@fjall/util 36.0.0 → 38.0.0

package/dist/.minified

@@ -1 +1 @@
-129 files minified at 2026-09-10T10:35:24.637Z
+136 files minified at 2026-09-18T21:39:28.638Z

package/dist/appTypes.d.ts

@@ -0,0 +1,27 @@
+/**
+ * The infrastructure tier vocabulary — what `fjall apps create --type` accepts,
+ * and the ONE spelling the generator's `AppTypeSchema`, the CLI's
+ * `commandSchemas.ts` and the MCP's `plan_app_scaffold` input all derive from.
+ *
+ * Not the pattern tiers (`PATTERN_TIER_VALUES`: lightweight … custom), which
+ * govern `--pattern-tier`. The two vocabularies overlap on three members and
+ * were conflated on the MCP surface until Train 4 of the 2026-09-07 hardening
+ * prompt; keeping both here, each naming the other, is what stops the next
+ * reader picking whichever tuple is nearer.
+ *
+ * The MCP shells out to the CLI and can import neither it nor the generator at
+ * runtime, so util is the seam all three read — the same rationale as
+ * `ciSetup.ts` and `patterns/patternTypes.ts`.
+ *
+ * Client-safe (no node built-ins) — exported from the root barrel.
+ */
+export declare const INFRASTRUCTURE_TIER_NAMES: readonly ["tinkerer", "lightweight", "standard", "resilient", "enterprise"];
+export type InfrastructureTierName = (typeof INFRASTRUCTURE_TIER_NAMES)[number];
+/**
+ * The escape hatch: an app that declares its own resources rather than taking
+ * a tier preset. A member of `APP_TYPES`, never of the tier tuple — the presets
+ * are a `Record<InfrastructureTierName, …>` and `custom` has no preset row.
+ */
+export declare const CUSTOM_APP_TYPE: "custom";
+export declare const APP_TYPES: readonly ["tinkerer", "lightweight", "standard", "resilient", "enterprise", "custom"];
+export type AppType = (typeof APP_TYPES)[number];

package/dist/appTypes.js

@@ -0,0 +1 @@
+const t=["tinkerer","lightweight","standard","resilient","enterprise"],e="custom",r=[...t,e];export{r as APP_TYPES,e as CUSTOM_APP_TYPE,t as INFRASTRUCTURE_TIER_NAMES};

package/dist/aws/index.d.ts

@@ -1,11 +1,12 @@
 export { AWSError, NoRolesFoundError, InvalidCredentialsError, SSOTokenExpiredError, MissingRegionError, ProfileNotFoundError, CommandError, isAWSError, isNoRolesFoundError, isSSOUnauthorizedError } from "./errors.js";
 export { STACK_NOT_FOUND_PATTERN, CDK_NO_STACKS_MATCH, type ResourceEvent, isResourceEvent } from "./cloudformationTypes.js";
+export { AWS_RESOURCE_TYPES, type AwsResourceType, isAwsResourceType } from "./resourceTypes.js";
 export { type ResourceProgressCounts, countResourceProgress, formatElapsed } from "./deployProgress.js";
 export { CloudFormationFailureAnalyser, type RootCause, type FailureAnalysis } from "./CloudFormationFailureAnalyser.js";
 export { FAILURE_ANALYSIS_CATEGORIES, type FailureAnalysisCategory } from "./failureAnalysisCategories.js";
 export { maskFailureAnalysis } from "./maskFailureAnalysis.js";
 export { classifyDriftSuspectEvents, findCurrentOperationStart, isDriftSuspectReason, isOperationOpeningEvent, type DriftSuspectEvent } from "./driftSuspects.js";
 export { IPAM_OPERATIONS_POOL_TAG_KEY, formatIpamPairTagValue } from "./ipamTags.js";
-export { FJALL_RESOURCE_TYPE_TAG_KEY, FJALL_RESOURCE_TYPES, type FjallResourceType, KMS_RETENTION_TAG_KEY, S3_VERSIONING_EXEMPT_TAG_KEY, S3_VERSIONING_EXEMPTIONS, SDK_PRE_EMPTY_TAG_KEY, type S3VersioningExemption } from "./infraTags.js";
+export { FJALL_RESOURCE_TYPE_TAG_KEY, FJALL_RESOURCE_TYPES, type FjallResourceType, KMS_ALIAS_TAG_KEY, KMS_RETENTION_TAG_KEY, S3_VERSIONING_EXEMPT_TAG_KEY, S3_VERSIONING_EXEMPTIONS, SDK_PRE_EMPTY_TAG_KEY, type S3VersioningExemption } from "./infraTags.js";
 export { COST_ALLOCATION_TAGS, DEFAULT_COST_ALLOCATION_ENVIRONMENT, DEFAULT_COST_ALLOCATION_OWNER, ecrCreateRepositoryTags, rdsPreMigrationSnapshotTags, type AwsSdkTag, type EcrCreateTag } from "./costAllocationTags.js";
 export { ACCOUNT_MONITORING_ROLE_NAME } from "./monitoringRole.js";

package/dist/aws/index.js

@@ -1 +1 @@
-import{AWSError as E,NoRolesFoundError as e,InvalidCredentialsError as _,SSOTokenExpiredError as T,MissingRegionError as t,ProfileNotFoundError as O,CommandError as A,isAWSError as s,isNoRolesFoundError as S,isSSOUnauthorizedError as i}from"./errors.js";import{STACK_NOT_FOUND_PATTERN as N,CDK_NO_STACKS_MATCH as n,isResourceEvent as R}from"./cloudformationTypes.js";import{countResourceProgress as C,formatElapsed as I}from"./deployProgress.js";import{CloudFormationFailureAnalyser as m}from"./CloudFormationFailureAnalyser.js";import{FAILURE_ANALYSIS_CATEGORIES as u}from"./failureAnalysisCategories.js";import{maskFailureAnalysis as l}from"./maskFailureAnalysis.js";import{classifyDriftSuspectEvents as x,findCurrentOperationStart as F,isDriftSuspectReason as M,isOperationOpeningEvent as G}from"./driftSuspects.js";import{IPAM_OPERATIONS_POOL_TAG_KEY as Y,formatIpamPairTagValue as g}from"./ipamTags.js";import{FJALL_RESOURCE_TYPE_TAG_KEY as c,FJALL_RESOURCE_TYPES as D,KMS_RETENTION_TAG_KEY as v,S3_VERSIONING_EXEMPT_TAG_KEY as y,S3_VERSIONING_EXEMPTIONS as V,SDK_PRE_EMPTY_TAG_KEY as W}from"./infraTags.js";import{COST_ALLOCATION_TAGS as k,DEFAULT_COST_ALLOCATION_ENVIRONMENT as J,DEFAULT_COST_ALLOCATION_OWNER as X,ecrCreateRepositoryTags as z,rdsPreMigrationSnapshotTags as H}from"./costAllocationTags.js";import{ACCOUNT_MONITORING_ROLE_NAME as j}from"./monitoringRole.js";export{j as ACCOUNT_MONITORING_ROLE_NAME,E as AWSError,n as CDK_NO_STACKS_MATCH,k as COST_ALLOCATION_TAGS,m as CloudFormationFailureAnalyser,A as CommandError,J as DEFAULT_COST_ALLOCATION_ENVIRONMENT,X as DEFAULT_COST_ALLOCATION_OWNER,u as FAILURE_ANALYSIS_CATEGORIES,D as FJALL_RESOURCE_TYPES,c as FJALL_RESOURCE_TYPE_TAG_KEY,Y as IPAM_OPERATIONS_POOL_TAG_KEY,_ as InvalidCredentialsError,v as KMS_RETENTION_TAG_KEY,t as MissingRegionError,e as NoRolesFoundError,O as ProfileNotFoundError,V as S3_VERSIONING_EXEMPTIONS,y as S3_VERSIONING_EXEMPT_TAG_KEY,W as SDK_PRE_EMPTY_TAG_KEY,T as SSOTokenExpiredError,N as STACK_NOT_FOUND_PATTERN,x as classifyDriftSuspectEvents,C as countResourceProgress,z as ecrCreateRepositoryTags,F as findCurrentOperationStart,I as formatElapsed,g as formatIpamPairTagValue,s as isAWSError,M as isDriftSuspectReason,S as isNoRolesFoundError,G as isOperationOpeningEvent,R as isResourceEvent,i as isSSOUnauthorizedError,l as maskFailureAnalysis,H as rdsPreMigrationSnapshotTags};
+import{AWSError as E,NoRolesFoundError as e,InvalidCredentialsError as _,SSOTokenExpiredError as T,MissingRegionError as A,ProfileNotFoundError as S,CommandError as t,isAWSError as O,isNoRolesFoundError as s,isSSOUnauthorizedError as i}from"./errors.js";import{STACK_NOT_FOUND_PATTERN as N,CDK_NO_STACKS_MATCH as n,isResourceEvent as R}from"./cloudformationTypes.js";import{AWS_RESOURCE_TYPES as C,isAwsResourceType as I}from"./resourceTypes.js";import{countResourceProgress as m,formatElapsed as L}from"./deployProgress.js";import{CloudFormationFailureAnalyser as P}from"./CloudFormationFailureAnalyser.js";import{FAILURE_ANALYSIS_CATEGORIES as x}from"./failureAnalysisCategories.js";import{maskFailureAnalysis as F}from"./maskFailureAnalysis.js";import{classifyDriftSuspectEvents as M,findCurrentOperationStart as G,isDriftSuspectReason as Y,isOperationOpeningEvent as U}from"./driftSuspects.js";import{IPAM_OPERATIONS_POOL_TAG_KEY as g,formatIpamPairTagValue as D}from"./ipamTags.js";import{FJALL_RESOURCE_TYPE_TAG_KEY as v,FJALL_RESOURCE_TYPES as V,KMS_ALIAS_TAG_KEY as W,KMS_RETENTION_TAG_KEY as h,S3_VERSIONING_EXEMPT_TAG_KEY as k,S3_VERSIONING_EXEMPTIONS as J,SDK_PRE_EMPTY_TAG_KEY as X}from"./infraTags.js";import{COST_ALLOCATION_TAGS as z,DEFAULT_COST_ALLOCATION_ENVIRONMENT as H,DEFAULT_COST_ALLOCATION_OWNER as b,ecrCreateRepositoryTags as j,rdsPreMigrationSnapshotTags as q}from"./costAllocationTags.js";import{ACCOUNT_MONITORING_ROLE_NAME as Q}from"./monitoringRole.js";export{Q as ACCOUNT_MONITORING_ROLE_NAME,E as AWSError,C as AWS_RESOURCE_TYPES,n as CDK_NO_STACKS_MATCH,z as COST_ALLOCATION_TAGS,P as CloudFormationFailureAnalyser,t as CommandError,H as DEFAULT_COST_ALLOCATION_ENVIRONMENT,b as DEFAULT_COST_ALLOCATION_OWNER,x as FAILURE_ANALYSIS_CATEGORIES,V as FJALL_RESOURCE_TYPES,v as FJALL_RESOURCE_TYPE_TAG_KEY,g as IPAM_OPERATIONS_POOL_TAG_KEY,_ as InvalidCredentialsError,W as KMS_ALIAS_TAG_KEY,h as KMS_RETENTION_TAG_KEY,A as MissingRegionError,e as NoRolesFoundError,S as ProfileNotFoundError,J as S3_VERSIONING_EXEMPTIONS,k as S3_VERSIONING_EXEMPT_TAG_KEY,X as SDK_PRE_EMPTY_TAG_KEY,T as SSOTokenExpiredError,N as STACK_NOT_FOUND_PATTERN,M as classifyDriftSuspectEvents,m as countResourceProgress,j as ecrCreateRepositoryTags,G as findCurrentOperationStart,L as formatElapsed,D as formatIpamPairTagValue,O as isAWSError,I as isAwsResourceType,Y as isDriftSuspectReason,s as isNoRolesFoundError,U as isOperationOpeningEvent,R as isResourceEvent,i as isSSOUnauthorizedError,F as maskFailureAnalysis,q as rdsPreMigrationSnapshotTags};

package/dist/aws/infraTags.d.ts

@@ -32,6 +32,24 @@ export declare const SDK_PRE_EMPTY_TAG_KEY = "fjall:sdk-pre-empty";
  * `__tests__/infraTags.test.ts` guards against casual renames.
  */
 export declare const KMS_RETENTION_TAG_KEY = "fjall:kms:retention";
+/**
+ * The KMS alias marker tag, stamped beside [[KMS_RETENTION_TAG_KEY]] on every
+ * retained key and valued with the key's alias name as `kms list-aliases`
+ * reports it (`alias/cmk/<stack>/FjallStackEncryptionKey`).
+ *
+ * A retained key outlives its stack; its `AWS::KMS::Alias` does not — the
+ * alias is an ordinary stack resource and goes with the stack delete — and
+ * CloudFormation stamps none of its `aws:cloudformation:*` tags on KMS keys.
+ * So once the stack is gone nothing but this tag says which key a stack's
+ * `FjallStackEncryptionKey` was. The deploy-test harness reads it back
+ * (`deploy-tests/lib/releaseStackKeys.mts`) to find the stack keys a
+ * torn-down suite retained, and a posture scan can name a stray key's
+ * origin by it.
+ *
+ * Deployed infrastructure state, pinned like its sibling: a rename would
+ * strip every retained key of its origin until the next deploy.
+ */
+export declare const KMS_ALIAS_TAG_KEY = "fjall:kms:alias";
 /**
  * The Fjall resource-type marker tag key, shared by producers and consumers:
  *

package/dist/aws/infraTags.js

@@ -1 +1 @@
-const e="fjall:sdk-pre-empty",t="fjall:kms:retention",r="fjall:resource:type",p={vpcPeering:"vpc-peering",vpcPeeringAccepter:"vpc-peering-accepter",deployTimeWriter:"deploy-time-writer"},c="fjall:s3:versioning-exempt",o=["build-output","isr-cache","cold-tier","access-logs"];export{p as FJALL_RESOURCE_TYPES,r as FJALL_RESOURCE_TYPE_TAG_KEY,t as KMS_RETENTION_TAG_KEY,o as S3_VERSIONING_EXEMPTIONS,c as S3_VERSIONING_EXEMPT_TAG_KEY,e as SDK_PRE_EMPTY_TAG_KEY};
+const e="fjall:sdk-pre-empty",t="fjall:kms:retention",r="fjall:kms:alias",o="fjall:resource:type",p={vpcPeering:"vpc-peering",vpcPeeringAccepter:"vpc-peering-accepter",deployTimeWriter:"deploy-time-writer"},_="fjall:s3:versioning-exempt",c=["build-output","isr-cache","cold-tier","access-logs"];export{p as FJALL_RESOURCE_TYPES,o as FJALL_RESOURCE_TYPE_TAG_KEY,r as KMS_ALIAS_TAG_KEY,t as KMS_RETENTION_TAG_KEY,c as S3_VERSIONING_EXEMPTIONS,_ as S3_VERSIONING_EXEMPT_TAG_KEY,e as SDK_PRE_EMPTY_TAG_KEY};

package/dist/aws/resourceTypes.d.ts

@@ -0,0 +1,54 @@
+/**
+ * The resource-type literals Fjall's posture surfaces speak in: what the
+ * scan stores as an asset's resource type, what a compliance rule lists as
+ * the types it judges, and the vocabulary the policy registries' `kind`
+ * column is drawn from (`POLICY_RESOURCE_KINDS`). One table, keyed by a
+ * screaming-snake name, so a row's kind, a rule's list and an asset's
+ * stored type compare by equality — never through a mapping that could
+ * drift. The spelling is CloudFormation's `AWS::Service::Type` and most
+ * entries are CloudFormation's own; four are the scan's (`AWS::EBS::Volume`,
+ * `AWS::ACM::Certificate`, `AWS::ECS::Task`, `AWS::RDS::DBSnapshot` — types
+ * CloudFormation spells differently or does not have), so an entry is never
+ * corrected against the CloudFormation registry: the stored vocabulary is
+ * the contract. A type joins the table when a surface needs it, and nothing
+ * here imports a node built-in, so the browser-facing subpaths may read it.
+ */
+export declare const AWS_RESOURCE_TYPES: {
+    readonly EC2_INSTANCE: "AWS::EC2::Instance";
+    readonly EC2_SECURITY_GROUP: "AWS::EC2::SecurityGroup";
+    readonly EC2_VPC: "AWS::EC2::VPC";
+    readonly EC2_SUBNET: "AWS::EC2::Subnet";
+    readonly EC2_NETWORK_INTERFACE: "AWS::EC2::NetworkInterface";
+    readonly EBS_VOLUME: "AWS::EBS::Volume";
+    readonly RDS_DB_INSTANCE: "AWS::RDS::DBInstance";
+    readonly RDS_DB_CLUSTER: "AWS::RDS::DBCluster";
+    readonly RDS_DB_SNAPSHOT: "AWS::RDS::DBSnapshot";
+    readonly S3_BUCKET: "AWS::S3::Bucket";
+    readonly LAMBDA_FUNCTION: "AWS::Lambda::Function";
+    readonly ECS_CLUSTER: "AWS::ECS::Cluster";
+    readonly ECS_SERVICE: "AWS::ECS::Service";
+    readonly ECS_TASK: "AWS::ECS::Task";
+    readonly ECS_TASK_DEFINITION: "AWS::ECS::TaskDefinition";
+    readonly DYNAMODB_TABLE: "AWS::DynamoDB::Table";
+    readonly CLOUDFRONT_DISTRIBUTION: "AWS::CloudFront::Distribution";
+    readonly IAM_ROLE: "AWS::IAM::Role";
+    readonly IAM_POLICY: "AWS::IAM::Policy";
+    readonly IAM_USER: "AWS::IAM::User";
+    readonly IAM_GROUP: "AWS::IAM::Group";
+    readonly KMS_KEY: "AWS::KMS::Key";
+    readonly CLOUDTRAIL_TRAIL: "AWS::CloudTrail::Trail";
+    readonly CLOUDWATCH_ALARM: "AWS::CloudWatch::Alarm";
+    readonly LOGS_LOG_GROUP: "AWS::Logs::LogGroup";
+    readonly SNS_TOPIC: "AWS::SNS::Topic";
+    readonly SQS_QUEUE: "AWS::SQS::Queue";
+    readonly APIGATEWAYV2_API: "AWS::ApiGatewayV2::Api";
+    readonly SECRETS_MANAGER_SECRET: "AWS::SecretsManager::Secret";
+    readonly ACM_CERTIFICATE: "AWS::ACM::Certificate";
+    readonly ELBV2_LOAD_BALANCER: "AWS::ElasticLoadBalancingV2::LoadBalancer";
+    readonly ELASTICACHE_CLUSTER: "AWS::ElastiCache::CacheCluster";
+    readonly ROUTE53_HOSTED_ZONE: "AWS::Route53::HostedZone";
+    readonly BACKUP_VAULT: "AWS::Backup::BackupVault";
+};
+export type AwsResourceType = (typeof AWS_RESOURCE_TYPES)[keyof typeof AWS_RESOURCE_TYPES];
+/** Membership in the table, and nothing else: case and shape are not judged. */
+export declare function isAwsResourceType(value: unknown): value is AwsResourceType;

package/dist/aws/resourceTypes.js

@@ -0,0 +1 @@
+var C=Object.defineProperty;var A=(S,E)=>C(S,"name",{value:E,configurable:!0});const _={EC2_INSTANCE:"AWS::EC2::Instance",EC2_SECURITY_GROUP:"AWS::EC2::SecurityGroup",EC2_VPC:"AWS::EC2::VPC",EC2_SUBNET:"AWS::EC2::Subnet",EC2_NETWORK_INTERFACE:"AWS::EC2::NetworkInterface",EBS_VOLUME:"AWS::EBS::Volume",RDS_DB_INSTANCE:"AWS::RDS::DBInstance",RDS_DB_CLUSTER:"AWS::RDS::DBCluster",RDS_DB_SNAPSHOT:"AWS::RDS::DBSnapshot",S3_BUCKET:"AWS::S3::Bucket",LAMBDA_FUNCTION:"AWS::Lambda::Function",ECS_CLUSTER:"AWS::ECS::Cluster",ECS_SERVICE:"AWS::ECS::Service",ECS_TASK:"AWS::ECS::Task",ECS_TASK_DEFINITION:"AWS::ECS::TaskDefinition",DYNAMODB_TABLE:"AWS::DynamoDB::Table",CLOUDFRONT_DISTRIBUTION:"AWS::CloudFront::Distribution",IAM_ROLE:"AWS::IAM::Role",IAM_POLICY:"AWS::IAM::Policy",IAM_USER:"AWS::IAM::User",IAM_GROUP:"AWS::IAM::Group",KMS_KEY:"AWS::KMS::Key",CLOUDTRAIL_TRAIL:"AWS::CloudTrail::Trail",CLOUDWATCH_ALARM:"AWS::CloudWatch::Alarm",LOGS_LOG_GROUP:"AWS::Logs::LogGroup",SNS_TOPIC:"AWS::SNS::Topic",SQS_QUEUE:"AWS::SQS::Queue",APIGATEWAYV2_API:"AWS::ApiGatewayV2::Api",SECRETS_MANAGER_SECRET:"AWS::SecretsManager::Secret",ACM_CERTIFICATE:"AWS::ACM::Certificate",ELBV2_LOAD_BALANCER:"AWS::ElasticLoadBalancingV2::LoadBalancer",ELASTICACHE_CLUSTER:"AWS::ElastiCache::CacheCluster",ROUTE53_HOSTED_ZONE:"AWS::Route53::HostedZone",BACKUP_VAULT:"AWS::Backup::BackupVault"},e=new Set(Object.values(_));function W(S){return typeof S=="string"&&e.has(S)}A(W,"isAwsResourceType");export{_ as AWS_RESOURCE_TYPES,W as isAwsResourceType};

package/dist/backupTiers.d.ts

@@ -70,7 +70,10 @@ export interface BackupTierDefaults {
      * lifecycle-expired access-log bucket.
      */
     readonly albAccessLogs: boolean;
-    /** CloudFront standard (legacy) logging to the same access-log bucket. */
+    /**
+     * CloudFront standard logging (v2, CloudWatch-vended) to the same
+     * access-log bucket, as JSON.
+     */
     readonly cloudFrontLogging: boolean;
     /** Lambda active X-Ray tracing. */
     readonly lambdaTracing: boolean;
@@ -88,7 +91,31 @@ export interface BackupTierDefaults {
  */
 export declare const BACKUP_TIER_DEFAULTS: Readonly<Record<BackupTier, BackupTierDefaults>>;
 /**
- * The tier-owned default for one knob. An undefined tier (no `backup` on the
- * App, or `backup: false`) reads the `standard` column.
+ * The column an app with no tier (no `backup` on the App, or `backup: false`)
+ * runs. Declaring it is free by construction — the same defaults plus the DR
+ * tag — which is why the webapp's posture cure proposes exactly this tier.
+ */
+export declare const DEFAULT_BACKUP_TIER = "standard";
+/**
+ * The tier-owned default for one knob. An undefined tier reads the
+ * [[DEFAULT_BACKUP_TIER]] column.
  */
 export declare function tierDefault<K extends keyof BackupTierDefaults>(tier: BackupTier | undefined, knob: K): BackupTierDefaults[K];
+/**
+ * The tag key AWS Backup plan selection rules match on. The constructs stamp
+ * it (`App.applyBackupTier()` app-wide, `StandardTagsAspect` per resource,
+ * `BackupPlan` as the selection key). The webapp's posture rules
+ * (`assetParser`, `missing-dr-tier-tag`) read it back from discovered
+ * resources and re-spell it until they import this — TODO 2026-09-14,
+ * owner: paul — tracked in the 2026-09-05 remediation-raises build
+ * prompt, § 10 Train E-webapp record ("util fold").
+ */
+export declare const BACKUP_TIER_TAG_KEY = "fjall:disasterRecovery:tier";
+/**
+ * Application backup tier → AWS Backup plan tag VALUE. `standard` maps to
+ * `default` (the plan every untiered resource joins), the other tiers to
+ * their own name. `Record<BackupTier, string>` is the presence guard: a new
+ * tier without a row fails typecheck here. The webapp's tag-value vocabulary
+ * re-spells these until it imports this map — same TODO as the key above.
+ */
+export declare const BACKUP_TIER_TAG_MAP: Readonly<Record<BackupTier, string>>;

package/dist/backupTiers.js

@@ -1 +1 @@
-var n=Object.defineProperty;var s=(e,t)=>n(e,"name",{value:t,configurable:!0});import{z as r}from"zod";const a=["standard","resilient","enterprise"],l=r.enum(a),o=new Set(a);function u(e){return o.has(e)}s(u,"isBackupTier");const i=Object.freeze({standard:Object.freeze({s3Versioned:!1,rdsBackupRetentionDays:14,deletionProtection:!1,customerManagedKeys:!1,containerInsights:!1,albAccessLogs:!1,cloudFrontLogging:!1,lambdaTracing:!1,databaseInsightsMode:"standard"}),resilient:Object.freeze({s3Versioned:!0,rdsBackupRetentionDays:30,deletionProtection:!0,customerManagedKeys:!1,containerInsights:!1,albAccessLogs:!1,cloudFrontLogging:!1,lambdaTracing:!1,databaseInsightsMode:"standard"}),enterprise:Object.freeze({s3Versioned:!0,rdsBackupRetentionDays:35,deletionProtection:!0,customerManagedKeys:!0,containerInsights:!0,albAccessLogs:!0,cloudFrontLogging:!0,lambdaTracing:!0,databaseInsightsMode:"advanced"})});function g(e,t){return i[e??"standard"][t]}s(g,"tierDefault");export{a as BACKUP_TIERS,i as BACKUP_TIER_DEFAULTS,l as BackupTierSchema,u as isBackupTier,g as tierDefault};
+var a=Object.defineProperty;var s=(e,t)=>a(e,"name",{value:t,configurable:!0});import{z as n}from"zod";const r=["standard","resilient","enterprise"],u=n.enum(r),o=new Set(r);function g(e){return o.has(e)}s(g,"isBackupTier");const i=Object.freeze({standard:Object.freeze({s3Versioned:!1,rdsBackupRetentionDays:14,deletionProtection:!1,customerManagedKeys:!1,containerInsights:!1,albAccessLogs:!1,cloudFrontLogging:!1,lambdaTracing:!1,databaseInsightsMode:"standard"}),resilient:Object.freeze({s3Versioned:!0,rdsBackupRetentionDays:30,deletionProtection:!0,customerManagedKeys:!1,containerInsights:!1,albAccessLogs:!1,cloudFrontLogging:!1,lambdaTracing:!1,databaseInsightsMode:"standard"}),enterprise:Object.freeze({s3Versioned:!0,rdsBackupRetentionDays:35,deletionProtection:!0,customerManagedKeys:!0,containerInsights:!0,albAccessLogs:!0,cloudFrontLogging:!0,lambdaTracing:!0,databaseInsightsMode:"advanced"})}),c="standard";function f(e,t){return i[e??c][t]}s(f,"tierDefault");const p="fjall:disasterRecovery:tier",T=Object.freeze({standard:"default",resilient:"resilient",enterprise:"enterprise"});export{r as BACKUP_TIERS,i as BACKUP_TIER_DEFAULTS,p as BACKUP_TIER_TAG_KEY,T as BACKUP_TIER_TAG_MAP,u as BackupTierSchema,c as DEFAULT_BACKUP_TIER,g as isBackupTier,f as tierDefault};

package/dist/ciSetup.d.ts

@@ -0,0 +1,25 @@
+/**
+ * `fjall ci setup` vocabulary — the ONE spelling the CLI's `--provider`
+ * option, its `CI_SETUP_SCHEMA` agent projection and the MCP's
+ * `plan_ci_setup` / `apply_ci_setup` pin all derive from.
+ *
+ * The MCP shells out to the CLI and cannot import it (`@fjall/cli` publishes
+ * a bin, no module exports), so until this module the two packages carried
+ * the provider list and the TOON field names as separate literals kept "in
+ * lockstep" by a comment. The MCP's pin reads the CLI's `--agent` output by
+ * field NAME (`provider: …`, `app: …`) and gates a deploy-token mint on the
+ * result, so a rename on one side silently un-pinned the other. Both sides
+ * now read these tuples; a rename is a typecheck failure in both packages.
+ *
+ * Client-safe (no node built-ins) — exported from the root barrel.
+ */
+export declare const CI_PROVIDERS: readonly ["github", "buildkite"];
+export type CiProvider = (typeof CI_PROVIDERS)[number];
+/**
+ * The fields `fjall ci setup --agent` renders as flat TOON `key: value`
+ * lines (the CLI's `CI_SETUP_SCHEMA.defaultFields`, in render order). No token
+ * field: the CLI never holds a deploy token — `mintUrl` is the hand-off to the
+ * web app that mints it.
+ */
+export declare const CI_SETUP_FIELDS: readonly ["provider", "repo", "app", "workflowPath", "planned", "workflowWritten", "deployTarget", "mintUrl", "secretName"];
+export type CiSetupField = (typeof CI_SETUP_FIELDS)[number];

package/dist/ciSetup.js

@@ -0,0 +1 @@
+const e=["github","buildkite"],t=["provider","repo","app","workflowPath","planned","workflowWritten","deployTarget","mintUrl","secretName"];export{e as CI_PROVIDERS,t as CI_SETUP_FIELDS};

package/dist/codemod/statementTypes.d.ts

@@ -0,0 +1,16 @@
+/**
+ * The codemod's statement-type vocabulary: the factory-built statements
+ * `fjall add | modify | remove <type>` address in `infrastructure.ts`, one
+ * per `XFactory.build` family. Declared here, beside the posture policy
+ * that keys its cure column by it, so the registry's "where the user writes
+ * the cure" and the codemod's "which statement it edits" are one tuple: a
+ * cure keyed by a family the codemod cannot address fails typecheck, and
+ * `@fjall/generator`'s `StatementTypeSchema` is `z.enum` over this tuple.
+ *
+ * The wider AST vocabulary (`AstStatementTypeSchema` in the generator's base
+ * schemas) also carries non-factory kinds — import, app-init, tags, custom —
+ * that no codemod verb locates by factory shape; they are not cure families.
+ */
+export declare const CODEMOD_STATEMENT_TYPES: readonly ["database", "storage", "compute", "messaging", "cdn", "network", "pattern", "vpc-peer", "vpc-peer-accepter", "cross-plan-connection", "organisation", "buildkite"];
+export type CodemodStatementType = (typeof CODEMOD_STATEMENT_TYPES)[number];
+export declare function isCodemodStatementType(value: unknown): value is CodemodStatementType;

package/dist/codemod/statementTypes.js

@@ -0,0 +1 @@
+var o=Object.defineProperty;var t=(e,n)=>o(e,"name",{value:n,configurable:!0});const r=["database","storage","compute","messaging","cdn","network","pattern","vpc-peer","vpc-peer-accepter","cross-plan-connection","organisation","buildkite"],c=new Set(r);function s(e){return typeof e=="string"&&c.has(e)}t(s,"isCodemodStatementType");export{r as CODEMOD_STATEMENT_TYPES,s as isCodemodStatementType};

package/dist/complianceIssue.d.ts

@@ -44,3 +44,13 @@ export declare const COMPLIANCE_ISSUE_STATUSES: readonly ["open", "acknowledged"
 export type ComplianceIssueStatus = (typeof COMPLIANCE_ISSUE_STATUSES)[number];
 /** Type guard: checks whether a string is a ComplianceIssue status. */
 export declare function isComplianceIssueStatus(value: string): value is ComplianceIssueStatus;
+/**
+ * ComplianceIssue severity vocabulary, most severe first — the order the
+ * webapp's `COMPLIANCE_SEVERITY_RANK` (app/.server/types/database-enums.ts)
+ * ranks by and its `/api/compliance/issues` `severity` filter accepts. The
+ * `mcp` `list_compliance_issues` filter builds `z.enum(...)` from it (same
+ * no-zod-here rationale as the statuses).
+ */
+export declare const COMPLIANCE_ISSUE_SEVERITIES: readonly ["critical", "high", "medium", "low"];
+/** @public — tuple companion type; ships with its tuple (knip skips @public) */
+export type ComplianceIssueSeverity = (typeof COMPLIANCE_ISSUE_SEVERITIES)[number];

package/dist/complianceIssue.js

@@ -1 +1 @@
-var S=Object.defineProperty;var t=(e,n)=>S(e,"name",{value:n,configurable:!0});const s=["open","acknowledged","pending_verification","resolved","suppressed","expected","mitigated"],o=new Set(s);function p(e){return o.has(e)}t(p,"isComplianceIssueStatus");export{s as COMPLIANCE_ISSUE_STATUSES,p as isComplianceIssueStatus};
+var i=Object.defineProperty;var t=(e,S)=>i(e,"name",{value:S,configurable:!0});const n=["open","acknowledged","pending_verification","resolved","suppressed","expected","mitigated"],o=new Set(n);function E(e){return o.has(e)}t(E,"isComplianceIssueStatus");const c=["critical","high","medium","low"];export{c as COMPLIANCE_ISSUE_SEVERITIES,n as COMPLIANCE_ISSUE_STATUSES,E as isComplianceIssueStatus};

package/dist/deploy/approvalTokenOutput.d.ts

@@ -9,10 +9,3 @@
  * silently. `@fjall/util` is the lowest common dependency of both.
  */
 export declare const APPROVAL_TOKEN_OUTPUT_PREFIX = "Approval token: ";
-/**
- * The exact stderr prefix the CLI prints minted scoped tokens under
- * (`fjall ci setup` / `fjall ci token create` / `fjall user token create`)
- * and the MCP `apply_ci_setup` handler parses to capture the one-time value.
- * Same cross-package print/parse contract as APPROVAL_TOKEN_OUTPUT_PREFIX.
- */
-export declare const TOKEN_STDERR_PREFIX = "Token: ";

package/dist/deploy/approvalTokenOutput.js

@@ -1 +1 @@
-const o="Approval token: ",T="Token: ";export{o as APPROVAL_TOKEN_OUTPUT_PREFIX,T as TOKEN_STDERR_PREFIX};
+const o="Approval token: ";export{o as APPROVAL_TOKEN_OUTPUT_PREFIX};

package/dist/fjallHome.d.ts

@@ -13,9 +13,10 @@
  * the package raw — evaluates every barrel module, and a static
  * `import { homedir } from "node:os"` throws at evaluation time against the
  * browser-external stub, killing hydration on every page. `process
- * .getBuiltinModule` (Node ≥ 22.3, below our engines floor) is the
- * runtime-agnostic form: nothing is referenced at module scope, and the
- * functions below only ever run in Node. The barrel-reachability test
+ * .getBuiltinModule` (Node ≥ 22.3.0 — the engines floor every published
+ * package declares) is the runtime-agnostic form: nothing is referenced at
+ * module scope, and the functions below only ever run in Node. The
+ * barrel-reachability test
  * (`__tests__/barrelBrowserSafety.test.ts`) pins the class for the whole
  * package.
  *

package/dist/index.d.ts

@@ -1,6 +1,7 @@
 export { DNS_APEX, getDomainExportNames, getDomainStackName, getDomainUsEast1CertificatesStackName, hostsExportPartName, serialiseHostsChunks, HOSTS_OUTPUT_MAX_BYTES, isManagedDomainBinding, DOMAIN_DEPLOY_DEFAULT_PHASE, type DomainDeployPhase, type ManagedDomainBinding, type ManagedDomainCoverage, type ManagedDomainExports } from "./infra/domainExports.js";
-export { BACKUP_VAULT_NAME } from "./infra/backupVault.js";
-export { APPROVAL_TOKEN_OUTPUT_PREFIX, TOKEN_STDERR_PREFIX } from "./deploy/approvalTokenOutput.js";
+export { BACKUP_VAULT_NAME, BACKUP_VAULT_CONTEXT_KEY, BackupVaultLockSchema, type BackupVaultLock, BackupVaultVerdictSchema, type BackupVaultVerdict, isReownedBackupVault } from "./infra/backupVault.js";
+export { type NonEmptyPartial } from "./nonEmptyPartial.js";
+export { APPROVAL_TOKEN_OUTPUT_PREFIX } from "./deploy/approvalTokenOutput.js";
 export { imageTagParameterName } from "./infra/imageTags.js";
 export { toPascalCase, toKebab, toValidDatabaseName, toScreamingSnake, capitalise, getSafeZoneName, accountConstructKey, hasAsciiStableConstructKey } from "./naming/caseConversion.js";
 export { albDnsExportName, albHostedZoneIdExportName, cdnDomainExportName, bucketWebsiteEndpointExportName, bucketWebsiteHostedZoneIdExportName } from "./naming/targetExportNames.js";
@@ -15,14 +16,18 @@ export { DANGEROUS_ENV_VARS, filterDangerousEnvVars, MASKED_VALUE_MARKER, maskSe
 export { sleep } from "./async/sleep.js";
 export { mapSettledWithConcurrency } from "./async/concurrency.js";
 export { ACCOUNT_STAGES_WITH_ROOT, STRUCTURAL_ENVIRONMENTS, ACCOUNT_STAGES, ACCOUNT_STAGE_LABELS, isAccountStage, ACCOUNT_TIERS, type AccountTier, AccountTierSchema, isAccountTier, GOVERNANCE_ACCOUNT_TIERS, isGovernanceTier, environmentToTier, type AccountStageEffect, accountStageEffect, ACCOUNT_STAGE_EFFECTS, formatAccountStageList, stageFromWireEnvironment, accountTier, resolveSynthEnvironment, type AccountStageWithRoot, type AccountStage, getEnvironmentLabel, ACCOUNT_ROLES } from "./environments.js";
-export { BACKUP_TIERS, BACKUP_TIER_DEFAULTS, type BackupTier, type BackupTierDefaults, BackupTierSchema, isBackupTier, tierDefault } from "./backupTiers.js";
+export { BACKUP_TIERS, BACKUP_TIER_DEFAULTS, BACKUP_TIER_TAG_KEY, BACKUP_TIER_TAG_MAP, type BackupTier, type BackupTierDefaults, BackupTierSchema, isBackupTier, tierDefault } from "./backupTiers.js";
+export { CODEMOD_STATEMENT_TYPES, type CodemodStatementType, isCodemodStatementType } from "./codemod/statementTypes.js";
 export { RESOURCE_CATEGORIES, type ResourceCategory, categoriseResource, getExpectedDuration, getFriendlyResourceType } from "./resourceCategorisation.js";
 export { parseGitRemoteUrl, type GitProvider, type ParsedGitRemote } from "./repo/gitRemoteParser.js";
 export { abbreviateRegion, AWS_REGIONS_METADATA, DEFAULT_REGION, getRegionInfo, MAX_SECONDARY_REGIONS, OPT_IN_REGION_CODES, optInRegionWarning, regions, RETIRED_REGION_ABBREVIATIONS, suggestRegionForTimezone, type RegionCode, type RegionInfo } from "./infra/regions.js";
-export { SCOPE_VALUES, MACHINE_ONLY_SCOPES, USER_GRANTABLE_SCOPES, GOVERNANCE_SCOPE_REQUIRED_CODE, type TokenScope } from "./infra/tokenScopes.js";
+export { SCOPE_VALUES, MACHINE_ONLY_SCOPES, USER_GRANTABLE_SCOPES, GOVERNANCE_SCOPE_REQUIRED_CODE, SESSION_ONLY_API_ROUTES, type TokenScope } from "./infra/tokenScopes.js";
 export { SECRET_NAME_PATTERN, SECRET_NAME_ERROR, SSM_COMPONENT_PATTERN, SSM_COMPONENT_ERROR, SSM_STANDARD_MAX_VALUE_BYTES, SecretNamespaceSchema, type SecretNamespace, buildNamespaceParts, buildParameterPath, parseParameterPath, isManageablePath, parseDotEnv, escapeDotEnvValue } from "./secrets.js";
 export { ConnectionWireSchema, type ConnectionWire, ConnectionsListResponseSchema, type ConnectionsListResponse, CONNECTION_PHASES, type ConnectionPhase, CONNECTION_TERMINAL_FAILURE_PHASES, type ConnectionTerminalFailurePhase, CONNECTION_FAILURE_REASONS, type ConnectionFailureReason, EXTERNAL_ID_PATTERN } from "./infra/connectionsWire.js";
-export { COMPLIANCE_ISSUE_STATUSES, type ComplianceIssueStatus, isComplianceIssueStatus } from "./complianceIssue.js";
+export { COMPLIANCE_ISSUE_STATUSES, type ComplianceIssueStatus, isComplianceIssueStatus, COMPLIANCE_ISSUE_SEVERITIES, type ComplianceIssueSeverity } from "./complianceIssue.js";
+export { CI_PROVIDERS, type CiProvider, CI_SETUP_FIELDS, type CiSetupField } from "./ciSetup.js";
+export { INFRASTRUCTURE_TIER_NAMES, type InfrastructureTierName, CUSTOM_APP_TYPE, APP_TYPES, type AppType } from "./appTypes.js";
+export { INSIGHT_TAB_VALUES, type InsightTab, INSIGHT_CATEGORIES, type InsightCategory, INSIGHT_SEVERITIES, type InsightSeverity, INSIGHT_SORT_VALUES, type InsightSort } from "./insights/vocabulary.js";
 export { PUBLIC_PACKAGE_NAME, INSTALL_SOURCES, type InstallSource, SETUP_COMMANDS, type SetupCommandId, upgradeCommand, SETUP_MODES, type SetupMode, SETUP_STEP_IDS, type SetupStepId, type SetupStep, type SetupStepSequence, SETUP_STEPS, AGENT_SETUP_PROMPTS, AGENT_INSTALL_COMMAND, SKILL_INSTALL_SEGMENTS, SKILL_INSTALL_FILENAME, SKILL_INSTALL_PATH } from "./onboarding/index.js";
 export { deriveRegionsFromOrgConfig, deriveTargets, deriveAllTargets, environmentOrTier, explainRetiredTargetName, findTarget, generateTargetName, type OrgConfigRegions, type TargetAccount, type DerivedTarget, type ResolvedTargetAccount } from "./targets.js";
 export { buildAppConfigPath } from "./repo/appPath.js";
@@ -36,8 +41,8 @@ export { MIGRATION_SNAPSHOT_NAME_PREFIX, MIGRATION_SNAPSHOT_RETENTION_DAYS_ENV,
 export { SCHEMA_GATE_EXIT, SCHEMA_GATE_EXIT_HINTS, schemaGateExitKind, type SchemaGateExitKind, type SchemaGateExitCode } from "./migration/schemaGateExit.js";
 export { FJALL_SCHEMA_GATE_USER, FJALL_MAINTENANCE_USER, FJALL_CLICKHOUSE_USERS, type FjallClickHouseUser } from "./migration/clickhouseFrameworkUsers.js";
 export { PHYSICAL_NAME_FALLBACK_PROPERTIES } from "./cfn/physicalNameProperties.js";
-export { PATTERN_TYPE_VALUES, type PatternType, PATTERN_TYPES, isPatternType, type PatternArtefact, type PatternStackPlacement, type PatternDescriptor, PATTERN_REGISTRY, patternConstructId, DEPLOYABLE_PATTERN_TYPES, type OpenNextPatternType, OPENNEXT_PATTERN_TYPES, isOpenNextPatternType, CLOUDFRONT_PRICE_CLASS_VALUES, type CloudFrontPriceClass, STATIC_SITE_CONFIG_KEYS, type StaticSiteConfigKey, STATIC_SITE_DEPLOY_INJECTED_KEYS, type StaticSiteDeployInjectedKey, STATIC_SITE_CDN_CONFIG_KEYS, type StaticSiteCdnConfigKey, STATIC_SITE_ROUTING_VALUES, STATIC_SITE_ROUTING_INFO, type StaticSiteRouting, type StaticSiteRoutingDescriptor, PATTERN_CREATE_INPUT_VALUES, type PatternCreateInput, PATTERN_CREATE_INPUT_FLAGS } from "./patterns/patternTypes.js";
-export { FRAMEWORK_VALUES, type Framework, FRAMEWORKS, isFramework, type DeployablePatternType, type UndeployablePatternType, type PatternRecommendation, FRAMEWORK_PATTERN_RECOMMENDATIONS, recommendPatternForFramework, CREATABLE_FRAMEWORKS, requiredInputsForFramework } from "./patterns/frameworkPatterns.js";
+export { PATTERN_TYPE_VALUES, type PatternType, PATTERN_TYPES, isPatternType, type PatternArtefact, type PatternStackPlacement, type PatternDescriptor, PATTERN_REGISTRY, patternConstructId, type DeployablePatternType, DEPLOYABLE_PATTERN_TYPES, PATTERN_TIER_VALUES, type PatternTier, type OpenNextPatternType, OPENNEXT_PATTERN_TYPES, isOpenNextPatternType, OPENNEXT_BUCKET_KEYS, type OpenNextBucketKey, isOpenNextBucketKey, patternBucketConstructId, CLOUDFRONT_PRICE_CLASS_VALUES, type CloudFrontPriceClass, STATIC_SITE_CONFIG_KEYS, type StaticSiteConfigKey, STATIC_SITE_DEPLOY_INJECTED_KEYS, type StaticSiteDeployInjectedKey, STATIC_SITE_CDN_CONFIG_KEYS, type StaticSiteCdnConfigKey, STATIC_SITE_ROUTING_VALUES, STATIC_SITE_ROUTING_INFO, type StaticSiteRouting, type StaticSiteRoutingDescriptor, PATTERN_CREATE_INPUT_VALUES, type PatternCreateInput, PATTERN_CREATE_INPUT_FLAGS } from "./patterns/patternTypes.js";
+export { FRAMEWORK_VALUES, type Framework, FRAMEWORKS, isFramework, type UndeployablePatternType, type PatternRecommendation, FRAMEWORK_PATTERN_RECOMMENDATIONS, recommendPatternForFramework, CREATABLE_FRAMEWORKS, requiredInputsForFramework } from "./patterns/frameworkPatterns.js";
 export { DEFAULT_FORMS_FROM_LOCAL_PART, defaultFormsFromAddress, defaultFormsCorsOrigin, isAddressAtDomain } from "./patterns/staticSiteForms.js";
 export { DEV_SUBSTRATE_PARAMS_SCHEMA_VERSION, DEV_SUBSTRATE_PARAMS_FILENAME, DevSubstrateSynthPropsSchema, type DevSubstrateSynthProps, DevSubstrateParamsSchema, type DevSubstrateParams } from "./devSubstrate/params.js";
 export { DEV_SUBSTRATE_ENTRYPOINT_SOURCE } from "./devSubstrate/entrypoint.js";

package/dist/index.js

@@ -1 +1 @@
-import{DNS_APEX as _,getDomainExportNames as r,getDomainStackName as T,getDomainUsEast1CertificatesStackName as A,hostsExportPartName as S,serialiseHostsChunks as t,HOSTS_OUTPUT_MAX_BYTES as o,isManagedDomainBinding as a,DOMAIN_DEPLOY_DEFAULT_PHASE as N}from"./infra/domainExports.js";import{BACKUP_VAULT_NAME as I}from"./infra/backupVault.js";import{APPROVAL_TOKEN_OUTPUT_PREFIX as i,TOKEN_STDERR_PREFIX as C}from"./deploy/approvalTokenOutput.js";import{imageTagParameterName as n}from"./infra/imageTags.js";import{toPascalCase as L,toKebab as s,toValidDatabaseName as p,toScreamingSnake as D,capitalise as c,getSafeZoneName as M,accountConstructKey as f,hasAsciiStableConstructKey as F}from"./naming/caseConversion.js";import{albDnsExportName as l,albHostedZoneIdExportName as u,cdnDomainExportName as x,bucketWebsiteEndpointExportName as d,bucketWebsiteHostedZoneIdExportName as G}from"./naming/targetExportNames.js";import{ec2ServiceName as h,mintedEc2KeyPairName as H}from"./naming/ec2Naming.js";import{CAPACITY_SLOT_PATTERN as Y,CAPACITY_SLOT_MAX_LENGTH as K,DEFAULT_CAPACITY_SLOT as y,CAPACITY_ANCHOR_PATTERN as v,CAPACITY_ANCHOR_MAX_LENGTH as B,CAPACITY_IDENTITY_CONTEXT_KEY as X,CapacityIdentityPinSchema as b,CapacityIdentityWireSchema as W,CapacityIdentityConfigSchema as k,projectCapacityIdentityToTarget as J}from"./capacityIdentity.js";import{findAccountNameCollision as w}from"./naming/accountNameCollision.js";import{defaultConnectedAccountName as q,suffixedAccountName as z,REGION_SHORT_CODES as Q,findTrailingRegionShortCode as $,regionSuffixRejectionMessage as ee}from"./naming/connectedAccountName.js";import{normaliseError as _e,getErrorMessage as re,hasErrorCode as Te,getErrorCode as Ae,getErrorStack as Se,formatErrorString as te}from"./errorUtils.js";import{FJALL_CONFIG_DIR_ENV as ae,FJALL_CREDENTIALS_FILENAME as Ne,FJALL_HOME_DIRNAME as Re,FJALL_LOG_DIR_ENV as Ie,fjallCredentialsPath as Oe,fjallHomeDir as ie,fjallLogDir as Ce,fjallStatePath as me}from"./fjallHome.js";import{singleton as Pe}from"./async/singleton.js";import{DANGEROUS_ENV_VARS as se,filterDangerousEnvVars as pe,MASKED_VALUE_MARKER as De,maskSensitiveOutput as ce,parseShellArgs as Me,REDACTED_KEY_SENTINEL as fe,SCOPED_TOKEN_REGEX as Fe}from"./securityHelpers.js";import{sleep as le}from"./async/sleep.js";import{mapSettledWithConcurrency as xe}from"./async/concurrency.js";import{ACCOUNT_STAGES_WITH_ROOT as Ge,STRUCTURAL_ENVIRONMENTS as ge,ACCOUNT_STAGES as he,ACCOUNT_STAGE_LABELS as He,isAccountStage as Ve,ACCOUNT_TIERS as Ye,AccountTierSchema as Ke,isAccountTier as ye,GOVERNANCE_ACCOUNT_TIERS as ve,isGovernanceTier as Be,environmentToTier as Xe,accountStageEffect as be,ACCOUNT_STAGE_EFFECTS as We,formatAccountStageList as ke,stageFromWireEnvironment as Je,accountTier as je,resolveSynthEnvironment as we,getEnvironmentLabel as Ze,ACCOUNT_ROLES as qe}from"./environments.js";import{BACKUP_TIERS as Qe,BACKUP_TIER_DEFAULTS as $e,BackupTierSchema as eE,isBackupTier as EE,tierDefault as _E}from"./backupTiers.js";import{RESOURCE_CATEGORIES as TE,categoriseResource as AE,getExpectedDuration as SE,getFriendlyResourceType as tE}from"./resourceCategorisation.js";import{parseGitRemoteUrl as aE}from"./repo/gitRemoteParser.js";import{abbreviateRegion as RE,AWS_REGIONS_METADATA as IE,DEFAULT_REGION as OE,getRegionInfo as iE,MAX_SECONDARY_REGIONS as CE,OPT_IN_REGION_CODES as mE,optInRegionWarning as nE,regions as PE,RETIRED_REGION_ABBREVIATIONS as LE,suggestRegionForTimezone as sE}from"./infra/regions.js";import{SCOPE_VALUES as DE,MACHINE_ONLY_SCOPES as cE,USER_GRANTABLE_SCOPES as ME,GOVERNANCE_SCOPE_REQUIRED_CODE as fE}from"./infra/tokenScopes.js";import{SECRET_NAME_PATTERN as UE,SECRET_NAME_ERROR as lE,SSM_COMPONENT_PATTERN as uE,SSM_COMPONENT_ERROR as xE,SSM_STANDARD_MAX_VALUE_BYTES as dE,SecretNamespaceSchema as GE,buildNamespaceParts as gE,buildParameterPath as hE,parseParameterPath as HE,isManageablePath as VE,parseDotEnv as YE,escapeDotEnvValue as KE}from"./secrets.js";import{ConnectionWireSchema as vE,ConnectionsListResponseSchema as BE,CONNECTION_PHASES as XE,CONNECTION_TERMINAL_FAILURE_PHASES as bE,CONNECTION_FAILURE_REASONS as WE,EXTERNAL_ID_PATTERN as kE}from"./infra/connectionsWire.js";import{COMPLIANCE_ISSUE_STATUSES as jE,isComplianceIssueStatus as wE}from"./complianceIssue.js";import{PUBLIC_PACKAGE_NAME as qE,INSTALL_SOURCES as zE,SETUP_COMMANDS as QE,upgradeCommand as $E,SETUP_MODES as e_,SETUP_STEP_IDS as E_,SETUP_STEPS as __,AGENT_SETUP_PROMPTS as r_,AGENT_INSTALL_COMMAND as T_,SKILL_INSTALL_SEGMENTS as A_,SKILL_INSTALL_FILENAME as S_,SKILL_INSTALL_PATH as t_}from"./onboarding/index.js";import{deriveRegionsFromOrgConfig as a_,deriveTargets as N_,deriveAllTargets as R_,environmentOrTier as I_,explainRetiredTargetName as O_,findTarget as i_,generateTargetName as C_}from"./targets.js";import{buildAppConfigPath as n_}from"./repo/appPath.js";import{findInfrastructurePaths as L_,findBoundaryPath as s_,isInfrastructureFile as p_}from"./repo/findInfrastructurePaths.js";import{inferContainerFromCandidates as c_}from"./repo/inferContainerFromCandidates.js";import{RESERVED_APP_NAMES as f_,RESERVED_APP_NAME_MESSAGE as F_,isReservedAppName as U_,RESERVED_APP_NAME_SUFFIX as l_,RESERVED_APP_NAME_SUFFIX_MESSAGE as u_,hasReservedAppNameSuffix as x_}from"./naming/reservedAppNames.js";import{deriveContentHashTag as G_,CONTENT_HASH_TAG_PATTERN as g_}from"./infra/deriveContentHashTag.js";import{DEPLOY_MODES as H_,DeployModeSchema as V_,IMAGE_TAG_PATTERN as Y_,ImageTagSchema as K_,ServiceArtefactSchema as y_,ServiceArtefactsSchema as v_,ARTEFACT_OUTPUT_FIELDS as B_,artefactOutputKey as X_}from"./infra/deployArtefacts.js";import{MIGRATION_SNAPSHOT_NAME_PREFIX as W_,MIGRATION_SNAPSHOT_RETENTION_DAYS_ENV as k_,MIGRATION_SNAPSHOT_KIND_TAG_KEY as J_,MIGRATION_SNAPSHOT_KIND_PREMIGRATE as j_,EXPECTED_SCHEMA_VERSION_ENV as w_,EXPECTED_SCHEMA_VERSION_TOOL_ENV as Z_,EXPECTED_CH_SCHEMA_VERSION_ENV as q_,SCHEMA_ADMIN_USER_ENV as z_,SCHEMA_ADMIN_PASSWORD_ENV as Q_,PRISMA_MIGRATION_DIR_RE as $_,CLICKHOUSE_MIGRATION_SKIP_RE as er}from"./migration/constants.js";import{SCHEMA_GATE_EXIT as _r,SCHEMA_GATE_EXIT_HINTS as rr,schemaGateExitKind as Tr}from"./migration/schemaGateExit.js";import{FJALL_SCHEMA_GATE_USER as Sr,FJALL_MAINTENANCE_USER as tr,FJALL_CLICKHOUSE_USERS as or}from"./migration/clickhouseFrameworkUsers.js";import{PHYSICAL_NAME_FALLBACK_PROPERTIES as Nr}from"./cfn/physicalNameProperties.js";import{PATTERN_TYPE_VALUES as Ir,PATTERN_TYPES as Or,isPatternType as ir,PATTERN_REGISTRY as Cr,patternConstructId as mr,DEPLOYABLE_PATTERN_TYPES as nr,OPENNEXT_PATTERN_TYPES as Pr,isOpenNextPatternType as Lr,CLOUDFRONT_PRICE_CLASS_VALUES as sr,STATIC_SITE_CONFIG_KEYS as pr,STATIC_SITE_DEPLOY_INJECTED_KEYS as Dr,STATIC_SITE_CDN_CONFIG_KEYS as cr,STATIC_SITE_ROUTING_VALUES as Mr,STATIC_SITE_ROUTING_INFO as fr,PATTERN_CREATE_INPUT_VALUES as Fr,PATTERN_CREATE_INPUT_FLAGS as Ur}from"./patterns/patternTypes.js";import{FRAMEWORK_VALUES as ur,FRAMEWORKS as xr,isFramework as dr,FRAMEWORK_PATTERN_RECOMMENDATIONS as Gr,recommendPatternForFramework as gr,CREATABLE_FRAMEWORKS as hr,requiredInputsForFramework as Hr}from"./patterns/frameworkPatterns.js";import{DEFAULT_FORMS_FROM_LOCAL_PART as Yr,defaultFormsFromAddress as Kr,defaultFormsCorsOrigin as yr,isAddressAtDomain as vr}from"./patterns/staticSiteForms.js";import{DEV_SUBSTRATE_PARAMS_SCHEMA_VERSION as Xr,DEV_SUBSTRATE_PARAMS_FILENAME as br,DevSubstrateSynthPropsSchema as Wr,DevSubstrateParamsSchema as kr}from"./devSubstrate/params.js";import{DEV_SUBSTRATE_ENTRYPOINT_SOURCE as jr}from"./devSubstrate/entrypoint.js";import{BLESSED_CDK_TOOLCHAIN as Zr}from"./cdkToolchain.js";import{DEPLOYMENT_FAILURE_PHASES as zr,DeploymentFailurePhaseSchema as Qr,DEPLOYMENT_FAULT_ATTRIBUTIONS as $r,DeploymentFaultAttributionSchema as eT,DEPLOYMENT_FAILURE_PROVIDER_SOURCES as ET,DeploymentFailureProviderSourceSchema as _T,DEPLOYMENT_FAILURE_CODE_PATTERN as rT,DEPLOYMENT_FAILURE_SCHEMA_VERSION as TT,DEPLOYMENT_FAILURE_LIMITS as AT,DeploymentFailureAnalysisSchema as ST,DeploymentFailureProviderSchema as tT,DeploymentFailureResourceSchema as oT,DeploymentFailureSchema as aT,parseDeploymentFailure as NT,DEPLOYMENT_FAILURE_DOCS_BASE_URL as RT,deploymentFailureDocsUrl as IT,DEPLOYMENT_FAULT_COPY as OT,DEPLOYMENT_PROVIDER_LABELS as iT,deriveErrorMessageFromFailure as CT,toDeploymentFailureAnalysis as mT}from"./failure/deploymentFailure.js";import{extractErrorWindow as PT,ERROR_WINDOW_CONTEXT_LINES as LT}from"./failure/extractErrorWindow.js";import{FJALL_COMPONENT_GITIGNORE as pT,FJALL_PROJECT_GITIGNORE as DT,FJALL_STATE_GITIGNORE_ENTRIES as cT,FJALL_MANAGED_STATE_DIR_ENTRIES as MT,LOCAL_CONFIG_GITIGNORE_ENTRY as fT}from"./scaffold/gitignore.js";import{ensureGitignoreEntries as UT}from"./scaffold/ensureGitignore.js";export{qe as ACCOUNT_ROLES,he as ACCOUNT_STAGES,Ge as ACCOUNT_STAGES_WITH_ROOT,We as ACCOUNT_STAGE_EFFECTS,He as ACCOUNT_STAGE_LABELS,Ye as ACCOUNT_TIERS,T_ as AGENT_INSTALL_COMMAND,r_ as AGENT_SETUP_PROMPTS,i as APPROVAL_TOKEN_OUTPUT_PREFIX,B_ as ARTEFACT_OUTPUT_FIELDS,IE as AWS_REGIONS_METADATA,Ke as AccountTierSchema,Qe as BACKUP_TIERS,$e as BACKUP_TIER_DEFAULTS,I as BACKUP_VAULT_NAME,Zr as BLESSED_CDK_TOOLCHAIN,eE as BackupTierSchema,B as CAPACITY_ANCHOR_MAX_LENGTH,v as CAPACITY_ANCHOR_PATTERN,X as CAPACITY_IDENTITY_CONTEXT_KEY,K as CAPACITY_SLOT_MAX_LENGTH,Y as CAPACITY_SLOT_PATTERN,er as CLICKHOUSE_MIGRATION_SKIP_RE,sr as CLOUDFRONT_PRICE_CLASS_VALUES,jE as COMPLIANCE_ISSUE_STATUSES,WE as CONNECTION_FAILURE_REASONS,XE as CONNECTION_PHASES,bE as CONNECTION_TERMINAL_FAILURE_PHASES,g_ as CONTENT_HASH_TAG_PATTERN,hr as CREATABLE_FRAMEWORKS,k as CapacityIdentityConfigSchema,b as CapacityIdentityPinSchema,W as CapacityIdentityWireSchema,vE as ConnectionWireSchema,BE as ConnectionsListResponseSchema,se as DANGEROUS_ENV_VARS,y as DEFAULT_CAPACITY_SLOT,Yr as DEFAULT_FORMS_FROM_LOCAL_PART,OE as DEFAULT_REGION,nr as DEPLOYABLE_PATTERN_TYPES,rT as DEPLOYMENT_FAILURE_CODE_PATTERN,RT as DEPLOYMENT_FAILURE_DOCS_BASE_URL,AT as DEPLOYMENT_FAILURE_LIMITS,zr as DEPLOYMENT_FAILURE_PHASES,ET as DEPLOYMENT_FAILURE_PROVIDER_SOURCES,TT as DEPLOYMENT_FAILURE_SCHEMA_VERSION,$r as DEPLOYMENT_FAULT_ATTRIBUTIONS,OT as DEPLOYMENT_FAULT_COPY,iT as DEPLOYMENT_PROVIDER_LABELS,H_ as DEPLOY_MODES,jr as DEV_SUBSTRATE_ENTRYPOINT_SOURCE,br as DEV_SUBSTRATE_PARAMS_FILENAME,Xr as DEV_SUBSTRATE_PARAMS_SCHEMA_VERSION,_ as DNS_APEX,N as DOMAIN_DEPLOY_DEFAULT_PHASE,V_ as DeployModeSchema,ST as DeploymentFailureAnalysisSchema,Qr as DeploymentFailurePhaseSchema,tT as DeploymentFailureProviderSchema,_T as DeploymentFailureProviderSourceSchema,oT as DeploymentFailureResourceSchema,aT as DeploymentFailureSchema,eT as DeploymentFaultAttributionSchema,kr as DevSubstrateParamsSchema,Wr as DevSubstrateSynthPropsSchema,LT as ERROR_WINDOW_CONTEXT_LINES,q_ as EXPECTED_CH_SCHEMA_VERSION_ENV,w_ as EXPECTED_SCHEMA_VERSION_ENV,Z_ as EXPECTED_SCHEMA_VERSION_TOOL_ENV,kE as EXTERNAL_ID_PATTERN,or as FJALL_CLICKHOUSE_USERS,pT as FJALL_COMPONENT_GITIGNORE,ae as FJALL_CONFIG_DIR_ENV,Ne as FJALL_CREDENTIALS_FILENAME,Re as FJALL_HOME_DIRNAME,Ie as FJALL_LOG_DIR_ENV,tr as FJALL_MAINTENANCE_USER,MT as FJALL_MANAGED_STATE_DIR_ENTRIES,DT as FJALL_PROJECT_GITIGNORE,Sr as FJALL_SCHEMA_GATE_USER,cT as FJALL_STATE_GITIGNORE_ENTRIES,xr as FRAMEWORKS,Gr as FRAMEWORK_PATTERN_RECOMMENDATIONS,ur as FRAMEWORK_VALUES,ve as GOVERNANCE_ACCOUNT_TIERS,fE as GOVERNANCE_SCOPE_REQUIRED_CODE,o as HOSTS_OUTPUT_MAX_BYTES,Y_ as IMAGE_TAG_PATTERN,zE as INSTALL_SOURCES,K_ as ImageTagSchema,fT as LOCAL_CONFIG_GITIGNORE_ENTRY,cE as MACHINE_ONLY_SCOPES,De as MASKED_VALUE_MARKER,CE as MAX_SECONDARY_REGIONS,j_ as MIGRATION_SNAPSHOT_KIND_PREMIGRATE,J_ as MIGRATION_SNAPSHOT_KIND_TAG_KEY,W_ as MIGRATION_SNAPSHOT_NAME_PREFIX,k_ as MIGRATION_SNAPSHOT_RETENTION_DAYS_ENV,Pr as OPENNEXT_PATTERN_TYPES,mE as OPT_IN_REGION_CODES,Ur as PATTERN_CREATE_INPUT_FLAGS,Fr as PATTERN_CREATE_INPUT_VALUES,Cr as PATTERN_REGISTRY,Or as PATTERN_TYPES,Ir as PATTERN_TYPE_VALUES,Nr as PHYSICAL_NAME_FALLBACK_PROPERTIES,$_ as PRISMA_MIGRATION_DIR_RE,qE as PUBLIC_PACKAGE_NAME,fe as REDACTED_KEY_SENTINEL,Q as REGION_SHORT_CODES,f_ as RESERVED_APP_NAMES,F_ as RESERVED_APP_NAME_MESSAGE,l_ as RESERVED_APP_NAME_SUFFIX,u_ as RESERVED_APP_NAME_SUFFIX_MESSAGE,TE as RESOURCE_CATEGORIES,LE as RETIRED_REGION_ABBREVIATIONS,Q_ as SCHEMA_ADMIN_PASSWORD_ENV,z_ as SCHEMA_ADMIN_USER_ENV,_r as SCHEMA_GATE_EXIT,rr as SCHEMA_GATE_EXIT_HINTS,Fe as SCOPED_TOKEN_REGEX,DE as SCOPE_VALUES,lE as SECRET_NAME_ERROR,UE as SECRET_NAME_PATTERN,QE as SETUP_COMMANDS,e_ as SETUP_MODES,__ as SETUP_STEPS,E_ as SETUP_STEP_IDS,S_ as SKILL_INSTALL_FILENAME,t_ as SKILL_INSTALL_PATH,A_ as SKILL_INSTALL_SEGMENTS,xE as SSM_COMPONENT_ERROR,uE as SSM_COMPONENT_PATTERN,dE as SSM_STANDARD_MAX_VALUE_BYTES,cr as STATIC_SITE_CDN_CONFIG_KEYS,pr as STATIC_SITE_CONFIG_KEYS,Dr as STATIC_SITE_DEPLOY_INJECTED_KEYS,fr as STATIC_SITE_ROUTING_INFO,Mr as STATIC_SITE_ROUTING_VALUES,ge as STRUCTURAL_ENVIRONMENTS,GE as SecretNamespaceSchema,y_ as ServiceArtefactSchema,v_ as ServiceArtefactsSchema,C as TOKEN_STDERR_PREFIX,ME as USER_GRANTABLE_SCOPES,RE as abbreviateRegion,f as accountConstructKey,be as accountStageEffect,je as accountTier,l as albDnsExportName,u as albHostedZoneIdExportName,X_ as artefactOutputKey,d as bucketWebsiteEndpointExportName,G as bucketWebsiteHostedZoneIdExportName,n_ as buildAppConfigPath,gE as buildNamespaceParts,hE as buildParameterPath,c as capitalise,AE as categoriseResource,x as cdnDomainExportName,q as defaultConnectedAccountName,yr as defaultFormsCorsOrigin,Kr as defaultFormsFromAddress,IT as deploymentFailureDocsUrl,R_ as deriveAllTargets,G_ as deriveContentHashTag,CT as deriveErrorMessageFromFailure,a_ as deriveRegionsFromOrgConfig,N_ as deriveTargets,h as ec2ServiceName,UT as ensureGitignoreEntries,I_ as environmentOrTier,Xe as environmentToTier,KE as escapeDotEnvValue,O_ as explainRetiredTargetName,PT as extractErrorWindow,pe as filterDangerousEnvVars,w as findAccountNameCollision,s_ as findBoundaryPath,L_ as findInfrastructurePaths,i_ as findTarget,$ as findTrailingRegionShortCode,Oe as fjallCredentialsPath,ie as fjallHomeDir,Ce as fjallLogDir,me as fjallStatePath,ke as formatAccountStageList,te as formatErrorString,C_ as generateTargetName,r as getDomainExportNames,T as getDomainStackName,A as getDomainUsEast1CertificatesStackName,Ze as getEnvironmentLabel,Ae as getErrorCode,re as getErrorMessage,Se as getErrorStack,SE as getExpectedDuration,tE as getFriendlyResourceType,iE as getRegionInfo,M as getSafeZoneName,F as hasAsciiStableConstructKey,Te as hasErrorCode,x_ as hasReservedAppNameSuffix,S as hostsExportPartName,n as imageTagParameterName,c_ as inferContainerFromCandidates,Ve as isAccountStage,ye as isAccountTier,vr as isAddressAtDomain,EE as isBackupTier,wE as isComplianceIssueStatus,dr as isFramework,Be as isGovernanceTier,p_ as isInfrastructureFile,VE as isManageablePath,a as isManagedDomainBinding,Lr as isOpenNextPatternType,ir as isPatternType,U_ as isReservedAppName,xe as mapSettledWithConcurrency,ce as maskSensitiveOutput,H as mintedEc2KeyPairName,_e as normaliseError,nE as optInRegionWarning,NT as parseDeploymentFailure,YE as parseDotEnv,aE as parseGitRemoteUrl,HE as parseParameterPath,Me as parseShellArgs,mr as patternConstructId,J as projectCapacityIdentityToTarget,gr as recommendPatternForFramework,ee as regionSuffixRejectionMessage,PE as regions,Hr as requiredInputsForFramework,we as resolveSynthEnvironment,Tr as schemaGateExitKind,t as serialiseHostsChunks,Pe as singleton,le as sleep,Je as stageFromWireEnvironment,z as suffixedAccountName,sE as suggestRegionForTimezone,_E as tierDefault,mT as toDeploymentFailureAnalysis,s as toKebab,L as toPascalCase,D as toScreamingSnake,p as toValidDatabaseName,$E as upgradeCommand};
+import{DNS_APEX as _,getDomainExportNames as r,getDomainStackName as T,getDomainUsEast1CertificatesStackName as S,hostsExportPartName as A,serialiseHostsChunks as t,HOSTS_OUTPUT_MAX_BYTES as o,isManagedDomainBinding as a,DOMAIN_DEPLOY_DEFAULT_PHASE as N}from"./infra/domainExports.js";import{BACKUP_VAULT_NAME as I,BACKUP_VAULT_CONTEXT_KEY as O,BackupVaultLockSchema as C,BackupVaultVerdictSchema as i,isReownedBackupVault as m}from"./infra/backupVault.js";import{APPROVAL_TOKEN_OUTPUT_PREFIX as n}from"./deploy/approvalTokenOutput.js";import{imageTagParameterName as s}from"./infra/imageTags.js";import{toPascalCase as D,toKebab as c,toValidDatabaseName as M,toScreamingSnake as U,capitalise as f,getSafeZoneName as F,accountConstructKey as u,hasAsciiStableConstructKey as l}from"./naming/caseConversion.js";import{albDnsExportName as G,albHostedZoneIdExportName as d,cdnDomainExportName as g,bucketWebsiteEndpointExportName as V,bucketWebsiteHostedZoneIdExportName as Y}from"./naming/targetExportNames.js";import{ec2ServiceName as h,mintedEc2KeyPairName as K}from"./naming/ec2Naming.js";import{CAPACITY_SLOT_PATTERN as B,CAPACITY_SLOT_MAX_LENGTH as v,DEFAULT_CAPACITY_SLOT as X,CAPACITY_ANCHOR_PATTERN as b,CAPACITY_ANCHOR_MAX_LENGTH as k,CAPACITY_IDENTITY_CONTEXT_KEY as W,CapacityIdentityPinSchema as J,CapacityIdentityWireSchema as j,CapacityIdentityConfigSchema as w,projectCapacityIdentityToTarget as Z}from"./capacityIdentity.js";import{findAccountNameCollision as z}from"./naming/accountNameCollision.js";import{defaultConnectedAccountName as $,suffixedAccountName as EE,REGION_SHORT_CODES as eE,findTrailingRegionShortCode as _E,regionSuffixRejectionMessage as rE}from"./naming/connectedAccountName.js";import{normaliseError as SE,getErrorMessage as AE,hasErrorCode as tE,getErrorCode as oE,getErrorStack as aE,formatErrorString as NE}from"./errorUtils.js";import{FJALL_CONFIG_DIR_ENV as IE,FJALL_CREDENTIALS_FILENAME as OE,FJALL_HOME_DIRNAME as CE,FJALL_LOG_DIR_ENV as iE,fjallCredentialsPath as mE,fjallHomeDir as PE,fjallLogDir as nE,fjallStatePath as LE}from"./fjallHome.js";import{singleton as pE}from"./async/singleton.js";import{DANGEROUS_ENV_VARS as cE,filterDangerousEnvVars as ME,MASKED_VALUE_MARKER as UE,maskSensitiveOutput as fE,parseShellArgs as FE,REDACTED_KEY_SENTINEL as uE,SCOPED_TOKEN_REGEX as lE}from"./securityHelpers.js";import{sleep as GE}from"./async/sleep.js";import{mapSettledWithConcurrency as gE}from"./async/concurrency.js";import{ACCOUNT_STAGES_WITH_ROOT as YE,STRUCTURAL_ENVIRONMENTS as HE,ACCOUNT_STAGES as hE,ACCOUNT_STAGE_LABELS as KE,isAccountStage as yE,ACCOUNT_TIERS as BE,AccountTierSchema as vE,isAccountTier as XE,GOVERNANCE_ACCOUNT_TIERS as bE,isGovernanceTier as kE,environmentToTier as WE,accountStageEffect as JE,ACCOUNT_STAGE_EFFECTS as jE,formatAccountStageList as wE,stageFromWireEnvironment as ZE,accountTier as qE,resolveSynthEnvironment as zE,getEnvironmentLabel as QE,ACCOUNT_ROLES as $E}from"./environments.js";import{BACKUP_TIERS as ee,BACKUP_TIER_DEFAULTS as _e,BACKUP_TIER_TAG_KEY as re,BACKUP_TIER_TAG_MAP as Te,BackupTierSchema as Se,isBackupTier as Ae,tierDefault as te}from"./backupTiers.js";import{CODEMOD_STATEMENT_TYPES as ae,isCodemodStatementType as Ne}from"./codemod/statementTypes.js";import{RESOURCE_CATEGORIES as Ie,categoriseResource as Oe,getExpectedDuration as Ce,getFriendlyResourceType as ie}from"./resourceCategorisation.js";import{parseGitRemoteUrl as Pe}from"./repo/gitRemoteParser.js";import{abbreviateRegion as Le,AWS_REGIONS_METADATA as se,DEFAULT_REGION as pe,getRegionInfo as De,MAX_SECONDARY_REGIONS as ce,OPT_IN_REGION_CODES as Me,optInRegionWarning as Ue,regions as fe,RETIRED_REGION_ABBREVIATIONS as Fe,suggestRegionForTimezone as ue}from"./infra/regions.js";import{SCOPE_VALUES as xe,MACHINE_ONLY_SCOPES as Ge,USER_GRANTABLE_SCOPES as de,GOVERNANCE_SCOPE_REQUIRED_CODE as ge,SESSION_ONLY_API_ROUTES as Ve}from"./infra/tokenScopes.js";import{SECRET_NAME_PATTERN as He,SECRET_NAME_ERROR as he,SSM_COMPONENT_PATTERN as Ke,SSM_COMPONENT_ERROR as ye,SSM_STANDARD_MAX_VALUE_BYTES as Be,SecretNamespaceSchema as ve,buildNamespaceParts as Xe,buildParameterPath as be,parseParameterPath as ke,isManageablePath as We,parseDotEnv as Je,escapeDotEnvValue as je}from"./secrets.js";import{ConnectionWireSchema as Ze,ConnectionsListResponseSchema as qe,CONNECTION_PHASES as ze,CONNECTION_TERMINAL_FAILURE_PHASES as Qe,CONNECTION_FAILURE_REASONS as $e,EXTERNAL_ID_PATTERN as E_}from"./infra/connectionsWire.js";import{COMPLIANCE_ISSUE_STATUSES as __,isComplianceIssueStatus as r_,COMPLIANCE_ISSUE_SEVERITIES as T_}from"./complianceIssue.js";import{CI_PROVIDERS as A_,CI_SETUP_FIELDS as t_}from"./ciSetup.js";import{INFRASTRUCTURE_TIER_NAMES as a_,CUSTOM_APP_TYPE as N_,APP_TYPES as R_}from"./appTypes.js";import{INSIGHT_TAB_VALUES as O_,INSIGHT_CATEGORIES as C_,INSIGHT_SEVERITIES as i_,INSIGHT_SORT_VALUES as m_}from"./insights/vocabulary.js";import{PUBLIC_PACKAGE_NAME as n_,INSTALL_SOURCES as L_,SETUP_COMMANDS as s_,upgradeCommand as p_,SETUP_MODES as D_,SETUP_STEP_IDS as c_,SETUP_STEPS as M_,AGENT_SETUP_PROMPTS as U_,AGENT_INSTALL_COMMAND as f_,SKILL_INSTALL_SEGMENTS as F_,SKILL_INSTALL_FILENAME as u_,SKILL_INSTALL_PATH as l_}from"./onboarding/index.js";import{deriveRegionsFromOrgConfig as G_,deriveTargets as d_,deriveAllTargets as g_,environmentOrTier as V_,explainRetiredTargetName as Y_,findTarget as H_,generateTargetName as h_}from"./targets.js";import{buildAppConfigPath as y_}from"./repo/appPath.js";import{findInfrastructurePaths as v_,findBoundaryPath as X_,isInfrastructureFile as b_}from"./repo/findInfrastructurePaths.js";import{inferContainerFromCandidates as W_}from"./repo/inferContainerFromCandidates.js";import{RESERVED_APP_NAMES as j_,RESERVED_APP_NAME_MESSAGE as w_,isReservedAppName as Z_,RESERVED_APP_NAME_SUFFIX as q_,RESERVED_APP_NAME_SUFFIX_MESSAGE as z_,hasReservedAppNameSuffix as Q_}from"./naming/reservedAppNames.js";import{deriveContentHashTag as Er,CONTENT_HASH_TAG_PATTERN as er}from"./infra/deriveContentHashTag.js";import{DEPLOY_MODES as rr,DeployModeSchema as Tr,IMAGE_TAG_PATTERN as Sr,ImageTagSchema as Ar,ServiceArtefactSchema as tr,ServiceArtefactsSchema as or,ARTEFACT_OUTPUT_FIELDS as ar,artefactOutputKey as Nr}from"./infra/deployArtefacts.js";import{MIGRATION_SNAPSHOT_NAME_PREFIX as Ir,MIGRATION_SNAPSHOT_RETENTION_DAYS_ENV as Or,MIGRATION_SNAPSHOT_KIND_TAG_KEY as Cr,MIGRATION_SNAPSHOT_KIND_PREMIGRATE as ir,EXPECTED_SCHEMA_VERSION_ENV as mr,EXPECTED_SCHEMA_VERSION_TOOL_ENV as Pr,EXPECTED_CH_SCHEMA_VERSION_ENV as nr,SCHEMA_ADMIN_USER_ENV as Lr,SCHEMA_ADMIN_PASSWORD_ENV as sr,PRISMA_MIGRATION_DIR_RE as pr,CLICKHOUSE_MIGRATION_SKIP_RE as Dr}from"./migration/constants.js";import{SCHEMA_GATE_EXIT as Mr,SCHEMA_GATE_EXIT_HINTS as Ur,schemaGateExitKind as fr}from"./migration/schemaGateExit.js";import{FJALL_SCHEMA_GATE_USER as ur,FJALL_MAINTENANCE_USER as lr,FJALL_CLICKHOUSE_USERS as xr}from"./migration/clickhouseFrameworkUsers.js";import{PHYSICAL_NAME_FALLBACK_PROPERTIES as dr}from"./cfn/physicalNameProperties.js";import{PATTERN_TYPE_VALUES as Vr,PATTERN_TYPES as Yr,isPatternType as Hr,PATTERN_REGISTRY as hr,patternConstructId as Kr,DEPLOYABLE_PATTERN_TYPES as yr,PATTERN_TIER_VALUES as Br,OPENNEXT_PATTERN_TYPES as vr,isOpenNextPatternType as Xr,OPENNEXT_BUCKET_KEYS as br,isOpenNextBucketKey as kr,patternBucketConstructId as Wr,CLOUDFRONT_PRICE_CLASS_VALUES as Jr,STATIC_SITE_CONFIG_KEYS as jr,STATIC_SITE_DEPLOY_INJECTED_KEYS as wr,STATIC_SITE_CDN_CONFIG_KEYS as Zr,STATIC_SITE_ROUTING_VALUES as qr,STATIC_SITE_ROUTING_INFO as zr,PATTERN_CREATE_INPUT_VALUES as Qr,PATTERN_CREATE_INPUT_FLAGS as $r}from"./patterns/patternTypes.js";import{FRAMEWORK_VALUES as eT,FRAMEWORKS as _T,isFramework as rT,FRAMEWORK_PATTERN_RECOMMENDATIONS as TT,recommendPatternForFramework as ST,CREATABLE_FRAMEWORKS as AT,requiredInputsForFramework as tT}from"./patterns/frameworkPatterns.js";import{DEFAULT_FORMS_FROM_LOCAL_PART as aT,defaultFormsFromAddress as NT,defaultFormsCorsOrigin as RT,isAddressAtDomain as IT}from"./patterns/staticSiteForms.js";import{DEV_SUBSTRATE_PARAMS_SCHEMA_VERSION as CT,DEV_SUBSTRATE_PARAMS_FILENAME as iT,DevSubstrateSynthPropsSchema as mT,DevSubstrateParamsSchema as PT}from"./devSubstrate/params.js";import{DEV_SUBSTRATE_ENTRYPOINT_SOURCE as LT}from"./devSubstrate/entrypoint.js";import{BLESSED_CDK_TOOLCHAIN as pT}from"./cdkToolchain.js";import{DEPLOYMENT_FAILURE_PHASES as cT,DeploymentFailurePhaseSchema as MT,DEPLOYMENT_FAULT_ATTRIBUTIONS as UT,DeploymentFaultAttributionSchema as fT,DEPLOYMENT_FAILURE_PROVIDER_SOURCES as FT,DeploymentFailureProviderSourceSchema as uT,DEPLOYMENT_FAILURE_CODE_PATTERN as lT,DEPLOYMENT_FAILURE_SCHEMA_VERSION as xT,DEPLOYMENT_FAILURE_LIMITS as GT,DeploymentFailureAnalysisSchema as dT,DeploymentFailureProviderSchema as gT,DeploymentFailureResourceSchema as VT,DeploymentFailureSchema as YT,parseDeploymentFailure as HT,DEPLOYMENT_FAILURE_DOCS_BASE_URL as hT,deploymentFailureDocsUrl as KT,DEPLOYMENT_FAULT_COPY as yT,DEPLOYMENT_PROVIDER_LABELS as BT,deriveErrorMessageFromFailure as vT,toDeploymentFailureAnalysis as XT}from"./failure/deploymentFailure.js";import{extractErrorWindow as kT,ERROR_WINDOW_CONTEXT_LINES as WT}from"./failure/extractErrorWindow.js";import{FJALL_COMPONENT_GITIGNORE as jT,FJALL_PROJECT_GITIGNORE as wT,FJALL_STATE_GITIGNORE_ENTRIES as ZT,FJALL_MANAGED_STATE_DIR_ENTRIES as qT,LOCAL_CONFIG_GITIGNORE_ENTRY as zT}from"./scaffold/gitignore.js";import{ensureGitignoreEntries as $T}from"./scaffold/ensureGitignore.js";export{$E as ACCOUNT_ROLES,hE as ACCOUNT_STAGES,YE as ACCOUNT_STAGES_WITH_ROOT,jE as ACCOUNT_STAGE_EFFECTS,KE as ACCOUNT_STAGE_LABELS,BE as ACCOUNT_TIERS,f_ as AGENT_INSTALL_COMMAND,U_ as AGENT_SETUP_PROMPTS,n as APPROVAL_TOKEN_OUTPUT_PREFIX,R_ as APP_TYPES,ar as ARTEFACT_OUTPUT_FIELDS,se as AWS_REGIONS_METADATA,vE as AccountTierSchema,ee as BACKUP_TIERS,_e as BACKUP_TIER_DEFAULTS,re as BACKUP_TIER_TAG_KEY,Te as BACKUP_TIER_TAG_MAP,O as BACKUP_VAULT_CONTEXT_KEY,I as BACKUP_VAULT_NAME,pT as BLESSED_CDK_TOOLCHAIN,Se as BackupTierSchema,C as BackupVaultLockSchema,i as BackupVaultVerdictSchema,k as CAPACITY_ANCHOR_MAX_LENGTH,b as CAPACITY_ANCHOR_PATTERN,W as CAPACITY_IDENTITY_CONTEXT_KEY,v as CAPACITY_SLOT_MAX_LENGTH,B as CAPACITY_SLOT_PATTERN,A_ as CI_PROVIDERS,t_ as CI_SETUP_FIELDS,Dr as CLICKHOUSE_MIGRATION_SKIP_RE,Jr as CLOUDFRONT_PRICE_CLASS_VALUES,ae as CODEMOD_STATEMENT_TYPES,T_ as COMPLIANCE_ISSUE_SEVERITIES,__ as COMPLIANCE_ISSUE_STATUSES,$e as CONNECTION_FAILURE_REASONS,ze as CONNECTION_PHASES,Qe as CONNECTION_TERMINAL_FAILURE_PHASES,er as CONTENT_HASH_TAG_PATTERN,AT as CREATABLE_FRAMEWORKS,N_ as CUSTOM_APP_TYPE,w as CapacityIdentityConfigSchema,J as CapacityIdentityPinSchema,j as CapacityIdentityWireSchema,Ze as ConnectionWireSchema,qe as ConnectionsListResponseSchema,cE as DANGEROUS_ENV_VARS,X as DEFAULT_CAPACITY_SLOT,aT as DEFAULT_FORMS_FROM_LOCAL_PART,pe as DEFAULT_REGION,yr as DEPLOYABLE_PATTERN_TYPES,lT as DEPLOYMENT_FAILURE_CODE_PATTERN,hT as DEPLOYMENT_FAILURE_DOCS_BASE_URL,GT as DEPLOYMENT_FAILURE_LIMITS,cT as DEPLOYMENT_FAILURE_PHASES,FT as DEPLOYMENT_FAILURE_PROVIDER_SOURCES,xT as DEPLOYMENT_FAILURE_SCHEMA_VERSION,UT as DEPLOYMENT_FAULT_ATTRIBUTIONS,yT as DEPLOYMENT_FAULT_COPY,BT as DEPLOYMENT_PROVIDER_LABELS,rr as DEPLOY_MODES,LT as DEV_SUBSTRATE_ENTRYPOINT_SOURCE,iT as DEV_SUBSTRATE_PARAMS_FILENAME,CT as DEV_SUBSTRATE_PARAMS_SCHEMA_VERSION,_ as DNS_APEX,N as DOMAIN_DEPLOY_DEFAULT_PHASE,Tr as DeployModeSchema,dT as DeploymentFailureAnalysisSchema,MT as DeploymentFailurePhaseSchema,gT as DeploymentFailureProviderSchema,uT as DeploymentFailureProviderSourceSchema,VT as DeploymentFailureResourceSchema,YT as DeploymentFailureSchema,fT as DeploymentFaultAttributionSchema,PT as DevSubstrateParamsSchema,mT as DevSubstrateSynthPropsSchema,WT as ERROR_WINDOW_CONTEXT_LINES,nr as EXPECTED_CH_SCHEMA_VERSION_ENV,mr as EXPECTED_SCHEMA_VERSION_ENV,Pr as EXPECTED_SCHEMA_VERSION_TOOL_ENV,E_ as EXTERNAL_ID_PATTERN,xr as FJALL_CLICKHOUSE_USERS,jT as FJALL_COMPONENT_GITIGNORE,IE as FJALL_CONFIG_DIR_ENV,OE as FJALL_CREDENTIALS_FILENAME,CE as FJALL_HOME_DIRNAME,iE as FJALL_LOG_DIR_ENV,lr as FJALL_MAINTENANCE_USER,qT as FJALL_MANAGED_STATE_DIR_ENTRIES,wT as FJALL_PROJECT_GITIGNORE,ur as FJALL_SCHEMA_GATE_USER,ZT as FJALL_STATE_GITIGNORE_ENTRIES,_T as FRAMEWORKS,TT as FRAMEWORK_PATTERN_RECOMMENDATIONS,eT as FRAMEWORK_VALUES,bE as GOVERNANCE_ACCOUNT_TIERS,ge as GOVERNANCE_SCOPE_REQUIRED_CODE,o as HOSTS_OUTPUT_MAX_BYTES,Sr as IMAGE_TAG_PATTERN,a_ as INFRASTRUCTURE_TIER_NAMES,C_ as INSIGHT_CATEGORIES,i_ as INSIGHT_SEVERITIES,m_ as INSIGHT_SORT_VALUES,O_ as INSIGHT_TAB_VALUES,L_ as INSTALL_SOURCES,Ar as ImageTagSchema,zT as LOCAL_CONFIG_GITIGNORE_ENTRY,Ge as MACHINE_ONLY_SCOPES,UE as MASKED_VALUE_MARKER,ce as MAX_SECONDARY_REGIONS,ir as MIGRATION_SNAPSHOT_KIND_PREMIGRATE,Cr as MIGRATION_SNAPSHOT_KIND_TAG_KEY,Ir as MIGRATION_SNAPSHOT_NAME_PREFIX,Or as MIGRATION_SNAPSHOT_RETENTION_DAYS_ENV,br as OPENNEXT_BUCKET_KEYS,vr as OPENNEXT_PATTERN_TYPES,Me as OPT_IN_REGION_CODES,$r as PATTERN_CREATE_INPUT_FLAGS,Qr as PATTERN_CREATE_INPUT_VALUES,hr as PATTERN_REGISTRY,Br as PATTERN_TIER_VALUES,Yr as PATTERN_TYPES,Vr as PATTERN_TYPE_VALUES,dr as PHYSICAL_NAME_FALLBACK_PROPERTIES,pr as PRISMA_MIGRATION_DIR_RE,n_ as PUBLIC_PACKAGE_NAME,uE as REDACTED_KEY_SENTINEL,eE as REGION_SHORT_CODES,j_ as RESERVED_APP_NAMES,w_ as RESERVED_APP_NAME_MESSAGE,q_ as RESERVED_APP_NAME_SUFFIX,z_ as RESERVED_APP_NAME_SUFFIX_MESSAGE,Ie as RESOURCE_CATEGORIES,Fe as RETIRED_REGION_ABBREVIATIONS,sr as SCHEMA_ADMIN_PASSWORD_ENV,Lr as SCHEMA_ADMIN_USER_ENV,Mr as SCHEMA_GATE_EXIT,Ur as SCHEMA_GATE_EXIT_HINTS,lE as SCOPED_TOKEN_REGEX,xe as SCOPE_VALUES,he as SECRET_NAME_ERROR,He as SECRET_NAME_PATTERN,Ve as SESSION_ONLY_API_ROUTES,s_ as SETUP_COMMANDS,D_ as SETUP_MODES,M_ as SETUP_STEPS,c_ as SETUP_STEP_IDS,u_ as SKILL_INSTALL_FILENAME,l_ as SKILL_INSTALL_PATH,F_ as SKILL_INSTALL_SEGMENTS,ye as SSM_COMPONENT_ERROR,Ke as SSM_COMPONENT_PATTERN,Be as SSM_STANDARD_MAX_VALUE_BYTES,Zr as STATIC_SITE_CDN_CONFIG_KEYS,jr as STATIC_SITE_CONFIG_KEYS,wr as STATIC_SITE_DEPLOY_INJECTED_KEYS,zr as STATIC_SITE_ROUTING_INFO,qr as STATIC_SITE_ROUTING_VALUES,HE as STRUCTURAL_ENVIRONMENTS,ve as SecretNamespaceSchema,tr as ServiceArtefactSchema,or as ServiceArtefactsSchema,de as USER_GRANTABLE_SCOPES,Le as abbreviateRegion,u as accountConstructKey,JE as accountStageEffect,qE as accountTier,G as albDnsExportName,d as albHostedZoneIdExportName,Nr as artefactOutputKey,V as bucketWebsiteEndpointExportName,Y as bucketWebsiteHostedZoneIdExportName,y_ as buildAppConfigPath,Xe as buildNamespaceParts,be as buildParameterPath,f as capitalise,Oe as categoriseResource,g as cdnDomainExportName,$ as defaultConnectedAccountName,RT as defaultFormsCorsOrigin,NT as defaultFormsFromAddress,KT as deploymentFailureDocsUrl,g_ as deriveAllTargets,Er as deriveContentHashTag,vT as deriveErrorMessageFromFailure,G_ as deriveRegionsFromOrgConfig,d_ as deriveTargets,h as ec2ServiceName,$T as ensureGitignoreEntries,V_ as environmentOrTier,WE as environmentToTier,je as escapeDotEnvValue,Y_ as explainRetiredTargetName,kT as extractErrorWindow,ME as filterDangerousEnvVars,z as findAccountNameCollision,X_ as findBoundaryPath,v_ as findInfrastructurePaths,H_ as findTarget,_E as findTrailingRegionShortCode,mE as fjallCredentialsPath,PE as fjallHomeDir,nE as fjallLogDir,LE as fjallStatePath,wE as formatAccountStageList,NE as formatErrorString,h_ as generateTargetName,r as getDomainExportNames,T as getDomainStackName,S as getDomainUsEast1CertificatesStackName,QE as getEnvironmentLabel,oE as getErrorCode,AE as getErrorMessage,aE as getErrorStack,Ce as getExpectedDuration,ie as getFriendlyResourceType,De as getRegionInfo,F as getSafeZoneName,l as hasAsciiStableConstructKey,tE as hasErrorCode,Q_ as hasReservedAppNameSuffix,A as hostsExportPartName,s as imageTagParameterName,W_ as inferContainerFromCandidates,yE as isAccountStage,XE as isAccountTier,IT as isAddressAtDomain,Ae as isBackupTier,Ne as isCodemodStatementType,r_ as isComplianceIssueStatus,rT as isFramework,kE as isGovernanceTier,b_ as isInfrastructureFile,We as isManageablePath,a as isManagedDomainBinding,kr as isOpenNextBucketKey,Xr as isOpenNextPatternType,Hr as isPatternType,m as isReownedBackupVault,Z_ as isReservedAppName,gE as mapSettledWithConcurrency,fE as maskSensitiveOutput,K as mintedEc2KeyPairName,SE as normaliseError,Ue as optInRegionWarning,HT as parseDeploymentFailure,Je as parseDotEnv,Pe as parseGitRemoteUrl,ke as parseParameterPath,FE as parseShellArgs,Wr as patternBucketConstructId,Kr as patternConstructId,Z as projectCapacityIdentityToTarget,ST as recommendPatternForFramework,rE as regionSuffixRejectionMessage,fe as regions,tT as requiredInputsForFramework,zE as resolveSynthEnvironment,fr as schemaGateExitKind,t as serialiseHostsChunks,pE as singleton,GE as sleep,ZE as stageFromWireEnvironment,EE as suffixedAccountName,ue as suggestRegionForTimezone,te as tierDefault,XT as toDeploymentFailureAnalysis,c as toKebab,D as toPascalCase,U as toScreamingSnake,M as toValidDatabaseName,p_ as upgradeCommand};

package/dist/infra/backupVault.d.ts

@@ -1,7 +1,84 @@
+import { z } from "zod";
 /**
  * Fixed name of the disaster-recovery backup vault. Single source of truth for
  * the @fjall/components-infrastructure DisasterRecovery construct (which
- * creates the vault under this name) and deploy-core's adopt-vs-create and
- * survival probes (which look it up by the same name).
+ * creates the vault under this name) and deploy-core's ownership and survival
+ * probes (which look it up by the same name).
  */
 export declare const BACKUP_VAULT_NAME = "backupVault";
+/**
+ * CDK context key the deploy engine injects the backup-vault ownership verdict
+ * under (`-c fjallBackupVault=<json>`), read by `readBackupVaultVerdict` in
+ * @fjall/components-infrastructure (`utils/cdkContext.ts`). One JSON value,
+ * not a boolean: the construct needs the live key ARN (a create-only vault
+ * property) to declare a re-owned vault without replacing it, and the live
+ * lock to report it and warn when the configured intent differs.
+ */
+export declare const BACKUP_VAULT_CONTEXT_KEY = "fjallBackupVault";
+/**
+ * The live vault lock as `DescribeBackupVault` reports it. `lockDate` is the
+ * instant a compliance-mode lock became (or becomes) immutable; a governance
+ * lock carries none. Every field is optional: a lock put through the Backup
+ * API may carry a maximum without a minimum, or a lock date alone, so a
+ * locked vault can report none of them. The lock is never declared in a
+ * template — the construct reads it for the `VaultLockEnabled` output and the
+ * intent warning only.
+ */
+export declare const BackupVaultLockSchema: z.ZodObject<{
+    minRetentionDays: z.ZodOptional<z.ZodNumber>;
+    maxRetentionDays: z.ZodOptional<z.ZodNumber>;
+    lockDate: z.ZodOptional<z.ZodString>;
+}, z.core.$strict>;
+export type BackupVaultLock = z.infer<typeof BackupVaultLockSchema>;
+/**
+ * Ownership verdict for the fixed-name DR vault in one account/region, probed
+ * by the deploy engine before synth (`probeBackupVaultOwnership` in
+ * deploy-core):
+ *
+ * - `absent` — no vault; the construct creates it with a stack-managed key.
+ * - `owned` — an `AWS::Backup::BackupVault` with physical id
+ *   `backupVault` is a current resource of THIS account stack. `keyInStack`
+ *   says whether its KMS key is too: if so the template is the create
+ *   template (the vault keeps converging to intent); if not the key is a
+ *   retained survivor and the vault is re-owned — declared against the live
+ *   key, with no lock declared (Fjall never issues a lock call against a
+ *   vault it did not create; the live lock stays as it is).
+ * - `unowned` — the vault exists but is not in the stack: the import
+ *   candidate. The construct declares identity only and the engine deploys
+ *   with `--import-existing-resources`, then re-probes and converges.
+ *
+ * `keyArn` is always a customer-managed key: the probe refuses a vault on an
+ * AWS-owned or AWS-managed key before any verdict is issued, because the
+ * re-owned template aliases the key and the DR plans' cross-account copies
+ * need a customer-managed one. A vault owned by ANOTHER stack is not
+ * distinguished here: the import change set fails with CloudFormation's own
+ * "already belongs to another stack".
+ */
+export declare const BackupVaultVerdictSchema: z.ZodDiscriminatedUnion<[z.ZodObject<{
+    state: z.ZodLiteral<"absent">;
+}, z.core.$strict>, z.ZodObject<{
+    state: z.ZodLiteral<"owned">;
+    keyArn: z.ZodString;
+    keyInStack: z.ZodBoolean;
+    lock: z.ZodNullable<z.ZodObject<{
+        minRetentionDays: z.ZodOptional<z.ZodNumber>;
+        maxRetentionDays: z.ZodOptional<z.ZodNumber>;
+        lockDate: z.ZodOptional<z.ZodString>;
+    }, z.core.$strict>>;
+}, z.core.$strict>, z.ZodObject<{
+    state: z.ZodLiteral<"unowned">;
+    keyArn: z.ZodString;
+    lock: z.ZodNullable<z.ZodObject<{
+        minRetentionDays: z.ZodOptional<z.ZodNumber>;
+        maxRetentionDays: z.ZodOptional<z.ZodNumber>;
+        lockDate: z.ZodOptional<z.ZodString>;
+    }, z.core.$strict>>;
+}, z.core.$strict>], "state">;
+export type BackupVaultVerdict = z.infer<typeof BackupVaultVerdictSchema>;
+/**
+ * Whether a verdict selects the re-owned template: the vault is (or is about
+ * to be) a stack resource whose key lives outside the stack. Shared by the
+ * construct (mode selection) and the engine (the import pass is the
+ * `unowned` half of this).
+ */
+export declare function isReownedBackupVault(verdict: BackupVaultVerdict): boolean;

package/dist/infra/backupVault.js

@@ -1 +1 @@
-const t="backupVault";export{t as BACKUP_VAULT_NAME};
+var i=Object.defineProperty;var n=(e,a)=>i(e,"name",{value:a,configurable:!0});import{z as t}from"zod";const s="backupVault",r="fjallBackupVault",o=t.object({minRetentionDays:t.number().int().positive().optional(),maxRetentionDays:t.number().int().positive().optional(),lockDate:t.string().datetime({offset:!0}).optional()}).strict(),u=t.discriminatedUnion("state",[t.object({state:t.literal("absent")}).strict(),t.object({state:t.literal("owned"),keyArn:t.string().min(1),keyInStack:t.boolean(),lock:o.nullable()}).strict(),t.object({state:t.literal("unowned"),keyArn:t.string().min(1),lock:o.nullable()}).strict()]);function p(e){return e.state==="unowned"||e.state==="owned"&&!e.keyInStack}n(p,"isReownedBackupVault");export{r as BACKUP_VAULT_CONTEXT_KEY,s as BACKUP_VAULT_NAME,o as BackupVaultLockSchema,u as BackupVaultVerdictSchema,p as isReownedBackupVault};

package/dist/infra/tokenScopes.d.ts

@@ -23,3 +23,18 @@ export declare const MACHINE_ONLY_SCOPES: readonly TokenScope[];
 export declare const GOVERNANCE_SCOPE_REQUIRED_CODE = "governance_scope_required";
 /** Scopes a user `*` grant expands to (excludes `admin` + machine-only). */
 export declare const USER_GRANTABLE_SCOPES: readonly TokenScope[];
+/**
+ * API routes that accept ONLY an interactive browser session — every
+ * Bearer-token caller (the CLI, the MCP server, a CI job) is refused at the
+ * webapp's trust boundary regardless of scope. The CLI therefore carries no
+ * client method for any route listed here: a Bearer client targeting one is
+ * dead code that can only ever 403, and the CLI guard test
+ * (`cli/src/util/api/__tests__/sessionOnlyRoutes.guard.test.ts`) fails
+ * closed if one is added.
+ *
+ * Stopgap, deleted with its guard when primitive 4 of the CLI dead-weight
+ * remediation (a per-path API route contract shared by the webapp and its
+ * clients) lands — that contract types the principal class per route, so the
+ * list stops needing to be hand-maintained here.
+ */
+export declare const SESSION_ONLY_API_ROUTES: readonly ["/api/ci/tokens"];

package/dist/infra/tokenScopes.js

@@ -1 +1 @@
-const r=["read","write","deploy","secrets:read","secrets:write","destroy","admin","applications:read","applications:deploy","deploy:oidc:mint","deploy:governance"],o={read:"user",write:"user",deploy:"user","secrets:read":"user","secrets:write":"user",destroy:"user",admin:"admin","applications:read":"user","applications:deploy":"user","deploy:oidc:mint":"machine","deploy:governance":"machine"},s=r.filter(e=>o[e]==="machine"),t="governance_scope_required",i=r.filter(e=>o[e]==="user");export{t as GOVERNANCE_SCOPE_REQUIRED_CODE,s as MACHINE_ONLY_SCOPES,r as SCOPE_VALUES,i as USER_GRANTABLE_SCOPES};
+const r=["read","write","deploy","secrets:read","secrets:write","destroy","admin","applications:read","applications:deploy","deploy:oidc:mint","deploy:governance"],o={read:"user",write:"user",deploy:"user","secrets:read":"user","secrets:write":"user",destroy:"user",admin:"admin","applications:read":"user","applications:deploy":"user","deploy:oidc:mint":"machine","deploy:governance":"machine"},s=r.filter(e=>o[e]==="machine"),t="governance_scope_required",i=r.filter(e=>o[e]==="user"),n=["/api/ci/tokens"];export{t as GOVERNANCE_SCOPE_REQUIRED_CODE,s as MACHINE_ONLY_SCOPES,r as SCOPE_VALUES,n as SESSION_ONLY_API_ROUTES,i as USER_GRANTABLE_SCOPES};