@factorialco/fcode-cli 1.5.0 → 2.1.0

package/dist/services/auth-service.js

@@ -7,6 +7,15 @@ const global_1 = require("../config/global");
 const color_1 = require("@oclif/color");
 const AUTH_URL_PATH = '/protocol/openid-connect';
 const AUTH_CLIENT_ID = 'cli';
+// Refresh this long before the access token actually expires, so a token
+// snapshotted at command init doesn't die mid-command.
+const TOKEN_EXPIRY_MARGIN_SECONDS = 300;
+function withExpiresAt(token) {
+    if (typeof token.expires_in === 'number') {
+        return { ...token, expires_at: Math.floor(Date.now() / 1000) + token.expires_in };
+    }
+    return token;
+}
 const AuthService = {
     clientId: process.env.FCODE_CLIENT_ID || AUTH_CLIENT_ID,
     async getToken({ authUrl, email, password, clientId, clientSecret }) {
@@ -44,7 +53,7 @@ const AuthService = {
         });
         const token = await response.json();
         if (response.ok) {
-            return token;
+            return withExpiresAt(token);
         }
         throw token.error_description;
     },
@@ -64,14 +73,21 @@ const AuthService = {
     globalConfig: new global_1.default(),
     async isAuthenticated(url) {
         try {
-            const { authUrl, token } = await this.globalConfig.getAuthInfo(url);
+            const authInfo = await this.globalConfig.getAuthInfo(url);
+            const { authUrl, token } = authInfo;
             try {
+                if (this.isTokenExpiring(token)) {
+                    throw new Error('Access token expired or about to expire');
+                }
                 await this.getUserInfo(authUrl, token);
             }
             catch (error) {
-                await this.globalConfig.clearAuthInfo(url);
-                cli_1.default.log(color_1.default.yellow('🚪  Session expired, please login again'));
-                throw error;
+                const refreshed = await this.tryRefresh(url, authInfo);
+                if (!refreshed) {
+                    await this.globalConfig.clearAuthInfo(url);
+                    cli_1.default.log(color_1.default.yellow('🚪  Session expired, please login again'));
+                    throw error;
+                }
             }
             return true;
         }
@@ -79,6 +95,41 @@ const AuthService = {
             return false;
         }
     },
+    isTokenExpiring(token) {
+        return token.expires_at !== undefined && Date.now() / 1000 >= token.expires_at - TOKEN_EXPIRY_MARGIN_SECONDS;
+    },
+    async refreshToken(authUrl, refreshToken) {
+        const body = new URLSearchParams({
+            client_id: this.clientId,
+            grant_type: 'refresh_token',
+            refresh_token: refreshToken,
+        });
+        const response = await (0, node_fetch_1.default)(`${authUrl}${AUTH_URL_PATH}/token`, {
+            body: body.toString(),
+            headers: {
+                'Content-Type': 'application/x-www-form-urlencoded',
+            },
+            method: 'POST',
+        });
+        const token = await response.json();
+        if (response.ok) {
+            return withExpiresAt(token);
+        }
+        throw token.error_description;
+    },
+    async tryRefresh(url, { authUrl, token, userInfo }) {
+        if (!token.refresh_token) {
+            return false;
+        }
+        try {
+            const refreshedToken = await this.refreshToken(authUrl, token.refresh_token);
+            await this.globalConfig.setAuthInfo(url, { authUrl, token: refreshedToken, userInfo });
+            return true;
+        }
+        catch {
+            return false;
+        }
+    },
     async login({ url, authUrl, email, password, clientId, clientSecret, accessToken }) {
         const token = accessToken
             ? { access_token: accessToken, refresh_token: '' }

package/dist/services/fcode-graphql-client.d.ts

@@ -1,5 +1,5 @@
 import { GraphQLClient } from 'graphql-request';
-import { Process, ProgrammingLanguage, ProgrammingLanguageManifest, RawTeamSettings, ScriptLibrary, TeamUpdateInput, Variable, VersionedProcess, VersionedScriptLibrary, ServiceAccount } from '../core/types';
+import { Process, ProgrammingLanguage, ProgrammingLanguageManifest, RawTeamSettings, ScriptLibrary, TeamUpdateInput, TeamVersion, TeamVersionAlias, Variable, VersionedProcess, VersionedScriptLibrary, ServiceAccount } from '../core/types';
 export type FcodeGraphQLClientOptions = {
     url: string;
     accessToken: string;
@@ -32,8 +32,27 @@ declare class FcodeGraphQLClient {
     removeVariable(id: String | undefined): Promise<Process>;
     programmingLanguageManifest(programmingLanguage: ProgrammingLanguage): Promise<ProgrammingLanguageManifest>;
     private inheritedTeam;
+    /**
+     * The public mode and the default header name are left out, so a public webhook — or one
+     * using the default header — keeps the metadata.json it already had on disk.
+     */
     private mapWebhook;
     mapProcess({ id, slug, name, description, tags, script, readme, manifest, settings, triggers, resolvingTeamSlug }: any): Process;
+    /**
+     * GraphQL nests the webhook configuration under `settings`, while team.json and the REST API
+     * keep it flat. Mapping it explicitly is what keeps that mismatch from silently reading as
+     * undefined.
+     */
+    mapTeamSettings(team: any): RawTeamSettings;
+    mapTeamVersion(teamVersion: any): TeamVersion;
+    mapTeamVersionAlias(alias: any): TeamVersionAlias;
+    allTeamVersions(): Promise<Array<TeamVersion>>;
+    createTeamVersion(tag: string, comment?: string): Promise<TeamVersion>;
+    deleteTeamVersion(tag: string): Promise<TeamVersion>;
+    allTeamVersionAliases(): Promise<Array<TeamVersionAlias>>;
+    /** The API upserts: an existing alias with the same name is re-pointed to the tag. */
+    createTeamVersionAlias(name: string, tag: string): Promise<TeamVersionAlias>;
+    deleteTeamVersionAlias(id: string): Promise<TeamVersionAlias>;
     team(): Promise<RawTeamSettings>;
     pushTeam(update: TeamUpdateInput): Promise<RawTeamSettings>;
     mapProgrammingLanguageManifest(programmingLanguageManifest: any): ProgrammingLanguageManifest;

package/dist/services/fcode-graphql-client.js

@@ -3,6 +3,31 @@ Object.defineProperty(exports, "__esModule", { value: true });
 const graphql_request_1 = require("graphql-request");
 const types_1 = require("../core/types");
 const _ = require("lodash");
+// Shared team version selections so every query/mutation returns the same shape.
+const TEAM_VERSION_FIELDS = `
+  id
+  tag
+  comment
+  createdAt
+  createdBy {
+    id
+    name
+  }
+  manifest {
+    resourceType
+    resourceId
+    slug
+    outcome
+    error
+  }
+`;
+const TEAM_VERSION_ALIAS_FIELDS = `
+  id
+  name
+  tag
+  createdAt
+  updatedAt
+`;
 // Shared process selection so pull queries and push mutations return the same
 // fields, keeping mapProcess (and therefore contentHash) consistent.
 const PROCESS_FIELDS = `
@@ -21,15 +46,10 @@ const PROCESS_FIELDS = `
   triggers {
     webhook {
       enabled
+      authMode
       auth {
-        basicAuth {
-          username
-          password
-          expression {
-            username
-            password
-          }
-        }
+        headerName
+        variableKey
       }
     }
   }
@@ -44,6 +64,7 @@ const PROCESS_FIELDS = `
     formSettings {
       enabled
       appRole
+      authMode
     }
     dependencies {
       scopedToProcess
@@ -240,33 +261,46 @@ class FcodeGraphQLClient {
             return Promise.reject(this.cleanError(error));
         });
     }
-    allVariables() {
-        return this.client
-            .request((0, graphql_request_1.gql) `
-          query teamVariables($first: Int!, $after: String) {
-            teamVariables(first: $first, after: $after) {
-              edges {
-                node {
-                  id
-                  key
-                  value
-                  isSensitive
+    // Pages through every variable: a workspace lists its own plus the ones inherited from
+    // its parent workspaces, so a single page is not enough to be sure nothing is missed.
+    async allVariables() {
+        const pageSize = 200;
+        const variables = [];
+        let after = null;
+        try {
+            do {
+                const { teamVariables: { edges, pageInfo }, } = await this.client.request((0, graphql_request_1.gql) `
+            query teamVariables($first: Int!, $after: String) {
+              teamVariables(first: $first, after: $after) {
+                edges {
+                  node {
+                    id
+                    key
+                    value
+                    isSensitive
+                    resolvingTeamSlug
+                  }
+                }
+                pageInfo {
+                  hasNextPage
+                  endCursor
                 }
-              }
-              pageInfo {
-                hasNextPage
-                endCursor
               }
             }
-          }
-        `, {
-            after: null,
-            first: 200,
-        })
-            .then(({ teamVariables: { edges } }) => edges.map(({ node: { id, isSensitive, key, value } }) => new types_1.Variable(id, key, value, isSensitive)))
-            .catch((error) => {
+          `, {
+                    after,
+                    first: pageSize,
+                });
+                for (const { node: { id, isSensitive, key, value, resolvingTeamSlug }, } of edges) {
+                    variables.push(new types_1.Variable(id, key, value, isSensitive, this.inheritedTeam(resolvingTeamSlug)));
+                }
+                after = pageInfo?.hasNextPage ? pageInfo.endCursor : null;
+            } while (after);
+        }
+        catch (error) {
             return Promise.reject(this.cleanError(error));
-        });
+        }
+        return variables;
     }
     toProcessInput(process, includeCreateOnly) {
         const settings = {
@@ -277,6 +311,9 @@ class FcodeGraphQLClient {
             if (process.form.appRole) {
                 settings.formSettings.appRole = process.form.appRole;
             }
+            if (process.form.authMode) {
+                settings.formSettings.authMode = process.form.authMode;
+            }
         }
         const input = {
             name: process.name,
@@ -292,11 +329,17 @@ class FcodeGraphQLClient {
         }
         if (process.webhook) {
             const webhook = { enabled: process.webhook.enabled };
-            if (process.webhook.username !== undefined) {
-                webhook.username = process.webhook.username;
-            }
-            if (process.webhook.password !== undefined) {
-                webhook.password = process.webhook.password;
+            // Forwarded including an explicit NONE, so a webhook can be un-protected from
+            // metadata.json; omitting the mode leaves the stored one in place.
+            if (process.webhook.authMode !== undefined) {
+                webhook.authMode = process.webhook.authMode;
+                if (process.webhook.auth) {
+                    const auth = { variableKey: process.webhook.auth.variableKey };
+                    if (process.webhook.auth.headerName !== undefined) {
+                        auth.headerName = process.webhook.auth.headerName;
+                    }
+                    webhook.auth = auth;
+                }
             }
             input.webhook = webhook;
         }
@@ -532,23 +575,24 @@ class FcodeGraphQLClient {
     inheritedTeam(resolvingTeamSlug) {
         return resolvingTeamSlug && resolvingTeamSlug !== this.teamSlug ? resolvingTeamSlug : undefined;
     }
+    /**
+     * The public mode and the default header name are left out, so a public webhook — or one
+     * using the default header — keeps the metadata.json it already had on disk.
+     */
     mapWebhook(triggers) {
         const webhookTrigger = triggers?.webhook;
         if (!webhookTrigger) {
             return undefined;
         }
         const webhook = { enabled: Boolean(webhookTrigger.enabled) };
-        const basicAuth = webhookTrigger.auth?.basicAuth;
-        if (basicAuth) {
-            // Prefer the expression form (env-var placeholders like $WEBHOOK_PASSWORD)
-            // over the resolved literal so placeholders round-trip on pull.
-            const username = basicAuth.expression?.username ?? basicAuth.username;
-            const password = basicAuth.expression?.password ?? basicAuth.password;
-            if (username != null) {
-                webhook.username = username;
-            }
-            if (password != null) {
-                webhook.password = password;
+        if (webhookTrigger.authMode && webhookTrigger.authMode !== 'NONE') {
+            webhook.authMode = webhookTrigger.authMode;
+            if (webhookTrigger.auth?.variableKey) {
+                const auth = { variableKey: webhookTrigger.auth.variableKey };
+                if (webhookTrigger.auth.headerName && webhookTrigger.auth.headerName !== types_1.DEFAULT_WEBHOOK_AUTH_HEADER) {
+                    auth.headerName = webhookTrigger.auth.headerName;
+                }
+                webhook.auth = auth;
             }
         }
         return webhook;
@@ -570,9 +614,143 @@ class FcodeGraphQLClient {
             if (settings.formSettings.appRole && settings.formSettings.appRole !== 'NONE') {
                 metadata.form.appRole = settings.formSettings.appRole;
             }
+            if (settings.formSettings.authMode && settings.formSettings.authMode !== 'NONE') {
+                metadata.form.authMode = settings.formSettings.authMode;
+            }
         }
         return new types_1.Process(id, slug, script, readme, { dependencies }, settings, metadata, this.inheritedTeam(resolvingTeamSlug));
     }
+    /**
+     * GraphQL nests the webhook configuration under `settings`, while team.json and the REST API
+     * keep it flat. Mapping it explicitly is what keeps that mismatch from silently reading as
+     * undefined.
+     */
+    mapTeamSettings(team) {
+        const settings = {
+            slug: team.slug,
+            zoneId: team.zoneId,
+            errorHandlerConfig: team.errorHandlerConfig,
+            parentTeamSlugs: team.parentTeamSlugs ?? [],
+        };
+        const webhookAuth = team.settings?.webhookAuth;
+        if (webhookAuth?.variableKey) {
+            settings.webhookAuth = { variableKey: webhookAuth.variableKey };
+            if (webhookAuth.headerName && webhookAuth.headerName !== types_1.DEFAULT_WEBHOOK_AUTH_HEADER) {
+                settings.webhookAuth.headerName = webhookAuth.headerName;
+            }
+        }
+        return settings;
+    }
+    mapTeamVersion(teamVersion) {
+        return {
+            id: teamVersion.id,
+            tag: teamVersion.tag,
+            comment: teamVersion.comment ?? null,
+            manifest: (teamVersion.manifest ?? []).map((entry) => ({
+                resourceType: entry.resourceType,
+                resourceId: entry.resourceId,
+                slug: entry.slug,
+                outcome: entry.outcome,
+                error: entry.error ?? null,
+            })),
+            createdAt: teamVersion.createdAt,
+            createdBy: teamVersion.createdBy ?? null,
+        };
+    }
+    mapTeamVersionAlias(alias) {
+        return {
+            id: alias.id,
+            name: alias.name,
+            tag: alias.tag,
+            createdAt: alias.createdAt,
+            updatedAt: alias.updatedAt ?? null,
+        };
+    }
+    allTeamVersions() {
+        return this.client
+            .request((0, graphql_request_1.gql) `
+          query allTeamVersions {
+            allTeamVersions {
+              ${TEAM_VERSION_FIELDS}
+            }
+          }
+        `)
+            .then(({ allTeamVersions }) => allTeamVersions.map((teamVersion) => this.mapTeamVersion(teamVersion)))
+            .catch((error) => {
+            return Promise.reject(this.cleanError(error));
+        });
+    }
+    createTeamVersion(tag, comment) {
+        return this.client
+            .request((0, graphql_request_1.gql) `
+          mutation createTeamVersion($tag: String!, $comment: String) {
+            createTeamVersion(tag: $tag, comment: $comment) {
+              ${TEAM_VERSION_FIELDS}
+            }
+          }
+        `, { tag, comment: comment ?? null })
+            .then(({ createTeamVersion }) => this.mapTeamVersion(createTeamVersion))
+            .catch((error) => {
+            return Promise.reject(this.cleanError(error));
+        });
+    }
+    deleteTeamVersion(tag) {
+        return this.client
+            .request((0, graphql_request_1.gql) `
+          mutation deleteTeamVersion($tag: String!) {
+            deleteTeamVersion(tag: $tag) {
+              ${TEAM_VERSION_FIELDS}
+            }
+          }
+        `, { tag })
+            .then(({ deleteTeamVersion }) => this.mapTeamVersion(deleteTeamVersion))
+            .catch((error) => {
+            return Promise.reject(this.cleanError(error));
+        });
+    }
+    allTeamVersionAliases() {
+        return this.client
+            .request((0, graphql_request_1.gql) `
+          query allTeamVersionAliases {
+            allTeamVersionAliases {
+              ${TEAM_VERSION_ALIAS_FIELDS}
+            }
+          }
+        `)
+            .then(({ allTeamVersionAliases }) => allTeamVersionAliases.map((alias) => this.mapTeamVersionAlias(alias)))
+            .catch((error) => {
+            return Promise.reject(this.cleanError(error));
+        });
+    }
+    /** The API upserts: an existing alias with the same name is re-pointed to the tag. */
+    createTeamVersionAlias(name, tag) {
+        return this.client
+            .request((0, graphql_request_1.gql) `
+          mutation createTeamVersionAlias($input: TeamVersionAliasInput!) {
+            createTeamVersionAlias(input: $input) {
+              ${TEAM_VERSION_ALIAS_FIELDS}
+            }
+          }
+        `, { input: { name, tag } })
+            .then(({ createTeamVersionAlias }) => this.mapTeamVersionAlias(createTeamVersionAlias))
+            .catch((error) => {
+            return Promise.reject(this.cleanError(error));
+        });
+    }
+    deleteTeamVersionAlias(id) {
+        return this.client
+            .request((0, graphql_request_1.gql) `
+          mutation deleteTeamVersionAlias($id: ID!) {
+            deleteTeamVersionAlias(id: $id) {
+              ${TEAM_VERSION_ALIAS_FIELDS}
+            }
+          }
+        `, { id })
+            .then(({ deleteTeamVersionAlias }) => this.mapTeamVersionAlias(deleteTeamVersionAlias))
+            .catch((error) => {
+            return Promise.reject(this.cleanError(error));
+        });
+    }
     team() {
         return this.client
             .request((0, graphql_request_1.gql) `
@@ -585,10 +763,16 @@ class FcodeGraphQLClient {
                 tag
               }
               parentTeamSlugs
+              settings {
+                webhookAuth {
+                  headerName
+                  variableKey
+                }
+              }
             }
           }
         `, { slug: this.teamSlug })
-            .then(({ team }) => team)
+            .then(({ team }) => this.mapTeamSettings(team))
             .catch((error) => {
             return Promise.reject(this.cleanError(error));
         });
@@ -605,10 +789,16 @@ class FcodeGraphQLClient {
                 tag
               }
               parentTeamSlugs
+              settings {
+                webhookAuth {
+                  headerName
+                  variableKey
+                }
+              }
             }
           }
         `, { slug: this.teamSlug, update })
-            .then(({ updateTeam: team }) => team)
+            .then(({ updateTeam: team }) => this.mapTeamSettings(team))
             .catch((error) => {
             return Promise.reject(this.cleanError(error));
         });

package/dist/services/oauth-browser-service.js

@@ -144,6 +144,7 @@ async function loginViaBrowser(url, authUrl, clientId) {
         const token = {
             access_token: tokenSet.access_token ?? '',
             refresh_token: tokenSet.refresh_token ?? '',
+            expires_at: tokenSet.expires_at,
         };
         const userInfo = await auth_service_1.default.getUserInfo(normalizedAuthUrl, token);
         const authInfo = {

package/dist/services/webhook-auth.d.ts

@@ -0,0 +1,21 @@
+import type * as http from 'node:http';
+import { ProcessWebhook, WebhookAuth } from '../core/types';
+export type WebhookAuthResult = {
+    authorized: true;
+} | {
+    authorized: false;
+    reason: string;
+};
+/**
+ * Node lower-cases incoming header names, while a configured name is stored as the user typed it,
+ * so the lookup has to be case-insensitive. A repeated header arrives as an array and is rejected
+ * rather than joined: a spliced value must never authenticate.
+ */
+export declare function findHeader(headers: http.IncomingHttpHeaders, name: string): string | undefined;
+/**
+ * The configuration a webhook actually enforces: its own when CUSTOM, the workspace's when TEAM.
+ * Returns null only when the webhook is public — TEAM without a workspace configuration throws,
+ * because treating it as public would silently unprotect a webhook its owner chose to protect.
+ */
+export declare function resolveEffectiveAuth(webhook: ProcessWebhook | undefined, teamWebhookAuth: WebhookAuth | undefined): WebhookAuth | null;
+export declare function checkWebhookAuth(effectiveAuth: WebhookAuth | null, headers: http.IncomingHttpHeaders, variableValue: string | undefined): WebhookAuthResult;

package/dist/services/webhook-auth.js

@@ -0,0 +1,77 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.findHeader = findHeader;
+exports.resolveEffectiveAuth = resolveEffectiveAuth;
+exports.checkWebhookAuth = checkWebhookAuth;
+const crypto = require("node:crypto");
+const types_1 = require("../core/types");
+/**
+ * Mirrors the cloud's webhook authentication so `fcode http` accepts and rejects exactly what the
+ * platform does. The scheme in the default Authorization header is case-insensitive per RFC 7235;
+ * the token is not. A custom header carries the raw value, with no scheme to parse.
+ */
+const BEARER_PATTERN = /^Bearer[ \t]+(\S+)[ \t]*$/i;
+/**
+ * Node lower-cases incoming header names, while a configured name is stored as the user typed it,
+ * so the lookup has to be case-insensitive. A repeated header arrives as an array and is rejected
+ * rather than joined: a spliced value must never authenticate.
+ */
+function findHeader(headers, name) {
+    const lowerCased = name.toLowerCase();
+    for (const [key, value] of Object.entries(headers)) {
+        if (key.toLowerCase() === lowerCased) {
+            return typeof value === 'string' ? value : undefined;
+        }
+    }
+    return undefined;
+}
+/**
+ * The configuration a webhook actually enforces: its own when CUSTOM, the workspace's when TEAM.
+ * Returns null only when the webhook is public — TEAM without a workspace configuration throws,
+ * because treating it as public would silently unprotect a webhook its owner chose to protect.
+ */
+function resolveEffectiveAuth(webhook, teamWebhookAuth) {
+    const authMode = webhook?.authMode;
+    if (!authMode || authMode === 'NONE') {
+        return null;
+    }
+    if (authMode === 'TEAM') {
+        if (!teamWebhookAuth) {
+            throw new Error('this webhook inherits the workspace webhook auth, which is not set in team.json');
+        }
+        return teamWebhookAuth;
+    }
+    if (!webhook?.auth?.variableKey) {
+        throw new Error('this webhook uses the CUSTOM auth mode but names no variable in metadata.json');
+    }
+    return webhook.auth;
+}
+/** Constant-time over equal-length digests, so neither the token nor its length leaks. */
+function matches(expectedToken, givenToken) {
+    const digest = (value) => crypto.createHash('sha256').update(value, 'utf8').digest();
+    return crypto.timingSafeEqual(digest(expectedToken), digest(givenToken));
+}
+function checkWebhookAuth(effectiveAuth, headers, variableValue) {
+    if (effectiveAuth === null) {
+        return { authorized: true };
+    }
+    const headerName = effectiveAuth.headerName ?? types_1.DEFAULT_WEBHOOK_AUTH_HEADER;
+    const headerValue = findHeader(headers, headerName);
+    if (headerValue === undefined || headerValue.trim().length === 0) {
+        return { authorized: false, reason: `the ${headerName} header is missing` };
+    }
+    let givenToken = headerValue;
+    if (headerName.toLowerCase() === types_1.DEFAULT_WEBHOOK_AUTH_HEADER.toLowerCase()) {
+        givenToken = BEARER_PATTERN.exec(headerValue)?.[1];
+        if (givenToken === undefined) {
+            return { authorized: false, reason: `the ${headerName} header is not a bearer token` };
+        }
+    }
+    if (variableValue === undefined) {
+        return { authorized: false, reason: `the ${effectiveAuth.variableKey} variable is not defined` };
+    }
+    if (!matches(variableValue, givenToken)) {
+        return { authorized: false, reason: `the value sent in ${headerName} does not match ${effectiveAuth.variableKey}` };
+    }
+    return { authorized: true };
+}

package/dist/utils/gitignore.d.ts

@@ -13,5 +13,7 @@ export declare function renderGitignoreWithInherited(existing: string, inherited
  * Refreshes the workspace .gitignore so inherited processes/modules (owned by a
  * parent team and pulled read-only) are not tracked by git. Regenerated from the
  * current workspace metadata, so resources that stop being inherited drop out.
+ * Inherited variable values live in one file, which is ignored as soon as the
+ * workspace inherits any variable.
  */
 export declare function syncInheritedGitignore(workspaceDir?: string): Promise<void>;

package/dist/utils/gitignore.js

@@ -6,6 +6,8 @@ exports.syncInheritedGitignore = syncInheritedGitignore;
 const path = require("node:path");
 const fs = require("fs-extra");
 const workspace_1 = require("../config/workspace");
+const global_1 = require("../config/global");
+const settings_1 = require("../config/settings");
 const filenamify_1 = require("./filenamify");
 const file_utils_1 = require("./file-utils");
 exports.INHERITED_BLOCK_START = '# BEGIN fcode inherited resources (auto-generated, do not edit)';
@@ -43,9 +45,12 @@ function stripManagedBlock(content) {
  * Refreshes the workspace .gitignore so inherited processes/modules (owned by a
  * parent team and pulled read-only) are not tracked by git. Regenerated from the
  * current workspace metadata, so resources that stop being inherited drop out.
+ * Inherited variable values live in one file, which is ignored as soon as the
+ * workspace inherits any variable.
  */
 async function syncInheritedGitignore(workspaceDir = process.cwd()) {
     const team = await new workspace_1.default(workspaceDir).getActiveTeam();
+    const inheritedVariablesFileName = await new global_1.default().getSetting(settings_1.SettingKeys.INHERITED_VARIABLES_FILE_NAME);
     const inheritedPaths = [
         ...Object.values(team.processes)
             .filter((process) => process.resolvingTeamSlug)
@@ -53,6 +58,7 @@ async function syncInheritedGitignore(workspaceDir = process.cwd()) {
         ...Object.values(team.modules)
             .filter((module) => module.resolvingTeamSlug)
             .map((module) => `modules/${(0, filenamify_1.default)(module.name)}/`),
+        ...(Object.values(team.variables ?? {}).some((variable) => variable.resolvingTeamSlug) ? [inheritedVariablesFileName] : []),
     ];
     const gitignorePath = path.join(workspaceDir, '.gitignore');
     const existing = fs.existsSync(gitignorePath) ? fs.readFileSync(gitignorePath, 'utf8') : '';