@empire-builder-kit/nx 1.0.0-beta.9 → 1.0.0-rc.2

package/src/secrets/model.d.ts

@@ -0,0 +1,49 @@
+export declare const OPERATOR_SECRET_MANAGEMENT_CLASS: "operator-secret";
+export declare const SECRET_CANONICAL_STAGES: readonly ["development", "staging", "production"];
+export type SecretCanonicalStage = (typeof SECRET_CANONICAL_STAGES)[number];
+export declare const SECRET_METADATA_TAG_KEYS: {
+    readonly logicalName: "ebk:logical-name";
+    readonly management: "ebk:management";
+    readonly owner: "ebk:owner";
+    readonly slice: "ebk:slice";
+    readonly stage: "ebk:stage";
+    readonly workspace: "ebk:workspace";
+};
+export type SecretMetadataRotation = {
+    mode: 'manual';
+} | {
+    mode: 'provider-managed';
+};
+export interface SecretMetadataDeclaration {
+    logicalName: string;
+    owner: string;
+    requiredStages: readonly string[];
+    rotation: SecretMetadataRotation;
+    source: 'aws-managed' | 'database-bootstrap' | 'operator';
+    valueKind: 'binary' | 'json' | 'string';
+}
+export interface SecretManagementScope {
+    slice: string;
+    stage: string;
+    workspace: string;
+}
+export interface ObservedSecretMetadata {
+    arn: string;
+    name: string;
+    rotationEnabled: boolean;
+    tags: Readonly<Record<string, string>>;
+    versionStages: readonly string[];
+}
+export declare function isSecretCanonicalStage(value: string): value is SecretCanonicalStage;
+export declare class SecretMetadataModelError extends Error {
+    readonly path: string;
+    readonly code = "secret-metadata-model-invalid";
+    constructor(path: string, reason: string);
+}
+export declare function validateSecretManagementScope(scope: SecretManagementScope): void;
+export declare function validateSecretMetadataDeclaration(declaration: SecretMetadataDeclaration): void;
+export declare function validateObservedSecretMetadata(observed: ObservedSecretMetadata): void;
+export declare function canonicalOperatorSecretName(scope: SecretManagementScope, logicalName: string): string;
+export declare function canonicalOperatorSecretTags(scope: SecretManagementScope, declaration: SecretMetadataDeclaration): Readonly<Record<string, string>>;
+export declare function isExactSecretArn(value: string): boolean;
+export declare function isRotationCompliant(declaration: SecretMetadataDeclaration, observed: ObservedSecretMetadata): boolean;

package/src/secrets/model.js

@@ -0,0 +1,125 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.SecretMetadataModelError = exports.SECRET_METADATA_TAG_KEYS = exports.SECRET_CANONICAL_STAGES = exports.OPERATOR_SECRET_MANAGEMENT_CLASS = void 0;
+exports.isSecretCanonicalStage = isSecretCanonicalStage;
+exports.validateSecretManagementScope = validateSecretManagementScope;
+exports.validateSecretMetadataDeclaration = validateSecretMetadataDeclaration;
+exports.validateObservedSecretMetadata = validateObservedSecretMetadata;
+exports.canonicalOperatorSecretName = canonicalOperatorSecretName;
+exports.canonicalOperatorSecretTags = canonicalOperatorSecretTags;
+exports.isExactSecretArn = isExactSecretArn;
+exports.isRotationCompliant = isRotationCompliant;
+exports.OPERATOR_SECRET_MANAGEMENT_CLASS = 'operator-secret';
+exports.SECRET_CANONICAL_STAGES = [
+    'development',
+    'staging',
+    'production',
+];
+exports.SECRET_METADATA_TAG_KEYS = {
+    logicalName: 'ebk:logical-name',
+    management: 'ebk:management',
+    owner: 'ebk:owner',
+    slice: 'ebk:slice',
+    stage: 'ebk:stage',
+    workspace: 'ebk:workspace',
+};
+const logicalNamePattern = /^[A-Za-z][A-Za-z0-9]{0,63}$/;
+const ownerPattern = /^[a-z0-9][a-z0-9-]{0,62}$/;
+const slugPattern = /^[a-z0-9][a-z0-9-]{0,62}$/;
+const secretArnPattern = /^arn:(?:aws|aws-us-gov|aws-cn):secretsmanager:[a-z0-9-]+:\d{12}:secret:[A-Za-z0-9/_+=.@-]+$/;
+const canonicalStages = new Set(exports.SECRET_CANONICAL_STAGES);
+function isSecretCanonicalStage(value) {
+    return canonicalStages.has(value);
+}
+class SecretMetadataModelError extends Error {
+    path;
+    code = 'secret-metadata-model-invalid';
+    constructor(path, reason) {
+        super(`Invalid secret metadata at ${path}: ${reason}.`);
+        this.path = path;
+        this.name = 'SecretMetadataModelError';
+    }
+}
+exports.SecretMetadataModelError = SecretMetadataModelError;
+function validateSecretManagementScope(scope) {
+    for (const key of ['workspace', 'stage', 'slice']) {
+        if (!slugPattern.test(scope[key])) {
+            throw new SecretMetadataModelError(`scope.${key}`, 'must be a normalized slug');
+        }
+    }
+    if (!isSecretCanonicalStage(scope.stage)) {
+        throw new SecretMetadataModelError('scope.stage', 'must be development, staging, or production');
+    }
+}
+function validateSecretMetadataDeclaration(declaration) {
+    if (!logicalNamePattern.test(declaration.logicalName)) {
+        throw new SecretMetadataModelError('declaration.logicalName', 'must start with a letter and contain only letters or digits');
+    }
+    if (!ownerPattern.test(declaration.owner)) {
+        throw new SecretMetadataModelError('declaration.owner', 'must be a normalized owner slug');
+    }
+    if (declaration.requiredStages.length === 0 ||
+        declaration.requiredStages.some((stage) => !isSecretCanonicalStage(stage)) ||
+        new Set(declaration.requiredStages).size !==
+            declaration.requiredStages.length) {
+        throw new SecretMetadataModelError('declaration.requiredStages', 'must contain unique canonical deployed stages');
+    }
+    if (!['aws-managed', 'database-bootstrap', 'operator'].includes(declaration.source)) {
+        throw new SecretMetadataModelError('declaration.source', 'must name a supported value authority');
+    }
+    if (!['binary', 'json', 'string'].includes(declaration.valueKind)) {
+        throw new SecretMetadataModelError('declaration.valueKind', 'must name a supported value shape');
+    }
+    if (!['manual', 'provider-managed'].includes(declaration.rotation.mode)) {
+        throw new SecretMetadataModelError('declaration.rotation.mode', 'must be manual or provider-managed');
+    }
+}
+function validateObservedSecretMetadata(observed) {
+    if (!secretArnPattern.test(observed.arn)) {
+        throw new SecretMetadataModelError('observed.arn', 'must be an exact Secrets Manager ARN without wildcards');
+    }
+    if (observed.name.length === 0 || observed.name.includes('*')) {
+        throw new SecretMetadataModelError('observed.name', 'must be a concrete secret name');
+    }
+    if (typeof observed.rotationEnabled !== 'boolean' ||
+        typeof observed.tags !== 'object' ||
+        observed.tags === null ||
+        Array.isArray(observed.tags) ||
+        Object.values(observed.tags).some((value) => typeof value !== 'string')) {
+        throw new SecretMetadataModelError('observed', 'must contain boolean rotation state and string metadata tags');
+    }
+    if (!Array.isArray(observed.versionStages)) {
+        throw new SecretMetadataModelError('observed.versionStages', 'must contain staging labels');
+    }
+    if (observed.versionStages.some((stage) => typeof stage !== 'string' || stage.length === 0)) {
+        throw new SecretMetadataModelError('observed.versionStages', 'must contain non-empty staging labels');
+    }
+}
+function canonicalOperatorSecretName(scope, logicalName) {
+    validateSecretManagementScope(scope);
+    if (!logicalNamePattern.test(logicalName)) {
+        throw new SecretMetadataModelError('logicalName', 'must start with a letter and contain only letters or digits');
+    }
+    return `ebk/${scope.stage}/${scope.slice}/${logicalName}`;
+}
+function canonicalOperatorSecretTags(scope, declaration) {
+    validateSecretManagementScope(scope);
+    validateSecretMetadataDeclaration(declaration);
+    return Object.freeze({
+        [exports.SECRET_METADATA_TAG_KEYS.logicalName]: declaration.logicalName,
+        [exports.SECRET_METADATA_TAG_KEYS.management]: exports.OPERATOR_SECRET_MANAGEMENT_CLASS,
+        [exports.SECRET_METADATA_TAG_KEYS.owner]: declaration.owner,
+        [exports.SECRET_METADATA_TAG_KEYS.slice]: scope.slice,
+        [exports.SECRET_METADATA_TAG_KEYS.stage]: scope.stage,
+        [exports.SECRET_METADATA_TAG_KEYS.workspace]: scope.workspace,
+    });
+}
+function isExactSecretArn(value) {
+    return secretArnPattern.test(value);
+}
+function isRotationCompliant(declaration, observed) {
+    return declaration.rotation.mode === 'provider-managed'
+        ? observed.rotationEnabled
+        : !observed.rotationEnabled;
+}
+//# sourceMappingURL=model.js.map

package/src/secrets/model.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"model.js","sourceRoot":"","sources":["../../../../../packages/nx/src/secrets/model.ts"],"names":[],"mappings":";;;AAmDA,wDAIC;AAcD,sEAiBC;AAED,8EAkDC;AAED,wEA2CC;AAED,kEAYC;AAED,kEAcC;AAED,4CAEC;AAED,kDAOC;AAlOY,QAAA,gCAAgC,GAAG,iBAA0B,CAAC;AAC9D,QAAA,uBAAuB,GAAG;IACrC,aAAa;IACb,SAAS;IACT,YAAY;CACJ,CAAC;AAIE,QAAA,wBAAwB,GAAG;IACtC,WAAW,EAAE,kBAAkB;IAC/B,UAAU,EAAE,gBAAgB;IAC5B,KAAK,EAAE,WAAW;IAClB,KAAK,EAAE,WAAW;IAClB,KAAK,EAAE,WAAW;IAClB,SAAS,EAAE,eAAe;CAClB,CAAC;AA4BX,MAAM,kBAAkB,GAAG,6BAA6B,CAAC;AACzD,MAAM,YAAY,GAAG,2BAA2B,CAAC;AACjD,MAAM,WAAW,GAAG,2BAA2B,CAAC;AAChD,MAAM,gBAAgB,GACpB,6FAA6F,CAAC;AAChG,MAAM,eAAe,GAAG,IAAI,GAAG,CAAS,+BAAuB,CAAC,CAAC;AAEjE,SAAgB,sBAAsB,CACpC,KAAa;IAEb,OAAO,eAAe,CAAC,GAAG,CAAC,KAAK,CAAC,CAAC;AACpC,CAAC;AAED,MAAa,wBAAyB,SAAQ,KAAK;IAItC;IAHF,IAAI,GAAG,+BAA+B,CAAC;IAEhD,YACW,IAAY,EACrB,MAAc;QAEd,KAAK,CAAC,8BAA8B,IAAI,KAAK,MAAM,GAAG,CAAC,CAAC;QAH/C,SAAI,GAAJ,IAAI,CAAQ;QAIrB,IAAI,CAAC,IAAI,GAAG,0BAA0B,CAAC;IACzC,CAAC;CACF;AAVD,4DAUC;AAED,SAAgB,6BAA6B,CAC3C,KAA4B;IAE5B,KAAK,MAAM,GAAG,IAAI,CAAC,WAAW,EAAE,OAAO,EAAE,OAAO,CAAU,EAAE,CAAC;QAC3D,IAAI,CAAC,WAAW,CAAC,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,EAAE,CAAC;YAClC,MAAM,IAAI,wBAAwB,CAChC,SAAS,GAAG,EAAE,EACd,2BAA2B,CAC5B,CAAC;QACJ,CAAC;IACH,CAAC;IACD,IAAI,CAAC,sBAAsB,CAAC,KAAK,CAAC,KAAK,CAAC,EAAE,CAAC;QACzC,MAAM,IAAI,wBAAwB,CAChC,aAAa,EACb,6CAA6C,CAC9C,CAAC;IACJ,CAAC;AACH,CAAC;AAED,SAAgB,iCAAiC,CAC/C,WAAsC;IAEtC,IAAI,CAAC,kBAAkB,CAAC,IAAI,CAAC,WAAW,CAAC,WAAW,CAAC,EAAE,CAAC;QACtD,MAAM,IAAI,wBAAwB,CAChC,yBAAyB,EACzB,6DAA6D,CAC9D,CAAC;IACJ,CAAC;IACD,IAAI,CAAC,YAAY,CAAC,IAAI,CAAC,WAAW,CAAC,KAAK,CAAC,EAAE,CAAC;QAC1C,MAAM,IAAI,wBAAwB,CAChC,mBAAmB,EACnB,iCAAiC,CAClC,CAAC;IACJ,CAAC;IACD,IACE,WAAW,CAAC,cAAc,CAAC,MAAM,KAAK,CAAC;QACvC,WAAW,CAAC,cAAc,CAAC,IAAI,CAC7B,CAAC,KAAK,EAAE,EAAE,CAAC,CAAC,sBAAsB,CAAC,KAAK,CAAC,CAC1C;QACD,IAAI,GAAG,CAAC,WAAW,CAAC,cAAc,CAAC,CAAC,IAAI;YACtC,WAAW,CAAC,cAAc,CAAC,MAAM,EACnC,CAAC;QACD,MAAM,IAAI,wBAAwB,CAChC,4BAA4B,EAC5B,+CAA+C,CAChD,CAAC;IACJ,CAAC;IACD,IACE,CAAC,CAAC,aAAa,EAAE,oBAAoB,EAAE,UAAU,CAAC,CAAC,QAAQ,CACzD,WAAW,CAAC,MAAM,CACnB,EACD,CAAC;QACD,MAAM,IAAI,wBAAwB,CAChC,oBAAoB,EACpB,uCAAuC,CACxC,CAAC;IACJ,CAAC;IACD,IAAI,CAAC,CAAC,QAAQ,EAAE,MAAM,EAAE,QAAQ,CAAC,CAAC,QAAQ,CAAC,WAAW,CAAC,SAAS,CAAC,EAAE,CAAC;QAClE,MAAM,IAAI,wBAAwB,CAChC,uBAAuB,EACvB,mCAAmC,CACpC,CAAC;IACJ,CAAC;IACD,IAAI,CAAC,CAAC,QAAQ,EAAE,kBAAkB,CAAC,CAAC,QAAQ,CAAC,WAAW,CAAC,QAAQ,CAAC,IAAI,CAAC,EAAE,CAAC;QACxE,MAAM,IAAI,wBAAwB,CAChC,2BAA2B,EAC3B,oCAAoC,CACrC,CAAC;IACJ,CAAC;AACH,CAAC;AAED,SAAgB,8BAA8B,CAC5C,QAAgC;IAEhC,IAAI,CAAC,gBAAgB,CAAC,IAAI,CAAC,QAAQ,CAAC,GAAG,CAAC,EAAE,CAAC;QACzC,MAAM,IAAI,wBAAwB,CAChC,cAAc,EACd,wDAAwD,CACzD,CAAC;IACJ,CAAC;IACD,IAAI,QAAQ,CAAC,IAAI,CAAC,MAAM,KAAK,CAAC,IAAI,QAAQ,CAAC,IAAI,CAAC,QAAQ,CAAC,GAAG,CAAC,EAAE,CAAC;QAC9D,MAAM,IAAI,wBAAwB,CAChC,eAAe,EACf,gCAAgC,CACjC,CAAC;IACJ,CAAC;IACD,IACE,OAAO,QAAQ,CAAC,eAAe,KAAK,SAAS;QAC7C,OAAO,QAAQ,CAAC,IAAI,KAAK,QAAQ;QACjC,QAAQ,CAAC,IAAI,KAAK,IAAI;QACtB,KAAK,CAAC,OAAO,CAAC,QAAQ,CAAC,IAAI,CAAC;QAC5B,MAAM,CAAC,MAAM,CAAC,QAAQ,CAAC,IAAI,CAAC,CAAC,IAAI,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,OAAO,KAAK,KAAK,QAAQ,CAAC,EACvE,CAAC;QACD,MAAM,IAAI,wBAAwB,CAChC,UAAU,EACV,8DAA8D,CAC/D,CAAC;IACJ,CAAC;IACD,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,QAAQ,CAAC,aAAa,CAAC,EAAE,CAAC;QAC3C,MAAM,IAAI,wBAAwB,CAChC,wBAAwB,EACxB,6BAA6B,CAC9B,CAAC;IACJ,CAAC;IACD,IACE,QAAQ,CAAC,aAAa,CAAC,IAAI,CACzB,CAAC,KAAK,EAAE,EAAE,CAAC,OAAO,KAAK,KAAK,QAAQ,IAAI,KAAK,CAAC,MAAM,KAAK,CAAC,CAC3D,EACD,CAAC;QACD,MAAM,IAAI,wBAAwB,CAChC,wBAAwB,EACxB,uCAAuC,CACxC,CAAC;IACJ,CAAC;AACH,CAAC;AAED,SAAgB,2BAA2B,CACzC,KAA4B,EAC5B,WAAmB;IAEnB,6BAA6B,CAAC,KAAK,CAAC,CAAC;IACrC,IAAI,CAAC,kBAAkB,CAAC,IAAI,CAAC,WAAW,CAAC,EAAE,CAAC;QAC1C,MAAM,IAAI,wBAAwB,CAChC,aAAa,EACb,6DAA6D,CAC9D,CAAC;IACJ,CAAC;IACD,OAAO,OAAO,KAAK,CAAC,KAAK,IAAI,KAAK,CAAC,KAAK,IAAI,WAAW,EAAE,CAAC;AAC5D,CAAC;AAED,SAAgB,2BAA2B,CACzC,KAA4B,EAC5B,WAAsC;IAEtC,6BAA6B,CAAC,KAAK,CAAC,CAAC;IACrC,iCAAiC,CAAC,WAAW,CAAC,CAAC;IAC/C,OAAO,MAAM,CAAC,MAAM,CAAC;QACnB,CAAC,gCAAwB,CAAC,WAAW,CAAC,EAAE,WAAW,CAAC,WAAW;QAC/D,CAAC,gCAAwB,CAAC,UAAU,CAAC,EAAE,wCAAgC;QACvE,CAAC,gCAAwB,CAAC,KAAK,CAAC,EAAE,WAAW,CAAC,KAAK;QACnD,CAAC,gCAAwB,CAAC,KAAK,CAAC,EAAE,KAAK,CAAC,KAAK;QAC7C,CAAC,gCAAwB,CAAC,KAAK,CAAC,EAAE,KAAK,CAAC,KAAK;QAC7C,CAAC,gCAAwB,CAAC,SAAS,CAAC,EAAE,KAAK,CAAC,SAAS;KACtD,CAAC,CAAC;AACL,CAAC;AAED,SAAgB,gBAAgB,CAAC,KAAa;IAC5C,OAAO,gBAAgB,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;AACtC,CAAC;AAED,SAAgB,mBAAmB,CACjC,WAAsC,EACtC,QAAgC;IAEhC,OAAO,WAAW,CAAC,QAAQ,CAAC,IAAI,KAAK,kBAAkB;QACrD,CAAC,CAAC,QAAQ,CAAC,eAAe;QAC1B,CAAC,CAAC,CAAC,QAAQ,CAAC,eAAe,CAAC;AAChC,CAAC"}

package/src/secrets/operator.d.ts

@@ -0,0 +1,101 @@
+import { type SecretMetadataMutationIntent, type SecretMetadataPreflightResult, type SecretMetadataReconciliationResult } from './metadata.js';
+import { type ObservedSecretMetadata, type SecretManagementScope, type SecretMetadataDeclaration } from './model.js';
+export interface ListedSecretContainer {
+    arn: string;
+    name: string;
+}
+export interface CreateEmptySecretContainerInput {
+    description: string;
+    name: string;
+    tags: Readonly<Record<string, string>>;
+}
+export interface TagSecretContainerInput {
+    arn: string;
+    tags: Readonly<Record<string, string>>;
+}
+export interface SecretMetadataControlPlane {
+    createEmpty(input: CreateEmptySecretContainerInput): Promise<{
+        arn: string;
+    }>;
+    describe(input: {
+        arn: string;
+    }): Promise<ObservedSecretMetadata>;
+    list(input: {
+        includePlannedDeletion?: boolean;
+        namePrefix: string;
+    }): Promise<readonly ListedSecretContainer[]>;
+    tag(input: TagSecretContainerInput): Promise<void>;
+}
+export interface ProtectedSecretLifecycleControlPlane extends SecretMetadataControlPlane {
+    restore(input: {
+        arn: string;
+    }): Promise<void>;
+    scheduleRetirement(input: {
+        arn: string;
+        recoveryWindowDays: number;
+    }): Promise<{
+        recoveryUntil: string;
+    }>;
+}
+export interface ProtectedSecretOperatorAuthorization {
+    approved: true;
+    authority: 'protected-secret-operator';
+    logicalName: string;
+    stage: string;
+}
+export type SecretProtectedLifecycleAction = 'deploy' | 'recover' | 'remove' | 'unlock';
+export declare class SecretOperatorControlPlaneError extends Error {
+    readonly operation: 'create-empty' | 'describe' | 'inventory' | 'list' | 'recover' | 'retire' | 'tag';
+    readonly code: 'secret-control-plane-apply-failed' | 'secret-control-plane-inventory-failed' | 'secret-control-plane-inventory-invalid' | 'secret-control-plane-protected-action-failed';
+    constructor(code: SecretOperatorControlPlaneError['code'], operation: 'create-empty' | 'describe' | 'inventory' | 'list' | 'recover' | 'retire' | 'tag');
+}
+export interface SecretMetadataOperatorResult {
+    after?: SecretMetadataReconciliationResult;
+    applied: readonly SecretMetadataMutationIntent[];
+    before: SecretMetadataReconciliationResult;
+    mode: 'apply' | 'report';
+    outcome: 'applied' | 'applied-with-findings' | 'blocked' | 'reported';
+}
+export interface SecretDeployPreflightResult extends SecretMetadataPreflightResult {
+    action: SecretProtectedLifecycleAction;
+    bypassed: boolean;
+}
+export type ProtectedSecretLifecycleResult = {
+    action: 'recover';
+    logicalName: string;
+    outcome: 'restored';
+    stage: string;
+} | {
+    action: 'retire';
+    logicalName: string;
+    outcome: 'scheduled';
+    recoveryUntil: string;
+    recoveryWindowDays: number;
+    stage: string;
+};
+export declare function runSecretMetadataOperator(input: {
+    controlPlane: SecretMetadataControlPlane;
+    declarations: readonly SecretMetadataDeclaration[];
+    mode?: 'apply' | 'report';
+    scope: SecretManagementScope;
+}): Promise<SecretMetadataOperatorResult>;
+export declare function runSecretDeployPreflight(input: {
+    action: SecretProtectedLifecycleAction;
+    controlPlane: SecretMetadataControlPlane;
+    declarations: readonly SecretMetadataDeclaration[];
+    scope: SecretManagementScope;
+}): Promise<SecretDeployPreflightResult>;
+export declare function runProtectedSecretLifecycle(input: {
+    action: 'recover';
+    authorization: ProtectedSecretOperatorAuthorization;
+    controlPlane: ProtectedSecretLifecycleControlPlane;
+    logicalName: string;
+    scope: SecretManagementScope;
+} | {
+    action: 'retire';
+    authorization: ProtectedSecretOperatorAuthorization;
+    controlPlane: ProtectedSecretLifecycleControlPlane;
+    logicalName: string;
+    recoveryWindowDays: number;
+    scope: SecretManagementScope;
+}): Promise<ProtectedSecretLifecycleResult>;

package/src/secrets/operator.js

@@ -0,0 +1,229 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.SecretOperatorControlPlaneError = void 0;
+exports.runSecretMetadataOperator = runSecretMetadataOperator;
+exports.runSecretDeployPreflight = runSecretDeployPreflight;
+exports.runProtectedSecretLifecycle = runProtectedSecretLifecycle;
+const deterministic_order_js_1 = require("../deterministic-order.js");
+const metadata_js_1 = require("./metadata.js");
+const model_js_1 = require("./model.js");
+class SecretOperatorControlPlaneError extends Error {
+    operation;
+    code;
+    constructor(code, operation) {
+        super(`Secret metadata ${operation} failed (${code}).`);
+        this.operation = operation;
+        this.name = 'SecretOperatorControlPlaneError';
+        this.code = code;
+    }
+}
+exports.SecretOperatorControlPlaneError = SecretOperatorControlPlaneError;
+function canonicalPrefix(scope) {
+    (0, model_js_1.validateSecretManagementScope)(scope);
+    return `ebk/${scope.stage}/${scope.slice}/`;
+}
+function safeControlPlaneError(error, code, operation) {
+    if (error instanceof SecretOperatorControlPlaneError) {
+        return error;
+    }
+    return new SecretOperatorControlPlaneError(code, operation);
+}
+async function collectSecretMetadata(controlPlane, scope, options = {}) {
+    const namePrefix = canonicalPrefix(scope);
+    let listed;
+    try {
+        listed = await controlPlane.list({
+            ...(options.includePlannedDeletion === undefined
+                ? {}
+                : { includePlannedDeletion: options.includePlannedDeletion }),
+            namePrefix,
+        });
+    }
+    catch (error) {
+        throw safeControlPlaneError(error, 'secret-control-plane-inventory-failed', 'list');
+    }
+    if (!Array.isArray(listed) ||
+        listed.some((item) => typeof item !== 'object' ||
+            item === null ||
+            typeof item.arn !== 'string' ||
+            typeof item.name !== 'string' ||
+            !item.name.startsWith(namePrefix))) {
+        throw new SecretOperatorControlPlaneError('secret-control-plane-inventory-invalid', 'inventory');
+    }
+    try {
+        return await Promise.all([...listed]
+            .sort((left, right) => (0, deterministic_order_js_1.compareUtf16)(left.name, right.name))
+            .map(async (item) => {
+            const description = await controlPlane.describe({ arn: item.arn });
+            (0, model_js_1.validateObservedSecretMetadata)(description);
+            if (description.arn !== item.arn || description.name !== item.name) {
+                throw new SecretOperatorControlPlaneError('secret-control-plane-inventory-invalid', 'describe');
+            }
+            return description;
+        }));
+    }
+    catch (error) {
+        throw safeControlPlaneError(error, 'secret-control-plane-inventory-failed', 'describe');
+    }
+}
+function hasAmbiguousOwnership(findings) {
+    return findings.some(({ code }) => code === 'identity-conflict' || code === 'ownership-ambiguous');
+}
+async function applyMutation(controlPlane, mutation) {
+    try {
+        if (mutation.kind === 'create-empty-container') {
+            await controlPlane.createEmpty({
+                description: mutation.description,
+                name: mutation.name,
+                tags: mutation.tags,
+            });
+        }
+        else {
+            await controlPlane.tag({
+                arn: mutation.arn,
+                tags: mutation.tags,
+            });
+        }
+    }
+    catch (error) {
+        throw safeControlPlaneError(error, 'secret-control-plane-apply-failed', mutation.kind === 'create-empty-container' ? 'create-empty' : 'tag');
+    }
+}
+async function runSecretMetadataOperator(input) {
+    const mode = input.mode ?? 'report';
+    const observed = await collectSecretMetadata(input.controlPlane, input.scope);
+    const before = (0, metadata_js_1.reconcileSecretMetadata)({
+        declarations: input.declarations,
+        mode,
+        observed,
+        scope: input.scope,
+    });
+    if (mode === 'report') {
+        return Object.freeze({
+            applied: [],
+            before,
+            mode,
+            outcome: 'reported',
+        });
+    }
+    if (hasAmbiguousOwnership(before.findings)) {
+        return Object.freeze({
+            applied: [],
+            before,
+            mode,
+            outcome: 'blocked',
+        });
+    }
+    const applied = [];
+    for (const mutation of before.authorizedMutations) {
+        await applyMutation(input.controlPlane, mutation);
+        applied.push(mutation);
+    }
+    const afterObserved = await collectSecretMetadata(input.controlPlane, input.scope);
+    const after = (0, metadata_js_1.reconcileSecretMetadata)({
+        declarations: input.declarations,
+        mode: 'report',
+        observed: afterObserved,
+        scope: input.scope,
+    });
+    return Object.freeze({
+        after,
+        applied: Object.freeze(applied),
+        before,
+        mode,
+        outcome: after.status === 'clean' ? 'applied' : 'applied-with-findings',
+    });
+}
+async function runSecretDeployPreflight(input) {
+    if (input.action !== 'deploy') {
+        return Object.freeze({
+            action: input.action,
+            bypassed: true,
+            findings: [],
+            ready: true,
+        });
+    }
+    const observed = await collectSecretMetadata(input.controlPlane, input.scope);
+    const result = (0, metadata_js_1.preflightSecretMetadata)({
+        declarations: input.declarations,
+        observed,
+        scope: input.scope,
+    });
+    return Object.freeze({
+        ...result,
+        action: input.action,
+        bypassed: false,
+    });
+}
+const canonicalStages = new Set(['development', 'staging', 'production']);
+const logicalNamePattern = /^[A-Za-z][A-Za-z0-9]{0,63}$/;
+function validateProtectedAuthorization(authorization, logicalName, scope) {
+    if (authorization.approved !== true ||
+        authorization.authority !== 'protected-secret-operator' ||
+        authorization.logicalName !== logicalName ||
+        authorization.stage !== scope.stage ||
+        !canonicalStages.has(scope.stage)) {
+        throw new SecretOperatorControlPlaneError('secret-control-plane-protected-action-failed', 'inventory');
+    }
+}
+function isOwnedOperatorSecret(observed, logicalName, scope) {
+    return (observed.name === (0, model_js_1.canonicalOperatorSecretName)(scope, logicalName) &&
+        observed.tags[model_js_1.SECRET_METADATA_TAG_KEYS.workspace] === scope.workspace &&
+        observed.tags[model_js_1.SECRET_METADATA_TAG_KEYS.stage] === scope.stage &&
+        observed.tags[model_js_1.SECRET_METADATA_TAG_KEYS.slice] === scope.slice &&
+        observed.tags[model_js_1.SECRET_METADATA_TAG_KEYS.logicalName] === logicalName &&
+        observed.tags[model_js_1.SECRET_METADATA_TAG_KEYS.management] ===
+            model_js_1.OPERATOR_SECRET_MANAGEMENT_CLASS);
+}
+async function runProtectedSecretLifecycle(input) {
+    if (!logicalNamePattern.test(input.logicalName)) {
+        throw new SecretOperatorControlPlaneError('secret-control-plane-protected-action-failed', 'inventory');
+    }
+    validateProtectedAuthorization(input.authorization, input.logicalName, input.scope);
+    if (input.action === 'retire' &&
+        (!Number.isSafeInteger(input.recoveryWindowDays) ||
+            input.recoveryWindowDays < 7 ||
+            input.recoveryWindowDays > 30)) {
+        throw new SecretOperatorControlPlaneError('secret-control-plane-protected-action-failed', 'retire');
+    }
+    const observed = await collectSecretMetadata(input.controlPlane, input.scope, { includePlannedDeletion: true });
+    const matches = observed.filter((secret) => isOwnedOperatorSecret(secret, input.logicalName, input.scope));
+    if (matches.length !== 1) {
+        throw new SecretOperatorControlPlaneError('secret-control-plane-inventory-invalid', 'inventory');
+    }
+    const managedSecret = matches[0];
+    if (managedSecret === undefined) {
+        throw new SecretOperatorControlPlaneError('secret-control-plane-inventory-invalid', 'inventory');
+    }
+    try {
+        if (input.action === 'recover') {
+            await input.controlPlane.restore({ arn: managedSecret.arn });
+            return Object.freeze({
+                action: input.action,
+                logicalName: input.logicalName,
+                outcome: 'restored',
+                stage: input.scope.stage,
+            });
+        }
+        const scheduled = await input.controlPlane.scheduleRetirement({
+            arn: managedSecret.arn,
+            recoveryWindowDays: input.recoveryWindowDays,
+        });
+        if (typeof scheduled.recoveryUntil !== 'string' ||
+            Number.isNaN(Date.parse(scheduled.recoveryUntil))) {
+            throw new SecretOperatorControlPlaneError('secret-control-plane-protected-action-failed', 'retire');
+        }
+        return Object.freeze({
+            action: input.action,
+            logicalName: input.logicalName,
+            outcome: 'scheduled',
+            recoveryUntil: scheduled.recoveryUntil,
+            recoveryWindowDays: input.recoveryWindowDays,
+            stage: input.scope.stage,
+        });
+    }
+    catch (error) {
+        throw safeControlPlaneError(error, 'secret-control-plane-protected-action-failed', input.action);
+    }
+}
+//# sourceMappingURL=operator.js.map

package/src/secrets/operator.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"operator.js","sourceRoot":"","sources":["../../../../../packages/nx/src/secrets/operator.ts"],"names":[],"mappings":";;;AAuOA,8DAuDC;AAED,4DA0BC;AAwCD,kEAsGC;AAxcD,sEAAyD;AACzD,+CAOuB;AACvB,yCASoB;AA8CpB,MAAa,+BAAgC,SAAQ,KAAK;IAS7C;IARF,IAAI,CAIsC;IAEnD,YACE,IAA6C,EACpC,SAOA;QAET,KAAK,CAAC,mBAAmB,SAAS,YAAY,IAAI,IAAI,CAAC,CAAC;QAT/C,cAAS,GAAT,SAAS,CAOT;QAGT,IAAI,CAAC,IAAI,GAAG,iCAAiC,CAAC;QAC9C,IAAI,CAAC,IAAI,GAAG,IAAI,CAAC;IACnB,CAAC;CACF;AAtBD,0EAsBC;AA+BD,SAAS,eAAe,CAAC,KAA4B;IACnD,IAAA,wCAA6B,EAAC,KAAK,CAAC,CAAC;IACrC,OAAO,OAAO,KAAK,CAAC,KAAK,IAAI,KAAK,CAAC,KAAK,GAAG,CAAC;AAC9C,CAAC;AAED,SAAS,qBAAqB,CAC5B,KAAc,EACd,IAA6C,EAC7C,SAAuD;IAEvD,IAAI,KAAK,YAAY,+BAA+B,EAAE,CAAC;QACrD,OAAO,KAAK,CAAC;IACf,CAAC;IACD,OAAO,IAAI,+BAA+B,CAAC,IAAI,EAAE,SAAS,CAAC,CAAC;AAC9D,CAAC;AAED,KAAK,UAAU,qBAAqB,CAClC,YAAwC,EACxC,KAA4B,EAC5B,UAAgD,EAAE;IAElD,MAAM,UAAU,GAAG,eAAe,CAAC,KAAK,CAAC,CAAC;IAC1C,IAAI,MAAwC,CAAC;IAC7C,IAAI,CAAC;QACH,MAAM,GAAG,MAAM,YAAY,CAAC,IAAI,CAAC;YAC/B,GAAG,CAAC,OAAO,CAAC,sBAAsB,KAAK,SAAS;gBAC9C,CAAC,CAAC,EAAE;gBACJ,CAAC,CAAC,EAAE,sBAAsB,EAAE,OAAO,CAAC,sBAAsB,EAAE,CAAC;YAC/D,UAAU;SACX,CAAC,CAAC;IACL,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,MAAM,qBAAqB,CACzB,KAAK,EACL,uCAAuC,EACvC,MAAM,CACP,CAAC;IACJ,CAAC;IACD,IACE,CAAC,KAAK,CAAC,OAAO,CAAC,MAAM,CAAC;QACtB,MAAM,CAAC,IAAI,CACT,CAAC,IAAI,EAAE,EAAE,CACP,OAAO,IAAI,KAAK,QAAQ;YACxB,IAAI,KAAK,IAAI;YACb,OAAO,IAAI,CAAC,GAAG,KAAK,QAAQ;YAC5B,OAAO,IAAI,CAAC,IAAI,KAAK,QAAQ;YAC7B,CAAC,IAAI,CAAC,IAAI,CAAC,UAAU,CAAC,UAAU,CAAC,CACpC,EACD,CAAC;QACD,MAAM,IAAI,+BAA+B,CACvC,wCAAwC,EACxC,WAAW,CACZ,CAAC;IACJ,CAAC;IAED,IAAI,CAAC;QACH,OAAO,MAAM,OAAO,CAAC,GAAG,CACtB,CAAC,GAAG,MAAM,CAAC;aACR,IAAI,CAAC,CAAC,IAAI,EAAE,KAAK,EAAE,EAAE,CAAC,IAAA,qCAAY,EAAC,IAAI,CAAC,IAAI,EAAE,KAAK,CAAC,IAAI,CAAC,CAAC;aAC1D,GAAG,CAAC,KAAK,EAAE,IAAI,EAAE,EAAE;YAClB,MAAM,WAAW,GAAG,MAAM,YAAY,CAAC,QAAQ,CAAC,EAAE,GAAG,EAAE,IAAI,CAAC,GAAG,EAAE,CAAC,CAAC;YACnE,IAAA,yCAA8B,EAAC,WAAW,CAAC,CAAC;YAC5C,IAAI,WAAW,CAAC,GAAG,KAAK,IAAI,CAAC,GAAG,IAAI,WAAW,CAAC,IAAI,KAAK,IAAI,CAAC,IAAI,EAAE,CAAC;gBACnE,MAAM,IAAI,+BAA+B,CACvC,wCAAwC,EACxC,UAAU,CACX,CAAC;YACJ,CAAC;YACD,OAAO,WAAW,CAAC;QACrB,CAAC,CAAC,CACL,CAAC;IACJ,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,MAAM,qBAAqB,CACzB,KAAK,EACL,uCAAuC,EACvC,UAAU,CACX,CAAC;IACJ,CAAC;AACH,CAAC;AAED,SAAS,qBAAqB,CAC5B,QAA0C;IAE1C,OAAO,QAAQ,CAAC,IAAI,CAClB,CAAC,EAAE,IAAI,EAAE,EAAE,EAAE,CACX,IAAI,KAAK,mBAAmB,IAAI,IAAI,KAAK,qBAAqB,CACjE,CAAC;AACJ,CAAC;AAED,KAAK,UAAU,aAAa,CAC1B,YAAwC,EACxC,QAAsC;IAEtC,IAAI,CAAC;QACH,IAAI,QAAQ,CAAC,IAAI,KAAK,wBAAwB,EAAE,CAAC;YAC/C,MAAM,YAAY,CAAC,WAAW,CAAC;gBAC7B,WAAW,EAAE,QAAQ,CAAC,WAAW;gBACjC,IAAI,EAAE,QAAQ,CAAC,IAAI;gBACnB,IAAI,EAAE,QAAQ,CAAC,IAAI;aACpB,CAAC,CAAC;QACL,CAAC;aAAM,CAAC;YACN,MAAM,YAAY,CAAC,GAAG,CAAC;gBACrB,GAAG,EAAE,QAAQ,CAAC,GAAG;gBACjB,IAAI,EAAE,QAAQ,CAAC,IAAI;aACpB,CAAC,CAAC;QACL,CAAC;IACH,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,MAAM,qBAAqB,CACzB,KAAK,EACL,mCAAmC,EACnC,QAAQ,CAAC,IAAI,KAAK,wBAAwB,CAAC,CAAC,CAAC,cAAc,CAAC,CAAC,CAAC,KAAK,CACpE,CAAC;IACJ,CAAC;AACH,CAAC;AAEM,KAAK,UAAU,yBAAyB,CAAC,KAK/C;IACC,MAAM,IAAI,GAAG,KAAK,CAAC,IAAI,IAAI,QAAQ,CAAC;IACpC,MAAM,QAAQ,GAAG,MAAM,qBAAqB,CAAC,KAAK,CAAC,YAAY,EAAE,KAAK,CAAC,KAAK,CAAC,CAAC;IAC9E,MAAM,MAAM,GAAG,IAAA,qCAAuB,EAAC;QACrC,YAAY,EAAE,KAAK,CAAC,YAAY;QAChC,IAAI;QACJ,QAAQ;QACR,KAAK,EAAE,KAAK,CAAC,KAAK;KACnB,CAAC,CAAC;IAEH,IAAI,IAAI,KAAK,QAAQ,EAAE,CAAC;QACtB,OAAO,MAAM,CAAC,MAAM,CAAC;YACnB,OAAO,EAAE,EAAE;YACX,MAAM;YACN,IAAI;YACJ,OAAO,EAAE,UAAU;SACpB,CAAC,CAAC;IACL,CAAC;IACD,IAAI,qBAAqB,CAAC,MAAM,CAAC,QAAQ,CAAC,EAAE,CAAC;QAC3C,OAAO,MAAM,CAAC,MAAM,CAAC;YACnB,OAAO,EAAE,EAAE;YACX,MAAM;YACN,IAAI;YACJ,OAAO,EAAE,SAAS;SACnB,CAAC,CAAC;IACL,CAAC;IAED,MAAM,OAAO,GAAmC,EAAE,CAAC;IACnD,KAAK,MAAM,QAAQ,IAAI,MAAM,CAAC,mBAAmB,EAAE,CAAC;QAClD,MAAM,aAAa,CAAC,KAAK,CAAC,YAAY,EAAE,QAAQ,CAAC,CAAC;QAClD,OAAO,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC;IACzB,CAAC;IAED,MAAM,aAAa,GAAG,MAAM,qBAAqB,CAC/C,KAAK,CAAC,YAAY,EAClB,KAAK,CAAC,KAAK,CACZ,CAAC;IACF,MAAM,KAAK,GAAG,IAAA,qCAAuB,EAAC;QACpC,YAAY,EAAE,KAAK,CAAC,YAAY;QAChC,IAAI,EAAE,QAAQ;QACd,QAAQ,EAAE,aAAa;QACvB,KAAK,EAAE,KAAK,CAAC,KAAK;KACnB,CAAC,CAAC;IACH,OAAO,MAAM,CAAC,MAAM,CAAC;QACnB,KAAK;QACL,OAAO,EAAE,MAAM,CAAC,MAAM,CAAC,OAAO,CAAC;QAC/B,MAAM;QACN,IAAI;QACJ,OAAO,EAAE,KAAK,CAAC,MAAM,KAAK,OAAO,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,uBAAuB;KACxE,CAAC,CAAC;AACL,CAAC;AAEM,KAAK,UAAU,wBAAwB,CAAC,KAK9C;IACC,IAAI,KAAK,CAAC,MAAM,KAAK,QAAQ,EAAE,CAAC;QAC9B,OAAO,MAAM,CAAC,MAAM,CAAC;YACnB,MAAM,EAAE,KAAK,CAAC,MAAM;YACpB,QAAQ,EAAE,IAAI;YACd,QAAQ,EAAE,EAAE;YACZ,KAAK,EAAE,IAAI;SACZ,CAAC,CAAC;IACL,CAAC;IAED,MAAM,QAAQ,GAAG,MAAM,qBAAqB,CAAC,KAAK,CAAC,YAAY,EAAE,KAAK,CAAC,KAAK,CAAC,CAAC;IAC9E,MAAM,MAAM,GAAG,IAAA,qCAAuB,EAAC;QACrC,YAAY,EAAE,KAAK,CAAC,YAAY;QAChC,QAAQ;QACR,KAAK,EAAE,KAAK,CAAC,KAAK;KACnB,CAAC,CAAC;IACH,OAAO,MAAM,CAAC,MAAM,CAAC;QACnB,GAAG,MAAM;QACT,MAAM,EAAE,KAAK,CAAC,MAAM;QACpB,QAAQ,EAAE,KAAK;KAChB,CAAC,CAAC;AACL,CAAC;AAED,MAAM,eAAe,GAAG,IAAI,GAAG,CAAC,CAAC,aAAa,EAAE,SAAS,EAAE,YAAY,CAAC,CAAC,CAAC;AAC1E,MAAM,kBAAkB,GAAG,6BAA6B,CAAC;AAEzD,SAAS,8BAA8B,CACrC,aAAmD,EACnD,WAAmB,EACnB,KAA4B;IAE5B,IACE,aAAa,CAAC,QAAQ,KAAK,IAAI;QAC/B,aAAa,CAAC,SAAS,KAAK,2BAA2B;QACvD,aAAa,CAAC,WAAW,KAAK,WAAW;QACzC,aAAa,CAAC,KAAK,KAAK,KAAK,CAAC,KAAK;QACnC,CAAC,eAAe,CAAC,GAAG,CAAC,KAAK,CAAC,KAAK,CAAC,EACjC,CAAC;QACD,MAAM,IAAI,+BAA+B,CACvC,8CAA8C,EAC9C,WAAW,CACZ,CAAC;IACJ,CAAC;AACH,CAAC;AAED,SAAS,qBAAqB,CAC5B,QAAgC,EAChC,WAAmB,EACnB,KAA4B;IAE5B,OAAO,CACL,QAAQ,CAAC,IAAI,KAAK,IAAA,sCAA2B,EAAC,KAAK,EAAE,WAAW,CAAC;QACjE,QAAQ,CAAC,IAAI,CAAC,mCAAwB,CAAC,SAAS,CAAC,KAAK,KAAK,CAAC,SAAS;QACrE,QAAQ,CAAC,IAAI,CAAC,mCAAwB,CAAC,KAAK,CAAC,KAAK,KAAK,CAAC,KAAK;QAC7D,QAAQ,CAAC,IAAI,CAAC,mCAAwB,CAAC,KAAK,CAAC,KAAK,KAAK,CAAC,KAAK;QAC7D,QAAQ,CAAC,IAAI,CAAC,mCAAwB,CAAC,WAAW,CAAC,KAAK,WAAW;QACnE,QAAQ,CAAC,IAAI,CAAC,mCAAwB,CAAC,UAAU,CAAC;YAChD,2CAAgC,CACnC,CAAC;AACJ,CAAC;AAEM,KAAK,UAAU,2BAA2B,CAC/C,KAeK;IAEL,IAAI,CAAC,kBAAkB,CAAC,IAAI,CAAC,KAAK,CAAC,WAAW,CAAC,EAAE,CAAC;QAChD,MAAM,IAAI,+BAA+B,CACvC,8CAA8C,EAC9C,WAAW,CACZ,CAAC;IACJ,CAAC;IACD,8BAA8B,CAC5B,KAAK,CAAC,aAAa,EACnB,KAAK,CAAC,WAAW,EACjB,KAAK,CAAC,KAAK,CACZ,CAAC;IACF,IACE,KAAK,CAAC,MAAM,KAAK,QAAQ;QACzB,CAAC,CAAC,MAAM,CAAC,aAAa,CAAC,KAAK,CAAC,kBAAkB,CAAC;YAC9C,KAAK,CAAC,kBAAkB,GAAG,CAAC;YAC5B,KAAK,CAAC,kBAAkB,GAAG,EAAE,CAAC,EAChC,CAAC;QACD,MAAM,IAAI,+BAA+B,CACvC,8CAA8C,EAC9C,QAAQ,CACT,CAAC;IACJ,CAAC;IAED,MAAM,QAAQ,GAAG,MAAM,qBAAqB,CAC1C,KAAK,CAAC,YAAY,EAClB,KAAK,CAAC,KAAK,EACX,EAAE,sBAAsB,EAAE,IAAI,EAAE,CACjC,CAAC;IACF,MAAM,OAAO,GAAG,QAAQ,CAAC,MAAM,CAAC,CAAC,MAAM,EAAE,EAAE,CACzC,qBAAqB,CAAC,MAAM,EAAE,KAAK,CAAC,WAAW,EAAE,KAAK,CAAC,KAAK,CAAC,CAC9D,CAAC;IACF,IAAI,OAAO,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QACzB,MAAM,IAAI,+BAA+B,CACvC,wCAAwC,EACxC,WAAW,CACZ,CAAC;IACJ,CAAC;IACD,MAAM,aAAa,GAAG,OAAO,CAAC,CAAC,CAAC,CAAC;IACjC,IAAI,aAAa,KAAK,SAAS,EAAE,CAAC;QAChC,MAAM,IAAI,+BAA+B,CACvC,wCAAwC,EACxC,WAAW,CACZ,CAAC;IACJ,CAAC;IAED,IAAI,CAAC;QACH,IAAI,KAAK,CAAC,MAAM,KAAK,SAAS,EAAE,CAAC;YAC/B,MAAM,KAAK,CAAC,YAAY,CAAC,OAAO,CAAC,EAAE,GAAG,EAAE,aAAa,CAAC,GAAG,EAAE,CAAC,CAAC;YAC7D,OAAO,MAAM,CAAC,MAAM,CAAC;gBACnB,MAAM,EAAE,KAAK,CAAC,MAAM;gBACpB,WAAW,EAAE,KAAK,CAAC,WAAW;gBAC9B,OAAO,EAAE,UAAU;gBACnB,KAAK,EAAE,KAAK,CAAC,KAAK,CAAC,KAAK;aACzB,CAAC,CAAC;QACL,CAAC;QAED,MAAM,SAAS,GAAG,MAAM,KAAK,CAAC,YAAY,CAAC,kBAAkB,CAAC;YAC5D,GAAG,EAAE,aAAa,CAAC,GAAG;YACtB,kBAAkB,EAAE,KAAK,CAAC,kBAAkB;SAC7C,CAAC,CAAC;QACH,IACE,OAAO,SAAS,CAAC,aAAa,KAAK,QAAQ;YAC3C,MAAM,CAAC,KAAK,CAAC,IAAI,CAAC,KAAK,CAAC,SAAS,CAAC,aAAa,CAAC,CAAC,EACjD,CAAC;YACD,MAAM,IAAI,+BAA+B,CACvC,8CAA8C,EAC9C,QAAQ,CACT,CAAC;QACJ,CAAC;QACD,OAAO,MAAM,CAAC,MAAM,CAAC;YACnB,MAAM,EAAE,KAAK,CAAC,MAAM;YACpB,WAAW,EAAE,KAAK,CAAC,WAAW;YAC9B,OAAO,EAAE,WAAW;YACpB,aAAa,EAAE,SAAS,CAAC,aAAa;YACtC,kBAAkB,EAAE,KAAK,CAAC,kBAAkB;YAC5C,KAAK,EAAE,KAAK,CAAC,KAAK,CAAC,KAAK;SACzB,CAAC,CAAC;IACL,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,MAAM,qBAAqB,CACzB,KAAK,EACL,8CAA8C,EAC9C,KAAK,CAAC,MAAM,CACb,CAAC;IACJ,CAAC;AACH,CAAC"}

package/src/secrets/permissions.d.ts

@@ -0,0 +1,34 @@
+export declare const SECRET_VALUE_READ_ACTION: "secretsmanager:GetSecretValue";
+export interface WorkloadSecretReferenceInput {
+    logicalName: string;
+    provider: 'aws-secrets-manager';
+    secretArn: string;
+}
+export interface WorkloadSecretLinkIntent {
+    link: {
+        properties: {
+            logicalName: string;
+            provider: 'aws-secrets-manager';
+            secretArn: string;
+        };
+        resourceName: string;
+    };
+    permission: {
+        Action: readonly [typeof SECRET_VALUE_READ_ACTION];
+        Effect: 'Allow';
+        Resource: readonly [string];
+    };
+}
+export interface WorkloadSecretPermissionIntent {
+    links: readonly WorkloadSecretLinkIntent[];
+    workload: string;
+}
+export interface SecretPermissionValidationIssue {
+    code: 'action-not-exact' | 'duplicate-reference' | 'effect-not-allow' | 'link-mismatch' | 'resource-not-exact';
+    logicalName?: string;
+}
+export declare function createWorkloadSecretPermissionIntent(input: {
+    references: readonly WorkloadSecretReferenceInput[];
+    workload: string;
+}): WorkloadSecretPermissionIntent;
+export declare function validateWorkloadSecretPermissionIntent(intent: WorkloadSecretPermissionIntent): readonly SecretPermissionValidationIssue[];

package/src/secrets/permissions.js

@@ -0,0 +1,86 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.SECRET_VALUE_READ_ACTION = void 0;
+exports.createWorkloadSecretPermissionIntent = createWorkloadSecretPermissionIntent;
+exports.validateWorkloadSecretPermissionIntent = validateWorkloadSecretPermissionIntent;
+const deterministic_order_js_1 = require("../deterministic-order.js");
+const model_js_1 = require("./model.js");
+exports.SECRET_VALUE_READ_ACTION = 'secretsmanager:GetSecretValue';
+const logicalNamePattern = /^[A-Za-z][A-Za-z0-9]{0,63}$/;
+const workloadPattern = /^[a-z0-9][a-z0-9._-]{0,127}$/;
+function validateReference(reference) {
+    if (reference.provider !== 'aws-secrets-manager' ||
+        !logicalNamePattern.test(reference.logicalName) ||
+        !(0, model_js_1.isExactSecretArn)(reference.secretArn)) {
+        throw new Error('Invalid reference-only secret intent.');
+    }
+}
+function createWorkloadSecretPermissionIntent(input) {
+    if (!workloadPattern.test(input.workload)) {
+        throw new Error('Secret workload identity must be normalized.');
+    }
+    const logicalNames = new Set();
+    const arns = new Set();
+    const links = input.references
+        .map((reference) => {
+        validateReference(reference);
+        if (logicalNames.has(reference.logicalName) ||
+            arns.has(reference.secretArn)) {
+            throw new Error('Duplicate secret reference.');
+        }
+        logicalNames.add(reference.logicalName);
+        arns.add(reference.secretArn);
+        return Object.freeze({
+            link: Object.freeze({
+                properties: Object.freeze({
+                    logicalName: reference.logicalName,
+                    provider: 'aws-secrets-manager',
+                    secretArn: reference.secretArn,
+                }),
+                resourceName: reference.logicalName,
+            }),
+            permission: Object.freeze({
+                Action: [exports.SECRET_VALUE_READ_ACTION],
+                Effect: 'Allow',
+                Resource: [reference.secretArn],
+            }),
+        });
+    })
+        .sort((left, right) => (0, deterministic_order_js_1.compareUtf16)(left.link.properties.logicalName, right.link.properties.logicalName));
+    return Object.freeze({
+        links: Object.freeze(links),
+        workload: input.workload,
+    });
+}
+function validateWorkloadSecretPermissionIntent(intent) {
+    const issues = [];
+    const logicalNames = new Set();
+    const arns = new Set();
+    for (const item of intent.links) {
+        const logicalName = item.link.properties.logicalName;
+        const secretArn = item.link.properties.secretArn;
+        if (logicalNames.has(logicalName) || arns.has(secretArn)) {
+            issues.push({ code: 'duplicate-reference', logicalName });
+        }
+        logicalNames.add(logicalName);
+        arns.add(secretArn);
+        if (item.permission.Effect !== 'Allow') {
+            issues.push({ code: 'effect-not-allow', logicalName });
+        }
+        if (item.permission.Action.length !== 1 ||
+            item.permission.Action[0] !== exports.SECRET_VALUE_READ_ACTION) {
+            issues.push({ code: 'action-not-exact', logicalName });
+        }
+        if (item.permission.Resource.length !== 1 ||
+            item.permission.Resource[0] !== secretArn ||
+            !(0, model_js_1.isExactSecretArn)(secretArn)) {
+            issues.push({ code: 'resource-not-exact', logicalName });
+        }
+        if (item.link.properties.provider !== 'aws-secrets-manager' ||
+            item.link.resourceName !== logicalName) {
+            issues.push({ code: 'link-mismatch', logicalName });
+        }
+    }
+    return Object.freeze(issues);
+}
+//# sourceMappingURL=permissions.js.map

package/src/secrets/permissions.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"permissions.js","sourceRoot":"","sources":["../../../../../packages/nx/src/secrets/permissions.ts"],"names":[],"mappings":";;;AAwDA,oFAgDC;AAED,wFAyCC;AAnJD,sEAAyD;AACzD,yCAA8C;AAEjC,QAAA,wBAAwB,GACnC,+BAAwC,CAAC;AAuC3C,MAAM,kBAAkB,GAAG,6BAA6B,CAAC;AACzD,MAAM,eAAe,GAAG,8BAA8B,CAAC;AAEvD,SAAS,iBAAiB,CAAC,SAAuC;IAChE,IACE,SAAS,CAAC,QAAQ,KAAK,qBAAqB;QAC5C,CAAC,kBAAkB,CAAC,IAAI,CAAC,SAAS,CAAC,WAAW,CAAC;QAC/C,CAAC,IAAA,2BAAgB,EAAC,SAAS,CAAC,SAAS,CAAC,EACtC,CAAC;QACD,MAAM,IAAI,KAAK,CAAC,uCAAuC,CAAC,CAAC;IAC3D,CAAC;AACH,CAAC;AAED,SAAgB,oCAAoC,CAAC,KAGpD;IACC,IAAI,CAAC,eAAe,CAAC,IAAI,CAAC,KAAK,CAAC,QAAQ,CAAC,EAAE,CAAC;QAC1C,MAAM,IAAI,KAAK,CAAC,8CAA8C,CAAC,CAAC;IAClE,CAAC;IAED,MAAM,YAAY,GAAG,IAAI,GAAG,EAAU,CAAC;IACvC,MAAM,IAAI,GAAG,IAAI,GAAG,EAAU,CAAC;IAC/B,MAAM,KAAK,GAAG,KAAK,CAAC,UAAU;SAC3B,GAAG,CAAC,CAAC,SAAS,EAA4B,EAAE;QAC3C,iBAAiB,CAAC,SAAS,CAAC,CAAC;QAC7B,IACE,YAAY,CAAC,GAAG,CAAC,SAAS,CAAC,WAAW,CAAC;YACvC,IAAI,CAAC,GAAG,CAAC,SAAS,CAAC,SAAS,CAAC,EAC7B,CAAC;YACD,MAAM,IAAI,KAAK,CAAC,6BAA6B,CAAC,CAAC;QACjD,CAAC;QACD,YAAY,CAAC,GAAG,CAAC,SAAS,CAAC,WAAW,CAAC,CAAC;QACxC,IAAI,CAAC,GAAG,CAAC,SAAS,CAAC,SAAS,CAAC,CAAC;QAC9B,OAAO,MAAM,CAAC,MAAM,CAAC;YACnB,IAAI,EAAE,MAAM,CAAC,MAAM,CAAC;gBAClB,UAAU,EAAE,MAAM,CAAC,MAAM,CAAC;oBACxB,WAAW,EAAE,SAAS,CAAC,WAAW;oBAClC,QAAQ,EAAE,qBAA8B;oBACxC,SAAS,EAAE,SAAS,CAAC,SAAS;iBAC/B,CAAC;gBACF,YAAY,EAAE,SAAS,CAAC,WAAW;aACpC,CAAC;YACF,UAAU,EAAE,MAAM,CAAC,MAAM,CAAC;gBACxB,MAAM,EAAE,CAAC,gCAAwB,CAAU;gBAC3C,MAAM,EAAE,OAAgB;gBACxB,QAAQ,EAAE,CAAC,SAAS,CAAC,SAAS,CAAU;aACzC,CAAC;SACH,CAAC,CAAC;IACL,CAAC,CAAC;SACD,IAAI,CAAC,CAAC,IAAI,EAAE,KAAK,EAAE,EAAE,CACpB,IAAA,qCAAY,EACV,IAAI,CAAC,IAAI,CAAC,UAAU,CAAC,WAAW,EAChC,KAAK,CAAC,IAAI,CAAC,UAAU,CAAC,WAAW,CAClC,CACF,CAAC;IAEJ,OAAO,MAAM,CAAC,MAAM,CAAC;QACnB,KAAK,EAAE,MAAM,CAAC,MAAM,CAAC,KAAK,CAAC;QAC3B,QAAQ,EAAE,KAAK,CAAC,QAAQ;KACzB,CAAC,CAAC;AACL,CAAC;AAED,SAAgB,sCAAsC,CACpD,MAAsC;IAEtC,MAAM,MAAM,GAAsC,EAAE,CAAC;IACrD,MAAM,YAAY,GAAG,IAAI,GAAG,EAAU,CAAC;IACvC,MAAM,IAAI,GAAG,IAAI,GAAG,EAAU,CAAC;IAE/B,KAAK,MAAM,IAAI,IAAI,MAAM,CAAC,KAAK,EAAE,CAAC;QAChC,MAAM,WAAW,GAAG,IAAI,CAAC,IAAI,CAAC,UAAU,CAAC,WAAW,CAAC;QACrD,MAAM,SAAS,GAAG,IAAI,CAAC,IAAI,CAAC,UAAU,CAAC,SAAS,CAAC;QACjD,IAAI,YAAY,CAAC,GAAG,CAAC,WAAW,CAAC,IAAI,IAAI,CAAC,GAAG,CAAC,SAAS,CAAC,EAAE,CAAC;YACzD,MAAM,CAAC,IAAI,CAAC,EAAE,IAAI,EAAE,qBAAqB,EAAE,WAAW,EAAE,CAAC,CAAC;QAC5D,CAAC;QACD,YAAY,CAAC,GAAG,CAAC,WAAW,CAAC,CAAC;QAC9B,IAAI,CAAC,GAAG,CAAC,SAAS,CAAC,CAAC;QAEpB,IAAI,IAAI,CAAC,UAAU,CAAC,MAAM,KAAK,OAAO,EAAE,CAAC;YACvC,MAAM,CAAC,IAAI,CAAC,EAAE,IAAI,EAAE,kBAAkB,EAAE,WAAW,EAAE,CAAC,CAAC;QACzD,CAAC;QACD,IACE,IAAI,CAAC,UAAU,CAAC,MAAM,CAAC,MAAM,KAAK,CAAC;YACnC,IAAI,CAAC,UAAU,CAAC,MAAM,CAAC,CAAC,CAAC,KAAK,gCAAwB,EACtD,CAAC;YACD,MAAM,CAAC,IAAI,CAAC,EAAE,IAAI,EAAE,kBAAkB,EAAE,WAAW,EAAE,CAAC,CAAC;QACzD,CAAC;QACD,IACE,IAAI,CAAC,UAAU,CAAC,QAAQ,CAAC,MAAM,KAAK,CAAC;YACrC,IAAI,CAAC,UAAU,CAAC,QAAQ,CAAC,CAAC,CAAC,KAAK,SAAS;YACzC,CAAC,IAAA,2BAAgB,EAAC,SAAS,CAAC,EAC5B,CAAC;YACD,MAAM,CAAC,IAAI,CAAC,EAAE,IAAI,EAAE,oBAAoB,EAAE,WAAW,EAAE,CAAC,CAAC;QAC3D,CAAC;QACD,IACE,IAAI,CAAC,IAAI,CAAC,UAAU,CAAC,QAAQ,KAAK,qBAAqB;YACvD,IAAI,CAAC,IAAI,CAAC,YAAY,KAAK,WAAW,EACtC,CAAC;YACD,MAAM,CAAC,IAAI,CAAC,EAAE,IAAI,EAAE,eAAe,EAAE,WAAW,EAAE,CAAC,CAAC;QACtD,CAAC;IACH,CAAC;IAED,OAAO,MAAM,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC;AAC/B,CAAC"}