@empire-builder-kit/nx 1.0.0-beta.9 → 1.0.0-rc.2

package/src/generators/slice/built-in-plan-secret-runtime-files.js

@@ -0,0 +1,1004 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.renderStandardSliceSecretRuntimeFiles = renderStandardSliceSecretRuntimeFiles;
+const discovery_js_1 = require("../../foundation/discovery.js");
+const tool_versions_js_1 = require("../preset/tool-versions.js");
+const built_in_plan_shared_js_1 = require("./built-in-plan-shared.js");
+const personalStagePattern = '^personal-[a-z0-9](?:[a-z0-9-]{0,25}[a-z0-9])?$';
+/** @internal */
+function renderStandardSliceSecretRuntimeFiles(name) {
+    const pascalName = name
+        .split('-')
+        .map((part) => `${part.charAt(0).toUpperCase()}${part.slice(1)}`)
+        .join('');
+    return {
+        'secrets/workload-access.json': (0, built_in_plan_shared_js_1.json)({
+            bindings: [
+                {
+                    logicalName: `${pascalName}PerformanceLoadHmacKeys`,
+                    workload: `${name}.web-server`,
+                },
+            ],
+            schemaVersion: 1,
+        }),
+        'scripts/validate-personal-secret.mjs': `import { readFile } from 'node:fs/promises';
+import { Secrets } from '../secrets/declarations.ts';
+
+const MAXIMUM_VALUE_BYTES = 64 * 1024;
+const metadataUrl = new URL('../secrets/metadata.json', import.meta.url);
+
+function isRecord(value) {
+  return typeof value === 'object' && value !== null && !Array.isArray(value);
+}
+
+function hasOnlyProperties(value, allowed) {
+  return Object.keys(value).every((key) => allowed.includes(key));
+}
+
+function declarationProjection(declaration) {
+  if (
+    !isRecord(declaration) ||
+    !hasOnlyProperties(declaration, [
+      'cache',
+      'contractVersion',
+      'logicalName',
+      'owner',
+      'requiredStages',
+      'retention',
+      'rotation',
+      'source',
+      'value',
+    ]) ||
+    declaration.contractVersion !== 1 ||
+    typeof declaration.logicalName !== 'string' ||
+    typeof declaration.owner !== 'string' ||
+    !Array.isArray(declaration.requiredStages) ||
+    declaration.requiredStages.some((stage) => typeof stage !== 'string') ||
+    !isRecord(declaration.rotation) ||
+    !['manual', 'provider-managed'].includes(declaration.rotation.mode) ||
+    !['aws-managed', 'database-bootstrap', 'operator'].includes(
+      declaration.source,
+    ) ||
+    !isRecord(declaration.value) ||
+    !hasOnlyProperties(declaration.value, ['kind', 'validate']) ||
+    !['binary', 'json', 'string'].includes(declaration.value.kind) ||
+    typeof declaration.value.validate !== 'function'
+  ) {
+    throw new Error('invalid');
+  }
+  return {
+    logicalName: declaration.logicalName,
+    owner: declaration.owner,
+    requiredStages: [...declaration.requiredStages],
+    rotation: { mode: declaration.rotation.mode },
+    source: declaration.source,
+    valueKind: declaration.value.kind,
+  };
+}
+
+function parseMetadata(value) {
+  if (
+    !isRecord(value) ||
+    !hasOnlyProperties(value, ['declarations', 'schemaVersion']) ||
+    value.schemaVersion !== 1 ||
+    !Array.isArray(value.declarations)
+  ) {
+    throw new Error('invalid');
+  }
+  const logicalNames = new Set();
+  const declarations = value.declarations.map((declaration) => {
+    if (
+      !isRecord(declaration) ||
+      !hasOnlyProperties(declaration, [
+        'logicalName',
+        'owner',
+        'requiredStages',
+        'rotation',
+        'source',
+        'valueKind',
+      ]) ||
+      typeof declaration.logicalName !== 'string' ||
+      typeof declaration.owner !== 'string' ||
+      !Array.isArray(declaration.requiredStages) ||
+      declaration.requiredStages.some(
+        (stage) => typeof stage !== 'string',
+      ) ||
+      !isRecord(declaration.rotation) ||
+      !hasOnlyProperties(declaration.rotation, ['mode']) ||
+      !['manual', 'provider-managed'].includes(declaration.rotation.mode) ||
+      !['aws-managed', 'database-bootstrap', 'operator'].includes(
+        declaration.source,
+      ) ||
+      !['binary', 'json', 'string'].includes(declaration.valueKind) ||
+      logicalNames.has(declaration.logicalName)
+    ) {
+      throw new Error('invalid');
+    }
+    logicalNames.add(declaration.logicalName);
+    return {
+      logicalName: declaration.logicalName,
+      owner: declaration.owner,
+      requiredStages: [...declaration.requiredStages],
+      rotation: { mode: declaration.rotation.mode },
+      source: declaration.source,
+      valueKind: declaration.valueKind,
+    };
+  });
+  return declarations.sort((left, right) =>
+    left.logicalName < right.logicalName
+      ? -1
+      : left.logicalName > right.logicalName
+        ? 1
+        : 0,
+  );
+}
+
+async function verifiedDeclarations() {
+  if (!isRecord(Secrets)) throw new Error('invalid');
+  const declarations = Object.entries(Secrets)
+    .map(([exportedName, declaration]) => {
+      const projection = declarationProjection(declaration);
+      if (exportedName !== projection.logicalName) throw new Error('invalid');
+      return projection;
+    })
+    .sort((left, right) =>
+      left.logicalName < right.logicalName
+        ? -1
+        : left.logicalName > right.logicalName
+          ? 1
+          : 0,
+    );
+  const metadata = parseMetadata(
+    JSON.parse(await readFile(metadataUrl, 'utf8')),
+  );
+  if (JSON.stringify(declarations) !== JSON.stringify(metadata)) {
+    throw new Error('invalid');
+  }
+  return new Map(
+    Object.values(Secrets).map((declaration) => [
+      declaration.logicalName,
+      declaration,
+    ]),
+  );
+}
+
+async function readHiddenInput() {
+  const chunks = [];
+  let size = 0;
+  try {
+    for await (const chunk of process.stdin) {
+      const bytes = Buffer.from(chunk);
+      size += bytes.byteLength;
+      if (size > MAXIMUM_VALUE_BYTES) {
+        bytes.fill(0);
+        throw new Error('invalid');
+      }
+      chunks.push(bytes);
+    }
+    return Buffer.concat(chunks, size);
+  } finally {
+    for (const chunk of chunks) chunk.fill(0);
+  }
+}
+
+async function validateHiddenValue(declarations, logicalName, valueKind) {
+  const declaration = declarations.get(logicalName);
+  if (
+    !declaration ||
+    declaration.source !== 'operator' ||
+    !declaration.requiredStages.includes('development') ||
+    declaration.value.kind !== valueKind
+  ) {
+    return false;
+  }
+  const bytes = await readHiddenInput();
+  try {
+    const payload =
+      valueKind === 'binary'
+        ? { secretBinary: Uint8Array.from(bytes) }
+        : {
+            secretString: new TextDecoder('utf-8', { fatal: true }).decode(
+              bytes,
+            ),
+          };
+    try {
+      return declaration.value.validate(payload).valid === true;
+    } catch {
+      return false;
+    } finally {
+      payload.secretBinary?.fill(0);
+    }
+  } finally {
+    bytes.fill(0);
+  }
+}
+
+async function main() {
+  const declarations = await verifiedDeclarations();
+  if (process.argv.length === 3 && process.argv[2] === '--verify') {
+    return true;
+  }
+  if (
+    process.argv.length !== 4 ||
+    !['binary', 'json', 'string'].includes(process.argv[3])
+  ) {
+    return false;
+  }
+  return validateHiddenValue(declarations, process.argv[2], process.argv[3]);
+}
+
+try {
+  process.stdout.write((await main()) ? 'valid\\n' : 'invalid\\n');
+} catch {
+  process.stdout.write('invalid\\n');
+}
+`,
+        'scripts/remove-personal-secrets.mjs': `import {
+  acquirePersonalSecretLedgerLock,
+  assertPersonalSecretLedgerLocation,
+  readPersonalSecretLedger,
+  releasePersonalSecretLedgerLock,
+  writePersonalSecretLedger,
+} from '@empire-builder-kit/nx/local-dev';
+import {
+  createPersonalSecretLedgerRecord,
+  isExactSstSecretAlreadyAbsent,
+} from '@empire-builder-kit/nx/secrets';
+import { execFile } from 'node:child_process';
+import { readFile, realpath } from 'node:fs/promises';
+import { dirname, isAbsolute, relative, resolve } from 'node:path';
+import { fileURLToPath } from 'node:url';
+import { promisify } from 'node:util';
+import { Secrets } from '../secrets/declarations.ts';
+
+const execFileAsync = promisify(execFile);
+const EXPECTED_SST_VERSION = '${tool_versions_js_1.WORKSPACE_SST_VERSION}';
+const FOUNDATION_EVENT_BUS_PARAMETER = '${(0, discovery_js_1.foundationSsmPath)('development', 'eventBusArn')}';
+const personalStagePattern = /${personalStagePattern}/;
+const profilePattern = /^[A-Za-z0-9][A-Za-z0-9._-]{0,127}$/;
+const regionPattern = /^[a-z]{2}(?:-gov)?-[a-z]+-\\d$/;
+
+function containedPath(root, candidate) {
+  const path = relative(root, candidate);
+  return path === '' || (!path.startsWith('..') && !isAbsolute(path));
+}
+
+function childEnvironment(profile, region) {
+  const environment = {};
+  for (const name of [
+    'APPDATA',
+    'AWS_CA_BUNDLE',
+    'AWS_CONFIG_FILE',
+    'AWS_SHARED_CREDENTIALS_FILE',
+    'HOME',
+    'LOCALAPPDATA',
+    'PATH',
+    'PATHEXT',
+    'SystemRoot',
+    'TEMP',
+    'TMP',
+    'TMPDIR',
+    'USERPROFILE',
+    'XDG_CONFIG_HOME',
+  ]) {
+    if (process.env[name]) environment[name] = process.env[name];
+  }
+  return {
+    ...environment,
+    AWS_DEFAULT_REGION: region,
+    AWS_EC2_METADATA_DISABLED: 'true',
+    AWS_PROFILE: profile,
+    AWS_REGION: region,
+    AWS_SDK_LOAD_CONFIG: '1',
+    EBK_CONSUMER_STAGE: process.env.EBK_STAGE,
+    EBK_FOUNDATION_STAGE: 'development',
+    EBK_STAGE: process.env.EBK_STAGE,
+    SST_TELEMETRY_DISABLED: '1',
+  };
+}
+
+async function requiredAwsContext(environment, profile, region) {
+  const common = [
+    '--profile',
+    profile,
+    '--region',
+    region,
+    '--output',
+    'text',
+    '--no-cli-pager',
+  ];
+  const runAws = (arguments_) => {
+    const executable =
+      process.platform === 'win32'
+        ? process.env.ComSpec ?? 'cmd.exe'
+        : 'aws';
+    const childArguments =
+      process.platform === 'win32'
+        ? ['/d', '/s', '/c', ['aws', ...arguments_].join(' ')]
+        : arguments_;
+    return execFileAsync(executable, childArguments, {
+        encoding: 'utf8',
+        env: environment,
+        maxBuffer: 4096,
+        timeout: 15_000,
+        windowsHide: true,
+      });
+  };
+  const [identity, eventBus] = await Promise.all([
+    runAws(['sts', 'get-caller-identity', '--query', 'Account', ...common]),
+    runAws(
+      [
+        'ssm',
+        'get-parameter',
+        '--name',
+        FOUNDATION_EVENT_BUS_PARAMETER,
+        '--query',
+        'Parameter.Value',
+        ...common,
+      ],
+    ),
+  ]);
+  const accountId = identity.stdout.trim();
+  const eventBusArn = eventBus.stdout.trim();
+  const match =
+    /^arn:(?:aws|aws-us-gov|aws-cn):events:([a-z0-9-]+):(\\d{12}):event-bus\\/[A-Za-z0-9._/-]+$/.exec(
+      eventBusArn,
+    );
+  if (
+    !/^\\d{12}$/.test(accountId) ||
+    !match ||
+    match[1] !== region ||
+    match[2] !== accountId
+  ) {
+    throw new Error(
+      'Personal secret cleanup could not prove the development Foundation account.',
+    );
+  }
+  return accountId;
+}
+
+async function workspaceSstRuntime(workspaceRoot) {
+  const workspaceManifest = JSON.parse(
+    await readFile(resolve(workspaceRoot, 'package.json'), 'utf8'),
+  );
+  const declared =
+    workspaceManifest.devDependencies?.sst ??
+    workspaceManifest.dependencies?.sst;
+  if (declared !== EXPECTED_SST_VERSION) {
+    throw new Error('The workspace SST runtime is not exact-pinned.');
+  }
+  const packageManifestPath = await realpath(
+    resolve(workspaceRoot, 'node_modules/sst/package.json'),
+  );
+  const packageRoot = await realpath(dirname(packageManifestPath));
+  const packageManifest = JSON.parse(
+    await readFile(packageManifestPath, 'utf8'),
+  );
+  const binary = await realpath(resolve(packageRoot, 'bin/sst.mjs'));
+  if (
+    packageManifest.version !== EXPECTED_SST_VERSION ||
+    !containedPath(packageRoot, binary)
+  ) {
+    throw new Error('The installed SST runtime differs from the workspace pin.');
+  }
+  return binary;
+}
+
+async function verifyDeclarations(projectRoot, environment) {
+  const validator = await realpath(
+    resolve(projectRoot, 'scripts/validate-personal-secret.mjs'),
+  );
+  if (!containedPath(projectRoot, validator)) {
+    throw new Error('Personal secret validator escaped its Product Slice.');
+  }
+  const result = await execFileAsync(
+    process.execPath,
+    [
+      '--no-warnings',
+      '--experimental-strip-types',
+      validator,
+      '--verify',
+    ],
+    {
+      cwd: projectRoot,
+      encoding: 'utf8',
+      env: environment,
+      maxBuffer: 32,
+      timeout: 10_000,
+      windowsHide: true,
+    },
+  );
+  if (result.stdout !== 'valid\\n' || result.stderr !== '') {
+    throw new Error('Personal secret declarations are not verified.');
+  }
+}
+
+async function removeSecret(binary, projectRoot, environment, profile, stage, logicalName) {
+  try {
+    await execFileAsync(
+      process.execPath,
+      [
+        binary,
+        'secret',
+        'remove',
+        logicalName,
+        '--stage',
+        stage,
+        '--profile',
+        profile,
+      ],
+      {
+        cwd: projectRoot,
+        encoding: 'utf8',
+        env: environment,
+        maxBuffer: 4096,
+        timeout: 60_000,
+        windowsHide: true,
+      },
+    );
+  } catch (error) {
+    const output =
+      error &&
+      typeof error === 'object' &&
+      'stdout' in error &&
+      'stderr' in error &&
+      typeof error.stdout === 'string' &&
+      typeof error.stderr === 'string'
+        ? error.stdout + '\\n' + error.stderr
+        : '';
+    if (isExactSstSecretAlreadyAbsent(output, logicalName)) return;
+    throw new Error('Personal SST secret removal failed.');
+  }
+}
+
+async function main() {
+  if (process.argv.length !== 2) {
+    throw new Error('Personal secret cleanup accepts no arguments.');
+  }
+  const stage = process.env.EBK_STAGE ?? '';
+  const profile = process.env.AWS_PROFILE ?? '';
+  const region = process.env.AWS_REGION ?? '';
+  const appData = process.env.EBK_LOCAL_DEV_APP_DATA ?? '';
+  const ledgerPath =
+    process.env.EBK_PERSONAL_SECRET_LEDGER_PATH ?? '';
+  if (
+    !personalStagePattern.test(stage) ||
+    !profilePattern.test(profile) ||
+    !regionPattern.test(region) ||
+    process.env.EBK_CONSUMER_STAGE !== stage ||
+    process.env.EBK_FOUNDATION_STAGE !== 'development'
+  ) {
+    throw new Error(
+      'Personal secret cleanup requires the Fleet-derived stage, profile, and Region.',
+    );
+  }
+  const projectRoot = await realpath(
+    resolve(dirname(fileURLToPath(import.meta.url)), '..'),
+  );
+  const workspaceRoot = await realpath(resolve(projectRoot, '../..'));
+  if (!containedPath(workspaceRoot, projectRoot)) {
+    throw new Error('Product Slice escaped its workspace.');
+  }
+  assertPersonalSecretLedgerLocation({
+    appData,
+    path: ledgerPath,
+    slice: '${name}',
+    stage,
+  });
+  const environment = childEnvironment(profile, region);
+  await verifyDeclarations(projectRoot, environment);
+  const binary = await workspaceSstRuntime(workspaceRoot);
+  const accountId = await requiredAwsContext(environment, profile, region);
+  const identity = {
+    accountId,
+    region,
+    slice: '${name}',
+    sstApp: '${name}',
+    stage,
+  };
+  const ledgerLock = acquirePersonalSecretLedgerLock({
+    appData,
+    slice: '${name}',
+    stage,
+  });
+  try {
+    const ledger = readPersonalSecretLedger({
+      appData,
+      expectedIdentity: identity,
+      slice: '${name}',
+      stage,
+    });
+    const declaredLogicalNames = Object.values(Secrets)
+      .filter(
+        (declaration) =>
+          declaration.source === 'operator' &&
+          declaration.requiredStages.includes('development'),
+      )
+      .map((declaration) => declaration.logicalName)
+      .sort((left, right) => (left < right ? -1 : left > right ? 1 : 0));
+    const logicalNames = [
+      ...new Set([
+        ...declaredLogicalNames,
+        ...(ledger?.logicalNames ?? []),
+      ]),
+    ].sort((left, right) => (left < right ? -1 : left > right ? 1 : 0));
+    createPersonalSecretLedgerRecord(identity, logicalNames);
+    const failures = [];
+    for (const logicalName of logicalNames) {
+      try {
+        await removeSecret(
+          binary,
+          projectRoot,
+          environment,
+          profile,
+          stage,
+          logicalName,
+        );
+      } catch {
+        failures.push(logicalName);
+      }
+    }
+    try {
+      writePersonalSecretLedger({
+        appData,
+        lock: ledgerLock,
+        record: createPersonalSecretLedgerRecord(identity, failures),
+      });
+    } catch {
+      throw new Error(
+        'Personal secret cleanup could not reconcile its machine-private ledger. Retain the Slice claim and retry ebk dev down.',
+      );
+    }
+    if (failures.length > 0) {
+      throw new Error(
+        'Personal secret cleanup retained failed logical name(s): ' +
+          failures.join(', ') +
+          '. Retry ebk dev down with the recorded account and Region.',
+      );
+    }
+  } finally {
+    releasePersonalSecretLedgerLock(ledgerLock);
+  }
+}
+
+await main();
+`,
+        'secrets/runtime.ts': `import {
+  bindServerSecretRuntime,
+  createAwsSecretsManagerSource,
+  createLinkedPersonalSstSecretSource,
+  createPersonalSstSecretResolver,
+  createServerSecretResolver,
+  personalSstSecretReference,
+  type DefinedSecret,
+  type SecretReference,
+  type SecretResolutionContext,
+  type SecretResolverHooks,
+  type SecretValueOf,
+  type SecretValueSchema,
+} from '@empire-builder-kit/runtime/secrets';
+import { Resource } from 'sst/resource';
+
+const personalStagePattern = /${personalStagePattern}/;
+const resources = Resource as unknown as Readonly<Record<string, unknown>>;
+
+export interface StandardSliceSecretRuntimeOptions {
+  accountId?: string;
+  developmentAccountId?: string;
+  hooks?: SecretResolverHooks;
+  stage: string;
+  workload: string;
+}
+
+export interface StandardSliceSecretRuntime {
+  get<
+    Declaration extends DefinedSecret<
+      string,
+      SecretValueSchema<unknown>
+    >,
+  >(
+    declaration: Declaration,
+    context?: SecretResolutionContext,
+  ): Promise<SecretValueOf<Declaration>>;
+  runWithSecret<
+    Declaration extends DefinedSecret<
+      string,
+      SecretValueSchema<unknown>
+    >,
+    Result,
+  >(options: {
+    context?: SecretResolutionContext;
+    declaration: Declaration;
+    isAuthenticationFailure(error: unknown): boolean;
+    operation(value: SecretValueOf<Declaration>): Promise<Result>;
+  }): Promise<Result>;
+}
+
+function isRecord(value: unknown): value is Record<string, unknown> {
+  return typeof value === 'object' && value !== null && !Array.isArray(value);
+}
+
+export function protectedReference(
+  declaration: DefinedSecret,
+): SecretReference {
+  const resource = resources[declaration.logicalName];
+  if (
+    !isRecord(resource) ||
+    Object.keys(resource).some(
+      (key) =>
+        key !== 'logicalName' &&
+        key !== 'provider' &&
+        key !== 'secretArn' &&
+        key !== 'type',
+    ) ||
+    resource.type !== 'sst.sst.Linkable' ||
+    resource.logicalName !== declaration.logicalName ||
+    resource.provider !== 'aws-secrets-manager' ||
+    typeof resource.secretArn !== 'string'
+  ) {
+    throw new Error(
+      'The protected secret reference is absent or malformed.',
+    );
+  }
+  return Object.freeze({
+    logicalName: resource.logicalName,
+    provider: resource.provider,
+    secretArn: resource.secretArn,
+  });
+}
+
+export function createStandardSliceSecretRuntime(
+  options: StandardSliceSecretRuntimeOptions,
+): StandardSliceSecretRuntime {
+  const binding = bindServerSecretRuntime({
+    stage: options.stage,
+    workload: options.workload,
+  });
+  if (personalStagePattern.test(options.stage)) {
+    const resolver = createPersonalSstSecretResolver({
+      accountId: options.accountId ?? '',
+      binding,
+      developmentAccountId: options.developmentAccountId ?? '',
+      ...(options.hooks ? { hooks: options.hooks } : {}),
+      mode: 'sst-dev',
+      source: createLinkedPersonalSstSecretSource(resources),
+      stage: options.stage,
+    });
+    const runtime: StandardSliceSecretRuntime = {
+      get(declaration, context) {
+        return resolver.get(
+          declaration,
+          personalSstSecretReference(
+            declaration.logicalName,
+            options.stage,
+          ),
+          context,
+        );
+      },
+      runWithSecret(runtimeOptions) {
+        return resolver.runWithSecret({
+          ...runtimeOptions,
+          reference: personalSstSecretReference(
+            runtimeOptions.declaration.logicalName,
+            options.stage,
+          ),
+        });
+      },
+    };
+    return Object.freeze(runtime);
+  }
+
+  if (!['development', 'staging', 'production'].includes(options.stage)) {
+    throw new Error(
+      'Secret runtime stage must be canonical or framework-personal.',
+    );
+  }
+  const resolver = createServerSecretResolver({
+    binding,
+    ...(options.hooks ? { hooks: options.hooks } : {}),
+    source: createAwsSecretsManagerSource(),
+  });
+  const runtime: StandardSliceSecretRuntime = {
+    get(declaration, context) {
+      return resolver.get(
+        declaration,
+        protectedReference(declaration),
+        context,
+      );
+    },
+    runWithSecret(runtimeOptions) {
+      return resolver.runWithSecret({
+        ...runtimeOptions,
+        reference: protectedReference(runtimeOptions.declaration),
+      });
+    },
+  };
+  return Object.freeze(runtime);
+}
+`,
+        'infra/personal-secrets.ts': `import {
+  parseSecretMetadataRegistry,
+  parseSecretWorkloadAccessRegistry,
+  personalSecretNamesForWorkload,
+  type SecretWorkloadAccessPlanEntry,
+} from '@empire-builder-kit/nx/secrets';
+import secretMetadataDocument from '../secrets/metadata.json';
+import secretWorkloadAccessDocument from '../secrets/workload-access.json';
+import { createStandardSliceWorkloadRoleTopology } from './workload-roles/candidate.js';
+import { standardSliceBoundOperatorSecretDeclarations } from './workload-roles/effective-intent.js';
+
+const metadata = parseSecretMetadataRegistry(secretMetadataDocument);
+const access = parseSecretWorkloadAccessRegistry(
+  secretWorkloadAccessDocument,
+);
+const personalStagePattern = /${personalStagePattern}/;
+const workloadPrefix = '${name}.';
+
+export interface StandardSliceSecretLinks {
+  linksForWorkload(
+    workload: string,
+    selection?: {
+      excludeLogicalNames?: readonly string[];
+    },
+  ): any[];
+}
+
+function excludedLogicalNames(
+  selection: {
+    excludeLogicalNames?: readonly string[];
+  } | undefined,
+): ReadonlySet<string> {
+  if (
+    selection !== undefined &&
+    (
+      !selection ||
+      typeof selection !== 'object' ||
+      Array.isArray(selection) ||
+      Object.keys(selection).some((key) => key !== 'excludeLogicalNames') ||
+      !Array.isArray(selection.excludeLogicalNames)
+    )
+  ) {
+    throw new Error('Secret link selection is invalid.');
+  }
+  const values = selection?.excludeLogicalNames ?? [];
+  if (
+    values.some(
+      (value) =>
+        typeof value !== 'string' ||
+        !/^[A-Za-z][A-Za-z0-9]{0,63}$/.test(value),
+    ) ||
+    new Set(values).size !== values.length
+  ) {
+    throw new Error('Secret link selection is invalid.');
+  }
+  return new Set(values);
+}
+
+function registeredLogicalNamesForWorkload(workload: string): ReadonlySet<string> {
+  return new Set(
+    access.bindings
+      .filter((binding) => binding.workload === workload)
+      .map(({ logicalName }) => logicalName),
+  );
+}
+
+function expectedBindingKeys(stage: string) {
+  if (
+    access.bindings.some(
+      ({ workload }) => !workload.startsWith(workloadPrefix),
+    )
+  ) {
+    throw new Error(
+      'Secret access must target an exact workload in this Product Slice.',
+    );
+  }
+  const activeLogicalNames = new Set(
+    metadata.declarations
+      .filter((declaration) => declaration.requiredStages.includes(stage))
+      .map(({ logicalName }) => logicalName),
+  );
+  return new Set(
+    access.bindings
+      .filter(({ logicalName }) => activeLogicalNames.has(logicalName))
+      .map(
+      ({ logicalName, workload }) => workload + '\\0' + logicalName,
+      ),
+  );
+}
+
+function createProtectedLinks(
+  protectedAccess: readonly SecretWorkloadAccessPlanEntry[],
+  stage: string,
+) {
+  const expected = expectedBindingKeys(stage);
+  const observed = new Set<string>();
+  const linksByName = new Map<
+    string,
+    { arn: string; resource: any }
+  >();
+  const linksByWorkload = new Map<
+    string,
+    Array<{ logicalName: string; resource: any }>
+  >();
+
+  for (const entry of protectedAccess) {
+    if (
+      entry.workload !== entry.intent.workload ||
+      linksByWorkload.has(entry.workload) ||
+      entry.references.length !== entry.intent.links.length
+    ) {
+      throw new Error(
+        'Protected secret access differs from the declared workload registry.',
+      );
+    }
+    const resources: Array<{ logicalName: string; resource: any }> = [];
+    for (const reference of entry.references) {
+      const bindingKey = entry.workload + '\\0' + reference.logicalName;
+      const link = entry.intent.links.find(
+        (candidate) =>
+          candidate.link.properties.logicalName === reference.logicalName,
+      );
+      if (
+        !expected.has(bindingKey) ||
+        observed.has(bindingKey) ||
+        reference.provider !== 'aws-secrets-manager' ||
+        !link ||
+        link.link.resourceName !== reference.logicalName ||
+        link.link.properties.provider !== 'aws-secrets-manager' ||
+        link.link.properties.secretArn !== reference.secretArn ||
+        link.permission.Effect !== 'Allow' ||
+        link.permission.Action.length !== 1 ||
+        link.permission.Action[0] !== 'secretsmanager:GetSecretValue' ||
+        link.permission.Resource.length !== 1 ||
+        link.permission.Resource[0] !== reference.secretArn
+      ) {
+        throw new Error(
+          'Protected secret access differs from the declared workload registry.',
+        );
+      }
+      observed.add(bindingKey);
+      const existing = linksByName.get(reference.logicalName);
+      if (existing && existing.arn !== reference.secretArn) {
+        throw new Error(
+          'A declared secret resolved to conflicting protected references.',
+        );
+      }
+      const resource =
+        existing?.resource ??
+        new sst.Linkable(reference.logicalName, {
+          properties: {
+            logicalName: reference.logicalName,
+            provider: 'aws-secrets-manager',
+            secretArn: reference.secretArn,
+          },
+          include: [
+            sst.aws.permission({
+              actions: ['secretsmanager:GetSecretValue'],
+              resources: [reference.secretArn],
+            }),
+          ],
+        });
+      linksByName.set(reference.logicalName, {
+        arn: reference.secretArn,
+        resource,
+      });
+      resources.push({ logicalName: reference.logicalName, resource });
+    }
+    linksByWorkload.set(entry.workload, resources);
+  }
+  if (
+    observed.size !== expected.size ||
+    [...expected].some((binding) => !observed.has(binding))
+  ) {
+    throw new Error(
+      'Protected secret access differs from the declared workload registry.',
+    );
+  }
+  return linksByWorkload;
+}
+
+export function createStandardSliceSecretLinks(
+  input: {
+    protectedAccess?: readonly SecretWorkloadAccessPlanEntry[];
+  } = {},
+): StandardSliceSecretLinks {
+  if ($dev) {
+    if (
+      input.protectedAccess !== undefined ||
+      !personalStagePattern.test($app.stage)
+    ) {
+      throw new Error(
+        'Personal SST secrets require the framework-derived personal stage.',
+      );
+    }
+    standardSliceBoundOperatorSecretDeclarations(
+      'development',
+      createStandardSliceWorkloadRoleTopology('development'),
+    );
+    const resources = new Map(
+      metadata.declarations
+        .filter(
+          (declaration) =>
+            declaration.source === 'operator' &&
+            declaration.requiredStages.includes('development'),
+        )
+        .map(
+          ({ logicalName }) =>
+            [logicalName, new sst.Secret(logicalName)] as const,
+        ),
+    );
+    return {
+      linksForWorkload(
+        workload: string,
+        selection?: { excludeLogicalNames?: readonly string[] },
+      ) {
+        if (!workload.startsWith(workloadPrefix)) {
+          throw new Error(
+            'Secret access must target an exact workload in this Product Slice.',
+          );
+        }
+        const logicalNames = personalSecretNamesForWorkload({
+          access,
+          declarations: metadata.declarations,
+          stage: 'development',
+          workload,
+        });
+        const excluded = excludedLogicalNames(selection);
+        const registered = registeredLogicalNamesForWorkload(workload);
+        if ([...excluded].some((logicalName) => !registered.has(logicalName))) {
+          throw new Error('Secret link selection is outside the workload registry.');
+        }
+        return logicalNames
+          .filter((logicalName) => !excluded.has(logicalName))
+          .map((logicalName) => {
+          const resource = resources.get(logicalName);
+          if (!resource) {
+            throw new Error(
+              'Personal secret access differs from the declared workload registry.',
+            );
+          }
+          return resource;
+          });
+      },
+    };
+  }
+
+  if (personalStagePattern.test($app.stage)) {
+    throw new Error(
+      'A personal stage may run only under the SST development adapter.',
+    );
+  }
+  const linksByWorkload = createProtectedLinks(
+    input.protectedAccess ?? [],
+    $app.stage,
+  );
+  return {
+    linksForWorkload(
+      workload: string,
+      selection?: { excludeLogicalNames?: readonly string[] },
+    ) {
+      if (!workload.startsWith(workloadPrefix)) {
+        throw new Error(
+          'Secret access must target an exact workload in this Product Slice.',
+        );
+      }
+      const assigned = linksByWorkload.get(workload) ?? [];
+      const excluded = excludedLogicalNames(selection);
+      const registered = registeredLogicalNamesForWorkload(workload);
+      if (
+        [...excluded].some(
+          (logicalName) => !registered.has(logicalName),
+        )
+      ) {
+        throw new Error('Secret link selection is outside the workload registry.');
+      }
+      return assigned
+        .filter(({ logicalName }) => !excluded.has(logicalName))
+        .map(({ resource }) => resource);
+    },
+  };
+}
+`,
+    };
+}
+//# sourceMappingURL=built-in-plan-secret-runtime-files.js.map