@empire-builder-kit/nx 1.0.0-rc.4 → 1.0.0-rc.40

package/src/schemas/performance-policy-v1.json

@@ -249,7 +249,9 @@
         "productionExceptionalOnly"
       ],
       "properties": {
-        "allowedProtectedStages": { "const": ["staging"] },
+        "allowedProtectedStages": {
+          "oneOf": [{ "const": ["development"] }, { "const": ["staging"] }]
+        },
         "maximumConcurrency": { "$ref": "#/$defs/positiveInteger" },
         "maximumDurationSeconds": { "$ref": "#/$defs/positiveInteger" },
         "maximumEstimatedCostUsd": {
@@ -293,8 +295,6 @@
             "ebk:framework-version",
             "ebk:managed-by",
             "ebk:owner",
-            "ebk:production-profile",
-            "ebk:repository",
             "ebk:slice",
             "ebk:stage",
             "ebk:workspace"

package/src/schemas/repository-policy-v1.json

@@ -6,14 +6,84 @@
   "additionalProperties": false,
   "required": [
     "schemaVersion",
+    "deploymentAccounts",
+    "deploymentProfile",
+    "deploymentRegion",
     "productionAccess",
     "productionApproval",
     "productionFoundation",
-    "slices"
+    "slices",
+    "workspaceDeploymentId",
+    "workspaceDeploymentProvenance"
   ],
   "properties": {
-    "$schema": { "type": "string", "minLength": 1 },
-    "schemaVersion": { "const": 1 },
+    "$schema": {
+      "type": "string",
+      "minLength": 1
+    },
+    "schemaVersion": {
+      "const": 1
+    },
+    "deploymentProfile": {
+      "type": "string",
+      "enum": ["starter", "production-isolated", "fully-isolated"]
+    },
+    "deliveryLane": {
+      "type": "string",
+      "enum": ["protected-pair", "trunk"],
+      "description": "How work reaches production. protected-pair (default) keeps develop and main with a promotion pull request and sync-back; trunk protects main alone and deploys production from every merged main push. trunk requires the starter deployment profile."
+    },
+    "deploymentRegion": {
+      "anyOf": [
+        {
+          "type": "null"
+        },
+        {
+          "type": "string",
+          "pattern": "^(?!(us-iso-|us-isob-|eu-isoe-|us-isof-))[a-z]{2}(-gov)?-[a-z]+(-[a-z]+)*-[0-9]$"
+        }
+      ]
+    },
+    "deploymentAccounts": {
+      "type": "object",
+      "additionalProperties": false,
+      "required": ["development", "staging", "production"],
+      "properties": {
+        "development": {
+          "anyOf": [
+            {
+              "type": "null"
+            },
+            {
+              "type": "string",
+              "pattern": "^[0-9]{12}$"
+            }
+          ]
+        },
+        "staging": {
+          "anyOf": [
+            {
+              "type": "null"
+            },
+            {
+              "type": "string",
+              "pattern": "^[0-9]{12}$"
+            }
+          ]
+        },
+        "production": {
+          "anyOf": [
+            {
+              "type": "null"
+            },
+            {
+              "type": "string",
+              "pattern": "^[0-9]{12}$"
+            }
+          ]
+        }
+      }
+    },
     "productionAccess": {
       "type": "string",
       "enum": ["disabled", "controlled"]
@@ -25,7 +95,7 @@
       "properties": {
         "mode": {
           "type": "string",
-          "enum": ["promotion-pr", "environment-reviewer"]
+          "enum": ["promotion-pr", "environment-reviewer", "trunk-promotion"]
         }
       }
     },
@@ -36,13 +106,15 @@
       "properties": {
         "profile": {
           "type": "string",
-          "enum": ["cost-optimized", "standard"]
+          "enum": ["cost-optimized", "balanced", "standard"]
         }
       }
     },
     "slices": {
       "type": "object",
-      "propertyNames": { "pattern": "^[a-z0-9][a-z0-9-]*$" },
+      "propertyNames": {
+        "pattern": "^[a-z0-9][a-z0-9-]*$"
+      },
       "additionalProperties": {
         "type": "object",
         "additionalProperties": false,
@@ -54,6 +126,58 @@
           }
         }
       }
+    },
+    "workspaceDeploymentId": {
+      "type": "string",
+      "pattern": "^ebkws-[a-f0-9]{32}$",
+      "description": "Stable generated identity shared by clones of this workspace and bound to every active AWS stage tuple."
+    },
+    "workspaceDeploymentProvenance": {
+      "oneOf": [
+        {
+          "type": "object",
+          "additionalProperties": false,
+          "required": ["kind", "schemaVersion"],
+          "properties": {
+            "kind": {
+              "const": "fresh"
+            },
+            "schemaVersion": {
+              "const": 1
+            }
+          }
+        },
+        {
+          "type": "object",
+          "additionalProperties": false,
+          "required": [
+            "evidencePath",
+            "evidenceSha256",
+            "kind",
+            "schemaVersion"
+          ],
+          "properties": {
+            "evidencePath": {
+              "type": "string",
+              "pattern": "^docs/adoption/[A-Za-z0-9._/-]+[.]json$",
+              "not": {
+                "pattern": "/(?:[.]|[.][.])(?:/|$)|//"
+              }
+            },
+            "evidenceSha256": {
+              "type": "string",
+              "pattern": "^[a-f0-9]{64}$"
+            },
+            "kind": {
+              "const": "migrated"
+            },
+            "schemaVersion": {
+              "const": 1
+            }
+          }
+        }
+      ],
+      "description": "Required origin declaration. Migrated identities retain an exact version-controlled occupancy-evidence binding."
     }
   }
 }

package/src/schemas/testing-evidence-result-v1.json

@@ -254,7 +254,7 @@
           }
         },
         "commit": {
-          "type": "string",
+          "type": ["string", "null"],
           "pattern": "^(?:[a-f0-9]{40}|[a-f0-9]{64})$"
         },
         "frameworkCandidate": {

package/src/secrets/adapters.d.ts

@@ -7,6 +7,9 @@ export interface SecretDeclarationContractLike {
         staleTtlMs?: number;
     };
     contractVersion: 1;
+    generation?: {
+        kind: 'hmac-key-ring-v1';
+    };
     logicalName: string;
     owner: string;
     requiredStages: readonly string[];
@@ -21,24 +24,26 @@ export interface SecretDeclarationContractLike {
         mode: 'provider-managed';
         runbook?: string;
     };
-    source: 'aws-managed' | 'database-bootstrap' | 'operator';
+    source: 'aws-managed' | 'database-bootstrap' | 'generated' | 'operator';
     value: {
         kind: 'binary' | 'json' | 'string';
         validate: unknown;
     };
 }
 export declare class SecretDeclarationAdapterError extends Error {
-    readonly code: 'secret-cross-slice-approval-required' | 'secret-consumption-stage-invalid' | 'secret-declaration-adapter-invalid' | 'secret-reference-undeclared';
+    readonly code: 'secret-cross-slice-approval-required' | 'secret-consumption-stage-invalid' | 'secret-declaration-adapter-invalid' | 'secret-reference-ownership-invalid' | 'secret-reference-undeclared';
     constructor(code: SecretDeclarationAdapterError['code']);
 }
 export declare function toSecretMetadataDeclaration(declaration: SecretDeclarationContractLike): SecretMetadataDeclaration;
 export declare function toOperatorSecretMetadataDeclarations(declarations: Readonly<Record<string, SecretDeclarationContractLike>>): readonly SecretMetadataDeclaration[];
+export declare function toDeployedSecretMetadataDeclarations(declarations: Readonly<Record<string, SecretDeclarationContractLike>>): readonly SecretMetadataDeclaration[];
 export declare function createHiddenInputValidator(declaration: SecretDeclarationContractLike): PersonalSecretValueValidator;
 export declare function createDeclaredWorkloadSecretPermissionIntent(input: {
     consumerSlice: string;
     declarations: Readonly<Record<string, SecretDeclarationContractLike>>;
     externalApprovals?: readonly {
         approved: true;
+        containerOwnership: 'ebk-stage' | 'external';
         logicalName: string;
         owner: string;
         secretArn: string;

package/src/secrets/adapters.js

@@ -3,6 +3,7 @@ Object.defineProperty(exports, "__esModule", { value: true });
 exports.SecretDeclarationAdapterError = void 0;
 exports.toSecretMetadataDeclaration = toSecretMetadataDeclaration;
 exports.toOperatorSecretMetadataDeclarations = toOperatorSecretMetadataDeclarations;
+exports.toDeployedSecretMetadataDeclarations = toDeployedSecretMetadataDeclarations;
 exports.createHiddenInputValidator = createHiddenInputValidator;
 exports.createDeclaredWorkloadSecretPermissionIntent = createDeclaredWorkloadSecretPermissionIntent;
 const deterministic_order_js_1 = require("../deterministic-order.js");
@@ -31,6 +32,7 @@ function validateContractShape(declaration) {
         !hasOnlyProperties(declaration, [
             'cache',
             'contractVersion',
+            'generation',
             'logicalName',
             'owner',
             'requiredStages',
@@ -44,11 +46,18 @@ function validateContractShape(declaration) {
         typeof declaration.owner !== 'string' ||
         !Array.isArray(declaration.requiredStages) ||
         declaration.requiredStages.some((stage) => typeof stage !== 'string') ||
-        !['aws-managed', 'database-bootstrap', 'operator'].includes(declaration.source) ||
+        !['aws-managed', 'database-bootstrap', 'generated', 'operator'].includes(declaration.source) ||
         !isRecord(declaration.value) ||
         !hasOnlyProperties(declaration.value, ['kind', 'validate']) ||
         !['binary', 'json', 'string'].includes(declaration.value.kind) ||
         typeof declaration.value.validate !== 'function' ||
+        (declaration.source === 'generated') !==
+            (declaration.generation !== undefined) ||
+        (declaration.generation !== undefined &&
+            (!isRecord(declaration.generation) ||
+                !hasOnlyProperties(declaration.generation, ['kind']) ||
+                declaration.generation.kind !== 'hmac-key-ring-v1' ||
+                declaration.value.kind !== 'json')) ||
         !isRecord(declaration.rotation) ||
         !hasOnlyProperties(declaration.rotation, ['mode', 'runbook']) ||
         !['manual', 'provider-managed'].includes(declaration.rotation.mode) ||
@@ -81,6 +90,13 @@ function validateContractShape(declaration) {
 function toSecretMetadataDeclaration(declaration) {
     validateContractShape(declaration);
     const metadata = {
+        ...(declaration.generation === undefined
+            ? {}
+            : {
+                generation: Object.freeze({
+                    kind: declaration.generation.kind,
+                }),
+            }),
         logicalName: declaration.logicalName,
         owner: declaration.owner,
         requiredStages: Object.freeze([...declaration.requiredStages]),
@@ -116,6 +132,11 @@ function toOperatorSecretMetadataDeclarations(declarations) {
         .filter(({ source }) => source === 'operator')
         .map((declaration) => toSecretMetadataDeclaration(declaration)));
 }
+function toDeployedSecretMetadataDeclarations(declarations) {
+    return Object.freeze([...validatedDeclarations(declarations).values()]
+        .filter(({ source }) => source === 'operator' || source === 'generated')
+        .map((declaration) => toSecretMetadataDeclaration(declaration)));
+}
 function createHiddenInputValidator(declaration) {
     validateContractShape(declaration);
     const validate = declaration.value.validate;
@@ -166,14 +187,24 @@ function createDeclaredWorkloadSecretPermissionIntent(input) {
         }
         const resourceName = reference.secretArn.split(':secret:')[1] ?? '';
         const expectedPrefix = `ebk/${input.stage}/${input.consumerSlice}/`;
+        const reservedStagePrefix = `ebk/${input.stage}/`;
         if (!resourceName.startsWith(expectedPrefix)) {
-            const approved = input.externalApprovals?.some((approval) => approval.approved === true &&
+            const approval = input.externalApprovals?.find((approval) => approval.approved === true &&
                 approval.logicalName === reference.logicalName &&
                 approval.owner === declaration.owner &&
                 approval.secretArn === reference.secretArn);
-            if (!approved) {
+            if (approval === undefined) {
                 throw new SecretDeclarationAdapterError('secret-cross-slice-approval-required');
             }
+            const isReservedStageContainer = resourceName.startsWith(reservedStagePrefix);
+            const isAnyReservedEbkContainer = resourceName.startsWith('ebk/');
+            if ((isReservedStageContainer &&
+                approval.containerOwnership !== 'ebk-stage') ||
+                (!isReservedStageContainer &&
+                    approval.containerOwnership !== 'external') ||
+                (isAnyReservedEbkContainer && !isReservedStageContainer)) {
+                throw new SecretDeclarationAdapterError('secret-reference-ownership-invalid');
+            }
         }
     }
     return (0, permissions_js_1.createWorkloadSecretPermissionIntent)({

package/src/secrets/aws-control-plane.d.ts

@@ -1,5 +1,5 @@
 import { CreateSecretCommand, DeleteSecretCommand, DescribeSecretCommand, ListSecretsCommand, RestoreSecretCommand, SecretsManagerClient, TagResourceCommand } from '@aws-sdk/client-secrets-manager';
-import type { ProtectedSecretLifecycleControlPlane, SecretMetadataControlPlane } from './operator.js';
+import type { GeneratedSecretRetirementControlPlane, ProtectedSecretLifecycleControlPlane, SecretMetadataControlPlane } from './operator.js';
 export type AwsSecretMetadataCommand = CreateSecretCommand | DeleteSecretCommand | DescribeSecretCommand | ListSecretsCommand | RestoreSecretCommand | TagResourceCommand;
 export interface AwsSecretsManagerMetadataClient {
     send(command: AwsSecretMetadataCommand): Promise<unknown>;
@@ -18,3 +18,12 @@ export declare function createAwsSecretsManagerMetadataControlPlane(options?: {
     client?: AwsSecretsManagerMetadataClient;
     clientConfiguration?: ConstructorParameters<typeof SecretsManagerClient>[0];
 }): SecretMetadataControlPlane & ProtectedSecretLifecycleControlPlane;
+/**
+ * Narrow adapter for framework-generated, stage-exclusive secret retirement.
+ * Immediate deletion is intentionally unavailable from the human/operator
+ * lifecycle adapter above and requires the caller to prove exact ownership.
+ */
+export declare function createAwsGeneratedSecretRetirementControlPlane(options?: {
+    client?: AwsSecretsManagerMetadataClient;
+    clientConfiguration?: ConstructorParameters<typeof SecretsManagerClient>[0];
+}): GeneratedSecretRetirementControlPlane;

package/src/secrets/aws-control-plane.js

@@ -2,6 +2,7 @@
 Object.defineProperty(exports, "__esModule", { value: true });
 exports.AwsSecretMetadataControlPlaneError = void 0;
 exports.createAwsSecretsManagerMetadataControlPlane = createAwsSecretsManagerMetadataControlPlane;
+exports.createAwsGeneratedSecretRetirementControlPlane = createAwsGeneratedSecretRetirementControlPlane;
 const deterministic_order_js_1 = require("../deterministic-order.js");
 const client_secrets_manager_1 = require("@aws-sdk/client-secrets-manager");
 const model_js_1 = require("./model.js");
@@ -18,6 +19,12 @@ const maximumListPages = 100;
 function isRecord(value) {
     return typeof value === 'object' && value !== null && !Array.isArray(value);
 }
+function isResourceNotFound(error) {
+    return (isRecord(error) &&
+        (error['name'] === 'ResourceNotFoundException' ||
+            error['Code'] === 'ResourceNotFoundException' ||
+            error['code'] === 'ResourceNotFoundException'));
+}
 function requireRecord(value) {
     if (!isRecord(value)) {
         throw new AwsSecretMetadataControlPlaneError('aws-secret-metadata-observation-invalid');
@@ -97,8 +104,16 @@ function versionStagesFromAws(value) {
     return Object.freeze([...stages].sort());
 }
 function toObservedSecretMetadata(output, expectedArn) {
+    if (output.DeletedDate !== undefined &&
+        (!(output.DeletedDate instanceof Date) ||
+            Number.isNaN(output.DeletedDate.getTime()))) {
+        throw new AwsSecretMetadataControlPlaneError('aws-secret-metadata-observation-invalid');
+    }
     const observed = Object.freeze({
         arn: requireExactArn(output.ARN),
+        ...(output.DeletedDate === undefined
+            ? {}
+            : { deletionPendingUntil: output.DeletedDate.toISOString() }),
         name: requireNonEmptyString(output.Name),
         rotationEnabled: output.RotationEnabled === true,
         tags: tagsFromAws(output.Tags),
@@ -172,6 +187,34 @@ function createAwsSecretsManagerMetadataControlPlane(options = {}) {
             })));
             return toObservedSecretMetadata(output, input.arn);
         },
+        async describeExact(input) {
+            validateMetadataText(input.name);
+            let output;
+            try {
+                output = requireOutput(await client.send(new client_secrets_manager_1.DescribeSecretCommand({
+                    SecretId: input.name,
+                })));
+            }
+            catch (error) {
+                if (isResourceNotFound(error))
+                    return undefined;
+                throw error;
+            }
+            const arn = requireExactArn(output.ARN);
+            if (output.DeletedDate !== undefined &&
+                input.includePlannedDeletion !== true) {
+                throw new AwsSecretMetadataControlPlaneError('aws-secret-metadata-observation-invalid');
+            }
+            const observed = toObservedSecretMetadata(output, arn);
+            const marker = `:secret:${input.name}-`;
+            const markerIndex = arn.lastIndexOf(marker);
+            if (observed.name !== input.name ||
+                markerIndex <= 0 ||
+                !/^[A-Za-z0-9]{6}$/.test(arn.slice(markerIndex + marker.length))) {
+                throw new AwsSecretMetadataControlPlaneError('aws-secret-metadata-observation-invalid');
+            }
+            return observed;
+        },
         async list(input) {
             validateMetadataText(input.namePrefix);
             const listed = [];
@@ -252,4 +295,28 @@ function createAwsSecretsManagerMetadataControlPlane(options = {}) {
         },
     });
 }
+/**
+ * Narrow adapter for framework-generated, stage-exclusive secret retirement.
+ * Immediate deletion is intentionally unavailable from the human/operator
+ * lifecycle adapter above and requires the caller to prove exact ownership.
+ */
+function createAwsGeneratedSecretRetirementControlPlane(options = {}) {
+    const client = options.client ?? defaultClient(options.clientConfiguration ?? {});
+    const metadata = createAwsSecretsManagerMetadataControlPlane({ client });
+    return Object.freeze({
+        describeExact: metadata.describeExact,
+        async deleteImmediately(input) {
+            assertExactArn(input.arn);
+            const output = requireOutput(await client.send(new client_secrets_manager_1.DeleteSecretCommand({
+                ForceDeleteWithoutRecovery: true,
+                SecretId: input.arn,
+            })));
+            if (requireExactArn(output.ARN) !== input.arn) {
+                throw new AwsSecretMetadataControlPlaneError('aws-secret-metadata-observation-invalid');
+            }
+        },
+        restore: metadata.restore,
+        scheduleRetirement: metadata.scheduleRetirement,
+    });
+}
 //# sourceMappingURL=aws-control-plane.js.map

package/src/secrets/generated-aws-control-plane.d.ts

@@ -0,0 +1,23 @@
+import { CreateSecretCommand, DescribeSecretCommand, SecretsManagerClient } from '@aws-sdk/client-secrets-manager';
+import type { GeneratedSecretInitializationControlPlane } from './operator.js';
+export type AwsGeneratedSecretCommand = CreateSecretCommand | DescribeSecretCommand;
+export interface AwsGeneratedSecretClient {
+    send(command: AwsGeneratedSecretCommand): Promise<unknown>;
+}
+export declare class AwsGeneratedSecretInitializationError extends Error {
+    readonly code: 'generated-secret-input-invalid' | 'generated-secret-observation-invalid' | 'generated-secret-read-failed' | 'generated-secret-state-conflicting' | 'generated-secret-write-failed';
+    constructor(code: AwsGeneratedSecretInitializationError['code']);
+}
+/**
+ * Generates one declared machine value inside the AWS adapter and atomically
+ * creates its Secrets Manager container. The public API accepts no plaintext
+ * and returns only applied/unchanged metadata. Plaintext necessarily exists
+ * transiently in this trusted process and the AWS SDK request, but it is never
+ * returned, logged, or persisted by EBK.
+ */
+export declare function createAwsGeneratedSecretInitializationControlPlane(options?: {
+    client?: AwsGeneratedSecretClient;
+    clientConfiguration?: ConstructorParameters<typeof SecretsManagerClient>[0];
+    randomBytes?: (size: number) => Buffer;
+    wait?: (milliseconds: number) => Promise<void>;
+}): GeneratedSecretInitializationControlPlane;