@empire-builder-kit/nx 1.0.0-beta.9 → 1.0.0-rc.2

package/src/schemas/testing-evidence-result-v1.json

@@ -0,0 +1,319 @@
+{
+  "$schema": "https://json-schema.org/draft/2020-12/schema",
+  "$id": "https://empirebuilderkit.dev/schemas/testing-evidence-result-v1.json",
+  "$comment": "Structural interchange schema only. Semantic acceptance requires validateTestingEvidenceResult from @empire-builder-kit/nx/testing-evidence.",
+  "title": "Empire Builder Kit testing evidence result v1 structural schema",
+  "type": "object",
+  "additionalProperties": false,
+  "required": [
+    "artifacts",
+    "cleanup",
+    "counts",
+    "environment",
+    "findings",
+    "identicalRetry",
+    "kind",
+    "operation",
+    "outcome",
+    "proofStarted",
+    "retryChangedOutcome",
+    "schemaVersion",
+    "source",
+    "timing",
+    "workspace"
+  ],
+  "properties": {
+    "artifacts": {
+      "type": "array",
+      "maxItems": 64,
+      "items": {
+        "type": "object",
+        "additionalProperties": false,
+        "required": ["digest", "name", "retentionClass"],
+        "properties": {
+          "digest": {
+            "type": "string",
+            "pattern": "^sha256:[a-f0-9]{64}$"
+          },
+          "name": {
+            "type": "string",
+            "minLength": 1,
+            "maxLength": 256,
+            "pattern": "^(?!/)(?!.*(?:^|/)\\.\\.?(?:/|$))[A-Za-z0-9._@+-]+(?:/[A-Za-z0-9._@+-]+)*$"
+          },
+          "retentionClass": {
+            "type": "string",
+            "enum": [
+              "source-result",
+              "failure-diagnostics",
+              "protected-promotion-proof",
+              "recovery-proof",
+              "candidate-release-proof"
+            ]
+          }
+        }
+      }
+    },
+    "cleanup": {
+      "type": "object",
+      "additionalProperties": false,
+      "required": ["outcome"],
+      "properties": {
+        "outcome": {
+          "type": "string",
+          "enum": ["passed", "failed", "not-required"]
+        },
+        "sanitizedSummary": {
+          "type": "string",
+          "minLength": 1,
+          "maxLength": 1024
+        }
+      },
+      "allOf": [
+        {
+          "if": {
+            "properties": { "outcome": { "const": "failed" } },
+            "required": ["outcome"]
+          },
+          "then": {
+            "properties": {
+              "sanitizedSummary": {
+                "type": "string",
+                "minLength": 1,
+                "maxLength": 1024
+              }
+            },
+            "required": ["sanitizedSummary"]
+          }
+        }
+      ]
+    },
+    "counts": {
+      "type": "object",
+      "additionalProperties": false,
+      "required": ["failed", "passed", "quarantined", "retried", "skipped"],
+      "properties": {
+        "failed": { "type": "integer", "minimum": 0 },
+        "passed": { "type": "integer", "minimum": 0 },
+        "quarantined": { "type": "integer", "minimum": 0 },
+        "retried": {
+          "type": "integer",
+          "minimum": 0,
+          "description": "Evidence-level identical diagnostic replays. Runner-internal retries are forbidden."
+        },
+        "skipped": { "type": "integer", "minimum": 0 }
+      }
+    },
+    "environment": {
+      "type": "object",
+      "additionalProperties": false,
+      "required": ["class", "deployed"],
+      "properties": {
+        "class": {
+          "type": "string",
+          "minLength": 1,
+          "maxLength": 64,
+          "pattern": "^[a-z0-9][a-z0-9-]*$"
+        },
+        "deployed": { "type": "boolean" },
+        "stage": {
+          "type": "string",
+          "minLength": 1,
+          "maxLength": 128,
+          "pattern": "^[a-z0-9][a-z0-9-]*$"
+        }
+      },
+      "allOf": [
+        {
+          "if": {
+            "properties": { "deployed": { "const": true } },
+            "required": ["deployed"]
+          },
+          "then": {
+            "properties": {
+              "stage": {
+                "type": "string",
+                "minLength": 1,
+                "maxLength": 128,
+                "pattern": "^[a-z0-9][a-z0-9-]*$"
+              }
+            },
+            "required": ["stage"]
+          }
+        }
+      ]
+    },
+    "findings": {
+      "type": "array",
+      "maxItems": 10,
+      "items": {
+        "type": "object",
+        "additionalProperties": false,
+        "required": ["classification", "sanitizedSummary"],
+        "properties": {
+          "classification": {
+            "type": "string",
+            "enum": [
+              "assertion-failed",
+              "contract-incompatible",
+              "authorization-denied",
+              "prerequisite-missing",
+              "environment-drift",
+              "infrastructure-unavailable",
+              "cleanup-failed",
+              "sensitive-artifact",
+              "flaky",
+              "evidence-incomplete"
+            ]
+          },
+          "sanitizedSummary": {
+            "type": "string",
+            "minLength": 1,
+            "maxLength": 1024
+          }
+        }
+      }
+    },
+    "identicalRetry": { "type": "boolean" },
+    "kind": { "const": "testing-evidence-result" },
+    "operation": {
+      "type": "object",
+      "additionalProperties": false,
+      "required": ["commandVersion", "project", "proofLayer", "target"],
+      "properties": {
+        "commandVersion": {
+          "type": "string",
+          "minLength": 1,
+          "maxLength": 256,
+          "pattern": "^[A-Za-z0-9@][A-Za-z0-9._:@/-]*$"
+        },
+        "project": {
+          "type": "string",
+          "minLength": 1,
+          "maxLength": 256,
+          "pattern": "^[A-Za-z0-9@][A-Za-z0-9._:@/-]*$"
+        },
+        "proofLayer": {
+          "type": "string",
+          "enum": [
+            "source",
+            "local-integration",
+            "contract-compatibility",
+            "browser-api-acceptance",
+            "deployed-smoke",
+            "resilience-recovery",
+            "continuous-synthetic"
+          ]
+        },
+        "target": {
+          "type": "string",
+          "minLength": 1,
+          "maxLength": 256,
+          "pattern": "^[A-Za-z0-9@][A-Za-z0-9._:@/-]*$"
+        }
+      }
+    },
+    "outcome": {
+      "type": "string",
+      "enum": ["passed", "failed", "blocked", "incomplete", "flaky"]
+    },
+    "proofStarted": { "type": "boolean" },
+    "retryChangedOutcome": { "type": "boolean" },
+    "runScope": {
+      "type": "string",
+      "minLength": 1,
+      "maxLength": 128,
+      "pattern": "^[A-Za-z0-9][A-Za-z0-9._:-]{0,127}$"
+    },
+    "schemaVersion": { "const": 1 },
+    "seed": {
+      "type": "string",
+      "minLength": 1,
+      "maxLength": 128,
+      "pattern": "^[A-Za-z0-9][A-Za-z0-9._:-]{0,127}$"
+    },
+    "slice": {
+      "type": "string",
+      "minLength": 1,
+      "maxLength": 128,
+      "pattern": "^[a-z0-9][a-z0-9-]*$"
+    },
+    "source": {
+      "type": "object",
+      "additionalProperties": false,
+      "required": ["blueprintCandidates", "commit", "frameworkCandidate"],
+      "properties": {
+        "blueprintCandidates": {
+          "type": "array",
+          "maxItems": 64,
+          "uniqueItems": true,
+          "items": {
+            "type": "string",
+            "minLength": 1,
+            "maxLength": 256
+          }
+        },
+        "commit": {
+          "type": "string",
+          "pattern": "^(?:[a-f0-9]{40}|[a-f0-9]{64})$"
+        },
+        "frameworkCandidate": {
+          "type": "string",
+          "minLength": 1,
+          "maxLength": 256
+        }
+      }
+    },
+    "timing": {
+      "type": "object",
+      "additionalProperties": false,
+      "required": ["completedAt", "durationMs", "startedAt"],
+      "properties": {
+        "completedAt": { "type": "string", "format": "date-time" },
+        "durationMs": { "type": "integer", "minimum": 0 },
+        "startedAt": { "type": "string", "format": "date-time" }
+      }
+    },
+    "workspace": {
+      "type": "string",
+      "minLength": 1,
+      "maxLength": 128,
+      "pattern": "^[a-z0-9][a-z0-9-]*$"
+    }
+  },
+  "allOf": [
+    {
+      "if": {
+        "properties": {
+          "operation": {
+            "type": "object",
+            "properties": {
+              "proofLayer": {
+                "enum": ["deployed-smoke", "continuous-synthetic"]
+              }
+            },
+            "required": ["proofLayer"]
+          }
+        },
+        "required": ["operation"]
+      },
+      "then": {
+        "properties": {
+          "environment": {
+            "type": "object",
+            "properties": {
+              "deployed": { "const": true },
+              "stage": {
+                "type": "string",
+                "minLength": 1,
+                "maxLength": 128,
+                "pattern": "^[a-z0-9][a-z0-9-]*$"
+              }
+            },
+            "required": ["deployed", "stage"]
+          }
+        }
+      }
+    }
+  ]
+}

package/src/secrets/adapters.d.ts

@@ -0,0 +1,49 @@
+import { type SecretMetadataDeclaration } from './model.js';
+import { type WorkloadSecretPermissionIntent, type WorkloadSecretReferenceInput } from './permissions.js';
+import { type PersonalSecretValueValidator } from './personal-command.js';
+export interface SecretDeclarationContractLike {
+    cache?: {
+        freshTtlMs?: number;
+        staleTtlMs?: number;
+    };
+    contractVersion: 1;
+    logicalName: string;
+    owner: string;
+    requiredStages: readonly string[];
+    retention: {
+        mode: 'retain' | 'retire-with-recovery-window';
+        recoveryWindowDays?: number;
+    };
+    rotation: {
+        mode: 'manual';
+        runbook: string;
+    } | {
+        mode: 'provider-managed';
+        runbook?: string;
+    };
+    source: 'aws-managed' | 'database-bootstrap' | 'operator';
+    value: {
+        kind: 'binary' | 'json' | 'string';
+        validate: unknown;
+    };
+}
+export declare class SecretDeclarationAdapterError extends Error {
+    readonly code: 'secret-cross-slice-approval-required' | 'secret-consumption-stage-invalid' | 'secret-declaration-adapter-invalid' | 'secret-reference-undeclared';
+    constructor(code: SecretDeclarationAdapterError['code']);
+}
+export declare function toSecretMetadataDeclaration(declaration: SecretDeclarationContractLike): SecretMetadataDeclaration;
+export declare function toOperatorSecretMetadataDeclarations(declarations: Readonly<Record<string, SecretDeclarationContractLike>>): readonly SecretMetadataDeclaration[];
+export declare function createHiddenInputValidator(declaration: SecretDeclarationContractLike): PersonalSecretValueValidator;
+export declare function createDeclaredWorkloadSecretPermissionIntent(input: {
+    consumerSlice: string;
+    declarations: Readonly<Record<string, SecretDeclarationContractLike>>;
+    externalApprovals?: readonly {
+        approved: true;
+        logicalName: string;
+        owner: string;
+        secretArn: string;
+    }[];
+    references: readonly WorkloadSecretReferenceInput[];
+    stage: string;
+    workload: string;
+}): WorkloadSecretPermissionIntent;

package/src/secrets/adapters.js

@@ -0,0 +1,184 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.SecretDeclarationAdapterError = void 0;
+exports.toSecretMetadataDeclaration = toSecretMetadataDeclaration;
+exports.toOperatorSecretMetadataDeclarations = toOperatorSecretMetadataDeclarations;
+exports.createHiddenInputValidator = createHiddenInputValidator;
+exports.createDeclaredWorkloadSecretPermissionIntent = createDeclaredWorkloadSecretPermissionIntent;
+const deterministic_order_js_1 = require("../deterministic-order.js");
+const model_js_1 = require("./model.js");
+const permissions_js_1 = require("./permissions.js");
+class SecretDeclarationAdapterError extends Error {
+    code;
+    constructor(code) {
+        super(`Secret declaration adaptation failed (${code}).`);
+        this.name = 'SecretDeclarationAdapterError';
+        this.code = code;
+    }
+}
+exports.SecretDeclarationAdapterError = SecretDeclarationAdapterError;
+const slicePattern = /^[a-z0-9][a-z0-9-]{0,62}$/;
+const maximumFreshTtlMs = 5 * 60 * 1_000;
+const maximumStaleTtlMs = 15 * 60 * 1_000;
+function isRecord(value) {
+    return typeof value === 'object' && value !== null && !Array.isArray(value);
+}
+function hasOnlyProperties(value, allowed) {
+    return Object.keys(value).every((key) => allowed.includes(key));
+}
+function validateContractShape(declaration) {
+    if (!isRecord(declaration) ||
+        !hasOnlyProperties(declaration, [
+            'cache',
+            'contractVersion',
+            'logicalName',
+            'owner',
+            'requiredStages',
+            'retention',
+            'rotation',
+            'source',
+            'value',
+        ]) ||
+        declaration.contractVersion !== 1 ||
+        typeof declaration.logicalName !== 'string' ||
+        typeof declaration.owner !== 'string' ||
+        !Array.isArray(declaration.requiredStages) ||
+        declaration.requiredStages.some((stage) => typeof stage !== 'string') ||
+        !['aws-managed', 'database-bootstrap', 'operator'].includes(declaration.source) ||
+        !isRecord(declaration.value) ||
+        !hasOnlyProperties(declaration.value, ['kind', 'validate']) ||
+        !['binary', 'json', 'string'].includes(declaration.value.kind) ||
+        typeof declaration.value.validate !== 'function' ||
+        !isRecord(declaration.rotation) ||
+        !hasOnlyProperties(declaration.rotation, ['mode', 'runbook']) ||
+        !['manual', 'provider-managed'].includes(declaration.rotation.mode) ||
+        (declaration.rotation.mode === 'manual' &&
+            typeof declaration.rotation.runbook !== 'string') ||
+        (declaration.rotation.mode === 'provider-managed' &&
+            declaration.rotation.runbook !== undefined &&
+            typeof declaration.rotation.runbook !== 'string') ||
+        !isRecord(declaration.retention) ||
+        !hasOnlyProperties(declaration.retention, ['mode', 'recoveryWindowDays']) ||
+        !['retain', 'retire-with-recovery-window'].includes(declaration.retention.mode) ||
+        (declaration.retention.mode === 'retire-with-recovery-window' &&
+            (!Number.isSafeInteger(declaration.retention.recoveryWindowDays) ||
+                (declaration.retention.recoveryWindowDays ?? 0) < 7 ||
+                (declaration.retention.recoveryWindowDays ?? 0) > 30)) ||
+        (declaration.cache !== undefined &&
+            (!isRecord(declaration.cache) ||
+                !hasOnlyProperties(declaration.cache, ['freshTtlMs', 'staleTtlMs']) ||
+                (declaration.cache.freshTtlMs !== undefined &&
+                    (!Number.isSafeInteger(declaration.cache.freshTtlMs) ||
+                        declaration.cache.freshTtlMs < 0 ||
+                        declaration.cache.freshTtlMs > maximumFreshTtlMs)) ||
+                (declaration.cache.staleTtlMs !== undefined &&
+                    (!Number.isSafeInteger(declaration.cache.staleTtlMs) ||
+                        declaration.cache.staleTtlMs < 0 ||
+                        declaration.cache.staleTtlMs > maximumStaleTtlMs))))) {
+        throw new SecretDeclarationAdapterError('secret-declaration-adapter-invalid');
+    }
+}
+function toSecretMetadataDeclaration(declaration) {
+    validateContractShape(declaration);
+    const metadata = {
+        logicalName: declaration.logicalName,
+        owner: declaration.owner,
+        requiredStages: Object.freeze([...declaration.requiredStages]),
+        rotation: Object.freeze({ mode: declaration.rotation.mode }),
+        source: declaration.source,
+        valueKind: declaration.value.kind,
+    };
+    try {
+        (0, model_js_1.validateSecretMetadataDeclaration)(metadata);
+    }
+    catch {
+        throw new SecretDeclarationAdapterError('secret-declaration-adapter-invalid');
+    }
+    return Object.freeze(metadata);
+}
+function validatedDeclarations(declarations) {
+    if (!isRecord(declarations)) {
+        throw new SecretDeclarationAdapterError('secret-declaration-adapter-invalid');
+    }
+    const result = new Map();
+    for (const [key, declaration] of Object.entries(declarations).sort(([left], [right]) => (0, deterministic_order_js_1.compareUtf16)(left, right))) {
+        validateContractShape(declaration);
+        toSecretMetadataDeclaration(declaration);
+        if (key !== declaration.logicalName || result.has(key)) {
+            throw new SecretDeclarationAdapterError('secret-declaration-adapter-invalid');
+        }
+        result.set(key, declaration);
+    }
+    return result;
+}
+function toOperatorSecretMetadataDeclarations(declarations) {
+    return Object.freeze([...validatedDeclarations(declarations).values()]
+        .filter(({ source }) => source === 'operator')
+        .map((declaration) => toSecretMetadataDeclaration(declaration)));
+}
+function createHiddenInputValidator(declaration) {
+    validateContractShape(declaration);
+    const validate = declaration.value.validate;
+    const validator = {
+        validate(input) {
+            if (input.valueKind !== declaration.value.kind) {
+                return false;
+            }
+            let validationBytes;
+            try {
+                const payload = input.valueKind === 'binary'
+                    ? {
+                        secretBinary: (validationBytes = new Uint8Array(input.bytes)),
+                    }
+                    : {
+                        secretString: new TextDecoder('utf-8', {
+                            fatal: true,
+                        }).decode(input.bytes),
+                    };
+                const result = validate(payload);
+                return (isRecord(result) &&
+                    result['valid'] === true &&
+                    Object.prototype.hasOwnProperty.call(result, 'value'));
+            }
+            catch {
+                return false;
+            }
+            finally {
+                validationBytes?.fill(0);
+            }
+        },
+    };
+    return Object.freeze(validator);
+}
+function createDeclaredWorkloadSecretPermissionIntent(input) {
+    if (!(0, model_js_1.isSecretCanonicalStage)(input.stage) ||
+        !slicePattern.test(input.consumerSlice)) {
+        throw new SecretDeclarationAdapterError('secret-consumption-stage-invalid');
+    }
+    const declarations = validatedDeclarations(input.declarations);
+    for (const reference of input.references) {
+        const declaration = declarations.get(reference.logicalName);
+        if (declaration === undefined) {
+            throw new SecretDeclarationAdapterError('secret-reference-undeclared');
+        }
+        if (!declaration.requiredStages.includes(input.stage)) {
+            throw new SecretDeclarationAdapterError('secret-consumption-stage-invalid');
+        }
+        const resourceName = reference.secretArn.split(':secret:')[1] ?? '';
+        const expectedPrefix = `ebk/${input.stage}/${input.consumerSlice}/`;
+        if (!resourceName.startsWith(expectedPrefix)) {
+            const approved = input.externalApprovals?.some((approval) => approval.approved === true &&
+                approval.logicalName === reference.logicalName &&
+                approval.owner === declaration.owner &&
+                approval.secretArn === reference.secretArn);
+            if (!approved) {
+                throw new SecretDeclarationAdapterError('secret-cross-slice-approval-required');
+            }
+        }
+    }
+    return (0, permissions_js_1.createWorkloadSecretPermissionIntent)({
+        references: input.references,
+        workload: input.workload,
+    });
+}
+//# sourceMappingURL=adapters.js.map

package/src/secrets/adapters.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"adapters.js","sourceRoot":"","sources":["../../../../../packages/nx/src/secrets/adapters.ts"],"names":[],"mappings":";;;AAsIA,kEAoBC;AA0BD,oFAQC;AAED,gEAuCC;AAED,oGAmDC;AA1RD,sEAAyD;AACzD,yCAIoB;AACpB,qDAI0B;AAgC1B,MAAa,6BAA8B,SAAQ,KAAK;IAC7C,IAAI,CAIqB;IAElC,YAAY,IAA2C;QACrD,KAAK,CAAC,yCAAyC,IAAI,IAAI,CAAC,CAAC;QACzD,IAAI,CAAC,IAAI,GAAG,+BAA+B,CAAC;QAC5C,IAAI,CAAC,IAAI,GAAG,IAAI,CAAC;IACnB,CAAC;CACF;AAZD,sEAYC;AAED,MAAM,YAAY,GAAG,2BAA2B,CAAC;AACjD,MAAM,iBAAiB,GAAG,CAAC,GAAG,EAAE,GAAG,KAAK,CAAC;AACzC,MAAM,iBAAiB,GAAG,EAAE,GAAG,EAAE,GAAG,KAAK,CAAC;AAE1C,SAAS,QAAQ,CAAC,KAAc;IAC9B,OAAO,OAAO,KAAK,KAAK,QAAQ,IAAI,KAAK,KAAK,IAAI,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC;AAC9E,CAAC;AAED,SAAS,iBAAiB,CACxB,KAA8B,EAC9B,OAA0B;IAE1B,OAAO,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,KAAK,CAAC,CAAC,GAAG,EAAE,EAAE,CAAC,OAAO,CAAC,QAAQ,CAAC,GAAG,CAAC,CAAC,CAAC;AAClE,CAAC;AAED,SAAS,qBAAqB,CAC5B,WAA0C;IAE1C,IACE,CAAC,QAAQ,CAAC,WAAW,CAAC;QACtB,CAAC,iBAAiB,CAAC,WAAW,EAAE;YAC9B,OAAO;YACP,iBAAiB;YACjB,aAAa;YACb,OAAO;YACP,gBAAgB;YAChB,WAAW;YACX,UAAU;YACV,QAAQ;YACR,OAAO;SACR,CAAC;QACF,WAAW,CAAC,eAAe,KAAK,CAAC;QACjC,OAAO,WAAW,CAAC,WAAW,KAAK,QAAQ;QAC3C,OAAO,WAAW,CAAC,KAAK,KAAK,QAAQ;QACrC,CAAC,KAAK,CAAC,OAAO,CAAC,WAAW,CAAC,cAAc,CAAC;QAC1C,WAAW,CAAC,cAAc,CAAC,IAAI,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,OAAO,KAAK,KAAK,QAAQ,CAAC;QACrE,CAAC,CAAC,aAAa,EAAE,oBAAoB,EAAE,UAAU,CAAC,CAAC,QAAQ,CACzD,WAAW,CAAC,MAAM,CACnB;QACD,CAAC,QAAQ,CAAC,WAAW,CAAC,KAAK,CAAC;QAC5B,CAAC,iBAAiB,CAAC,WAAW,CAAC,KAAK,EAAE,CAAC,MAAM,EAAE,UAAU,CAAC,CAAC;QAC3D,CAAC,CAAC,QAAQ,EAAE,MAAM,EAAE,QAAQ,CAAC,CAAC,QAAQ,CAAC,WAAW,CAAC,KAAK,CAAC,IAAI,CAAC;QAC9D,OAAO,WAAW,CAAC,KAAK,CAAC,QAAQ,KAAK,UAAU;QAChD,CAAC,QAAQ,CAAC,WAAW,CAAC,QAAQ,CAAC;QAC/B,CAAC,iBAAiB,CAAC,WAAW,CAAC,QAAQ,EAAE,CAAC,MAAM,EAAE,SAAS,CAAC,CAAC;QAC7D,CAAC,CAAC,QAAQ,EAAE,kBAAkB,CAAC,CAAC,QAAQ,CAAC,WAAW,CAAC,QAAQ,CAAC,IAAI,CAAC;QACnE,CAAC,WAAW,CAAC,QAAQ,CAAC,IAAI,KAAK,QAAQ;YACrC,OAAO,WAAW,CAAC,QAAQ,CAAC,OAAO,KAAK,QAAQ,CAAC;QACnD,CAAC,WAAW,CAAC,QAAQ,CAAC,IAAI,KAAK,kBAAkB;YAC/C,WAAW,CAAC,QAAQ,CAAC,OAAO,KAAK,SAAS;YAC1C,OAAO,WAAW,CAAC,QAAQ,CAAC,OAAO,KAAK,QAAQ,CAAC;QACnD,CAAC,QAAQ,CAAC,WAAW,CAAC,SAAS,CAAC;QAChC,CAAC,iBAAiB,CAAC,WAAW,CAAC,SAAS,EAAE,CAAC,MAAM,EAAE,oBAAoB,CAAC,CAAC;QACzE,CAAC,CAAC,QAAQ,EAAE,6BAA6B,CAAC,CAAC,QAAQ,CACjD,WAAW,CAAC,SAAS,CAAC,IAAI,CAC3B;QACD,CAAC,WAAW,CAAC,SAAS,CAAC,IAAI,KAAK,6BAA6B;YAC3D,CAAC,CAAC,MAAM,CAAC,aAAa,CAAC,WAAW,CAAC,SAAS,CAAC,kBAAkB,CAAC;gBAC9D,CAAC,WAAW,CAAC,SAAS,CAAC,kBAAkB,IAAI,CAAC,CAAC,GAAG,CAAC;gBACnD,CAAC,WAAW,CAAC,SAAS,CAAC,kBAAkB,IAAI,CAAC,CAAC,GAAG,EAAE,CAAC,CAAC;QAC1D,CAAC,WAAW,CAAC,KAAK,KAAK,SAAS;YAC9B,CAAC,CAAC,QAAQ,CAAC,WAAW,CAAC,KAAK,CAAC;gBAC3B,CAAC,iBAAiB,CAAC,WAAW,CAAC,KAAK,EAAE,CAAC,YAAY,EAAE,YAAY,CAAC,CAAC;gBACnE,CAAC,WAAW,CAAC,KAAK,CAAC,UAAU,KAAK,SAAS;oBACzC,CAAC,CAAC,MAAM,CAAC,aAAa,CAAC,WAAW,CAAC,KAAK,CAAC,UAAU,CAAC;wBAClD,WAAW,CAAC,KAAK,CAAC,UAAU,GAAG,CAAC;wBAChC,WAAW,CAAC,KAAK,CAAC,UAAU,GAAG,iBAAiB,CAAC,CAAC;gBACtD,CAAC,WAAW,CAAC,KAAK,CAAC,UAAU,KAAK,SAAS;oBACzC,CAAC,CAAC,MAAM,CAAC,aAAa,CAAC,WAAW,CAAC,KAAK,CAAC,UAAU,CAAC;wBAClD,WAAW,CAAC,KAAK,CAAC,UAAU,GAAG,CAAC;wBAChC,WAAW,CAAC,KAAK,CAAC,UAAU,GAAG,iBAAiB,CAAC,CAAC,CAAC,CAAC,EAC5D,CAAC;QACD,MAAM,IAAI,6BAA6B,CACrC,oCAAoC,CACrC,CAAC;IACJ,CAAC;AACH,CAAC;AAED,SAAgB,2BAA2B,CACzC,WAA0C;IAE1C,qBAAqB,CAAC,WAAW,CAAC,CAAC;IACnC,MAAM,QAAQ,GAA8B;QAC1C,WAAW,EAAE,WAAW,CAAC,WAAW;QACpC,KAAK,EAAE,WAAW,CAAC,KAAK;QACxB,cAAc,EAAE,MAAM,CAAC,MAAM,CAAC,CAAC,GAAG,WAAW,CAAC,cAAc,CAAC,CAAC;QAC9D,QAAQ,EAAE,MAAM,CAAC,MAAM,CAAC,EAAE,IAAI,EAAE,WAAW,CAAC,QAAQ,CAAC,IAAI,EAAE,CAAC;QAC5D,MAAM,EAAE,WAAW,CAAC,MAAM;QAC1B,SAAS,EAAE,WAAW,CAAC,KAAK,CAAC,IAAI;KAClC,CAAC;IACF,IAAI,CAAC;QACH,IAAA,4CAAiC,EAAC,QAAQ,CAAC,CAAC;IAC9C,CAAC;IAAC,MAAM,CAAC;QACP,MAAM,IAAI,6BAA6B,CACrC,oCAAoC,CACrC,CAAC;IACJ,CAAC;IACD,OAAO,MAAM,CAAC,MAAM,CAAC,QAAQ,CAAC,CAAC;AACjC,CAAC;AAED,SAAS,qBAAqB,CAC5B,YAAqE;IAErE,IAAI,CAAC,QAAQ,CAAC,YAAY,CAAC,EAAE,CAAC;QAC5B,MAAM,IAAI,6BAA6B,CACrC,oCAAoC,CACrC,CAAC;IACJ,CAAC;IACD,MAAM,MAAM,GAAG,IAAI,GAAG,EAAyC,CAAC;IAChE,KAAK,MAAM,CAAC,GAAG,EAAE,WAAW,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,YAAY,CAAC,CAAC,IAAI,CAChE,CAAC,CAAC,IAAI,CAAC,EAAE,CAAC,KAAK,CAAC,EAAE,EAAE,CAAC,IAAA,qCAAY,EAAC,IAAI,EAAE,KAAK,CAAC,CAC/C,EAAE,CAAC;QACF,qBAAqB,CAAC,WAAW,CAAC,CAAC;QACnC,2BAA2B,CAAC,WAAW,CAAC,CAAC;QACzC,IAAI,GAAG,KAAK,WAAW,CAAC,WAAW,IAAI,MAAM,CAAC,GAAG,CAAC,GAAG,CAAC,EAAE,CAAC;YACvD,MAAM,IAAI,6BAA6B,CACrC,oCAAoC,CACrC,CAAC;QACJ,CAAC;QACD,MAAM,CAAC,GAAG,CAAC,GAAG,EAAE,WAAW,CAAC,CAAC;IAC/B,CAAC;IACD,OAAO,MAAM,CAAC;AAChB,CAAC;AAED,SAAgB,oCAAoC,CAClD,YAAqE;IAErE,OAAO,MAAM,CAAC,MAAM,CAClB,CAAC,GAAG,qBAAqB,CAAC,YAAY,CAAC,CAAC,MAAM,EAAE,CAAC;SAC9C,MAAM,CAAC,CAAC,EAAE,MAAM,EAAE,EAAE,EAAE,CAAC,MAAM,KAAK,UAAU,CAAC;SAC7C,GAAG,CAAC,CAAC,WAAW,EAAE,EAAE,CAAC,2BAA2B,CAAC,WAAW,CAAC,CAAC,CAClE,CAAC;AACJ,CAAC;AAED,SAAgB,0BAA0B,CACxC,WAA0C;IAE1C,qBAAqB,CAAC,WAAW,CAAC,CAAC;IACnC,MAAM,QAAQ,GAAG,WAAW,CAAC,KAAK,CAAC,QAGtB,CAAC;IACd,MAAM,SAAS,GAAiC;QAC9C,QAAQ,CAAC,KAAK;YACZ,IAAI,KAAK,CAAC,SAAS,KAAK,WAAW,CAAC,KAAK,CAAC,IAAI,EAAE,CAAC;gBAC/C,OAAO,KAAK,CAAC;YACf,CAAC;YACD,IAAI,eAAuC,CAAC;YAC5C,IAAI,CAAC;gBACH,MAAM,OAAO,GACX,KAAK,CAAC,SAAS,KAAK,QAAQ;oBAC1B,CAAC,CAAC;wBACE,YAAY,EAAE,CAAC,eAAe,GAAG,IAAI,UAAU,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC;qBAC9D;oBACH,CAAC,CAAC;wBACE,YAAY,EAAE,IAAI,WAAW,CAAC,OAAO,EAAE;4BACrC,KAAK,EAAE,IAAI;yBACZ,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,KAAK,CAAC;qBACvB,CAAC;gBACR,MAAM,MAAM,GAAG,QAAQ,CAAC,OAAO,CAAC,CAAC;gBACjC,OAAO,CACL,QAAQ,CAAC,MAAM,CAAC;oBAChB,MAAM,CAAC,OAAO,CAAC,KAAK,IAAI;oBACxB,MAAM,CAAC,SAAS,CAAC,cAAc,CAAC,IAAI,CAAC,MAAM,EAAE,OAAO,CAAC,CACtD,CAAC;YACJ,CAAC;YAAC,MAAM,CAAC;gBACP,OAAO,KAAK,CAAC;YACf,CAAC;oBAAS,CAAC;gBACT,eAAe,EAAE,IAAI,CAAC,CAAC,CAAC,CAAC;YAC3B,CAAC;QACH,CAAC;KACF,CAAC;IACF,OAAO,MAAM,CAAC,MAAM,CAAC,SAAS,CAAC,CAAC;AAClC,CAAC;AAED,SAAgB,4CAA4C,CAAC,KAY5D;IACC,IACE,CAAC,IAAA,iCAAsB,EAAC,KAAK,CAAC,KAAK,CAAC;QACpC,CAAC,YAAY,CAAC,IAAI,CAAC,KAAK,CAAC,aAAa,CAAC,EACvC,CAAC;QACD,MAAM,IAAI,6BAA6B,CAAC,kCAAkC,CAAC,CAAC;IAC9E,CAAC;IACD,MAAM,YAAY,GAAG,qBAAqB,CAAC,KAAK,CAAC,YAAY,CAAC,CAAC;IAC/D,KAAK,MAAM,SAAS,IAAI,KAAK,CAAC,UAAU,EAAE,CAAC;QACzC,MAAM,WAAW,GAAG,YAAY,CAAC,GAAG,CAAC,SAAS,CAAC,WAAW,CAAC,CAAC;QAC5D,IAAI,WAAW,KAAK,SAAS,EAAE,CAAC;YAC9B,MAAM,IAAI,6BAA6B,CAAC,6BAA6B,CAAC,CAAC;QACzE,CAAC;QACD,IAAI,CAAC,WAAW,CAAC,cAAc,CAAC,QAAQ,CAAC,KAAK,CAAC,KAAK,CAAC,EAAE,CAAC;YACtD,MAAM,IAAI,6BAA6B,CACrC,kCAAkC,CACnC,CAAC;QACJ,CAAC;QACD,MAAM,YAAY,GAAG,SAAS,CAAC,SAAS,CAAC,KAAK,CAAC,UAAU,CAAC,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC;QACpE,MAAM,cAAc,GAAG,OAAO,KAAK,CAAC,KAAK,IAAI,KAAK,CAAC,aAAa,GAAG,CAAC;QACpE,IAAI,CAAC,YAAY,CAAC,UAAU,CAAC,cAAc,CAAC,EAAE,CAAC;YAC7C,MAAM,QAAQ,GAAG,KAAK,CAAC,iBAAiB,EAAE,IAAI,CAC5C,CAAC,QAAQ,EAAE,EAAE,CACX,QAAQ,CAAC,QAAQ,KAAK,IAAI;gBAC1B,QAAQ,CAAC,WAAW,KAAK,SAAS,CAAC,WAAW;gBAC9C,QAAQ,CAAC,KAAK,KAAK,WAAW,CAAC,KAAK;gBACpC,QAAQ,CAAC,SAAS,KAAK,SAAS,CAAC,SAAS,CAC7C,CAAC;YACF,IAAI,CAAC,QAAQ,EAAE,CAAC;gBACd,MAAM,IAAI,6BAA6B,CACrC,sCAAsC,CACvC,CAAC;YACJ,CAAC;QACH,CAAC;IACH,CAAC;IACD,OAAO,IAAA,qDAAoC,EAAC;QAC1C,UAAU,EAAE,KAAK,CAAC,UAAU;QAC5B,QAAQ,EAAE,KAAK,CAAC,QAAQ;KACzB,CAAC,CAAC;AACL,CAAC"}

package/src/secrets/aws-control-plane.d.ts

@@ -0,0 +1,20 @@
+import { CreateSecretCommand, DeleteSecretCommand, DescribeSecretCommand, ListSecretsCommand, RestoreSecretCommand, SecretsManagerClient, TagResourceCommand } from '@aws-sdk/client-secrets-manager';
+import type { ProtectedSecretLifecycleControlPlane, SecretMetadataControlPlane } from './operator.js';
+export type AwsSecretMetadataCommand = CreateSecretCommand | DeleteSecretCommand | DescribeSecretCommand | ListSecretsCommand | RestoreSecretCommand | TagResourceCommand;
+export interface AwsSecretsManagerMetadataClient {
+    send(command: AwsSecretMetadataCommand): Promise<unknown>;
+}
+export declare class AwsSecretMetadataControlPlaneError extends Error {
+    readonly code: 'aws-secret-metadata-input-invalid' | 'aws-secret-metadata-observation-invalid' | 'aws-secret-metadata-pagination-invalid';
+    constructor(code: AwsSecretMetadataControlPlaneError['code']);
+}
+/**
+ * Creates the value-blind AWS Secrets Manager control plane used by report,
+ * preflight, reconciliation, retirement, and recovery. This adapter
+ * intentionally has no GetSecretValue, PutSecretValue, or force-delete
+ * operation.
+ */
+export declare function createAwsSecretsManagerMetadataControlPlane(options?: {
+    client?: AwsSecretsManagerMetadataClient;
+    clientConfiguration?: ConstructorParameters<typeof SecretsManagerClient>[0];
+}): SecretMetadataControlPlane & ProtectedSecretLifecycleControlPlane;