@empire-builder-kit/nx 1.0.0-rc.4 → 1.0.0-rc.40

package/src/generators/preset/workspace-files-workload-role-baseline.js

@@ -39,7 +39,15 @@ The ordinary deployment policy is not promoted until every project provisioner
 returns a sanitized, exact registration. It contains only exact registration
 reads, qualified provisioner observation/invocation, and exact
 service-conditioned \`iam:PassRole\`. It contains no direct role, trust, inline
-policy, tag, boundary, or delete mutation.
+policy, tag, boundary, or delete mutation. A separate protected CloudFormation
+stack shards this authority into exact managed-policy documents within AWS's
+6,144-character document and attachment limits; the account-baseline stack
+never removes the active deployment authority during convergence.
+
+Each provisioner invocation is synchronous and may consume the fixed 900-second
+Lambda timeout for a large stage. The publisher therefore sets the AWS CLI read
+timeout to 910 seconds instead of inheriting the 60-second default; Lambda still
+bounds server execution, and any timeout fails the publication before promotion.
 
 ## Candidate bundle and first-stage bootstrap
 
@@ -57,7 +65,8 @@ phases because Slice intent depends on outputs created by Foundation:
 1. Run \`foundation-bootstrap\` report mode. This fixed phase emits Foundation
    only; it is not a generic project filter.
 2. Review and apply that Foundation-only publication, then deploy Foundation
-   with the same candidate identity. Bootstrap apply proves both the baseline
+   with the same candidate identity through the root \`deploy-local\` target's exact
+   \`--phase=foundation-bootstrap\` mode. Bootstrap apply proves both the baseline
    stack and Foundation workload-role pointer are absent before any mutation,
    then uses create-only stack semantics so a concurrent bootstrap cannot win a
    check/use race. It cannot shrink or replace an existing stage boundary.
@@ -67,16 +76,31 @@ phases because Slice intent depends on outputs created by Foundation:
 4. Review and apply the full-stage publication before deploying any Slice.
    Every later publication uses \`full-stage\`; bootstrap reuse fails closed.
 
-If initial bootstrap fails after its create-only stack succeeds but before the
-Foundation pointer is promoted, do not bypass the one-time check. The external
-account-baseline owner must inspect the failed stack and retained state, remove
-that incomplete bootstrap explicitly, and restart from the same reviewed
-candidate. A successful or ambiguous bootstrap is never reset for convenience.
+If Foundation deployment fails after bootstrap has published its account
+baseline, do not delete the baseline or bypass the one-time check. Inspect the
+retained Foundation state, generate a repaired Foundation-only candidate, and
+rerun the publisher with the exact independently reviewed prior candidate,
+manifest digest, history digest, and history document. Recovery revalidates the
+existing stack, protected pointer, and live history before rebinding the same
+baseline. A stable \`UPDATE_ROLLBACK_COMPLETE\` stack is eligible for this exact
+recovery because CloudFormation has restored the prior template; in-progress or
+failed rollback states remain ineligible. Missing, ambiguous, or substituted
+authority still fails closed. Foundation-only recovery also requires the exact
+Foundation-only stack inventory; after any Slice baseline exists, rebind the
+complete candidate through \`full-stage\` and never shrink the stack through
+bootstrap recovery.
+
+If the create-only baseline stack exists but the Foundation SSM pointer and
+history object are both absent, bootstrap stopped before authority promotion.
+Do not rerun bootstrap or synthesize either record. Inspect the exact
+Foundation-only stack, remove that incomplete bootstrap through the reviewed
+CloudFormation recovery procedure, prove the stack and history key absent, and
+then restart the two-phase bootstrap with a new candidate.
 
 \`\`\`bash
 pnpm nx run ${options.name}:workload-role-candidate-report -- \\
   --phase=foundation-bootstrap \\
-  --candidate=<reviewed-candidate> \\
+  --candidate=<reviewed-source-commit> \\
   --stage=staging \\
   --region=us-east-1 \\
   > /path/outside-the-checkout/staging-foundation-workload-roles.json
@@ -84,7 +108,7 @@ pnpm nx run ${options.name}:workload-role-candidate-report -- \\
 # After Foundation publication and deployment:
 pnpm nx run ${options.name}:workload-role-candidate-report -- \\
   --phase=full-stage \\
-  --candidate=<same-reviewed-candidate> \\
+  --candidate=<same-reviewed-source-commit> \\
   --stage=staging \\
   --region=us-east-1 \\
   > /path/outside-the-checkout/staging-workload-roles.json
@@ -100,7 +124,7 @@ principal returned by \`aws sts get-caller-identity\`:
 node tools/workload-role-baseline/publish.mjs \\
   --documents=/path/outside-the-checkout/staging-workload-roles.json \\
   --phase=full-stage \\
-  --candidate=<reviewed-candidate> \\
+  --candidate=<reviewed-source-commit> \\
   --stage=staging \\
   --account=<12-digit-account> \\
   --partition=aws \\
@@ -125,7 +149,11 @@ documents and digest entries. When a full-stage candidate drops or renames an
 active role, the report adds only the exact retired role and NAT profile ARNs
 to temporary provisioner authority. It rejects stale, cross-stage,
 cross-project, or unreviewed history and never uses a wildcard. Bootstrap
-rejects all prior-history input.
+without prior history is create-only. After an interrupted Foundation deploy,
+the same Foundation-only phase accepts one exact reviewed prior history to
+rebind the existing account baseline to a repaired candidate; apply first
+requires the exact existing stack, protected pointer, and live history to
+match that independently reviewed authority.
 
 Review both deterministic templates, the exact resource inventory, boundary
 digest, and boundary character count. The transitional template contains only
@@ -155,7 +183,8 @@ aggregate boundary first, stores every
 reviewed document with explicit AES-256 encryption, invokes each
 candidate-qualified alias, validates all sanitized results, reapplies the
 settled baseline to remove transition authority, replaces the one exact
-deployment inline policy, and finally switches each protected SSM pointer. A
+deployment managed-policy stack, removes the legacy inline policy only after
+the managed stack succeeds, and finally switches each protected SSM pointer. A
 failure before the final three steps leaves ordinary deployment unpromoted.
 Investigate and rerun the same immutable candidate; never widen the policy,
 skip a Slice, substitute a digest, or invoke an unqualified function.
@@ -603,7 +632,11 @@ import { join } from 'node:path';
 import { spawnSync } from 'node:child_process';
 import {
   createWorkloadRoleStageAccountBaselinePlan,
+  digestWorkloadRoleHistory,
   publishReviewedStageWorkloadRoleCandidate,
+  requireWorkloadRoleHistory,
+  requireWorkloadRoleStorageRegistration,
+  workloadRoleHistoryObjectKey,
 } from '@empire-builder-kit/nx/workload-roles';
 import {
   discoverWorkloadRoleCandidateProjects,
@@ -787,14 +820,9 @@ if (
 ) {
   throw new Error('--prior and --prior-histories must be supplied together.');
 }
-if (
+const foundationRecovery =
   publicationPhase === 'foundation-bootstrap' &&
-  expectedPriorHistories !== undefined
-) {
-  throw new Error(
-    'Foundation bootstrap cannot carry prior workload-role history.',
-  );
-}
+  expectedPriorHistories !== undefined;
 const plan = createWorkloadRoleStageAccountBaselinePlan({
   code: {
     bucketName: required(
@@ -857,6 +885,7 @@ const report = {
   stage: plan.stage,
   stateBucketName: plan.stateBucketName,
   publicationPhase,
+  foundationRecovery,
   settledTemplate: plan.settledCloudFormationTemplate,
   transitionalTemplate: plan.transitionalCloudFormationTemplate,
   transitionalInstanceProfileArns: plan.transitionalInstanceProfileArns,
@@ -864,7 +893,7 @@ const report = {
 };
 
 if (args.apply !== true) {
-  process.stdout.write(JSON.stringify(report, null, 2) + '\\n');
+  writeFileSync(1, JSON.stringify(report, null, 2) + '\\n');
   process.exit(0);
 }
 if (
@@ -920,6 +949,155 @@ function requireAwsResourceAbsent(command, commandArgs, absentPattern, label) {
   }
 }
 
+function awsToFile(command, commandArgs, outputPath) {
+  const response = spawnSync(
+    'aws',
+    [command, ...commandArgs, '--region', plan.region, outputPath],
+    {
+      encoding: 'utf8',
+      maxBuffer: 4 * 1024 * 1024,
+      shell: false,
+    },
+  );
+  if (response.status !== 0) {
+    throw new Error(
+      'Protected AWS read failed: ' +
+        command +
+        ' (' +
+        String(response.status) +
+        ').',
+    );
+  }
+}
+
+function requireFoundationRecoveryAuthority(foundation) {
+  const expectation = expectedPriorHistories?.foundation;
+  const reviewed = reviewedPriorHistories?.foundation;
+  if (!expectation || reviewed === undefined) {
+    throw new Error('Foundation recovery prior authority is absent.');
+  }
+  const stacks = JSON.parse(
+    aws('cloudformation', [
+      'describe-stacks',
+      '--stack-name',
+      plan.stackName,
+      '--output',
+      'json',
+    ]),
+  ).Stacks;
+  const stableRecoveryStatuses = new Set([
+    'CREATE_COMPLETE',
+    'UPDATE_COMPLETE',
+    'UPDATE_ROLLBACK_COMPLETE',
+  ]);
+  if (
+    !Array.isArray(stacks) ||
+    stacks.length !== 1 ||
+    stacks[0]?.StackName !== plan.stackName ||
+    !stableRecoveryStatuses.has(stacks[0]?.StackStatus)
+  ) {
+    throw new Error('Foundation recovery baseline stack authority differs.');
+  }
+  const currentResources = JSON.parse(
+    aws('cloudformation', [
+      'list-stack-resources',
+      '--stack-name',
+      plan.stackName,
+      '--output',
+      'json',
+    ]),
+  ).StackResourceSummaries;
+  const expectedResources = Object.entries(
+    plan.settledCloudFormationTemplate.Resources,
+  )
+    .map(([logicalResourceId, resource]) => ({
+      logicalResourceId,
+      resourceType: resource.Type,
+    }))
+    .sort((left, right) =>
+      left.logicalResourceId < right.logicalResourceId
+        ? -1
+        : left.logicalResourceId > right.logicalResourceId
+          ? 1
+          : 0,
+    );
+  const observedResources = Array.isArray(currentResources)
+    ? currentResources
+        .map((resource) => ({
+          logicalResourceId: resource?.LogicalResourceId,
+          resourceType: resource?.ResourceType,
+        }))
+        .sort((left, right) => {
+          const leftId = String(left.logicalResourceId);
+          const rightId = String(right.logicalResourceId);
+          return leftId < rightId ? -1 : leftId > rightId ? 1 : 0;
+        })
+    : [];
+  if (JSON.stringify(observedResources) !== JSON.stringify(expectedResources)) {
+    throw new Error(
+      'Foundation recovery requires an exact Foundation-only baseline inventory; use full-stage publication after any Slice baseline exists.',
+    );
+  }
+  const parameter = JSON.parse(
+    aws('ssm', [
+      'get-parameter',
+      '--name',
+      foundation.storageParameterName,
+      '--output',
+      'json',
+    ]),
+  ).Parameter;
+  let storage;
+  try {
+    storage = requireWorkloadRoleStorageRegistration(
+      JSON.parse(parameter?.Value ?? ''),
+    );
+  } catch {
+    throw new Error('Foundation recovery storage authority is malformed.');
+  }
+  if (
+    parameter?.Name !== foundation.storageParameterName ||
+    parameter?.Type !== 'String' ||
+    storage.bucketName !== plan.stateBucketName ||
+    storage.candidateIdentity !== expectation.candidateIdentity ||
+    storage.manifestDigest !== expectation.manifestDigest ||
+    storage.project !== 'foundation' ||
+    storage.stage !== plan.stage
+  ) {
+    throw new Error('Foundation recovery storage authority differs.');
+  }
+  const historyPath = join(scratch, 'foundation-prior-history.json');
+  awsToFile(
+    's3api',
+    [
+      'get-object',
+      '--bucket',
+      plan.stateBucketName,
+      '--key',
+      workloadRoleHistoryObjectKey(plan.stage, 'foundation'),
+    ],
+    historyPath,
+  );
+  let currentHistory;
+  let reviewedHistory;
+  try {
+    currentHistory = requireWorkloadRoleHistory(
+      JSON.parse(readFileSync(historyPath, 'utf8')),
+    );
+    reviewedHistory = requireWorkloadRoleHistory(reviewed);
+  } catch {
+    throw new Error('Foundation recovery history authority is malformed.');
+  }
+  if (
+    currentHistory.currentCandidateIdentity !== expectation.candidateIdentity ||
+    currentHistory.currentManifestDigest !== expectation.manifestDigest ||
+    digestWorkloadRoleHistory(currentHistory) !== expectation.historyDigest ||
+    JSON.stringify(currentHistory) !== JSON.stringify(reviewedHistory)
+  ) {
+    throw new Error('Foundation recovery history authority differs.');
+  }
+}
+
 try {
   const caller = JSON.parse(
     aws('sts', ['get-caller-identity', '--output', 'json']),
@@ -954,18 +1132,22 @@ try {
         'Foundation bootstrap project set was substituted.',
       );
     }
-    requireAwsResourceAbsent(
-      'cloudformation',
-      ['describe-stacks', '--stack-name', plan.stackName],
-      /does not exist/i,
-      'the workload-role account-baseline stack',
-    );
-    requireAwsResourceAbsent(
-      'ssm',
-      ['get-parameter', '--name', foundation.storageParameterName],
-      /ParameterNotFound/,
-      'the Foundation workload-role pointer',
-    );
+    if (foundationRecovery) {
+      requireFoundationRecoveryAuthority(foundation);
+    } else {
+      requireAwsResourceAbsent(
+        'cloudformation',
+        ['describe-stacks', '--stack-name', plan.stackName],
+        /does not exist/i,
+        'the workload-role account-baseline stack',
+      );
+      requireAwsResourceAbsent(
+        'ssm',
+        ['get-parameter', '--name', foundation.storageParameterName],
+        /ParameterNotFound/,
+        'the Foundation workload-role pointer',
+      );
+    }
   }
 
   let baselineApplications = 0;
@@ -978,6 +1160,7 @@ try {
       });
       if (
         publicationPhase === 'foundation-bootstrap' &&
+        !foundationRecovery &&
         baselineApplications === 0
       ) {
         aws('cloudformation', [
@@ -1042,6 +1225,8 @@ try {
           functionArn,
           '--invocation-type',
           'RequestResponse',
+          '--cli-read-timeout',
+          '910',
           '--cli-binary-format',
           'raw-in-base64-out',
           '--payload',
@@ -1057,20 +1242,47 @@ try {
       return JSON.parse(readFileSync(outputPath, 'utf8'));
     },
     async putDeploymentRolePolicy(input) {
-      const path = join(scratch, 'deployment-policy.json');
-      writeFileSync(path, JSON.stringify(input.policy), {
+      const path = join(scratch, 'deployment-policy-stack.json');
+      writeFileSync(path, JSON.stringify(input.template), {
         encoding: 'utf8',
         mode: 0o600,
       });
-      aws('iam', [
-        'put-role-policy',
-        '--role-name',
-        input.roleName,
-        '--policy-name',
-        input.policyName,
-        '--policy-document',
-        'file://' + path,
+      aws('cloudformation', [
+        'deploy',
+        '--template-file',
+        path,
+        '--stack-name',
+        input.stackName,
+        '--capabilities',
+        'CAPABILITY_NAMED_IAM',
+        '--no-fail-on-empty-changeset',
       ]);
+      const inlinePolicyNames = JSON.parse(
+        aws('iam', [
+          'list-role-policies',
+          '--role-name',
+          input.roleName,
+          '--output',
+          'json',
+        ]),
+      ).PolicyNames;
+      if (
+        !Array.isArray(inlinePolicyNames) ||
+        inlinePolicyNames.some(
+          (name) => typeof name !== 'string' || name.length === 0,
+        )
+      ) {
+        throw new Error('Deployment role inline policy inventory is invalid.');
+      }
+      if (inlinePolicyNames.includes(input.policyName)) {
+        aws('iam', [
+          'delete-role-policy',
+          '--role-name',
+          input.roleName,
+          '--policy-name',
+          input.policyName,
+        ]);
+      }
     },
     async putStoragePointer(input) {
       aws('ssm', [

package/src/generators/preset/workspace-files.d.ts

@@ -1,7 +1,23 @@
 import { type FoundationOwnershipRecord, type WorkspaceOwnershipRecord } from '../../ownership/index.js';
+import { type DeliveryLane, type ProductionApprovalMode, type ConfiguredDeploymentAccounts, type DeploymentProfile } from '../../repository-policy/index.js';
 export interface WorkspaceFileOptions {
+    /** Prior managed declaration: upgrades retain every already-declared resource. */
+    foundationDescriptor?: unknown;
+    /** Validated requirements are unioned before any generated file is written. */
+    foundationRequirements?: readonly unknown[];
+    /** trunk (starter only) protects main alone and delivers production from
+     * every merged main push; protected-pair keeps develop and main. */
+    deliveryLane?: DeliveryLane;
+    dependencyOverrides?: unknown;
+    deploymentAccounts?: ConfiguredDeploymentAccounts;
+    deploymentProfile?: DeploymentProfile;
+    deploymentRegion?: string | null;
     frameworkVersion: string;
     name: string;
+    /** Committed productionApproval.mode; trunk-promotion changes the generated
+     * deploy workflow and drops the sync-back workflow. */
+    productionApprovalMode?: ProductionApprovalMode;
+    workspaceDeploymentId?: string;
 }
 export declare const BLUEPRINT_TRUST_AUTHORITY_PATH: "tools/blueprint-trust-check.mjs";
 export declare function isRawWorkspaceAuthorityPath(path: string): boolean;
@@ -14,9 +30,9 @@ export interface PlanProviderRefreshPolicyStatement {
     Resource: string | readonly string[];
     Sid: string;
 }
-export declare function validatePlanProviderRefreshPolicy(value: unknown, region: string, account: string): PlanProviderRefreshPolicyStatement[];
+export declare function validatePlanProviderRefreshPolicy(value: unknown, region: string, account: string, stage: 'production' | 'staging'): PlanProviderRefreshPolicyStatement[];
 export declare const WORKSPACE_PACKAGE_MANAGED_JSON_POINTERS: readonly ["/devDependencies/eslint-plugin-jsx-a11y", "/devDependencies/vitest", "/engines/node", "/engines/pnpm", "/packageManager"];
-export declare const WORKSPACE_PROJECT_MANAGED_JSON_POINTERS: readonly ["/name", "/$schema", "/projectType", "/root", "/tags", "/targets/blueprint-trust-check", "/targets/blueprint-trust-check-protected", "/targets/developer-context", "/targets/deployment-plan", "/targets/dev", "/targets/dev-doctor", "/targets/dev-setup", "/targets/github-bootstrap", "/targets/install-git-hooks", "/targets/supply-chain-check", "/targets/supply-chain-check-protected", "/targets/supply-chain-scan", "/targets/verify", "/targets/work-markers", "/targets/workload-role-candidate-report", "/targets/workload-role-provisioner-build", "/targets/workspace-health"];
+export declare const WORKSPACE_PROJECT_MANAGED_JSON_POINTERS: readonly ["/name", "/$schema", "/projectType", "/root", "/tags", "/targets/blueprint-trust-check", "/targets/blueprint-trust-check-main", "/targets/blueprint-trust-check-protected", "/targets/developer-context", "/targets/deployment-plan", "/targets/deploy-local", "/targets/dev", "/targets/dev-doctor", "/targets/dev-setup", "/targets/github-bootstrap", "/targets/install-git-hooks", "/targets/stage-authority-render", "/targets/supply-chain-check", "/targets/supply-chain-check-protected", "/targets/supply-chain-scan", "/targets/verify", "/targets/verify-proposed", "/targets/work-markers", "/targets/workspace-health"];
 export interface FoundationFilePlan {
     files: Readonly<Record<string, string>>;
     ownership: FoundationOwnershipRecord;