@empire-builder-kit/nx 1.0.0-beta.9 → 1.0.0-rc.2

package/src/generators/slice/built-in-plan-authorization-files.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"built-in-plan-authorization-files.js","sourceRoot":"","sources":["../../../../../../packages/nx/src/generators/slice/built-in-plan-authorization-files.ts"],"names":[],"mappings":";;AAGA,0EAswEC;AAzwED,uEAAiE;AAEjE,gBAAgB;AAChB,SAAgB,+BAA+B,CAC7C,IAAY,EACZ,UAAkB;IAElB,MAAM,gBAAgB,GAAG,IAAA,8CAAoB,EAAC,UAAU,CAAC,CAAC;IAC1D,OAAO;QACL,yBAAyB,EAAE;;;;;;;;eAQhB,gBAAgB;qBACV,IAAI;wBACD,IAAI;mBACT,IAAI;mBACJ,IAAI;uBACA,IAAI;uBACJ,IAAI;oBACP,IAAI;4BACI,IAAI;6BACH,IAAI;0BACP,IAAI;mBACX,IAAI;mBACJ,IAAI;0BACG,IAAI;uBACP,IAAI;iBACV,IAAI;kBACH,IAAI;qBACD,IAAI;2BACE,IAAI;sBACT,IAAI;sBACJ,IAAI;;;cAGZ,UAAU;YACZ,gBAAgB,sCAAsC,gBAAgB;;;;;;;kBAOhE,gBAAgB;;;;4BAIN,IAAI;;;;;;;kBAOd,gBAAgB;YACtB,UAAU;;;mBAGH,gBAAgB;;WAExB,gBAAgB;;WAEhB,gBAAgB;;;;;;;mBAOR,UAAU;;;;;;cAMf,UAAU;;aAEX,UAAU;;;cAGT,UAAU;IACpB,UAAU;IACV,UAAU;;;;gCAIkB,UAAU;IACtC,gBAAgB;IAChB,gBAAgB;IAChB,gBAAgB;IAChB,gBAAgB;IAChB,gBAAgB;IAChB,gBAAgB;IAChB,gBAAgB;IAChB,gBAAgB;IAChB,gBAAgB;;;kBAGF,gBAAgB;YACtB,UAAU;;;WAGX,gBAAgB;gBACX,IAAI;WACT,gBAAgB;gBACX,IAAI;WACT,gBAAgB;WAChB,gBAAgB;WAChB,gBAAgB;gBACX,IAAI;;;;;;wBAMI,UAAU;;;;;;;;kCAQA,gBAAgB;;;;;;;;;;;;;eAanC,gBAAgB;8BACD,UAAU;;;;;;UAM9B,gBAAgB;;;;;;;;;;;;;;;;;YAiBd,gBAAgB;;;;;;;;;;;;;;qBAcP,gBAAgB;;;uCAGE,IAAI;;;;;qBAKtB,gBAAgB;;;;;;;;;;YAUzB,gBAAgB;qBACP,gBAAgB;;;;;;;;;;;;;;;;;;qBAkBhB,gBAAgB;qBAChB,gBAAgB;;;;;;;;;;;;gCAYL,gBAAgB;;;;;;;;;;;;;;;;;;;;qBAoB3B,gBAAgB;;;;;;;;;;;;;;;;;;;CAmBpC;QACG,0BAA0B,EAAE;;;;;;;;;;;;;;;;;;;;;;;;IAwB5B,gBAAgB;IAChB,gBAAgB;IAChB,gBAAgB;UACV,UAAU;SACX,UAAU;SACV,UAAU;SACV,UAAU;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;2BAiDQ,IAAI;;gCAEC,gBAAgB;;;;;;;;;KAS3C,UAAU;;;;;;;;qBAQM,gBAAgB;kBACnB,UAAU;;;;;qBAKP,UAAU;;;;;;;;aAQlB,UAAU;;;;;;;;;;;;;;;;;;;;;;;;;;;;;cA6BT,gBAAgB;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;cAoChB,gBAAgB;;;;;;;;;;;;;;cAchB,gBAAgB;;;;;;;;QAQtB,gBAAgB;;;;;;;;;;;;;;;;;;;wCAmBgB,IAAI;;;;;;;;;;qBAUvB,IAAI;;;;cAIX,UAAU;0CACkB,UAAU;;;;;;mBAMjC,UAAU;;;;;;;;;;;;;;;;;cAiBf,IAAI;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;iCAwCe,UAAU;;eAE5B,gBAAgB;eAChB,gBAAgB;eAChB,gBAAgB;eAChB,gBAAgB;eAChB,gBAAgB;;;;;;;;;;;;;;;;;8BAiBD,UAAU;;;;;;;;;;;;;;cAc1B,gBAAgB;;;;;;;YAOlB,gBAAgB;;;gBAGZ,gBAAgB;;;;;;;;;yBASP,UAAU;;;;;;;;;;;;;MAa7B,gBAAgB;;;;;;;;;;sBAUA,IAAI;;;;;;;;;;;8BAWI,UAAU;;;;;;;;;;;;;;;;uBAgBjB,UAAU;;;cAGnB,gBAAgB;;;;;;;;;;;;;;;;;;;;;;;;;iCAyBG,UAAU;;;;;0BAKjB,UAAU;;;;;;;iCAOH,UAAU;;;;;0BAKjB,UAAU;;CAEnC;QACG,wBAAwB,EAAE;;;;;;gBAMd,UAAU;;;;;;wBAMF,UAAU;;qBAEb,UAAU;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;sDAgCuB,UAAU;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;mBAwC7C,UAAU;;+BAEE,UAAU;;;;+BAIV,UAAU;;;;+BAIV,UAAU;;;;;;;;wBAQjB,UAAU;;KAE7B,UAAU;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;wDAgCyC,UAAU;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;CAuCjE;QACG,4BAA4B,EAAE;;;;;;;;;;;;;;;;;;;IAmB9B,gBAAgB;IAChB,gBAAgB;IAChB,gBAAgB;UACV,UAAU;SACX,UAAU;SACV,UAAU;;iBAEF,UAAU;;yBAEF,gBAAgB;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;iBAmExB,IAAI;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;eAiDN,gBAAgB;;;;;;YAMnB,UAAU;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;aA+BT,IAAI;;;;;;;;6BAQY,UAAU;;;;;;+BAMR,UAAU;;;;;;;;;;;;;;;;;;;;;;;;iCAwBR,UAAU;;;cAG7B,UAAU;;oBAEJ,gBAAgB;;;;YAIxB,gBAAgB;;;;;;;;;;;;;;kBAcV,IAAI;;;;;;;;;;;;cAYR,gBAAgB;;;;;;;;;;;2BAWH,UAAU;;;;;;;;;MAS/B,gBAAgB;;;;;;;UAOZ,gBAAgB;;;gBAGV,IAAI;;;;;;;;;;;;;;;;;;;;;;;;6BAwBS,IAAI;;;;;cAKnB,gBAAgB;;;;;;8CAMgB,UAAU;yBAC/B,UAAU;gBACnB,gBAAgB;;;;;;;;;;;;;;;mBAeb,UAAU;;;;cAIf,gBAAgB;;;;;;;;;;;;;;;;;;;;;;;;;;;;;2BA6BH,UAAU;;;;;;;;;;8BAUP,UAAU;;;;;8BAKV,UAAU;wBAChB,UAAU;;;;;;;;;;;;;;;;;;;;;;;cAuBpB,gBAAgB;;;;;;;;;;CAU7B;QACG,8CAA8C,EAAE;;;;;;;;;;;;;;;;;;;IAmBhD,UAAU;;cAEA,IAAI;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;mBAkDC,IAAI;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;wCA2EiB,UAAU;;;4CAGN,UAAU;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;CAmCrD;QACG,8BAA8B,EAAE;;;;;;;IAOhC,gBAAgB;IAChB,gBAAgB;IAChB,gBAAgB;UACV,UAAU;SACX,UAAU;SACV,UAAU;;;;;;;;;;;;;;;;;;uBAkBI,UAAU;KAC5B,UAAU;;cAED,gBAAgB;;+BAEC,IAAI;;;;;;;;;;;;;;YAcvB,UAAU;;uBAEC,UAAU;cACnB,gBAAgB;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;oBAmCV,gBAAgB;;;;;;;;;;;oBAWhB,gBAAgB;4CACQ,IAAI;;;;;;;;;;;oBAW5B,gBAAgB;;;;;;;iBAOnB,IAAI;;;;;;oBAMD,gBAAgB;;;;;;;;;cAStB,gBAAgB;;;;;QAKtB,gBAAgB;QAChB,gBAAgB;;;;;;;;;;;;;;;;;;UAkBd,gBAAgB;;;;;;;;;;;;;oBAaN,gBAAgB;;;;gBAIpB,gBAAgB;;;;;;;;;;;wBAWR,IAAI;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;mBAwCT,IAAI;;;;;;;sBAOD,gBAAgB;;;;;;;;;;;;;;;;;gBAiBtB,gBAAgB;;;;;;;;;;;;gBAYhB,UAAU;;SAEjB,UAAU;;;;;;;;;;YAUP,gBAAgB;aACf,IAAI;;;;;;;YAOL,gBAAgB;aACf,IAAI;;;;;;;YAOL,gBAAgB;aACf,IAAI;;;;;;;YAOL,gBAAgB;aACf,IAAI;;;;;;;YAOL,gBAAgB;aACf,IAAI;;;;;;UAMP,gBAAgB;WACf,IAAI;;;UAGL,gBAAgB;WACf,IAAI;;;UAGL,gBAAgB;WACf,IAAI;;;UAGL,gBAAgB;WACf,IAAI;;;UAGL,gBAAgB;;;;kBAIR,gBAAgB;;;;;;;;;;;;uDAYqB,UAAU;yBACxC,UAAU;;;;;;;;;;;;;;CAclC;QACG,iCAAiC,EAAE;;;;;;;;;;;;;;;IAenC,gBAAgB;IAChB,gBAAgB;IAChB,gBAAgB;UACV,UAAU;SACX,UAAU;;;;+BAIY,UAAU;;;;sBAInB,UAAU;;;kCAGE,UAAU;;;;;;;;;;;;;;6BAcf,UAAU;;;;;;;;;;;;;;kCAcL,IAAI;;;;;;;;oBAQlB,IAAI;iBACP,IAAI;;4BAEO,IAAI;;;;;;QAMxB,gBAAgB;;sBAEF,IAAI;;;;;;2BAMC,IAAI;;;;;;;;;;YAUnB,UAAU;;;;;kBAKJ,gBAAgB;;mBAEf,IAAI;;UAEb,gBAAgB;;;;;;;;;;;;;gBAaV,IAAI;;;yBAGK,UAAU;gBACnB,gBAAgB;;;;kBAId,gBAAgB;;qBAEb,IAAI;;;;;;;YAOb,gBAAgB;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;kBA8BV,gBAAgB;;mBAEf,IAAI;;UAEb,gBAAgB;;;;;;;;;;;;gBAYV,IAAI;;;;kBAIF,gBAAgB;;qBAEb,IAAI;;;;;6BAKI,UAAU;oBACnB,gBAAgB;;;;YAIxB,gBAAgB;;;;;;;;;;;;;;;;;;kBAkBV,gBAAgB;;mBAEf,IAAI;;UAEb,gBAAgB;;;;;;;;;;;;gBAYV,IAAI;;;yBAGK,UAAU;;aAEtB,gBAAgB;;;;;;;kBAOX,gBAAgB;;qBAEb,IAAI;;;;;;;YAOb,gBAAgB;;;;;;;;;;;;;;;;;;;kBAmBV,gBAAgB;;mBAEf,IAAI;;;;;;;;;;;gBAWP,IAAI;;;;kBAIF,gBAAgB;;qBAEb,IAAI;;;;;6BAKI,UAAU;oBACnB,gBAAgB;;;;;;;;;;;;;;gBAcpB,gBAAgB;;;;;;;gBAOhB,IAAI;;;;kBAIF,gBAAgB;;;;;;;;;;;;;;;;;;;;;kBAqBhB,gBAAgB;;;;;;;;;;;;;;;;;kBAiBhB,gBAAgB;;;;;;;;;;;;;kBAahB,gBAAgB;;;;;;;;;;;;;;;gBAelB,gBAAgB;;;;;;;gBAOhB,IAAI;;;;;;;;;;;;;;;;;CAiBnB;QACG,gCAAgC,EAAE;;;;;;;;;gBAStB,IAAI;;;;;;;;;;;;;;oCAcgB,IAAI;;;;;;;IAOpC,IAAI,2BAA2B,IAAI;;;;;;;;;;;;CAYtC;KACE,CAAC;AACJ,CAAC"}

package/src/generators/slice/built-in-plan-authorization-infrastructure-files.d.ts

@@ -0,0 +1,2 @@
+/** @internal */
+export declare function renderStandardSliceAuthorizationInfrastructureFiles(name: string, pascalName: string): Readonly<Record<string, string>>;

package/src/generators/slice/built-in-plan-authorization-infrastructure-files.js

@@ -0,0 +1,559 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.renderStandardSliceAuthorizationInfrastructureFiles = renderStandardSliceAuthorizationInfrastructureFiles;
+const MACHINE_CLIENT_PROVISIONER_SOURCE = `import boto3,datetime,json,logging,os,urllib.request
+from botocore.exceptions import ClientError
+cognito=boto3.client("cognito-idp")
+secrets=boto3.client("secretsmanager")
+logger=logging.getLogger()
+logger.setLevel(logging.INFO)
+
+def emit(event,level,outcome,message,error_code=None):
+    attributes={
+        "requestType":str(event.get("RequestType","unknown"))[:32],
+    }
+    if error_code:
+        attributes["errorCode"]=str(error_code)[:128]
+    record={
+        "attributes":attributes,
+        "component":"machine-client-provisioner",
+        "feature":"authorization",
+        "level":level,
+        "message":message,
+        "operation":"machine-client.provision",
+        "outcome":outcome,
+        "requestId":str(event.get("RequestId","unknown"))[:128],
+        "schemaVersion":1,
+        "slice":os.environ.get("EBK_SLICE",""),
+        "stage":os.environ.get("EBK_STAGE",""),
+        "timestamp":datetime.datetime.now(
+            datetime.timezone.utc
+        ).isoformat(timespec="milliseconds").replace("+00:00","Z"),
+        "workspace":os.environ.get("EBK_WORKSPACE",""),
+    }
+    encoded=json.dumps(record,separators=(",",":"),sort_keys=True)
+    if level=="ERROR":
+        logger.error(encoded)
+    else:
+        logger.info(encoded)
+
+def respond(event,status,physical,data=None,reason=None):
+    body=json.dumps({
+        "Status":status,
+        "Reason":reason or status,
+        "PhysicalResourceId":physical,
+        "StackId":event["StackId"],
+        "RequestId":event["RequestId"],
+        "LogicalResourceId":event["LogicalResourceId"],
+        "NoEcho":False,
+        "Data":data or {},
+    }).encode()
+    request=urllib.request.Request(
+        event["ResponseURL"],
+        data=body,
+        headers={"content-type":"","content-length":str(len(body))},
+        method="PUT",
+    )
+    with urllib.request.urlopen(request):
+        pass
+
+def read_version(secret_arn,stage):
+    try:
+        value=secrets.get_secret_value(
+            SecretId=secret_arn,
+            VersionStage=stage,
+        )
+        document=json.loads(value["SecretString"])
+        document["_versionId"]=value["VersionId"]
+        return document
+    except ClientError as error:
+        if error.response["Error"]["Code"] in (
+            "ResourceNotFoundException",
+            "InvalidRequestException",
+        ):
+            return None
+        raise
+
+def find_client(user_pool_id,client_name):
+    paginator=cognito.get_paginator("list_user_pool_clients")
+    for page in paginator.paginate(UserPoolId=user_pool_id,MaxResults=60):
+        for summary in page.get("UserPoolClients",[]):
+            if summary.get("ClientName")==client_name:
+                return cognito.describe_user_pool_client(
+                    UserPoolId=user_pool_id,
+                    ClientId=summary["ClientId"],
+                )["UserPoolClient"]
+    return None
+
+def ensure_client(properties):
+    client=find_client(properties["UserPoolId"],properties["ClientName"])
+    if client:
+        return client
+    return cognito.create_user_pool_client(
+        UserPoolId=properties["UserPoolId"],
+        ClientName=properties["ClientName"],
+        GenerateSecret=True,
+        AllowedOAuthFlows=["client_credentials"],
+        AllowedOAuthFlowsUserPoolClient=True,
+        AllowedOAuthScopes=properties["Scopes"],
+        AccessTokenValidity=15,
+        TokenValidityUnits={"AccessToken":"minutes"},
+        EnableTokenRevocation=True,
+        PreventUserExistenceErrors="ENABLED",
+    )["UserPoolClient"]
+
+def delete_client(user_pool_id,client_id):
+    try:
+        cognito.delete_user_pool_client(
+            UserPoolId=user_pool_id,
+            ClientId=client_id,
+        )
+    except ClientError as error:
+        if error.response["Error"]["Code"]!="ResourceNotFoundException":
+            raise
+
+def handler(event,context):
+    properties=event["ResourceProperties"]
+    physical="ebk-machine-client-"+properties["ResourceServerIdentifier"]
+    try:
+        current=read_version(properties["SecretArn"],"AWSCURRENT")
+        previous=read_version(properties["SecretArn"],"AWSPREVIOUS")
+        if event["RequestType"]=="Delete":
+            for document in (current,previous):
+                if document and document.get("clientId"):
+                    delete_client(properties["UserPoolId"],document["clientId"])
+            emit(
+                event,
+                "INFO",
+                "success",
+                "Machine client provisioning completed.",
+            )
+            respond(event,"SUCCESS",physical)
+            return
+
+        generation=properties["CredentialGeneration"]
+        retire=properties["RetirePreviousGeneration"]=="true"
+        if retire and not current:
+            raise ValueError("No current machine credential generation exists.")
+        client=ensure_client(properties)
+        client_id=client["ClientId"]
+        rollback=(
+            current
+            and previous
+            and current.get("generation")!=generation
+            and previous.get("generation")==generation
+        )
+        if rollback:
+            if retire:
+                raise ValueError("Restore and prove the rollback generation before retiring the displaced generation.")
+            if previous.get("clientId")!=client_id:
+                raise ValueError("Rollback generation does not match its existing Cognito client.")
+            secrets.update_secret_version_stage(
+                SecretId=properties["SecretArn"],
+                VersionStage="AWSCURRENT",
+                MoveToVersionId=previous["_versionId"],
+                RemoveFromVersionId=current["_versionId"],
+            )
+            current,previous=previous,current
+        elif current and current.get("generation")!=generation:
+            if previous:
+                raise ValueError("Retire the previous generation before beginning another rotation.")
+            old_slot=current["generation"].split("-",1)[0]
+            new_slot=generation.split("-",1)[0]
+            if old_slot==new_slot:
+                raise ValueError("Credential generation must alternate blue and green slots.")
+            if retire:
+                raise ValueError("Create and prove a new generation before retiring the previous one.")
+
+        if not rollback and (
+            not current
+            or current.get("generation")!=generation
+            or current.get("clientId")!=client_id
+        ):
+            secrets.put_secret_value(
+                SecretId=properties["SecretArn"],
+                SecretString=json.dumps({
+                    "clientId":client_id,
+                    "clientSecret":client["ClientSecret"],
+                    "generation":generation,
+                },separators=(",",":")),
+            )
+            previous=current
+
+        if retire:
+            if not previous:
+                raise ValueError("No previous machine credential generation exists.")
+            previous_id=previous.get("clientId")
+            if previous_id and previous_id!=client_id:
+                delete_client(properties["UserPoolId"],previous_id)
+            version_id=previous.get("_versionId")
+            if version_id:
+                secrets.update_secret_version_stage(
+                    SecretId=properties["SecretArn"],
+                    VersionStage="AWSPREVIOUS",
+                    RemoveFromVersionId=version_id,
+                )
+
+        accepted_client_ids=[client_id]
+        if (
+            not retire
+            and previous
+            and previous.get("clientId")
+            and previous["clientId"]!=client_id
+        ):
+            accepted_client_ids.append(previous["clientId"])
+        emit(
+            event,
+            "INFO",
+            "success",
+            "Machine client provisioning completed.",
+        )
+        respond(event,"SUCCESS",physical,{
+            "AcceptedClientIdsJson":json.dumps(
+                accepted_client_ids,
+                separators=(",",":"),
+            ),
+            "ClientId":client_id,
+        })
+    except Exception as error:
+        emit(
+            event,
+            "ERROR",
+            "failure",
+            "Machine client provisioning failed.",
+            type(error).__name__,
+        )
+        respond(event,"FAILED",physical,reason=type(error).__name__)
+`;
+/** @internal */
+function renderStandardSliceAuthorizationInfrastructureFiles(name, pascalName) {
+    return {
+        'authorization/machine-client-provisioner.py': MACHINE_CLIENT_PROVISIONER_SOURCE + '\n',
+        'infra/authorization.ts': `import { createHash } from 'node:crypto';
+
+const MACHINE_AUTHORIZATION_SCOPE_NAMES = [
+  'delegation-use',
+  'proof-read',
+] as const;
+
+export type MachineCredentialGeneration =
+  | \`blue-\${number}\`
+  | \`green-\${number}\`;
+
+export interface StandardSliceMachineAuthorizationOptions {
+  credentialGeneration: MachineCredentialGeneration;
+  provisionerFunctionArn: any;
+  retirePreviousGeneration?: boolean;
+  tokenEndpoint: any;
+  userPoolId: any;
+}
+
+function requireCredentialGeneration(
+  value: string,
+): MachineCredentialGeneration {
+  if (!/^(?:blue|green)-[1-9][0-9]{0,11}$/.test(value)) {
+    throw new Error(
+      'Machine credential generation must select blue or green plus a bounded positive integer.',
+    );
+  }
+  return value as MachineCredentialGeneration;
+}
+
+function machineClientName(
+  stage: string,
+  generation: MachineCredentialGeneration,
+): string {
+  const value = '${name}-machine-' + stage + '-' + generation;
+  if (value.length <= 128) return value;
+  const digest = createHash('sha256')
+    .update(value, 'utf8')
+    .digest('hex')
+    .slice(0, 12);
+  return value.slice(0, 115) + '-' + digest;
+}
+
+function requiredStackOutput(stack: any, key: string) {
+  return stack.outputs.apply((outputs: Record<string, string>) => {
+    const value = outputs?.[key];
+    if (!value) {
+      throw new Error(
+        'Machine authorization provisioning omitted required output ' + key + '.',
+      );
+    }
+    return value;
+  });
+}
+
+export function standardSliceMachineClientProvisionerPermissions(options: {
+  userPoolArn: any;
+}) {
+  const account = aws.getCallerIdentityOutput({});
+  const partition = aws.getPartitionOutput({});
+  const region = aws.getRegionOutput({});
+  const secretArn =
+    $interpolate\`arn:\${partition.partition}:secretsmanager:\${region.name}:\${account.accountId}:secret:ebk/\${$app.stage}/${name}/authorization/machine-client-*\`;
+  return [
+    {
+      actions: [
+        'cognito-idp:CreateUserPoolClient',
+        'cognito-idp:DeleteUserPoolClient',
+        'cognito-idp:DescribeUserPoolClient',
+        'cognito-idp:ListUserPoolClients',
+      ],
+      resources: [options.userPoolArn],
+    },
+    {
+      actions: [
+        'secretsmanager:GetSecretValue',
+        'secretsmanager:PutSecretValue',
+        'secretsmanager:UpdateSecretVersionStage',
+      ],
+      resources: [secretArn],
+    },
+  ];
+}
+
+/**
+ * Provisions the Slice resource server and a confidential client entirely
+ * inside AWS. The nested stack exports the non-secret client ID and secret
+ * container ARN; the generated client secret never crosses into SST/Pulumi
+ * inputs, outputs, logs, or state.
+ */
+export function createStandardSliceMachineAuthorization(
+  options: StandardSliceMachineAuthorizationOptions,
+) {
+  const credentialGeneration = requireCredentialGeneration(
+    options.credentialGeneration,
+  );
+  const resourceServerIdentifier = '${name}-' + $app.stage;
+  const template = {
+    AWSTemplateFormatVersion: '2010-09-09',
+    Description:
+      'EBK AWS-internal confidential Cognito client provisioning contract.',
+    Parameters: {
+      ClientName: { Type: 'String' },
+      CredentialGeneration: {
+        AllowedPattern: '^(blue|green)-[1-9][0-9]{0,11}$',
+        Type: 'String',
+      },
+      ResourceServerIdentifier: { Type: 'String' },
+      ProvisionerFunctionArn: { Type: 'String' },
+      RetirePreviousGeneration: {
+        AllowedValues: ['false', 'true'],
+        Type: 'String',
+      },
+      SecretName: { Type: 'String' },
+      UserPoolId: { Type: 'String' },
+    },
+    Resources: {
+      SliceAdminGroup: {
+        Type: 'AWS::Cognito::UserPoolGroup',
+        Properties: {
+          Description:
+            'Direct human recovery and non-author review authority for ${name}.',
+          GroupName: '${name}-admin',
+          Precedence: 10,
+          UserPoolId: { Ref: 'UserPoolId' },
+        },
+      },
+      SliceTestWriterGroup: {
+        Type: 'AWS::Cognito::UserPoolGroup',
+        Properties: {
+          Description:
+            'Run-scoped synthetic-write authority for ${name} deployed proof.',
+          GroupName: '${name}-test-writer',
+          Precedence: 20,
+          UserPoolId: { Ref: 'UserPoolId' },
+        },
+      },
+      MachineClientSecret: {
+        Type: 'AWS::SecretsManager::Secret',
+        Properties: {
+          Description:
+            'EBK generated ${name} confidential machine-client credential.',
+          Name: { Ref: 'SecretName' },
+          Tags: [
+            { Key: 'ebk:management', Value: 'generated-machine-credential' },
+            { Key: 'ebk:slice', Value: '${name}' },
+            { Key: 'sst:stage', Value: $app.stage },
+          ],
+        },
+      },
+      MachineResourceServer: {
+        Type: 'AWS::Cognito::UserPoolResourceServer',
+        Properties: {
+          Identifier: { Ref: 'ResourceServerIdentifier' },
+          Name: '${pascalName}MachineAuthorization',
+          Scopes: [
+            {
+              ScopeDescription:
+                'Use an online ${name} attended-delegation capability.',
+              ScopeName: MACHINE_AUTHORIZATION_SCOPE_NAMES[0],
+            },
+            {
+              ScopeDescription:
+                'Call the narrow ${name} machine-authorization proof.',
+              ScopeName: MACHINE_AUTHORIZATION_SCOPE_NAMES[1],
+            },
+          ],
+          UserPoolId: { Ref: 'UserPoolId' },
+        },
+      },
+      MachineClient: {
+        Type: 'Custom::EbkCognitoMachineClient',
+        DependsOn: ['MachineResourceServer'],
+        Properties: {
+          ClientName: { Ref: 'ClientName' },
+          CredentialGeneration: { Ref: 'CredentialGeneration' },
+          ResourceServerIdentifier: {
+            Ref: 'ResourceServerIdentifier',
+          },
+          RetirePreviousGeneration: {
+            Ref: 'RetirePreviousGeneration',
+          },
+          Scopes: MACHINE_AUTHORIZATION_SCOPE_NAMES.map((scope) => ({
+            'Fn::Join': [
+              '/',
+              [{ Ref: 'ResourceServerIdentifier' }, scope],
+            ],
+          })),
+          SecretArn: { Ref: 'MachineClientSecret' },
+          ServiceToken: { Ref: 'ProvisionerFunctionArn' },
+          UserPoolId: { Ref: 'UserPoolId' },
+        },
+      },
+    },
+    Outputs: {
+      AcceptedClientIdsJson: {
+        Value: {
+          'Fn::GetAtt': ['MachineClient', 'AcceptedClientIdsJson'],
+        },
+      },
+      AdminGroupName: { Value: { Ref: 'SliceAdminGroup' } },
+      ClientId: {
+        Value: { 'Fn::GetAtt': ['MachineClient', 'ClientId'] },
+      },
+      ResourceServerIdentifier: {
+        Value: { Ref: 'ResourceServerIdentifier' },
+      },
+      SecretArn: { Value: { Ref: 'MachineClientSecret' } },
+      TestWriterGroupName: {
+        Value: { Ref: 'SliceTestWriterGroup' },
+      },
+    },
+  };
+
+  const stack = new aws.cloudformation.Stack(
+    '${pascalName}MachineAuthorization',
+    {
+      parameters: {
+        ClientName: machineClientName($app.stage, credentialGeneration),
+        CredentialGeneration: credentialGeneration,
+        ProvisionerFunctionArn: options.provisionerFunctionArn,
+        ResourceServerIdentifier: resourceServerIdentifier,
+        RetirePreviousGeneration:
+          options.retirePreviousGeneration === true ? 'true' : 'false',
+        SecretName:
+          'ebk/' +
+          $app.stage +
+          '/${name}/authorization/machine-client',
+        UserPoolId: options.userPoolId,
+      },
+      templateBody: JSON.stringify(template),
+    },
+  );
+  const acceptedClientIdsJson = requiredStackOutput(
+    stack,
+    'AcceptedClientIdsJson',
+  );
+  const adminGroupName = requiredStackOutput(stack, 'AdminGroupName');
+  const clientId = requiredStackOutput(stack, 'ClientId');
+  const identifier = requiredStackOutput(
+    stack,
+    'ResourceServerIdentifier',
+  );
+  const secretArn = requiredStackOutput(stack, 'SecretArn');
+  const testWriterGroupName = requiredStackOutput(
+    stack,
+    'TestWriterGroupName',
+  );
+  const scopes = {
+    delegationUse: identifier.apply(
+      (value: string) => value + '/delegation-use',
+    ),
+    proofRead: identifier.apply(
+      (value: string) => value + '/proof-read',
+    ),
+  };
+  return {
+    acceptedClientIdsJson,
+    adminGroupName,
+    clientId,
+    credentialGeneration,
+    resourceServerIdentifier: identifier,
+    scopes,
+    proof: {
+      environment: {
+        AUTH_MACHINE_CLIENT_ID: clientId,
+        AUTH_MACHINE_CLIENT_SECRET_ARN: secretArn,
+        AUTH_MACHINE_PROOF_SCOPE: scopes.proofRead,
+        AUTH_MACHINE_RESOURCE_SERVER: identifier,
+        AUTH_MACHINE_TOKEN_ENDPOINT: options.tokenEndpoint,
+      },
+      permissions: [
+        {
+          actions: ['secretsmanager:GetSecretValue'],
+          resources: [secretArn],
+        },
+      ],
+    },
+    secretArn,
+    testWriterGroupName,
+    tokenEndpoint: options.tokenEndpoint,
+  };
+}
+`,
+        'docs/runbooks/rotate-machine-authorization.md': `# Rotate machine authorization credentials
+
+The Standard Slice creates its Cognito client secret inside AWS and writes it
+directly to the generated Secrets Manager container. Do not retrieve, copy,
+print, or pass the client secret to SST, Pulumi, GitHub, an agent, or a command
+line.
+
+## Begin an overlap
+
+1. Read the current non-secret generation from the protected deployment
+   configuration.
+2. Select the other slot and a new positive generation number, for example
+   \`blue-1\` to \`green-2\`.
+3. Set \`EBK_MACHINE_CREDENTIAL_GENERATION\` to that generation and leave
+   \`EBK_MACHINE_RETIRE_PREVIOUS_GENERATION\` unset.
+4. Deploy through the Slice's Nx \`deploy\` target. The AWS-internal
+   provisioner creates the replacement client and moves its credential to
+   \`AWSCURRENT\`; the former credential remains \`AWSPREVIOUS\` and its Cognito
+   client remains valid during the overlap.
+5. Prove the server-side token-minting journey reads \`AWSCURRENT\`, obtains a
+   bounded access token, and completes its narrow capability smoke. Evidence
+   may contain the client ID, generation, scope names, and outcome, but never a
+   secret or access token.
+
+## Retire the previous generation
+
+Only after the new generation is proved, set
+\`EBK_MACHINE_RETIRE_PREVIOUS_GENERATION=true\` and deploy the same generation
+again through Nx. The AWS-internal provisioner deletes the previous Cognito
+client and removes its \`AWSPREVIOUS\` label without returning either
+credential. Clear the retirement flag after the successful deploy.
+
+If the replacement cannot mint and use a token, restore the prior deployment
+configuration before retirement. The provisioner recognizes that exact
+\`AWSPREVIOUS\` generation, atomically promotes it back to \`AWSCURRENT\`, and
+keeps the failed replacement as the new rollback generation. Prove the restored
+generation before retiring anything. Never retire in the same deployment that
+creates a generation, reuse the current color for a new generation, invoke SST
+directly, or use the interactive operator-secret commands for this
+provider-generated credential.
+`,
+    };
+}
+//# sourceMappingURL=built-in-plan-authorization-infrastructure-files.js.map

package/src/generators/slice/built-in-plan-authorization-infrastructure-files.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"built-in-plan-authorization-infrastructure-files.js","sourceRoot":"","sources":["../../../../../../packages/nx/src/generators/slice/built-in-plan-authorization-infrastructure-files.ts"],"names":[],"mappings":";;AAkOA,kHA6UC;AA/iBD,MAAM,iCAAiC,GAAG;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;CA+NzC,CAAC;AAEF,gBAAgB;AAChB,SAAgB,mDAAmD,CACjE,IAAY,EACZ,UAAkB;IAElB,OAAO;QACL,6CAA6C,EAC3C,iCAAiC,GAAG,IAAI;QAC1C,wBAAwB,EAAE;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;mBAkCX,IAAI;;;;;;;;;;;;;;;;;;;;;;;;;;;;+HA4BwG,IAAI;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;sCAkC7F,IAAI;;;;;;;;;;;;;;;;;;;;;;;;;yEAyB+B,IAAI;wBACrD,IAAI;;;;;;;;;wDAS4B,IAAI;wBACpC,IAAI;;;;;;;;;6BASC,IAAI;;;;0CAIS,IAAI;;;;;;;;;mBAS3B,UAAU;;;;iCAII,IAAI;;;;;mCAKF,IAAI;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;OAoDhC,UAAU;;;;;;;;;;;;cAYH,IAAI;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;CAwDjB;QACG,+CAA+C,EAAE;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;CAwCpD;KACE,CAAC;AACJ,CAAC"}

package/src/generators/slice/built-in-plan-data-deletion-files.d.ts

@@ -0,0 +1,2 @@
+/** @internal */
+export declare function renderProductDataDeletionFiles(name: string, pascalName: string, workspace: string): Readonly<Record<string, string>>;