putitoutthere 0.1.29 → 0.1.31
This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.
- package/dist/auth.d.ts +0 -2
- package/dist/auth.d.ts.map +1 -1
- package/dist/auth.js +0 -5
- package/dist/auth.js.map +1 -1
- package/dist/cli.d.ts.map +1 -1
- package/dist/cli.js +31 -6
- package/dist/cli.js.map +1 -1
- package/dist/env.d.ts +15 -0
- package/dist/env.d.ts.map +1 -1
- package/dist/env.js +81 -0
- package/dist/env.js.map +1 -1
- package/dist/handlers/crates.d.ts.map +1 -1
- package/dist/handlers/crates.js +8 -6
- package/dist/handlers/crates.js.map +1 -1
- package/dist/handlers/npm-platform.d.ts.map +1 -1
- package/dist/handlers/npm-platform.js +3 -2
- package/dist/handlers/npm-platform.js.map +1 -1
- package/dist/handlers/npm.d.ts +6 -2
- package/dist/handlers/npm.d.ts.map +1 -1
- package/dist/handlers/npm.js +19 -10
- package/dist/handlers/npm.js.map +1 -1
- package/dist/handlers/pypi.d.ts.map +1 -1
- package/dist/handlers/pypi.js +7 -6
- package/dist/handlers/pypi.js.map +1 -1
- package/dist/init.d.ts +2 -1
- package/dist/init.d.ts.map +1 -1
- package/dist/init.js +13 -3
- package/dist/init.js.map +1 -1
- package/dist/log.d.ts +34 -6
- package/dist/log.d.ts.map +1 -1
- package/dist/log.js +92 -20
- package/dist/log.js.map +1 -1
- package/dist/token.d.ts +14 -1
- package/dist/token.d.ts.map +1 -1
- package/dist/token.js +30 -9
- package/dist/token.js.map +1 -1
- package/dist/version.d.ts +9 -0
- package/dist/version.d.ts.map +1 -1
- package/dist/version.js +10 -0
- package/dist/version.js.map +1 -1
- package/package.json +1 -1
package/dist/handlers/npm.js.map
CHANGED
|
@@ -1 +1 @@
|
|
|
1
|
-
{"version":3,"file":"npm.js","sourceRoot":"","sources":["../../src/handlers/npm.ts"],"names":[],"mappings":"AAAA;;;;;;;;GAQG;AAEH,OAAO,EAAE,YAAY,EAAE,MAAM,oBAAoB,CAAC;AAClD,OAAO,EAAE,YAAY,EAAE,aAAa,EAAE,MAAM,SAAS,CAAC;AACtD,OAAO,EAAE,IAAI,EAAE,MAAM,WAAW,CAAC;AAGjC,OAAO,EAAE,gBAAgB,EAAoB,MAAM,mBAAmB,CAAC;AACvE,OAAO,EAAE,QAAQ,EAAE,MAAM,WAAW,CAAC;
|
|
1
|
+
{"version":3,"file":"npm.js","sourceRoot":"","sources":["../../src/handlers/npm.ts"],"names":[],"mappings":"AAAA;;;;;;;;GAQG;AAEH,OAAO,EAAE,YAAY,EAAE,MAAM,oBAAoB,CAAC;AAClD,OAAO,EAAE,YAAY,EAAE,aAAa,EAAE,MAAM,SAAS,CAAC;AACtD,OAAO,EAAE,IAAI,EAAE,MAAM,WAAW,CAAC;AAGjC,OAAO,EAAE,gBAAgB,EAAoB,MAAM,mBAAmB,CAAC;AACvE,OAAO,EAAE,kBAAkB,EAAE,QAAQ,EAAE,MAAM,WAAW,CAAC;AACzD,OAAO,EAAE,UAAU,EAAE,MAAM,eAAe,CAAC;AAY3C,SAAS,UAAU,CAAC,GAAW;IAC7B,OAAO,GAAG,CAAC,GAAG,IAAI,GAAG,CAAC,IAAI,CAAC;AAC7B,CAAC;AAED,SAAS,eAAe,CAAC,GAAW,EAAE,OAAe,EAAE,GAAQ;IAC7D,MAAM,IAAI,GAAG,UAAU,CAAC,GAAG,CAAC,CAAC;IAC7B,IAAI,CAAC;QACH,YAAY,CAAC,KAAK,EAAE,CAAC,MAAM,EAAE,GAAG,IAAI,IAAI,OAAO,EAAE,EAAE,SAAS,CAAC,EAAE;YAC7D,GAAG,EAAE,GAAG,CAAC,GAAG;YACZ,KAAK,EAAE,CAAC,QAAQ,EAAE,MAAM,EAAE,MAAM,CAAC;SAClC,CAAC,CAAC;QACH,OAAO,OAAO,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC;IAC/B,CAAC;IAAC,MAAM,CAAC;QACP,4DAA4D;QAC5D,6DAA6D;QAC7D,4DAA4D;QAC5D,OAAO,OAAO,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC;IAChC,CAAC;AACH,CAAC;AAED,SAAS,gBAAgB,CAAC,GAAW,EAAE,OAAe,EAAE,IAAS;IAC/D,MAAM,CAAC,GAAG,IAAI,CAAC,GAAG,CAAC,IAAI,EAAE,cAAc,CAAC,CAAC;IACzC,IAAI,QAAgB,CAAC;IACrB,IAAI,CAAC;QACH,QAAQ,GAAG,YAAY,CAAC,CAAC,EAAE,MAAM,CAAC,CAAC;IACrC,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,IAAK,GAA6B,CAAC,IAAI,KAAK,QAAQ,EAAE,CAAC;YACrD,OAAO,OAAO,CAAC,MAAM,CAAC,IAAI,KAAK,CAAC,6BAA6B,CAAC,EAAE,CAAC,CAAC,CAAC;QACrE,CAAC;QACD,4DAA4D;QAC5D,OAAO,OAAO,CAAC,MAAM,CAAC,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,IAAI,KAAK,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC;IAC7E,CAAC;IACD,IAAI,MAA+B,CAAC;IACpC,IAAI,CAAC;QACH,MAAM,GAAG,IAAI,CAAC,KAAK,CAAC,QAAQ,CAA4B,CAAC;IAC3D,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,OAAO,OAAO,CAAC,MAAM,CACnB,IAAI,KAAK,CAAC,kCAAkC,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,EAAE,CAAC,CAChG,CAAC;IACJ,CAAC;IACD,IAAI,MAAM,CAAC,OAAO,KAAK,OAAO;QAAE,OAAO,OAAO,CAAC,OAAO,CAAC,EAAE,CAAC,CAAC;IAC3D,MAAM,CAAC,OAAO,GAAG,OAAO,CAAC;IACzB,iEAAiE;IACjE,uDAAuD;IACvD,MAAM,MAAM,GAAG,YAAY,CAAC,QAAQ,CAAC,CAAC;IACtC,MAAM,QAAQ,GAAG,QAAQ,CAAC,QAAQ,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC;IACrD,aAAa,CAAC,CAAC,EAAE,IAAI,CAAC,SAAS,CAAC,MAAM,EAAE,IAAI,EAAE,MAAM,CAAC,GAAG,QAAQ,EAAE,MAAM,CAAC,CAAC;IAC1E,OAAO,OAAO,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;AAC9B,CAAC;AAED,KAAK,UAAU,WAAW,CAAC,GAAW,EAAE,OAAe,EAAE,GAAQ;IAC/D,IAAI,MAAM,eAAe,CAAC,GAAG,EAAE,OAAO,EAAE,GAAG,CAAC,EAAE,CAAC;QAC7C,OAAO,EAAE,MAAM,EAAE,mBAAmB,EAAE,CAAC;IACzC,CAAC;IACD,IAAI,GAAG,CAAC,MAAM,EAAE,CAAC;QACf,OAAO,EAAE,MAAM,EAAE,SAAS,EAAE,CAAC;IAC/B,CAAC;IAED,oEAAoE;IACpE,uEAAuE;IACvE,wDAAwD;IACxD,IACE,CAAC,GAAG,CAAC,KAAK,KAAK,MAAM,IAAI,GAAG,CAAC,KAAK,KAAK,aAAa,CAAC;QACrD,GAAG,CAAC,OAAO,KAAK,SAAS;QACzB,GAAG,CAAC,OAAO,CAAC,MAAM,GAAG,CAAC,EACtB,CAAC;QACD,MAAM,WAAW,GAAgB;YAC/B,IAAI,EAAE,GAAG,CAAC,IAAI;YACd,IAAI,EAAE,GAAG,CAAC,IAAI;YACd,GAAG,EAAE,GAAG,CAAC,GAAG;YACZ,MAAM,EAAE,GAAG,CAAC,MAAM;YAClB,GAAG,EAAE,GAAG,CAAC,GAAG;YACZ,KAAK,EAAE,GAAG,CAAC,KAAK;YAChB,OAAO,EAAE,GAAG,CAAC,OAAO;SACrB,CAAC;QACF,MAAM,gBAAgB,CAAC,WAAW,EAAE,OAAO,EAAE,GAAG,CAAC,CAAC;IACpD,CAAC;IAED,MAAM,OAAO,GAAG,OAAO,CACrB,QAAQ,CAAC,GAAG,CAAC,GAAG,CAAC,8BAA8B,CAAC;QAC9C,QAAQ,CAAC,OAAO,CAAC,GAAG,CAAC,8BAA8B,CAAC,CACvD,CAAC;IAEF,+DAA+D;IAC/D,oEAAoE;IACpE,mEAAmE;IACnE,IAAI,OAAO,EAAE,CAAC;QACZ,qBAAqB,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC;IAClC,CAAC;IAED,MAAM,MAAM,GAAG,GAAG,CAAC,MAAM,IAAI,QAAQ,CAAC;IACtC,MAAM,IAAI,GAAa,CAAC,SAAS,EAAE,YAAY,MAAM,EAAE,CAAC,CAAC;IACzD,IAAI,GAAG,CAAC,GAAG;QAAE,IAAI,CAAC,IAAI,CAAC,SAAS,GAAG,CAAC,GAAG,EAAE,CAAC,CAAC;IAC3C,IAAI,OAAO;QAAE,IAAI,CAAC,IAAI,CAAC,cAAc,CAAC,CAAC;IAEvC,IAAI,CAAC;QACH,YAAY,CAAC,KAAK,EAAE,IAAI,EAAE;YACxB,GAAG,EAAE,GAAG,CAAC,IAAI;YACb,gEAAgE;YAChE,2CAA2C;YAC3C,GAAG,EAAE,kBAAkB,CAAC,GAAG,CAAC,GAAG,CAAC;YAChC,KAAK,EAAE,CAAC,QAAQ,EAAE,MAAM,EAAE,MAAM,CAAC;SAClC,CAAC,CAAC;IACL,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,MAAM,MAAM,GAAI,GAA2B,CAAC,MAAM,EAAE,QAAQ,CAAC,MAAM,CAAC,CAAC,IAAI,EAAE,CAAC;QAC5E,MAAM,IAAI,GAAG,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC;QAC9D,MAAM,IAAI,GAAG,UAAU,CAAC,GAAG,CAAC,CAAC;QAC7B,gEAAgE;QAChE,kEAAkE;QAClE,iEAAiE;QACjE,6DAA6D;QAC7D,kCAAkC;QAClC,IAAI,OAAO,IAAI,oBAAoB,CAAC,MAAM,CAAC,EAAE,CAAC;YAC5C,IAAI,MAAM,kBAAkB,CAAC,IAAI,CAAC,EAAE,CAAC;gBACnC,MAAM,IAAI,KAAK,CACb;oBACE,yBAAyB,IAAI,6CAA6C;oBAC1E,6DAA6D;oBAC7D,+GAA+G;iBAChH,CAAC,IAAI,CAAC,IAAI,CAAC,EACZ,EAAE,KAAK,EAAE,GAAG,EAAE,CACf,CAAC;YACJ,CAAC;QACH,CAAC;QACD,MAAM,IAAI,KAAK,CAAC,qBAAqB,MAAM,CAAC,CAAC,CAAC,MAAM,MAAM,EAAE,CAAC,CAAC,CAAC,KAAK,IAAI,EAAE,EAAE,EAAE,EAAE,KAAK,EAAE,GAAG,EAAE,CAAC,CAAC;IAChG,CAAC;IAED,OAAO;QACL,MAAM,EAAE,WAAW;QACnB,GAAG,EAAE,iCAAiC,UAAU,CAAC,GAAG,CAAC,MAAM,OAAO,EAAE;KACrE,CAAC;AACJ,CAAC;AAED,6EAA6E;AAE7E,SAAS,qBAAqB,CAAC,IAAY;IACzC,MAAM,WAAW,GAAG,IAAI,CAAC,IAAI,EAAE,cAAc,CAAC,CAAC;IAC/C,MAAM,GAAG,GAAG,YAAY,CAAC,WAAW,EAAE,MAAM,CAAC,CAAC;IAC9C,MAAM,GAAG,GAAG,IAAI,CAAC,KAAK,CAAC,GAAG,CAA6B,CAAC;IACxD,IAAI,CAAC,GAAG,CAAC,UAAU,EAAE,CAAC;QACpB,MAAM,IAAI,KAAK,CACb,wEAAwE,CACzE,CAAC;IACJ,CAAC;AACH,CAAC;AAED,2DAA2D;AAC3D,SAAS,oBAAoB,CAAC,MAA0B;IACtD,IAAI,CAAC,MAAM;QAAE,OAAO,KAAK,CAAC;IAC1B,OAAO,qFAAqF,CAAC,IAAI,CAC/F,MAAM,CACP,CAAC;AACJ,CAAC;AAED;;;;;;;;;GASG;AACH,MAAM,CAAC,KAAK,UAAU,kBAAkB,CAAC,IAAY;IACnD,IAAI,CAAC;QACH,mEAAmE;QACnE,gEAAgE;QAChE,kEAAkE;QAClE,gEAAgE;QAChE,uDAAuD;QACvD,MAAM,GAAG,GAAG,MAAM,KAAK,CACrB,8BAA8B,kBAAkB,CAAC,IAAI,CAAC,CAAC,UAAU,CAAC,KAAK,EAAE,GAAG,CAAC,EAAE,EAC/E;YACE,MAAM,EAAE,KAAK;YACb,OAAO,EAAE,EAAE,YAAY,EAAE,UAAU,EAAE;YACrC,MAAM,EAAE,WAAW,CAAC,OAAO,CAAC,IAAI,CAAC;SAClC,CACF,CAAC;QACF,OAAO,GAAG,CAAC,MAAM,KAAK,GAAG,CAAC;IAC5B,CAAC;IAAC,MAAM,CAAC;QACP,mEAAmE;QACnE,gEAAgE;QAChE,sDAAsD;QACtD,OAAO,KAAK,CAAC;IACf,CAAC;AACH,CAAC;AAED,oDAAoD;AACpD,SAAS,YAAY,CAAC,MAAc;IAClC,MAAM,CAAC,GAAG,sBAAsB,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC;IAC9C,0GAA0G;IAC1G,IAAI,CAAC,CAAC,EAAE,MAAM,EAAE,MAAM;QAAE,OAAO,CAAC,CAAC;IACjC,MAAM,MAAM,GAAG,CAAC,CAAC,MAAM,CAAC,MAAM,CAAC;IAC/B,IAAI,MAAM,CAAC,QAAQ,CAAC,IAAI,CAAC;QAAE,OAAO,IAAI,CAAC;IACvC,OAAO,MAAM,CAAC,MAAM,CAAC;AACvB,CAAC;AAED,MAAM,CAAC,MAAM,GAAG,GAAY;IAC1B,IAAI,EAAE,KAAK;IACX,WAAW,EAAE,eAAyC;IACtD,YAAY,EAAE,gBAA2C;IACzD,OAAO,EAAE,WAAiC;CAC3C,CAAC"}
|
|
@@ -1 +1 @@
|
|
|
1
|
-
{"version":3,"file":"pypi.d.ts","sourceRoot":"","sources":["../../src/handlers/pypi.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;GAgBG;AAQH,OAAO,KAAK,EAAO,OAAO,EAAiB,MAAM,aAAa,CAAC;
|
|
1
|
+
{"version":3,"file":"pypi.d.ts","sourceRoot":"","sources":["../../src/handlers/pypi.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;GAgBG;AAQH,OAAO,KAAK,EAAO,OAAO,EAAiB,MAAM,aAAa,CAAC;AAuM/D;;;;;;GAMG;AACH,wBAAgB,uBAAuB,CAAC,MAAM,EAAE,MAAM,EAAE,OAAO,EAAE,MAAM,GAAG,MAAM,CAa/E;AAmCD,eAAO,MAAM,IAAI,EAAE,OAKlB,CAAC"}
|
package/dist/handlers/pypi.js
CHANGED
|
@@ -20,14 +20,15 @@ import { existsSync, readFileSync, readdirSync, statSync, writeFileSync } from '
|
|
|
20
20
|
import { join } from 'node:path';
|
|
21
21
|
import { parse as parseToml } from 'smol-toml';
|
|
22
22
|
import { TransientError } from '../types.js';
|
|
23
|
-
import { nonEmpty } from '../env.js';
|
|
23
|
+
import { buildSubprocessEnv, nonEmpty } from '../env.js';
|
|
24
|
+
import { USER_AGENT } from '../version.js';
|
|
24
25
|
const REGISTRY = 'https://pypi.org';
|
|
25
26
|
async function isPublishedImpl(pkg, version, _ctx) {
|
|
26
27
|
const name = pypiNameFor(pkg);
|
|
27
28
|
const url = `${REGISTRY}/pypi/${encodeURIComponent(name)}/${encodeURIComponent(version)}/json`;
|
|
28
29
|
const res = await fetch(url, {
|
|
29
30
|
method: 'GET',
|
|
30
|
-
headers: { 'user-agent':
|
|
31
|
+
headers: { 'user-agent': USER_AGENT },
|
|
31
32
|
});
|
|
32
33
|
if (res.status === 200)
|
|
33
34
|
return true;
|
|
@@ -122,12 +123,12 @@ async function publishImpl(pkg, version, ctx) {
|
|
|
122
123
|
try {
|
|
123
124
|
execFileSync('twine', ['upload', '--non-interactive', '--disable-progress-bar', ...files], {
|
|
124
125
|
cwd: ctx.cwd,
|
|
125
|
-
|
|
126
|
-
|
|
127
|
-
|
|
126
|
+
// #138: minimal env. Don't forward the whole parent process.env
|
|
127
|
+
// to twine.
|
|
128
|
+
env: buildSubprocessEnv(ctx.env, {
|
|
128
129
|
TWINE_USERNAME: '__token__',
|
|
129
130
|
TWINE_PASSWORD: token,
|
|
130
|
-
},
|
|
131
|
+
}),
|
|
131
132
|
stdio: ['ignore', 'pipe', 'pipe'],
|
|
132
133
|
});
|
|
133
134
|
}
|
|
@@ -1 +1 @@
|
|
|
1
|
-
{"version":3,"file":"pypi.js","sourceRoot":"","sources":["../../src/handlers/pypi.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;GAgBG;AAEH,OAAO,EAAE,YAAY,EAAE,MAAM,oBAAoB,CAAC;AAClD,OAAO,EAAE,UAAU,EAAE,YAAY,EAAE,WAAW,EAAE,QAAQ,EAAE,aAAa,EAAE,MAAM,SAAS,CAAC;AACzF,OAAO,EAAE,IAAI,EAAE,MAAM,WAAW,CAAC;AAEjC,OAAO,EAAE,KAAK,IAAI,SAAS,EAAE,MAAM,WAAW,CAAC;AAG/C,OAAO,EAAE,cAAc,EAAE,MAAM,aAAa,CAAC;AAC7C,OAAO,EAAE,QAAQ,EAAE,MAAM,WAAW,CAAC;
|
|
1
|
+
{"version":3,"file":"pypi.js","sourceRoot":"","sources":["../../src/handlers/pypi.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;GAgBG;AAEH,OAAO,EAAE,YAAY,EAAE,MAAM,oBAAoB,CAAC;AAClD,OAAO,EAAE,UAAU,EAAE,YAAY,EAAE,WAAW,EAAE,QAAQ,EAAE,aAAa,EAAE,MAAM,SAAS,CAAC;AACzF,OAAO,EAAE,IAAI,EAAE,MAAM,WAAW,CAAC;AAEjC,OAAO,EAAE,KAAK,IAAI,SAAS,EAAE,MAAM,WAAW,CAAC;AAG/C,OAAO,EAAE,cAAc,EAAE,MAAM,aAAa,CAAC;AAC7C,OAAO,EAAE,kBAAkB,EAAE,QAAQ,EAAE,MAAM,WAAW,CAAC;AACzD,OAAO,EAAE,UAAU,EAAE,MAAM,eAAe,CAAC;AAE3C,MAAM,QAAQ,GAAG,kBAAkB,CAAC;AAEpC,KAAK,UAAU,eAAe,CAC5B,GAAoC,EACpC,OAAe,EACf,IAAS;IAET,MAAM,IAAI,GAAG,WAAW,CAAC,GAAG,CAAC,CAAC;IAC9B,MAAM,GAAG,GAAG,GAAG,QAAQ,SAAS,kBAAkB,CAAC,IAAI,CAAC,IAAI,kBAAkB,CAAC,OAAO,CAAC,OAAO,CAAC;IAC/F,MAAM,GAAG,GAAG,MAAM,KAAK,CAAC,GAAG,EAAE;QAC3B,MAAM,EAAE,KAAK;QACb,OAAO,EAAE,EAAE,YAAY,EAAE,UAAU,EAAE;KACtC,CAAC,CAAC;IACH,IAAI,GAAG,CAAC,MAAM,KAAK,GAAG;QAAE,OAAO,IAAI,CAAC;IACpC,IAAI,GAAG,CAAC,MAAM,KAAK,GAAG;QAAE,OAAO,KAAK,CAAC;IACrC,IAAI,GAAG,CAAC,MAAM,IAAI,GAAG,EAAE,CAAC;QACtB,MAAM,IAAI,cAAc,CAAC,gBAAgB,GAAG,aAAa,GAAG,CAAC,MAAM,EAAE,CAAC,CAAC;IACzE,CAAC;IACD,yFAAyF;IACzF,MAAM,IAAI,KAAK,CAAC,gBAAgB,GAAG,aAAa,GAAG,CAAC,MAAM,EAAE,CAAC,CAAC;AAChE,CAAC;AAED,SAAS,gBAAgB,CACvB,GAAoC,EACpC,OAAe,EACf,GAAQ;IAER,MAAM,aAAa,GAAG,IAAI,CAAC,GAAG,CAAC,IAAI,EAAE,gBAAgB,CAAC,CAAC;IACvD,IAAI,QAAgB,CAAC;IACrB,IAAI,CAAC;QACH,QAAQ,GAAG,YAAY,CAAC,aAAa,EAAE,MAAM,CAAC,CAAC;IACjD,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,IAAK,GAA6B,CAAC,IAAI,KAAK,QAAQ,EAAE,CAAC;YACrD,OAAO,OAAO,CAAC,MAAM,CAAC,IAAI,KAAK,CAAC,+BAA+B,aAAa,EAAE,CAAC,CAAC,CAAC;QACnF,CAAC;QACD,4DAA4D;QAC5D,OAAO,OAAO,CAAC,MAAM,CAAC,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,IAAI,KAAK,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC;IAC7E,CAAC;IACD,6EAA6E;IAC7E,sEAAsE;IACtE,6EAA6E;IAC7E,IAAI,MAAe,CAAC;IACpB,IAAI,CAAC;QACH,MAAM,GAAG,SAAS,CAAC,QAAQ,CAAC,CAAC;IAC/B,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,MAAM,GAAG,GAAG,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC;QAC7D,OAAO,OAAO,CAAC,MAAM,CAAC,IAAI,KAAK,CAAC,mCAAmC,aAAa,KAAK,GAAG,EAAE,CAAC,CAAC,CAAC;IAC/F,CAAC;IACD,MAAM,OAAO,GAAI,MAA8C,EAAE,OAAO,CAAC;IACzE,IAAI,CAAC,OAAO,EAAE,CAAC;QACb,OAAO,OAAO,CAAC,MAAM,CACnB,IAAI,KAAK,CACP,uGAAuG,CACxG,CACF,CAAC;IACJ,CAAC;IACD,uEAAuE;IACvE,0EAA0E;IAC1E,wEAAwE;IACxE,qEAAqE;IACrE,uEAAuE;IACvE,IAAI,6BAA6B,CAAC,OAAO,CAAC,EAAE,CAAC;QAC3C,MAAM,GAAG,GAAG,GAAG,CAAC,IAAI,CAAC,CAAC,CAAC,SAAS,GAAG,CAAC,IAAI,EAAE,CAAC,CAAC,CAAC,MAAM,CAAC;QACpD,GAAG,CAAC,GAAG,CAAC,IAAI,CACV,GAAG,GAAG,4GAA4G,CACnH,CAAC;QACF,OAAO,OAAO,CAAC,OAAO,CAAC,EAAE,CAAC,CAAC;IAC7B,CAAC;IACD,IAAI,OAAe,CAAC;IACpB,IAAI,CAAC;QACH,OAAO,GAAG,uBAAuB,CAAC,QAAQ,EAAE,OAAO,CAAC,CAAC;IACvD,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,OAAO,OAAO,CAAC,MAAM,CAAC,GAAY,CAAC,CAAC;IACtC,CAAC;IACD,IAAI,OAAO,KAAK,QAAQ;QAAE,OAAO,OAAO,CAAC,OAAO,CAAC,EAAE,CAAC,CAAC;IACrD,aAAa,CAAC,aAAa,EAAE,OAAO,EAAE,MAAM,CAAC,CAAC;IAC9C,OAAO,OAAO,CAAC,OAAO,CAAC,CAAC,aAAa,CAAC,CAAC,CAAC;AAC1C,CAAC;AAED,KAAK,UAAU,WAAW,CACxB,GAAkD,EAClD,OAAe,EACf,GAAQ;IAER,IAAI,MAAM,eAAe,CAAC,GAAG,EAAE,OAAO,EAAE,GAAG,CAAC,EAAE,CAAC;QAC7C,OAAO,EAAE,MAAM,EAAE,mBAAmB,EAAE,CAAC;IACzC,CAAC;IACD,IAAI,GAAG,CAAC,MAAM,EAAE,CAAC;QACf,OAAO,EAAE,MAAM,EAAE,SAAS,EAAE,CAAC;IAC/B,CAAC;IAED,MAAM,KAAK,GAAG,gBAAgB,CAAC,GAAG,CAAC,IAAI,EAAE,GAAG,CAAC,aAAa,CAAC,CAAC;IAC5D,IAAI,KAAK,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QACvB,MAAM,IAAI,KAAK,CACb,gCAAgC,GAAG,CAAC,IAAI,UAAU,GAAG,CAAC,aAAa,IAAI,uBAAuB,EAAE,CACjG,CAAC;IACJ,CAAC;IAED,2DAA2D;IAC3D,6DAA6D;IAC7D,mEAAmE;IACnE,yDAAyD;IACzD,oBAAoB;IACpB,MAAM,SAAS,GAAG,MAAM,aAAa,CAAC,GAAG,CAAC,CAAC;IAC3C,MAAM,aAAa,GAAG,QAAQ,CAAC,GAAG,CAAC,GAAG,CAAC,cAAc,CAAC,IAAI,QAAQ,CAAC,OAAO,CAAC,GAAG,CAAC,cAAc,CAAC,CAAC;IAC/F,MAAM,KAAK,GAAG,SAAS,IAAI,aAAa,CAAC;IACzC,IAAI,CAAC,KAAK,EAAE,CAAC;QACX,MAAM,IAAI,KAAK,CACb;YACE,kCAAkC;YAClC,gDAAgD;YAChD,2HAA2H;YAC3H,kEAAkE;YAClE,eAAe;YACf,4EAA4E;SAC7E,CAAC,IAAI,CAAC,IAAI,CAAC,CACb,CAAC;IACJ,CAAC;IACD,GAAG,CAAC,GAAG,CAAC,IAAI,CACV,SAAS,CAAC,CAAC,CAAC,kDAAkD,CAAC,CAAC,CAAC,yCAAyC,CAC3G,CAAC;IAEF,IAAI,CAAC;QACH,YAAY,CAAC,OAAO,EAAE,CAAC,QAAQ,EAAE,mBAAmB,EAAE,wBAAwB,EAAE,GAAG,KAAK,CAAC,EAAE;YACzF,GAAG,EAAE,GAAG,CAAC,GAAG;YACZ,gEAAgE;YAChE,YAAY;YACZ,GAAG,EAAE,kBAAkB,CAAC,GAAG,CAAC,GAAG,EAAE;gBAC/B,cAAc,EAAE,WAAW;gBAC3B,cAAc,EAAE,KAAK;aACtB,CAAC;YACF,KAAK,EAAE,CAAC,QAAQ,EAAE,MAAM,EAAE,MAAM,CAAC;SAClC,CAAC,CAAC;IACL,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,MAAM,MAAM,GAAI,GAA2B,CAAC,MAAM,EAAE,QAAQ,CAAC,MAAM,CAAC,CAAC,IAAI,EAAE,CAAC;QAC5E,MAAM,IAAI,GAAG,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC;QAC9D,MAAM,IAAI,KAAK,CAAC,sBAAsB,MAAM,CAAC,CAAC,CAAC,MAAM,MAAM,EAAE,CAAC,CAAC,CAAC,KAAK,IAAI,EAAE,EAAE,EAAE,EAAE,KAAK,EAAE,GAAG,EAAE,CAAC,CAAC;IACjG,CAAC;IAED,OAAO;QACL,MAAM,EAAE,WAAW;QACnB,GAAG,EAAE,GAAG,QAAQ,YAAY,WAAW,CAAC,GAAG,CAAC,IAAI,OAAO,GAAG;KAC3D,CAAC;AACJ,CAAC;AAED,6EAA6E;AAE7E,SAAS,WAAW,CAAC,GAAoC;IACvD,OAAO,GAAG,CAAC,IAAI,IAAI,GAAG,CAAC,IAAI,CAAC;AAC9B,CAAC;AAED;;;;;GAKG;AACH,KAAK,UAAU,aAAa,CAAC,GAAQ;IACnC,MAAM,MAAM,GACV,QAAQ,CAAC,GAAG,CAAC,GAAG,CAAC,4BAA4B,CAAC;QAC9C,QAAQ,CAAC,OAAO,CAAC,GAAG,CAAC,4BAA4B,CAAC,CAAC;IACrD,MAAM,QAAQ,GACZ,QAAQ,CAAC,GAAG,CAAC,GAAG,CAAC,8BAA8B,CAAC;QAChD,QAAQ,CAAC,OAAO,CAAC,GAAG,CAAC,8BAA8B,CAAC,CAAC;IACvD,IAAI,CAAC,MAAM,IAAI,CAAC,QAAQ;QAAE,OAAO,IAAI,CAAC;IAEtC,MAAM,UAAU,GAAG,MAAM,KAAK,CAAC,GAAG,MAAM,gBAAgB,EAAE;QACxD,OAAO,EAAE,EAAE,aAAa,EAAE,UAAU,QAAQ,EAAE,EAAE;KACjD,CAAC,CAAC;IACH,IAAI,CAAC,UAAU,CAAC,EAAE,EAAE,CAAC;QACnB,GAAG,CAAC,GAAG,CAAC,IAAI,CAAC,uCAAuC,UAAU,CAAC,MAAM,EAAE,CAAC,CAAC;QACzE,OAAO,IAAI,CAAC;IACd,CAAC;IACD,MAAM,WAAW,GAAG,CAAC,MAAM,UAAU,CAAC,IAAI,EAAE,CAAuB,CAAC;IACpE,MAAM,OAAO,GAAG,WAAW,CAAC,KAAK,CAAC;IAClC,IAAI,CAAC,OAAO,EAAE,CAAC;QACb,GAAG,CAAC,GAAG,CAAC,IAAI,CAAC,8CAA8C,CAAC,CAAC;QAC7D,OAAO,IAAI,CAAC;IACd,CAAC;IAED,MAAM,OAAO,GAAG,MAAM,KAAK,CAAC,GAAG,QAAQ,oBAAoB,EAAE;QAC3D,MAAM,EAAE,MAAM;QACd,OAAO,EAAE,EAAE,cAAc,EAAE,kBAAkB,EAAE;QAC/C,IAAI,EAAE,IAAI,CAAC,SAAS,CAAC,EAAE,KAAK,EAAE,OAAO,EAAE,CAAC;KACzC,CAAC,CAAC;IACH,IAAI,CAAC,OAAO,CAAC,EAAE,EAAE,CAAC;QAChB,MAAM,IAAI,GAAG,MAAM,OAAO,CAAC,IAAI,EAAE,CAAC;QAClC,GAAG,CAAC,GAAG,CAAC,IAAI,CAAC,iCAAiC,OAAO,CAAC,MAAM,MAAM,IAAI,CAAC,KAAK,CAAC,CAAC,EAAE,GAAG,CAAC,EAAE,CAAC,CAAC;QACxF,OAAO,IAAI,CAAC;IACd,CAAC;IACD,MAAM,QAAQ,GAAG,CAAC,MAAM,OAAO,CAAC,IAAI,EAAE,CAAuB,CAAC;IAC9D,OAAO,QAAQ,CAAC,KAAK,IAAI,IAAI,CAAC;AAChC,CAAC;AAED;;;;;;GAMG;AACH,MAAM,UAAU,uBAAuB,CAAC,MAAc,EAAE,OAAe;IACrE,MAAM,EAAE,GAAG,uDAAuD,CAAC;IACnE,MAAM,CAAC,GAAG,EAAE,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC;IAC1B,IAAI,CAAC,CAAC,EAAE,CAAC;QACP,MAAM,IAAI,KAAK,CACb,sGAAsG,CACvG,CAAC;IACJ,CAAC;IACD,MAAM,CAAC,EAAE,GAAG,EAAE,MAAM,EAAE,GAAG,EAAE,MAAM,CAAC,GAAG,CAAwD,CAAC;IAC9F,IAAI,GAAG,KAAK,OAAO;QAAE,OAAO,MAAM,CAAC;IACnC,MAAM,KAAK,GAAG,CAAC,CAAC,KAAK,GAAG,GAAG,CAAC,MAAM,CAAC;IACnC,MAAM,GAAG,GAAG,KAAK,GAAG,MAAM,CAAC,MAAM,GAAG,GAAG,CAAC,MAAM,GAAG,MAAM,CAAC,MAAM,CAAC;IAC/D,OAAO,MAAM,CAAC,KAAK,CAAC,CAAC,EAAE,KAAK,CAAC,GAAG,MAAM,GAAG,OAAO,GAAG,MAAM,GAAG,MAAM,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC;AAChF,CAAC;AAED;;;;;GAKG;AACH,SAAS,6BAA6B,CAAC,OAA8B;IACnE,MAAM,EAAE,OAAO,EAAE,GAAG,OAAO,CAAC;IAC5B,OAAO,KAAK,CAAC,OAAO,CAAC,OAAO,CAAC,IAAI,OAAO,CAAC,QAAQ,CAAC,SAAS,CAAC,CAAC;AAC/D,CAAC;AAED;;;;GAIG;AACH,SAAS,gBAAgB,CAAC,OAAe,EAAE,aAAiC;IAC1E,IAAI,CAAC,aAAa,IAAI,CAAC,UAAU,CAAC,aAAa,CAAC;QAAE,OAAO,EAAE,CAAC;IAC5D,MAAM,GAAG,GAAa,EAAE,CAAC;IACzB,KAAK,MAAM,KAAK,IAAI,WAAW,CAAC,aAAa,CAAC,EAAE,CAAC;QAC/C,IAAI,CAAC,KAAK,CAAC,UAAU,CAAC,GAAG,OAAO,GAAG,CAAC;YAAE,SAAS;QAC/C,MAAM,GAAG,GAAG,IAAI,CAAC,aAAa,EAAE,KAAK,CAAC,CAAC;QACvC,4EAA4E;QAC5E,IAAI,CAAC,QAAQ,CAAC,GAAG,CAAC,CAAC,WAAW,EAAE;YAAE,SAAS;QAC3C,KAAK,MAAM,IAAI,IAAI,WAAW,CAAC,GAAG,CAAC,EAAE,CAAC;YACpC,IAAI,IAAI,CAAC,QAAQ,CAAC,MAAM,CAAC,IAAI,IAAI,CAAC,QAAQ,CAAC,SAAS,CAAC,EAAE,CAAC;gBACtD,GAAG,CAAC,IAAI,CAAC,IAAI,CAAC,GAAG,EAAE,IAAI,CAAC,CAAC,CAAC;YAC5B,CAAC;QACH,CAAC;IACH,CAAC;IACD,OAAO,GAAG,CAAC;AACb,CAAC;AAED,MAAM,CAAC,MAAM,IAAI,GAAY;IAC3B,IAAI,EAAE,MAAM;IACZ,WAAW,EAAE,eAAyC;IACtD,YAAY,EAAE,gBAA2C;IACzD,OAAO,EAAE,WAAiC;CAC3C,CAAC"}
|
package/dist/init.d.ts
CHANGED
|
@@ -9,7 +9,8 @@
|
|
|
9
9
|
*
|
|
10
10
|
* Idempotency (plan.md §17.4):
|
|
11
11
|
* - Existing `putitoutthere.toml` → skip unless `--force`.
|
|
12
|
-
* - Existing workflow →
|
|
12
|
+
* - Existing workflow → if byte-identical, mark already-present (no .bak);
|
|
13
|
+
* otherwise rename to `.bak` before writing (#148).
|
|
13
14
|
* - Existing `CLAUDE.md` already containing the import line → skip the append.
|
|
14
15
|
*
|
|
15
16
|
* Issue #20 / #25. Plan: §9, §17.
|
package/dist/init.d.ts.map
CHANGED
|
@@ -1 +1 @@
|
|
|
1
|
-
{"version":3,"file":"init.d.ts","sourceRoot":"","sources":["../src/init.ts"],"names":[],"mappings":"AAAA
|
|
1
|
+
{"version":3,"file":"init.d.ts","sourceRoot":"","sources":["../src/init.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;GAgBG;AAKH,OAAO,EAAmD,KAAK,OAAO,EAAE,MAAM,gBAAgB,CAAC;AAE/F,MAAM,WAAW,WAAW;IAC1B,GAAG,EAAE,MAAM,CAAC;IACZ,wDAAwD;IACxD,KAAK,CAAC,EAAE,OAAO,CAAC;IAChB,wDAAwD;IACxD,KAAK,CAAC,EAAE,QAAQ,GAAG,QAAQ,CAAC;IAC5B,mEAAmE;IACnE,OAAO,CAAC,EAAE,OAAO,CAAC;CACnB;AAED,MAAM,WAAW,UAAU;IACzB,KAAK,EAAE,MAAM,EAAE,CAAC;IAChB;;;OAGG;IACH,OAAO,EAAE,MAAM,EAAE,CAAC;IAClB;;;;OAIG;IACH,cAAc,EAAE,MAAM,EAAE,CAAC;IACzB,QAAQ,EAAE,MAAM,EAAE,CAAC;CACpB;AAED,wBAAgB,IAAI,CAAC,IAAI,EAAE,WAAW,GAAG,UAAU,CAuDlD"}
|
package/dist/init.js
CHANGED
|
@@ -9,7 +9,8 @@
|
|
|
9
9
|
*
|
|
10
10
|
* Idempotency (plan.md §17.4):
|
|
11
11
|
* - Existing `putitoutthere.toml` → skip unless `--force`.
|
|
12
|
-
* - Existing workflow →
|
|
12
|
+
* - Existing workflow → if byte-identical, mark already-present (no .bak);
|
|
13
|
+
* otherwise rename to `.bak` before writing (#148).
|
|
13
14
|
* - Existing `CLAUDE.md` already containing the import line → skip the append.
|
|
14
15
|
*
|
|
15
16
|
* Issue #20 / #25. Plan: §9, §17.
|
|
@@ -76,13 +77,22 @@ export function init(opts) {
|
|
|
76
77
|
/* ---------------------------- internals ---------------------------- */
|
|
77
78
|
function writeWorkflow(cwd, name, contents, result) {
|
|
78
79
|
const target = join(cwd, '.github', 'workflows', name);
|
|
80
|
+
const rel = `.github/workflows/${name}`;
|
|
79
81
|
if (existsSync(target)) {
|
|
82
|
+
// #148: skip the `.bak` dance when the existing file is already
|
|
83
|
+
// byte-identical to what init would write. Otherwise re-running init
|
|
84
|
+
// pollutes the working tree with a fresh .bak each time.
|
|
85
|
+
const existing = readFileSync(target, 'utf8');
|
|
86
|
+
if (existing === contents) {
|
|
87
|
+
result.alreadyPresent.push(rel);
|
|
88
|
+
return;
|
|
89
|
+
}
|
|
80
90
|
const bak = `${target}.bak`;
|
|
81
91
|
renameSync(target, bak);
|
|
82
|
-
result.backedUp.push(
|
|
92
|
+
result.backedUp.push(rel);
|
|
83
93
|
}
|
|
84
94
|
writeAtomic(target, contents);
|
|
85
|
-
result.wrote.push(
|
|
95
|
+
result.wrote.push(rel);
|
|
86
96
|
}
|
|
87
97
|
function writeAtomic(path, contents) {
|
|
88
98
|
// lgtm[js/insecure-temporary-file] -- writes into opts.cwd, which
|
package/dist/init.js.map
CHANGED
|
@@ -1 +1 @@
|
|
|
1
|
-
{"version":3,"file":"init.js","sourceRoot":"","sources":["../src/init.ts"],"names":[],"mappings":"AAAA
|
|
1
|
+
{"version":3,"file":"init.js","sourceRoot":"","sources":["../src/init.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;GAgBG;AAEH,OAAO,EAAE,UAAU,EAAE,SAAS,EAAE,YAAY,EAAE,UAAU,EAAE,aAAa,EAAE,MAAM,SAAS,CAAC;AACzF,OAAO,EAAE,OAAO,EAAE,IAAI,EAAE,MAAM,WAAW,CAAC;AAE1C,OAAO,EAAE,SAAS,EAAE,SAAS,EAAE,UAAU,EAAE,aAAa,EAAgB,MAAM,gBAAgB,CAAC;AA4B/F,MAAM,UAAU,IAAI,CAAC,IAAiB;IACpC,MAAM,GAAG,GAAG,IAAI,CAAC,GAAG,CAAC;IACrB,MAAM,KAAK,GAAG,OAAO,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;IAClC,MAAM,KAAK,GAAG,IAAI,CAAC,KAAK,IAAI,QAAQ,CAAC;IACrC,MAAM,OAAO,GAAY,IAAI,CAAC,OAAO,IAAI,WAAW,CAAC;IACrD,MAAM,MAAM,GAAe,EAAE,KAAK,EAAE,EAAE,EAAE,OAAO,EAAE,EAAE,EAAE,cAAc,EAAE,EAAE,EAAE,QAAQ,EAAE,EAAE,EAAE,CAAC;IAExF,6CAA6C;IAC7C,MAAM,QAAQ,GAAG,IAAI,CAAC,GAAG,EAAE,oBAAoB,CAAC,CAAC;IACjD,IAAI,UAAU,CAAC,QAAQ,CAAC,IAAI,CAAC,KAAK,EAAE,CAAC;QACnC,MAAM,CAAC,OAAO,CAAC,IAAI,CAAC,oBAAoB,CAAC,CAAC;IAC5C,CAAC;SAAM,CAAC;QACN,WAAW,CAAC,QAAQ,EAAE,aAAa,CAAC,CAAC;QACrC,MAAM,CAAC,KAAK,CAAC,IAAI,CAAC,oBAAoB,CAAC,CAAC;IAC1C,CAAC;IAED,uEAAuE;IACvE,MAAM,UAAU,GAAG,IAAI,CAAC,GAAG,EAAE,eAAe,EAAE,WAAW,CAAC,CAAC;IAC3D,IAAI,UAAU,CAAC,UAAU,CAAC,EAAE,CAAC;QAC3B,MAAM,CAAC,cAAc,CAAC,IAAI,CAAC,yBAAyB,CAAC,CAAC;IACxD,CAAC;SAAM,CAAC;QACN,WAAW,CAAC,UAAU,EAAE,SAAS,CAAC,CAAC;QACnC,MAAM,CAAC,KAAK,CAAC,IAAI,CAAC,yBAAyB,CAAC,CAAC;IAC/C,CAAC;IAED,yEAAyE;IACzE,IAAI,KAAK,KAAK,QAAQ,EAAE,CAAC;QACvB,MAAM,UAAU,GAAG,IAAI,CAAC,GAAG,EAAE,WAAW,CAAC,CAAC;QAC1C,MAAM,UAAU,GAAG,0BAA0B,CAAC;QAC9C,MAAM,QAAQ,GAAG,UAAU,CAAC,UAAU,CAAC,CAAC,CAAC,CAAC,YAAY,CAAC,UAAU,EAAE,MAAM,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC;QAChF,IAAI,QAAQ,CAAC,QAAQ,CAAC,UAAU,CAAC,EAAE,CAAC;YAClC,MAAM,CAAC,cAAc,CAAC,IAAI,CAAC,WAAW,CAAC,CAAC;QAC1C,CAAC;aAAM,CAAC;YACN,MAAM,GAAG,GAAG,QAAQ,CAAC,MAAM,GAAG,CAAC,IAAI,CAAC,QAAQ,CAAC,QAAQ,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC;YACxE,WAAW,CAAC,UAAU,EAAE,GAAG,QAAQ,GAAG,GAAG,GAAG,UAAU,IAAI,CAAC,CAAC;YAC5D,MAAM,CAAC,KAAK,CAAC,IAAI,CAAC,WAAW,CAAC,CAAC;QACjC,CAAC;QACD,kEAAkE;IACpE,CAAC;SAAM,CAAC;QACN,MAAM,UAAU,GAAG,IAAI,CAAC,GAAG,EAAE,cAAc,CAAC,CAAC;QAC7C,MAAM,QAAQ,GAAG,UAAU,CAAC,UAAU,CAAC,CAAC,CAAC,CAAC,YAAY,CAAC,UAAU,EAAE,MAAM,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC;QAChF,IAAI,QAAQ,CAAC,QAAQ,CAAC,wCAAwC,CAAC,EAAE,CAAC;YAChE,MAAM,CAAC,cAAc,CAAC,IAAI,CAAC,cAAc,CAAC,CAAC;QAC7C,CAAC;aAAM,CAAC;YACN,WAAW,CAAC,UAAU,EAAE,GAAG,QAAQ,GAAG,QAAQ,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,GAAG,SAAS,EAAE,CAAC,CAAC;YACrF,MAAM,CAAC,KAAK,CAAC,IAAI,CAAC,cAAc,CAAC,CAAC;QACpC,CAAC;IACH,CAAC;IACD,oBAAoB;IAEpB,eAAe;IACf,aAAa,CAAC,GAAG,EAAE,aAAa,EAAE,UAAU,CAAC,OAAO,CAAC,EAAE,MAAM,CAAC,CAAC;IAC/D,aAAa,CAAC,GAAG,EAAE,yBAAyB,EAAE,SAAS,EAAE,MAAM,CAAC,CAAC;IAEjE,OAAO,MAAM,CAAC;AAChB,CAAC;AAED,yEAAyE;AAEzE,SAAS,aAAa,CAAC,GAAW,EAAE,IAAY,EAAE,QAAgB,EAAE,MAAkB;IACpF,MAAM,MAAM,GAAG,IAAI,CAAC,GAAG,EAAE,SAAS,EAAE,WAAW,EAAE,IAAI,CAAC,CAAC;IACvD,MAAM,GAAG,GAAG,qBAAqB,IAAI,EAAE,CAAC;IACxC,IAAI,UAAU,CAAC,MAAM,CAAC,EAAE,CAAC;QACvB,gEAAgE;QAChE,qEAAqE;QACrE,yDAAyD;QACzD,MAAM,QAAQ,GAAG,YAAY,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;QAC9C,IAAI,QAAQ,KAAK,QAAQ,EAAE,CAAC;YAC1B,MAAM,CAAC,cAAc,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;YAChC,OAAO;QACT,CAAC;QACD,MAAM,GAAG,GAAG,GAAG,MAAM,MAAM,CAAC;QAC5B,UAAU,CAAC,MAAM,EAAE,GAAG,CAAC,CAAC;QACxB,MAAM,CAAC,QAAQ,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;IAC5B,CAAC;IACD,WAAW,CAAC,MAAM,EAAE,QAAQ,CAAC,CAAC;IAC9B,MAAM,CAAC,KAAK,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;AACzB,CAAC;AAED,SAAS,WAAW,CAAC,IAAY,EAAE,QAAgB;IACjD,kEAAkE;IAClE,kEAAkE;IAClE,mEAAmE;IACnE,SAAS,CAAC,OAAO,CAAC,IAAI,CAAC,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,IAAI,EAAE,KAAK,EAAE,CAAC,CAAC;IAC3D,aAAa,CAAC,IAAI,EAAE,QAAQ,EAAE,EAAE,QAAQ,EAAE,MAAM,EAAE,IAAI,EAAE,KAAK,EAAE,CAAC,CAAC;AACnE,CAAC"}
|
package/dist/log.d.ts
CHANGED
|
@@ -4,24 +4,50 @@
|
|
|
4
4
|
* JSON-per-line output in CI; human-readable text in TTYs. Every emitted
|
|
5
5
|
* line is passed through a redactor that replaces any occurrence of a
|
|
6
6
|
* known-secret env value (keys matching *TOKEN* / *SECRET* / *PASSWORD*
|
|
7
|
-
* / *KEY*, case-insensitive) with `[REDACTED:<digest>]`,
|
|
8
|
-
* is a stable 8-hex-char SHA-256 prefix (#134).
|
|
9
|
-
* rotated tokens across log lines without ever
|
|
7
|
+
* / *KEY* / *PASS* / *PAT*, case-insensitive) with `[REDACTED:<digest>]`,
|
|
8
|
+
* where `<digest>` is a stable 8-hex-char SHA-256 prefix (#134).
|
|
9
|
+
* Operators can correlate rotated tokens across log lines without ever
|
|
10
|
+
* seeing the value.
|
|
10
11
|
*
|
|
11
12
|
* Substring redaction (rather than Pino-style field-path redaction) is
|
|
12
13
|
* deliberate: handlers capture child-process stdout/stderr and feed it
|
|
13
14
|
* through the logger. A token leaked inside that stream must not escape
|
|
14
15
|
* to CI logs regardless of which field it ended up in.
|
|
15
16
|
*
|
|
17
|
+
* Sources scanned:
|
|
18
|
+
* - `process.env` (always)
|
|
19
|
+
* - any additional `envSources` passed to `createLogger` (#136), so
|
|
20
|
+
* credentials injected into a per-call `ctx.env` object (rather than
|
|
21
|
+
* the process env) are redacted too.
|
|
22
|
+
*
|
|
23
|
+
* Performance (#141): the redaction set is cached per-source object by
|
|
24
|
+
* identity in a WeakMap, keyed by a cheap content signature. Back-to-back
|
|
25
|
+
* log calls re-use the cached entries; env is re-walked only when a
|
|
26
|
+
* source object's size/contents change.
|
|
27
|
+
*
|
|
28
|
+
* Length floor (#137): values shorter than 8 chars are skipped even when
|
|
29
|
+
* their env-var name matches a known-secret pattern. Real registry
|
|
30
|
+
* tokens comfortably clear this; short values (`CI=1`, a boolean flag)
|
|
31
|
+
* cause far more harm by mangling every occurrence of that character in
|
|
32
|
+
* the log stream than they are worth defending as credentials.
|
|
33
|
+
*
|
|
16
34
|
* Issue #11. Plan: §22.2, §22.5.
|
|
17
35
|
*/
|
|
18
36
|
import type { Writable } from 'node:stream';
|
|
19
37
|
import type { Logger } from './types.js';
|
|
20
38
|
export type Level = 'debug' | 'info' | 'warn' | 'error';
|
|
39
|
+
export type EnvSource = Record<string, string | undefined>;
|
|
21
40
|
export interface LoggerOptions {
|
|
22
41
|
stream?: Writable;
|
|
23
42
|
pretty?: boolean;
|
|
24
43
|
level?: Level;
|
|
44
|
+
/**
|
|
45
|
+
* Additional env-like objects to scan for secrets, alongside
|
|
46
|
+
* `process.env`. Credentials are frequently injected into `ctx.env`
|
|
47
|
+
* rather than the process env (#136), so callers can pass `ctx.env`
|
|
48
|
+
* here to make the redactor see them.
|
|
49
|
+
*/
|
|
50
|
+
envSources?: readonly EnvSource[];
|
|
25
51
|
}
|
|
26
52
|
export declare function createLogger(opts?: LoggerOptions): Logger;
|
|
27
53
|
/**
|
|
@@ -29,8 +55,10 @@ export declare function createLogger(opts?: LoggerOptions): Logger;
|
|
|
29
55
|
* `[REDACTED:<digest>]` where `<digest>` is a stable 8-hex-char
|
|
30
56
|
* SHA-256 prefix of the token. Operators can correlate rotated
|
|
31
57
|
* tokens across log lines without ever seeing the value itself.
|
|
32
|
-
*
|
|
33
|
-
*
|
|
58
|
+
*
|
|
59
|
+
* Sources default to `[process.env]`. Callers (e.g. `createLogger`)
|
|
60
|
+
* pass additional per-ctx env objects so credentials that never touched
|
|
61
|
+
* `process.env` still redact (#136).
|
|
34
62
|
*/
|
|
35
|
-
export declare function redact(s: string): string;
|
|
63
|
+
export declare function redact(s: string, sources?: readonly EnvSource[]): string;
|
|
36
64
|
//# sourceMappingURL=log.d.ts.map
|
package/dist/log.d.ts.map
CHANGED
|
@@ -1 +1 @@
|
|
|
1
|
-
{"version":3,"file":"log.d.ts","sourceRoot":"","sources":["../src/log.ts"],"names":[],"mappings":"AAAA
|
|
1
|
+
{"version":3,"file":"log.d.ts","sourceRoot":"","sources":["../src/log.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAkCG;AAGH,OAAO,KAAK,EAAE,QAAQ,EAAE,MAAM,aAAa,CAAC;AAE5C,OAAO,KAAK,EAAE,MAAM,EAAE,MAAM,YAAY,CAAC;AAEzC,MAAM,MAAM,KAAK,GAAG,OAAO,GAAG,MAAM,GAAG,MAAM,GAAG,OAAO,CAAC;AASxD,MAAM,MAAM,SAAS,GAAG,MAAM,CAAC,MAAM,EAAE,MAAM,GAAG,SAAS,CAAC,CAAC;AAE3D,MAAM,WAAW,aAAa;IAC5B,MAAM,CAAC,EAAE,QAAQ,CAAC;IAClB,MAAM,CAAC,EAAE,OAAO,CAAC;IACjB,KAAK,CAAC,EAAE,KAAK,CAAC;IACd;;;;;OAKG;IACH,UAAU,CAAC,EAAE,SAAS,SAAS,EAAE,CAAC;CACnC;AAED,wBAAgB,YAAY,CAAC,IAAI,GAAE,aAAkB,GAAG,MAAM,CAyB7D;AAsFD;;;;;;;;;GASG;AACH,wBAAgB,MAAM,CACpB,CAAC,EAAE,MAAM,EACT,OAAO,GAAE,SAAS,SAAS,EAA+B,GACzD,MAAM,CAYR"}
|
package/dist/log.js
CHANGED
|
@@ -4,18 +4,36 @@
|
|
|
4
4
|
* JSON-per-line output in CI; human-readable text in TTYs. Every emitted
|
|
5
5
|
* line is passed through a redactor that replaces any occurrence of a
|
|
6
6
|
* known-secret env value (keys matching *TOKEN* / *SECRET* / *PASSWORD*
|
|
7
|
-
* / *KEY*, case-insensitive) with `[REDACTED:<digest>]`,
|
|
8
|
-
* is a stable 8-hex-char SHA-256 prefix (#134).
|
|
9
|
-
* rotated tokens across log lines without ever
|
|
7
|
+
* / *KEY* / *PASS* / *PAT*, case-insensitive) with `[REDACTED:<digest>]`,
|
|
8
|
+
* where `<digest>` is a stable 8-hex-char SHA-256 prefix (#134).
|
|
9
|
+
* Operators can correlate rotated tokens across log lines without ever
|
|
10
|
+
* seeing the value.
|
|
10
11
|
*
|
|
11
12
|
* Substring redaction (rather than Pino-style field-path redaction) is
|
|
12
13
|
* deliberate: handlers capture child-process stdout/stderr and feed it
|
|
13
14
|
* through the logger. A token leaked inside that stream must not escape
|
|
14
15
|
* to CI logs regardless of which field it ended up in.
|
|
15
16
|
*
|
|
17
|
+
* Sources scanned:
|
|
18
|
+
* - `process.env` (always)
|
|
19
|
+
* - any additional `envSources` passed to `createLogger` (#136), so
|
|
20
|
+
* credentials injected into a per-call `ctx.env` object (rather than
|
|
21
|
+
* the process env) are redacted too.
|
|
22
|
+
*
|
|
23
|
+
* Performance (#141): the redaction set is cached per-source object by
|
|
24
|
+
* identity in a WeakMap, keyed by a cheap content signature. Back-to-back
|
|
25
|
+
* log calls re-use the cached entries; env is re-walked only when a
|
|
26
|
+
* source object's size/contents change.
|
|
27
|
+
*
|
|
28
|
+
* Length floor (#137): values shorter than 8 chars are skipped even when
|
|
29
|
+
* their env-var name matches a known-secret pattern. Real registry
|
|
30
|
+
* tokens comfortably clear this; short values (`CI=1`, a boolean flag)
|
|
31
|
+
* cause far more harm by mangling every occurrence of that character in
|
|
32
|
+
* the log stream than they are worth defending as credentials.
|
|
33
|
+
*
|
|
16
34
|
* Issue #11. Plan: §22.2, §22.5.
|
|
17
35
|
*/
|
|
18
|
-
import {
|
|
36
|
+
import { createHash } from 'node:crypto';
|
|
19
37
|
const LEVEL_ORDER = {
|
|
20
38
|
debug: 10,
|
|
21
39
|
info: 20,
|
|
@@ -28,14 +46,17 @@ export function createLogger(opts = {}) {
|
|
|
28
46
|
/* v8 ignore next -- tests always pass an explicit stream */
|
|
29
47
|
const stream = opts.stream ?? process.stderr;
|
|
30
48
|
const pretty = opts.pretty ?? isTty(stream);
|
|
31
|
-
/* v8 ignore next -- 'info' default vs explicit level both exercised; the ?? branch is one of those */
|
|
32
49
|
const minLevel = LEVEL_ORDER[opts.level ?? 'info'];
|
|
50
|
+
const sources = [
|
|
51
|
+
process.env,
|
|
52
|
+
...(opts.envSources ?? []),
|
|
53
|
+
];
|
|
33
54
|
const emit = (level, msg, fields) => {
|
|
34
55
|
if (LEVEL_ORDER[level] < minLevel)
|
|
35
56
|
return;
|
|
36
57
|
const record = { level, time: new Date().toISOString(), msg, ...fields };
|
|
37
58
|
const raw = pretty ? formatPretty(record) : `${JSON.stringify(record)}\n`;
|
|
38
|
-
stream.write(redact(raw));
|
|
59
|
+
stream.write(redact(raw, sources));
|
|
39
60
|
};
|
|
40
61
|
return {
|
|
41
62
|
debug: (msg, fields = {}) => emit('debug', msg, fields),
|
|
@@ -64,28 +85,79 @@ function formatScalar(v) {
|
|
|
64
85
|
return JSON.stringify(v);
|
|
65
86
|
}
|
|
66
87
|
/* ----------------------------- redaction ----------------------------- */
|
|
67
|
-
const SECRET_KEY = /TOKEN|SECRET|PASSWORD|KEY/i;
|
|
88
|
+
const SECRET_KEY = /TOKEN|SECRET|PASSWORD|KEY|PASS|PAT/i;
|
|
89
|
+
const MIN_OPAQUE_LEN = 8;
|
|
90
|
+
const SCAN_CACHE = new WeakMap();
|
|
91
|
+
function scanSource(src) {
|
|
92
|
+
// Cheap signature-of-env to detect in-place mutation. Accumulates a
|
|
93
|
+
// small multiplicative hash over each key name + value length + key's
|
|
94
|
+
// first byte; distinguishes renames and equal-length swaps that a
|
|
95
|
+
// plain count+length sum would miss. Keeping the per-call cost below
|
|
96
|
+
// the full scan is what makes #141 a real win.
|
|
97
|
+
const keys = Object.keys(src);
|
|
98
|
+
let acc = keys.length;
|
|
99
|
+
for (const k of keys) {
|
|
100
|
+
const v = src[k] ?? '';
|
|
101
|
+
acc = (acc * 31 + k.length + v.length + k.charCodeAt(0)) | 0;
|
|
102
|
+
}
|
|
103
|
+
const sig = `${keys.length}:${acc}`;
|
|
104
|
+
const cached = SCAN_CACHE.get(src);
|
|
105
|
+
if (cached !== undefined && cached.sig === sig)
|
|
106
|
+
return cached.values;
|
|
107
|
+
const values = [];
|
|
108
|
+
for (const k of keys) {
|
|
109
|
+
const v = src[k];
|
|
110
|
+
// `undefined` is rare (read-after-delete race in tests). Treat
|
|
111
|
+
// as absent; skip without a dedicated branch so coverage stays
|
|
112
|
+
// tight.
|
|
113
|
+
if (!v)
|
|
114
|
+
continue;
|
|
115
|
+
if (!SECRET_KEY.test(k))
|
|
116
|
+
continue;
|
|
117
|
+
// #137 length floor. Short values mangle every matching character
|
|
118
|
+
// in unrelated log text. Real tokens clear 8 easily; short values
|
|
119
|
+
// that happen to share a name shape with a credential aren't worth
|
|
120
|
+
// defending.
|
|
121
|
+
if (v.length < MIN_OPAQUE_LEN)
|
|
122
|
+
continue;
|
|
123
|
+
values.push(v);
|
|
124
|
+
}
|
|
125
|
+
// Longest-first: redacting a substring first would leave the
|
|
126
|
+
// superset's leftover fragment unredacted in the output.
|
|
127
|
+
values.sort((a, b) => b.length - a.length);
|
|
128
|
+
const entry = { sig, values };
|
|
129
|
+
SCAN_CACHE.set(src, entry);
|
|
130
|
+
return values;
|
|
131
|
+
}
|
|
68
132
|
/**
|
|
69
133
|
* Replace every occurrence of a known-secret env value with
|
|
70
134
|
* `[REDACTED:<digest>]` where `<digest>` is a stable 8-hex-char
|
|
71
135
|
* SHA-256 prefix of the token. Operators can correlate rotated
|
|
72
136
|
* tokens across log lines without ever seeing the value itself.
|
|
73
|
-
*
|
|
74
|
-
*
|
|
137
|
+
*
|
|
138
|
+
* Sources default to `[process.env]`. Callers (e.g. `createLogger`)
|
|
139
|
+
* pass additional per-ctx env objects so credentials that never touched
|
|
140
|
+
* `process.env` still redact (#136).
|
|
75
141
|
*/
|
|
76
|
-
export function redact(s) {
|
|
142
|
+
export function redact(s, sources = [process.env]) {
|
|
77
143
|
let out = s;
|
|
78
|
-
for (const
|
|
79
|
-
|
|
80
|
-
|
|
81
|
-
|
|
82
|
-
|
|
83
|
-
|
|
84
|
-
|
|
85
|
-
|
|
86
|
-
|
|
87
|
-
out = out.split(v).join(`[REDACTED:${tokenDigest(v)}]`);
|
|
144
|
+
for (const src of sources) {
|
|
145
|
+
for (const v of scanSource(src)) {
|
|
146
|
+
if (!out.includes(v))
|
|
147
|
+
continue;
|
|
148
|
+
// String.replaceAll expects a literal or a RegExp; use split/join to
|
|
149
|
+
// avoid regex escaping every secret value. Repeats across sources
|
|
150
|
+
// are a no-op (the value's already gone after the first pass).
|
|
151
|
+
out = out.split(v).join(`[REDACTED:${sha256Prefix(v)}]`);
|
|
152
|
+
}
|
|
88
153
|
}
|
|
89
154
|
return out;
|
|
90
155
|
}
|
|
156
|
+
/** SHA-256 prefix for identifying a token in logs without leaking it.
|
|
157
|
+
* Inlined here after removing `auth.ts#tokenDigest` (#134): the redactor
|
|
158
|
+
* was the only external consumer, and exposing the helper just for one
|
|
159
|
+
* call site is the kind of indirection we don't need. */
|
|
160
|
+
function sha256Prefix(token) {
|
|
161
|
+
return createHash('sha256').update(token).digest('hex').slice(0, 8);
|
|
162
|
+
}
|
|
91
163
|
//# sourceMappingURL=log.js.map
|
package/dist/log.js.map
CHANGED
|
@@ -1 +1 @@
|
|
|
1
|
-
{"version":3,"file":"log.js","sourceRoot":"","sources":["../src/log.ts"],"names":[],"mappings":"AAAA
|
|
1
|
+
{"version":3,"file":"log.js","sourceRoot":"","sources":["../src/log.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAkCG;AAEH,OAAO,EAAE,UAAU,EAAE,MAAM,aAAa,CAAC;AAOzC,MAAM,WAAW,GAA0B;IACzC,KAAK,EAAE,EAAE;IACT,IAAI,EAAE,EAAE;IACR,IAAI,EAAE,EAAE;IACR,KAAK,EAAE,EAAE;CACV,CAAC;AAiBF,MAAM,UAAU,YAAY,CAAC,OAAsB,EAAE;IACnD,+DAA+D;IAC/D,kDAAkD;IAClD,4DAA4D;IAC5D,MAAM,MAAM,GAAa,IAAI,CAAC,MAAM,IAAI,OAAO,CAAC,MAAM,CAAC;IACvD,MAAM,MAAM,GAAG,IAAI,CAAC,MAAM,IAAI,KAAK,CAAC,MAAM,CAAC,CAAC;IAC5C,MAAM,QAAQ,GAAG,WAAW,CAAC,IAAI,CAAC,KAAK,IAAI,MAAM,CAAC,CAAC;IACnD,MAAM,OAAO,GAAyB;QACpC,OAAO,CAAC,GAAgB;QACxB,GAAG,CAAC,IAAI,CAAC,UAAU,IAAI,EAAE,CAAC;KAC3B,CAAC;IAEF,MAAM,IAAI,GAAG,CAAC,KAAY,EAAE,GAAW,EAAE,MAA+B,EAAQ,EAAE;QAChF,IAAI,WAAW,CAAC,KAAK,CAAC,GAAG,QAAQ;YAAE,OAAO;QAC1C,MAAM,MAAM,GAAG,EAAE,KAAK,EAAE,IAAI,EAAE,IAAI,IAAI,EAAE,CAAC,WAAW,EAAE,EAAE,GAAG,EAAE,GAAG,MAAM,EAAE,CAAC;QACzE,MAAM,GAAG,GAAG,MAAM,CAAC,CAAC,CAAC,YAAY,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,GAAG,IAAI,CAAC,SAAS,CAAC,MAAM,CAAC,IAAI,CAAC;QAC1E,MAAM,CAAC,KAAK,CAAC,MAAM,CAAC,GAAG,EAAE,OAAO,CAAC,CAAC,CAAC;IACrC,CAAC,CAAC;IAEF,OAAO;QACL,KAAK,EAAE,CAAC,GAAG,EAAE,MAAM,GAAG,EAAE,EAAE,EAAE,CAAC,IAAI,CAAC,OAAO,EAAE,GAAG,EAAE,MAAM,CAAC;QACvD,IAAI,EAAE,CAAC,GAAG,EAAE,MAAM,GAAG,EAAE,EAAE,EAAE,CAAC,IAAI,CAAC,MAAM,EAAE,GAAG,EAAE,MAAM,CAAC;QACrD,IAAI,EAAE,CAAC,GAAG,EAAE,MAAM,GAAG,EAAE,EAAE,EAAE,CAAC,IAAI,CAAC,MAAM,EAAE,GAAG,EAAE,MAAM,CAAC;QACrD,KAAK,EAAE,CAAC,GAAG,EAAE,MAAM,GAAG,EAAE,EAAE,EAAE,CAAC,IAAI,CAAC,OAAO,EAAE,GAAG,EAAE,MAAM,CAAC;KACxD,CAAC;AACJ,CAAC;AAED,SAAS,KAAK,CAAC,MAAgB;IAC7B,OAAO,OAAO,CAAE,MAA8B,CAAC,KAAK,CAAC,CAAC;AACxD,CAAC;AAED,SAAS,YAAY,CAAC,MAA+B;IACnD,MAAM,EAAE,KAAK,EAAE,IAAI,EAAE,EAAE,EAAE,GAAG,EAAE,GAAG,MAAM,EAAE,GAAG,MAAM,CAAC;IACnD,MAAM,KAAK,GAAG,MAAM,CAAC,OAAO,CAAC,MAAM,CAAC;SACjC,GAAG,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,EAAE,EAAE,CAAC,GAAG,CAAC,IAAI,YAAY,CAAC,CAAC,CAAC,EAAE,CAAC;SAC1C,IAAI,CAAC,GAAG,CAAC,CAAC;IACb,MAAM,MAAM,GAAG,IAAI,MAAM,CAAC,KAAK,CAAC,CAAC,WAAW,EAAE,GAAG,CAAC;IAClD,OAAO,KAAK,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,MAAM,IAAI,MAAM,CAAC,GAAG,CAAC,KAAK,KAAK,IAAI,CAAC,CAAC,CAAC,GAAG,MAAM,IAAI,MAAM,CAAC,GAAG,CAAC,IAAI,CAAC;AAClG,CAAC;AAED,SAAS,YAAY,CAAC,CAAU;IAC9B,IAAI,OAAO,CAAC,KAAK,QAAQ;QAAE,OAAO,CAAC,CAAC;IACpC,oFAAoF;IACpF,IAAI,OAAO,CAAC,KAAK,QAAQ,IAAI,OAAO,CAAC,KAAK,SAAS,IAAI,CAAC,KAAK,IAAI;QAAE,OAAO,MAAM,CAAC,CAAC,CAAC,CAAC;IACpF,OAAO,IAAI,CAAC,SAAS,CAAC,CAAC,CAAC,CAAC;AAC3B,CAAC;AAED,2EAA2E;AAE3E,MAAM,UAAU,GAAG,qCAAqC,CAAC;AACzD,MAAM,cAAc,GAAG,CAAC,CAAC;AAmBzB,MAAM,UAAU,GAAG,IAAI,OAAO,EAAsB,CAAC;AAErD,SAAS,UAAU,CAAC,GAAc;IAChC,oEAAoE;IACpE,sEAAsE;IACtE,kEAAkE;IAClE,qEAAqE;IACrE,+CAA+C;IAC/C,MAAM,IAAI,GAAG,MAAM,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;IAC9B,IAAI,GAAG,GAAG,IAAI,CAAC,MAAM,CAAC;IACtB,KAAK,MAAM,CAAC,IAAI,IAAI,EAAE,CAAC;QACrB,MAAM,CAAC,GAAG,GAAG,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC;QACvB,GAAG,GAAG,CAAC,GAAG,GAAG,EAAE,GAAG,CAAC,CAAC,MAAM,GAAG,CAAC,CAAC,MAAM,GAAG,CAAC,CAAC,UAAU,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC;IAC/D,CAAC;IACD,MAAM,GAAG,GAAG,GAAG,IAAI,CAAC,MAAM,IAAI,GAAG,EAAE,CAAC;IAEpC,MAAM,MAAM,GAAG,UAAU,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC;IACnC,IAAI,MAAM,KAAK,SAAS,IAAI,MAAM,CAAC,GAAG,KAAK,GAAG;QAAE,OAAO,MAAM,CAAC,MAAM,CAAC;IAErE,MAAM,MAAM,GAAa,EAAE,CAAC;IAC5B,KAAK,MAAM,CAAC,IAAI,IAAI,EAAE,CAAC;QACrB,MAAM,CAAC,GAAG,GAAG,CAAC,CAAC,CAAC,CAAC;QACjB,+DAA+D;QAC/D,+DAA+D;QAC/D,SAAS;QACT,IAAI,CAAC,CAAC;YAAE,SAAS;QACjB,IAAI,CAAC,UAAU,CAAC,IAAI,CAAC,CAAC,CAAC;YAAE,SAAS;QAClC,kEAAkE;QAClE,kEAAkE;QAClE,mEAAmE;QACnE,aAAa;QACb,IAAI,CAAC,CAAC,MAAM,GAAG,cAAc;YAAE,SAAS;QACxC,MAAM,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;IACjB,CAAC;IACD,6DAA6D;IAC7D,yDAAyD;IACzD,MAAM,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,MAAM,GAAG,CAAC,CAAC,MAAM,CAAC,CAAC;IAC3C,MAAM,KAAK,GAAY,EAAE,GAAG,EAAE,MAAM,EAAE,CAAC;IACvC,UAAU,CAAC,GAAG,CAAC,GAAG,EAAE,KAAK,CAAC,CAAC;IAC3B,OAAO,MAAM,CAAC;AAChB,CAAC;AAED;;;;;;;;;GASG;AACH,MAAM,UAAU,MAAM,CACpB,CAAS,EACT,UAAgC,CAAC,OAAO,CAAC,GAAgB,CAAC;IAE1D,IAAI,GAAG,GAAG,CAAC,CAAC;IACZ,KAAK,MAAM,GAAG,IAAI,OAAO,EAAE,CAAC;QAC1B,KAAK,MAAM,CAAC,IAAI,UAAU,CAAC,GAAG,CAAC,EAAE,CAAC;YAChC,IAAI,CAAC,GAAG,CAAC,QAAQ,CAAC,CAAC,CAAC;gBAAE,SAAS;YAC/B,qEAAqE;YACrE,kEAAkE;YAClE,+DAA+D;YAC/D,GAAG,GAAG,GAAG,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,aAAa,YAAY,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC;QAC3D,CAAC;IACH,CAAC;IACD,OAAO,GAAG,CAAC;AACb,CAAC;AAED;;;yDAGyD;AACzD,SAAS,YAAY,CAAC,KAAa;IACjC,OAAO,UAAU,CAAC,QAAQ,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC;AACtE,CAAC"}
|
package/dist/token.d.ts
CHANGED
|
@@ -143,12 +143,24 @@ export interface SecretListOptions {
|
|
|
143
143
|
repo?: string;
|
|
144
144
|
keyring?: Keyring;
|
|
145
145
|
fetchFn?: typeof fetch;
|
|
146
|
-
/**
|
|
146
|
+
/**
|
|
147
|
+
* Override GitHub API base URL. Tests only: honored only when
|
|
148
|
+
* NODE_ENV === 'test' (#139). In production callers, an arbitrary
|
|
149
|
+
* base URL would be an SSRF lever (attacker-controlled URL receives
|
|
150
|
+
* a Bearer-token GET against internal services); gating on NODE_ENV
|
|
151
|
+
* keeps that lever out of reach outside the test harness. Vitest
|
|
152
|
+
* sets NODE_ENV=test by default, so this is transparent to the
|
|
153
|
+
* existing suite.
|
|
154
|
+
*/
|
|
147
155
|
apiBase?: string;
|
|
148
156
|
/** Per-request timeout. Defaults to 5000ms. */
|
|
149
157
|
timeoutMs?: number;
|
|
150
158
|
env?: NodeJS.ProcessEnv;
|
|
151
159
|
}
|
|
160
|
+
export interface EnvSecretError {
|
|
161
|
+
environment: string;
|
|
162
|
+
message: string;
|
|
163
|
+
}
|
|
152
164
|
export type SecretListOutcome = {
|
|
153
165
|
kind: 'not_logged_in';
|
|
154
166
|
message: string;
|
|
@@ -162,6 +174,7 @@ export type SecretListOutcome = {
|
|
|
162
174
|
} | {
|
|
163
175
|
kind: 'ok';
|
|
164
176
|
rows: TokenListRow[];
|
|
177
|
+
envErrors?: EnvSecretError[];
|
|
165
178
|
};
|
|
166
179
|
/**
|
|
167
180
|
* List GitHub Actions secrets (repo + environment) whose names look like
|
package/dist/token.d.ts.map
CHANGED
|
@@ -1 +1 @@
|
|
|
1
|
-
{"version":3,"file":"token.d.ts","sourceRoot":"","sources":["../src/token.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;GAcG;AAKH,OAAO,EAAc,KAAK,OAAO,EAAE,MAAM,aAAa,CAAC;AACvD,OAAO,EAAkB,KAAK,OAAO,EAAE,MAAM,cAAc,CAAC;
|
|
1
|
+
{"version":3,"file":"token.d.ts","sourceRoot":"","sources":["../src/token.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;GAcG;AAKH,OAAO,EAAc,KAAK,OAAO,EAAE,MAAM,aAAa,CAAC;AACvD,OAAO,EAAkB,KAAK,OAAO,EAAE,MAAM,cAAc,CAAC;AAG5D,MAAM,MAAM,QAAQ,GAAG,MAAM,GAAG,KAAK,GAAG,QAAQ,CAAC;AAEjD,MAAM,WAAW,cAAc;IAC7B,KAAK,EAAE,MAAM,CAAC;IACd,QAAQ,CAAC,EAAE,QAAQ,CAAC;IACpB,gDAAgD;IAChD,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB,oEAAoE;IACpE,SAAS,CAAC,EAAE,MAAM,CAAC;CACpB;AAED,MAAM,MAAM,aAAa,GACrB,iBAAiB,GACjB,gBAAgB,GAChB,mBAAmB,GACnB,kBAAkB,CAAC;AAEvB,UAAU,UAAU;IAClB,QAAQ,EAAE,QAAQ,CAAC;IACnB,aAAa,EAAE,MAAM,CAAC;CACvB;AAED,MAAM,WAAW,iBAAkB,SAAQ,UAAU;IACnD,QAAQ,EAAE,MAAM,CAAC;IACjB,MAAM,EAAE,UAAU,CAAC;IACnB,UAAU,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,GAAG,IAAI,CAAC;IAC3C,YAAY,EAAE,WAAW,EAAE,CAAC;IAC5B,OAAO,EAAE,OAAO,CAAC;CAClB;AAED,MAAM,MAAM,WAAW,GACnB;IAAE,IAAI,EAAE,cAAc,CAAC;IAAC,KAAK,EAAE,MAAM,EAAE,CAAA;CAAE,GACzC;IAAE,IAAI,EAAE,YAAY,CAAC;IAAC,GAAG,EAAE,MAAM,EAAE,CAAA;CAAE,GACrC;IAAE,IAAI,EAAE,MAAM,CAAC;IAAC,UAAU,CAAC,EAAE,MAAM,CAAC;IAAC,SAAS,CAAC,EAAE,MAAM,CAAA;CAAE,GACzD;IAAE,IAAI,EAAE,SAAS,CAAC;IAAC,GAAG,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAA;CAAE,CAAC;AAEtD,MAAM,WAAW,WAAW;IAC1B,QAAQ,EAAE,OAAO,CAAC;IAClB,UAAU,EAAE,OAAO,CAAC;IACpB,QAAQ,EAAE,MAAM,EAAE,GAAG,IAAI,CAAC;IAC1B,MAAM,EAAE,MAAM,EAAE,GAAG,IAAI,CAAC;IACxB,IAAI,EAAE,MAAM,EAAE,GAAG,IAAI,CAAC;IACtB,UAAU,EAAE,MAAM,GAAG,IAAI,CAAC;IAC1B,cAAc,EAAE,MAAM,EAAE,GAAG,IAAI,CAAC;IAChC,OAAO,EAAE,MAAM,GAAG,IAAI,CAAC;CACxB;AAED,MAAM,WAAW,gBAAiB,SAAQ,UAAU;IAClD,QAAQ,EAAE,KAAK,CAAC;IAChB,MAAM,EAAE,UAAU,GAAG,QAAQ,GAAG,SAAS,CAAC;IAC1C,QAAQ,EAAE,MAAM,CAAC;IACjB,SAAS,EAAE,WAAW,GAAG,IAAI,CAAC;IAC9B,IAAI,CAAC,EAAE,MAAM,CAAC;CACf;AAED,MAAM,WAAW,cAAc;IAC7B,IAAI,EAAE,MAAM,CAAC;IACb,eAAe,EAAE,MAAM,EAAE,GAAG,IAAI,CAAC;IACjC,YAAY,EAAE,MAAM,EAAE,GAAG,IAAI,CAAC;IAC9B,UAAU,EAAE,MAAM,GAAG,IAAI,CAAC;CAC3B;AAED,MAAM,WAAW,mBAAoB,SAAQ,UAAU;IACrD,QAAQ,EAAE,QAAQ,CAAC;IACnB,QAAQ,EAAE,MAAM,CAAC;IACjB,cAAc,EAAE,cAAc,EAAE,GAAG,IAAI,CAAC;IACxC,UAAU,EAAE,IAAI,CAAC;IACjB,IAAI,EAAE,MAAM,CAAC;CACd;AAED,MAAM,WAAW,kBAAkB;IACjC,QAAQ,EAAE,QAAQ,GAAG,SAAS,CAAC;IAC/B,aAAa,EAAE,MAAM,CAAC;IACtB,KAAK,EAAE,MAAM,CAAC;CACf;AAED,wBAAgB,OAAO,CAAC,CAAC,EAAE,aAAa,GAAG,CAAC,IAAI,kBAAkB,CAEjE;AAED,wBAAsB,OAAO,CAAC,IAAI,EAAE,cAAc,GAAG,OAAO,CAAC,aAAa,CAAC,CAW1E;AAED,wBAAgB,cAAc,CAAC,KAAK,EAAE,MAAM,GAAG,QAAQ,CAItD;AA2cD,MAAM,WAAW,YAAY;IAC3B,QAAQ,EAAE,QAAQ,CAAC;IACnB,MAAM,EAAE,KAAK,GAAG,aAAa,GAAG,oBAAoB,CAAC;IACrD,IAAI,EAAE,MAAM,CAAC;IACb,OAAO,EAAE,MAAM,CAAC;IAChB,yDAAyD;IACzD,WAAW,CAAC,EAAE,MAAM,CAAC;CACtB;AAED,MAAM,WAAW,gBAAgB;IAC/B,kFAAkF;IAClF,GAAG,CAAC,EAAE,MAAM,CAAC;IACb,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB,4CAA4C;IAC5C,GAAG,CAAC,EAAE,MAAM,CAAC,UAAU,CAAC;IACxB;;;OAGG;IACH,QAAQ,CAAC,EAAE,SAAS,OAAO,EAAE,CAAC;CAC/B;AAOD;;;;;;;;;;;;;GAaG;AACH,wBAAgB,SAAS,CAAC,IAAI,GAAE,gBAAqB,GAAG,YAAY,EAAE,CAqBrE;AAiBD;;;;;;;;;;;GAWG;AACH,wBAAgB,kBAAkB,CAAC,IAAI,EAAE,MAAM,GAAG,QAAQ,GAAG,IAAI,CAQhE;AAED,MAAM,WAAW,iBAAiB;IAChC,yEAAyE;IACzE,GAAG,CAAC,EAAE,MAAM,CAAC;IACb,uGAAuG;IACvG,IAAI,CAAC,EAAE,MAAM,CAAC;IACd,OAAO,CAAC,EAAE,OAAO,CAAC;IAClB,OAAO,CAAC,EAAE,OAAO,KAAK,CAAC;IACvB;;;;;;;;OAQG;IACH,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB,+CAA+C;IAC/C,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,GAAG,CAAC,EAAE,MAAM,CAAC,UAAU,CAAC;CACzB;AAED,MAAM,WAAW,cAAc;IAC7B,WAAW,EAAE,MAAM,CAAC;IACpB,OAAO,EAAE,MAAM,CAAC;CACjB;AAED,MAAM,MAAM,iBAAiB,GACzB;IAAE,IAAI,EAAE,eAAe,CAAC;IAAC,OAAO,EAAE,MAAM,CAAA;CAAE,GAC1C;IAAE,IAAI,EAAE,SAAS,CAAC;IAAC,OAAO,EAAE,MAAM,CAAA;CAAE,GACpC;IAAE,IAAI,EAAE,OAAO,CAAC;IAAC,OAAO,EAAE,MAAM,CAAC;IAAC,IAAI,EAAE,YAAY,EAAE,CAAA;CAAE,GACxD;IAAE,IAAI,EAAE,IAAI,CAAC;IAAC,IAAI,EAAE,YAAY,EAAE,CAAC;IAAC,SAAS,CAAC,EAAE,cAAc,EAAE,CAAA;CAAE,CAAC;AAIvE;;;;;;;;;;;GAWG;AACH,wBAAsB,gBAAgB,CAAC,IAAI,GAAE,iBAAsB,GAAG,OAAO,CAAC,iBAAiB,CAAC,CAqG/F;AAyDD;;;;;;;GAOG;AACH,wBAAgB,WAAW,CAAC,GAAG,EAAE,MAAM,CAAC,UAAU,EAAE,GAAG,EAAE,MAAM,GAAG,MAAM,GAAG,IAAI,CAgB9E;AAED,wBAAgB,iBAAiB,CAAC,GAAG,EAAE,MAAM,GAAG,MAAM,GAAG,IAAI,CAW5D"}
|
package/dist/token.js
CHANGED
|
@@ -17,6 +17,7 @@ import { createHash } from 'node:crypto';
|
|
|
17
17
|
import { execFileSync } from 'node:child_process';
|
|
18
18
|
import { loadConfig } from './config.js';
|
|
19
19
|
import { defaultKeyring } from './keyring.js';
|
|
20
|
+
import { USER_AGENT } from './version.js';
|
|
20
21
|
export function isError(r) {
|
|
21
22
|
return 'error' in r;
|
|
22
23
|
}
|
|
@@ -219,7 +220,7 @@ async function probe(url, headers, timeoutMs) {
|
|
|
219
220
|
try {
|
|
220
221
|
const res = await fetch(url, {
|
|
221
222
|
method: 'GET',
|
|
222
|
-
headers: { 'user-agent':
|
|
223
|
+
headers: { 'user-agent': USER_AGENT, ...headers },
|
|
223
224
|
signal: AbortSignal.timeout(timeoutMs),
|
|
224
225
|
});
|
|
225
226
|
let body = null;
|
|
@@ -544,7 +545,12 @@ const GITHUB_API = 'https://api.github.com';
|
|
|
544
545
|
export async function tokenListSecrets(opts = {}) {
|
|
545
546
|
const keyring = opts.keyring ?? defaultKeyring();
|
|
546
547
|
const fetchFn = opts.fetchFn ?? fetch;
|
|
547
|
-
|
|
548
|
+
// #139: apiBase is test-only. Silently ignore the override outside
|
|
549
|
+
// the vitest harness so production callers can't smuggle an
|
|
550
|
+
// attacker-controlled URL in and earn a Bearer-token GET against it.
|
|
551
|
+
const apiBase = opts.apiBase !== undefined && process.env.NODE_ENV === 'test'
|
|
552
|
+
? opts.apiBase
|
|
553
|
+
: GITHUB_API;
|
|
548
554
|
const timeoutMs = opts.timeoutMs ?? 5000;
|
|
549
555
|
const env = opts.env ?? process.env;
|
|
550
556
|
const stored = await keyring.get();
|
|
@@ -578,21 +584,36 @@ export async function tokenListSecrets(opts = {}) {
|
|
|
578
584
|
}
|
|
579
585
|
}
|
|
580
586
|
const envsRes = await ghGetJson(fetchFn, `${apiBase}/repos/${repo}/environments`, auth, timeoutMs);
|
|
587
|
+
const envErrors = [];
|
|
581
588
|
if (envsRes.kind === 'ok') {
|
|
582
589
|
const envNames = extractEnvironmentNames(envsRes.body);
|
|
583
|
-
|
|
590
|
+
// Fan out per-environment secret lookups concurrently (#143): GitHub
|
|
591
|
+
// rate-limits by req/h not concurrency, and a serial loop adds a
|
|
592
|
+
// full RTT per environment. allSettled preserves partial results —
|
|
593
|
+
// one flaky environment no longer nukes the whole list.
|
|
594
|
+
const settled = await Promise.allSettled(envNames.map(async (envName) => {
|
|
584
595
|
const encoded = encodeURIComponent(envName);
|
|
585
596
|
const envSecrets = await ghGetJson(fetchFn, `${apiBase}/repos/${repo}/environments/${encoded}/secrets`, auth, timeoutMs);
|
|
586
|
-
|
|
587
|
-
|
|
597
|
+
return { envName, envSecrets };
|
|
598
|
+
}));
|
|
599
|
+
for (const s of settled) {
|
|
600
|
+
/* v8 ignore next 4 -- ghGetJson returns a tagged union and never rejects; defence-in-depth */
|
|
601
|
+
if (s.status === 'rejected') {
|
|
602
|
+
envErrors.push({ environment: '(unknown)', message: String(s.reason) });
|
|
588
603
|
continue;
|
|
589
|
-
|
|
590
|
-
|
|
604
|
+
}
|
|
605
|
+
const { envName, envSecrets } = s.value;
|
|
606
|
+
if (envSecrets.kind !== 'ok') {
|
|
607
|
+
envErrors.push({ environment: envName, message: envSecrets.message });
|
|
608
|
+
continue;
|
|
609
|
+
}
|
|
610
|
+
for (const sec of extractSecretNames(envSecrets.body)) {
|
|
611
|
+
const reg = classifySecretName(sec);
|
|
591
612
|
if (reg !== null) {
|
|
592
613
|
rows.push({
|
|
593
614
|
registry: reg,
|
|
594
615
|
source: 'environment-secret',
|
|
595
|
-
name:
|
|
616
|
+
name: sec,
|
|
596
617
|
details: `environment secret (${envName})`,
|
|
597
618
|
environment: envName,
|
|
598
619
|
});
|
|
@@ -608,7 +629,7 @@ export async function tokenListSecrets(opts = {}) {
|
|
|
608
629
|
return a.source.localeCompare(b.source);
|
|
609
630
|
return a.name.localeCompare(b.name);
|
|
610
631
|
});
|
|
611
|
-
return { kind: 'ok', rows };
|
|
632
|
+
return envErrors.length > 0 ? { kind: 'ok', rows, envErrors } : { kind: 'ok', rows };
|
|
612
633
|
}
|
|
613
634
|
async function ghGetJson(fetchFn, url, authorization, timeoutMs) {
|
|
614
635
|
try {
|