@patchstack/connect 0.3.29 → 0.3.30

package/dist/index.d.cts

@@ -74,7 +74,7 @@ declare class PatchstackError extends Error {
 }
 
 type LockfileFilename = 'package-lock.json' | 'bun.lock' | 'bun.lockb' | 'yarn.lock' | 'pnpm-lock.yaml';
-type DetectionStrategy = 'npm-lockfile' | 'node-modules-walk' | 'pnpm-lockfile' | 'yarn-lockfile';
+type DetectionStrategy = 'npm-lockfile' | 'bun-lockfile' | 'node-modules-walk' | 'pnpm-lockfile' | 'yarn-lockfile';
 interface DetectedLockfile {
     ecosystem: 'npm';
     filePath: string;
@@ -145,21 +145,40 @@ interface ResolveConfigOptions {
 }
 declare function resolveConfig(options: ResolveConfigOptions): Promise<Config>;
 declare function writeConfigFile(cwd: string, config: ConfigFile): Promise<string>;
+/**
+ * What happened to the credential file, so a caller can say only what is true.
+ *
+ * `ignored` is the OUTCOME of the ignore entry, verified by reading the file back — not the fact that a
+ * write was attempted. Telling somebody their credential is ignored when it is not is worse than telling
+ * them nothing: they stop looking, and a credential committed once is in the history whether or not the
+ * file is removed afterwards.
+ */
+interface SecretFileResult {
+    /** Absolute path of the credential file. */
+    path: string;
+    /** True only when `.gitignore` was read back and really covers it. */
+    ignored: boolean;
+    /** Why not, when it is not — for the caller to print instead of a false assurance. */
+    reason?: string;
+}
 /**
  * Merge a new siteUuid into the existing `.patchstackrc.json` (or create it).
  * Preserves any `endpoint` / `timeoutMs` / `apiKey` the user already wrote.
  */
 declare function persistSiteUuid(cwd: string, siteUuid: string): Promise<string>;
 /**
- * Persist the WP-format api_key issued at provision. Authenticates both the
- * Pulse endpoints and connector log reporting. Never embed it in the public
- * disclosure widget.
+ * Persist the WP-format api_key issued at provision. Authenticates both the Pulse endpoints and connector
+ * log reporting. Never embed it in the public disclosure widget.
+ *
+ * Written to the credential file, which setup adds to the project's ignore list — the public config is
+ * meant to be committed, so a credential in it is a credential in the repository.
  *
- * Drops any `pulseAuth` written by an earlier version. That field resolves
- * ahead of `apiKey`, so leaving a copy behind after the credential changes
- * would leave Pulse authenticating with the value the server just replaced.
+ * Any copy in the committed config is REMOVED at the same time. Leaving it would mean the value that just
+ * got moved is still in the file everyone commits, which is the state this split exists to end. `pulseAuth`
+ * goes with it: that field resolves ahead of `apiKey`, so a stale copy would keep authenticating with a
+ * credential the server has replaced.
  */
-declare function persistApiKey(cwd: string, apiKey: string): Promise<string>;
+declare function persistApiKey(cwd: string, apiKey: string): Promise<SecretFileResult>;
 /**
  * Persist a Pulse-specific credential.
  *
@@ -167,7 +186,7 @@ declare function persistApiKey(cwd: string, apiKey: string): Promise<string>;
  * credentials; they share one today, so `persistApiKey` covers both. Retained
  * for callers that separate them.
  */
-declare function persistPulseAuth(cwd: string, pulseAuth: string): Promise<string>;
+declare function persistPulseAuth(cwd: string, pulseAuth: string): Promise<SecretFileResult>;
 
 /**
  * A best-effort description of the stack a build was produced with, derived

package/dist/index.d.ts

@@ -74,7 +74,7 @@ declare class PatchstackError extends Error {
 }
 
 type LockfileFilename = 'package-lock.json' | 'bun.lock' | 'bun.lockb' | 'yarn.lock' | 'pnpm-lock.yaml';
-type DetectionStrategy = 'npm-lockfile' | 'node-modules-walk' | 'pnpm-lockfile' | 'yarn-lockfile';
+type DetectionStrategy = 'npm-lockfile' | 'bun-lockfile' | 'node-modules-walk' | 'pnpm-lockfile' | 'yarn-lockfile';
 interface DetectedLockfile {
     ecosystem: 'npm';
     filePath: string;
@@ -145,21 +145,40 @@ interface ResolveConfigOptions {
 }
 declare function resolveConfig(options: ResolveConfigOptions): Promise<Config>;
 declare function writeConfigFile(cwd: string, config: ConfigFile): Promise<string>;
+/**
+ * What happened to the credential file, so a caller can say only what is true.
+ *
+ * `ignored` is the OUTCOME of the ignore entry, verified by reading the file back — not the fact that a
+ * write was attempted. Telling somebody their credential is ignored when it is not is worse than telling
+ * them nothing: they stop looking, and a credential committed once is in the history whether or not the
+ * file is removed afterwards.
+ */
+interface SecretFileResult {
+    /** Absolute path of the credential file. */
+    path: string;
+    /** True only when `.gitignore` was read back and really covers it. */
+    ignored: boolean;
+    /** Why not, when it is not — for the caller to print instead of a false assurance. */
+    reason?: string;
+}
 /**
  * Merge a new siteUuid into the existing `.patchstackrc.json` (or create it).
  * Preserves any `endpoint` / `timeoutMs` / `apiKey` the user already wrote.
  */
 declare function persistSiteUuid(cwd: string, siteUuid: string): Promise<string>;
 /**
- * Persist the WP-format api_key issued at provision. Authenticates both the
- * Pulse endpoints and connector log reporting. Never embed it in the public
- * disclosure widget.
+ * Persist the WP-format api_key issued at provision. Authenticates both the Pulse endpoints and connector
+ * log reporting. Never embed it in the public disclosure widget.
+ *
+ * Written to the credential file, which setup adds to the project's ignore list — the public config is
+ * meant to be committed, so a credential in it is a credential in the repository.
  *
- * Drops any `pulseAuth` written by an earlier version. That field resolves
- * ahead of `apiKey`, so leaving a copy behind after the credential changes
- * would leave Pulse authenticating with the value the server just replaced.
+ * Any copy in the committed config is REMOVED at the same time. Leaving it would mean the value that just
+ * got moved is still in the file everyone commits, which is the state this split exists to end. `pulseAuth`
+ * goes with it: that field resolves ahead of `apiKey`, so a stale copy would keep authenticating with a
+ * credential the server has replaced.
  */
-declare function persistApiKey(cwd: string, apiKey: string): Promise<string>;
+declare function persistApiKey(cwd: string, apiKey: string): Promise<SecretFileResult>;
 /**
  * Persist a Pulse-specific credential.
  *
@@ -167,7 +186,7 @@ declare function persistApiKey(cwd: string, apiKey: string): Promise<string>;
  * credentials; they share one today, so `persistApiKey` covers both. Retained
  * for callers that separate them.
  */
-declare function persistPulseAuth(cwd: string, pulseAuth: string): Promise<string>;
+declare function persistPulseAuth(cwd: string, pulseAuth: string): Promise<SecretFileResult>;
 
 /**
  * A best-effort description of the stack a build was produced with, derived