@empire-builder-kit/nx 1.0.0-rc.4 → 1.0.0-rc.40

package/src/executors/router-waf-rehearsal/schema.json

@@ -0,0 +1,29 @@
+{
+  "$schema": "https://json-schema.org/schema",
+  "version": 2,
+  "title": "Empire Builder Kit Router WAF rehearsal seal",
+  "description": "Attest committed stage authority and the live CloudFront/Web ACL baseline, then run the bounded RateLimitPerIP probe and seal its exact marked WAF sample and metric.",
+  "type": "object",
+  "additionalProperties": false,
+  "properties": {
+    "probeUrl": {
+      "type": "string",
+      "minLength": 9,
+      "maxLength": 2048,
+      "pattern": "^https://[^/?#]+/[a-z0-9]+(?:-[a-z0-9]+)*/api/health$",
+      "description": "Exact HTTPS Router health URL in /<kebab-slice>/api/health form. The host must equal the retained CloudFront DomainName or an exact Alias."
+    },
+    "profile": {
+      "type": "string",
+      "minLength": 1,
+      "maxLength": 128,
+      "description": "Optional invocation-private AWS profile. Local runs may instead inherit the exact AWS_PROFILE; protected GitHub runs use configured OIDC credentials."
+    },
+    "seedProbes": {
+      "type": "boolean",
+      "default": false,
+      "description": "Managed rehearsal from the protected GitHub staging dispatch only: perform the non-allowlisted and managed-rule operator probes from the runner, seed the live evidence, and seal inside the runner's temporary allowlist admission."
+    }
+  },
+  "required": ["probeUrl"]
+}

package/src/executors/secret-initialize/schema.json

@@ -0,0 +1,42 @@
+{
+  "$schema": "https://json-schema.org/schema",
+  "version": 2,
+  "title": "Empire Builder Kit generated secret initializer",
+  "description": "Report or explicitly initialize one declared machine-generated secret without accepting or returning its value.",
+  "type": "object",
+  "additionalProperties": false,
+  "properties": {
+    "apply": {
+      "type": "boolean",
+      "description": "Atomically create the exact declared generated secret and its first version. Defaults to report-only.",
+      "default": false
+    },
+    "expectedRoleArn": {
+      "type": "string",
+      "pattern": "^arn:(aws|aws-us-gov|aws-cn):iam::[0-9]{12}:role/[A-Za-z0-9+=,.@_/-]{1,512}$",
+      "description": "Exact committed stage deployment role expected for a local apply."
+    },
+    "logicalName": {
+      "type": "string",
+      "pattern": "^[A-Za-z][A-Za-z0-9]{0,63}$",
+      "description": "Exact generated secret declaration to initialize."
+    },
+    "profile": {
+      "type": "string",
+      "minLength": 1,
+      "maxLength": 128,
+      "description": "Optional exact AWS shared-config profile; required for a local apply."
+    },
+    "region": {
+      "type": "string",
+      "pattern": "^[a-z]{2}(-gov)?-[a-z]+-[0-9]$",
+      "description": "Exact committed AWS Region. Defaults to AWS_REGION or AWS_DEFAULT_REGION."
+    },
+    "stage": {
+      "type": "string",
+      "enum": ["development", "staging", "production"],
+      "description": "Active canonical stage that owns the generated secret."
+    }
+  },
+  "required": ["logicalName", "stage"]
+}

package/src/executors/secret-initialize/secret-initialize.d.ts

@@ -0,0 +1,34 @@
+import { type ExecutorContext, type PromiseExecutor } from '@nx/devkit';
+import { type DeploymentProfile, type RepositoryOperatingPolicy } from '../../repository-policy/index.js';
+import { type GeneratedSecretInitializationControlPlane, type GeneratedSecretInitializationResult, type SecretMetadataControlPlane } from '../../secrets/index.js';
+import { assertWorkspaceStageOwnershipForWorkspace } from '../../workspace-deployment/index.js';
+export interface SecretInitializeExecutorOptions {
+    apply?: boolean;
+    expectedRoleArn?: string;
+    logicalName: string;
+    profile?: string;
+    region?: string;
+    stage: 'development' | 'production' | 'staging';
+}
+export interface SecretInitializeExecutorDependencies {
+    environment?: NodeJS.ProcessEnv;
+    initializationControlPlane?: GeneratedSecretInitializationControlPlane;
+    metadataControlPlane?: SecretMetadataControlPlane;
+    ownership?: typeof assertWorkspaceStageOwnershipForWorkspace;
+    readJson?: (path: string) => Promise<unknown>;
+    readOperatingPolicy?: (workspaceRoot: string) => RepositoryOperatingPolicy;
+    readPrincipal?: (input: {
+        profile?: string;
+        region: string;
+    }) => Promise<{
+        accountId: string;
+        arn: string;
+    }>;
+}
+export type SecretInitializeApplyAuthority = 'local' | 'none' | 'workflow';
+export declare function assertSecretInitializeApplyAuthority(stage: SecretInitializeExecutorOptions['stage'], apply: boolean, environment: NodeJS.ProcessEnv, deploymentProfile: DeploymentProfile): SecretInitializeApplyAuthority;
+/** Initialize only declared machine-generated containers under protected deploy authority. */
+export declare function initializeProtectedDeploymentSecrets(stage: SecretInitializeExecutorOptions['stage'], context: ExecutorContext, environment: NodeJS.ProcessEnv, dependencies?: SecretInitializeExecutorDependencies): Promise<void>;
+export declare function executeSecretInitialize(options: SecretInitializeExecutorOptions, context: ExecutorContext, dependencies?: SecretInitializeExecutorDependencies): Promise<GeneratedSecretInitializationResult>;
+declare const executor: PromiseExecutor<SecretInitializeExecutorOptions>;
+export default executor;

package/src/executors/secret-initialize/secret-initialize.js

@@ -0,0 +1,297 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.assertSecretInitializeApplyAuthority = assertSecretInitializeApplyAuthority;
+exports.initializeProtectedDeploymentSecrets = initializeProtectedDeploymentSecrets;
+exports.executeSecretInitialize = executeSecretInitialize;
+const client_sts_1 = require("@aws-sdk/client-sts");
+const credential_providers_1 = require("@aws-sdk/credential-providers");
+const devkit_1 = require("@nx/devkit");
+const node_path_1 = require("node:path");
+const index_js_1 = require("../../aws-authority/index.js");
+const identity_js_1 = require("../../aws/identity.js");
+const index_js_2 = require("../../repository-policy/index.js");
+const index_js_3 = require("../../secrets/index.js");
+const generated_aws_control_plane_js_1 = require("../../secrets/generated-aws-control-plane.js");
+const secret_preflight_js_1 = require("../sst-lifecycle/secret-preflight.js");
+const index_js_4 = require("../../workspace-deployment/index.js");
+const allowedOptionKeys = new Set([
+    'apply',
+    'expectedRoleArn',
+    'logicalName',
+    'profile',
+    'region',
+    'stage',
+]);
+const logicalNamePattern = /^[A-Za-z][A-Za-z0-9]{0,63}$/;
+const roleArnPattern = /^arn:(aws|aws-us-gov|aws-cn):iam::\d{12}:role\/[A-Za-z0-9+=,.@_/-]{1,512}$/;
+function partitionForRegion(region) {
+    if (region.startsWith('cn-'))
+        return 'aws-cn';
+    if (region.startsWith('us-gov-'))
+        return 'aws-us-gov';
+    return 'aws';
+}
+function assertOptions(options) {
+    if (typeof options !== 'object' ||
+        options === null ||
+        Object.keys(options).some((key) => !allowedOptionKeys.has(key)) ||
+        (options.apply !== undefined && typeof options.apply !== 'boolean') ||
+        typeof options.logicalName !== 'string' ||
+        !logicalNamePattern.test(options.logicalName) ||
+        (options.profile !== undefined &&
+            (options.profile.trim() !== options.profile ||
+                options.profile.length === 0 ||
+                options.profile.length > 128)) ||
+        (options.region !== undefined &&
+            options.region.trim() !== options.region) ||
+        (options.expectedRoleArn !== undefined &&
+            (!roleArnPattern.test(options.expectedRoleArn) ||
+                options.expectedRoleArn.trim() !== options.expectedRoleArn))) {
+        throw new Error('Generated secret initialization accepts only one exact logical name and value-free authority options.');
+    }
+}
+function resolveSliceRoot(context) {
+    if (!context.projectName) {
+        throw new Error('Generated secret initialization requires the exact Nx Product Slice name.');
+    }
+    const configuredRoot = context.projectsConfigurations?.projects[context.projectName]?.root;
+    if (!configuredRoot) {
+        throw new Error(`Nx project ${context.projectName} does not declare a project root.`);
+    }
+    return (0, node_path_1.isAbsolute)(configuredRoot)
+        ? configuredRoot
+        : (0, node_path_1.join)(context.root, configuredRoot);
+}
+function isNativeDeploymentWorkflow(stage, environment, deploymentProfile) {
+    const repository = environment.GITHUB_REPOSITORY;
+    const ref = `refs/heads/${stage === 'production' ? 'main' : 'develop'}`;
+    const workflow = `${repository}/.github/workflows/deploy.yml@${ref}`;
+    const event = environment.GITHUB_EVENT_NAME;
+    const caller = event === 'push'
+        ? `${repository}/.github/workflows/ci.yml@${ref}`
+        : workflow;
+    return (Boolean(repository) &&
+        environment.GITHUB_ACTIONS === 'true' &&
+        (event === 'workflow_dispatch' ||
+            (event === 'push' && deploymentProfile !== 'starter')) &&
+        environment.GITHUB_REF === ref &&
+        environment.GITHUB_WORKFLOW_REF === caller &&
+        environment.EBK_GITHUB_JOB_WORKFLOW_REF === workflow &&
+        environment.EBK_NX_STAGE_LIFECYCLE === 'github' &&
+        /^[a-f0-9]{40}(?:[a-f0-9]{24})?$/.test(environment.GITHUB_SHA ?? '') &&
+        environment.EBK_SOURCE_COMMIT === environment.GITHUB_SHA);
+}
+function assertSecretInitializeApplyAuthority(stage, apply, environment, deploymentProfile) {
+    if (!apply)
+        return 'none';
+    const repository = environment.GITHUB_REPOSITORY;
+    const branch = stage === 'production' ? 'main' : 'develop';
+    const ref = `refs/heads/${branch}`;
+    const expectedWorkflow = repository
+        ? `${repository}/.github/workflows/secret-initialize.yml@${ref}`
+        : undefined;
+    const exactWorkflow = environment.GITHUB_ACTIONS === 'true' &&
+        environment.GITHUB_EVENT_NAME === 'workflow_dispatch' &&
+        environment.GITHUB_REF === ref &&
+        Boolean(repository) &&
+        environment.GITHUB_WORKFLOW_REF === expectedWorkflow;
+    if (exactWorkflow ||
+        isNativeDeploymentWorkflow(stage, environment, deploymentProfile)) {
+        if (deploymentProfile === 'starter' ||
+            (0, index_js_2.requiresGithubDeployment)(deploymentProfile, stage)) {
+            return 'workflow';
+        }
+        throw new Error(`Generated secret initialization for ${stage} is local-only under the ${deploymentProfile} deployment profile.`);
+    }
+    if ((0, index_js_2.requiresGithubDeployment)(deploymentProfile, stage) ||
+        environment.GITHUB_ACTIONS === 'true') {
+        throw new Error(`Generated secret initialization for ${stage} must run from the exact ${branch}-branch Secret initialize workflow or governed native deployment workflow.`);
+    }
+    return 'local';
+}
+async function readCurrentPrincipal(input) {
+    const client = new client_sts_1.STSClient({
+        ...(input.profile
+            ? { credentials: (0, credential_providers_1.fromIni)({ profile: input.profile }) }
+            : {}),
+        endpoint: (0, identity_js_1.canonicalStsEndpoint)(input.region),
+        region: input.region,
+    });
+    const identity = await client.send(new client_sts_1.GetCallerIdentityCommand({}));
+    if (!identity.Account || !identity.Arn) {
+        throw new Error('Generated secret initialization principal is unavailable.');
+    }
+    return { accountId: identity.Account, arn: identity.Arn };
+}
+async function assertExactPrincipal(input) {
+    const profile = input.profile?.trim() ?? '';
+    if (input.authority === 'local' && profile === '') {
+        throw new Error('Local generated secret initialization requires one exact AWS profile.');
+    }
+    if (input.authority === 'workflow') {
+        if (input.environment.AWS_EXPECTED_ACCOUNT_ID !== input.accountId ||
+            input.environment.AWS_DEPLOY_ROLE_ARN !== input.expectedRoleArn ||
+            !/^\d+$/.test(input.environment.GITHUB_RUN_ID ?? '') ||
+            !/^\d+$/.test(input.environment.GITHUB_RUN_ATTEMPT ?? '')) {
+            throw new Error('Protected generated secret initialization requires the exact committed deployment role and workflow run identity.');
+        }
+    }
+    let principal;
+    try {
+        principal = await (input.readPrincipal ?? readCurrentPrincipal)({
+            ...(input.authority === 'local' ? { profile } : {}),
+            region: input.region,
+        });
+    }
+    catch {
+        throw new Error('Generated secret initialization could not authenticate its AWS principal.');
+    }
+    if (principal.accountId !== input.accountId ||
+        !(0, identity_js_1.matchesExpectedAssumedRoleArn)(input.accountId, principal.arn, input.expectedRoleArn)) {
+        throw new Error('Generated secret initialization is not running in the committed account as the exact temporary stage deployment role.');
+    }
+    if (input.authority === 'workflow') {
+        const prefix = input.environment.GITHUB_WORKFLOW_REF?.includes('/.github/workflows/secret-initialize.yml@')
+            ? 'ebk-secret-initialize'
+            : 'ebk-native';
+        const expectedSession = `${prefix}-${input.environment.GITHUB_RUN_ID}-${input.environment.GITHUB_RUN_ATTEMPT}`;
+        if (!principal.arn.endsWith(`/${expectedSession}`)) {
+            throw new Error('Protected generated secret initialization is not running as the exact reviewed workflow session.');
+        }
+    }
+}
+/** Initialize only declared machine-generated containers under protected deploy authority. */
+async function initializeProtectedDeploymentSecrets(stage, context, environment, dependencies = {}) {
+    const project = context.projectsConfigurations?.projects[context.projectName ?? ''];
+    if (!project?.tags?.includes('type:slice'))
+        return;
+    const policy = (dependencies.readOperatingPolicy ?? index_js_2.readRepositoryOperatingPolicy)(context.root);
+    if (!isNativeDeploymentWorkflow(stage, environment, policy.deploymentProfile)) {
+        throw new Error('Automatic generated-secret initialization requires the exact native deployment workflow and source.');
+    }
+    const loaded = await (0, secret_preflight_js_1.loadSliceSecretMetadata)({
+        context,
+        cwd: resolveSliceRoot(context),
+        stage,
+        ...(dependencies.readJson ? { readJson: dependencies.readJson } : {}),
+    });
+    for (const declaration of loaded.declarations) {
+        if (declaration.source !== 'generated' ||
+            !declaration.requiredStages.includes(stage))
+            continue;
+        const result = await executeSecretInitialize({
+            apply: true,
+            logicalName: declaration.logicalName,
+            stage,
+            region: (0, index_js_2.configuredDeploymentRegion)(policy.deploymentRegion),
+        }, context, { ...dependencies, environment });
+        if (result.outcome !== 'applied' && result.outcome !== 'unchanged') {
+            throw new Error(`Generated secret initialization blocked ${context.projectName}/${declaration.logicalName}; run the stage Secret initialize report and resolve its metadata findings before retrying deployment.`);
+        }
+    }
+}
+async function executeSecretInitialize(options, context, dependencies = {}) {
+    assertOptions(options);
+    const environment = dependencies.environment ?? process.env;
+    const policy = (dependencies.readOperatingPolicy ?? index_js_2.readRepositoryOperatingPolicy)(context.root);
+    if (!(0, index_js_2.isActiveDeploymentStage)(policy.deploymentProfile, options.stage)) {
+        throw new Error(`Generated secret initialization stage ${options.stage} is inactive for the ${policy.deploymentProfile} deployment profile.`);
+    }
+    const aws = (0, secret_preflight_js_1.resolveSecretAwsContext)(options, environment);
+    const region = (0, index_js_2.configuredDeploymentRegion)(policy.deploymentRegion);
+    if (aws.region !== region) {
+        throw new Error(`Generated secret initialization requires committed deployment Region ${region}.`);
+    }
+    const accountId = (0, index_js_2.configuredDeploymentAccountForStage)(policy.deploymentProfile, policy.deploymentAccounts, options.stage);
+    const expectedRoleArn = (0, index_js_1.createStageAuthorityIdentity)({
+        accountId,
+        partition: partitionForRegion(region),
+        region,
+        stage: options.stage,
+    }).deploymentRoleArn;
+    if (options.expectedRoleArn !== undefined &&
+        options.expectedRoleArn !== expectedRoleArn) {
+        throw new Error(`Generated secret initialization requires the exact committed ${options.stage} stage authority role ${expectedRoleArn}.`);
+    }
+    const apply = options.apply === true;
+    const authority = assertSecretInitializeApplyAuthority(options.stage, apply, environment, policy.deploymentProfile);
+    if (authority === 'local') {
+        if (options.expectedRoleArn !== expectedRoleArn) {
+            throw new Error(`Local generated secret initialization requires the exact committed ${options.stage} stage authority role ${expectedRoleArn}.`);
+        }
+        await assertExactPrincipal({
+            accountId,
+            authority,
+            environment,
+            expectedRoleArn,
+            ...(aws.profile ? { profile: aws.profile } : {}),
+            readPrincipal: dependencies.readPrincipal,
+            region,
+        });
+    }
+    else if (authority === 'workflow') {
+        if (options.profile !== undefined ||
+            options.expectedRoleArn !== undefined) {
+            throw new Error('Protected generated secret initialization uses only its exact OIDC workflow authority.');
+        }
+        await assertExactPrincipal({
+            accountId,
+            authority,
+            environment,
+            expectedRoleArn,
+            readPrincipal: dependencies.readPrincipal,
+            region,
+        });
+    }
+    if (apply) {
+        await (dependencies.ownership ?? index_js_4.assertWorkspaceStageOwnershipForWorkspace)(context.root, options.stage, {
+            ...(environment.AWS_CONFIG_FILE
+                ? { configFilepath: environment.AWS_CONFIG_FILE }
+                : {}),
+            ...(environment.AWS_SHARED_CREDENTIALS_FILE
+                ? {
+                    credentialsFilepath: environment.AWS_SHARED_CREDENTIALS_FILE,
+                }
+                : {}),
+            ...(aws.profile ? { profile: aws.profile } : {}),
+        });
+    }
+    const loaded = await (0, secret_preflight_js_1.loadSliceSecretMetadata)({
+        context,
+        cwd: resolveSliceRoot(context),
+        ...(dependencies.readJson ? { readJson: dependencies.readJson } : {}),
+        stage: options.stage,
+    });
+    const metadataControlPlane = dependencies.metadataControlPlane ?? (0, secret_preflight_js_1.createSecretMetadataControlPlane)(aws);
+    const initializationControlPlane = dependencies.initializationControlPlane ??
+        (0, generated_aws_control_plane_js_1.createAwsGeneratedSecretInitializationControlPlane)({
+            clientConfiguration: (0, secret_preflight_js_1.secretMetadataClientConfiguration)(aws),
+        });
+    return (0, index_js_3.runGeneratedSecretInitializer)({
+        declarations: loaded.declarations,
+        initializationControlPlane,
+        logicalName: options.logicalName,
+        metadataControlPlane,
+        mode: apply ? 'apply' : 'report',
+        scope: loaded.scope,
+    });
+}
+const executor = async (options, context) => {
+    try {
+        const result = await executeSecretInitialize(options, context);
+        devkit_1.logger.info(`[secret-initialize] ${result.mode} ${result.outcome}\n${JSON.stringify(result, null, 2)}`);
+        return {
+            success: result.outcome === 'applied' ||
+                result.outcome === 'reported' ||
+                result.outcome === 'unchanged',
+        };
+    }
+    catch (error) {
+        devkit_1.logger.error(error instanceof Error
+            ? error.message
+            : 'Generated secret initialization failed.');
+        return { success: false };
+    }
+};
+exports.default = executor;
+//# sourceMappingURL=secret-initialize.js.map

package/src/executors/secret-metadata/schema.json

@@ -11,6 +11,11 @@
       "description": "Apply only the reported empty-container and tag mutations. Defaults to report-only.",
       "default": false
     },
+    "expectedRoleArn": {
+      "type": "string",
+      "pattern": "^arn:(aws|aws-us-gov|aws-cn):iam::[0-9]{12}:role/[A-Za-z0-9+=,.@_/-]{1,512}$",
+      "description": "Exact temporary assumed IAM role expected for a deployment-profile-admitted local protected-stage apply."
+    },
     "profile": {
       "type": "string",
       "minLength": 1,

package/src/executors/secret-metadata/secret-metadata.d.ts

@@ -1,7 +1,10 @@
 import { type ExecutorContext, type PromiseExecutor } from '@nx/devkit';
 import { type SecretMetadataControlPlane, type SecretMetadataOperatorResult } from '../../secrets/index.js';
+import { type DeploymentProfile, type RepositoryOperatingPolicy } from '../../repository-policy/index.js';
+import { assertWorkspaceStageOwnershipForWorkspace } from '../../workspace-deployment/index.js';
 export interface SecretMetadataExecutorOptions {
     apply?: boolean;
+    expectedRoleArn?: string;
     profile?: string;
     region?: string;
     stage: 'development' | 'production' | 'staging';
@@ -9,6 +12,7 @@ export interface SecretMetadataExecutorOptions {
 export interface SecretMetadataExecutorDependencies {
     controlPlane?: SecretMetadataControlPlane;
     environment?: NodeJS.ProcessEnv;
+    ownership?: typeof assertWorkspaceStageOwnershipForWorkspace;
     readPrincipal?: (input: {
         profile?: string;
         region: string;
@@ -17,16 +21,26 @@ export interface SecretMetadataExecutorDependencies {
         arn: string;
     }>;
     readJson?: (path: string) => Promise<unknown>;
+    readOperatingPolicy?: (workspaceRoot: string) => RepositoryOperatingPolicy;
 }
-export declare function assertSecretMetadataApplyAuthority(stage: SecretMetadataExecutorOptions['stage'], apply: boolean, environment?: NodeJS.ProcessEnv): void;
+type SecretMetadataApplyAuthority = 'none' | 'workflow' | 'local';
+export declare function assertSecretMetadataApplyAuthority(stage: SecretMetadataExecutorOptions['stage'], apply: boolean, environment?: NodeJS.ProcessEnv, deploymentProfile?: DeploymentProfile): SecretMetadataApplyAuthority;
 export declare function assertProtectedSecretMetadataPrincipal(input: {
+    accountId: string;
     apply: boolean;
     environment: NodeJS.ProcessEnv;
-    profile?: string;
+    expectedRoleArn: string;
     readPrincipal?: SecretMetadataExecutorDependencies['readPrincipal'];
     region: string;
     stage: SecretMetadataExecutorOptions['stage'];
 }): Promise<void>;
+export declare function assertLocalSecretMetadataPrincipal(input: {
+    accountId: string;
+    expectedRoleArn?: string;
+    profile?: string;
+    readPrincipal?: SecretMetadataExecutorDependencies['readPrincipal'];
+    region: string;
+}): Promise<void>;
 export declare function executeSecretMetadata(options: SecretMetadataExecutorOptions, context: ExecutorContext, dependencies?: SecretMetadataExecutorDependencies): Promise<SecretMetadataOperatorResult>;
 declare const executor: PromiseExecutor<SecretMetadataExecutorOptions>;
 export default executor;