@fjall/util 14.0.0 → 14.2.0

package/dist/.build-source-hash

@@ -9,7 +9,7 @@
     "package.json",
     "tsconfig.json"
   ],
-  "hash": "341946842f29ac978c5e64acaf6306bda9c2f241b9fe4ef46e3d72346dcd258c",
+  "hash": "0e78a44ce0b1b8f076fb13ac7479e40ec00f8cf5c6d8d621ea022491817503d2",
   "files": {
     "src/async/concurrency.ts": "3c7ebe0222a720f9",
     "src/async/singleton.ts": "7bcc21b0fb920561",
@@ -67,12 +67,12 @@
     "src/fsHelpers.ts": "0869d9739d523572",
     "src/fsScan.ts": "feb187758481443f",
     "src/httpKeepAlive.ts": "c8fe4b118ef4c79f",
-    "src/index.ts": "cdad78f5609b53dc",
+    "src/index.ts": "30d1b34d958e8737",
     "src/infra/backupVault.ts": "661678a6dfb0b648",
     "src/infra/connectionsWire.ts": "125c099da0e17ac1",
     "src/infra/deployArtefacts.ts": "235ac21dd3ccf0b2",
     "src/infra/deriveContentHashTag.ts": "115fbe6588794027",
-    "src/infra/domainExports.ts": "6a6ae87e93e12523",
+    "src/infra/domainExports.ts": "23be88ac8666e1ec",
     "src/infra/imageTags.ts": "82d14f3dfd6ca68f",
     "src/infra/regions.ts": "26b80d7cea05454c",
     "src/infra/tokenScopes.ts": "88c6a1f0da3fa491",
@@ -110,9 +110,9 @@
     "src/securityHelpers.ts": "3f78606079c8f45e",
     "src/targets.ts": "126280f0a5762e21",
     "../scripts/minify-dist.mjs": "6b2e4b0df8aec601",
-    "package.json": "d5f18e7bca9376a5",
+    "package.json": "05ab5d34224f7e27",
     "tsconfig.json": "db759831ad95f396"
   },
-  "outputHash": "7812b1a8244457a3088f8332173824606c745851d959f416339704edb74c9805",
+  "outputHash": "e6b5f17d1ac1a4e0f2260c6ee7f17fbe199aadc74233a9f8964e135907d4dbd7",
   "outputFileCount": 203
 }

package/dist/.minified

@@ -1 +1 @@
-101 files minified at 2026-08-17T02:03:50.046Z
+101 files minified at 2026-08-18T14:32:50.559Z

package/dist/index.d.ts

@@ -1,4 +1,4 @@
-export { DNS_APEX, getDomainExportNames, getDomainStackName, getDomainUsEast1CertificatesStackName, isManagedDomainBinding, DOMAIN_DEPLOY_DEFAULT_PHASE, type DomainDeployPhase, type ManagedDomainBinding, type ManagedDomainExports } from "./infra/domainExports.js";
+export { DNS_APEX, getDomainExportNames, getDomainStackName, getDomainUsEast1CertificatesStackName, isManagedDomainBinding, DOMAIN_DEPLOY_DEFAULT_PHASE, type DomainDeployPhase, type ManagedDomainBinding, type ManagedDomainCoverage, type ManagedDomainExports } from "./infra/domainExports.js";
 export { BACKUP_VAULT_NAME } from "./infra/backupVault.js";
 export { APPROVAL_TOKEN_OUTPUT_PREFIX, TOKEN_STDERR_PREFIX } from "./deploy/approvalTokenOutput.js";
 export { imageTagParameterName } from "./infra/imageTags.js";

package/dist/infra/domainExports.d.ts

@@ -51,7 +51,9 @@ export declare const DOMAIN_DEPLOY_DEFAULT_PHASE: DomainDeployPhase;
 export declare function getDomainExportNames(domainName: string): {
     hostedZoneId: string;
     certificateArn: string;
+    certificateHosts: string;
     usEast1CertificateArn: string;
+    usEast1CertificateHosts: string;
     delegationRoleArn: string;
     nameservers: string;
 };
@@ -85,6 +87,25 @@ export interface ManagedDomainBinding {
     /** Parent DelegationRole ARN for child-writes NS delegation (D8), always literal. */
     delegationRoleArn?: string;
 }
+/**
+ * Certificate-coverage companion to {@link ManagedDomainBinding} (design
+ * 2026-08-18 cdn-app-origin, D5). Carries the hostnames covered by exactly
+ * the two certificates the binding names — `certificateHosts` for
+ * `certificateArn`, `usEast1CertificateHosts` for `usEast1CertificateArn` —
+ * read from the domain stack's per-certificate hosts outputs. Injected as a
+ * SEPARATE context key (`fjall:managedDomainCoverage:<zone>`), never folded
+ * into the binding JSON: the binding parser fails closed on unknown fields,
+ * so extending the binding would break older-engine synths fed by a newer
+ * CLI, while a separate key is invisible to them by construction. A field is
+ * absent when the domain stack predates the hosts outputs — consumers must
+ * treat absence as coverage-unknown (warn), never as not-covered.
+ */
+export interface ManagedDomainCoverage {
+    /** Hostnames covered by the binding's regional `certificateArn`. */
+    certificateHosts?: string[];
+    /** Hostnames covered by the binding's `usEast1CertificateArn` (D3). */
+    usEast1CertificateHosts?: string[];
+}
 /**
  * Discriminate a `ManagedDomainExports | ManagedDomainBinding` union so
  * constructs accepting `managedDomain` can branch: a binding carries the

package/dist/infra/domainExports.js

@@ -1 +1 @@
-var r=Object.defineProperty;var n=(e,t)=>r(e,"name",{value:t,configurable:!0});import{toPascalCase as a}from"../naming/caseConversion.js";const s="@";function c(e){return`${a(e.split(".").join(""))}Domain`}n(c,"getDomainStackName");function f(e){return`${e}UsEast1Certificates`}n(f,"getDomainUsEast1CertificatesStackName");const m="full";function p(e){const t=e.replace(/\./g,"-");return{hostedZoneId:`${t}-hosted-zone-id`,certificateArn:`${t}-certificate-arn`,usEast1CertificateArn:`${t}-us-east-1-certificate-arn`,delegationRoleArn:`${t}-delegation-role-arn`,nameservers:`${t}-nameservers`}}n(p,"getDomainExportNames");function u(e){return typeof e.hostedZoneId=="string"}n(u,"isManagedDomainBinding");export{s as DNS_APEX,m as DOMAIN_DEPLOY_DEFAULT_PHASE,p as getDomainExportNames,c as getDomainStackName,f as getDomainUsEast1CertificatesStackName,u as isManagedDomainBinding};
+var r=Object.defineProperty;var a=(t,e)=>r(t,"name",{value:e,configurable:!0});import{toPascalCase as i}from"../naming/caseConversion.js";const o="@";function c(t){return`${i(t.split(".").join(""))}Domain`}a(c,"getDomainStackName");function f(t){return`${t}UsEast1Certificates`}a(f,"getDomainUsEast1CertificatesStackName");const u="full";function m(t){const e=t.replace(/\./g,"-");return{hostedZoneId:`${e}-hosted-zone-id`,certificateArn:`${e}-certificate-arn`,certificateHosts:`${e}-certificate-hosts`,usEast1CertificateArn:`${e}-us-east-1-certificate-arn`,usEast1CertificateHosts:`${e}-us-east-1-certificate-hosts`,delegationRoleArn:`${e}-delegation-role-arn`,nameservers:`${e}-nameservers`}}a(m,"getDomainExportNames");function p(t){return typeof t.hostedZoneId=="string"}a(p,"isManagedDomainBinding");export{o as DNS_APEX,u as DOMAIN_DEPLOY_DEFAULT_PHASE,m as getDomainExportNames,c as getDomainStackName,f as getDomainUsEast1CertificatesStackName,p as isManagedDomainBinding};

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@fjall/util",
-  "version": "14.0.0",
+  "version": "14.2.0",
   "repository": {
     "type": "git",
     "url": "git+https://github.com/fjall-tech/fjall.git",