@fjall/components-infrastructure 2.21.0 → 2.22.0

package/dist/lib/patterns/aws/compute.js

@@ -2,6 +2,7 @@ import { Token } from "aws-cdk-lib";
 import { Runtime } from "aws-cdk-lib/aws-lambda";
 import { isCompute, isEcsCompute, isLambdaCompute, isEc2Compute } from "./interfaces/compute.js";
 import { warnIfPropertiesIgnored } from "../../utils/validationLogger.js";
+import { applyInferredPublicBuildArgs } from "./computeBuildArgInference.js";
 import { DEFAULT_ECS_FALLBACK_IMAGE, DEFAULT_EC2_INSTANCE_TYPE } from "../../resources/aws/compute/ecsConstants.js";
 // Import and re-export from per-pattern files
 import { EcsCompute, ECS_CAPACITY_PROVIDER_CONFIG, getEcsCapacityProviderConfig, ScalingType, validateEcsProps, buildContainerConfigs, expandMigrationsSugar, resolveScalingConfig } from "./computeEcs.js";
@@ -163,6 +164,11 @@ export class ComputeFactory {
                     const clusterName = id;
                     const appName = computeProps.appName ?? app.getName();
                     for (const service of computeProps.services) {
+                        // Promote public-prefixed declared-env vars into docker.buildArgs
+                        // (with their values) BEFORE the manifest copy and before the
+                        // synth-time bake-guard runs in the EcsCompute constructor below —
+                        // a secret-shaped inferred value must be caught by that guard.
+                        applyInferredPublicBuildArgs(service);
                         const manifestService = {
                             name: service.name,
                             clusterName

package/dist/lib/patterns/aws/computeBuildArgInference.d.ts

@@ -0,0 +1,43 @@
+/**
+ * Synth-time public build-arg inference (Phase 3, source 1).
+ *
+ * A Vite/Next service that lists `VITE_*` / `NEXT_PUBLIC_*` / `PUBLIC_*`
+ * variables in its container `environment` needs those values baked into the
+ * client bundle at BUILD time — container ENV cannot reach the client. Without
+ * inference the author has to duplicate every public var into `docker.buildArgs`
+ * by hand; a forgotten one silently ships an `undefined` to the browser.
+ *
+ * This helper promotes each public-prefixed declared-environment key into a
+ * `docker.buildArgs` entry, WRITING THROUGH its declared value (P3-D1) so it
+ * bakes even with no `.env` file present. It is a PROMOTE, not a move — the key
+ * legitimately stays a runtime env var too (harmless for client-public vars).
+ *
+ * Explicit `buildArgs` always win: an inferred key never overwrites an existing
+ * entry (which may carry an acknowledged public-but-sensitive object form).
+ *
+ * Pure — reads only the in-memory service config; no fs, no env reads. The
+ * returned `docker.buildArgs` is mutated in place on `service.docker` by the
+ * caller so the synth-time bake-guard (which reads `service.docker.buildArgs`)
+ * inspects the inferred values too.
+ */
+import type { DockerBuildArgValue } from "@fjall/util/manifest/schemas";
+interface ServiceWithDocker {
+    containers?: ReadonlyArray<{
+        environment?: Record<string, string>;
+    }>;
+    docker?: {
+        buildArgs?: Record<string, DockerBuildArgValue>;
+    };
+}
+/**
+ * Mutate `service.docker.buildArgs` in place to include every public-prefixed
+ * declared-environment key not already explicitly declared, writing through its
+ * declared value. No-op when the service has no `docker` config (nothing is
+ * built, so there are no build-args).
+ *
+ * Returns the (possibly mutated) `service.docker.buildArgs` for convenience;
+ * mutation is the load-bearing effect so the synth-time bake-guard sees the
+ * inferred values.
+ */
+export declare function applyInferredPublicBuildArgs(service: ServiceWithDocker): void;
+export {};

package/dist/lib/patterns/aws/computeBuildArgInference.js

@@ -0,0 +1,73 @@
+/**
+ * Synth-time public build-arg inference (Phase 3, source 1).
+ *
+ * A Vite/Next service that lists `VITE_*` / `NEXT_PUBLIC_*` / `PUBLIC_*`
+ * variables in its container `environment` needs those values baked into the
+ * client bundle at BUILD time — container ENV cannot reach the client. Without
+ * inference the author has to duplicate every public var into `docker.buildArgs`
+ * by hand; a forgotten one silently ships an `undefined` to the browser.
+ *
+ * This helper promotes each public-prefixed declared-environment key into a
+ * `docker.buildArgs` entry, WRITING THROUGH its declared value (P3-D1) so it
+ * bakes even with no `.env` file present. It is a PROMOTE, not a move — the key
+ * legitimately stays a runtime env var too (harmless for client-public vars).
+ *
+ * Explicit `buildArgs` always win: an inferred key never overwrites an existing
+ * entry (which may carry an acknowledged public-but-sensitive object form).
+ *
+ * Pure — reads only the in-memory service config; no fs, no env reads. The
+ * returned `docker.buildArgs` is mutated in place on `service.docker` by the
+ * caller so the synth-time bake-guard (which reads `service.docker.buildArgs`)
+ * inspects the inferred values too.
+ */
+import { inferPublicBuildArgKeys } from "@fjall/util/docker";
+/**
+ * Aggregate the declared environment a service exposes across all its
+ * containers. Later containers win on key collision — the union is only used to
+ * discover public-prefixed KEYS and their values for write-through, so collision
+ * order is not load-bearing (a public var with two different values across
+ * containers is already an authoring error).
+ */
+function aggregateDeclaredEnv(service) {
+    const merged = {};
+    for (const container of service.containers ?? []) {
+        if (container.environment === undefined)
+            continue;
+        for (const [key, value] of Object.entries(container.environment)) {
+            merged[key] = value;
+        }
+    }
+    return merged;
+}
+/**
+ * Mutate `service.docker.buildArgs` in place to include every public-prefixed
+ * declared-environment key not already explicitly declared, writing through its
+ * declared value. No-op when the service has no `docker` config (nothing is
+ * built, so there are no build-args).
+ *
+ * Returns the (possibly mutated) `service.docker.buildArgs` for convenience;
+ * mutation is the load-bearing effect so the synth-time bake-guard sees the
+ * inferred values.
+ */
+export function applyInferredPublicBuildArgs(service) {
+    if (service.docker === undefined)
+        return;
+    const declaredEnv = aggregateDeclaredEnv(service);
+    const explicitBuildArgs = service.docker.buildArgs;
+    const inferredKeys = inferPublicBuildArgKeys({
+        declaredEnv,
+        ...(explicitBuildArgs !== undefined && { explicitBuildArgs })
+    });
+    if (inferredKeys.length === 0)
+        return;
+    const merged = {
+        ...(explicitBuildArgs ?? {})
+    };
+    for (const key of inferredKeys) {
+        // P3-D1: write through the declared value so it bakes even without a .env
+        // file. inferPublicBuildArgKeys already excluded explicit keys, so this
+        // never overwrites an explicit (possibly acknowledged) entry.
+        merged[key] = declaredEnv[key];
+    }
+    service.docker.buildArgs = merged;
+}

package/dist/lib/patterns/aws/computeEcs.js

@@ -22,6 +22,8 @@ import { vpcHasNatGateways } from "../../utils/vpcUtils.js";
 import { toPascalCase } from "../../utils/capitaliseString.js";
 import { FjallLogger } from "../../utils/validationLogger.js";
 import { VALIDATION_PATTERNS } from "@fjall/generator";
+import { evaluateBakeGuard } from "@fjall/util/docker";
+import { toKebab } from "@fjall/util";
 import { COMPUTE_DEFAULTS, collectImportedSecretNames } from "./compute.js";
 import { isHookMigrations } from "./computeEcsTypes.js";
 export { ScalingType } from "./computeEcsTypes.js";
@@ -93,6 +95,16 @@ export function validateEcsProps(props) {
         throw new Error(`Invalid service names: ${invalidNames.map((s) => s.name).join(", ")}. ` +
             "Service names must start with a letter and contain only letters, numbers, and hyphens.");
     }
+    // Reject secret-shaped buildArgs at synth time (mirror of the resources-layer
+    // validateEcsClusterProps check — direct `new EcsCluster(...)` consumers hit
+    // that one, EcsCompute/ComputeFactory consumers hit this one).
+    const appPrefix = props.appName !== undefined ? toKebab(props.appName) : "";
+    for (const service of props.services) {
+        const findings = evaluateBakeGuard(service.docker?.buildArgs, appPrefix).findings;
+        if (findings.length > 0) {
+            throw new Error(`Service '${service.name}': ${findings.map((f) => f.message).join(" ")}`);
+        }
+    }
     // Validate routing when multiple services have ports
     const servicesWithPorts = props.services.filter((s) => s.containers?.some((c) => c.port));
     if (servicesWithPorts.length > 1) {

package/dist/lib/resources/aws/compute/ecsValidation.js

@@ -1,4 +1,6 @@
 import { NetworkMode } from "aws-cdk-lib/aws-ecs";
+import { evaluateBakeGuard } from "@fjall/util/docker";
+import { toKebab } from "@fjall/util";
 import { ScalingType } from "./ecsTypes.js";
 /**
  * Validates ECS cluster props before construction.
@@ -36,6 +38,18 @@ export function validateEcsClusterProps(props) {
     if (duplicateServices.length > 0) {
         throw new Error(`Duplicate service names: ${[...new Set(duplicateServices)].join(", ")}`);
     }
+    // Reject secret-shaped buildArgs at synth time — a credential baked into a
+    // build arg lands in the image layer / docker history / provenance and the
+    // shared cache repo, where it survives long after the build. Fails the synth
+    // rather than deferring to the pre-build bake-guard, so a bad manifest never
+    // reaches a deploy. appName scopes the masking heuristic's prefix warnings.
+    const appPrefix = props.appName !== undefined ? toKebab(props.appName) : "";
+    for (const service of props.services) {
+        const findings = evaluateBakeGuard(service.docker?.buildArgs, appPrefix).findings;
+        if (findings.length > 0) {
+            throw new Error(`Service '${service.name}': ${findings.map((f) => f.message).join(" ")}`);
+        }
+    }
     // Validate routing when multiple services have ports
     const servicesWithPorts = props.services.filter((s) => s.containers.some((c) => c.port !== undefined));
     if (servicesWithPorts.length > 1 && !loadBalancerDisabled) {

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@fjall/components-infrastructure",
-  "version": "2.21.0",
+  "version": "2.22.0",
   "license": "SEE LICENSE IN LICENSE",
   "type": "module",
   "bin": {
@@ -63,8 +63,8 @@
   },
   "dependencies": {
     "@aws-sdk/client-organizations": "^3.1038.0",
-    "@fjall/generator": "^2.21.0",
-    "@fjall/util": "^2.21.0",
+    "@fjall/generator": "^2.22.0",
+    "@fjall/util": "^2.22.0",
     "constructs": "^10.6.0"
   },
   "overrides": {
@@ -78,5 +78,5 @@
   "engines": {
     "node": ">=18.0.0"
   },
-  "gitHead": "1b8902876c40697183ce8cbc25a0556b11d0ec38"
+  "gitHead": "448c771d258e87f0535ae7698f11438e0f7c57b1"
 }