Scope secret refs sync deletes and harden AWS gateway errors

server/src/secrets/aws-secrets-manager-provider.ts

@@ -748,7 +748,15 @@ class AwsSecretsManagerJsonGateway implements AwsSecretsManagerGateway {
     if (!response.ok) {
       const code = String(parsed.__type ?? parsed.code ?? parsed.Code ?? response.statusText ?? "UnknownError");
       const message = String(parsed.message ?? parsed.Message ?? code);
-      throw new Error(`${code}: ${message}`);
+      const rawMessage = `${code}: ${message}`;
+      const clientCode = classifyAwsProviderError(rawMessage);
+      throw new SecretProviderClientError({
+        code: clientCode,
+        provider: "aws_secrets_manager",
+        operation,
+        message: awsProviderSafeMessage(clientCode),
+        rawMessage,
+      });
     }
 
     return parsed as T;

server/src/services/secrets.ts

@@ -1842,16 +1842,33 @@ export function secretService(db: Db) {
         });
       }
 
+      const pathPrefixes = [...new Set(normalizedRefs.map((ref) => ref.configPath.split(".")[0]))];
+
       await db.transaction(async (tx) => {
-        await tx
-          .delete(companySecretBindings)
-          .where(
-            and(
-              eq(companySecretBindings.companyId, companyId),
-              eq(companySecretBindings.targetType, target.targetType),
-              eq(companySecretBindings.targetId, target.targetId),
-            ),
-          );
+        if (pathPrefixes.length > 0) {
+          for (const pathPrefix of pathPrefixes) {
+            await tx
+              .delete(companySecretBindings)
+              .where(
+                and(
+                  eq(companySecretBindings.companyId, companyId),
+                  eq(companySecretBindings.targetType, target.targetType),
+                  eq(companySecretBindings.targetId, target.targetId),
+                  like(companySecretBindings.configPath, `${pathPrefix}.%`),
+                ),
+              );
+          }
+        } else {
+          await tx
+            .delete(companySecretBindings)
+            .where(
+              and(
+                eq(companySecretBindings.companyId, companyId),
+                eq(companySecretBindings.targetType, target.targetType),
+                eq(companySecretBindings.targetId, target.targetId),
+              ),
+            );
+        }
         if (normalizedRefs.length === 0) return;
         await tx.insert(companySecretBindings).values(
           normalizedRefs.map((ref) => ({