@taimos/projen 0.1.85 → 0.1.87

package/lib/components/amplify-deploy.js

@@ -43,7 +43,7 @@ const DEFAULT_SHARED_BUILD_PATHS = [
  * assume-role or parameter-read step rather than skipping a deploy.
  */
 class GitHubAmplifyDeploy extends projen_1.Component {
-    static [JSII_RTTI_SYMBOL_1] = { fqn: "@taimos/projen.GitHubAmplifyDeploy", version: "0.1.85" };
+    static [JSII_RTTI_SYMBOL_1] = { fqn: "@taimos/projen.GitHubAmplifyDeploy", version: "0.1.87" };
     /** The generated deploy workflows, one per app. */
     workflows = [];
     /** Name of the IAM role CI chains into, in every stage account. */

package/lib/components/gitleaks.d.ts

@@ -0,0 +1,69 @@
+import { Component, TextFile, github, typescript } from 'projen';
+/**
+ * One path-scoped allowlist entry for the generated `.gitleaks.toml`.
+ *
+ * Each entry is rendered as a `[[allowlists]]` block. Keep every allowlist as
+ * tightly path-scoped as possible so it cannot mask a real secret elsewhere in
+ * the repo.
+ */
+export interface GitleaksAllowlist {
+    /** Human-readable description of what this allowlist exempts and why. */
+    readonly description: string;
+    /**
+     * Regex paths the allowlist applies to (rendered as gitleaks `paths`), e.g.
+     * `['^\\.npmrc$']`. Omit to apply the regexes repo-wide (discouraged).
+     *
+     * @default - no path scope
+     */
+    readonly paths?: string[];
+    /**
+     * Regexes matching the allowed secret values (rendered as gitleaks
+     * `regexes`). Omit to allow anything on the scoped paths.
+     *
+     * @default - no value regexes
+     */
+    readonly regexes?: string[];
+    /**
+     * gitleaks `condition` combining `paths` and `regexes` (`AND` requires both).
+     *
+     * @default - gitleaks default (OR)
+     */
+    readonly condition?: string;
+    /**
+     * gitleaks `regexTarget` (`secret` | `match` | `line`).
+     *
+     * @default - gitleaks default
+     */
+    readonly regexTarget?: string;
+}
+export interface GitleaksOptions {
+    /**
+     * The gitleaks version downloaded in CI.
+     *
+     * @default '8.30.1'
+     */
+    readonly version?: string;
+    /**
+     * Path-scoped allowlists for known false positives, appended after
+     * `[extend] useDefault = true`.
+     *
+     * @default []
+     */
+    readonly allowlists?: GitleaksAllowlist[];
+}
+/**
+ * gitleaks secret-scanning for a project: a `.gitleaks.toml` config that extends
+ * the bundled default ruleset plus tightly path-scoped allowlists, and a
+ * pull-request workflow that scans the full git history against it.
+ *
+ * projen has no native gitleaks component, so both artifacts are generated here
+ * to stay in the "never hand-edit generated files" model. Requires GitHub to be
+ * enabled on the project.
+ */
+export declare class Gitleaks extends Component {
+    /** The generated `.gitleaks.toml`. */
+    readonly configFile: TextFile;
+    /** The generated pull-request scanning workflow. */
+    readonly workflow: github.GithubWorkflow;
+    constructor(scope: typescript.TypeScriptProject, options?: GitleaksOptions);
+}

package/lib/components/gitleaks.js

@@ -0,0 +1,93 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.Gitleaks = void 0;
+const JSII_RTTI_SYMBOL_1 = Symbol.for("jsii.rtti");
+const projen_1 = require("projen");
+/**
+ * gitleaks secret-scanning for a project: a `.gitleaks.toml` config that extends
+ * the bundled default ruleset plus tightly path-scoped allowlists, and a
+ * pull-request workflow that scans the full git history against it.
+ *
+ * projen has no native gitleaks component, so both artifacts are generated here
+ * to stay in the "never hand-edit generated files" model. Requires GitHub to be
+ * enabled on the project.
+ */
+class Gitleaks extends projen_1.Component {
+    static [JSII_RTTI_SYMBOL_1] = { fqn: "@taimos/projen.Gitleaks", version: "0.1.87" };
+    /** The generated `.gitleaks.toml`. */
+    configFile;
+    /** The generated pull-request scanning workflow. */
+    workflow;
+    constructor(scope, options = {}) {
+        super(scope);
+        if (!scope.github) {
+            throw new Error('Gitleaks requires GitHub to be enabled on the project');
+        }
+        const version = options.version ?? '8.30.1';
+        const allowlists = options.allowlists ?? [];
+        const lines = [
+            '# ~~ Generated by projen. To modify, edit .projenrc.ts and run "npx projen".',
+            '#',
+            '# gitleaks config. Extends the default ruleset, then adds tightly scoped',
+            '# allowlists for known false positives. Each allowlist is path-scoped so it',
+            '# cannot mask a real secret elsewhere in the repo.',
+            '[extend]',
+            'useDefault = true',
+        ];
+        for (const a of allowlists) {
+            lines.push('', `# ${a.description}`, '[[allowlists]]', `description = ${JSON.stringify(a.description)}`);
+            if (a.condition) {
+                lines.push(`condition = ${JSON.stringify(a.condition)}`);
+            }
+            if (a.regexTarget) {
+                lines.push(`regexTarget = ${JSON.stringify(a.regexTarget)}`);
+            }
+            if (a.paths && a.paths.length > 0) {
+                lines.push(`paths = [${a.paths.map((p) => `'''${p}'''`).join(', ')}]`);
+            }
+            if (a.regexes && a.regexes.length > 0) {
+                lines.push(`regexes = [${a.regexes.map((r) => `'''${r}'''`).join(', ')}]`);
+            }
+        }
+        this.configFile = new projen_1.TextFile(scope, '.gitleaks.toml', {
+            lines,
+            // A `//`-style projen marker is invalid TOML; the `#` marker is baked in.
+            marker: false,
+        });
+        this.workflow = scope.github.addWorkflow('gitleaks');
+        // Secrets can land in any path, so no path filter — plus merge queue and
+        // manual dispatch, matching the repo's other workflows.
+        this.workflow.on({
+            pullRequest: {},
+            mergeGroup: {},
+            workflowDispatch: {},
+        });
+        this.workflow.addJob('gitleaks', {
+            runsOn: ['ubuntu-latest'],
+            permissions: { contents: projen_1.github.workflows.JobPermission.READ },
+            steps: [
+                {
+                    name: 'Checkout',
+                    uses: 'actions/checkout@v4',
+                    // Full history so gitleaks scans every commit in the PR, not just HEAD.
+                    with: { 'fetch-depth': 0 },
+                },
+                {
+                    name: 'Install gitleaks',
+                    run: [
+                        `curl -sSfL https://github.com/gitleaks/gitleaks/releases/download/v${version}/gitleaks_${version}_linux_x64.tar.gz \\`,
+                        '  | tar -xz gitleaks',
+                        'sudo mv gitleaks /usr/local/bin/gitleaks',
+                    ].join('\n'),
+                },
+                {
+                    name: 'Scan git history',
+                    // --redact keeps any real secret out of the public CI logs.
+                    run: 'gitleaks git --no-banner --redact .',
+                },
+            ],
+        });
+    }
+}
+exports.Gitleaks = Gitleaks;
+//# sourceMappingURL=data:application/json;base64,eyJ2ZXJzaW9uIjozLCJmaWxlIjoiZ2l0bGVha3MuanMiLCJzb3VyY2VSb290IjoiIiwic291cmNlcyI6WyIuLi8uLi9zcmMvY29tcG9uZW50cy9naXRsZWFrcy50cyJdLCJuYW1lcyI6W10sIm1hcHBpbmdzIjoiOzs7O0FBQUEsbUNBQWlFO0FBd0RqRTs7Ozs7Ozs7R0FRRztBQUNILE1BQWEsUUFBUyxTQUFRLGtCQUFTOztJQUVyQyxzQ0FBc0M7SUFDdEIsVUFBVSxDQUFXO0lBRXJDLG9EQUFvRDtJQUNwQyxRQUFRLENBQXdCO0lBRWhELFlBQVksS0FBbUMsRUFBRSxVQUEyQixFQUFFO1FBQzVFLEtBQUssQ0FBQyxLQUFLLENBQUMsQ0FBQztRQUViLElBQUksQ0FBQyxLQUFLLENBQUMsTUFBTSxFQUFFLENBQUM7WUFDbEIsTUFBTSxJQUFJLEtBQUssQ0FBQyx1REFBdUQsQ0FBQyxDQUFDO1FBQzNFLENBQUM7UUFFRCxNQUFNLE9BQU8sR0FBRyxPQUFPLENBQUMsT0FBTyxJQUFJLFFBQVEsQ0FBQztRQUM1QyxNQUFNLFVBQVUsR0FBRyxPQUFPLENBQUMsVUFBVSxJQUFJLEVBQUUsQ0FBQztRQUU1QyxNQUFNLEtBQUssR0FBYTtZQUN0Qiw4RUFBOEU7WUFDOUUsR0FBRztZQUNILDBFQUEwRTtZQUMxRSw2RUFBNkU7WUFDN0Usb0RBQW9EO1lBQ3BELFVBQVU7WUFDVixtQkFBbUI7U0FDcEIsQ0FBQztRQUNGLEtBQUssTUFBTSxDQUFDLElBQUksVUFBVSxFQUFFLENBQUM7WUFDM0IsS0FBSyxDQUFDLElBQUksQ0FBQyxFQUFFLEVBQUUsS0FBSyxDQUFDLENBQUMsV0FBVyxFQUFFLEVBQUUsZ0JBQWdCLEVBQUUsaUJBQWlCLElBQUksQ0FBQyxTQUFTLENBQUMsQ0FBQyxDQUFDLFdBQVcsQ0FBQyxFQUFFLENBQUMsQ0FBQztZQUN6RyxJQUFJLENBQUMsQ0FBQyxTQUFTLEVBQUUsQ0FBQztnQkFDaEIsS0FBSyxDQUFDLElBQUksQ0FBQyxlQUFlLElBQUksQ0FBQyxTQUFTLENBQUMsQ0FBQyxDQUFDLFNBQVMsQ0FBQyxFQUFFLENBQUMsQ0FBQztZQUMzRCxDQUFDO1lBQ0QsSUFBSSxDQUFDLENBQUMsV0FBVyxFQUFFLENBQUM7Z0JBQ2xCLEtBQUssQ0FBQyxJQUFJLENBQUMsaUJBQWlCLElBQUksQ0FBQyxTQUFTLENBQUMsQ0FBQyxDQUFDLFdBQVcsQ0FBQyxFQUFFLENBQUMsQ0FBQztZQUMvRCxDQUFDO1lBQ0QsSUFBSSxDQUFDLENBQUMsS0FBSyxJQUFJLENBQUMsQ0FBQyxLQUFLLENBQUMsTUFBTSxHQUFHLENBQUMsRUFBRSxDQUFDO2dCQUNsQyxLQUFLLENBQUMsSUFBSSxDQUFDLFlBQVksQ0FBQyxDQUFDLEtBQUssQ0FBQyxHQUFHLENBQUMsQ0FBQyxDQUFDLEVBQUUsRUFBRSxDQUFDLE1BQU0sQ0FBQyxLQUFLLENBQUMsQ0FBQyxJQUFJLENBQUMsSUFBSSxDQUFDLEdBQUcsQ0FBQyxDQUFDO1lBQ3pFLENBQUM7WUFDRCxJQUFJLENBQUMsQ0FBQyxPQUFPLElBQUksQ0FBQyxDQUFDLE9BQU8sQ0FBQyxNQUFNLEdBQUcsQ0FBQyxFQUFFLENBQUM7Z0JBQ3RDLEtBQUssQ0FBQyxJQUFJLENBQUMsY0FBYyxDQUFDLENBQUMsT0FBTyxDQUFDLEdBQUcsQ0FBQyxDQUFDLENBQUMsRUFBRSxFQUFFLENBQUMsTUFBTSxDQUFDLEtBQUssQ0FBQyxDQUFDLElBQUksQ0FBQyxJQUFJLENBQUMsR0FBRyxDQUFDLENBQUM7WUFDN0UsQ0FBQztRQUNILENBQUM7UUFFRCxJQUFJLENBQUMsVUFBVSxHQUFHLElBQUksaUJBQVEsQ0FBQyxLQUFLLEVBQUUsZ0JBQWdCLEVBQUU7WUFDdEQsS0FBSztZQUNMLDBFQUEwRTtZQUMxRSxNQUFNLEVBQUUsS0FBSztTQUNkLENBQUMsQ0FBQztRQUVILElBQUksQ0FBQyxRQUFRLEdBQUcsS0FBSyxDQUFDLE1BQU0sQ0FBQyxXQUFXLENBQUMsVUFBVSxDQUFDLENBQUM7UUFDckQseUVBQXlFO1FBQ3pFLHdEQUF3RDtRQUN4RCxJQUFJLENBQUMsUUFBUSxDQUFDLEVBQUUsQ0FBQztZQUNmLFdBQVcsRUFBRSxFQUFFO1lBQ2YsVUFBVSxFQUFFLEVBQUU7WUFDZCxnQkFBZ0IsRUFBRSxFQUFFO1NBQ3JCLENBQUMsQ0FBQztRQUNILElBQUksQ0FBQyxRQUFRLENBQUMsTUFBTSxDQUFDLFVBQVUsRUFBRTtZQUMvQixNQUFNLEVBQUUsQ0FBQyxlQUFlLENBQUM7WUFDekIsV0FBVyxFQUFFLEVBQUUsUUFBUSxFQUFFLGVBQU0sQ0FBQyxTQUFTLENBQUMsYUFBYSxDQUFDLElBQUksRUFBRTtZQUM5RCxLQUFLLEVBQUU7Z0JBQ0w7b0JBQ0UsSUFBSSxFQUFFLFVBQVU7b0JBQ2hCLElBQUksRUFBRSxxQkFBcUI7b0JBQzNCLHdFQUF3RTtvQkFDeEUsSUFBSSxFQUFFLEVBQUUsYUFBYSxFQUFFLENBQUMsRUFBRTtpQkFDM0I7Z0JBQ0Q7b0JBQ0UsSUFBSSxFQUFFLGtCQUFrQjtvQkFDeEIsR0FBRyxFQUFFO3dCQUNILHNFQUFzRSxPQUFPLGFBQWEsT0FBTyxzQkFBc0I7d0JBQ3ZILHNCQUFzQjt3QkFDdEIsMENBQTBDO3FCQUMzQyxDQUFDLElBQUksQ0FBQyxJQUFJLENBQUM7aUJBQ2I7Z0JBQ0Q7b0JBQ0UsSUFBSSxFQUFFLGtCQUFrQjtvQkFDeEIsNERBQTREO29CQUM1RCxHQUFHLEVBQUUscUNBQXFDO2lCQUMzQzthQUNGO1NBQ0YsQ0FBQyxDQUFDO0lBQ0wsQ0FBQzs7QUFsRkgsNEJBbUZDIiwic291cmNlc0NvbnRlbnQiOlsiaW1wb3J0IHsgQ29tcG9uZW50LCBUZXh0RmlsZSwgZ2l0aHViLCB0eXBlc2NyaXB0IH0gZnJvbSAncHJvamVuJztcblxuLyoqXG4gKiBPbmUgcGF0aC1zY29wZWQgYWxsb3dsaXN0IGVudHJ5IGZvciB0aGUgZ2VuZXJhdGVkIGAuZ2l0bGVha3MudG9tbGAuXG4gKlxuICogRWFjaCBlbnRyeSBpcyByZW5kZXJlZCBhcyBhIGBbW2FsbG93bGlzdHNdXWAgYmxvY2suIEtlZXAgZXZlcnkgYWxsb3dsaXN0IGFzXG4gKiB0aWdodGx5IHBhdGgtc2NvcGVkIGFzIHBvc3NpYmxlIHNvIGl0IGNhbm5vdCBtYXNrIGEgcmVhbCBzZWNyZXQgZWxzZXdoZXJlIGluXG4gKiB0aGUgcmVwby5cbiAqL1xuZXhwb3J0IGludGVyZmFjZSBHaXRsZWFrc0FsbG93bGlzdCB7XG4gIC8qKiBIdW1hbi1yZWFkYWJsZSBkZXNjcmlwdGlvbiBvZiB3aGF0IHRoaXMgYWxsb3dsaXN0IGV4ZW1wdHMgYW5kIHdoeS4gKi9cbiAgcmVhZG9ubHkgZGVzY3JpcHRpb246IHN0cmluZztcbiAgLyoqXG4gICAqIFJlZ2V4IHBhdGhzIHRoZSBhbGxvd2xpc3QgYXBwbGllcyB0byAocmVuZGVyZWQgYXMgZ2l0bGVha3MgYHBhdGhzYCksIGUuZy5cbiAgICogYFsnXlxcXFwubnBtcmMkJ11gLiBPbWl0IHRvIGFwcGx5IHRoZSByZWdleGVzIHJlcG8td2lkZSAoZGlzY291cmFnZWQpLlxuICAgKlxuICAgKiBAZGVmYXVsdCAtIG5vIHBhdGggc2NvcGVcbiAgICovXG4gIHJlYWRvbmx5IHBhdGhzPzogc3RyaW5nW107XG4gIC8qKlxuICAgKiBSZWdleGVzIG1hdGNoaW5nIHRoZSBhbGxvd2VkIHNlY3JldCB2YWx1ZXMgKHJlbmRlcmVkIGFzIGdpdGxlYWtzXG4gICAqIGByZWdleGVzYCkuIE9taXQgdG8gYWxsb3cgYW55dGhpbmcgb24gdGhlIHNjb3BlZCBwYXRocy5cbiAgICpcbiAgICogQGRlZmF1bHQgLSBubyB2YWx1ZSByZWdleGVzXG4gICAqL1xuICByZWFkb25seSByZWdleGVzPzogc3RyaW5nW107XG4gIC8qKlxuICAgKiBnaXRsZWFrcyBgY29uZGl0aW9uYCBjb21iaW5pbmcgYHBhdGhzYCBhbmQgYHJlZ2V4ZXNgIChgQU5EYCByZXF1aXJlcyBib3RoKS5cbiAgICpcbiAgICogQGRlZmF1bHQgLSBnaXRsZWFrcyBkZWZhdWx0IChPUilcbiAgICovXG4gIHJlYWRvbmx5IGNvbmRpdGlvbj86IHN0cmluZztcbiAgLyoqXG4gICAqIGdpdGxlYWtzIGByZWdleFRhcmdldGAgKGBzZWNyZXRgIHwgYG1hdGNoYCB8IGBsaW5lYCkuXG4gICAqXG4gICAqIEBkZWZhdWx0IC0gZ2l0bGVha3MgZGVmYXVsdFxuICAgKi9cbiAgcmVhZG9ubHkgcmVnZXhUYXJnZXQ/OiBzdHJpbmc7XG59XG5cbmV4cG9ydCBpbnRlcmZhY2UgR2l0bGVha3NPcHRpb25zIHtcbiAgLyoqXG4gICAqIFRoZSBnaXRsZWFrcyB2ZXJzaW9uIGRvd25sb2FkZWQgaW4gQ0kuXG4gICAqXG4gICAqIEBkZWZhdWx0ICc4LjMwLjEnXG4gICAqL1xuICByZWFkb25seSB2ZXJzaW9uPzogc3RyaW5nO1xuICAvKipcbiAgICogUGF0aC1zY29wZWQgYWxsb3dsaXN0cyBmb3Iga25vd24gZmFsc2UgcG9zaXRpdmVzLCBhcHBlbmRlZCBhZnRlclxuICAgKiBgW2V4dGVuZF0gdXNlRGVmYXVsdCA9IHRydWVgLlxuICAgKlxuICAgKiBAZGVmYXVsdCBbXVxuICAgKi9cbiAgcmVhZG9ubHkgYWxsb3dsaXN0cz86IEdpdGxlYWtzQWxsb3dsaXN0W107XG59XG5cbi8qKlxuICogZ2l0bGVha3Mgc2VjcmV0LXNjYW5uaW5nIGZvciBhIHByb2plY3Q6IGEgYC5naXRsZWFrcy50b21sYCBjb25maWcgdGhhdCBleHRlbmRzXG4gKiB0aGUgYnVuZGxlZCBkZWZhdWx0IHJ1bGVzZXQgcGx1cyB0aWdodGx5IHBhdGgtc2NvcGVkIGFsbG93bGlzdHMsIGFuZCBhXG4gKiBwdWxsLXJlcXVlc3Qgd29ya2Zsb3cgdGhhdCBzY2FucyB0aGUgZnVsbCBnaXQgaGlzdG9yeSBhZ2FpbnN0IGl0LlxuICpcbiAqIHByb2plbiBoYXMgbm8gbmF0aXZlIGdpdGxlYWtzIGNvbXBvbmVudCwgc28gYm90aCBhcnRpZmFjdHMgYXJlIGdlbmVyYXRlZCBoZXJlXG4gKiB0byBzdGF5IGluIHRoZSBcIm5ldmVyIGhhbmQtZWRpdCBnZW5lcmF0ZWQgZmlsZXNcIiBtb2RlbC4gUmVxdWlyZXMgR2l0SHViIHRvIGJlXG4gKiBlbmFibGVkIG9uIHRoZSBwcm9qZWN0LlxuICovXG5leHBvcnQgY2xhc3MgR2l0bGVha3MgZXh0ZW5kcyBDb21wb25lbnQge1xuXG4gIC8qKiBUaGUgZ2VuZXJhdGVkIGAuZ2l0bGVha3MudG9tbGAuICovXG4gIHB1YmxpYyByZWFkb25seSBjb25maWdGaWxlOiBUZXh0RmlsZTtcblxuICAvKiogVGhlIGdlbmVyYXRlZCBwdWxsLXJlcXVlc3Qgc2Nhbm5pbmcgd29ya2Zsb3cuICovXG4gIHB1YmxpYyByZWFkb25seSB3b3JrZmxvdzogZ2l0aHViLkdpdGh1YldvcmtmbG93O1xuXG4gIGNvbnN0cnVjdG9yKHNjb3BlOiB0eXBlc2NyaXB0LlR5cGVTY3JpcHRQcm9qZWN0LCBvcHRpb25zOiBHaXRsZWFrc09wdGlvbnMgPSB7fSkge1xuICAgIHN1cGVyKHNjb3BlKTtcblxuICAgIGlmICghc2NvcGUuZ2l0aHViKSB7XG4gICAgICB0aHJvdyBuZXcgRXJyb3IoJ0dpdGxlYWtzIHJlcXVpcmVzIEdpdEh1YiB0byBiZSBlbmFibGVkIG9uIHRoZSBwcm9qZWN0Jyk7XG4gICAgfVxuXG4gICAgY29uc3QgdmVyc2lvbiA9IG9wdGlvbnMudmVyc2lvbiA/PyAnOC4zMC4xJztcbiAgICBjb25zdCBhbGxvd2xpc3RzID0gb3B0aW9ucy5hbGxvd2xpc3RzID8/IFtdO1xuXG4gICAgY29uc3QgbGluZXM6IHN0cmluZ1tdID0gW1xuICAgICAgJyMgfn4gR2VuZXJhdGVkIGJ5IHByb2plbi4gVG8gbW9kaWZ5LCBlZGl0IC5wcm9qZW5yYy50cyBhbmQgcnVuIFwibnB4IHByb2plblwiLicsXG4gICAgICAnIycsXG4gICAgICAnIyBnaXRsZWFrcyBjb25maWcuIEV4dGVuZHMgdGhlIGRlZmF1bHQgcnVsZXNldCwgdGhlbiBhZGRzIHRpZ2h0bHkgc2NvcGVkJyxcbiAgICAgICcjIGFsbG93bGlzdHMgZm9yIGtub3duIGZhbHNlIHBvc2l0aXZlcy4gRWFjaCBhbGxvd2xpc3QgaXMgcGF0aC1zY29wZWQgc28gaXQnLFxuICAgICAgJyMgY2Fubm90IG1hc2sgYSByZWFsIHNlY3JldCBlbHNld2hlcmUgaW4gdGhlIHJlcG8uJyxcbiAgICAgICdbZXh0ZW5kXScsXG4gICAgICAndXNlRGVmYXVsdCA9IHRydWUnLFxuICAgIF07XG4gICAgZm9yIChjb25zdCBhIG9mIGFsbG93bGlzdHMpIHtcbiAgICAgIGxpbmVzLnB1c2goJycsIGAjICR7YS5kZXNjcmlwdGlvbn1gLCAnW1thbGxvd2xpc3RzXV0nLCBgZGVzY3JpcHRpb24gPSAke0pTT04uc3RyaW5naWZ5KGEuZGVzY3JpcHRpb24pfWApO1xuICAgICAgaWYgKGEuY29uZGl0aW9uKSB7XG4gICAgICAgIGxpbmVzLnB1c2goYGNvbmRpdGlvbiA9ICR7SlNPTi5zdHJpbmdpZnkoYS5jb25kaXRpb24pfWApO1xuICAgICAgfVxuICAgICAgaWYgKGEucmVnZXhUYXJnZXQpIHtcbiAgICAgICAgbGluZXMucHVzaChgcmVnZXhUYXJnZXQgPSAke0pTT04uc3RyaW5naWZ5KGEucmVnZXhUYXJnZXQpfWApO1xuICAgICAgfVxuICAgICAgaWYgKGEucGF0aHMgJiYgYS5wYXRocy5sZW5ndGggPiAwKSB7XG4gICAgICAgIGxpbmVzLnB1c2goYHBhdGhzID0gWyR7YS5wYXRocy5tYXAoKHApID0+IGAnJycke3B9JycnYCkuam9pbignLCAnKX1dYCk7XG4gICAgICB9XG4gICAgICBpZiAoYS5yZWdleGVzICYmIGEucmVnZXhlcy5sZW5ndGggPiAwKSB7XG4gICAgICAgIGxpbmVzLnB1c2goYHJlZ2V4ZXMgPSBbJHthLnJlZ2V4ZXMubWFwKChyKSA9PiBgJycnJHtyfScnJ2ApLmpvaW4oJywgJyl9XWApO1xuICAgICAgfVxuICAgIH1cblxuICAgIHRoaXMuY29uZmlnRmlsZSA9IG5ldyBUZXh0RmlsZShzY29wZSwgJy5naXRsZWFrcy50b21sJywge1xuICAgICAgbGluZXMsXG4gICAgICAvLyBBIGAvL2Atc3R5bGUgcHJvamVuIG1hcmtlciBpcyBpbnZhbGlkIFRPTUw7IHRoZSBgI2AgbWFya2VyIGlzIGJha2VkIGluLlxuICAgICAgbWFya2VyOiBmYWxzZSxcbiAgICB9KTtcblxuICAgIHRoaXMud29ya2Zsb3cgPSBzY29wZS5naXRodWIuYWRkV29ya2Zsb3coJ2dpdGxlYWtzJyk7XG4gICAgLy8gU2VjcmV0cyBjYW4gbGFuZCBpbiBhbnkgcGF0aCwgc28gbm8gcGF0aCBmaWx0ZXIg4oCUIHBsdXMgbWVyZ2UgcXVldWUgYW5kXG4gICAgLy8gbWFudWFsIGRpc3BhdGNoLCBtYXRjaGluZyB0aGUgcmVwbydzIG90aGVyIHdvcmtmbG93cy5cbiAgICB0aGlzLndvcmtmbG93Lm9uKHtcbiAgICAgIHB1bGxSZXF1ZXN0OiB7fSxcbiAgICAgIG1lcmdlR3JvdXA6IHt9LFxuICAgICAgd29ya2Zsb3dEaXNwYXRjaDoge30sXG4gICAgfSk7XG4gICAgdGhpcy53b3JrZmxvdy5hZGRKb2IoJ2dpdGxlYWtzJywge1xuICAgICAgcnVuc09uOiBbJ3VidW50dS1sYXRlc3QnXSxcbiAgICAgIHBlcm1pc3Npb25zOiB7IGNvbnRlbnRzOiBnaXRodWIud29ya2Zsb3dzLkpvYlBlcm1pc3Npb24uUkVBRCB9LFxuICAgICAgc3RlcHM6IFtcbiAgICAgICAge1xuICAgICAgICAgIG5hbWU6ICdDaGVja291dCcsXG4gICAgICAgICAgdXNlczogJ2FjdGlvbnMvY2hlY2tvdXRAdjQnLFxuICAgICAgICAgIC8vIEZ1bGwgaGlzdG9yeSBzbyBnaXRsZWFrcyBzY2FucyBldmVyeSBjb21taXQgaW4gdGhlIFBSLCBub3QganVzdCBIRUFELlxuICAgICAgICAgIHdpdGg6IHsgJ2ZldGNoLWRlcHRoJzogMCB9LFxuICAgICAgICB9LFxuICAgICAgICB7XG4gICAgICAgICAgbmFtZTogJ0luc3RhbGwgZ2l0bGVha3MnLFxuICAgICAgICAgIHJ1bjogW1xuICAgICAgICAgICAgYGN1cmwgLXNTZkwgaHR0cHM6Ly9naXRodWIuY29tL2dpdGxlYWtzL2dpdGxlYWtzL3JlbGVhc2VzL2Rvd25sb2FkL3Yke3ZlcnNpb259L2dpdGxlYWtzXyR7dmVyc2lvbn1fbGludXhfeDY0LnRhci5neiBcXFxcYCxcbiAgICAgICAgICAgICcgIHwgdGFyIC14eiBnaXRsZWFrcycsXG4gICAgICAgICAgICAnc3VkbyBtdiBnaXRsZWFrcyAvdXNyL2xvY2FsL2Jpbi9naXRsZWFrcycsXG4gICAgICAgICAgXS5qb2luKCdcXG4nKSxcbiAgICAgICAgfSxcbiAgICAgICAge1xuICAgICAgICAgIG5hbWU6ICdTY2FuIGdpdCBoaXN0b3J5JyxcbiAgICAgICAgICAvLyAtLXJlZGFjdCBrZWVwcyBhbnkgcmVhbCBzZWNyZXQgb3V0IG9mIHRoZSBwdWJsaWMgQ0kgbG9ncy5cbiAgICAgICAgICBydW46ICdnaXRsZWFrcyBnaXQgLS1uby1iYW5uZXIgLS1yZWRhY3QgLicsXG4gICAgICAgIH0sXG4gICAgICBdLFxuICAgIH0pO1xuICB9XG59XG4iXX0=

package/lib/components/index.d.ts

@@ -1,2 +1,3 @@
 export * from './amplify-deploy';
 export * from './production-release';
+export * from './gitleaks';

package/lib/components/index.js

@@ -16,4 +16,5 @@ var __exportStar = (this && this.__exportStar) || function(m, exports) {
 Object.defineProperty(exports, "__esModule", { value: true });
 __exportStar(require("./amplify-deploy"), exports);
 __exportStar(require("./production-release"), exports);
-//# sourceMappingURL=data:application/json;base64,eyJ2ZXJzaW9uIjozLCJmaWxlIjoiaW5kZXguanMiLCJzb3VyY2VSb290IjoiIiwic291cmNlcyI6WyIuLi8uLi9zcmMvY29tcG9uZW50cy9pbmRleC50cyJdLCJuYW1lcyI6W10sIm1hcHBpbmdzIjoiOzs7Ozs7Ozs7Ozs7Ozs7O0FBQUEsbURBQWlDO0FBQ2pDLHVEQUFxQyIsInNvdXJjZXNDb250ZW50IjpbImV4cG9ydCAqIGZyb20gJy4vYW1wbGlmeS1kZXBsb3knO1xuZXhwb3J0ICogZnJvbSAnLi9wcm9kdWN0aW9uLXJlbGVhc2UnO1xuIl19
+__exportStar(require("./gitleaks"), exports);
+//# sourceMappingURL=data:application/json;base64,eyJ2ZXJzaW9uIjozLCJmaWxlIjoiaW5kZXguanMiLCJzb3VyY2VSb290IjoiIiwic291cmNlcyI6WyIuLi8uLi9zcmMvY29tcG9uZW50cy9pbmRleC50cyJdLCJuYW1lcyI6W10sIm1hcHBpbmdzIjoiOzs7Ozs7Ozs7Ozs7Ozs7O0FBQUEsbURBQWlDO0FBQ2pDLHVEQUFxQztBQUNyQyw2Q0FBMkIiLCJzb3VyY2VzQ29udGVudCI6WyJleHBvcnQgKiBmcm9tICcuL2FtcGxpZnktZGVwbG95JztcbmV4cG9ydCAqIGZyb20gJy4vcHJvZHVjdGlvbi1yZWxlYXNlJztcbmV4cG9ydCAqIGZyb20gJy4vZ2l0bGVha3MnO1xuIl19

package/lib/components/production-release.js

@@ -15,7 +15,7 @@ const projen_1 = require("projen");
  * dispatch time.
  */
 class GitHubProductionRelease extends projen_1.Component {
-    static [JSII_RTTI_SYMBOL_1] = { fqn: "@taimos/projen.GitHubProductionRelease", version: "0.1.85" };
+    static [JSII_RTTI_SYMBOL_1] = { fqn: "@taimos/projen.GitHubProductionRelease", version: "0.1.87" };
     /**
      * Resolves the branch that is promoted — the project's default release branch.
      *

package/lib/projects/api-library.d.ts

@@ -0,0 +1,77 @@
+import { TaimosPrivateTypescriptLibrary, TaimosPrivateTypescriptLibraryOptions } from './private-ts-lib';
+/**
+ * REST (OpenAPI) codegen options for the shared API library.
+ */
+export interface ApiRestCodegen {
+    /**
+     * The OpenAPI spec file, relative to the package root.
+     *
+     * @default 'rest.yaml'
+     */
+    readonly specFile?: string;
+    /**
+     * The generated TypeScript output file.
+     *
+     * @default 'src/generated/rest.model.generated.ts'
+     */
+    readonly outputFile?: string;
+}
+/**
+ * GraphQL (graphql-codegen) codegen options for the shared API library.
+ */
+export interface ApiGraphqlCodegen {
+    /**
+     * The GraphQL schema files, in order, relative to the package root.
+     *
+     * @default ['aws.graphql', 'schema.graphql']
+     */
+    readonly schemaFiles?: string[];
+    /**
+     * The generated TypeScript output file.
+     *
+     * @default './src/generated/graphql.model.generated.ts'
+     */
+    readonly outputFile?: string;
+    /**
+     * Scalar map passed to graphql-codegen. Defaults to the AppSync scalar set
+     * (all mapped to `string`).
+     *
+     * @default - the AppSync scalar map
+     */
+    readonly scalars?: {
+        [name: string]: string;
+    };
+}
+export interface TaimosApiLibraryOptions extends TaimosPrivateTypescriptLibraryOptions {
+    /**
+     * Enable REST (OpenAPI -> TypeScript) codegen via `openapi-typescript`.
+     *
+     * Pass `true` for defaults, an object to customise, or `false` to disable.
+     *
+     * @default true
+     */
+    readonly rest?: boolean | ApiRestCodegen;
+    /**
+     * Enable GraphQL codegen via `graphql-codegen`.
+     *
+     * Pass `true` for defaults, an object to customise, or omit to disable. The
+     * graphql-codegen v5 / typescript-plugin v4 lines are pinned because v6/v7 are
+     * incompatible with graphql 16, which the workspace pins.
+     *
+     * @default false
+     */
+    readonly graphql?: boolean | ApiGraphqlCodegen;
+}
+/**
+ * The shared, workspace-internal API/types library for a Taimos monorepo.
+ *
+ * Owns the canonical contract (OpenAPI and/or GraphQL) and the generated
+ * TypeScript types, consumed by the backend and frontends via `workspace:*`.
+ * Wires the codegen tasks, the `@generated`/`@util` tsconfig path aliases, and
+ * the matching jest `moduleNameMapper` so a consumer does not re-derive them.
+ *
+ * @pjid taimos-api-library
+ */
+export declare class TaimosApiLibrary extends TaimosPrivateTypescriptLibrary {
+    constructor(options: TaimosApiLibraryOptions);
+}

package/lib/projects/api-library.js

@@ -0,0 +1,111 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.TaimosApiLibrary = void 0;
+const JSII_RTTI_SYMBOL_1 = Symbol.for("jsii.rtti");
+const projen_1 = require("projen");
+const private_ts_lib_1 = require("./private-ts-lib");
+const DEFAULT_SCALARS = {
+    AWSDate: 'string',
+    AWSURL: 'string',
+    AWSEmail: 'string',
+    AWSTime: 'string',
+    AWSDateTime: 'string',
+    AWSTimestamp: 'string',
+    AWSPhone: 'string',
+    AWSIPAddress: 'string',
+    AWSJSON: 'string',
+};
+/**
+ * The shared, workspace-internal API/types library for a Taimos monorepo.
+ *
+ * Owns the canonical contract (OpenAPI and/or GraphQL) and the generated
+ * TypeScript types, consumed by the backend and frontends via `workspace:*`.
+ * Wires the codegen tasks, the `@generated`/`@util` tsconfig path aliases, and
+ * the matching jest `moduleNameMapper` so a consumer does not re-derive them.
+ *
+ * @pjid taimos-api-library
+ */
+class TaimosApiLibrary extends private_ts_lib_1.TaimosPrivateTypescriptLibrary {
+    static [JSII_RTTI_SYMBOL_1] = { fqn: "@taimos/projen.TaimosApiLibrary", version: "0.1.87" };
+    constructor(options) {
+        const restEnabled = options.rest ?? true;
+        const graphqlEnabled = options.graphql ?? false;
+        const rest = typeof restEnabled === 'object' ? restEnabled : {};
+        const gql = typeof graphqlEnabled === 'object' ? graphqlEnabled : {};
+        super({
+            projenrcTs: false,
+            sampleCode: false,
+            github: false,
+            release: false,
+            releaseToNpm: false, // workspace-internal; consumed via workspace:*
+            licensed: false,
+            docgen: false,
+            depsUpgrade: false,
+            ...options,
+            tsconfig: {
+                ...options.tsconfig,
+                compilerOptions: {
+                    skipLibCheck: true,
+                    paths: {
+                        '@generated/*': ['./src/generated/*'],
+                        '@util/*': ['./src/util/*'],
+                        ...options.tsconfig?.compilerOptions?.paths,
+                    },
+                    ...options.tsconfig?.compilerOptions,
+                },
+            },
+            jestOptions: {
+                ...options.jestOptions,
+                jestConfig: {
+                    ...options.jestOptions?.jestConfig,
+                    moduleNameMapper: {
+                        '^@generated/(.*)$': '<rootDir>/src/generated/$1',
+                        '^@util/(.*)$': '<rootDir>/src/util/$1',
+                        ...options.jestOptions?.jestConfig?.moduleNameMapper,
+                    },
+                },
+            },
+            deps: [
+                ...(restEnabled ? ['openapi-typescript@^7.0.0'] : []),
+                ...(graphqlEnabled ? ['graphql@^16.14.2'] : []),
+                ...options.deps ?? [],
+            ],
+            devDeps: [
+                ...(graphqlEnabled ? ['@graphql-codegen/cli@^5.0.0', '@graphql-codegen/typescript@^4.0.0'] : []),
+                ...options.devDeps ?? [],
+            ],
+        });
+        if (restEnabled) {
+            const specFile = rest.specFile ?? 'rest.yaml';
+            const outputFile = rest.outputFile ?? 'src/generated/rest.model.generated.ts';
+            const task = this.addTask('generate:api:rest', {
+                exec: `openapi-typescript ${specFile} --output ${outputFile}`,
+                description: 'Generate TypeScript types from the OpenAPI specification',
+            });
+            this.preCompileTask.prependSpawn(task);
+        }
+        if (graphqlEnabled) {
+            const configFileName = 'graphql-codegen.yml';
+            const outputFile = gql.outputFile ?? './src/generated/graphql.model.generated.ts';
+            const task = this.addTask('generate:api:graphql', {
+                exec: `graphql-codegen -c ${configFileName}`,
+                description: 'Generate Types from the GraphQL specification',
+            });
+            this.preCompileTask.prependSpawn(task);
+            new projen_1.YamlFile(this, configFileName, {
+                obj: {
+                    schema: gql.schemaFiles ?? ['aws.graphql', 'schema.graphql'],
+                    config: {
+                        scalars: gql.scalars ?? DEFAULT_SCALARS,
+                        maybeValue: 'T | undefined',
+                    },
+                    generates: {
+                        [outputFile]: { plugins: ['typescript'] },
+                    },
+                },
+            });
+        }
+    }
+}
+exports.TaimosApiLibrary = TaimosApiLibrary;
+//# sourceMappingURL=data:application/json;base64,eyJ2ZXJzaW9uIjozLCJmaWxlIjoiYXBpLWxpYnJhcnkuanMiLCJzb3VyY2VSb290IjoiIiwic291cmNlcyI6WyIuLi8uLi9zcmMvcHJvamVjdHMvYXBpLWxpYnJhcnkudHMiXSwibmFtZXMiOltdLCJtYXBwaW5ncyI6Ijs7OztBQUFBLG1DQUFrQztBQUNsQyxxREFBeUc7QUFrRXpHLE1BQU0sZUFBZSxHQUErQjtJQUNsRCxPQUFPLEVBQUUsUUFBUTtJQUNqQixNQUFNLEVBQUUsUUFBUTtJQUNoQixRQUFRLEVBQUUsUUFBUTtJQUNsQixPQUFPLEVBQUUsUUFBUTtJQUNqQixXQUFXLEVBQUUsUUFBUTtJQUNyQixZQUFZLEVBQUUsUUFBUTtJQUN0QixRQUFRLEVBQUUsUUFBUTtJQUNsQixZQUFZLEVBQUUsUUFBUTtJQUN0QixPQUFPLEVBQUUsUUFBUTtDQUNsQixDQUFDO0FBRUY7Ozs7Ozs7OztHQVNHO0FBQ0gsTUFBYSxnQkFBaUIsU0FBUSwrQ0FBOEI7O0lBRWxFLFlBQVksT0FBZ0M7UUFDMUMsTUFBTSxXQUFXLEdBQUcsT0FBTyxDQUFDLElBQUksSUFBSSxJQUFJLENBQUM7UUFDekMsTUFBTSxjQUFjLEdBQUcsT0FBTyxDQUFDLE9BQU8sSUFBSSxLQUFLLENBQUM7UUFFaEQsTUFBTSxJQUFJLEdBQW1CLE9BQU8sV0FBVyxLQUFLLFFBQVEsQ0FBQyxDQUFDLENBQUMsV0FBVyxDQUFDLENBQUMsQ0FBQyxFQUFFLENBQUM7UUFDaEYsTUFBTSxHQUFHLEdBQXNCLE9BQU8sY0FBYyxLQUFLLFFBQVEsQ0FBQyxDQUFDLENBQUMsY0FBYyxDQUFDLENBQUMsQ0FBQyxFQUFFLENBQUM7UUFFeEYsS0FBSyxDQUFDO1lBQ0osVUFBVSxFQUFFLEtBQUs7WUFDakIsVUFBVSxFQUFFLEtBQUs7WUFDakIsTUFBTSxFQUFFLEtBQUs7WUFDYixPQUFPLEVBQUUsS0FBSztZQUNkLFlBQVksRUFBRSxLQUFLLEVBQUUsK0NBQStDO1lBQ3BFLFFBQVEsRUFBRSxLQUFLO1lBQ2YsTUFBTSxFQUFFLEtBQUs7WUFDYixXQUFXLEVBQUUsS0FBSztZQUNsQixHQUFHLE9BQU87WUFDVixRQUFRLEVBQUU7Z0JBQ1IsR0FBRyxPQUFPLENBQUMsUUFBUTtnQkFDbkIsZUFBZSxFQUFFO29CQUNmLFlBQVksRUFBRSxJQUFJO29CQUNsQixLQUFLLEVBQUU7d0JBQ0wsY0FBYyxFQUFFLENBQUMsbUJBQW1CLENBQUM7d0JBQ3JDLFNBQVMsRUFBRSxDQUFDLGNBQWMsQ0FBQzt3QkFDM0IsR0FBRyxPQUFPLENBQUMsUUFBUSxFQUFFLGVBQWUsRUFBRSxLQUFLO3FCQUM1QztvQkFDRCxHQUFHLE9BQU8sQ0FBQyxRQUFRLEVBQUUsZUFBZTtpQkFDckM7YUFDRjtZQUNELFdBQVcsRUFBRTtnQkFDWCxHQUFHLE9BQU8sQ0FBQyxXQUFXO2dCQUN0QixVQUFVLEVBQUU7b0JBQ1YsR0FBRyxPQUFPLENBQUMsV0FBVyxFQUFFLFVBQVU7b0JBQ2xDLGdCQUFnQixFQUFFO3dCQUNoQixtQkFBbUIsRUFBRSw0QkFBNEI7d0JBQ2pELGNBQWMsRUFBRSx1QkFBdUI7d0JBQ3ZDLEdBQUcsT0FBTyxDQUFDLFdBQVcsRUFBRSxVQUFVLEVBQUUsZ0JBQWdCO3FCQUNyRDtpQkFDRjthQUNGO1lBQ0QsSUFBSSxFQUFFO2dCQUNKLEdBQUcsQ0FBQyxXQUFXLENBQUMsQ0FBQyxDQUFDLENBQUMsMkJBQTJCLENBQUMsQ0FBQyxDQUFDLENBQUMsRUFBRSxDQUFDO2dCQUNyRCxHQUFHLENBQUMsY0FBYyxDQUFDLENBQUMsQ0FBQyxDQUFDLGtCQUFrQixDQUFDLENBQUMsQ0FBQyxDQUFDLEVBQUUsQ0FBQztnQkFDL0MsR0FBRyxPQUFPLENBQUMsSUFBSSxJQUFJLEVBQUU7YUFDdEI7WUFDRCxPQUFPLEVBQUU7Z0JBQ1AsR0FBRyxDQUFDLGNBQWMsQ0FBQyxDQUFDLENBQUMsQ0FBQyw2QkFBNkIsRUFBRSxvQ0FBb0MsQ0FBQyxDQUFDLENBQUMsQ0FBQyxFQUFFLENBQUM7Z0JBQ2hHLEdBQUcsT0FBTyxDQUFDLE9BQU8sSUFBSSxFQUFFO2FBQ3pCO1NBQ0YsQ0FBQyxDQUFDO1FBRUgsSUFBSSxXQUFXLEVBQUUsQ0FBQztZQUNoQixNQUFNLFFBQVEsR0FBRyxJQUFJLENBQUMsUUFBUSxJQUFJLFdBQVcsQ0FBQztZQUM5QyxNQUFNLFVBQVUsR0FBRyxJQUFJLENBQUMsVUFBVSxJQUFJLHVDQUF1QyxDQUFDO1lBQzlFLE1BQU0sSUFBSSxHQUFHLElBQUksQ0FBQyxPQUFPLENBQUMsbUJBQW1CLEVBQUU7Z0JBQzdDLElBQUksRUFBRSxzQkFBc0IsUUFBUSxhQUFhLFVBQVUsRUFBRTtnQkFDN0QsV0FBVyxFQUFFLDBEQUEwRDthQUN4RSxDQUFDLENBQUM7WUFDSCxJQUFJLENBQUMsY0FBYyxDQUFDLFlBQVksQ0FBQyxJQUFJLENBQUMsQ0FBQztRQUN6QyxDQUFDO1FBRUQsSUFBSSxjQUFjLEVBQUUsQ0FBQztZQUNuQixNQUFNLGNBQWMsR0FBRyxxQkFBcUIsQ0FBQztZQUM3QyxNQUFNLFVBQVUsR0FBRyxHQUFHLENBQUMsVUFBVSxJQUFJLDRDQUE0QyxDQUFDO1lBQ2xGLE1BQU0sSUFBSSxHQUFHLElBQUksQ0FBQyxPQUFPLENBQUMsc0JBQXNCLEVBQUU7Z0JBQ2hELElBQUksRUFBRSxzQkFBc0IsY0FBYyxFQUFFO2dCQUM1QyxXQUFXLEVBQUUsK0NBQStDO2FBQzdELENBQUMsQ0FBQztZQUNILElBQUksQ0FBQyxjQUFjLENBQUMsWUFBWSxDQUFDLElBQUksQ0FBQyxDQUFDO1lBRXZDLElBQUksaUJBQVEsQ0FBQyxJQUFJLEVBQUUsY0FBYyxFQUFFO2dCQUNqQyxHQUFHLEVBQUU7b0JBQ0gsTUFBTSxFQUFFLEdBQUcsQ0FBQyxXQUFXLElBQUksQ0FBQyxhQUFhLEVBQUUsZ0JBQWdCLENBQUM7b0JBQzVELE1BQU0sRUFBRTt3QkFDTixPQUFPLEVBQUUsR0FBRyxDQUFDLE9BQU8sSUFBSSxlQUFlO3dCQUN2QyxVQUFVLEVBQUUsZUFBZTtxQkFDNUI7b0JBQ0QsU0FBUyxFQUFFO3dCQUNULENBQUMsVUFBVSxDQUFDLEVBQUUsRUFBRSxPQUFPLEVBQUUsQ0FBQyxZQUFZLENBQUMsRUFBRTtxQkFDMUM7aUJBQ0Y7YUFDRixDQUFDLENBQUM7UUFDTCxDQUFDO0lBQ0gsQ0FBQzs7QUFyRkgsNENBc0ZDIiwic291cmNlc0NvbnRlbnQiOlsiaW1wb3J0IHsgWWFtbEZpbGUgfSBmcm9tICdwcm9qZW4nO1xuaW1wb3J0IHsgVGFpbW9zUHJpdmF0ZVR5cGVzY3JpcHRMaWJyYXJ5LCBUYWltb3NQcml2YXRlVHlwZXNjcmlwdExpYnJhcnlPcHRpb25zIH0gZnJvbSAnLi9wcml2YXRlLXRzLWxpYic7XG5cbi8qKlxuICogUkVTVCAoT3BlbkFQSSkgY29kZWdlbiBvcHRpb25zIGZvciB0aGUgc2hhcmVkIEFQSSBsaWJyYXJ5LlxuICovXG5leHBvcnQgaW50ZXJmYWNlIEFwaVJlc3RDb2RlZ2VuIHtcbiAgLyoqXG4gICAqIFRoZSBPcGVuQVBJIHNwZWMgZmlsZSwgcmVsYXRpdmUgdG8gdGhlIHBhY2thZ2Ugcm9vdC5cbiAgICpcbiAgICogQGRlZmF1bHQgJ3Jlc3QueWFtbCdcbiAgICovXG4gIHJlYWRvbmx5IHNwZWNGaWxlPzogc3RyaW5nO1xuICAvKipcbiAgICogVGhlIGdlbmVyYXRlZCBUeXBlU2NyaXB0IG91dHB1dCBmaWxlLlxuICAgKlxuICAgKiBAZGVmYXVsdCAnc3JjL2dlbmVyYXRlZC9yZXN0Lm1vZGVsLmdlbmVyYXRlZC50cydcbiAgICovXG4gIHJlYWRvbmx5IG91dHB1dEZpbGU/OiBzdHJpbmc7XG59XG5cbi8qKlxuICogR3JhcGhRTCAoZ3JhcGhxbC1jb2RlZ2VuKSBjb2RlZ2VuIG9wdGlvbnMgZm9yIHRoZSBzaGFyZWQgQVBJIGxpYnJhcnkuXG4gKi9cbmV4cG9ydCBpbnRlcmZhY2UgQXBpR3JhcGhxbENvZGVnZW4ge1xuICAvKipcbiAgICogVGhlIEdyYXBoUUwgc2NoZW1hIGZpbGVzLCBpbiBvcmRlciwgcmVsYXRpdmUgdG8gdGhlIHBhY2thZ2Ugcm9vdC5cbiAgICpcbiAgICogQGRlZmF1bHQgWydhd3MuZ3JhcGhxbCcsICdzY2hlbWEuZ3JhcGhxbCddXG4gICAqL1xuICByZWFkb25seSBzY2hlbWFGaWxlcz86IHN0cmluZ1tdO1xuICAvKipcbiAgICogVGhlIGdlbmVyYXRlZCBUeXBlU2NyaXB0IG91dHB1dCBmaWxlLlxuICAgKlxuICAgKiBAZGVmYXVsdCAnLi9zcmMvZ2VuZXJhdGVkL2dyYXBocWwubW9kZWwuZ2VuZXJhdGVkLnRzJ1xuICAgKi9cbiAgcmVhZG9ubHkgb3V0cHV0RmlsZT86IHN0cmluZztcbiAgLyoqXG4gICAqIFNjYWxhciBtYXAgcGFzc2VkIHRvIGdyYXBocWwtY29kZWdlbi4gRGVmYXVsdHMgdG8gdGhlIEFwcFN5bmMgc2NhbGFyIHNldFxuICAgKiAoYWxsIG1hcHBlZCB0byBgc3RyaW5nYCkuXG4gICAqXG4gICAqIEBkZWZhdWx0IC0gdGhlIEFwcFN5bmMgc2NhbGFyIG1hcFxuICAgKi9cbiAgcmVhZG9ubHkgc2NhbGFycz86IHsgW25hbWU6IHN0cmluZ106IHN0cmluZyB9O1xufVxuXG5leHBvcnQgaW50ZXJmYWNlIFRhaW1vc0FwaUxpYnJhcnlPcHRpb25zIGV4dGVuZHMgVGFpbW9zUHJpdmF0ZVR5cGVzY3JpcHRMaWJyYXJ5T3B0aW9ucyB7XG4gIC8qKlxuICAgKiBFbmFibGUgUkVTVCAoT3BlbkFQSSAtPiBUeXBlU2NyaXB0KSBjb2RlZ2VuIHZpYSBgb3BlbmFwaS10eXBlc2NyaXB0YC5cbiAgICpcbiAgICogUGFzcyBgdHJ1ZWAgZm9yIGRlZmF1bHRzLCBhbiBvYmplY3QgdG8gY3VzdG9taXNlLCBvciBgZmFsc2VgIHRvIGRpc2FibGUuXG4gICAqXG4gICAqIEBkZWZhdWx0IHRydWVcbiAgICovXG4gIHJlYWRvbmx5IHJlc3Q/OiBib29sZWFuIHwgQXBpUmVzdENvZGVnZW47XG4gIC8qKlxuICAgKiBFbmFibGUgR3JhcGhRTCBjb2RlZ2VuIHZpYSBgZ3JhcGhxbC1jb2RlZ2VuYC5cbiAgICpcbiAgICogUGFzcyBgdHJ1ZWAgZm9yIGRlZmF1bHRzLCBhbiBvYmplY3QgdG8gY3VzdG9taXNlLCBvciBvbWl0IHRvIGRpc2FibGUuIFRoZVxuICAgKiBncmFwaHFsLWNvZGVnZW4gdjUgLyB0eXBlc2NyaXB0LXBsdWdpbiB2NCBsaW5lcyBhcmUgcGlubmVkIGJlY2F1c2UgdjYvdjcgYXJlXG4gICAqIGluY29tcGF0aWJsZSB3aXRoIGdyYXBocWwgMTYsIHdoaWNoIHRoZSB3b3Jrc3BhY2UgcGlucy5cbiAgICpcbiAgICogQGRlZmF1bHQgZmFsc2VcbiAgICovXG4gIHJlYWRvbmx5IGdyYXBocWw/OiBib29sZWFuIHwgQXBpR3JhcGhxbENvZGVnZW47XG59XG5cbmNvbnN0IERFRkFVTFRfU0NBTEFSUzogeyBbbmFtZTogc3RyaW5nXTogc3RyaW5nIH0gPSB7XG4gIEFXU0RhdGU6ICdzdHJpbmcnLFxuICBBV1NVUkw6ICdzdHJpbmcnLFxuICBBV1NFbWFpbDogJ3N0cmluZycsXG4gIEFXU1RpbWU6ICdzdHJpbmcnLFxuICBBV1NEYXRlVGltZTogJ3N0cmluZycsXG4gIEFXU1RpbWVzdGFtcDogJ3N0cmluZycsXG4gIEFXU1Bob25lOiAnc3RyaW5nJyxcbiAgQVdTSVBBZGRyZXNzOiAnc3RyaW5nJyxcbiAgQVdTSlNPTjogJ3N0cmluZycsXG59O1xuXG4vKipcbiAqIFRoZSBzaGFyZWQsIHdvcmtzcGFjZS1pbnRlcm5hbCBBUEkvdHlwZXMgbGlicmFyeSBmb3IgYSBUYWltb3MgbW9ub3JlcG8uXG4gKlxuICogT3ducyB0aGUgY2Fub25pY2FsIGNvbnRyYWN0IChPcGVuQVBJIGFuZC9vciBHcmFwaFFMKSBhbmQgdGhlIGdlbmVyYXRlZFxuICogVHlwZVNjcmlwdCB0eXBlcywgY29uc3VtZWQgYnkgdGhlIGJhY2tlbmQgYW5kIGZyb250ZW5kcyB2aWEgYHdvcmtzcGFjZToqYC5cbiAqIFdpcmVzIHRoZSBjb2RlZ2VuIHRhc2tzLCB0aGUgYEBnZW5lcmF0ZWRgL2BAdXRpbGAgdHNjb25maWcgcGF0aCBhbGlhc2VzLCBhbmRcbiAqIHRoZSBtYXRjaGluZyBqZXN0IGBtb2R1bGVOYW1lTWFwcGVyYCBzbyBhIGNvbnN1bWVyIGRvZXMgbm90IHJlLWRlcml2ZSB0aGVtLlxuICpcbiAqIEBwamlkIHRhaW1vcy1hcGktbGlicmFyeVxuICovXG5leHBvcnQgY2xhc3MgVGFpbW9zQXBpTGlicmFyeSBleHRlbmRzIFRhaW1vc1ByaXZhdGVUeXBlc2NyaXB0TGlicmFyeSB7XG5cbiAgY29uc3RydWN0b3Iob3B0aW9uczogVGFpbW9zQXBpTGlicmFyeU9wdGlvbnMpIHtcbiAgICBjb25zdCByZXN0RW5hYmxlZCA9IG9wdGlvbnMucmVzdCA/PyB0cnVlO1xuICAgIGNvbnN0IGdyYXBocWxFbmFibGVkID0gb3B0aW9ucy5ncmFwaHFsID8/IGZhbHNlO1xuXG4gICAgY29uc3QgcmVzdDogQXBpUmVzdENvZGVnZW4gPSB0eXBlb2YgcmVzdEVuYWJsZWQgPT09ICdvYmplY3QnID8gcmVzdEVuYWJsZWQgOiB7fTtcbiAgICBjb25zdCBncWw6IEFwaUdyYXBocWxDb2RlZ2VuID0gdHlwZW9mIGdyYXBocWxFbmFibGVkID09PSAnb2JqZWN0JyA/IGdyYXBocWxFbmFibGVkIDoge307XG5cbiAgICBzdXBlcih7XG4gICAgICBwcm9qZW5yY1RzOiBmYWxzZSxcbiAgICAgIHNhbXBsZUNvZGU6IGZhbHNlLFxuICAgICAgZ2l0aHViOiBmYWxzZSxcbiAgICAgIHJlbGVhc2U6IGZhbHNlLFxuICAgICAgcmVsZWFzZVRvTnBtOiBmYWxzZSwgLy8gd29ya3NwYWNlLWludGVybmFsOyBjb25zdW1lZCB2aWEgd29ya3NwYWNlOipcbiAgICAgIGxpY2Vuc2VkOiBmYWxzZSxcbiAgICAgIGRvY2dlbjogZmFsc2UsXG4gICAgICBkZXBzVXBncmFkZTogZmFsc2UsXG4gICAgICAuLi5vcHRpb25zLFxuICAgICAgdHNjb25maWc6IHtcbiAgICAgICAgLi4ub3B0aW9ucy50c2NvbmZpZyxcbiAgICAgICAgY29tcGlsZXJPcHRpb25zOiB7XG4gICAgICAgICAgc2tpcExpYkNoZWNrOiB0cnVlLFxuICAgICAgICAgIHBhdGhzOiB7XG4gICAgICAgICAgICAnQGdlbmVyYXRlZC8qJzogWycuL3NyYy9nZW5lcmF0ZWQvKiddLFxuICAgICAgICAgICAgJ0B1dGlsLyonOiBbJy4vc3JjL3V0aWwvKiddLFxuICAgICAgICAgICAgLi4ub3B0aW9ucy50c2NvbmZpZz8uY29tcGlsZXJPcHRpb25zPy5wYXRocyxcbiAgICAgICAgICB9LFxuICAgICAgICAgIC4uLm9wdGlvbnMudHNjb25maWc/LmNvbXBpbGVyT3B0aW9ucyxcbiAgICAgICAgfSxcbiAgICAgIH0sXG4gICAgICBqZXN0T3B0aW9uczoge1xuICAgICAgICAuLi5vcHRpb25zLmplc3RPcHRpb25zLFxuICAgICAgICBqZXN0Q29uZmlnOiB7XG4gICAgICAgICAgLi4ub3B0aW9ucy5qZXN0T3B0aW9ucz8uamVzdENvbmZpZyxcbiAgICAgICAgICBtb2R1bGVOYW1lTWFwcGVyOiB7XG4gICAgICAgICAgICAnXkBnZW5lcmF0ZWQvKC4qKSQnOiAnPHJvb3REaXI+L3NyYy9nZW5lcmF0ZWQvJDEnLFxuICAgICAgICAgICAgJ15AdXRpbC8oLiopJCc6ICc8cm9vdERpcj4vc3JjL3V0aWwvJDEnLFxuICAgICAgICAgICAgLi4ub3B0aW9ucy5qZXN0T3B0aW9ucz8uamVzdENvbmZpZz8ubW9kdWxlTmFtZU1hcHBlcixcbiAgICAgICAgICB9LFxuICAgICAgICB9LFxuICAgICAgfSxcbiAgICAgIGRlcHM6IFtcbiAgICAgICAgLi4uKHJlc3RFbmFibGVkID8gWydvcGVuYXBpLXR5cGVzY3JpcHRAXjcuMC4wJ10gOiBbXSksXG4gICAgICAgIC4uLihncmFwaHFsRW5hYmxlZCA/IFsnZ3JhcGhxbEBeMTYuMTQuMiddIDogW10pLFxuICAgICAgICAuLi5vcHRpb25zLmRlcHMgPz8gW10sXG4gICAgICBdLFxuICAgICAgZGV2RGVwczogW1xuICAgICAgICAuLi4oZ3JhcGhxbEVuYWJsZWQgPyBbJ0BncmFwaHFsLWNvZGVnZW4vY2xpQF41LjAuMCcsICdAZ3JhcGhxbC1jb2RlZ2VuL3R5cGVzY3JpcHRAXjQuMC4wJ10gOiBbXSksXG4gICAgICAgIC4uLm9wdGlvbnMuZGV2RGVwcyA/PyBbXSxcbiAgICAgIF0sXG4gICAgfSk7XG5cbiAgICBpZiAocmVzdEVuYWJsZWQpIHtcbiAgICAgIGNvbnN0IHNwZWNGaWxlID0gcmVzdC5zcGVjRmlsZSA/PyAncmVzdC55YW1sJztcbiAgICAgIGNvbnN0IG91dHB1dEZpbGUgPSByZXN0Lm91dHB1dEZpbGUgPz8gJ3NyYy9nZW5lcmF0ZWQvcmVzdC5tb2RlbC5nZW5lcmF0ZWQudHMnO1xuICAgICAgY29uc3QgdGFzayA9IHRoaXMuYWRkVGFzaygnZ2VuZXJhdGU6YXBpOnJlc3QnLCB7XG4gICAgICAgIGV4ZWM6IGBvcGVuYXBpLXR5cGVzY3JpcHQgJHtzcGVjRmlsZX0gLS1vdXRwdXQgJHtvdXRwdXRGaWxlfWAsXG4gICAgICAgIGRlc2NyaXB0aW9uOiAnR2VuZXJhdGUgVHlwZVNjcmlwdCB0eXBlcyBmcm9tIHRoZSBPcGVuQVBJIHNwZWNpZmljYXRpb24nLFxuICAgICAgfSk7XG4gICAgICB0aGlzLnByZUNvbXBpbGVUYXNrLnByZXBlbmRTcGF3bih0YXNrKTtcbiAgICB9XG5cbiAgICBpZiAoZ3JhcGhxbEVuYWJsZWQpIHtcbiAgICAgIGNvbnN0IGNvbmZpZ0ZpbGVOYW1lID0gJ2dyYXBocWwtY29kZWdlbi55bWwnO1xuICAgICAgY29uc3Qgb3V0cHV0RmlsZSA9IGdxbC5vdXRwdXRGaWxlID8/ICcuL3NyYy9nZW5lcmF0ZWQvZ3JhcGhxbC5tb2RlbC5nZW5lcmF0ZWQudHMnO1xuICAgICAgY29uc3QgdGFzayA9IHRoaXMuYWRkVGFzaygnZ2VuZXJhdGU6YXBpOmdyYXBocWwnLCB7XG4gICAgICAgIGV4ZWM6IGBncmFwaHFsLWNvZGVnZW4gLWMgJHtjb25maWdGaWxlTmFtZX1gLFxuICAgICAgICBkZXNjcmlwdGlvbjogJ0dlbmVyYXRlIFR5cGVzIGZyb20gdGhlIEdyYXBoUUwgc3BlY2lmaWNhdGlvbicsXG4gICAgICB9KTtcbiAgICAgIHRoaXMucHJlQ29tcGlsZVRhc2sucHJlcGVuZFNwYXduKHRhc2spO1xuXG4gICAgICBuZXcgWWFtbEZpbGUodGhpcywgY29uZmlnRmlsZU5hbWUsIHtcbiAgICAgICAgb2JqOiB7XG4gICAgICAgICAgc2NoZW1hOiBncWwuc2NoZW1hRmlsZXMgPz8gWydhd3MuZ3JhcGhxbCcsICdzY2hlbWEuZ3JhcGhxbCddLFxuICAgICAgICAgIGNvbmZpZzoge1xuICAgICAgICAgICAgc2NhbGFyczogZ3FsLnNjYWxhcnMgPz8gREVGQVVMVF9TQ0FMQVJTLFxuICAgICAgICAgICAgbWF5YmVWYWx1ZTogJ1QgfCB1bmRlZmluZWQnLFxuICAgICAgICAgIH0sXG4gICAgICAgICAgZ2VuZXJhdGVzOiB7XG4gICAgICAgICAgICBbb3V0cHV0RmlsZV06IHsgcGx1Z2luczogWyd0eXBlc2NyaXB0J10gfSxcbiAgICAgICAgICB9LFxuICAgICAgICB9LFxuICAgICAgfSk7XG4gICAgfVxuICB9XG59XG4iXX0=

package/lib/projects/cdk-app.js

@@ -9,7 +9,7 @@ const projen_1 = require("projen");
  * @pjid taimos-cdk-app
  */
 class TaimosCdkApp extends projen_1.awscdk.AwsCdkTypeScriptApp {
-    static [JSII_RTTI_SYMBOL_1] = { fqn: "@taimos/projen.TaimosCdkApp", version: "0.1.85" };
+    static [JSII_RTTI_SYMBOL_1] = { fqn: "@taimos/projen.TaimosCdkApp", version: "0.1.87" };
     constructor(options) {
         super({
             authorEmail: 'info@taimos.de',

package/lib/projects/cdk-construct.js

@@ -9,7 +9,7 @@ const projen_1 = require("projen");
  * @pjid taimos-awscdk-construct
  */
 class TaimosCdkConstructLibrary extends projen_1.awscdk.AwsCdkConstructLibrary {
-    static [JSII_RTTI_SYMBOL_1] = { fqn: "@taimos/projen.TaimosCdkConstructLibrary", version: "0.1.85" };
+    static [JSII_RTTI_SYMBOL_1] = { fqn: "@taimos/projen.TaimosCdkConstructLibrary", version: "0.1.87" };
     constructor(options) {
         super({
             authorOrganization: true,

package/lib/projects/index.d.ts

@@ -5,3 +5,4 @@ export * from './private-cdk-app';
 export * from './cdk-construct';
 export * from './prod-cdk-app';
 export * from './monorepo';
+export * from './api-library';

package/lib/projects/index.js

@@ -21,4 +21,5 @@ __exportStar(require("./private-cdk-app"), exports);
 __exportStar(require("./cdk-construct"), exports);
 __exportStar(require("./prod-cdk-app"), exports);
 __exportStar(require("./monorepo"), exports);
-//# sourceMappingURL=data:application/json;base64,eyJ2ZXJzaW9uIjozLCJmaWxlIjoiaW5kZXguanMiLCJzb3VyY2VSb290IjoiIiwic291cmNlcyI6WyIuLi8uLi9zcmMvcHJvamVjdHMvaW5kZXgudHMiXSwibmFtZXMiOltdLCJtYXBwaW5ncyI6Ijs7Ozs7Ozs7Ozs7Ozs7OztBQUFBLDRDQUEwQjtBQUMxQiwyQ0FBeUI7QUFDekIsbURBQWlDO0FBQ2pDLG9EQUFrQztBQUNsQyxrREFBZ0M7QUFDaEMsaURBQStCO0FBQy9CLDZDQUEyQiIsInNvdXJjZXNDb250ZW50IjpbImV4cG9ydCAqIGZyb20gJy4vY2RrLWFwcCc7XG5leHBvcnQgKiBmcm9tICcuL3RzLWxpYic7XG5leHBvcnQgKiBmcm9tICcuL3ByaXZhdGUtdHMtbGliJztcbmV4cG9ydCAqIGZyb20gJy4vcHJpdmF0ZS1jZGstYXBwJztcbmV4cG9ydCAqIGZyb20gJy4vY2RrLWNvbnN0cnVjdCc7XG5leHBvcnQgKiBmcm9tICcuL3Byb2QtY2RrLWFwcCc7XG5leHBvcnQgKiBmcm9tICcuL21vbm9yZXBvJztcbiJdfQ==
+__exportStar(require("./api-library"), exports);
+//# sourceMappingURL=data:application/json;base64,eyJ2ZXJzaW9uIjozLCJmaWxlIjoiaW5kZXguanMiLCJzb3VyY2VSb290IjoiIiwic291cmNlcyI6WyIuLi8uLi9zcmMvcHJvamVjdHMvaW5kZXgudHMiXSwibmFtZXMiOltdLCJtYXBwaW5ncyI6Ijs7Ozs7Ozs7Ozs7Ozs7OztBQUFBLDRDQUEwQjtBQUMxQiwyQ0FBeUI7QUFDekIsbURBQWlDO0FBQ2pDLG9EQUFrQztBQUNsQyxrREFBZ0M7QUFDaEMsaURBQStCO0FBQy9CLDZDQUEyQjtBQUMzQixnREFBOEIiLCJzb3VyY2VzQ29udGVudCI6WyJleHBvcnQgKiBmcm9tICcuL2Nkay1hcHAnO1xuZXhwb3J0ICogZnJvbSAnLi90cy1saWInO1xuZXhwb3J0ICogZnJvbSAnLi9wcml2YXRlLXRzLWxpYic7XG5leHBvcnQgKiBmcm9tICcuL3ByaXZhdGUtY2RrLWFwcCc7XG5leHBvcnQgKiBmcm9tICcuL2Nkay1jb25zdHJ1Y3QnO1xuZXhwb3J0ICogZnJvbSAnLi9wcm9kLWNkay1hcHAnO1xuZXhwb3J0ICogZnJvbSAnLi9tb25vcmVwbyc7XG5leHBvcnQgKiBmcm9tICcuL2FwaS1saWJyYXJ5JztcbiJdfQ==

package/lib/projects/monorepo.d.ts

@@ -1,6 +1,6 @@
 import { github, typescript, YamlFile } from 'projen';
 import { GitHubAssignApprover } from 'projen-pipelines';
-import { GitHubAmplifyDeploy, GitHubAmplifyDeployOptions, GitHubProductionRelease, GitHubProductionReleaseOptions } from '../components';
+import { GitHubAmplifyDeploy, GitHubAmplifyDeployOptions, GitHubProductionRelease, GitHubProductionReleaseOptions, Gitleaks, GitleaksOptions } from '../components';
 /**
  * The frontend framework an Amplify Hosting application is built with.
  *
@@ -225,6 +225,19 @@ export interface MonorepoProjectOptions extends typescript.TypeScriptProjectOpti
      * @default - promote `main` to a `production` branch
      */
     readonly productionReleaseOptions?: GitHubProductionReleaseOptions;
+    /**
+     * Whether to add gitleaks secret-scanning: a `.gitleaks.toml` config plus a
+     * pull-request workflow that scans the full git history (see `Gitleaks`).
+     *
+     * @default false
+     */
+    readonly gitleaks?: boolean;
+    /**
+     * Options for the gitleaks component. Only used when `gitleaks` is enabled.
+     *
+     * @default - extend the default ruleset, no extra allowlists
+     */
+    readonly gitleaksOptions?: GitleaksOptions;
     /**
      * Drive Amplify Hosting builds from GitHub Actions instead of Amplify's own
      * auto-build, so an app only rebuilds when the packages it is built from
@@ -270,6 +283,8 @@ export declare class MonorepoProject extends typescript.TypeScriptProject {
     readonly productionRelease?: GitHubProductionRelease;
     /** The Amplify deploy workflows, when `amplifyDeployOptions` is set. */
     readonly amplifyDeploy?: GitHubAmplifyDeploy;
+    /** The gitleaks secret-scanning component, if enabled. */
+    readonly gitleaks?: Gitleaks;
     /** The default release branch (promoted by the production release workflow). */
     readonly defaultReleaseBranch: string;
     constructor(options: MonorepoProjectOptions);