@fjall/util 33.0.0 → 34.0.0

package/dist/.minified

@@ -1 +1 @@
-123 files minified at 2026-09-05T06:21:52.328Z
+124 files minified at 2026-09-05T22:58:50.480Z

package/dist/aws/index.d.ts

@@ -6,6 +6,6 @@ export { FAILURE_ANALYSIS_CATEGORIES, type FailureAnalysisCategory } from "./fai
 export { maskFailureAnalysis } from "./maskFailureAnalysis.js";
 export { classifyDriftSuspectEvents, findCurrentOperationStart, isDriftSuspectReason, isOperationOpeningEvent, type DriftSuspectEvent } from "./driftSuspects.js";
 export { IPAM_OPERATIONS_POOL_TAG_KEY, formatIpamPairTagValue } from "./ipamTags.js";
-export { KMS_RETENTION_TAG_KEY, SDK_PRE_EMPTY_TAG_KEY } from "./infraTags.js";
+export { KMS_RETENTION_TAG_KEY, S3_VERSIONING_EXEMPT_TAG_KEY, S3_VERSIONING_EXEMPTIONS, SDK_PRE_EMPTY_TAG_KEY, type S3VersioningExemption } from "./infraTags.js";
 export { COST_ALLOCATION_TAGS, DEFAULT_COST_ALLOCATION_ENVIRONMENT, DEFAULT_COST_ALLOCATION_OWNER, ecrCreateRepositoryTags, rdsPreMigrationSnapshotTags, type AwsSdkTag, type EcrCreateTag } from "./costAllocationTags.js";
 export { ACCOUNT_MONITORING_ROLE_NAME } from "./monitoringRole.js";

package/dist/aws/index.js

@@ -1 +1 @@
-import{AWSError as e,NoRolesFoundError as t,InvalidCredentialsError as E,SSOTokenExpiredError as s,MissingRegionError as T,ProfileNotFoundError as _,CommandError as i,isAWSError as O,isNoRolesFoundError as A,isSSOUnauthorizedError as a}from"./errors.js";import{STACK_NOT_FOUND_PATTERN as S,CDK_NO_STACKS_MATCH as N,isResourceEvent as p}from"./cloudformationTypes.js";import{countResourceProgress as m,formatElapsed as C}from"./deployProgress.js";import{CloudFormationFailureAnalyser as u}from"./CloudFormationFailureAnalyser.js";import{FAILURE_ANALYSIS_CATEGORIES as l}from"./failureAnalysisCategories.js";import{maskFailureAnalysis as x}from"./maskFailureAnalysis.js";import{classifyDriftSuspectEvents as F,findCurrentOperationStart as P,isDriftSuspectReason as M,isOperationOpeningEvent as g}from"./driftSuspects.js";import{IPAM_OPERATIONS_POOL_TAG_KEY as c,formatIpamPairTagValue as D}from"./ipamTags.js";import{KMS_RETENTION_TAG_KEY as U,SDK_PRE_EMPTY_TAG_KEY as Y}from"./infraTags.js";import{COST_ALLOCATION_TAGS as y,DEFAULT_COST_ALLOCATION_ENVIRONMENT as W,DEFAULT_COST_ALLOCATION_OWNER as h,ecrCreateRepositoryTags as k,rdsPreMigrationSnapshotTags as V}from"./costAllocationTags.js";import{ACCOUNT_MONITORING_ROLE_NAME as H}from"./monitoringRole.js";export{H as ACCOUNT_MONITORING_ROLE_NAME,e as AWSError,N as CDK_NO_STACKS_MATCH,y as COST_ALLOCATION_TAGS,u as CloudFormationFailureAnalyser,i as CommandError,W as DEFAULT_COST_ALLOCATION_ENVIRONMENT,h as DEFAULT_COST_ALLOCATION_OWNER,l as FAILURE_ANALYSIS_CATEGORIES,c as IPAM_OPERATIONS_POOL_TAG_KEY,E as InvalidCredentialsError,U as KMS_RETENTION_TAG_KEY,T as MissingRegionError,t as NoRolesFoundError,_ as ProfileNotFoundError,Y as SDK_PRE_EMPTY_TAG_KEY,s as SSOTokenExpiredError,S as STACK_NOT_FOUND_PATTERN,F as classifyDriftSuspectEvents,m as countResourceProgress,k as ecrCreateRepositoryTags,P as findCurrentOperationStart,C as formatElapsed,D as formatIpamPairTagValue,O as isAWSError,M as isDriftSuspectReason,A as isNoRolesFoundError,g as isOperationOpeningEvent,p as isResourceEvent,a as isSSOUnauthorizedError,x as maskFailureAnalysis,V as rdsPreMigrationSnapshotTags};
+import{AWSError as e,NoRolesFoundError as E,InvalidCredentialsError as _,SSOTokenExpiredError as t,MissingRegionError as T,ProfileNotFoundError as O,CommandError as s,isAWSError as i,isNoRolesFoundError as A,isSSOUnauthorizedError as S}from"./errors.js";import{STACK_NOT_FOUND_PATTERN as N,CDK_NO_STACKS_MATCH as n,isResourceEvent as p}from"./cloudformationTypes.js";import{countResourceProgress as R,formatElapsed as f}from"./deployProgress.js";import{CloudFormationFailureAnalyser as C}from"./CloudFormationFailureAnalyser.js";import{FAILURE_ANALYSIS_CATEGORIES as l}from"./failureAnalysisCategories.js";import{maskFailureAnalysis as x}from"./maskFailureAnalysis.js";import{classifyDriftSuspectEvents as P,findCurrentOperationStart as M,isDriftSuspectReason as F,isOperationOpeningEvent as G}from"./driftSuspects.js";import{IPAM_OPERATIONS_POOL_TAG_KEY as g,formatIpamPairTagValue as c}from"./ipamTags.js";import{KMS_RETENTION_TAG_KEY as U,S3_VERSIONING_EXEMPT_TAG_KEY as Y,S3_VERSIONING_EXEMPTIONS as v,SDK_PRE_EMPTY_TAG_KEY as y}from"./infraTags.js";import{COST_ALLOCATION_TAGS as W,DEFAULT_COST_ALLOCATION_ENVIRONMENT as h,DEFAULT_COST_ALLOCATION_OWNER as k,ecrCreateRepositoryTags as X,rdsPreMigrationSnapshotTags as z}from"./costAllocationTags.js";import{ACCOUNT_MONITORING_ROLE_NAME as b}from"./monitoringRole.js";export{b as ACCOUNT_MONITORING_ROLE_NAME,e as AWSError,n as CDK_NO_STACKS_MATCH,W as COST_ALLOCATION_TAGS,C as CloudFormationFailureAnalyser,s as CommandError,h as DEFAULT_COST_ALLOCATION_ENVIRONMENT,k as DEFAULT_COST_ALLOCATION_OWNER,l as FAILURE_ANALYSIS_CATEGORIES,g as IPAM_OPERATIONS_POOL_TAG_KEY,_ as InvalidCredentialsError,U as KMS_RETENTION_TAG_KEY,T as MissingRegionError,E as NoRolesFoundError,O as ProfileNotFoundError,v as S3_VERSIONING_EXEMPTIONS,Y as S3_VERSIONING_EXEMPT_TAG_KEY,y as SDK_PRE_EMPTY_TAG_KEY,t as SSOTokenExpiredError,N as STACK_NOT_FOUND_PATTERN,P as classifyDriftSuspectEvents,R as countResourceProgress,X as ecrCreateRepositoryTags,M as findCurrentOperationStart,f as formatElapsed,c as formatIpamPairTagValue,i as isAWSError,F as isDriftSuspectReason,A as isNoRolesFoundError,G as isOperationOpeningEvent,p as isResourceEvent,S as isSSOUnauthorizedError,x as maskFailureAnalysis,z as rdsPreMigrationSnapshotTags};

package/dist/aws/infraTags.d.ts

@@ -32,3 +32,30 @@ export declare const SDK_PRE_EMPTY_TAG_KEY = "fjall:sdk-pre-empty";
  * `__tests__/infraTags.test.ts` guards against casual renames.
  */
 export declare const KMS_RETENTION_TAG_KEY = "fjall:kms:retention";
+/**
+ * The S3 versioning-exemption marker tag, shared by producer and consumer:
+ *
+ * - Producer (`@fjall/components-infrastructure`): the `S3Bucket` wrapper
+ *   (`storage/s3.ts`) stamps a bucket whose author passed
+ *   `versioningExemption`, and only when the bucket's resolved `versioned`
+ *   is false — a bucket that versions after all has nothing to exempt. The
+ *   value names why versioning is off by design: `build-output` (Payload
+ *   assets, pruned on every deploy), `isr-cache` (Payload ISR cache,
+ *   regenerated at runtime), `cold-tier` (ClickHouse cold-tier storage, the
+ *   table's own tiered parts), `access-logs` (the stack's access-log
+ *   delivery bucket, lifecycle-expired; versioning would only multiply the
+ *   expired objects).
+ * - Consumer (webapp posture): the `S3_VERSIONING_DISABLED` tier-policy rows
+ *   read key and value to land the finding `mitigated` on every bucket the
+ *   design exempts (tier-aware alert policy design 2026-09-01 §8 K4), one
+ *   signal for every construct site instead of a logical id per site.
+ *
+ * Key and values are deployed infrastructure state, read back by the same
+ * literals: a rename would return every exempt bucket to `open` until the
+ * next deploy. The pin test in `__tests__/infraTags.test.ts` guards against
+ * casual renames.
+ */
+export declare const S3_VERSIONING_EXEMPT_TAG_KEY = "fjall:s3:versioning-exempt";
+/** The exemptions the tag may carry — each names a bucket whose contents are rebuilt, not kept. */
+export declare const S3_VERSIONING_EXEMPTIONS: readonly ["build-output", "isr-cache", "cold-tier", "access-logs"];
+export type S3VersioningExemption = (typeof S3_VERSIONING_EXEMPTIONS)[number];

package/dist/aws/infraTags.js

@@ -1 +1 @@
-const t="fjall:sdk-pre-empty",_="fjall:kms:retention";export{_ as KMS_RETENTION_TAG_KEY,t as SDK_PRE_EMPTY_TAG_KEY};
+const t="fjall:sdk-pre-empty",e="fjall:kms:retention",o="fjall:s3:versioning-exempt",E=["build-output","isr-cache","cold-tier","access-logs"];export{e as KMS_RETENTION_TAG_KEY,E as S3_VERSIONING_EXEMPTIONS,o as S3_VERSIONING_EXEMPT_TAG_KEY,t as SDK_PRE_EMPTY_TAG_KEY};

package/dist/backupTiers.d.ts

@@ -52,9 +52,15 @@ export interface BackupTierDefaults {
      * Encrypt with the stack's shared customer-managed KMS key instead of the
      * AWS-managed default: DynamoDB tables, SNS topics, Lambda environment
      * variables, ECS Exec session logging, and the CloudWatch log groups the
-     * tier-aware constructs create. ECR, RDS/Aurora storage and Secrets
-     * Manager keep their own knobs (each is a create-time or replacement
-     * property; flipping it from a tier would replace live data).
+     * tier-aware constructs create. ECR and RDS/Aurora storage keep their own
+     * knobs — each is a create-only property, so flipping it from a tier would
+     * replace live data. The Secrets Manager key is a different case: it is an
+     * in-place property (the registry seed at
+     * `deploy-core/src/services/infrastructure/cfnRegistrySeed.ts` lists only
+     * `Name` as create-only), and today every Fjall-minted secret carries its
+     * own per-secret key at every tier, untiered. Bringing that key under this
+     * column is an open raise of the backup-tier owned-defaults design (R1 of
+     * its 2026-09-05 follow-ups), not a decision this column has taken.
      */
     readonly customerManagedKeys: boolean;
     /** ECS Container Insights (enhanced observability) on the cluster. */

package/dist/capacityIdentity.d.ts

@@ -1,8 +1,8 @@
 import { z } from "zod";
 /**
  * Stable capacity identity — the shared vocabulary for capacity SLOTS and
- * their identity ANCHORS (design
- * `aiDocs/designs/2026-08-01-stable-capacity-identity-and-rename-safe-deploys.md`).
+ * their identity ANCHORS (the 2026-08-01 stable capacity identity and
+ * rename-safe deploys design).
  *
  * A capacity slot is the operator-chosen, config-independent name for one EC2
  * auto-scaling group within a cluster ("primary", "clickhouse-data"). Its

package/dist/docker/cacheRepository.d.ts

@@ -23,7 +23,7 @@ export type BuildCacheMode = (typeof BUILD_CACHE_MODES)[number];
  * reads any existing cache). Escape hatch for slow uplinks where the
  * dep-bump double upload (image push + mode=max export) is not worth the
  * cross-machine reuse — trade-off recorded in
- * aiDocs/decisions/2026-07-17-buildx-cache-export-mode.md.
+ * the 2026-07-17 decision: buildx cache export mode.
  *
  * Fails (rather than falling back) on an empty or unrecognised value.
  */

package/dist/failure/deploymentFailure.d.ts

@@ -2,7 +2,7 @@
  * Canonical deployment-failure record — the single structured shape every
  * producer (the deploy-core classifier, the webapp worker's platform-side
  * shim) and every consumer (webapp UI, CLI renderers, notifications, AI
- * surfaces) share. Design: aiDocs/designs/2026-08-10-deployment-failure-taxonomy.md § 3.
+ * surfaces) share. Design: the 2026-08-10 deployment-failure taxonomy design, § 3.
  *
  * Pitfall guards encoded (mirroring docker/dockerCliSchemas.ts):
  *   - Pitfall 1/6: every exported schema pairs a `z.infer` companion type

package/dist/index.d.ts

@@ -4,6 +4,7 @@ export { APPROVAL_TOKEN_OUTPUT_PREFIX, TOKEN_STDERR_PREFIX } from "./deploy/appr
 export { imageTagParameterName } from "./infra/imageTags.js";
 export { toPascalCase, toKebab, toValidDatabaseName, toScreamingSnake, capitalise, getSafeZoneName, accountConstructKey, hasAsciiStableConstructKey } from "./naming/caseConversion.js";
 export { albDnsExportName, albHostedZoneIdExportName, cdnDomainExportName, bucketWebsiteEndpointExportName, bucketWebsiteHostedZoneIdExportName } from "./naming/targetExportNames.js";
+export { ec2ServiceName, mintedEc2KeyPairName } from "./naming/ec2Naming.js";
 export { CAPACITY_SLOT_PATTERN, CAPACITY_SLOT_MAX_LENGTH, DEFAULT_CAPACITY_SLOT, CAPACITY_ANCHOR_PATTERN, CAPACITY_ANCHOR_MAX_LENGTH, CAPACITY_IDENTITY_CONTEXT_KEY, CapacityIdentityPinSchema, type CapacityIdentityPin, CapacityIdentityWireSchema, type CapacityIdentityWire, CapacityIdentityConfigSchema, type CapacityIdentityConfig, projectCapacityIdentityToTarget } from "./capacityIdentity.js";
 export { findAccountNameCollision, type AccountNameCollision } from "./naming/accountNameCollision.js";
 export { defaultConnectedAccountName, suffixedAccountName, REGION_SHORT_CODES, findTrailingRegionShortCode, regionSuffixRejectionMessage } from "./naming/connectedAccountName.js";

package/dist/index.js

@@ -1 +1 @@
-import{DNS_APEX as _,getDomainExportNames as r,getDomainStackName as T,getDomainUsEast1CertificatesStackName as A,hostsExportPartName as S,serialiseHostsChunks as t,HOSTS_OUTPUT_MAX_BYTES as o,isManagedDomainBinding as a,DOMAIN_DEPLOY_DEFAULT_PHASE as N}from"./infra/domainExports.js";import{BACKUP_VAULT_NAME as I}from"./infra/backupVault.js";import{APPROVAL_TOKEN_OUTPUT_PREFIX as i,TOKEN_STDERR_PREFIX as C}from"./deploy/approvalTokenOutput.js";import{imageTagParameterName as m}from"./infra/imageTags.js";import{toPascalCase as L,toKebab as s,toValidDatabaseName as D,toScreamingSnake as p,capitalise as M,getSafeZoneName as c,accountConstructKey as f,hasAsciiStableConstructKey as F}from"./naming/caseConversion.js";import{albDnsExportName as l,albHostedZoneIdExportName as u,cdnDomainExportName as x,bucketWebsiteEndpointExportName as G,bucketWebsiteHostedZoneIdExportName as d}from"./naming/targetExportNames.js";import{CAPACITY_SLOT_PATTERN as h,CAPACITY_SLOT_MAX_LENGTH as H,DEFAULT_CAPACITY_SLOT as V,CAPACITY_ANCHOR_PATTERN as Y,CAPACITY_ANCHOR_MAX_LENGTH as K,CAPACITY_IDENTITY_CONTEXT_KEY as y,CapacityIdentityPinSchema as v,CapacityIdentityWireSchema as B,CapacityIdentityConfigSchema as X,projectCapacityIdentityToTarget as b}from"./capacityIdentity.js";import{findAccountNameCollision as k}from"./naming/accountNameCollision.js";import{defaultConnectedAccountName as j,suffixedAccountName as w,REGION_SHORT_CODES as Z,findTrailingRegionShortCode as q,regionSuffixRejectionMessage as z}from"./naming/connectedAccountName.js";import{normaliseError as $,getErrorMessage as ee,hasErrorCode as Ee,getErrorCode as _e,getErrorStack as re,formatErrorString as Te}from"./errorUtils.js";import{FJALL_CONFIG_DIR_ENV as Se,FJALL_CREDENTIALS_FILENAME as te,FJALL_HOME_DIRNAME as oe,FJALL_LOG_DIR_ENV as ae,fjallCredentialsPath as Ne,fjallHomeDir as Re,fjallLogDir as Ie,fjallStatePath as Oe}from"./fjallHome.js";import{singleton as Ce}from"./async/singleton.js";import{DANGEROUS_ENV_VARS as me,filterDangerousEnvVars as Pe,MASKED_VALUE_MARKER as Le,maskSensitiveOutput as se,parseShellArgs as De,REDACTED_KEY_SENTINEL as pe,SCOPED_TOKEN_REGEX as Me}from"./securityHelpers.js";import{sleep as fe}from"./async/sleep.js";import{mapSettledWithConcurrency as Ue}from"./async/concurrency.js";import{ACCOUNT_STAGES_WITH_ROOT as ue,STRUCTURAL_ENVIRONMENTS as xe,ACCOUNT_STAGES as Ge,ACCOUNT_STAGE_LABELS as de,isAccountStage as ge,ACCOUNT_TIERS as he,AccountTierSchema as He,isAccountTier as Ve,GOVERNANCE_ACCOUNT_TIERS as Ye,isGovernanceTier as Ke,environmentToTier as ye,accountStageEffect as ve,ACCOUNT_STAGE_EFFECTS as Be,formatAccountStageList as Xe,stageFromWireEnvironment as be,accountTier as We,resolveSynthEnvironment as ke,getEnvironmentLabel as Je,ACCOUNT_ROLES as je}from"./environments.js";import{BACKUP_TIERS as Ze,BACKUP_TIER_DEFAULTS as qe,BackupTierSchema as ze,isBackupTier as Qe,tierDefault as $e}from"./backupTiers.js";import{RESOURCE_CATEGORIES as EE,categoriseResource as _E,getExpectedDuration as rE,getFriendlyResourceType as TE}from"./resourceCategorisation.js";import{parseGitRemoteUrl as SE}from"./repo/gitRemoteParser.js";import{abbreviateRegion as oE,AWS_REGIONS_METADATA as aE,DEFAULT_REGION as NE,getRegionInfo as RE,MAX_SECONDARY_REGIONS as IE,OPT_IN_REGION_CODES as OE,optInRegionWarning as iE,regions as CE,RETIRED_REGION_ABBREVIATIONS as nE,suggestRegionForTimezone as mE}from"./infra/regions.js";import{SCOPE_VALUES as LE,MACHINE_ONLY_SCOPES as sE,USER_GRANTABLE_SCOPES as DE,GOVERNANCE_SCOPE_REQUIRED_CODE as pE}from"./infra/tokenScopes.js";import{SECRET_NAME_PATTERN as cE,SECRET_NAME_ERROR as fE,SSM_COMPONENT_PATTERN as FE,SSM_COMPONENT_ERROR as UE,SSM_STANDARD_MAX_VALUE_BYTES as lE,SecretNamespaceSchema as uE,buildNamespaceParts as xE,buildParameterPath as GE,parseParameterPath as dE,isManageablePath as gE,parseDotEnv as hE,escapeDotEnvValue as HE}from"./secrets.js";import{ConnectionWireSchema as YE,ConnectionsListResponseSchema as KE,CONNECTION_PHASES as yE,CONNECTION_TERMINAL_FAILURE_PHASES as vE,CONNECTION_FAILURE_REASONS as BE,EXTERNAL_ID_PATTERN as XE}from"./infra/connectionsWire.js";import{COMPLIANCE_ISSUE_STATUSES as WE,isComplianceIssueStatus as kE}from"./complianceIssue.js";import{PUBLIC_PACKAGE_NAME as jE,INSTALL_SOURCES as wE,SETUP_COMMANDS as ZE,upgradeCommand as qE,SETUP_MODES as zE,SETUP_STEP_IDS as QE,SETUP_STEPS as $E,AGENT_SETUP_PROMPTS as e_,AGENT_INSTALL_COMMAND as E_,SKILL_INSTALL_SEGMENTS as __,SKILL_INSTALL_FILENAME as r_,SKILL_INSTALL_PATH as T_}from"./onboarding/index.js";import{deriveRegionsFromOrgConfig as S_,deriveTargets as t_,deriveAllTargets as o_,environmentOrTier as a_,explainRetiredTargetName as N_,findTarget as R_,generateTargetName as I_}from"./targets.js";import{buildAppConfigPath as i_}from"./repo/appPath.js";import{findInfrastructurePaths as n_,findBoundaryPath as m_,isInfrastructureFile as P_}from"./repo/findInfrastructurePaths.js";import{inferContainerFromCandidates as s_}from"./repo/inferContainerFromCandidates.js";import{RESERVED_APP_NAMES as p_,RESERVED_APP_NAME_MESSAGE as M_,isReservedAppName as c_,RESERVED_APP_NAME_SUFFIX as f_,RESERVED_APP_NAME_SUFFIX_MESSAGE as F_,hasReservedAppNameSuffix as U_}from"./naming/reservedAppNames.js";import{deriveContentHashTag as u_,CONTENT_HASH_TAG_PATTERN as x_}from"./infra/deriveContentHashTag.js";import{DEPLOY_MODES as d_,DeployModeSchema as g_,IMAGE_TAG_PATTERN as h_,ImageTagSchema as H_,ServiceArtefactSchema as V_,ServiceArtefactsSchema as Y_,ARTEFACT_OUTPUT_FIELDS as K_,artefactOutputKey as y_}from"./infra/deployArtefacts.js";import{MIGRATION_SNAPSHOT_NAME_PREFIX as B_,MIGRATION_SNAPSHOT_RETENTION_DAYS_ENV as X_,MIGRATION_SNAPSHOT_KIND_TAG_KEY as b_,MIGRATION_SNAPSHOT_KIND_PREMIGRATE as W_,EXPECTED_SCHEMA_VERSION_ENV as k_,EXPECTED_SCHEMA_VERSION_TOOL_ENV as J_,EXPECTED_CH_SCHEMA_VERSION_ENV as j_,SCHEMA_ADMIN_USER_ENV as w_,SCHEMA_ADMIN_PASSWORD_ENV as Z_,PRISMA_MIGRATION_DIR_RE as q_,CLICKHOUSE_MIGRATION_SKIP_RE as z_}from"./migration/constants.js";import{SCHEMA_GATE_EXIT as $_,SCHEMA_GATE_EXIT_HINTS as er,schemaGateExitKind as Er}from"./migration/schemaGateExit.js";import{FJALL_SCHEMA_GATE_USER as rr,FJALL_MAINTENANCE_USER as Tr,FJALL_CLICKHOUSE_USERS as Ar}from"./migration/clickhouseFrameworkUsers.js";import{PHYSICAL_NAME_FALLBACK_PROPERTIES as tr}from"./cfn/physicalNameProperties.js";import{PATTERN_TYPE_VALUES as ar,PATTERN_TYPES as Nr,isPatternType as Rr,PATTERN_REGISTRY as Ir,patternConstructId as Or,DEPLOYABLE_PATTERN_TYPES as ir,OPENNEXT_PATTERN_TYPES as Cr,isOpenNextPatternType as nr,CLOUDFRONT_PRICE_CLASS_VALUES as mr,STATIC_SITE_CONFIG_KEYS as Pr,STATIC_SITE_DEPLOY_INJECTED_KEYS as Lr,STATIC_SITE_CDN_CONFIG_KEYS as sr,STATIC_SITE_ROUTING_VALUES as Dr,STATIC_SITE_ROUTING_INFO as pr,PATTERN_CREATE_INPUT_VALUES as Mr,PATTERN_CREATE_INPUT_FLAGS as cr}from"./patterns/patternTypes.js";import{FRAMEWORK_VALUES as Fr,FRAMEWORKS as Ur,isFramework as lr,FRAMEWORK_PATTERN_RECOMMENDATIONS as ur,recommendPatternForFramework as xr,CREATABLE_FRAMEWORKS as Gr,requiredInputsForFramework as dr}from"./patterns/frameworkPatterns.js";import{DEFAULT_FORMS_FROM_LOCAL_PART as hr,defaultFormsFromAddress as Hr,defaultFormsCorsOrigin as Vr,isAddressAtDomain as Yr}from"./patterns/staticSiteForms.js";import{DEV_SUBSTRATE_PARAMS_SCHEMA_VERSION as yr,DEV_SUBSTRATE_PARAMS_FILENAME as vr,DevSubstrateSynthPropsSchema as Br,DevSubstrateParamsSchema as Xr}from"./devSubstrate/params.js";import{DEV_SUBSTRATE_ENTRYPOINT_SOURCE as Wr}from"./devSubstrate/entrypoint.js";import{BLESSED_CDK_TOOLCHAIN as Jr}from"./cdkToolchain.js";import{DEPLOYMENT_FAILURE_PHASES as wr,DeploymentFailurePhaseSchema as Zr,DEPLOYMENT_FAULT_ATTRIBUTIONS as qr,DeploymentFaultAttributionSchema as zr,DEPLOYMENT_FAILURE_PROVIDER_SOURCES as Qr,DeploymentFailureProviderSourceSchema as $r,DEPLOYMENT_FAILURE_CODE_PATTERN as eT,DEPLOYMENT_FAILURE_SCHEMA_VERSION as ET,DEPLOYMENT_FAILURE_LIMITS as _T,DeploymentFailureAnalysisSchema as rT,DeploymentFailureProviderSchema as TT,DeploymentFailureResourceSchema as AT,DeploymentFailureSchema as ST,parseDeploymentFailure as tT,DEPLOYMENT_FAILURE_DOCS_BASE_URL as oT,deploymentFailureDocsUrl as aT,DEPLOYMENT_FAULT_COPY as NT,DEPLOYMENT_PROVIDER_LABELS as RT,deriveErrorMessageFromFailure as IT,toDeploymentFailureAnalysis as OT}from"./failure/deploymentFailure.js";import{extractErrorWindow as CT,ERROR_WINDOW_CONTEXT_LINES as nT}from"./failure/extractErrorWindow.js";import{FJALL_COMPONENT_GITIGNORE as PT,FJALL_PROJECT_GITIGNORE as LT,FJALL_STATE_GITIGNORE_ENTRIES as sT,FJALL_MANAGED_STATE_DIR_ENTRIES as DT,LOCAL_CONFIG_GITIGNORE_ENTRY as pT}from"./scaffold/gitignore.js";import{ensureGitignoreEntries as cT}from"./scaffold/ensureGitignore.js";export{je as ACCOUNT_ROLES,Ge as ACCOUNT_STAGES,ue as ACCOUNT_STAGES_WITH_ROOT,Be as ACCOUNT_STAGE_EFFECTS,de as ACCOUNT_STAGE_LABELS,he as ACCOUNT_TIERS,E_ as AGENT_INSTALL_COMMAND,e_ as AGENT_SETUP_PROMPTS,i as APPROVAL_TOKEN_OUTPUT_PREFIX,K_ as ARTEFACT_OUTPUT_FIELDS,aE as AWS_REGIONS_METADATA,He as AccountTierSchema,Ze as BACKUP_TIERS,qe as BACKUP_TIER_DEFAULTS,I as BACKUP_VAULT_NAME,Jr as BLESSED_CDK_TOOLCHAIN,ze as BackupTierSchema,K as CAPACITY_ANCHOR_MAX_LENGTH,Y as CAPACITY_ANCHOR_PATTERN,y as CAPACITY_IDENTITY_CONTEXT_KEY,H as CAPACITY_SLOT_MAX_LENGTH,h as CAPACITY_SLOT_PATTERN,z_ as CLICKHOUSE_MIGRATION_SKIP_RE,mr as CLOUDFRONT_PRICE_CLASS_VALUES,WE as COMPLIANCE_ISSUE_STATUSES,BE as CONNECTION_FAILURE_REASONS,yE as CONNECTION_PHASES,vE as CONNECTION_TERMINAL_FAILURE_PHASES,x_ as CONTENT_HASH_TAG_PATTERN,Gr as CREATABLE_FRAMEWORKS,X as CapacityIdentityConfigSchema,v as CapacityIdentityPinSchema,B as CapacityIdentityWireSchema,YE as ConnectionWireSchema,KE as ConnectionsListResponseSchema,me as DANGEROUS_ENV_VARS,V as DEFAULT_CAPACITY_SLOT,hr as DEFAULT_FORMS_FROM_LOCAL_PART,NE as DEFAULT_REGION,ir as DEPLOYABLE_PATTERN_TYPES,eT as DEPLOYMENT_FAILURE_CODE_PATTERN,oT as DEPLOYMENT_FAILURE_DOCS_BASE_URL,_T as DEPLOYMENT_FAILURE_LIMITS,wr as DEPLOYMENT_FAILURE_PHASES,Qr as DEPLOYMENT_FAILURE_PROVIDER_SOURCES,ET as DEPLOYMENT_FAILURE_SCHEMA_VERSION,qr as DEPLOYMENT_FAULT_ATTRIBUTIONS,NT as DEPLOYMENT_FAULT_COPY,RT as DEPLOYMENT_PROVIDER_LABELS,d_ as DEPLOY_MODES,Wr as DEV_SUBSTRATE_ENTRYPOINT_SOURCE,vr as DEV_SUBSTRATE_PARAMS_FILENAME,yr as DEV_SUBSTRATE_PARAMS_SCHEMA_VERSION,_ as DNS_APEX,N as DOMAIN_DEPLOY_DEFAULT_PHASE,g_ as DeployModeSchema,rT as DeploymentFailureAnalysisSchema,Zr as DeploymentFailurePhaseSchema,TT as DeploymentFailureProviderSchema,$r as DeploymentFailureProviderSourceSchema,AT as DeploymentFailureResourceSchema,ST as DeploymentFailureSchema,zr as DeploymentFaultAttributionSchema,Xr as DevSubstrateParamsSchema,Br as DevSubstrateSynthPropsSchema,nT as ERROR_WINDOW_CONTEXT_LINES,j_ as EXPECTED_CH_SCHEMA_VERSION_ENV,k_ as EXPECTED_SCHEMA_VERSION_ENV,J_ as EXPECTED_SCHEMA_VERSION_TOOL_ENV,XE as EXTERNAL_ID_PATTERN,Ar as FJALL_CLICKHOUSE_USERS,PT as FJALL_COMPONENT_GITIGNORE,Se as FJALL_CONFIG_DIR_ENV,te as FJALL_CREDENTIALS_FILENAME,oe as FJALL_HOME_DIRNAME,ae as FJALL_LOG_DIR_ENV,Tr as FJALL_MAINTENANCE_USER,DT as FJALL_MANAGED_STATE_DIR_ENTRIES,LT as FJALL_PROJECT_GITIGNORE,rr as FJALL_SCHEMA_GATE_USER,sT as FJALL_STATE_GITIGNORE_ENTRIES,Ur as FRAMEWORKS,ur as FRAMEWORK_PATTERN_RECOMMENDATIONS,Fr as FRAMEWORK_VALUES,Ye as GOVERNANCE_ACCOUNT_TIERS,pE as GOVERNANCE_SCOPE_REQUIRED_CODE,o as HOSTS_OUTPUT_MAX_BYTES,h_ as IMAGE_TAG_PATTERN,wE as INSTALL_SOURCES,H_ as ImageTagSchema,pT as LOCAL_CONFIG_GITIGNORE_ENTRY,sE as MACHINE_ONLY_SCOPES,Le as MASKED_VALUE_MARKER,IE as MAX_SECONDARY_REGIONS,W_ as MIGRATION_SNAPSHOT_KIND_PREMIGRATE,b_ as MIGRATION_SNAPSHOT_KIND_TAG_KEY,B_ as MIGRATION_SNAPSHOT_NAME_PREFIX,X_ as MIGRATION_SNAPSHOT_RETENTION_DAYS_ENV,Cr as OPENNEXT_PATTERN_TYPES,OE as OPT_IN_REGION_CODES,cr as PATTERN_CREATE_INPUT_FLAGS,Mr as PATTERN_CREATE_INPUT_VALUES,Ir as PATTERN_REGISTRY,Nr as PATTERN_TYPES,ar as PATTERN_TYPE_VALUES,tr as PHYSICAL_NAME_FALLBACK_PROPERTIES,q_ as PRISMA_MIGRATION_DIR_RE,jE as PUBLIC_PACKAGE_NAME,pe as REDACTED_KEY_SENTINEL,Z as REGION_SHORT_CODES,p_ as RESERVED_APP_NAMES,M_ as RESERVED_APP_NAME_MESSAGE,f_ as RESERVED_APP_NAME_SUFFIX,F_ as RESERVED_APP_NAME_SUFFIX_MESSAGE,EE as RESOURCE_CATEGORIES,nE as RETIRED_REGION_ABBREVIATIONS,Z_ as SCHEMA_ADMIN_PASSWORD_ENV,w_ as SCHEMA_ADMIN_USER_ENV,$_ as SCHEMA_GATE_EXIT,er as SCHEMA_GATE_EXIT_HINTS,Me as SCOPED_TOKEN_REGEX,LE as SCOPE_VALUES,fE as SECRET_NAME_ERROR,cE as SECRET_NAME_PATTERN,ZE as SETUP_COMMANDS,zE as SETUP_MODES,$E as SETUP_STEPS,QE as SETUP_STEP_IDS,r_ as SKILL_INSTALL_FILENAME,T_ as SKILL_INSTALL_PATH,__ as SKILL_INSTALL_SEGMENTS,UE as SSM_COMPONENT_ERROR,FE as SSM_COMPONENT_PATTERN,lE as SSM_STANDARD_MAX_VALUE_BYTES,sr as STATIC_SITE_CDN_CONFIG_KEYS,Pr as STATIC_SITE_CONFIG_KEYS,Lr as STATIC_SITE_DEPLOY_INJECTED_KEYS,pr as STATIC_SITE_ROUTING_INFO,Dr as STATIC_SITE_ROUTING_VALUES,xe as STRUCTURAL_ENVIRONMENTS,uE as SecretNamespaceSchema,V_ as ServiceArtefactSchema,Y_ as ServiceArtefactsSchema,C as TOKEN_STDERR_PREFIX,DE as USER_GRANTABLE_SCOPES,oE as abbreviateRegion,f as accountConstructKey,ve as accountStageEffect,We as accountTier,l as albDnsExportName,u as albHostedZoneIdExportName,y_ as artefactOutputKey,G as bucketWebsiteEndpointExportName,d as bucketWebsiteHostedZoneIdExportName,i_ as buildAppConfigPath,xE as buildNamespaceParts,GE as buildParameterPath,M as capitalise,_E as categoriseResource,x as cdnDomainExportName,j as defaultConnectedAccountName,Vr as defaultFormsCorsOrigin,Hr as defaultFormsFromAddress,aT as deploymentFailureDocsUrl,o_ as deriveAllTargets,u_ as deriveContentHashTag,IT as deriveErrorMessageFromFailure,S_ as deriveRegionsFromOrgConfig,t_ as deriveTargets,cT as ensureGitignoreEntries,a_ as environmentOrTier,ye as environmentToTier,HE as escapeDotEnvValue,N_ as explainRetiredTargetName,CT as extractErrorWindow,Pe as filterDangerousEnvVars,k as findAccountNameCollision,m_ as findBoundaryPath,n_ as findInfrastructurePaths,R_ as findTarget,q as findTrailingRegionShortCode,Ne as fjallCredentialsPath,Re as fjallHomeDir,Ie as fjallLogDir,Oe as fjallStatePath,Xe as formatAccountStageList,Te as formatErrorString,I_ as generateTargetName,r as getDomainExportNames,T as getDomainStackName,A as getDomainUsEast1CertificatesStackName,Je as getEnvironmentLabel,_e as getErrorCode,ee as getErrorMessage,re as getErrorStack,rE as getExpectedDuration,TE as getFriendlyResourceType,RE as getRegionInfo,c as getSafeZoneName,F as hasAsciiStableConstructKey,Ee as hasErrorCode,U_ as hasReservedAppNameSuffix,S as hostsExportPartName,m as imageTagParameterName,s_ as inferContainerFromCandidates,ge as isAccountStage,Ve as isAccountTier,Yr as isAddressAtDomain,Qe as isBackupTier,kE as isComplianceIssueStatus,lr as isFramework,Ke as isGovernanceTier,P_ as isInfrastructureFile,gE as isManageablePath,a as isManagedDomainBinding,nr as isOpenNextPatternType,Rr as isPatternType,c_ as isReservedAppName,Ue as mapSettledWithConcurrency,se as maskSensitiveOutput,$ as normaliseError,iE as optInRegionWarning,tT as parseDeploymentFailure,hE as parseDotEnv,SE as parseGitRemoteUrl,dE as parseParameterPath,De as parseShellArgs,Or as patternConstructId,b as projectCapacityIdentityToTarget,xr as recommendPatternForFramework,z as regionSuffixRejectionMessage,CE as regions,dr as requiredInputsForFramework,ke as resolveSynthEnvironment,Er as schemaGateExitKind,t as serialiseHostsChunks,Ce as singleton,fe as sleep,be as stageFromWireEnvironment,w as suffixedAccountName,mE as suggestRegionForTimezone,$e as tierDefault,OT as toDeploymentFailureAnalysis,s as toKebab,L as toPascalCase,p as toScreamingSnake,D as toValidDatabaseName,qE as upgradeCommand};
+import{DNS_APEX as _,getDomainExportNames as r,getDomainStackName as T,getDomainUsEast1CertificatesStackName as A,hostsExportPartName as S,serialiseHostsChunks as t,HOSTS_OUTPUT_MAX_BYTES as o,isManagedDomainBinding as a,DOMAIN_DEPLOY_DEFAULT_PHASE as N}from"./infra/domainExports.js";import{BACKUP_VAULT_NAME as I}from"./infra/backupVault.js";import{APPROVAL_TOKEN_OUTPUT_PREFIX as i,TOKEN_STDERR_PREFIX as C}from"./deploy/approvalTokenOutput.js";import{imageTagParameterName as n}from"./infra/imageTags.js";import{toPascalCase as L,toKebab as s,toValidDatabaseName as p,toScreamingSnake as D,capitalise as c,getSafeZoneName as M,accountConstructKey as f,hasAsciiStableConstructKey as F}from"./naming/caseConversion.js";import{albDnsExportName as l,albHostedZoneIdExportName as u,cdnDomainExportName as x,bucketWebsiteEndpointExportName as d,bucketWebsiteHostedZoneIdExportName as G}from"./naming/targetExportNames.js";import{ec2ServiceName as h,mintedEc2KeyPairName as H}from"./naming/ec2Naming.js";import{CAPACITY_SLOT_PATTERN as Y,CAPACITY_SLOT_MAX_LENGTH as K,DEFAULT_CAPACITY_SLOT as y,CAPACITY_ANCHOR_PATTERN as v,CAPACITY_ANCHOR_MAX_LENGTH as B,CAPACITY_IDENTITY_CONTEXT_KEY as X,CapacityIdentityPinSchema as b,CapacityIdentityWireSchema as W,CapacityIdentityConfigSchema as k,projectCapacityIdentityToTarget as J}from"./capacityIdentity.js";import{findAccountNameCollision as w}from"./naming/accountNameCollision.js";import{defaultConnectedAccountName as q,suffixedAccountName as z,REGION_SHORT_CODES as Q,findTrailingRegionShortCode as $,regionSuffixRejectionMessage as ee}from"./naming/connectedAccountName.js";import{normaliseError as _e,getErrorMessage as re,hasErrorCode as Te,getErrorCode as Ae,getErrorStack as Se,formatErrorString as te}from"./errorUtils.js";import{FJALL_CONFIG_DIR_ENV as ae,FJALL_CREDENTIALS_FILENAME as Ne,FJALL_HOME_DIRNAME as Re,FJALL_LOG_DIR_ENV as Ie,fjallCredentialsPath as Oe,fjallHomeDir as ie,fjallLogDir as Ce,fjallStatePath as me}from"./fjallHome.js";import{singleton as Pe}from"./async/singleton.js";import{DANGEROUS_ENV_VARS as se,filterDangerousEnvVars as pe,MASKED_VALUE_MARKER as De,maskSensitiveOutput as ce,parseShellArgs as Me,REDACTED_KEY_SENTINEL as fe,SCOPED_TOKEN_REGEX as Fe}from"./securityHelpers.js";import{sleep as le}from"./async/sleep.js";import{mapSettledWithConcurrency as xe}from"./async/concurrency.js";import{ACCOUNT_STAGES_WITH_ROOT as Ge,STRUCTURAL_ENVIRONMENTS as ge,ACCOUNT_STAGES as he,ACCOUNT_STAGE_LABELS as He,isAccountStage as Ve,ACCOUNT_TIERS as Ye,AccountTierSchema as Ke,isAccountTier as ye,GOVERNANCE_ACCOUNT_TIERS as ve,isGovernanceTier as Be,environmentToTier as Xe,accountStageEffect as be,ACCOUNT_STAGE_EFFECTS as We,formatAccountStageList as ke,stageFromWireEnvironment as Je,accountTier as je,resolveSynthEnvironment as we,getEnvironmentLabel as Ze,ACCOUNT_ROLES as qe}from"./environments.js";import{BACKUP_TIERS as Qe,BACKUP_TIER_DEFAULTS as $e,BackupTierSchema as eE,isBackupTier as EE,tierDefault as _E}from"./backupTiers.js";import{RESOURCE_CATEGORIES as TE,categoriseResource as AE,getExpectedDuration as SE,getFriendlyResourceType as tE}from"./resourceCategorisation.js";import{parseGitRemoteUrl as aE}from"./repo/gitRemoteParser.js";import{abbreviateRegion as RE,AWS_REGIONS_METADATA as IE,DEFAULT_REGION as OE,getRegionInfo as iE,MAX_SECONDARY_REGIONS as CE,OPT_IN_REGION_CODES as mE,optInRegionWarning as nE,regions as PE,RETIRED_REGION_ABBREVIATIONS as LE,suggestRegionForTimezone as sE}from"./infra/regions.js";import{SCOPE_VALUES as DE,MACHINE_ONLY_SCOPES as cE,USER_GRANTABLE_SCOPES as ME,GOVERNANCE_SCOPE_REQUIRED_CODE as fE}from"./infra/tokenScopes.js";import{SECRET_NAME_PATTERN as UE,SECRET_NAME_ERROR as lE,SSM_COMPONENT_PATTERN as uE,SSM_COMPONENT_ERROR as xE,SSM_STANDARD_MAX_VALUE_BYTES as dE,SecretNamespaceSchema as GE,buildNamespaceParts as gE,buildParameterPath as hE,parseParameterPath as HE,isManageablePath as VE,parseDotEnv as YE,escapeDotEnvValue as KE}from"./secrets.js";import{ConnectionWireSchema as vE,ConnectionsListResponseSchema as BE,CONNECTION_PHASES as XE,CONNECTION_TERMINAL_FAILURE_PHASES as bE,CONNECTION_FAILURE_REASONS as WE,EXTERNAL_ID_PATTERN as kE}from"./infra/connectionsWire.js";import{COMPLIANCE_ISSUE_STATUSES as jE,isComplianceIssueStatus as wE}from"./complianceIssue.js";import{PUBLIC_PACKAGE_NAME as qE,INSTALL_SOURCES as zE,SETUP_COMMANDS as QE,upgradeCommand as $E,SETUP_MODES as e_,SETUP_STEP_IDS as E_,SETUP_STEPS as __,AGENT_SETUP_PROMPTS as r_,AGENT_INSTALL_COMMAND as T_,SKILL_INSTALL_SEGMENTS as A_,SKILL_INSTALL_FILENAME as S_,SKILL_INSTALL_PATH as t_}from"./onboarding/index.js";import{deriveRegionsFromOrgConfig as a_,deriveTargets as N_,deriveAllTargets as R_,environmentOrTier as I_,explainRetiredTargetName as O_,findTarget as i_,generateTargetName as C_}from"./targets.js";import{buildAppConfigPath as n_}from"./repo/appPath.js";import{findInfrastructurePaths as L_,findBoundaryPath as s_,isInfrastructureFile as p_}from"./repo/findInfrastructurePaths.js";import{inferContainerFromCandidates as c_}from"./repo/inferContainerFromCandidates.js";import{RESERVED_APP_NAMES as f_,RESERVED_APP_NAME_MESSAGE as F_,isReservedAppName as U_,RESERVED_APP_NAME_SUFFIX as l_,RESERVED_APP_NAME_SUFFIX_MESSAGE as u_,hasReservedAppNameSuffix as x_}from"./naming/reservedAppNames.js";import{deriveContentHashTag as G_,CONTENT_HASH_TAG_PATTERN as g_}from"./infra/deriveContentHashTag.js";import{DEPLOY_MODES as H_,DeployModeSchema as V_,IMAGE_TAG_PATTERN as Y_,ImageTagSchema as K_,ServiceArtefactSchema as y_,ServiceArtefactsSchema as v_,ARTEFACT_OUTPUT_FIELDS as B_,artefactOutputKey as X_}from"./infra/deployArtefacts.js";import{MIGRATION_SNAPSHOT_NAME_PREFIX as W_,MIGRATION_SNAPSHOT_RETENTION_DAYS_ENV as k_,MIGRATION_SNAPSHOT_KIND_TAG_KEY as J_,MIGRATION_SNAPSHOT_KIND_PREMIGRATE as j_,EXPECTED_SCHEMA_VERSION_ENV as w_,EXPECTED_SCHEMA_VERSION_TOOL_ENV as Z_,EXPECTED_CH_SCHEMA_VERSION_ENV as q_,SCHEMA_ADMIN_USER_ENV as z_,SCHEMA_ADMIN_PASSWORD_ENV as Q_,PRISMA_MIGRATION_DIR_RE as $_,CLICKHOUSE_MIGRATION_SKIP_RE as er}from"./migration/constants.js";import{SCHEMA_GATE_EXIT as _r,SCHEMA_GATE_EXIT_HINTS as rr,schemaGateExitKind as Tr}from"./migration/schemaGateExit.js";import{FJALL_SCHEMA_GATE_USER as Sr,FJALL_MAINTENANCE_USER as tr,FJALL_CLICKHOUSE_USERS as or}from"./migration/clickhouseFrameworkUsers.js";import{PHYSICAL_NAME_FALLBACK_PROPERTIES as Nr}from"./cfn/physicalNameProperties.js";import{PATTERN_TYPE_VALUES as Ir,PATTERN_TYPES as Or,isPatternType as ir,PATTERN_REGISTRY as Cr,patternConstructId as mr,DEPLOYABLE_PATTERN_TYPES as nr,OPENNEXT_PATTERN_TYPES as Pr,isOpenNextPatternType as Lr,CLOUDFRONT_PRICE_CLASS_VALUES as sr,STATIC_SITE_CONFIG_KEYS as pr,STATIC_SITE_DEPLOY_INJECTED_KEYS as Dr,STATIC_SITE_CDN_CONFIG_KEYS as cr,STATIC_SITE_ROUTING_VALUES as Mr,STATIC_SITE_ROUTING_INFO as fr,PATTERN_CREATE_INPUT_VALUES as Fr,PATTERN_CREATE_INPUT_FLAGS as Ur}from"./patterns/patternTypes.js";import{FRAMEWORK_VALUES as ur,FRAMEWORKS as xr,isFramework as dr,FRAMEWORK_PATTERN_RECOMMENDATIONS as Gr,recommendPatternForFramework as gr,CREATABLE_FRAMEWORKS as hr,requiredInputsForFramework as Hr}from"./patterns/frameworkPatterns.js";import{DEFAULT_FORMS_FROM_LOCAL_PART as Yr,defaultFormsFromAddress as Kr,defaultFormsCorsOrigin as yr,isAddressAtDomain as vr}from"./patterns/staticSiteForms.js";import{DEV_SUBSTRATE_PARAMS_SCHEMA_VERSION as Xr,DEV_SUBSTRATE_PARAMS_FILENAME as br,DevSubstrateSynthPropsSchema as Wr,DevSubstrateParamsSchema as kr}from"./devSubstrate/params.js";import{DEV_SUBSTRATE_ENTRYPOINT_SOURCE as jr}from"./devSubstrate/entrypoint.js";import{BLESSED_CDK_TOOLCHAIN as Zr}from"./cdkToolchain.js";import{DEPLOYMENT_FAILURE_PHASES as zr,DeploymentFailurePhaseSchema as Qr,DEPLOYMENT_FAULT_ATTRIBUTIONS as $r,DeploymentFaultAttributionSchema as eT,DEPLOYMENT_FAILURE_PROVIDER_SOURCES as ET,DeploymentFailureProviderSourceSchema as _T,DEPLOYMENT_FAILURE_CODE_PATTERN as rT,DEPLOYMENT_FAILURE_SCHEMA_VERSION as TT,DEPLOYMENT_FAILURE_LIMITS as AT,DeploymentFailureAnalysisSchema as ST,DeploymentFailureProviderSchema as tT,DeploymentFailureResourceSchema as oT,DeploymentFailureSchema as aT,parseDeploymentFailure as NT,DEPLOYMENT_FAILURE_DOCS_BASE_URL as RT,deploymentFailureDocsUrl as IT,DEPLOYMENT_FAULT_COPY as OT,DEPLOYMENT_PROVIDER_LABELS as iT,deriveErrorMessageFromFailure as CT,toDeploymentFailureAnalysis as mT}from"./failure/deploymentFailure.js";import{extractErrorWindow as PT,ERROR_WINDOW_CONTEXT_LINES as LT}from"./failure/extractErrorWindow.js";import{FJALL_COMPONENT_GITIGNORE as pT,FJALL_PROJECT_GITIGNORE as DT,FJALL_STATE_GITIGNORE_ENTRIES as cT,FJALL_MANAGED_STATE_DIR_ENTRIES as MT,LOCAL_CONFIG_GITIGNORE_ENTRY as fT}from"./scaffold/gitignore.js";import{ensureGitignoreEntries as UT}from"./scaffold/ensureGitignore.js";export{qe as ACCOUNT_ROLES,he as ACCOUNT_STAGES,Ge as ACCOUNT_STAGES_WITH_ROOT,We as ACCOUNT_STAGE_EFFECTS,He as ACCOUNT_STAGE_LABELS,Ye as ACCOUNT_TIERS,T_ as AGENT_INSTALL_COMMAND,r_ as AGENT_SETUP_PROMPTS,i as APPROVAL_TOKEN_OUTPUT_PREFIX,B_ as ARTEFACT_OUTPUT_FIELDS,IE as AWS_REGIONS_METADATA,Ke as AccountTierSchema,Qe as BACKUP_TIERS,$e as BACKUP_TIER_DEFAULTS,I as BACKUP_VAULT_NAME,Zr as BLESSED_CDK_TOOLCHAIN,eE as BackupTierSchema,B as CAPACITY_ANCHOR_MAX_LENGTH,v as CAPACITY_ANCHOR_PATTERN,X as CAPACITY_IDENTITY_CONTEXT_KEY,K as CAPACITY_SLOT_MAX_LENGTH,Y as CAPACITY_SLOT_PATTERN,er as CLICKHOUSE_MIGRATION_SKIP_RE,sr as CLOUDFRONT_PRICE_CLASS_VALUES,jE as COMPLIANCE_ISSUE_STATUSES,WE as CONNECTION_FAILURE_REASONS,XE as CONNECTION_PHASES,bE as CONNECTION_TERMINAL_FAILURE_PHASES,g_ as CONTENT_HASH_TAG_PATTERN,hr as CREATABLE_FRAMEWORKS,k as CapacityIdentityConfigSchema,b as CapacityIdentityPinSchema,W as CapacityIdentityWireSchema,vE as ConnectionWireSchema,BE as ConnectionsListResponseSchema,se as DANGEROUS_ENV_VARS,y as DEFAULT_CAPACITY_SLOT,Yr as DEFAULT_FORMS_FROM_LOCAL_PART,OE as DEFAULT_REGION,nr as DEPLOYABLE_PATTERN_TYPES,rT as DEPLOYMENT_FAILURE_CODE_PATTERN,RT as DEPLOYMENT_FAILURE_DOCS_BASE_URL,AT as DEPLOYMENT_FAILURE_LIMITS,zr as DEPLOYMENT_FAILURE_PHASES,ET as DEPLOYMENT_FAILURE_PROVIDER_SOURCES,TT as DEPLOYMENT_FAILURE_SCHEMA_VERSION,$r as DEPLOYMENT_FAULT_ATTRIBUTIONS,OT as DEPLOYMENT_FAULT_COPY,iT as DEPLOYMENT_PROVIDER_LABELS,H_ as DEPLOY_MODES,jr as DEV_SUBSTRATE_ENTRYPOINT_SOURCE,br as DEV_SUBSTRATE_PARAMS_FILENAME,Xr as DEV_SUBSTRATE_PARAMS_SCHEMA_VERSION,_ as DNS_APEX,N as DOMAIN_DEPLOY_DEFAULT_PHASE,V_ as DeployModeSchema,ST as DeploymentFailureAnalysisSchema,Qr as DeploymentFailurePhaseSchema,tT as DeploymentFailureProviderSchema,_T as DeploymentFailureProviderSourceSchema,oT as DeploymentFailureResourceSchema,aT as DeploymentFailureSchema,eT as DeploymentFaultAttributionSchema,kr as DevSubstrateParamsSchema,Wr as DevSubstrateSynthPropsSchema,LT as ERROR_WINDOW_CONTEXT_LINES,q_ as EXPECTED_CH_SCHEMA_VERSION_ENV,w_ as EXPECTED_SCHEMA_VERSION_ENV,Z_ as EXPECTED_SCHEMA_VERSION_TOOL_ENV,kE as EXTERNAL_ID_PATTERN,or as FJALL_CLICKHOUSE_USERS,pT as FJALL_COMPONENT_GITIGNORE,ae as FJALL_CONFIG_DIR_ENV,Ne as FJALL_CREDENTIALS_FILENAME,Re as FJALL_HOME_DIRNAME,Ie as FJALL_LOG_DIR_ENV,tr as FJALL_MAINTENANCE_USER,MT as FJALL_MANAGED_STATE_DIR_ENTRIES,DT as FJALL_PROJECT_GITIGNORE,Sr as FJALL_SCHEMA_GATE_USER,cT as FJALL_STATE_GITIGNORE_ENTRIES,xr as FRAMEWORKS,Gr as FRAMEWORK_PATTERN_RECOMMENDATIONS,ur as FRAMEWORK_VALUES,ve as GOVERNANCE_ACCOUNT_TIERS,fE as GOVERNANCE_SCOPE_REQUIRED_CODE,o as HOSTS_OUTPUT_MAX_BYTES,Y_ as IMAGE_TAG_PATTERN,zE as INSTALL_SOURCES,K_ as ImageTagSchema,fT as LOCAL_CONFIG_GITIGNORE_ENTRY,cE as MACHINE_ONLY_SCOPES,De as MASKED_VALUE_MARKER,CE as MAX_SECONDARY_REGIONS,j_ as MIGRATION_SNAPSHOT_KIND_PREMIGRATE,J_ as MIGRATION_SNAPSHOT_KIND_TAG_KEY,W_ as MIGRATION_SNAPSHOT_NAME_PREFIX,k_ as MIGRATION_SNAPSHOT_RETENTION_DAYS_ENV,Pr as OPENNEXT_PATTERN_TYPES,mE as OPT_IN_REGION_CODES,Ur as PATTERN_CREATE_INPUT_FLAGS,Fr as PATTERN_CREATE_INPUT_VALUES,Cr as PATTERN_REGISTRY,Or as PATTERN_TYPES,Ir as PATTERN_TYPE_VALUES,Nr as PHYSICAL_NAME_FALLBACK_PROPERTIES,$_ as PRISMA_MIGRATION_DIR_RE,qE as PUBLIC_PACKAGE_NAME,fe as REDACTED_KEY_SENTINEL,Q as REGION_SHORT_CODES,f_ as RESERVED_APP_NAMES,F_ as RESERVED_APP_NAME_MESSAGE,l_ as RESERVED_APP_NAME_SUFFIX,u_ as RESERVED_APP_NAME_SUFFIX_MESSAGE,TE as RESOURCE_CATEGORIES,LE as RETIRED_REGION_ABBREVIATIONS,Q_ as SCHEMA_ADMIN_PASSWORD_ENV,z_ as SCHEMA_ADMIN_USER_ENV,_r as SCHEMA_GATE_EXIT,rr as SCHEMA_GATE_EXIT_HINTS,Fe as SCOPED_TOKEN_REGEX,DE as SCOPE_VALUES,lE as SECRET_NAME_ERROR,UE as SECRET_NAME_PATTERN,QE as SETUP_COMMANDS,e_ as SETUP_MODES,__ as SETUP_STEPS,E_ as SETUP_STEP_IDS,S_ as SKILL_INSTALL_FILENAME,t_ as SKILL_INSTALL_PATH,A_ as SKILL_INSTALL_SEGMENTS,xE as SSM_COMPONENT_ERROR,uE as SSM_COMPONENT_PATTERN,dE as SSM_STANDARD_MAX_VALUE_BYTES,cr as STATIC_SITE_CDN_CONFIG_KEYS,pr as STATIC_SITE_CONFIG_KEYS,Dr as STATIC_SITE_DEPLOY_INJECTED_KEYS,fr as STATIC_SITE_ROUTING_INFO,Mr as STATIC_SITE_ROUTING_VALUES,ge as STRUCTURAL_ENVIRONMENTS,GE as SecretNamespaceSchema,y_ as ServiceArtefactSchema,v_ as ServiceArtefactsSchema,C as TOKEN_STDERR_PREFIX,ME as USER_GRANTABLE_SCOPES,RE as abbreviateRegion,f as accountConstructKey,be as accountStageEffect,je as accountTier,l as albDnsExportName,u as albHostedZoneIdExportName,X_ as artefactOutputKey,d as bucketWebsiteEndpointExportName,G as bucketWebsiteHostedZoneIdExportName,n_ as buildAppConfigPath,gE as buildNamespaceParts,hE as buildParameterPath,c as capitalise,AE as categoriseResource,x as cdnDomainExportName,q as defaultConnectedAccountName,yr as defaultFormsCorsOrigin,Kr as defaultFormsFromAddress,IT as deploymentFailureDocsUrl,R_ as deriveAllTargets,G_ as deriveContentHashTag,CT as deriveErrorMessageFromFailure,a_ as deriveRegionsFromOrgConfig,N_ as deriveTargets,h as ec2ServiceName,UT as ensureGitignoreEntries,I_ as environmentOrTier,Xe as environmentToTier,KE as escapeDotEnvValue,O_ as explainRetiredTargetName,PT as extractErrorWindow,pe as filterDangerousEnvVars,w as findAccountNameCollision,s_ as findBoundaryPath,L_ as findInfrastructurePaths,i_ as findTarget,$ as findTrailingRegionShortCode,Oe as fjallCredentialsPath,ie as fjallHomeDir,Ce as fjallLogDir,me as fjallStatePath,ke as formatAccountStageList,te as formatErrorString,C_ as generateTargetName,r as getDomainExportNames,T as getDomainStackName,A as getDomainUsEast1CertificatesStackName,Ze as getEnvironmentLabel,Ae as getErrorCode,re as getErrorMessage,Se as getErrorStack,SE as getExpectedDuration,tE as getFriendlyResourceType,iE as getRegionInfo,M as getSafeZoneName,F as hasAsciiStableConstructKey,Te as hasErrorCode,x_ as hasReservedAppNameSuffix,S as hostsExportPartName,n as imageTagParameterName,c_ as inferContainerFromCandidates,Ve as isAccountStage,ye as isAccountTier,vr as isAddressAtDomain,EE as isBackupTier,wE as isComplianceIssueStatus,dr as isFramework,Be as isGovernanceTier,p_ as isInfrastructureFile,VE as isManageablePath,a as isManagedDomainBinding,Lr as isOpenNextPatternType,ir as isPatternType,U_ as isReservedAppName,xe as mapSettledWithConcurrency,ce as maskSensitiveOutput,H as mintedEc2KeyPairName,_e as normaliseError,nE as optInRegionWarning,NT as parseDeploymentFailure,YE as parseDotEnv,aE as parseGitRemoteUrl,HE as parseParameterPath,Me as parseShellArgs,mr as patternConstructId,J as projectCapacityIdentityToTarget,gr as recommendPatternForFramework,ee as regionSuffixRejectionMessage,PE as regions,Hr as requiredInputsForFramework,we as resolveSynthEnvironment,Tr as schemaGateExitKind,t as serialiseHostsChunks,Pe as singleton,le as sleep,Je as stageFromWireEnvironment,z as suffixedAccountName,sE as suggestRegionForTimezone,_E as tierDefault,mT as toDeploymentFailureAnalysis,s as toKebab,L as toPascalCase,D as toScreamingSnake,p as toValidDatabaseName,$E as upgradeCommand};

package/dist/insights/computePatternFingerprint.d.ts

@@ -3,7 +3,7 @@ import { z } from "zod";
  * Input shape for the cross-recurrence pattern fingerprint used by the
  * Auto-snoozed view pill pipeline.
  *
- * See `aiDocs/designs/2026-04-19-auto-snoozed-pill.md` §4.2. The fingerprint
+ * See the 2026-04-19 auto-snoozed pill design, §4.2. The fingerprint
  * collides intentionally across distinct `insight_id`s representing the same
  * finding class within an org, which is what the 3-in-30d dismissal
  * heuristic aggregates over.

package/dist/migration/clickhouseFrameworkUsers.d.ts

@@ -24,9 +24,8 @@
  * them. SQL-provisioned (not `users.xml`) deliberately: no ClickHouse
  * restart, no `SYSTEM RELOAD USERS` race, zero outage on adoption.
  *
- * Coupled values — must move together per
- * `.claude/rules/code-quality.md § "Coupled values: shared source at 2
- * occurrences"`.
+ * Coupled values — must move together per the shared-source-at-two-occurrences
+ * rule.
  */
 import { z } from "zod";
 /** Read-only identity the materialised schema gate authenticates as. */

package/dist/migration/clickhouseSqlUsers.d.ts

@@ -17,9 +17,8 @@
  * — profiles are bound by customer SQL migrations via
  * `ALTER USER <name> SETTINGS PROFILE '<profile>'`.
  *
- * Coupled values — must move together per
- * `.claude/rules/code-quality.md § "Coupled values: shared source at 2
- * occurrences"`. Lives in `@fjall/util` so the runtime Docker image picks the
+ * Coupled values — must move together per the shared-source-at-two-occurrences
+ * rule. Lives in `@fjall/util` so the runtime Docker image picks the
  * constant + schema up without pulling `aws-cdk-lib`.
  */
 import { z } from "zod";
@@ -42,9 +41,8 @@ export declare const CLICKHOUSE_MANAGED_USERS_ENV: "CLICKHOUSE_MANAGED_USERS";
  * `process.env[userPasswordEnvName(name)]` for each entry in the manifest —
  * no runtime SDK call.
  *
- * Coupled values — must move together per
- * `.claude/rules/code-quality.md § "Coupled values: shared source at 2
- * occurrences"`. Single source-of-truth here so a future shape change
+ * Coupled values — must move together per the shared-source-at-two-occurrences
+ * rule. Single source-of-truth here so a future shape change
  * (`USER_<NAME>_SECRET`, lower-case, prefixed) lands at one site, not three.
  */
 export declare function userPasswordEnvName(userName: string): string;

package/dist/migration/compareSchemaVersion.d.ts

@@ -10,7 +10,7 @@
  * The tolerance exists because expand/contract migrations make an old image safe
  * against a newer schema: rolling the image back without rolling the DB back is
  * the intended expand-only rollback, and a strict-equality gate defeated it by
- * refusing to boot. See `aiDocs/patterns/migration-safety-pattern.md`.
+ * refusing to boot. See the migration-safety pattern.
  */
 /**
  * True when `version` is a monotonically-ordered migration identifier whose

package/dist/naming/ec2Naming.d.ts

@@ -0,0 +1,14 @@
+/**
+ * Names the EC2 compute pattern and construct derive from a compute's name.
+ *
+ * `Ec2Compute` names the `Ec2Instance` it builds `${name}Service`, and the
+ * instance mints a key pair named `${serviceName}KeyPair` when `sshAccess`
+ * omits `keyName`. Synth refuses a `keyName` equal to that minted name (the
+ * switch to an imported reference would make CloudFormation delete the
+ * managed key pair and its stored private key), and the `fjall add` wizard
+ * refuses the same name before the plan is written. Both sides call these
+ * functions rather than compose the strings, so the wizard cannot refuse a
+ * name the construct accepts, or accept one it refuses.
+ */
+export declare function ec2ServiceName(computeName: string): string;
+export declare function mintedEc2KeyPairName(serviceName: string): string;

package/dist/naming/ec2Naming.js

@@ -0,0 +1 @@
+var n=Object.defineProperty;var r=(e,i)=>n(e,"name",{value:i,configurable:!0});function c(e){return`${e}Service`}r(c,"ec2ServiceName");function a(e){return`${e}KeyPair`}r(a,"mintedEc2KeyPairName");export{c as ec2ServiceName,a as mintedEc2KeyPairName};

package/dist/repo/appPath.d.ts

@@ -22,8 +22,8 @@
  * template literals would invite silent CLI/webapp drift if the
  * convention shifts.
  *
- * See `aiDocs/designs/2026-05-11-marker-as-boundary-not-identity.md` and
- * `aiDocs/patterns/fjall-marker-convention-pattern.md` for the
+ * See the 2026-05-11 marker-as-boundary-not-identity design and the
+ * fjall-marker convention pattern for the
  * convention's full topology mapping.
  */
 export declare function buildAppConfigPath(appName: string, container?: string): string;

package/dist/repo/findInfrastructurePaths.d.ts

@@ -15,9 +15,9 @@
  * No I/O. Pure path classification. The structural contract is the function
  * signature; review-time agreement is not load-bearing.
  *
- * See `aiDocs/patterns/fjall-marker-convention-pattern.md` for the convention
- * and `aiDocs/decisions/2026-05-11-scan-parity-contract-vs-structural.md`
- * for the rationale behind extracting this module.
+ * See the fjall-marker convention pattern for the convention and the
+ * 2026-05-11 scan-parity decision (contract vs structural) for the
+ * rationale behind extracting this module.
  */
 import type { ScanPath } from "./scanTypes.js";
 export declare const INFRASTRUCTURE_FILE = "infrastructure.ts";

package/dist/repo/scanLocalRepository.d.ts

@@ -10,7 +10,7 @@
  * the same set as a defence-in-depth contract.
  *
  * Returns the same `{ paths }` shape as the webapp scan so the helpers are
- * consumer-substitutable (`aiDocs/patterns/cross-system-parity-pattern.md`).
+ * consumer-substitutable (the cross-system parity pattern).
  *
  * Walk discipline:
  *   - Symlinks are skipped entirely via `Dirent.isSymbolicLink()` (loop guard).

package/dist/repo/scanTypes.d.ts

@@ -4,7 +4,7 @@
  *
  * Both producers MUST emit the same `{ paths }` shape so the helpers are
  * consumer-substitutable. See
- * `aiDocs/patterns/cross-system-parity-pattern.md`.
+ * the cross-system parity pattern.
  *
  * `ScanPath` carries path information only — no name, no kind. The linker
  * is solely responsible for mapping paths to applications and tier kinds.

package/dist/securityHelpers.d.ts

@@ -54,7 +54,7 @@ export declare const REDACTED_KEY_SENTINEL = "[REDACTED]";
  *
  * Single source of truth — consumer loggers (CLI, worker, webapp) MUST
  * NOT re-implement these patterns inline. See
- * .claude/rules/security-standards.md § "Masking Patterns Live in @fjall/util".
+ * the credential-masking standard, § "Masking Patterns Live in @fjall/util".
  */
 export declare function maskSensitiveOutput(output: string): string;
 /**

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@fjall/util",
-  "version": "33.0.0",
+  "version": "34.0.0",
   "repository": {
     "type": "git",
     "url": "git+https://github.com/fjall-tech/fjall.git",
@@ -141,7 +141,8 @@
     }
   },
   "files": [
-    "dist/"
+    "dist/",
+    "!dist/.build-source-hash"
   ],
   "publishConfig": {
     "access": "public"
@@ -149,8 +150,10 @@
   "scripts": {
     "clean": "rm -rf ./dist ./sourcemaps",
     "clean:node": "rm -rf ./node_modules",
-    "build": "npm run clean && npx tsc && node ../scripts/minify-dist.mjs dist && node ../scripts/stamp-build.mjs",
+    "build": "node ../scripts/run-build.mjs --purpose=build -- npm run build:steps",
+    "build:steps": "npm run clean && npx tsc && node ../scripts/minify-dist.mjs dist && node ../scripts/stamp-build.mjs",
     "prepack": "node ../scripts/check-dist-freshness.mjs",
+    "prepublishOnly": "node ../scripts/audit-package-tarball.mjs",
     "watch": "npm run build && npx tsc-watch",
     "watch:only": "npx tsc-watch",
     "format": "prettier --write \"src/**/*.{ts,tsx,js,jsx,json}\"",

package/dist/.build-source-hash

@@ -1,143 +0,0 @@
-{
-  "version": 2,
-  "algorithm": "sha256",
-  "sources": [
-    "src"
-  ],
-  "extraFiles": [
-    "../scripts/minify-dist.mjs",
-    "package.json",
-    "tsconfig.json"
-  ],
-  "hash": "f3d44a1bfafa66fa7a658d6acf9a1adbba981638c012feb94e794e5182502c3d",
-  "files": {
-    "src/async/concurrency.ts": "3c7ebe0222a720f9",
-    "src/async/singleton.ts": "7bcc21b0fb920561",
-    "src/async/sleep.ts": "df52b17675ec3ed2",
-    "src/atomicTempNaming.ts": "d08f34bdb062be6f",
-    "src/aws/CloudFormationFailureAnalyser.ts": "4e68b353171edd31",
-    "src/aws/cloudformationTypes.ts": "e43bab9c96a21856",
-    "src/aws/costAllocationTags.ts": "56cb9593dab3027b",
-    "src/aws/deployProgress.ts": "be09dedb4deb9a7a",
-    "src/aws/driftSuspects.ts": "ca30b2de3ed84ab3",
-    "src/aws/errors.ts": "5addfa6bb2d1456a",
-    "src/aws/failureAnalysisCategories.ts": "85ab1632d8069273",
-    "src/aws/index.ts": "ce3da231274defdf",
-    "src/aws/infraTags.ts": "ba9442248b8a0ef4",
-    "src/aws/ipamTags.ts": "ac19ecd6c36b3bc2",
-    "src/aws/maskFailureAnalysis.ts": "ae11250412cd6fd8",
-    "src/aws/monitoringRole.ts": "70c8b5947dc9138d",
-    "src/backupTiers.ts": "981677b7cf1ff5b9",
-    "src/buildConcurrency.ts": "1804e76ddc4f8216",
-    "src/capacityIdentity.ts": "9e59bfc92a5ba361",
-    "src/cdkTmpdirCleanup.ts": "4574b3f10e3ab0f9",
-    "src/cdkToolchain.ts": "a6b996c60b87d644",
-    "src/cfn/physicalNameProperties.ts": "35d3c6f28079c593",
-    "src/clickhouse.ts": "655c74cdba292c29",
-    "src/complianceIssue.ts": "10ea87dfb4c0e849",
-    "src/config.ts": "6e15344c1d4a79fe",
-    "src/configPaths.ts": "afcc2e4ceb6652a0",
-    "src/constructMap.ts": "b81fc8e90015467f",
-    "src/deploy/approvalTokenOutput.ts": "4be7b52825d88a37",
-    "src/devSubstrate/entrypoint.ts": "0526b88258174aa6",
-    "src/devSubstrate/params.ts": "43bf902b57eb9edd",
-    "src/diagnostics/controlSequences.ts": "cb1cc3f29f041371",
-    "src/diagnostics/index.ts": "249d04cb4dd7db35",
-    "src/docker/DockerCli.build.ts": "93a74294437cc002",
-    "src/docker/DockerCli.daemon.ts": "11b9c3352c957d7c",
-    "src/docker/DockerCli.registry.ts": "f8dfcf1d7e413014",
-    "src/docker/DockerCli.ts": "3d2697c355b102d5",
-    "src/docker/abortHelpers.ts": "76daf48e617b8ec8",
-    "src/docker/architecture.ts": "305d87b68b905694",
-    "src/docker/bakeGuard.ts": "fc4120fb97756ddb",
-    "src/docker/buildArgInference.ts": "611dc5cb52b63f75",
-    "src/docker/buildxArgvBuilder.ts": "0ccc37cf5aaae62c",
-    "src/docker/buildxBuildMonitor.ts": "27c7b921901a9759",
-    "src/docker/cacheRepository.ts": "fae19107a3adbf13",
-    "src/docker/dockerCliConstants.ts": "2c216f214f466307",
-    "src/docker/dockerCliDiagnostics.ts": "250bc882b75d7bcc",
-    "src/docker/dockerCliSchemas.ts": "af1e89eb8ecd7023",
-    "src/docker/dockerErrorFormat.ts": "332dedf7ea3589c2",
-    "src/docker/ecrCredentialStore.ts": "0a99f7155dad5894",
-    "src/docker/index.ts": "f189b4e9967ab8c0",
-    "src/docker/metadataFileParser.ts": "299bc37a12c4594b",
-    "src/docker/projectBuildxResult.ts": "f462ba365b7ccdcc",
-    "src/docker/rawjsonParser.ts": "b9e5218abc326fa5",
-    "src/docker/rawjsonToVertexEvent.ts": "a356190727f0d1a4",
-    "src/docker/result.ts": "2ff0d59a3add8b06",
-    "src/environments.ts": "a05afb198a7b67ce",
-    "src/errorUtils.ts": "c601f2905c74b8d0",
-    "src/errors/absence.ts": "390fea350ffbb4e5",
-    "src/failure/deploymentFailure.ts": "5824db1d97d01838",
-    "src/failure/extractErrorWindow.ts": "ca41f90946fa939c",
-    "src/fjallHome.ts": "032df8e58d7e29cd",
-    "src/fsHelpers.ts": "4dd3877b3953c6a9",
-    "src/fsScan.ts": "feb187758481443f",
-    "src/httpKeepAlive.ts": "c8fe4b118ef4c79f",
-    "src/index.ts": "cfc916bee8f13029",
-    "src/infra/backupVault.ts": "661678a6dfb0b648",
-    "src/infra/connectionsWire.ts": "e3afa3ba95a531d8",
-    "src/infra/deployArtefacts.ts": "235ac21dd3ccf0b2",
-    "src/infra/deriveContentHashTag.ts": "115fbe6588794027",
-    "src/infra/domainExports.ts": "18de5b8668633aaf",
-    "src/infra/imageTags.ts": "82d14f3dfd6ca68f",
-    "src/infra/regions.ts": "982acfd56adf04c2",
-    "src/infra/tokenScopes.ts": "68f0152394fb416e",
-    "src/insights/computePatternFingerprint.ts": "b5d3a4704f42cc1f",
-    "src/logRotation.ts": "5ea989894082107b",
-    "src/logger.ts": "865ec4ec62a9a588",
-    "src/manifest/index.ts": "bfa2930556c2f8ad",
-    "src/manifest/io.ts": "915ab602ac92d126",
-    "src/manifest/schemas.ts": "21dce8ba66b1230f",
-    "src/mcpProtocol/index.ts": "55df3209915a5043",
-    "src/migration/clickhouseFrameworkUsers.ts": "4bd55a96d4fddff4",
-    "src/migration/clickhouseSqlUsers.ts": "c916e148367715bb",
-    "src/migration/compareSchemaVersion.ts": "1c9247e722ec5d5b",
-    "src/migration/constants.ts": "5c585a455ba56d95",
-    "src/migration/controlPlaneActivity.ts": "c7ba33958f9fcbcc",
-    "src/migration/index.ts": "dc711329d0060213",
-    "src/migration/pickLatestClickHouseMigration.ts": "a5b4a00ba63522cb",
-    "src/migration/pickLatestPrismaMigration.ts": "cbddc2950f4d4c85",
-    "src/migration/schemaGateExit.ts": "53f26d02b798a475",
-    "src/migration/sleepAbortable.ts": "71c7e7cc59406e2a",
-    "src/migration/verifyExpectedSchemaVersion.ts": "cd583329d771a047",
-    "src/naming/accountNameCollision.ts": "2dc8b278ff039220",
-    "src/naming/caseConversion.ts": "8b8984f2b58b8ab7",
-    "src/naming/connectedAccountName.ts": "2290e0020d4335b0",
-    "src/naming/reservedAppNames.ts": "7f63dd0b84c1972e",
-    "src/naming/targetExportNames.ts": "da78a19d8b2d4a6f",
-    "src/onboarding/index.ts": "7999117c5a7a18d1",
-    "src/onboarding/versionCurrency.ts": "19695f38b09cfc46",
-    "src/organisationBinding/apiBaseUrl.ts": "ad71ded9b42c95c6",
-    "src/organisationBinding/binding.ts": "d542bb92999d50ef",
-    "src/organisationBinding/cachedCredentialIdentity.ts": "f370024fe414949f",
-    "src/organisationBinding/credentialFingerprint.ts": "ae7fff52b70ba09a",
-    "src/organisationBinding/index.ts": "db0c6c2b73b6ea22",
-    "src/patterns/frameworkPatterns.ts": "0f843cb043eb11fc",
-    "src/patterns/index.ts": "8c765d60d672f7f7",
-    "src/patterns/patternTypes.ts": "549b06ec2a3a696e",
-    "src/patterns/staticSiteForms.ts": "86ffcf142d9a8eac",
-    "src/repo/appPath.ts": "9aa0d01262b88e65",
-    "src/repo/findInfrastructurePaths.ts": "dd1245f5d4004dd5",
-    "src/repo/findProjectsBelow.ts": "0ee63f2910a47a89",
-    "src/repo/findRepoRoot.ts": "6007be0f7d3407b1",
-    "src/repo/gitRemoteParser.ts": "2e1407d1d120baff",
-    "src/repo/inferContainerFromCandidates.ts": "63df34e7e5e65b34",
-    "src/repo/scanLocalRepository.ts": "c7bc76201622a7a5",
-    "src/repo/scanTypes.ts": "1fda805a7d8de93b",
-    "src/resourceCategorisation.ts": "a140d1b3cb38be33",
-    "src/rootConfigMerge.ts": "e5085a5ae802647d",
-    "src/rootConfigSchema.ts": "5751173d999c0690",
-    "src/scaffold/ensureGitignore.ts": "178a2c3b2c18bc83",
-    "src/scaffold/gitignore.ts": "87c66797a4bd05f2",
-    "src/secrets.ts": "50258d463e4e67c3",
-    "src/securityHelpers.ts": "1e68e1330c6da971",
-    "src/staticSiteOutput.ts": "cc81ed32acc597f1",
-    "src/targets.ts": "b4bdf07f06755374",
-    "../scripts/minify-dist.mjs": "6b2e4b0df8aec601",
-    "package.json": "8d5da0aef9c1c0a8",
-    "tsconfig.json": "edfc9d9fbd0729d2"
-  },
-  "outputHash": "68b436c9d0b584458b0ddc561afc8b16af863e97b1af2e4c165e57fabbf9ead7",
-  "outputFileCount": 247
-}