@intentius/chant-lexicon-aws 0.124.31 → 0.124.32

package/dist/generated/runtime.js

@@ -0,0 +1,4 @@
+/**
+ * Runtime factory constructors — re-exported from core.
+ */
+export { createResource, createProperty } from "@intentius/chant/runtime";

package/dist/governance.js

@@ -0,0 +1,131 @@
+/**
+ * AWS governance authoring: the desired-state config
+ * shape an external governance reconciler applies, and `landingZoneConfig()` —
+ * the typed authoring layer that emits it.
+ *
+ * This is deliberately NOT a composite. The evaluability rules (EVL002/004,
+ * #916/#952) require composites to declare a fixed set of resources, so a
+ * data-driven OU tree walker cannot be one. The split mirrors the SCM
+ * reconcilers: authoring emits config (this module, arbitrary cardinality);
+ * resources for greenfield bootstrap are the fixed-shape composites in
+ * `composites/landing-zone.ts`; the reconciler consumes only the config.
+ *
+ * GCP (Folder/OrgPolicy/AuditConfig) and Azure (blocked on #1545)
+ * counterparts followed the same shape.
+ */
+// ---------------------------------------------------------------------------
+// Baseline guardrails (shared with the bootstrap composites)
+// ---------------------------------------------------------------------------
+export const DENY_LEAVE_ORGANIZATION = {
+    description: "Member accounts may not remove themselves from the organization.",
+    document: {
+        Version: "2012-10-17",
+        Statement: [{ Effect: "Deny", Action: "organizations:LeaveOrganization", Resource: "*" }],
+    },
+};
+export const DENY_AUDIT_TAMPER = {
+    description: "Audit trails and recorders cannot be stopped or deleted from member accounts.",
+    document: {
+        Version: "2012-10-17",
+        Statement: [
+            {
+                Effect: "Deny",
+                Action: [
+                    "cloudtrail:StopLogging",
+                    "cloudtrail:DeleteTrail",
+                    "config:StopConfigurationRecorder",
+                    "config:DeleteConfigurationRecorder",
+                    "config:DeleteDeliveryChannel",
+                ],
+                Resource: "*",
+            },
+        ],
+    },
+};
+/** Deny requests outside `regions`, excepting global services. */
+export function regionRestriction(regions) {
+    return {
+        description: `Deny requests outside [${regions.join(", ")}] except global services.`,
+        document: {
+            Version: "2012-10-17",
+            Statement: [
+                {
+                    Effect: "Deny",
+                    NotAction: [
+                        "iam:*",
+                        "organizations:*",
+                        "route53:*",
+                        "cloudfront:*",
+                        "sts:*",
+                        "support:*",
+                        "budgets:*",
+                    ],
+                    Resource: "*",
+                    Condition: { StringNotEquals: { "aws:RequestedRegion": regions } },
+                },
+            ],
+        },
+    };
+}
+/**
+ * The recommended foundation OU structure. Exported so callers can extend it
+ * rather than restate it.
+ */
+export const FOUNDATION_OUS = {
+    Security: { scps: ["deny-audit-tamper"] },
+    Infrastructure: {},
+    Sandbox: {},
+    Workloads: {},
+};
+/**
+ * Author the desired-state tree an external governance reconciler applies.
+ * Pure. Throws when the tree attaches an SCP name with no definition; only
+ * SCPs the tree actually attaches are included in the output.
+ */
+export function landingZoneConfig(props = {}) {
+    const foundation = props.foundation ?? true;
+    const scps = {
+        ...(foundation
+            ? { "deny-leave-organization": DENY_LEAVE_ORGANIZATION, "deny-audit-tamper": DENY_AUDIT_TAMPER }
+            : {}),
+        ...(props.allowedRegions?.length ? { "region-restriction": regionRestriction(props.allowedRegions) } : {}),
+        ...props.scps,
+    };
+    const ous = { ...(foundation ? FOUNDATION_OUS : {}), ...props.ous };
+    const rootScps = [
+        ...(foundation ? ["deny-leave-organization"] : []),
+        ...(props.allowedRegions?.length ? ["region-restriction"] : []),
+        ...(props.rootScps ?? []),
+    ];
+    const attached = new Set(rootScps);
+    const collect = (tree) => {
+        for (const node of Object.values(tree)) {
+            for (const s of node.scps ?? [])
+                attached.add(s);
+            if (node.children)
+                collect(node.children);
+        }
+    };
+    collect(ous);
+    for (const name of attached) {
+        if (!scps[name])
+            throw new Error(`landingZoneConfig: SCP "${name}" is attached but not defined in scps`);
+    }
+    if (props.identity) {
+        const granted = [...(props.identity.assignments ?? []), ...(props.identity.breakGlass ? [props.identity.breakGlass] : [])];
+        for (const a of granted) {
+            if (!props.identity.permissionSets[a.permissionSet]) {
+                throw new Error(`landingZoneConfig: assignment for "${a.principal}" references permission set "${a.permissionSet}" not defined in identity.permissionSets`);
+            }
+        }
+    }
+    return {
+        organization: rootScps.length ? { scps: rootScps } : {},
+        ous,
+        scps: Object.fromEntries(Object.entries(scps).filter(([n]) => attached.has(n))),
+        ...(props.identity ? { identity: props.identity } : {}),
+        ...(props.cloudtrailBucket
+            ? { auditSinks: { cloudtrail: { bucket: props.cloudtrailBucket, multiRegion: true } } }
+            : {}),
+    };
+}

package/dist/identity-observe.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"identity-observe.d.ts","sourceRoot":"","sources":["../src/identity-observe.ts"],"names":[],"mappings":"AAwBA,OAAO,EAA4C,KAAK,oBAAoB,EAAgC,MAAM,mBAAmB,CAAC;AACtI,OAAO,KAAK,EAAE,gBAAgB,EAAE,MAAM,0BAA0B,CAAC;AAmBjE;;;;;GAKG;AACH,wBAAgB,kBAAkB,CAAC,UAAU,EAAE,MAAM,EAAE,KAAK,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,GAAG,MAAM,GAAG,SAAS,CAazG;AAkCD;;;;;GAKG;AACH,wBAAsB,iBAAiB,CACrC,WAAW,EAAE,MAAM,EAAE,EACrB,QAAQ,EAAE,GAAG,CAAC,MAAM,EAAE;IAAE,UAAU,EAAE,MAAM,CAAC;IAAC,KAAK,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAA;CAAE,CAAC,GAAG,SAAS,EACzF,OAAO,EAAE,MAAM,CAAC,MAAM,EAAE,gBAAgB,CAAC,EACzC,MAAM,EAAE,oBAAoB,GAC3B,OAAO,CAAC;IAAE,SAAS,EAAE,MAAM,CAAC,MAAM,EAAE,gBAAgB,CAAC,CAAC;IAAC,OAAO,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAA;CAAE,CAAC,CA4B3F"}
+{"version":3,"file":"identity-observe.d.ts","sourceRoot":"","sources":["../src/identity-observe.ts"],"names":[],"mappings":"AAyBA,OAAO,EAA4C,KAAK,oBAAoB,EAAgC,MAAM,mBAAmB,CAAC;AACtI,OAAO,KAAK,EAAE,gBAAgB,EAAE,MAAM,0BAA0B,CAAC;AAmBjE;;;;;GAKG;AACH,wBAAgB,kBAAkB,CAAC,UAAU,EAAE,MAAM,EAAE,KAAK,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,GAAG,MAAM,GAAG,SAAS,CAazG;AAkCD;;;;;GAKG;AACH,wBAAsB,iBAAiB,CACrC,WAAW,EAAE,MAAM,EAAE,EACrB,QAAQ,EAAE,GAAG,CAAC,MAAM,EAAE;IAAE,UAAU,EAAE,MAAM,CAAC;IAAC,KAAK,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAA;CAAE,CAAC,GAAG,SAAS,EACzF,OAAO,EAAE,MAAM,CAAC,MAAM,EAAE,gBAAgB,CAAC,EACzC,MAAM,EAAE,oBAAoB,GAC3B,OAAO,CAAC;IAAE,SAAS,EAAE,MAAM,CAAC,MAAM,EAAE,gBAAgB,CAAC,CAAC;IAAC,OAAO,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAA;CAAE,CAAC,CA4B3F"}

package/dist/identity-observe.js

@@ -0,0 +1,127 @@
+/**
+ * The identity fallback on the stack read (#1647).
+ *
+ * `describeResources` asks CloudFormation exactly one question — is there a
+ * logical id named <entity> in this stack? — which reads a freshly
+ * carve-emitted, still-Terraform-owned resource as confirmed-absent even
+ * though the declared `BucketName` names it precisely. When a declared entity
+ * is absent from the stack AND its props spell the type's full primary
+ * identifier (the spec knowledge the codegen already compiled into
+ * `lexicon-aws.json`), ask Cloud Control for it by identity. Found means
+ * OBSERVED: `ownership: "foreign"` (it exists and something other than this
+ * stack owns it — Terraform, a console hand, another tool) and
+ * `status: "EXTERNAL"` (live outside the stack, deliberately not a
+ * CloudFormation status word).
+ *
+ * Best-effort ON TOP of a stack answer, never instead of one: a genuine miss
+ * (`ResourceNotFoundException`) keeps the stack's absent verdict, and so does
+ * every other refusal (`UnsupportedOperation` — a Floci without Cloud
+ * Control — credentials, throttling). The stack read succeeded; absence at
+ * stack scope is an honest verdict this fallback can refine but must never
+ * degrade into a hole, or a pre-first-apply plan would stop proposing
+ * `create` the moment the emulator lacks Cloud Control.
+ */
+import { createRequire } from "module";
+import { moduleSourceUrl } from "@intentius/chant/module-source";
+import { AwsReadError, getResource, listResources } from "./api/read-client.js";
+const require = createRequire(moduleSourceUrl(import.meta.url));
+let byResourceType;
+function manifestByType() {
+    if (!byResourceType) {
+        const manifest = require("./generated/lexicon-aws.json");
+        byResourceType = new Map(Object.values(manifest).map((e) => [e.resourceType, e]));
+    }
+    return byResourceType;
+}
+/**
+ * The Cloud Control identifier the declared props spell, or undefined when the
+ * type has no primary identifier on record or any part of it is absent or
+ * non-scalar (a Ref, an intrinsic, a server-assigned name). Multi-part
+ * identifiers join with `|`, Cloud Control's own separator.
+ */
+export function declaredIdentifier(entityType, props) {
+    const entry = manifestByType().get(entityType);
+    const parts = entry?.primaryIdentifier;
+    if (!entry || entry.kind !== "resource" || !parts || parts.length === 0)
+        return undefined;
+    const values = [];
+    for (const part of parts) {
+        const v = props[part];
+        if (typeof v !== "string" && typeof v !== "number")
+            return undefined;
+        const s = String(v);
+        if (!s)
+            return undefined;
+        values.push(s);
+    }
+    return values.join("|");
+}
+/**
+ * `GetResource`, with a `ListResources` + identifier-match fallback when the
+ * endpoint says the operation itself is unsupported. That is Floci's exact
+ * answer (read-client's own note) while it serves `ListResources` fine — and
+ * an emulator is exactly where the carve state lives, so without this leg the
+ * fallback proves itself everywhere except the one place the walkthrough
+ * films it. Every other refusal propagates: the caller decides what a failed
+ * refinement means.
+ */
+async function readByIdentity(typeName, identifier, client) {
+    try {
+        return await getResource(typeName, identifier, client);
+    }
+    catch (err) {
+        if (!(err instanceof AwsReadError) || err.code !== "UnsupportedOperation")
+            throw err;
+        const listed = await listResources(typeName, client);
+        return listed.find((d) => d.identifier === identifier) ?? null;
+    }
+}
+/** The same scrub the stack-output path applies, on live property KEYS. */
+function redactSensitive(properties) {
+    const out = {};
+    for (const [key, value] of Object.entries(properties)) {
+        out[key] = /password|secret|token/i.test(key) ? "[REDACTED]" : value;
+    }
+    return Object.keys(out).length > 0 ? out : undefined;
+}
+/**
+ * Identity-read every entity the stack did not answer for and whose props
+ * spell an identifier. `already` is the stack's answer — an entity the stack
+ * DID return is never re-read. The `queried` map records the address each
+ * attempted read was issued against (#1620), whatever the verdict.
+ */
+export async function observeByIdentity(entityNames, entities, already, client) {
+    const resources = {};
+    const queried = {};
+    if (!entities)
+        return { resources, queried };
+    for (const name of entityNames) {
+        if (already[name])
+            continue;
+        const entity = entities.get(name);
+        if (!entity)
+            continue;
+        const identifier = declaredIdentifier(entity.entityType, entity.props ?? {});
+        if (!identifier)
+            continue;
+        queried[name] = `cloudcontrol:GetResource:${entity.entityType}:${identifier}`;
+        try {
+            const found = await readByIdentity(entity.entityType, identifier, client);
+            if (!found)
+                continue;
+            resources[name] = {
+                type: entity.entityType,
+                physicalId: found.identifier || identifier,
+                status: "EXTERNAL",
+                ownership: "foreign",
+                ...(redactSensitive(found.properties) ? { attributes: redactSensitive(found.properties) } : {}),
+            };
+        }
+        catch {
+            // Refusals of every kind keep the stack's verdict — see the module
+            // comment for why a failed refinement must not become a hole.
+            continue;
+        }
+    }
+    return { resources, queried };
+}