@empire-builder-kit/nx 1.0.0-rc.4 → 1.0.0-rc.41

package/src/executors/github-bootstrap/schema.json

@@ -2,7 +2,7 @@
   "$schema": "https://json-schema.org/schema",
   "version": 2,
   "title": "Empire Builder Kit GitHub bootstrap",
-  "description": "Report or explicitly apply protected repository rules and environments without creating secrets, branches, or credentials.",
+  "description": "Report or explicitly apply protected repository rules, environments, and the default immutable GitHub OIDC repository subject without creating secrets, branches, or credentials.",
   "type": "object",
   "additionalProperties": false,
   "properties": {
@@ -16,6 +16,12 @@
       "default": false,
       "description": "Apply the reported GitHub settings. Omit for the default read-only report."
     },
+    "immutableOidcTrustAcknowledgement": {
+      "type": "string",
+      "pattern": "^aws-trust-ready:repo:",
+      "maxLength": 512,
+      "description": "Required only when --apply would enable GitHub's immutable repository OIDC subject. Supply aws-trust-ready:<reported repositoryIdentity.subjectPrefix> only after the matching AWS trusts have been applied, read back, and verified."
+    },
     "npmPrereleaseReviewerIds": {
       "type": "string",
       "pattern": "^[1-9][0-9]*(,[1-9][0-9]*)*$",

package/src/executors/infrastructure-plan/infrastructure-plan.d.ts

@@ -1,143 +1,36 @@
 import { type ExecutorContext, type PromiseExecutor } from '@nx/devkit';
-import { type InfrastructureDriftStatus, type InfrastructureMutationAction, type InfrastructurePlanV1, type InfrastructureStateIdentityV1, type NormalizedSstDiffV1 } from '../../infrastructure-change/index.js';
-import { type SstCommandInvocation, type SstLifecycleOptions } from '../sst-lifecycle/run-sst-command.js';
-export interface InfrastructurePlanExecutorOptions extends Pick<SstLifecycleOptions, 'cwd' | 'stage' | 'stageMode'> {
-    action?: InfrastructureMutationAction;
-    approvalPath?: string;
-    configurationPath?: string;
-    configurationPaths?: string[];
-    descriptorPath?: string;
-    mutationBindingPath?: string;
-    operation?: 'finalize-convergence' | 'plan';
-    operationalEvidencePath?: string;
-    pendingConvergencePath?: string;
-    smokeBindingPath?: string;
-    smokeEvidencePath?: string;
-}
-export interface InfrastructureResourceObservationCoverage {
-    adapter: 'aws-resource-groups-tagging-api' | 'none' | 'sst-pulumi-refresh-preview';
-    arnDigest: string | null;
-    coveredProperties: readonly string[];
-    type: string;
-    unobservedMaterialProperties: readonly string[];
-    urn: string;
-}
-interface DriftEvidence {
-    coverage: readonly InfrastructureResourceObservationCoverage[];
-    digest: string;
-    expiresAt: string;
-    generatedAt: string;
-    status: InfrastructureDriftStatus;
-}
-export interface InfrastructureObservation {
-    callInventory: readonly string[];
-    drift: DriftEvidence;
-    observerArnDigest: string;
-    resources?: readonly InfrastructureObservedResource[];
-    state: InfrastructureStateIdentityV1;
-}
-export interface InfrastructureObservedResource {
-    dependencyDigests: readonly string[];
-    logicalId: string;
-    physicalArn?: string;
-    physicalId?: string;
-    physicalSelector?: Readonly<Record<string, string>>;
-    physicalIdentityDigest: string | null;
-    protected: boolean | null;
-    resourceType: string;
-    retainedOnDelete: boolean | null;
-    urnDigest: string;
-}
-interface CommandResult {
-    status: number | null;
-    stderr: string;
-    stdout: string;
-}
-export interface InfrastructurePlanExecutorDependencies {
-    now?: () => Date;
-    observe?: (input: {
-        backendBootstrapDigest: string;
-        childEnvironment: NodeJS.ProcessEnv;
-        environment: NodeJS.ProcessEnv;
-        invocation: SstCommandInvocation;
-        now: Date;
-        ordinaryDiff: NormalizedSstDiffV1;
-        project: string;
-        sourceCommit: string;
-        spawn: NonNullable<InfrastructurePlanExecutorDependencies['spawn']>;
-        toolVersion: string;
-    }) => InfrastructureObservation;
-    spawn?: (executable: string, args: readonly string[], options: {
-        cwd: string;
-        encoding: 'utf8';
-        env: NodeJS.ProcessEnv;
-        maxBuffer: number;
-        shell: false;
-    }) => CommandResult;
-}
-type StandardRemoveProbeKind = 'aws-cloud-control' | 'aws-events-target' | 'aws-iam-role-policy' | 'aws-kms-retained' | 'aws-lambda-event-invoke-config' | 'aws-lambda-permission' | 'aws-logs-data-protection-policy' | 'aws-s3-retained' | 'aws-s3-object' | 'aws-secrets-manager-secret' | 'aws-sqs-queue-policy' | 'aws-ssm-parameter';
-interface StandardRemoveProbe {
-    identifier: string;
-    kind: StandardRemoveProbeKind;
-    protectionProfile?: string;
-    selector?: Readonly<Record<string, string>>;
-    typeName?: string;
+import { spawn, spawnSync } from 'node:child_process';
+import { type CanonicalDeploymentStage } from '../../repository-policy/index.js';
+import { createLocalFederatedCredentialTransport } from '../local-deploy/federated-credential-transport.js';
+import { localWorkingTreeDigest } from '../local-deploy/local-deploy.js';
+import { assertWorkspaceStageOwnershipForWorkspace } from '../../workspace-deployment/index.js';
+export { matchesExpectedAssumedRoleArn } from '../../aws/identity.js';
+export interface InfrastructurePlanExecutorOptions {
+    cwd?: string;
+    expectedRoleArn?: string;
+    profile?: string;
+    region?: string;
+    stage: CanonicalDeploymentStage;
+    stageMode: 'consumer' | 'foundation';
+}
+interface InfrastructurePlanDependencies {
+    createTransport?: typeof createLocalFederatedCredentialTransport;
+    environment?: NodeJS.ProcessEnv;
+    identifyGithubCaller?: (region: string) => Promise<{
+        Account?: string;
+        Arn?: string;
+    }>;
+    ownership?: typeof assertWorkspaceStageOwnershipForWorkspace;
+    readSource?: typeof localWorkingTreeDigest;
+    platform?: NodeJS.Platform;
+    run?: typeof spawnSync;
+    spawnChild?: typeof spawn;
 }
 /**
- * Reads the Pulumi StepEventStateMetadata `new.id` emitted by SST's pinned
- * JSON diff for imports. Only its digest leaves this private boundary.
+ * Run SST's native diff as advisory output. The result is intentionally not
+ * normalized, retained, or used as later mutation authority.
  */
-export declare function extractPrivateImportIdentifierDigests(diffStdout: string, diff: NormalizedSstDiffV1): Readonly<Record<string, string>>;
-/** @internal */
-export declare function approvalCandidateSourceCommit(context: ExecutorContext, options: InfrastructurePlanExecutorOptions, environment: NodeJS.ProcessEnv): string | undefined;
-/** @internal */
-export declare function createCandidateBoundSstChildEnvironment(environment: NodeJS.ProcessEnv, invocationEnvironment: SstCommandInvocation['environment'], candidateSourceCommit: string): NodeJS.ProcessEnv;
-export declare function assessPulumiRefreshPreview(input: {
-    invocation: SstCommandInvocation;
-    ordinaryDiff: NormalizedSstDiffV1;
-    spawn: NonNullable<InfrastructurePlanExecutorDependencies['spawn']>;
-    toolVersion: string;
-    childEnvironment: NodeJS.ProcessEnv;
-}): {
-    commandSucceeded: boolean;
-    complete: boolean;
-    desiredMatchesOrdinary: boolean;
-    digest: string;
-    drift: NormalizedSstDiffV1;
-    observedRefreshUrns: readonly string[];
-};
-export declare function standardRemoveProbeForResource(resource: InfrastructureObservedResource): StandardRemoveProbe;
-interface StandardRemoveProbeResult {
-    present: boolean;
-    protectionDigest: string | null;
-}
-export declare function probeStandardRemoveResource(input: {
-    childEnvironment: NodeJS.ProcessEnv;
-    invocation: SstCommandInvocation;
-    probe: StandardRemoveProbe;
-    spawn: NonNullable<InfrastructurePlanExecutorDependencies['spawn']>;
-}): StandardRemoveProbeResult;
-export declare function observeInfrastructureState(input: {
-    backendBootstrapDigest: string;
-    childEnvironment: NodeJS.ProcessEnv;
-    environment: NodeJS.ProcessEnv;
-    invocation: SstCommandInvocation;
-    now: Date;
-    ordinaryDiff: NormalizedSstDiffV1;
-    project: string;
-    sourceCommit: string;
-    spawn: NonNullable<InfrastructurePlanExecutorDependencies['spawn']>;
-    toolVersion: string;
-}): InfrastructureObservation;
-export declare function validateGovernanceEvidence(reviewed: {
-    governance?: unknown;
-} | undefined, plan: InfrastructurePlanV1, observedResources?: readonly InfrastructureObservedResource[], importIdentifierDigests?: Readonly<Record<string, string>>): Readonly<Record<string, string>>;
-export declare function runInfrastructurePlanExecutor(options: InfrastructurePlanExecutorOptions, context: ExecutorContext, environment?: NodeJS.ProcessEnv, dependencies?: InfrastructurePlanExecutorDependencies): Promise<{
-    success: boolean;
-}>;
-export declare function revalidateInfrastructureMutationAuthorization(action: InfrastructureMutationAction, options: SstLifecycleOptions, context: ExecutorContext, invocation: SstCommandInvocation, environment?: NodeJS.ProcessEnv, dependencies?: InfrastructurePlanExecutorDependencies): Promise<void>;
-export declare function recordInfrastructureMutationConvergence(action: InfrastructureMutationAction, options: SstLifecycleOptions, context: ExecutorContext, invocation: SstCommandInvocation, applySucceeded: boolean, environment?: NodeJS.ProcessEnv, dependencies?: InfrastructurePlanExecutorDependencies): Promise<boolean>;
-export declare function finalizeInfrastructureMutationConvergence(options: InfrastructurePlanExecutorOptions, context: ExecutorContext, environment?: NodeJS.ProcessEnv, dependencies?: Pick<InfrastructurePlanExecutorDependencies, 'now'>): Promise<{
+export declare function runInfrastructurePlanExecutor(options: InfrastructurePlanExecutorOptions, context: ExecutorContext, dependencies?: InfrastructurePlanDependencies): Promise<{
     success: boolean;
 }>;
 declare const executor: PromiseExecutor<InfrastructurePlanExecutorOptions>;