@empire-builder-kit/nx 1.0.0-beta.9 → 1.0.0-rc.2

package/src/secrets/aws-control-plane.js

@@ -0,0 +1,255 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.AwsSecretMetadataControlPlaneError = void 0;
+exports.createAwsSecretsManagerMetadataControlPlane = createAwsSecretsManagerMetadataControlPlane;
+const deterministic_order_js_1 = require("../deterministic-order.js");
+const client_secrets_manager_1 = require("@aws-sdk/client-secrets-manager");
+const model_js_1 = require("./model.js");
+class AwsSecretMetadataControlPlaneError extends Error {
+    code;
+    constructor(code) {
+        super(`AWS secret metadata control plane failed (${code}).`);
+        this.name = 'AwsSecretMetadataControlPlaneError';
+        this.code = code;
+    }
+}
+exports.AwsSecretMetadataControlPlaneError = AwsSecretMetadataControlPlaneError;
+const maximumListPages = 100;
+function isRecord(value) {
+    return typeof value === 'object' && value !== null && !Array.isArray(value);
+}
+function requireRecord(value) {
+    if (!isRecord(value)) {
+        throw new AwsSecretMetadataControlPlaneError('aws-secret-metadata-observation-invalid');
+    }
+    return value;
+}
+function requireNonEmptyString(value) {
+    if (typeof value !== 'string' || value.length === 0) {
+        throw new AwsSecretMetadataControlPlaneError('aws-secret-metadata-observation-invalid');
+    }
+    return value;
+}
+function requireExactArn(value) {
+    const arn = requireNonEmptyString(value);
+    if (!(0, model_js_1.isExactSecretArn)(arn)) {
+        throw new AwsSecretMetadataControlPlaneError('aws-secret-metadata-observation-invalid');
+    }
+    return arn;
+}
+function assertExactArn(value) {
+    if (!(0, model_js_1.isExactSecretArn)(value)) {
+        throw new AwsSecretMetadataControlPlaneError('aws-secret-metadata-input-invalid');
+    }
+}
+function validateMetadataText(value) {
+    if (value.length === 0 || value.includes('\0')) {
+        throw new AwsSecretMetadataControlPlaneError('aws-secret-metadata-input-invalid');
+    }
+}
+function tagsToAws(tags) {
+    if (!isRecord(tags) ||
+        Object.keys(tags).length === 0 ||
+        Object.entries(tags).some(([key, value]) => key.length === 0 ||
+            key.includes('\0') ||
+            typeof value !== 'string' ||
+            value.length === 0 ||
+            value.includes('\0'))) {
+        throw new AwsSecretMetadataControlPlaneError('aws-secret-metadata-input-invalid');
+    }
+    return Object.keys(tags)
+        .sort()
+        .map((Key) => ({ Key, Value: tags[Key] }));
+}
+function tagsFromAws(value) {
+    if (value === undefined)
+        return Object.freeze({});
+    if (!Array.isArray(value)) {
+        throw new AwsSecretMetadataControlPlaneError('aws-secret-metadata-observation-invalid');
+    }
+    const tags = {};
+    for (const entry of value) {
+        const tag = requireRecord(entry);
+        const key = requireNonEmptyString(tag['Key']);
+        if (typeof tag['Value'] !== 'string' ||
+            Object.prototype.hasOwnProperty.call(tags, key)) {
+            throw new AwsSecretMetadataControlPlaneError('aws-secret-metadata-observation-invalid');
+        }
+        tags[key] = tag['Value'];
+    }
+    return Object.freeze(tags);
+}
+function versionStagesFromAws(value) {
+    if (value === undefined)
+        return Object.freeze([]);
+    if (!isRecord(value)) {
+        throw new AwsSecretMetadataControlPlaneError('aws-secret-metadata-observation-invalid');
+    }
+    const stages = new Set();
+    for (const item of Object.values(value)) {
+        if (!Array.isArray(item) ||
+            item.some((stage) => typeof stage !== 'string' || stage.length === 0)) {
+            throw new AwsSecretMetadataControlPlaneError('aws-secret-metadata-observation-invalid');
+        }
+        for (const stage of item)
+            stages.add(stage);
+    }
+    return Object.freeze([...stages].sort());
+}
+function toObservedSecretMetadata(output, expectedArn) {
+    const observed = Object.freeze({
+        arn: requireExactArn(output.ARN),
+        name: requireNonEmptyString(output.Name),
+        rotationEnabled: output.RotationEnabled === true,
+        tags: tagsFromAws(output.Tags),
+        versionStages: versionStagesFromAws(output.VersionIdsToStages),
+    });
+    if (observed.arn !== expectedArn) {
+        throw new AwsSecretMetadataControlPlaneError('aws-secret-metadata-observation-invalid');
+    }
+    try {
+        (0, model_js_1.validateObservedSecretMetadata)(observed);
+    }
+    catch {
+        throw new AwsSecretMetadataControlPlaneError('aws-secret-metadata-observation-invalid');
+    }
+    return observed;
+}
+function requireOutput(value) {
+    requireRecord(value);
+    return value;
+}
+function defaultClient(configuration) {
+    const client = new client_secrets_manager_1.SecretsManagerClient(configuration);
+    return {
+        send(command) {
+            if (command instanceof client_secrets_manager_1.CreateSecretCommand) {
+                return client.send(command);
+            }
+            if (command instanceof client_secrets_manager_1.DeleteSecretCommand) {
+                return client.send(command);
+            }
+            if (command instanceof client_secrets_manager_1.DescribeSecretCommand) {
+                return client.send(command);
+            }
+            if (command instanceof client_secrets_manager_1.ListSecretsCommand) {
+                return client.send(command);
+            }
+            if (command instanceof client_secrets_manager_1.RestoreSecretCommand) {
+                return client.send(command);
+            }
+            return client.send(command);
+        },
+    };
+}
+/**
+ * Creates the value-blind AWS Secrets Manager control plane used by report,
+ * preflight, reconciliation, retirement, and recovery. This adapter
+ * intentionally has no GetSecretValue, PutSecretValue, or force-delete
+ * operation.
+ */
+function createAwsSecretsManagerMetadataControlPlane(options = {}) {
+    const client = options.client ?? defaultClient(options.clientConfiguration ?? {});
+    return Object.freeze({
+        async createEmpty(input) {
+            validateMetadataText(input.name);
+            validateMetadataText(input.description);
+            const output = requireOutput(await client.send(new client_secrets_manager_1.CreateSecretCommand({
+                Description: input.description,
+                Name: input.name,
+                Tags: tagsToAws(input.tags),
+            })));
+            const arn = requireExactArn(output.ARN);
+            if (output.Name !== input.name || output.VersionId !== undefined) {
+                throw new AwsSecretMetadataControlPlaneError('aws-secret-metadata-observation-invalid');
+            }
+            return Object.freeze({ arn });
+        },
+        async describe(input) {
+            assertExactArn(input.arn);
+            const output = requireOutput(await client.send(new client_secrets_manager_1.DescribeSecretCommand({
+                SecretId: input.arn,
+            })));
+            return toObservedSecretMetadata(output, input.arn);
+        },
+        async list(input) {
+            validateMetadataText(input.namePrefix);
+            const listed = [];
+            const seenTokens = new Set();
+            let nextToken;
+            for (let page = 0; page < maximumListPages; page += 1) {
+                const output = requireOutput(await client.send(new client_secrets_manager_1.ListSecretsCommand({
+                    Filters: [{ Key: 'name', Values: [input.namePrefix] }],
+                    ...(input.includePlannedDeletion === undefined
+                        ? {}
+                        : {
+                            IncludePlannedDeletion: input.includePlannedDeletion,
+                        }),
+                    ...(nextToken === undefined ? {} : { NextToken: nextToken }),
+                })));
+                const pageItems = output.SecretList ?? [];
+                if (!Array.isArray(pageItems)) {
+                    throw new AwsSecretMetadataControlPlaneError('aws-secret-metadata-observation-invalid');
+                }
+                for (const item of pageItems) {
+                    const arn = requireExactArn(item.ARN);
+                    const name = requireNonEmptyString(item.Name);
+                    if (!name.startsWith(input.namePrefix)) {
+                        throw new AwsSecretMetadataControlPlaneError('aws-secret-metadata-observation-invalid');
+                    }
+                    listed.push({ arn, name });
+                }
+                if (output.NextToken === undefined) {
+                    return Object.freeze(listed
+                        .sort((left, right) => (0, deterministic_order_js_1.compareUtf16)(left.name, right.name))
+                        .map((item) => Object.freeze(item)));
+                }
+                if (typeof output.NextToken !== 'string' ||
+                    output.NextToken.length === 0 ||
+                    seenTokens.has(output.NextToken)) {
+                    throw new AwsSecretMetadataControlPlaneError('aws-secret-metadata-pagination-invalid');
+                }
+                seenTokens.add(output.NextToken);
+                nextToken = output.NextToken;
+            }
+            throw new AwsSecretMetadataControlPlaneError('aws-secret-metadata-pagination-invalid');
+        },
+        async restore(input) {
+            assertExactArn(input.arn);
+            const output = requireOutput(await client.send(new client_secrets_manager_1.RestoreSecretCommand({
+                SecretId: input.arn,
+            })));
+            if (requireExactArn(output.ARN) !== input.arn) {
+                throw new AwsSecretMetadataControlPlaneError('aws-secret-metadata-observation-invalid');
+            }
+        },
+        async scheduleRetirement(input) {
+            assertExactArn(input.arn);
+            if (!Number.isSafeInteger(input.recoveryWindowDays) ||
+                input.recoveryWindowDays < 7 ||
+                input.recoveryWindowDays > 30) {
+                throw new AwsSecretMetadataControlPlaneError('aws-secret-metadata-input-invalid');
+            }
+            const output = requireOutput(await client.send(new client_secrets_manager_1.DeleteSecretCommand({
+                RecoveryWindowInDays: input.recoveryWindowDays,
+                SecretId: input.arn,
+            })));
+            if (requireExactArn(output.ARN) !== input.arn ||
+                !(output.DeletionDate instanceof Date) ||
+                Number.isNaN(output.DeletionDate.getTime())) {
+                throw new AwsSecretMetadataControlPlaneError('aws-secret-metadata-observation-invalid');
+            }
+            return Object.freeze({
+                recoveryUntil: output.DeletionDate.toISOString(),
+            });
+        },
+        async tag(input) {
+            assertExactArn(input.arn);
+            await client.send(new client_secrets_manager_1.TagResourceCommand({
+                SecretId: input.arn,
+                Tags: tagsToAws(input.tags),
+            }));
+        },
+    });
+}
+//# sourceMappingURL=aws-control-plane.js.map

package/src/secrets/aws-control-plane.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"aws-control-plane.js","sourceRoot":"","sources":["../../../../../packages/nx/src/secrets/aws-control-plane.ts"],"names":[],"mappings":";;;AAwOA,kGAkKC;AA1YD,sEAAyD;AACzD,4EAayC;AAEzC,yCAIoB;AAkBpB,MAAa,kCAAmC,SAAQ,KAAK;IAClD,IAAI,CAGgC;IAE7C,YAAY,IAAgD;QAC1D,KAAK,CAAC,6CAA6C,IAAI,IAAI,CAAC,CAAC;QAC7D,IAAI,CAAC,IAAI,GAAG,oCAAoC,CAAC;QACjD,IAAI,CAAC,IAAI,GAAG,IAAI,CAAC;IACnB,CAAC;CACF;AAXD,gFAWC;AAED,MAAM,gBAAgB,GAAG,GAAG,CAAC;AAE7B,SAAS,QAAQ,CAAC,KAAc;IAC9B,OAAO,OAAO,KAAK,KAAK,QAAQ,IAAI,KAAK,KAAK,IAAI,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC;AAC9E,CAAC;AAED,SAAS,aAAa,CAAC,KAAc;IACnC,IAAI,CAAC,QAAQ,CAAC,KAAK,CAAC,EAAE,CAAC;QACrB,MAAM,IAAI,kCAAkC,CAC1C,yCAAyC,CAC1C,CAAC;IACJ,CAAC;IACD,OAAO,KAAK,CAAC;AACf,CAAC;AAED,SAAS,qBAAqB,CAAC,KAAc;IAC3C,IAAI,OAAO,KAAK,KAAK,QAAQ,IAAI,KAAK,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QACpD,MAAM,IAAI,kCAAkC,CAC1C,yCAAyC,CAC1C,CAAC;IACJ,CAAC;IACD,OAAO,KAAK,CAAC;AACf,CAAC;AAED,SAAS,eAAe,CAAC,KAAc;IACrC,MAAM,GAAG,GAAG,qBAAqB,CAAC,KAAK,CAAC,CAAC;IACzC,IAAI,CAAC,IAAA,2BAAgB,EAAC,GAAG,CAAC,EAAE,CAAC;QAC3B,MAAM,IAAI,kCAAkC,CAC1C,yCAAyC,CAC1C,CAAC;IACJ,CAAC;IACD,OAAO,GAAG,CAAC;AACb,CAAC;AAED,SAAS,cAAc,CAAC,KAAa;IACnC,IAAI,CAAC,IAAA,2BAAgB,EAAC,KAAK,CAAC,EAAE,CAAC;QAC7B,MAAM,IAAI,kCAAkC,CAC1C,mCAAmC,CACpC,CAAC;IACJ,CAAC;AACH,CAAC;AAED,SAAS,oBAAoB,CAAC,KAAa;IACzC,IAAI,KAAK,CAAC,MAAM,KAAK,CAAC,IAAI,KAAK,CAAC,QAAQ,CAAC,IAAI,CAAC,EAAE,CAAC;QAC/C,MAAM,IAAI,kCAAkC,CAC1C,mCAAmC,CACpC,CAAC;IACJ,CAAC;AACH,CAAC;AAED,SAAS,SAAS,CAAC,IAAsC;IACvD,IACE,CAAC,QAAQ,CAAC,IAAI,CAAC;QACf,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,MAAM,KAAK,CAAC;QAC9B,MAAM,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC,IAAI,CACvB,CAAC,CAAC,GAAG,EAAE,KAAK,CAAC,EAAE,EAAE,CACf,GAAG,CAAC,MAAM,KAAK,CAAC;YAChB,GAAG,CAAC,QAAQ,CAAC,IAAI,CAAC;YAClB,OAAO,KAAK,KAAK,QAAQ;YACzB,KAAK,CAAC,MAAM,KAAK,CAAC;YAClB,KAAK,CAAC,QAAQ,CAAC,IAAI,CAAC,CACvB,EACD,CAAC;QACD,MAAM,IAAI,kCAAkC,CAC1C,mCAAmC,CACpC,CAAC;IACJ,CAAC;IACD,OAAO,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC;SACrB,IAAI,EAAE;SACN,GAAG,CAAC,CAAC,GAAG,EAAE,EAAE,CAAC,CAAC,EAAE,GAAG,EAAE,KAAK,EAAE,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC,CAAC;AAC/C,CAAC;AAED,SAAS,WAAW,CAAC,KAAc;IACjC,IAAI,KAAK,KAAK,SAAS;QAAE,OAAO,MAAM,CAAC,MAAM,CAAC,EAAE,CAAC,CAAC;IAClD,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC,EAAE,CAAC;QAC1B,MAAM,IAAI,kCAAkC,CAC1C,yCAAyC,CAC1C,CAAC;IACJ,CAAC;IACD,MAAM,IAAI,GAA2B,EAAE,CAAC;IACxC,KAAK,MAAM,KAAK,IAAI,KAAK,EAAE,CAAC;QAC1B,MAAM,GAAG,GAAG,aAAa,CAAC,KAAK,CAAC,CAAC;QACjC,MAAM,GAAG,GAAG,qBAAqB,CAAC,GAAG,CAAC,KAAK,CAAC,CAAC,CAAC;QAC9C,IACE,OAAO,GAAG,CAAC,OAAO,CAAC,KAAK,QAAQ;YAChC,MAAM,CAAC,SAAS,CAAC,cAAc,CAAC,IAAI,CAAC,IAAI,EAAE,GAAG,CAAC,EAC/C,CAAC;YACD,MAAM,IAAI,kCAAkC,CAC1C,yCAAyC,CAC1C,CAAC;QACJ,CAAC;QACD,IAAI,CAAC,GAAG,CAAC,GAAG,GAAG,CAAC,OAAO,CAAC,CAAC;IAC3B,CAAC;IACD,OAAO,MAAM,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC;AAC7B,CAAC;AAED,SAAS,oBAAoB,CAAC,KAAc;IAC1C,IAAI,KAAK,KAAK,SAAS;QAAE,OAAO,MAAM,CAAC,MAAM,CAAC,EAAE,CAAC,CAAC;IAClD,IAAI,CAAC,QAAQ,CAAC,KAAK,CAAC,EAAE,CAAC;QACrB,MAAM,IAAI,kCAAkC,CAC1C,yCAAyC,CAC1C,CAAC;IACJ,CAAC;IACD,MAAM,MAAM,GAAG,IAAI,GAAG,EAAU,CAAC;IACjC,KAAK,MAAM,IAAI,IAAI,MAAM,CAAC,MAAM,CAAC,KAAK,CAAC,EAAE,CAAC;QACxC,IACE,CAAC,KAAK,CAAC,OAAO,CAAC,IAAI,CAAC;YACpB,IAAI,CAAC,IAAI,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,OAAO,KAAK,KAAK,QAAQ,IAAI,KAAK,CAAC,MAAM,KAAK,CAAC,CAAC,EACrE,CAAC;YACD,MAAM,IAAI,kCAAkC,CAC1C,yCAAyC,CAC1C,CAAC;QACJ,CAAC;QACD,KAAK,MAAM,KAAK,IAAI,IAAI;YAAE,MAAM,CAAC,GAAG,CAAC,KAAe,CAAC,CAAC;IACxD,CAAC;IACD,OAAO,MAAM,CAAC,MAAM,CAAC,CAAC,GAAG,MAAM,CAAC,CAAC,IAAI,EAAE,CAAC,CAAC;AAC3C,CAAC;AAED,SAAS,wBAAwB,CAC/B,MAAmC,EACnC,WAAmB;IAEnB,MAAM,QAAQ,GAA2B,MAAM,CAAC,MAAM,CAAC;QACrD,GAAG,EAAE,eAAe,CAAC,MAAM,CAAC,GAAG,CAAC;QAChC,IAAI,EAAE,qBAAqB,CAAC,MAAM,CAAC,IAAI,CAAC;QACxC,eAAe,EAAE,MAAM,CAAC,eAAe,KAAK,IAAI;QAChD,IAAI,EAAE,WAAW,CAAC,MAAM,CAAC,IAAI,CAAC;QAC9B,aAAa,EAAE,oBAAoB,CAAC,MAAM,CAAC,kBAAkB,CAAC;KAC/D,CAAC,CAAC;IACH,IAAI,QAAQ,CAAC,GAAG,KAAK,WAAW,EAAE,CAAC;QACjC,MAAM,IAAI,kCAAkC,CAC1C,yCAAyC,CAC1C,CAAC;IACJ,CAAC;IACD,IAAI,CAAC;QACH,IAAA,yCAA8B,EAAC,QAAQ,CAAC,CAAC;IAC3C,CAAC;IAAC,MAAM,CAAC;QACP,MAAM,IAAI,kCAAkC,CAC1C,yCAAyC,CAC1C,CAAC;IACJ,CAAC;IACD,OAAO,QAAQ,CAAC;AAClB,CAAC;AAED,SAAS,aAAa,CAAI,KAAc;IACtC,aAAa,CAAC,KAAK,CAAC,CAAC;IACrB,OAAO,KAAU,CAAC;AACpB,CAAC;AAED,SAAS,aAAa,CACpB,aAAoE;IAEpE,MAAM,MAAM,GAAG,IAAI,6CAAoB,CAAC,aAAa,CAAC,CAAC;IACvD,OAAO;QACL,IAAI,CAAC,OAAO;YACV,IAAI,OAAO,YAAY,4CAAmB,EAAE,CAAC;gBAC3C,OAAO,MAAM,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC;YAC9B,CAAC;YACD,IAAI,OAAO,YAAY,4CAAmB,EAAE,CAAC;gBAC3C,OAAO,MAAM,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC;YAC9B,CAAC;YACD,IAAI,OAAO,YAAY,8CAAqB,EAAE,CAAC;gBAC7C,OAAO,MAAM,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC;YAC9B,CAAC;YACD,IAAI,OAAO,YAAY,2CAAkB,EAAE,CAAC;gBAC1C,OAAO,MAAM,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC;YAC9B,CAAC;YACD,IAAI,OAAO,YAAY,6CAAoB,EAAE,CAAC;gBAC5C,OAAO,MAAM,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC;YAC9B,CAAC;YACD,OAAO,MAAM,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC;QAC9B,CAAC;KACF,CAAC;AACJ,CAAC;AAED;;;;;GAKG;AACH,SAAgB,2CAA2C,CACzD,UAGI,EAAE;IAEN,MAAM,MAAM,GACV,OAAO,CAAC,MAAM,IAAI,aAAa,CAAC,OAAO,CAAC,mBAAmB,IAAI,EAAE,CAAC,CAAC;IAErE,OAAO,MAAM,CAAC,MAAM,CAAC;QACnB,KAAK,CAAC,WAAW,CAAC,KAAK;YACrB,oBAAoB,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC;YACjC,oBAAoB,CAAC,KAAK,CAAC,WAAW,CAAC,CAAC;YACxC,MAAM,MAAM,GAAG,aAAa,CAC1B,MAAM,MAAM,CAAC,IAAI,CACf,IAAI,4CAAmB,CAAC;gBACtB,WAAW,EAAE,KAAK,CAAC,WAAW;gBAC9B,IAAI,EAAE,KAAK,CAAC,IAAI;gBAChB,IAAI,EAAE,SAAS,CAAC,KAAK,CAAC,IAAI,CAAC;aAC5B,CAAC,CACH,CACF,CAAC;YACF,MAAM,GAAG,GAAG,eAAe,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC;YACxC,IAAI,MAAM,CAAC,IAAI,KAAK,KAAK,CAAC,IAAI,IAAI,MAAM,CAAC,SAAS,KAAK,SAAS,EAAE,CAAC;gBACjE,MAAM,IAAI,kCAAkC,CAC1C,yCAAyC,CAC1C,CAAC;YACJ,CAAC;YACD,OAAO,MAAM,CAAC,MAAM,CAAC,EAAE,GAAG,EAAE,CAAC,CAAC;QAChC,CAAC;QAED,KAAK,CAAC,QAAQ,CAAC,KAAK;YAClB,cAAc,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC;YAC1B,MAAM,MAAM,GAAG,aAAa,CAC1B,MAAM,MAAM,CAAC,IAAI,CACf,IAAI,8CAAqB,CAAC;gBACxB,QAAQ,EAAE,KAAK,CAAC,GAAG;aACpB,CAAC,CACH,CACF,CAAC;YACF,OAAO,wBAAwB,CAAC,MAAM,EAAE,KAAK,CAAC,GAAG,CAAC,CAAC;QACrD,CAAC;QAED,KAAK,CAAC,IAAI,CAAC,KAAK;YACd,oBAAoB,CAAC,KAAK,CAAC,UAAU,CAAC,CAAC;YACvC,MAAM,MAAM,GAAoC,EAAE,CAAC;YACnD,MAAM,UAAU,GAAG,IAAI,GAAG,EAAU,CAAC;YACrC,IAAI,SAA6B,CAAC;YAClC,KAAK,IAAI,IAAI,GAAG,CAAC,EAAE,IAAI,GAAG,gBAAgB,EAAE,IAAI,IAAI,CAAC,EAAE,CAAC;gBACtD,MAAM,MAAM,GAAG,aAAa,CAC1B,MAAM,MAAM,CAAC,IAAI,CACf,IAAI,2CAAkB,CAAC;oBACrB,OAAO,EAAE,CAAC,EAAE,GAAG,EAAE,MAAM,EAAE,MAAM,EAAE,CAAC,KAAK,CAAC,UAAU,CAAC,EAAE,CAAC;oBACtD,GAAG,CAAC,KAAK,CAAC,sBAAsB,KAAK,SAAS;wBAC5C,CAAC,CAAC,EAAE;wBACJ,CAAC,CAAC;4BACE,sBAAsB,EAAE,KAAK,CAAC,sBAAsB;yBACrD,CAAC;oBACN,GAAG,CAAC,SAAS,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,SAAS,EAAE,SAAS,EAAE,CAAC;iBAC7D,CAAC,CACH,CACF,CAAC;gBACF,MAAM,SAAS,GAAG,MAAM,CAAC,UAAU,IAAI,EAAE,CAAC;gBAC1C,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,SAAS,CAAC,EAAE,CAAC;oBAC9B,MAAM,IAAI,kCAAkC,CAC1C,yCAAyC,CAC1C,CAAC;gBACJ,CAAC;gBACD,KAAK,MAAM,IAAI,IAAI,SAAS,EAAE,CAAC;oBAC7B,MAAM,GAAG,GAAG,eAAe,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;oBACtC,MAAM,IAAI,GAAG,qBAAqB,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;oBAC9C,IAAI,CAAC,IAAI,CAAC,UAAU,CAAC,KAAK,CAAC,UAAU,CAAC,EAAE,CAAC;wBACvC,MAAM,IAAI,kCAAkC,CAC1C,yCAAyC,CAC1C,CAAC;oBACJ,CAAC;oBACD,MAAM,CAAC,IAAI,CAAC,EAAE,GAAG,EAAE,IAAI,EAAE,CAAC,CAAC;gBAC7B,CAAC;gBAED,IAAI,MAAM,CAAC,SAAS,KAAK,SAAS,EAAE,CAAC;oBACnC,OAAO,MAAM,CAAC,MAAM,CAClB,MAAM;yBACH,IAAI,CAAC,CAAC,IAAI,EAAE,KAAK,EAAE,EAAE,CAAC,IAAA,qCAAY,EAAC,IAAI,CAAC,IAAI,EAAE,KAAK,CAAC,IAAI,CAAC,CAAC;yBAC1D,GAAG,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,MAAM,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC,CACtC,CAAC;gBACJ,CAAC;gBACD,IACE,OAAO,MAAM,CAAC,SAAS,KAAK,QAAQ;oBACpC,MAAM,CAAC,SAAS,CAAC,MAAM,KAAK,CAAC;oBAC7B,UAAU,CAAC,GAAG,CAAC,MAAM,CAAC,SAAS,CAAC,EAChC,CAAC;oBACD,MAAM,IAAI,kCAAkC,CAC1C,wCAAwC,CACzC,CAAC;gBACJ,CAAC;gBACD,UAAU,CAAC,GAAG,CAAC,MAAM,CAAC,SAAS,CAAC,CAAC;gBACjC,SAAS,GAAG,MAAM,CAAC,SAAS,CAAC;YAC/B,CAAC;YACD,MAAM,IAAI,kCAAkC,CAC1C,wCAAwC,CACzC,CAAC;QACJ,CAAC;QAED,KAAK,CAAC,OAAO,CAAC,KAAK;YACjB,cAAc,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC;YAC1B,MAAM,MAAM,GAAG,aAAa,CAC1B,MAAM,MAAM,CAAC,IAAI,CACf,IAAI,6CAAoB,CAAC;gBACvB,QAAQ,EAAE,KAAK,CAAC,GAAG;aACpB,CAAC,CACH,CACF,CAAC;YACF,IAAI,eAAe,CAAC,MAAM,CAAC,GAAG,CAAC,KAAK,KAAK,CAAC,GAAG,EAAE,CAAC;gBAC9C,MAAM,IAAI,kCAAkC,CAC1C,yCAAyC,CAC1C,CAAC;YACJ,CAAC;QACH,CAAC;QAED,KAAK,CAAC,kBAAkB,CAAC,KAAK;YAC5B,cAAc,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC;YAC1B,IACE,CAAC,MAAM,CAAC,aAAa,CAAC,KAAK,CAAC,kBAAkB,CAAC;gBAC/C,KAAK,CAAC,kBAAkB,GAAG,CAAC;gBAC5B,KAAK,CAAC,kBAAkB,GAAG,EAAE,EAC7B,CAAC;gBACD,MAAM,IAAI,kCAAkC,CAC1C,mCAAmC,CACpC,CAAC;YACJ,CAAC;YACD,MAAM,MAAM,GAAG,aAAa,CAC1B,MAAM,MAAM,CAAC,IAAI,CACf,IAAI,4CAAmB,CAAC;gBACtB,oBAAoB,EAAE,KAAK,CAAC,kBAAkB;gBAC9C,QAAQ,EAAE,KAAK,CAAC,GAAG;aACpB,CAAC,CACH,CACF,CAAC;YACF,IACE,eAAe,CAAC,MAAM,CAAC,GAAG,CAAC,KAAK,KAAK,CAAC,GAAG;gBACzC,CAAC,CAAC,MAAM,CAAC,YAAY,YAAY,IAAI,CAAC;gBACtC,MAAM,CAAC,KAAK,CAAC,MAAM,CAAC,YAAY,CAAC,OAAO,EAAE,CAAC,EAC3C,CAAC;gBACD,MAAM,IAAI,kCAAkC,CAC1C,yCAAyC,CAC1C,CAAC;YACJ,CAAC;YACD,OAAO,MAAM,CAAC,MAAM,CAAC;gBACnB,aAAa,EAAE,MAAM,CAAC,YAAY,CAAC,WAAW,EAAE;aACjD,CAAC,CAAC;QACL,CAAC;QAED,KAAK,CAAC,GAAG,CAAC,KAAK;YACb,cAAc,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC;YAC1B,MAAM,MAAM,CAAC,IAAI,CACf,IAAI,2CAAkB,CAAC;gBACrB,QAAQ,EAAE,KAAK,CAAC,GAAG;gBACnB,IAAI,EAAE,SAAS,CAAC,KAAK,CAAC,IAAI,CAAC;aAC5B,CAAC,CACH,CAAC;QACJ,CAAC;KACF,CAAC,CAAC;AACL,CAAC"}

package/src/secrets/declaration-verification.d.ts

@@ -0,0 +1,11 @@
+export declare const PERSONAL_SECRET_VALIDATOR_PATH: "scripts/validate-personal-secret.mjs";
+export declare function resolvePersonalSecretValidatorPath(projectRoot: string): string;
+/**
+ * Executes the managed declaration verifier without secret input. This joins
+ * the TypeScript source contract to its value-free metadata projection during
+ * every Slice verification.
+ */
+export declare function verifyDeclaredSecretContract(input: {
+    environment?: NodeJS.ProcessEnv;
+    projectRoot: string;
+}): Promise<boolean>;

package/src/secrets/declaration-verification.js

@@ -0,0 +1,68 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.PERSONAL_SECRET_VALIDATOR_PATH = void 0;
+exports.resolvePersonalSecretValidatorPath = resolvePersonalSecretValidatorPath;
+exports.verifyDeclaredSecretContract = verifyDeclaredSecretContract;
+const node_child_process_1 = require("node:child_process");
+const node_fs_1 = require("node:fs");
+const node_path_1 = require("node:path");
+const node_util_1 = require("node:util");
+exports.PERSONAL_SECRET_VALIDATOR_PATH = 'scripts/validate-personal-secret.mjs';
+const execFileAsync = (0, node_util_1.promisify)(node_child_process_1.execFile);
+function containedPath(root, candidate) {
+    const path = (0, node_path_1.relative)(root, candidate);
+    return path === '' || (!path.startsWith('..') && !(0, node_path_1.isAbsolute)(path));
+}
+function resolvePersonalSecretValidatorPath(projectRoot) {
+    if (!(0, node_path_1.isAbsolute)(projectRoot)) {
+        throw new Error('Personal secret validator project root must be absolute.');
+    }
+    const root = (0, node_fs_1.realpathSync)(projectRoot);
+    const script = (0, node_fs_1.realpathSync)((0, node_path_1.join)(root, exports.PERSONAL_SECRET_VALIDATOR_PATH));
+    if (!containedPath(root, script)) {
+        throw new Error('Personal secret validator escaped its Product Slice.');
+    }
+    return script;
+}
+function validationEnvironment(environment) {
+    const result = {};
+    for (const name of [
+        'APPDATA',
+        'HOME',
+        'LOCALAPPDATA',
+        'PATH',
+        'PATHEXT',
+        'SystemRoot',
+        'TEMP',
+        'TMP',
+        'TMPDIR',
+        'USERPROFILE',
+    ]) {
+        if (environment[name])
+            result[name] = environment[name];
+    }
+    return result;
+}
+/**
+ * Executes the managed declaration verifier without secret input. This joins
+ * the TypeScript source contract to its value-free metadata projection during
+ * every Slice verification.
+ */
+async function verifyDeclaredSecretContract(input) {
+    try {
+        const script = resolvePersonalSecretValidatorPath(input.projectRoot);
+        const result = await execFileAsync(process.execPath, ['--no-warnings', '--experimental-strip-types', script, '--verify'], {
+            cwd: input.projectRoot,
+            encoding: 'utf8',
+            env: validationEnvironment(input.environment ?? process.env),
+            maxBuffer: 32,
+            timeout: 10_000,
+            windowsHide: true,
+        });
+        return result.stdout === 'valid\n' && result.stderr === '';
+    }
+    catch {
+        return false;
+    }
+}
+//# sourceMappingURL=declaration-verification.js.map

package/src/secrets/declaration-verification.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"declaration-verification.js","sourceRoot":"","sources":["../../../../../packages/nx/src/secrets/declaration-verification.ts"],"names":[],"mappings":";;;AAeA,gFAYC;AA4BD,oEAsBC;AA7ED,2DAA8C;AAC9C,qCAAuC;AACvC,yCAAuD;AACvD,yCAAsC;AAEzB,QAAA,8BAA8B,GACzC,sCAA+C,CAAC;AAElD,MAAM,aAAa,GAAG,IAAA,qBAAS,EAAC,6BAAQ,CAAC,CAAC;AAE1C,SAAS,aAAa,CAAC,IAAY,EAAE,SAAiB;IACpD,MAAM,IAAI,GAAG,IAAA,oBAAQ,EAAC,IAAI,EAAE,SAAS,CAAC,CAAC;IACvC,OAAO,IAAI,KAAK,EAAE,IAAI,CAAC,CAAC,IAAI,CAAC,UAAU,CAAC,IAAI,CAAC,IAAI,CAAC,IAAA,sBAAU,EAAC,IAAI,CAAC,CAAC,CAAC;AACtE,CAAC;AAED,SAAgB,kCAAkC,CAChD,WAAmB;IAEnB,IAAI,CAAC,IAAA,sBAAU,EAAC,WAAW,CAAC,EAAE,CAAC;QAC7B,MAAM,IAAI,KAAK,CAAC,0DAA0D,CAAC,CAAC;IAC9E,CAAC;IACD,MAAM,IAAI,GAAG,IAAA,sBAAY,EAAC,WAAW,CAAC,CAAC;IACvC,MAAM,MAAM,GAAG,IAAA,sBAAY,EAAC,IAAA,gBAAI,EAAC,IAAI,EAAE,sCAA8B,CAAC,CAAC,CAAC;IACxE,IAAI,CAAC,aAAa,CAAC,IAAI,EAAE,MAAM,CAAC,EAAE,CAAC;QACjC,MAAM,IAAI,KAAK,CAAC,sDAAsD,CAAC,CAAC;IAC1E,CAAC;IACD,OAAO,MAAM,CAAC;AAChB,CAAC;AAED,SAAS,qBAAqB,CAC5B,WAA8B;IAE9B,MAAM,MAAM,GAAsB,EAAE,CAAC;IACrC,KAAK,MAAM,IAAI,IAAI;QACjB,SAAS;QACT,MAAM;QACN,cAAc;QACd,MAAM;QACN,SAAS;QACT,YAAY;QACZ,MAAM;QACN,KAAK;QACL,QAAQ;QACR,aAAa;KACL,EAAE,CAAC;QACX,IAAI,WAAW,CAAC,IAAI,CAAC;YAAE,MAAM,CAAC,IAAI,CAAC,GAAG,WAAW,CAAC,IAAI,CAAC,CAAC;IAC1D,CAAC;IACD,OAAO,MAAM,CAAC;AAChB,CAAC;AAED;;;;GAIG;AACI,KAAK,UAAU,4BAA4B,CAAC,KAGlD;IACC,IAAI,CAAC;QACH,MAAM,MAAM,GAAG,kCAAkC,CAAC,KAAK,CAAC,WAAW,CAAC,CAAC;QACrE,MAAM,MAAM,GAAG,MAAM,aAAa,CAChC,OAAO,CAAC,QAAQ,EAChB,CAAC,eAAe,EAAE,4BAA4B,EAAE,MAAM,EAAE,UAAU,CAAC,EACnE;YACE,GAAG,EAAE,KAAK,CAAC,WAAW;YACtB,QAAQ,EAAE,MAAM;YAChB,GAAG,EAAE,qBAAqB,CAAC,KAAK,CAAC,WAAW,IAAI,OAAO,CAAC,GAAG,CAAC;YAC5D,SAAS,EAAE,EAAE;YACb,OAAO,EAAE,MAAM;YACf,WAAW,EAAE,IAAI;SAClB,CACF,CAAC;QACF,OAAO,MAAM,CAAC,MAAM,KAAK,SAAS,IAAI,MAAM,CAAC,MAAM,KAAK,EAAE,CAAC;IAC7D,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,KAAK,CAAC;IACf,CAAC;AACH,CAAC"}

package/src/secrets/guardrails.d.ts

@@ -0,0 +1,26 @@
+export declare const SECRET_GUARDRAIL_CODES: readonly ["client-secret-runtime-import", "client-secret-runtime-transitive-import", "direct-secret-provider-client", "direct-sst-secret-value-read", "direct-sst-secret", "protected-secret-fallback", "protected-secret-placeholder", "secret-environment-access", "secret-generated-environment"];
+export type SecretGuardrailCode = (typeof SECRET_GUARDRAIL_CODES)[number];
+export type SecretStaticSurface = 'client' | 'generated-infrastructure' | 'server' | 'workflow';
+export interface SecretStaticFile {
+    allowFrameworkPersonalSstRemove?: boolean;
+    allowFrameworkSecretProviderClient?: boolean;
+    allowFrameworkPersonalSstSecret?: boolean;
+    declaredSecretNames?: readonly string[];
+    path: string;
+    source: string;
+    surface: SecretStaticSurface;
+}
+export interface SecretGuardrailIssue {
+    code: SecretGuardrailCode;
+    line: number;
+    logicalName?: string;
+    path: string;
+}
+export declare function inspectSecretStaticFile(file: SecretStaticFile): readonly SecretGuardrailIssue[];
+export declare function inspectSecretStaticFiles(files: readonly SecretStaticFile[]): readonly SecretGuardrailIssue[];
+/**
+ * Treats every explicitly classified client file as an entry point and follows
+ * its relative module graph. A server-classified helper cannot hide a secret
+ * resolver import from the client build guardrail.
+ */
+export declare function inspectClientSecretImportGraph(input: readonly SecretStaticFile[]): readonly SecretGuardrailIssue[];