@fjall/util 37.0.0 → 38.0.0

package/dist/.minified

@@ -1 +1 @@
-131 files minified at 2026-09-14T08:49:14.213Z
+136 files minified at 2026-09-18T21:39:28.638Z

package/dist/appTypes.d.ts

@@ -0,0 +1,27 @@
+/**
+ * The infrastructure tier vocabulary — what `fjall apps create --type` accepts,
+ * and the ONE spelling the generator's `AppTypeSchema`, the CLI's
+ * `commandSchemas.ts` and the MCP's `plan_app_scaffold` input all derive from.
+ *
+ * Not the pattern tiers (`PATTERN_TIER_VALUES`: lightweight … custom), which
+ * govern `--pattern-tier`. The two vocabularies overlap on three members and
+ * were conflated on the MCP surface until Train 4 of the 2026-09-07 hardening
+ * prompt; keeping both here, each naming the other, is what stops the next
+ * reader picking whichever tuple is nearer.
+ *
+ * The MCP shells out to the CLI and can import neither it nor the generator at
+ * runtime, so util is the seam all three read — the same rationale as
+ * `ciSetup.ts` and `patterns/patternTypes.ts`.
+ *
+ * Client-safe (no node built-ins) — exported from the root barrel.
+ */
+export declare const INFRASTRUCTURE_TIER_NAMES: readonly ["tinkerer", "lightweight", "standard", "resilient", "enterprise"];
+export type InfrastructureTierName = (typeof INFRASTRUCTURE_TIER_NAMES)[number];
+/**
+ * The escape hatch: an app that declares its own resources rather than taking
+ * a tier preset. A member of `APP_TYPES`, never of the tier tuple — the presets
+ * are a `Record<InfrastructureTierName, …>` and `custom` has no preset row.
+ */
+export declare const CUSTOM_APP_TYPE: "custom";
+export declare const APP_TYPES: readonly ["tinkerer", "lightweight", "standard", "resilient", "enterprise", "custom"];
+export type AppType = (typeof APP_TYPES)[number];

package/dist/appTypes.js

@@ -0,0 +1 @@
+const t=["tinkerer","lightweight","standard","resilient","enterprise"],e="custom",r=[...t,e];export{r as APP_TYPES,e as CUSTOM_APP_TYPE,t as INFRASTRUCTURE_TIER_NAMES};

package/dist/aws/index.d.ts

@@ -1,5 +1,6 @@
 export { AWSError, NoRolesFoundError, InvalidCredentialsError, SSOTokenExpiredError, MissingRegionError, ProfileNotFoundError, CommandError, isAWSError, isNoRolesFoundError, isSSOUnauthorizedError } from "./errors.js";
 export { STACK_NOT_FOUND_PATTERN, CDK_NO_STACKS_MATCH, type ResourceEvent, isResourceEvent } from "./cloudformationTypes.js";
+export { AWS_RESOURCE_TYPES, type AwsResourceType, isAwsResourceType } from "./resourceTypes.js";
 export { type ResourceProgressCounts, countResourceProgress, formatElapsed } from "./deployProgress.js";
 export { CloudFormationFailureAnalyser, type RootCause, type FailureAnalysis } from "./CloudFormationFailureAnalyser.js";
 export { FAILURE_ANALYSIS_CATEGORIES, type FailureAnalysisCategory } from "./failureAnalysisCategories.js";

package/dist/aws/index.js

@@ -1 +1 @@
-import{AWSError as E,NoRolesFoundError as e,InvalidCredentialsError as _,SSOTokenExpiredError as T,MissingRegionError as A,ProfileNotFoundError as t,CommandError as O,isAWSError as S,isNoRolesFoundError as s,isSSOUnauthorizedError as i}from"./errors.js";import{STACK_NOT_FOUND_PATTERN as N,CDK_NO_STACKS_MATCH as n,isResourceEvent as R}from"./cloudformationTypes.js";import{countResourceProgress as C,formatElapsed as I}from"./deployProgress.js";import{CloudFormationFailureAnalyser as m}from"./CloudFormationFailureAnalyser.js";import{FAILURE_ANALYSIS_CATEGORIES as u}from"./failureAnalysisCategories.js";import{maskFailureAnalysis as l}from"./maskFailureAnalysis.js";import{classifyDriftSuspectEvents as x,findCurrentOperationStart as F,isDriftSuspectReason as K,isOperationOpeningEvent as M}from"./driftSuspects.js";import{IPAM_OPERATIONS_POOL_TAG_KEY as Y,formatIpamPairTagValue as g}from"./ipamTags.js";import{FJALL_RESOURCE_TYPE_TAG_KEY as c,FJALL_RESOURCE_TYPES as D,KMS_ALIAS_TAG_KEY as v,KMS_RETENTION_TAG_KEY as y,S3_VERSIONING_EXEMPT_TAG_KEY as V,S3_VERSIONING_EXEMPTIONS as W,SDK_PRE_EMPTY_TAG_KEY as h}from"./infraTags.js";import{COST_ALLOCATION_TAGS as J,DEFAULT_COST_ALLOCATION_ENVIRONMENT as X,DEFAULT_COST_ALLOCATION_OWNER as z,ecrCreateRepositoryTags as H,rdsPreMigrationSnapshotTags as b}from"./costAllocationTags.js";import{ACCOUNT_MONITORING_ROLE_NAME as q}from"./monitoringRole.js";export{q as ACCOUNT_MONITORING_ROLE_NAME,E as AWSError,n as CDK_NO_STACKS_MATCH,J as COST_ALLOCATION_TAGS,m as CloudFormationFailureAnalyser,O as CommandError,X as DEFAULT_COST_ALLOCATION_ENVIRONMENT,z as DEFAULT_COST_ALLOCATION_OWNER,u as FAILURE_ANALYSIS_CATEGORIES,D as FJALL_RESOURCE_TYPES,c as FJALL_RESOURCE_TYPE_TAG_KEY,Y as IPAM_OPERATIONS_POOL_TAG_KEY,_ as InvalidCredentialsError,v as KMS_ALIAS_TAG_KEY,y as KMS_RETENTION_TAG_KEY,A as MissingRegionError,e as NoRolesFoundError,t as ProfileNotFoundError,W as S3_VERSIONING_EXEMPTIONS,V as S3_VERSIONING_EXEMPT_TAG_KEY,h as SDK_PRE_EMPTY_TAG_KEY,T as SSOTokenExpiredError,N as STACK_NOT_FOUND_PATTERN,x as classifyDriftSuspectEvents,C as countResourceProgress,H as ecrCreateRepositoryTags,F as findCurrentOperationStart,I as formatElapsed,g as formatIpamPairTagValue,S as isAWSError,K as isDriftSuspectReason,s as isNoRolesFoundError,M as isOperationOpeningEvent,R as isResourceEvent,i as isSSOUnauthorizedError,l as maskFailureAnalysis,b as rdsPreMigrationSnapshotTags};
+import{AWSError as E,NoRolesFoundError as e,InvalidCredentialsError as _,SSOTokenExpiredError as T,MissingRegionError as A,ProfileNotFoundError as S,CommandError as t,isAWSError as O,isNoRolesFoundError as s,isSSOUnauthorizedError as i}from"./errors.js";import{STACK_NOT_FOUND_PATTERN as N,CDK_NO_STACKS_MATCH as n,isResourceEvent as R}from"./cloudformationTypes.js";import{AWS_RESOURCE_TYPES as C,isAwsResourceType as I}from"./resourceTypes.js";import{countResourceProgress as m,formatElapsed as L}from"./deployProgress.js";import{CloudFormationFailureAnalyser as P}from"./CloudFormationFailureAnalyser.js";import{FAILURE_ANALYSIS_CATEGORIES as x}from"./failureAnalysisCategories.js";import{maskFailureAnalysis as F}from"./maskFailureAnalysis.js";import{classifyDriftSuspectEvents as M,findCurrentOperationStart as G,isDriftSuspectReason as Y,isOperationOpeningEvent as U}from"./driftSuspects.js";import{IPAM_OPERATIONS_POOL_TAG_KEY as g,formatIpamPairTagValue as D}from"./ipamTags.js";import{FJALL_RESOURCE_TYPE_TAG_KEY as v,FJALL_RESOURCE_TYPES as V,KMS_ALIAS_TAG_KEY as W,KMS_RETENTION_TAG_KEY as h,S3_VERSIONING_EXEMPT_TAG_KEY as k,S3_VERSIONING_EXEMPTIONS as J,SDK_PRE_EMPTY_TAG_KEY as X}from"./infraTags.js";import{COST_ALLOCATION_TAGS as z,DEFAULT_COST_ALLOCATION_ENVIRONMENT as H,DEFAULT_COST_ALLOCATION_OWNER as b,ecrCreateRepositoryTags as j,rdsPreMigrationSnapshotTags as q}from"./costAllocationTags.js";import{ACCOUNT_MONITORING_ROLE_NAME as Q}from"./monitoringRole.js";export{Q as ACCOUNT_MONITORING_ROLE_NAME,E as AWSError,C as AWS_RESOURCE_TYPES,n as CDK_NO_STACKS_MATCH,z as COST_ALLOCATION_TAGS,P as CloudFormationFailureAnalyser,t as CommandError,H as DEFAULT_COST_ALLOCATION_ENVIRONMENT,b as DEFAULT_COST_ALLOCATION_OWNER,x as FAILURE_ANALYSIS_CATEGORIES,V as FJALL_RESOURCE_TYPES,v as FJALL_RESOURCE_TYPE_TAG_KEY,g as IPAM_OPERATIONS_POOL_TAG_KEY,_ as InvalidCredentialsError,W as KMS_ALIAS_TAG_KEY,h as KMS_RETENTION_TAG_KEY,A as MissingRegionError,e as NoRolesFoundError,S as ProfileNotFoundError,J as S3_VERSIONING_EXEMPTIONS,k as S3_VERSIONING_EXEMPT_TAG_KEY,X as SDK_PRE_EMPTY_TAG_KEY,T as SSOTokenExpiredError,N as STACK_NOT_FOUND_PATTERN,M as classifyDriftSuspectEvents,m as countResourceProgress,j as ecrCreateRepositoryTags,G as findCurrentOperationStart,L as formatElapsed,D as formatIpamPairTagValue,O as isAWSError,I as isAwsResourceType,Y as isDriftSuspectReason,s as isNoRolesFoundError,U as isOperationOpeningEvent,R as isResourceEvent,i as isSSOUnauthorizedError,F as maskFailureAnalysis,q as rdsPreMigrationSnapshotTags};

package/dist/aws/resourceTypes.d.ts

@@ -0,0 +1,54 @@
+/**
+ * The resource-type literals Fjall's posture surfaces speak in: what the
+ * scan stores as an asset's resource type, what a compliance rule lists as
+ * the types it judges, and the vocabulary the policy registries' `kind`
+ * column is drawn from (`POLICY_RESOURCE_KINDS`). One table, keyed by a
+ * screaming-snake name, so a row's kind, a rule's list and an asset's
+ * stored type compare by equality — never through a mapping that could
+ * drift. The spelling is CloudFormation's `AWS::Service::Type` and most
+ * entries are CloudFormation's own; four are the scan's (`AWS::EBS::Volume`,
+ * `AWS::ACM::Certificate`, `AWS::ECS::Task`, `AWS::RDS::DBSnapshot` — types
+ * CloudFormation spells differently or does not have), so an entry is never
+ * corrected against the CloudFormation registry: the stored vocabulary is
+ * the contract. A type joins the table when a surface needs it, and nothing
+ * here imports a node built-in, so the browser-facing subpaths may read it.
+ */
+export declare const AWS_RESOURCE_TYPES: {
+    readonly EC2_INSTANCE: "AWS::EC2::Instance";
+    readonly EC2_SECURITY_GROUP: "AWS::EC2::SecurityGroup";
+    readonly EC2_VPC: "AWS::EC2::VPC";
+    readonly EC2_SUBNET: "AWS::EC2::Subnet";
+    readonly EC2_NETWORK_INTERFACE: "AWS::EC2::NetworkInterface";
+    readonly EBS_VOLUME: "AWS::EBS::Volume";
+    readonly RDS_DB_INSTANCE: "AWS::RDS::DBInstance";
+    readonly RDS_DB_CLUSTER: "AWS::RDS::DBCluster";
+    readonly RDS_DB_SNAPSHOT: "AWS::RDS::DBSnapshot";
+    readonly S3_BUCKET: "AWS::S3::Bucket";
+    readonly LAMBDA_FUNCTION: "AWS::Lambda::Function";
+    readonly ECS_CLUSTER: "AWS::ECS::Cluster";
+    readonly ECS_SERVICE: "AWS::ECS::Service";
+    readonly ECS_TASK: "AWS::ECS::Task";
+    readonly ECS_TASK_DEFINITION: "AWS::ECS::TaskDefinition";
+    readonly DYNAMODB_TABLE: "AWS::DynamoDB::Table";
+    readonly CLOUDFRONT_DISTRIBUTION: "AWS::CloudFront::Distribution";
+    readonly IAM_ROLE: "AWS::IAM::Role";
+    readonly IAM_POLICY: "AWS::IAM::Policy";
+    readonly IAM_USER: "AWS::IAM::User";
+    readonly IAM_GROUP: "AWS::IAM::Group";
+    readonly KMS_KEY: "AWS::KMS::Key";
+    readonly CLOUDTRAIL_TRAIL: "AWS::CloudTrail::Trail";
+    readonly CLOUDWATCH_ALARM: "AWS::CloudWatch::Alarm";
+    readonly LOGS_LOG_GROUP: "AWS::Logs::LogGroup";
+    readonly SNS_TOPIC: "AWS::SNS::Topic";
+    readonly SQS_QUEUE: "AWS::SQS::Queue";
+    readonly APIGATEWAYV2_API: "AWS::ApiGatewayV2::Api";
+    readonly SECRETS_MANAGER_SECRET: "AWS::SecretsManager::Secret";
+    readonly ACM_CERTIFICATE: "AWS::ACM::Certificate";
+    readonly ELBV2_LOAD_BALANCER: "AWS::ElasticLoadBalancingV2::LoadBalancer";
+    readonly ELASTICACHE_CLUSTER: "AWS::ElastiCache::CacheCluster";
+    readonly ROUTE53_HOSTED_ZONE: "AWS::Route53::HostedZone";
+    readonly BACKUP_VAULT: "AWS::Backup::BackupVault";
+};
+export type AwsResourceType = (typeof AWS_RESOURCE_TYPES)[keyof typeof AWS_RESOURCE_TYPES];
+/** Membership in the table, and nothing else: case and shape are not judged. */
+export declare function isAwsResourceType(value: unknown): value is AwsResourceType;

package/dist/aws/resourceTypes.js

@@ -0,0 +1 @@
+var C=Object.defineProperty;var A=(S,E)=>C(S,"name",{value:E,configurable:!0});const _={EC2_INSTANCE:"AWS::EC2::Instance",EC2_SECURITY_GROUP:"AWS::EC2::SecurityGroup",EC2_VPC:"AWS::EC2::VPC",EC2_SUBNET:"AWS::EC2::Subnet",EC2_NETWORK_INTERFACE:"AWS::EC2::NetworkInterface",EBS_VOLUME:"AWS::EBS::Volume",RDS_DB_INSTANCE:"AWS::RDS::DBInstance",RDS_DB_CLUSTER:"AWS::RDS::DBCluster",RDS_DB_SNAPSHOT:"AWS::RDS::DBSnapshot",S3_BUCKET:"AWS::S3::Bucket",LAMBDA_FUNCTION:"AWS::Lambda::Function",ECS_CLUSTER:"AWS::ECS::Cluster",ECS_SERVICE:"AWS::ECS::Service",ECS_TASK:"AWS::ECS::Task",ECS_TASK_DEFINITION:"AWS::ECS::TaskDefinition",DYNAMODB_TABLE:"AWS::DynamoDB::Table",CLOUDFRONT_DISTRIBUTION:"AWS::CloudFront::Distribution",IAM_ROLE:"AWS::IAM::Role",IAM_POLICY:"AWS::IAM::Policy",IAM_USER:"AWS::IAM::User",IAM_GROUP:"AWS::IAM::Group",KMS_KEY:"AWS::KMS::Key",CLOUDTRAIL_TRAIL:"AWS::CloudTrail::Trail",CLOUDWATCH_ALARM:"AWS::CloudWatch::Alarm",LOGS_LOG_GROUP:"AWS::Logs::LogGroup",SNS_TOPIC:"AWS::SNS::Topic",SQS_QUEUE:"AWS::SQS::Queue",APIGATEWAYV2_API:"AWS::ApiGatewayV2::Api",SECRETS_MANAGER_SECRET:"AWS::SecretsManager::Secret",ACM_CERTIFICATE:"AWS::ACM::Certificate",ELBV2_LOAD_BALANCER:"AWS::ElasticLoadBalancingV2::LoadBalancer",ELASTICACHE_CLUSTER:"AWS::ElastiCache::CacheCluster",ROUTE53_HOSTED_ZONE:"AWS::Route53::HostedZone",BACKUP_VAULT:"AWS::Backup::BackupVault"},e=new Set(Object.values(_));function W(S){return typeof S=="string"&&e.has(S)}A(W,"isAwsResourceType");export{_ as AWS_RESOURCE_TYPES,W as isAwsResourceType};

package/dist/backupTiers.d.ts

@@ -70,7 +70,10 @@ export interface BackupTierDefaults {
      * lifecycle-expired access-log bucket.
      */
     readonly albAccessLogs: boolean;
-    /** CloudFront standard (legacy) logging to the same access-log bucket. */
+    /**
+     * CloudFront standard logging (v2, CloudWatch-vended) to the same
+     * access-log bucket, as JSON.
+     */
     readonly cloudFrontLogging: boolean;
     /** Lambda active X-Ray tracing. */
     readonly lambdaTracing: boolean;

package/dist/ciSetup.d.ts

@@ -0,0 +1,25 @@
+/**
+ * `fjall ci setup` vocabulary — the ONE spelling the CLI's `--provider`
+ * option, its `CI_SETUP_SCHEMA` agent projection and the MCP's
+ * `plan_ci_setup` / `apply_ci_setup` pin all derive from.
+ *
+ * The MCP shells out to the CLI and cannot import it (`@fjall/cli` publishes
+ * a bin, no module exports), so until this module the two packages carried
+ * the provider list and the TOON field names as separate literals kept "in
+ * lockstep" by a comment. The MCP's pin reads the CLI's `--agent` output by
+ * field NAME (`provider: …`, `app: …`) and gates a deploy-token mint on the
+ * result, so a rename on one side silently un-pinned the other. Both sides
+ * now read these tuples; a rename is a typecheck failure in both packages.
+ *
+ * Client-safe (no node built-ins) — exported from the root barrel.
+ */
+export declare const CI_PROVIDERS: readonly ["github", "buildkite"];
+export type CiProvider = (typeof CI_PROVIDERS)[number];
+/**
+ * The fields `fjall ci setup --agent` renders as flat TOON `key: value`
+ * lines (the CLI's `CI_SETUP_SCHEMA.defaultFields`, in render order). No token
+ * field: the CLI never holds a deploy token — `mintUrl` is the hand-off to the
+ * web app that mints it.
+ */
+export declare const CI_SETUP_FIELDS: readonly ["provider", "repo", "app", "workflowPath", "planned", "workflowWritten", "deployTarget", "mintUrl", "secretName"];
+export type CiSetupField = (typeof CI_SETUP_FIELDS)[number];

package/dist/ciSetup.js

@@ -0,0 +1 @@
+const e=["github","buildkite"],t=["provider","repo","app","workflowPath","planned","workflowWritten","deployTarget","mintUrl","secretName"];export{e as CI_PROVIDERS,t as CI_SETUP_FIELDS};

package/dist/complianceIssue.d.ts

@@ -44,3 +44,13 @@ export declare const COMPLIANCE_ISSUE_STATUSES: readonly ["open", "acknowledged"
 export type ComplianceIssueStatus = (typeof COMPLIANCE_ISSUE_STATUSES)[number];
 /** Type guard: checks whether a string is a ComplianceIssue status. */
 export declare function isComplianceIssueStatus(value: string): value is ComplianceIssueStatus;
+/**
+ * ComplianceIssue severity vocabulary, most severe first — the order the
+ * webapp's `COMPLIANCE_SEVERITY_RANK` (app/.server/types/database-enums.ts)
+ * ranks by and its `/api/compliance/issues` `severity` filter accepts. The
+ * `mcp` `list_compliance_issues` filter builds `z.enum(...)` from it (same
+ * no-zod-here rationale as the statuses).
+ */
+export declare const COMPLIANCE_ISSUE_SEVERITIES: readonly ["critical", "high", "medium", "low"];
+/** @public — tuple companion type; ships with its tuple (knip skips @public) */
+export type ComplianceIssueSeverity = (typeof COMPLIANCE_ISSUE_SEVERITIES)[number];

package/dist/complianceIssue.js

@@ -1 +1 @@
-var S=Object.defineProperty;var t=(e,n)=>S(e,"name",{value:n,configurable:!0});const s=["open","acknowledged","pending_verification","resolved","suppressed","expected","mitigated"],o=new Set(s);function p(e){return o.has(e)}t(p,"isComplianceIssueStatus");export{s as COMPLIANCE_ISSUE_STATUSES,p as isComplianceIssueStatus};
+var i=Object.defineProperty;var t=(e,S)=>i(e,"name",{value:S,configurable:!0});const n=["open","acknowledged","pending_verification","resolved","suppressed","expected","mitigated"],o=new Set(n);function E(e){return o.has(e)}t(E,"isComplianceIssueStatus");const c=["critical","high","medium","low"];export{c as COMPLIANCE_ISSUE_SEVERITIES,n as COMPLIANCE_ISSUE_STATUSES,E as isComplianceIssueStatus};

package/dist/deploy/approvalTokenOutput.d.ts

@@ -9,12 +9,3 @@
  * silently. `@fjall/util` is the lowest common dependency of both.
  */
 export declare const APPROVAL_TOKEN_OUTPUT_PREFIX = "Approval token: ";
-/**
- * The exact stderr prefix the CLI prints a minted user token under
- * (`fjall user token create`). Deploy tokens are minted in the web app only
- * — `fjall ci setup` prints no token and the MCP `apply_ci_setup` handler
- * parses none — so this is a CLI-side print contract, single-sourced here
- * because it is the one place a minted credential is ever written to a
- * stream.
- */
-export declare const TOKEN_STDERR_PREFIX = "Token: ";

package/dist/deploy/approvalTokenOutput.js

@@ -1 +1 @@
-const o="Approval token: ",T="Token: ";export{o as APPROVAL_TOKEN_OUTPUT_PREFIX,T as TOKEN_STDERR_PREFIX};
+const o="Approval token: ";export{o as APPROVAL_TOKEN_OUTPUT_PREFIX};

package/dist/index.d.ts

@@ -1,6 +1,7 @@
 export { DNS_APEX, getDomainExportNames, getDomainStackName, getDomainUsEast1CertificatesStackName, hostsExportPartName, serialiseHostsChunks, HOSTS_OUTPUT_MAX_BYTES, isManagedDomainBinding, DOMAIN_DEPLOY_DEFAULT_PHASE, type DomainDeployPhase, type ManagedDomainBinding, type ManagedDomainCoverage, type ManagedDomainExports } from "./infra/domainExports.js";
-export { BACKUP_VAULT_NAME } from "./infra/backupVault.js";
-export { APPROVAL_TOKEN_OUTPUT_PREFIX, TOKEN_STDERR_PREFIX } from "./deploy/approvalTokenOutput.js";
+export { BACKUP_VAULT_NAME, BACKUP_VAULT_CONTEXT_KEY, BackupVaultLockSchema, type BackupVaultLock, BackupVaultVerdictSchema, type BackupVaultVerdict, isReownedBackupVault } from "./infra/backupVault.js";
+export { type NonEmptyPartial } from "./nonEmptyPartial.js";
+export { APPROVAL_TOKEN_OUTPUT_PREFIX } from "./deploy/approvalTokenOutput.js";
 export { imageTagParameterName } from "./infra/imageTags.js";
 export { toPascalCase, toKebab, toValidDatabaseName, toScreamingSnake, capitalise, getSafeZoneName, accountConstructKey, hasAsciiStableConstructKey } from "./naming/caseConversion.js";
 export { albDnsExportName, albHostedZoneIdExportName, cdnDomainExportName, bucketWebsiteEndpointExportName, bucketWebsiteHostedZoneIdExportName } from "./naming/targetExportNames.js";
@@ -23,7 +24,10 @@ export { abbreviateRegion, AWS_REGIONS_METADATA, DEFAULT_REGION, getRegionInfo,
 export { SCOPE_VALUES, MACHINE_ONLY_SCOPES, USER_GRANTABLE_SCOPES, GOVERNANCE_SCOPE_REQUIRED_CODE, SESSION_ONLY_API_ROUTES, type TokenScope } from "./infra/tokenScopes.js";
 export { SECRET_NAME_PATTERN, SECRET_NAME_ERROR, SSM_COMPONENT_PATTERN, SSM_COMPONENT_ERROR, SSM_STANDARD_MAX_VALUE_BYTES, SecretNamespaceSchema, type SecretNamespace, buildNamespaceParts, buildParameterPath, parseParameterPath, isManageablePath, parseDotEnv, escapeDotEnvValue } from "./secrets.js";
 export { ConnectionWireSchema, type ConnectionWire, ConnectionsListResponseSchema, type ConnectionsListResponse, CONNECTION_PHASES, type ConnectionPhase, CONNECTION_TERMINAL_FAILURE_PHASES, type ConnectionTerminalFailurePhase, CONNECTION_FAILURE_REASONS, type ConnectionFailureReason, EXTERNAL_ID_PATTERN } from "./infra/connectionsWire.js";
-export { COMPLIANCE_ISSUE_STATUSES, type ComplianceIssueStatus, isComplianceIssueStatus } from "./complianceIssue.js";
+export { COMPLIANCE_ISSUE_STATUSES, type ComplianceIssueStatus, isComplianceIssueStatus, COMPLIANCE_ISSUE_SEVERITIES, type ComplianceIssueSeverity } from "./complianceIssue.js";
+export { CI_PROVIDERS, type CiProvider, CI_SETUP_FIELDS, type CiSetupField } from "./ciSetup.js";
+export { INFRASTRUCTURE_TIER_NAMES, type InfrastructureTierName, CUSTOM_APP_TYPE, APP_TYPES, type AppType } from "./appTypes.js";
+export { INSIGHT_TAB_VALUES, type InsightTab, INSIGHT_CATEGORIES, type InsightCategory, INSIGHT_SEVERITIES, type InsightSeverity, INSIGHT_SORT_VALUES, type InsightSort } from "./insights/vocabulary.js";
 export { PUBLIC_PACKAGE_NAME, INSTALL_SOURCES, type InstallSource, SETUP_COMMANDS, type SetupCommandId, upgradeCommand, SETUP_MODES, type SetupMode, SETUP_STEP_IDS, type SetupStepId, type SetupStep, type SetupStepSequence, SETUP_STEPS, AGENT_SETUP_PROMPTS, AGENT_INSTALL_COMMAND, SKILL_INSTALL_SEGMENTS, SKILL_INSTALL_FILENAME, SKILL_INSTALL_PATH } from "./onboarding/index.js";
 export { deriveRegionsFromOrgConfig, deriveTargets, deriveAllTargets, environmentOrTier, explainRetiredTargetName, findTarget, generateTargetName, type OrgConfigRegions, type TargetAccount, type DerivedTarget, type ResolvedTargetAccount } from "./targets.js";
 export { buildAppConfigPath } from "./repo/appPath.js";
@@ -37,8 +41,8 @@ export { MIGRATION_SNAPSHOT_NAME_PREFIX, MIGRATION_SNAPSHOT_RETENTION_DAYS_ENV,
 export { SCHEMA_GATE_EXIT, SCHEMA_GATE_EXIT_HINTS, schemaGateExitKind, type SchemaGateExitKind, type SchemaGateExitCode } from "./migration/schemaGateExit.js";
 export { FJALL_SCHEMA_GATE_USER, FJALL_MAINTENANCE_USER, FJALL_CLICKHOUSE_USERS, type FjallClickHouseUser } from "./migration/clickhouseFrameworkUsers.js";
 export { PHYSICAL_NAME_FALLBACK_PROPERTIES } from "./cfn/physicalNameProperties.js";
-export { PATTERN_TYPE_VALUES, type PatternType, PATTERN_TYPES, isPatternType, type PatternArtefact, type PatternStackPlacement, type PatternDescriptor, PATTERN_REGISTRY, patternConstructId, DEPLOYABLE_PATTERN_TYPES, type OpenNextPatternType, OPENNEXT_PATTERN_TYPES, isOpenNextPatternType, CLOUDFRONT_PRICE_CLASS_VALUES, type CloudFrontPriceClass, STATIC_SITE_CONFIG_KEYS, type StaticSiteConfigKey, STATIC_SITE_DEPLOY_INJECTED_KEYS, type StaticSiteDeployInjectedKey, STATIC_SITE_CDN_CONFIG_KEYS, type StaticSiteCdnConfigKey, STATIC_SITE_ROUTING_VALUES, STATIC_SITE_ROUTING_INFO, type StaticSiteRouting, type StaticSiteRoutingDescriptor, PATTERN_CREATE_INPUT_VALUES, type PatternCreateInput, PATTERN_CREATE_INPUT_FLAGS } from "./patterns/patternTypes.js";
-export { FRAMEWORK_VALUES, type Framework, FRAMEWORKS, isFramework, type DeployablePatternType, type UndeployablePatternType, type PatternRecommendation, FRAMEWORK_PATTERN_RECOMMENDATIONS, recommendPatternForFramework, CREATABLE_FRAMEWORKS, requiredInputsForFramework } from "./patterns/frameworkPatterns.js";
+export { PATTERN_TYPE_VALUES, type PatternType, PATTERN_TYPES, isPatternType, type PatternArtefact, type PatternStackPlacement, type PatternDescriptor, PATTERN_REGISTRY, patternConstructId, type DeployablePatternType, DEPLOYABLE_PATTERN_TYPES, PATTERN_TIER_VALUES, type PatternTier, type OpenNextPatternType, OPENNEXT_PATTERN_TYPES, isOpenNextPatternType, OPENNEXT_BUCKET_KEYS, type OpenNextBucketKey, isOpenNextBucketKey, patternBucketConstructId, CLOUDFRONT_PRICE_CLASS_VALUES, type CloudFrontPriceClass, STATIC_SITE_CONFIG_KEYS, type StaticSiteConfigKey, STATIC_SITE_DEPLOY_INJECTED_KEYS, type StaticSiteDeployInjectedKey, STATIC_SITE_CDN_CONFIG_KEYS, type StaticSiteCdnConfigKey, STATIC_SITE_ROUTING_VALUES, STATIC_SITE_ROUTING_INFO, type StaticSiteRouting, type StaticSiteRoutingDescriptor, PATTERN_CREATE_INPUT_VALUES, type PatternCreateInput, PATTERN_CREATE_INPUT_FLAGS } from "./patterns/patternTypes.js";
+export { FRAMEWORK_VALUES, type Framework, FRAMEWORKS, isFramework, type UndeployablePatternType, type PatternRecommendation, FRAMEWORK_PATTERN_RECOMMENDATIONS, recommendPatternForFramework, CREATABLE_FRAMEWORKS, requiredInputsForFramework } from "./patterns/frameworkPatterns.js";
 export { DEFAULT_FORMS_FROM_LOCAL_PART, defaultFormsFromAddress, defaultFormsCorsOrigin, isAddressAtDomain } from "./patterns/staticSiteForms.js";
 export { DEV_SUBSTRATE_PARAMS_SCHEMA_VERSION, DEV_SUBSTRATE_PARAMS_FILENAME, DevSubstrateSynthPropsSchema, type DevSubstrateSynthProps, DevSubstrateParamsSchema, type DevSubstrateParams } from "./devSubstrate/params.js";
 export { DEV_SUBSTRATE_ENTRYPOINT_SOURCE } from "./devSubstrate/entrypoint.js";

package/dist/index.js

@@ -1 +1 @@
-import{DNS_APEX as _,getDomainExportNames as r,getDomainStackName as T,getDomainUsEast1CertificatesStackName as A,hostsExportPartName as S,serialiseHostsChunks as t,HOSTS_OUTPUT_MAX_BYTES as o,isManagedDomainBinding as a,DOMAIN_DEPLOY_DEFAULT_PHASE as N}from"./infra/domainExports.js";import{BACKUP_VAULT_NAME as I}from"./infra/backupVault.js";import{APPROVAL_TOKEN_OUTPUT_PREFIX as i,TOKEN_STDERR_PREFIX as C}from"./deploy/approvalTokenOutput.js";import{imageTagParameterName as n}from"./infra/imageTags.js";import{toPascalCase as L,toKebab as s,toValidDatabaseName as p,toScreamingSnake as D,capitalise as M,getSafeZoneName as c,accountConstructKey as f,hasAsciiStableConstructKey as U}from"./naming/caseConversion.js";import{albDnsExportName as l,albHostedZoneIdExportName as u,cdnDomainExportName as x,bucketWebsiteEndpointExportName as d,bucketWebsiteHostedZoneIdExportName as G}from"./naming/targetExportNames.js";import{ec2ServiceName as Y,mintedEc2KeyPairName as h}from"./naming/ec2Naming.js";import{CAPACITY_SLOT_PATTERN as V,CAPACITY_SLOT_MAX_LENGTH as K,DEFAULT_CAPACITY_SLOT as y,CAPACITY_ANCHOR_PATTERN as v,CAPACITY_ANCHOR_MAX_LENGTH as B,CAPACITY_IDENTITY_CONTEXT_KEY as X,CapacityIdentityPinSchema as b,CapacityIdentityWireSchema as W,CapacityIdentityConfigSchema as k,projectCapacityIdentityToTarget as J}from"./capacityIdentity.js";import{findAccountNameCollision as w}from"./naming/accountNameCollision.js";import{defaultConnectedAccountName as q,suffixedAccountName as z,REGION_SHORT_CODES as Q,findTrailingRegionShortCode as $,regionSuffixRejectionMessage as ee}from"./naming/connectedAccountName.js";import{normaliseError as _e,getErrorMessage as re,hasErrorCode as Te,getErrorCode as Ae,getErrorStack as Se,formatErrorString as te}from"./errorUtils.js";import{FJALL_CONFIG_DIR_ENV as ae,FJALL_CREDENTIALS_FILENAME as Ne,FJALL_HOME_DIRNAME as Re,FJALL_LOG_DIR_ENV as Ie,fjallCredentialsPath as Oe,fjallHomeDir as ie,fjallLogDir as Ce,fjallStatePath as me}from"./fjallHome.js";import{singleton as Pe}from"./async/singleton.js";import{DANGEROUS_ENV_VARS as se,filterDangerousEnvVars as pe,MASKED_VALUE_MARKER as De,maskSensitiveOutput as Me,parseShellArgs as ce,REDACTED_KEY_SENTINEL as fe,SCOPED_TOKEN_REGEX as Ue}from"./securityHelpers.js";import{sleep as le}from"./async/sleep.js";import{mapSettledWithConcurrency as xe}from"./async/concurrency.js";import{ACCOUNT_STAGES_WITH_ROOT as Ge,STRUCTURAL_ENVIRONMENTS as ge,ACCOUNT_STAGES as Ye,ACCOUNT_STAGE_LABELS as he,isAccountStage as He,ACCOUNT_TIERS as Ve,AccountTierSchema as Ke,isAccountTier as ye,GOVERNANCE_ACCOUNT_TIERS as ve,isGovernanceTier as Be,environmentToTier as Xe,accountStageEffect as be,ACCOUNT_STAGE_EFFECTS as We,formatAccountStageList as ke,stageFromWireEnvironment as Je,accountTier as je,resolveSynthEnvironment as we,getEnvironmentLabel as Ze,ACCOUNT_ROLES as qe}from"./environments.js";import{BACKUP_TIERS as Qe,BACKUP_TIER_DEFAULTS as $e,BACKUP_TIER_TAG_KEY as eE,BACKUP_TIER_TAG_MAP as EE,BackupTierSchema as _E,isBackupTier as rE,tierDefault as TE}from"./backupTiers.js";import{CODEMOD_STATEMENT_TYPES as SE,isCodemodStatementType as tE}from"./codemod/statementTypes.js";import{RESOURCE_CATEGORIES as aE,categoriseResource as NE,getExpectedDuration as RE,getFriendlyResourceType as IE}from"./resourceCategorisation.js";import{parseGitRemoteUrl as iE}from"./repo/gitRemoteParser.js";import{abbreviateRegion as mE,AWS_REGIONS_METADATA as nE,DEFAULT_REGION as PE,getRegionInfo as LE,MAX_SECONDARY_REGIONS as sE,OPT_IN_REGION_CODES as pE,optInRegionWarning as DE,regions as ME,RETIRED_REGION_ABBREVIATIONS as cE,suggestRegionForTimezone as fE}from"./infra/regions.js";import{SCOPE_VALUES as FE,MACHINE_ONLY_SCOPES as lE,USER_GRANTABLE_SCOPES as uE,GOVERNANCE_SCOPE_REQUIRED_CODE as xE,SESSION_ONLY_API_ROUTES as dE}from"./infra/tokenScopes.js";import{SECRET_NAME_PATTERN as gE,SECRET_NAME_ERROR as YE,SSM_COMPONENT_PATTERN as hE,SSM_COMPONENT_ERROR as HE,SSM_STANDARD_MAX_VALUE_BYTES as VE,SecretNamespaceSchema as KE,buildNamespaceParts as yE,buildParameterPath as vE,parseParameterPath as BE,isManageablePath as XE,parseDotEnv as bE,escapeDotEnvValue as WE}from"./secrets.js";import{ConnectionWireSchema as JE,ConnectionsListResponseSchema as jE,CONNECTION_PHASES as wE,CONNECTION_TERMINAL_FAILURE_PHASES as ZE,CONNECTION_FAILURE_REASONS as qE,EXTERNAL_ID_PATTERN as zE}from"./infra/connectionsWire.js";import{COMPLIANCE_ISSUE_STATUSES as $E,isComplianceIssueStatus as e_}from"./complianceIssue.js";import{PUBLIC_PACKAGE_NAME as __,INSTALL_SOURCES as r_,SETUP_COMMANDS as T_,upgradeCommand as A_,SETUP_MODES as S_,SETUP_STEP_IDS as t_,SETUP_STEPS as o_,AGENT_SETUP_PROMPTS as a_,AGENT_INSTALL_COMMAND as N_,SKILL_INSTALL_SEGMENTS as R_,SKILL_INSTALL_FILENAME as I_,SKILL_INSTALL_PATH as O_}from"./onboarding/index.js";import{deriveRegionsFromOrgConfig as C_,deriveTargets as m_,deriveAllTargets as n_,environmentOrTier as P_,explainRetiredTargetName as L_,findTarget as s_,generateTargetName as p_}from"./targets.js";import{buildAppConfigPath as M_}from"./repo/appPath.js";import{findInfrastructurePaths as f_,findBoundaryPath as U_,isInfrastructureFile as F_}from"./repo/findInfrastructurePaths.js";import{inferContainerFromCandidates as u_}from"./repo/inferContainerFromCandidates.js";import{RESERVED_APP_NAMES as d_,RESERVED_APP_NAME_MESSAGE as G_,isReservedAppName as g_,RESERVED_APP_NAME_SUFFIX as Y_,RESERVED_APP_NAME_SUFFIX_MESSAGE as h_,hasReservedAppNameSuffix as H_}from"./naming/reservedAppNames.js";import{deriveContentHashTag as K_,CONTENT_HASH_TAG_PATTERN as y_}from"./infra/deriveContentHashTag.js";import{DEPLOY_MODES as B_,DeployModeSchema as X_,IMAGE_TAG_PATTERN as b_,ImageTagSchema as W_,ServiceArtefactSchema as k_,ServiceArtefactsSchema as J_,ARTEFACT_OUTPUT_FIELDS as j_,artefactOutputKey as w_}from"./infra/deployArtefacts.js";import{MIGRATION_SNAPSHOT_NAME_PREFIX as q_,MIGRATION_SNAPSHOT_RETENTION_DAYS_ENV as z_,MIGRATION_SNAPSHOT_KIND_TAG_KEY as Q_,MIGRATION_SNAPSHOT_KIND_PREMIGRATE as $_,EXPECTED_SCHEMA_VERSION_ENV as er,EXPECTED_SCHEMA_VERSION_TOOL_ENV as Er,EXPECTED_CH_SCHEMA_VERSION_ENV as _r,SCHEMA_ADMIN_USER_ENV as rr,SCHEMA_ADMIN_PASSWORD_ENV as Tr,PRISMA_MIGRATION_DIR_RE as Ar,CLICKHOUSE_MIGRATION_SKIP_RE as Sr}from"./migration/constants.js";import{SCHEMA_GATE_EXIT as or,SCHEMA_GATE_EXIT_HINTS as ar,schemaGateExitKind as Nr}from"./migration/schemaGateExit.js";import{FJALL_SCHEMA_GATE_USER as Ir,FJALL_MAINTENANCE_USER as Or,FJALL_CLICKHOUSE_USERS as ir}from"./migration/clickhouseFrameworkUsers.js";import{PHYSICAL_NAME_FALLBACK_PROPERTIES as mr}from"./cfn/physicalNameProperties.js";import{PATTERN_TYPE_VALUES as Pr,PATTERN_TYPES as Lr,isPatternType as sr,PATTERN_REGISTRY as pr,patternConstructId as Dr,DEPLOYABLE_PATTERN_TYPES as Mr,OPENNEXT_PATTERN_TYPES as cr,isOpenNextPatternType as fr,CLOUDFRONT_PRICE_CLASS_VALUES as Ur,STATIC_SITE_CONFIG_KEYS as Fr,STATIC_SITE_DEPLOY_INJECTED_KEYS as lr,STATIC_SITE_CDN_CONFIG_KEYS as ur,STATIC_SITE_ROUTING_VALUES as xr,STATIC_SITE_ROUTING_INFO as dr,PATTERN_CREATE_INPUT_VALUES as Gr,PATTERN_CREATE_INPUT_FLAGS as gr}from"./patterns/patternTypes.js";import{FRAMEWORK_VALUES as hr,FRAMEWORKS as Hr,isFramework as Vr,FRAMEWORK_PATTERN_RECOMMENDATIONS as Kr,recommendPatternForFramework as yr,CREATABLE_FRAMEWORKS as vr,requiredInputsForFramework as Br}from"./patterns/frameworkPatterns.js";import{DEFAULT_FORMS_FROM_LOCAL_PART as br,defaultFormsFromAddress as Wr,defaultFormsCorsOrigin as kr,isAddressAtDomain as Jr}from"./patterns/staticSiteForms.js";import{DEV_SUBSTRATE_PARAMS_SCHEMA_VERSION as wr,DEV_SUBSTRATE_PARAMS_FILENAME as Zr,DevSubstrateSynthPropsSchema as qr,DevSubstrateParamsSchema as zr}from"./devSubstrate/params.js";import{DEV_SUBSTRATE_ENTRYPOINT_SOURCE as $r}from"./devSubstrate/entrypoint.js";import{BLESSED_CDK_TOOLCHAIN as ET}from"./cdkToolchain.js";import{DEPLOYMENT_FAILURE_PHASES as rT,DeploymentFailurePhaseSchema as TT,DEPLOYMENT_FAULT_ATTRIBUTIONS as AT,DeploymentFaultAttributionSchema as ST,DEPLOYMENT_FAILURE_PROVIDER_SOURCES as tT,DeploymentFailureProviderSourceSchema as oT,DEPLOYMENT_FAILURE_CODE_PATTERN as aT,DEPLOYMENT_FAILURE_SCHEMA_VERSION as NT,DEPLOYMENT_FAILURE_LIMITS as RT,DeploymentFailureAnalysisSchema as IT,DeploymentFailureProviderSchema as OT,DeploymentFailureResourceSchema as iT,DeploymentFailureSchema as CT,parseDeploymentFailure as mT,DEPLOYMENT_FAILURE_DOCS_BASE_URL as nT,deploymentFailureDocsUrl as PT,DEPLOYMENT_FAULT_COPY as LT,DEPLOYMENT_PROVIDER_LABELS as sT,deriveErrorMessageFromFailure as pT,toDeploymentFailureAnalysis as DT}from"./failure/deploymentFailure.js";import{extractErrorWindow as cT,ERROR_WINDOW_CONTEXT_LINES as fT}from"./failure/extractErrorWindow.js";import{FJALL_COMPONENT_GITIGNORE as FT,FJALL_PROJECT_GITIGNORE as lT,FJALL_STATE_GITIGNORE_ENTRIES as uT,FJALL_MANAGED_STATE_DIR_ENTRIES as xT,LOCAL_CONFIG_GITIGNORE_ENTRY as dT}from"./scaffold/gitignore.js";import{ensureGitignoreEntries as gT}from"./scaffold/ensureGitignore.js";export{qe as ACCOUNT_ROLES,Ye as ACCOUNT_STAGES,Ge as ACCOUNT_STAGES_WITH_ROOT,We as ACCOUNT_STAGE_EFFECTS,he as ACCOUNT_STAGE_LABELS,Ve as ACCOUNT_TIERS,N_ as AGENT_INSTALL_COMMAND,a_ as AGENT_SETUP_PROMPTS,i as APPROVAL_TOKEN_OUTPUT_PREFIX,j_ as ARTEFACT_OUTPUT_FIELDS,nE as AWS_REGIONS_METADATA,Ke as AccountTierSchema,Qe as BACKUP_TIERS,$e as BACKUP_TIER_DEFAULTS,eE as BACKUP_TIER_TAG_KEY,EE as BACKUP_TIER_TAG_MAP,I as BACKUP_VAULT_NAME,ET as BLESSED_CDK_TOOLCHAIN,_E as BackupTierSchema,B as CAPACITY_ANCHOR_MAX_LENGTH,v as CAPACITY_ANCHOR_PATTERN,X as CAPACITY_IDENTITY_CONTEXT_KEY,K as CAPACITY_SLOT_MAX_LENGTH,V as CAPACITY_SLOT_PATTERN,Sr as CLICKHOUSE_MIGRATION_SKIP_RE,Ur as CLOUDFRONT_PRICE_CLASS_VALUES,SE as CODEMOD_STATEMENT_TYPES,$E as COMPLIANCE_ISSUE_STATUSES,qE as CONNECTION_FAILURE_REASONS,wE as CONNECTION_PHASES,ZE as CONNECTION_TERMINAL_FAILURE_PHASES,y_ as CONTENT_HASH_TAG_PATTERN,vr as CREATABLE_FRAMEWORKS,k as CapacityIdentityConfigSchema,b as CapacityIdentityPinSchema,W as CapacityIdentityWireSchema,JE as ConnectionWireSchema,jE as ConnectionsListResponseSchema,se as DANGEROUS_ENV_VARS,y as DEFAULT_CAPACITY_SLOT,br as DEFAULT_FORMS_FROM_LOCAL_PART,PE as DEFAULT_REGION,Mr as DEPLOYABLE_PATTERN_TYPES,aT as DEPLOYMENT_FAILURE_CODE_PATTERN,nT as DEPLOYMENT_FAILURE_DOCS_BASE_URL,RT as DEPLOYMENT_FAILURE_LIMITS,rT as DEPLOYMENT_FAILURE_PHASES,tT as DEPLOYMENT_FAILURE_PROVIDER_SOURCES,NT as DEPLOYMENT_FAILURE_SCHEMA_VERSION,AT as DEPLOYMENT_FAULT_ATTRIBUTIONS,LT as DEPLOYMENT_FAULT_COPY,sT as DEPLOYMENT_PROVIDER_LABELS,B_ as DEPLOY_MODES,$r as DEV_SUBSTRATE_ENTRYPOINT_SOURCE,Zr as DEV_SUBSTRATE_PARAMS_FILENAME,wr as DEV_SUBSTRATE_PARAMS_SCHEMA_VERSION,_ as DNS_APEX,N as DOMAIN_DEPLOY_DEFAULT_PHASE,X_ as DeployModeSchema,IT as DeploymentFailureAnalysisSchema,TT as DeploymentFailurePhaseSchema,OT as DeploymentFailureProviderSchema,oT as DeploymentFailureProviderSourceSchema,iT as DeploymentFailureResourceSchema,CT as DeploymentFailureSchema,ST as DeploymentFaultAttributionSchema,zr as DevSubstrateParamsSchema,qr as DevSubstrateSynthPropsSchema,fT as ERROR_WINDOW_CONTEXT_LINES,_r as EXPECTED_CH_SCHEMA_VERSION_ENV,er as EXPECTED_SCHEMA_VERSION_ENV,Er as EXPECTED_SCHEMA_VERSION_TOOL_ENV,zE as EXTERNAL_ID_PATTERN,ir as FJALL_CLICKHOUSE_USERS,FT as FJALL_COMPONENT_GITIGNORE,ae as FJALL_CONFIG_DIR_ENV,Ne as FJALL_CREDENTIALS_FILENAME,Re as FJALL_HOME_DIRNAME,Ie as FJALL_LOG_DIR_ENV,Or as FJALL_MAINTENANCE_USER,xT as FJALL_MANAGED_STATE_DIR_ENTRIES,lT as FJALL_PROJECT_GITIGNORE,Ir as FJALL_SCHEMA_GATE_USER,uT as FJALL_STATE_GITIGNORE_ENTRIES,Hr as FRAMEWORKS,Kr as FRAMEWORK_PATTERN_RECOMMENDATIONS,hr as FRAMEWORK_VALUES,ve as GOVERNANCE_ACCOUNT_TIERS,xE as GOVERNANCE_SCOPE_REQUIRED_CODE,o as HOSTS_OUTPUT_MAX_BYTES,b_ as IMAGE_TAG_PATTERN,r_ as INSTALL_SOURCES,W_ as ImageTagSchema,dT as LOCAL_CONFIG_GITIGNORE_ENTRY,lE as MACHINE_ONLY_SCOPES,De as MASKED_VALUE_MARKER,sE as MAX_SECONDARY_REGIONS,$_ as MIGRATION_SNAPSHOT_KIND_PREMIGRATE,Q_ as MIGRATION_SNAPSHOT_KIND_TAG_KEY,q_ as MIGRATION_SNAPSHOT_NAME_PREFIX,z_ as MIGRATION_SNAPSHOT_RETENTION_DAYS_ENV,cr as OPENNEXT_PATTERN_TYPES,pE as OPT_IN_REGION_CODES,gr as PATTERN_CREATE_INPUT_FLAGS,Gr as PATTERN_CREATE_INPUT_VALUES,pr as PATTERN_REGISTRY,Lr as PATTERN_TYPES,Pr as PATTERN_TYPE_VALUES,mr as PHYSICAL_NAME_FALLBACK_PROPERTIES,Ar as PRISMA_MIGRATION_DIR_RE,__ as PUBLIC_PACKAGE_NAME,fe as REDACTED_KEY_SENTINEL,Q as REGION_SHORT_CODES,d_ as RESERVED_APP_NAMES,G_ as RESERVED_APP_NAME_MESSAGE,Y_ as RESERVED_APP_NAME_SUFFIX,h_ as RESERVED_APP_NAME_SUFFIX_MESSAGE,aE as RESOURCE_CATEGORIES,cE as RETIRED_REGION_ABBREVIATIONS,Tr as SCHEMA_ADMIN_PASSWORD_ENV,rr as SCHEMA_ADMIN_USER_ENV,or as SCHEMA_GATE_EXIT,ar as SCHEMA_GATE_EXIT_HINTS,Ue as SCOPED_TOKEN_REGEX,FE as SCOPE_VALUES,YE as SECRET_NAME_ERROR,gE as SECRET_NAME_PATTERN,dE as SESSION_ONLY_API_ROUTES,T_ as SETUP_COMMANDS,S_ as SETUP_MODES,o_ as SETUP_STEPS,t_ as SETUP_STEP_IDS,I_ as SKILL_INSTALL_FILENAME,O_ as SKILL_INSTALL_PATH,R_ as SKILL_INSTALL_SEGMENTS,HE as SSM_COMPONENT_ERROR,hE as SSM_COMPONENT_PATTERN,VE as SSM_STANDARD_MAX_VALUE_BYTES,ur as STATIC_SITE_CDN_CONFIG_KEYS,Fr as STATIC_SITE_CONFIG_KEYS,lr as STATIC_SITE_DEPLOY_INJECTED_KEYS,dr as STATIC_SITE_ROUTING_INFO,xr as STATIC_SITE_ROUTING_VALUES,ge as STRUCTURAL_ENVIRONMENTS,KE as SecretNamespaceSchema,k_ as ServiceArtefactSchema,J_ as ServiceArtefactsSchema,C as TOKEN_STDERR_PREFIX,uE as USER_GRANTABLE_SCOPES,mE as abbreviateRegion,f as accountConstructKey,be as accountStageEffect,je as accountTier,l as albDnsExportName,u as albHostedZoneIdExportName,w_ as artefactOutputKey,d as bucketWebsiteEndpointExportName,G as bucketWebsiteHostedZoneIdExportName,M_ as buildAppConfigPath,yE as buildNamespaceParts,vE as buildParameterPath,M as capitalise,NE as categoriseResource,x as cdnDomainExportName,q as defaultConnectedAccountName,kr as defaultFormsCorsOrigin,Wr as defaultFormsFromAddress,PT as deploymentFailureDocsUrl,n_ as deriveAllTargets,K_ as deriveContentHashTag,pT as deriveErrorMessageFromFailure,C_ as deriveRegionsFromOrgConfig,m_ as deriveTargets,Y as ec2ServiceName,gT as ensureGitignoreEntries,P_ as environmentOrTier,Xe as environmentToTier,WE as escapeDotEnvValue,L_ as explainRetiredTargetName,cT as extractErrorWindow,pe as filterDangerousEnvVars,w as findAccountNameCollision,U_ as findBoundaryPath,f_ as findInfrastructurePaths,s_ as findTarget,$ as findTrailingRegionShortCode,Oe as fjallCredentialsPath,ie as fjallHomeDir,Ce as fjallLogDir,me as fjallStatePath,ke as formatAccountStageList,te as formatErrorString,p_ as generateTargetName,r as getDomainExportNames,T as getDomainStackName,A as getDomainUsEast1CertificatesStackName,Ze as getEnvironmentLabel,Ae as getErrorCode,re as getErrorMessage,Se as getErrorStack,RE as getExpectedDuration,IE as getFriendlyResourceType,LE as getRegionInfo,c as getSafeZoneName,U as hasAsciiStableConstructKey,Te as hasErrorCode,H_ as hasReservedAppNameSuffix,S as hostsExportPartName,n as imageTagParameterName,u_ as inferContainerFromCandidates,He as isAccountStage,ye as isAccountTier,Jr as isAddressAtDomain,rE as isBackupTier,tE as isCodemodStatementType,e_ as isComplianceIssueStatus,Vr as isFramework,Be as isGovernanceTier,F_ as isInfrastructureFile,XE as isManageablePath,a as isManagedDomainBinding,fr as isOpenNextPatternType,sr as isPatternType,g_ as isReservedAppName,xe as mapSettledWithConcurrency,Me as maskSensitiveOutput,h as mintedEc2KeyPairName,_e as normaliseError,DE as optInRegionWarning,mT as parseDeploymentFailure,bE as parseDotEnv,iE as parseGitRemoteUrl,BE as parseParameterPath,ce as parseShellArgs,Dr as patternConstructId,J as projectCapacityIdentityToTarget,yr as recommendPatternForFramework,ee as regionSuffixRejectionMessage,ME as regions,Br as requiredInputsForFramework,we as resolveSynthEnvironment,Nr as schemaGateExitKind,t as serialiseHostsChunks,Pe as singleton,le as sleep,Je as stageFromWireEnvironment,z as suffixedAccountName,fE as suggestRegionForTimezone,TE as tierDefault,DT as toDeploymentFailureAnalysis,s as toKebab,L as toPascalCase,D as toScreamingSnake,p as toValidDatabaseName,A_ as upgradeCommand};
+import{DNS_APEX as _,getDomainExportNames as r,getDomainStackName as T,getDomainUsEast1CertificatesStackName as S,hostsExportPartName as A,serialiseHostsChunks as t,HOSTS_OUTPUT_MAX_BYTES as o,isManagedDomainBinding as a,DOMAIN_DEPLOY_DEFAULT_PHASE as N}from"./infra/domainExports.js";import{BACKUP_VAULT_NAME as I,BACKUP_VAULT_CONTEXT_KEY as O,BackupVaultLockSchema as C,BackupVaultVerdictSchema as i,isReownedBackupVault as m}from"./infra/backupVault.js";import{APPROVAL_TOKEN_OUTPUT_PREFIX as n}from"./deploy/approvalTokenOutput.js";import{imageTagParameterName as s}from"./infra/imageTags.js";import{toPascalCase as D,toKebab as c,toValidDatabaseName as M,toScreamingSnake as U,capitalise as f,getSafeZoneName as F,accountConstructKey as u,hasAsciiStableConstructKey as l}from"./naming/caseConversion.js";import{albDnsExportName as G,albHostedZoneIdExportName as d,cdnDomainExportName as g,bucketWebsiteEndpointExportName as V,bucketWebsiteHostedZoneIdExportName as Y}from"./naming/targetExportNames.js";import{ec2ServiceName as h,mintedEc2KeyPairName as K}from"./naming/ec2Naming.js";import{CAPACITY_SLOT_PATTERN as B,CAPACITY_SLOT_MAX_LENGTH as v,DEFAULT_CAPACITY_SLOT as X,CAPACITY_ANCHOR_PATTERN as b,CAPACITY_ANCHOR_MAX_LENGTH as k,CAPACITY_IDENTITY_CONTEXT_KEY as W,CapacityIdentityPinSchema as J,CapacityIdentityWireSchema as j,CapacityIdentityConfigSchema as w,projectCapacityIdentityToTarget as Z}from"./capacityIdentity.js";import{findAccountNameCollision as z}from"./naming/accountNameCollision.js";import{defaultConnectedAccountName as $,suffixedAccountName as EE,REGION_SHORT_CODES as eE,findTrailingRegionShortCode as _E,regionSuffixRejectionMessage as rE}from"./naming/connectedAccountName.js";import{normaliseError as SE,getErrorMessage as AE,hasErrorCode as tE,getErrorCode as oE,getErrorStack as aE,formatErrorString as NE}from"./errorUtils.js";import{FJALL_CONFIG_DIR_ENV as IE,FJALL_CREDENTIALS_FILENAME as OE,FJALL_HOME_DIRNAME as CE,FJALL_LOG_DIR_ENV as iE,fjallCredentialsPath as mE,fjallHomeDir as PE,fjallLogDir as nE,fjallStatePath as LE}from"./fjallHome.js";import{singleton as pE}from"./async/singleton.js";import{DANGEROUS_ENV_VARS as cE,filterDangerousEnvVars as ME,MASKED_VALUE_MARKER as UE,maskSensitiveOutput as fE,parseShellArgs as FE,REDACTED_KEY_SENTINEL as uE,SCOPED_TOKEN_REGEX as lE}from"./securityHelpers.js";import{sleep as GE}from"./async/sleep.js";import{mapSettledWithConcurrency as gE}from"./async/concurrency.js";import{ACCOUNT_STAGES_WITH_ROOT as YE,STRUCTURAL_ENVIRONMENTS as HE,ACCOUNT_STAGES as hE,ACCOUNT_STAGE_LABELS as KE,isAccountStage as yE,ACCOUNT_TIERS as BE,AccountTierSchema as vE,isAccountTier as XE,GOVERNANCE_ACCOUNT_TIERS as bE,isGovernanceTier as kE,environmentToTier as WE,accountStageEffect as JE,ACCOUNT_STAGE_EFFECTS as jE,formatAccountStageList as wE,stageFromWireEnvironment as ZE,accountTier as qE,resolveSynthEnvironment as zE,getEnvironmentLabel as QE,ACCOUNT_ROLES as $E}from"./environments.js";import{BACKUP_TIERS as ee,BACKUP_TIER_DEFAULTS as _e,BACKUP_TIER_TAG_KEY as re,BACKUP_TIER_TAG_MAP as Te,BackupTierSchema as Se,isBackupTier as Ae,tierDefault as te}from"./backupTiers.js";import{CODEMOD_STATEMENT_TYPES as ae,isCodemodStatementType as Ne}from"./codemod/statementTypes.js";import{RESOURCE_CATEGORIES as Ie,categoriseResource as Oe,getExpectedDuration as Ce,getFriendlyResourceType as ie}from"./resourceCategorisation.js";import{parseGitRemoteUrl as Pe}from"./repo/gitRemoteParser.js";import{abbreviateRegion as Le,AWS_REGIONS_METADATA as se,DEFAULT_REGION as pe,getRegionInfo as De,MAX_SECONDARY_REGIONS as ce,OPT_IN_REGION_CODES as Me,optInRegionWarning as Ue,regions as fe,RETIRED_REGION_ABBREVIATIONS as Fe,suggestRegionForTimezone as ue}from"./infra/regions.js";import{SCOPE_VALUES as xe,MACHINE_ONLY_SCOPES as Ge,USER_GRANTABLE_SCOPES as de,GOVERNANCE_SCOPE_REQUIRED_CODE as ge,SESSION_ONLY_API_ROUTES as Ve}from"./infra/tokenScopes.js";import{SECRET_NAME_PATTERN as He,SECRET_NAME_ERROR as he,SSM_COMPONENT_PATTERN as Ke,SSM_COMPONENT_ERROR as ye,SSM_STANDARD_MAX_VALUE_BYTES as Be,SecretNamespaceSchema as ve,buildNamespaceParts as Xe,buildParameterPath as be,parseParameterPath as ke,isManageablePath as We,parseDotEnv as Je,escapeDotEnvValue as je}from"./secrets.js";import{ConnectionWireSchema as Ze,ConnectionsListResponseSchema as qe,CONNECTION_PHASES as ze,CONNECTION_TERMINAL_FAILURE_PHASES as Qe,CONNECTION_FAILURE_REASONS as $e,EXTERNAL_ID_PATTERN as E_}from"./infra/connectionsWire.js";import{COMPLIANCE_ISSUE_STATUSES as __,isComplianceIssueStatus as r_,COMPLIANCE_ISSUE_SEVERITIES as T_}from"./complianceIssue.js";import{CI_PROVIDERS as A_,CI_SETUP_FIELDS as t_}from"./ciSetup.js";import{INFRASTRUCTURE_TIER_NAMES as a_,CUSTOM_APP_TYPE as N_,APP_TYPES as R_}from"./appTypes.js";import{INSIGHT_TAB_VALUES as O_,INSIGHT_CATEGORIES as C_,INSIGHT_SEVERITIES as i_,INSIGHT_SORT_VALUES as m_}from"./insights/vocabulary.js";import{PUBLIC_PACKAGE_NAME as n_,INSTALL_SOURCES as L_,SETUP_COMMANDS as s_,upgradeCommand as p_,SETUP_MODES as D_,SETUP_STEP_IDS as c_,SETUP_STEPS as M_,AGENT_SETUP_PROMPTS as U_,AGENT_INSTALL_COMMAND as f_,SKILL_INSTALL_SEGMENTS as F_,SKILL_INSTALL_FILENAME as u_,SKILL_INSTALL_PATH as l_}from"./onboarding/index.js";import{deriveRegionsFromOrgConfig as G_,deriveTargets as d_,deriveAllTargets as g_,environmentOrTier as V_,explainRetiredTargetName as Y_,findTarget as H_,generateTargetName as h_}from"./targets.js";import{buildAppConfigPath as y_}from"./repo/appPath.js";import{findInfrastructurePaths as v_,findBoundaryPath as X_,isInfrastructureFile as b_}from"./repo/findInfrastructurePaths.js";import{inferContainerFromCandidates as W_}from"./repo/inferContainerFromCandidates.js";import{RESERVED_APP_NAMES as j_,RESERVED_APP_NAME_MESSAGE as w_,isReservedAppName as Z_,RESERVED_APP_NAME_SUFFIX as q_,RESERVED_APP_NAME_SUFFIX_MESSAGE as z_,hasReservedAppNameSuffix as Q_}from"./naming/reservedAppNames.js";import{deriveContentHashTag as Er,CONTENT_HASH_TAG_PATTERN as er}from"./infra/deriveContentHashTag.js";import{DEPLOY_MODES as rr,DeployModeSchema as Tr,IMAGE_TAG_PATTERN as Sr,ImageTagSchema as Ar,ServiceArtefactSchema as tr,ServiceArtefactsSchema as or,ARTEFACT_OUTPUT_FIELDS as ar,artefactOutputKey as Nr}from"./infra/deployArtefacts.js";import{MIGRATION_SNAPSHOT_NAME_PREFIX as Ir,MIGRATION_SNAPSHOT_RETENTION_DAYS_ENV as Or,MIGRATION_SNAPSHOT_KIND_TAG_KEY as Cr,MIGRATION_SNAPSHOT_KIND_PREMIGRATE as ir,EXPECTED_SCHEMA_VERSION_ENV as mr,EXPECTED_SCHEMA_VERSION_TOOL_ENV as Pr,EXPECTED_CH_SCHEMA_VERSION_ENV as nr,SCHEMA_ADMIN_USER_ENV as Lr,SCHEMA_ADMIN_PASSWORD_ENV as sr,PRISMA_MIGRATION_DIR_RE as pr,CLICKHOUSE_MIGRATION_SKIP_RE as Dr}from"./migration/constants.js";import{SCHEMA_GATE_EXIT as Mr,SCHEMA_GATE_EXIT_HINTS as Ur,schemaGateExitKind as fr}from"./migration/schemaGateExit.js";import{FJALL_SCHEMA_GATE_USER as ur,FJALL_MAINTENANCE_USER as lr,FJALL_CLICKHOUSE_USERS as xr}from"./migration/clickhouseFrameworkUsers.js";import{PHYSICAL_NAME_FALLBACK_PROPERTIES as dr}from"./cfn/physicalNameProperties.js";import{PATTERN_TYPE_VALUES as Vr,PATTERN_TYPES as Yr,isPatternType as Hr,PATTERN_REGISTRY as hr,patternConstructId as Kr,DEPLOYABLE_PATTERN_TYPES as yr,PATTERN_TIER_VALUES as Br,OPENNEXT_PATTERN_TYPES as vr,isOpenNextPatternType as Xr,OPENNEXT_BUCKET_KEYS as br,isOpenNextBucketKey as kr,patternBucketConstructId as Wr,CLOUDFRONT_PRICE_CLASS_VALUES as Jr,STATIC_SITE_CONFIG_KEYS as jr,STATIC_SITE_DEPLOY_INJECTED_KEYS as wr,STATIC_SITE_CDN_CONFIG_KEYS as Zr,STATIC_SITE_ROUTING_VALUES as qr,STATIC_SITE_ROUTING_INFO as zr,PATTERN_CREATE_INPUT_VALUES as Qr,PATTERN_CREATE_INPUT_FLAGS as $r}from"./patterns/patternTypes.js";import{FRAMEWORK_VALUES as eT,FRAMEWORKS as _T,isFramework as rT,FRAMEWORK_PATTERN_RECOMMENDATIONS as TT,recommendPatternForFramework as ST,CREATABLE_FRAMEWORKS as AT,requiredInputsForFramework as tT}from"./patterns/frameworkPatterns.js";import{DEFAULT_FORMS_FROM_LOCAL_PART as aT,defaultFormsFromAddress as NT,defaultFormsCorsOrigin as RT,isAddressAtDomain as IT}from"./patterns/staticSiteForms.js";import{DEV_SUBSTRATE_PARAMS_SCHEMA_VERSION as CT,DEV_SUBSTRATE_PARAMS_FILENAME as iT,DevSubstrateSynthPropsSchema as mT,DevSubstrateParamsSchema as PT}from"./devSubstrate/params.js";import{DEV_SUBSTRATE_ENTRYPOINT_SOURCE as LT}from"./devSubstrate/entrypoint.js";import{BLESSED_CDK_TOOLCHAIN as pT}from"./cdkToolchain.js";import{DEPLOYMENT_FAILURE_PHASES as cT,DeploymentFailurePhaseSchema as MT,DEPLOYMENT_FAULT_ATTRIBUTIONS as UT,DeploymentFaultAttributionSchema as fT,DEPLOYMENT_FAILURE_PROVIDER_SOURCES as FT,DeploymentFailureProviderSourceSchema as uT,DEPLOYMENT_FAILURE_CODE_PATTERN as lT,DEPLOYMENT_FAILURE_SCHEMA_VERSION as xT,DEPLOYMENT_FAILURE_LIMITS as GT,DeploymentFailureAnalysisSchema as dT,DeploymentFailureProviderSchema as gT,DeploymentFailureResourceSchema as VT,DeploymentFailureSchema as YT,parseDeploymentFailure as HT,DEPLOYMENT_FAILURE_DOCS_BASE_URL as hT,deploymentFailureDocsUrl as KT,DEPLOYMENT_FAULT_COPY as yT,DEPLOYMENT_PROVIDER_LABELS as BT,deriveErrorMessageFromFailure as vT,toDeploymentFailureAnalysis as XT}from"./failure/deploymentFailure.js";import{extractErrorWindow as kT,ERROR_WINDOW_CONTEXT_LINES as WT}from"./failure/extractErrorWindow.js";import{FJALL_COMPONENT_GITIGNORE as jT,FJALL_PROJECT_GITIGNORE as wT,FJALL_STATE_GITIGNORE_ENTRIES as ZT,FJALL_MANAGED_STATE_DIR_ENTRIES as qT,LOCAL_CONFIG_GITIGNORE_ENTRY as zT}from"./scaffold/gitignore.js";import{ensureGitignoreEntries as $T}from"./scaffold/ensureGitignore.js";export{$E as ACCOUNT_ROLES,hE as ACCOUNT_STAGES,YE as ACCOUNT_STAGES_WITH_ROOT,jE as ACCOUNT_STAGE_EFFECTS,KE as ACCOUNT_STAGE_LABELS,BE as ACCOUNT_TIERS,f_ as AGENT_INSTALL_COMMAND,U_ as AGENT_SETUP_PROMPTS,n as APPROVAL_TOKEN_OUTPUT_PREFIX,R_ as APP_TYPES,ar as ARTEFACT_OUTPUT_FIELDS,se as AWS_REGIONS_METADATA,vE as AccountTierSchema,ee as BACKUP_TIERS,_e as BACKUP_TIER_DEFAULTS,re as BACKUP_TIER_TAG_KEY,Te as BACKUP_TIER_TAG_MAP,O as BACKUP_VAULT_CONTEXT_KEY,I as BACKUP_VAULT_NAME,pT as BLESSED_CDK_TOOLCHAIN,Se as BackupTierSchema,C as BackupVaultLockSchema,i as BackupVaultVerdictSchema,k as CAPACITY_ANCHOR_MAX_LENGTH,b as CAPACITY_ANCHOR_PATTERN,W as CAPACITY_IDENTITY_CONTEXT_KEY,v as CAPACITY_SLOT_MAX_LENGTH,B as CAPACITY_SLOT_PATTERN,A_ as CI_PROVIDERS,t_ as CI_SETUP_FIELDS,Dr as CLICKHOUSE_MIGRATION_SKIP_RE,Jr as CLOUDFRONT_PRICE_CLASS_VALUES,ae as CODEMOD_STATEMENT_TYPES,T_ as COMPLIANCE_ISSUE_SEVERITIES,__ as COMPLIANCE_ISSUE_STATUSES,$e as CONNECTION_FAILURE_REASONS,ze as CONNECTION_PHASES,Qe as CONNECTION_TERMINAL_FAILURE_PHASES,er as CONTENT_HASH_TAG_PATTERN,AT as CREATABLE_FRAMEWORKS,N_ as CUSTOM_APP_TYPE,w as CapacityIdentityConfigSchema,J as CapacityIdentityPinSchema,j as CapacityIdentityWireSchema,Ze as ConnectionWireSchema,qe as ConnectionsListResponseSchema,cE as DANGEROUS_ENV_VARS,X as DEFAULT_CAPACITY_SLOT,aT as DEFAULT_FORMS_FROM_LOCAL_PART,pe as DEFAULT_REGION,yr as DEPLOYABLE_PATTERN_TYPES,lT as DEPLOYMENT_FAILURE_CODE_PATTERN,hT as DEPLOYMENT_FAILURE_DOCS_BASE_URL,GT as DEPLOYMENT_FAILURE_LIMITS,cT as DEPLOYMENT_FAILURE_PHASES,FT as DEPLOYMENT_FAILURE_PROVIDER_SOURCES,xT as DEPLOYMENT_FAILURE_SCHEMA_VERSION,UT as DEPLOYMENT_FAULT_ATTRIBUTIONS,yT as DEPLOYMENT_FAULT_COPY,BT as DEPLOYMENT_PROVIDER_LABELS,rr as DEPLOY_MODES,LT as DEV_SUBSTRATE_ENTRYPOINT_SOURCE,iT as DEV_SUBSTRATE_PARAMS_FILENAME,CT as DEV_SUBSTRATE_PARAMS_SCHEMA_VERSION,_ as DNS_APEX,N as DOMAIN_DEPLOY_DEFAULT_PHASE,Tr as DeployModeSchema,dT as DeploymentFailureAnalysisSchema,MT as DeploymentFailurePhaseSchema,gT as DeploymentFailureProviderSchema,uT as DeploymentFailureProviderSourceSchema,VT as DeploymentFailureResourceSchema,YT as DeploymentFailureSchema,fT as DeploymentFaultAttributionSchema,PT as DevSubstrateParamsSchema,mT as DevSubstrateSynthPropsSchema,WT as ERROR_WINDOW_CONTEXT_LINES,nr as EXPECTED_CH_SCHEMA_VERSION_ENV,mr as EXPECTED_SCHEMA_VERSION_ENV,Pr as EXPECTED_SCHEMA_VERSION_TOOL_ENV,E_ as EXTERNAL_ID_PATTERN,xr as FJALL_CLICKHOUSE_USERS,jT as FJALL_COMPONENT_GITIGNORE,IE as FJALL_CONFIG_DIR_ENV,OE as FJALL_CREDENTIALS_FILENAME,CE as FJALL_HOME_DIRNAME,iE as FJALL_LOG_DIR_ENV,lr as FJALL_MAINTENANCE_USER,qT as FJALL_MANAGED_STATE_DIR_ENTRIES,wT as FJALL_PROJECT_GITIGNORE,ur as FJALL_SCHEMA_GATE_USER,ZT as FJALL_STATE_GITIGNORE_ENTRIES,_T as FRAMEWORKS,TT as FRAMEWORK_PATTERN_RECOMMENDATIONS,eT as FRAMEWORK_VALUES,bE as GOVERNANCE_ACCOUNT_TIERS,ge as GOVERNANCE_SCOPE_REQUIRED_CODE,o as HOSTS_OUTPUT_MAX_BYTES,Sr as IMAGE_TAG_PATTERN,a_ as INFRASTRUCTURE_TIER_NAMES,C_ as INSIGHT_CATEGORIES,i_ as INSIGHT_SEVERITIES,m_ as INSIGHT_SORT_VALUES,O_ as INSIGHT_TAB_VALUES,L_ as INSTALL_SOURCES,Ar as ImageTagSchema,zT as LOCAL_CONFIG_GITIGNORE_ENTRY,Ge as MACHINE_ONLY_SCOPES,UE as MASKED_VALUE_MARKER,ce as MAX_SECONDARY_REGIONS,ir as MIGRATION_SNAPSHOT_KIND_PREMIGRATE,Cr as MIGRATION_SNAPSHOT_KIND_TAG_KEY,Ir as MIGRATION_SNAPSHOT_NAME_PREFIX,Or as MIGRATION_SNAPSHOT_RETENTION_DAYS_ENV,br as OPENNEXT_BUCKET_KEYS,vr as OPENNEXT_PATTERN_TYPES,Me as OPT_IN_REGION_CODES,$r as PATTERN_CREATE_INPUT_FLAGS,Qr as PATTERN_CREATE_INPUT_VALUES,hr as PATTERN_REGISTRY,Br as PATTERN_TIER_VALUES,Yr as PATTERN_TYPES,Vr as PATTERN_TYPE_VALUES,dr as PHYSICAL_NAME_FALLBACK_PROPERTIES,pr as PRISMA_MIGRATION_DIR_RE,n_ as PUBLIC_PACKAGE_NAME,uE as REDACTED_KEY_SENTINEL,eE as REGION_SHORT_CODES,j_ as RESERVED_APP_NAMES,w_ as RESERVED_APP_NAME_MESSAGE,q_ as RESERVED_APP_NAME_SUFFIX,z_ as RESERVED_APP_NAME_SUFFIX_MESSAGE,Ie as RESOURCE_CATEGORIES,Fe as RETIRED_REGION_ABBREVIATIONS,sr as SCHEMA_ADMIN_PASSWORD_ENV,Lr as SCHEMA_ADMIN_USER_ENV,Mr as SCHEMA_GATE_EXIT,Ur as SCHEMA_GATE_EXIT_HINTS,lE as SCOPED_TOKEN_REGEX,xe as SCOPE_VALUES,he as SECRET_NAME_ERROR,He as SECRET_NAME_PATTERN,Ve as SESSION_ONLY_API_ROUTES,s_ as SETUP_COMMANDS,D_ as SETUP_MODES,M_ as SETUP_STEPS,c_ as SETUP_STEP_IDS,u_ as SKILL_INSTALL_FILENAME,l_ as SKILL_INSTALL_PATH,F_ as SKILL_INSTALL_SEGMENTS,ye as SSM_COMPONENT_ERROR,Ke as SSM_COMPONENT_PATTERN,Be as SSM_STANDARD_MAX_VALUE_BYTES,Zr as STATIC_SITE_CDN_CONFIG_KEYS,jr as STATIC_SITE_CONFIG_KEYS,wr as STATIC_SITE_DEPLOY_INJECTED_KEYS,zr as STATIC_SITE_ROUTING_INFO,qr as STATIC_SITE_ROUTING_VALUES,HE as STRUCTURAL_ENVIRONMENTS,ve as SecretNamespaceSchema,tr as ServiceArtefactSchema,or as ServiceArtefactsSchema,de as USER_GRANTABLE_SCOPES,Le as abbreviateRegion,u as accountConstructKey,JE as accountStageEffect,qE as accountTier,G as albDnsExportName,d as albHostedZoneIdExportName,Nr as artefactOutputKey,V as bucketWebsiteEndpointExportName,Y as bucketWebsiteHostedZoneIdExportName,y_ as buildAppConfigPath,Xe as buildNamespaceParts,be as buildParameterPath,f as capitalise,Oe as categoriseResource,g as cdnDomainExportName,$ as defaultConnectedAccountName,RT as defaultFormsCorsOrigin,NT as defaultFormsFromAddress,KT as deploymentFailureDocsUrl,g_ as deriveAllTargets,Er as deriveContentHashTag,vT as deriveErrorMessageFromFailure,G_ as deriveRegionsFromOrgConfig,d_ as deriveTargets,h as ec2ServiceName,$T as ensureGitignoreEntries,V_ as environmentOrTier,WE as environmentToTier,je as escapeDotEnvValue,Y_ as explainRetiredTargetName,kT as extractErrorWindow,ME as filterDangerousEnvVars,z as findAccountNameCollision,X_ as findBoundaryPath,v_ as findInfrastructurePaths,H_ as findTarget,_E as findTrailingRegionShortCode,mE as fjallCredentialsPath,PE as fjallHomeDir,nE as fjallLogDir,LE as fjallStatePath,wE as formatAccountStageList,NE as formatErrorString,h_ as generateTargetName,r as getDomainExportNames,T as getDomainStackName,S as getDomainUsEast1CertificatesStackName,QE as getEnvironmentLabel,oE as getErrorCode,AE as getErrorMessage,aE as getErrorStack,Ce as getExpectedDuration,ie as getFriendlyResourceType,De as getRegionInfo,F as getSafeZoneName,l as hasAsciiStableConstructKey,tE as hasErrorCode,Q_ as hasReservedAppNameSuffix,A as hostsExportPartName,s as imageTagParameterName,W_ as inferContainerFromCandidates,yE as isAccountStage,XE as isAccountTier,IT as isAddressAtDomain,Ae as isBackupTier,Ne as isCodemodStatementType,r_ as isComplianceIssueStatus,rT as isFramework,kE as isGovernanceTier,b_ as isInfrastructureFile,We as isManageablePath,a as isManagedDomainBinding,kr as isOpenNextBucketKey,Xr as isOpenNextPatternType,Hr as isPatternType,m as isReownedBackupVault,Z_ as isReservedAppName,gE as mapSettledWithConcurrency,fE as maskSensitiveOutput,K as mintedEc2KeyPairName,SE as normaliseError,Ue as optInRegionWarning,HT as parseDeploymentFailure,Je as parseDotEnv,Pe as parseGitRemoteUrl,ke as parseParameterPath,FE as parseShellArgs,Wr as patternBucketConstructId,Kr as patternConstructId,Z as projectCapacityIdentityToTarget,ST as recommendPatternForFramework,rE as regionSuffixRejectionMessage,fe as regions,tT as requiredInputsForFramework,zE as resolveSynthEnvironment,fr as schemaGateExitKind,t as serialiseHostsChunks,pE as singleton,GE as sleep,ZE as stageFromWireEnvironment,EE as suffixedAccountName,ue as suggestRegionForTimezone,te as tierDefault,XT as toDeploymentFailureAnalysis,c as toKebab,D as toPascalCase,U as toScreamingSnake,M as toValidDatabaseName,p_ as upgradeCommand};

package/dist/infra/backupVault.d.ts

@@ -1,7 +1,84 @@
+import { z } from "zod";
 /**
  * Fixed name of the disaster-recovery backup vault. Single source of truth for
  * the @fjall/components-infrastructure DisasterRecovery construct (which
- * creates the vault under this name) and deploy-core's adopt-vs-create and
- * survival probes (which look it up by the same name).
+ * creates the vault under this name) and deploy-core's ownership and survival
+ * probes (which look it up by the same name).
  */
 export declare const BACKUP_VAULT_NAME = "backupVault";
+/**
+ * CDK context key the deploy engine injects the backup-vault ownership verdict
+ * under (`-c fjallBackupVault=<json>`), read by `readBackupVaultVerdict` in
+ * @fjall/components-infrastructure (`utils/cdkContext.ts`). One JSON value,
+ * not a boolean: the construct needs the live key ARN (a create-only vault
+ * property) to declare a re-owned vault without replacing it, and the live
+ * lock to report it and warn when the configured intent differs.
+ */
+export declare const BACKUP_VAULT_CONTEXT_KEY = "fjallBackupVault";
+/**
+ * The live vault lock as `DescribeBackupVault` reports it. `lockDate` is the
+ * instant a compliance-mode lock became (or becomes) immutable; a governance
+ * lock carries none. Every field is optional: a lock put through the Backup
+ * API may carry a maximum without a minimum, or a lock date alone, so a
+ * locked vault can report none of them. The lock is never declared in a
+ * template — the construct reads it for the `VaultLockEnabled` output and the
+ * intent warning only.
+ */
+export declare const BackupVaultLockSchema: z.ZodObject<{
+    minRetentionDays: z.ZodOptional<z.ZodNumber>;
+    maxRetentionDays: z.ZodOptional<z.ZodNumber>;
+    lockDate: z.ZodOptional<z.ZodString>;
+}, z.core.$strict>;
+export type BackupVaultLock = z.infer<typeof BackupVaultLockSchema>;
+/**
+ * Ownership verdict for the fixed-name DR vault in one account/region, probed
+ * by the deploy engine before synth (`probeBackupVaultOwnership` in
+ * deploy-core):
+ *
+ * - `absent` — no vault; the construct creates it with a stack-managed key.
+ * - `owned` — an `AWS::Backup::BackupVault` with physical id
+ *   `backupVault` is a current resource of THIS account stack. `keyInStack`
+ *   says whether its KMS key is too: if so the template is the create
+ *   template (the vault keeps converging to intent); if not the key is a
+ *   retained survivor and the vault is re-owned — declared against the live
+ *   key, with no lock declared (Fjall never issues a lock call against a
+ *   vault it did not create; the live lock stays as it is).
+ * - `unowned` — the vault exists but is not in the stack: the import
+ *   candidate. The construct declares identity only and the engine deploys
+ *   with `--import-existing-resources`, then re-probes and converges.
+ *
+ * `keyArn` is always a customer-managed key: the probe refuses a vault on an
+ * AWS-owned or AWS-managed key before any verdict is issued, because the
+ * re-owned template aliases the key and the DR plans' cross-account copies
+ * need a customer-managed one. A vault owned by ANOTHER stack is not
+ * distinguished here: the import change set fails with CloudFormation's own
+ * "already belongs to another stack".
+ */
+export declare const BackupVaultVerdictSchema: z.ZodDiscriminatedUnion<[z.ZodObject<{
+    state: z.ZodLiteral<"absent">;
+}, z.core.$strict>, z.ZodObject<{
+    state: z.ZodLiteral<"owned">;
+    keyArn: z.ZodString;
+    keyInStack: z.ZodBoolean;
+    lock: z.ZodNullable<z.ZodObject<{
+        minRetentionDays: z.ZodOptional<z.ZodNumber>;
+        maxRetentionDays: z.ZodOptional<z.ZodNumber>;
+        lockDate: z.ZodOptional<z.ZodString>;
+    }, z.core.$strict>>;
+}, z.core.$strict>, z.ZodObject<{
+    state: z.ZodLiteral<"unowned">;
+    keyArn: z.ZodString;
+    lock: z.ZodNullable<z.ZodObject<{
+        minRetentionDays: z.ZodOptional<z.ZodNumber>;
+        maxRetentionDays: z.ZodOptional<z.ZodNumber>;
+        lockDate: z.ZodOptional<z.ZodString>;
+    }, z.core.$strict>>;
+}, z.core.$strict>], "state">;
+export type BackupVaultVerdict = z.infer<typeof BackupVaultVerdictSchema>;
+/**
+ * Whether a verdict selects the re-owned template: the vault is (or is about
+ * to be) a stack resource whose key lives outside the stack. Shared by the
+ * construct (mode selection) and the engine (the import pass is the
+ * `unowned` half of this).
+ */
+export declare function isReownedBackupVault(verdict: BackupVaultVerdict): boolean;

package/dist/infra/backupVault.js

@@ -1 +1 @@
-const t="backupVault";export{t as BACKUP_VAULT_NAME};
+var i=Object.defineProperty;var n=(e,a)=>i(e,"name",{value:a,configurable:!0});import{z as t}from"zod";const s="backupVault",r="fjallBackupVault",o=t.object({minRetentionDays:t.number().int().positive().optional(),maxRetentionDays:t.number().int().positive().optional(),lockDate:t.string().datetime({offset:!0}).optional()}).strict(),u=t.discriminatedUnion("state",[t.object({state:t.literal("absent")}).strict(),t.object({state:t.literal("owned"),keyArn:t.string().min(1),keyInStack:t.boolean(),lock:o.nullable()}).strict(),t.object({state:t.literal("unowned"),keyArn:t.string().min(1),lock:o.nullable()}).strict()]);function p(e){return e.state==="unowned"||e.state==="owned"&&!e.keyInStack}n(p,"isReownedBackupVault");export{r as BACKUP_VAULT_CONTEXT_KEY,s as BACKUP_VAULT_NAME,o as BackupVaultLockSchema,u as BackupVaultVerdictSchema,p as isReownedBackupVault};

package/dist/insights/vocabulary.d.ts

@@ -0,0 +1,29 @@
+/**
+ * Insight list vocabulary — the filter and ordering tokens `GET /api/insights`
+ * accepts, minted once so every consumer spells them the same way.
+ *
+ * Owner today: the webapp (`webapp/app/lib/insights/insights.ts` —
+ * `TAB_VALUES`, `INSIGHT_CATEGORIES`, `INSIGHT_SEVERITIES`, `SORT_VALUES`).
+ * The MCP's `list_insights` tool re-typed all four by hand and advertised
+ * them on its wire surface, so a token added or renamed in the webapp left
+ * the tool silently offering a filter the route rejects. The MCP now derives
+ * from here, and the route's 400-on-unknown gate is what keeps the two honest
+ * while the webapp still carries its own copies.
+ *
+ * Client-safe (no node built-ins): exported from the root barrel and as the
+ * `@fjall/util/insights/vocabulary` subpath so browser code can take it
+ * without the root barrel.
+ */
+export declare const INSIGHT_TAB_VALUES: readonly ["open", "snoozed", "resolved", "all"];
+/** @public — tuple companion type; ships with its tuple (knip skips @public) */
+export type InsightTab = (typeof INSIGHT_TAB_VALUES)[number];
+export declare const INSIGHT_CATEGORIES: readonly ["performance", "cost", "reliability", "security", "deployment"];
+/** @public — tuple companion type; ships with its tuple (knip skips @public) */
+export type InsightCategory = (typeof INSIGHT_CATEGORIES)[number];
+/** Most severe first. */
+export declare const INSIGHT_SEVERITIES: readonly ["critical", "warning", "recommendation", "info"];
+/** @public — tuple companion type; ships with its tuple (knip skips @public) */
+export type InsightSeverity = (typeof INSIGHT_SEVERITIES)[number];
+export declare const INSIGHT_SORT_VALUES: readonly ["matters", "severity", "newest", "oldest", "savings"];
+/** @public — tuple companion type; ships with its tuple (knip skips @public) */
+export type InsightSort = (typeof INSIGHT_SORT_VALUES)[number];

package/dist/insights/vocabulary.js

@@ -0,0 +1 @@
+const e=["open","snoozed","resolved","all"],o=["performance","cost","reliability","security","deployment"],t=["critical","warning","recommendation","info"],n=["matters","severity","newest","oldest","savings"];export{o as INSIGHT_CATEGORIES,t as INSIGHT_SEVERITIES,n as INSIGHT_SORT_VALUES,e as INSIGHT_TAB_VALUES};

package/dist/mcpProtocol/index.d.ts

@@ -176,23 +176,32 @@ export declare const TargetAccountSchema: z.ZodObject<{
     source: z.ZodString;
 }, z.core.$strict>;
 export type TargetAccount = z.infer<typeof TargetAccountSchema>;
+/**
+ * Every input `plan_app_scaffold` accepts, as the plan records it and
+ * `apply_app_scaffold` replays it (`buildApplyCommand`). Plan keys ⊆ these
+ * keys is pinned by the MCP's resolvedInputsParity test: a key the plan
+ * accepts but this schema drops was silently absent from the apply argv
+ * (`type`, `database`, `containerPort` were, until Train 4).
+ */
 export declare const ResolvedInputsSchema: z.ZodObject<{
     name: z.ZodString;
-    pattern: z.ZodOptional<z.ZodString>;
+    pattern: z.ZodOptional<z.ZodEnum<{
+        payload: "payload";
+        staticsite: "staticsite";
+    }>>;
     patternTier: z.ZodOptional<z.ZodEnum<{
+        lightweight: "lightweight";
         standard: "standard";
         resilient: "resilient";
-        enterprise: "enterprise";
-        tinkerer: "tinkerer";
-        lightweight: "lightweight";
+        custom: "custom";
     }>>;
     patternDomain: z.ZodOptional<z.ZodString>;
     network: z.ZodOptional<z.ZodEnum<{
+        lightweight: "lightweight";
         standard: "standard";
         resilient: "resilient";
         enterprise: "enterprise";
         none: "none";
-        lightweight: "lightweight";
     }>>;
     template: z.ZodOptional<z.ZodString>;
     docker: z.ZodOptional<z.ZodObject<{
@@ -200,6 +209,19 @@ export declare const ResolvedInputsSchema: z.ZodObject<{
         context: z.ZodOptional<z.ZodString>;
         target: z.ZodOptional<z.ZodString>;
     }, z.core.$strict>>;
+    type: z.ZodOptional<z.ZodEnum<{
+        tinkerer: "tinkerer";
+        lightweight: "lightweight";
+        standard: "standard";
+        resilient: "resilient";
+        enterprise: "enterprise";
+        custom: "custom";
+    }>>;
+    database: z.ZodOptional<z.ZodBoolean>;
+    containerPort: z.ZodOptional<z.ZodNumber>;
+    source: z.ZodOptional<z.ZodString>;
+    buildCommand: z.ZodOptional<z.ZodString>;
+    outputDir: z.ZodOptional<z.ZodString>;
     git: z.ZodOptional<z.ZodBoolean>;
     github: z.ZodOptional<z.ZodBoolean>;
     repoVisibility: z.ZodOptional<z.ZodEnum<{
@@ -214,21 +236,23 @@ export declare const ScaffoldPlanSchema: z.ZodObject<{
     normalisedPath: z.ZodString;
     resolvedInputs: z.ZodObject<{
         name: z.ZodString;
-        pattern: z.ZodOptional<z.ZodString>;
+        pattern: z.ZodOptional<z.ZodEnum<{
+            payload: "payload";
+            staticsite: "staticsite";
+        }>>;
         patternTier: z.ZodOptional<z.ZodEnum<{
+            lightweight: "lightweight";
             standard: "standard";
             resilient: "resilient";
-            enterprise: "enterprise";
-            tinkerer: "tinkerer";
-            lightweight: "lightweight";
+            custom: "custom";
         }>>;
         patternDomain: z.ZodOptional<z.ZodString>;
         network: z.ZodOptional<z.ZodEnum<{
+            lightweight: "lightweight";
             standard: "standard";
             resilient: "resilient";
             enterprise: "enterprise";
             none: "none";
-            lightweight: "lightweight";
         }>>;
         template: z.ZodOptional<z.ZodString>;
         docker: z.ZodOptional<z.ZodObject<{
@@ -236,6 +260,19 @@ export declare const ScaffoldPlanSchema: z.ZodObject<{
             context: z.ZodOptional<z.ZodString>;
             target: z.ZodOptional<z.ZodString>;
         }, z.core.$strict>>;
+        type: z.ZodOptional<z.ZodEnum<{
+            tinkerer: "tinkerer";
+            lightweight: "lightweight";
+            standard: "standard";
+            resilient: "resilient";
+            enterprise: "enterprise";
+            custom: "custom";
+        }>>;
+        database: z.ZodOptional<z.ZodBoolean>;
+        containerPort: z.ZodOptional<z.ZodNumber>;
+        source: z.ZodOptional<z.ZodString>;
+        buildCommand: z.ZodOptional<z.ZodString>;
+        outputDir: z.ZodOptional<z.ZodString>;
         git: z.ZodOptional<z.ZodBoolean>;
         github: z.ZodOptional<z.ZodBoolean>;
         repoVisibility: z.ZodOptional<z.ZodEnum<{

package/dist/mcpProtocol/index.js

@@ -1 +1 @@
-var p=Object.defineProperty;var a=(n,r)=>p(n,"name",{value:r,configurable:!0});import{z as t}from"zod";const g=2,v={AUTHENTICATION_REQUIRED:"AUTHENTICATION_REQUIRED",VALIDATION_ERROR:"VALIDATION_ERROR",INTERNAL_ERROR:"INTERNAL_ERROR",INVALID_SUBCOMMAND:"INVALID_SUBCOMMAND",INVALID_FRAME:"INVALID_FRAME"},s=1e3,e=t.literal(g),u=t.enum(["completed","error","skipped"]),d=t.object({v:e,kind:t.literal("step.start"),stepId:t.string().min(1),name:t.string().min(1),index:t.number().int().min(0),total:t.number().int().min(1)}).strict(),b=t.object({v:e,kind:t.literal("step.complete"),stepId:t.string().min(1),name:t.string().min(1),status:u,index:t.number().int().min(0),total:t.number().int().min(1),errorMessage:t.string().optional()}).strict(),h=t.object({v:e,kind:t.literal("warning"),message:t.string().min(1)}).strict(),R=t.object({code:t.string().min(1),message:t.string().min(1),details:t.record(t.string(),t.unknown()).optional()}).strict(),A=t.object({v:e,kind:t.literal("error"),error:R}).strict(),S=t.object({v:e,kind:t.literal("result"),data:t.unknown()}).strict(),I=t.object({v:e,kind:t.literal("auth.browser.required"),url:t.string().url(),externalId:t.string().min(1),region:t.string().min(1),environment:t.string().min(1),reason:t.string().min(1)}).strict(),x=t.object({v:e,kind:t.literal("auth.browser.complete"),awsAccountId:t.string().min(1),accountName:t.string().min(1),roleArn:t.string().min(1)}).strict(),k=t.discriminatedUnion("kind",[d,b,h,A,S,I,x]),c=t.object({path:t.string().min(1),sizeBytes:t.number().int().nonnegative(),collisionMode:t.enum(["create","overwrite"])}).strict(),m=t.object({type:t.enum(["register-application","create-activity","auto-link-repository","writeback-config-path"]),description:t.string().min(1)}).strict(),E=t.enum(["tinkerer","lightweight","standard","resilient","enterprise"]),N=t.enum(["lightweight","standard","resilient","enterprise","none"]),l=t.object({name:t.string().min(1),environment:t.string().min(1).nullable(),source:t.string().min(1)}).strict(),y=t.object({name:t.string().min(1),pattern:t.string().min(1).optional(),patternTier:E.optional(),patternDomain:t.string().min(1).optional(),network:N.optional(),template:t.string().min(1).optional(),docker:t.object({path:t.string().min(1).optional(),context:t.string().min(1).optional(),target:t.string().min(1).optional()}).strict().optional(),git:t.boolean().optional(),github:t.boolean().optional(),repoVisibility:t.enum(["private","public"]).optional(),intent:t.string().max(s).optional()}).strict(),w=t.object({planId:t.string().regex(/^[0-9a-f]{32}$/),normalisedPath:t.string().min(1),resolvedInputs:y,targetAccount:l.nullable(),targetAccountCandidates:t.array(l),filesToWrite:t.array(c),npmPackages:t.array(t.string().min(1)),registryActions:t.array(m),patternUnsupportedForDryRun:t.boolean().optional(),intent:t.string().max(s).optional(),framework:t.string().min(1).optional(),summary:t.string().min(1)}).strict(),f=t.object({filesToWrite:t.array(c),npmPackages:t.array(t.string().min(1)),registryActions:t.array(m),patternUnsupportedForDryRun:t.boolean().optional()}).strict(),O=t.object({path:t.string().min(1),name:t.string().min(1),mode:t.enum(["application","pattern"]),dependenciesInstalled:t.boolean().optional(),warning:t.string().optional(),dryRunArtefacts:f.optional()}).strict(),D=t.object({step:t.string().min(1),current:t.number().int().nonnegative(),total:t.number().int().positive().optional(),message:t.string().min(1)}).strict();function F(n){let r;try{r=JSON.parse(n)}catch(o){return{ok:!1,reason:"json",raw:n,error:o instanceof Error?o.message:String(o)}}const i=k.safeParse(r);return i.success?{ok:!0,frame:i.data}:{ok:!1,reason:"schema",raw:n,error:i.error.message}}a(F,"parseFrame");export{x as AuthBrowserCompleteFrameSchema,I as AuthBrowserRequiredFrameSchema,f as DryRunArtefactsSchema,A as ErrorFrameSchema,c as FileToWriteSchema,s as INTENT_MAX_LENGTH,v as MCP_ERROR_CODES,g as MCP_PROTOCOL_VERSION,k as McpProtocolFrameSchema,m as RegistryActionSchema,y as ResolvedInputsSchema,S as ResultFrameSchema,w as ScaffoldPlanSchema,D as ScaffoldProgressFrameSchema,O as ScaffoldResultDataSchema,b as StepCompleteFrameSchema,d as StepStartFrameSchema,l as TargetAccountSchema,h as WarningFrameSchema,F as parseFrame};
+var l=Object.defineProperty;var a=(e,r)=>l(e,"name",{value:r,configurable:!0});import{z as t}from"zod";import{APP_TYPES as g}from"../appTypes.js";import{DEPLOYABLE_PATTERN_TYPES as u,PATTERN_TIER_VALUES as d}from"../patterns/patternTypes.js";const b=2,L={AUTHENTICATION_REQUIRED:"AUTHENTICATION_REQUIRED",VALIDATION_ERROR:"VALIDATION_ERROR",INTERNAL_ERROR:"INTERNAL_ERROR",INVALID_SUBCOMMAND:"INVALID_SUBCOMMAND",INVALID_FRAME:"INVALID_FRAME"},s=1e3,n=t.literal(b),A=t.enum(["completed","error","skipped"]),R=t.object({v:n,kind:t.literal("step.start"),stepId:t.string().min(1),name:t.string().min(1),index:t.number().int().min(0),total:t.number().int().min(1)}).strict(),S=t.object({v:n,kind:t.literal("step.complete"),stepId:t.string().min(1),name:t.string().min(1),status:A,index:t.number().int().min(0),total:t.number().int().min(1),errorMessage:t.string().optional()}).strict(),E=t.object({v:n,kind:t.literal("warning"),message:t.string().min(1)}).strict(),h=t.object({code:t.string().min(1),message:t.string().min(1),details:t.record(t.string(),t.unknown()).optional()}).strict(),I=t.object({v:n,kind:t.literal("error"),error:h}).strict(),x=t.object({v:n,kind:t.literal("result"),data:t.unknown()}).strict(),T=t.object({v:n,kind:t.literal("auth.browser.required"),url:t.string().url(),externalId:t.string().min(1),region:t.string().min(1),environment:t.string().min(1),reason:t.string().min(1)}).strict(),y=t.object({v:n,kind:t.literal("auth.browser.complete"),awsAccountId:t.string().min(1),accountName:t.string().min(1),roleArn:t.string().min(1)}).strict(),N=t.discriminatedUnion("kind",[R,S,E,I,x,T,y]),m=t.object({path:t.string().min(1),sizeBytes:t.number().int().nonnegative(),collisionMode:t.enum(["create","overwrite"])}).strict(),c=t.object({type:t.enum(["register-application","create-activity","auto-link-repository","writeback-config-path"]),description:t.string().min(1)}).strict(),f=t.enum(d),k=t.enum(u),P=t.enum(g),_=t.enum(["lightweight","standard","resilient","enterprise","none"]),p=t.object({name:t.string().min(1),environment:t.string().min(1).nullable(),source:t.string().min(1)}).strict(),j=t.object({name:t.string().min(1),pattern:k.optional(),patternTier:f.optional(),patternDomain:t.string().min(1).optional(),network:_.optional(),template:t.string().min(1).optional(),docker:t.object({path:t.string().min(1).optional(),context:t.string().min(1).optional(),target:t.string().min(1).optional()}).strict().optional(),type:P.optional(),database:t.boolean().optional(),containerPort:t.number().int().min(1).max(65535).optional(),source:t.string().min(1).optional(),buildCommand:t.string().min(1).optional(),outputDir:t.string().min(1).optional(),git:t.boolean().optional(),github:t.boolean().optional(),repoVisibility:t.enum(["private","public"]).optional(),intent:t.string().max(s).optional()}).strict(),C=t.object({planId:t.string().regex(/^[0-9a-f]{32}$/),normalisedPath:t.string().min(1),resolvedInputs:j,targetAccount:p.nullable(),targetAccountCandidates:t.array(p),filesToWrite:t.array(m),npmPackages:t.array(t.string().min(1)),registryActions:t.array(c),patternUnsupportedForDryRun:t.boolean().optional(),intent:t.string().max(s).optional(),framework:t.string().min(1).optional(),summary:t.string().min(1)}).strict(),D=t.object({filesToWrite:t.array(m),npmPackages:t.array(t.string().min(1)),registryActions:t.array(c),patternUnsupportedForDryRun:t.boolean().optional()}).strict(),M=t.object({path:t.string().min(1),name:t.string().min(1),mode:t.enum(["application","pattern"]),dependenciesInstalled:t.boolean().optional(),warning:t.string().optional(),dryRunArtefacts:D.optional()}).strict(),U=t.object({step:t.string().min(1),current:t.number().int().nonnegative(),total:t.number().int().positive().optional(),message:t.string().min(1)}).strict();function V(e){let r;try{r=JSON.parse(e)}catch(i){return{ok:!1,reason:"json",raw:e,error:i instanceof Error?i.message:String(i)}}const o=N.safeParse(r);return o.success?{ok:!0,frame:o.data}:{ok:!1,reason:"schema",raw:e,error:o.error.message}}a(V,"parseFrame");export{y as AuthBrowserCompleteFrameSchema,T as AuthBrowserRequiredFrameSchema,D as DryRunArtefactsSchema,I as ErrorFrameSchema,m as FileToWriteSchema,s as INTENT_MAX_LENGTH,L as MCP_ERROR_CODES,b as MCP_PROTOCOL_VERSION,N as McpProtocolFrameSchema,c as RegistryActionSchema,j as ResolvedInputsSchema,x as ResultFrameSchema,C as ScaffoldPlanSchema,U as ScaffoldProgressFrameSchema,M as ScaffoldResultDataSchema,S as StepCompleteFrameSchema,R as StepStartFrameSchema,p as TargetAccountSchema,E as WarningFrameSchema,V as parseFrame};

package/dist/nonEmptyPartial.d.ts

@@ -0,0 +1,19 @@
+/**
+ * A read-only partial record that cannot be empty: the union, over every
+ * key of `T`, of "this key required, the rest optional". `{}` is
+ * unrepresentable whether or not `T` declares the key optional (the
+ * required arm strips `?`, so the carried key is present with its value),
+ * a key `T` does not carry fails typecheck on a literal, and each present
+ * key keeps its own value type — `T[K]` may differ per key, which is what a
+ * plain `Partial<T>` with a non-emptiness check cannot express. The shape a
+ * cure map is declared on: the posture registries' `PolicyCure`, and a
+ * consumer mirroring the cure map declares its own on this helper rather
+ * than re-spelling the union.
+ */
+export type NonEmptyPartial<T> = {
+    [Key in keyof T]-?: {
+        readonly [K in Key]-?: T[K];
+    } & {
+        readonly [K in Exclude<keyof T, Key>]?: T[K];
+    };
+}[keyof T];

package/dist/nonEmptyPartial.js

@@ -0,0 +1 @@
+const n={first:1},o={second:"two"},t={first:1,second:"two"},s={},e={first:1,third:3},c={second:"two"},i={},d={second:void 0};

package/dist/patterns/frameworkPatterns.d.ts

@@ -30,7 +30,7 @@
  * than left behind as a lie. The reverse holds too: a pattern that loses its
  * construct cannot stay in `recommended`.
  */
-import { PATTERN_REGISTRY, type PatternType, type PatternCreateInput } from "./patternTypes.js";
+import { PATTERN_REGISTRY, type PatternType, type PatternCreateInput, type DeployablePatternType } from "./patternTypes.js";
 /**
  * Every framework the detector can name.
  *
@@ -50,13 +50,6 @@ export declare const FRAMEWORK_VALUES: readonly ["nextjs", "payload", "nextjs+pa
 export type Framework = (typeof FRAMEWORK_VALUES)[number];
 export declare const FRAMEWORKS: ReadonlySet<string>;
 export declare function isFramework(value: unknown): value is Framework;
-/**
- * The patterns that can deploy end-to-end, derived from the registry's own
- * flag at the type level. `DEPLOYABLE_PATTERN_TYPES` is the value-level twin.
- */
-export type DeployablePatternType = {
-    [K in PatternType]: (typeof PATTERN_REGISTRY)[K]["deployable"] extends true ? K : never;
-}[PatternType];
 /**
  * The patterns the generator knows but cannot yet synthesise. Uninhabited once
  * every pattern is deployable — at which point the `blocked` verdict below

package/dist/patterns/index.d.ts

@@ -7,6 +7,6 @@
  * the webapp bundles) can take the vocabulary without depending on the root
  * barrel's contents staying pure.
  */
-export { PATTERN_TYPE_VALUES, type PatternType, PATTERN_TYPES, isPatternType, type PatternArtefact, type PatternStackPlacement, type PatternDescriptor, PATTERN_REGISTRY, patternConstructId, DEPLOYABLE_PATTERN_TYPES, type OpenNextPatternType, OPENNEXT_PATTERN_TYPES, isOpenNextPatternType, CLOUDFRONT_PRICE_CLASS_VALUES, type CloudFrontPriceClass, STATIC_SITE_CONFIG_KEYS, type StaticSiteConfigKey, STATIC_SITE_DEPLOY_INJECTED_KEYS, type StaticSiteDeployInjectedKey, STATIC_SITE_CDN_CONFIG_KEYS, type StaticSiteCdnConfigKey, STATIC_SITE_ROUTING_VALUES, STATIC_SITE_ROUTING_INFO, type StaticSiteRouting, type StaticSiteRoutingDescriptor, PATTERN_CREATE_INPUT_VALUES, type PatternCreateInput, PATTERN_CREATE_INPUT_FLAGS } from "./patternTypes.js";
-export { FRAMEWORK_VALUES, type Framework, FRAMEWORKS, isFramework, type DeployablePatternType, type UndeployablePatternType, type PatternRecommendation, FRAMEWORK_PATTERN_RECOMMENDATIONS, recommendPatternForFramework, CREATABLE_FRAMEWORKS, requiredInputsForFramework } from "./frameworkPatterns.js";
+export { PATTERN_TYPE_VALUES, type PatternType, PATTERN_TYPES, isPatternType, type PatternArtefact, type PatternStackPlacement, type PatternDescriptor, PATTERN_REGISTRY, patternConstructId, type DeployablePatternType, DEPLOYABLE_PATTERN_TYPES, PATTERN_TIER_VALUES, type PatternTier, type OpenNextPatternType, OPENNEXT_PATTERN_TYPES, isOpenNextPatternType, OPENNEXT_BUCKET_KEYS, type OpenNextBucketKey, isOpenNextBucketKey, patternBucketConstructId, CLOUDFRONT_PRICE_CLASS_VALUES, type CloudFrontPriceClass, STATIC_SITE_CONFIG_KEYS, type StaticSiteConfigKey, STATIC_SITE_DEPLOY_INJECTED_KEYS, type StaticSiteDeployInjectedKey, STATIC_SITE_CDN_CONFIG_KEYS, type StaticSiteCdnConfigKey, STATIC_SITE_ROUTING_VALUES, STATIC_SITE_ROUTING_INFO, type StaticSiteRouting, type StaticSiteRoutingDescriptor, PATTERN_CREATE_INPUT_VALUES, type PatternCreateInput, PATTERN_CREATE_INPUT_FLAGS } from "./patternTypes.js";
+export { FRAMEWORK_VALUES, type Framework, FRAMEWORKS, isFramework, type UndeployablePatternType, type PatternRecommendation, FRAMEWORK_PATTERN_RECOMMENDATIONS, recommendPatternForFramework, CREATABLE_FRAMEWORKS, requiredInputsForFramework } from "./frameworkPatterns.js";
 export { DEFAULT_FORMS_FROM_LOCAL_PART, defaultFormsFromAddress, defaultFormsCorsOrigin, isAddressAtDomain } from "./staticSiteForms.js";

package/dist/patterns/index.js

@@ -1 +1 @@
-import{PATTERN_TYPE_VALUES as _,PATTERN_TYPES as A,isPatternType as r,PATTERN_REGISTRY as R,patternConstructId as S,DEPLOYABLE_PATTERN_TYPES as I,OPENNEXT_PATTERN_TYPES as N,isOpenNextPatternType as e,CLOUDFRONT_PRICE_CLASS_VALUES as P,STATIC_SITE_CONFIG_KEYS as O,STATIC_SITE_DEPLOY_INJECTED_KEYS as F,STATIC_SITE_CDN_CONFIG_KEYS as C,STATIC_SITE_ROUTING_VALUES as o,STATIC_SITE_ROUTING_INFO as t,PATTERN_CREATE_INPUT_VALUES as L,PATTERN_CREATE_INPUT_FLAGS as s}from"./patternTypes.js";import{FRAMEWORK_VALUES as U,FRAMEWORKS as a,isFramework as n,FRAMEWORK_PATTERN_RECOMMENDATIONS as Y,recommendPatternForFramework as d,CREATABLE_FRAMEWORKS as i,requiredInputsForFramework as p}from"./frameworkPatterns.js";import{DEFAULT_FORMS_FROM_LOCAL_PART as M,defaultFormsFromAddress as K,defaultFormsCorsOrigin as G,isAddressAtDomain as f}from"./staticSiteForms.js";export{P as CLOUDFRONT_PRICE_CLASS_VALUES,i as CREATABLE_FRAMEWORKS,M as DEFAULT_FORMS_FROM_LOCAL_PART,I as DEPLOYABLE_PATTERN_TYPES,a as FRAMEWORKS,Y as FRAMEWORK_PATTERN_RECOMMENDATIONS,U as FRAMEWORK_VALUES,N as OPENNEXT_PATTERN_TYPES,s as PATTERN_CREATE_INPUT_FLAGS,L as PATTERN_CREATE_INPUT_VALUES,R as PATTERN_REGISTRY,A as PATTERN_TYPES,_ as PATTERN_TYPE_VALUES,C as STATIC_SITE_CDN_CONFIG_KEYS,O as STATIC_SITE_CONFIG_KEYS,F as STATIC_SITE_DEPLOY_INJECTED_KEYS,t as STATIC_SITE_ROUTING_INFO,o as STATIC_SITE_ROUTING_VALUES,G as defaultFormsCorsOrigin,K as defaultFormsFromAddress,f as isAddressAtDomain,n as isFramework,e as isOpenNextPatternType,r as isPatternType,S as patternConstructId,d as recommendPatternForFramework,p as requiredInputsForFramework};
+import{PATTERN_TYPE_VALUES as _,PATTERN_TYPES as A,isPatternType as r,PATTERN_REGISTRY as R,patternConstructId as S,DEPLOYABLE_PATTERN_TYPES as e,PATTERN_TIER_VALUES as N,OPENNEXT_PATTERN_TYPES as t,isOpenNextPatternType as I,OPENNEXT_BUCKET_KEYS as P,isOpenNextBucketKey as O,patternBucketConstructId as C,CLOUDFRONT_PRICE_CLASS_VALUES as F,STATIC_SITE_CONFIG_KEYS as o,STATIC_SITE_DEPLOY_INJECTED_KEYS as L,STATIC_SITE_CDN_CONFIG_KEYS as s,STATIC_SITE_ROUTING_VALUES as n,STATIC_SITE_ROUTING_INFO as U,PATTERN_CREATE_INPUT_VALUES as m,PATTERN_CREATE_INPUT_FLAGS as a}from"./patternTypes.js";import{FRAMEWORK_VALUES as d,FRAMEWORKS as p,isFramework as K,FRAMEWORK_PATTERN_RECOMMENDATIONS as i,recommendPatternForFramework as u,CREATABLE_FRAMEWORKS as D,requiredInputsForFramework as M}from"./frameworkPatterns.js";import{DEFAULT_FORMS_FROM_LOCAL_PART as V,defaultFormsFromAddress as c,defaultFormsCorsOrigin as f,isAddressAtDomain as k}from"./staticSiteForms.js";export{F as CLOUDFRONT_PRICE_CLASS_VALUES,D as CREATABLE_FRAMEWORKS,V as DEFAULT_FORMS_FROM_LOCAL_PART,e as DEPLOYABLE_PATTERN_TYPES,p as FRAMEWORKS,i as FRAMEWORK_PATTERN_RECOMMENDATIONS,d as FRAMEWORK_VALUES,P as OPENNEXT_BUCKET_KEYS,t as OPENNEXT_PATTERN_TYPES,a as PATTERN_CREATE_INPUT_FLAGS,m as PATTERN_CREATE_INPUT_VALUES,R as PATTERN_REGISTRY,N as PATTERN_TIER_VALUES,A as PATTERN_TYPES,_ as PATTERN_TYPE_VALUES,s as STATIC_SITE_CDN_CONFIG_KEYS,o as STATIC_SITE_CONFIG_KEYS,L as STATIC_SITE_DEPLOY_INJECTED_KEYS,U as STATIC_SITE_ROUTING_INFO,n as STATIC_SITE_ROUTING_VALUES,f as defaultFormsCorsOrigin,c as defaultFormsFromAddress,k as isAddressAtDomain,K as isFramework,O as isOpenNextBucketKey,I as isOpenNextPatternType,r as isPatternType,C as patternBucketConstructId,S as patternConstructId,u as recommendPatternForFramework,M as requiredInputsForFramework};

package/dist/patterns/patternTypes.d.ts

@@ -128,12 +128,54 @@ export declare const PATTERN_REGISTRY: {
  * detection silently re-admits the synth-fatal id collision.
  */
 export declare function patternConstructId(name: string, type: PatternType): string;
+/**
+ * The buckets an OpenNext pattern's construct builds, keyed as the pattern
+ * statement's `storage` config spells them (`storage.media.versioned`): the
+ * build output, the ISR cache and the uploads. The constructs' props type
+ * and the generator's config schema are both pinned to this tuple, so a
+ * bucket the construct starts building appears in the config vocabulary
+ * before either can compile without it.
+ */
+export declare const OPENNEXT_BUCKET_KEYS: readonly ["assets", "cache", "media"];
+export type OpenNextBucketKey = (typeof OPENNEXT_BUCKET_KEYS)[number];
+export declare function isOpenNextBucketKey(value: unknown): value is OpenNextBucketKey;
+/**
+ * The construct id of one bucket an OpenNext pattern builds — the FIRST
+ * ARGUMENT of the `StorageFactory.build` call the construct makes for it:
+ * the pattern statement's `name` prop (the workload name the engine lists
+ * as `resourceName`), a hyphen, the bucket key. The bucket's CloudFormation
+ * logical id is derived from this id, so a consumer matching a logical id
+ * back to the statement that owns the bucket derives the same string here
+ * rather than re-composing it; a drifted re-composition agrees for every
+ * kebab-case name and diverges the first time a name carries a case
+ * boundary the id derivation folds.
+ */
+export declare function patternBucketConstructId(name: string, bucket: OpenNextBucketKey): string;
+/**
+ * The patterns that can deploy end-to-end, derived from the registry's own
+ * flag at the type level. `DEPLOYABLE_PATTERN_TYPES` is the value-level twin.
+ */
+export type DeployablePatternType = {
+    [K in PatternType]: (typeof PATTERN_REGISTRY)[K]["deployable"] extends true ? K : never;
+}[PatternType];
 /**
  * Patterns the toolchain may offer for creation, derived from the registry —
  * pickers and validation reject the rest at create time instead of letting a
- * scaffold fail at first deploy.
+ * scaffold fail at first deploy. Typed to the deployable subset so an enum
+ * built from it (`z.enum(DEPLOYABLE_PATTERN_TYPES)`) infers exactly the
+ * members it accepts at runtime.
+ */
+export declare const DEPLOYABLE_PATTERN_TYPES: readonly DeployablePatternType[];
+/**
+ * Tier presets a pattern may be created with — the ONE spelling the generator
+ * (`PatternTierSchema`), the CLI's SKILL vocabulary, the MCP protocol's
+ * `ResolvedInputsSchema` and the MCP `plan_app_scaffold` input derive from.
+ * Not the infrastructure tiers (`TIER_NAMES`: tinkerer … enterprise), which
+ * govern `fjall add … --tier` — the two vocabularies were conflated on the MCP
+ * surface until Train 4 of the 2026-09-07 hardening prompt.
  */
-export declare const DEPLOYABLE_PATTERN_TYPES: readonly PatternType[];
+export declare const PATTERN_TIER_VALUES: readonly ["lightweight", "standard", "resilient", "custom"];
+export type PatternTier = (typeof PATTERN_TIER_VALUES)[number];
 /**
  * The OpenNext-shaped patterns, derived from the registry at both the type and
  * the value level — a new OpenNext pattern joins this accept-set by declaring

package/dist/patterns/patternTypes.js

@@ -1 +1 @@
-var n=Object.defineProperty;var e=(t,a)=>n(t,"name",{value:a,configurable:!0});import{toPascalCase as r}from"../naming/caseConversion.js";const s=["payload","nextjs","staticsite"],c=new Set(s);function T(t){return typeof t=="string"&&c.has(t)}e(T,"isPatternType");const S=["source","buildCommand","outputDir"],d={source:"--source",buildCommand:"--build-command",outputDir:"--output-dir"},o={payload:{label:"Payload CMS",constructIdSuffix:"Payload",artefact:"opennext-lambda",stackPlacement:"compute",deployable:!0,requiredCreateInputs:[],synthesises:["AWS::S3::Bucket","AWS::KMS::Key"]},nextjs:{label:"Next.js",constructIdSuffix:"Nextjs",artefact:"opennext-lambda",stackPlacement:"compute",deployable:!1,requiredCreateInputs:[],synthesises:["AWS::S3::Bucket","AWS::KMS::Key"]},staticsite:{label:"Static site",constructIdSuffix:"StaticSite",artefact:"static-assets",stackPlacement:"cdn",deployable:!0,requiredCreateInputs:["source","buildCommand","outputDir"],synthesises:["AWS::S3::Bucket"]}};function E(t,a){return`${r(t)}${o[a].constructIdSuffix}`}e(E,"patternConstructId");const _=s.filter(t=>o[t].deployable),i=s.filter(t=>o[t].artefact==="opennext-lambda"),u=new Set(i);function m(t){return t!=null&&u.has(t)}e(m,"isOpenNextPatternType");const x=["multipage","directory","spa"],P={multipage:{label:"Multi-page (.html files)",summary:"/about serves /about.html"},directory:{label:"Directory index",summary:"/about serves /about/index.html"},spa:{label:"Single-page app",summary:"unknown paths fall back to /index.html"}},I=["PriceClass_100","PriceClass_200","PriceClass_All"],A=["type","name","source","build","routing","security","domain","managedDomain","zoneName","hostedZoneId","forms","cdn","accessGate"],C=["managedDomain"],N=["behaviours","priceClass","invalidateOnDeploy"];export{I as CLOUDFRONT_PRICE_CLASS_VALUES,_ as DEPLOYABLE_PATTERN_TYPES,i as OPENNEXT_PATTERN_TYPES,d as PATTERN_CREATE_INPUT_FLAGS,S as PATTERN_CREATE_INPUT_VALUES,o as PATTERN_REGISTRY,c as PATTERN_TYPES,s as PATTERN_TYPE_VALUES,N as STATIC_SITE_CDN_CONFIG_KEYS,A as STATIC_SITE_CONFIG_KEYS,C as STATIC_SITE_DEPLOY_INJECTED_KEYS,P as STATIC_SITE_ROUTING_INFO,x as STATIC_SITE_ROUTING_VALUES,m as isOpenNextPatternType,T as isPatternType,E as patternConstructId};
+var n=Object.defineProperty;var e=(t,s)=>n(t,"name",{value:s,configurable:!0});import{toPascalCase as r}from"../naming/caseConversion.js";const o=["payload","nextjs","staticsite"],c=new Set(o);function S(t){return typeof t=="string"&&c.has(t)}e(S,"isPatternType");const d=["source","buildCommand","outputDir"],_={source:"--source",buildCommand:"--build-command",outputDir:"--output-dir"},a={payload:{label:"Payload CMS",constructIdSuffix:"Payload",artefact:"opennext-lambda",stackPlacement:"compute",deployable:!0,requiredCreateInputs:[],synthesises:["AWS::S3::Bucket","AWS::KMS::Key"]},nextjs:{label:"Next.js",constructIdSuffix:"Nextjs",artefact:"opennext-lambda",stackPlacement:"compute",deployable:!1,requiredCreateInputs:[],synthesises:["AWS::S3::Bucket","AWS::KMS::Key"]},staticsite:{label:"Static site",constructIdSuffix:"StaticSite",artefact:"static-assets",stackPlacement:"cdn",deployable:!0,requiredCreateInputs:["source","buildCommand","outputDir"],synthesises:["AWS::S3::Bucket"]}};function m(t,s){return`${r(t)}${a[s].constructIdSuffix}`}e(m,"patternConstructId");const i=["assets","cache","media"],u=new Set(i);function x(t){return typeof t=="string"&&u.has(t)}e(x,"isOpenNextBucketKey");function P(t,s){return`${t}-${s}`}e(P,"patternBucketConstructId");const N=o.filter(t=>a[t].deployable),I=["lightweight","standard","resilient","custom"],p=o.filter(t=>a[t].artefact==="opennext-lambda"),l=new Set(p);function A(t){return t!=null&&l.has(t)}e(A,"isOpenNextPatternType");const C=["multipage","directory","spa"],f={multipage:{label:"Multi-page (.html files)",summary:"/about serves /about.html"},directory:{label:"Directory index",summary:"/about serves /about/index.html"},spa:{label:"Single-page app",summary:"unknown paths fall back to /index.html"}},y=["PriceClass_100","PriceClass_200","PriceClass_All"],b=["type","name","source","build","routing","security","domain","managedDomain","zoneName","hostedZoneId","forms","cdn","accessGate"],R=["managedDomain"],h=["behaviours","priceClass","invalidateOnDeploy"];export{y as CLOUDFRONT_PRICE_CLASS_VALUES,N as DEPLOYABLE_PATTERN_TYPES,i as OPENNEXT_BUCKET_KEYS,p as OPENNEXT_PATTERN_TYPES,_ as PATTERN_CREATE_INPUT_FLAGS,d as PATTERN_CREATE_INPUT_VALUES,a as PATTERN_REGISTRY,I as PATTERN_TIER_VALUES,c as PATTERN_TYPES,o as PATTERN_TYPE_VALUES,h as STATIC_SITE_CDN_CONFIG_KEYS,b as STATIC_SITE_CONFIG_KEYS,R as STATIC_SITE_DEPLOY_INJECTED_KEYS,f as STATIC_SITE_ROUTING_INFO,C as STATIC_SITE_ROUTING_VALUES,x as isOpenNextBucketKey,A as isOpenNextPatternType,S as isPatternType,P as patternBucketConstructId,m as patternConstructId};

package/dist/posturePolicy/registry.d.ts

@@ -26,6 +26,7 @@ import { type PatternType } from "../patterns/patternTypes.js";
 import type { BackupTierDefaults } from "../backupTiers.js";
 import { type CodemodStatementType } from "../codemod/statementTypes.js";
 import type { MachineLaneStatus } from "./machineLane.js";
+import type { NonEmptyPartial } from "../nonEmptyPartial.js";
 import type { PolicyResourceKind } from "./resourceKinds.js";
 /** Account stages on which an expected-lane finding is softened. */
 export declare const EXPECTED_LANE_STAGES: readonly ["development", "staging"];
@@ -81,21 +82,16 @@ export interface PatternCure {
 export type PolicyCureEdit<Family extends CodemodStatementType> = Family extends "pattern" ? PatternCure : string;
 /**
  * The cure per family of statement the finding's resource can belong to,
- * keyed by the codemod's vocabulary: a non-empty partial record — the union,
- * over every family, of "this family required, the rest optional" — so `{}`
- * is unrepresentable and a key the codemod cannot address fails typecheck.
+ * keyed by the codemod's vocabulary: a `NonEmptyPartial` record, so `{}` is
+ * unrepresentable and a key the codemod cannot address fails typecheck.
  * Each value is the edit as the user writes it in `infrastructure.ts` on a
  * statement of that family (`versioned: true` on a `storage` statement,
  * `storage.media.versioned: true` on the `pattern` statement that owns the
  * bucket, scoped to the pattern types that carry the path).
  */
-export type PolicyCure = {
-    [Family in CodemodStatementType]: {
-        readonly [K in Family]: PolicyCureEdit<K>;
-    } & {
-        readonly [K in Exclude<CodemodStatementType, Family>]?: PolicyCureEdit<K>;
-    };
-}[CodemodStatementType];
+export type PolicyCure = NonEmptyPartial<{
+    [Family in CodemodStatementType]: PolicyCureEdit<Family>;
+}>;
 export interface ExpectedPolicyRow {
     ruleId: string;
     /**

package/dist/posturePolicy/resourceKinds.d.ts

@@ -1,12 +1,12 @@
 /**
  * The CloudFormation resource types the policy registries speak for: the
  * `kind` every row carries, and the vocabulary a create surface's footprint
- * is expressed in (`expectedRowsAtDefault`). The literals are
- * CloudFormation's own (`AWS::S3::Bucket`) — the strings the scan stores as
- * an asset's resource type and a webapp rule lists in its `resourceTypes` —
- * so a row's kind is checked against its rule by equality, never through a
- * mapping. A kind joins the tuple when a row needs it; a footprint can only
- * name a kind some row can match.
+ * is expressed in (`expectedRowsAtDefault`). Drawn from `AWS_RESOURCE_TYPES`
+ * — the literals are CloudFormation's own (`AWS::S3::Bucket`), the strings
+ * the scan stores as an asset's resource type and a webapp rule lists in its
+ * `resourceTypes` — so a row's kind is checked against its rule by equality,
+ * never through a mapping. A kind joins the tuple when a row needs it; a
+ * footprint can only name a kind some row can match.
  */
 export declare const POLICY_RESOURCE_KINDS: readonly ["AWS::S3::Bucket", "AWS::ECS::Cluster", "AWS::SNS::Topic", "AWS::KMS::Key"];
 export type PolicyResourceKind = (typeof POLICY_RESOURCE_KINDS)[number];

package/dist/posturePolicy/resourceKinds.js

@@ -1 +1 @@
-var S=Object.defineProperty;var e=(t,o)=>S(t,"name",{value:o,configurable:!0});const r=["AWS::S3::Bucket","AWS::ECS::Cluster","AWS::SNS::Topic","AWS::KMS::Key"],c=new Set(r);function i(t){return typeof t=="string"&&c.has(t)}e(i,"isPolicyResourceKind");function p(t){const o=new Set;for(const n of t)i(n)&&o.add(n);return o}e(p,"policyResourceFootprint");export{r as POLICY_RESOURCE_KINDS,i as isPolicyResourceKind,p as policyResourceFootprint};
+var e=Object.defineProperty;var r=(o,t)=>e(o,"name",{value:t,configurable:!0});import{AWS_RESOURCE_TYPES as n}from"../aws/resourceTypes.js";const E=[n.S3_BUCKET,n.ECS_CLUSTER,n.SNS_TOPIC,n.KMS_KEY],i=new Set(E);function _(o){return typeof o=="string"&&i.has(o)}r(_,"isPolicyResourceKind");function s(o){const t=new Set;for(const S of o)_(S)&&t.add(S);return t}r(s,"policyResourceFootprint");export{E as POLICY_RESOURCE_KINDS,_ as isPolicyResourceKind,s as policyResourceFootprint};

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@fjall/util",
-  "version": "37.0.0",
+  "version": "38.0.0",
   "repository": {
     "type": "git",
     "url": "git+https://github.com/fjall-tech/fjall.git",
@@ -119,6 +119,10 @@
       "types": "./dist/insights/computePatternFingerprint.d.ts",
       "default": "./dist/insights/computePatternFingerprint.js"
     },
+    "./insights/vocabulary": {
+      "types": "./dist/insights/vocabulary.d.ts",
+      "default": "./dist/insights/vocabulary.js"
+    },
     "./mcpProtocol": {
       "types": "./dist/mcpProtocol/index.d.ts",
       "default": "./dist/mcpProtocol/index.js"