@fjall/util 14.1.0 → 14.3.0

package/dist/.build-source-hash

@@ -9,7 +9,7 @@
     "package.json",
     "tsconfig.json"
   ],
-  "hash": "9ba5f8462c4c5f005ba61e0d6e5f8f1d5c4737b6b20f8f0e66ad1d5f6fcb9372",
+  "hash": "2456ccf71d3121abba35dc43ada91128a5768e0545b4f30d1afed9e096d19f64",
   "files": {
     "src/async/concurrency.ts": "3c7ebe0222a720f9",
     "src/async/singleton.ts": "7bcc21b0fb920561",
@@ -67,12 +67,12 @@
     "src/fsHelpers.ts": "0869d9739d523572",
     "src/fsScan.ts": "feb187758481443f",
     "src/httpKeepAlive.ts": "c8fe4b118ef4c79f",
-    "src/index.ts": "cdad78f5609b53dc",
+    "src/index.ts": "46bfe8f90ef630f6",
     "src/infra/backupVault.ts": "661678a6dfb0b648",
     "src/infra/connectionsWire.ts": "125c099da0e17ac1",
     "src/infra/deployArtefacts.ts": "235ac21dd3ccf0b2",
     "src/infra/deriveContentHashTag.ts": "115fbe6588794027",
-    "src/infra/domainExports.ts": "6a6ae87e93e12523",
+    "src/infra/domainExports.ts": "18de5b8668633aaf",
     "src/infra/imageTags.ts": "82d14f3dfd6ca68f",
     "src/infra/regions.ts": "26b80d7cea05454c",
     "src/infra/tokenScopes.ts": "88c6a1f0da3fa491",
@@ -110,9 +110,9 @@
     "src/securityHelpers.ts": "3f78606079c8f45e",
     "src/targets.ts": "126280f0a5762e21",
     "../scripts/minify-dist.mjs": "6b2e4b0df8aec601",
-    "package.json": "76d445ee30fe22a0",
+    "package.json": "ae34b72bd0d3d155",
     "tsconfig.json": "db759831ad95f396"
   },
-  "outputHash": "56ec5530931e99e606abcd810bb468f515fe1c94e836fa33623ba7c6d581e3b8",
+  "outputHash": "97f3a228e9c39812f68ded3882b03cbab3a65e26ab255fbd8a51359dbedeb46e",
   "outputFileCount": 203
 }

package/dist/.minified

@@ -1 +1 @@
-101 files minified at 2026-08-17T10:21:54.082Z
+101 files minified at 2026-08-20T22:18:47.242Z

package/dist/index.d.ts

@@ -1,4 +1,4 @@
-export { DNS_APEX, getDomainExportNames, getDomainStackName, getDomainUsEast1CertificatesStackName, isManagedDomainBinding, DOMAIN_DEPLOY_DEFAULT_PHASE, type DomainDeployPhase, type ManagedDomainBinding, type ManagedDomainExports } from "./infra/domainExports.js";
+export { DNS_APEX, getDomainExportNames, getDomainStackName, getDomainUsEast1CertificatesStackName, hostsExportPartName, serialiseHostsChunks, HOSTS_OUTPUT_MAX_BYTES, isManagedDomainBinding, DOMAIN_DEPLOY_DEFAULT_PHASE, type DomainDeployPhase, type ManagedDomainBinding, type ManagedDomainCoverage, type ManagedDomainExports } from "./infra/domainExports.js";
 export { BACKUP_VAULT_NAME } from "./infra/backupVault.js";
 export { APPROVAL_TOKEN_OUTPUT_PREFIX, TOKEN_STDERR_PREFIX } from "./deploy/approvalTokenOutput.js";
 export { imageTagParameterName } from "./infra/imageTags.js";

package/dist/index.js

@@ -1 +1 @@
-import{DNS_APEX as r,getDomainExportNames as t,getDomainStackName as o,getDomainUsEast1CertificatesStackName as _,isManagedDomainBinding as a,DOMAIN_DEPLOY_DEFAULT_PHASE as A}from"./infra/domainExports.js";import{BACKUP_VAULT_NAME as T}from"./infra/backupVault.js";import{APPROVAL_TOKEN_OUTPUT_PREFIX as i,TOKEN_STDERR_PREFIX as R}from"./deploy/approvalTokenOutput.js";import{imageTagParameterName as m}from"./infra/imageTags.js";import{toPascalCase as P,toKebab as C,toValidDatabaseName as s,toScreamingSnake as p,capitalise as c,getSafeZoneName as I,accountConstructKey as D,hasAsciiStableConstructKey as f}from"./naming/caseConversion.js";import{albDnsExportName as L,albHostedZoneIdExportName as l,cdnDomainExportName as u,bucketWebsiteEndpointExportName as g,bucketWebsiteHostedZoneIdExportName as d}from"./naming/targetExportNames.js";import{CAPACITY_SLOT_PATTERN as x,CAPACITY_SLOT_MAX_LENGTH as F,DEFAULT_CAPACITY_SLOT as h,CAPACITY_ANCHOR_PATTERN as V,CAPACITY_ANCHOR_MAX_LENGTH as y,CAPACITY_IDENTITY_CONTEXT_KEY as Y,CapacityIdentityPinSchema as G,CapacityIdentityWireSchema as v,CapacityIdentityConfigSchema as H,projectCapacityIdentityToTarget as b}from"./capacityIdentity.js";import{findAccountNameCollision as K}from"./naming/accountNameCollision.js";import{defaultConnectedAccountName as W,suffixedAccountName as k,REGION_SHORT_CODES as Z,findTrailingRegionShortCode as j,regionSuffixRejectionMessage as w}from"./naming/connectedAccountName.js";import{normaliseError as Q,getErrorMessage as q,hasErrorCode as J,getErrorCode as $,getErrorStack as ee,formatErrorString as Ee}from"./errorUtils.js";import{singleton as te}from"./async/singleton.js";import{DANGEROUS_ENV_VARS as _e,filterDangerousEnvVars as ae,MASKED_VALUE_MARKER as Ae,maskSensitiveOutput as Se,parseShellArgs as Te,REDACTED_KEY_SENTINEL as ne,SCOPED_TOKEN_REGEX as ie}from"./securityHelpers.js";import{sleep as Ne}from"./async/sleep.js";import{mapSettledWithConcurrency as Oe}from"./async/concurrency.js";import{ACCOUNT_STAGES_WITH_ROOT as Ce,STRUCTURAL_ENVIRONMENTS as se,ACCOUNT_STAGES as pe,ACCOUNT_STAGE_LABELS as ce,isAccountStage as Ie,ACCOUNT_TIERS as De,AccountTierSchema as fe,isAccountTier as Me,GOVERNANCE_ACCOUNT_TIERS as Le,isGovernanceTier as le,environmentToTier as ue,stageFromWireEnvironment as ge,accountTier as de,resolveSynthEnvironment as Ue,getEnvironmentLabel as xe,ACCOUNT_ROLES as Fe}from"./environments.js";import{RESOURCE_CATEGORIES as Ve,categoriseResource as ye,getExpectedDuration as Ye,getFriendlyResourceType as Ge}from"./resourceCategorisation.js";import{parseGitRemoteUrl as He}from"./repo/gitRemoteParser.js";import{abbreviateRegion as Xe,AWS_REGIONS_METADATA as Ke,DEFAULT_REGION as Be,getRegionInfo as We,MAX_SECONDARY_REGIONS as ke,OPT_IN_REGION_CODES as Ze,optInRegionWarning as je,regions as we,suggestRegionForTimezone as ze}from"./infra/regions.js";import{SCOPE_VALUES as qe,MACHINE_ONLY_SCOPES as Je,USER_GRANTABLE_SCOPES as $e,GOVERNANCE_SCOPE_REQUIRED_CODE as eE}from"./infra/tokenScopes.js";import{SECRET_NAME_PATTERN as rE,SECRET_NAME_ERROR as tE,SSM_COMPONENT_PATTERN as oE,SSM_COMPONENT_ERROR as _E,SSM_STANDARD_MAX_VALUE_BYTES as aE,SecretNamespaceSchema as AE,buildNamespaceParts as SE,buildParameterPath as TE,parseParameterPath as nE,isManageablePath as iE,parseDotEnv as RE,escapeDotEnvValue as NE}from"./secrets.js";import{ConnectionWireSchema as OE,ConnectionsListResponseSchema as PE}from"./infra/connectionsWire.js";import{deriveRegionsFromOrgConfig as sE,deriveTargets as pE,deriveAllTargets as cE,environmentOrTier as IE,findTarget as DE,generateTargetName as fE}from"./targets.js";import{buildAppConfigPath as LE}from"./repo/appPath.js";import{findInfrastructurePaths as uE,findBoundaryPath as gE,isInfrastructureFile as dE}from"./repo/findInfrastructurePaths.js";import{inferContainerFromCandidates as xE}from"./repo/inferContainerFromCandidates.js";import{RESERVED_APP_NAMES as hE,RESERVED_APP_NAME_MESSAGE as VE,isReservedAppName as yE,RESERVED_APP_NAME_SUFFIX as YE,RESERVED_APP_NAME_SUFFIX_MESSAGE as GE,hasReservedAppNameSuffix as vE}from"./naming/reservedAppNames.js";import{deriveContentHashTag as bE,CONTENT_HASH_TAG_PATTERN as XE}from"./infra/deriveContentHashTag.js";import{DEPLOY_MODES as BE,DeployModeSchema as WE,IMAGE_TAG_PATTERN as kE,ImageTagSchema as ZE,ServiceArtefactSchema as jE,ServiceArtefactsSchema as wE,ARTEFACT_OUTPUT_FIELDS as zE,artefactOutputKey as QE}from"./infra/deployArtefacts.js";import{MIGRATION_SNAPSHOT_NAME_PREFIX as JE,EXPECTED_SCHEMA_VERSION_ENV as $E,EXPECTED_SCHEMA_VERSION_TOOL_ENV as er,EXPECTED_CH_SCHEMA_VERSION_ENV as Er,SCHEMA_ADMIN_USER_ENV as rr,SCHEMA_ADMIN_PASSWORD_ENV as tr,PRISMA_MIGRATION_DIR_RE as or,CLICKHOUSE_MIGRATION_SKIP_RE as _r}from"./migration/constants.js";import{PHYSICAL_NAME_FALLBACK_PROPERTIES as Ar}from"./cfn/physicalNameProperties.js";import{PATTERN_TYPE_VALUES as Tr,PATTERN_TYPES as nr,isPatternType as ir,PATTERN_REGISTRY as Rr,patternConstructId as Nr,DEPLOYABLE_PATTERN_TYPES as mr,OPENNEXT_PATTERN_TYPES as Or,isOpenNextPatternType as Pr,STATIC_SITE_ROUTING_VALUES as Cr}from"./patterns/patternTypes.js";import{DEFAULT_FORMS_FROM_LOCAL_PART as pr,defaultFormsFromAddress as cr,defaultFormsCorsOrigin as Ir,isAddressAtDomain as Dr}from"./patterns/staticSiteForms.js";import{DEV_SUBSTRATE_PARAMS_SCHEMA_VERSION as Mr,DEV_SUBSTRATE_PARAMS_FILENAME as Lr,DevSubstrateSynthPropsSchema as lr,DevSubstrateParamsSchema as ur}from"./devSubstrate/params.js";import{DEV_SUBSTRATE_ENTRYPOINT_SOURCE as dr}from"./devSubstrate/entrypoint.js";import{DEPLOYMENT_FAILURE_PHASES as xr,DeploymentFailurePhaseSchema as Fr,DEPLOYMENT_FAULT_ATTRIBUTIONS as hr,DeploymentFaultAttributionSchema as Vr,DEPLOYMENT_FAILURE_PROVIDER_SOURCES as yr,DeploymentFailureProviderSourceSchema as Yr,DEPLOYMENT_FAILURE_CODE_PATTERN as Gr,DEPLOYMENT_FAILURE_SCHEMA_VERSION as vr,DEPLOYMENT_FAILURE_LIMITS as Hr,DeploymentFailureAnalysisSchema as br,DeploymentFailureProviderSchema as Xr,DeploymentFailureResourceSchema as Kr,DeploymentFailureSchema as Br,parseDeploymentFailure as Wr,DEPLOYMENT_FAILURE_DOCS_BASE_URL as kr,deploymentFailureDocsUrl as Zr,DEPLOYMENT_FAULT_COPY as jr,DEPLOYMENT_PROVIDER_LABELS as wr,deriveErrorMessageFromFailure as zr,toDeploymentFailureAnalysis as Qr}from"./failure/deploymentFailure.js";import{extractErrorWindow as Jr,ERROR_WINDOW_CONTEXT_LINES as $r}from"./failure/extractErrorWindow.js";export{Fe as ACCOUNT_ROLES,pe as ACCOUNT_STAGES,Ce as ACCOUNT_STAGES_WITH_ROOT,ce as ACCOUNT_STAGE_LABELS,De as ACCOUNT_TIERS,i as APPROVAL_TOKEN_OUTPUT_PREFIX,zE as ARTEFACT_OUTPUT_FIELDS,Ke as AWS_REGIONS_METADATA,fe as AccountTierSchema,T as BACKUP_VAULT_NAME,y as CAPACITY_ANCHOR_MAX_LENGTH,V as CAPACITY_ANCHOR_PATTERN,Y as CAPACITY_IDENTITY_CONTEXT_KEY,F as CAPACITY_SLOT_MAX_LENGTH,x as CAPACITY_SLOT_PATTERN,_r as CLICKHOUSE_MIGRATION_SKIP_RE,XE as CONTENT_HASH_TAG_PATTERN,H as CapacityIdentityConfigSchema,G as CapacityIdentityPinSchema,v as CapacityIdentityWireSchema,OE as ConnectionWireSchema,PE as ConnectionsListResponseSchema,_e as DANGEROUS_ENV_VARS,h as DEFAULT_CAPACITY_SLOT,pr as DEFAULT_FORMS_FROM_LOCAL_PART,Be as DEFAULT_REGION,mr as DEPLOYABLE_PATTERN_TYPES,Gr as DEPLOYMENT_FAILURE_CODE_PATTERN,kr as DEPLOYMENT_FAILURE_DOCS_BASE_URL,Hr as DEPLOYMENT_FAILURE_LIMITS,xr as DEPLOYMENT_FAILURE_PHASES,yr as DEPLOYMENT_FAILURE_PROVIDER_SOURCES,vr as DEPLOYMENT_FAILURE_SCHEMA_VERSION,hr as DEPLOYMENT_FAULT_ATTRIBUTIONS,jr as DEPLOYMENT_FAULT_COPY,wr as DEPLOYMENT_PROVIDER_LABELS,BE as DEPLOY_MODES,dr as DEV_SUBSTRATE_ENTRYPOINT_SOURCE,Lr as DEV_SUBSTRATE_PARAMS_FILENAME,Mr as DEV_SUBSTRATE_PARAMS_SCHEMA_VERSION,r as DNS_APEX,A as DOMAIN_DEPLOY_DEFAULT_PHASE,WE as DeployModeSchema,br as DeploymentFailureAnalysisSchema,Fr as DeploymentFailurePhaseSchema,Xr as DeploymentFailureProviderSchema,Yr as DeploymentFailureProviderSourceSchema,Kr as DeploymentFailureResourceSchema,Br as DeploymentFailureSchema,Vr as DeploymentFaultAttributionSchema,ur as DevSubstrateParamsSchema,lr as DevSubstrateSynthPropsSchema,$r as ERROR_WINDOW_CONTEXT_LINES,Er as EXPECTED_CH_SCHEMA_VERSION_ENV,$E as EXPECTED_SCHEMA_VERSION_ENV,er as EXPECTED_SCHEMA_VERSION_TOOL_ENV,Le as GOVERNANCE_ACCOUNT_TIERS,eE as GOVERNANCE_SCOPE_REQUIRED_CODE,kE as IMAGE_TAG_PATTERN,ZE as ImageTagSchema,Je as MACHINE_ONLY_SCOPES,Ae as MASKED_VALUE_MARKER,ke as MAX_SECONDARY_REGIONS,JE as MIGRATION_SNAPSHOT_NAME_PREFIX,Or as OPENNEXT_PATTERN_TYPES,Ze as OPT_IN_REGION_CODES,Rr as PATTERN_REGISTRY,nr as PATTERN_TYPES,Tr as PATTERN_TYPE_VALUES,Ar as PHYSICAL_NAME_FALLBACK_PROPERTIES,or as PRISMA_MIGRATION_DIR_RE,ne as REDACTED_KEY_SENTINEL,Z as REGION_SHORT_CODES,hE as RESERVED_APP_NAMES,VE as RESERVED_APP_NAME_MESSAGE,YE as RESERVED_APP_NAME_SUFFIX,GE as RESERVED_APP_NAME_SUFFIX_MESSAGE,Ve as RESOURCE_CATEGORIES,tr as SCHEMA_ADMIN_PASSWORD_ENV,rr as SCHEMA_ADMIN_USER_ENV,ie as SCOPED_TOKEN_REGEX,qe as SCOPE_VALUES,tE as SECRET_NAME_ERROR,rE as SECRET_NAME_PATTERN,_E as SSM_COMPONENT_ERROR,oE as SSM_COMPONENT_PATTERN,aE as SSM_STANDARD_MAX_VALUE_BYTES,Cr as STATIC_SITE_ROUTING_VALUES,se as STRUCTURAL_ENVIRONMENTS,AE as SecretNamespaceSchema,jE as ServiceArtefactSchema,wE as ServiceArtefactsSchema,R as TOKEN_STDERR_PREFIX,$e as USER_GRANTABLE_SCOPES,Xe as abbreviateRegion,D as accountConstructKey,de as accountTier,L as albDnsExportName,l as albHostedZoneIdExportName,QE as artefactOutputKey,g as bucketWebsiteEndpointExportName,d as bucketWebsiteHostedZoneIdExportName,LE as buildAppConfigPath,SE as buildNamespaceParts,TE as buildParameterPath,c as capitalise,ye as categoriseResource,u as cdnDomainExportName,W as defaultConnectedAccountName,Ir as defaultFormsCorsOrigin,cr as defaultFormsFromAddress,Zr as deploymentFailureDocsUrl,cE as deriveAllTargets,bE as deriveContentHashTag,zr as deriveErrorMessageFromFailure,sE as deriveRegionsFromOrgConfig,pE as deriveTargets,IE as environmentOrTier,ue as environmentToTier,NE as escapeDotEnvValue,Jr as extractErrorWindow,ae as filterDangerousEnvVars,K as findAccountNameCollision,gE as findBoundaryPath,uE as findInfrastructurePaths,DE as findTarget,j as findTrailingRegionShortCode,Ee as formatErrorString,fE as generateTargetName,t as getDomainExportNames,o as getDomainStackName,_ as getDomainUsEast1CertificatesStackName,xe as getEnvironmentLabel,$ as getErrorCode,q as getErrorMessage,ee as getErrorStack,Ye as getExpectedDuration,Ge as getFriendlyResourceType,We as getRegionInfo,I as getSafeZoneName,f as hasAsciiStableConstructKey,J as hasErrorCode,vE as hasReservedAppNameSuffix,m as imageTagParameterName,xE as inferContainerFromCandidates,Ie as isAccountStage,Me as isAccountTier,Dr as isAddressAtDomain,le as isGovernanceTier,dE as isInfrastructureFile,iE as isManageablePath,a as isManagedDomainBinding,Pr as isOpenNextPatternType,ir as isPatternType,yE as isReservedAppName,Oe as mapSettledWithConcurrency,Se as maskSensitiveOutput,Q as normaliseError,je as optInRegionWarning,Wr as parseDeploymentFailure,RE as parseDotEnv,He as parseGitRemoteUrl,nE as parseParameterPath,Te as parseShellArgs,Nr as patternConstructId,b as projectCapacityIdentityToTarget,w as regionSuffixRejectionMessage,we as regions,Ue as resolveSynthEnvironment,te as singleton,Ne as sleep,ge as stageFromWireEnvironment,k as suffixedAccountName,ze as suggestRegionForTimezone,Qr as toDeploymentFailureAnalysis,C as toKebab,P as toPascalCase,p as toScreamingSnake,s as toValidDatabaseName};
+import{DNS_APEX as r,getDomainExportNames as t,getDomainStackName as o,getDomainUsEast1CertificatesStackName as _,hostsExportPartName as a,serialiseHostsChunks as A,HOSTS_OUTPUT_MAX_BYTES as S,isManagedDomainBinding as T,DOMAIN_DEPLOY_DEFAULT_PHASE as n}from"./infra/domainExports.js";import{BACKUP_VAULT_NAME as R}from"./infra/backupVault.js";import{APPROVAL_TOKEN_OUTPUT_PREFIX as m,TOKEN_STDERR_PREFIX as O}from"./deploy/approvalTokenOutput.js";import{imageTagParameterName as P}from"./infra/imageTags.js";import{toPascalCase as p,toKebab as c,toValidDatabaseName as I,toScreamingSnake as D,capitalise as f,getSafeZoneName as M,accountConstructKey as L,hasAsciiStableConstructKey as l}from"./naming/caseConversion.js";import{albDnsExportName as g,albHostedZoneIdExportName as d,cdnDomainExportName as U,bucketWebsiteEndpointExportName as x,bucketWebsiteHostedZoneIdExportName as F}from"./naming/targetExportNames.js";import{CAPACITY_SLOT_PATTERN as V,CAPACITY_SLOT_MAX_LENGTH as Y,DEFAULT_CAPACITY_SLOT as y,CAPACITY_ANCHOR_PATTERN as G,CAPACITY_ANCHOR_MAX_LENGTH as H,CAPACITY_IDENTITY_CONTEXT_KEY as v,CapacityIdentityPinSchema as b,CapacityIdentityWireSchema as X,CapacityIdentityConfigSchema as B,projectCapacityIdentityToTarget as K}from"./capacityIdentity.js";import{findAccountNameCollision as k}from"./naming/accountNameCollision.js";import{defaultConnectedAccountName as j,suffixedAccountName as w,REGION_SHORT_CODES as z,findTrailingRegionShortCode as Q,regionSuffixRejectionMessage as q}from"./naming/connectedAccountName.js";import{normaliseError as $,getErrorMessage as ee,hasErrorCode as Ee,getErrorCode as re,getErrorStack as te,formatErrorString as oe}from"./errorUtils.js";import{singleton as ae}from"./async/singleton.js";import{DANGEROUS_ENV_VARS as Se,filterDangerousEnvVars as Te,MASKED_VALUE_MARKER as ne,maskSensitiveOutput as ie,parseShellArgs as Re,REDACTED_KEY_SENTINEL as Ne,SCOPED_TOKEN_REGEX as me}from"./securityHelpers.js";import{sleep as se}from"./async/sleep.js";import{mapSettledWithConcurrency as Ce}from"./async/concurrency.js";import{ACCOUNT_STAGES_WITH_ROOT as ce,STRUCTURAL_ENVIRONMENTS as Ie,ACCOUNT_STAGES as De,ACCOUNT_STAGE_LABELS as fe,isAccountStage as Me,ACCOUNT_TIERS as Le,AccountTierSchema as le,isAccountTier as ue,GOVERNANCE_ACCOUNT_TIERS as ge,isGovernanceTier as de,environmentToTier as Ue,stageFromWireEnvironment as xe,accountTier as Fe,resolveSynthEnvironment as he,getEnvironmentLabel as Ve,ACCOUNT_ROLES as Ye}from"./environments.js";import{RESOURCE_CATEGORIES as Ge,categoriseResource as He,getExpectedDuration as ve,getFriendlyResourceType as be}from"./resourceCategorisation.js";import{parseGitRemoteUrl as Be}from"./repo/gitRemoteParser.js";import{abbreviateRegion as We,AWS_REGIONS_METADATA as ke,DEFAULT_REGION as Ze,getRegionInfo as je,MAX_SECONDARY_REGIONS as we,OPT_IN_REGION_CODES as ze,optInRegionWarning as Qe,regions as qe,suggestRegionForTimezone as Je}from"./infra/regions.js";import{SCOPE_VALUES as eE,MACHINE_ONLY_SCOPES as EE,USER_GRANTABLE_SCOPES as rE,GOVERNANCE_SCOPE_REQUIRED_CODE as tE}from"./infra/tokenScopes.js";import{SECRET_NAME_PATTERN as _E,SECRET_NAME_ERROR as aE,SSM_COMPONENT_PATTERN as AE,SSM_COMPONENT_ERROR as SE,SSM_STANDARD_MAX_VALUE_BYTES as TE,SecretNamespaceSchema as nE,buildNamespaceParts as iE,buildParameterPath as RE,parseParameterPath as NE,isManageablePath as mE,parseDotEnv as OE,escapeDotEnvValue as sE}from"./secrets.js";import{ConnectionWireSchema as CE,ConnectionsListResponseSchema as pE}from"./infra/connectionsWire.js";import{deriveRegionsFromOrgConfig as IE,deriveTargets as DE,deriveAllTargets as fE,environmentOrTier as ME,findTarget as LE,generateTargetName as lE}from"./targets.js";import{buildAppConfigPath as gE}from"./repo/appPath.js";import{findInfrastructurePaths as UE,findBoundaryPath as xE,isInfrastructureFile as FE}from"./repo/findInfrastructurePaths.js";import{inferContainerFromCandidates as VE}from"./repo/inferContainerFromCandidates.js";import{RESERVED_APP_NAMES as yE,RESERVED_APP_NAME_MESSAGE as GE,isReservedAppName as HE,RESERVED_APP_NAME_SUFFIX as vE,RESERVED_APP_NAME_SUFFIX_MESSAGE as bE,hasReservedAppNameSuffix as XE}from"./naming/reservedAppNames.js";import{deriveContentHashTag as KE,CONTENT_HASH_TAG_PATTERN as WE}from"./infra/deriveContentHashTag.js";import{DEPLOY_MODES as ZE,DeployModeSchema as jE,IMAGE_TAG_PATTERN as wE,ImageTagSchema as zE,ServiceArtefactSchema as QE,ServiceArtefactsSchema as qE,ARTEFACT_OUTPUT_FIELDS as JE,artefactOutputKey as $E}from"./infra/deployArtefacts.js";import{MIGRATION_SNAPSHOT_NAME_PREFIX as Er,EXPECTED_SCHEMA_VERSION_ENV as rr,EXPECTED_SCHEMA_VERSION_TOOL_ENV as tr,EXPECTED_CH_SCHEMA_VERSION_ENV as or,SCHEMA_ADMIN_USER_ENV as _r,SCHEMA_ADMIN_PASSWORD_ENV as ar,PRISMA_MIGRATION_DIR_RE as Ar,CLICKHOUSE_MIGRATION_SKIP_RE as Sr}from"./migration/constants.js";import{PHYSICAL_NAME_FALLBACK_PROPERTIES as nr}from"./cfn/physicalNameProperties.js";import{PATTERN_TYPE_VALUES as Rr,PATTERN_TYPES as Nr,isPatternType as mr,PATTERN_REGISTRY as Or,patternConstructId as sr,DEPLOYABLE_PATTERN_TYPES as Pr,OPENNEXT_PATTERN_TYPES as Cr,isOpenNextPatternType as pr,STATIC_SITE_ROUTING_VALUES as cr}from"./patterns/patternTypes.js";import{DEFAULT_FORMS_FROM_LOCAL_PART as Dr,defaultFormsFromAddress as fr,defaultFormsCorsOrigin as Mr,isAddressAtDomain as Lr}from"./patterns/staticSiteForms.js";import{DEV_SUBSTRATE_PARAMS_SCHEMA_VERSION as ur,DEV_SUBSTRATE_PARAMS_FILENAME as gr,DevSubstrateSynthPropsSchema as dr,DevSubstrateParamsSchema as Ur}from"./devSubstrate/params.js";import{DEV_SUBSTRATE_ENTRYPOINT_SOURCE as Fr}from"./devSubstrate/entrypoint.js";import{DEPLOYMENT_FAILURE_PHASES as Vr,DeploymentFailurePhaseSchema as Yr,DEPLOYMENT_FAULT_ATTRIBUTIONS as yr,DeploymentFaultAttributionSchema as Gr,DEPLOYMENT_FAILURE_PROVIDER_SOURCES as Hr,DeploymentFailureProviderSourceSchema as vr,DEPLOYMENT_FAILURE_CODE_PATTERN as br,DEPLOYMENT_FAILURE_SCHEMA_VERSION as Xr,DEPLOYMENT_FAILURE_LIMITS as Br,DeploymentFailureAnalysisSchema as Kr,DeploymentFailureProviderSchema as Wr,DeploymentFailureResourceSchema as kr,DeploymentFailureSchema as Zr,parseDeploymentFailure as jr,DEPLOYMENT_FAILURE_DOCS_BASE_URL as wr,deploymentFailureDocsUrl as zr,DEPLOYMENT_FAULT_COPY as Qr,DEPLOYMENT_PROVIDER_LABELS as qr,deriveErrorMessageFromFailure as Jr,toDeploymentFailureAnalysis as $r}from"./failure/deploymentFailure.js";import{extractErrorWindow as Et,ERROR_WINDOW_CONTEXT_LINES as rt}from"./failure/extractErrorWindow.js";export{Ye as ACCOUNT_ROLES,De as ACCOUNT_STAGES,ce as ACCOUNT_STAGES_WITH_ROOT,fe as ACCOUNT_STAGE_LABELS,Le as ACCOUNT_TIERS,m as APPROVAL_TOKEN_OUTPUT_PREFIX,JE as ARTEFACT_OUTPUT_FIELDS,ke as AWS_REGIONS_METADATA,le as AccountTierSchema,R as BACKUP_VAULT_NAME,H as CAPACITY_ANCHOR_MAX_LENGTH,G as CAPACITY_ANCHOR_PATTERN,v as CAPACITY_IDENTITY_CONTEXT_KEY,Y as CAPACITY_SLOT_MAX_LENGTH,V as CAPACITY_SLOT_PATTERN,Sr as CLICKHOUSE_MIGRATION_SKIP_RE,WE as CONTENT_HASH_TAG_PATTERN,B as CapacityIdentityConfigSchema,b as CapacityIdentityPinSchema,X as CapacityIdentityWireSchema,CE as ConnectionWireSchema,pE as ConnectionsListResponseSchema,Se as DANGEROUS_ENV_VARS,y as DEFAULT_CAPACITY_SLOT,Dr as DEFAULT_FORMS_FROM_LOCAL_PART,Ze as DEFAULT_REGION,Pr as DEPLOYABLE_PATTERN_TYPES,br as DEPLOYMENT_FAILURE_CODE_PATTERN,wr as DEPLOYMENT_FAILURE_DOCS_BASE_URL,Br as DEPLOYMENT_FAILURE_LIMITS,Vr as DEPLOYMENT_FAILURE_PHASES,Hr as DEPLOYMENT_FAILURE_PROVIDER_SOURCES,Xr as DEPLOYMENT_FAILURE_SCHEMA_VERSION,yr as DEPLOYMENT_FAULT_ATTRIBUTIONS,Qr as DEPLOYMENT_FAULT_COPY,qr as DEPLOYMENT_PROVIDER_LABELS,ZE as DEPLOY_MODES,Fr as DEV_SUBSTRATE_ENTRYPOINT_SOURCE,gr as DEV_SUBSTRATE_PARAMS_FILENAME,ur as DEV_SUBSTRATE_PARAMS_SCHEMA_VERSION,r as DNS_APEX,n as DOMAIN_DEPLOY_DEFAULT_PHASE,jE as DeployModeSchema,Kr as DeploymentFailureAnalysisSchema,Yr as DeploymentFailurePhaseSchema,Wr as DeploymentFailureProviderSchema,vr as DeploymentFailureProviderSourceSchema,kr as DeploymentFailureResourceSchema,Zr as DeploymentFailureSchema,Gr as DeploymentFaultAttributionSchema,Ur as DevSubstrateParamsSchema,dr as DevSubstrateSynthPropsSchema,rt as ERROR_WINDOW_CONTEXT_LINES,or as EXPECTED_CH_SCHEMA_VERSION_ENV,rr as EXPECTED_SCHEMA_VERSION_ENV,tr as EXPECTED_SCHEMA_VERSION_TOOL_ENV,ge as GOVERNANCE_ACCOUNT_TIERS,tE as GOVERNANCE_SCOPE_REQUIRED_CODE,S as HOSTS_OUTPUT_MAX_BYTES,wE as IMAGE_TAG_PATTERN,zE as ImageTagSchema,EE as MACHINE_ONLY_SCOPES,ne as MASKED_VALUE_MARKER,we as MAX_SECONDARY_REGIONS,Er as MIGRATION_SNAPSHOT_NAME_PREFIX,Cr as OPENNEXT_PATTERN_TYPES,ze as OPT_IN_REGION_CODES,Or as PATTERN_REGISTRY,Nr as PATTERN_TYPES,Rr as PATTERN_TYPE_VALUES,nr as PHYSICAL_NAME_FALLBACK_PROPERTIES,Ar as PRISMA_MIGRATION_DIR_RE,Ne as REDACTED_KEY_SENTINEL,z as REGION_SHORT_CODES,yE as RESERVED_APP_NAMES,GE as RESERVED_APP_NAME_MESSAGE,vE as RESERVED_APP_NAME_SUFFIX,bE as RESERVED_APP_NAME_SUFFIX_MESSAGE,Ge as RESOURCE_CATEGORIES,ar as SCHEMA_ADMIN_PASSWORD_ENV,_r as SCHEMA_ADMIN_USER_ENV,me as SCOPED_TOKEN_REGEX,eE as SCOPE_VALUES,aE as SECRET_NAME_ERROR,_E as SECRET_NAME_PATTERN,SE as SSM_COMPONENT_ERROR,AE as SSM_COMPONENT_PATTERN,TE as SSM_STANDARD_MAX_VALUE_BYTES,cr as STATIC_SITE_ROUTING_VALUES,Ie as STRUCTURAL_ENVIRONMENTS,nE as SecretNamespaceSchema,QE as ServiceArtefactSchema,qE as ServiceArtefactsSchema,O as TOKEN_STDERR_PREFIX,rE as USER_GRANTABLE_SCOPES,We as abbreviateRegion,L as accountConstructKey,Fe as accountTier,g as albDnsExportName,d as albHostedZoneIdExportName,$E as artefactOutputKey,x as bucketWebsiteEndpointExportName,F as bucketWebsiteHostedZoneIdExportName,gE as buildAppConfigPath,iE as buildNamespaceParts,RE as buildParameterPath,f as capitalise,He as categoriseResource,U as cdnDomainExportName,j as defaultConnectedAccountName,Mr as defaultFormsCorsOrigin,fr as defaultFormsFromAddress,zr as deploymentFailureDocsUrl,fE as deriveAllTargets,KE as deriveContentHashTag,Jr as deriveErrorMessageFromFailure,IE as deriveRegionsFromOrgConfig,DE as deriveTargets,ME as environmentOrTier,Ue as environmentToTier,sE as escapeDotEnvValue,Et as extractErrorWindow,Te as filterDangerousEnvVars,k as findAccountNameCollision,xE as findBoundaryPath,UE as findInfrastructurePaths,LE as findTarget,Q as findTrailingRegionShortCode,oe as formatErrorString,lE as generateTargetName,t as getDomainExportNames,o as getDomainStackName,_ as getDomainUsEast1CertificatesStackName,Ve as getEnvironmentLabel,re as getErrorCode,ee as getErrorMessage,te as getErrorStack,ve as getExpectedDuration,be as getFriendlyResourceType,je as getRegionInfo,M as getSafeZoneName,l as hasAsciiStableConstructKey,Ee as hasErrorCode,XE as hasReservedAppNameSuffix,a as hostsExportPartName,P as imageTagParameterName,VE as inferContainerFromCandidates,Me as isAccountStage,ue as isAccountTier,Lr as isAddressAtDomain,de as isGovernanceTier,FE as isInfrastructureFile,mE as isManageablePath,T as isManagedDomainBinding,pr as isOpenNextPatternType,mr as isPatternType,HE as isReservedAppName,Ce as mapSettledWithConcurrency,ie as maskSensitiveOutput,$ as normaliseError,Qe as optInRegionWarning,jr as parseDeploymentFailure,OE as parseDotEnv,Be as parseGitRemoteUrl,NE as parseParameterPath,Re as parseShellArgs,sr as patternConstructId,K as projectCapacityIdentityToTarget,q as regionSuffixRejectionMessage,qe as regions,he as resolveSynthEnvironment,A as serialiseHostsChunks,ae as singleton,se as sleep,xe as stageFromWireEnvironment,w as suffixedAccountName,Je as suggestRegionForTimezone,$r as toDeploymentFailureAnalysis,c as toKebab,p as toPascalCase,D as toScreamingSnake,I as toValidDatabaseName};

package/dist/infra/domainExports.d.ts

@@ -51,10 +51,39 @@ export declare const DOMAIN_DEPLOY_DEFAULT_PHASE: DomainDeployPhase;
 export declare function getDomainExportNames(domainName: string): {
     hostedZoneId: string;
     certificateArn: string;
+    certificateHosts: string;
     usEast1CertificateArn: string;
+    usEast1CertificateHosts: string;
     delegationRoleArn: string;
     nameservers: string;
 };
+/**
+ * CloudFormation caps output values at 1024 bytes; hosts lists serialise
+ * against a 1000-byte threshold for headroom under the hard cap. Shared by
+ * every hosts-output emitter ({@link serialiseHostsChunks}).
+ */
+export declare const HOSTS_OUTPUT_MAX_BYTES = 1000;
+/**
+ * Serialise a certificate's hosts list into one-or-more JSON-array strings,
+ * each under {@link HOSTS_OUTPUT_MAX_BYTES}. One chunk → the emitter keeps
+ * the base export name (byte-identical to the single-output era); more →
+ * the {@link hostsExportPartName} family replaces the base name. The SSOT
+ * for the chunking algorithm: the Domain construct's certificate composer
+ * and the CLI's eject templates must split identically, or an ejected
+ * stack would rename the deployed hosts outputs.
+ */
+export declare function serialiseHostsChunks(hosts: string[]): string[];
+/**
+ * Export name of chunk `part` (1-based) of a certificate-hosts list too
+ * large for one CloudFormation output value. The part family REPLACES the
+ * base export name entirely when chunking engages — the base name is
+ * OMITTED, never emitted with a partial list, so a consumer that only knows
+ * the base name reads absence (coverage-unknown, the honest degraded
+ * answer) rather than a partial list it would misread as complete and turn
+ * into a false not-covered verdict. Consumers that know the family read
+ * `-1`, `-2`, … until the first absent part and concatenate.
+ */
+export declare function hostsExportPartName(baseExportName: string, part: number): string;
 /**
  * Props for importing zone and certificate from a managed domain stack.
  * When set, app constructs use Fn.importValue() instead of creating inline.
@@ -85,6 +114,25 @@ export interface ManagedDomainBinding {
     /** Parent DelegationRole ARN for child-writes NS delegation (D8), always literal. */
     delegationRoleArn?: string;
 }
+/**
+ * Certificate-coverage companion to {@link ManagedDomainBinding} (design
+ * 2026-08-18 cdn-app-origin, D5). Carries the hostnames covered by exactly
+ * the two certificates the binding names — `certificateHosts` for
+ * `certificateArn`, `usEast1CertificateHosts` for `usEast1CertificateArn` —
+ * read from the domain stack's per-certificate hosts outputs. Injected as a
+ * SEPARATE context key (`fjall:managedDomainCoverage:<zone>`), never folded
+ * into the binding JSON: the binding parser fails closed on unknown fields,
+ * so extending the binding would break older-engine synths fed by a newer
+ * CLI, while a separate key is invisible to them by construction. A field is
+ * absent when the domain stack predates the hosts outputs — consumers must
+ * treat absence as coverage-unknown (warn), never as not-covered.
+ */
+export interface ManagedDomainCoverage {
+    /** Hostnames covered by the binding's regional `certificateArn`. */
+    certificateHosts?: string[];
+    /** Hostnames covered by the binding's `usEast1CertificateArn` (D3). */
+    usEast1CertificateHosts?: string[];
+}
 /**
  * Discriminate a `ManagedDomainExports | ManagedDomainBinding` union so
  * constructs accepting `managedDomain` can branch: a binding carries the

package/dist/infra/domainExports.js

@@ -1 +1 @@
-var r=Object.defineProperty;var n=(e,t)=>r(e,"name",{value:t,configurable:!0});import{toPascalCase as a}from"../naming/caseConversion.js";const s="@";function c(e){return`${a(e.split(".").join(""))}Domain`}n(c,"getDomainStackName");function f(e){return`${e}UsEast1Certificates`}n(f,"getDomainUsEast1CertificatesStackName");const m="full";function p(e){const t=e.replace(/\./g,"-");return{hostedZoneId:`${t}-hosted-zone-id`,certificateArn:`${t}-certificate-arn`,usEast1CertificateArn:`${t}-us-east-1-certificate-arn`,delegationRoleArn:`${t}-delegation-role-arn`,nameservers:`${t}-nameservers`}}n(p,"getDomainExportNames");function u(e){return typeof e.hostedZoneId=="string"}n(u,"isManagedDomainBinding");export{s as DNS_APEX,m as DOMAIN_DEPLOY_DEFAULT_PHASE,p as getDomainExportNames,c as getDomainStackName,f as getDomainUsEast1CertificatesStackName,u as isManagedDomainBinding};
+var i=Object.defineProperty;var s=(e,t)=>i(e,"name",{value:t,configurable:!0});import{toPascalCase as a}from"../naming/caseConversion.js";const p="@";function g(e){return`${a(e.split(".").join(""))}Domain`}s(g,"getDomainStackName");function h(e){return`${e}UsEast1Certificates`}s(h,"getDomainUsEast1CertificatesStackName");const l="full";function m(e){const t=e.replace(/\./g,"-");return{hostedZoneId:`${t}-hosted-zone-id`,certificateArn:`${t}-certificate-arn`,certificateHosts:`${t}-certificate-hosts`,usEast1CertificateArn:`${t}-us-east-1-certificate-arn`,usEast1CertificateHosts:`${t}-us-east-1-certificate-hosts`,delegationRoleArn:`${t}-delegation-role-arn`,nameservers:`${t}-nameservers`}}s(m,"getDomainExportNames");const c=1e3;function d(e){const t=[];let n=[];for(const r of e){const o=[...n,r];n.length>0&&Buffer.byteLength(JSON.stringify(o),"utf8")>c?(t.push(n),n=[r]):n=o}return n.length>0&&t.push(n),t.map(r=>JSON.stringify(r))}s(d,"serialiseHostsChunks");function x(e,t){return`${e}-${t}`}s(x,"hostsExportPartName");function E(e){return typeof e.hostedZoneId=="string"}s(E,"isManagedDomainBinding");export{p as DNS_APEX,l as DOMAIN_DEPLOY_DEFAULT_PHASE,c as HOSTS_OUTPUT_MAX_BYTES,m as getDomainExportNames,g as getDomainStackName,h as getDomainUsEast1CertificatesStackName,x as hostsExportPartName,E as isManagedDomainBinding,d as serialiseHostsChunks};

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@fjall/util",
-  "version": "14.1.0",
+  "version": "14.3.0",
   "repository": {
     "type": "git",
     "url": "git+https://github.com/fjall-tech/fjall.git",