectBoundary = (0, boundary_js_1.createWorkloadRoleBoundaryContract)({
+            accountId: document.accountId,
+            bundle,
+            manifest: document.manifest,
+            partition: document.partition,
+            stage: document.manifest.candidate.stage,
+        });
+        for (const statement of projectBoundary.policy.Statement) {
+            if (statement.Sid === 'DenyPrivilegeConstruction')
+                continue;
+            if (statement.Effect !== 'Allow') {
+                throw new StageWorkloadRoleBoundaryError('stage-boundary-substitution', `Registered project ${document.project} contains an unsupported non-fixed deny.`);
+            }
+            const iamActions = statement.Action.filter((action) => action.startsWith('iam:'));
+            for (const action of statement.Action) {
+                if (!action.startsWith('iam:'))
+                    nonIamActions.add(action);
+            }
+            if (iamActions.length === 0)
+                continue;
+            if (iamActions.some((action) => action !== 'iam:PassRole') ||
+                iamActions.length !== statement.Action.length ||
+                !statement.Condition ||
+                Object.keys(statement.Condition).length !== 1 ||
+                !statement.Condition.StringEquals ||
+                Object.keys(statement.Condition.StringEquals).length !== 1) {
+                throw new StageWorkloadRoleBoundaryError('stage-boundary-substitution', `Registered project ${document.project} contains an unsupported IAM allow in workload intent.`);
+            }
+            const destinationValue = statement.Condition.StringEquals['iam:PassedToService'];
+            const destinations = typeof destinationValue === 'string'
+                ? [destinationValue]
+                : destinationValue;
+            if (!Array.isArray(destinations) ||
+                destinations.length === 0 ||
+                destinations.some((destination) => !/^[a-z0-9](?:[a-z0-9-]*\.)+[a-z0-9-]+$/.test(destination)) ||
+                statement.Resource.some((resource) => !new RegExp(`^arn:${document.partition}:iam::${document.accountId}:role/[A-Za-z0-9+=,.@_-]{1,64}$`).test(resource))) {
+                throw new StageWorkloadRoleBoundaryError('stage-boundary-substitution', `Registered project ${document.project} contains a non-exact iam:PassRole allow.`);
+            }
+            for (const destination of destinations) {
+                const resources = passRoleResourcesByService.get(destination) ?? new Set();
+                for (const resource of statement.Resource)
+                    resources.add(resource);
+                passRoleResourcesByService.set(destination, resources);
+            }
+        }
+    }
+    if (nonIamActions.size === 0) {
+        throw new StageWorkloadRoleBoundaryError('stage-boundary-project-set-invalid', 'Stage boundary has no reviewed non-IAM workload actions.');
+    }
+    const policy = {
+        Statement: [
+            {
+                Action: [...nonIamActions].sort(compareStrings),
+                Effect: 'Allow',
+                Resource: ['*'],
+                Sid: 'AllowRegisteredWorkloadActions',
+            },
+            ...[...passRoleResourcesByService.entries()]
+                .sort(([left], [right]) => compareStrings(left, right))
+                .map(([destination, resources]) => ({
+                Action: ['iam:PassRole'],
+                Condition: {
+                    StringEquals: {
+                        'iam:PassedToService': destination,
+                    },
+                },
+                Effect: 'Allow',
+                Resource: [...resources].sort(compareStrings),
+                Sid: `AllowPassRole${(0, node_crypto_1.createHash)('sha256')
+                    .update(destination, 'utf8')
+                    .digest('hex')
+                    .slice(0, 20)}`,
+            })),
+            {
+                Action: [...boundary_js_1.WORKLOAD_ROLE_BOUNDARY_DENIED_ACTIONS],
+                Effect: 'Deny',
+                Resource: ['*'],
+                Sid: 'DenyPrivilegeConstruction',
+            },
+        ],
+        Version: '2012-10-17',
+    };
+    const serializedPolicy = JSON.stringify(policy);
+    if (serializedPolicy.length > exports.AWS_MANAGED_POLICY_MAXIMUM_CHARACTERS) {
+        throw new StageWorkloadRoleBoundaryError('stage-boundary-project-set-invalid', `Compact stage boundary is ${serializedPolicy.length} characters and exceeds the AWS managed-policy limit of ${exports.AWS_MANAGED_POLICY_MAXIMUM_CHARACTERS}.`);
+    }
+    return {
+        accountId: options.expectedAccountId,
+        arn: expectedBoundaryArn,
+        candidateIdentity: options.expectedCandidateIdentity,
+        digest: (0, node_crypto_1.createHash)('sha256').update(serializedPolicy, 'utf8').digest('hex'),
+        documents,
+        manifestDigestsByProject: Object.fromEntries(documents.map(({ manifestDigest, project }) => [project, manifestDigest])),
+        partition: options.expectedPartition,
+        path: (0, boundary_js_1.workloadRoleBoundaryPath)(options.expectedStage),
+        policy,
+        policyCharacters: serializedPolicy.length,
+        policyName: boundary_js_1.WORKLOAD_ROLE_BOUNDARY_POLICY_NAME,
+        projects: expectedProjects,
+        stage: options.expectedStage,
+    };
+}
+//# sourceMappingURL=stage-boundary.js.map

package/src/workload-roles/stage-boundary.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"stage-boundary.js","sourceRoot":"","sources":["../../../../../packages/nx/src/workload-roles/stage-boundary.ts"],"names":[],"mappings":";;;AA0GA,0FAwNC;AAlUD,6CAAyC;AAEzC,+CAOuB;AACvB,+DAAgF;AAChF,uDAG2B;AAO3B,MAAa,8BAA+B,SAAQ,KAAK;IAE5C;IADX,YACW,cAA8D,EACvE,OAAe;QAEf,KAAK,CAAC,OAAO,CAAC,CAAC;QAHN,mBAAc,GAAd,cAAc,CAAgD;QAIvE,IAAI,CAAC,IAAI,GAAG,gCAAgC,CAAC;IAC/C,CAAC;CACF;AARD,wEAQC;AASY,QAAA,qCAAqC,GAAG,KAAc,CAAC;AAEpE,MAAM,cAAc,GAAG,UAAU,CAAC;AAClC,MAAM,gBAAgB,GAAG,8BAA8B,CAAC;AACxD,MAAM,aAAa,GAAG,gBAAgB,CAAC;AACvC,MAAM,cAAc,GAAG,2BAA2B,CAAC;AACnD,MAAM,YAAY,GAAG,2BAA2B,CAAC;AAEjD,SAAS,cAAc,CAAC,IAAY,EAAE,KAAa;IACjD,OAAO,IAAI,GAAG,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,IAAI,GAAG,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;AAClD,CAAC;AAED,SAAS,YAAY,CAAC,KAAa,EAAE,OAAe,EAAE,KAAa;IACjE,IAAI,CAAC,OAAO,CAAC,IAAI,CAAC,KAAK,CAAC,EAAE,CAAC;QACzB,MAAM,IAAI,8BAA8B,CACtC,8BAA8B,EAC9B,GAAG,KAAK,cAAc,CACvB,CAAC;IACJ,CAAC;IACD,OAAO,KAAK,CAAC;AACf,CAAC;AAED,SAAS,uBAAuB,CAAC,OAGhC;IACC,IAAI,OAAO,CAAC,gBAAgB,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QAC1C,MAAM,IAAI,8BAA8B,CACtC,oCAAoC,EACpC,0DAA0D,CAC3D,CAAC;IACJ,CAAC;IACD,MAAM,QAAQ,GAAG,OAAO,CAAC,gBAAgB,CAAC,GAAG,CAAC,CAAC,OAAO,EAAE,EAAE,CACxD,YAAY,CAAC,OAAO,EAAE,cAAc,EAAE,kBAAkB,CAAC,CAC1D,CAAC;IACF,IAAI,IAAI,GAAG,CAAC,QAAQ,CAAC,CAAC,IAAI,KAAK,QAAQ,CAAC,MAAM,EAAE,CAAC;QAC/C,MAAM,IAAI,8BAA8B,CACtC,oCAAoC,EACpC,yCAAyC,CAC1C,CAAC;IACJ,CAAC;IACD,MAAM,cAAc,GAAG,MAAM,CAAC,IAAI,CAAC,OAAO,CAAC,uBAAuB,CAAC,CAAC,IAAI,CACtE,cAAc,CACf,CAAC;IACF,MAAM,QAAQ,GAAG,CAAC,GAAG,QAAQ,CAAC,CAAC,IAAI,CAAC,cAAc,CAAC,CAAC;IACpD,IACE,IAAI,CAAC,SAAS,CAAC,cAAc,CAAC,KAAK,IAAI,CAAC,SAAS,CAAC,QAAQ,CAAC;QAC3D,cAAc,CAAC,IAAI,CACjB,CAAC,OAAO,EAAE,EAAE,CACV,CAAC,aAAa,CAAC,IAAI,CAAC,OAAO,CAAC,uBAAuB,CAAC,OAAO,CAAW,CAAC,CAC1E,EACD,CAAC;QACD,MAAM,IAAI,8BAA8B,CACtC,oCAAoC,EACpC,qEAAqE,CACtE,CAAC;IACJ,CAAC;IACD,OAAO,QAAQ,CAAC;AAClB,CAAC;AAED;;;;;;;GAOG;AACH,SAAgB,uCAAuC,CAAC,OAQvD;IACC,YAAY,CAAC,OAAO,CAAC,iBAAiB,EAAE,cAAc,EAAE,kBAAkB,CAAC,CAAC;IAC5E,YAAY,CACV,OAAO,CAAC,yBAAyB,EACjC,gBAAgB,EAChB,6BAA6B,CAC9B,CAAC;IACF,YAAY,CAAC,OAAO,CAAC,aAAa,EAAE,YAAY,EAAE,gBAAgB,CAAC,CAAC;IACpE,IAAI,CAAC,CAAC,KAAK,EAAE,QAAQ,EAAE,YAAY,CAAC,CAAC,QAAQ,CAAC,OAAO,CAAC,iBAAiB,CAAC,EAAE,CAAC;QACzE,MAAM,IAAI,8BAA8B,CACtC,8BAA8B,EAC9B,gCAAgC,CACjC,CAAC;IACJ,CAAC;IACD,MAAM,gBAAgB,GAAG,uBAAuB,CAAC,OAAO,CAAC,CAAC;IAC1D,MAAM,SAAS,GAAG,OAAO,CAAC,SAAS;SAChC,GAAG,CAAC,+DAA6C,CAAC;SAClD,IAAI,CAAC,CAAC,IAAI,EAAE,KAAK,EAAE,EAAE,CAAC,cAAc,CAAC,IAAI,CAAC,OAAO,EAAE,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC;IACtE,MAAM,gBAAgB,GAAG,SAAS,CAAC,GAAG,CAAC,CAAC,EAAE,OAAO,EAAE,EAAE,EAAE,CAAC,OAAO,CAAC,CAAC;IACjE,IAAI,IAAI,CAAC,SAAS,CAAC,gBAAgB,CAAC,KAAK,IAAI,CAAC,SAAS,CAAC,gBAAgB,CAAC,EAAE,CAAC;QAC1E,MAAM,IAAI,8BAA8B,CACtC,oCAAoC,EACpC,mFAAmF,CACpF,CAAC;IACJ,CAAC;IAED,MAAM,OAAO,GAAG,IAAI,GAAG,EAAU,CAAC;IAClC,MAAM,SAAS,GAAG,IAAI,GAAG,EAAU,CAAC;IACpC,MAAM,aAAa,GAAG,IAAI,GAAG,EAAU,CAAC;IACxC,MAAM,0BAA0B,GAAG,IAAI,GAAG,EAAuB,CAAC;IAClE,MAAM,mBAAmB,GAAG,IAAA,qCAAuB,EAAC;QAClD,SAAS,EAAE,OAAO,CAAC,iBAAiB;QACpC,SAAS,EAAE,OAAO,CAAC,iBAAiB;QACpC,KAAK,EAAE,OAAO,CAAC,aAAa;KAC7B,CAAC,CAAC;IAEH,KAAK,MAAM,QAAQ,IAAI,SAAS,EAAE,CAAC;QACjC,IACE,QAAQ,CAAC,SAAS,KAAK,OAAO,CAAC,iBAAiB;YAChD,QAAQ,CAAC,SAAS,KAAK,OAAO,CAAC,iBAAiB;YAChD,QAAQ,CAAC,QAAQ,CAAC,SAAS,CAAC,QAAQ;gBAClC,OAAO,CAAC,yBAAyB;YACnC,QAAQ,CAAC,QAAQ,CAAC,SAAS,CAAC,KAAK,KAAK,OAAO,CAAC,aAAa;YAC3D,QAAQ,CAAC,cAAc;gBACrB,OAAO,CAAC,uBAAuB,CAAC,QAAQ,CAAC,OAAO,CAAC,EACnD,CAAC;YACD,MAAM,IAAI,8BAA8B,CACtC,6BAA6B,EAC7B,sBAAsB,QAAQ,CAAC,OAAO,sDAAsD,CAC7F,CAAC;QACJ,CAAC;QACD,IACE,QAAQ,CAAC,QAAQ,CAAC,KAAK,CAAC,IAAI,CAC1B,CAAC,EAAE,WAAW,EAAE,EAAE,EAAE,CAAC,WAAW,KAAK,mBAAmB,CACzD,EACD,CAAC;YACD,MAAM,IAAI,8BAA8B,CACtC,6BAA6B,EAC7B,sBAAsB,QAAQ,CAAC,OAAO,kCAAkC,CACzE,CAAC;QACJ,CAAC;QACD,KAAK,MAAM,IAAI,IAAI,QAAQ,CAAC,QAAQ,CAAC,KAAK,EAAE,CAAC;YAC3C,MAAM,kBAAkB,GAAG,IAAI,CAAC,QAAQ,CAAC,WAAW,EAAE,CAAC;YACvD,IAAI,OAAO,CAAC,GAAG,CAAC,IAAI,CAAC,EAAE,CAAC,IAAI,SAAS,CAAC,GAAG,CAAC,kBAAkB,CAAC,EAAE,CAAC;gBAC9D,MAAM,IAAI,8BAA8B,CACtC,oCAAoC,EACpC,sBAAsB,QAAQ,CAAC,OAAO,sCAAsC,IAAI,CAAC,EAAE,OAAO,IAAI,CAAC,QAAQ,GAAG,CAC3G,CAAC;YACJ,CAAC;YACD,OAAO,CAAC,GAAG,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;YACrB,SAAS,CAAC,GAAG,CAAC,kBAAkB,CAAC,CAAC;QACpC,CAAC;QACD,MAAM,MAAM,GAAG,IAAA,6DAAuC,EAAC;YACrD,aAAa,EAAE,QAAQ,CAAC,aAAa;YACrC,QAAQ,EAAE,QAAQ,CAAC,QAAQ;SAC5B,CAAC,CAAC;QACH,MAAM,eAAe,GAAG,IAAA,gDAAkC,EAAC;YACzD,SAAS,EAAE,QAAQ,CAAC,SAAS;YAC7B,MAAM;YACN,QAAQ,EAAE,QAAQ,CAAC,QAAQ;YAC3B,SAAS,EAAE,QAAQ,CAAC,SAAS;YAC7B,KAAK,EAAE,QAAQ,CAAC,QAAQ,CAAC,SAAS,CAAC,KAAK;SACzC,CAAC,CAAC;QACH,KAAK,MAAM,SAAS,IAAI,eAAe,CAAC,MAAM,CAAC,SAAS,EAAE,CAAC;YACzD,IAAI,SAAS,CAAC,GAAG,KAAK,2BAA2B;gBAAE,SAAS;YAC5D,IAAI,SAAS,CAAC,MAAM,KAAK,OAAO,EAAE,CAAC;gBACjC,MAAM,IAAI,8BAA8B,CACtC,6BAA6B,EAC7B,sBAAsB,QAAQ,CAAC,OAAO,0CAA0C,CACjF,CAAC;YACJ,CAAC;YACD,MAAM,UAAU,GAAG,SAAS,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC,MAAM,EAAE,EAAE,CACpD,MAAM,CAAC,UAAU,CAAC,MAAM,CAAC,CAC1B,CAAC;YACF,KAAK,MAAM,MAAM,IAAI,SAAS,CAAC,MAAM,EAAE,CAAC;gBACtC,IAAI,CAAC,MAAM,CAAC,UAAU,CAAC,MAAM,CAAC;oBAAE,aAAa,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC;YAC5D,CAAC;YACD,IAAI,UAAU,CAAC,MAAM,KAAK,CAAC;gBAAE,SAAS;YACtC,IACE,UAAU,CAAC,IAAI,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC,MAAM,KAAK,cAAc,CAAC;gBACtD,UAAU,CAAC,MAAM,KAAK,SAAS,CAAC,MAAM,CAAC,MAAM;gBAC7C,CAAC,SAAS,CAAC,SAAS;gBACpB,MAAM,CAAC,IAAI,CAAC,SAAS,CAAC,SAAS,CAAC,CAAC,MAAM,KAAK,CAAC;gBAC7C,CAAC,SAAS,CAAC,SAAS,CAAC,YAAY;gBACjC,MAAM,CAAC,IAAI,CAAC,SAAS,CAAC,SAAS,CAAC,YAAY,CAAC,CAAC,MAAM,KAAK,CAAC,EAC1D,CAAC;gBACD,MAAM,IAAI,8BAA8B,CACtC,6BAA6B,EAC7B,sBAAsB,QAAQ,CAAC,OAAO,wDAAwD,CAC/F,CAAC;YACJ,CAAC;YACD,MAAM,gBAAgB,GACpB,SAAS,CAAC,SAAS,CAAC,YAAY,CAAC,qBAAqB,CAAC,CAAC;YAC1D,MAAM,YAAY,GAChB,OAAO,gBAAgB,KAAK,QAAQ;gBAClC,CAAC,CAAC,CAAC,gBAAgB,CAAC;gBACpB,CAAC,CAAC,gBAAgB,CAAC;YACvB,IACE,CAAC,KAAK,CAAC,OAAO,CAAC,YAAY,CAAC;gBAC5B,YAAY,CAAC,MAAM,KAAK,CAAC;gBACzB,YAAY,CAAC,IAAI,CACf,CAAC,WAAW,EAAE,EAAE,CACd,CAAC,uCAAuC,CAAC,IAAI,CAAC,WAAW,CAAC,CAC7D;gBACD,SAAS,CAAC,QAAQ,CAAC,IAAI,CACrB,CAAC,QAAQ,EAAE,EAAE,CACX,CAAC,IAAI,MAAM,CACT,QAAQ,QAAQ,CAAC,SAAS,SAAS,QAAQ,CAAC,SAAS,iCAAiC,CACvF,CAAC,IAAI,CAAC,QAAQ,CAAC,CACnB,EACD,CAAC;gBACD,MAAM,IAAI,8BAA8B,CACtC,6BAA6B,EAC7B,sBAAsB,QAAQ,CAAC,OAAO,2CAA2C,CAClF,CAAC;YACJ,CAAC;YACD,KAAK,MAAM,WAAW,IAAI,YAAY,EAAE,CAAC;gBACvC,MAAM,SAAS,GACb,0BAA0B,CAAC,GAAG,CAAC,WAAW,CAAC,IAAI,IAAI,GAAG,EAAU,CAAC;gBACnE,KAAK,MAAM,QAAQ,IAAI,SAAS,CAAC,QAAQ;oBAAE,SAAS,CAAC,GAAG,CAAC,QAAQ,CAAC,CAAC;gBACnE,0BAA0B,CAAC,GAAG,CAAC,WAAW,EAAE,SAAS,CAAC,CAAC;YACzD,CAAC;QACH,CAAC;IACH,CAAC;IAED,IAAI,aAAa,CAAC,IAAI,KAAK,CAAC,EAAE,CAAC;QAC7B,MAAM,IAAI,8BAA8B,CACtC,oCAAoC,EACpC,0DAA0D,CAC3D,CAAC;IACJ,CAAC;IACD,MAAM,MAAM,GAA2C;QACrD,SAAS,EAAE;YACT;gBACE,MAAM,EAAE,CAAC,GAAG,aAAa,CAAC,CAAC,IAAI,CAAC,cAAc,CAAC;gBAC/C,MAAM,EAAE,OAAO;gBACf,QAAQ,EAAE,CAAC,GAAG,CAAC;gBACf,GAAG,EAAE,gCAAgC;aACtC;YACD,GAAG,CAAC,GAAG,0BAA0B,CAAC,OAAO,EAAE,CAAC;iBACzC,IAAI,CAAC,CAAC,CAAC,IAAI,CAAC,EAAE,CAAC,KAAK,CAAC,EAAE,EAAE,CAAC,cAAc,CAAC,IAAI,EAAE,KAAK,CAAC,CAAC;iBACtD,GAAG,CAAC,CAAC,CAAC,WAAW,EAAE,SAAS,CAAC,EAAE,EAAE,CAAC,CAAC;gBAClC,MAAM,EAAE,CAAC,cAAc,CAAC;gBACxB,SAAS,EAAE;oBACT,YAAY,EAAE;wBACZ,qBAAqB,EAAE,WAAW;qBACnC;iBACF;gBACD,MAAM,EAAE,OAAgB;gBACxB,QAAQ,EAAE,CAAC,GAAG,SAAS,CAAC,CAAC,IAAI,CAAC,cAAc,CAAC;gBAC7C,GAAG,EAAE,gBAAgB,IAAA,wBAAU,EAAC,QAAQ,CAAC;qBACtC,MAAM,CAAC,WAAW,EAAE,MAAM,CAAC;qBAC3B,MAAM,CAAC,KAAK,CAAC;qBACb,KAAK,CAAC,CAAC,EAAE,EAAE,CAAC,EAAE;aAClB,CAAC,CAAC;YACL;gBACE,MAAM,EAAE,CAAC,GAAG,mDAAqC,CAAC;gBAClD,MAAM,EAAE,MAAM;gBACd,QAAQ,EAAE,CAAC,GAAG,CAAC;gBACf,GAAG,EAAE,2BAA2B;aACjC;SACF;QACD,OAAO,EAAE,YAAY;KACtB,CAAC;IACF,MAAM,gBAAgB,GAAG,IAAI,CAAC,SAAS,CAAC,MAAM,CAAC,CAAC;IAChD,IAAI,gBAAgB,CAAC,MAAM,GAAG,6CAAqC,EAAE,CAAC;QACpE,MAAM,IAAI,8BAA8B,CACtC,oCAAoC,EACpC,6BAA6B,gBAAgB,CAAC,MAAM,2DAA2D,6CAAqC,GAAG,CACxJ,CAAC;IACJ,CAAC;IACD,OAAO;QACL,SAAS,EAAE,OAAO,CAAC,iBAAiB;QACpC,GAAG,EAAE,mBAAmB;QACxB,iBAAiB,EAAE,OAAO,CAAC,yBAAyB;QACpD,MAAM,EAAE,IAAA,wBAAU,EAAC,QAAQ,CAAC,CAAC,MAAM,CAAC,gBAAgB,EAAE,MAAM,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC;QAC3E,SAAS;QACT,wBAAwB,EAAE,MAAM,CAAC,WAAW,CAC1C,SAAS,CAAC,GAAG,CAAC,CAAC,EAAE,cAAc,EAAE,OAAO,EAAE,EAAE,EAAE,CAAC,CAAC,OAAO,EAAE,cAAc,CAAC,CAAC,CAC1E;QACD,SAAS,EAAE,OAAO,CAAC,iBAAoD;QACvE,IAAI,EAAE,IAAA,sCAAwB,EAAC,OAAO,CAAC,aAAa,CAAC;QACrD,MAAM;QACN,gBAAgB,EAAE,gBAAgB,CAAC,MAAM;QACzC,UAAU,EAAE,gDAAkC;QAC9C,QAAQ,EAAE,gBAAgB;QAC1B,KAAK,EAAE,OAAO,CAAC,aAAa;KAC7B,CAAC;AACJ,CAAC"}

package/src/workload-roles/standard-slice.d.ts

@@ -0,0 +1,54 @@
+import { type WorkloadRolePermissionIntent } from './effective-policy.js';
+import { type WorkloadRoleManifest, type WorkloadRoleSurface } from './manifest.js';
+export declare const STANDARD_SLICE_WORKLOAD_EXTENSION_KINDS: readonly ["function", "job", "service"];
+export type StandardSliceWorkloadExtensionKind = (typeof STANDARD_SLICE_WORKLOAD_EXTENSION_KINDS)[number];
+export interface StandardSliceWorkloadExtension {
+    id: string;
+    kind: StandardSliceWorkloadExtensionKind;
+}
+export interface StandardSliceWorkloadRoleTopologyEntry {
+    id: string;
+    ownership: {
+        project: string;
+        resource: string;
+    };
+    resource: string;
+    surface: WorkloadRoleSurface;
+}
+export interface StandardSliceWorkloadRoleTopology {
+    roles: StandardSliceWorkloadRoleTopologyEntry[];
+    serviceAdapterOwner: string | null;
+    slice: string;
+}
+export interface StandardSliceServiceAdapterMetadata {
+    owner: string | null;
+    status: 'managed-generated-service-runtime-endpoint' | 'requires-adopter-service-runtime-endpoint';
+}
+export interface StandardSliceWorkloadRoleCandidate {
+    intentsByRole: Readonly<Record<string, readonly WorkloadRolePermissionIntent[]>>;
+    manifest: WorkloadRoleManifest;
+    topology: StandardSliceWorkloadRoleTopology;
+}
+export type StandardSliceWorkloadRoleFailureClassification = 'standard-role-input-invalid' | 'standard-role-intent-incomplete' | 'standard-role-intent-substitution' | 'standard-role-topology-ambiguous';
+export declare class StandardSliceWorkloadRoleError extends Error {
+    readonly classification: StandardSliceWorkloadRoleFailureClassification;
+    constructor(classification: StandardSliceWorkloadRoleFailureClassification, message: string);
+}
+export declare function createStandardSliceWorkloadRoleTopology(options: {
+    databaseIdentifiers?: readonly string[];
+    extensions?: readonly StandardSliceWorkloadExtension[];
+    serviceAdapter?: StandardSliceServiceAdapterMetadata;
+    slice: string;
+}): StandardSliceWorkloadRoleTopology;
+export declare function standardSliceWorkloadRoleName(stage: string, slice: string, resource: string): string;
+export declare function createStandardSliceWorkloadRoleCandidate(options: {
+    accountId: string;
+    candidateIdentity: string;
+    databaseIdentifiers?: readonly string[];
+    extensions?: readonly StandardSliceWorkloadExtension[];
+    intentsByRole: Readonly<Record<string, readonly WorkloadRolePermissionIntent[]>>;
+    partition: string;
+    serviceAdapter?: StandardSliceServiceAdapterMetadata;
+    slice: string;
+    stage: string;
+}): StandardSliceWorkloadRoleCandidate;

package/src/workload-roles/standard-slice.js

@@ -0,0 +1,252 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.StandardSliceWorkloadRoleError = exports.STANDARD_SLICE_WORKLOAD_EXTENSION_KINDS = void 0;
+exports.createStandardSliceWorkloadRoleTopology = createStandardSliceWorkloadRoleTopology;
+exports.standardSliceWorkloadRoleName = standardSliceWorkloadRoleName;
+exports.createStandardSliceWorkloadRoleCandidate = createStandardSliceWorkloadRoleCandidate;
+const node_crypto_1 = require("node:crypto");
+const boundary_js_1 = require("./boundary.js");
+const effective_policy_js_1 = require("./effective-policy.js");
+const manifest_js_1 = require("./manifest.js");
+exports.STANDARD_SLICE_WORKLOAD_EXTENSION_KINDS = [
+    'function',
+    'job',
+    'service',
+];
+class StandardSliceWorkloadRoleError extends Error {
+    classification;
+    constructor(classification, message) {
+        super(message);
+        this.classification = classification;
+        this.name = 'StandardSliceWorkloadRoleError';
+    }
+}
+exports.StandardSliceWorkloadRoleError = StandardSliceWorkloadRoleError;
+const identifierPattern = /^[a-z0-9][a-z0-9-]{0,62}$/;
+const databaseIdentifierPattern = /^[a-z][a-z0-9]*(?:[-_][a-z0-9]+)*$/;
+function compareStrings(left, right) {
+    return left < right ? -1 : left > right ? 1 : 0;
+}
+function requireIdentifier(value, label) {
+    if (!identifierPattern.test(value)) {
+        throw new StandardSliceWorkloadRoleError('standard-role-input-invalid', `${label} must be a normalized identifier.`);
+    }
+    return value;
+}
+function requireDatabaseIdentifier(value) {
+    if (!databaseIdentifierPattern.test(value)) {
+        throw new StandardSliceWorkloadRoleError('standard-role-input-invalid', 'Database identifier must match the generated bindings contract.');
+    }
+    return value;
+}
+function baseTopology(slice, databaseIdentifiers) {
+    const role = (resource, surface, ownershipResource = resource) => ({
+        id: `${slice}.${resource}`,
+        ownership: { project: slice, resource: ownershipResource },
+        resource,
+        surface,
+    });
+    const roles = [
+        role('api-data-rights', 'api-route'),
+        role('api-delegations', 'api-route'),
+        role('api-health', 'api-route'),
+        role('api-machine-authorization-proof', 'api-route'),
+        role('api-protected', 'api-route'),
+        role('api-database-health', 'api-route'),
+        role('api-database-records', 'api-route'),
+        role('api-publish-created', 'api-route'),
+        role('async-outbox-relay', 'lambda-function'),
+        role('async-provider-worker', 'queue-consumer'),
+        role('async-schedule-target', 'lambda-function'),
+        role('async-webhook-ingress', 'api-route'),
+        role('async-workflow-orchestration', 'job-orchestration'),
+        role('async-workflow-task', 'lambda-function'),
+        role('configuration-monitor', 'appconfig-monitor'),
+        role('data-export-cleanup', 'lambda-function'),
+        role('data-retention-maintenance-launcher', 'lambda-function'),
+        role('event-consumer', 'queue-consumer'),
+        role('machine-client-provisioner', 'lambda-function'),
+        role('machine-authorization-proof', 'lambda-function'),
+        role('web-server', 'next-server'),
+        role('web-image-optimizer', 'next-image-optimizer'),
+        role('web-revalidation-seeder', 'next-revalidation-seeder'),
+        role('web-revalidation-subscriber', 'next-revalidation-subscriber'),
+        role('data-retention-job-task', 'job-task', 'data-retention-job'),
+        role('data-retention-job-execution', 'job-execution', 'data-retention-job'),
+        role('data-retention-job-orchestration', 'job-orchestration'),
+        role('data-retention-maintenance-job-task', 'job-task', 'data-retention-maintenance-job'),
+        role('data-retention-maintenance-job-execution', 'job-execution', 'data-retention-maintenance-job'),
+    ];
+    for (const database of databaseIdentifiers) {
+        const prefix = `database-${database}`;
+        roles.push(role(`${prefix}-bootstrap-task`, 'bootstrap-task', `${prefix}-bootstrap`), role(`${prefix}-bootstrap-execution`, 'bootstrap-execution', `${prefix}-bootstrap`), role(`${prefix}-migration-task`, 'migration-task', `${prefix}-migration`), role(`${prefix}-migration-execution`, 'migration-execution', `${prefix}-migration`), role(`${prefix}-migration-orchestration`, 'migration-orchestration'));
+        if (database === 'retirement_rehearsal') {
+            roles.push(role(`${prefix}-retirement-task`, 'retirement-task', `${prefix}-retirement`), role(`${prefix}-retirement-execution`, 'retirement-execution', `${prefix}-retirement`), role(`${prefix}-retirement-orchestration`, 'retirement-orchestration'));
+        }
+    }
+    return roles;
+}
+function extensionTopology(slice, extension, ownsProtectedLoadAdapter) {
+    const id = requireIdentifier(extension.id, 'Workload extension id');
+    if (!exports.STANDARD_SLICE_WORKLOAD_EXTENSION_KINDS.includes(extension.kind)) {
+        throw new StandardSliceWorkloadRoleError('standard-role-input-invalid', `Workload extension ${id} uses an unsupported kind.`);
+    }
+    const entry = (suffix, surface, ownershipResource = `${id}-${suffix}`) => {
+        const resource = `${id}-${suffix}`;
+        return {
+            id: `${slice}.${resource}`,
+            ownership: { project: slice, resource: ownershipResource },
+            resource,
+            surface,
+        };
+    };
+    if (extension.kind === 'function') {
+        return [entry('function', 'lambda-function')];
+    }
+    if (extension.kind === 'service') {
+        return [
+            entry('service-task', 'service-task', `${id}-service`),
+            ...(ownsProtectedLoadAdapter
+                ? [entry('service-performance-task', 'service-task', `${id}-service`)]
+                : []),
+            entry('service-execution', 'service-execution', `${id}-service`),
+        ];
+    }
+    return [
+        entry('job-task', 'job-task', `${id}-job`),
+        entry('job-execution', 'job-execution', `${id}-job`),
+    ];
+}
+function createStandardSliceWorkloadRoleTopology(options) {
+    const slice = requireIdentifier(options.slice, 'Slice');
+    const databaseIdentifiers = options.databaseIdentifiers ?? ['primary'];
+    if (databaseIdentifiers.length === 0) {
+        throw new StandardSliceWorkloadRoleError('standard-role-input-invalid', 'A Standard Slice must declare at least one database identifier.');
+    }
+    for (const identifier of databaseIdentifiers) {
+        requireDatabaseIdentifier(identifier);
+    }
+    if (new Set(databaseIdentifiers).size !== databaseIdentifiers.length) {
+        throw new StandardSliceWorkloadRoleError('standard-role-topology-ambiguous', 'Standard Slice database identifiers must be unique.');
+    }
+    const extensions = options.extensions ?? [];
+    const extensionKeys = extensions.map(({ id, kind }) => `${kind}:${requireIdentifier(id, 'Workload extension id')}`);
+    if (new Set(extensionKeys).size !== extensionKeys.length) {
+        throw new StandardSliceWorkloadRoleError('standard-role-topology-ambiguous', 'Standard Slice workload extensions must be unique by kind and id.');
+    }
+    const serviceAdapter = options.serviceAdapter ?? {
+        owner: null,
+        status: 'requires-adopter-service-runtime-endpoint',
+    };
+    const serviceAdapterOwner = serviceAdapter.owner;
+    const serviceExtensions = extensions.filter(({ kind }) => kind === 'service');
+    if (serviceAdapter.status === 'managed-generated-service-runtime-endpoint'
+        ? typeof serviceAdapterOwner !== 'string' ||
+            !identifierPattern.test(serviceAdapterOwner) ||
+            serviceExtensions.filter(({ id }) => id === serviceAdapterOwner)
+                .length !== 1
+        : serviceAdapter.status !== 'requires-adopter-service-runtime-endpoint' ||
+            serviceAdapterOwner !== null) {
+        throw new StandardSliceWorkloadRoleError('standard-role-topology-ambiguous', 'Standard Slice Service adapter metadata must elect exactly one generated Service only when managed.');
+    }
+    const roles = [
+        ...baseTopology(slice, databaseIdentifiers),
+        ...extensions.flatMap((extension) => extensionTopology(slice, extension, extension.kind === 'service' && extension.id === serviceAdapterOwner)),
+    ].sort((left, right) => compareStrings(left.id, right.id));
+    const ids = roles.map(({ id }) => id);
+    const resources = roles.map(({ resource }) => resource);
+    if (new Set(ids).size !== ids.length ||
+        new Set(resources).size !== resources.length) {
+        throw new StandardSliceWorkloadRoleError('standard-role-topology-ambiguous', 'Standard Slice workload composition produced duplicate role identities.');
+    }
+    return { roles, serviceAdapterOwner, slice };
+}
+function standardSliceWorkloadRoleName(stage, slice, resource) {
+    const unabridged = `ebk-${stage}-${slice}-${resource}`;
+    if (unabridged.length <= 64) {
+        return unabridged;
+    }
+    const digest = (0, node_crypto_1.createHash)('sha256')
+        .update(unabridged, 'utf8')
+        .digest('hex')
+        .slice(0, 12);
+    return `${unabridged.slice(0, 51)}-${digest}`;
+}
+function canonicalIntents(topology, intentsByRole) {
+    const expected = new Set(topology.roles.map(({ id }) => id));
+    const unexpected = Object.keys(intentsByRole).filter((roleId) => !expected.has(roleId));
+    if (unexpected.length > 0) {
+        throw new StandardSliceWorkloadRoleError('standard-role-intent-substitution', `Permission intent source contains undeclared Standard Slice roles: ${unexpected.sort(compareStrings).join(', ')}.`);
+    }
+    const missing = topology.roles
+        .filter(({ id }) => !Object.prototype.hasOwnProperty.call(intentsByRole, id))
+        .map(({ id }) => id);
+    if (missing.length > 0) {
+        throw new StandardSliceWorkloadRoleError('standard-role-intent-incomplete', `Permission intent source is missing Standard Slice roles: ${missing.join(', ')}.`);
+    }
+    return Object.fromEntries(topology.roles.map(({ id }) => [
+        id,
+        (intentsByRole[id] ?? []).map((intent) => ({
+            ...intent,
+            actions: [...intent.actions],
+            ...(intent.conditions
+                ? {
+                    conditions: Object.fromEntries(Object.entries(intent.conditions).map(([operator, entries]) => [
+                        operator,
+                        Object.fromEntries(Object.entries(entries).map(([key, value]) => [
+                            key,
+                            Array.isArray(value) ? [...value] : value,
+                        ])),
+                    ])),
+                }
+                : {}),
+            resources: [...intent.resources],
+            source: { ...intent.source },
+        })),
+    ]));
+}
+function createStandardSliceWorkloadRoleCandidate(options) {
+    const topology = createStandardSliceWorkloadRoleTopology({
+        ...(options.databaseIdentifiers
+            ? { databaseIdentifiers: options.databaseIdentifiers }
+            : {}),
+        ...(options.extensions ? { extensions: options.extensions } : {}),
+        ...(options.serviceAdapter
+            ? { serviceAdapter: options.serviceAdapter }
+            : {}),
+        slice: options.slice,
+    });
+    const intentsByRole = canonicalIntents(topology, options.intentsByRole);
+    const boundaryArn = (0, boundary_js_1.workloadRoleBoundaryArn)({
+        accountId: options.accountId,
+        partition: options.partition,
+        stage: options.stage,
+    });
+    const roles = topology.roles.map((entry) => {
+        const contract = manifest_js_1.WORKLOAD_ROLE_SURFACE_CONTRACTS[entry.surface];
+        const draft = {
+            boundaryArn,
+            id: entry.id,
+            ownership: { ...entry.ownership },
+            passDestinations: [contract.passDestination],
+            permissionPolicyDigest: '0'.repeat(64),
+            roleName: standardSliceWorkloadRoleName(options.stage, topology.slice, entry.resource),
+            surface: entry.surface,
+            trustClass: contract.trustClass,
+        };
+        return {
+            ...draft,
+            permissionPolicyDigest: (0, effective_policy_js_1.createWorkloadRoleEffectivePolicy)(draft, intentsByRole[entry.id] ?? []).digest,
+        };
+    });
+    const manifest = (0, manifest_js_1.canonicalizeWorkloadRoleManifest)({
+        candidate: {
+            identity: options.candidateIdentity,
+            stage: options.stage,
+        },
+        roles,
+        schemaVersion: manifest_js_1.WORKLOAD_ROLE_MANIFEST_SCHEMA_VERSION,
+    });
+    return { intentsByRole, manifest, topology };
+}
+//# sourceMappingURL=standard-slice.js.map

package/src/workload-roles/standard-slice.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"standard-slice.js","sourceRoot":"","sources":["../../../../../packages/nx/src/workload-roles/standard-slice.ts"],"names":[],"mappings":";;;AA6OA,0FA+EC;AAED,sEAcC;AA0DD,4FA8DC;AApcD,6CAAyC;AAEzC,+CAAwD;AACxD,+DAG+B;AAC/B,+CAMuB;AAEV,QAAA,uCAAuC,GAAG;IACrD,UAAU;IACV,KAAK;IACL,SAAS;CACD,CAAC;AA+CX,MAAa,8BAA+B,SAAQ,KAAK;IAE5C;IADX,YACW,cAA8D,EACvE,OAAe;QAEf,KAAK,CAAC,OAAO,CAAC,CAAC;QAHN,mBAAc,GAAd,cAAc,CAAgD;QAIvE,IAAI,CAAC,IAAI,GAAG,gCAAgC,CAAC;IAC/C,CAAC;CACF;AARD,wEAQC;AAED,MAAM,iBAAiB,GAAG,2BAA2B,CAAC;AACtD,MAAM,yBAAyB,GAAG,oCAAoC,CAAC;AAEvE,SAAS,cAAc,CAAC,IAAY,EAAE,KAAa;IACjD,OAAO,IAAI,GAAG,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,IAAI,GAAG,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;AAClD,CAAC;AAED,SAAS,iBAAiB,CAAC,KAAa,EAAE,KAAa;IACrD,IAAI,CAAC,iBAAiB,CAAC,IAAI,CAAC,KAAK,CAAC,EAAE,CAAC;QACnC,MAAM,IAAI,8BAA8B,CACtC,6BAA6B,EAC7B,GAAG,KAAK,mCAAmC,CAC5C,CAAC;IACJ,CAAC;IACD,OAAO,KAAK,CAAC;AACf,CAAC;AAED,SAAS,yBAAyB,CAAC,KAAa;IAC9C,IAAI,CAAC,yBAAyB,CAAC,IAAI,CAAC,KAAK,CAAC,EAAE,CAAC;QAC3C,MAAM,IAAI,8BAA8B,CACtC,6BAA6B,EAC7B,iEAAiE,CAClE,CAAC;IACJ,CAAC;IACD,OAAO,KAAK,CAAC;AACf,CAAC;AAED,SAAS,YAAY,CACnB,KAAa,EACb,mBAAsC;IAEtC,MAAM,IAAI,GAAG,CACX,QAAgB,EAChB,OAA4B,EAC5B,iBAAiB,GAAG,QAAQ,EACY,EAAE,CAAC,CAAC;QAC5C,EAAE,EAAE,GAAG,KAAK,IAAI,QAAQ,EAAE;QAC1B,SAAS,EAAE,EAAE,OAAO,EAAE,KAAK,EAAE,QAAQ,EAAE,iBAAiB,EAAE;QAC1D,QAAQ;QACR,OAAO;KACR,CAAC,CAAC;IAEH,MAAM,KAAK,GAA6C;QACtD,IAAI,CAAC,iBAAiB,EAAE,WAAW,CAAC;QACpC,IAAI,CAAC,iBAAiB,EAAE,WAAW,CAAC;QACpC,IAAI,CAAC,YAAY,EAAE,WAAW,CAAC;QAC/B,IAAI,CAAC,iCAAiC,EAAE,WAAW,CAAC;QACpD,IAAI,CAAC,eAAe,EAAE,WAAW,CAAC;QAClC,IAAI,CAAC,qBAAqB,EAAE,WAAW,CAAC;QACxC,IAAI,CAAC,sBAAsB,EAAE,WAAW,CAAC;QACzC,IAAI,CAAC,qBAAqB,EAAE,WAAW,CAAC;QACxC,IAAI,CAAC,oBAAoB,EAAE,iBAAiB,CAAC;QAC7C,IAAI,CAAC,uBAAuB,EAAE,gBAAgB,CAAC;QAC/C,IAAI,CAAC,uBAAuB,EAAE,iBAAiB,CAAC;QAChD,IAAI,CAAC,uBAAuB,EAAE,WAAW,CAAC;QAC1C,IAAI,CAAC,8BAA8B,EAAE,mBAAmB,CAAC;QACzD,IAAI,CAAC,qBAAqB,EAAE,iBAAiB,CAAC;QAC9C,IAAI,CAAC,uBAAuB,EAAE,mBAAmB,CAAC;QAClD,IAAI,CAAC,qBAAqB,EAAE,iBAAiB,CAAC;QAC9C,IAAI,CAAC,qCAAqC,EAAE,iBAAiB,CAAC;QAC9D,IAAI,CAAC,gBAAgB,EAAE,gBAAgB,CAAC;QACxC,IAAI,CAAC,4BAA4B,EAAE,iBAAiB,CAAC;QACrD,IAAI,CAAC,6BAA6B,EAAE,iBAAiB,CAAC;QACtD,IAAI,CAAC,YAAY,EAAE,aAAa,CAAC;QACjC,IAAI,CAAC,qBAAqB,EAAE,sBAAsB,CAAC;QACnD,IAAI,CAAC,yBAAyB,EAAE,0BAA0B,CAAC;QAC3D,IAAI,CAAC,6BAA6B,EAAE,8BAA8B,CAAC;QACnE,IAAI,CAAC,yBAAyB,EAAE,UAAU,EAAE,oBAAoB,CAAC;QACjE,IAAI,CAAC,8BAA8B,EAAE,eAAe,EAAE,oBAAoB,CAAC;QAC3E,IAAI,CAAC,kCAAkC,EAAE,mBAAmB,CAAC;QAC7D,IAAI,CACF,qCAAqC,EACrC,UAAU,EACV,gCAAgC,CACjC;QACD,IAAI,CACF,0CAA0C,EAC1C,eAAe,EACf,gCAAgC,CACjC;KACF,CAAC;IAEF,KAAK,MAAM,QAAQ,IAAI,mBAAmB,EAAE,CAAC;QAC3C,MAAM,MAAM,GAAG,YAAY,QAAQ,EAAE,CAAC;QACtC,KAAK,CAAC,IAAI,CACR,IAAI,CAAC,GAAG,MAAM,iBAAiB,EAAE,gBAAgB,EAAE,GAAG,MAAM,YAAY,CAAC,EACzE,IAAI,CACF,GAAG,MAAM,sBAAsB,EAC/B,qBAAqB,EACrB,GAAG,MAAM,YAAY,CACtB,EACD,IAAI,CAAC,GAAG,MAAM,iBAAiB,EAAE,gBAAgB,EAAE,GAAG,MAAM,YAAY,CAAC,EACzE,IAAI,CACF,GAAG,MAAM,sBAAsB,EAC/B,qBAAqB,EACrB,GAAG,MAAM,YAAY,CACtB,EACD,IAAI,CAAC,GAAG,MAAM,0BAA0B,EAAE,yBAAyB,CAAC,CACrE,CAAC;QACF,IAAI,QAAQ,KAAK,sBAAsB,EAAE,CAAC;YACxC,KAAK,CAAC,IAAI,CACR,IAAI,CACF,GAAG,MAAM,kBAAkB,EAC3B,iBAAiB,EACjB,GAAG,MAAM,aAAa,CACvB,EACD,IAAI,CACF,GAAG,MAAM,uBAAuB,EAChC,sBAAsB,EACtB,GAAG,MAAM,aAAa,CACvB,EACD,IAAI,CAAC,GAAG,MAAM,2BAA2B,EAAE,0BAA0B,CAAC,CACvE,CAAC;QACJ,CAAC;IACH,CAAC;IACD,OAAO,KAAK,CAAC;AACf,CAAC;AAED,SAAS,iBAAiB,CACxB,KAAa,EACb,SAAyC,EACzC,wBAAiC;IAEjC,MAAM,EAAE,GAAG,iBAAiB,CAAC,SAAS,CAAC,EAAE,EAAE,uBAAuB,CAAC,CAAC;IACpE,IAAI,CAAC,+CAAuC,CAAC,QAAQ,CAAC,SAAS,CAAC,IAAI,CAAC,EAAE,CAAC;QACtE,MAAM,IAAI,8BAA8B,CACtC,6BAA6B,EAC7B,sBAAsB,EAAE,4BAA4B,CACrD,CAAC;IACJ,CAAC;IACD,MAAM,KAAK,GAAG,CACZ,MAAc,EACd,OAA4B,EAC5B,iBAAiB,GAAG,GAAG,EAAE,IAAI,MAAM,EAAE,EACG,EAAE;QAC1C,MAAM,QAAQ,GAAG,GAAG,EAAE,IAAI,MAAM,EAAE,CAAC;QACnC,OAAO;YACL,EAAE,EAAE,GAAG,KAAK,IAAI,QAAQ,EAAE;YAC1B,SAAS,EAAE,EAAE,OAAO,EAAE,KAAK,EAAE,QAAQ,EAAE,iBAAiB,EAAE;YAC1D,QAAQ;YACR,OAAO;SACR,CAAC;IACJ,CAAC,CAAC;IACF,IAAI,SAAS,CAAC,IAAI,KAAK,UAAU,EAAE,CAAC;QAClC,OAAO,CAAC,KAAK,CAAC,UAAU,EAAE,iBAAiB,CAAC,CAAC,CAAC;IAChD,CAAC;IACD,IAAI,SAAS,CAAC,IAAI,KAAK,SAAS,EAAE,CAAC;QACjC,OAAO;YACL,KAAK,CAAC,cAAc,EAAE,cAAc,EAAE,GAAG,EAAE,UAAU,CAAC;YACtD,GAAG,CAAC,wBAAwB;gBAC1B,CAAC,CAAC,CAAC,KAAK,CAAC,0BAA0B,EAAE,cAAc,EAAE,GAAG,EAAE,UAAU,CAAC,CAAC;gBACtE,CAAC,CAAC,EAAE,CAAC;YACP,KAAK,CAAC,mBAAmB,EAAE,mBAAmB,EAAE,GAAG,EAAE,UAAU,CAAC;SACjE,CAAC;IACJ,CAAC;IACD,OAAO;QACL,KAAK,CAAC,UAAU,EAAE,UAAU,EAAE,GAAG,EAAE,MAAM,CAAC;QAC1C,KAAK,CAAC,eAAe,EAAE,eAAe,EAAE,GAAG,EAAE,MAAM,CAAC;KACrD,CAAC;AACJ,CAAC;AAED,SAAgB,uCAAuC,CAAC,OAKvD;IACC,MAAM,KAAK,GAAG,iBAAiB,CAAC,OAAO,CAAC,KAAK,EAAE,OAAO,CAAC,CAAC;IACxD,MAAM,mBAAmB,GAAG,OAAO,CAAC,mBAAmB,IAAI,CAAC,SAAS,CAAC,CAAC;IACvE,IAAI,mBAAmB,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QACrC,MAAM,IAAI,8BAA8B,CACtC,6BAA6B,EAC7B,iEAAiE,CAClE,CAAC;IACJ,CAAC;IACD,KAAK,MAAM,UAAU,IAAI,mBAAmB,EAAE,CAAC;QAC7C,yBAAyB,CAAC,UAAU,CAAC,CAAC;IACxC,CAAC;IACD,IAAI,IAAI,GAAG,CAAC,mBAAmB,CAAC,CAAC,IAAI,KAAK,mBAAmB,CAAC,MAAM,EAAE,CAAC;QACrE,MAAM,IAAI,8BAA8B,CACtC,kCAAkC,EAClC,qDAAqD,CACtD,CAAC;IACJ,CAAC;IAED,MAAM,UAAU,GAAG,OAAO,CAAC,UAAU,IAAI,EAAE,CAAC;IAC5C,MAAM,aAAa,GAAG,UAAU,CAAC,GAAG,CAClC,CAAC,EAAE,EAAE,EAAE,IAAI,EAAE,EAAE,EAAE,CACf,GAAG,IAAI,IAAI,iBAAiB,CAAC,EAAE,EAAE,uBAAuB,CAAC,EAAE,CAC9D,CAAC;IACF,IAAI,IAAI,GAAG,CAAC,aAAa,CAAC,CAAC,IAAI,KAAK,aAAa,CAAC,MAAM,EAAE,CAAC;QACzD,MAAM,IAAI,8BAA8B,CACtC,kCAAkC,EAClC,mEAAmE,CACpE,CAAC;IACJ,CAAC;IAED,MAAM,cAAc,GAAG,OAAO,CAAC,cAAc,IAAI;QAC/C,KAAK,EAAE,IAAI;QACX,MAAM,EAAE,2CAAoD;KAC7D,CAAC;IACF,MAAM,mBAAmB,GAAG,cAAc,CAAC,KAAK,CAAC;IACjD,MAAM,iBAAiB,GAAG,UAAU,CAAC,MAAM,CAAC,CAAC,EAAE,IAAI,EAAE,EAAE,EAAE,CAAC,IAAI,KAAK,SAAS,CAAC,CAAC;IAC9E,IACE,cAAc,CAAC,MAAM,KAAK,4CAA4C;QACpE,CAAC,CAAC,OAAO,mBAAmB,KAAK,QAAQ;YACvC,CAAC,iBAAiB,CAAC,IAAI,CAAC,mBAAmB,CAAC;YAC5C,iBAAiB,CAAC,MAAM,CAAC,CAAC,EAAE,EAAE,EAAE,EAAE,EAAE,CAAC,EAAE,KAAK,mBAAmB,CAAC;iBAC7D,MAAM,KAAK,CAAC;QACjB,CAAC,CAAC,cAAc,CAAC,MAAM,KAAK,2CAA2C;YACrE,mBAAmB,KAAK,IAAI,EAChC,CAAC;QACD,MAAM,IAAI,8BAA8B,CACtC,kCAAkC,EAClC,qGAAqG,CACtG,CAAC;IACJ,CAAC;IAED,MAAM,KAAK,GAAG;QACZ,GAAG,YAAY,CAAC,KAAK,EAAE,mBAAmB,CAAC;QAC3C,GAAG,UAAU,CAAC,OAAO,CAAC,CAAC,SAAS,EAAE,EAAE,CAClC,iBAAiB,CACf,KAAK,EACL,SAAS,EACT,SAAS,CAAC,IAAI,KAAK,SAAS,IAAI,SAAS,CAAC,EAAE,KAAK,mBAAmB,CACrE,CACF;KACF,CAAC,IAAI,CAAC,CAAC,IAAI,EAAE,KAAK,EAAE,EAAE,CAAC,cAAc,CAAC,IAAI,CAAC,EAAE,EAAE,KAAK,CAAC,EAAE,CAAC,CAAC,CAAC;IAC3D,MAAM,GAAG,GAAG,KAAK,CAAC,GAAG,CAAC,CAAC,EAAE,EAAE,EAAE,EAAE,EAAE,CAAC,EAAE,CAAC,CAAC;IACtC,MAAM,SAAS,GAAG,KAAK,CAAC,GAAG,CAAC,CAAC,EAAE,QAAQ,EAAE,EAAE,EAAE,CAAC,QAAQ,CAAC,CAAC;IACxD,IACE,IAAI,GAAG,CAAC,GAAG,CAAC,CAAC,IAAI,KAAK,GAAG,CAAC,MAAM;QAChC,IAAI,GAAG,CAAC,SAAS,CAAC,CAAC,IAAI,KAAK,SAAS,CAAC,MAAM,EAC5C,CAAC;QACD,MAAM,IAAI,8BAA8B,CACtC,kCAAkC,EAClC,yEAAyE,CAC1E,CAAC;IACJ,CAAC;IACD,OAAO,EAAE,KAAK,EAAE,mBAAmB,EAAE,KAAK,EAAE,CAAC;AAC/C,CAAC;AAED,SAAgB,6BAA6B,CAC3C,KAAa,EACb,KAAa,EACb,QAAgB;IAEhB,MAAM,UAAU,GAAG,OAAO,KAAK,IAAI,KAAK,IAAI,QAAQ,EAAE,CAAC;IACvD,IAAI,UAAU,CAAC,MAAM,IAAI,EAAE,EAAE,CAAC;QAC5B,OAAO,UAAU,CAAC;IACpB,CAAC;IACD,MAAM,MAAM,GAAG,IAAA,wBAAU,EAAC,QAAQ,CAAC;SAChC,MAAM,CAAC,UAAU,EAAE,MAAM,CAAC;SAC1B,MAAM,CAAC,KAAK,CAAC;SACb,KAAK,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC;IAChB,OAAO,GAAG,UAAU,CAAC,KAAK,CAAC,CAAC,EAAE,EAAE,CAAC,IAAI,MAAM,EAAE,CAAC;AAChD,CAAC;AAED,SAAS,gBAAgB,CACvB,QAA2C,EAC3C,aAEC;IAED,MAAM,QAAQ,GAAG,IAAI,GAAG,CAAC,QAAQ,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,EAAE,EAAE,EAAE,EAAE,EAAE,CAAC,EAAE,CAAC,CAAC,CAAC;IAC7D,MAAM,UAAU,GAAG,MAAM,CAAC,IAAI,CAAC,aAAa,CAAC,CAAC,MAAM,CAClD,CAAC,MAAM,EAAE,EAAE,CAAC,CAAC,QAAQ,CAAC,GAAG,CAAC,MAAM,CAAC,CAClC,CAAC;IACF,IAAI,UAAU,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;QAC1B,MAAM,IAAI,8BAA8B,CACtC,mCAAmC,EACnC,sEAAsE,UAAU,CAAC,IAAI,CAAC,cAAc,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,GAAG,CACpH,CAAC;IACJ,CAAC;IACD,MAAM,OAAO,GAAG,QAAQ,CAAC,KAAK;SAC3B,MAAM,CACL,CAAC,EAAE,EAAE,EAAE,EAAE,EAAE,CAAC,CAAC,MAAM,CAAC,SAAS,CAAC,cAAc,CAAC,IAAI,CAAC,aAAa,EAAE,EAAE,CAAC,CACrE;SACA,GAAG,CAAC,CAAC,EAAE,EAAE,EAAE,EAAE,EAAE,CAAC,EAAE,CAAC,CAAC;IACvB,IAAI,OAAO,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;QACvB,MAAM,IAAI,8BAA8B,CACtC,iCAAiC,EACjC,6DAA6D,OAAO,CAAC,IAAI,CAAC,IAAI,CAAC,GAAG,CACnF,CAAC;IACJ,CAAC;IAED,OAAO,MAAM,CAAC,WAAW,CACvB,QAAQ,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,EAAE,EAAE,EAAE,EAAE,EAAE,CAAC;QAC7B,EAAE;QACF,CAAC,aAAa,CAAC,EAAE,CAAC,IAAI,EAAE,CAAC,CAAC,GAAG,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC,CAAC;YACzC,GAAG,MAAM;YACT,OAAO,EAAE,CAAC,GAAG,MAAM,CAAC,OAAO,CAAC;YAC5B,GAAG,CAAC,MAAM,CAAC,UAAU;gBACnB,CAAC,CAAC;oBACE,UAAU,EAAE,MAAM,CAAC,WAAW,CAC5B,MAAM,CAAC,OAAO,CAAC,MAAM,CAAC,UAAU,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,QAAQ,EAAE,OAAO,CAAC,EAAE,EAAE,CAAC;wBAC7D,QAAQ;wBACR,MAAM,CAAC,WAAW,CAChB,MAAM,CAAC,OAAO,CAAC,OAAO,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,GAAG,EAAE,KAAK,CAAC,EAAE,EAAE,CAAC;4BAC5C,GAAG;4BACH,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,GAAG,KAAK,CAAC,CAAC,CAAC,CAAC,KAAK;yBAC1C,CAAC,CACH;qBACF,CAAC,CACH;iBACF;gBACH,CAAC,CAAC,EAAE,CAAC;YACP,SAAS,EAAE,CAAC,GAAG,MAAM,CAAC,SAAS,CAAC;YAChC,MAAM,EAAE,EAAE,GAAG,MAAM,CAAC,MAAM,EAAE;SAC7B,CAAC,CAAC;KACJ,CAAC,CACH,CAAC;AACJ,CAAC;AAED,SAAgB,wCAAwC,CAAC,OAYxD;IACC,MAAM,QAAQ,GAAG,uCAAuC,CAAC;QACvD,GAAG,CAAC,OAAO,CAAC,mBAAmB;YAC7B,CAAC,CAAC,EAAE,mBAAmB,EAAE,OAAO,CAAC,mBAAmB,EAAE;YACtD,CAAC,CAAC,EAAE,CAAC;QACP,GAAG,CAAC,OAAO,CAAC,UAAU,CAAC,CAAC,CAAC,EAAE,UAAU,EAAE,OAAO,CAAC,UAAU,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QACjE,GAAG,CAAC,OAAO,CAAC,cAAc;YACxB,CAAC,CAAC,EAAE,cAAc,EAAE,OAAO,CAAC,cAAc,EAAE;YAC5C,CAAC,CAAC,EAAE,CAAC;QACP,KAAK,EAAE,OAAO,CAAC,KAAK;KACrB,CAAC,CAAC;IACH,MAAM,aAAa,GAAG,gBAAgB,CAAC,QAAQ,EAAE,OAAO,CAAC,aAAa,CAAC,CAAC;IACxE,MAAM,WAAW,GAAG,IAAA,qCAAuB,EAAC;QAC1C,SAAS,EAAE,OAAO,CAAC,SAAS;QAC5B,SAAS,EAAE,OAAO,CAAC,SAAS;QAC5B,KAAK,EAAE,OAAO,CAAC,KAAK;KACrB,CAAC,CAAC;IACH,MAAM,KAAK,GAAG,QAAQ,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,KAAK,EAAE,EAAE;QACzC,MAAM,QAAQ,GAAG,6CAA+B,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC;QAChE,MAAM,KAAK,GAAG;YACZ,WAAW;YACX,EAAE,EAAE,KAAK,CAAC,EAAE;YACZ,SAAS,EAAE,EAAE,GAAG,KAAK,CAAC,SAAS,EAAE;YACjC,gBAAgB,EAAE,CAAC,QAAQ,CAAC,eAAe,CAAC;YAC5C,sBAAsB,EAAE,GAAG,CAAC,MAAM,CAAC,EAAE,CAAC;YACtC,QAAQ,EAAE,6BAA6B,CACrC,OAAO,CAAC,KAAK,EACb,QAAQ,CAAC,KAAK,EACd,KAAK,CAAC,QAAQ,CACf;YACD,OAAO,EAAE,KAAK,CAAC,OAAO;YACtB,UAAU,EAAE,QAAQ,CAAC,UAAU;SAChC,CAAC;QACF,OAAO;YACL,GAAG,KAAK;YACR,sBAAsB,EAAE,IAAA,uDAAiC,EACvD,KAAK,EACL,aAAa,CAAC,KAAK,CAAC,EAAE,CAAC,IAAI,EAAE,CAC9B,CAAC,MAAM;SACT,CAAC;IACJ,CAAC,CAAC,CAAC;IACH,MAAM,QAAQ,GAAG,IAAA,8CAAgC,EAAC;QAChD,SAAS,EAAE;YACT,QAAQ,EAAE,OAAO,CAAC,iBAAiB;YACnC,KAAK,EAAE,OAAO,CAAC,KAAK;SACrB;QACD,KAAK;QACL,aAAa,EAAE,mDAAqC;KACrD,CAAC,CAAC;IACH,OAAO,EAAE,aAAa,EAAE,QAAQ,EAAE,QAAQ,EAAE,CAAC;AAC/C,CAAC"}

package/migrations/standard-pre-v1-to-v1.md

@@ -1,11 +0,0 @@
-# Standard Blueprint pre-v1 succession
-
-The pre-v1 Standard Blueprint is not supported by an in-place managed upgrade.
-
-1. Create a clean v1 workspace and generate a replacement Product Slice.
-2. Port adopter-owned product behavior and contracts intentionally.
-3. Rehearse the replacement in a personal stage, then staging.
-4. If data must move, use the database-replacement runbook and keep the source database until rollback is no longer required.
-5. Cut over through the normal protected deployment workflow and verify the target before retiring the source.
-
-Do not copy the old ownership record or mark the v1 Blueprint active until the replacement slice is the reviewed source of truth.

package/src/foundation/aurora-logical-database.d.ts

@@ -1,76 +0,0 @@
-import type { ExecuteStatementCommand, RDSDataClient } from '@aws-sdk/client-rds-data';
-export interface AuroraLogicalDbInputs {
-    clusterArn: string;
-    masterSecretArn: string;
-    database: string;
-    readwriteRole: string;
-    readonlyRole: string;
-    removalPolicy?: 'retain' | 'destroy';
-    rotationToken?: string;
-}
-export interface AuroraLogicalDbState extends AuroraLogicalDbInputs {
-    readwritePassword: string;
-    readonlyPassword: string;
-    id: string;
-}
-export interface DataApiExecutor {
-    execute(database: string, sql: string): Promise<void>;
-    exists(database: string, existsSql: string): Promise<boolean>;
-}
-type ExecuteStatementCommandConstructor = new (input: ConstructorParameters<typeof ExecuteStatementCommand>[0]) => ExecuteStatementCommand;
-export declare class RdsDataApiExecutor implements DataApiExecutor {
-    private readonly client;
-    private readonly resourceArn;
-    private readonly secretArn;
-    private readonly ExecuteStatementCommand;
-    constructor(client: RDSDataClient, resourceArn: string, secretArn: string, ExecuteStatementCommand: ExecuteStatementCommandConstructor);
-    execute(database: string, sql: string): Promise<void>;
-    exists(database: string, existsSql: string): Promise<boolean>;
-}
-export declare function createDatabaseSql(database: string): string;
-export declare function databaseExistsSql(database: string): string;
-export declare function roleExistsSql(role: string): string;
-export declare function createRoleSql(role: string, password: string): string;
-export declare function alterRolePasswordSql(role: string, password: string): string;
-export declare function grantScopedAccessSql(database: string, readwriteRole: string, readonlyRole: string): string[];
-export type PasswordGenerator = () => string;
-export interface PulumiCreateResult {
-    id: string;
-    outs?: Record<string, unknown>;
-}
-export interface PulumiUpdateResult {
-    outs?: Record<string, unknown>;
-}
-export interface AuroraLogicalDbProviderOptions {
-    executorFactory?: (inputs: AuroraLogicalDbInputs) => DataApiExecutor;
-    passwordGenerator?: PasswordGenerator;
-}
-export declare class AuroraLogicalDbProvider {
-    private readonly executorFactory?;
-    private readonly passwordGenerator;
-    constructor(options?: AuroraLogicalDbProviderOptions);
-    private buildExecutor;
-    private generateSecret;
-    create(inputs: AuroraLogicalDbInputs): Promise<PulumiCreateResult>;
-    private createInternal;
-    update(_id: string, olds: AuroraLogicalDbState, news: AuroraLogicalDbInputs): Promise<PulumiUpdateResult>;
-    private updateInternal;
-    delete(_id: string, props: AuroraLogicalDbState): Promise<void>;
-    private deleteInternal;
-}
-export interface AuroraLogicalDbResource {
-    readwritePassword: unknown;
-    readonlyPassword: unknown;
-    [key: string]: unknown;
-}
-export interface AuroraLogicalDbResourceOptions {
-    additionalSecretOutputs?: string[];
-    [key: string]: unknown;
-}
-export interface CreateAuroraLogicalDbOptions {
-    name: string;
-    args: AuroraLogicalDbInputs | Record<string, unknown>;
-    opts?: AuroraLogicalDbResourceOptions;
-}
-export declare function createAuroraLogicalDbResource(options: CreateAuroraLogicalDbOptions): AuroraLogicalDbResource;
-export {};