@empire-builder-kit/nx 1.0.0-beta.9 → 1.0.0-rc.2

package/src/secrets/guardrails.js

@@ -0,0 +1,328 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.SECRET_GUARDRAIL_CODES = void 0;
+exports.inspectSecretStaticFile = inspectSecretStaticFile;
+exports.inspectSecretStaticFiles = inspectSecretStaticFiles;
+exports.inspectClientSecretImportGraph = inspectClientSecretImportGraph;
+const deterministic_order_js_1 = require("../deterministic-order.js");
+const node_path_1 = require("node:path");
+exports.SECRET_GUARDRAIL_CODES = [
+    'client-secret-runtime-import',
+    'client-secret-runtime-transitive-import',
+    'direct-secret-provider-client',
+    'direct-sst-secret-value-read',
+    'direct-sst-secret',
+    'protected-secret-fallback',
+    'protected-secret-placeholder',
+    'secret-environment-access',
+    'secret-generated-environment',
+];
+function maskComments(source) {
+    let result = '';
+    let state = 'normal';
+    let escaped = false;
+    for (let index = 0; index < source.length; index += 1) {
+        const character = source[index] ?? '';
+        const next = source[index + 1] ?? '';
+        if (state === 'line-comment') {
+            if (character === '\n') {
+                state = 'normal';
+                result += '\n';
+            }
+            else {
+                result += ' ';
+            }
+            continue;
+        }
+        if (state === 'block-comment') {
+            if (character === '*' && next === '/') {
+                result += '  ';
+                index += 1;
+                state = 'normal';
+            }
+            else {
+                result += character === '\n' ? '\n' : ' ';
+            }
+            continue;
+        }
+        if (state !== 'normal') {
+            result += character;
+            if (escaped) {
+                escaped = false;
+            }
+            else if (character === '\\') {
+                escaped = true;
+            }
+            else if ((state === 'single' && character === "'") ||
+                (state === 'double' && character === '"') ||
+                (state === 'template' && character === '`')) {
+                state = 'normal';
+            }
+            continue;
+        }
+        if (character === '/' && next === '/') {
+            result += '  ';
+            index += 1;
+            state = 'line-comment';
+        }
+        else if (character === '/' && next === '*') {
+            result += '  ';
+            index += 1;
+            state = 'block-comment';
+        }
+        else {
+            result += character;
+            if (character === "'") {
+                state = 'single';
+            }
+            else if (character === '"') {
+                state = 'double';
+            }
+            else if (character === '`') {
+                state = 'template';
+            }
+        }
+    }
+    return result;
+}
+function lineAt(source, index) {
+    let line = 1;
+    for (let offset = 0; offset < index; offset += 1) {
+        if (source[offset] === '\n') {
+            line += 1;
+        }
+    }
+    return line;
+}
+function escapePattern(value) {
+    return value.replace(/[.*+?^${}()|[\]\\]/g, '\\$&');
+}
+function environmentNames(logicalName) {
+    const upperSnake = logicalName
+        .replace(/([a-z0-9])([A-Z])/g, '$1_$2')
+        .replace(/[^A-Za-z0-9]+/g, '_')
+        .toUpperCase();
+    return [...new Set([logicalName, upperSnake, `EBK_${upperSnake}`])];
+}
+function firstMatch(source, patterns) {
+    let earliest = -1;
+    for (const pattern of patterns) {
+        const match = pattern.exec(source);
+        if (match !== null && (earliest === -1 || match.index < earliest)) {
+            earliest = match.index;
+        }
+    }
+    return earliest;
+}
+function addIssue(issues, file, source, code, index, logicalName) {
+    if (index < 0) {
+        return;
+    }
+    issues.push({
+        code,
+        line: lineAt(source, index),
+        ...(logicalName === undefined ? {} : { logicalName }),
+        path: file.path,
+    });
+}
+function clientRuntimeImportIndex(source) {
+    return firstMatch(source, [
+        /(?:from\s*|import\s*\(\s*|require\s*\(\s*)['"]@empire-builder-kit\/runtime\/secrets(?:\/[^'"]*)?['"]/m,
+        /import\s*\{[^}]*\bSecret\b[^}]*\}\s*from\s*['"]@empire-builder-kit\/runtime['"]/m,
+        /import\s+\*\s+as\s+\w+\s+from\s*['"]@empire-builder-kit\/runtime['"][\s\S]{0,2000}\b\w+\.Secret\b/m,
+        /(?:from\s*|import\s*\(\s*|require\s*\(\s*)['"][^'"]*(?:^|\/)secrets\/runtime(?:\.[cm]?[jt]s)?['"]/m,
+    ]);
+}
+function directSstSecretIndex(source, allowFrameworkPersonalSstRemove) {
+    const commandPattern = allowFrameworkPersonalSstRemove
+        ? '(?:list|load|set)'
+        : '(?:list|load|remove|set)';
+    return firstMatch(source, [
+        /\b(?:new\s+)?sst(?:\.aws)?\.Secret\s*\(/m,
+        /\b(?:new\s+)?sst(?:\.aws)?\s*\[\s*['"]Secret['"]\s*\]\s*\(/m,
+        /import\s*\{[^}]*\bSecret(?:\s+as\s+\w+)?\b[^}]*\}\s*from\s*['"]sst['"]/m,
+        /\brequire\s*\(\s*['"]sst['"]\s*\)\.Secret\b/m,
+        /\brequire\s*\(\s*['"]sst['"]\s*\)\s*\[\s*['"]Secret['"]\s*\]/m,
+        /\b(?:const|let|var)\s*\{[^}]*\bSecret\b[^}]*\}\s*=\s*sst(?:\.aws)?\b/m,
+        new RegExp(`\\bsst\\s+secret\\s+${commandPattern}\\b`, 'm'),
+        new RegExp(`['"]secret['"]\\s*,\\s*['"]${commandPattern}['"]`, 'm'),
+    ]);
+}
+function directSecretProviderClientIndex(source) {
+    return firstMatch(source, [
+        /\bGetSecretValueCommand\b/m,
+        /\b[A-Za-z_$][\w$]*\.getSecretValue\s*\(/m,
+        /\baws\s+secretsmanager\s+get-secret-value\b/m,
+        /['"]secretsmanager['"]\s*,\s*['"]get-secret-value['"]/m,
+    ]);
+}
+function protectedFallbackIndex(source) {
+    return firstMatch(source, [
+        /\bsst\s+secret\b[^\n]*\s--fallback(?:\s|=|$)/m,
+        /\b(?:new\s+)?sst(?:\.aws)?\.Secret\s*\([^,\n()]+,\s*[^)\s]/m,
+        /\b(?:new\s+)?sst(?:\.aws)?\.Secret\s*\([^)]{0,500}\bfallback\s*:/m,
+        /\b(?:new\s+)?sst(?:\.aws)?\s*\[\s*['"]Secret['"]\s*\]\s*\([^,\n()]+,\s*[^)\s]/m,
+    ]);
+}
+function protectedPlaceholderIndex(source) {
+    return firstMatch(source, [
+        /\bdefineSecrets\s*\(\s*\{[\s\S]{0,5000}\bvalue\s*:\s*['"`]/m,
+        /\b(?:secret|credential|token|password)\w*\s*:\s*['"](?:change-me|placeholder|replace-me|todo)['"]/im,
+    ]);
+}
+function environmentAccessIndex(source, environmentName) {
+    const escaped = escapePattern(environmentName);
+    return firstMatch(source, [
+        new RegExp(`\\bprocess\\.env\\.${escaped}\\b`, 'm'),
+        new RegExp(`\\bprocess\\.env\\s*\\[\\s*['"]${escaped}['"]\\s*\\]`, 'm'),
+        new RegExp(`\\b(?:const|let|var)\\s*\\{[^}]*\\b${escaped}\\b[^}]*\\}\\s*=\\s*process\\.env\\b`, 'm'),
+        new RegExp(`\\b(?:const|let|var)\\s+([A-Za-z_$][\\w$]*)\\s*=\\s*process\\.env\\b[\\s\\S]{0,5000}?\\b\\1(?:\\.|\\?\\.)${escaped}\\b|\\b(?:const|let|var)\\s+([A-Za-z_$][\\w$]*)\\s*=\\s*process\\.env\\b[\\s\\S]{0,5000}?\\b\\2\\s*\\[\\s*['"]${escaped}['"]\\s*\\]`, 'm'),
+        new RegExp(`\\bBun\\.env\\.${escaped}\\b`, 'm'),
+        new RegExp(`\\bDeno\\.env\\.get\\s*\\(\\s*['"]${escaped}['"]\\s*\\)`, 'm'),
+        new RegExp(`(?:^|\\n)\\s*(?:export\\s+)?${escaped}\\s*=\\s*[^\\s#]+`, 'm'),
+    ]);
+}
+function generatedEnvironmentIndex(source, environmentName) {
+    const escaped = escapePattern(environmentName);
+    return firstMatch(source, [
+        new RegExp(`(?:\\benvironment\\b|['"]environment['"])\\s*:\\s*\\{[\\s\\S]{0,5000}?(?:\\b${escaped}\\b|['"]${escaped}['"])\\s*:`, 'm'),
+        new RegExp(`\\benvironment\\s*=\\s*\\{[\\s\\S]{0,5000}?(?:\\b${escaped}\\b|['"]${escaped}['"])\\s*:`, 'm'),
+        new RegExp(`(?:\\benvironment\\b|['"]environment['"])\\s*:\\s*\\[[\\s\\S]{0,5000}?(?:\\bname\\b|['"]name['"])\\s*:\\s*['"]${escaped}['"]`, 'm'),
+    ]);
+}
+function directSstSecretValueIndex(source, logicalName) {
+    const escaped = escapePattern(logicalName);
+    return firstMatch(source, [
+        new RegExp(`\\bResource(?:\\.|\\?\\.)${escaped}(?:\\.|\\?\\.)value\\b`, 'm'),
+        new RegExp(`\\bResource(?:\\.|\\?\\.)${escaped}\\s*\\[\\s*['"]value['"]\\s*\\]`, 'm'),
+        new RegExp(`\\bResource\\s*\\[\\s*['"]${escaped}['"]\\s*\\](?:\\?\\.)?\\s*(?:\\.value|\\[\\s*['"]value['"]\\s*\\])`, 'm'),
+        new RegExp(`\\b(?:const|let|var)\\s*\\{[^}]*\\bvalue\\b[^}]*\\}\\s*=\\s*Resource(?:\\.${escaped}|\\s*\\[\\s*['"]${escaped}['"]\\s*\\])`, 'm'),
+        new RegExp(`\\b(?:const|let|var)\\s+([A-Za-z_$][\\w$]*)\\s*=\\s*Resource(?:\\.${escaped}|\\s*\\[\\s*['"]${escaped}['"]\\s*\\])\\s*;?[\\s\\S]{0,5000}?\\b\\1(?:(?:\\.|\\?\\.)value\\b|\\s*\\[\\s*['"]value['"]\\s*\\])`, 'm'),
+        new RegExp(`\\b(?:const|let|var)\\s+([A-Za-z_$][\\w$]*)\\s*=\\s*Resource\\s*;?[\\s\\S]{0,5000}?\\b\\1(?:\\.|\\?\\.)${escaped}(?:(?:\\.|\\?\\.)value\\b|\\s*\\[\\s*['"]value['"]\\s*\\])`, 'm'),
+    ]);
+}
+function inspectSecretStaticFile(file) {
+    const source = maskComments(file.source);
+    const issues = [];
+    if (file.surface === 'client') {
+        addIssue(issues, file, source, 'client-secret-runtime-import', clientRuntimeImportIndex(source));
+    }
+    if (file.allowFrameworkPersonalSstSecret !== true) {
+        addIssue(issues, file, source, 'direct-sst-secret', directSstSecretIndex(source, file.allowFrameworkPersonalSstRemove === true));
+    }
+    if (file.allowFrameworkSecretProviderClient !== true) {
+        addIssue(issues, file, source, 'direct-secret-provider-client', directSecretProviderClientIndex(source));
+    }
+    addIssue(issues, file, source, 'protected-secret-fallback', protectedFallbackIndex(source));
+    addIssue(issues, file, source, 'protected-secret-placeholder', protectedPlaceholderIndex(source));
+    for (const logicalName of file.declaredSecretNames ?? []) {
+        addIssue(issues, file, source, 'direct-sst-secret-value-read', directSstSecretValueIndex(source, logicalName), logicalName);
+        for (const name of environmentNames(logicalName)) {
+            addIssue(issues, file, source, 'secret-environment-access', environmentAccessIndex(source, name), logicalName);
+            if (file.surface === 'generated-infrastructure') {
+                addIssue(issues, file, source, 'secret-generated-environment', generatedEnvironmentIndex(source, name), logicalName);
+            }
+        }
+    }
+    const unique = new Map();
+    for (const issue of issues) {
+        const key = `${issue.code}\0${issue.logicalName ?? ''}\0${issue.line}`;
+        if (!unique.has(key)) {
+            unique.set(key, issue);
+        }
+    }
+    return Object.freeze([...unique.values()].sort((left, right) => left.line - right.line ||
+        (0, deterministic_order_js_1.compareUtf16)(left.code, right.code) ||
+        (0, deterministic_order_js_1.compareUtf16)(left.logicalName ?? '', right.logicalName ?? '')));
+}
+function inspectSecretStaticFiles(files) {
+    return Object.freeze(files
+        .flatMap((file) => inspectSecretStaticFile(file))
+        .sort((left, right) => (0, deterministic_order_js_1.compareUtf16)(left.path, right.path) ||
+        left.line - right.line ||
+        (0, deterministic_order_js_1.compareUtf16)(left.code, right.code)));
+}
+const moduleSourceExtensions = [
+    '.ts',
+    '.tsx',
+    '.mts',
+    '.cts',
+    '.js',
+    '.jsx',
+    '.mjs',
+    '.cjs',
+];
+function relativeModuleSpecifiers(source) {
+    const masked = maskComments(source);
+    const specifiers = new Set();
+    const patterns = [
+        /(?:import|export)\s+(?:[\s\S]*?\s+from\s+)?['"](\.[^'"]+)['"]/g,
+        /import\s*\(\s*['"](\.[^'"]+)['"]\s*\)/g,
+        /require\s*\(\s*['"](\.[^'"]+)['"]\s*\)/g,
+    ];
+    for (const pattern of patterns) {
+        for (const match of masked.matchAll(pattern)) {
+            const specifier = match[1];
+            if (specifier)
+                specifiers.add(specifier);
+        }
+    }
+    return [...specifiers].sort();
+}
+function resolveRelativeModule(importer, specifier, files) {
+    const unresolved = node_path_1.posix.normalize(node_path_1.posix.join(node_path_1.posix.dirname(importer), specifier));
+    const extension = node_path_1.posix.extname(unresolved);
+    const bases = moduleSourceExtensions.includes(extension)
+        ? [unresolved, unresolved.slice(0, -extension.length)]
+        : [unresolved];
+    const candidates = [
+        ...bases,
+        ...bases.flatMap((base) => moduleSourceExtensions.map((candidateExtension) => `${base}${candidateExtension}`)),
+        ...bases.flatMap((base) => moduleSourceExtensions.map((candidateExtension) => node_path_1.posix.join(base, `index${candidateExtension}`))),
+    ];
+    return candidates.find((candidate) => files.has(candidate));
+}
+/**
+ * Treats every explicitly classified client file as an entry point and follows
+ * its relative module graph. A server-classified helper cannot hide a secret
+ * resolver import from the client build guardrail.
+ */
+function inspectClientSecretImportGraph(input) {
+    const files = new Map(input.map((file) => [file.path, file]));
+    const reached = new Set();
+    const pending = input
+        .filter(({ surface }) => surface === 'client')
+        .map(({ path }) => path)
+        .sort();
+    while (pending.length > 0) {
+        const path = pending.shift();
+        if (reached.has(path))
+            continue;
+        reached.add(path);
+        const file = files.get(path);
+        if (!file)
+            continue;
+        for (const specifier of relativeModuleSpecifiers(file.source)) {
+            const resolved = resolveRelativeModule(path, specifier, files);
+            if (resolved && !reached.has(resolved))
+                pending.push(resolved);
+        }
+    }
+    return Object.freeze([...reached].sort().flatMap((path) => {
+        const file = files.get(path);
+        if (!file || file.surface === 'client')
+            return [];
+        const source = maskComments(file.source);
+        const index = clientRuntimeImportIndex(source);
+        return index < 0
+            ? []
+            : [
+                {
+                    code: 'client-secret-runtime-transitive-import',
+                    line: lineAt(source, index),
+                    path: file.path,
+                },
+            ];
+    }));
+}
+//# sourceMappingURL=guardrails.js.map

package/src/secrets/guardrails.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"guardrails.js","sourceRoot":"","sources":["../../../../../packages/nx/src/secrets/guardrails.ts"],"names":[],"mappings":";;;AAmSA,0DAiGC;AAED,4DAaC;AAiED,wEAsCC;AA1fD,sEAAyD;AACzD,yCAAkC;AAErB,QAAA,sBAAsB,GAAG;IACpC,8BAA8B;IAC9B,yCAAyC;IACzC,+BAA+B;IAC/B,8BAA8B;IAC9B,mBAAmB;IACnB,2BAA2B;IAC3B,8BAA8B;IAC9B,2BAA2B;IAC3B,8BAA8B;CACtB,CAAC;AAwBX,SAAS,YAAY,CAAC,MAAc;IAClC,IAAI,MAAM,GAAG,EAAE,CAAC;IAChB,IAAI,KAAK,GAMQ,QAAQ,CAAC;IAC1B,IAAI,OAAO,GAAG,KAAK,CAAC;IAEpB,KAAK,IAAI,KAAK,GAAG,CAAC,EAAE,KAAK,GAAG,MAAM,CAAC,MAAM,EAAE,KAAK,IAAI,CAAC,EAAE,CAAC;QACtD,MAAM,SAAS,GAAG,MAAM,CAAC,KAAK,CAAC,IAAI,EAAE,CAAC;QACtC,MAAM,IAAI,GAAG,MAAM,CAAC,KAAK,GAAG,CAAC,CAAC,IAAI,EAAE,CAAC;QAErC,IAAI,KAAK,KAAK,cAAc,EAAE,CAAC;YAC7B,IAAI,SAAS,KAAK,IAAI,EAAE,CAAC;gBACvB,KAAK,GAAG,QAAQ,CAAC;gBACjB,MAAM,IAAI,IAAI,CAAC;YACjB,CAAC;iBAAM,CAAC;gBACN,MAAM,IAAI,GAAG,CAAC;YAChB,CAAC;YACD,SAAS;QACX,CAAC;QACD,IAAI,KAAK,KAAK,eAAe,EAAE,CAAC;YAC9B,IAAI,SAAS,KAAK,GAAG,IAAI,IAAI,KAAK,GAAG,EAAE,CAAC;gBACtC,MAAM,IAAI,IAAI,CAAC;gBACf,KAAK,IAAI,CAAC,CAAC;gBACX,KAAK,GAAG,QAAQ,CAAC;YACnB,CAAC;iBAAM,CAAC;gBACN,MAAM,IAAI,SAAS,KAAK,IAAI,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,GAAG,CAAC;YAC5C,CAAC;YACD,SAAS;QACX,CAAC;QACD,IAAI,KAAK,KAAK,QAAQ,EAAE,CAAC;YACvB,MAAM,IAAI,SAAS,CAAC;YACpB,IAAI,OAAO,EAAE,CAAC;gBACZ,OAAO,GAAG,KAAK,CAAC;YAClB,CAAC;iBAAM,IAAI,SAAS,KAAK,IAAI,EAAE,CAAC;gBAC9B,OAAO,GAAG,IAAI,CAAC;YACjB,CAAC;iBAAM,IACL,CAAC,KAAK,KAAK,QAAQ,IAAI,SAAS,KAAK,GAAG,CAAC;gBACzC,CAAC,KAAK,KAAK,QAAQ,IAAI,SAAS,KAAK,GAAG,CAAC;gBACzC,CAAC,KAAK,KAAK,UAAU,IAAI,SAAS,KAAK,GAAG,CAAC,EAC3C,CAAC;gBACD,KAAK,GAAG,QAAQ,CAAC;YACnB,CAAC;YACD,SAAS;QACX,CAAC;QAED,IAAI,SAAS,KAAK,GAAG,IAAI,IAAI,KAAK,GAAG,EAAE,CAAC;YACtC,MAAM,IAAI,IAAI,CAAC;YACf,KAAK,IAAI,CAAC,CAAC;YACX,KAAK,GAAG,cAAc,CAAC;QACzB,CAAC;aAAM,IAAI,SAAS,KAAK,GAAG,IAAI,IAAI,KAAK,GAAG,EAAE,CAAC;YAC7C,MAAM,IAAI,IAAI,CAAC;YACf,KAAK,IAAI,CAAC,CAAC;YACX,KAAK,GAAG,eAAe,CAAC;QAC1B,CAAC;aAAM,CAAC;YACN,MAAM,IAAI,SAAS,CAAC;YACpB,IAAI,SAAS,KAAK,GAAG,EAAE,CAAC;gBACtB,KAAK,GAAG,QAAQ,CAAC;YACnB,CAAC;iBAAM,IAAI,SAAS,KAAK,GAAG,EAAE,CAAC;gBAC7B,KAAK,GAAG,QAAQ,CAAC;YACnB,CAAC;iBAAM,IAAI,SAAS,KAAK,GAAG,EAAE,CAAC;gBAC7B,KAAK,GAAG,UAAU,CAAC;YACrB,CAAC;QACH,CAAC;IACH,CAAC;IAED,OAAO,MAAM,CAAC;AAChB,CAAC;AAED,SAAS,MAAM,CAAC,MAAc,EAAE,KAAa;IAC3C,IAAI,IAAI,GAAG,CAAC,CAAC;IACb,KAAK,IAAI,MAAM,GAAG,CAAC,EAAE,MAAM,GAAG,KAAK,EAAE,MAAM,IAAI,CAAC,EAAE,CAAC;QACjD,IAAI,MAAM,CAAC,MAAM,CAAC,KAAK,IAAI,EAAE,CAAC;YAC5B,IAAI,IAAI,CAAC,CAAC;QACZ,CAAC;IACH,CAAC;IACD,OAAO,IAAI,CAAC;AACd,CAAC;AAED,SAAS,aAAa,CAAC,KAAa;IAClC,OAAO,KAAK,CAAC,OAAO,CAAC,qBAAqB,EAAE,MAAM,CAAC,CAAC;AACtD,CAAC;AAED,SAAS,gBAAgB,CAAC,WAAmB;IAC3C,MAAM,UAAU,GAAG,WAAW;SAC3B,OAAO,CAAC,oBAAoB,EAAE,OAAO,CAAC;SACtC,OAAO,CAAC,gBAAgB,EAAE,GAAG,CAAC;SAC9B,WAAW,EAAE,CAAC;IACjB,OAAO,CAAC,GAAG,IAAI,GAAG,CAAC,CAAC,WAAW,EAAE,UAAU,EAAE,OAAO,UAAU,EAAE,CAAC,CAAC,CAAC,CAAC;AACtE,CAAC;AAED,SAAS,UAAU,CAAC,MAAc,EAAE,QAA2B;IAC7D,IAAI,QAAQ,GAAG,CAAC,CAAC,CAAC;IAClB,KAAK,MAAM,OAAO,IAAI,QAAQ,EAAE,CAAC;QAC/B,MAAM,KAAK,GAAG,OAAO,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC;QACnC,IAAI,KAAK,KAAK,IAAI,IAAI,CAAC,QAAQ,KAAK,CAAC,CAAC,IAAI,KAAK,CAAC,KAAK,GAAG,QAAQ,CAAC,EAAE,CAAC;YAClE,QAAQ,GAAG,KAAK,CAAC,KAAK,CAAC;QACzB,CAAC;IACH,CAAC;IACD,OAAO,QAAQ,CAAC;AAClB,CAAC;AAED,SAAS,QAAQ,CACf,MAA8B,EAC9B,IAAsB,EACtB,MAAc,EACd,IAAyB,EACzB,KAAa,EACb,WAAoB;IAEpB,IAAI,KAAK,GAAG,CAAC,EAAE,CAAC;QACd,OAAO;IACT,CAAC;IACD,MAAM,CAAC,IAAI,CAAC;QACV,IAAI;QACJ,IAAI,EAAE,MAAM,CAAC,MAAM,EAAE,KAAK,CAAC;QAC3B,GAAG,CAAC,WAAW,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,WAAW,EAAE,CAAC;QACrD,IAAI,EAAE,IAAI,CAAC,IAAI;KAChB,CAAC,CAAC;AACL,CAAC;AAED,SAAS,wBAAwB,CAAC,MAAc;IAC9C,OAAO,UAAU,CAAC,MAAM,EAAE;QACxB,uGAAuG;QACvG,kFAAkF;QAClF,oGAAoG;QACpG,oGAAoG;KACrG,CAAC,CAAC;AACL,CAAC;AAED,SAAS,oBAAoB,CAC3B,MAAc,EACd,+BAAwC;IAExC,MAAM,cAAc,GAAG,+BAA+B;QACpD,CAAC,CAAC,mBAAmB;QACrB,CAAC,CAAC,0BAA0B,CAAC;IAC/B,OAAO,UAAU,CAAC,MAAM,EAAE;QACxB,0CAA0C;QAC1C,6DAA6D;QAC7D,yEAAyE;QACzE,8CAA8C;QAC9C,+DAA+D;QAC/D,uEAAuE;QACvE,IAAI,MAAM,CAAC,uBAAuB,cAAc,KAAK,EAAE,GAAG,CAAC;QAC3D,IAAI,MAAM,CAAC,8BAA8B,cAAc,MAAM,EAAE,GAAG,CAAC;KACpE,CAAC,CAAC;AACL,CAAC;AAED,SAAS,+BAA+B,CAAC,MAAc;IACrD,OAAO,UAAU,CAAC,MAAM,EAAE;QACxB,4BAA4B;QAC5B,0CAA0C;QAC1C,8CAA8C;QAC9C,wDAAwD;KACzD,CAAC,CAAC;AACL,CAAC;AAED,SAAS,sBAAsB,CAAC,MAAc;IAC5C,OAAO,UAAU,CAAC,MAAM,EAAE;QACxB,+CAA+C;QAC/C,6DAA6D;QAC7D,mEAAmE;QACnE,gFAAgF;KACjF,CAAC,CAAC;AACL,CAAC;AAED,SAAS,yBAAyB,CAAC,MAAc;IAC/C,OAAO,UAAU,CAAC,MAAM,EAAE;QACxB,6DAA6D;QAC7D,qGAAqG;KACtG,CAAC,CAAC;AACL,CAAC;AAED,SAAS,sBAAsB,CAC7B,MAAc,EACd,eAAuB;IAEvB,MAAM,OAAO,GAAG,aAAa,CAAC,eAAe,CAAC,CAAC;IAC/C,OAAO,UAAU,CAAC,MAAM,EAAE;QACxB,IAAI,MAAM,CAAC,sBAAsB,OAAO,KAAK,EAAE,GAAG,CAAC;QACnD,IAAI,MAAM,CAAC,kCAAkC,OAAO,aAAa,EAAE,GAAG,CAAC;QACvE,IAAI,MAAM,CACR,sCAAsC,OAAO,sCAAsC,EACnF,GAAG,CACJ;QACD,IAAI,MAAM,CACR,4GAA4G,OAAO,iHAAiH,OAAO,aAAa,EACxP,GAAG,CACJ;QACD,IAAI,MAAM,CAAC,kBAAkB,OAAO,KAAK,EAAE,GAAG,CAAC;QAC/C,IAAI,MAAM,CAAC,qCAAqC,OAAO,aAAa,EAAE,GAAG,CAAC;QAC1E,IAAI,MAAM,CAAC,+BAA+B,OAAO,mBAAmB,EAAE,GAAG,CAAC;KAC3E,CAAC,CAAC;AACL,CAAC;AAED,SAAS,yBAAyB,CAChC,MAAc,EACd,eAAuB;IAEvB,MAAM,OAAO,GAAG,aAAa,CAAC,eAAe,CAAC,CAAC;IAC/C,OAAO,UAAU,CAAC,MAAM,EAAE;QACxB,IAAI,MAAM,CACR,+EAA+E,OAAO,WAAW,OAAO,YAAY,EACpH,GAAG,CACJ;QACD,IAAI,MAAM,CACR,oDAAoD,OAAO,WAAW,OAAO,YAAY,EACzF,GAAG,CACJ;QACD,IAAI,MAAM,CACR,iHAAiH,OAAO,MAAM,EAC9H,GAAG,CACJ;KACF,CAAC,CAAC;AACL,CAAC;AAED,SAAS,yBAAyB,CAChC,MAAc,EACd,WAAmB;IAEnB,MAAM,OAAO,GAAG,aAAa,CAAC,WAAW,CAAC,CAAC;IAC3C,OAAO,UAAU,CAAC,MAAM,EAAE;QACxB,IAAI,MAAM,CACR,4BAA4B,OAAO,wBAAwB,EAC3D,GAAG,CACJ;QACD,IAAI,MAAM,CACR,4BAA4B,OAAO,iCAAiC,EACpE,GAAG,CACJ;QACD,IAAI,MAAM,CACR,6BAA6B,OAAO,oEAAoE,EACxG,GAAG,CACJ;QACD,IAAI,MAAM,CACR,6EAA6E,OAAO,mBAAmB,OAAO,cAAc,EAC5H,GAAG,CACJ;QACD,IAAI,MAAM,CACR,qEAAqE,OAAO,mBAAmB,OAAO,qGAAqG,EAC3M,GAAG,CACJ;QACD,IAAI,MAAM,CACR,0GAA0G,OAAO,4DAA4D,EAC7K,GAAG,CACJ;KACF,CAAC,CAAC;AACL,CAAC;AAED,SAAgB,uBAAuB,CACrC,IAAsB;IAEtB,MAAM,MAAM,GAAG,YAAY,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC;IACzC,MAAM,MAAM,GAA2B,EAAE,CAAC;IAE1C,IAAI,IAAI,CAAC,OAAO,KAAK,QAAQ,EAAE,CAAC;QAC9B,QAAQ,CACN,MAAM,EACN,IAAI,EACJ,MAAM,EACN,8BAA8B,EAC9B,wBAAwB,CAAC,MAAM,CAAC,CACjC,CAAC;IACJ,CAAC;IACD,IAAI,IAAI,CAAC,+BAA+B,KAAK,IAAI,EAAE,CAAC;QAClD,QAAQ,CACN,MAAM,EACN,IAAI,EACJ,MAAM,EACN,mBAAmB,EACnB,oBAAoB,CAClB,MAAM,EACN,IAAI,CAAC,+BAA+B,KAAK,IAAI,CAC9C,CACF,CAAC;IACJ,CAAC;IACD,IAAI,IAAI,CAAC,kCAAkC,KAAK,IAAI,EAAE,CAAC;QACrD,QAAQ,CACN,MAAM,EACN,IAAI,EACJ,MAAM,EACN,+BAA+B,EAC/B,+BAA+B,CAAC,MAAM,CAAC,CACxC,CAAC;IACJ,CAAC;IACD,QAAQ,CACN,MAAM,EACN,IAAI,EACJ,MAAM,EACN,2BAA2B,EAC3B,sBAAsB,CAAC,MAAM,CAAC,CAC/B,CAAC;IACF,QAAQ,CACN,MAAM,EACN,IAAI,EACJ,MAAM,EACN,8BAA8B,EAC9B,yBAAyB,CAAC,MAAM,CAAC,CAClC,CAAC;IAEF,KAAK,MAAM,WAAW,IAAI,IAAI,CAAC,mBAAmB,IAAI,EAAE,EAAE,CAAC;QACzD,QAAQ,CACN,MAAM,EACN,IAAI,EACJ,MAAM,EACN,8BAA8B,EAC9B,yBAAyB,CAAC,MAAM,EAAE,WAAW,CAAC,EAC9C,WAAW,CACZ,CAAC;QACF,KAAK,MAAM,IAAI,IAAI,gBAAgB,CAAC,WAAW,CAAC,EAAE,CAAC;YACjD,QAAQ,CACN,MAAM,EACN,IAAI,EACJ,MAAM,EACN,2BAA2B,EAC3B,sBAAsB,CAAC,MAAM,EAAE,IAAI,CAAC,EACpC,WAAW,CACZ,CAAC;YACF,IAAI,IAAI,CAAC,OAAO,KAAK,0BAA0B,EAAE,CAAC;gBAChD,QAAQ,CACN,MAAM,EACN,IAAI,EACJ,MAAM,EACN,8BAA8B,EAC9B,yBAAyB,CAAC,MAAM,EAAE,IAAI,CAAC,EACvC,WAAW,CACZ,CAAC;YACJ,CAAC;QACH,CAAC;IACH,CAAC;IAED,MAAM,MAAM,GAAG,IAAI,GAAG,EAAgC,CAAC;IACvD,KAAK,MAAM,KAAK,IAAI,MAAM,EAAE,CAAC;QAC3B,MAAM,GAAG,GAAG,GAAG,KAAK,CAAC,IAAI,KAAK,KAAK,CAAC,WAAW,IAAI,EAAE,KAAK,KAAK,CAAC,IAAI,EAAE,CAAC;QACvE,IAAI,CAAC,MAAM,CAAC,GAAG,CAAC,GAAG,CAAC,EAAE,CAAC;YACrB,MAAM,CAAC,GAAG,CAAC,GAAG,EAAE,KAAK,CAAC,CAAC;QACzB,CAAC;IACH,CAAC;IACD,OAAO,MAAM,CAAC,MAAM,CAClB,CAAC,GAAG,MAAM,CAAC,MAAM,EAAE,CAAC,CAAC,IAAI,CACvB,CAAC,IAAI,EAAE,KAAK,EAAE,EAAE,CACd,IAAI,CAAC,IAAI,GAAG,KAAK,CAAC,IAAI;QACtB,IAAA,qCAAY,EAAC,IAAI,CAAC,IAAI,EAAE,KAAK,CAAC,IAAI,CAAC;QACnC,IAAA,qCAAY,EAAC,IAAI,CAAC,WAAW,IAAI,EAAE,EAAE,KAAK,CAAC,WAAW,IAAI,EAAE,CAAC,CAChE,CACF,CAAC;AACJ,CAAC;AAED,SAAgB,wBAAwB,CACtC,KAAkC;IAElC,OAAO,MAAM,CAAC,MAAM,CAClB,KAAK;SACF,OAAO,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,uBAAuB,CAAC,IAAI,CAAC,CAAC;SAChD,IAAI,CACH,CAAC,IAAI,EAAE,KAAK,EAAE,EAAE,CACd,IAAA,qCAAY,EAAC,IAAI,CAAC,IAAI,EAAE,KAAK,CAAC,IAAI,CAAC;QACnC,IAAI,CAAC,IAAI,GAAG,KAAK,CAAC,IAAI;QACtB,IAAA,qCAAY,EAAC,IAAI,CAAC,IAAI,EAAE,KAAK,CAAC,IAAI,CAAC,CACtC,CACJ,CAAC;AACJ,CAAC;AAED,MAAM,sBAAsB,GAAG;IAC7B,KAAK;IACL,MAAM;IACN,MAAM;IACN,MAAM;IACN,KAAK;IACL,MAAM;IACN,MAAM;IACN,MAAM;CACE,CAAC;AAEX,SAAS,wBAAwB,CAAC,MAAc;IAC9C,MAAM,MAAM,GAAG,YAAY,CAAC,MAAM,CAAC,CAAC;IACpC,MAAM,UAAU,GAAG,IAAI,GAAG,EAAU,CAAC;IACrC,MAAM,QAAQ,GAAG;QACf,gEAAgE;QAChE,wCAAwC;QACxC,yCAAyC;KAC1C,CAAC;IACF,KAAK,MAAM,OAAO,IAAI,QAAQ,EAAE,CAAC;QAC/B,KAAK,MAAM,KAAK,IAAI,MAAM,CAAC,QAAQ,CAAC,OAAO,CAAC,EAAE,CAAC;YAC7C,MAAM,SAAS,GAAG,KAAK,CAAC,CAAC,CAAC,CAAC;YAC3B,IAAI,SAAS;gBAAE,UAAU,CAAC,GAAG,CAAC,SAAS,CAAC,CAAC;QAC3C,CAAC;IACH,CAAC;IACD,OAAO,CAAC,GAAG,UAAU,CAAC,CAAC,IAAI,EAAE,CAAC;AAChC,CAAC;AAED,SAAS,qBAAqB,CAC5B,QAAgB,EAChB,SAAiB,EACjB,KAA4C;IAE5C,MAAM,UAAU,GAAG,iBAAK,CAAC,SAAS,CAChC,iBAAK,CAAC,IAAI,CAAC,iBAAK,CAAC,OAAO,CAAC,QAAQ,CAAC,EAAE,SAAS,CAAC,CAC/C,CAAC;IACF,MAAM,SAAS,GAAG,iBAAK,CAAC,OAAO,CAAC,UAAU,CAAC,CAAC;IAC5C,MAAM,KAAK,GAAG,sBAAsB,CAAC,QAAQ,CAC3C,SAAoD,CACrD;QACC,CAAC,CAAC,CAAC,UAAU,EAAE,UAAU,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC,SAAS,CAAC,MAAM,CAAC,CAAC;QACtD,CAAC,CAAC,CAAC,UAAU,CAAC,CAAC;IACjB,MAAM,UAAU,GAAG;QACjB,GAAG,KAAK;QACR,GAAG,KAAK,CAAC,OAAO,CAAC,CAAC,IAAI,EAAE,EAAE,CACxB,sBAAsB,CAAC,GAAG,CACxB,CAAC,kBAAkB,EAAE,EAAE,CAAC,GAAG,IAAI,GAAG,kBAAkB,EAAE,CACvD,CACF;QACD,GAAG,KAAK,CAAC,OAAO,CAAC,CAAC,IAAI,EAAE,EAAE,CACxB,sBAAsB,CAAC,GAAG,CAAC,CAAC,kBAAkB,EAAE,EAAE,CAChD,iBAAK,CAAC,IAAI,CAAC,IAAI,EAAE,QAAQ,kBAAkB,EAAE,CAAC,CAC/C,CACF;KACF,CAAC;IACF,OAAO,UAAU,CAAC,IAAI,CAAC,CAAC,SAAS,EAAE,EAAE,CAAC,KAAK,CAAC,GAAG,CAAC,SAAS,CAAC,CAAC,CAAC;AAC9D,CAAC;AAED;;;;GAIG;AACH,SAAgB,8BAA8B,CAC5C,KAAkC;IAElC,MAAM,KAAK,GAAG,IAAI,GAAG,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,CAAC,IAAI,CAAC,IAAI,EAAE,IAAI,CAAC,CAAC,CAAC,CAAC;IAC9D,MAAM,OAAO,GAAG,IAAI,GAAG,EAAU,CAAC;IAClC,MAAM,OAAO,GAAG,KAAK;SAClB,MAAM,CAAC,CAAC,EAAE,OAAO,EAAE,EAAE,EAAE,CAAC,OAAO,KAAK,QAAQ,CAAC;SAC7C,GAAG,CAAC,CAAC,EAAE,IAAI,EAAE,EAAE,EAAE,CAAC,IAAI,CAAC;SACvB,IAAI,EAAE,CAAC;IACV,OAAO,OAAO,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;QAC1B,MAAM,IAAI,GAAG,OAAO,CAAC,KAAK,EAAY,CAAC;QACvC,IAAI,OAAO,CAAC,GAAG,CAAC,IAAI,CAAC;YAAE,SAAS;QAChC,OAAO,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC;QAClB,MAAM,IAAI,GAAG,KAAK,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC;QAC7B,IAAI,CAAC,IAAI;YAAE,SAAS;QACpB,KAAK,MAAM,SAAS,IAAI,wBAAwB,CAAC,IAAI,CAAC,MAAM,CAAC,EAAE,CAAC;YAC9D,MAAM,QAAQ,GAAG,qBAAqB,CAAC,IAAI,EAAE,SAAS,EAAE,KAAK,CAAC,CAAC;YAC/D,IAAI,QAAQ,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,QAAQ,CAAC;gBAAE,OAAO,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC;QACjE,CAAC;IACH,CAAC;IAED,OAAO,MAAM,CAAC,MAAM,CAClB,CAAC,GAAG,OAAO,CAAC,CAAC,IAAI,EAAE,CAAC,OAAO,CAAC,CAAC,IAAI,EAAE,EAAE;QACnC,MAAM,IAAI,GAAG,KAAK,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC;QAC7B,IAAI,CAAC,IAAI,IAAI,IAAI,CAAC,OAAO,KAAK,QAAQ;YAAE,OAAO,EAAE,CAAC;QAClD,MAAM,MAAM,GAAG,YAAY,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC;QACzC,MAAM,KAAK,GAAG,wBAAwB,CAAC,MAAM,CAAC,CAAC;QAC/C,OAAO,KAAK,GAAG,CAAC;YACd,CAAC,CAAC,EAAE;YACJ,CAAC,CAAC;gBACE;oBACE,IAAI,EAAE,yCAAkD;oBACxD,IAAI,EAAE,MAAM,CAAC,MAAM,EAAE,KAAK,CAAC;oBAC3B,IAAI,EAAE,IAAI,CAAC,IAAI;iBAChB;aACF,CAAC;IACR,CAAC,CAAC,CACH,CAAC;AACJ,CAAC"}

package/src/secrets/index.d.ts

@@ -0,0 +1,12 @@
+export * from './adapters.js';
+export * from './aws-control-plane.js';
+export * from './declaration-verification.js';
+export * from './guardrails.js';
+export * from './metadata.js';
+export * from './model.js';
+export * from './operator.js';
+export * from './permissions.js';
+export * from './personal-ledger.js';
+export * from './registry.js';
+export * from './verification.js';
+export * from './workload-access.js';

package/src/secrets/index.js

@@ -0,0 +1,16 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+const tslib_1 = require("tslib");
+tslib_1.__exportStar(require("./adapters.js"), exports);
+tslib_1.__exportStar(require("./aws-control-plane.js"), exports);
+tslib_1.__exportStar(require("./declaration-verification.js"), exports);
+tslib_1.__exportStar(require("./guardrails.js"), exports);
+tslib_1.__exportStar(require("./metadata.js"), exports);
+tslib_1.__exportStar(require("./model.js"), exports);
+tslib_1.__exportStar(require("./operator.js"), exports);
+tslib_1.__exportStar(require("./permissions.js"), exports);
+tslib_1.__exportStar(require("./personal-ledger.js"), exports);
+tslib_1.__exportStar(require("./registry.js"), exports);
+tslib_1.__exportStar(require("./verification.js"), exports);
+tslib_1.__exportStar(require("./workload-access.js"), exports);
+//# sourceMappingURL=index.js.map

package/src/secrets/index.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../../../../../packages/nx/src/secrets/index.ts"],"names":[],"mappings":";;;AAAA,wDAA8B;AAC9B,iEAAuC;AACvC,wEAA8C;AAC9C,0DAAgC;AAChC,wDAA8B;AAC9B,qDAA2B;AAC3B,wDAA8B;AAC9B,2DAAiC;AACjC,+DAAqC;AACrC,wDAA8B;AAC9B,4DAAkC;AAClC,+DAAqC"}

package/src/secrets/metadata.d.ts

@@ -0,0 +1,48 @@
+import { type ObservedSecretMetadata, type SecretManagementScope, type SecretMetadataDeclaration } from './model.js';
+export declare const SECRET_METADATA_FINDING_CODES: readonly ["identity-conflict", "missing-container", "missing-current-version", "orphan-container", "ownership-ambiguous", "rotation-policy-violation", "tag-drift"];
+export type SecretMetadataFindingCode = (typeof SECRET_METADATA_FINDING_CODES)[number];
+export interface SecretMetadataFinding {
+    code: SecretMetadataFindingCode;
+    logicalName?: string;
+    name: string;
+    severity: 'blocking' | 'warning';
+}
+export type SecretMetadataMutationIntent = {
+    description: string;
+    kind: 'create-empty-container';
+    name: string;
+    tags: Readonly<Record<string, string>>;
+} | {
+    arn: string;
+    kind: 'set-tags';
+    tags: Readonly<Record<string, string>>;
+};
+export interface SecretMetadataReconciliationResult {
+    /**
+     * Only populated in apply mode. These value-free intents are the complete
+     * mutation authority of this Phase 2 core.
+     */
+    authorizedMutations: readonly SecretMetadataMutationIntent[];
+    findings: readonly SecretMetadataFinding[];
+    mode: 'apply' | 'report';
+    proposedMutations: readonly SecretMetadataMutationIntent[];
+    status: 'clean' | 'drifted';
+}
+export interface SecretMetadataPreflightResult {
+    findings: readonly SecretMetadataFinding[];
+    ready: boolean;
+}
+interface ReconciliationInput {
+    declarations: readonly SecretMetadataDeclaration[];
+    mode?: 'apply' | 'report';
+    observed: readonly ObservedSecretMetadata[];
+    scope: SecretManagementScope;
+}
+interface PreflightInput {
+    declarations: readonly SecretMetadataDeclaration[];
+    observed: readonly ObservedSecretMetadata[];
+    scope: SecretManagementScope;
+}
+export declare function reconcileSecretMetadata(input: ReconciliationInput): SecretMetadataReconciliationResult;
+export declare function preflightSecretMetadata(input: PreflightInput): SecretMetadataPreflightResult;
+export {};

package/src/secrets/metadata.js

@@ -0,0 +1,171 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.SECRET_METADATA_FINDING_CODES = void 0;
+exports.reconcileSecretMetadata = reconcileSecretMetadata;
+exports.preflightSecretMetadata = preflightSecretMetadata;
+const model_js_1 = require("./model.js");
+exports.SECRET_METADATA_FINDING_CODES = [
+    'identity-conflict',
+    'missing-container',
+    'missing-current-version',
+    'orphan-container',
+    'ownership-ambiguous',
+    'rotation-policy-violation',
+    'tag-drift',
+];
+const identityTagKeys = [
+    model_js_1.SECRET_METADATA_TAG_KEYS.workspace,
+    model_js_1.SECRET_METADATA_TAG_KEYS.stage,
+    model_js_1.SECRET_METADATA_TAG_KEYS.slice,
+    model_js_1.SECRET_METADATA_TAG_KEYS.logicalName,
+];
+function expectedDeclarations(declarations, scope) {
+    const names = new Set();
+    for (const declaration of declarations) {
+        (0, model_js_1.validateSecretMetadataDeclaration)(declaration);
+        if (declaration.source !== 'operator') {
+            throw new model_js_1.SecretMetadataModelError(`declarations.${declaration.logicalName}.source`, 'must be operator for the operator-secret metadata path');
+        }
+        if (names.has(declaration.logicalName)) {
+            throw new model_js_1.SecretMetadataModelError('declarations', 'must not contain duplicate logical names');
+        }
+        names.add(declaration.logicalName);
+    }
+    return declarations.filter((declaration) => declaration.requiredStages.includes(scope.stage));
+}
+function observationsByName(observed) {
+    const result = new Map();
+    for (const item of observed) {
+        (0, model_js_1.validateObservedSecretMetadata)(item);
+        if (result.has(item.name)) {
+            throw new model_js_1.SecretMetadataModelError('observed', 'must not contain duplicate secret names');
+        }
+        result.set(item.name, item);
+    }
+    return result;
+}
+function identityDisposition(observed, expectedTags) {
+    const present = identityTagKeys.filter((key) => observed.tags[key] !== undefined);
+    if (present.length === 0) {
+        return 'ambiguous';
+    }
+    if (present.some((key) => observed.tags[key] !== expectedTags[key])) {
+        return 'conflicting';
+    }
+    return present.length === identityTagKeys.length ? 'owned' : 'ambiguous';
+}
+function tagsDiffer(observed, expected) {
+    return Object.entries(expected).some(([key, value]) => observed.tags[key] !== value);
+}
+function finding(code, name, logicalName, severity) {
+    return {
+        code,
+        ...(logicalName === undefined ? {} : { logicalName }),
+        name,
+        severity,
+    };
+}
+function reconcileSecretMetadata(input) {
+    (0, model_js_1.validateSecretManagementScope)(input.scope);
+    const mode = input.mode ?? 'report';
+    if (mode !== 'apply' && mode !== 'report') {
+        throw new model_js_1.SecretMetadataModelError('mode', 'must be report or explicit apply');
+    }
+    const declarations = expectedDeclarations(input.declarations, input.scope);
+    const observed = observationsByName(input.observed);
+    const expectedNames = new Set();
+    const findings = [];
+    const proposedMutations = [];
+    for (const declaration of declarations) {
+        const name = (0, model_js_1.canonicalOperatorSecretName)(input.scope, declaration.logicalName);
+        expectedNames.add(name);
+        const expectedTags = (0, model_js_1.canonicalOperatorSecretTags)(input.scope, declaration);
+        const actual = observed.get(name);
+        if (actual === undefined) {
+            findings.push(finding('missing-container', name, declaration.logicalName, 'blocking'));
+            proposedMutations.push({
+                description: `EBK operator secret ${declaration.logicalName}`,
+                kind: 'create-empty-container',
+                name,
+                tags: expectedTags,
+            });
+            continue;
+        }
+        const ownership = identityDisposition(actual, expectedTags);
+        if (ownership === 'ambiguous') {
+            findings.push(finding('ownership-ambiguous', name, declaration.logicalName, 'blocking'));
+            continue;
+        }
+        if (ownership === 'conflicting') {
+            findings.push(finding('identity-conflict', name, declaration.logicalName, 'blocking'));
+            continue;
+        }
+        if (tagsDiffer(actual, expectedTags)) {
+            findings.push(finding('tag-drift', name, declaration.logicalName, 'warning'));
+            proposedMutations.push({
+                arn: actual.arn,
+                kind: 'set-tags',
+                tags: expectedTags,
+            });
+        }
+        if (!(0, model_js_1.isRotationCompliant)(declaration, actual)) {
+            findings.push(finding('rotation-policy-violation', name, declaration.logicalName, 'blocking'));
+        }
+    }
+    for (const actual of observed.values()) {
+        if (!expectedNames.has(actual.name) &&
+            actual.tags[model_js_1.SECRET_METADATA_TAG_KEYS.workspace] ===
+                input.scope.workspace &&
+            actual.tags[model_js_1.SECRET_METADATA_TAG_KEYS.stage] === input.scope.stage &&
+            actual.tags[model_js_1.SECRET_METADATA_TAG_KEYS.slice] === input.scope.slice &&
+            actual.tags[model_js_1.SECRET_METADATA_TAG_KEYS.management] ===
+                model_js_1.OPERATOR_SECRET_MANAGEMENT_CLASS) {
+            findings.push(finding('orphan-container', actual.name, actual.tags[model_js_1.SECRET_METADATA_TAG_KEYS.logicalName], 'warning'));
+        }
+    }
+    const mutationBlocked = findings.some(({ code }) => code === 'identity-conflict' || code === 'ownership-ambiguous');
+    return Object.freeze({
+        authorizedMutations: mode === 'apply' && !mutationBlocked
+            ? Object.freeze([...proposedMutations])
+            : [],
+        findings: Object.freeze(findings),
+        mode,
+        proposedMutations: Object.freeze(proposedMutations),
+        status: findings.length === 0 ? 'clean' : 'drifted',
+    });
+}
+function preflightSecretMetadata(input) {
+    (0, model_js_1.validateSecretManagementScope)(input.scope);
+    const declarations = expectedDeclarations(input.declarations, input.scope);
+    const observed = observationsByName(input.observed);
+    const findings = [];
+    for (const declaration of declarations) {
+        const name = (0, model_js_1.canonicalOperatorSecretName)(input.scope, declaration.logicalName);
+        const actual = observed.get(name);
+        if (actual === undefined) {
+            findings.push(finding('missing-container', name, declaration.logicalName, 'blocking'));
+            continue;
+        }
+        const expectedTags = (0, model_js_1.canonicalOperatorSecretTags)(input.scope, declaration);
+        const ownership = identityDisposition(actual, expectedTags);
+        if (ownership === 'ambiguous') {
+            findings.push(finding('ownership-ambiguous', name, declaration.logicalName, 'blocking'));
+            continue;
+        }
+        if (ownership === 'conflicting') {
+            findings.push(finding('identity-conflict', name, declaration.logicalName, 'blocking'));
+            continue;
+        }
+        if (!actual.versionStages.includes('AWSCURRENT')) {
+            findings.push(finding('missing-current-version', name, declaration.logicalName, 'blocking'));
+        }
+        if (!(0, model_js_1.isRotationCompliant)(declaration, actual)) {
+            findings.push(finding('rotation-policy-violation', name, declaration.logicalName, 'blocking'));
+        }
+    }
+    return Object.freeze({
+        findings: Object.freeze(findings),
+        ready: findings.length === 0,
+    });
+}
+//# sourceMappingURL=metadata.js.map

package/src/secrets/metadata.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"metadata.js","sourceRoot":"","sources":["../../../../../packages/nx/src/secrets/metadata.ts"],"names":[],"mappings":";;;AAuKA,0DAiHC;AAED,0DAkEC;AA5VD,yCAaoB;AAEP,QAAA,6BAA6B,GAAG;IAC3C,mBAAmB;IACnB,mBAAmB;IACnB,yBAAyB;IACzB,kBAAkB;IAClB,qBAAqB;IACrB,2BAA2B;IAC3B,WAAW;CACH,CAAC;AAuDX,MAAM,eAAe,GAAG;IACtB,mCAAwB,CAAC,SAAS;IAClC,mCAAwB,CAAC,KAAK;IAC9B,mCAAwB,CAAC,KAAK;IAC9B,mCAAwB,CAAC,WAAW;CAC5B,CAAC;AAEX,SAAS,oBAAoB,CAC3B,YAAkD,EAClD,KAA4B;IAE5B,MAAM,KAAK,GAAG,IAAI,GAAG,EAAU,CAAC;IAChC,KAAK,MAAM,WAAW,IAAI,YAAY,EAAE,CAAC;QACvC,IAAA,4CAAiC,EAAC,WAAW,CAAC,CAAC;QAC/C,IAAI,WAAW,CAAC,MAAM,KAAK,UAAU,EAAE,CAAC;YACtC,MAAM,IAAI,mCAAwB,CAChC,gBAAgB,WAAW,CAAC,WAAW,SAAS,EAChD,wDAAwD,CACzD,CAAC;QACJ,CAAC;QACD,IAAI,KAAK,CAAC,GAAG,CAAC,WAAW,CAAC,WAAW,CAAC,EAAE,CAAC;YACvC,MAAM,IAAI,mCAAwB,CAChC,cAAc,EACd,0CAA0C,CAC3C,CAAC;QACJ,CAAC;QACD,KAAK,CAAC,GAAG,CAAC,WAAW,CAAC,WAAW,CAAC,CAAC;IACrC,CAAC;IACD,OAAO,YAAY,CAAC,MAAM,CAAC,CAAC,WAAW,EAAE,EAAE,CACzC,WAAW,CAAC,cAAc,CAAC,QAAQ,CAAC,KAAK,CAAC,KAAK,CAAC,CACjD,CAAC;AACJ,CAAC;AAED,SAAS,kBAAkB,CACzB,QAA2C;IAE3C,MAAM,MAAM,GAAG,IAAI,GAAG,EAAkC,CAAC;IACzD,KAAK,MAAM,IAAI,IAAI,QAAQ,EAAE,CAAC;QAC5B,IAAA,yCAA8B,EAAC,IAAI,CAAC,CAAC;QACrC,IAAI,MAAM,CAAC,GAAG,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC;YAC1B,MAAM,IAAI,mCAAwB,CAChC,UAAU,EACV,yCAAyC,CAC1C,CAAC;QACJ,CAAC;QACD,MAAM,CAAC,GAAG,CAAC,IAAI,CAAC,IAAI,EAAE,IAAI,CAAC,CAAC;IAC9B,CAAC;IACD,OAAO,MAAM,CAAC;AAChB,CAAC;AAED,SAAS,mBAAmB,CAC1B,QAAgC,EAChC,YAA8C;IAE9C,MAAM,OAAO,GAAG,eAAe,CAAC,MAAM,CACpC,CAAC,GAAG,EAAE,EAAE,CAAC,QAAQ,CAAC,IAAI,CAAC,GAAG,CAAC,KAAK,SAAS,CAC1C,CAAC;IACF,IAAI,OAAO,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QACzB,OAAO,WAAW,CAAC;IACrB,CAAC;IACD,IAAI,OAAO,CAAC,IAAI,CAAC,CAAC,GAAG,EAAE,EAAE,CAAC,QAAQ,CAAC,IAAI,CAAC,GAAG,CAAC,KAAK,YAAY,CAAC,GAAG,CAAC,CAAC,EAAE,CAAC;QACpE,OAAO,aAAa,CAAC;IACvB,CAAC;IACD,OAAO,OAAO,CAAC,MAAM,KAAK,eAAe,CAAC,MAAM,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,WAAW,CAAC;AAC3E,CAAC;AAED,SAAS,UAAU,CACjB,QAAgC,EAChC,QAA0C;IAE1C,OAAO,MAAM,CAAC,OAAO,CAAC,QAAQ,CAAC,CAAC,IAAI,CAClC,CAAC,CAAC,GAAG,EAAE,KAAK,CAAC,EAAE,EAAE,CAAC,QAAQ,CAAC,IAAI,CAAC,GAAG,CAAC,KAAK,KAAK,CAC/C,CAAC;AACJ,CAAC;AAED,SAAS,OAAO,CACd,IAA+B,EAC/B,IAAY,EACZ,WAA+B,EAC/B,QAAgC;IAEhC,OAAO;QACL,IAAI;QACJ,GAAG,CAAC,WAAW,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,WAAW,EAAE,CAAC;QACrD,IAAI;QACJ,QAAQ;KACT,CAAC;AACJ,CAAC;AAED,SAAgB,uBAAuB,CACrC,KAA0B;IAE1B,IAAA,wCAA6B,EAAC,KAAK,CAAC,KAAK,CAAC,CAAC;IAC3C,MAAM,IAAI,GAAG,KAAK,CAAC,IAAI,IAAI,QAAQ,CAAC;IACpC,IAAI,IAAI,KAAK,OAAO,IAAI,IAAI,KAAK,QAAQ,EAAE,CAAC;QAC1C,MAAM,IAAI,mCAAwB,CAChC,MAAM,EACN,kCAAkC,CACnC,CAAC;IACJ,CAAC;IACD,MAAM,YAAY,GAAG,oBAAoB,CAAC,KAAK,CAAC,YAAY,EAAE,KAAK,CAAC,KAAK,CAAC,CAAC;IAC3E,MAAM,QAAQ,GAAG,kBAAkB,CAAC,KAAK,CAAC,QAAQ,CAAC,CAAC;IACpD,MAAM,aAAa,GAAG,IAAI,GAAG,EAAU,CAAC;IACxC,MAAM,QAAQ,GAA4B,EAAE,CAAC;IAC7C,MAAM,iBAAiB,GAAmC,EAAE,CAAC;IAE7D,KAAK,MAAM,WAAW,IAAI,YAAY,EAAE,CAAC;QACvC,MAAM,IAAI,GAAG,IAAA,sCAA2B,EACtC,KAAK,CAAC,KAAK,EACX,WAAW,CAAC,WAAW,CACxB,CAAC;QACF,aAAa,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC;QACxB,MAAM,YAAY,GAAG,IAAA,sCAA2B,EAAC,KAAK,CAAC,KAAK,EAAE,WAAW,CAAC,CAAC;QAC3E,MAAM,MAAM,GAAG,QAAQ,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC;QAClC,IAAI,MAAM,KAAK,SAAS,EAAE,CAAC;YACzB,QAAQ,CAAC,IAAI,CACX,OAAO,CAAC,mBAAmB,EAAE,IAAI,EAAE,WAAW,CAAC,WAAW,EAAE,UAAU,CAAC,CACxE,CAAC;YACF,iBAAiB,CAAC,IAAI,CAAC;gBACrB,WAAW,EAAE,uBAAuB,WAAW,CAAC,WAAW,EAAE;gBAC7D,IAAI,EAAE,wBAAwB;gBAC9B,IAAI;gBACJ,IAAI,EAAE,YAAY;aACnB,CAAC,CAAC;YACH,SAAS;QACX,CAAC;QAED,MAAM,SAAS,GAAG,mBAAmB,CAAC,MAAM,EAAE,YAAY,CAAC,CAAC;QAC5D,IAAI,SAAS,KAAK,WAAW,EAAE,CAAC;YAC9B,QAAQ,CAAC,IAAI,CACX,OAAO,CACL,qBAAqB,EACrB,IAAI,EACJ,WAAW,CAAC,WAAW,EACvB,UAAU,CACX,CACF,CAAC;YACF,SAAS;QACX,CAAC;QACD,IAAI,SAAS,KAAK,aAAa,EAAE,CAAC;YAChC,QAAQ,CAAC,IAAI,CACX,OAAO,CAAC,mBAAmB,EAAE,IAAI,EAAE,WAAW,CAAC,WAAW,EAAE,UAAU,CAAC,CACxE,CAAC;YACF,SAAS;QACX,CAAC;QACD,IAAI,UAAU,CAAC,MAAM,EAAE,YAAY,CAAC,EAAE,CAAC;YACrC,QAAQ,CAAC,IAAI,CACX,OAAO,CAAC,WAAW,EAAE,IAAI,EAAE,WAAW,CAAC,WAAW,EAAE,SAAS,CAAC,CAC/D,CAAC;YACF,iBAAiB,CAAC,IAAI,CAAC;gBACrB,GAAG,EAAE,MAAM,CAAC,GAAG;gBACf,IAAI,EAAE,UAAU;gBAChB,IAAI,EAAE,YAAY;aACnB,CAAC,CAAC;QACL,CAAC;QACD,IAAI,CAAC,IAAA,8BAAmB,EAAC,WAAW,EAAE,MAAM,CAAC,EAAE,CAAC;YAC9C,QAAQ,CAAC,IAAI,CACX,OAAO,CACL,2BAA2B,EAC3B,IAAI,EACJ,WAAW,CAAC,WAAW,EACvB,UAAU,CACX,CACF,CAAC;QACJ,CAAC;IACH,CAAC;IAED,KAAK,MAAM,MAAM,IAAI,QAAQ,CAAC,MAAM,EAAE,EAAE,CAAC;QACvC,IACE,CAAC,aAAa,CAAC,GAAG,CAAC,MAAM,CAAC,IAAI,CAAC;YAC/B,MAAM,CAAC,IAAI,CAAC,mCAAwB,CAAC,SAAS,CAAC;gBAC7C,KAAK,CAAC,KAAK,CAAC,SAAS;YACvB,MAAM,CAAC,IAAI,CAAC,mCAAwB,CAAC,KAAK,CAAC,KAAK,KAAK,CAAC,KAAK,CAAC,KAAK;YACjE,MAAM,CAAC,IAAI,CAAC,mCAAwB,CAAC,KAAK,CAAC,KAAK,KAAK,CAAC,KAAK,CAAC,KAAK;YACjE,MAAM,CAAC,IAAI,CAAC,mCAAwB,CAAC,UAAU,CAAC;gBAC9C,2CAAgC,EAClC,CAAC;YACD,QAAQ,CAAC,IAAI,CACX,OAAO,CACL,kBAAkB,EAClB,MAAM,CAAC,IAAI,EACX,MAAM,CAAC,IAAI,CAAC,mCAAwB,CAAC,WAAW,CAAC,EACjD,SAAS,CACV,CACF,CAAC;QACJ,CAAC;IACH,CAAC;IAED,MAAM,eAAe,GAAG,QAAQ,CAAC,IAAI,CACnC,CAAC,EAAE,IAAI,EAAE,EAAE,EAAE,CACX,IAAI,KAAK,mBAAmB,IAAI,IAAI,KAAK,qBAAqB,CACjE,CAAC;IACF,OAAO,MAAM,CAAC,MAAM,CAAC;QACnB,mBAAmB,EACjB,IAAI,KAAK,OAAO,IAAI,CAAC,eAAe;YAClC,CAAC,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC,GAAG,iBAAiB,CAAC,CAAC;YACvC,CAAC,CAAC,EAAE;QACR,QAAQ,EAAE,MAAM,CAAC,MAAM,CAAC,QAAQ,CAAC;QACjC,IAAI;QACJ,iBAAiB,EAAE,MAAM,CAAC,MAAM,CAAC,iBAAiB,CAAC;QACnD,MAAM,EAAE,QAAQ,CAAC,MAAM,KAAK,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,SAAS;KACpD,CAAC,CAAC;AACL,CAAC;AAED,SAAgB,uBAAuB,CACrC,KAAqB;IAErB,IAAA,wCAA6B,EAAC,KAAK,CAAC,KAAK,CAAC,CAAC;IAC3C,MAAM,YAAY,GAAG,oBAAoB,CAAC,KAAK,CAAC,YAAY,EAAE,KAAK,CAAC,KAAK,CAAC,CAAC;IAC3E,MAAM,QAAQ,GAAG,kBAAkB,CAAC,KAAK,CAAC,QAAQ,CAAC,CAAC;IACpD,MAAM,QAAQ,GAA4B,EAAE,CAAC;IAE7C,KAAK,MAAM,WAAW,IAAI,YAAY,EAAE,CAAC;QACvC,MAAM,IAAI,GAAG,IAAA,sCAA2B,EACtC,KAAK,CAAC,KAAK,EACX,WAAW,CAAC,WAAW,CACxB,CAAC;QACF,MAAM,MAAM,GAAG,QAAQ,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC;QAClC,IAAI,MAAM,KAAK,SAAS,EAAE,CAAC;YACzB,QAAQ,CAAC,IAAI,CACX,OAAO,CAAC,mBAAmB,EAAE,IAAI,EAAE,WAAW,CAAC,WAAW,EAAE,UAAU,CAAC,CACxE,CAAC;YACF,SAAS;QACX,CAAC;QAED,MAAM,YAAY,GAAG,IAAA,sCAA2B,EAAC,KAAK,CAAC,KAAK,EAAE,WAAW,CAAC,CAAC;QAC3E,MAAM,SAAS,GAAG,mBAAmB,CAAC,MAAM,EAAE,YAAY,CAAC,CAAC;QAC5D,IAAI,SAAS,KAAK,WAAW,EAAE,CAAC;YAC9B,QAAQ,CAAC,IAAI,CACX,OAAO,CACL,qBAAqB,EACrB,IAAI,EACJ,WAAW,CAAC,WAAW,EACvB,UAAU,CACX,CACF,CAAC;YACF,SAAS;QACX,CAAC;QACD,IAAI,SAAS,KAAK,aAAa,EAAE,CAAC;YAChC,QAAQ,CAAC,IAAI,CACX,OAAO,CAAC,mBAAmB,EAAE,IAAI,EAAE,WAAW,CAAC,WAAW,EAAE,UAAU,CAAC,CACxE,CAAC;YACF,SAAS;QACX,CAAC;QACD,IAAI,CAAC,MAAM,CAAC,aAAa,CAAC,QAAQ,CAAC,YAAY,CAAC,EAAE,CAAC;YACjD,QAAQ,CAAC,IAAI,CACX,OAAO,CACL,yBAAyB,EACzB,IAAI,EACJ,WAAW,CAAC,WAAW,EACvB,UAAU,CACX,CACF,CAAC;QACJ,CAAC;QACD,IAAI,CAAC,IAAA,8BAAmB,EAAC,WAAW,EAAE,MAAM,CAAC,EAAE,CAAC;YAC9C,QAAQ,CAAC,IAAI,CACX,OAAO,CACL,2BAA2B,EAC3B,IAAI,EACJ,WAAW,CAAC,WAAW,EACvB,UAAU,CACX,CACF,CAAC;QACJ,CAAC;IACH,CAAC;IAED,OAAO,MAAM,CAAC,MAAM,CAAC;QACnB,QAAQ,EAAE,MAAM,CAAC,MAAM,CAAC,QAAQ,CAAC;QACjC,KAAK,EAAE,QAAQ,CAAC,MAAM,KAAK,CAAC;KAC7B,CAAC,CAAC;AACL,CAAC"}