@peac/cli 0.14.0 → 0.14.2

package/dist/lib/safe-file.d.ts

@@ -0,0 +1,88 @@
+/**
+ * Internal file-IO helpers for @peac/cli command handlers.
+ *
+ * Package-private; not exported from any package barrel and not part of
+ * the public CLI API. Mirrors the syscall-style conventions already in
+ * use in `output-preflight.ts`: named imports from `node:fs`,
+ * fd-bound reads, errno discrimination via `NodeJS.ErrnoException`, and
+ * `closeSync` always wrapped in `try`/`finally` with secondary errors
+ * swallowed so they do not mask the primary error.
+ *
+ * The helpers exist to remove TOCTOU patterns where an existence probe
+ * (`existsSync` / `accessSync` / `statSync`) is followed by a file
+ * operation (`readFileSync` / `writeFileSync` / `openSync` / `unlinkSync`)
+ * on the same path. The atomic alternative is a single syscall that
+ * discriminates outcome via errno: success means the operation worked;
+ * `ENOENT` means the file is missing; `EACCES` means the file is
+ * unreadable / unwritable; `EISDIR` / `ENOTDIR` means the path is the
+ * wrong type.
+ *
+ * Each helper takes a path string. Internal use of file descriptors is
+ * hidden from the caller. Callers receive plain return values on success
+ * and `NodeJS.ErrnoException`-shaped errors on failure that they can
+ * inspect via `e.code === 'ENOENT' | 'EACCES' | 'EEXIST' | 'EISDIR' |
+ * 'ENOTDIR'` and translate into user-facing wording.
+ */
+/**
+ * Read the entire file at `path` as a UTF-8 string via a single
+ * fd-bound `open`/`fstat`/`read`/`close` sequence.
+ *
+ * Throws an `ErrnoException`-shaped error on failure. Callers
+ * discriminate via `e.code`:
+ *   - `ENOENT`: file does not exist
+ *   - `EISDIR`: path resolves to a directory
+ *   - `EACCES`: not readable
+ */
+export declare function readFileUtf8Snapshot(path: string): string;
+/**
+ * Read the entire file at `path` as a `Buffer` via a single fd-bound
+ * `open`/`fstat`/`read`/`close` sequence. Optionally enforces a maximum
+ * byte size. The size limit is checked twice: once against the `fstat`
+ * size before reading (cheap fast-fail) and once against the actual
+ * read length (defends against the file growing between `fstat` and the
+ * subsequent `readFileSync`).
+ *
+ * Throws on failure:
+ *   - `ENOENT`: file does not exist
+ *   - `EISDIR`: path resolves to a directory
+ *   - `EACCES`: not readable
+ *   - `E_PEAC_FILE_TOO_LARGE`: file exceeds `options.maxBytes`
+ */
+export declare function readFileBufferSnapshot(path: string, options?: {
+    maxBytes?: number;
+}): Buffer;
+/**
+ * Write `data` to `path` atomically without overwriting an existing
+ * file. Uses POSIX `O_CREAT | O_EXCL | O_WRONLY` semantics via Node's
+ * `'wx'` flag. The path either gets created with the supplied content
+ * or the call throws `EEXIST`.
+ *
+ * Callers translate `EEXIST` into user-facing wording (e.g. "use --force
+ * to overwrite").
+ */
+export declare function writeFileNoOverwrite(path: string, data: string | Buffer, options?: {
+    encoding?: BufferEncoding;
+    mode?: number;
+}): void;
+/**
+ * Rewrite a JSON config file atomically. If the file does not exist
+ * (ENOENT), returns silently: there is no config to rewrite. Otherwise
+ * the existing content is parsed, `mutate(config)` is invoked, and the
+ * mutated config is written via a sibling temp file plus
+ * `renameSync`. The final target path is never partially written.
+ *
+ * Existing file permissions on the target are preserved across the
+ * rename. If the existing mode cannot be observed, the temp file is
+ * created with a restrictive `0o600` fallback so a config rewrite never
+ * accidentally widens the permission set.
+ *
+ * Cleans up the temp file if rename fails. Read failures other than
+ * `ENOENT` propagate to the caller.
+ */
+export declare function rewriteJsonFileAtomic(path: string, mutate: (config: Record<string, unknown>) => void): void;
+/**
+ * Remove the file at `path` if it exists. Swallows `ENOENT`. All
+ * other errors propagate to the caller.
+ */
+export declare function unlinkIfExists(path: string): void;
+//# sourceMappingURL=safe-file.d.ts.map

package/dist/lib/safe-file.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"safe-file.d.ts","sourceRoot":"","sources":["../../src/lib/safe-file.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;GAwBG;AAeH;;;;;;;;;GASG;AACH,wBAAgB,oBAAoB,CAAC,IAAI,EAAE,MAAM,GAAG,MAAM,CAkBzD;AAED;;;;;;;;;;;;;GAaG;AACH,wBAAgB,sBAAsB,CAAC,IAAI,EAAE,MAAM,EAAE,OAAO,CAAC,EAAE;IAAE,QAAQ,CAAC,EAAE,MAAM,CAAA;CAAE,GAAG,MAAM,CAyB5F;AAgBD;;;;;;;;GAQG;AACH,wBAAgB,oBAAoB,CAClC,IAAI,EAAE,MAAM,EACZ,IAAI,EAAE,MAAM,GAAG,MAAM,EACrB,OAAO,CAAC,EAAE;IAAE,QAAQ,CAAC,EAAE,cAAc,CAAC;IAAC,IAAI,CAAC,EAAE,MAAM,CAAA;CAAE,GACrD,IAAI,CAQN;AAED;;;;;;;;;;;;;;GAcG;AACH,wBAAgB,qBAAqB,CACnC,IAAI,EAAE,MAAM,EACZ,MAAM,EAAE,CAAC,MAAM,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,KAAK,IAAI,GAChD,IAAI,CAiDN;AAED;;;GAGG;AACH,wBAAgB,cAAc,CAAC,IAAI,EAAE,MAAM,GAAG,IAAI,CAMjD"}

package/dist/lib/secret-scan.d.ts

@@ -0,0 +1,35 @@
+/**
+ * Secret-scan regex set for bounded-capture samples.
+ *
+ * Secret-scan is ON by default. When raw sample emission is possible
+ * (`--capture-mode raw && --unsafe-allow-raw-capture`), the wrapper
+ * runs this regex set against each candidate sample BEFORE emission.
+ * If a token-like pattern matches, the sample is suppressed and
+ * replaced with `{ sample_suppressed_reason: "secret_pattern_detected",
+ * matched_pattern_category: <category> }`. The literal match is NEVER
+ * recorded.
+ *
+ * The regex set is intentionally small (5 named patterns). False
+ * positives are tolerated; the suppression itself is observable so a
+ * verifier can detect over-suppression.
+ *
+ * Disabling secret-scan under raw capture requires the third unsafe
+ * flag (`--unsafe-disable-secret-scan`); enforcement lives in the
+ * subcommand flag-parse layer, not here.
+ */
+export type SecretCategory = 'bearer-token' | 'api-key' | 'jwt' | 'aws-access-key' | 'generic-high-entropy';
+export interface SecretMatch {
+    category: SecretCategory;
+}
+/**
+ * Scan a buffer or string for token-like patterns. Returns the first
+ * match (by pattern declaration order); the literal match is NEVER
+ * returned to callers.
+ */
+export declare function scanForSecrets(input: string | Uint8Array): SecretMatch | null;
+/**
+ * Scan an argv element. Same shape as `scanForSecrets` but documents
+ * intent: argv elements are scanned independently of stream samples.
+ */
+export declare function scanArgvElement(token: string): SecretMatch | null;
+//# sourceMappingURL=secret-scan.d.ts.map

package/dist/lib/secret-scan.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"secret-scan.d.ts","sourceRoot":"","sources":["../../src/lib/secret-scan.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;GAkBG;AAEH,MAAM,MAAM,cAAc,GACtB,cAAc,GACd,SAAS,GACT,KAAK,GACL,gBAAgB,GAChB,sBAAsB,CAAC;AA0C3B,MAAM,WAAW,WAAW;IAC1B,QAAQ,EAAE,cAAc,CAAC;CAC1B;AAED;;;;GAIG;AACH,wBAAgB,cAAc,CAAC,KAAK,EAAE,MAAM,GAAG,UAAU,GAAG,WAAW,GAAG,IAAI,CAQ7E;AAED;;;GAGG;AACH,wBAAgB,eAAe,CAAC,KAAK,EAAE,MAAM,GAAG,WAAW,GAAG,IAAI,CAEjE"}

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@peac/cli",
-  "version": "0.14.0",
+  "version": "0.14.2",
   "description": "PEAC protocol command-line tools",
   "main": "dist/index.cjs",
   "types": "dist/index.d.ts",
@@ -38,13 +38,13 @@
   "dependencies": {
     "chalk": "^4.1.2",
     "commander": "^11.0.0",
-    "@peac/crypto": "0.14.0",
-    "@peac/kernel": "0.14.0",
-    "@peac/net-node": "0.14.0",
-    "@peac/audit": "0.14.0",
-    "@peac/protocol": "0.14.0",
-    "@peac/policy-kit": "0.14.0",
-    "@peac/schema": "0.14.0"
+    "@peac/audit": "0.14.2",
+    "@peac/crypto": "0.14.2",
+    "@peac/policy-kit": "0.14.2",
+    "@peac/protocol": "0.14.2",
+    "@peac/kernel": "0.14.2",
+    "@peac/net-node": "0.14.2",
+    "@peac/schema": "0.14.2"
   },
   "devDependencies": {
     "@types/node": "^22.19.11",