@fjall/generator 11.0.0 → 12.1.0

package/dist/.build-source-hash

@@ -9,7 +9,7 @@
     "package.json",
     "tsconfig.json"
   ],
-  "hash": "4a7dce9d3d88158a6cab7876ddb21a58014c0b56705d53a505940adbb00df8c6",
+  "hash": "fa029ff864130e5861fec3e0393668295eb9dd41ba4903c287d1c4969edf2289",
   "files": {
     "src/ast/astTestHelpers.ts": "026cac849eb88bdb",
     "src/ast/domain/astDomainParser.ts": "940ce5742507477d",
@@ -74,21 +74,22 @@
     "src/codemod/fileRewriter/parse.ts": "b12026c31562a13c",
     "src/codemod/fileRewriter/print.ts": "f5ff7afb5b7786bf",
     "src/codemod/historyPaths.ts": "ef8084013146db57",
-    "src/codemod/index.ts": "db90315eab333aab",
+    "src/codemod/index.ts": "b90c77ffc82e09df",
     "src/codemod/listResources.ts": "97f206a50edbea20",
     "src/codemod/llmFallback/apply.ts": "2e656a6e55b3b4e3",
-    "src/codemod/llmFallback/claudeTier.ts": "0a37fe782c85f75b",
-    "src/codemod/llmFallback/egressGate.ts": "2573dcf5b7a126a0",
-    "src/codemod/llmFallback/egressGate.types.ts": "15531dd497ae6135",
-    "src/codemod/llmFallback/index.ts": "b6c6cc8ef78d7887",
-    "src/codemod/llmFallback/morphTier.ts": "9551b6b63a1af561",
+    "src/codemod/llmFallback/claudeTier.ts": "ace3e3baa51383c9",
+    "src/codemod/llmFallback/egressGate.ts": "1b9076a5c51508fc",
+    "src/codemod/llmFallback/egressGate.types.ts": "e30947f12ee546ff",
+    "src/codemod/llmFallback/gateFallbackOutput.ts": "d61dc46527c566b8",
+    "src/codemod/llmFallback/index.ts": "d32779fa95df6b94",
+    "src/codemod/llmFallback/morphTier.ts": "adcc1cf280f9a65d",
     "src/codemod/llmFallback/prompt.ts": "60e8f4ab434bf9ec",
-    "src/codemod/llmFallback/runFallback.ts": "d3f1d1915aa56a23",
+    "src/codemod/llmFallback/runFallback.ts": "03880734d6c456af",
     "src/codemod/llmFallback/shouldTryFallback.ts": "df6038f97612b8ee",
     "src/codemod/llmFallback/signals.ts": "298bae6465b5f173",
-    "src/codemod/llmFallback/telemetryEvents.ts": "33a85939739693ab",
+    "src/codemod/llmFallback/telemetryEvents.ts": "827282cb185eea6c",
     "src/codemod/llmFallback/tierRunner.ts": "a26094accd78cf15",
-    "src/codemod/llmFallback/types.ts": "14af8d2bd9afae12",
+    "src/codemod/llmFallback/types.ts": "0b528ccbab7d48b8",
     "src/codemod/registry.ts": "fca9df965dd2d7ed",
     "src/codemod/semanticIndex/classifyControlFlow.ts": "ed96215d91a3cae3",
     "src/codemod/semanticIndex/findReferences.ts": "96aea37418d1e91a",
@@ -98,18 +99,18 @@
     "src/codemod/semanticIndex/projectCache.ts": "dfd9b265c9d233c9",
     "src/codemod/semanticIndex/resolveConstructByLiteralProperty.ts": "2d013a330af15c5c",
     "src/codemod/telemetry/errorKinds.ts": "66c736abfa8b3a67",
-    "src/codemod/types.ts": "0cd929df5bb46696",
+    "src/codemod/types.ts": "41a3d0a462f5fc86",
     "src/codemod/validationGate/gates/classify.ts": "3cba0ee8fe6d94d9",
     "src/codemod/validationGate/gates/drift.ts": "bd603a216fbb91a9",
     "src/codemod/validationGate/gates/locate.ts": "2c186c32edbb97ce",
     "src/codemod/validationGate/gates/parse.ts": "5433c5c8ffa35324",
     "src/codemod/validationGate/gates/schema.ts": "7ed5acaec0620a46",
-    "src/codemod/validationGate/index.ts": "df5754bea9070410",
+    "src/codemod/validationGate/index.ts": "47b475a621f5038a",
     "src/codemod/validationGate/types.ts": "af466ee5f3433042",
     "src/detection/index.ts": "b4ad9a935564cb3e",
     "src/dns/bindParser.ts": "376d274bf9e4bf9f",
     "src/dns/bindWriter.ts": "c296911ce5aef77c",
-    "src/dns/domainFileGenerator.ts": "83451c031d3ed79c",
+    "src/dns/domainFileGenerator.ts": "29ece83900ecc829",
     "src/dns/domainRecords.ts": "ab917006b92ae916",
     "src/dns/index.ts": "b476ef3d7b381dc8",
     "src/dns/types.ts": "82d6db9d7d26dbc2",
@@ -140,18 +141,18 @@
     "src/presets/patternTierPresets.ts": "f4fc368fc623aae4",
     "src/presets/storagePresets.ts": "5df2d4d7d21a66d8",
     "src/presets/tierPresets.ts": "c0148771bffbef9b",
-    "src/presets/tierTypes.ts": "96d33201ebddf6e6",
+    "src/presets/tierTypes.ts": "6526373876daacf0",
     "src/projection/index.ts": "f46e0e482bb33565",
     "src/projection/project.ts": "2104026f10a27264",
     "src/projection/tables.ts": "00904da382c06cf5",
     "src/projection/types.ts": "da0845cb34bfd12b",
-    "src/schemas/alarmSchemas.ts": "9016095d8031f006",
+    "src/schemas/alarmSchemas.ts": "a6f6ac07b2a102de",
     "src/schemas/applicationSchemas.ts": "d85771a4607cf2da",
     "src/schemas/baseSchemas.ts": "93d9bd1c0adfcaa0",
     "src/schemas/buildkiteSchemas.ts": "a28ec3b40f7851ec",
     "src/schemas/cdnSchemas.ts": "a982034c7903a31a",
     "src/schemas/computeSchemas.ts": "907747add0b1e1a9",
-    "src/schemas/constants.ts": "52cabac20382fbc9",
+    "src/schemas/constants.ts": "732a290de68e4ff8",
     "src/schemas/databaseSchemas.ts": "3c05f176e1aadb46",
     "src/schemas/devRolePolicies.ts": "6ca70fb20f5fbebc",
     "src/schemas/index.ts": "a1500a885048074b",
@@ -169,11 +170,11 @@
     "src/validation/patterns.ts": "f9629eafdad7ac3e",
     "src/validation/validationMessages.ts": "c727ade4690274f4",
     "src/validation/validationPatterns.ts": "865f3d688975b7c8",
-    "src/version.ts": "393ba013d8b49510",
+    "src/version.ts": "360d8be98d7f0b6a",
     "../scripts/minify-dist.mjs": "6b2e4b0df8aec601",
-    "package.json": "9dd018860d55f06d",
+    "package.json": "9e18c6eff5975fbc",
     "tsconfig.json": "1929cf3f99fe9b1e"
   },
-  "outputHash": "d253c353fb56d9d876097e673b86836353790cf9dbb7ffcaa7263e51c3fe244d",
-  "outputFileCount": 319
+  "outputHash": "a9bbc2ebb1234fd1a41c3f717b8df4d4c8cd124a457456bc05a573ff5eca0af2",
+  "outputFileCount": 321
 }

package/dist/.minified

@@ -1 +1 @@
-159 files minified at 2026-08-13T04:01:57.358Z
+160 files minified at 2026-08-15T06:01:40.068Z

package/dist/src/ast/astTestHelpers.d.ts

@@ -247,10 +247,10 @@ export declare function parseAndConvert(code: string): {
                 sourceText: string;
             }[] | undefined;
             alarms?: false | {
-                cpuThreshold?: number | undefined;
-                memoryThreshold?: number | undefined;
+                cpuThreshold?: number | false | undefined;
+                memoryThreshold?: number | false | undefined;
                 runningTasksMinimum?: number | undefined;
-                http5xxThreshold?: number | undefined;
+                http5xxThreshold?: number | false | undefined;
             } | undefined;
         }[] | undefined;
         docker?: {

package/dist/src/codemod/index.d.ts

@@ -21,5 +21,5 @@ export { evaluateEmitGuard, UNRESOLVED, type EmitGuardProperties, type EmitGuard
 export { CODEMOD_ERROR_KINDS } from "./telemetry/errorKinds.js";
 export type { CodemodErrorKind } from "./telemetry/errorKinds.js";
 export type { GateId } from "./validationGate/index.js";
-export { buildEgressBlockedEvent, buildFiredEvent, buildGateFailedEvent, buildGatePassedEvent, buildRejectedEvent, buildSucceededEvent, buildTimeoutEvent, estimateCostUsd, FALLBACK_EVENTS, GATE_EVENTS, PARSE_GATE, RUNTIME_GATE, runFallback, shouldTryFallback, type AnthropicClientProvider, type FallbackClients, type FallbackDecision, type FallbackEgressBlockedEvent, type FallbackGuardConfig, type FallbackInput, type FallbackIntent, type FallbackOp, type FallbackOutput, type FallbackTelemetry, type FallbackTelemetryEvent, type MorphClientProvider, type RunFallbackInput, type TelemetrySource, type TriggerReason, } from "./llmFallback/index.js";
+export { buildEgressBlockedEvent, buildFiredEvent, buildGateFailedEvent, buildGatePassedEvent, buildRejectedEvent, buildSucceededEvent, buildTimeoutEvent, estimateCostUsd, FALLBACK_EVENTS, GATE_EVENTS, gateFallbackOutput, PARSE_GATE, RUNTIME_GATE, runFallback, shouldTryFallback, UNATTRIBUTED_ORGANISATION, type AnthropicClientProvider, type AnthropicContentBlock, type AnthropicResponse, type EgressStage, type FallbackClients, type FallbackDecision, type FallbackEgressBlockedEvent, type FallbackGuardConfig, type FallbackInput, type FallbackIntent, type FallbackOp, type FallbackOutput, type FallbackTelemetry, type FallbackTelemetryEvent, type GateEventAction, type GateFallbackParams, type MorphClientProvider, type RunFallbackInput, type TelemetrySource, type TriggerReason, } from "./llmFallback/index.js";
 export type { AddOptions, CodemodError, CodemodSuccess, ControlFlowClassifierError, DriftConflictError, DriftUnmergeableError, DuplicateResourceError, EditOrchestratorSuccess, InvalidPropertyError, LinesChanged, LlmFallbackRejectedError, LlmFallbackTimeoutError, LlmFallbackTier, LlmFallbackUnsafeInputError, MissingAppInitError, ModifyOptions, NodeLocation, ParseError, PermissionError, ReferenceLocation, ReferencesRemainError, RemoveOptions, ResourceListing, ResourceListingEntry, ResourceName, ResourceNotFoundError, SemanticQueryError, StatementType, TemplateLiteralNameError, } from "./types.js";

package/dist/src/codemod/index.js

@@ -1 +1 @@
-import{addResource as o}from"./edits/addResource.js";import{removeResource as c}from"./edits/removeResource.js";import{modifyResource as m}from"./edits/modifyResource.js";import{appendAccountToStage as a}from"./edits/appendAccountToStage.js";import{setContainerSecrets as d}from"./edits/setContainerSecrets.js";import{connectResourceToCompute as i}from"./edits/connectResourceToCompute.js";import{addVpcPeer as f,modifyVpcPeer as u,removeVpcPeer as P}from"./edits/vpcPeer.js";import{addVpcPeerAccepter as R,modifyVpcPeerAccepter as T,removeVpcPeerAccepter as S}from"./edits/vpcPeerAccepter.js";import{addCrossPlanConnection as C,modifyCrossPlanConnection as A,removeCrossPlanConnection as V}from"./edits/crossPlanConnection.js";import{resolveDriftPolicy as y}from"./edits/driftPolicy.js";import{listResources as D}from"./listResources.js";import{resolveConstructByLiteralProperty as N}from"./semanticIndex/index.js";import{parse as F}from"./fileRewriter/parse.js";import{CrossPlanConnectionResourcePlanSchema as I,VpcPeerAccepterResourcePlanSchema as M,VpcPeerResourcePlanSchema as O}from"../schemas/index.js";import{detectDrift as k,mergeProperties as B,snapshotProperties as U}from"./drift/index.js";import{computeLinesDelta as Y}from"./_internal.js";import{ResourceNameSchema as q,StatementTypeSchema as w}from"./types.js";import{REGISTERED_STATEMENT_TYPES as H,STATEMENT_REGISTRY as J}from"./registry.js";import{evaluateEmitGuard as W,UNRESOLVED as X}from"./emitGuard.js";import{CODEMOD_ERROR_KINDS as $}from"./telemetry/errorKinds.js";import{buildEgressBlockedEvent as re,buildFiredEvent as oe,buildGateFailedEvent as te,buildGatePassedEvent as ce,buildRejectedEvent as pe,buildSucceededEvent as me,buildTimeoutEvent as se,estimateCostUsd as ae,FALLBACK_EVENTS as ne,GATE_EVENTS as de,PARSE_GATE as Ee,RUNTIME_GATE as ie,runFallback as le,shouldTryFallback as fe}from"./llmFallback/index.js";export{$ as CODEMOD_ERROR_KINDS,I as CrossPlanConnectionResourcePlanSchema,ne as FALLBACK_EVENTS,de as GATE_EVENTS,Ee as PARSE_GATE,H as REGISTERED_STATEMENT_TYPES,ie as RUNTIME_GATE,q as ResourceNameSchema,J as STATEMENT_REGISTRY,w as StatementTypeSchema,X as UNRESOLVED,M as VpcPeerAccepterResourcePlanSchema,O as VpcPeerResourcePlanSchema,C as addCrossPlanConnection,o as addResource,f as addVpcPeer,R as addVpcPeerAccepter,a as appendAccountToStage,re as buildEgressBlockedEvent,oe as buildFiredEvent,te as buildGateFailedEvent,ce as buildGatePassedEvent,pe as buildRejectedEvent,me as buildSucceededEvent,se as buildTimeoutEvent,Y as computeLinesDelta,i as connectResourceToCompute,k as detectDrift,ae as estimateCostUsd,W as evaluateEmitGuard,D as listResources,B as mergeProperties,A as modifyCrossPlanConnection,m as modifyResource,u as modifyVpcPeer,T as modifyVpcPeerAccepter,F as parse,V as removeCrossPlanConnection,c as removeResource,P as removeVpcPeer,S as removeVpcPeerAccepter,N as resolveConstructByLiteralProperty,y as resolveDriftPolicy,le as runFallback,d as setContainerSecrets,fe as shouldTryFallback,U as snapshotProperties};
+import{addResource as o}from"./edits/addResource.js";import{removeResource as c}from"./edits/removeResource.js";import{modifyResource as m}from"./edits/modifyResource.js";import{appendAccountToStage as s}from"./edits/appendAccountToStage.js";import{setContainerSecrets as E}from"./edits/setContainerSecrets.js";import{connectResourceToCompute as l}from"./edits/connectResourceToCompute.js";import{addVpcPeer as u,modifyVpcPeer as f,removeVpcPeer as T}from"./edits/vpcPeer.js";import{addVpcPeerAccepter as R,modifyVpcPeerAccepter as x,removeVpcPeerAccepter as S}from"./edits/vpcPeerAccepter.js";import{addCrossPlanConnection as v,modifyCrossPlanConnection as C,removeCrossPlanConnection as N}from"./edits/crossPlanConnection.js";import{resolveDriftPolicy as b}from"./edits/driftPolicy.js";import{listResources as y}from"./listResources.js";import{resolveConstructByLiteralProperty as G}from"./semanticIndex/index.js";import{parse as I}from"./fileRewriter/parse.js";import{CrossPlanConnectionResourcePlanSchema as F,VpcPeerAccepterResourcePlanSchema as L,VpcPeerResourcePlanSchema as U}from"../schemas/index.js";import{detectDrift as k,mergeProperties as B,snapshotProperties as M}from"./drift/index.js";import{computeLinesDelta as Y}from"./_internal.js";import{ResourceNameSchema as q,StatementTypeSchema as w}from"./types.js";import{REGISTERED_STATEMENT_TYPES as H,STATEMENT_REGISTRY as J}from"./registry.js";import{evaluateEmitGuard as W,UNRESOLVED as X}from"./emitGuard.js";import{CODEMOD_ERROR_KINDS as $}from"./telemetry/errorKinds.js";import{buildEgressBlockedEvent as re,buildFiredEvent as oe,buildGateFailedEvent as te,buildGatePassedEvent as ce,buildRejectedEvent as pe,buildSucceededEvent as me,buildTimeoutEvent as ae,estimateCostUsd as se,FALLBACK_EVENTS as ne,GATE_EVENTS as Ee,gateFallbackOutput as de,PARSE_GATE as le,RUNTIME_GATE as ie,runFallback as ue,shouldTryFallback as fe,UNATTRIBUTED_ORGANISATION as Te}from"./llmFallback/index.js";export{$ as CODEMOD_ERROR_KINDS,F as CrossPlanConnectionResourcePlanSchema,ne as FALLBACK_EVENTS,Ee as GATE_EVENTS,le as PARSE_GATE,H as REGISTERED_STATEMENT_TYPES,ie as RUNTIME_GATE,q as ResourceNameSchema,J as STATEMENT_REGISTRY,w as StatementTypeSchema,Te as UNATTRIBUTED_ORGANISATION,X as UNRESOLVED,L as VpcPeerAccepterResourcePlanSchema,U as VpcPeerResourcePlanSchema,v as addCrossPlanConnection,o as addResource,u as addVpcPeer,R as addVpcPeerAccepter,s as appendAccountToStage,re as buildEgressBlockedEvent,oe as buildFiredEvent,te as buildGateFailedEvent,ce as buildGatePassedEvent,pe as buildRejectedEvent,me as buildSucceededEvent,ae as buildTimeoutEvent,Y as computeLinesDelta,l as connectResourceToCompute,k as detectDrift,se as estimateCostUsd,W as evaluateEmitGuard,de as gateFallbackOutput,y as listResources,B as mergeProperties,C as modifyCrossPlanConnection,m as modifyResource,f as modifyVpcPeer,x as modifyVpcPeerAccepter,I as parse,N as removeCrossPlanConnection,c as removeResource,T as removeVpcPeer,S as removeVpcPeerAccepter,G as resolveConstructByLiteralProperty,b as resolveDriftPolicy,ue as runFallback,E as setContainerSecrets,fe as shouldTryFallback,M as snapshotProperties};

package/dist/src/codemod/llmFallback/claudeTier.js

@@ -1 +1 @@
-var k=Object.defineProperty;var p=(t,n)=>k(t,"name",{value:n,configurable:!0});import{gateEgress as d}from"./egressGate.js";import{buildPrompt as E}from"./prompt.js";import{applyStrReplaceOps as b}from"./apply.js";import{withTierTimeout as w}from"./tierRunner.js";import{PARSE_GATE as m}from"./types.js";const O=3e4,o="claude",f={name:"str_replace_based_edit_tool",type:"text_editor_20250728"};async function P(t,n){if(!t.orgAllowsFallback)return{state:"disabled",reason:"org-opt-out"};const s=d(t.content,o);if(s!==void 0)return s;const e=d(JSON.stringify(t.intent.properties),o);if(e!==void 0)return e;const{systemPrompt:i,userPrompt:c}=E({content:t.content,intent:t.intent,tier:o});return w(t.abortSignal,o,O,async({signal:_,started:g})=>{const a=await n.create({model:n.resolveModelId(),max_tokens:4096,system:i,messages:[{role:"user",content:c}],tools:[f],signal:_}),T=Date.now()-g,l=x(a.content);if(l.length===0)return{state:"rejected",tier:o,failedGate:m,diagnostics:"Model produced no str_replace operations"};const r=b(t.content,l);if(!r.success)return{state:"rejected",tier:o,failedGate:m,diagnostics:`Ambiguous str_replace at op ${r.error.opIndex}: "${r.error.old_str.slice(0,40)}\u2026" matched ${r.error.matchCount} times`};const u=d(r.data.content,o);if(u!==void 0)return u;const y={tier:o,elapsedMs:T,inputTokens:a.usage?.input_tokens??0,outputTokens:a.usage?.output_tokens??0,opsApplied:r.data.appliedCount};return{state:"applied",content:r.data.content,telemetry:y}})}p(P,"runClaudeTier");function x(t){const n=[];for(const s of t){if(s.type!=="tool_use"||s.name!==f.name)continue;const e=s.input;if(!("command"in e)||e.command!=="str_replace"||!("old_str"in e)||!("new_str"in e))continue;const i=e.old_str,c=e.new_str;typeof i!="string"||typeof c!="string"||n.push({old_str:i,new_str:c})}return n}p(x,"extractStrReplaceOps");export{f as TEXT_EDITOR_TOOL,P as runClaudeTier};
+var y=Object.defineProperty;var l=(t,r)=>y(t,"name",{value:r,configurable:!0});import{maskSensitiveOutput as S}from"@fjall/util";import{gateEgress as u}from"./egressGate.js";import{buildPrompt as E}from"./prompt.js";import{applyStrReplaceOps as O}from"./apply.js";import{withTierTimeout as b}from"./tierRunner.js";import{PARSE_GATE as d}from"./types.js";const M=3e4,e="claude",f={name:"str_replace_based_edit_tool",type:"text_editor_20250728"};async function C(t,r){if(!t.orgAllowsFallback)return{state:"disabled",reason:"org-opt-out"};const s=u(t.content,e,"input");if(s!==void 0)return s;const o=u(JSON.stringify(t.intent.properties),e,"input");if(o!==void 0)return o;const{systemPrompt:i,userPrompt:a}=E({content:t.content,intent:t.intent,tier:e});return b(t.abortSignal,e,M,async({signal:_,started:g})=>{const p=await r.create({model:r.resolveModelId(),max_tokens:4096,system:i,messages:[{role:"user",content:a}],tools:[f],signal:_}),T=Date.now()-g,c=w(p.content);if(c.length===0)return{state:"rejected",tier:e,failedGate:d,diagnostics:"Model produced no str_replace operations"};const n=O(t.content,c);if(!n.success){const k=S(n.error.old_str).slice(0,40);return{state:"rejected",tier:e,failedGate:d,diagnostics:`Ambiguous str_replace at op ${n.error.opIndex}: "${k}\u2026" matched ${n.error.matchCount} times`}}if(n.data.appliedCount===0)return{state:"rejected",tier:e,failedGate:d,diagnostics:`Model emitted ${String(c.length)} operation(s) but none matched the file`};if(n.data.content===t.content)return{state:"rejected",tier:e,failedGate:d,diagnostics:`Model emitted ${String(c.length)} operation(s) that left the file unchanged`};const m=u(n.data.content,e,"output");if(m!==void 0)return m;const h={tier:e,elapsedMs:T,inputTokens:p.usage?.input_tokens??0,outputTokens:p.usage?.output_tokens??0,opsApplied:n.data.appliedCount};return{state:"applied",content:n.data.content,telemetry:h}})}l(C,"runClaudeTier");function w(t){const r=[];for(const s of t){if(s.type!=="tool_use"||s.name!==f.name)continue;const o=s.input;if(!("command"in o)||o.command!=="str_replace"||!("old_str"in o)||!("new_str"in o))continue;const i=o.old_str,a=o.new_str;typeof i!="string"||typeof a!="string"||r.push({old_str:i,new_str:a})}return r}l(w,"extractStrReplaceOps");export{f as TEXT_EDITOR_TOOL,C as runClaudeTier};

package/dist/src/codemod/llmFallback/egressGate.d.ts

@@ -1,5 +1,5 @@
 import type { LlmFallbackTier } from "../types.js";
 import type { EgressGateResult } from "./egressGate.types.js";
-import type { FallbackOutput } from "./types.js";
+import type { EgressStage, FallbackOutput } from "./types.js";
 export declare function scanForEgressRisk(content: string): EgressGateResult;
-export declare function gateEgress(content: string, tier: LlmFallbackTier): FallbackOutput | undefined;
+export declare function gateEgress(content: string, tier: LlmFallbackTier, stage: EgressStage): FallbackOutput | undefined;

package/dist/src/codemod/llmFallback/egressGate.js

@@ -1 +1 @@
-var a=Object.defineProperty;var r=(t,n)=>a(t,"name",{value:n,configurable:!0});const h=32,u=4.5,f=8,_=/\barn:aws:[a-z0-9-]+:[a-z0-9-]*:[0-9]*:[^\s"']+/g,H=/(?<![A-Za-z0-9+/=_-])[A-Za-z0-9+/=_-]{32,}(?![A-Za-z0-9+/=_-])/g;function E(t){if(t.length===0)return 0;const n=new Map;for(const o of t)n.set(o,(n.get(o)??0)+1);let e=0;for(const o of n.values()){const s=o/t.length;e-=s*Math.log2(s)}return e}r(E,"shannonEntropy");function c(t){return t.length<=8?t:`${t.slice(0,8)}\u2026`}r(c,"truncateHint");function l(t){const n=[...t.matchAll(_)];if(n.length>0){const o=n[0]?.[0]??"";return{state:"block",reason:"arn-shape",count:n.length,sampleHint:c(o)}}const e=[];for(const o of t.matchAll(H)){const s=o[0]??"";s.length>=32&&E(s)>=4.5&&e.push(s)}return e.length>0?{state:"block",reason:"high-entropy",count:e.length,sampleHint:c(e[0]??"")}:{state:"pass"}}r(l,"scanForEgressRisk");function g(t,n){const e=l(t);if(e.state==="block")return{state:"egress-blocked",tier:n,reason:e.reason,count:e.count}}r(g,"gateEgress");export{g as gateEgress,l as scanForEgressRisk};
+var l=Object.defineProperty;var r=(t,e)=>l(t,"name",{value:e,configurable:!0});import{MASKED_VALUE_MARKER as c,maskSensitiveOutput as h}from"@fjall/util";const i=32,f=4.5,g=/\barn:aws[a-z-]*:[a-z0-9-]+:[a-z0-9-]*:[0-9]*:[^\s"']+/g,E=/(?<![A-Za-z0-9+/=_-])[A-Za-z0-9+/=_-]{32,}(?![A-Za-z0-9+/=_-])/g;function _(t){if(t.length===0)return 0;const e=new Map;for(const n of t)e.set(n,(e.get(n)??0)+1);let o=0;for(const n of e.values()){const s=n/t.length;o-=s*Math.log2(s)}return o}r(_,"shannonEntropy");function u(t,e){let o=0,n=0;for(;;){const s=t.indexOf(e,n);if(s===-1)break;o+=1,n=s+e.length}return o}r(u,"countOccurrences");function p(t){const e=[...t.matchAll(g)];if(e.length>0)return{state:"block",reason:"arn-shape",count:e.length};const o=h(t);if(o!==t){const s=u(o,c)-u(t,c);return{state:"block",reason:"credential-pattern",count:Math.max(1,s)}}const n=[];for(const s of t.matchAll(E)){const a=s[0]??"";a.length>=i&&_(a)>=f&&n.push(a)}return n.length>0?{state:"block",reason:"high-entropy",count:n.length}:{state:"pass"}}r(p,"scanForEgressRisk");function k(t,e,o){const n=p(t);if(n.state==="block")return{state:"egress-blocked",tier:e,reason:n.reason,count:n.count,stage:o}}r(k,"gateEgress");export{k as gateEgress,p as scanForEgressRisk};

package/dist/src/codemod/llmFallback/egressGate.types.d.ts

@@ -1,9 +1,10 @@
-export type EgressRiskReason = "high-entropy" | "arn-shape";
+/** Which egress scan fired: the pre-send input scan or the model-output scan. */
+export type EgressStage = "input" | "output";
+export type EgressRiskReason = "high-entropy" | "arn-shape" | "credential-pattern";
 export type EgressGateResult = {
     state: "pass";
 } | {
     state: "block";
     reason: EgressRiskReason;
     count: number;
-    sampleHint: string;
 };

package/dist/src/codemod/llmFallback/gateFallbackOutput.d.ts

@@ -0,0 +1,32 @@
+import type { ResourceSnapshot } from "../drift/index.js";
+import type { LlmFallbackTier } from "../types.js";
+import { type GateId } from "../validationGate/index.js";
+import type { FallbackIntent } from "./types.js";
+import type { FallbackOutput } from "./types.js";
+export type GateEventAction = "pass" | "fail";
+export interface GateFallbackParams {
+    /** The tier's applied content — the candidate for the write. */
+    outputContent: string;
+    /** The pre-fallback source the model was shown (classify gate's before-side). */
+    inputContent: string;
+    intent: FallbackIntent;
+    tier: LlmFallbackTier;
+    /**
+     * Drift baseline, threaded from the caller when it has one. Optional for
+     * parity with the deterministic path: absent ⇒ the drift gate is a
+     * vacuous proceed, exactly as `addResource`/`modifyResource` behave when
+     * called without a baseline context.
+     */
+    baseline?: ResourceSnapshot;
+    abortSignal?: AbortSignal;
+    onGateResult?: (gate: GateId, action: GateEventAction, durationMs: number) => void;
+}
+/**
+ * Run the validation-gate chain on applied fallback output.
+ *
+ * Returns `undefined` when every gate passes (the caller keeps the applied
+ * result), or a substitute `FallbackOutput` — "rejected" carrying the real
+ * failed gate id with diagnostics pre-masked at construction, or
+ * "cancelled" when the caller's abort signal fired between gates.
+ */
+export declare function gateFallbackOutput(params: GateFallbackParams): FallbackOutput | undefined;

package/dist/src/codemod/llmFallback/gateFallbackOutput.js

@@ -0,0 +1 @@
+var m=Object.defineProperty;var c=(e,t)=>m(e,"name",{value:t,configurable:!0});import{isDeepStrictEqual as $}from"node:util";import{maskSensitiveOutput as d}from"@fjall/util";import{STATEMENT_REGISTRY as h}from"../registry.js";import{classifyGate as l,createLocateGate as p,driftGate as G,parseGate as f,schemaGate as b}from"../validationGate/index.js";function D(e){const{intent:t,tier:i}=e;if(t.op==="add"&&h[t.type].addContract===void 0)return{state:"rejected",tier:i,failedGate:"schema",diagnostics:`LLM fallback cannot add a ${t.type}: its complete add contract is not yet declared. Nothing has been written.`};const g={type:t.type,name:t.name,properties:t.properties,op:t.op==="add"?"add":"modify"},y={content:e.outputContent,plan:g,inputContent:e.inputContent,...e.baseline!==void 0&&{baseline:e.baseline},...e.abortSignal!==void 0&&{signal:e.abortSignal}};for(const n of E(t.op)){if(e.abortSignal?.aborted===!0)return{state:"cancelled"};const u=Date.now();let a;try{a=n.run(y)}catch(o){return e.onGateResult?.(n.id,"fail",Date.now()-u),{state:"rejected",tier:i,failedGate:n.id,diagnostics:d(o instanceof Error?o.message:String(o))}}const s=Date.now()-u;if(!a.success)return e.onGateResult?.(n.id,"fail",s),{state:"rejected",tier:i,failedGate:n.id,diagnostics:d(S(a.error))};if(a.data.action==="reject")return e.onGateResult?.(n.id,"fail",s),{state:"rejected",tier:i,failedGate:a.data.failedGate??n.id,diagnostics:d(a.data.diagnostics??"gate rejected the output")};if(a.data.driftState!==void 0){const o=a.data.driftState.deltas.filter(r=>r.verdict==="clean"&&Object.hasOwn(t.properties,r.property)&&!$(r.theirs,r.ours)).map(r=>`\`${r.property}\``);if(o.length>0)return e.onGateResult?.(n.id,"fail",s),{state:"rejected",tier:i,failedGate:n.id,diagnostics:d(`output left requested ${o.length===1?"property":"properties"} at the baseline value: ${o.join(", ")}`)}}e.onGateResult?.(n.id,"pass",s)}}c(D,"gateFallbackOutput");function E(e){return e==="remove"?[f,l,p({mode:"absent"})]:[f,l,p({mode:"present"}),b,G]}c(E,"gatesForOp");function S(e){switch(e.kind){case"ParseError":return`output does not parse: ${e.message}`;case"ControlFlowClassifierError":return`output moved ${e.resource.type} "${e.resource.name}" out of top-level scope (${e.reason})`;case"ResourceNotFoundError":return`${e.type} "${e.name}" is missing from the output`;case"DuplicateResourceError":return`${e.type} "${e.name}" is still present in the output`;case"TemplateLiteralNameError":return`output names the resource with a template literal (line ${String(e.line)})`;case"InvalidPropertyError":return`property \`${e.property}\`: ${e.reason}`;case"DriftConflictError":{const t=e.deltas.filter(i=>i.verdict==="conflict").map(i=>`\`${i.property}\``).join(", ");return`output conflicts with the requested properties on ${e.resource.type} "${e.resource.name}"`+(t.length>0?` (${t})`:"")}case"SemanticQueryError":return`output could not be analysed: ${e.reason}`;default:return e.kind}}c(S,"describeGateError");export{D as gateFallbackOutput};

package/dist/src/codemod/llmFallback/index.d.ts

@@ -1,6 +1,7 @@
 export { runFallback, type FallbackClients, type RunFallbackInput, } from "./runFallback.js";
+export { gateFallbackOutput, type GateEventAction, type GateFallbackParams, } from "./gateFallbackOutput.js";
 export { shouldTryFallback, type FallbackDecision, type FallbackGuardConfig, } from "./shouldTryFallback.js";
-export { buildEgressBlockedEvent, buildFiredEvent, buildGateFailedEvent, buildGatePassedEvent, buildRejectedEvent, buildSucceededEvent, buildTimeoutEvent, estimateCostUsd, FALLBACK_EVENTS, GATE_EVENTS, type FallbackEgressBlockedEvent, type FallbackFiredEvent, type FallbackRejectedEvent, type FallbackSucceededEvent, type FallbackTelemetryEvent, type FallbackTimeoutEvent, type GateFailedEvent, type GatePassedEvent, type TelemetrySource, } from "./telemetryEvents.js";
+export { buildEgressBlockedEvent, buildFiredEvent, buildGateFailedEvent, buildGatePassedEvent, buildRejectedEvent, buildSucceededEvent, buildTimeoutEvent, estimateCostUsd, FALLBACK_EVENTS, GATE_EVENTS, UNATTRIBUTED_ORGANISATION, type FallbackEgressBlockedEvent, type FallbackFiredEvent, type FallbackRejectedEvent, type FallbackSucceededEvent, type FallbackTelemetryEvent, type FallbackTimeoutEvent, type GateFailedEvent, type GatePassedEvent, type TelemetrySource, } from "./telemetryEvents.js";
 export { PARSE_GATE, RUNTIME_GATE } from "./types.js";
-export type { AnthropicClientProvider, AnthropicContentBlock, AnthropicResponse, ApplyResult, FallbackInput, FallbackIntent, FallbackOp, FallbackOutput, FallbackTelemetry, MorphClientProvider, MorphResponse, StrReplaceOp, TriggerReason, } from "./types.js";
+export type { AnthropicClientProvider, AnthropicContentBlock, AnthropicResponse, ApplyResult, EgressStage, FallbackInput, FallbackIntent, FallbackOp, FallbackOutput, FallbackTelemetry, MorphClientProvider, MorphResponse, StrReplaceOp, TriggerReason, } from "./types.js";
 export type { EgressGateResult, EgressRiskReason } from "./egressGate.types.js";

package/dist/src/codemod/llmFallback/index.js

@@ -1 +1 @@
-import{runFallback as E}from"./runFallback.js";import{shouldTryFallback as l}from"./shouldTryFallback.js";import{buildEgressBlockedEvent as r,buildFiredEvent as i,buildGateFailedEvent as u,buildGatePassedEvent as a,buildRejectedEvent as b,buildSucceededEvent as n,buildTimeoutEvent as s,estimateCostUsd as T,FALLBACK_EVENTS as v,GATE_EVENTS as c}from"./telemetryEvents.js";import{PARSE_GATE as A,RUNTIME_GATE as F}from"./types.js";export{v as FALLBACK_EVENTS,c as GATE_EVENTS,A as PARSE_GATE,F as RUNTIME_GATE,r as buildEgressBlockedEvent,i as buildFiredEvent,u as buildGateFailedEvent,a as buildGatePassedEvent,b as buildRejectedEvent,n as buildSucceededEvent,s as buildTimeoutEvent,T as estimateCostUsd,E as runFallback,l as shouldTryFallback};
+import{runFallback as E}from"./runFallback.js";import{gateFallbackOutput as l}from"./gateFallbackOutput.js";import{shouldTryFallback as r}from"./shouldTryFallback.js";import{buildEgressBlockedEvent as a,buildFiredEvent as T,buildGateFailedEvent as i,buildGatePassedEvent as b,buildRejectedEvent as A,buildSucceededEvent as n,buildTimeoutEvent as s,estimateCostUsd as c,FALLBACK_EVENTS as m,GATE_EVENTS as v,UNATTRIBUTED_ORGANISATION as p}from"./telemetryEvents.js";import{PARSE_GATE as G,RUNTIME_GATE as N}from"./types.js";export{m as FALLBACK_EVENTS,v as GATE_EVENTS,G as PARSE_GATE,N as RUNTIME_GATE,p as UNATTRIBUTED_ORGANISATION,a as buildEgressBlockedEvent,T as buildFiredEvent,i as buildGateFailedEvent,b as buildGatePassedEvent,A as buildRejectedEvent,n as buildSucceededEvent,s as buildTimeoutEvent,c as estimateCostUsd,l as gateFallbackOutput,E as runFallback,r as shouldTryFallback};

package/dist/src/codemod/llmFallback/morphTier.js

@@ -1,3 +1,3 @@
-var m=Object.defineProperty;var c=(e,o)=>m(e,"name",{value:o,configurable:!0});import{gateEgress as r}from"./egressGate.js";import{buildPrompt as T}from"./prompt.js";import{withTierTimeout as k}from"./tierRunner.js";import{PARSE_GATE as E}from"./types.js";const b=15e3,t="morph";async function _(e,o){if(!e.orgAllowsFallback)return{state:"disabled",reason:"org-opt-out"};if(!o.isAvailable())return{state:"disabled",reason:"env-flag"};const s=r(e.content,t);if(s!==void 0)return s;const i=r(JSON.stringify(e.intent.properties),t);if(i!==void 0)return i;const{systemPrompt:p,userPrompt:u}=T({content:e.content,intent:e.intent,tier:t});return k(e.abortSignal,t,b,async({signal:l,started:d})=>{const n=await o.apply({originalFile:e.content,update:`${p}
+var m=Object.defineProperty;var c=(t,o)=>m(t,"name",{value:o,configurable:!0});import{gateEgress as r}from"./egressGate.js";import{buildPrompt as T}from"./prompt.js";import{withTierTimeout as k}from"./tierRunner.js";import{PARSE_GATE as E}from"./types.js";const b=15e3,e="morph";async function _(t,o){if(!t.orgAllowsFallback)return{state:"disabled",reason:"org-opt-out"};if(!o.isAvailable())return{state:"disabled",reason:"env-flag"};const s=r(t.content,e,"input");if(s!==void 0)return s;const i=r(JSON.stringify(t.intent.properties),e,"input");if(i!==void 0)return i;const{systemPrompt:p,userPrompt:u}=T({content:t.content,intent:t.intent,tier:e});return k(t.abortSignal,e,b,async({signal:l,started:d})=>{const n=await o.apply({originalFile:t.content,update:`${p}
 
-${u}`,signal:l}),f=Date.now()-d;if(n.content===e.content)return{state:"rejected",tier:t,failedGate:E,diagnostics:"Morph returned unchanged content"};const a=r(n.content,t);if(a!==void 0)return a;const g={tier:t,elapsedMs:f,inputTokens:n.usage?.inputTokens??0,outputTokens:n.usage?.outputTokens??0,opsApplied:1};return{state:"applied",content:n.content,telemetry:g}})}c(_,"runMorphTier");export{_ as runMorphTier};
+${u}`,signal:l}),f=Date.now()-d;if(n.content===t.content)return{state:"rejected",tier:e,failedGate:E,diagnostics:"Morph returned unchanged content"};const a=r(n.content,e,"output");if(a!==void 0)return a;const g={tier:e,elapsedMs:f,inputTokens:n.usage?.inputTokens??0,outputTokens:n.usage?.outputTokens??0,opsApplied:1};return{state:"applied",content:n.content,telemetry:g}})}c(_,"runMorphTier");export{_ as runMorphTier};

package/dist/src/codemod/llmFallback/runFallback.d.ts

@@ -1,4 +1,7 @@
-import type { AnthropicClientProvider, FallbackInput, FallbackOutput, MorphClientProvider } from "./types.js";
+import type { ResourceSnapshot } from "../drift/index.js";
+import type { GateId } from "../validationGate/types.js";
+import { type GateEventAction } from "./gateFallbackOutput.js";
+import { type AnthropicClientProvider, type FallbackInput, type FallbackOutput, type MorphClientProvider } from "./types.js";
 export interface FallbackClients {
     claude: AnthropicClientProvider;
     morph?: MorphClientProvider;
@@ -9,5 +12,13 @@ export interface RunFallbackInput {
     orgAllowsFallback: boolean;
     morphTierEnabled: boolean;
     abortSignal?: AbortSignal;
+    /**
+     * Drift baseline for the post-apply gate run. Optional — absent means the
+     * drift gate proceeds vacuously, matching the deterministic edit path when
+     * called without a baseline context.
+     */
+    baseline?: ResourceSnapshot;
+    /** Per-gate observability hook for the post-apply validation chain. */
+    onGateResult?: (gate: GateId, action: GateEventAction, durationMs: number) => void;
 }
 export declare function runFallback(input: RunFallbackInput, clients: FallbackClients): Promise<FallbackOutput>;

package/dist/src/codemod/llmFallback/runFallback.js

@@ -1 +1 @@
-var a=Object.defineProperty;var o=(r,e)=>a(r,"name",{value:e,configurable:!0});import{runClaudeTier as l}from"./claudeTier.js";import{runMorphTier as i}from"./morphTier.js";function n(r,e){return{content:r.content,intent:r.intent,tier:e,orgAllowsFallback:r.orgAllowsFallback,abortSignal:r.abortSignal}}o(n,"buildTierInput");async function d(r,e){const t=await l(n(r,"claude"),e.claude);return!(t.state==="rejected"||t.state==="timeout")||!r.morphTierEnabled||e.morph===void 0?t:i(n(r,"morph"),e.morph)}o(d,"runFallback");export{d as runFallback};
+var c=Object.defineProperty;var a=(e,t)=>c(e,"name",{value:t,configurable:!0});import{maskSensitiveOutput as s}from"@fjall/util";import{runClaudeTier as d}from"./claudeTier.js";import{gateFallbackOutput as u}from"./gateFallbackOutput.js";import{runMorphTier as b}from"./morphTier.js";import{RUNTIME_GATE as f}from"./types.js";function l(e,t){return{content:e.content,intent:e.intent,tier:t,orgAllowsFallback:e.orgAllowsFallback,abortSignal:e.abortSignal}}a(l,"buildTierInput");async function i(e,t,n){try{const r=await n();return r.state!=="applied"?r:u({outputContent:r.content,inputContent:e.content,intent:e.intent,tier:t,...e.baseline!==void 0&&{baseline:e.baseline},...e.abortSignal!==void 0&&{abortSignal:e.abortSignal},...e.onGateResult!==void 0&&{onGateResult:e.onGateResult}})??r}catch(r){return e.abortSignal?.aborted===!0?{state:"cancelled"}:{state:"rejected",tier:t,failedGate:f,diagnostics:s(r instanceof Error?r.message:String(r))}}}a(i,"runGatedTier");async function G(e,t){const n=await i(e,"claude",()=>d(l(e,"claude"),t.claude));if(!(n.state==="rejected"||n.state==="timeout"))return n;const o=t.morph;return!e.morphTierEnabled||o===void 0?n:i(e,"morph",()=>b(l(e,"morph"),o))}a(G,"runFallback");export{G as runFallback};

package/dist/src/codemod/llmFallback/telemetryEvents.d.ts

@@ -1,5 +1,5 @@
 import type { GateId } from "../validationGate/types.js";
-import type { FallbackOp, FallbackTelemetry, TriggerReason } from "./types.js";
+import type { EgressStage, FallbackOp, FallbackTelemetry, TriggerReason } from "./types.js";
 import type { EgressRiskReason } from "./egressGate.types.js";
 import type { LlmFallbackTier } from "../types.js";
 export declare const FALLBACK_EVENTS: {
@@ -13,6 +13,13 @@ export declare const GATE_EVENTS: {
     readonly PASSED: "codemod.gate.passed";
     readonly FAILED: "codemod.gate.failed";
 };
+/**
+ * Sentinel for events emitted before an organisation identity is resolved.
+ * Coupled value at 2+ consumers (CLI + webapp emitters): analytics forks
+ * silently if the spellings diverge, so import this — never inline the
+ * literal.
+ */
+export declare const UNATTRIBUTED_ORGANISATION = "unknown";
 export type TelemetrySource = "cli" | "webapp_service" | "webapp_api" | "webapp_ui" | "mcp";
 export interface FallbackFiredEvent {
     event: typeof FALLBACK_EVENTS.FIRED;
@@ -64,6 +71,7 @@ export interface FallbackEgressBlockedEvent {
         tier: LlmFallbackTier;
         reason: EgressRiskReason;
         count: number;
+        stage: EgressStage;
         organisationId: string;
     };
 }
@@ -123,6 +131,7 @@ export declare function buildEgressBlockedEvent(params: {
     tier: LlmFallbackTier;
     reason: EgressRiskReason;
     count: number;
+    stage: EgressStage;
     organisationId: string;
 }): FallbackEgressBlockedEvent;
 export declare function buildGatePassedEvent(params: {

package/dist/src/codemod/llmFallback/telemetryEvents.js

@@ -1 +1 @@
-var d=Object.defineProperty;var t=(e,n)=>d(e,"name",{value:n,configurable:!0});const o={FIRED:"codemod.llm_fallback.fired",SUCCEEDED:"codemod.llm_fallback.succeeded",REJECTED:"codemod.llm_fallback.rejected",TIMEOUT:"codemod.llm_fallback.timeout",EGRESS_BLOCKED:"codemod.llm_fallback.egress_blocked"},r={PASSED:"codemod.gate.passed",FAILED:"codemod.gate.failed"},i=3/1e6,u=15/1e6;function c(e){if(e.tier!=="claude")return 0;const n=e.inputTokens*i,E=e.outputTokens*u;return Math.round((n+E)*1e6)/1e6}t(c,"estimateCostUsd");function s(e){return{event:o.FIRED,properties:e}}t(s,"buildFiredEvent");function p(e){return{event:o.SUCCEEDED,properties:{source:e.source,operation:e.operation,tier:e.telemetry.tier,durationMs:e.telemetry.elapsedMs,estimatedCostUsd:c(e.telemetry),organisationId:e.organisationId}}}t(p,"buildSucceededEvent");function _(e){return{event:o.REJECTED,properties:e}}t(_,"buildRejectedEvent");function a(e){return{event:o.TIMEOUT,properties:e}}t(a,"buildTimeoutEvent");function T(e){return{event:o.EGRESS_BLOCKED,properties:e}}t(T,"buildEgressBlockedEvent");function f(e){return{event:r.PASSED,properties:e}}t(f,"buildGatePassedEvent");function D(e){return{event:r.FAILED,properties:e}}t(D,"buildGateFailedEvent");export{o as FALLBACK_EVENTS,r as GATE_EVENTS,T as buildEgressBlockedEvent,s as buildFiredEvent,D as buildGateFailedEvent,f as buildGatePassedEvent,_ as buildRejectedEvent,p as buildSucceededEvent,a as buildTimeoutEvent,c as estimateCostUsd};
+var d=Object.defineProperty;var t=(e,n)=>d(e,"name",{value:n,configurable:!0});const o={FIRED:"codemod.llm_fallback.fired",SUCCEEDED:"codemod.llm_fallback.succeeded",REJECTED:"codemod.llm_fallback.rejected",TIMEOUT:"codemod.llm_fallback.timeout",EGRESS_BLOCKED:"codemod.llm_fallback.egress_blocked"},r={PASSED:"codemod.gate.passed",FAILED:"codemod.gate.failed"},s="unknown",i=3/1e6,u=15/1e6;function c(e){if(e.tier!=="claude")return 0;const n=e.inputTokens*i,E=e.outputTokens*u;return Math.round((n+E)*1e6)/1e6}t(c,"estimateCostUsd");function p(e){return{event:o.FIRED,properties:e}}t(p,"buildFiredEvent");function _(e){return{event:o.SUCCEEDED,properties:{source:e.source,operation:e.operation,tier:e.telemetry.tier,durationMs:e.telemetry.elapsedMs,estimatedCostUsd:c(e.telemetry),organisationId:e.organisationId}}}t(_,"buildSucceededEvent");function T(e){return{event:o.REJECTED,properties:e}}t(T,"buildRejectedEvent");function a(e){return{event:o.TIMEOUT,properties:e}}t(a,"buildTimeoutEvent");function D(e){return{event:o.EGRESS_BLOCKED,properties:e}}t(D,"buildEgressBlockedEvent");function f(e){return{event:r.PASSED,properties:e}}t(f,"buildGatePassedEvent");function C(e){return{event:r.FAILED,properties:e}}t(C,"buildGateFailedEvent");export{o as FALLBACK_EVENTS,r as GATE_EVENTS,s as UNATTRIBUTED_ORGANISATION,D as buildEgressBlockedEvent,p as buildFiredEvent,C as buildGateFailedEvent,f as buildGatePassedEvent,T as buildRejectedEvent,_ as buildSucceededEvent,a as buildTimeoutEvent,c as estimateCostUsd};

package/dist/src/codemod/llmFallback/types.d.ts

@@ -1,6 +1,7 @@
 import type { StatementType, ResourceName, LlmFallbackTier } from "../types.js";
 import type { GateId } from "../validationGate/types.js";
-import type { EgressRiskReason } from "./egressGate.types.js";
+import type { EgressRiskReason, EgressStage } from "./egressGate.types.js";
+export type { EgressStage } from "./egressGate.types.js";
 export declare const PARSE_GATE: GateId;
 export declare const RUNTIME_GATE: GateId;
 export type FallbackOp = "add" | "modify" | "remove" | "resolve-drift-merge";
@@ -17,6 +18,12 @@ export interface FallbackInput {
     orgAllowsFallback: boolean;
     abortSignal?: AbortSignal;
 }
+/**
+ * `rejected.diagnostics` is pre-masked at construction — every construction
+ * site (tier rejections, `tierRunner` throw containment, `gateFallbackOutput`)
+ * routes dynamic content through `maskSensitiveOutput`. Consumers MUST NOT
+ * re-mask (security-standards § "One mask per output path").
+ */
 export type FallbackOutput = {
     state: "applied";
     content: string;
@@ -26,6 +33,7 @@ export type FallbackOutput = {
     tier: LlmFallbackTier;
     reason: EgressRiskReason;
     count: number;
+    stage: EgressStage;
 } | {
     state: "timeout";
     tier: LlmFallbackTier;

package/dist/src/codemod/types.d.ts

@@ -1,7 +1,7 @@
 import { z } from "zod";
 import { ResourceNameSchema } from "../schemas/baseSchemas.js";
 import type { GateId } from "./validationGate/types.js";
-import type { EgressRiskReason } from "./llmFallback/egressGate.types.js";
+import type { EgressRiskReason, EgressStage } from "./llmFallback/egressGate.types.js";
 export declare const DriftPolicySchema: z.ZodObject<{
     force: z.ZodOptional<z.ZodBoolean>;
     resolutionMap: z.ZodOptional<z.ZodRecord<z.ZodString, z.ZodUnknown>>;
@@ -301,6 +301,12 @@ export interface ControlFlowClassifierError {
     remediation?: string;
 }
 export type LlmFallbackTier = "claude" | "morph";
+/**
+ * `diagnostics` is pre-masked at construction — the generator's tier
+ * rejections, throw containment and gate-chain rejections all route dynamic
+ * content through `maskSensitiveOutput` before it lands here (see
+ * `llmFallback/types.ts` § FallbackOutput). Consumers MUST NOT re-mask.
+ */
 export interface LlmFallbackRejectedError {
     kind: "LlmFallbackRejectedError";
     tier: LlmFallbackTier;
@@ -316,5 +322,7 @@ export interface LlmFallbackUnsafeInputError {
     kind: "LlmFallbackUnsafeInputError";
     reason: EgressRiskReason;
     count: number;
+    /** Which egress scan fired — the pre-send input scan or the model-output scan. */
+    stage: EgressStage;
 }
 export type CodemodError = ParseError | TemplateLiteralNameError | DuplicateResourceError | ResourceNotFoundError | ReferencesRemainError | InvalidPropertyError | SemanticQueryError | MissingAppInitError | DriftConflictError | DriftUnmergeableError | PermissionError | ControlFlowClassifierError | LlmFallbackRejectedError | LlmFallbackTimeoutError | LlmFallbackUnsafeInputError;

package/dist/src/codemod/validationGate/index.d.ts

@@ -2,5 +2,5 @@ export { runPipeline, runPipelineAsync, type AsyncGate, type Gate, type GateActi
 export { driftGate } from "./gates/drift.js";
 export { schemaGate } from "./gates/schema.js";
 export { parseGate } from "./gates/parse.js";
-export { locateGate } from "./gates/locate.js";
+export { createLocateGate, locateGate, type LocateGateOptions, type LocateMode, } from "./gates/locate.js";
 export { classifyGate } from "./gates/classify.js";

package/dist/src/codemod/validationGate/index.js

@@ -1 +1 @@
-import{runPipeline as o,runPipelineAsync as t}from"./types.js";import{driftGate as p}from"./gates/drift.js";import{schemaGate as m}from"./gates/schema.js";import{parseGate as x}from"./gates/parse.js";import{locateGate as s}from"./gates/locate.js";import{classifyGate as c}from"./gates/classify.js";export{c as classifyGate,p as driftGate,s as locateGate,x as parseGate,o as runPipeline,t as runPipelineAsync,m as schemaGate};
+import{runPipeline as t,runPipelineAsync as o}from"./types.js";import{driftGate as p}from"./gates/drift.js";import{schemaGate as m}from"./gates/schema.js";import{parseGate as i}from"./gates/parse.js";import{createLocateGate as G,locateGate as n}from"./gates/locate.js";import{classifyGate as l}from"./gates/classify.js";export{l as classifyGate,G as createLocateGate,p as driftGate,n as locateGate,i as parseGate,t as runPipeline,o as runPipelineAsync,m as schemaGate};

package/dist/src/dns/domainFileGenerator.js

@@ -24,7 +24,7 @@ ${l}  certificates: [
   ],
   records: ${d},
 });
-`}r(k,"generateDefaultInfrastructureTs");function g(t){return JSON.stringify({name:`domain-${t}`,version:u,scripts:{},devDependencies:{"@types/node":"20.4.9","ts-node":"^10.9.1",typescript:"~5.1.6"},dependencies:{"@fjall/components-infrastructure":`^${u}`,"aws-cdk-lib":"^2.263.0",constructs:"^10.7.2"}},null,2)+`
+`}r(k,"generateDefaultInfrastructureTs");function g(t){return JSON.stringify({name:`domain-${t}`,version:u,scripts:{},devDependencies:{"@types/node":"20.4.9","ts-node":"^10.9.1",typescript:"~5.1.6"},dependencies:{"@fjall/components-infrastructure":`^${u}`,"aws-cdk-lib":"^2.265.0",constructs:"^10.7.2"}},null,2)+`
 `}r(g,"generateDomainPackageJson");const y=`node_modules/
 cdk.out/
 *.d.ts

package/dist/src/presets/tierTypes.d.ts

@@ -109,7 +109,7 @@ export interface DatabaseTierPreset {
  * Only applies when capacityProvider is "EC2".
  */
 export interface TierEc2CapacityConfig {
-    /** EC2 instance type. Default: "t4g.micro" */
+    /** EC2 instance type. Default: "t4g.small" (the constructs' ECS EC2 default) */
     instanceType?: string;
     /** AMI hardware type. Default: "ARM" for cost efficiency */
     amiHardwareType?: "ARM" | "STANDARD";

package/dist/src/schemas/alarmSchemas.d.ts

@@ -1,9 +1,9 @@
 import { z } from "zod";
 export declare const EcsServiceAlarmConfigSchema: z.ZodUnion<readonly [z.ZodLiteral<false>, z.ZodObject<{
-    cpuThreshold: z.ZodOptional<z.ZodNumber>;
-    memoryThreshold: z.ZodOptional<z.ZodNumber>;
+    cpuThreshold: z.ZodOptional<z.ZodUnion<readonly [z.ZodNumber, z.ZodLiteral<false>]>>;
+    memoryThreshold: z.ZodOptional<z.ZodUnion<readonly [z.ZodNumber, z.ZodLiteral<false>]>>;
     runningTasksMinimum: z.ZodOptional<z.ZodNumber>;
-    http5xxThreshold: z.ZodOptional<z.ZodNumber>;
+    http5xxThreshold: z.ZodOptional<z.ZodUnion<readonly [z.ZodNumber, z.ZodLiteral<false>]>>;
 }, z.core.$strict>]>;
 export declare const RdsAlarmConfigSchema: z.ZodUnion<readonly [z.ZodLiteral<false>, z.ZodObject<{
     cpuThreshold: z.ZodOptional<z.ZodNumber>;

package/dist/src/schemas/alarmSchemas.js

@@ -1 +1 @@
-import{z as o}from"zod";import{VALIDATION_MESSAGES as n}from"../validation/patterns.js";const e=o.number().min(1,n.ALARM.PERCENTAGE.MIN).max(100,n.ALARM.PERCENTAGE.MAX),r=o.number().min(1,n.ALARM.FREE_STORAGE_GIB.MIN),a=o.union([o.literal(!1),o.object({cpuThreshold:e.optional(),memoryThreshold:e.optional(),runningTasksMinimum:o.number().int().min(0).optional(),http5xxThreshold:e.optional()}).strict()]),l=o.union([o.literal(!1),o.object({cpuThreshold:e.optional(),freeStorageThresholdGiB:r.optional(),connectionsThreshold:o.number().int().min(1).optional()}).strict()]),h=o.union([o.literal(!1),o.object({errorRateThreshold:e.optional(),durationThresholdPercent:e.optional()}).strict()]);export{a as EcsServiceAlarmConfigSchema,h as LambdaAlarmConfigSchema,l as RdsAlarmConfigSchema};
+import{z as o}from"zod";import{VALIDATION_MESSAGES as n}from"../validation/patterns.js";const e=o.number().min(1,n.ALARM.PERCENTAGE.MIN).max(100,n.ALARM.PERCENTAGE.MAX),r=o.union([e,o.literal(!1)]),t=o.number().min(1,n.ALARM.FREE_STORAGE_GIB.MIN),l=o.union([o.literal(!1),o.object({cpuThreshold:r.optional(),memoryThreshold:r.optional(),runningTasksMinimum:o.number().int().min(0).optional(),http5xxThreshold:r.optional()}).strict()]),s=o.union([o.literal(!1),o.object({cpuThreshold:e.optional(),freeStorageThresholdGiB:t.optional(),connectionsThreshold:o.number().int().min(1).optional()}).strict()]),h=o.union([o.literal(!1),o.object({errorRateThreshold:e.optional(),durationThresholdPercent:e.optional()}).strict()]);export{l as EcsServiceAlarmConfigSchema,h as LambdaAlarmConfigSchema,s as RdsAlarmConfigSchema};

package/dist/src/schemas/applicationSchemas.d.ts

@@ -657,10 +657,10 @@ export declare const ApplicationResourcePlanSchema: z.ZodObject<{
                 sourceText: z.ZodString;
             }, z.core.$strict>>>;
             alarms: z.ZodOptional<z.ZodUnion<readonly [z.ZodLiteral<false>, z.ZodObject<{
-                cpuThreshold: z.ZodOptional<z.ZodNumber>;
-                memoryThreshold: z.ZodOptional<z.ZodNumber>;
+                cpuThreshold: z.ZodOptional<z.ZodUnion<readonly [z.ZodNumber, z.ZodLiteral<false>]>>;
+                memoryThreshold: z.ZodOptional<z.ZodUnion<readonly [z.ZodNumber, z.ZodLiteral<false>]>>;
                 runningTasksMinimum: z.ZodOptional<z.ZodNumber>;
-                http5xxThreshold: z.ZodOptional<z.ZodNumber>;
+                http5xxThreshold: z.ZodOptional<z.ZodUnion<readonly [z.ZodNumber, z.ZodLiteral<false>]>>;
             }, z.core.$strict>]>>;
         }, z.core.$strict>>>;
         docker: z.ZodOptional<z.ZodObject<{

package/dist/src/schemas/computeSchemas.d.ts

@@ -266,10 +266,10 @@ export declare const EcsServiceConfigSchema: z.ZodObject<{
         sourceText: z.ZodString;
     }, z.core.$strict>>>;
     alarms: z.ZodOptional<z.ZodUnion<readonly [z.ZodLiteral<false>, z.ZodObject<{
-        cpuThreshold: z.ZodOptional<z.ZodNumber>;
-        memoryThreshold: z.ZodOptional<z.ZodNumber>;
+        cpuThreshold: z.ZodOptional<z.ZodUnion<readonly [z.ZodNumber, z.ZodLiteral<false>]>>;
+        memoryThreshold: z.ZodOptional<z.ZodUnion<readonly [z.ZodNumber, z.ZodLiteral<false>]>>;
         runningTasksMinimum: z.ZodOptional<z.ZodNumber>;
-        http5xxThreshold: z.ZodOptional<z.ZodNumber>;
+        http5xxThreshold: z.ZodOptional<z.ZodUnion<readonly [z.ZodNumber, z.ZodLiteral<false>]>>;
     }, z.core.$strict>]>>;
 }, z.core.$strict>;
 /**
@@ -419,10 +419,10 @@ export declare const ComputeResourcePlanSchema: z.ZodObject<{
             sourceText: z.ZodString;
         }, z.core.$strict>>>;
         alarms: z.ZodOptional<z.ZodUnion<readonly [z.ZodLiteral<false>, z.ZodObject<{
-            cpuThreshold: z.ZodOptional<z.ZodNumber>;
-            memoryThreshold: z.ZodOptional<z.ZodNumber>;
+            cpuThreshold: z.ZodOptional<z.ZodUnion<readonly [z.ZodNumber, z.ZodLiteral<false>]>>;
+            memoryThreshold: z.ZodOptional<z.ZodUnion<readonly [z.ZodNumber, z.ZodLiteral<false>]>>;
             runningTasksMinimum: z.ZodOptional<z.ZodNumber>;
-            http5xxThreshold: z.ZodOptional<z.ZodNumber>;
+            http5xxThreshold: z.ZodOptional<z.ZodUnion<readonly [z.ZodNumber, z.ZodLiteral<false>]>>;
         }, z.core.$strict>]>>;
     }, z.core.$strict>>>;
     docker: z.ZodOptional<z.ZodObject<{
@@ -822,10 +822,10 @@ export declare const ComputeGeneratorSchema: z.ZodDiscriminatedUnion<[z.ZodObjec
             sourceText: z.ZodString;
         }, z.core.$strict>>>;
         alarms: z.ZodOptional<z.ZodUnion<readonly [z.ZodLiteral<false>, z.ZodObject<{
-            cpuThreshold: z.ZodOptional<z.ZodNumber>;
-            memoryThreshold: z.ZodOptional<z.ZodNumber>;
+            cpuThreshold: z.ZodOptional<z.ZodUnion<readonly [z.ZodNumber, z.ZodLiteral<false>]>>;
+            memoryThreshold: z.ZodOptional<z.ZodUnion<readonly [z.ZodNumber, z.ZodLiteral<false>]>>;
             runningTasksMinimum: z.ZodOptional<z.ZodNumber>;
-            http5xxThreshold: z.ZodOptional<z.ZodNumber>;
+            http5xxThreshold: z.ZodOptional<z.ZodUnion<readonly [z.ZodNumber, z.ZodLiteral<false>]>>;
         }, z.core.$strict>]>>;
     }, z.core.$strict>>;
     docker: z.ZodOptional<z.ZodObject<{

package/dist/src/version.d.ts

@@ -1 +1 @@
-export declare const GENERATOR_VERSION = "11.0.0";
+export declare const GENERATOR_VERSION = "12.1.0";

package/dist/src/version.js

@@ -1 +1 @@
-const E="11.0.0";export{E as GENERATOR_VERSION};
+const E="12.1.0";export{E as GENERATOR_VERSION};

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@fjall/generator",
-  "version": "11.0.0",
+  "version": "12.1.0",
   "repository": {
     "type": "git",
     "url": "git+https://github.com/fjall-tech/fjall.git",
@@ -53,7 +53,7 @@
   },
   "license": "SEE LICENSE IN LICENSE",
   "dependencies": {
-    "@fjall/util": "^11.0.0",
+    "@fjall/util": "^12.1.0",
     "ast-types": "^0.16.1",
     "recast": "^0.23.12",
     "ts-morph": "^28.0.0",