@empire-builder-kit/nx 1.0.0-beta.9 → 1.0.0-rc.2

package/src/secrets/personal-command.d.ts

@@ -0,0 +1,83 @@
+import { type SecretMetadataDeclaration } from './model.js';
+declare const HUMAN_SECRET_CEREMONY: unique symbol;
+export interface HumanSecretCeremony {
+    readonly [HUMAN_SECRET_CEREMONY]: true;
+    actor: 'human';
+    agentDelegated: boolean;
+    interactive: boolean;
+    stdinIsTty: boolean;
+}
+export interface HiddenSecretInputReader {
+    readHidden(input: {
+        logicalName: string;
+        prompt: string;
+    }): Promise<Uint8Array>;
+}
+export interface PersonalSecretValueValidator {
+    validate(input: {
+        bytes: Uint8Array;
+        valueKind: SecretMetadataDeclaration['valueKind'];
+    }): boolean | Promise<boolean>;
+}
+export interface PersonalSstSecretStore {
+    /**
+     * The implementation must consume the bytes before this promise resolves.
+     * It must use hidden stdin or an equivalent in-process channel, never argv.
+     */
+    setFromHiddenInput(input: {
+        logicalName: string;
+        stage: string;
+        valueKind: SecretMetadataDeclaration['valueKind'];
+    }, bytes: Uint8Array): Promise<void>;
+    remove(input: {
+        logicalName: string;
+        stage: string;
+    }): Promise<void>;
+}
+export interface PersonalSecretConfirmation {
+    confirm(input: {
+        action: 'remove';
+        logicalName: string;
+        stage: string;
+    }): Promise<boolean>;
+}
+export interface PersonalSecretCommandResult {
+    action: 'remove' | 'set';
+    logicalName: string;
+    outcome: 'success';
+    stage: string;
+}
+export declare class PersonalSecretCommandError extends Error {
+    readonly code: 'personal-secret-account-invalid' | 'personal-secret-command-invalid' | 'personal-secret-confirmation-required' | 'personal-secret-hidden-input-failed' | 'personal-secret-human-required' | 'personal-secret-stage-invalid' | 'personal-secret-store-failed' | 'personal-secret-value-invalid';
+    constructor(code: PersonalSecretCommandError['code']);
+}
+interface PersonalSecretEnvironment {
+    accountId: string;
+    ceremony: HumanSecretCeremony;
+    declaration: SecretMetadataDeclaration;
+    developmentAccountId: string;
+    mode: 'sst-dev';
+    stage: string;
+    store: PersonalSstSecretStore;
+}
+export interface SetPersonalSecretInput extends PersonalSecretEnvironment {
+    hiddenInput: HiddenSecretInputReader;
+    validator: PersonalSecretValueValidator;
+}
+export interface RemovePersonalSecretInput extends PersonalSecretEnvironment {
+    confirmation: PersonalSecretConfirmation;
+}
+/**
+ * Issues the in-process capability used by the CLI after it has inspected the
+ * terminal and agent/CI environment. This module is intentionally not part of
+ * the public `@empire-builder-kit/nx/secrets` surface.
+ */
+export declare function issueHumanSecretCeremony(input: {
+    agentDelegated: boolean;
+    interactive: boolean;
+    stdinIsTty: boolean;
+}): HumanSecretCeremony;
+export declare function assertHumanSecretCeremony(ceremony: HumanSecretCeremony): void;
+export declare function setPersonalSstSecret(input: SetPersonalSecretInput): Promise<PersonalSecretCommandResult>;
+export declare function removePersonalSstSecret(input: RemovePersonalSecretInput): Promise<PersonalSecretCommandResult>;
+export {};

package/src/secrets/personal-command.js

@@ -0,0 +1,197 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.PersonalSecretCommandError = void 0;
+exports.issueHumanSecretCeremony = issueHumanSecretCeremony;
+exports.assertHumanSecretCeremony = assertHumanSecretCeremony;
+exports.setPersonalSstSecret = setPersonalSstSecret;
+exports.removePersonalSstSecret = removePersonalSstSecret;
+const stages_js_1 = require("../foundation/stages.js");
+const model_js_1 = require("./model.js");
+const HUMAN_SECRET_CEREMONY = Symbol('ebk.human-secret-ceremony');
+class PersonalSecretCommandError extends Error {
+    code;
+    constructor(code) {
+        super(`Personal secret command failed (${code}).`);
+        this.name = 'PersonalSecretCommandError';
+        this.code = code;
+    }
+}
+exports.PersonalSecretCommandError = PersonalSecretCommandError;
+const accountPattern = /^\d{12}$/;
+const maximumPersonalSecretBytes = 64 * 1024;
+function rejectUnexpectedProperties(input, allowed) {
+    if (Object.keys(input).some((key) => !allowed.includes(key))) {
+        throw new PersonalSecretCommandError('personal-secret-command-invalid');
+    }
+}
+function validateEnvironment(input) {
+    try {
+        (0, model_js_1.validateSecretMetadataDeclaration)(input.declaration);
+    }
+    catch {
+        throw new PersonalSecretCommandError('personal-secret-command-invalid');
+    }
+    if (input.declaration.source !== 'operator' || input.mode !== 'sst-dev') {
+        throw new PersonalSecretCommandError('personal-secret-command-invalid');
+    }
+    if (!(0, stages_js_1.isPersonalStage)(input.stage)) {
+        throw new PersonalSecretCommandError('personal-secret-stage-invalid');
+    }
+    if (!accountPattern.test(input.accountId) ||
+        !accountPattern.test(input.developmentAccountId) ||
+        input.accountId !== input.developmentAccountId) {
+        throw new PersonalSecretCommandError('personal-secret-account-invalid');
+    }
+    assertHumanSecretCeremony(input.ceremony);
+}
+/**
+ * Issues the in-process capability used by the CLI after it has inspected the
+ * terminal and agent/CI environment. This module is intentionally not part of
+ * the public `@empire-builder-kit/nx/secrets` surface.
+ */
+function issueHumanSecretCeremony(input) {
+    if (typeof input.agentDelegated !== 'boolean' ||
+        typeof input.interactive !== 'boolean' ||
+        typeof input.stdinIsTty !== 'boolean') {
+        throw new PersonalSecretCommandError('personal-secret-human-required');
+    }
+    const ceremony = {
+        actor: 'human',
+        agentDelegated: input.agentDelegated,
+        interactive: input.interactive,
+        stdinIsTty: input.stdinIsTty,
+    };
+    Object.defineProperty(ceremony, HUMAN_SECRET_CEREMONY, {
+        configurable: false,
+        enumerable: false,
+        value: true,
+        writable: false,
+    });
+    return Object.freeze(ceremony);
+}
+function assertHumanSecretCeremony(ceremony) {
+    if (typeof ceremony !== 'object' ||
+        ceremony === null ||
+        ceremony[HUMAN_SECRET_CEREMONY] !== true ||
+        ceremony.actor !== 'human' ||
+        ceremony.agentDelegated ||
+        !ceremony.interactive ||
+        !ceremony.stdinIsTty) {
+        throw new PersonalSecretCommandError('personal-secret-human-required');
+    }
+}
+async function setPersonalSstSecret(input) {
+    rejectUnexpectedProperties(input, [
+        'accountId',
+        'ceremony',
+        'declaration',
+        'developmentAccountId',
+        'hiddenInput',
+        'mode',
+        'stage',
+        'store',
+        'validator',
+    ]);
+    validateEnvironment(input);
+    let bytes;
+    try {
+        bytes = await input.hiddenInput.readHidden({
+            logicalName: input.declaration.logicalName,
+            prompt: `Enter ${input.declaration.logicalName}`,
+        });
+    }
+    catch {
+        throw new PersonalSecretCommandError('personal-secret-hidden-input-failed');
+    }
+    if (!ArrayBuffer.isView(bytes) ||
+        typeof bytes.BYTES_PER_ELEMENT !== 'number' ||
+        bytes.BYTES_PER_ELEMENT !== 1) {
+        throw new PersonalSecretCommandError('personal-secret-hidden-input-failed');
+    }
+    try {
+        if (bytes.byteLength === 0 ||
+            bytes.byteLength > maximumPersonalSecretBytes) {
+            throw new PersonalSecretCommandError('personal-secret-value-invalid');
+        }
+        const validationCopy = new Uint8Array(bytes);
+        try {
+            if (!(await input.validator.validate({
+                bytes: validationCopy,
+                valueKind: input.declaration.valueKind,
+            }))) {
+                throw new PersonalSecretCommandError('personal-secret-value-invalid');
+            }
+        }
+        catch (error) {
+            if (error instanceof PersonalSecretCommandError) {
+                throw error;
+            }
+            throw new PersonalSecretCommandError('personal-secret-value-invalid');
+        }
+        finally {
+            validationCopy.fill(0);
+        }
+        try {
+            await input.store.setFromHiddenInput({
+                logicalName: input.declaration.logicalName,
+                stage: input.stage,
+                valueKind: input.declaration.valueKind,
+            }, bytes);
+        }
+        catch {
+            throw new PersonalSecretCommandError('personal-secret-store-failed');
+        }
+    }
+    finally {
+        bytes.fill(0);
+    }
+    return Object.freeze({
+        action: 'set',
+        logicalName: input.declaration.logicalName,
+        outcome: 'success',
+        stage: input.stage,
+    });
+}
+async function removePersonalSstSecret(input) {
+    rejectUnexpectedProperties(input, [
+        'accountId',
+        'ceremony',
+        'confirmation',
+        'declaration',
+        'developmentAccountId',
+        'mode',
+        'stage',
+        'store',
+    ]);
+    validateEnvironment(input);
+    let confirmed;
+    try {
+        confirmed = await input.confirmation.confirm({
+            action: 'remove',
+            logicalName: input.declaration.logicalName,
+            stage: input.stage,
+        });
+    }
+    catch {
+        throw new PersonalSecretCommandError('personal-secret-confirmation-required');
+    }
+    if (!confirmed) {
+        throw new PersonalSecretCommandError('personal-secret-confirmation-required');
+    }
+    try {
+        await input.store.remove({
+            logicalName: input.declaration.logicalName,
+            stage: input.stage,
+        });
+    }
+    catch {
+        throw new PersonalSecretCommandError('personal-secret-store-failed');
+    }
+    return Object.freeze({
+        action: 'remove',
+        logicalName: input.declaration.logicalName,
+        outcome: 'success',
+        stage: input.stage,
+    });
+}
+//# sourceMappingURL=personal-command.js.map

package/src/secrets/personal-command.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"personal-command.js","sourceRoot":"","sources":["../../../../../packages/nx/src/secrets/personal-command.ts"],"names":[],"mappings":";;;AAyIA,4DAyBC;AAED,8DAYC;AAED,oDAiFC;AAED,0DA+CC;AApTD,uDAA0D;AAC1D,yCAGoB;AAEpB,MAAM,qBAAqB,GAAG,MAAM,CAAC,2BAA2B,CAAC,CAAC;AAuDlE,MAAa,0BAA2B,SAAQ,KAAK;IAC1C,IAAI,CAQuB;IAEpC,YAAY,IAAwC;QAClD,KAAK,CAAC,mCAAmC,IAAI,IAAI,CAAC,CAAC;QACnD,IAAI,CAAC,IAAI,GAAG,4BAA4B,CAAC;QACzC,IAAI,CAAC,IAAI,GAAG,IAAI,CAAC;IACnB,CAAC;CACF;AAhBD,gEAgBC;AAqBD,MAAM,cAAc,GAAG,UAAU,CAAC;AAClC,MAAM,0BAA0B,GAAG,EAAE,GAAG,IAAI,CAAC;AAE7C,SAAS,0BAA0B,CACjC,KAAa,EACb,OAA0B;IAE1B,IAAI,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,IAAI,CAAC,CAAC,GAAG,EAAE,EAAE,CAAC,CAAC,OAAO,CAAC,QAAQ,CAAC,GAAG,CAAC,CAAC,EAAE,CAAC;QAC7D,MAAM,IAAI,0BAA0B,CAAC,iCAAiC,CAAC,CAAC;IAC1E,CAAC;AACH,CAAC;AAED,SAAS,mBAAmB,CAAC,KAAgC;IAC3D,IAAI,CAAC;QACH,IAAA,4CAAiC,EAAC,KAAK,CAAC,WAAW,CAAC,CAAC;IACvD,CAAC;IAAC,MAAM,CAAC;QACP,MAAM,IAAI,0BAA0B,CAAC,iCAAiC,CAAC,CAAC;IAC1E,CAAC;IACD,IAAI,KAAK,CAAC,WAAW,CAAC,MAAM,KAAK,UAAU,IAAI,KAAK,CAAC,IAAI,KAAK,SAAS,EAAE,CAAC;QACxE,MAAM,IAAI,0BAA0B,CAAC,iCAAiC,CAAC,CAAC;IAC1E,CAAC;IACD,IAAI,CAAC,IAAA,2BAAe,EAAC,KAAK,CAAC,KAAK,CAAC,EAAE,CAAC;QAClC,MAAM,IAAI,0BAA0B,CAAC,+BAA+B,CAAC,CAAC;IACxE,CAAC;IACD,IACE,CAAC,cAAc,CAAC,IAAI,CAAC,KAAK,CAAC,SAAS,CAAC;QACrC,CAAC,cAAc,CAAC,IAAI,CAAC,KAAK,CAAC,oBAAoB,CAAC;QAChD,KAAK,CAAC,SAAS,KAAK,KAAK,CAAC,oBAAoB,EAC9C,CAAC;QACD,MAAM,IAAI,0BAA0B,CAAC,iCAAiC,CAAC,CAAC;IAC1E,CAAC;IACD,yBAAyB,CAAC,KAAK,CAAC,QAAQ,CAAC,CAAC;AAC5C,CAAC;AAED;;;;GAIG;AACH,SAAgB,wBAAwB,CAAC,KAIxC;IACC,IACE,OAAO,KAAK,CAAC,cAAc,KAAK,SAAS;QACzC,OAAO,KAAK,CAAC,WAAW,KAAK,SAAS;QACtC,OAAO,KAAK,CAAC,UAAU,KAAK,SAAS,EACrC,CAAC;QACD,MAAM,IAAI,0BAA0B,CAAC,gCAAgC,CAAC,CAAC;IACzE,CAAC;IACD,MAAM,QAAQ,GAAG;QACf,KAAK,EAAE,OAAgB;QACvB,cAAc,EAAE,KAAK,CAAC,cAAc;QACpC,WAAW,EAAE,KAAK,CAAC,WAAW;QAC9B,UAAU,EAAE,KAAK,CAAC,UAAU;KACN,CAAC;IACzB,MAAM,CAAC,cAAc,CAAC,QAAQ,EAAE,qBAAqB,EAAE;QACrD,YAAY,EAAE,KAAK;QACnB,UAAU,EAAE,KAAK;QACjB,KAAK,EAAE,IAAI;QACX,QAAQ,EAAE,KAAK;KAChB,CAAC,CAAC;IACH,OAAO,MAAM,CAAC,MAAM,CAAC,QAAQ,CAAC,CAAC;AACjC,CAAC;AAED,SAAgB,yBAAyB,CAAC,QAA6B;IACrE,IACE,OAAO,QAAQ,KAAK,QAAQ;QAC5B,QAAQ,KAAK,IAAI;QACjB,QAAQ,CAAC,qBAAqB,CAAC,KAAK,IAAI;QACxC,QAAQ,CAAC,KAAK,KAAK,OAAO;QAC1B,QAAQ,CAAC,cAAc;QACvB,CAAC,QAAQ,CAAC,WAAW;QACrB,CAAC,QAAQ,CAAC,UAAU,EACpB,CAAC;QACD,MAAM,IAAI,0BAA0B,CAAC,gCAAgC,CAAC,CAAC;IACzE,CAAC;AACH,CAAC;AAEM,KAAK,UAAU,oBAAoB,CACxC,KAA6B;IAE7B,0BAA0B,CAAC,KAAK,EAAE;QAChC,WAAW;QACX,UAAU;QACV,aAAa;QACb,sBAAsB;QACtB,aAAa;QACb,MAAM;QACN,OAAO;QACP,OAAO;QACP,WAAW;KACZ,CAAC,CAAC;IACH,mBAAmB,CAAC,KAAK,CAAC,CAAC;IAE3B,IAAI,KAAiB,CAAC;IACtB,IAAI,CAAC;QACH,KAAK,GAAG,MAAM,KAAK,CAAC,WAAW,CAAC,UAAU,CAAC;YACzC,WAAW,EAAE,KAAK,CAAC,WAAW,CAAC,WAAW;YAC1C,MAAM,EAAE,SAAS,KAAK,CAAC,WAAW,CAAC,WAAW,EAAE;SACjD,CAAC,CAAC;IACL,CAAC;IAAC,MAAM,CAAC;QACP,MAAM,IAAI,0BAA0B,CAAC,qCAAqC,CAAC,CAAC;IAC9E,CAAC;IACD,IACE,CAAC,WAAW,CAAC,MAAM,CAAC,KAAK,CAAC;QAC1B,OAAO,KAAK,CAAC,iBAAiB,KAAK,QAAQ;QAC3C,KAAK,CAAC,iBAAiB,KAAK,CAAC,EAC7B,CAAC;QACD,MAAM,IAAI,0BAA0B,CAAC,qCAAqC,CAAC,CAAC;IAC9E,CAAC;IAED,IAAI,CAAC;QACH,IACE,KAAK,CAAC,UAAU,KAAK,CAAC;YACtB,KAAK,CAAC,UAAU,GAAG,0BAA0B,EAC7C,CAAC;YACD,MAAM,IAAI,0BAA0B,CAAC,+BAA+B,CAAC,CAAC;QACxE,CAAC;QACD,MAAM,cAAc,GAAG,IAAI,UAAU,CAAC,KAAK,CAAC,CAAC;QAC7C,IAAI,CAAC;YACH,IACE,CAAC,CAAC,MAAM,KAAK,CAAC,SAAS,CAAC,QAAQ,CAAC;gBAC/B,KAAK,EAAE,cAAc;gBACrB,SAAS,EAAE,KAAK,CAAC,WAAW,CAAC,SAAS;aACvC,CAAC,CAAC,EACH,CAAC;gBACD,MAAM,IAAI,0BAA0B,CAAC,+BAA+B,CAAC,CAAC;YACxE,CAAC;QACH,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,IAAI,KAAK,YAAY,0BAA0B,EAAE,CAAC;gBAChD,MAAM,KAAK,CAAC;YACd,CAAC;YACD,MAAM,IAAI,0BAA0B,CAAC,+BAA+B,CAAC,CAAC;QACxE,CAAC;gBAAS,CAAC;YACT,cAAc,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;QACzB,CAAC;QAED,IAAI,CAAC;YACH,MAAM,KAAK,CAAC,KAAK,CAAC,kBAAkB,CAClC;gBACE,WAAW,EAAE,KAAK,CAAC,WAAW,CAAC,WAAW;gBAC1C,KAAK,EAAE,KAAK,CAAC,KAAK;gBAClB,SAAS,EAAE,KAAK,CAAC,WAAW,CAAC,SAAS;aACvC,EACD,KAAK,CACN,CAAC;QACJ,CAAC;QAAC,MAAM,CAAC;YACP,MAAM,IAAI,0BAA0B,CAAC,8BAA8B,CAAC,CAAC;QACvE,CAAC;IACH,CAAC;YAAS,CAAC;QACT,KAAK,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;IAChB,CAAC;IAED,OAAO,MAAM,CAAC,MAAM,CAAC;QACnB,MAAM,EAAE,KAAK;QACb,WAAW,EAAE,KAAK,CAAC,WAAW,CAAC,WAAW;QAC1C,OAAO,EAAE,SAAS;QAClB,KAAK,EAAE,KAAK,CAAC,KAAK;KACnB,CAAC,CAAC;AACL,CAAC;AAEM,KAAK,UAAU,uBAAuB,CAC3C,KAAgC;IAEhC,0BAA0B,CAAC,KAAK,EAAE;QAChC,WAAW;QACX,UAAU;QACV,cAAc;QACd,aAAa;QACb,sBAAsB;QACtB,MAAM;QACN,OAAO;QACP,OAAO;KACR,CAAC,CAAC;IACH,mBAAmB,CAAC,KAAK,CAAC,CAAC;IAE3B,IAAI,SAAkB,CAAC;IACvB,IAAI,CAAC;QACH,SAAS,GAAG,MAAM,KAAK,CAAC,YAAY,CAAC,OAAO,CAAC;YAC3C,MAAM,EAAE,QAAQ;YAChB,WAAW,EAAE,KAAK,CAAC,WAAW,CAAC,WAAW;YAC1C,KAAK,EAAE,KAAK,CAAC,KAAK;SACnB,CAAC,CAAC;IACL,CAAC;IAAC,MAAM,CAAC;QACP,MAAM,IAAI,0BAA0B,CAClC,uCAAuC,CACxC,CAAC;IACJ,CAAC;IACD,IAAI,CAAC,SAAS,EAAE,CAAC;QACf,MAAM,IAAI,0BAA0B,CAClC,uCAAuC,CACxC,CAAC;IACJ,CAAC;IAED,IAAI,CAAC;QACH,MAAM,KAAK,CAAC,KAAK,CAAC,MAAM,CAAC;YACvB,WAAW,EAAE,KAAK,CAAC,WAAW,CAAC,WAAW;YAC1C,KAAK,EAAE,KAAK,CAAC,KAAK;SACnB,CAAC,CAAC;IACL,CAAC;IAAC,MAAM,CAAC;QACP,MAAM,IAAI,0BAA0B,CAAC,8BAA8B,CAAC,CAAC;IACvE,CAAC;IACD,OAAO,MAAM,CAAC,MAAM,CAAC;QACnB,MAAM,EAAE,QAAQ;QAChB,WAAW,EAAE,KAAK,CAAC,WAAW,CAAC,WAAW;QAC1C,OAAO,EAAE,SAAS;QAClB,KAAK,EAAE,KAAK,CAAC,KAAK;KACnB,CAAC,CAAC;AACL,CAAC"}

package/src/secrets/personal-ledger.d.ts

@@ -0,0 +1,21 @@
+export declare const PERSONAL_SECRET_LEDGER_SCHEMA_VERSION: 1;
+export declare const PERSONAL_SECRET_LEDGER_MAX_LOGICAL_NAMES: 512;
+export declare const SST_SECRET_REMOVE_OUTPUT_MAX_BYTES: 4096;
+export interface PersonalSecretLedgerIdentity {
+    accountId: string;
+    region: string;
+    slice: string;
+    sstApp: string;
+    stage: string;
+}
+export interface PersonalSecretLedgerRecord extends PersonalSecretLedgerIdentity {
+    logicalNames: readonly string[];
+    schemaVersion: typeof PERSONAL_SECRET_LEDGER_SCHEMA_VERSION;
+}
+export declare class PersonalSecretLedgerError extends Error {
+    constructor(message: string);
+}
+export declare function validatePersonalSecretLedgerRecord(value: unknown, expectedIdentity?: PersonalSecretLedgerIdentity): PersonalSecretLedgerRecord;
+export declare function createPersonalSecretLedgerRecord(identity: PersonalSecretLedgerIdentity, logicalNames: readonly string[]): PersonalSecretLedgerRecord;
+export declare function serializePersonalSecretLedgerRecord(record: PersonalSecretLedgerRecord): string;
+export declare function isExactSstSecretAlreadyAbsent(output: string | Uint8Array, logicalName: string): boolean;

package/src/secrets/personal-ledger.js

@@ -0,0 +1,135 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.PersonalSecretLedgerError = exports.SST_SECRET_REMOVE_OUTPUT_MAX_BYTES = exports.PERSONAL_SECRET_LEDGER_MAX_LOGICAL_NAMES = exports.PERSONAL_SECRET_LEDGER_SCHEMA_VERSION = void 0;
+exports.validatePersonalSecretLedgerRecord = validatePersonalSecretLedgerRecord;
+exports.createPersonalSecretLedgerRecord = createPersonalSecretLedgerRecord;
+exports.serializePersonalSecretLedgerRecord = serializePersonalSecretLedgerRecord;
+exports.isExactSstSecretAlreadyAbsent = isExactSstSecretAlreadyAbsent;
+const deterministic_order_js_1 = require("../deterministic-order.js");
+exports.PERSONAL_SECRET_LEDGER_SCHEMA_VERSION = 1;
+exports.PERSONAL_SECRET_LEDGER_MAX_LOGICAL_NAMES = 512;
+exports.SST_SECRET_REMOVE_OUTPUT_MAX_BYTES = 4_096;
+const accountIdPattern = /^\d{12}$/;
+const logicalNamePattern = /^[A-Za-z][A-Za-z0-9]{0,63}$/;
+const regionPattern = /^[a-z]{2}(?:-gov)?-[a-z]+-\d$/;
+const slicePattern = /^[a-z0-9][a-z0-9-]{0,62}$/;
+const personalStagePattern = /^personal-[a-z0-9](?:[a-z0-9-]{0,25}[a-z0-9])?$/;
+const ansiCsiPattern = new RegExp(`${String.fromCharCode(0x1b)}\\[[0-?]*[ -/]*[@-~]`, 'g');
+class PersonalSecretLedgerError extends Error {
+    constructor(message) {
+        super(`Personal secret ledger is invalid: ${message}.`);
+        this.name = 'PersonalSecretLedgerError';
+    }
+}
+exports.PersonalSecretLedgerError = PersonalSecretLedgerError;
+function invalid(message) {
+    throw new PersonalSecretLedgerError(message);
+}
+function isRecord(value) {
+    return typeof value === 'object' && value !== null && !Array.isArray(value);
+}
+function requirePattern(value, label, pattern) {
+    if (typeof value !== 'string' ||
+        value !== value.trim() ||
+        !pattern.test(value)) {
+        return invalid(`${label} has an unsupported format`);
+    }
+    return value;
+}
+function validateIdentity(value) {
+    const slice = requirePattern(value['slice'], 'slice', slicePattern);
+    const sstApp = requirePattern(value['sstApp'], 'sstApp', slicePattern);
+    if (sstApp !== slice) {
+        return invalid('sstApp must equal the exact generated Slice app identity');
+    }
+    return Object.freeze({
+        accountId: requirePattern(value['accountId'], 'accountId', accountIdPattern),
+        region: requirePattern(value['region'], 'region', regionPattern),
+        slice,
+        sstApp,
+        stage: requirePattern(value['stage'], 'stage', personalStagePattern),
+    });
+}
+function validateLogicalNames(value) {
+    if (!Array.isArray(value) ||
+        value.length > exports.PERSONAL_SECRET_LEDGER_MAX_LOGICAL_NAMES) {
+        return invalid('logicalNames must be a bounded array');
+    }
+    const names = value.map((entry) => requirePattern(entry, 'logicalNames entry', logicalNamePattern));
+    const sorted = [...names].sort((left, right) => (0, deterministic_order_js_1.compareUtf16)(left, right));
+    if (new Set(names).size !== names.length ||
+        names.some((name, index) => name !== sorted[index])) {
+        return invalid('logicalNames must be unique and sorted');
+    }
+    return Object.freeze(names);
+}
+function sameIdentity(actual, expected) {
+    return (actual.accountId === expected.accountId &&
+        actual.region === expected.region &&
+        actual.slice === expected.slice &&
+        actual.sstApp === expected.sstApp &&
+        actual.stage === expected.stage);
+}
+function validatePersonalSecretLedgerRecord(value, expectedIdentity) {
+    if (!isRecord(value))
+        return invalid('record must be an object');
+    const expectedProperties = [
+        'accountId',
+        'logicalNames',
+        'region',
+        'schemaVersion',
+        'slice',
+        'sstApp',
+        'stage',
+    ];
+    const properties = Object.keys(value);
+    if (properties.length !== expectedProperties.length ||
+        properties.some((property) => !expectedProperties.includes(property))) {
+        return invalid('record properties must match schemaVersion 1 exactly');
+    }
+    if (value['schemaVersion'] !== exports.PERSONAL_SECRET_LEDGER_SCHEMA_VERSION) {
+        return invalid(`schemaVersion must be ${exports.PERSONAL_SECRET_LEDGER_SCHEMA_VERSION}`);
+    }
+    const identity = validateIdentity(value);
+    if (expectedIdentity && !sameIdentity(identity, expectedIdentity)) {
+        return invalid('backend identity does not match the proved account, Region, app, Slice, and personal stage');
+    }
+    return Object.freeze({
+        ...identity,
+        logicalNames: validateLogicalNames(value['logicalNames']),
+        schemaVersion: exports.PERSONAL_SECRET_LEDGER_SCHEMA_VERSION,
+    });
+}
+function createPersonalSecretLedgerRecord(identity, logicalNames) {
+    return validatePersonalSecretLedgerRecord({
+        ...identity,
+        logicalNames: [...logicalNames].sort((left, right) => (0, deterministic_order_js_1.compareUtf16)(left, right)),
+        schemaVersion: exports.PERSONAL_SECRET_LEDGER_SCHEMA_VERSION,
+    });
+}
+function serializePersonalSecretLedgerRecord(record) {
+    return `${JSON.stringify(validatePersonalSecretLedgerRecord(record), null, 2)}\n`;
+}
+function isExactSstSecretAlreadyAbsent(output, logicalName) {
+    if (!logicalNamePattern.test(logicalName))
+        return false;
+    const bytes = typeof output === 'string'
+        ? Buffer.byteLength(output, 'utf8')
+        : output.byteLength;
+    if (bytes > exports.SST_SECRET_REMOVE_OUTPUT_MAX_BYTES)
+        return false;
+    let decoded;
+    try {
+        decoded =
+            typeof output === 'string'
+                ? output
+                : new TextDecoder('utf-8', { fatal: true }).decode(output);
+    }
+    catch {
+        return false;
+    }
+    const rendered = decoded.replace(ansiCsiPattern, '').trim();
+    const message = rendered.startsWith('✕  ') ? rendered.slice(3) : rendered;
+    return message === `Secret "${logicalName}" does not exist`;
+}
+//# sourceMappingURL=personal-ledger.js.map

package/src/secrets/personal-ledger.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"personal-ledger.js","sourceRoot":"","sources":["../../../../../packages/nx/src/secrets/personal-ledger.ts"],"names":[],"mappings":";;;AAgHA,gFAqCC;AAED,4EAWC;AAED,kFAIC;AAED,sEAsBC;AAhMD,sEAAyD;AAC5C,QAAA,qCAAqC,GAAG,CAAU,CAAC;AACnD,QAAA,wCAAwC,GAAG,GAAY,CAAC;AACxD,QAAA,kCAAkC,GAAG,KAAc,CAAC;AAEjE,MAAM,gBAAgB,GAAG,UAAU,CAAC;AACpC,MAAM,kBAAkB,GAAG,6BAA6B,CAAC;AACzD,MAAM,aAAa,GAAG,+BAA+B,CAAC;AACtD,MAAM,YAAY,GAAG,2BAA2B,CAAC;AACjD,MAAM,oBAAoB,GAAG,iDAAiD,CAAC;AAC/E,MAAM,cAAc,GAAG,IAAI,MAAM,CAC/B,GAAG,MAAM,CAAC,YAAY,CAAC,IAAI,CAAC,sBAAsB,EAClD,GAAG,CACJ,CAAC;AAeF,MAAa,yBAA0B,SAAQ,KAAK;IAClD,YAAY,OAAe;QACzB,KAAK,CAAC,sCAAsC,OAAO,GAAG,CAAC,CAAC;QACxD,IAAI,CAAC,IAAI,GAAG,2BAA2B,CAAC;IAC1C,CAAC;CACF;AALD,8DAKC;AAED,SAAS,OAAO,CAAC,OAAe;IAC9B,MAAM,IAAI,yBAAyB,CAAC,OAAO,CAAC,CAAC;AAC/C,CAAC;AAED,SAAS,QAAQ,CAAC,KAAc;IAC9B,OAAO,OAAO,KAAK,KAAK,QAAQ,IAAI,KAAK,KAAK,IAAI,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC;AAC9E,CAAC;AAED,SAAS,cAAc,CACrB,KAAc,EACd,KAAa,EACb,OAAe;IAEf,IACE,OAAO,KAAK,KAAK,QAAQ;QACzB,KAAK,KAAK,KAAK,CAAC,IAAI,EAAE;QACtB,CAAC,OAAO,CAAC,IAAI,CAAC,KAAK,CAAC,EACpB,CAAC;QACD,OAAO,OAAO,CAAC,GAAG,KAAK,4BAA4B,CAAC,CAAC;IACvD,CAAC;IACD,OAAO,KAAK,CAAC;AACf,CAAC;AAED,SAAS,gBAAgB,CACvB,KAA8B;IAE9B,MAAM,KAAK,GAAG,cAAc,CAAC,KAAK,CAAC,OAAO,CAAC,EAAE,OAAO,EAAE,YAAY,CAAC,CAAC;IACpE,MAAM,MAAM,GAAG,cAAc,CAAC,KAAK,CAAC,QAAQ,CAAC,EAAE,QAAQ,EAAE,YAAY,CAAC,CAAC;IACvE,IAAI,MAAM,KAAK,KAAK,EAAE,CAAC;QACrB,OAAO,OAAO,CAAC,0DAA0D,CAAC,CAAC;IAC7E,CAAC;IACD,OAAO,MAAM,CAAC,MAAM,CAAC;QACnB,SAAS,EAAE,cAAc,CACvB,KAAK,CAAC,WAAW,CAAC,EAClB,WAAW,EACX,gBAAgB,CACjB;QACD,MAAM,EAAE,cAAc,CAAC,KAAK,CAAC,QAAQ,CAAC,EAAE,QAAQ,EAAE,aAAa,CAAC;QAChE,KAAK;QACL,MAAM;QACN,KAAK,EAAE,cAAc,CAAC,KAAK,CAAC,OAAO,CAAC,EAAE,OAAO,EAAE,oBAAoB,CAAC;KACrE,CAAC,CAAC;AACL,CAAC;AAED,SAAS,oBAAoB,CAAC,KAAc;IAC1C,IACE,CAAC,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC;QACrB,KAAK,CAAC,MAAM,GAAG,gDAAwC,EACvD,CAAC;QACD,OAAO,OAAO,CAAC,sCAAsC,CAAC,CAAC;IACzD,CAAC;IACD,MAAM,KAAK,GAAG,KAAK,CAAC,GAAG,CAAC,CAAC,KAAK,EAAE,EAAE,CAChC,cAAc,CAAC,KAAK,EAAE,oBAAoB,EAAE,kBAAkB,CAAC,CAChE,CAAC;IACF,MAAM,MAAM,GAAG,CAAC,GAAG,KAAK,CAAC,CAAC,IAAI,CAAC,CAAC,IAAI,EAAE,KAAK,EAAE,EAAE,CAAC,IAAA,qCAAY,EAAC,IAAI,EAAE,KAAK,CAAC,CAAC,CAAC;IAC3E,IACE,IAAI,GAAG,CAAC,KAAK,CAAC,CAAC,IAAI,KAAK,KAAK,CAAC,MAAM;QACpC,KAAK,CAAC,IAAI,CAAC,CAAC,IAAI,EAAE,KAAK,EAAE,EAAE,CAAC,IAAI,KAAK,MAAM,CAAC,KAAK,CAAC,CAAC,EACnD,CAAC;QACD,OAAO,OAAO,CAAC,wCAAwC,CAAC,CAAC;IAC3D,CAAC;IACD,OAAO,MAAM,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;AAC9B,CAAC;AAED,SAAS,YAAY,CACnB,MAAoC,EACpC,QAAsC;IAEtC,OAAO,CACL,MAAM,CAAC,SAAS,KAAK,QAAQ,CAAC,SAAS;QACvC,MAAM,CAAC,MAAM,KAAK,QAAQ,CAAC,MAAM;QACjC,MAAM,CAAC,KAAK,KAAK,QAAQ,CAAC,KAAK;QAC/B,MAAM,CAAC,MAAM,KAAK,QAAQ,CAAC,MAAM;QACjC,MAAM,CAAC,KAAK,KAAK,QAAQ,CAAC,KAAK,CAChC,CAAC;AACJ,CAAC;AAED,SAAgB,kCAAkC,CAChD,KAAc,EACd,gBAA+C;IAE/C,IAAI,CAAC,QAAQ,CAAC,KAAK,CAAC;QAAE,OAAO,OAAO,CAAC,0BAA0B,CAAC,CAAC;IACjE,MAAM,kBAAkB,GAAG;QACzB,WAAW;QACX,cAAc;QACd,QAAQ;QACR,eAAe;QACf,OAAO;QACP,QAAQ;QACR,OAAO;KACR,CAAC;IACF,MAAM,UAAU,GAAG,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;IACtC,IACE,UAAU,CAAC,MAAM,KAAK,kBAAkB,CAAC,MAAM;QAC/C,UAAU,CAAC,IAAI,CAAC,CAAC,QAAQ,EAAE,EAAE,CAAC,CAAC,kBAAkB,CAAC,QAAQ,CAAC,QAAQ,CAAC,CAAC,EACrE,CAAC;QACD,OAAO,OAAO,CAAC,sDAAsD,CAAC,CAAC;IACzE,CAAC;IACD,IAAI,KAAK,CAAC,eAAe,CAAC,KAAK,6CAAqC,EAAE,CAAC;QACrE,OAAO,OAAO,CACZ,yBAAyB,6CAAqC,EAAE,CACjE,CAAC;IACJ,CAAC;IACD,MAAM,QAAQ,GAAG,gBAAgB,CAAC,KAAK,CAAC,CAAC;IACzC,IAAI,gBAAgB,IAAI,CAAC,YAAY,CAAC,QAAQ,EAAE,gBAAgB,CAAC,EAAE,CAAC;QAClE,OAAO,OAAO,CACZ,4FAA4F,CAC7F,CAAC;IACJ,CAAC;IACD,OAAO,MAAM,CAAC,MAAM,CAAC;QACnB,GAAG,QAAQ;QACX,YAAY,EAAE,oBAAoB,CAAC,KAAK,CAAC,cAAc,CAAC,CAAC;QACzD,aAAa,EAAE,6CAAqC;KACrD,CAAC,CAAC;AACL,CAAC;AAED,SAAgB,gCAAgC,CAC9C,QAAsC,EACtC,YAA+B;IAE/B,OAAO,kCAAkC,CAAC;QACxC,GAAG,QAAQ;QACX,YAAY,EAAE,CAAC,GAAG,YAAY,CAAC,CAAC,IAAI,CAAC,CAAC,IAAI,EAAE,KAAK,EAAE,EAAE,CACnD,IAAA,qCAAY,EAAC,IAAI,EAAE,KAAK,CAAC,CAC1B;QACD,aAAa,EAAE,6CAAqC;KACrD,CAAC,CAAC;AACL,CAAC;AAED,SAAgB,mCAAmC,CACjD,MAAkC;IAElC,OAAO,GAAG,IAAI,CAAC,SAAS,CAAC,kCAAkC,CAAC,MAAM,CAAC,EAAE,IAAI,EAAE,CAAC,CAAC,IAAI,CAAC;AACpF,CAAC;AAED,SAAgB,6BAA6B,CAC3C,MAA2B,EAC3B,WAAmB;IAEnB,IAAI,CAAC,kBAAkB,CAAC,IAAI,CAAC,WAAW,CAAC;QAAE,OAAO,KAAK,CAAC;IACxD,MAAM,KAAK,GACT,OAAO,MAAM,KAAK,QAAQ;QACxB,CAAC,CAAC,MAAM,CAAC,UAAU,CAAC,MAAM,EAAE,MAAM,CAAC;QACnC,CAAC,CAAC,MAAM,CAAC,UAAU,CAAC;IACxB,IAAI,KAAK,GAAG,0CAAkC;QAAE,OAAO,KAAK,CAAC;IAC7D,IAAI,OAAe,CAAC;IACpB,IAAI,CAAC;QACH,OAAO;YACL,OAAO,MAAM,KAAK,QAAQ;gBACxB,CAAC,CAAC,MAAM;gBACR,CAAC,CAAC,IAAI,WAAW,CAAC,OAAO,EAAE,EAAE,KAAK,EAAE,IAAI,EAAE,CAAC,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC;IACjE,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,KAAK,CAAC;IACf,CAAC;IACD,MAAM,QAAQ,GAAG,OAAO,CAAC,OAAO,CAAC,cAAc,EAAE,EAAE,CAAC,CAAC,IAAI,EAAE,CAAC;IAC5D,MAAM,OAAO,GAAG,QAAQ,CAAC,UAAU,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,QAAQ,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,QAAQ,CAAC;IAC1E,OAAO,OAAO,KAAK,WAAW,WAAW,kBAAkB,CAAC;AAC9D,CAAC"}

package/src/secrets/registry.d.ts

@@ -0,0 +1,9 @@
+import { type SecretMetadataDeclaration } from './model.js';
+export declare const SECRET_METADATA_REGISTRY_PATH: "secrets/metadata.json";
+export declare const SECRET_METADATA_REGISTRY_SCHEMA_VERSION: 1;
+export interface SecretMetadataRegistry {
+    declarations: readonly SecretMetadataDeclaration[];
+    schemaVersion: typeof SECRET_METADATA_REGISTRY_SCHEMA_VERSION;
+}
+export declare function parseSecretMetadataRegistry(value: unknown): SecretMetadataRegistry;
+export declare function operatorSecretMetadataDeclarations(registry: SecretMetadataRegistry): readonly SecretMetadataDeclaration[];

package/src/secrets/registry.js

@@ -0,0 +1,86 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.SECRET_METADATA_REGISTRY_SCHEMA_VERSION = exports.SECRET_METADATA_REGISTRY_PATH = void 0;
+exports.parseSecretMetadataRegistry = parseSecretMetadataRegistry;
+exports.operatorSecretMetadataDeclarations = operatorSecretMetadataDeclarations;
+const deterministic_order_js_1 = require("../deterministic-order.js");
+const model_js_1 = require("./model.js");
+exports.SECRET_METADATA_REGISTRY_PATH = 'secrets/metadata.json';
+exports.SECRET_METADATA_REGISTRY_SCHEMA_VERSION = 1;
+function isRecord(value) {
+    return typeof value === 'object' && value !== null && !Array.isArray(value);
+}
+function hasOnlyProperties(value, allowed) {
+    return Object.keys(value).every((key) => allowed.includes(key));
+}
+function invalidRegistry(path, reason) {
+    throw new model_js_1.SecretMetadataModelError(`registry.${path}`, reason);
+}
+function parseDeclaration(value, index) {
+    if (!isRecord(value) ||
+        !hasOnlyProperties(value, [
+            'logicalName',
+            'owner',
+            'requiredStages',
+            'rotation',
+            'source',
+            'valueKind',
+        ]) ||
+        typeof value['logicalName'] !== 'string' ||
+        typeof value['owner'] !== 'string' ||
+        !Array.isArray(value['requiredStages']) ||
+        value['requiredStages'].some((stage) => typeof stage !== 'string') ||
+        !isRecord(value['rotation']) ||
+        !hasOnlyProperties(value['rotation'], ['mode']) ||
+        (value['rotation']['mode'] !== 'manual' &&
+            value['rotation']['mode'] !== 'provider-managed') ||
+        (value['source'] !== 'aws-managed' &&
+            value['source'] !== 'database-bootstrap' &&
+            value['source'] !== 'operator') ||
+        (value['valueKind'] !== 'binary' &&
+            value['valueKind'] !== 'json' &&
+            value['valueKind'] !== 'string')) {
+        invalidRegistry(`declarations.${index}`, 'must contain only the supported value-free declaration metadata');
+    }
+    const declaration = Object.freeze({
+        logicalName: value['logicalName'],
+        owner: value['owner'],
+        requiredStages: Object.freeze([...value['requiredStages']]),
+        rotation: Object.freeze({ mode: value['rotation']['mode'] }),
+        source: value['source'],
+        valueKind: value['valueKind'],
+    });
+    try {
+        (0, model_js_1.validateSecretMetadataDeclaration)(declaration);
+    }
+    catch {
+        invalidRegistry(`declarations.${index}`, 'does not satisfy the secret declaration contract');
+    }
+    return declaration;
+}
+function parseSecretMetadataRegistry(value) {
+    if (!isRecord(value) ||
+        !hasOnlyProperties(value, ['declarations', 'schemaVersion']) ||
+        value['schemaVersion'] !== exports.SECRET_METADATA_REGISTRY_SCHEMA_VERSION ||
+        !Array.isArray(value['declarations'])) {
+        invalidRegistry('', `must use schemaVersion ${exports.SECRET_METADATA_REGISTRY_SCHEMA_VERSION} and contain only declarations`);
+    }
+    const logicalNames = new Set();
+    const declarations = value['declarations']
+        .map((declaration, index) => parseDeclaration(declaration, index))
+        .sort((left, right) => (0, deterministic_order_js_1.compareUtf16)(left.logicalName, right.logicalName));
+    for (const declaration of declarations) {
+        if (logicalNames.has(declaration.logicalName)) {
+            invalidRegistry('declarations', `contains duplicate logical name ${declaration.logicalName}`);
+        }
+        logicalNames.add(declaration.logicalName);
+    }
+    return Object.freeze({
+        declarations: Object.freeze(declarations),
+        schemaVersion: exports.SECRET_METADATA_REGISTRY_SCHEMA_VERSION,
+    });
+}
+function operatorSecretMetadataDeclarations(registry) {
+    return Object.freeze(registry.declarations.filter(({ source }) => source === 'operator'));
+}
+//# sourceMappingURL=registry.js.map

package/src/secrets/registry.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"registry.js","sourceRoot":"","sources":["../../../../../packages/nx/src/secrets/registry.ts"],"names":[],"mappings":";;;AAoFA,kEAiCC;AAED,gFAMC;AA7HD,sEAAyD;AACzD,yCAIoB;AAEP,QAAA,6BAA6B,GAAG,uBAAgC,CAAC;AACjE,QAAA,uCAAuC,GAAG,CAAU,CAAC;AAOlE,SAAS,QAAQ,CAAC,KAAc;IAC9B,OAAO,OAAO,KAAK,KAAK,QAAQ,IAAI,KAAK,KAAK,IAAI,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC;AAC9E,CAAC;AAED,SAAS,iBAAiB,CACxB,KAA8B,EAC9B,OAA0B;IAE1B,OAAO,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,KAAK,CAAC,CAAC,GAAG,EAAE,EAAE,CAAC,OAAO,CAAC,QAAQ,CAAC,GAAG,CAAC,CAAC,CAAC;AAClE,CAAC;AAED,SAAS,eAAe,CAAC,IAAY,EAAE,MAAc;IACnD,MAAM,IAAI,mCAAwB,CAAC,YAAY,IAAI,EAAE,EAAE,MAAM,CAAC,CAAC;AACjE,CAAC;AAED,SAAS,gBAAgB,CACvB,KAAc,EACd,KAAa;IAEb,IACE,CAAC,QAAQ,CAAC,KAAK,CAAC;QAChB,CAAC,iBAAiB,CAAC,KAAK,EAAE;YACxB,aAAa;YACb,OAAO;YACP,gBAAgB;YAChB,UAAU;YACV,QAAQ;YACR,WAAW;SACZ,CAAC;QACF,OAAO,KAAK,CAAC,aAAa,CAAC,KAAK,QAAQ;QACxC,OAAO,KAAK,CAAC,OAAO,CAAC,KAAK,QAAQ;QAClC,CAAC,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC,gBAAgB,CAAC,CAAC;QACvC,KAAK,CAAC,gBAAgB,CAAC,CAAC,IAAI,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,OAAO,KAAK,KAAK,QAAQ,CAAC;QAClE,CAAC,QAAQ,CAAC,KAAK,CAAC,UAAU,CAAC,CAAC;QAC5B,CAAC,iBAAiB,CAAC,KAAK,CAAC,UAAU,CAAC,EAAE,CAAC,MAAM,CAAC,CAAC;QAC/C,CAAC,KAAK,CAAC,UAAU,CAAC,CAAC,MAAM,CAAC,KAAK,QAAQ;YACrC,KAAK,CAAC,UAAU,CAAC,CAAC,MAAM,CAAC,KAAK,kBAAkB,CAAC;QACnD,CAAC,KAAK,CAAC,QAAQ,CAAC,KAAK,aAAa;YAChC,KAAK,CAAC,QAAQ,CAAC,KAAK,oBAAoB;YACxC,KAAK,CAAC,QAAQ,CAAC,KAAK,UAAU,CAAC;QACjC,CAAC,KAAK,CAAC,WAAW,CAAC,KAAK,QAAQ;YAC9B,KAAK,CAAC,WAAW,CAAC,KAAK,MAAM;YAC7B,KAAK,CAAC,WAAW,CAAC,KAAK,QAAQ,CAAC,EAClC,CAAC;QACD,eAAe,CACb,gBAAgB,KAAK,EAAE,EACvB,iEAAiE,CAClE,CAAC;IACJ,CAAC;IAED,MAAM,WAAW,GAA8B,MAAM,CAAC,MAAM,CAAC;QAC3D,WAAW,EAAE,KAAK,CAAC,aAAa,CAAC;QACjC,KAAK,EAAE,KAAK,CAAC,OAAO,CAAC;QACrB,cAAc,EAAE,MAAM,CAAC,MAAM,CAAC,CAAC,GAAG,KAAK,CAAC,gBAAgB,CAAC,CAAC,CAAC;QAC3D,QAAQ,EAAE,MAAM,CAAC,MAAM,CAAC,EAAE,IAAI,EAAE,KAAK,CAAC,UAAU,CAAC,CAAC,MAAM,CAAC,EAAE,CAAC;QAC5D,MAAM,EAAE,KAAK,CAAC,QAAQ,CAAC;QACvB,SAAS,EAAE,KAAK,CAAC,WAAW,CAAC;KAC9B,CAAC,CAAC;IACH,IAAI,CAAC;QACH,IAAA,4CAAiC,EAAC,WAAW,CAAC,CAAC;IACjD,CAAC;IAAC,MAAM,CAAC;QACP,eAAe,CACb,gBAAgB,KAAK,EAAE,EACvB,kDAAkD,CACnD,CAAC;IACJ,CAAC;IACD,OAAO,WAAW,CAAC;AACrB,CAAC;AAED,SAAgB,2BAA2B,CACzC,KAAc;IAEd,IACE,CAAC,QAAQ,CAAC,KAAK,CAAC;QAChB,CAAC,iBAAiB,CAAC,KAAK,EAAE,CAAC,cAAc,EAAE,eAAe,CAAC,CAAC;QAC5D,KAAK,CAAC,eAAe,CAAC,KAAK,+CAAuC;QAClE,CAAC,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC,cAAc,CAAC,CAAC,EACrC,CAAC;QACD,eAAe,CACb,EAAE,EACF,0BAA0B,+CAAuC,gCAAgC,CAClG,CAAC;IACJ,CAAC;IAED,MAAM,YAAY,GAAG,IAAI,GAAG,EAAU,CAAC;IACvC,MAAM,YAAY,GAAG,KAAK,CAAC,cAAc,CAAC;SACvC,GAAG,CAAC,CAAC,WAAW,EAAE,KAAK,EAAE,EAAE,CAAC,gBAAgB,CAAC,WAAW,EAAE,KAAK,CAAC,CAAC;SACjE,IAAI,CAAC,CAAC,IAAI,EAAE,KAAK,EAAE,EAAE,CAAC,IAAA,qCAAY,EAAC,IAAI,CAAC,WAAW,EAAE,KAAK,CAAC,WAAW,CAAC,CAAC,CAAC;IAC5E,KAAK,MAAM,WAAW,IAAI,YAAY,EAAE,CAAC;QACvC,IAAI,YAAY,CAAC,GAAG,CAAC,WAAW,CAAC,WAAW,CAAC,EAAE,CAAC;YAC9C,eAAe,CACb,cAAc,EACd,mCAAmC,WAAW,CAAC,WAAW,EAAE,CAC7D,CAAC;QACJ,CAAC;QACD,YAAY,CAAC,GAAG,CAAC,WAAW,CAAC,WAAW,CAAC,CAAC;IAC5C,CAAC;IAED,OAAO,MAAM,CAAC,MAAM,CAAC;QACnB,YAAY,EAAE,MAAM,CAAC,MAAM,CAAC,YAAY,CAAC;QACzC,aAAa,EAAE,+CAAuC;KACvD,CAAC,CAAC;AACL,CAAC;AAED,SAAgB,kCAAkC,CAChD,QAAgC;IAEhC,OAAO,MAAM,CAAC,MAAM,CAClB,QAAQ,CAAC,YAAY,CAAC,MAAM,CAAC,CAAC,EAAE,MAAM,EAAE,EAAE,EAAE,CAAC,MAAM,KAAK,UAAU,CAAC,CACpE,CAAC;AACJ,CAAC"}

package/src/secrets/verification.d.ts

@@ -0,0 +1,18 @@
+import { type SecretGuardrailIssue } from './guardrails.js';
+export interface SecretStaticVerificationResult {
+    filesInspected: number;
+    issues: readonly SecretGuardrailIssue[];
+    valid: boolean;
+}
+export declare class SecretStaticVerificationError extends Error {
+    readonly code: 'secret-static-input-invalid' | 'secret-static-registry-invalid' | 'secret-static-source-invalid';
+    constructor(code: SecretStaticVerificationError['code']);
+}
+/**
+ * Scans the actual Product Slice sources used by build and deploy. The
+ * verifier follows no symlinks and deliberately ignores build/cache output so
+ * an alternate source tree cannot hide a forbidden secret path.
+ */
+export declare function verifySliceSecretStaticContract(input: {
+    projectRoot: string;
+}): Promise<SecretStaticVerificationResult>;