@fjall/generator 2.23.1 → 2.24.0

package/dist/.minified

@@ -1 +1 @@
-139 files minified at 2026-07-02T12:17:55.593Z
+141 files minified at 2026-07-05T07:50:57.469Z

package/dist/src/codemod/drift/types.d.ts

@@ -14,6 +14,7 @@ export declare const ResourceSnapshotSchema: z.ZodObject<{
         "vpc-peer": "vpc-peer";
         "vpc-peer-accepter": "vpc-peer-accepter";
         "cross-plan-connection": "cross-plan-connection";
+        organisation: "organisation";
     }>;
     name: z.ZodString;
     properties: z.ZodRecord<z.ZodString, z.ZodUnknown>;
@@ -32,6 +33,7 @@ export declare const DriftStateSchema: z.ZodObject<{
             "vpc-peer": "vpc-peer";
             "vpc-peer-accepter": "vpc-peer-accepter";
             "cross-plan-connection": "cross-plan-connection";
+            organisation: "organisation";
         }>;
         name: z.ZodString;
     }, z.core.$strict>;

package/dist/src/codemod/edits/findInsertionPosition.d.ts

@@ -23,9 +23,10 @@ export interface ImportInfo {
 export type InsertionStatementType = StatementType | "import" | "app-init" | "tags";
 /**
  * Returns the byte offset at which a new statement of `newType` should
- * be inserted. Mirrors legacy `findInsertionPositionByType` verbatim.
+ * be inserted. Ports legacy `findInsertionPositionByType`, extended
+ * with the `organisation` kind.
  *
- * Algorithm (unchanged from the legacy port):
+ * Algorithm:
  *   1. Look up `newType`'s index in the canonical order.
  *   2. Walk `existingImports` and `existingResources` in document order.
  *      Track the last entry whose type index is <= the target index.

package/dist/src/codemod/edits/findInsertionPosition.js

@@ -1 +1 @@
-const o=["import","app-init","tags","database","storage","messaging","compute","network","vpc-peer","vpc-peer-accepter","cross-plan-connection","cdn","pattern"];function d(c,i,p,r){const t=o.indexOf(p);if(t===-1)return r;let e;const a=o.indexOf("import");for(const n of c)a<=t&&(e=n.endPos);for(const n of i){const s=o.indexOf(n.type);s!==-1&&s<=t&&(e=n.endPos)}return e??r}export{d as findInsertionPosition};
+const e={import:0,"app-init":1,tags:2,organisation:3,database:4,storage:5,messaging:6,compute:7,network:8,"vpc-peer":9,"vpc-peer-accepter":10,"cross-plan-connection":11,cdn:12,pattern:13};function p(r,s,i,a){const o=e[i];let n;const c=e.import;for(const t of r)c<=o&&(n=t.endPos);for(const t of s)e[t.type]<=o&&(n=t.endPos);return n??a}export{p as findInsertionPosition};

package/dist/src/codemod/registry.d.ts

@@ -38,8 +38,18 @@ declare const FACTORY_IDENTIFIERS: {
     readonly "vpc-peer": "VpcPeerFactory";
     readonly "vpc-peer-accepter": "VpcPeerAccepterFactory";
     readonly "cross-plan-connection": "CrossPlanConnectionFactory";
+    readonly organisation: "OrganisationFactory";
 };
 export type FactoryIdentifier = (typeof FACTORY_IDENTIFIERS)[StatementType];
 export declare const STATEMENT_REGISTRY: Record<StatementType, StatementTypeEntry>;
+/**
+ * Statement types as registered, derived from the registry keys. The
+ * registry's `Record<StatementType, StatementTypeEntry>` annotation
+ * above is the compile-time exhaustiveness guard — it lives in compiled
+ * `src/` (test globs are excluded from `tsc`), so a missing or extra
+ * key fails the typecheck at the declaration. Runtime consumers needing
+ * the key set derive it from here rather than re-listing the literals.
+ */
+export declare const REGISTERED_STATEMENT_TYPES: ReadonlyArray<StatementType>;
 export declare function findTypeByIdentifier(identifier: string): StatementType | undefined;
 export {};

package/dist/src/codemod/registry.js

@@ -1 +1 @@
-import{z as c}from"zod";import{CDNResourcePlanSchema as i,ComputeResourcePlanSchema as u,CrossPlanConnectionResourcePlanSchema as g,DatabaseResourcePlanSchema as l,NetworkResourcePlanSchema as h,NextJSPatternConfigSchema as d,PayloadPatternConfigSchema as y,S3ResourcePlanSchema as S,SQSResourcePlanSchema as F,VpcPeerAccepterResourcePlanSchema as P,VpcPeerResourcePlanSchema as f}from"../schemas/index.js";import{failure as C}from"../types/Result.js";const r={database:"DatabaseFactory",storage:"StorageFactory",compute:"ComputeFactory",messaging:"MessagingFactory",cdn:"CdnFactory",network:"NetworkFactory",pattern:"PatternFactory","vpc-peer":"VpcPeerFactory","vpc-peer-accepter":"VpcPeerAccepterFactory","cross-plan-connection":"CrossPlanConnectionFactory"};function a(e){const{name:t,...o}=e.shape;return c.object(o).partial().strict()}const b=a(l),R=a(S),v=(()=>{const{name:e,...t}=u.shape;return c.object(t).partial().strict()})(),E=a(F),w=a(i),k=a(h),T=(()=>{const{name:e,type:t,...o}=y.shape,{name:D,type:V,...m}=d.shape;return c.object({...o,...m}).partial().strict()})(),_=a(f),x=a(P),N=a(g);function s(e,t){return C({kind:"SemanticQueryError",reason:`StatementTypeEntry.${e} for ${t} is not wired; existing types dispatch through the shared locator/generator.`})}function j(e){return{factoryIdentifier:e,findByShape:()=>s("locator.findByShape",e),validateContext:()=>s("locator.validateContext",e)}}function A(e){return{build:()=>{const t=s("generator.build",e);throw new Error(t.success?"unreachable":t.error.reason)}}}function n(e,t){return{factoryIdentifier:e,locator:j(e),generator:A(e),schemaFragment:t}}const p={database:n(r.database,b),storage:n(r.storage,R),compute:n(r.compute,v),messaging:n(r.messaging,E),cdn:n(r.cdn,w),network:n(r.network,k),pattern:n(r.pattern,T),"vpc-peer":n(r["vpc-peer"],_),"vpc-peer-accepter":n(r["vpc-peer-accepter"],x),"cross-plan-connection":n(r["cross-plan-connection"],N)};function I(e){const t=Object.keys(p);for(const o of t)if(p[o].factoryIdentifier===e)return o}export{p as STATEMENT_REGISTRY,I as findTypeByIdentifier};
+import{z as c}from"zod";import{CDNResourcePlanSchema as m,ComputeResourcePlanSchema as g,CrossPlanConnectionResourcePlanSchema as u,DatabaseResourcePlanSchema as l,NetworkResourcePlanSchema as S,NextJSPatternConfigSchema as h,OrganisationResourcePlanSchema as y,PayloadPatternConfigSchema as F,S3ResourcePlanSchema as P,SQSResourcePlanSchema as d,VpcPeerAccepterResourcePlanSchema as f,VpcPeerResourcePlanSchema as E}from"../schemas/index.js";import{failure as R}from"../types/Result.js";const n={database:"DatabaseFactory",storage:"StorageFactory",compute:"ComputeFactory",messaging:"MessagingFactory",cdn:"CdnFactory",network:"NetworkFactory",pattern:"PatternFactory","vpc-peer":"VpcPeerFactory","vpc-peer-accepter":"VpcPeerAccepterFactory","cross-plan-connection":"CrossPlanConnectionFactory",organisation:"OrganisationFactory"};function a(e){const{name:t,...o}=e.shape;return c.object(o).partial().strict()}const b=a(l),C=a(P),T=(()=>{const{name:e,...t}=g.shape;return c.object(t).partial().strict()})(),v=a(d),_=a(m),k=a(S),w=(()=>{const{name:e,type:t,...o}=F.shape,{name:V,type:B,...i}=h.shape;return c.object({...o,...i}).partial().strict()})(),x=a(E),N=a(f),j=a(u),A=a(y);function s(e,t){return R({kind:"SemanticQueryError",reason:`StatementTypeEntry.${e} for ${t} is not wired; existing types dispatch through the shared locator/generator.`})}function O(e){return{factoryIdentifier:e,findByShape:()=>s("locator.findByShape",e),validateContext:()=>s("locator.validateContext",e)}}function D(e){return{build:()=>{const t=s("generator.build",e);throw new Error(t.success?"unreachable":t.error.reason)}}}function r(e,t){return{factoryIdentifier:e,locator:O(e),generator:D(e),schemaFragment:t}}const p={database:r(n.database,b),storage:r(n.storage,C),compute:r(n.compute,T),messaging:r(n.messaging,v),cdn:r(n.cdn,_),network:r(n.network,k),pattern:r(n.pattern,w),"vpc-peer":r(n["vpc-peer"],x),"vpc-peer-accepter":r(n["vpc-peer-accepter"],N),"cross-plan-connection":r(n["cross-plan-connection"],j),organisation:r(n.organisation,A)},Y=Object.keys(p);function Q(e){const t=Object.keys(p);for(const o of t)if(p[o].factoryIdentifier===e)return o}export{Y as REGISTERED_STATEMENT_TYPES,p as STATEMENT_REGISTRY,Q as findTypeByIdentifier};

package/dist/src/codemod/types.d.ts

@@ -22,6 +22,7 @@ export declare const StatementTypeSchema: z.ZodEnum<{
     "vpc-peer": "vpc-peer";
     "vpc-peer-accepter": "vpc-peer-accepter";
     "cross-plan-connection": "cross-plan-connection";
+    organisation: "organisation";
 }>;
 export type StatementType = z.infer<typeof StatementTypeSchema>;
 export declare const ResourceNameSchema: z.ZodString;
@@ -38,6 +39,7 @@ export declare const AddOptionsSchema: z.ZodObject<{
         "vpc-peer": "vpc-peer";
         "vpc-peer-accepter": "vpc-peer-accepter";
         "cross-plan-connection": "cross-plan-connection";
+        organisation: "organisation";
     }>;
     name: z.ZodString;
     properties: z.ZodRecord<z.ZodString, z.ZodUnknown>;
@@ -61,6 +63,7 @@ export declare const RemoveOptionsSchema: z.ZodObject<{
         "vpc-peer": "vpc-peer";
         "vpc-peer-accepter": "vpc-peer-accepter";
         "cross-plan-connection": "cross-plan-connection";
+        organisation: "organisation";
     }>;
     name: z.ZodString;
     filePath: z.ZodOptional<z.ZodString>;
@@ -80,6 +83,7 @@ export declare const ModifyOptionsSchema: z.ZodObject<{
         "vpc-peer": "vpc-peer";
         "vpc-peer-accepter": "vpc-peer-accepter";
         "cross-plan-connection": "cross-plan-connection";
+        organisation: "organisation";
     }>;
     name: z.ZodString;
     properties: z.ZodRecord<z.ZodString, z.ZodUnknown>;
@@ -114,6 +118,7 @@ export declare const ResourceListingEntrySchema: z.ZodObject<{
         "vpc-peer": "vpc-peer";
         "vpc-peer-accepter": "vpc-peer-accepter";
         "cross-plan-connection": "cross-plan-connection";
+        organisation: "organisation";
     }>;
     name: z.ZodString;
     filePath: z.ZodString;
@@ -135,6 +140,7 @@ export declare const ResourceListingSchema: z.ZodObject<{
             "vpc-peer": "vpc-peer";
             "vpc-peer-accepter": "vpc-peer-accepter";
             "cross-plan-connection": "cross-plan-connection";
+            organisation: "organisation";
         }>;
         name: z.ZodString;
         filePath: z.ZodString;

package/dist/src/codemod/types.js

@@ -1 +1 @@
-import{z as t}from"zod";import{VALIDATION_MESSAGES as i,VALIDATION_PATTERNS as c}from"../validation/patterns.js";const o=t.object({force:t.boolean().optional(),resolutionMap:t.record(t.string(),t.unknown()).optional()}).strict(),e=t.enum(["database","storage","compute","messaging","cdn","network","pattern","vpc-peer","vpc-peer-accepter","cross-plan-connection"]),n=t.string().regex(c.PASCAL_CASE,i.PASCAL_CASE),r=t.record(t.string(),t.unknown()),g=t.object({type:e,name:n,properties:r,filePath:t.string().optional(),driftPolicy:o.optional(),branch:t.string().optional()}).strict(),h=t.object({type:e,name:n,filePath:t.string().optional(),force:t.boolean().optional(),branch:t.string().optional()}).strict(),b=t.object({type:e,name:n,properties:r,filePath:t.string().optional(),driftPolicy:o.optional(),branch:t.string().optional()}).strict(),a=t.object({line:t.number().int().positive(),column:t.number().int().positive(),context:t.string()}).strict(),s=t.object({added:t.number().int().nonnegative(),removed:t.number().int().nonnegative()}).strict(),p=t.object({type:e,name:t.string(),filePath:t.string(),start:t.number().int().nonnegative(),length:t.number().int().nonnegative()}).strict(),S=t.object({filePath:t.string(),resources:t.array(p)}).strict(),u=t.object({content:t.string(),linesChanged:s,references:t.array(a).optional(),warnings:t.array(t.string()).optional()}).strict(),d=t.object({property:t.string(),base:t.unknown().optional(),theirs:t.unknown(),ours:t.unknown(),verdict:t.enum(["clean","no-op","compatible","conflict"])}).strict();export{g as AddOptionsSchema,u as CodemodSuccessSchema,o as DriftPolicySchema,s as LinesChangedSchema,b as ModifyOptionsSchema,d as PropertyDeltaSchema,a as ReferenceLocationSchema,h as RemoveOptionsSchema,p as ResourceListingEntrySchema,S as ResourceListingSchema,n as ResourceNameSchema,e as StatementTypeSchema};
+import{z as t}from"zod";import{VALIDATION_MESSAGES as i,VALIDATION_PATTERNS as c}from"../validation/patterns.js";const o=t.object({force:t.boolean().optional(),resolutionMap:t.record(t.string(),t.unknown()).optional()}).strict(),e=t.enum(["database","storage","compute","messaging","cdn","network","pattern","vpc-peer","vpc-peer-accepter","cross-plan-connection","organisation"]),n=t.string().regex(c.PASCAL_CASE,i.PASCAL_CASE),r=t.record(t.string(),t.unknown()),g=t.object({type:e,name:n,properties:r,filePath:t.string().optional(),driftPolicy:o.optional(),branch:t.string().optional()}).strict(),h=t.object({type:e,name:n,filePath:t.string().optional(),force:t.boolean().optional(),branch:t.string().optional()}).strict(),b=t.object({type:e,name:n,properties:r,filePath:t.string().optional(),driftPolicy:o.optional(),branch:t.string().optional()}).strict(),a=t.object({line:t.number().int().positive(),column:t.number().int().positive(),context:t.string()}).strict(),s=t.object({added:t.number().int().nonnegative(),removed:t.number().int().nonnegative()}).strict(),p=t.object({type:e,name:t.string(),filePath:t.string(),start:t.number().int().nonnegative(),length:t.number().int().nonnegative()}).strict(),S=t.object({filePath:t.string(),resources:t.array(p)}).strict(),u=t.object({content:t.string(),linesChanged:s,references:t.array(a).optional(),warnings:t.array(t.string()).optional()}).strict(),d=t.object({property:t.string(),base:t.unknown().optional(),theirs:t.unknown(),ours:t.unknown(),verdict:t.enum(["clean","no-op","compatible","conflict"])}).strict();export{g as AddOptionsSchema,u as CodemodSuccessSchema,o as DriftPolicySchema,s as LinesChangedSchema,b as ModifyOptionsSchema,d as PropertyDeltaSchema,a as ReferenceLocationSchema,h as RemoveOptionsSchema,p as ResourceListingEntrySchema,S as ResourceListingSchema,n as ResourceNameSchema,e as StatementTypeSchema};

package/dist/src/schemas/index.d.ts

@@ -1,3 +1,4 @@
 export * from "./resourceSchemas.js";
 export * from "./constants.js";
+export * from "./securityBoundary.js";
 export { type AmiHardwareType, getArchitectureForInstanceType, validateArchitectureMatch, isArchitectureCompatible, } from "./instanceTypeArchitecture.js";

package/dist/src/schemas/index.js

@@ -1 +1 @@
-export*from"./resourceSchemas.js";export*from"./constants.js";import{getArchitectureForInstanceType as o,validateArchitectureMatch as i,isArchitectureCompatible as a}from"./instanceTypeArchitecture.js";export{o as getArchitectureForInstanceType,a as isArchitectureCompatible,i as validateArchitectureMatch};
+export*from"./resourceSchemas.js";export*from"./constants.js";export*from"./securityBoundary.js";import{getArchitectureForInstanceType as i,validateArchitectureMatch as p,isArchitectureCompatible as a}from"./instanceTypeArchitecture.js";export{i as getArchitectureForInstanceType,a as isArchitectureCompatible,p as validateArchitectureMatch};

package/dist/src/schemas/organisationSchemas.d.ts

@@ -0,0 +1,292 @@
+import { z } from "zod";
+/**
+ * Canonical Identity Centre source-mode vocabulary. Single source of
+ * truth — the Zod schemas below and the components-infrastructure
+ * construct/validator all derive from this tuple, so a source added
+ * here flows to every consumer without a second edit.
+ */
+export declare const IDENTITY_CENTRE_SOURCES: readonly ["fjall-managed", "external", "external-manual"];
+export declare const IdentityCentreSourceSchema: z.ZodEnum<{
+    external: "external";
+    "fjall-managed": "fjall-managed";
+    "external-manual": "external-manual";
+}>;
+export type IdentityCentreSource = z.infer<typeof IdentityCentreSourceSchema>;
+/**
+ * Names of the built-in permission sets the Organisation construct creates
+ * unless `defaultPermissionSets: false`. The definitions (policy ARNs,
+ * descriptions) live in the construct's `DEFAULT_PERMISSION_SETS`, which is
+ * typed against this tuple so the two cannot drift.
+ */
+export declare const DEFAULT_PERMISSION_SET_NAMES: readonly ["AdministratorAccess", "ReadOnlyAccess", "Billing"];
+export type DefaultPermissionSetName = (typeof DEFAULT_PERMISSION_SET_NAMES)[number];
+export declare const IdentityCentreUserSpecSchema: z.ZodObject<{
+    givenName: z.ZodString;
+    familyName: z.ZodString;
+    displayName: z.ZodOptional<z.ZodString>;
+    expires: z.ZodOptional<z.ZodString>;
+}, z.core.$strict>;
+export type IdentityCentreUserSpec = z.infer<typeof IdentityCentreUserSpecSchema>;
+export declare const CustomerManagedPolicyRefSchema: z.ZodObject<{
+    name: z.ZodString;
+    path: z.ZodOptional<z.ZodString>;
+}, z.core.$strict>;
+export type CustomerManagedPolicyRef = z.infer<typeof CustomerManagedPolicyRefSchema>;
+export declare const PermissionsBoundarySpecSchema: z.ZodUnion<readonly [z.ZodObject<{
+    managedPolicyArn: z.ZodString;
+}, z.core.$strict>, z.ZodObject<{
+    customerManagedPolicy: z.ZodObject<{
+        name: z.ZodString;
+        path: z.ZodOptional<z.ZodString>;
+    }, z.core.$strict>;
+}, z.core.$strict>]>;
+export type PermissionsBoundarySpec = z.infer<typeof PermissionsBoundarySpecSchema>;
+export declare const IdentityCentrePermissionSetSpecSchema: z.ZodObject<{
+    managedPolicies: z.ZodOptional<z.ZodArray<z.ZodString>>;
+    inlinePolicy: z.ZodOptional<z.ZodRecord<z.ZodString, z.ZodUnknown>>;
+    customerManagedPolicies: z.ZodOptional<z.ZodArray<z.ZodObject<{
+        name: z.ZodString;
+        path: z.ZodOptional<z.ZodString>;
+    }, z.core.$strict>>>;
+    permissionsBoundary: z.ZodOptional<z.ZodUnion<readonly [z.ZodObject<{
+        managedPolicyArn: z.ZodString;
+    }, z.core.$strict>, z.ZodObject<{
+        customerManagedPolicy: z.ZodObject<{
+            name: z.ZodString;
+            path: z.ZodOptional<z.ZodString>;
+        }, z.core.$strict>;
+    }, z.core.$strict>]>>;
+    sessionDuration: z.ZodOptional<z.ZodString>;
+    description: z.ZodOptional<z.ZodString>;
+    accounts: z.ZodOptional<z.ZodUnion<readonly [z.ZodArray<z.ZodString>, z.ZodLiteral<"all">]>>;
+    includeManagementAccount: z.ZodOptional<z.ZodBoolean>;
+    groups: z.ZodOptional<z.ZodArray<z.ZodString>>;
+}, z.core.$strict>;
+export type IdentityCentrePermissionSetSpec = z.infer<typeof IdentityCentrePermissionSetSpecSchema>;
+export declare const IdentityCentreGroupSpecSchema: z.ZodObject<{
+    description: z.ZodOptional<z.ZodString>;
+}, z.core.$strict>;
+export type IdentityCentreGroupSpec = z.infer<typeof IdentityCentreGroupSpecSchema>;
+/**
+ * Discriminated on `source`. The "external" variant omits `users` entirely
+ * (mirroring the construct's `users?: never`) — `.strict()` rejects a `users`
+ * key on that variant at the write gate. Each variant's discriminator
+ * literal is `satisfies`-pinned to {@link IdentityCentreSource} so a
+ * literal outside the canonical tuple fails `tsc`.
+ */
+export declare const IdentityCentreConfigSchema: z.ZodDiscriminatedUnion<[z.ZodObject<{
+    source: z.ZodLiteral<"fjall-managed">;
+    users: z.ZodRecord<z.ZodString, z.ZodObject<{
+        givenName: z.ZodString;
+        familyName: z.ZodString;
+        displayName: z.ZodOptional<z.ZodString>;
+        expires: z.ZodOptional<z.ZodString>;
+    }, z.core.$strict>>;
+    groups: z.ZodOptional<z.ZodRecord<z.ZodString, z.ZodObject<{
+        description: z.ZodOptional<z.ZodString>;
+    }, z.core.$strict>>>;
+    permissionSets: z.ZodOptional<z.ZodRecord<z.ZodString, z.ZodObject<{
+        managedPolicies: z.ZodOptional<z.ZodArray<z.ZodString>>;
+        inlinePolicy: z.ZodOptional<z.ZodRecord<z.ZodString, z.ZodUnknown>>;
+        customerManagedPolicies: z.ZodOptional<z.ZodArray<z.ZodObject<{
+            name: z.ZodString;
+            path: z.ZodOptional<z.ZodString>;
+        }, z.core.$strict>>>;
+        permissionsBoundary: z.ZodOptional<z.ZodUnion<readonly [z.ZodObject<{
+            managedPolicyArn: z.ZodString;
+        }, z.core.$strict>, z.ZodObject<{
+            customerManagedPolicy: z.ZodObject<{
+                name: z.ZodString;
+                path: z.ZodOptional<z.ZodString>;
+            }, z.core.$strict>;
+        }, z.core.$strict>]>>;
+        sessionDuration: z.ZodOptional<z.ZodString>;
+        description: z.ZodOptional<z.ZodString>;
+        accounts: z.ZodOptional<z.ZodUnion<readonly [z.ZodArray<z.ZodString>, z.ZodLiteral<"all">]>>;
+        includeManagementAccount: z.ZodOptional<z.ZodBoolean>;
+        groups: z.ZodOptional<z.ZodArray<z.ZodString>>;
+    }, z.core.$strict>>>;
+    memberships: z.ZodOptional<z.ZodRecord<z.ZodString, z.ZodArray<z.ZodString>>>;
+    resolutionVersion: z.ZodOptional<z.ZodNumber>;
+    defaultPermissionSets: z.ZodOptional<z.ZodBoolean>;
+}, z.core.$strict>, z.ZodObject<{
+    source: z.ZodLiteral<"external">;
+    groups: z.ZodOptional<z.ZodRecord<z.ZodString, z.ZodObject<{
+        description: z.ZodOptional<z.ZodString>;
+    }, z.core.$strict>>>;
+    permissionSets: z.ZodOptional<z.ZodRecord<z.ZodString, z.ZodObject<{
+        managedPolicies: z.ZodOptional<z.ZodArray<z.ZodString>>;
+        inlinePolicy: z.ZodOptional<z.ZodRecord<z.ZodString, z.ZodUnknown>>;
+        customerManagedPolicies: z.ZodOptional<z.ZodArray<z.ZodObject<{
+            name: z.ZodString;
+            path: z.ZodOptional<z.ZodString>;
+        }, z.core.$strict>>>;
+        permissionsBoundary: z.ZodOptional<z.ZodUnion<readonly [z.ZodObject<{
+            managedPolicyArn: z.ZodString;
+        }, z.core.$strict>, z.ZodObject<{
+            customerManagedPolicy: z.ZodObject<{
+                name: z.ZodString;
+                path: z.ZodOptional<z.ZodString>;
+            }, z.core.$strict>;
+        }, z.core.$strict>]>>;
+        sessionDuration: z.ZodOptional<z.ZodString>;
+        description: z.ZodOptional<z.ZodString>;
+        accounts: z.ZodOptional<z.ZodUnion<readonly [z.ZodArray<z.ZodString>, z.ZodLiteral<"all">]>>;
+        includeManagementAccount: z.ZodOptional<z.ZodBoolean>;
+        groups: z.ZodOptional<z.ZodArray<z.ZodString>>;
+    }, z.core.$strict>>>;
+    memberships: z.ZodOptional<z.ZodRecord<z.ZodString, z.ZodArray<z.ZodString>>>;
+    resolutionVersion: z.ZodOptional<z.ZodNumber>;
+    defaultPermissionSets: z.ZodOptional<z.ZodBoolean>;
+}, z.core.$strict>, z.ZodObject<{
+    source: z.ZodLiteral<"external-manual">;
+    users: z.ZodOptional<z.ZodRecord<z.ZodString, z.ZodObject<{
+        givenName: z.ZodString;
+        familyName: z.ZodString;
+        displayName: z.ZodOptional<z.ZodString>;
+        expires: z.ZodOptional<z.ZodString>;
+    }, z.core.$strict>>>;
+    groups: z.ZodOptional<z.ZodRecord<z.ZodString, z.ZodObject<{
+        description: z.ZodOptional<z.ZodString>;
+    }, z.core.$strict>>>;
+    permissionSets: z.ZodOptional<z.ZodRecord<z.ZodString, z.ZodObject<{
+        managedPolicies: z.ZodOptional<z.ZodArray<z.ZodString>>;
+        inlinePolicy: z.ZodOptional<z.ZodRecord<z.ZodString, z.ZodUnknown>>;
+        customerManagedPolicies: z.ZodOptional<z.ZodArray<z.ZodObject<{
+            name: z.ZodString;
+            path: z.ZodOptional<z.ZodString>;
+        }, z.core.$strict>>>;
+        permissionsBoundary: z.ZodOptional<z.ZodUnion<readonly [z.ZodObject<{
+            managedPolicyArn: z.ZodString;
+        }, z.core.$strict>, z.ZodObject<{
+            customerManagedPolicy: z.ZodObject<{
+                name: z.ZodString;
+                path: z.ZodOptional<z.ZodString>;
+            }, z.core.$strict>;
+        }, z.core.$strict>]>>;
+        sessionDuration: z.ZodOptional<z.ZodString>;
+        description: z.ZodOptional<z.ZodString>;
+        accounts: z.ZodOptional<z.ZodUnion<readonly [z.ZodArray<z.ZodString>, z.ZodLiteral<"all">]>>;
+        includeManagementAccount: z.ZodOptional<z.ZodBoolean>;
+        groups: z.ZodOptional<z.ZodArray<z.ZodString>>;
+    }, z.core.$strict>>>;
+    memberships: z.ZodOptional<z.ZodRecord<z.ZodString, z.ZodArray<z.ZodString>>>;
+    resolutionVersion: z.ZodOptional<z.ZodNumber>;
+    defaultPermissionSets: z.ZodOptional<z.ZodBoolean>;
+}, z.core.$strict>], "source">;
+export type IdentityCentreConfig = z.infer<typeof IdentityCentreConfigSchema>;
+/**
+ * Engine-side plan for `OrganisationFactory.build("Name", {...})` statements.
+ * `accounts` stays opaque: the scaffold passes the `ACCOUNTS` identifier,
+ * which the snapshot layer already represents as `{ kind: "expression" }`.
+ */
+export declare const OrganisationResourcePlanSchema: z.ZodObject<{
+    name: z.ZodString;
+    type: z.ZodOptional<z.ZodLiteral<"organisation">>;
+    organisationName: z.ZodOptional<z.ZodString>;
+    orgEmail: z.ZodOptional<z.ZodString>;
+    accounts: z.ZodOptional<z.ZodUnknown>;
+    accountIds: z.ZodOptional<z.ZodRecord<z.ZodString, z.ZodString>>;
+    identityCentre: z.ZodOptional<z.ZodUnion<readonly [z.ZodDiscriminatedUnion<[z.ZodObject<{
+        source: z.ZodLiteral<"fjall-managed">;
+        users: z.ZodRecord<z.ZodString, z.ZodObject<{
+            givenName: z.ZodString;
+            familyName: z.ZodString;
+            displayName: z.ZodOptional<z.ZodString>;
+            expires: z.ZodOptional<z.ZodString>;
+        }, z.core.$strict>>;
+        groups: z.ZodOptional<z.ZodRecord<z.ZodString, z.ZodObject<{
+            description: z.ZodOptional<z.ZodString>;
+        }, z.core.$strict>>>;
+        permissionSets: z.ZodOptional<z.ZodRecord<z.ZodString, z.ZodObject<{
+            managedPolicies: z.ZodOptional<z.ZodArray<z.ZodString>>;
+            inlinePolicy: z.ZodOptional<z.ZodRecord<z.ZodString, z.ZodUnknown>>;
+            customerManagedPolicies: z.ZodOptional<z.ZodArray<z.ZodObject<{
+                name: z.ZodString;
+                path: z.ZodOptional<z.ZodString>;
+            }, z.core.$strict>>>;
+            permissionsBoundary: z.ZodOptional<z.ZodUnion<readonly [z.ZodObject<{
+                managedPolicyArn: z.ZodString;
+            }, z.core.$strict>, z.ZodObject<{
+                customerManagedPolicy: z.ZodObject<{
+                    name: z.ZodString;
+                    path: z.ZodOptional<z.ZodString>;
+                }, z.core.$strict>;
+            }, z.core.$strict>]>>;
+            sessionDuration: z.ZodOptional<z.ZodString>;
+            description: z.ZodOptional<z.ZodString>;
+            accounts: z.ZodOptional<z.ZodUnion<readonly [z.ZodArray<z.ZodString>, z.ZodLiteral<"all">]>>;
+            includeManagementAccount: z.ZodOptional<z.ZodBoolean>;
+            groups: z.ZodOptional<z.ZodArray<z.ZodString>>;
+        }, z.core.$strict>>>;
+        memberships: z.ZodOptional<z.ZodRecord<z.ZodString, z.ZodArray<z.ZodString>>>;
+        resolutionVersion: z.ZodOptional<z.ZodNumber>;
+        defaultPermissionSets: z.ZodOptional<z.ZodBoolean>;
+    }, z.core.$strict>, z.ZodObject<{
+        source: z.ZodLiteral<"external">;
+        groups: z.ZodOptional<z.ZodRecord<z.ZodString, z.ZodObject<{
+            description: z.ZodOptional<z.ZodString>;
+        }, z.core.$strict>>>;
+        permissionSets: z.ZodOptional<z.ZodRecord<z.ZodString, z.ZodObject<{
+            managedPolicies: z.ZodOptional<z.ZodArray<z.ZodString>>;
+            inlinePolicy: z.ZodOptional<z.ZodRecord<z.ZodString, z.ZodUnknown>>;
+            customerManagedPolicies: z.ZodOptional<z.ZodArray<z.ZodObject<{
+                name: z.ZodString;
+                path: z.ZodOptional<z.ZodString>;
+            }, z.core.$strict>>>;
+            permissionsBoundary: z.ZodOptional<z.ZodUnion<readonly [z.ZodObject<{
+                managedPolicyArn: z.ZodString;
+            }, z.core.$strict>, z.ZodObject<{
+                customerManagedPolicy: z.ZodObject<{
+                    name: z.ZodString;
+                    path: z.ZodOptional<z.ZodString>;
+                }, z.core.$strict>;
+            }, z.core.$strict>]>>;
+            sessionDuration: z.ZodOptional<z.ZodString>;
+            description: z.ZodOptional<z.ZodString>;
+            accounts: z.ZodOptional<z.ZodUnion<readonly [z.ZodArray<z.ZodString>, z.ZodLiteral<"all">]>>;
+            includeManagementAccount: z.ZodOptional<z.ZodBoolean>;
+            groups: z.ZodOptional<z.ZodArray<z.ZodString>>;
+        }, z.core.$strict>>>;
+        memberships: z.ZodOptional<z.ZodRecord<z.ZodString, z.ZodArray<z.ZodString>>>;
+        resolutionVersion: z.ZodOptional<z.ZodNumber>;
+        defaultPermissionSets: z.ZodOptional<z.ZodBoolean>;
+    }, z.core.$strict>, z.ZodObject<{
+        source: z.ZodLiteral<"external-manual">;
+        users: z.ZodOptional<z.ZodRecord<z.ZodString, z.ZodObject<{
+            givenName: z.ZodString;
+            familyName: z.ZodString;
+            displayName: z.ZodOptional<z.ZodString>;
+            expires: z.ZodOptional<z.ZodString>;
+        }, z.core.$strict>>>;
+        groups: z.ZodOptional<z.ZodRecord<z.ZodString, z.ZodObject<{
+            description: z.ZodOptional<z.ZodString>;
+        }, z.core.$strict>>>;
+        permissionSets: z.ZodOptional<z.ZodRecord<z.ZodString, z.ZodObject<{
+            managedPolicies: z.ZodOptional<z.ZodArray<z.ZodString>>;
+            inlinePolicy: z.ZodOptional<z.ZodRecord<z.ZodString, z.ZodUnknown>>;
+            customerManagedPolicies: z.ZodOptional<z.ZodArray<z.ZodObject<{
+                name: z.ZodString;
+                path: z.ZodOptional<z.ZodString>;
+            }, z.core.$strict>>>;
+            permissionsBoundary: z.ZodOptional<z.ZodUnion<readonly [z.ZodObject<{
+                managedPolicyArn: z.ZodString;
+            }, z.core.$strict>, z.ZodObject<{
+                customerManagedPolicy: z.ZodObject<{
+                    name: z.ZodString;
+                    path: z.ZodOptional<z.ZodString>;
+                }, z.core.$strict>;
+            }, z.core.$strict>]>>;
+            sessionDuration: z.ZodOptional<z.ZodString>;
+            description: z.ZodOptional<z.ZodString>;
+            accounts: z.ZodOptional<z.ZodUnion<readonly [z.ZodArray<z.ZodString>, z.ZodLiteral<"all">]>>;
+            includeManagementAccount: z.ZodOptional<z.ZodBoolean>;
+            groups: z.ZodOptional<z.ZodArray<z.ZodString>>;
+        }, z.core.$strict>>>;
+        memberships: z.ZodOptional<z.ZodRecord<z.ZodString, z.ZodArray<z.ZodString>>>;
+        resolutionVersion: z.ZodOptional<z.ZodNumber>;
+        defaultPermissionSets: z.ZodOptional<z.ZodBoolean>;
+    }, z.core.$strict>], "source">, z.ZodLiteral<false>]>>;
+    allowedRegions: z.ZodOptional<z.ZodArray<z.ZodString>>;
+}, z.core.$strict>;
+export type OrganisationResourcePlan = z.infer<typeof OrganisationResourcePlanSchema>;

package/dist/src/schemas/organisationSchemas.js

@@ -0,0 +1 @@
+import{z as n}from"zod";import{VALIDATION_PATTERNS as r,VALIDATION_MESSAGES as a}from"../validation/patterns.js";import{ResourceNameSchema as s}from"./baseSchemas.js";const c=["fjall-managed","external","external-manual"],y=n.enum(c),x=["AdministratorAccess","ReadOnlyAccess","Billing"],e=n.object({givenName:n.string().min(1),familyName:n.string().min(1),displayName:n.string().min(1).optional(),expires:n.string().min(1).optional()}).strict(),i=n.object({name:n.string().min(1),path:n.string().min(1).optional()}).strict(),l=n.union([n.object({managedPolicyArn:n.string().min(1)}).strict(),n.object({customerManagedPolicy:i}).strict()]),m=n.object({managedPolicies:n.array(n.string().min(1)).optional(),inlinePolicy:n.record(n.string(),n.unknown()).optional(),customerManagedPolicies:n.array(i).optional(),permissionsBoundary:l.optional(),sessionDuration:n.string().min(1).optional(),description:n.string().optional(),accounts:n.union([n.array(n.string().min(1)),n.literal("all")]).optional(),includeManagementAccount:n.boolean().optional(),groups:n.array(n.string().min(1)).optional()}).strict(),p=n.object({description:n.string().optional()}).strict(),t=n.string().regex(r.EMAIL,a.EMAIL),o={groups:n.record(n.string(),p).optional(),permissionSets:n.record(n.string(),m).optional(),memberships:n.record(n.string(),n.array(t)).optional(),resolutionVersion:n.number().int().min(1).optional(),defaultPermissionSets:n.boolean().optional()},g=n.discriminatedUnion("source",[n.object({...o,source:n.literal("fjall-managed"),users:n.record(t,e)}).strict(),n.object({...o,source:n.literal("external")}).strict(),n.object({...o,source:n.literal("external-manual"),users:n.record(t,e).optional()}).strict()]),I=n.object({name:s,type:n.literal("organisation").optional(),organisationName:n.string().min(1).optional(),orgEmail:t.optional(),accounts:n.unknown().optional(),accountIds:n.record(n.string(),n.string()).optional(),identityCentre:n.union([g,n.literal(!1)]).optional(),allowedRegions:n.array(n.string().min(1)).optional()}).strict();export{i as CustomerManagedPolicyRefSchema,x as DEFAULT_PERMISSION_SET_NAMES,c as IDENTITY_CENTRE_SOURCES,g as IdentityCentreConfigSchema,p as IdentityCentreGroupSpecSchema,m as IdentityCentrePermissionSetSpecSchema,y as IdentityCentreSourceSchema,e as IdentityCentreUserSpecSchema,I as OrganisationResourcePlanSchema,l as PermissionsBoundarySpecSchema};

package/dist/src/schemas/resourceSchemas.d.ts

@@ -13,6 +13,7 @@
  *   computeSchemas.ts     — EC2, Lambda, ECS, container, service configs
  *   patternSchemas.ts     — Payload/NextJS pattern configs, tier schemas
  *   applicationSchemas.ts — ApplicationResourcePlan, ApplicationGenerator
+ *   organisationSchemas.ts — Organisation resource plan, identityCentre union
  *
  * All exports are re-exported here so existing consumers continue to work
  * without any import path changes.
@@ -27,3 +28,4 @@ export * from "./computeSchemas.js";
 export * from "./patternSchemas.js";
 export * from "./applicationSchemas.js";
 export * from "./alarmSchemas.js";
+export * from "./organisationSchemas.js";

package/dist/src/schemas/resourceSchemas.js

@@ -1 +1 @@
-export*from"./baseSchemas.js";export*from"./databaseSchemas.js";export*from"./networkSchemas.js";export*from"./storageSchemas.js";export*from"./messagingSchemas.js";export*from"./cdnSchemas.js";export*from"./computeSchemas.js";export*from"./patternSchemas.js";export*from"./applicationSchemas.js";export*from"./alarmSchemas.js";
+export*from"./baseSchemas.js";export*from"./databaseSchemas.js";export*from"./networkSchemas.js";export*from"./storageSchemas.js";export*from"./messagingSchemas.js";export*from"./cdnSchemas.js";export*from"./computeSchemas.js";export*from"./patternSchemas.js";export*from"./applicationSchemas.js";export*from"./alarmSchemas.js";export*from"./organisationSchemas.js";

package/dist/src/schemas/securityBoundary.d.ts

@@ -0,0 +1,100 @@
+import { type GovernancePreset } from "./constants.js";
+/**
+ * The Fjall deploy-role permissions-boundary ceiling, keyed by governance tier.
+ *
+ * A permissions boundary is the HARD CAP on the two admin surfaces Fjall deploys
+ * run under — the `FjallDeploy${orgId}` OIDC role and the CDK bootstrap
+ * `cfn-exec-role`. Unlike a per-deploy STS session policy (Phase D), a boundary
+ * DOES apply to an assumed role, so it cannot be bypassed by CDK's role hand-off.
+ * See aiDocs research 2026-07-05-phase-d-session-policy-assume-role-bypass.md.
+ *
+ * This module is the single source of truth for the boundary NAME derivation
+ * and per-tier STATEMENT CONTENT. It lives in `@fjall/generator` (not
+ * `@fjall/util`) because it keys on `GovernancePreset`, which lives here — and
+ * `@fjall/util` cannot import it without a circular dependency. Consumers:
+ * `@fjall/components-infrastructure` (creates the policy in `oidcConnector.ts`),
+ * `@fjall/deploy-core` (passes the name to `cdk bootstrap`), `@fjall/cli`
+ * (resolves the tier). The Quick-Create YAML twin mirrors the content by hand,
+ * kept in lockstep by `oidcConnectorTemplate.test.ts` (presence parity + a
+ * statement-content deep-compare against the hardened tier of this SSoT).
+ *
+ * NOT related to `PermissionsBoundarySpec` in organisationSchemas.ts — that is a
+ * REFERENCE to an existing policy for Identity Centre permission sets; this
+ * defines boundary CONTENT for the deploy role.
+ */
+/**
+ * A single IAM policy statement in AWS JSON shape — the exact form
+ * `iam.PolicyStatement.fromJson` consumes. Kept as plain data so the pure
+ * generator carries no CDK dependency: the CDK construct maps these to
+ * `iam.PolicyStatement`, and the hand-authored Quick-Create YAML mirrors them.
+ */
+export interface BoundaryStatement {
+    Sid?: string;
+    Effect: "Allow" | "Deny";
+    Action?: string | string[];
+    NotAction?: string | string[];
+    Resource?: string | string[];
+    NotResource?: string | string[];
+    Condition?: Record<string, Record<string, string | string[]>>;
+}
+/**
+ * The customer-managed permissions-boundary policy name for an org's deploy
+ * surface. Org-id-suffixed to match the deploy role (`FjallDeploy${orgId}`),
+ * giving per-connection isolation and sidestepping the cross-org
+ * `EntityAlreadyExistsException` collision a shared tier-named policy would hit
+ * (the same class the account-global OIDC provider solves with adopt-if-exists).
+ *
+ * COUPLED VALUE — three sites MUST derive this name identically, or
+ * `cdk bootstrap --custom-permissions-boundary` looks up a policy that does not
+ * exist and fails: (1) the CDK construct that CREATES the policy
+ * (`config/aws/oidcConnector.ts`), (2) the Quick-Create YAML twin
+ * (`oidc-connector.yaml`, `!Sub "FjallDeployBoundary${FjallOrgId}"` — mirrors
+ * this by hand, parity-linted), and (3) the bootstrap flag
+ * (`CdkService.runCdkBootstrap` → `CdkOptions.permissionsBoundary`).
+ */
+export declare function deployBoundaryName(fjallOrgId: string): string;
+/**
+ * Tier → boundary statement list. `Record<GovernancePreset, …>` so a new tier
+ * landing in `GOVERNANCE_PRESETS` lights up a missing-key `error TS2741` here —
+ * the exhaustiveness guard fires structurally.
+ *
+ * LIVE-TUNING CANDIDATES (deliberately NOT in v1 — each is emitted by a real
+ * CloudFormation deploy/destroy/bootstrap UPDATE path, or collides with a
+ * deferred feature, so it needs live redeploy validation and/or resource
+ * scoping before it can be denied. Each carries the completeness-review verdict
+ * (adversarial content review, aiDocs 2026-07-05-phase-e-deploy-boundary):
+ *   • `iam:AttachRolePolicy` of `AdministratorAccess` — breaks bootstrap's
+ *     creation of the cfn-exec-role (which carries AdministratorAccess).
+ *   • `iam:PutRolePermissionsBoundary` [companion to FjallDenyBoundarySelfEscape]
+ *     — the SECOND self-escape (replace own boundary with a permissive one).
+ *     Emitted by re-bootstrap boundary UPDATE and by the deferred E3b path
+ *     (cdk.json permissionsBoundary on app roles → CFN UPDATE of an existing
+ *     role's boundary). Deny only once E3b resource-scopes it (allow when
+ *     setting the Fjall boundary / exempt CDK-created role paths); hardened.
+ *   • Boundary-policy self-protection (deny `iam:CreatePolicyVersion` /
+ *     `iam:SetDefaultPolicyVersion` on the FjallDeployBoundary policy itself)
+ *     — blocks the role republishing a permissive version of its own ceiling;
+ *     requires out-of-band admin to re-tune, so land with the live loop.
+ *   • `kms:PutKeyPolicy` — CFN emits it on key-policy/grant UPDATE (e.g.
+ *     `key.grantDecrypt(newPrincipal)` on redeploy); denying outright breaks a
+ *     legitimate app redeploy. Needs a live cycle or resource scoping.
+ *   • `kms:ScheduleKeyDeletion` — `cdk destroy` of a DESTROY-policy CMK emits
+ *     it (kms.ts pendingWindow); safe to deny ONLY if hardened commits to
+ *     RETAIN-only keys (matches the org SCP, which exempts the automation role).
+ *   • `backup:DeleteBackupVault` / `DeleteRecoveryPoint` (foundation) +
+ *     `Put/DeleteBackupVaultLockConfiguration` (hardened) — no construct emits
+ *     them TODAY (vaults are RETAIN-forced), but the safety is coupled to that
+ *     RETAIN invariant and to the adopt-mode re-lock CFN surface; validate in a
+ *     DR-enabled redeploy before denying.
+ *   • `guardduty:DisassociateFromMasterAccount` / `StopMonitoringMembers`
+ *     (compliance) — never emitted (the org CR only calls
+ *     UpdateOrganizationConfiguration), but they fire only in a platform/org
+ *     account; validate in a platform hardened cycle.
+ *
+ * NEVER DENY (completeness review verified these are LOAD-BEARING — the org
+ * security-services deploy CALLS them with AutoEnableOrganizationMembers:'ALL',
+ * so denying breaks a legitimate platform-org deploy):
+ *   • `securityhub:UpdateOrganizationConfiguration`
+ *   • `guardduty:UpdateOrganizationConfiguration`
+ */
+export declare const SECURITY_TIER_TO_BOUNDARY: Record<GovernancePreset, BoundaryStatement[]>;

package/dist/src/schemas/securityBoundary.js

@@ -0,0 +1 @@
+function t(c){return`FjallDeployBoundary${c}`}const e={Sid:"FjallInheritAdministratorAccess",Effect:"Allow",Action:"*",Resource:"*"},n=[{Sid:"FjallDenyOrgAndAccountEscape",Effect:"Deny",Action:["organizations:LeaveOrganization","account:CloseAccount"],Resource:"*"},{Sid:"FjallDenyDisableAuditLogging",Effect:"Deny",Action:["cloudtrail:StopLogging"],Resource:"*"},{Sid:"FjallDenyBoundarySelfEscape",Effect:"Deny",Action:["iam:DeleteRolePermissionsBoundary"],Resource:"*"},{Sid:"FjallDenyDisableKmsKey",Effect:"Deny",Action:["kms:DisableKey"],Resource:"*"}],o=[...n,{Sid:"FjallDenyStandingHumanCredentials",Effect:"Deny",Action:["iam:CreateUser","iam:CreateLoginProfile","iam:CreateAccessKey","iam:CreateAccountAlias"],Resource:"*"},{Sid:"FjallDenyDisableConfigRecorder",Effect:"Deny",Action:["config:StopConfigurationRecorder"],Resource:"*"}],i=[...o,{Sid:"FjallDenyAccountPasswordPolicyTamper",Effect:"Deny",Action:["iam:UpdateAccountPasswordPolicy","iam:DeleteAccountPasswordPolicy"],Resource:"*"},{Sid:"FjallDenyDisableDefaultEbsEncryption",Effect:"Deny",Action:["ec2:DisableEbsEncryptionByDefault"],Resource:"*"}],a={foundation:[e,...n],compliance:[e,...o],hardened:[e,...i]};export{a as SECURITY_TIER_TO_BOUNDARY,t as deployBoundaryName};

package/dist/src/validation/validationMessages.d.ts

@@ -27,8 +27,6 @@ export declare const VALIDATION_MESSAGES: Readonly<{
         readonly NAME: "Name is required";
         readonly USERNAME: "Username is required";
         readonly CONTAINER_NAME: "Container name is required";
-        readonly FIRST_NAME: "First name is required";
-        readonly LAST_NAME: "Last name is required";
         readonly GROUP: "Group is required";
         readonly PATTERN_NAME: "Pattern name is required";
         readonly ROUTING_PATH: "Routing path is required";

package/dist/src/validation/validationMessages.js

@@ -1 +1 @@
-import{SECRET_NAME_ERROR as e,SSM_COMPONENT_ERROR as t}from"@fjall/util";const n=Object.freeze({IDENTIFIER:"Must start with a letter, contain only letters, numbers, and hyphens",NEW_APP_NAME:"Must start with a lowercase letter and contain only lowercase letters, numbers, and hyphens",IDENTIFIER_MIN_LENGTH:"Must be at least 2 characters",IDENTIFIER_NO_TRAILING_HYPHEN:"Must not end with a hyphen",IDENTIFIER_NO_CONSECUTIVE_HYPHENS:"Must not contain consecutive hyphens",RESOURCE_NAME:"Must start with a letter and contain only letters and numbers (PascalCase recommended)",ECS_SERVICE_NAME:"Service name must start with a letter and contain only letters, numbers, and hyphens",BUCKET_NAME:"Bucket name must start with a lowercase letter and contain only lowercase letters, numbers, and hyphens",DATABASE_NAME:"Database name must start with a letter and contain only letters, numbers, and underscores",RESOURCE_TYPE:"Resource type must be in format 'category' or 'category:type'",SSM_PATH:"SSM path must start with / and contain valid namespace segments (e.g., /myapp/ApiCluster/service)",SECRET_NAME:e,SSM_COMPONENT:t,EMAIL:"Please enter a valid email address",DOMAIN:"Please enter a valid domain (e.g., cms.example.com)",DOCKER_IMAGE:"Invalid Docker image name format",REQUIRED:{APP_NAME:"Application name is required",RESOURCE_NAME:"Resource name is required",BUCKET_NAME:"Bucket name is required",SERVICE_NAME:"Service name is required",NETWORK_NAME:"Network name is required",DATABASE_NAME:"Database name is required",ORGANISATION_NAME:"Organisation name is required",EMAIL:"Email is required",NAME:"Name is required",USERNAME:"Username is required",CONTAINER_NAME:"Container name is required",FIRST_NAME:"First name is required",LAST_NAME:"Last name is required",GROUP:"Group is required",PATTERN_NAME:"Pattern name is required",ROUTING_PATH:"Routing path is required",RESOURCE_REFERENCE:"Resource reference is required",RESOURCE_TYPE:"Resource type is required",VARIANT:"Variant is required",SUBTYPE:"Subtype is required",DEPLOY_TARGET:"Deploy target is required",DESTROY_TARGET:"Destroy target is required"},MAX_LENGTH:{APP_NAME:"Application name must be 50 characters or less",RESOURCE_NAME:"Resource name must be 63 characters or less",BUCKET_NAME:"Bucket name must be 63 characters or less",SERVICE_NAME:"Service name must be 255 characters or less",NETWORK_NAME:"Network name must be 50 characters or less",DATABASE_NAME:"Database name must be 63 characters or less",ORGANISATION_NAME:"Organisation name must be 50 characters or less"},PORT:{INTEGER:"Port must be an integer",MIN:"Port must be at least 1",MAX:"Port cannot exceed 65535"},USERNAME:{MAX_LENGTH:"Username cannot exceed 63 characters"},LAMBDA:{MEMORY:{INTEGER:"Lambda memory must be an integer",MIN:"Memory must be at least 128 MB",MAX:"Memory cannot exceed 10240 MB",MULTIPLE:"Memory must be 128 MB or a multiple of 64 MB"},TIMEOUT:{INTEGER:"Timeout must be an integer",MIN:"Timeout must be at least 1 second",MAX:"Timeout cannot exceed 900 seconds"},RUNTIME:"Lambda runtime must contain only letters, digits, dots, underscores, or dashes (e.g. 'NODEJS_20_X' or 'nodejs20.x')"},ENV_VAR_NAME:"Environment variable names must start with a letter or underscore and contain only letters, digits, and underscores",PRIORITY:{INTEGER:"Priority must be an integer",MIN:"Priority must be at least 1",MAX:"Priority cannot exceed 50000"},CAPACITY:{MIN:{INTEGER:"Minimum capacity must be an integer",MIN_0:"Minimum capacity must be at least 0",MIN_1:"Minimum capacity must be at least 1",MAX:"Minimum capacity cannot exceed 100"},MAX:{INTEGER:"Maximum capacity must be an integer",MIN_0:"Maximum capacity must be at least 0",MIN_1:"Maximum capacity must be at least 1",MAX:"Maximum capacity cannot exceed 100"},DESIRED:{INTEGER:"Desired count must be an integer",MIN:"Desired count must be at least 0",MAX:"Desired count cannot exceed 100"},WARM_POOL_REQUIRED:"minCapacity 0 requires a warmPool \u2014 without it, new tasks wait 60-90s for a cold instance launch",WARM_POOL:{MIN_SIZE:{INTEGER:"Warm pool minSize must be an integer",MIN:"Warm pool minSize must be at least 0",MAX:"Warm pool minSize cannot exceed 100"},MIN_SIZE_EXCEEDS_MAX_CAPACITY:"warmPool.minSize cannot exceed maxCapacity \u2014 the warm pool cannot hold more instances than the ASG allows"}},MEMORY_LIMIT:{INTEGER:"Memory limit must be an integer",MIN_512:"Memory limit must be at least 512 MiB",MIN_128:"Memory limit must be at least 128 MiB",MAX:"Memory limit cannot exceed 30720 MiB"},DATABASE:{PORT:{INTEGER:"Database port must be an integer",MIN:"Database port must be at least 1024",MAX:"Database port cannot exceed 65535"},NAME:{REQUIRED:"Database name is required",MAX_LENGTH:"Database name must be 63 characters or less"}},BACKUP_RETENTION:{INTEGER:"Backup retention must be an integer",MIN:"Backup retention must be at least 1 day",MAX:"Backup retention cannot exceed 35 days"},SQS:{VISIBILITY_TIMEOUT:{INTEGER:"Visibility timeout must be an integer",MIN:"Visibility timeout must be at least 0 seconds",MAX:"Visibility timeout cannot exceed 43200 seconds (12 hours)"},RETENTION_PERIOD:{INTEGER:"Retention period must be an integer",MIN:"Retention period must be at least 60 seconds",MAX:"Retention period cannot exceed 1209600 seconds (14 days)"}},READER:{COUNT:{INTEGER:"Reader count must be an integer",MIN:"Reader count must be at least 0",MAX:"Reader count cannot exceed 15"}},IDENTIFIER_SUFFIX:{REQUIRED:"Identifier suffix is required when specified",MAX_LENGTH:"Identifier suffix cannot exceed 50 characters"},ROTATION:{INTEGER:"Rotation days must be an integer",MIN:"Rotation interval must be at least 1 day",MAX:"Rotation interval cannot exceed 365 days"},MAX_CONNECTIONS:{INTEGER:"Max connections must be an integer",MIN:"Max connections must be at least 1",MAX:"Max connections cannot exceed 100"},MONITORING_INTERVAL:{INTEGER:"Monitoring interval must be an integer",MIN:"Monitoring interval must be at least 0",MAX:"Monitoring interval cannot exceed 60 seconds",VALUES:"Monitoring interval must be 0, 1, 5, 10, 15, 30, or 60 seconds"},RETENTION_DAYS:{INTEGER:"Retention days must be an integer",MIN:"Retention days must be at least 1",MAX:"Retention days cannot exceed 365"},BATCH_SIZE:{INTEGER:"Batch size must be an integer",MIN:"Batch size must be at least 1",MAX:"Batch size cannot exceed 10000"},SERVICE:{UNIQUE_WITHIN_CLUSTER:"Service names must be unique within a cluster",MIN_REQUIRED:"At least one service is required",ROUTING_REQUIRED:"Multiple services with ports require routing config (path or host)"},PROXY_CONFIG:{MAX_IDLE_CONNECTIONS:{INTEGER:"Max idle connections must be an integer",MIN:"Max idle connections must be at least 0",MAX:"Max idle connections cannot exceed 100"},BORROW_TIMEOUT:{INTEGER:"Connection borrow timeout must be an integer",MIN:"Connection borrow timeout must be at least 1 second",MAX:"Connection borrow timeout cannot exceed 3600 seconds"}},MAX_AZS:{INTEGER:"Max AZs must be an integer",MIN:"Max AZs must be at least 1",MAX:"Max AZs cannot exceed 3"},BATCHING_WINDOW:{INTEGER:"Max batching window must be an integer",MIN:"Max batching window must be at least 0",MAX:"Max batching window cannot exceed 300 seconds"},HEALTH_CHECK:{INTERVAL:{INTEGER:"Health check interval must be an integer",MIN:"Health check interval must be at least 5 seconds",MAX:"Health check interval cannot exceed 300 seconds"},TIMEOUT:{INTEGER:"Health check timeout must be an integer",MIN:"Health check timeout must be at least 2 seconds",MAX:"Health check timeout cannot exceed 60 seconds"},RETRIES:{INTEGER:"Health check retries must be an integer",MIN:"Health check retries must be at least 1",MAX:"Health check retries cannot exceed 10"},START_PERIOD:{INTEGER:"Health check start period must be an integer",MIN:"Health check start period must be at least 0 seconds",MAX:"Health check start period cannot exceed 300 seconds"}},EPHEMERAL_STORAGE:{INTEGER:"Ephemeral storage size must be an integer",MIN:"Ephemeral storage size must be at least 512 MB",MAX:"Ephemeral storage size cannot exceed 10240 MB"},MAX_MESSAGE_SIZE:{INTEGER:"Max message size must be an integer",MIN:"Max message size must be at least 1024 bytes",MAX:"Max message size cannot exceed 262144 bytes (256 KB)"},CAPACITY_CONSTRAINT:{MIN_LTE_MAX:"minCapacity must be less than or equal to maxCapacity"},DIRECT_ACCESS:{NO_DOMAIN:"directAccess cannot be used with domain (no ALB for HTTPS)",NO_LOAD_BALANCER:"directAccess cannot be used with loadBalancer (mutually exclusive)"},GLOBAL_AURORA:{PRIMARY_REGION_REQUIRED:"primaryRegion is required for GlobalAurora databases"},NAT_GATEWAY:{INTEGER:"NAT gateway count must be an integer",MIN:"NAT gateway count must be at least 0",MAX:"NAT gateway count cannot exceed 3"},CIDR_MASK:{INTEGER:"CIDR mask must be an integer",MIN:"CIDR mask must be at least 16",MAX:"CIDR mask cannot exceed 28"},CPU:{INTEGER:"CPU must be an integer",MIN:"CPU must be at least 256 units",MAX:"CPU cannot exceed 4096 units"},KMS:{KEY_REQUIRED:"KMS key ARN is required when using KMS encryption"},READER_INSTANCES:{MAX:"Cannot have more than 15 reader instances",COUNT_OR_INSTANCES:"Cannot specify both 'count' and 'instances' - use one or the other"},GENERATOR_CAPACITY:{MIN:{MIN:"Minimum capacity must be at least 1",MAX:"Minimum capacity cannot exceed 1000"},MAX:{MIN:"Maximum capacity must be at least 1",MAX:"Maximum capacity cannot exceed 1000"}},INSTANCE_TYPE:"Unknown instance type. Common types include: t4g.micro, t4g.small, m5.large",ARCHITECTURE_MISMATCH:"Architecture mismatch between instance type and AMI",ALLOCATED_STORAGE:{INTEGER:"Allocated storage must be an integer",MIN:"Allocated storage must be at least 20 GB",MAX:"Allocated storage cannot exceed 65536 GB"},DLQ:{MAX_RECEIVE_COUNT:{INTEGER:"Max receive count must be an integer",MIN:"Max receive count must be at least 1",MAX:"Max receive count cannot exceed 1000"}},ALARM:{PERCENTAGE:{MIN:"Threshold must be at least 1%",MAX:"Threshold must be at most 100%"},FREE_STORAGE_GIB:{MIN:"Free storage threshold must be at least 1 GiB"}},REGION:"Invalid AWS region",PASCAL_CASE:"Resource name must start with an uppercase letter and contain only alphanumerics (PascalCase).",IMAGE_DOCKER_MUTEX:"image and docker are mutually exclusive",AWS_ACCOUNT_ID:"AWS account id must be exactly 12 digits (no hyphens)",VPC_ID:"VPC id must look like vpc-abc12345",ROLE_ARN:"Role ARN must have the form arn:aws:iam::<account-id>:role/<name>",CIDR:"CIDR must be in dotted-quad/prefix-length form (e.g. 10.0.0.0/16)",VPC_PEER:{MIN_REQUESTER_ACCOUNTS:"At least one requester account id is required",REGION_REQUIRED:"Peer region is required when specified",ROUTE_TABLE_ID_REQUIRED:"Route table id must not be empty"},SCHEDULE_EXPRESSION:"Schedule expression must be 'rate(N minute|minutes|hour|hours|day|days)' with N>=1, or 'cron(<6-field AWS expression>)'"});export{n as VALIDATION_MESSAGES};
+import{SECRET_NAME_ERROR as e,SSM_COMPONENT_ERROR as t}from"@fjall/util";const n=Object.freeze({IDENTIFIER:"Must start with a letter, contain only letters, numbers, and hyphens",NEW_APP_NAME:"Must start with a lowercase letter and contain only lowercase letters, numbers, and hyphens",IDENTIFIER_MIN_LENGTH:"Must be at least 2 characters",IDENTIFIER_NO_TRAILING_HYPHEN:"Must not end with a hyphen",IDENTIFIER_NO_CONSECUTIVE_HYPHENS:"Must not contain consecutive hyphens",RESOURCE_NAME:"Must start with a letter and contain only letters and numbers (PascalCase recommended)",ECS_SERVICE_NAME:"Service name must start with a letter and contain only letters, numbers, and hyphens",BUCKET_NAME:"Bucket name must start with a lowercase letter and contain only lowercase letters, numbers, and hyphens",DATABASE_NAME:"Database name must start with a letter and contain only letters, numbers, and underscores",RESOURCE_TYPE:"Resource type must be in format 'category' or 'category:type'",SSM_PATH:"SSM path must start with / and contain valid namespace segments (e.g., /myapp/ApiCluster/service)",SECRET_NAME:e,SSM_COMPONENT:t,EMAIL:"Please enter a valid email address",DOMAIN:"Please enter a valid domain (e.g., cms.example.com)",DOCKER_IMAGE:"Invalid Docker image name format",REQUIRED:{APP_NAME:"Application name is required",RESOURCE_NAME:"Resource name is required",BUCKET_NAME:"Bucket name is required",SERVICE_NAME:"Service name is required",NETWORK_NAME:"Network name is required",DATABASE_NAME:"Database name is required",ORGANISATION_NAME:"Organisation name is required",EMAIL:"Email is required",NAME:"Name is required",USERNAME:"Username is required",CONTAINER_NAME:"Container name is required",GROUP:"Group is required",PATTERN_NAME:"Pattern name is required",ROUTING_PATH:"Routing path is required",RESOURCE_REFERENCE:"Resource reference is required",RESOURCE_TYPE:"Resource type is required",VARIANT:"Variant is required",SUBTYPE:"Subtype is required",DEPLOY_TARGET:"Deploy target is required",DESTROY_TARGET:"Destroy target is required"},MAX_LENGTH:{APP_NAME:"Application name must be 50 characters or less",RESOURCE_NAME:"Resource name must be 63 characters or less",BUCKET_NAME:"Bucket name must be 63 characters or less",SERVICE_NAME:"Service name must be 255 characters or less",NETWORK_NAME:"Network name must be 50 characters or less",DATABASE_NAME:"Database name must be 63 characters or less",ORGANISATION_NAME:"Organisation name must be 50 characters or less"},PORT:{INTEGER:"Port must be an integer",MIN:"Port must be at least 1",MAX:"Port cannot exceed 65535"},USERNAME:{MAX_LENGTH:"Username cannot exceed 63 characters"},LAMBDA:{MEMORY:{INTEGER:"Lambda memory must be an integer",MIN:"Memory must be at least 128 MB",MAX:"Memory cannot exceed 10240 MB",MULTIPLE:"Memory must be 128 MB or a multiple of 64 MB"},TIMEOUT:{INTEGER:"Timeout must be an integer",MIN:"Timeout must be at least 1 second",MAX:"Timeout cannot exceed 900 seconds"},RUNTIME:"Lambda runtime must contain only letters, digits, dots, underscores, or dashes (e.g. 'NODEJS_20_X' or 'nodejs20.x')"},ENV_VAR_NAME:"Environment variable names must start with a letter or underscore and contain only letters, digits, and underscores",PRIORITY:{INTEGER:"Priority must be an integer",MIN:"Priority must be at least 1",MAX:"Priority cannot exceed 50000"},CAPACITY:{MIN:{INTEGER:"Minimum capacity must be an integer",MIN_0:"Minimum capacity must be at least 0",MIN_1:"Minimum capacity must be at least 1",MAX:"Minimum capacity cannot exceed 100"},MAX:{INTEGER:"Maximum capacity must be an integer",MIN_0:"Maximum capacity must be at least 0",MIN_1:"Maximum capacity must be at least 1",MAX:"Maximum capacity cannot exceed 100"},DESIRED:{INTEGER:"Desired count must be an integer",MIN:"Desired count must be at least 0",MAX:"Desired count cannot exceed 100"},WARM_POOL_REQUIRED:"minCapacity 0 requires a warmPool \u2014 without it, new tasks wait 60-90s for a cold instance launch",WARM_POOL:{MIN_SIZE:{INTEGER:"Warm pool minSize must be an integer",MIN:"Warm pool minSize must be at least 0",MAX:"Warm pool minSize cannot exceed 100"},MIN_SIZE_EXCEEDS_MAX_CAPACITY:"warmPool.minSize cannot exceed maxCapacity \u2014 the warm pool cannot hold more instances than the ASG allows"}},MEMORY_LIMIT:{INTEGER:"Memory limit must be an integer",MIN_512:"Memory limit must be at least 512 MiB",MIN_128:"Memory limit must be at least 128 MiB",MAX:"Memory limit cannot exceed 30720 MiB"},DATABASE:{PORT:{INTEGER:"Database port must be an integer",MIN:"Database port must be at least 1024",MAX:"Database port cannot exceed 65535"},NAME:{REQUIRED:"Database name is required",MAX_LENGTH:"Database name must be 63 characters or less"}},BACKUP_RETENTION:{INTEGER:"Backup retention must be an integer",MIN:"Backup retention must be at least 1 day",MAX:"Backup retention cannot exceed 35 days"},SQS:{VISIBILITY_TIMEOUT:{INTEGER:"Visibility timeout must be an integer",MIN:"Visibility timeout must be at least 0 seconds",MAX:"Visibility timeout cannot exceed 43200 seconds (12 hours)"},RETENTION_PERIOD:{INTEGER:"Retention period must be an integer",MIN:"Retention period must be at least 60 seconds",MAX:"Retention period cannot exceed 1209600 seconds (14 days)"}},READER:{COUNT:{INTEGER:"Reader count must be an integer",MIN:"Reader count must be at least 0",MAX:"Reader count cannot exceed 15"}},IDENTIFIER_SUFFIX:{REQUIRED:"Identifier suffix is required when specified",MAX_LENGTH:"Identifier suffix cannot exceed 50 characters"},ROTATION:{INTEGER:"Rotation days must be an integer",MIN:"Rotation interval must be at least 1 day",MAX:"Rotation interval cannot exceed 365 days"},MAX_CONNECTIONS:{INTEGER:"Max connections must be an integer",MIN:"Max connections must be at least 1",MAX:"Max connections cannot exceed 100"},MONITORING_INTERVAL:{INTEGER:"Monitoring interval must be an integer",MIN:"Monitoring interval must be at least 0",MAX:"Monitoring interval cannot exceed 60 seconds",VALUES:"Monitoring interval must be 0, 1, 5, 10, 15, 30, or 60 seconds"},RETENTION_DAYS:{INTEGER:"Retention days must be an integer",MIN:"Retention days must be at least 1",MAX:"Retention days cannot exceed 365"},BATCH_SIZE:{INTEGER:"Batch size must be an integer",MIN:"Batch size must be at least 1",MAX:"Batch size cannot exceed 10000"},SERVICE:{UNIQUE_WITHIN_CLUSTER:"Service names must be unique within a cluster",MIN_REQUIRED:"At least one service is required",ROUTING_REQUIRED:"Multiple services with ports require routing config (path or host)"},PROXY_CONFIG:{MAX_IDLE_CONNECTIONS:{INTEGER:"Max idle connections must be an integer",MIN:"Max idle connections must be at least 0",MAX:"Max idle connections cannot exceed 100"},BORROW_TIMEOUT:{INTEGER:"Connection borrow timeout must be an integer",MIN:"Connection borrow timeout must be at least 1 second",MAX:"Connection borrow timeout cannot exceed 3600 seconds"}},MAX_AZS:{INTEGER:"Max AZs must be an integer",MIN:"Max AZs must be at least 1",MAX:"Max AZs cannot exceed 3"},BATCHING_WINDOW:{INTEGER:"Max batching window must be an integer",MIN:"Max batching window must be at least 0",MAX:"Max batching window cannot exceed 300 seconds"},HEALTH_CHECK:{INTERVAL:{INTEGER:"Health check interval must be an integer",MIN:"Health check interval must be at least 5 seconds",MAX:"Health check interval cannot exceed 300 seconds"},TIMEOUT:{INTEGER:"Health check timeout must be an integer",MIN:"Health check timeout must be at least 2 seconds",MAX:"Health check timeout cannot exceed 60 seconds"},RETRIES:{INTEGER:"Health check retries must be an integer",MIN:"Health check retries must be at least 1",MAX:"Health check retries cannot exceed 10"},START_PERIOD:{INTEGER:"Health check start period must be an integer",MIN:"Health check start period must be at least 0 seconds",MAX:"Health check start period cannot exceed 300 seconds"}},EPHEMERAL_STORAGE:{INTEGER:"Ephemeral storage size must be an integer",MIN:"Ephemeral storage size must be at least 512 MB",MAX:"Ephemeral storage size cannot exceed 10240 MB"},MAX_MESSAGE_SIZE:{INTEGER:"Max message size must be an integer",MIN:"Max message size must be at least 1024 bytes",MAX:"Max message size cannot exceed 262144 bytes (256 KB)"},CAPACITY_CONSTRAINT:{MIN_LTE_MAX:"minCapacity must be less than or equal to maxCapacity"},DIRECT_ACCESS:{NO_DOMAIN:"directAccess cannot be used with domain (no ALB for HTTPS)",NO_LOAD_BALANCER:"directAccess cannot be used with loadBalancer (mutually exclusive)"},GLOBAL_AURORA:{PRIMARY_REGION_REQUIRED:"primaryRegion is required for GlobalAurora databases"},NAT_GATEWAY:{INTEGER:"NAT gateway count must be an integer",MIN:"NAT gateway count must be at least 0",MAX:"NAT gateway count cannot exceed 3"},CIDR_MASK:{INTEGER:"CIDR mask must be an integer",MIN:"CIDR mask must be at least 16",MAX:"CIDR mask cannot exceed 28"},CPU:{INTEGER:"CPU must be an integer",MIN:"CPU must be at least 256 units",MAX:"CPU cannot exceed 4096 units"},KMS:{KEY_REQUIRED:"KMS key ARN is required when using KMS encryption"},READER_INSTANCES:{MAX:"Cannot have more than 15 reader instances",COUNT_OR_INSTANCES:"Cannot specify both 'count' and 'instances' - use one or the other"},GENERATOR_CAPACITY:{MIN:{MIN:"Minimum capacity must be at least 1",MAX:"Minimum capacity cannot exceed 1000"},MAX:{MIN:"Maximum capacity must be at least 1",MAX:"Maximum capacity cannot exceed 1000"}},INSTANCE_TYPE:"Unknown instance type. Common types include: t4g.micro, t4g.small, m5.large",ARCHITECTURE_MISMATCH:"Architecture mismatch between instance type and AMI",ALLOCATED_STORAGE:{INTEGER:"Allocated storage must be an integer",MIN:"Allocated storage must be at least 20 GB",MAX:"Allocated storage cannot exceed 65536 GB"},DLQ:{MAX_RECEIVE_COUNT:{INTEGER:"Max receive count must be an integer",MIN:"Max receive count must be at least 1",MAX:"Max receive count cannot exceed 1000"}},ALARM:{PERCENTAGE:{MIN:"Threshold must be at least 1%",MAX:"Threshold must be at most 100%"},FREE_STORAGE_GIB:{MIN:"Free storage threshold must be at least 1 GiB"}},REGION:"Invalid AWS region",PASCAL_CASE:"Resource name must start with an uppercase letter and contain only alphanumerics (PascalCase).",IMAGE_DOCKER_MUTEX:"image and docker are mutually exclusive",AWS_ACCOUNT_ID:"AWS account id must be exactly 12 digits (no hyphens)",VPC_ID:"VPC id must look like vpc-abc12345",ROLE_ARN:"Role ARN must have the form arn:aws:iam::<account-id>:role/<name>",CIDR:"CIDR must be in dotted-quad/prefix-length form (e.g. 10.0.0.0/16)",VPC_PEER:{MIN_REQUESTER_ACCOUNTS:"At least one requester account id is required",REGION_REQUIRED:"Peer region is required when specified",ROUTE_TABLE_ID_REQUIRED:"Route table id must not be empty"},SCHEDULE_EXPRESSION:"Schedule expression must be 'rate(N minute|minutes|hour|hours|day|days)' with N>=1, or 'cron(<6-field AWS expression>)'"});export{n as VALIDATION_MESSAGES};

package/dist/src/version.d.ts

@@ -1 +1 @@
-export declare const GENERATOR_VERSION = "2.23.0";
+export declare const GENERATOR_VERSION = "2.23.1";

package/dist/src/version.js

@@ -1 +1 @@
-const E="2.23.0";export{E as GENERATOR_VERSION};
+const E="2.23.1";export{E as GENERATOR_VERSION};

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@fjall/generator",
-  "version": "2.23.1",
+  "version": "2.24.0",
   "description": "Pure infrastructure generation logic for Fjall",
   "type": "module",
   "main": "dist/src/index.js",
@@ -47,7 +47,7 @@
   },
   "license": "SEE LICENSE IN LICENSE",
   "dependencies": {
-    "@fjall/util": "^2.23.1",
+    "@fjall/util": "^2.24.0",
     "ast-types": "^0.16.1",
     "recast": "^0.23.11",
     "ts-morph": "^28.0.0",
@@ -63,5 +63,5 @@
     "typescript-eslint": "^8.59.1",
     "vitest": "^4.1.5"
   },
-  "gitHead": "749133c6c5cfe24a09a401869f2193c7d177a324"
+  "gitHead": "616d7af846f0eebfa3409f5f47c98fbee836bad9"
 }