@kungfu-tech/buildchain 3.0.9-alpha.9 → 4.0.0-alpha.1

package/scripts/aws-macos-jit-controller-core.mjs

@@ -3,7 +3,6 @@
 import { digest } from "./aws-runner-burst-core.mjs";
 import {
   MACOS_EC2_JIT,
-  macosJitRegionConfig,
   macosJitRunnerLabel,
   macosJitRunnerLabels,
 } from "./aws-macos-jit-core.mjs";
@@ -56,17 +55,6 @@ function source(values) {
   };
 }
 
-function previousSource(values) {
-  return {
-    sha: exactSha(values.previousSourceSha),
-    ref: exact(
-      values.previousSourceRef || values.sourceRef,
-      /^refs\/heads\/[A-Za-z0-9._/-]+$/,
-      "previousSourceRef",
-    ),
-  };
-}
-
 function campaignId(value) {
   return exact(value, /^[a-z0-9][a-z0-9-]{2,47}$/, "campaignId");
 }
@@ -75,110 +63,15 @@ function qualificationId(value) {
   return exact(value, /^mac-(?:smoke-0[12]|full-01)$/, "qualificationId");
 }
 
-function terminalFailureRunIds(value) {
-  if (!Array.isArray(value) || value.length === 0) {
-    throw new Error("terminalFailureRunIds must be a non-empty array");
-  }
-  const normalized = value.map((entry) =>
-    exact(entry, /^[1-9]\d*$/, "terminalFailureRunId"),
-  );
-  if (new Set(normalized).size !== normalized.length) {
-    throw new Error("terminalFailureRunIds must be unique");
-  }
-  return [...normalized].sort((left, right) => Number(left) - Number(right));
-}
-
-function preflightFailureRunIds(value) {
-  if (!Array.isArray(value) || value.length === 0) {
-    throw new Error("preflightFailureRunIds must be a non-empty array");
-  }
-  const normalized = value.map((entry) =>
-    exact(entry, /^[1-9]\d*$/, "preflightFailureRunId"),
-  );
-  if (new Set(normalized).size !== normalized.length) {
-    throw new Error("preflightFailureRunIds must be unique");
-  }
-  return [...normalized].sort((left, right) => Number(left) - Number(right));
-}
-
-function successfulRunIds(value) {
-  if (value === undefined) return [];
-  if (!Array.isArray(value)) {
-    throw new Error("successfulRunIds must be an array");
-  }
-  const normalized = value.map((entry) =>
-    exact(entry, /^[1-9]\d*$/, "successfulRunId"),
-  );
-  if (new Set(normalized).size !== normalized.length) {
-    throw new Error("successfulRunIds must be unique");
-  }
-  return [...normalized].sort((left, right) => Number(left) - Number(right));
-}
-
-function startupFailureRuns(value) {
-  if (value === undefined) return [];
-  if (!Array.isArray(value)) {
-    throw new Error("startupFailureRuns must be an array");
-  }
-  const normalized = value.map((entry) => ({
-    runId: exact(entry?.runId, /^[1-9]\d*$/, "startupFailureRunId"),
-    sourceSha: exactSha(entry?.sourceSha),
-  }));
-  if (
-    new Set(normalized.map(({ runId }) => runId)).size !== normalized.length
-  ) {
-    throw new Error("startupFailureRuns must use unique run ids");
-  }
-  return [...normalized].sort(
-    (left, right) => Number(left.runId) - Number(right.runId),
-  );
-}
-
-function historicalTerminalFailureRuns(value) {
-  if (value === undefined) return [];
-  if (!Array.isArray(value)) {
-    throw new Error("historicalTerminalFailureRuns must be an array");
-  }
-  const normalized = value.map((entry) => ({
-    runId: exact(entry?.runId, /^[1-9]\d*$/, "historicalTerminalFailureRunId"),
-    sourceSha: exactSha(entry?.sourceSha),
-  }));
-  if (
-    new Set(normalized.map(({ runId }) => runId)).size !== normalized.length
-  ) {
-    throw new Error("historicalTerminalFailureRuns must use unique run ids");
-  }
-  return [...normalized].sort(
-    (left, right) => Number(left.runId) - Number(right.runId),
-  );
-}
-
-function historicalPreflightFailureRuns(value) {
-  if (value === undefined) return [];
-  if (!Array.isArray(value)) {
-    throw new Error("historicalPreflightFailureRuns must be an array");
-  }
-  const normalized = value.map((entry) => ({
-    runId: exact(entry?.runId, /^[1-9]\d*$/, "historicalPreflightFailureRunId"),
-    sourceSha: exactSha(entry?.sourceSha),
-  }));
-  if (
-    new Set(normalized.map(({ runId }) => runId)).size !== normalized.length
-  ) {
-    throw new Error("historicalPreflightFailureRuns must use unique run ids");
-  }
-  return [...normalized].sort(
-    (left, right) => Number(left.runId) - Number(right.runId),
-  );
-}
-
 function commonAws(values) {
   const region = exact(
     values.region || MACOS_EC2_JIT.region,
     /^us-[a-z]+-\d$/,
     "region",
   );
-  const regionConfig = macosJitRegionConfig(region);
+  if (region !== MACOS_EC2_JIT.region) {
+    throw new Error(`region must be ${MACOS_EC2_JIT.region}`);
+  }
   const instanceType = exact(
     values.instanceType || MACOS_EC2_JIT.instanceType,
     /^mac2\.metal$/,
@@ -187,18 +80,13 @@ function commonAws(values) {
   if (instanceType !== MACOS_EC2_JIT.instanceType) {
     throw new Error(`instanceType must be ${MACOS_EC2_JIT.instanceType}`);
   }
-  const availabilityZone = exact(
-    values.availabilityZone,
-    /^us-[a-z]+-\d[a-z]$/,
-    "availabilityZone",
-  );
-  if (!availabilityZone.startsWith(region)) {
-    throw new Error(`availabilityZone must belong to ${region}`);
-  }
   return {
     region,
-    availabilityZone,
-    controlPlaneStack: regionConfig.stack,
+    availabilityZone: exact(
+      values.availabilityZone,
+      /^us-[a-z]+-\d[a-z]$/,
+      "availabilityZone",
+    ),
     instanceType,
     amiId: exact(values.amiId, /^ami-[0-9a-f]+$/, "amiId"),
     amiName: exact(values.amiName, /^[A-Za-z0-9._-]+$/, "amiName"),
@@ -235,7 +123,6 @@ export function createMacosJitCampaignPlan(values = {}) {
   const id = campaignId(values.campaignId);
   const boundSource = source(values);
   const aws = commonAws(values);
-  const regionConfig = macosJitRegionConfig(aws.region);
   const tags = ownershipTags({ id, sourceSha: boundSource.sha });
   const createdAt = iso(values.createdAt, "createdAt");
   const plan = {
@@ -243,13 +130,6 @@ export function createMacosJitCampaignPlan(values = {}) {
     contract: AWS_MACOS_JIT_CONTROLLER_CONTRACT,
     kind: "campaign-launch-plan",
     repository: repository(values.repository),
-    account: {
-      id: exact(values.accountId, /^\d{12}$/, "accountId"),
-    },
-    github: {
-      workflowId: MACOS_EC2_JIT.workflowId,
-      requiredState: "disabled_manually",
-    },
     campaign: { id, createdAt },
     source: boundSource,
     aws: {
@@ -278,232 +158,18 @@ export function createMacosJitCampaignPlan(values = {}) {
       exactSourceRequired: true,
       activeHostCeiling: MACOS_EC2_JIT.maxAcceptedHosts,
       activeInstanceCeiling: 1,
-      awsPermissionSimulationRequiredBeforeAllocation: true,
+      awsDryRunRequiredBeforeAllocation: true,
       awsDryRunRequiredBeforeLaunch: true,
       retainHostOnInstanceLaunchFailure: true,
       minimumHostAllocationHours: MACOS_EC2_JIT.minimumHostAllocationHours,
       maximumHostAllocationHours: MACOS_EC2_JIT.maximumHostAllocationHours,
       cleanupOwner: "scheduled-card-scoped-reaper",
-      budget: {
-        name: regionConfig.budgetName,
-        limitUsd: MACOS_EC2_JIT.budgetLimitUsd,
-        metrics: ["UnblendedCost"],
-        dimensionFilter: {
-          usageTypes: regionConfig.budgetUsageTypes,
-          operation: MACOS_EC2_JIT.budgetOperation,
-          regions: regionConfig.budgetRegions,
-        },
-        requiredActualThresholds: [80, 95],
-      },
-    },
-  };
-  return { ...plan, digest: digest(plan) };
-}
-
-export function createMacosJitInstanceRehydratePlan(values = {}) {
-  const id = campaignId(values.campaignId);
-  const boundSource = source(values);
-  const aws = commonAws(values);
-  const regionConfig = macosJitRegionConfig(aws.region);
-  const tags = ownershipTags({ id, sourceSha: boundSource.sha });
-  const rehydrationId = exact(
-    values.rehydrationId,
-    /^r[1-9]\d{0,2}$/,
-    "rehydrationId",
-  );
-  const instanceClientToken = `kungfu-mac-rehydrate-${id}-${rehydrationId}`;
-  if (instanceClientToken.length > 64) {
-    throw new Error("rehydration client token exceeds the EC2 limit");
-  }
-  const plan = {
-    schemaVersion: 1,
-    contract: AWS_MACOS_JIT_CONTROLLER_CONTRACT,
-    kind: "instance-rehydrate-plan",
-    repository: repository(values.repository),
-    account: {
-      id: exact(values.accountId, /^\d{12}$/, "accountId"),
-    },
-    github: {
-      workflowId: MACOS_EC2_JIT.workflowId,
-      requiredState: "disabled_manually",
-    },
-    campaign: { id },
-    source: boundSource,
-    aws: {
-      ...aws,
-      hostId: exact(values.hostId, /^h-[0-9a-f]+$/, "hostId"),
-      hostAllocatedAt: iso(values.hostAllocatedAt, "hostAllocatedAt"),
-      replacesInstanceId: exact(
-        values.replacesInstanceId,
-        /^i-[0-9a-f]+$/,
-        "replacesInstanceId",
-      ),
-      rehydrationId,
-      instanceTags: tags,
-      volumeTags: tags,
-      instanceClientToken,
-      rootVolume: {
-        deviceName: "/dev/sda1",
-        deleteOnTermination: true,
-        encrypted: true,
-        volumeSizeGiB: 200,
-        volumeType: "gp3",
-      },
-      metadata: {
-        httpEndpoint: "enabled",
-        httpTokens: "required",
-        httpPutResponseHopLimit: 1,
-        instanceMetadataTags: "disabled",
-      },
-    },
-    safety: {
-      applyMode: values.execute === true ? "execute" : "dry-run",
-      exactSourceRequired: true,
-      existingCampaignHostRequired: true,
-      noHostAllocation: true,
-      zeroActiveInstanceRequired: true,
-      zeroRunnerResidueRequired: true,
-      awsDryRunRequiredBeforeLaunch: true,
-      cleanupOwner: "scheduled-card-scoped-reaper",
-      budget: {
-        name: regionConfig.budgetName,
-        limitUsd: MACOS_EC2_JIT.budgetLimitUsd,
-        metrics: ["UnblendedCost"],
-        dimensionFilter: {
-          usageTypes: regionConfig.budgetUsageTypes,
-          operation: MACOS_EC2_JIT.budgetOperation,
-          regions: regionConfig.budgetRegions,
-        },
-        requiredActualThresholds: [80, 95],
-      },
     },
   };
   return { ...plan, digest: digest(plan) };
 }
 
-export function createMacosJitSourceRebindPlan(values = {}) {
-  const id = campaignId(values.campaignId);
-  const boundSource = source(values);
-  const priorSource = previousSource(values);
-  if (boundSource.sha === priorSource.sha) {
-    throw new Error("sourceSha must differ from previousSourceSha");
-  }
-  if (boundSource.ref !== priorSource.ref) {
-    throw new Error("sourceRef must remain unchanged during campaign rebind");
-  }
-  const aws = commonAws(values);
-  const regionConfig = macosJitRegionConfig(aws.region);
-  const workflowId = exact(values.workflowId, /^\d+$/, "workflowId");
-  if (workflowId !== MACOS_EC2_JIT.workflowId) {
-    throw new Error(`workflowId must be ${MACOS_EC2_JIT.workflowId}`);
-  }
-  const priorRunPolicy = values.priorRunPolicy || "unused";
-  if (
-    !["unused", "terminal-failure", "preflight-failure"].includes(
-      priorRunPolicy,
-    )
-  ) {
-    throw new Error(
-      "priorRunPolicy must be unused, terminal-failure, or preflight-failure",
-    );
-  }
-  const terminalRunIds =
-    priorRunPolicy === "terminal-failure"
-      ? terminalFailureRunIds(values.terminalFailureRunIds)
-      : [];
-  const preflightRunIds =
-    priorRunPolicy === "preflight-failure"
-      ? preflightFailureRunIds(values.preflightFailureRunIds)
-      : [];
-  const startupRuns = startupFailureRuns(values.startupFailureRuns);
-  const historicalTerminalRuns = historicalTerminalFailureRuns(
-    values.historicalTerminalFailureRuns,
-  );
-  const historicalPreflightRuns = historicalPreflightFailureRuns(
-    values.historicalPreflightFailureRuns,
-  );
-  const successfulRuns = successfulRunIds(values.successfulRunIds);
-  if (priorRunPolicy === "unused" && startupRuns.length !== 0) {
-    throw new Error("startupFailureRuns require a failed priorRunPolicy");
-  }
-  if (priorRunPolicy === "unused" && historicalTerminalRuns.length !== 0) {
-    throw new Error(
-      "historicalTerminalFailureRuns require a failed priorRunPolicy",
-    );
-  }
-  if (priorRunPolicy === "unused" && historicalPreflightRuns.length !== 0) {
-    throw new Error(
-      "historicalPreflightFailureRuns require a failed priorRunPolicy",
-    );
-  }
-  if (priorRunPolicy === "unused" && successfulRuns.length !== 0) {
-    throw new Error("successfulRunIds require a failed priorRunPolicy");
-  }
-  const plan = {
-    schemaVersion: 1,
-    contract: AWS_MACOS_JIT_CONTROLLER_CONTRACT,
-    kind: "campaign-source-rebind-plan",
-    repository: repository(values.repository),
-    account: {
-      id: exact(values.accountId, /^\d{12}$/, "accountId"),
-    },
-    campaign: { id },
-    previousSource: priorSource,
-    source: boundSource,
-    github: {
-      workflowId,
-      requiredState: "disabled_manually",
-      priorRunPolicy,
-      terminalFailureRunIds: terminalRunIds,
-      preflightFailureRunIds: preflightRunIds,
-      startupFailureRuns: startupRuns,
-      historicalTerminalFailureRuns: historicalTerminalRuns,
-      historicalPreflightFailureRuns: historicalPreflightRuns,
-      successfulRunIds: successfulRuns,
-    },
-    aws: {
-      ...aws,
-      hostId: exact(values.hostId, /^h-[0-9a-f]+$/, "hostId"),
-      instanceId: exact(values.instanceId, /^i-[0-9a-f]+$/, "instanceId"),
-    },
-    safety: {
-      applyMode: values.execute === true ? "execute" : "dry-run",
-      noAllocation: true,
-      noDispatch: true,
-      forwardOnlySource: true,
-      sameSourceRefRequired: true,
-      workflowDisabledRequired: true,
-      zeroPriorJobsRequired: priorRunPolicy === "unused",
-      zeroPriorArtifactsRequired: priorRunPolicy === "unused",
-      terminalFailureEvidencePreserved: priorRunPolicy === "terminal-failure",
-      preflightFailureEvidencePreserved: priorRunPolicy === "preflight-failure",
-      startupFailureEvidencePreserved: startupRuns.length !== 0,
-      historicalTerminalFailureEvidencePreserved:
-        historicalTerminalRuns.length !== 0,
-      historicalPreflightFailureEvidencePreserved:
-        historicalPreflightRuns.length !== 0,
-      successfulRunEvidencePreserved: successfulRuns.length !== 0,
-      zeroJitResidueRequired: true,
-      zeroEvidenceRequired: true,
-      exactCampaignResourcesRequired: true,
-      compensatedRollbackRequired: true,
-      budget: {
-        name: regionConfig.budgetName,
-        limitUsd: MACOS_EC2_JIT.budgetLimitUsd,
-        metrics: ["UnblendedCost"],
-        dimensionFilter: {
-          usageTypes: regionConfig.budgetUsageTypes,
-          operation: MACOS_EC2_JIT.budgetOperation,
-          regions: regionConfig.budgetRegions,
-        },
-        requiredActualThresholds: [80, 95],
-      },
-    },
-  };
-  return { ...plan, digest: digest(plan) };
-}
-
-export function macosAllocateHostsArgs(plan) {
+export function macosAllocateHostsArgs(plan, { dryRun = false } = {}) {
   if (
     plan?.contract !== AWS_MACOS_JIT_CONTROLLER_CONTRACT ||
     plan.kind !== "campaign-launch-plan"
@@ -530,15 +196,16 @@ export function macosAllocateHostsArgs(plan) {
     "--output",
     "json",
   ];
+  if (dryRun) args.splice(2, 0, "--dry-run");
   return args;
 }
 
 export function macosRunInstancesArgs(plan, { hostId, dryRun = false } = {}) {
   if (
     plan?.contract !== AWS_MACOS_JIT_CONTROLLER_CONTRACT ||
-    !["campaign-launch-plan", "instance-rehydrate-plan"].includes(plan.kind)
+    plan.kind !== "campaign-launch-plan"
   ) {
-    throw new Error("macOS JIT instance launch plan contract is invalid");
+    throw new Error("macOS JIT campaign launch plan contract is invalid");
   }
   const resolvedHostId = exact(hostId, /^h-[0-9a-f]+$/, "hostId");
   const args = [

package/scripts/aws-macos-jit-controller-runtime.mjs

@@ -1,9 +1,9 @@
 // SPDX-License-Identifier: Apache-2.0
 
-import { spawnSync } from "node:child_process";
+import { spawnSyncCommand } from "../packages/core/spawn-command.js";
 
 export function commandResult(command, args, options = {}) {
-  const result = spawnSync(command, args, {
+  const result = spawnSyncCommand(command, args, {
     encoding: "utf8",
     maxBuffer: 16 * 1024 * 1024,
     stdio: [options.input === undefined ? "ignore" : "pipe", "pipe", "pipe"],
@@ -80,211 +80,3 @@ export function assertDryRun(result, label) {
     throw new Error(`${label} did not return DryRunOperation`);
   }
 }
-
-export function assertAllowedPolicySimulation(
-  plan,
-  profile,
-  principalArn,
-  actionName,
-) {
-  if (!/^arn:aws:iam::\d{12}:(?:user|role)\/.+/.test(principalArn || "")) {
-    throw new Error(
-      "AWS allocation policy simulation requires an IAM user or role principal ARN",
-    );
-  }
-  const contextEntries = [
-    `ContextKeyName=aws:RequestedRegion,ContextKeyValues=${plan.aws.region},ContextKeyType=string`,
-    ...plan.aws.hostTags.map(
-      ({ Key, Value }) =>
-        `ContextKeyName=aws:RequestTag/${Key},ContextKeyValues=${Value},ContextKeyType=string`,
-    ),
-  ];
-  const evaluation = awsJson(
-    plan,
-    profile,
-    [
-      "iam",
-      "simulate-principal-policy",
-      "--policy-source-arn",
-      principalArn,
-      "--action-names",
-      actionName,
-      "--resource-arns",
-      "*",
-      "--context-entries",
-      ...contextEntries,
-      "--output",
-      "json",
-    ],
-    `${actionName} IAM policy simulation`,
-  ).EvaluationResults?.[0];
-  if (
-    evaluation?.EvalActionName !== actionName ||
-    evaluation?.EvalDecision !== "allowed" ||
-    (evaluation.MissingContextValues || []).length !== 0
-  ) {
-    throw new Error(`${actionName} IAM policy simulation did not allow allocation`);
-  }
-  return {
-    actionName,
-    decision: evaluation.EvalDecision,
-    principalArn,
-  };
-}
-
-function sameJson(left, right) {
-  return JSON.stringify(left) === JSON.stringify(right);
-}
-
-function sameDimensionSet(observed, expected) {
-  return (
-    Array.isArray(observed) &&
-    observed.length === expected.length &&
-    expected.every((entry) =>
-      observed.some((candidate) => sameJson(candidate, entry)),
-    )
-  );
-}
-
-export function assertMacosBudgetLaunchGate(plan, profile) {
-  const identity = awsJson(
-    plan,
-    profile,
-    ["sts", "get-caller-identity", "--output", "json"],
-    "AWS account identity preflight",
-  );
-  if (identity.Account !== plan.account.id) {
-    throw new Error("AWS account identity mismatch");
-  }
-  const workflow = ghJson(
-    [
-      "api",
-      `repos/${plan.repository}/actions/workflows/${plan.github.workflowId}`,
-    ],
-    undefined,
-    "GitHub macOS workflow preflight",
-  );
-  if (workflow.state !== plan.github.requiredState) {
-    throw new Error(
-      `macOS workflow must be ${plan.github.requiredState}; observed ${workflow.state || "unknown"}`,
-    );
-  }
-  const stack = awsJson(
-    plan,
-    profile,
-    [
-      "cloudformation",
-      "describe-stacks",
-      "--stack-name",
-      plan.aws.controlPlaneStack,
-      "--output",
-      "json",
-    ],
-    "macOS control-plane stack preflight",
-  ).Stacks?.[0];
-  if (!stack || !/(?:CREATE|UPDATE)_COMPLETE$/.test(stack.StackStatus || "")) {
-    throw new Error("macOS control-plane stack is not complete");
-  }
-  const topicArn = (stack.Outputs || []).find(
-    (entry) => entry.OutputKey === "KillSwitchTopic",
-  )?.OutputValue;
-  if (!/^arn:aws:sns:/.test(String(topicArn || ""))) {
-    throw new Error("macOS Budget kill-switch topic readback failed");
-  }
-  const budget = awsJson(
-    plan,
-    profile,
-    [
-      "budgets",
-      "describe-budget",
-      "--account-id",
-      plan.account.id,
-      "--budget-name",
-      plan.safety.budget.name,
-      "--show-filter-expression",
-      "--output",
-      "json",
-    ],
-    "macOS Budget preflight",
-  ).Budget;
-  const expectedDimensions = [
-    ["USAGE_TYPE", plan.safety.budget.dimensionFilter.usageTypes],
-    ["OPERATION", [plan.safety.budget.dimensionFilter.operation]],
-    ["REGION", plan.safety.budget.dimensionFilter.regions],
-  ].map(([Key, Values]) => ({
-    Dimensions: { Key, Values, MatchOptions: ["EQUALS"] },
-  }));
-  if (
-    !budget ||
-    budget.BudgetName !== plan.safety.budget.name ||
-    Number(budget.BudgetLimit?.Amount) !== plan.safety.budget.limitUsd ||
-    budget.BudgetLimit?.Unit !== "USD" ||
-    budget.BudgetType !== "COST" ||
-    !sameJson(budget.Metrics, plan.safety.budget.metrics) ||
-    !sameDimensionSet(budget.FilterExpression?.And, expectedDimensions)
-  ) {
-    throw new Error("macOS Budget identity or dimension filter mismatch");
-  }
-  const notifications = awsJson(
-    plan,
-    profile,
-    [
-      "budgets",
-      "describe-notifications-for-budget",
-      "--account-id",
-      plan.account.id,
-      "--budget-name",
-      plan.safety.budget.name,
-      "--output",
-      "json",
-    ],
-    "macOS Budget notifications preflight",
-  ).Notifications;
-  const thresholds = (notifications || [])
-    .filter(
-      (entry) =>
-        entry.NotificationType === "ACTUAL" &&
-        (entry.ThresholdType || "PERCENTAGE") === "PERCENTAGE",
-    )
-    .map((entry) => Number(entry.Threshold))
-    .sort((left, right) => left - right);
-  if (!sameJson(thresholds, plan.safety.budget.requiredActualThresholds)) {
-    throw new Error("macOS Budget notification thresholds mismatch");
-  }
-  for (const notification of notifications) {
-    const subscribers = awsJson(
-      plan,
-      profile,
-      [
-        "budgets",
-        "describe-subscribers-for-notification",
-        "--account-id",
-        plan.account.id,
-        "--budget-name",
-        plan.safety.budget.name,
-        "--notification",
-        JSON.stringify(notification),
-        "--output",
-        "json",
-      ],
-      `macOS Budget ${notification.Threshold}% subscribers preflight`,
-    ).Subscribers;
-    if (
-      !(subscribers || []).some(
-        (entry) =>
-          entry.SubscriptionType === "SNS" && entry.Address === topicArn,
-      )
-    ) {
-      throw new Error("macOS Budget SNS subscriber mismatch");
-    }
-  }
-  return {
-    accountId: identity.Account,
-    principalArn: identity.Arn,
-    workflowState: workflow.state,
-    stackStatus: stack.StackStatus,
-    budgetName: budget.BudgetName,
-    budgetDimensionFilter: plan.safety.budget.dimensionFilter,
-    budgetThresholds: thresholds,
-  };
-}