@fjall/util 20.0.0 → 21.1.0

package/dist/scaffold/gitignore.d.ts

@@ -0,0 +1,47 @@
+export declare const FJALL_STATE_GITIGNORE_ENTRIES: readonly [".fjall-state*.json", ".deploy-state.json", ...string[]];
+/**
+ * Path of the per-checkout local-state file, relative to the project anchor
+ * directory, in `.gitignore` spelling. Derived from the constants that define
+ * the real write path (`Config.writeLocalConfig`) so the ignore rule cannot
+ * drift away from the file it is meant to cover.
+ */
+export declare const LOCAL_CONFIG_GITIGNORE_ENTRY = "/.fjall/local.json";
+/**
+ * Fjall-managed state DIRECTORIES under `.fjall/` — drift baselines, codemod
+ * history, and reserved operator logs. Anchored with a leading slash, so each
+ * entry only covers the directory holding the `.gitignore` that carries it.
+ */
+export declare const FJALL_MANAGED_STATE_DIR_ENTRIES: readonly ["/.fjall/history/", "/.fjall/baseline/", "/.fjall/logs/"];
+/**
+ * `.gitignore` for a scaffolded COMPONENT directory (`fjall/<component>/`):
+ * compiled output, CDK synth artefacts, per-machine deploy state, and codemod
+ * backups.
+ *
+ * Deliberately does NOT ignore `fjall-config.json`. Earlier copies of this
+ * content did, which is a data-loss hazard rather than a tidiness win: the file
+ * is committed project state, and its `capacityIdentity` block is load-bearing
+ * deployed state — losing it renames (replaces) every stateful resource in its
+ * slot on the next deploy. The entry was harmless only by accident, because it
+ * sat in component directories where no `fjall-config.json` exists AND because
+ * the packaging defects above meant it never reached a customer machine.
+ */
+export declare const FJALL_COMPONENT_GITIGNORE: string;
+/**
+ * `.gitignore` for the PROJECT ANCHOR directory — the directory holding
+ * `fjall-config.json`, which is where `.fjall/` managed state is written.
+ *
+ * This is a separate policy from {@link FJALL_COMPONENT_GITIGNORE} because the
+ * two cover different directories. A component `.gitignore` at
+ * `fjall/<component>/` cannot reach `fjall/.fjall/local.json` one level up, so
+ * the local-state entries only do anything when written at the anchor.
+ */
+/** Attribution marker for entries appended to a pre-existing `.gitignore`. */
+export declare const LOCAL_STATE_GITIGNORE_MARKER = "# fjall: managed local state (added by the fjall CLI)";
+/**
+ * Explanatory preamble written when Fjall CREATES the anchor `.gitignore`.
+ * Not appended to an existing file — only the missing entries are, under
+ * {@link LOCAL_STATE_GITIGNORE_MARKER}.
+ */
+export declare const FJALL_PROJECT_GITIGNORE_HEADER = "# Fjall-managed local state.\n#\n# `fjall-config.json` beside this file is deliberately NOT ignored: it is\n# committed project state, and its `capacityIdentity` block is load-bearing\n# deployed state \u2014 losing it renames (replaces) every stateful resource in its\n# slot on the next deploy.\n\n# Per-checkout active deploy target. Never committed: a committed value\n# silently re-aims a teammate's deploy or a CI pipeline at the wrong target.\n";
+/** Full anchor-directory `.gitignore` (header plus every managed entry). */
+export declare const FJALL_PROJECT_GITIGNORE: string;

package/dist/scaffold/gitignore.js

@@ -0,0 +1,35 @@
+import{LOCAL_CONFIG_DIRNAME as e,LOCAL_CONFIG_FILENAME as s,ROOT_CONFIG_FILENAME as l}from"../configPaths.js";import{ATOMIC_TMP_SUFFIX as r,atomicTmpGlob as i}from"../atomicTempNaming.js";const t=[".fjall-state*.json",".deploy-state.json"],n=[...t,...t.map(i),...t.map(a=>`${a}${r}`)],c=`/${e}/${s}`,o=[`/${e}/history/`,`/${e}/baseline/`,`/${e}/logs/`],m=`*.js
+*.d.ts
+node_modules
+.cdk.staging
+**/**/cdk.out
+
+.DS_Store
+
+# Fjall-managed state directories. Kept here as well as at the project anchor
+# because codemod runs resolve them against the working directory.
+${o.join(`
+`)}
+
+# Fjall per-target deploy state \u2014 a per-machine cache, never a deploy oracle.
+${n.join(`
+`)}
+
+# Fjall backup files (sibling \`.bak\` from codemod mutations + domain eject)
+**/backup/
+*.bak
+`,E="# fjall: managed local state (added by the fjall CLI)",d=`# Fjall-managed local state.
+#
+# \`${l}\` beside this file is deliberately NOT ignored: it is
+# committed project state, and its \`capacityIdentity\` block is load-bearing
+# deployed state \u2014 losing it renames (replaces) every stateful resource in its
+# slot on the next deploy.
+
+# Per-checkout active deploy target. Never committed: a committed value
+# silently re-aims a teammate's deploy or a CI pipeline at the wrong target.
+`,I=`${d}${c}
+
+# Drift baselines, codemod history, and operator logs.
+${o.join(`
+`)}
+`;export{m as FJALL_COMPONENT_GITIGNORE,o as FJALL_MANAGED_STATE_DIR_ENTRIES,I as FJALL_PROJECT_GITIGNORE,d as FJALL_PROJECT_GITIGNORE_HEADER,n as FJALL_STATE_GITIGNORE_ENTRIES,c as LOCAL_CONFIG_GITIGNORE_ENTRY,E as LOCAL_STATE_GITIGNORE_MARKER};

package/dist/securityHelpers.d.ts

@@ -50,7 +50,7 @@ export declare const REDACTED_KEY_SENTINEL = "[REDACTED]";
  * GitHub tokens (ghu_/ghs_/ghp_/gho_/github_pat_), bare AWS access-key IDs
  * (AKIA-prefixed and ASIA-prefixed), AWS secret keys (env, INI, and JSON key
  * spellings), session tokens, agent tokens (`fjall_ak_` scoped, `fjall_dk_`
- * deploy).
+ * deploy), legacy personal API keys (`fj_<8 hex>_<48 hex>`).
  *
  * Single source of truth — consumer loggers (CLI, worker, webapp) MUST
  * NOT re-implement these patterns inline. See

package/dist/securityHelpers.js

@@ -1 +1 @@
-var g=Object.defineProperty;var A=(_,t)=>g(_,"name",{value:t,configurable:!0});const R=new Set(["NODE_OPTIONS","NODE_PATH","NODE_EXTRA_CA_CERTS","NODE_DEBUG","NODE_PRESERVE_SYMLINKS","LD_PRELOAD","LD_LIBRARY_PATH","LD_AUDIT","LD_BIND_NOW","DYLD_INSERT_LIBRARIES","DYLD_LIBRARY_PATH","DYLD_FRAMEWORK_PATH","PYTHONPATH","PYTHONSTARTUP","PERL5LIB","PERL5OPT","RUBYLIB","RUBYOPT","HOME","XDG_CONFIG_HOME","AWS_SHARED_CREDENTIALS_FILE","AWS_CONFIG_FILE","SHELL","BASH_ENV","ENV","ZDOTDIR"]);function T(_){return Object.fromEntries(Object.entries(_).filter(([t])=>!R.has(t.toUpperCase())))}A(T,"filterDangerousEnvVars");const u=/fjall_(?:ak|dk)_[A-Z2-7]{16}\.[A-Z2-7]{40}/,S=/(fjall_(?:ak|dk)_)[A-Z2-7]{16}\.[A-Z2-7]{40}/g,s="***",i="[REDACTED]",o=`-----BEGIN ${i} PRIVATE KEY-----...-----END ${i} PRIVATE KEY-----`,l=String.raw`(?:next|continuation|pagination|page|forward|backward)+token`,p=String.raw`(?!ghu_|ghs_|ghp_|gho_|github_pat_|(?:sk|rk)_(?:live|test)_|whsec_|fjall_(?:ak|dk)_|AKIA|ASIA|%[a-zA-Z])`,D=new RegExp(String.raw`(?<!"${l}":\s*")`+String.raw`(?<="[a-zA-Z0-9_-]*(?:password|passwd|secret|api[_-]?key|token|auth|credential)":\s*")`+p+String.raw`[^"]+`,"gi"),I=new RegExp(String.raw`(?<!${l}\s*[=:]\s*["']?)`+String.raw`(?<=(?<!/)(?:password|passwd|secret|api[_-]?key|token|auth|credential)\s*[=:]\s*["']?)`+p+String.raw`[^\s"']+`,"gi");function w(_){return _.replace(/-----BEGIN [A-Z ]*PRIVATE KEY-----(?:[^"\\]|\\[\\nrt"])*?-----END [A-Z ]*PRIVATE KEY-----/g,()=>o).replace(/-----BEGIN [A-Z ]*PRIVATE KEY-----[\s\S]*?-----END [A-Z ]*PRIVATE KEY-----/g,()=>o).replace(/(\w+:\/\/[^:]+:)[^@]+(@)/gi,(t,e,a)=>`${e}${s}${a}`).replace(/(?<![a-zA-Z])(password|passwd|secret|api[_-]?key|token|auth|credential)([=:])["']?[^\s"']+/gi,(t,e,a)=>`${e}${a}${s}`).replace(D,s).replace(I,s).replace(/\b(ghu_|ghs_|ghp_|gho_|github_pat_)[A-Za-z0-9_]+/g,(t,e)=>`${e}${s}`).replace(/\b(sk|rk)_(live|test)_[A-Za-z0-9]{8,}/g,(t,e,a)=>`${e}_${a}_${s}`).replace(/\bwhsec_[A-Za-z0-9]{8,}/g,()=>`whsec_${s}`).replace(/(?<=Authorization:\s*Bearer\s+)[A-Za-z0-9._~+/=-]+/gi,s).replace(/\b(AKIA|ASIA)[A-Z0-9]{12,}\b/g,(t,e)=>`${e}${s}`).replace(/(?<=aws_secret_access_key\s*=\s*["']?|SecretAccessKey[=:]\s*|"(aws)?secretAccessKey":\s*"|"aws_secret_access_key":\s*")[A-Za-z0-9/+=]{40,}/gi,s).replace(/(?<="(aws)?sessionToken":\s*"|"aws_session_token":\s*")[^"]+/gi,s).replace(/(?<=aws_session_token\s*[=:]\s*["']?|SessionToken[=:]\s*["']?)[^\s"']+/gi,s).replace(/(?<="(internal[Aa]piKey|fjallCallbackToken)":\s*")[^"]+/g,s).replace(S,(t,e)=>`${e}${s}`)}A(w,"maskSensitiveOutput");function h(_){const t=[];let e="",a=!1,E=!1,c=!1,n=!1;for(const r of _){if(c){e+=r,c=!1;continue}if(r==="\\"&&!a){c=!0;continue}if(r==="'"&&!E){a=!a,n=!0;continue}if(r==='"'&&!a){E=!E,n=!0;continue}if(r===" "&&!a&&!E){(e||n)&&(t.push(e),e="",n=!1);continue}e+=r}if(a||E)throw new Error(`Unbalanced ${a?"single":"double"} quote in command: ${_.slice(0,80)}`);if(c)throw new Error(`Trailing backslash in command: ${_.slice(0,80)}`);return(e||n)&&t.push(e),t}A(h,"parseShellArgs");export{R as DANGEROUS_ENV_VARS,s as MASKED_VALUE_MARKER,i as REDACTED_KEY_SENTINEL,u as SCOPED_TOKEN_REGEX,T as filterDangerousEnvVars,w as maskSensitiveOutput,h as parseShellArgs};
+var g=Object.defineProperty;var A=(t,a)=>g(t,"name",{value:a,configurable:!0});const R=new Set(["NODE_OPTIONS","NODE_PATH","NODE_EXTRA_CA_CERTS","NODE_DEBUG","NODE_PRESERVE_SYMLINKS","LD_PRELOAD","LD_LIBRARY_PATH","LD_AUDIT","LD_BIND_NOW","DYLD_INSERT_LIBRARIES","DYLD_LIBRARY_PATH","DYLD_FRAMEWORK_PATH","PYTHONPATH","PYTHONSTARTUP","PERL5LIB","PERL5OPT","RUBYLIB","RUBYOPT","HOME","XDG_CONFIG_HOME","AWS_SHARED_CREDENTIALS_FILE","AWS_CONFIG_FILE","SHELL","BASH_ENV","ENV","ZDOTDIR"]);function u(t){return Object.fromEntries(Object.entries(t).filter(([a])=>!R.has(a.toUpperCase())))}A(u,"filterDangerousEnvVars");const L=/fjall_(?:ak|dk)_[A-Z2-7]{16}\.[A-Z2-7]{40}/,S=/(fjall_(?:ak|dk)_)[A-Z2-7]{16}\.[A-Z2-7]{40}/g,D=/\bfj_[0-9a-f]{8}_[0-9a-f]{48}\b/gi,s="***",i="[REDACTED]",o=`-----BEGIN ${i} PRIVATE KEY-----...-----END ${i} PRIVATE KEY-----`,l=String.raw`(?:next|continuation|pagination|page|forward|backward)+token`,p=String.raw`(?!ghu_|ghs_|ghp_|gho_|github_pat_|(?:sk|rk)_(?:live|test)_|whsec_|fjall_(?:ak|dk)_|fj_[0-9a-f]{8}_|AKIA|ASIA|%[a-zA-Z])`,I=new RegExp(String.raw`(?<!"${l}":\s*")`+String.raw`(?<="[a-zA-Z0-9_-]*(?:password|passwd|secret|api[_-]?key|token|auth|credential)":\s*")`+p+String.raw`[^"]+`,"gi"),N=new RegExp(String.raw`(?<!${l}\s*[=:]\s*["']?)`+String.raw`(?<=(?<!/)(?:password|passwd|secret|api[_-]?key|token|auth|credential)\s*[=:]\s*["']?)`+p+String.raw`[^\s"']+`,"gi");function f(t){return t.replace(/-----BEGIN [A-Z ]*PRIVATE KEY-----(?:[^"\\]|\\[\\nrt"])*?-----END [A-Z ]*PRIVATE KEY-----/g,()=>o).replace(/-----BEGIN [A-Z ]*PRIVATE KEY-----[\s\S]*?-----END [A-Z ]*PRIVATE KEY-----/g,()=>o).replace(/(\w+:\/\/[^:]+:)[^@]+(@)/gi,(a,e,_)=>`${e}${s}${_}`).replace(/(?<![a-zA-Z])(password|passwd|secret|api[_-]?key|token|auth|credential)([=:])["']?[^\s"']+/gi,(a,e,_)=>`${e}${_}${s}`).replace(I,s).replace(N,s).replace(/\b(ghu_|ghs_|ghp_|gho_|github_pat_)[A-Za-z0-9_]+/g,(a,e)=>`${e}${s}`).replace(/\b(sk|rk)_(live|test)_[A-Za-z0-9]{8,}/g,(a,e,_)=>`${e}_${_}_${s}`).replace(/\bwhsec_[A-Za-z0-9]{8,}/g,()=>`whsec_${s}`).replace(/(?<=Authorization:\s*Bearer\s+)[A-Za-z0-9._~+/=-]+/gi,s).replace(/\b(AKIA|ASIA)[A-Z0-9]{12,}\b/g,(a,e)=>`${e}${s}`).replace(/(?<=aws_secret_access_key\s*=\s*["']?|SecretAccessKey[=:]\s*|"(aws)?secretAccessKey":\s*"|"aws_secret_access_key":\s*")[A-Za-z0-9/+=]{40,}/gi,s).replace(/(?<="(aws)?sessionToken":\s*"|"aws_session_token":\s*")[^"]+/gi,s).replace(/(?<=aws_session_token\s*[=:]\s*["']?|SessionToken[=:]\s*["']?)[^\s"']+/gi,s).replace(/(?<="(internal[Aa]piKey|fjallCallbackToken)":\s*")[^"]+/g,s).replace(S,(a,e)=>`${e}${s}`).replace(D,()=>`fj_${s}`)}A(f,"maskSensitiveOutput");function w(t){const a=[];let e="",_=!1,E=!1,c=!1,n=!1;for(const r of t){if(c){e+=r,c=!1;continue}if(r==="\\"&&!_){c=!0;continue}if(r==="'"&&!E){_=!_,n=!0;continue}if(r==='"'&&!_){E=!E,n=!0;continue}if(r===" "&&!_&&!E){(e||n)&&(a.push(e),e="",n=!1);continue}e+=r}if(_||E)throw new Error(`Unbalanced ${_?"single":"double"} quote in command: ${t.slice(0,80)}`);if(c)throw new Error(`Trailing backslash in command: ${t.slice(0,80)}`);return(e||n)&&a.push(e),a}A(w,"parseShellArgs");export{R as DANGEROUS_ENV_VARS,s as MASKED_VALUE_MARKER,i as REDACTED_KEY_SENTINEL,L as SCOPED_TOKEN_REGEX,u as filterDangerousEnvVars,f as maskSensitiveOutput,w as parseShellArgs};

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@fjall/util",
-  "version": "20.0.0",
+  "version": "21.1.0",
   "repository": {
     "type": "git",
     "url": "git+https://github.com/fjall-tech/fjall.git",
@@ -15,6 +15,10 @@
       "types": "./dist/index.d.ts",
       "default": "./dist/index.js"
     },
+    "./atomicTempNaming": {
+      "types": "./dist/atomicTempNaming.d.ts",
+      "default": "./dist/atomicTempNaming.js"
+    },
     "./buildConcurrency": {
       "types": "./dist/buildConcurrency.d.ts",
       "default": "./dist/buildConcurrency.js"
@@ -35,6 +39,10 @@
       "types": "./dist/docker/index.d.ts",
       "default": "./dist/docker/index.js"
     },
+    "./logRotation": {
+      "types": "./dist/logRotation.d.ts",
+      "default": "./dist/logRotation.js"
+    },
     "./manifest": {
       "types": "./dist/manifest/index.d.ts",
       "default": "./dist/manifest/index.js"