@empire-builder-kit/nx 1.0.0-rc.4 → 1.0.0-rc.41

package/src/supply-chain/sbom.js

@@ -12,7 +12,7 @@ const validation_js_1 = require("../validation.js");
 const common_js_1 = require("./common.js");
 const errors_js_1 = require("./errors.js");
 const license_expression_js_1 = require("./license-expression.js");
-exports.CYCLONEDX_SPEC_VERSION = '1.6';
+exports.CYCLONEDX_SPEC_VERSION = '1.7';
 exports.SUPPLY_CHAIN_SBOM_SCHEMA_VERSION = 1;
 exports.SUPPLY_CHAIN_RELEASE_BINDING_KIND = 'ebk-supply-chain-release-binding';
 exports.CYCLONEDX_INVENTORY_SCOPES = [
@@ -181,6 +181,29 @@ function uuidFromDigest(digest) {
 function canonicalClone(value) {
     return JSON.parse((0, common_js_1.canonicalizeSupplyChainValue)(value));
 }
+function isVersionlessSyftFileComponent(candidate) {
+    const hashes = candidate.hashes;
+    if (candidate.type !== 'file' ||
+        candidate.version !== undefined ||
+        candidate.purl !== undefined ||
+        typeof candidate.name !== 'string' ||
+        !candidate.name.startsWith('/') ||
+        candidate.name.length > 4_096 ||
+        !Array.isArray(hashes) ||
+        hashes.length !== 2) {
+        return false;
+    }
+    const sha1 = hashes[0];
+    const sha256 = hashes[1];
+    return ((0, validation_js_1.isRecord)(sha1) &&
+        sha1.alg === 'SHA-1' &&
+        typeof sha1.content === 'string' &&
+        /^[a-f0-9]{40}$/.test(sha1.content) &&
+        (0, validation_js_1.isRecord)(sha256) &&
+        sha256.alg === 'SHA-256' &&
+        typeof sha256.content === 'string' &&
+        common_js_1.SUPPLY_CHAIN_SHA256.test(sha256.content));
+}
 /**
  * Create one deterministic CycloneDX inventory for a multi-architecture OCI
  * index from the independently scanned child manifests.
@@ -244,7 +267,7 @@ function createCycloneDxPlatformSbomUnion(input) {
             sbom.components.length === 0 ||
             !Array.isArray(sbom.dependencies) ||
             !(0, validation_js_1.isRecord)(sbom.metadata)) {
-            throw new errors_js_1.SupplyChainError('supply-chain-sbom-invalid', path, 'must be complete CycloneDX 1.6 child-manifest evidence');
+            throw new errors_js_1.SupplyChainError('supply-chain-sbom-invalid', path, 'must be complete CycloneDX 1.7 child-manifest evidence');
         }
         const seenChildRefs = new Set();
         const npmComponents = [];
@@ -263,8 +286,9 @@ function createCycloneDxPlatformSbomUnion(input) {
                 candidate.name.length === 0 ||
                 typeof candidate.type !== 'string' ||
                 candidate.type.length === 0 ||
-                typeof candidate.version !== 'string' ||
-                candidate.version.length === 0) {
+                !((typeof candidate.version === 'string' &&
+                    candidate.version.length > 0) ||
+                    isVersionlessSyftFileComponent(candidate))) {
                 throw new errors_js_1.SupplyChainError('supply-chain-sbom-invalid', `${path}.components[${componentIndex}]`, 'must have one unique bounded component identity');
             }
             seenChildRefs.add(ref);
@@ -277,7 +301,8 @@ function createCycloneDxPlatformSbomUnion(input) {
             }
             componentByRef.set(ref, component);
             if (typeof candidate.purl === 'string' &&
-                candidate.purl.startsWith('pkg:npm/')) {
+                candidate.purl.startsWith('pkg:npm/') &&
+                typeof candidate.version === 'string') {
                 npmComponents.push({
                     name: candidate.name,
                     purl: candidate.purl,

package/src/supply-chain/scanner.js

@@ -277,6 +277,9 @@ function severity(value) {
     const candidate = (0, validation_js_1.isRecord)(value) && typeof value.severity === 'string'
         ? value.severity.toLowerCase()
         : '';
+    // GitHub's GraphQL/advisory data uses MODERATE for the REST medium tier.
+    if (candidate === 'moderate')
+        return 'medium';
     return ['critical', 'high', 'medium', 'low'].includes(candidate)
         ? candidate
         : 'unknown';

package/src/testing-evidence/fixture-scope.d.ts

@@ -8,7 +8,8 @@ export interface LocalTestIsolationCapabilities {
 }
 export interface LocalTestScopeIdentity {
     attempt: number;
-    commit: string;
+    /** Null is an unborn local development worktree, not a deployed identity. */
+    commit: string | null;
     runId: string;
     seed: string;
     stage: string;

package/src/testing-evidence/fixture-scope.js

@@ -30,7 +30,9 @@ function isCanonicalTimestamp(value) {
 function requireIdentity(value) {
     if (!slugPattern.test(value.workspace) ||
         !slugPattern.test(value.stage) ||
-        !commitPattern.test(value.commit) ||
+        (value.commit === null
+            ? value.stage !== 'development'
+            : !commitPattern.test(value.commit)) ||
         !seedPattern.test(value.runId) ||
         !seedPattern.test(value.seed) ||
         !Number.isSafeInteger(value.attempt) ||
@@ -59,7 +61,7 @@ function createLocalTestScope(options) {
         .update([
         identity.workspace,
         identity.stage,
-        identity.commit,
+        identity.commit ?? 'unborn-local-worktree',
         identity.runId,
         String(identity.attempt),
         String(identity.worker),

package/src/testing-evidence/result.d.ts

@@ -18,7 +18,8 @@ export interface TestingEvidenceSource {
      * relationship rather than this result contract.
      */
     blueprintCandidates: readonly string[];
-    commit: string;
+    /** Null denotes an unborn local worktree, never committed or deployed proof. */
+    commit: string | null;
     frameworkCandidate: string;
 }
 export interface TestingEvidenceOperation {

package/src/testing-evidence/result.js

@@ -170,9 +170,11 @@ function validateSource(value, issues) {
     if (!source)
         return undefined;
     rejectUnknownProperties(source, ['blueprintCandidates', 'commit', 'frameworkCandidate'], 'result.source', issues);
-    requireBoundedString(source.commit, 'result.source.commit', issues, {
-        pattern: COMMIT_PATTERN,
-    });
+    if (source.commit !== null) {
+        requireBoundedString(source.commit, 'result.source.commit', issues, {
+            pattern: COMMIT_PATTERN,
+        });
+    }
     requireBoundedString(source.frameworkCandidate, 'result.source.frameworkCandidate', issues);
     if (!Array.isArray(source.blueprintCandidates)) {
         addIssue(issues, 'result.source.blueprintCandidates', 'must be an array');
@@ -457,7 +459,7 @@ function validateTestingEvidenceResult(value) {
     if (!outcome) {
         addIssue(issues, 'result.outcome', `must equal one of ${exports.TESTING_EVIDENCE_OUTCOMES.join(', ')}`);
     }
-    validateSource(result.source, issues);
+    const source = validateSource(result.source, issues);
     const operation = validateOperation(result.operation, issues);
     validateTiming(result.timing, issues);
     const counts = validateCounts(result.counts, issues);
@@ -465,6 +467,18 @@ function validateTestingEvidenceResult(value) {
     const findings = validateFindings(result.findings, issues);
     validateArtifacts(result.artifacts, issues);
     const cleanup = validateCleanup(result.cleanup, issues);
+    if (source?.commit === null &&
+        (environment?.deployed !== false ||
+            !['source', 'local-docker'].includes(environment.class) ||
+            (environment.stage !== undefined &&
+                environment.stage !== 'development') ||
+            !operation ||
+            !['source', 'contract-compatibility', 'local-integration'].includes(operation.proofLayer) ||
+            !Array.isArray(result.artifacts) ||
+            result.artifacts.some((artifact) => !(0, validation_js_1.isRecord)(artifact) ||
+                !['source-result', 'failure-diagnostics'].includes(String(artifact.retentionClass))))) {
+        addIssue(issues, 'result.source.commit', 'must be a full commit SHA outside uncommitted local source or integration checks');
+    }
     if (operation &&
         environment &&
         (operation.proofLayer === 'deployed-smoke' ||

package/src/workload-roles/account-baseline.d.ts

@@ -4,6 +4,7 @@ import { type ProvisionedWorkloadRoleRegistrationDocument, type RegisteredWorklo
 import { type StageWorkloadRoleBoundaryContract } from './stage-boundary.js';
 export declare const WORKLOAD_ROLE_DEPLOYMENT_POLICY_NAME: "ebk-workload-role-deployment-v1";
 export declare const WORKLOAD_ROLE_ACCOUNT_BASELINE_SCHEMA_VERSION: 1;
+export declare const WORKLOAD_ROLE_PROVISIONER_MAX_ATTEMPTS: 5;
 export type WorkloadRoleAccountBaselineFailureClassification = 'account-baseline-input-invalid' | 'account-baseline-project-set-invalid' | 'account-baseline-result-invalid' | 'account-baseline-substitution';
 export declare class WorkloadRoleAccountBaselineError extends Error {
     readonly classification: WorkloadRoleAccountBaselineFailureClassification;
@@ -53,6 +54,8 @@ export interface ReviewedPriorWorkloadRoleHistoryExpectation {
 export interface WorkloadRoleStageDeploymentPromotion {
     deploymentPolicy: CanonicalIamPolicyDocument;
     deploymentPolicyName: typeof WORKLOAD_ROLE_DEPLOYMENT_POLICY_NAME;
+    deploymentPolicyStackName: string;
+    deploymentPolicyTemplate: Readonly<Record<string, unknown>>;
     projectPromotions: Readonly<Record<string, {
         provisionedRegistration: ProvisionedWorkloadRoleRegistrationDocument;
         storageParameterName: string;
@@ -80,6 +83,8 @@ export interface ProtectedWorkloadRolePublisherControlPlane {
         policy: CanonicalIamPolicyDocument;
         policyName: string;
         roleName: string;
+        stackName: string;
+        template: Readonly<Record<string, unknown>>;
     }): Promise<void>;
     putRegisteredDocument(input: {
         bucketName: string;
@@ -129,4 +134,10 @@ export declare function createWorkloadRoleStageDeploymentPromotion(options: {
 export declare function publishReviewedStageWorkloadRoleCandidate(options: {
     controlPlane: ProtectedWorkloadRolePublisherControlPlane;
     plan: WorkloadRoleStageAccountBaselinePlan;
+    waitBeforeProvisionerRetry?: (input: {
+        attempt: number;
+        delayMs: number;
+        maxAttempts: typeof WORKLOAD_ROLE_PROVISIONER_MAX_ATTEMPTS;
+        project: string;
+    }) => Promise<void>;
 }): Promise<WorkloadRoleStageDeploymentPromotion['sanitizedResult']>;

package/src/workload-roles/account-baseline.js

@@ -1,6 +1,6 @@
 "use strict";
 Object.defineProperty(exports, "__esModule", { value: true });
-exports.WorkloadRoleAccountBaselineError = exports.WORKLOAD_ROLE_ACCOUNT_BASELINE_SCHEMA_VERSION = exports.WORKLOAD_ROLE_DEPLOYMENT_POLICY_NAME = void 0;
+exports.WorkloadRoleAccountBaselineError = exports.WORKLOAD_ROLE_PROVISIONER_MAX_ATTEMPTS = exports.WORKLOAD_ROLE_ACCOUNT_BASELINE_SCHEMA_VERSION = exports.WORKLOAD_ROLE_DEPLOYMENT_POLICY_NAME = void 0;
 exports.workloadRoleProvisionerAliasArn = workloadRoleProvisionerAliasArn;
 exports.createWorkloadRoleStageAccountBaselinePlan = createWorkloadRoleStageAccountBaselinePlan;
 exports.createWorkloadRoleStageDeploymentPromotion = createWorkloadRoleStageDeploymentPromotion;
@@ -13,6 +13,27 @@ const registration_js_1 = require("./registration.js");
 const stage_boundary_js_1 = require("./stage-boundary.js");
 exports.WORKLOAD_ROLE_DEPLOYMENT_POLICY_NAME = 'ebk-workload-role-deployment-v1';
 exports.WORKLOAD_ROLE_ACCOUNT_BASELINE_SCHEMA_VERSION = 1;
+exports.WORKLOAD_ROLE_PROVISIONER_MAX_ATTEMPTS = 5;
+const IAM_MANAGED_POLICY_MAX_CHARACTERS = 6_144;
+const IAM_ROLE_MAX_ATTACHED_MANAGED_POLICIES = 10;
+const IAM_DEPLOYMENT_ROLE_MAX_FRAMEWORK_MANAGED_POLICIES = 9;
+const workloadRoleProvisionerRetryDelaysMs = [
+    1_000, 2_000, 4_000, 8_000,
+];
+const boundedInternalProvisionerFailures = new Set([
+    'fixed-provisioner-convergence-error',
+    'fixed-provisioner-history-load-error',
+    'fixed-provisioner-history-save-error',
+    'fixed-provisioner-internal-error',
+    'fixed-provisioner-registration-save-error',
+    'fixed-provisioner-source-load-error',
+]);
+const retryableProvisionerFailures = new Set([
+    'fixed-provisioner-convergence-error',
+    'fixed-provisioner-history-load-error',
+    'fixed-provisioner-internal-error',
+    'fixed-provisioner-source-load-error',
+]);
 class WorkloadRoleAccountBaselineError extends Error {
     classification;
     constructor(classification, message) {
@@ -69,6 +90,9 @@ function stateBucketName(accountId, region, stage) {
 function stackName(stage) {
     return stableName(['ebk', stage, 'workload-role-account-baseline'], 128);
 }
+function deploymentPolicyStackName(stage) {
+    return stableName(['ebk', stage, 'workload-role-deployment-policy'], 128);
+}
 function workloadRoleProvisionerAliasArn(options) {
     requireMatch(options.accountId, accountPattern, 'Account ID');
     requireMatch(options.manifestDigest, digestPattern, 'Manifest digest');
@@ -173,6 +197,13 @@ function exactInstanceProfileArns(boundary) {
         .map(({ roleName }) => `arn:${partition}:iam::${accountId}:instance-profile/${roleName}-profile`))
         .sort(compareStrings);
 }
+function exactInstanceProfileRoleArns(boundary) {
+    return boundary.documents
+        .flatMap(({ accountId, manifest, partition }) => manifest.roles
+        .filter(({ surface }) => surface === 'foundation-nat-instance')
+        .map(({ roleName }) => `arn:${partition}:iam::${accountId}:role/${roleName}`))
+        .sort(compareStrings);
+}
 function provisionerPolicy(options) {
     const currentRoleArns = exactRoleArns(options.boundary);
     const roleArns = [...currentRoleArns, ...options.transitionalRoleArns].sort(compareStrings);
@@ -180,6 +211,7 @@ function provisionerPolicy(options) {
         ...exactInstanceProfileArns(options.boundary),
         ...options.transitionalInstanceProfileArns,
     ].sort(compareStrings);
+    const profileRoleArns = exactInstanceProfileRoleArns(options.boundary);
     return {
         Statement: [
             {
@@ -190,6 +222,18 @@ function provisionerPolicy(options) {
                     .sort(compareStrings),
                 Sid: 'WriteProvisionerLogs',
             },
+            {
+                Action: ['s3:ListBucket'],
+                Condition: {
+                    NumericLessThanEquals: { 's3:max-keys': '1' },
+                    StringEquals: {
+                        's3:prefix': [...options.readableObjectKeys].sort(compareStrings),
+                    },
+                },
+                Effect: 'Allow',
+                Resource: [options.stateBucketArn],
+                Sid: 'ListExactRegisteredState',
+            },
             {
                 Action: ['s3:GetObject'],
                 Effect: 'Allow',
@@ -234,6 +278,21 @@ function provisionerPolicy(options) {
                 Resource: roleArns,
                 Sid: 'ConvergeExactRegisteredRoles',
             },
+            ...(profileRoleArns.length === 0
+                ? []
+                : [
+                    {
+                        Action: ['iam:PassRole'],
+                        Condition: {
+                            StringEquals: {
+                                'iam:PassedToService': 'ec2.amazonaws.com',
+                            },
+                        },
+                        Effect: 'Allow',
+                        Resource: profileRoleArns,
+                        Sid: 'PassExactNatInstanceProfileRoles',
+                    },
+                ]),
             ...(profileArns.length === 0
                 ? []
                 : [
@@ -254,6 +313,68 @@ function provisionerPolicy(options) {
         Version: '2012-10-17',
     };
 }
+function policyCharacters(statements) {
+    return JSON.stringify({ Statement: statements, Version: '2012-10-17' })
+        .length;
+}
+function boundedManagedPolicyStatements(statement, label) {
+    if (policyCharacters([statement]) <= IAM_MANAGED_POLICY_MAX_CHARACTERS) {
+        return [statement];
+    }
+    const parts = [];
+    let resources = [];
+    for (const resource of statement.Resource) {
+        const candidate = {
+            ...statement,
+            Resource: [...resources, resource],
+            Sid: `${statement.Sid}Part0001`,
+        };
+        if (policyCharacters([candidate]) <= IAM_MANAGED_POLICY_MAX_CHARACTERS) {
+            resources.push(resource);
+            continue;
+        }
+        if (resources.length === 0) {
+            throw new WorkloadRoleAccountBaselineError('account-baseline-input-invalid', `${label} statement ${statement.Sid} cannot fit an IAM managed policy.`);
+        }
+        parts.push({ ...statement, Resource: resources });
+        resources = [resource];
+    }
+    if (resources.length > 0) {
+        parts.push({ ...statement, Resource: resources });
+    }
+    return parts.map((part, index) => {
+        const suffix = `Part${String(index + 1).padStart(4, '0')}`;
+        const result = { ...part, Sid: `${statement.Sid}${suffix}` };
+        if (policyCharacters([result]) > IAM_MANAGED_POLICY_MAX_CHARACTERS) {
+            throw new WorkloadRoleAccountBaselineError('account-baseline-input-invalid', `${label} statement ${statement.Sid} cannot fit an IAM managed policy.`);
+        }
+        return result;
+    });
+}
+function boundedManagedPolicyDocuments(policy, label, maximumDocuments = IAM_ROLE_MAX_ATTACHED_MANAGED_POLICIES) {
+    const statements = policy.Statement.flatMap((statement) => boundedManagedPolicyStatements(statement, label));
+    const documents = [];
+    let current = [];
+    for (const statement of statements) {
+        const candidate = [...current, statement];
+        if (policyCharacters(candidate) <= IAM_MANAGED_POLICY_MAX_CHARACTERS) {
+            current = candidate;
+            continue;
+        }
+        if (current.length === 0) {
+            throw new WorkloadRoleAccountBaselineError('account-baseline-input-invalid', `${label} statement cannot fit an IAM managed policy.`);
+        }
+        documents.push({ Statement: current, Version: '2012-10-17' });
+        current = [statement];
+    }
+    if (current.length > 0) {
+        documents.push({ Statement: current, Version: '2012-10-17' });
+    }
+    if (documents.length === 0 || documents.length > maximumDocuments) {
+        throw new WorkloadRoleAccountBaselineError('account-baseline-input-invalid', `${label} exceeds the bounded IAM managed-policy attachment count.`);
+    }
+    return documents;
+}
 function bucketPolicy(partition, bucketName) {
     const bucketArn = `arn:${partition}:s3:::${bucketName}`;
     const objectArn = `${bucketArn}/*`;
@@ -300,7 +421,7 @@ function projectLambdaResources(options) {
     const aliasId = logicalId(options.plan.project, 'ProvisionerAlias');
     return {
         [logId]: {
-            DeletionPolicy: 'Retain',
+            DeletionPolicy: 'RetainExceptOnCreate',
             Properties: {
                 LogGroupName: `/aws/lambda/${options.plan.functionName}`,
                 RetentionInDays: 30,
@@ -328,7 +449,11 @@ function projectLambdaResources(options) {
                 FunctionName: options.plan.functionName,
                 Handler: 'index.handler',
                 MemorySize: 512,
-                ReservedConcurrentExecutions: 1,
+                // Accounts at Lambda's minimum concurrency quota cannot reserve even
+                // one execution because AWS requires ten executions to remain
+                // unreserved. The publisher invokes one exact candidate alias at a
+                // time and the provisioner converges one digest-bound registration,
+                // so quota-dependent reservation is neither required nor portable.
                 Role: {
                     'Fn::GetAtt': [options.provisionerRoleLogicalId, 'Arn'],
                 },
@@ -355,7 +480,10 @@ function projectLambdaResources(options) {
     };
 }
 function cloudFormationTemplate(options) {
-    const registeredObjectArns = options.projectPlans.map(({ registeredManifestObjectKey }) => `arn:${options.boundary.partition}:s3:::${options.stateBucketName}/${registeredManifestObjectKey}`);
+    const stateBucketArn = `arn:${options.boundary.partition}:s3:::${options.stateBucketName}`;
+    const registeredObjectKeys = options.projectPlans.map(({ registeredManifestObjectKey }) => registeredManifestObjectKey);
+    const historyObjectKeys = options.projectPlans.map(({ project }) => (0, registration_js_1.workloadRoleHistoryObjectKey)(options.boundary.stage, project));
+    const registeredObjectArns = registeredObjectKeys.map((key) => `${stateBucketArn}/${key}`);
     const stateObjectArns = options.projectPlans.flatMap(({ project }) => [
         `arn:${options.boundary.partition}:s3:::${options.stateBucketName}/${(0, registration_js_1.provisionedWorkloadRoleRegistrationObjectKey)({
             manifestDigest: options.boundary.manifestDigestsByProject[project],
@@ -369,11 +497,15 @@ function cloudFormationTemplate(options) {
     const policy = provisionerPolicy({
         boundary: options.boundary,
         logGroupArns,
+        readableObjectKeys: [...registeredObjectKeys, ...historyObjectKeys].sort(compareStrings),
         registeredObjectArns,
+        stateBucketArn,
         stateObjectArns,
         transitionalInstanceProfileArns: options.transitionalInstanceProfileArns,
         transitionalRoleArns: options.transitionalRoleArns,
     });
+    const policyDocuments = boundedManagedPolicyDocuments(policy, 'Provisioner policy');
+    const policyLogicalIds = policyDocuments.map((_, index) => `WorkloadRoleProvisionerPolicy${index + 1}`);
     const resources = {
         WorkloadRoleBoundary: {
             Properties: {
@@ -384,6 +516,24 @@ function cloudFormationTemplate(options) {
             },
             Type: 'AWS::IAM::ManagedPolicy',
         },
+        ...Object.fromEntries(policyDocuments.map((document, index) => [
+            policyLogicalIds[index],
+            {
+                Properties: {
+                    Description: `Exact reviewed authority shard ${index + 1} for the fixed ${options.boundary.stage} workload-role provisioner.`,
+                    ManagedPolicyName: stableName([
+                        'ebk',
+                        options.boundary.stage,
+                        'workload-role-provisioner',
+                        'v2',
+                        `policy-${index + 1}`,
+                    ], 128),
+                    Path: options.boundary.path,
+                    PolicyDocument: document,
+                },
+                Type: 'AWS::IAM::ManagedPolicy',
+            },
+        ])),
         WorkloadRoleProvisionerRole: {
             Properties: {
                 AssumeRolePolicyDocument: {
@@ -396,12 +546,9 @@ function cloudFormationTemplate(options) {
                     ],
                     Version: '2012-10-17',
                 },
-                Policies: [
-                    {
-                        PolicyDocument: policy,
-                        PolicyName: 'ebk-fixed-workload-role-provisioner-v1',
-                    },
-                ],
+                ManagedPolicyArns: policyLogicalIds.map((logicalId) => ({
+                    Ref: logicalId,
+                })),
                 RoleName: options.provisionerRoleName,
                 Tags: [
                     { Key: 'ebk:managed-by', Value: 'account-baseline' },
@@ -584,7 +731,10 @@ function requireSuccessResult(plan, value) {
         Array.isArray(value) ||
         !('ok' in value) ||
         value.ok !== true) {
-        throw new WorkloadRoleAccountBaselineError('account-baseline-result-invalid', `Fixed provisioner for ${plan.project} did not return sanitized success.`);
+        const internalClassification = boundedInternalFailureClassification(value);
+        throw new WorkloadRoleAccountBaselineError('account-baseline-result-invalid', internalClassification
+            ? `Fixed provisioner for ${plan.project} returned ${internalClassification} without sanitized success.`
+            : `Fixed provisioner for ${plan.project} did not return sanitized success.`);
     }
     const result = value;
     const allowed = [
@@ -630,6 +780,50 @@ function requireSuccessResult(plan, value) {
         provisionedRegistration,
     };
 }
+function boundedInternalFailureClassification(value) {
+    if (typeof value !== 'object' || value === null || Array.isArray(value)) {
+        return undefined;
+    }
+    const result = value;
+    if (Object.keys(result).sort().join(',') ===
+        'classification,ok,protocolVersion,resultSchemaVersion' &&
+        typeof result.classification === 'string' &&
+        boundedInternalProvisionerFailures.has(result.classification) &&
+        result.ok === false &&
+        result.protocolVersion ===
+            provisioner_js_1.FIXED_WORKLOAD_ROLE_PROVISIONER_PROTOCOL_VERSION &&
+        result.resultSchemaVersion ===
+            handler_js_1.FIXED_WORKLOAD_ROLE_PROVISIONER_RESULT_SCHEMA_VERSION) {
+        return result.classification;
+    }
+    return undefined;
+}
+function isRetryableProvisionerFailure(value) {
+    const classification = boundedInternalFailureClassification(value);
+    return (classification !== undefined &&
+        retryableProvisionerFailures.has(classification));
+}
+async function invokeQualifiedProvisionerWithRetry(options) {
+    for (let attempt = 1; attempt <= exports.WORKLOAD_ROLE_PROVISIONER_MAX_ATTEMPTS; attempt += 1) {
+        const result = await options.controlPlane.invokeQualifiedProvisioner(options.plan.provisionerAliasArn, options.plan.provisionerRequest);
+        if (!isRetryableProvisionerFailure(result) ||
+            attempt === exports.WORKLOAD_ROLE_PROVISIONER_MAX_ATTEMPTS) {
+            return result;
+        }
+        const delayMs = workloadRoleProvisionerRetryDelaysMs[attempt - 1];
+        const wait = options.waitBeforeProvisionerRetry ??
+            (({ delayMs: boundedDelayMs }) => new Promise((resolve) => {
+                setTimeout(resolve, boundedDelayMs);
+            }));
+        await wait({
+            attempt,
+            delayMs,
+            maxAttempts: exports.WORKLOAD_ROLE_PROVISIONER_MAX_ATTEMPTS,
+            project: options.plan.project,
+        });
+    }
+    throw new Error('Unreachable bounded provisioner retry state.');
+}
 function deploymentStatementSid(project, sid) {
     const projectDigest = (0, node_crypto_1.createHash)('sha256')
         .update(project, 'utf8')
@@ -637,6 +831,32 @@ function deploymentStatementSid(project, sid) {
         .slice(0, 12);
     return `Project${projectDigest}${sid}`;
 }
+function deploymentPolicyCloudFormationTemplate(options) {
+    const documents = boundedManagedPolicyDocuments(options.deploymentPolicy, 'Deployment policy', IAM_DEPLOYMENT_ROLE_MAX_FRAMEWORK_MANAGED_POLICIES);
+    return {
+        AWSTemplateFormatVersion: '2010-09-09',
+        Description: 'Protected Empire Builder Kit v1 exact stage workload-role deployment authority. Apply only after complete provisioner convergence.',
+        Resources: Object.fromEntries(documents.map((document, index) => [
+            `WorkloadRoleDeploymentPolicy${index + 1}`,
+            {
+                Properties: {
+                    Description: `Exact reviewed authority shard ${index + 1} for the ${options.boundary.stage} deployment role.`,
+                    ManagedPolicyName: stableName([
+                        'ebk',
+                        options.boundary.stage,
+                        'workload-role-deployment',
+                        'v2',
+                        `policy-${index + 1}`,
+                    ], 128),
+                    Path: options.boundary.path,
+                    PolicyDocument: document,
+                    Roles: [options.deploymentRoleName],
+                },
+                Type: 'AWS::IAM::ManagedPolicy',
+            },
+        ])),
+    };
+}
 function createWorkloadRoleStageDeploymentPromotion(options) {
     const resultProjects = Object.keys(options.provisionerResults).sort(compareStrings);
     const expectedProjects = options.plan.projectPlans
@@ -682,12 +902,19 @@ function createWorkloadRoleStageDeploymentPromotion(options) {
         });
     }
     deploymentStatements.sort((left, right) => compareStrings(left.Sid, right.Sid));
+    const deploymentPolicy = {
+        Statement: deploymentStatements,
+        Version: '2012-10-17',
+    };
     return {
-        deploymentPolicy: {
-            Statement: deploymentStatements,
-            Version: '2012-10-17',
-        },
+        deploymentPolicy,
         deploymentPolicyName: exports.WORKLOAD_ROLE_DEPLOYMENT_POLICY_NAME,
+        deploymentPolicyStackName: deploymentPolicyStackName(options.plan.stage),
+        deploymentPolicyTemplate: deploymentPolicyCloudFormationTemplate({
+            boundary: options.plan.boundary,
+            deploymentPolicy,
+            deploymentRoleName: options.plan.deploymentRoleName,
+        }),
         projectPromotions,
         sanitizedResult: {
             candidateIdentity: options.plan.candidateIdentity,
@@ -716,7 +943,15 @@ async function publishReviewedStageWorkloadRoleCandidate(options) {
     const provisionerResults = {};
     for (const project of options.plan.projectPlans) {
         provisionerResults[project.project] =
-            await options.controlPlane.invokeQualifiedProvisioner(project.provisionerAliasArn, project.provisionerRequest);
+            await invokeQualifiedProvisionerWithRetry({
+                controlPlane: options.controlPlane,
+                plan: project,
+                ...(options.waitBeforeProvisionerRetry
+                    ? {
+                        waitBeforeProvisionerRetry: options.waitBeforeProvisionerRetry,
+                    }
+                    : {}),
+            });
     }
     const promotion = createWorkloadRoleStageDeploymentPromotion({
         plan: options.plan,
@@ -727,6 +962,8 @@ async function publishReviewedStageWorkloadRoleCandidate(options) {
         policy: promotion.deploymentPolicy,
         policyName: promotion.deploymentPolicyName,
         roleName: options.plan.deploymentRoleName,
+        stackName: promotion.deploymentPolicyStackName,
+        template: promotion.deploymentPolicyTemplate,
     });
     for (const project of options.plan.projectPlans) {
         const promoted = promotion.projectPromotions[project.project];

package/src/workload-roles/authority.d.ts

@@ -32,7 +32,9 @@ export interface DeploymentRoleAuthorityValidation {
  * Stable ordinary deployment-role authority. It can read exact protected
  * registration objects, invoke and observe only the fixed qualified
  * provisioner, and pass exact registered roles to their declared AWS services.
- * It deliberately exposes no direct IAM role inspection or mutation surface.
+ * It exposes only exact read authority needed by Pulumi to import the already
+ * provisioned roles and NAT instance profiles. It exposes no direct IAM
+ * mutation surface.
  */
 export declare function createDeploymentRoleAuthorityPlan(registry: ExactProvisionedWorkloadRoleRegistry, registrationReadScope?: DeploymentRoleRegistrationReadScope): DeploymentRoleAuthorityPlan;
 export declare function validateDeploymentRoleAuthorityPlan(registry: ExactProvisionedWorkloadRoleRegistry, value: unknown, registrationReadScope?: DeploymentRoleRegistrationReadScope): DeploymentRoleAuthorityValidation;