@composurecdk/budgets 0.8.3 → 0.8.5

package/dist/commonjs/email.d.ts

@@ -9,19 +9,14 @@ declare const emailBrand: unique symbol;
 export type Email = string & {
     readonly [emailBrand]: true;
 };
+/** Validates a Budgets subscriber email against {@link EMAIL}. @throws on invalid input. */
+export declare function validateEmail(value: string): void;
 /**
- * Validates and brands a string as an {@link Email}.
+ * Validates and brands a string as an {@link Email}. Surrounding whitespace is
+ * trimmed before validation, so the branded value is exactly what AWS receives.
  *
- * The pattern intentionally errs on the side of acceptance — anything
- * obviously not an email (whitespace, missing `@`, missing TLD) is
- * rejected, but any address AWS Budgets will plausibly accept passes.
- * The 50-char cap matches the Budgets API's documented per-subscriber
- * limit.
- *
- * @throws If the input is empty, exceeds 50 characters, or doesn't
- * contain `local@domain.tld`.
- *
- * @see https://docs.aws.amazon.com/aws-cost-management/latest/APIReference/API_budgets_Subscriber.html
+ * @throws If the input exceeds 50 characters or is not of the form
+ * `local@domain.tld`.
  */
 export declare function email(input: string): Email;
 export {};

package/dist/commonjs/email.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"email.d.ts","sourceRoot":"","sources":["../../src/email.ts"],"names":[],"mappings":"AAAA,OAAO,CAAC,MAAM,UAAU,EAAE,OAAO,MAAM,CAAC;AAExC;;;;;;GAMG;AACH,MAAM,MAAM,KAAK,GAAG,MAAM,GAAG;IAAE,QAAQ,CAAC,CAAC,UAAU,CAAC,EAAE,IAAI,CAAA;CAAE,CAAC;AAK7D;;;;;;;;;;;;;GAaG;AACH,wBAAgB,KAAK,CAAC,KAAK,EAAE,MAAM,GAAG,KAAK,CAc1C"}
+{"version":3,"file":"email.d.ts","sourceRoot":"","sources":["../../src/email.ts"],"names":[],"mappings":"AAEA,OAAO,CAAC,MAAM,UAAU,EAAE,OAAO,MAAM,CAAC;AAExC;;;;;;GAMG;AACH,MAAM,MAAM,KAAK,GAAG,MAAM,GAAG;IAAE,QAAQ,CAAC,CAAC,UAAU,CAAC,EAAE,IAAI,CAAA;CAAE,CAAC;AAyB7D,4FAA4F;AAC5F,wBAAgB,aAAa,CAAC,KAAK,EAAE,MAAM,GAAG,IAAI,CAEjD;AAED;;;;;;GAMG;AACH,wBAAgB,KAAK,CAAC,KAAK,EAAE,MAAM,GAAG,KAAK,CAI1C"}

package/dist/commonjs/email.js

@@ -1,33 +1,43 @@
 "use strict";
 Object.defineProperty(exports, "__esModule", { value: true });
+exports.validateEmail = validateEmail;
 exports.email = email;
-const MAX_LEN = 50;
-const EMAIL_REGEX = /^[^\s@]+@[^\s@]+\.[^\s@]+$/;
+const cloudformation_1 = require("@composurecdk/cloudformation");
 /**
- * Validates and brands a string as an {@link Email}.
+ * The Budgets subscriber-email constraint. Email is a *format* rule rather than
+ * a character-class one, so it carries an explicit `pattern` instead of being
+ * built from `stringConstraint()`'s `charClass`. The pattern errs on the side
+ * of acceptance — anything obviously not an email (whitespace, missing `@`,
+ * missing TLD) is rejected, but any address AWS Budgets will plausibly accept
+ * passes. The 50-char cap matches the Budgets API's documented per-subscriber
+ * limit. See ADR-0010.
  *
- * The pattern intentionally errs on the side of acceptance — anything
- * obviously not an email (whitespace, missing `@`, missing TLD) is
- * rejected, but any address AWS Budgets will plausibly accept passes.
- * The 50-char cap matches the Budgets API's documented per-subscriber
- * limit.
- *
- * @throws If the input is empty, exceeds 50 characters, or doesn't
- * contain `local@domain.tld`.
+ * The domain is matched as dot-separated labels (`[^\s@.]+(\.[^\s@.]+)+`) rather
+ * than `[^\s@]+\.[^\s@]+`: excluding `.` from each label removes the overlapping
+ * quantifiers that make the latter a super-linear (ReDoS-prone) pattern, while
+ * accepting exactly the same addresses.
+ */
+const EMAIL = {
+    name: "Budgets subscriber email",
+    pattern: /^[^\s@]+@[^\s@.]+(?:\.[^\s@.]+)+$/,
+    maxLength: 50,
+    allowed: "an email address of the form local@domain.tld",
+    source: "https://docs.aws.amazon.com/aws-cost-management/latest/APIReference/API_budgets_Subscriber.html",
+};
+/** Validates a Budgets subscriber email against {@link EMAIL}. @throws on invalid input. */
+function validateEmail(value) {
+    (0, cloudformation_1.validateString)(value, EMAIL);
+}
+/**
+ * Validates and brands a string as an {@link Email}. Surrounding whitespace is
+ * trimmed before validation, so the branded value is exactly what AWS receives.
  *
- * @see https://docs.aws.amazon.com/aws-cost-management/latest/APIReference/API_budgets_Subscriber.html
+ * @throws If the input exceeds 50 characters or is not of the form
+ * `local@domain.tld`.
  */
 function email(input) {
     const trimmed = input.trim();
-    if (trimmed.length === 0) {
-        throw new Error("email cannot be empty");
-    }
-    if (trimmed.length > MAX_LEN) {
-        throw new Error(`email exceeds ${String(MAX_LEN)} chars (AWS Budgets per-subscriber limit): "${trimmed}"`);
-    }
-    if (!EMAIL_REGEX.test(trimmed)) {
-        throw new Error(`invalid email address: "${trimmed}"`);
-    }
+    validateEmail(trimmed);
     return trimmed;
 }
 //# sourceMappingURL=email.js.map

package/dist/commonjs/email.js.map

@@ -1 +1 @@
-{"version":3,"file":"email.js","sourceRoot":"","sources":["../../src/email.ts"],"names":[],"mappings":";;AA4BA,sBAcC;AA/BD,MAAM,OAAO,GAAG,EAAE,CAAC;AACnB,MAAM,WAAW,GAAG,4BAA4B,CAAC;AAEjD;;;;;;;;;;;;;GAaG;AACH,SAAgB,KAAK,CAAC,KAAa;IACjC,MAAM,OAAO,GAAG,KAAK,CAAC,IAAI,EAAE,CAAC;IAC7B,IAAI,OAAO,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QACzB,MAAM,IAAI,KAAK,CAAC,uBAAuB,CAAC,CAAC;IAC3C,CAAC;IACD,IAAI,OAAO,CAAC,MAAM,GAAG,OAAO,EAAE,CAAC;QAC7B,MAAM,IAAI,KAAK,CACb,iBAAiB,MAAM,CAAC,OAAO,CAAC,+CAA+C,OAAO,GAAG,CAC1F,CAAC;IACJ,CAAC;IACD,IAAI,CAAC,WAAW,CAAC,IAAI,CAAC,OAAO,CAAC,EAAE,CAAC;QAC/B,MAAM,IAAI,KAAK,CAAC,2BAA2B,OAAO,GAAG,CAAC,CAAC;IACzD,CAAC;IACD,OAAO,OAAgB,CAAC;AAC1B,CAAC"}
+{"version":3,"file":"email.js","sourceRoot":"","sources":["../../src/email.ts"],"names":[],"mappings":";;AAqCA,sCAEC;AASD,sBAIC;AApDD,iEAAqF;AAarF;;;;;;;;;;;;;GAaG;AACH,MAAM,KAAK,GAAqB;IAC9B,IAAI,EAAE,0BAA0B;IAChC,OAAO,EAAE,mCAAmC;IAC5C,SAAS,EAAE,EAAE;IACb,OAAO,EAAE,+CAA+C;IACxD,MAAM,EACJ,iGAAiG;CACpG,CAAC;AAEF,4FAA4F;AAC5F,SAAgB,aAAa,CAAC,KAAa;IACzC,IAAA,+BAAc,EAAC,KAAK,EAAE,KAAK,CAAC,CAAC;AAC/B,CAAC;AAED;;;;;;GAMG;AACH,SAAgB,KAAK,CAAC,KAAa;IACjC,MAAM,OAAO,GAAG,KAAK,CAAC,IAAI,EAAE,CAAC;IAC7B,aAAa,CAAC,OAAO,CAAC,CAAC;IACvB,OAAO,OAAgB,CAAC;AAC1B,CAAC"}

package/dist/commonjs/index.d.ts

@@ -1,3 +1,4 @@
+import { validateEmail } from "./email.js";
 export { createBudgetBuilder, type IBudgetBuilder, type BudgetBuilderProps, type BudgetBuilderResult, type BudgetLimit, } from "./budget-builder.js";
 export { createBudgetAlarmBuilder, type IBudgetAlarmBuilder, type BudgetAlarmBuilderProps, type BudgetAlarmBuilderResult, } from "./budget-alarm-builder.js";
 export { BUDGET_DEFAULTS, DEFAULT_BUDGET_CURRENCIES } from "./defaults.js";
@@ -5,4 +6,16 @@ export { type BudgetAlarmConfig, type EstimatedChargesAlarmConfig } from "./alar
 export { createBudgetsTopicPolicies } from "./topic-policy.js";
 export { email, type Email } from "./email.js";
 export { resolveSubscribers, toCfnNotificationWithSubscribers, type NotificationEntry, type NotificationType, type NotifySubscribers, type ResolvedSubscribers, } from "./notifications.js";
+/**
+ * This package's AWS-property constraints, grouped by application strategy.
+ * The `constraints.validate.*` / `constraints.sanitize.*` shape is identical in
+ * every builder package; the underlying constraint definition stays
+ * module-private — this namespace is its only public surface. See ADR-0010.
+ */
+export declare const constraints: {
+    validate: {
+        email: typeof validateEmail;
+    };
+    sanitize: {};
+};
 //# sourceMappingURL=index.d.ts.map

package/dist/commonjs/index.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../src/index.ts"],"names":[],"mappings":"AAAA,OAAO,EACL,mBAAmB,EACnB,KAAK,cAAc,EACnB,KAAK,kBAAkB,EACvB,KAAK,mBAAmB,EACxB,KAAK,WAAW,GACjB,MAAM,qBAAqB,CAAC;AAC7B,OAAO,EACL,wBAAwB,EACxB,KAAK,mBAAmB,EACxB,KAAK,uBAAuB,EAC5B,KAAK,wBAAwB,GAC9B,MAAM,2BAA2B,CAAC;AACnC,OAAO,EAAE,eAAe,EAAE,yBAAyB,EAAE,MAAM,eAAe,CAAC;AAC3E,OAAO,EAAE,KAAK,iBAAiB,EAAE,KAAK,2BAA2B,EAAE,MAAM,mBAAmB,CAAC;AAC7F,OAAO,EAAE,0BAA0B,EAAE,MAAM,mBAAmB,CAAC;AAC/D,OAAO,EAAE,KAAK,EAAE,KAAK,KAAK,EAAE,MAAM,YAAY,CAAC;AAC/C,OAAO,EACL,kBAAkB,EAClB,gCAAgC,EAChC,KAAK,iBAAiB,EACtB,KAAK,gBAAgB,EACrB,KAAK,iBAAiB,EACtB,KAAK,mBAAmB,GACzB,MAAM,oBAAoB,CAAC"}
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../src/index.ts"],"names":[],"mappings":"AACA,OAAO,EAAE,aAAa,EAAE,MAAM,YAAY,CAAC;AAE3C,OAAO,EACL,mBAAmB,EACnB,KAAK,cAAc,EACnB,KAAK,kBAAkB,EACvB,KAAK,mBAAmB,EACxB,KAAK,WAAW,GACjB,MAAM,qBAAqB,CAAC;AAC7B,OAAO,EACL,wBAAwB,EACxB,KAAK,mBAAmB,EACxB,KAAK,uBAAuB,EAC5B,KAAK,wBAAwB,GAC9B,MAAM,2BAA2B,CAAC;AACnC,OAAO,EAAE,eAAe,EAAE,yBAAyB,EAAE,MAAM,eAAe,CAAC;AAC3E,OAAO,EAAE,KAAK,iBAAiB,EAAE,KAAK,2BAA2B,EAAE,MAAM,mBAAmB,CAAC;AAC7F,OAAO,EAAE,0BAA0B,EAAE,MAAM,mBAAmB,CAAC;AAC/D,OAAO,EAAE,KAAK,EAAE,KAAK,KAAK,EAAE,MAAM,YAAY,CAAC;AAC/C,OAAO,EACL,kBAAkB,EAClB,gCAAgC,EAChC,KAAK,iBAAiB,EACtB,KAAK,gBAAgB,EACrB,KAAK,iBAAiB,EACtB,KAAK,mBAAmB,GACzB,MAAM,oBAAoB,CAAC;AAE5B;;;;;GAKG;AACH,eAAO,MAAM,WAAW;;;;;CAGO,CAAC"}

package/dist/commonjs/index.js

@@ -1,6 +1,7 @@
 "use strict";
 Object.defineProperty(exports, "__esModule", { value: true });
-exports.toCfnNotificationWithSubscribers = exports.resolveSubscribers = exports.email = exports.createBudgetsTopicPolicies = exports.DEFAULT_BUDGET_CURRENCIES = exports.BUDGET_DEFAULTS = exports.createBudgetAlarmBuilder = exports.createBudgetBuilder = void 0;
+exports.constraints = exports.toCfnNotificationWithSubscribers = exports.resolveSubscribers = exports.email = exports.createBudgetsTopicPolicies = exports.DEFAULT_BUDGET_CURRENCIES = exports.BUDGET_DEFAULTS = exports.createBudgetAlarmBuilder = exports.createBudgetBuilder = void 0;
+const email_js_1 = require("./email.js");
 var budget_builder_js_1 = require("./budget-builder.js");
 Object.defineProperty(exports, "createBudgetBuilder", { enumerable: true, get: function () { return budget_builder_js_1.createBudgetBuilder; } });
 var budget_alarm_builder_js_1 = require("./budget-alarm-builder.js");
@@ -10,9 +11,19 @@ Object.defineProperty(exports, "BUDGET_DEFAULTS", { enumerable: true, get: funct
 Object.defineProperty(exports, "DEFAULT_BUDGET_CURRENCIES", { enumerable: true, get: function () { return defaults_js_1.DEFAULT_BUDGET_CURRENCIES; } });
 var topic_policy_js_1 = require("./topic-policy.js");
 Object.defineProperty(exports, "createBudgetsTopicPolicies", { enumerable: true, get: function () { return topic_policy_js_1.createBudgetsTopicPolicies; } });
-var email_js_1 = require("./email.js");
-Object.defineProperty(exports, "email", { enumerable: true, get: function () { return email_js_1.email; } });
+var email_js_2 = require("./email.js");
+Object.defineProperty(exports, "email", { enumerable: true, get: function () { return email_js_2.email; } });
 var notifications_js_1 = require("./notifications.js");
 Object.defineProperty(exports, "resolveSubscribers", { enumerable: true, get: function () { return notifications_js_1.resolveSubscribers; } });
 Object.defineProperty(exports, "toCfnNotificationWithSubscribers", { enumerable: true, get: function () { return notifications_js_1.toCfnNotificationWithSubscribers; } });
+/**
+ * This package's AWS-property constraints, grouped by application strategy.
+ * The `constraints.validate.*` / `constraints.sanitize.*` shape is identical in
+ * every builder package; the underlying constraint definition stays
+ * module-private — this namespace is its only public surface. See ADR-0010.
+ */
+exports.constraints = {
+    validate: { email: email_js_1.validateEmail },
+    sanitize: {},
+};
 //# sourceMappingURL=index.js.map

package/dist/commonjs/index.js.map

@@ -1 +1 @@
-{"version":3,"file":"index.js","sourceRoot":"","sources":["../../src/index.ts"],"names":[],"mappings":";;;AAAA,yDAM6B;AAL3B,wHAAA,mBAAmB,OAAA;AAMrB,qEAKmC;AAJjC,mIAAA,wBAAwB,OAAA;AAK1B,6CAA2E;AAAlE,8GAAA,eAAe,OAAA;AAAE,wHAAA,yBAAyB,OAAA;AAEnD,qDAA+D;AAAtD,6HAAA,0BAA0B,OAAA;AACnC,uCAA+C;AAAtC,iGAAA,KAAK,OAAA;AACd,uDAO4B;AAN1B,sHAAA,kBAAkB,OAAA;AAClB,oIAAA,gCAAgC,OAAA"}
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../../src/index.ts"],"names":[],"mappings":";;;AACA,yCAA2C;AAE3C,yDAM6B;AAL3B,wHAAA,mBAAmB,OAAA;AAMrB,qEAKmC;AAJjC,mIAAA,wBAAwB,OAAA;AAK1B,6CAA2E;AAAlE,8GAAA,eAAe,OAAA;AAAE,wHAAA,yBAAyB,OAAA;AAEnD,qDAA+D;AAAtD,6HAAA,0BAA0B,OAAA;AACnC,uCAA+C;AAAtC,iGAAA,KAAK,OAAA;AACd,uDAO4B;AAN1B,sHAAA,kBAAkB,OAAA;AAClB,oIAAA,gCAAgC,OAAA;AAOlC;;;;;GAKG;AACU,QAAA,WAAW,GAAG;IACzB,QAAQ,EAAE,EAAE,KAAK,EAAE,wBAAa,EAAE;IAClC,QAAQ,EAAE,EAAE;CACiB,CAAC"}

package/dist/esm/email.d.ts

@@ -9,19 +9,14 @@ declare const emailBrand: unique symbol;
 export type Email = string & {
     readonly [emailBrand]: true;
 };
+/** Validates a Budgets subscriber email against {@link EMAIL}. @throws on invalid input. */
+export declare function validateEmail(value: string): void;
 /**
- * Validates and brands a string as an {@link Email}.
+ * Validates and brands a string as an {@link Email}. Surrounding whitespace is
+ * trimmed before validation, so the branded value is exactly what AWS receives.
  *
- * The pattern intentionally errs on the side of acceptance — anything
- * obviously not an email (whitespace, missing `@`, missing TLD) is
- * rejected, but any address AWS Budgets will plausibly accept passes.
- * The 50-char cap matches the Budgets API's documented per-subscriber
- * limit.
- *
- * @throws If the input is empty, exceeds 50 characters, or doesn't
- * contain `local@domain.tld`.
- *
- * @see https://docs.aws.amazon.com/aws-cost-management/latest/APIReference/API_budgets_Subscriber.html
+ * @throws If the input exceeds 50 characters or is not of the form
+ * `local@domain.tld`.
  */
 export declare function email(input: string): Email;
 export {};

package/dist/esm/email.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"email.d.ts","sourceRoot":"","sources":["../../src/email.ts"],"names":[],"mappings":"AAAA,OAAO,CAAC,MAAM,UAAU,EAAE,OAAO,MAAM,CAAC;AAExC;;;;;;GAMG;AACH,MAAM,MAAM,KAAK,GAAG,MAAM,GAAG;IAAE,QAAQ,CAAC,CAAC,UAAU,CAAC,EAAE,IAAI,CAAA;CAAE,CAAC;AAK7D;;;;;;;;;;;;;GAaG;AACH,wBAAgB,KAAK,CAAC,KAAK,EAAE,MAAM,GAAG,KAAK,CAc1C"}
+{"version":3,"file":"email.d.ts","sourceRoot":"","sources":["../../src/email.ts"],"names":[],"mappings":"AAEA,OAAO,CAAC,MAAM,UAAU,EAAE,OAAO,MAAM,CAAC;AAExC;;;;;;GAMG;AACH,MAAM,MAAM,KAAK,GAAG,MAAM,GAAG;IAAE,QAAQ,CAAC,CAAC,UAAU,CAAC,EAAE,IAAI,CAAA;CAAE,CAAC;AAyB7D,4FAA4F;AAC5F,wBAAgB,aAAa,CAAC,KAAK,EAAE,MAAM,GAAG,IAAI,CAEjD;AAED;;;;;;GAMG;AACH,wBAAgB,KAAK,CAAC,KAAK,EAAE,MAAM,GAAG,KAAK,CAI1C"}

package/dist/esm/email.js

@@ -1,30 +1,39 @@
-const MAX_LEN = 50;
-const EMAIL_REGEX = /^[^\s@]+@[^\s@]+\.[^\s@]+$/;
+import { validateString } from "@composurecdk/cloudformation";
 /**
- * Validates and brands a string as an {@link Email}.
+ * The Budgets subscriber-email constraint. Email is a *format* rule rather than
+ * a character-class one, so it carries an explicit `pattern` instead of being
+ * built from `stringConstraint()`'s `charClass`. The pattern errs on the side
+ * of acceptance — anything obviously not an email (whitespace, missing `@`,
+ * missing TLD) is rejected, but any address AWS Budgets will plausibly accept
+ * passes. The 50-char cap matches the Budgets API's documented per-subscriber
+ * limit. See ADR-0010.
  *
- * The pattern intentionally errs on the side of acceptance — anything
- * obviously not an email (whitespace, missing `@`, missing TLD) is
- * rejected, but any address AWS Budgets will plausibly accept passes.
- * The 50-char cap matches the Budgets API's documented per-subscriber
- * limit.
- *
- * @throws If the input is empty, exceeds 50 characters, or doesn't
- * contain `local@domain.tld`.
+ * The domain is matched as dot-separated labels (`[^\s@.]+(\.[^\s@.]+)+`) rather
+ * than `[^\s@]+\.[^\s@]+`: excluding `.` from each label removes the overlapping
+ * quantifiers that make the latter a super-linear (ReDoS-prone) pattern, while
+ * accepting exactly the same addresses.
+ */
+const EMAIL = {
+    name: "Budgets subscriber email",
+    pattern: /^[^\s@]+@[^\s@.]+(?:\.[^\s@.]+)+$/,
+    maxLength: 50,
+    allowed: "an email address of the form local@domain.tld",
+    source: "https://docs.aws.amazon.com/aws-cost-management/latest/APIReference/API_budgets_Subscriber.html",
+};
+/** Validates a Budgets subscriber email against {@link EMAIL}. @throws on invalid input. */
+export function validateEmail(value) {
+    validateString(value, EMAIL);
+}
+/**
+ * Validates and brands a string as an {@link Email}. Surrounding whitespace is
+ * trimmed before validation, so the branded value is exactly what AWS receives.
  *
- * @see https://docs.aws.amazon.com/aws-cost-management/latest/APIReference/API_budgets_Subscriber.html
+ * @throws If the input exceeds 50 characters or is not of the form
+ * `local@domain.tld`.
  */
 export function email(input) {
     const trimmed = input.trim();
-    if (trimmed.length === 0) {
-        throw new Error("email cannot be empty");
-    }
-    if (trimmed.length > MAX_LEN) {
-        throw new Error(`email exceeds ${String(MAX_LEN)} chars (AWS Budgets per-subscriber limit): "${trimmed}"`);
-    }
-    if (!EMAIL_REGEX.test(trimmed)) {
-        throw new Error(`invalid email address: "${trimmed}"`);
-    }
+    validateEmail(trimmed);
     return trimmed;
 }
 //# sourceMappingURL=email.js.map

package/dist/esm/email.js.map

@@ -1 +1 @@
-{"version":3,"file":"email.js","sourceRoot":"","sources":["../../src/email.ts"],"names":[],"mappings":"AAWA,MAAM,OAAO,GAAG,EAAE,CAAC;AACnB,MAAM,WAAW,GAAG,4BAA4B,CAAC;AAEjD;;;;;;;;;;;;;GAaG;AACH,MAAM,UAAU,KAAK,CAAC,KAAa;IACjC,MAAM,OAAO,GAAG,KAAK,CAAC,IAAI,EAAE,CAAC;IAC7B,IAAI,OAAO,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QACzB,MAAM,IAAI,KAAK,CAAC,uBAAuB,CAAC,CAAC;IAC3C,CAAC;IACD,IAAI,OAAO,CAAC,MAAM,GAAG,OAAO,EAAE,CAAC;QAC7B,MAAM,IAAI,KAAK,CACb,iBAAiB,MAAM,CAAC,OAAO,CAAC,+CAA+C,OAAO,GAAG,CAC1F,CAAC;IACJ,CAAC;IACD,IAAI,CAAC,WAAW,CAAC,IAAI,CAAC,OAAO,CAAC,EAAE,CAAC;QAC/B,MAAM,IAAI,KAAK,CAAC,2BAA2B,OAAO,GAAG,CAAC,CAAC;IACzD,CAAC;IACD,OAAO,OAAgB,CAAC;AAC1B,CAAC"}
+{"version":3,"file":"email.js","sourceRoot":"","sources":["../../src/email.ts"],"names":[],"mappings":"AAAA,OAAO,EAAyB,cAAc,EAAE,MAAM,8BAA8B,CAAC;AAarF;;;;;;;;;;;;;GAaG;AACH,MAAM,KAAK,GAAqB;IAC9B,IAAI,EAAE,0BAA0B;IAChC,OAAO,EAAE,mCAAmC;IAC5C,SAAS,EAAE,EAAE;IACb,OAAO,EAAE,+CAA+C;IACxD,MAAM,EACJ,iGAAiG;CACpG,CAAC;AAEF,4FAA4F;AAC5F,MAAM,UAAU,aAAa,CAAC,KAAa;IACzC,cAAc,CAAC,KAAK,EAAE,KAAK,CAAC,CAAC;AAC/B,CAAC;AAED;;;;;;GAMG;AACH,MAAM,UAAU,KAAK,CAAC,KAAa;IACjC,MAAM,OAAO,GAAG,KAAK,CAAC,IAAI,EAAE,CAAC;IAC7B,aAAa,CAAC,OAAO,CAAC,CAAC;IACvB,OAAO,OAAgB,CAAC;AAC1B,CAAC"}

package/dist/esm/index.d.ts

@@ -1,3 +1,4 @@
+import { validateEmail } from "./email.js";
 export { createBudgetBuilder, type IBudgetBuilder, type BudgetBuilderProps, type BudgetBuilderResult, type BudgetLimit, } from "./budget-builder.js";
 export { createBudgetAlarmBuilder, type IBudgetAlarmBuilder, type BudgetAlarmBuilderProps, type BudgetAlarmBuilderResult, } from "./budget-alarm-builder.js";
 export { BUDGET_DEFAULTS, DEFAULT_BUDGET_CURRENCIES } from "./defaults.js";
@@ -5,4 +6,16 @@ export { type BudgetAlarmConfig, type EstimatedChargesAlarmConfig } from "./alar
 export { createBudgetsTopicPolicies } from "./topic-policy.js";
 export { email, type Email } from "./email.js";
 export { resolveSubscribers, toCfnNotificationWithSubscribers, type NotificationEntry, type NotificationType, type NotifySubscribers, type ResolvedSubscribers, } from "./notifications.js";
+/**
+ * This package's AWS-property constraints, grouped by application strategy.
+ * The `constraints.validate.*` / `constraints.sanitize.*` shape is identical in
+ * every builder package; the underlying constraint definition stays
+ * module-private — this namespace is its only public surface. See ADR-0010.
+ */
+export declare const constraints: {
+    validate: {
+        email: typeof validateEmail;
+    };
+    sanitize: {};
+};
 //# sourceMappingURL=index.d.ts.map

package/dist/esm/index.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../src/index.ts"],"names":[],"mappings":"AAAA,OAAO,EACL,mBAAmB,EACnB,KAAK,cAAc,EACnB,KAAK,kBAAkB,EACvB,KAAK,mBAAmB,EACxB,KAAK,WAAW,GACjB,MAAM,qBAAqB,CAAC;AAC7B,OAAO,EACL,wBAAwB,EACxB,KAAK,mBAAmB,EACxB,KAAK,uBAAuB,EAC5B,KAAK,wBAAwB,GAC9B,MAAM,2BAA2B,CAAC;AACnC,OAAO,EAAE,eAAe,EAAE,yBAAyB,EAAE,MAAM,eAAe,CAAC;AAC3E,OAAO,EAAE,KAAK,iBAAiB,EAAE,KAAK,2BAA2B,EAAE,MAAM,mBAAmB,CAAC;AAC7F,OAAO,EAAE,0BAA0B,EAAE,MAAM,mBAAmB,CAAC;AAC/D,OAAO,EAAE,KAAK,EAAE,KAAK,KAAK,EAAE,MAAM,YAAY,CAAC;AAC/C,OAAO,EACL,kBAAkB,EAClB,gCAAgC,EAChC,KAAK,iBAAiB,EACtB,KAAK,gBAAgB,EACrB,KAAK,iBAAiB,EACtB,KAAK,mBAAmB,GACzB,MAAM,oBAAoB,CAAC"}
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../src/index.ts"],"names":[],"mappings":"AACA,OAAO,EAAE,aAAa,EAAE,MAAM,YAAY,CAAC;AAE3C,OAAO,EACL,mBAAmB,EACnB,KAAK,cAAc,EACnB,KAAK,kBAAkB,EACvB,KAAK,mBAAmB,EACxB,KAAK,WAAW,GACjB,MAAM,qBAAqB,CAAC;AAC7B,OAAO,EACL,wBAAwB,EACxB,KAAK,mBAAmB,EACxB,KAAK,uBAAuB,EAC5B,KAAK,wBAAwB,GAC9B,MAAM,2BAA2B,CAAC;AACnC,OAAO,EAAE,eAAe,EAAE,yBAAyB,EAAE,MAAM,eAAe,CAAC;AAC3E,OAAO,EAAE,KAAK,iBAAiB,EAAE,KAAK,2BAA2B,EAAE,MAAM,mBAAmB,CAAC;AAC7F,OAAO,EAAE,0BAA0B,EAAE,MAAM,mBAAmB,CAAC;AAC/D,OAAO,EAAE,KAAK,EAAE,KAAK,KAAK,EAAE,MAAM,YAAY,CAAC;AAC/C,OAAO,EACL,kBAAkB,EAClB,gCAAgC,EAChC,KAAK,iBAAiB,EACtB,KAAK,gBAAgB,EACrB,KAAK,iBAAiB,EACtB,KAAK,mBAAmB,GACzB,MAAM,oBAAoB,CAAC;AAE5B;;;;;GAKG;AACH,eAAO,MAAM,WAAW;;;;;CAGO,CAAC"}

package/dist/esm/index.js

@@ -1,7 +1,18 @@
+import { validateEmail } from "./email.js";
 export { createBudgetBuilder, } from "./budget-builder.js";
 export { createBudgetAlarmBuilder, } from "./budget-alarm-builder.js";
 export { BUDGET_DEFAULTS, DEFAULT_BUDGET_CURRENCIES } from "./defaults.js";
 export { createBudgetsTopicPolicies } from "./topic-policy.js";
 export { email } from "./email.js";
 export { resolveSubscribers, toCfnNotificationWithSubscribers, } from "./notifications.js";
+/**
+ * This package's AWS-property constraints, grouped by application strategy.
+ * The `constraints.validate.*` / `constraints.sanitize.*` shape is identical in
+ * every builder package; the underlying constraint definition stays
+ * module-private — this namespace is its only public surface. See ADR-0010.
+ */
+export const constraints = {
+    validate: { email: validateEmail },
+    sanitize: {},
+};
 //# sourceMappingURL=index.js.map

package/dist/esm/index.js.map

@@ -1 +1 @@
-{"version":3,"file":"index.js","sourceRoot":"","sources":["../../src/index.ts"],"names":[],"mappings":"AAAA,OAAO,EACL,mBAAmB,GAKpB,MAAM,qBAAqB,CAAC;AAC7B,OAAO,EACL,wBAAwB,GAIzB,MAAM,2BAA2B,CAAC;AACnC,OAAO,EAAE,eAAe,EAAE,yBAAyB,EAAE,MAAM,eAAe,CAAC;AAE3E,OAAO,EAAE,0BAA0B,EAAE,MAAM,mBAAmB,CAAC;AAC/D,OAAO,EAAE,KAAK,EAAc,MAAM,YAAY,CAAC;AAC/C,OAAO,EACL,kBAAkB,EAClB,gCAAgC,GAKjC,MAAM,oBAAoB,CAAC"}
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../../src/index.ts"],"names":[],"mappings":"AACA,OAAO,EAAE,aAAa,EAAE,MAAM,YAAY,CAAC;AAE3C,OAAO,EACL,mBAAmB,GAKpB,MAAM,qBAAqB,CAAC;AAC7B,OAAO,EACL,wBAAwB,GAIzB,MAAM,2BAA2B,CAAC;AACnC,OAAO,EAAE,eAAe,EAAE,yBAAyB,EAAE,MAAM,eAAe,CAAC;AAE3E,OAAO,EAAE,0BAA0B,EAAE,MAAM,mBAAmB,CAAC;AAC/D,OAAO,EAAE,KAAK,EAAc,MAAM,YAAY,CAAC;AAC/C,OAAO,EACL,kBAAkB,EAClB,gCAAgC,GAKjC,MAAM,oBAAoB,CAAC;AAE5B;;;;;GAKG;AACH,MAAM,CAAC,MAAM,WAAW,GAAG;IACzB,QAAQ,EAAE,EAAE,KAAK,EAAE,aAAa,EAAE;IAClC,QAAQ,EAAE,EAAE;CACiB,CAAC"}

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@composurecdk/budgets",
-  "version": "0.8.3",
+  "version": "0.8.5",
   "description": "Composable AWS Budgets builder with well-architected defaults and automatic SNS topic policies",
   "repository": {
     "type": "git",
@@ -20,7 +20,17 @@
     "test": "vitest run --passWithNoTests",
     "test:watch": "vitest"
   },
-  "keywords": [],
+  "keywords": [
+    "aws",
+    "cdk",
+    "aws-cdk",
+    "infrastructure-as-code",
+    "iac",
+    "composurecdk",
+    "budgets",
+    "cost-management",
+    "billing"
+  ],
   "author": "Jason Duffett (https://github.com/laazyj)",
   "license": "MIT",
   "publishConfig": {
@@ -44,11 +54,11 @@
     "constructs": "^10.0.0"
   },
   "devDependencies": {
-    "@types/node": "^25.9.1",
-    "aws-cdk-lib": "^2.257.0",
+    "@types/node": "^25.9.3",
+    "aws-cdk-lib": "^2.258.1",
     "constructs": "^10.6.0",
     "typescript": "^6.0.3",
-    "vitest": "^4.1.7"
+    "vitest": "^4.1.8"
   },
   "exports": {
     "./package.json": "./package.json",