@empire-builder-kit/nx 1.0.0-rc.31 → 1.0.0-rc.33

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@empire-builder-kit/nx",
-  "version": "1.0.0-rc.31",
+  "version": "1.0.0-rc.33",
   "description": "Nx generators, executors, and Blueprint contracts for Empire Builder Kit",
   "keywords": [
     "aws",
@@ -103,6 +103,10 @@
       "types": "./src/workload-roles/index.d.ts",
       "default": "./src/workload-roles/index.js"
     },
+    "./workspace-deployment": {
+      "types": "./src/workspace-deployment/index.d.ts",
+      "default": "./src/workspace-deployment/index.js"
+    },
     "./schemas/blueprint-v1.json": "./src/schemas/blueprint-v1.json",
     "./schemas/aggregate-count-evidence-v1.json": "./src/schemas/aggregate-count-evidence-v1.json",
     "./schemas/blueprint-input-schema-v1.json": "./src/schemas/blueprint-input-schema-v1.json",
@@ -126,7 +130,7 @@
     "provenance": false
   },
   "dependencies": {
-    "@empire-builder-kit/runtime": "1.0.0-rc.31",
+    "@empire-builder-kit/runtime": "1.0.0-rc.33",
     "@aws-sdk/client-cloudfront": "^3.700.0",
     "@aws-sdk/client-cloudwatch": "^3.700.0",
     "@aws-sdk/client-cloudwatch-logs": "^3.700.0",
@@ -157,5 +161,5 @@
   "engines": {
     "node": ">=22.13.0"
   },
-  "gitHead": "829fe75d048a0166c4d8bd1af683c35d9b561bfa"
+  "gitHead": "98e000230d1affdd188a64aa2cdcd30075a270b4"
 }

package/src/aws/identity.js

@@ -5,7 +5,7 @@ exports.canonicalStsEndpoint = canonicalStsEndpoint;
 exports.matchesExpectedAssumedRoleArn = matchesExpectedAssumedRoleArn;
 const IAM_ROLE_ARN = /^arn:([^:]+):iam::(\d{12}):role\/(.+)$/u;
 const STS_ASSUMED_ROLE_ARN = /^arn:([^:]+):sts::(\d{12}):assumed-role\/(.+)\/([^/]+)$/u;
-const AWS_REGION = /^[a-z]{2}(?:-gov)?-[a-z]+-\d$/u;
+const AWS_REGION = /^[a-z]{2}(?:-gov)?-[a-z]+(?:-[a-z]+)*-\d$/u;
 /** Bind security-sensitive AWS SDK reads to the canonical regional service
  * endpoint rather than an ambient or shared-config endpoint override. */
 function canonicalAwsRegionalEndpoint(service, region) {

package/src/aws/identity.js.map

@@ -1 +1 @@
-{"version":3,"file":"identity.js","sourceRoot":"","sources":["../../../../../packages/nx/src/aws/identity.ts"],"names":[],"mappings":";;AAUA,oEAYC;AAID,oDAEC;AAOD,sEAgBC;AAnDD,MAAM,YAAY,GAAG,yCAAyC,CAAC;AAC/D,MAAM,oBAAoB,GACxB,0DAA0D,CAAC;AAC7D,MAAM,UAAU,GAAG,gCAAgC,CAAC;AAKpD;yEACyE;AACzE,SAAgB,4BAA4B,CAC1C,OAAoC,EACpC,MAAc;IAEd,IAAI,CAAC,UAAU,CAAC,IAAI,CAAC,MAAM,CAAC,EAAE,CAAC;QAC7B,MAAM,IAAI,KAAK,CACb,GAAG,OAAO,CAAC,WAAW,EAAE,6CAA6C,CACtE,CAAC;IACJ,CAAC;IACD,OAAO,MAAM,CAAC,UAAU,CAAC,KAAK,CAAC;QAC7B,CAAC,CAAC,WAAW,OAAO,IAAI,MAAM,mBAAmB;QACjD,CAAC,CAAC,WAAW,OAAO,IAAI,MAAM,gBAAgB,CAAC;AACnD,CAAC;AAED;yDACyD;AACzD,SAAgB,oBAAoB,CAAC,MAAc;IACjD,OAAO,4BAA4B,CAAC,KAAK,EAAE,MAAM,CAAC,CAAC;AACrD,CAAC;AAED;;;;GAIG;AACH,SAAgB,6BAA6B,CAC3C,eAAuB,EACvB,SAAiB,EACjB,eAAuB;IAEvB,MAAM,QAAQ,GAAG,YAAY,CAAC,IAAI,CAAC,eAAe,CAAC,CAAC;IACpD,MAAM,MAAM,GAAG,oBAAoB,CAAC,IAAI,CAAC,SAAS,CAAC,CAAC;IACpD,IAAI,CAAC,QAAQ,IAAI,CAAC,MAAM;QAAE,OAAO,KAAK,CAAC;IACvC,MAAM,gBAAgB,GAAG,QAAQ,CAAC,CAAC,CAAC,EAAE,KAAK,CAAC,GAAG,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC;IACxD,OAAO,CACL,QAAQ,CAAC,CAAC,CAAC,KAAK,MAAM,CAAC,CAAC,CAAC;QACzB,QAAQ,CAAC,CAAC,CAAC,KAAK,eAAe;QAC/B,MAAM,CAAC,CAAC,CAAC,KAAK,eAAe;QAC7B,gBAAgB,KAAK,SAAS;QAC9B,gBAAgB,KAAK,MAAM,CAAC,CAAC,CAAC,CAC/B,CAAC;AACJ,CAAC"}
+{"version":3,"file":"identity.js","sourceRoot":"","sources":["../../../../../packages/nx/src/aws/identity.ts"],"names":[],"mappings":";;AAUA,oEAYC;AAID,oDAEC;AAOD,sEAgBC;AAnDD,MAAM,YAAY,GAAG,yCAAyC,CAAC;AAC/D,MAAM,oBAAoB,GACxB,0DAA0D,CAAC;AAC7D,MAAM,UAAU,GAAG,4CAA4C,CAAC;AAKhE;yEACyE;AACzE,SAAgB,4BAA4B,CAC1C,OAAoC,EACpC,MAAc;IAEd,IAAI,CAAC,UAAU,CAAC,IAAI,CAAC,MAAM,CAAC,EAAE,CAAC;QAC7B,MAAM,IAAI,KAAK,CACb,GAAG,OAAO,CAAC,WAAW,EAAE,6CAA6C,CACtE,CAAC;IACJ,CAAC;IACD,OAAO,MAAM,CAAC,UAAU,CAAC,KAAK,CAAC;QAC7B,CAAC,CAAC,WAAW,OAAO,IAAI,MAAM,mBAAmB;QACjD,CAAC,CAAC,WAAW,OAAO,IAAI,MAAM,gBAAgB,CAAC;AACnD,CAAC;AAED;yDACyD;AACzD,SAAgB,oBAAoB,CAAC,MAAc;IACjD,OAAO,4BAA4B,CAAC,KAAK,EAAE,MAAM,CAAC,CAAC;AACrD,CAAC;AAED;;;;GAIG;AACH,SAAgB,6BAA6B,CAC3C,eAAuB,EACvB,SAAiB,EACjB,eAAuB;IAEvB,MAAM,QAAQ,GAAG,YAAY,CAAC,IAAI,CAAC,eAAe,CAAC,CAAC;IACpD,MAAM,MAAM,GAAG,oBAAoB,CAAC,IAAI,CAAC,SAAS,CAAC,CAAC;IACpD,IAAI,CAAC,QAAQ,IAAI,CAAC,MAAM;QAAE,OAAO,KAAK,CAAC;IACvC,MAAM,gBAAgB,GAAG,QAAQ,CAAC,CAAC,CAAC,EAAE,KAAK,CAAC,GAAG,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC;IACxD,OAAO,CACL,QAAQ,CAAC,CAAC,CAAC,KAAK,MAAM,CAAC,CAAC,CAAC;QACzB,QAAQ,CAAC,CAAC,CAAC,KAAK,eAAe;QAC/B,MAAM,CAAC,CAAC,CAAC,KAAK,eAAe;QAC7B,gBAAgB,KAAK,SAAS;QAC9B,gBAAgB,KAAK,MAAM,CAAC,CAAC,CAAC,CAC/B,CAAC;AACJ,CAAC"}

package/src/aws-authority/stage-authority.d.ts

@@ -5,6 +5,7 @@ export declare const STAGE_AUTHORITY_DEPLOYMENT_POLICY_KINDS: readonly ["read",
 export declare const STAGE_AUTHORITY_MANAGED_POLICY_CHARACTER_LIMIT = 6144;
 export declare const STAGE_AUTHORITY_MANAGED_POLICY_CHARACTER_HEADROOM = 200;
 export declare const STAGE_AUTHORITY_TEMPLATE_BODY_BYTE_LIMIT = 51200;
+export declare const STAGE_AUTHORITY_BOUND_TEMPLATE_BODY_MINIMUM_HEADROOM = 1024;
 export type StageAuthorityStage = (typeof STAGE_AUTHORITY_STAGES)[number];
 export type StageAuthorityPartition = (typeof STAGE_AUTHORITY_PARTITIONS)[number];
 export type StageAuthorityDeploymentPolicyKind = (typeof STAGE_AUTHORITY_DEPLOYMENT_POLICY_KINDS)[number];
@@ -226,6 +227,7 @@ export declare const STAGE_AUTHORITY_SERVICE_LINKED_ROLES: readonly (Readonly<{
 export declare function createStageAuthorityIdentity(input: Pick<StageAuthorityInput, 'accountId' | 'partition' | 'region' | 'stage'>): StageAuthorityIdentity;
 export declare function canonicalStageAuthorityTemplate(template: Readonly<Record<string, unknown>>): string;
 export declare function digestStageAuthorityTemplate(template: Readonly<Record<string, unknown>>): string;
+export declare function assertBoundStageAuthorityTemplateFitsBodyLimit(template: Readonly<Record<string, unknown>>): number;
 export declare function createStageAuthorityPlan(input: StageAuthorityInput): StageAuthorityPlan;
 export declare function createStageIamBoundaryTransformContract(input: Pick<StageAuthorityInput, 'accountId' | 'partition' | 'stage'>): StageIamBoundaryTransformContract;
 /**

package/src/aws-authority/stage-authority.js

@@ -1,10 +1,11 @@
 "use strict";
 Object.defineProperty(exports, "__esModule", { value: true });
-exports.STAGE_AUTHORITY_UNTAGGED_DESTRUCTIVE_ACTIONS = exports.STAGE_AUTHORITY_CROSS_STAGE_DESTRUCTIVE_ACTIONS = exports.STAGE_AUTHORITY_CROSS_ACCOUNT_MUTATION_ACTIONS = exports.STAGE_AUTHORITY_CROSS_ACCOUNT_EC2_MUTATION_ACTIONS = exports.STAGE_AUTHORITY_SST_417_EXTERNAL_AMI_OWNERS_BY_PARTITION = exports.STAGE_AUTHORITY_SCOPE_GUARD_MUTATION_FAMILIES = exports.STAGE_AUTHORITY_WORKLOAD_IDENTITY_POLICY_ACTIONS = exports.STAGE_AUTHORITY_APPROVED_AWS_MANAGED_POLICIES = exports.STAGE_RUNTIME_REGIONAL_SERVICE_FAMILIES = exports.STAGE_AUTHORITY_LOGS_MUTATION_FAMILIES = exports.STAGE_AUTHORITY_REGIONAL_MUTATION_FAMILIES = exports.STAGE_RUNTIME_GLOBAL_ACTIONS = exports.STAGE_RUNTIME_REGIONAL_ACTIONS = exports.STAGE_AUTHORITY_ACCOUNT_SCOPED_GLOBAL_WRITE_ACTIONS = exports.STAGE_AUTHORITY_GLOBAL_WRITE_ACTIONS = exports.STAGE_AUTHORITY_UNSUPPORTED_REPLICATION_AND_TOPOLOGY_ACTIONS = exports.STAGE_AUTHORITY_WAF_EDGE_MUTATION_ACTIONS = exports.STAGE_AUTHORITY_S3_REGIONAL_MUTATION_ACTIONS = exports.STAGE_AUTHORITY_UNSCOPED_CLOUDFRONT_CREATE_ACTIONS = exports.STAGE_AUTHORITY_REGIONAL_WRITE_ACTIONS = exports.STAGE_AUTHORITY_LAMBDA_INFRASTRUCTURE_ACTIONS = exports.STAGE_AUTHORITY_KMS_INFRASTRUCTURE_ACTIONS = exports.STAGE_AUTHORITY_EC2_INFRASTRUCTURE_ACTIONS = exports.STAGE_AUTHORITY_BACKUP_INFRASTRUCTURE_ACTIONS = exports.STAGE_AUTHORITY_BROAD_REGIONAL_SERVICE_ACTIONS = exports.STAGE_AUTHORITY_EDGE_OBSERVABILITY_READ_ACTIONS = exports.STAGE_AUTHORITY_GLOBAL_READ_ACTIONS = exports.STAGE_AUTHORITY_REGIONAL_READ_ACTIONS = exports.STAGE_AUTHORITY_COST_ANOMALY_WRITE_ACTIONS = exports.STAGE_AUTHORITY_COST_ANOMALY_RESOURCE_WRITE_ACTIONS = exports.STAGE_AUTHORITY_COST_ANOMALY_CREATE_ACTIONS = exports.STAGE_AUTHORITY_COST_ANOMALY_READ_ACTIONS = exports.STAGE_AUTHORITY_KMS_ROTATION_ACTIONS = exports.STAGE_AUTHORITY_RDS_EVENT_SUBSCRIPTION_SOURCE_ACTIONS = exports.STAGE_AUTHORITY_BUDGET_MUTATION_ACTIONS = exports.STAGE_AUTHORITY_EDGE_WAF_LOG_DELIVERY_MUTATION_ACTIONS = exports.STAGE_AUTHORITY_EDGE_WAF_LOG_GROUP_ACTIONS = exports.STAGE_AUTHORITY_WAF_LOGGING_ACTIONS = exports.STAGE_AUTHORITY_CLOUDFRONT_INVALIDATION_ACTIONS = exports.STAGE_AUTHORITY_LAMBDA_DEPLOYMENT_INVOKE_ACTIONS = exports.STAGE_AUTHORITY_EVENT_ARCHIVE_RESOURCE_ACTIONS = exports.STAGE_AUTHORITY_EVENT_ARCHIVE_CREATE_ACTIONS = exports.STAGE_AUTHORITY_CLOUDFORMATION_LIFECYCLE_ACTIONS = exports.STAGE_AUTHORITY_TEMPLATE_BODY_BYTE_LIMIT = exports.STAGE_AUTHORITY_MANAGED_POLICY_CHARACTER_HEADROOM = exports.STAGE_AUTHORITY_MANAGED_POLICY_CHARACTER_LIMIT = exports.STAGE_AUTHORITY_DEPLOYMENT_POLICY_KINDS = exports.STAGE_AUTHORITY_PARTITIONS = exports.STAGE_AUTHORITY_STAGES = exports.STAGE_AUTHORITY_SCHEMA_VERSION = void 0;
-exports.STAGE_AUTHORITY_SERVICE_LINKED_ROLES = exports.STAGE_AUTHORITY_UNSUPPORTED_WORKFLOW_EXECUTION_ACTIONS = exports.STAGE_AUTHORITY_NON_DEPLOYMENT_ACCOUNT_AND_DATA_ACTIONS = exports.STAGE_AUTHORITY_UNREVIEWED_PERMISSION_MANAGEMENT_ACTION_PATTERNS = exports.STAGE_AUTHORITY_REVIEWED_PERMISSION_MANAGEMENT_ACTIONS = exports.STAGE_AUTHORITY_S3_BUCKET_POLICY_MUTATION_ACTIONS = exports.STAGE_AUTHORITY_KNOWN_STAGE_MUTATION_ACTIONS = void 0;
+exports.STAGE_AUTHORITY_CROSS_STAGE_DESTRUCTIVE_ACTIONS = exports.STAGE_AUTHORITY_CROSS_ACCOUNT_MUTATION_ACTIONS = exports.STAGE_AUTHORITY_CROSS_ACCOUNT_EC2_MUTATION_ACTIONS = exports.STAGE_AUTHORITY_SST_417_EXTERNAL_AMI_OWNERS_BY_PARTITION = exports.STAGE_AUTHORITY_SCOPE_GUARD_MUTATION_FAMILIES = exports.STAGE_AUTHORITY_WORKLOAD_IDENTITY_POLICY_ACTIONS = exports.STAGE_AUTHORITY_APPROVED_AWS_MANAGED_POLICIES = exports.STAGE_RUNTIME_REGIONAL_SERVICE_FAMILIES = exports.STAGE_AUTHORITY_LOGS_MUTATION_FAMILIES = exports.STAGE_AUTHORITY_REGIONAL_MUTATION_FAMILIES = exports.STAGE_RUNTIME_GLOBAL_ACTIONS = exports.STAGE_RUNTIME_REGIONAL_ACTIONS = exports.STAGE_AUTHORITY_ACCOUNT_SCOPED_GLOBAL_WRITE_ACTIONS = exports.STAGE_AUTHORITY_GLOBAL_WRITE_ACTIONS = exports.STAGE_AUTHORITY_UNSUPPORTED_REPLICATION_AND_TOPOLOGY_ACTIONS = exports.STAGE_AUTHORITY_WAF_EDGE_MUTATION_ACTIONS = exports.STAGE_AUTHORITY_S3_REGIONAL_MUTATION_ACTIONS = exports.STAGE_AUTHORITY_UNSCOPED_CLOUDFRONT_CREATE_ACTIONS = exports.STAGE_AUTHORITY_REGIONAL_WRITE_ACTIONS = exports.STAGE_AUTHORITY_LAMBDA_INFRASTRUCTURE_ACTIONS = exports.STAGE_AUTHORITY_KMS_INFRASTRUCTURE_ACTIONS = exports.STAGE_AUTHORITY_EC2_INFRASTRUCTURE_ACTIONS = exports.STAGE_AUTHORITY_BACKUP_INFRASTRUCTURE_ACTIONS = exports.STAGE_AUTHORITY_BROAD_REGIONAL_SERVICE_ACTIONS = exports.STAGE_AUTHORITY_EDGE_OBSERVABILITY_READ_ACTIONS = exports.STAGE_AUTHORITY_GLOBAL_READ_ACTIONS = exports.STAGE_AUTHORITY_REGIONAL_READ_ACTIONS = exports.STAGE_AUTHORITY_COST_ANOMALY_WRITE_ACTIONS = exports.STAGE_AUTHORITY_COST_ANOMALY_RESOURCE_WRITE_ACTIONS = exports.STAGE_AUTHORITY_COST_ANOMALY_CREATE_ACTIONS = exports.STAGE_AUTHORITY_COST_ANOMALY_READ_ACTIONS = exports.STAGE_AUTHORITY_KMS_ROTATION_ACTIONS = exports.STAGE_AUTHORITY_RDS_EVENT_SUBSCRIPTION_SOURCE_ACTIONS = exports.STAGE_AUTHORITY_BUDGET_MUTATION_ACTIONS = exports.STAGE_AUTHORITY_EDGE_WAF_LOG_DELIVERY_MUTATION_ACTIONS = exports.STAGE_AUTHORITY_EDGE_WAF_LOG_GROUP_ACTIONS = exports.STAGE_AUTHORITY_WAF_LOGGING_ACTIONS = exports.STAGE_AUTHORITY_CLOUDFRONT_INVALIDATION_ACTIONS = exports.STAGE_AUTHORITY_LAMBDA_DEPLOYMENT_INVOKE_ACTIONS = exports.STAGE_AUTHORITY_EVENT_ARCHIVE_RESOURCE_ACTIONS = exports.STAGE_AUTHORITY_EVENT_ARCHIVE_CREATE_ACTIONS = exports.STAGE_AUTHORITY_CLOUDFORMATION_LIFECYCLE_ACTIONS = exports.STAGE_AUTHORITY_BOUND_TEMPLATE_BODY_MINIMUM_HEADROOM = exports.STAGE_AUTHORITY_TEMPLATE_BODY_BYTE_LIMIT = exports.STAGE_AUTHORITY_MANAGED_POLICY_CHARACTER_HEADROOM = exports.STAGE_AUTHORITY_MANAGED_POLICY_CHARACTER_LIMIT = exports.STAGE_AUTHORITY_DEPLOYMENT_POLICY_KINDS = exports.STAGE_AUTHORITY_PARTITIONS = exports.STAGE_AUTHORITY_STAGES = exports.STAGE_AUTHORITY_SCHEMA_VERSION = void 0;
+exports.STAGE_AUTHORITY_SERVICE_LINKED_ROLES = exports.STAGE_AUTHORITY_UNSUPPORTED_WORKFLOW_EXECUTION_ACTIONS = exports.STAGE_AUTHORITY_NON_DEPLOYMENT_ACCOUNT_AND_DATA_ACTIONS = exports.STAGE_AUTHORITY_UNREVIEWED_PERMISSION_MANAGEMENT_ACTION_PATTERNS = exports.STAGE_AUTHORITY_REVIEWED_PERMISSION_MANAGEMENT_ACTIONS = exports.STAGE_AUTHORITY_S3_BUCKET_POLICY_MUTATION_ACTIONS = exports.STAGE_AUTHORITY_KNOWN_STAGE_MUTATION_ACTIONS = exports.STAGE_AUTHORITY_UNTAGGED_DESTRUCTIVE_ACTIONS = void 0;
 exports.createStageAuthorityIdentity = createStageAuthorityIdentity;
 exports.canonicalStageAuthorityTemplate = canonicalStageAuthorityTemplate;
 exports.digestStageAuthorityTemplate = digestStageAuthorityTemplate;
+exports.assertBoundStageAuthorityTemplateFitsBodyLimit = assertBoundStageAuthorityTemplateFitsBodyLimit;
 exports.createStageAuthorityPlan = createStageAuthorityPlan;
 exports.createStageIamBoundaryTransformContract = createStageIamBoundaryTransformContract;
 exports.installStageIamBoundaryTransforms = installStageIamBoundaryTransforms;
@@ -33,13 +34,14 @@ exports.STAGE_AUTHORITY_DEPLOYMENT_POLICY_KINDS = [
 exports.STAGE_AUTHORITY_MANAGED_POLICY_CHARACTER_LIMIT = 6_144;
 exports.STAGE_AUTHORITY_MANAGED_POLICY_CHARACTER_HEADROOM = 200;
 exports.STAGE_AUTHORITY_TEMPLATE_BODY_BYTE_LIMIT = 51_200;
+exports.STAGE_AUTHORITY_BOUND_TEMPLATE_BODY_MINIMUM_HEADROOM = 1_024;
 const STAGE_AUTHORITY_MAX_AWS_PRINCIPALS = 16;
 const STAGE_AUTHORITY_MAX_AWS_PRINCIPAL_ARN_BYTES = 2_048;
 const ACCOUNT_ID = /^\d{12}$/u;
 const REGION = /^(?:(?:af|ap|ca|cn|eu|il|me|mx|sa|us)(?:-(?:gov|iso|isob|isoe|isof))?|eusc-[a-z]{2})-[a-z]+-\d$/u;
 const AWS_PRINCIPAL_ARN = /^arn:(aws|aws-cn|aws-us-gov):iam::(\d{12}):role\/[A-Za-z0-9+=,.@_/-]+$/u;
 const GITHUB_OIDC_PROVIDER_ARN = /^arn:(aws|aws-cn|aws-us-gov):iam::(\d{12}):oidc-provider\/token[.]actions[.]githubusercontent[.]com$/u;
-const GITHUB_SUBJECT = /^repo:(?:[A-Za-z0-9_.-]+\/[A-Za-z0-9_.-]+|[A-Za-z0-9_.-]+@[1-9][0-9]{0,19}\/[A-Za-z0-9_.-]+@[1-9][0-9]{0,19}):environment:(development|staging|production)$/u;
+const GITHUB_SUBJECT = /^repo:[A-Za-z0-9_.-]+@[1-9][0-9]{0,19}\/[A-Za-z0-9_.-]+@[1-9][0-9]{0,19}:environment:(development|staging|production)$/u;
 /** Native lifecycle required by the generated machine-authorization nested
  * stack. Recovery-only and stack-policy mutation APIs remain ungranted. */
 exports.STAGE_AUTHORITY_CLOUDFORMATION_LIFECYCLE_ACTIONS = Object.freeze([
@@ -922,10 +924,13 @@ exports.STAGE_AUTHORITY_NON_DEPLOYMENT_ACCOUNT_AND_DATA_ACTIONS = Object.freeze(
 const SECRET_BATCH_VALUE_READ_ACTIONS = Object.freeze([
     'secretsmanager:BatchGetSecretValue',
 ]);
-const GENERATED_FOUNDATION_DATABASE_VALUE_ACTIONS = Object.freeze([
-    'secretsmanager:GetSecretValue',
-    'secretsmanager:PutSecretValue',
+const GENERATED_FOUNDATION_DATABASE_VALUE_ACTIONS = Object.freeze(['secretsmanager:GetSecretValue', 'secretsmanager:PutSecretValue'].sort(compareStrings));
+const STAGE_SECRET_CONTAINER_METADATA_UPDATE_ACTIONS = Object.freeze([
     'secretsmanager:UpdateSecret',
+]);
+const GENERATED_FOUNDATION_DATABASE_RECONCILIATION_ACTIONS = Object.freeze([
+    ...GENERATED_FOUNDATION_DATABASE_VALUE_ACTIONS,
+    ...STAGE_SECRET_CONTAINER_METADATA_UPDATE_ACTIONS,
 ].sort(compareStrings));
 const SSM_HISTORY_AND_RECURSIVE_VALUE_READ_ACTIONS = Object.freeze(['ssm:GetParameterHistory', 'ssm:GetParametersByPath'].sort(compareStrings));
 const WORKFLOW_EXECUTION_MUTATION_ACTIONS = Object.freeze([
@@ -1013,6 +1018,46 @@ function omitPolicyStatementSids(document) {
         }),
     };
 }
+function replaceExactTemplateString(value, expected, replacement) {
+    if (value === expected)
+        return replacement;
+    if (Array.isArray(value)) {
+        return value.map((entry) => replaceExactTemplateString(entry, expected, replacement));
+    }
+    if (!value || typeof value !== 'object')
+        return value;
+    return Object.fromEntries(Object.entries(value).map(([key, entry]) => [
+        key,
+        replaceExactTemplateString(entry, expected, replacement),
+    ]));
+}
+function compactExactTemplatePolicyStrings(documents, values) {
+    const constants = {};
+    const replacements = new Map();
+    for (const value of [...new Set(values)].sort(compareStrings)) {
+        const key = `A${replacements.size}`;
+        const replacement = Object.freeze({
+            'Fn::FindInMap': Object.freeze(['A', 'V', key]),
+        });
+        constants[key] = value;
+        replacements.set(value, replacement);
+    }
+    if (replacements.size === 0)
+        return Object.freeze({ documents });
+    const compactedDocuments = Object.fromEntries(Object.entries(documents).map(([logicalId, document]) => [
+        logicalId,
+        [...replacements.entries()].reduce((current, [arn, replacement]) => replaceExactTemplateString(current, arn, replacement), document),
+    ]));
+    return Object.freeze({
+        documents: Object.freeze(compactedDocuments),
+        // These short, template-private identifiers avoid repeating long exact
+        // ARNs in policy documents. Fn::FindInMap resolves to the original literal
+        // before IAM sees the policy; the executable policy model stays literal.
+        mappings: Object.freeze({
+            A: Object.freeze({ V: Object.freeze(constants) }),
+        }),
+    });
+}
 function statement(input) {
     if ((input.Resource === undefined) === (input.NotResource === undefined)) {
         throw new Error('Stage authority statements require exactly one Resource or NotResource scope.');
@@ -1293,22 +1338,43 @@ function deploymentPolicy(options) {
         `arn:${options.partition}:sqs:${options.region}:${options.accountId}:*-${options.stage}-*`,
     ];
     const stageReadableSsmValueResources = [
+        `arn:${options.partition}:ssm:${options.region}:${options.accountId}:parameter/ebk/${options.stage}/workspace-owner`,
         `arn:${options.partition}:ssm:${options.region}:${options.accountId}:parameter/ebk/${options.stage}/foundation/*`,
         `arn:${options.partition}:ssm:${options.region}:${options.accountId}:parameter/sst/bootstrap`,
         `arn:${options.partition}:ssm:${options.region}:${options.accountId}:parameter/sst/passphrase/*/${options.stage}`,
         `arn:${options.partition}:ssm:${options.region}:${options.accountId}:parameter/sst/vpc/vpc-*/private-key-value`,
     ].sort(compareStrings);
+    const immutableWorkspaceOwnerResources = [
+        'development',
+        'production',
+        'staging',
+    ]
+        .map((stage) => `arn:${options.partition}:ssm:${options.region}:${options.accountId}:parameter/ebk/${stage}/workspace-owner`)
+        .sort(compareStrings);
     // SST 4.17.1 models the generated Aurora credential as a managed
-    // SecretVersion. The pinned AWS provider needs PutSecretValue to create it,
-    // GetSecretValue to reconcile its AWSCURRENT version during removal, and may
-    // use UpdateSecret while reconciling its owning Secret resource. Because
-    // UpdateSecret can also carry plaintext, keep all three operations bound to
-    // the one Foundation-owned physical-name and stage-tag contract;
-    // operator/generated paths and every other secret value remain explicitly
-    // outside this exception.
+    // SecretVersion. The pinned AWS provider needs PutSecretValue to create it
+    // and GetSecretValue to reconcile its AWSCURRENT version during removal.
+    // Keep those value operations bound to the one Foundation-owned
+    // physical-name and stage-tag contract; operator/generated paths and every
+    // other secret value remain explicitly outside this exception.
     const generatedFoundationDatabaseCredentialResources = [
         `arn:${options.partition}:secretsmanager:${options.region}:${options.accountId}:secret:foundation-${options.stage}-FoundationDatabaseProxySecret-*`,
     ];
+    // Native providers reconcile an EBK-owned Secret container through
+    // UpdateSecret regardless of whether it holds a generated database
+    // credential, a machine credential, or operator-supplied material. Bind that
+    // metadata lifecycle to the stable stage-owned namespace instead of
+    // enumerating today's generated container purposes. UpdateSecret can itself
+    // carry plaintext, so reviewed generated source, temporary deployer
+    // credentials, and CloudTrail remain the honest controls. GetSecretValue and
+    // PutSecretValue stay excluded from every Slice container.
+    const stageOwnedSecretContainerResources = [
+        `arn:${options.partition}:secretsmanager:${options.region}:${options.accountId}:secret:ebk/${options.stage}/*`,
+    ];
+    const stageSecretContainerMetadataUpdateResources = [
+        ...generatedFoundationDatabaseCredentialResources,
+        ...stageOwnedSecretContainerResources,
+    ].sort(compareStrings);
     const machineAuthorizationStackResources = [
         `arn:${options.partition}:cloudformation:${options.region}:${options.accountId}:stack/*MachineAuthorization*/*`,
     ];
@@ -1606,7 +1672,7 @@ function deploymentPolicy(options) {
             Sid: 'DenySecretValueAccessOutsideGeneratedFoundationDatabase',
         }),
         statement({
-            Action: GENERATED_FOUNDATION_DATABASE_VALUE_ACTIONS,
+            Action: GENERATED_FOUNDATION_DATABASE_RECONCILIATION_ACTIONS,
             Condition: {
                 StringNotEquals: {
                     'aws:ResourceTag/ebk:stage': options.stage,
@@ -1616,6 +1682,12 @@ function deploymentPolicy(options) {
             Resource: generatedFoundationDatabaseCredentialResources,
             Sid: 'DenyGeneratedDatabaseValueAccessWithWrongStageTag',
         }),
+        statement({
+            Action: STAGE_SECRET_CONTAINER_METADATA_UPDATE_ACTIONS,
+            Effect: 'Deny',
+            NotResource: stageSecretContainerMetadataUpdateResources,
+            Sid: 'DenySecretMetadataUpdateOutsideStageContainers',
+        }),
         statement({
             Action: ['ssm:GetParameter', 'ssm:GetParameters'],
             Effect: 'Deny',
@@ -1628,6 +1700,20 @@ function deploymentPolicy(options) {
             Resource: ['*'],
             Sid: 'DenySsmHistoryAndRecursiveValueReads',
         }),
+        statement({
+            Action: [
+                'ssm:AddTagsToResource',
+                'ssm:DeleteParameter',
+                'ssm:DeleteParameters',
+                'ssm:LabelParameterVersion',
+                'ssm:PutParameter',
+                'ssm:RemoveTagsFromResource',
+                'ssm:UnlabelParameterVersion',
+            ],
+            Effect: 'Deny',
+            Resource: immutableWorkspaceOwnerResources,
+            Sid: 'DenyOwnerMutation',
+        }),
         statement({
             Action: exports.STAGE_AUTHORITY_NON_DEPLOYMENT_ACCOUNT_AND_DATA_ACTIONS,
             Effect: 'Deny',
@@ -2494,6 +2580,7 @@ function deploymentPolicy(options) {
                 'DenyEdgeControlMutationOutsideEdgeRegion',
                 'DenyMutationOutsideStageRegion',
                 'DenyS3MutationOutsideStageRegion',
+                'DenySecretMetadataUpdateOutsideStageContainers',
                 'DenyUnscopedWorkflowExecutionMutation',
                 'InvokeOnlyStageLambdaFunctions',
                 'MutateEdgeCertificates',
@@ -2554,6 +2641,7 @@ function deploymentPolicy(options) {
                 'InvalidateOnlyStageCloudFrontDistributions',
                 'MutateNamedFoundationEventArchive',
                 'MutateTaggedMachineAuthorizationStacks',
+                'DenyOwnerMutation',
                 ...(options.stage !== 'production'
                     ? ['RetireOnlyTaggedNonProductionKmsKeys']
                     : []),
@@ -2618,6 +2706,7 @@ function deploymentPolicy(options) {
                         'DenyMutationOutsideStageRegion',
                         'DenyNonDeploymentControlOperations',
                         'DenyNonPrivateServiceDiscoveryNamespaces',
+                        'DenyOwnerMutation',
                         'DenyNonProductionDatabaseEventSubscriptionSourceMutation',
                         'DenyProductionCostScopeRemoval',
                         'DenyProductionCostScopeSubstitution',
@@ -2626,6 +2715,7 @@ function deploymentPolicy(options) {
                         'DenyRuntimeBoundaryRemoval',
                         'DenyRuntimeTrustPolicyMutation',
                         'DenySecretsManagerBatchValueReads',
+                        'DenySecretMetadataUpdateOutsideStageContainers',
                         'DenySecretValueAccessOutsideGeneratedFoundationDatabase',
                         'DenySsmHistoryAndRecursiveValueReads',
                         'DenyStageAccountBudgetStageTagRemoval',
@@ -2691,6 +2781,13 @@ function digestStageAuthorityTemplate(template) {
         .update(canonicalStageAuthorityTemplate(template), 'utf8')
         .digest('hex');
 }
+function assertBoundStageAuthorityTemplateFitsBodyLimit(template) {
+    const templateBytes = Buffer.byteLength(canonicalStageAuthorityTemplate(template), 'utf8');
+    if (templateBytes > exports.STAGE_AUTHORITY_TEMPLATE_BODY_BYTE_LIMIT) {
+        throw new Error(`Workspace-bound stage authority template has ${templateBytes} bytes; the direct CloudFormation TemplateBody limit is ${exports.STAGE_AUTHORITY_TEMPLATE_BODY_BYTE_LIMIT}.`);
+    }
+    return templateBytes;
+}
 function createStageAuthorityPlan(input) {
     const target = requireIdentity(input);
     const identity = createStageAuthorityIdentity(target);
@@ -2712,6 +2809,33 @@ function createStageAuthorityPlan(input) {
         region: target.region,
         stage: target.stage,
     });
+    const renderedDeploymentPolicyDocuments = Object.fromEntries(deployment.map((entry) => {
+        let document = replaceExactTemplateString(replaceExactTemplateString(omitPolicyStatementSids(entry.document), identity.boundaryArn, { Ref: 'StageRuntimeBoundary' }), identity.deploymentRoleArn, { 'Fn::GetAtt': ['StageDeploymentRole', 'Arn'] });
+        if (entry.logicalId === 'StageDeploymentGlobalIamMutationPolicy') {
+            for (const sibling of deployment) {
+                if (sibling.logicalId === entry.logicalId)
+                    continue;
+                document = replaceExactTemplateString(document, sibling.arn, {
+                    Ref: sibling.logicalId,
+                });
+            }
+        }
+        return [entry.logicalId, document];
+    }));
+    const edgeRegion = edgeControlRegion(target.partition, target.region);
+    const templatePolicyDocuments = compactExactTemplatePolicyStrings({
+        ...renderedDeploymentPolicyDocuments,
+        StageRuntimeBoundary: omitPolicyStatementSids(boundary),
+    }, [
+        identity.workloadRoleArnPattern,
+        `arn:${target.partition}:cloudformation:${target.region}:${target.accountId}:stack/*MachineAuthorization*/*`,
+        `arn:${target.partition}:events:${target.region}:${target.accountId}:archive/ebk-${target.stage}-foundation-events`,
+        `arn:${target.partition}:events:${target.region}:${target.accountId}:event-bus/foundation-${target.stage}-FoundationEventBusBus-*`,
+        `arn:${target.partition}:lambda:${target.region}:${target.accountId}:function:*`,
+        `arn:${target.partition}:logs:${edgeRegion}:${target.accountId}:log-group:aws-waf-logs-foundation-${target.stage}-FoundationRouter-*`,
+        `arn:${target.partition}:secretsmanager:${target.region}:${target.accountId}:secret:foundation-${target.stage}-FoundationDatabaseProxySecret-*`,
+        `arn:${target.partition}:states:${target.region}:${target.accountId}:execution:*:*`,
+    ]);
     const deploymentPolicyResources = Object.fromEntries(deployment.map((entry) => [
         entry.logicalId,
         {
@@ -2723,7 +2847,12 @@ function createStageAuthorityPlan(input) {
                 // in the executable policy model while omitting them from the direct
                 // CloudFormation body so every supported partition retains bounded
                 // TemplateBody headroom without changing effective permissions.
-                PolicyDocument: omitPolicyStatementSids(entry.document),
+                // Ref on AWS::IAM::ManagedPolicy resolves to its exact ARN. Use the
+                // runtime-boundary resource identity in rendered policy documents
+                // instead of repeating its long partition/account/path ARN. The
+                // executable policy model retains the literal ARN for simulation;
+                // this is representation-only direct-TemplateBody compaction.
+                PolicyDocument: templatePolicyDocuments.documents[entry.logicalId],
                 Roles: [{ Ref: 'StageDeploymentRole' }],
             },
             Type: 'AWS::IAM::ManagedPolicy',
@@ -2731,11 +2860,14 @@ function createStageAuthorityPlan(input) {
     ]));
     const template = {
         AWSTemplateFormatVersion: '2010-09-09',
-        Description: `Stable Empire Builder Kit ${target.stage} deployment authority. ` +
-            'This stack changes only when the reviewed stage authority contract changes.',
+        ...(templatePolicyDocuments.mappings
+            ? { Mappings: templatePolicyDocuments.mappings }
+            : {}),
         Outputs: {
-            DeploymentRoleArn: { Value: identity.deploymentRoleArn },
-            RuntimeBoundaryArn: { Value: identity.boundaryArn },
+            DeploymentRoleArn: {
+                Value: { 'Fn::GetAtt': ['StageDeploymentRole', 'Arn'] },
+            },
+            RuntimeBoundaryArn: { Value: { Ref: 'StageRuntimeBoundary' } },
         },
         Resources: {
             ...deploymentPolicyResources,
@@ -2758,7 +2890,7 @@ function createStageAuthorityPlan(input) {
                     Description: `Stable maximum permissions for ${target.stage} workload roles.`,
                     ManagedPolicyName: identity.boundaryName,
                     Path: identity.boundaryPath,
-                    PolicyDocument: omitPolicyStatementSids(boundary),
+                    PolicyDocument: templatePolicyDocuments.documents['StageRuntimeBoundary'],
                 },
                 Type: 'AWS::IAM::ManagedPolicy',
             },