@empire-builder-kit/nx 1.0.0-rc.37 → 1.0.0-rc.39

package/src/aws-authority/stage-authority.js

@@ -1,7 +1,7 @@
 "use strict";
 Object.defineProperty(exports, "__esModule", { value: true });
-exports.STAGE_AUTHORITY_CROSS_STAGE_DESTRUCTIVE_ACTIONS = exports.STAGE_AUTHORITY_CROSS_ACCOUNT_MUTATION_ACTIONS = exports.STAGE_AUTHORITY_CROSS_ACCOUNT_EC2_MUTATION_ACTIONS = exports.STAGE_AUTHORITY_SST_417_EXTERNAL_AMI_OWNERS_BY_PARTITION = exports.STAGE_AUTHORITY_SCOPE_GUARD_MUTATION_FAMILIES = exports.STAGE_AUTHORITY_WORKLOAD_IDENTITY_POLICY_ACTIONS = exports.STAGE_AUTHORITY_APPROVED_AWS_MANAGED_POLICIES = exports.STAGE_RUNTIME_REGIONAL_SERVICE_FAMILIES = exports.STAGE_AUTHORITY_LOGS_MUTATION_FAMILIES = exports.STAGE_AUTHORITY_REGIONAL_MUTATION_FAMILIES = exports.STAGE_RUNTIME_GLOBAL_ACTIONS = exports.STAGE_RUNTIME_REGIONAL_ACTIONS = exports.STAGE_AUTHORITY_ACCOUNT_SCOPED_GLOBAL_WRITE_ACTIONS = exports.STAGE_AUTHORITY_GLOBAL_WRITE_ACTIONS = exports.STAGE_AUTHORITY_UNSUPPORTED_REPLICATION_AND_TOPOLOGY_ACTIONS = exports.STAGE_AUTHORITY_WAF_EDGE_MUTATION_ACTIONS = exports.STAGE_AUTHORITY_S3_REGIONAL_MUTATION_ACTIONS = exports.STAGE_AUTHORITY_UNSCOPED_CLOUDFRONT_CREATE_ACTIONS = exports.STAGE_AUTHORITY_REGIONAL_WRITE_ACTIONS = exports.STAGE_AUTHORITY_LAMBDA_INFRASTRUCTURE_ACTIONS = exports.STAGE_AUTHORITY_KMS_INFRASTRUCTURE_ACTIONS = exports.STAGE_AUTHORITY_EC2_INFRASTRUCTURE_ACTIONS = exports.STAGE_AUTHORITY_BACKUP_INFRASTRUCTURE_ACTIONS = exports.STAGE_AUTHORITY_BROAD_REGIONAL_SERVICE_ACTIONS = exports.STAGE_AUTHORITY_EDGE_OBSERVABILITY_READ_ACTIONS = exports.STAGE_AUTHORITY_GLOBAL_READ_ACTIONS = exports.STAGE_AUTHORITY_REGIONAL_READ_ACTIONS = exports.STAGE_AUTHORITY_COST_ANOMALY_WRITE_ACTIONS = exports.STAGE_AUTHORITY_COST_ANOMALY_RESOURCE_WRITE_ACTIONS = exports.STAGE_AUTHORITY_COST_ANOMALY_CREATE_ACTIONS = exports.STAGE_AUTHORITY_COST_ANOMALY_READ_ACTIONS = exports.STAGE_AUTHORITY_KMS_ROTATION_ACTIONS = exports.STAGE_AUTHORITY_RDS_EVENT_SUBSCRIPTION_SOURCE_ACTIONS = exports.STAGE_AUTHORITY_BUDGET_MUTATION_ACTIONS = exports.STAGE_AUTHORITY_EDGE_WAF_LOG_DELIVERY_MUTATION_ACTIONS = exports.STAGE_AUTHORITY_EDGE_WAF_LOG_GROUP_ACTIONS = exports.STAGE_AUTHORITY_WAF_LOGGING_ACTIONS = exports.STAGE_AUTHORITY_CLOUDFRONT_INVALIDATION_ACTIONS = exports.STAGE_AUTHORITY_LAMBDA_DEPLOYMENT_INVOKE_ACTIONS = exports.STAGE_AUTHORITY_EVENT_ARCHIVE_RESOURCE_ACTIONS = exports.STAGE_AUTHORITY_EVENT_ARCHIVE_CREATE_ACTIONS = exports.STAGE_AUTHORITY_CLOUDFORMATION_LIFECYCLE_ACTIONS = exports.STAGE_AUTHORITY_BOUND_TEMPLATE_BODY_MINIMUM_HEADROOM = exports.STAGE_AUTHORITY_TEMPLATE_BODY_BYTE_LIMIT = exports.STAGE_AUTHORITY_MANAGED_POLICY_CHARACTER_HEADROOM = exports.STAGE_AUTHORITY_MANAGED_POLICY_CHARACTER_LIMIT = exports.STAGE_AUTHORITY_DEPLOYMENT_POLICY_KINDS = exports.STAGE_AUTHORITY_PARTITIONS = exports.STAGE_AUTHORITY_STAGES = exports.STAGE_AUTHORITY_SCHEMA_VERSION = void 0;
-exports.STAGE_AUTHORITY_SERVICE_LINKED_ROLES = exports.STAGE_AUTHORITY_UNSUPPORTED_WORKFLOW_EXECUTION_ACTIONS = exports.STAGE_AUTHORITY_NON_DEPLOYMENT_ACCOUNT_AND_DATA_ACTIONS = exports.STAGE_AUTHORITY_UNREVIEWED_PERMISSION_MANAGEMENT_ACTION_PATTERNS = exports.STAGE_AUTHORITY_REVIEWED_PERMISSION_MANAGEMENT_ACTIONS = exports.STAGE_AUTHORITY_S3_BUCKET_POLICY_MUTATION_ACTIONS = exports.STAGE_AUTHORITY_KNOWN_STAGE_MUTATION_ACTIONS = exports.STAGE_AUTHORITY_UNTAGGED_DESTRUCTIVE_ACTIONS = void 0;
+exports.STAGE_AUTHORITY_CROSS_ACCOUNT_MUTATION_ACTIONS = exports.STAGE_AUTHORITY_CROSS_ACCOUNT_EC2_MUTATION_ACTIONS = exports.STAGE_AUTHORITY_SST_417_EXTERNAL_AMI_OWNERS_BY_PARTITION = exports.STAGE_AUTHORITY_CLOUDCONTROL_EDGE_MUTATION_ACTIONS = exports.STAGE_AUTHORITY_SCOPE_GUARD_MUTATION_FAMILIES = exports.STAGE_AUTHORITY_WORKLOAD_IDENTITY_POLICY_ACTIONS = exports.STAGE_AUTHORITY_APPROVED_AWS_MANAGED_POLICIES = exports.STAGE_RUNTIME_REGIONAL_SERVICE_FAMILIES = exports.STAGE_AUTHORITY_LOGS_MUTATION_FAMILIES = exports.STAGE_AUTHORITY_REGIONAL_MUTATION_FAMILIES = exports.STAGE_RUNTIME_GLOBAL_ACTIONS = exports.STAGE_RUNTIME_REGIONAL_ACTIONS = exports.STAGE_AUTHORITY_ACCOUNT_SCOPED_GLOBAL_WRITE_ACTIONS = exports.STAGE_AUTHORITY_GLOBAL_WRITE_ACTIONS = exports.STAGE_AUTHORITY_UNSUPPORTED_REPLICATION_AND_TOPOLOGY_ACTIONS = exports.STAGE_AUTHORITY_WAF_EDGE_MUTATION_ACTIONS = exports.STAGE_AUTHORITY_S3_REGIONAL_MUTATION_ACTIONS = exports.STAGE_AUTHORITY_UNSCOPED_CLOUDFRONT_CREATE_ACTIONS = exports.STAGE_AUTHORITY_REGIONAL_WRITE_ACTIONS = exports.STAGE_AUTHORITY_LAMBDA_INFRASTRUCTURE_ACTIONS = exports.STAGE_AUTHORITY_KMS_INFRASTRUCTURE_ACTIONS = exports.STAGE_AUTHORITY_EC2_INFRASTRUCTURE_ACTIONS = exports.STAGE_AUTHORITY_BACKUP_INFRASTRUCTURE_ACTIONS = exports.STAGE_AUTHORITY_BROAD_REGIONAL_SERVICE_ACTIONS = exports.STAGE_AUTHORITY_EDGE_OBSERVABILITY_READ_ACTIONS = exports.STAGE_AUTHORITY_GLOBAL_READ_ACTIONS = exports.STAGE_AUTHORITY_REGIONAL_READ_ACTIONS = exports.STAGE_AUTHORITY_COST_ANOMALY_WRITE_ACTIONS = exports.STAGE_AUTHORITY_COST_ANOMALY_RESOURCE_WRITE_ACTIONS = exports.STAGE_AUTHORITY_COST_ANOMALY_CREATE_ACTIONS = exports.STAGE_AUTHORITY_COST_ANOMALY_READ_ACTIONS = exports.STAGE_AUTHORITY_KMS_ROTATION_ACTIONS = exports.STAGE_AUTHORITY_RDS_EVENT_SUBSCRIPTION_SOURCE_ACTIONS = exports.STAGE_AUTHORITY_BUDGET_MUTATION_ACTIONS = exports.STAGE_AUTHORITY_EDGE_WAF_LOG_DELIVERY_MUTATION_ACTIONS = exports.STAGE_AUTHORITY_EDGE_WAF_LOG_GROUP_ACTIONS = exports.STAGE_AUTHORITY_WAF_LOGGING_ACTIONS = exports.STAGE_AUTHORITY_CLOUDFRONT_INVALIDATION_ACTIONS = exports.STAGE_AUTHORITY_LAMBDA_DEPLOYMENT_INVOKE_ACTIONS = exports.STAGE_AUTHORITY_EVENT_ARCHIVE_RESOURCE_ACTIONS = exports.STAGE_AUTHORITY_EVENT_ARCHIVE_CREATE_ACTIONS = exports.STAGE_AUTHORITY_CLOUDFORMATION_LIFECYCLE_ACTIONS = exports.STAGE_AUTHORITY_BOUND_TEMPLATE_BODY_MINIMUM_HEADROOM = exports.STAGE_AUTHORITY_TEMPLATE_BODY_BYTE_LIMIT = exports.STAGE_AUTHORITY_MANAGED_POLICY_CHARACTER_HEADROOM = exports.STAGE_AUTHORITY_MANAGED_POLICY_CHARACTER_LIMIT = exports.STAGE_AUTHORITY_DEPLOYMENT_POLICY_KINDS = exports.STAGE_AUTHORITY_PARTITIONS = exports.STAGE_AUTHORITY_STAGES = exports.STAGE_AUTHORITY_SCHEMA_VERSION = void 0;
+exports.STAGE_AUTHORITY_SERVICE_LINKED_ROLES = exports.STAGE_AUTHORITY_UNSUPPORTED_WORKFLOW_EXECUTION_ACTIONS = exports.STAGE_AUTHORITY_NON_DEPLOYMENT_ACCOUNT_AND_DATA_ACTIONS = exports.STAGE_AUTHORITY_UNREVIEWED_PERMISSION_MANAGEMENT_ACTION_PATTERNS = exports.STAGE_AUTHORITY_REVIEWED_PERMISSION_MANAGEMENT_ACTIONS = exports.STAGE_AUTHORITY_S3_BUCKET_POLICY_MUTATION_ACTIONS = exports.STAGE_AUTHORITY_KNOWN_STAGE_MUTATION_ACTIONS = exports.STAGE_AUTHORITY_UNTAGGED_DESTRUCTIVE_ACTIONS = exports.STAGE_AUTHORITY_CROSS_STAGE_DESTRUCTIVE_ACTIONS = void 0;
 exports.createStageAuthorityIdentity = createStageAuthorityIdentity;
 exports.canonicalStageAuthorityTemplate = canonicalStageAuthorityTemplate;
 exports.digestStageAuthorityTemplate = digestStageAuthorityTemplate;
@@ -37,6 +37,10 @@ exports.STAGE_AUTHORITY_TEMPLATE_BODY_BYTE_LIMIT = 51_200;
 exports.STAGE_AUTHORITY_BOUND_TEMPLATE_BODY_MINIMUM_HEADROOM = 1_024;
 const STAGE_AUTHORITY_MAX_AWS_PRINCIPALS = 16;
 const STAGE_AUTHORITY_MAX_AWS_PRINCIPAL_ARN_BYTES = 2_048;
+// IAM glob syntax cannot validate hexadecimal characters. Framework task
+// admission validates exact lowercase hex; this is only a bounded IAM shape.
+const TASK_STAGE_IAM_SHAPE = `personal-${'?'.repeat(24)}`;
+const TASK_PRINCIPAL_STAGE = '${aws:PrincipalTag/ebk:stage}';
 const ACCOUNT_ID = /^\d{12}$/u;
 const REGION = /^(?:(?:af|ap|ca|cn|eu|il|me|mx|sa|us)(?:-(?:gov|iso|isob|isoe|isof))?|eusc-[a-z]{2})-[a-z]+-\d$/u;
 const AWS_PRINCIPAL_ARN = /^arn:(aws|aws-cn|aws-us-gov):iam::(\d{12}):role\/[A-Za-z0-9+=,.@_/-]+$/u;
@@ -419,10 +423,12 @@ exports.STAGE_RUNTIME_REGIONAL_ACTIONS = Object.freeze([
     'dynamodb:BatchWriteItem',
     'dynamodb:ConditionCheckItem',
     'dynamodb:DeleteItem',
+    'dynamodb:DescribeStream',
     'dynamodb:DescribeTable',
     'dynamodb:GetItem',
     'dynamodb:GetRecords',
     'dynamodb:GetShardIterator',
+    'dynamodb:ListStreams',
     'dynamodb:PutItem',
     'dynamodb:Query',
     'dynamodb:Scan',
@@ -582,6 +588,11 @@ exports.STAGE_AUTHORITY_SCOPE_GUARD_MUTATION_FAMILIES = Object.freeze([
         'wafv2:*',
     ]),
 ].sort(compareStrings));
+exports.STAGE_AUTHORITY_CLOUDCONTROL_EDGE_MUTATION_ACTIONS = Object.freeze([
+    'cloudformation:CreateResource',
+    'cloudformation:DeleteResource',
+    'cloudformation:UpdateResource',
+]);
 /** SST 4.17.1 resolves the generated nonproduction VPC's EC2 NAT image from
  * this commercial-partition fck-nat publisher. The generated development
  * bastion reuses that NAT instance, while production uses managed NAT. No
@@ -1002,20 +1013,57 @@ function policy(statements) {
         Version: IAM_POLICY_VERSION,
     };
 }
-function omitPolicyStatementSids(document) {
+function omitPolicyStatementSids(document, compactActions = false) {
     const record = document;
     const statements = record['Statement'];
     if (!Array.isArray(statements)) {
         throw new Error('Stage authority template policy statements are invalid.');
     }
+    const rendered = statements.map((entry) => {
+        if (!entry || typeof entry !== 'object' || Array.isArray(entry)) {
+            throw new Error('Stage authority template policy statement is invalid.');
+        }
+        return Object.fromEntries(Object.entries(entry).filter(([key]) => key !== 'Sid'));
+    });
+    if (!compactActions)
+        return { ...record, Statement: rendered };
+    // Statements with identical effect, resources and conditions differ only in
+    // their positive Action sets. Their union is exactly equivalent; NotAction
+    // statements are deliberately never merged (union would change semantics).
+    const scopes = new Map();
+    const compacted = [];
+    for (const entry of rendered) {
+        if (!Array.isArray(entry['Action'])) {
+            compacted.push(entry);
+            continue;
+        }
+        const { Action, ...scope } = entry;
+        const key = JSON.stringify(scope);
+        const existing = scopes.get(key);
+        if (existing)
+            existing['Action'] = [
+                ...new Set([
+                    ...existing['Action'],
+                    ...Action,
+                ]),
+            ].sort(compareStrings);
+        else {
+            scopes.set(key, entry);
+            compacted.push(entry);
+        }
+    }
+    // IAM accepts a singleton resource as either a string or a one-element
+    // list. Keep the executable model as lists; shorten only the rendered JSON.
     return {
         ...record,
-        Statement: statements.map((entry) => {
-            if (!entry || typeof entry !== 'object' || Array.isArray(entry)) {
-                throw new Error('Stage authority template policy statement is invalid.');
-            }
-            return Object.fromEntries(Object.entries(entry).filter(([key]) => key !== 'Sid'));
-        }),
+        Statement: compacted.map((entry) => Object.fromEntries(Object.entries(entry).map(([key, value]) => [
+            key,
+            ['Resource', 'NotResource'].includes(key) &&
+                Array.isArray(value) &&
+                value.length === 1
+                ? value[0]
+                : value,
+        ]))),
     };
 }
 function replaceExactTemplateString(value, expected, replacement) {
@@ -1031,11 +1079,13 @@ function replaceExactTemplateString(value, expected, replacement) {
         replaceExactTemplateString(entry, expected, replacement),
     ]));
 }
-function compactExactTemplatePolicyStrings(documents, values) {
+function compactExactTemplatePolicyStrings(documents, values, compactLists = false) {
     const constants = {};
     const replacements = new Map();
     for (const value of [...new Set(values)].sort(compareStrings)) {
-        const key = `A${replacements.size}`;
+        const key = compactLists
+            ? replacements.size.toString(36)
+            : `A${replacements.size}`;
         const replacement = Object.freeze({
             'Fn::FindInMap': Object.freeze(['A', 'V', key]),
         });
@@ -1044,10 +1094,98 @@ function compactExactTemplatePolicyStrings(documents, values) {
     }
     if (replacements.size === 0)
         return Object.freeze({ documents });
-    const compactedDocuments = Object.fromEntries(Object.entries(documents).map(([logicalId, document]) => [
+    let compactedDocuments = Object.fromEntries(Object.entries(documents).map(([logicalId, document]) => [
         logicalId,
-        [...replacements.entries()].reduce((current, [arn, replacement]) => replaceExactTemplateString(current, arn, replacement), document),
+        [...replacements.entries()].reduce((current, [literal, replacement]) => replaceExactTemplateString(current, literal, replacement), document),
     ]));
+    if (compactLists) {
+        const counts = new Map();
+        const collect = (value) => {
+            if (Array.isArray(value) &&
+                value.every((entry) => typeof entry === 'string')) {
+                const key = JSON.stringify(value);
+                counts.set(key, (counts.get(key) ?? 0) + 1);
+            }
+            else if (Array.isArray(value))
+                value.forEach(collect);
+            else if (value && typeof value === 'object')
+                Object.values(value).forEach(collect);
+        };
+        collect(compactedDocuments);
+        const listReferences = new Map();
+        for (const [literal, count] of [...counts].sort(([a], [b]) => compareStrings(a, b))) {
+            if ((count - 1) * literal.length <= count * 36 + 24)
+                continue;
+            const key = (replacements.size + listReferences.size).toString(36);
+            constants[key] = JSON.parse(literal);
+            listReferences.set(literal, { 'Fn::FindInMap': ['A', 'V', key] });
+        }
+        const replaceLists = (value) => {
+            if (Array.isArray(value)) {
+                const reference = listReferences.get(JSON.stringify(value));
+                return reference ?? value.map(replaceLists);
+            }
+            if (value && typeof value === 'object')
+                return Object.fromEntries(Object.entries(value).map(([key, entry]) => [
+                    key,
+                    replaceLists(entry),
+                ]));
+            return value;
+        };
+        compactedDocuments = replaceLists(compactedDocuments);
+        // Fn::Split is resolved by CloudFormation before IAM evaluates the
+        // document. Long literal lists can omit JSON's repeated quotes without
+        // introducing wildcards, changing order, or changing a single permission.
+        // Mapping values themselves stay literal (intrinsics are not valid there).
+        const encodeLiteralLists = (value) => {
+            if (Array.isArray(value)) {
+                if (value.every((entry) => typeof entry === 'string' && !entry.includes(','))) {
+                    let encoded = { 'Fn::Split': [',', value.join(',')] };
+                    // Factor only a literal ARN prefix. CloudFormation expands it back
+                    // before IAM sees the list; IAM policy variables must stay literal.
+                    if (value.length > 1 &&
+                        value.every((entry) => entry.startsWith('arn:') && !entry.includes('${'))) {
+                        let prefix = value[0];
+                        for (const entry of value)
+                            while (!entry.startsWith(prefix))
+                                prefix = prefix.slice(0, -1);
+                        const factored = {
+                            'Fn::Split': [
+                                ',',
+                                {
+                                    'Fn::Sub': [
+                                        value
+                                            .map((entry) => '${P}' + entry.slice(prefix.length))
+                                            .join(','),
+                                        { P: prefix },
+                                    ],
+                                },
+                            ],
+                        };
+                        if (JSON.stringify(factored).length < JSON.stringify(encoded).length)
+                            encoded = factored;
+                    }
+                    if (JSON.stringify(encoded).length < JSON.stringify(value).length)
+                        return encoded;
+                }
+                return value.map(encodeLiteralLists);
+            }
+            if (value && typeof value === 'object')
+                return Object.fromEntries(Object.entries(value).map(([key, entry]) => [
+                    key,
+                    encodeLiteralLists(entry),
+                ]));
+            return value;
+        };
+        compactedDocuments = encodeLiteralLists(compactedDocuments);
+    }
+    if (compactLists) {
+        const serialized = JSON.stringify(compactedDocuments);
+        for (const key of Object.keys(constants)) {
+            if (!serialized.includes(JSON.stringify(['A', 'V', key])))
+                delete constants[key];
+        }
+    }
     return Object.freeze({
         documents: Object.freeze(compactedDocuments),
         // These short, template-private identifiers avoid repeating long exact
@@ -1058,13 +1196,35 @@ function compactExactTemplatePolicyStrings(documents, values) {
         }),
     });
 }
+function repeatedDevelopmentPolicyStrings(documents) {
+    const counts = new Map();
+    const visit = (value) => {
+        if (typeof value === 'string')
+            counts.set(value, (counts.get(value) ?? 0) + 1);
+        else if (Array.isArray(value))
+            value.forEach(visit);
+        else if (value && typeof value === 'object')
+            Object.values(value).forEach(visit);
+    };
+    visit(documents);
+    // Exact FindInMap substitution only; admit entries whose repeated bytes pay
+    // for both the mapping and references. No IAM statement semantics change.
+    return [...counts]
+        .filter(([value, count]) => (count - 1) * value.length > count * 36 + 24)
+        .map(([value]) => value);
+}
 function statement(input) {
+    if ((input.Action === undefined) === (input.NotAction === undefined)) {
+        throw new Error('Stage authority statements require exactly one Action or NotAction scope.');
+    }
     if ((input.Resource === undefined) === (input.NotResource === undefined)) {
         throw new Error('Stage authority statements require exactly one Resource or NotResource scope.');
     }
     return {
         ...input,
-        Action: [...input.Action].sort(compareStrings),
+        ...(input.Action
+            ? { Action: [...input.Action].sort(compareStrings) }
+            : { NotAction: [...(input.NotAction ?? [])].sort(compareStrings) }),
         ...(input.Resource
             ? { Resource: [...input.Resource].sort(compareStrings) }
             : {}),
@@ -1177,7 +1337,7 @@ function requireTrust(input, identity) {
     };
 }
 function runtimeBoundaryPolicy(options) {
-    return policy([
+    const statements = [
         statement({
             Action: exports.STAGE_RUNTIME_REGIONAL_ACTIONS,
             Condition: {
@@ -1251,7 +1411,175 @@ function runtimeBoundaryPolicy(options) {
             Resource: ['*'],
             Sid: 'DenyRuntimePrivilegeConstruction',
         }),
-    ]);
+    ];
+    if (options.stage === 'development') {
+        const regionalGuardIndex = statements.findIndex((entry) => entry.Sid === 'DenyRuntimeOutsideStageRegion');
+        const regionalGuard = statements[regionalGuardIndex];
+        if (!regionalGuard?.Action)
+            throw new Error('Runtime Region guard is missing.');
+        // Development has only these global runtime exceptions. Denying every
+        // other action outside the Region preserves all admitted runtime calls
+        // while strengthening the old service-family deny, including AppSync.
+        statements[regionalGuardIndex] = statement({
+            Sid: regionalGuard.Sid,
+            NotAction: [
+                ...exports.STAGE_RUNTIME_GLOBAL_ACTIONS,
+                'iam:PassRole',
+                'sts:GetCallerIdentity',
+            ],
+            Effect: 'Deny',
+            Resource: ['*'],
+            Condition: regionalGuard.Condition,
+        });
+        const privilegeGuard = statements.find((entry) => entry.Sid === 'DenyRuntimePrivilegeConstruction');
+        if (!privilegeGuard?.Action)
+            throw new Error('Runtime privilege guard is missing.');
+        // These deny-only patterns cover every original privilege action and no
+        // admitted runtime action (notably iam:PassRole). Protected stages retain
+        // their byte-identical explicit inventory.
+        privilegeGuard.Action = [
+            'account:*',
+            'iam:*Boundary',
+            'iam:*Policy*',
+            'iam:Create*',
+            'iam:Delete*',
+            'organizations:*',
+            'sts:AssumeRole',
+        ];
+        // Native SST dev uses one untagged account/Region AppSync Events API and
+        // its `sst` namespace. IAM cannot isolate nested task channel paths. This
+        // is a shared development control plane, not an application event bus.
+        // The boundary narrows SST's appsync:* identity grant to transport only.
+        statements.push(...nativeDevelopmentTransportStatements({
+            accountId: options.accountId,
+            partition: options.identity.boundaryArn.split(':')[1],
+            region: options.region,
+            initialize: false,
+        }));
+        const canonicalGuard = statements.find((entry) => entry.Sid === 'DenyRuntimeKnownOtherStageResources');
+        if (!canonicalGuard)
+            throw new Error('Runtime stage guard is missing.');
+        canonicalGuard.Condition = {
+            ...canonicalGuard.Condition,
+            StringEquals: { 'aws:PrincipalTag/ebk:stage': 'development' },
+        };
+        const taskPrincipal = {
+            StringLike: { 'aws:PrincipalTag/ebk:stage': TASK_STAGE_IAM_SHAPE },
+        };
+        const partition = options.identity.boundaryArn.split(':')[1];
+        // Native Lambda creates an untagged ENI against existing Foundation
+        // subnets/security groups. Neither VPCs nor existing shared ENIs are
+        // exempted. Task-owned VPC topology is not generated by this contract.
+        const sharedNetwork = ['subnet', 'security-group'].map((resource) => `arn:${partition}:ec2:${options.region}:${options.accountId}:${resource}/*`);
+        const shared = [
+            `arn:${partition}:events:${options.region}:${options.accountId}:event-bus/foundation-development-FoundationEventBusBus-*`,
+            `arn:${partition}:cognito-idp:${options.region}:${options.accountId}:userpool/*`,
+            ...sharedNetwork,
+        ];
+        const sharedActions = [
+            'ec2:CreateNetworkInterface',
+            'events:PutEvents',
+            ...exports.STAGE_RUNTIME_REGIONAL_ACTIONS.filter((action) => action.startsWith('cognito-idp:')),
+        ];
+        statements.push(statement({
+            Sid: 'DenyRuntimeMissingOrInvalidPrincipalStage',
+            Action: ['*'],
+            Effect: 'Deny',
+            Resource: ['*'],
+            Condition: {
+                StringNotLike: {
+                    'aws:PrincipalTag/ebk:stage': ['development', TASK_STAGE_IAM_SHAPE],
+                },
+            },
+        }), statement({
+            Sid: 'DenyTaskRuntimeOtherTaggedResources',
+            Action: ['*'],
+            Effect: 'Deny',
+            NotResource: shared,
+            Condition: {
+                ...taskPrincipal,
+                Null: { 'aws:ResourceTag/ebk:stage': 'false' },
+                StringNotEquals: {
+                    'aws:ResourceTag/ebk:stage': TASK_PRINCIPAL_STAGE,
+                },
+            },
+        }), ...['ebk:stage', 'ebk:owner'].map((key) => statement({
+            Sid: `DenyTaskRuntimeUnownedShared${key.split(':')[1]}`,
+            Action: ['*'],
+            Effect: 'Deny',
+            Resource: shared,
+            Condition: {
+                StringNotEquals: {
+                    [`aws:ResourceTag/${key}`]: key === 'ebk:stage' ? 'development' : 'foundation',
+                },
+            },
+        })), statement({
+            Sid: 'DenyTaskRuntimeUnlinkedSharedActions',
+            // The boundary is only a ceiling. Existing native link/VPC identity
+            // policies still determine effective permissions. AWS's resource-type
+            // contracts prevent this union from granting cross-service operations.
+            // Shared guards also constrain canonical-development runtime roles to
+            // generated Foundation ownership; protected stages are unchanged.
+            NotAction: sharedActions,
+            Effect: 'Deny',
+            Resource: shared,
+        }), statement({
+            Sid: 'DenyRuntimeUnownedSharedNetworkWorkspace',
+            Action: ['*'],
+            Effect: 'Deny',
+            Resource: sharedNetwork,
+            Condition: {
+                StringNotEquals: {
+                    'aws:ResourceTag/ebk:workspace': "${aws:PrincipalTag/ebk:workspace, ''}",
+                },
+            },
+        }));
+    }
+    // Tagless APIs retain their existing exact native-link identity policies;
+    // this boundary does not pretend unsupported ResourceTag keys are present.
+    return policy(statements);
+}
+function nativeDevelopmentTransportStatements(options) {
+    const api = `arn:${options.partition}:appsync:${options.region}:${options.accountId}:apis/*`;
+    const Condition = {
+        StringEquals: { 'aws:RequestedRegion': options.region },
+    };
+    return [
+        ...(options.initialize
+            ? [
+                statement({
+                    // SST supplies neither tags nor a logging role. AWS has no API-name
+                    // condition for CreateApi, and ListApis requires Resource: *.
+                    Action: ['appsync:CreateApi', 'appsync:ListApis'],
+                    Condition,
+                    Effect: 'Allow',
+                    Resource: ['*'],
+                    Sid: 'InitializeNativeDevelopmentTransport',
+                }),
+            ]
+            : []),
+        statement({
+            Action: [
+                'appsync:EventConnect',
+                ...(options.initialize ? ['appsync:GetApi'] : []),
+            ],
+            ...(options.initialize ? { Condition } : {}),
+            Effect: 'Allow',
+            Resource: [api],
+            Sid: 'ConnectNativeDevelopmentTransport',
+        }),
+        statement({
+            Action: [
+                'appsync:EventPublish',
+                'appsync:EventSubscribe',
+                ...(options.initialize ? ['appsync:CreateChannelNamespace'] : []),
+            ],
+            ...(options.initialize ? { Condition } : {}),
+            Effect: 'Allow',
+            Resource: [`${api}/channelNamespace/sst`],
+            Sid: 'UseNativeDevelopmentNamespace',
+        }),
+    ];
 }
 const SST_4_17_1_PHYSICAL_NAME_RANDOM_SUFFIX_LENGTH = 9;
 const FOUNDATION_ROUTER_CLOUDFRONT_FUNCTION_NAMES = [
@@ -1277,6 +1605,95 @@ function generatedRouterCloudFrontFunctionResources(options, stage) {
         stage,
     })}`).sort(compareStrings);
 }
+/** Expand only existing task-app namespace contracts, never Foundation names. */
+function taskNamespaceResources(resources) {
+    return [
+        ...new Set(resources.flatMap((resource) => {
+            if (/foundation|Foundation|workspace-owner|:rds:|:backup:|:wafv2:|:iam:/u.test(resource))
+                return [resource];
+            let task = resource;
+            if (resource.includes('/sst/passphrase/')) {
+                task = resource.replace(/\/development$/u, `/${TASK_STAGE_IAM_SHAPE}`);
+            }
+            else if (resource.includes(':parameter/*development*')) {
+                // Native task state is not an arbitrary parameter containing "personal".
+                return [
+                    resource,
+                    resource.replace(':parameter/*development*', `:parameter/sst/passphrase/*/${TASK_STAGE_IAM_SHAPE}`),
+                ];
+            }
+            else {
+                task = resource
+                    .replace(/-development-/gu, `-${TASK_STAGE_IAM_SHAPE}-`)
+                    .replace(/\/ebk\/development\//gu, `/ebk/${TASK_STAGE_IAM_SHAPE}/`)
+                    .replace(/:secret:ebk\/development\//gu, `:secret:ebk/${TASK_STAGE_IAM_SHAPE}/`)
+                    .replace(/:alias\/ebk-development-/gu, `:alias/ebk-${TASK_STAGE_IAM_SHAPE}-`);
+            }
+            return task === resource ? [resource] : [resource, task];
+        })),
+    ].sort(compareStrings);
+}
+function admitDevelopmentTaskNamespaces(statements) {
+    const tagged = new Set([
+        'MutateFixedRegionalServiceFamilies',
+        'MutateEdgeCertificates',
+        'DenyExplicitOtherStageRequestTag',
+        'DenyKnownOtherStageResourceMutation',
+        'DescribeOnlyTaggedStageWorkflowExecutions',
+        'DenyWorkflowExecutionReadWithoutStageTag',
+        'StartOnlyTaggedStageWorkflowExecutions',
+        'CreateTaggedMachineAuthorizationStacks',
+        'MutateTaggedMachineAuthorizationStacks',
+        'CreateOnlyAwsResourceKmsGrants',
+        'EnableRotationOnStageKmsKeys',
+        'RetireOnlyTaggedNonProductionKmsKeys',
+        'InvalidateOnlyStageCloudFrontDistributions',
+        'InvokeOnlyStageLambdaFunctions',
+        'AddOnlyReviewedStageLambdaIntegrations',
+        'AddOnlyPublicStageLambdaFunctionUrlAccess',
+        'AddOnlyPublicStageLambdaFunctionUrlInvoke',
+        'RemoveOnlyStageLambdaIntegrations',
+    ]);
+    const named = new Set([
+        'SetOnlyStageQueueAttributes',
+        'DenyQueueAttributeMutationOutsideStage',
+        'SetOnlyStageTopicAttributes',
+        'DenyTopicAttributeMutationOutsideStage',
+        'DenyUntaggedMutationOutsideStageAndSstResources',
+        'DenyBucketPolicyMutationOutsideStageAndSstBootstrap',
+        'DenyUnapprovedSsmValueReads',
+        'DenySecretMetadataUpdateOutsideStageContainers',
+        'DenyEdgeLogGroupMutationOutsideGeneratedStageLogs',
+    ]);
+    for (const sid of new Set([...tagged, ...named])) {
+        if (statements.filter((entry) => entry.Sid === sid).length !== 1) {
+            throw new Error(`Task authority propagation requires exactly one ${sid} statement.`);
+        }
+    }
+    for (const entry of statements) {
+        if (tagged.has(entry.Sid) && entry.Condition) {
+            const conditions = {};
+            for (const [operator, values] of Object.entries(entry.Condition)) {
+                for (const [key, value] of Object.entries(values)) {
+                    const taskTag = ['aws:RequestTag/ebk:stage', 'aws:ResourceTag/ebk:stage'].includes(key) && value === 'development';
+                    const taskOperator = taskTag
+                        ? operator.replace('Equals', 'Like')
+                        : operator;
+                    (conditions[taskOperator] ??= {})[key] = taskTag
+                        ? ['development', TASK_STAGE_IAM_SHAPE]
+                        : value;
+                }
+            }
+            entry.Condition = conditions;
+        }
+        if (named.has(entry.Sid)) {
+            if (entry.Resource)
+                entry.Resource = taskNamespaceResources(entry.Resource);
+            if (entry.NotResource)
+                entry.NotResource = taskNamespaceResources(entry.NotResource);
+        }
+    }
+}
 function deploymentPolicy(options) {
     const edgeRegion = edgeControlRegion(options.partition, options.region);
     const managedPolicies = exports.STAGE_AUTHORITY_APPROVED_AWS_MANAGED_POLICIES.map((name) => `arn:${options.partition}:iam::aws:policy/${name}`);
@@ -1537,7 +1954,23 @@ function deploymentPolicy(options) {
         // action-specific condition key; reviewed generated source is the control
         // for its uninspectable payload, and the request remains edge-Region-bound.
         statement({
-            Action: exports.STAGE_AUTHORITY_EDGE_WAF_LOG_DELIVERY_MUTATION_ACTIONS,
+            Action: [
+                ...exports.STAGE_AUTHORITY_EDGE_WAF_LOG_DELIVERY_MUTATION_ACTIONS,
+                // Cloud Control has no resource-level or TypeName condition support.
+                // Use the caller's temporary session, never a service RoleArn. The
+                // underlying resource operations retain the deployer's guardrails.
+                ...exports.STAGE_AUTHORITY_CLOUDCONTROL_EDGE_MUTATION_ACTIONS,
+                // The ordinary regional read grant already covers a same-Region
+                // deployment. CloudFront still needs these exact reads at the edge
+                // endpoint when application resources live elsewhere.
+                ...(options.region === edgeRegion
+                    ? []
+                    : [
+                        'cloudformation:DescribeType',
+                        'cloudformation:GetResource',
+                        'cloudformation:GetResourceRequestStatus',
+                    ]),
+            ],
             Condition: {
                 StringEquals: { 'aws:RequestedRegion': edgeRegion },
             },
@@ -2313,7 +2746,10 @@ function deploymentPolicy(options) {
             Sid: 'DenyEdgeControlMutationOutsideEdgeRegion',
         }),
         statement({
-            Action: exports.STAGE_AUTHORITY_REGIONAL_MUTATION_FAMILIES,
+            Action: [
+                ...exports.STAGE_AUTHORITY_REGIONAL_MUTATION_FAMILIES.filter((family) => family !== 'cloudformation:*'),
+                ...exports.STAGE_AUTHORITY_CLOUDFORMATION_LIFECYCLE_ACTIONS,
+            ],
             Condition: {
                 StringNotEquals: { 'aws:RequestedRegion': options.region },
             },
@@ -2548,7 +2984,69 @@ function deploymentPolicy(options) {
             Sid: 'DenyProtectedProductionRetentionDeletion',
         }));
     }
-    const groups = [
+    if (options.stage === 'development') {
+        admitDevelopmentTaskNamespaces(statements);
+        const privilege = statements.find(({ Sid }) => Sid === 'DenyAccountAndPrivilegeAdministration');
+        if (!privilege?.Action)
+            throw new Error('Deployment privilege guard is missing.');
+        privilege.Action = privilege.Action.filter((action) => action !== 'sts:AssumeRole');
+        // Native SST EnvFor assumes the SSR dev-server role, not the deployment
+        // identity, for local application code. Preserve every other assumption
+        // deny, protected-stage policy, created-role boundary and trust control.
+        // Native physical names can truncate even the component suffix for long
+        // valid Slice names. Bind purpose by a generated role tag, not that suffix.
+        const nativeWebRoles = [options.identity.workloadRoleArnPattern];
+        statements.push(...Object.entries({
+            Region: ['aws:RequestedRegion', options.region],
+            Session: ['sts:RoleSessionName', 'sst-dev'],
+            Purpose: ['aws:ResourceTag/ebk:dev-runtime', 'web'],
+        }).map(([label, [key, value]]) => statement({
+            Sid: `DenyDevAssume${label}`,
+            Effect: 'Deny',
+            Action: ['sts:AssumeRole'],
+            Resource: nativeWebRoles,
+            // Negated conditions also deny a missing key. Separate statements
+            // encode OR: any invalid attribute blocks an unrelated attached Allow.
+            Condition: { StringNotEquals: { [key]: value } },
+        })), statement({
+            Sid: 'DenyDevAssumeStage',
+            Effect: 'Deny',
+            Action: ['sts:AssumeRole'],
+            Resource: nativeWebRoles,
+            Condition: {
+                StringNotLike: {
+                    'aws:ResourceTag/ebk:stage': ['development', TASK_STAGE_IAM_SHAPE],
+                },
+            },
+        }), statement({
+            Sid: 'AssumeNativeDevelopmentWebRuntime',
+            Effect: 'Allow',
+            Action: ['sts:AssumeRole'],
+            Resource: nativeWebRoles,
+            Condition: {
+                StringEquals: {
+                    'aws:RequestedRegion': options.region,
+                    'sts:RoleSessionName': 'sst-dev',
+                    'aws:ResourceTag/ebk:dev-runtime': 'web',
+                },
+                StringLike: {
+                    'aws:ResourceTag/ebk:stage': ['development', TASK_STAGE_IAM_SHAPE],
+                },
+            },
+        }), statement({
+            Sid: 'DenyAssumptionOutsideNativeDevelopmentWebRuntime',
+            Effect: 'Deny',
+            Action: ['sts:AssumeRole'],
+            NotResource: nativeWebRoles,
+        }));
+        statements.push(...nativeDevelopmentTransportStatements({
+            accountId: options.accountId,
+            partition: options.partition,
+            region: options.region,
+            initialize: true,
+        }));
+    }
+    let groups = [
         {
             kind: 'read',
             logicalId: 'StageDeploymentReadPolicy',
@@ -2562,11 +3060,17 @@ function deploymentPolicy(options) {
                 'DenyWorkflowExecutionReadOutsideAccount',
                 'DenyUnapprovedSsmValueReads',
                 'CreateOnlyAwsResourceKmsGrants',
-                'ManageEdgeWafLogDeliveryControlPlane',
                 'ManageOnlyGeneratedEdgeWafLogGroup',
                 'PutOnlyStageRouterWafLogging',
                 'ReadFixedGlobalServiceFamilies',
                 'ReadFixedRegionalServiceFamilies',
+                ...(options.stage === 'development'
+                    ? [
+                        'InitializeNativeDevelopmentTransport',
+                        'ConnectNativeDevelopmentTransport',
+                        'UseNativeDevelopmentNamespace',
+                    ]
+                    : []),
                 'DenyWorkflowExecutionReadWithoutStageTag',
                 'DescribeOnlyTaggedStageWorkflowExecutions',
                 ...(options.stage === 'production'
@@ -2606,6 +3110,9 @@ function deploymentPolicy(options) {
                 'DenyTopicAttributeMutationOutsideStage',
                 'DenyUnscopedLambdaPermissions',
                 'ManageStageWorkloadIdentities',
+                ...(options.stage === 'development'
+                    ? ['AssumeNativeDevelopmentWebRuntime']
+                    : []),
                 'PassOnlyStageWorkloadRoles',
                 'RemoveOnlyStageLambdaIntegrations',
                 'SetOnlyStageQueueAttributes',
@@ -2617,6 +3124,15 @@ function deploymentPolicy(options) {
             logicalId: 'StageDeploymentGlobalResourceMutationPolicy',
             sids: [
                 'DenyCrossAccountMutationWhenResourceAccountIsKnown',
+                ...(options.stage === 'development'
+                    ? ['DenyRuntimeTrustPolicyMutation']
+                    : []),
+                ...(options.stage === 'development'
+                    ? ['ReadEdgeCertificateControlPlane']
+                    : []),
+                ...(options.stage === 'development'
+                    ? ['ReadEdgeObservabilityControlPlane']
+                    : []),
                 'DenyCrossAccountRunInstancesTargets',
                 'DenyLogsMutationOutsideStageAndEdgeRegions',
                 'DenyRunInstancesFromUnapprovedReferenceOwners',
@@ -2624,6 +3140,7 @@ function deploymentPolicy(options) {
                 'LaunchStageInfrastructureFromApprovedReferences',
                 'MutateAccountCloudFront',
                 'MutateCloudFrontScopeWafInEdgeRegion',
+                'ManageEdgeWafLogDeliveryControlPlane',
                 'MutateFixedGlobalServiceFamilies',
                 'CreateOnlyTaggedStageAccountBudget',
                 'DenyStageAccountBudgetStageTagRemoval',
@@ -2634,6 +3151,9 @@ function deploymentPolicy(options) {
             kind: 'generated-resource-mutation',
             logicalId: 'StageDeploymentGeneratedResourceMutationPolicy',
             sids: [
+                ...(options.stage === 'development'
+                    ? ['DenyKnownOtherStageResourceMutation']
+                    : []),
                 'AddOnlyPublicStageLambdaFunctionUrlAccess',
                 'AddOnlyPublicStageLambdaFunctionUrlInvoke',
                 'CreateOnlyRequiredServiceLinkedRoles',
@@ -2670,11 +3190,15 @@ function deploymentPolicy(options) {
                 'DenyBucketPolicyMutationOutsideStageAndSstBootstrap',
                 'DenyEventArchiveMutationOutsideGeneratedFoundationArchive',
                 'DenyExplicitOtherStageRequestTag',
-                'DenyKnownOtherStageResourceMutation',
+                ...(options.stage === 'development'
+                    ? []
+                    : ['DenyKnownOtherStageResourceMutation']),
                 ...(options.stage !== 'production'
                     ? ['DenyNonProductionDatabaseEventSubscriptionSourceMutation']
                     : []),
-                'DenyRuntimeTrustPolicyMutation',
+                ...(options.stage === 'development'
+                    ? []
+                    : ['DenyRuntimeTrustPolicyMutation']),
                 'DenyUnscopedDatabaseEventSubscriptionSourceMutation',
                 'DenyUntaggedMutationOutsideStageAndSstResources',
             ],
@@ -2741,11 +3265,44 @@ function deploymentPolicy(options) {
                         'DenyS3MutationOutsideStageRegion',
                     ].includes(entry.Sid))
                     .map((entry) => entry.Sid),
-                'ReadEdgeCertificateControlPlane',
-                'ReadEdgeObservabilityControlPlane',
+                ...(options.stage === 'development'
+                    ? []
+                    : ['ReadEdgeCertificateControlPlane']),
+                ...(options.stage === 'development'
+                    ? []
+                    : ['ReadEdgeObservabilityControlPlane']),
             ],
         },
     ];
+    if (options.stage === 'development') {
+        // Co-locate equivalent scopes so rendering can union only their Action
+        // sets. Every statement remains in one existing, attached policy.
+        const relocation = {
+            DenyRuntimeBoundarySubstitution: 'permission-guardrails',
+            DenyDevAssumeRegion: 'regional-mutation',
+            DenyDevAssumeSession: 'regional-mutation',
+            DenyDevAssumePurpose: 'regional-mutation',
+            InvokeOnlyStageLambdaFunctions: 'global-iam-mutation',
+            DenyLogsMutationOutsideStageAndEdgeRegions: 'regional-mutation',
+            DenyRuntimeTrustPolicyMutation: 'read',
+            CreateOnlyGeneratedCloudFrontResources: 'global-resource-mutation',
+            MutateStageBucketsInStageRegion: 'global-resource-mutation',
+        };
+        for (const sid of Object.keys(relocation)) {
+            if (groups.flatMap((group) => group.sids).filter((value) => value === sid)
+                .length !== 1)
+                throw new Error(`Task authority compaction requires exactly one ${sid}.`);
+        }
+        groups = groups.map((group) => ({
+            ...group,
+            sids: [
+                ...group.sids.filter((sid) => !relocation[sid]),
+                ...Object.entries(relocation)
+                    .filter(([, kind]) => kind === group.kind)
+                    .map(([sid]) => sid),
+            ],
+        }));
+    }
     const assigned = new Set(groups.flatMap((group) => group.sids));
     const assignmentCount = groups.reduce((total, group) => total + group.sids.length, 0);
     const unassigned = statements.filter((entry) => !assigned.has(entry.Sid));
@@ -2757,7 +3314,7 @@ function deploymentPolicy(options) {
     }
     return Object.freeze(groups.map((group, index) => {
         const document = policy(statements.filter((entry) => group.sids.includes(entry.Sid)));
-        const characters = JSON.stringify(omitPolicyStatementSids(document)).length;
+        const characters = JSON.stringify(omitPolicyStatementSids(document, options.stage === 'development')).length;
         if (characters >
             exports.STAGE_AUTHORITY_MANAGED_POLICY_CHARACTER_LIMIT -
                 exports.STAGE_AUTHORITY_MANAGED_POLICY_CHARACTER_HEADROOM) {
@@ -2802,7 +3359,7 @@ function createStageAuthorityPlan(input) {
         region: target.region,
         stage: target.stage,
     });
-    const boundaryCharacters = JSON.stringify(omitPolicyStatementSids(boundary)).length;
+    const boundaryCharacters = JSON.stringify(omitPolicyStatementSids(boundary, target.stage === 'development')).length;
     if (boundaryCharacters > exports.STAGE_AUTHORITY_MANAGED_POLICY_CHARACTER_LIMIT) {
         throw new Error(`Stage runtime boundary has ${boundaryCharacters} characters; the IAM managed-policy limit is ${exports.STAGE_AUTHORITY_MANAGED_POLICY_CHARACTER_LIMIT}.`);
     }
@@ -2814,7 +3371,7 @@ function createStageAuthorityPlan(input) {
         stage: target.stage,
     });
     const renderedDeploymentPolicyDocuments = Object.fromEntries(deployment.map((entry) => {
-        let document = replaceExactTemplateString(replaceExactTemplateString(omitPolicyStatementSids(entry.document), identity.boundaryArn, { Ref: 'StageRuntimeBoundary' }), identity.deploymentRoleArn, { 'Fn::GetAtt': ['StageDeploymentRole', 'Arn'] });
+        let document = replaceExactTemplateString(replaceExactTemplateString(omitPolicyStatementSids(entry.document, target.stage === 'development'), identity.boundaryArn, { Ref: 'StageRuntimeBoundary' }), identity.deploymentRoleArn, { 'Fn::GetAtt': ['StageDeploymentRole', 'Arn'] });
         if (entry.logicalId === 'StageDeploymentGlobalIamMutationPolicy') {
             for (const sibling of deployment) {
                 if (sibling.logicalId === entry.logicalId)
@@ -2829,7 +3386,7 @@ function createStageAuthorityPlan(input) {
     const edgeRegion = edgeControlRegion(target.partition, target.region);
     const templatePolicyDocuments = compactExactTemplatePolicyStrings({
         ...renderedDeploymentPolicyDocuments,
-        StageRuntimeBoundary: omitPolicyStatementSids(boundary),
+        StageRuntimeBoundary: omitPolicyStatementSids(boundary, target.stage === 'development'),
     }, [
         identity.workloadRoleArnPattern,
         `arn:${target.partition}:cloudformation:${target.region}:${target.accountId}:stack/*MachineAuthorization*/*`,
@@ -2839,7 +3396,13 @@ function createStageAuthorityPlan(input) {
         `arn:${target.partition}:logs:${edgeRegion}:${target.accountId}:log-group:aws-waf-logs-foundation-${target.stage}-FoundationRouter-*`,
         `arn:${target.partition}:secretsmanager:${target.region}:${target.accountId}:secret:foundation-${target.stage}-FoundationDatabaseProxySecret-*`,
         `arn:${target.partition}:states:${target.region}:${target.accountId}:execution:*:*`,
-    ]);
+        ...(target.stage === 'development'
+            ? repeatedDevelopmentPolicyStrings({
+                ...renderedDeploymentPolicyDocuments,
+                boundary,
+            })
+            : []),
+    ], target.stage === 'development');
     const deploymentPolicyResources = Object.fromEntries(deployment.map((entry) => [
         entry.logicalId,
         {
@@ -2954,11 +3517,34 @@ function installStageIamBoundaryTransforms(input) {
         input.instanceProfileResource === undefined) {
         throw new Error('Stage IAM boundary transforms require the ordinary Pulumi role and instance-profile resource types.');
     }
+    const resourceStage = input.resourceStage ?? input.stage;
+    if (resourceStage !== input.stage &&
+        !(input.stage === 'development' &&
+            /^personal-[a-f0-9]{24}$/u.test(resourceStage))) {
+        throw new Error('IAM resource stage must be canonical or the exact development task.');
+    }
     const contract = createStageIamBoundaryTransformContract(input);
     input.registerTransform(input.roleResource, (value) => {
         const args = requireTransformArgs(value, 'IAM role');
+        let stageTags;
+        if (input.stage === 'development') {
+            const tags = args.tags;
+            if (tags !== undefined &&
+                (!tags ||
+                    typeof tags !== 'object' ||
+                    Array.isArray(tags) ||
+                    ![Object.prototype, null].includes(Object.getPrototypeOf(tags)) ||
+                    Object.values(tags).some((value) => typeof value !== 'string'))) {
+                throw new Error('IAM role stage tags must be a literal string record.');
+            }
+            const literalTags = (tags ?? {});
+            refuseSubstitution(literalTags['ebk:stage'], resourceStage, 'IAM role stage tag');
+            stageTags = { ...literalTags, 'ebk:stage': resourceStage };
+        }
         refuseSubstitution(args.permissionsBoundary, contract.boundaryArn, 'IAM role permissions boundary');
         refuseSubstitution(args.path, contract.rolePath, 'IAM role path');
+        if (stageTags)
+            args.tags = stageTags;
         args.permissionsBoundary = contract.boundaryArn;
         args.path = contract.rolePath;
     });