@empire-builder-kit/nx 1.0.0-rc.30 → 1.0.0-rc.31

package/src/executors/secret-metadata/secret-metadata.js.map

@@ -1 +1 @@
-{"version":3,"file":"secret-metadata.js","sourceRoot":"","sources":["../../../../../../packages/nx/src/executors/secret-metadata/secret-metadata.ts"],"names":[],"mappings":";;AAkDA,gFA6BC;AAqBD,wFAgDC;AAED,gFAqCC;AAoBD,sDAiEC;AAhRD,uCAAgF;AAChF,oDAA0E;AAC1E,wEAAwD;AACxD,yCAA6C;AAE7C,qDAIgC;AAChC,8EAI8C;AAC9C,+DAO0C;AAC1C,0FAA8F;AAqB9F,MAAM,eAAe,GAAG,IAAI,GAAG,CAAC,CAAC,SAAS,EAAE,YAAY,CAAC,CAAC,CAAC;AAC3D,MAAM,IAAI,GACR,4EAA4E,CAAC;AAI/E,SAAgB,kCAAkC,CAChD,KAA6C,EAC7C,KAAc,EACd,cAAiC,OAAO,CAAC,GAAG,EAC5C,oBAAuC,gBAAgB;IAEvD,IAAI,CAAC,KAAK,IAAI,CAAC,eAAe,CAAC,GAAG,CAAC,KAAK,CAAC;QAAE,OAAO,MAAM,CAAC;IACzD,MAAM,UAAU,GAAG,WAAW,CAAC,iBAAiB,CAAC;IACjD,MAAM,MAAM,GAAG,KAAK,KAAK,SAAS,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,MAAM,CAAC;IACxD,MAAM,GAAG,GAAG,cAAc,MAAM,EAAE,CAAC;IACnC,MAAM,gBAAgB,GAAG,UAAU;QACjC,CAAC,CAAC,GAAG,UAAU,0CAA0C,GAAG,EAAE;QAC9D,CAAC,CAAC,SAAS,CAAC;IACd,MAAM,aAAa,GACjB,WAAW,CAAC,cAAc,KAAK,MAAM;QACrC,WAAW,CAAC,iBAAiB,KAAK,mBAAmB;QACrD,WAAW,CAAC,UAAU,KAAK,GAAG;QAC9B,OAAO,CAAC,UAAU,CAAC;QACnB,WAAW,CAAC,mBAAmB,KAAK,gBAAgB,CAAC;IACvD,IAAI,aAAa;QAAE,OAAO,UAAU,CAAC;IACrC,IACE,IAAA,mCAAwB,EAAC,iBAAiB,EAAE,KAAK,CAAC;QAClD,WAAW,CAAC,cAAc,KAAK,MAAM,EACrC,CAAC;QACD,MAAM,IAAI,KAAK,CACb,aAAa,KAAK,4CAA4C,MAAM,mCAAmC,CACxG,CAAC;IACJ,CAAC;IACD,OAAO,OAAO,CAAC;AACjB,CAAC;AAED,KAAK,UAAU,oBAAoB,CAAC,KAGnC;IACC,MAAM,MAAM,GAAG,IAAI,sBAAS,CAAC;QAC3B,GAAG,CAAC,KAAK,CAAC,OAAO;YACf,CAAC,CAAC;gBACE,WAAW,EAAE,IAAA,8BAAO,EAAC,EAAE,OAAO,EAAE,KAAK,CAAC,OAAO,EAAE,CAAC;aACjD;YACH,CAAC,CAAC,EAAE,CAAC;QACP,MAAM,EAAE,KAAK,CAAC,MAAM;KACrB,CAAC,CAAC;IACH,MAAM,QAAQ,GAAG,MAAM,MAAM,CAAC,IAAI,CAAC,IAAI,qCAAwB,CAAC,EAAE,CAAC,CAAC,CAAC;IACrE,IAAI,CAAC,QAAQ,CAAC,OAAO,IAAI,CAAC,QAAQ,CAAC,GAAG,EAAE,CAAC;QACvC,MAAM,IAAI,KAAK,CAAC,qDAAqD,CAAC,CAAC;IACzE,CAAC;IACD,OAAO,EAAE,SAAS,EAAE,QAAQ,CAAC,OAAO,EAAE,GAAG,EAAE,QAAQ,CAAC,GAAG,EAAE,CAAC;AAC5D,CAAC;AAEM,KAAK,UAAU,sCAAsC,CAAC,KAO5D;IACC,IAAI,CAAC,KAAK,CAAC,KAAK,IAAI,CAAC,eAAe,CAAC,GAAG,CAAC,KAAK,CAAC,KAAK,CAAC;QAAE,OAAO;IAC9D,MAAM,eAAe,GAAG,KAAK,CAAC,WAAW,CAAC,uBAAuB,CAAC;IAClE,MAAM,eAAe,GAAG,KAAK,CAAC,WAAW,CAAC,mBAAmB,CAAC;IAC9D,MAAM,KAAK,GAAG,KAAK,CAAC,WAAW,CAAC,aAAa,CAAC;IAC9C,MAAM,UAAU,GAAG,KAAK,CAAC,WAAW,CAAC,kBAAkB,CAAC;IACxD,MAAM,IAAI,GACR,gFAAgF,CAAC,IAAI,CACnF,eAAe,IAAI,EAAE,CACtB,CAAC;IACJ,IACE,CAAC,IAAI;QACL,IAAI,CAAC,CAAC,CAAC,KAAK,eAAe;QAC3B,IAAI,CAAC,CAAC,CAAC,KAAK,eAAe;QAC3B,CAAC,OAAO,CAAC,IAAI,CAAC,KAAK,IAAI,EAAE,CAAC;QAC1B,CAAC,OAAO,CAAC,IAAI,CAAC,UAAU,IAAI,EAAE,CAAC,EAC/B,CAAC;QACD,MAAM,IAAI,KAAK,CACb,wGAAwG,CACzG,CAAC;IACJ,CAAC;IACD,IAAI,SAA6C,CAAC;IAClD,IAAI,CAAC;QACH,SAAS,GAAG,MAAM,CAAC,KAAK,CAAC,aAAa,IAAI,oBAAoB,CAAC,CAAC;YAC9D,GAAG,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,EAAE,OAAO,EAAE,KAAK,CAAC,OAAO,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;YACpD,MAAM,EAAE,KAAK,CAAC,MAAM;SACrB,CAAC,CAAC;IACL,CAAC;IAAC,MAAM,CAAC;QACP,MAAM,IAAI,KAAK,CACb,2EAA2E,CAC5E,CAAC;IACJ,CAAC;IACD,MAAM,oBAAoB,GAAG,OAAO,IAAI,CAAC,CAAC,CAAC,SAAS,eAAe,iBAAiB,IAAI,CAAC,CAAC,CAAC,wBAAwB,KAAK,IAAI,UAAU,EAAE,CAAC;IACzI,IACE,SAAS,CAAC,SAAS,KAAK,eAAe;QACvC,SAAS,CAAC,GAAG,KAAK,oBAAoB,EACtC,CAAC;QACD,MAAM,IAAI,KAAK,CACb,+FAA+F,CAChG,CAAC;IACJ,CAAC;AACH,CAAC;AAEM,KAAK,UAAU,kCAAkC,CAAC,KAMxD;IACC,MAAM,eAAe,GAAG,KAAK,CAAC,eAAe,EAAE,IAAI,EAAE,IAAI,EAAE,CAAC;IAC5D,MAAM,OAAO,GAAG,KAAK,CAAC,OAAO,EAAE,IAAI,EAAE,IAAI,EAAE,CAAC;IAC5C,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC,eAAe,CAAC,IAAI,OAAO,KAAK,EAAE,EAAE,CAAC;QAClD,MAAM,IAAI,KAAK,CACb,2FAA2F,CAC5F,CAAC;IACJ,CAAC;IACD,IAAI,SAA6C,CAAC;IAClD,IAAI,CAAC;QACH,SAAS,GAAG,MAAM,CAAC,KAAK,CAAC,aAAa,IAAI,oBAAoB,CAAC,CAAC;YAC9D,OAAO;YACP,MAAM,EAAE,KAAK,CAAC,MAAM;SACrB,CAAC,CAAC;IACL,CAAC;IAAC,MAAM,CAAC;QACP,MAAM,IAAI,KAAK,CACb,iFAAiF,CAClF,CAAC;IACJ,CAAC;IACD,IACE,SAAS,CAAC,SAAS,KAAK,KAAK,CAAC,SAAS;QACvC,CAAC,IAAA,sDAA6B,EAC5B,KAAK,CAAC,SAAS,EACf,SAAS,CAAC,GAAG,EACb,eAAe,CAChB,EACD,CAAC;QACD,MAAM,IAAI,KAAK,CACb,oHAAoH,CACrH,CAAC;IACJ,CAAC;AACH,CAAC;AAED,SAAS,gBAAgB,CAAC,OAAwB;IAChD,IAAI,CAAC,OAAO,CAAC,WAAW,EAAE,CAAC;QACzB,MAAM,IAAI,KAAK,CACb,qEAAqE,CACtE,CAAC;IACJ,CAAC;IACD,MAAM,cAAc,GAClB,OAAO,CAAC,sBAAsB,EAAE,QAAQ,CAAC,OAAO,CAAC,WAAW,CAAC,EAAE,IAAI,CAAC;IACtE,IAAI,CAAC,cAAc,EAAE,CAAC;QACpB,MAAM,IAAI,KAAK,CACb,cAAc,OAAO,CAAC,WAAW,mCAAmC,CACrE,CAAC;IACJ,CAAC;IACD,OAAO,IAAA,sBAAU,EAAC,cAAc,CAAC;QAC/B,CAAC,CAAC,cAAc;QAChB,CAAC,CAAC,IAAA,gBAAI,EAAC,OAAO,CAAC,IAAI,EAAE,cAAc,CAAC,CAAC;AACzC,CAAC;AAEM,KAAK,UAAU,qBAAqB,CACzC,OAAsC,EACtC,OAAwB,EACxB,eAAmD,EAAE;IAErD,MAAM,WAAW,GAAG,YAAY,CAAC,WAAW,IAAI,OAAO,CAAC,GAAG,CAAC;IAC5D,MAAM,KAAK,GAAG,OAAO,CAAC,KAAK,KAAK,IAAI,CAAC;IACrC,MAAM,eAAe,GACnB,KAAK,IAAI,eAAe,CAAC,GAAG,CAAC,OAAO,CAAC,KAAK,CAAC;QACzC,CAAC,CAAC,CAAC,YAAY,CAAC,mBAAmB,IAAI,wCAA6B,CAAC,CACjE,OAAO,CAAC,IAAI,CACb;QACH,CAAC,CAAC,SAAS,CAAC;IAChB,MAAM,SAAS,GAAG,kCAAkC,CAClD,OAAO,CAAC,KAAK,EACb,KAAK,EACL,WAAW,EACX,eAAe,EAAE,iBAAiB,CACnC,CAAC;IACF,MAAM,GAAG,GAAG,IAAA,6CAAuB,EAAC,OAAO,EAAE,WAAW,CAAC,CAAC;IAC1D,IAAI,SAAS,KAAK,UAAU,EAAE,CAAC;QAC7B,MAAM,sCAAsC,CAAC;YAC3C,KAAK;YACL,WAAW;YACX,GAAG,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,EAAE,OAAO,EAAE,GAAG,CAAC,OAAO,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;YAChD,aAAa,EAAE,YAAY,CAAC,aAAa;YACzC,MAAM,EAAE,GAAG,CAAC,MAAM;YAClB,KAAK,EAAE,OAAO,CAAC,KAAK;SACrB,CAAC,CAAC;IACL,CAAC;SAAM,IAAI,SAAS,KAAK,OAAO,EAAE,CAAC;QACjC,IAAI,CAAC,eAAe,EAAE,CAAC;YACrB,MAAM,IAAI,KAAK,CAAC,wDAAwD,CAAC,CAAC;QAC5E,CAAC;QACD,MAAM,QAAQ,GAAG,IAAA,8CAAmC,EAClD,eAAe,CAAC,iBAAiB,EACjC,eAAe,CAAC,kBAAkB,CACnC,CAAC;QACF,MAAM,MAAM,GAAG,IAAA,qCAA0B,EAAC,eAAe,CAAC,gBAAgB,CAAC,CAAC;QAC5E,IAAI,GAAG,CAAC,MAAM,KAAK,MAAM,EAAE,CAAC;YAC1B,MAAM,IAAI,KAAK,CACb,8EAA8E,MAAM,GAAG,CACxF,CAAC;QACJ,CAAC;QACD,MAAM,kCAAkC,CAAC;YACvC,SAAS,EAAE,QAAQ,CAAC,OAAO,CAAC,KAAK,CAAC;YAClC,eAAe,EAAE,OAAO,CAAC,eAAe;YACxC,GAAG,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,EAAE,OAAO,EAAE,GAAG,CAAC,OAAO,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;YAChD,aAAa,EAAE,YAAY,CAAC,aAAa;YACzC,MAAM;SACP,CAAC,CAAC;IACL,CAAC;IACD,MAAM,MAAM,GAAG,MAAM,IAAA,6CAAuB,EAAC;QAC3C,OAAO;QACP,GAAG,EAAE,gBAAgB,CAAC,OAAO,CAAC;QAC9B,GAAG,CAAC,YAAY,CAAC,QAAQ,CAAC,CAAC,CAAC,EAAE,QAAQ,EAAE,YAAY,CAAC,QAAQ,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QACrE,KAAK,EAAE,OAAO,CAAC,KAAK;KACrB,CAAC,CAAC;IACH,MAAM,YAAY,GAChB,YAAY,CAAC,YAAY,IAAI,IAAA,sDAAgC,EAAC,GAAG,CAAC,CAAC;IACrE,OAAO,IAAA,oCAAyB,EAAC;QAC/B,YAAY;QACZ,YAAY,EAAE,MAAM,CAAC,YAAY;QACjC,IAAI,EAAE,KAAK,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,QAAQ;QAChC,KAAK,EAAE,MAAM,CAAC,KAAK;KACpB,CAAC,CAAC;AACL,CAAC;AAED,MAAM,QAAQ,GAAmD,KAAK,EACpE,OAAO,EACP,OAAO,EACP,EAAE;IACF,IAAI,CAAC;QACH,MAAM,MAAM,GAAG,MAAM,qBAAqB,CAAC,OAAO,EAAE,OAAO,CAAC,CAAC;QAC7D,eAAM,CAAC,IAAI,CACT,qBAAqB,MAAM,CAAC,IAAI,IAAI,MAAM,CAAC,OAAO,KAAK,IAAI,CAAC,SAAS,CAAC,MAAM,EAAE,IAAI,EAAE,CAAC,CAAC,EAAE,CACzF,CAAC;QACF,OAAO;YACL,OAAO,EAAE,MAAM,CAAC,OAAO,KAAK,UAAU,IAAI,MAAM,CAAC,OAAO,KAAK,SAAS;SACvE,CAAC;IACJ,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,eAAM,CAAC,KAAK,CACV,KAAK,YAAY,KAAK;YACpB,CAAC,CAAC,KAAK,CAAC,OAAO;YACf,CAAC,CAAC,mCAAmC,CACxC,CAAC;QACF,OAAO,EAAE,OAAO,EAAE,KAAK,EAAE,CAAC;IAC5B,CAAC;AACH,CAAC,CAAC;AAEF,kBAAe,QAAQ,CAAC"}
+{"version":3,"file":"secret-metadata.js","sourceRoot":"","sources":["../../../../../../packages/nx/src/executors/secret-metadata/secret-metadata.ts"],"names":[],"mappings":";;AAsDA,gFA6BC;AA4BD,wFAiDC;AAED,gFAqCC;AAoBD,sDAqGC;AAhUD,uCAAgF;AAChF,oDAA0E;AAC1E,wEAAwD;AACxD,yCAA6C;AAE7C,qDAIgC;AAChC,2DAA4E;AAC5E,8EAI8C;AAC9C,+DAQ0C;AAC1C,uDAG+B;AAqB/B,MAAM,IAAI,GACR,4EAA4E,CAAC;AAI/E,SAAgB,kCAAkC,CAChD,KAA6C,EAC7C,KAAc,EACd,cAAiC,OAAO,CAAC,GAAG,EAC5C,oBAAuC,gBAAgB;IAEvD,IAAI,CAAC,KAAK;QAAE,OAAO,MAAM,CAAC;IAC1B,MAAM,UAAU,GAAG,WAAW,CAAC,iBAAiB,CAAC;IACjD,MAAM,MAAM,GAAG,KAAK,KAAK,YAAY,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,SAAS,CAAC;IAC3D,MAAM,GAAG,GAAG,cAAc,MAAM,EAAE,CAAC;IACnC,MAAM,gBAAgB,GAAG,UAAU;QACjC,CAAC,CAAC,GAAG,UAAU,0CAA0C,GAAG,EAAE;QAC9D,CAAC,CAAC,SAAS,CAAC;IACd,MAAM,aAAa,GACjB,WAAW,CAAC,cAAc,KAAK,MAAM;QACrC,WAAW,CAAC,iBAAiB,KAAK,mBAAmB;QACrD,WAAW,CAAC,UAAU,KAAK,GAAG;QAC9B,OAAO,CAAC,UAAU,CAAC;QACnB,WAAW,CAAC,mBAAmB,KAAK,gBAAgB,CAAC;IACvD,IAAI,aAAa;QAAE,OAAO,UAAU,CAAC;IACrC,IACE,IAAA,mCAAwB,EAAC,iBAAiB,EAAE,KAAK,CAAC;QAClD,WAAW,CAAC,cAAc,KAAK,MAAM,EACrC,CAAC;QACD,MAAM,IAAI,KAAK,CACb,aAAa,KAAK,4CAA4C,MAAM,mCAAmC,CACxG,CAAC;IACJ,CAAC;IACD,OAAO,OAAO,CAAC;AACjB,CAAC;AAED,SAAS,kBAAkB,CAAC,MAAc;IACxC,IAAI,MAAM,CAAC,UAAU,CAAC,KAAK,CAAC;QAAE,OAAO,QAAQ,CAAC;IAC9C,IAAI,MAAM,CAAC,UAAU,CAAC,SAAS,CAAC;QAAE,OAAO,YAAY,CAAC;IACtD,OAAO,KAAK,CAAC;AACf,CAAC;AAED,KAAK,UAAU,oBAAoB,CAAC,KAGnC;IACC,MAAM,MAAM,GAAG,IAAI,sBAAS,CAAC;QAC3B,GAAG,CAAC,KAAK,CAAC,OAAO;YACf,CAAC,CAAC;gBACE,WAAW,EAAE,IAAA,8BAAO,EAAC,EAAE,OAAO,EAAE,KAAK,CAAC,OAAO,EAAE,CAAC;aACjD;YACH,CAAC,CAAC,EAAE,CAAC;QACP,QAAQ,EAAE,IAAA,kCAAoB,EAAC,KAAK,CAAC,MAAM,CAAC;QAC5C,MAAM,EAAE,KAAK,CAAC,MAAM;KACrB,CAAC,CAAC;IACH,MAAM,QAAQ,GAAG,MAAM,MAAM,CAAC,IAAI,CAAC,IAAI,qCAAwB,CAAC,EAAE,CAAC,CAAC,CAAC;IACrE,IAAI,CAAC,QAAQ,CAAC,OAAO,IAAI,CAAC,QAAQ,CAAC,GAAG,EAAE,CAAC;QACvC,MAAM,IAAI,KAAK,CAAC,qDAAqD,CAAC,CAAC;IACzE,CAAC;IACD,OAAO,EAAE,SAAS,EAAE,QAAQ,CAAC,OAAO,EAAE,GAAG,EAAE,QAAQ,CAAC,GAAG,EAAE,CAAC;AAC5D,CAAC;AAEM,KAAK,UAAU,sCAAsC,CAAC,KAQ5D;IACC,IAAI,CAAC,KAAK,CAAC,KAAK;QAAE,OAAO;IACzB,MAAM,eAAe,GAAG,KAAK,CAAC,WAAW,CAAC,uBAAuB,CAAC;IAClE,MAAM,iBAAiB,GAAG,KAAK,CAAC,WAAW,CAAC,mBAAmB,CAAC;IAChE,MAAM,KAAK,GAAG,KAAK,CAAC,WAAW,CAAC,aAAa,CAAC;IAC9C,MAAM,UAAU,GAAG,KAAK,CAAC,WAAW,CAAC,kBAAkB,CAAC;IACxD,IACE,CAAC,IAAI,CAAC,IAAI,CAAC,KAAK,CAAC,eAAe,CAAC;QACjC,eAAe,KAAK,KAAK,CAAC,SAAS;QACnC,iBAAiB,KAAK,KAAK,CAAC,eAAe;QAC3C,CAAC,OAAO,CAAC,IAAI,CAAC,KAAK,IAAI,EAAE,CAAC;QAC1B,CAAC,OAAO,CAAC,IAAI,CAAC,UAAU,IAAI,EAAE,CAAC,EAC/B,CAAC;QACD,MAAM,IAAI,KAAK,CACb,+GAA+G,CAChH,CAAC;IACJ,CAAC;IACD,IAAI,SAA6C,CAAC;IAClD,IAAI,CAAC;QACH,SAAS,GAAG,MAAM,CAAC,KAAK,CAAC,aAAa,IAAI,oBAAoB,CAAC,CAAC;YAC9D,MAAM,EAAE,KAAK,CAAC,MAAM;SACrB,CAAC,CAAC;IACL,CAAC;IAAC,MAAM,CAAC;QACP,MAAM,IAAI,KAAK,CACb,2EAA2E,CAC5E,CAAC;IACJ,CAAC;IACD,MAAM,eAAe,GAAG,uBAAuB,KAAK,IAAI,UAAU,EAAE,CAAC;IACrE,IACE,SAAS,CAAC,SAAS,KAAK,KAAK,CAAC,SAAS;QACvC,CAAC,IAAA,2CAA6B,EAC5B,KAAK,CAAC,SAAS,EACf,SAAS,CAAC,GAAG,EACb,KAAK,CAAC,eAAe,CACtB;QACD,CAAC,SAAS,CAAC,GAAG,CAAC,QAAQ,CAAC,IAAI,eAAe,EAAE,CAAC,EAC9C,CAAC;QACD,MAAM,IAAI,KAAK,CACb,+FAA+F,CAChG,CAAC;IACJ,CAAC;AACH,CAAC;AAEM,KAAK,UAAU,kCAAkC,CAAC,KAMxD;IACC,MAAM,eAAe,GAAG,KAAK,CAAC,eAAe,EAAE,IAAI,EAAE,IAAI,EAAE,CAAC;IAC5D,MAAM,OAAO,GAAG,KAAK,CAAC,OAAO,EAAE,IAAI,EAAE,IAAI,EAAE,CAAC;IAC5C,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC,eAAe,CAAC,IAAI,OAAO,KAAK,EAAE,EAAE,CAAC;QAClD,MAAM,IAAI,KAAK,CACb,2FAA2F,CAC5F,CAAC;IACJ,CAAC;IACD,IAAI,SAA6C,CAAC;IAClD,IAAI,CAAC;QACH,SAAS,GAAG,MAAM,CAAC,KAAK,CAAC,aAAa,IAAI,oBAAoB,CAAC,CAAC;YAC9D,OAAO;YACP,MAAM,EAAE,KAAK,CAAC,MAAM;SACrB,CAAC,CAAC;IACL,CAAC;IAAC,MAAM,CAAC;QACP,MAAM,IAAI,KAAK,CACb,iFAAiF,CAClF,CAAC;IACJ,CAAC;IACD,IACE,SAAS,CAAC,SAAS,KAAK,KAAK,CAAC,SAAS;QACvC,CAAC,IAAA,2CAA6B,EAC5B,KAAK,CAAC,SAAS,EACf,SAAS,CAAC,GAAG,EACb,eAAe,CAChB,EACD,CAAC;QACD,MAAM,IAAI,KAAK,CACb,oHAAoH,CACrH,CAAC;IACJ,CAAC;AACH,CAAC;AAED,SAAS,gBAAgB,CAAC,OAAwB;IAChD,IAAI,CAAC,OAAO,CAAC,WAAW,EAAE,CAAC;QACzB,MAAM,IAAI,KAAK,CACb,qEAAqE,CACtE,CAAC;IACJ,CAAC;IACD,MAAM,cAAc,GAClB,OAAO,CAAC,sBAAsB,EAAE,QAAQ,CAAC,OAAO,CAAC,WAAW,CAAC,EAAE,IAAI,CAAC;IACtE,IAAI,CAAC,cAAc,EAAE,CAAC;QACpB,MAAM,IAAI,KAAK,CACb,cAAc,OAAO,CAAC,WAAW,mCAAmC,CACrE,CAAC;IACJ,CAAC;IACD,OAAO,IAAA,sBAAU,EAAC,cAAc,CAAC;QAC/B,CAAC,CAAC,cAAc;QAChB,CAAC,CAAC,IAAA,gBAAI,EAAC,OAAO,CAAC,IAAI,EAAE,cAAc,CAAC,CAAC;AACzC,CAAC;AAEM,KAAK,UAAU,qBAAqB,CACzC,OAAsC,EACtC,OAAwB,EACxB,eAAmD,EAAE;IAErD,MAAM,WAAW,GAAG,YAAY,CAAC,WAAW,IAAI,OAAO,CAAC,GAAG,CAAC;IAC5D,MAAM,KAAK,GAAG,OAAO,CAAC,KAAK,KAAK,IAAI,CAAC;IACrC,MAAM,eAAe,GAAG,KAAK;QAC3B,CAAC,CAAC,CAAC,YAAY,CAAC,mBAAmB,IAAI,wCAA6B,CAAC,CACjE,OAAO,CAAC,IAAI,CACb;QACH,CAAC,CAAC,SAAS,CAAC;IACd,MAAM,SAAS,GAAG,kCAAkC,CAClD,OAAO,CAAC,KAAK,EACb,KAAK,EACL,WAAW,EACX,eAAe,EAAE,iBAAiB,CACnC,CAAC;IACF,MAAM,GAAG,GAAG,IAAA,6CAAuB,EAAC,OAAO,EAAE,WAAW,CAAC,CAAC;IAC1D,IAAI,SAA6B,CAAC;IAClC,IAAI,eAAmC,CAAC;IACxC,IAAI,KAAK,EAAE,CAAC;QACV,IAAI,CAAC,eAAe,EAAE,CAAC;YACrB,MAAM,IAAI,KAAK,CAAC,kDAAkD,CAAC,CAAC;QACtE,CAAC;QACD,IACE,CAAC,IAAA,kCAAuB,EAAC,eAAe,CAAC,iBAAiB,EAAE,OAAO,CAAC,KAAK,CAAC,EAC1E,CAAC;YACD,MAAM,IAAI,KAAK,CACb,yBAAyB,OAAO,CAAC,KAAK,wBAAwB,eAAe,CAAC,iBAAiB,sBAAsB,CACtH,CAAC;QACJ,CAAC;QACD,MAAM,MAAM,GAAG,IAAA,qCAA0B,EAAC,eAAe,CAAC,gBAAgB,CAAC,CAAC;QAC5E,IAAI,GAAG,CAAC,MAAM,KAAK,MAAM,EAAE,CAAC;YAC1B,MAAM,IAAI,KAAK,CACb,8DAA8D,MAAM,GAAG,CACxE,CAAC;QACJ,CAAC;QACD,SAAS,GAAG,IAAA,8CAAmC,EAC7C,eAAe,CAAC,iBAAiB,EACjC,eAAe,CAAC,kBAAkB,EAClC,OAAO,CAAC,KAAK,CACd,CAAC;QACF,eAAe,GAAG,IAAA,uCAA4B,EAAC;YAC7C,SAAS;YACT,SAAS,EAAE,kBAAkB,CAAC,MAAM,CAAC;YACrC,MAAM;YACN,KAAK,EAAE,OAAO,CAAC,KAAK;SACrB,CAAC,CAAC,iBAAiB,CAAC;IACvB,CAAC;IACD,IAAI,SAAS,KAAK,UAAU,EAAE,CAAC;QAC7B,IACE,SAAS,KAAK,SAAS;YACvB,eAAe,KAAK,SAAS;YAC7B,OAAO,CAAC,OAAO,KAAK,SAAS;YAC7B,OAAO,CAAC,eAAe,KAAK,SAAS,EACrC,CAAC;YACD,MAAM,IAAI,KAAK,CACb,8EAA8E,CAC/E,CAAC;QACJ,CAAC;QACD,MAAM,sCAAsC,CAAC;YAC3C,SAAS;YACT,KAAK;YACL,WAAW;YACX,eAAe;YACf,aAAa,EAAE,YAAY,CAAC,aAAa;YACzC,MAAM,EAAE,GAAG,CAAC,MAAM;YAClB,KAAK,EAAE,OAAO,CAAC,KAAK;SACrB,CAAC,CAAC;IACL,CAAC;SAAM,IAAI,SAAS,KAAK,OAAO,EAAE,CAAC;QACjC,IAAI,SAAS,KAAK,SAAS,IAAI,eAAe,KAAK,SAAS,EAAE,CAAC;YAC7D,MAAM,IAAI,KAAK,CAAC,wDAAwD,CAAC,CAAC;QAC5E,CAAC;QACD,IAAI,OAAO,CAAC,eAAe,KAAK,eAAe,EAAE,CAAC;YAChD,MAAM,IAAI,KAAK,CACb,4DAA4D,OAAO,CAAC,KAAK,yBAAyB,eAAe,GAAG,CACrH,CAAC;QACJ,CAAC;QACD,MAAM,kCAAkC,CAAC;YACvC,SAAS;YACT,eAAe;YACf,GAAG,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,EAAE,OAAO,EAAE,GAAG,CAAC,OAAO,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;YAChD,aAAa,EAAE,YAAY,CAAC,aAAa;YACzC,MAAM,EAAE,GAAG,CAAC,MAAM;SACnB,CAAC,CAAC;IACL,CAAC;IACD,MAAM,MAAM,GAAG,MAAM,IAAA,6CAAuB,EAAC;QAC3C,OAAO;QACP,GAAG,EAAE,gBAAgB,CAAC,OAAO,CAAC;QAC9B,GAAG,CAAC,YAAY,CAAC,QAAQ,CAAC,CAAC,CAAC,EAAE,QAAQ,EAAE,YAAY,CAAC,QAAQ,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QACrE,KAAK,EAAE,OAAO,CAAC,KAAK;KACrB,CAAC,CAAC;IACH,MAAM,YAAY,GAChB,YAAY,CAAC,YAAY,IAAI,IAAA,sDAAgC,EAAC,GAAG,CAAC,CAAC;IACrE,OAAO,IAAA,oCAAyB,EAAC;QAC/B,YAAY;QACZ,YAAY,EAAE,MAAM,CAAC,YAAY;QACjC,IAAI,EAAE,KAAK,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,QAAQ;QAChC,KAAK,EAAE,MAAM,CAAC,KAAK;KACpB,CAAC,CAAC;AACL,CAAC;AAED,MAAM,QAAQ,GAAmD,KAAK,EACpE,OAAO,EACP,OAAO,EACP,EAAE;IACF,IAAI,CAAC;QACH,MAAM,MAAM,GAAG,MAAM,qBAAqB,CAAC,OAAO,EAAE,OAAO,CAAC,CAAC;QAC7D,eAAM,CAAC,IAAI,CACT,qBAAqB,MAAM,CAAC,IAAI,IAAI,MAAM,CAAC,OAAO,KAAK,IAAI,CAAC,SAAS,CAAC,MAAM,EAAE,IAAI,EAAE,CAAC,CAAC,EAAE,CACzF,CAAC;QACF,OAAO;YACL,OAAO,EAAE,MAAM,CAAC,OAAO,KAAK,UAAU,IAAI,MAAM,CAAC,OAAO,KAAK,SAAS;SACvE,CAAC;IACJ,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,eAAM,CAAC,KAAK,CACV,KAAK,YAAY,KAAK;YACpB,CAAC,CAAC,KAAK,CAAC,OAAO;YACf,CAAC,CAAC,mCAAmC,CACxC,CAAC;QACF,OAAO,EAAE,OAAO,EAAE,KAAK,EAAE,CAAC;IAC5B,CAAC;AACH,CAAC,CAAC;AAEF,kBAAe,QAAQ,CAAC"}

package/src/executors/sst-lifecycle/generated-secret-retirement.d.ts

@@ -0,0 +1,53 @@
+import type { ExecutorContext } from '@nx/devkit';
+import { type RepositoryOperatingPolicy } from '../../repository-policy/index.js';
+import { type GeneratedSecretRetirementControlPlane, type GeneratedSecretRetirementResult } from '../../secrets/index.js';
+import { type LoadedSliceSecretMetadata } from './secret-preflight.js';
+import type { SstCommandInvocation, SstLifecycleOptions } from './run-sst-command.js';
+export declare const GENERATED_SECRET_RETIREMENT_EVIDENCE_DIRECTORY: string;
+interface AwsPrincipal {
+    accountId: string;
+    arn: string;
+}
+export interface GeneratedSecretRetirementEvidence {
+    accountId: string;
+    actorArn: string;
+    completedAt: string;
+    deletionMode: GeneratedSecretRetirementResult['deletionMode'];
+    kind: 'ebk-generated-secret-retirement';
+    project: string;
+    recoveryWindowDays?: 7;
+    region: string;
+    result: 'succeeded';
+    schemaVersion: 1;
+    secrets: GeneratedSecretRetirementResult['secrets'];
+    sourceCommit: string;
+    stage: string;
+    startedAt: string;
+    workspace: string;
+}
+export interface GeneratedSecretRetirementDependencies {
+    controlPlane?: GeneratedSecretRetirementControlPlane;
+    environment?: NodeJS.ProcessEnv;
+    loadMetadata?: (input: {
+        context: ExecutorContext;
+        cwd: string;
+        stage: string;
+    }) => Promise<LoadedSliceSecretMetadata>;
+    now?: () => Date;
+    readOperatingPolicy?: (workspaceRoot: string) => RepositoryOperatingPolicy;
+    readPrincipal?: (input: {
+        environment: NodeJS.ProcessEnv;
+        profile?: string;
+        region: string;
+    }) => Promise<AwsPrincipal>;
+    writeEvidence?: (path: string, evidence: GeneratedSecretRetirementEvidence) => void;
+    waitBeforeRetry?: (delayMs: number) => Promise<void>;
+}
+/**
+ * Complete the generated-secret portion of one successful native Slice remove.
+ * The invocation has already passed the normal stage/removal authorization;
+ * this function independently reattests its exact AWS identity and secret
+ * ownership before applying the stage-specific deletion policy.
+ */
+export declare function retireGeneratedSecretsAfterSliceRemove(options: SstLifecycleOptions, context: ExecutorContext, invocation: SstCommandInvocation, dependencies?: GeneratedSecretRetirementDependencies): Promise<GeneratedSecretRetirementEvidence>;
+export {};

package/src/executors/sst-lifecycle/generated-secret-retirement.js

@@ -0,0 +1,192 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.GENERATED_SECRET_RETIREMENT_EVIDENCE_DIRECTORY = void 0;
+exports.retireGeneratedSecretsAfterSliceRemove = retireGeneratedSecretsAfterSliceRemove;
+const client_sts_1 = require("@aws-sdk/client-sts");
+const credential_providers_1 = require("@aws-sdk/credential-providers");
+const node_fs_1 = require("node:fs");
+const node_path_1 = require("node:path");
+const index_js_1 = require("../../aws-authority/index.js");
+const identity_js_1 = require("../../aws/identity.js");
+const index_js_2 = require("../../repository-policy/index.js");
+const index_js_3 = require("../../secrets/index.js");
+const secret_preflight_js_1 = require("./secret-preflight.js");
+const private_state_js_1 = require("../../local-dev/private-state.js");
+const GENERATED_SECRET_RETIREMENT_EVIDENCE_SEGMENTS = [
+    '.ebk',
+    'evidence',
+    'generated-secret-retirement',
+];
+exports.GENERATED_SECRET_RETIREMENT_EVIDENCE_DIRECTORY = (0, node_path_1.join)(...GENERATED_SECRET_RETIREMENT_EVIDENCE_SEGMENTS);
+const SHA = /^[a-f0-9]{40,64}$/u;
+const MAXIMUM_EVIDENCE_BYTES = 32 * 1024;
+function partitionForRegion(region) {
+    if (region.startsWith('cn-'))
+        return 'aws-cn';
+    if (region.startsWith('us-gov-'))
+        return 'aws-us-gov';
+    return 'aws';
+}
+function profileCredentials(profile, environment) {
+    return (0, credential_providers_1.fromIni)({
+        ...(environment.AWS_CONFIG_FILE
+            ? { configFilepath: environment.AWS_CONFIG_FILE }
+            : {}),
+        ...(environment.AWS_SHARED_CREDENTIALS_FILE
+            ? { filepath: environment.AWS_SHARED_CREDENTIALS_FILE }
+            : {}),
+        profile,
+    });
+}
+async function readCurrentPrincipal(input) {
+    const client = new client_sts_1.STSClient({
+        ...(input.profile
+            ? { credentials: profileCredentials(input.profile, input.environment) }
+            : {}),
+        endpoint: (0, identity_js_1.canonicalStsEndpoint)(input.region),
+        region: input.region,
+    });
+    try {
+        const identity = await client.send(new client_sts_1.GetCallerIdentityCommand({}));
+        if (!identity.Account || !identity.Arn) {
+            throw new Error('identity unavailable');
+        }
+        return { accountId: identity.Account, arn: identity.Arn };
+    }
+    finally {
+        client.destroy();
+    }
+}
+function writeBoundedEvidence(path, evidence) {
+    const serialized = `${JSON.stringify(evidence, null, 2)}\n`;
+    (0, private_state_js_1.atomicWritePrivateFileWithMaximumBytes)(path, serialized, MAXIMUM_EVIDENCE_BYTES);
+}
+function prepareEvidenceDestination(cwd, path) {
+    const projectRoot = (0, node_path_1.resolve)(cwd);
+    const expectedPath = (0, node_path_1.join)(projectRoot, ...GENERATED_SECRET_RETIREMENT_EVIDENCE_SEGMENTS, (0, node_path_1.basename)(path));
+    if ((0, node_path_1.resolve)(path) !== expectedPath) {
+        throw new Error('Generated secret retirement evidence must remain inside the exact project evidence directory.');
+    }
+    const projectIdentity = (0, node_fs_1.lstatSync)(projectRoot);
+    if (projectIdentity.isSymbolicLink() || !projectIdentity.isDirectory()) {
+        throw new Error('Generated secret retirement requires one real project directory.');
+    }
+    let current = projectRoot;
+    for (const segment of GENERATED_SECRET_RETIREMENT_EVIDENCE_SEGMENTS) {
+        current = (0, node_path_1.join)(current, segment);
+        (0, private_state_js_1.ensurePrivateDirectory)(current);
+    }
+    if ((0, node_fs_1.existsSync)(path)) {
+        (0, private_state_js_1.assertPrivatePath)(path, 'file');
+    }
+}
+function sourceCommit(environment) {
+    const commit = (environment.EBK_SOURCE_COMMIT ??
+        environment.GITHUB_SHA ??
+        '').trim();
+    if (!SHA.test(commit)) {
+        throw new Error('Generated secret retirement requires one exact lifecycle source commit.');
+    }
+    return commit;
+}
+/**
+ * Complete the generated-secret portion of one successful native Slice remove.
+ * The invocation has already passed the normal stage/removal authorization;
+ * this function independently reattests its exact AWS identity and secret
+ * ownership before applying the stage-specific deletion policy.
+ */
+async function retireGeneratedSecretsAfterSliceRemove(options, context, invocation, dependencies = {}) {
+    const environment = dependencies.environment ?? process.env;
+    const exactSourceCommit = sourceCommit(environment);
+    const startedAt = (dependencies.now ?? (() => new Date()))().toISOString();
+    const policy = (dependencies.readOperatingPolicy ?? index_js_2.readRepositoryOperatingPolicy)(context.root);
+    const stage = invocation.environment.EBK_CONSUMER_STAGE;
+    if (!(0, index_js_2.isActiveDeploymentStage)(policy.deploymentProfile, stage)) {
+        throw new Error(`Generated secret retirement stage ${stage} is inactive for the ${policy.deploymentProfile} deployment profile.`);
+    }
+    const region = (0, index_js_2.configuredDeploymentRegion)(policy.deploymentRegion);
+    const accountId = (0, index_js_2.configuredDeploymentAccountForStage)(policy.deploymentProfile, policy.deploymentAccounts, stage);
+    const expectedRoleArn = (0, index_js_1.createStageAuthorityIdentity)({
+        accountId,
+        partition: partitionForRegion(region),
+        region,
+        stage,
+    }).deploymentRoleArn;
+    if (invocation.environment.AWS_EXPECTED_ACCOUNT_ID !== accountId ||
+        invocation.environment.AWS_REGION !== region ||
+        invocation.environment.EBK_EXPECTED_DEPLOYMENT_ROLE_ARN !==
+            expectedRoleArn ||
+        (options.expectedRoleArn !== undefined &&
+            options.expectedRoleArn !== expectedRoleArn)) {
+        throw new Error('Generated secret retirement requires the exact committed account, Region, stage, and deployment role.');
+    }
+    const profile = invocation.environment.AWS_PROFILE;
+    if (profile !== undefined && options.profile !== profile) {
+        throw new Error('Generated secret retirement requires the exact invocation-private AWS profile.');
+    }
+    let principal;
+    try {
+        principal = await (dependencies.readPrincipal ?? readCurrentPrincipal)({
+            environment,
+            ...(profile ? { profile } : {}),
+            region,
+        });
+    }
+    catch {
+        throw new Error('Generated secret retirement could not authenticate its AWS principal.');
+    }
+    if (principal.accountId !== accountId ||
+        !(0, identity_js_1.matchesExpectedAssumedRoleArn)(accountId, principal.arn, expectedRoleArn)) {
+        throw new Error('Generated secret retirement is not running in the committed account as the exact temporary stage deployment role.');
+    }
+    const loaded = await (dependencies.loadMetadata ?? secret_preflight_js_1.loadSliceSecretMetadata)({
+        context,
+        cwd: invocation.cwd,
+        stage,
+    });
+    const evidencePath = (0, node_path_1.join)(invocation.cwd, exports.GENERATED_SECRET_RETIREMENT_EVIDENCE_DIRECTORY, `${stage}.json`);
+    prepareEvidenceDestination(invocation.cwd, evidencePath);
+    const controlPlane = dependencies.controlPlane ??
+        (0, index_js_3.createAwsGeneratedSecretRetirementControlPlane)({
+            clientConfiguration: {
+                ...(profile
+                    ? { credentials: profileCredentials(profile, environment) }
+                    : {}),
+                endpoint: (0, identity_js_1.canonicalAwsRegionalEndpoint)('secretsmanager', region),
+                region,
+            },
+        });
+    const result = await (0, index_js_3.runGeneratedSecretRetirement)({
+        accountId,
+        controlPlane,
+        declarations: loaded.declarations,
+        partition: partitionForRegion(region),
+        region,
+        scope: loaded.scope,
+        ...(dependencies.waitBeforeRetry === undefined
+            ? {}
+            : { waitBeforeRetry: dependencies.waitBeforeRetry }),
+    });
+    const evidence = Object.freeze({
+        accountId,
+        actorArn: principal.arn,
+        completedAt: (dependencies.now ?? (() => new Date()))().toISOString(),
+        deletionMode: result.deletionMode,
+        kind: 'ebk-generated-secret-retirement',
+        project: loaded.scope.slice,
+        ...(result.recoveryWindowDays === undefined
+            ? {}
+            : { recoveryWindowDays: result.recoveryWindowDays }),
+        region,
+        result: 'succeeded',
+        schemaVersion: 1,
+        secrets: result.secrets,
+        sourceCommit: exactSourceCommit,
+        stage,
+        startedAt,
+        workspace: loaded.scope.workspace,
+    });
+    (dependencies.writeEvidence ?? writeBoundedEvidence)(evidencePath, evidence);
+    return evidence;
+}
+//# sourceMappingURL=generated-secret-retirement.js.map

package/src/executors/sst-lifecycle/generated-secret-retirement.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"generated-secret-retirement.js","sourceRoot":"","sources":["../../../../../../packages/nx/src/executors/sst-lifecycle/generated-secret-retirement.ts"],"names":[],"mappings":";;;AAyMA,wFA2HC;AApUD,oDAA0E;AAC1E,wEAAwD;AAExD,qCAAgD;AAChD,yCAAoD;AAEpD,2DAA4E;AAC5E,uDAI+B;AAC/B,+DAM0C;AAC1C,qDAKgC;AAChC,+DAG+B;AAC/B,uEAI0C;AAM1C,MAAM,6CAA6C,GAAG;IACpD,MAAM;IACN,UAAU;IACV,6BAA6B;CACrB,CAAC;AAEE,QAAA,8CAA8C,GAAG,IAAA,gBAAI,EAChE,GAAG,6CAA6C,CACjD,CAAC;AA+CF,MAAM,GAAG,GAAG,oBAAoB,CAAC;AACjC,MAAM,sBAAsB,GAAG,EAAE,GAAG,IAAI,CAAC;AAEzC,SAAS,kBAAkB,CAAC,MAAc;IACxC,IAAI,MAAM,CAAC,UAAU,CAAC,KAAK,CAAC;QAAE,OAAO,QAAQ,CAAC;IAC9C,IAAI,MAAM,CAAC,UAAU,CAAC,SAAS,CAAC;QAAE,OAAO,YAAY,CAAC;IACtD,OAAO,KAAK,CAAC;AACf,CAAC;AAED,SAAS,kBAAkB,CAAC,OAAe,EAAE,WAA8B;IACzE,OAAO,IAAA,8BAAO,EAAC;QACb,GAAG,CAAC,WAAW,CAAC,eAAe;YAC7B,CAAC,CAAC,EAAE,cAAc,EAAE,WAAW,CAAC,eAAe,EAAE;YACjD,CAAC,CAAC,EAAE,CAAC;QACP,GAAG,CAAC,WAAW,CAAC,2BAA2B;YACzC,CAAC,CAAC,EAAE,QAAQ,EAAE,WAAW,CAAC,2BAA2B,EAAE;YACvD,CAAC,CAAC,EAAE,CAAC;QACP,OAAO;KACR,CAAC,CAAC;AACL,CAAC;AAED,KAAK,UAAU,oBAAoB,CAAC,KAInC;IACC,MAAM,MAAM,GAAG,IAAI,sBAAS,CAAC;QAC3B,GAAG,CAAC,KAAK,CAAC,OAAO;YACf,CAAC,CAAC,EAAE,WAAW,EAAE,kBAAkB,CAAC,KAAK,CAAC,OAAO,EAAE,KAAK,CAAC,WAAW,CAAC,EAAE;YACvE,CAAC,CAAC,EAAE,CAAC;QACP,QAAQ,EAAE,IAAA,kCAAoB,EAAC,KAAK,CAAC,MAAM,CAAC;QAC5C,MAAM,EAAE,KAAK,CAAC,MAAM;KACrB,CAAC,CAAC;IACH,IAAI,CAAC;QACH,MAAM,QAAQ,GAAG,MAAM,MAAM,CAAC,IAAI,CAAC,IAAI,qCAAwB,CAAC,EAAE,CAAC,CAAC,CAAC;QACrE,IAAI,CAAC,QAAQ,CAAC,OAAO,IAAI,CAAC,QAAQ,CAAC,GAAG,EAAE,CAAC;YACvC,MAAM,IAAI,KAAK,CAAC,sBAAsB,CAAC,CAAC;QAC1C,CAAC;QACD,OAAO,EAAE,SAAS,EAAE,QAAQ,CAAC,OAAO,EAAE,GAAG,EAAE,QAAQ,CAAC,GAAG,EAAE,CAAC;IAC5D,CAAC;YAAS,CAAC;QACT,MAAM,CAAC,OAAO,EAAE,CAAC;IACnB,CAAC;AACH,CAAC;AAED,SAAS,oBAAoB,CAC3B,IAAY,EACZ,QAA2C;IAE3C,MAAM,UAAU,GAAG,GAAG,IAAI,CAAC,SAAS,CAAC,QAAQ,EAAE,IAAI,EAAE,CAAC,CAAC,IAAI,CAAC;IAC5D,IAAA,yDAAsC,EACpC,IAAI,EACJ,UAAU,EACV,sBAAsB,CACvB,CAAC;AACJ,CAAC;AAED,SAAS,0BAA0B,CAAC,GAAW,EAAE,IAAY;IAC3D,MAAM,WAAW,GAAG,IAAA,mBAAO,EAAC,GAAG,CAAC,CAAC;IACjC,MAAM,YAAY,GAAG,IAAA,gBAAI,EACvB,WAAW,EACX,GAAG,6CAA6C,EAChD,IAAA,oBAAQ,EAAC,IAAI,CAAC,CACf,CAAC;IACF,IAAI,IAAA,mBAAO,EAAC,IAAI,CAAC,KAAK,YAAY,EAAE,CAAC;QACnC,MAAM,IAAI,KAAK,CACb,+FAA+F,CAChG,CAAC;IACJ,CAAC;IAED,MAAM,eAAe,GAAG,IAAA,mBAAS,EAAC,WAAW,CAAC,CAAC;IAC/C,IAAI,eAAe,CAAC,cAAc,EAAE,IAAI,CAAC,eAAe,CAAC,WAAW,EAAE,EAAE,CAAC;QACvE,MAAM,IAAI,KAAK,CACb,kEAAkE,CACnE,CAAC;IACJ,CAAC;IAED,IAAI,OAAO,GAAG,WAAW,CAAC;IAC1B,KAAK,MAAM,OAAO,IAAI,6CAA6C,EAAE,CAAC;QACpE,OAAO,GAAG,IAAA,gBAAI,EAAC,OAAO,EAAE,OAAO,CAAC,CAAC;QACjC,IAAA,yCAAsB,EAAC,OAAO,CAAC,CAAC;IAClC,CAAC;IAED,IAAI,IAAA,oBAAU,EAAC,IAAI,CAAC,EAAE,CAAC;QACrB,IAAA,oCAAiB,EAAC,IAAI,EAAE,MAAM,CAAC,CAAC;IAClC,CAAC;AACH,CAAC;AAED,SAAS,YAAY,CAAC,WAA8B;IAClD,MAAM,MAAM,GAAG,CACb,WAAW,CAAC,iBAAiB;QAC7B,WAAW,CAAC,UAAU;QACtB,EAAE,CACH,CAAC,IAAI,EAAE,CAAC;IACT,IAAI,CAAC,GAAG,CAAC,IAAI,CAAC,MAAM,CAAC,EAAE,CAAC;QACtB,MAAM,IAAI,KAAK,CACb,yEAAyE,CAC1E,CAAC;IACJ,CAAC;IACD,OAAO,MAAM,CAAC;AAChB,CAAC;AAED;;;;;GAKG;AACI,KAAK,UAAU,sCAAsC,CAC1D,OAA4B,EAC5B,OAAwB,EACxB,UAAgC,EAChC,eAAsD,EAAE;IAExD,MAAM,WAAW,GAAG,YAAY,CAAC,WAAW,IAAI,OAAO,CAAC,GAAG,CAAC;IAC5D,MAAM,iBAAiB,GAAG,YAAY,CAAC,WAAW,CAAC,CAAC;IACpD,MAAM,SAAS,GAAG,CAAC,YAAY,CAAC,GAAG,IAAI,CAAC,GAAG,EAAE,CAAC,IAAI,IAAI,EAAE,CAAC,CAAC,EAAE,CAAC,WAAW,EAAE,CAAC;IAC3E,MAAM,MAAM,GAAG,CACb,YAAY,CAAC,mBAAmB,IAAI,wCAA6B,CAClE,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC;IAChB,MAAM,KAAK,GAAG,UAAU,CAAC,WAAW,CAAC,kBAAkB,CAAC;IACxD,IAAI,CAAC,IAAA,kCAAuB,EAAC,MAAM,CAAC,iBAAiB,EAAE,KAAK,CAAC,EAAE,CAAC;QAC9D,MAAM,IAAI,KAAK,CACb,qCAAqC,KAAK,wBAAwB,MAAM,CAAC,iBAAiB,sBAAsB,CACjH,CAAC;IACJ,CAAC;IACD,MAAM,MAAM,GAAG,IAAA,qCAA0B,EAAC,MAAM,CAAC,gBAAgB,CAAC,CAAC;IACnE,MAAM,SAAS,GAAG,IAAA,8CAAmC,EACnD,MAAM,CAAC,iBAAiB,EACxB,MAAM,CAAC,kBAAkB,EACzB,KAAK,CACN,CAAC;IACF,MAAM,eAAe,GAAG,IAAA,uCAA4B,EAAC;QACnD,SAAS;QACT,SAAS,EAAE,kBAAkB,CAAC,MAAM,CAAC;QACrC,MAAM;QACN,KAAK;KACN,CAAC,CAAC,iBAAiB,CAAC;IACrB,IACE,UAAU,CAAC,WAAW,CAAC,uBAAuB,KAAK,SAAS;QAC5D,UAAU,CAAC,WAAW,CAAC,UAAU,KAAK,MAAM;QAC5C,UAAU,CAAC,WAAW,CAAC,gCAAgC;YACrD,eAAe;QACjB,CAAC,OAAO,CAAC,eAAe,KAAK,SAAS;YACpC,OAAO,CAAC,eAAe,KAAK,eAAe,CAAC,EAC9C,CAAC;QACD,MAAM,IAAI,KAAK,CACb,uGAAuG,CACxG,CAAC;IACJ,CAAC;IACD,MAAM,OAAO,GAAG,UAAU,CAAC,WAAW,CAAC,WAAW,CAAC;IACnD,IAAI,OAAO,KAAK,SAAS,IAAI,OAAO,CAAC,OAAO,KAAK,OAAO,EAAE,CAAC;QACzD,MAAM,IAAI,KAAK,CACb,gFAAgF,CACjF,CAAC;IACJ,CAAC;IACD,IAAI,SAAuB,CAAC;IAC5B,IAAI,CAAC;QACH,SAAS,GAAG,MAAM,CAAC,YAAY,CAAC,aAAa,IAAI,oBAAoB,CAAC,CAAC;YACrE,WAAW;YACX,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,EAAE,OAAO,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;YAC/B,MAAM;SACP,CAAC,CAAC;IACL,CAAC;IAAC,MAAM,CAAC;QACP,MAAM,IAAI,KAAK,CACb,uEAAuE,CACxE,CAAC;IACJ,CAAC;IACD,IACE,SAAS,CAAC,SAAS,KAAK,SAAS;QACjC,CAAC,IAAA,2CAA6B,EAAC,SAAS,EAAE,SAAS,CAAC,GAAG,EAAE,eAAe,CAAC,EACzE,CAAC;QACD,MAAM,IAAI,KAAK,CACb,mHAAmH,CACpH,CAAC;IACJ,CAAC;IAED,MAAM,MAAM,GAAG,MAAM,CAAC,YAAY,CAAC,YAAY,IAAI,6CAAuB,CAAC,CAAC;QAC1E,OAAO;QACP,GAAG,EAAE,UAAU,CAAC,GAAG;QACnB,KAAK;KACN,CAAC,CAAC;IACH,MAAM,YAAY,GAAG,IAAA,gBAAI,EACvB,UAAU,CAAC,GAAG,EACd,sDAA8C,EAC9C,GAAG,KAAK,OAAO,CAChB,CAAC;IACF,0BAA0B,CAAC,UAAU,CAAC,GAAG,EAAE,YAAY,CAAC,CAAC;IACzD,MAAM,YAAY,GAChB,YAAY,CAAC,YAAY;QACzB,IAAA,yDAA8C,EAAC;YAC7C,mBAAmB,EAAE;gBACnB,GAAG,CAAC,OAAO;oBACT,CAAC,CAAC,EAAE,WAAW,EAAE,kBAAkB,CAAC,OAAO,EAAE,WAAW,CAAC,EAAE;oBAC3D,CAAC,CAAC,EAAE,CAAC;gBACP,QAAQ,EAAE,IAAA,0CAA4B,EAAC,gBAAgB,EAAE,MAAM,CAAC;gBAChE,MAAM;aACP;SACF,CAAC,CAAC;IACL,MAAM,MAAM,GAAG,MAAM,IAAA,uCAA4B,EAAC;QAChD,SAAS;QACT,YAAY;QACZ,YAAY,EAAE,MAAM,CAAC,YAAY;QACjC,SAAS,EAAE,kBAAkB,CAAC,MAAM,CAAC;QACrC,MAAM;QACN,KAAK,EAAE,MAAM,CAAC,KAAK;QACnB,GAAG,CAAC,YAAY,CAAC,eAAe,KAAK,SAAS;YAC5C,CAAC,CAAC,EAAE;YACJ,CAAC,CAAC,EAAE,eAAe,EAAE,YAAY,CAAC,eAAe,EAAE,CAAC;KACvD,CAAC,CAAC;IACH,MAAM,QAAQ,GAAG,MAAM,CAAC,MAAM,CAAC;QAC7B,SAAS;QACT,QAAQ,EAAE,SAAS,CAAC,GAAG;QACvB,WAAW,EAAE,CAAC,YAAY,CAAC,GAAG,IAAI,CAAC,GAAG,EAAE,CAAC,IAAI,IAAI,EAAE,CAAC,CAAC,EAAE,CAAC,WAAW,EAAE;QACrE,YAAY,EAAE,MAAM,CAAC,YAAY;QACjC,IAAI,EAAE,iCAA0C;QAChD,OAAO,EAAE,MAAM,CAAC,KAAK,CAAC,KAAK;QAC3B,GAAG,CAAC,MAAM,CAAC,kBAAkB,KAAK,SAAS;YACzC,CAAC,CAAC,EAAE;YACJ,CAAC,CAAC,EAAE,kBAAkB,EAAE,MAAM,CAAC,kBAAkB,EAAE,CAAC;QACtD,MAAM;QACN,MAAM,EAAE,WAAoB;QAC5B,aAAa,EAAE,CAAU;QACzB,OAAO,EAAE,MAAM,CAAC,OAAO;QACvB,YAAY,EAAE,iBAAiB;QAC/B,KAAK;QACL,SAAS;QACT,SAAS,EAAE,MAAM,CAAC,KAAK,CAAC,SAAS;KAClC,CAAC,CAAC;IACH,CAAC,YAAY,CAAC,aAAa,IAAI,oBAAoB,CAAC,CAAC,YAAY,EAAE,QAAQ,CAAC,CAAC;IAC7E,OAAO,QAAQ,CAAC;AAClB,CAAC"}

package/src/executors/sst-lifecycle/governed-native-operation.d.ts

@@ -0,0 +1,46 @@
+import type { ReadStream, WriteStream } from 'node:tty';
+import { type ExecutorContext } from '@nx/devkit';
+import { createLocalFederatedCredentialTransport } from '../local-deploy/federated-credential-transport.js';
+import { type SstLifecycleCommand, type SstLifecycleOptions } from './run-sst-command.js';
+export type GovernedNativeOperation = 'refresh' | 'remove' | 'unlock';
+export interface GovernedNativeOperationApprovalRequest {
+    action: GovernedNativeOperation;
+    challenge: string;
+    sourceCommit: string;
+    stage: 'production' | 'staging';
+}
+export type GovernedNativeOperationApprover = (request: GovernedNativeOperationApprovalRequest) => Promise<boolean>;
+interface ApprovalTerminal {
+    input: ReadStream;
+    output: WriteStream;
+}
+interface SourceIdentity {
+    clean: boolean;
+    commit: string;
+    workingTreeDigest: string;
+}
+type NativeRunner = (command: SstLifecycleCommand, options: SstLifecycleOptions, context: ExecutorContext, dependencies?: {
+    environment?: NodeJS.ProcessEnv;
+}) => Promise<{
+    success: boolean;
+}>;
+export interface GovernedNativeOperationDependencies {
+    approve?: GovernedNativeOperationApprover;
+    createTransport?: typeof createLocalFederatedCredentialTransport;
+    environment?: NodeJS.ProcessEnv;
+    platform?: NodeJS.Platform;
+    readSource?: (root: string) => SourceIdentity;
+    run?: NativeRunner;
+}
+/** Active operator acknowledgement, not an independent-review claim. */
+export declare function createTtyGovernedNativeOperationApprover(terminal?: ApprovalTerminal): GovernedNativeOperationApprover;
+/**
+ * Govern refresh, remove, and unlock without replacing SST's native lifecycle.
+ * Local execution flattens the operator's federated profile into one private,
+ * invocation-scoped profile; protected stages additionally require a TTY
+ * acknowledgement. GitHub OIDC proceeds through the existing native path.
+ */
+export declare function runGovernedNativeOperation(command: GovernedNativeOperation, options: SstLifecycleOptions, context: ExecutorContext, dependencies?: GovernedNativeOperationDependencies): Promise<{
+    success: boolean;
+}>;
+export {};

package/src/executors/sst-lifecycle/governed-native-operation.js

@@ -0,0 +1,153 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.createTtyGovernedNativeOperationApprover = createTtyGovernedNativeOperationApprover;
+exports.runGovernedNativeOperation = runGovernedNativeOperation;
+const promises_1 = require("node:readline/promises");
+const devkit_1 = require("@nx/devkit");
+const index_js_1 = require("../../aws-authority/index.js");
+const index_js_2 = require("../../repository-policy/index.js");
+const federated_credential_transport_js_1 = require("../local-deploy/federated-credential-transport.js");
+const local_deploy_js_1 = require("../local-deploy/local-deploy.js");
+const run_sst_command_js_1 = require("./run-sst-command.js");
+const SHA = /^[a-f0-9]{40,64}$/u;
+function partitionForRegion(region) {
+    if (region.startsWith('cn-'))
+        return 'aws-cn';
+    if (region.startsWith('us-gov-'))
+        return 'aws-us-gov';
+    return 'aws';
+}
+function readSource(root) {
+    const identity = (0, local_deploy_js_1.localWorkingTreeDigest)(root);
+    const commit = identity.commit;
+    if (!SHA.test(commit)) {
+        throw new Error('Governed native lifecycle could not resolve one exact Git HEAD.');
+    }
+    return {
+        clean: identity.clean,
+        commit,
+        workingTreeDigest: identity.digest,
+    };
+}
+/** Active operator acknowledgement, not an independent-review claim. */
+function createTtyGovernedNativeOperationApprover(terminal = {
+    input: process.stdin,
+    output: process.stderr,
+}) {
+    return async ({ challenge }) => {
+        if (!terminal.input.isTTY || !terminal.output.isTTY) {
+            throw new Error('Local protected-stage lifecycle mutation requires an interactive TTY operated by a human or authorized agent.');
+        }
+        const prompt = (0, promises_1.createInterface)({
+            input: terminal.input,
+            output: terminal.output,
+            terminal: true,
+        });
+        try {
+            return ((await prompt.question(`Type ${challenge} to continue: `)) === challenge);
+        }
+        catch {
+            throw new Error('Local protected-stage lifecycle mutation requires an interactive TTY operated by a human or authorized agent.');
+        }
+        finally {
+            prompt.close();
+        }
+    };
+}
+/**
+ * Govern refresh, remove, and unlock without replacing SST's native lifecycle.
+ * Local execution flattens the operator's federated profile into one private,
+ * invocation-scoped profile; protected stages additionally require a TTY
+ * acknowledgement. GitHub OIDC proceeds through the existing native path.
+ */
+async function runGovernedNativeOperation(command, options, context, dependencies = {}) {
+    try {
+        (0, run_sst_command_js_1.assertGovernedAwsLifecyclePlatform)(dependencies.platform);
+    }
+    catch (error) {
+        devkit_1.logger.error(error instanceof Error ? error.message : String(error));
+        return { success: false };
+    }
+    const environment = dependencies.environment ?? process.env;
+    const run = dependencies.run ?? run_sst_command_js_1.runSstCommand;
+    if (environment.GITHUB_ACTIONS === 'true') {
+        return run(command, options, context, { environment });
+    }
+    let transport;
+    try {
+        const policy = (0, index_js_2.readRepositoryOperatingPolicy)(context.root);
+        const stage = options.stage?.trim() ?? '';
+        if (!(0, index_js_2.isActiveDeploymentStage)(policy.deploymentProfile, stage)) {
+            throw new Error(`Lifecycle stage ${stage || '<absent>'} is inactive for the ${policy.deploymentProfile} deployment profile.`);
+        }
+        if ((0, index_js_2.requiresGithubDeployment)(policy.deploymentProfile, stage)) {
+            throw new Error(`The ${policy.deploymentProfile} profile requires GitHub deployment authority for ${stage}.`);
+        }
+        const region = (0, index_js_2.configuredDeploymentRegion)(policy.deploymentRegion);
+        if (options.region?.trim() && options.region.trim() !== region) {
+            throw new Error(`Lifecycle Region ${options.region.trim()} differs from committed deployment Region ${region}.`);
+        }
+        const account = (0, index_js_2.configuredDeploymentAccountForStage)(policy.deploymentProfile, policy.deploymentAccounts, stage);
+        const expectedRoleArn = (0, index_js_1.createStageAuthorityIdentity)({
+            accountId: account,
+            partition: partitionForRegion(region),
+            region,
+            stage,
+        }).deploymentRoleArn;
+        const source = (dependencies.readSource ?? readSource)(context.root);
+        if (stage !== 'development' && !source.clean) {
+            throw new Error(`Local ${stage} ${command} requires a completely clean source tree.`);
+        }
+        if (stage !== 'development') {
+            const challenge = `approve:${command}:${stage}:${source.commit}`;
+            const acknowledged = await (dependencies.approve ?? createTtyGovernedNativeOperationApprover())({
+                action: command,
+                challenge,
+                sourceCommit: source.commit,
+                stage,
+            });
+            if (!acknowledged) {
+                throw new Error(`Local ${stage} ${command} acknowledgement was declined.`);
+            }
+        }
+        transport = await (dependencies.createTransport ?? federated_credential_transport_js_1.createLocalFederatedCredentialTransport)({
+            account,
+            expectedRoleArn,
+            ...(options.profile ? { profile: options.profile } : {}),
+            region,
+        });
+        await transport.refresh();
+        const childEnvironment = {
+            ...transport.childEnvironment(environment),
+            AWS_EXPECTED_ACCOUNT_ID: account,
+            AWS_REGION: region,
+            EBK_NX_STAGE_LIFECYCLE: 'local',
+            EBK_LOCAL_SOURCE_TREE: source.workingTreeDigest,
+            EBK_SOURCE_COMMIT: source.commit,
+        };
+        const result = await run(command, {
+            ...options,
+            expectedRoleArn,
+            profile: transport.profile,
+            region,
+            stage,
+        }, context, { environment: childEnvironment });
+        transport.cleanup();
+        transport = undefined;
+        return result;
+    }
+    catch (error) {
+        devkit_1.logger.error(error instanceof Error ? error.message : String(error));
+        if (transport) {
+            try {
+                transport.cleanup();
+                transport = undefined;
+            }
+            catch {
+                devkit_1.logger.error('Local federated credential transport cleanup failed; lifecycle acceptance is blocked.');
+            }
+        }
+        return { success: false };
+    }
+}
+//# sourceMappingURL=governed-native-operation.js.map

package/src/executors/sst-lifecycle/governed-native-operation.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"governed-native-operation.js","sourceRoot":"","sources":["../../../../../../packages/nx/src/executors/sst-lifecycle/governed-native-operation.ts"],"names":[],"mappings":";;AAyFA,4FA6BC;AAQD,gEAsHC;AApPD,qDAAyD;AAGzD,uCAA0D;AAE1D,2DAA4E;AAC5E,+DAM0C;AAC1C,yGAG2D;AAC3D,qEAAyE;AACzE,6DAK8B;AA0C9B,MAAM,GAAG,GAAG,oBAAoB,CAAC;AAEjC,SAAS,kBAAkB,CAAC,MAAc;IACxC,IAAI,MAAM,CAAC,UAAU,CAAC,KAAK,CAAC;QAAE,OAAO,QAAQ,CAAC;IAC9C,IAAI,MAAM,CAAC,UAAU,CAAC,SAAS,CAAC;QAAE,OAAO,YAAY,CAAC;IACtD,OAAO,KAAK,CAAC;AACf,CAAC;AAED,SAAS,UAAU,CAAC,IAAY;IAC9B,MAAM,QAAQ,GAAG,IAAA,wCAAsB,EAAC,IAAI,CAAC,CAAC;IAC9C,MAAM,MAAM,GAAG,QAAQ,CAAC,MAAM,CAAC;IAC/B,IAAI,CAAC,GAAG,CAAC,IAAI,CAAC,MAAM,CAAC,EAAE,CAAC;QACtB,MAAM,IAAI,KAAK,CACb,iEAAiE,CAClE,CAAC;IACJ,CAAC;IACD,OAAO;QACL,KAAK,EAAE,QAAQ,CAAC,KAAK;QACrB,MAAM;QACN,iBAAiB,EAAE,QAAQ,CAAC,MAAM;KACnC,CAAC;AACJ,CAAC;AAED,wEAAwE;AACxE,SAAgB,wCAAwC,CACtD,WAA6B;IAC3B,KAAK,EAAE,OAAO,CAAC,KAAK;IACpB,MAAM,EAAE,OAAO,CAAC,MAAM;CACvB;IAED,OAAO,KAAK,EAAE,EAAE,SAAS,EAAE,EAAE,EAAE;QAC7B,IAAI,CAAC,QAAQ,CAAC,KAAK,CAAC,KAAK,IAAI,CAAC,QAAQ,CAAC,MAAM,CAAC,KAAK,EAAE,CAAC;YACpD,MAAM,IAAI,KAAK,CACb,+GAA+G,CAChH,CAAC;QACJ,CAAC;QACD,MAAM,MAAM,GAAG,IAAA,0BAAe,EAAC;YAC7B,KAAK,EAAE,QAAQ,CAAC,KAAK;YACrB,MAAM,EAAE,QAAQ,CAAC,MAAM;YACvB,QAAQ,EAAE,IAAI;SACf,CAAC,CAAC;QACH,IAAI,CAAC;YACH,OAAO,CACL,CAAC,MAAM,MAAM,CAAC,QAAQ,CAAC,QAAQ,SAAS,gBAAgB,CAAC,CAAC,KAAK,SAAS,CACzE,CAAC;QACJ,CAAC;QAAC,MAAM,CAAC;YACP,MAAM,IAAI,KAAK,CACb,+GAA+G,CAChH,CAAC;QACJ,CAAC;gBAAS,CAAC;YACT,MAAM,CAAC,KAAK,EAAE,CAAC;QACjB,CAAC;IACH,CAAC,CAAC;AACJ,CAAC;AAED;;;;;GAKG;AACI,KAAK,UAAU,0BAA0B,CAC9C,OAAgC,EAChC,OAA4B,EAC5B,OAAwB,EACxB,eAAoD,EAAE;IAEtD,IAAI,CAAC;QACH,IAAA,uDAAkC,EAAC,YAAY,CAAC,QAAQ,CAAC,CAAC;IAC5D,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,eAAM,CAAC,KAAK,CAAC,KAAK,YAAY,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,CAAC;QACrE,OAAO,EAAE,OAAO,EAAE,KAAK,EAAE,CAAC;IAC5B,CAAC;IACD,MAAM,WAAW,GAAG,YAAY,CAAC,WAAW,IAAI,OAAO,CAAC,GAAG,CAAC;IAC5D,MAAM,GAAG,GAAG,YAAY,CAAC,GAAG,IAAI,kCAAa,CAAC;IAC9C,IAAI,WAAW,CAAC,cAAc,KAAK,MAAM,EAAE,CAAC;QAC1C,OAAO,GAAG,CAAC,OAAO,EAAE,OAAO,EAAE,OAAO,EAAE,EAAE,WAAW,EAAE,CAAC,CAAC;IACzD,CAAC;IAED,IAAI,SAAwD,CAAC;IAC7D,IAAI,CAAC;QACH,MAAM,MAAM,GAAG,IAAA,wCAA6B,EAAC,OAAO,CAAC,IAAI,CAAC,CAAC;QAC3D,MAAM,KAAK,GAAG,OAAO,CAAC,KAAK,EAAE,IAAI,EAAE,IAAI,EAAE,CAAC;QAC1C,IAAI,CAAC,IAAA,kCAAuB,EAAC,MAAM,CAAC,iBAAiB,EAAE,KAAK,CAAC,EAAE,CAAC;YAC9D,MAAM,IAAI,KAAK,CACb,mBAAmB,KAAK,IAAI,UAAU,wBAAwB,MAAM,CAAC,iBAAiB,sBAAsB,CAC7G,CAAC;QACJ,CAAC;QACD,IAAI,IAAA,mCAAwB,EAAC,MAAM,CAAC,iBAAiB,EAAE,KAAK,CAAC,EAAE,CAAC;YAC9D,MAAM,IAAI,KAAK,CACb,OAAO,MAAM,CAAC,iBAAiB,qDAAqD,KAAK,GAAG,CAC7F,CAAC;QACJ,CAAC;QACD,MAAM,MAAM,GAAG,IAAA,qCAA0B,EAAC,MAAM,CAAC,gBAAgB,CAAC,CAAC;QACnE,IAAI,OAAO,CAAC,MAAM,EAAE,IAAI,EAAE,IAAI,OAAO,CAAC,MAAM,CAAC,IAAI,EAAE,KAAK,MAAM,EAAE,CAAC;YAC/D,MAAM,IAAI,KAAK,CACb,oBAAoB,OAAO,CAAC,MAAM,CAAC,IAAI,EAAE,6CAA6C,MAAM,GAAG,CAChG,CAAC;QACJ,CAAC;QACD,MAAM,OAAO,GAAG,IAAA,8CAAmC,EACjD,MAAM,CAAC,iBAAiB,EACxB,MAAM,CAAC,kBAAkB,EACzB,KAAK,CACN,CAAC;QACF,MAAM,eAAe,GAAG,IAAA,uCAA4B,EAAC;YACnD,SAAS,EAAE,OAAO;YAClB,SAAS,EAAE,kBAAkB,CAAC,MAAM,CAAC;YACrC,MAAM;YACN,KAAK;SACN,CAAC,CAAC,iBAAiB,CAAC;QACrB,MAAM,MAAM,GAAG,CAAC,YAAY,CAAC,UAAU,IAAI,UAAU,CAAC,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC;QACrE,IAAI,KAAK,KAAK,aAAa,IAAI,CAAC,MAAM,CAAC,KAAK,EAAE,CAAC;YAC7C,MAAM,IAAI,KAAK,CACb,SAAS,KAAK,IAAI,OAAO,2CAA2C,CACrE,CAAC;QACJ,CAAC;QACD,IAAI,KAAK,KAAK,aAAa,EAAE,CAAC;YAC5B,MAAM,SAAS,GAAG,WAAW,OAAO,IAAI,KAAK,IAAI,MAAM,CAAC,MAAM,EAAE,CAAC;YACjE,MAAM,YAAY,GAAG,MAAM,CACzB,YAAY,CAAC,OAAO,IAAI,wCAAwC,EAAE,CACnE,CAAC;gBACA,MAAM,EAAE,OAAO;gBACf,SAAS;gBACT,YAAY,EAAE,MAAM,CAAC,MAAM;gBAC3B,KAAK;aACN,CAAC,CAAC;YACH,IAAI,CAAC,YAAY,EAAE,CAAC;gBAClB,MAAM,IAAI,KAAK,CACb,SAAS,KAAK,IAAI,OAAO,gCAAgC,CAC1D,CAAC;YACJ,CAAC;QACH,CAAC;QAED,SAAS,GAAG,MAAM,CAChB,YAAY,CAAC,eAAe,IAAI,2EAAuC,CACxE,CAAC;YACA,OAAO;YACP,eAAe;YACf,GAAG,CAAC,OAAO,CAAC,OAAO,CAAC,CAAC,CAAC,EAAE,OAAO,EAAE,OAAO,CAAC,OAAO,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;YACxD,MAAM;SACP,CAAC,CAAC;QACH,MAAM,SAAS,CAAC,OAAO,EAAE,CAAC;QAC1B,MAAM,gBAAgB,GAAG;YACvB,GAAG,SAAS,CAAC,gBAAgB,CAAC,WAAW,CAAC;YAC1C,uBAAuB,EAAE,OAAO;YAChC,UAAU,EAAE,MAAM;YAClB,sBAAsB,EAAE,OAAO;YAC/B,qBAAqB,EAAE,MAAM,CAAC,iBAAiB;YAC/C,iBAAiB,EAAE,MAAM,CAAC,MAAM;SACjC,CAAC;QACF,MAAM,MAAM,GAAG,MAAM,GAAG,CACtB,OAAO,EACP;YACE,GAAG,OAAO;YACV,eAAe;YACf,OAAO,EAAE,SAAS,CAAC,OAAO;YAC1B,MAAM;YACN,KAAK;SACN,EACD,OAAO,EACP,EAAE,WAAW,EAAE,gBAAgB,EAAE,CAClC,CAAC;QACF,SAAS,CAAC,OAAO,EAAE,CAAC;QACpB,SAAS,GAAG,SAAS,CAAC;QACtB,OAAO,MAAM,CAAC;IAChB,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,eAAM,CAAC,KAAK,CAAC,KAAK,YAAY,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,CAAC;QACrE,IAAI,SAAS,EAAE,CAAC;YACd,IAAI,CAAC;gBACH,SAAS,CAAC,OAAO,EAAE,CAAC;gBACpB,SAAS,GAAG,SAAS,CAAC;YACxB,CAAC;YAAC,MAAM,CAAC;gBACP,eAAM,CAAC,KAAK,CACV,uFAAuF,CACxF,CAAC;YACJ,CAAC;QACH,CAAC;QACD,OAAO,EAAE,OAAO,EAAE,KAAK,EAAE,CAAC;IAC5B,CAAC;AACH,CAAC"}

package/src/executors/sst-lifecycle/run-sst-command.d.ts

@@ -3,15 +3,14 @@ import { spawn } from 'node:child_process';
 import { type FoundationStageResolution } from '../../foundation/stages.js';
 import { type PersonalStageResolver } from '../../local-dev/personal-stage.js';
 import { type DeploymentProfile } from '../../repository-policy/index.js';
-import { preflightManagedLogGroups } from './logging-preflight.js';
 import { preflightSliceSecretMetadata } from './secret-preflight.js';
+import { retireGeneratedSecretsAfterSliceRemove } from './generated-secret-retirement.js';
 export type SstLifecycleCommand = 'deploy' | 'dev' | 'refresh' | 'remove' | 'unlock';
 export interface SstLifecycleOptions {
     args?: string[];
     cwd?: string;
     expectedRoleArn?: string;
     foundationStage?: string;
-    localProductionConfirmation?: string;
     profile?: string;
     region?: string;
     stage?: string;
@@ -28,20 +27,39 @@ export interface SstCommandInvocation {
         EBK_CONSUMER_STAGE: string;
         EBK_EXPECTED_DEPLOYMENT_ROLE_ARN?: string;
         EBK_FOUNDATION_STAGE: string;
+        EBK_LOCAL_SOURCE_TREE?: string;
         EBK_PRODUCTION_FOUNDATION_PROFILE?: string;
+        EBK_SOURCE_COMMIT?: string;
     };
     executable: string;
 }
 export interface SstLifecyclePreflightDependencies {
-    infrastructureAuthorization?: (command: 'deploy' | 'refresh' | 'remove', options: SstLifecycleOptions, context: ExecutorContext, invocation: SstCommandInvocation) => Promise<void>;
-    logging?: typeof preflightManagedLogGroups;
     secrets?: typeof preflightSliceSecretMetadata;
-    unlockAuthorization?: (options: SstLifecycleOptions, invocation: SstCommandInvocation) => Promise<void> | void;
+    unlockAuthorization?: (options: SstLifecycleOptions, invocation: SstCommandInvocation, environment?: NodeJS.ProcessEnv) => Promise<void> | void;
 }
 interface SstLifecycleRuntimeDependencies extends SstLifecyclePreflightDependencies {
-    infrastructureConvergence?: (command: 'deploy' | 'refresh' | 'remove', options: SstLifecycleOptions, context: ExecutorContext, invocation: SstCommandInvocation, applySucceeded: boolean) => Promise<boolean>;
+    environment?: NodeJS.ProcessEnv;
+    generatedSecretRetirement?: typeof retireGeneratedSecretsAfterSliceRemove;
+    platform?: NodeJS.Platform;
     spawnChild?: typeof spawn;
 }
+export declare function assertGovernedAwsLifecyclePlatform(platform?: NodeJS.Platform): void;
+export interface GovernedChildProcessResult {
+    error?: Error;
+    signal: NodeJS.Signals | null;
+    status: number | null;
+}
+/** Run one exact shell-free child as an owned process tree. The returned
+ * promise settles only after child teardown and the bounded caller-supplied
+ * close reconciliation complete. */
+export declare function runGovernedChildProcess(input: {
+    afterClose?: (result: GovernedChildProcessResult) => Promise<void> | void;
+    args: readonly string[];
+    cwd: string;
+    environment: NodeJS.ProcessEnv;
+    executable: string;
+    spawnChild?: typeof spawn;
+}): Promise<GovernedChildProcessResult>;
 export declare function createSstChildEnvironment(ambient: NodeJS.ProcessEnv, invocation: SstCommandInvocation['environment']): NodeJS.ProcessEnv;
 export declare function assertSafeSstForwardedArguments(args: readonly string[]): void;
 export declare function resolveSstDevMode(environment: NodeJS.ProcessEnv, forwardedArguments?: readonly string[]): 'basic' | 'mono' | undefined;
@@ -50,7 +68,7 @@ export declare function resolveSstLifecycleStages(options: SstLifecycleOptions,
 export declare function buildSstCommandInvocation(command: SstLifecycleCommand, options: SstLifecycleOptions, context: ExecutorContext, environment?: NodeJS.ProcessEnv, dependencies?: {
     personalStageResolver?: PersonalStageResolver;
 }): SstCommandInvocation;
-export declare function runSstLifecyclePreflights(command: SstLifecycleCommand, options: SstLifecycleOptions, context: ExecutorContext, invocation: SstCommandInvocation, dependencies?: SstLifecyclePreflightDependencies): Promise<void>;
+export declare function runSstLifecyclePreflights(command: SstLifecycleCommand, options: SstLifecycleOptions, context: ExecutorContext, invocation: SstCommandInvocation, dependencies?: SstLifecyclePreflightDependencies, environment?: NodeJS.ProcessEnv): Promise<void>;
 export declare function runSstCommand(command: SstLifecycleCommand, options: SstLifecycleOptions, context: ExecutorContext, dependencies?: SstLifecycleRuntimeDependencies): Promise<{
     success: boolean;
 }>;