@empire-builder-kit/nx 1.0.0-beta.9 → 1.0.0-rc.2

package/src/generators/preset/workspace-files-workload-role-baseline.js

@@ -0,0 +1,1102 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.renderWorkspaceWorkloadRoleBaselineFiles = renderWorkspaceWorkloadRoleBaselineFiles;
+/**
+ * Isolated protected-account-baseline renderer. The workspace preset composes
+ * these files only after the workload-role contract is accepted; keeping this
+ * renderer separate gives its authority-bearing source focused proof.
+ */
+function renderWorkspaceWorkloadRoleBaselineFiles(options) {
+    return {
+        'docs/workload-role-account-baseline.md': `# Workload-role account baseline
+
+The \`${options.name}\` workspace workload-role boundary, state bucket, fixed provisioner, candidate
+registration, and ordinary deployment policy form one protected stage
+publication. They are not ordinary SST resources.
+
+The complete reviewed stage bundle must contain every Product Slice project
+exactly once under one account, partition, stage, and candidate identity.
+Publication rejects a missing or extra project, mixed identity, duplicate role,
+changed manifest digest, unsupported IAM allow, or compact boundary larger than
+the AWS 6,144-character managed-policy limit before it creates a mutation plan.
+The singular stage boundary is a maximum-action cap, not a grant. Exact
+resources and conditions remain in each digest-bound inline role policy.
+
+## Authority
+
+Initial bootstrap and later publication use an external protected
+account-baseline authority. Do not configure a second GitHub OIDC/admin role and
+do not run \`--apply\` in GitHub Actions. The publisher rejects the ordinary
+deployment role and all GitHub Actions apply attempts. The external protected
+CloudFormation update applies the aggregate boundary before any provisioner
+invocation. The generated stack gives the fixed AWS-internal provisioner only:
+
+- role/profile authority for exact registered v1 names;
+- state access under exact registered project/digest keys; and
+- log writes for the exact provisioner functions.
+
+The ordinary deployment policy is not promoted until every project provisioner
+returns a sanitized, exact registration. It contains only exact registration
+reads, qualified provisioner observation/invocation, and exact
+service-conditioned \`iam:PassRole\`. It contains no direct role, trust, inline
+policy, tag, boundary, or delete mutation.
+
+## Candidate bundle and first-stage bootstrap
+
+The generated report target constructs registered documents directly from the
+generated Foundation and Slice candidates plus read-only STS, SSM, and Secrets
+Manager discovery. It never reads an existing workload-role registration and
+has no AWS mutation client. Project selection is not an input: the target
+derives the one Foundation and every generated Product Slice from
+\`packages/*/project.json\`, rejects ambiguous ownership, and validates the
+result as one stage boundary before writing JSON to stdout.
+
+A stage that has never had a workload-role account baseline needs two exact
+phases because Slice intent depends on outputs created by Foundation:
+
+1. Run \`foundation-bootstrap\` report mode. This fixed phase emits Foundation
+   only; it is not a generic project filter.
+2. Review and apply that Foundation-only publication, then deploy Foundation
+   with the same candidate identity. Bootstrap apply proves both the baseline
+   stack and Foundation workload-role pointer are absent before any mutation,
+   then uses create-only stack semantics so a concurrent bootstrap cannot win a
+   check/use race. It cannot shrink or replace an existing stage boundary.
+3. Run \`full-stage\` report mode. It reads the now-provisioned Foundation
+   outputs and exact operator-secret metadata and emits Foundation plus every
+   generated Product Slice.
+4. Review and apply the full-stage publication before deploying any Slice.
+   Every later publication uses \`full-stage\`; bootstrap reuse fails closed.
+
+If initial bootstrap fails after its create-only stack succeeds but before the
+Foundation pointer is promoted, do not bypass the one-time check. The external
+account-baseline owner must inspect the failed stack and retained state, remove
+that incomplete bootstrap explicitly, and restart from the same reviewed
+candidate. A successful or ambiguous bootstrap is never reset for convenience.
+
+\`\`\`bash
+pnpm nx run ${options.name}:workload-role-candidate-report -- \\
+  --phase=foundation-bootstrap \\
+  --candidate=<reviewed-candidate> \\
+  --stage=staging \\
+  --region=us-east-1 \\
+  > /path/outside-the-checkout/staging-foundation-workload-roles.json
+
+# After Foundation publication and deployment:
+pnpm nx run ${options.name}:workload-role-candidate-report -- \\
+  --phase=full-stage \\
+  --candidate=<same-reviewed-candidate> \\
+  --stage=staging \\
+  --region=us-east-1 \\
+  > /path/outside-the-checkout/staging-workload-roles.json
+\`\`\`
+
+Independently record the derived project set and digest map in the review. Run
+publisher report mode from a clean \`develop\` checkout for
+development/staging or a clean \`main\` checkout for production. Supply the
+matching phase, exact reviewed HEAD commit, and exact external publisher
+principal returned by \`aws sts get-caller-identity\`:
+
+\`\`\`bash
+node tools/workload-role-baseline/publish.mjs \\
+  --documents=/path/outside-the-checkout/staging-workload-roles.json \\
+  --phase=full-stage \\
+  --candidate=<reviewed-candidate> \\
+  --stage=staging \\
+  --account=<12-digit-account> \\
+  --partition=aws \\
+  --region=us-east-1 \\
+  --digests=foundation:<sha256>,billing:<sha256>,orders:<sha256> \\
+  --deployment-role-arn=arn:aws:iam::<account>:role/<deployment-role> \\
+  --publisher-principal-arn=arn:aws:sts::<account>:assumed-role/<role>/<session> \\
+  --reviewed-commit=<full-git-object-id> \\
+  --code-bucket=<protected-versioned-artifact-bucket> \\
+  --code-key=workload-role-provisioner/v1/index.zip \\
+  --code-version=<reviewed-s3-version-id>
+\`\`\`
+
+When a reviewed candidate drops or renames an active role, also supply
+\`--prior-histories=<reviewed-json-object-by-project>\` and
+\`--prior=<project>:<prior-candidate>:<prior-manifest-digest>:<prior-history-digest>[,...]\`.
+The history digest covers the complete canonical active set and every retained
+tombstone; it is reviewed independently from the active manifest digest.
+The publisher derives the exact phase-appropriate project set from the same
+generated project inventory and rejects missing, extra, or substituted
+documents and digest entries. When a full-stage candidate drops or renames an
+active role, the report adds only the exact retired role and NAT profile ARNs
+to temporary provisioner authority. It rejects stale, cross-stage,
+cross-project, or unreviewed history and never uses a wildcard. Bootstrap
+rejects all prior-history input.
+
+Review both deterministic templates, the exact resource inventory, boundary
+digest, and boundary character count. The transitional template contains only
+reviewed retirement authority; the settled template contains none. Run
+\`pnpm nx run ${options.name}:workload-role-provisioner-build\`; retain the
+reported SHA-256 for
+\`dist/workload-role-baseline/provisioner.zip\`. The deterministic archive
+bundles \`tools/workload-role-baseline/provisioner.ts\` as \`index.handler\`
+with \`@empire-builder-kit/nx\`, \`@aws-sdk/client-iam\`, and
+\`@aws-sdk/client-s3\`. Upload that exact reviewed archive to the protected,
+versioned code location named by the report.
+
+## Apply and recovery
+
+Apply only from the same reviewed source with externally obtained protected
+account-baseline credentials:
+
+\`\`\`bash
+export EBK_ACCOUNT_BASELINE_AUTHORITY=external-protected
+# Repeat the exact report command and append:
+  --apply
+\`\`\`
+
+Apply verifies the exact reviewed caller principal, exact deployment role,
+actual Git branch, clean tree, and immutable reviewed commit. It updates the
+aggregate boundary first, stores every
+reviewed document with explicit AES-256 encryption, invokes each
+candidate-qualified alias, validates all sanitized results, reapplies the
+settled baseline to remove transition authority, replaces the one exact
+deployment inline policy, and finally switches each protected SSM pointer. A
+failure before the final three steps leaves ordinary deployment unpromoted.
+Investigate and rerun the same immutable candidate; never widen the policy,
+skip a Slice, substitute a digest, or invoke an unqualified function.
+`,
+        'tools/workload-role-baseline/project-set.mjs': `import {
+  lstatSync,
+  readFileSync,
+  readdirSync,
+} from 'node:fs';
+import { join } from 'node:path';
+
+const projectPattern = /^[a-z0-9][a-z0-9-]{0,62}$/;
+const phases = new Set(['foundation-bootstrap', 'full-stage']);
+
+function readProject(path) {
+  let value;
+  try {
+    value = JSON.parse(readFileSync(path, 'utf8'));
+  } catch (error) {
+    if (error?.code === 'ENOENT') return undefined;
+    throw new Error('Generated workload-role project metadata is unreadable.');
+  }
+  if (
+    typeof value !== 'object' ||
+    value === null ||
+    Array.isArray(value) ||
+    typeof value.name !== 'string' ||
+    !Array.isArray(value.tags) ||
+    value.tags.some((tag) => typeof tag !== 'string')
+  ) {
+    throw new Error('Generated workload-role project metadata is malformed.');
+  }
+  return value;
+}
+
+export function discoverWorkloadRoleCandidateProjects(workspaceRoot) {
+  const packagesRoot = join(workspaceRoot, 'packages');
+  const projects = [];
+  for (const entry of readdirSync(packagesRoot, { withFileTypes: true })) {
+    if (!entry.isDirectory()) continue;
+    const metadata = readProject(
+      join(packagesRoot, entry.name, 'project.json'),
+    );
+    if (!metadata) continue;
+    const isFoundation =
+      entry.name === 'foundation' &&
+      metadata.name === 'foundation' &&
+      metadata.tags.includes('scope:foundation');
+    const isSlice = metadata.tags.includes('type:slice');
+    if (!isFoundation && !isSlice) continue;
+    if (
+      !projectPattern.test(metadata.name) ||
+      metadata.name !== entry.name ||
+      isFoundation === isSlice
+    ) {
+      throw new Error(
+        'Generated workload-role project identity is ambiguous.',
+      );
+    }
+    const reportPath = join(
+      packagesRoot,
+      entry.name,
+      'infra',
+      'workload-roles',
+      'report.ts',
+    );
+    try {
+      if (!lstatSync(reportPath).isFile()) {
+        throw new Error();
+      }
+    } catch {
+      throw new Error(
+        'Generated workload-role candidate reporter is absent.',
+      );
+    }
+    projects.push({
+      kind: isFoundation ? 'foundation' : 'slice',
+      project: metadata.name,
+      reportPath,
+    });
+  }
+  projects.sort((left, right) =>
+    left.project < right.project
+      ? -1
+      : left.project > right.project
+        ? 1
+        : 0,
+  );
+  if (
+    projects.filter(({ kind }) => kind === 'foundation').length !== 1 ||
+    new Set(projects.map(({ project }) => project)).size !== projects.length
+  ) {
+    throw new Error(
+      'Workspace must contain one Foundation and unique Product Slices.',
+    );
+  }
+  return Object.freeze(projects);
+}
+
+export function selectWorkloadRoleCandidateProjects(projects, phase) {
+  if (!phases.has(phase)) {
+    throw new Error('Workload-role candidate report phase is invalid.');
+  }
+  if (phase === 'foundation-bootstrap') {
+    return Object.freeze(
+      projects.filter(({ kind }) => kind === 'foundation'),
+    );
+  }
+  return Object.freeze([...projects]);
+}
+`,
+        'tools/workload-role-baseline/report-candidate-bundle.mjs': `import {
+  mkdtempSync,
+  rmSync,
+} from 'node:fs';
+import { createRequire } from 'node:module';
+import { tmpdir } from 'node:os';
+import { join } from 'node:path';
+import { build } from 'esbuild';
+import {
+  createStageWorkloadRoleBoundaryContract,
+  requireRegisteredWorkloadRoleManifestDocument,
+} from '@empire-builder-kit/nx/workload-roles';
+import {
+  discoverWorkloadRoleCandidateProjects,
+  selectWorkloadRoleCandidateProjects,
+} from './project-set.mjs';
+
+const supported = new Set(['candidate', 'phase', 'region', 'stage']);
+
+function parseArgs(values) {
+  const result = {};
+  for (const value of values) {
+    const separator = value.indexOf('=');
+    const name = value.slice(2, separator);
+    if (
+      !value.startsWith('--') ||
+      separator < 3 ||
+      !supported.has(name) ||
+      result[name] !== undefined
+    ) {
+      throw new Error(
+        'Candidate report arguments must be unique --name=value entries.',
+      );
+    }
+    const parsed = value.slice(separator + 1);
+    if (!parsed) {
+      throw new Error('Candidate report argument is empty: ' + name);
+    }
+    result[name] = parsed;
+  }
+  return result;
+}
+
+function required(args, name, pattern) {
+  const value = args[name];
+  if (typeof value !== 'string' || !pattern.test(value)) {
+    throw new Error(
+      'Required candidate report argument is invalid: ' + name,
+    );
+  }
+  return value;
+}
+
+const args = parseArgs(process.argv.slice(2));
+const candidateIdentity = required(
+  args,
+  'candidate',
+  /^[a-z0-9][a-z0-9._-]{0,127}$/,
+);
+const phase = required(
+  args,
+  'phase',
+  /^(foundation-bootstrap|full-stage)$/,
+);
+const region = required(
+  args,
+  'region',
+  /^[a-z]{2}(?:-gov)?-[a-z]+-\\d$/,
+);
+const stage = required(
+  args,
+  'stage',
+  /^(development|staging|production)$/,
+);
+const projects = selectWorkloadRoleCandidateProjects(
+  discoverWorkloadRoleCandidateProjects(process.cwd()),
+  phase,
+);
+const scratch = mkdtempSync(
+  join(tmpdir(), 'ebk-workload-role-report-'),
+);
+const require = createRequire(import.meta.url);
+
+try {
+  const documents = [];
+  for (const project of projects) {
+    const outputPath = join(scratch, project.project + '.cjs');
+    await build({
+      bundle: true,
+      entryPoints: [project.reportPath],
+      format: 'cjs',
+      legalComments: 'none',
+      logLevel: 'silent',
+      outfile: outputPath,
+      platform: 'node',
+      sourcemap: false,
+      target: 'node22',
+    });
+    const reporter = require(outputPath).reportWorkloadRoleCandidate;
+    if (typeof reporter !== 'function') {
+      throw new Error(
+        'Generated workload-role candidate reporter was substituted.',
+      );
+    }
+    const document = requireRegisteredWorkloadRoleManifestDocument(
+      await reporter({ candidateIdentity, region, stage }),
+    );
+    if (document.project !== project.project) {
+      throw new Error(
+        'Generated workload-role candidate report named another project.',
+      );
+    }
+    documents.push(document);
+  }
+  const first = documents[0];
+  if (!first) {
+    throw new Error('Generated workload-role candidate set is empty.');
+  }
+  const boundary = createStageWorkloadRoleBoundaryContract({
+    documents,
+    expectedAccountId: first.accountId,
+    expectedCandidateIdentity: candidateIdentity,
+    expectedManifestDigests: Object.fromEntries(
+      documents.map(({ manifestDigest, project }) => [
+        project,
+        manifestDigest,
+      ]),
+    ),
+    expectedPartition: first.partition,
+    expectedProjects: projects.map(({ project }) => project),
+    expectedStage: stage,
+  });
+  process.stdout.write(
+    JSON.stringify(boundary.documents, null, 2) + '\\n',
+  );
+} finally {
+  rmSync(scratch, { force: true, recursive: true });
+}
+`,
+        'tools/workload-role-baseline/provisioner.ts': `import * as iamSdk from '@aws-sdk/client-iam';
+import * as s3Sdk from '@aws-sdk/client-s3';
+import {
+  createAwsInternalWorkloadRoleProvisionerHandler,
+  createAwsSdkV3IamControlPlane,
+  createAwsSdkV3S3JsonControlPlane,
+} from '@empire-builder-kit/nx/workload-roles';
+
+const required = (
+  name:
+    | 'EBK_WORKLOAD_ROLE_BUCKET'
+    | 'EBK_WORKLOAD_ROLE_MANIFEST_DIGEST'
+    | 'EBK_WORKLOAD_ROLE_PROJECT'
+    | 'EBK_WORKLOAD_ROLE_PROVISIONER_ALIAS_ARN'
+    | 'EBK_WORKLOAD_ROLE_STAGE',
+  pattern: RegExp,
+) => {
+  const value = process.env[name]?.trim();
+  if (!value || !pattern.test(value)) {
+    throw new Error('Fixed workload-role provisioner configuration is invalid.');
+  }
+  return value;
+};
+
+const bucketName = required(
+  'EBK_WORKLOAD_ROLE_BUCKET',
+  /^(?!\\d{1,3}(?:\\.\\d{1,3}){3}$)[a-z0-9][a-z0-9.-]{1,61}[a-z0-9]$/,
+);
+const manifestDigest = required(
+  'EBK_WORKLOAD_ROLE_MANIFEST_DIGEST',
+  /^[a-f0-9]{64}$/,
+);
+const project = required(
+  'EBK_WORKLOAD_ROLE_PROJECT',
+  /^[a-z0-9][a-z0-9-]{0,62}$/,
+);
+const provisionerFunctionArn = required(
+  'EBK_WORKLOAD_ROLE_PROVISIONER_ALIAS_ARN',
+  /^arn:(aws|aws-cn|aws-us-gov):lambda:[a-z0-9-]+:\\d{12}:function:[A-Za-z0-9-_]+:candidate-[a-f0-9]{64}$/,
+);
+const stage = required(
+  'EBK_WORKLOAD_ROLE_STAGE',
+  /^[a-z0-9][a-z0-9-]{0,62}$/,
+);
+
+let fixedHandler: Promise<
+  (request: unknown) => Promise<unknown>
+> | undefined;
+
+async function configuredHandler() {
+  fixedHandler ??= Promise.all([
+    createAwsSdkV3IamControlPlane({
+      loadModule: async () => iamSdk,
+    }),
+    createAwsSdkV3S3JsonControlPlane({
+      loadModule: async () => s3Sdk,
+    }),
+  ]).then(([iam, s3]) =>
+    createAwsInternalWorkloadRoleProvisionerHandler({
+      bucketName,
+      iam,
+      manifestDigest,
+      project,
+      provisionerFunctionArn,
+      s3,
+      stage,
+    }),
+  );
+  return fixedHandler;
+}
+
+export async function handler(request: unknown) {
+  return (await configuredHandler())(request);
+}
+`,
+        'tools/workload-role-baseline/build.mjs': `import { createHash } from 'node:crypto';
+import { mkdirSync, writeFileSync } from 'node:fs';
+import { build } from 'esbuild';
+
+const outputDirectory = 'dist/workload-role-baseline';
+const archivePath = outputDirectory + '/provisioner.zip';
+const entryName = Buffer.from('index.js', 'utf8');
+
+const crcTable = Array.from({ length: 256 }, (_, index) => {
+  let value = index;
+  for (let bit = 0; bit < 8; bit += 1) {
+    value = (value & 1) === 1
+      ? 0xedb88320 ^ (value >>> 1)
+      : value >>> 1;
+  }
+  return value >>> 0;
+});
+
+function crc32(value) {
+  let crc = 0xffffffff;
+  for (const byte of value) {
+    crc = crcTable[(crc ^ byte) & 0xff] ^ (crc >>> 8);
+  }
+  return (crc ^ 0xffffffff) >>> 0;
+}
+
+function deterministicZip(name, contents) {
+  const checksum = crc32(contents);
+  const local = Buffer.alloc(30);
+  local.writeUInt32LE(0x04034b50, 0);
+  local.writeUInt16LE(20, 4);
+  local.writeUInt16LE(0, 6);
+  local.writeUInt16LE(0, 8);
+  local.writeUInt16LE(0, 10);
+  local.writeUInt16LE(0x21, 12);
+  local.writeUInt32LE(checksum, 14);
+  local.writeUInt32LE(contents.length, 18);
+  local.writeUInt32LE(contents.length, 22);
+  local.writeUInt16LE(name.length, 26);
+  local.writeUInt16LE(0, 28);
+
+  const central = Buffer.alloc(46);
+  central.writeUInt32LE(0x02014b50, 0);
+  central.writeUInt16LE(20, 4);
+  central.writeUInt16LE(20, 6);
+  central.writeUInt16LE(0, 8);
+  central.writeUInt16LE(0, 10);
+  central.writeUInt16LE(0, 12);
+  central.writeUInt16LE(0x21, 14);
+  central.writeUInt32LE(checksum, 16);
+  central.writeUInt32LE(contents.length, 20);
+  central.writeUInt32LE(contents.length, 24);
+  central.writeUInt16LE(name.length, 28);
+  central.writeUInt16LE(0, 30);
+  central.writeUInt16LE(0, 32);
+  central.writeUInt16LE(0, 34);
+  central.writeUInt16LE(0, 36);
+  central.writeUInt32LE(0, 38);
+  central.writeUInt32LE(0, 42);
+
+  const centralOffset = local.length + name.length + contents.length;
+  const end = Buffer.alloc(22);
+  end.writeUInt32LE(0x06054b50, 0);
+  end.writeUInt16LE(0, 4);
+  end.writeUInt16LE(0, 6);
+  end.writeUInt16LE(1, 8);
+  end.writeUInt16LE(1, 10);
+  end.writeUInt32LE(central.length + name.length, 12);
+  end.writeUInt32LE(centralOffset, 16);
+  end.writeUInt16LE(0, 20);
+  return Buffer.concat([
+    local,
+    name,
+    contents,
+    central,
+    name,
+    end,
+  ]);
+}
+
+const result = await build({
+  bundle: true,
+  entryPoints: ['tools/workload-role-baseline/provisioner.ts'],
+  format: 'cjs',
+  legalComments: 'none',
+  minify: false,
+  platform: 'node',
+  sourcemap: false,
+  target: 'node22',
+  write: false,
+});
+if (result.outputFiles.length !== 1) {
+  throw new Error('Provisioner build did not produce one exact bundled entry.');
+}
+const bundled = Buffer.from(result.outputFiles[0].contents);
+const archive = deterministicZip(entryName, bundled);
+const digest = createHash('sha256').update(archive).digest('hex');
+mkdirSync(outputDirectory, { recursive: true });
+writeFileSync(archivePath, archive, { mode: 0o600 });
+writeFileSync(
+  outputDirectory + '/provisioner.sha256',
+  digest + '  provisioner.zip\\n',
+  { encoding: 'utf8', mode: 0o600 },
+);
+process.stdout.write(
+  JSON.stringify({
+    archive: archivePath,
+    sha256: digest,
+  }) + '\\n',
+);
+`,
+        'tools/workload-role-baseline/publish.mjs': `import {
+  mkdtempSync,
+  readFileSync,
+  rmSync,
+  writeFileSync,
+} from 'node:fs';
+import { tmpdir } from 'node:os';
+import { join } from 'node:path';
+import { spawnSync } from 'node:child_process';
+import {
+  createWorkloadRoleStageAccountBaselinePlan,
+  publishReviewedStageWorkloadRoleCandidate,
+} from '@empire-builder-kit/nx/workload-roles';
+import {
+  discoverWorkloadRoleCandidateProjects,
+  selectWorkloadRoleCandidateProjects,
+} from './project-set.mjs';
+
+const supported = new Set([
+  'account',
+  'apply',
+  'candidate',
+  'code-bucket',
+  'code-key',
+  'code-version',
+  'deployment-role-arn',
+  'digests',
+  'documents',
+  'partition',
+  'phase',
+  'prior',
+  'prior-histories',
+  'publisher-principal-arn',
+  'region',
+  'reviewed-commit',
+  'stage',
+]);
+
+function parseArgs(values) {
+  const result = {};
+  for (const value of values) {
+    if (!value.startsWith('--')) {
+      throw new Error('Publisher arguments must use --name=value.');
+    }
+    if (value === '--apply') {
+      if (result.apply !== undefined) throw new Error('Duplicate --apply.');
+      result.apply = true;
+      continue;
+    }
+    const separator = value.indexOf('=');
+    if (separator < 3) throw new Error('Publisher arguments must use --name=value.');
+    const name = value.slice(2, separator);
+    if (!supported.has(name) || result[name] !== undefined) {
+      throw new Error('Publisher argument is unsupported or duplicated: ' + name);
+    }
+    const parsed = value.slice(separator + 1);
+    if (!parsed) throw new Error('Publisher argument is empty: ' + name);
+    result[name] = parsed;
+  }
+  return result;
+}
+
+function required(args, name, pattern) {
+  const value = args[name];
+  if (typeof value !== 'string' || !pattern.test(value)) {
+    throw new Error('Required publisher argument is invalid: ' + name);
+  }
+  return value;
+}
+
+function exactDigests(value, projects) {
+  const result = {};
+  for (const entry of value.split(',')) {
+    const separator = entry.indexOf(':');
+    const project = entry.slice(0, separator);
+    const digest = entry.slice(separator + 1);
+    if (
+      separator < 1 ||
+      result[project] !== undefined ||
+      !/^[a-f0-9]{64}$/.test(digest)
+    ) {
+      throw new Error('Reviewed digest map is invalid.');
+    }
+    result[project] = digest;
+  }
+  if (JSON.stringify(Object.keys(result).sort()) !== JSON.stringify(projects)) {
+    throw new Error('Reviewed digest map must name the exact project set.');
+  }
+  return result;
+}
+
+function readDocuments(path) {
+  const value = JSON.parse(readFileSync(path, 'utf8'));
+  if (!Array.isArray(value) || value.length === 0) {
+    throw new Error('Reviewed document bundle must be a non-empty JSON array.');
+  }
+  return value;
+}
+
+function git(args) {
+  const response = spawnSync('git', args, {
+    encoding: 'utf8',
+    maxBuffer: 4 * 1024 * 1024,
+    shell: false,
+  });
+  if (response.status !== 0) {
+    throw new Error('Unable to verify reviewed Git source.');
+  }
+  return response.stdout.trim();
+}
+
+function verifiedGitSource(stage, reviewedCommit) {
+  const expected = stage === 'production'
+    ? 'refs/heads/main'
+    : 'refs/heads/develop';
+  const actualRef = git(['symbolic-ref', '--quiet', 'HEAD']);
+  const actualCommit = git(['rev-parse', 'HEAD']);
+  const status = git(['status', '--porcelain=v1', '--untracked-files=all']);
+  if (
+    actualRef !== expected ||
+    actualCommit !== reviewedCommit ||
+    status !== ''
+  ) {
+    throw new Error(
+      'Publisher requires the exact clean reviewed commit on ' + expected + '.',
+    );
+  }
+}
+
+function priorExpectations(value, projects) {
+  if (value === undefined) return undefined;
+  const result = {};
+  for (const entry of value.split(',')) {
+    const [
+      project,
+      candidateIdentity,
+      manifestDigest,
+      historyDigest,
+      extra,
+    ] = entry.split(':');
+    if (
+      extra !== undefined ||
+      !projects.includes(project) ||
+      result[project] !== undefined ||
+      !/^[a-z0-9][a-z0-9._-]{0,127}$/.test(candidateIdentity ?? '') ||
+      !/^[a-f0-9]{64}$/.test(manifestDigest ?? '') ||
+      !/^[a-f0-9]{64}$/.test(historyDigest ?? '')
+    ) {
+      throw new Error('Reviewed prior-history expectation is invalid.');
+    }
+    result[project] = { candidateIdentity, historyDigest, manifestDigest };
+  }
+  return result;
+}
+
+function readPriorHistories(path) {
+  if (path === undefined) return undefined;
+  const value = JSON.parse(readFileSync(path, 'utf8'));
+  if (typeof value !== 'object' || value === null || Array.isArray(value)) {
+    throw new Error('Reviewed prior histories must be a JSON object by project.');
+  }
+  return value;
+}
+
+const args = parseArgs(process.argv.slice(2));
+const expectedStage = required(
+  args,
+  'stage',
+  /^(development|staging|production)$/,
+);
+const publicationPhase = required(
+  args,
+  'phase',
+  /^(foundation-bootstrap|full-stage)$/,
+);
+verifiedGitSource(
+  expectedStage,
+  required(args, 'reviewed-commit', /^[a-f0-9]{40}(?:[a-f0-9]{24})?$/),
+);
+const expectedProjects = selectWorkloadRoleCandidateProjects(
+  discoverWorkloadRoleCandidateProjects(process.cwd()),
+  publicationPhase,
+).map(({ project }) => project);
+const expectedManifestDigests = exactDigests(
+  required(args, 'digests', /^.+$/),
+  expectedProjects,
+);
+const expectedPriorHistories = priorExpectations(args.prior, expectedProjects);
+const reviewedPriorHistories = readPriorHistories(args['prior-histories']);
+if (
+  (expectedPriorHistories === undefined) !==
+  (reviewedPriorHistories === undefined)
+) {
+  throw new Error('--prior and --prior-histories must be supplied together.');
+}
+if (
+  publicationPhase === 'foundation-bootstrap' &&
+  expectedPriorHistories !== undefined
+) {
+  throw new Error(
+    'Foundation bootstrap cannot carry prior workload-role history.',
+  );
+}
+const plan = createWorkloadRoleStageAccountBaselinePlan({
+  code: {
+    bucketName: required(
+      args,
+      'code-bucket',
+      /^(?!\\d{1,3}(?:\\.\\d{1,3}){3}$)[a-z0-9][a-z0-9.-]{1,61}[a-z0-9]$/,
+    ),
+    objectKey: required(args, 'code-key', /^(?!\\/).+$/),
+    objectVersion: required(args, 'code-version', /^.+$/),
+  },
+  expectedAccountId: required(args, 'account', /^\\d{12}$/),
+  expectedCandidateIdentity: required(
+    args,
+    'candidate',
+    /^[a-z0-9][a-z0-9._-]{0,127}$/,
+  ),
+  expectedManifestDigests,
+  expectedPartition: required(
+    args,
+    'partition',
+    /^(aws|aws-cn|aws-us-gov)$/,
+  ),
+  ...(expectedPriorHistories ? { expectedPriorHistories } : {}),
+  expectedProjects,
+  expectedStage,
+  region: required(args, 'region', /^[a-z]{2}(?:-gov)?-[a-z]+-\\d$/),
+  registeredDocuments: readDocuments(
+    required(args, 'documents', /^.+$/),
+  ),
+  reviewedDeploymentRoleArn: required(
+    args,
+    'deployment-role-arn',
+    /^arn:(aws|aws-cn|aws-us-gov):iam::\\d{12}:role\\/.+$/,
+  ),
+  ...(reviewedPriorHistories ? { reviewedPriorHistories } : {}),
+  reviewedPublisherPrincipalArn: required(
+    args,
+    'publisher-principal-arn',
+    /^arn:(aws|aws-cn|aws-us-gov):(iam|sts)::\\d{12}:(?:role|user|assumed-role)\\/.+$/,
+  ),
+});
+
+const report = {
+  boundary: {
+    arn: plan.boundary.arn,
+    digest: plan.boundary.digest,
+    policyCharacters: plan.boundary.policyCharacters,
+  },
+  candidateIdentity: plan.candidateIdentity,
+  deploymentRoleArn: plan.deploymentRoleArn,
+  projects: plan.projectPlans.map((project) => ({
+    manifestDigest: project.manifestDigest,
+    project: project.project,
+    provisionerAliasArn: project.provisionerAliasArn,
+    registeredManifestObjectKey: project.registeredManifestObjectKey,
+    storageParameterName: project.storageParameterName,
+  })),
+  schemaVersion: plan.schemaVersion,
+  stackName: plan.stackName,
+  stage: plan.stage,
+  stateBucketName: plan.stateBucketName,
+  publicationPhase,
+  settledTemplate: plan.settledCloudFormationTemplate,
+  transitionalTemplate: plan.transitionalCloudFormationTemplate,
+  transitionalInstanceProfileArns: plan.transitionalInstanceProfileArns,
+  transitionalRoleArns: plan.transitionalRoleArns,
+};
+
+if (args.apply !== true) {
+  process.stdout.write(JSON.stringify(report, null, 2) + '\\n');
+  process.exit(0);
+}
+if (
+  process.env.EBK_ACCOUNT_BASELINE_AUTHORITY !== 'external-protected' ||
+  process.env.GITHUB_ACTIONS === 'true'
+) {
+  throw new Error(
+    'Apply requires external protected account-baseline authority outside GitHub Actions.',
+  );
+}
+
+const scratch = mkdtempSync(join(tmpdir(), 'ebk-workload-role-baseline-'));
+function aws(command, commandArgs) {
+  const response = spawnSync(
+    'aws',
+    [command, ...commandArgs, '--region', plan.region],
+    {
+      encoding: 'utf8',
+      maxBuffer: 16 * 1024 * 1024,
+      shell: false,
+    },
+  );
+  if (response.status !== 0) {
+    throw new Error(
+      'Protected AWS operation failed: ' +
+        command +
+        ' (' +
+        String(response.status) +
+        ').',
+    );
+  }
+  return response.stdout;
+}
+
+function requireAwsResourceAbsent(command, commandArgs, absentPattern, label) {
+  const response = spawnSync(
+    'aws',
+    [command, ...commandArgs, '--region', plan.region],
+    {
+      encoding: 'utf8',
+      maxBuffer: 4 * 1024 * 1024,
+      shell: false,
+    },
+  );
+  if (
+    response.status === 0 ||
+    response.status === null ||
+    !absentPattern.test(response.stderr ?? '')
+  ) {
+    throw new Error(
+      'Foundation bootstrap requires proven absence of ' + label + '.',
+    );
+  }
+}
+
+try {
+  const caller = JSON.parse(
+    aws('sts', ['get-caller-identity', '--output', 'json']),
+  );
+  if (
+    caller.Account !== plan.boundary.accountId ||
+    caller.Arn !== plan.publisherPrincipalArn
+  ) {
+    throw new Error(
+      'Current AWS identity is not external protected account-baseline authority.',
+    );
+  }
+  const deploymentRole = JSON.parse(
+    aws('iam', [
+      'get-role',
+      '--role-name',
+      plan.deploymentRoleName,
+      '--output',
+      'json',
+    ]),
+  );
+  if (deploymentRole.Role?.Arn !== plan.deploymentRoleArn) {
+    throw new Error('Reviewed deployment role identity was substituted.');
+  }
+  if (publicationPhase === 'foundation-bootstrap') {
+    const foundation = plan.projectPlans[0];
+    if (
+      plan.projectPlans.length !== 1 ||
+      foundation?.project !== 'foundation'
+    ) {
+      throw new Error(
+        'Foundation bootstrap project set was substituted.',
+      );
+    }
+    requireAwsResourceAbsent(
+      'cloudformation',
+      ['describe-stacks', '--stack-name', plan.stackName],
+      /does not exist/i,
+      'the workload-role account-baseline stack',
+    );
+    requireAwsResourceAbsent(
+      'ssm',
+      ['get-parameter', '--name', foundation.storageParameterName],
+      /ParameterNotFound/,
+      'the Foundation workload-role pointer',
+    );
+  }
+
+  let baselineApplications = 0;
+  const controlPlane = {
+    async applyAccountBaseline(template, stackName) {
+      const templatePath = join(scratch, 'account-baseline.json');
+      writeFileSync(templatePath, JSON.stringify(template), {
+        encoding: 'utf8',
+        mode: 0o600,
+      });
+      if (
+        publicationPhase === 'foundation-bootstrap' &&
+        baselineApplications === 0
+      ) {
+        aws('cloudformation', [
+          'create-stack',
+          '--template-body',
+          'file://' + templatePath,
+          '--stack-name',
+          stackName,
+          '--capabilities',
+          'CAPABILITY_NAMED_IAM',
+        ]);
+        aws('cloudformation', [
+          'wait',
+          'stack-create-complete',
+          '--stack-name',
+          stackName,
+        ]);
+      } else {
+        aws('cloudformation', [
+          'deploy',
+          '--template-file',
+          templatePath,
+          '--stack-name',
+          stackName,
+          '--capabilities',
+          'CAPABILITY_NAMED_IAM',
+          '--no-fail-on-empty-changeset',
+        ]);
+      }
+      baselineApplications += 1;
+    },
+    async putRegisteredDocument(input) {
+      const path = join(scratch, input.value.project + '-registered.json');
+      writeFileSync(path, JSON.stringify(input.value), {
+        encoding: 'utf8',
+        mode: 0o600,
+      });
+      aws('s3api', [
+        'put-object',
+        '--bucket',
+        input.bucketName,
+        '--key',
+        input.key,
+        '--body',
+        path,
+        '--server-side-encryption',
+        'AES256',
+        '--checksum-algorithm',
+        'SHA256',
+      ]);
+    },
+    async invokeQualifiedProvisioner(functionArn, request) {
+      const project = plan.projectPlans.find(
+        (entry) => entry.provisionerAliasArn === functionArn,
+      );
+      if (!project) throw new Error('Qualified provisioner was substituted.');
+      const outputPath = join(scratch, project.project + '-result.json');
+      const metadata = JSON.parse(
+        aws('lambda', [
+          'invoke',
+          '--function-name',
+          functionArn,
+          '--invocation-type',
+          'RequestResponse',
+          '--cli-binary-format',
+          'raw-in-base64-out',
+          '--payload',
+          JSON.stringify(request),
+          outputPath,
+          '--output',
+          'json',
+        ]),
+      );
+      if (metadata.FunctionError !== undefined) {
+        throw new Error('Fixed provisioner returned a Lambda function error.');
+      }
+      return JSON.parse(readFileSync(outputPath, 'utf8'));
+    },
+    async putDeploymentRolePolicy(input) {
+      const path = join(scratch, 'deployment-policy.json');
+      writeFileSync(path, JSON.stringify(input.policy), {
+        encoding: 'utf8',
+        mode: 0o600,
+      });
+      aws('iam', [
+        'put-role-policy',
+        '--role-name',
+        input.roleName,
+        '--policy-name',
+        input.policyName,
+        '--policy-document',
+        'file://' + path,
+      ]);
+    },
+    async putStoragePointer(input) {
+      aws('ssm', [
+        'put-parameter',
+        '--name',
+        input.name,
+        '--type',
+        'String',
+        '--value',
+        input.value,
+        '--overwrite',
+      ]);
+    },
+  };
+
+  const result = await publishReviewedStageWorkloadRoleCandidate({
+    controlPlane,
+    plan,
+  });
+  process.stdout.write(
+    JSON.stringify({ ok: true, result, schemaVersion: 1 }) + '\\n',
+  );
+} finally {
+  rmSync(scratch, { force: true, recursive: true });
+}
+`,
+    };
+}
+//# sourceMappingURL=workspace-files-workload-role-baseline.js.map