@empire-builder-kit/nx 1.0.0-rc.30 → 1.0.0-rc.32

package/executors.json

@@ -38,17 +38,17 @@
     "infrastructure-plan": {
       "implementation": "./src/executors/infrastructure-plan/infrastructure-plan",
       "schema": "./src/executors/infrastructure-plan/schema.json",
-      "description": "Run a pinned SST resource diff and fail closed on unapproved, stale, locked, drifted, or unknown protected plans."
+      "description": "Stream one advisory native SST diff through the exact committed stage authority without retaining mutation authority."
     },
     "local-deploy": {
       "implementation": "./src/executors/local-deploy/local-deploy",
       "schema": "./src/executors/local-deploy/schema.json",
-      "description": "Plan and deploy one complete stage locally with exact temporary AWS role, source, account, Region, and production confirmation authority."
+      "description": "Deploy one complete active stage through ordered native SST children, exact temporary AWS authority, migrations, smoke checks, and a bounded receipt."
     },
     "router-waf-rehearsal": {
       "implementation": "./src/executors/router-waf-rehearsal/router-waf-rehearsal",
       "schema": "./src/executors/router-waf-rehearsal/schema.json",
-      "description": "Seal bounded staging Router WAF blocking evidence for the exact committed policy before production deployment."
+      "description": "Run the bounded Router WAF rate probe, correlate its exact BLOCK sample and metric, and seal the committed blocking evidence."
     },
     "work-markers": {
       "implementation": "./src/executors/work-markers/work-markers",
@@ -80,6 +80,11 @@
       "schema": "./src/executors/secret-metadata/schema.json",
       "description": "Report or explicitly apply value-blind operator-secret container metadata for one Product Slice."
     },
+    "secret-initialize": {
+      "implementation": "./src/executors/secret-initialize/secret-initialize",
+      "schema": "./src/executors/secret-initialize/schema.json",
+      "description": "Report or explicitly initialize one declared machine-generated secret without accepting or returning its value."
+    },
     "secret-guardrails": {
       "implementation": "./src/executors/secret-guardrails/secret-guardrails",
       "schema": "./src/executors/secret-guardrails/schema.json",

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@empire-builder-kit/nx",
-  "version": "1.0.0-rc.30",
+  "version": "1.0.0-rc.32",
   "description": "Nx generators, executors, and Blueprint contracts for Empire Builder Kit",
   "keywords": [
     "aws",
@@ -39,6 +39,10 @@
       "types": "./src/authorization/index.d.ts",
       "default": "./src/authorization/index.js"
     },
+    "./aws-authority": {
+      "types": "./src/aws-authority/index.d.ts",
+      "default": "./src/aws-authority/index.js"
+    },
     "./database-retirement": {
       "types": "./src/database-retirement/index.d.ts",
       "default": "./src/database-retirement/index.js"
@@ -59,10 +63,6 @@
       "types": "./src/git-policy/index.d.ts",
       "default": "./src/git-policy/index.js"
     },
-    "./infrastructure-change": {
-      "types": "./src/infrastructure-change/index.d.ts",
-      "default": "./src/infrastructure-change/index.js"
-    },
     "./local-dev": {
       "types": "./src/local-dev/index.d.ts",
       "default": "./src/local-dev/index.js"
@@ -103,6 +103,10 @@
       "types": "./src/workload-roles/index.d.ts",
       "default": "./src/workload-roles/index.js"
     },
+    "./workspace-deployment": {
+      "types": "./src/workspace-deployment/index.d.ts",
+      "default": "./src/workspace-deployment/index.js"
+    },
     "./schemas/blueprint-v1.json": "./src/schemas/blueprint-v1.json",
     "./schemas/aggregate-count-evidence-v1.json": "./src/schemas/aggregate-count-evidence-v1.json",
     "./schemas/blueprint-input-schema-v1.json": "./src/schemas/blueprint-input-schema-v1.json",
@@ -126,7 +130,9 @@
     "provenance": false
   },
   "dependencies": {
-    "@empire-builder-kit/runtime": "1.0.0-rc.30",
+    "@empire-builder-kit/runtime": "1.0.0-rc.32",
+    "@aws-sdk/client-cloudfront": "^3.700.0",
+    "@aws-sdk/client-cloudwatch": "^3.700.0",
     "@aws-sdk/client-cloudwatch-logs": "^3.700.0",
     "@aws-sdk/client-iam": "^3.700.0",
     "@nx/devkit": "23.1.0",
@@ -135,6 +141,7 @@
     "@aws-sdk/client-secrets-manager": "^3.700.0",
     "@aws-sdk/client-ssm": "^3.700.0",
     "@aws-sdk/client-sts": "^3.700.0",
+    "@aws-sdk/client-wafv2": "^3.700.0",
     "@aws-sdk/credential-providers": "^3.700.0",
     "ajv": "8.20.0",
     "prettier": "^3.8.2",
@@ -154,5 +161,5 @@
   "engines": {
     "node": ">=22.13.0"
   },
-  "gitHead": "8fa5d9e9867de1192111268210cc96c2ceb96119"
+  "gitHead": "550d37dc3eb44e8f34ea438033ffefb65a42dc77"
 }

package/src/aws/child-environment.d.ts

@@ -0,0 +1,10 @@
+export interface GovernedAwsChildEnvironmentOptions {
+    /** GitHub's configure-aws-credentials action replaces ambient AWS
+     * credentials with one exact temporary role session. That verified session
+     * is the only raw credential environment admitted to a protected child. */
+    preserveVerifiedGithubCredentials?: boolean;
+}
+/** Remove ambient authority inputs that could redirect AWS calls, replace
+ * trust roots, mint another OIDC credential, or select an unverified AWS
+ * principal. Normal non-secret GitHub provenance remains available. */
+export declare function sanitizeGovernedAwsChildEnvironment(ambient: NodeJS.ProcessEnv, options?: GovernedAwsChildEnvironmentOptions): NodeJS.ProcessEnv;

package/src/aws/child-environment.js

@@ -0,0 +1,77 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.sanitizeGovernedAwsChildEnvironment = sanitizeGovernedAwsChildEnvironment;
+const RAW_AWS_CREDENTIAL_VARIABLES = new Set([
+    'AWS_ACCESS_KEY_ID',
+    'AWS_CONTAINER_AUTHORIZATION_TOKEN',
+    'AWS_CONTAINER_AUTHORIZATION_TOKEN_FILE',
+    'AWS_CONTAINER_CREDENTIALS_FULL_URI',
+    'AWS_CONTAINER_CREDENTIALS_RELATIVE_URI',
+    'AWS_CREDENTIAL_EXPIRATION',
+    'AWS_ROLE_ARN',
+    'AWS_ROLE_SESSION_NAME',
+    'AWS_SECRET_ACCESS_KEY',
+    'AWS_SECURITY_TOKEN',
+    'AWS_SESSION_TOKEN',
+    'AWS_WEB_IDENTITY_TOKEN_FILE',
+]);
+const VERIFIED_GITHUB_CREDENTIAL_VARIABLES = new Set([
+    'AWS_ACCESS_KEY_ID',
+    'AWS_CREDENTIAL_EXPIRATION',
+    'AWS_SECRET_ACCESS_KEY',
+    'AWS_SESSION_TOKEN',
+]);
+const AUTHORITY_OVERRIDE_VARIABLES = new Set([
+    'ACTIONS_ID_TOKEN_REQUEST_TOKEN',
+    'ACTIONS_ID_TOKEN_REQUEST_URL',
+    'ACTIONS_RESULTS_URL',
+    'ACTIONS_RUNTIME_TOKEN',
+    'ACTIONS_RUNTIME_URL',
+    'ALL_PROXY',
+    'AWS_CA_BUNDLE',
+    'AWS_EC2_METADATA_SERVICE_ENDPOINT',
+    'AWS_EC2_METADATA_SERVICE_ENDPOINT_MODE',
+    'AWS_USE_DUALSTACK_ENDPOINT',
+    'AWS_USE_FIPS_ENDPOINT',
+    'CURL_CA_BUNDLE',
+    'GH_TOKEN',
+    'GITHUB_TOKEN',
+    'GIT_SSL_CAINFO',
+    'GIT_SSL_NO_VERIFY',
+    'GLOBAL_AGENT_HTTP_PROXY',
+    'GLOBAL_AGENT_HTTPS_PROXY',
+    'HTTPS_PROXY',
+    'HTTP_PROXY',
+    'NODE_EXTRA_CA_CERTS',
+    'NODE_TLS_REJECT_UNAUTHORIZED',
+    'NO_PROXY',
+    'NPM_CONFIG_CAFILE',
+    'NPM_CONFIG_HTTPS_PROXY',
+    'NPM_CONFIG_PROXY',
+    'REQUESTS_CA_BUNDLE',
+    'SSL_CERT_DIR',
+    'SSL_CERT_FILE',
+]);
+/** Remove ambient authority inputs that could redirect AWS calls, replace
+ * trust roots, mint another OIDC credential, or select an unverified AWS
+ * principal. Normal non-secret GitHub provenance remains available. */
+function sanitizeGovernedAwsChildEnvironment(ambient, options = {}) {
+    const environment = { ...ambient };
+    for (const name of Object.keys(environment)) {
+        const canonical = name.toUpperCase();
+        const endpointOverride = canonical === 'AWS_ENDPOINT_URL' ||
+            canonical.startsWith('AWS_ENDPOINT_URL_');
+        const authorityOverride = AUTHORITY_OVERRIDE_VARIABLES.has(canonical);
+        const rawCredential = RAW_AWS_CREDENTIAL_VARIABLES.has(canonical);
+        const exactGithubCredential = options.preserveVerifiedGithubCredentials === true &&
+            name === canonical &&
+            VERIFIED_GITHUB_CREDENTIAL_VARIABLES.has(canonical);
+        if (endpointOverride ||
+            authorityOverride ||
+            (rawCredential && !exactGithubCredential)) {
+            delete environment[name];
+        }
+    }
+    return environment;
+}
+//# sourceMappingURL=child-environment.js.map

package/src/aws/child-environment.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"child-environment.js","sourceRoot":"","sources":["../../../../../packages/nx/src/aws/child-environment.ts"],"names":[],"mappings":";;AAgEA,kFAyBC;AAzFD,MAAM,4BAA4B,GAAG,IAAI,GAAG,CAAC;IAC3C,mBAAmB;IACnB,mCAAmC;IACnC,wCAAwC;IACxC,oCAAoC;IACpC,wCAAwC;IACxC,2BAA2B;IAC3B,cAAc;IACd,uBAAuB;IACvB,uBAAuB;IACvB,oBAAoB;IACpB,mBAAmB;IACnB,6BAA6B;CAC9B,CAAC,CAAC;AAEH,MAAM,oCAAoC,GAAG,IAAI,GAAG,CAAC;IACnD,mBAAmB;IACnB,2BAA2B;IAC3B,uBAAuB;IACvB,mBAAmB;CACpB,CAAC,CAAC;AAEH,MAAM,4BAA4B,GAAG,IAAI,GAAG,CAAC;IAC3C,gCAAgC;IAChC,8BAA8B;IAC9B,qBAAqB;IACrB,uBAAuB;IACvB,qBAAqB;IACrB,WAAW;IACX,eAAe;IACf,mCAAmC;IACnC,wCAAwC;IACxC,4BAA4B;IAC5B,uBAAuB;IACvB,gBAAgB;IAChB,UAAU;IACV,cAAc;IACd,gBAAgB;IAChB,mBAAmB;IACnB,yBAAyB;IACzB,0BAA0B;IAC1B,aAAa;IACb,YAAY;IACZ,qBAAqB;IACrB,8BAA8B;IAC9B,UAAU;IACV,mBAAmB;IACnB,wBAAwB;IACxB,kBAAkB;IAClB,oBAAoB;IACpB,cAAc;IACd,eAAe;CAChB,CAAC,CAAC;AASH;;uEAEuE;AACvE,SAAgB,mCAAmC,CACjD,OAA0B,EAC1B,UAA8C,EAAE;IAEhD,MAAM,WAAW,GAAG,EAAE,GAAG,OAAO,EAAE,CAAC;IACnC,KAAK,MAAM,IAAI,IAAI,MAAM,CAAC,IAAI,CAAC,WAAW,CAAC,EAAE,CAAC;QAC5C,MAAM,SAAS,GAAG,IAAI,CAAC,WAAW,EAAE,CAAC;QACrC,MAAM,gBAAgB,GACpB,SAAS,KAAK,kBAAkB;YAChC,SAAS,CAAC,UAAU,CAAC,mBAAmB,CAAC,CAAC;QAC5C,MAAM,iBAAiB,GAAG,4BAA4B,CAAC,GAAG,CAAC,SAAS,CAAC,CAAC;QACtE,MAAM,aAAa,GAAG,4BAA4B,CAAC,GAAG,CAAC,SAAS,CAAC,CAAC;QAClE,MAAM,qBAAqB,GACzB,OAAO,CAAC,iCAAiC,KAAK,IAAI;YAClD,IAAI,KAAK,SAAS;YAClB,oCAAoC,CAAC,GAAG,CAAC,SAAS,CAAC,CAAC;QACtD,IACE,gBAAgB;YAChB,iBAAiB;YACjB,CAAC,aAAa,IAAI,CAAC,qBAAqB,CAAC,EACzC,CAAC;YACD,OAAO,WAAW,CAAC,IAAI,CAAC,CAAC;QAC3B,CAAC;IACH,CAAC;IACD,OAAO,WAAW,CAAC;AACrB,CAAC"}

package/src/aws/identity.d.ts

@@ -0,0 +1,13 @@
+export type CanonicalAwsRegionalService = 'rds' | 'secretsmanager' | 'ssm' | 'sts';
+/** Bind security-sensitive AWS SDK reads to the canonical regional service
+ * endpoint rather than an ambient or shared-config endpoint override. */
+export declare function canonicalAwsRegionalEndpoint(service: CanonicalAwsRegionalService, region: string): string;
+/** Bind identity verification to AWS's canonical regional STS service rather
+ * than an ambient or shared-config endpoint override. */
+export declare function canonicalStsEndpoint(region: string): string;
+/**
+ * AWS STS omits an IAM role path from an assumed-role ARN. Match the exact
+ * account, partition, and terminal role name while accepting that documented
+ * AWS representation difference.
+ */
+export declare function matchesExpectedAssumedRoleArn(expectedAccount: string, callerArn: string, expectedRoleArn: string): boolean;

package/src/aws/identity.js

@@ -0,0 +1,41 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.canonicalAwsRegionalEndpoint = canonicalAwsRegionalEndpoint;
+exports.canonicalStsEndpoint = canonicalStsEndpoint;
+exports.matchesExpectedAssumedRoleArn = matchesExpectedAssumedRoleArn;
+const IAM_ROLE_ARN = /^arn:([^:]+):iam::(\d{12}):role\/(.+)$/u;
+const STS_ASSUMED_ROLE_ARN = /^arn:([^:]+):sts::(\d{12}):assumed-role\/(.+)\/([^/]+)$/u;
+const AWS_REGION = /^[a-z]{2}(?:-gov)?-[a-z]+(?:-[a-z]+)*-\d$/u;
+/** Bind security-sensitive AWS SDK reads to the canonical regional service
+ * endpoint rather than an ambient or shared-config endpoint override. */
+function canonicalAwsRegionalEndpoint(service, region) {
+    if (!AWS_REGION.test(region)) {
+        throw new Error(`${service.toUpperCase()} verification requires an exact AWS Region.`);
+    }
+    return region.startsWith('cn-')
+        ? `https://${service}.${region}.amazonaws.com.cn`
+        : `https://${service}.${region}.amazonaws.com`;
+}
+/** Bind identity verification to AWS's canonical regional STS service rather
+ * than an ambient or shared-config endpoint override. */
+function canonicalStsEndpoint(region) {
+    return canonicalAwsRegionalEndpoint('sts', region);
+}
+/**
+ * AWS STS omits an IAM role path from an assumed-role ARN. Match the exact
+ * account, partition, and terminal role name while accepting that documented
+ * AWS representation difference.
+ */
+function matchesExpectedAssumedRoleArn(expectedAccount, callerArn, expectedRoleArn) {
+    const expected = IAM_ROLE_ARN.exec(expectedRoleArn);
+    const caller = STS_ASSUMED_ROLE_ARN.exec(callerArn);
+    if (!expected || !caller)
+        return false;
+    const expectedRoleName = expected[3]?.split('/').at(-1);
+    return (expected[1] === caller[1] &&
+        expected[2] === expectedAccount &&
+        caller[2] === expectedAccount &&
+        expectedRoleName !== undefined &&
+        expectedRoleName === caller[3]);
+}
+//# sourceMappingURL=identity.js.map

package/src/aws/identity.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"identity.js","sourceRoot":"","sources":["../../../../../packages/nx/src/aws/identity.ts"],"names":[],"mappings":";;AAUA,oEAYC;AAID,oDAEC;AAOD,sEAgBC;AAnDD,MAAM,YAAY,GAAG,yCAAyC,CAAC;AAC/D,MAAM,oBAAoB,GACxB,0DAA0D,CAAC;AAC7D,MAAM,UAAU,GAAG,4CAA4C,CAAC;AAKhE;yEACyE;AACzE,SAAgB,4BAA4B,CAC1C,OAAoC,EACpC,MAAc;IAEd,IAAI,CAAC,UAAU,CAAC,IAAI,CAAC,MAAM,CAAC,EAAE,CAAC;QAC7B,MAAM,IAAI,KAAK,CACb,GAAG,OAAO,CAAC,WAAW,EAAE,6CAA6C,CACtE,CAAC;IACJ,CAAC;IACD,OAAO,MAAM,CAAC,UAAU,CAAC,KAAK,CAAC;QAC7B,CAAC,CAAC,WAAW,OAAO,IAAI,MAAM,mBAAmB;QACjD,CAAC,CAAC,WAAW,OAAO,IAAI,MAAM,gBAAgB,CAAC;AACnD,CAAC;AAED;yDACyD;AACzD,SAAgB,oBAAoB,CAAC,MAAc;IACjD,OAAO,4BAA4B,CAAC,KAAK,EAAE,MAAM,CAAC,CAAC;AACrD,CAAC;AAED;;;;GAIG;AACH,SAAgB,6BAA6B,CAC3C,eAAuB,EACvB,SAAiB,EACjB,eAAuB;IAEvB,MAAM,QAAQ,GAAG,YAAY,CAAC,IAAI,CAAC,eAAe,CAAC,CAAC;IACpD,MAAM,MAAM,GAAG,oBAAoB,CAAC,IAAI,CAAC,SAAS,CAAC,CAAC;IACpD,IAAI,CAAC,QAAQ,IAAI,CAAC,MAAM;QAAE,OAAO,KAAK,CAAC;IACvC,MAAM,gBAAgB,GAAG,QAAQ,CAAC,CAAC,CAAC,EAAE,KAAK,CAAC,GAAG,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC;IACxD,OAAO,CACL,QAAQ,CAAC,CAAC,CAAC,KAAK,MAAM,CAAC,CAAC,CAAC;QACzB,QAAQ,CAAC,CAAC,CAAC,KAAK,eAAe;QAC/B,MAAM,CAAC,CAAC,CAAC,KAAK,eAAe;QAC7B,gBAAgB,KAAK,SAAS;QAC9B,gBAAgB,KAAK,MAAM,CAAC,CAAC,CAAC,CAC/B,CAAC;AACJ,CAAC"}

package/src/aws-authority/index.d.ts

@@ -0,0 +1 @@
+export * from './stage-authority.js';

package/src/aws-authority/index.js

@@ -0,0 +1,5 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+const tslib_1 = require("tslib");
+tslib_1.__exportStar(require("./stage-authority.js"), exports);
+//# sourceMappingURL=index.js.map

package/src/aws-authority/index.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../../../../../packages/nx/src/aws-authority/index.ts"],"names":[],"mappings":";;;AAAA,+DAAqC"}

package/src/aws-authority/stage-authority.d.ts

@@ -0,0 +1,240 @@
+export declare const STAGE_AUTHORITY_SCHEMA_VERSION: 1;
+export declare const STAGE_AUTHORITY_STAGES: readonly ["development", "staging", "production"];
+export declare const STAGE_AUTHORITY_PARTITIONS: readonly ["aws", "aws-cn", "aws-us-gov"];
+export declare const STAGE_AUTHORITY_DEPLOYMENT_POLICY_KINDS: readonly ["read", "regional-mutation", "global-iam-mutation", "global-resource-mutation", "generated-resource-mutation", "stage-containment", "permission-guardrails", "guardrails"];
+export declare const STAGE_AUTHORITY_MANAGED_POLICY_CHARACTER_LIMIT = 6144;
+export declare const STAGE_AUTHORITY_MANAGED_POLICY_CHARACTER_HEADROOM = 200;
+export declare const STAGE_AUTHORITY_TEMPLATE_BODY_BYTE_LIMIT = 51200;
+export declare const STAGE_AUTHORITY_BOUND_TEMPLATE_BODY_MINIMUM_HEADROOM = 1024;
+export type StageAuthorityStage = (typeof STAGE_AUTHORITY_STAGES)[number];
+export type StageAuthorityPartition = (typeof STAGE_AUTHORITY_PARTITIONS)[number];
+export type StageAuthorityDeploymentPolicyKind = (typeof STAGE_AUTHORITY_DEPLOYMENT_POLICY_KINDS)[number];
+type ConditionValue = string | readonly string[];
+type ConditionEntries = Readonly<Record<string, ConditionValue>>;
+export interface StageAuthorityPolicyStatement {
+    Action: readonly string[];
+    Condition?: Readonly<Record<string, ConditionEntries>>;
+    Effect: 'Allow' | 'Deny';
+    NotResource?: readonly string[];
+    Resource?: readonly string[];
+    Sid: string;
+}
+export interface StageAuthorityPolicyDocument {
+    Statement: readonly StageAuthorityPolicyStatement[];
+    Version: '2012-10-17';
+}
+export interface StageAuthorityGithubTrust {
+    oidcProviderArn: string;
+    subject: string;
+}
+export interface StageAuthorityInput {
+    accountId: string;
+    awsPrincipalArns?: readonly string[];
+    github?: StageAuthorityGithubTrust;
+    partition?: StageAuthorityPartition;
+    region: string;
+    stage: StageAuthorityStage;
+}
+export interface StageAuthorityIdentity {
+    boundaryArn: string;
+    boundaryName: string;
+    boundaryPath: string;
+    deploymentPolicyArns: readonly string[];
+    deploymentPolicyNames: readonly string[];
+    deploymentRoleArn: string;
+    deploymentRoleName: string;
+    deploymentRolePath: string;
+    stackName: string;
+    workloadInstanceProfileArnPattern: string;
+    workloadInstanceProfilePath: string;
+    workloadRoleArnPattern: string;
+    workloadRolePath: string;
+}
+export interface StageAuthorityDeploymentPolicy {
+    arn: string;
+    document: StageAuthorityPolicyDocument;
+    kind: StageAuthorityDeploymentPolicyKind;
+    logicalId: string;
+    name: string;
+}
+export interface StageAuthorityLimitations {
+    protectedDatabaseConfiguration: 'iam-cannot-inspect-rds-modify-request-fields-lifecycle-preflight-required';
+    resourcePolicyAttributes: 'sns-and-sqs-set-attributes-can-write-resource-policies-name-account-region-containment-applies';
+    sameAccountStageDeploymentIsolation: 'deployment-role-is-account-scoped-use-production-isolated-for-hard-production-boundary';
+    wafLoggingResourcePolicy: 'cloudwatch-logs-put-resource-policy-has-no-resource-or-action-condition-keys-reviewed-generated-source-is-control';
+    workloadTrust: 'iam-cannot-inspect-create-role-trust-reviewed-generated-source-is-control';
+}
+export interface StageAuthorityPlan {
+    deploymentPolicies: readonly StageAuthorityDeploymentPolicy[];
+    digest: string;
+    identity: StageAuthorityIdentity;
+    limitations: StageAuthorityLimitations;
+    runtimeBoundaryPolicy: StageAuthorityPolicyDocument;
+    schemaVersion: typeof STAGE_AUTHORITY_SCHEMA_VERSION;
+    template: Readonly<Record<string, unknown>>;
+}
+export interface StageIamBoundaryTransformContract {
+    boundaryArn: string;
+    instanceProfilePath: string;
+    rolePath: string;
+}
+export interface StageIamBoundaryTransformArgs {
+    path?: unknown;
+    permissionsBoundary?: unknown;
+    [key: string]: unknown;
+}
+export interface StageIamBoundaryTransformInput {
+    accountId: string;
+    instanceProfileResource: unknown;
+    partition?: StageAuthorityPartition;
+    registerTransform: (resource: unknown, transform: (args: StageIamBoundaryTransformArgs) => void) => void;
+    roleResource: unknown;
+    stage: StageAuthorityStage;
+}
+/** Native lifecycle required by the generated machine-authorization nested
+ * stack. Recovery-only and stack-policy mutation APIs remain ungranted. */
+export declare const STAGE_AUTHORITY_CLOUDFORMATION_LIFECYCLE_ACTIONS: readonly string[];
+/** EventBridge archives expose no request-tag or resource-tag IAM condition
+ * keys. Their lifecycle is contained by the exact canonical archive ARN and
+ * requested Region instead. */
+export declare const STAGE_AUTHORITY_EVENT_ARCHIVE_CREATE_ACTIONS: readonly string[];
+export declare const STAGE_AUTHORITY_EVENT_ARCHIVE_RESOURCE_ACTIONS: readonly string[];
+export declare const STAGE_AUTHORITY_LAMBDA_DEPLOYMENT_INVOKE_ACTIONS: readonly string[];
+export declare const STAGE_AUTHORITY_CLOUDFRONT_INVALIDATION_ACTIONS: readonly string[];
+export declare const STAGE_AUTHORITY_WAF_LOGGING_ACTIONS: readonly string[];
+/** SST's CloudFront-scope WAF logging component owns exactly one generated log
+ * group in the edge control Region. These resource-capable actions stay bound
+ * to that generated ARN below. */
+export declare const STAGE_AUTHORITY_EDGE_WAF_LOG_GROUP_ACTIONS: readonly string[];
+/** CloudWatch Logs exposes these WAF delivery mutations only at account scope.
+ * In particular, PutResourcePolicy supports neither resource ARNs nor
+ * action-specific condition keys. Requested Region and reviewed generated
+ * source are therefore the strongest honest controls for that one exception. */
+export declare const STAGE_AUTHORITY_EDGE_WAF_LOG_DELIVERY_MUTATION_ACTIONS: readonly string[];
+export declare const STAGE_AUTHORITY_BUDGET_MUTATION_ACTIONS: readonly string[];
+export declare const STAGE_AUTHORITY_RDS_EVENT_SUBSCRIPTION_SOURCE_ACTIONS: readonly string[];
+export declare const STAGE_AUTHORITY_KMS_ROTATION_ACTIONS: readonly string[];
+/** Cost Explorer creation is account-global, while existing anomaly controls
+ * support account-bound ARNs. These exact verbs are admitted only to the
+ * production stage role below. */
+export declare const STAGE_AUTHORITY_COST_ANOMALY_READ_ACTIONS: readonly string[];
+export declare const STAGE_AUTHORITY_COST_ANOMALY_CREATE_ACTIONS: readonly string[];
+export declare const STAGE_AUTHORITY_COST_ANOMALY_RESOURCE_WRITE_ACTIONS: readonly string[];
+export declare const STAGE_AUTHORITY_COST_ANOMALY_WRITE_ACTIONS: readonly string[];
+export declare const STAGE_AUTHORITY_REGIONAL_READ_ACTIONS: readonly string[];
+export declare const STAGE_AUTHORITY_GLOBAL_READ_ACTIONS: readonly string[];
+/** CloudFront-scope WAF publishes its observability signals through the edge
+ * control Region. Keep this read surface exact instead of broadening every
+ * regional read when the application Region differs from us-east-1. */
+export declare const STAGE_AUTHORITY_EDGE_OBSERVABILITY_READ_ACTIONS: readonly string[];
+/** A deployment role is a temporary infrastructure administrator, not a
+ * runtime workload identity. Routine regional services therefore use one
+ * stable service-family contract instead of a provider-call inventory. The
+ * families whose policy, protection, launch, or trust semantics need tighter
+ * treatment remain on the bounded action sets below. */
+export declare const STAGE_AUTHORITY_BROAD_REGIONAL_SERVICE_ACTIONS: readonly string[];
+export declare const STAGE_AUTHORITY_BACKUP_INFRASTRUCTURE_ACTIONS: readonly string[];
+export declare const STAGE_AUTHORITY_EC2_INFRASTRUCTURE_ACTIONS: readonly string[];
+export declare const STAGE_AUTHORITY_KMS_INFRASTRUCTURE_ACTIONS: readonly string[];
+/** AddPermission, RemovePermission, and InvokeFunction remain in exact
+ * statements so the family allow cannot bypass Lambda resource-policy and
+ * deployment-smoke constraints. */
+export declare const STAGE_AUTHORITY_LAMBDA_INFRASTRUCTURE_ACTIONS: readonly string[];
+export declare const STAGE_AUTHORITY_REGIONAL_WRITE_ACTIONS: readonly string[];
+export declare const STAGE_AUTHORITY_UNSCOPED_CLOUDFRONT_CREATE_ACTIONS: readonly string[];
+export declare const STAGE_AUTHORITY_S3_REGIONAL_MUTATION_ACTIONS: readonly string[];
+export declare const STAGE_AUTHORITY_WAF_EDGE_MUTATION_ACTIONS: readonly string[];
+/** These APIs establish unsupported replicas, global resources, alternate
+ * database topologies, integrations, or cross-Region copies. The generated
+ * architecture does not use them. */
+export declare const STAGE_AUTHORITY_UNSUPPORTED_REPLICATION_AND_TOPOLOGY_ACTIONS: readonly string[];
+export declare const STAGE_AUTHORITY_GLOBAL_WRITE_ACTIONS: readonly string[];
+export declare const STAGE_AUTHORITY_ACCOUNT_SCOPED_GLOBAL_WRITE_ACTIONS: readonly string[];
+export declare const STAGE_RUNTIME_REGIONAL_ACTIONS: readonly string[];
+export declare const STAGE_RUNTIME_GLOBAL_ACTIONS: readonly string[];
+export declare const STAGE_AUTHORITY_REGIONAL_MUTATION_FAMILIES: readonly string[];
+/** Logs application resources live in the deployment Region, while native WAF
+ * delivery resources live in the CloudFront edge control Region. The allow
+ * statements remain separate; this family exists only to deny mutations in a
+ * third Region. */
+export declare const STAGE_AUTHORITY_LOGS_MUTATION_FAMILIES: readonly string[];
+export declare const STAGE_RUNTIME_REGIONAL_SERVICE_FAMILIES: readonly string[];
+export declare const STAGE_AUTHORITY_APPROVED_AWS_MANAGED_POLICIES: readonly string[];
+export declare const STAGE_AUTHORITY_WORKLOAD_IDENTITY_POLICY_ACTIONS: readonly string[];
+/** Compact service-family scope guards keep mutation outside the selected AWS
+ * account/Region closed. They intentionally do not claim same-account stage
+ * isolation, because native SST owns account-shared bootstrap resources. */
+export declare const STAGE_AUTHORITY_SCOPE_GUARD_MUTATION_FAMILIES: readonly string[];
+/** SST 4.17.1 resolves the generated nonproduction VPC's EC2 NAT image from
+ * this commercial-partition fck-nat publisher. The generated development
+ * bastion reuses that NAT instance, while production uses managed NAT. No
+ * publisher is admitted in partitions where the pinned source is unproven. */
+export declare const STAGE_AUTHORITY_SST_417_EXTERNAL_AMI_OWNERS_BY_PARTITION: Readonly<{
+    aws: readonly string[];
+    'aws-cn': readonly any[];
+    'aws-us-gov': readonly any[];
+}>;
+/** Preserve the generic cross-account guard for ordinary EC2 mutations while
+ * routing RunInstances through its resource-aware statements below. A service
+ * family wildcard would otherwise reject SST's deliberately external AMI. */
+export declare const STAGE_AUTHORITY_CROSS_ACCOUNT_EC2_MUTATION_ACTIONS: readonly string[];
+export declare const STAGE_AUTHORITY_CROSS_ACCOUNT_MUTATION_ACTIONS: readonly string[];
+/** A deliberately narrow destructive set for same-account stage defense in
+ * depth. It protects named/tagged production resources without pretending the
+ * deployment roles form a complete IAM boundary. */
+export declare const STAGE_AUTHORITY_CROSS_STAGE_DESTRUCTIVE_ACTIONS: readonly string[];
+/** Existing-resource mutations must either retain the exact stage tag or use a
+ * generated stage/SST shared resource identity. Initial create/tag calls are
+ * governed by their request-tag or exact-resource statements instead. */
+export declare const STAGE_AUTHORITY_UNTAGGED_DESTRUCTIVE_ACTIONS: readonly string[];
+/** Operations whose target already exposes a stage tag may use the broader
+ * deployer contract. A known different-stage tag must still win as an explicit
+ * deny, including for provider calls that are not destructive by name. */
+export declare const STAGE_AUTHORITY_KNOWN_STAGE_MUTATION_ACTIONS: readonly string[];
+export declare const STAGE_AUTHORITY_S3_BUCKET_POLICY_MUTATION_ACTIONS: readonly string[];
+/** Permission-management actions that the generated lifecycle must call. Each
+ * exception is named exactly here and remains subject to the resource and
+ * condition containment statements below. */
+export declare const STAGE_AUTHORITY_REVIEWED_PERMISSION_MANAGEMENT_ACTIONS: readonly string[];
+/** Compact deny patterns covering permission-management actions admitted by
+ * wildcard lifecycle grants but not named as reviewed exceptions. The focused
+ * oracle derives every wildcard service family from the policy and proves each
+ * currently admitted permission-management action is reviewed or denied, and
+ * that no compact pattern also captures a retained read-only action. */
+export declare const STAGE_AUTHORITY_UNREVIEWED_PERMISSION_MANAGEMENT_ACTION_PATTERNS: readonly string[];
+/** Stable exclusions from the temporary infrastructure-administrator role.
+ * These are account administration, direct application data/user mutation,
+ * message handling, or export paths rather than native stack reconciliation.
+ * The generated deployed smoke retains only its four exact Cognito admin calls. */
+export declare const STAGE_AUTHORITY_NON_DEPLOYMENT_ACCOUNT_AND_DATA_ACTIONS: readonly string[];
+export declare const STAGE_AUTHORITY_UNSUPPORTED_WORKFLOW_EXECUTION_ACTIONS: readonly string[];
+export declare const STAGE_AUTHORITY_SERVICE_LINKED_ROLES: readonly (Readonly<{
+    path: "ecs.amazonaws.com/AWSServiceRoleForECS";
+    serviceName: "ecs.amazonaws.com";
+}> | Readonly<{
+    path: "ecs.application-autoscaling.amazonaws.com/AWSServiceRoleForApplicationAutoScaling_ECSService";
+    serviceName: "ecs.application-autoscaling.amazonaws.com";
+}> | Readonly<{
+    path: "rds.amazonaws.com/AWSServiceRoleForRDS";
+    serviceName: "rds.amazonaws.com";
+}> | Readonly<{
+    path: "rds.application-autoscaling.amazonaws.com/AWSServiceRoleForApplicationAutoScaling_RDSCluster";
+    serviceName: "rds.application-autoscaling.amazonaws.com";
+}> | Readonly<{
+    path: "wafv2.amazonaws.com/AWSServiceRoleForWAFV2Logging";
+    serviceName: "wafv2.amazonaws.com";
+}>)[];
+export declare function createStageAuthorityIdentity(input: Pick<StageAuthorityInput, 'accountId' | 'partition' | 'region' | 'stage'>): StageAuthorityIdentity;
+export declare function canonicalStageAuthorityTemplate(template: Readonly<Record<string, unknown>>): string;
+export declare function digestStageAuthorityTemplate(template: Readonly<Record<string, unknown>>): string;
+export declare function assertBoundStageAuthorityTemplateFitsBodyLimit(template: Readonly<Record<string, unknown>>): number;
+export declare function createStageAuthorityPlan(input: StageAuthorityInput): StageAuthorityPlan;
+export declare function createStageIamBoundaryTransformContract(input: Pick<StageAuthorityInput, 'accountId' | 'partition' | 'stage'>): StageIamBoundaryTransformContract;
+/**
+ * Installs ordinary Pulumi resource transforms before generated SST components
+ * are constructed. SST remains responsible for creating its roles and NAT
+ * instance profiles; this helper contributes only the stable stage path and
+ * permissions boundary.
+ */
+export declare function installStageIamBoundaryTransforms(input: StageIamBoundaryTransformInput): StageIamBoundaryTransformContract;
+export {};