@ts-cloud/core 0.7.115 → 0.7.117

package/dist/types.d.ts

@@ -1537,6 +1537,30 @@ export interface DnsConfig {
 export interface SecurityConfig {
     waf?: WafConfig;
     kms?: boolean;
+    /**
+     * Pre-deployment secret scan.
+     *
+     * The scan walks the project directory before a deploy and blocks on secrets
+     * it finds. `scan.exclude` names directories to leave out of that walk, on
+     * top of the built-in list (`.git`, `node_modules`, `dist`, `build`,
+     * `vendor`, `pantry`, `coverage`, ...). Entries are matched on the directory
+     * NAME at any depth, not as globs or paths.
+     *
+     * Use it for trees this project does not own and does not ship — a vendored
+     * git submodule is the usual case. Third-party test fixtures are a rich
+     * source of strings that look like credentials (the TypeScript compiler's
+     * baselines trip the AWS-key heuristic on an identifier), and no amount of
+     * remediation in your own code makes them go away.
+     *
+     * Excluding a directory here means secrets inside it will NOT be caught, so
+     * only list trees you are confident never reach a server.
+     *
+     * @example
+     * security: { scan: { exclude: ['_submodules'] } }
+     */
+    scan?: {
+        exclude?: string[];
+    };
     /**
      * SSL/TLS Certificate configuration
      */

package/package.json

@@ -1,7 +1,7 @@
 {
   "name": "@ts-cloud/core",
   "type": "module",
-  "version": "0.7.115",
+  "version": "0.7.117",
   "description": "Core CloudFormation generation library for ts-cloud",
   "author": "Chris Breuer <chris@stacksjs.com>",
   "license": "MIT",
@@ -31,7 +31,7 @@
     "typecheck": "tsc --noEmit"
   },
   "dependencies": {
-    "@ts-cloud/aws-types": "0.7.115"
+    "@ts-cloud/aws-types": "0.7.117"
   },
   "devDependencies": {
     "typescript": "^7.0.2"