@empire-builder-kit/nx 1.0.0-rc.44 → 1.0.0-rc.45

package/src/secrets/generated-aws-control-plane.js

@@ -1,16 +1,62 @@
 "use strict";
 Object.defineProperty(exports, "__esModule", { value: true });
 exports.AwsGeneratedSecretInitializationError = void 0;
+exports.safeGeneratedSecretObservationDiagnostic = safeGeneratedSecretObservationDiagnostic;
 exports.createAwsGeneratedSecretInitializationControlPlane = createAwsGeneratedSecretInitializationControlPlane;
 const node_crypto_1 = require("node:crypto");
 const client_secrets_manager_1 = require("@aws-sdk/client-secrets-manager");
 const model_js_1 = require("./model.js");
+const observationPhases = ['inspect', 'pre-create', 'post-create'];
+const observationPredicates = [
+    'response-record',
+    'arn-type',
+    'arn-name',
+    'name',
+    'description',
+    'deleted-date',
+    'rotation-enabled',
+    'tags-shape',
+    'tags-count',
+    'tag-entry',
+    'tag-duplicate',
+    'tag-value',
+    'version-state',
+    'not-found',
+];
+/** Copy only static labels; never invoke getters or retain provider detail. */
+function safeGeneratedSecretObservationDiagnostic(value) {
+    try {
+        if (!isRecord(value))
+            return undefined;
+        const descriptors = Object.getOwnPropertyDescriptors(value);
+        if (Reflect.ownKeys(descriptors).length !== 2 ||
+            !Object.prototype.hasOwnProperty.call(descriptors.phase ?? {}, 'value') ||
+            !Object.prototype.hasOwnProperty.call(descriptors.predicate ?? {}, 'value')) {
+            return undefined;
+        }
+        const phase = descriptors.phase?.value;
+        const predicate = descriptors.predicate?.value;
+        if (!observationPhases.some((entry) => entry === phase) ||
+            !observationPredicates.some((entry) => entry === predicate)) {
+            return undefined;
+        }
+        return Object.freeze({
+            phase: phase,
+            predicate: predicate,
+        });
+    }
+    catch {
+        return undefined;
+    }
+}
 class AwsGeneratedSecretInitializationError extends Error {
     code;
-    constructor(code) {
+    observationDiagnostic;
+    constructor(code, observationDiagnostic) {
         super(`Generated secret initialization failed (${code}).`);
         this.name = 'AwsGeneratedSecretInitializationError';
         this.code = code;
+        this.observationDiagnostic = safeGeneratedSecretObservationDiagnostic(observationDiagnostic);
     }
 }
 exports.AwsGeneratedSecretInitializationError = AwsGeneratedSecretInitializationError;
@@ -71,21 +117,26 @@ function tagsToAws(tags) {
         .sort()
         .map((Key) => ({ Key, Value: tags[Key] }));
 }
-function exactTags(value, expected) {
-    if (!Array.isArray(value) || value.length !== Object.keys(expected).length) {
-        return false;
-    }
+function tagsDiagnostic(value, expected) {
+    if (!Array.isArray(value))
+        return 'tags-shape';
+    if (value.length !== Object.keys(expected).length)
+        return 'tags-count';
     const observed = {};
     for (const entry of value) {
         if (!isRecord(entry) ||
             typeof entry['Key'] !== 'string' ||
-            typeof entry['Value'] !== 'string' ||
-            Object.prototype.hasOwnProperty.call(observed, entry['Key'])) {
-            return false;
+            typeof entry['Value'] !== 'string') {
+            return 'tag-entry';
+        }
+        if (Object.prototype.hasOwnProperty.call(observed, entry['Key'])) {
+            return 'tag-duplicate';
         }
         observed[entry['Key']] = entry['Value'];
     }
-    return Object.entries(expected).every(([key, expectedValue]) => observed[key] === expectedValue);
+    return Object.entries(expected).every(([key, expectedValue]) => observed[key] === expectedValue)
+        ? undefined
+        : 'tag-value';
 }
 function arnMatchesName(arn, name) {
     if (!(0, model_js_1.isExactSecretArn)(arn))
@@ -108,20 +159,32 @@ function inspectVersionState(output, versionId) {
         ? 'current'
         : 'conflicting';
 }
-function requireDescribeOutput(value, input) {
-    if (!isRecord(value) ||
-        typeof value['ARN'] !== 'string' ||
-        !arnMatchesName(value['ARN'], input.name) ||
-        value['Name'] !== input.name ||
-        value['Description'] !== input.description ||
-        value['DeletedDate'] !== undefined ||
-        value['RotationEnabled'] === true ||
-        !exactTags(value['Tags'], input.tags)) {
-        throw new AwsGeneratedSecretInitializationError('generated-secret-observation-invalid');
+function requireDescribeOutput(value, input, phase) {
+    let predicate;
+    if (!isRecord(value))
+        predicate = 'response-record';
+    else if (typeof value['ARN'] !== 'string')
+        predicate = 'arn-type';
+    else if (!arnMatchesName(value['ARN'], input.name))
+        predicate = 'arn-name';
+    else if (value['Name'] !== input.name)
+        predicate = 'name';
+    else if (value['Description'] !== input.description)
+        predicate = 'description';
+    else if (value['DeletedDate'] !== undefined)
+        predicate = 'deleted-date';
+    else if (value['RotationEnabled'] === true)
+        predicate = 'rotation-enabled';
+    else
+        predicate = tagsDiagnostic(value['Tags'], input.tags);
+    if (predicate !== undefined) {
+        throw new AwsGeneratedSecretInitializationError('generated-secret-observation-invalid', { phase, predicate });
     }
+    // The branches above establish the same shape as the former compound check.
+    const output = value;
     return {
-        arn: value['ARN'],
-        state: inspectVersionState(value, expectedVersionId(input.name, input.generation)),
+        arn: output.ARN,
+        state: inspectVersionState(output, expectedVersionId(input.name, input.generation)),
     };
 }
 function requireCreateOutput(value, input, versionId) {
@@ -161,7 +224,7 @@ function createAwsGeneratedSecretInitializationControlPlane(options = {}) {
     const client = options.client ?? defaultClient(options.clientConfiguration ?? {});
     const generateBytes = options.randomBytes ?? node_crypto_1.randomBytes;
     const wait = options.wait ?? defaultWait;
-    const inspectExact = async (input) => {
+    const inspectExact = async (input, phase) => {
         requireInput(input);
         let rawOutput;
         try {
@@ -172,13 +235,13 @@ function createAwsGeneratedSecretInitializationControlPlane(options = {}) {
                 return { state: 'missing' };
             throw new AwsGeneratedSecretInitializationError('generated-secret-read-failed');
         }
-        return requireDescribeOutput(rawOutput, input);
+        return requireDescribeOutput(rawOutput, input, phase);
     };
     const inspectAfterCreate = async (input) => {
         let finalInspection = { state: 'missing' };
         for (const delay of inspectionDelaysMilliseconds) {
             await wait(delay);
-            finalInspection = await inspectExact(input);
+            finalInspection = await inspectExact(input, 'post-create');
             if (finalInspection.state !== 'missing')
                 return finalInspection;
         }
@@ -186,15 +249,15 @@ function createAwsGeneratedSecretInitializationControlPlane(options = {}) {
     };
     return Object.freeze({
         async inspect(input) {
-            return (await inspectExact(input)).state;
+            return (await inspectExact(input, 'inspect')).state;
         },
         async initializeGenerated(input) {
             requireInput(input);
-            const initial = await inspectExact(input);
+            const initial = await inspectExact(input, 'pre-create');
             if (initial.state === 'current')
                 return 'unchanged';
             if (initial.state !== 'missing') {
-                throw new AwsGeneratedSecretInitializationError('generated-secret-state-conflicting');
+                throw new AwsGeneratedSecretInitializationError('generated-secret-state-conflicting', { phase: 'pre-create', predicate: 'version-state' });
             }
             let idBytes;
             let keyBytes;
@@ -248,11 +311,11 @@ function createAwsGeneratedSecretInitializationControlPlane(options = {}) {
                 return responseAccepted ? 'applied' : 'unchanged';
             }
             if (finalInspection.state === 'conflicting') {
-                throw new AwsGeneratedSecretInitializationError('generated-secret-state-conflicting');
+                throw new AwsGeneratedSecretInitializationError('generated-secret-state-conflicting', { phase: 'post-create', predicate: 'version-state' });
             }
             throw new AwsGeneratedSecretInitializationError(responseAccepted
                 ? 'generated-secret-observation-invalid'
-                : 'generated-secret-write-failed');
+                : 'generated-secret-write-failed', { phase: 'post-create', predicate: 'not-found' });
         },
     });
 }

package/src/secrets/operator.d.ts

@@ -1,4 +1,4 @@
-import { AwsGeneratedSecretInitializationError } from './generated-aws-control-plane.js';
+import { AwsGeneratedSecretInitializationError, type GeneratedSecretObservationDiagnostic } from './generated-aws-control-plane.js';
 import { type SecretMetadataFinding, type SecretMetadataMutationIntent, type SecretMetadataPreflightResult, type SecretMetadataReconciliationResult } from './metadata.js';
 import { type ObservedSecretMetadata, type SecretManagementScope, type SecretMetadataDeclaration } from './model.js';
 export interface ListedSecretContainer {
@@ -84,8 +84,9 @@ export type SecretProtectedLifecycleAction = 'deploy' | 'recover' | 'remove' | '
 export declare class SecretOperatorControlPlaneError extends Error {
     readonly operation: 'create-empty' | 'describe' | 'inventory' | 'initialize-generated' | 'list' | 'recover' | 'retire' | 'tag';
     readonly diagnosticCode?: AwsGeneratedSecretInitializationError['code'];
+    readonly observationDiagnostic?: GeneratedSecretObservationDiagnostic;
     readonly code: 'secret-control-plane-apply-failed' | 'secret-control-plane-inventory-failed' | 'secret-control-plane-inventory-invalid' | 'secret-control-plane-protected-action-failed';
-    constructor(code: SecretOperatorControlPlaneError['code'], operation: 'create-empty' | 'describe' | 'inventory' | 'initialize-generated' | 'list' | 'recover' | 'retire' | 'tag', diagnosticCode?: AwsGeneratedSecretInitializationError['code']);
+    constructor(code: SecretOperatorControlPlaneError['code'], operation: 'create-empty' | 'describe' | 'inventory' | 'initialize-generated' | 'list' | 'recover' | 'retire' | 'tag', diagnosticCode?: AwsGeneratedSecretInitializationError['code'], observationDiagnostic?: GeneratedSecretObservationDiagnostic);
 }
 export interface SecretMetadataOperatorResult {
     after?: SecretMetadataReconciliationResult;

package/src/secrets/operator.js

@@ -13,14 +13,20 @@ const model_js_1 = require("./model.js");
 class SecretOperatorControlPlaneError extends Error {
     operation;
     diagnosticCode;
+    observationDiagnostic;
     code;
-    constructor(code, operation, diagnosticCode) {
+    constructor(code, operation, diagnosticCode, observationDiagnostic) {
+        const safeObservation = (0, generated_aws_control_plane_js_1.safeGeneratedSecretObservationDiagnostic)(observationDiagnostic);
         super(`Secret metadata ${operation} failed (${code}).` +
-            (diagnosticCode ? ` Reason: ${diagnosticCode}.` : ''));
+            (diagnosticCode ? ` Reason: ${diagnosticCode}.` : '') +
+            (safeObservation
+                ? ` Observation: ${safeObservation.phase}/${safeObservation.predicate}.`
+                : ''));
         this.operation = operation;
         this.diagnosticCode = diagnosticCode;
         this.name = 'SecretOperatorControlPlaneError';
         this.code = code;
+        this.observationDiagnostic = safeObservation;
     }
 }
 exports.SecretOperatorControlPlaneError = SecretOperatorControlPlaneError;
@@ -35,14 +41,30 @@ function safeControlPlaneError(error, code, operation) {
     // Preserve only our finite, value-blind diagnostic vocabulary. Never attach
     // the raw SDK error, message, stack, request or cause: they may hold values.
     if (error instanceof generated_aws_control_plane_js_1.AwsGeneratedSecretInitializationError) {
-        const diagnosticCode = Object.getOwnPropertyDescriptor(error, 'code')?.value;
+        let diagnosticCode;
+        try {
+            diagnosticCode = Object.getOwnPropertyDescriptor(error, 'code')?.value;
+        }
+        catch {
+            // A descriptor trap must not replace the safe error with its own.
+            return new SecretOperatorControlPlaneError(code, operation);
+        }
         switch (diagnosticCode) {
             case 'generated-secret-input-invalid':
             case 'generated-secret-observation-invalid':
             case 'generated-secret-read-failed':
             case 'generated-secret-state-conflicting':
-            case 'generated-secret-write-failed':
-                return new SecretOperatorControlPlaneError(code, operation, diagnosticCode);
+            case 'generated-secret-write-failed': {
+                let observationDiagnostic;
+                try {
+                    observationDiagnostic = (0, generated_aws_control_plane_js_1.safeGeneratedSecretObservationDiagnostic)(Object.getOwnPropertyDescriptor(error, 'observationDiagnostic')
+                        ?.value);
+                }
+                catch {
+                    // An optional descriptor trap is untrusted detail, not a new error.
+                }
+                return new SecretOperatorControlPlaneError(code, operation, diagnosticCode, observationDiagnostic);
+            }
         }
     }
     return new SecretOperatorControlPlaneError(code, operation);

package/src/supply-chain/generated-files.js

@@ -275,6 +275,15 @@ to generate the effective managed \`pnpm-workspace.yaml\`, then run
 Review the lockfile and rerun affected checks. Never edit the managed YAML or
 ownership hashes. Pins do not waive the existing supply-chain policies.
 
+The Standard Slice owns an exact local \`@opennextjs/aws\` development dependency.
+Its build wrapper refuses a missing or different local builder; it never invokes
+npx or dlx. Fresh override defaults include the reviewed
+\`@node-minify/core@9.0.2>glob@10.3.3: 10.5.0\` correction. Existing seeded
+policy always wins: explicitly reconcile that entry in the editable JSON before
+the supported workspace report/apply, preserving other decisions. The override
+governs the managed builder tree; OpenNext's nested npm image install remains a
+separate boundary checked by the generated Sharp metadata/native-target guard.
+
 The license lists are organization-owned policy, not legal conclusions.
 Unknown and changed licenses require review. Exceptions are exact-component,
 approved, expiring records with compensating controls and recheck triggers.