@empire-builder-kit/nx 1.0.0-rc.2 → 1.0.0-rc.21

package/src/executors/infrastructure-plan/infrastructure-plan.d.ts

@@ -1,7 +1,7 @@
 import { type ExecutorContext, type PromiseExecutor } from '@nx/devkit';
-import { type InfrastructureDriftStatus, type InfrastructureMutationAction, type InfrastructurePlanV1, type InfrastructureStateIdentityV1, type NormalizedSstDiffV1 } from '../../infrastructure-change/index.js';
+import { type InfrastructureApprovalRecordV1, type InfrastructureAuthorizationEvidenceV1, type InfrastructureDriftStatus, type InfrastructureMutationAction, type InfrastructurePlanV1, type InfrastructureRiskAssessmentV1, type InfrastructureRiskPolicyV1, type InfrastructureStateIdentityV1, type NormalizedSstDiffV1 } from '../../infrastructure-change/index.js';
 import { type SstCommandInvocation, type SstLifecycleOptions } from '../sst-lifecycle/run-sst-command.js';
-export interface InfrastructurePlanExecutorOptions extends Pick<SstLifecycleOptions, 'cwd' | 'stage' | 'stageMode'> {
+export interface InfrastructurePlanExecutorOptions extends Pick<SstLifecycleOptions, 'cwd' | 'expectedRoleArn' | 'profile' | 'region' | 'stage' | 'stageMode'> {
     action?: InfrastructureMutationAction;
     approvalPath?: string;
     configurationPath?: string;
@@ -15,7 +15,7 @@ export interface InfrastructurePlanExecutorOptions extends Pick<SstLifecycleOpti
     smokeEvidencePath?: string;
 }
 export interface InfrastructureResourceObservationCoverage {
-    adapter: 'aws-resource-groups-tagging-api' | 'none' | 'sst-pulumi-refresh-preview';
+    adapter: 'aws-resource-groups-tagging-api' | 'none' | 'sst-pulumi-refresh-preview' | 'sst-pulumi-refresh-preview+aws-secrets-manager-version-stages';
     arnDigest: string | null;
     coveredProperties: readonly string[];
     type: string;
@@ -29,6 +29,61 @@ interface DriftEvidence {
     generatedAt: string;
     status: InfrastructureDriftStatus;
 }
+interface RefreshPreviewDiagnosticResource {
+    changeBasis: readonly ('detailedDiff' | 'diffs' | 'old-new')[];
+    changedPropertyPaths: readonly string[];
+    logicalId: string;
+    resourceType: string;
+}
+interface RefreshPreviewExternalLookupNormalization {
+    changedPropertyPath: '/inputs/name' | '/inputs/tags/Name';
+    logicalId: string;
+    resourceType: string;
+}
+interface RefreshPreviewExternalFrameworkTagObservation {
+    changedPropertyPaths: readonly string[];
+    logicalId: string;
+    providerReadLogicalId: string;
+    resourceType: string;
+}
+interface RefreshPreviewDiagnostics {
+    authorityMode: 'ordinary-and-refresh-separated' | 'refresh-reconciliation';
+    command: {
+        errorCode: string | null;
+        signal: string | null;
+        status: number | null;
+        stderrBytes: number;
+        stdoutBytes: number;
+    };
+    commandSucceeded: boolean;
+    complete: boolean;
+    entryCounts: {
+        desired: number;
+        externalFrameworkTagObserved: number;
+        externalLookupNormalized: number;
+        inertSame: number;
+        refresh: number;
+        rejectedSame: number;
+    };
+    providerRefreshSeparated: boolean;
+    ordinaryDesired: {
+        complete: boolean;
+        failureCounts: Readonly<Record<string, number>>;
+        resourceCount: number;
+    };
+    postRefreshDesired: {
+        complete: boolean;
+        failureCounts: Readonly<Record<string, number>>;
+        operationCounts: Readonly<Record<string, number>>;
+        resourceCount: number;
+    };
+    digest: string;
+    kind: 'ebk-infrastructure-refresh-preview-diagnostics';
+    externalFrameworkTagObservations: readonly RefreshPreviewExternalFrameworkTagObservation[];
+    externalLookupNormalizations: readonly RefreshPreviewExternalLookupNormalization[];
+    resources: readonly RefreshPreviewDiagnosticResource[];
+    schemaVersion: 7;
+}
 export interface InfrastructureObservation {
     callInventory: readonly string[];
     drift: DriftEvidence;
@@ -48,14 +103,23 @@ export interface InfrastructureObservedResource {
     retainedOnDelete: boolean | null;
     urnDigest: string;
 }
+interface ReviewedApprovalFile {
+    approval: InfrastructureApprovalRecordV1;
+    governance?: unknown;
+    planned: InfrastructurePlanV1;
+}
 interface CommandResult {
+    error?: NodeJS.ErrnoException;
+    signal?: NodeJS.Signals | null;
     status: number | null;
     stderr: string;
     stdout: string;
 }
 export interface InfrastructurePlanExecutorDependencies {
+    localCapability?: (input: Parameters<typeof consumeLocalMutationCapability>[0]) => void;
     now?: () => Date;
     observe?: (input: {
+        action: InfrastructureMutationAction;
         backendBootstrapDigest: string;
         childEnvironment: NodeJS.ProcessEnv;
         environment: NodeJS.ProcessEnv;
@@ -75,6 +139,29 @@ export interface InfrastructurePlanExecutorDependencies {
         shell: false;
     }) => CommandResult;
 }
+export declare const MAX_SST_DIFF_JSON_BYTES: number;
+interface InfrastructureBuildArtifactEntry {
+    digest: string;
+    path: string;
+    size: number;
+}
+interface InfrastructureBuildArtifactMaterial {
+    digest: string;
+    entries: readonly InfrastructureBuildArtifactEntry[];
+    kind: 'ebk-infrastructure-build-artifacts';
+    schemaVersion: 1;
+}
+/** @internal */
+export declare function collectInfrastructureBuildArtifacts(projectRoot: string): InfrastructureBuildArtifactMaterial;
+/** @internal */
+export declare function infrastructureConfigurationMetadataDigest(input: {
+    buildArtifactDigest: string;
+    configurationInputs: readonly {
+        contents: string;
+        path: string;
+    }[];
+    releaseCandidateDigest: string;
+}): string;
 type StandardRemoveProbeKind = 'aws-cloud-control' | 'aws-events-target' | 'aws-iam-role-policy' | 'aws-kms-retained' | 'aws-lambda-event-invoke-config' | 'aws-lambda-permission' | 'aws-logs-data-protection-policy' | 'aws-s3-retained' | 'aws-s3-object' | 'aws-secrets-manager-secret' | 'aws-sqs-queue-policy' | 'aws-ssm-parameter';
 interface StandardRemoveProbe {
     identifier: string;
@@ -83,6 +170,20 @@ interface StandardRemoveProbe {
     selector?: Readonly<Record<string, string>>;
     typeName?: string;
 }
+export declare function matchesExpectedAssumedRoleArn(account: string, callerArn: string, expectedRoleArn: string): boolean;
+export declare function localProductionConfirmation(input: {
+    action: InfrastructureMutationAction;
+    accountId: string;
+    region: string;
+    sourceCommit: string;
+}): string;
+export declare function revalidateLocalUnlockCallerAuthority(input: {
+    environment?: NodeJS.ProcessEnv;
+    invocation: SstCommandInvocation;
+    profile?: string;
+    spawn?: NonNullable<InfrastructurePlanExecutorDependencies['spawn']>;
+}): void;
+export declare function parseRefreshPreviewJson(value: string): unknown;
 /**
  * Reads the Pulumi StepEventStateMetadata `new.id` emitted by SST's pinned
  * JSON diff for imports. Only its digest leaves this private boundary.
@@ -92,20 +193,51 @@ export declare function extractPrivateImportIdentifierDigests(diffStdout: string
 export declare function approvalCandidateSourceCommit(context: ExecutorContext, options: InfrastructurePlanExecutorOptions, environment: NodeJS.ProcessEnv): string | undefined;
 /** @internal */
 export declare function createCandidateBoundSstChildEnvironment(environment: NodeJS.ProcessEnv, invocationEnvironment: SstCommandInvocation['environment'], candidateSourceCommit: string): NodeJS.ProcessEnv;
+interface PulumiStateResource {
+    custom?: unknown;
+    dependencies?: unknown;
+    external?: unknown;
+    id?: unknown;
+    inputs?: unknown;
+    outputs?: unknown;
+    parent?: unknown;
+    provider?: unknown;
+    protect?: unknown;
+    retainOnDelete?: unknown;
+    type?: unknown;
+    urn?: unknown;
+}
+/** @internal */
+export declare function normalizeDesiredSstDiffV4_17_1(input: {
+    errorCode?: string | null;
+    exitCode: number;
+    signal?: string | null;
+    spawnError?: boolean;
+    stderr?: string;
+    stdout: string | unknown;
+    toolVersion: string;
+}): NormalizedSstDiffV1;
 export declare function assessPulumiRefreshPreview(input: {
+    action: InfrastructureMutationAction;
     invocation: SstCommandInvocation;
     ordinaryDiff: NormalizedSstDiffV1;
     spawn: NonNullable<InfrastructurePlanExecutorDependencies['spawn']>;
+    stateResources?: readonly PulumiStateResource[];
     toolVersion: string;
     childEnvironment: NodeJS.ProcessEnv;
 }): {
     commandSucceeded: boolean;
     complete: boolean;
-    desiredMatchesOrdinary: boolean;
+    diagnostics: RefreshPreviewDiagnostics;
+    providerRefreshSeparated: boolean;
     digest: string;
     drift: NormalizedSstDiffV1;
     observedRefreshUrns: readonly string[];
+    rawDrift: string;
+    stderr: string;
 };
+/** @internal */
+export declare function requiresIamMutationAnalysis(_action: InfrastructureMutationAction, resource: NormalizedSstDiffV1['resources'][number]): boolean;
 export declare function standardRemoveProbeForResource(resource: InfrastructureObservedResource): StandardRemoveProbe;
 interface StandardRemoveProbeResult {
     present: boolean;
@@ -118,6 +250,7 @@ export declare function probeStandardRemoveResource(input: {
     spawn: NonNullable<InfrastructurePlanExecutorDependencies['spawn']>;
 }): StandardRemoveProbeResult;
 export declare function observeInfrastructureState(input: {
+    action: InfrastructureMutationAction;
     backendBootstrapDigest: string;
     childEnvironment: NodeJS.ProcessEnv;
     environment: NodeJS.ProcessEnv;
@@ -129,9 +262,100 @@ export declare function observeInfrastructureState(input: {
     spawn: NonNullable<InfrastructurePlanExecutorDependencies['spawn']>;
     toolVersion: string;
 }): InfrastructureObservation;
+/** @internal */
+export declare function actionRisk(risk: InfrastructureRiskAssessmentV1, action: InfrastructureMutationAction, options?: Readonly<{
+    diffComplete?: boolean;
+}>): InfrastructureRiskAssessmentV1;
 export declare function validateGovernanceEvidence(reviewed: {
+    approval?: InfrastructureApprovalRecordV1;
     governance?: unknown;
-} | undefined, plan: InfrastructurePlanV1, observedResources?: readonly InfrastructureObservedResource[], importIdentifierDigests?: Readonly<Record<string, string>>): Readonly<Record<string, string>>;
+} | undefined, plan: InfrastructurePlanV1, observedResources?: readonly InfrastructureObservedResource[], importIdentifierDigests?: Readonly<Record<string, string>>, adoptedImportPolicy?: InfrastructureRiskPolicyV1['adoptedImports']): Readonly<Record<string, string>>;
+/** @internal */
+export declare function createLocalPlanApprovalRecord(input: {
+    context: ExecutorContext;
+    environment: NodeJS.ProcessEnv;
+    now: Date;
+    plan: InfrastructurePlanV1;
+}): InfrastructureApprovalRecordV1 | undefined;
+/** @internal */
+export declare function hasUnreviewableLocalPlanBlock(plan: InfrastructurePlanV1): boolean;
+/** @internal */
+export declare function createLocalRefreshGovernanceReview(input: {
+    approval: InfrastructureApprovalRecordV1;
+    environment: NodeJS.ProcessEnv;
+    plan: InfrastructurePlanV1;
+}): ReviewedApprovalFile | undefined;
+/** @internal */
+export declare function createLocalDeployGovernanceReview(input: {
+    approval: InfrastructureApprovalRecordV1;
+    environment: NodeJS.ProcessEnv;
+    plan: InfrastructurePlanV1;
+}): ReviewedApprovalFile | undefined;
+/**
+ * Retains exact local approval for a plan that the stage-wide local executor
+ * has just recomputed and reviewed. This deliberately does not run SST again:
+ * the project mutation executor consumes one invocation-scoped capability and
+ * rechecks source, artifacts, credentials, policy, state identity, and lock
+ * immediately before spawn without claiming provider-preview replay.
+ *
+ * @internal
+ */
+export declare function authorizeRetainedLocalInfrastructurePlan(input: {
+    context: ExecutorContext;
+    environment: NodeJS.ProcessEnv;
+    now: Date;
+    plan: InfrastructurePlanV1;
+}): InfrastructureAuthorizationEvidenceV1;
+/** @internal */
+export declare function requiresGovernanceValidation(input: {
+    action: InfrastructureMutationAction;
+    adoptedImportCount: number;
+    hasApproval: boolean;
+}): boolean;
+/** @internal */
+export declare function isLocalPlanReviewPending(input: {
+    context: ExecutorContext;
+    environment: NodeJS.ProcessEnv;
+    plan: InfrastructurePlanV1;
+    validation: InfrastructureAuthorizationEvidenceV1['validation'];
+}): boolean;
+interface LocalMutationStateObservation {
+    actorArn: string;
+    exportedState: unknown;
+    identity: InfrastructureStateIdentityV1;
+    resourceCount: number;
+}
+/** @internal */
+export declare function observeLocalMutationStateIdentity(input: {
+    backendBootstrapDigest: string;
+    childEnvironment: NodeJS.ProcessEnv;
+    environment: NodeJS.ProcessEnv;
+    invocation: SstCommandInvocation;
+    now: Date;
+    project: string;
+    sourceCommit: string;
+    spawn: NonNullable<InfrastructurePlanExecutorDependencies['spawn']>;
+}): LocalMutationStateObservation;
+/** @internal */
+export declare function retainLocalRefreshStateBackup(input: {
+    context: ExecutorContext;
+    now: Date;
+    observation: LocalMutationStateObservation;
+    plan: InfrastructurePlanV1;
+    project: string;
+}): void;
+declare function consumeLocalMutationCapability(input: {
+    action: Extract<InfrastructureMutationAction, 'deploy' | 'refresh'>;
+    authorizationContents: string;
+    context: ExecutorContext;
+    dependencies: InfrastructurePlanExecutorDependencies;
+    environment: NodeJS.ProcessEnv;
+    invocation: SstCommandInvocation;
+    now: Date;
+    options: InfrastructurePlanExecutorOptions;
+    plan: InfrastructurePlanV1;
+    planContents: string;
+}): void;
 export declare function runInfrastructurePlanExecutor(options: InfrastructurePlanExecutorOptions, context: ExecutorContext, environment?: NodeJS.ProcessEnv, dependencies?: InfrastructurePlanExecutorDependencies): Promise<{
     success: boolean;
 }>;