@fjall/util 20.0.0 → 21.0.0

package/dist/.build-source-hash

@@ -9,19 +9,19 @@
     "package.json",
     "tsconfig.json"
   ],
-  "hash": "a0a493b8832688e4bc7a72eea503c17e90d177fbbdf80d407eaa571a83d6d6a3",
+  "hash": "566909df146d4928f9cb8ac9c8063289f5932765c3509080f17a0886905f61b9",
   "files": {
     "src/async/concurrency.ts": "3c7ebe0222a720f9",
     "src/async/singleton.ts": "7bcc21b0fb920561",
     "src/async/sleep.ts": "df52b17675ec3ed2",
     "src/aws/CloudFormationFailureAnalyser.ts": "4e68b353171edd31",
     "src/aws/cloudformationTypes.ts": "e43bab9c96a21856",
-    "src/aws/costAllocationTags.ts": "102100b3df7d428e",
+    "src/aws/costAllocationTags.ts": "8b60ac5b62a68a9d",
     "src/aws/deployProgress.ts": "be09dedb4deb9a7a",
     "src/aws/driftSuspects.ts": "5400dc05ebd6c977",
     "src/aws/errors.ts": "5addfa6bb2d1456a",
     "src/aws/failureAnalysisCategories.ts": "85ab1632d8069273",
-    "src/aws/index.ts": "d1b45a75d7fb8e28",
+    "src/aws/index.ts": "ba6c3c8c913e4789",
     "src/aws/infraTags.ts": "6b1e65bf7119f32c",
     "src/aws/ipamTags.ts": "ac19ecd6c36b3bc2",
     "src/aws/maskFailureAnalysis.ts": "ae11250412cd6fd8",
@@ -69,7 +69,7 @@
     "src/fsHelpers.ts": "0869d9739d523572",
     "src/fsScan.ts": "feb187758481443f",
     "src/httpKeepAlive.ts": "c8fe4b118ef4c79f",
-    "src/index.ts": "34a9bb9a33ef1680",
+    "src/index.ts": "478cb9c5a7cb3489",
     "src/infra/backupVault.ts": "661678a6dfb0b648",
     "src/infra/connectionsWire.ts": "e3afa3ba95a531d8",
     "src/infra/deployArtefacts.ts": "235ac21dd3ccf0b2",
@@ -84,12 +84,16 @@
     "src/manifest/io.ts": "915ab602ac92d126",
     "src/manifest/schemas.ts": "21dce8ba66b1230f",
     "src/mcpProtocol/index.ts": "55df3209915a5043",
+    "src/migration/clickhouseFrameworkUsers.ts": "4bd55a96d4fddff4",
     "src/migration/clickhouseSqlUsers.ts": "c916e148367715bb",
     "src/migration/compareSchemaVersion.ts": "1c9247e722ec5d5b",
-    "src/migration/constants.ts": "fa7b53cc1e15a245",
-    "src/migration/index.ts": "fc1f4a461d637766",
+    "src/migration/constants.ts": "6a1481ac5f62b5d7",
+    "src/migration/controlPlaneActivity.ts": "c7ba33958f9fcbcc",
+    "src/migration/index.ts": "1c4090534fbaf61c",
     "src/migration/pickLatestClickHouseMigration.ts": "a5b4a00ba63522cb",
     "src/migration/pickLatestPrismaMigration.ts": "cbddc2950f4d4c85",
+    "src/migration/schemaGateExit.ts": "53f26d02b798a475",
+    "src/migration/sleepAbortable.ts": "71c7e7cc59406e2a",
     "src/migration/verifyExpectedSchemaVersion.ts": "cd583329d771a047",
     "src/naming/accountNameCollision.ts": "2dc8b278ff039220",
     "src/naming/caseConversion.ts": "8b8984f2b58b8ab7",
@@ -111,12 +115,12 @@
     "src/repo/scanTypes.ts": "1fda805a7d8de93b",
     "src/resourceCategorisation.ts": "a140d1b3cb38be33",
     "src/secrets.ts": "50258d463e4e67c3",
-    "src/securityHelpers.ts": "2632215f57e1528c",
+    "src/securityHelpers.ts": "81ba6146cf6fcefb",
     "src/targets.ts": "126280f0a5762e21",
     "../scripts/minify-dist.mjs": "6b2e4b0df8aec601",
-    "package.json": "e6b55e0cbbcafa56",
+    "package.json": "8720ee3c924a4dda",
     "tsconfig.json": "db759831ad95f396"
   },
-  "outputHash": "5d297fd2a4b1eb5849301e75fd57cf8b1f47a2c32b3b828c446b4be862ca27fe",
-  "outputFileCount": 211
+  "outputHash": "f451723e4b5caa30c47b264401b188074b72d28a9b4d4d8fcf022a3e82cdad23",
+  "outputFileCount": 221
 }

package/dist/.minified

@@ -1 +1 @@
-105 files minified at 2026-08-24T18:04:48.133Z
+110 files minified at 2026-08-26T08:32:27.986Z

package/dist/aws/costAllocationTags.d.ts

@@ -32,3 +32,21 @@ export declare const COST_ALLOCATION_TAGS: {
  * management (root) account and stage-less governance resources.
  */
 export declare const DEFAULT_COST_ALLOCATION_ENVIRONMENT: "management";
+/** SDK tag shape (`{ Key, Value }`) accepted by `CreateRepositoryCommand`. */
+export interface EcrCreateTag {
+    readonly Key: string;
+    readonly Value: string;
+}
+/**
+ * Cost-allocation tag set for SDK-created ECR repositories (the buildx
+ * registry-cache repos and the schema-gate mirror repo — everything ECR the
+ * CDK constructs do NOT synthesise). The service value is the repository name:
+ * it is the one identity every creation path shares byte-identically, which
+ * matters for the cache repos — the `fjall build` provisioner
+ * (`@fjall/cli` EcrRepositoryService) and the deploy-path provisioner
+ * (`@fjall/deploy-core` ensureBuildCacheRepository) both create the SAME
+ * physical repo, so their tag sets must not drift. No environment tag: these
+ * repos are account-scoped and shared across every stage in the account.
+ * Tags apply on create only — already-existing repos are never retro-tagged.
+ */
+export declare function ecrCreateRepositoryTags(repositoryName: string): EcrCreateTag[];

package/dist/aws/costAllocationTags.js

@@ -1 +1 @@
-const o={ENVIRONMENT:"fjall:costAllocation:environment",SERVICE:"fjall:costAllocation:service",DOMAIN:"fjall:costAllocation:domain",OWNER:"fjall:costAllocation:owner"},l="management";export{o as COST_ALLOCATION_TAGS,l as DEFAULT_COST_ALLOCATION_ENVIRONMENT};
+var l=Object.defineProperty;var t=(o,e)=>l(o,"name",{value:e,configurable:!0});const n={ENVIRONMENT:"fjall:costAllocation:environment",SERVICE:"fjall:costAllocation:service",DOMAIN:"fjall:costAllocation:domain",OWNER:"fjall:costAllocation:owner"},c="management";function r(o){return[{Key:n.SERVICE,Value:o}]}t(r,"ecrCreateRepositoryTags");export{n as COST_ALLOCATION_TAGS,c as DEFAULT_COST_ALLOCATION_ENVIRONMENT,r as ecrCreateRepositoryTags};

package/dist/aws/index.d.ts

@@ -7,5 +7,5 @@ export { maskFailureAnalysis } from "./maskFailureAnalysis.js";
 export { classifyDriftSuspectEvents, findCurrentOperationStart, isDriftSuspectReason, isOperationOpeningEvent, type DriftSuspectEvent } from "./driftSuspects.js";
 export { IPAM_OPERATIONS_POOL_TAG_KEY, formatIpamPairTagValue } from "./ipamTags.js";
 export { SDK_PRE_EMPTY_TAG_KEY } from "./infraTags.js";
-export { COST_ALLOCATION_TAGS, DEFAULT_COST_ALLOCATION_ENVIRONMENT } from "./costAllocationTags.js";
+export { COST_ALLOCATION_TAGS, DEFAULT_COST_ALLOCATION_ENVIRONMENT, ecrCreateRepositoryTags, type EcrCreateTag } from "./costAllocationTags.js";
 export { ACCOUNT_MONITORING_ROLE_NAME } from "./monitoringRole.js";

package/dist/aws/index.js

@@ -1 +1 @@
-import{AWSError as e,NoRolesFoundError as t,InvalidCredentialsError as E,SSOTokenExpiredError as i,MissingRegionError as s,ProfileNotFoundError as n,CommandError as A,isAWSError as O,isNoRolesFoundError as _,isSSOUnauthorizedError as a}from"./errors.js";import{STACK_NOT_FOUND_PATTERN as S,CDK_NO_STACKS_MATCH as p,isResourceEvent as f}from"./cloudformationTypes.js";import{countResourceProgress as N,formatElapsed as C}from"./deployProgress.js";import{CloudFormationFailureAnalyser as R}from"./CloudFormationFailureAnalyser.js";import{FAILURE_ANALYSIS_CATEGORIES as x}from"./failureAnalysisCategories.js";import{maskFailureAnalysis as d}from"./maskFailureAnalysis.js";import{classifyDriftSuspectEvents as L,findCurrentOperationStart as P,isDriftSuspectReason as M,isOperationOpeningEvent as c}from"./driftSuspects.js";import{IPAM_OPERATIONS_POOL_TAG_KEY as K,formatIpamPairTagValue as g}from"./ipamTags.js";import{SDK_PRE_EMPTY_TAG_KEY as U}from"./infraTags.js";import{COST_ALLOCATION_TAGS as Y,DEFAULT_COST_ALLOCATION_ENVIRONMENT as y}from"./costAllocationTags.js";import{ACCOUNT_MONITORING_ROLE_NAME as V}from"./monitoringRole.js";export{V as ACCOUNT_MONITORING_ROLE_NAME,e as AWSError,p as CDK_NO_STACKS_MATCH,Y as COST_ALLOCATION_TAGS,R as CloudFormationFailureAnalyser,A as CommandError,y as DEFAULT_COST_ALLOCATION_ENVIRONMENT,x as FAILURE_ANALYSIS_CATEGORIES,K as IPAM_OPERATIONS_POOL_TAG_KEY,E as InvalidCredentialsError,s as MissingRegionError,t as NoRolesFoundError,n as ProfileNotFoundError,U as SDK_PRE_EMPTY_TAG_KEY,i as SSOTokenExpiredError,S as STACK_NOT_FOUND_PATTERN,L as classifyDriftSuspectEvents,N as countResourceProgress,P as findCurrentOperationStart,C as formatElapsed,g as formatIpamPairTagValue,O as isAWSError,M as isDriftSuspectReason,_ as isNoRolesFoundError,c as isOperationOpeningEvent,f as isResourceEvent,a as isSSOUnauthorizedError,d as maskFailureAnalysis};
+import{AWSError as e,NoRolesFoundError as t,InvalidCredentialsError as E,SSOTokenExpiredError as s,MissingRegionError as i,ProfileNotFoundError as a,CommandError as n,isAWSError as A,isNoRolesFoundError as O,isSSOUnauthorizedError as _}from"./errors.js";import{STACK_NOT_FOUND_PATTERN as p,CDK_NO_STACKS_MATCH as S,isResourceEvent as f}from"./cloudformationTypes.js";import{countResourceProgress as N,formatElapsed as C}from"./deployProgress.js";import{CloudFormationFailureAnalyser as u}from"./CloudFormationFailureAnalyser.js";import{FAILURE_ANALYSIS_CATEGORIES as x}from"./failureAnalysisCategories.js";import{maskFailureAnalysis as d}from"./maskFailureAnalysis.js";import{classifyDriftSuspectEvents as L,findCurrentOperationStart as P,isDriftSuspectReason as c,isOperationOpeningEvent as M}from"./driftSuspects.js";import{IPAM_OPERATIONS_POOL_TAG_KEY as D,formatIpamPairTagValue as K}from"./ipamTags.js";import{SDK_PRE_EMPTY_TAG_KEY as U}from"./infraTags.js";import{COST_ALLOCATION_TAGS as y,DEFAULT_COST_ALLOCATION_ENVIRONMENT as Y,ecrCreateRepositoryTags as k}from"./costAllocationTags.js";import{ACCOUNT_MONITORING_ROLE_NAME as W}from"./monitoringRole.js";export{W as ACCOUNT_MONITORING_ROLE_NAME,e as AWSError,S as CDK_NO_STACKS_MATCH,y as COST_ALLOCATION_TAGS,u as CloudFormationFailureAnalyser,n as CommandError,Y as DEFAULT_COST_ALLOCATION_ENVIRONMENT,x as FAILURE_ANALYSIS_CATEGORIES,D as IPAM_OPERATIONS_POOL_TAG_KEY,E as InvalidCredentialsError,i as MissingRegionError,t as NoRolesFoundError,a as ProfileNotFoundError,U as SDK_PRE_EMPTY_TAG_KEY,s as SSOTokenExpiredError,p as STACK_NOT_FOUND_PATTERN,L as classifyDriftSuspectEvents,N as countResourceProgress,k as ecrCreateRepositoryTags,P as findCurrentOperationStart,C as formatElapsed,K as formatIpamPairTagValue,A as isAWSError,c as isDriftSuspectReason,O as isNoRolesFoundError,M as isOperationOpeningEvent,f as isResourceEvent,_ as isSSOUnauthorizedError,d as maskFailureAnalysis};

package/dist/index.d.ts

@@ -29,6 +29,8 @@ export { RESERVED_APP_NAMES, type ReservedAppName, RESERVED_APP_NAME_MESSAGE, is
 export { deriveContentHashTag, CONTENT_HASH_TAG_PATTERN } from "./infra/deriveContentHashTag.js";
 export { DEPLOY_MODES, DeployModeSchema, type DeployMode, IMAGE_TAG_PATTERN, ImageTagSchema, type ImageTag, ServiceArtefactSchema, type ServiceArtefact, ServiceArtefactsSchema, type ServiceArtefacts, ARTEFACT_OUTPUT_FIELDS, type ArtefactOutputField, artefactOutputKey } from "./infra/deployArtefacts.js";
 export { MIGRATION_SNAPSHOT_NAME_PREFIX, EXPECTED_SCHEMA_VERSION_ENV, EXPECTED_SCHEMA_VERSION_TOOL_ENV, EXPECTED_CH_SCHEMA_VERSION_ENV, SCHEMA_ADMIN_USER_ENV, SCHEMA_ADMIN_PASSWORD_ENV, PRISMA_MIGRATION_DIR_RE, CLICKHOUSE_MIGRATION_SKIP_RE } from "./migration/constants.js";
+export { SCHEMA_GATE_EXIT, SCHEMA_GATE_EXIT_HINTS, schemaGateExitKind, type SchemaGateExitKind, type SchemaGateExitCode } from "./migration/schemaGateExit.js";
+export { FJALL_SCHEMA_GATE_USER, FJALL_MAINTENANCE_USER, FJALL_CLICKHOUSE_USERS, type FjallClickHouseUser } from "./migration/clickhouseFrameworkUsers.js";
 export { PHYSICAL_NAME_FALLBACK_PROPERTIES } from "./cfn/physicalNameProperties.js";
 export { PATTERN_TYPE_VALUES, type PatternType, PATTERN_TYPES, isPatternType, type PatternArtefact, type PatternStackPlacement, type PatternDescriptor, PATTERN_REGISTRY, patternConstructId, DEPLOYABLE_PATTERN_TYPES, type OpenNextPatternType, OPENNEXT_PATTERN_TYPES, isOpenNextPatternType, STATIC_SITE_ROUTING_VALUES, type StaticSiteRouting } from "./patterns/patternTypes.js";
 export { DEFAULT_FORMS_FROM_LOCAL_PART, defaultFormsFromAddress, defaultFormsCorsOrigin, isAddressAtDomain } from "./patterns/staticSiteForms.js";

package/dist/index.js

@@ -1 +1 @@
-import{DNS_APEX as r,getDomainExportNames as _,getDomainStackName as t,getDomainUsEast1CertificatesStackName as o,hostsExportPartName as S,serialiseHostsChunks as T,HOSTS_OUTPUT_MAX_BYTES as A,isManagedDomainBinding as a,DOMAIN_DEPLOY_DEFAULT_PHASE as N}from"./infra/domainExports.js";import{BACKUP_VAULT_NAME as n}from"./infra/backupVault.js";import{APPROVAL_TOKEN_OUTPUT_PREFIX as m,TOKEN_STDERR_PREFIX as O}from"./deploy/approvalTokenOutput.js";import{imageTagParameterName as C}from"./infra/imageTags.js";import{toPascalCase as I,toKebab as p,toValidDatabaseName as D,toScreamingSnake as L,capitalise as c,getSafeZoneName as M,accountConstructKey as f,hasAsciiStableConstructKey as U}from"./naming/caseConversion.js";import{albDnsExportName as u,albHostedZoneIdExportName as d,cdnDomainExportName as g,bucketWebsiteEndpointExportName as x,bucketWebsiteHostedZoneIdExportName as F}from"./naming/targetExportNames.js";import{CAPACITY_SLOT_PATTERN as V,CAPACITY_SLOT_MAX_LENGTH as Y,DEFAULT_CAPACITY_SLOT as y,CAPACITY_ANCHOR_PATTERN as G,CAPACITY_ANCHOR_MAX_LENGTH as H,CAPACITY_IDENTITY_CONTEXT_KEY as v,CapacityIdentityPinSchema as b,CapacityIdentityWireSchema as K,CapacityIdentityConfigSchema as X,projectCapacityIdentityToTarget as B}from"./capacityIdentity.js";import{findAccountNameCollision as k}from"./naming/accountNameCollision.js";import{defaultConnectedAccountName as j,suffixedAccountName as w,REGION_SHORT_CODES as z,findTrailingRegionShortCode as Q,regionSuffixRejectionMessage as q}from"./naming/connectedAccountName.js";import{normaliseError as $,getErrorMessage as ee,hasErrorCode as Ee,getErrorCode as re,getErrorStack as _e,formatErrorString as te}from"./errorUtils.js";import{singleton as Se}from"./async/singleton.js";import{DANGEROUS_ENV_VARS as Ae,filterDangerousEnvVars as ae,MASKED_VALUE_MARKER as Ne,maskSensitiveOutput as Re,parseShellArgs as ne,REDACTED_KEY_SENTINEL as ie,SCOPED_TOKEN_REGEX as me}from"./securityHelpers.js";import{sleep as Pe}from"./async/sleep.js";import{mapSettledWithConcurrency as se}from"./async/concurrency.js";import{ACCOUNT_STAGES_WITH_ROOT as pe,STRUCTURAL_ENVIRONMENTS as De,ACCOUNT_STAGES as Le,ACCOUNT_STAGE_LABELS as ce,isAccountStage as Me,ACCOUNT_TIERS as fe,AccountTierSchema as Ue,isAccountTier as le,GOVERNANCE_ACCOUNT_TIERS as ue,isGovernanceTier as de,environmentToTier as ge,stageFromWireEnvironment as xe,accountTier as Fe,resolveSynthEnvironment as he,getEnvironmentLabel as Ve,ACCOUNT_ROLES as Ye}from"./environments.js";import{RESOURCE_CATEGORIES as Ge,categoriseResource as He,getExpectedDuration as ve,getFriendlyResourceType as be}from"./resourceCategorisation.js";import{parseGitRemoteUrl as Xe}from"./repo/gitRemoteParser.js";import{abbreviateRegion as We,AWS_REGIONS_METADATA as ke,DEFAULT_REGION as Ze,getRegionInfo as je,MAX_SECONDARY_REGIONS as we,OPT_IN_REGION_CODES as ze,optInRegionWarning as Qe,regions as qe,suggestRegionForTimezone as Je}from"./infra/regions.js";import{SCOPE_VALUES as eE,MACHINE_ONLY_SCOPES as EE,USER_GRANTABLE_SCOPES as rE,GOVERNANCE_SCOPE_REQUIRED_CODE as _E}from"./infra/tokenScopes.js";import{SECRET_NAME_PATTERN as oE,SECRET_NAME_ERROR as SE,SSM_COMPONENT_PATTERN as TE,SSM_COMPONENT_ERROR as AE,SSM_STANDARD_MAX_VALUE_BYTES as aE,SecretNamespaceSchema as NE,buildNamespaceParts as RE,buildParameterPath as nE,parseParameterPath as iE,isManageablePath as mE,parseDotEnv as OE,escapeDotEnvValue as PE}from"./secrets.js";import{ConnectionWireSchema as sE,ConnectionsListResponseSchema as IE,CONNECTION_PHASES as pE,CONNECTION_TERMINAL_FAILURE_PHASES as DE,CONNECTION_FAILURE_REASONS as LE,EXTERNAL_ID_PATTERN as cE}from"./infra/connectionsWire.js";import{PUBLIC_PACKAGE_NAME as fE,INSTALL_SOURCES as UE,SETUP_COMMANDS as lE,upgradeCommand as uE,SETUP_MODES as dE,SETUP_STEP_IDS as gE,SETUP_STEPS as xE,AGENT_SETUP_PROMPTS as FE,AGENT_INSTALL_COMMAND as hE,SKILL_INSTALL_SEGMENTS as VE,SKILL_INSTALL_FILENAME as YE,SKILL_INSTALL_PATH as yE}from"./onboarding/index.js";import{deriveRegionsFromOrgConfig as HE,deriveTargets as vE,deriveAllTargets as bE,environmentOrTier as KE,findTarget as XE,generateTargetName as BE}from"./targets.js";import{buildAppConfigPath as kE}from"./repo/appPath.js";import{findInfrastructurePaths as jE,findBoundaryPath as wE,isInfrastructureFile as zE}from"./repo/findInfrastructurePaths.js";import{inferContainerFromCandidates as qE}from"./repo/inferContainerFromCandidates.js";import{RESERVED_APP_NAMES as $E,RESERVED_APP_NAME_MESSAGE as er,isReservedAppName as Er,RESERVED_APP_NAME_SUFFIX as rr,RESERVED_APP_NAME_SUFFIX_MESSAGE as _r,hasReservedAppNameSuffix as tr}from"./naming/reservedAppNames.js";import{deriveContentHashTag as Sr,CONTENT_HASH_TAG_PATTERN as Tr}from"./infra/deriveContentHashTag.js";import{DEPLOY_MODES as ar,DeployModeSchema as Nr,IMAGE_TAG_PATTERN as Rr,ImageTagSchema as nr,ServiceArtefactSchema as ir,ServiceArtefactsSchema as mr,ARTEFACT_OUTPUT_FIELDS as Or,artefactOutputKey as Pr}from"./infra/deployArtefacts.js";import{MIGRATION_SNAPSHOT_NAME_PREFIX as sr,EXPECTED_SCHEMA_VERSION_ENV as Ir,EXPECTED_SCHEMA_VERSION_TOOL_ENV as pr,EXPECTED_CH_SCHEMA_VERSION_ENV as Dr,SCHEMA_ADMIN_USER_ENV as Lr,SCHEMA_ADMIN_PASSWORD_ENV as cr,PRISMA_MIGRATION_DIR_RE as Mr,CLICKHOUSE_MIGRATION_SKIP_RE as fr}from"./migration/constants.js";import{PHYSICAL_NAME_FALLBACK_PROPERTIES as lr}from"./cfn/physicalNameProperties.js";import{PATTERN_TYPE_VALUES as dr,PATTERN_TYPES as gr,isPatternType as xr,PATTERN_REGISTRY as Fr,patternConstructId as hr,DEPLOYABLE_PATTERN_TYPES as Vr,OPENNEXT_PATTERN_TYPES as Yr,isOpenNextPatternType as yr,STATIC_SITE_ROUTING_VALUES as Gr}from"./patterns/patternTypes.js";import{DEFAULT_FORMS_FROM_LOCAL_PART as vr,defaultFormsFromAddress as br,defaultFormsCorsOrigin as Kr,isAddressAtDomain as Xr}from"./patterns/staticSiteForms.js";import{DEV_SUBSTRATE_PARAMS_SCHEMA_VERSION as Wr,DEV_SUBSTRATE_PARAMS_FILENAME as kr,DevSubstrateSynthPropsSchema as Zr,DevSubstrateParamsSchema as jr}from"./devSubstrate/params.js";import{DEV_SUBSTRATE_ENTRYPOINT_SOURCE as zr}from"./devSubstrate/entrypoint.js";import{BLESSED_CDK_TOOLCHAIN as qr}from"./cdkToolchain.js";import{DEPLOYMENT_FAILURE_PHASES as $r,DeploymentFailurePhaseSchema as e_,DEPLOYMENT_FAULT_ATTRIBUTIONS as E_,DeploymentFaultAttributionSchema as r_,DEPLOYMENT_FAILURE_PROVIDER_SOURCES as __,DeploymentFailureProviderSourceSchema as t_,DEPLOYMENT_FAILURE_CODE_PATTERN as o_,DEPLOYMENT_FAILURE_SCHEMA_VERSION as S_,DEPLOYMENT_FAILURE_LIMITS as T_,DeploymentFailureAnalysisSchema as A_,DeploymentFailureProviderSchema as a_,DeploymentFailureResourceSchema as N_,DeploymentFailureSchema as R_,parseDeploymentFailure as n_,DEPLOYMENT_FAILURE_DOCS_BASE_URL as i_,deploymentFailureDocsUrl as m_,DEPLOYMENT_FAULT_COPY as O_,DEPLOYMENT_PROVIDER_LABELS as P_,deriveErrorMessageFromFailure as C_,toDeploymentFailureAnalysis as s_}from"./failure/deploymentFailure.js";import{extractErrorWindow as p_,ERROR_WINDOW_CONTEXT_LINES as D_}from"./failure/extractErrorWindow.js";export{Ye as ACCOUNT_ROLES,Le as ACCOUNT_STAGES,pe as ACCOUNT_STAGES_WITH_ROOT,ce as ACCOUNT_STAGE_LABELS,fe as ACCOUNT_TIERS,hE as AGENT_INSTALL_COMMAND,FE as AGENT_SETUP_PROMPTS,m as APPROVAL_TOKEN_OUTPUT_PREFIX,Or as ARTEFACT_OUTPUT_FIELDS,ke as AWS_REGIONS_METADATA,Ue as AccountTierSchema,n as BACKUP_VAULT_NAME,qr as BLESSED_CDK_TOOLCHAIN,H as CAPACITY_ANCHOR_MAX_LENGTH,G as CAPACITY_ANCHOR_PATTERN,v as CAPACITY_IDENTITY_CONTEXT_KEY,Y as CAPACITY_SLOT_MAX_LENGTH,V as CAPACITY_SLOT_PATTERN,fr as CLICKHOUSE_MIGRATION_SKIP_RE,LE as CONNECTION_FAILURE_REASONS,pE as CONNECTION_PHASES,DE as CONNECTION_TERMINAL_FAILURE_PHASES,Tr as CONTENT_HASH_TAG_PATTERN,X as CapacityIdentityConfigSchema,b as CapacityIdentityPinSchema,K as CapacityIdentityWireSchema,sE as ConnectionWireSchema,IE as ConnectionsListResponseSchema,Ae as DANGEROUS_ENV_VARS,y as DEFAULT_CAPACITY_SLOT,vr as DEFAULT_FORMS_FROM_LOCAL_PART,Ze as DEFAULT_REGION,Vr as DEPLOYABLE_PATTERN_TYPES,o_ as DEPLOYMENT_FAILURE_CODE_PATTERN,i_ as DEPLOYMENT_FAILURE_DOCS_BASE_URL,T_ as DEPLOYMENT_FAILURE_LIMITS,$r as DEPLOYMENT_FAILURE_PHASES,__ as DEPLOYMENT_FAILURE_PROVIDER_SOURCES,S_ as DEPLOYMENT_FAILURE_SCHEMA_VERSION,E_ as DEPLOYMENT_FAULT_ATTRIBUTIONS,O_ as DEPLOYMENT_FAULT_COPY,P_ as DEPLOYMENT_PROVIDER_LABELS,ar as DEPLOY_MODES,zr as DEV_SUBSTRATE_ENTRYPOINT_SOURCE,kr as DEV_SUBSTRATE_PARAMS_FILENAME,Wr as DEV_SUBSTRATE_PARAMS_SCHEMA_VERSION,r as DNS_APEX,N as DOMAIN_DEPLOY_DEFAULT_PHASE,Nr as DeployModeSchema,A_ as DeploymentFailureAnalysisSchema,e_ as DeploymentFailurePhaseSchema,a_ as DeploymentFailureProviderSchema,t_ as DeploymentFailureProviderSourceSchema,N_ as DeploymentFailureResourceSchema,R_ as DeploymentFailureSchema,r_ as DeploymentFaultAttributionSchema,jr as DevSubstrateParamsSchema,Zr as DevSubstrateSynthPropsSchema,D_ as ERROR_WINDOW_CONTEXT_LINES,Dr as EXPECTED_CH_SCHEMA_VERSION_ENV,Ir as EXPECTED_SCHEMA_VERSION_ENV,pr as EXPECTED_SCHEMA_VERSION_TOOL_ENV,cE as EXTERNAL_ID_PATTERN,ue as GOVERNANCE_ACCOUNT_TIERS,_E as GOVERNANCE_SCOPE_REQUIRED_CODE,A as HOSTS_OUTPUT_MAX_BYTES,Rr as IMAGE_TAG_PATTERN,UE as INSTALL_SOURCES,nr as ImageTagSchema,EE as MACHINE_ONLY_SCOPES,Ne as MASKED_VALUE_MARKER,we as MAX_SECONDARY_REGIONS,sr as MIGRATION_SNAPSHOT_NAME_PREFIX,Yr as OPENNEXT_PATTERN_TYPES,ze as OPT_IN_REGION_CODES,Fr as PATTERN_REGISTRY,gr as PATTERN_TYPES,dr as PATTERN_TYPE_VALUES,lr as PHYSICAL_NAME_FALLBACK_PROPERTIES,Mr as PRISMA_MIGRATION_DIR_RE,fE as PUBLIC_PACKAGE_NAME,ie as REDACTED_KEY_SENTINEL,z as REGION_SHORT_CODES,$E as RESERVED_APP_NAMES,er as RESERVED_APP_NAME_MESSAGE,rr as RESERVED_APP_NAME_SUFFIX,_r as RESERVED_APP_NAME_SUFFIX_MESSAGE,Ge as RESOURCE_CATEGORIES,cr as SCHEMA_ADMIN_PASSWORD_ENV,Lr as SCHEMA_ADMIN_USER_ENV,me as SCOPED_TOKEN_REGEX,eE as SCOPE_VALUES,SE as SECRET_NAME_ERROR,oE as SECRET_NAME_PATTERN,lE as SETUP_COMMANDS,dE as SETUP_MODES,xE as SETUP_STEPS,gE as SETUP_STEP_IDS,YE as SKILL_INSTALL_FILENAME,yE as SKILL_INSTALL_PATH,VE as SKILL_INSTALL_SEGMENTS,AE as SSM_COMPONENT_ERROR,TE as SSM_COMPONENT_PATTERN,aE as SSM_STANDARD_MAX_VALUE_BYTES,Gr as STATIC_SITE_ROUTING_VALUES,De as STRUCTURAL_ENVIRONMENTS,NE as SecretNamespaceSchema,ir as ServiceArtefactSchema,mr as ServiceArtefactsSchema,O as TOKEN_STDERR_PREFIX,rE as USER_GRANTABLE_SCOPES,We as abbreviateRegion,f as accountConstructKey,Fe as accountTier,u as albDnsExportName,d as albHostedZoneIdExportName,Pr as artefactOutputKey,x as bucketWebsiteEndpointExportName,F as bucketWebsiteHostedZoneIdExportName,kE as buildAppConfigPath,RE as buildNamespaceParts,nE as buildParameterPath,c as capitalise,He as categoriseResource,g as cdnDomainExportName,j as defaultConnectedAccountName,Kr as defaultFormsCorsOrigin,br as defaultFormsFromAddress,m_ as deploymentFailureDocsUrl,bE as deriveAllTargets,Sr as deriveContentHashTag,C_ as deriveErrorMessageFromFailure,HE as deriveRegionsFromOrgConfig,vE as deriveTargets,KE as environmentOrTier,ge as environmentToTier,PE as escapeDotEnvValue,p_ as extractErrorWindow,ae as filterDangerousEnvVars,k as findAccountNameCollision,wE as findBoundaryPath,jE as findInfrastructurePaths,XE as findTarget,Q as findTrailingRegionShortCode,te as formatErrorString,BE as generateTargetName,_ as getDomainExportNames,t as getDomainStackName,o as getDomainUsEast1CertificatesStackName,Ve as getEnvironmentLabel,re as getErrorCode,ee as getErrorMessage,_e as getErrorStack,ve as getExpectedDuration,be as getFriendlyResourceType,je as getRegionInfo,M as getSafeZoneName,U as hasAsciiStableConstructKey,Ee as hasErrorCode,tr as hasReservedAppNameSuffix,S as hostsExportPartName,C as imageTagParameterName,qE as inferContainerFromCandidates,Me as isAccountStage,le as isAccountTier,Xr as isAddressAtDomain,de as isGovernanceTier,zE as isInfrastructureFile,mE as isManageablePath,a as isManagedDomainBinding,yr as isOpenNextPatternType,xr as isPatternType,Er as isReservedAppName,se as mapSettledWithConcurrency,Re as maskSensitiveOutput,$ as normaliseError,Qe as optInRegionWarning,n_ as parseDeploymentFailure,OE as parseDotEnv,Xe as parseGitRemoteUrl,iE as parseParameterPath,ne as parseShellArgs,hr as patternConstructId,B as projectCapacityIdentityToTarget,q as regionSuffixRejectionMessage,qe as regions,he as resolveSynthEnvironment,T as serialiseHostsChunks,Se as singleton,Pe as sleep,xe as stageFromWireEnvironment,w as suffixedAccountName,Je as suggestRegionForTimezone,s_ as toDeploymentFailureAnalysis,p as toKebab,I as toPascalCase,L as toScreamingSnake,D as toValidDatabaseName,uE as upgradeCommand};
+import{DNS_APEX as r,getDomainExportNames as _,getDomainStackName as t,getDomainUsEast1CertificatesStackName as o,hostsExportPartName as S,serialiseHostsChunks as A,HOSTS_OUTPUT_MAX_BYTES as T,isManagedDomainBinding as a,DOMAIN_DEPLOY_DEFAULT_PHASE as N}from"./infra/domainExports.js";import{BACKUP_VAULT_NAME as n}from"./infra/backupVault.js";import{APPROVAL_TOKEN_OUTPUT_PREFIX as m,TOKEN_STDERR_PREFIX as O}from"./deploy/approvalTokenOutput.js";import{imageTagParameterName as P}from"./infra/imageTags.js";import{toPascalCase as s,toKebab as p,toValidDatabaseName as L,toScreamingSnake as D,capitalise as c,getSafeZoneName as M,accountConstructKey as f,hasAsciiStableConstructKey as U}from"./naming/caseConversion.js";import{albDnsExportName as u,albHostedZoneIdExportName as d,cdnDomainExportName as g,bucketWebsiteEndpointExportName as x,bucketWebsiteHostedZoneIdExportName as F}from"./naming/targetExportNames.js";import{CAPACITY_SLOT_PATTERN as G,CAPACITY_SLOT_MAX_LENGTH as H,DEFAULT_CAPACITY_SLOT as V,CAPACITY_ANCHOR_PATTERN as Y,CAPACITY_ANCHOR_MAX_LENGTH as y,CAPACITY_IDENTITY_CONTEXT_KEY as v,CapacityIdentityPinSchema as K,CapacityIdentityWireSchema as X,CapacityIdentityConfigSchema as b,projectCapacityIdentityToTarget as B}from"./capacityIdentity.js";import{findAccountNameCollision as k}from"./naming/accountNameCollision.js";import{defaultConnectedAccountName as Z,suffixedAccountName as j,REGION_SHORT_CODES as w,findTrailingRegionShortCode as z,regionSuffixRejectionMessage as Q}from"./naming/connectedAccountName.js";import{normaliseError as $,getErrorMessage as ee,hasErrorCode as Ee,getErrorCode as re,getErrorStack as _e,formatErrorString as te}from"./errorUtils.js";import{singleton as Se}from"./async/singleton.js";import{DANGEROUS_ENV_VARS as Te,filterDangerousEnvVars as ae,MASKED_VALUE_MARKER as Ne,maskSensitiveOutput as Re,parseShellArgs as ne,REDACTED_KEY_SENTINEL as ie,SCOPED_TOKEN_REGEX as me}from"./securityHelpers.js";import{sleep as Ce}from"./async/sleep.js";import{mapSettledWithConcurrency as Ie}from"./async/concurrency.js";import{ACCOUNT_STAGES_WITH_ROOT as pe,STRUCTURAL_ENVIRONMENTS as Le,ACCOUNT_STAGES as De,ACCOUNT_STAGE_LABELS as ce,isAccountStage as Me,ACCOUNT_TIERS as fe,AccountTierSchema as Ue,isAccountTier as le,GOVERNANCE_ACCOUNT_TIERS as ue,isGovernanceTier as de,environmentToTier as ge,stageFromWireEnvironment as xe,accountTier as Fe,resolveSynthEnvironment as he,getEnvironmentLabel as Ge,ACCOUNT_ROLES as He}from"./environments.js";import{RESOURCE_CATEGORIES as Ye,categoriseResource as ye,getExpectedDuration as ve,getFriendlyResourceType as Ke}from"./resourceCategorisation.js";import{parseGitRemoteUrl as be}from"./repo/gitRemoteParser.js";import{abbreviateRegion as We,AWS_REGIONS_METADATA as ke,DEFAULT_REGION as Je,getRegionInfo as Ze,MAX_SECONDARY_REGIONS as je,OPT_IN_REGION_CODES as we,optInRegionWarning as ze,regions as Qe,suggestRegionForTimezone as qe}from"./infra/regions.js";import{SCOPE_VALUES as eE,MACHINE_ONLY_SCOPES as EE,USER_GRANTABLE_SCOPES as rE,GOVERNANCE_SCOPE_REQUIRED_CODE as _E}from"./infra/tokenScopes.js";import{SECRET_NAME_PATTERN as oE,SECRET_NAME_ERROR as SE,SSM_COMPONENT_PATTERN as AE,SSM_COMPONENT_ERROR as TE,SSM_STANDARD_MAX_VALUE_BYTES as aE,SecretNamespaceSchema as NE,buildNamespaceParts as RE,buildParameterPath as nE,parseParameterPath as iE,isManageablePath as mE,parseDotEnv as OE,escapeDotEnvValue as CE}from"./secrets.js";import{ConnectionWireSchema as IE,ConnectionsListResponseSchema as sE,CONNECTION_PHASES as pE,CONNECTION_TERMINAL_FAILURE_PHASES as LE,CONNECTION_FAILURE_REASONS as DE,EXTERNAL_ID_PATTERN as cE}from"./infra/connectionsWire.js";import{PUBLIC_PACKAGE_NAME as fE,INSTALL_SOURCES as UE,SETUP_COMMANDS as lE,upgradeCommand as uE,SETUP_MODES as dE,SETUP_STEP_IDS as gE,SETUP_STEPS as xE,AGENT_SETUP_PROMPTS as FE,AGENT_INSTALL_COMMAND as hE,SKILL_INSTALL_SEGMENTS as GE,SKILL_INSTALL_FILENAME as HE,SKILL_INSTALL_PATH as VE}from"./onboarding/index.js";import{deriveRegionsFromOrgConfig as yE,deriveTargets as vE,deriveAllTargets as KE,environmentOrTier as XE,findTarget as bE,generateTargetName as BE}from"./targets.js";import{buildAppConfigPath as kE}from"./repo/appPath.js";import{findInfrastructurePaths as ZE,findBoundaryPath as jE,isInfrastructureFile as wE}from"./repo/findInfrastructurePaths.js";import{inferContainerFromCandidates as QE}from"./repo/inferContainerFromCandidates.js";import{RESERVED_APP_NAMES as $E,RESERVED_APP_NAME_MESSAGE as er,isReservedAppName as Er,RESERVED_APP_NAME_SUFFIX as rr,RESERVED_APP_NAME_SUFFIX_MESSAGE as _r,hasReservedAppNameSuffix as tr}from"./naming/reservedAppNames.js";import{deriveContentHashTag as Sr,CONTENT_HASH_TAG_PATTERN as Ar}from"./infra/deriveContentHashTag.js";import{DEPLOY_MODES as ar,DeployModeSchema as Nr,IMAGE_TAG_PATTERN as Rr,ImageTagSchema as nr,ServiceArtefactSchema as ir,ServiceArtefactsSchema as mr,ARTEFACT_OUTPUT_FIELDS as Or,artefactOutputKey as Cr}from"./infra/deployArtefacts.js";import{MIGRATION_SNAPSHOT_NAME_PREFIX as Ir,EXPECTED_SCHEMA_VERSION_ENV as sr,EXPECTED_SCHEMA_VERSION_TOOL_ENV as pr,EXPECTED_CH_SCHEMA_VERSION_ENV as Lr,SCHEMA_ADMIN_USER_ENV as Dr,SCHEMA_ADMIN_PASSWORD_ENV as cr,PRISMA_MIGRATION_DIR_RE as Mr,CLICKHOUSE_MIGRATION_SKIP_RE as fr}from"./migration/constants.js";import{SCHEMA_GATE_EXIT as lr,SCHEMA_GATE_EXIT_HINTS as ur,schemaGateExitKind as dr}from"./migration/schemaGateExit.js";import{FJALL_SCHEMA_GATE_USER as xr,FJALL_MAINTENANCE_USER as Fr,FJALL_CLICKHOUSE_USERS as hr}from"./migration/clickhouseFrameworkUsers.js";import{PHYSICAL_NAME_FALLBACK_PROPERTIES as Hr}from"./cfn/physicalNameProperties.js";import{PATTERN_TYPE_VALUES as Yr,PATTERN_TYPES as yr,isPatternType as vr,PATTERN_REGISTRY as Kr,patternConstructId as Xr,DEPLOYABLE_PATTERN_TYPES as br,OPENNEXT_PATTERN_TYPES as Br,isOpenNextPatternType as Wr,STATIC_SITE_ROUTING_VALUES as kr}from"./patterns/patternTypes.js";import{DEFAULT_FORMS_FROM_LOCAL_PART as Zr,defaultFormsFromAddress as jr,defaultFormsCorsOrigin as wr,isAddressAtDomain as zr}from"./patterns/staticSiteForms.js";import{DEV_SUBSTRATE_PARAMS_SCHEMA_VERSION as qr,DEV_SUBSTRATE_PARAMS_FILENAME as $r,DevSubstrateSynthPropsSchema as e_,DevSubstrateParamsSchema as E_}from"./devSubstrate/params.js";import{DEV_SUBSTRATE_ENTRYPOINT_SOURCE as __}from"./devSubstrate/entrypoint.js";import{BLESSED_CDK_TOOLCHAIN as o_}from"./cdkToolchain.js";import{DEPLOYMENT_FAILURE_PHASES as A_,DeploymentFailurePhaseSchema as T_,DEPLOYMENT_FAULT_ATTRIBUTIONS as a_,DeploymentFaultAttributionSchema as N_,DEPLOYMENT_FAILURE_PROVIDER_SOURCES as R_,DeploymentFailureProviderSourceSchema as n_,DEPLOYMENT_FAILURE_CODE_PATTERN as i_,DEPLOYMENT_FAILURE_SCHEMA_VERSION as m_,DEPLOYMENT_FAILURE_LIMITS as O_,DeploymentFailureAnalysisSchema as C_,DeploymentFailureProviderSchema as P_,DeploymentFailureResourceSchema as I_,DeploymentFailureSchema as s_,parseDeploymentFailure as p_,DEPLOYMENT_FAILURE_DOCS_BASE_URL as L_,deploymentFailureDocsUrl as D_,DEPLOYMENT_FAULT_COPY as c_,DEPLOYMENT_PROVIDER_LABELS as M_,deriveErrorMessageFromFailure as f_,toDeploymentFailureAnalysis as U_}from"./failure/deploymentFailure.js";import{extractErrorWindow as u_,ERROR_WINDOW_CONTEXT_LINES as d_}from"./failure/extractErrorWindow.js";export{He as ACCOUNT_ROLES,De as ACCOUNT_STAGES,pe as ACCOUNT_STAGES_WITH_ROOT,ce as ACCOUNT_STAGE_LABELS,fe as ACCOUNT_TIERS,hE as AGENT_INSTALL_COMMAND,FE as AGENT_SETUP_PROMPTS,m as APPROVAL_TOKEN_OUTPUT_PREFIX,Or as ARTEFACT_OUTPUT_FIELDS,ke as AWS_REGIONS_METADATA,Ue as AccountTierSchema,n as BACKUP_VAULT_NAME,o_ as BLESSED_CDK_TOOLCHAIN,y as CAPACITY_ANCHOR_MAX_LENGTH,Y as CAPACITY_ANCHOR_PATTERN,v as CAPACITY_IDENTITY_CONTEXT_KEY,H as CAPACITY_SLOT_MAX_LENGTH,G as CAPACITY_SLOT_PATTERN,fr as CLICKHOUSE_MIGRATION_SKIP_RE,DE as CONNECTION_FAILURE_REASONS,pE as CONNECTION_PHASES,LE as CONNECTION_TERMINAL_FAILURE_PHASES,Ar as CONTENT_HASH_TAG_PATTERN,b as CapacityIdentityConfigSchema,K as CapacityIdentityPinSchema,X as CapacityIdentityWireSchema,IE as ConnectionWireSchema,sE as ConnectionsListResponseSchema,Te as DANGEROUS_ENV_VARS,V as DEFAULT_CAPACITY_SLOT,Zr as DEFAULT_FORMS_FROM_LOCAL_PART,Je as DEFAULT_REGION,br as DEPLOYABLE_PATTERN_TYPES,i_ as DEPLOYMENT_FAILURE_CODE_PATTERN,L_ as DEPLOYMENT_FAILURE_DOCS_BASE_URL,O_ as DEPLOYMENT_FAILURE_LIMITS,A_ as DEPLOYMENT_FAILURE_PHASES,R_ as DEPLOYMENT_FAILURE_PROVIDER_SOURCES,m_ as DEPLOYMENT_FAILURE_SCHEMA_VERSION,a_ as DEPLOYMENT_FAULT_ATTRIBUTIONS,c_ as DEPLOYMENT_FAULT_COPY,M_ as DEPLOYMENT_PROVIDER_LABELS,ar as DEPLOY_MODES,__ as DEV_SUBSTRATE_ENTRYPOINT_SOURCE,$r as DEV_SUBSTRATE_PARAMS_FILENAME,qr as DEV_SUBSTRATE_PARAMS_SCHEMA_VERSION,r as DNS_APEX,N as DOMAIN_DEPLOY_DEFAULT_PHASE,Nr as DeployModeSchema,C_ as DeploymentFailureAnalysisSchema,T_ as DeploymentFailurePhaseSchema,P_ as DeploymentFailureProviderSchema,n_ as DeploymentFailureProviderSourceSchema,I_ as DeploymentFailureResourceSchema,s_ as DeploymentFailureSchema,N_ as DeploymentFaultAttributionSchema,E_ as DevSubstrateParamsSchema,e_ as DevSubstrateSynthPropsSchema,d_ as ERROR_WINDOW_CONTEXT_LINES,Lr as EXPECTED_CH_SCHEMA_VERSION_ENV,sr as EXPECTED_SCHEMA_VERSION_ENV,pr as EXPECTED_SCHEMA_VERSION_TOOL_ENV,cE as EXTERNAL_ID_PATTERN,hr as FJALL_CLICKHOUSE_USERS,Fr as FJALL_MAINTENANCE_USER,xr as FJALL_SCHEMA_GATE_USER,ue as GOVERNANCE_ACCOUNT_TIERS,_E as GOVERNANCE_SCOPE_REQUIRED_CODE,T as HOSTS_OUTPUT_MAX_BYTES,Rr as IMAGE_TAG_PATTERN,UE as INSTALL_SOURCES,nr as ImageTagSchema,EE as MACHINE_ONLY_SCOPES,Ne as MASKED_VALUE_MARKER,je as MAX_SECONDARY_REGIONS,Ir as MIGRATION_SNAPSHOT_NAME_PREFIX,Br as OPENNEXT_PATTERN_TYPES,we as OPT_IN_REGION_CODES,Kr as PATTERN_REGISTRY,yr as PATTERN_TYPES,Yr as PATTERN_TYPE_VALUES,Hr as PHYSICAL_NAME_FALLBACK_PROPERTIES,Mr as PRISMA_MIGRATION_DIR_RE,fE as PUBLIC_PACKAGE_NAME,ie as REDACTED_KEY_SENTINEL,w as REGION_SHORT_CODES,$E as RESERVED_APP_NAMES,er as RESERVED_APP_NAME_MESSAGE,rr as RESERVED_APP_NAME_SUFFIX,_r as RESERVED_APP_NAME_SUFFIX_MESSAGE,Ye as RESOURCE_CATEGORIES,cr as SCHEMA_ADMIN_PASSWORD_ENV,Dr as SCHEMA_ADMIN_USER_ENV,lr as SCHEMA_GATE_EXIT,ur as SCHEMA_GATE_EXIT_HINTS,me as SCOPED_TOKEN_REGEX,eE as SCOPE_VALUES,SE as SECRET_NAME_ERROR,oE as SECRET_NAME_PATTERN,lE as SETUP_COMMANDS,dE as SETUP_MODES,xE as SETUP_STEPS,gE as SETUP_STEP_IDS,HE as SKILL_INSTALL_FILENAME,VE as SKILL_INSTALL_PATH,GE as SKILL_INSTALL_SEGMENTS,TE as SSM_COMPONENT_ERROR,AE as SSM_COMPONENT_PATTERN,aE as SSM_STANDARD_MAX_VALUE_BYTES,kr as STATIC_SITE_ROUTING_VALUES,Le as STRUCTURAL_ENVIRONMENTS,NE as SecretNamespaceSchema,ir as ServiceArtefactSchema,mr as ServiceArtefactsSchema,O as TOKEN_STDERR_PREFIX,rE as USER_GRANTABLE_SCOPES,We as abbreviateRegion,f as accountConstructKey,Fe as accountTier,u as albDnsExportName,d as albHostedZoneIdExportName,Cr as artefactOutputKey,x as bucketWebsiteEndpointExportName,F as bucketWebsiteHostedZoneIdExportName,kE as buildAppConfigPath,RE as buildNamespaceParts,nE as buildParameterPath,c as capitalise,ye as categoriseResource,g as cdnDomainExportName,Z as defaultConnectedAccountName,wr as defaultFormsCorsOrigin,jr as defaultFormsFromAddress,D_ as deploymentFailureDocsUrl,KE as deriveAllTargets,Sr as deriveContentHashTag,f_ as deriveErrorMessageFromFailure,yE as deriveRegionsFromOrgConfig,vE as deriveTargets,XE as environmentOrTier,ge as environmentToTier,CE as escapeDotEnvValue,u_ as extractErrorWindow,ae as filterDangerousEnvVars,k as findAccountNameCollision,jE as findBoundaryPath,ZE as findInfrastructurePaths,bE as findTarget,z as findTrailingRegionShortCode,te as formatErrorString,BE as generateTargetName,_ as getDomainExportNames,t as getDomainStackName,o as getDomainUsEast1CertificatesStackName,Ge as getEnvironmentLabel,re as getErrorCode,ee as getErrorMessage,_e as getErrorStack,ve as getExpectedDuration,Ke as getFriendlyResourceType,Ze as getRegionInfo,M as getSafeZoneName,U as hasAsciiStableConstructKey,Ee as hasErrorCode,tr as hasReservedAppNameSuffix,S as hostsExportPartName,P as imageTagParameterName,QE as inferContainerFromCandidates,Me as isAccountStage,le as isAccountTier,zr as isAddressAtDomain,de as isGovernanceTier,wE as isInfrastructureFile,mE as isManageablePath,a as isManagedDomainBinding,Wr as isOpenNextPatternType,vr as isPatternType,Er as isReservedAppName,Ie as mapSettledWithConcurrency,Re as maskSensitiveOutput,$ as normaliseError,ze as optInRegionWarning,p_ as parseDeploymentFailure,OE as parseDotEnv,be as parseGitRemoteUrl,iE as parseParameterPath,ne as parseShellArgs,Xr as patternConstructId,B as projectCapacityIdentityToTarget,Q as regionSuffixRejectionMessage,Qe as regions,he as resolveSynthEnvironment,dr as schemaGateExitKind,A as serialiseHostsChunks,Se as singleton,Ce as sleep,xe as stageFromWireEnvironment,j as suffixedAccountName,qe as suggestRegionForTimezone,U_ as toDeploymentFailureAnalysis,p as toKebab,s as toPascalCase,D as toScreamingSnake,L as toValidDatabaseName,uE as upgradeCommand};

package/dist/migration/clickhouseFrameworkUsers.d.ts

@@ -0,0 +1,80 @@
+/**
+ * Cross-package contract for the framework-owned ClickHouse identities —
+ * one SQL user per control-plane workload class, so no two classes ever
+ * contend for the same per-user concurrency cap.
+ *
+ * | identity             | holder(s)                              | rights                                   |
+ * | -------------------- | -------------------------------------- | ---------------------------------------- |
+ * | `schemaAdmin.name`   | migration task (XML, `ddl_admin`)      | full DDL; cap 1 = DDL single-flight      |
+ * | `fjall_schema_gate`  | materialised gate container            | `readonly=2`, SELECT on `_schema_migrations` only; NO per-user cap |
+ * | `fjall_maintenance`  | backup + optimise sidecars             | today's `ddl_admin` numbers (cap 1); OPTIMIZE / BACKUP / RESTORE / scratch DROP |
+ *
+ * Producer: `ClickHouseDatabase` mints a Secrets-Manager password per
+ * framework identity (OUTSIDE the customer `managedPasswords` set — these
+ * secrets are never injected into the ClickHouse service container, so
+ * adopting them changes no ClickHouse task definition) and
+ * `getMigrationContributions()` emits `CLICKHOUSE_FRAMEWORK_USERS` (a
+ * JSON-stringified array of the names below) plus a `USER_<NAME>_PASSWORD`
+ * import per identity on the migration task.
+ *
+ * Consumer: `@fjall/clickhouse § provisionFrameworkUsersFromEnv` runs as
+ * `schemaAdmin` from the pre-scale-up lifecycle hook — ordered ahead of every
+ * gate and sidecar — and issues the idempotent CREATE / ALTER / GRANT set for
+ * each identity, so the identities exist before anything authenticates as
+ * them. SQL-provisioned (not `users.xml`) deliberately: no ClickHouse
+ * restart, no `SYSTEM RELOAD USERS` race, zero outage on adoption.
+ *
+ * Coupled values — must move together per
+ * `.claude/rules/code-quality.md § "Coupled values: shared source at 2
+ * occurrences"`.
+ */
+import { z } from "zod";
+/** Read-only identity the materialised schema gate authenticates as. */
+export declare const FJALL_SCHEMA_GATE_USER: "fjall_schema_gate";
+/** Identity the backup + optimise maintenance sidecars authenticate as. */
+export declare const FJALL_MAINTENANCE_USER: "fjall_maintenance";
+/**
+ * Every framework-owned identity, in provisioning order. Derive from this —
+ * never re-list the names — so a new workload class lands in the manifest,
+ * the reserved-name validator, and the provisioning loop at once.
+ */
+export declare const FJALL_CLICKHOUSE_USERS: readonly ["fjall_schema_gate", "fjall_maintenance"];
+export type FjallClickHouseUser = (typeof FJALL_CLICKHOUSE_USERS)[number];
+/**
+ * Prefix reserved for framework identities. `ClickHouseDatabase` throws at
+ * synth when a customer `schemaAdmin.name` or `managedPasswords` entry
+ * starts with it, so a customer user can never collide with (or be silently
+ * re-provisioned as) a framework identity.
+ */
+export declare const FJALL_CLICKHOUSE_USER_PREFIX: "fjall_";
+export declare function isReservedClickHouseUserName(name: string): boolean;
+/**
+ * Container env var name carrying the JSON-stringified manifest of framework
+ * identities to provision. Sibling to `CLICKHOUSE_MANAGED_USERS` (customer
+ * users); kept separate because the two sets differ in ownership — the
+ * framework decides its identities' rights, customer SQL decides the managed
+ * users' profiles.
+ */
+export declare const CLICKHOUSE_FRAMEWORK_USERS_ENV: "CLICKHOUSE_FRAMEWORK_USERS";
+/**
+ * Container env var name carrying the settings-profile name the maintenance
+ * identity binds to — the construct contributes `schemaAdmin.profile` (the
+ * `ddl_admin` profile at the resolved instance's scale), so
+ * `fjall_maintenance` inherits today's memory / execution caps and tracks
+ * instance resizes without the runner knowing any numbers. The runner pins
+ * `max_concurrent_queries_for_user = 1 CONST` on top: a bare setting is a
+ * default the session can override, only `CONST` makes the cap binding.
+ */
+export declare const CLICKHOUSE_MAINTENANCE_PROFILE_ENV: "CLICKHOUSE_MAINTENANCE_PROFILE";
+export declare const FrameworkUserNameSchema: z.ZodString & z.ZodType<"fjall_schema_gate" | "fjall_maintenance", string, z.core.$ZodTypeInternals<"fjall_schema_gate" | "fjall_maintenance", string>>;
+export type FrameworkUserName = z.infer<typeof FrameworkUserNameSchema>;
+export declare const FrameworkUserNamesSchema: z.ZodArray<z.ZodString & z.ZodType<"fjall_schema_gate" | "fjall_maintenance", string, z.core.$ZodTypeInternals<"fjall_schema_gate" | "fjall_maintenance", string>>>;
+export type FrameworkUserNames = z.infer<typeof FrameworkUserNamesSchema>;
+/**
+ * Scratch database the backup sidecar restores into to verify a backup, and
+ * the only database `fjall_maintenance` may DROP. Coupled across the
+ * construct (backup script, IAM) and `@fjall/clickhouse` (the GRANT set) —
+ * a drift would grant DROP on a database the script never touches while the
+ * one it does touch fails with `ACCESS_DENIED`.
+ */
+export declare const CLICKHOUSE_BACKUP_SCRATCH_DATABASE: "fjall_backup_verify";

package/dist/migration/clickhouseFrameworkUsers.js

@@ -0,0 +1 @@
+var r=Object.defineProperty;var E=(e,o)=>r(e,"name",{value:o,configurable:!0});import{z as _}from"zod";import{MANAGED_USER_NAME_PATTERN as s}from"./clickhouseSqlUsers.js";const S="fjall_schema_gate",a="fjall_maintenance",t=[S,a],A="fjall_";function L(e){return e.startsWith(A)}E(L,"isReservedClickHouseUserName");const N="CLICKHOUSE_FRAMEWORK_USERS",m="CLICKHOUSE_MAINTENANCE_PROFILE",n=new Set(t),C=_.string().regex(s,"Must be lowercase snake_case").refine(e=>n.has(e),{message:`Must be one of ${t.join(", ")}`}),p=_.array(C),I="fjall_backup_verify";export{I as CLICKHOUSE_BACKUP_SCRATCH_DATABASE,N as CLICKHOUSE_FRAMEWORK_USERS_ENV,m as CLICKHOUSE_MAINTENANCE_PROFILE_ENV,t as FJALL_CLICKHOUSE_USERS,A as FJALL_CLICKHOUSE_USER_PREFIX,a as FJALL_MAINTENANCE_USER,S as FJALL_SCHEMA_GATE_USER,C as FrameworkUserNameSchema,p as FrameworkUserNamesSchema,L as isReservedClickHouseUserName};

package/dist/migration/clickhouseFrameworkUsers.test.d.ts

@@ -0,0 +1 @@
+export {};

package/dist/migration/clickhouseFrameworkUsers.test.js

@@ -0,0 +1 @@
+import{describe as a,expect as e,it as s}from"vitest";import{CLICKHOUSE_FRAMEWORK_USERS_ENV as f,FJALL_CLICKHOUSE_USER_PREFIX as C,FJALL_CLICKHOUSE_USERS as c,FJALL_MAINTENANCE_USER as l,FJALL_SCHEMA_GATE_USER as h,FrameworkUserNamesSchema as d,isReservedClickHouseUserName as n}from"./clickhouseFrameworkUsers.js";import{MANAGED_USER_NAME_PATTERN as A}from"./clickhouseSqlUsers.js";import{CONTROL_PLANE_ACTIVITY_RECENCY_SECONDS as S,buildControlPlaneActivityQuery as r}from"./controlPlaneActivity.js";import{SCHEMA_GATE_EXIT as i,SCHEMA_GATE_EXIT_HINTS as y,schemaGateExitKind as m}from"./schemaGateExit.js";import{sleepAbortable as E}from"./sleepAbortable.js";a("framework ClickHouse identities",()=>{s("every framework identity carries the reserved prefix and is a valid SQL name",()=>{for(const t of c)e(n(t)).toBe(!0),e(t).toMatch(A);e(c).toEqual([h,l])}),s("customer names outside the prefix are not reserved",()=>{e(n("schema_admin")).toBe(!1),e(n("backup_reader")).toBe(!1),e(n(`${C}x`)).toBe(!0)}),s("the manifest schema accepts only framework identities",()=>{e(d.safeParse([...c]).success).toBe(!0),e(d.safeParse(["fjall_other"]).success).toBe(!1),e(d.safeParse(["schema_admin"]).success).toBe(!1),e(f).toBe("CLICKHOUSE_FRAMEWORK_USERS")})}),a("schema gate exit taxonomy",()=>{s("codes are distinct and every kind has a hint",()=>{const t=Object.values(i);e(new Set(t).size).toBe(t.length);for(const o of Object.keys(i))e(y[o].length).toBeGreaterThan(0),e(m(i[o])).toBe(o)}),s("pins the wire values consumers already depend on",()=>{e(i).toEqual({pass:0,refused:1,configError:2,connectionError:3,busy:4,denied:5})}),s("returns undefined for codes the gate never emits",()=>{e(m(143)).toBeUndefined(),e(m(137)).toBeUndefined()})}),a("buildControlPlaneActivityQuery",()=>{s("probes both live processes and recent query_log for the named users",()=>{const t=r({users:["schema_admin",l]});e(t).toContain("FROM system.processes WHERE user IN ('schema_admin', 'fjall_maintenance')"),e(t).toContain("FROM system.query_log WHERE user IN ('schema_admin', 'fjall_maintenance')"),e(t).toContain(`INTERVAL ${S} SECOND`),e(t).toContain("type != 'QueryStart'"),e(t).toContain("event_date >= yesterday()"),e(t.trim().endsWith("AS active")).toBe(!0)}),s("honours a recency override",()=>{e(r({users:["schema_admin"],recencySeconds:5})).toContain("INTERVAL 5 SECOND")}),s("rejects names that could smuggle quoting, empty user lists, and bad recency",()=>{e(()=>r({users:["x' OR 1=1 --"]})).toThrow(/Invalid ClickHouse user name/),e(()=>r({users:[]})).toThrow(/at least one user/),e(()=>r({users:["a"],recencySeconds:0})).toThrow(/positive integer/)})}),a("sleepAbortable",()=>{s("resolves immediately on an already-aborted signal and on abort mid-sleep",async()=>{const t=new AbortController;t.abort(),await e(E(6e4,t.signal)).resolves.toBeUndefined();const o=new AbortController,u=Date.now(),_=E(6e4,o.signal);o.abort(),await _,e(Date.now()-u).toBeLessThan(1e3)})});

package/dist/migration/constants.d.ts

@@ -36,13 +36,13 @@ export declare const EXPECTED_SCHEMA_VERSION_TOOL_ENV: "EXPECTED_SCHEMA_VERSION_
 export declare const EXPECTED_CH_SCHEMA_VERSION_ENV: "EXPECTED_CH_SCHEMA_VERSION";
 /**
  * Container env / secret names for the ClickHouse schema-admin user contributed
- * by `ClickHouseDatabase`. Both the migration task AND every connected service
- * whose `connections:` includes a migration-declaring CH database receive
- * these, so the boot-time schema gate can authenticate against
- * `_schema_migrations`. Drift between the framework injection site, the
- * migration runner, and the boot gate would mask a missing-credential failure
- * as a generic "schema version mismatch" — hoisted to one site so all three
- * always read from the same name.
+ * by `ClickHouseDatabase`. Injected ONLY into the migration task (the sole
+ * DDL principal) — never into app containers, the gate container, or the
+ * maintenance sidecars, each of which authenticates as its own workload-class
+ * identity (see `clickhouseFrameworkUsers.ts`). One XML principal shared by
+ * six holders under a `max_concurrent_queries_for_user = 1` cap was the
+ * 2026-08-25 deploy-rollback incident: a gate probe lost the slot to the
+ * scheduled OPTIMIZE and reported the server "unreachable".
  */
 export declare const SCHEMA_ADMIN_USER_ENV: "SCHEMA_ADMIN_USER";
 export declare const SCHEMA_ADMIN_PASSWORD_ENV: "SCHEMA_ADMIN_PASSWORD";
@@ -76,6 +76,28 @@ export declare const SCHEMA_GATE_DB_PASSWORD_ENV: "FJALL_SCHEMA_GATE_DB_PASSWORD
 export declare const SCHEMA_GATE_CH_URL_ENV: "CLICKHOUSE_URL";
 export declare const SCHEMA_GATE_CH_DATABASE_ENV: "CLICKHOUSE_DATABASE";
 export declare const SCHEMA_GATE_CH_CA_CERT_ENV: "CLICKHOUSE_CA_CERT";
+/**
+ * ClickHouse credential env names for the gate container's CH half. The
+ * value of `SCHEMA_GATE_CH_USER_ENV` is always `FJALL_SCHEMA_GATE_USER` (the
+ * read-only gate identity), and `SCHEMA_GATE_CH_PASSWORD_ENV` is a
+ * Secrets-Manager import of that identity's password. Named in the
+ * `FJALL_SCHEMA_GATE_*` family alongside the Postgres trio so a reader of the
+ * task definition sees one gate contract, not a gate half and a borrowed
+ * admin half.
+ */
+export declare const SCHEMA_GATE_CH_USER_ENV: "FJALL_SCHEMA_GATE_CH_USER";
+export declare const SCHEMA_GATE_CH_PASSWORD_ENV: "FJALL_SCHEMA_GATE_CH_PASSWORD";
+/**
+ * ECS `startTimeout` for the synthetic gate container — the ceiling ECS
+ * allows the gate to reach its exit before the task is stopped as a failed
+ * start. The gate runner derives its own retry budget FROM this value (it
+ * must finish, with a verdict, comfortably inside it), so the two are coupled
+ * across the construct↔runner boundary: a construct that raised the timeout
+ * without the runner widening its budget would leave headroom unused; a
+ * runner budget exceeding the timeout would be cut off mid-retry with no
+ * verdict at all. Hoisted so both read one number.
+ */
+export declare const SCHEMA_GATE_START_TIMEOUT_SECONDS: 120;
 /**
  * The synthetic gate container's reserved name. Shared between the construct
  * (container synthesis + the name-collision validator in `validateEcsProps`)

package/dist/migration/constants.js

@@ -1 +1 @@
-const E="fjall-premigrate",_="EXPECTED_SCHEMA_VERSION",A="EXPECTED_SCHEMA_VERSION_TOOL",S="EXPECTED_CH_SCHEMA_VERSION",C="SCHEMA_ADMIN_USER",t="SCHEMA_ADMIN_PASSWORD",o="FJALL_SCHEMA_GATE_DB_URL_BASE",M="FJALL_SCHEMA_GATE_DB_USER",R="FJALL_SCHEMA_GATE_DB_PASSWORD",H="CLICKHOUSE_URL",I="CLICKHOUSE_DATABASE",N="CLICKHOUSE_CA_CERT",T="fjall-schema-gate",e="fjall/schema-gate",O="public.ecr.aws/fjall/schema-gate",s=/^\d{14}_/,c=/\.dev\.sql$/,D=/\.sql$/;export{D as CLICKHOUSE_MIGRATION_FILE_RE,c as CLICKHOUSE_MIGRATION_SKIP_RE,S as EXPECTED_CH_SCHEMA_VERSION_ENV,_ as EXPECTED_SCHEMA_VERSION_ENV,A as EXPECTED_SCHEMA_VERSION_TOOL_ENV,E as MIGRATION_SNAPSHOT_NAME_PREFIX,s as PRISMA_MIGRATION_DIR_RE,t as SCHEMA_ADMIN_PASSWORD_ENV,C as SCHEMA_ADMIN_USER_ENV,N as SCHEMA_GATE_CH_CA_CERT_ENV,I as SCHEMA_GATE_CH_DATABASE_ENV,H as SCHEMA_GATE_CH_URL_ENV,T as SCHEMA_GATE_CONTAINER_NAME,R as SCHEMA_GATE_DB_PASSWORD_ENV,o as SCHEMA_GATE_DB_URL_BASE_ENV,M as SCHEMA_GATE_DB_USER_ENV,e as SCHEMA_GATE_ECR_REPO_NAME,O as SCHEMA_GATE_PUBLIC_IMAGE_REPO};
+const _="fjall-premigrate",E="EXPECTED_SCHEMA_VERSION",A="EXPECTED_SCHEMA_VERSION_TOOL",S="EXPECTED_CH_SCHEMA_VERSION",C="SCHEMA_ADMIN_USER",t="SCHEMA_ADMIN_PASSWORD",o="FJALL_SCHEMA_GATE_DB_URL_BASE",H="FJALL_SCHEMA_GATE_DB_USER",M="FJALL_SCHEMA_GATE_DB_PASSWORD",R="CLICKHOUSE_URL",T="CLICKHOUSE_DATABASE",N="CLICKHOUSE_CA_CERT",I="FJALL_SCHEMA_GATE_CH_USER",e="FJALL_SCHEMA_GATE_CH_PASSWORD",O=120,s="fjall-schema-gate",c="fjall/schema-gate",D="public.ecr.aws/fjall/schema-gate",r=/^\d{14}_/,p=/\.dev\.sql$/,L=/\.sql$/;export{L as CLICKHOUSE_MIGRATION_FILE_RE,p as CLICKHOUSE_MIGRATION_SKIP_RE,S as EXPECTED_CH_SCHEMA_VERSION_ENV,E as EXPECTED_SCHEMA_VERSION_ENV,A as EXPECTED_SCHEMA_VERSION_TOOL_ENV,_ as MIGRATION_SNAPSHOT_NAME_PREFIX,r as PRISMA_MIGRATION_DIR_RE,t as SCHEMA_ADMIN_PASSWORD_ENV,C as SCHEMA_ADMIN_USER_ENV,N as SCHEMA_GATE_CH_CA_CERT_ENV,T as SCHEMA_GATE_CH_DATABASE_ENV,e as SCHEMA_GATE_CH_PASSWORD_ENV,R as SCHEMA_GATE_CH_URL_ENV,I as SCHEMA_GATE_CH_USER_ENV,s as SCHEMA_GATE_CONTAINER_NAME,M as SCHEMA_GATE_DB_PASSWORD_ENV,o as SCHEMA_GATE_DB_URL_BASE_ENV,H as SCHEMA_GATE_DB_USER_ENV,c as SCHEMA_GATE_ECR_REPO_NAME,D as SCHEMA_GATE_PUBLIC_IMAGE_REPO,O as SCHEMA_GATE_START_TIMEOUT_SECONDS};

package/dist/migration/controlPlaneActivity.d.ts

@@ -0,0 +1,58 @@
+/**
+ * ClickHouse-native activity probe for the migrate ↔ maintenance mutex.
+ *
+ * The migration task (Compute stack) and the maintenance sidecars (Database
+ * stack) cannot see each other through ECS — the Database stack is deployed
+ * first and cannot reference the Compute stack — so the mutual exclusion is
+ * observed through the server both already talk to: `system.processes`
+ * (queries running right now) plus `system.query_log` recency (a query that
+ * finished within the last `recencySeconds`). Each side asks about the OTHER
+ * control-plane identity and defers while it is active:
+ *
+ * - the maintenance wrapper asks about `schemaAdmin.name` before OPTIMIZE /
+ *   BACKUP and exits `deferred` (exit 0, metric) when a migration is under way;
+ * - the migration runner asks about `fjall_maintenance` before its ClickHouse
+ *   phase and waits (bounded, abort-aware) for the sidecar to go idle.
+ *
+ * The recency window closes the gap between one statement of a multi-
+ * statement job finishing and the next one starting (there is no process
+ * row in between). Both sides read the same builder so the two halves of
+ * the mutex cannot drift in what "active" means.
+ *
+ * `system.query_log` is flushed on an interval (7500 ms in the constructs'
+ * server config), so the recency signal lands up to one flush late; the
+ * residual window is the sub-second gap between a process row vanishing and
+ * its finish row landing, and the two identities carry separate concurrency
+ * caps, so a probe that slips through it costs contention, never a 202. Two
+ * server-side preconditions keep the recency half honest: the table only
+ * exists after the first flush (a brand-new server answers `Code: 60` until
+ * then — the probe's own queries create it inside one interval, which is why
+ * `awaitControlPlaneIdle` keeps polling through non-denied errors), and
+ * `log_queries_min_query_duration_ms` must stay 0 (see `clickhouseTuning`),
+ * else short control-plane statements never reach the log at all.
+ *
+ * The caller's own identity is never in `users`, so no self-exclusion is
+ * needed; the probe is a plain SELECT the gate/maintenance/admin identities
+ * are all granted on `system.processes` and `system.query_log`.
+ */
+/**
+ * How long after a control-plane query completes the identity is still
+ * considered active. Long enough to bridge a sidecar's per-statement gaps
+ * (the backup script runs DROP → BACKUP → RESTORE back-to-back), short
+ * enough that a finished job releases the mutex well inside one deploy.
+ */
+export declare const CONTROL_PLANE_ACTIVITY_RECENCY_SECONDS: 120;
+export interface ControlPlaneActivityQueryOpts {
+    /** Identities to test for activity — the OTHER side of the mutex. */
+    users: readonly string[];
+    /** Overrides `CONTROL_PLANE_ACTIVITY_RECENCY_SECONDS`. */
+    recencySeconds?: number;
+}
+/**
+ * Builds a single-row `SELECT active` returning `1` when any of `users` has
+ * a running query or finished one within the recency window, else `0`.
+ * Names are validated against the managed-user pattern before interpolation
+ * — the only quoting the SQL needs — so a name that could carry a quote
+ * never reaches the string.
+ */
+export declare function buildControlPlaneActivityQuery(opts: ControlPlaneActivityQueryOpts): string;

package/dist/migration/controlPlaneActivity.js

@@ -0,0 +1,2 @@
+var s=Object.defineProperty;var o=(e,r)=>s(e,"name",{value:r,configurable:!0});import{MANAGED_USER_NAME_PATTERN as i}from"./clickhouseSqlUsers.js";const E=120;function y(e){const r=e.recencySeconds??E;if(!Number.isInteger(r)||r<=0)throw new Error(`recencySeconds must be a positive integer, got ${String(r)}`);if(e.users.length===0)throw new Error("buildControlPlaneActivityQuery needs at least one user");for(const t of e.users)if(!i.test(t))throw new Error(`Invalid ClickHouse user name for activity probe: ${t}`);const n=e.users.map(t=>`'${t}'`).join(", ");return["SELECT toUInt8(",`  (SELECT count() FROM system.processes WHERE user IN (${n})) > 0`,"  OR",`  (SELECT count() FROM system.query_log WHERE user IN (${n})`,"     AND event_date >= yesterday()","     AND type != 'QueryStart'",`     AND event_time >= now() - INTERVAL ${r} SECOND) > 0`,") AS active"].join(`
+`)}o(y,"buildControlPlaneActivityQuery");export{E as CONTROL_PLANE_ACTIVITY_RECENCY_SECONDS,y as buildControlPlaneActivityQuery};

package/dist/migration/index.d.ts

@@ -1,6 +1,10 @@
-export { MIGRATION_SNAPSHOT_NAME_PREFIX, EXPECTED_SCHEMA_VERSION_ENV, EXPECTED_SCHEMA_VERSION_TOOL_ENV, EXPECTED_CH_SCHEMA_VERSION_ENV, SCHEMA_ADMIN_USER_ENV, SCHEMA_ADMIN_PASSWORD_ENV, SCHEMA_GATE_DB_URL_BASE_ENV, SCHEMA_GATE_DB_USER_ENV, SCHEMA_GATE_DB_PASSWORD_ENV, SCHEMA_GATE_CH_URL_ENV, SCHEMA_GATE_CH_DATABASE_ENV, SCHEMA_GATE_CH_CA_CERT_ENV, SCHEMA_GATE_CONTAINER_NAME, SCHEMA_GATE_ECR_REPO_NAME, SCHEMA_GATE_PUBLIC_IMAGE_REPO, PRISMA_MIGRATION_DIR_RE, CLICKHOUSE_MIGRATION_SKIP_RE } from "./constants.js";
+export { MIGRATION_SNAPSHOT_NAME_PREFIX, EXPECTED_SCHEMA_VERSION_ENV, EXPECTED_SCHEMA_VERSION_TOOL_ENV, EXPECTED_CH_SCHEMA_VERSION_ENV, SCHEMA_ADMIN_USER_ENV, SCHEMA_ADMIN_PASSWORD_ENV, SCHEMA_GATE_DB_URL_BASE_ENV, SCHEMA_GATE_DB_USER_ENV, SCHEMA_GATE_DB_PASSWORD_ENV, SCHEMA_GATE_CH_URL_ENV, SCHEMA_GATE_CH_DATABASE_ENV, SCHEMA_GATE_CH_CA_CERT_ENV, SCHEMA_GATE_CH_USER_ENV, SCHEMA_GATE_CH_PASSWORD_ENV, SCHEMA_GATE_START_TIMEOUT_SECONDS, SCHEMA_GATE_CONTAINER_NAME, SCHEMA_GATE_ECR_REPO_NAME, SCHEMA_GATE_PUBLIC_IMAGE_REPO, PRISMA_MIGRATION_DIR_RE, CLICKHOUSE_MIGRATION_SKIP_RE } from "./constants.js";
 export { pickLatestPrismaMigration } from "./pickLatestPrismaMigration.js";
 export { pickLatestClickHouseMigration } from "./pickLatestClickHouseMigration.js";
 export { isOrderableSchemaVersion, isSchemaVersionSatisfied } from "./compareSchemaVersion.js";
 export { type MigrationsSqlClient, type VerifyExpectedSchemaVersionOpts, type VerifyExpectedSchemaVersionResult, verifyExpectedSchemaVersion } from "./verifyExpectedSchemaVersion.js";
 export { CLICKHOUSE_MANAGED_USERS_ENV, MANAGED_USER_NAME_PATTERN, userPasswordEnvName, ManagedUserNameSchema, ManagedUserNamesSchema, type ManagedUserName, type ManagedUserNames } from "./clickhouseSqlUsers.js";
+export { FJALL_SCHEMA_GATE_USER, FJALL_MAINTENANCE_USER, FJALL_CLICKHOUSE_USERS, FJALL_CLICKHOUSE_USER_PREFIX, isReservedClickHouseUserName, CLICKHOUSE_FRAMEWORK_USERS_ENV, CLICKHOUSE_MAINTENANCE_PROFILE_ENV, CLICKHOUSE_BACKUP_SCRATCH_DATABASE, FrameworkUserNameSchema, FrameworkUserNamesSchema, type FjallClickHouseUser, type FrameworkUserName, type FrameworkUserNames } from "./clickhouseFrameworkUsers.js";
+export { SCHEMA_GATE_EXIT, SCHEMA_GATE_EXIT_HINTS, schemaGateExitKind, type SchemaGateExitKind, type SchemaGateExitCode } from "./schemaGateExit.js";
+export { CONTROL_PLANE_ACTIVITY_RECENCY_SECONDS, buildControlPlaneActivityQuery, type ControlPlaneActivityQueryOpts } from "./controlPlaneActivity.js";
+export { sleepAbortable } from "./sleepAbortable.js";

package/dist/migration/index.js

@@ -1 +1 @@
-import{MIGRATION_SNAPSHOT_NAME_PREFIX as A,EXPECTED_SCHEMA_VERSION_ENV as S,EXPECTED_SCHEMA_VERSION_TOOL_ENV as N,EXPECTED_CH_SCHEMA_VERSION_ENV as e,SCHEMA_ADMIN_USER_ENV as C,SCHEMA_ADMIN_PASSWORD_ENV as M,SCHEMA_GATE_DB_URL_BASE_ENV as r,SCHEMA_GATE_DB_USER_ENV as R,SCHEMA_GATE_DB_PASSWORD_ENV as H,SCHEMA_GATE_CH_URL_ENV as T,SCHEMA_GATE_CH_DATABASE_ENV as a,SCHEMA_GATE_CH_CA_CERT_ENV as I,SCHEMA_GATE_CONTAINER_NAME as o,SCHEMA_GATE_ECR_REPO_NAME as V,SCHEMA_GATE_PUBLIC_IMAGE_REPO as O,PRISMA_MIGRATION_DIR_RE as i,CLICKHOUSE_MIGRATION_SKIP_RE as s}from"./constants.js";import{pickLatestPrismaMigration as G}from"./pickLatestPrismaMigration.js";import{pickLatestClickHouseMigration as t}from"./pickLatestClickHouseMigration.js";import{isOrderableSchemaVersion as U,isSchemaVersionSatisfied as c}from"./compareSchemaVersion.js";import{verifyExpectedSchemaVersion as f}from"./verifyExpectedSchemaVersion.js";import{CLICKHOUSE_MANAGED_USERS_ENV as L,MANAGED_USER_NAME_PATTERN as x,userPasswordEnvName as d,ManagedUserNameSchema as B,ManagedUserNamesSchema as h}from"./clickhouseSqlUsers.js";export{L as CLICKHOUSE_MANAGED_USERS_ENV,s as CLICKHOUSE_MIGRATION_SKIP_RE,e as EXPECTED_CH_SCHEMA_VERSION_ENV,S as EXPECTED_SCHEMA_VERSION_ENV,N as EXPECTED_SCHEMA_VERSION_TOOL_ENV,x as MANAGED_USER_NAME_PATTERN,A as MIGRATION_SNAPSHOT_NAME_PREFIX,B as ManagedUserNameSchema,h as ManagedUserNamesSchema,i as PRISMA_MIGRATION_DIR_RE,M as SCHEMA_ADMIN_PASSWORD_ENV,C as SCHEMA_ADMIN_USER_ENV,I as SCHEMA_GATE_CH_CA_CERT_ENV,a as SCHEMA_GATE_CH_DATABASE_ENV,T as SCHEMA_GATE_CH_URL_ENV,o as SCHEMA_GATE_CONTAINER_NAME,H as SCHEMA_GATE_DB_PASSWORD_ENV,r as SCHEMA_GATE_DB_URL_BASE_ENV,R as SCHEMA_GATE_DB_USER_ENV,V as SCHEMA_GATE_ECR_REPO_NAME,O as SCHEMA_GATE_PUBLIC_IMAGE_REPO,U as isOrderableSchemaVersion,c as isSchemaVersionSatisfied,t as pickLatestClickHouseMigration,G as pickLatestPrismaMigration,d as userPasswordEnvName,f as verifyExpectedSchemaVersion};
+import{MIGRATION_SNAPSHOT_NAME_PREFIX as A,EXPECTED_SCHEMA_VERSION_ENV as S,EXPECTED_SCHEMA_VERSION_TOOL_ENV as C,EXPECTED_CH_SCHEMA_VERSION_ENV as e,SCHEMA_ADMIN_USER_ENV as N,SCHEMA_ADMIN_PASSWORD_ENV as r,SCHEMA_GATE_DB_URL_BASE_ENV as T,SCHEMA_GATE_DB_USER_ENV as M,SCHEMA_GATE_DB_PASSWORD_ENV as R,SCHEMA_GATE_CH_URL_ENV as H,SCHEMA_GATE_CH_DATABASE_ENV as I,SCHEMA_GATE_CH_CA_CERT_ENV as o,SCHEMA_GATE_CH_USER_ENV as a,SCHEMA_GATE_CH_PASSWORD_ENV as O,SCHEMA_GATE_START_TIMEOUT_SECONDS as m,SCHEMA_GATE_CONTAINER_NAME as U,SCHEMA_GATE_ECR_REPO_NAME as s,SCHEMA_GATE_PUBLIC_IMAGE_REPO as t,PRISMA_MIGRATION_DIR_RE as L,CLICKHOUSE_MIGRATION_SKIP_RE as i}from"./constants.js";import{pickLatestPrismaMigration as G}from"./pickLatestPrismaMigration.js";import{pickLatestClickHouseMigration as D}from"./pickLatestClickHouseMigration.js";import{isOrderableSchemaVersion as p,isSchemaVersionSatisfied as f}from"./compareSchemaVersion.js";import{verifyExpectedSchemaVersion as n}from"./verifyExpectedSchemaVersion.js";import{CLICKHOUSE_MANAGED_USERS_ENV as F,MANAGED_USER_NAME_PATTERN as d,userPasswordEnvName as h,ManagedUserNameSchema as l,ManagedUserNamesSchema as B}from"./clickhouseSqlUsers.js";import{FJALL_SCHEMA_GATE_USER as k,FJALL_MAINTENANCE_USER as u,FJALL_CLICKHOUSE_USERS as b,FJALL_CLICKHOUSE_USER_PREFIX as g,isReservedClickHouseUserName as v,CLICKHOUSE_FRAMEWORK_USERS_ENV as J,CLICKHOUSE_MAINTENANCE_PROFILE_ENV as W,CLICKHOUSE_BACKUP_SCRATCH_DATABASE as w,FrameworkUserNameSchema as y,FrameworkUserNamesSchema as Y}from"./clickhouseFrameworkUsers.js";import{SCHEMA_GATE_EXIT as j,SCHEMA_GATE_EXIT_HINTS as q,schemaGateExitKind as z}from"./schemaGateExit.js";import{CONTROL_PLANE_ACTIVITY_RECENCY_SECONDS as $,buildControlPlaneActivityQuery as EE}from"./controlPlaneActivity.js";import{sleepAbortable as AE}from"./sleepAbortable.js";export{w as CLICKHOUSE_BACKUP_SCRATCH_DATABASE,J as CLICKHOUSE_FRAMEWORK_USERS_ENV,W as CLICKHOUSE_MAINTENANCE_PROFILE_ENV,F as CLICKHOUSE_MANAGED_USERS_ENV,i as CLICKHOUSE_MIGRATION_SKIP_RE,$ as CONTROL_PLANE_ACTIVITY_RECENCY_SECONDS,e as EXPECTED_CH_SCHEMA_VERSION_ENV,S as EXPECTED_SCHEMA_VERSION_ENV,C as EXPECTED_SCHEMA_VERSION_TOOL_ENV,b as FJALL_CLICKHOUSE_USERS,g as FJALL_CLICKHOUSE_USER_PREFIX,u as FJALL_MAINTENANCE_USER,k as FJALL_SCHEMA_GATE_USER,y as FrameworkUserNameSchema,Y as FrameworkUserNamesSchema,d as MANAGED_USER_NAME_PATTERN,A as MIGRATION_SNAPSHOT_NAME_PREFIX,l as ManagedUserNameSchema,B as ManagedUserNamesSchema,L as PRISMA_MIGRATION_DIR_RE,r as SCHEMA_ADMIN_PASSWORD_ENV,N as SCHEMA_ADMIN_USER_ENV,o as SCHEMA_GATE_CH_CA_CERT_ENV,I as SCHEMA_GATE_CH_DATABASE_ENV,O as SCHEMA_GATE_CH_PASSWORD_ENV,H as SCHEMA_GATE_CH_URL_ENV,a as SCHEMA_GATE_CH_USER_ENV,U as SCHEMA_GATE_CONTAINER_NAME,R as SCHEMA_GATE_DB_PASSWORD_ENV,T as SCHEMA_GATE_DB_URL_BASE_ENV,M as SCHEMA_GATE_DB_USER_ENV,s as SCHEMA_GATE_ECR_REPO_NAME,j as SCHEMA_GATE_EXIT,q as SCHEMA_GATE_EXIT_HINTS,t as SCHEMA_GATE_PUBLIC_IMAGE_REPO,m as SCHEMA_GATE_START_TIMEOUT_SECONDS,EE as buildControlPlaneActivityQuery,p as isOrderableSchemaVersion,v as isReservedClickHouseUserName,f as isSchemaVersionSatisfied,D as pickLatestClickHouseMigration,G as pickLatestPrismaMigration,z as schemaGateExitKind,AE as sleepAbortable,h as userPasswordEnvName,n as verifyExpectedSchemaVersion};

package/dist/migration/schemaGateExit.d.ts

@@ -0,0 +1,63 @@
+/**
+ * Exit taxonomy for the materialised schema-gate container
+ * (`@fjall/schema-gate`). The dependent app containers declare
+ * `dependsOn: [{ container: "fjall-schema-gate", condition: "SUCCESS" }]`, so
+ * ANY non-zero exit stops the task pre-RUNNING and counts toward the
+ * deployment circuit breaker — the codes exist for the forensic log and the
+ * deploy-time ECS tail, not for ECS itself.
+ *
+ * Lives in `@fjall/util` because three packages must agree on it: the gate
+ * runner emits the codes, `@fjall/deploy-core`'s deployment tail translates
+ * them into one human line, and the constructs' docs cite them. Coupled
+ * values across package boundaries — a drift would have the tail describe
+ * an exit the runner never emits.
+ *
+ * - `pass` (0) — every configured target verified; app containers start.
+ * - `refused` (1) — a target's live schema does not satisfy the expected
+ *   version (forward skew, or a never-migrated database). The gate did its
+ *   job; the deploy must roll back or the migration must land first.
+ * - `configError` (2) — the gate could not even attempt verification:
+ *   missing/empty env, unsupported tool or engine family, or an internal
+ *   error. Points at a construct bug or an author override.
+ * - `connectionError` (3) — the server could not be reached after the
+ *   bounded retry budget (network, TLS, timeout). Indeterminate: the schema
+ *   may be fine.
+ * - `busy` (4) — the server was reachable and answered every attempt, but
+ *   refused to run the probe because a concurrency cap or quota was
+ *   exhausted (ClickHouse `TOO_MANY_SIMULTANEOUS_QUERIES` 202 /
+ *   `QUOTA_EXCEEDED` 201, Postgres `too_many_connections` 53300 /
+ *   `cannot_connect_now` 57P03) for the whole budget. Indeterminate, and
+ *   distinct from `connectionError` because the cure is different: the
+ *   server is healthy and something else holds the slot.
+ * - `denied` (5) — the server was reachable and rejected the gate's
+ *   identity or its rights (auth failure, unknown user, missing grant,
+ *   read-only violation). Definitive: no retry will change it, and the fix
+ *   is provisioning, not capacity.
+ *
+ * Precedence when targets disagree: `configError` is detected before any
+ * connection is attempted; then `refused` (definitive evidence), then
+ * `denied` (definitive), then `busy`, then `connectionError` (both
+ * indeterminate; `busy` carries the more specific cure).
+ */
+export declare const SCHEMA_GATE_EXIT: {
+    readonly pass: 0;
+    readonly refused: 1;
+    readonly configError: 2;
+    readonly connectionError: 3;
+    readonly busy: 4;
+    readonly denied: 5;
+};
+export type SchemaGateExitKind = keyof typeof SCHEMA_GATE_EXIT;
+export type SchemaGateExitCode = (typeof SCHEMA_GATE_EXIT)[SchemaGateExitKind];
+/**
+ * One human line per exit kind, for the deploy-time ECS tail and forensic
+ * logs. Keyed on the taxonomy so adding an exit kind without a hint is a
+ * compile error (`Record<SchemaGateExitKind, string>` rejects a missing key).
+ */
+export declare const SCHEMA_GATE_EXIT_HINTS: Record<SchemaGateExitKind, string>;
+/**
+ * Inverse lookup for the deployment tail: an ECS container exit code → the
+ * taxonomy kind, or `undefined` for a code the gate never emits (a signal
+ * exit such as 143, or an OOM 137).
+ */
+export declare function schemaGateExitKind(code: number): SchemaGateExitKind | undefined;

package/dist/migration/schemaGateExit.js

@@ -0,0 +1 @@
+var o=Object.defineProperty;var t=(e,r)=>o(e,"name",{value:r,configurable:!0});const a={pass:0,refused:1,configError:2,connectionError:3,busy:4,denied:5},i={pass:"schema gate passed",refused:"schema gate refused: live schema does not satisfy the expected version \u2014 land the migration or roll back",configError:"schema gate could not run: missing or invalid gate configuration \u2014 check the task definition's FJALL_SCHEMA_GATE_* env",connectionError:"schema gate could not reach the database within its budget \u2014 check network reachability and database health",busy:"schema gate was refused a query slot for its whole budget \u2014 the database is healthy; another workload holds the concurrency cap or quota",denied:"schema gate identity was rejected \u2014 the gate user's credentials or grants are wrong; re-run the migration task to re-provision it"},s=new Map(Object.keys(a).map(e=>[a[e],e]));function c(e){return s.get(e)}t(c,"schemaGateExitKind");export{a as SCHEMA_GATE_EXIT,i as SCHEMA_GATE_EXIT_HINTS,c as schemaGateExitKind};

package/dist/migration/sleepAbortable.d.ts

@@ -0,0 +1,10 @@
+/**
+ * Promise-based sleep that short-circuits when the supplied abort signal
+ * fires. Poll and retry loops that can be running when a shutdown signal
+ * arrives (SIGTERM in a worker, an ECS stop of the gate container) MUST use
+ * this for inter-attempt delays so the signal does not stall for the full
+ * sleep. Resolves (never rejects) on abort; callers check `signal.aborted`
+ * after waking. Shared by `@fjall/clickhouse`, `@fjall/schema-gate` and
+ * `@fjall/deploy-core`.
+ */
+export declare function sleepAbortable(ms: number, signal?: AbortSignal): Promise<void>;

package/dist/migration/sleepAbortable.js

@@ -0,0 +1 @@
+var u=Object.defineProperty;var r=(t,e)=>u(t,"name",{value:e,configurable:!0});function m(t,e){return e?.aborted===!0?Promise.resolve():new Promise(o=>{const i=setTimeout(()=>{e?.removeEventListener("abort",n),o()},t),n=r(()=>{clearTimeout(i),o()},"onAbort");e?.addEventListener("abort",n,{once:!0})})}r(m,"sleepAbortable");export{m as sleepAbortable};

package/dist/securityHelpers.d.ts

@@ -50,7 +50,7 @@ export declare const REDACTED_KEY_SENTINEL = "[REDACTED]";
  * GitHub tokens (ghu_/ghs_/ghp_/gho_/github_pat_), bare AWS access-key IDs
  * (AKIA-prefixed and ASIA-prefixed), AWS secret keys (env, INI, and JSON key
  * spellings), session tokens, agent tokens (`fjall_ak_` scoped, `fjall_dk_`
- * deploy).
+ * deploy), legacy personal API keys (`fj_<8 hex>_<48 hex>`).
  *
  * Single source of truth — consumer loggers (CLI, worker, webapp) MUST
  * NOT re-implement these patterns inline. See

package/dist/securityHelpers.js

@@ -1 +1 @@
-var g=Object.defineProperty;var A=(_,t)=>g(_,"name",{value:t,configurable:!0});const R=new Set(["NODE_OPTIONS","NODE_PATH","NODE_EXTRA_CA_CERTS","NODE_DEBUG","NODE_PRESERVE_SYMLINKS","LD_PRELOAD","LD_LIBRARY_PATH","LD_AUDIT","LD_BIND_NOW","DYLD_INSERT_LIBRARIES","DYLD_LIBRARY_PATH","DYLD_FRAMEWORK_PATH","PYTHONPATH","PYTHONSTARTUP","PERL5LIB","PERL5OPT","RUBYLIB","RUBYOPT","HOME","XDG_CONFIG_HOME","AWS_SHARED_CREDENTIALS_FILE","AWS_CONFIG_FILE","SHELL","BASH_ENV","ENV","ZDOTDIR"]);function T(_){return Object.fromEntries(Object.entries(_).filter(([t])=>!R.has(t.toUpperCase())))}A(T,"filterDangerousEnvVars");const u=/fjall_(?:ak|dk)_[A-Z2-7]{16}\.[A-Z2-7]{40}/,S=/(fjall_(?:ak|dk)_)[A-Z2-7]{16}\.[A-Z2-7]{40}/g,s="***",i="[REDACTED]",o=`-----BEGIN ${i} PRIVATE KEY-----...-----END ${i} PRIVATE KEY-----`,l=String.raw`(?:next|continuation|pagination|page|forward|backward)+token`,p=String.raw`(?!ghu_|ghs_|ghp_|gho_|github_pat_|(?:sk|rk)_(?:live|test)_|whsec_|fjall_(?:ak|dk)_|AKIA|ASIA|%[a-zA-Z])`,D=new RegExp(String.raw`(?<!"${l}":\s*")`+String.raw`(?<="[a-zA-Z0-9_-]*(?:password|passwd|secret|api[_-]?key|token|auth|credential)":\s*")`+p+String.raw`[^"]+`,"gi"),I=new RegExp(String.raw`(?<!${l}\s*[=:]\s*["']?)`+String.raw`(?<=(?<!/)(?:password|passwd|secret|api[_-]?key|token|auth|credential)\s*[=:]\s*["']?)`+p+String.raw`[^\s"']+`,"gi");function w(_){return _.replace(/-----BEGIN [A-Z ]*PRIVATE KEY-----(?:[^"\\]|\\[\\nrt"])*?-----END [A-Z ]*PRIVATE KEY-----/g,()=>o).replace(/-----BEGIN [A-Z ]*PRIVATE KEY-----[\s\S]*?-----END [A-Z ]*PRIVATE KEY-----/g,()=>o).replace(/(\w+:\/\/[^:]+:)[^@]+(@)/gi,(t,e,a)=>`${e}${s}${a}`).replace(/(?<![a-zA-Z])(password|passwd|secret|api[_-]?key|token|auth|credential)([=:])["']?[^\s"']+/gi,(t,e,a)=>`${e}${a}${s}`).replace(D,s).replace(I,s).replace(/\b(ghu_|ghs_|ghp_|gho_|github_pat_)[A-Za-z0-9_]+/g,(t,e)=>`${e}${s}`).replace(/\b(sk|rk)_(live|test)_[A-Za-z0-9]{8,}/g,(t,e,a)=>`${e}_${a}_${s}`).replace(/\bwhsec_[A-Za-z0-9]{8,}/g,()=>`whsec_${s}`).replace(/(?<=Authorization:\s*Bearer\s+)[A-Za-z0-9._~+/=-]+/gi,s).replace(/\b(AKIA|ASIA)[A-Z0-9]{12,}\b/g,(t,e)=>`${e}${s}`).replace(/(?<=aws_secret_access_key\s*=\s*["']?|SecretAccessKey[=:]\s*|"(aws)?secretAccessKey":\s*"|"aws_secret_access_key":\s*")[A-Za-z0-9/+=]{40,}/gi,s).replace(/(?<="(aws)?sessionToken":\s*"|"aws_session_token":\s*")[^"]+/gi,s).replace(/(?<=aws_session_token\s*[=:]\s*["']?|SessionToken[=:]\s*["']?)[^\s"']+/gi,s).replace(/(?<="(internal[Aa]piKey|fjallCallbackToken)":\s*")[^"]+/g,s).replace(S,(t,e)=>`${e}${s}`)}A(w,"maskSensitiveOutput");function h(_){const t=[];let e="",a=!1,E=!1,c=!1,n=!1;for(const r of _){if(c){e+=r,c=!1;continue}if(r==="\\"&&!a){c=!0;continue}if(r==="'"&&!E){a=!a,n=!0;continue}if(r==='"'&&!a){E=!E,n=!0;continue}if(r===" "&&!a&&!E){(e||n)&&(t.push(e),e="",n=!1);continue}e+=r}if(a||E)throw new Error(`Unbalanced ${a?"single":"double"} quote in command: ${_.slice(0,80)}`);if(c)throw new Error(`Trailing backslash in command: ${_.slice(0,80)}`);return(e||n)&&t.push(e),t}A(h,"parseShellArgs");export{R as DANGEROUS_ENV_VARS,s as MASKED_VALUE_MARKER,i as REDACTED_KEY_SENTINEL,u as SCOPED_TOKEN_REGEX,T as filterDangerousEnvVars,w as maskSensitiveOutput,h as parseShellArgs};
+var g=Object.defineProperty;var A=(t,a)=>g(t,"name",{value:a,configurable:!0});const R=new Set(["NODE_OPTIONS","NODE_PATH","NODE_EXTRA_CA_CERTS","NODE_DEBUG","NODE_PRESERVE_SYMLINKS","LD_PRELOAD","LD_LIBRARY_PATH","LD_AUDIT","LD_BIND_NOW","DYLD_INSERT_LIBRARIES","DYLD_LIBRARY_PATH","DYLD_FRAMEWORK_PATH","PYTHONPATH","PYTHONSTARTUP","PERL5LIB","PERL5OPT","RUBYLIB","RUBYOPT","HOME","XDG_CONFIG_HOME","AWS_SHARED_CREDENTIALS_FILE","AWS_CONFIG_FILE","SHELL","BASH_ENV","ENV","ZDOTDIR"]);function u(t){return Object.fromEntries(Object.entries(t).filter(([a])=>!R.has(a.toUpperCase())))}A(u,"filterDangerousEnvVars");const L=/fjall_(?:ak|dk)_[A-Z2-7]{16}\.[A-Z2-7]{40}/,S=/(fjall_(?:ak|dk)_)[A-Z2-7]{16}\.[A-Z2-7]{40}/g,D=/\bfj_[0-9a-f]{8}_[0-9a-f]{48}\b/gi,s="***",i="[REDACTED]",o=`-----BEGIN ${i} PRIVATE KEY-----...-----END ${i} PRIVATE KEY-----`,l=String.raw`(?:next|continuation|pagination|page|forward|backward)+token`,p=String.raw`(?!ghu_|ghs_|ghp_|gho_|github_pat_|(?:sk|rk)_(?:live|test)_|whsec_|fjall_(?:ak|dk)_|fj_[0-9a-f]{8}_|AKIA|ASIA|%[a-zA-Z])`,I=new RegExp(String.raw`(?<!"${l}":\s*")`+String.raw`(?<="[a-zA-Z0-9_-]*(?:password|passwd|secret|api[_-]?key|token|auth|credential)":\s*")`+p+String.raw`[^"]+`,"gi"),N=new RegExp(String.raw`(?<!${l}\s*[=:]\s*["']?)`+String.raw`(?<=(?<!/)(?:password|passwd|secret|api[_-]?key|token|auth|credential)\s*[=:]\s*["']?)`+p+String.raw`[^\s"']+`,"gi");function f(t){return t.replace(/-----BEGIN [A-Z ]*PRIVATE KEY-----(?:[^"\\]|\\[\\nrt"])*?-----END [A-Z ]*PRIVATE KEY-----/g,()=>o).replace(/-----BEGIN [A-Z ]*PRIVATE KEY-----[\s\S]*?-----END [A-Z ]*PRIVATE KEY-----/g,()=>o).replace(/(\w+:\/\/[^:]+:)[^@]+(@)/gi,(a,e,_)=>`${e}${s}${_}`).replace(/(?<![a-zA-Z])(password|passwd|secret|api[_-]?key|token|auth|credential)([=:])["']?[^\s"']+/gi,(a,e,_)=>`${e}${_}${s}`).replace(I,s).replace(N,s).replace(/\b(ghu_|ghs_|ghp_|gho_|github_pat_)[A-Za-z0-9_]+/g,(a,e)=>`${e}${s}`).replace(/\b(sk|rk)_(live|test)_[A-Za-z0-9]{8,}/g,(a,e,_)=>`${e}_${_}_${s}`).replace(/\bwhsec_[A-Za-z0-9]{8,}/g,()=>`whsec_${s}`).replace(/(?<=Authorization:\s*Bearer\s+)[A-Za-z0-9._~+/=-]+/gi,s).replace(/\b(AKIA|ASIA)[A-Z0-9]{12,}\b/g,(a,e)=>`${e}${s}`).replace(/(?<=aws_secret_access_key\s*=\s*["']?|SecretAccessKey[=:]\s*|"(aws)?secretAccessKey":\s*"|"aws_secret_access_key":\s*")[A-Za-z0-9/+=]{40,}/gi,s).replace(/(?<="(aws)?sessionToken":\s*"|"aws_session_token":\s*")[^"]+/gi,s).replace(/(?<=aws_session_token\s*[=:]\s*["']?|SessionToken[=:]\s*["']?)[^\s"']+/gi,s).replace(/(?<="(internal[Aa]piKey|fjallCallbackToken)":\s*")[^"]+/g,s).replace(S,(a,e)=>`${e}${s}`).replace(D,()=>`fj_${s}`)}A(f,"maskSensitiveOutput");function w(t){const a=[];let e="",_=!1,E=!1,c=!1,n=!1;for(const r of t){if(c){e+=r,c=!1;continue}if(r==="\\"&&!_){c=!0;continue}if(r==="'"&&!E){_=!_,n=!0;continue}if(r==='"'&&!_){E=!E,n=!0;continue}if(r===" "&&!_&&!E){(e||n)&&(a.push(e),e="",n=!1);continue}e+=r}if(_||E)throw new Error(`Unbalanced ${_?"single":"double"} quote in command: ${t.slice(0,80)}`);if(c)throw new Error(`Trailing backslash in command: ${t.slice(0,80)}`);return(e||n)&&a.push(e),a}A(w,"parseShellArgs");export{R as DANGEROUS_ENV_VARS,s as MASKED_VALUE_MARKER,i as REDACTED_KEY_SENTINEL,L as SCOPED_TOKEN_REGEX,u as filterDangerousEnvVars,f as maskSensitiveOutput,w as parseShellArgs};

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@fjall/util",
-  "version": "20.0.0",
+  "version": "21.0.0",
   "repository": {
     "type": "git",
     "url": "git+https://github.com/fjall-tech/fjall.git",