@fjall/util 31.0.0 → 33.0.0

package/dist/.build-source-hash

@@ -9,7 +9,7 @@
     "package.json",
     "tsconfig.json"
   ],
-  "hash": "e245fbc1ecd86b0221c4922ff4692165210972cb6acd1fbc07046a80a75ee683",
+  "hash": "f3d44a1bfafa66fa7a658d6acf9a1adbba981638c012feb94e794e5182502c3d",
   "files": {
     "src/async/concurrency.ts": "3c7ebe0222a720f9",
     "src/async/singleton.ts": "7bcc21b0fb920561",
@@ -19,7 +19,7 @@
     "src/aws/cloudformationTypes.ts": "e43bab9c96a21856",
     "src/aws/costAllocationTags.ts": "56cb9593dab3027b",
     "src/aws/deployProgress.ts": "be09dedb4deb9a7a",
-    "src/aws/driftSuspects.ts": "5400dc05ebd6c977",
+    "src/aws/driftSuspects.ts": "ca30b2de3ed84ab3",
     "src/aws/errors.ts": "5addfa6bb2d1456a",
     "src/aws/failureAnalysisCategories.ts": "85ab1632d8069273",
     "src/aws/index.ts": "ce3da231274defdf",
@@ -27,6 +27,7 @@
     "src/aws/ipamTags.ts": "ac19ecd6c36b3bc2",
     "src/aws/maskFailureAnalysis.ts": "ae11250412cd6fd8",
     "src/aws/monitoringRole.ts": "70c8b5947dc9138d",
+    "src/backupTiers.ts": "981677b7cf1ff5b9",
     "src/buildConcurrency.ts": "1804e76ddc4f8216",
     "src/capacityIdentity.ts": "9e59bfc92a5ba361",
     "src/cdkTmpdirCleanup.ts": "4574b3f10e3ab0f9",
@@ -73,14 +74,14 @@
     "src/fsHelpers.ts": "4dd3877b3953c6a9",
     "src/fsScan.ts": "feb187758481443f",
     "src/httpKeepAlive.ts": "c8fe4b118ef4c79f",
-    "src/index.ts": "78ff2b177eeb8374",
+    "src/index.ts": "cfc916bee8f13029",
     "src/infra/backupVault.ts": "661678a6dfb0b648",
     "src/infra/connectionsWire.ts": "e3afa3ba95a531d8",
     "src/infra/deployArtefacts.ts": "235ac21dd3ccf0b2",
     "src/infra/deriveContentHashTag.ts": "115fbe6588794027",
     "src/infra/domainExports.ts": "18de5b8668633aaf",
     "src/infra/imageTags.ts": "82d14f3dfd6ca68f",
-    "src/infra/regions.ts": "26b80d7cea05454c",
+    "src/infra/regions.ts": "982acfd56adf04c2",
     "src/infra/tokenScopes.ts": "68f0152394fb416e",
     "src/insights/computePatternFingerprint.ts": "b5d3a4704f42cc1f",
     "src/logRotation.ts": "5ea989894082107b",
@@ -102,7 +103,7 @@
     "src/migration/verifyExpectedSchemaVersion.ts": "cd583329d771a047",
     "src/naming/accountNameCollision.ts": "2dc8b278ff039220",
     "src/naming/caseConversion.ts": "8b8984f2b58b8ab7",
-    "src/naming/connectedAccountName.ts": "3cd3bc7dba0a2f0b",
+    "src/naming/connectedAccountName.ts": "2290e0020d4335b0",
     "src/naming/reservedAppNames.ts": "7f63dd0b84c1972e",
     "src/naming/targetExportNames.ts": "da78a19d8b2d4a6f",
     "src/onboarding/index.ts": "7999117c5a7a18d1",
@@ -132,11 +133,11 @@
     "src/secrets.ts": "50258d463e4e67c3",
     "src/securityHelpers.ts": "1e68e1330c6da971",
     "src/staticSiteOutput.ts": "cc81ed32acc597f1",
-    "src/targets.ts": "126280f0a5762e21",
+    "src/targets.ts": "b4bdf07f06755374",
     "../scripts/minify-dist.mjs": "6b2e4b0df8aec601",
-    "package.json": "1976c21a05591af7",
-    "tsconfig.json": "db759831ad95f396"
+    "package.json": "8d5da0aef9c1c0a8",
+    "tsconfig.json": "edfc9d9fbd0729d2"
   },
-  "outputHash": "34f3e34410fa32b9cd928c6b14a219b4fca0d3ccba6c56f29de451b291cbf660",
-  "outputFileCount": 253
+  "outputHash": "68b436c9d0b584458b0ddc561afc8b16af863e97b1af2e4c165e57fabbf9ead7",
+  "outputFileCount": 247
 }

package/dist/.minified

@@ -1 +1 @@
-126 files minified at 2026-09-03T09:13:46.689Z
+123 files minified at 2026-09-05T06:21:52.328Z

package/dist/aws/driftSuspects.d.ts

@@ -3,9 +3,9 @@
  *
  * A resource CloudFormation still tracks but which was deleted outside
  * CloudFormation wedges every subsequent update: the service handler returns
- * NotFound and the stack rolls back (the BusinessContinuity CMK incident,
- * account 913524923178). The patterns here are derived from the Phase 0
- * empirical fixtures (`fjall/deploy-core/src/orchestration/drift/__tests__/
+ * NotFound and the stack rolls back (the BusinessContinuity CMK incident). The
+ * patterns here are derived from the Phase 0 empirical fixtures
+ * (`fjall/deploy-core/src/orchestration/drift/__tests__/
  * fixtures/bc-stack-events.json`, captured 2026-07-07): the stable anchors are
  * the registry handler contract marker `HandlerErrorCode: NotFound` and the
  * service message shape `does not exist (Service: …`.

package/dist/backupTiers.d.ts

@@ -0,0 +1,88 @@
+/**
+ * Application backup tier — the disaster-recovery posture an app declares
+ * once (`App.getApp(name, { backup: { tier } })`) and every tier-derived
+ * default reads. The vocabulary AND the per-tier defaults table live here so
+ * the constructs (which synthesise the defaults), the generator (whose
+ * presets and schemas speak the vocabulary) and every test that asserts what
+ * a tier promises derive from one declaration instead of copies kept in step
+ * by hand.
+ *
+ * Independent of the two other tier axes: the account governance tier
+ * ([[ACCOUNT_TIERS]]) and the generator pattern tier (`TIER_NAMES`).
+ */
+import { z } from "zod";
+export declare const BACKUP_TIERS: readonly ["standard", "resilient", "enterprise"];
+export type BackupTier = (typeof BACKUP_TIERS)[number];
+export declare const BackupTierSchema: z.ZodEnum<{
+    standard: "standard";
+    resilient: "resilient";
+    enterprise: "enterprise";
+}>;
+/** Type guard: checks whether a string is a declared application backup tier. */
+export declare function isBackupTier(value: string): value is BackupTier;
+/**
+ * Every default the app-level backup tier owns. One row per tier, one column
+ * per knob; a construct reads its column through [[tierDefault]] and never
+ * spells the value itself, so the tier→default derivation has exactly one
+ * home. An explicit prop on the construct still beats the tier column.
+ */
+export interface BackupTierDefaults {
+    /** S3 bucket versioning (`S3Bucket.versioned`). */
+    readonly s3Versioned: boolean;
+    /**
+     * RDS Instance / Aurora / Global Aurora automated backup retention in days
+     * (`backupRetention`). The read replica keeps CloudFormation's 0 — replica
+     * retention is a create-time property, so a tier flip would replace it.
+     */
+    readonly rdsBackupRetentionDays: number;
+    /**
+     * Service-side delete guards on the resources CloudFormation would refuse
+     * to delete while they are on: DynamoDB `DeletionProtectionEnabled` and
+     * the ELBv2 `deletion_protection.enabled` attribute (the load balancer
+     * guard additionally applies only in the production environment — a
+     * dev/staging stack is destroyed daily by design). RDS deletion
+     * protection is NOT tier-owned: the database constructs default it ON at
+     * every tier. The destroy pre-flight
+     * (`deploy-core/src/orchestration/application/destroyPreFlight.ts`)
+     * switches every guard off before a consented destroy, so a tier that
+     * turns one on never wedges `fjall destroy` or a CI destroy action.
+     */
+    readonly deletionProtection: boolean;
+    /**
+     * Encrypt with the stack's shared customer-managed KMS key instead of the
+     * AWS-managed default: DynamoDB tables, SNS topics, Lambda environment
+     * variables, ECS Exec session logging, and the CloudWatch log groups the
+     * tier-aware constructs create. ECR, RDS/Aurora storage and Secrets
+     * Manager keep their own knobs (each is a create-time or replacement
+     * property; flipping it from a tier would replace live data).
+     */
+    readonly customerManagedKeys: boolean;
+    /** ECS Container Insights (enhanced observability) on the cluster. */
+    readonly containerInsights: boolean;
+    /**
+     * Application load balancer access logs, delivered to the stack's
+     * lifecycle-expired access-log bucket.
+     */
+    readonly albAccessLogs: boolean;
+    /** CloudFront standard (legacy) logging to the same access-log bucket. */
+    readonly cloudFrontLogging: boolean;
+    /** Lambda active X-Ray tracing. */
+    readonly lambdaTracing: boolean;
+    /**
+     * RDS Database Insights mode when the construct has no explicit
+     * `databaseInsights.mode`; `advanced` carries 15 months of Performance
+     * Insights retention.
+     */
+    readonly databaseInsightsMode: "standard" | "advanced";
+}
+/**
+ * The tier table. `standard` is also the column an app with no tier (or
+ * `backup: false`) runs — declaring `standard` adds the DR tag and changes
+ * no default — so the untiered column is this one, not a fourth row.
+ */
+export declare const BACKUP_TIER_DEFAULTS: Readonly<Record<BackupTier, BackupTierDefaults>>;
+/**
+ * The tier-owned default for one knob. An undefined tier (no `backup` on the
+ * App, or `backup: false`) reads the `standard` column.
+ */
+export declare function tierDefault<K extends keyof BackupTierDefaults>(tier: BackupTier | undefined, knob: K): BackupTierDefaults[K];

package/dist/backupTiers.js

@@ -0,0 +1 @@
+var n=Object.defineProperty;var s=(e,t)=>n(e,"name",{value:t,configurable:!0});import{z as r}from"zod";const a=["standard","resilient","enterprise"],l=r.enum(a),o=new Set(a);function u(e){return o.has(e)}s(u,"isBackupTier");const i=Object.freeze({standard:Object.freeze({s3Versioned:!1,rdsBackupRetentionDays:14,deletionProtection:!1,customerManagedKeys:!1,containerInsights:!1,albAccessLogs:!1,cloudFrontLogging:!1,lambdaTracing:!1,databaseInsightsMode:"standard"}),resilient:Object.freeze({s3Versioned:!0,rdsBackupRetentionDays:30,deletionProtection:!0,customerManagedKeys:!1,containerInsights:!1,albAccessLogs:!1,cloudFrontLogging:!1,lambdaTracing:!1,databaseInsightsMode:"standard"}),enterprise:Object.freeze({s3Versioned:!0,rdsBackupRetentionDays:35,deletionProtection:!0,customerManagedKeys:!0,containerInsights:!0,albAccessLogs:!0,cloudFrontLogging:!0,lambdaTracing:!0,databaseInsightsMode:"advanced"})});function g(e,t){return i[e??"standard"][t]}s(g,"tierDefault");export{a as BACKUP_TIERS,i as BACKUP_TIER_DEFAULTS,l as BackupTierSchema,u as isBackupTier,g as tierDefault};

package/dist/index.d.ts

@@ -14,15 +14,16 @@ export { DANGEROUS_ENV_VARS, filterDangerousEnvVars, MASKED_VALUE_MARKER, maskSe
 export { sleep } from "./async/sleep.js";
 export { mapSettledWithConcurrency } from "./async/concurrency.js";
 export { ACCOUNT_STAGES_WITH_ROOT, STRUCTURAL_ENVIRONMENTS, ACCOUNT_STAGES, ACCOUNT_STAGE_LABELS, isAccountStage, ACCOUNT_TIERS, type AccountTier, AccountTierSchema, isAccountTier, GOVERNANCE_ACCOUNT_TIERS, isGovernanceTier, environmentToTier, type AccountStageEffect, accountStageEffect, ACCOUNT_STAGE_EFFECTS, formatAccountStageList, stageFromWireEnvironment, accountTier, resolveSynthEnvironment, type AccountStageWithRoot, type AccountStage, getEnvironmentLabel, ACCOUNT_ROLES } from "./environments.js";
+export { BACKUP_TIERS, BACKUP_TIER_DEFAULTS, type BackupTier, type BackupTierDefaults, BackupTierSchema, isBackupTier, tierDefault } from "./backupTiers.js";
 export { RESOURCE_CATEGORIES, type ResourceCategory, categoriseResource, getExpectedDuration, getFriendlyResourceType } from "./resourceCategorisation.js";
 export { parseGitRemoteUrl, type GitProvider, type ParsedGitRemote } from "./repo/gitRemoteParser.js";
-export { abbreviateRegion, AWS_REGIONS_METADATA, DEFAULT_REGION, getRegionInfo, MAX_SECONDARY_REGIONS, OPT_IN_REGION_CODES, optInRegionWarning, regions, suggestRegionForTimezone, type RegionCode, type RegionInfo } from "./infra/regions.js";
+export { abbreviateRegion, AWS_REGIONS_METADATA, DEFAULT_REGION, getRegionInfo, MAX_SECONDARY_REGIONS, OPT_IN_REGION_CODES, optInRegionWarning, regions, RETIRED_REGION_ABBREVIATIONS, suggestRegionForTimezone, type RegionCode, type RegionInfo } from "./infra/regions.js";
 export { SCOPE_VALUES, MACHINE_ONLY_SCOPES, USER_GRANTABLE_SCOPES, GOVERNANCE_SCOPE_REQUIRED_CODE, type TokenScope } from "./infra/tokenScopes.js";
 export { SECRET_NAME_PATTERN, SECRET_NAME_ERROR, SSM_COMPONENT_PATTERN, SSM_COMPONENT_ERROR, SSM_STANDARD_MAX_VALUE_BYTES, SecretNamespaceSchema, type SecretNamespace, buildNamespaceParts, buildParameterPath, parseParameterPath, isManageablePath, parseDotEnv, escapeDotEnvValue } from "./secrets.js";
 export { ConnectionWireSchema, type ConnectionWire, ConnectionsListResponseSchema, type ConnectionsListResponse, CONNECTION_PHASES, type ConnectionPhase, CONNECTION_TERMINAL_FAILURE_PHASES, type ConnectionTerminalFailurePhase, CONNECTION_FAILURE_REASONS, type ConnectionFailureReason, EXTERNAL_ID_PATTERN } from "./infra/connectionsWire.js";
 export { COMPLIANCE_ISSUE_STATUSES, type ComplianceIssueStatus, isComplianceIssueStatus } from "./complianceIssue.js";
 export { PUBLIC_PACKAGE_NAME, INSTALL_SOURCES, type InstallSource, SETUP_COMMANDS, type SetupCommandId, upgradeCommand, SETUP_MODES, type SetupMode, SETUP_STEP_IDS, type SetupStepId, type SetupStep, type SetupStepSequence, SETUP_STEPS, AGENT_SETUP_PROMPTS, AGENT_INSTALL_COMMAND, SKILL_INSTALL_SEGMENTS, SKILL_INSTALL_FILENAME, SKILL_INSTALL_PATH } from "./onboarding/index.js";
-export { deriveRegionsFromOrgConfig, deriveTargets, deriveAllTargets, environmentOrTier, findTarget, generateTargetName, type OrgConfigRegions, type TargetAccount, type DerivedTarget } from "./targets.js";
+export { deriveRegionsFromOrgConfig, deriveTargets, deriveAllTargets, environmentOrTier, explainRetiredTargetName, findTarget, generateTargetName, type OrgConfigRegions, type TargetAccount, type DerivedTarget, type ResolvedTargetAccount } from "./targets.js";
 export { buildAppConfigPath } from "./repo/appPath.js";
 export { type ScanPath } from "./repo/scanTypes.js";
 export { findInfrastructurePaths, findBoundaryPath, isInfrastructureFile, type MarkerEntry, type FindInfrastructurePathsOptions } from "./repo/findInfrastructurePaths.js";

package/dist/index.js

@@ -1 +1 @@
-import{DNS_APEX as _,getDomainExportNames as r,getDomainStackName as T,getDomainUsEast1CertificatesStackName as A,hostsExportPartName as S,serialiseHostsChunks as t,HOSTS_OUTPUT_MAX_BYTES as o,isManagedDomainBinding as a,DOMAIN_DEPLOY_DEFAULT_PHASE as N}from"./infra/domainExports.js";import{BACKUP_VAULT_NAME as I}from"./infra/backupVault.js";import{APPROVAL_TOKEN_OUTPUT_PREFIX as C,TOKEN_STDERR_PREFIX as i}from"./deploy/approvalTokenOutput.js";import{imageTagParameterName as m}from"./infra/imageTags.js";import{toPascalCase as L,toKebab as s,toValidDatabaseName as D,toScreamingSnake as p,capitalise as M,getSafeZoneName as c,accountConstructKey as f,hasAsciiStableConstructKey as F}from"./naming/caseConversion.js";import{albDnsExportName as l,albHostedZoneIdExportName as u,cdnDomainExportName as x,bucketWebsiteEndpointExportName as G,bucketWebsiteHostedZoneIdExportName as d}from"./naming/targetExportNames.js";import{CAPACITY_SLOT_PATTERN as h,CAPACITY_SLOT_MAX_LENGTH as H,DEFAULT_CAPACITY_SLOT as V,CAPACITY_ANCHOR_PATTERN as Y,CAPACITY_ANCHOR_MAX_LENGTH as y,CAPACITY_IDENTITY_CONTEXT_KEY as K,CapacityIdentityPinSchema as v,CapacityIdentityWireSchema as X,CapacityIdentityConfigSchema as b,projectCapacityIdentityToTarget as B}from"./capacityIdentity.js";import{findAccountNameCollision as J}from"./naming/accountNameCollision.js";import{defaultConnectedAccountName as j,suffixedAccountName as w,REGION_SHORT_CODES as Z,findTrailingRegionShortCode as q,regionSuffixRejectionMessage as z}from"./naming/connectedAccountName.js";import{normaliseError as $,getErrorMessage as EE,hasErrorCode as eE,getErrorCode as _E,getErrorStack as rE,formatErrorString as TE}from"./errorUtils.js";import{FJALL_CONFIG_DIR_ENV as SE,FJALL_CREDENTIALS_FILENAME as tE,FJALL_HOME_DIRNAME as oE,FJALL_LOG_DIR_ENV as aE,fjallCredentialsPath as NE,fjallHomeDir as RE,fjallLogDir as IE,fjallStatePath as OE}from"./fjallHome.js";import{singleton as iE}from"./async/singleton.js";import{DANGEROUS_ENV_VARS as mE,filterDangerousEnvVars as PE,MASKED_VALUE_MARKER as LE,maskSensitiveOutput as sE,parseShellArgs as DE,REDACTED_KEY_SENTINEL as pE,SCOPED_TOKEN_REGEX as ME}from"./securityHelpers.js";import{sleep as fE}from"./async/sleep.js";import{mapSettledWithConcurrency as UE}from"./async/concurrency.js";import{ACCOUNT_STAGES_WITH_ROOT as uE,STRUCTURAL_ENVIRONMENTS as xE,ACCOUNT_STAGES as GE,ACCOUNT_STAGE_LABELS as dE,isAccountStage as gE,ACCOUNT_TIERS as hE,AccountTierSchema as HE,isAccountTier as VE,GOVERNANCE_ACCOUNT_TIERS as YE,isGovernanceTier as yE,environmentToTier as KE,accountStageEffect as vE,ACCOUNT_STAGE_EFFECTS as XE,formatAccountStageList as bE,stageFromWireEnvironment as BE,accountTier as WE,resolveSynthEnvironment as JE,getEnvironmentLabel as kE,ACCOUNT_ROLES as jE}from"./environments.js";import{RESOURCE_CATEGORIES as ZE,categoriseResource as qE,getExpectedDuration as zE,getFriendlyResourceType as QE}from"./resourceCategorisation.js";import{parseGitRemoteUrl as Ee}from"./repo/gitRemoteParser.js";import{abbreviateRegion as _e,AWS_REGIONS_METADATA as re,DEFAULT_REGION as Te,getRegionInfo as Ae,MAX_SECONDARY_REGIONS as Se,OPT_IN_REGION_CODES as te,optInRegionWarning as oe,regions as ae,suggestRegionForTimezone as Ne}from"./infra/regions.js";import{SCOPE_VALUES as Ie,MACHINE_ONLY_SCOPES as Oe,USER_GRANTABLE_SCOPES as Ce,GOVERNANCE_SCOPE_REQUIRED_CODE as ie}from"./infra/tokenScopes.js";import{SECRET_NAME_PATTERN as me,SECRET_NAME_ERROR as Pe,SSM_COMPONENT_PATTERN as Le,SSM_COMPONENT_ERROR as se,SSM_STANDARD_MAX_VALUE_BYTES as De,SecretNamespaceSchema as pe,buildNamespaceParts as Me,buildParameterPath as ce,parseParameterPath as fe,isManageablePath as Fe,parseDotEnv as Ue,escapeDotEnvValue as le}from"./secrets.js";import{ConnectionWireSchema as xe,ConnectionsListResponseSchema as Ge,CONNECTION_PHASES as de,CONNECTION_TERMINAL_FAILURE_PHASES as ge,CONNECTION_FAILURE_REASONS as he,EXTERNAL_ID_PATTERN as He}from"./infra/connectionsWire.js";import{COMPLIANCE_ISSUE_STATUSES as Ye,isComplianceIssueStatus as ye}from"./complianceIssue.js";import{PUBLIC_PACKAGE_NAME as ve,INSTALL_SOURCES as Xe,SETUP_COMMANDS as be,upgradeCommand as Be,SETUP_MODES as We,SETUP_STEP_IDS as Je,SETUP_STEPS as ke,AGENT_SETUP_PROMPTS as je,AGENT_INSTALL_COMMAND as we,SKILL_INSTALL_SEGMENTS as Ze,SKILL_INSTALL_FILENAME as qe,SKILL_INSTALL_PATH as ze}from"./onboarding/index.js";import{deriveRegionsFromOrgConfig as $e,deriveTargets as E_,deriveAllTargets as e_,environmentOrTier as __,findTarget as r_,generateTargetName as T_}from"./targets.js";import{buildAppConfigPath as S_}from"./repo/appPath.js";import{findInfrastructurePaths as o_,findBoundaryPath as a_,isInfrastructureFile as N_}from"./repo/findInfrastructurePaths.js";import{inferContainerFromCandidates as I_}from"./repo/inferContainerFromCandidates.js";import{RESERVED_APP_NAMES as C_,RESERVED_APP_NAME_MESSAGE as i_,isReservedAppName as n_,RESERVED_APP_NAME_SUFFIX as m_,RESERVED_APP_NAME_SUFFIX_MESSAGE as P_,hasReservedAppNameSuffix as L_}from"./naming/reservedAppNames.js";import{deriveContentHashTag as D_,CONTENT_HASH_TAG_PATTERN as p_}from"./infra/deriveContentHashTag.js";import{DEPLOY_MODES as c_,DeployModeSchema as f_,IMAGE_TAG_PATTERN as F_,ImageTagSchema as U_,ServiceArtefactSchema as l_,ServiceArtefactsSchema as u_,ARTEFACT_OUTPUT_FIELDS as x_,artefactOutputKey as G_}from"./infra/deployArtefacts.js";import{MIGRATION_SNAPSHOT_NAME_PREFIX as g_,MIGRATION_SNAPSHOT_RETENTION_DAYS_ENV as h_,MIGRATION_SNAPSHOT_KIND_TAG_KEY as H_,MIGRATION_SNAPSHOT_KIND_PREMIGRATE as V_,EXPECTED_SCHEMA_VERSION_ENV as Y_,EXPECTED_SCHEMA_VERSION_TOOL_ENV as y_,EXPECTED_CH_SCHEMA_VERSION_ENV as K_,SCHEMA_ADMIN_USER_ENV as v_,SCHEMA_ADMIN_PASSWORD_ENV as X_,PRISMA_MIGRATION_DIR_RE as b_,CLICKHOUSE_MIGRATION_SKIP_RE as B_}from"./migration/constants.js";import{SCHEMA_GATE_EXIT as J_,SCHEMA_GATE_EXIT_HINTS as k_,schemaGateExitKind as j_}from"./migration/schemaGateExit.js";import{FJALL_SCHEMA_GATE_USER as Z_,FJALL_MAINTENANCE_USER as q_,FJALL_CLICKHOUSE_USERS as z_}from"./migration/clickhouseFrameworkUsers.js";import{PHYSICAL_NAME_FALLBACK_PROPERTIES as $_}from"./cfn/physicalNameProperties.js";import{PATTERN_TYPE_VALUES as er,PATTERN_TYPES as _r,isPatternType as rr,PATTERN_REGISTRY as Tr,patternConstructId as Ar,DEPLOYABLE_PATTERN_TYPES as Sr,OPENNEXT_PATTERN_TYPES as tr,isOpenNextPatternType as or,CLOUDFRONT_PRICE_CLASS_VALUES as ar,STATIC_SITE_CONFIG_KEYS as Nr,STATIC_SITE_DEPLOY_INJECTED_KEYS as Rr,STATIC_SITE_CDN_CONFIG_KEYS as Ir,STATIC_SITE_ROUTING_VALUES as Or,STATIC_SITE_ROUTING_INFO as Cr,PATTERN_CREATE_INPUT_VALUES as ir,PATTERN_CREATE_INPUT_FLAGS as nr}from"./patterns/patternTypes.js";import{FRAMEWORK_VALUES as Pr,FRAMEWORKS as Lr,isFramework as sr,FRAMEWORK_PATTERN_RECOMMENDATIONS as Dr,recommendPatternForFramework as pr,CREATABLE_FRAMEWORKS as Mr,requiredInputsForFramework as cr}from"./patterns/frameworkPatterns.js";import{DEFAULT_FORMS_FROM_LOCAL_PART as Fr,defaultFormsFromAddress as Ur,defaultFormsCorsOrigin as lr,isAddressAtDomain as ur}from"./patterns/staticSiteForms.js";import{DEV_SUBSTRATE_PARAMS_SCHEMA_VERSION as Gr,DEV_SUBSTRATE_PARAMS_FILENAME as dr,DevSubstrateSynthPropsSchema as gr,DevSubstrateParamsSchema as hr}from"./devSubstrate/params.js";import{DEV_SUBSTRATE_ENTRYPOINT_SOURCE as Vr}from"./devSubstrate/entrypoint.js";import{BLESSED_CDK_TOOLCHAIN as yr}from"./cdkToolchain.js";import{DEPLOYMENT_FAILURE_PHASES as vr,DeploymentFailurePhaseSchema as Xr,DEPLOYMENT_FAULT_ATTRIBUTIONS as br,DeploymentFaultAttributionSchema as Br,DEPLOYMENT_FAILURE_PROVIDER_SOURCES as Wr,DeploymentFailureProviderSourceSchema as Jr,DEPLOYMENT_FAILURE_CODE_PATTERN as kr,DEPLOYMENT_FAILURE_SCHEMA_VERSION as jr,DEPLOYMENT_FAILURE_LIMITS as wr,DeploymentFailureAnalysisSchema as Zr,DeploymentFailureProviderSchema as qr,DeploymentFailureResourceSchema as zr,DeploymentFailureSchema as Qr,parseDeploymentFailure as $r,DEPLOYMENT_FAILURE_DOCS_BASE_URL as ET,deploymentFailureDocsUrl as eT,DEPLOYMENT_FAULT_COPY as _T,DEPLOYMENT_PROVIDER_LABELS as rT,deriveErrorMessageFromFailure as TT,toDeploymentFailureAnalysis as AT}from"./failure/deploymentFailure.js";import{extractErrorWindow as tT,ERROR_WINDOW_CONTEXT_LINES as oT}from"./failure/extractErrorWindow.js";import{FJALL_COMPONENT_GITIGNORE as NT,FJALL_PROJECT_GITIGNORE as RT,FJALL_STATE_GITIGNORE_ENTRIES as IT,FJALL_MANAGED_STATE_DIR_ENTRIES as OT,LOCAL_CONFIG_GITIGNORE_ENTRY as CT}from"./scaffold/gitignore.js";import{ensureGitignoreEntries as nT}from"./scaffold/ensureGitignore.js";export{jE as ACCOUNT_ROLES,GE as ACCOUNT_STAGES,uE as ACCOUNT_STAGES_WITH_ROOT,XE as ACCOUNT_STAGE_EFFECTS,dE as ACCOUNT_STAGE_LABELS,hE as ACCOUNT_TIERS,we as AGENT_INSTALL_COMMAND,je as AGENT_SETUP_PROMPTS,C as APPROVAL_TOKEN_OUTPUT_PREFIX,x_ as ARTEFACT_OUTPUT_FIELDS,re as AWS_REGIONS_METADATA,HE as AccountTierSchema,I as BACKUP_VAULT_NAME,yr as BLESSED_CDK_TOOLCHAIN,y as CAPACITY_ANCHOR_MAX_LENGTH,Y as CAPACITY_ANCHOR_PATTERN,K as CAPACITY_IDENTITY_CONTEXT_KEY,H as CAPACITY_SLOT_MAX_LENGTH,h as CAPACITY_SLOT_PATTERN,B_ as CLICKHOUSE_MIGRATION_SKIP_RE,ar as CLOUDFRONT_PRICE_CLASS_VALUES,Ye as COMPLIANCE_ISSUE_STATUSES,he as CONNECTION_FAILURE_REASONS,de as CONNECTION_PHASES,ge as CONNECTION_TERMINAL_FAILURE_PHASES,p_ as CONTENT_HASH_TAG_PATTERN,Mr as CREATABLE_FRAMEWORKS,b as CapacityIdentityConfigSchema,v as CapacityIdentityPinSchema,X as CapacityIdentityWireSchema,xe as ConnectionWireSchema,Ge as ConnectionsListResponseSchema,mE as DANGEROUS_ENV_VARS,V as DEFAULT_CAPACITY_SLOT,Fr as DEFAULT_FORMS_FROM_LOCAL_PART,Te as DEFAULT_REGION,Sr as DEPLOYABLE_PATTERN_TYPES,kr as DEPLOYMENT_FAILURE_CODE_PATTERN,ET as DEPLOYMENT_FAILURE_DOCS_BASE_URL,wr as DEPLOYMENT_FAILURE_LIMITS,vr as DEPLOYMENT_FAILURE_PHASES,Wr as DEPLOYMENT_FAILURE_PROVIDER_SOURCES,jr as DEPLOYMENT_FAILURE_SCHEMA_VERSION,br as DEPLOYMENT_FAULT_ATTRIBUTIONS,_T as DEPLOYMENT_FAULT_COPY,rT as DEPLOYMENT_PROVIDER_LABELS,c_ as DEPLOY_MODES,Vr as DEV_SUBSTRATE_ENTRYPOINT_SOURCE,dr as DEV_SUBSTRATE_PARAMS_FILENAME,Gr as DEV_SUBSTRATE_PARAMS_SCHEMA_VERSION,_ as DNS_APEX,N as DOMAIN_DEPLOY_DEFAULT_PHASE,f_ as DeployModeSchema,Zr as DeploymentFailureAnalysisSchema,Xr as DeploymentFailurePhaseSchema,qr as DeploymentFailureProviderSchema,Jr as DeploymentFailureProviderSourceSchema,zr as DeploymentFailureResourceSchema,Qr as DeploymentFailureSchema,Br as DeploymentFaultAttributionSchema,hr as DevSubstrateParamsSchema,gr as DevSubstrateSynthPropsSchema,oT as ERROR_WINDOW_CONTEXT_LINES,K_ as EXPECTED_CH_SCHEMA_VERSION_ENV,Y_ as EXPECTED_SCHEMA_VERSION_ENV,y_ as EXPECTED_SCHEMA_VERSION_TOOL_ENV,He as EXTERNAL_ID_PATTERN,z_ as FJALL_CLICKHOUSE_USERS,NT as FJALL_COMPONENT_GITIGNORE,SE as FJALL_CONFIG_DIR_ENV,tE as FJALL_CREDENTIALS_FILENAME,oE as FJALL_HOME_DIRNAME,aE as FJALL_LOG_DIR_ENV,q_ as FJALL_MAINTENANCE_USER,OT as FJALL_MANAGED_STATE_DIR_ENTRIES,RT as FJALL_PROJECT_GITIGNORE,Z_ as FJALL_SCHEMA_GATE_USER,IT as FJALL_STATE_GITIGNORE_ENTRIES,Lr as FRAMEWORKS,Dr as FRAMEWORK_PATTERN_RECOMMENDATIONS,Pr as FRAMEWORK_VALUES,YE as GOVERNANCE_ACCOUNT_TIERS,ie as GOVERNANCE_SCOPE_REQUIRED_CODE,o as HOSTS_OUTPUT_MAX_BYTES,F_ as IMAGE_TAG_PATTERN,Xe as INSTALL_SOURCES,U_ as ImageTagSchema,CT as LOCAL_CONFIG_GITIGNORE_ENTRY,Oe as MACHINE_ONLY_SCOPES,LE as MASKED_VALUE_MARKER,Se as MAX_SECONDARY_REGIONS,V_ as MIGRATION_SNAPSHOT_KIND_PREMIGRATE,H_ as MIGRATION_SNAPSHOT_KIND_TAG_KEY,g_ as MIGRATION_SNAPSHOT_NAME_PREFIX,h_ as MIGRATION_SNAPSHOT_RETENTION_DAYS_ENV,tr as OPENNEXT_PATTERN_TYPES,te as OPT_IN_REGION_CODES,nr as PATTERN_CREATE_INPUT_FLAGS,ir as PATTERN_CREATE_INPUT_VALUES,Tr as PATTERN_REGISTRY,_r as PATTERN_TYPES,er as PATTERN_TYPE_VALUES,$_ as PHYSICAL_NAME_FALLBACK_PROPERTIES,b_ as PRISMA_MIGRATION_DIR_RE,ve as PUBLIC_PACKAGE_NAME,pE as REDACTED_KEY_SENTINEL,Z as REGION_SHORT_CODES,C_ as RESERVED_APP_NAMES,i_ as RESERVED_APP_NAME_MESSAGE,m_ as RESERVED_APP_NAME_SUFFIX,P_ as RESERVED_APP_NAME_SUFFIX_MESSAGE,ZE as RESOURCE_CATEGORIES,X_ as SCHEMA_ADMIN_PASSWORD_ENV,v_ as SCHEMA_ADMIN_USER_ENV,J_ as SCHEMA_GATE_EXIT,k_ as SCHEMA_GATE_EXIT_HINTS,ME as SCOPED_TOKEN_REGEX,Ie as SCOPE_VALUES,Pe as SECRET_NAME_ERROR,me as SECRET_NAME_PATTERN,be as SETUP_COMMANDS,We as SETUP_MODES,ke as SETUP_STEPS,Je as SETUP_STEP_IDS,qe as SKILL_INSTALL_FILENAME,ze as SKILL_INSTALL_PATH,Ze as SKILL_INSTALL_SEGMENTS,se as SSM_COMPONENT_ERROR,Le as SSM_COMPONENT_PATTERN,De as SSM_STANDARD_MAX_VALUE_BYTES,Ir as STATIC_SITE_CDN_CONFIG_KEYS,Nr as STATIC_SITE_CONFIG_KEYS,Rr as STATIC_SITE_DEPLOY_INJECTED_KEYS,Cr as STATIC_SITE_ROUTING_INFO,Or as STATIC_SITE_ROUTING_VALUES,xE as STRUCTURAL_ENVIRONMENTS,pe as SecretNamespaceSchema,l_ as ServiceArtefactSchema,u_ as ServiceArtefactsSchema,i as TOKEN_STDERR_PREFIX,Ce as USER_GRANTABLE_SCOPES,_e as abbreviateRegion,f as accountConstructKey,vE as accountStageEffect,WE as accountTier,l as albDnsExportName,u as albHostedZoneIdExportName,G_ as artefactOutputKey,G as bucketWebsiteEndpointExportName,d as bucketWebsiteHostedZoneIdExportName,S_ as buildAppConfigPath,Me as buildNamespaceParts,ce as buildParameterPath,M as capitalise,qE as categoriseResource,x as cdnDomainExportName,j as defaultConnectedAccountName,lr as defaultFormsCorsOrigin,Ur as defaultFormsFromAddress,eT as deploymentFailureDocsUrl,e_ as deriveAllTargets,D_ as deriveContentHashTag,TT as deriveErrorMessageFromFailure,$e as deriveRegionsFromOrgConfig,E_ as deriveTargets,nT as ensureGitignoreEntries,__ as environmentOrTier,KE as environmentToTier,le as escapeDotEnvValue,tT as extractErrorWindow,PE as filterDangerousEnvVars,J as findAccountNameCollision,a_ as findBoundaryPath,o_ as findInfrastructurePaths,r_ as findTarget,q as findTrailingRegionShortCode,NE as fjallCredentialsPath,RE as fjallHomeDir,IE as fjallLogDir,OE as fjallStatePath,bE as formatAccountStageList,TE as formatErrorString,T_ as generateTargetName,r as getDomainExportNames,T as getDomainStackName,A as getDomainUsEast1CertificatesStackName,kE as getEnvironmentLabel,_E as getErrorCode,EE as getErrorMessage,rE as getErrorStack,zE as getExpectedDuration,QE as getFriendlyResourceType,Ae as getRegionInfo,c as getSafeZoneName,F as hasAsciiStableConstructKey,eE as hasErrorCode,L_ as hasReservedAppNameSuffix,S as hostsExportPartName,m as imageTagParameterName,I_ as inferContainerFromCandidates,gE as isAccountStage,VE as isAccountTier,ur as isAddressAtDomain,ye as isComplianceIssueStatus,sr as isFramework,yE as isGovernanceTier,N_ as isInfrastructureFile,Fe as isManageablePath,a as isManagedDomainBinding,or as isOpenNextPatternType,rr as isPatternType,n_ as isReservedAppName,UE as mapSettledWithConcurrency,sE as maskSensitiveOutput,$ as normaliseError,oe as optInRegionWarning,$r as parseDeploymentFailure,Ue as parseDotEnv,Ee as parseGitRemoteUrl,fe as parseParameterPath,DE as parseShellArgs,Ar as patternConstructId,B as projectCapacityIdentityToTarget,pr as recommendPatternForFramework,z as regionSuffixRejectionMessage,ae as regions,cr as requiredInputsForFramework,JE as resolveSynthEnvironment,j_ as schemaGateExitKind,t as serialiseHostsChunks,iE as singleton,fE as sleep,BE as stageFromWireEnvironment,w as suffixedAccountName,Ne as suggestRegionForTimezone,AT as toDeploymentFailureAnalysis,s as toKebab,L as toPascalCase,p as toScreamingSnake,D as toValidDatabaseName,Be as upgradeCommand};
+import{DNS_APEX as _,getDomainExportNames as r,getDomainStackName as T,getDomainUsEast1CertificatesStackName as A,hostsExportPartName as S,serialiseHostsChunks as t,HOSTS_OUTPUT_MAX_BYTES as o,isManagedDomainBinding as a,DOMAIN_DEPLOY_DEFAULT_PHASE as N}from"./infra/domainExports.js";import{BACKUP_VAULT_NAME as I}from"./infra/backupVault.js";import{APPROVAL_TOKEN_OUTPUT_PREFIX as i,TOKEN_STDERR_PREFIX as C}from"./deploy/approvalTokenOutput.js";import{imageTagParameterName as m}from"./infra/imageTags.js";import{toPascalCase as L,toKebab as s,toValidDatabaseName as D,toScreamingSnake as p,capitalise as M,getSafeZoneName as c,accountConstructKey as f,hasAsciiStableConstructKey as F}from"./naming/caseConversion.js";import{albDnsExportName as l,albHostedZoneIdExportName as u,cdnDomainExportName as x,bucketWebsiteEndpointExportName as G,bucketWebsiteHostedZoneIdExportName as d}from"./naming/targetExportNames.js";import{CAPACITY_SLOT_PATTERN as h,CAPACITY_SLOT_MAX_LENGTH as H,DEFAULT_CAPACITY_SLOT as V,CAPACITY_ANCHOR_PATTERN as Y,CAPACITY_ANCHOR_MAX_LENGTH as K,CAPACITY_IDENTITY_CONTEXT_KEY as y,CapacityIdentityPinSchema as v,CapacityIdentityWireSchema as B,CapacityIdentityConfigSchema as X,projectCapacityIdentityToTarget as b}from"./capacityIdentity.js";import{findAccountNameCollision as k}from"./naming/accountNameCollision.js";import{defaultConnectedAccountName as j,suffixedAccountName as w,REGION_SHORT_CODES as Z,findTrailingRegionShortCode as q,regionSuffixRejectionMessage as z}from"./naming/connectedAccountName.js";import{normaliseError as $,getErrorMessage as ee,hasErrorCode as Ee,getErrorCode as _e,getErrorStack as re,formatErrorString as Te}from"./errorUtils.js";import{FJALL_CONFIG_DIR_ENV as Se,FJALL_CREDENTIALS_FILENAME as te,FJALL_HOME_DIRNAME as oe,FJALL_LOG_DIR_ENV as ae,fjallCredentialsPath as Ne,fjallHomeDir as Re,fjallLogDir as Ie,fjallStatePath as Oe}from"./fjallHome.js";import{singleton as Ce}from"./async/singleton.js";import{DANGEROUS_ENV_VARS as me,filterDangerousEnvVars as Pe,MASKED_VALUE_MARKER as Le,maskSensitiveOutput as se,parseShellArgs as De,REDACTED_KEY_SENTINEL as pe,SCOPED_TOKEN_REGEX as Me}from"./securityHelpers.js";import{sleep as fe}from"./async/sleep.js";import{mapSettledWithConcurrency as Ue}from"./async/concurrency.js";import{ACCOUNT_STAGES_WITH_ROOT as ue,STRUCTURAL_ENVIRONMENTS as xe,ACCOUNT_STAGES as Ge,ACCOUNT_STAGE_LABELS as de,isAccountStage as ge,ACCOUNT_TIERS as he,AccountTierSchema as He,isAccountTier as Ve,GOVERNANCE_ACCOUNT_TIERS as Ye,isGovernanceTier as Ke,environmentToTier as ye,accountStageEffect as ve,ACCOUNT_STAGE_EFFECTS as Be,formatAccountStageList as Xe,stageFromWireEnvironment as be,accountTier as We,resolveSynthEnvironment as ke,getEnvironmentLabel as Je,ACCOUNT_ROLES as je}from"./environments.js";import{BACKUP_TIERS as Ze,BACKUP_TIER_DEFAULTS as qe,BackupTierSchema as ze,isBackupTier as Qe,tierDefault as $e}from"./backupTiers.js";import{RESOURCE_CATEGORIES as EE,categoriseResource as _E,getExpectedDuration as rE,getFriendlyResourceType as TE}from"./resourceCategorisation.js";import{parseGitRemoteUrl as SE}from"./repo/gitRemoteParser.js";import{abbreviateRegion as oE,AWS_REGIONS_METADATA as aE,DEFAULT_REGION as NE,getRegionInfo as RE,MAX_SECONDARY_REGIONS as IE,OPT_IN_REGION_CODES as OE,optInRegionWarning as iE,regions as CE,RETIRED_REGION_ABBREVIATIONS as nE,suggestRegionForTimezone as mE}from"./infra/regions.js";import{SCOPE_VALUES as LE,MACHINE_ONLY_SCOPES as sE,USER_GRANTABLE_SCOPES as DE,GOVERNANCE_SCOPE_REQUIRED_CODE as pE}from"./infra/tokenScopes.js";import{SECRET_NAME_PATTERN as cE,SECRET_NAME_ERROR as fE,SSM_COMPONENT_PATTERN as FE,SSM_COMPONENT_ERROR as UE,SSM_STANDARD_MAX_VALUE_BYTES as lE,SecretNamespaceSchema as uE,buildNamespaceParts as xE,buildParameterPath as GE,parseParameterPath as dE,isManageablePath as gE,parseDotEnv as hE,escapeDotEnvValue as HE}from"./secrets.js";import{ConnectionWireSchema as YE,ConnectionsListResponseSchema as KE,CONNECTION_PHASES as yE,CONNECTION_TERMINAL_FAILURE_PHASES as vE,CONNECTION_FAILURE_REASONS as BE,EXTERNAL_ID_PATTERN as XE}from"./infra/connectionsWire.js";import{COMPLIANCE_ISSUE_STATUSES as WE,isComplianceIssueStatus as kE}from"./complianceIssue.js";import{PUBLIC_PACKAGE_NAME as jE,INSTALL_SOURCES as wE,SETUP_COMMANDS as ZE,upgradeCommand as qE,SETUP_MODES as zE,SETUP_STEP_IDS as QE,SETUP_STEPS as $E,AGENT_SETUP_PROMPTS as e_,AGENT_INSTALL_COMMAND as E_,SKILL_INSTALL_SEGMENTS as __,SKILL_INSTALL_FILENAME as r_,SKILL_INSTALL_PATH as T_}from"./onboarding/index.js";import{deriveRegionsFromOrgConfig as S_,deriveTargets as t_,deriveAllTargets as o_,environmentOrTier as a_,explainRetiredTargetName as N_,findTarget as R_,generateTargetName as I_}from"./targets.js";import{buildAppConfigPath as i_}from"./repo/appPath.js";import{findInfrastructurePaths as n_,findBoundaryPath as m_,isInfrastructureFile as P_}from"./repo/findInfrastructurePaths.js";import{inferContainerFromCandidates as s_}from"./repo/inferContainerFromCandidates.js";import{RESERVED_APP_NAMES as p_,RESERVED_APP_NAME_MESSAGE as M_,isReservedAppName as c_,RESERVED_APP_NAME_SUFFIX as f_,RESERVED_APP_NAME_SUFFIX_MESSAGE as F_,hasReservedAppNameSuffix as U_}from"./naming/reservedAppNames.js";import{deriveContentHashTag as u_,CONTENT_HASH_TAG_PATTERN as x_}from"./infra/deriveContentHashTag.js";import{DEPLOY_MODES as d_,DeployModeSchema as g_,IMAGE_TAG_PATTERN as h_,ImageTagSchema as H_,ServiceArtefactSchema as V_,ServiceArtefactsSchema as Y_,ARTEFACT_OUTPUT_FIELDS as K_,artefactOutputKey as y_}from"./infra/deployArtefacts.js";import{MIGRATION_SNAPSHOT_NAME_PREFIX as B_,MIGRATION_SNAPSHOT_RETENTION_DAYS_ENV as X_,MIGRATION_SNAPSHOT_KIND_TAG_KEY as b_,MIGRATION_SNAPSHOT_KIND_PREMIGRATE as W_,EXPECTED_SCHEMA_VERSION_ENV as k_,EXPECTED_SCHEMA_VERSION_TOOL_ENV as J_,EXPECTED_CH_SCHEMA_VERSION_ENV as j_,SCHEMA_ADMIN_USER_ENV as w_,SCHEMA_ADMIN_PASSWORD_ENV as Z_,PRISMA_MIGRATION_DIR_RE as q_,CLICKHOUSE_MIGRATION_SKIP_RE as z_}from"./migration/constants.js";import{SCHEMA_GATE_EXIT as $_,SCHEMA_GATE_EXIT_HINTS as er,schemaGateExitKind as Er}from"./migration/schemaGateExit.js";import{FJALL_SCHEMA_GATE_USER as rr,FJALL_MAINTENANCE_USER as Tr,FJALL_CLICKHOUSE_USERS as Ar}from"./migration/clickhouseFrameworkUsers.js";import{PHYSICAL_NAME_FALLBACK_PROPERTIES as tr}from"./cfn/physicalNameProperties.js";import{PATTERN_TYPE_VALUES as ar,PATTERN_TYPES as Nr,isPatternType as Rr,PATTERN_REGISTRY as Ir,patternConstructId as Or,DEPLOYABLE_PATTERN_TYPES as ir,OPENNEXT_PATTERN_TYPES as Cr,isOpenNextPatternType as nr,CLOUDFRONT_PRICE_CLASS_VALUES as mr,STATIC_SITE_CONFIG_KEYS as Pr,STATIC_SITE_DEPLOY_INJECTED_KEYS as Lr,STATIC_SITE_CDN_CONFIG_KEYS as sr,STATIC_SITE_ROUTING_VALUES as Dr,STATIC_SITE_ROUTING_INFO as pr,PATTERN_CREATE_INPUT_VALUES as Mr,PATTERN_CREATE_INPUT_FLAGS as cr}from"./patterns/patternTypes.js";import{FRAMEWORK_VALUES as Fr,FRAMEWORKS as Ur,isFramework as lr,FRAMEWORK_PATTERN_RECOMMENDATIONS as ur,recommendPatternForFramework as xr,CREATABLE_FRAMEWORKS as Gr,requiredInputsForFramework as dr}from"./patterns/frameworkPatterns.js";import{DEFAULT_FORMS_FROM_LOCAL_PART as hr,defaultFormsFromAddress as Hr,defaultFormsCorsOrigin as Vr,isAddressAtDomain as Yr}from"./patterns/staticSiteForms.js";import{DEV_SUBSTRATE_PARAMS_SCHEMA_VERSION as yr,DEV_SUBSTRATE_PARAMS_FILENAME as vr,DevSubstrateSynthPropsSchema as Br,DevSubstrateParamsSchema as Xr}from"./devSubstrate/params.js";import{DEV_SUBSTRATE_ENTRYPOINT_SOURCE as Wr}from"./devSubstrate/entrypoint.js";import{BLESSED_CDK_TOOLCHAIN as Jr}from"./cdkToolchain.js";import{DEPLOYMENT_FAILURE_PHASES as wr,DeploymentFailurePhaseSchema as Zr,DEPLOYMENT_FAULT_ATTRIBUTIONS as qr,DeploymentFaultAttributionSchema as zr,DEPLOYMENT_FAILURE_PROVIDER_SOURCES as Qr,DeploymentFailureProviderSourceSchema as $r,DEPLOYMENT_FAILURE_CODE_PATTERN as eT,DEPLOYMENT_FAILURE_SCHEMA_VERSION as ET,DEPLOYMENT_FAILURE_LIMITS as _T,DeploymentFailureAnalysisSchema as rT,DeploymentFailureProviderSchema as TT,DeploymentFailureResourceSchema as AT,DeploymentFailureSchema as ST,parseDeploymentFailure as tT,DEPLOYMENT_FAILURE_DOCS_BASE_URL as oT,deploymentFailureDocsUrl as aT,DEPLOYMENT_FAULT_COPY as NT,DEPLOYMENT_PROVIDER_LABELS as RT,deriveErrorMessageFromFailure as IT,toDeploymentFailureAnalysis as OT}from"./failure/deploymentFailure.js";import{extractErrorWindow as CT,ERROR_WINDOW_CONTEXT_LINES as nT}from"./failure/extractErrorWindow.js";import{FJALL_COMPONENT_GITIGNORE as PT,FJALL_PROJECT_GITIGNORE as LT,FJALL_STATE_GITIGNORE_ENTRIES as sT,FJALL_MANAGED_STATE_DIR_ENTRIES as DT,LOCAL_CONFIG_GITIGNORE_ENTRY as pT}from"./scaffold/gitignore.js";import{ensureGitignoreEntries as cT}from"./scaffold/ensureGitignore.js";export{je as ACCOUNT_ROLES,Ge as ACCOUNT_STAGES,ue as ACCOUNT_STAGES_WITH_ROOT,Be as ACCOUNT_STAGE_EFFECTS,de as ACCOUNT_STAGE_LABELS,he as ACCOUNT_TIERS,E_ as AGENT_INSTALL_COMMAND,e_ as AGENT_SETUP_PROMPTS,i as APPROVAL_TOKEN_OUTPUT_PREFIX,K_ as ARTEFACT_OUTPUT_FIELDS,aE as AWS_REGIONS_METADATA,He as AccountTierSchema,Ze as BACKUP_TIERS,qe as BACKUP_TIER_DEFAULTS,I as BACKUP_VAULT_NAME,Jr as BLESSED_CDK_TOOLCHAIN,ze as BackupTierSchema,K as CAPACITY_ANCHOR_MAX_LENGTH,Y as CAPACITY_ANCHOR_PATTERN,y as CAPACITY_IDENTITY_CONTEXT_KEY,H as CAPACITY_SLOT_MAX_LENGTH,h as CAPACITY_SLOT_PATTERN,z_ as CLICKHOUSE_MIGRATION_SKIP_RE,mr as CLOUDFRONT_PRICE_CLASS_VALUES,WE as COMPLIANCE_ISSUE_STATUSES,BE as CONNECTION_FAILURE_REASONS,yE as CONNECTION_PHASES,vE as CONNECTION_TERMINAL_FAILURE_PHASES,x_ as CONTENT_HASH_TAG_PATTERN,Gr as CREATABLE_FRAMEWORKS,X as CapacityIdentityConfigSchema,v as CapacityIdentityPinSchema,B as CapacityIdentityWireSchema,YE as ConnectionWireSchema,KE as ConnectionsListResponseSchema,me as DANGEROUS_ENV_VARS,V as DEFAULT_CAPACITY_SLOT,hr as DEFAULT_FORMS_FROM_LOCAL_PART,NE as DEFAULT_REGION,ir as DEPLOYABLE_PATTERN_TYPES,eT as DEPLOYMENT_FAILURE_CODE_PATTERN,oT as DEPLOYMENT_FAILURE_DOCS_BASE_URL,_T as DEPLOYMENT_FAILURE_LIMITS,wr as DEPLOYMENT_FAILURE_PHASES,Qr as DEPLOYMENT_FAILURE_PROVIDER_SOURCES,ET as DEPLOYMENT_FAILURE_SCHEMA_VERSION,qr as DEPLOYMENT_FAULT_ATTRIBUTIONS,NT as DEPLOYMENT_FAULT_COPY,RT as DEPLOYMENT_PROVIDER_LABELS,d_ as DEPLOY_MODES,Wr as DEV_SUBSTRATE_ENTRYPOINT_SOURCE,vr as DEV_SUBSTRATE_PARAMS_FILENAME,yr as DEV_SUBSTRATE_PARAMS_SCHEMA_VERSION,_ as DNS_APEX,N as DOMAIN_DEPLOY_DEFAULT_PHASE,g_ as DeployModeSchema,rT as DeploymentFailureAnalysisSchema,Zr as DeploymentFailurePhaseSchema,TT as DeploymentFailureProviderSchema,$r as DeploymentFailureProviderSourceSchema,AT as DeploymentFailureResourceSchema,ST as DeploymentFailureSchema,zr as DeploymentFaultAttributionSchema,Xr as DevSubstrateParamsSchema,Br as DevSubstrateSynthPropsSchema,nT as ERROR_WINDOW_CONTEXT_LINES,j_ as EXPECTED_CH_SCHEMA_VERSION_ENV,k_ as EXPECTED_SCHEMA_VERSION_ENV,J_ as EXPECTED_SCHEMA_VERSION_TOOL_ENV,XE as EXTERNAL_ID_PATTERN,Ar as FJALL_CLICKHOUSE_USERS,PT as FJALL_COMPONENT_GITIGNORE,Se as FJALL_CONFIG_DIR_ENV,te as FJALL_CREDENTIALS_FILENAME,oe as FJALL_HOME_DIRNAME,ae as FJALL_LOG_DIR_ENV,Tr as FJALL_MAINTENANCE_USER,DT as FJALL_MANAGED_STATE_DIR_ENTRIES,LT as FJALL_PROJECT_GITIGNORE,rr as FJALL_SCHEMA_GATE_USER,sT as FJALL_STATE_GITIGNORE_ENTRIES,Ur as FRAMEWORKS,ur as FRAMEWORK_PATTERN_RECOMMENDATIONS,Fr as FRAMEWORK_VALUES,Ye as GOVERNANCE_ACCOUNT_TIERS,pE as GOVERNANCE_SCOPE_REQUIRED_CODE,o as HOSTS_OUTPUT_MAX_BYTES,h_ as IMAGE_TAG_PATTERN,wE as INSTALL_SOURCES,H_ as ImageTagSchema,pT as LOCAL_CONFIG_GITIGNORE_ENTRY,sE as MACHINE_ONLY_SCOPES,Le as MASKED_VALUE_MARKER,IE as MAX_SECONDARY_REGIONS,W_ as MIGRATION_SNAPSHOT_KIND_PREMIGRATE,b_ as MIGRATION_SNAPSHOT_KIND_TAG_KEY,B_ as MIGRATION_SNAPSHOT_NAME_PREFIX,X_ as MIGRATION_SNAPSHOT_RETENTION_DAYS_ENV,Cr as OPENNEXT_PATTERN_TYPES,OE as OPT_IN_REGION_CODES,cr as PATTERN_CREATE_INPUT_FLAGS,Mr as PATTERN_CREATE_INPUT_VALUES,Ir as PATTERN_REGISTRY,Nr as PATTERN_TYPES,ar as PATTERN_TYPE_VALUES,tr as PHYSICAL_NAME_FALLBACK_PROPERTIES,q_ as PRISMA_MIGRATION_DIR_RE,jE as PUBLIC_PACKAGE_NAME,pe as REDACTED_KEY_SENTINEL,Z as REGION_SHORT_CODES,p_ as RESERVED_APP_NAMES,M_ as RESERVED_APP_NAME_MESSAGE,f_ as RESERVED_APP_NAME_SUFFIX,F_ as RESERVED_APP_NAME_SUFFIX_MESSAGE,EE as RESOURCE_CATEGORIES,nE as RETIRED_REGION_ABBREVIATIONS,Z_ as SCHEMA_ADMIN_PASSWORD_ENV,w_ as SCHEMA_ADMIN_USER_ENV,$_ as SCHEMA_GATE_EXIT,er as SCHEMA_GATE_EXIT_HINTS,Me as SCOPED_TOKEN_REGEX,LE as SCOPE_VALUES,fE as SECRET_NAME_ERROR,cE as SECRET_NAME_PATTERN,ZE as SETUP_COMMANDS,zE as SETUP_MODES,$E as SETUP_STEPS,QE as SETUP_STEP_IDS,r_ as SKILL_INSTALL_FILENAME,T_ as SKILL_INSTALL_PATH,__ as SKILL_INSTALL_SEGMENTS,UE as SSM_COMPONENT_ERROR,FE as SSM_COMPONENT_PATTERN,lE as SSM_STANDARD_MAX_VALUE_BYTES,sr as STATIC_SITE_CDN_CONFIG_KEYS,Pr as STATIC_SITE_CONFIG_KEYS,Lr as STATIC_SITE_DEPLOY_INJECTED_KEYS,pr as STATIC_SITE_ROUTING_INFO,Dr as STATIC_SITE_ROUTING_VALUES,xe as STRUCTURAL_ENVIRONMENTS,uE as SecretNamespaceSchema,V_ as ServiceArtefactSchema,Y_ as ServiceArtefactsSchema,C as TOKEN_STDERR_PREFIX,DE as USER_GRANTABLE_SCOPES,oE as abbreviateRegion,f as accountConstructKey,ve as accountStageEffect,We as accountTier,l as albDnsExportName,u as albHostedZoneIdExportName,y_ as artefactOutputKey,G as bucketWebsiteEndpointExportName,d as bucketWebsiteHostedZoneIdExportName,i_ as buildAppConfigPath,xE as buildNamespaceParts,GE as buildParameterPath,M as capitalise,_E as categoriseResource,x as cdnDomainExportName,j as defaultConnectedAccountName,Vr as defaultFormsCorsOrigin,Hr as defaultFormsFromAddress,aT as deploymentFailureDocsUrl,o_ as deriveAllTargets,u_ as deriveContentHashTag,IT as deriveErrorMessageFromFailure,S_ as deriveRegionsFromOrgConfig,t_ as deriveTargets,cT as ensureGitignoreEntries,a_ as environmentOrTier,ye as environmentToTier,HE as escapeDotEnvValue,N_ as explainRetiredTargetName,CT as extractErrorWindow,Pe as filterDangerousEnvVars,k as findAccountNameCollision,m_ as findBoundaryPath,n_ as findInfrastructurePaths,R_ as findTarget,q as findTrailingRegionShortCode,Ne as fjallCredentialsPath,Re as fjallHomeDir,Ie as fjallLogDir,Oe as fjallStatePath,Xe as formatAccountStageList,Te as formatErrorString,I_ as generateTargetName,r as getDomainExportNames,T as getDomainStackName,A as getDomainUsEast1CertificatesStackName,Je as getEnvironmentLabel,_e as getErrorCode,ee as getErrorMessage,re as getErrorStack,rE as getExpectedDuration,TE as getFriendlyResourceType,RE as getRegionInfo,c as getSafeZoneName,F as hasAsciiStableConstructKey,Ee as hasErrorCode,U_ as hasReservedAppNameSuffix,S as hostsExportPartName,m as imageTagParameterName,s_ as inferContainerFromCandidates,ge as isAccountStage,Ve as isAccountTier,Yr as isAddressAtDomain,Qe as isBackupTier,kE as isComplianceIssueStatus,lr as isFramework,Ke as isGovernanceTier,P_ as isInfrastructureFile,gE as isManageablePath,a as isManagedDomainBinding,nr as isOpenNextPatternType,Rr as isPatternType,c_ as isReservedAppName,Ue as mapSettledWithConcurrency,se as maskSensitiveOutput,$ as normaliseError,iE as optInRegionWarning,tT as parseDeploymentFailure,hE as parseDotEnv,SE as parseGitRemoteUrl,dE as parseParameterPath,De as parseShellArgs,Or as patternConstructId,b as projectCapacityIdentityToTarget,xr as recommendPatternForFramework,z as regionSuffixRejectionMessage,CE as regions,dr as requiredInputsForFramework,ke as resolveSynthEnvironment,Er as schemaGateExitKind,t as serialiseHostsChunks,Ce as singleton,fe as sleep,be as stageFromWireEnvironment,w as suffixedAccountName,mE as suggestRegionForTimezone,$e as tierDefault,OT as toDeploymentFailureAnalysis,s as toKebab,L as toPascalCase,p as toScreamingSnake,D as toValidDatabaseName,qE as upgradeCommand};

package/dist/infra/regions.d.ts

@@ -239,9 +239,22 @@ export declare function optInRegionWarning(regionCode: string): string;
 export declare function getRegionInfo(code: string): RegionInfo | undefined;
 /**
  * Abbreviate an AWS region name to a compact form.
- * e.g. "us-east-1" → "use1", "eu-west-1" → "euw1"
+ * e.g. "us-east-1" → "use1", "eu-west-1" → "euw1", "ap-south-1" → "apso1"
  */
 export declare function abbreviateRegion(region: string): string;
+/**
+ * Region short codes Fjall used to emit and no longer does, mapped to the
+ * region(s) each one named. Derived by diffing the legacy derivation against
+ * the current one over the live metadata, so it extends itself.
+ *
+ * A code lands here for one of two reasons, and the guards treat them the same:
+ * it was ambiguous (`aps1` named both ap-southeast-1 and ap-south-1), or it was
+ * unambiguous but has moved (`apn1` named ap-northeast-1, now `apne1`). Either
+ * way a name carrying it is refused rather than resolved — an operator who
+ * typed it meant the region it used to mean, and quietly delivering a different
+ * one is precisely the failure the rename exists to end.
+ */
+export declare const RETIRED_REGION_ABBREVIATIONS: ReadonlyMap<string, readonly string[]>;
 /**
  * Suggest the geographically nearest *deployable* AWS region for an IANA
  * timezone (e.g. from Intl.DateTimeFormat().resolvedOptions().timeZone). Never

package/dist/infra/regions.js

@@ -1 +1 @@
-var i=Object.defineProperty;var t=(e,a)=>i(e,"name",{value:a,configurable:!0});const r="us-east-2",d=10,o=Object.freeze([{code:"us-east-2",name:"US East",city:"Ohio",country:"USA",optIn:!1},{code:"us-west-2",name:"US West",city:"Oregon",country:"USA",optIn:!1},{code:"us-east-1",name:"US East",city:"N. Virginia",country:"USA",optIn:!1},{code:"eu-west-1",name:"EU West",city:"Ireland",country:"Ireland",optIn:!1},{code:"eu-central-1",name:"EU Central",city:"Frankfurt",country:"Germany",optIn:!1},{code:"ap-southeast-1",name:"Asia Pacific",city:"Singapore",country:"Singapore",optIn:!1},{code:"ap-northeast-1",name:"Asia Pacific",city:"Tokyo",country:"Japan",optIn:!1},{code:"ap-southeast-2",name:"Asia Pacific",city:"Sydney",country:"Australia",optIn:!1},{code:"us-west-1",name:"US West",city:"N. California",country:"USA",optIn:!1},{code:"ca-central-1",name:"Canada",city:"Central",country:"Canada",optIn:!1},{code:"af-south-1",name:"Africa",city:"Cape Town",country:"South Africa",optIn:!0},{code:"ap-east-1",name:"Asia Pacific",city:"Hong Kong",country:"Hong Kong",optIn:!0},{code:"ap-northeast-2",name:"Asia Pacific",city:"Seoul",country:"South Korea",optIn:!1},{code:"ap-northeast-3",name:"Asia Pacific",city:"Osaka",country:"Japan",optIn:!1},{code:"ap-south-1",name:"Asia Pacific",city:"Mumbai",country:"India",optIn:!1},{code:"ap-south-2",name:"Asia Pacific",city:"Hyderabad",country:"India",optIn:!0},{code:"ap-southeast-3",name:"Asia Pacific",city:"Jakarta",country:"Indonesia",optIn:!0},{code:"ap-southeast-4",name:"Asia Pacific",city:"Melbourne",country:"Australia",optIn:!0},{code:"eu-central-2",name:"EU Central",city:"Zurich",country:"Switzerland",optIn:!0},{code:"eu-north-1",name:"EU North",city:"Stockholm",country:"Sweden",optIn:!1},{code:"eu-south-1",name:"EU South",city:"Milan",country:"Italy",optIn:!0},{code:"eu-south-2",name:"EU South",city:"Spain",country:"Spain",optIn:!0},{code:"eu-west-2",name:"EU West",city:"London",country:"UK",optIn:!1},{code:"eu-west-3",name:"EU West",city:"Paris",country:"France",optIn:!1},{code:"me-central-1",name:"Middle East",city:"UAE",country:"UAE",optIn:!0},{code:"me-south-1",name:"Middle East",city:"Bahrain",country:"Bahrain",optIn:!0},{code:"sa-east-1",name:"South America",city:"S\xE3o Paulo",country:"Brazil",optIn:!1},{code:"ap-southeast-5",name:"Asia Pacific",city:"Kuala Lumpur",country:"Malaysia",optIn:!0},{code:"ap-southeast-6",name:"Asia Pacific",city:"Auckland",country:"New Zealand",optIn:!0},{code:"ap-southeast-7",name:"Asia Pacific",city:"Bangkok",country:"Thailand",optIn:!0},{code:"ap-east-2",name:"Asia Pacific",city:"Taipei",country:"Taiwan",optIn:!0},{code:"ca-west-1",name:"Canada West",city:"Calgary",country:"Canada",optIn:!0},{code:"il-central-1",name:"Israel",city:"Tel Aviv",country:"Israel",optIn:!0},{code:"mx-central-1",name:"Mexico",city:"Central",country:"Mexico",optIn:!0}]),m=Object.freeze(o.map(e=>e.code)),c=new Set(o.filter(e=>e.optIn).map(e=>e.code));function y(e){return`${e} is an opt-in region: it must be enabled in the AWS account (Account settings \u2192 Regions) before deployment will succeed.`}t(y,"optInRegionWarning");function f(e){return o.find(a=>a.code===e)}t(f,"getRegionInfo");function I(e){const a=e.split("-");return a.length===3&&a[0]&&a[1]&&a[2]?`${a[0]}${a[1][0]}${a[2]}`:e}t(I,"abbreviateRegion");const p=Object.freeze({"Europe/London":"eu-west-2","Europe/Jersey":"eu-west-2","Europe/Guernsey":"eu-west-2","Europe/Isle_of_Man":"eu-west-2","Europe/Dublin":"eu-west-1","Europe/Paris":"eu-west-3","Europe/Berlin":"eu-central-1","Europe/Amsterdam":"eu-central-1","Europe/Brussels":"eu-central-1","Europe/Luxembourg":"eu-central-1","Europe/Vienna":"eu-central-1","Europe/Prague":"eu-central-1","Europe/Warsaw":"eu-central-1","Europe/Budapest":"eu-central-1","Europe/Zurich":"eu-central-2","Europe/Stockholm":"eu-north-1","Europe/Oslo":"eu-north-1","Europe/Copenhagen":"eu-north-1","Europe/Helsinki":"eu-north-1","Europe/Tallinn":"eu-north-1","Europe/Riga":"eu-north-1","Europe/Vilnius":"eu-north-1","Europe/Rome":"eu-south-1","Europe/Malta":"eu-south-1","Europe/Athens":"eu-south-1","Europe/Madrid":"eu-south-2","Europe/Lisbon":"eu-south-2","America/New_York":"us-east-1","America/Detroit":"us-east-1","America/Toronto":"ca-central-1","America/Montreal":"ca-central-1","America/Halifax":"ca-central-1","America/Winnipeg":"ca-central-1","America/Chicago":"us-east-2","America/Indiana/Indianapolis":"us-east-2","America/Mexico_City":"us-east-2","America/Denver":"us-west-2","America/Phoenix":"us-west-2","America/Edmonton":"us-west-2","America/Vancouver":"us-west-2","America/Los_Angeles":"us-west-1","America/Tijuana":"us-west-1","America/Sao_Paulo":"sa-east-1","America/Argentina/Buenos_Aires":"sa-east-1","America/Santiago":"sa-east-1","America/Montevideo":"sa-east-1","America/Lima":"sa-east-1","America/Bogota":"us-east-1","Asia/Tokyo":"ap-northeast-1","Asia/Seoul":"ap-northeast-2","Asia/Hong_Kong":"ap-east-1","Asia/Shanghai":"ap-east-1","Asia/Taipei":"ap-east-1","Asia/Macau":"ap-east-1","Asia/Singapore":"ap-southeast-1","Asia/Kuala_Lumpur":"ap-southeast-1","Asia/Bangkok":"ap-southeast-1","Asia/Ho_Chi_Minh":"ap-southeast-1","Asia/Manila":"ap-southeast-1","Asia/Jakarta":"ap-southeast-3","Asia/Kolkata":"ap-south-1","Asia/Calcutta":"ap-south-1","Asia/Karachi":"ap-south-1","Asia/Dhaka":"ap-south-1","Asia/Colombo":"ap-south-1","Asia/Dubai":"me-central-1","Asia/Muscat":"me-central-1","Asia/Qatar":"me-south-1","Asia/Bahrain":"me-south-1","Asia/Riyadh":"me-south-1","Asia/Kuwait":"me-south-1","Asia/Jerusalem":"me-south-1","Australia/Sydney":"ap-southeast-2","Australia/Brisbane":"ap-southeast-2","Australia/Canberra":"ap-southeast-2","Australia/Melbourne":"ap-southeast-4","Australia/Hobart":"ap-southeast-4","Australia/Adelaide":"ap-southeast-4","Pacific/Auckland":"ap-southeast-2","Pacific/Honolulu":"us-west-1","Africa/Johannesburg":"af-south-1","Africa/Casablanca":"eu-south-2","Africa/Cairo":"me-south-1","Indian/Maldives":"ap-south-1"}),l=Object.freeze({Europe:"eu-central-1",America:"us-east-1",Asia:"ap-southeast-1",Australia:"ap-southeast-2",Pacific:"ap-southeast-2",Africa:"af-south-1",Atlantic:"eu-west-1",Indian:"ap-south-1"}),A=Object.freeze({"af-south-1":"eu-west-1","ap-east-1":"ap-southeast-1","ap-southeast-3":"ap-southeast-1","ap-southeast-4":"ap-southeast-2","eu-central-2":"eu-central-1","eu-south-1":"eu-central-1","eu-south-2":"eu-west-3","me-central-1":"ap-south-1","me-south-1":"ap-south-1"});function u(e){return c.has(e)?A[e]??r:e}t(u,"toDeployableRegion");function E(e){if(!e)return;const a=p[e];if(a!==void 0)return u(a);const n=e.split("/")[0];if(n===void 0)return;const s=l[n];return s===void 0?void 0:u(s)}t(E,"suggestRegionForTimezone");export{o as AWS_REGIONS_METADATA,r as DEFAULT_REGION,d as MAX_SECONDARY_REGIONS,c as OPT_IN_REGION_CODES,I as abbreviateRegion,f as getRegionInfo,y as optInRegionWarning,m as regions,E as suggestRegionForTimezone};
+var i=Object.defineProperty;var o=(e,a)=>i(e,"name",{value:a,configurable:!0});const c="us-east-2",I=10,s=Object.freeze([{code:"us-east-2",name:"US East",city:"Ohio",country:"USA",optIn:!1},{code:"us-west-2",name:"US West",city:"Oregon",country:"USA",optIn:!1},{code:"us-east-1",name:"US East",city:"N. Virginia",country:"USA",optIn:!1},{code:"eu-west-1",name:"EU West",city:"Ireland",country:"Ireland",optIn:!1},{code:"eu-central-1",name:"EU Central",city:"Frankfurt",country:"Germany",optIn:!1},{code:"ap-southeast-1",name:"Asia Pacific",city:"Singapore",country:"Singapore",optIn:!1},{code:"ap-northeast-1",name:"Asia Pacific",city:"Tokyo",country:"Japan",optIn:!1},{code:"ap-southeast-2",name:"Asia Pacific",city:"Sydney",country:"Australia",optIn:!1},{code:"us-west-1",name:"US West",city:"N. California",country:"USA",optIn:!1},{code:"ca-central-1",name:"Canada",city:"Central",country:"Canada",optIn:!1},{code:"af-south-1",name:"Africa",city:"Cape Town",country:"South Africa",optIn:!0},{code:"ap-east-1",name:"Asia Pacific",city:"Hong Kong",country:"Hong Kong",optIn:!0},{code:"ap-northeast-2",name:"Asia Pacific",city:"Seoul",country:"South Korea",optIn:!1},{code:"ap-northeast-3",name:"Asia Pacific",city:"Osaka",country:"Japan",optIn:!1},{code:"ap-south-1",name:"Asia Pacific",city:"Mumbai",country:"India",optIn:!1},{code:"ap-south-2",name:"Asia Pacific",city:"Hyderabad",country:"India",optIn:!0},{code:"ap-southeast-3",name:"Asia Pacific",city:"Jakarta",country:"Indonesia",optIn:!0},{code:"ap-southeast-4",name:"Asia Pacific",city:"Melbourne",country:"Australia",optIn:!0},{code:"eu-central-2",name:"EU Central",city:"Zurich",country:"Switzerland",optIn:!0},{code:"eu-north-1",name:"EU North",city:"Stockholm",country:"Sweden",optIn:!1},{code:"eu-south-1",name:"EU South",city:"Milan",country:"Italy",optIn:!0},{code:"eu-south-2",name:"EU South",city:"Spain",country:"Spain",optIn:!0},{code:"eu-west-2",name:"EU West",city:"London",country:"UK",optIn:!1},{code:"eu-west-3",name:"EU West",city:"Paris",country:"France",optIn:!1},{code:"me-central-1",name:"Middle East",city:"UAE",country:"UAE",optIn:!0},{code:"me-south-1",name:"Middle East",city:"Bahrain",country:"Bahrain",optIn:!0},{code:"sa-east-1",name:"South America",city:"S\xE3o Paulo",country:"Brazil",optIn:!1},{code:"ap-southeast-5",name:"Asia Pacific",city:"Kuala Lumpur",country:"Malaysia",optIn:!0},{code:"ap-southeast-6",name:"Asia Pacific",city:"Auckland",country:"New Zealand",optIn:!0},{code:"ap-southeast-7",name:"Asia Pacific",city:"Bangkok",country:"Thailand",optIn:!0},{code:"ap-east-2",name:"Asia Pacific",city:"Taipei",country:"Taiwan",optIn:!0},{code:"ca-west-1",name:"Canada West",city:"Calgary",country:"Canada",optIn:!0},{code:"il-central-1",name:"Israel",city:"Tel Aviv",country:"Israel",optIn:!0},{code:"mx-central-1",name:"Mexico",city:"Central",country:"Mexico",optIn:!0}]),E=Object.freeze(s.map(e=>e.code)),p=new Set(s.filter(e=>e.optIn).map(e=>e.code));function g(e){return`${e} is an opt-in region: it must be enabled in the AWS account (Account settings \u2192 Regions) before deployment will succeed.`}o(g,"optInRegionWarning");function S(e){return s.find(a=>a.code===e)}o(S,"getRegionInfo");const l=Object.freeze({southeast:"se",northeast:"ne",south:"so",north:"n",east:"e",west:"w",central:"c"});function h(e){const a=e.split("-");if(a.length===3&&a[0]&&a[1]&&a[2]){const t=l[a[1]]??a[1][0];return`${a[0]}${t}${a[2]}`}return e}o(h,"abbreviateRegion");function A(e){const a=e.split("-");return a.length===3&&a[0]&&a[1]&&a[2]?`${a[0]}${a[1][0]}${a[2]}`:e}o(A,"legacyAbbreviateRegion");const w=(()=>{const e=new Set(s.map(t=>h(t.code))),a=new Map;for(const t of s){const n=A(t.code);if(e.has(n))continue;const u=a.get(n);u===void 0?a.set(n,[t.code]):u.push(t.code)}return a})(),d=Object.freeze({"Europe/London":"eu-west-2","Europe/Jersey":"eu-west-2","Europe/Guernsey":"eu-west-2","Europe/Isle_of_Man":"eu-west-2","Europe/Dublin":"eu-west-1","Europe/Paris":"eu-west-3","Europe/Berlin":"eu-central-1","Europe/Amsterdam":"eu-central-1","Europe/Brussels":"eu-central-1","Europe/Luxembourg":"eu-central-1","Europe/Vienna":"eu-central-1","Europe/Prague":"eu-central-1","Europe/Warsaw":"eu-central-1","Europe/Budapest":"eu-central-1","Europe/Zurich":"eu-central-2","Europe/Stockholm":"eu-north-1","Europe/Oslo":"eu-north-1","Europe/Copenhagen":"eu-north-1","Europe/Helsinki":"eu-north-1","Europe/Tallinn":"eu-north-1","Europe/Riga":"eu-north-1","Europe/Vilnius":"eu-north-1","Europe/Rome":"eu-south-1","Europe/Malta":"eu-south-1","Europe/Athens":"eu-south-1","Europe/Madrid":"eu-south-2","Europe/Lisbon":"eu-south-2","America/New_York":"us-east-1","America/Detroit":"us-east-1","America/Toronto":"ca-central-1","America/Montreal":"ca-central-1","America/Halifax":"ca-central-1","America/Winnipeg":"ca-central-1","America/Chicago":"us-east-2","America/Indiana/Indianapolis":"us-east-2","America/Mexico_City":"us-east-2","America/Denver":"us-west-2","America/Phoenix":"us-west-2","America/Edmonton":"us-west-2","America/Vancouver":"us-west-2","America/Los_Angeles":"us-west-1","America/Tijuana":"us-west-1","America/Sao_Paulo":"sa-east-1","America/Argentina/Buenos_Aires":"sa-east-1","America/Santiago":"sa-east-1","America/Montevideo":"sa-east-1","America/Lima":"sa-east-1","America/Bogota":"us-east-1","Asia/Tokyo":"ap-northeast-1","Asia/Seoul":"ap-northeast-2","Asia/Hong_Kong":"ap-east-1","Asia/Shanghai":"ap-east-1","Asia/Taipei":"ap-east-1","Asia/Macau":"ap-east-1","Asia/Singapore":"ap-southeast-1","Asia/Kuala_Lumpur":"ap-southeast-1","Asia/Bangkok":"ap-southeast-1","Asia/Ho_Chi_Minh":"ap-southeast-1","Asia/Manila":"ap-southeast-1","Asia/Jakarta":"ap-southeast-3","Asia/Kolkata":"ap-south-1","Asia/Calcutta":"ap-south-1","Asia/Karachi":"ap-south-1","Asia/Dhaka":"ap-south-1","Asia/Colombo":"ap-south-1","Asia/Dubai":"me-central-1","Asia/Muscat":"me-central-1","Asia/Qatar":"me-south-1","Asia/Bahrain":"me-south-1","Asia/Riyadh":"me-south-1","Asia/Kuwait":"me-south-1","Asia/Jerusalem":"me-south-1","Australia/Sydney":"ap-southeast-2","Australia/Brisbane":"ap-southeast-2","Australia/Canberra":"ap-southeast-2","Australia/Melbourne":"ap-southeast-4","Australia/Hobart":"ap-southeast-4","Australia/Adelaide":"ap-southeast-4","Pacific/Auckland":"ap-southeast-2","Pacific/Honolulu":"us-west-1","Africa/Johannesburg":"af-south-1","Africa/Casablanca":"eu-south-2","Africa/Cairo":"me-south-1","Indian/Maldives":"ap-south-1"}),m=Object.freeze({Europe:"eu-central-1",America:"us-east-1",Asia:"ap-southeast-1",Australia:"ap-southeast-2",Pacific:"ap-southeast-2",Africa:"af-south-1",Atlantic:"eu-west-1",Indian:"ap-south-1"}),y=Object.freeze({"af-south-1":"eu-west-1","ap-east-1":"ap-southeast-1","ap-southeast-3":"ap-southeast-1","ap-southeast-4":"ap-southeast-2","eu-central-2":"eu-central-1","eu-south-1":"eu-central-1","eu-south-2":"eu-west-3","me-central-1":"ap-south-1","me-south-1":"ap-south-1"});function r(e){return p.has(e)?y[e]??c:e}o(r,"toDeployableRegion");function _(e){if(!e)return;const a=d[e];if(a!==void 0)return r(a);const t=e.split("/")[0];if(t===void 0)return;const n=m[t];return n===void 0?void 0:r(n)}o(_,"suggestRegionForTimezone");export{s as AWS_REGIONS_METADATA,c as DEFAULT_REGION,I as MAX_SECONDARY_REGIONS,p as OPT_IN_REGION_CODES,w as RETIRED_REGION_ABBREVIATIONS,h as abbreviateRegion,S as getRegionInfo,g as optInRegionWarning,E as regions,_ as suggestRegionForTimezone};

package/dist/mcpProtocol/index.d.ts

@@ -180,19 +180,19 @@ export declare const ResolvedInputsSchema: z.ZodObject<{
     name: z.ZodString;
     pattern: z.ZodOptional<z.ZodString>;
     patternTier: z.ZodOptional<z.ZodEnum<{
-        tinkerer: "tinkerer";
-        lightweight: "lightweight";
         standard: "standard";
         resilient: "resilient";
         enterprise: "enterprise";
+        tinkerer: "tinkerer";
+        lightweight: "lightweight";
     }>>;
     patternDomain: z.ZodOptional<z.ZodString>;
     network: z.ZodOptional<z.ZodEnum<{
-        none: "none";
-        lightweight: "lightweight";
         standard: "standard";
         resilient: "resilient";
         enterprise: "enterprise";
+        none: "none";
+        lightweight: "lightweight";
     }>>;
     template: z.ZodOptional<z.ZodString>;
     docker: z.ZodOptional<z.ZodObject<{
@@ -216,19 +216,19 @@ export declare const ScaffoldPlanSchema: z.ZodObject<{
         name: z.ZodString;
         pattern: z.ZodOptional<z.ZodString>;
         patternTier: z.ZodOptional<z.ZodEnum<{
-            tinkerer: "tinkerer";
-            lightweight: "lightweight";
             standard: "standard";
             resilient: "resilient";
             enterprise: "enterprise";
+            tinkerer: "tinkerer";
+            lightweight: "lightweight";
         }>>;
         patternDomain: z.ZodOptional<z.ZodString>;
         network: z.ZodOptional<z.ZodEnum<{
-            none: "none";
-            lightweight: "lightweight";
             standard: "standard";
             resilient: "resilient";
             enterprise: "enterprise";
+            none: "none";
+            lightweight: "lightweight";
         }>>;
         template: z.ZodOptional<z.ZodString>;
         docker: z.ZodOptional<z.ZodObject<{

package/dist/naming/connectedAccountName.d.ts

@@ -4,7 +4,7 @@
  * A connected AWS account's display name flows into deployment target names
  * (`generateTargetName`) AND into CFN / profile identifiers, so the name must be
  * a clean slug and must NOT already carry a region short-code suffix — otherwise
- * the region is appended twice (`clearcalcs-prod-use2` → target `…-use2-use2`).
+ * the region is appended twice (`acme-widgets-prod-use2` → target `…-use2-use2`).
  *
  * Single source of truth for the default-name shape and the region-suffix guard,
  * shared by the webapp connect / quick-create ingress and the CLI connect screen.
@@ -13,21 +13,25 @@
  * Default name for a newly-connected account: `<org>-<stage>` as a clean slug.
  * `stage` must be the DECODED workload stage (e.g. "production"), never a raw
  * wire `environment` value. An empty stage yields the org slug alone.
- * e.g. ("Calcs.com", "production") → "calcs-com-production".
+ * e.g. ("Acme.example", "production") → "acme-example-production".
  */
 export declare function defaultConnectedAccountName(orgName: string, stage: string): string;
 /**
  * Append a short disambiguating suffix to a base account name when the base
  * collides with an existing account (the `<org>-<stage>` default is taken).
- * e.g. ("calcs-com-production", "a3f9") → "calcs-com-production-a3f9".
+ * e.g. ("acme-example-production", "a3f9") → "acme-example-production-a3f9".
  */
 export declare function suffixedAccountName(base: string, shortId: string): string;
 /**
- * Every region short code an account name could be mistakenly suffixed with,
- * derived from the region metadata via `abbreviateRegion` (the same derivation
- * `generateTargetName` appends). Deduplicated — distinct regions can abbreviate
- * to the same code (e.g. ap-south-1 and ap-southeast-1 both → "aps1"), which is
- * harmless for membership testing.
+ * Every region short code an account name could be mistakenly suffixed with:
+ * the codes `abbreviateRegion` emits today (the same derivation
+ * `generateTargetName` appends), plus the retired ones it used to emit.
+ *
+ * The retired half matters because this set only ever answers "would appending
+ * a region to this name read as a doubled region?" — and it would, for a name a
+ * customer picked while an older Fjall was emitting the old codes. Deriving the
+ * set from the live codes alone would quietly start accepting `acme-aps1` as an
+ * account name the day the abbreviations changed.
  */
 export declare const REGION_SHORT_CODES: ReadonlySet<string>;
 /**

package/dist/naming/connectedAccountName.js

@@ -1 +1 @@
-var u=Object.defineProperty;var o=(e,t)=>u(e,"name",{value:t,configurable:!0});import{abbreviateRegion as c,AWS_REGIONS_METADATA as a}from"../infra/regions.js";import{toKebab as f}from"./caseConversion.js";function r(e){return f(e).replace(/[^a-z0-9]+/g,"-").replace(/^-+|-+$/g,"")}o(r,"slugifyAccountName");function m(e,t){const n=r(e),i=r(t);return n===""?i:i===""?n:`${n}-${i}`}o(m,"defaultConnectedAccountName");function p(e,t){const n=r(t);return n===""?e:`${e}-${n}`}o(p,"suffixedAccountName");const s=new Set(a.map(e=>c(e.code)));function x(e){const t=e.toLowerCase().split(/[-\s_]+/).filter(i=>i.length>0),n=t[t.length-1];if(n!==void 0&&s.has(n))return n}o(x,"findTrailingRegionShortCode");function A(e){return`Account name must not end with a region code ("-${e}") \u2014 the region is added automatically when deploying. Remove the "-${e}" suffix.`}o(A,"regionSuffixRejectionMessage");export{s as REGION_SHORT_CODES,m as defaultConnectedAccountName,x as findTrailingRegionShortCode,A as regionSuffixRejectionMessage,p as suffixedAccountName};
+var u=Object.defineProperty;var o=(e,t)=>u(e,"name",{value:t,configurable:!0});import{abbreviateRegion as c,AWS_REGIONS_METADATA as a,RETIRED_REGION_ABBREVIATIONS as f}from"../infra/regions.js";import{toKebab as s}from"./caseConversion.js";function r(e){return s(e).replace(/[^a-z0-9]+/g,"-").replace(/^-+|-+$/g,"")}o(r,"slugifyAccountName");function p(e,t){const n=r(e),i=r(t);return n===""?i:i===""?n:`${n}-${i}`}o(p,"defaultConnectedAccountName");function R(e,t){const n=r(t);return n===""?e:`${e}-${n}`}o(R,"suffixedAccountName");const g=new Set([...a.map(e=>c(e.code)),...f.keys()]);function A(e){const t=e.toLowerCase().split(/[-\s_]+/).filter(i=>i.length>0),n=t[t.length-1];if(n!==void 0&&g.has(n))return n}o(A,"findTrailingRegionShortCode");function x(e){return`Account name must not end with a region code ("-${e}") \u2014 the region is added automatically when deploying. Remove the "-${e}" suffix.`}o(x,"regionSuffixRejectionMessage");export{g as REGION_SHORT_CODES,p as defaultConnectedAccountName,A as findTrailingRegionShortCode,x as regionSuffixRejectionMessage,R as suffixedAccountName};

package/dist/targets.d.ts

@@ -23,13 +23,24 @@ export interface TargetAccount {
     environment: string | null;
     tier?: AccountTier;
 }
-export interface DerivedTarget {
-    name: string;
+/**
+ * The account and region a deployment target names.
+ *
+ * Split out from `DerivedTarget` because it is the half that carries meaning:
+ * the name is a derived encoding of this pair, and the encoding is not
+ * reversible in general (account names contain hyphens; two regions abbreviated
+ * to one code until 2026-09-04). Code that has resolved the pair passes it
+ * along as this type rather than composing a name for a callee to take apart.
+ */
+export interface ResolvedTargetAccount {
     accountName: string;
     accountId: string;
     environment: string;
     region: string;
 }
+export interface DerivedTarget extends ResolvedTargetAccount {
+    name: string;
+}
 /**
  * Canonical stage-or-tier fallback. Structural accounts carry a null workload
  * stage, so display/naming/OU derivation fall back to the structural tier to
@@ -44,6 +55,19 @@ export declare function environmentOrTier(account: {
  * e.g. ("Production-US", "us-east-1") → "production-us-use1"
  */
 export declare function generateTargetName(accountName: string, region: string): string;
+/**
+ * The refusal for a target name whose region code Fjall no longer emits, or
+ * `undefined` when the name carries no retired code.
+ *
+ * Every guard that turns a target name back into an account and region consumes
+ * this before searching, so a stale name is refused with the same explanation
+ * wherever it is typed. Without it the searches fail open in the worst
+ * direction: they scan every AWS region for a name match, so a retired code
+ * either finds nothing (a bare "not found" that teaches the operator nothing
+ * about why a name that worked last week does not now) or — for the codes that
+ * were ambiguous — finds the wrong region and deploys there.
+ */
+export declare function explainRetiredTargetName(targetName: string): string | undefined;
 /**
  * Derive all deployment targets from org config accounts and regions.
  * Excludes root accounts (organisation management accounts).

package/dist/targets.js

@@ -1 +1 @@
-var s=Object.defineProperty;var o=(e,n)=>s(e,"name",{value:n,configurable:!0});import{abbreviateRegion as u}from"./infra/regions.js";import{accountTier as m}from"./environments.js";function f(e){const n=[e.primaryRegion,...e.secondaryRegions??[],e.disasterRecoveryRegion].filter(t=>t!==void 0);return[...new Set(n)]}o(f,"deriveRegionsFromOrgConfig");function p(e){return e.environment??m(e)}o(p,"environmentOrTier");function d(e,n){return`${e.toLowerCase()}-${u(n)}`}o(d,"generateTargetName");function g(e,n){const t=[];for(const r of e){if(m(r)==="organisation")continue;const i=p(r);for(const a of n)t.push({name:d(r.name,a),accountName:r.name,accountId:r.id,environment:i,region:a})}return t.sort((r,i)=>{const a=r.environment.localeCompare(i.environment);if(a!==0)return a;const c=r.accountName.localeCompare(i.accountName);return c!==0?c:r.region.localeCompare(i.region)})}o(g,"deriveTargets");function x(e){return g(e.providerAccounts,f(e))}o(x,"deriveAllTargets");function y(e,n){if(n.length===0)return e;const t=new Set([e.primaryRegion,e.disasterRecoveryRegion].filter(Boolean)),r=n.filter(i=>!t.has(i));return{...e,secondaryRegions:r.length>0?r:void 0}}o(y,"mergeSecondaryRegions");function T(e,n){return e.find(t=>t.name===n)}o(T,"findTarget");export{x as deriveAllTargets,f as deriveRegionsFromOrgConfig,g as deriveTargets,p as environmentOrTier,T as findTarget,d as generateTargetName,y as mergeSecondaryRegions};
+var l=Object.defineProperty;var i=(e,n)=>l(e,"name",{value:n,configurable:!0});import{abbreviateRegion as u,RETIRED_REGION_ABBREVIATIONS as g}from"./infra/regions.js";import{accountTier as m}from"./environments.js";function p(e){const n=[e.primaryRegion,...e.secondaryRegions??[],e.disasterRecoveryRegion].filter(o=>o!==void 0);return[...new Set(n)]}i(p,"deriveRegionsFromOrgConfig");function R(e){return e.environment??m(e)}i(R,"environmentOrTier");function v(e,n){return`${e.toLowerCase()}-${u(n)}`}i(v,"generateTargetName");function y(e){const n=e.toLowerCase(),o=n.lastIndexOf("-");if(o<=0)return;const r=n.slice(o+1),t=g.get(r);if(t===void 0||t.length===0)return;const s=n.slice(0,o),a=t.map(c=>`'${s}-${u(c)}' (${c})`),d=t.length>1?`"${r}" named ${t.join(" and ")}, so it could not say which`:`"${r}" named ${t[0]}`,f=a.length>1?`Use ${a.slice(0,-1).join(", ")} or ${a[a.length-1]}`:`Use ${a[0]}`;return`Target '${e}' uses a retired region code. ${d}. ${f}. Run 'fjall target list' to see every current target name.`}i(y,"explainRetiredTargetName");function $(e,n){const o=[];for(const r of e){if(m(r)==="organisation")continue;const t=R(r);for(const s of n)o.push({name:v(r.name,s),accountName:r.name,accountId:r.id,environment:t,region:s})}return o.sort((r,t)=>{const s=r.environment.localeCompare(t.environment);if(s!==0)return s;const a=r.accountName.localeCompare(t.accountName);return a!==0?a:r.region.localeCompare(t.region)})}i($,"deriveTargets");function w(e){return $(e.providerAccounts,p(e))}i(w,"deriveAllTargets");function I(e,n){if(n.length===0)return e;const o=new Set([e.primaryRegion,e.disasterRecoveryRegion].filter(Boolean)),r=n.filter(t=>!o.has(t));return{...e,secondaryRegions:r.length>0?r:void 0}}i(I,"mergeSecondaryRegions");function N(e,n){return e.find(o=>o.name===n)}i(N,"findTarget");export{w as deriveAllTargets,p as deriveRegionsFromOrgConfig,$ as deriveTargets,R as environmentOrTier,y as explainRetiredTargetName,N as findTarget,v as generateTargetName,I as mergeSecondaryRegions};

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@fjall/util",
-  "version": "31.0.0",
+  "version": "33.0.0",
   "repository": {
     "type": "git",
     "url": "git+https://github.com/fjall-tech/fjall.git",
@@ -67,6 +67,10 @@
       "types": "./dist/environments.d.ts",
       "default": "./dist/environments.js"
     },
+    "./backupTiers": {
+      "types": "./dist/backupTiers.d.ts",
+      "default": "./dist/backupTiers.js"
+    },
     "./fsHelpers": {
       "types": "./dist/fsHelpers.d.ts",
       "default": "./dist/fsHelpers.js"

package/dist/migration/clickhouseFrameworkUsers.test.d.ts

@@ -1 +0,0 @@
-export {};

package/dist/migration/clickhouseFrameworkUsers.test.js

@@ -1 +0,0 @@
-import{describe as a,expect as e,it as s}from"vitest";import{CLICKHOUSE_FRAMEWORK_USERS_ENV as f,FJALL_CLICKHOUSE_USER_PREFIX as C,FJALL_CLICKHOUSE_USERS as c,FJALL_MAINTENANCE_USER as l,FJALL_SCHEMA_GATE_USER as h,FrameworkUserNamesSchema as d,isReservedClickHouseUserName as n}from"./clickhouseFrameworkUsers.js";import{MANAGED_USER_NAME_PATTERN as A}from"./clickhouseSqlUsers.js";import{CONTROL_PLANE_ACTIVITY_RECENCY_SECONDS as S,buildControlPlaneActivityQuery as r}from"./controlPlaneActivity.js";import{SCHEMA_GATE_EXIT as i,SCHEMA_GATE_EXIT_HINTS as y,schemaGateExitKind as m}from"./schemaGateExit.js";import{sleepAbortable as E}from"./sleepAbortable.js";a("framework ClickHouse identities",()=>{s("every framework identity carries the reserved prefix and is a valid SQL name",()=>{for(const t of c)e(n(t)).toBe(!0),e(t).toMatch(A);e(c).toEqual([h,l])}),s("customer names outside the prefix are not reserved",()=>{e(n("schema_admin")).toBe(!1),e(n("backup_reader")).toBe(!1),e(n(`${C}x`)).toBe(!0)}),s("the manifest schema accepts only framework identities",()=>{e(d.safeParse([...c]).success).toBe(!0),e(d.safeParse(["fjall_other"]).success).toBe(!1),e(d.safeParse(["schema_admin"]).success).toBe(!1),e(f).toBe("CLICKHOUSE_FRAMEWORK_USERS")})}),a("schema gate exit taxonomy",()=>{s("codes are distinct and every kind has a hint",()=>{const t=Object.values(i);e(new Set(t).size).toBe(t.length);for(const o of Object.keys(i))e(y[o].length).toBeGreaterThan(0),e(m(i[o])).toBe(o)}),s("pins the wire values consumers already depend on",()=>{e(i).toEqual({pass:0,refused:1,configError:2,connectionError:3,busy:4,denied:5})}),s("returns undefined for codes the gate never emits",()=>{e(m(143)).toBeUndefined(),e(m(137)).toBeUndefined()})}),a("buildControlPlaneActivityQuery",()=>{s("probes both live processes and recent query_log for the named users",()=>{const t=r({users:["schema_admin",l]});e(t).toContain("FROM system.processes WHERE user IN ('schema_admin', 'fjall_maintenance')"),e(t).toContain("FROM system.query_log WHERE user IN ('schema_admin', 'fjall_maintenance')"),e(t).toContain(`INTERVAL ${S} SECOND`),e(t).toContain("type != 'QueryStart'"),e(t).toContain("event_date >= yesterday()"),e(t.trim().endsWith("AS active")).toBe(!0)}),s("honours a recency override",()=>{e(r({users:["schema_admin"],recencySeconds:5})).toContain("INTERVAL 5 SECOND")}),s("rejects names that could smuggle quoting, empty user lists, and bad recency",()=>{e(()=>r({users:["x' OR 1=1 --"]})).toThrow(/Invalid ClickHouse user name/),e(()=>r({users:[]})).toThrow(/at least one user/),e(()=>r({users:["a"],recencySeconds:0})).toThrow(/positive integer/)})}),a("sleepAbortable",()=>{s("resolves immediately on an already-aborted signal and on abort mid-sleep",async()=>{const t=new AbortController;t.abort(),await e(E(6e4,t.signal)).resolves.toBeUndefined();const o=new AbortController,u=Date.now(),_=E(6e4,o.signal);o.abort(),await _,e(Date.now()-u).toBeLessThan(1e3)})});

package/dist/migration/compareSchemaVersion.test.d.ts

@@ -1 +0,0 @@
-export {};

package/dist/migration/compareSchemaVersion.test.js

@@ -1 +0,0 @@
-import{describe as i,expect as e,it as s}from"vitest";import{isOrderableSchemaVersion as t,isSchemaVersionSatisfied as a}from"./compareSchemaVersion.js";i("isOrderableSchemaVersion",()=>{s("recognises a Prisma migration name",()=>{e(t("20260706120000_add_log_events")).toBe(!0)}),s("recognises a ClickHouse migration filename",()=>{e(t("011-issue-brief-citations.sql")).toBe(!0)}),s("rejects a sha256 content hash (the audit `version` field)",()=>{e(t("3f2b1c9d8e7a6f5b4c3d2e1f0a9b8c7d6e5f4a3b2c1d0e9f8a7b6c5d4e3f2a1b")).toBe(!1)}),s("rejects the constant `prisma_version` marker",()=>{e(t("applied")).toBe(!1)}),s("rejects a digit-leading string with no migration shape",()=>{e(t("19bc2fdeadbeef")).toBe(!1)})}),i("isSchemaVersionSatisfied",()=>{i("orderable versions (expand-only tolerance)",()=>{s("passes when actual equals expected (Prisma)",()=>{e(a("20260520000000_add_widgets","20260520000000_add_widgets")).toBe(!0)}),s("passes when actual is AHEAD of expected (Prisma rollback)",()=>{e(a("20260520000000_add_widgets","20260521000000_more")).toBe(!0)}),s("fails when actual TRAILS expected (Prisma \u2014 new code, old schema)",()=>{e(a("20260520000000_add_widgets","20260519000000_old")).toBe(!1)}),s("passes when actual is AHEAD of expected (ClickHouse rollback)",()=>{e(a("010-issue-briefs.sql","011-citations.sql")).toBe(!0)}),s("fails when actual TRAILS expected (ClickHouse)",()=>{e(a("010-issue-briefs.sql","009-old.sql")).toBe(!1)}),s("respects zero-padded numeric ordering, not naive digit count",()=>{e(a("010-a.sql","002-b.sql")).toBe(!1),e(a("002-b.sql","010-a.sql")).toBe(!0)})}),i("mismatched-width prefixes (fail-closed, no lexicographic trust)",()=>{s("refuses `>=` when CH numeric-prefix widths differ",()=>{e(a("010-x.sql","9-hotfix.sql")).toBe(!1),e(a("9-hotfix.sql","010-x.sql")).toBe(!1)}),s("still passes on exact identity even at a mismatched-width name",()=>{e(a("9-hotfix.sql","9-hotfix.sql")).toBe(!0)}),s("fails closed for a `.sql` name with no numeric prefix",()=>{e(a("010-x.sql","hotfix.sql")).toBe(!1),e(a("hotfix.sql","hotfix.sql")).toBe(!0)})}),i("non-orderable versions (fail-closed strict identity)",()=>{s("passes only on exact hash identity",()=>{const o="3f2b1c9d8e7a6f5b4c3d2e1f0a9b8c7d6e5f4a3b2c1d0e9f8a7b6c5d4e3f2a1b";e(a(o,o)).toBe(!0)}),s("fails for a different hash even when it sorts later",()=>{e(a("00000000","ffffffff")).toBe(!1)}),s("fails when only one side is orderable",()=>{e(a("20260520000000_add_widgets","applied")).toBe(!1),e(a("applied","20260521000000_more")).toBe(!1)})})});

package/dist/migration/pickLatestClickHouseMigration.test.d.ts

@@ -1 +0,0 @@
-export {};

package/dist/migration/pickLatestClickHouseMigration.test.js

@@ -1 +0,0 @@
-import{mkdtempSync as c,mkdirSync as a,rmSync as m,writeFileSync as i}from"node:fs";import{tmpdir as f}from"node:os";import{join as s}from"node:path";import{afterEach as h,beforeEach as p,describe as n,expect as t,it as o}from"vitest";import{CLICKHOUSE_MIGRATION_SKIP_RE as l}from"./constants.js";import{pickLatestClickHouseMigration as r}from"./pickLatestClickHouseMigration.js";n("pickLatestClickHouseMigration",()=>{let e;p(()=>{e=c(s(f(),"fjall-ch-test-"))}),h(()=>{m(e,{recursive:!0,force:!0})}),o("returns the lexicographically-latest *.sql filename",()=>{i(s(e,"001-schema.sql"),""),i(s(e,"010-issue-briefs.sql"),""),i(s(e,"005-optimisation-mvs.sql"),""),t(r(e)).toBe("010-issue-briefs.sql")}),o("skips *.dev.sql so synth and runner agree on 'latest'",()=>{i(s(e,"001-schema.sql"),""),i(s(e,"002-permissions.sql"),""),i(s(e,"999-local-only.dev.sql"),""),t(r(e)).toBe("002-permissions.sql")}),o("ignores non-SQL files (shell backfills, configs)",()=>{i(s(e,"001-schema.sql"),""),i(s(e,"009-mv-ttl-backfill.sh"),""),i(s(e,"users.xml"),""),i(s(e,"config.xml"),""),t(r(e)).toBe("001-schema.sql")}),o("ignores subdirectories that look like SQL",()=>{i(s(e,"001-schema.sql"),""),a(s(e,"999-not-a-file.sql")),t(r(e)).toBe("001-schema.sql")}),o("throws when the directory contains no eligible SQL files",()=>{i(s(e,"999-only.dev.sql"),""),i(s(e,"config.xml"),""),t(()=>r(e)).toThrow(/No ClickHouse migration files found/)}),o("throws on an empty directory",()=>{t(()=>r(e)).toThrow(/No ClickHouse migration files found/)})}),n("CLICKHOUSE_MIGRATION_SKIP_RE",()=>{o("matches *.dev.sql",()=>{t(l.test("001-users.dev.sql")).toBe(!0)}),o("rejects bare *.sql",()=>{t(l.test("001-schema.sql")).toBe(!1)}),o("regex identity pin \u2014 drift here decouples synth gate from runner applier",()=>{t(l.source).toBe(String.raw`\.dev\.sql$`)})});

package/dist/migration/verifyExpectedSchemaVersion.test.d.ts

@@ -1 +0,0 @@
-export {};

package/dist/migration/verifyExpectedSchemaVersion.test.js

@@ -1 +0,0 @@
-var d=Object.defineProperty;var c=(e,t)=>d(e,"name",{value:t,configurable:!0});import{describe as r,expect as a,it as o,vi as u}from"vitest";import{verifyExpectedSchemaVersion as n}from"./verifyExpectedSchemaVersion.js";function i(e){const t=[];return{client:{query:u.fn(async l=>(t.push(l),{rows:e}))},queries:t}}c(i,"makeMockClient"),r("verifyExpectedSchemaVersion",()=>{r('tool: "prisma"',()=>{o("returns matches=true when actual === expected",async()=>{const{client:e,queries:t}=i([{migration_name:"20260520000000_add_widgets"}]),s=await n({tool:"prisma",expected:"20260520000000_add_widgets",client:e});a(s).toEqual({matches:!0,expected:"20260520000000_add_widgets",actual:"20260520000000_add_widgets"}),a(t).toHaveLength(1),a(t[0]).toContain("_prisma_migrations"),a(t[0]).toContain("finished_at IS NOT NULL"),a(t[0]).toContain("ORDER BY migration_name DESC LIMIT 1")}),o("orders by migration_name, not finished_at (out-of-order application)",async()=>{const{client:e,queries:t}=i([{migration_name:"20260809140000_drop_admin_plugin_columns"}]),s=await n({tool:"prisma",expected:"20260809140000_drop_admin_plugin_columns",client:e});a(s.matches).toBe(!0),a(t[0]).not.toContain("ORDER BY finished_at"),a(t[0]).toContain("ORDER BY migration_name DESC LIMIT 1")}),o("returns matches=false with actual when DB trails image",async()=>{const{client:e}=i([{migration_name:"20260519000000_old"}]),t=await n({tool:"prisma",expected:"20260520000000_add_widgets",client:e});a(t).toEqual({matches:!1,expected:"20260520000000_add_widgets",actual:"20260519000000_old"})}),o("returns matches=true when DB is AHEAD (expand-only rollback)",async()=>{const{client:e}=i([{migration_name:"20260521000000_add_more_widgets"}]),t=await n({tool:"prisma",expected:"20260520000000_add_widgets",client:e});a(t).toEqual({matches:!0,expected:"20260520000000_add_widgets",actual:"20260521000000_add_more_widgets"})}),o("returns actual=null on empty result set",async()=>{const{client:e}=i([]),t=await n({tool:"prisma",expected:"20260520000000_add_widgets",client:e});a(t).toEqual({matches:!1,expected:"20260520000000_add_widgets",actual:null})}),o("returns actual=null when row's migration_name is not a string",async()=>{const{client:e}=i([{migration_name:12345}]),t=await n({tool:"prisma",expected:"x",client:e});a(t.actual).toBeNull(),a(t.matches).toBe(!1)})}),r('tool: "custom"',()=>{o("uses customQuery sql and column",async()=>{const{client:e,queries:t}=i([{hash:"deadbeef"}]),s=await n({tool:"custom",expected:"deadbeef",client:e,customQuery:{sql:"SELECT hash FROM __drizzle_migrations ORDER BY created_at DESC LIMIT 1",column:"hash"}});a(s.matches).toBe(!0),a(s.actual).toBe("deadbeef"),a(t[0]).toBe("SELECT hash FROM __drizzle_migrations ORDER BY created_at DESC LIMIT 1")}),o("stays strict for non-orderable versions even when actual sorts later",async()=>{const{client:e}=i([{hash:"ffffffff"}]),t=await n({tool:"custom",expected:"00000000",client:e,customQuery:{sql:"SELECT hash FROM __drizzle_migrations ORDER BY created_at DESC LIMIT 1",column:"hash"}});a(t.matches).toBe(!1),a(t.actual).toBe("ffffffff")}),o("throws when customQuery is omitted",async()=>{const{client:e}=i([]);await a(n({tool:"custom",expected:"x",client:e})).rejects.toThrow(/tool="custom" requires customQuery/)})}),r("abort signal",()=>{o("short-circuits before query when signal is already aborted",async()=>{const{client:e,queries:t}=i([{migration_name:"irrelevant"}]),s=new AbortController;s.abort(),await a(n({tool:"prisma",expected:"x",client:e,signal:s.signal})).rejects.toThrow(/aborted by signal before query/),a(t).toEqual([])})})});