@empire-builder-kit/runtime 1.0.0-beta.9 → 1.0.0-rc.2

package/src/secrets/observability.js

@@ -0,0 +1,100 @@
+export const SECRET_RESOLUTION_FEATURE = 'secret-management';
+export const SECRET_RESOLUTION_OPERATION = 'secret.resolve';
+export const SECRET_RESOLUTION_COMPONENT = 'secret-resolver';
+function renderObservation(observation) {
+    switch (observation.type) {
+        case 'authentication-retry':
+            return {
+                level: 'warn',
+                message: 'Secret authentication retry started',
+                metricName: 'SecretAuthenticationRetries',
+            };
+        case 'cache-hit':
+            return {
+                level: 'debug',
+                message: 'Secret cache hit',
+            };
+        case 'cache-invalidated':
+            return {
+                level: 'info',
+                message: 'Secret cache invalidated',
+            };
+        case 'refresh-failed':
+            return {
+                level: 'error',
+                message: 'Secret resolution failed',
+                metricName: 'SecretResolutionFailures',
+                outcome: 'failure',
+            };
+        case 'refresh-started':
+            return {
+                level: 'debug',
+                message: 'Secret resolution started',
+            };
+        case 'refresh-succeeded':
+            return {
+                level: 'info',
+                message: 'Secret resolution completed',
+                outcome: 'success',
+            };
+        case 'stale-value-used':
+            return {
+                level: 'warn',
+                message: 'Secret stale value used',
+                metricName: 'SecretStaleValueUses',
+            };
+    }
+}
+function reviewedAttributes(observation) {
+    const common = {
+        lifecycleEvent: observation.type,
+        logicalName: observation.logicalName,
+    };
+    switch (observation.type) {
+        case 'authentication-retry':
+        case 'refresh-started':
+        case 'refresh-succeeded':
+            return common;
+        case 'cache-hit':
+            return Object.assign(Object.assign({}, common), { cacheAgeMs: observation.ageMs });
+        case 'cache-invalidated':
+            return Object.assign(Object.assign({}, common), { invalidationReason: observation.reason });
+        case 'refresh-failed':
+            return Object.assign(Object.assign({}, common), { failureClass: observation.failureClass });
+        case 'stale-value-used':
+            return Object.assign(Object.assign({}, common), { cacheAgeMs: observation.ageMs, retryAfterMs: observation.retryAfterMs });
+    }
+}
+export function createSecretResolverObservability(options) {
+    var _a;
+    const component = (_a = options.component) !== null && _a !== void 0 ? _a : SECRET_RESOLUTION_COMPONENT;
+    const logger = options.logger.child({
+        component,
+        feature: SECRET_RESOLUTION_FEATURE,
+        operation: SECRET_RESOLUTION_OPERATION,
+    });
+    return Object.freeze({
+        observe(observation) {
+            const rendering = renderObservation(observation);
+            const context = observation.correlationId === 'unavailable'
+                ? undefined
+                : { correlationId: observation.correlationId };
+            logger[rendering.level](rendering.message, {
+                attributes: reviewedAttributes(observation),
+                context,
+                outcome: rendering.outcome,
+            });
+            if (rendering.metricName !== undefined) {
+                options.metrics.emit({
+                    dimensions: Object.assign(Object.assign({ component, feature: SECRET_RESOLUTION_FEATURE, operation: SECRET_RESOLUTION_OPERATION }, (rendering.outcome === undefined
+                        ? {}
+                        : { outcome: rendering.outcome })), { slice: options.slice, stage: options.stage }),
+                    metricName: rendering.metricName,
+                    unit: 'Count',
+                    value: 1,
+                });
+            }
+        },
+    });
+}
+//# sourceMappingURL=observability.js.map

package/src/secrets/observability.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"observability.js","sourceRoot":"","sources":["../../../../../packages/runtime/src/secrets/observability.ts"],"names":[],"mappings":"AAOA,MAAM,CAAC,MAAM,yBAAyB,GAAG,mBAA4B,CAAC;AACtE,MAAM,CAAC,MAAM,2BAA2B,GAAG,gBAAyB,CAAC;AACrE,MAAM,CAAC,MAAM,2BAA2B,GAAG,iBAA0B,CAAC;AAiBtE,SAAS,iBAAiB,CACxB,WAAsC;IAEtC,QAAQ,WAAW,CAAC,IAAI,EAAE,CAAC;QACzB,KAAK,sBAAsB;YACzB,OAAO;gBACL,KAAK,EAAE,MAAM;gBACb,OAAO,EAAE,qCAAqC;gBAC9C,UAAU,EAAE,6BAA6B;aAC1C,CAAC;QACJ,KAAK,WAAW;YACd,OAAO;gBACL,KAAK,EAAE,OAAO;gBACd,OAAO,EAAE,kBAAkB;aAC5B,CAAC;QACJ,KAAK,mBAAmB;YACtB,OAAO;gBACL,KAAK,EAAE,MAAM;gBACb,OAAO,EAAE,0BAA0B;aACpC,CAAC;QACJ,KAAK,gBAAgB;YACnB,OAAO;gBACL,KAAK,EAAE,OAAO;gBACd,OAAO,EAAE,0BAA0B;gBACnC,UAAU,EAAE,0BAA0B;gBACtC,OAAO,EAAE,SAAS;aACnB,CAAC;QACJ,KAAK,iBAAiB;YACpB,OAAO;gBACL,KAAK,EAAE,OAAO;gBACd,OAAO,EAAE,2BAA2B;aACrC,CAAC;QACJ,KAAK,mBAAmB;YACtB,OAAO;gBACL,KAAK,EAAE,MAAM;gBACb,OAAO,EAAE,6BAA6B;gBACtC,OAAO,EAAE,SAAS;aACnB,CAAC;QACJ,KAAK,kBAAkB;YACrB,OAAO;gBACL,KAAK,EAAE,MAAM;gBACb,OAAO,EAAE,yBAAyB;gBAClC,UAAU,EAAE,sBAAsB;aACnC,CAAC;IACN,CAAC;AACH,CAAC;AAED,SAAS,kBAAkB,CACzB,WAAsC;IAEtC,MAAM,MAAM,GAAG;QACb,cAAc,EAAE,WAAW,CAAC,IAAI;QAChC,WAAW,EAAE,WAAW,CAAC,WAAW;KACrC,CAAC;IACF,QAAQ,WAAW,CAAC,IAAI,EAAE,CAAC;QACzB,KAAK,sBAAsB,CAAC;QAC5B,KAAK,iBAAiB,CAAC;QACvB,KAAK,mBAAmB;YACtB,OAAO,MAAM,CAAC;QAChB,KAAK,WAAW;YACd,uCAAY,MAAM,KAAE,UAAU,EAAE,WAAW,CAAC,KAAK,IAAG;QACtD,KAAK,mBAAmB;YACtB,uCAAY,MAAM,KAAE,kBAAkB,EAAE,WAAW,CAAC,MAAM,IAAG;QAC/D,KAAK,gBAAgB;YACnB,uCAAY,MAAM,KAAE,YAAY,EAAE,WAAW,CAAC,YAAY,IAAG;QAC/D,KAAK,kBAAkB;YACrB,uCACK,MAAM,KACT,UAAU,EAAE,WAAW,CAAC,KAAK,EAC7B,YAAY,EAAE,WAAW,CAAC,YAAY,IACtC;IACN,CAAC;AACH,CAAC;AAED,MAAM,UAAU,iCAAiC,CAC/C,OAA2C;;IAE3C,MAAM,SAAS,GAAG,MAAA,OAAO,CAAC,SAAS,mCAAI,2BAA2B,CAAC;IACnE,MAAM,MAAM,GAAG,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC;QAClC,SAAS;QACT,OAAO,EAAE,yBAAyB;QAClC,SAAS,EAAE,2BAA2B;KACvC,CAAC,CAAC;IAEH,OAAO,MAAM,CAAC,MAAM,CAAC;QACnB,OAAO,CAAC,WAAsC;YAC5C,MAAM,SAAS,GAAG,iBAAiB,CAAC,WAAW,CAAC,CAAC;YACjD,MAAM,OAAO,GACX,WAAW,CAAC,aAAa,KAAK,aAAa;gBACzC,CAAC,CAAC,SAAS;gBACX,CAAC,CAAC,EAAE,aAAa,EAAE,WAAW,CAAC,aAAa,EAAE,CAAC;YACnD,MAAM,CAAC,SAAS,CAAC,KAAK,CAAC,CAAC,SAAS,CAAC,OAAO,EAAE;gBACzC,UAAU,EAAE,kBAAkB,CAAC,WAAW,CAAC;gBAC3C,OAAO;gBACP,OAAO,EAAE,SAAS,CAAC,OAAO;aAC3B,CAAC,CAAC;YAEH,IAAI,SAAS,CAAC,UAAU,KAAK,SAAS,EAAE,CAAC;gBACvC,OAAO,CAAC,OAAO,CAAC,IAAI,CAAC;oBACnB,UAAU,gCACR,SAAS,EACT,OAAO,EAAE,yBAAyB,EAClC,SAAS,EAAE,2BAA2B,IACnC,CAAC,SAAS,CAAC,OAAO,KAAK,SAAS;wBACjC,CAAC,CAAC,EAAE;wBACJ,CAAC,CAAC,EAAE,OAAO,EAAE,SAAS,CAAC,OAAO,EAAE,CAAC,KACnC,KAAK,EAAE,OAAO,CAAC,KAAK,EACpB,KAAK,EAAE,OAAO,CAAC,KAAK,GACrB;oBACD,UAAU,EAAE,SAAS,CAAC,UAAU;oBAChC,IAAI,EAAE,OAAO;oBACb,KAAK,EAAE,CAAC;iBACT,CAAC,CAAC;YACL,CAAC;QACH,CAAC;KACF,CAAC,CAAC;AACL,CAAC"}

package/src/secrets/personal.d.ts

@@ -0,0 +1,48 @@
+import { type DefinedSecret, type SecretValueOf, type SecretValuePayload, type SecretValueSchema } from './contract.js';
+import { type SecretResolutionContext, type SecretResolverHooks, type ServerSecretRuntimeBinding } from './resolver.js';
+export declare const CANONICAL_SECRET_STAGES: readonly ["development", "staging", "production"];
+export interface PersonalSstSecretReference {
+    logicalName: string;
+    provider: 'sst-personal-secret';
+    stage: string;
+}
+export interface PersonalSstSecretSourceValue {
+    payload: SecretValuePayload;
+    provenance: 'explicit' | 'fallback' | 'placeholder';
+    valueKind?: 'binary' | 'json' | 'string';
+}
+export interface PersonalSstSecretSource {
+    read(input: {
+        logicalName: string;
+        stage: string;
+    }): Promise<PersonalSstSecretSourceValue | undefined>;
+}
+export interface PersonalSstLinkedResource {
+    value: string;
+}
+export interface PersonalSstSecretResolver {
+    get<Declaration extends DefinedSecret<string, SecretValueSchema<unknown>>>(declaration: Declaration, reference: PersonalSstSecretReference, context?: SecretResolutionContext): Promise<SecretValueOf<Declaration>>;
+    runWithSecret<Declaration extends DefinedSecret<string, SecretValueSchema<unknown>>, Result>(options: {
+        context?: SecretResolutionContext;
+        declaration: Declaration;
+        isAuthenticationFailure(error: unknown): boolean;
+        operation(value: SecretValueOf<Declaration>): Promise<Result>;
+        reference: PersonalSstSecretReference;
+    }): Promise<Result>;
+}
+export interface CreatePersonalSstSecretResolverOptions {
+    accountId: string;
+    binding: ServerSecretRuntimeBinding;
+    developmentAccountId: string;
+    hooks?: SecretResolverHooks;
+    mode: 'sst-dev';
+    source: PersonalSstSecretSource;
+    stage: string;
+}
+/**
+ * Adapts the value-only resources emitted by the generated personal SST
+ * bridge. Product code never reads `Resource.<name>.value` directly.
+ */
+export declare function createLinkedPersonalSstSecretSource(resources: Readonly<Record<string, unknown>>): PersonalSstSecretSource;
+export declare function personalSstSecretReference(logicalName: string, stage: string): PersonalSstSecretReference;
+export declare function createPersonalSstSecretResolver(options: CreatePersonalSstSecretResolverOptions): PersonalSstSecretResolver;

package/src/secrets/personal.js

@@ -0,0 +1,332 @@
+import { __awaiter } from "tslib";
+import { SECRET_CANONICAL_STAGES, isDefinedSecret, } from './contract.js';
+import { SecretResolutionError, assertServerSecretRuntimeBinding, } from './resolver.js';
+export const CANONICAL_SECRET_STAGES = SECRET_CANONICAL_STAGES;
+const accountPattern = /^\d{12}$/;
+const logicalNamePattern = /^[A-Za-z][A-Za-z0-9]{0,63}$/;
+const personalStagePattern = /^personal-[a-z0-9](?:[a-z0-9-]{0,25}[a-z0-9])?$/;
+const correlationPattern = /^[A-Za-z0-9][A-Za-z0-9._:-]{0,127}$/;
+const personalSecretEnvelopePrefix = 'ebk-personal-secret-v1:';
+const canonicalBase64Pattern = /^(?:[A-Za-z0-9+/]{4})*(?:[A-Za-z0-9+/]{2}==|[A-Za-z0-9+/]{3}=)?$/;
+function isRecord(value) {
+    return typeof value === 'object' && value !== null && !Array.isArray(value);
+}
+function decodePersonalSecretEnvelope(input) {
+    var _a, _b, _c;
+    if (!input.value.startsWith(personalSecretEnvelopePrefix)) {
+        return Object.freeze({
+            payload: Object.freeze({}),
+            provenance: 'placeholder',
+        });
+    }
+    const encoded = input.value.slice(personalSecretEnvelopePrefix.length);
+    if (encoded.length === 0 ||
+        encoded.length % 4 !== 0 ||
+        !canonicalBase64Pattern.test(encoded)) {
+        return Object.freeze({
+            payload: Object.freeze({}),
+            provenance: 'placeholder',
+        });
+    }
+    const envelope = Uint8Array.from(Buffer.from(encoded, 'base64'));
+    try {
+        const stageLength = (_a = envelope[1]) !== null && _a !== void 0 ? _a : 0;
+        const logicalNameLength = (_b = envelope[2]) !== null && _b !== void 0 ? _b : 0;
+        const valueOffset = 4 + stageLength + logicalNameLength;
+        if (envelope[0] !== 1 ||
+            ![1, 2, 3].includes((_c = envelope[3]) !== null && _c !== void 0 ? _c : 0) ||
+            stageLength === 0 ||
+            logicalNameLength === 0 ||
+            valueOffset > envelope.byteLength) {
+            return Object.freeze({
+                payload: Object.freeze({}),
+                provenance: 'placeholder',
+            });
+        }
+        const decoder = new TextDecoder('utf-8', { fatal: true });
+        const stage = decoder.decode(envelope.subarray(4, 4 + stageLength));
+        const logicalName = decoder.decode(envelope.subarray(4 + stageLength, 4 + stageLength + logicalNameLength));
+        if (stage !== input.stage) {
+            return Object.freeze({
+                payload: Object.freeze({}),
+                provenance: 'fallback',
+            });
+        }
+        if (logicalName !== input.logicalName) {
+            return Object.freeze({
+                payload: Object.freeze({}),
+                provenance: 'placeholder',
+            });
+        }
+        const value = envelope.subarray(valueOffset);
+        if (envelope[3] === 1) {
+            return Object.freeze({
+                payload: Object.freeze({
+                    secretBinary: new Uint8Array(value),
+                }),
+                provenance: 'explicit',
+                valueKind: 'binary',
+            });
+        }
+        return Object.freeze({
+            payload: Object.freeze({
+                secretString: decoder.decode(value),
+            }),
+            provenance: 'explicit',
+            valueKind: envelope[3] === 2 ? 'json' : 'string',
+        });
+    }
+    catch (_d) {
+        return Object.freeze({
+            payload: Object.freeze({}),
+            provenance: 'placeholder',
+        });
+    }
+    finally {
+        envelope.fill(0);
+    }
+}
+/**
+ * Adapts the value-only resources emitted by the generated personal SST
+ * bridge. Product code never reads `Resource.<name>.value` directly.
+ */
+export function createLinkedPersonalSstSecretSource(resources) {
+    if (!isRecord(resources)) {
+        throw new SecretResolutionError({
+            code: 'secret-runtime-configuration-invalid',
+            logicalName: 'unknown',
+        });
+    }
+    return Object.freeze({
+        read(_a) {
+            return __awaiter(this, arguments, void 0, function* ({ logicalName, stage, }) {
+                if (!logicalNamePattern.test(logicalName) ||
+                    !Object.prototype.hasOwnProperty.call(resources, logicalName)) {
+                    return undefined;
+                }
+                const resource = resources[logicalName];
+                if (!isRecord(resource) ||
+                    resource['type'] !== 'sst.sst.Secret' ||
+                    typeof resource['value'] !== 'string' ||
+                    Object.keys(resource).some((key) => key !== 'type' && key !== 'value')) {
+                    throw new SecretResolutionError({
+                        code: 'secret-source-failed',
+                        logicalName,
+                    });
+                }
+                return decodePersonalSecretEnvelope({
+                    logicalName,
+                    stage,
+                    value: resource['value'],
+                });
+            });
+        },
+    });
+}
+export function personalSstSecretReference(logicalName, stage) {
+    if (!logicalNamePattern.test(logicalName) ||
+        !personalStagePattern.test(stage)) {
+        throw new SecretResolutionError({
+            code: 'secret-reference-invalid',
+            logicalName,
+        });
+    }
+    return Object.freeze({
+        logicalName,
+        provider: 'sst-personal-secret',
+        stage,
+    });
+}
+function safeCorrelationId(context) {
+    return (context === null || context === void 0 ? void 0 : context.correlationId) !== undefined &&
+        correlationPattern.test(context.correlationId)
+        ? context.correlationId
+        : 'unavailable';
+}
+function validatePersonalEnvironment(options) {
+    assertServerSecretRuntimeBinding(options.binding);
+    if (options.mode !== 'sst-dev' ||
+        !personalStagePattern.test(options.stage) ||
+        CANONICAL_SECRET_STAGES.includes(options.stage) ||
+        options.binding.stage !== options.stage ||
+        !accountPattern.test(options.accountId) ||
+        !accountPattern.test(options.developmentAccountId) ||
+        options.accountId !== options.developmentAccountId) {
+        throw new SecretResolutionError({
+            code: 'secret-personal-stage-invalid',
+            logicalName: 'unknown',
+        });
+    }
+}
+function validateReference(declaration, reference, stage, context) {
+    if (!isDefinedSecret(declaration)) {
+        throw new SecretResolutionError({
+            code: 'secret-reference-invalid',
+            correlationId: context === null || context === void 0 ? void 0 : context.correlationId,
+            logicalName: 'unknown',
+        });
+    }
+    if (reference.provider !== 'sst-personal-secret' ||
+        reference.stage !== stage ||
+        declaration.source !== 'operator' ||
+        !logicalNamePattern.test(reference.logicalName)) {
+        throw new SecretResolutionError({
+            code: 'secret-reference-invalid',
+            correlationId: context === null || context === void 0 ? void 0 : context.correlationId,
+            logicalName: declaration.logicalName,
+        });
+    }
+    if (reference.logicalName !== declaration.logicalName) {
+        throw new SecretResolutionError({
+            code: 'secret-reference-mismatch',
+            correlationId: context === null || context === void 0 ? void 0 : context.correlationId,
+            logicalName: declaration.logicalName,
+        });
+    }
+}
+function validateValue(declaration, sourcePayload, context) {
+    var _a;
+    let decodedBinary;
+    let validationBinary;
+    try {
+        const payload = sourcePayload.secretBinary === undefined
+            ? sourcePayload
+            : {
+                secretBinary: (decodedBinary = new Uint8Array(sourcePayload.secretBinary)),
+            };
+        const result = declaration.value.validate(Object.assign(Object.assign({}, (payload.secretBinary === undefined
+            ? {}
+            : {
+                secretBinary: (validationBinary = new Uint8Array(payload.secretBinary)),
+            })), (payload.secretString === undefined
+            ? {}
+            : { secretString: payload.secretString })));
+        if (result.valid) {
+            return (declaration.value.kind === 'binary' &&
+                result.value instanceof Uint8Array
+                ? new Uint8Array(result.value)
+                : result.value);
+        }
+    }
+    catch (_b) {
+        // Validator details may contain the personal value and are discarded.
+    }
+    finally {
+        validationBinary === null || validationBinary === void 0 ? void 0 : validationBinary.fill(0);
+        decodedBinary === null || decodedBinary === void 0 ? void 0 : decodedBinary.fill(0);
+        (_a = sourcePayload.secretBinary) === null || _a === void 0 ? void 0 : _a.fill(0);
+    }
+    throw new SecretResolutionError({
+        code: 'secret-value-malformed',
+        correlationId: context === null || context === void 0 ? void 0 : context.correlationId,
+        logicalName: declaration.logicalName,
+    });
+}
+export function createPersonalSstSecretResolver(options) {
+    validatePersonalEnvironment(options);
+    function observe(observation) {
+        var _a, _b;
+        try {
+            (_b = (_a = options.hooks) === null || _a === void 0 ? void 0 : _a.observe) === null || _b === void 0 ? void 0 : _b.call(_a, observation);
+        }
+        catch (_c) {
+            // Observability cannot alter personal secret resolution.
+        }
+    }
+    function get(declaration, reference, context) {
+        return __awaiter(this, void 0, void 0, function* () {
+            validateReference(declaration, reference, options.stage, context);
+            const observationContext = {
+                correlationId: safeCorrelationId(context),
+                logicalName: declaration.logicalName,
+            };
+            observe(Object.assign(Object.assign({}, observationContext), { type: 'refresh-started' }));
+            let sourceValue;
+            try {
+                sourceValue = yield options.source.read({
+                    logicalName: declaration.logicalName,
+                    stage: options.stage,
+                });
+            }
+            catch (_a) {
+                observe(Object.assign(Object.assign({}, observationContext), { failureClass: 'other', type: 'refresh-failed' }));
+                throw new SecretResolutionError({
+                    code: 'secret-source-failed',
+                    correlationId: context === null || context === void 0 ? void 0 : context.correlationId,
+                    logicalName: declaration.logicalName,
+                });
+            }
+            if (sourceValue === undefined) {
+                observe(Object.assign(Object.assign({}, observationContext), { failureClass: 'missing', type: 'refresh-failed' }));
+                throw new SecretResolutionError({
+                    code: 'secret-source-missing',
+                    correlationId: context === null || context === void 0 ? void 0 : context.correlationId,
+                    logicalName: declaration.logicalName,
+                });
+            }
+            let provenance;
+            let payload;
+            let valueKind;
+            try {
+                provenance = sourceValue.provenance;
+                payload = sourceValue.payload;
+                valueKind = sourceValue.valueKind;
+            }
+            catch (_b) {
+                observe(Object.assign(Object.assign({}, observationContext), { failureClass: 'other', type: 'refresh-failed' }));
+                throw new SecretResolutionError({
+                    code: 'secret-source-failed',
+                    correlationId: context === null || context === void 0 ? void 0 : context.correlationId,
+                    logicalName: declaration.logicalName,
+                });
+            }
+            if (provenance !== 'explicit' || valueKind !== declaration.value.kind) {
+                observe(Object.assign(Object.assign({}, observationContext), { failureClass: 'other', type: 'refresh-failed' }));
+                throw new SecretResolutionError({
+                    code: 'secret-personal-source-forbidden',
+                    correlationId: context === null || context === void 0 ? void 0 : context.correlationId,
+                    logicalName: declaration.logicalName,
+                });
+            }
+            try {
+                const value = validateValue(declaration, payload, context);
+                observe(Object.assign(Object.assign({}, observationContext), { type: 'refresh-succeeded' }));
+                return value;
+            }
+            catch (error) {
+                observe(Object.assign(Object.assign({}, observationContext), { failureClass: 'other', type: 'refresh-failed' }));
+                throw error instanceof SecretResolutionError
+                    ? error
+                    : new SecretResolutionError({
+                        code: 'secret-source-failed',
+                        correlationId: context === null || context === void 0 ? void 0 : context.correlationId,
+                        logicalName: declaration.logicalName,
+                    });
+            }
+        });
+    }
+    return Object.freeze({
+        get,
+        runWithSecret(runOptions) {
+            return __awaiter(this, void 0, void 0, function* () {
+                const initial = yield get(runOptions.declaration, runOptions.reference, runOptions.context);
+                try {
+                    return yield runOptions.operation(initial);
+                }
+                catch (error) {
+                    if (!runOptions.isAuthenticationFailure(error)) {
+                        throw error;
+                    }
+                }
+                observe({
+                    correlationId: safeCorrelationId(runOptions.context),
+                    logicalName: runOptions.declaration.logicalName,
+                    type: 'authentication-retry',
+                });
+                const refreshed = yield get(runOptions.declaration, runOptions.reference, runOptions.context);
+                return runOptions.operation(refreshed);
+            });
+        },
+    });
+}
+//# sourceMappingURL=personal.js.map

package/src/secrets/personal.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"personal.js","sourceRoot":"","sources":["../../../../../packages/runtime/src/secrets/personal.ts"],"names":[],"mappings":";AAAA,OAAO,EACL,uBAAuB,EACvB,eAAe,GAKhB,MAAM,eAAe,CAAC;AACvB,OAAO,EACL,qBAAqB,EACrB,gCAAgC,GAIjC,MAAM,eAAe,CAAC;AAEvB,MAAM,CAAC,MAAM,uBAAuB,GAAG,uBAAuB,CAAC;AAqD/D,MAAM,cAAc,GAAG,UAAU,CAAC;AAClC,MAAM,kBAAkB,GAAG,6BAA6B,CAAC;AACzD,MAAM,oBAAoB,GAAG,iDAAiD,CAAC;AAC/E,MAAM,kBAAkB,GAAG,qCAAqC,CAAC;AACjE,MAAM,4BAA4B,GAAG,yBAAyB,CAAC;AAC/D,MAAM,sBAAsB,GAC1B,kEAAkE,CAAC;AAErE,SAAS,QAAQ,CAAC,KAAc;IAC9B,OAAO,OAAO,KAAK,KAAK,QAAQ,IAAI,KAAK,KAAK,IAAI,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC;AAC9E,CAAC;AAED,SAAS,4BAA4B,CAAC,KAIrC;;IACC,IAAI,CAAC,KAAK,CAAC,KAAK,CAAC,UAAU,CAAC,4BAA4B,CAAC,EAAE,CAAC;QAC1D,OAAO,MAAM,CAAC,MAAM,CAAC;YACnB,OAAO,EAAE,MAAM,CAAC,MAAM,CAAC,EAAE,CAAC;YAC1B,UAAU,EAAE,aAAsB;SACnC,CAAC,CAAC;IACL,CAAC;IACD,MAAM,OAAO,GAAG,KAAK,CAAC,KAAK,CAAC,KAAK,CAAC,4BAA4B,CAAC,MAAM,CAAC,CAAC;IACvE,IACE,OAAO,CAAC,MAAM,KAAK,CAAC;QACpB,OAAO,CAAC,MAAM,GAAG,CAAC,KAAK,CAAC;QACxB,CAAC,sBAAsB,CAAC,IAAI,CAAC,OAAO,CAAC,EACrC,CAAC;QACD,OAAO,MAAM,CAAC,MAAM,CAAC;YACnB,OAAO,EAAE,MAAM,CAAC,MAAM,CAAC,EAAE,CAAC;YAC1B,UAAU,EAAE,aAAsB;SACnC,CAAC,CAAC;IACL,CAAC;IAED,MAAM,QAAQ,GAAG,UAAU,CAAC,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,OAAO,EAAE,QAAQ,CAAC,CAAC,CAAC;IACjE,IAAI,CAAC;QACH,MAAM,WAAW,GAAG,MAAA,QAAQ,CAAC,CAAC,CAAC,mCAAI,CAAC,CAAC;QACrC,MAAM,iBAAiB,GAAG,MAAA,QAAQ,CAAC,CAAC,CAAC,mCAAI,CAAC,CAAC;QAC3C,MAAM,WAAW,GAAG,CAAC,GAAG,WAAW,GAAG,iBAAiB,CAAC;QACxD,IACE,QAAQ,CAAC,CAAC,CAAC,KAAK,CAAC;YACjB,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,CAAC,CAAC,CAAC,QAAQ,CAAC,MAAA,QAAQ,CAAC,CAAC,CAAC,mCAAI,CAAC,CAAC;YACrC,WAAW,KAAK,CAAC;YACjB,iBAAiB,KAAK,CAAC;YACvB,WAAW,GAAG,QAAQ,CAAC,UAAU,EACjC,CAAC;YACD,OAAO,MAAM,CAAC,MAAM,CAAC;gBACnB,OAAO,EAAE,MAAM,CAAC,MAAM,CAAC,EAAE,CAAC;gBAC1B,UAAU,EAAE,aAAsB;aACnC,CAAC,CAAC;QACL,CAAC;QACD,MAAM,OAAO,GAAG,IAAI,WAAW,CAAC,OAAO,EAAE,EAAE,KAAK,EAAE,IAAI,EAAE,CAAC,CAAC;QAC1D,MAAM,KAAK,GAAG,OAAO,CAAC,MAAM,CAAC,QAAQ,CAAC,QAAQ,CAAC,CAAC,EAAE,CAAC,GAAG,WAAW,CAAC,CAAC,CAAC;QACpE,MAAM,WAAW,GAAG,OAAO,CAAC,MAAM,CAChC,QAAQ,CAAC,QAAQ,CAAC,CAAC,GAAG,WAAW,EAAE,CAAC,GAAG,WAAW,GAAG,iBAAiB,CAAC,CACxE,CAAC;QACF,IAAI,KAAK,KAAK,KAAK,CAAC,KAAK,EAAE,CAAC;YAC1B,OAAO,MAAM,CAAC,MAAM,CAAC;gBACnB,OAAO,EAAE,MAAM,CAAC,MAAM,CAAC,EAAE,CAAC;gBAC1B,UAAU,EAAE,UAAmB;aAChC,CAAC,CAAC;QACL,CAAC;QACD,IAAI,WAAW,KAAK,KAAK,CAAC,WAAW,EAAE,CAAC;YACtC,OAAO,MAAM,CAAC,MAAM,CAAC;gBACnB,OAAO,EAAE,MAAM,CAAC,MAAM,CAAC,EAAE,CAAC;gBAC1B,UAAU,EAAE,aAAsB;aACnC,CAAC,CAAC;QACL,CAAC;QACD,MAAM,KAAK,GAAG,QAAQ,CAAC,QAAQ,CAAC,WAAW,CAAC,CAAC;QAC7C,IAAI,QAAQ,CAAC,CAAC,CAAC,KAAK,CAAC,EAAE,CAAC;YACtB,OAAO,MAAM,CAAC,MAAM,CAAC;gBACnB,OAAO,EAAE,MAAM,CAAC,MAAM,CAAC;oBACrB,YAAY,EAAE,IAAI,UAAU,CAAC,KAAK,CAAC;iBACpC,CAAC;gBACF,UAAU,EAAE,UAAmB;gBAC/B,SAAS,EAAE,QAAiB;aAC7B,CAAC,CAAC;QACL,CAAC;QACD,OAAO,MAAM,CAAC,MAAM,CAAC;YACnB,OAAO,EAAE,MAAM,CAAC,MAAM,CAAC;gBACrB,YAAY,EAAE,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC;aACpC,CAAC;YACF,UAAU,EAAE,UAAmB;YAC/B,SAAS,EAAE,QAAQ,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,CAAE,MAAgB,CAAC,CAAC,CAAE,QAAkB;SACvE,CAAC,CAAC;IACL,CAAC;IAAC,WAAM,CAAC;QACP,OAAO,MAAM,CAAC,MAAM,CAAC;YACnB,OAAO,EAAE,MAAM,CAAC,MAAM,CAAC,EAAE,CAAC;YAC1B,UAAU,EAAE,aAAsB;SACnC,CAAC,CAAC;IACL,CAAC;YAAS,CAAC;QACT,QAAQ,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;IACnB,CAAC;AACH,CAAC;AAED;;;GAGG;AACH,MAAM,UAAU,mCAAmC,CACjD,SAA4C;IAE5C,IAAI,CAAC,QAAQ,CAAC,SAAS,CAAC,EAAE,CAAC;QACzB,MAAM,IAAI,qBAAqB,CAAC;YAC9B,IAAI,EAAE,sCAAsC;YAC5C,WAAW,EAAE,SAAS;SACvB,CAAC,CAAC;IACL,CAAC;IACD,OAAO,MAAM,CAAC,MAAM,CAAC;QACb,IAAI;iEAAC,EACT,WAAW,EACX,KAAK,GAIN;gBACC,IACE,CAAC,kBAAkB,CAAC,IAAI,CAAC,WAAW,CAAC;oBACrC,CAAC,MAAM,CAAC,SAAS,CAAC,cAAc,CAAC,IAAI,CAAC,SAAS,EAAE,WAAW,CAAC,EAC7D,CAAC;oBACD,OAAO,SAAS,CAAC;gBACnB,CAAC;gBACD,MAAM,QAAQ,GAAG,SAAS,CAAC,WAAW,CAAC,CAAC;gBACxC,IACE,CAAC,QAAQ,CAAC,QAAQ,CAAC;oBACnB,QAAQ,CAAC,MAAM,CAAC,KAAK,gBAAgB;oBACrC,OAAO,QAAQ,CAAC,OAAO,CAAC,KAAK,QAAQ;oBACrC,MAAM,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC,IAAI,CAAC,CAAC,GAAG,EAAE,EAAE,CAAC,GAAG,KAAK,MAAM,IAAI,GAAG,KAAK,OAAO,CAAC,EACtE,CAAC;oBACD,MAAM,IAAI,qBAAqB,CAAC;wBAC9B,IAAI,EAAE,sBAAsB;wBAC5B,WAAW;qBACZ,CAAC,CAAC;gBACL,CAAC;gBACD,OAAO,4BAA4B,CAAC;oBAClC,WAAW;oBACX,KAAK;oBACL,KAAK,EAAE,QAAQ,CAAC,OAAO,CAAC;iBACzB,CAAC,CAAC;YACL,CAAC;SAAA;KACF,CAAC,CAAC;AACL,CAAC;AAED,MAAM,UAAU,0BAA0B,CACxC,WAAmB,EACnB,KAAa;IAEb,IACE,CAAC,kBAAkB,CAAC,IAAI,CAAC,WAAW,CAAC;QACrC,CAAC,oBAAoB,CAAC,IAAI,CAAC,KAAK,CAAC,EACjC,CAAC;QACD,MAAM,IAAI,qBAAqB,CAAC;YAC9B,IAAI,EAAE,0BAA0B;YAChC,WAAW;SACZ,CAAC,CAAC;IACL,CAAC;IACD,OAAO,MAAM,CAAC,MAAM,CAAC;QACnB,WAAW;QACX,QAAQ,EAAE,qBAAqB;QAC/B,KAAK;KACN,CAAC,CAAC;AACL,CAAC;AAED,SAAS,iBAAiB,CACxB,OAA4C;IAE5C,OAAO,CAAA,OAAO,aAAP,OAAO,uBAAP,OAAO,CAAE,aAAa,MAAK,SAAS;QACzC,kBAAkB,CAAC,IAAI,CAAC,OAAO,CAAC,aAAa,CAAC;QAC9C,CAAC,CAAC,OAAO,CAAC,aAAa;QACvB,CAAC,CAAC,aAAa,CAAC;AACpB,CAAC;AAED,SAAS,2BAA2B,CAClC,OAA+C;IAE/C,gCAAgC,CAAC,OAAO,CAAC,OAAO,CAAC,CAAC;IAClD,IACE,OAAO,CAAC,IAAI,KAAK,SAAS;QAC1B,CAAC,oBAAoB,CAAC,IAAI,CAAC,OAAO,CAAC,KAAK,CAAC;QACzC,uBAAuB,CAAC,QAAQ,CAC9B,OAAO,CAAC,KAAiD,CAC1D;QACD,OAAO,CAAC,OAAO,CAAC,KAAK,KAAK,OAAO,CAAC,KAAK;QACvC,CAAC,cAAc,CAAC,IAAI,CAAC,OAAO,CAAC,SAAS,CAAC;QACvC,CAAC,cAAc,CAAC,IAAI,CAAC,OAAO,CAAC,oBAAoB,CAAC;QAClD,OAAO,CAAC,SAAS,KAAK,OAAO,CAAC,oBAAoB,EAClD,CAAC;QACD,MAAM,IAAI,qBAAqB,CAAC;YAC9B,IAAI,EAAE,+BAA+B;YACrC,WAAW,EAAE,SAAS;SACvB,CAAC,CAAC;IACL,CAAC;AACH,CAAC;AAED,SAAS,iBAAiB,CACxB,WAA0B,EAC1B,SAAqC,EACrC,KAAa,EACb,OAA4C;IAE5C,IAAI,CAAC,eAAe,CAAC,WAAW,CAAC,EAAE,CAAC;QAClC,MAAM,IAAI,qBAAqB,CAAC;YAC9B,IAAI,EAAE,0BAA0B;YAChC,aAAa,EAAE,OAAO,aAAP,OAAO,uBAAP,OAAO,CAAE,aAAa;YACrC,WAAW,EAAE,SAAS;SACvB,CAAC,CAAC;IACL,CAAC;IACD,IACE,SAAS,CAAC,QAAQ,KAAK,qBAAqB;QAC5C,SAAS,CAAC,KAAK,KAAK,KAAK;QACzB,WAAW,CAAC,MAAM,KAAK,UAAU;QACjC,CAAC,kBAAkB,CAAC,IAAI,CAAC,SAAS,CAAC,WAAW,CAAC,EAC/C,CAAC;QACD,MAAM,IAAI,qBAAqB,CAAC;YAC9B,IAAI,EAAE,0BAA0B;YAChC,aAAa,EAAE,OAAO,aAAP,OAAO,uBAAP,OAAO,CAAE,aAAa;YACrC,WAAW,EAAE,WAAW,CAAC,WAAW;SACrC,CAAC,CAAC;IACL,CAAC;IACD,IAAI,SAAS,CAAC,WAAW,KAAK,WAAW,CAAC,WAAW,EAAE,CAAC;QACtD,MAAM,IAAI,qBAAqB,CAAC;YAC9B,IAAI,EAAE,2BAA2B;YACjC,aAAa,EAAE,OAAO,aAAP,OAAO,uBAAP,OAAO,CAAE,aAAa;YACrC,WAAW,EAAE,WAAW,CAAC,WAAW;SACrC,CAAC,CAAC;IACL,CAAC;AACH,CAAC;AAED,SAAS,aAAa,CAGpB,WAAwB,EACxB,aAAiC,EACjC,OAA4C;;IAE5C,IAAI,aAAqC,CAAC;IAC1C,IAAI,gBAAwC,CAAC;IAC7C,IAAI,CAAC;QACH,MAAM,OAAO,GACX,aAAa,CAAC,YAAY,KAAK,SAAS;YACtC,CAAC,CAAC,aAAa;YACf,CAAC,CAAC;gBACE,YAAY,EAAE,CAAC,aAAa,GAAG,IAAI,UAAU,CAC3C,aAAa,CAAC,YAAY,CAC3B,CAAC;aACH,CAAC;QACR,MAAM,MAAM,GAAG,WAAW,CAAC,KAAK,CAAC,QAAQ,iCACpC,CAAC,OAAO,CAAC,YAAY,KAAK,SAAS;YACpC,CAAC,CAAC,EAAE;YACJ,CAAC,CAAC;gBACE,YAAY,EAAE,CAAC,gBAAgB,GAAG,IAAI,UAAU,CAC9C,OAAO,CAAC,YAAY,CACrB,CAAC;aACH,CAAC,GACH,CAAC,OAAO,CAAC,YAAY,KAAK,SAAS;YACpC,CAAC,CAAC,EAAE;YACJ,CAAC,CAAC,EAAE,YAAY,EAAE,OAAO,CAAC,YAAY,EAAE,CAAC,EAC3C,CAAC;QACH,IAAI,MAAM,CAAC,KAAK,EAAE,CAAC;YACjB,OAAO,CACL,WAAW,CAAC,KAAK,CAAC,IAAI,KAAK,QAAQ;gBACnC,MAAM,CAAC,KAAK,YAAY,UAAU;gBAChC,CAAC,CAAC,IAAI,UAAU,CAAC,MAAM,CAAC,KAAK,CAAC;gBAC9B,CAAC,CAAC,MAAM,CAAC,KAAK,CACa,CAAC;QAClC,CAAC;IACH,CAAC;IAAC,WAAM,CAAC;QACP,sEAAsE;IACxE,CAAC;YAAS,CAAC;QACT,gBAAgB,aAAhB,gBAAgB,uBAAhB,gBAAgB,CAAE,IAAI,CAAC,CAAC,CAAC,CAAC;QAC1B,aAAa,aAAb,aAAa,uBAAb,aAAa,CAAE,IAAI,CAAC,CAAC,CAAC,CAAC;QACvB,MAAA,aAAa,CAAC,YAAY,0CAAE,IAAI,CAAC,CAAC,CAAC,CAAC;IACtC,CAAC;IACD,MAAM,IAAI,qBAAqB,CAAC;QAC9B,IAAI,EAAE,wBAAwB;QAC9B,aAAa,EAAE,OAAO,aAAP,OAAO,uBAAP,OAAO,CAAE,aAAa;QACrC,WAAW,EAAE,WAAW,CAAC,WAAW;KACrC,CAAC,CAAC;AACL,CAAC;AAED,MAAM,UAAU,+BAA+B,CAC7C,OAA+C;IAE/C,2BAA2B,CAAC,OAAO,CAAC,CAAC;IAErC,SAAS,OAAO,CACd,WAAuE;;QAEvE,IAAI,CAAC;YACH,MAAA,MAAA,OAAO,CAAC,KAAK,0CAAE,OAAO,mDAAG,WAAW,CAAC,CAAC;QACxC,CAAC;QAAC,WAAM,CAAC;YACP,yDAAyD;QAC3D,CAAC;IACH,CAAC;IAED,SAAe,GAAG,CAGhB,WAAwB,EACxB,SAAqC,EACrC,OAAiC;;YAEjC,iBAAiB,CAAC,WAAW,EAAE,SAAS,EAAE,OAAO,CAAC,KAAK,EAAE,OAAO,CAAC,CAAC;YAClE,MAAM,kBAAkB,GAAG;gBACzB,aAAa,EAAE,iBAAiB,CAAC,OAAO,CAAC;gBACzC,WAAW,EAAE,WAAW,CAAC,WAAW;aACrC,CAAC;YACF,OAAO,iCACF,kBAAkB,KACrB,IAAI,EAAE,iBAAiB,IACvB,CAAC;YAEH,IAAI,WAAqD,CAAC;YAC1D,IAAI,CAAC;gBACH,WAAW,GAAG,MAAM,OAAO,CAAC,MAAM,CAAC,IAAI,CAAC;oBACtC,WAAW,EAAE,WAAW,CAAC,WAAW;oBACpC,KAAK,EAAE,OAAO,CAAC,KAAK;iBACrB,CAAC,CAAC;YACL,CAAC;YAAC,WAAM,CAAC;gBACP,OAAO,iCACF,kBAAkB,KACrB,YAAY,EAAE,OAAO,EACrB,IAAI,EAAE,gBAAgB,IACtB,CAAC;gBACH,MAAM,IAAI,qBAAqB,CAAC;oBAC9B,IAAI,EAAE,sBAAsB;oBAC5B,aAAa,EAAE,OAAO,aAAP,OAAO,uBAAP,OAAO,CAAE,aAAa;oBACrC,WAAW,EAAE,WAAW,CAAC,WAAW;iBACrC,CAAC,CAAC;YACL,CAAC;YACD,IAAI,WAAW,KAAK,SAAS,EAAE,CAAC;gBAC9B,OAAO,iCACF,kBAAkB,KACrB,YAAY,EAAE,SAAS,EACvB,IAAI,EAAE,gBAAgB,IACtB,CAAC;gBACH,MAAM,IAAI,qBAAqB,CAAC;oBAC9B,IAAI,EAAE,uBAAuB;oBAC7B,aAAa,EAAE,OAAO,aAAP,OAAO,uBAAP,OAAO,CAAE,aAAa;oBACrC,WAAW,EAAE,WAAW,CAAC,WAAW;iBACrC,CAAC,CAAC;YACL,CAAC;YACD,IAAI,UAAsD,CAAC;YAC3D,IAAI,OAA2B,CAAC;YAChC,IAAI,SAAoD,CAAC;YACzD,IAAI,CAAC;gBACH,UAAU,GAAG,WAAW,CAAC,UAAU,CAAC;gBACpC,OAAO,GAAG,WAAW,CAAC,OAAO,CAAC;gBAC9B,SAAS,GAAG,WAAW,CAAC,SAAS,CAAC;YACpC,CAAC;YAAC,WAAM,CAAC;gBACP,OAAO,iCACF,kBAAkB,KACrB,YAAY,EAAE,OAAO,EACrB,IAAI,EAAE,gBAAgB,IACtB,CAAC;gBACH,MAAM,IAAI,qBAAqB,CAAC;oBAC9B,IAAI,EAAE,sBAAsB;oBAC5B,aAAa,EAAE,OAAO,aAAP,OAAO,uBAAP,OAAO,CAAE,aAAa;oBACrC,WAAW,EAAE,WAAW,CAAC,WAAW;iBACrC,CAAC,CAAC;YACL,CAAC;YACD,IAAI,UAAU,KAAK,UAAU,IAAI,SAAS,KAAK,WAAW,CAAC,KAAK,CAAC,IAAI,EAAE,CAAC;gBACtE,OAAO,iCACF,kBAAkB,KACrB,YAAY,EAAE,OAAO,EACrB,IAAI,EAAE,gBAAgB,IACtB,CAAC;gBACH,MAAM,IAAI,qBAAqB,CAAC;oBAC9B,IAAI,EAAE,kCAAkC;oBACxC,aAAa,EAAE,OAAO,aAAP,OAAO,uBAAP,OAAO,CAAE,aAAa;oBACrC,WAAW,EAAE,WAAW,CAAC,WAAW;iBACrC,CAAC,CAAC;YACL,CAAC;YAED,IAAI,CAAC;gBACH,MAAM,KAAK,GAAG,aAAa,CAAC,WAAW,EAAE,OAAO,EAAE,OAAO,CAAC,CAAC;gBAC3D,OAAO,iCACF,kBAAkB,KACrB,IAAI,EAAE,mBAAmB,IACzB,CAAC;gBACH,OAAO,KAAK,CAAC;YACf,CAAC;YAAC,OAAO,KAAK,EAAE,CAAC;gBACf,OAAO,iCACF,kBAAkB,KACrB,YAAY,EAAE,OAAO,EACrB,IAAI,EAAE,gBAAgB,IACtB,CAAC;gBACH,MAAM,KAAK,YAAY,qBAAqB;oBAC1C,CAAC,CAAC,KAAK;oBACP,CAAC,CAAC,IAAI,qBAAqB,CAAC;wBACxB,IAAI,EAAE,sBAAsB;wBAC5B,aAAa,EAAE,OAAO,aAAP,OAAO,uBAAP,OAAO,CAAE,aAAa;wBACrC,WAAW,EAAE,WAAW,CAAC,WAAW;qBACrC,CAAC,CAAC;YACT,CAAC;QACH,CAAC;KAAA;IAED,OAAO,MAAM,CAAC,MAAM,CAAC;QACnB,GAAG;QACG,aAAa,CAGjB,UAMD;;gBACC,MAAM,OAAO,GAAG,MAAM,GAAG,CACvB,UAAU,CAAC,WAAW,EACtB,UAAU,CAAC,SAAS,EACpB,UAAU,CAAC,OAAO,CACnB,CAAC;gBACF,IAAI,CAAC;oBACH,OAAO,MAAM,UAAU,CAAC,SAAS,CAAC,OAAO,CAAC,CAAC;gBAC7C,CAAC;gBAAC,OAAO,KAAK,EAAE,CAAC;oBACf,IAAI,CAAC,UAAU,CAAC,uBAAuB,CAAC,KAAK,CAAC,EAAE,CAAC;wBAC/C,MAAM,KAAK,CAAC;oBACd,CAAC;gBACH,CAAC;gBACD,OAAO,CAAC;oBACN,aAAa,EAAE,iBAAiB,CAAC,UAAU,CAAC,OAAO,CAAC;oBACpD,WAAW,EAAE,UAAU,CAAC,WAAW,CAAC,WAAW;oBAC/C,IAAI,EAAE,sBAAsB;iBAC7B,CAAC,CAAC;gBACH,MAAM,SAAS,GAAG,MAAM,GAAG,CACzB,UAAU,CAAC,WAAW,EACtB,UAAU,CAAC,SAAS,EACpB,UAAU,CAAC,OAAO,CACnB,CAAC;gBACF,OAAO,UAAU,CAAC,SAAS,CAAC,SAAS,CAAC,CAAC;YACzC,CAAC;SAAA;KACF,CAAC,CAAC;AACL,CAAC"}

package/src/secrets/resolver.d.ts

@@ -0,0 +1,125 @@
+import { GetSecretValueCommand, type GetSecretValueCommandOutput } from '@aws-sdk/client-secrets-manager';
+import { type DefinedSecret, type SecretReference, type SecretValueOf, type SecretValuePayload, type SecretValueSchema } from './contract.js';
+declare const SERVER_RUNTIME_BRAND: unique symbol;
+export declare const DEFAULT_SECRET_CACHE_MAX_ENTRIES: 64;
+export declare const MAX_SECRET_CACHE_MAX_ENTRIES: 1024;
+export declare const SECRET_SOURCE_FAILURE_CLASSES: readonly ["access-denied", "availability", "missing", "other"];
+export type SecretSourceFailureClass = (typeof SECRET_SOURCE_FAILURE_CLASSES)[number];
+export interface SecretSourceRequest {
+    logicalName: string;
+    secretArn: string;
+    versionStage: 'AWSCURRENT';
+}
+export interface SecretSourceValue extends SecretValuePayload {
+    versionStages: readonly string[];
+}
+export interface SecretSource {
+    getCurrentValue(request: SecretSourceRequest): Promise<SecretSourceValue>;
+}
+export declare class SecretSourceError extends Error {
+    readonly code: string;
+    readonly failureClass: SecretSourceFailureClass;
+    constructor(failureClass: SecretSourceFailureClass, code: string);
+}
+export declare const SECRET_RESOLUTION_ERROR_CODES: readonly ["secret-access-denied", "secret-current-version-missing", "secret-cache-capacity-exceeded", "secret-reference-invalid", "secret-reference-mismatch", "secret-refresh-invalidated", "secret-personal-source-forbidden", "secret-personal-stage-invalid", "secret-runtime-configuration-invalid", "secret-runtime-unbound", "secret-source-failed", "secret-source-missing", "secret-source-unavailable", "secret-value-malformed"];
+export type SecretResolutionErrorCode = (typeof SECRET_RESOLUTION_ERROR_CODES)[number];
+export declare class SecretResolutionError extends Error {
+    readonly code: SecretResolutionErrorCode;
+    readonly correlationId: string;
+    readonly logicalName: string;
+    readonly staleEligible: boolean;
+    constructor(input: {
+        code: SecretResolutionErrorCode;
+        correlationId?: string;
+        logicalName: string;
+        staleEligible?: boolean;
+    });
+}
+export interface ServerSecretRuntimeBinding {
+    readonly [SERVER_RUNTIME_BRAND]: true;
+    readonly stage: string;
+    readonly workload: string;
+}
+export interface SecretResolutionContext {
+    correlationId?: string;
+}
+export type SecretResolverObservation = {
+    correlationId: string;
+    logicalName: string;
+    type: 'authentication-retry';
+} | {
+    correlationId: string;
+    logicalName: string;
+    reason: 'authentication-failure' | 'explicit' | 'rotation';
+    type: 'cache-invalidated';
+} | {
+    ageMs: number;
+    correlationId: string;
+    logicalName: string;
+    type: 'cache-hit';
+} | {
+    correlationId: string;
+    failureClass: SecretSourceFailureClass;
+    logicalName: string;
+    type: 'refresh-failed';
+} | {
+    correlationId: string;
+    logicalName: string;
+    type: 'refresh-started' | 'refresh-succeeded';
+} | {
+    ageMs: number;
+    correlationId: string;
+    logicalName: string;
+    retryAfterMs: number;
+    type: 'stale-value-used';
+};
+export interface SecretResolverHooks {
+    /**
+     * These are sanitized lifecycle facts, not log records. Workstream A owns
+     * the canonical record, operation, severity, and metric rendering.
+     */
+    observe?(observation: SecretResolverObservation): void;
+}
+export interface SecretResolverClock {
+    now(): number;
+}
+export interface SecretResolverCachePolicy {
+    freshTtlMs?: number;
+    maximumEntries?: number;
+    staleTtlMs?: number;
+}
+export interface SecretResolverBackoffPolicy {
+    initialMs?: number;
+    maximumMs?: number;
+}
+export interface CreateServerSecretResolverOptions {
+    backoff?: SecretResolverBackoffPolicy;
+    binding: ServerSecretRuntimeBinding;
+    cache?: SecretResolverCachePolicy;
+    clock?: SecretResolverClock;
+    hooks?: SecretResolverHooks;
+    source: SecretSource;
+}
+export interface RunWithSecretOptions<Declaration extends DefinedSecret<string, SecretValueSchema<unknown>>, Result> {
+    context?: SecretResolutionContext;
+    declaration: Declaration;
+    isAuthenticationFailure(error: unknown): boolean;
+    operation(value: SecretValueOf<Declaration>): Promise<Result>;
+    reference: SecretReference;
+}
+export interface ServerSecretResolver {
+    get<Declaration extends DefinedSecret<string, SecretValueSchema<unknown>>>(declaration: Declaration, reference: SecretReference, context?: SecretResolutionContext): Promise<SecretValueOf<Declaration>>;
+    invalidate<Declaration extends DefinedSecret<string, SecretValueSchema<unknown>>>(declaration: Declaration, reference: SecretReference, reason?: 'authentication-failure' | 'explicit' | 'rotation', context?: SecretResolutionContext): void;
+    runWithSecret<Declaration extends DefinedSecret<string, SecretValueSchema<unknown>>, Result>(options: RunWithSecretOptions<Declaration, Result>): Promise<Result>;
+}
+interface AwsSecretsManagerClient {
+    send(command: GetSecretValueCommand): Promise<GetSecretValueCommandOutput>;
+}
+export declare function assertServerSecretRuntimeBinding(value: unknown): asserts value is ServerSecretRuntimeBinding;
+export declare function bindServerSecretRuntime(input: {
+    stage: string;
+    workload: string;
+}): ServerSecretRuntimeBinding;
+export declare function createAwsSecretsManagerSource(client?: AwsSecretsManagerClient): SecretSource;
+export declare function createServerSecretResolver(options: CreateServerSecretResolverOptions): ServerSecretResolver;
+export {};