@fjall/util 32.0.0 → 33.1.0

package/dist/.minified

@@ -1 +1 @@
-126 files minified at 2026-09-05T02:09:25.839Z
+123 files minified at 2026-09-05T10:46:23.318Z

package/dist/aws/driftSuspects.d.ts

@@ -3,9 +3,9 @@
  *
  * A resource CloudFormation still tracks but which was deleted outside
  * CloudFormation wedges every subsequent update: the service handler returns
- * NotFound and the stack rolls back (the BusinessContinuity CMK incident,
- * account 913524923178). The patterns here are derived from the Phase 0
- * empirical fixtures (`fjall/deploy-core/src/orchestration/drift/__tests__/
+ * NotFound and the stack rolls back (the BusinessContinuity CMK incident). The
+ * patterns here are derived from the Phase 0 empirical fixtures
+ * (`fjall/deploy-core/src/orchestration/drift/__tests__/
  * fixtures/bc-stack-events.json`, captured 2026-07-07): the stable anchors are
  * the registry handler contract marker `HandlerErrorCode: NotFound` and the
  * service message shape `does not exist (Service: …`.

package/dist/aws/index.d.ts

@@ -6,6 +6,6 @@ export { FAILURE_ANALYSIS_CATEGORIES, type FailureAnalysisCategory } from "./fai
 export { maskFailureAnalysis } from "./maskFailureAnalysis.js";
 export { classifyDriftSuspectEvents, findCurrentOperationStart, isDriftSuspectReason, isOperationOpeningEvent, type DriftSuspectEvent } from "./driftSuspects.js";
 export { IPAM_OPERATIONS_POOL_TAG_KEY, formatIpamPairTagValue } from "./ipamTags.js";
-export { KMS_RETENTION_TAG_KEY, SDK_PRE_EMPTY_TAG_KEY } from "./infraTags.js";
+export { KMS_RETENTION_TAG_KEY, S3_VERSIONING_EXEMPT_TAG_KEY, S3_VERSIONING_EXEMPTIONS, SDK_PRE_EMPTY_TAG_KEY, type S3VersioningExemption } from "./infraTags.js";
 export { COST_ALLOCATION_TAGS, DEFAULT_COST_ALLOCATION_ENVIRONMENT, DEFAULT_COST_ALLOCATION_OWNER, ecrCreateRepositoryTags, rdsPreMigrationSnapshotTags, type AwsSdkTag, type EcrCreateTag } from "./costAllocationTags.js";
 export { ACCOUNT_MONITORING_ROLE_NAME } from "./monitoringRole.js";

package/dist/aws/index.js

@@ -1 +1 @@
-import{AWSError as e,NoRolesFoundError as t,InvalidCredentialsError as E,SSOTokenExpiredError as s,MissingRegionError as T,ProfileNotFoundError as _,CommandError as i,isAWSError as O,isNoRolesFoundError as A,isSSOUnauthorizedError as a}from"./errors.js";import{STACK_NOT_FOUND_PATTERN as S,CDK_NO_STACKS_MATCH as N,isResourceEvent as p}from"./cloudformationTypes.js";import{countResourceProgress as m,formatElapsed as C}from"./deployProgress.js";import{CloudFormationFailureAnalyser as u}from"./CloudFormationFailureAnalyser.js";import{FAILURE_ANALYSIS_CATEGORIES as l}from"./failureAnalysisCategories.js";import{maskFailureAnalysis as x}from"./maskFailureAnalysis.js";import{classifyDriftSuspectEvents as F,findCurrentOperationStart as P,isDriftSuspectReason as M,isOperationOpeningEvent as g}from"./driftSuspects.js";import{IPAM_OPERATIONS_POOL_TAG_KEY as c,formatIpamPairTagValue as D}from"./ipamTags.js";import{KMS_RETENTION_TAG_KEY as U,SDK_PRE_EMPTY_TAG_KEY as Y}from"./infraTags.js";import{COST_ALLOCATION_TAGS as y,DEFAULT_COST_ALLOCATION_ENVIRONMENT as W,DEFAULT_COST_ALLOCATION_OWNER as h,ecrCreateRepositoryTags as k,rdsPreMigrationSnapshotTags as V}from"./costAllocationTags.js";import{ACCOUNT_MONITORING_ROLE_NAME as H}from"./monitoringRole.js";export{H as ACCOUNT_MONITORING_ROLE_NAME,e as AWSError,N as CDK_NO_STACKS_MATCH,y as COST_ALLOCATION_TAGS,u as CloudFormationFailureAnalyser,i as CommandError,W as DEFAULT_COST_ALLOCATION_ENVIRONMENT,h as DEFAULT_COST_ALLOCATION_OWNER,l as FAILURE_ANALYSIS_CATEGORIES,c as IPAM_OPERATIONS_POOL_TAG_KEY,E as InvalidCredentialsError,U as KMS_RETENTION_TAG_KEY,T as MissingRegionError,t as NoRolesFoundError,_ as ProfileNotFoundError,Y as SDK_PRE_EMPTY_TAG_KEY,s as SSOTokenExpiredError,S as STACK_NOT_FOUND_PATTERN,F as classifyDriftSuspectEvents,m as countResourceProgress,k as ecrCreateRepositoryTags,P as findCurrentOperationStart,C as formatElapsed,D as formatIpamPairTagValue,O as isAWSError,M as isDriftSuspectReason,A as isNoRolesFoundError,g as isOperationOpeningEvent,p as isResourceEvent,a as isSSOUnauthorizedError,x as maskFailureAnalysis,V as rdsPreMigrationSnapshotTags};
+import{AWSError as e,NoRolesFoundError as E,InvalidCredentialsError as _,SSOTokenExpiredError as t,MissingRegionError as T,ProfileNotFoundError as O,CommandError as s,isAWSError as i,isNoRolesFoundError as A,isSSOUnauthorizedError as S}from"./errors.js";import{STACK_NOT_FOUND_PATTERN as N,CDK_NO_STACKS_MATCH as n,isResourceEvent as p}from"./cloudformationTypes.js";import{countResourceProgress as R,formatElapsed as f}from"./deployProgress.js";import{CloudFormationFailureAnalyser as C}from"./CloudFormationFailureAnalyser.js";import{FAILURE_ANALYSIS_CATEGORIES as l}from"./failureAnalysisCategories.js";import{maskFailureAnalysis as x}from"./maskFailureAnalysis.js";import{classifyDriftSuspectEvents as P,findCurrentOperationStart as M,isDriftSuspectReason as F,isOperationOpeningEvent as G}from"./driftSuspects.js";import{IPAM_OPERATIONS_POOL_TAG_KEY as g,formatIpamPairTagValue as c}from"./ipamTags.js";import{KMS_RETENTION_TAG_KEY as U,S3_VERSIONING_EXEMPT_TAG_KEY as Y,S3_VERSIONING_EXEMPTIONS as v,SDK_PRE_EMPTY_TAG_KEY as y}from"./infraTags.js";import{COST_ALLOCATION_TAGS as W,DEFAULT_COST_ALLOCATION_ENVIRONMENT as h,DEFAULT_COST_ALLOCATION_OWNER as k,ecrCreateRepositoryTags as X,rdsPreMigrationSnapshotTags as z}from"./costAllocationTags.js";import{ACCOUNT_MONITORING_ROLE_NAME as b}from"./monitoringRole.js";export{b as ACCOUNT_MONITORING_ROLE_NAME,e as AWSError,n as CDK_NO_STACKS_MATCH,W as COST_ALLOCATION_TAGS,C as CloudFormationFailureAnalyser,s as CommandError,h as DEFAULT_COST_ALLOCATION_ENVIRONMENT,k as DEFAULT_COST_ALLOCATION_OWNER,l as FAILURE_ANALYSIS_CATEGORIES,g as IPAM_OPERATIONS_POOL_TAG_KEY,_ as InvalidCredentialsError,U as KMS_RETENTION_TAG_KEY,T as MissingRegionError,E as NoRolesFoundError,O as ProfileNotFoundError,v as S3_VERSIONING_EXEMPTIONS,Y as S3_VERSIONING_EXEMPT_TAG_KEY,y as SDK_PRE_EMPTY_TAG_KEY,t as SSOTokenExpiredError,N as STACK_NOT_FOUND_PATTERN,P as classifyDriftSuspectEvents,R as countResourceProgress,X as ecrCreateRepositoryTags,M as findCurrentOperationStart,f as formatElapsed,c as formatIpamPairTagValue,i as isAWSError,F as isDriftSuspectReason,A as isNoRolesFoundError,G as isOperationOpeningEvent,p as isResourceEvent,S as isSSOUnauthorizedError,x as maskFailureAnalysis,z as rdsPreMigrationSnapshotTags};

package/dist/aws/infraTags.d.ts

@@ -32,3 +32,28 @@ export declare const SDK_PRE_EMPTY_TAG_KEY = "fjall:sdk-pre-empty";
  * `__tests__/infraTags.test.ts` guards against casual renames.
  */
 export declare const KMS_RETENTION_TAG_KEY = "fjall:kms:retention";
+/**
+ * The S3 versioning-exemption marker tag, shared by producer and consumer:
+ *
+ * - Producer (`@fjall/components-infrastructure`): the `S3Bucket` wrapper
+ *   (`storage/s3.ts`) stamps a bucket whose author passed
+ *   `versioningExemption`, and only when the bucket's resolved `versioned`
+ *   is false — a bucket that versions after all has nothing to exempt. The
+ *   value names why versioning is off by design: `build-output` (Payload
+ *   assets, pruned on every deploy), `isr-cache` (Payload ISR cache,
+ *   regenerated at runtime), `cold-tier` (ClickHouse cold-tier storage, the
+ *   table's own tiered parts).
+ * - Consumer (webapp posture): the `S3_VERSIONING_DISABLED` tier-policy rows
+ *   read key and value to land the finding `mitigated` on every bucket the
+ *   design exempts (tier-aware alert policy design 2026-09-01 §8 K4), one
+ *   signal for every construct site instead of a logical id per site.
+ *
+ * Key and values are deployed infrastructure state, read back by the same
+ * literals: a rename would return every exempt bucket to `open` until the
+ * next deploy. The pin test in `__tests__/infraTags.test.ts` guards against
+ * casual renames.
+ */
+export declare const S3_VERSIONING_EXEMPT_TAG_KEY = "fjall:s3:versioning-exempt";
+/** The exemptions the tag may carry — each names a bucket whose contents are rebuilt, not kept. */
+export declare const S3_VERSIONING_EXEMPTIONS: readonly ["build-output", "isr-cache", "cold-tier"];
+export type S3VersioningExemption = (typeof S3_VERSIONING_EXEMPTIONS)[number];

package/dist/aws/infraTags.js

@@ -1 +1 @@
-const t="fjall:sdk-pre-empty",_="fjall:kms:retention";export{_ as KMS_RETENTION_TAG_KEY,t as SDK_PRE_EMPTY_TAG_KEY};
+const t="fjall:sdk-pre-empty",e="fjall:kms:retention",E="fjall:s3:versioning-exempt",_=["build-output","isr-cache","cold-tier"];export{e as KMS_RETENTION_TAG_KEY,_ as S3_VERSIONING_EXEMPTIONS,E as S3_VERSIONING_EXEMPT_TAG_KEY,t as SDK_PRE_EMPTY_TAG_KEY};

package/dist/backupTiers.d.ts

@@ -0,0 +1,88 @@
+/**
+ * Application backup tier — the disaster-recovery posture an app declares
+ * once (`App.getApp(name, { backup: { tier } })`) and every tier-derived
+ * default reads. The vocabulary AND the per-tier defaults table live here so
+ * the constructs (which synthesise the defaults), the generator (whose
+ * presets and schemas speak the vocabulary) and every test that asserts what
+ * a tier promises derive from one declaration instead of copies kept in step
+ * by hand.
+ *
+ * Independent of the two other tier axes: the account governance tier
+ * ([[ACCOUNT_TIERS]]) and the generator pattern tier (`TIER_NAMES`).
+ */
+import { z } from "zod";
+export declare const BACKUP_TIERS: readonly ["standard", "resilient", "enterprise"];
+export type BackupTier = (typeof BACKUP_TIERS)[number];
+export declare const BackupTierSchema: z.ZodEnum<{
+    standard: "standard";
+    resilient: "resilient";
+    enterprise: "enterprise";
+}>;
+/** Type guard: checks whether a string is a declared application backup tier. */
+export declare function isBackupTier(value: string): value is BackupTier;
+/**
+ * Every default the app-level backup tier owns. One row per tier, one column
+ * per knob; a construct reads its column through [[tierDefault]] and never
+ * spells the value itself, so the tier→default derivation has exactly one
+ * home. An explicit prop on the construct still beats the tier column.
+ */
+export interface BackupTierDefaults {
+    /** S3 bucket versioning (`S3Bucket.versioned`). */
+    readonly s3Versioned: boolean;
+    /**
+     * RDS Instance / Aurora / Global Aurora automated backup retention in days
+     * (`backupRetention`). The read replica keeps CloudFormation's 0 — replica
+     * retention is a create-time property, so a tier flip would replace it.
+     */
+    readonly rdsBackupRetentionDays: number;
+    /**
+     * Service-side delete guards on the resources CloudFormation would refuse
+     * to delete while they are on: DynamoDB `DeletionProtectionEnabled` and
+     * the ELBv2 `deletion_protection.enabled` attribute (the load balancer
+     * guard additionally applies only in the production environment — a
+     * dev/staging stack is destroyed daily by design). RDS deletion
+     * protection is NOT tier-owned: the database constructs default it ON at
+     * every tier. The destroy pre-flight
+     * (`deploy-core/src/orchestration/application/destroyPreFlight.ts`)
+     * switches every guard off before a consented destroy, so a tier that
+     * turns one on never wedges `fjall destroy` or a CI destroy action.
+     */
+    readonly deletionProtection: boolean;
+    /**
+     * Encrypt with the stack's shared customer-managed KMS key instead of the
+     * AWS-managed default: DynamoDB tables, SNS topics, Lambda environment
+     * variables, ECS Exec session logging, and the CloudWatch log groups the
+     * tier-aware constructs create. ECR, RDS/Aurora storage and Secrets
+     * Manager keep their own knobs (each is a create-time or replacement
+     * property; flipping it from a tier would replace live data).
+     */
+    readonly customerManagedKeys: boolean;
+    /** ECS Container Insights (enhanced observability) on the cluster. */
+    readonly containerInsights: boolean;
+    /**
+     * Application load balancer access logs, delivered to the stack's
+     * lifecycle-expired access-log bucket.
+     */
+    readonly albAccessLogs: boolean;
+    /** CloudFront standard (legacy) logging to the same access-log bucket. */
+    readonly cloudFrontLogging: boolean;
+    /** Lambda active X-Ray tracing. */
+    readonly lambdaTracing: boolean;
+    /**
+     * RDS Database Insights mode when the construct has no explicit
+     * `databaseInsights.mode`; `advanced` carries 15 months of Performance
+     * Insights retention.
+     */
+    readonly databaseInsightsMode: "standard" | "advanced";
+}
+/**
+ * The tier table. `standard` is also the column an app with no tier (or
+ * `backup: false`) runs — declaring `standard` adds the DR tag and changes
+ * no default — so the untiered column is this one, not a fourth row.
+ */
+export declare const BACKUP_TIER_DEFAULTS: Readonly<Record<BackupTier, BackupTierDefaults>>;
+/**
+ * The tier-owned default for one knob. An undefined tier (no `backup` on the
+ * App, or `backup: false`) reads the `standard` column.
+ */
+export declare function tierDefault<K extends keyof BackupTierDefaults>(tier: BackupTier | undefined, knob: K): BackupTierDefaults[K];

package/dist/backupTiers.js

@@ -0,0 +1 @@
+var n=Object.defineProperty;var s=(e,t)=>n(e,"name",{value:t,configurable:!0});import{z as r}from"zod";const a=["standard","resilient","enterprise"],l=r.enum(a),o=new Set(a);function u(e){return o.has(e)}s(u,"isBackupTier");const i=Object.freeze({standard:Object.freeze({s3Versioned:!1,rdsBackupRetentionDays:14,deletionProtection:!1,customerManagedKeys:!1,containerInsights:!1,albAccessLogs:!1,cloudFrontLogging:!1,lambdaTracing:!1,databaseInsightsMode:"standard"}),resilient:Object.freeze({s3Versioned:!0,rdsBackupRetentionDays:30,deletionProtection:!0,customerManagedKeys:!1,containerInsights:!1,albAccessLogs:!1,cloudFrontLogging:!1,lambdaTracing:!1,databaseInsightsMode:"standard"}),enterprise:Object.freeze({s3Versioned:!0,rdsBackupRetentionDays:35,deletionProtection:!0,customerManagedKeys:!0,containerInsights:!0,albAccessLogs:!0,cloudFrontLogging:!0,lambdaTracing:!0,databaseInsightsMode:"advanced"})});function g(e,t){return i[e??"standard"][t]}s(g,"tierDefault");export{a as BACKUP_TIERS,i as BACKUP_TIER_DEFAULTS,l as BackupTierSchema,u as isBackupTier,g as tierDefault};

package/dist/capacityIdentity.d.ts

@@ -1,8 +1,8 @@
 import { z } from "zod";
 /**
  * Stable capacity identity — the shared vocabulary for capacity SLOTS and
- * their identity ANCHORS (design
- * `aiDocs/designs/2026-08-01-stable-capacity-identity-and-rename-safe-deploys.md`).
+ * their identity ANCHORS (the 2026-08-01 stable capacity identity and
+ * rename-safe deploys design).
  *
  * A capacity slot is the operator-chosen, config-independent name for one EC2
  * auto-scaling group within a cluster ("primary", "clickhouse-data"). Its

package/dist/docker/cacheRepository.d.ts

@@ -23,7 +23,7 @@ export type BuildCacheMode = (typeof BUILD_CACHE_MODES)[number];
  * reads any existing cache). Escape hatch for slow uplinks where the
  * dep-bump double upload (image push + mode=max export) is not worth the
  * cross-machine reuse — trade-off recorded in
- * aiDocs/decisions/2026-07-17-buildx-cache-export-mode.md.
+ * the 2026-07-17 decision: buildx cache export mode.
  *
  * Fails (rather than falling back) on an empty or unrecognised value.
  */

package/dist/failure/deploymentFailure.d.ts

@@ -2,7 +2,7 @@
  * Canonical deployment-failure record — the single structured shape every
  * producer (the deploy-core classifier, the webapp worker's platform-side
  * shim) and every consumer (webapp UI, CLI renderers, notifications, AI
- * surfaces) share. Design: aiDocs/designs/2026-08-10-deployment-failure-taxonomy.md § 3.
+ * surfaces) share. Design: the 2026-08-10 deployment-failure taxonomy design, § 3.
  *
  * Pitfall guards encoded (mirroring docker/dockerCliSchemas.ts):
  *   - Pitfall 1/6: every exported schema pairs a `z.infer` companion type

package/dist/index.d.ts

@@ -14,6 +14,7 @@ export { DANGEROUS_ENV_VARS, filterDangerousEnvVars, MASKED_VALUE_MARKER, maskSe
 export { sleep } from "./async/sleep.js";
 export { mapSettledWithConcurrency } from "./async/concurrency.js";
 export { ACCOUNT_STAGES_WITH_ROOT, STRUCTURAL_ENVIRONMENTS, ACCOUNT_STAGES, ACCOUNT_STAGE_LABELS, isAccountStage, ACCOUNT_TIERS, type AccountTier, AccountTierSchema, isAccountTier, GOVERNANCE_ACCOUNT_TIERS, isGovernanceTier, environmentToTier, type AccountStageEffect, accountStageEffect, ACCOUNT_STAGE_EFFECTS, formatAccountStageList, stageFromWireEnvironment, accountTier, resolveSynthEnvironment, type AccountStageWithRoot, type AccountStage, getEnvironmentLabel, ACCOUNT_ROLES } from "./environments.js";
+export { BACKUP_TIERS, BACKUP_TIER_DEFAULTS, type BackupTier, type BackupTierDefaults, BackupTierSchema, isBackupTier, tierDefault } from "./backupTiers.js";
 export { RESOURCE_CATEGORIES, type ResourceCategory, categoriseResource, getExpectedDuration, getFriendlyResourceType } from "./resourceCategorisation.js";
 export { parseGitRemoteUrl, type GitProvider, type ParsedGitRemote } from "./repo/gitRemoteParser.js";
 export { abbreviateRegion, AWS_REGIONS_METADATA, DEFAULT_REGION, getRegionInfo, MAX_SECONDARY_REGIONS, OPT_IN_REGION_CODES, optInRegionWarning, regions, RETIRED_REGION_ABBREVIATIONS, suggestRegionForTimezone, type RegionCode, type RegionInfo } from "./infra/regions.js";

package/dist/index.js

@@ -1 +1 @@
-import{DNS_APEX as _,getDomainExportNames as r,getDomainStackName as T,getDomainUsEast1CertificatesStackName as A,hostsExportPartName as S,serialiseHostsChunks as t,HOSTS_OUTPUT_MAX_BYTES as o,isManagedDomainBinding as a,DOMAIN_DEPLOY_DEFAULT_PHASE as N}from"./infra/domainExports.js";import{BACKUP_VAULT_NAME as I}from"./infra/backupVault.js";import{APPROVAL_TOKEN_OUTPUT_PREFIX as C,TOKEN_STDERR_PREFIX as i}from"./deploy/approvalTokenOutput.js";import{imageTagParameterName as m}from"./infra/imageTags.js";import{toPascalCase as L,toKebab as s,toValidDatabaseName as D,toScreamingSnake as p,capitalise as M,getSafeZoneName as c,accountConstructKey as f,hasAsciiStableConstructKey as F}from"./naming/caseConversion.js";import{albDnsExportName as l,albHostedZoneIdExportName as u,cdnDomainExportName as x,bucketWebsiteEndpointExportName as G,bucketWebsiteHostedZoneIdExportName as d}from"./naming/targetExportNames.js";import{CAPACITY_SLOT_PATTERN as h,CAPACITY_SLOT_MAX_LENGTH as H,DEFAULT_CAPACITY_SLOT as V,CAPACITY_ANCHOR_PATTERN as Y,CAPACITY_ANCHOR_MAX_LENGTH as y,CAPACITY_IDENTITY_CONTEXT_KEY as K,CapacityIdentityPinSchema as v,CapacityIdentityWireSchema as X,CapacityIdentityConfigSchema as b,projectCapacityIdentityToTarget as B}from"./capacityIdentity.js";import{findAccountNameCollision as J}from"./naming/accountNameCollision.js";import{defaultConnectedAccountName as j,suffixedAccountName as w,REGION_SHORT_CODES as Z,findTrailingRegionShortCode as q,regionSuffixRejectionMessage as z}from"./naming/connectedAccountName.js";import{normaliseError as $,getErrorMessage as ee,hasErrorCode as Ee,getErrorCode as _e,getErrorStack as re,formatErrorString as Te}from"./errorUtils.js";import{FJALL_CONFIG_DIR_ENV as Se,FJALL_CREDENTIALS_FILENAME as te,FJALL_HOME_DIRNAME as oe,FJALL_LOG_DIR_ENV as ae,fjallCredentialsPath as Ne,fjallHomeDir as Re,fjallLogDir as Ie,fjallStatePath as Oe}from"./fjallHome.js";import{singleton as ie}from"./async/singleton.js";import{DANGEROUS_ENV_VARS as me,filterDangerousEnvVars as Pe,MASKED_VALUE_MARKER as Le,maskSensitiveOutput as se,parseShellArgs as De,REDACTED_KEY_SENTINEL as pe,SCOPED_TOKEN_REGEX as Me}from"./securityHelpers.js";import{sleep as fe}from"./async/sleep.js";import{mapSettledWithConcurrency as Ue}from"./async/concurrency.js";import{ACCOUNT_STAGES_WITH_ROOT as ue,STRUCTURAL_ENVIRONMENTS as xe,ACCOUNT_STAGES as Ge,ACCOUNT_STAGE_LABELS as de,isAccountStage as ge,ACCOUNT_TIERS as he,AccountTierSchema as He,isAccountTier as Ve,GOVERNANCE_ACCOUNT_TIERS as Ye,isGovernanceTier as ye,environmentToTier as Ke,accountStageEffect as ve,ACCOUNT_STAGE_EFFECTS as Xe,formatAccountStageList as be,stageFromWireEnvironment as Be,accountTier as We,resolveSynthEnvironment as Je,getEnvironmentLabel as ke,ACCOUNT_ROLES as je}from"./environments.js";import{RESOURCE_CATEGORIES as Ze,categoriseResource as qe,getExpectedDuration as ze,getFriendlyResourceType as Qe}from"./resourceCategorisation.js";import{parseGitRemoteUrl as eE}from"./repo/gitRemoteParser.js";import{abbreviateRegion as _E,AWS_REGIONS_METADATA as rE,DEFAULT_REGION as TE,getRegionInfo as AE,MAX_SECONDARY_REGIONS as SE,OPT_IN_REGION_CODES as tE,optInRegionWarning as oE,regions as aE,RETIRED_REGION_ABBREVIATIONS as NE,suggestRegionForTimezone as RE}from"./infra/regions.js";import{SCOPE_VALUES as OE,MACHINE_ONLY_SCOPES as CE,USER_GRANTABLE_SCOPES as iE,GOVERNANCE_SCOPE_REQUIRED_CODE as nE}from"./infra/tokenScopes.js";import{SECRET_NAME_PATTERN as PE,SECRET_NAME_ERROR as LE,SSM_COMPONENT_PATTERN as sE,SSM_COMPONENT_ERROR as DE,SSM_STANDARD_MAX_VALUE_BYTES as pE,SecretNamespaceSchema as ME,buildNamespaceParts as cE,buildParameterPath as fE,parseParameterPath as FE,isManageablePath as UE,parseDotEnv as lE,escapeDotEnvValue as uE}from"./secrets.js";import{ConnectionWireSchema as GE,ConnectionsListResponseSchema as dE,CONNECTION_PHASES as gE,CONNECTION_TERMINAL_FAILURE_PHASES as hE,CONNECTION_FAILURE_REASONS as HE,EXTERNAL_ID_PATTERN as VE}from"./infra/connectionsWire.js";import{COMPLIANCE_ISSUE_STATUSES as yE,isComplianceIssueStatus as KE}from"./complianceIssue.js";import{PUBLIC_PACKAGE_NAME as XE,INSTALL_SOURCES as bE,SETUP_COMMANDS as BE,upgradeCommand as WE,SETUP_MODES as JE,SETUP_STEP_IDS as kE,SETUP_STEPS as jE,AGENT_SETUP_PROMPTS as wE,AGENT_INSTALL_COMMAND as ZE,SKILL_INSTALL_SEGMENTS as qE,SKILL_INSTALL_FILENAME as zE,SKILL_INSTALL_PATH as QE}from"./onboarding/index.js";import{deriveRegionsFromOrgConfig as e_,deriveTargets as E_,deriveAllTargets as __,environmentOrTier as r_,explainRetiredTargetName as T_,findTarget as A_,generateTargetName as S_}from"./targets.js";import{buildAppConfigPath as o_}from"./repo/appPath.js";import{findInfrastructurePaths as N_,findBoundaryPath as R_,isInfrastructureFile as I_}from"./repo/findInfrastructurePaths.js";import{inferContainerFromCandidates as C_}from"./repo/inferContainerFromCandidates.js";import{RESERVED_APP_NAMES as n_,RESERVED_APP_NAME_MESSAGE as m_,isReservedAppName as P_,RESERVED_APP_NAME_SUFFIX as L_,RESERVED_APP_NAME_SUFFIX_MESSAGE as s_,hasReservedAppNameSuffix as D_}from"./naming/reservedAppNames.js";import{deriveContentHashTag as M_,CONTENT_HASH_TAG_PATTERN as c_}from"./infra/deriveContentHashTag.js";import{DEPLOY_MODES as F_,DeployModeSchema as U_,IMAGE_TAG_PATTERN as l_,ImageTagSchema as u_,ServiceArtefactSchema as x_,ServiceArtefactsSchema as G_,ARTEFACT_OUTPUT_FIELDS as d_,artefactOutputKey as g_}from"./infra/deployArtefacts.js";import{MIGRATION_SNAPSHOT_NAME_PREFIX as H_,MIGRATION_SNAPSHOT_RETENTION_DAYS_ENV as V_,MIGRATION_SNAPSHOT_KIND_TAG_KEY as Y_,MIGRATION_SNAPSHOT_KIND_PREMIGRATE as y_,EXPECTED_SCHEMA_VERSION_ENV as K_,EXPECTED_SCHEMA_VERSION_TOOL_ENV as v_,EXPECTED_CH_SCHEMA_VERSION_ENV as X_,SCHEMA_ADMIN_USER_ENV as b_,SCHEMA_ADMIN_PASSWORD_ENV as B_,PRISMA_MIGRATION_DIR_RE as W_,CLICKHOUSE_MIGRATION_SKIP_RE as J_}from"./migration/constants.js";import{SCHEMA_GATE_EXIT as j_,SCHEMA_GATE_EXIT_HINTS as w_,schemaGateExitKind as Z_}from"./migration/schemaGateExit.js";import{FJALL_SCHEMA_GATE_USER as z_,FJALL_MAINTENANCE_USER as Q_,FJALL_CLICKHOUSE_USERS as $_}from"./migration/clickhouseFrameworkUsers.js";import{PHYSICAL_NAME_FALLBACK_PROPERTIES as Er}from"./cfn/physicalNameProperties.js";import{PATTERN_TYPE_VALUES as rr,PATTERN_TYPES as Tr,isPatternType as Ar,PATTERN_REGISTRY as Sr,patternConstructId as tr,DEPLOYABLE_PATTERN_TYPES as or,OPENNEXT_PATTERN_TYPES as ar,isOpenNextPatternType as Nr,CLOUDFRONT_PRICE_CLASS_VALUES as Rr,STATIC_SITE_CONFIG_KEYS as Ir,STATIC_SITE_DEPLOY_INJECTED_KEYS as Or,STATIC_SITE_CDN_CONFIG_KEYS as Cr,STATIC_SITE_ROUTING_VALUES as ir,STATIC_SITE_ROUTING_INFO as nr,PATTERN_CREATE_INPUT_VALUES as mr,PATTERN_CREATE_INPUT_FLAGS as Pr}from"./patterns/patternTypes.js";import{FRAMEWORK_VALUES as sr,FRAMEWORKS as Dr,isFramework as pr,FRAMEWORK_PATTERN_RECOMMENDATIONS as Mr,recommendPatternForFramework as cr,CREATABLE_FRAMEWORKS as fr,requiredInputsForFramework as Fr}from"./patterns/frameworkPatterns.js";import{DEFAULT_FORMS_FROM_LOCAL_PART as lr,defaultFormsFromAddress as ur,defaultFormsCorsOrigin as xr,isAddressAtDomain as Gr}from"./patterns/staticSiteForms.js";import{DEV_SUBSTRATE_PARAMS_SCHEMA_VERSION as gr,DEV_SUBSTRATE_PARAMS_FILENAME as hr,DevSubstrateSynthPropsSchema as Hr,DevSubstrateParamsSchema as Vr}from"./devSubstrate/params.js";import{DEV_SUBSTRATE_ENTRYPOINT_SOURCE as yr}from"./devSubstrate/entrypoint.js";import{BLESSED_CDK_TOOLCHAIN as vr}from"./cdkToolchain.js";import{DEPLOYMENT_FAILURE_PHASES as br,DeploymentFailurePhaseSchema as Br,DEPLOYMENT_FAULT_ATTRIBUTIONS as Wr,DeploymentFaultAttributionSchema as Jr,DEPLOYMENT_FAILURE_PROVIDER_SOURCES as kr,DeploymentFailureProviderSourceSchema as jr,DEPLOYMENT_FAILURE_CODE_PATTERN as wr,DEPLOYMENT_FAILURE_SCHEMA_VERSION as Zr,DEPLOYMENT_FAILURE_LIMITS as qr,DeploymentFailureAnalysisSchema as zr,DeploymentFailureProviderSchema as Qr,DeploymentFailureResourceSchema as $r,DeploymentFailureSchema as eT,parseDeploymentFailure as ET,DEPLOYMENT_FAILURE_DOCS_BASE_URL as _T,deploymentFailureDocsUrl as rT,DEPLOYMENT_FAULT_COPY as TT,DEPLOYMENT_PROVIDER_LABELS as AT,deriveErrorMessageFromFailure as ST,toDeploymentFailureAnalysis as tT}from"./failure/deploymentFailure.js";import{extractErrorWindow as aT,ERROR_WINDOW_CONTEXT_LINES as NT}from"./failure/extractErrorWindow.js";import{FJALL_COMPONENT_GITIGNORE as IT,FJALL_PROJECT_GITIGNORE as OT,FJALL_STATE_GITIGNORE_ENTRIES as CT,FJALL_MANAGED_STATE_DIR_ENTRIES as iT,LOCAL_CONFIG_GITIGNORE_ENTRY as nT}from"./scaffold/gitignore.js";import{ensureGitignoreEntries as PT}from"./scaffold/ensureGitignore.js";export{je as ACCOUNT_ROLES,Ge as ACCOUNT_STAGES,ue as ACCOUNT_STAGES_WITH_ROOT,Xe as ACCOUNT_STAGE_EFFECTS,de as ACCOUNT_STAGE_LABELS,he as ACCOUNT_TIERS,ZE as AGENT_INSTALL_COMMAND,wE as AGENT_SETUP_PROMPTS,C as APPROVAL_TOKEN_OUTPUT_PREFIX,d_ as ARTEFACT_OUTPUT_FIELDS,rE as AWS_REGIONS_METADATA,He as AccountTierSchema,I as BACKUP_VAULT_NAME,vr as BLESSED_CDK_TOOLCHAIN,y as CAPACITY_ANCHOR_MAX_LENGTH,Y as CAPACITY_ANCHOR_PATTERN,K as CAPACITY_IDENTITY_CONTEXT_KEY,H as CAPACITY_SLOT_MAX_LENGTH,h as CAPACITY_SLOT_PATTERN,J_ as CLICKHOUSE_MIGRATION_SKIP_RE,Rr as CLOUDFRONT_PRICE_CLASS_VALUES,yE as COMPLIANCE_ISSUE_STATUSES,HE as CONNECTION_FAILURE_REASONS,gE as CONNECTION_PHASES,hE as CONNECTION_TERMINAL_FAILURE_PHASES,c_ as CONTENT_HASH_TAG_PATTERN,fr as CREATABLE_FRAMEWORKS,b as CapacityIdentityConfigSchema,v as CapacityIdentityPinSchema,X as CapacityIdentityWireSchema,GE as ConnectionWireSchema,dE as ConnectionsListResponseSchema,me as DANGEROUS_ENV_VARS,V as DEFAULT_CAPACITY_SLOT,lr as DEFAULT_FORMS_FROM_LOCAL_PART,TE as DEFAULT_REGION,or as DEPLOYABLE_PATTERN_TYPES,wr as DEPLOYMENT_FAILURE_CODE_PATTERN,_T as DEPLOYMENT_FAILURE_DOCS_BASE_URL,qr as DEPLOYMENT_FAILURE_LIMITS,br as DEPLOYMENT_FAILURE_PHASES,kr as DEPLOYMENT_FAILURE_PROVIDER_SOURCES,Zr as DEPLOYMENT_FAILURE_SCHEMA_VERSION,Wr as DEPLOYMENT_FAULT_ATTRIBUTIONS,TT as DEPLOYMENT_FAULT_COPY,AT as DEPLOYMENT_PROVIDER_LABELS,F_ as DEPLOY_MODES,yr as DEV_SUBSTRATE_ENTRYPOINT_SOURCE,hr as DEV_SUBSTRATE_PARAMS_FILENAME,gr as DEV_SUBSTRATE_PARAMS_SCHEMA_VERSION,_ as DNS_APEX,N as DOMAIN_DEPLOY_DEFAULT_PHASE,U_ as DeployModeSchema,zr as DeploymentFailureAnalysisSchema,Br as DeploymentFailurePhaseSchema,Qr as DeploymentFailureProviderSchema,jr as DeploymentFailureProviderSourceSchema,$r as DeploymentFailureResourceSchema,eT as DeploymentFailureSchema,Jr as DeploymentFaultAttributionSchema,Vr as DevSubstrateParamsSchema,Hr as DevSubstrateSynthPropsSchema,NT as ERROR_WINDOW_CONTEXT_LINES,X_ as EXPECTED_CH_SCHEMA_VERSION_ENV,K_ as EXPECTED_SCHEMA_VERSION_ENV,v_ as EXPECTED_SCHEMA_VERSION_TOOL_ENV,VE as EXTERNAL_ID_PATTERN,$_ as FJALL_CLICKHOUSE_USERS,IT as FJALL_COMPONENT_GITIGNORE,Se as FJALL_CONFIG_DIR_ENV,te as FJALL_CREDENTIALS_FILENAME,oe as FJALL_HOME_DIRNAME,ae as FJALL_LOG_DIR_ENV,Q_ as FJALL_MAINTENANCE_USER,iT as FJALL_MANAGED_STATE_DIR_ENTRIES,OT as FJALL_PROJECT_GITIGNORE,z_ as FJALL_SCHEMA_GATE_USER,CT as FJALL_STATE_GITIGNORE_ENTRIES,Dr as FRAMEWORKS,Mr as FRAMEWORK_PATTERN_RECOMMENDATIONS,sr as FRAMEWORK_VALUES,Ye as GOVERNANCE_ACCOUNT_TIERS,nE as GOVERNANCE_SCOPE_REQUIRED_CODE,o as HOSTS_OUTPUT_MAX_BYTES,l_ as IMAGE_TAG_PATTERN,bE as INSTALL_SOURCES,u_ as ImageTagSchema,nT as LOCAL_CONFIG_GITIGNORE_ENTRY,CE as MACHINE_ONLY_SCOPES,Le as MASKED_VALUE_MARKER,SE as MAX_SECONDARY_REGIONS,y_ as MIGRATION_SNAPSHOT_KIND_PREMIGRATE,Y_ as MIGRATION_SNAPSHOT_KIND_TAG_KEY,H_ as MIGRATION_SNAPSHOT_NAME_PREFIX,V_ as MIGRATION_SNAPSHOT_RETENTION_DAYS_ENV,ar as OPENNEXT_PATTERN_TYPES,tE as OPT_IN_REGION_CODES,Pr as PATTERN_CREATE_INPUT_FLAGS,mr as PATTERN_CREATE_INPUT_VALUES,Sr as PATTERN_REGISTRY,Tr as PATTERN_TYPES,rr as PATTERN_TYPE_VALUES,Er as PHYSICAL_NAME_FALLBACK_PROPERTIES,W_ as PRISMA_MIGRATION_DIR_RE,XE as PUBLIC_PACKAGE_NAME,pe as REDACTED_KEY_SENTINEL,Z as REGION_SHORT_CODES,n_ as RESERVED_APP_NAMES,m_ as RESERVED_APP_NAME_MESSAGE,L_ as RESERVED_APP_NAME_SUFFIX,s_ as RESERVED_APP_NAME_SUFFIX_MESSAGE,Ze as RESOURCE_CATEGORIES,NE as RETIRED_REGION_ABBREVIATIONS,B_ as SCHEMA_ADMIN_PASSWORD_ENV,b_ as SCHEMA_ADMIN_USER_ENV,j_ as SCHEMA_GATE_EXIT,w_ as SCHEMA_GATE_EXIT_HINTS,Me as SCOPED_TOKEN_REGEX,OE as SCOPE_VALUES,LE as SECRET_NAME_ERROR,PE as SECRET_NAME_PATTERN,BE as SETUP_COMMANDS,JE as SETUP_MODES,jE as SETUP_STEPS,kE as SETUP_STEP_IDS,zE as SKILL_INSTALL_FILENAME,QE as SKILL_INSTALL_PATH,qE as SKILL_INSTALL_SEGMENTS,DE as SSM_COMPONENT_ERROR,sE as SSM_COMPONENT_PATTERN,pE as SSM_STANDARD_MAX_VALUE_BYTES,Cr as STATIC_SITE_CDN_CONFIG_KEYS,Ir as STATIC_SITE_CONFIG_KEYS,Or as STATIC_SITE_DEPLOY_INJECTED_KEYS,nr as STATIC_SITE_ROUTING_INFO,ir as STATIC_SITE_ROUTING_VALUES,xe as STRUCTURAL_ENVIRONMENTS,ME as SecretNamespaceSchema,x_ as ServiceArtefactSchema,G_ as ServiceArtefactsSchema,i as TOKEN_STDERR_PREFIX,iE as USER_GRANTABLE_SCOPES,_E as abbreviateRegion,f as accountConstructKey,ve as accountStageEffect,We as accountTier,l as albDnsExportName,u as albHostedZoneIdExportName,g_ as artefactOutputKey,G as bucketWebsiteEndpointExportName,d as bucketWebsiteHostedZoneIdExportName,o_ as buildAppConfigPath,cE as buildNamespaceParts,fE as buildParameterPath,M as capitalise,qe as categoriseResource,x as cdnDomainExportName,j as defaultConnectedAccountName,xr as defaultFormsCorsOrigin,ur as defaultFormsFromAddress,rT as deploymentFailureDocsUrl,__ as deriveAllTargets,M_ as deriveContentHashTag,ST as deriveErrorMessageFromFailure,e_ as deriveRegionsFromOrgConfig,E_ as deriveTargets,PT as ensureGitignoreEntries,r_ as environmentOrTier,Ke as environmentToTier,uE as escapeDotEnvValue,T_ as explainRetiredTargetName,aT as extractErrorWindow,Pe as filterDangerousEnvVars,J as findAccountNameCollision,R_ as findBoundaryPath,N_ as findInfrastructurePaths,A_ as findTarget,q as findTrailingRegionShortCode,Ne as fjallCredentialsPath,Re as fjallHomeDir,Ie as fjallLogDir,Oe as fjallStatePath,be as formatAccountStageList,Te as formatErrorString,S_ as generateTargetName,r as getDomainExportNames,T as getDomainStackName,A as getDomainUsEast1CertificatesStackName,ke as getEnvironmentLabel,_e as getErrorCode,ee as getErrorMessage,re as getErrorStack,ze as getExpectedDuration,Qe as getFriendlyResourceType,AE as getRegionInfo,c as getSafeZoneName,F as hasAsciiStableConstructKey,Ee as hasErrorCode,D_ as hasReservedAppNameSuffix,S as hostsExportPartName,m as imageTagParameterName,C_ as inferContainerFromCandidates,ge as isAccountStage,Ve as isAccountTier,Gr as isAddressAtDomain,KE as isComplianceIssueStatus,pr as isFramework,ye as isGovernanceTier,I_ as isInfrastructureFile,UE as isManageablePath,a as isManagedDomainBinding,Nr as isOpenNextPatternType,Ar as isPatternType,P_ as isReservedAppName,Ue as mapSettledWithConcurrency,se as maskSensitiveOutput,$ as normaliseError,oE as optInRegionWarning,ET as parseDeploymentFailure,lE as parseDotEnv,eE as parseGitRemoteUrl,FE as parseParameterPath,De as parseShellArgs,tr as patternConstructId,B as projectCapacityIdentityToTarget,cr as recommendPatternForFramework,z as regionSuffixRejectionMessage,aE as regions,Fr as requiredInputsForFramework,Je as resolveSynthEnvironment,Z_ as schemaGateExitKind,t as serialiseHostsChunks,ie as singleton,fe as sleep,Be as stageFromWireEnvironment,w as suffixedAccountName,RE as suggestRegionForTimezone,tT as toDeploymentFailureAnalysis,s as toKebab,L as toPascalCase,p as toScreamingSnake,D as toValidDatabaseName,WE as upgradeCommand};
+import{DNS_APEX as _,getDomainExportNames as r,getDomainStackName as T,getDomainUsEast1CertificatesStackName as A,hostsExportPartName as S,serialiseHostsChunks as t,HOSTS_OUTPUT_MAX_BYTES as o,isManagedDomainBinding as a,DOMAIN_DEPLOY_DEFAULT_PHASE as N}from"./infra/domainExports.js";import{BACKUP_VAULT_NAME as I}from"./infra/backupVault.js";import{APPROVAL_TOKEN_OUTPUT_PREFIX as i,TOKEN_STDERR_PREFIX as C}from"./deploy/approvalTokenOutput.js";import{imageTagParameterName as m}from"./infra/imageTags.js";import{toPascalCase as L,toKebab as s,toValidDatabaseName as D,toScreamingSnake as p,capitalise as M,getSafeZoneName as c,accountConstructKey as f,hasAsciiStableConstructKey as F}from"./naming/caseConversion.js";import{albDnsExportName as l,albHostedZoneIdExportName as u,cdnDomainExportName as x,bucketWebsiteEndpointExportName as G,bucketWebsiteHostedZoneIdExportName as d}from"./naming/targetExportNames.js";import{CAPACITY_SLOT_PATTERN as h,CAPACITY_SLOT_MAX_LENGTH as H,DEFAULT_CAPACITY_SLOT as V,CAPACITY_ANCHOR_PATTERN as Y,CAPACITY_ANCHOR_MAX_LENGTH as K,CAPACITY_IDENTITY_CONTEXT_KEY as y,CapacityIdentityPinSchema as v,CapacityIdentityWireSchema as B,CapacityIdentityConfigSchema as X,projectCapacityIdentityToTarget as b}from"./capacityIdentity.js";import{findAccountNameCollision as k}from"./naming/accountNameCollision.js";import{defaultConnectedAccountName as j,suffixedAccountName as w,REGION_SHORT_CODES as Z,findTrailingRegionShortCode as q,regionSuffixRejectionMessage as z}from"./naming/connectedAccountName.js";import{normaliseError as $,getErrorMessage as ee,hasErrorCode as Ee,getErrorCode as _e,getErrorStack as re,formatErrorString as Te}from"./errorUtils.js";import{FJALL_CONFIG_DIR_ENV as Se,FJALL_CREDENTIALS_FILENAME as te,FJALL_HOME_DIRNAME as oe,FJALL_LOG_DIR_ENV as ae,fjallCredentialsPath as Ne,fjallHomeDir as Re,fjallLogDir as Ie,fjallStatePath as Oe}from"./fjallHome.js";import{singleton as Ce}from"./async/singleton.js";import{DANGEROUS_ENV_VARS as me,filterDangerousEnvVars as Pe,MASKED_VALUE_MARKER as Le,maskSensitiveOutput as se,parseShellArgs as De,REDACTED_KEY_SENTINEL as pe,SCOPED_TOKEN_REGEX as Me}from"./securityHelpers.js";import{sleep as fe}from"./async/sleep.js";import{mapSettledWithConcurrency as Ue}from"./async/concurrency.js";import{ACCOUNT_STAGES_WITH_ROOT as ue,STRUCTURAL_ENVIRONMENTS as xe,ACCOUNT_STAGES as Ge,ACCOUNT_STAGE_LABELS as de,isAccountStage as ge,ACCOUNT_TIERS as he,AccountTierSchema as He,isAccountTier as Ve,GOVERNANCE_ACCOUNT_TIERS as Ye,isGovernanceTier as Ke,environmentToTier as ye,accountStageEffect as ve,ACCOUNT_STAGE_EFFECTS as Be,formatAccountStageList as Xe,stageFromWireEnvironment as be,accountTier as We,resolveSynthEnvironment as ke,getEnvironmentLabel as Je,ACCOUNT_ROLES as je}from"./environments.js";import{BACKUP_TIERS as Ze,BACKUP_TIER_DEFAULTS as qe,BackupTierSchema as ze,isBackupTier as Qe,tierDefault as $e}from"./backupTiers.js";import{RESOURCE_CATEGORIES as EE,categoriseResource as _E,getExpectedDuration as rE,getFriendlyResourceType as TE}from"./resourceCategorisation.js";import{parseGitRemoteUrl as SE}from"./repo/gitRemoteParser.js";import{abbreviateRegion as oE,AWS_REGIONS_METADATA as aE,DEFAULT_REGION as NE,getRegionInfo as RE,MAX_SECONDARY_REGIONS as IE,OPT_IN_REGION_CODES as OE,optInRegionWarning as iE,regions as CE,RETIRED_REGION_ABBREVIATIONS as nE,suggestRegionForTimezone as mE}from"./infra/regions.js";import{SCOPE_VALUES as LE,MACHINE_ONLY_SCOPES as sE,USER_GRANTABLE_SCOPES as DE,GOVERNANCE_SCOPE_REQUIRED_CODE as pE}from"./infra/tokenScopes.js";import{SECRET_NAME_PATTERN as cE,SECRET_NAME_ERROR as fE,SSM_COMPONENT_PATTERN as FE,SSM_COMPONENT_ERROR as UE,SSM_STANDARD_MAX_VALUE_BYTES as lE,SecretNamespaceSchema as uE,buildNamespaceParts as xE,buildParameterPath as GE,parseParameterPath as dE,isManageablePath as gE,parseDotEnv as hE,escapeDotEnvValue as HE}from"./secrets.js";import{ConnectionWireSchema as YE,ConnectionsListResponseSchema as KE,CONNECTION_PHASES as yE,CONNECTION_TERMINAL_FAILURE_PHASES as vE,CONNECTION_FAILURE_REASONS as BE,EXTERNAL_ID_PATTERN as XE}from"./infra/connectionsWire.js";import{COMPLIANCE_ISSUE_STATUSES as WE,isComplianceIssueStatus as kE}from"./complianceIssue.js";import{PUBLIC_PACKAGE_NAME as jE,INSTALL_SOURCES as wE,SETUP_COMMANDS as ZE,upgradeCommand as qE,SETUP_MODES as zE,SETUP_STEP_IDS as QE,SETUP_STEPS as $E,AGENT_SETUP_PROMPTS as e_,AGENT_INSTALL_COMMAND as E_,SKILL_INSTALL_SEGMENTS as __,SKILL_INSTALL_FILENAME as r_,SKILL_INSTALL_PATH as T_}from"./onboarding/index.js";import{deriveRegionsFromOrgConfig as S_,deriveTargets as t_,deriveAllTargets as o_,environmentOrTier as a_,explainRetiredTargetName as N_,findTarget as R_,generateTargetName as I_}from"./targets.js";import{buildAppConfigPath as i_}from"./repo/appPath.js";import{findInfrastructurePaths as n_,findBoundaryPath as m_,isInfrastructureFile as P_}from"./repo/findInfrastructurePaths.js";import{inferContainerFromCandidates as s_}from"./repo/inferContainerFromCandidates.js";import{RESERVED_APP_NAMES as p_,RESERVED_APP_NAME_MESSAGE as M_,isReservedAppName as c_,RESERVED_APP_NAME_SUFFIX as f_,RESERVED_APP_NAME_SUFFIX_MESSAGE as F_,hasReservedAppNameSuffix as U_}from"./naming/reservedAppNames.js";import{deriveContentHashTag as u_,CONTENT_HASH_TAG_PATTERN as x_}from"./infra/deriveContentHashTag.js";import{DEPLOY_MODES as d_,DeployModeSchema as g_,IMAGE_TAG_PATTERN as h_,ImageTagSchema as H_,ServiceArtefactSchema as V_,ServiceArtefactsSchema as Y_,ARTEFACT_OUTPUT_FIELDS as K_,artefactOutputKey as y_}from"./infra/deployArtefacts.js";import{MIGRATION_SNAPSHOT_NAME_PREFIX as B_,MIGRATION_SNAPSHOT_RETENTION_DAYS_ENV as X_,MIGRATION_SNAPSHOT_KIND_TAG_KEY as b_,MIGRATION_SNAPSHOT_KIND_PREMIGRATE as W_,EXPECTED_SCHEMA_VERSION_ENV as k_,EXPECTED_SCHEMA_VERSION_TOOL_ENV as J_,EXPECTED_CH_SCHEMA_VERSION_ENV as j_,SCHEMA_ADMIN_USER_ENV as w_,SCHEMA_ADMIN_PASSWORD_ENV as Z_,PRISMA_MIGRATION_DIR_RE as q_,CLICKHOUSE_MIGRATION_SKIP_RE as z_}from"./migration/constants.js";import{SCHEMA_GATE_EXIT as $_,SCHEMA_GATE_EXIT_HINTS as er,schemaGateExitKind as Er}from"./migration/schemaGateExit.js";import{FJALL_SCHEMA_GATE_USER as rr,FJALL_MAINTENANCE_USER as Tr,FJALL_CLICKHOUSE_USERS as Ar}from"./migration/clickhouseFrameworkUsers.js";import{PHYSICAL_NAME_FALLBACK_PROPERTIES as tr}from"./cfn/physicalNameProperties.js";import{PATTERN_TYPE_VALUES as ar,PATTERN_TYPES as Nr,isPatternType as Rr,PATTERN_REGISTRY as Ir,patternConstructId as Or,DEPLOYABLE_PATTERN_TYPES as ir,OPENNEXT_PATTERN_TYPES as Cr,isOpenNextPatternType as nr,CLOUDFRONT_PRICE_CLASS_VALUES as mr,STATIC_SITE_CONFIG_KEYS as Pr,STATIC_SITE_DEPLOY_INJECTED_KEYS as Lr,STATIC_SITE_CDN_CONFIG_KEYS as sr,STATIC_SITE_ROUTING_VALUES as Dr,STATIC_SITE_ROUTING_INFO as pr,PATTERN_CREATE_INPUT_VALUES as Mr,PATTERN_CREATE_INPUT_FLAGS as cr}from"./patterns/patternTypes.js";import{FRAMEWORK_VALUES as Fr,FRAMEWORKS as Ur,isFramework as lr,FRAMEWORK_PATTERN_RECOMMENDATIONS as ur,recommendPatternForFramework as xr,CREATABLE_FRAMEWORKS as Gr,requiredInputsForFramework as dr}from"./patterns/frameworkPatterns.js";import{DEFAULT_FORMS_FROM_LOCAL_PART as hr,defaultFormsFromAddress as Hr,defaultFormsCorsOrigin as Vr,isAddressAtDomain as Yr}from"./patterns/staticSiteForms.js";import{DEV_SUBSTRATE_PARAMS_SCHEMA_VERSION as yr,DEV_SUBSTRATE_PARAMS_FILENAME as vr,DevSubstrateSynthPropsSchema as Br,DevSubstrateParamsSchema as Xr}from"./devSubstrate/params.js";import{DEV_SUBSTRATE_ENTRYPOINT_SOURCE as Wr}from"./devSubstrate/entrypoint.js";import{BLESSED_CDK_TOOLCHAIN as Jr}from"./cdkToolchain.js";import{DEPLOYMENT_FAILURE_PHASES as wr,DeploymentFailurePhaseSchema as Zr,DEPLOYMENT_FAULT_ATTRIBUTIONS as qr,DeploymentFaultAttributionSchema as zr,DEPLOYMENT_FAILURE_PROVIDER_SOURCES as Qr,DeploymentFailureProviderSourceSchema as $r,DEPLOYMENT_FAILURE_CODE_PATTERN as eT,DEPLOYMENT_FAILURE_SCHEMA_VERSION as ET,DEPLOYMENT_FAILURE_LIMITS as _T,DeploymentFailureAnalysisSchema as rT,DeploymentFailureProviderSchema as TT,DeploymentFailureResourceSchema as AT,DeploymentFailureSchema as ST,parseDeploymentFailure as tT,DEPLOYMENT_FAILURE_DOCS_BASE_URL as oT,deploymentFailureDocsUrl as aT,DEPLOYMENT_FAULT_COPY as NT,DEPLOYMENT_PROVIDER_LABELS as RT,deriveErrorMessageFromFailure as IT,toDeploymentFailureAnalysis as OT}from"./failure/deploymentFailure.js";import{extractErrorWindow as CT,ERROR_WINDOW_CONTEXT_LINES as nT}from"./failure/extractErrorWindow.js";import{FJALL_COMPONENT_GITIGNORE as PT,FJALL_PROJECT_GITIGNORE as LT,FJALL_STATE_GITIGNORE_ENTRIES as sT,FJALL_MANAGED_STATE_DIR_ENTRIES as DT,LOCAL_CONFIG_GITIGNORE_ENTRY as pT}from"./scaffold/gitignore.js";import{ensureGitignoreEntries as cT}from"./scaffold/ensureGitignore.js";export{je as ACCOUNT_ROLES,Ge as ACCOUNT_STAGES,ue as ACCOUNT_STAGES_WITH_ROOT,Be as ACCOUNT_STAGE_EFFECTS,de as ACCOUNT_STAGE_LABELS,he as ACCOUNT_TIERS,E_ as AGENT_INSTALL_COMMAND,e_ as AGENT_SETUP_PROMPTS,i as APPROVAL_TOKEN_OUTPUT_PREFIX,K_ as ARTEFACT_OUTPUT_FIELDS,aE as AWS_REGIONS_METADATA,He as AccountTierSchema,Ze as BACKUP_TIERS,qe as BACKUP_TIER_DEFAULTS,I as BACKUP_VAULT_NAME,Jr as BLESSED_CDK_TOOLCHAIN,ze as BackupTierSchema,K as CAPACITY_ANCHOR_MAX_LENGTH,Y as CAPACITY_ANCHOR_PATTERN,y as CAPACITY_IDENTITY_CONTEXT_KEY,H as CAPACITY_SLOT_MAX_LENGTH,h as CAPACITY_SLOT_PATTERN,z_ as CLICKHOUSE_MIGRATION_SKIP_RE,mr as CLOUDFRONT_PRICE_CLASS_VALUES,WE as COMPLIANCE_ISSUE_STATUSES,BE as CONNECTION_FAILURE_REASONS,yE as CONNECTION_PHASES,vE as CONNECTION_TERMINAL_FAILURE_PHASES,x_ as CONTENT_HASH_TAG_PATTERN,Gr as CREATABLE_FRAMEWORKS,X as CapacityIdentityConfigSchema,v as CapacityIdentityPinSchema,B as CapacityIdentityWireSchema,YE as ConnectionWireSchema,KE as ConnectionsListResponseSchema,me as DANGEROUS_ENV_VARS,V as DEFAULT_CAPACITY_SLOT,hr as DEFAULT_FORMS_FROM_LOCAL_PART,NE as DEFAULT_REGION,ir as DEPLOYABLE_PATTERN_TYPES,eT as DEPLOYMENT_FAILURE_CODE_PATTERN,oT as DEPLOYMENT_FAILURE_DOCS_BASE_URL,_T as DEPLOYMENT_FAILURE_LIMITS,wr as DEPLOYMENT_FAILURE_PHASES,Qr as DEPLOYMENT_FAILURE_PROVIDER_SOURCES,ET as DEPLOYMENT_FAILURE_SCHEMA_VERSION,qr as DEPLOYMENT_FAULT_ATTRIBUTIONS,NT as DEPLOYMENT_FAULT_COPY,RT as DEPLOYMENT_PROVIDER_LABELS,d_ as DEPLOY_MODES,Wr as DEV_SUBSTRATE_ENTRYPOINT_SOURCE,vr as DEV_SUBSTRATE_PARAMS_FILENAME,yr as DEV_SUBSTRATE_PARAMS_SCHEMA_VERSION,_ as DNS_APEX,N as DOMAIN_DEPLOY_DEFAULT_PHASE,g_ as DeployModeSchema,rT as DeploymentFailureAnalysisSchema,Zr as DeploymentFailurePhaseSchema,TT as DeploymentFailureProviderSchema,$r as DeploymentFailureProviderSourceSchema,AT as DeploymentFailureResourceSchema,ST as DeploymentFailureSchema,zr as DeploymentFaultAttributionSchema,Xr as DevSubstrateParamsSchema,Br as DevSubstrateSynthPropsSchema,nT as ERROR_WINDOW_CONTEXT_LINES,j_ as EXPECTED_CH_SCHEMA_VERSION_ENV,k_ as EXPECTED_SCHEMA_VERSION_ENV,J_ as EXPECTED_SCHEMA_VERSION_TOOL_ENV,XE as EXTERNAL_ID_PATTERN,Ar as FJALL_CLICKHOUSE_USERS,PT as FJALL_COMPONENT_GITIGNORE,Se as FJALL_CONFIG_DIR_ENV,te as FJALL_CREDENTIALS_FILENAME,oe as FJALL_HOME_DIRNAME,ae as FJALL_LOG_DIR_ENV,Tr as FJALL_MAINTENANCE_USER,DT as FJALL_MANAGED_STATE_DIR_ENTRIES,LT as FJALL_PROJECT_GITIGNORE,rr as FJALL_SCHEMA_GATE_USER,sT as FJALL_STATE_GITIGNORE_ENTRIES,Ur as FRAMEWORKS,ur as FRAMEWORK_PATTERN_RECOMMENDATIONS,Fr as FRAMEWORK_VALUES,Ye as GOVERNANCE_ACCOUNT_TIERS,pE as GOVERNANCE_SCOPE_REQUIRED_CODE,o as HOSTS_OUTPUT_MAX_BYTES,h_ as IMAGE_TAG_PATTERN,wE as INSTALL_SOURCES,H_ as ImageTagSchema,pT as LOCAL_CONFIG_GITIGNORE_ENTRY,sE as MACHINE_ONLY_SCOPES,Le as MASKED_VALUE_MARKER,IE as MAX_SECONDARY_REGIONS,W_ as MIGRATION_SNAPSHOT_KIND_PREMIGRATE,b_ as MIGRATION_SNAPSHOT_KIND_TAG_KEY,B_ as MIGRATION_SNAPSHOT_NAME_PREFIX,X_ as MIGRATION_SNAPSHOT_RETENTION_DAYS_ENV,Cr as OPENNEXT_PATTERN_TYPES,OE as OPT_IN_REGION_CODES,cr as PATTERN_CREATE_INPUT_FLAGS,Mr as PATTERN_CREATE_INPUT_VALUES,Ir as PATTERN_REGISTRY,Nr as PATTERN_TYPES,ar as PATTERN_TYPE_VALUES,tr as PHYSICAL_NAME_FALLBACK_PROPERTIES,q_ as PRISMA_MIGRATION_DIR_RE,jE as PUBLIC_PACKAGE_NAME,pe as REDACTED_KEY_SENTINEL,Z as REGION_SHORT_CODES,p_ as RESERVED_APP_NAMES,M_ as RESERVED_APP_NAME_MESSAGE,f_ as RESERVED_APP_NAME_SUFFIX,F_ as RESERVED_APP_NAME_SUFFIX_MESSAGE,EE as RESOURCE_CATEGORIES,nE as RETIRED_REGION_ABBREVIATIONS,Z_ as SCHEMA_ADMIN_PASSWORD_ENV,w_ as SCHEMA_ADMIN_USER_ENV,$_ as SCHEMA_GATE_EXIT,er as SCHEMA_GATE_EXIT_HINTS,Me as SCOPED_TOKEN_REGEX,LE as SCOPE_VALUES,fE as SECRET_NAME_ERROR,cE as SECRET_NAME_PATTERN,ZE as SETUP_COMMANDS,zE as SETUP_MODES,$E as SETUP_STEPS,QE as SETUP_STEP_IDS,r_ as SKILL_INSTALL_FILENAME,T_ as SKILL_INSTALL_PATH,__ as SKILL_INSTALL_SEGMENTS,UE as SSM_COMPONENT_ERROR,FE as SSM_COMPONENT_PATTERN,lE as SSM_STANDARD_MAX_VALUE_BYTES,sr as STATIC_SITE_CDN_CONFIG_KEYS,Pr as STATIC_SITE_CONFIG_KEYS,Lr as STATIC_SITE_DEPLOY_INJECTED_KEYS,pr as STATIC_SITE_ROUTING_INFO,Dr as STATIC_SITE_ROUTING_VALUES,xe as STRUCTURAL_ENVIRONMENTS,uE as SecretNamespaceSchema,V_ as ServiceArtefactSchema,Y_ as ServiceArtefactsSchema,C as TOKEN_STDERR_PREFIX,DE as USER_GRANTABLE_SCOPES,oE as abbreviateRegion,f as accountConstructKey,ve as accountStageEffect,We as accountTier,l as albDnsExportName,u as albHostedZoneIdExportName,y_ as artefactOutputKey,G as bucketWebsiteEndpointExportName,d as bucketWebsiteHostedZoneIdExportName,i_ as buildAppConfigPath,xE as buildNamespaceParts,GE as buildParameterPath,M as capitalise,_E as categoriseResource,x as cdnDomainExportName,j as defaultConnectedAccountName,Vr as defaultFormsCorsOrigin,Hr as defaultFormsFromAddress,aT as deploymentFailureDocsUrl,o_ as deriveAllTargets,u_ as deriveContentHashTag,IT as deriveErrorMessageFromFailure,S_ as deriveRegionsFromOrgConfig,t_ as deriveTargets,cT as ensureGitignoreEntries,a_ as environmentOrTier,ye as environmentToTier,HE as escapeDotEnvValue,N_ as explainRetiredTargetName,CT as extractErrorWindow,Pe as filterDangerousEnvVars,k as findAccountNameCollision,m_ as findBoundaryPath,n_ as findInfrastructurePaths,R_ as findTarget,q as findTrailingRegionShortCode,Ne as fjallCredentialsPath,Re as fjallHomeDir,Ie as fjallLogDir,Oe as fjallStatePath,Xe as formatAccountStageList,Te as formatErrorString,I_ as generateTargetName,r as getDomainExportNames,T as getDomainStackName,A as getDomainUsEast1CertificatesStackName,Je as getEnvironmentLabel,_e as getErrorCode,ee as getErrorMessage,re as getErrorStack,rE as getExpectedDuration,TE as getFriendlyResourceType,RE as getRegionInfo,c as getSafeZoneName,F as hasAsciiStableConstructKey,Ee as hasErrorCode,U_ as hasReservedAppNameSuffix,S as hostsExportPartName,m as imageTagParameterName,s_ as inferContainerFromCandidates,ge as isAccountStage,Ve as isAccountTier,Yr as isAddressAtDomain,Qe as isBackupTier,kE as isComplianceIssueStatus,lr as isFramework,Ke as isGovernanceTier,P_ as isInfrastructureFile,gE as isManageablePath,a as isManagedDomainBinding,nr as isOpenNextPatternType,Rr as isPatternType,c_ as isReservedAppName,Ue as mapSettledWithConcurrency,se as maskSensitiveOutput,$ as normaliseError,iE as optInRegionWarning,tT as parseDeploymentFailure,hE as parseDotEnv,SE as parseGitRemoteUrl,dE as parseParameterPath,De as parseShellArgs,Or as patternConstructId,b as projectCapacityIdentityToTarget,xr as recommendPatternForFramework,z as regionSuffixRejectionMessage,CE as regions,dr as requiredInputsForFramework,ke as resolveSynthEnvironment,Er as schemaGateExitKind,t as serialiseHostsChunks,Ce as singleton,fe as sleep,be as stageFromWireEnvironment,w as suffixedAccountName,mE as suggestRegionForTimezone,$e as tierDefault,OT as toDeploymentFailureAnalysis,s as toKebab,L as toPascalCase,p as toScreamingSnake,D as toValidDatabaseName,qE as upgradeCommand};

package/dist/insights/computePatternFingerprint.d.ts

@@ -3,7 +3,7 @@ import { z } from "zod";
  * Input shape for the cross-recurrence pattern fingerprint used by the
  * Auto-snoozed view pill pipeline.
  *
- * See `aiDocs/designs/2026-04-19-auto-snoozed-pill.md` §4.2. The fingerprint
+ * See the 2026-04-19 auto-snoozed pill design, §4.2. The fingerprint
  * collides intentionally across distinct `insight_id`s representing the same
  * finding class within an org, which is what the 3-in-30d dismissal
  * heuristic aggregates over.

package/dist/mcpProtocol/index.d.ts

@@ -180,19 +180,19 @@ export declare const ResolvedInputsSchema: z.ZodObject<{
     name: z.ZodString;
     pattern: z.ZodOptional<z.ZodString>;
     patternTier: z.ZodOptional<z.ZodEnum<{
-        tinkerer: "tinkerer";
-        lightweight: "lightweight";
         standard: "standard";
         resilient: "resilient";
         enterprise: "enterprise";
+        tinkerer: "tinkerer";
+        lightweight: "lightweight";
     }>>;
     patternDomain: z.ZodOptional<z.ZodString>;
     network: z.ZodOptional<z.ZodEnum<{
-        none: "none";
-        lightweight: "lightweight";
         standard: "standard";
         resilient: "resilient";
         enterprise: "enterprise";
+        none: "none";
+        lightweight: "lightweight";
     }>>;
     template: z.ZodOptional<z.ZodString>;
     docker: z.ZodOptional<z.ZodObject<{
@@ -216,19 +216,19 @@ export declare const ScaffoldPlanSchema: z.ZodObject<{
         name: z.ZodString;
         pattern: z.ZodOptional<z.ZodString>;
         patternTier: z.ZodOptional<z.ZodEnum<{
-            tinkerer: "tinkerer";
-            lightweight: "lightweight";
             standard: "standard";
             resilient: "resilient";
             enterprise: "enterprise";
+            tinkerer: "tinkerer";
+            lightweight: "lightweight";
         }>>;
         patternDomain: z.ZodOptional<z.ZodString>;
         network: z.ZodOptional<z.ZodEnum<{
-            none: "none";
-            lightweight: "lightweight";
             standard: "standard";
             resilient: "resilient";
             enterprise: "enterprise";
+            none: "none";
+            lightweight: "lightweight";
         }>>;
         template: z.ZodOptional<z.ZodString>;
         docker: z.ZodOptional<z.ZodObject<{

package/dist/migration/clickhouseFrameworkUsers.d.ts

@@ -24,9 +24,8 @@
  * them. SQL-provisioned (not `users.xml`) deliberately: no ClickHouse
  * restart, no `SYSTEM RELOAD USERS` race, zero outage on adoption.
  *
- * Coupled values — must move together per
- * `.claude/rules/code-quality.md § "Coupled values: shared source at 2
- * occurrences"`.
+ * Coupled values — must move together per the shared-source-at-two-occurrences
+ * rule.
  */
 import { z } from "zod";
 /** Read-only identity the materialised schema gate authenticates as. */

package/dist/migration/clickhouseSqlUsers.d.ts

@@ -17,9 +17,8 @@
  * — profiles are bound by customer SQL migrations via
  * `ALTER USER <name> SETTINGS PROFILE '<profile>'`.
  *
- * Coupled values — must move together per
- * `.claude/rules/code-quality.md § "Coupled values: shared source at 2
- * occurrences"`. Lives in `@fjall/util` so the runtime Docker image picks the
+ * Coupled values — must move together per the shared-source-at-two-occurrences
+ * rule. Lives in `@fjall/util` so the runtime Docker image picks the
  * constant + schema up without pulling `aws-cdk-lib`.
  */
 import { z } from "zod";
@@ -42,9 +41,8 @@ export declare const CLICKHOUSE_MANAGED_USERS_ENV: "CLICKHOUSE_MANAGED_USERS";
  * `process.env[userPasswordEnvName(name)]` for each entry in the manifest —
  * no runtime SDK call.
  *
- * Coupled values — must move together per
- * `.claude/rules/code-quality.md § "Coupled values: shared source at 2
- * occurrences"`. Single source-of-truth here so a future shape change
+ * Coupled values — must move together per the shared-source-at-two-occurrences
+ * rule. Single source-of-truth here so a future shape change
  * (`USER_<NAME>_SECRET`, lower-case, prefixed) lands at one site, not three.
  */
 export declare function userPasswordEnvName(userName: string): string;

package/dist/migration/compareSchemaVersion.d.ts

@@ -10,7 +10,7 @@
  * The tolerance exists because expand/contract migrations make an old image safe
  * against a newer schema: rolling the image back without rolling the DB back is
  * the intended expand-only rollback, and a strict-equality gate defeated it by
- * refusing to boot. See `aiDocs/patterns/migration-safety-pattern.md`.
+ * refusing to boot. See the migration-safety pattern.
  */
 /**
  * True when `version` is a monotonically-ordered migration identifier whose

package/dist/naming/connectedAccountName.d.ts

@@ -4,7 +4,7 @@
  * A connected AWS account's display name flows into deployment target names
  * (`generateTargetName`) AND into CFN / profile identifiers, so the name must be
  * a clean slug and must NOT already carry a region short-code suffix — otherwise
- * the region is appended twice (`clearcalcs-prod-use2` → target `…-use2-use2`).
+ * the region is appended twice (`acme-widgets-prod-use2` → target `…-use2-use2`).
  *
  * Single source of truth for the default-name shape and the region-suffix guard,
  * shared by the webapp connect / quick-create ingress and the CLI connect screen.
@@ -13,13 +13,13 @@
  * Default name for a newly-connected account: `<org>-<stage>` as a clean slug.
  * `stage` must be the DECODED workload stage (e.g. "production"), never a raw
  * wire `environment` value. An empty stage yields the org slug alone.
- * e.g. ("Calcs.com", "production") → "calcs-com-production".
+ * e.g. ("Acme.example", "production") → "acme-example-production".
  */
 export declare function defaultConnectedAccountName(orgName: string, stage: string): string;
 /**
  * Append a short disambiguating suffix to a base account name when the base
  * collides with an existing account (the `<org>-<stage>` default is taken).
- * e.g. ("calcs-com-production", "a3f9") → "calcs-com-production-a3f9".
+ * e.g. ("acme-example-production", "a3f9") → "acme-example-production-a3f9".
  */
 export declare function suffixedAccountName(base: string, shortId: string): string;
 /**

package/dist/repo/appPath.d.ts

@@ -22,8 +22,8 @@
  * template literals would invite silent CLI/webapp drift if the
  * convention shifts.
  *
- * See `aiDocs/designs/2026-05-11-marker-as-boundary-not-identity.md` and
- * `aiDocs/patterns/fjall-marker-convention-pattern.md` for the
+ * See the 2026-05-11 marker-as-boundary-not-identity design and the
+ * fjall-marker convention pattern for the
  * convention's full topology mapping.
  */
 export declare function buildAppConfigPath(appName: string, container?: string): string;

package/dist/repo/findInfrastructurePaths.d.ts

@@ -15,9 +15,9 @@
  * No I/O. Pure path classification. The structural contract is the function
  * signature; review-time agreement is not load-bearing.
  *
- * See `aiDocs/patterns/fjall-marker-convention-pattern.md` for the convention
- * and `aiDocs/decisions/2026-05-11-scan-parity-contract-vs-structural.md`
- * for the rationale behind extracting this module.
+ * See the fjall-marker convention pattern for the convention and the
+ * 2026-05-11 scan-parity decision (contract vs structural) for the
+ * rationale behind extracting this module.
  */
 import type { ScanPath } from "./scanTypes.js";
 export declare const INFRASTRUCTURE_FILE = "infrastructure.ts";

package/dist/repo/scanLocalRepository.d.ts

@@ -10,7 +10,7 @@
  * the same set as a defence-in-depth contract.
  *
  * Returns the same `{ paths }` shape as the webapp scan so the helpers are
- * consumer-substitutable (`aiDocs/patterns/cross-system-parity-pattern.md`).
+ * consumer-substitutable (the cross-system parity pattern).
  *
  * Walk discipline:
  *   - Symlinks are skipped entirely via `Dirent.isSymbolicLink()` (loop guard).

package/dist/repo/scanTypes.d.ts

@@ -4,7 +4,7 @@
  *
  * Both producers MUST emit the same `{ paths }` shape so the helpers are
  * consumer-substitutable. See
- * `aiDocs/patterns/cross-system-parity-pattern.md`.
+ * the cross-system parity pattern.
  *
  * `ScanPath` carries path information only — no name, no kind. The linker
  * is solely responsible for mapping paths to applications and tier kinds.

package/dist/securityHelpers.d.ts

@@ -54,7 +54,7 @@ export declare const REDACTED_KEY_SENTINEL = "[REDACTED]";
  *
  * Single source of truth — consumer loggers (CLI, worker, webapp) MUST
  * NOT re-implement these patterns inline. See
- * .claude/rules/security-standards.md § "Masking Patterns Live in @fjall/util".
+ * the credential-masking standard, § "Masking Patterns Live in @fjall/util".
  */
 export declare function maskSensitiveOutput(output: string): string;
 /**

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@fjall/util",
-  "version": "32.0.0",
+  "version": "33.1.0",
   "repository": {
     "type": "git",
     "url": "git+https://github.com/fjall-tech/fjall.git",
@@ -67,6 +67,10 @@
       "types": "./dist/environments.d.ts",
       "default": "./dist/environments.js"
     },
+    "./backupTiers": {
+      "types": "./dist/backupTiers.d.ts",
+      "default": "./dist/backupTiers.js"
+    },
     "./fsHelpers": {
       "types": "./dist/fsHelpers.d.ts",
       "default": "./dist/fsHelpers.js"
@@ -137,7 +141,8 @@
     }
   },
   "files": [
-    "dist/"
+    "dist/",
+    "!dist/.build-source-hash"
   ],
   "publishConfig": {
     "access": "public"
@@ -147,6 +152,7 @@
     "clean:node": "rm -rf ./node_modules",
     "build": "npm run clean && npx tsc && node ../scripts/minify-dist.mjs dist && node ../scripts/stamp-build.mjs",
     "prepack": "node ../scripts/check-dist-freshness.mjs",
+    "prepublishOnly": "node ../scripts/audit-package-tarball.mjs",
     "watch": "npm run build && npx tsc-watch",
     "watch:only": "npx tsc-watch",
     "format": "prettier --write \"src/**/*.{ts,tsx,js,jsx,json}\"",

package/dist/.build-source-hash

@@ -1,142 +0,0 @@
-{
-  "version": 2,
-  "algorithm": "sha256",
-  "sources": [
-    "src"
-  ],
-  "extraFiles": [
-    "../scripts/minify-dist.mjs",
-    "package.json",
-    "tsconfig.json"
-  ],
-  "hash": "6f342faf735304bf30905e9380cc583c652a4c68bd81ad9295f900ff246085c3",
-  "files": {
-    "src/async/concurrency.ts": "3c7ebe0222a720f9",
-    "src/async/singleton.ts": "7bcc21b0fb920561",
-    "src/async/sleep.ts": "df52b17675ec3ed2",
-    "src/atomicTempNaming.ts": "d08f34bdb062be6f",
-    "src/aws/CloudFormationFailureAnalyser.ts": "4e68b353171edd31",
-    "src/aws/cloudformationTypes.ts": "e43bab9c96a21856",
-    "src/aws/costAllocationTags.ts": "56cb9593dab3027b",
-    "src/aws/deployProgress.ts": "be09dedb4deb9a7a",
-    "src/aws/driftSuspects.ts": "5400dc05ebd6c977",
-    "src/aws/errors.ts": "5addfa6bb2d1456a",
-    "src/aws/failureAnalysisCategories.ts": "85ab1632d8069273",
-    "src/aws/index.ts": "ce3da231274defdf",
-    "src/aws/infraTags.ts": "ba9442248b8a0ef4",
-    "src/aws/ipamTags.ts": "ac19ecd6c36b3bc2",
-    "src/aws/maskFailureAnalysis.ts": "ae11250412cd6fd8",
-    "src/aws/monitoringRole.ts": "70c8b5947dc9138d",
-    "src/buildConcurrency.ts": "1804e76ddc4f8216",
-    "src/capacityIdentity.ts": "9e59bfc92a5ba361",
-    "src/cdkTmpdirCleanup.ts": "4574b3f10e3ab0f9",
-    "src/cdkToolchain.ts": "a6b996c60b87d644",
-    "src/cfn/physicalNameProperties.ts": "35d3c6f28079c593",
-    "src/clickhouse.ts": "655c74cdba292c29",
-    "src/complianceIssue.ts": "10ea87dfb4c0e849",
-    "src/config.ts": "6e15344c1d4a79fe",
-    "src/configPaths.ts": "afcc2e4ceb6652a0",
-    "src/constructMap.ts": "b81fc8e90015467f",
-    "src/deploy/approvalTokenOutput.ts": "4be7b52825d88a37",
-    "src/devSubstrate/entrypoint.ts": "0526b88258174aa6",
-    "src/devSubstrate/params.ts": "43bf902b57eb9edd",
-    "src/diagnostics/controlSequences.ts": "cb1cc3f29f041371",
-    "src/diagnostics/index.ts": "249d04cb4dd7db35",
-    "src/docker/DockerCli.build.ts": "93a74294437cc002",
-    "src/docker/DockerCli.daemon.ts": "11b9c3352c957d7c",
-    "src/docker/DockerCli.registry.ts": "f8dfcf1d7e413014",
-    "src/docker/DockerCli.ts": "3d2697c355b102d5",
-    "src/docker/abortHelpers.ts": "76daf48e617b8ec8",
-    "src/docker/architecture.ts": "305d87b68b905694",
-    "src/docker/bakeGuard.ts": "fc4120fb97756ddb",
-    "src/docker/buildArgInference.ts": "611dc5cb52b63f75",
-    "src/docker/buildxArgvBuilder.ts": "0ccc37cf5aaae62c",
-    "src/docker/buildxBuildMonitor.ts": "27c7b921901a9759",
-    "src/docker/cacheRepository.ts": "fae19107a3adbf13",
-    "src/docker/dockerCliConstants.ts": "2c216f214f466307",
-    "src/docker/dockerCliDiagnostics.ts": "250bc882b75d7bcc",
-    "src/docker/dockerCliSchemas.ts": "af1e89eb8ecd7023",
-    "src/docker/dockerErrorFormat.ts": "332dedf7ea3589c2",
-    "src/docker/ecrCredentialStore.ts": "0a99f7155dad5894",
-    "src/docker/index.ts": "f189b4e9967ab8c0",
-    "src/docker/metadataFileParser.ts": "299bc37a12c4594b",
-    "src/docker/projectBuildxResult.ts": "f462ba365b7ccdcc",
-    "src/docker/rawjsonParser.ts": "b9e5218abc326fa5",
-    "src/docker/rawjsonToVertexEvent.ts": "a356190727f0d1a4",
-    "src/docker/result.ts": "2ff0d59a3add8b06",
-    "src/environments.ts": "a05afb198a7b67ce",
-    "src/errorUtils.ts": "c601f2905c74b8d0",
-    "src/errors/absence.ts": "390fea350ffbb4e5",
-    "src/failure/deploymentFailure.ts": "5824db1d97d01838",
-    "src/failure/extractErrorWindow.ts": "ca41f90946fa939c",
-    "src/fjallHome.ts": "032df8e58d7e29cd",
-    "src/fsHelpers.ts": "4dd3877b3953c6a9",
-    "src/fsScan.ts": "feb187758481443f",
-    "src/httpKeepAlive.ts": "c8fe4b118ef4c79f",
-    "src/index.ts": "d2ad475845d22746",
-    "src/infra/backupVault.ts": "661678a6dfb0b648",
-    "src/infra/connectionsWire.ts": "e3afa3ba95a531d8",
-    "src/infra/deployArtefacts.ts": "235ac21dd3ccf0b2",
-    "src/infra/deriveContentHashTag.ts": "115fbe6588794027",
-    "src/infra/domainExports.ts": "18de5b8668633aaf",
-    "src/infra/imageTags.ts": "82d14f3dfd6ca68f",
-    "src/infra/regions.ts": "982acfd56adf04c2",
-    "src/infra/tokenScopes.ts": "68f0152394fb416e",
-    "src/insights/computePatternFingerprint.ts": "b5d3a4704f42cc1f",
-    "src/logRotation.ts": "5ea989894082107b",
-    "src/logger.ts": "865ec4ec62a9a588",
-    "src/manifest/index.ts": "bfa2930556c2f8ad",
-    "src/manifest/io.ts": "915ab602ac92d126",
-    "src/manifest/schemas.ts": "21dce8ba66b1230f",
-    "src/mcpProtocol/index.ts": "55df3209915a5043",
-    "src/migration/clickhouseFrameworkUsers.ts": "4bd55a96d4fddff4",
-    "src/migration/clickhouseSqlUsers.ts": "c916e148367715bb",
-    "src/migration/compareSchemaVersion.ts": "1c9247e722ec5d5b",
-    "src/migration/constants.ts": "5c585a455ba56d95",
-    "src/migration/controlPlaneActivity.ts": "c7ba33958f9fcbcc",
-    "src/migration/index.ts": "dc711329d0060213",
-    "src/migration/pickLatestClickHouseMigration.ts": "a5b4a00ba63522cb",
-    "src/migration/pickLatestPrismaMigration.ts": "cbddc2950f4d4c85",
-    "src/migration/schemaGateExit.ts": "53f26d02b798a475",
-    "src/migration/sleepAbortable.ts": "71c7e7cc59406e2a",
-    "src/migration/verifyExpectedSchemaVersion.ts": "cd583329d771a047",
-    "src/naming/accountNameCollision.ts": "2dc8b278ff039220",
-    "src/naming/caseConversion.ts": "8b8984f2b58b8ab7",
-    "src/naming/connectedAccountName.ts": "664596ca0a0c3f82",
-    "src/naming/reservedAppNames.ts": "7f63dd0b84c1972e",
-    "src/naming/targetExportNames.ts": "da78a19d8b2d4a6f",
-    "src/onboarding/index.ts": "7999117c5a7a18d1",
-    "src/onboarding/versionCurrency.ts": "19695f38b09cfc46",
-    "src/organisationBinding/apiBaseUrl.ts": "ad71ded9b42c95c6",
-    "src/organisationBinding/binding.ts": "d542bb92999d50ef",
-    "src/organisationBinding/cachedCredentialIdentity.ts": "f370024fe414949f",
-    "src/organisationBinding/credentialFingerprint.ts": "ae7fff52b70ba09a",
-    "src/organisationBinding/index.ts": "db0c6c2b73b6ea22",
-    "src/patterns/frameworkPatterns.ts": "0f843cb043eb11fc",
-    "src/patterns/index.ts": "8c765d60d672f7f7",
-    "src/patterns/patternTypes.ts": "549b06ec2a3a696e",
-    "src/patterns/staticSiteForms.ts": "86ffcf142d9a8eac",
-    "src/repo/appPath.ts": "9aa0d01262b88e65",
-    "src/repo/findInfrastructurePaths.ts": "dd1245f5d4004dd5",
-    "src/repo/findProjectsBelow.ts": "0ee63f2910a47a89",
-    "src/repo/findRepoRoot.ts": "6007be0f7d3407b1",
-    "src/repo/gitRemoteParser.ts": "2e1407d1d120baff",
-    "src/repo/inferContainerFromCandidates.ts": "63df34e7e5e65b34",
-    "src/repo/scanLocalRepository.ts": "c7bc76201622a7a5",
-    "src/repo/scanTypes.ts": "1fda805a7d8de93b",
-    "src/resourceCategorisation.ts": "a140d1b3cb38be33",
-    "src/rootConfigMerge.ts": "e5085a5ae802647d",
-    "src/rootConfigSchema.ts": "5751173d999c0690",
-    "src/scaffold/ensureGitignore.ts": "178a2c3b2c18bc83",
-    "src/scaffold/gitignore.ts": "87c66797a4bd05f2",
-    "src/secrets.ts": "50258d463e4e67c3",
-    "src/securityHelpers.ts": "1e68e1330c6da971",
-    "src/staticSiteOutput.ts": "cc81ed32acc597f1",
-    "src/targets.ts": "b4bdf07f06755374",
-    "../scripts/minify-dist.mjs": "6b2e4b0df8aec601",
-    "package.json": "4f46b151940a4220",
-    "tsconfig.json": "db759831ad95f396"
-  },
-  "outputHash": "d208f1929cba3466d7532dd64a67eaabe65092481c1cd36d921779ae5025184b",
-  "outputFileCount": 253
-}

package/dist/migration/clickhouseFrameworkUsers.test.d.ts

@@ -1 +0,0 @@
-export {};

package/dist/migration/clickhouseFrameworkUsers.test.js

@@ -1 +0,0 @@
-import{describe as a,expect as e,it as s}from"vitest";import{CLICKHOUSE_FRAMEWORK_USERS_ENV as f,FJALL_CLICKHOUSE_USER_PREFIX as C,FJALL_CLICKHOUSE_USERS as c,FJALL_MAINTENANCE_USER as l,FJALL_SCHEMA_GATE_USER as h,FrameworkUserNamesSchema as d,isReservedClickHouseUserName as n}from"./clickhouseFrameworkUsers.js";import{MANAGED_USER_NAME_PATTERN as A}from"./clickhouseSqlUsers.js";import{CONTROL_PLANE_ACTIVITY_RECENCY_SECONDS as S,buildControlPlaneActivityQuery as r}from"./controlPlaneActivity.js";import{SCHEMA_GATE_EXIT as i,SCHEMA_GATE_EXIT_HINTS as y,schemaGateExitKind as m}from"./schemaGateExit.js";import{sleepAbortable as E}from"./sleepAbortable.js";a("framework ClickHouse identities",()=>{s("every framework identity carries the reserved prefix and is a valid SQL name",()=>{for(const t of c)e(n(t)).toBe(!0),e(t).toMatch(A);e(c).toEqual([h,l])}),s("customer names outside the prefix are not reserved",()=>{e(n("schema_admin")).toBe(!1),e(n("backup_reader")).toBe(!1),e(n(`${C}x`)).toBe(!0)}),s("the manifest schema accepts only framework identities",()=>{e(d.safeParse([...c]).success).toBe(!0),e(d.safeParse(["fjall_other"]).success).toBe(!1),e(d.safeParse(["schema_admin"]).success).toBe(!1),e(f).toBe("CLICKHOUSE_FRAMEWORK_USERS")})}),a("schema gate exit taxonomy",()=>{s("codes are distinct and every kind has a hint",()=>{const t=Object.values(i);e(new Set(t).size).toBe(t.length);for(const o of Object.keys(i))e(y[o].length).toBeGreaterThan(0),e(m(i[o])).toBe(o)}),s("pins the wire values consumers already depend on",()=>{e(i).toEqual({pass:0,refused:1,configError:2,connectionError:3,busy:4,denied:5})}),s("returns undefined for codes the gate never emits",()=>{e(m(143)).toBeUndefined(),e(m(137)).toBeUndefined()})}),a("buildControlPlaneActivityQuery",()=>{s("probes both live processes and recent query_log for the named users",()=>{const t=r({users:["schema_admin",l]});e(t).toContain("FROM system.processes WHERE user IN ('schema_admin', 'fjall_maintenance')"),e(t).toContain("FROM system.query_log WHERE user IN ('schema_admin', 'fjall_maintenance')"),e(t).toContain(`INTERVAL ${S} SECOND`),e(t).toContain("type != 'QueryStart'"),e(t).toContain("event_date >= yesterday()"),e(t.trim().endsWith("AS active")).toBe(!0)}),s("honours a recency override",()=>{e(r({users:["schema_admin"],recencySeconds:5})).toContain("INTERVAL 5 SECOND")}),s("rejects names that could smuggle quoting, empty user lists, and bad recency",()=>{e(()=>r({users:["x' OR 1=1 --"]})).toThrow(/Invalid ClickHouse user name/),e(()=>r({users:[]})).toThrow(/at least one user/),e(()=>r({users:["a"],recencySeconds:0})).toThrow(/positive integer/)})}),a("sleepAbortable",()=>{s("resolves immediately on an already-aborted signal and on abort mid-sleep",async()=>{const t=new AbortController;t.abort(),await e(E(6e4,t.signal)).resolves.toBeUndefined();const o=new AbortController,u=Date.now(),_=E(6e4,o.signal);o.abort(),await _,e(Date.now()-u).toBeLessThan(1e3)})});

package/dist/migration/compareSchemaVersion.test.d.ts

@@ -1 +0,0 @@
-export {};

package/dist/migration/compareSchemaVersion.test.js

@@ -1 +0,0 @@
-import{describe as i,expect as e,it as s}from"vitest";import{isOrderableSchemaVersion as t,isSchemaVersionSatisfied as a}from"./compareSchemaVersion.js";i("isOrderableSchemaVersion",()=>{s("recognises a Prisma migration name",()=>{e(t("20260706120000_add_log_events")).toBe(!0)}),s("recognises a ClickHouse migration filename",()=>{e(t("011-issue-brief-citations.sql")).toBe(!0)}),s("rejects a sha256 content hash (the audit `version` field)",()=>{e(t("3f2b1c9d8e7a6f5b4c3d2e1f0a9b8c7d6e5f4a3b2c1d0e9f8a7b6c5d4e3f2a1b")).toBe(!1)}),s("rejects the constant `prisma_version` marker",()=>{e(t("applied")).toBe(!1)}),s("rejects a digit-leading string with no migration shape",()=>{e(t("19bc2fdeadbeef")).toBe(!1)})}),i("isSchemaVersionSatisfied",()=>{i("orderable versions (expand-only tolerance)",()=>{s("passes when actual equals expected (Prisma)",()=>{e(a("20260520000000_add_widgets","20260520000000_add_widgets")).toBe(!0)}),s("passes when actual is AHEAD of expected (Prisma rollback)",()=>{e(a("20260520000000_add_widgets","20260521000000_more")).toBe(!0)}),s("fails when actual TRAILS expected (Prisma \u2014 new code, old schema)",()=>{e(a("20260520000000_add_widgets","20260519000000_old")).toBe(!1)}),s("passes when actual is AHEAD of expected (ClickHouse rollback)",()=>{e(a("010-issue-briefs.sql","011-citations.sql")).toBe(!0)}),s("fails when actual TRAILS expected (ClickHouse)",()=>{e(a("010-issue-briefs.sql","009-old.sql")).toBe(!1)}),s("respects zero-padded numeric ordering, not naive digit count",()=>{e(a("010-a.sql","002-b.sql")).toBe(!1),e(a("002-b.sql","010-a.sql")).toBe(!0)})}),i("mismatched-width prefixes (fail-closed, no lexicographic trust)",()=>{s("refuses `>=` when CH numeric-prefix widths differ",()=>{e(a("010-x.sql","9-hotfix.sql")).toBe(!1),e(a("9-hotfix.sql","010-x.sql")).toBe(!1)}),s("still passes on exact identity even at a mismatched-width name",()=>{e(a("9-hotfix.sql","9-hotfix.sql")).toBe(!0)}),s("fails closed for a `.sql` name with no numeric prefix",()=>{e(a("010-x.sql","hotfix.sql")).toBe(!1),e(a("hotfix.sql","hotfix.sql")).toBe(!0)})}),i("non-orderable versions (fail-closed strict identity)",()=>{s("passes only on exact hash identity",()=>{const o="3f2b1c9d8e7a6f5b4c3d2e1f0a9b8c7d6e5f4a3b2c1d0e9f8a7b6c5d4e3f2a1b";e(a(o,o)).toBe(!0)}),s("fails for a different hash even when it sorts later",()=>{e(a("00000000","ffffffff")).toBe(!1)}),s("fails when only one side is orderable",()=>{e(a("20260520000000_add_widgets","applied")).toBe(!1),e(a("applied","20260521000000_more")).toBe(!1)})})});

package/dist/migration/pickLatestClickHouseMigration.test.d.ts

@@ -1 +0,0 @@
-export {};

package/dist/migration/pickLatestClickHouseMigration.test.js

@@ -1 +0,0 @@
-import{mkdtempSync as c,mkdirSync as a,rmSync as m,writeFileSync as i}from"node:fs";import{tmpdir as f}from"node:os";import{join as s}from"node:path";import{afterEach as h,beforeEach as p,describe as n,expect as t,it as o}from"vitest";import{CLICKHOUSE_MIGRATION_SKIP_RE as l}from"./constants.js";import{pickLatestClickHouseMigration as r}from"./pickLatestClickHouseMigration.js";n("pickLatestClickHouseMigration",()=>{let e;p(()=>{e=c(s(f(),"fjall-ch-test-"))}),h(()=>{m(e,{recursive:!0,force:!0})}),o("returns the lexicographically-latest *.sql filename",()=>{i(s(e,"001-schema.sql"),""),i(s(e,"010-issue-briefs.sql"),""),i(s(e,"005-optimisation-mvs.sql"),""),t(r(e)).toBe("010-issue-briefs.sql")}),o("skips *.dev.sql so synth and runner agree on 'latest'",()=>{i(s(e,"001-schema.sql"),""),i(s(e,"002-permissions.sql"),""),i(s(e,"999-local-only.dev.sql"),""),t(r(e)).toBe("002-permissions.sql")}),o("ignores non-SQL files (shell backfills, configs)",()=>{i(s(e,"001-schema.sql"),""),i(s(e,"009-mv-ttl-backfill.sh"),""),i(s(e,"users.xml"),""),i(s(e,"config.xml"),""),t(r(e)).toBe("001-schema.sql")}),o("ignores subdirectories that look like SQL",()=>{i(s(e,"001-schema.sql"),""),a(s(e,"999-not-a-file.sql")),t(r(e)).toBe("001-schema.sql")}),o("throws when the directory contains no eligible SQL files",()=>{i(s(e,"999-only.dev.sql"),""),i(s(e,"config.xml"),""),t(()=>r(e)).toThrow(/No ClickHouse migration files found/)}),o("throws on an empty directory",()=>{t(()=>r(e)).toThrow(/No ClickHouse migration files found/)})}),n("CLICKHOUSE_MIGRATION_SKIP_RE",()=>{o("matches *.dev.sql",()=>{t(l.test("001-users.dev.sql")).toBe(!0)}),o("rejects bare *.sql",()=>{t(l.test("001-schema.sql")).toBe(!1)}),o("regex identity pin \u2014 drift here decouples synth gate from runner applier",()=>{t(l.source).toBe(String.raw`\.dev\.sql$`)})});

package/dist/migration/verifyExpectedSchemaVersion.test.d.ts

@@ -1 +0,0 @@
-export {};

package/dist/migration/verifyExpectedSchemaVersion.test.js

@@ -1 +0,0 @@
-var d=Object.defineProperty;var c=(e,t)=>d(e,"name",{value:t,configurable:!0});import{describe as r,expect as a,it as o,vi as u}from"vitest";import{verifyExpectedSchemaVersion as n}from"./verifyExpectedSchemaVersion.js";function i(e){const t=[];return{client:{query:u.fn(async l=>(t.push(l),{rows:e}))},queries:t}}c(i,"makeMockClient"),r("verifyExpectedSchemaVersion",()=>{r('tool: "prisma"',()=>{o("returns matches=true when actual === expected",async()=>{const{client:e,queries:t}=i([{migration_name:"20260520000000_add_widgets"}]),s=await n({tool:"prisma",expected:"20260520000000_add_widgets",client:e});a(s).toEqual({matches:!0,expected:"20260520000000_add_widgets",actual:"20260520000000_add_widgets"}),a(t).toHaveLength(1),a(t[0]).toContain("_prisma_migrations"),a(t[0]).toContain("finished_at IS NOT NULL"),a(t[0]).toContain("ORDER BY migration_name DESC LIMIT 1")}),o("orders by migration_name, not finished_at (out-of-order application)",async()=>{const{client:e,queries:t}=i([{migration_name:"20260809140000_drop_admin_plugin_columns"}]),s=await n({tool:"prisma",expected:"20260809140000_drop_admin_plugin_columns",client:e});a(s.matches).toBe(!0),a(t[0]).not.toContain("ORDER BY finished_at"),a(t[0]).toContain("ORDER BY migration_name DESC LIMIT 1")}),o("returns matches=false with actual when DB trails image",async()=>{const{client:e}=i([{migration_name:"20260519000000_old"}]),t=await n({tool:"prisma",expected:"20260520000000_add_widgets",client:e});a(t).toEqual({matches:!1,expected:"20260520000000_add_widgets",actual:"20260519000000_old"})}),o("returns matches=true when DB is AHEAD (expand-only rollback)",async()=>{const{client:e}=i([{migration_name:"20260521000000_add_more_widgets"}]),t=await n({tool:"prisma",expected:"20260520000000_add_widgets",client:e});a(t).toEqual({matches:!0,expected:"20260520000000_add_widgets",actual:"20260521000000_add_more_widgets"})}),o("returns actual=null on empty result set",async()=>{const{client:e}=i([]),t=await n({tool:"prisma",expected:"20260520000000_add_widgets",client:e});a(t).toEqual({matches:!1,expected:"20260520000000_add_widgets",actual:null})}),o("returns actual=null when row's migration_name is not a string",async()=>{const{client:e}=i([{migration_name:12345}]),t=await n({tool:"prisma",expected:"x",client:e});a(t.actual).toBeNull(),a(t.matches).toBe(!1)})}),r('tool: "custom"',()=>{o("uses customQuery sql and column",async()=>{const{client:e,queries:t}=i([{hash:"deadbeef"}]),s=await n({tool:"custom",expected:"deadbeef",client:e,customQuery:{sql:"SELECT hash FROM __drizzle_migrations ORDER BY created_at DESC LIMIT 1",column:"hash"}});a(s.matches).toBe(!0),a(s.actual).toBe("deadbeef"),a(t[0]).toBe("SELECT hash FROM __drizzle_migrations ORDER BY created_at DESC LIMIT 1")}),o("stays strict for non-orderable versions even when actual sorts later",async()=>{const{client:e}=i([{hash:"ffffffff"}]),t=await n({tool:"custom",expected:"00000000",client:e,customQuery:{sql:"SELECT hash FROM __drizzle_migrations ORDER BY created_at DESC LIMIT 1",column:"hash"}});a(t.matches).toBe(!1),a(t.actual).toBe("ffffffff")}),o("throws when customQuery is omitted",async()=>{const{client:e}=i([]);await a(n({tool:"custom",expected:"x",client:e})).rejects.toThrow(/tool="custom" requires customQuery/)})}),r("abort signal",()=>{o("short-circuits before query when signal is already aborted",async()=>{const{client:e,queries:t}=i([{migration_name:"irrelevant"}]),s=new AbortController;s.abort(),await a(n({tool:"prisma",expected:"x",client:e,signal:s.signal})).rejects.toThrow(/aborted by signal before query/),a(t).toEqual([])})})});