@empire-builder-kit/nx 1.0.0-rc.4 → 1.0.0-rc.41

package/src/executors/sst-lifecycle/governed-native-operation.js

@@ -0,0 +1,163 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.createTtyGovernedNativeOperationApprover = createTtyGovernedNativeOperationApprover;
+exports.runGovernedNativeOperation = runGovernedNativeOperation;
+const promises_1 = require("node:readline/promises");
+const devkit_1 = require("@nx/devkit");
+const index_js_1 = require("../../aws-authority/index.js");
+const index_js_2 = require("../../repository-policy/index.js");
+const federated_credential_transport_js_1 = require("../local-deploy/federated-credential-transport.js");
+const local_deploy_js_1 = require("../local-deploy/local-deploy.js");
+const task_unlock_js_1 = require("./task-unlock.js");
+const run_sst_command_js_1 = require("./run-sst-command.js");
+const SHA = /^[a-f0-9]{40,64}$/u;
+function partitionForRegion(region) {
+    if (region.startsWith('cn-'))
+        return 'aws-cn';
+    if (region.startsWith('us-gov-'))
+        return 'aws-us-gov';
+    return 'aws';
+}
+function readSource(root) {
+    const identity = (0, local_deploy_js_1.localWorkingTreeDigest)(root);
+    const commit = identity.commit;
+    if (!SHA.test(commit)) {
+        throw new Error('Governed native lifecycle could not resolve one exact Git HEAD.');
+    }
+    return {
+        clean: identity.clean,
+        commit,
+        workingTreeDigest: identity.digest,
+    };
+}
+const LOCAL_PROTECTED_LIFECYCLE_TTY_MESSAGE = 'Local protected-stage lifecycle mutation requires a human at an interactive TTY to type the exact acknowledgement challenge. Development needs no acknowledgement. An agent without a terminal should hand the human the exact command to run in their own terminal, or propose the change through the protected GitHub workflow.';
+/** Active operator acknowledgement, not an independent-review claim. */
+function createTtyGovernedNativeOperationApprover(terminal = {
+    input: process.stdin,
+    output: process.stderr,
+}) {
+    return async ({ challenge }) => {
+        if (!terminal.input.isTTY || !terminal.output.isTTY) {
+            throw new Error(LOCAL_PROTECTED_LIFECYCLE_TTY_MESSAGE);
+        }
+        const prompt = (0, promises_1.createInterface)({
+            input: terminal.input,
+            output: terminal.output,
+            terminal: true,
+        });
+        try {
+            return ((await prompt.question(`Type ${challenge} to continue: `)) === challenge);
+        }
+        catch {
+            throw new Error(LOCAL_PROTECTED_LIFECYCLE_TTY_MESSAGE);
+        }
+        finally {
+            prompt.close();
+        }
+    };
+}
+/**
+ * Govern refresh, remove, and unlock without replacing SST's native lifecycle.
+ * Local execution flattens the operator's federated profile into one private,
+ * invocation-scoped profile; protected stages additionally require a TTY
+ * acknowledgement. GitHub OIDC proceeds through the existing native path.
+ */
+async function runGovernedNativeOperation(command, options, context, dependencies = {}) {
+    if (command === 'unlock' && options.stage?.startsWith('personal-')) {
+        return (0, task_unlock_js_1.runCurrentTaskUnlock)(options, context, {
+            ...dependencies.taskUnlock,
+            createTransport: dependencies.createTransport,
+            environment: dependencies.environment,
+            run: dependencies.run,
+        });
+    }
+    try {
+        (0, run_sst_command_js_1.assertGovernedAwsLifecyclePlatform)(dependencies.platform);
+    }
+    catch (error) {
+        devkit_1.logger.error(error instanceof Error ? error.message : String(error));
+        return { success: false };
+    }
+    const environment = dependencies.environment ?? process.env;
+    const run = dependencies.run ?? run_sst_command_js_1.runSstCommand;
+    if (environment.GITHUB_ACTIONS === 'true') {
+        return run(command, options, context, { environment });
+    }
+    let transport;
+    try {
+        const policy = (0, index_js_2.readRepositoryOperatingPolicy)(context.root);
+        const stage = options.stage?.trim() ?? '';
+        if (!(0, index_js_2.isActiveDeploymentStage)(policy.deploymentProfile, stage)) {
+            throw new Error(`Lifecycle stage ${stage || '<absent>'} is inactive for the ${policy.deploymentProfile} deployment profile.`);
+        }
+        if ((0, index_js_2.requiresGithubDeployment)(policy.deploymentProfile, stage)) {
+            throw new Error(`The ${policy.deploymentProfile} profile requires GitHub deployment authority for ${stage}.`);
+        }
+        const region = (0, index_js_2.configuredDeploymentRegion)(policy.deploymentRegion);
+        if (options.region?.trim() && options.region.trim() !== region) {
+            throw new Error(`Lifecycle Region ${options.region.trim()} differs from committed deployment Region ${region}.`);
+        }
+        const account = (0, index_js_2.configuredDeploymentAccountForStage)(policy.deploymentProfile, policy.deploymentAccounts, stage);
+        const expectedRoleArn = (0, index_js_1.createStageAuthorityIdentity)({
+            accountId: account,
+            partition: partitionForRegion(region),
+            region,
+            stage,
+        }).deploymentRoleArn;
+        const source = (dependencies.readSource ?? readSource)(context.root);
+        if (stage !== 'development' && !source.clean) {
+            throw new Error(`Local ${stage} ${command} requires a completely clean source tree.`);
+        }
+        if (stage !== 'development') {
+            const challenge = `approve:${command}:${stage}:${source.commit}`;
+            const acknowledged = await (dependencies.approve ?? createTtyGovernedNativeOperationApprover())({
+                action: command,
+                challenge,
+                sourceCommit: source.commit,
+                stage,
+            });
+            if (!acknowledged) {
+                throw new Error(`Local ${stage} ${command} acknowledgement was declined.`);
+            }
+        }
+        transport = await (dependencies.createTransport ?? federated_credential_transport_js_1.createLocalFederatedCredentialTransport)({
+            account,
+            expectedRoleArn,
+            ...(options.profile ? { profile: options.profile } : {}),
+            region,
+        });
+        await transport.refresh();
+        const childEnvironment = {
+            ...transport.childEnvironment(environment),
+            AWS_EXPECTED_ACCOUNT_ID: account,
+            AWS_REGION: region,
+            EBK_NX_STAGE_LIFECYCLE: 'local',
+            EBK_LOCAL_SOURCE_TREE: source.workingTreeDigest,
+            EBK_SOURCE_COMMIT: source.commit,
+        };
+        const result = await run(command, {
+            ...options,
+            expectedRoleArn,
+            profile: transport.profile,
+            region,
+            stage,
+        }, context, { environment: childEnvironment });
+        transport.cleanup();
+        transport = undefined;
+        return result;
+    }
+    catch (error) {
+        devkit_1.logger.error(error instanceof Error ? error.message : String(error));
+        if (transport) {
+            try {
+                transport.cleanup();
+                transport = undefined;
+            }
+            catch {
+                devkit_1.logger.error('Local federated credential transport cleanup failed; lifecycle acceptance is blocked.');
+            }
+        }
+        return { success: false };
+    }
+}
+//# sourceMappingURL=governed-native-operation.js.map

package/src/executors/sst-lifecycle/logging-preflight.d.ts

@@ -9,6 +9,11 @@ export interface ManagedLogGroupPreflightDependencies {
     }) => Promise<ExistingManagedLogGroup[]>;
     readJson: (path: string) => Promise<unknown>;
 }
+export declare function managedLogGroupResourceArn(group: Readonly<{
+    arn?: string;
+    logGroupArn?: string;
+}>, name: string): string;
+export declare function sstStateExportArguments(invocation: SstCommandInvocation): string[];
 export declare function loadManagedLogGroupContracts(input: {
     context: ExecutorContext;
     invocation: SstCommandInvocation;

package/src/executors/sst-lifecycle/logging-preflight.js

@@ -1,5 +1,7 @@
 "use strict";
 Object.defineProperty(exports, "__esModule", { value: true });
+exports.managedLogGroupResourceArn = managedLogGroupResourceArn;
+exports.sstStateExportArguments = sstStateExportArguments;
 exports.loadManagedLogGroupContracts = loadManagedLogGroupContracts;
 exports.preflightManagedLogGroups = preflightManagedLogGroups;
 const deterministic_order_js_1 = require("../../deterministic-order.js");
@@ -26,6 +28,15 @@ async function readJson(path) {
         throw new Error(`Managed log-group preflight input is not JSON: ${path}.`);
     }
 }
+function managedLogGroupResourceArn(group, name) {
+    const candidate = group.logGroupArn ?? group.arn?.replace(/:\*$/u, '');
+    if (!candidate ||
+        candidate.endsWith(':*') ||
+        !/^arn:(?:aws|aws-cn|aws-us-gov):logs:[a-z0-9-]+:\d{12}:log-group:\S+$/u.test(candidate)) {
+        throw new Error(`CloudWatch Logs did not return an exact resource ARN for existing group ${name}.`);
+    }
+    return candidate;
+}
 async function inventoryManagedLogGroups(names, options) {
     const client = new client_cloudwatch_logs_1.CloudWatchLogsClient({
         ...(options.profile
@@ -42,10 +53,7 @@ async function inventoryManagedLogGroups(names, options) {
         const group = described.logGroups?.find((candidate) => candidate.logGroupName === name);
         if (!group)
             continue;
-        const arn = group.arn ?? group.logGroupArn;
-        if (!arn) {
-            throw new Error(`CloudWatch Logs did not return an ARN for existing group ${name}.`);
-        }
+        const arn = managedLogGroupResourceArn(group, name);
         const [tagResult, indexResult] = await Promise.all([
             client.send(new client_cloudwatch_logs_1.ListTagsForResourceCommand({ resourceArn: arn })),
             client.send(new client_cloudwatch_logs_1.DescribeIndexPoliciesCommand({ logGroupIdentifiers: [arn] })),
@@ -59,15 +67,8 @@ async function inventoryManagedLogGroups(names, options) {
     client.destroy();
     return existing;
 }
-function exportSstState(invocation, options) {
-    const args = [
-        invocation.args[0],
-        'state',
-        'export',
-        '--stage',
-        invocation.environment.EBK_CONSUMER_STAGE,
-        ...(options.profile ? ['--profile', options.profile] : []),
-    ];
+function exportSstState(invocation, _options) {
+    const args = sstStateExportArguments(invocation);
     return new Promise((resolve, reject) => {
         const child = (0, node_child_process_1.spawn)(invocation.executable, args, {
             cwd: invocation.cwd,
@@ -119,6 +120,15 @@ function exportSstState(invocation, options) {
         });
     });
 }
+function sstStateExportArguments(invocation) {
+    return [
+        invocation.args[0],
+        'state',
+        'export',
+        '--stage',
+        invocation.environment.EBK_CONSUMER_STAGE,
+    ];
+}
 async function loadManagedLogGroupContracts(input) {
     if (!input.context.projectName) {
         throw new Error('Managed log-group preflight requires the exact Nx project name.');

package/src/executors/sst-lifecycle/run-sst-command.d.ts

@@ -2,12 +2,17 @@ import { type ExecutorContext } from '@nx/devkit';
 import { spawn } from 'node:child_process';
 import { type FoundationStageResolution } from '../../foundation/stages.js';
 import { type PersonalStageResolver } from '../../local-dev/personal-stage.js';
-import { preflightManagedLogGroups } from './logging-preflight.js';
+import { type DeploymentProfile } from '../../repository-policy/index.js';
+import { assertWorkspaceStageOwnershipForWorkspace } from '../../workspace-deployment/index.js';
 import { preflightSliceSecretMetadata } from './secret-preflight.js';
+import { acquireTaskNativeWriterLease, type TaskNativeWriterEffects } from '../../local-dev/task-native-writer.js';
+import { initializeProtectedDeploymentSecrets } from '../secret-initialize/secret-initialize.js';
+import { retireGeneratedSecretsAfterSliceRemove } from './generated-secret-retirement.js';
 export type SstLifecycleCommand = 'deploy' | 'dev' | 'refresh' | 'remove' | 'unlock';
 export interface SstLifecycleOptions {
     args?: string[];
     cwd?: string;
+    expectedRoleArn?: string;
     foundationStage?: string;
     profile?: string;
     region?: string;
@@ -19,31 +24,66 @@ export interface SstCommandInvocation {
     args: string[];
     cwd: string;
     environment: {
+        AWS_EXPECTED_ACCOUNT_ID?: string;
+        AWS_PROFILE?: string;
         AWS_REGION?: string;
         EBK_CONSUMER_STAGE: string;
+        EBK_EXPECTED_DEPLOYMENT_ROLE_ARN?: string;
         EBK_FOUNDATION_STAGE: string;
+        EBK_LOCAL_SOURCE_TREE?: string;
         EBK_PRODUCTION_FOUNDATION_PROFILE?: string;
+        EBK_SOURCE_COMMIT?: string;
+        EBK_NX_TASK_CLEANUP?: string;
+        EBK_NX_TASK_UNLOCK?: string;
     };
     executable: string;
 }
 export interface SstLifecyclePreflightDependencies {
-    infrastructureAuthorization?: (command: 'deploy' | 'refresh' | 'remove', options: SstLifecycleOptions, context: ExecutorContext, invocation: SstCommandInvocation) => Promise<void>;
-    logging?: typeof preflightManagedLogGroups;
+    initializeSecrets?: typeof initializeProtectedDeploymentSecrets;
+    ownership?: typeof assertWorkspaceStageOwnershipForWorkspace;
     secrets?: typeof preflightSliceSecretMetadata;
+    unlockAuthorization?: (options: SstLifecycleOptions, invocation: SstCommandInvocation, environment?: NodeJS.ProcessEnv) => Promise<void> | void;
 }
 interface SstLifecycleRuntimeDependencies extends SstLifecyclePreflightDependencies {
-    infrastructureConvergence?: (command: 'deploy' | 'refresh' | 'remove', options: SstLifecycleOptions, context: ExecutorContext, invocation: SstCommandInvocation, applySucceeded: boolean) => Promise<boolean>;
+    environment?: NodeJS.ProcessEnv;
+    generatedSecretRetirement?: typeof retireGeneratedSecretsAfterSliceRemove;
+    platform?: NodeJS.Platform;
     spawnChild?: typeof spawn;
+    taskNativeWriterEffects?: TaskNativeWriterEffects;
+    acquireTaskWriter?: typeof acquireTaskNativeWriterLease;
 }
+export declare function assertGovernedAwsLifecyclePlatform(platform?: NodeJS.Platform): void;
+export interface GovernedChildProcessResult {
+    error?: Error;
+    signal: NodeJS.Signals | null;
+    status: number | null;
+}
+/** Run one exact shell-free child as an owned process tree. The returned
+ * promise settles only after child teardown and the bounded caller-supplied
+ * close reconciliation complete. */
+export declare function runGovernedChildProcess(input: {
+    afterClose?: (result: GovernedChildProcessResult) => Promise<void> | void;
+    args: readonly string[];
+    cwd: string;
+    environment: NodeJS.ProcessEnv;
+    executable: string;
+    spawnChild?: typeof spawn;
+    /**
+     * Defaults to inheriting all three streams. A structured caller may route
+     * the child's stdout to the parent's stderr (`['inherit', 2, 'inherit']`)
+     * so its own stdout carries only the structured result.
+     */
+    stdio?: 'inherit' | readonly ['inherit', 2, 'inherit'];
+}): Promise<GovernedChildProcessResult>;
 export declare function createSstChildEnvironment(ambient: NodeJS.ProcessEnv, invocation: SstCommandInvocation['environment']): NodeJS.ProcessEnv;
 export declare function assertSafeSstForwardedArguments(args: readonly string[]): void;
 export declare function resolveSstDevMode(environment: NodeJS.ProcessEnv, forwardedArguments?: readonly string[]): 'basic' | 'mono' | undefined;
-export declare function assertSstLifecyclePolicy(command: SstLifecycleCommand, stage: string, environment?: NodeJS.ProcessEnv): void;
+export declare function assertSstLifecyclePolicy(command: SstLifecycleCommand, stage: string, environment?: NodeJS.ProcessEnv, deploymentProfile?: DeploymentProfile): void;
 export declare function resolveSstLifecycleStages(options: SstLifecycleOptions, environment?: NodeJS.ProcessEnv): FoundationStageResolution;
 export declare function buildSstCommandInvocation(command: SstLifecycleCommand, options: SstLifecycleOptions, context: ExecutorContext, environment?: NodeJS.ProcessEnv, dependencies?: {
     personalStageResolver?: PersonalStageResolver;
 }): SstCommandInvocation;
-export declare function runSstLifecyclePreflights(command: SstLifecycleCommand, options: SstLifecycleOptions, context: ExecutorContext, invocation: SstCommandInvocation, dependencies?: SstLifecyclePreflightDependencies): Promise<void>;
+export declare function runSstLifecyclePreflights(command: SstLifecycleCommand, options: SstLifecycleOptions, context: ExecutorContext, invocation: SstCommandInvocation, dependencies?: SstLifecyclePreflightDependencies, environment?: NodeJS.ProcessEnv): Promise<void>;
 export declare function runSstCommand(command: SstLifecycleCommand, options: SstLifecycleOptions, context: ExecutorContext, dependencies?: SstLifecycleRuntimeDependencies): Promise<{
     success: boolean;
 }>;