@fjall/util 2.24.0 → 2.25.0

package/dist/.minified

@@ -1 +1 @@
-75 files minified at 2026-07-05T07:50:20.044Z
+75 files minified at 2026-07-06T11:56:15.602Z

package/dist/deploy/approvalTokenOutput.d.ts

@@ -9,3 +9,10 @@
  * silently. `@fjall/util` is the lowest common dependency of both.
  */
 export declare const APPROVAL_TOKEN_OUTPUT_PREFIX = "Approval token: ";
+/**
+ * The exact stderr prefix the CLI prints minted scoped tokens under
+ * (`fjall ci setup` / `fjall ci token create` / `fjall user token create`)
+ * and the MCP `apply_ci_setup` handler parses to capture the one-time value.
+ * Same cross-package print/parse contract as APPROVAL_TOKEN_OUTPUT_PREFIX.
+ */
+export declare const TOKEN_STDERR_PREFIX = "Token: ";

package/dist/deploy/approvalTokenOutput.js

@@ -1 +1 @@
-const o="Approval token: ";export{o as APPROVAL_TOKEN_OUTPUT_PREFIX};
+const o="Approval token: ",T="Token: ";export{o as APPROVAL_TOKEN_OUTPUT_PREFIX,T as TOKEN_STDERR_PREFIX};

package/dist/index.d.ts

@@ -1,13 +1,13 @@
 export { DNS_APEX, getDomainExportNames, type ManagedDomainExports } from "./infra/domainExports.js";
 export { BACKUP_VAULT_NAME } from "./infra/backupVault.js";
-export { APPROVAL_TOKEN_OUTPUT_PREFIX } from "./deploy/approvalTokenOutput.js";
+export { APPROVAL_TOKEN_OUTPUT_PREFIX, TOKEN_STDERR_PREFIX } from "./deploy/approvalTokenOutput.js";
 export { imageTagParameterName } from "./infra/imageTags.js";
 export { toPascalCase, toKebab, toValidDatabaseName, toScreamingSnake, capitalise, getSafeZoneName, accountConstructKey, hasAsciiStableConstructKey } from "./naming/caseConversion.js";
 export { findAccountNameCollision, type AccountNameCollision } from "./naming/accountNameCollision.js";
 export { defaultConnectedAccountName, suffixedAccountName, REGION_SHORT_CODES, findTrailingRegionShortCode, regionSuffixRejectionMessage } from "./naming/connectedAccountName.js";
 export { normaliseError, getErrorMessage, hasErrorCode, getErrorCode, getErrorStack, formatErrorString } from "./errorUtils.js";
 export { singleton } from "./async/singleton.js";
-export { DANGEROUS_ENV_VARS, filterDangerousEnvVars, maskSensitiveOutput, parseShellArgs } from "./securityHelpers.js";
+export { DANGEROUS_ENV_VARS, filterDangerousEnvVars, maskSensitiveOutput, parseShellArgs, SCOPED_TOKEN_REGEX } from "./securityHelpers.js";
 export { sleep } from "./async/sleep.js";
 export { mapSettledWithConcurrency } from "./async/concurrency.js";
 export { ACCOUNT_STAGES_WITH_ROOT, STRUCTURAL_ENVIRONMENTS, ACCOUNT_STAGES, ACCOUNT_STAGE_LABELS, isAccountStage, ACCOUNT_TIERS, type AccountTier, AccountTierSchema, isAccountTier, environmentToTier, stageFromWireEnvironment, accountTier, type AccountStageWithRoot, type AccountStage, getEnvironmentLabel, ACCOUNT_ROLES } from "./environments.js";
@@ -23,6 +23,6 @@ export { type ScanPath } from "./repo/scanTypes.js";
 export { findInfrastructurePaths, findBoundaryPath, isInfrastructureFile, type MarkerEntry, type FindInfrastructurePathsOptions } from "./repo/findInfrastructurePaths.js";
 export { inferContainerFromCandidates } from "./repo/inferContainerFromCandidates.js";
 export { RESERVED_APP_NAMES, type ReservedAppName, RESERVED_APP_NAME_MESSAGE, isReservedAppName } from "./naming/reservedAppNames.js";
-export { deriveContentHashTag } from "./infra/deriveContentHashTag.js";
+export { deriveContentHashTag, CONTENT_HASH_TAG_PATTERN } from "./infra/deriveContentHashTag.js";
 export { DEPLOY_MODES, DeployModeSchema, type DeployMode, IMAGE_TAG_PATTERN, ImageTagSchema, type ImageTag, ServiceArtefactSchema, type ServiceArtefact, ServiceArtefactsSchema, type ServiceArtefacts, ARTEFACT_OUTPUT_FIELDS, type ArtefactOutputField, artefactOutputKey } from "./infra/deployArtefacts.js";
 export { MIGRATION_SNAPSHOT_NAME_PREFIX, EXPECTED_SCHEMA_VERSION_ENV, EXPECTED_SCHEMA_VERSION_TOOL_ENV, EXPECTED_CH_SCHEMA_VERSION_ENV, SCHEMA_ADMIN_USER_ENV, SCHEMA_ADMIN_PASSWORD_ENV, PRISMA_MIGRATION_DIR_RE, CLICKHOUSE_MIGRATION_SKIP_RE } from "./migration/constants.js";

package/dist/index.js

@@ -1 +1 @@
-import{DNS_APEX as o,getDomainExportNames as t}from"./infra/domainExports.js";import{BACKUP_VAULT_NAME as a}from"./infra/backupVault.js";import{APPROVAL_TOKEN_OUTPUT_PREFIX as n}from"./deploy/approvalTokenOutput.js";import{imageTagParameterName as i}from"./infra/imageTags.js";import{toPascalCase as m,toKebab as T,toValidDatabaseName as R,toScreamingSnake as N,capitalise as s,getSafeZoneName as C,accountConstructKey as O,hasAsciiStableConstructKey as c}from"./naming/caseConversion.js";import{findAccountNameCollision as p}from"./naming/accountNameCollision.js";import{defaultConnectedAccountName as P,suffixedAccountName as I,REGION_SHORT_CODES as M,findTrailingRegionShortCode as u,regionSuffixRejectionMessage as x}from"./naming/connectedAccountName.js";import{normaliseError as d,getErrorMessage as l,hasErrorCode as U,getErrorCode as h,getErrorStack as V,formatErrorString as G}from"./errorUtils.js";import{singleton as v}from"./async/singleton.js";import{DANGEROUS_ENV_VARS as b,filterDangerousEnvVars as F,maskSensitiveOutput as y,parseShellArgs as K}from"./securityHelpers.js";import{sleep as W}from"./async/sleep.js";import{mapSettledWithConcurrency as Y}from"./async/concurrency.js";import{ACCOUNT_STAGES_WITH_ROOT as j,STRUCTURAL_ENVIRONMENTS as z,ACCOUNT_STAGES as Z,ACCOUNT_STAGE_LABELS as q,isAccountStage as w,ACCOUNT_TIERS as J,AccountTierSchema as Q,isAccountTier as $,environmentToTier as ee,stageFromWireEnvironment as re,accountTier as oe,getEnvironmentLabel as te,ACCOUNT_ROLES as Ee}from"./environments.js";import{RESOURCE_CATEGORIES as Se,categoriseResource as ne,getExpectedDuration as _e,getFriendlyResourceType as ie}from"./resourceCategorisation.js";import{parseGitRemoteUrl as me}from"./repo/gitRemoteParser.js";import{abbreviateRegion as Re,AWS_REGIONS_METADATA as Ne,DEFAULT_REGION as se,getRegionInfo as Ce,MAX_SECONDARY_REGIONS as Oe,OPT_IN_REGION_CODES as ce,optInRegionWarning as fe,regions as pe,suggestRegionForTimezone as ge}from"./infra/regions.js";import{SCOPE_VALUES as Ie,MACHINE_ONLY_SCOPES as Me,USER_GRANTABLE_SCOPES as ue}from"./infra/tokenScopes.js";import{SECRET_NAME_PATTERN as De,SECRET_NAME_ERROR as de,SSM_COMPONENT_PATTERN as le,SSM_COMPONENT_ERROR as Ue,SSM_STANDARD_MAX_VALUE_BYTES as he,SecretNamespaceSchema as Ve,buildNamespaceParts as Ge,buildParameterPath as Le,parseParameterPath as ve,isManageablePath as He,parseDotEnv as be,escapeDotEnvValue as Fe}from"./secrets.js";import{ConnectionWireSchema as Ke,ConnectionsListResponseSchema as Xe}from"./infra/connectionsWire.js";import{deriveRegionsFromOrgConfig as Be,deriveTargets as Ye,deriveAllTargets as ke,environmentOrTier as je,findTarget as ze,generateTargetName as Ze}from"./targets.js";import{buildAppConfigPath as we}from"./repo/appPath.js";import{findInfrastructurePaths as Qe,findBoundaryPath as $e,isInfrastructureFile as er}from"./repo/findInfrastructurePaths.js";import{inferContainerFromCandidates as or}from"./repo/inferContainerFromCandidates.js";import{RESERVED_APP_NAMES as Er,RESERVED_APP_NAME_MESSAGE as ar,isReservedAppName as Sr}from"./naming/reservedAppNames.js";import{deriveContentHashTag as _r}from"./infra/deriveContentHashTag.js";import{DEPLOY_MODES as Ar,DeployModeSchema as mr,IMAGE_TAG_PATTERN as Tr,ImageTagSchema as Rr,ServiceArtefactSchema as Nr,ServiceArtefactsSchema as sr,ARTEFACT_OUTPUT_FIELDS as Cr,artefactOutputKey as Or}from"./infra/deployArtefacts.js";import{MIGRATION_SNAPSHOT_NAME_PREFIX as fr,EXPECTED_SCHEMA_VERSION_ENV as pr,EXPECTED_SCHEMA_VERSION_TOOL_ENV as gr,EXPECTED_CH_SCHEMA_VERSION_ENV as Pr,SCHEMA_ADMIN_USER_ENV as Ir,SCHEMA_ADMIN_PASSWORD_ENV as Mr,PRISMA_MIGRATION_DIR_RE as ur,CLICKHOUSE_MIGRATION_SKIP_RE as xr}from"./migration/constants.js";export{Ee as ACCOUNT_ROLES,Z as ACCOUNT_STAGES,j as ACCOUNT_STAGES_WITH_ROOT,q as ACCOUNT_STAGE_LABELS,J as ACCOUNT_TIERS,n as APPROVAL_TOKEN_OUTPUT_PREFIX,Cr as ARTEFACT_OUTPUT_FIELDS,Ne as AWS_REGIONS_METADATA,Q as AccountTierSchema,a as BACKUP_VAULT_NAME,xr as CLICKHOUSE_MIGRATION_SKIP_RE,Ke as ConnectionWireSchema,Xe as ConnectionsListResponseSchema,b as DANGEROUS_ENV_VARS,se as DEFAULT_REGION,Ar as DEPLOY_MODES,o as DNS_APEX,mr as DeployModeSchema,Pr as EXPECTED_CH_SCHEMA_VERSION_ENV,pr as EXPECTED_SCHEMA_VERSION_ENV,gr as EXPECTED_SCHEMA_VERSION_TOOL_ENV,Tr as IMAGE_TAG_PATTERN,Rr as ImageTagSchema,Me as MACHINE_ONLY_SCOPES,Oe as MAX_SECONDARY_REGIONS,fr as MIGRATION_SNAPSHOT_NAME_PREFIX,ce as OPT_IN_REGION_CODES,ur as PRISMA_MIGRATION_DIR_RE,M as REGION_SHORT_CODES,Er as RESERVED_APP_NAMES,ar as RESERVED_APP_NAME_MESSAGE,Se as RESOURCE_CATEGORIES,Mr as SCHEMA_ADMIN_PASSWORD_ENV,Ir as SCHEMA_ADMIN_USER_ENV,Ie as SCOPE_VALUES,de as SECRET_NAME_ERROR,De as SECRET_NAME_PATTERN,Ue as SSM_COMPONENT_ERROR,le as SSM_COMPONENT_PATTERN,he as SSM_STANDARD_MAX_VALUE_BYTES,z as STRUCTURAL_ENVIRONMENTS,Ve as SecretNamespaceSchema,Nr as ServiceArtefactSchema,sr as ServiceArtefactsSchema,ue as USER_GRANTABLE_SCOPES,Re as abbreviateRegion,O as accountConstructKey,oe as accountTier,Or as artefactOutputKey,we as buildAppConfigPath,Ge as buildNamespaceParts,Le as buildParameterPath,s as capitalise,ne as categoriseResource,P as defaultConnectedAccountName,ke as deriveAllTargets,_r as deriveContentHashTag,Be as deriveRegionsFromOrgConfig,Ye as deriveTargets,je as environmentOrTier,ee as environmentToTier,Fe as escapeDotEnvValue,F as filterDangerousEnvVars,p as findAccountNameCollision,$e as findBoundaryPath,Qe as findInfrastructurePaths,ze as findTarget,u as findTrailingRegionShortCode,G as formatErrorString,Ze as generateTargetName,t as getDomainExportNames,te as getEnvironmentLabel,h as getErrorCode,l as getErrorMessage,V as getErrorStack,_e as getExpectedDuration,ie as getFriendlyResourceType,Ce as getRegionInfo,C as getSafeZoneName,c as hasAsciiStableConstructKey,U as hasErrorCode,i as imageTagParameterName,or as inferContainerFromCandidates,w as isAccountStage,$ as isAccountTier,er as isInfrastructureFile,He as isManageablePath,Sr as isReservedAppName,Y as mapSettledWithConcurrency,y as maskSensitiveOutput,d as normaliseError,fe as optInRegionWarning,be as parseDotEnv,me as parseGitRemoteUrl,ve as parseParameterPath,K as parseShellArgs,x as regionSuffixRejectionMessage,pe as regions,v as singleton,W as sleep,re as stageFromWireEnvironment,I as suffixedAccountName,ge as suggestRegionForTimezone,T as toKebab,m as toPascalCase,N as toScreamingSnake,R as toValidDatabaseName};
+import{DNS_APEX as o,getDomainExportNames as t}from"./infra/domainExports.js";import{BACKUP_VAULT_NAME as a}from"./infra/backupVault.js";import{APPROVAL_TOKEN_OUTPUT_PREFIX as _,TOKEN_STDERR_PREFIX as n}from"./deploy/approvalTokenOutput.js";import{imageTagParameterName as i}from"./infra/imageTags.js";import{toPascalCase as R,toKebab as m,toValidDatabaseName as N,toScreamingSnake as s,capitalise as O,getSafeZoneName as C,accountConstructKey as c,hasAsciiStableConstructKey as f}from"./naming/caseConversion.js";import{findAccountNameCollision as g}from"./naming/accountNameCollision.js";import{defaultConnectedAccountName as I,suffixedAccountName as M,REGION_SHORT_CODES as u,findTrailingRegionShortCode as x,regionSuffixRejectionMessage as D}from"./naming/connectedAccountName.js";import{normaliseError as l,getErrorMessage as U,hasErrorCode as h,getErrorCode as G,getErrorStack as V,formatErrorString as L}from"./errorUtils.js";import{singleton as H}from"./async/singleton.js";import{DANGEROUS_ENV_VARS as b,filterDangerousEnvVars as K,maskSensitiveOutput as X,parseShellArgs as y,SCOPED_TOKEN_REGEX as W}from"./securityHelpers.js";import{sleep as Y}from"./async/sleep.js";import{mapSettledWithConcurrency as j}from"./async/concurrency.js";import{ACCOUNT_STAGES_WITH_ROOT as Z,STRUCTURAL_ENVIRONMENTS as q,ACCOUNT_STAGES as w,ACCOUNT_STAGE_LABELS as J,isAccountStage as Q,ACCOUNT_TIERS as $,AccountTierSchema as ee,isAccountTier as re,environmentToTier as oe,stageFromWireEnvironment as te,accountTier as Ee,getEnvironmentLabel as ae,ACCOUNT_ROLES as Se}from"./environments.js";import{RESOURCE_CATEGORIES as ne,categoriseResource as Ae,getExpectedDuration as ie,getFriendlyResourceType as Te}from"./resourceCategorisation.js";import{parseGitRemoteUrl as me}from"./repo/gitRemoteParser.js";import{abbreviateRegion as se,AWS_REGIONS_METADATA as Oe,DEFAULT_REGION as Ce,getRegionInfo as ce,MAX_SECONDARY_REGIONS as fe,OPT_IN_REGION_CODES as pe,optInRegionWarning as ge,regions as Pe,suggestRegionForTimezone as Ie}from"./infra/regions.js";import{SCOPE_VALUES as ue,MACHINE_ONLY_SCOPES as xe,USER_GRANTABLE_SCOPES as De}from"./infra/tokenScopes.js";import{SECRET_NAME_PATTERN as le,SECRET_NAME_ERROR as Ue,SSM_COMPONENT_PATTERN as he,SSM_COMPONENT_ERROR as Ge,SSM_STANDARD_MAX_VALUE_BYTES as Ve,SecretNamespaceSchema as Le,buildNamespaceParts as ve,buildParameterPath as He,parseParameterPath as Fe,isManageablePath as be,parseDotEnv as Ke,escapeDotEnvValue as Xe}from"./secrets.js";import{ConnectionWireSchema as We,ConnectionsListResponseSchema as Be}from"./infra/connectionsWire.js";import{deriveRegionsFromOrgConfig as ke,deriveTargets as je,deriveAllTargets as ze,environmentOrTier as Ze,findTarget as qe,generateTargetName as we}from"./targets.js";import{buildAppConfigPath as Qe}from"./repo/appPath.js";import{findInfrastructurePaths as er,findBoundaryPath as rr,isInfrastructureFile as or}from"./repo/findInfrastructurePaths.js";import{inferContainerFromCandidates as Er}from"./repo/inferContainerFromCandidates.js";import{RESERVED_APP_NAMES as Sr,RESERVED_APP_NAME_MESSAGE as _r,isReservedAppName as nr}from"./naming/reservedAppNames.js";import{deriveContentHashTag as ir,CONTENT_HASH_TAG_PATTERN as Tr}from"./infra/deriveContentHashTag.js";import{DEPLOY_MODES as mr,DeployModeSchema as Nr,IMAGE_TAG_PATTERN as sr,ImageTagSchema as Or,ServiceArtefactSchema as Cr,ServiceArtefactsSchema as cr,ARTEFACT_OUTPUT_FIELDS as fr,artefactOutputKey as pr}from"./infra/deployArtefacts.js";import{MIGRATION_SNAPSHOT_NAME_PREFIX as Pr,EXPECTED_SCHEMA_VERSION_ENV as Ir,EXPECTED_SCHEMA_VERSION_TOOL_ENV as Mr,EXPECTED_CH_SCHEMA_VERSION_ENV as ur,SCHEMA_ADMIN_USER_ENV as xr,SCHEMA_ADMIN_PASSWORD_ENV as Dr,PRISMA_MIGRATION_DIR_RE as dr,CLICKHOUSE_MIGRATION_SKIP_RE as lr}from"./migration/constants.js";export{Se as ACCOUNT_ROLES,w as ACCOUNT_STAGES,Z as ACCOUNT_STAGES_WITH_ROOT,J as ACCOUNT_STAGE_LABELS,$ as ACCOUNT_TIERS,_ as APPROVAL_TOKEN_OUTPUT_PREFIX,fr as ARTEFACT_OUTPUT_FIELDS,Oe as AWS_REGIONS_METADATA,ee as AccountTierSchema,a as BACKUP_VAULT_NAME,lr as CLICKHOUSE_MIGRATION_SKIP_RE,Tr as CONTENT_HASH_TAG_PATTERN,We as ConnectionWireSchema,Be as ConnectionsListResponseSchema,b as DANGEROUS_ENV_VARS,Ce as DEFAULT_REGION,mr as DEPLOY_MODES,o as DNS_APEX,Nr as DeployModeSchema,ur as EXPECTED_CH_SCHEMA_VERSION_ENV,Ir as EXPECTED_SCHEMA_VERSION_ENV,Mr as EXPECTED_SCHEMA_VERSION_TOOL_ENV,sr as IMAGE_TAG_PATTERN,Or as ImageTagSchema,xe as MACHINE_ONLY_SCOPES,fe as MAX_SECONDARY_REGIONS,Pr as MIGRATION_SNAPSHOT_NAME_PREFIX,pe as OPT_IN_REGION_CODES,dr as PRISMA_MIGRATION_DIR_RE,u as REGION_SHORT_CODES,Sr as RESERVED_APP_NAMES,_r as RESERVED_APP_NAME_MESSAGE,ne as RESOURCE_CATEGORIES,Dr as SCHEMA_ADMIN_PASSWORD_ENV,xr as SCHEMA_ADMIN_USER_ENV,W as SCOPED_TOKEN_REGEX,ue as SCOPE_VALUES,Ue as SECRET_NAME_ERROR,le as SECRET_NAME_PATTERN,Ge as SSM_COMPONENT_ERROR,he as SSM_COMPONENT_PATTERN,Ve as SSM_STANDARD_MAX_VALUE_BYTES,q as STRUCTURAL_ENVIRONMENTS,Le as SecretNamespaceSchema,Cr as ServiceArtefactSchema,cr as ServiceArtefactsSchema,n as TOKEN_STDERR_PREFIX,De as USER_GRANTABLE_SCOPES,se as abbreviateRegion,c as accountConstructKey,Ee as accountTier,pr as artefactOutputKey,Qe as buildAppConfigPath,ve as buildNamespaceParts,He as buildParameterPath,O as capitalise,Ae as categoriseResource,I as defaultConnectedAccountName,ze as deriveAllTargets,ir as deriveContentHashTag,ke as deriveRegionsFromOrgConfig,je as deriveTargets,Ze as environmentOrTier,oe as environmentToTier,Xe as escapeDotEnvValue,K as filterDangerousEnvVars,g as findAccountNameCollision,rr as findBoundaryPath,er as findInfrastructurePaths,qe as findTarget,x as findTrailingRegionShortCode,L as formatErrorString,we as generateTargetName,t as getDomainExportNames,ae as getEnvironmentLabel,G as getErrorCode,U as getErrorMessage,V as getErrorStack,ie as getExpectedDuration,Te as getFriendlyResourceType,ce as getRegionInfo,C as getSafeZoneName,f as hasAsciiStableConstructKey,h as hasErrorCode,i as imageTagParameterName,Er as inferContainerFromCandidates,Q as isAccountStage,re as isAccountTier,or as isInfrastructureFile,be as isManageablePath,nr as isReservedAppName,j as mapSettledWithConcurrency,X as maskSensitiveOutput,l as normaliseError,ge as optInRegionWarning,Ke as parseDotEnv,me as parseGitRemoteUrl,Fe as parseParameterPath,y as parseShellArgs,D as regionSuffixRejectionMessage,Pe as regions,H as singleton,Y as sleep,te as stageFromWireEnvironment,M as suffixedAccountName,Ie as suggestRegionForTimezone,m as toKebab,R as toPascalCase,s as toScreamingSnake,N as toValidDatabaseName};

package/dist/infra/deployArtefacts.d.ts

@@ -16,11 +16,12 @@
  * `util/src/__tests__/deployArtefacts.test.ts` freeze that wire format.
  */
 import { z } from "zod";
-export declare const DEPLOY_MODES: readonly ["full", "code-only", "rollback"];
+export declare const DEPLOY_MODES: readonly ["full", "code-only", "rollback", "restart"];
 export declare const DeployModeSchema: z.ZodEnum<{
     full: "full";
     "code-only": "code-only";
     rollback: "rollback";
+    restart: "restart";
 }>;
 export type DeployMode = z.infer<typeof DeployModeSchema>;
 /**

package/dist/infra/deployArtefacts.js

@@ -1 +1 @@
-import{z as e}from"zod";const n=["full","code-only","rollback"],c=e.enum(n),o=/^[a-zA-Z0-9._-]+$/,r=e.string().min(1).max(128).regex(o),a=e.object({serviceName:e.string().min(1),imageTag:r,imageDigest:e.string().min(1).optional(),imageUri:e.string().min(1),ecrRepositoryArn:e.string().min(1).optional(),taskDefinitionArn:e.string().min(1).optional(),previousTaskDefinitionArn:e.string().min(1).optional()}).strict(),m=e.array(a),g=["TaskDefinition","PreviousTaskDefinition","ImageTag","ImageUri","EcrRepositoryArn","ImageDigest"];function p(t,i){return`${t}${i}`}export{g as ARTEFACT_OUTPUT_FIELDS,n as DEPLOY_MODES,c as DeployModeSchema,o as IMAGE_TAG_PATTERN,r as ImageTagSchema,a as ServiceArtefactSchema,m as ServiceArtefactsSchema,p as artefactOutputKey};
+import{z as t}from"zod";const r=["full","code-only","rollback","restart"],c=t.enum(r),n=/^[a-zA-Z0-9._-]+$/,o=t.string().min(1).max(128).regex(n),a=t.object({serviceName:t.string().min(1),imageTag:o,imageDigest:t.string().min(1).optional(),imageUri:t.string().min(1),ecrRepositoryArn:t.string().min(1).optional(),taskDefinitionArn:t.string().min(1).optional(),previousTaskDefinitionArn:t.string().min(1).optional()}).strict(),m=t.array(a),g=["TaskDefinition","PreviousTaskDefinition","ImageTag","ImageUri","EcrRepositoryArn","ImageDigest"];function p(e,i){return`${e}${i}`}export{g as ARTEFACT_OUTPUT_FIELDS,r as DEPLOY_MODES,c as DeployModeSchema,n as IMAGE_TAG_PATTERN,o as ImageTagSchema,a as ServiceArtefactSchema,m as ServiceArtefactsSchema,p as artefactOutputKey};

package/dist/infra/deriveContentHashTag.d.ts

@@ -31,4 +31,11 @@ export type Result<T, E = Error> = {
     success: false;
     error: E;
 };
+/**
+ * Matches a tag synthesised by {@link deriveContentHashTag} — coupled to its
+ * `${stem}-sha-${prefix}` output shape (code-quality.md § "Coupled values").
+ * Consumers selecting a content-hash tag from a live tag list (e.g. the
+ * restart orchestrator) MUST use this rather than re-encoding the shape.
+ */
+export declare const CONTENT_HASH_TAG_PATTERN: RegExp;
 export declare function deriveContentHashTag(digest: string, serviceName: string, target?: string): Result<string, Error>;

package/dist/infra/deriveContentHashTag.js

@@ -1 +1 @@
-function d(e){return{success:!0,data:e}}function t(e){return{success:!1,error:e}}const a="sha256:",o=12;function f(e,u,i){if(!e.startsWith(a))return t(new Error(`expected sha256:... digest, got ${e.slice(0,32)}`));const r=e.slice(a.length);if(r.length<o)return t(new Error(`digest hex payload too short (need >=${o} chars, got ${r.length})`));const n=u.trim();if(n==="")return t(new Error("serviceName must be a non-empty string"));let s;if(i!==void 0){const c=i.trim();if(c==="")return t(new Error("target, when supplied, must be a non-empty string; omit the argument instead"));s=c.toLowerCase()}const h=r.slice(0,o).toLowerCase(),m=s!==void 0?`${n.toLowerCase()}-${s}`:n.toLowerCase();return d(`${m}-sha-${h}`)}export{f as deriveContentHashTag};
+function m(e){return{success:!0,data:e}}function t(e){return{success:!1,error:e}}const c="sha256:",r=12,d=new RegExp(`-sha-[0-9a-f]{${r}}$`);function g(e,u,i){if(!e.startsWith(c))return t(new Error(`expected sha256:... digest, got ${e.slice(0,32)}`));const n=e.slice(c.length);if(n.length<r)return t(new Error(`digest hex payload too short (need >=${r} chars, got ${n.length})`));const s=u.trim();if(s==="")return t(new Error("serviceName must be a non-empty string"));let o;if(i!==void 0){const a=i.trim();if(a==="")return t(new Error("target, when supplied, must be a non-empty string; omit the argument instead"));o=a.toLowerCase()}const h=n.slice(0,r).toLowerCase(),f=o!==void 0?`${s.toLowerCase()}-${o}`:s.toLowerCase();return m(`${f}-sha-${h}`)}export{d as CONTENT_HASH_TAG_PATTERN,g as deriveContentHashTag};

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@fjall/util",
-  "version": "2.24.0",
+  "version": "2.25.0",
   "description": "Common utility methods",
   "type": "module",
   "main": "dist/index.js",
@@ -125,5 +125,5 @@
   "engines": {
     "node": ">=22.0.0"
   },
-  "gitHead": "616d7af846f0eebfa3409f5f47c98fbee836bad9"
+  "gitHead": "7c1a329184064aefa557c2c09de0965c4f8cd4fb"
 }