feat(TD-9488): EOL deps — Node 22, js-yaml 4, bunyan→pino (Phases 0 + 1b)

.nvmrc

@@ -0,0 +1 @@
+22

DEPENDENCY-AUDIT.md

@@ -30,7 +30,7 @@ bunyan's **`optionalDependencies`** (`mv`, `moment`, `dtrace-provider`,
 - **B (clean):** replace `bunyan-category` logger with a maintained logger (e.g. `pino`).
   Kills the whole EOL bunyan tree; requires rewriting logger usage in `src/index.ts`.
 
-Recommend **A** for the Nov 1 release; file **B** as follow-up.
+Recommend **A** for the core release; file **B** as follow-up.
 
 ---
 
@@ -129,8 +129,20 @@ Keep those on their last CJS major and patch to latest-in-major. No ESM conversi
 
 1. **Coverage net (nock)** — ✅ **DONE.** `src/index.nock.test.ts`, 38 tests, all 15 graphClient methods (success + error). `index.ts` coverage 41.6% → **64.6%** stmts, funcs 34% → 68%. 72 tests total (34 PollyJS + 38 nock) green. 3 Apollo-4-sensitive behaviors pinned in `PUBLIC-API.md` §6a.
 2. **Migrate yarn → npm** (Section 4a) — ✅ **DONE.** `yarn.lock` removed, `package-lock.json` generated. Scripts/CI/husky/lint-staged swapped. Added `.npmrc` `legacy-peer-deps=true` (bunyan-category's exact `@types/bunyan@1.8.6` peer — removed once Phase 1b lands). CI bumped to Node 22 + setup-node@v4. `npm test` → 72 pass; `npm run build` emits d.ts. npm audit: 322 → **35** (dedup from fresh install).
-3. **Phase 0** — quick wins + transitive resolutions/overrides.
-4. **Phase 1b** — kill `inflight` chain (TD-9488).
+3. **Phase 0** — ✅ **DONE.** `.nvmrc` (22), `engines: >=22`, `js-yaml 3.13.1 → 4.3.2`
+   (`safeLoad`→`load` at `j1cli.ts:207`; removes the js-yaml high). Contract unchanged,
+   72 tests green, build clean (TS 3.8 intact). **Transitive-vuln `overrides` deferred to
+   Phase 1a** — `npm audit fix` overreached into the dev tree and pulled a modern
+   `@types/babel__traverse` that TS 3.8 can't parse (TS1005). Clean fix requires the TS
+   upgrade first. Residual **prod** vulns (0 critical, 4 high) map to later phases:
+   `lodash`→Phase 2 (apollo), `moment`→Phase 1b (bunyan optionals), `tmp`/`inquirer`/
+   `external-editor`→Phase 1a (inquirer), `brace-expansion`/`minimatch`→Phase 1a overrides.
+4. **Phase 1b** — ✅ **DONE.** Replaced `bunyan-category` with `pino ^8.21.0` (pino 8 types
+   parse under TS 3.8). `inflight` + `mv`/`rimraf@2`/`glob@6` **gone from prod tree**. `Logger`
+   now an exported structural interface (`JupiterOneClientOptions.logger` backward-compatible) —
+   approved contract change, baseline updated (see `PUBLIC-API.md` §6b). Removed `.npmrc`
+   `legacy-peer-deps` (no longer needed — bunyan-category's `@types/bunyan` peer was the cause).
+   Prod vulns 7 → **4**. 72 tests green, build clean.
 5. **Phase 2** — Apollo + graphql (TD-9488 core). Verified by step 1's nock tests.
 6. **Phase 1a / Phase 3** — tooling + CLI fleet (follow-up, post-Nov-1 if needed).
 

PUBLIC-API.baseline.d.ts

@@ -1,6 +1,5 @@
 import { ApolloClient, QueryOptions } from 'apollo-client';
 import { Response as FetchResponse } from 'node-fetch';
-import Logger from 'bunyan-category';
 import { Entity, EntityForSync, Relationship, RelationshipForSync, IntegrationDefinition, IntegrationInstance, ListIntegrationInstancesOptions, EntitySource } from './types';
 import { QueryTypes } from './util/query';
 export declare class FetchError extends Error {
@@ -46,6 +45,20 @@ export interface QueryResult {
     entity: object;
     properties: object;
 }
+/**
+ * Minimal structural logger interface. Any bunyan/pino-style logger satisfies it,
+ * so consumers can continue passing their existing logger. Each method accepts
+ * either `(msg)` or `(mergeObject, msg)`, matching both bunyan and pino.
+ */
+export declare type LogFn = (objOrMsg: unknown, msg?: string) => void;
+export interface Logger {
+    trace(objOrMsg: unknown, msg?: string): void;
+    debug(objOrMsg: unknown, msg?: string): void;
+    info(objOrMsg: unknown, msg?: string): void;
+    warn(objOrMsg: unknown, msg?: string): void;
+    error(objOrMsg: unknown, msg?: string): void;
+    fatal(objOrMsg: unknown, msg?: string): void;
+}
 export interface JupiterOneClientOptions {
     account: string;
     accessToken?: string;

PUBLIC-API.md

@@ -199,3 +199,13 @@ NOT change them silently in the upgrade. If the Apollo 4 swap alters any, call i
 - **`integrationInstances.update` / `.delete` pass the `query` keyword into `mutate()`.**
   apollo-client 2.6 tolerates it; **Apollo 4 is stricter and may reject** — explicit upgrade risk.
 - `integrationDefinitions.list` uses `errorPolicy: 'all'` → collects partial errors without throwing.
+
+### 6b. Approved contract change — Phase 1b (bunyan → pino)
+**Baseline `.d.ts` updated** to reflect this. `bunyan-category` replaced with `pino` to
+remove the `mv → rimraf → glob → inflight` chain from the consumer tree (TD-9488).
+- **Before:** `logger?: Logger` where `Logger` = default import from `bunyan-category` (not exported).
+- **After:** `Logger` is a **structural interface exported from the package**
+  (`{ trace, debug, info, warn, error, fatal }`, each `(objOrMsg, msg?) => void`), plus
+  exported `LogFn`. Any bunyan/pino-style logger still satisfies it.
+- **Break risk:** only a consumer who imported bunyan's `Logger` type and used
+  bunyan methods beyond those six. Runtime log output drops the bunyan `category` field.