@empire-builder-kit/nx 1.0.0-rc.13 → 1.0.0-rc.17

package/src/executors/infrastructure-plan/schema.json

@@ -18,6 +18,22 @@
       "type": "string",
       "enum": ["consumer", "foundation"]
     },
+    "expectedRoleArn": {
+      "type": "string",
+      "pattern": "^arn:(aws|aws-us-gov|aws-cn):iam::[0-9]{12}:role/[A-Za-z0-9+=,.@_/-]{1,512}$",
+      "description": "Exact temporary-session IAM role expected for local governed planning."
+    },
+    "profile": {
+      "type": "string",
+      "minLength": 1,
+      "maxLength": 128,
+      "description": "Optional AWS shared-config profile used to obtain temporary federated credentials."
+    },
+    "region": {
+      "type": "string",
+      "pattern": "^[a-z]{2}(-gov)?-[a-z]+-[0-9]$",
+      "description": "Exact AWS Region used by EBK control-plane preflights. This must match the committed deployment Region."
+    },
     "action": {
       "type": "string",
       "enum": ["deploy", "refresh", "remove"],

package/src/executors/local-deploy/fixtures/local-deploy-state-machine.mjs

@@ -0,0 +1,53 @@
+import { readFileSync, renameSync, writeFileSync } from 'node:fs';
+
+const [statePath, target, action] = process.argv.slice(2);
+if (!statePath || !target || !action) {
+  process.stderr.write('statePath, target, and action are required\n');
+  process.exit(2);
+}
+
+const [project, operation] = target.split(':');
+const state = JSON.parse(readFileSync(statePath, 'utf8'));
+const projectState = state.projects?.[project];
+if (
+  !projectState ||
+  !['infrastructure-plan', 'deploy', 'refresh'].includes(operation)
+) {
+  process.stderr.write(`unsupported state-machine target: ${target}\n`);
+  process.exit(2);
+}
+if (operation === 'infrastructure-plan' && projectState.planFailure) {
+  process.stderr.write(`${projectState.planFailure}\n`);
+  process.exit(1);
+}
+if (operation !== 'infrastructure-plan' && projectState.interrupt) {
+  process.stderr.write(`interrupted ${target}\n`);
+  process.exit(130);
+}
+if (operation !== 'infrastructure-plan') {
+  projectState.observed = projectState.desired;
+}
+state.calls ??= [];
+state.calls.push({ action, target });
+const temporaryPath = `${statePath}.next`;
+writeFileSync(temporaryPath, `${JSON.stringify(state)}\n`, { mode: 0o600 });
+renameSync(temporaryPath, statePath);
+process.stdout.write(
+  `${JSON.stringify({
+    desired: projectState.desired,
+    noOp: projectState.desired === projectState.observed,
+    observed: projectState.observed,
+    project,
+    providerReadOnly:
+      operation === 'infrastructure-plan' &&
+      projectState.providerReadOnly === true,
+    providerReadCopies:
+      operation === 'infrastructure-plan' &&
+      projectState.providerReadOnly === true
+        ? (projectState.providerReadCopies ?? 1)
+        : 0,
+    reviewRequired:
+      operation === 'infrastructure-plan' &&
+      projectState.desired !== projectState.observed,
+  })}\n`,
+);

package/src/executors/local-deploy/local-approval.d.ts

@@ -0,0 +1,23 @@
+import type { ReadStream, WriteStream } from 'node:tty';
+export interface LocalMutationApprovalRequest {
+    action: 'deploy' | 'refresh';
+    challenge: string;
+    planDigest: string;
+    project: string;
+    stage: 'development' | 'staging' | 'production';
+}
+export type LocalMutationApprover = (request: LocalMutationApprovalRequest) => Promise<boolean>;
+export declare class LocalMutationApprovalUnavailableError extends Error {
+    constructor();
+}
+interface LocalApprovalTerminal {
+    input: ReadStream;
+    output: WriteStream;
+}
+/**
+ * Creates the public, non-secret operator acknowledgement used by deploy-local
+ * and refresh-local. This is an active-operator boundary, not an independent
+ * human-review claim: an authorized agent controlling a real TTY may answer it.
+ */
+export declare function createTtyLocalMutationApprover(terminal?: LocalApprovalTerminal): LocalMutationApprover;
+export {};

package/src/executors/local-deploy/local-approval.js

@@ -0,0 +1,43 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.LocalMutationApprovalUnavailableError = void 0;
+exports.createTtyLocalMutationApprover = createTtyLocalMutationApprover;
+const promises_1 = require("node:readline/promises");
+class LocalMutationApprovalUnavailableError extends Error {
+    constructor() {
+        super('Local infrastructure mutation requires an interactive TTY operated by a human or authorized agent.');
+        this.name = 'LocalMutationApprovalUnavailableError';
+    }
+}
+exports.LocalMutationApprovalUnavailableError = LocalMutationApprovalUnavailableError;
+/**
+ * Creates the public, non-secret operator acknowledgement used by deploy-local
+ * and refresh-local. This is an active-operator boundary, not an independent
+ * human-review claim: an authorized agent controlling a real TTY may answer it.
+ */
+function createTtyLocalMutationApprover(terminal = {
+    input: process.stdin,
+    output: process.stderr,
+}) {
+    return async ({ challenge }) => {
+        if (!terminal.input.isTTY || !terminal.output.isTTY) {
+            throw new LocalMutationApprovalUnavailableError();
+        }
+        const prompt = (0, promises_1.createInterface)({
+            input: terminal.input,
+            output: terminal.output,
+            terminal: true,
+        });
+        try {
+            const response = await prompt.question(`Type ${challenge} to acknowledge the current plan: `);
+            return response === challenge;
+        }
+        catch {
+            throw new LocalMutationApprovalUnavailableError();
+        }
+        finally {
+            prompt.close();
+        }
+    };
+}
+//# sourceMappingURL=local-approval.js.map

package/src/executors/local-deploy/local-approval.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"local-approval.js","sourceRoot":"","sources":["../../../../../../packages/nx/src/executors/local-deploy/local-approval.ts"],"names":[],"mappings":";;;AAkCA,wEA0BC;AA5DD,qDAAyD;AAezD,MAAa,qCAAsC,SAAQ,KAAK;IAC9D;QACE,KAAK,CACH,oGAAoG,CACrG,CAAC;QACF,IAAI,CAAC,IAAI,GAAG,uCAAuC,CAAC;IACtD,CAAC;CACF;AAPD,sFAOC;AAOD;;;;GAIG;AACH,SAAgB,8BAA8B,CAC5C,WAAkC;IAChC,KAAK,EAAE,OAAO,CAAC,KAAK;IACpB,MAAM,EAAE,OAAO,CAAC,MAAM;CACvB;IAED,OAAO,KAAK,EAAE,EAAE,SAAS,EAAE,EAAE,EAAE;QAC7B,IAAI,CAAC,QAAQ,CAAC,KAAK,CAAC,KAAK,IAAI,CAAC,QAAQ,CAAC,MAAM,CAAC,KAAK,EAAE,CAAC;YACpD,MAAM,IAAI,qCAAqC,EAAE,CAAC;QACpD,CAAC;QACD,MAAM,MAAM,GAAG,IAAA,0BAAe,EAAC;YAC7B,KAAK,EAAE,QAAQ,CAAC,KAAK;YACrB,MAAM,EAAE,QAAQ,CAAC,MAAM;YACvB,QAAQ,EAAE,IAAI;SACf,CAAC,CAAC;QACH,IAAI,CAAC;YACH,MAAM,QAAQ,GAAG,MAAM,MAAM,CAAC,QAAQ,CACpC,QAAQ,SAAS,oCAAoC,CACtD,CAAC;YACF,OAAO,QAAQ,KAAK,SAAS,CAAC;QAChC,CAAC;QAAC,MAAM,CAAC;YACP,MAAM,IAAI,qCAAqC,EAAE,CAAC;QACpD,CAAC;gBAAS,CAAC;YACT,MAAM,CAAC,KAAK,EAAE,CAAC;QACjB,CAAC;IACH,CAAC,CAAC;AACJ,CAAC"}

package/src/executors/local-deploy/local-deploy.d.ts

@@ -0,0 +1,69 @@
+import { spawnSync } from 'node:child_process';
+import { GetParameterCommand, PutParameterCommand } from '@aws-sdk/client-ssm';
+import { type ExecutorContext, type PromiseExecutor } from '@nx/devkit';
+import { type InfrastructurePlanV1 } from '../../infrastructure-change/index.js';
+import { type CanonicalDeploymentStage } from '../../repository-policy/index.js';
+import { type LocalMutationApprover } from './local-approval.js';
+interface LocalDeployOptions {
+    action?: 'deploy' | 'refresh';
+    confirmation?: string;
+    expectedRoleArn: string;
+    phase?: 'foundation-bootstrap' | 'full-stage';
+    profile?: string;
+    stage: CanonicalDeploymentStage;
+}
+interface LocalDeployDependencies {
+    approve?: LocalMutationApprover;
+    backend?: (input: {
+        account: string;
+        applications: readonly string[];
+        profile?: string;
+        region: string;
+        stage: CanonicalDeploymentStage;
+    }) => Promise<LocalSstBackendAuthority>;
+    now?: () => Date;
+    run?: typeof spawnSync;
+    caller?: (region: string) => Promise<{
+        Account?: string;
+        Arn?: string;
+    }>;
+}
+interface LocalSstBackendAuthority {
+    authorityDigest: string;
+    createdApplications: readonly string[];
+    stateBucketArn: string;
+}
+/** @internal */
+export declare function prepareLocalSstBackend(input: {
+    account: string;
+    applications: readonly string[];
+    profile?: string;
+    region: string;
+    stage: CanonicalDeploymentStage;
+}, dependencies?: {
+    passphrase?: () => string;
+    send?: (command: GetParameterCommand | PutParameterCommand) => Promise<{
+        Parameter?: {
+            Name?: string;
+            Type?: string;
+            Value?: string;
+            Version?: number;
+        };
+    }>;
+}): Promise<LocalSstBackendAuthority>;
+/** @internal */
+export declare function localPlanSummaryDigest(input: {
+    action?: 'deploy' | 'refresh';
+    account: string;
+    orderedProjects: readonly string[];
+    phase: 'foundation-bootstrap' | 'full-stage';
+    plans: Readonly<Record<string, InfrastructurePlanV1>>;
+    region: string;
+    sourceCommit: string;
+    stage: CanonicalDeploymentStage;
+}): string;
+export declare function runLocalDeploy(options: LocalDeployOptions, context: ExecutorContext, dependencies?: LocalDeployDependencies): Promise<{
+    success: boolean;
+}>;
+declare const executor: PromiseExecutor<LocalDeployOptions>;
+export default executor;