@fjall/util 21.1.0 → 23.0.0

package/dist/.build-source-hash

@@ -9,7 +9,7 @@
     "package.json",
     "tsconfig.json"
   ],
-  "hash": "3cd4016b6ba53a403e092a115897c084755ae5791ecbb7812d771635c0e9bd67",
+  "hash": "530f54e5f0a172b22cf6590c868bced0b89f2e67809446782c6702e3bf3feb78",
   "files": {
     "src/async/concurrency.ts": "3c7ebe0222a720f9",
     "src/async/singleton.ts": "7bcc21b0fb920561",
@@ -33,7 +33,7 @@
     "src/cdkToolchain.ts": "a6b996c60b87d644",
     "src/cfn/physicalNameProperties.ts": "35d3c6f28079c593",
     "src/clickhouse.ts": "655c74cdba292c29",
-    "src/config.ts": "2c4174dabed881ed",
+    "src/config.ts": "64887717f4eba63f",
     "src/configPaths.ts": "afcc2e4ceb6652a0",
     "src/constructMap.ts": "b81fc8e90015467f",
     "src/deploy/approvalTokenOutput.ts": "4be7b52825d88a37",
@@ -72,7 +72,7 @@
     "src/fsHelpers.ts": "4dd3877b3953c6a9",
     "src/fsScan.ts": "feb187758481443f",
     "src/httpKeepAlive.ts": "c8fe4b118ef4c79f",
-    "src/index.ts": "7dd522de0cf1aca0",
+    "src/index.ts": "32834272a48e9483",
     "src/infra/backupVault.ts": "661678a6dfb0b648",
     "src/infra/connectionsWire.ts": "e3afa3ba95a531d8",
     "src/infra/deployArtefacts.ts": "235ac21dd3ccf0b2",
@@ -107,8 +107,8 @@
     "src/onboarding/index.ts": "7999117c5a7a18d1",
     "src/onboarding/versionCurrency.ts": "19695f38b09cfc46",
     "src/patterns/frameworkPatterns.ts": "0f843cb043eb11fc",
-    "src/patterns/index.ts": "41142efdd3b2711b",
-    "src/patterns/patternTypes.ts": "a50d9004645abc0c",
+    "src/patterns/index.ts": "796c656a81bb39d0",
+    "src/patterns/patternTypes.ts": "28c3c5bc40d66798",
     "src/patterns/staticSiteForms.ts": "86ffcf142d9a8eac",
     "src/repo/appPath.ts": "9aa0d01262b88e65",
     "src/repo/findInfrastructurePaths.ts": "dd1245f5d4004dd5",
@@ -119,15 +119,15 @@
     "src/repo/scanLocalRepository.ts": "c7bc76201622a7a5",
     "src/repo/scanTypes.ts": "1fda805a7d8de93b",
     "src/resourceCategorisation.ts": "a140d1b3cb38be33",
-    "src/scaffold/ensureGitignore.ts": "230253a19bbf092c",
+    "src/scaffold/ensureGitignore.ts": "178a2c3b2c18bc83",
     "src/scaffold/gitignore.ts": "87c66797a4bd05f2",
     "src/secrets.ts": "50258d463e4e67c3",
-    "src/securityHelpers.ts": "81ba6146cf6fcefb",
+    "src/securityHelpers.ts": "1e68e1330c6da971",
     "src/targets.ts": "126280f0a5762e21",
     "../scripts/minify-dist.mjs": "6b2e4b0df8aec601",
-    "package.json": "da75ad74e9acae9c",
+    "package.json": "1fa2d1d0f2d46345",
     "tsconfig.json": "db759831ad95f396"
   },
-  "outputHash": "6286cd5069962e57b14e7a8b535b6862c7e8d9618cc4d0395239e2fb5013ef8d",
+  "outputHash": "0e7359be2d17098165ea61be5189d5454426ddc3d04c2254263e3d30a838604a",
   "outputFileCount": 235
 }

package/dist/.minified

@@ -1 +1 @@
-117 files minified at 2026-08-28T12:40:07.188Z
+117 files minified at 2026-08-30T05:33:57.362Z

package/dist/config.d.ts

@@ -147,6 +147,25 @@ export declare const DomainConfigSchema: z.ZodObject<{
     region: z.ZodOptional<z.ZodString>;
 }, z.core.$strict>;
 export type DomainConfig = z.infer<typeof DomainConfigSchema>;
+/**
+ * STRICT wire contract for the `organisation` key — the project's binding to
+ * ONE Fjall organisation.
+ *
+ * This is the ONE organisation fact that belongs in fjall-config.json, and it
+ * is not a mirror of API state: it is a project ASSERTION, written once by
+ * `fjall org bind` from stated intent, that says which organisation this
+ * source tree deploys into. Everything else about an organisation (accounts,
+ * regions, tiers) is mutable API state that a committed copy would misreport,
+ * which is why it stays out of this file.
+ *
+ * `id` is the only field ever compared. `name` is display-only, so renaming an
+ * organisation neither trips the guard nor dirties a checkout.
+ */
+export declare const OrganisationBindingSchema: z.ZodObject<{
+    id: z.ZodString;
+    name: z.ZodOptional<z.ZodString>;
+}, z.core.$strict>;
+export type OrganisationBinding = z.infer<typeof OrganisationBindingSchema>;
 export declare const RootConfigSchema: z.ZodObject<{
     activeTarget: z.ZodOptional<z.ZodString>;
     domains: z.ZodOptional<z.ZodArray<z.ZodObject<{
@@ -164,6 +183,10 @@ export declare const RootConfigSchema: z.ZodObject<{
         legacyOwnerId: z.ZodOptional<z.ZodString>;
         legacySgDescription: z.ZodOptional<z.ZodString>;
     }, z.core.$strict>>>>>;
+    organisation: z.ZodOptional<z.ZodObject<{
+        id: z.ZodString;
+        name: z.ZodOptional<z.ZodString>;
+    }, z.core.$strict>>;
 }, z.core.$strict>;
 export type RootConfig = z.infer<typeof RootConfigSchema>;
 /**
@@ -194,6 +217,10 @@ export declare const RootConfigReadSchema: z.ZodObject<{
         legacyOwnerId: z.ZodOptional<z.ZodString>;
         legacySgDescription: z.ZodOptional<z.ZodString>;
     }, z.core.$strict>>>>>;
+    organisation: z.ZodOptional<z.ZodObject<{
+        id: z.ZodString;
+        name: z.ZodOptional<z.ZodString>;
+    }, z.core.$strict>>;
 }, z.core.$strip>;
 export type RootConfigRead = z.infer<typeof RootConfigReadSchema>;
 /**
@@ -356,4 +383,7 @@ export declare class Config {
     addDomain(domain: DomainConfig): void;
     getDomain(name: string): DomainConfig | undefined;
     removeDomain(name: string): boolean;
+    getOrganisation(): OrganisationBinding | undefined;
+    setOrganisation(binding: OrganisationBinding): void;
+    clearOrganisation(): void;
 }

package/dist/config.js

@@ -1,2 +1,2 @@
-var F=Object.defineProperty;var p=(u,e)=>F(u,"name",{value:e,configurable:!0});import*as a from"fs";import*as d from"path";import{z as l}from"zod";import{CapacityIdentityConfigSchema as A}from"./capacityIdentity.js";import{failure as m,success as w}from"./docker/result.js";import{getErrorMessage as E}from"./errorUtils.js";import{logger as O}from"./logger.js";import{maskSensitiveOutput as y}from"./securityHelpers.js";import{ensureGitignoreEntries as I}from"./scaffold/ensureGitignore.js";import{FJALL_MANAGED_STATE_DIR_ENTRIES as D,FJALL_PROJECT_GITIGNORE_HEADER as R,LOCAL_CONFIG_GITIGNORE_ENTRY as b,LOCAL_STATE_GITIGNORE_MARKER as $}from"./scaffold/gitignore.js";import{LOCAL_CONFIG_DIRNAME as x,LOCAL_CONFIG_FILENAME as M,ROOT_CONFIG_FILENAME as T}from"./configPaths.js";import{LOCAL_CONFIG_DIRNAME as de,LOCAL_CONFIG_FILENAME as ge,ROOT_CONFIG_FILENAME as ue}from"./configPaths.js";const G=10,Q=["compliance","governance","none"],ee=["enforced","off"],te=["centralised","off"],ne=["account","draining","org"],oe="managementEvents",re="organisationManagementEvents",ie=["active","draining","removed"],se="FjallTrailBucketName",ae="FjallTrailKeyArn",ce="OrganisationTrailBucketName",j=l.object({name:l.string(),type:l.enum(["apex","delegated"]),parentDomain:l.string().optional(),account:l.string().optional(),region:l.string().optional()}).strict(),L=l.object({activeTarget:l.string().optional(),domains:l.array(j).optional(),capacityIdentity:A.optional()}).strict(),_=l.object({activeTarget:l.string().optional(),domains:l.array(j).optional(),capacityIdentity:A.optional()}),P=l.object({activeTarget:l.string().optional()});function K(u={}){return JSON.stringify(u,null,2)}p(K,"serialiseRootConfig");const N=L.keyof().options;function J(u,e,t){const n=e[t];n!==void 0&&(u[t]=n)}p(J,"copyDefinedKey");function k(u,e){if(e===void 0)return!1;const t=new Set([...Object.keys(u),...Object.keys(e)]);for(const n of t)if(u[n]!==e[n])return!1;return!0}p(k,"domainEntriesEqual");class f{static{p(this,"Config")}rootConfig;configPath=null;loadFailed=!1;parseDegraded=!1;loadedSnapshot={};constructor(e,t){this.rootConfig=e??{},this.configPath=t??null}static findConfigDirectory(e){let t=e!==void 0&&e!==""?e:process.cwd();for(let n=0;n<G;n++){const o=d.join(t,"fjall"),i=d.join(o,T);if(a.existsSync(i))return o;const r=d.join(t,T);if(a.existsSync(r))return t;const c=d.dirname(t);if(c===t)break;t=c}return null}static loadConfigFile(e){try{return a.accessSync(e,a.constants.R_OK),a.readFileSync(e,{encoding:"utf8"})}catch(t){return O.warn("Config",`Config file at ${e} could not be read; using defaults`,{file:e,error:y(E(t))}),null}}static loadConfig(e){const t=f.findConfigDirectory(e);if(!t)return new f;const n=d.join(t,T),o=f.loadConfigFile(n);if(o===null){const g=new f(void 0,n);return g.loadFailed=!0,g}let i,r=!1;if(o!==""){let g;try{g=JSON.parse(o)}catch(s){throw f.formatZodError(s,T)}const C=L.safeParse(g);if(C.success)i=C.data;else{const s=_.safeParse(g);i=s.success?s.data:{},r=!s.success,s.success?O.warn("Config","fjall-config.json contains keys this version does not recognise (only activeTarget, domains and capacityIdentity are read). They were most likely written by a newer fjall version \u2014 leave them in place; saves preserve them verbatim.",{file:n}):O.warn("Config","fjall-config.json has a malformed activeTarget, domains or capacityIdentity value, so its contents were ignored for this run \u2014 any capacity-identity pins it holds will NOT apply (a pinned stack deploys unpinned and is blocked by the rename gate). Fix the file by hand; do NOT regenerate it, which would discard the pins.",{file:n})}}const c=new f(i,n);return c.parseDegraded=r,c.loadedSnapshot=structuredClone(c.rootConfig),c}static formatZodError(e,t){if(e instanceof l.ZodError&&e.issues.length>0){const i=e.issues.map(r=>`${r.path.join(".")}: ${r.message}`).join("; ");return new Error(`Failed to parse ${t}: ${i}`)}const o=(e instanceof Error?e.message:String(e)).replace(/\n/g," ").substring(0,500);return new Error(`Failed to parse ${t}: ${o}`)}saveConfig(){const e=d.join(this.resolveProjectDirectory()??d.join(process.cwd(),"fjall"),T);if(this.loadFailed)return m(new Error(`Refusing to save ${e}: the file exists but could not be read when this config loaded, so saving would replace its contents with state that never included them. Fix the file permissions (e.g. chmod u+rw ${e}) and retry.`));const t=d.dirname(e);try{a.mkdirSync(t,{recursive:!0})}catch(c){return m(new Error(`Cannot create config directory ${t}: ${y(E(c))}`))}const n=f.assertWritable(e,t);if(!n.success)return n;const o=this.mergeWithDisk(e);if(!o.success)return o;const i=K(o.data),r=`${e}.tmp-${process.pid}`;try{a.writeFileSync(r,i,{mode:384}),a.renameSync(r,e)}catch(c){return m(new Error(`Failed to save ${e}: ${y(E(c))}`))}return this.configPath=e,w(void 0)}static assertWritable(e,t){if(a.existsSync(e))try{a.accessSync(e,a.constants.W_OK)}catch{return m(new Error(`Cannot save ${e}: the file is read-only. Make it writable (e.g. chmod u+w ${e}) and retry.`))}try{a.accessSync(t,a.constants.W_OK)}catch{return m(new Error(`Cannot save ${e}: the directory ${t} is not writable. Make it writable (e.g. chmod u+w ${t}) and retry.`))}return w(void 0)}mergeWithDisk(e){const t=f.readDiskConfigForMerge(e);if(t.kind==="unmergeable")return m(new Error(`Refusing to save ${e}: ${t.reason}. Writing now would keep only this session's state and drop everything else the file carries (including keys written by other fjall versions). Fix or remove the file and retry.`));if(t.kind==="absent")return w(this.rootConfig);const n=t.disk,o={...n.foreign,...n.known};for(const r of N)r!=="domains"&&this.sessionChangedKey(r)&&(this.rootConfig[r]===void 0?delete o[r]:J(o,this.rootConfig,r));const i=this.mergeDomains(n.known.domains);return i!==void 0?o.domains=i:delete o.domains,w(o)}sessionChangedKey(e){return JSON.stringify(this.rootConfig[e])!==JSON.stringify(this.loadedSnapshot[e])}mergeDomains(e){const t=this.rootConfig.domains,n=this.loadedSnapshot.domains??[];if(t===void 0&&n.length===0)return e;const o=p(s=>s.toLowerCase(),"norm"),i=t??[],r=new Map(n.map(s=>[o(s.name),s])),c=new Map(i.map(s=>[o(s.name),s])),g=[],C=new Set;for(const s of e??[]){const h=o(s.name);C.add(h);const v=c.get(h),S=r.get(h);if(v!==void 0&&!k(v,S)){g.push(v);continue}v===void 0&&S!==void 0||g.push(s)}for(const s of i){const h=o(s.name);C.has(h)||k(s,r.get(h))||g.push(s)}return g}static readDiskConfigForMerge(e){if(!a.existsSync(e))return{kind:"absent"};let t;try{const i=a.readFileSync(e,{encoding:"utf8"});if(i==="")return{kind:"absent"};t=JSON.parse(i)}catch(i){return{kind:"unmergeable",reason:`the existing file could not be read or parsed as JSON (${y(E(i))})`}}const n=_.safeParse(t);if(!n.success){const i=n.error.issues.map(r=>`${r.path.join(".")}: ${r.message}`).join("; ");return{kind:"unmergeable",reason:`a recognised key in the existing file is malformed (${y(i)})`}}const o={};if(typeof t=="object"&&t!==null){const i=N;for(const[r,c]of Object.entries(t))i.includes(r)||(o[r]=c)}return{kind:"ok",disk:{known:n.data,foreign:o}}}static getConfigDirectory(e){return f.findConfigDirectory(e)}getConfigPath(){return this.configPath}isContentUnavailable(){return this.loadFailed||this.parseDegraded}static warnedLegacyActiveTarget=!1;localConfigCache;resolveProjectDirectory(){return this.configPath!==null?d.dirname(this.configPath):f.findConfigDirectory()}localConfigFile(){const e=this.resolveProjectDirectory();return e===null?null:d.join(e,x,M)}loadLocalConfig(){if(this.localConfigCache===void 0){const e=this.localConfigFile();if(e===null)return this.localConfigCache={};try{const t=a.readFileSync(e,{encoding:"utf8"}),n=P.safeParse(JSON.parse(t));this.localConfigCache=n.success?n.data:{}}catch{this.localConfigCache={}}}return this.localConfigCache}writeLocalConfig(e){const t=this.localConfigFile();if(t===null)return m(new Error("Cannot persist local state: no fjall-config.json was found from this directory, so there is no project to anchor `.fjall/local.json` to. Run this from inside a fjall project, or run `fjall create account` / `fjall create app` first."));try{a.mkdirSync(d.dirname(t),{recursive:!0});const n=`${t}.tmp-${process.pid}`;a.writeFileSync(n,JSON.stringify(e,null,2)+`
-`,{encoding:"utf8"}),a.renameSync(n,t),I(d.dirname(d.dirname(t)),[b,...D],{header:R,marker:$})}catch(n){return m(new Error(`Failed to write ${t}: ${y(E(n))}`))}return this.localConfigCache=e,w(void 0)}static warnLegacyActiveTargetOnce(){f.warnedLegacyActiveTarget||(f.warnedLegacyActiveTarget=!0,O.warn("Config","`activeTarget` in fjall-config.json is deprecated and ignored: a committed target must never re-aim a deploy or CI pipeline. Run `fjall target set <name>` to store it locally in .fjall/local.json, then remove `activeTarget` from the committed fjall-config.json."))}getActiveTarget(){const e=this.loadLocalConfig().activeTarget;if(e!==void 0)return e;this.rootConfig.activeTarget!==void 0&&f.warnLegacyActiveTargetOnce()}setActiveTarget(e){const t=this.loadLocalConfig();return t.activeTarget=e,this.writeLocalConfig(t)}clearActiveTarget(){const e=this.loadLocalConfig();return delete e.activeTarget,this.writeLocalConfig(e)}getDomains(){return this.rootConfig.domains??[]}setDomains(e){this.rootConfig.domains=e}addDomain(e){this.rootConfig.domains||(this.rootConfig.domains=[]),this.rootConfig.domains.push(e)}getDomain(e){return this.rootConfig.domains?.find(t=>t.name.toLowerCase()===e.toLowerCase())}removeDomain(e){if(!this.rootConfig.domains)return!1;const t=this.rootConfig.domains.findIndex(n=>n.name.toLowerCase()===e.toLowerCase());return t===-1?!1:(this.rootConfig.domains.splice(t,1),!0)}}export{oe as ACCOUNT_TRAIL_NAME,ie as ACCOUNT_TRAIL_STATES,f as Config,j as DomainConfigSchema,de as LOCAL_CONFIG_DIRNAME,ge as LOCAL_CONFIG_FILENAME,re as ORGANISATION_TRAIL_NAME,ce as ORG_TRAIL_BUCKET_OUTPUT_KEY,te as ROOT_ACCESS_MANAGEMENT_MODES,ue as ROOT_CONFIG_FILENAME,_ as RootConfigReadSchema,L as RootConfigSchema,ee as S3_BPA_MODES,se as TRAIL_BUCKET_OUTPUT_KEY,ae as TRAIL_KEY_ARN_OUTPUT_KEY,ne as TRAIL_LIFECYCLE_STATES,Q as VAULT_LOCK_MODES,K as serialiseRootConfig};
+var I=Object.defineProperty;var p=(u,e)=>I(u,"name",{value:e,configurable:!0});import*as a from"fs";import*as d from"path";import{z as c}from"zod";import{CapacityIdentityConfigSchema as A}from"./capacityIdentity.js";import{failure as m,success as w}from"./docker/result.js";import{getErrorMessage as E}from"./errorUtils.js";import{logger as v}from"./logger.js";import{maskSensitiveOutput as C}from"./securityHelpers.js";import{ensureGitignoreEntries as D}from"./scaffold/ensureGitignore.js";import{FJALL_MANAGED_STATE_DIR_ENTRIES as R,FJALL_PROJECT_GITIGNORE_HEADER as b,LOCAL_CONFIG_GITIGNORE_ENTRY as x,LOCAL_STATE_GITIGNORE_MARKER as $}from"./scaffold/gitignore.js";import{LOCAL_CONFIG_DIRNAME as M,LOCAL_CONFIG_FILENAME as G,ROOT_CONFIG_FILENAME as T}from"./configPaths.js";import{LOCAL_CONFIG_DIRNAME as ge,LOCAL_CONFIG_FILENAME as ue,ROOT_CONFIG_FILENAME as me}from"./configPaths.js";const P=10,ee=["compliance","governance","none"],te=["enforced","off"],ne=["centralised","off"],oe=["account","draining","org"],ie="managementEvents",re="organisationManagementEvents",se=["active","draining","removed"],ae="FjallTrailBucketName",ce="FjallTrailKeyArn",le="OrganisationTrailBucketName",j=c.object({name:c.string(),type:c.enum(["apex","delegated"]),parentDomain:c.string().optional(),account:c.string().optional(),region:c.string().optional()}).strict(),L=c.object({id:c.string().min(1),name:c.string().min(1).optional()}).strict(),_=c.object({activeTarget:c.string().optional(),domains:c.array(j).optional(),capacityIdentity:A.optional(),organisation:L.optional()}).strict(),N=c.object({activeTarget:c.string().optional(),domains:c.array(j).optional(),capacityIdentity:A.optional(),organisation:L.optional()}),K=c.object({activeTarget:c.string().optional()});function J(u={}){return JSON.stringify(u,null,2)}p(J,"serialiseRootConfig");const k=_.keyof().options;function U(u,e,t){const n=e[t];n!==void 0&&(u[t]=n)}p(U,"copyDefinedKey");function F(u,e){if(e===void 0)return!1;const t=new Set([...Object.keys(u),...Object.keys(e)]);for(const n of t)if(u[n]!==e[n])return!1;return!0}p(F,"domainEntriesEqual");class f{static{p(this,"Config")}rootConfig;configPath=null;loadFailed=!1;parseDegraded=!1;loadedSnapshot={};constructor(e,t){this.rootConfig=e??{},this.configPath=t??null}static findConfigDirectory(e){let t=e!==void 0&&e!==""?e:process.cwd();for(let n=0;n<P;n++){const o=d.join(t,"fjall"),r=d.join(o,T);if(a.existsSync(r))return o;const i=d.join(t,T);if(a.existsSync(i))return t;const l=d.dirname(t);if(l===t)break;t=l}return null}static loadConfigFile(e){try{return a.accessSync(e,a.constants.R_OK),a.readFileSync(e,{encoding:"utf8"})}catch(t){return v.warn("Config",`Config file at ${e} could not be read; using defaults`,{file:e,error:C(E(t))}),null}}static loadConfig(e){const t=f.findConfigDirectory(e);if(!t)return new f;const n=d.join(t,T),o=f.loadConfigFile(n);if(o===null){const g=new f(void 0,n);return g.loadFailed=!0,g}let r,i=!1;if(o!==""){let g;try{g=JSON.parse(o)}catch(s){throw f.formatZodError(s,T)}const y=_.safeParse(g);if(y.success)r=y.data;else{const s=N.safeParse(g);r=s.success?s.data:{},i=!s.success,s.success?v.warn("Config","fjall-config.json contains keys this version does not recognise (only activeTarget, domains and capacityIdentity are read). They were most likely written by a newer fjall version \u2014 leave them in place; saves preserve them verbatim.",{file:n}):v.warn("Config","fjall-config.json has a malformed activeTarget, domains or capacityIdentity value, so its contents were ignored for this run \u2014 any capacity-identity pins it holds will NOT apply (a pinned stack deploys unpinned and is blocked by the rename gate). Fix the file by hand; do NOT regenerate it, which would discard the pins.",{file:n})}}const l=new f(r,n);return l.parseDegraded=i,l.loadedSnapshot=structuredClone(l.rootConfig),l}static formatZodError(e,t){if(e instanceof c.ZodError&&e.issues.length>0){const r=e.issues.map(i=>`${i.path.join(".")}: ${i.message}`).join("; ");return new Error(`Failed to parse ${t}: ${r}`)}const o=(e instanceof Error?e.message:String(e)).replace(/\n/g," ").substring(0,500);return new Error(`Failed to parse ${t}: ${o}`)}saveConfig(){const e=d.join(this.resolveProjectDirectory()??d.join(process.cwd(),"fjall"),T);if(this.loadFailed)return m(new Error(`Refusing to save ${e}: the file exists but could not be read when this config loaded, so saving would replace its contents with state that never included them. Fix the file permissions (e.g. chmod u+rw ${e}) and retry.`));const t=d.dirname(e);try{a.mkdirSync(t,{recursive:!0})}catch(l){return m(new Error(`Cannot create config directory ${t}: ${C(E(l))}`))}const n=f.assertWritable(e,t);if(!n.success)return n;const o=this.mergeWithDisk(e);if(!o.success)return o;const r=J(o.data),i=`${e}.tmp-${process.pid}`;try{a.writeFileSync(i,r,{mode:384}),a.renameSync(i,e)}catch(l){return m(new Error(`Failed to save ${e}: ${C(E(l))}`))}return this.configPath=e,w(void 0)}static assertWritable(e,t){if(a.existsSync(e))try{a.accessSync(e,a.constants.W_OK)}catch{return m(new Error(`Cannot save ${e}: the file is read-only. Make it writable (e.g. chmod u+w ${e}) and retry.`))}try{a.accessSync(t,a.constants.W_OK)}catch{return m(new Error(`Cannot save ${e}: the directory ${t} is not writable. Make it writable (e.g. chmod u+w ${t}) and retry.`))}return w(void 0)}mergeWithDisk(e){const t=f.readDiskConfigForMerge(e);if(t.kind==="unmergeable")return m(new Error(`Refusing to save ${e}: ${t.reason}. Writing now would keep only this session's state and drop everything else the file carries (including keys written by other fjall versions). Fix or remove the file and retry.`));if(t.kind==="absent")return w(this.rootConfig);const n=t.disk,o={...n.foreign,...n.known};for(const i of k)i!=="domains"&&this.sessionChangedKey(i)&&(this.rootConfig[i]===void 0?delete o[i]:U(o,this.rootConfig,i));const r=this.mergeDomains(n.known.domains);return r!==void 0?o.domains=r:delete o.domains,w(o)}sessionChangedKey(e){return JSON.stringify(this.rootConfig[e])!==JSON.stringify(this.loadedSnapshot[e])}mergeDomains(e){const t=this.rootConfig.domains,n=this.loadedSnapshot.domains??[];if(t===void 0&&n.length===0)return e;const o=p(s=>s.toLowerCase(),"norm"),r=t??[],i=new Map(n.map(s=>[o(s.name),s])),l=new Map(r.map(s=>[o(s.name),s])),g=[],y=new Set;for(const s of e??[]){const h=o(s.name);y.add(h);const O=l.get(h),S=i.get(h);if(O!==void 0&&!F(O,S)){g.push(O);continue}O===void 0&&S!==void 0||g.push(s)}for(const s of r){const h=o(s.name);y.has(h)||F(s,i.get(h))||g.push(s)}return g}static readDiskConfigForMerge(e){if(!a.existsSync(e))return{kind:"absent"};let t;try{const r=a.readFileSync(e,{encoding:"utf8"});if(r==="")return{kind:"absent"};t=JSON.parse(r)}catch(r){return{kind:"unmergeable",reason:`the existing file could not be read or parsed as JSON (${C(E(r))})`}}const n=N.safeParse(t);if(!n.success){const r=n.error.issues.map(i=>`${i.path.join(".")}: ${i.message}`).join("; ");return{kind:"unmergeable",reason:`a recognised key in the existing file is malformed (${C(r)})`}}const o={};if(typeof t=="object"&&t!==null){const r=k;for(const[i,l]of Object.entries(t))r.includes(i)||(o[i]=l)}return{kind:"ok",disk:{known:n.data,foreign:o}}}static getConfigDirectory(e){return f.findConfigDirectory(e)}getConfigPath(){return this.configPath}isContentUnavailable(){return this.loadFailed||this.parseDegraded}static warnedLegacyActiveTarget=!1;localConfigCache;resolveProjectDirectory(){return this.configPath!==null?d.dirname(this.configPath):f.findConfigDirectory()}localConfigFile(){const e=this.resolveProjectDirectory();return e===null?null:d.join(e,M,G)}loadLocalConfig(){if(this.localConfigCache===void 0){const e=this.localConfigFile();if(e===null)return this.localConfigCache={};try{const t=a.readFileSync(e,{encoding:"utf8"}),n=K.safeParse(JSON.parse(t));this.localConfigCache=n.success?n.data:{}}catch{this.localConfigCache={}}}return this.localConfigCache}writeLocalConfig(e){const t=this.localConfigFile();if(t===null)return m(new Error("Cannot persist local state: no fjall-config.json was found from this directory, so there is no project to anchor `.fjall/local.json` to. Run this from inside a fjall project, or run `fjall create account` / `fjall create app` first."));try{a.mkdirSync(d.dirname(t),{recursive:!0});const n=`${t}.tmp-${process.pid}`;a.writeFileSync(n,JSON.stringify(e,null,2)+`
+`,{encoding:"utf8"}),a.renameSync(n,t),D(d.dirname(d.dirname(t)),[x,...R],{header:b,marker:$})}catch(n){return m(new Error(`Failed to write ${t}: ${C(E(n))}`))}return this.localConfigCache=e,w(void 0)}static warnLegacyActiveTargetOnce(){f.warnedLegacyActiveTarget||(f.warnedLegacyActiveTarget=!0,v.warn("Config","`activeTarget` in fjall-config.json is deprecated and ignored: a committed target must never re-aim a deploy or CI pipeline. Run `fjall target set <name>` to store it locally in .fjall/local.json, then remove `activeTarget` from the committed fjall-config.json."))}getActiveTarget(){const e=this.loadLocalConfig().activeTarget;if(e!==void 0)return e;this.rootConfig.activeTarget!==void 0&&f.warnLegacyActiveTargetOnce()}setActiveTarget(e){const t=this.loadLocalConfig();return t.activeTarget=e,this.writeLocalConfig(t)}clearActiveTarget(){const e=this.loadLocalConfig();return delete e.activeTarget,this.writeLocalConfig(e)}getDomains(){return this.rootConfig.domains??[]}setDomains(e){this.rootConfig.domains=e}addDomain(e){this.rootConfig.domains||(this.rootConfig.domains=[]),this.rootConfig.domains.push(e)}getDomain(e){return this.rootConfig.domains?.find(t=>t.name.toLowerCase()===e.toLowerCase())}removeDomain(e){if(!this.rootConfig.domains)return!1;const t=this.rootConfig.domains.findIndex(n=>n.name.toLowerCase()===e.toLowerCase());return t===-1?!1:(this.rootConfig.domains.splice(t,1),!0)}getOrganisation(){return this.rootConfig.organisation}setOrganisation(e){this.rootConfig.organisation=e}clearOrganisation(){delete this.rootConfig.organisation}}export{ie as ACCOUNT_TRAIL_NAME,se as ACCOUNT_TRAIL_STATES,f as Config,j as DomainConfigSchema,ge as LOCAL_CONFIG_DIRNAME,ue as LOCAL_CONFIG_FILENAME,re as ORGANISATION_TRAIL_NAME,le as ORG_TRAIL_BUCKET_OUTPUT_KEY,L as OrganisationBindingSchema,ne as ROOT_ACCESS_MANAGEMENT_MODES,me as ROOT_CONFIG_FILENAME,N as RootConfigReadSchema,_ as RootConfigSchema,te as S3_BPA_MODES,ae as TRAIL_BUCKET_OUTPUT_KEY,ce as TRAIL_KEY_ARN_OUTPUT_KEY,oe as TRAIL_LIFECYCLE_STATES,ee as VAULT_LOCK_MODES,J as serialiseRootConfig};

package/dist/index.d.ts

@@ -33,7 +33,7 @@ export { MIGRATION_SNAPSHOT_NAME_PREFIX, EXPECTED_SCHEMA_VERSION_ENV, EXPECTED_S
 export { SCHEMA_GATE_EXIT, SCHEMA_GATE_EXIT_HINTS, schemaGateExitKind, type SchemaGateExitKind, type SchemaGateExitCode } from "./migration/schemaGateExit.js";
 export { FJALL_SCHEMA_GATE_USER, FJALL_MAINTENANCE_USER, FJALL_CLICKHOUSE_USERS, type FjallClickHouseUser } from "./migration/clickhouseFrameworkUsers.js";
 export { PHYSICAL_NAME_FALLBACK_PROPERTIES } from "./cfn/physicalNameProperties.js";
-export { PATTERN_TYPE_VALUES, type PatternType, PATTERN_TYPES, isPatternType, type PatternArtefact, type PatternStackPlacement, type PatternDescriptor, PATTERN_REGISTRY, patternConstructId, DEPLOYABLE_PATTERN_TYPES, type OpenNextPatternType, OPENNEXT_PATTERN_TYPES, isOpenNextPatternType, STATIC_SITE_ROUTING_VALUES, type StaticSiteRouting, PATTERN_CREATE_INPUT_VALUES, type PatternCreateInput, PATTERN_CREATE_INPUT_FLAGS } from "./patterns/patternTypes.js";
+export { PATTERN_TYPE_VALUES, type PatternType, PATTERN_TYPES, isPatternType, type PatternArtefact, type PatternStackPlacement, type PatternDescriptor, PATTERN_REGISTRY, patternConstructId, DEPLOYABLE_PATTERN_TYPES, type OpenNextPatternType, OPENNEXT_PATTERN_TYPES, isOpenNextPatternType, STATIC_SITE_ROUTING_VALUES, STATIC_SITE_ROUTING_INFO, type StaticSiteRouting, type StaticSiteRoutingDescriptor, PATTERN_CREATE_INPUT_VALUES, type PatternCreateInput, PATTERN_CREATE_INPUT_FLAGS } from "./patterns/patternTypes.js";
 export { FRAMEWORK_VALUES, type Framework, FRAMEWORKS, isFramework, type DeployablePatternType, type UndeployablePatternType, type PatternRecommendation, FRAMEWORK_PATTERN_RECOMMENDATIONS, recommendPatternForFramework, CREATABLE_FRAMEWORKS, requiredInputsForFramework } from "./patterns/frameworkPatterns.js";
 export { DEFAULT_FORMS_FROM_LOCAL_PART, defaultFormsFromAddress, defaultFormsCorsOrigin, isAddressAtDomain } from "./patterns/staticSiteForms.js";
 export { DEV_SUBSTRATE_PARAMS_SCHEMA_VERSION, DEV_SUBSTRATE_PARAMS_FILENAME, DevSubstrateSynthPropsSchema, type DevSubstrateSynthProps, DevSubstrateParamsSchema, type DevSubstrateParams } from "./devSubstrate/params.js";

package/dist/index.js

@@ -1 +1 @@
-import{DNS_APEX as r,getDomainExportNames as _,getDomainStackName as o,getDomainUsEast1CertificatesStackName as t,hostsExportPartName as A,serialiseHostsChunks as T,HOSTS_OUTPUT_MAX_BYTES as S,isManagedDomainBinding as a,DOMAIN_DEPLOY_DEFAULT_PHASE as N}from"./infra/domainExports.js";import{BACKUP_VAULT_NAME as i}from"./infra/backupVault.js";import{APPROVAL_TOKEN_OUTPUT_PREFIX as O,TOKEN_STDERR_PREFIX as m}from"./deploy/approvalTokenOutput.js";import{imageTagParameterName as I}from"./infra/imageTags.js";import{toPascalCase as L,toKebab as s,toValidDatabaseName as p,toScreamingSnake as D,capitalise as M,getSafeZoneName as c,accountConstructKey as f,hasAsciiStableConstructKey as F}from"./naming/caseConversion.js";import{albDnsExportName as l,albHostedZoneIdExportName as u,cdnDomainExportName as d,bucketWebsiteEndpointExportName as x,bucketWebsiteHostedZoneIdExportName as g}from"./naming/targetExportNames.js";import{CAPACITY_SLOT_PATTERN as h,CAPACITY_SLOT_MAX_LENGTH as H,DEFAULT_CAPACITY_SLOT as V,CAPACITY_ANCHOR_PATTERN as Y,CAPACITY_ANCHOR_MAX_LENGTH as y,CAPACITY_IDENTITY_CONTEXT_KEY as K,CapacityIdentityPinSchema as v,CapacityIdentityWireSchema as X,CapacityIdentityConfigSchema as b,projectCapacityIdentityToTarget as B}from"./capacityIdentity.js";import{findAccountNameCollision as J}from"./naming/accountNameCollision.js";import{defaultConnectedAccountName as j,suffixedAccountName as w,REGION_SHORT_CODES as Z,findTrailingRegionShortCode as q,regionSuffixRejectionMessage as z}from"./naming/connectedAccountName.js";import{normaliseError as $,getErrorMessage as ee,hasErrorCode as Ee,getErrorCode as re,getErrorStack as _e,formatErrorString as oe}from"./errorUtils.js";import{FJALL_CONFIG_DIR_ENV as Ae,FJALL_CREDENTIALS_FILENAME as Te,FJALL_HOME_DIRNAME as Se,FJALL_LOG_DIR_ENV as ae,fjallCredentialsPath as Ne,fjallHomeDir as Re,fjallLogDir as ie,fjallStatePath as ne}from"./fjallHome.js";import{singleton as me}from"./async/singleton.js";import{DANGEROUS_ENV_VARS as Ie,filterDangerousEnvVars as Pe,MASKED_VALUE_MARKER as Le,maskSensitiveOutput as se,parseShellArgs as pe,REDACTED_KEY_SENTINEL as De,SCOPED_TOKEN_REGEX as Me}from"./securityHelpers.js";import{sleep as fe}from"./async/sleep.js";import{mapSettledWithConcurrency as Ue}from"./async/concurrency.js";import{ACCOUNT_STAGES_WITH_ROOT as ue,STRUCTURAL_ENVIRONMENTS as de,ACCOUNT_STAGES as xe,ACCOUNT_STAGE_LABELS as ge,isAccountStage as Ge,ACCOUNT_TIERS as he,AccountTierSchema as He,isAccountTier as Ve,GOVERNANCE_ACCOUNT_TIERS as Ye,isGovernanceTier as ye,environmentToTier as Ke,stageFromWireEnvironment as ve,accountTier as Xe,resolveSynthEnvironment as be,getEnvironmentLabel as Be,ACCOUNT_ROLES as We}from"./environments.js";import{RESOURCE_CATEGORIES as ke,categoriseResource as je,getExpectedDuration as we,getFriendlyResourceType as Ze}from"./resourceCategorisation.js";import{parseGitRemoteUrl as ze}from"./repo/gitRemoteParser.js";import{abbreviateRegion as $e,AWS_REGIONS_METADATA as eE,DEFAULT_REGION as EE,getRegionInfo as rE,MAX_SECONDARY_REGIONS as _E,OPT_IN_REGION_CODES as oE,optInRegionWarning as tE,regions as AE,suggestRegionForTimezone as TE}from"./infra/regions.js";import{SCOPE_VALUES as aE,MACHINE_ONLY_SCOPES as NE,USER_GRANTABLE_SCOPES as RE,GOVERNANCE_SCOPE_REQUIRED_CODE as iE}from"./infra/tokenScopes.js";import{SECRET_NAME_PATTERN as OE,SECRET_NAME_ERROR as mE,SSM_COMPONENT_PATTERN as CE,SSM_COMPONENT_ERROR as IE,SSM_STANDARD_MAX_VALUE_BYTES as PE,SecretNamespaceSchema as LE,buildNamespaceParts as sE,buildParameterPath as pE,parseParameterPath as DE,isManageablePath as ME,parseDotEnv as cE,escapeDotEnvValue as fE}from"./secrets.js";import{ConnectionWireSchema as UE,ConnectionsListResponseSchema as lE,CONNECTION_PHASES as uE,CONNECTION_TERMINAL_FAILURE_PHASES as dE,CONNECTION_FAILURE_REASONS as xE,EXTERNAL_ID_PATTERN as gE}from"./infra/connectionsWire.js";import{PUBLIC_PACKAGE_NAME as hE,INSTALL_SOURCES as HE,SETUP_COMMANDS as VE,upgradeCommand as YE,SETUP_MODES as yE,SETUP_STEP_IDS as KE,SETUP_STEPS as vE,AGENT_SETUP_PROMPTS as XE,AGENT_INSTALL_COMMAND as bE,SKILL_INSTALL_SEGMENTS as BE,SKILL_INSTALL_FILENAME as WE,SKILL_INSTALL_PATH as JE}from"./onboarding/index.js";import{deriveRegionsFromOrgConfig as jE,deriveTargets as wE,deriveAllTargets as ZE,environmentOrTier as qE,findTarget as zE,generateTargetName as QE}from"./targets.js";import{buildAppConfigPath as er}from"./repo/appPath.js";import{findInfrastructurePaths as rr,findBoundaryPath as _r,isInfrastructureFile as or}from"./repo/findInfrastructurePaths.js";import{inferContainerFromCandidates as Ar}from"./repo/inferContainerFromCandidates.js";import{RESERVED_APP_NAMES as Sr,RESERVED_APP_NAME_MESSAGE as ar,isReservedAppName as Nr,RESERVED_APP_NAME_SUFFIX as Rr,RESERVED_APP_NAME_SUFFIX_MESSAGE as ir,hasReservedAppNameSuffix as nr}from"./naming/reservedAppNames.js";import{deriveContentHashTag as mr,CONTENT_HASH_TAG_PATTERN as Cr}from"./infra/deriveContentHashTag.js";import{DEPLOY_MODES as Pr,DeployModeSchema as Lr,IMAGE_TAG_PATTERN as sr,ImageTagSchema as pr,ServiceArtefactSchema as Dr,ServiceArtefactsSchema as Mr,ARTEFACT_OUTPUT_FIELDS as cr,artefactOutputKey as fr}from"./infra/deployArtefacts.js";import{MIGRATION_SNAPSHOT_NAME_PREFIX as Ur,EXPECTED_SCHEMA_VERSION_ENV as lr,EXPECTED_SCHEMA_VERSION_TOOL_ENV as ur,EXPECTED_CH_SCHEMA_VERSION_ENV as dr,SCHEMA_ADMIN_USER_ENV as xr,SCHEMA_ADMIN_PASSWORD_ENV as gr,PRISMA_MIGRATION_DIR_RE as Gr,CLICKHOUSE_MIGRATION_SKIP_RE as hr}from"./migration/constants.js";import{SCHEMA_GATE_EXIT as Vr,SCHEMA_GATE_EXIT_HINTS as Yr,schemaGateExitKind as yr}from"./migration/schemaGateExit.js";import{FJALL_SCHEMA_GATE_USER as vr,FJALL_MAINTENANCE_USER as Xr,FJALL_CLICKHOUSE_USERS as br}from"./migration/clickhouseFrameworkUsers.js";import{PHYSICAL_NAME_FALLBACK_PROPERTIES as Wr}from"./cfn/physicalNameProperties.js";import{PATTERN_TYPE_VALUES as kr,PATTERN_TYPES as jr,isPatternType as wr,PATTERN_REGISTRY as Zr,patternConstructId as qr,DEPLOYABLE_PATTERN_TYPES as zr,OPENNEXT_PATTERN_TYPES as Qr,isOpenNextPatternType as $r,STATIC_SITE_ROUTING_VALUES as e_,PATTERN_CREATE_INPUT_VALUES as E_,PATTERN_CREATE_INPUT_FLAGS as r_}from"./patterns/patternTypes.js";import{FRAMEWORK_VALUES as o_,FRAMEWORKS as t_,isFramework as A_,FRAMEWORK_PATTERN_RECOMMENDATIONS as T_,recommendPatternForFramework as S_,CREATABLE_FRAMEWORKS as a_,requiredInputsForFramework as N_}from"./patterns/frameworkPatterns.js";import{DEFAULT_FORMS_FROM_LOCAL_PART as i_,defaultFormsFromAddress as n_,defaultFormsCorsOrigin as O_,isAddressAtDomain as m_}from"./patterns/staticSiteForms.js";import{DEV_SUBSTRATE_PARAMS_SCHEMA_VERSION as I_,DEV_SUBSTRATE_PARAMS_FILENAME as P_,DevSubstrateSynthPropsSchema as L_,DevSubstrateParamsSchema as s_}from"./devSubstrate/params.js";import{DEV_SUBSTRATE_ENTRYPOINT_SOURCE as D_}from"./devSubstrate/entrypoint.js";import{BLESSED_CDK_TOOLCHAIN as c_}from"./cdkToolchain.js";import{DEPLOYMENT_FAILURE_PHASES as F_,DeploymentFailurePhaseSchema as U_,DEPLOYMENT_FAULT_ATTRIBUTIONS as l_,DeploymentFaultAttributionSchema as u_,DEPLOYMENT_FAILURE_PROVIDER_SOURCES as d_,DeploymentFailureProviderSourceSchema as x_,DEPLOYMENT_FAILURE_CODE_PATTERN as g_,DEPLOYMENT_FAILURE_SCHEMA_VERSION as G_,DEPLOYMENT_FAILURE_LIMITS as h_,DeploymentFailureAnalysisSchema as H_,DeploymentFailureProviderSchema as V_,DeploymentFailureResourceSchema as Y_,DeploymentFailureSchema as y_,parseDeploymentFailure as K_,DEPLOYMENT_FAILURE_DOCS_BASE_URL as v_,deploymentFailureDocsUrl as X_,DEPLOYMENT_FAULT_COPY as b_,DEPLOYMENT_PROVIDER_LABELS as B_,deriveErrorMessageFromFailure as W_,toDeploymentFailureAnalysis as J_}from"./failure/deploymentFailure.js";import{extractErrorWindow as j_,ERROR_WINDOW_CONTEXT_LINES as w_}from"./failure/extractErrorWindow.js";import{FJALL_COMPONENT_GITIGNORE as q_,FJALL_PROJECT_GITIGNORE as z_,FJALL_STATE_GITIGNORE_ENTRIES as Q_,FJALL_MANAGED_STATE_DIR_ENTRIES as $_,LOCAL_CONFIG_GITIGNORE_ENTRY as eo}from"./scaffold/gitignore.js";import{ensureGitignoreEntries as ro}from"./scaffold/ensureGitignore.js";export{We as ACCOUNT_ROLES,xe as ACCOUNT_STAGES,ue as ACCOUNT_STAGES_WITH_ROOT,ge as ACCOUNT_STAGE_LABELS,he as ACCOUNT_TIERS,bE as AGENT_INSTALL_COMMAND,XE as AGENT_SETUP_PROMPTS,O as APPROVAL_TOKEN_OUTPUT_PREFIX,cr as ARTEFACT_OUTPUT_FIELDS,eE as AWS_REGIONS_METADATA,He as AccountTierSchema,i as BACKUP_VAULT_NAME,c_ as BLESSED_CDK_TOOLCHAIN,y as CAPACITY_ANCHOR_MAX_LENGTH,Y as CAPACITY_ANCHOR_PATTERN,K as CAPACITY_IDENTITY_CONTEXT_KEY,H as CAPACITY_SLOT_MAX_LENGTH,h as CAPACITY_SLOT_PATTERN,hr as CLICKHOUSE_MIGRATION_SKIP_RE,xE as CONNECTION_FAILURE_REASONS,uE as CONNECTION_PHASES,dE as CONNECTION_TERMINAL_FAILURE_PHASES,Cr as CONTENT_HASH_TAG_PATTERN,a_ as CREATABLE_FRAMEWORKS,b as CapacityIdentityConfigSchema,v as CapacityIdentityPinSchema,X as CapacityIdentityWireSchema,UE as ConnectionWireSchema,lE as ConnectionsListResponseSchema,Ie as DANGEROUS_ENV_VARS,V as DEFAULT_CAPACITY_SLOT,i_ as DEFAULT_FORMS_FROM_LOCAL_PART,EE as DEFAULT_REGION,zr as DEPLOYABLE_PATTERN_TYPES,g_ as DEPLOYMENT_FAILURE_CODE_PATTERN,v_ as DEPLOYMENT_FAILURE_DOCS_BASE_URL,h_ as DEPLOYMENT_FAILURE_LIMITS,F_ as DEPLOYMENT_FAILURE_PHASES,d_ as DEPLOYMENT_FAILURE_PROVIDER_SOURCES,G_ as DEPLOYMENT_FAILURE_SCHEMA_VERSION,l_ as DEPLOYMENT_FAULT_ATTRIBUTIONS,b_ as DEPLOYMENT_FAULT_COPY,B_ as DEPLOYMENT_PROVIDER_LABELS,Pr as DEPLOY_MODES,D_ as DEV_SUBSTRATE_ENTRYPOINT_SOURCE,P_ as DEV_SUBSTRATE_PARAMS_FILENAME,I_ as DEV_SUBSTRATE_PARAMS_SCHEMA_VERSION,r as DNS_APEX,N as DOMAIN_DEPLOY_DEFAULT_PHASE,Lr as DeployModeSchema,H_ as DeploymentFailureAnalysisSchema,U_ as DeploymentFailurePhaseSchema,V_ as DeploymentFailureProviderSchema,x_ as DeploymentFailureProviderSourceSchema,Y_ as DeploymentFailureResourceSchema,y_ as DeploymentFailureSchema,u_ as DeploymentFaultAttributionSchema,s_ as DevSubstrateParamsSchema,L_ as DevSubstrateSynthPropsSchema,w_ as ERROR_WINDOW_CONTEXT_LINES,dr as EXPECTED_CH_SCHEMA_VERSION_ENV,lr as EXPECTED_SCHEMA_VERSION_ENV,ur as EXPECTED_SCHEMA_VERSION_TOOL_ENV,gE as EXTERNAL_ID_PATTERN,br as FJALL_CLICKHOUSE_USERS,q_ as FJALL_COMPONENT_GITIGNORE,Ae as FJALL_CONFIG_DIR_ENV,Te as FJALL_CREDENTIALS_FILENAME,Se as FJALL_HOME_DIRNAME,ae as FJALL_LOG_DIR_ENV,Xr as FJALL_MAINTENANCE_USER,$_ as FJALL_MANAGED_STATE_DIR_ENTRIES,z_ as FJALL_PROJECT_GITIGNORE,vr as FJALL_SCHEMA_GATE_USER,Q_ as FJALL_STATE_GITIGNORE_ENTRIES,t_ as FRAMEWORKS,T_ as FRAMEWORK_PATTERN_RECOMMENDATIONS,o_ as FRAMEWORK_VALUES,Ye as GOVERNANCE_ACCOUNT_TIERS,iE as GOVERNANCE_SCOPE_REQUIRED_CODE,S as HOSTS_OUTPUT_MAX_BYTES,sr as IMAGE_TAG_PATTERN,HE as INSTALL_SOURCES,pr as ImageTagSchema,eo as LOCAL_CONFIG_GITIGNORE_ENTRY,NE as MACHINE_ONLY_SCOPES,Le as MASKED_VALUE_MARKER,_E as MAX_SECONDARY_REGIONS,Ur as MIGRATION_SNAPSHOT_NAME_PREFIX,Qr as OPENNEXT_PATTERN_TYPES,oE as OPT_IN_REGION_CODES,r_ as PATTERN_CREATE_INPUT_FLAGS,E_ as PATTERN_CREATE_INPUT_VALUES,Zr as PATTERN_REGISTRY,jr as PATTERN_TYPES,kr as PATTERN_TYPE_VALUES,Wr as PHYSICAL_NAME_FALLBACK_PROPERTIES,Gr as PRISMA_MIGRATION_DIR_RE,hE as PUBLIC_PACKAGE_NAME,De as REDACTED_KEY_SENTINEL,Z as REGION_SHORT_CODES,Sr as RESERVED_APP_NAMES,ar as RESERVED_APP_NAME_MESSAGE,Rr as RESERVED_APP_NAME_SUFFIX,ir as RESERVED_APP_NAME_SUFFIX_MESSAGE,ke as RESOURCE_CATEGORIES,gr as SCHEMA_ADMIN_PASSWORD_ENV,xr as SCHEMA_ADMIN_USER_ENV,Vr as SCHEMA_GATE_EXIT,Yr as SCHEMA_GATE_EXIT_HINTS,Me as SCOPED_TOKEN_REGEX,aE as SCOPE_VALUES,mE as SECRET_NAME_ERROR,OE as SECRET_NAME_PATTERN,VE as SETUP_COMMANDS,yE as SETUP_MODES,vE as SETUP_STEPS,KE as SETUP_STEP_IDS,WE as SKILL_INSTALL_FILENAME,JE as SKILL_INSTALL_PATH,BE as SKILL_INSTALL_SEGMENTS,IE as SSM_COMPONENT_ERROR,CE as SSM_COMPONENT_PATTERN,PE as SSM_STANDARD_MAX_VALUE_BYTES,e_ as STATIC_SITE_ROUTING_VALUES,de as STRUCTURAL_ENVIRONMENTS,LE as SecretNamespaceSchema,Dr as ServiceArtefactSchema,Mr as ServiceArtefactsSchema,m as TOKEN_STDERR_PREFIX,RE as USER_GRANTABLE_SCOPES,$e as abbreviateRegion,f as accountConstructKey,Xe as accountTier,l as albDnsExportName,u as albHostedZoneIdExportName,fr as artefactOutputKey,x as bucketWebsiteEndpointExportName,g as bucketWebsiteHostedZoneIdExportName,er as buildAppConfigPath,sE as buildNamespaceParts,pE as buildParameterPath,M as capitalise,je as categoriseResource,d as cdnDomainExportName,j as defaultConnectedAccountName,O_ as defaultFormsCorsOrigin,n_ as defaultFormsFromAddress,X_ as deploymentFailureDocsUrl,ZE as deriveAllTargets,mr as deriveContentHashTag,W_ as deriveErrorMessageFromFailure,jE as deriveRegionsFromOrgConfig,wE as deriveTargets,ro as ensureGitignoreEntries,qE as environmentOrTier,Ke as environmentToTier,fE as escapeDotEnvValue,j_ as extractErrorWindow,Pe as filterDangerousEnvVars,J as findAccountNameCollision,_r as findBoundaryPath,rr as findInfrastructurePaths,zE as findTarget,q as findTrailingRegionShortCode,Ne as fjallCredentialsPath,Re as fjallHomeDir,ie as fjallLogDir,ne as fjallStatePath,oe as formatErrorString,QE as generateTargetName,_ as getDomainExportNames,o as getDomainStackName,t as getDomainUsEast1CertificatesStackName,Be as getEnvironmentLabel,re as getErrorCode,ee as getErrorMessage,_e as getErrorStack,we as getExpectedDuration,Ze as getFriendlyResourceType,rE as getRegionInfo,c as getSafeZoneName,F as hasAsciiStableConstructKey,Ee as hasErrorCode,nr as hasReservedAppNameSuffix,A as hostsExportPartName,I as imageTagParameterName,Ar as inferContainerFromCandidates,Ge as isAccountStage,Ve as isAccountTier,m_ as isAddressAtDomain,A_ as isFramework,ye as isGovernanceTier,or as isInfrastructureFile,ME as isManageablePath,a as isManagedDomainBinding,$r as isOpenNextPatternType,wr as isPatternType,Nr as isReservedAppName,Ue as mapSettledWithConcurrency,se as maskSensitiveOutput,$ as normaliseError,tE as optInRegionWarning,K_ as parseDeploymentFailure,cE as parseDotEnv,ze as parseGitRemoteUrl,DE as parseParameterPath,pe as parseShellArgs,qr as patternConstructId,B as projectCapacityIdentityToTarget,S_ as recommendPatternForFramework,z as regionSuffixRejectionMessage,AE as regions,N_ as requiredInputsForFramework,be as resolveSynthEnvironment,yr as schemaGateExitKind,T as serialiseHostsChunks,me as singleton,fe as sleep,ve as stageFromWireEnvironment,w as suffixedAccountName,TE as suggestRegionForTimezone,J_ as toDeploymentFailureAnalysis,s as toKebab,L as toPascalCase,D as toScreamingSnake,p as toValidDatabaseName,YE as upgradeCommand};
+import{DNS_APEX as r,getDomainExportNames as _,getDomainStackName as A,getDomainUsEast1CertificatesStackName as o,hostsExportPartName as t,serialiseHostsChunks as T,HOSTS_OUTPUT_MAX_BYTES as S,isManagedDomainBinding as a,DOMAIN_DEPLOY_DEFAULT_PHASE as N}from"./infra/domainExports.js";import{BACKUP_VAULT_NAME as i}from"./infra/backupVault.js";import{APPROVAL_TOKEN_OUTPUT_PREFIX as O,TOKEN_STDERR_PREFIX as m}from"./deploy/approvalTokenOutput.js";import{imageTagParameterName as C}from"./infra/imageTags.js";import{toPascalCase as L,toKebab as s,toValidDatabaseName as p,toScreamingSnake as D,capitalise as M,getSafeZoneName as c,accountConstructKey as f,hasAsciiStableConstructKey as F}from"./naming/caseConversion.js";import{albDnsExportName as l,albHostedZoneIdExportName as u,cdnDomainExportName as d,bucketWebsiteEndpointExportName as x,bucketWebsiteHostedZoneIdExportName as g}from"./naming/targetExportNames.js";import{CAPACITY_SLOT_PATTERN as h,CAPACITY_SLOT_MAX_LENGTH as H,DEFAULT_CAPACITY_SLOT as V,CAPACITY_ANCHOR_PATTERN as Y,CAPACITY_ANCHOR_MAX_LENGTH as y,CAPACITY_IDENTITY_CONTEXT_KEY as K,CapacityIdentityPinSchema as v,CapacityIdentityWireSchema as X,CapacityIdentityConfigSchema as b,projectCapacityIdentityToTarget as B}from"./capacityIdentity.js";import{findAccountNameCollision as J}from"./naming/accountNameCollision.js";import{defaultConnectedAccountName as j,suffixedAccountName as w,REGION_SHORT_CODES as Z,findTrailingRegionShortCode as q,regionSuffixRejectionMessage as z}from"./naming/connectedAccountName.js";import{normaliseError as $,getErrorMessage as ee,hasErrorCode as Ee,getErrorCode as re,getErrorStack as _e,formatErrorString as Ae}from"./errorUtils.js";import{FJALL_CONFIG_DIR_ENV as te,FJALL_CREDENTIALS_FILENAME as Te,FJALL_HOME_DIRNAME as Se,FJALL_LOG_DIR_ENV as ae,fjallCredentialsPath as Ne,fjallHomeDir as Re,fjallLogDir as ie,fjallStatePath as ne}from"./fjallHome.js";import{singleton as me}from"./async/singleton.js";import{DANGEROUS_ENV_VARS as Ce,filterDangerousEnvVars as Pe,MASKED_VALUE_MARKER as Le,maskSensitiveOutput as se,parseShellArgs as pe,REDACTED_KEY_SENTINEL as De,SCOPED_TOKEN_REGEX as Me}from"./securityHelpers.js";import{sleep as fe}from"./async/sleep.js";import{mapSettledWithConcurrency as Ue}from"./async/concurrency.js";import{ACCOUNT_STAGES_WITH_ROOT as ue,STRUCTURAL_ENVIRONMENTS as de,ACCOUNT_STAGES as xe,ACCOUNT_STAGE_LABELS as ge,isAccountStage as Ge,ACCOUNT_TIERS as he,AccountTierSchema as He,isAccountTier as Ve,GOVERNANCE_ACCOUNT_TIERS as Ye,isGovernanceTier as ye,environmentToTier as Ke,stageFromWireEnvironment as ve,accountTier as Xe,resolveSynthEnvironment as be,getEnvironmentLabel as Be,ACCOUNT_ROLES as We}from"./environments.js";import{RESOURCE_CATEGORIES as ke,categoriseResource as je,getExpectedDuration as we,getFriendlyResourceType as Ze}from"./resourceCategorisation.js";import{parseGitRemoteUrl as ze}from"./repo/gitRemoteParser.js";import{abbreviateRegion as $e,AWS_REGIONS_METADATA as eE,DEFAULT_REGION as EE,getRegionInfo as rE,MAX_SECONDARY_REGIONS as _E,OPT_IN_REGION_CODES as AE,optInRegionWarning as oE,regions as tE,suggestRegionForTimezone as TE}from"./infra/regions.js";import{SCOPE_VALUES as aE,MACHINE_ONLY_SCOPES as NE,USER_GRANTABLE_SCOPES as RE,GOVERNANCE_SCOPE_REQUIRED_CODE as iE}from"./infra/tokenScopes.js";import{SECRET_NAME_PATTERN as OE,SECRET_NAME_ERROR as mE,SSM_COMPONENT_PATTERN as IE,SSM_COMPONENT_ERROR as CE,SSM_STANDARD_MAX_VALUE_BYTES as PE,SecretNamespaceSchema as LE,buildNamespaceParts as sE,buildParameterPath as pE,parseParameterPath as DE,isManageablePath as ME,parseDotEnv as cE,escapeDotEnvValue as fE}from"./secrets.js";import{ConnectionWireSchema as UE,ConnectionsListResponseSchema as lE,CONNECTION_PHASES as uE,CONNECTION_TERMINAL_FAILURE_PHASES as dE,CONNECTION_FAILURE_REASONS as xE,EXTERNAL_ID_PATTERN as gE}from"./infra/connectionsWire.js";import{PUBLIC_PACKAGE_NAME as hE,INSTALL_SOURCES as HE,SETUP_COMMANDS as VE,upgradeCommand as YE,SETUP_MODES as yE,SETUP_STEP_IDS as KE,SETUP_STEPS as vE,AGENT_SETUP_PROMPTS as XE,AGENT_INSTALL_COMMAND as bE,SKILL_INSTALL_SEGMENTS as BE,SKILL_INSTALL_FILENAME as WE,SKILL_INSTALL_PATH as JE}from"./onboarding/index.js";import{deriveRegionsFromOrgConfig as jE,deriveTargets as wE,deriveAllTargets as ZE,environmentOrTier as qE,findTarget as zE,generateTargetName as QE}from"./targets.js";import{buildAppConfigPath as er}from"./repo/appPath.js";import{findInfrastructurePaths as rr,findBoundaryPath as _r,isInfrastructureFile as Ar}from"./repo/findInfrastructurePaths.js";import{inferContainerFromCandidates as tr}from"./repo/inferContainerFromCandidates.js";import{RESERVED_APP_NAMES as Sr,RESERVED_APP_NAME_MESSAGE as ar,isReservedAppName as Nr,RESERVED_APP_NAME_SUFFIX as Rr,RESERVED_APP_NAME_SUFFIX_MESSAGE as ir,hasReservedAppNameSuffix as nr}from"./naming/reservedAppNames.js";import{deriveContentHashTag as mr,CONTENT_HASH_TAG_PATTERN as Ir}from"./infra/deriveContentHashTag.js";import{DEPLOY_MODES as Pr,DeployModeSchema as Lr,IMAGE_TAG_PATTERN as sr,ImageTagSchema as pr,ServiceArtefactSchema as Dr,ServiceArtefactsSchema as Mr,ARTEFACT_OUTPUT_FIELDS as cr,artefactOutputKey as fr}from"./infra/deployArtefacts.js";import{MIGRATION_SNAPSHOT_NAME_PREFIX as Ur,EXPECTED_SCHEMA_VERSION_ENV as lr,EXPECTED_SCHEMA_VERSION_TOOL_ENV as ur,EXPECTED_CH_SCHEMA_VERSION_ENV as dr,SCHEMA_ADMIN_USER_ENV as xr,SCHEMA_ADMIN_PASSWORD_ENV as gr,PRISMA_MIGRATION_DIR_RE as Gr,CLICKHOUSE_MIGRATION_SKIP_RE as hr}from"./migration/constants.js";import{SCHEMA_GATE_EXIT as Vr,SCHEMA_GATE_EXIT_HINTS as Yr,schemaGateExitKind as yr}from"./migration/schemaGateExit.js";import{FJALL_SCHEMA_GATE_USER as vr,FJALL_MAINTENANCE_USER as Xr,FJALL_CLICKHOUSE_USERS as br}from"./migration/clickhouseFrameworkUsers.js";import{PHYSICAL_NAME_FALLBACK_PROPERTIES as Wr}from"./cfn/physicalNameProperties.js";import{PATTERN_TYPE_VALUES as kr,PATTERN_TYPES as jr,isPatternType as wr,PATTERN_REGISTRY as Zr,patternConstructId as qr,DEPLOYABLE_PATTERN_TYPES as zr,OPENNEXT_PATTERN_TYPES as Qr,isOpenNextPatternType as $r,STATIC_SITE_ROUTING_VALUES as e_,STATIC_SITE_ROUTING_INFO as E_,PATTERN_CREATE_INPUT_VALUES as r_,PATTERN_CREATE_INPUT_FLAGS as __}from"./patterns/patternTypes.js";import{FRAMEWORK_VALUES as o_,FRAMEWORKS as t_,isFramework as T_,FRAMEWORK_PATTERN_RECOMMENDATIONS as S_,recommendPatternForFramework as a_,CREATABLE_FRAMEWORKS as N_,requiredInputsForFramework as R_}from"./patterns/frameworkPatterns.js";import{DEFAULT_FORMS_FROM_LOCAL_PART as n_,defaultFormsFromAddress as O_,defaultFormsCorsOrigin as m_,isAddressAtDomain as I_}from"./patterns/staticSiteForms.js";import{DEV_SUBSTRATE_PARAMS_SCHEMA_VERSION as P_,DEV_SUBSTRATE_PARAMS_FILENAME as L_,DevSubstrateSynthPropsSchema as s_,DevSubstrateParamsSchema as p_}from"./devSubstrate/params.js";import{DEV_SUBSTRATE_ENTRYPOINT_SOURCE as M_}from"./devSubstrate/entrypoint.js";import{BLESSED_CDK_TOOLCHAIN as f_}from"./cdkToolchain.js";import{DEPLOYMENT_FAILURE_PHASES as U_,DeploymentFailurePhaseSchema as l_,DEPLOYMENT_FAULT_ATTRIBUTIONS as u_,DeploymentFaultAttributionSchema as d_,DEPLOYMENT_FAILURE_PROVIDER_SOURCES as x_,DeploymentFailureProviderSourceSchema as g_,DEPLOYMENT_FAILURE_CODE_PATTERN as G_,DEPLOYMENT_FAILURE_SCHEMA_VERSION as h_,DEPLOYMENT_FAILURE_LIMITS as H_,DeploymentFailureAnalysisSchema as V_,DeploymentFailureProviderSchema as Y_,DeploymentFailureResourceSchema as y_,DeploymentFailureSchema as K_,parseDeploymentFailure as v_,DEPLOYMENT_FAILURE_DOCS_BASE_URL as X_,deploymentFailureDocsUrl as b_,DEPLOYMENT_FAULT_COPY as B_,DEPLOYMENT_PROVIDER_LABELS as W_,deriveErrorMessageFromFailure as J_,toDeploymentFailureAnalysis as k_}from"./failure/deploymentFailure.js";import{extractErrorWindow as w_,ERROR_WINDOW_CONTEXT_LINES as Z_}from"./failure/extractErrorWindow.js";import{FJALL_COMPONENT_GITIGNORE as z_,FJALL_PROJECT_GITIGNORE as Q_,FJALL_STATE_GITIGNORE_ENTRIES as $_,FJALL_MANAGED_STATE_DIR_ENTRIES as eA,LOCAL_CONFIG_GITIGNORE_ENTRY as EA}from"./scaffold/gitignore.js";import{ensureGitignoreEntries as _A}from"./scaffold/ensureGitignore.js";export{We as ACCOUNT_ROLES,xe as ACCOUNT_STAGES,ue as ACCOUNT_STAGES_WITH_ROOT,ge as ACCOUNT_STAGE_LABELS,he as ACCOUNT_TIERS,bE as AGENT_INSTALL_COMMAND,XE as AGENT_SETUP_PROMPTS,O as APPROVAL_TOKEN_OUTPUT_PREFIX,cr as ARTEFACT_OUTPUT_FIELDS,eE as AWS_REGIONS_METADATA,He as AccountTierSchema,i as BACKUP_VAULT_NAME,f_ as BLESSED_CDK_TOOLCHAIN,y as CAPACITY_ANCHOR_MAX_LENGTH,Y as CAPACITY_ANCHOR_PATTERN,K as CAPACITY_IDENTITY_CONTEXT_KEY,H as CAPACITY_SLOT_MAX_LENGTH,h as CAPACITY_SLOT_PATTERN,hr as CLICKHOUSE_MIGRATION_SKIP_RE,xE as CONNECTION_FAILURE_REASONS,uE as CONNECTION_PHASES,dE as CONNECTION_TERMINAL_FAILURE_PHASES,Ir as CONTENT_HASH_TAG_PATTERN,N_ as CREATABLE_FRAMEWORKS,b as CapacityIdentityConfigSchema,v as CapacityIdentityPinSchema,X as CapacityIdentityWireSchema,UE as ConnectionWireSchema,lE as ConnectionsListResponseSchema,Ce as DANGEROUS_ENV_VARS,V as DEFAULT_CAPACITY_SLOT,n_ as DEFAULT_FORMS_FROM_LOCAL_PART,EE as DEFAULT_REGION,zr as DEPLOYABLE_PATTERN_TYPES,G_ as DEPLOYMENT_FAILURE_CODE_PATTERN,X_ as DEPLOYMENT_FAILURE_DOCS_BASE_URL,H_ as DEPLOYMENT_FAILURE_LIMITS,U_ as DEPLOYMENT_FAILURE_PHASES,x_ as DEPLOYMENT_FAILURE_PROVIDER_SOURCES,h_ as DEPLOYMENT_FAILURE_SCHEMA_VERSION,u_ as DEPLOYMENT_FAULT_ATTRIBUTIONS,B_ as DEPLOYMENT_FAULT_COPY,W_ as DEPLOYMENT_PROVIDER_LABELS,Pr as DEPLOY_MODES,M_ as DEV_SUBSTRATE_ENTRYPOINT_SOURCE,L_ as DEV_SUBSTRATE_PARAMS_FILENAME,P_ as DEV_SUBSTRATE_PARAMS_SCHEMA_VERSION,r as DNS_APEX,N as DOMAIN_DEPLOY_DEFAULT_PHASE,Lr as DeployModeSchema,V_ as DeploymentFailureAnalysisSchema,l_ as DeploymentFailurePhaseSchema,Y_ as DeploymentFailureProviderSchema,g_ as DeploymentFailureProviderSourceSchema,y_ as DeploymentFailureResourceSchema,K_ as DeploymentFailureSchema,d_ as DeploymentFaultAttributionSchema,p_ as DevSubstrateParamsSchema,s_ as DevSubstrateSynthPropsSchema,Z_ as ERROR_WINDOW_CONTEXT_LINES,dr as EXPECTED_CH_SCHEMA_VERSION_ENV,lr as EXPECTED_SCHEMA_VERSION_ENV,ur as EXPECTED_SCHEMA_VERSION_TOOL_ENV,gE as EXTERNAL_ID_PATTERN,br as FJALL_CLICKHOUSE_USERS,z_ as FJALL_COMPONENT_GITIGNORE,te as FJALL_CONFIG_DIR_ENV,Te as FJALL_CREDENTIALS_FILENAME,Se as FJALL_HOME_DIRNAME,ae as FJALL_LOG_DIR_ENV,Xr as FJALL_MAINTENANCE_USER,eA as FJALL_MANAGED_STATE_DIR_ENTRIES,Q_ as FJALL_PROJECT_GITIGNORE,vr as FJALL_SCHEMA_GATE_USER,$_ as FJALL_STATE_GITIGNORE_ENTRIES,t_ as FRAMEWORKS,S_ as FRAMEWORK_PATTERN_RECOMMENDATIONS,o_ as FRAMEWORK_VALUES,Ye as GOVERNANCE_ACCOUNT_TIERS,iE as GOVERNANCE_SCOPE_REQUIRED_CODE,S as HOSTS_OUTPUT_MAX_BYTES,sr as IMAGE_TAG_PATTERN,HE as INSTALL_SOURCES,pr as ImageTagSchema,EA as LOCAL_CONFIG_GITIGNORE_ENTRY,NE as MACHINE_ONLY_SCOPES,Le as MASKED_VALUE_MARKER,_E as MAX_SECONDARY_REGIONS,Ur as MIGRATION_SNAPSHOT_NAME_PREFIX,Qr as OPENNEXT_PATTERN_TYPES,AE as OPT_IN_REGION_CODES,__ as PATTERN_CREATE_INPUT_FLAGS,r_ as PATTERN_CREATE_INPUT_VALUES,Zr as PATTERN_REGISTRY,jr as PATTERN_TYPES,kr as PATTERN_TYPE_VALUES,Wr as PHYSICAL_NAME_FALLBACK_PROPERTIES,Gr as PRISMA_MIGRATION_DIR_RE,hE as PUBLIC_PACKAGE_NAME,De as REDACTED_KEY_SENTINEL,Z as REGION_SHORT_CODES,Sr as RESERVED_APP_NAMES,ar as RESERVED_APP_NAME_MESSAGE,Rr as RESERVED_APP_NAME_SUFFIX,ir as RESERVED_APP_NAME_SUFFIX_MESSAGE,ke as RESOURCE_CATEGORIES,gr as SCHEMA_ADMIN_PASSWORD_ENV,xr as SCHEMA_ADMIN_USER_ENV,Vr as SCHEMA_GATE_EXIT,Yr as SCHEMA_GATE_EXIT_HINTS,Me as SCOPED_TOKEN_REGEX,aE as SCOPE_VALUES,mE as SECRET_NAME_ERROR,OE as SECRET_NAME_PATTERN,VE as SETUP_COMMANDS,yE as SETUP_MODES,vE as SETUP_STEPS,KE as SETUP_STEP_IDS,WE as SKILL_INSTALL_FILENAME,JE as SKILL_INSTALL_PATH,BE as SKILL_INSTALL_SEGMENTS,CE as SSM_COMPONENT_ERROR,IE as SSM_COMPONENT_PATTERN,PE as SSM_STANDARD_MAX_VALUE_BYTES,E_ as STATIC_SITE_ROUTING_INFO,e_ as STATIC_SITE_ROUTING_VALUES,de as STRUCTURAL_ENVIRONMENTS,LE as SecretNamespaceSchema,Dr as ServiceArtefactSchema,Mr as ServiceArtefactsSchema,m as TOKEN_STDERR_PREFIX,RE as USER_GRANTABLE_SCOPES,$e as abbreviateRegion,f as accountConstructKey,Xe as accountTier,l as albDnsExportName,u as albHostedZoneIdExportName,fr as artefactOutputKey,x as bucketWebsiteEndpointExportName,g as bucketWebsiteHostedZoneIdExportName,er as buildAppConfigPath,sE as buildNamespaceParts,pE as buildParameterPath,M as capitalise,je as categoriseResource,d as cdnDomainExportName,j as defaultConnectedAccountName,m_ as defaultFormsCorsOrigin,O_ as defaultFormsFromAddress,b_ as deploymentFailureDocsUrl,ZE as deriveAllTargets,mr as deriveContentHashTag,J_ as deriveErrorMessageFromFailure,jE as deriveRegionsFromOrgConfig,wE as deriveTargets,_A as ensureGitignoreEntries,qE as environmentOrTier,Ke as environmentToTier,fE as escapeDotEnvValue,w_ as extractErrorWindow,Pe as filterDangerousEnvVars,J as findAccountNameCollision,_r as findBoundaryPath,rr as findInfrastructurePaths,zE as findTarget,q as findTrailingRegionShortCode,Ne as fjallCredentialsPath,Re as fjallHomeDir,ie as fjallLogDir,ne as fjallStatePath,Ae as formatErrorString,QE as generateTargetName,_ as getDomainExportNames,A as getDomainStackName,o as getDomainUsEast1CertificatesStackName,Be as getEnvironmentLabel,re as getErrorCode,ee as getErrorMessage,_e as getErrorStack,we as getExpectedDuration,Ze as getFriendlyResourceType,rE as getRegionInfo,c as getSafeZoneName,F as hasAsciiStableConstructKey,Ee as hasErrorCode,nr as hasReservedAppNameSuffix,t as hostsExportPartName,C as imageTagParameterName,tr as inferContainerFromCandidates,Ge as isAccountStage,Ve as isAccountTier,I_ as isAddressAtDomain,T_ as isFramework,ye as isGovernanceTier,Ar as isInfrastructureFile,ME as isManageablePath,a as isManagedDomainBinding,$r as isOpenNextPatternType,wr as isPatternType,Nr as isReservedAppName,Ue as mapSettledWithConcurrency,se as maskSensitiveOutput,$ as normaliseError,oE as optInRegionWarning,v_ as parseDeploymentFailure,cE as parseDotEnv,ze as parseGitRemoteUrl,DE as parseParameterPath,pe as parseShellArgs,qr as patternConstructId,B as projectCapacityIdentityToTarget,a_ as recommendPatternForFramework,z as regionSuffixRejectionMessage,tE as regions,R_ as requiredInputsForFramework,be as resolveSynthEnvironment,yr as schemaGateExitKind,T as serialiseHostsChunks,me as singleton,fe as sleep,ve as stageFromWireEnvironment,w as suffixedAccountName,TE as suggestRegionForTimezone,k_ as toDeploymentFailureAnalysis,s as toKebab,L as toPascalCase,D as toScreamingSnake,p as toValidDatabaseName,YE as upgradeCommand};

package/dist/patterns/index.d.ts

@@ -7,6 +7,6 @@
  * the webapp bundles) can take the vocabulary without depending on the root
  * barrel's contents staying pure.
  */
-export { PATTERN_TYPE_VALUES, type PatternType, PATTERN_TYPES, isPatternType, type PatternArtefact, type PatternStackPlacement, type PatternDescriptor, PATTERN_REGISTRY, patternConstructId, DEPLOYABLE_PATTERN_TYPES, type OpenNextPatternType, OPENNEXT_PATTERN_TYPES, isOpenNextPatternType, STATIC_SITE_ROUTING_VALUES, type StaticSiteRouting, PATTERN_CREATE_INPUT_VALUES, type PatternCreateInput, PATTERN_CREATE_INPUT_FLAGS } from "./patternTypes.js";
+export { PATTERN_TYPE_VALUES, type PatternType, PATTERN_TYPES, isPatternType, type PatternArtefact, type PatternStackPlacement, type PatternDescriptor, PATTERN_REGISTRY, patternConstructId, DEPLOYABLE_PATTERN_TYPES, type OpenNextPatternType, OPENNEXT_PATTERN_TYPES, isOpenNextPatternType, STATIC_SITE_ROUTING_VALUES, STATIC_SITE_ROUTING_INFO, type StaticSiteRouting, type StaticSiteRoutingDescriptor, PATTERN_CREATE_INPUT_VALUES, type PatternCreateInput, PATTERN_CREATE_INPUT_FLAGS } from "./patternTypes.js";
 export { FRAMEWORK_VALUES, type Framework, FRAMEWORKS, isFramework, type DeployablePatternType, type UndeployablePatternType, type PatternRecommendation, FRAMEWORK_PATTERN_RECOMMENDATIONS, recommendPatternForFramework, CREATABLE_FRAMEWORKS, requiredInputsForFramework } from "./frameworkPatterns.js";
 export { DEFAULT_FORMS_FROM_LOCAL_PART, defaultFormsFromAddress, defaultFormsCorsOrigin, isAddressAtDomain } from "./staticSiteForms.js";

package/dist/patterns/index.js

@@ -1 +1 @@
-import{PATTERN_TYPE_VALUES as A,PATTERN_TYPES as r,isPatternType as R,PATTERN_REGISTRY as _,patternConstructId as e,DEPLOYABLE_PATTERN_TYPES as P,OPENNEXT_PATTERN_TYPES as o,isOpenNextPatternType as t,STATIC_SITE_ROUTING_VALUES as F,PATTERN_CREATE_INPUT_VALUES as N,PATTERN_CREATE_INPUT_FLAGS as S}from"./patternTypes.js";import{FRAMEWORK_VALUES as s,FRAMEWORKS as m,isFramework as L,FRAMEWORK_PATTERN_RECOMMENDATIONS as a,recommendPatternForFramework as n,CREATABLE_FRAMEWORKS as d,requiredInputsForFramework as I}from"./frameworkPatterns.js";import{DEFAULT_FORMS_FROM_LOCAL_PART as p,defaultFormsFromAddress as C,defaultFormsCorsOrigin as M,isAddressAtDomain as U}from"./staticSiteForms.js";export{d as CREATABLE_FRAMEWORKS,p as DEFAULT_FORMS_FROM_LOCAL_PART,P as DEPLOYABLE_PATTERN_TYPES,m as FRAMEWORKS,a as FRAMEWORK_PATTERN_RECOMMENDATIONS,s as FRAMEWORK_VALUES,o as OPENNEXT_PATTERN_TYPES,S as PATTERN_CREATE_INPUT_FLAGS,N as PATTERN_CREATE_INPUT_VALUES,_ as PATTERN_REGISTRY,r as PATTERN_TYPES,A as PATTERN_TYPE_VALUES,F as STATIC_SITE_ROUTING_VALUES,M as defaultFormsCorsOrigin,C as defaultFormsFromAddress,U as isAddressAtDomain,L as isFramework,t as isOpenNextPatternType,R as isPatternType,e as patternConstructId,n as recommendPatternForFramework,I as requiredInputsForFramework};
+import{PATTERN_TYPE_VALUES as A,PATTERN_TYPES as r,isPatternType as _,PATTERN_REGISTRY as R,patternConstructId as e,DEPLOYABLE_PATTERN_TYPES as P,OPENNEXT_PATTERN_TYPES as o,isOpenNextPatternType as t,STATIC_SITE_ROUTING_VALUES as N,STATIC_SITE_ROUTING_INFO as F,PATTERN_CREATE_INPUT_VALUES as S,PATTERN_CREATE_INPUT_FLAGS as O}from"./patternTypes.js";import{FRAMEWORK_VALUES as I,FRAMEWORKS as m,isFramework as L,FRAMEWORK_PATTERN_RECOMMENDATIONS as a,recommendPatternForFramework as n,CREATABLE_FRAMEWORKS as d,requiredInputsForFramework as C}from"./frameworkPatterns.js";import{DEFAULT_FORMS_FROM_LOCAL_PART as i,defaultFormsFromAddress as p,defaultFormsCorsOrigin as M,isAddressAtDomain as Y}from"./staticSiteForms.js";export{d as CREATABLE_FRAMEWORKS,i as DEFAULT_FORMS_FROM_LOCAL_PART,P as DEPLOYABLE_PATTERN_TYPES,m as FRAMEWORKS,a as FRAMEWORK_PATTERN_RECOMMENDATIONS,I as FRAMEWORK_VALUES,o as OPENNEXT_PATTERN_TYPES,O as PATTERN_CREATE_INPUT_FLAGS,S as PATTERN_CREATE_INPUT_VALUES,R as PATTERN_REGISTRY,r as PATTERN_TYPES,A as PATTERN_TYPE_VALUES,F as STATIC_SITE_ROUTING_INFO,N as STATIC_SITE_ROUTING_VALUES,M as defaultFormsCorsOrigin,p as defaultFormsFromAddress,Y as isAddressAtDomain,L as isFramework,t as isOpenNextPatternType,_ as isPatternType,e as patternConstructId,n as recommendPatternForFramework,C as requiredInputsForFramework};

package/dist/patterns/patternTypes.d.ts

@@ -135,7 +135,48 @@ export declare function isOpenNextPatternType(value: string | undefined | null):
 /**
  * Routing mode for a static site. Shared with the CDN construct and the
  * generator's `StaticSiteRoutingSchema`, both of which derive from this tuple —
- * a third mode must not be addable to one without the other.
+ * a mode must not be addable to one without the other.
+ *
+ * The first two modes answer the same question — which object does a pretty
+ * URL serve? — for the two layouts a static build emits: `multipage` for
+ * builds that write `about.html` (Astro `build.format: "file"`, Next.js
+ * default export), `directory` for builds that write `about/index.html`
+ * (Astro's default `build.format: "directory"`). Both serve BOTH link shapes
+ * (`/about` and `/about/`) from their layout's object. A single hybrid mode
+ * used to rewrite trailing-slash requests one way and bare requests the
+ * other, which gave every site exactly one working link shape and one broken
+ * one.
+ *
+ * `spa` opts out of rewriting entirely: unknown paths fall back to
+ * `/index.html` for client-side routing.
  */
-export declare const STATIC_SITE_ROUTING_VALUES: readonly ["multipage", "spa"];
+export declare const STATIC_SITE_ROUTING_VALUES: readonly ["multipage", "directory", "spa"];
 export type StaticSiteRouting = (typeof STATIC_SITE_ROUTING_VALUES)[number];
+/**
+ * Human-facing vocabulary for each routing mode, beside the tuple that
+ * governs it (the same shape as `PATTERN_REGISTRY`'s `label`). The CLI
+ * picker, the `--routing` flag help and the agent SKILL all render from
+ * here, so a mode added to the tuple fails to compile until it states what
+ * it serves — and no surface can drift onto its own wording of what a mode
+ * means.
+ */
+export interface StaticSiteRoutingDescriptor {
+    /** Short name for pickers (the Ink `Select` label). */
+    readonly label: string;
+    /** One-line behaviour summary, phrased as what a request serves. */
+    readonly summary: string;
+}
+export declare const STATIC_SITE_ROUTING_INFO: {
+    readonly multipage: {
+        readonly label: "Multi-page (.html files)";
+        readonly summary: "/about serves /about.html";
+    };
+    readonly directory: {
+        readonly label: "Directory index";
+        readonly summary: "/about serves /about/index.html";
+    };
+    readonly spa: {
+        readonly label: "Single-page app";
+        readonly summary: "unknown paths fall back to /index.html";
+    };
+};

package/dist/patterns/patternTypes.js

@@ -1 +1 @@
-var n=Object.defineProperty;var e=(t,o)=>n(t,"name",{value:o,configurable:!0});import{toPascalCase as s}from"../naming/caseConversion.js";const a=["payload","nextjs","staticsite"],c=new Set(a);function l(t){return typeof t=="string"&&c.has(t)}e(l,"isPatternType");const d=["source","buildCommand","outputDir"],E={source:"--source",buildCommand:"--build-command",outputDir:"--output-dir"},r={payload:{label:"Payload CMS",constructIdSuffix:"Payload",artefact:"opennext-lambda",stackPlacement:"compute",deployable:!0,requiredCreateInputs:[]},nextjs:{label:"Next.js",constructIdSuffix:"Nextjs",artefact:"opennext-lambda",stackPlacement:"compute",deployable:!1,requiredCreateInputs:[]},staticsite:{label:"Static site",constructIdSuffix:"StaticSite",artefact:"static-assets",stackPlacement:"cdn",deployable:!0,requiredCreateInputs:["source","buildCommand","outputDir"]}};function P(t,o){return`${s(t)}${r[o].constructIdSuffix}`}e(P,"patternConstructId");const x=a.filter(t=>r[t].deployable),u=a.filter(t=>r[t].artefact==="opennext-lambda"),p=new Set(u);function f(t){return t!=null&&p.has(t)}e(f,"isOpenNextPatternType");const S=["multipage","spa"];export{x as DEPLOYABLE_PATTERN_TYPES,u as OPENNEXT_PATTERN_TYPES,E as PATTERN_CREATE_INPUT_FLAGS,d as PATTERN_CREATE_INPUT_VALUES,r as PATTERN_REGISTRY,c as PATTERN_TYPES,a as PATTERN_TYPE_VALUES,S as STATIC_SITE_ROUTING_VALUES,f as isOpenNextPatternType,l as isPatternType,P as patternConstructId};
+var n=Object.defineProperty;var e=(t,a)=>n(t,"name",{value:a,configurable:!0});import{toPascalCase as s}from"../naming/caseConversion.js";const o=["payload","nextjs","staticsite"],u=new Set(o);function T(t){return typeof t=="string"&&u.has(t)}e(T,"isPatternType");const d=["source","buildCommand","outputDir"],m={source:"--source",buildCommand:"--build-command",outputDir:"--output-dir"},r={payload:{label:"Payload CMS",constructIdSuffix:"Payload",artefact:"opennext-lambda",stackPlacement:"compute",deployable:!0,requiredCreateInputs:[]},nextjs:{label:"Next.js",constructIdSuffix:"Nextjs",artefact:"opennext-lambda",stackPlacement:"compute",deployable:!1,requiredCreateInputs:[]},staticsite:{label:"Static site",constructIdSuffix:"StaticSite",artefact:"static-assets",stackPlacement:"cdn",deployable:!0,requiredCreateInputs:["source","buildCommand","outputDir"]}};function E(t,a){return`${s(t)}${r[a].constructIdSuffix}`}e(E,"patternConstructId");const x=o.filter(t=>r[t].deployable),c=o.filter(t=>r[t].artefact==="opennext-lambda"),l=new Set(c);function P(t){return t!=null&&l.has(t)}e(P,"isOpenNextPatternType");const S=["multipage","directory","spa"],f={multipage:{label:"Multi-page (.html files)",summary:"/about serves /about.html"},directory:{label:"Directory index",summary:"/about serves /about/index.html"},spa:{label:"Single-page app",summary:"unknown paths fall back to /index.html"}};export{x as DEPLOYABLE_PATTERN_TYPES,c as OPENNEXT_PATTERN_TYPES,m as PATTERN_CREATE_INPUT_FLAGS,d as PATTERN_CREATE_INPUT_VALUES,r as PATTERN_REGISTRY,u as PATTERN_TYPES,o as PATTERN_TYPE_VALUES,f as STATIC_SITE_ROUTING_INFO,S as STATIC_SITE_ROUTING_VALUES,P as isOpenNextPatternType,T as isPatternType,E as patternConstructId};

package/dist/scaffold/ensureGitignore.d.ts

@@ -1,18 +1,26 @@
 /**
  * Idempotently guarantee that a `.gitignore` in `directory` carries `entries`.
  *
- * Absent file → written with `header` followed by the entries. Existing file →
- * only the missing entries are appended, under `marker` so the addition is
- * attributable. An entry already present anywhere in the file (at any
- * indentation) is left alone, so repeat calls are no-ops.
+ * Absent file → written with `header` followed by the entries, unless the
+ * caller passes `createIfMissing: false`. Existing file → only the missing
+ * entries are appended, under `marker` so the addition is attributable. An
+ * entry already present anywhere in the file (at any indentation) is left
+ * alone, so repeat calls are no-ops.
+ *
+ * `createIfMissing: false` is for migration callers, which append globs to a
+ * checkout that already ignores something. Creating a `.gitignore` where the
+ * author never had one is a write into their repository that they did not
+ * ask for, and it is not what a migration means.
  *
  * Best-effort by design: this maintains repository hygiene, never correctness.
  * The caller's real work — writing config or recording deploy state — must not
  * fail because a `.gitignore` could not be written (read-only checkout, no
  * repository at all, permissions). Returns whether the file now provably
- * carries every entry, for callers that want to assert or log.
+ * carries every entry, for callers that want to assert or log — so a skipped
+ * creation reports `false`, because no file carries anything.
  */
 export declare function ensureGitignoreEntries(directory: string, entries: readonly string[], options: {
     header?: string;
     marker: string;
+    createIfMissing?: boolean;
 }): boolean;

package/dist/scaffold/ensureGitignore.js

@@ -1,9 +1,9 @@
-var d=Object.defineProperty;var u=(o,e)=>d(o,"name",{value:e,configurable:!0});import i from"fs";import g from"path";function l(o,e,s){const t=g.join(o,".gitignore");try{const r=i.existsSync(t)?i.readFileSync(t,"utf8"):void 0;if(r===void 0){const n=s.header??"";return i.writeFileSync(t,`${n}${e.join(`
+var d=Object.defineProperty;var o=(s,n)=>d(s,"name",{value:n,configurable:!0});import i from"fs";import g from"path";function p(s,n,f){const t=g.join(s,".gitignore");try{const r=i.existsSync(t)?i.readFileSync(t,"utf8"):void 0;if(r===void 0){if(f.createIfMissing===!1)return!1;const e=f.header??"";return i.writeFileSync(t,`${e}${n.join(`
 `)}
-`,{encoding:"utf8"}),!0}const a=new Set(r.split(`
-`).map(n=>n.trim())),c=e.filter(n=>!a.has(n));if(c.length===0)return!0;const f=r===""||r.endsWith(`
+`,{encoding:"utf8"}),!0}const c=new Set(r.split(`
+`).map(e=>e.trim())),a=n.filter(e=>!c.has(e));if(a.length===0)return!0;const u=r===""||r.endsWith(`
 `)?"":`
-`;return i.appendFileSync(t,`${f}${s.marker}
-${c.join(`
+`;return i.appendFileSync(t,`${u}${f.marker}
+${a.join(`
 `)}
-`,"utf8"),!0}catch{return!1}}u(l,"ensureGitignoreEntries");export{l as ensureGitignoreEntries};
+`,"utf8"),!0}catch{return!1}}o(p,"ensureGitignoreEntries");export{p as ensureGitignoreEntries};

package/dist/securityHelpers.js

@@ -1 +1 @@
-var g=Object.defineProperty;var A=(t,a)=>g(t,"name",{value:a,configurable:!0});const R=new Set(["NODE_OPTIONS","NODE_PATH","NODE_EXTRA_CA_CERTS","NODE_DEBUG","NODE_PRESERVE_SYMLINKS","LD_PRELOAD","LD_LIBRARY_PATH","LD_AUDIT","LD_BIND_NOW","DYLD_INSERT_LIBRARIES","DYLD_LIBRARY_PATH","DYLD_FRAMEWORK_PATH","PYTHONPATH","PYTHONSTARTUP","PERL5LIB","PERL5OPT","RUBYLIB","RUBYOPT","HOME","XDG_CONFIG_HOME","AWS_SHARED_CREDENTIALS_FILE","AWS_CONFIG_FILE","SHELL","BASH_ENV","ENV","ZDOTDIR"]);function u(t){return Object.fromEntries(Object.entries(t).filter(([a])=>!R.has(a.toUpperCase())))}A(u,"filterDangerousEnvVars");const L=/fjall_(?:ak|dk)_[A-Z2-7]{16}\.[A-Z2-7]{40}/,S=/(fjall_(?:ak|dk)_)[A-Z2-7]{16}\.[A-Z2-7]{40}/g,D=/\bfj_[0-9a-f]{8}_[0-9a-f]{48}\b/gi,s="***",i="[REDACTED]",o=`-----BEGIN ${i} PRIVATE KEY-----...-----END ${i} PRIVATE KEY-----`,l=String.raw`(?:next|continuation|pagination|page|forward|backward)+token`,p=String.raw`(?!ghu_|ghs_|ghp_|gho_|github_pat_|(?:sk|rk)_(?:live|test)_|whsec_|fjall_(?:ak|dk)_|fj_[0-9a-f]{8}_|AKIA|ASIA|%[a-zA-Z])`,I=new RegExp(String.raw`(?<!"${l}":\s*")`+String.raw`(?<="[a-zA-Z0-9_-]*(?:password|passwd|secret|api[_-]?key|token|auth|credential)":\s*")`+p+String.raw`[^"]+`,"gi"),N=new RegExp(String.raw`(?<!${l}\s*[=:]\s*["']?)`+String.raw`(?<=(?<!/)(?:password|passwd|secret|api[_-]?key|token|auth|credential)\s*[=:]\s*["']?)`+p+String.raw`[^\s"']+`,"gi");function f(t){return t.replace(/-----BEGIN [A-Z ]*PRIVATE KEY-----(?:[^"\\]|\\[\\nrt"])*?-----END [A-Z ]*PRIVATE KEY-----/g,()=>o).replace(/-----BEGIN [A-Z ]*PRIVATE KEY-----[\s\S]*?-----END [A-Z ]*PRIVATE KEY-----/g,()=>o).replace(/(\w+:\/\/[^:]+:)[^@]+(@)/gi,(a,e,_)=>`${e}${s}${_}`).replace(/(?<![a-zA-Z])(password|passwd|secret|api[_-]?key|token|auth|credential)([=:])["']?[^\s"']+/gi,(a,e,_)=>`${e}${_}${s}`).replace(I,s).replace(N,s).replace(/\b(ghu_|ghs_|ghp_|gho_|github_pat_)[A-Za-z0-9_]+/g,(a,e)=>`${e}${s}`).replace(/\b(sk|rk)_(live|test)_[A-Za-z0-9]{8,}/g,(a,e,_)=>`${e}_${_}_${s}`).replace(/\bwhsec_[A-Za-z0-9]{8,}/g,()=>`whsec_${s}`).replace(/(?<=Authorization:\s*Bearer\s+)[A-Za-z0-9._~+/=-]+/gi,s).replace(/\b(AKIA|ASIA)[A-Z0-9]{12,}\b/g,(a,e)=>`${e}${s}`).replace(/(?<=aws_secret_access_key\s*=\s*["']?|SecretAccessKey[=:]\s*|"(aws)?secretAccessKey":\s*"|"aws_secret_access_key":\s*")[A-Za-z0-9/+=]{40,}/gi,s).replace(/(?<="(aws)?sessionToken":\s*"|"aws_session_token":\s*")[^"]+/gi,s).replace(/(?<=aws_session_token\s*[=:]\s*["']?|SessionToken[=:]\s*["']?)[^\s"']+/gi,s).replace(/(?<="(internal[Aa]piKey|fjallCallbackToken)":\s*")[^"]+/g,s).replace(S,(a,e)=>`${e}${s}`).replace(D,()=>`fj_${s}`)}A(f,"maskSensitiveOutput");function w(t){const a=[];let e="",_=!1,E=!1,c=!1,n=!1;for(const r of t){if(c){e+=r,c=!1;continue}if(r==="\\"&&!_){c=!0;continue}if(r==="'"&&!E){_=!_,n=!0;continue}if(r==='"'&&!_){E=!E,n=!0;continue}if(r===" "&&!_&&!E){(e||n)&&(a.push(e),e="",n=!1);continue}e+=r}if(_||E)throw new Error(`Unbalanced ${_?"single":"double"} quote in command: ${t.slice(0,80)}`);if(c)throw new Error(`Trailing backslash in command: ${t.slice(0,80)}`);return(e||n)&&a.push(e),a}A(w,"parseShellArgs");export{R as DANGEROUS_ENV_VARS,s as MASKED_VALUE_MARKER,i as REDACTED_KEY_SENTINEL,L as SCOPED_TOKEN_REGEX,u as filterDangerousEnvVars,f as maskSensitiveOutput,w as parseShellArgs};
+var p=Object.defineProperty;var c=(t,_)=>p(t,"name",{value:_,configurable:!0});const D=new Set(["NODE_OPTIONS","NODE_PATH","NODE_EXTRA_CA_CERTS","NODE_DEBUG","NODE_PRESERVE_SYMLINKS","LD_PRELOAD","LD_LIBRARY_PATH","LD_AUDIT","LD_BIND_NOW","DYLD_INSERT_LIBRARIES","DYLD_LIBRARY_PATH","DYLD_FRAMEWORK_PATH","PYTHONPATH","PYTHONSTARTUP","PERL5LIB","PERL5OPT","RUBYLIB","RUBYOPT","HOME","XDG_CONFIG_HOME","AWS_SHARED_CREDENTIALS_FILE","AWS_CONFIG_FILE","SHELL","BASH_ENV","ENV","ZDOTDIR"]);function u(t){return Object.fromEntries(Object.entries(t).filter(([_])=>!D.has(_.toUpperCase())))}c(u,"filterDangerousEnvVars");const O=/fjall_(?:ak|dk)_[A-Z2-7]{16}\.[A-Z2-7]{40}/,I=/(fjall_(?:ak|dk)_)[A-Z2-7]{16}\.[A-Z2-7]{40}/g,N=/\bfj_[0-9a-f]{8}_[0-9a-f]{48}\b/gi,s="***",o="[REDACTED]",l=`-----BEGIN ${o} PRIVATE KEY-----...-----END ${o} PRIVATE KEY-----`,g=String.raw`(?:next|continuation|pagination|page|forward|backward)+token`,R=String.raw`(?!ghu_|ghs_|ghp_|gho_|github_pat_|(?:sk|rk)_(?:live|test)_|whsec_|fjall_(?:ak|dk)_|fj_[0-9a-f]{8}_|AKIA|ASIA|%[a-zA-Z])`,i=String.raw`password|passwd|secret|api[_-]?key|token|auth|credential`,S=String.raw`arn:aws[a-z-]*:[a-z0-9-]+:[a-z0-9-]*:[0-9]*:`,T=new RegExp(String.raw`(?<!"${g}":\s*")`+String.raw`(?<="[a-zA-Z0-9_-]*(?:${i})":\s*")`+R+String.raw`[^"]+`,"gi"),L=new RegExp(String.raw`(?<!${g}\s*[=:]\s*["']?)`+String.raw`(?<!${S}(?:${i})\s*[=:]\s*["']?)`+String.raw`(?<=(?<!/)(?:${i})\s*[=:]\s*["']?)`+R+String.raw`[^\s"']+`,"gi"),w=new RegExp(String.raw`(?<!${S})(?<![a-zA-Z])(${i})([=:])["']?[^\s"']+`,"gi");function $(t){return t.replace(/-----BEGIN [A-Z ]*PRIVATE KEY-----(?:[^"\\]|\\[\\nrt"])*?-----END [A-Z ]*PRIVATE KEY-----/g,()=>l).replace(/-----BEGIN [A-Z ]*PRIVATE KEY-----[\s\S]*?-----END [A-Z ]*PRIVATE KEY-----/g,()=>l).replace(/(\w+:\/\/[^:]+:)[^@]+(@)/gi,(_,e,a)=>`${e}${s}${a}`).replace(w,(_,e,a)=>`${e}${a}${s}`).replace(T,s).replace(L,s).replace(/\b(ghu_|ghs_|ghp_|gho_|github_pat_)[A-Za-z0-9_]+/g,(_,e)=>`${e}${s}`).replace(/\b(sk|rk)_(live|test)_[A-Za-z0-9]{8,}/g,(_,e,a)=>`${e}_${a}_${s}`).replace(/\bwhsec_[A-Za-z0-9]{8,}/g,()=>`whsec_${s}`).replace(/(?<=Authorization:\s*Bearer\s+)[A-Za-z0-9._~+/=-]+/gi,s).replace(/\b(AKIA|ASIA)[A-Z0-9]{12,}\b/g,(_,e)=>`${e}${s}`).replace(/(?<=aws_secret_access_key\s*=\s*["']?|SecretAccessKey[=:]\s*|"(aws)?secretAccessKey":\s*"|"aws_secret_access_key":\s*")[A-Za-z0-9/+=]{40,}/gi,s).replace(/(?<="(aws)?sessionToken":\s*"|"aws_session_token":\s*")[^"]+/gi,s).replace(/(?<=aws_session_token\s*[=:]\s*["']?|SessionToken[=:]\s*["']?)[^\s"']+/gi,s).replace(/(?<="(internal[Aa]piKey|fjallCallbackToken)":\s*")[^"]+/g,s).replace(I,(_,e)=>`${e}${s}`).replace(N,()=>`fj_${s}`)}c($,"maskSensitiveOutput");function h(t){const _=[];let e="",a=!1,r=!1,A=!1,n=!1;for(const E of t){if(A){e+=E,A=!1;continue}if(E==="\\"&&!a){A=!0;continue}if(E==="'"&&!r){a=!a,n=!0;continue}if(E==='"'&&!a){r=!r,n=!0;continue}if(E===" "&&!a&&!r){(e||n)&&(_.push(e),e="",n=!1);continue}e+=E}if(a||r)throw new Error(`Unbalanced ${a?"single":"double"} quote in command: ${t.slice(0,80)}`);if(A)throw new Error(`Trailing backslash in command: ${t.slice(0,80)}`);return(e||n)&&_.push(e),_}c(h,"parseShellArgs");export{D as DANGEROUS_ENV_VARS,s as MASKED_VALUE_MARKER,o as REDACTED_KEY_SENTINEL,O as SCOPED_TOKEN_REGEX,u as filterDangerousEnvVars,$ as maskSensitiveOutput,h as parseShellArgs};

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@fjall/util",
-  "version": "21.1.0",
+  "version": "23.0.0",
   "repository": {
     "type": "git",
     "url": "git+https://github.com/fjall-tech/fjall.git",