@fjall/util 18.0.0 → 20.0.0

package/dist/.build-source-hash

@@ -9,7 +9,7 @@
     "package.json",
     "tsconfig.json"
   ],
-  "hash": "9abfb8e1ee26866c15c98463d53a3bc1b1d309cf70d094a76bff151a68672433",
+  "hash": "a0a493b8832688e4bc7a72eea503c17e90d177fbbdf80d407eaa571a83d6d6a3",
   "files": {
     "src/async/concurrency.ts": "3c7ebe0222a720f9",
     "src/async/singleton.ts": "7bcc21b0fb920561",
@@ -29,6 +29,7 @@
     "src/buildConcurrency.ts": "1804e76ddc4f8216",
     "src/capacityIdentity.ts": "9e59bfc92a5ba361",
     "src/cdkTmpdirCleanup.ts": "4574b3f10e3ab0f9",
+    "src/cdkToolchain.ts": "a6b996c60b87d644",
     "src/cfn/physicalNameProperties.ts": "35d3c6f28079c593",
     "src/clickhouse.ts": "655c74cdba292c29",
     "src/config.ts": "11c577414a91c542",
@@ -68,9 +69,9 @@
     "src/fsHelpers.ts": "0869d9739d523572",
     "src/fsScan.ts": "feb187758481443f",
     "src/httpKeepAlive.ts": "c8fe4b118ef4c79f",
-    "src/index.ts": "46bfe8f90ef630f6",
+    "src/index.ts": "34a9bb9a33ef1680",
     "src/infra/backupVault.ts": "661678a6dfb0b648",
-    "src/infra/connectionsWire.ts": "125c099da0e17ac1",
+    "src/infra/connectionsWire.ts": "e3afa3ba95a531d8",
     "src/infra/deployArtefacts.ts": "235ac21dd3ccf0b2",
     "src/infra/deriveContentHashTag.ts": "115fbe6588794027",
     "src/infra/domainExports.ts": "18de5b8668633aaf",
@@ -95,6 +96,8 @@
     "src/naming/connectedAccountName.ts": "3cd3bc7dba0a2f0b",
     "src/naming/reservedAppNames.ts": "7f63dd0b84c1972e",
     "src/naming/targetExportNames.ts": "bab26b7c0243fafa",
+    "src/onboarding/index.ts": "7999117c5a7a18d1",
+    "src/onboarding/versionCurrency.ts": "19695f38b09cfc46",
     "src/patterns/index.ts": "9f024b45c2e225b0",
     "src/patterns/patternTypes.ts": "6e0aff0443bcb770",
     "src/patterns/staticSiteForms.ts": "86ffcf142d9a8eac",
@@ -111,9 +114,9 @@
     "src/securityHelpers.ts": "2632215f57e1528c",
     "src/targets.ts": "126280f0a5762e21",
     "../scripts/minify-dist.mjs": "6b2e4b0df8aec601",
-    "package.json": "470d8fa5be871d49",
+    "package.json": "e6b55e0cbbcafa56",
     "tsconfig.json": "db759831ad95f396"
   },
-  "outputHash": "39bac1f5f5cc670240f795336fabba9b462d4fe5eb91da8241852b220945f1ec",
-  "outputFileCount": 205
+  "outputHash": "5d297fd2a4b1eb5849301e75fd57cf8b1f47a2c32b3b828c446b4be862ca27fe",
+  "outputFileCount": 211
 }

package/dist/.minified

@@ -1 +1 @@
-102 files minified at 2026-08-23T08:31:32.846Z
+105 files minified at 2026-08-24T18:04:48.133Z

package/dist/cdkToolchain.d.ts

@@ -0,0 +1,19 @@
+/**
+ * Blessed AWS CDK toolchain — the versions last confirmed compatible as a
+ * set. The canonical record is `scripts/cdk-blessed-versions.json` at the
+ * monorepo root (enforced against installed node_modules by
+ * `scripts/check-cdk-blessed-pair.mjs` in CI); this export mirrors it for
+ * consumers OUTSIDE the monorepo that materialise CDK workspaces at runtime
+ * (the webapp's dev-substrate worker cannot read the construct package's own
+ * package.json — `npm ci --omit=dev` strips it). Parity between this
+ * constant, the JSON, and the construct package's peer range is pinned by
+ * `util/src/__tests__/cdkToolchain.test.ts`, which runs in fjall-ci — a bump
+ * to either side without the other fails the build.
+ */
+export declare const BLESSED_CDK_TOOLCHAIN: {
+    readonly "aws-cdk": "2.1134.0";
+    readonly "aws-cdk-lib": "2.265.0";
+    readonly "@aws-cdk/cloudformation-diff": "2.187.2";
+    readonly constructs: "10.8.0";
+};
+export type BlessedCdkToolchain = typeof BLESSED_CDK_TOOLCHAIN;

package/dist/cdkToolchain.js

@@ -0,0 +1 @@
+const c={"aws-cdk":"2.1134.0","aws-cdk-lib":"2.265.0","@aws-cdk/cloudformation-diff":"2.187.2",constructs:"10.8.0"};export{c as BLESSED_CDK_TOOLCHAIN};

package/dist/failure/deploymentFailure.d.ts

@@ -48,11 +48,11 @@ export declare const DeploymentFailureProviderSourceSchema: z.ZodEnum<{
     docker: "docker";
     ecr: "ecr";
     other: "other";
+    npm: "npm";
     cloudformation: "cloudformation";
     ecs: "ecs";
     iam: "iam";
     cdk: "cdk";
-    npm: "npm";
 }>;
 export type DeploymentFailureProviderSource = z.infer<typeof DeploymentFailureProviderSourceSchema>;
 /**
@@ -164,11 +164,11 @@ export declare const DeploymentFailureProviderSchema: z.ZodObject<{
         docker: "docker";
         ecr: "ecr";
         other: "other";
+        npm: "npm";
         cloudformation: "cloudformation";
         ecs: "ecs";
         iam: "iam";
         cdk: "cdk";
-        npm: "npm";
     }>;
     code: z.ZodOptional<z.ZodString>;
     message: z.ZodString;
@@ -209,11 +209,11 @@ export declare const DeploymentFailureSchema: z.ZodObject<{
             docker: "docker";
             ecr: "ecr";
             other: "other";
+            npm: "npm";
             cloudformation: "cloudformation";
             ecs: "ecs";
             iam: "iam";
             cdk: "cdk";
-            npm: "npm";
         }>;
         code: z.ZodOptional<z.ZodString>;
         message: z.ZodString;

package/dist/index.d.ts

@@ -18,7 +18,8 @@ export { parseGitRemoteUrl, type GitProvider, type ParsedGitRemote } from "./rep
 export { abbreviateRegion, AWS_REGIONS_METADATA, DEFAULT_REGION, getRegionInfo, MAX_SECONDARY_REGIONS, OPT_IN_REGION_CODES, optInRegionWarning, regions, suggestRegionForTimezone, type RegionCode, type RegionInfo } from "./infra/regions.js";
 export { SCOPE_VALUES, MACHINE_ONLY_SCOPES, USER_GRANTABLE_SCOPES, GOVERNANCE_SCOPE_REQUIRED_CODE, type TokenScope } from "./infra/tokenScopes.js";
 export { SECRET_NAME_PATTERN, SECRET_NAME_ERROR, SSM_COMPONENT_PATTERN, SSM_COMPONENT_ERROR, SSM_STANDARD_MAX_VALUE_BYTES, SecretNamespaceSchema, type SecretNamespace, buildNamespaceParts, buildParameterPath, parseParameterPath, isManageablePath, parseDotEnv, escapeDotEnvValue } from "./secrets.js";
-export { ConnectionWireSchema, type ConnectionWire, ConnectionsListResponseSchema, type ConnectionsListResponse } from "./infra/connectionsWire.js";
+export { ConnectionWireSchema, type ConnectionWire, ConnectionsListResponseSchema, type ConnectionsListResponse, CONNECTION_PHASES, type ConnectionPhase, CONNECTION_TERMINAL_FAILURE_PHASES, type ConnectionTerminalFailurePhase, CONNECTION_FAILURE_REASONS, type ConnectionFailureReason, EXTERNAL_ID_PATTERN } from "./infra/connectionsWire.js";
+export { PUBLIC_PACKAGE_NAME, INSTALL_SOURCES, type InstallSource, SETUP_COMMANDS, type SetupCommandId, upgradeCommand, SETUP_MODES, type SetupMode, SETUP_STEP_IDS, type SetupStepId, type SetupStep, type SetupStepSequence, SETUP_STEPS, AGENT_SETUP_PROMPTS, AGENT_INSTALL_COMMAND, SKILL_INSTALL_SEGMENTS, SKILL_INSTALL_FILENAME, SKILL_INSTALL_PATH } from "./onboarding/index.js";
 export { deriveRegionsFromOrgConfig, deriveTargets, deriveAllTargets, environmentOrTier, findTarget, generateTargetName, type OrgConfigRegions, type TargetAccount, type DerivedTarget } from "./targets.js";
 export { buildAppConfigPath } from "./repo/appPath.js";
 export { type ScanPath } from "./repo/scanTypes.js";
@@ -33,5 +34,6 @@ export { PATTERN_TYPE_VALUES, type PatternType, PATTERN_TYPES, isPatternType, ty
 export { DEFAULT_FORMS_FROM_LOCAL_PART, defaultFormsFromAddress, defaultFormsCorsOrigin, isAddressAtDomain } from "./patterns/staticSiteForms.js";
 export { DEV_SUBSTRATE_PARAMS_SCHEMA_VERSION, DEV_SUBSTRATE_PARAMS_FILENAME, DevSubstrateSynthPropsSchema, type DevSubstrateSynthProps, DevSubstrateParamsSchema, type DevSubstrateParams } from "./devSubstrate/params.js";
 export { DEV_SUBSTRATE_ENTRYPOINT_SOURCE } from "./devSubstrate/entrypoint.js";
+export { BLESSED_CDK_TOOLCHAIN, type BlessedCdkToolchain } from "./cdkToolchain.js";
 export { DEPLOYMENT_FAILURE_PHASES, DeploymentFailurePhaseSchema, type DeploymentFailurePhase, DEPLOYMENT_FAULT_ATTRIBUTIONS, DeploymentFaultAttributionSchema, type DeploymentFaultAttribution, DEPLOYMENT_FAILURE_PROVIDER_SOURCES, DeploymentFailureProviderSourceSchema, type DeploymentFailureProviderSource, DEPLOYMENT_FAILURE_CODE_PATTERN, DEPLOYMENT_FAILURE_SCHEMA_VERSION, DEPLOYMENT_FAILURE_LIMITS, DeploymentFailureAnalysisSchema, type DeploymentFailureAnalysis, DeploymentFailureProviderSchema, type DeploymentFailureProvider, DeploymentFailureResourceSchema, type DeploymentFailureResource, DeploymentFailureSchema, type DeploymentFailure, parseDeploymentFailure, DEPLOYMENT_FAILURE_DOCS_BASE_URL, deploymentFailureDocsUrl, DEPLOYMENT_FAULT_COPY, DEPLOYMENT_PROVIDER_LABELS, deriveErrorMessageFromFailure, toDeploymentFailureAnalysis } from "./failure/deploymentFailure.js";
 export { extractErrorWindow, ERROR_WINDOW_CONTEXT_LINES, type ExtractErrorWindowOptions } from "./failure/extractErrorWindow.js";

package/dist/index.js

@@ -1 +1 @@
-import{DNS_APEX as r,getDomainExportNames as t,getDomainStackName as o,getDomainUsEast1CertificatesStackName as _,hostsExportPartName as a,serialiseHostsChunks as A,HOSTS_OUTPUT_MAX_BYTES as S,isManagedDomainBinding as T,DOMAIN_DEPLOY_DEFAULT_PHASE as n}from"./infra/domainExports.js";import{BACKUP_VAULT_NAME as R}from"./infra/backupVault.js";import{APPROVAL_TOKEN_OUTPUT_PREFIX as m,TOKEN_STDERR_PREFIX as O}from"./deploy/approvalTokenOutput.js";import{imageTagParameterName as P}from"./infra/imageTags.js";import{toPascalCase as p,toKebab as c,toValidDatabaseName as I,toScreamingSnake as D,capitalise as f,getSafeZoneName as M,accountConstructKey as L,hasAsciiStableConstructKey as l}from"./naming/caseConversion.js";import{albDnsExportName as g,albHostedZoneIdExportName as d,cdnDomainExportName as U,bucketWebsiteEndpointExportName as x,bucketWebsiteHostedZoneIdExportName as F}from"./naming/targetExportNames.js";import{CAPACITY_SLOT_PATTERN as V,CAPACITY_SLOT_MAX_LENGTH as Y,DEFAULT_CAPACITY_SLOT as y,CAPACITY_ANCHOR_PATTERN as G,CAPACITY_ANCHOR_MAX_LENGTH as H,CAPACITY_IDENTITY_CONTEXT_KEY as v,CapacityIdentityPinSchema as b,CapacityIdentityWireSchema as X,CapacityIdentityConfigSchema as B,projectCapacityIdentityToTarget as K}from"./capacityIdentity.js";import{findAccountNameCollision as k}from"./naming/accountNameCollision.js";import{defaultConnectedAccountName as j,suffixedAccountName as w,REGION_SHORT_CODES as z,findTrailingRegionShortCode as Q,regionSuffixRejectionMessage as q}from"./naming/connectedAccountName.js";import{normaliseError as $,getErrorMessage as ee,hasErrorCode as Ee,getErrorCode as re,getErrorStack as te,formatErrorString as oe}from"./errorUtils.js";import{singleton as ae}from"./async/singleton.js";import{DANGEROUS_ENV_VARS as Se,filterDangerousEnvVars as Te,MASKED_VALUE_MARKER as ne,maskSensitiveOutput as ie,parseShellArgs as Re,REDACTED_KEY_SENTINEL as Ne,SCOPED_TOKEN_REGEX as me}from"./securityHelpers.js";import{sleep as se}from"./async/sleep.js";import{mapSettledWithConcurrency as Ce}from"./async/concurrency.js";import{ACCOUNT_STAGES_WITH_ROOT as ce,STRUCTURAL_ENVIRONMENTS as Ie,ACCOUNT_STAGES as De,ACCOUNT_STAGE_LABELS as fe,isAccountStage as Me,ACCOUNT_TIERS as Le,AccountTierSchema as le,isAccountTier as ue,GOVERNANCE_ACCOUNT_TIERS as ge,isGovernanceTier as de,environmentToTier as Ue,stageFromWireEnvironment as xe,accountTier as Fe,resolveSynthEnvironment as he,getEnvironmentLabel as Ve,ACCOUNT_ROLES as Ye}from"./environments.js";import{RESOURCE_CATEGORIES as Ge,categoriseResource as He,getExpectedDuration as ve,getFriendlyResourceType as be}from"./resourceCategorisation.js";import{parseGitRemoteUrl as Be}from"./repo/gitRemoteParser.js";import{abbreviateRegion as We,AWS_REGIONS_METADATA as ke,DEFAULT_REGION as Ze,getRegionInfo as je,MAX_SECONDARY_REGIONS as we,OPT_IN_REGION_CODES as ze,optInRegionWarning as Qe,regions as qe,suggestRegionForTimezone as Je}from"./infra/regions.js";import{SCOPE_VALUES as eE,MACHINE_ONLY_SCOPES as EE,USER_GRANTABLE_SCOPES as rE,GOVERNANCE_SCOPE_REQUIRED_CODE as tE}from"./infra/tokenScopes.js";import{SECRET_NAME_PATTERN as _E,SECRET_NAME_ERROR as aE,SSM_COMPONENT_PATTERN as AE,SSM_COMPONENT_ERROR as SE,SSM_STANDARD_MAX_VALUE_BYTES as TE,SecretNamespaceSchema as nE,buildNamespaceParts as iE,buildParameterPath as RE,parseParameterPath as NE,isManageablePath as mE,parseDotEnv as OE,escapeDotEnvValue as sE}from"./secrets.js";import{ConnectionWireSchema as CE,ConnectionsListResponseSchema as pE}from"./infra/connectionsWire.js";import{deriveRegionsFromOrgConfig as IE,deriveTargets as DE,deriveAllTargets as fE,environmentOrTier as ME,findTarget as LE,generateTargetName as lE}from"./targets.js";import{buildAppConfigPath as gE}from"./repo/appPath.js";import{findInfrastructurePaths as UE,findBoundaryPath as xE,isInfrastructureFile as FE}from"./repo/findInfrastructurePaths.js";import{inferContainerFromCandidates as VE}from"./repo/inferContainerFromCandidates.js";import{RESERVED_APP_NAMES as yE,RESERVED_APP_NAME_MESSAGE as GE,isReservedAppName as HE,RESERVED_APP_NAME_SUFFIX as vE,RESERVED_APP_NAME_SUFFIX_MESSAGE as bE,hasReservedAppNameSuffix as XE}from"./naming/reservedAppNames.js";import{deriveContentHashTag as KE,CONTENT_HASH_TAG_PATTERN as WE}from"./infra/deriveContentHashTag.js";import{DEPLOY_MODES as ZE,DeployModeSchema as jE,IMAGE_TAG_PATTERN as wE,ImageTagSchema as zE,ServiceArtefactSchema as QE,ServiceArtefactsSchema as qE,ARTEFACT_OUTPUT_FIELDS as JE,artefactOutputKey as $E}from"./infra/deployArtefacts.js";import{MIGRATION_SNAPSHOT_NAME_PREFIX as Er,EXPECTED_SCHEMA_VERSION_ENV as rr,EXPECTED_SCHEMA_VERSION_TOOL_ENV as tr,EXPECTED_CH_SCHEMA_VERSION_ENV as or,SCHEMA_ADMIN_USER_ENV as _r,SCHEMA_ADMIN_PASSWORD_ENV as ar,PRISMA_MIGRATION_DIR_RE as Ar,CLICKHOUSE_MIGRATION_SKIP_RE as Sr}from"./migration/constants.js";import{PHYSICAL_NAME_FALLBACK_PROPERTIES as nr}from"./cfn/physicalNameProperties.js";import{PATTERN_TYPE_VALUES as Rr,PATTERN_TYPES as Nr,isPatternType as mr,PATTERN_REGISTRY as Or,patternConstructId as sr,DEPLOYABLE_PATTERN_TYPES as Pr,OPENNEXT_PATTERN_TYPES as Cr,isOpenNextPatternType as pr,STATIC_SITE_ROUTING_VALUES as cr}from"./patterns/patternTypes.js";import{DEFAULT_FORMS_FROM_LOCAL_PART as Dr,defaultFormsFromAddress as fr,defaultFormsCorsOrigin as Mr,isAddressAtDomain as Lr}from"./patterns/staticSiteForms.js";import{DEV_SUBSTRATE_PARAMS_SCHEMA_VERSION as ur,DEV_SUBSTRATE_PARAMS_FILENAME as gr,DevSubstrateSynthPropsSchema as dr,DevSubstrateParamsSchema as Ur}from"./devSubstrate/params.js";import{DEV_SUBSTRATE_ENTRYPOINT_SOURCE as Fr}from"./devSubstrate/entrypoint.js";import{DEPLOYMENT_FAILURE_PHASES as Vr,DeploymentFailurePhaseSchema as Yr,DEPLOYMENT_FAULT_ATTRIBUTIONS as yr,DeploymentFaultAttributionSchema as Gr,DEPLOYMENT_FAILURE_PROVIDER_SOURCES as Hr,DeploymentFailureProviderSourceSchema as vr,DEPLOYMENT_FAILURE_CODE_PATTERN as br,DEPLOYMENT_FAILURE_SCHEMA_VERSION as Xr,DEPLOYMENT_FAILURE_LIMITS as Br,DeploymentFailureAnalysisSchema as Kr,DeploymentFailureProviderSchema as Wr,DeploymentFailureResourceSchema as kr,DeploymentFailureSchema as Zr,parseDeploymentFailure as jr,DEPLOYMENT_FAILURE_DOCS_BASE_URL as wr,deploymentFailureDocsUrl as zr,DEPLOYMENT_FAULT_COPY as Qr,DEPLOYMENT_PROVIDER_LABELS as qr,deriveErrorMessageFromFailure as Jr,toDeploymentFailureAnalysis as $r}from"./failure/deploymentFailure.js";import{extractErrorWindow as Et,ERROR_WINDOW_CONTEXT_LINES as rt}from"./failure/extractErrorWindow.js";export{Ye as ACCOUNT_ROLES,De as ACCOUNT_STAGES,ce as ACCOUNT_STAGES_WITH_ROOT,fe as ACCOUNT_STAGE_LABELS,Le as ACCOUNT_TIERS,m as APPROVAL_TOKEN_OUTPUT_PREFIX,JE as ARTEFACT_OUTPUT_FIELDS,ke as AWS_REGIONS_METADATA,le as AccountTierSchema,R as BACKUP_VAULT_NAME,H as CAPACITY_ANCHOR_MAX_LENGTH,G as CAPACITY_ANCHOR_PATTERN,v as CAPACITY_IDENTITY_CONTEXT_KEY,Y as CAPACITY_SLOT_MAX_LENGTH,V as CAPACITY_SLOT_PATTERN,Sr as CLICKHOUSE_MIGRATION_SKIP_RE,WE as CONTENT_HASH_TAG_PATTERN,B as CapacityIdentityConfigSchema,b as CapacityIdentityPinSchema,X as CapacityIdentityWireSchema,CE as ConnectionWireSchema,pE as ConnectionsListResponseSchema,Se as DANGEROUS_ENV_VARS,y as DEFAULT_CAPACITY_SLOT,Dr as DEFAULT_FORMS_FROM_LOCAL_PART,Ze as DEFAULT_REGION,Pr as DEPLOYABLE_PATTERN_TYPES,br as DEPLOYMENT_FAILURE_CODE_PATTERN,wr as DEPLOYMENT_FAILURE_DOCS_BASE_URL,Br as DEPLOYMENT_FAILURE_LIMITS,Vr as DEPLOYMENT_FAILURE_PHASES,Hr as DEPLOYMENT_FAILURE_PROVIDER_SOURCES,Xr as DEPLOYMENT_FAILURE_SCHEMA_VERSION,yr as DEPLOYMENT_FAULT_ATTRIBUTIONS,Qr as DEPLOYMENT_FAULT_COPY,qr as DEPLOYMENT_PROVIDER_LABELS,ZE as DEPLOY_MODES,Fr as DEV_SUBSTRATE_ENTRYPOINT_SOURCE,gr as DEV_SUBSTRATE_PARAMS_FILENAME,ur as DEV_SUBSTRATE_PARAMS_SCHEMA_VERSION,r as DNS_APEX,n as DOMAIN_DEPLOY_DEFAULT_PHASE,jE as DeployModeSchema,Kr as DeploymentFailureAnalysisSchema,Yr as DeploymentFailurePhaseSchema,Wr as DeploymentFailureProviderSchema,vr as DeploymentFailureProviderSourceSchema,kr as DeploymentFailureResourceSchema,Zr as DeploymentFailureSchema,Gr as DeploymentFaultAttributionSchema,Ur as DevSubstrateParamsSchema,dr as DevSubstrateSynthPropsSchema,rt as ERROR_WINDOW_CONTEXT_LINES,or as EXPECTED_CH_SCHEMA_VERSION_ENV,rr as EXPECTED_SCHEMA_VERSION_ENV,tr as EXPECTED_SCHEMA_VERSION_TOOL_ENV,ge as GOVERNANCE_ACCOUNT_TIERS,tE as GOVERNANCE_SCOPE_REQUIRED_CODE,S as HOSTS_OUTPUT_MAX_BYTES,wE as IMAGE_TAG_PATTERN,zE as ImageTagSchema,EE as MACHINE_ONLY_SCOPES,ne as MASKED_VALUE_MARKER,we as MAX_SECONDARY_REGIONS,Er as MIGRATION_SNAPSHOT_NAME_PREFIX,Cr as OPENNEXT_PATTERN_TYPES,ze as OPT_IN_REGION_CODES,Or as PATTERN_REGISTRY,Nr as PATTERN_TYPES,Rr as PATTERN_TYPE_VALUES,nr as PHYSICAL_NAME_FALLBACK_PROPERTIES,Ar as PRISMA_MIGRATION_DIR_RE,Ne as REDACTED_KEY_SENTINEL,z as REGION_SHORT_CODES,yE as RESERVED_APP_NAMES,GE as RESERVED_APP_NAME_MESSAGE,vE as RESERVED_APP_NAME_SUFFIX,bE as RESERVED_APP_NAME_SUFFIX_MESSAGE,Ge as RESOURCE_CATEGORIES,ar as SCHEMA_ADMIN_PASSWORD_ENV,_r as SCHEMA_ADMIN_USER_ENV,me as SCOPED_TOKEN_REGEX,eE as SCOPE_VALUES,aE as SECRET_NAME_ERROR,_E as SECRET_NAME_PATTERN,SE as SSM_COMPONENT_ERROR,AE as SSM_COMPONENT_PATTERN,TE as SSM_STANDARD_MAX_VALUE_BYTES,cr as STATIC_SITE_ROUTING_VALUES,Ie as STRUCTURAL_ENVIRONMENTS,nE as SecretNamespaceSchema,QE as ServiceArtefactSchema,qE as ServiceArtefactsSchema,O as TOKEN_STDERR_PREFIX,rE as USER_GRANTABLE_SCOPES,We as abbreviateRegion,L as accountConstructKey,Fe as accountTier,g as albDnsExportName,d as albHostedZoneIdExportName,$E as artefactOutputKey,x as bucketWebsiteEndpointExportName,F as bucketWebsiteHostedZoneIdExportName,gE as buildAppConfigPath,iE as buildNamespaceParts,RE as buildParameterPath,f as capitalise,He as categoriseResource,U as cdnDomainExportName,j as defaultConnectedAccountName,Mr as defaultFormsCorsOrigin,fr as defaultFormsFromAddress,zr as deploymentFailureDocsUrl,fE as deriveAllTargets,KE as deriveContentHashTag,Jr as deriveErrorMessageFromFailure,IE as deriveRegionsFromOrgConfig,DE as deriveTargets,ME as environmentOrTier,Ue as environmentToTier,sE as escapeDotEnvValue,Et as extractErrorWindow,Te as filterDangerousEnvVars,k as findAccountNameCollision,xE as findBoundaryPath,UE as findInfrastructurePaths,LE as findTarget,Q as findTrailingRegionShortCode,oe as formatErrorString,lE as generateTargetName,t as getDomainExportNames,o as getDomainStackName,_ as getDomainUsEast1CertificatesStackName,Ve as getEnvironmentLabel,re as getErrorCode,ee as getErrorMessage,te as getErrorStack,ve as getExpectedDuration,be as getFriendlyResourceType,je as getRegionInfo,M as getSafeZoneName,l as hasAsciiStableConstructKey,Ee as hasErrorCode,XE as hasReservedAppNameSuffix,a as hostsExportPartName,P as imageTagParameterName,VE as inferContainerFromCandidates,Me as isAccountStage,ue as isAccountTier,Lr as isAddressAtDomain,de as isGovernanceTier,FE as isInfrastructureFile,mE as isManageablePath,T as isManagedDomainBinding,pr as isOpenNextPatternType,mr as isPatternType,HE as isReservedAppName,Ce as mapSettledWithConcurrency,ie as maskSensitiveOutput,$ as normaliseError,Qe as optInRegionWarning,jr as parseDeploymentFailure,OE as parseDotEnv,Be as parseGitRemoteUrl,NE as parseParameterPath,Re as parseShellArgs,sr as patternConstructId,K as projectCapacityIdentityToTarget,q as regionSuffixRejectionMessage,qe as regions,he as resolveSynthEnvironment,A as serialiseHostsChunks,ae as singleton,se as sleep,xe as stageFromWireEnvironment,w as suffixedAccountName,Je as suggestRegionForTimezone,$r as toDeploymentFailureAnalysis,c as toKebab,p as toPascalCase,D as toScreamingSnake,I as toValidDatabaseName};
+import{DNS_APEX as r,getDomainExportNames as _,getDomainStackName as t,getDomainUsEast1CertificatesStackName as o,hostsExportPartName as S,serialiseHostsChunks as T,HOSTS_OUTPUT_MAX_BYTES as A,isManagedDomainBinding as a,DOMAIN_DEPLOY_DEFAULT_PHASE as N}from"./infra/domainExports.js";import{BACKUP_VAULT_NAME as n}from"./infra/backupVault.js";import{APPROVAL_TOKEN_OUTPUT_PREFIX as m,TOKEN_STDERR_PREFIX as O}from"./deploy/approvalTokenOutput.js";import{imageTagParameterName as C}from"./infra/imageTags.js";import{toPascalCase as I,toKebab as p,toValidDatabaseName as D,toScreamingSnake as L,capitalise as c,getSafeZoneName as M,accountConstructKey as f,hasAsciiStableConstructKey as U}from"./naming/caseConversion.js";import{albDnsExportName as u,albHostedZoneIdExportName as d,cdnDomainExportName as g,bucketWebsiteEndpointExportName as x,bucketWebsiteHostedZoneIdExportName as F}from"./naming/targetExportNames.js";import{CAPACITY_SLOT_PATTERN as V,CAPACITY_SLOT_MAX_LENGTH as Y,DEFAULT_CAPACITY_SLOT as y,CAPACITY_ANCHOR_PATTERN as G,CAPACITY_ANCHOR_MAX_LENGTH as H,CAPACITY_IDENTITY_CONTEXT_KEY as v,CapacityIdentityPinSchema as b,CapacityIdentityWireSchema as K,CapacityIdentityConfigSchema as X,projectCapacityIdentityToTarget as B}from"./capacityIdentity.js";import{findAccountNameCollision as k}from"./naming/accountNameCollision.js";import{defaultConnectedAccountName as j,suffixedAccountName as w,REGION_SHORT_CODES as z,findTrailingRegionShortCode as Q,regionSuffixRejectionMessage as q}from"./naming/connectedAccountName.js";import{normaliseError as $,getErrorMessage as ee,hasErrorCode as Ee,getErrorCode as re,getErrorStack as _e,formatErrorString as te}from"./errorUtils.js";import{singleton as Se}from"./async/singleton.js";import{DANGEROUS_ENV_VARS as Ae,filterDangerousEnvVars as ae,MASKED_VALUE_MARKER as Ne,maskSensitiveOutput as Re,parseShellArgs as ne,REDACTED_KEY_SENTINEL as ie,SCOPED_TOKEN_REGEX as me}from"./securityHelpers.js";import{sleep as Pe}from"./async/sleep.js";import{mapSettledWithConcurrency as se}from"./async/concurrency.js";import{ACCOUNT_STAGES_WITH_ROOT as pe,STRUCTURAL_ENVIRONMENTS as De,ACCOUNT_STAGES as Le,ACCOUNT_STAGE_LABELS as ce,isAccountStage as Me,ACCOUNT_TIERS as fe,AccountTierSchema as Ue,isAccountTier as le,GOVERNANCE_ACCOUNT_TIERS as ue,isGovernanceTier as de,environmentToTier as ge,stageFromWireEnvironment as xe,accountTier as Fe,resolveSynthEnvironment as he,getEnvironmentLabel as Ve,ACCOUNT_ROLES as Ye}from"./environments.js";import{RESOURCE_CATEGORIES as Ge,categoriseResource as He,getExpectedDuration as ve,getFriendlyResourceType as be}from"./resourceCategorisation.js";import{parseGitRemoteUrl as Xe}from"./repo/gitRemoteParser.js";import{abbreviateRegion as We,AWS_REGIONS_METADATA as ke,DEFAULT_REGION as Ze,getRegionInfo as je,MAX_SECONDARY_REGIONS as we,OPT_IN_REGION_CODES as ze,optInRegionWarning as Qe,regions as qe,suggestRegionForTimezone as Je}from"./infra/regions.js";import{SCOPE_VALUES as eE,MACHINE_ONLY_SCOPES as EE,USER_GRANTABLE_SCOPES as rE,GOVERNANCE_SCOPE_REQUIRED_CODE as _E}from"./infra/tokenScopes.js";import{SECRET_NAME_PATTERN as oE,SECRET_NAME_ERROR as SE,SSM_COMPONENT_PATTERN as TE,SSM_COMPONENT_ERROR as AE,SSM_STANDARD_MAX_VALUE_BYTES as aE,SecretNamespaceSchema as NE,buildNamespaceParts as RE,buildParameterPath as nE,parseParameterPath as iE,isManageablePath as mE,parseDotEnv as OE,escapeDotEnvValue as PE}from"./secrets.js";import{ConnectionWireSchema as sE,ConnectionsListResponseSchema as IE,CONNECTION_PHASES as pE,CONNECTION_TERMINAL_FAILURE_PHASES as DE,CONNECTION_FAILURE_REASONS as LE,EXTERNAL_ID_PATTERN as cE}from"./infra/connectionsWire.js";import{PUBLIC_PACKAGE_NAME as fE,INSTALL_SOURCES as UE,SETUP_COMMANDS as lE,upgradeCommand as uE,SETUP_MODES as dE,SETUP_STEP_IDS as gE,SETUP_STEPS as xE,AGENT_SETUP_PROMPTS as FE,AGENT_INSTALL_COMMAND as hE,SKILL_INSTALL_SEGMENTS as VE,SKILL_INSTALL_FILENAME as YE,SKILL_INSTALL_PATH as yE}from"./onboarding/index.js";import{deriveRegionsFromOrgConfig as HE,deriveTargets as vE,deriveAllTargets as bE,environmentOrTier as KE,findTarget as XE,generateTargetName as BE}from"./targets.js";import{buildAppConfigPath as kE}from"./repo/appPath.js";import{findInfrastructurePaths as jE,findBoundaryPath as wE,isInfrastructureFile as zE}from"./repo/findInfrastructurePaths.js";import{inferContainerFromCandidates as qE}from"./repo/inferContainerFromCandidates.js";import{RESERVED_APP_NAMES as $E,RESERVED_APP_NAME_MESSAGE as er,isReservedAppName as Er,RESERVED_APP_NAME_SUFFIX as rr,RESERVED_APP_NAME_SUFFIX_MESSAGE as _r,hasReservedAppNameSuffix as tr}from"./naming/reservedAppNames.js";import{deriveContentHashTag as Sr,CONTENT_HASH_TAG_PATTERN as Tr}from"./infra/deriveContentHashTag.js";import{DEPLOY_MODES as ar,DeployModeSchema as Nr,IMAGE_TAG_PATTERN as Rr,ImageTagSchema as nr,ServiceArtefactSchema as ir,ServiceArtefactsSchema as mr,ARTEFACT_OUTPUT_FIELDS as Or,artefactOutputKey as Pr}from"./infra/deployArtefacts.js";import{MIGRATION_SNAPSHOT_NAME_PREFIX as sr,EXPECTED_SCHEMA_VERSION_ENV as Ir,EXPECTED_SCHEMA_VERSION_TOOL_ENV as pr,EXPECTED_CH_SCHEMA_VERSION_ENV as Dr,SCHEMA_ADMIN_USER_ENV as Lr,SCHEMA_ADMIN_PASSWORD_ENV as cr,PRISMA_MIGRATION_DIR_RE as Mr,CLICKHOUSE_MIGRATION_SKIP_RE as fr}from"./migration/constants.js";import{PHYSICAL_NAME_FALLBACK_PROPERTIES as lr}from"./cfn/physicalNameProperties.js";import{PATTERN_TYPE_VALUES as dr,PATTERN_TYPES as gr,isPatternType as xr,PATTERN_REGISTRY as Fr,patternConstructId as hr,DEPLOYABLE_PATTERN_TYPES as Vr,OPENNEXT_PATTERN_TYPES as Yr,isOpenNextPatternType as yr,STATIC_SITE_ROUTING_VALUES as Gr}from"./patterns/patternTypes.js";import{DEFAULT_FORMS_FROM_LOCAL_PART as vr,defaultFormsFromAddress as br,defaultFormsCorsOrigin as Kr,isAddressAtDomain as Xr}from"./patterns/staticSiteForms.js";import{DEV_SUBSTRATE_PARAMS_SCHEMA_VERSION as Wr,DEV_SUBSTRATE_PARAMS_FILENAME as kr,DevSubstrateSynthPropsSchema as Zr,DevSubstrateParamsSchema as jr}from"./devSubstrate/params.js";import{DEV_SUBSTRATE_ENTRYPOINT_SOURCE as zr}from"./devSubstrate/entrypoint.js";import{BLESSED_CDK_TOOLCHAIN as qr}from"./cdkToolchain.js";import{DEPLOYMENT_FAILURE_PHASES as $r,DeploymentFailurePhaseSchema as e_,DEPLOYMENT_FAULT_ATTRIBUTIONS as E_,DeploymentFaultAttributionSchema as r_,DEPLOYMENT_FAILURE_PROVIDER_SOURCES as __,DeploymentFailureProviderSourceSchema as t_,DEPLOYMENT_FAILURE_CODE_PATTERN as o_,DEPLOYMENT_FAILURE_SCHEMA_VERSION as S_,DEPLOYMENT_FAILURE_LIMITS as T_,DeploymentFailureAnalysisSchema as A_,DeploymentFailureProviderSchema as a_,DeploymentFailureResourceSchema as N_,DeploymentFailureSchema as R_,parseDeploymentFailure as n_,DEPLOYMENT_FAILURE_DOCS_BASE_URL as i_,deploymentFailureDocsUrl as m_,DEPLOYMENT_FAULT_COPY as O_,DEPLOYMENT_PROVIDER_LABELS as P_,deriveErrorMessageFromFailure as C_,toDeploymentFailureAnalysis as s_}from"./failure/deploymentFailure.js";import{extractErrorWindow as p_,ERROR_WINDOW_CONTEXT_LINES as D_}from"./failure/extractErrorWindow.js";export{Ye as ACCOUNT_ROLES,Le as ACCOUNT_STAGES,pe as ACCOUNT_STAGES_WITH_ROOT,ce as ACCOUNT_STAGE_LABELS,fe as ACCOUNT_TIERS,hE as AGENT_INSTALL_COMMAND,FE as AGENT_SETUP_PROMPTS,m as APPROVAL_TOKEN_OUTPUT_PREFIX,Or as ARTEFACT_OUTPUT_FIELDS,ke as AWS_REGIONS_METADATA,Ue as AccountTierSchema,n as BACKUP_VAULT_NAME,qr as BLESSED_CDK_TOOLCHAIN,H as CAPACITY_ANCHOR_MAX_LENGTH,G as CAPACITY_ANCHOR_PATTERN,v as CAPACITY_IDENTITY_CONTEXT_KEY,Y as CAPACITY_SLOT_MAX_LENGTH,V as CAPACITY_SLOT_PATTERN,fr as CLICKHOUSE_MIGRATION_SKIP_RE,LE as CONNECTION_FAILURE_REASONS,pE as CONNECTION_PHASES,DE as CONNECTION_TERMINAL_FAILURE_PHASES,Tr as CONTENT_HASH_TAG_PATTERN,X as CapacityIdentityConfigSchema,b as CapacityIdentityPinSchema,K as CapacityIdentityWireSchema,sE as ConnectionWireSchema,IE as ConnectionsListResponseSchema,Ae as DANGEROUS_ENV_VARS,y as DEFAULT_CAPACITY_SLOT,vr as DEFAULT_FORMS_FROM_LOCAL_PART,Ze as DEFAULT_REGION,Vr as DEPLOYABLE_PATTERN_TYPES,o_ as DEPLOYMENT_FAILURE_CODE_PATTERN,i_ as DEPLOYMENT_FAILURE_DOCS_BASE_URL,T_ as DEPLOYMENT_FAILURE_LIMITS,$r as DEPLOYMENT_FAILURE_PHASES,__ as DEPLOYMENT_FAILURE_PROVIDER_SOURCES,S_ as DEPLOYMENT_FAILURE_SCHEMA_VERSION,E_ as DEPLOYMENT_FAULT_ATTRIBUTIONS,O_ as DEPLOYMENT_FAULT_COPY,P_ as DEPLOYMENT_PROVIDER_LABELS,ar as DEPLOY_MODES,zr as DEV_SUBSTRATE_ENTRYPOINT_SOURCE,kr as DEV_SUBSTRATE_PARAMS_FILENAME,Wr as DEV_SUBSTRATE_PARAMS_SCHEMA_VERSION,r as DNS_APEX,N as DOMAIN_DEPLOY_DEFAULT_PHASE,Nr as DeployModeSchema,A_ as DeploymentFailureAnalysisSchema,e_ as DeploymentFailurePhaseSchema,a_ as DeploymentFailureProviderSchema,t_ as DeploymentFailureProviderSourceSchema,N_ as DeploymentFailureResourceSchema,R_ as DeploymentFailureSchema,r_ as DeploymentFaultAttributionSchema,jr as DevSubstrateParamsSchema,Zr as DevSubstrateSynthPropsSchema,D_ as ERROR_WINDOW_CONTEXT_LINES,Dr as EXPECTED_CH_SCHEMA_VERSION_ENV,Ir as EXPECTED_SCHEMA_VERSION_ENV,pr as EXPECTED_SCHEMA_VERSION_TOOL_ENV,cE as EXTERNAL_ID_PATTERN,ue as GOVERNANCE_ACCOUNT_TIERS,_E as GOVERNANCE_SCOPE_REQUIRED_CODE,A as HOSTS_OUTPUT_MAX_BYTES,Rr as IMAGE_TAG_PATTERN,UE as INSTALL_SOURCES,nr as ImageTagSchema,EE as MACHINE_ONLY_SCOPES,Ne as MASKED_VALUE_MARKER,we as MAX_SECONDARY_REGIONS,sr as MIGRATION_SNAPSHOT_NAME_PREFIX,Yr as OPENNEXT_PATTERN_TYPES,ze as OPT_IN_REGION_CODES,Fr as PATTERN_REGISTRY,gr as PATTERN_TYPES,dr as PATTERN_TYPE_VALUES,lr as PHYSICAL_NAME_FALLBACK_PROPERTIES,Mr as PRISMA_MIGRATION_DIR_RE,fE as PUBLIC_PACKAGE_NAME,ie as REDACTED_KEY_SENTINEL,z as REGION_SHORT_CODES,$E as RESERVED_APP_NAMES,er as RESERVED_APP_NAME_MESSAGE,rr as RESERVED_APP_NAME_SUFFIX,_r as RESERVED_APP_NAME_SUFFIX_MESSAGE,Ge as RESOURCE_CATEGORIES,cr as SCHEMA_ADMIN_PASSWORD_ENV,Lr as SCHEMA_ADMIN_USER_ENV,me as SCOPED_TOKEN_REGEX,eE as SCOPE_VALUES,SE as SECRET_NAME_ERROR,oE as SECRET_NAME_PATTERN,lE as SETUP_COMMANDS,dE as SETUP_MODES,xE as SETUP_STEPS,gE as SETUP_STEP_IDS,YE as SKILL_INSTALL_FILENAME,yE as SKILL_INSTALL_PATH,VE as SKILL_INSTALL_SEGMENTS,AE as SSM_COMPONENT_ERROR,TE as SSM_COMPONENT_PATTERN,aE as SSM_STANDARD_MAX_VALUE_BYTES,Gr as STATIC_SITE_ROUTING_VALUES,De as STRUCTURAL_ENVIRONMENTS,NE as SecretNamespaceSchema,ir as ServiceArtefactSchema,mr as ServiceArtefactsSchema,O as TOKEN_STDERR_PREFIX,rE as USER_GRANTABLE_SCOPES,We as abbreviateRegion,f as accountConstructKey,Fe as accountTier,u as albDnsExportName,d as albHostedZoneIdExportName,Pr as artefactOutputKey,x as bucketWebsiteEndpointExportName,F as bucketWebsiteHostedZoneIdExportName,kE as buildAppConfigPath,RE as buildNamespaceParts,nE as buildParameterPath,c as capitalise,He as categoriseResource,g as cdnDomainExportName,j as defaultConnectedAccountName,Kr as defaultFormsCorsOrigin,br as defaultFormsFromAddress,m_ as deploymentFailureDocsUrl,bE as deriveAllTargets,Sr as deriveContentHashTag,C_ as deriveErrorMessageFromFailure,HE as deriveRegionsFromOrgConfig,vE as deriveTargets,KE as environmentOrTier,ge as environmentToTier,PE as escapeDotEnvValue,p_ as extractErrorWindow,ae as filterDangerousEnvVars,k as findAccountNameCollision,wE as findBoundaryPath,jE as findInfrastructurePaths,XE as findTarget,Q as findTrailingRegionShortCode,te as formatErrorString,BE as generateTargetName,_ as getDomainExportNames,t as getDomainStackName,o as getDomainUsEast1CertificatesStackName,Ve as getEnvironmentLabel,re as getErrorCode,ee as getErrorMessage,_e as getErrorStack,ve as getExpectedDuration,be as getFriendlyResourceType,je as getRegionInfo,M as getSafeZoneName,U as hasAsciiStableConstructKey,Ee as hasErrorCode,tr as hasReservedAppNameSuffix,S as hostsExportPartName,C as imageTagParameterName,qE as inferContainerFromCandidates,Me as isAccountStage,le as isAccountTier,Xr as isAddressAtDomain,de as isGovernanceTier,zE as isInfrastructureFile,mE as isManageablePath,a as isManagedDomainBinding,yr as isOpenNextPatternType,xr as isPatternType,Er as isReservedAppName,se as mapSettledWithConcurrency,Re as maskSensitiveOutput,$ as normaliseError,Qe as optInRegionWarning,n_ as parseDeploymentFailure,OE as parseDotEnv,Xe as parseGitRemoteUrl,iE as parseParameterPath,ne as parseShellArgs,hr as patternConstructId,B as projectCapacityIdentityToTarget,q as regionSuffixRejectionMessage,qe as regions,he as resolveSynthEnvironment,T as serialiseHostsChunks,Se as singleton,Pe as sleep,xe as stageFromWireEnvironment,w as suffixedAccountName,Je as suggestRegionForTimezone,s_ as toDeploymentFailureAnalysis,p as toKebab,I as toPascalCase,L as toScreamingSnake,D as toValidDatabaseName,uE as upgradeCommand};

package/dist/infra/connectionsWire.d.ts

@@ -14,6 +14,8 @@ export declare const ConnectionWireSchema: z.ZodObject<{
     roleArn: z.ZodString;
     environment: z.ZodOptional<z.ZodString>;
     connectedAt: z.ZodString;
+    externalId: z.ZodOptional<z.ZodString>;
+    reason: z.ZodOptional<z.ZodString>;
 }, z.core.$strip>;
 export type ConnectionWire = z.infer<typeof ConnectionWireSchema>;
 export declare const ConnectionsListResponseSchema: z.ZodObject<{
@@ -25,6 +27,39 @@ export declare const ConnectionsListResponseSchema: z.ZodObject<{
         roleArn: z.ZodString;
         environment: z.ZodOptional<z.ZodString>;
         connectedAt: z.ZodString;
+        externalId: z.ZodOptional<z.ZodString>;
+        reason: z.ZodOptional<z.ZodString>;
     }, z.core.$strip>>;
 }, z.core.$strip>;
 export type ConnectionsListResponse = z.infer<typeof ConnectionsListResponseSchema>;
+/**
+ * Connection lifecycle vocabulary shared with the webapp producer
+ * (`GET /api/connections/status`, the wizard and the CLI's `connect` wait
+ * loop). Coupled value across repos: the webapp mirrors these tuples at
+ * `webapp/app/lib/connections-wire.ts` until it imports them from a minted
+ * `@fjall/util`; a change here MUST land on both sides together, the way
+ * `TOKEN_AUTH_FAILURE_REASONS` is kept in lockstep. The content pins in
+ * `util/src/__tests__/connectionsWire.test.ts` are the drift tripwire.
+ */
+export declare const CONNECTION_PHASES: readonly ["awaiting_stack", "connected", "failed", "disconnected"];
+export type ConnectionPhase = (typeof CONNECTION_PHASES)[number];
+/**
+ * The terminal-failure subset: phases where polling must stop and the
+ * reason's cure be reported. `satisfies` pins every member to a real
+ * phase; consumers derive their accept-sets from this tuple rather than
+ * hand-listing the pair.
+ */
+export declare const CONNECTION_TERMINAL_FAILURE_PHASES: readonly ["failed", "disconnected"];
+export type ConnectionTerminalFailurePhase = (typeof CONNECTION_TERMINAL_FAILURE_PHASES)[number];
+export declare const CONNECTION_FAILURE_REASONS: readonly ["account_mismatch", "root_exists", "root_promotion", "name_conflict", "plan_limit", "stack_rolled_back", "stack_deleted"];
+export type ConnectionFailureReason = (typeof CONNECTION_FAILURE_REASONS)[number];
+/**
+ * The connection external id: minted by the webapp as
+ * `randomBytes(16).toString("hex")` (32 hex characters) and accepted up to 64
+ * so a wider mint never breaks an older client. Canonical pattern the
+ * validators converge on: the webapp callback route enforces the equivalent
+ * 32–64 hex chain today, the status route accepts >=32 with no upper cap
+ * until it adopts this constant at the next `@fjall/util` mint, and the CLI
+ * `connect status` command consumes it when that command lands.
+ */
+export declare const EXTERNAL_ID_PATTERN: RegExp;

package/dist/infra/connectionsWire.js

@@ -1 +1 @@
-import{z as n}from"zod";const t=n.object({awsAccountId:n.string(),accountName:n.string().nullable(),status:n.string(),role:n.string(),roleArn:n.string(),environment:n.string().optional(),connectedAt:n.string()}),e=n.object({accounts:n.array(t)});export{t as ConnectionWireSchema,e as ConnectionsListResponseSchema};
+import{z as t}from"zod";const n=t.object({awsAccountId:t.string(),accountName:t.string().nullable(),status:t.string(),role:t.string(),roleArn:t.string(),environment:t.string().optional(),connectedAt:t.string(),externalId:t.string().optional(),reason:t.string().optional()}),e=t.object({accounts:t.array(n)}),c=["awaiting_stack","connected","failed","disconnected"],s=["failed","disconnected"],i=["account_mismatch","root_exists","root_promotion","name_conflict","plan_limit","stack_rolled_back","stack_deleted"],r=/^[a-f0-9]{32,64}$/;export{i as CONNECTION_FAILURE_REASONS,c as CONNECTION_PHASES,s as CONNECTION_TERMINAL_FAILURE_PHASES,n as ConnectionWireSchema,e as ConnectionsListResponseSchema,r as EXTERNAL_ID_PATTERN};

package/dist/onboarding/index.d.ts

@@ -0,0 +1,79 @@
+/**
+ * The Fjall setup contract — the single source of truth for every command
+ * string, step sequence and install path the onboarding surfaces show.
+ *
+ * Consumers (cross-system parity — every surface derives, none hand-copies):
+ * the SKILL.md template, CLI next-step hints and gates, the MCP resolver, the
+ * webapp wizard, and the docs lint. A rename lands here once; the fjall
+ * parity test (`skillInvocationParity.test.ts`) proves every command below
+ * still parses against the live commander program.
+ *
+ * Client-safe by construction: pure data plus pure functions, no Node
+ * imports — the webapp renders this in the browser.
+ */
+/** The npm package end users install (the self-contained wrapper). */
+export declare const PUBLIC_PACKAGE_NAME: "fjall";
+export declare const INSTALL_SOURCES: readonly ["npm", "homebrew"];
+export type InstallSource = (typeof INSTALL_SOURCES)[number];
+export declare const SETUP_COMMANDS: {
+    readonly install: "npm install -g fjall";
+    readonly upgrade: "npm install -g fjall@latest";
+    readonly upgradeHomebrew: "brew upgrade fjall";
+    readonly installSkill: "fjall agent install-skill";
+    readonly installHooks: "fjall agent install-hooks";
+    readonly uninstallHooks: "fjall agent uninstall-hooks";
+    readonly sessionContext: "fjall agent session-context";
+    readonly login: "fjall login";
+    readonly loginDevice: "fjall login --device";
+    readonly loginDeviceAgent: "fjall login --device --agent";
+    readonly createAccount: "fjall create account";
+    readonly createOrganisation: "fjall create organisation";
+    readonly connect: "fjall connect";
+    readonly connectStatus: "fjall connect status";
+    readonly accountDeploy: "fjall account deploy";
+    readonly organisationDeploy: "fjall org deploy";
+    readonly createApplication: "fjall create app";
+    readonly createApplicationAgent: "fjall apps create";
+    readonly deployApplication: "fjall deploy <app>";
+    readonly status: "fjall status";
+};
+export type SetupCommandId = keyof typeof SETUP_COMMANDS;
+/** The upgrade command for how the CLI was installed. */
+export declare function upgradeCommand(source: InstallSource): string;
+export declare const SETUP_MODES: readonly ["account", "organisation"];
+export type SetupMode = (typeof SETUP_MODES)[number];
+export declare const SETUP_STEP_IDS: readonly ["scaffold", "connect", "deploy"];
+export type SetupStepId = (typeof SETUP_STEP_IDS)[number];
+export interface SetupStep {
+    readonly id: SetupStepId;
+    readonly command: SetupCommandId;
+    /** Short, path-neutral title — checklist rows, wizard headings. */
+    readonly label: string;
+    /** One sentence on what the step leaves behind. */
+    readonly summary: string;
+}
+export type SetupStepSequence = readonly [SetupStep, SetupStep, SetupStep];
+/**
+ * The three steps of each setup mode, in order. Presentation-only fields
+ * (time hints, teasers, expected-output lines) stay with the surface that
+ * renders them.
+ */
+export declare const SETUP_STEPS: Record<SetupMode, SetupStepSequence>;
+/**
+ * The prompt a person pastes into their agent, one per mode. Derived from
+ * `SETUP_STEPS` so the prompt and the checklist can never name different
+ * commands.
+ */
+export declare const AGENT_SETUP_PROMPTS: Record<SetupMode, string>;
+/** The one-line install for agent hosts: CLI plus the skill file. */
+export declare const AGENT_INSTALL_COMMAND: "npm install -g fjall && fjall agent install-skill";
+/**
+ * Where `fjall agent install-skill` writes SKILL.md, relative to the home
+ * directory. The runtime `join(homedir(), ...SKILL_INSTALL_SEGMENTS)` and the
+ * display string both derive from this tuple.
+ */
+export declare const SKILL_INSTALL_SEGMENTS: readonly [".claude", "skills", "fjall"];
+export declare const SKILL_INSTALL_FILENAME: "SKILL.md";
+export declare const SKILL_INSTALL_DIR: `~/${string}`;
+export declare const SKILL_INSTALL_PATH: `~/${string}/SKILL.md`;
+export { compareSemver, isNewerVersion, parseSemver, type ParsedSemver } from "./versionCurrency.js";

package/dist/onboarding/index.js

@@ -0,0 +1 @@
+var c=Object.defineProperty;var o=(a,n)=>c(a,"name",{value:n,configurable:!0});const m="fjall",g=["npm","homebrew"],t={install:"npm install -g fjall",upgrade:"npm install -g fjall@latest",upgradeHomebrew:"brew upgrade fjall",installSkill:"fjall agent install-skill",installHooks:"fjall agent install-hooks",uninstallHooks:"fjall agent uninstall-hooks",sessionContext:"fjall agent session-context",login:"fjall login",loginDevice:"fjall login --device",loginDeviceAgent:"fjall login --device --agent",createAccount:"fjall create account",createOrganisation:"fjall create organisation",connect:"fjall connect",connectStatus:"fjall connect status",accountDeploy:"fjall account deploy",organisationDeploy:"fjall org deploy",createApplication:"fjall create app",createApplicationAgent:"fjall apps create",deployApplication:"fjall deploy <app>",status:"fjall status"};function f(a){return a==="homebrew"?t.upgradeHomebrew:t.upgrade}o(f,"upgradeCommand");const S=["account","organisation"],j=["scaffold","connect","deploy"],r={account:[{id:"scaffold",command:"createAccount",label:"Create the account project",summary:"Scaffolds fjall/account/infrastructure.ts, the declaration of everything Fjall manages in one AWS account."},{id:"connect",command:"connect",label:"Connect your AWS account",summary:"Opens the AWS quick-create link that installs Fjall's OIDC trust in the account, then waits for the stack to report back."},{id:"deploy",command:"accountDeploy",label:"Deploy account infrastructure",summary:"Provisions the account tier \u2014 deploy roles, logging and guardrails \u2014 so applications can be deployed into it."}],organisation:[{id:"scaffold",command:"createOrganisation",label:"Create the organisation project",summary:"Scaffolds fjall/organisation/infrastructure.ts with the member accounts, identity and guardrail declarations."},{id:"connect",command:"connect",label:"Connect the management account",summary:"Opens the AWS quick-create link that installs Fjall's OIDC trust in the AWS Organizations management account, then waits for the stack to report back."},{id:"deploy",command:"organisationDeploy",label:"Deploy the organisation",summary:"Creates the member accounts and provisions the organisation, platform and account tiers."}]},i={account:"I want to deploy a single AWS account",organisation:"I want to deploy an organisation with governance and shared infrastructure"};function e(a){const n=r[a].map(l=>`\`${t[l.command]}\``).join(", ");return`Set up Fjall for me \u2014 ${i[a]}. Follow the fjall skill and run ${n} in that order, passing --agent on every command.`}o(e,"buildAgentSetupPrompt");const A={account:e("account"),organisation:e("organisation")},h=`${t.install} && ${t.installSkill}`,s=[".claude","skills","fjall"],p="SKILL.md",u=`~/${s.join("/")}`,y=`${u}/${p}`;import{compareSemver as T,isNewerVersion as E,parseSemver as I}from"./versionCurrency.js";export{h as AGENT_INSTALL_COMMAND,A as AGENT_SETUP_PROMPTS,g as INSTALL_SOURCES,m as PUBLIC_PACKAGE_NAME,t as SETUP_COMMANDS,S as SETUP_MODES,r as SETUP_STEPS,j as SETUP_STEP_IDS,u as SKILL_INSTALL_DIR,p as SKILL_INSTALL_FILENAME,y as SKILL_INSTALL_PATH,s as SKILL_INSTALL_SEGMENTS,T as compareSemver,E as isNewerVersion,I as parseSemver,f as upgradeCommand};

package/dist/onboarding/versionCurrency.d.ts

@@ -0,0 +1,25 @@
+/**
+ * Semver ordering for install-currency decisions ("is the published version
+ * newer than the one running?"). Fjall versions are lerna-minted
+ * `MAJOR.MINOR.PATCH` with an optional prerelease; build metadata is ignored
+ * per the spec. Pure and client-safe — the webapp can compare too.
+ *
+ * Two sibling parsers exist with deliberately different semantics — do not
+ * consolidate onto this one: `util/src/docker/DockerCli.daemon.ts` truncates
+ * prerelease (daemon versions like `24.0.7-ce` gate on the core only), and
+ * `deploy-core` `engineCompat.ts#parseEngineVersion` refuses malformed input
+ * outright so a corrupted constraint cannot vacate the engine gate. This one
+ * compares prerelease per spec §11, which dist-tag currency needs.
+ */
+export interface ParsedSemver {
+    readonly core: readonly [number, number, number];
+    readonly prerelease: readonly string[];
+}
+export declare function parseSemver(version: string): ParsedSemver | undefined;
+/** Spec §11 precedence; -1 / 0 / 1 like `Array.prototype.sort` comparators. */
+export declare function compareSemver(a: ParsedSemver, b: ParsedSemver): number;
+/**
+ * Whether `candidate` is strictly newer than `current`. Unparseable input on
+ * either side is "not newer" — a currency nudge must never fire on garbage.
+ */
+export declare function isNewerVersion(candidate: string, current: string): boolean;

package/dist/onboarding/versionCurrency.js

@@ -0,0 +1 @@
+var o=Object.defineProperty;var i=(r,e)=>o(r,"name",{value:e,configurable:!0});const c=/^v?(\d+)\.(\d+)\.(\d+)(?:-([0-9A-Za-z-]+(?:\.[0-9A-Za-z-]+)*))?(?:\+[0-9A-Za-z-]+(?:\.[0-9A-Za-z-]+)*)?$/;function l(r){const e=c.exec(r.trim());if(e===null)return;const[,t="0",n="0",s="0",a]=e;return{core:[Number(t),Number(n),Number(s)],prerelease:a===void 0?[]:a.split(".")}}i(l,"parseSemver");const u=/^\d+$/;function p(r,e){const t=u.test(r),n=u.test(e);return t&&n?Math.sign(Number(r)-Number(e)):t?-1:n?1:r<e?-1:r>e?1:0}i(p,"comparePrereleaseIdentifier");function d(r,e){for(let n=0;n<3;n+=1){const s=Math.sign(r.core[n]-e.core[n]);if(s!==0)return s}if(r.prerelease.length===0||e.prerelease.length===0)return Math.sign(e.prerelease.length-r.prerelease.length);const t=Math.min(r.prerelease.length,e.prerelease.length);for(let n=0;n<t;n+=1){const s=p(r.prerelease[n]??"",e.prerelease[n]??"");if(s!==0)return s}return Math.sign(r.prerelease.length-e.prerelease.length)}i(d,"compareSemver");function h(r,e){const t=l(r),n=l(e);return t===void 0||n===void 0?!1:d(t,n)>0}i(h,"isNewerVersion");export{d as compareSemver,h as isNewerVersion,l as parseSemver};

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@fjall/util",
-  "version": "18.0.0",
+  "version": "20.0.0",
   "repository": {
     "type": "git",
     "url": "git+https://github.com/fjall-tech/fjall.git",
@@ -114,6 +114,10 @@
     "./errors/absence": {
       "types": "./dist/errors/absence.d.ts",
       "default": "./dist/errors/absence.js"
+    },
+    "./onboarding": {
+      "types": "./dist/onboarding/index.d.ts",
+      "default": "./dist/onboarding/index.js"
     }
   },
   "files": [