@empire-builder-kit/nx 1.0.0-rc.30 → 1.0.0-rc.32

package/src/executors/secret-metadata/secret-metadata.js

@@ -9,16 +9,17 @@ const client_sts_1 = require("@aws-sdk/client-sts");
 const credential_providers_1 = require("@aws-sdk/credential-providers");
 const node_path_1 = require("node:path");
 const index_js_1 = require("../../secrets/index.js");
+const index_js_2 = require("../../aws-authority/index.js");
 const secret_preflight_js_1 = require("../sst-lifecycle/secret-preflight.js");
-const index_js_2 = require("../../repository-policy/index.js");
-const infrastructure_plan_js_1 = require("../infrastructure-plan/infrastructure-plan.js");
-const protectedStages = new Set(['staging', 'production']);
+const index_js_3 = require("../../repository-policy/index.js");
+const identity_js_1 = require("../../aws/identity.js");
+const index_js_4 = require("../../workspace-deployment/index.js");
 const ROLE = /^arn:(aws|aws-us-gov|aws-cn):iam::\d{12}:role\/[A-Za-z0-9+=,.@_/-]{1,512}$/;
 function assertSecretMetadataApplyAuthority(stage, apply, environment = process.env, deploymentProfile = 'fully-isolated') {
-    if (!apply || !protectedStages.has(stage))
+    if (!apply)
         return 'none';
     const repository = environment.GITHUB_REPOSITORY;
-    const branch = stage === 'staging' ? 'develop' : 'main';
+    const branch = stage === 'production' ? 'main' : 'develop';
     const ref = `refs/heads/${branch}`;
     const expectedWorkflow = repository
         ? `${repository}/.github/workflows/secret-metadata.yml@${ref}`
@@ -30,12 +31,19 @@ function assertSecretMetadataApplyAuthority(stage, apply, environment = process.
         environment.GITHUB_WORKFLOW_REF === expectedWorkflow;
     if (exactWorkflow)
         return 'workflow';
-    if ((0, index_js_2.requiresGithubDeployment)(deploymentProfile, stage) ||
+    if ((0, index_js_3.requiresGithubDeployment)(deploymentProfile, stage) ||
         environment.GITHUB_ACTIONS === 'true') {
         throw new Error(`Protected ${stage} secret metadata apply must run from the ${branch}-branch Secret metadata workflow.`);
     }
     return 'local';
 }
+function partitionForRegion(region) {
+    if (region.startsWith('cn-'))
+        return 'aws-cn';
+    if (region.startsWith('us-gov-'))
+        return 'aws-us-gov';
+    return 'aws';
+}
 async function readCurrentPrincipal(input) {
     const client = new client_sts_1.STSClient({
         ...(input.profile
@@ -43,6 +51,7 @@ async function readCurrentPrincipal(input) {
                 credentials: (0, credential_providers_1.fromIni)({ profile: input.profile }),
             }
             : {}),
+        endpoint: (0, identity_js_1.canonicalStsEndpoint)(input.region),
         region: input.region,
     });
     const identity = await client.send(new client_sts_1.GetCallerIdentityCommand({}));
@@ -52,33 +61,32 @@ async function readCurrentPrincipal(input) {
     return { accountId: identity.Account, arn: identity.Arn };
 }
 async function assertProtectedSecretMetadataPrincipal(input) {
-    if (!input.apply || !protectedStages.has(input.stage))
+    if (!input.apply)
         return;
     const expectedAccount = input.environment.AWS_EXPECTED_ACCOUNT_ID;
-    const expectedRoleArn = input.environment.AWS_DEPLOY_ROLE_ARN;
+    const configuredRoleArn = input.environment.AWS_DEPLOY_ROLE_ARN;
     const runId = input.environment.GITHUB_RUN_ID;
     const runAttempt = input.environment.GITHUB_RUN_ATTEMPT;
-    const role = /^(arn:(aws|aws-us-gov|aws-cn):iam::(\d{12}):role\/([A-Za-z0-9+=,.@_-]{1,64}))$/.exec(expectedRoleArn ?? '');
-    if (!role ||
-        role[1] !== expectedRoleArn ||
-        role[3] !== expectedAccount ||
+    if (!ROLE.test(input.expectedRoleArn) ||
+        expectedAccount !== input.accountId ||
+        configuredRoleArn !== input.expectedRoleArn ||
         !/^\d+$/.test(runId ?? '') ||
         !/^\d+$/.test(runAttempt ?? '')) {
-        throw new Error('Protected secret metadata apply requires one exact pathless deployment role and workflow run identity.');
+        throw new Error('Protected secret metadata apply requires the exact committed stage deployment role and workflow run identity.');
     }
     let principal;
     try {
         principal = await (input.readPrincipal ?? readCurrentPrincipal)({
-            ...(input.profile ? { profile: input.profile } : {}),
             region: input.region,
         });
     }
     catch {
         throw new Error('Protected secret metadata apply could not authenticate its AWS principal.');
     }
-    const expectedPrincipalArn = `arn:${role[2]}:sts::${expectedAccount}:assumed-role/${role[4]}/ebk-secret-metadata-${runId}-${runAttempt}`;
-    if (principal.accountId !== expectedAccount ||
-        principal.arn !== expectedPrincipalArn) {
+    const expectedSession = `ebk-secret-metadata-${runId}-${runAttempt}`;
+    if (principal.accountId !== input.accountId ||
+        !(0, identity_js_1.matchesExpectedAssumedRoleArn)(input.accountId, principal.arn, input.expectedRoleArn) ||
+        !principal.arn.endsWith(`/${expectedSession}`)) {
         throw new Error('Protected secret metadata apply is not running as the exact reviewed deployment-role session.');
     }
 }
@@ -99,7 +107,7 @@ async function assertLocalSecretMetadataPrincipal(input) {
         throw new Error('Local protected secret metadata apply could not authenticate its AWS principal.');
     }
     if (principal.accountId !== input.accountId ||
-        !(0, infrastructure_plan_js_1.matchesExpectedAssumedRoleArn)(input.accountId, principal.arn, expectedRoleArn)) {
+        !(0, identity_js_1.matchesExpectedAssumedRoleArn)(input.accountId, principal.arn, expectedRoleArn)) {
         throw new Error('Local protected secret metadata apply is not running in the committed account as the exact temporary assumed role.');
     }
 }
@@ -118,36 +126,75 @@ function resolveSliceRoot(context) {
 async function executeSecretMetadata(options, context, dependencies = {}) {
     const environment = dependencies.environment ?? process.env;
     const apply = options.apply === true;
-    const operatingPolicy = apply && protectedStages.has(options.stage)
-        ? (dependencies.readOperatingPolicy ?? index_js_2.readRepositoryOperatingPolicy)(context.root)
+    const operatingPolicy = apply
+        ? (dependencies.readOperatingPolicy ?? index_js_3.readRepositoryOperatingPolicy)(context.root)
         : undefined;
     const authority = assertSecretMetadataApplyAuthority(options.stage, apply, environment, operatingPolicy?.deploymentProfile);
     const aws = (0, secret_preflight_js_1.resolveSecretAwsContext)(options, environment);
+    let accountId;
+    let expectedRoleArn;
+    if (apply) {
+        if (!operatingPolicy) {
+            throw new Error('Secret metadata operating policy is unavailable.');
+        }
+        if (!(0, index_js_3.isActiveDeploymentStage)(operatingPolicy.deploymentProfile, options.stage)) {
+            throw new Error(`Secret metadata stage ${options.stage} is inactive for the ${operatingPolicy.deploymentProfile} deployment profile.`);
+        }
+        const region = (0, index_js_3.configuredDeploymentRegion)(operatingPolicy.deploymentRegion);
+        if (aws.region !== region) {
+            throw new Error(`Secret metadata apply requires committed deployment Region ${region}.`);
+        }
+        accountId = (0, index_js_3.configuredDeploymentAccountForStage)(operatingPolicy.deploymentProfile, operatingPolicy.deploymentAccounts, options.stage);
+        expectedRoleArn = (0, index_js_2.createStageAuthorityIdentity)({
+            accountId,
+            partition: partitionForRegion(region),
+            region,
+            stage: options.stage,
+        }).deploymentRoleArn;
+    }
     if (authority === 'workflow') {
+        if (accountId === undefined ||
+            expectedRoleArn === undefined ||
+            options.profile !== undefined ||
+            options.expectedRoleArn !== undefined) {
+            throw new Error('Protected secret metadata apply uses only its exact OIDC workflow authority.');
+        }
         await assertProtectedSecretMetadataPrincipal({
+            accountId,
             apply,
             environment,
-            ...(aws.profile ? { profile: aws.profile } : {}),
+            expectedRoleArn,
             readPrincipal: dependencies.readPrincipal,
             region: aws.region,
             stage: options.stage,
         });
     }
     else if (authority === 'local') {
-        if (!operatingPolicy) {
+        if (accountId === undefined || expectedRoleArn === undefined) {
             throw new Error('Local secret metadata operating policy is unavailable.');
         }
-        const accounts = (0, index_js_2.configuredDeploymentAccountTopology)(operatingPolicy.deploymentProfile, operatingPolicy.deploymentAccounts);
-        const region = (0, index_js_2.configuredDeploymentRegion)(operatingPolicy.deploymentRegion);
-        if (aws.region !== region) {
-            throw new Error(`Local protected secret metadata apply requires committed deployment Region ${region}.`);
+        if (options.expectedRoleArn !== expectedRoleArn) {
+            throw new Error(`Local secret metadata apply requires the exact committed ${options.stage} stage authority role ${expectedRoleArn}.`);
         }
         await assertLocalSecretMetadataPrincipal({
-            accountId: accounts[options.stage],
-            expectedRoleArn: options.expectedRoleArn,
+            accountId,
+            expectedRoleArn,
             ...(aws.profile ? { profile: aws.profile } : {}),
             readPrincipal: dependencies.readPrincipal,
-            region,
+            region: aws.region,
+        });
+    }
+    if (apply) {
+        await (dependencies.ownership ?? index_js_4.assertWorkspaceStageOwnershipForWorkspace)(context.root, options.stage, {
+            ...(environment.AWS_CONFIG_FILE
+                ? { configFilepath: environment.AWS_CONFIG_FILE }
+                : {}),
+            ...(environment.AWS_SHARED_CREDENTIALS_FILE
+                ? {
+                    credentialsFilepath: environment.AWS_SHARED_CREDENTIALS_FILE,
+                }
+                : {}),
+            ...(aws.profile ? { profile: aws.profile } : {}),
         });
     }
     const loaded = await (0, secret_preflight_js_1.loadSliceSecretMetadata)({

package/src/executors/secret-metadata/secret-metadata.js.map

@@ -1 +1 @@
-{"version":3,"file":"secret-metadata.js","sourceRoot":"","sources":["../../../../../../packages/nx/src/executors/secret-metadata/secret-metadata.ts"],"names":[],"mappings":";;AAkDA,gFA6BC;AAqBD,wFAgDC;AAED,gFAqCC;AAoBD,sDAiEC;AAhRD,uCAAgF;AAChF,oDAA0E;AAC1E,wEAAwD;AACxD,yCAA6C;AAE7C,qDAIgC;AAChC,8EAI8C;AAC9C,+DAO0C;AAC1C,0FAA8F;AAqB9F,MAAM,eAAe,GAAG,IAAI,GAAG,CAAC,CAAC,SAAS,EAAE,YAAY,CAAC,CAAC,CAAC;AAC3D,MAAM,IAAI,GACR,4EAA4E,CAAC;AAI/E,SAAgB,kCAAkC,CAChD,KAA6C,EAC7C,KAAc,EACd,cAAiC,OAAO,CAAC,GAAG,EAC5C,oBAAuC,gBAAgB;IAEvD,IAAI,CAAC,KAAK,IAAI,CAAC,eAAe,CAAC,GAAG,CAAC,KAAK,CAAC;QAAE,OAAO,MAAM,CAAC;IACzD,MAAM,UAAU,GAAG,WAAW,CAAC,iBAAiB,CAAC;IACjD,MAAM,MAAM,GAAG,KAAK,KAAK,SAAS,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,MAAM,CAAC;IACxD,MAAM,GAAG,GAAG,cAAc,MAAM,EAAE,CAAC;IACnC,MAAM,gBAAgB,GAAG,UAAU;QACjC,CAAC,CAAC,GAAG,UAAU,0CAA0C,GAAG,EAAE;QAC9D,CAAC,CAAC,SAAS,CAAC;IACd,MAAM,aAAa,GACjB,WAAW,CAAC,cAAc,KAAK,MAAM;QACrC,WAAW,CAAC,iBAAiB,KAAK,mBAAmB;QACrD,WAAW,CAAC,UAAU,KAAK,GAAG;QAC9B,OAAO,CAAC,UAAU,CAAC;QACnB,WAAW,CAAC,mBAAmB,KAAK,gBAAgB,CAAC;IACvD,IAAI,aAAa;QAAE,OAAO,UAAU,CAAC;IACrC,IACE,IAAA,mCAAwB,EAAC,iBAAiB,EAAE,KAAK,CAAC;QAClD,WAAW,CAAC,cAAc,KAAK,MAAM,EACrC,CAAC;QACD,MAAM,IAAI,KAAK,CACb,aAAa,KAAK,4CAA4C,MAAM,mCAAmC,CACxG,CAAC;IACJ,CAAC;IACD,OAAO,OAAO,CAAC;AACjB,CAAC;AAED,KAAK,UAAU,oBAAoB,CAAC,KAGnC;IACC,MAAM,MAAM,GAAG,IAAI,sBAAS,CAAC;QAC3B,GAAG,CAAC,KAAK,CAAC,OAAO;YACf,CAAC,CAAC;gBACE,WAAW,EAAE,IAAA,8BAAO,EAAC,EAAE,OAAO,EAAE,KAAK,CAAC,OAAO,EAAE,CAAC;aACjD;YACH,CAAC,CAAC,EAAE,CAAC;QACP,MAAM,EAAE,KAAK,CAAC,MAAM;KACrB,CAAC,CAAC;IACH,MAAM,QAAQ,GAAG,MAAM,MAAM,CAAC,IAAI,CAAC,IAAI,qCAAwB,CAAC,EAAE,CAAC,CAAC,CAAC;IACrE,IAAI,CAAC,QAAQ,CAAC,OAAO,IAAI,CAAC,QAAQ,CAAC,GAAG,EAAE,CAAC;QACvC,MAAM,IAAI,KAAK,CAAC,qDAAqD,CAAC,CAAC;IACzE,CAAC;IACD,OAAO,EAAE,SAAS,EAAE,QAAQ,CAAC,OAAO,EAAE,GAAG,EAAE,QAAQ,CAAC,GAAG,EAAE,CAAC;AAC5D,CAAC;AAEM,KAAK,UAAU,sCAAsC,CAAC,KAO5D;IACC,IAAI,CAAC,KAAK,CAAC,KAAK,IAAI,CAAC,eAAe,CAAC,GAAG,CAAC,KAAK,CAAC,KAAK,CAAC;QAAE,OAAO;IAC9D,MAAM,eAAe,GAAG,KAAK,CAAC,WAAW,CAAC,uBAAuB,CAAC;IAClE,MAAM,eAAe,GAAG,KAAK,CAAC,WAAW,CAAC,mBAAmB,CAAC;IAC9D,MAAM,KAAK,GAAG,KAAK,CAAC,WAAW,CAAC,aAAa,CAAC;IAC9C,MAAM,UAAU,GAAG,KAAK,CAAC,WAAW,CAAC,kBAAkB,CAAC;IACxD,MAAM,IAAI,GACR,gFAAgF,CAAC,IAAI,CACnF,eAAe,IAAI,EAAE,CACtB,CAAC;IACJ,IACE,CAAC,IAAI;QACL,IAAI,CAAC,CAAC,CAAC,KAAK,eAAe;QAC3B,IAAI,CAAC,CAAC,CAAC,KAAK,eAAe;QAC3B,CAAC,OAAO,CAAC,IAAI,CAAC,KAAK,IAAI,EAAE,CAAC;QAC1B,CAAC,OAAO,CAAC,IAAI,CAAC,UAAU,IAAI,EAAE,CAAC,EAC/B,CAAC;QACD,MAAM,IAAI,KAAK,CACb,wGAAwG,CACzG,CAAC;IACJ,CAAC;IACD,IAAI,SAA6C,CAAC;IAClD,IAAI,CAAC;QACH,SAAS,GAAG,MAAM,CAAC,KAAK,CAAC,aAAa,IAAI,oBAAoB,CAAC,CAAC;YAC9D,GAAG,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,EAAE,OAAO,EAAE,KAAK,CAAC,OAAO,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;YACpD,MAAM,EAAE,KAAK,CAAC,MAAM;SACrB,CAAC,CAAC;IACL,CAAC;IAAC,MAAM,CAAC;QACP,MAAM,IAAI,KAAK,CACb,2EAA2E,CAC5E,CAAC;IACJ,CAAC;IACD,MAAM,oBAAoB,GAAG,OAAO,IAAI,CAAC,CAAC,CAAC,SAAS,eAAe,iBAAiB,IAAI,CAAC,CAAC,CAAC,wBAAwB,KAAK,IAAI,UAAU,EAAE,CAAC;IACzI,IACE,SAAS,CAAC,SAAS,KAAK,eAAe;QACvC,SAAS,CAAC,GAAG,KAAK,oBAAoB,EACtC,CAAC;QACD,MAAM,IAAI,KAAK,CACb,+FAA+F,CAChG,CAAC;IACJ,CAAC;AACH,CAAC;AAEM,KAAK,UAAU,kCAAkC,CAAC,KAMxD;IACC,MAAM,eAAe,GAAG,KAAK,CAAC,eAAe,EAAE,IAAI,EAAE,IAAI,EAAE,CAAC;IAC5D,MAAM,OAAO,GAAG,KAAK,CAAC,OAAO,EAAE,IAAI,EAAE,IAAI,EAAE,CAAC;IAC5C,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC,eAAe,CAAC,IAAI,OAAO,KAAK,EAAE,EAAE,CAAC;QAClD,MAAM,IAAI,KAAK,CACb,2FAA2F,CAC5F,CAAC;IACJ,CAAC;IACD,IAAI,SAA6C,CAAC;IAClD,IAAI,CAAC;QACH,SAAS,GAAG,MAAM,CAAC,KAAK,CAAC,aAAa,IAAI,oBAAoB,CAAC,CAAC;YAC9D,OAAO;YACP,MAAM,EAAE,KAAK,CAAC,MAAM;SACrB,CAAC,CAAC;IACL,CAAC;IAAC,MAAM,CAAC;QACP,MAAM,IAAI,KAAK,CACb,iFAAiF,CAClF,CAAC;IACJ,CAAC;IACD,IACE,SAAS,CAAC,SAAS,KAAK,KAAK,CAAC,SAAS;QACvC,CAAC,IAAA,sDAA6B,EAC5B,KAAK,CAAC,SAAS,EACf,SAAS,CAAC,GAAG,EACb,eAAe,CAChB,EACD,CAAC;QACD,MAAM,IAAI,KAAK,CACb,oHAAoH,CACrH,CAAC;IACJ,CAAC;AACH,CAAC;AAED,SAAS,gBAAgB,CAAC,OAAwB;IAChD,IAAI,CAAC,OAAO,CAAC,WAAW,EAAE,CAAC;QACzB,MAAM,IAAI,KAAK,CACb,qEAAqE,CACtE,CAAC;IACJ,CAAC;IACD,MAAM,cAAc,GAClB,OAAO,CAAC,sBAAsB,EAAE,QAAQ,CAAC,OAAO,CAAC,WAAW,CAAC,EAAE,IAAI,CAAC;IACtE,IAAI,CAAC,cAAc,EAAE,CAAC;QACpB,MAAM,IAAI,KAAK,CACb,cAAc,OAAO,CAAC,WAAW,mCAAmC,CACrE,CAAC;IACJ,CAAC;IACD,OAAO,IAAA,sBAAU,EAAC,cAAc,CAAC;QAC/B,CAAC,CAAC,cAAc;QAChB,CAAC,CAAC,IAAA,gBAAI,EAAC,OAAO,CAAC,IAAI,EAAE,cAAc,CAAC,CAAC;AACzC,CAAC;AAEM,KAAK,UAAU,qBAAqB,CACzC,OAAsC,EACtC,OAAwB,EACxB,eAAmD,EAAE;IAErD,MAAM,WAAW,GAAG,YAAY,CAAC,WAAW,IAAI,OAAO,CAAC,GAAG,CAAC;IAC5D,MAAM,KAAK,GAAG,OAAO,CAAC,KAAK,KAAK,IAAI,CAAC;IACrC,MAAM,eAAe,GACnB,KAAK,IAAI,eAAe,CAAC,GAAG,CAAC,OAAO,CAAC,KAAK,CAAC;QACzC,CAAC,CAAC,CAAC,YAAY,CAAC,mBAAmB,IAAI,wCAA6B,CAAC,CACjE,OAAO,CAAC,IAAI,CACb;QACH,CAAC,CAAC,SAAS,CAAC;IAChB,MAAM,SAAS,GAAG,kCAAkC,CAClD,OAAO,CAAC,KAAK,EACb,KAAK,EACL,WAAW,EACX,eAAe,EAAE,iBAAiB,CACnC,CAAC;IACF,MAAM,GAAG,GAAG,IAAA,6CAAuB,EAAC,OAAO,EAAE,WAAW,CAAC,CAAC;IAC1D,IAAI,SAAS,KAAK,UAAU,EAAE,CAAC;QAC7B,MAAM,sCAAsC,CAAC;YAC3C,KAAK;YACL,WAAW;YACX,GAAG,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,EAAE,OAAO,EAAE,GAAG,CAAC,OAAO,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;YAChD,aAAa,EAAE,YAAY,CAAC,aAAa;YACzC,MAAM,EAAE,GAAG,CAAC,MAAM;YAClB,KAAK,EAAE,OAAO,CAAC,KAAK;SACrB,CAAC,CAAC;IACL,CAAC;SAAM,IAAI,SAAS,KAAK,OAAO,EAAE,CAAC;QACjC,IAAI,CAAC,eAAe,EAAE,CAAC;YACrB,MAAM,IAAI,KAAK,CAAC,wDAAwD,CAAC,CAAC;QAC5E,CAAC;QACD,MAAM,QAAQ,GAAG,IAAA,8CAAmC,EAClD,eAAe,CAAC,iBAAiB,EACjC,eAAe,CAAC,kBAAkB,CACnC,CAAC;QACF,MAAM,MAAM,GAAG,IAAA,qCAA0B,EAAC,eAAe,CAAC,gBAAgB,CAAC,CAAC;QAC5E,IAAI,GAAG,CAAC,MAAM,KAAK,MAAM,EAAE,CAAC;YAC1B,MAAM,IAAI,KAAK,CACb,8EAA8E,MAAM,GAAG,CACxF,CAAC;QACJ,CAAC;QACD,MAAM,kCAAkC,CAAC;YACvC,SAAS,EAAE,QAAQ,CAAC,OAAO,CAAC,KAAK,CAAC;YAClC,eAAe,EAAE,OAAO,CAAC,eAAe;YACxC,GAAG,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,EAAE,OAAO,EAAE,GAAG,CAAC,OAAO,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;YAChD,aAAa,EAAE,YAAY,CAAC,aAAa;YACzC,MAAM;SACP,CAAC,CAAC;IACL,CAAC;IACD,MAAM,MAAM,GAAG,MAAM,IAAA,6CAAuB,EAAC;QAC3C,OAAO;QACP,GAAG,EAAE,gBAAgB,CAAC,OAAO,CAAC;QAC9B,GAAG,CAAC,YAAY,CAAC,QAAQ,CAAC,CAAC,CAAC,EAAE,QAAQ,EAAE,YAAY,CAAC,QAAQ,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QACrE,KAAK,EAAE,OAAO,CAAC,KAAK;KACrB,CAAC,CAAC;IACH,MAAM,YAAY,GAChB,YAAY,CAAC,YAAY,IAAI,IAAA,sDAAgC,EAAC,GAAG,CAAC,CAAC;IACrE,OAAO,IAAA,oCAAyB,EAAC;QAC/B,YAAY;QACZ,YAAY,EAAE,MAAM,CAAC,YAAY;QACjC,IAAI,EAAE,KAAK,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,QAAQ;QAChC,KAAK,EAAE,MAAM,CAAC,KAAK;KACpB,CAAC,CAAC;AACL,CAAC;AAED,MAAM,QAAQ,GAAmD,KAAK,EACpE,OAAO,EACP,OAAO,EACP,EAAE;IACF,IAAI,CAAC;QACH,MAAM,MAAM,GAAG,MAAM,qBAAqB,CAAC,OAAO,EAAE,OAAO,CAAC,CAAC;QAC7D,eAAM,CAAC,IAAI,CACT,qBAAqB,MAAM,CAAC,IAAI,IAAI,MAAM,CAAC,OAAO,KAAK,IAAI,CAAC,SAAS,CAAC,MAAM,EAAE,IAAI,EAAE,CAAC,CAAC,EAAE,CACzF,CAAC;QACF,OAAO;YACL,OAAO,EAAE,MAAM,CAAC,OAAO,KAAK,UAAU,IAAI,MAAM,CAAC,OAAO,KAAK,SAAS;SACvE,CAAC;IACJ,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,eAAM,CAAC,KAAK,CACV,KAAK,YAAY,KAAK;YACpB,CAAC,CAAC,KAAK,CAAC,OAAO;YACf,CAAC,CAAC,mCAAmC,CACxC,CAAC;QACF,OAAO,EAAE,OAAO,EAAE,KAAK,EAAE,CAAC;IAC5B,CAAC;AACH,CAAC,CAAC;AAEF,kBAAe,QAAQ,CAAC"}
+{"version":3,"file":"secret-metadata.js","sourceRoot":"","sources":["../../../../../../packages/nx/src/executors/secret-metadata/secret-metadata.ts"],"names":[],"mappings":";;AAwDA,gFA6BC;AA4BD,wFAiDC;AAED,gFAqCC;AAoBD,sDAsHC;AAnVD,uCAAgF;AAChF,oDAA0E;AAC1E,wEAAwD;AACxD,yCAA6C;AAE7C,qDAIgC;AAChC,2DAA4E;AAC5E,8EAI8C;AAC9C,+DAQ0C;AAC1C,uDAG+B;AAC/B,kEAAgG;AAsBhG,MAAM,IAAI,GACR,4EAA4E,CAAC;AAI/E,SAAgB,kCAAkC,CAChD,KAA6C,EAC7C,KAAc,EACd,cAAiC,OAAO,CAAC,GAAG,EAC5C,oBAAuC,gBAAgB;IAEvD,IAAI,CAAC,KAAK;QAAE,OAAO,MAAM,CAAC;IAC1B,MAAM,UAAU,GAAG,WAAW,CAAC,iBAAiB,CAAC;IACjD,MAAM,MAAM,GAAG,KAAK,KAAK,YAAY,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,SAAS,CAAC;IAC3D,MAAM,GAAG,GAAG,cAAc,MAAM,EAAE,CAAC;IACnC,MAAM,gBAAgB,GAAG,UAAU;QACjC,CAAC,CAAC,GAAG,UAAU,0CAA0C,GAAG,EAAE;QAC9D,CAAC,CAAC,SAAS,CAAC;IACd,MAAM,aAAa,GACjB,WAAW,CAAC,cAAc,KAAK,MAAM;QACrC,WAAW,CAAC,iBAAiB,KAAK,mBAAmB;QACrD,WAAW,CAAC,UAAU,KAAK,GAAG;QAC9B,OAAO,CAAC,UAAU,CAAC;QACnB,WAAW,CAAC,mBAAmB,KAAK,gBAAgB,CAAC;IACvD,IAAI,aAAa;QAAE,OAAO,UAAU,CAAC;IACrC,IACE,IAAA,mCAAwB,EAAC,iBAAiB,EAAE,KAAK,CAAC;QAClD,WAAW,CAAC,cAAc,KAAK,MAAM,EACrC,CAAC;QACD,MAAM,IAAI,KAAK,CACb,aAAa,KAAK,4CAA4C,MAAM,mCAAmC,CACxG,CAAC;IACJ,CAAC;IACD,OAAO,OAAO,CAAC;AACjB,CAAC;AAED,SAAS,kBAAkB,CAAC,MAAc;IACxC,IAAI,MAAM,CAAC,UAAU,CAAC,KAAK,CAAC;QAAE,OAAO,QAAQ,CAAC;IAC9C,IAAI,MAAM,CAAC,UAAU,CAAC,SAAS,CAAC;QAAE,OAAO,YAAY,CAAC;IACtD,OAAO,KAAK,CAAC;AACf,CAAC;AAED,KAAK,UAAU,oBAAoB,CAAC,KAGnC;IACC,MAAM,MAAM,GAAG,IAAI,sBAAS,CAAC;QAC3B,GAAG,CAAC,KAAK,CAAC,OAAO;YACf,CAAC,CAAC;gBACE,WAAW,EAAE,IAAA,8BAAO,EAAC,EAAE,OAAO,EAAE,KAAK,CAAC,OAAO,EAAE,CAAC;aACjD;YACH,CAAC,CAAC,EAAE,CAAC;QACP,QAAQ,EAAE,IAAA,kCAAoB,EAAC,KAAK,CAAC,MAAM,CAAC;QAC5C,MAAM,EAAE,KAAK,CAAC,MAAM;KACrB,CAAC,CAAC;IACH,MAAM,QAAQ,GAAG,MAAM,MAAM,CAAC,IAAI,CAAC,IAAI,qCAAwB,CAAC,EAAE,CAAC,CAAC,CAAC;IACrE,IAAI,CAAC,QAAQ,CAAC,OAAO,IAAI,CAAC,QAAQ,CAAC,GAAG,EAAE,CAAC;QACvC,MAAM,IAAI,KAAK,CAAC,qDAAqD,CAAC,CAAC;IACzE,CAAC;IACD,OAAO,EAAE,SAAS,EAAE,QAAQ,CAAC,OAAO,EAAE,GAAG,EAAE,QAAQ,CAAC,GAAG,EAAE,CAAC;AAC5D,CAAC;AAEM,KAAK,UAAU,sCAAsC,CAAC,KAQ5D;IACC,IAAI,CAAC,KAAK,CAAC,KAAK;QAAE,OAAO;IACzB,MAAM,eAAe,GAAG,KAAK,CAAC,WAAW,CAAC,uBAAuB,CAAC;IAClE,MAAM,iBAAiB,GAAG,KAAK,CAAC,WAAW,CAAC,mBAAmB,CAAC;IAChE,MAAM,KAAK,GAAG,KAAK,CAAC,WAAW,CAAC,aAAa,CAAC;IAC9C,MAAM,UAAU,GAAG,KAAK,CAAC,WAAW,CAAC,kBAAkB,CAAC;IACxD,IACE,CAAC,IAAI,CAAC,IAAI,CAAC,KAAK,CAAC,eAAe,CAAC;QACjC,eAAe,KAAK,KAAK,CAAC,SAAS;QACnC,iBAAiB,KAAK,KAAK,CAAC,eAAe;QAC3C,CAAC,OAAO,CAAC,IAAI,CAAC,KAAK,IAAI,EAAE,CAAC;QAC1B,CAAC,OAAO,CAAC,IAAI,CAAC,UAAU,IAAI,EAAE,CAAC,EAC/B,CAAC;QACD,MAAM,IAAI,KAAK,CACb,+GAA+G,CAChH,CAAC;IACJ,CAAC;IACD,IAAI,SAA6C,CAAC;IAClD,IAAI,CAAC;QACH,SAAS,GAAG,MAAM,CAAC,KAAK,CAAC,aAAa,IAAI,oBAAoB,CAAC,CAAC;YAC9D,MAAM,EAAE,KAAK,CAAC,MAAM;SACrB,CAAC,CAAC;IACL,CAAC;IAAC,MAAM,CAAC;QACP,MAAM,IAAI,KAAK,CACb,2EAA2E,CAC5E,CAAC;IACJ,CAAC;IACD,MAAM,eAAe,GAAG,uBAAuB,KAAK,IAAI,UAAU,EAAE,CAAC;IACrE,IACE,SAAS,CAAC,SAAS,KAAK,KAAK,CAAC,SAAS;QACvC,CAAC,IAAA,2CAA6B,EAC5B,KAAK,CAAC,SAAS,EACf,SAAS,CAAC,GAAG,EACb,KAAK,CAAC,eAAe,CACtB;QACD,CAAC,SAAS,CAAC,GAAG,CAAC,QAAQ,CAAC,IAAI,eAAe,EAAE,CAAC,EAC9C,CAAC;QACD,MAAM,IAAI,KAAK,CACb,+FAA+F,CAChG,CAAC;IACJ,CAAC;AACH,CAAC;AAEM,KAAK,UAAU,kCAAkC,CAAC,KAMxD;IACC,MAAM,eAAe,GAAG,KAAK,CAAC,eAAe,EAAE,IAAI,EAAE,IAAI,EAAE,CAAC;IAC5D,MAAM,OAAO,GAAG,KAAK,CAAC,OAAO,EAAE,IAAI,EAAE,IAAI,EAAE,CAAC;IAC5C,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC,eAAe,CAAC,IAAI,OAAO,KAAK,EAAE,EAAE,CAAC;QAClD,MAAM,IAAI,KAAK,CACb,2FAA2F,CAC5F,CAAC;IACJ,CAAC;IACD,IAAI,SAA6C,CAAC;IAClD,IAAI,CAAC;QACH,SAAS,GAAG,MAAM,CAAC,KAAK,CAAC,aAAa,IAAI,oBAAoB,CAAC,CAAC;YAC9D,OAAO;YACP,MAAM,EAAE,KAAK,CAAC,MAAM;SACrB,CAAC,CAAC;IACL,CAAC;IAAC,MAAM,CAAC;QACP,MAAM,IAAI,KAAK,CACb,iFAAiF,CAClF,CAAC;IACJ,CAAC;IACD,IACE,SAAS,CAAC,SAAS,KAAK,KAAK,CAAC,SAAS;QACvC,CAAC,IAAA,2CAA6B,EAC5B,KAAK,CAAC,SAAS,EACf,SAAS,CAAC,GAAG,EACb,eAAe,CAChB,EACD,CAAC;QACD,MAAM,IAAI,KAAK,CACb,oHAAoH,CACrH,CAAC;IACJ,CAAC;AACH,CAAC;AAED,SAAS,gBAAgB,CAAC,OAAwB;IAChD,IAAI,CAAC,OAAO,CAAC,WAAW,EAAE,CAAC;QACzB,MAAM,IAAI,KAAK,CACb,qEAAqE,CACtE,CAAC;IACJ,CAAC;IACD,MAAM,cAAc,GAClB,OAAO,CAAC,sBAAsB,EAAE,QAAQ,CAAC,OAAO,CAAC,WAAW,CAAC,EAAE,IAAI,CAAC;IACtE,IAAI,CAAC,cAAc,EAAE,CAAC;QACpB,MAAM,IAAI,KAAK,CACb,cAAc,OAAO,CAAC,WAAW,mCAAmC,CACrE,CAAC;IACJ,CAAC;IACD,OAAO,IAAA,sBAAU,EAAC,cAAc,CAAC;QAC/B,CAAC,CAAC,cAAc;QAChB,CAAC,CAAC,IAAA,gBAAI,EAAC,OAAO,CAAC,IAAI,EAAE,cAAc,CAAC,CAAC;AACzC,CAAC;AAEM,KAAK,UAAU,qBAAqB,CACzC,OAAsC,EACtC,OAAwB,EACxB,eAAmD,EAAE;IAErD,MAAM,WAAW,GAAG,YAAY,CAAC,WAAW,IAAI,OAAO,CAAC,GAAG,CAAC;IAC5D,MAAM,KAAK,GAAG,OAAO,CAAC,KAAK,KAAK,IAAI,CAAC;IACrC,MAAM,eAAe,GAAG,KAAK;QAC3B,CAAC,CAAC,CAAC,YAAY,CAAC,mBAAmB,IAAI,wCAA6B,CAAC,CACjE,OAAO,CAAC,IAAI,CACb;QACH,CAAC,CAAC,SAAS,CAAC;IACd,MAAM,SAAS,GAAG,kCAAkC,CAClD,OAAO,CAAC,KAAK,EACb,KAAK,EACL,WAAW,EACX,eAAe,EAAE,iBAAiB,CACnC,CAAC;IACF,MAAM,GAAG,GAAG,IAAA,6CAAuB,EAAC,OAAO,EAAE,WAAW,CAAC,CAAC;IAC1D,IAAI,SAA6B,CAAC;IAClC,IAAI,eAAmC,CAAC;IACxC,IAAI,KAAK,EAAE,CAAC;QACV,IAAI,CAAC,eAAe,EAAE,CAAC;YACrB,MAAM,IAAI,KAAK,CAAC,kDAAkD,CAAC,CAAC;QACtE,CAAC;QACD,IACE,CAAC,IAAA,kCAAuB,EAAC,eAAe,CAAC,iBAAiB,EAAE,OAAO,CAAC,KAAK,CAAC,EAC1E,CAAC;YACD,MAAM,IAAI,KAAK,CACb,yBAAyB,OAAO,CAAC,KAAK,wBAAwB,eAAe,CAAC,iBAAiB,sBAAsB,CACtH,CAAC;QACJ,CAAC;QACD,MAAM,MAAM,GAAG,IAAA,qCAA0B,EAAC,eAAe,CAAC,gBAAgB,CAAC,CAAC;QAC5E,IAAI,GAAG,CAAC,MAAM,KAAK,MAAM,EAAE,CAAC;YAC1B,MAAM,IAAI,KAAK,CACb,8DAA8D,MAAM,GAAG,CACxE,CAAC;QACJ,CAAC;QACD,SAAS,GAAG,IAAA,8CAAmC,EAC7C,eAAe,CAAC,iBAAiB,EACjC,eAAe,CAAC,kBAAkB,EAClC,OAAO,CAAC,KAAK,CACd,CAAC;QACF,eAAe,GAAG,IAAA,uCAA4B,EAAC;YAC7C,SAAS;YACT,SAAS,EAAE,kBAAkB,CAAC,MAAM,CAAC;YACrC,MAAM;YACN,KAAK,EAAE,OAAO,CAAC,KAAK;SACrB,CAAC,CAAC,iBAAiB,CAAC;IACvB,CAAC;IACD,IAAI,SAAS,KAAK,UAAU,EAAE,CAAC;QAC7B,IACE,SAAS,KAAK,SAAS;YACvB,eAAe,KAAK,SAAS;YAC7B,OAAO,CAAC,OAAO,KAAK,SAAS;YAC7B,OAAO,CAAC,eAAe,KAAK,SAAS,EACrC,CAAC;YACD,MAAM,IAAI,KAAK,CACb,8EAA8E,CAC/E,CAAC;QACJ,CAAC;QACD,MAAM,sCAAsC,CAAC;YAC3C,SAAS;YACT,KAAK;YACL,WAAW;YACX,eAAe;YACf,aAAa,EAAE,YAAY,CAAC,aAAa;YACzC,MAAM,EAAE,GAAG,CAAC,MAAM;YAClB,KAAK,EAAE,OAAO,CAAC,KAAK;SACrB,CAAC,CAAC;IACL,CAAC;SAAM,IAAI,SAAS,KAAK,OAAO,EAAE,CAAC;QACjC,IAAI,SAAS,KAAK,SAAS,IAAI,eAAe,KAAK,SAAS,EAAE,CAAC;YAC7D,MAAM,IAAI,KAAK,CAAC,wDAAwD,CAAC,CAAC;QAC5E,CAAC;QACD,IAAI,OAAO,CAAC,eAAe,KAAK,eAAe,EAAE,CAAC;YAChD,MAAM,IAAI,KAAK,CACb,4DAA4D,OAAO,CAAC,KAAK,yBAAyB,eAAe,GAAG,CACrH,CAAC;QACJ,CAAC;QACD,MAAM,kCAAkC,CAAC;YACvC,SAAS;YACT,eAAe;YACf,GAAG,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,EAAE,OAAO,EAAE,GAAG,CAAC,OAAO,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;YAChD,aAAa,EAAE,YAAY,CAAC,aAAa;YACzC,MAAM,EAAE,GAAG,CAAC,MAAM;SACnB,CAAC,CAAC;IACL,CAAC;IACD,IAAI,KAAK,EAAE,CAAC;QACV,MAAM,CAAC,YAAY,CAAC,SAAS,IAAI,oDAAyC,CAAC,CACzE,OAAO,CAAC,IAAI,EACZ,OAAO,CAAC,KAAK,EACb;YACE,GAAG,CAAC,WAAW,CAAC,eAAe;gBAC7B,CAAC,CAAC,EAAE,cAAc,EAAE,WAAW,CAAC,eAAe,EAAE;gBACjD,CAAC,CAAC,EAAE,CAAC;YACP,GAAG,CAAC,WAAW,CAAC,2BAA2B;gBACzC,CAAC,CAAC;oBACE,mBAAmB,EAAE,WAAW,CAAC,2BAA2B;iBAC7D;gBACH,CAAC,CAAC,EAAE,CAAC;YACP,GAAG,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,EAAE,OAAO,EAAE,GAAG,CAAC,OAAO,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;SACjD,CACF,CAAC;IACJ,CAAC;IACD,MAAM,MAAM,GAAG,MAAM,IAAA,6CAAuB,EAAC;QAC3C,OAAO;QACP,GAAG,EAAE,gBAAgB,CAAC,OAAO,CAAC;QAC9B,GAAG,CAAC,YAAY,CAAC,QAAQ,CAAC,CAAC,CAAC,EAAE,QAAQ,EAAE,YAAY,CAAC,QAAQ,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QACrE,KAAK,EAAE,OAAO,CAAC,KAAK;KACrB,CAAC,CAAC;IACH,MAAM,YAAY,GAChB,YAAY,CAAC,YAAY,IAAI,IAAA,sDAAgC,EAAC,GAAG,CAAC,CAAC;IACrE,OAAO,IAAA,oCAAyB,EAAC;QAC/B,YAAY;QACZ,YAAY,EAAE,MAAM,CAAC,YAAY;QACjC,IAAI,EAAE,KAAK,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,QAAQ;QAChC,KAAK,EAAE,MAAM,CAAC,KAAK;KACpB,CAAC,CAAC;AACL,CAAC;AAED,MAAM,QAAQ,GAAmD,KAAK,EACpE,OAAO,EACP,OAAO,EACP,EAAE;IACF,IAAI,CAAC;QACH,MAAM,MAAM,GAAG,MAAM,qBAAqB,CAAC,OAAO,EAAE,OAAO,CAAC,CAAC;QAC7D,eAAM,CAAC,IAAI,CACT,qBAAqB,MAAM,CAAC,IAAI,IAAI,MAAM,CAAC,OAAO,KAAK,IAAI,CAAC,SAAS,CAAC,MAAM,EAAE,IAAI,EAAE,CAAC,CAAC,EAAE,CACzF,CAAC;QACF,OAAO;YACL,OAAO,EAAE,MAAM,CAAC,OAAO,KAAK,UAAU,IAAI,MAAM,CAAC,OAAO,KAAK,SAAS;SACvE,CAAC;IACJ,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,eAAM,CAAC,KAAK,CACV,KAAK,YAAY,KAAK;YACpB,CAAC,CAAC,KAAK,CAAC,OAAO;YACf,CAAC,CAAC,mCAAmC,CACxC,CAAC;QACF,OAAO,EAAE,OAAO,EAAE,KAAK,EAAE,CAAC;IAC5B,CAAC;AACH,CAAC,CAAC;AAEF,kBAAe,QAAQ,CAAC"}

package/src/executors/sst-lifecycle/generated-secret-retirement.d.ts

@@ -0,0 +1,53 @@
+import type { ExecutorContext } from '@nx/devkit';
+import { type RepositoryOperatingPolicy } from '../../repository-policy/index.js';
+import { type GeneratedSecretRetirementControlPlane, type GeneratedSecretRetirementResult } from '../../secrets/index.js';
+import { type LoadedSliceSecretMetadata } from './secret-preflight.js';
+import type { SstCommandInvocation, SstLifecycleOptions } from './run-sst-command.js';
+export declare const GENERATED_SECRET_RETIREMENT_EVIDENCE_DIRECTORY: string;
+interface AwsPrincipal {
+    accountId: string;
+    arn: string;
+}
+export interface GeneratedSecretRetirementEvidence {
+    accountId: string;
+    actorArn: string;
+    completedAt: string;
+    deletionMode: GeneratedSecretRetirementResult['deletionMode'];
+    kind: 'ebk-generated-secret-retirement';
+    project: string;
+    recoveryWindowDays?: 7;
+    region: string;
+    result: 'succeeded';
+    schemaVersion: 1;
+    secrets: GeneratedSecretRetirementResult['secrets'];
+    sourceCommit: string;
+    stage: string;
+    startedAt: string;
+    workspace: string;
+}
+export interface GeneratedSecretRetirementDependencies {
+    controlPlane?: GeneratedSecretRetirementControlPlane;
+    environment?: NodeJS.ProcessEnv;
+    loadMetadata?: (input: {
+        context: ExecutorContext;
+        cwd: string;
+        stage: string;
+    }) => Promise<LoadedSliceSecretMetadata>;
+    now?: () => Date;
+    readOperatingPolicy?: (workspaceRoot: string) => RepositoryOperatingPolicy;
+    readPrincipal?: (input: {
+        environment: NodeJS.ProcessEnv;
+        profile?: string;
+        region: string;
+    }) => Promise<AwsPrincipal>;
+    writeEvidence?: (path: string, evidence: GeneratedSecretRetirementEvidence) => void;
+    waitBeforeRetry?: (delayMs: number) => Promise<void>;
+}
+/**
+ * Complete the generated-secret portion of one successful native Slice remove.
+ * The invocation has already passed the normal stage/removal authorization;
+ * this function independently reattests its exact AWS identity and secret
+ * ownership before applying the stage-specific deletion policy.
+ */
+export declare function retireGeneratedSecretsAfterSliceRemove(options: SstLifecycleOptions, context: ExecutorContext, invocation: SstCommandInvocation, dependencies?: GeneratedSecretRetirementDependencies): Promise<GeneratedSecretRetirementEvidence>;
+export {};

package/src/executors/sst-lifecycle/generated-secret-retirement.js

@@ -0,0 +1,192 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.GENERATED_SECRET_RETIREMENT_EVIDENCE_DIRECTORY = void 0;
+exports.retireGeneratedSecretsAfterSliceRemove = retireGeneratedSecretsAfterSliceRemove;
+const client_sts_1 = require("@aws-sdk/client-sts");
+const credential_providers_1 = require("@aws-sdk/credential-providers");
+const node_fs_1 = require("node:fs");
+const node_path_1 = require("node:path");
+const index_js_1 = require("../../aws-authority/index.js");
+const identity_js_1 = require("../../aws/identity.js");
+const index_js_2 = require("../../repository-policy/index.js");
+const index_js_3 = require("../../secrets/index.js");
+const secret_preflight_js_1 = require("./secret-preflight.js");
+const private_state_js_1 = require("../../local-dev/private-state.js");
+const GENERATED_SECRET_RETIREMENT_EVIDENCE_SEGMENTS = [
+    '.ebk',
+    'evidence',
+    'generated-secret-retirement',
+];
+exports.GENERATED_SECRET_RETIREMENT_EVIDENCE_DIRECTORY = (0, node_path_1.join)(...GENERATED_SECRET_RETIREMENT_EVIDENCE_SEGMENTS);
+const SHA = /^[a-f0-9]{40,64}$/u;
+const MAXIMUM_EVIDENCE_BYTES = 32 * 1024;
+function partitionForRegion(region) {
+    if (region.startsWith('cn-'))
+        return 'aws-cn';
+    if (region.startsWith('us-gov-'))
+        return 'aws-us-gov';
+    return 'aws';
+}
+function profileCredentials(profile, environment) {
+    return (0, credential_providers_1.fromIni)({
+        ...(environment.AWS_CONFIG_FILE
+            ? { configFilepath: environment.AWS_CONFIG_FILE }
+            : {}),
+        ...(environment.AWS_SHARED_CREDENTIALS_FILE
+            ? { filepath: environment.AWS_SHARED_CREDENTIALS_FILE }
+            : {}),
+        profile,
+    });
+}
+async function readCurrentPrincipal(input) {
+    const client = new client_sts_1.STSClient({
+        ...(input.profile
+            ? { credentials: profileCredentials(input.profile, input.environment) }
+            : {}),
+        endpoint: (0, identity_js_1.canonicalStsEndpoint)(input.region),
+        region: input.region,
+    });
+    try {
+        const identity = await client.send(new client_sts_1.GetCallerIdentityCommand({}));
+        if (!identity.Account || !identity.Arn) {
+            throw new Error('identity unavailable');
+        }
+        return { accountId: identity.Account, arn: identity.Arn };
+    }
+    finally {
+        client.destroy();
+    }
+}
+function writeBoundedEvidence(path, evidence) {
+    const serialized = `${JSON.stringify(evidence, null, 2)}\n`;
+    (0, private_state_js_1.atomicWritePrivateFileWithMaximumBytes)(path, serialized, MAXIMUM_EVIDENCE_BYTES);
+}
+function prepareEvidenceDestination(cwd, path) {
+    const projectRoot = (0, node_path_1.resolve)(cwd);
+    const expectedPath = (0, node_path_1.join)(projectRoot, ...GENERATED_SECRET_RETIREMENT_EVIDENCE_SEGMENTS, (0, node_path_1.basename)(path));
+    if ((0, node_path_1.resolve)(path) !== expectedPath) {
+        throw new Error('Generated secret retirement evidence must remain inside the exact project evidence directory.');
+    }
+    const projectIdentity = (0, node_fs_1.lstatSync)(projectRoot);
+    if (projectIdentity.isSymbolicLink() || !projectIdentity.isDirectory()) {
+        throw new Error('Generated secret retirement requires one real project directory.');
+    }
+    let current = projectRoot;
+    for (const segment of GENERATED_SECRET_RETIREMENT_EVIDENCE_SEGMENTS) {
+        current = (0, node_path_1.join)(current, segment);
+        (0, private_state_js_1.ensurePrivateDirectory)(current);
+    }
+    if ((0, node_fs_1.existsSync)(path)) {
+        (0, private_state_js_1.assertPrivatePath)(path, 'file');
+    }
+}
+function sourceCommit(environment) {
+    const commit = (environment.EBK_SOURCE_COMMIT ??
+        environment.GITHUB_SHA ??
+        '').trim();
+    if (!SHA.test(commit)) {
+        throw new Error('Generated secret retirement requires one exact lifecycle source commit.');
+    }
+    return commit;
+}
+/**
+ * Complete the generated-secret portion of one successful native Slice remove.
+ * The invocation has already passed the normal stage/removal authorization;
+ * this function independently reattests its exact AWS identity and secret
+ * ownership before applying the stage-specific deletion policy.
+ */
+async function retireGeneratedSecretsAfterSliceRemove(options, context, invocation, dependencies = {}) {
+    const environment = dependencies.environment ?? process.env;
+    const exactSourceCommit = sourceCommit(environment);
+    const startedAt = (dependencies.now ?? (() => new Date()))().toISOString();
+    const policy = (dependencies.readOperatingPolicy ?? index_js_2.readRepositoryOperatingPolicy)(context.root);
+    const stage = invocation.environment.EBK_CONSUMER_STAGE;
+    if (!(0, index_js_2.isActiveDeploymentStage)(policy.deploymentProfile, stage)) {
+        throw new Error(`Generated secret retirement stage ${stage} is inactive for the ${policy.deploymentProfile} deployment profile.`);
+    }
+    const region = (0, index_js_2.configuredDeploymentRegion)(policy.deploymentRegion);
+    const accountId = (0, index_js_2.configuredDeploymentAccountForStage)(policy.deploymentProfile, policy.deploymentAccounts, stage);
+    const expectedRoleArn = (0, index_js_1.createStageAuthorityIdentity)({
+        accountId,
+        partition: partitionForRegion(region),
+        region,
+        stage,
+    }).deploymentRoleArn;
+    if (invocation.environment.AWS_EXPECTED_ACCOUNT_ID !== accountId ||
+        invocation.environment.AWS_REGION !== region ||
+        invocation.environment.EBK_EXPECTED_DEPLOYMENT_ROLE_ARN !==
+            expectedRoleArn ||
+        (options.expectedRoleArn !== undefined &&
+            options.expectedRoleArn !== expectedRoleArn)) {
+        throw new Error('Generated secret retirement requires the exact committed account, Region, stage, and deployment role.');
+    }
+    const profile = invocation.environment.AWS_PROFILE;
+    if (profile !== undefined && options.profile !== profile) {
+        throw new Error('Generated secret retirement requires the exact invocation-private AWS profile.');
+    }
+    let principal;
+    try {
+        principal = await (dependencies.readPrincipal ?? readCurrentPrincipal)({
+            environment,
+            ...(profile ? { profile } : {}),
+            region,
+        });
+    }
+    catch {
+        throw new Error('Generated secret retirement could not authenticate its AWS principal.');
+    }
+    if (principal.accountId !== accountId ||
+        !(0, identity_js_1.matchesExpectedAssumedRoleArn)(accountId, principal.arn, expectedRoleArn)) {
+        throw new Error('Generated secret retirement is not running in the committed account as the exact temporary stage deployment role.');
+    }
+    const loaded = await (dependencies.loadMetadata ?? secret_preflight_js_1.loadSliceSecretMetadata)({
+        context,
+        cwd: invocation.cwd,
+        stage,
+    });
+    const evidencePath = (0, node_path_1.join)(invocation.cwd, exports.GENERATED_SECRET_RETIREMENT_EVIDENCE_DIRECTORY, `${stage}.json`);
+    prepareEvidenceDestination(invocation.cwd, evidencePath);
+    const controlPlane = dependencies.controlPlane ??
+        (0, index_js_3.createAwsGeneratedSecretRetirementControlPlane)({
+            clientConfiguration: {
+                ...(profile
+                    ? { credentials: profileCredentials(profile, environment) }
+                    : {}),
+                endpoint: (0, identity_js_1.canonicalAwsRegionalEndpoint)('secretsmanager', region),
+                region,
+            },
+        });
+    const result = await (0, index_js_3.runGeneratedSecretRetirement)({
+        accountId,
+        controlPlane,
+        declarations: loaded.declarations,
+        partition: partitionForRegion(region),
+        region,
+        scope: loaded.scope,
+        ...(dependencies.waitBeforeRetry === undefined
+            ? {}
+            : { waitBeforeRetry: dependencies.waitBeforeRetry }),
+    });
+    const evidence = Object.freeze({
+        accountId,
+        actorArn: principal.arn,
+        completedAt: (dependencies.now ?? (() => new Date()))().toISOString(),
+        deletionMode: result.deletionMode,
+        kind: 'ebk-generated-secret-retirement',
+        project: loaded.scope.slice,
+        ...(result.recoveryWindowDays === undefined
+            ? {}
+            : { recoveryWindowDays: result.recoveryWindowDays }),
+        region,
+        result: 'succeeded',
+        schemaVersion: 1,
+        secrets: result.secrets,
+        sourceCommit: exactSourceCommit,
+        stage,
+        startedAt,
+        workspace: loaded.scope.workspace,
+    });
+    (dependencies.writeEvidence ?? writeBoundedEvidence)(evidencePath, evidence);
+    return evidence;
+}
+//# sourceMappingURL=generated-secret-retirement.js.map

package/src/executors/sst-lifecycle/generated-secret-retirement.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"generated-secret-retirement.js","sourceRoot":"","sources":["../../../../../../packages/nx/src/executors/sst-lifecycle/generated-secret-retirement.ts"],"names":[],"mappings":";;;AAyMA,wFA2HC;AApUD,oDAA0E;AAC1E,wEAAwD;AAExD,qCAAgD;AAChD,yCAAoD;AAEpD,2DAA4E;AAC5E,uDAI+B;AAC/B,+DAM0C;AAC1C,qDAKgC;AAChC,+DAG+B;AAC/B,uEAI0C;AAM1C,MAAM,6CAA6C,GAAG;IACpD,MAAM;IACN,UAAU;IACV,6BAA6B;CACrB,CAAC;AAEE,QAAA,8CAA8C,GAAG,IAAA,gBAAI,EAChE,GAAG,6CAA6C,CACjD,CAAC;AA+CF,MAAM,GAAG,GAAG,oBAAoB,CAAC;AACjC,MAAM,sBAAsB,GAAG,EAAE,GAAG,IAAI,CAAC;AAEzC,SAAS,kBAAkB,CAAC,MAAc;IACxC,IAAI,MAAM,CAAC,UAAU,CAAC,KAAK,CAAC;QAAE,OAAO,QAAQ,CAAC;IAC9C,IAAI,MAAM,CAAC,UAAU,CAAC,SAAS,CAAC;QAAE,OAAO,YAAY,CAAC;IACtD,OAAO,KAAK,CAAC;AACf,CAAC;AAED,SAAS,kBAAkB,CAAC,OAAe,EAAE,WAA8B;IACzE,OAAO,IAAA,8BAAO,EAAC;QACb,GAAG,CAAC,WAAW,CAAC,eAAe;YAC7B,CAAC,CAAC,EAAE,cAAc,EAAE,WAAW,CAAC,eAAe,EAAE;YACjD,CAAC,CAAC,EAAE,CAAC;QACP,GAAG,CAAC,WAAW,CAAC,2BAA2B;YACzC,CAAC,CAAC,EAAE,QAAQ,EAAE,WAAW,CAAC,2BAA2B,EAAE;YACvD,CAAC,CAAC,EAAE,CAAC;QACP,OAAO;KACR,CAAC,CAAC;AACL,CAAC;AAED,KAAK,UAAU,oBAAoB,CAAC,KAInC;IACC,MAAM,MAAM,GAAG,IAAI,sBAAS,CAAC;QAC3B,GAAG,CAAC,KAAK,CAAC,OAAO;YACf,CAAC,CAAC,EAAE,WAAW,EAAE,kBAAkB,CAAC,KAAK,CAAC,OAAO,EAAE,KAAK,CAAC,WAAW,CAAC,EAAE;YACvE,CAAC,CAAC,EAAE,CAAC;QACP,QAAQ,EAAE,IAAA,kCAAoB,EAAC,KAAK,CAAC,MAAM,CAAC;QAC5C,MAAM,EAAE,KAAK,CAAC,MAAM;KACrB,CAAC,CAAC;IACH,IAAI,CAAC;QACH,MAAM,QAAQ,GAAG,MAAM,MAAM,CAAC,IAAI,CAAC,IAAI,qCAAwB,CAAC,EAAE,CAAC,CAAC,CAAC;QACrE,IAAI,CAAC,QAAQ,CAAC,OAAO,IAAI,CAAC,QAAQ,CAAC,GAAG,EAAE,CAAC;YACvC,MAAM,IAAI,KAAK,CAAC,sBAAsB,CAAC,CAAC;QAC1C,CAAC;QACD,OAAO,EAAE,SAAS,EAAE,QAAQ,CAAC,OAAO,EAAE,GAAG,EAAE,QAAQ,CAAC,GAAG,EAAE,CAAC;IAC5D,CAAC;YAAS,CAAC;QACT,MAAM,CAAC,OAAO,EAAE,CAAC;IACnB,CAAC;AACH,CAAC;AAED,SAAS,oBAAoB,CAC3B,IAAY,EACZ,QAA2C;IAE3C,MAAM,UAAU,GAAG,GAAG,IAAI,CAAC,SAAS,CAAC,QAAQ,EAAE,IAAI,EAAE,CAAC,CAAC,IAAI,CAAC;IAC5D,IAAA,yDAAsC,EACpC,IAAI,EACJ,UAAU,EACV,sBAAsB,CACvB,CAAC;AACJ,CAAC;AAED,SAAS,0BAA0B,CAAC,GAAW,EAAE,IAAY;IAC3D,MAAM,WAAW,GAAG,IAAA,mBAAO,EAAC,GAAG,CAAC,CAAC;IACjC,MAAM,YAAY,GAAG,IAAA,gBAAI,EACvB,WAAW,EACX,GAAG,6CAA6C,EAChD,IAAA,oBAAQ,EAAC,IAAI,CAAC,CACf,CAAC;IACF,IAAI,IAAA,mBAAO,EAAC,IAAI,CAAC,KAAK,YAAY,EAAE,CAAC;QACnC,MAAM,IAAI,KAAK,CACb,+FAA+F,CAChG,CAAC;IACJ,CAAC;IAED,MAAM,eAAe,GAAG,IAAA,mBAAS,EAAC,WAAW,CAAC,CAAC;IAC/C,IAAI,eAAe,CAAC,cAAc,EAAE,IAAI,CAAC,eAAe,CAAC,WAAW,EAAE,EAAE,CAAC;QACvE,MAAM,IAAI,KAAK,CACb,kEAAkE,CACnE,CAAC;IACJ,CAAC;IAED,IAAI,OAAO,GAAG,WAAW,CAAC;IAC1B,KAAK,MAAM,OAAO,IAAI,6CAA6C,EAAE,CAAC;QACpE,OAAO,GAAG,IAAA,gBAAI,EAAC,OAAO,EAAE,OAAO,CAAC,CAAC;QACjC,IAAA,yCAAsB,EAAC,OAAO,CAAC,CAAC;IAClC,CAAC;IAED,IAAI,IAAA,oBAAU,EAAC,IAAI,CAAC,EAAE,CAAC;QACrB,IAAA,oCAAiB,EAAC,IAAI,EAAE,MAAM,CAAC,CAAC;IAClC,CAAC;AACH,CAAC;AAED,SAAS,YAAY,CAAC,WAA8B;IAClD,MAAM,MAAM,GAAG,CACb,WAAW,CAAC,iBAAiB;QAC7B,WAAW,CAAC,UAAU;QACtB,EAAE,CACH,CAAC,IAAI,EAAE,CAAC;IACT,IAAI,CAAC,GAAG,CAAC,IAAI,CAAC,MAAM,CAAC,EAAE,CAAC;QACtB,MAAM,IAAI,KAAK,CACb,yEAAyE,CAC1E,CAAC;IACJ,CAAC;IACD,OAAO,MAAM,CAAC;AAChB,CAAC;AAED;;;;;GAKG;AACI,KAAK,UAAU,sCAAsC,CAC1D,OAA4B,EAC5B,OAAwB,EACxB,UAAgC,EAChC,eAAsD,EAAE;IAExD,MAAM,WAAW,GAAG,YAAY,CAAC,WAAW,IAAI,OAAO,CAAC,GAAG,CAAC;IAC5D,MAAM,iBAAiB,GAAG,YAAY,CAAC,WAAW,CAAC,CAAC;IACpD,MAAM,SAAS,GAAG,CAAC,YAAY,CAAC,GAAG,IAAI,CAAC,GAAG,EAAE,CAAC,IAAI,IAAI,EAAE,CAAC,CAAC,EAAE,CAAC,WAAW,EAAE,CAAC;IAC3E,MAAM,MAAM,GAAG,CACb,YAAY,CAAC,mBAAmB,IAAI,wCAA6B,CAClE,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC;IAChB,MAAM,KAAK,GAAG,UAAU,CAAC,WAAW,CAAC,kBAAkB,CAAC;IACxD,IAAI,CAAC,IAAA,kCAAuB,EAAC,MAAM,CAAC,iBAAiB,EAAE,KAAK,CAAC,EAAE,CAAC;QAC9D,MAAM,IAAI,KAAK,CACb,qCAAqC,KAAK,wBAAwB,MAAM,CAAC,iBAAiB,sBAAsB,CACjH,CAAC;IACJ,CAAC;IACD,MAAM,MAAM,GAAG,IAAA,qCAA0B,EAAC,MAAM,CAAC,gBAAgB,CAAC,CAAC;IACnE,MAAM,SAAS,GAAG,IAAA,8CAAmC,EACnD,MAAM,CAAC,iBAAiB,EACxB,MAAM,CAAC,kBAAkB,EACzB,KAAK,CACN,CAAC;IACF,MAAM,eAAe,GAAG,IAAA,uCAA4B,EAAC;QACnD,SAAS;QACT,SAAS,EAAE,kBAAkB,CAAC,MAAM,CAAC;QACrC,MAAM;QACN,KAAK;KACN,CAAC,CAAC,iBAAiB,CAAC;IACrB,IACE,UAAU,CAAC,WAAW,CAAC,uBAAuB,KAAK,SAAS;QAC5D,UAAU,CAAC,WAAW,CAAC,UAAU,KAAK,MAAM;QAC5C,UAAU,CAAC,WAAW,CAAC,gCAAgC;YACrD,eAAe;QACjB,CAAC,OAAO,CAAC,eAAe,KAAK,SAAS;YACpC,OAAO,CAAC,eAAe,KAAK,eAAe,CAAC,EAC9C,CAAC;QACD,MAAM,IAAI,KAAK,CACb,uGAAuG,CACxG,CAAC;IACJ,CAAC;IACD,MAAM,OAAO,GAAG,UAAU,CAAC,WAAW,CAAC,WAAW,CAAC;IACnD,IAAI,OAAO,KAAK,SAAS,IAAI,OAAO,CAAC,OAAO,KAAK,OAAO,EAAE,CAAC;QACzD,MAAM,IAAI,KAAK,CACb,gFAAgF,CACjF,CAAC;IACJ,CAAC;IACD,IAAI,SAAuB,CAAC;IAC5B,IAAI,CAAC;QACH,SAAS,GAAG,MAAM,CAAC,YAAY,CAAC,aAAa,IAAI,oBAAoB,CAAC,CAAC;YACrE,WAAW;YACX,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,EAAE,OAAO,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;YAC/B,MAAM;SACP,CAAC,CAAC;IACL,CAAC;IAAC,MAAM,CAAC;QACP,MAAM,IAAI,KAAK,CACb,uEAAuE,CACxE,CAAC;IACJ,CAAC;IACD,IACE,SAAS,CAAC,SAAS,KAAK,SAAS;QACjC,CAAC,IAAA,2CAA6B,EAAC,SAAS,EAAE,SAAS,CAAC,GAAG,EAAE,eAAe,CAAC,EACzE,CAAC;QACD,MAAM,IAAI,KAAK,CACb,mHAAmH,CACpH,CAAC;IACJ,CAAC;IAED,MAAM,MAAM,GAAG,MAAM,CAAC,YAAY,CAAC,YAAY,IAAI,6CAAuB,CAAC,CAAC;QAC1E,OAAO;QACP,GAAG,EAAE,UAAU,CAAC,GAAG;QACnB,KAAK;KACN,CAAC,CAAC;IACH,MAAM,YAAY,GAAG,IAAA,gBAAI,EACvB,UAAU,CAAC,GAAG,EACd,sDAA8C,EAC9C,GAAG,KAAK,OAAO,CAChB,CAAC;IACF,0BAA0B,CAAC,UAAU,CAAC,GAAG,EAAE,YAAY,CAAC,CAAC;IACzD,MAAM,YAAY,GAChB,YAAY,CAAC,YAAY;QACzB,IAAA,yDAA8C,EAAC;YAC7C,mBAAmB,EAAE;gBACnB,GAAG,CAAC,OAAO;oBACT,CAAC,CAAC,EAAE,WAAW,EAAE,kBAAkB,CAAC,OAAO,EAAE,WAAW,CAAC,EAAE;oBAC3D,CAAC,CAAC,EAAE,CAAC;gBACP,QAAQ,EAAE,IAAA,0CAA4B,EAAC,gBAAgB,EAAE,MAAM,CAAC;gBAChE,MAAM;aACP;SACF,CAAC,CAAC;IACL,MAAM,MAAM,GAAG,MAAM,IAAA,uCAA4B,EAAC;QAChD,SAAS;QACT,YAAY;QACZ,YAAY,EAAE,MAAM,CAAC,YAAY;QACjC,SAAS,EAAE,kBAAkB,CAAC,MAAM,CAAC;QACrC,MAAM;QACN,KAAK,EAAE,MAAM,CAAC,KAAK;QACnB,GAAG,CAAC,YAAY,CAAC,eAAe,KAAK,SAAS;YAC5C,CAAC,CAAC,EAAE;YACJ,CAAC,CAAC,EAAE,eAAe,EAAE,YAAY,CAAC,eAAe,EAAE,CAAC;KACvD,CAAC,CAAC;IACH,MAAM,QAAQ,GAAG,MAAM,CAAC,MAAM,CAAC;QAC7B,SAAS;QACT,QAAQ,EAAE,SAAS,CAAC,GAAG;QACvB,WAAW,EAAE,CAAC,YAAY,CAAC,GAAG,IAAI,CAAC,GAAG,EAAE,CAAC,IAAI,IAAI,EAAE,CAAC,CAAC,EAAE,CAAC,WAAW,EAAE;QACrE,YAAY,EAAE,MAAM,CAAC,YAAY;QACjC,IAAI,EAAE,iCAA0C;QAChD,OAAO,EAAE,MAAM,CAAC,KAAK,CAAC,KAAK;QAC3B,GAAG,CAAC,MAAM,CAAC,kBAAkB,KAAK,SAAS;YACzC,CAAC,CAAC,EAAE;YACJ,CAAC,CAAC,EAAE,kBAAkB,EAAE,MAAM,CAAC,kBAAkB,EAAE,CAAC;QACtD,MAAM;QACN,MAAM,EAAE,WAAoB;QAC5B,aAAa,EAAE,CAAU;QACzB,OAAO,EAAE,MAAM,CAAC,OAAO;QACvB,YAAY,EAAE,iBAAiB;QAC/B,KAAK;QACL,SAAS;QACT,SAAS,EAAE,MAAM,CAAC,KAAK,CAAC,SAAS;KAClC,CAAC,CAAC;IACH,CAAC,YAAY,CAAC,aAAa,IAAI,oBAAoB,CAAC,CAAC,YAAY,EAAE,QAAQ,CAAC,CAAC;IAC7E,OAAO,QAAQ,CAAC;AAClB,CAAC"}

package/src/executors/sst-lifecycle/governed-native-operation.d.ts

@@ -0,0 +1,46 @@
+import type { ReadStream, WriteStream } from 'node:tty';
+import { type ExecutorContext } from '@nx/devkit';
+import { createLocalFederatedCredentialTransport } from '../local-deploy/federated-credential-transport.js';
+import { type SstLifecycleCommand, type SstLifecycleOptions } from './run-sst-command.js';
+export type GovernedNativeOperation = 'refresh' | 'remove' | 'unlock';
+export interface GovernedNativeOperationApprovalRequest {
+    action: GovernedNativeOperation;
+    challenge: string;
+    sourceCommit: string;
+    stage: 'production' | 'staging';
+}
+export type GovernedNativeOperationApprover = (request: GovernedNativeOperationApprovalRequest) => Promise<boolean>;
+interface ApprovalTerminal {
+    input: ReadStream;
+    output: WriteStream;
+}
+interface SourceIdentity {
+    clean: boolean;
+    commit: string;
+    workingTreeDigest: string;
+}
+type NativeRunner = (command: SstLifecycleCommand, options: SstLifecycleOptions, context: ExecutorContext, dependencies?: {
+    environment?: NodeJS.ProcessEnv;
+}) => Promise<{
+    success: boolean;
+}>;
+export interface GovernedNativeOperationDependencies {
+    approve?: GovernedNativeOperationApprover;
+    createTransport?: typeof createLocalFederatedCredentialTransport;
+    environment?: NodeJS.ProcessEnv;
+    platform?: NodeJS.Platform;
+    readSource?: (root: string) => SourceIdentity;
+    run?: NativeRunner;
+}
+/** Active operator acknowledgement, not an independent-review claim. */
+export declare function createTtyGovernedNativeOperationApprover(terminal?: ApprovalTerminal): GovernedNativeOperationApprover;
+/**
+ * Govern refresh, remove, and unlock without replacing SST's native lifecycle.
+ * Local execution flattens the operator's federated profile into one private,
+ * invocation-scoped profile; protected stages additionally require a TTY
+ * acknowledgement. GitHub OIDC proceeds through the existing native path.
+ */
+export declare function runGovernedNativeOperation(command: GovernedNativeOperation, options: SstLifecycleOptions, context: ExecutorContext, dependencies?: GovernedNativeOperationDependencies): Promise<{
+    success: boolean;
+}>;
+export {};