@empire-builder-kit/nx 1.0.0-rc.30 → 1.0.0-rc.31

package/src/secrets/metadata.js

@@ -23,8 +23,9 @@ function expectedDeclarations(declarations, scope) {
     const names = new Set();
     for (const declaration of declarations) {
         (0, model_js_1.validateSecretMetadataDeclaration)(declaration);
-        if (declaration.source !== 'operator') {
-            throw new model_js_1.SecretMetadataModelError(`declarations.${declaration.logicalName}.source`, 'must be operator for the operator-secret metadata path');
+        if (declaration.source !== 'operator' &&
+            declaration.source !== 'generated') {
+            throw new model_js_1.SecretMetadataModelError(`declarations.${declaration.logicalName}.source`, 'must be operator or generated for the deployed-secret metadata path');
         }
         if (names.has(declaration.logicalName)) {
             throw new model_js_1.SecretMetadataModelError('declarations', 'must not contain duplicate logical names');
@@ -54,6 +55,17 @@ function identityDisposition(observed, expectedTags) {
     }
     return present.length === identityTagKeys.length ? 'owned' : 'ambiguous';
 }
+function managementDisposition(observed, expectedTags) {
+    const actualManagement = observed.tags[model_js_1.SECRET_METADATA_TAG_KEYS.management];
+    const expectedManagement = expectedTags[model_js_1.SECRET_METADATA_TAG_KEYS.management];
+    const actualGeneration = observed.tags[model_js_1.SECRET_METADATA_TAG_KEYS.generation];
+    const expectedGeneration = expectedTags[model_js_1.SECRET_METADATA_TAG_KEYS.generation];
+    if (actualManagement === expectedManagement &&
+        actualGeneration === expectedGeneration) {
+        return 'owned';
+    }
+    return 'conflicting';
+}
 function tagsDiffer(observed, expected) {
     return Object.entries(expected).some(([key, value]) => observed.tags[key] !== value);
 }
@@ -83,12 +95,17 @@ function reconcileSecretMetadata(input) {
         const actual = observed.get(name);
         if (actual === undefined) {
             findings.push(finding('missing-container', name, declaration.logicalName, 'blocking'));
-            proposedMutations.push({
-                description: `EBK operator secret ${declaration.logicalName}`,
-                kind: 'create-empty-container',
-                name,
-                tags: expectedTags,
-            });
+            // A generated value and its container are one atomic Secrets Manager
+            // creation. Metadata reconciliation may create only value-free operator
+            // containers; the generated initializer owns the generated container.
+            if (declaration.source !== 'generated') {
+                proposedMutations.push({
+                    description: `EBK ${declaration.source} secret ${declaration.logicalName}`,
+                    kind: 'create-empty-container',
+                    name,
+                    tags: expectedTags,
+                });
+            }
             continue;
         }
         const ownership = identityDisposition(actual, expectedTags);
@@ -100,6 +117,11 @@ function reconcileSecretMetadata(input) {
             findings.push(finding('identity-conflict', name, declaration.logicalName, 'blocking'));
             continue;
         }
+        const management = managementDisposition(actual, expectedTags);
+        if (management === 'conflicting') {
+            findings.push(finding('identity-conflict', name, declaration.logicalName, 'blocking'));
+            continue;
+        }
         if (tagsDiffer(actual, expectedTags)) {
             findings.push(finding('tag-drift', name, declaration.logicalName, 'warning'));
             proposedMutations.push({
@@ -118,8 +140,10 @@ function reconcileSecretMetadata(input) {
                 input.scope.workspace &&
             actual.tags[model_js_1.SECRET_METADATA_TAG_KEYS.stage] === input.scope.stage &&
             actual.tags[model_js_1.SECRET_METADATA_TAG_KEYS.slice] === input.scope.slice &&
-            actual.tags[model_js_1.SECRET_METADATA_TAG_KEYS.management] ===
-                model_js_1.OPERATOR_SECRET_MANAGEMENT_CLASS) {
+            (actual.tags[model_js_1.SECRET_METADATA_TAG_KEYS.management] ===
+                model_js_1.OPERATOR_SECRET_MANAGEMENT_CLASS ||
+                actual.tags[model_js_1.SECRET_METADATA_TAG_KEYS.management] ===
+                    model_js_1.GENERATED_SECRET_MANAGEMENT_CLASS)) {
             findings.push(finding('orphan-container', actual.name, actual.tags[model_js_1.SECRET_METADATA_TAG_KEYS.logicalName], 'warning'));
         }
     }
@@ -156,6 +180,10 @@ function preflightSecretMetadata(input) {
             findings.push(finding('identity-conflict', name, declaration.logicalName, 'blocking'));
             continue;
         }
+        if (managementDisposition(actual, expectedTags) === 'conflicting') {
+            findings.push(finding('identity-conflict', name, declaration.logicalName, 'blocking'));
+            continue;
+        }
         if (!actual.versionStages.includes('AWSCURRENT')) {
             findings.push(finding('missing-current-version', name, declaration.logicalName, 'blocking'));
         }

package/src/secrets/metadata.js.map

@@ -1 +1 @@
-{"version":3,"file":"metadata.js","sourceRoot":"","sources":["../../../../../packages/nx/src/secrets/metadata.ts"],"names":[],"mappings":";;;AAuKA,0DAiHC;AAED,0DAkEC;AA5VD,yCAaoB;AAEP,QAAA,6BAA6B,GAAG;IAC3C,mBAAmB;IACnB,mBAAmB;IACnB,yBAAyB;IACzB,kBAAkB;IAClB,qBAAqB;IACrB,2BAA2B;IAC3B,WAAW;CACH,CAAC;AAuDX,MAAM,eAAe,GAAG;IACtB,mCAAwB,CAAC,SAAS;IAClC,mCAAwB,CAAC,KAAK;IAC9B,mCAAwB,CAAC,KAAK;IAC9B,mCAAwB,CAAC,WAAW;CAC5B,CAAC;AAEX,SAAS,oBAAoB,CAC3B,YAAkD,EAClD,KAA4B;IAE5B,MAAM,KAAK,GAAG,IAAI,GAAG,EAAU,CAAC;IAChC,KAAK,MAAM,WAAW,IAAI,YAAY,EAAE,CAAC;QACvC,IAAA,4CAAiC,EAAC,WAAW,CAAC,CAAC;QAC/C,IAAI,WAAW,CAAC,MAAM,KAAK,UAAU,EAAE,CAAC;YACtC,MAAM,IAAI,mCAAwB,CAChC,gBAAgB,WAAW,CAAC,WAAW,SAAS,EAChD,wDAAwD,CACzD,CAAC;QACJ,CAAC;QACD,IAAI,KAAK,CAAC,GAAG,CAAC,WAAW,CAAC,WAAW,CAAC,EAAE,CAAC;YACvC,MAAM,IAAI,mCAAwB,CAChC,cAAc,EACd,0CAA0C,CAC3C,CAAC;QACJ,CAAC;QACD,KAAK,CAAC,GAAG,CAAC,WAAW,CAAC,WAAW,CAAC,CAAC;IACrC,CAAC;IACD,OAAO,YAAY,CAAC,MAAM,CAAC,CAAC,WAAW,EAAE,EAAE,CACzC,WAAW,CAAC,cAAc,CAAC,QAAQ,CAAC,KAAK,CAAC,KAAK,CAAC,CACjD,CAAC;AACJ,CAAC;AAED,SAAS,kBAAkB,CACzB,QAA2C;IAE3C,MAAM,MAAM,GAAG,IAAI,GAAG,EAAkC,CAAC;IACzD,KAAK,MAAM,IAAI,IAAI,QAAQ,EAAE,CAAC;QAC5B,IAAA,yCAA8B,EAAC,IAAI,CAAC,CAAC;QACrC,IAAI,MAAM,CAAC,GAAG,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC;YAC1B,MAAM,IAAI,mCAAwB,CAChC,UAAU,EACV,yCAAyC,CAC1C,CAAC;QACJ,CAAC;QACD,MAAM,CAAC,GAAG,CAAC,IAAI,CAAC,IAAI,EAAE,IAAI,CAAC,CAAC;IAC9B,CAAC;IACD,OAAO,MAAM,CAAC;AAChB,CAAC;AAED,SAAS,mBAAmB,CAC1B,QAAgC,EAChC,YAA8C;IAE9C,MAAM,OAAO,GAAG,eAAe,CAAC,MAAM,CACpC,CAAC,GAAG,EAAE,EAAE,CAAC,QAAQ,CAAC,IAAI,CAAC,GAAG,CAAC,KAAK,SAAS,CAC1C,CAAC;IACF,IAAI,OAAO,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QACzB,OAAO,WAAW,CAAC;IACrB,CAAC;IACD,IAAI,OAAO,CAAC,IAAI,CAAC,CAAC,GAAG,EAAE,EAAE,CAAC,QAAQ,CAAC,IAAI,CAAC,GAAG,CAAC,KAAK,YAAY,CAAC,GAAG,CAAC,CAAC,EAAE,CAAC;QACpE,OAAO,aAAa,CAAC;IACvB,CAAC;IACD,OAAO,OAAO,CAAC,MAAM,KAAK,eAAe,CAAC,MAAM,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,WAAW,CAAC;AAC3E,CAAC;AAED,SAAS,UAAU,CACjB,QAAgC,EAChC,QAA0C;IAE1C,OAAO,MAAM,CAAC,OAAO,CAAC,QAAQ,CAAC,CAAC,IAAI,CAClC,CAAC,CAAC,GAAG,EAAE,KAAK,CAAC,EAAE,EAAE,CAAC,QAAQ,CAAC,IAAI,CAAC,GAAG,CAAC,KAAK,KAAK,CAC/C,CAAC;AACJ,CAAC;AAED,SAAS,OAAO,CACd,IAA+B,EAC/B,IAAY,EACZ,WAA+B,EAC/B,QAAgC;IAEhC,OAAO;QACL,IAAI;QACJ,GAAG,CAAC,WAAW,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,WAAW,EAAE,CAAC;QACrD,IAAI;QACJ,QAAQ;KACT,CAAC;AACJ,CAAC;AAED,SAAgB,uBAAuB,CACrC,KAA0B;IAE1B,IAAA,wCAA6B,EAAC,KAAK,CAAC,KAAK,CAAC,CAAC;IAC3C,MAAM,IAAI,GAAG,KAAK,CAAC,IAAI,IAAI,QAAQ,CAAC;IACpC,IAAI,IAAI,KAAK,OAAO,IAAI,IAAI,KAAK,QAAQ,EAAE,CAAC;QAC1C,MAAM,IAAI,mCAAwB,CAChC,MAAM,EACN,kCAAkC,CACnC,CAAC;IACJ,CAAC;IACD,MAAM,YAAY,GAAG,oBAAoB,CAAC,KAAK,CAAC,YAAY,EAAE,KAAK,CAAC,KAAK,CAAC,CAAC;IAC3E,MAAM,QAAQ,GAAG,kBAAkB,CAAC,KAAK,CAAC,QAAQ,CAAC,CAAC;IACpD,MAAM,aAAa,GAAG,IAAI,GAAG,EAAU,CAAC;IACxC,MAAM,QAAQ,GAA4B,EAAE,CAAC;IAC7C,MAAM,iBAAiB,GAAmC,EAAE,CAAC;IAE7D,KAAK,MAAM,WAAW,IAAI,YAAY,EAAE,CAAC;QACvC,MAAM,IAAI,GAAG,IAAA,sCAA2B,EACtC,KAAK,CAAC,KAAK,EACX,WAAW,CAAC,WAAW,CACxB,CAAC;QACF,aAAa,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC;QACxB,MAAM,YAAY,GAAG,IAAA,sCAA2B,EAAC,KAAK,CAAC,KAAK,EAAE,WAAW,CAAC,CAAC;QAC3E,MAAM,MAAM,GAAG,QAAQ,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC;QAClC,IAAI,MAAM,KAAK,SAAS,EAAE,CAAC;YACzB,QAAQ,CAAC,IAAI,CACX,OAAO,CAAC,mBAAmB,EAAE,IAAI,EAAE,WAAW,CAAC,WAAW,EAAE,UAAU,CAAC,CACxE,CAAC;YACF,iBAAiB,CAAC,IAAI,CAAC;gBACrB,WAAW,EAAE,uBAAuB,WAAW,CAAC,WAAW,EAAE;gBAC7D,IAAI,EAAE,wBAAwB;gBAC9B,IAAI;gBACJ,IAAI,EAAE,YAAY;aACnB,CAAC,CAAC;YACH,SAAS;QACX,CAAC;QAED,MAAM,SAAS,GAAG,mBAAmB,CAAC,MAAM,EAAE,YAAY,CAAC,CAAC;QAC5D,IAAI,SAAS,KAAK,WAAW,EAAE,CAAC;YAC9B,QAAQ,CAAC,IAAI,CACX,OAAO,CACL,qBAAqB,EACrB,IAAI,EACJ,WAAW,CAAC,WAAW,EACvB,UAAU,CACX,CACF,CAAC;YACF,SAAS;QACX,CAAC;QACD,IAAI,SAAS,KAAK,aAAa,EAAE,CAAC;YAChC,QAAQ,CAAC,IAAI,CACX,OAAO,CAAC,mBAAmB,EAAE,IAAI,EAAE,WAAW,CAAC,WAAW,EAAE,UAAU,CAAC,CACxE,CAAC;YACF,SAAS;QACX,CAAC;QACD,IAAI,UAAU,CAAC,MAAM,EAAE,YAAY,CAAC,EAAE,CAAC;YACrC,QAAQ,CAAC,IAAI,CACX,OAAO,CAAC,WAAW,EAAE,IAAI,EAAE,WAAW,CAAC,WAAW,EAAE,SAAS,CAAC,CAC/D,CAAC;YACF,iBAAiB,CAAC,IAAI,CAAC;gBACrB,GAAG,EAAE,MAAM,CAAC,GAAG;gBACf,IAAI,EAAE,UAAU;gBAChB,IAAI,EAAE,YAAY;aACnB,CAAC,CAAC;QACL,CAAC;QACD,IAAI,CAAC,IAAA,8BAAmB,EAAC,WAAW,EAAE,MAAM,CAAC,EAAE,CAAC;YAC9C,QAAQ,CAAC,IAAI,CACX,OAAO,CACL,2BAA2B,EAC3B,IAAI,EACJ,WAAW,CAAC,WAAW,EACvB,UAAU,CACX,CACF,CAAC;QACJ,CAAC;IACH,CAAC;IAED,KAAK,MAAM,MAAM,IAAI,QAAQ,CAAC,MAAM,EAAE,EAAE,CAAC;QACvC,IACE,CAAC,aAAa,CAAC,GAAG,CAAC,MAAM,CAAC,IAAI,CAAC;YAC/B,MAAM,CAAC,IAAI,CAAC,mCAAwB,CAAC,SAAS,CAAC;gBAC7C,KAAK,CAAC,KAAK,CAAC,SAAS;YACvB,MAAM,CAAC,IAAI,CAAC,mCAAwB,CAAC,KAAK,CAAC,KAAK,KAAK,CAAC,KAAK,CAAC,KAAK;YACjE,MAAM,CAAC,IAAI,CAAC,mCAAwB,CAAC,KAAK,CAAC,KAAK,KAAK,CAAC,KAAK,CAAC,KAAK;YACjE,MAAM,CAAC,IAAI,CAAC,mCAAwB,CAAC,UAAU,CAAC;gBAC9C,2CAAgC,EAClC,CAAC;YACD,QAAQ,CAAC,IAAI,CACX,OAAO,CACL,kBAAkB,EAClB,MAAM,CAAC,IAAI,EACX,MAAM,CAAC,IAAI,CAAC,mCAAwB,CAAC,WAAW,CAAC,EACjD,SAAS,CACV,CACF,CAAC;QACJ,CAAC;IACH,CAAC;IAED,MAAM,eAAe,GAAG,QAAQ,CAAC,IAAI,CACnC,CAAC,EAAE,IAAI,EAAE,EAAE,EAAE,CACX,IAAI,KAAK,mBAAmB,IAAI,IAAI,KAAK,qBAAqB,CACjE,CAAC;IACF,OAAO,MAAM,CAAC,MAAM,CAAC;QACnB,mBAAmB,EACjB,IAAI,KAAK,OAAO,IAAI,CAAC,eAAe;YAClC,CAAC,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC,GAAG,iBAAiB,CAAC,CAAC;YACvC,CAAC,CAAC,EAAE;QACR,QAAQ,EAAE,MAAM,CAAC,MAAM,CAAC,QAAQ,CAAC;QACjC,IAAI;QACJ,iBAAiB,EAAE,MAAM,CAAC,MAAM,CAAC,iBAAiB,CAAC;QACnD,MAAM,EAAE,QAAQ,CAAC,MAAM,KAAK,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,SAAS;KACpD,CAAC,CAAC;AACL,CAAC;AAED,SAAgB,uBAAuB,CACrC,KAAqB;IAErB,IAAA,wCAA6B,EAAC,KAAK,CAAC,KAAK,CAAC,CAAC;IAC3C,MAAM,YAAY,GAAG,oBAAoB,CAAC,KAAK,CAAC,YAAY,EAAE,KAAK,CAAC,KAAK,CAAC,CAAC;IAC3E,MAAM,QAAQ,GAAG,kBAAkB,CAAC,KAAK,CAAC,QAAQ,CAAC,CAAC;IACpD,MAAM,QAAQ,GAA4B,EAAE,CAAC;IAE7C,KAAK,MAAM,WAAW,IAAI,YAAY,EAAE,CAAC;QACvC,MAAM,IAAI,GAAG,IAAA,sCAA2B,EACtC,KAAK,CAAC,KAAK,EACX,WAAW,CAAC,WAAW,CACxB,CAAC;QACF,MAAM,MAAM,GAAG,QAAQ,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC;QAClC,IAAI,MAAM,KAAK,SAAS,EAAE,CAAC;YACzB,QAAQ,CAAC,IAAI,CACX,OAAO,CAAC,mBAAmB,EAAE,IAAI,EAAE,WAAW,CAAC,WAAW,EAAE,UAAU,CAAC,CACxE,CAAC;YACF,SAAS;QACX,CAAC;QAED,MAAM,YAAY,GAAG,IAAA,sCAA2B,EAAC,KAAK,CAAC,KAAK,EAAE,WAAW,CAAC,CAAC;QAC3E,MAAM,SAAS,GAAG,mBAAmB,CAAC,MAAM,EAAE,YAAY,CAAC,CAAC;QAC5D,IAAI,SAAS,KAAK,WAAW,EAAE,CAAC;YAC9B,QAAQ,CAAC,IAAI,CACX,OAAO,CACL,qBAAqB,EACrB,IAAI,EACJ,WAAW,CAAC,WAAW,EACvB,UAAU,CACX,CACF,CAAC;YACF,SAAS;QACX,CAAC;QACD,IAAI,SAAS,KAAK,aAAa,EAAE,CAAC;YAChC,QAAQ,CAAC,IAAI,CACX,OAAO,CAAC,mBAAmB,EAAE,IAAI,EAAE,WAAW,CAAC,WAAW,EAAE,UAAU,CAAC,CACxE,CAAC;YACF,SAAS;QACX,CAAC;QACD,IAAI,CAAC,MAAM,CAAC,aAAa,CAAC,QAAQ,CAAC,YAAY,CAAC,EAAE,CAAC;YACjD,QAAQ,CAAC,IAAI,CACX,OAAO,CACL,yBAAyB,EACzB,IAAI,EACJ,WAAW,CAAC,WAAW,EACvB,UAAU,CACX,CACF,CAAC;QACJ,CAAC;QACD,IAAI,CAAC,IAAA,8BAAmB,EAAC,WAAW,EAAE,MAAM,CAAC,EAAE,CAAC;YAC9C,QAAQ,CAAC,IAAI,CACX,OAAO,CACL,2BAA2B,EAC3B,IAAI,EACJ,WAAW,CAAC,WAAW,EACvB,UAAU,CACX,CACF,CAAC;QACJ,CAAC;IACH,CAAC;IAED,OAAO,MAAM,CAAC,MAAM,CAAC;QACnB,QAAQ,EAAE,MAAM,CAAC,MAAM,CAAC,QAAQ,CAAC;QACjC,KAAK,EAAE,QAAQ,CAAC,MAAM,KAAK,CAAC;KAC7B,CAAC,CAAC;AACL,CAAC"}
+{"version":3,"file":"metadata.js","sourceRoot":"","sources":["../../../../../packages/nx/src/secrets/metadata.ts"],"names":[],"mappings":";;;AA4LA,0DA+HC;AAED,0DAwEC;AArYD,yCAcoB;AAEP,QAAA,6BAA6B,GAAG;IAC3C,mBAAmB;IACnB,mBAAmB;IACnB,yBAAyB;IACzB,kBAAkB;IAClB,qBAAqB;IACrB,2BAA2B;IAC3B,WAAW;CACH,CAAC;AAuDX,MAAM,eAAe,GAAG;IACtB,mCAAwB,CAAC,SAAS;IAClC,mCAAwB,CAAC,KAAK;IAC9B,mCAAwB,CAAC,KAAK;IAC9B,mCAAwB,CAAC,WAAW;CAC5B,CAAC;AAEX,SAAS,oBAAoB,CAC3B,YAAkD,EAClD,KAA4B;IAE5B,MAAM,KAAK,GAAG,IAAI,GAAG,EAAU,CAAC;IAChC,KAAK,MAAM,WAAW,IAAI,YAAY,EAAE,CAAC;QACvC,IAAA,4CAAiC,EAAC,WAAW,CAAC,CAAC;QAC/C,IACE,WAAW,CAAC,MAAM,KAAK,UAAU;YACjC,WAAW,CAAC,MAAM,KAAK,WAAW,EAClC,CAAC;YACD,MAAM,IAAI,mCAAwB,CAChC,gBAAgB,WAAW,CAAC,WAAW,SAAS,EAChD,qEAAqE,CACtE,CAAC;QACJ,CAAC;QACD,IAAI,KAAK,CAAC,GAAG,CAAC,WAAW,CAAC,WAAW,CAAC,EAAE,CAAC;YACvC,MAAM,IAAI,mCAAwB,CAChC,cAAc,EACd,0CAA0C,CAC3C,CAAC;QACJ,CAAC;QACD,KAAK,CAAC,GAAG,CAAC,WAAW,CAAC,WAAW,CAAC,CAAC;IACrC,CAAC;IACD,OAAO,YAAY,CAAC,MAAM,CAAC,CAAC,WAAW,EAAE,EAAE,CACzC,WAAW,CAAC,cAAc,CAAC,QAAQ,CAAC,KAAK,CAAC,KAAK,CAAC,CACjD,CAAC;AACJ,CAAC;AAED,SAAS,kBAAkB,CACzB,QAA2C;IAE3C,MAAM,MAAM,GAAG,IAAI,GAAG,EAAkC,CAAC;IACzD,KAAK,MAAM,IAAI,IAAI,QAAQ,EAAE,CAAC;QAC5B,IAAA,yCAA8B,EAAC,IAAI,CAAC,CAAC;QACrC,IAAI,MAAM,CAAC,GAAG,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC;YAC1B,MAAM,IAAI,mCAAwB,CAChC,UAAU,EACV,yCAAyC,CAC1C,CAAC;QACJ,CAAC;QACD,MAAM,CAAC,GAAG,CAAC,IAAI,CAAC,IAAI,EAAE,IAAI,CAAC,CAAC;IAC9B,CAAC;IACD,OAAO,MAAM,CAAC;AAChB,CAAC;AAED,SAAS,mBAAmB,CAC1B,QAAgC,EAChC,YAA8C;IAE9C,MAAM,OAAO,GAAG,eAAe,CAAC,MAAM,CACpC,CAAC,GAAG,EAAE,EAAE,CAAC,QAAQ,CAAC,IAAI,CAAC,GAAG,CAAC,KAAK,SAAS,CAC1C,CAAC;IACF,IAAI,OAAO,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QACzB,OAAO,WAAW,CAAC;IACrB,CAAC;IACD,IAAI,OAAO,CAAC,IAAI,CAAC,CAAC,GAAG,EAAE,EAAE,CAAC,QAAQ,CAAC,IAAI,CAAC,GAAG,CAAC,KAAK,YAAY,CAAC,GAAG,CAAC,CAAC,EAAE,CAAC;QACpE,OAAO,aAAa,CAAC;IACvB,CAAC;IACD,OAAO,OAAO,CAAC,MAAM,KAAK,eAAe,CAAC,MAAM,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,WAAW,CAAC;AAC3E,CAAC;AAED,SAAS,qBAAqB,CAC5B,QAAgC,EAChC,YAA8C;IAE9C,MAAM,gBAAgB,GAAG,QAAQ,CAAC,IAAI,CAAC,mCAAwB,CAAC,UAAU,CAAC,CAAC;IAC5E,MAAM,kBAAkB,GAAG,YAAY,CAAC,mCAAwB,CAAC,UAAU,CAAC,CAAC;IAC7E,MAAM,gBAAgB,GAAG,QAAQ,CAAC,IAAI,CAAC,mCAAwB,CAAC,UAAU,CAAC,CAAC;IAC5E,MAAM,kBAAkB,GAAG,YAAY,CAAC,mCAAwB,CAAC,UAAU,CAAC,CAAC;IAC7E,IACE,gBAAgB,KAAK,kBAAkB;QACvC,gBAAgB,KAAK,kBAAkB,EACvC,CAAC;QACD,OAAO,OAAO,CAAC;IACjB,CAAC;IACD,OAAO,aAAa,CAAC;AACvB,CAAC;AAED,SAAS,UAAU,CACjB,QAAgC,EAChC,QAA0C;IAE1C,OAAO,MAAM,CAAC,OAAO,CAAC,QAAQ,CAAC,CAAC,IAAI,CAClC,CAAC,CAAC,GAAG,EAAE,KAAK,CAAC,EAAE,EAAE,CAAC,QAAQ,CAAC,IAAI,CAAC,GAAG,CAAC,KAAK,KAAK,CAC/C,CAAC;AACJ,CAAC;AAED,SAAS,OAAO,CACd,IAA+B,EAC/B,IAAY,EACZ,WAA+B,EAC/B,QAAgC;IAEhC,OAAO;QACL,IAAI;QACJ,GAAG,CAAC,WAAW,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,WAAW,EAAE,CAAC;QACrD,IAAI;QACJ,QAAQ;KACT,CAAC;AACJ,CAAC;AAED,SAAgB,uBAAuB,CACrC,KAA0B;IAE1B,IAAA,wCAA6B,EAAC,KAAK,CAAC,KAAK,CAAC,CAAC;IAC3C,MAAM,IAAI,GAAG,KAAK,CAAC,IAAI,IAAI,QAAQ,CAAC;IACpC,IAAI,IAAI,KAAK,OAAO,IAAI,IAAI,KAAK,QAAQ,EAAE,CAAC;QAC1C,MAAM,IAAI,mCAAwB,CAChC,MAAM,EACN,kCAAkC,CACnC,CAAC;IACJ,CAAC;IACD,MAAM,YAAY,GAAG,oBAAoB,CAAC,KAAK,CAAC,YAAY,EAAE,KAAK,CAAC,KAAK,CAAC,CAAC;IAC3E,MAAM,QAAQ,GAAG,kBAAkB,CAAC,KAAK,CAAC,QAAQ,CAAC,CAAC;IACpD,MAAM,aAAa,GAAG,IAAI,GAAG,EAAU,CAAC;IACxC,MAAM,QAAQ,GAA4B,EAAE,CAAC;IAC7C,MAAM,iBAAiB,GAAmC,EAAE,CAAC;IAE7D,KAAK,MAAM,WAAW,IAAI,YAAY,EAAE,CAAC;QACvC,MAAM,IAAI,GAAG,IAAA,sCAA2B,EACtC,KAAK,CAAC,KAAK,EACX,WAAW,CAAC,WAAW,CACxB,CAAC;QACF,aAAa,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC;QACxB,MAAM,YAAY,GAAG,IAAA,sCAA2B,EAAC,KAAK,CAAC,KAAK,EAAE,WAAW,CAAC,CAAC;QAC3E,MAAM,MAAM,GAAG,QAAQ,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC;QAClC,IAAI,MAAM,KAAK,SAAS,EAAE,CAAC;YACzB,QAAQ,CAAC,IAAI,CACX,OAAO,CAAC,mBAAmB,EAAE,IAAI,EAAE,WAAW,CAAC,WAAW,EAAE,UAAU,CAAC,CACxE,CAAC;YACF,qEAAqE;YACrE,wEAAwE;YACxE,sEAAsE;YACtE,IAAI,WAAW,CAAC,MAAM,KAAK,WAAW,EAAE,CAAC;gBACvC,iBAAiB,CAAC,IAAI,CAAC;oBACrB,WAAW,EAAE,OAAO,WAAW,CAAC,MAAM,WAAW,WAAW,CAAC,WAAW,EAAE;oBAC1E,IAAI,EAAE,wBAAwB;oBAC9B,IAAI;oBACJ,IAAI,EAAE,YAAY;iBACnB,CAAC,CAAC;YACL,CAAC;YACD,SAAS;QACX,CAAC;QAED,MAAM,SAAS,GAAG,mBAAmB,CAAC,MAAM,EAAE,YAAY,CAAC,CAAC;QAC5D,IAAI,SAAS,KAAK,WAAW,EAAE,CAAC;YAC9B,QAAQ,CAAC,IAAI,CACX,OAAO,CACL,qBAAqB,EACrB,IAAI,EACJ,WAAW,CAAC,WAAW,EACvB,UAAU,CACX,CACF,CAAC;YACF,SAAS;QACX,CAAC;QACD,IAAI,SAAS,KAAK,aAAa,EAAE,CAAC;YAChC,QAAQ,CAAC,IAAI,CACX,OAAO,CAAC,mBAAmB,EAAE,IAAI,EAAE,WAAW,CAAC,WAAW,EAAE,UAAU,CAAC,CACxE,CAAC;YACF,SAAS;QACX,CAAC;QACD,MAAM,UAAU,GAAG,qBAAqB,CAAC,MAAM,EAAE,YAAY,CAAC,CAAC;QAC/D,IAAI,UAAU,KAAK,aAAa,EAAE,CAAC;YACjC,QAAQ,CAAC,IAAI,CACX,OAAO,CAAC,mBAAmB,EAAE,IAAI,EAAE,WAAW,CAAC,WAAW,EAAE,UAAU,CAAC,CACxE,CAAC;YACF,SAAS;QACX,CAAC;QACD,IAAI,UAAU,CAAC,MAAM,EAAE,YAAY,CAAC,EAAE,CAAC;YACrC,QAAQ,CAAC,IAAI,CACX,OAAO,CAAC,WAAW,EAAE,IAAI,EAAE,WAAW,CAAC,WAAW,EAAE,SAAS,CAAC,CAC/D,CAAC;YACF,iBAAiB,CAAC,IAAI,CAAC;gBACrB,GAAG,EAAE,MAAM,CAAC,GAAG;gBACf,IAAI,EAAE,UAAU;gBAChB,IAAI,EAAE,YAAY;aACnB,CAAC,CAAC;QACL,CAAC;QACD,IAAI,CAAC,IAAA,8BAAmB,EAAC,WAAW,EAAE,MAAM,CAAC,EAAE,CAAC;YAC9C,QAAQ,CAAC,IAAI,CACX,OAAO,CACL,2BAA2B,EAC3B,IAAI,EACJ,WAAW,CAAC,WAAW,EACvB,UAAU,CACX,CACF,CAAC;QACJ,CAAC;IACH,CAAC;IAED,KAAK,MAAM,MAAM,IAAI,QAAQ,CAAC,MAAM,EAAE,EAAE,CAAC;QACvC,IACE,CAAC,aAAa,CAAC,GAAG,CAAC,MAAM,CAAC,IAAI,CAAC;YAC/B,MAAM,CAAC,IAAI,CAAC,mCAAwB,CAAC,SAAS,CAAC;gBAC7C,KAAK,CAAC,KAAK,CAAC,SAAS;YACvB,MAAM,CAAC,IAAI,CAAC,mCAAwB,CAAC,KAAK,CAAC,KAAK,KAAK,CAAC,KAAK,CAAC,KAAK;YACjE,MAAM,CAAC,IAAI,CAAC,mCAAwB,CAAC,KAAK,CAAC,KAAK,KAAK,CAAC,KAAK,CAAC,KAAK;YACjE,CAAC,MAAM,CAAC,IAAI,CAAC,mCAAwB,CAAC,UAAU,CAAC;gBAC/C,2CAAgC;gBAChC,MAAM,CAAC,IAAI,CAAC,mCAAwB,CAAC,UAAU,CAAC;oBAC9C,4CAAiC,CAAC,EACtC,CAAC;YACD,QAAQ,CAAC,IAAI,CACX,OAAO,CACL,kBAAkB,EAClB,MAAM,CAAC,IAAI,EACX,MAAM,CAAC,IAAI,CAAC,mCAAwB,CAAC,WAAW,CAAC,EACjD,SAAS,CACV,CACF,CAAC;QACJ,CAAC;IACH,CAAC;IAED,MAAM,eAAe,GAAG,QAAQ,CAAC,IAAI,CACnC,CAAC,EAAE,IAAI,EAAE,EAAE,EAAE,CACX,IAAI,KAAK,mBAAmB,IAAI,IAAI,KAAK,qBAAqB,CACjE,CAAC;IACF,OAAO,MAAM,CAAC,MAAM,CAAC;QACnB,mBAAmB,EACjB,IAAI,KAAK,OAAO,IAAI,CAAC,eAAe;YAClC,CAAC,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC,GAAG,iBAAiB,CAAC,CAAC;YACvC,CAAC,CAAC,EAAE;QACR,QAAQ,EAAE,MAAM,CAAC,MAAM,CAAC,QAAQ,CAAC;QACjC,IAAI;QACJ,iBAAiB,EAAE,MAAM,CAAC,MAAM,CAAC,iBAAiB,CAAC;QACnD,MAAM,EAAE,QAAQ,CAAC,MAAM,KAAK,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,SAAS;KACpD,CAAC,CAAC;AACL,CAAC;AAED,SAAgB,uBAAuB,CACrC,KAAqB;IAErB,IAAA,wCAA6B,EAAC,KAAK,CAAC,KAAK,CAAC,CAAC;IAC3C,MAAM,YAAY,GAAG,oBAAoB,CAAC,KAAK,CAAC,YAAY,EAAE,KAAK,CAAC,KAAK,CAAC,CAAC;IAC3E,MAAM,QAAQ,GAAG,kBAAkB,CAAC,KAAK,CAAC,QAAQ,CAAC,CAAC;IACpD,MAAM,QAAQ,GAA4B,EAAE,CAAC;IAE7C,KAAK,MAAM,WAAW,IAAI,YAAY,EAAE,CAAC;QACvC,MAAM,IAAI,GAAG,IAAA,sCAA2B,EACtC,KAAK,CAAC,KAAK,EACX,WAAW,CAAC,WAAW,CACxB,CAAC;QACF,MAAM,MAAM,GAAG,QAAQ,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC;QAClC,IAAI,MAAM,KAAK,SAAS,EAAE,CAAC;YACzB,QAAQ,CAAC,IAAI,CACX,OAAO,CAAC,mBAAmB,EAAE,IAAI,EAAE,WAAW,CAAC,WAAW,EAAE,UAAU,CAAC,CACxE,CAAC;YACF,SAAS;QACX,CAAC;QAED,MAAM,YAAY,GAAG,IAAA,sCAA2B,EAAC,KAAK,CAAC,KAAK,EAAE,WAAW,CAAC,CAAC;QAC3E,MAAM,SAAS,GAAG,mBAAmB,CAAC,MAAM,EAAE,YAAY,CAAC,CAAC;QAC5D,IAAI,SAAS,KAAK,WAAW,EAAE,CAAC;YAC9B,QAAQ,CAAC,IAAI,CACX,OAAO,CACL,qBAAqB,EACrB,IAAI,EACJ,WAAW,CAAC,WAAW,EACvB,UAAU,CACX,CACF,CAAC;YACF,SAAS;QACX,CAAC;QACD,IAAI,SAAS,KAAK,aAAa,EAAE,CAAC;YAChC,QAAQ,CAAC,IAAI,CACX,OAAO,CAAC,mBAAmB,EAAE,IAAI,EAAE,WAAW,CAAC,WAAW,EAAE,UAAU,CAAC,CACxE,CAAC;YACF,SAAS;QACX,CAAC;QACD,IAAI,qBAAqB,CAAC,MAAM,EAAE,YAAY,CAAC,KAAK,aAAa,EAAE,CAAC;YAClE,QAAQ,CAAC,IAAI,CACX,OAAO,CAAC,mBAAmB,EAAE,IAAI,EAAE,WAAW,CAAC,WAAW,EAAE,UAAU,CAAC,CACxE,CAAC;YACF,SAAS;QACX,CAAC;QACD,IAAI,CAAC,MAAM,CAAC,aAAa,CAAC,QAAQ,CAAC,YAAY,CAAC,EAAE,CAAC;YACjD,QAAQ,CAAC,IAAI,CACX,OAAO,CACL,yBAAyB,EACzB,IAAI,EACJ,WAAW,CAAC,WAAW,EACvB,UAAU,CACX,CACF,CAAC;QACJ,CAAC;QACD,IAAI,CAAC,IAAA,8BAAmB,EAAC,WAAW,EAAE,MAAM,CAAC,EAAE,CAAC;YAC9C,QAAQ,CAAC,IAAI,CACX,OAAO,CACL,2BAA2B,EAC3B,IAAI,EACJ,WAAW,CAAC,WAAW,EACvB,UAAU,CACX,CACF,CAAC;QACJ,CAAC;IACH,CAAC;IAED,OAAO,MAAM,CAAC,MAAM,CAAC;QACnB,QAAQ,EAAE,MAAM,CAAC,MAAM,CAAC,QAAQ,CAAC;QACjC,KAAK,EAAE,QAAQ,CAAC,MAAM,KAAK,CAAC;KAC7B,CAAC,CAAC;AACL,CAAC"}

package/src/secrets/model.d.ts

@@ -1,7 +1,10 @@
 export declare const OPERATOR_SECRET_MANAGEMENT_CLASS: "operator-secret";
+export declare const GENERATED_SECRET_MANAGEMENT_CLASS: "generated-secret";
+export declare const GENERATED_HMAC_SECRET_LOGICAL_NAME: "GeneratedPerformanceLoadHmacKeys";
 export declare const SECRET_CANONICAL_STAGES: readonly ["development", "staging", "production"];
 export type SecretCanonicalStage = (typeof SECRET_CANONICAL_STAGES)[number];
 export declare const SECRET_METADATA_TAG_KEYS: {
+    readonly generation: "ebk:generation";
     readonly logicalName: "ebk:logical-name";
     readonly management: "ebk:management";
     readonly owner: "ebk:owner";
@@ -15,11 +18,14 @@ export type SecretMetadataRotation = {
     mode: 'provider-managed';
 };
 export interface SecretMetadataDeclaration {
+    generation?: {
+        kind: 'hmac-key-ring-v1';
+    };
     logicalName: string;
     owner: string;
     requiredStages: readonly string[];
     rotation: SecretMetadataRotation;
-    source: 'aws-managed' | 'database-bootstrap' | 'operator';
+    source: 'aws-managed' | 'database-bootstrap' | 'generated' | 'operator';
     valueKind: 'binary' | 'json' | 'string';
 }
 export interface SecretManagementScope {
@@ -29,6 +35,7 @@ export interface SecretManagementScope {
 }
 export interface ObservedSecretMetadata {
     arn: string;
+    deletionPendingUntil?: string;
     name: string;
     rotationEnabled: boolean;
     tags: Readonly<Record<string, string>>;

package/src/secrets/model.js

@@ -1,6 +1,6 @@
 "use strict";
 Object.defineProperty(exports, "__esModule", { value: true });
-exports.SecretMetadataModelError = exports.SECRET_METADATA_TAG_KEYS = exports.SECRET_CANONICAL_STAGES = exports.OPERATOR_SECRET_MANAGEMENT_CLASS = void 0;
+exports.SecretMetadataModelError = exports.SECRET_METADATA_TAG_KEYS = exports.SECRET_CANONICAL_STAGES = exports.GENERATED_HMAC_SECRET_LOGICAL_NAME = exports.GENERATED_SECRET_MANAGEMENT_CLASS = exports.OPERATOR_SECRET_MANAGEMENT_CLASS = void 0;
 exports.isSecretCanonicalStage = isSecretCanonicalStage;
 exports.validateSecretManagementScope = validateSecretManagementScope;
 exports.validateSecretMetadataDeclaration = validateSecretMetadataDeclaration;
@@ -10,12 +10,15 @@ exports.canonicalOperatorSecretTags = canonicalOperatorSecretTags;
 exports.isExactSecretArn = isExactSecretArn;
 exports.isRotationCompliant = isRotationCompliant;
 exports.OPERATOR_SECRET_MANAGEMENT_CLASS = 'operator-secret';
+exports.GENERATED_SECRET_MANAGEMENT_CLASS = 'generated-secret';
+exports.GENERATED_HMAC_SECRET_LOGICAL_NAME = 'GeneratedPerformanceLoadHmacKeys';
 exports.SECRET_CANONICAL_STAGES = [
     'development',
     'staging',
     'production',
 ];
 exports.SECRET_METADATA_TAG_KEYS = {
+    generation: 'ebk:generation',
     logicalName: 'ebk:logical-name',
     management: 'ebk:management',
     owner: 'ebk:owner',
@@ -64,12 +67,20 @@ function validateSecretMetadataDeclaration(declaration) {
             declaration.requiredStages.length) {
         throw new SecretMetadataModelError('declaration.requiredStages', 'must contain unique canonical deployed stages');
     }
-    if (!['aws-managed', 'database-bootstrap', 'operator'].includes(declaration.source)) {
+    if (!['aws-managed', 'database-bootstrap', 'generated', 'operator'].includes(declaration.source)) {
         throw new SecretMetadataModelError('declaration.source', 'must name a supported value authority');
     }
     if (!['binary', 'json', 'string'].includes(declaration.valueKind)) {
         throw new SecretMetadataModelError('declaration.valueKind', 'must name a supported value shape');
     }
+    if ((declaration.source === 'generated') !==
+        (declaration.generation !== undefined) ||
+        (declaration.generation !== undefined &&
+            (declaration.generation.kind !== 'hmac-key-ring-v1' ||
+                Object.keys(declaration.generation).length !== 1 ||
+                declaration.valueKind !== 'json'))) {
+        throw new SecretMetadataModelError('declaration.generation', 'must select the supported value-blind JSON generator exactly when source is generated');
+    }
     if (!['manual', 'provider-managed'].includes(declaration.rotation.mode)) {
         throw new SecretMetadataModelError('declaration.rotation.mode', 'must be manual or provider-managed');
     }
@@ -82,6 +93,9 @@ function validateObservedSecretMetadata(observed) {
         throw new SecretMetadataModelError('observed.name', 'must be a concrete secret name');
     }
     if (typeof observed.rotationEnabled !== 'boolean' ||
+        (observed.deletionPendingUntil !== undefined &&
+            (typeof observed.deletionPendingUntil !== 'string' ||
+                Number.isNaN(Date.parse(observed.deletionPendingUntil)))) ||
         typeof observed.tags !== 'object' ||
         observed.tags === null ||
         Array.isArray(observed.tags) ||
@@ -106,8 +120,15 @@ function canonicalOperatorSecretTags(scope, declaration) {
     validateSecretManagementScope(scope);
     validateSecretMetadataDeclaration(declaration);
     return Object.freeze({
+        ...(declaration.generation === undefined
+            ? {}
+            : {
+                [exports.SECRET_METADATA_TAG_KEYS.generation]: declaration.generation.kind,
+            }),
         [exports.SECRET_METADATA_TAG_KEYS.logicalName]: declaration.logicalName,
-        [exports.SECRET_METADATA_TAG_KEYS.management]: exports.OPERATOR_SECRET_MANAGEMENT_CLASS,
+        [exports.SECRET_METADATA_TAG_KEYS.management]: declaration.source === 'generated'
+            ? exports.GENERATED_SECRET_MANAGEMENT_CLASS
+            : exports.OPERATOR_SECRET_MANAGEMENT_CLASS,
         [exports.SECRET_METADATA_TAG_KEYS.owner]: declaration.owner,
         [exports.SECRET_METADATA_TAG_KEYS.slice]: scope.slice,
         [exports.SECRET_METADATA_TAG_KEYS.stage]: scope.stage,

package/src/secrets/model.js.map

@@ -1 +1 @@
-{"version":3,"file":"model.js","sourceRoot":"","sources":["../../../../../packages/nx/src/secrets/model.ts"],"names":[],"mappings":";;;AAmDA,wDAIC;AAcD,sEAiBC;AAED,8EAkDC;AAED,wEA2CC;AAED,kEAYC;AAED,kEAcC;AAED,4CAEC;AAED,kDAOC;AAlOY,QAAA,gCAAgC,GAAG,iBAA0B,CAAC;AAC9D,QAAA,uBAAuB,GAAG;IACrC,aAAa;IACb,SAAS;IACT,YAAY;CACJ,CAAC;AAIE,QAAA,wBAAwB,GAAG;IACtC,WAAW,EAAE,kBAAkB;IAC/B,UAAU,EAAE,gBAAgB;IAC5B,KAAK,EAAE,WAAW;IAClB,KAAK,EAAE,WAAW;IAClB,KAAK,EAAE,WAAW;IAClB,SAAS,EAAE,eAAe;CAClB,CAAC;AA4BX,MAAM,kBAAkB,GAAG,6BAA6B,CAAC;AACzD,MAAM,YAAY,GAAG,2BAA2B,CAAC;AACjD,MAAM,WAAW,GAAG,2BAA2B,CAAC;AAChD,MAAM,gBAAgB,GACpB,6FAA6F,CAAC;AAChG,MAAM,eAAe,GAAG,IAAI,GAAG,CAAS,+BAAuB,CAAC,CAAC;AAEjE,SAAgB,sBAAsB,CACpC,KAAa;IAEb,OAAO,eAAe,CAAC,GAAG,CAAC,KAAK,CAAC,CAAC;AACpC,CAAC;AAED,MAAa,wBAAyB,SAAQ,KAAK;IAItC;IAHF,IAAI,GAAG,+BAA+B,CAAC;IAEhD,YACW,IAAY,EACrB,MAAc;QAEd,KAAK,CAAC,8BAA8B,IAAI,KAAK,MAAM,GAAG,CAAC,CAAC;QAH/C,SAAI,GAAJ,IAAI,CAAQ;QAIrB,IAAI,CAAC,IAAI,GAAG,0BAA0B,CAAC;IACzC,CAAC;CACF;AAVD,4DAUC;AAED,SAAgB,6BAA6B,CAC3C,KAA4B;IAE5B,KAAK,MAAM,GAAG,IAAI,CAAC,WAAW,EAAE,OAAO,EAAE,OAAO,CAAU,EAAE,CAAC;QAC3D,IAAI,CAAC,WAAW,CAAC,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,EAAE,CAAC;YAClC,MAAM,IAAI,wBAAwB,CAChC,SAAS,GAAG,EAAE,EACd,2BAA2B,CAC5B,CAAC;QACJ,CAAC;IACH,CAAC;IACD,IAAI,CAAC,sBAAsB,CAAC,KAAK,CAAC,KAAK,CAAC,EAAE,CAAC;QACzC,MAAM,IAAI,wBAAwB,CAChC,aAAa,EACb,6CAA6C,CAC9C,CAAC;IACJ,CAAC;AACH,CAAC;AAED,SAAgB,iCAAiC,CAC/C,WAAsC;IAEtC,IAAI,CAAC,kBAAkB,CAAC,IAAI,CAAC,WAAW,CAAC,WAAW,CAAC,EAAE,CAAC;QACtD,MAAM,IAAI,wBAAwB,CAChC,yBAAyB,EACzB,6DAA6D,CAC9D,CAAC;IACJ,CAAC;IACD,IAAI,CAAC,YAAY,CAAC,IAAI,CAAC,WAAW,CAAC,KAAK,CAAC,EAAE,CAAC;QAC1C,MAAM,IAAI,wBAAwB,CAChC,mBAAmB,EACnB,iCAAiC,CAClC,CAAC;IACJ,CAAC;IACD,IACE,WAAW,CAAC,cAAc,CAAC,MAAM,KAAK,CAAC;QACvC,WAAW,CAAC,cAAc,CAAC,IAAI,CAC7B,CAAC,KAAK,EAAE,EAAE,CAAC,CAAC,sBAAsB,CAAC,KAAK,CAAC,CAC1C;QACD,IAAI,GAAG,CAAC,WAAW,CAAC,cAAc,CAAC,CAAC,IAAI;YACtC,WAAW,CAAC,cAAc,CAAC,MAAM,EACnC,CAAC;QACD,MAAM,IAAI,wBAAwB,CAChC,4BAA4B,EAC5B,+CAA+C,CAChD,CAAC;IACJ,CAAC;IACD,IACE,CAAC,CAAC,aAAa,EAAE,oBAAoB,EAAE,UAAU,CAAC,CAAC,QAAQ,CACzD,WAAW,CAAC,MAAM,CACnB,EACD,CAAC;QACD,MAAM,IAAI,wBAAwB,CAChC,oBAAoB,EACpB,uCAAuC,CACxC,CAAC;IACJ,CAAC;IACD,IAAI,CAAC,CAAC,QAAQ,EAAE,MAAM,EAAE,QAAQ,CAAC,CAAC,QAAQ,CAAC,WAAW,CAAC,SAAS,CAAC,EAAE,CAAC;QAClE,MAAM,IAAI,wBAAwB,CAChC,uBAAuB,EACvB,mCAAmC,CACpC,CAAC;IACJ,CAAC;IACD,IAAI,CAAC,CAAC,QAAQ,EAAE,kBAAkB,CAAC,CAAC,QAAQ,CAAC,WAAW,CAAC,QAAQ,CAAC,IAAI,CAAC,EAAE,CAAC;QACxE,MAAM,IAAI,wBAAwB,CAChC,2BAA2B,EAC3B,oCAAoC,CACrC,CAAC;IACJ,CAAC;AACH,CAAC;AAED,SAAgB,8BAA8B,CAC5C,QAAgC;IAEhC,IAAI,CAAC,gBAAgB,CAAC,IAAI,CAAC,QAAQ,CAAC,GAAG,CAAC,EAAE,CAAC;QACzC,MAAM,IAAI,wBAAwB,CAChC,cAAc,EACd,wDAAwD,CACzD,CAAC;IACJ,CAAC;IACD,IAAI,QAAQ,CAAC,IAAI,CAAC,MAAM,KAAK,CAAC,IAAI,QAAQ,CAAC,IAAI,CAAC,QAAQ,CAAC,GAAG,CAAC,EAAE,CAAC;QAC9D,MAAM,IAAI,wBAAwB,CAChC,eAAe,EACf,gCAAgC,CACjC,CAAC;IACJ,CAAC;IACD,IACE,OAAO,QAAQ,CAAC,eAAe,KAAK,SAAS;QAC7C,OAAO,QAAQ,CAAC,IAAI,KAAK,QAAQ;QACjC,QAAQ,CAAC,IAAI,KAAK,IAAI;QACtB,KAAK,CAAC,OAAO,CAAC,QAAQ,CAAC,IAAI,CAAC;QAC5B,MAAM,CAAC,MAAM,CAAC,QAAQ,CAAC,IAAI,CAAC,CAAC,IAAI,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,OAAO,KAAK,KAAK,QAAQ,CAAC,EACvE,CAAC;QACD,MAAM,IAAI,wBAAwB,CAChC,UAAU,EACV,8DAA8D,CAC/D,CAAC;IACJ,CAAC;IACD,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,QAAQ,CAAC,aAAa,CAAC,EAAE,CAAC;QAC3C,MAAM,IAAI,wBAAwB,CAChC,wBAAwB,EACxB,6BAA6B,CAC9B,CAAC;IACJ,CAAC;IACD,IACE,QAAQ,CAAC,aAAa,CAAC,IAAI,CACzB,CAAC,KAAK,EAAE,EAAE,CAAC,OAAO,KAAK,KAAK,QAAQ,IAAI,KAAK,CAAC,MAAM,KAAK,CAAC,CAC3D,EACD,CAAC;QACD,MAAM,IAAI,wBAAwB,CAChC,wBAAwB,EACxB,uCAAuC,CACxC,CAAC;IACJ,CAAC;AACH,CAAC;AAED,SAAgB,2BAA2B,CACzC,KAA4B,EAC5B,WAAmB;IAEnB,6BAA6B,CAAC,KAAK,CAAC,CAAC;IACrC,IAAI,CAAC,kBAAkB,CAAC,IAAI,CAAC,WAAW,CAAC,EAAE,CAAC;QAC1C,MAAM,IAAI,wBAAwB,CAChC,aAAa,EACb,6DAA6D,CAC9D,CAAC;IACJ,CAAC;IACD,OAAO,OAAO,KAAK,CAAC,KAAK,IAAI,KAAK,CAAC,KAAK,IAAI,WAAW,EAAE,CAAC;AAC5D,CAAC;AAED,SAAgB,2BAA2B,CACzC,KAA4B,EAC5B,WAAsC;IAEtC,6BAA6B,CAAC,KAAK,CAAC,CAAC;IACrC,iCAAiC,CAAC,WAAW,CAAC,CAAC;IAC/C,OAAO,MAAM,CAAC,MAAM,CAAC;QACnB,CAAC,gCAAwB,CAAC,WAAW,CAAC,EAAE,WAAW,CAAC,WAAW;QAC/D,CAAC,gCAAwB,CAAC,UAAU,CAAC,EAAE,wCAAgC;QACvE,CAAC,gCAAwB,CAAC,KAAK,CAAC,EAAE,WAAW,CAAC,KAAK;QACnD,CAAC,gCAAwB,CAAC,KAAK,CAAC,EAAE,KAAK,CAAC,KAAK;QAC7C,CAAC,gCAAwB,CAAC,KAAK,CAAC,EAAE,KAAK,CAAC,KAAK;QAC7C,CAAC,gCAAwB,CAAC,SAAS,CAAC,EAAE,KAAK,CAAC,SAAS;KACtD,CAAC,CAAC;AACL,CAAC;AAED,SAAgB,gBAAgB,CAAC,KAAa;IAC5C,OAAO,gBAAgB,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;AACtC,CAAC;AAED,SAAgB,mBAAmB,CACjC,WAAsC,EACtC,QAAgC;IAEhC,OAAO,WAAW,CAAC,QAAQ,CAAC,IAAI,KAAK,kBAAkB;QACrD,CAAC,CAAC,QAAQ,CAAC,eAAe;QAC1B,CAAC,CAAC,CAAC,QAAQ,CAAC,eAAe,CAAC;AAChC,CAAC"}
+{"version":3,"file":"model.js","sourceRoot":"","sources":["../../../../../packages/nx/src/secrets/model.ts"],"names":[],"mappings":";;;AAyDA,wDAIC;AAcD,sEAiBC;AAED,8EA+DC;AAED,wEA8CC;AAED,kEAYC;AAED,kEAsBC;AAED,4CAEC;AAED,kDAOC;AAhQY,QAAA,gCAAgC,GAAG,iBAA0B,CAAC;AAC9D,QAAA,iCAAiC,GAAG,kBAA2B,CAAC;AAChE,QAAA,kCAAkC,GAC7C,kCAA2C,CAAC;AACjC,QAAA,uBAAuB,GAAG;IACrC,aAAa;IACb,SAAS;IACT,YAAY;CACJ,CAAC;AAIE,QAAA,wBAAwB,GAAG;IACtC,UAAU,EAAE,gBAAgB;IAC5B,WAAW,EAAE,kBAAkB;IAC/B,UAAU,EAAE,gBAAgB;IAC5B,KAAK,EAAE,WAAW;IAClB,KAAK,EAAE,WAAW;IAClB,KAAK,EAAE,WAAW;IAClB,SAAS,EAAE,eAAe;CAClB,CAAC;AA8BX,MAAM,kBAAkB,GAAG,6BAA6B,CAAC;AACzD,MAAM,YAAY,GAAG,2BAA2B,CAAC;AACjD,MAAM,WAAW,GAAG,2BAA2B,CAAC;AAChD,MAAM,gBAAgB,GACpB,6FAA6F,CAAC;AAChG,MAAM,eAAe,GAAG,IAAI,GAAG,CAAS,+BAAuB,CAAC,CAAC;AAEjE,SAAgB,sBAAsB,CACpC,KAAa;IAEb,OAAO,eAAe,CAAC,GAAG,CAAC,KAAK,CAAC,CAAC;AACpC,CAAC;AAED,MAAa,wBAAyB,SAAQ,KAAK;IAItC;IAHF,IAAI,GAAG,+BAA+B,CAAC;IAEhD,YACW,IAAY,EACrB,MAAc;QAEd,KAAK,CAAC,8BAA8B,IAAI,KAAK,MAAM,GAAG,CAAC,CAAC;QAH/C,SAAI,GAAJ,IAAI,CAAQ;QAIrB,IAAI,CAAC,IAAI,GAAG,0BAA0B,CAAC;IACzC,CAAC;CACF;AAVD,4DAUC;AAED,SAAgB,6BAA6B,CAC3C,KAA4B;IAE5B,KAAK,MAAM,GAAG,IAAI,CAAC,WAAW,EAAE,OAAO,EAAE,OAAO,CAAU,EAAE,CAAC;QAC3D,IAAI,CAAC,WAAW,CAAC,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,EAAE,CAAC;YAClC,MAAM,IAAI,wBAAwB,CAChC,SAAS,GAAG,EAAE,EACd,2BAA2B,CAC5B,CAAC;QACJ,CAAC;IACH,CAAC;IACD,IAAI,CAAC,sBAAsB,CAAC,KAAK,CAAC,KAAK,CAAC,EAAE,CAAC;QACzC,MAAM,IAAI,wBAAwB,CAChC,aAAa,EACb,6CAA6C,CAC9C,CAAC;IACJ,CAAC;AACH,CAAC;AAED,SAAgB,iCAAiC,CAC/C,WAAsC;IAEtC,IAAI,CAAC,kBAAkB,CAAC,IAAI,CAAC,WAAW,CAAC,WAAW,CAAC,EAAE,CAAC;QACtD,MAAM,IAAI,wBAAwB,CAChC,yBAAyB,EACzB,6DAA6D,CAC9D,CAAC;IACJ,CAAC;IACD,IAAI,CAAC,YAAY,CAAC,IAAI,CAAC,WAAW,CAAC,KAAK,CAAC,EAAE,CAAC;QAC1C,MAAM,IAAI,wBAAwB,CAChC,mBAAmB,EACnB,iCAAiC,CAClC,CAAC;IACJ,CAAC;IACD,IACE,WAAW,CAAC,cAAc,CAAC,MAAM,KAAK,CAAC;QACvC,WAAW,CAAC,cAAc,CAAC,IAAI,CAC7B,CAAC,KAAK,EAAE,EAAE,CAAC,CAAC,sBAAsB,CAAC,KAAK,CAAC,CAC1C;QACD,IAAI,GAAG,CAAC,WAAW,CAAC,cAAc,CAAC,CAAC,IAAI;YACtC,WAAW,CAAC,cAAc,CAAC,MAAM,EACnC,CAAC;QACD,MAAM,IAAI,wBAAwB,CAChC,4BAA4B,EAC5B,+CAA+C,CAChD,CAAC;IACJ,CAAC;IACD,IACE,CAAC,CAAC,aAAa,EAAE,oBAAoB,EAAE,WAAW,EAAE,UAAU,CAAC,CAAC,QAAQ,CACtE,WAAW,CAAC,MAAM,CACnB,EACD,CAAC;QACD,MAAM,IAAI,wBAAwB,CAChC,oBAAoB,EACpB,uCAAuC,CACxC,CAAC;IACJ,CAAC;IACD,IAAI,CAAC,CAAC,QAAQ,EAAE,MAAM,EAAE,QAAQ,CAAC,CAAC,QAAQ,CAAC,WAAW,CAAC,SAAS,CAAC,EAAE,CAAC;QAClE,MAAM,IAAI,wBAAwB,CAChC,uBAAuB,EACvB,mCAAmC,CACpC,CAAC;IACJ,CAAC;IACD,IACE,CAAC,WAAW,CAAC,MAAM,KAAK,WAAW,CAAC;QAClC,CAAC,WAAW,CAAC,UAAU,KAAK,SAAS,CAAC;QACxC,CAAC,WAAW,CAAC,UAAU,KAAK,SAAS;YACnC,CAAC,WAAW,CAAC,UAAU,CAAC,IAAI,KAAK,kBAAkB;gBACjD,MAAM,CAAC,IAAI,CAAC,WAAW,CAAC,UAAU,CAAC,CAAC,MAAM,KAAK,CAAC;gBAChD,WAAW,CAAC,SAAS,KAAK,MAAM,CAAC,CAAC,EACtC,CAAC;QACD,MAAM,IAAI,wBAAwB,CAChC,wBAAwB,EACxB,uFAAuF,CACxF,CAAC;IACJ,CAAC;IACD,IAAI,CAAC,CAAC,QAAQ,EAAE,kBAAkB,CAAC,CAAC,QAAQ,CAAC,WAAW,CAAC,QAAQ,CAAC,IAAI,CAAC,EAAE,CAAC;QACxE,MAAM,IAAI,wBAAwB,CAChC,2BAA2B,EAC3B,oCAAoC,CACrC,CAAC;IACJ,CAAC;AACH,CAAC;AAED,SAAgB,8BAA8B,CAC5C,QAAgC;IAEhC,IAAI,CAAC,gBAAgB,CAAC,IAAI,CAAC,QAAQ,CAAC,GAAG,CAAC,EAAE,CAAC;QACzC,MAAM,IAAI,wBAAwB,CAChC,cAAc,EACd,wDAAwD,CACzD,CAAC;IACJ,CAAC;IACD,IAAI,QAAQ,CAAC,IAAI,CAAC,MAAM,KAAK,CAAC,IAAI,QAAQ,CAAC,IAAI,CAAC,QAAQ,CAAC,GAAG,CAAC,EAAE,CAAC;QAC9D,MAAM,IAAI,wBAAwB,CAChC,eAAe,EACf,gCAAgC,CACjC,CAAC;IACJ,CAAC;IACD,IACE,OAAO,QAAQ,CAAC,eAAe,KAAK,SAAS;QAC7C,CAAC,QAAQ,CAAC,oBAAoB,KAAK,SAAS;YAC1C,CAAC,OAAO,QAAQ,CAAC,oBAAoB,KAAK,QAAQ;gBAChD,MAAM,CAAC,KAAK,CAAC,IAAI,CAAC,KAAK,CAAC,QAAQ,CAAC,oBAAoB,CAAC,CAAC,CAAC,CAAC;QAC7D,OAAO,QAAQ,CAAC,IAAI,KAAK,QAAQ;QACjC,QAAQ,CAAC,IAAI,KAAK,IAAI;QACtB,KAAK,CAAC,OAAO,CAAC,QAAQ,CAAC,IAAI,CAAC;QAC5B,MAAM,CAAC,MAAM,CAAC,QAAQ,CAAC,IAAI,CAAC,CAAC,IAAI,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,OAAO,KAAK,KAAK,QAAQ,CAAC,EACvE,CAAC;QACD,MAAM,IAAI,wBAAwB,CAChC,UAAU,EACV,8DAA8D,CAC/D,CAAC;IACJ,CAAC;IACD,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,QAAQ,CAAC,aAAa,CAAC,EAAE,CAAC;QAC3C,MAAM,IAAI,wBAAwB,CAChC,wBAAwB,EACxB,6BAA6B,CAC9B,CAAC;IACJ,CAAC;IACD,IACE,QAAQ,CAAC,aAAa,CAAC,IAAI,CACzB,CAAC,KAAK,EAAE,EAAE,CAAC,OAAO,KAAK,KAAK,QAAQ,IAAI,KAAK,CAAC,MAAM,KAAK,CAAC,CAC3D,EACD,CAAC;QACD,MAAM,IAAI,wBAAwB,CAChC,wBAAwB,EACxB,uCAAuC,CACxC,CAAC;IACJ,CAAC;AACH,CAAC;AAED,SAAgB,2BAA2B,CACzC,KAA4B,EAC5B,WAAmB;IAEnB,6BAA6B,CAAC,KAAK,CAAC,CAAC;IACrC,IAAI,CAAC,kBAAkB,CAAC,IAAI,CAAC,WAAW,CAAC,EAAE,CAAC;QAC1C,MAAM,IAAI,wBAAwB,CAChC,aAAa,EACb,6DAA6D,CAC9D,CAAC;IACJ,CAAC;IACD,OAAO,OAAO,KAAK,CAAC,KAAK,IAAI,KAAK,CAAC,KAAK,IAAI,WAAW,EAAE,CAAC;AAC5D,CAAC;AAED,SAAgB,2BAA2B,CACzC,KAA4B,EAC5B,WAAsC;IAEtC,6BAA6B,CAAC,KAAK,CAAC,CAAC;IACrC,iCAAiC,CAAC,WAAW,CAAC,CAAC;IAC/C,OAAO,MAAM,CAAC,MAAM,CAAC;QACnB,GAAG,CAAC,WAAW,CAAC,UAAU,KAAK,SAAS;YACtC,CAAC,CAAC,EAAE;YACJ,CAAC,CAAC;gBACE,CAAC,gCAAwB,CAAC,UAAU,CAAC,EAAE,WAAW,CAAC,UAAU,CAAC,IAAI;aACnE,CAAC;QACN,CAAC,gCAAwB,CAAC,WAAW,CAAC,EAAE,WAAW,CAAC,WAAW;QAC/D,CAAC,gCAAwB,CAAC,UAAU,CAAC,EACnC,WAAW,CAAC,MAAM,KAAK,WAAW;YAChC,CAAC,CAAC,yCAAiC;YACnC,CAAC,CAAC,wCAAgC;QACtC,CAAC,gCAAwB,CAAC,KAAK,CAAC,EAAE,WAAW,CAAC,KAAK;QACnD,CAAC,gCAAwB,CAAC,KAAK,CAAC,EAAE,KAAK,CAAC,KAAK;QAC7C,CAAC,gCAAwB,CAAC,KAAK,CAAC,EAAE,KAAK,CAAC,KAAK;QAC7C,CAAC,gCAAwB,CAAC,SAAS,CAAC,EAAE,KAAK,CAAC,SAAS;KACtD,CAAC,CAAC;AACL,CAAC;AAED,SAAgB,gBAAgB,CAAC,KAAa;IAC5C,OAAO,gBAAgB,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;AACtC,CAAC;AAED,SAAgB,mBAAmB,CACjC,WAAsC,EACtC,QAAgC;IAEhC,OAAO,WAAW,CAAC,QAAQ,CAAC,IAAI,KAAK,kBAAkB;QACrD,CAAC,CAAC,QAAQ,CAAC,eAAe;QAC1B,CAAC,CAAC,CAAC,QAAQ,CAAC,eAAe,CAAC;AAChC,CAAC"}

package/src/secrets/operator.d.ts

@@ -1,4 +1,4 @@
-import { type SecretMetadataMutationIntent, type SecretMetadataPreflightResult, type SecretMetadataReconciliationResult } from './metadata.js';
+import { type SecretMetadataFinding, type SecretMetadataMutationIntent, type SecretMetadataPreflightResult, type SecretMetadataReconciliationResult } from './metadata.js';
 import { type ObservedSecretMetadata, type SecretManagementScope, type SecretMetadataDeclaration } from './model.js';
 export interface ListedSecretContainer {
     arn: string;
@@ -20,12 +20,40 @@ export interface SecretMetadataControlPlane {
     describe(input: {
         arn: string;
     }): Promise<ObservedSecretMetadata>;
+    describeExact(input: {
+        includePlannedDeletion?: boolean;
+        name: string;
+    }): Promise<ObservedSecretMetadata | undefined>;
     list(input: {
         includePlannedDeletion?: boolean;
         namePrefix: string;
     }): Promise<readonly ListedSecretContainer[]>;
     tag(input: TagSecretContainerInput): Promise<void>;
 }
+export interface GeneratedSecretInitializationControlPlane {
+    /**
+     * Atomically create the container and generated value inside the concrete
+     * control-plane adapter. The plaintext must never be returned to this
+     * orchestration layer.
+     */
+    initializeGenerated(input: {
+        description: string;
+        generation: 'hmac-key-ring-v1';
+        name: string;
+        tags: Readonly<Record<string, string>>;
+    }): Promise<'applied' | 'unchanged'>;
+    /**
+     * Describe and validate the exact named container, provenance metadata, and
+     * deterministic generated version. Implementations must not use an
+     * eventually consistent inventory/list operation for this attestation.
+     */
+    inspect(input: {
+        description: string;
+        generation: 'hmac-key-ring-v1';
+        name: string;
+        tags: Readonly<Record<string, string>>;
+    }): Promise<'conflicting' | 'current' | 'missing'>;
+}
 export interface ProtectedSecretLifecycleControlPlane extends SecretMetadataControlPlane {
     restore(input: {
         arn: string;
@@ -37,6 +65,14 @@ export interface ProtectedSecretLifecycleControlPlane extends SecretMetadataCont
         recoveryUntil: string;
     }>;
 }
+export interface GeneratedSecretRetirementControlPlane extends Pick<ProtectedSecretLifecycleControlPlane, 'describeExact' | 'scheduleRetirement'> {
+    deleteImmediately(input: {
+        arn: string;
+    }): Promise<void>;
+    restore(input: {
+        arn: string;
+    }): Promise<void>;
+}
 export interface ProtectedSecretOperatorAuthorization {
     approved: true;
     authority: 'protected-secret-operator';
@@ -45,9 +81,9 @@ export interface ProtectedSecretOperatorAuthorization {
 }
 export type SecretProtectedLifecycleAction = 'deploy' | 'recover' | 'remove' | 'unlock';
 export declare class SecretOperatorControlPlaneError extends Error {
-    readonly operation: 'create-empty' | 'describe' | 'inventory' | 'list' | 'recover' | 'retire' | 'tag';
+    readonly operation: 'create-empty' | 'describe' | 'inventory' | 'initialize-generated' | 'list' | 'recover' | 'retire' | 'tag';
     readonly code: 'secret-control-plane-apply-failed' | 'secret-control-plane-inventory-failed' | 'secret-control-plane-inventory-invalid' | 'secret-control-plane-protected-action-failed';
-    constructor(code: SecretOperatorControlPlaneError['code'], operation: 'create-empty' | 'describe' | 'inventory' | 'list' | 'recover' | 'retire' | 'tag');
+    constructor(code: SecretOperatorControlPlaneError['code'], operation: 'create-empty' | 'describe' | 'inventory' | 'initialize-generated' | 'list' | 'recover' | 'retire' | 'tag');
 }
 export interface SecretMetadataOperatorResult {
     after?: SecretMetadataReconciliationResult;
@@ -56,6 +92,33 @@ export interface SecretMetadataOperatorResult {
     mode: 'apply' | 'report';
     outcome: 'applied' | 'applied-with-findings' | 'blocked' | 'reported';
 }
+export interface GeneratedSecretInitializationResult {
+    findings: readonly SecretMetadataFinding[];
+    initialized: readonly {
+        logicalName: string;
+        name: string;
+    }[];
+    mode: 'apply' | 'report';
+    outcome: 'applied' | 'blocked' | 'reported' | 'unchanged';
+    proposed: readonly {
+        logicalName: string;
+        name: string;
+    }[];
+}
+export interface GeneratedSecretRetirementResult {
+    deletionMode: 'immediate' | 'recovery-window';
+    outcome: 'not-applicable' | 'retired';
+    recoveryWindowDays?: 7;
+    secrets: readonly {
+        generation: 'hmac-key-ring-v1';
+        logicalName: string;
+        name: string;
+        outcome: 'already-scheduled' | 'deleted' | 'not-found' | 'scheduled';
+        recoveryUntil?: string;
+        source: 'generated';
+    }[];
+    stage: string;
+}
 export interface SecretDeployPreflightResult extends SecretMetadataPreflightResult {
     action: SecretProtectedLifecycleAction;
     bypassed: boolean;
@@ -79,12 +142,35 @@ export declare function runSecretMetadataOperator(input: {
     mode?: 'apply' | 'report';
     scope: SecretManagementScope;
 }): Promise<SecretMetadataOperatorResult>;
+export declare function runGeneratedSecretInitializer(input: {
+    initializationControlPlane: GeneratedSecretInitializationControlPlane;
+    logicalName: string;
+    metadataControlPlane: SecretMetadataControlPlane;
+    declarations: readonly SecretMetadataDeclaration[];
+    mode?: 'apply' | 'report';
+    scope: SecretManagementScope;
+}): Promise<GeneratedSecretInitializationResult>;
 export declare function runSecretDeployPreflight(input: {
     action: SecretProtectedLifecycleAction;
     controlPlane: SecretMetadataControlPlane;
     declarations: readonly SecretMetadataDeclaration[];
     scope: SecretManagementScope;
 }): Promise<SecretDeployPreflightResult>;
+/**
+ * Retires only exact framework-generated stage secrets after a
+ * successful native Slice removal. This path never reads a secret value,
+ * inventories a prefix, or operates on operator/database-bootstrap secrets.
+ */
+export declare function runGeneratedSecretRetirement(input: {
+    accountId: string;
+    controlPlane: GeneratedSecretRetirementControlPlane;
+    declarations: readonly SecretMetadataDeclaration[];
+    now?: () => number;
+    partition: 'aws' | 'aws-cn' | 'aws-us-gov';
+    region: string;
+    scope: SecretManagementScope;
+    waitBeforeRetry?: (delayMs: number) => Promise<void>;
+}): Promise<GeneratedSecretRetirementResult>;
 export declare function runProtectedSecretLifecycle(input: {
     action: 'recover';
     authorization: ProtectedSecretOperatorAuthorization;