@empire-builder-kit/nx 1.0.0-rc.30 → 1.0.0-rc.32

package/src/executors/foundation-remove-preflight/foundation-remove-preflight.js

@@ -2,6 +2,8 @@
 Object.defineProperty(exports, "__esModule", { value: true });
 exports.evaluateFoundationRemoval = evaluateFoundationRemoval;
 exports.productSliceRegistrationName = productSliceRegistrationName;
+exports.inspectProductSliceRegistrations = inspectProductSliceRegistrations;
+exports.runFoundationRemovePreflight = runFoundationRemovePreflight;
 const client_ssm_1 = require("@aws-sdk/client-ssm");
 const credential_providers_1 = require("@aws-sdk/credential-providers");
 const devkit_1 = require("@nx/devkit");
@@ -28,42 +30,63 @@ function productSliceRegistrationName(foundationStage, parameterName) {
         ? relativeName
         : `[unrecognized registration] ${parameterName}`;
 }
-const executor = async (options) => {
+async function inspectProductSliceRegistrations(foundationStage, fetchPage) {
+    const registrations = [];
+    const prefix = `${(0, discovery_js_1.productSliceRegistrationRoot)(foundationStage)}/`;
+    let nextToken;
+    do {
+        const response = await fetchPage({
+            ...(nextToken ? { NextToken: nextToken } : {}),
+            ParameterFilters: [
+                {
+                    Key: 'Name',
+                    Option: 'BeginsWith',
+                    Values: [prefix],
+                },
+            ],
+        });
+        registrations.push(...(response.Parameters ?? []).map(({ Name }) => productSliceRegistrationName(foundationStage, Name)));
+        nextToken = response.NextToken;
+    } while (nextToken);
+    return registrations.sort();
+}
+async function runFoundationRemovePreflight(options, dependencies = {}) {
     const region = options.region?.trim() ||
         process.env.AWS_REGION?.trim() ||
         process.env.AWS_DEFAULT_REGION?.trim();
-    const client = new client_ssm_1.SSMClient({
-        ...(options.profile
-            ? { credentials: (0, credential_providers_1.fromIni)({ profile: options.profile }) }
-            : {}),
-        ...(region ? { region } : {}),
-    });
-    const registrations = [];
-    let nextToken;
+    const client = dependencies.sendCommand
+        ? undefined
+        : new client_ssm_1.SSMClient({
+            ...(options.profile
+                ? { credentials: (0, credential_providers_1.fromIni)({ profile: options.profile }) }
+                : {}),
+            ...(region ? { region } : {}),
+        });
+    const sendCommand = dependencies.sendCommand ??
+        (async (command) => {
+            if (!client) {
+                throw new Error('SSM client is unavailable.');
+            }
+            return client.send(command);
+        });
+    let registrations;
     try {
-        do {
-            const response = await client.send(new client_ssm_1.GetParametersByPathCommand({
-                NextToken: nextToken,
-                Path: (0, discovery_js_1.productSliceRegistrationRoot)(options.stage),
-                Recursive: true,
-            }));
-            registrations.push(...(response.Parameters ?? []).map(({ Name }) => productSliceRegistrationName(options.stage, Name)));
-            nextToken = response.NextToken;
-        } while (nextToken);
+        registrations = await inspectProductSliceRegistrations(options.stage, (input) => sendCommand(new client_ssm_1.DescribeParametersCommand(input)));
     }
     catch (error) {
         devkit_1.logger.error(`[foundation-remove-preflight] foundationStage=${options.stage}: unable to inspect Product Slice registrations. ${error instanceof Error ? error.message : String(error)}`);
         return { success: false };
     }
     finally {
-        client.destroy();
+        client?.destroy();
     }
-    const result = evaluateFoundationRemoval(options.stage, registrations.sort());
+    const result = evaluateFoundationRemoval(options.stage, registrations);
     if (result.success)
         devkit_1.logger.info(result.message);
     else
         devkit_1.logger.error(result.message);
     return { success: result.success };
-};
+}
+const executor = (options) => runFoundationRemovePreflight(options);
 exports.default = executor;
 //# sourceMappingURL=foundation-remove-preflight.js.map

package/src/executors/foundation-remove-preflight/foundation-remove-preflight.js.map

@@ -1 +1 @@
-{"version":3,"file":"foundation-remove-preflight.js","sourceRoot":"","sources":["../../../../../../packages/nx/src/executors/foundation-remove-preflight/foundation-remove-preflight.ts"],"names":[],"mappings":";;AAWA,8DAcC;AAED,oEAYC;AAvCD,oDAA4E;AAC5E,wEAAwD;AACxD,uCAA0D;AAC1D,gEAA6E;AAQ7E,SAAgB,yBAAyB,CACvC,eAAuB,EACvB,iBAAoC;IAEpC,IAAI,iBAAiB,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QACnC,OAAO;YACL,OAAO,EAAE,iDAAiD,eAAe,0CAA0C;YACnH,OAAO,EAAE,IAAI;SACd,CAAC;IACJ,CAAC;IACD,OAAO;QACL,OAAO,EAAE,iDAAiD,eAAe,0EAA0E,iBAAiB,CAAC,IAAI,CAAC,IAAI,CAAC,0GAA0G;QACzR,OAAO,EAAE,KAAK;KACf,CAAC;AACJ,CAAC;AAED,SAAgB,4BAA4B,CAC1C,eAAuB,EACvB,aAAiC;IAEjC,MAAM,MAAM,GAAG,GAAG,IAAA,2CAA4B,EAAC,eAAe,CAAC,GAAG,CAAC;IACnE,IAAI,CAAC,aAAa,EAAE,UAAU,CAAC,MAAM,CAAC,EAAE,CAAC;QACvC,OAAO,+BAA+B,aAAa,IAAI,0BAA0B,EAAE,CAAC;IACtF,CAAC;IACD,MAAM,YAAY,GAAG,aAAa,CAAC,KAAK,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC;IACxD,OAAO,0CAA0C,CAAC,IAAI,CAAC,YAAY,CAAC;QAClE,CAAC,CAAC,YAAY;QACd,CAAC,CAAC,+BAA+B,aAAa,EAAE,CAAC;AACrD,CAAC;AAED,MAAM,QAAQ,GAAsD,KAAK,EACvE,OAAO,EACP,EAAE;IACF,MAAM,MAAM,GACV,OAAO,CAAC,MAAM,EAAE,IAAI,EAAE;QACtB,OAAO,CAAC,GAAG,CAAC,UAAU,EAAE,IAAI,EAAE;QAC9B,OAAO,CAAC,GAAG,CAAC,kBAAkB,EAAE,IAAI,EAAE,CAAC;IACzC,MAAM,MAAM,GAAG,IAAI,sBAAS,CAAC;QAC3B,GAAG,CAAC,OAAO,CAAC,OAAO;YACjB,CAAC,CAAC,EAAE,WAAW,EAAE,IAAA,8BAAO,EAAC,EAAE,OAAO,EAAE,OAAO,CAAC,OAAO,EAAE,CAAC,EAAE;YACxD,CAAC,CAAC,EAAE,CAAC;QACP,GAAG,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,MAAM,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;KAC9B,CAAC,CAAC;IACH,MAAM,aAAa,GAAa,EAAE,CAAC;IACnC,IAAI,SAA6B,CAAC;IAClC,IAAI,CAAC;QACH,GAAG,CAAC;YACF,MAAM,QAAQ,GAAG,MAAM,MAAM,CAAC,IAAI,CAChC,IAAI,uCAA0B,CAAC;gBAC7B,SAAS,EAAE,SAAS;gBACpB,IAAI,EAAE,IAAA,2CAA4B,EAAC,OAAO,CAAC,KAAK,CAAC;gBACjD,SAAS,EAAE,IAAI;aAChB,CAAC,CACH,CAAC;YACF,aAAa,CAAC,IAAI,CAChB,GAAG,CAAC,QAAQ,CAAC,UAAU,IAAI,EAAE,CAAC,CAAC,GAAG,CAAC,CAAC,EAAE,IAAI,EAAE,EAAE,EAAE,CAC9C,4BAA4B,CAAC,OAAO,CAAC,KAAK,EAAE,IAAI,CAAC,CAClD,CACF,CAAC;YACF,SAAS,GAAG,QAAQ,CAAC,SAAS,CAAC;QACjC,CAAC,QAAQ,SAAS,EAAE;IACtB,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,eAAM,CAAC,KAAK,CACV,iDAAiD,OAAO,CAAC,KAAK,oDAAoD,KAAK,YAAY,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,EAAE,CAC3K,CAAC;QACF,OAAO,EAAE,OAAO,EAAE,KAAK,EAAE,CAAC;IAC5B,CAAC;YAAS,CAAC;QACT,MAAM,CAAC,OAAO,EAAE,CAAC;IACnB,CAAC;IAED,MAAM,MAAM,GAAG,yBAAyB,CAAC,OAAO,CAAC,KAAK,EAAE,aAAa,CAAC,IAAI,EAAE,CAAC,CAAC;IAC9E,IAAI,MAAM,CAAC,OAAO;QAAE,eAAM,CAAC,IAAI,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC;;QAC3C,eAAM,CAAC,KAAK,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC;IAClC,OAAO,EAAE,OAAO,EAAE,MAAM,CAAC,OAAO,EAAE,CAAC;AACrC,CAAC,CAAC;AAEF,kBAAe,QAAQ,CAAC"}
+{"version":3,"file":"foundation-remove-preflight.js","sourceRoot":"","sources":["../../../../../../packages/nx/src/executors/foundation-remove-preflight/foundation-remove-preflight.ts"],"names":[],"mappings":";;AAiBA,8DAcC;AAED,oEAYC;AAaD,4EA4BC;AAED,oEA2CC;AAnID,oDAK6B;AAC7B,wEAAwD;AACxD,uCAA0D;AAC1D,gEAA6E;AAS7E,SAAgB,yBAAyB,CACvC,eAAuB,EACvB,iBAAoC;IAEpC,IAAI,iBAAiB,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QACnC,OAAO;YACL,OAAO,EAAE,iDAAiD,eAAe,0CAA0C;YACnH,OAAO,EAAE,IAAI;SACd,CAAC;IACJ,CAAC;IACD,OAAO;QACL,OAAO,EAAE,iDAAiD,eAAe,0EAA0E,iBAAiB,CAAC,IAAI,CAAC,IAAI,CAAC,0GAA0G;QACzR,OAAO,EAAE,KAAK;KACf,CAAC;AACJ,CAAC;AAED,SAAgB,4BAA4B,CAC1C,eAAuB,EACvB,aAAiC;IAEjC,MAAM,MAAM,GAAG,GAAG,IAAA,2CAA4B,EAAC,eAAe,CAAC,GAAG,CAAC;IACnE,IAAI,CAAC,aAAa,EAAE,UAAU,CAAC,MAAM,CAAC,EAAE,CAAC;QACvC,OAAO,+BAA+B,aAAa,IAAI,0BAA0B,EAAE,CAAC;IACtF,CAAC;IACD,MAAM,YAAY,GAAG,aAAa,CAAC,KAAK,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC;IACxD,OAAO,0CAA0C,CAAC,IAAI,CAAC,YAAY,CAAC;QAClE,CAAC,CAAC,YAAY;QACd,CAAC,CAAC,+BAA+B,aAAa,EAAE,CAAC;AACrD,CAAC;AAaM,KAAK,UAAU,gCAAgC,CACpD,eAAuB,EACvB,SAEoC;IAEpC,MAAM,aAAa,GAAa,EAAE,CAAC;IACnC,MAAM,MAAM,GAAG,GAAG,IAAA,2CAA4B,EAAC,eAAe,CAAC,GAAG,CAAC;IACnE,IAAI,SAA6B,CAAC;IAClC,GAAG,CAAC;QACF,MAAM,QAAQ,GAAG,MAAM,SAAS,CAAC;YAC/B,GAAG,CAAC,SAAS,CAAC,CAAC,CAAC,EAAE,SAAS,EAAE,SAAS,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;YAC9C,gBAAgB,EAAE;gBAChB;oBACE,GAAG,EAAE,MAAM;oBACX,MAAM,EAAE,YAAY;oBACpB,MAAM,EAAE,CAAC,MAAM,CAAC;iBACjB;aACF;SACF,CAAC,CAAC;QACH,aAAa,CAAC,IAAI,CAChB,GAAG,CAAC,QAAQ,CAAC,UAAU,IAAI,EAAE,CAAC,CAAC,GAAG,CAAC,CAAC,EAAE,IAAI,EAAE,EAAE,EAAE,CAC9C,4BAA4B,CAAC,eAAe,EAAE,IAAI,CAAC,CACpD,CACF,CAAC;QACF,SAAS,GAAG,QAAQ,CAAC,SAAS,CAAC;IACjC,CAAC,QAAQ,SAAS,EAAE;IACpB,OAAO,aAAa,CAAC,IAAI,EAAE,CAAC;AAC9B,CAAC;AAEM,KAAK,UAAU,4BAA4B,CAChD,OAAyC,EACzC,eAAsD,EAAE;IAExD,MAAM,MAAM,GACV,OAAO,CAAC,MAAM,EAAE,IAAI,EAAE;QACtB,OAAO,CAAC,GAAG,CAAC,UAAU,EAAE,IAAI,EAAE;QAC9B,OAAO,CAAC,GAAG,CAAC,kBAAkB,EAAE,IAAI,EAAE,CAAC;IACzC,MAAM,MAAM,GAAG,YAAY,CAAC,WAAW;QACrC,CAAC,CAAC,SAAS;QACX,CAAC,CAAC,IAAI,sBAAS,CAAC;YACZ,GAAG,CAAC,OAAO,CAAC,OAAO;gBACjB,CAAC,CAAC,EAAE,WAAW,EAAE,IAAA,8BAAO,EAAC,EAAE,OAAO,EAAE,OAAO,CAAC,OAAO,EAAE,CAAC,EAAE;gBACxD,CAAC,CAAC,EAAE,CAAC;YACP,GAAG,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,MAAM,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;SAC9B,CAAC,CAAC;IACP,MAAM,WAAW,GACf,YAAY,CAAC,WAAW;QACxB,CAAC,KAAK,EAAE,OAAkC,EAAE,EAAE;YAC5C,IAAI,CAAC,MAAM,EAAE,CAAC;gBACZ,MAAM,IAAI,KAAK,CAAC,4BAA4B,CAAC,CAAC;YAChD,CAAC;YACD,OAAO,MAAM,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC;QAC9B,CAAC,CAAC,CAAC;IACL,IAAI,aAAuB,CAAC;IAC5B,IAAI,CAAC;QACH,aAAa,GAAG,MAAM,gCAAgC,CACpD,OAAO,CAAC,KAAK,EACb,CAAC,KAAK,EAAE,EAAE,CAAC,WAAW,CAAC,IAAI,sCAAyB,CAAC,KAAK,CAAC,CAAC,CAC7D,CAAC;IACJ,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,eAAM,CAAC,KAAK,CACV,iDAAiD,OAAO,CAAC,KAAK,oDAAoD,KAAK,YAAY,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,EAAE,CAC3K,CAAC;QACF,OAAO,EAAE,OAAO,EAAE,KAAK,EAAE,CAAC;IAC5B,CAAC;YAAS,CAAC;QACT,MAAM,EAAE,OAAO,EAAE,CAAC;IACpB,CAAC;IAED,MAAM,MAAM,GAAG,yBAAyB,CAAC,OAAO,CAAC,KAAK,EAAE,aAAa,CAAC,CAAC;IACvE,IAAI,MAAM,CAAC,OAAO;QAAE,eAAM,CAAC,IAAI,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC;;QAC3C,eAAM,CAAC,KAAK,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC;IAClC,OAAO,EAAE,OAAO,EAAE,MAAM,CAAC,OAAO,EAAE,CAAC;AACrC,CAAC;AAED,MAAM,QAAQ,GAAsD,CAAC,OAAO,EAAE,EAAE,CAC9E,4BAA4B,CAAC,OAAO,CAAC,CAAC;AAExC,kBAAe,QAAQ,CAAC"}

package/src/executors/foundation-remove-preflight/schema.json

@@ -11,7 +11,12 @@
       "default": "development"
     },
     "region": { "type": "string" },
-    "profile": { "type": "string" }
+    "profile": { "type": "string" },
+    "expectedRoleArn": {
+      "type": "string",
+      "pattern": "^arn:(aws|aws-us-gov|aws-cn):iam::[0-9]{12}:role/[A-Za-z0-9+=,.@_/-]{1,512}$",
+      "description": "Exact stage deployment role forwarded to the governed remove executor. The preflight accepts but does not consume this authority input."
+    }
   },
   "required": ["stage"]
 }

package/src/executors/github-bootstrap/github-bootstrap.d.ts

@@ -1,6 +1,7 @@
 import { type PromiseExecutor } from '@nx/devkit';
 interface GitHubBootstrapExecutorOptions {
     apply?: boolean;
+    immutableOidcTrustAcknowledgement?: string;
     npmPrereleaseReviewerIds?: string;
     productionReviewerIds?: string;
     repository?: string;

package/src/executors/github-bootstrap/github-bootstrap.js

@@ -14,6 +14,7 @@ const executor = async (options, context) => {
         const report = await (0, index_js_1.runGitHubBootstrap)({
             apply: options.apply === true,
             deploymentProfile: policy.deploymentProfile,
+            immutableOidcTrustAcknowledgement: options.immutableOidcTrustAcknowledgement,
             npmPrereleaseReviewerIds: parseReviewerIds(options.npmPrereleaseReviewerIds),
             productionApprovalMode: policy.productionApproval.mode,
             productionReviewerIds: parseReviewerIds(options.productionReviewerIds),

package/src/executors/github-bootstrap/github-bootstrap.js.map

@@ -1 +1 @@
-{"version":3,"file":"github-bootstrap.js","sourceRoot":"","sources":["../../../../../../packages/nx/src/executors/github-bootstrap/github-bootstrap.ts"],"names":[],"mappings":";;AAAA,uCAA0D;AAC1D,wDAA+D;AAC/D,+DAAiF;AASjF,SAAS,gBAAgB,CAAC,KAAyB;IACjD,IAAI,CAAC,KAAK,EAAE,IAAI,EAAE;QAAE,OAAO,EAAE,CAAC;IAC9B,OAAO,KAAK,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,GAAG,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,MAAM,CAAC,IAAI,CAAC,IAAI,EAAE,CAAC,CAAC,CAAC;AAC7D,CAAC;AAED,MAAM,QAAQ,GAAoD,KAAK,EACrE,OAAO,EACP,OAAO,EACP,EAAE;IACF,IAAI,CAAC;QACH,MAAM,MAAM,GAAG,IAAA,wCAA6B,EAAC,OAAO,CAAC,IAAI,CAAC,CAAC;QAC3D,MAAM,MAAM,GAAG,MAAM,IAAA,6BAAkB,EAAC;YACtC,KAAK,EAAE,OAAO,CAAC,KAAK,KAAK,IAAI;YAC7B,iBAAiB,EAAE,MAAM,CAAC,iBAAiB;YAC3C,wBAAwB,EAAE,gBAAgB,CACxC,OAAO,CAAC,wBAAwB,CACjC;YACD,sBAAsB,EAAE,MAAM,CAAC,kBAAkB,CAAC,IAAI;YACtD,qBAAqB,EAAE,gBAAgB,CAAC,OAAO,CAAC,qBAAqB,CAAC;YACtE,UAAU,EACR,OAAO,CAAC,UAAU,EAAE,IAAI,EAAE,IAAI,OAAO,CAAC,GAAG,CAAC,OAAO,EAAE,IAAI,EAAE,IAAI,EAAE;YACjE,KAAK,EACH,OAAO,CAAC,GAAG,CAAC,QAAQ,EAAE,IAAI,EAAE,IAAI,OAAO,CAAC,GAAG,CAAC,YAAY,EAAE,IAAI,EAAE,IAAI,EAAE;SACzE,CAAC,CAAC;QACH,eAAM,CAAC,IAAI,CAAC,IAAI,CAAC,SAAS,CAAC,MAAM,EAAE,IAAI,EAAE,CAAC,CAAC,CAAC,CAAC;QAC7C,OAAO,EAAE,OAAO,EAAE,OAAO,CAAC,KAAK,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC;IAC1D,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,eAAM,CAAC,KAAK,CAAC,KAAK,YAAY,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,CAAC;QACrE,OAAO,EAAE,OAAO,EAAE,KAAK,EAAE,CAAC;IAC5B,CAAC;AACH,CAAC,CAAC;AAEF,kBAAe,QAAQ,CAAC"}
+{"version":3,"file":"github-bootstrap.js","sourceRoot":"","sources":["../../../../../../packages/nx/src/executors/github-bootstrap/github-bootstrap.ts"],"names":[],"mappings":";;AAAA,uCAA0D;AAC1D,wDAA+D;AAC/D,+DAAiF;AAUjF,SAAS,gBAAgB,CAAC,KAAyB;IACjD,IAAI,CAAC,KAAK,EAAE,IAAI,EAAE;QAAE,OAAO,EAAE,CAAC;IAC9B,OAAO,KAAK,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,GAAG,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,MAAM,CAAC,IAAI,CAAC,IAAI,EAAE,CAAC,CAAC,CAAC;AAC7D,CAAC;AAED,MAAM,QAAQ,GAAoD,KAAK,EACrE,OAAO,EACP,OAAO,EACP,EAAE;IACF,IAAI,CAAC;QACH,MAAM,MAAM,GAAG,IAAA,wCAA6B,EAAC,OAAO,CAAC,IAAI,CAAC,CAAC;QAC3D,MAAM,MAAM,GAAG,MAAM,IAAA,6BAAkB,EAAC;YACtC,KAAK,EAAE,OAAO,CAAC,KAAK,KAAK,IAAI;YAC7B,iBAAiB,EAAE,MAAM,CAAC,iBAAiB;YAC3C,iCAAiC,EAC/B,OAAO,CAAC,iCAAiC;YAC3C,wBAAwB,EAAE,gBAAgB,CACxC,OAAO,CAAC,wBAAwB,CACjC;YACD,sBAAsB,EAAE,MAAM,CAAC,kBAAkB,CAAC,IAAI;YACtD,qBAAqB,EAAE,gBAAgB,CAAC,OAAO,CAAC,qBAAqB,CAAC;YACtE,UAAU,EACR,OAAO,CAAC,UAAU,EAAE,IAAI,EAAE,IAAI,OAAO,CAAC,GAAG,CAAC,OAAO,EAAE,IAAI,EAAE,IAAI,EAAE;YACjE,KAAK,EACH,OAAO,CAAC,GAAG,CAAC,QAAQ,EAAE,IAAI,EAAE,IAAI,OAAO,CAAC,GAAG,CAAC,YAAY,EAAE,IAAI,EAAE,IAAI,EAAE;SACzE,CAAC,CAAC;QACH,eAAM,CAAC,IAAI,CAAC,IAAI,CAAC,SAAS,CAAC,MAAM,EAAE,IAAI,EAAE,CAAC,CAAC,CAAC,CAAC;QAC7C,OAAO,EAAE,OAAO,EAAE,OAAO,CAAC,KAAK,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC;IAC1D,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,eAAM,CAAC,KAAK,CAAC,KAAK,YAAY,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,CAAC;QACrE,OAAO,EAAE,OAAO,EAAE,KAAK,EAAE,CAAC;IAC5B,CAAC;AACH,CAAC,CAAC;AAEF,kBAAe,QAAQ,CAAC"}

package/src/executors/github-bootstrap/schema.json

@@ -2,7 +2,7 @@
   "$schema": "https://json-schema.org/schema",
   "version": 2,
   "title": "Empire Builder Kit GitHub bootstrap",
-  "description": "Report or explicitly apply protected repository rules and environments without creating secrets, branches, or credentials.",
+  "description": "Report or explicitly apply protected repository rules, environments, and the default immutable GitHub OIDC repository subject without creating secrets, branches, or credentials.",
   "type": "object",
   "additionalProperties": false,
   "properties": {
@@ -16,6 +16,12 @@
       "default": false,
       "description": "Apply the reported GitHub settings. Omit for the default read-only report."
     },
+    "immutableOidcTrustAcknowledgement": {
+      "type": "string",
+      "pattern": "^aws-trust-ready:repo:",
+      "maxLength": 512,
+      "description": "Required only when --apply would enable GitHub's immutable repository OIDC subject. Supply aws-trust-ready:<reported repositoryIdentity.subjectPrefix> only after the matching AWS trusts have been applied, read back, and verified."
+    },
     "npmPrereleaseReviewerIds": {
       "type": "string",
       "pattern": "^[1-9][0-9]*(,[1-9][0-9]*)*$",

package/src/executors/infrastructure-plan/infrastructure-plan.d.ts

@@ -1,378 +1,36 @@
 import { type ExecutorContext, type PromiseExecutor } from '@nx/devkit';
-import { type InfrastructureApprovalRecordV1, type InfrastructureAuthorizationEvidenceV1, type InfrastructureDriftStatus, type InfrastructureMutationAction, type InfrastructurePlanV1, type InfrastructureRiskAssessmentV1, type InfrastructureRiskPolicyV1, type InfrastructureStateIdentityV1, type NormalizedSstDiffV1 } from '../../infrastructure-change/index.js';
-import { type SstCommandInvocation, type SstLifecycleOptions } from '../sst-lifecycle/run-sst-command.js';
-export interface InfrastructurePlanExecutorOptions extends Pick<SstLifecycleOptions, 'cwd' | 'expectedRoleArn' | 'profile' | 'region' | 'stage' | 'stageMode'> {
-    action?: InfrastructureMutationAction;
-    approvalPath?: string;
-    configurationPath?: string;
-    configurationPaths?: string[];
-    descriptorPath?: string;
-    mutationBindingPath?: string;
-    operation?: 'finalize-convergence' | 'plan';
-    operationalEvidencePath?: string;
-    pendingConvergencePath?: string;
-    smokeBindingPath?: string;
-    smokeEvidencePath?: string;
-}
-export interface InfrastructureResourceObservationCoverage {
-    adapter: 'aws-resource-groups-tagging-api' | 'none' | 'sst-pulumi-refresh-preview' | 'sst-pulumi-refresh-preview+aws-secrets-manager-version-stages';
-    arnDigest: string | null;
-    coveredProperties: readonly string[];
-    type: string;
-    unobservedMaterialProperties: readonly string[];
-    urn: string;
-}
-interface DriftEvidence {
-    coverage: readonly InfrastructureResourceObservationCoverage[];
-    digest: string;
-    expiresAt: string;
-    generatedAt: string;
-    status: InfrastructureDriftStatus;
-}
-interface RefreshPreviewDiagnosticResource {
-    changeBasis: readonly ('detailedDiff' | 'diffs' | 'old-new')[];
-    changedPropertyPaths: readonly string[];
-    logicalId: string;
-    resourceType: string;
-}
-interface RefreshPreviewExternalLookupNormalization {
-    changedPropertyPath: '/inputs/name' | '/inputs/tags/Name';
-    logicalId: string;
-    resourceType: string;
-}
-interface RefreshPreviewExternalFrameworkTagObservation {
-    changedPropertyPaths: readonly string[];
-    logicalId: string;
-    providerReadLogicalId: string;
-    resourceType: string;
-}
-interface RefreshPreviewDiagnostics {
-    authorityMode: 'ordinary-and-refresh-separated' | 'refresh-reconciliation';
-    command: {
-        errorCode: string | null;
-        signal: string | null;
-        status: number | null;
-        stderrBytes: number;
-        stdoutBytes: number;
-    };
-    commandSucceeded: boolean;
-    complete: boolean;
-    entryCounts: {
-        desired: number;
-        externalFrameworkTagObserved: number;
-        externalLookupNormalized: number;
-        inertSame: number;
-        refresh: number;
-        rejectedSame: number;
-    };
-    providerRefreshSeparated: boolean;
-    ordinaryDesired: {
-        complete: boolean;
-        failureCounts: Readonly<Record<string, number>>;
-        resourceCount: number;
-    };
-    postRefreshDesired: {
-        complete: boolean;
-        failureCounts: Readonly<Record<string, number>>;
-        operationCounts: Readonly<Record<string, number>>;
-        resourceCount: number;
-    };
-    digest: string;
-    kind: 'ebk-infrastructure-refresh-preview-diagnostics';
-    externalFrameworkTagObservations: readonly RefreshPreviewExternalFrameworkTagObservation[];
-    externalLookupNormalizations: readonly RefreshPreviewExternalLookupNormalization[];
-    resources: readonly RefreshPreviewDiagnosticResource[];
-    schemaVersion: 7;
-}
-export interface InfrastructureObservation {
-    callInventory: readonly string[];
-    drift: DriftEvidence;
-    observerArnDigest: string;
-    resources?: readonly InfrastructureObservedResource[];
-    state: InfrastructureStateIdentityV1;
-}
-export interface InfrastructureObservedResource {
-    dependencyDigests: readonly string[];
-    logicalId: string;
-    physicalArn?: string;
-    physicalId?: string;
-    physicalSelector?: Readonly<Record<string, string>>;
-    physicalIdentityDigest: string | null;
-    protected: boolean | null;
-    resourceType: string;
-    retainedOnDelete: boolean | null;
-    urnDigest: string;
-}
-interface ReviewedApprovalFile {
-    approval: InfrastructureApprovalRecordV1;
-    governance?: unknown;
-    planned: InfrastructurePlanV1;
-}
-interface CommandResult {
-    error?: NodeJS.ErrnoException;
-    signal?: NodeJS.Signals | null;
-    status: number | null;
-    stderr: string;
-    stdout: string;
-}
-export interface InfrastructurePlanExecutorDependencies {
-    localCapability?: (input: Parameters<typeof consumeLocalMutationCapability>[0]) => void;
-    now?: () => Date;
-    observe?: (input: {
-        action: InfrastructureMutationAction;
-        backendBootstrapDigest: string;
-        childEnvironment: NodeJS.ProcessEnv;
-        environment: NodeJS.ProcessEnv;
-        invocation: SstCommandInvocation;
-        now: Date;
-        ordinaryDiff: NormalizedSstDiffV1;
-        project: string;
-        sourceCommit: string;
-        spawn: NonNullable<InfrastructurePlanExecutorDependencies['spawn']>;
-        toolVersion: string;
-    }) => InfrastructureObservation;
-    spawn?: (executable: string, args: readonly string[], options: {
-        cwd: string;
-        encoding: 'utf8';
-        env: NodeJS.ProcessEnv;
-        maxBuffer: number;
-        shell: false;
-    }) => CommandResult;
-}
-export declare const MAX_SST_DIFF_JSON_BYTES: number;
-interface InfrastructureBuildArtifactEntry {
-    digest: string;
-    path: string;
-    size: number;
-}
-interface InfrastructureBuildArtifactMaterial {
-    digest: string;
-    entries: readonly InfrastructureBuildArtifactEntry[];
-    kind: 'ebk-infrastructure-build-artifacts';
-    schemaVersion: 1;
-}
-/** @internal */
-export declare function collectInfrastructureBuildArtifacts(projectRoot: string): InfrastructureBuildArtifactMaterial;
-/** @internal */
-export declare function infrastructureConfigurationMetadataDigest(input: {
-    buildArtifactDigest: string;
-    configurationInputs: readonly {
-        contents: string;
-        path: string;
-    }[];
-    releaseCandidateDigest: string;
-}): string;
-type StandardRemoveProbeKind = 'aws-cloud-control' | 'aws-events-target' | 'aws-iam-role-policy' | 'aws-kms-retained' | 'aws-lambda-event-invoke-config' | 'aws-lambda-permission' | 'aws-logs-data-protection-policy' | 'aws-s3-retained' | 'aws-s3-object' | 'aws-secrets-manager-secret' | 'aws-sqs-queue-policy' | 'aws-ssm-parameter';
-interface StandardRemoveProbe {
-    identifier: string;
-    kind: StandardRemoveProbeKind;
-    protectionProfile?: string;
-    selector?: Readonly<Record<string, string>>;
-    typeName?: string;
-}
-export declare function matchesExpectedAssumedRoleArn(account: string, callerArn: string, expectedRoleArn: string): boolean;
-export declare function localProductionConfirmation(input: {
-    action: InfrastructureMutationAction;
-    accountId: string;
-    region: string;
-    sourceCommit: string;
-}): string;
-export declare function revalidateLocalUnlockCallerAuthority(input: {
-    environment?: NodeJS.ProcessEnv;
-    invocation: SstCommandInvocation;
+import { spawn, spawnSync } from 'node:child_process';
+import { type CanonicalDeploymentStage } from '../../repository-policy/index.js';
+import { createLocalFederatedCredentialTransport } from '../local-deploy/federated-credential-transport.js';
+import { localWorkingTreeDigest } from '../local-deploy/local-deploy.js';
+import { assertWorkspaceStageOwnershipForWorkspace } from '../../workspace-deployment/index.js';
+export { matchesExpectedAssumedRoleArn } from '../../aws/identity.js';
+export interface InfrastructurePlanExecutorOptions {
+    cwd?: string;
+    expectedRoleArn?: string;
     profile?: string;
-    spawn?: NonNullable<InfrastructurePlanExecutorDependencies['spawn']>;
-}): void;
-export declare function parseRefreshPreviewJson(value: string): unknown;
-/**
- * Reads the Pulumi StepEventStateMetadata `new.id` emitted by SST's pinned
- * JSON diff for imports. Only its digest leaves this private boundary.
- */
-export declare function extractPrivateImportIdentifierDigests(diffStdout: string, diff: NormalizedSstDiffV1): Readonly<Record<string, string>>;
-/** @internal */
-export declare function releaseCandidateBinding(input: {
-    project: string;
-    projectRoot: string;
-    repository: string;
-    sourceCommit: string;
-    workspaceRoot: string;
-}): {
-    digest: string;
-    path: string;
-};
-/** @internal */
-export declare function approvalCandidateSourceCommit(context: ExecutorContext, options: InfrastructurePlanExecutorOptions, environment: NodeJS.ProcessEnv): string | undefined;
-/** @internal */
-export declare function createCandidateBoundSstChildEnvironment(environment: NodeJS.ProcessEnv, invocationEnvironment: SstCommandInvocation['environment'], candidateSourceCommit: string): NodeJS.ProcessEnv;
-interface PulumiStateResource {
-    custom?: unknown;
-    dependencies?: unknown;
-    external?: unknown;
-    id?: unknown;
-    inputs?: unknown;
-    outputs?: unknown;
-    parent?: unknown;
-    provider?: unknown;
-    protect?: unknown;
-    retainOnDelete?: unknown;
-    type?: unknown;
-    urn?: unknown;
+    region?: string;
+    stage: CanonicalDeploymentStage;
+    stageMode: 'consumer' | 'foundation';
 }
-/** @internal */
-export declare function normalizeDesiredSstDiffV4_17_1(input: {
-    errorCode?: string | null;
-    exitCode: number;
-    signal?: string | null;
-    spawnError?: boolean;
-    stderr?: string;
-    stdout: string | unknown;
-    toolVersion: string;
-}): NormalizedSstDiffV1;
-export declare function assessPulumiRefreshPreview(input: {
-    action: InfrastructureMutationAction;
-    invocation: SstCommandInvocation;
-    ordinaryDiff: NormalizedSstDiffV1;
-    spawn: NonNullable<InfrastructurePlanExecutorDependencies['spawn']>;
-    stateResources?: readonly PulumiStateResource[];
-    toolVersion: string;
-    childEnvironment: NodeJS.ProcessEnv;
-}): {
-    commandSucceeded: boolean;
-    complete: boolean;
-    diagnostics: RefreshPreviewDiagnostics;
-    providerRefreshSeparated: boolean;
-    digest: string;
-    drift: NormalizedSstDiffV1;
-    observedRefreshUrns: readonly string[];
-    rawDrift: string;
-    stderr: string;
-};
-/** @internal */
-export declare function requiresIamMutationAnalysis(_action: InfrastructureMutationAction, resource: NormalizedSstDiffV1['resources'][number]): boolean;
-export declare function standardRemoveProbeForResource(resource: InfrastructureObservedResource): StandardRemoveProbe;
-interface StandardRemoveProbeResult {
-    present: boolean;
-    protectionDigest: string | null;
+interface InfrastructurePlanDependencies {
+    createTransport?: typeof createLocalFederatedCredentialTransport;
+    environment?: NodeJS.ProcessEnv;
+    identifyGithubCaller?: (region: string) => Promise<{
+        Account?: string;
+        Arn?: string;
+    }>;
+    ownership?: typeof assertWorkspaceStageOwnershipForWorkspace;
+    readSource?: typeof localWorkingTreeDigest;
+    platform?: NodeJS.Platform;
+    run?: typeof spawnSync;
+    spawnChild?: typeof spawn;
 }
-export declare function probeStandardRemoveResource(input: {
-    childEnvironment: NodeJS.ProcessEnv;
-    invocation: SstCommandInvocation;
-    probe: StandardRemoveProbe;
-    spawn: NonNullable<InfrastructurePlanExecutorDependencies['spawn']>;
-}): StandardRemoveProbeResult;
-export declare function observeInfrastructureState(input: {
-    action: InfrastructureMutationAction;
-    backendBootstrapDigest: string;
-    childEnvironment: NodeJS.ProcessEnv;
-    environment: NodeJS.ProcessEnv;
-    invocation: SstCommandInvocation;
-    now: Date;
-    ordinaryDiff: NormalizedSstDiffV1;
-    project: string;
-    sourceCommit: string;
-    spawn: NonNullable<InfrastructurePlanExecutorDependencies['spawn']>;
-    toolVersion: string;
-}): InfrastructureObservation;
-/** @internal */
-export declare function actionRisk(risk: InfrastructureRiskAssessmentV1, action: InfrastructureMutationAction, options?: Readonly<{
-    diffComplete?: boolean;
-}>): InfrastructureRiskAssessmentV1;
-export declare function validateGovernanceEvidence(reviewed: {
-    approval?: InfrastructureApprovalRecordV1;
-    governance?: unknown;
-} | undefined, plan: InfrastructurePlanV1, observedResources?: readonly InfrastructureObservedResource[], importIdentifierDigests?: Readonly<Record<string, string>>, adoptedImportPolicy?: InfrastructureRiskPolicyV1['adoptedImports']): Readonly<Record<string, string>>;
-/** @internal */
-export declare function createLocalPlanApprovalRecord(input: {
-    context: ExecutorContext;
-    environment: NodeJS.ProcessEnv;
-    now: Date;
-    plan: InfrastructurePlanV1;
-}): InfrastructureApprovalRecordV1 | undefined;
-/** @internal */
-export declare function hasUnreviewableLocalPlanBlock(plan: InfrastructurePlanV1): boolean;
-/** @internal */
-export declare function createLocalRefreshGovernanceReview(input: {
-    approval: InfrastructureApprovalRecordV1;
-    environment: NodeJS.ProcessEnv;
-    plan: InfrastructurePlanV1;
-}): ReviewedApprovalFile | undefined;
-/** @internal */
-export declare function createLocalDeployGovernanceReview(input: {
-    approval: InfrastructureApprovalRecordV1;
-    environment: NodeJS.ProcessEnv;
-    plan: InfrastructurePlanV1;
-}): ReviewedApprovalFile | undefined;
 /**
- * Retains exact local approval for a plan that the stage-wide local executor
- * has just recomputed and reviewed. This deliberately does not run SST again:
- * the project mutation executor consumes one invocation-scoped capability and
- * rechecks source, artifacts, credentials, policy, state identity, and lock
- * immediately before spawn without claiming provider-preview replay.
- *
- * @internal
+ * Run SST's native diff as advisory output. The result is intentionally not
+ * normalized, retained, or used as later mutation authority.
  */
-export declare function authorizeRetainedLocalInfrastructurePlan(input: {
-    context: ExecutorContext;
-    environment: NodeJS.ProcessEnv;
-    now: Date;
-    plan: InfrastructurePlanV1;
-}): InfrastructureAuthorizationEvidenceV1;
-/** @internal */
-export declare function requiresGovernanceValidation(input: {
-    action: InfrastructureMutationAction;
-    adoptedImportCount: number;
-    hasApproval: boolean;
-}): boolean;
-/** @internal */
-export declare function isLocalPlanReviewPending(input: {
-    context: ExecutorContext;
-    environment: NodeJS.ProcessEnv;
-    plan: InfrastructurePlanV1;
-    validation: InfrastructureAuthorizationEvidenceV1['validation'];
-}): boolean;
-interface LocalMutationStateObservation {
-    actorArn: string;
-    exportedState: unknown;
-    identity: InfrastructureStateIdentityV1;
-    resourceCount: number;
-}
-/** @internal */
-export declare function observeLocalMutationStateIdentity(input: {
-    backendBootstrapDigest: string;
-    childEnvironment: NodeJS.ProcessEnv;
-    environment: NodeJS.ProcessEnv;
-    invocation: SstCommandInvocation;
-    now: Date;
-    project: string;
-    sourceCommit: string;
-    spawn: NonNullable<InfrastructurePlanExecutorDependencies['spawn']>;
-}): LocalMutationStateObservation;
-/** @internal */
-export declare function retainLocalRefreshStateBackup(input: {
-    context: ExecutorContext;
-    now: Date;
-    observation: LocalMutationStateObservation;
-    plan: InfrastructurePlanV1;
-    project: string;
-}): void;
-declare function consumeLocalMutationCapability(input: {
-    action: Extract<InfrastructureMutationAction, 'deploy' | 'refresh'>;
-    authorizationContents: string;
-    context: ExecutorContext;
-    dependencies: InfrastructurePlanExecutorDependencies;
-    environment: NodeJS.ProcessEnv;
-    invocation: SstCommandInvocation;
-    now: Date;
-    options: InfrastructurePlanExecutorOptions;
-    plan: InfrastructurePlanV1;
-    planContents: string;
-}): void;
-export declare function runInfrastructurePlanExecutor(options: InfrastructurePlanExecutorOptions, context: ExecutorContext, environment?: NodeJS.ProcessEnv, dependencies?: InfrastructurePlanExecutorDependencies): Promise<{
-    success: boolean;
-}>;
-export declare function revalidateInfrastructureMutationAuthorization(action: InfrastructureMutationAction, options: SstLifecycleOptions, context: ExecutorContext, invocation: SstCommandInvocation, environment?: NodeJS.ProcessEnv, dependencies?: InfrastructurePlanExecutorDependencies): Promise<void>;
-export declare function recordInfrastructureMutationConvergence(action: InfrastructureMutationAction, options: SstLifecycleOptions, context: ExecutorContext, invocation: SstCommandInvocation, applySucceeded: boolean, environment?: NodeJS.ProcessEnv, dependencies?: InfrastructurePlanExecutorDependencies): Promise<boolean>;
-export declare function finalizeInfrastructureMutationConvergence(options: InfrastructurePlanExecutorOptions, context: ExecutorContext, environment?: NodeJS.ProcessEnv, dependencies?: Pick<InfrastructurePlanExecutorDependencies, 'now'>): Promise<{
+export declare function runInfrastructurePlanExecutor(options: InfrastructurePlanExecutorOptions, context: ExecutorContext, dependencies?: InfrastructurePlanDependencies): Promise<{
     success: boolean;
 }>;
 declare const executor: PromiseExecutor<InfrastructurePlanExecutorOptions>;