@fjall/util 2.27.0 → 2.30.0

package/dist/.minified

@@ -1 +1 @@
-77 files minified at 2026-07-07T01:04:04.313Z
+84 files minified at 2026-07-15T07:08:25.279Z

package/dist/aws/CloudFormationFailureAnalyser.d.ts

@@ -1,4 +1,5 @@
 import { type ResourceEvent } from "./cloudformationTypes.js";
+import { type DriftSuspectEvent } from "./driftSuspects.js";
 export interface RootCause {
     resource: ResourceEvent;
     reason: string;
@@ -12,6 +13,13 @@ export interface FailureAnalysis {
     summary: string;
     remediation: string[];
     errorPattern?: string;
+    /**
+     * Resources whose failure carries the out-of-band-deletion shape (Class 1
+     * drift): CloudFormation still tracks them but the service reported
+     * NotFound. Suspects only — confirmation requires the deploy-core drift
+     * probe. Absent when no failure event matches the NotFound anchors.
+     */
+    driftSuspects?: DriftSuspectEvent[];
 }
 /**
  * CloudFormationFailureAnalyser provides intelligent analysis of deployment failures
@@ -19,7 +27,25 @@ export interface FailureAnalysis {
  */
 export declare class CloudFormationFailureAnalyser {
     private knownErrorPatterns;
-    analyseFailure(eventHistory: Map<string, ResourceEvent[]>): FailureAnalysis | null;
+    /**
+     * `stackName` opts the drift scan into current-operation bounding: the
+     * monitor's event history is seeded with the stack's FULL retained event
+     * history (~90 days), so an unbounded scan would resurrect suspects from
+     * long-past operations that were since cured. Callers whose history is
+     * already operation-scoped (callback-fed collections) omit it.
+     */
+    analyseFailure(eventHistory: Map<string, ResourceEvent[]>, stackName?: string): FailureAnalysis | null;
+    /**
+     * Scans EVERY failed event, not failedResources: a wedged resource's
+     * UPDATE_FAILED is superseded by its rollback event, so latest-per-resource
+     * semantics would drop exactly the wedge. When `stackName` is given, the
+     * scan is bounded to events at/after the current operation's opening event;
+     * if no opening event is visible the scan yields nothing rather than risk
+     * classifying a stale prior-operation failure (fail-safe: a missed hint is
+     * recoverable via `fjall drift detect`, a stale suspect self-reinforces
+     * through the journal).
+     */
+    private classifyDriftSuspects;
     private findFailedResources;
     private findRootCause;
     private categoriseError;

package/dist/aws/CloudFormationFailureAnalyser.js

@@ -1 +1 @@
-class a{knownErrorPatterns=[{pattern:/AccessDenied|UnauthorizedOperation|Forbidden/i,category:"permissions",remediation:["Check IAM permissions for the deployment role","Ensure the role has necessary CloudFormation permissions","Verify service-linked roles are created if needed"]},{pattern:/Invalid.*Parameter|ValidationError|Invalid.*Value/i,category:"validation",remediation:["Review parameter values in your CDK code","Check for typos in resource names or ARNs","Ensure all required parameters are provided"]},{pattern:/Limit.*Exceeded|Quota.*Exceeded|Maximum.*reached/i,category:"limit",remediation:["Check AWS service quotas in the Service Quotas console","Request a quota increase if needed","Consider using a different region with available capacity"]},{pattern:/Timeout|Connection.*refused|Network.*unreachable/i,category:"network",remediation:["Check network connectivity and VPC settings","Verify security groups and NACLs","Ensure endpoints are accessible"]},{pattern:/already exists|Duplicate|ConflictException/i,category:"validation",remediation:["Resource with this name already exists","Consider using a different name or deleting the existing resource","Check if you are deploying to the correct account/region"]},{pattern:/Role.*not.*found|Role.*does.*not.*exist/i,category:"dependency",remediation:["Ensure IAM roles are created before dependent resources","Check role names and ARNs are correct","Verify cross-stack references are properly configured"]}];analyseFailure(e){const r=this.findFailedResources(e);if(r.length===0)return null;const s=this.findRootCause(r,e),n=this.buildDependencyChain(s.resource,r),i=this.generateRemediation(s),t=this.generateSummary(s,r);return{rootCause:s,affectedResources:r,dependencyChain:n,summary:t,remediation:i,errorPattern:s.category}}findFailedResources(e){const r=[];for(const[s,n]of e){const i=n[n.length-1];i&&this.isFailedStatus(i.status)&&r.push(i)}return r.sort((s,n)=>s.timestamp.getTime()-n.timestamp.getTime())}findRootCause(e,r){if(e.length===0)return{resource:{logicalId:"Unknown",resourceType:"Unknown",status:"FAILED",timestamp:new Date},reason:"No failed resources found",category:"unknown",isDirectCause:!1};const s=e[0],n=this.categoriseError(s.statusReason||""),i=this.isDirectCause(s,r);return{resource:s,reason:s.statusReason||"Unknown error",category:n,isDirectCause:i}}categoriseError(e){for(const r of this.knownErrorPatterns)if(r.pattern.test(e))return r.category;return"unknown"}isDirectCause(e,r){const s=e.statusReason||"";return s.includes("depends on")||s.includes("referenced by")||s.includes("required by")?!1:!(r.get(e.logicalId)||[]).some(t=>t.status.includes("COMPLETE")&&!t.status.includes("ROLLBACK"))}buildDependencyChain(e,r){const s=[];s.push(`${e.logicalId} (${e.resourceType}) - ROOT CAUSE`);for(const n of r)n.logicalId!==e.logicalId&&((n.statusReason||"").toLowerCase().includes(e.logicalId.toLowerCase())?s.push(`  \u2192 ${n.logicalId} (${n.resourceType}) - Failed due to ${e.logicalId}`):s.push(`  \u2192 ${n.logicalId} (${n.resourceType})`));return s}generateRemediation(e){const r=[];for(const s of this.knownErrorPatterns)if(s.category===e.category){r.push(...s.remediation);break}return e.resource.resourceType.includes("IAM")?r.push("Review IAM policies and trust relationships"):e.resource.resourceType.includes("Lambda")?r.push("Check Lambda function configuration and runtime"):e.resource.resourceType.includes("ECS")&&r.push("Verify ECS task definition and container configuration"),r.length===0&&r.push("Review the CloudFormation console for detailed error messages","Check the resource configuration in your CDK code","Ensure all dependencies are properly defined"),r}generateSummary(e,r){const s=this.simplifyResourceType(e.resource.resourceType),n=r.length;let i=`Deployment failed: ${s} "${e.resource.logicalId}" `;switch(e.category){case"permissions":i+="failed due to insufficient permissions";break;case"validation":i+="failed validation";break;case"dependency":i+="has missing or invalid dependencies";break;case"limit":i+="exceeded AWS service limits";break;case"network":i+="encountered network issues";break;default:i+="failed to create"}return n>1&&(i+=` (${n-1} dependent resources also failed)`),i}simplifyResourceType(e){return e.replace("AWS::","").replace("::"," ")}isFailedStatus(e){return e.includes("FAILED")}}export{a as CloudFormationFailureAnalyser};
+import{classifyDriftSuspectEvents as c,findCurrentOperationStart as d}from"./driftSuspects.js";class f{knownErrorPatterns=[{pattern:/AccessDenied|UnauthorizedOperation|Forbidden/i,category:"permissions",remediation:["Check IAM permissions for the deployment role","Ensure the role has necessary CloudFormation permissions","Verify service-linked roles are created if needed"]},{pattern:/Invalid.*Parameter|ValidationError|Invalid.*Value/i,category:"validation",remediation:["Review parameter values in your CDK code","Check for typos in resource names or ARNs","Ensure all required parameters are provided"]},{pattern:/Limit.*Exceeded|Quota.*Exceeded|Maximum.*reached/i,category:"limit",remediation:["Check AWS service quotas in the Service Quotas console","Request a quota increase if needed","Consider using a different region with available capacity"]},{pattern:/Timeout|Connection.*refused|Network.*unreachable/i,category:"network",remediation:["Check network connectivity and VPC settings","Verify security groups and NACLs","Ensure endpoints are accessible"]},{pattern:/already exists|Duplicate|ConflictException/i,category:"validation",remediation:["Resource with this name already exists","Consider using a different name or deleting the existing resource","Check if you are deploying to the correct account/region"]},{pattern:/Role.*not.*found|Role.*does.*not.*exist/i,category:"dependency",remediation:["Ensure IAM roles are created before dependent resources","Check role names and ARNs are correct","Verify cross-stack references are properly configured"]}];analyseFailure(e,t){const r=this.findFailedResources(e);if(r.length===0)return null;const s=this.findRootCause(r,e),n=this.buildDependencyChain(s.resource,r),i=this.classifyDriftSuspects(e,t),o=this.generateRemediation(s);i.length>0&&o.unshift("One or more resources CloudFormation still tracks appear to have been deleted outside CloudFormation","Run 'fjall drift detect' to confirm the deletion; confirmed deletions are remediated with 'fjall drift repair'");const a=this.generateSummary(s,r);return{rootCause:s,affectedResources:r,dependencyChain:n,summary:a,remediation:o,errorPattern:s.category,...i.length>0?{driftSuspects:i}:{}}}classifyDriftSuspects(e,t){const r=t!==void 0?d(e.get(t)??[],t):null;if(t!==void 0&&r===null)return[];const s=[];for(const n of e.values())for(const i of n)this.isFailedStatus(i.status)&&(r!==null&&i.timestamp.getTime()<r.getTime()||s.push(i));return c(s)}findFailedResources(e){const t=[];for(const[r,s]of e){const n=s[s.length-1];n&&this.isFailedStatus(n.status)&&t.push(n)}return t.sort((r,s)=>r.timestamp.getTime()-s.timestamp.getTime())}findRootCause(e,t){if(e.length===0)return{resource:{logicalId:"Unknown",resourceType:"Unknown",status:"FAILED",timestamp:new Date},reason:"No failed resources found",category:"unknown",isDirectCause:!1};const r=e[0],s=this.categoriseError(r.statusReason||""),n=this.isDirectCause(r,t);return{resource:r,reason:r.statusReason||"Unknown error",category:s,isDirectCause:n}}categoriseError(e){for(const t of this.knownErrorPatterns)if(t.pattern.test(e))return t.category;return"unknown"}isDirectCause(e,t){const r=e.statusReason||"";return r.includes("depends on")||r.includes("referenced by")||r.includes("required by")?!1:!(t.get(e.logicalId)||[]).some(i=>i.status.includes("COMPLETE")&&!i.status.includes("ROLLBACK"))}buildDependencyChain(e,t){const r=[];r.push(`${e.logicalId} (${e.resourceType}) - ROOT CAUSE`);for(const s of t)s.logicalId!==e.logicalId&&((s.statusReason||"").toLowerCase().includes(e.logicalId.toLowerCase())?r.push(`  \u2192 ${s.logicalId} (${s.resourceType}) - Failed due to ${e.logicalId}`):r.push(`  \u2192 ${s.logicalId} (${s.resourceType})`));return r}generateRemediation(e){const t=[];for(const r of this.knownErrorPatterns)if(r.category===e.category){t.push(...r.remediation);break}return e.resource.resourceType.includes("IAM")?t.push("Review IAM policies and trust relationships"):e.resource.resourceType.includes("Lambda")?t.push("Check Lambda function configuration and runtime"):e.resource.resourceType.includes("ECS")&&t.push("Verify ECS task definition and container configuration"),t.length===0&&t.push("Review the CloudFormation console for detailed error messages","Check the resource configuration in your CDK code","Ensure all dependencies are properly defined"),t}generateSummary(e,t){const r=this.simplifyResourceType(e.resource.resourceType),s=t.length;let n=`Deployment failed: ${r} "${e.resource.logicalId}" `;switch(e.category){case"permissions":n+="failed due to insufficient permissions";break;case"validation":n+="failed validation";break;case"dependency":n+="has missing or invalid dependencies";break;case"limit":n+="exceeded AWS service limits";break;case"network":n+="encountered network issues";break;default:n+="failed to create"}return s>1&&(n+=` (${s-1} dependent resources also failed)`),n}simplifyResourceType(e){return e.replace("AWS::","").replace("::"," ")}isFailedStatus(e){return e.includes("FAILED")}}export{f as CloudFormationFailureAnalyser};

package/dist/aws/cloudformationTypes.d.ts

@@ -13,5 +13,11 @@ export interface ResourceEvent {
     group?: string;
     /** CDK construct path (e.g., "/Account/CloudTrail/trail/Resource"). */
     constructPath?: string;
+    /**
+     * CloudFormation ClientRequestToken for the operation that emitted this event
+     * (§5.9 capture-not-stamp). Lets a reconciler correlate an orphaned CFN
+     * operation back to its deployment row. Absent on synthetic/initial events.
+     */
+    clientRequestToken?: string;
 }
 export declare function isResourceEvent(event: unknown): event is ResourceEvent;

package/dist/aws/driftSuspects.d.ts

@@ -0,0 +1,54 @@
+/**
+ * Class 1 drift classification — out-of-band deletion suspects.
+ *
+ * A resource CloudFormation still tracks but which was deleted outside
+ * CloudFormation wedges every subsequent update: the service handler returns
+ * NotFound and the stack rolls back (the BusinessContinuity CMK incident,
+ * account 913524923178). The patterns here are derived from the Phase 0
+ * empirical fixtures (`fjall/deploy-core/src/orchestration/drift/__tests__/
+ * fixtures/bc-stack-events.json`, captured 2026-07-07): the stable anchors are
+ * the registry handler contract marker `HandlerErrorCode: NotFound` and the
+ * service message shape `does not exist (Service: …`.
+ *
+ * Classification is SUSPECTS ONLY — never a confirmed verdict. Confirmation
+ * requires a direct per-type probe (deploy-core `driftProbe.ts`); a suspect
+ * that cannot be probed stays UNCONFIRMED and remediation is refused
+ * (fail-closed: never surgery on a resource not proven dead).
+ */
+import type { ResourceEvent } from "./cloudformationTypes.js";
+/**
+ * A resource whose failure event carries the out-of-band-deletion shape.
+ * `statusReason` is raw here — the analyser's `maskFailureAnalysis` boundary
+ * (or the sink) masks before display/persistence.
+ */
+export interface DriftSuspectEvent {
+    logicalId: string;
+    resourceType: string;
+    physicalId?: string;
+    /** The failed status that carried the NotFound shape (e.g. UPDATE_FAILED). */
+    failedStatus: string;
+    statusReason: string;
+}
+/** True when a failure reason carries the out-of-band-deletion shape. */
+export declare function isDriftSuspectReason(statusReason: string): boolean;
+/**
+ * True for the stack-level event that opens a CloudFormation operation —
+ * the shared boundary for "current operation only" scans (the deploy-core
+ * last-operation event walk and the failure analyser's drift scan).
+ */
+export declare function isOperationOpeningEvent(event: ResourceEvent, stackName: string): boolean;
+/**
+ * Timestamp of the most recent operation-opening event for `stackName`, or
+ * null when none is visible. Server-clock consistent with event timestamps,
+ * so callers can bound scans without local-clock skew.
+ */
+export declare function findCurrentOperationStart(events: readonly ResourceEvent[], stackName: string): Date | null;
+/**
+ * Extract out-of-band-deletion suspects from failure events. Callers pass
+ * EVERY failed event in the operation, not just each resource's latest — a
+ * wedged resource's UPDATE_FAILED is typically superseded by a later
+ * UPDATE_ROLLBACK_* event, so latest-event-per-resource semantics would drop
+ * exactly the suspects this classifier exists to find. Deduplicated by
+ * logicalId (first match wins).
+ */
+export declare function classifyDriftSuspectEvents(events: readonly ResourceEvent[]): DriftSuspectEvent[];

package/dist/aws/driftSuspects.js

@@ -0,0 +1 @@
+const o=new Set(["UPDATE_FAILED","DELETE_FAILED"]),i=[/HandlerErrorCode:\s*NotFound\b/,/does not exist \(Service:/i,/\b(?:ResourceNotFoundException|NotFoundException|NoSuchBucket|NoSuchEntity)\b/],c=/Resource (?:creation|update) cancelled/i;function u(e){return c.test(e)?!1:i.some(s=>s.test(e))}const a="AWS::CloudFormation::Stack",r=new Set(["CREATE_IN_PROGRESS","UPDATE_IN_PROGRESS","DELETE_IN_PROGRESS","IMPORT_IN_PROGRESS"]),E="User Initiated";function S(e,s){return e.resourceType===a&&e.logicalId===s&&r.has(e.status)&&e.statusReason!==void 0&&e.statusReason.includes(E)}function d(e,s){let n=null;for(const t of e)S(t,s)&&(n===null||t.timestamp.getTime()>n.getTime())&&(n=t.timestamp);return n}function R(e){const s=[],n=new Set;for(const t of e)n.has(t.logicalId)||o.has(t.status)&&(t.statusReason===void 0||t.statusReason===""||u(t.statusReason)&&(n.add(t.logicalId),s.push({logicalId:t.logicalId,resourceType:t.resourceType,...t.physicalId!==void 0&&t.physicalId!==""?{physicalId:t.physicalId}:{},failedStatus:t.status,statusReason:t.statusReason})));return s}export{R as classifyDriftSuspectEvents,d as findCurrentOperationStart,u as isDriftSuspectReason,S as isOperationOpeningEvent};

package/dist/aws/index.d.ts

@@ -3,6 +3,7 @@ export { STACK_NOT_FOUND_PATTERN, CDK_NO_STACKS_MATCH, type ResourceEvent, isRes
 export { type ResourceProgressCounts, countResourceProgress, formatElapsed } from "./deployProgress.js";
 export { CloudFormationFailureAnalyser, type RootCause, type FailureAnalysis } from "./CloudFormationFailureAnalyser.js";
 export { maskFailureAnalysis } from "./maskFailureAnalysis.js";
+export { classifyDriftSuspectEvents, findCurrentOperationStart, isDriftSuspectReason, isOperationOpeningEvent, type DriftSuspectEvent } from "./driftSuspects.js";
 export { IPAM_OPERATIONS_POOL_TAG_KEY, formatIpamPairTagValue } from "./ipamTags.js";
 export { SDK_PRE_EMPTY_TAG_KEY } from "./infraTags.js";
 export { ACCOUNT_MONITORING_ROLE_NAME } from "./monitoringRole.js";

package/dist/aws/index.js

@@ -1 +1 @@
-import{AWSError as e,NoRolesFoundError as E,InvalidCredentialsError as s,SSOTokenExpiredError as a,MissingRegionError as i,ProfileNotFoundError as _,CommandError as t,isAWSError as m,isNoRolesFoundError as n,isSSOUnauthorizedError as A}from"./errors.js";import{STACK_NOT_FOUND_PATTERN as O,CDK_NO_STACKS_MATCH as l,isResourceEvent as N}from"./cloudformationTypes.js";import{countResourceProgress as p,formatElapsed as u}from"./deployProgress.js";import{CloudFormationFailureAnalyser as d}from"./CloudFormationFailureAnalyser.js";import{maskFailureAnalysis as x}from"./maskFailureAnalysis.js";import{IPAM_OPERATIONS_POOL_TAG_KEY as P,formatIpamPairTagValue as F}from"./ipamTags.js";import{SDK_PRE_EMPTY_TAG_KEY as K}from"./infraTags.js";import{ACCOUNT_MONITORING_ROLE_NAME as g}from"./monitoringRole.js";export{g as ACCOUNT_MONITORING_ROLE_NAME,e as AWSError,l as CDK_NO_STACKS_MATCH,d as CloudFormationFailureAnalyser,t as CommandError,P as IPAM_OPERATIONS_POOL_TAG_KEY,s as InvalidCredentialsError,i as MissingRegionError,E as NoRolesFoundError,_ as ProfileNotFoundError,K as SDK_PRE_EMPTY_TAG_KEY,a as SSOTokenExpiredError,O as STACK_NOT_FOUND_PATTERN,p as countResourceProgress,u as formatElapsed,F as formatIpamPairTagValue,m as isAWSError,n as isNoRolesFoundError,N as isResourceEvent,A as isSSOUnauthorizedError,x as maskFailureAnalysis};
+import{AWSError as e,NoRolesFoundError as t,InvalidCredentialsError as i,SSOTokenExpiredError as s,MissingRegionError as n,ProfileNotFoundError as E,CommandError as a,isAWSError as p,isNoRolesFoundError as _,isSSOUnauthorizedError as f}from"./errors.js";import{STACK_NOT_FOUND_PATTERN as O,CDK_NO_STACKS_MATCH as u,isResourceEvent as A}from"./cloudformationTypes.js";import{countResourceProgress as T,formatElapsed as l}from"./deployProgress.js";import{CloudFormationFailureAnalyser as d}from"./CloudFormationFailureAnalyser.js";import{maskFailureAnalysis as x}from"./maskFailureAnalysis.js";import{classifyDriftSuspectEvents as P,findCurrentOperationStart as F,isDriftSuspectReason as c,isOperationOpeningEvent as I}from"./driftSuspects.js";import{IPAM_OPERATIONS_POOL_TAG_KEY as M,formatIpamPairTagValue as g}from"./ipamTags.js";import{SDK_PRE_EMPTY_TAG_KEY as v}from"./infraTags.js";import{ACCOUNT_MONITORING_ROLE_NAME as G}from"./monitoringRole.js";export{G as ACCOUNT_MONITORING_ROLE_NAME,e as AWSError,u as CDK_NO_STACKS_MATCH,d as CloudFormationFailureAnalyser,a as CommandError,M as IPAM_OPERATIONS_POOL_TAG_KEY,i as InvalidCredentialsError,n as MissingRegionError,t as NoRolesFoundError,E as ProfileNotFoundError,v as SDK_PRE_EMPTY_TAG_KEY,s as SSOTokenExpiredError,O as STACK_NOT_FOUND_PATTERN,P as classifyDriftSuspectEvents,T as countResourceProgress,F as findCurrentOperationStart,l as formatElapsed,g as formatIpamPairTagValue,p as isAWSError,c as isDriftSuspectReason,_ as isNoRolesFoundError,I as isOperationOpeningEvent,A as isResourceEvent,f as isSSOUnauthorizedError,x as maskFailureAnalysis};

package/dist/aws/maskFailureAnalysis.js

@@ -1 +1 @@
-import{maskSensitiveOutput as o}from"../securityHelpers.js";function r(e){return e.statusReason===void 0?e:{...e,statusReason:o(e.statusReason)}}function u(e){const s={...e.rootCause,reason:o(e.rootCause.reason),resource:r(e.rootCause.resource)};return{...e,rootCause:s,affectedResources:e.affectedResources.map(r)}}export{u as maskFailureAnalysis};
+import{maskSensitiveOutput as t}from"../securityHelpers.js";function r(e){return e.statusReason===void 0?e:{...e,statusReason:t(e.statusReason)}}function u(e){return{...e,statusReason:t(e.statusReason)}}function n(e){const s={...e.rootCause,reason:t(e.rootCause.reason),resource:r(e.rootCause.resource)};return{...e,rootCause:s,affectedResources:e.affectedResources.map(r),...e.driftSuspects!==void 0?{driftSuspects:e.driftSuspects.map(u)}:{}}}export{n as maskFailureAnalysis};

package/dist/cfn/physicalNameProperties.d.ts

@@ -0,0 +1,13 @@
+/**
+ * Fallback map for pinned-name detection: CloudFormation resource types whose
+ * user-settable NAMING property cannot be derived from the registry schema's
+ * `primaryIdentifier` — the identifier is a generated attribute (ARN, URL, ID)
+ * that never appears in a template's Properties.
+ *
+ * Consulted by @fjall/deploy-core's pinned-name detector AFTER the
+ * primaryIdentifier derivation fails to yield a template property. Keep this
+ * map small: types whose primaryIdentifier IS the naming property
+ * (DBInstanceIdentifier, TableName, BucketName, RepositoryName, …) must NOT be
+ * added here.
+ */
+export declare const PHYSICAL_NAME_FALLBACK_PROPERTIES: Readonly<Record<string, string>>;

package/dist/cfn/physicalNameProperties.js

@@ -0,0 +1 @@
+const e={"AWS::SecretsManager::Secret":"Name","AWS::SQS::Queue":"QueueName","AWS::SNS::Topic":"TopicName"};export{e as PHYSICAL_NAME_FALLBACK_PROPERTIES};

package/dist/docker/bakeGuard.d.ts

@@ -29,6 +29,17 @@ import type { DockerBuildArgValue } from "../manifest/schemas.js";
  * finding/warning message states the same blast radius (design R4).
  */
 export declare const BAKE_GUARD_EXPOSURE_CLAUSE: string;
+/**
+ * Creates a per-deploy de-duplicator for bake-exposure warnings.
+ *
+ * A buildArg baked into more than one service image of the same app (an app +
+ * its workers, built as separate groups) produces byte-identical exposure
+ * warnings — the exposure is a property of the KEY, not of each image, so the
+ * operator only needs to see each warning once per deploy. Returns a predicate
+ * that is `true` the first time it sees a message and `false` thereafter; share
+ * one instance across a deploy's build groups.
+ */
+export declare function createBakeWarningDeduper(): (message: string) => boolean;
 export type BakeGuardFindingReason = "sourced-ref" | "credential-shape";
 export interface BakeGuardFinding {
     /** The offending `buildArgs` key. */

package/dist/docker/bakeGuard.js

@@ -1 +1 @@
-import{maskSensitiveOutput as s}from"../securityHelpers.js";import{PUBLIC_BUILD_ARG_PREFIXES as l,isPublicBuildVarName as u}from"./buildArgInference.js";const o="baked values are world-readable in `docker history`, image provenance/SBOM, and the `<app>-cache` mode=max ECR cache repo";function p(t,n){const r=[],i=[];if(t===void 0)return{findings:r,warnings:i};for(const[e,a]of Object.entries(t)){if(typeof a=="object"){if(a.acknowledgePublic===!0)continue;if(a.ssm!==void 0||a.secretsManager!==void 0){r.push({key:e,reason:"sourced-ref",message:`buildArg "${e}" (app "${n}") is sourced from a secret store (SSM/Secrets Manager) but baked via --build-arg \u2014 ${o}. Move it to docker.buildSecrets (BuildKit --secret mount, never baked), or, if the value is genuinely public-but-sensitive and must ship in the client bundle, set acknowledgePublic: true to bake it deliberately.`});continue}u(e)||i.push({key:e,message:d(e)});continue}if(s(a)!==a){r.push({key:e,reason:"credential-shape",message:c(e,n)});continue}u(e)||i.push({key:e,message:d(e)})}return{findings:r,warnings:i}}function d(t){return`buildArg "${t}" does not start with a public prefix (${l.join(", ")}) and is frozen into the image at build time \u2014 ${o}. If this value should vary per deploy, use a runtime env var (ECS task environment) instead of baking it.`}function c(t,n){return`buildArg "${t}" (app "${n}") has a value that looks like a credential but would be baked via --build-arg \u2014 ${o}. Move it to docker.buildSecrets (BuildKit --secret mount, never baked). If it is a genuinely public-but-sensitive value, use the object form { ssm/secretsManager/env, acknowledgePublic: true } to bake it deliberately.`}function g(t){const n=new Set;if(t===void 0)return n;for(const[r,i]of Object.entries(t))typeof i=="object"&&i.acknowledgePublic===!0&&n.add(r);return n}function v(t,n,r){const i=[];for(const[e,a]of Object.entries(t))r.has(e)||s(a)!==a&&i.push({key:e,reason:"credential-shape",message:c(e,n)});return i}export{o as BAKE_GUARD_EXPOSURE_CLAUSE,g as acknowledgedBuildArgKeys,p as evaluateBakeGuard,v as evaluateResolvedBuildArgValues};
+import{maskSensitiveOutput as o}from"../securityHelpers.js";import{PUBLIC_BUILD_ARG_PREFIXES as l,isPublicBuildVarName as s}from"./buildArgInference.js";const u="baked values are world-readable in `docker history`, image provenance/SBOM, and the `<app>-cache` mode=max ECR cache repo";function p(){const e=new Set;return n=>e.has(n)?!1:(e.add(n),!0)}function g(e,n){const a=[],i=[];if(e===void 0)return{findings:a,warnings:i};for(const[t,r]of Object.entries(e)){if(typeof r=="object"){if(r.acknowledgePublic===!0)continue;if(r.ssm!==void 0||r.secretsManager!==void 0){a.push({key:t,reason:"sourced-ref",message:`buildArg "${t}" (app "${n}") is sourced from a secret store (SSM/Secrets Manager) but baked via --build-arg \u2014 ${u}. Move it to docker.buildSecrets (BuildKit --secret mount, never baked), or, if the value is genuinely public-but-sensitive and must ship in the client bundle, set acknowledgePublic: true to bake it deliberately.`});continue}s(t)||i.push({key:t,message:d(t)});continue}if(o(r)!==r){a.push({key:t,reason:"credential-shape",message:c(t,n)});continue}s(t)||i.push({key:t,message:d(t)})}return{findings:a,warnings:i}}function d(e){return`buildArg "${e}" does not start with a public prefix (${l.join(", ")}) and is frozen into the image at build time \u2014 ${u}. If this value should vary per deploy, use a runtime env var (ECS task environment) instead of baking it.`}function c(e,n){return`buildArg "${e}" (app "${n}") has a value that looks like a credential but would be baked via --build-arg \u2014 ${u}. Move it to docker.buildSecrets (BuildKit --secret mount, never baked). If it is a genuinely public-but-sensitive value, use the object form { ssm/secretsManager/env, acknowledgePublic: true } to bake it deliberately.`}function k(e){const n=new Set;if(e===void 0)return n;for(const[a,i]of Object.entries(e))typeof i=="object"&&i.acknowledgePublic===!0&&n.add(a);return n}function v(e,n,a){const i=[];for(const[t,r]of Object.entries(e))a.has(t)||o(r)!==r&&i.push({key:t,reason:"credential-shape",message:c(t,n)});return i}export{u as BAKE_GUARD_EXPOSURE_CLAUSE,k as acknowledgedBuildArgKeys,p as createBakeWarningDeduper,g as evaluateBakeGuard,v as evaluateResolvedBuildArgValues};

package/dist/docker/index.d.ts

@@ -2,7 +2,7 @@ export { type Result, isSuccess, isFailure, success, failure } from "./result.js
 export { DOCKER_CLI_LOG_CATEGORY, DOCKER_CLI_BUILDX_LOG_CATEGORY, BUILDX_VERSION_FLOOR, ENGINE_VERSION_FLOOR, PrerequisiteMissingExitCode, DEFAULT_BUILDER_NAME, DEFAULT_DOCKER_BIN, SIGTERM_GRACE_MS, STDERR_TAIL_LINES, DEFAULT_BUILD_TIMEOUT_MS, DEFAULT_PUSH_TIMEOUT_MS, DEFAULT_PULL_TIMEOUT_MS, DEFAULT_INSPECT_TIMEOUT_MS, DEFAULT_DAEMON_PROBE_TIMEOUT_MS } from "./dockerCliConstants.js";
 export { BuildxBuildArgsSchema, BuildxBuildResultSchema, DockerCliErrorKindSchema, DockerCliErrorSchema, isDockerCliErrorKind, type BuildxBuildArgs, type BuildxBuildResult, type DockerCliError, type DockerCliErrorKind } from "./dockerCliSchemas.js";
 export { buildxArgvBuilder } from "./buildxArgvBuilder.js";
-export { evaluateBakeGuard, evaluateResolvedBuildArgValues, acknowledgedBuildArgKeys, BAKE_GUARD_EXPOSURE_CLAUSE, type BakeGuardFinding, type BakeGuardFindingReason, type BakeGuardWarning, type BakeGuardResult } from "./bakeGuard.js";
+export { evaluateBakeGuard, evaluateResolvedBuildArgValues, acknowledgedBuildArgKeys, createBakeWarningDeduper, BAKE_GUARD_EXPOSURE_CLAUSE, type BakeGuardFinding, type BakeGuardFindingReason, type BakeGuardWarning, type BakeGuardResult } from "./bakeGuard.js";
 export { PUBLIC_BUILD_ARG_PREFIXES, isPublicBuildVarName, inferPublicBuildArgKeys, type InferPublicBuildArgKeysInput } from "./buildArgInference.js";
 export { parseRawjsonLine, type RawjsonEnvelope, type RawjsonVertex, type RawjsonStatus, type RawjsonLog, type RawjsonWarning } from "./rawjsonParser.js";
 export { rawjsonToVertexEvent, type RawjsonVertexEvent, type NormalisedVertex, type NormalisedStatus, type NormalisedLog, type NormalisedWarning } from "./rawjsonToVertexEvent.js";

package/dist/docker/index.js

@@ -1 +1 @@
-import{isSuccess as o,isFailure as E,success as _,failure as i}from"./result.js";import{DOCKER_CLI_LOG_CATEGORY as t,DOCKER_CLI_BUILDX_LOG_CATEGORY as a,BUILDX_VERSION_FLOOR as s,ENGINE_VERSION_FLOOR as T,PrerequisiteMissingExitCode as u,DEFAULT_BUILDER_NAME as A,DEFAULT_DOCKER_BIN as L,SIGTERM_GRACE_MS as R,STDERR_TAIL_LINES as D,DEFAULT_BUILD_TIMEOUT_MS as U,DEFAULT_PUSH_TIMEOUT_MS as c,DEFAULT_PULL_TIMEOUT_MS as I,DEFAULT_INSPECT_TIMEOUT_MS as O,DEFAULT_DAEMON_PROBE_TIMEOUT_MS as S}from"./dockerCliConstants.js";import{BuildxBuildArgsSchema as x,BuildxBuildResultSchema as m,DockerCliErrorKindSchema as B,DockerCliErrorSchema as C,isDockerCliErrorKind as p}from"./dockerCliSchemas.js";import{buildxArgvBuilder as M}from"./buildxArgvBuilder.js";import{evaluateBakeGuard as P,evaluateResolvedBuildArgValues as F,acknowledgedBuildArgKeys as G,BAKE_GUARD_EXPOSURE_CLAUSE as n}from"./bakeGuard.js";import{PUBLIC_BUILD_ARG_PREFIXES as K,isPublicBuildVarName as h,inferPublicBuildArgKeys as k}from"./buildArgInference.js";import{parseRawjsonLine as v}from"./rawjsonParser.js";import{rawjsonToVertexEvent as V}from"./rawjsonToVertexEvent.js";import{parseMetadataFile as j}from"./metadataFileParser.js";import{projectBuildxResult as Y}from"./projectBuildxResult.js";import{abortChildProcess as q}from"./abortHelpers.js";import{DockerCli as J}from"./DockerCli.js";import{createEcrAuthSession as W}from"./ecrCredentialStore.js";import{buildCacheRepositoryName as $,untaggedLifecyclePolicyText as ee,CACHE_REPO_UNTAGGED_RETENTION_DAYS as re}from"./cacheRepository.js";export{n as BAKE_GUARD_EXPOSURE_CLAUSE,s as BUILDX_VERSION_FLOOR,x as BuildxBuildArgsSchema,m as BuildxBuildResultSchema,re as CACHE_REPO_UNTAGGED_RETENTION_DAYS,A as DEFAULT_BUILDER_NAME,U as DEFAULT_BUILD_TIMEOUT_MS,S as DEFAULT_DAEMON_PROBE_TIMEOUT_MS,L as DEFAULT_DOCKER_BIN,O as DEFAULT_INSPECT_TIMEOUT_MS,I as DEFAULT_PULL_TIMEOUT_MS,c as DEFAULT_PUSH_TIMEOUT_MS,a as DOCKER_CLI_BUILDX_LOG_CATEGORY,t as DOCKER_CLI_LOG_CATEGORY,J as DockerCli,B as DockerCliErrorKindSchema,C as DockerCliErrorSchema,T as ENGINE_VERSION_FLOOR,K as PUBLIC_BUILD_ARG_PREFIXES,u as PrerequisiteMissingExitCode,R as SIGTERM_GRACE_MS,D as STDERR_TAIL_LINES,q as abortChildProcess,G as acknowledgedBuildArgKeys,$ as buildCacheRepositoryName,M as buildxArgvBuilder,W as createEcrAuthSession,P as evaluateBakeGuard,F as evaluateResolvedBuildArgValues,i as failure,k as inferPublicBuildArgKeys,p as isDockerCliErrorKind,E as isFailure,h as isPublicBuildVarName,o as isSuccess,j as parseMetadataFile,v as parseRawjsonLine,Y as projectBuildxResult,V as rawjsonToVertexEvent,_ as success,ee as untaggedLifecyclePolicyText};
+import{isSuccess as o,isFailure as E,success as _,failure as i}from"./result.js";import{DOCKER_CLI_LOG_CATEGORY as a,DOCKER_CLI_BUILDX_LOG_CATEGORY as l,BUILDX_VERSION_FLOOR as s,ENGINE_VERSION_FLOOR as u,PrerequisiteMissingExitCode as T,DEFAULT_BUILDER_NAME as A,DEFAULT_DOCKER_BIN as L,SIGTERM_GRACE_MS as R,STDERR_TAIL_LINES as D,DEFAULT_BUILD_TIMEOUT_MS as c,DEFAULT_PUSH_TIMEOUT_MS as U,DEFAULT_PULL_TIMEOUT_MS as d,DEFAULT_INSPECT_TIMEOUT_MS as I,DEFAULT_DAEMON_PROBE_TIMEOUT_MS as O}from"./dockerCliConstants.js";import{BuildxBuildArgsSchema as x,BuildxBuildResultSchema as B,DockerCliErrorKindSchema as m,DockerCliErrorSchema as C,isDockerCliErrorKind as p}from"./dockerCliSchemas.js";import{buildxArgvBuilder as M}from"./buildxArgvBuilder.js";import{evaluateBakeGuard as n,evaluateResolvedBuildArgValues as P,acknowledgedBuildArgKeys as F,createBakeWarningDeduper as G,BAKE_GUARD_EXPOSURE_CLAUSE as g}from"./bakeGuard.js";import{PUBLIC_BUILD_ARG_PREFIXES as h,isPublicBuildVarName as k,inferPublicBuildArgKeys as b}from"./buildArgInference.js";import{parseRawjsonLine as y}from"./rawjsonParser.js";import{rawjsonToVertexEvent as X}from"./rawjsonToVertexEvent.js";import{parseMetadataFile as w}from"./metadataFileParser.js";import{projectBuildxResult as H}from"./projectBuildxResult.js";import{abortChildProcess as W}from"./abortHelpers.js";import{DockerCli as J}from"./DockerCli.js";import{createEcrAuthSession as Z}from"./ecrCredentialStore.js";import{buildCacheRepositoryName as ee,untaggedLifecyclePolicyText as re,CACHE_REPO_UNTAGGED_RETENTION_DAYS as oe}from"./cacheRepository.js";export{g as BAKE_GUARD_EXPOSURE_CLAUSE,s as BUILDX_VERSION_FLOOR,x as BuildxBuildArgsSchema,B as BuildxBuildResultSchema,oe as CACHE_REPO_UNTAGGED_RETENTION_DAYS,A as DEFAULT_BUILDER_NAME,c as DEFAULT_BUILD_TIMEOUT_MS,O as DEFAULT_DAEMON_PROBE_TIMEOUT_MS,L as DEFAULT_DOCKER_BIN,I as DEFAULT_INSPECT_TIMEOUT_MS,d as DEFAULT_PULL_TIMEOUT_MS,U as DEFAULT_PUSH_TIMEOUT_MS,l as DOCKER_CLI_BUILDX_LOG_CATEGORY,a as DOCKER_CLI_LOG_CATEGORY,J as DockerCli,m as DockerCliErrorKindSchema,C as DockerCliErrorSchema,u as ENGINE_VERSION_FLOOR,h as PUBLIC_BUILD_ARG_PREFIXES,T as PrerequisiteMissingExitCode,R as SIGTERM_GRACE_MS,D as STDERR_TAIL_LINES,W as abortChildProcess,F as acknowledgedBuildArgKeys,ee as buildCacheRepositoryName,M as buildxArgvBuilder,G as createBakeWarningDeduper,Z as createEcrAuthSession,n as evaluateBakeGuard,P as evaluateResolvedBuildArgValues,i as failure,b as inferPublicBuildArgKeys,p as isDockerCliErrorKind,E as isFailure,k as isPublicBuildVarName,o as isSuccess,w as parseMetadataFile,y as parseRawjsonLine,H as projectBuildxResult,X as rawjsonToVertexEvent,_ as success,re as untaggedLifecyclePolicyText};

package/dist/index.d.ts

@@ -26,3 +26,6 @@ export { RESERVED_APP_NAMES, type ReservedAppName, RESERVED_APP_NAME_MESSAGE, is
 export { deriveContentHashTag, CONTENT_HASH_TAG_PATTERN } from "./infra/deriveContentHashTag.js";
 export { DEPLOY_MODES, DeployModeSchema, type DeployMode, IMAGE_TAG_PATTERN, ImageTagSchema, type ImageTag, ServiceArtefactSchema, type ServiceArtefact, ServiceArtefactsSchema, type ServiceArtefacts, ARTEFACT_OUTPUT_FIELDS, type ArtefactOutputField, artefactOutputKey } from "./infra/deployArtefacts.js";
 export { MIGRATION_SNAPSHOT_NAME_PREFIX, EXPECTED_SCHEMA_VERSION_ENV, EXPECTED_SCHEMA_VERSION_TOOL_ENV, EXPECTED_CH_SCHEMA_VERSION_ENV, SCHEMA_ADMIN_USER_ENV, SCHEMA_ADMIN_PASSWORD_ENV, PRISMA_MIGRATION_DIR_RE, CLICKHOUSE_MIGRATION_SKIP_RE } from "./migration/constants.js";
+export { PHYSICAL_NAME_FALLBACK_PROPERTIES } from "./cfn/physicalNameProperties.js";
+export { PATTERN_TYPE_VALUES, type PatternType, PATTERN_TYPES, isPatternType, type PatternArtefact, type PatternStackPlacement, type PatternDescriptor, PATTERN_REGISTRY, type OpenNextPatternType, OPENNEXT_PATTERN_TYPES, isOpenNextPatternType, STATIC_SITE_ROUTING_VALUES, type StaticSiteRouting } from "./patterns/patternTypes.js";
+export { DEFAULT_FORMS_FROM_LOCAL_PART, defaultFormsFromAddress, defaultFormsCorsOrigin, isAddressAtDomain } from "./patterns/staticSiteForms.js";

package/dist/index.js

@@ -1 +1 @@
-import{DNS_APEX as o,getDomainExportNames as E}from"./infra/domainExports.js";import{BACKUP_VAULT_NAME as a}from"./infra/backupVault.js";import{APPROVAL_TOKEN_OUTPUT_PREFIX as _,TOKEN_STDERR_PREFIX as A}from"./deploy/approvalTokenOutput.js";import{imageTagParameterName as i}from"./infra/imageTags.js";import{toPascalCase as T,toKebab as N,toValidDatabaseName as m,toScreamingSnake as s,capitalise as O,getSafeZoneName as C,accountConstructKey as c,hasAsciiStableConstructKey as f}from"./naming/caseConversion.js";import{findAccountNameCollision as P}from"./naming/accountNameCollision.js";import{defaultConnectedAccountName as I,suffixedAccountName as M,REGION_SHORT_CODES as u,findTrailingRegionShortCode as x,regionSuffixRejectionMessage as D}from"./naming/connectedAccountName.js";import{normaliseError as l,getErrorMessage as U,hasErrorCode as V,getErrorCode as h,getErrorStack as G,formatErrorString as v}from"./errorUtils.js";import{singleton as F}from"./async/singleton.js";import{DANGEROUS_ENV_VARS as X,filterDangerousEnvVars as b,maskSensitiveOutput as K,parseShellArgs as y,SCOPED_TOKEN_REGEX as W}from"./securityHelpers.js";import{sleep as Y}from"./async/sleep.js";import{mapSettledWithConcurrency as j}from"./async/concurrency.js";import{ACCOUNT_STAGES_WITH_ROOT as Z,STRUCTURAL_ENVIRONMENTS as q,ACCOUNT_STAGES as w,ACCOUNT_STAGE_LABELS as J,isAccountStage as Q,ACCOUNT_TIERS as $,AccountTierSchema as ee,isAccountTier as re,environmentToTier as oe,stageFromWireEnvironment as Ee,accountTier as te,getEnvironmentLabel as ae,ACCOUNT_ROLES as Se}from"./environments.js";import{RESOURCE_CATEGORIES as Ae,categoriseResource as ne,getExpectedDuration as ie,getFriendlyResourceType as Re}from"./resourceCategorisation.js";import{parseGitRemoteUrl as Ne}from"./repo/gitRemoteParser.js";import{abbreviateRegion as se,AWS_REGIONS_METADATA as Oe,DEFAULT_REGION as Ce,getRegionInfo as ce,MAX_SECONDARY_REGIONS as fe,OPT_IN_REGION_CODES as pe,optInRegionWarning as Pe,regions as ge,suggestRegionForTimezone as Ie}from"./infra/regions.js";import{SCOPE_VALUES as ue,MACHINE_ONLY_SCOPES as xe,USER_GRANTABLE_SCOPES as De}from"./infra/tokenScopes.js";import{SECRET_NAME_PATTERN as le,SECRET_NAME_ERROR as Ue,SSM_COMPONENT_PATTERN as Ve,SSM_COMPONENT_ERROR as he,SSM_STANDARD_MAX_VALUE_BYTES as Ge,SecretNamespaceSchema as ve,buildNamespaceParts as Le,buildParameterPath as Fe,parseParameterPath as He,isManageablePath as Xe,parseDotEnv as be,escapeDotEnvValue as Ke}from"./secrets.js";import{ConnectionWireSchema as We,ConnectionsListResponseSchema as Be}from"./infra/connectionsWire.js";import{deriveRegionsFromOrgConfig as ke,deriveTargets as je,deriveAllTargets as ze,environmentOrTier as Ze,findTarget as qe,generateTargetName as we}from"./targets.js";import{buildAppConfigPath as Qe}from"./repo/appPath.js";import{findInfrastructurePaths as er,findBoundaryPath as rr,isInfrastructureFile as or}from"./repo/findInfrastructurePaths.js";import{inferContainerFromCandidates as tr}from"./repo/inferContainerFromCandidates.js";import{RESERVED_APP_NAMES as Sr,RESERVED_APP_NAME_MESSAGE as _r,isReservedAppName as Ar,RESERVED_APP_NAME_SUFFIX as nr,RESERVED_APP_NAME_SUFFIX_MESSAGE as ir,hasReservedAppNameSuffix as Rr}from"./naming/reservedAppNames.js";import{deriveContentHashTag as Nr,CONTENT_HASH_TAG_PATTERN as mr}from"./infra/deriveContentHashTag.js";import{DEPLOY_MODES as Or,DeployModeSchema as Cr,IMAGE_TAG_PATTERN as cr,ImageTagSchema as fr,ServiceArtefactSchema as pr,ServiceArtefactsSchema as Pr,ARTEFACT_OUTPUT_FIELDS as gr,artefactOutputKey as Ir}from"./infra/deployArtefacts.js";import{MIGRATION_SNAPSHOT_NAME_PREFIX as ur,EXPECTED_SCHEMA_VERSION_ENV as xr,EXPECTED_SCHEMA_VERSION_TOOL_ENV as Dr,EXPECTED_CH_SCHEMA_VERSION_ENV as dr,SCHEMA_ADMIN_USER_ENV as lr,SCHEMA_ADMIN_PASSWORD_ENV as Ur,PRISMA_MIGRATION_DIR_RE as Vr,CLICKHOUSE_MIGRATION_SKIP_RE as hr}from"./migration/constants.js";export{Se as ACCOUNT_ROLES,w as ACCOUNT_STAGES,Z as ACCOUNT_STAGES_WITH_ROOT,J as ACCOUNT_STAGE_LABELS,$ as ACCOUNT_TIERS,_ as APPROVAL_TOKEN_OUTPUT_PREFIX,gr as ARTEFACT_OUTPUT_FIELDS,Oe as AWS_REGIONS_METADATA,ee as AccountTierSchema,a as BACKUP_VAULT_NAME,hr as CLICKHOUSE_MIGRATION_SKIP_RE,mr as CONTENT_HASH_TAG_PATTERN,We as ConnectionWireSchema,Be as ConnectionsListResponseSchema,X as DANGEROUS_ENV_VARS,Ce as DEFAULT_REGION,Or as DEPLOY_MODES,o as DNS_APEX,Cr as DeployModeSchema,dr as EXPECTED_CH_SCHEMA_VERSION_ENV,xr as EXPECTED_SCHEMA_VERSION_ENV,Dr as EXPECTED_SCHEMA_VERSION_TOOL_ENV,cr as IMAGE_TAG_PATTERN,fr as ImageTagSchema,xe as MACHINE_ONLY_SCOPES,fe as MAX_SECONDARY_REGIONS,ur as MIGRATION_SNAPSHOT_NAME_PREFIX,pe as OPT_IN_REGION_CODES,Vr as PRISMA_MIGRATION_DIR_RE,u as REGION_SHORT_CODES,Sr as RESERVED_APP_NAMES,_r as RESERVED_APP_NAME_MESSAGE,nr as RESERVED_APP_NAME_SUFFIX,ir as RESERVED_APP_NAME_SUFFIX_MESSAGE,Ae as RESOURCE_CATEGORIES,Ur as SCHEMA_ADMIN_PASSWORD_ENV,lr as SCHEMA_ADMIN_USER_ENV,W as SCOPED_TOKEN_REGEX,ue as SCOPE_VALUES,Ue as SECRET_NAME_ERROR,le as SECRET_NAME_PATTERN,he as SSM_COMPONENT_ERROR,Ve as SSM_COMPONENT_PATTERN,Ge as SSM_STANDARD_MAX_VALUE_BYTES,q as STRUCTURAL_ENVIRONMENTS,ve as SecretNamespaceSchema,pr as ServiceArtefactSchema,Pr as ServiceArtefactsSchema,A as TOKEN_STDERR_PREFIX,De as USER_GRANTABLE_SCOPES,se as abbreviateRegion,c as accountConstructKey,te as accountTier,Ir as artefactOutputKey,Qe as buildAppConfigPath,Le as buildNamespaceParts,Fe as buildParameterPath,O as capitalise,ne as categoriseResource,I as defaultConnectedAccountName,ze as deriveAllTargets,Nr as deriveContentHashTag,ke as deriveRegionsFromOrgConfig,je as deriveTargets,Ze as environmentOrTier,oe as environmentToTier,Ke as escapeDotEnvValue,b as filterDangerousEnvVars,P as findAccountNameCollision,rr as findBoundaryPath,er as findInfrastructurePaths,qe as findTarget,x as findTrailingRegionShortCode,v as formatErrorString,we as generateTargetName,E as getDomainExportNames,ae as getEnvironmentLabel,h as getErrorCode,U as getErrorMessage,G as getErrorStack,ie as getExpectedDuration,Re as getFriendlyResourceType,ce as getRegionInfo,C as getSafeZoneName,f as hasAsciiStableConstructKey,V as hasErrorCode,Rr as hasReservedAppNameSuffix,i as imageTagParameterName,tr as inferContainerFromCandidates,Q as isAccountStage,re as isAccountTier,or as isInfrastructureFile,Xe as isManageablePath,Ar as isReservedAppName,j as mapSettledWithConcurrency,K as maskSensitiveOutput,l as normaliseError,Pe as optInRegionWarning,be as parseDotEnv,Ne as parseGitRemoteUrl,He as parseParameterPath,y as parseShellArgs,D as regionSuffixRejectionMessage,ge as regions,F as singleton,Y as sleep,Ee as stageFromWireEnvironment,M as suffixedAccountName,Ie as suggestRegionForTimezone,N as toKebab,T as toPascalCase,s as toScreamingSnake,m as toValidDatabaseName};
+import{DNS_APEX as E,getDomainExportNames as o}from"./infra/domainExports.js";import{BACKUP_VAULT_NAME as _}from"./infra/backupVault.js";import{APPROVAL_TOKEN_OUTPUT_PREFIX as S,TOKEN_STDERR_PREFIX as A}from"./deploy/approvalTokenOutput.js";import{imageTagParameterName as n}from"./infra/imageTags.js";import{toPascalCase as i,toKebab as N,toValidDatabaseName as m,toScreamingSnake as s,capitalise as O,getSafeZoneName as P,accountConstructKey as C,hasAsciiStableConstructKey as p}from"./naming/caseConversion.js";import{findAccountNameCollision as c}from"./naming/accountNameCollision.js";import{defaultConnectedAccountName as I,suffixedAccountName as M,REGION_SHORT_CODES as x,findTrailingRegionShortCode as u,regionSuffixRejectionMessage as d}from"./naming/connectedAccountName.js";import{normaliseError as l,getErrorMessage as U,hasErrorCode as L,getErrorCode as V,getErrorStack as F,formatErrorString as G}from"./errorUtils.js";import{singleton as v}from"./async/singleton.js";import{DANGEROUS_ENV_VARS as X,filterDangerousEnvVars as b,maskSensitiveOutput as K,parseShellArgs as y,SCOPED_TOKEN_REGEX as Y}from"./securityHelpers.js";import{sleep as B}from"./async/sleep.js";import{mapSettledWithConcurrency as j}from"./async/concurrency.js";import{ACCOUNT_STAGES_WITH_ROOT as Z,STRUCTURAL_ENVIRONMENTS as q,ACCOUNT_STAGES as w,ACCOUNT_STAGE_LABELS as J,isAccountStage as Q,ACCOUNT_TIERS as $,AccountTierSchema as ee,isAccountTier as re,environmentToTier as Ee,stageFromWireEnvironment as oe,accountTier as te,getEnvironmentLabel as _e,ACCOUNT_ROLES as ae}from"./environments.js";import{RESOURCE_CATEGORIES as Ae,categoriseResource as Te,getExpectedDuration as ne,getFriendlyResourceType as Re}from"./resourceCategorisation.js";import{parseGitRemoteUrl as Ne}from"./repo/gitRemoteParser.js";import{abbreviateRegion as se,AWS_REGIONS_METADATA as Oe,DEFAULT_REGION as Pe,getRegionInfo as Ce,MAX_SECONDARY_REGIONS as pe,OPT_IN_REGION_CODES as fe,optInRegionWarning as ce,regions as ge,suggestRegionForTimezone as Ie}from"./infra/regions.js";import{SCOPE_VALUES as xe,MACHINE_ONLY_SCOPES as ue,USER_GRANTABLE_SCOPES as de}from"./infra/tokenScopes.js";import{SECRET_NAME_PATTERN as le,SECRET_NAME_ERROR as Ue,SSM_COMPONENT_PATTERN as Le,SSM_COMPONENT_ERROR as Ve,SSM_STANDARD_MAX_VALUE_BYTES as Fe,SecretNamespaceSchema as Ge,buildNamespaceParts as he,buildParameterPath as ve,parseParameterPath as He,isManageablePath as Xe,parseDotEnv as be,escapeDotEnvValue as Ke}from"./secrets.js";import{ConnectionWireSchema as Ye,ConnectionsListResponseSchema as We}from"./infra/connectionsWire.js";import{deriveRegionsFromOrgConfig as ke,deriveTargets as je,deriveAllTargets as ze,environmentOrTier as Ze,findTarget as qe,generateTargetName as we}from"./targets.js";import{buildAppConfigPath as Qe}from"./repo/appPath.js";import{findInfrastructurePaths as er,findBoundaryPath as rr,isInfrastructureFile as Er}from"./repo/findInfrastructurePaths.js";import{inferContainerFromCandidates as tr}from"./repo/inferContainerFromCandidates.js";import{RESERVED_APP_NAMES as ar,RESERVED_APP_NAME_MESSAGE as Sr,isReservedAppName as Ar,RESERVED_APP_NAME_SUFFIX as Tr,RESERVED_APP_NAME_SUFFIX_MESSAGE as nr,hasReservedAppNameSuffix as Rr}from"./naming/reservedAppNames.js";import{deriveContentHashTag as Nr,CONTENT_HASH_TAG_PATTERN as mr}from"./infra/deriveContentHashTag.js";import{DEPLOY_MODES as Or,DeployModeSchema as Pr,IMAGE_TAG_PATTERN as Cr,ImageTagSchema as pr,ServiceArtefactSchema as fr,ServiceArtefactsSchema as cr,ARTEFACT_OUTPUT_FIELDS as gr,artefactOutputKey as Ir}from"./infra/deployArtefacts.js";import{MIGRATION_SNAPSHOT_NAME_PREFIX as xr,EXPECTED_SCHEMA_VERSION_ENV as ur,EXPECTED_SCHEMA_VERSION_TOOL_ENV as dr,EXPECTED_CH_SCHEMA_VERSION_ENV as Dr,SCHEMA_ADMIN_USER_ENV as lr,SCHEMA_ADMIN_PASSWORD_ENV as Ur,PRISMA_MIGRATION_DIR_RE as Lr,CLICKHOUSE_MIGRATION_SKIP_RE as Vr}from"./migration/constants.js";import{PHYSICAL_NAME_FALLBACK_PROPERTIES as Gr}from"./cfn/physicalNameProperties.js";import{PATTERN_TYPE_VALUES as vr,PATTERN_TYPES as Hr,isPatternType as Xr,PATTERN_REGISTRY as br,OPENNEXT_PATTERN_TYPES as Kr,isOpenNextPatternType as yr,STATIC_SITE_ROUTING_VALUES as Yr}from"./patterns/patternTypes.js";import{DEFAULT_FORMS_FROM_LOCAL_PART as Br,defaultFormsFromAddress as kr,defaultFormsCorsOrigin as jr,isAddressAtDomain as zr}from"./patterns/staticSiteForms.js";export{ae as ACCOUNT_ROLES,w as ACCOUNT_STAGES,Z as ACCOUNT_STAGES_WITH_ROOT,J as ACCOUNT_STAGE_LABELS,$ as ACCOUNT_TIERS,S as APPROVAL_TOKEN_OUTPUT_PREFIX,gr as ARTEFACT_OUTPUT_FIELDS,Oe as AWS_REGIONS_METADATA,ee as AccountTierSchema,_ as BACKUP_VAULT_NAME,Vr as CLICKHOUSE_MIGRATION_SKIP_RE,mr as CONTENT_HASH_TAG_PATTERN,Ye as ConnectionWireSchema,We as ConnectionsListResponseSchema,X as DANGEROUS_ENV_VARS,Br as DEFAULT_FORMS_FROM_LOCAL_PART,Pe as DEFAULT_REGION,Or as DEPLOY_MODES,E as DNS_APEX,Pr as DeployModeSchema,Dr as EXPECTED_CH_SCHEMA_VERSION_ENV,ur as EXPECTED_SCHEMA_VERSION_ENV,dr as EXPECTED_SCHEMA_VERSION_TOOL_ENV,Cr as IMAGE_TAG_PATTERN,pr as ImageTagSchema,ue as MACHINE_ONLY_SCOPES,pe as MAX_SECONDARY_REGIONS,xr as MIGRATION_SNAPSHOT_NAME_PREFIX,Kr as OPENNEXT_PATTERN_TYPES,fe as OPT_IN_REGION_CODES,br as PATTERN_REGISTRY,Hr as PATTERN_TYPES,vr as PATTERN_TYPE_VALUES,Gr as PHYSICAL_NAME_FALLBACK_PROPERTIES,Lr as PRISMA_MIGRATION_DIR_RE,x as REGION_SHORT_CODES,ar as RESERVED_APP_NAMES,Sr as RESERVED_APP_NAME_MESSAGE,Tr as RESERVED_APP_NAME_SUFFIX,nr as RESERVED_APP_NAME_SUFFIX_MESSAGE,Ae as RESOURCE_CATEGORIES,Ur as SCHEMA_ADMIN_PASSWORD_ENV,lr as SCHEMA_ADMIN_USER_ENV,Y as SCOPED_TOKEN_REGEX,xe as SCOPE_VALUES,Ue as SECRET_NAME_ERROR,le as SECRET_NAME_PATTERN,Ve as SSM_COMPONENT_ERROR,Le as SSM_COMPONENT_PATTERN,Fe as SSM_STANDARD_MAX_VALUE_BYTES,Yr as STATIC_SITE_ROUTING_VALUES,q as STRUCTURAL_ENVIRONMENTS,Ge as SecretNamespaceSchema,fr as ServiceArtefactSchema,cr as ServiceArtefactsSchema,A as TOKEN_STDERR_PREFIX,de as USER_GRANTABLE_SCOPES,se as abbreviateRegion,C as accountConstructKey,te as accountTier,Ir as artefactOutputKey,Qe as buildAppConfigPath,he as buildNamespaceParts,ve as buildParameterPath,O as capitalise,Te as categoriseResource,I as defaultConnectedAccountName,jr as defaultFormsCorsOrigin,kr as defaultFormsFromAddress,ze as deriveAllTargets,Nr as deriveContentHashTag,ke as deriveRegionsFromOrgConfig,je as deriveTargets,Ze as environmentOrTier,Ee as environmentToTier,Ke as escapeDotEnvValue,b as filterDangerousEnvVars,c as findAccountNameCollision,rr as findBoundaryPath,er as findInfrastructurePaths,qe as findTarget,u as findTrailingRegionShortCode,G as formatErrorString,we as generateTargetName,o as getDomainExportNames,_e as getEnvironmentLabel,V as getErrorCode,U as getErrorMessage,F as getErrorStack,ne as getExpectedDuration,Re as getFriendlyResourceType,Ce as getRegionInfo,P as getSafeZoneName,p as hasAsciiStableConstructKey,L as hasErrorCode,Rr as hasReservedAppNameSuffix,n as imageTagParameterName,tr as inferContainerFromCandidates,Q as isAccountStage,re as isAccountTier,zr as isAddressAtDomain,Er as isInfrastructureFile,Xe as isManageablePath,yr as isOpenNextPatternType,Xr as isPatternType,Ar as isReservedAppName,j as mapSettledWithConcurrency,K as maskSensitiveOutput,l as normaliseError,ce as optInRegionWarning,be as parseDotEnv,Ne as parseGitRemoteUrl,He as parseParameterPath,y as parseShellArgs,d as regionSuffixRejectionMessage,ge as regions,v as singleton,B as sleep,oe as stageFromWireEnvironment,M as suffixedAccountName,Ie as suggestRegionForTimezone,N as toKebab,i as toPascalCase,s as toScreamingSnake,m as toValidDatabaseName};

package/dist/manifest/schemas.d.ts

@@ -213,6 +213,8 @@ export type ManifestService = z.infer<typeof ManifestServiceSchema>;
 declare const ManifestPatternSchema: z.ZodObject<{
     type: z.ZodEnum<{
         payload: "payload";
+        nextjs: "nextjs";
+        staticsite: "staticsite";
     }>;
     name: z.ZodString;
     source: z.ZodString;
@@ -296,6 +298,8 @@ export declare const FjallManifestSchema: z.ZodObject<{
     pattern: z.ZodOptional<z.ZodObject<{
         type: z.ZodEnum<{
             payload: "payload";
+            nextjs: "nextjs";
+            staticsite: "staticsite";
         }>;
         name: z.ZodString;
         source: z.ZodString;

package/dist/manifest/schemas.js

@@ -1 +1 @@
-import{z as e}from"zod";const h="fjall-manifest.json",u=1,b=/^[A-Za-z0-9_.-]+$/,f=e.object({id:e.string().min(1,"buildSecret id cannot be empty").regex(b,"buildSecret id may contain only letters, digits, '_', '.', and '-' (no comma, '=', or whitespace, which would break the buildx --secret argv)"),ssm:e.string().min(1,"ssm parameter name cannot be empty").optional(),secretsManager:e.object({name:e.string().min(1,"secret name cannot be empty").optional(),arn:e.string().min(1,"secret arn cannot be empty").optional(),field:e.string().min(1,"secret field cannot be empty").optional()}).strict().refine(t=>t.name===void 0!=(t.arn===void 0),"secretsManager requires exactly one of name or arn").optional(),env:e.string().min(1,"env variable name cannot be empty").optional()}).strict().superRefine((t,n)=>{[t.ssm,t.secretsManager,t.env].filter(r=>r!==void 0).length!==1&&n.addIssue({code:e.ZodIssueCode.custom,message:"buildSecret requires exactly one source (ssm, secretsManager, or env)"})}),y=e.union([e.string(),e.object({ssm:e.string().min(1,"ssm parameter name cannot be empty").optional(),secretsManager:e.object({name:e.string().min(1,"secret name cannot be empty").optional(),arn:e.string().min(1,"secret arn cannot be empty").optional(),field:e.string().min(1,"secret field cannot be empty").optional()}).strict().refine(t=>t.name===void 0!=(t.arn===void 0),"secretsManager requires exactly one of name or arn").optional(),env:e.string().min(1,"env variable name cannot be empty").optional(),acknowledgePublic:e.boolean().optional()}).strict().superRefine((t,n)=>{[t.ssm,t.secretsManager,t.env].filter(r=>r!==void 0).length!==1&&n.addIssue({code:e.ZodIssueCode.custom,message:"buildArg value requires exactly one source (ssm, secretsManager, or env)"})})]),i=e.object({path:e.string(),context:e.string().min(1,"context cannot be empty").optional(),target:e.string().min(1,"target cannot be empty").optional(),buildArgs:e.record(e.string(),y).optional(),buildSecrets:e.array(f).optional()}).strict(),x=i.partial();function M(t,n){if(n===void 0)return t;const a=n.context??t.context,r=n.target??t.target,s=n.buildArgs??t.buildArgs,o=n.buildSecrets??t.buildSecrets;return{path:n.path??t.path,...a!==void 0&&{context:a},...r!==void 0&&{target:r},...s!==void 0&&{buildArgs:s},...o!==void 0&&{buildSecrets:o}}}const c=e.object({name:e.string(),clusterName:e.string().optional(),docker:i.optional(),containerPort:e.number().optional(),secrets:e.array(e.string()).optional(),ssmSecretsPath:e.string().optional(),importedSecretNames:e.array(e.string()).optional()}).strict(),m=e.object({type:e.enum(["payload"]),name:e.string(),source:e.string()}).strict(),l=e.object({repositoryName:e.string()}).strict(),p=e.object({name:e.string(),secrets:e.array(e.string()).optional(),ssmSecretsPath:e.string().optional(),importedSecretNames:e.array(e.string()).optional()}).strict(),d=e.object({templateHash:e.string(),synthTimestamp:e.string()}).strict(),g=e.object({constructPath:e.string().max(512),group:e.string().max(128),resourceType:e.string().max(256)}).strict(),j=e.object({version:e.literal(u),generatedAt:e.string(),appName:e.string(),services:e.array(c),lambdas:e.array(p),pattern:m.optional(),ecr:l.optional(),stacks:e.record(e.string(),d),resourceMap:e.record(e.string(),g).optional()}).strict();export{b as BUILDKIT_SECRET_ID_PATTERN,y as DockerBuildArgValueSchema,x as DockerBuildPartialSchema,i as DockerBuildSchema,f as DockerBuildSecretRefSchema,h as FJALL_MANIFEST_FILENAME,j as FjallManifestSchema,u as MANIFEST_SCHEMA_VERSION,l as ManifestEcrSchema,p as ManifestLambdaSchema,m as ManifestPatternSchema,c as ManifestServiceSchema,d as ManifestStackHashSchema,g as ResourceMapEntrySchema,M as mergeDockerBuild};
+import{z as e}from"zod";import{PATTERN_TYPE_VALUES as u}from"../patterns/patternTypes.js";const M="fjall-manifest.json",b=1,f=/^[A-Za-z0-9_.-]+$/,S=e.object({id:e.string().min(1,"buildSecret id cannot be empty").regex(f,"buildSecret id may contain only letters, digits, '_', '.', and '-' (no comma, '=', or whitespace, which would break the buildx --secret argv)"),ssm:e.string().min(1,"ssm parameter name cannot be empty").optional(),secretsManager:e.object({name:e.string().min(1,"secret name cannot be empty").optional(),arn:e.string().min(1,"secret arn cannot be empty").optional(),field:e.string().min(1,"secret field cannot be empty").optional()}).strict().refine(t=>t.name===void 0!=(t.arn===void 0),"secretsManager requires exactly one of name or arn").optional(),env:e.string().min(1,"env variable name cannot be empty").optional()}).strict().superRefine((t,n)=>{[t.ssm,t.secretsManager,t.env].filter(r=>r!==void 0).length!==1&&n.addIssue({code:e.ZodIssueCode.custom,message:"buildSecret requires exactly one source (ssm, secretsManager, or env)"})}),y=e.union([e.string(),e.object({ssm:e.string().min(1,"ssm parameter name cannot be empty").optional(),secretsManager:e.object({name:e.string().min(1,"secret name cannot be empty").optional(),arn:e.string().min(1,"secret arn cannot be empty").optional(),field:e.string().min(1,"secret field cannot be empty").optional()}).strict().refine(t=>t.name===void 0!=(t.arn===void 0),"secretsManager requires exactly one of name or arn").optional(),env:e.string().min(1,"env variable name cannot be empty").optional(),acknowledgePublic:e.boolean().optional()}).strict().superRefine((t,n)=>{[t.ssm,t.secretsManager,t.env].filter(r=>r!==void 0).length!==1&&n.addIssue({code:e.ZodIssueCode.custom,message:"buildArg value requires exactly one source (ssm, secretsManager, or env)"})})]),i=e.object({path:e.string(),context:e.string().min(1,"context cannot be empty").optional(),target:e.string().min(1,"target cannot be empty").optional(),buildArgs:e.record(e.string(),y).optional(),buildSecrets:e.array(S).optional()}).strict(),A=i.partial();function j(t,n){if(n===void 0)return t;const a=n.context??t.context,r=n.target??t.target,o=n.buildArgs??t.buildArgs,s=n.buildSecrets??t.buildSecrets;return{path:n.path??t.path,...a!==void 0&&{context:a},...r!==void 0&&{target:r},...o!==void 0&&{buildArgs:o},...s!==void 0&&{buildSecrets:s}}}const c=e.object({name:e.string(),clusterName:e.string().optional(),docker:i.optional(),containerPort:e.number().optional(),secrets:e.array(e.string()).optional(),ssmSecretsPath:e.string().optional(),importedSecretNames:e.array(e.string()).optional()}).strict(),m=e.object({type:e.enum(u),name:e.string(),source:e.string()}).strict(),l=e.object({repositoryName:e.string()}).strict(),p=e.object({name:e.string(),secrets:e.array(e.string()).optional(),ssmSecretsPath:e.string().optional(),importedSecretNames:e.array(e.string()).optional()}).strict(),d=e.object({templateHash:e.string(),synthTimestamp:e.string()}).strict(),g=e.object({constructPath:e.string().max(512),group:e.string().max(128),resourceType:e.string().max(256)}).strict(),E=e.object({version:e.literal(b),generatedAt:e.string(),appName:e.string(),services:e.array(c),lambdas:e.array(p),pattern:m.optional(),ecr:l.optional(),stacks:e.record(e.string(),d),resourceMap:e.record(e.string(),g).optional()}).strict();export{f as BUILDKIT_SECRET_ID_PATTERN,y as DockerBuildArgValueSchema,A as DockerBuildPartialSchema,i as DockerBuildSchema,S as DockerBuildSecretRefSchema,M as FJALL_MANIFEST_FILENAME,E as FjallManifestSchema,b as MANIFEST_SCHEMA_VERSION,l as ManifestEcrSchema,p as ManifestLambdaSchema,m as ManifestPatternSchema,c as ManifestServiceSchema,d as ManifestStackHashSchema,g as ResourceMapEntrySchema,j as mergeDockerBuild};

package/dist/migration/compareSchemaVersion.d.ts

@@ -0,0 +1,50 @@
+/**
+ * Boot-gate version comparison with expand-only rollback tolerance.
+ *
+ * The schema-version gates (`verifyExpectedSchemaVersion` for Postgres,
+ * `verifyExpectedClickHouseSchemaVersion` for ClickHouse) both decide whether a
+ * booting image's EXPECTED schema version is SATISFIED by what the database has
+ * APPLIED. Both route their `matches` verdict through here so the two gates can
+ * never drift (Code Quality § "Coupled values: shared source at 2 occurrences").
+ *
+ * The tolerance exists because expand/contract migrations make an old image safe
+ * against a newer schema: rolling the image back without rolling the DB back is
+ * the intended expand-only rollback, and a strict-equality gate defeated it by
+ * refusing to boot. See `aiDocs/patterns/migration-safety-pattern.md`.
+ */
+/**
+ * True when `version` is a monotonically-ordered migration identifier whose
+ * lexicographic order equals its chronological/sequence order — a Prisma
+ * migration name (`20260706120000_add_users`, fixed-width timestamp) or a
+ * ClickHouse migration filename (`011-issue-brief-citations.sql`, zero-padded
+ * numeric prefix). Both are selected as "latest" by `.sort()` at synth time
+ * (`pickLatest*Migration`) and apply time (the runner), so lexicographic
+ * comparison here mirrors that selection exactly.
+ *
+ * Returns false for the non-orderable audit fields — `_schema_migrations.version`
+ * (sha256 content hash) and `prisma_version` (the constant marker `"applied"`) —
+ * so the caller fails closed on exact identity for those.
+ */
+export declare function isOrderableSchemaVersion(version: string): boolean;
+/**
+ * Whether the `expected` schema version baked into the image is satisfied by the
+ * `actual` version applied to the database.
+ *
+ * When BOTH are orderable migration identifiers, the DB may sit AT or AHEAD of
+ * the image's expectation — an old image booting against a newer expand-only
+ * schema is safe, so `actual >= expected` passes. The forward direction
+ * (`actual < expected`, new code against an older schema) still fails: the
+ * columns/tables the image needs may not exist yet.
+ *
+ * When EITHER is non-orderable (content hash, constant marker), there is no
+ * defined newer/older, so it falls back to strict identity — fail-closed,
+ * byte-identical to the pre-tolerance behaviour.
+ *
+ * The `>=` is lexicographic, which equals sequence order only when both
+ * versions share an equal-width numeric prefix (Prisma's fixed 14-digit
+ * timestamp always does; a ClickHouse `NNN-…` filename only if authored
+ * zero-padded). If the widths differ — or a `.sql` name carries no numeric
+ * prefix at all — lexicographic order cannot be trusted, so it also falls back
+ * to strict identity (fail-closed) rather than return a possibly-inverted `>=`.
+ */
+export declare function isSchemaVersionSatisfied(expected: string, actual: string): boolean;

package/dist/migration/compareSchemaVersion.js

@@ -0,0 +1 @@
+import{PRISMA_MIGRATION_DIR_RE as u,CLICKHOUSE_MIGRATION_FILE_RE as s}from"./constants.js";function e(n){return u.test(n)||s.test(n)}function o(n){const r=/^(\d+)/.exec(n);return r===null?null:r[1].length}function I(n,r){if(e(n)&&e(r)){const t=o(n),i=o(r);return t!==null&&i!==null&&t===i?r>=n:r===n}return r===n}export{e as isOrderableSchemaVersion,I as isSchemaVersionSatisfied};

package/dist/migration/compareSchemaVersion.test.d.ts

@@ -0,0 +1 @@
+export {};

package/dist/migration/compareSchemaVersion.test.js

@@ -0,0 +1 @@
+import{describe as i,expect as e,it as s}from"vitest";import{isOrderableSchemaVersion as t,isSchemaVersionSatisfied as a}from"./compareSchemaVersion.js";i("isOrderableSchemaVersion",()=>{s("recognises a Prisma migration name",()=>{e(t("20260706120000_add_log_events")).toBe(!0)}),s("recognises a ClickHouse migration filename",()=>{e(t("011-issue-brief-citations.sql")).toBe(!0)}),s("rejects a sha256 content hash (the audit `version` field)",()=>{e(t("3f2b1c9d8e7a6f5b4c3d2e1f0a9b8c7d6e5f4a3b2c1d0e9f8a7b6c5d4e3f2a1b")).toBe(!1)}),s("rejects the constant `prisma_version` marker",()=>{e(t("applied")).toBe(!1)}),s("rejects a digit-leading string with no migration shape",()=>{e(t("19bc2fdeadbeef")).toBe(!1)})}),i("isSchemaVersionSatisfied",()=>{i("orderable versions (expand-only tolerance)",()=>{s("passes when actual equals expected (Prisma)",()=>{e(a("20260520000000_add_widgets","20260520000000_add_widgets")).toBe(!0)}),s("passes when actual is AHEAD of expected (Prisma rollback)",()=>{e(a("20260520000000_add_widgets","20260521000000_more")).toBe(!0)}),s("fails when actual TRAILS expected (Prisma \u2014 new code, old schema)",()=>{e(a("20260520000000_add_widgets","20260519000000_old")).toBe(!1)}),s("passes when actual is AHEAD of expected (ClickHouse rollback)",()=>{e(a("010-issue-briefs.sql","011-citations.sql")).toBe(!0)}),s("fails when actual TRAILS expected (ClickHouse)",()=>{e(a("010-issue-briefs.sql","009-old.sql")).toBe(!1)}),s("respects zero-padded numeric ordering, not naive digit count",()=>{e(a("010-a.sql","002-b.sql")).toBe(!1),e(a("002-b.sql","010-a.sql")).toBe(!0)})}),i("mismatched-width prefixes (fail-closed, no lexicographic trust)",()=>{s("refuses `>=` when CH numeric-prefix widths differ",()=>{e(a("010-x.sql","9-hotfix.sql")).toBe(!1),e(a("9-hotfix.sql","010-x.sql")).toBe(!1)}),s("still passes on exact identity even at a mismatched-width name",()=>{e(a("9-hotfix.sql","9-hotfix.sql")).toBe(!0)}),s("fails closed for a `.sql` name with no numeric prefix",()=>{e(a("010-x.sql","hotfix.sql")).toBe(!1),e(a("hotfix.sql","hotfix.sql")).toBe(!0)})}),i("non-orderable versions (fail-closed strict identity)",()=>{s("passes only on exact hash identity",()=>{const o="3f2b1c9d8e7a6f5b4c3d2e1f0a9b8c7d6e5f4a3b2c1d0e9f8a7b6c5d4e3f2a1b";e(a(o,o)).toBe(!0)}),s("fails for a different hash even when it sorts later",()=>{e(a("00000000","ffffffff")).toBe(!1)}),s("fails when only one side is orderable",()=>{e(a("20260520000000_add_widgets","applied")).toBe(!1),e(a("applied","20260521000000_more")).toBe(!1)})})});

package/dist/migration/constants.d.ts

@@ -59,3 +59,12 @@ export declare const PRISMA_MIGRATION_DIR_RE: RegExp;
  * record, hard-failing every boot.
  */
 export declare const CLICKHOUSE_MIGRATION_SKIP_RE: RegExp;
+/**
+ * A ClickHouse migration filename — the `.sql` suffix by which
+ * `pickLatestClickHouseMigration` / `runSqlMigrations` select the "latest"
+ * migration (both `.endsWith(".sql")` then `.sort()`). The boot gate's
+ * order-tolerant comparison uses it to tell a monotonically-ordered CH version
+ * (`ch_version` = the latest `.sql` filename) from the non-orderable audit
+ * fields (`version` = sha256 hash, `prisma_version` = the constant `"applied"`).
+ */
+export declare const CLICKHOUSE_MIGRATION_FILE_RE: RegExp;

package/dist/migration/constants.js

@@ -1 +1 @@
-const E="fjall-premigrate",_="EXPECTED_SCHEMA_VERSION",S="EXPECTED_SCHEMA_VERSION_TOOL",A="EXPECTED_CH_SCHEMA_VERSION",I="SCHEMA_ADMIN_USER",C="SCHEMA_ADMIN_PASSWORD",N=/^\d{14}_/,M=/\.dev\.sql$/;export{M as CLICKHOUSE_MIGRATION_SKIP_RE,A as EXPECTED_CH_SCHEMA_VERSION_ENV,_ as EXPECTED_SCHEMA_VERSION_ENV,S as EXPECTED_SCHEMA_VERSION_TOOL_ENV,E as MIGRATION_SNAPSHOT_NAME_PREFIX,N as PRISMA_MIGRATION_DIR_RE,C as SCHEMA_ADMIN_PASSWORD_ENV,I as SCHEMA_ADMIN_USER_ENV};
+const E="fjall-premigrate",_="EXPECTED_SCHEMA_VERSION",S="EXPECTED_SCHEMA_VERSION_TOOL",I="EXPECTED_CH_SCHEMA_VERSION",A="SCHEMA_ADMIN_USER",C="SCHEMA_ADMIN_PASSWORD",N=/^\d{14}_/,M=/\.dev\.sql$/,R=/\.sql$/;export{R as CLICKHOUSE_MIGRATION_FILE_RE,M as CLICKHOUSE_MIGRATION_SKIP_RE,I as EXPECTED_CH_SCHEMA_VERSION_ENV,_ as EXPECTED_SCHEMA_VERSION_ENV,S as EXPECTED_SCHEMA_VERSION_TOOL_ENV,E as MIGRATION_SNAPSHOT_NAME_PREFIX,N as PRISMA_MIGRATION_DIR_RE,C as SCHEMA_ADMIN_PASSWORD_ENV,A as SCHEMA_ADMIN_USER_ENV};

package/dist/migration/index.d.ts

@@ -1,5 +1,6 @@
 export { MIGRATION_SNAPSHOT_NAME_PREFIX, EXPECTED_SCHEMA_VERSION_ENV, EXPECTED_SCHEMA_VERSION_TOOL_ENV, EXPECTED_CH_SCHEMA_VERSION_ENV, SCHEMA_ADMIN_USER_ENV, SCHEMA_ADMIN_PASSWORD_ENV, PRISMA_MIGRATION_DIR_RE, CLICKHOUSE_MIGRATION_SKIP_RE } from "./constants.js";
 export { pickLatestPrismaMigration } from "./pickLatestPrismaMigration.js";
 export { pickLatestClickHouseMigration } from "./pickLatestClickHouseMigration.js";
+export { isOrderableSchemaVersion, isSchemaVersionSatisfied } from "./compareSchemaVersion.js";
 export { type MigrationsSqlClient, type VerifyExpectedSchemaVersionOpts, type VerifyExpectedSchemaVersionResult, verifyExpectedSchemaVersion } from "./verifyExpectedSchemaVersion.js";
 export { CLICKHOUSE_MANAGED_USERS_ENV, MANAGED_USER_NAME_PATTERN, userPasswordEnvName, ManagedUserNameSchema, ManagedUserNamesSchema, type ManagedUserName, type ManagedUserNames } from "./clickhouseSqlUsers.js";

package/dist/migration/index.js

@@ -1 +1 @@
-import{MIGRATION_SNAPSHOT_NAME_PREFIX as e,EXPECTED_SCHEMA_VERSION_ENV as N,EXPECTED_SCHEMA_VERSION_TOOL_ENV as S,EXPECTED_CH_SCHEMA_VERSION_ENV as A,SCHEMA_ADMIN_USER_ENV as r,SCHEMA_ADMIN_PASSWORD_ENV as M,PRISMA_MIGRATION_DIR_RE as I,CLICKHOUSE_MIGRATION_SKIP_RE as a}from"./constants.js";import{pickLatestPrismaMigration as o}from"./pickLatestPrismaMigration.js";import{pickLatestClickHouseMigration as m}from"./pickLatestClickHouseMigration.js";import{verifyExpectedSchemaVersion as O}from"./verifyExpectedSchemaVersion.js";import{CLICKHOUSE_MANAGED_USERS_ENV as P,MANAGED_USER_NAME_PATTERN as i,userPasswordEnvName as H,ManagedUserNameSchema as T,ManagedUserNamesSchema as V}from"./clickhouseSqlUsers.js";export{P as CLICKHOUSE_MANAGED_USERS_ENV,a as CLICKHOUSE_MIGRATION_SKIP_RE,A as EXPECTED_CH_SCHEMA_VERSION_ENV,N as EXPECTED_SCHEMA_VERSION_ENV,S as EXPECTED_SCHEMA_VERSION_TOOL_ENV,i as MANAGED_USER_NAME_PATTERN,e as MIGRATION_SNAPSHOT_NAME_PREFIX,T as ManagedUserNameSchema,V as ManagedUserNamesSchema,I as PRISMA_MIGRATION_DIR_RE,M as SCHEMA_ADMIN_PASSWORD_ENV,r as SCHEMA_ADMIN_USER_ENV,m as pickLatestClickHouseMigration,o as pickLatestPrismaMigration,H as userPasswordEnvName,O as verifyExpectedSchemaVersion};
+import{MIGRATION_SNAPSHOT_NAME_PREFIX as e,EXPECTED_SCHEMA_VERSION_ENV as S,EXPECTED_SCHEMA_VERSION_TOOL_ENV as r,EXPECTED_CH_SCHEMA_VERSION_ENV as N,SCHEMA_ADMIN_USER_ENV as a,SCHEMA_ADMIN_PASSWORD_ENV as A,PRISMA_MIGRATION_DIR_RE as o,CLICKHOUSE_MIGRATION_SKIP_RE as M}from"./constants.js";import{pickLatestPrismaMigration as i}from"./pickLatestPrismaMigration.js";import{pickLatestClickHouseMigration as R}from"./pickLatestClickHouseMigration.js";import{isOrderableSchemaVersion as t,isSchemaVersionSatisfied as C}from"./compareSchemaVersion.js";import{verifyExpectedSchemaVersion as V}from"./verifyExpectedSchemaVersion.js";import{CLICKHOUSE_MANAGED_USERS_ENV as H,MANAGED_USER_NAME_PATTERN as T,userPasswordEnvName as c,ManagedUserNameSchema as p,ManagedUserNamesSchema as D}from"./clickhouseSqlUsers.js";export{H as CLICKHOUSE_MANAGED_USERS_ENV,M as CLICKHOUSE_MIGRATION_SKIP_RE,N as EXPECTED_CH_SCHEMA_VERSION_ENV,S as EXPECTED_SCHEMA_VERSION_ENV,r as EXPECTED_SCHEMA_VERSION_TOOL_ENV,T as MANAGED_USER_NAME_PATTERN,e as MIGRATION_SNAPSHOT_NAME_PREFIX,p as ManagedUserNameSchema,D as ManagedUserNamesSchema,o as PRISMA_MIGRATION_DIR_RE,A as SCHEMA_ADMIN_PASSWORD_ENV,a as SCHEMA_ADMIN_USER_ENV,t as isOrderableSchemaVersion,C as isSchemaVersionSatisfied,R as pickLatestClickHouseMigration,i as pickLatestPrismaMigration,c as userPasswordEnvName,V as verifyExpectedSchemaVersion};

package/dist/migration/verifyExpectedSchemaVersion.d.ts

@@ -20,6 +20,11 @@
  * Returns `{ matches, expected, actual }` rather than throwing on mismatch:
  * the boot gate's caller owns the exit-code / log shape so the helper can
  * be reused by integration tests, dashboards, and CLI checks alike.
+ *
+ * `matches` tolerates expand-only rollback: an old image booting against a
+ * NEWER applied schema passes (`actual >= expected`), while the forward
+ * direction (new code against an older schema) still fails. The comparison is
+ * delegated to `isSchemaVersionSatisfied` — see it for the orderability rules.
  */
 /**
  * Minimal SQL-driver shim. Compatible with `pg.Client.query`, `mysql2.query`,

package/dist/migration/verifyExpectedSchemaVersion.js

@@ -1 +1 @@
-const c="SELECT migration_name FROM _prisma_migrations WHERE finished_at IS NOT NULL ORDER BY finished_at DESC LIMIT 1",s="migration_name";async function a(e){if(e.signal?.aborted)throw new Error("verifyExpectedSchemaVersion: aborted by signal before query");let r,n;if(e.tool==="prisma")r=c,n=s;else if(e.tool==="custom"){if(e.customQuery===void 0)throw new Error('verifyExpectedSchemaVersion: tool="custom" requires customQuery');r=e.customQuery.sql,n=e.customQuery.column}else throw new Error(`verifyExpectedSchemaVersion: unknown tool ${String(e.tool)}`);const t=(await e.client.query(r)).rows[0],o=t!==void 0?t[n]:void 0,i=typeof o=="string"?o:null;return{matches:i===e.expected,expected:e.expected,actual:i}}export{a as verifyExpectedSchemaVersion};
+import{isSchemaVersionSatisfied as c}from"./compareSchemaVersion.js";const s="SELECT migration_name FROM _prisma_migrations WHERE finished_at IS NOT NULL ORDER BY finished_at DESC LIMIT 1",a="migration_name";async function m(e){if(e.signal?.aborted)throw new Error("verifyExpectedSchemaVersion: aborted by signal before query");let r,n;if(e.tool==="prisma")r=s,n=a;else if(e.tool==="custom"){if(e.customQuery===void 0)throw new Error('verifyExpectedSchemaVersion: tool="custom" requires customQuery');r=e.customQuery.sql,n=e.customQuery.column}else throw new Error(`verifyExpectedSchemaVersion: unknown tool ${String(e.tool)}`);const i=(await e.client.query(r)).rows[0],o=i!==void 0?i[n]:void 0,t=typeof o=="string"?o:null;return{matches:t!==null&&c(e.expected,t),expected:e.expected,actual:t}}export{m as verifyExpectedSchemaVersion};

package/dist/migration/verifyExpectedSchemaVersion.test.js

@@ -1 +1 @@
-import{describe as r,expect as a,it as o,vi as l}from"vitest";import{verifyExpectedSchemaVersion as i}from"./verifyExpectedSchemaVersion.js";function n(t){const e=[];return{client:{query:l.fn(async c=>(e.push(c),{rows:t}))},queries:e}}r("verifyExpectedSchemaVersion",()=>{r('tool: "prisma"',()=>{o("returns matches=true when actual === expected",async()=>{const{client:t,queries:e}=n([{migration_name:"20260520000000_add_widgets"}]),s=await i({tool:"prisma",expected:"20260520000000_add_widgets",client:t});a(s).toEqual({matches:!0,expected:"20260520000000_add_widgets",actual:"20260520000000_add_widgets"}),a(e).toHaveLength(1),a(e[0]).toContain("_prisma_migrations"),a(e[0]).toContain("finished_at IS NOT NULL"),a(e[0]).toContain("ORDER BY finished_at DESC LIMIT 1")}),o("returns matches=false with actual when DB trails image",async()=>{const{client:t}=n([{migration_name:"20260519000000_old"}]),e=await i({tool:"prisma",expected:"20260520000000_add_widgets",client:t});a(e).toEqual({matches:!1,expected:"20260520000000_add_widgets",actual:"20260519000000_old"})}),o("returns actual=null on empty result set",async()=>{const{client:t}=n([]),e=await i({tool:"prisma",expected:"20260520000000_add_widgets",client:t});a(e).toEqual({matches:!1,expected:"20260520000000_add_widgets",actual:null})}),o("returns actual=null when row's migration_name is not a string",async()=>{const{client:t}=n([{migration_name:12345}]),e=await i({tool:"prisma",expected:"x",client:t});a(e.actual).toBeNull(),a(e.matches).toBe(!1)})}),r('tool: "custom"',()=>{o("uses customQuery sql and column",async()=>{const{client:t,queries:e}=n([{hash:"deadbeef"}]),s=await i({tool:"custom",expected:"deadbeef",client:t,customQuery:{sql:"SELECT hash FROM __drizzle_migrations ORDER BY created_at DESC LIMIT 1",column:"hash"}});a(s.matches).toBe(!0),a(s.actual).toBe("deadbeef"),a(e[0]).toBe("SELECT hash FROM __drizzle_migrations ORDER BY created_at DESC LIMIT 1")}),o("throws when customQuery is omitted",async()=>{const{client:t}=n([]);await a(i({tool:"custom",expected:"x",client:t})).rejects.toThrow(/tool="custom" requires customQuery/)})}),r("abort signal",()=>{o("short-circuits before query when signal is already aborted",async()=>{const{client:t,queries:e}=n([{migration_name:"irrelevant"}]),s=new AbortController;s.abort(),await a(i({tool:"prisma",expected:"x",client:t,signal:s.signal})).rejects.toThrow(/aborted by signal before query/),a(e).toEqual([])})})});
+import{describe as c,expect as a,it as s,vi as l}from"vitest";import{verifyExpectedSchemaVersion as o}from"./verifyExpectedSchemaVersion.js";function n(t){const e=[];return{client:{query:l.fn(async i=>(e.push(i),{rows:t}))},queries:e}}c("verifyExpectedSchemaVersion",()=>{c('tool: "prisma"',()=>{s("returns matches=true when actual === expected",async()=>{const{client:t,queries:e}=n([{migration_name:"20260520000000_add_widgets"}]),r=await o({tool:"prisma",expected:"20260520000000_add_widgets",client:t});a(r).toEqual({matches:!0,expected:"20260520000000_add_widgets",actual:"20260520000000_add_widgets"}),a(e).toHaveLength(1),a(e[0]).toContain("_prisma_migrations"),a(e[0]).toContain("finished_at IS NOT NULL"),a(e[0]).toContain("ORDER BY finished_at DESC LIMIT 1")}),s("returns matches=false with actual when DB trails image",async()=>{const{client:t}=n([{migration_name:"20260519000000_old"}]),e=await o({tool:"prisma",expected:"20260520000000_add_widgets",client:t});a(e).toEqual({matches:!1,expected:"20260520000000_add_widgets",actual:"20260519000000_old"})}),s("returns matches=true when DB is AHEAD (expand-only rollback)",async()=>{const{client:t}=n([{migration_name:"20260521000000_add_more_widgets"}]),e=await o({tool:"prisma",expected:"20260520000000_add_widgets",client:t});a(e).toEqual({matches:!0,expected:"20260520000000_add_widgets",actual:"20260521000000_add_more_widgets"})}),s("returns actual=null on empty result set",async()=>{const{client:t}=n([]),e=await o({tool:"prisma",expected:"20260520000000_add_widgets",client:t});a(e).toEqual({matches:!1,expected:"20260520000000_add_widgets",actual:null})}),s("returns actual=null when row's migration_name is not a string",async()=>{const{client:t}=n([{migration_name:12345}]),e=await o({tool:"prisma",expected:"x",client:t});a(e.actual).toBeNull(),a(e.matches).toBe(!1)})}),c('tool: "custom"',()=>{s("uses customQuery sql and column",async()=>{const{client:t,queries:e}=n([{hash:"deadbeef"}]),r=await o({tool:"custom",expected:"deadbeef",client:t,customQuery:{sql:"SELECT hash FROM __drizzle_migrations ORDER BY created_at DESC LIMIT 1",column:"hash"}});a(r.matches).toBe(!0),a(r.actual).toBe("deadbeef"),a(e[0]).toBe("SELECT hash FROM __drizzle_migrations ORDER BY created_at DESC LIMIT 1")}),s("stays strict for non-orderable versions even when actual sorts later",async()=>{const{client:t}=n([{hash:"ffffffff"}]),e=await o({tool:"custom",expected:"00000000",client:t,customQuery:{sql:"SELECT hash FROM __drizzle_migrations ORDER BY created_at DESC LIMIT 1",column:"hash"}});a(e.matches).toBe(!1),a(e.actual).toBe("ffffffff")}),s("throws when customQuery is omitted",async()=>{const{client:t}=n([]);await a(o({tool:"custom",expected:"x",client:t})).rejects.toThrow(/tool="custom" requires customQuery/)})}),c("abort signal",()=>{s("short-circuits before query when signal is already aborted",async()=>{const{client:t,queries:e}=n([{migration_name:"irrelevant"}]),r=new AbortController;r.abort(),await a(o({tool:"prisma",expected:"x",client:t,signal:r.signal})).rejects.toThrow(/aborted by signal before query/),a(e).toEqual([])})})});

package/dist/patterns/index.d.ts

@@ -0,0 +1,11 @@
+/**
+ * The pattern vocabulary, its dispatch registry and the static-site forms
+ * address rules.
+ *
+ * Available as the `@fjall/util/patterns` subpath so consumers that must stay
+ * free of `node:*` imports (deploy-core's browser-safe `types/` barrel, which
+ * the webapp bundles) can take the vocabulary without depending on the root
+ * barrel's contents staying pure.
+ */
+export { PATTERN_TYPE_VALUES, type PatternType, PATTERN_TYPES, isPatternType, type PatternArtefact, type PatternStackPlacement, type PatternDescriptor, PATTERN_REGISTRY, type OpenNextPatternType, OPENNEXT_PATTERN_TYPES, isOpenNextPatternType, STATIC_SITE_ROUTING_VALUES, type StaticSiteRouting } from "./patternTypes.js";
+export { DEFAULT_FORMS_FROM_LOCAL_PART, defaultFormsFromAddress, defaultFormsCorsOrigin, isAddressAtDomain } from "./staticSiteForms.js";

package/dist/patterns/index.js

@@ -0,0 +1 @@
+import{PATTERN_TYPE_VALUES as r,PATTERN_TYPES as A,isPatternType as _,PATTERN_REGISTRY as e,OPENNEXT_PATTERN_TYPES as P,isOpenNextPatternType as s,STATIC_SITE_ROUTING_VALUES as t}from"./patternTypes.js";import{DEFAULT_FORMS_FROM_LOCAL_PART as o,defaultFormsFromAddress as N,defaultFormsCorsOrigin as S,isAddressAtDomain as O}from"./staticSiteForms.js";export{o as DEFAULT_FORMS_FROM_LOCAL_PART,P as OPENNEXT_PATTERN_TYPES,e as PATTERN_REGISTRY,A as PATTERN_TYPES,r as PATTERN_TYPE_VALUES,t as STATIC_SITE_ROUTING_VALUES,S as defaultFormsCorsOrigin,N as defaultFormsFromAddress,O as isAddressAtDomain,s as isOpenNextPatternType,_ as isPatternType};

package/dist/patterns/patternTypes.d.ts

@@ -0,0 +1,91 @@
+/**
+ * The pattern vocabulary — single source of truth.
+ *
+ * A "pattern" is a whole-application shape (Payload CMS, a Next.js app, a
+ * pre-built static site) that the generator emits, the CDK synthesises,
+ * deploy-core builds and the CLI offers. Before this module the vocabulary was
+ * declared four times — generator schemas, CDK interfaces, the deploy manifest
+ * and the CLI create flow — each with a different membership, so adding a
+ * pattern to one left the others silently wrong.
+ *
+ * `PATTERN_REGISTRY` is the compiler's checklist. It is a `Record<PatternType,
+ * PatternDescriptor>`, so a new member of `PATTERN_TYPE_VALUES` fails to
+ * compile until every dispatch decision — which stack, which builder, which
+ * construct id — is stated. Dispatch sites read the descriptor instead of
+ * re-deriving the answer from a ternary chain whose `else` branch would
+ * otherwise absorb the new pattern.
+ */
+/**
+ * Every pattern the toolchain knows about.
+ *
+ * - `payload` — Payload CMS on OpenNext (always has a database + migrations).
+ * - `nextjs` — a plain Next.js app on OpenNext (optional database). No CDK
+ *   construct exists yet: `IPatternProps` (components/infrastructure) omits it,
+ *   so a generated `nextjs` app fails to synthesise. Add the props + a
+ *   `PatternFactory.build` case to close the gap.
+ * - `staticsite` — pre-built static assets on private S3 + CloudFront/OAC.
+ */
+export declare const PATTERN_TYPE_VALUES: readonly ["payload", "nextjs", "staticsite"];
+export type PatternType = (typeof PATTERN_TYPE_VALUES)[number];
+export declare const PATTERN_TYPES: ReadonlySet<string>;
+export declare function isPatternType(value: unknown): value is PatternType;
+/**
+ * What a pattern's build step produces. Selects the deploy-core builder:
+ * `opennext-lambda` runs the OpenNext build and uploads a Lambda bundle;
+ * `static-assets` runs the site's own build command and syncs a directory to S3.
+ */
+export type PatternArtefact = "opennext-lambda" | "static-assets";
+/**
+ * Which stack the pattern's constructs are placed into. A static site has no
+ * VPC or compute, so it co-locates in the CDN stack; OpenNext patterns carry a
+ * Lambda (and usually a database) and belong in the compute stack.
+ */
+export type PatternStackPlacement = "compute" | "cdn";
+export interface PatternDescriptor {
+    /** Human-facing name, used by the CLI picker and progress output. */
+    readonly label: string;
+    /** Suffix the generator appends to the PascalCase app name for the construct id. */
+    readonly constructIdSuffix: string;
+    /** What the build produces — selects the deploy-core framework builder. */
+    readonly artefact: PatternArtefact;
+    /** Stack the pattern's constructs are placed into. */
+    readonly stackPlacement: PatternStackPlacement;
+}
+export declare const PATTERN_REGISTRY: {
+    readonly payload: {
+        readonly label: "Payload CMS";
+        readonly constructIdSuffix: "Payload";
+        readonly artefact: "opennext-lambda";
+        readonly stackPlacement: "compute";
+    };
+    readonly nextjs: {
+        readonly label: "Next.js";
+        readonly constructIdSuffix: "Nextjs";
+        readonly artefact: "opennext-lambda";
+        readonly stackPlacement: "compute";
+    };
+    readonly staticsite: {
+        readonly label: "Static site";
+        readonly constructIdSuffix: "StaticSite";
+        readonly artefact: "static-assets";
+        readonly stackPlacement: "cdn";
+    };
+};
+/**
+ * The OpenNext-shaped patterns, derived from the registry at both the type and
+ * the value level — a new OpenNext pattern joins this accept-set by declaring
+ * its artefact, not by being remembered in a second list. (`as const satisfies`
+ * above is what keeps the literal `artefact` types the mapped type reads.)
+ */
+export type OpenNextPatternType = {
+    [K in PatternType]: (typeof PATTERN_REGISTRY)[K]["artefact"] extends "opennext-lambda" ? K : never;
+}[PatternType];
+export declare const OPENNEXT_PATTERN_TYPES: readonly OpenNextPatternType[];
+export declare function isOpenNextPatternType(value: string | undefined | null): value is OpenNextPatternType;
+/**
+ * Routing mode for a static site. Shared with the CDN construct and the
+ * generator's `StaticSiteRoutingSchema`, both of which derive from this tuple —
+ * a third mode must not be addable to one without the other.
+ */
+export declare const STATIC_SITE_ROUTING_VALUES: readonly ["multipage", "spa"];
+export type StaticSiteRouting = (typeof STATIC_SITE_ROUTING_VALUES)[number];

package/dist/patterns/patternTypes.js

@@ -0,0 +1 @@
+const e=["payload","nextjs","staticsite"],a=new Set(e);function o(t){return typeof t=="string"&&a.has(t)}const n={payload:{label:"Payload CMS",constructIdSuffix:"Payload",artefact:"opennext-lambda",stackPlacement:"compute"},nextjs:{label:"Next.js",constructIdSuffix:"Nextjs",artefact:"opennext-lambda",stackPlacement:"compute"},staticsite:{label:"Static site",constructIdSuffix:"StaticSite",artefact:"static-assets",stackPlacement:"cdn"}},c=e.filter(t=>n[t].artefact==="opennext-lambda"),s=new Set(c);function T(t){return t!=null&&s.has(t)}const r=["multipage","spa"];export{c as OPENNEXT_PATTERN_TYPES,n as PATTERN_REGISTRY,a as PATTERN_TYPES,e as PATTERN_TYPE_VALUES,r as STATIC_SITE_ROUTING_VALUES,T as isOpenNextPatternType,o as isPatternType};

package/dist/patterns/staticSiteForms.d.ts

@@ -0,0 +1,24 @@
+/**
+ * Address derivation for the static-site contact form.
+ *
+ * The generator validates `forms.from` against these rules and the CDK
+ * construct derives the defaults from them, so they are a coupled pair: a
+ * change to the default sender that landed on one side only would deploy an
+ * endpoint whose IAM `ses:FromAddress` condition denies its own send.
+ */
+/** Local part of the default envelope sender: `noreply@<domain>`. */
+export declare const DEFAULT_FORMS_FROM_LOCAL_PART = "noreply";
+/**
+ * The envelope sender used when `forms.from` is absent. Sits at the site's
+ * domain because SES sends only from a verified identity.
+ */
+export declare function defaultFormsFromAddress(domain: string): string;
+/** The origin allowed to POST the form when `forms.corsOrigin` is absent. */
+export declare function defaultFormsCorsOrigin(domain: string): string;
+/**
+ * Whether `address` sits at exactly `domain`. Subdomains are rejected: the
+ * pattern grants `ses:SendEmail` under a `ses:FromAddress` condition pinned to
+ * the address, so an address SES would accept but the policy would not is a
+ * deploy-green/runtime-500 trap.
+ */
+export declare function isAddressAtDomain(address: string, domain: string): boolean;

package/dist/patterns/staticSiteForms.js

@@ -0,0 +1 @@
+const s="noreply";function f(r){return`${s}@${r}`}function i(r){return`https://${r}`}function u(r,o){const t=r.split("@");if(t.length!==2)return!1;const[e,n]=t;return e===void 0||e===""||n===void 0?!1:n.toLowerCase()===o.toLowerCase()}export{s as DEFAULT_FORMS_FROM_LOCAL_PART,i as defaultFormsCorsOrigin,f as defaultFormsFromAddress,u as isAddressAtDomain};

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@fjall/util",
-  "version": "2.27.0",
+  "version": "2.30.0",
   "description": "Common utility methods",
   "type": "module",
   "main": "dist/index.js",
@@ -30,6 +30,10 @@
       "types": "./dist/manifest/index.d.ts",
       "default": "./dist/manifest/index.js"
     },
+    "./patterns": {
+      "types": "./dist/patterns/index.d.ts",
+      "default": "./dist/patterns/index.js"
+    },
     "./manifest/schemas": {
       "types": "./dist/manifest/schemas.d.ts",
       "default": "./dist/manifest/schemas.js"
@@ -101,6 +105,7 @@
     "clean": "rm -rf ./dist ./sourcemaps",
     "clean:node": "rm -rf ./node_modules",
     "build": "npm run clean && npx tsc && node ../scripts/minify-dist.mjs dist",
+    "prepack": "node ../scripts/check-dist-freshness.mjs",
     "watch": "npm run build && npx tsc-watch",
     "watch:only": "npx tsc-watch",
     "format": "prettier --write \"src/**/*.{ts,tsx,js,jsx,json}\"",
@@ -129,5 +134,5 @@
   "engines": {
     "node": ">=22.0.0"
   },
-  "gitHead": "921ecd4f65f52c17037a8a24834d7e4c196b9347"
+  "gitHead": "ec35b16db566dfa5feb714c16f132c55b4663c86"
 }