@empire-builder-kit/nx 1.0.0-rc.4 → 1.0.0-rc.41

package/src/generators/preset/workspace-files-stage-authority.js

@@ -0,0 +1,529 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.renderStageAuthorityWorkspaceFiles = renderStageAuthorityWorkspaceFiles;
+function renderStageAuthorityWorkspaceFiles(options) {
+    return {
+        'docs/stage-deployment-authority.md': `# Stage deployment authority
+
+Each active stage uses one stable deployment role and one runtime permission
+boundary. The authority is independent of framework package candidates and is
+updated only when the reviewed service-family contract changes.
+
+A fresh fully-isolated workspace may bind development and staging before its
+production account exists. Leave an unavailable account explicitly null; do
+not invent an ID or reuse another stage's account. The selected lower stage
+must have its exact account, and every configured account must be distinct.
+Production operations still require the complete three-account topology and
+all existing production controls. This does not relax the complete tuple
+evidence required when migrating ownership of an existing workspace.
+
+Render a stage's CloudFormation template from the committed repository policy:
+
+\`\`\`sh
+pnpm nx run <workspace>:stage-authority-render -- \\
+  --stage=development \\
+  --aws-principal-arn=<temporary-credential-source-role>
+\`\`\`
+
+Locally admitted stages require at least one reviewed
+\`--aws-principal-arn\`.
+
+Rendering, reviewing, and read-only simulation of the emitted templates are
+ordinary work an agent may do with the development profile. Applying the
+owner-claim and authority stacks creates IAM roles and trust and therefore
+requires an account-administrator credential that agents never hold: the agent
+hands the exact rendered \`ownership-template.json\`, \`template.json\`, stack
+names, and parameters to the account administrator, who applies them, and the
+agent verifies afterwards with the read-only ownership doctor.
+
+Stages that require only protected GitHub deployment
+require one exact \`--github-repository\` environment trust and reject local AWS
+principals. Production-isolated staging requires both the local principal and
+the protected GitHub environment trust: local staging remains supported, while
+the protected \`develop\` deployment produces the receipt consumed by production
+promotion. The \`starter\` profile may add that exact GitHub trust to either of
+its locally admitted stages because its GitHub paved road is optional. Fully
+isolated development rejects GitHub trust.
+
+GitHub trust is scoped to the repository's exact stage environment and always
+uses GitHub's immutable owner/repository-ID OIDC subject customization. Every
+\`--github-repository\` must be accompanied by both
+\`--github-owner-id=<numeric-id>\` and
+\`--github-repository-id=<numeric-id>\`; a partial or name-only subject is
+rejected. Obtain the canonical slug and IDs from the GitHub bootstrap report,
+but do not enable immutable subjects yet for an existing repository. First apply the rendered
+\`ownership-template.json\` as the owner-claim stack named in
+\`ownership-manifest.json\`. CloudFormation creates the retained
+\`/ebk/<stage>/workspace-owner\` record atomically. Then apply
+\`template.json\` as the authority stack shown in \`manifest.json\`; its
+CloudFormation Rule reads the exact owner before any IAM change. A second
+workspace therefore cannot address the same account, Region, and stage tuple,
+while a clone retaining the committed deployment ID reuses both stacks.
+Read back and simulate the effective immutable-subject trust, then apply the
+GitHub bootstrap change that configures the repository's default immutable OIDC
+subject. This AWS-trust-first order prevents an existing protected deployment
+from being stranded between the subject-format and trust-policy changes.
+Existing deployed workspaces must first commit the explicit migration evidence
+described in \`docs/workspace-deployment-ownership.md\`; never claim an existing
+tuple by editing policy directly. Read back the deployed template and policies
+and compare their canonical digests before any application mutation. Simulate
+representative permitted lifecycle calls and denied account, trust,
+boundary-removal, cross-stage, cross-account, and cross-Region calls against
+the effective assumed role.
+
+The deployment role is a temporary infrastructure administrator, not a runtime
+workload identity. It therefore receives stable service-family authority for
+the generated architecture instead of a candidate-specific provider-call
+inventory. Sensitive seams remain independently bounded: IAM roles must use the
+generated stage path and permission boundary, \`iam:PassRole\` is limited to
+those roles, Lambda resource-policy mutation follows the generated integration
+and Function URL contracts, later trust-policy mutation is denied, and
+unreviewed direct resource-policy APIs are denied.
+The \`/ebk/<stage>/workloads/\` IAM path is an EBK-owned reserved namespace for
+roles created from reviewed generated infrastructure. External or manually
+managed roles must never be created there, and the deployer's bounded
+\`iam:PassRole\` access to that path is not adopter extension authority.
+Supported generated S3,
+Lambda, SNS, and SQS policy surfaces remain resource-contained. The generated
+edge WAF log group is ARN-contained. CloudWatch Logs exposes
+\`PutResourcePolicy\` only at account scope, with no resource or action-specific
+condition keys, so its reviewed generated payload cannot be inspected by IAM;
+the exact edge Region and reviewed generated source are the honest controls.
+The separate, normally empty Router smoke-access IP set uses the existing
+Pulumi AWS provider's Cloud Control resource lifecycle. Cloud Control
+create/update/delete require \`Resource: "*"\` and offer no resource-type
+condition key. Those orchestration actions and required reads are restricted
+to the edge Region; the service uses the caller's temporary session, with no
+service-role override. Underlying WAF calls still require the stage deployer's
+resource authority and remain subject to its explicit guardrails. Baseline WAF
+IP-set identities are preserved and smoke never edits their addresses.
+When the committed application Region is also the edge Region, ordinary log
+lifecycle mutations are admitted only for the generated stage application and
+API execution-log namespaces; unrelated and other-stage log groups remain
+denied.
+IAM identity
+policies cannot inspect the initial \`AssumeRolePolicyDocument\` supplied to
+\`CreateRole\`. For that create-time field, reviewed generated infrastructure
+source is the control: the temporary deployment principal is trusted to execute
+that source, while later trust-policy mutation remains denied. EBK does not
+claim a postdeployment trust attestor. Runtime roles are created by SST/Pulumi
+in the application stack and must carry the generated stage permission
+boundary.
+
+The policy generator is checked against a compact, versioned extract of AWS's
+official Service Authorization Reference v1.4. Every wildcard-admitted service
+family is covered. Every permission-management action that the role can admit
+is either explicitly denied or an exact reviewed lifecycle seam: bounded
+workload-role IAM operations, AWS-resource KMS grants, generated Lambda
+integration permissions, stage SNS/SQS attributes, and stage/SST S3 bucket
+policy, public-access-block, and ownership controls, plus the generated edge
+WAF log-delivery resource policy described above. Actions the role does not
+admit remain implicitly denied.
+Unsupported replication, alternate RDS topology/integration, export, account
+control, arbitrary user/data-plane, and exfiltration operations remain denied.
+
+Governed nonproduction Slice removal configures the provider to delete the
+versioned confidential-export bucket, removes its deterministic alias, and may
+schedule only a KMS key carrying both the exact stage and
+\`standard-data-export\` management tags. Production export buckets, aliases,
+and keys remain retained and are explicitly denied deletion. Long generated
+bucket names are truncated and hash-suffixed while preserving the
+\`-data-export\` suffix so that protection remains narrowly scoped.
+
+The role may inspect secret metadata. SST 4.17.1's generated Foundation Aurora
+credential is the one value exception: the temporary deployer may put and read
+that exact stage/account/Region-bound secret version so the pinned provider can
+create and reconcile it. The reserved name must also carry the exact
+\`ebk:stage\` tag. \`GetSecretValue\` and \`PutSecretValue\` remain denied for
+operator-secret and all other Slice containers.
+Generated source creates Slice containers inside the deterministic
+\`ebk/<stage>/*\` namespace. The temporary deployer's \`UpdateSecret\` authority
+is denied outside that namespace and the exact generated Foundation
+provider-secret identity. Imported, externally owned or shared, unmanaged,
+other-stage, cross-account, and cross-Region containers remain outside this
+update authority. The namespace is reserved for EBK-owned, stage-exclusive
+containers, including explicitly approved cross-Slice use; imported or
+externally owned containers must use a name outside it. The namespace contract
+covers generated database, machine-client, generated-value, and EBK-owned
+operator containers without adding a new IAM exception for every provider
+resource type. It does not admit
+\`GetSecretValue\` or \`PutSecretValue\` for Slice containers. Because
+\`CreateSecret\` and \`UpdateSecret\` can optionally carry a value, IAM cannot
+distinguish a metadata-only call; reviewed generated source, temporary
+credentials, the stage namespace, and CloudTrail are the honest controls for
+those provider APIs.
+SSM value reads are limited to the stage's Foundation configuration, SST 4.17.1
+bootstrap record, stage-qualified SST passphrases, SST's VPC private-key
+reference, and the exact retained workspace-owner record. The deployment role
+can read but cannot change or delete that owner. Foundation removal enumerates Product Slice registration names and
+metadata without reading their values. Recursive and historical SSM value reads
+are denied. These controls,
+the exact trust, temporary credentials, requested Region, known account/stage
+tags, production-name protections, and explicit protection-removal denies are
+the stable guardrails around the broader infrastructure service families. In
+commercial AWS, CloudFront, CloudFront-scope WAF, and edge ACM mutations use
+the us-east-1 control plane while application resources remain bound to the
+committed deployment Region. This prerelease does not claim Router edge support in
+noncommercial partitions: CloudFront is unavailable inside GovCloud, and the
+China-partition CloudFront/WAF/edge-ACM control plane is not yet proven.
+
+When multiple stages share one AWS account, their application resources,
+runtime roles, data, and discovery remain separately named and tagged, but the
+native SST deployment role is account-scoped enough to reconcile SST's shared
+bootstrap state and assets. Tag and name denies are defense in depth, not a hard
+IAM boundary between same-account deployment roles. Choose
+\`production-isolated\` when production requires an AWS-enforced deployment
+blast-radius boundary from development and staging.
+
+Native SST 4.17.1 development uses a shared untagged AppSync Events API named
+\`sst\` and its \`sst\` namespace in the development account/Region. Development
+authority admits native discovery/creation; the runtime boundary admits only
+connect/publish/subscribe. No API-key, GraphQL, update or deletion authority is
+added. IAM cannot isolate task channel subpaths within this namespace: this is
+a shared developer control plane, not an application event bus or a boundary
+between mutually hostile tasks. Application data/events remain task-scoped.
+Task cleanup never deletes this shared transport. Protected-stage authority is
+unchanged; an incomplete or malformed native API requires investigation.
+
+Native Next.js development also assumes SST's generated web dev-server runtime
+role. Development authority admits only the \`sst-dev\` session in the committed
+Region, for roles in the reserved development workload path carrying both the
+generated \`ebk:dev-runtime=web\` purpose and a development or task-stage tag.
+Purpose does not depend on SST's potentially truncated physical names. Other role paths/accounts and
+protected-stage assumptions remain denied. Runtime roles still cannot assume
+other roles, and their mandatory boundary and task data restrictions remain.
+The owned web launcher requires SST's temporary runtime session and strips
+inherited deployment profile selectors before starting Next. If that handoff
+fails, reconcile this generated authority and inspect \`ebk dev logs <slice>\`,
+then retry \`ebk dev restart <slice>\`. Do not grant the infrastructure deployer
+direct application data access or modify generated runtime trust as a workaround.
+`,
+        'docs/workspace-deployment-ownership.md': `# Workspace deployment ownership
+
+Every generated workspace commits one stable, random \`workspaceDeploymentId\`
+and \`workspaceDeploymentProvenance: { kind: "fresh", schemaVersion: 1 }\`.
+That identity belongs to the workspace, not to a checkout: clones with the same
+committed policy are the same deployment owner.
+
+Before authority or SST lifecycle work, each active account/Region/canonical
+stage tuple must contain exactly one retained String parameter at
+\`/ebk/<stage>/workspace-owner\`. The value binds the tuple to the generated
+deployment ID; the current workspace name remains diagnostic metadata and may
+be renamed without transferring authority. The ownership claim is deliberately
+exclusive and retained. Two workspaces do not cohabit one tuple, and removing
+an application stack does not release the claim.
+
+Render stage authority with \`pnpm nx run ${options.name}:stage-authority-render --
+--stage=<stage> ...\`. An agent may render and review it; an account administrator
+applies the stacks, because they create IAM roles and trust. Apply the emitted \`ownership-template.json\` as the exact
+claim stack in \`ownership-manifest.json\` before applying the authority template.
+CloudFormation's fixed-name SSM create is the atomic claim. The authority
+template accepts only that exact parameter path and fails its Rule before any
+IAM change unless its value is the exact committed owner. The deployment role
+may read the owner but is explicitly denied every owner mutation.
+
+For a read-only report, run
+\`node tools/stage-authority-render.mjs --stage=<stage> --ownership-doctor=true
+--profile=<temporary-profile>\`. It reports \`owned\`, \`unclaimed\`, or \`conflict\`;
+a conflict identifies the committed owner without changing AWS.
+
+## Existing prerelease deployments
+
+An existing policy without the required deployment identity provenance is fail
+closed. Inventory
+each configured tuple read-only and commit bounded evidence under
+\`docs/adoption/\`. The evidence must bind the exact prior policy SHA-256,
+workspace name, proposed \`ebkws-<32 lowercase hex>\` ID, and every configured
+tuple. The ID, exact Region, and every active-stage account must be committed in
+the same migration change; an empty interim topology cannot reserve future
+coordinates. Each tuple declares \`empty\` with no resource digests or
+\`existing-workspace\` with sorted SHA-256 digests of its bounded resource
+identity evidence. Then run the repository-policy generator with both
+\`--workspaceDeploymentId\` and
+\`--workspaceDeploymentMigrationEvidence\`. Report-only mode shows the exact
+result with \`workspaceDeploymentProvenance.kind: "migrated"\`; \`--apply\`
+commits it. Every later policy read revalidates the retained evidence bytes,
+workspace identity, the syntactically valid diagnostic name recorded at migration,
+and exact active stage/account/Region tuple set. The current package name may be
+renamed without renewing ownership evidence because authority is bound to the
+immutable deployment ID rather than that diagnostic label.
+A profile, account, or Region change for a migrated workspace requires a new
+versioned evidence path whose previous-policy digest binds the current policy;
+unrelated policy changes retain the existing binding.
+
+This migration is an explicit ownership assertion, not automatic discovery.
+Never use it to adopt a tuple whose resources belong to another workspace. An
+occupied but unclaimed tuple requires reviewed evidence that the existing
+resources belong to this workspace. There is no implicit compatibility claim,
+ownership transfer, or force-adoption path.
+`,
+        'tools/stage-authority-render.mjs': `import {
+  assertBoundStageAuthorityTemplateFitsBodyLimit,
+  canonicalStageAuthorityTemplate,
+  createStageAuthorityPlan,
+} from '@empire-builder-kit/nx/aws-authority';
+import {
+  configuredDeploymentAccountForStage,
+  configuredDeploymentRegion,
+  isActiveDeploymentStage,
+  readRepositoryOperatingPolicy,
+  requiresGithubDeployment,
+} from '@empire-builder-kit/nx/repository-policy';
+import {
+  bindStageAuthorityTemplateToWorkspaceOwner,
+  canonicalWorkspaceStageOwner,
+  createWorkspaceStageOwnershipClaimPlan,
+  inspectWorkspaceStageOwnership,
+} from '@empire-builder-kit/nx/workspace-deployment';
+import { createHash } from 'node:crypto';
+import { mkdirSync, readFileSync, writeFileSync } from 'node:fs';
+import { join } from 'node:path';
+
+const values = new Map();
+const principals = [];
+for (const argument of process.argv.slice(2)) {
+  const index = argument.indexOf('=');
+  if (!argument.startsWith('--') || index <= 2) {
+    throw new Error('Stage authority arguments must use --name=value.');
+  }
+  const name = argument.slice(2, index);
+  const value = argument.slice(index + 1);
+  if (!value) throw new Error('Stage authority arguments cannot be empty.');
+  if (name === 'aws-principal-arn') principals.push(value);
+  else if (values.has(name)) throw new Error('Duplicate stage authority argument: ' + name);
+  else values.set(name, value);
+}
+const stage = values.get('stage');
+if (!['development', 'staging', 'production'].includes(stage)) {
+  throw new Error('--stage must be development, staging, or production.');
+}
+const policy = readRepositoryOperatingPolicy(process.cwd());
+const rootPackage = JSON.parse(readFileSync('package.json', 'utf8'));
+const workspaceName = rootPackage?.name;
+if (
+  typeof workspaceName !== 'string' ||
+  workspaceName.length > 214 ||
+  !/^(?:@[a-z0-9][a-z0-9._~-]*\\/)?[a-z0-9][a-z0-9._~-]*$/.test(workspaceName)
+) {
+  throw new Error('Workspace ownership requires the current generated root package name.');
+}
+if (policy.deploymentProfile !== '${options.deploymentProfile}') {
+  throw new Error('Generated and committed deployment profiles differ.');
+}
+if (policy.workspaceDeploymentId !== '${options.workspaceDeploymentId}') {
+  throw new Error('Generated and committed workspace deployment identities differ.');
+}
+if (!isActiveDeploymentStage(policy.deploymentProfile, stage)) {
+  throw new Error('Requested stage is inactive for the committed deployment profile.');
+}
+const accountId = configuredDeploymentAccountForStage(
+  policy.deploymentProfile,
+  policy.deploymentAccounts,
+  stage,
+);
+const region = configuredDeploymentRegion(policy.deploymentRegion);
+if (/^(?:us-iso-|us-isob-|eu-isoe-|us-isof-)/.test(region)) {
+  throw new Error(
+    'The committed Region belongs to an unsupported AWS partition. Generated authority supports aws, aws-cn, and aws-us-gov only.',
+  );
+}
+const partition = region.startsWith('cn-')
+  ? 'aws-cn'
+  : region.startsWith('us-gov-')
+    ? 'aws-us-gov'
+    : 'aws';
+const ownershipTarget = {
+  accountId,
+  region,
+  stage,
+  workspaceDeploymentId: policy.workspaceDeploymentId,
+  workspaceName,
+};
+const ownershipDoctor = values.get('ownership-doctor');
+if (ownershipDoctor !== undefined && ownershipDoctor !== 'true') {
+  throw new Error('--ownership-doctor must be exactly true when supplied.');
+}
+if (ownershipDoctor === 'true') {
+  if (principals.length > 0 || values.has('github-repository')) {
+    throw new Error('Workspace ownership doctor does not accept authority trust inputs.');
+  }
+  const profile = values.get('profile');
+  const [{ GetCallerIdentityCommand, STSClient }, { fromIni }] = await Promise.all([
+    import('@aws-sdk/client-sts'),
+    import('@aws-sdk/credential-providers'),
+  ]);
+  const credentials = profile ? fromIni({ profile }) : undefined;
+  const identity = await new STSClient({
+    ...(credentials ? { credentials } : {}),
+    region,
+  }).send(new GetCallerIdentityCommand({}));
+  if (identity.Account !== accountId) {
+    throw new Error('Workspace ownership doctor caller differs from the committed stage account.');
+  }
+  const inspection = await inspectWorkspaceStageOwnership(
+    ownershipTarget,
+    profile ? { profile } : {},
+  );
+  process.stdout.write(JSON.stringify({
+    accountId,
+    expectedOwner: inspection.expectedOwner,
+    kind: 'ebk-workspace-stage-owner-doctor',
+    parameterArn: inspection.parameterArn,
+    region,
+    ...(inspection.status === 'owned'
+      ? { owner: inspection.expectedOwner }
+      : inspection.status === 'conflict' && inspection.actualOwner
+        ? { owner: inspection.actualOwner }
+        : {}),
+    ...(inspection.status === 'conflict' ? { reason: inspection.reason } : {}),
+    schemaVersion: 1,
+    stage,
+    status: inspection.status,
+  }, null, 2) + '\\n');
+  if (inspection.status !== 'owned') process.exitCode = 1;
+} else {
+const repository = values.get('github-repository');
+if (repository && !/^[A-Za-z0-9_.-]+[/][A-Za-z0-9_.-]+$/.test(repository)) {
+  throw new Error('--github-repository must be one exact owner/repository slug.');
+}
+const githubOwnerId = values.get('github-owner-id');
+const githubRepositoryId = values.get('github-repository-id');
+const githubId = /^[1-9][0-9]{0,19}$/;
+if (repository && (!githubOwnerId || !githubRepositoryId)) {
+  throw new Error(
+    '--github-repository requires both --github-owner-id and --github-repository-id.',
+  );
+}
+if ((githubOwnerId || githubRepositoryId) && !repository) {
+  throw new Error('Immutable GitHub IDs require --github-repository.');
+}
+if (
+  (githubOwnerId && !githubId.test(githubOwnerId)) ||
+  (githubRepositoryId && !githubId.test(githubRepositoryId))
+) {
+  throw new Error('Immutable GitHub owner and repository IDs must be positive bounded integers.');
+}
+const githubOnly = requiresGithubDeployment(policy.deploymentProfile, stage);
+const productionIsolatedStaging =
+  policy.deploymentProfile === 'production-isolated' && stage === 'staging';
+const localRequired = !githubOnly;
+const githubRequired = githubOnly || productionIsolatedStaging;
+const githubAllowed = githubRequired || policy.deploymentProfile === 'starter';
+if (localRequired && principals.length === 0) {
+  throw new Error(
+    'Locally admitted stages require at least one reviewed --aws-principal-arn.',
+  );
+}
+if (!localRequired && principals.length > 0) {
+  throw new Error(
+    'Protected GitHub deployment stages reject local --aws-principal-arn trust.',
+  );
+}
+if (githubRequired && !repository) {
+  throw new Error(
+    'This stage requires protected GitHub deployment and one exact --github-repository trust.',
+  );
+}
+if (repository && !githubAllowed) {
+  throw new Error(
+    'This locally admitted isolated-profile stage does not permit GitHub trust.',
+  );
+}
+const [githubOwner, githubRepository] = repository?.split('/') ?? [];
+const githubSubject = repository
+  ? 'repo:' +
+    githubOwner + '@' + githubOwnerId + '/' + githubRepository + '@' + githubRepositoryId +
+    ':environment:' + stage
+  : undefined;
+const plan = createStageAuthorityPlan({
+  accountId,
+  awsPrincipalArns: principals,
+  ...(repository
+    ? {
+        github: {
+          oidcProviderArn:
+            'arn:' + partition + ':iam::' + accountId + ':oidc-provider/token.actions.githubusercontent.com',
+          subject: githubSubject,
+        },
+      }
+    : {}),
+  region,
+  partition,
+  stage,
+});
+const ownership = createWorkspaceStageOwnershipClaimPlan(ownershipTarget);
+const authorityTemplate = bindStageAuthorityTemplateToWorkspaceOwner(
+  plan.template,
+  ownershipTarget,
+);
+assertBoundStageAuthorityTemplateFitsBodyLimit(authorityTemplate);
+const template = canonicalStageAuthorityTemplate(authorityTemplate);
+const directory = join('.ebk', 'authority', stage);
+mkdirSync(directory, { mode: 0o700, recursive: true });
+const templatePath = join(directory, 'template.json');
+const manifestPath = join(directory, 'manifest.json');
+const ownershipTemplate = canonicalStageAuthorityTemplate(ownership.template);
+const ownershipTemplatePath = join(directory, 'ownership-template.json');
+const ownershipManifestPath = join(directory, 'ownership-manifest.json');
+writeFileSync(templatePath, template, { encoding: 'utf8', mode: 0o600 });
+writeFileSync(ownershipTemplatePath, ownershipTemplate, {
+  encoding: 'utf8',
+  mode: 0o600,
+});
+const ownershipTemplateSha256 = createHash('sha256')
+  .update(ownershipTemplate)
+  .digest('hex');
+const ownershipManifest = {
+  accountId,
+  digest: ownershipTemplateSha256,
+  kind: 'ebk-workspace-stage-owner-claim',
+  parameterArn: ownership.parameterArn,
+  parameterName: ownership.parameterName,
+  region,
+  schemaVersion: 1,
+  stackName: ownership.stackName,
+  stage,
+  templateSha256: ownershipTemplateSha256,
+  workspaceDeploymentId: policy.workspaceDeploymentId,
+  workspaceName,
+};
+writeFileSync(
+  ownershipManifestPath,
+  JSON.stringify(ownershipManifest, null, 2) + '\\n',
+  { encoding: 'utf8', mode: 0o600 },
+);
+const templateSha256 = createHash('sha256').update(template).digest('hex');
+const manifest = {
+  accountId,
+  deploymentRoleArn: plan.identity.deploymentRoleArn,
+  digest: templateSha256,
+  kind: 'ebk-stage-authority-render',
+  limitations: plan.limitations,
+  profile: policy.deploymentProfile,
+  region,
+  schemaVersion: 1,
+  stackName: plan.identity.stackName,
+  stage,
+  templateSha256,
+  workspaceDeploymentId: policy.workspaceDeploymentId,
+  workspaceName,
+  workspaceOwner: canonicalWorkspaceStageOwner(ownershipTarget),
+  workspaceOwnerClaimStackName: ownership.stackName,
+  workspaceOwnerManifestPath: ownershipManifestPath,
+};
+writeFileSync(manifestPath, JSON.stringify(manifest, null, 2) + '\\n', {
+  encoding: 'utf8',
+  mode: 0o600,
+});
+process.stdout.write(JSON.stringify({
+  manifestPath,
+  ...manifest,
+  ownershipManifestPath,
+  ownershipTemplatePath,
+  templatePath,
+}) + '\\n');
+}
+`,
+    };
+}
+//# sourceMappingURL=workspace-files-stage-authority.js.map

package/src/generators/preset/workspace-files-thin-deploy.d.ts

@@ -0,0 +1,65 @@
+import type { DeploymentProfile } from '../../repository-policy/index.js';
+export declare const THIN_DEPLOY_WORKFLOW_PATH: ".github/workflows/deploy.yml";
+export interface ThinDeployActionPins {
+    cache: string;
+    checkout: string;
+    configureAwsCredentials: string;
+    downloadArtifact: string;
+    pnpmSetup: string;
+    setupNode: string;
+    uploadArtifact: string;
+}
+export interface ThinDeployToolVersions {
+    node: string;
+    sst: string;
+}
+export interface ThinDeployWorkflowOptions {
+    actionPins: ThinDeployActionPins;
+    /** trunk (starter only): main pushes call the deploy workflow for production. */
+    deliveryLane?: 'protected-pair' | 'trunk';
+    deploymentProfile: DeploymentProfile;
+    name: string;
+    /**
+     * trunk-promotion (isolated profiles only): a successful staging lifecycle on
+     * develop promotes and deploys production in the same run, then records the
+     * deployed commit on main; promotion-pr and environment-reviewer keep the
+     * develop-to-main promotion pull request.
+     */
+    productionApprovalMode?: ThinDeployProductionApprovalMode;
+    toolVersions: ThinDeployToolVersions;
+}
+export type ThinDeployProductionApprovalMode = 'promotion-pr' | 'environment-reviewer' | 'trunk-promotion';
+/** The production environment secret that lets record-main fast-forward main. */
+export declare const EBK_RECORD_MAIN_TOKEN_SECRET: "EBK_RECORD_MAIN_TOKEN";
+export interface ThinDeployWorkflowFilePlan {
+    files: Readonly<Record<typeof THIN_DEPLOY_WORKFLOW_PATH, string>>;
+    managedPaths: readonly [typeof THIN_DEPLOY_WORKFLOW_PATH];
+}
+export declare function renderThinDeployVerifyCaller(profile: DeploymentProfile, deliveryLane?: 'protected-pair' | 'trunk', productionApprovalMode?: ThinDeployProductionApprovalMode): string;
+/** @internal Run exactly this generated script in the protected-runner fixture. */
+export declare function protectedBrowserInstallScript(): string;
+/**
+ * @internal Run exactly this generated script in the protected-runner fixture.
+ *
+ * Reads the deploying stage's GitHub environment variables through request
+ * names and exports the canonical machine-credential variables only when they
+ * are set. An unset GitHub variable expands to '', which the generated Slice
+ * SST config would read as a generation rather than its blue-1 default, so the
+ * canonical names never reach the lifecycle when the request is empty.
+ */
+export declare function machineCredentialRequestScript(): string;
+/** @internal Exported for executable source-contract tests. */
+export declare function exactStageDeployerGuardScript(operation: string, accountVariable: string): string;
+/** @internal Shared verbatim by every generated protected workflow. */
+export declare function canonicalStageAuthorityDerivationScript(): string;
+/** @internal Exported for executable source-contract tests. */
+export declare function exactStagingPromotionPullGuardScript(): string;
+/** @internal Shared verbatim with the generated workflow and executable tests. */
+export declare function stagingPromotionReceiptValidationScript(): string;
+/** @internal Shared verbatim with the generated workflow and executable tests. */
+export declare function restoredCandidateValidationScript(): string;
+/** @internal Shared verbatim with the generated workflow and executable tests. */
+export declare function stagingPromotionSealScript(): string;
+/** @internal Shared verbatim with the generated workflow and executable tests. */
+export declare function postdeploySupplyChainBindingScript(): string;
+export declare function renderThinDeployWorkflowFilePlan(options: ThinDeployWorkflowOptions): ThinDeployWorkflowFilePlan;