@fjall/util 2.25.0 → 2.27.0

package/dist/.minified

@@ -1 +1 @@
-75 files minified at 2026-07-06T11:56:15.602Z
+77 files minified at 2026-07-07T01:04:04.313Z

package/dist/buildConcurrency.d.ts

@@ -0,0 +1,38 @@
+import { type Result } from "./docker/result.js";
+export interface RunWithBoundedConcurrencyOptions {
+    /**
+     * When true, stop issuing new jobs after the first failure. The orchestrator
+     * is responsible for owning the AbortController and signalling in-flight jobs.
+     */
+    abortOnFirstFailure?: boolean;
+    /**
+     * Optional abort signal: once aborted, the runner stops issuing NEW jobs.
+     * In-flight jobs are not cancelled — the orchestrator owns the
+     * AbortController and is responsible for signalling them (typically via a
+     * closure over the same signal inside each job factory).
+     */
+    abortSignal?: AbortSignal;
+}
+/**
+ * Run a list of async jobs with a bounded number in-flight at any tick.
+ *
+ * Returns results in INPUT order (job N's result lives at index N) regardless
+ * of completion order. Slots for jobs never issued (abort or first-failure
+ * stop) are left `undefined` — the return type is honest about the holes.
+ */
+export declare function runWithBoundedConcurrency<T>(jobs: ReadonlyArray<() => Promise<T>>, concurrency: number, opts?: RunWithBoundedConcurrencyOptions): Promise<Array<Result<T, Error> | undefined>>;
+/**
+ * Resolve the per-orchestrator-run build concurrency from the
+ * `FJALL_BUILD_CONCURRENCY` environment variable, clamped to `[1, serviceCount]`.
+ *
+ * The env-var contract is shared by every build surface (`fjall build` via
+ * `@fjall/cli` and `fjall deploy` via `@fjall/deploy-core`) — this module is
+ * the single source so the two paths cannot drift.
+ *
+ * - Empty-string env values are rejected (per robustness-standards.md
+ *   § "Environment Variable Truthy Checks").
+ * - Non-integer / non-positive values fall back to the default.
+ * - When `serviceCount === 0`, returns `1` (no jobs would be issued anyway).
+ * - The default is CPU-aware (see `defaultBuildConcurrency`).
+ */
+export declare function resolveBuildConcurrency(serviceCount: number): number;

package/dist/buildConcurrency.js

@@ -0,0 +1 @@
+import p from"os";import{success as y,failure as x}from"./docker/result.js";async function F(r,e,o={}){const t=r.length,i=new Array(t);if(t===0)return i;const l=Math.max(1,Math.min(e,t)),u=o.abortOnFirstFailure===!0;let c=0,s=!1;async function d(){for(;;){if(u&&s||o.abortSignal?.aborted===!0)return;const n=c;if(n>=t)return;c=n+1;const h=r[n];try{const a=await h();i[n]=y(a)}catch(a){const m=a instanceof Error?a:new Error(String(a));i[n]=x(m),u&&(s=!0)}}}const f=[];for(let n=0;n<l;n++)f.push(d());return await Promise.all(f),i}function w(r){const e=p.cpus().length;return Math.min(r,Math.max(2,Math.floor(e/2)))}function g(r){if(r<=0)return 1;const e=process.env.FJALL_BUILD_CONCURRENCY;let o=w(r);if(e!==void 0&&e!==""){const t=parseInt(e,10);Number.isInteger(t)&&t>0&&(o=t)}return Math.max(1,Math.min(o,r))}export{g as resolveBuildConcurrency,F as runWithBoundedConcurrency};

package/dist/docker/cacheRepository.d.ts

@@ -0,0 +1,26 @@
+/**
+ * Derivation for the buildx registry-cache ECR repository that sits beside an
+ * app's image repository. Both the `fjall build` provisioner
+ * (`@fjall/cli` EcrBuildOrchestrator) and the deploy-path provisioner
+ * (`@fjall/deploy-core` dockerBuildHelper) address the SAME physical repo, so
+ * the name derivation and the lifecycle retention live here — a re-implemented
+ * `\`${name}-cache\`` at either site is silent drift against a shared AWS
+ * resource (see code-quality.md § "Runtime resource names must match the CDK
+ * construct's derivation" — same rule, orchestrator↔orchestrator seam).
+ */
+/** `<repositoryName>-cache`; `repositoryName` is the kebab-case app repo name. */
+export declare function buildCacheRepositoryName(repositoryName: string): string;
+/**
+ * Days before untagged cache layers expire. Buildx registry-cache writes leave
+ * untagged image layers behind on every push; both provisioners apply the same
+ * lifecycle policy idempotently, so a differing value would flip-flop between
+ * `fjall build` and `fjall deploy` runs (last writer wins).
+ */
+export declare const CACHE_REPO_UNTAGGED_RETENTION_DAYS = 14;
+/**
+ * The exact lifecycle-policy document both provisioners PUT on the cache
+ * repo. Shared so the stored policy text is byte-identical regardless of
+ * which path wrote last — a structurally-equal-but-differently-worded
+ * document would rewrite the policy on every alternating build/deploy run.
+ */
+export declare function untaggedLifecyclePolicyText(daysUntilExpiry: number): string;

package/dist/docker/cacheRepository.js

@@ -0,0 +1 @@
+function t(e){return`${e}-cache`}const n=14;function i(e){return JSON.stringify({rules:[{rulePriority:1,description:`Expire untagged images after ${e} days`,selection:{tagStatus:"untagged",countType:"sinceImagePushed",countUnit:"days",countNumber:e},action:{type:"expire"}}]})}export{n as CACHE_REPO_UNTAGGED_RETENTION_DAYS,t as buildCacheRepositoryName,i as untaggedLifecyclePolicyText};

package/dist/docker/dockerCliConstants.d.ts

@@ -8,7 +8,7 @@ export declare const DEFAULT_DOCKER_BIN = "docker";
 export declare const SIGTERM_GRACE_MS = 5000;
 export declare const STDERR_TAIL_LINES = 50;
 export declare const STDERR_TAIL_LINE_MAX_CHARS = 2000;
-export declare const DEFAULT_BUILD_TIMEOUT_MS = 600000;
+export declare const DEFAULT_BUILD_TIMEOUT_MS = 1800000;
 export declare const DEFAULT_PUSH_TIMEOUT_MS = 300000;
 export declare const DEFAULT_PULL_TIMEOUT_MS = 300000;
 export declare const DEFAULT_INSPECT_TIMEOUT_MS = 30000;

package/dist/docker/dockerCliConstants.js

@@ -1 +1 @@
-const _="DockerCli",o="DockerCli.buildx",E="0.13.0",t="23.0.0",T=64,L="fjall",e="docker",I=5e3,r=50,O=2e3,D=6e5,c=3e5,s=3e5,R=3e4,U=1e4;export{E as BUILDX_VERSION_FLOOR,L as DEFAULT_BUILDER_NAME,D as DEFAULT_BUILD_TIMEOUT_MS,U as DEFAULT_DAEMON_PROBE_TIMEOUT_MS,e as DEFAULT_DOCKER_BIN,R as DEFAULT_INSPECT_TIMEOUT_MS,s as DEFAULT_PULL_TIMEOUT_MS,c as DEFAULT_PUSH_TIMEOUT_MS,o as DOCKER_CLI_BUILDX_LOG_CATEGORY,_ as DOCKER_CLI_LOG_CATEGORY,t as ENGINE_VERSION_FLOOR,T as PrerequisiteMissingExitCode,I as SIGTERM_GRACE_MS,r as STDERR_TAIL_LINES,O as STDERR_TAIL_LINE_MAX_CHARS};
+const _="DockerCli",o="DockerCli.buildx",E="0.13.0",t="23.0.0",T=64,L="fjall",e="docker",I=5e3,r=50,O=2e3,D=18e5,c=3e5,s=3e5,R=3e4,U=1e4;export{E as BUILDX_VERSION_FLOOR,L as DEFAULT_BUILDER_NAME,D as DEFAULT_BUILD_TIMEOUT_MS,U as DEFAULT_DAEMON_PROBE_TIMEOUT_MS,e as DEFAULT_DOCKER_BIN,R as DEFAULT_INSPECT_TIMEOUT_MS,s as DEFAULT_PULL_TIMEOUT_MS,c as DEFAULT_PUSH_TIMEOUT_MS,o as DOCKER_CLI_BUILDX_LOG_CATEGORY,_ as DOCKER_CLI_LOG_CATEGORY,t as ENGINE_VERSION_FLOOR,T as PrerequisiteMissingExitCode,I as SIGTERM_GRACE_MS,r as STDERR_TAIL_LINES,O as STDERR_TAIL_LINE_MAX_CHARS};

package/dist/docker/index.d.ts

@@ -11,3 +11,4 @@ export { projectBuildxResult, type DockerBuildResultLike, type ProjectBuildxResu
 export { abortChildProcess } from "./abortHelpers.js";
 export { DockerCli, type DockerCliLogger, type DockerCliOptions, type BuildxProgressEvent, type PushProgressEvent, type PushResult, type PullProgressEvent, type PullResult, type ImagetoolsInspect, type EcrLoginArgs, type BuildxCapabilities, type DaemonInfo } from "./DockerCli.js";
 export { createEcrAuthSession, type EcrAuthSession, type CreateEcrAuthSessionParams } from "./ecrCredentialStore.js";
+export { buildCacheRepositoryName, untaggedLifecyclePolicyText, CACHE_REPO_UNTAGGED_RETENTION_DAYS } from "./cacheRepository.js";

package/dist/docker/index.js

@@ -1 +1 @@
-import{isSuccess as o,isFailure as E,success as _,failure as i}from"./result.js";import{DOCKER_CLI_LOG_CATEGORY as s,DOCKER_CLI_BUILDX_LOG_CATEGORY as t,BUILDX_VERSION_FLOOR as a,ENGINE_VERSION_FLOOR as u,PrerequisiteMissingExitCode as L,DEFAULT_BUILDER_NAME as T,DEFAULT_DOCKER_BIN as A,SIGTERM_GRACE_MS as R,STDERR_TAIL_LINES as U,DEFAULT_BUILD_TIMEOUT_MS as D,DEFAULT_PUSH_TIMEOUT_MS as I,DEFAULT_PULL_TIMEOUT_MS as S,DEFAULT_INSPECT_TIMEOUT_MS as O,DEFAULT_DAEMON_PROBE_TIMEOUT_MS as d}from"./dockerCliConstants.js";import{BuildxBuildArgsSchema as c,BuildxBuildResultSchema as x,DockerCliErrorKindSchema as m,DockerCliErrorSchema as C,isDockerCliErrorKind as p}from"./dockerCliSchemas.js";import{buildxArgvBuilder as f}from"./buildxArgvBuilder.js";import{evaluateBakeGuard as P,evaluateResolvedBuildArgValues as n,acknowledgedBuildArgKeys as G,BAKE_GUARD_EXPOSURE_CLAUSE as N}from"./bakeGuard.js";import{PUBLIC_BUILD_ARG_PREFIXES as g,isPublicBuildVarName as h,inferPublicBuildArgKeys as k}from"./buildArgInference.js";import{parseRawjsonLine as V}from"./rawjsonParser.js";import{rawjsonToVertexEvent as X}from"./rawjsonToVertexEvent.js";import{parseMetadataFile as w}from"./metadataFileParser.js";import{projectBuildxResult as Y}from"./projectBuildxResult.js";import{abortChildProcess as H}from"./abortHelpers.js";import{DockerCli as J}from"./DockerCli.js";import{createEcrAuthSession as W}from"./ecrCredentialStore.js";export{N as BAKE_GUARD_EXPOSURE_CLAUSE,a as BUILDX_VERSION_FLOOR,c as BuildxBuildArgsSchema,x as BuildxBuildResultSchema,T as DEFAULT_BUILDER_NAME,D as DEFAULT_BUILD_TIMEOUT_MS,d as DEFAULT_DAEMON_PROBE_TIMEOUT_MS,A as DEFAULT_DOCKER_BIN,O as DEFAULT_INSPECT_TIMEOUT_MS,S as DEFAULT_PULL_TIMEOUT_MS,I as DEFAULT_PUSH_TIMEOUT_MS,t as DOCKER_CLI_BUILDX_LOG_CATEGORY,s as DOCKER_CLI_LOG_CATEGORY,J as DockerCli,m as DockerCliErrorKindSchema,C as DockerCliErrorSchema,u as ENGINE_VERSION_FLOOR,g as PUBLIC_BUILD_ARG_PREFIXES,L as PrerequisiteMissingExitCode,R as SIGTERM_GRACE_MS,U as STDERR_TAIL_LINES,H as abortChildProcess,G as acknowledgedBuildArgKeys,f as buildxArgvBuilder,W as createEcrAuthSession,P as evaluateBakeGuard,n as evaluateResolvedBuildArgValues,i as failure,k as inferPublicBuildArgKeys,p as isDockerCliErrorKind,E as isFailure,h as isPublicBuildVarName,o as isSuccess,w as parseMetadataFile,V as parseRawjsonLine,Y as projectBuildxResult,X as rawjsonToVertexEvent,_ as success};
+import{isSuccess as o,isFailure as E,success as _,failure as i}from"./result.js";import{DOCKER_CLI_LOG_CATEGORY as t,DOCKER_CLI_BUILDX_LOG_CATEGORY as a,BUILDX_VERSION_FLOOR as s,ENGINE_VERSION_FLOOR as T,PrerequisiteMissingExitCode as u,DEFAULT_BUILDER_NAME as A,DEFAULT_DOCKER_BIN as L,SIGTERM_GRACE_MS as R,STDERR_TAIL_LINES as D,DEFAULT_BUILD_TIMEOUT_MS as U,DEFAULT_PUSH_TIMEOUT_MS as c,DEFAULT_PULL_TIMEOUT_MS as I,DEFAULT_INSPECT_TIMEOUT_MS as O,DEFAULT_DAEMON_PROBE_TIMEOUT_MS as S}from"./dockerCliConstants.js";import{BuildxBuildArgsSchema as x,BuildxBuildResultSchema as m,DockerCliErrorKindSchema as B,DockerCliErrorSchema as C,isDockerCliErrorKind as p}from"./dockerCliSchemas.js";import{buildxArgvBuilder as M}from"./buildxArgvBuilder.js";import{evaluateBakeGuard as P,evaluateResolvedBuildArgValues as F,acknowledgedBuildArgKeys as G,BAKE_GUARD_EXPOSURE_CLAUSE as n}from"./bakeGuard.js";import{PUBLIC_BUILD_ARG_PREFIXES as K,isPublicBuildVarName as h,inferPublicBuildArgKeys as k}from"./buildArgInference.js";import{parseRawjsonLine as v}from"./rawjsonParser.js";import{rawjsonToVertexEvent as V}from"./rawjsonToVertexEvent.js";import{parseMetadataFile as j}from"./metadataFileParser.js";import{projectBuildxResult as Y}from"./projectBuildxResult.js";import{abortChildProcess as q}from"./abortHelpers.js";import{DockerCli as J}from"./DockerCli.js";import{createEcrAuthSession as W}from"./ecrCredentialStore.js";import{buildCacheRepositoryName as $,untaggedLifecyclePolicyText as ee,CACHE_REPO_UNTAGGED_RETENTION_DAYS as re}from"./cacheRepository.js";export{n as BAKE_GUARD_EXPOSURE_CLAUSE,s as BUILDX_VERSION_FLOOR,x as BuildxBuildArgsSchema,m as BuildxBuildResultSchema,re as CACHE_REPO_UNTAGGED_RETENTION_DAYS,A as DEFAULT_BUILDER_NAME,U as DEFAULT_BUILD_TIMEOUT_MS,S as DEFAULT_DAEMON_PROBE_TIMEOUT_MS,L as DEFAULT_DOCKER_BIN,O as DEFAULT_INSPECT_TIMEOUT_MS,I as DEFAULT_PULL_TIMEOUT_MS,c as DEFAULT_PUSH_TIMEOUT_MS,a as DOCKER_CLI_BUILDX_LOG_CATEGORY,t as DOCKER_CLI_LOG_CATEGORY,J as DockerCli,B as DockerCliErrorKindSchema,C as DockerCliErrorSchema,T as ENGINE_VERSION_FLOOR,K as PUBLIC_BUILD_ARG_PREFIXES,u as PrerequisiteMissingExitCode,R as SIGTERM_GRACE_MS,D as STDERR_TAIL_LINES,q as abortChildProcess,G as acknowledgedBuildArgKeys,$ as buildCacheRepositoryName,M as buildxArgvBuilder,W as createEcrAuthSession,P as evaluateBakeGuard,F as evaluateResolvedBuildArgValues,i as failure,k as inferPublicBuildArgKeys,p as isDockerCliErrorKind,E as isFailure,h as isPublicBuildVarName,o as isSuccess,j as parseMetadataFile,v as parseRawjsonLine,Y as projectBuildxResult,V as rawjsonToVertexEvent,_ as success,ee as untaggedLifecyclePolicyText};

package/dist/index.d.ts

@@ -22,7 +22,7 @@ export { buildAppConfigPath } from "./repo/appPath.js";
 export { type ScanPath } from "./repo/scanTypes.js";
 export { findInfrastructurePaths, findBoundaryPath, isInfrastructureFile, type MarkerEntry, type FindInfrastructurePathsOptions } from "./repo/findInfrastructurePaths.js";
 export { inferContainerFromCandidates } from "./repo/inferContainerFromCandidates.js";
-export { RESERVED_APP_NAMES, type ReservedAppName, RESERVED_APP_NAME_MESSAGE, isReservedAppName } from "./naming/reservedAppNames.js";
+export { RESERVED_APP_NAMES, type ReservedAppName, RESERVED_APP_NAME_MESSAGE, isReservedAppName, RESERVED_APP_NAME_SUFFIX, RESERVED_APP_NAME_SUFFIX_MESSAGE, hasReservedAppNameSuffix } from "./naming/reservedAppNames.js";
 export { deriveContentHashTag, CONTENT_HASH_TAG_PATTERN } from "./infra/deriveContentHashTag.js";
 export { DEPLOY_MODES, DeployModeSchema, type DeployMode, IMAGE_TAG_PATTERN, ImageTagSchema, type ImageTag, ServiceArtefactSchema, type ServiceArtefact, ServiceArtefactsSchema, type ServiceArtefacts, ARTEFACT_OUTPUT_FIELDS, type ArtefactOutputField, artefactOutputKey } from "./infra/deployArtefacts.js";
 export { MIGRATION_SNAPSHOT_NAME_PREFIX, EXPECTED_SCHEMA_VERSION_ENV, EXPECTED_SCHEMA_VERSION_TOOL_ENV, EXPECTED_CH_SCHEMA_VERSION_ENV, SCHEMA_ADMIN_USER_ENV, SCHEMA_ADMIN_PASSWORD_ENV, PRISMA_MIGRATION_DIR_RE, CLICKHOUSE_MIGRATION_SKIP_RE } from "./migration/constants.js";

package/dist/index.js

@@ -1 +1 @@
-import{DNS_APEX as o,getDomainExportNames as t}from"./infra/domainExports.js";import{BACKUP_VAULT_NAME as a}from"./infra/backupVault.js";import{APPROVAL_TOKEN_OUTPUT_PREFIX as _,TOKEN_STDERR_PREFIX as n}from"./deploy/approvalTokenOutput.js";import{imageTagParameterName as i}from"./infra/imageTags.js";import{toPascalCase as R,toKebab as m,toValidDatabaseName as N,toScreamingSnake as s,capitalise as O,getSafeZoneName as C,accountConstructKey as c,hasAsciiStableConstructKey as f}from"./naming/caseConversion.js";import{findAccountNameCollision as g}from"./naming/accountNameCollision.js";import{defaultConnectedAccountName as I,suffixedAccountName as M,REGION_SHORT_CODES as u,findTrailingRegionShortCode as x,regionSuffixRejectionMessage as D}from"./naming/connectedAccountName.js";import{normaliseError as l,getErrorMessage as U,hasErrorCode as h,getErrorCode as G,getErrorStack as V,formatErrorString as L}from"./errorUtils.js";import{singleton as H}from"./async/singleton.js";import{DANGEROUS_ENV_VARS as b,filterDangerousEnvVars as K,maskSensitiveOutput as X,parseShellArgs as y,SCOPED_TOKEN_REGEX as W}from"./securityHelpers.js";import{sleep as Y}from"./async/sleep.js";import{mapSettledWithConcurrency as j}from"./async/concurrency.js";import{ACCOUNT_STAGES_WITH_ROOT as Z,STRUCTURAL_ENVIRONMENTS as q,ACCOUNT_STAGES as w,ACCOUNT_STAGE_LABELS as J,isAccountStage as Q,ACCOUNT_TIERS as $,AccountTierSchema as ee,isAccountTier as re,environmentToTier as oe,stageFromWireEnvironment as te,accountTier as Ee,getEnvironmentLabel as ae,ACCOUNT_ROLES as Se}from"./environments.js";import{RESOURCE_CATEGORIES as ne,categoriseResource as Ae,getExpectedDuration as ie,getFriendlyResourceType as Te}from"./resourceCategorisation.js";import{parseGitRemoteUrl as me}from"./repo/gitRemoteParser.js";import{abbreviateRegion as se,AWS_REGIONS_METADATA as Oe,DEFAULT_REGION as Ce,getRegionInfo as ce,MAX_SECONDARY_REGIONS as fe,OPT_IN_REGION_CODES as pe,optInRegionWarning as ge,regions as Pe,suggestRegionForTimezone as Ie}from"./infra/regions.js";import{SCOPE_VALUES as ue,MACHINE_ONLY_SCOPES as xe,USER_GRANTABLE_SCOPES as De}from"./infra/tokenScopes.js";import{SECRET_NAME_PATTERN as le,SECRET_NAME_ERROR as Ue,SSM_COMPONENT_PATTERN as he,SSM_COMPONENT_ERROR as Ge,SSM_STANDARD_MAX_VALUE_BYTES as Ve,SecretNamespaceSchema as Le,buildNamespaceParts as ve,buildParameterPath as He,parseParameterPath as Fe,isManageablePath as be,parseDotEnv as Ke,escapeDotEnvValue as Xe}from"./secrets.js";import{ConnectionWireSchema as We,ConnectionsListResponseSchema as Be}from"./infra/connectionsWire.js";import{deriveRegionsFromOrgConfig as ke,deriveTargets as je,deriveAllTargets as ze,environmentOrTier as Ze,findTarget as qe,generateTargetName as we}from"./targets.js";import{buildAppConfigPath as Qe}from"./repo/appPath.js";import{findInfrastructurePaths as er,findBoundaryPath as rr,isInfrastructureFile as or}from"./repo/findInfrastructurePaths.js";import{inferContainerFromCandidates as Er}from"./repo/inferContainerFromCandidates.js";import{RESERVED_APP_NAMES as Sr,RESERVED_APP_NAME_MESSAGE as _r,isReservedAppName as nr}from"./naming/reservedAppNames.js";import{deriveContentHashTag as ir,CONTENT_HASH_TAG_PATTERN as Tr}from"./infra/deriveContentHashTag.js";import{DEPLOY_MODES as mr,DeployModeSchema as Nr,IMAGE_TAG_PATTERN as sr,ImageTagSchema as Or,ServiceArtefactSchema as Cr,ServiceArtefactsSchema as cr,ARTEFACT_OUTPUT_FIELDS as fr,artefactOutputKey as pr}from"./infra/deployArtefacts.js";import{MIGRATION_SNAPSHOT_NAME_PREFIX as Pr,EXPECTED_SCHEMA_VERSION_ENV as Ir,EXPECTED_SCHEMA_VERSION_TOOL_ENV as Mr,EXPECTED_CH_SCHEMA_VERSION_ENV as ur,SCHEMA_ADMIN_USER_ENV as xr,SCHEMA_ADMIN_PASSWORD_ENV as Dr,PRISMA_MIGRATION_DIR_RE as dr,CLICKHOUSE_MIGRATION_SKIP_RE as lr}from"./migration/constants.js";export{Se as ACCOUNT_ROLES,w as ACCOUNT_STAGES,Z as ACCOUNT_STAGES_WITH_ROOT,J as ACCOUNT_STAGE_LABELS,$ as ACCOUNT_TIERS,_ as APPROVAL_TOKEN_OUTPUT_PREFIX,fr as ARTEFACT_OUTPUT_FIELDS,Oe as AWS_REGIONS_METADATA,ee as AccountTierSchema,a as BACKUP_VAULT_NAME,lr as CLICKHOUSE_MIGRATION_SKIP_RE,Tr as CONTENT_HASH_TAG_PATTERN,We as ConnectionWireSchema,Be as ConnectionsListResponseSchema,b as DANGEROUS_ENV_VARS,Ce as DEFAULT_REGION,mr as DEPLOY_MODES,o as DNS_APEX,Nr as DeployModeSchema,ur as EXPECTED_CH_SCHEMA_VERSION_ENV,Ir as EXPECTED_SCHEMA_VERSION_ENV,Mr as EXPECTED_SCHEMA_VERSION_TOOL_ENV,sr as IMAGE_TAG_PATTERN,Or as ImageTagSchema,xe as MACHINE_ONLY_SCOPES,fe as MAX_SECONDARY_REGIONS,Pr as MIGRATION_SNAPSHOT_NAME_PREFIX,pe as OPT_IN_REGION_CODES,dr as PRISMA_MIGRATION_DIR_RE,u as REGION_SHORT_CODES,Sr as RESERVED_APP_NAMES,_r as RESERVED_APP_NAME_MESSAGE,ne as RESOURCE_CATEGORIES,Dr as SCHEMA_ADMIN_PASSWORD_ENV,xr as SCHEMA_ADMIN_USER_ENV,W as SCOPED_TOKEN_REGEX,ue as SCOPE_VALUES,Ue as SECRET_NAME_ERROR,le as SECRET_NAME_PATTERN,Ge as SSM_COMPONENT_ERROR,he as SSM_COMPONENT_PATTERN,Ve as SSM_STANDARD_MAX_VALUE_BYTES,q as STRUCTURAL_ENVIRONMENTS,Le as SecretNamespaceSchema,Cr as ServiceArtefactSchema,cr as ServiceArtefactsSchema,n as TOKEN_STDERR_PREFIX,De as USER_GRANTABLE_SCOPES,se as abbreviateRegion,c as accountConstructKey,Ee as accountTier,pr as artefactOutputKey,Qe as buildAppConfigPath,ve as buildNamespaceParts,He as buildParameterPath,O as capitalise,Ae as categoriseResource,I as defaultConnectedAccountName,ze as deriveAllTargets,ir as deriveContentHashTag,ke as deriveRegionsFromOrgConfig,je as deriveTargets,Ze as environmentOrTier,oe as environmentToTier,Xe as escapeDotEnvValue,K as filterDangerousEnvVars,g as findAccountNameCollision,rr as findBoundaryPath,er as findInfrastructurePaths,qe as findTarget,x as findTrailingRegionShortCode,L as formatErrorString,we as generateTargetName,t as getDomainExportNames,ae as getEnvironmentLabel,G as getErrorCode,U as getErrorMessage,V as getErrorStack,ie as getExpectedDuration,Te as getFriendlyResourceType,ce as getRegionInfo,C as getSafeZoneName,f as hasAsciiStableConstructKey,h as hasErrorCode,i as imageTagParameterName,Er as inferContainerFromCandidates,Q as isAccountStage,re as isAccountTier,or as isInfrastructureFile,be as isManageablePath,nr as isReservedAppName,j as mapSettledWithConcurrency,X as maskSensitiveOutput,l as normaliseError,ge as optInRegionWarning,Ke as parseDotEnv,me as parseGitRemoteUrl,Fe as parseParameterPath,y as parseShellArgs,D as regionSuffixRejectionMessage,Pe as regions,H as singleton,Y as sleep,te as stageFromWireEnvironment,M as suffixedAccountName,Ie as suggestRegionForTimezone,m as toKebab,R as toPascalCase,s as toScreamingSnake,N as toValidDatabaseName};
+import{DNS_APEX as o,getDomainExportNames as E}from"./infra/domainExports.js";import{BACKUP_VAULT_NAME as a}from"./infra/backupVault.js";import{APPROVAL_TOKEN_OUTPUT_PREFIX as _,TOKEN_STDERR_PREFIX as A}from"./deploy/approvalTokenOutput.js";import{imageTagParameterName as i}from"./infra/imageTags.js";import{toPascalCase as T,toKebab as N,toValidDatabaseName as m,toScreamingSnake as s,capitalise as O,getSafeZoneName as C,accountConstructKey as c,hasAsciiStableConstructKey as f}from"./naming/caseConversion.js";import{findAccountNameCollision as P}from"./naming/accountNameCollision.js";import{defaultConnectedAccountName as I,suffixedAccountName as M,REGION_SHORT_CODES as u,findTrailingRegionShortCode as x,regionSuffixRejectionMessage as D}from"./naming/connectedAccountName.js";import{normaliseError as l,getErrorMessage as U,hasErrorCode as V,getErrorCode as h,getErrorStack as G,formatErrorString as v}from"./errorUtils.js";import{singleton as F}from"./async/singleton.js";import{DANGEROUS_ENV_VARS as X,filterDangerousEnvVars as b,maskSensitiveOutput as K,parseShellArgs as y,SCOPED_TOKEN_REGEX as W}from"./securityHelpers.js";import{sleep as Y}from"./async/sleep.js";import{mapSettledWithConcurrency as j}from"./async/concurrency.js";import{ACCOUNT_STAGES_WITH_ROOT as Z,STRUCTURAL_ENVIRONMENTS as q,ACCOUNT_STAGES as w,ACCOUNT_STAGE_LABELS as J,isAccountStage as Q,ACCOUNT_TIERS as $,AccountTierSchema as ee,isAccountTier as re,environmentToTier as oe,stageFromWireEnvironment as Ee,accountTier as te,getEnvironmentLabel as ae,ACCOUNT_ROLES as Se}from"./environments.js";import{RESOURCE_CATEGORIES as Ae,categoriseResource as ne,getExpectedDuration as ie,getFriendlyResourceType as Re}from"./resourceCategorisation.js";import{parseGitRemoteUrl as Ne}from"./repo/gitRemoteParser.js";import{abbreviateRegion as se,AWS_REGIONS_METADATA as Oe,DEFAULT_REGION as Ce,getRegionInfo as ce,MAX_SECONDARY_REGIONS as fe,OPT_IN_REGION_CODES as pe,optInRegionWarning as Pe,regions as ge,suggestRegionForTimezone as Ie}from"./infra/regions.js";import{SCOPE_VALUES as ue,MACHINE_ONLY_SCOPES as xe,USER_GRANTABLE_SCOPES as De}from"./infra/tokenScopes.js";import{SECRET_NAME_PATTERN as le,SECRET_NAME_ERROR as Ue,SSM_COMPONENT_PATTERN as Ve,SSM_COMPONENT_ERROR as he,SSM_STANDARD_MAX_VALUE_BYTES as Ge,SecretNamespaceSchema as ve,buildNamespaceParts as Le,buildParameterPath as Fe,parseParameterPath as He,isManageablePath as Xe,parseDotEnv as be,escapeDotEnvValue as Ke}from"./secrets.js";import{ConnectionWireSchema as We,ConnectionsListResponseSchema as Be}from"./infra/connectionsWire.js";import{deriveRegionsFromOrgConfig as ke,deriveTargets as je,deriveAllTargets as ze,environmentOrTier as Ze,findTarget as qe,generateTargetName as we}from"./targets.js";import{buildAppConfigPath as Qe}from"./repo/appPath.js";import{findInfrastructurePaths as er,findBoundaryPath as rr,isInfrastructureFile as or}from"./repo/findInfrastructurePaths.js";import{inferContainerFromCandidates as tr}from"./repo/inferContainerFromCandidates.js";import{RESERVED_APP_NAMES as Sr,RESERVED_APP_NAME_MESSAGE as _r,isReservedAppName as Ar,RESERVED_APP_NAME_SUFFIX as nr,RESERVED_APP_NAME_SUFFIX_MESSAGE as ir,hasReservedAppNameSuffix as Rr}from"./naming/reservedAppNames.js";import{deriveContentHashTag as Nr,CONTENT_HASH_TAG_PATTERN as mr}from"./infra/deriveContentHashTag.js";import{DEPLOY_MODES as Or,DeployModeSchema as Cr,IMAGE_TAG_PATTERN as cr,ImageTagSchema as fr,ServiceArtefactSchema as pr,ServiceArtefactsSchema as Pr,ARTEFACT_OUTPUT_FIELDS as gr,artefactOutputKey as Ir}from"./infra/deployArtefacts.js";import{MIGRATION_SNAPSHOT_NAME_PREFIX as ur,EXPECTED_SCHEMA_VERSION_ENV as xr,EXPECTED_SCHEMA_VERSION_TOOL_ENV as Dr,EXPECTED_CH_SCHEMA_VERSION_ENV as dr,SCHEMA_ADMIN_USER_ENV as lr,SCHEMA_ADMIN_PASSWORD_ENV as Ur,PRISMA_MIGRATION_DIR_RE as Vr,CLICKHOUSE_MIGRATION_SKIP_RE as hr}from"./migration/constants.js";export{Se as ACCOUNT_ROLES,w as ACCOUNT_STAGES,Z as ACCOUNT_STAGES_WITH_ROOT,J as ACCOUNT_STAGE_LABELS,$ as ACCOUNT_TIERS,_ as APPROVAL_TOKEN_OUTPUT_PREFIX,gr as ARTEFACT_OUTPUT_FIELDS,Oe as AWS_REGIONS_METADATA,ee as AccountTierSchema,a as BACKUP_VAULT_NAME,hr as CLICKHOUSE_MIGRATION_SKIP_RE,mr as CONTENT_HASH_TAG_PATTERN,We as ConnectionWireSchema,Be as ConnectionsListResponseSchema,X as DANGEROUS_ENV_VARS,Ce as DEFAULT_REGION,Or as DEPLOY_MODES,o as DNS_APEX,Cr as DeployModeSchema,dr as EXPECTED_CH_SCHEMA_VERSION_ENV,xr as EXPECTED_SCHEMA_VERSION_ENV,Dr as EXPECTED_SCHEMA_VERSION_TOOL_ENV,cr as IMAGE_TAG_PATTERN,fr as ImageTagSchema,xe as MACHINE_ONLY_SCOPES,fe as MAX_SECONDARY_REGIONS,ur as MIGRATION_SNAPSHOT_NAME_PREFIX,pe as OPT_IN_REGION_CODES,Vr as PRISMA_MIGRATION_DIR_RE,u as REGION_SHORT_CODES,Sr as RESERVED_APP_NAMES,_r as RESERVED_APP_NAME_MESSAGE,nr as RESERVED_APP_NAME_SUFFIX,ir as RESERVED_APP_NAME_SUFFIX_MESSAGE,Ae as RESOURCE_CATEGORIES,Ur as SCHEMA_ADMIN_PASSWORD_ENV,lr as SCHEMA_ADMIN_USER_ENV,W as SCOPED_TOKEN_REGEX,ue as SCOPE_VALUES,Ue as SECRET_NAME_ERROR,le as SECRET_NAME_PATTERN,he as SSM_COMPONENT_ERROR,Ve as SSM_COMPONENT_PATTERN,Ge as SSM_STANDARD_MAX_VALUE_BYTES,q as STRUCTURAL_ENVIRONMENTS,ve as SecretNamespaceSchema,pr as ServiceArtefactSchema,Pr as ServiceArtefactsSchema,A as TOKEN_STDERR_PREFIX,De as USER_GRANTABLE_SCOPES,se as abbreviateRegion,c as accountConstructKey,te as accountTier,Ir as artefactOutputKey,Qe as buildAppConfigPath,Le as buildNamespaceParts,Fe as buildParameterPath,O as capitalise,ne as categoriseResource,I as defaultConnectedAccountName,ze as deriveAllTargets,Nr as deriveContentHashTag,ke as deriveRegionsFromOrgConfig,je as deriveTargets,Ze as environmentOrTier,oe as environmentToTier,Ke as escapeDotEnvValue,b as filterDangerousEnvVars,P as findAccountNameCollision,rr as findBoundaryPath,er as findInfrastructurePaths,qe as findTarget,x as findTrailingRegionShortCode,v as formatErrorString,we as generateTargetName,E as getDomainExportNames,ae as getEnvironmentLabel,h as getErrorCode,U as getErrorMessage,G as getErrorStack,ie as getExpectedDuration,Re as getFriendlyResourceType,ce as getRegionInfo,C as getSafeZoneName,f as hasAsciiStableConstructKey,V as hasErrorCode,Rr as hasReservedAppNameSuffix,i as imageTagParameterName,tr as inferContainerFromCandidates,Q as isAccountStage,re as isAccountTier,or as isInfrastructureFile,Xe as isManageablePath,Ar as isReservedAppName,j as mapSettledWithConcurrency,K as maskSensitiveOutput,l as normaliseError,Pe as optInRegionWarning,be as parseDotEnv,Ne as parseGitRemoteUrl,He as parseParameterPath,y as parseShellArgs,D as regionSuffixRejectionMessage,ge as regions,F as singleton,Y as sleep,Ee as stageFromWireEnvironment,M as suffixedAccountName,Ie as suggestRegionForTimezone,N as toKebab,T as toPascalCase,s as toScreamingSnake,m as toValidDatabaseName};

package/dist/naming/reservedAppNames.d.ts

@@ -44,3 +44,30 @@ export declare const RESERVED_APP_NAME_MESSAGE = "This application name is reser
  * inline, so the lowercasing discipline cannot drift across CLI/webapp/worker.
  */
 export declare function isReservedAppName(name: string): boolean;
+/**
+ * Reserved application-name suffix: `-cache`.
+ *
+ * Every app's ECR build-cache repository is derived as
+ * `` `${toKebab(appName)}-cache` `` (`buildCacheRepositoryName`,
+ * `util/src/docker/cacheRepository.ts`). An application whose own kebab form
+ * ends in `-cache` would collide with a sibling app's cache repo: the
+ * sibling's deploy session policy exempts that ARN from the foreign-ECR
+ * mutation Deny (deploy-core `deploySessionPolicy.ts`) and its cache ensure
+ * would overwrite the colliding app repo's lifecycle policy. Rejecting the
+ * suffix at create time keeps the `-cache` namespace exclusively
+ * derivational.
+ */
+export declare const RESERVED_APP_NAME_SUFFIX = "-cache";
+/**
+ * Canonical user-facing rejection message for a `-cache`-suffixed name.
+ * Shared by every create surface so the wording cannot drift.
+ */
+export declare const RESERVED_APP_NAME_SUFFIX_MESSAGE = "Application names ending in '-cache' are reserved for Fjall build-cache repositories.";
+/**
+ * Suffix check for the reserved `-cache` namespace. Runs on the kebab form,
+ * not the raw lowercase — `WebAppCache` contains no hyphen until kebab-cased,
+ * yet derives the colliding repo `web-app-cache`. Consumers MUST route
+ * through this helper rather than an inline `.endsWith()` so the kebab-first
+ * discipline cannot drift across CLI/webapp/worker.
+ */
+export declare function hasReservedAppNameSuffix(name: string): boolean;

package/dist/naming/reservedAppNames.js

@@ -1 +1 @@
-const r=["fjall","organisation","platform","account"],o="This application name is reserved for Fjall's organisation-tier infrastructure.";function t(e){return r.includes(e.toLowerCase())}export{r as RESERVED_APP_NAMES,o as RESERVED_APP_NAME_MESSAGE,t as isReservedAppName};
+import{toKebab as r}from"./caseConversion.js";const o=["fjall","organisation","platform","account"],a="This application name is reserved for Fjall's organisation-tier infrastructure.";function i(e){return o.includes(e.toLowerCase())}const t="-cache",s="Application names ending in '-cache' are reserved for Fjall build-cache repositories.";function E(e){return r(e).endsWith(t)}export{o as RESERVED_APP_NAMES,a as RESERVED_APP_NAME_MESSAGE,t as RESERVED_APP_NAME_SUFFIX,s as RESERVED_APP_NAME_SUFFIX_MESSAGE,E as hasReservedAppNameSuffix,i as isReservedAppName};

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@fjall/util",
-  "version": "2.25.0",
+  "version": "2.27.0",
   "description": "Common utility methods",
   "type": "module",
   "main": "dist/index.js",
@@ -10,6 +10,10 @@
       "types": "./dist/index.d.ts",
       "default": "./dist/index.js"
     },
+    "./buildConcurrency": {
+      "types": "./dist/buildConcurrency.d.ts",
+      "default": "./dist/buildConcurrency.js"
+    },
     "./config": {
       "types": "./dist/config.d.ts",
       "default": "./dist/config.js"
@@ -125,5 +129,5 @@
   "engines": {
     "node": ">=22.0.0"
   },
-  "gitHead": "7c1a329184064aefa557c2c09de0965c4f8cd4fb"
+  "gitHead": "921ecd4f65f52c17037a8a24834d7e4c196b9347"
 }