@empire-builder-kit/nx 1.0.0-rc.4 → 1.0.0-rc.41

package/src/executors/secret-metadata/secret-metadata.js

@@ -2,30 +2,47 @@
 Object.defineProperty(exports, "__esModule", { value: true });
 exports.assertSecretMetadataApplyAuthority = assertSecretMetadataApplyAuthority;
 exports.assertProtectedSecretMetadataPrincipal = assertProtectedSecretMetadataPrincipal;
+exports.assertLocalSecretMetadataPrincipal = assertLocalSecretMetadataPrincipal;
 exports.executeSecretMetadata = executeSecretMetadata;
 const devkit_1 = require("@nx/devkit");
 const client_sts_1 = require("@aws-sdk/client-sts");
 const credential_providers_1 = require("@aws-sdk/credential-providers");
 const node_path_1 = require("node:path");
 const index_js_1 = require("../../secrets/index.js");
+const index_js_2 = require("../../aws-authority/index.js");
 const secret_preflight_js_1 = require("../sst-lifecycle/secret-preflight.js");
-const protectedStages = new Set(['staging', 'production']);
-function assertSecretMetadataApplyAuthority(stage, apply, environment = process.env) {
-    if (!apply || !protectedStages.has(stage))
-        return;
+const index_js_3 = require("../../repository-policy/index.js");
+const identity_js_1 = require("../../aws/identity.js");
+const index_js_4 = require("../../workspace-deployment/index.js");
+const ROLE = /^arn:(aws|aws-us-gov|aws-cn):iam::\d{12}:role\/[A-Za-z0-9+=,.@_/-]{1,512}$/;
+function assertSecretMetadataApplyAuthority(stage, apply, environment = process.env, deploymentProfile = 'fully-isolated') {
+    if (!apply)
+        return 'none';
     const repository = environment.GITHUB_REPOSITORY;
-    const branch = stage === 'staging' ? 'develop' : 'main';
+    const branch = stage === 'production' ? 'main' : 'develop';
     const ref = `refs/heads/${branch}`;
     const expectedWorkflow = repository
         ? `${repository}/.github/workflows/secret-metadata.yml@${ref}`
         : undefined;
-    if (environment.GITHUB_ACTIONS !== 'true' ||
-        environment.GITHUB_EVENT_NAME !== 'workflow_dispatch' ||
-        environment.GITHUB_REF !== ref ||
-        !repository ||
-        environment.GITHUB_WORKFLOW_REF !== expectedWorkflow) {
+    const exactWorkflow = environment.GITHUB_ACTIONS === 'true' &&
+        environment.GITHUB_EVENT_NAME === 'workflow_dispatch' &&
+        environment.GITHUB_REF === ref &&
+        Boolean(repository) &&
+        environment.GITHUB_WORKFLOW_REF === expectedWorkflow;
+    if (exactWorkflow)
+        return 'workflow';
+    if ((0, index_js_3.requiresGithubDeployment)(deploymentProfile, stage) ||
+        environment.GITHUB_ACTIONS === 'true') {
         throw new Error(`Protected ${stage} secret metadata apply must run from the ${branch}-branch Secret metadata workflow.`);
     }
+    return 'local';
+}
+function partitionForRegion(region) {
+    if (region.startsWith('cn-'))
+        return 'aws-cn';
+    if (region.startsWith('us-gov-'))
+        return 'aws-us-gov';
+    return 'aws';
 }
 async function readCurrentPrincipal(input) {
     const client = new client_sts_1.STSClient({
@@ -34,6 +51,7 @@ async function readCurrentPrincipal(input) {
                 credentials: (0, credential_providers_1.fromIni)({ profile: input.profile }),
             }
             : {}),
+        endpoint: (0, identity_js_1.canonicalStsEndpoint)(input.region),
         region: input.region,
     });
     const identity = await client.send(new client_sts_1.GetCallerIdentityCommand({}));
@@ -43,36 +61,56 @@ async function readCurrentPrincipal(input) {
     return { accountId: identity.Account, arn: identity.Arn };
 }
 async function assertProtectedSecretMetadataPrincipal(input) {
-    if (!input.apply || !protectedStages.has(input.stage))
+    if (!input.apply)
         return;
     const expectedAccount = input.environment.AWS_EXPECTED_ACCOUNT_ID;
-    const expectedRoleArn = input.environment.AWS_DEPLOY_ROLE_ARN;
+    const configuredRoleArn = input.environment.AWS_DEPLOY_ROLE_ARN;
     const runId = input.environment.GITHUB_RUN_ID;
     const runAttempt = input.environment.GITHUB_RUN_ATTEMPT;
-    const role = /^(arn:(aws|aws-us-gov|aws-cn):iam::(\d{12}):role\/([A-Za-z0-9+=,.@_-]{1,64}))$/.exec(expectedRoleArn ?? '');
-    if (!role ||
-        role[1] !== expectedRoleArn ||
-        role[3] !== expectedAccount ||
+    if (!ROLE.test(input.expectedRoleArn) ||
+        expectedAccount !== input.accountId ||
+        configuredRoleArn !== input.expectedRoleArn ||
         !/^\d+$/.test(runId ?? '') ||
         !/^\d+$/.test(runAttempt ?? '')) {
-        throw new Error('Protected secret metadata apply requires one exact pathless deployment role and workflow run identity.');
+        throw new Error('Protected secret metadata apply requires the exact committed stage deployment role and workflow run identity.');
     }
     let principal;
     try {
         principal = await (input.readPrincipal ?? readCurrentPrincipal)({
-            ...(input.profile ? { profile: input.profile } : {}),
             region: input.region,
         });
     }
     catch {
         throw new Error('Protected secret metadata apply could not authenticate its AWS principal.');
     }
-    const expectedPrincipalArn = `arn:${role[2]}:sts::${expectedAccount}:assumed-role/${role[4]}/ebk-secret-metadata-${runId}-${runAttempt}`;
-    if (principal.accountId !== expectedAccount ||
-        principal.arn !== expectedPrincipalArn) {
+    const expectedSession = `ebk-secret-metadata-${runId}-${runAttempt}`;
+    if (principal.accountId !== input.accountId ||
+        !(0, identity_js_1.matchesExpectedAssumedRoleArn)(input.accountId, principal.arn, input.expectedRoleArn) ||
+        !principal.arn.endsWith(`/${expectedSession}`)) {
         throw new Error('Protected secret metadata apply is not running as the exact reviewed deployment-role session.');
     }
 }
+async function assertLocalSecretMetadataPrincipal(input) {
+    const expectedRoleArn = input.expectedRoleArn?.trim() ?? '';
+    const profile = input.profile?.trim() ?? '';
+    if (!ROLE.test(expectedRoleArn) || profile === '') {
+        throw new Error('Local protected secret metadata apply requires --profile and one exact --expectedRoleArn.');
+    }
+    let principal;
+    try {
+        principal = await (input.readPrincipal ?? readCurrentPrincipal)({
+            profile,
+            region: input.region,
+        });
+    }
+    catch {
+        throw new Error('Local protected secret metadata apply could not authenticate its AWS principal.');
+    }
+    if (principal.accountId !== input.accountId ||
+        !(0, identity_js_1.matchesExpectedAssumedRoleArn)(input.accountId, principal.arn, expectedRoleArn)) {
+        throw new Error('Local protected secret metadata apply is not running in the committed account as the exact temporary assumed role.');
+    }
+}
 function resolveSliceRoot(context) {
     if (!context.projectName) {
         throw new Error('Secret metadata operations require the exact Nx Product Slice name.');
@@ -88,16 +126,77 @@ function resolveSliceRoot(context) {
 async function executeSecretMetadata(options, context, dependencies = {}) {
     const environment = dependencies.environment ?? process.env;
     const apply = options.apply === true;
-    assertSecretMetadataApplyAuthority(options.stage, apply, environment);
+    const operatingPolicy = apply
+        ? (dependencies.readOperatingPolicy ?? index_js_3.readRepositoryOperatingPolicy)(context.root)
+        : undefined;
+    const authority = assertSecretMetadataApplyAuthority(options.stage, apply, environment, operatingPolicy?.deploymentProfile);
     const aws = (0, secret_preflight_js_1.resolveSecretAwsContext)(options, environment);
-    await assertProtectedSecretMetadataPrincipal({
-        apply,
-        environment,
-        ...(aws.profile ? { profile: aws.profile } : {}),
-        readPrincipal: dependencies.readPrincipal,
-        region: aws.region,
-        stage: options.stage,
-    });
+    let accountId;
+    let expectedRoleArn;
+    if (apply) {
+        if (!operatingPolicy) {
+            throw new Error('Secret metadata operating policy is unavailable.');
+        }
+        if (!(0, index_js_3.isActiveDeploymentStage)(operatingPolicy.deploymentProfile, options.stage)) {
+            throw new Error(`Secret metadata stage ${options.stage} is inactive for the ${operatingPolicy.deploymentProfile} deployment profile.`);
+        }
+        const region = (0, index_js_3.configuredDeploymentRegion)(operatingPolicy.deploymentRegion);
+        if (aws.region !== region) {
+            throw new Error(`Secret metadata apply requires committed deployment Region ${region}.`);
+        }
+        accountId = (0, index_js_3.configuredDeploymentAccountForStage)(operatingPolicy.deploymentProfile, operatingPolicy.deploymentAccounts, options.stage);
+        expectedRoleArn = (0, index_js_2.createStageAuthorityIdentity)({
+            accountId,
+            partition: partitionForRegion(region),
+            region,
+            stage: options.stage,
+        }).deploymentRoleArn;
+    }
+    if (authority === 'workflow') {
+        if (accountId === undefined ||
+            expectedRoleArn === undefined ||
+            options.profile !== undefined ||
+            options.expectedRoleArn !== undefined) {
+            throw new Error('Protected secret metadata apply uses only its exact OIDC workflow authority.');
+        }
+        await assertProtectedSecretMetadataPrincipal({
+            accountId,
+            apply,
+            environment,
+            expectedRoleArn,
+            readPrincipal: dependencies.readPrincipal,
+            region: aws.region,
+            stage: options.stage,
+        });
+    }
+    else if (authority === 'local') {
+        if (accountId === undefined || expectedRoleArn === undefined) {
+            throw new Error('Local secret metadata operating policy is unavailable.');
+        }
+        if (options.expectedRoleArn !== expectedRoleArn) {
+            throw new Error(`Local secret metadata apply requires the exact committed ${options.stage} stage authority role ${expectedRoleArn}.`);
+        }
+        await assertLocalSecretMetadataPrincipal({
+            accountId,
+            expectedRoleArn,
+            ...(aws.profile ? { profile: aws.profile } : {}),
+            readPrincipal: dependencies.readPrincipal,
+            region: aws.region,
+        });
+    }
+    if (apply) {
+        await (dependencies.ownership ?? index_js_4.assertWorkspaceStageOwnershipForWorkspace)(context.root, options.stage, {
+            ...(environment.AWS_CONFIG_FILE
+                ? { configFilepath: environment.AWS_CONFIG_FILE }
+                : {}),
+            ...(environment.AWS_SHARED_CREDENTIALS_FILE
+                ? {
+                    credentialsFilepath: environment.AWS_SHARED_CREDENTIALS_FILE,
+                }
+                : {}),
+            ...(aws.profile ? { profile: aws.profile } : {}),
+        });
+    }
     const loaded = await (0, secret_preflight_js_1.loadSliceSecretMetadata)({
         context,
         cwd: resolveSliceRoot(context),

package/src/executors/sst-lifecycle/generated-secret-retirement.d.ts

@@ -0,0 +1,53 @@
+import type { ExecutorContext } from '@nx/devkit';
+import { type RepositoryOperatingPolicy } from '../../repository-policy/index.js';
+import { type GeneratedSecretRetirementControlPlane, type GeneratedSecretRetirementResult } from '../../secrets/index.js';
+import { type LoadedSliceSecretMetadata } from './secret-preflight.js';
+import type { SstCommandInvocation, SstLifecycleOptions } from './run-sst-command.js';
+export declare const GENERATED_SECRET_RETIREMENT_EVIDENCE_DIRECTORY: string;
+interface AwsPrincipal {
+    accountId: string;
+    arn: string;
+}
+export interface GeneratedSecretRetirementEvidence {
+    accountId: string;
+    actorArn: string;
+    completedAt: string;
+    deletionMode: GeneratedSecretRetirementResult['deletionMode'];
+    kind: 'ebk-generated-secret-retirement';
+    project: string;
+    recoveryWindowDays?: 7;
+    region: string;
+    result: 'succeeded';
+    schemaVersion: 1;
+    secrets: GeneratedSecretRetirementResult['secrets'];
+    sourceCommit: string;
+    stage: string;
+    startedAt: string;
+    workspace: string;
+}
+export interface GeneratedSecretRetirementDependencies {
+    controlPlane?: GeneratedSecretRetirementControlPlane;
+    environment?: NodeJS.ProcessEnv;
+    loadMetadata?: (input: {
+        context: ExecutorContext;
+        cwd: string;
+        stage: string;
+    }) => Promise<LoadedSliceSecretMetadata>;
+    now?: () => Date;
+    readOperatingPolicy?: (workspaceRoot: string) => RepositoryOperatingPolicy;
+    readPrincipal?: (input: {
+        environment: NodeJS.ProcessEnv;
+        profile?: string;
+        region: string;
+    }) => Promise<AwsPrincipal>;
+    writeEvidence?: (path: string, evidence: GeneratedSecretRetirementEvidence) => void;
+    waitBeforeRetry?: (delayMs: number) => Promise<void>;
+}
+/**
+ * Complete the generated-secret portion of one successful native Slice remove.
+ * The invocation has already passed the normal stage/removal authorization;
+ * this function independently reattests its exact AWS identity and secret
+ * ownership before applying the stage-specific deletion policy.
+ */
+export declare function retireGeneratedSecretsAfterSliceRemove(options: SstLifecycleOptions, context: ExecutorContext, invocation: SstCommandInvocation, dependencies?: GeneratedSecretRetirementDependencies): Promise<GeneratedSecretRetirementEvidence>;
+export {};

package/src/executors/sst-lifecycle/generated-secret-retirement.js

@@ -0,0 +1,192 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.GENERATED_SECRET_RETIREMENT_EVIDENCE_DIRECTORY = void 0;
+exports.retireGeneratedSecretsAfterSliceRemove = retireGeneratedSecretsAfterSliceRemove;
+const client_sts_1 = require("@aws-sdk/client-sts");
+const credential_providers_1 = require("@aws-sdk/credential-providers");
+const node_fs_1 = require("node:fs");
+const node_path_1 = require("node:path");
+const index_js_1 = require("../../aws-authority/index.js");
+const identity_js_1 = require("../../aws/identity.js");
+const index_js_2 = require("../../repository-policy/index.js");
+const index_js_3 = require("../../secrets/index.js");
+const secret_preflight_js_1 = require("./secret-preflight.js");
+const private_state_js_1 = require("../../local-dev/private-state.js");
+const GENERATED_SECRET_RETIREMENT_EVIDENCE_SEGMENTS = [
+    '.ebk',
+    'evidence',
+    'generated-secret-retirement',
+];
+exports.GENERATED_SECRET_RETIREMENT_EVIDENCE_DIRECTORY = (0, node_path_1.join)(...GENERATED_SECRET_RETIREMENT_EVIDENCE_SEGMENTS);
+const SHA = /^[a-f0-9]{40,64}$/u;
+const MAXIMUM_EVIDENCE_BYTES = 32 * 1024;
+function partitionForRegion(region) {
+    if (region.startsWith('cn-'))
+        return 'aws-cn';
+    if (region.startsWith('us-gov-'))
+        return 'aws-us-gov';
+    return 'aws';
+}
+function profileCredentials(profile, environment) {
+    return (0, credential_providers_1.fromIni)({
+        ...(environment.AWS_CONFIG_FILE
+            ? { configFilepath: environment.AWS_CONFIG_FILE }
+            : {}),
+        ...(environment.AWS_SHARED_CREDENTIALS_FILE
+            ? { filepath: environment.AWS_SHARED_CREDENTIALS_FILE }
+            : {}),
+        profile,
+    });
+}
+async function readCurrentPrincipal(input) {
+    const client = new client_sts_1.STSClient({
+        ...(input.profile
+            ? { credentials: profileCredentials(input.profile, input.environment) }
+            : {}),
+        endpoint: (0, identity_js_1.canonicalStsEndpoint)(input.region),
+        region: input.region,
+    });
+    try {
+        const identity = await client.send(new client_sts_1.GetCallerIdentityCommand({}));
+        if (!identity.Account || !identity.Arn) {
+            throw new Error('identity unavailable');
+        }
+        return { accountId: identity.Account, arn: identity.Arn };
+    }
+    finally {
+        client.destroy();
+    }
+}
+function writeBoundedEvidence(path, evidence) {
+    const serialized = `${JSON.stringify(evidence, null, 2)}\n`;
+    (0, private_state_js_1.atomicWritePrivateFileWithMaximumBytes)(path, serialized, MAXIMUM_EVIDENCE_BYTES);
+}
+function prepareEvidenceDestination(cwd, path) {
+    const projectRoot = (0, node_path_1.resolve)(cwd);
+    const expectedPath = (0, node_path_1.join)(projectRoot, ...GENERATED_SECRET_RETIREMENT_EVIDENCE_SEGMENTS, (0, node_path_1.basename)(path));
+    if ((0, node_path_1.resolve)(path) !== expectedPath) {
+        throw new Error('Generated secret retirement evidence must remain inside the exact project evidence directory.');
+    }
+    const projectIdentity = (0, node_fs_1.lstatSync)(projectRoot);
+    if (projectIdentity.isSymbolicLink() || !projectIdentity.isDirectory()) {
+        throw new Error('Generated secret retirement requires one real project directory.');
+    }
+    let current = projectRoot;
+    for (const segment of GENERATED_SECRET_RETIREMENT_EVIDENCE_SEGMENTS) {
+        current = (0, node_path_1.join)(current, segment);
+        (0, private_state_js_1.ensurePrivateDirectory)(current);
+    }
+    if ((0, node_fs_1.existsSync)(path)) {
+        (0, private_state_js_1.assertPrivatePath)(path, 'file');
+    }
+}
+function sourceCommit(environment) {
+    const commit = (environment.EBK_SOURCE_COMMIT ??
+        environment.GITHUB_SHA ??
+        '').trim();
+    if (!SHA.test(commit)) {
+        throw new Error('Generated secret retirement requires one exact lifecycle source commit.');
+    }
+    return commit;
+}
+/**
+ * Complete the generated-secret portion of one successful native Slice remove.
+ * The invocation has already passed the normal stage/removal authorization;
+ * this function independently reattests its exact AWS identity and secret
+ * ownership before applying the stage-specific deletion policy.
+ */
+async function retireGeneratedSecretsAfterSliceRemove(options, context, invocation, dependencies = {}) {
+    const environment = dependencies.environment ?? process.env;
+    const exactSourceCommit = sourceCommit(environment);
+    const startedAt = (dependencies.now ?? (() => new Date()))().toISOString();
+    const policy = (dependencies.readOperatingPolicy ?? index_js_2.readRepositoryOperatingPolicy)(context.root);
+    const stage = invocation.environment.EBK_CONSUMER_STAGE;
+    if (!(0, index_js_2.isActiveDeploymentStage)(policy.deploymentProfile, stage)) {
+        throw new Error(`Generated secret retirement stage ${stage} is inactive for the ${policy.deploymentProfile} deployment profile.`);
+    }
+    const region = (0, index_js_2.configuredDeploymentRegion)(policy.deploymentRegion);
+    const accountId = (0, index_js_2.configuredDeploymentAccountForStage)(policy.deploymentProfile, policy.deploymentAccounts, stage);
+    const expectedRoleArn = (0, index_js_1.createStageAuthorityIdentity)({
+        accountId,
+        partition: partitionForRegion(region),
+        region,
+        stage,
+    }).deploymentRoleArn;
+    if (invocation.environment.AWS_EXPECTED_ACCOUNT_ID !== accountId ||
+        invocation.environment.AWS_REGION !== region ||
+        invocation.environment.EBK_EXPECTED_DEPLOYMENT_ROLE_ARN !==
+            expectedRoleArn ||
+        (options.expectedRoleArn !== undefined &&
+            options.expectedRoleArn !== expectedRoleArn)) {
+        throw new Error('Generated secret retirement requires the exact committed account, Region, stage, and deployment role.');
+    }
+    const profile = invocation.environment.AWS_PROFILE;
+    if (profile !== undefined && options.profile !== profile) {
+        throw new Error('Generated secret retirement requires the exact invocation-private AWS profile.');
+    }
+    let principal;
+    try {
+        principal = await (dependencies.readPrincipal ?? readCurrentPrincipal)({
+            environment,
+            ...(profile ? { profile } : {}),
+            region,
+        });
+    }
+    catch {
+        throw new Error('Generated secret retirement could not authenticate its AWS principal.');
+    }
+    if (principal.accountId !== accountId ||
+        !(0, identity_js_1.matchesExpectedAssumedRoleArn)(accountId, principal.arn, expectedRoleArn)) {
+        throw new Error('Generated secret retirement is not running in the committed account as the exact temporary stage deployment role.');
+    }
+    const loaded = await (dependencies.loadMetadata ?? secret_preflight_js_1.loadSliceSecretMetadata)({
+        context,
+        cwd: invocation.cwd,
+        stage,
+    });
+    const evidencePath = (0, node_path_1.join)(invocation.cwd, exports.GENERATED_SECRET_RETIREMENT_EVIDENCE_DIRECTORY, `${stage}.json`);
+    prepareEvidenceDestination(invocation.cwd, evidencePath);
+    const controlPlane = dependencies.controlPlane ??
+        (0, index_js_3.createAwsGeneratedSecretRetirementControlPlane)({
+            clientConfiguration: {
+                ...(profile
+                    ? { credentials: profileCredentials(profile, environment) }
+                    : {}),
+                endpoint: (0, identity_js_1.canonicalAwsRegionalEndpoint)('secretsmanager', region),
+                region,
+            },
+        });
+    const result = await (0, index_js_3.runGeneratedSecretRetirement)({
+        accountId,
+        controlPlane,
+        declarations: loaded.declarations,
+        partition: partitionForRegion(region),
+        region,
+        scope: loaded.scope,
+        ...(dependencies.waitBeforeRetry === undefined
+            ? {}
+            : { waitBeforeRetry: dependencies.waitBeforeRetry }),
+    });
+    const evidence = Object.freeze({
+        accountId,
+        actorArn: principal.arn,
+        completedAt: (dependencies.now ?? (() => new Date()))().toISOString(),
+        deletionMode: result.deletionMode,
+        kind: 'ebk-generated-secret-retirement',
+        project: loaded.scope.slice,
+        ...(result.recoveryWindowDays === undefined
+            ? {}
+            : { recoveryWindowDays: result.recoveryWindowDays }),
+        region,
+        result: 'succeeded',
+        schemaVersion: 1,
+        secrets: result.secrets,
+        sourceCommit: exactSourceCommit,
+        stage,
+        startedAt,
+        workspace: loaded.scope.workspace,
+    });
+    (dependencies.writeEvidence ?? writeBoundedEvidence)(evidencePath, evidence);
+    return evidence;
+}
+//# sourceMappingURL=generated-secret-retirement.js.map

package/src/executors/sst-lifecycle/governed-native-operation.d.ts

@@ -0,0 +1,48 @@
+import type { ReadStream, WriteStream } from 'node:tty';
+import { type ExecutorContext } from '@nx/devkit';
+import { createLocalFederatedCredentialTransport } from '../local-deploy/federated-credential-transport.js';
+import { type TaskUnlockDependencies } from './task-unlock.js';
+import { type SstLifecycleCommand, type SstLifecycleOptions } from './run-sst-command.js';
+export type GovernedNativeOperation = 'refresh' | 'remove' | 'unlock';
+export interface GovernedNativeOperationApprovalRequest {
+    action: GovernedNativeOperation;
+    challenge: string;
+    sourceCommit: string;
+    stage: 'production' | 'staging';
+}
+export type GovernedNativeOperationApprover = (request: GovernedNativeOperationApprovalRequest) => Promise<boolean>;
+interface ApprovalTerminal {
+    input: ReadStream;
+    output: WriteStream;
+}
+interface SourceIdentity {
+    clean: boolean;
+    commit: string;
+    workingTreeDigest: string;
+}
+type NativeRunner = (command: SstLifecycleCommand, options: SstLifecycleOptions, context: ExecutorContext, dependencies?: {
+    environment?: NodeJS.ProcessEnv;
+}) => Promise<{
+    success: boolean;
+}>;
+export interface GovernedNativeOperationDependencies {
+    taskUnlock?: Pick<TaskUnlockDependencies, 'authority' | 'writers'>;
+    approve?: GovernedNativeOperationApprover;
+    createTransport?: typeof createLocalFederatedCredentialTransport;
+    environment?: NodeJS.ProcessEnv;
+    platform?: NodeJS.Platform;
+    readSource?: (root: string) => SourceIdentity;
+    run?: NativeRunner;
+}
+/** Active operator acknowledgement, not an independent-review claim. */
+export declare function createTtyGovernedNativeOperationApprover(terminal?: ApprovalTerminal): GovernedNativeOperationApprover;
+/**
+ * Govern refresh, remove, and unlock without replacing SST's native lifecycle.
+ * Local execution flattens the operator's federated profile into one private,
+ * invocation-scoped profile; protected stages additionally require a TTY
+ * acknowledgement. GitHub OIDC proceeds through the existing native path.
+ */
+export declare function runGovernedNativeOperation(command: GovernedNativeOperation, options: SstLifecycleOptions, context: ExecutorContext, dependencies?: GovernedNativeOperationDependencies): Promise<{
+    success: boolean;
+}>;
+export {};