@fjall/util 37.0.0 → 39.0.0

package/dist/.minified

@@ -1 +1 @@
-131 files minified at 2026-09-14T08:49:14.213Z
+139 files minified at 2026-09-19T23:56:50.203Z

package/dist/appTypes.d.ts

@@ -0,0 +1,27 @@
+/**
+ * The infrastructure tier vocabulary — what `fjall apps create --type` accepts,
+ * and the ONE spelling the generator's `AppTypeSchema`, the CLI's
+ * `commandSchemas.ts` and the MCP's `plan_app_scaffold` input all derive from.
+ *
+ * Not the pattern tiers (`PATTERN_TIER_VALUES`: lightweight … custom), which
+ * govern `--pattern-tier`. The two vocabularies overlap on three members and
+ * were conflated on the MCP surface until Train 4 of the 2026-09-07 hardening
+ * prompt; keeping both here, each naming the other, is what stops the next
+ * reader picking whichever tuple is nearer.
+ *
+ * The MCP shells out to the CLI and can import neither it nor the generator at
+ * runtime, so util is the seam all three read — the same rationale as
+ * `ciSetup.ts` and `patterns/patternTypes.ts`.
+ *
+ * Client-safe (no node built-ins) — exported from the root barrel.
+ */
+export declare const INFRASTRUCTURE_TIER_NAMES: readonly ["tinkerer", "lightweight", "standard", "resilient", "enterprise"];
+export type InfrastructureTierName = (typeof INFRASTRUCTURE_TIER_NAMES)[number];
+/**
+ * The escape hatch: an app that declares its own resources rather than taking
+ * a tier preset. A member of `APP_TYPES`, never of the tier tuple — the presets
+ * are a `Record<InfrastructureTierName, …>` and `custom` has no preset row.
+ */
+export declare const CUSTOM_APP_TYPE: "custom";
+export declare const APP_TYPES: readonly ["tinkerer", "lightweight", "standard", "resilient", "enterprise", "custom"];
+export type AppType = (typeof APP_TYPES)[number];

package/dist/appTypes.js

@@ -0,0 +1 @@
+const t=["tinkerer","lightweight","standard","resilient","enterprise"],e="custom",r=[...t,e];export{r as APP_TYPES,e as CUSTOM_APP_TYPE,t as INFRASTRUCTURE_TIER_NAMES};

package/dist/aws/index.d.ts

@@ -1,11 +1,12 @@
 export { AWSError, NoRolesFoundError, InvalidCredentialsError, SSOTokenExpiredError, MissingRegionError, ProfileNotFoundError, CommandError, isAWSError, isNoRolesFoundError, isSSOUnauthorizedError } from "./errors.js";
 export { STACK_NOT_FOUND_PATTERN, CDK_NO_STACKS_MATCH, type ResourceEvent, isResourceEvent } from "./cloudformationTypes.js";
+export { AWS_RESOURCE_TYPES, type AwsResourceType, isAwsResourceType } from "./resourceTypes.js";
 export { type ResourceProgressCounts, countResourceProgress, formatElapsed } from "./deployProgress.js";
 export { CloudFormationFailureAnalyser, type RootCause, type FailureAnalysis } from "./CloudFormationFailureAnalyser.js";
 export { FAILURE_ANALYSIS_CATEGORIES, type FailureAnalysisCategory } from "./failureAnalysisCategories.js";
 export { maskFailureAnalysis } from "./maskFailureAnalysis.js";
 export { classifyDriftSuspectEvents, findCurrentOperationStart, isDriftSuspectReason, isOperationOpeningEvent, type DriftSuspectEvent } from "./driftSuspects.js";
 export { IPAM_OPERATIONS_POOL_TAG_KEY, formatIpamPairTagValue } from "./ipamTags.js";
-export { FJALL_RESOURCE_TYPE_TAG_KEY, FJALL_RESOURCE_TYPES, type FjallResourceType, KMS_ALIAS_TAG_KEY, KMS_RETENTION_TAG_KEY, S3_VERSIONING_EXEMPT_TAG_KEY, S3_VERSIONING_EXEMPTIONS, SDK_PRE_EMPTY_TAG_KEY, type S3VersioningExemption } from "./infraTags.js";
+export { FJALL_RESOURCE_TYPE_TAG_KEY, FJALL_RESOURCE_TYPES, type FjallResourceType, KMS_ALIAS_TAG_KEY, KMS_RETENTION_TAG_KEY, S3_BACKUP_EXEMPT_TAG_KEY, S3_BACKUP_EXEMPTIONS, S3_VERSIONING_EXEMPT_TAG_KEY, S3_VERSIONING_EXEMPTIONS, SDK_PRE_EMPTY_TAG_KEY, type S3BackupExemption, type S3VersioningExemption } from "./infraTags.js";
 export { COST_ALLOCATION_TAGS, DEFAULT_COST_ALLOCATION_ENVIRONMENT, DEFAULT_COST_ALLOCATION_OWNER, ecrCreateRepositoryTags, rdsPreMigrationSnapshotTags, type AwsSdkTag, type EcrCreateTag } from "./costAllocationTags.js";
 export { ACCOUNT_MONITORING_ROLE_NAME } from "./monitoringRole.js";

package/dist/aws/index.js

@@ -1 +1 @@
-import{AWSError as E,NoRolesFoundError as e,InvalidCredentialsError as _,SSOTokenExpiredError as T,MissingRegionError as A,ProfileNotFoundError as t,CommandError as O,isAWSError as S,isNoRolesFoundError as s,isSSOUnauthorizedError as i}from"./errors.js";import{STACK_NOT_FOUND_PATTERN as N,CDK_NO_STACKS_MATCH as n,isResourceEvent as R}from"./cloudformationTypes.js";import{countResourceProgress as C,formatElapsed as I}from"./deployProgress.js";import{CloudFormationFailureAnalyser as m}from"./CloudFormationFailureAnalyser.js";import{FAILURE_ANALYSIS_CATEGORIES as u}from"./failureAnalysisCategories.js";import{maskFailureAnalysis as l}from"./maskFailureAnalysis.js";import{classifyDriftSuspectEvents as x,findCurrentOperationStart as F,isDriftSuspectReason as K,isOperationOpeningEvent as M}from"./driftSuspects.js";import{IPAM_OPERATIONS_POOL_TAG_KEY as Y,formatIpamPairTagValue as g}from"./ipamTags.js";import{FJALL_RESOURCE_TYPE_TAG_KEY as c,FJALL_RESOURCE_TYPES as D,KMS_ALIAS_TAG_KEY as v,KMS_RETENTION_TAG_KEY as y,S3_VERSIONING_EXEMPT_TAG_KEY as V,S3_VERSIONING_EXEMPTIONS as W,SDK_PRE_EMPTY_TAG_KEY as h}from"./infraTags.js";import{COST_ALLOCATION_TAGS as J,DEFAULT_COST_ALLOCATION_ENVIRONMENT as X,DEFAULT_COST_ALLOCATION_OWNER as z,ecrCreateRepositoryTags as H,rdsPreMigrationSnapshotTags as b}from"./costAllocationTags.js";import{ACCOUNT_MONITORING_ROLE_NAME as q}from"./monitoringRole.js";export{q as ACCOUNT_MONITORING_ROLE_NAME,E as AWSError,n as CDK_NO_STACKS_MATCH,J as COST_ALLOCATION_TAGS,m as CloudFormationFailureAnalyser,O as CommandError,X as DEFAULT_COST_ALLOCATION_ENVIRONMENT,z as DEFAULT_COST_ALLOCATION_OWNER,u as FAILURE_ANALYSIS_CATEGORIES,D as FJALL_RESOURCE_TYPES,c as FJALL_RESOURCE_TYPE_TAG_KEY,Y as IPAM_OPERATIONS_POOL_TAG_KEY,_ as InvalidCredentialsError,v as KMS_ALIAS_TAG_KEY,y as KMS_RETENTION_TAG_KEY,A as MissingRegionError,e as NoRolesFoundError,t as ProfileNotFoundError,W as S3_VERSIONING_EXEMPTIONS,V as S3_VERSIONING_EXEMPT_TAG_KEY,h as SDK_PRE_EMPTY_TAG_KEY,T as SSOTokenExpiredError,N as STACK_NOT_FOUND_PATTERN,x as classifyDriftSuspectEvents,C as countResourceProgress,H as ecrCreateRepositoryTags,F as findCurrentOperationStart,I as formatElapsed,g as formatIpamPairTagValue,S as isAWSError,K as isDriftSuspectReason,s as isNoRolesFoundError,M as isOperationOpeningEvent,R as isResourceEvent,i as isSSOUnauthorizedError,l as maskFailureAnalysis,b as rdsPreMigrationSnapshotTags};
+import{AWSError as E,NoRolesFoundError as _,InvalidCredentialsError as e,SSOTokenExpiredError as T,MissingRegionError as A,ProfileNotFoundError as S,CommandError as O,isAWSError as t,isNoRolesFoundError as s,isSSOUnauthorizedError as i}from"./errors.js";import{STACK_NOT_FOUND_PATTERN as a,CDK_NO_STACKS_MATCH as n,isResourceEvent as R}from"./cloudformationTypes.js";import{AWS_RESOURCE_TYPES as C,isAwsResourceType as I}from"./resourceTypes.js";import{countResourceProgress as m,formatElapsed as P}from"./deployProgress.js";import{CloudFormationFailureAnalyser as u}from"./CloudFormationFailureAnalyser.js";import{FAILURE_ANALYSIS_CATEGORIES as M}from"./failureAnalysisCategories.js";import{maskFailureAnalysis as x}from"./maskFailureAnalysis.js";import{classifyDriftSuspectEvents as F,findCurrentOperationStart as G,isDriftSuspectReason as Y,isOperationOpeningEvent as U}from"./driftSuspects.js";import{IPAM_OPERATIONS_POOL_TAG_KEY as g,formatIpamPairTagValue as D}from"./ipamTags.js";import{FJALL_RESOURCE_TYPE_TAG_KEY as v,FJALL_RESOURCE_TYPES as V,KMS_ALIAS_TAG_KEY as W,KMS_RETENTION_TAG_KEY as X,S3_BACKUP_EXEMPT_TAG_KEY as h,S3_BACKUP_EXEMPTIONS as k,S3_VERSIONING_EXEMPT_TAG_KEY as B,S3_VERSIONING_EXEMPTIONS as J,SDK_PRE_EMPTY_TAG_KEY as w}from"./infraTags.js";import{COST_ALLOCATION_TAGS as H,DEFAULT_COST_ALLOCATION_ENVIRONMENT as b,DEFAULT_COST_ALLOCATION_OWNER as j,ecrCreateRepositoryTags as q,rdsPreMigrationSnapshotTags as Q}from"./costAllocationTags.js";import{ACCOUNT_MONITORING_ROLE_NAME as $}from"./monitoringRole.js";export{$ as ACCOUNT_MONITORING_ROLE_NAME,E as AWSError,C as AWS_RESOURCE_TYPES,n as CDK_NO_STACKS_MATCH,H as COST_ALLOCATION_TAGS,u as CloudFormationFailureAnalyser,O as CommandError,b as DEFAULT_COST_ALLOCATION_ENVIRONMENT,j as DEFAULT_COST_ALLOCATION_OWNER,M as FAILURE_ANALYSIS_CATEGORIES,V as FJALL_RESOURCE_TYPES,v as FJALL_RESOURCE_TYPE_TAG_KEY,g as IPAM_OPERATIONS_POOL_TAG_KEY,e as InvalidCredentialsError,W as KMS_ALIAS_TAG_KEY,X as KMS_RETENTION_TAG_KEY,A as MissingRegionError,_ as NoRolesFoundError,S as ProfileNotFoundError,k as S3_BACKUP_EXEMPTIONS,h as S3_BACKUP_EXEMPT_TAG_KEY,J as S3_VERSIONING_EXEMPTIONS,B as S3_VERSIONING_EXEMPT_TAG_KEY,w as SDK_PRE_EMPTY_TAG_KEY,T as SSOTokenExpiredError,a as STACK_NOT_FOUND_PATTERN,F as classifyDriftSuspectEvents,m as countResourceProgress,q as ecrCreateRepositoryTags,G as findCurrentOperationStart,P as formatElapsed,D as formatIpamPairTagValue,t as isAWSError,I as isAwsResourceType,Y as isDriftSuspectReason,s as isNoRolesFoundError,U as isOperationOpeningEvent,R as isResourceEvent,i as isSSOUnauthorizedError,x as maskFailureAnalysis,Q as rdsPreMigrationSnapshotTags};

package/dist/aws/infraTags.d.ts

@@ -66,8 +66,8 @@ export declare const KMS_ALIAS_TAG_KEY = "fjall:kms:alias";
  *
  * The literal is deployed infrastructure state: renaming the key strips every
  * already-tagged resource of its marker until the next deploy, and the posture
- * exclusion silently falls back to the legacy name patterns. The pin test in
- * `__tests__/infraTags.test.ts` guards against casual renames.
+ * exclusion then reports every role whose only exemption was the marker. The
+ * pin test in `__tests__/infraTags.test.ts` guards against casual renames.
  */
 export declare const FJALL_RESOURCE_TYPE_TAG_KEY = "fjall:resource:type";
 /**
@@ -77,8 +77,21 @@ export declare const FJALL_RESOURCE_TYPE_TAG_KEY = "fjall:resource:type";
  * single class for every role that CloudFormation assumes only while driving a
  * custom resource (connector writers, IPAM, RDS, TLS, return-routes, identity
  * store, aws-cdk-lib's own hoisted providers), the class the unused-role
- * exclusion carves out — roles Fjall does not emit (CDK bootstrap, AWS
- * Organizations) stay on that exclusion's name patterns.
+ * exclusion carves out.
+ *
+ * What stays on that exclusion's NAME patterns is enumerated, not inferred by
+ * subtraction, and it is three sets: roles AWS or the CDK bootstrap stack
+ * create, which Fjall can never tag (`OrganizationAccountAccessRole`, the five
+ * bootstrap roles); roles Fjall emits with deterministic names that are NOT
+ * deploy-time writers (the connector deploy role, the DNS delegation roles,
+ * the dev-tier trio); and the connector writer roles
+ * (`Fjall{OIDCProvider,DeployBoundary,Callback}Lambda<orgId>`), which ARE
+ * marked — by the Quick-Create template named above — and keep a name clause
+ * only to cover connector stacks deployed before the marker release. That
+ * third set is the only LEGACY one, and the only clause that retires.
+ * aws-cdk-lib's hoisted singleton is in none of the three — it is marked, so
+ * it is exempt by marker alone, and a singleton in a stack Fjall did not
+ * synthesise carries no marker and IS reported.
  *
  * CDK resolves tag conflicts deeper-scope-wins, so a writer nested inside a
  * `vpcPeering` subtree resolves to `deployTimeWriter` — the more specific
@@ -117,3 +130,36 @@ export declare const S3_VERSIONING_EXEMPT_TAG_KEY = "fjall:s3:versioning-exempt"
 /** The exemptions the tag may carry — each names a bucket whose contents are rebuilt, not kept. */
 export declare const S3_VERSIONING_EXEMPTIONS: readonly ["build-output", "isr-cache", "cold-tier", "access-logs"];
 export type S3VersioningExemption = (typeof S3_VERSIONING_EXEMPTIONS)[number];
+/**
+ * The S3 backup-exemption marker tag — the versioning exemption's sibling, for
+ * the buckets the versioning one structurally cannot cover.
+ *
+ * `S3_VERSIONING_EXEMPT_TAG_KEY` is stamped only when the resolved `versioned`
+ * is false. These buckets are versioned and stay versioned; what they are not
+ * is a *backup source*. AWS Backup selects by tag with no resource-type
+ * filter, so a versioned bucket carrying `fjall:disasterRecovery:tier` is a
+ * bucket AWS Backup will copy — and for a bucket an AWS service delivers to
+ * continuously, that is a copy of a log stream that already has its own
+ * retention, not a recovery point anybody would restore.
+ *
+ * - Producer (`@fjall/components-infrastructure`): the `S3Bucket` wrapper
+ *   (`storage/s3.ts`) stamps a bucket whose author passed `backupExemption`,
+ *   and only when the bucket is versioned — an unversioned bucket is already
+ *   outside every plan, so it has nothing to exempt. The value names why the
+ *   bucket is not a source: `log-delivery` (an AWS service writes to it
+ *   continuously under its own lifecycle — VPC flow logs, CloudTrail, Config
+ *   delivery).
+ * - Consumer (webapp posture): the `MISSING_DR_TIER_TAG` rule reads key and
+ *   value to tell a versioned bucket that is deliberately not enrolled from
+ *   one that lost its tier by omission. Without it the rule raises a
+ *   permanent finding whose own auto-remediation cannot clear it, because no
+ *   construct will ever stamp that bucket.
+ *
+ * Key and values are deployed infrastructure state, read back by the same
+ * literals: a rename would return every exempt bucket to `open` until the next
+ * deploy. The pin test guards against casual renames.
+ */
+export declare const S3_BACKUP_EXEMPT_TAG_KEY = "fjall:s3:backup-exempt";
+/** The exemptions the tag may carry — each names a bucket that receives a service's log stream rather than holding recoverable state. */
+export declare const S3_BACKUP_EXEMPTIONS: readonly ["log-delivery"];
+export type S3BackupExemption = (typeof S3_BACKUP_EXEMPTIONS)[number];

package/dist/aws/infraTags.js

@@ -1 +1 @@
-const e="fjall:sdk-pre-empty",t="fjall:kms:retention",r="fjall:kms:alias",o="fjall:resource:type",p={vpcPeering:"vpc-peering",vpcPeeringAccepter:"vpc-peering-accepter",deployTimeWriter:"deploy-time-writer"},_="fjall:s3:versioning-exempt",c=["build-output","isr-cache","cold-tier","access-logs"];export{p as FJALL_RESOURCE_TYPES,o as FJALL_RESOURCE_TYPE_TAG_KEY,r as KMS_ALIAS_TAG_KEY,t as KMS_RETENTION_TAG_KEY,c as S3_VERSIONING_EXEMPTIONS,_ as S3_VERSIONING_EXEMPT_TAG_KEY,e as SDK_PRE_EMPTY_TAG_KEY};
+const e="fjall:sdk-pre-empty",t="fjall:kms:retention",_="fjall:kms:alias",o="fjall:resource:type",r={vpcPeering:"vpc-peering",vpcPeeringAccepter:"vpc-peering-accepter",deployTimeWriter:"deploy-time-writer"},p="fjall:s3:versioning-exempt",E=["build-output","isr-cache","cold-tier","access-logs"],c="fjall:s3:backup-exempt",s=["log-delivery"];export{r as FJALL_RESOURCE_TYPES,o as FJALL_RESOURCE_TYPE_TAG_KEY,_ as KMS_ALIAS_TAG_KEY,t as KMS_RETENTION_TAG_KEY,s as S3_BACKUP_EXEMPTIONS,c as S3_BACKUP_EXEMPT_TAG_KEY,E as S3_VERSIONING_EXEMPTIONS,p as S3_VERSIONING_EXEMPT_TAG_KEY,e as SDK_PRE_EMPTY_TAG_KEY};

package/dist/aws/resourceTypes.d.ts

@@ -0,0 +1,54 @@
+/**
+ * The resource-type literals Fjall's posture surfaces speak in: what the
+ * scan stores as an asset's resource type, what a compliance rule lists as
+ * the types it judges, and the vocabulary the policy registries' `kind`
+ * column is drawn from (`POLICY_RESOURCE_KINDS`). One table, keyed by a
+ * screaming-snake name, so a row's kind, a rule's list and an asset's
+ * stored type compare by equality — never through a mapping that could
+ * drift. The spelling is CloudFormation's `AWS::Service::Type` and most
+ * entries are CloudFormation's own; four are the scan's (`AWS::EBS::Volume`,
+ * `AWS::ACM::Certificate`, `AWS::ECS::Task`, `AWS::RDS::DBSnapshot` — types
+ * CloudFormation spells differently or does not have), so an entry is never
+ * corrected against the CloudFormation registry: the stored vocabulary is
+ * the contract. A type joins the table when a surface needs it, and nothing
+ * here imports a node built-in, so the browser-facing subpaths may read it.
+ */
+export declare const AWS_RESOURCE_TYPES: {
+    readonly EC2_INSTANCE: "AWS::EC2::Instance";
+    readonly EC2_SECURITY_GROUP: "AWS::EC2::SecurityGroup";
+    readonly EC2_VPC: "AWS::EC2::VPC";
+    readonly EC2_SUBNET: "AWS::EC2::Subnet";
+    readonly EC2_NETWORK_INTERFACE: "AWS::EC2::NetworkInterface";
+    readonly EBS_VOLUME: "AWS::EBS::Volume";
+    readonly RDS_DB_INSTANCE: "AWS::RDS::DBInstance";
+    readonly RDS_DB_CLUSTER: "AWS::RDS::DBCluster";
+    readonly RDS_DB_SNAPSHOT: "AWS::RDS::DBSnapshot";
+    readonly S3_BUCKET: "AWS::S3::Bucket";
+    readonly LAMBDA_FUNCTION: "AWS::Lambda::Function";
+    readonly ECS_CLUSTER: "AWS::ECS::Cluster";
+    readonly ECS_SERVICE: "AWS::ECS::Service";
+    readonly ECS_TASK: "AWS::ECS::Task";
+    readonly ECS_TASK_DEFINITION: "AWS::ECS::TaskDefinition";
+    readonly DYNAMODB_TABLE: "AWS::DynamoDB::Table";
+    readonly CLOUDFRONT_DISTRIBUTION: "AWS::CloudFront::Distribution";
+    readonly IAM_ROLE: "AWS::IAM::Role";
+    readonly IAM_POLICY: "AWS::IAM::Policy";
+    readonly IAM_USER: "AWS::IAM::User";
+    readonly IAM_GROUP: "AWS::IAM::Group";
+    readonly KMS_KEY: "AWS::KMS::Key";
+    readonly CLOUDTRAIL_TRAIL: "AWS::CloudTrail::Trail";
+    readonly CLOUDWATCH_ALARM: "AWS::CloudWatch::Alarm";
+    readonly LOGS_LOG_GROUP: "AWS::Logs::LogGroup";
+    readonly SNS_TOPIC: "AWS::SNS::Topic";
+    readonly SQS_QUEUE: "AWS::SQS::Queue";
+    readonly APIGATEWAYV2_API: "AWS::ApiGatewayV2::Api";
+    readonly SECRETS_MANAGER_SECRET: "AWS::SecretsManager::Secret";
+    readonly ACM_CERTIFICATE: "AWS::ACM::Certificate";
+    readonly ELBV2_LOAD_BALANCER: "AWS::ElasticLoadBalancingV2::LoadBalancer";
+    readonly ELASTICACHE_CLUSTER: "AWS::ElastiCache::CacheCluster";
+    readonly ROUTE53_HOSTED_ZONE: "AWS::Route53::HostedZone";
+    readonly BACKUP_VAULT: "AWS::Backup::BackupVault";
+};
+export type AwsResourceType = (typeof AWS_RESOURCE_TYPES)[keyof typeof AWS_RESOURCE_TYPES];
+/** Membership in the table, and nothing else: case and shape are not judged. */
+export declare function isAwsResourceType(value: unknown): value is AwsResourceType;

package/dist/aws/resourceTypes.js

@@ -0,0 +1 @@
+var C=Object.defineProperty;var A=(S,E)=>C(S,"name",{value:E,configurable:!0});const _={EC2_INSTANCE:"AWS::EC2::Instance",EC2_SECURITY_GROUP:"AWS::EC2::SecurityGroup",EC2_VPC:"AWS::EC2::VPC",EC2_SUBNET:"AWS::EC2::Subnet",EC2_NETWORK_INTERFACE:"AWS::EC2::NetworkInterface",EBS_VOLUME:"AWS::EBS::Volume",RDS_DB_INSTANCE:"AWS::RDS::DBInstance",RDS_DB_CLUSTER:"AWS::RDS::DBCluster",RDS_DB_SNAPSHOT:"AWS::RDS::DBSnapshot",S3_BUCKET:"AWS::S3::Bucket",LAMBDA_FUNCTION:"AWS::Lambda::Function",ECS_CLUSTER:"AWS::ECS::Cluster",ECS_SERVICE:"AWS::ECS::Service",ECS_TASK:"AWS::ECS::Task",ECS_TASK_DEFINITION:"AWS::ECS::TaskDefinition",DYNAMODB_TABLE:"AWS::DynamoDB::Table",CLOUDFRONT_DISTRIBUTION:"AWS::CloudFront::Distribution",IAM_ROLE:"AWS::IAM::Role",IAM_POLICY:"AWS::IAM::Policy",IAM_USER:"AWS::IAM::User",IAM_GROUP:"AWS::IAM::Group",KMS_KEY:"AWS::KMS::Key",CLOUDTRAIL_TRAIL:"AWS::CloudTrail::Trail",CLOUDWATCH_ALARM:"AWS::CloudWatch::Alarm",LOGS_LOG_GROUP:"AWS::Logs::LogGroup",SNS_TOPIC:"AWS::SNS::Topic",SQS_QUEUE:"AWS::SQS::Queue",APIGATEWAYV2_API:"AWS::ApiGatewayV2::Api",SECRETS_MANAGER_SECRET:"AWS::SecretsManager::Secret",ACM_CERTIFICATE:"AWS::ACM::Certificate",ELBV2_LOAD_BALANCER:"AWS::ElasticLoadBalancingV2::LoadBalancer",ELASTICACHE_CLUSTER:"AWS::ElastiCache::CacheCluster",ROUTE53_HOSTED_ZONE:"AWS::Route53::HostedZone",BACKUP_VAULT:"AWS::Backup::BackupVault"},e=new Set(Object.values(_));function W(S){return typeof S=="string"&&e.has(S)}A(W,"isAwsResourceType");export{_ as AWS_RESOURCE_TYPES,W as isAwsResourceType};

package/dist/backupTiers.d.ts

@@ -70,7 +70,10 @@ export interface BackupTierDefaults {
      * lifecycle-expired access-log bucket.
      */
     readonly albAccessLogs: boolean;
-    /** CloudFront standard (legacy) logging to the same access-log bucket. */
+    /**
+     * CloudFront standard logging (v2, CloudWatch-vended) to the same
+     * access-log bucket, as JSON.
+     */
     readonly cloudFrontLogging: boolean;
     /** Lambda active X-Ray tracing. */
     readonly lambdaTracing: boolean;
@@ -99,9 +102,13 @@ export declare const DEFAULT_BACKUP_TIER = "standard";
  */
 export declare function tierDefault<K extends keyof BackupTierDefaults>(tier: BackupTier | undefined, knob: K): BackupTierDefaults[K];
 /**
- * The tag key AWS Backup plan selection rules match on. The constructs stamp
- * it (`App.applyBackupTier()` app-wide, `StandardTagsAspect` per resource,
- * `BackupPlan` as the selection key). The webapp's posture rules
+ * The tag key AWS Backup plan selection rules match on. `BackupPlan` builds
+ * its selection from this key alone — the selection carries no resource-type
+ * filter, so the tag IS the selection scope — and the constructs that own a
+ * resource AWS Backup can protect stamp it at construction (`tagBackupTier`,
+ * called by the RDS instance, the Aurora cluster, the DynamoDB table, the
+ * ClickHouse data volume and a versioned bucket). It is not applied across
+ * the app, and no aspect applies it. The webapp's posture rules
  * (`assetParser`, `missing-dr-tier-tag`) read it back from discovered
  * resources and re-spell it until they import this — TODO 2026-09-14,
  * owner: paul — tracked in the 2026-09-05 remediation-raises build

package/dist/childEnvPolicy.d.ts

@@ -0,0 +1,72 @@
+/**
+ * Environment policy for child processes that may execute UNTRUSTED code.
+ *
+ * `filterDangerousEnvVars` is a deny-list of exec-hijack names (NODE_OPTIONS,
+ * LD_PRELOAD, …). It strips no secret and no credential, so a caller that holds
+ * production secrets in `process.env` and spawns with it hands every one of them
+ * to the child. That is correct on an operator's laptop — the child is the
+ * operator's own code, running as the operator — and wrong in a multi-tenant
+ * worker, where the child is a customer's `infrastructure.ts`, their
+ * `node_modules/typescript`, or their `npm` install scripts.
+ *
+ * The two cases cannot share a default, so the policy is REQUIRED at every seam
+ * that builds a child environment: an absent policy would silently select the
+ * permissive one, and no gate in either repository would fire.
+ */
+/**
+ * How a child process inherits its parent's environment.
+ *
+ * - `inherit` — the parent's environment minus the exec-hijack deny-list. The
+ *   child is trusted to the same degree as the parent. `reason` records why,
+ *   so the choice is visible at the call site rather than defaulted into.
+ * - `isolate` — an ALLOW-LIST. Only names the child demonstrably needs survive;
+ *   everything else, secrets included, is dropped. `extraAllowed` admits names a
+ *   specific caller must add; it never re-admits a name on the never-list.
+ */
+export type ChildEnvPolicy = {
+    kind: "inherit";
+    reason: string;
+} | {
+    kind: "isolate";
+    extraAllowed?: readonly string[];
+};
+/**
+ * Names an isolated child may read. Anything absent is dropped, so this list is
+ * the contract: a child that needs a new name gets it added here (or via
+ * `extraAllowed`) rather than by widening the policy.
+ */
+export declare const CHILD_ENV_ALLOWED_NAMES: ReadonlySet<string>;
+/**
+ * Names an isolated child may NEVER read, even via `extraAllowed`.
+ *
+ * The ECS entries are the reason this list exists rather than being folded into
+ * "absent from the allow-list": they are how the container runtime hands a task
+ * its OWN role credentials. A customer child that reads
+ * `AWS_CONTAINER_CREDENTIALS_RELATIVE_URI` fetches the deploy worker's
+ * production identity from 169.254.170.2 — a strictly larger prize than any
+ * single secret in the environment, and one no amount of secret-scrubbing
+ * removes. The web-identity pair is the same hazard on the IRSA and GitHub-OIDC
+ * lanes.
+ */
+export declare const CHILD_ENV_NEVER_NAMES: ReadonlySet<string>;
+/**
+ * For a `CdkArgumentBuilder` constructed purely to build argv — it never calls
+ * `buildCdkEnv`, so the policy is never consulted. Named rather than inlined so
+ * the reader can see the constructor argument is deliberate, and `isolate` so a
+ * future call to `buildCdkEnv` on such a builder fails safe rather than open.
+ */
+export declare const ARGV_ONLY_ENV_POLICY: ChildEnvPolicy;
+/**
+ * Build the environment for a child process under an explicit policy.
+ *
+ * `overrides` are applied after the policy and are NOT filtered — they are the
+ * caller's own deliberate writes (the credentials it just minted, the stage it
+ * resolved), not inherited ambient state. Under `isolate` the never-list is
+ * re-applied afterwards, so an override cannot reintroduce the task-role seam.
+ *
+ * The never-list does NOT apply under `inherit`: it carries `AWS_PROFILE` and
+ * the web-identity pair, which are exactly how an operator's laptop finds its
+ * identity. Removing them there would break every profile-based deploy to fix
+ * nothing — under `inherit` the child is already as trusted as the parent.
+ */
+export declare function buildChildEnv(policy: ChildEnvPolicy, source: NodeJS.ProcessEnv, overrides?: NodeJS.ProcessEnv): NodeJS.ProcessEnv;

package/dist/childEnvPolicy.js

@@ -0,0 +1 @@
+var I=Object.defineProperty;var S=(_,A)=>I(_,"name",{value:A,configurable:!0});import{filterDangerousEnvVars as R}from"./securityHelpers.js";const C=new Set(["PATH","TMPDIR","TEMP","TMP","LANG","LANGUAGE","LC_ALL","LC_CTYPE","TZ","TERM","COLUMNS","CI","FORCE_COLOR","NO_COLOR","NODE_NO_WARNINGS","NODE_ENV","SSL_CERT_FILE","SSL_CERT_DIR","HTTP_PROXY","HTTPS_PROXY","NO_PROXY","http_proxy","https_proxy","no_proxy","ENVIRONMENT","AWS_ACCESS_KEY_ID","AWS_SECRET_ACCESS_KEY","AWS_SESSION_TOKEN","AWS_REGION","AWS_DEFAULT_REGION","AWS_STS_REGIONAL_ENDPOINTS","AWS_USE_FIPS_ENDPOINT","AWS_MAX_ATTEMPTS","AWS_RETRY_MODE","CDK_DEFAULT_ACCOUNT","CDK_DEFAULT_REGION","CDK_DISABLE_VERSION_CHECK","CDK_OUTDIR"]),T=new Set(["AWS_CONTAINER_CREDENTIALS_RELATIVE_URI","AWS_CONTAINER_CREDENTIALS_FULL_URI","AWS_CONTAINER_AUTHORIZATION_TOKEN","AWS_CONTAINER_AUTHORIZATION_TOKEN_FILE","ECS_CONTAINER_METADATA_URI","ECS_CONTAINER_METADATA_URI_V4","AWS_WEB_IDENTITY_TOKEN_FILE","AWS_ROLE_ARN","AWS_ROLE_SESSION_NAME","AWS_PROFILE","AWS_SHARED_CREDENTIALS_FILE","AWS_CONFIG_FILE"]),D={kind:"isolate"};function n(_,A,O){const N={..._.kind==="inherit"?R(A):Object.fromEntries(Object.entries(A).filter(([E])=>(C.has(E)||_.extraAllowed?.includes(E)===!0)&&!T.has(E))),...O};if(_.kind==="isolate")for(const E of T)delete N[E];return N}S(n,"buildChildEnv");export{D as ARGV_ONLY_ENV_POLICY,C as CHILD_ENV_ALLOWED_NAMES,T as CHILD_ENV_NEVER_NAMES,n as buildChildEnv};

package/dist/ciSetup.d.ts

@@ -0,0 +1,25 @@
+/**
+ * `fjall ci setup` vocabulary — the ONE spelling the CLI's `--provider`
+ * option, its `CI_SETUP_SCHEMA` agent projection and the MCP's
+ * `plan_ci_setup` / `apply_ci_setup` pin all derive from.
+ *
+ * The MCP shells out to the CLI and cannot import it (`@fjall/cli` publishes
+ * a bin, no module exports), so until this module the two packages carried
+ * the provider list and the TOON field names as separate literals kept "in
+ * lockstep" by a comment. The MCP's pin reads the CLI's `--agent` output by
+ * field NAME (`provider: …`, `app: …`) and gates a deploy-token mint on the
+ * result, so a rename on one side silently un-pinned the other. Both sides
+ * now read these tuples; a rename is a typecheck failure in both packages.
+ *
+ * Client-safe (no node built-ins) — exported from the root barrel.
+ */
+export declare const CI_PROVIDERS: readonly ["github", "buildkite"];
+export type CiProvider = (typeof CI_PROVIDERS)[number];
+/**
+ * The fields `fjall ci setup --agent` renders as flat TOON `key: value`
+ * lines (the CLI's `CI_SETUP_SCHEMA.defaultFields`, in render order). No token
+ * field: the CLI never holds a deploy token — `mintUrl` is the hand-off to the
+ * web app that mints it.
+ */
+export declare const CI_SETUP_FIELDS: readonly ["provider", "repo", "app", "workflowPath", "planned", "workflowWritten", "deployTarget", "mintUrl", "secretName"];
+export type CiSetupField = (typeof CI_SETUP_FIELDS)[number];

package/dist/ciSetup.js

@@ -0,0 +1 @@
+const e=["github","buildkite"],t=["provider","repo","app","workflowPath","planned","workflowWritten","deployTarget","mintUrl","secretName"];export{e as CI_PROVIDERS,t as CI_SETUP_FIELDS};

package/dist/complianceIssue.d.ts

@@ -44,3 +44,13 @@ export declare const COMPLIANCE_ISSUE_STATUSES: readonly ["open", "acknowledged"
 export type ComplianceIssueStatus = (typeof COMPLIANCE_ISSUE_STATUSES)[number];
 /** Type guard: checks whether a string is a ComplianceIssue status. */
 export declare function isComplianceIssueStatus(value: string): value is ComplianceIssueStatus;
+/**
+ * ComplianceIssue severity vocabulary, most severe first — the order the
+ * webapp's `COMPLIANCE_SEVERITY_RANK` (app/.server/types/database-enums.ts)
+ * ranks by and its `/api/compliance/issues` `severity` filter accepts. The
+ * `mcp` `list_compliance_issues` filter builds `z.enum(...)` from it (same
+ * no-zod-here rationale as the statuses).
+ */
+export declare const COMPLIANCE_ISSUE_SEVERITIES: readonly ["critical", "high", "medium", "low"];
+/** @public — tuple companion type; ships with its tuple (knip skips @public) */
+export type ComplianceIssueSeverity = (typeof COMPLIANCE_ISSUE_SEVERITIES)[number];

package/dist/complianceIssue.js

@@ -1 +1 @@
-var S=Object.defineProperty;var t=(e,n)=>S(e,"name",{value:n,configurable:!0});const s=["open","acknowledged","pending_verification","resolved","suppressed","expected","mitigated"],o=new Set(s);function p(e){return o.has(e)}t(p,"isComplianceIssueStatus");export{s as COMPLIANCE_ISSUE_STATUSES,p as isComplianceIssueStatus};
+var i=Object.defineProperty;var t=(e,S)=>i(e,"name",{value:S,configurable:!0});const n=["open","acknowledged","pending_verification","resolved","suppressed","expected","mitigated"],o=new Set(n);function E(e){return o.has(e)}t(E,"isComplianceIssueStatus");const c=["critical","high","medium","low"];export{c as COMPLIANCE_ISSUE_SEVERITIES,n as COMPLIANCE_ISSUE_STATUSES,E as isComplianceIssueStatus};

package/dist/deploy/approvalTokenOutput.d.ts

@@ -9,12 +9,3 @@
  * silently. `@fjall/util` is the lowest common dependency of both.
  */
 export declare const APPROVAL_TOKEN_OUTPUT_PREFIX = "Approval token: ";
-/**
- * The exact stderr prefix the CLI prints a minted user token under
- * (`fjall user token create`). Deploy tokens are minted in the web app only
- * — `fjall ci setup` prints no token and the MCP `apply_ci_setup` handler
- * parses none — so this is a CLI-side print contract, single-sourced here
- * because it is the one place a minted credential is ever written to a
- * stream.
- */
-export declare const TOKEN_STDERR_PREFIX = "Token: ";

package/dist/deploy/approvalTokenOutput.js

@@ -1 +1 @@
-const o="Approval token: ",T="Token: ";export{o as APPROVAL_TOKEN_OUTPUT_PREFIX,T as TOKEN_STDERR_PREFIX};
+const o="Approval token: ";export{o as APPROVAL_TOKEN_OUTPUT_PREFIX};

package/dist/index.d.ts

@@ -1,9 +1,12 @@
 export { DNS_APEX, getDomainExportNames, getDomainStackName, getDomainUsEast1CertificatesStackName, hostsExportPartName, serialiseHostsChunks, HOSTS_OUTPUT_MAX_BYTES, isManagedDomainBinding, DOMAIN_DEPLOY_DEFAULT_PHASE, type DomainDeployPhase, type ManagedDomainBinding, type ManagedDomainCoverage, type ManagedDomainExports } from "./infra/domainExports.js";
-export { BACKUP_VAULT_NAME } from "./infra/backupVault.js";
-export { APPROVAL_TOKEN_OUTPUT_PREFIX, TOKEN_STDERR_PREFIX } from "./deploy/approvalTokenOutput.js";
+export { BACKUP_VAULT_NAME, BACKUP_VAULT_CONTEXT_KEY, BackupVaultLockSchema, type BackupVaultLock, BackupVaultVerdictSchema, type BackupVaultVerdict, isReownedBackupVault } from "./infra/backupVault.js";
+export { type NonEmptyPartial } from "./nonEmptyPartial.js";
+export { APPROVAL_TOKEN_OUTPUT_PREFIX } from "./deploy/approvalTokenOutput.js";
 export { imageTagParameterName } from "./infra/imageTags.js";
 export { toPascalCase, toKebab, toValidDatabaseName, toScreamingSnake, capitalise, getSafeZoneName, accountConstructKey, hasAsciiStableConstructKey } from "./naming/caseConversion.js";
 export { albDnsExportName, albHostedZoneIdExportName, cdnDomainExportName, bucketWebsiteEndpointExportName, bucketWebsiteHostedZoneIdExportName } from "./naming/targetExportNames.js";
+export { APPLICATION_STACKS, type ApplicationStack, getApplicationStackName, isApplicationStack } from "./naming/applicationStackNames.js";
+export { stackScopedExportName, DEPLOYABLE_SERVICE_EXPORT_MARKER, DEPLOYABLE_CLUSTER_EXPORT_MARKER, CLUSTER_ARN_EXPORT_MARKER, VPC_CIDR_EXPORT_MARKER, deployableServiceExportName, legacyDeployableServiceExportName, isDeployableServiceExportName, deployableClusterExportName, clusterArnExportName, defaultVpcConstructId, vpcCidrExportName, legacyVpcCidrExportName, isVpcCidrExportName } from "./naming/stackExportNames.js";
 export { ec2ServiceName, mintedEc2KeyPairName } from "./naming/ec2Naming.js";
 export { CAPACITY_SLOT_PATTERN, CAPACITY_SLOT_MAX_LENGTH, DEFAULT_CAPACITY_SLOT, CAPACITY_ANCHOR_PATTERN, CAPACITY_ANCHOR_MAX_LENGTH, CAPACITY_IDENTITY_CONTEXT_KEY, CapacityIdentityPinSchema, type CapacityIdentityPin, CapacityIdentityWireSchema, type CapacityIdentityWire, CapacityIdentityConfigSchema, type CapacityIdentityConfig, projectCapacityIdentityToTarget } from "./capacityIdentity.js";
 export { findAccountNameCollision, type AccountNameCollision } from "./naming/accountNameCollision.js";
@@ -12,6 +15,8 @@ export { normaliseError, getErrorMessage, hasErrorCode, getErrorCode, getErrorSt
 export { FJALL_CONFIG_DIR_ENV, FJALL_CREDENTIALS_FILENAME, FJALL_HOME_DIRNAME, FJALL_LOG_DIR_ENV, fjallCredentialsPath, fjallHomeDir, fjallLogDir, fjallStatePath } from "./fjallHome.js";
 export { singleton } from "./async/singleton.js";
 export { DANGEROUS_ENV_VARS, filterDangerousEnvVars, MASKED_VALUE_MARKER, maskSensitiveOutput, parseShellArgs, REDACTED_KEY_SENTINEL, SCOPED_TOKEN_REGEX } from "./securityHelpers.js";
+export { ARGV_ONLY_ENV_POLICY, buildChildEnv, CHILD_ENV_ALLOWED_NAMES, CHILD_ENV_NEVER_NAMES } from "./childEnvPolicy.js";
+export type { ChildEnvPolicy } from "./childEnvPolicy.js";
 export { sleep } from "./async/sleep.js";
 export { mapSettledWithConcurrency } from "./async/concurrency.js";
 export { ACCOUNT_STAGES_WITH_ROOT, STRUCTURAL_ENVIRONMENTS, ACCOUNT_STAGES, ACCOUNT_STAGE_LABELS, isAccountStage, ACCOUNT_TIERS, type AccountTier, AccountTierSchema, isAccountTier, GOVERNANCE_ACCOUNT_TIERS, isGovernanceTier, environmentToTier, type AccountStageEffect, accountStageEffect, ACCOUNT_STAGE_EFFECTS, formatAccountStageList, stageFromWireEnvironment, accountTier, resolveSynthEnvironment, type AccountStageWithRoot, type AccountStage, getEnvironmentLabel, ACCOUNT_ROLES } from "./environments.js";
@@ -23,7 +28,10 @@ export { abbreviateRegion, AWS_REGIONS_METADATA, DEFAULT_REGION, getRegionInfo,
 export { SCOPE_VALUES, MACHINE_ONLY_SCOPES, USER_GRANTABLE_SCOPES, GOVERNANCE_SCOPE_REQUIRED_CODE, SESSION_ONLY_API_ROUTES, type TokenScope } from "./infra/tokenScopes.js";
 export { SECRET_NAME_PATTERN, SECRET_NAME_ERROR, SSM_COMPONENT_PATTERN, SSM_COMPONENT_ERROR, SSM_STANDARD_MAX_VALUE_BYTES, SecretNamespaceSchema, type SecretNamespace, buildNamespaceParts, buildParameterPath, parseParameterPath, isManageablePath, parseDotEnv, escapeDotEnvValue } from "./secrets.js";
 export { ConnectionWireSchema, type ConnectionWire, ConnectionsListResponseSchema, type ConnectionsListResponse, CONNECTION_PHASES, type ConnectionPhase, CONNECTION_TERMINAL_FAILURE_PHASES, type ConnectionTerminalFailurePhase, CONNECTION_FAILURE_REASONS, type ConnectionFailureReason, EXTERNAL_ID_PATTERN } from "./infra/connectionsWire.js";
-export { COMPLIANCE_ISSUE_STATUSES, type ComplianceIssueStatus, isComplianceIssueStatus } from "./complianceIssue.js";
+export { COMPLIANCE_ISSUE_STATUSES, type ComplianceIssueStatus, isComplianceIssueStatus, COMPLIANCE_ISSUE_SEVERITIES, type ComplianceIssueSeverity } from "./complianceIssue.js";
+export { CI_PROVIDERS, type CiProvider, CI_SETUP_FIELDS, type CiSetupField } from "./ciSetup.js";
+export { INFRASTRUCTURE_TIER_NAMES, type InfrastructureTierName, CUSTOM_APP_TYPE, APP_TYPES, type AppType } from "./appTypes.js";
+export { INSIGHT_TAB_VALUES, type InsightTab, INSIGHT_CATEGORIES, type InsightCategory, INSIGHT_SEVERITIES, type InsightSeverity, INSIGHT_SORT_VALUES, type InsightSort } from "./insights/vocabulary.js";
 export { PUBLIC_PACKAGE_NAME, INSTALL_SOURCES, type InstallSource, SETUP_COMMANDS, type SetupCommandId, upgradeCommand, SETUP_MODES, type SetupMode, SETUP_STEP_IDS, type SetupStepId, type SetupStep, type SetupStepSequence, SETUP_STEPS, AGENT_SETUP_PROMPTS, AGENT_INSTALL_COMMAND, SKILL_INSTALL_SEGMENTS, SKILL_INSTALL_FILENAME, SKILL_INSTALL_PATH } from "./onboarding/index.js";
 export { deriveRegionsFromOrgConfig, deriveTargets, deriveAllTargets, environmentOrTier, explainRetiredTargetName, findTarget, generateTargetName, type OrgConfigRegions, type TargetAccount, type DerivedTarget, type ResolvedTargetAccount } from "./targets.js";
 export { buildAppConfigPath } from "./repo/appPath.js";
@@ -37,8 +45,8 @@ export { MIGRATION_SNAPSHOT_NAME_PREFIX, MIGRATION_SNAPSHOT_RETENTION_DAYS_ENV,
 export { SCHEMA_GATE_EXIT, SCHEMA_GATE_EXIT_HINTS, schemaGateExitKind, type SchemaGateExitKind, type SchemaGateExitCode } from "./migration/schemaGateExit.js";
 export { FJALL_SCHEMA_GATE_USER, FJALL_MAINTENANCE_USER, FJALL_CLICKHOUSE_USERS, type FjallClickHouseUser } from "./migration/clickhouseFrameworkUsers.js";
 export { PHYSICAL_NAME_FALLBACK_PROPERTIES } from "./cfn/physicalNameProperties.js";
-export { PATTERN_TYPE_VALUES, type PatternType, PATTERN_TYPES, isPatternType, type PatternArtefact, type PatternStackPlacement, type PatternDescriptor, PATTERN_REGISTRY, patternConstructId, DEPLOYABLE_PATTERN_TYPES, type OpenNextPatternType, OPENNEXT_PATTERN_TYPES, isOpenNextPatternType, CLOUDFRONT_PRICE_CLASS_VALUES, type CloudFrontPriceClass, STATIC_SITE_CONFIG_KEYS, type StaticSiteConfigKey, STATIC_SITE_DEPLOY_INJECTED_KEYS, type StaticSiteDeployInjectedKey, STATIC_SITE_CDN_CONFIG_KEYS, type StaticSiteCdnConfigKey, STATIC_SITE_ROUTING_VALUES, STATIC_SITE_ROUTING_INFO, type StaticSiteRouting, type StaticSiteRoutingDescriptor, PATTERN_CREATE_INPUT_VALUES, type PatternCreateInput, PATTERN_CREATE_INPUT_FLAGS } from "./patterns/patternTypes.js";
-export { FRAMEWORK_VALUES, type Framework, FRAMEWORKS, isFramework, type DeployablePatternType, type UndeployablePatternType, type PatternRecommendation, FRAMEWORK_PATTERN_RECOMMENDATIONS, recommendPatternForFramework, CREATABLE_FRAMEWORKS, requiredInputsForFramework } from "./patterns/frameworkPatterns.js";
+export { PATTERN_TYPE_VALUES, type PatternType, PATTERN_TYPES, isPatternType, type PatternArtefact, type PatternStackPlacement, type PatternDescriptor, PATTERN_REGISTRY, patternConstructId, type DeployablePatternType, DEPLOYABLE_PATTERN_TYPES, PATTERN_TIER_VALUES, type PatternTier, type OpenNextPatternType, OPENNEXT_PATTERN_TYPES, isOpenNextPatternType, OPENNEXT_BUCKET_KEYS, type OpenNextBucketKey, isOpenNextBucketKey, patternBucketConstructId, CLOUDFRONT_PRICE_CLASS_VALUES, type CloudFrontPriceClass, STATIC_SITE_CONFIG_KEYS, type StaticSiteConfigKey, STATIC_SITE_DEPLOY_INJECTED_KEYS, type StaticSiteDeployInjectedKey, STATIC_SITE_CDN_CONFIG_KEYS, type StaticSiteCdnConfigKey, STATIC_SITE_ROUTING_VALUES, STATIC_SITE_ROUTING_INFO, type StaticSiteRouting, type StaticSiteRoutingDescriptor, PATTERN_CREATE_INPUT_VALUES, type PatternCreateInput, PATTERN_CREATE_INPUT_FLAGS } from "./patterns/patternTypes.js";
+export { FRAMEWORK_VALUES, type Framework, FRAMEWORKS, isFramework, type UndeployablePatternType, type PatternRecommendation, FRAMEWORK_PATTERN_RECOMMENDATIONS, recommendPatternForFramework, CREATABLE_FRAMEWORKS, requiredInputsForFramework } from "./patterns/frameworkPatterns.js";
 export { DEFAULT_FORMS_FROM_LOCAL_PART, defaultFormsFromAddress, defaultFormsCorsOrigin, isAddressAtDomain } from "./patterns/staticSiteForms.js";
 export { DEV_SUBSTRATE_PARAMS_SCHEMA_VERSION, DEV_SUBSTRATE_PARAMS_FILENAME, DevSubstrateSynthPropsSchema, type DevSubstrateSynthProps, DevSubstrateParamsSchema, type DevSubstrateParams } from "./devSubstrate/params.js";
 export { DEV_SUBSTRATE_ENTRYPOINT_SOURCE } from "./devSubstrate/entrypoint.js";

package/dist/index.js

@@ -1 +1 @@
-import{DNS_APEX as _,getDomainExportNames as r,getDomainStackName as T,getDomainUsEast1CertificatesStackName as A,hostsExportPartName as S,serialiseHostsChunks as t,HOSTS_OUTPUT_MAX_BYTES as o,isManagedDomainBinding as a,DOMAIN_DEPLOY_DEFAULT_PHASE as N}from"./infra/domainExports.js";import{BACKUP_VAULT_NAME as I}from"./infra/backupVault.js";import{APPROVAL_TOKEN_OUTPUT_PREFIX as i,TOKEN_STDERR_PREFIX as C}from"./deploy/approvalTokenOutput.js";import{imageTagParameterName as n}from"./infra/imageTags.js";import{toPascalCase as L,toKebab as s,toValidDatabaseName as p,toScreamingSnake as D,capitalise as M,getSafeZoneName as c,accountConstructKey as f,hasAsciiStableConstructKey as U}from"./naming/caseConversion.js";import{albDnsExportName as l,albHostedZoneIdExportName as u,cdnDomainExportName as x,bucketWebsiteEndpointExportName as d,bucketWebsiteHostedZoneIdExportName as G}from"./naming/targetExportNames.js";import{ec2ServiceName as Y,mintedEc2KeyPairName as h}from"./naming/ec2Naming.js";import{CAPACITY_SLOT_PATTERN as V,CAPACITY_SLOT_MAX_LENGTH as K,DEFAULT_CAPACITY_SLOT as y,CAPACITY_ANCHOR_PATTERN as v,CAPACITY_ANCHOR_MAX_LENGTH as B,CAPACITY_IDENTITY_CONTEXT_KEY as X,CapacityIdentityPinSchema as b,CapacityIdentityWireSchema as W,CapacityIdentityConfigSchema as k,projectCapacityIdentityToTarget as J}from"./capacityIdentity.js";import{findAccountNameCollision as w}from"./naming/accountNameCollision.js";import{defaultConnectedAccountName as q,suffixedAccountName as z,REGION_SHORT_CODES as Q,findTrailingRegionShortCode as $,regionSuffixRejectionMessage as ee}from"./naming/connectedAccountName.js";import{normaliseError as _e,getErrorMessage as re,hasErrorCode as Te,getErrorCode as Ae,getErrorStack as Se,formatErrorString as te}from"./errorUtils.js";import{FJALL_CONFIG_DIR_ENV as ae,FJALL_CREDENTIALS_FILENAME as Ne,FJALL_HOME_DIRNAME as Re,FJALL_LOG_DIR_ENV as Ie,fjallCredentialsPath as Oe,fjallHomeDir as ie,fjallLogDir as Ce,fjallStatePath as me}from"./fjallHome.js";import{singleton as Pe}from"./async/singleton.js";import{DANGEROUS_ENV_VARS as se,filterDangerousEnvVars as pe,MASKED_VALUE_MARKER as De,maskSensitiveOutput as Me,parseShellArgs as ce,REDACTED_KEY_SENTINEL as fe,SCOPED_TOKEN_REGEX as Ue}from"./securityHelpers.js";import{sleep as le}from"./async/sleep.js";import{mapSettledWithConcurrency as xe}from"./async/concurrency.js";import{ACCOUNT_STAGES_WITH_ROOT as Ge,STRUCTURAL_ENVIRONMENTS as ge,ACCOUNT_STAGES as Ye,ACCOUNT_STAGE_LABELS as he,isAccountStage as He,ACCOUNT_TIERS as Ve,AccountTierSchema as Ke,isAccountTier as ye,GOVERNANCE_ACCOUNT_TIERS as ve,isGovernanceTier as Be,environmentToTier as Xe,accountStageEffect as be,ACCOUNT_STAGE_EFFECTS as We,formatAccountStageList as ke,stageFromWireEnvironment as Je,accountTier as je,resolveSynthEnvironment as we,getEnvironmentLabel as Ze,ACCOUNT_ROLES as qe}from"./environments.js";import{BACKUP_TIERS as Qe,BACKUP_TIER_DEFAULTS as $e,BACKUP_TIER_TAG_KEY as eE,BACKUP_TIER_TAG_MAP as EE,BackupTierSchema as _E,isBackupTier as rE,tierDefault as TE}from"./backupTiers.js";import{CODEMOD_STATEMENT_TYPES as SE,isCodemodStatementType as tE}from"./codemod/statementTypes.js";import{RESOURCE_CATEGORIES as aE,categoriseResource as NE,getExpectedDuration as RE,getFriendlyResourceType as IE}from"./resourceCategorisation.js";import{parseGitRemoteUrl as iE}from"./repo/gitRemoteParser.js";import{abbreviateRegion as mE,AWS_REGIONS_METADATA as nE,DEFAULT_REGION as PE,getRegionInfo as LE,MAX_SECONDARY_REGIONS as sE,OPT_IN_REGION_CODES as pE,optInRegionWarning as DE,regions as ME,RETIRED_REGION_ABBREVIATIONS as cE,suggestRegionForTimezone as fE}from"./infra/regions.js";import{SCOPE_VALUES as FE,MACHINE_ONLY_SCOPES as lE,USER_GRANTABLE_SCOPES as uE,GOVERNANCE_SCOPE_REQUIRED_CODE as xE,SESSION_ONLY_API_ROUTES as dE}from"./infra/tokenScopes.js";import{SECRET_NAME_PATTERN as gE,SECRET_NAME_ERROR as YE,SSM_COMPONENT_PATTERN as hE,SSM_COMPONENT_ERROR as HE,SSM_STANDARD_MAX_VALUE_BYTES as VE,SecretNamespaceSchema as KE,buildNamespaceParts as yE,buildParameterPath as vE,parseParameterPath as BE,isManageablePath as XE,parseDotEnv as bE,escapeDotEnvValue as WE}from"./secrets.js";import{ConnectionWireSchema as JE,ConnectionsListResponseSchema as jE,CONNECTION_PHASES as wE,CONNECTION_TERMINAL_FAILURE_PHASES as ZE,CONNECTION_FAILURE_REASONS as qE,EXTERNAL_ID_PATTERN as zE}from"./infra/connectionsWire.js";import{COMPLIANCE_ISSUE_STATUSES as $E,isComplianceIssueStatus as e_}from"./complianceIssue.js";import{PUBLIC_PACKAGE_NAME as __,INSTALL_SOURCES as r_,SETUP_COMMANDS as T_,upgradeCommand as A_,SETUP_MODES as S_,SETUP_STEP_IDS as t_,SETUP_STEPS as o_,AGENT_SETUP_PROMPTS as a_,AGENT_INSTALL_COMMAND as N_,SKILL_INSTALL_SEGMENTS as R_,SKILL_INSTALL_FILENAME as I_,SKILL_INSTALL_PATH as O_}from"./onboarding/index.js";import{deriveRegionsFromOrgConfig as C_,deriveTargets as m_,deriveAllTargets as n_,environmentOrTier as P_,explainRetiredTargetName as L_,findTarget as s_,generateTargetName as p_}from"./targets.js";import{buildAppConfigPath as M_}from"./repo/appPath.js";import{findInfrastructurePaths as f_,findBoundaryPath as U_,isInfrastructureFile as F_}from"./repo/findInfrastructurePaths.js";import{inferContainerFromCandidates as u_}from"./repo/inferContainerFromCandidates.js";import{RESERVED_APP_NAMES as d_,RESERVED_APP_NAME_MESSAGE as G_,isReservedAppName as g_,RESERVED_APP_NAME_SUFFIX as Y_,RESERVED_APP_NAME_SUFFIX_MESSAGE as h_,hasReservedAppNameSuffix as H_}from"./naming/reservedAppNames.js";import{deriveContentHashTag as K_,CONTENT_HASH_TAG_PATTERN as y_}from"./infra/deriveContentHashTag.js";import{DEPLOY_MODES as B_,DeployModeSchema as X_,IMAGE_TAG_PATTERN as b_,ImageTagSchema as W_,ServiceArtefactSchema as k_,ServiceArtefactsSchema as J_,ARTEFACT_OUTPUT_FIELDS as j_,artefactOutputKey as w_}from"./infra/deployArtefacts.js";import{MIGRATION_SNAPSHOT_NAME_PREFIX as q_,MIGRATION_SNAPSHOT_RETENTION_DAYS_ENV as z_,MIGRATION_SNAPSHOT_KIND_TAG_KEY as Q_,MIGRATION_SNAPSHOT_KIND_PREMIGRATE as $_,EXPECTED_SCHEMA_VERSION_ENV as er,EXPECTED_SCHEMA_VERSION_TOOL_ENV as Er,EXPECTED_CH_SCHEMA_VERSION_ENV as _r,SCHEMA_ADMIN_USER_ENV as rr,SCHEMA_ADMIN_PASSWORD_ENV as Tr,PRISMA_MIGRATION_DIR_RE as Ar,CLICKHOUSE_MIGRATION_SKIP_RE as Sr}from"./migration/constants.js";import{SCHEMA_GATE_EXIT as or,SCHEMA_GATE_EXIT_HINTS as ar,schemaGateExitKind as Nr}from"./migration/schemaGateExit.js";import{FJALL_SCHEMA_GATE_USER as Ir,FJALL_MAINTENANCE_USER as Or,FJALL_CLICKHOUSE_USERS as ir}from"./migration/clickhouseFrameworkUsers.js";import{PHYSICAL_NAME_FALLBACK_PROPERTIES as mr}from"./cfn/physicalNameProperties.js";import{PATTERN_TYPE_VALUES as Pr,PATTERN_TYPES as Lr,isPatternType as sr,PATTERN_REGISTRY as pr,patternConstructId as Dr,DEPLOYABLE_PATTERN_TYPES as Mr,OPENNEXT_PATTERN_TYPES as cr,isOpenNextPatternType as fr,CLOUDFRONT_PRICE_CLASS_VALUES as Ur,STATIC_SITE_CONFIG_KEYS as Fr,STATIC_SITE_DEPLOY_INJECTED_KEYS as lr,STATIC_SITE_CDN_CONFIG_KEYS as ur,STATIC_SITE_ROUTING_VALUES as xr,STATIC_SITE_ROUTING_INFO as dr,PATTERN_CREATE_INPUT_VALUES as Gr,PATTERN_CREATE_INPUT_FLAGS as gr}from"./patterns/patternTypes.js";import{FRAMEWORK_VALUES as hr,FRAMEWORKS as Hr,isFramework as Vr,FRAMEWORK_PATTERN_RECOMMENDATIONS as Kr,recommendPatternForFramework as yr,CREATABLE_FRAMEWORKS as vr,requiredInputsForFramework as Br}from"./patterns/frameworkPatterns.js";import{DEFAULT_FORMS_FROM_LOCAL_PART as br,defaultFormsFromAddress as Wr,defaultFormsCorsOrigin as kr,isAddressAtDomain as Jr}from"./patterns/staticSiteForms.js";import{DEV_SUBSTRATE_PARAMS_SCHEMA_VERSION as wr,DEV_SUBSTRATE_PARAMS_FILENAME as Zr,DevSubstrateSynthPropsSchema as qr,DevSubstrateParamsSchema as zr}from"./devSubstrate/params.js";import{DEV_SUBSTRATE_ENTRYPOINT_SOURCE as $r}from"./devSubstrate/entrypoint.js";import{BLESSED_CDK_TOOLCHAIN as ET}from"./cdkToolchain.js";import{DEPLOYMENT_FAILURE_PHASES as rT,DeploymentFailurePhaseSchema as TT,DEPLOYMENT_FAULT_ATTRIBUTIONS as AT,DeploymentFaultAttributionSchema as ST,DEPLOYMENT_FAILURE_PROVIDER_SOURCES as tT,DeploymentFailureProviderSourceSchema as oT,DEPLOYMENT_FAILURE_CODE_PATTERN as aT,DEPLOYMENT_FAILURE_SCHEMA_VERSION as NT,DEPLOYMENT_FAILURE_LIMITS as RT,DeploymentFailureAnalysisSchema as IT,DeploymentFailureProviderSchema as OT,DeploymentFailureResourceSchema as iT,DeploymentFailureSchema as CT,parseDeploymentFailure as mT,DEPLOYMENT_FAILURE_DOCS_BASE_URL as nT,deploymentFailureDocsUrl as PT,DEPLOYMENT_FAULT_COPY as LT,DEPLOYMENT_PROVIDER_LABELS as sT,deriveErrorMessageFromFailure as pT,toDeploymentFailureAnalysis as DT}from"./failure/deploymentFailure.js";import{extractErrorWindow as cT,ERROR_WINDOW_CONTEXT_LINES as fT}from"./failure/extractErrorWindow.js";import{FJALL_COMPONENT_GITIGNORE as FT,FJALL_PROJECT_GITIGNORE as lT,FJALL_STATE_GITIGNORE_ENTRIES as uT,FJALL_MANAGED_STATE_DIR_ENTRIES as xT,LOCAL_CONFIG_GITIGNORE_ENTRY as dT}from"./scaffold/gitignore.js";import{ensureGitignoreEntries as gT}from"./scaffold/ensureGitignore.js";export{qe as ACCOUNT_ROLES,Ye as ACCOUNT_STAGES,Ge as ACCOUNT_STAGES_WITH_ROOT,We as ACCOUNT_STAGE_EFFECTS,he as ACCOUNT_STAGE_LABELS,Ve as ACCOUNT_TIERS,N_ as AGENT_INSTALL_COMMAND,a_ as AGENT_SETUP_PROMPTS,i as APPROVAL_TOKEN_OUTPUT_PREFIX,j_ as ARTEFACT_OUTPUT_FIELDS,nE as AWS_REGIONS_METADATA,Ke as AccountTierSchema,Qe as BACKUP_TIERS,$e as BACKUP_TIER_DEFAULTS,eE as BACKUP_TIER_TAG_KEY,EE as BACKUP_TIER_TAG_MAP,I as BACKUP_VAULT_NAME,ET as BLESSED_CDK_TOOLCHAIN,_E as BackupTierSchema,B as CAPACITY_ANCHOR_MAX_LENGTH,v as CAPACITY_ANCHOR_PATTERN,X as CAPACITY_IDENTITY_CONTEXT_KEY,K as CAPACITY_SLOT_MAX_LENGTH,V as CAPACITY_SLOT_PATTERN,Sr as CLICKHOUSE_MIGRATION_SKIP_RE,Ur as CLOUDFRONT_PRICE_CLASS_VALUES,SE as CODEMOD_STATEMENT_TYPES,$E as COMPLIANCE_ISSUE_STATUSES,qE as CONNECTION_FAILURE_REASONS,wE as CONNECTION_PHASES,ZE as CONNECTION_TERMINAL_FAILURE_PHASES,y_ as CONTENT_HASH_TAG_PATTERN,vr as CREATABLE_FRAMEWORKS,k as CapacityIdentityConfigSchema,b as CapacityIdentityPinSchema,W as CapacityIdentityWireSchema,JE as ConnectionWireSchema,jE as ConnectionsListResponseSchema,se as DANGEROUS_ENV_VARS,y as DEFAULT_CAPACITY_SLOT,br as DEFAULT_FORMS_FROM_LOCAL_PART,PE as DEFAULT_REGION,Mr as DEPLOYABLE_PATTERN_TYPES,aT as DEPLOYMENT_FAILURE_CODE_PATTERN,nT as DEPLOYMENT_FAILURE_DOCS_BASE_URL,RT as DEPLOYMENT_FAILURE_LIMITS,rT as DEPLOYMENT_FAILURE_PHASES,tT as DEPLOYMENT_FAILURE_PROVIDER_SOURCES,NT as DEPLOYMENT_FAILURE_SCHEMA_VERSION,AT as DEPLOYMENT_FAULT_ATTRIBUTIONS,LT as DEPLOYMENT_FAULT_COPY,sT as DEPLOYMENT_PROVIDER_LABELS,B_ as DEPLOY_MODES,$r as DEV_SUBSTRATE_ENTRYPOINT_SOURCE,Zr as DEV_SUBSTRATE_PARAMS_FILENAME,wr as DEV_SUBSTRATE_PARAMS_SCHEMA_VERSION,_ as DNS_APEX,N as DOMAIN_DEPLOY_DEFAULT_PHASE,X_ as DeployModeSchema,IT as DeploymentFailureAnalysisSchema,TT as DeploymentFailurePhaseSchema,OT as DeploymentFailureProviderSchema,oT as DeploymentFailureProviderSourceSchema,iT as DeploymentFailureResourceSchema,CT as DeploymentFailureSchema,ST as DeploymentFaultAttributionSchema,zr as DevSubstrateParamsSchema,qr as DevSubstrateSynthPropsSchema,fT as ERROR_WINDOW_CONTEXT_LINES,_r as EXPECTED_CH_SCHEMA_VERSION_ENV,er as EXPECTED_SCHEMA_VERSION_ENV,Er as EXPECTED_SCHEMA_VERSION_TOOL_ENV,zE as EXTERNAL_ID_PATTERN,ir as FJALL_CLICKHOUSE_USERS,FT as FJALL_COMPONENT_GITIGNORE,ae as FJALL_CONFIG_DIR_ENV,Ne as FJALL_CREDENTIALS_FILENAME,Re as FJALL_HOME_DIRNAME,Ie as FJALL_LOG_DIR_ENV,Or as FJALL_MAINTENANCE_USER,xT as FJALL_MANAGED_STATE_DIR_ENTRIES,lT as FJALL_PROJECT_GITIGNORE,Ir as FJALL_SCHEMA_GATE_USER,uT as FJALL_STATE_GITIGNORE_ENTRIES,Hr as FRAMEWORKS,Kr as FRAMEWORK_PATTERN_RECOMMENDATIONS,hr as FRAMEWORK_VALUES,ve as GOVERNANCE_ACCOUNT_TIERS,xE as GOVERNANCE_SCOPE_REQUIRED_CODE,o as HOSTS_OUTPUT_MAX_BYTES,b_ as IMAGE_TAG_PATTERN,r_ as INSTALL_SOURCES,W_ as ImageTagSchema,dT as LOCAL_CONFIG_GITIGNORE_ENTRY,lE as MACHINE_ONLY_SCOPES,De as MASKED_VALUE_MARKER,sE as MAX_SECONDARY_REGIONS,$_ as MIGRATION_SNAPSHOT_KIND_PREMIGRATE,Q_ as MIGRATION_SNAPSHOT_KIND_TAG_KEY,q_ as MIGRATION_SNAPSHOT_NAME_PREFIX,z_ as MIGRATION_SNAPSHOT_RETENTION_DAYS_ENV,cr as OPENNEXT_PATTERN_TYPES,pE as OPT_IN_REGION_CODES,gr as PATTERN_CREATE_INPUT_FLAGS,Gr as PATTERN_CREATE_INPUT_VALUES,pr as PATTERN_REGISTRY,Lr as PATTERN_TYPES,Pr as PATTERN_TYPE_VALUES,mr as PHYSICAL_NAME_FALLBACK_PROPERTIES,Ar as PRISMA_MIGRATION_DIR_RE,__ as PUBLIC_PACKAGE_NAME,fe as REDACTED_KEY_SENTINEL,Q as REGION_SHORT_CODES,d_ as RESERVED_APP_NAMES,G_ as RESERVED_APP_NAME_MESSAGE,Y_ as RESERVED_APP_NAME_SUFFIX,h_ as RESERVED_APP_NAME_SUFFIX_MESSAGE,aE as RESOURCE_CATEGORIES,cE as RETIRED_REGION_ABBREVIATIONS,Tr as SCHEMA_ADMIN_PASSWORD_ENV,rr as SCHEMA_ADMIN_USER_ENV,or as SCHEMA_GATE_EXIT,ar as SCHEMA_GATE_EXIT_HINTS,Ue as SCOPED_TOKEN_REGEX,FE as SCOPE_VALUES,YE as SECRET_NAME_ERROR,gE as SECRET_NAME_PATTERN,dE as SESSION_ONLY_API_ROUTES,T_ as SETUP_COMMANDS,S_ as SETUP_MODES,o_ as SETUP_STEPS,t_ as SETUP_STEP_IDS,I_ as SKILL_INSTALL_FILENAME,O_ as SKILL_INSTALL_PATH,R_ as SKILL_INSTALL_SEGMENTS,HE as SSM_COMPONENT_ERROR,hE as SSM_COMPONENT_PATTERN,VE as SSM_STANDARD_MAX_VALUE_BYTES,ur as STATIC_SITE_CDN_CONFIG_KEYS,Fr as STATIC_SITE_CONFIG_KEYS,lr as STATIC_SITE_DEPLOY_INJECTED_KEYS,dr as STATIC_SITE_ROUTING_INFO,xr as STATIC_SITE_ROUTING_VALUES,ge as STRUCTURAL_ENVIRONMENTS,KE as SecretNamespaceSchema,k_ as ServiceArtefactSchema,J_ as ServiceArtefactsSchema,C as TOKEN_STDERR_PREFIX,uE as USER_GRANTABLE_SCOPES,mE as abbreviateRegion,f as accountConstructKey,be as accountStageEffect,je as accountTier,l as albDnsExportName,u as albHostedZoneIdExportName,w_ as artefactOutputKey,d as bucketWebsiteEndpointExportName,G as bucketWebsiteHostedZoneIdExportName,M_ as buildAppConfigPath,yE as buildNamespaceParts,vE as buildParameterPath,M as capitalise,NE as categoriseResource,x as cdnDomainExportName,q as defaultConnectedAccountName,kr as defaultFormsCorsOrigin,Wr as defaultFormsFromAddress,PT as deploymentFailureDocsUrl,n_ as deriveAllTargets,K_ as deriveContentHashTag,pT as deriveErrorMessageFromFailure,C_ as deriveRegionsFromOrgConfig,m_ as deriveTargets,Y as ec2ServiceName,gT as ensureGitignoreEntries,P_ as environmentOrTier,Xe as environmentToTier,WE as escapeDotEnvValue,L_ as explainRetiredTargetName,cT as extractErrorWindow,pe as filterDangerousEnvVars,w as findAccountNameCollision,U_ as findBoundaryPath,f_ as findInfrastructurePaths,s_ as findTarget,$ as findTrailingRegionShortCode,Oe as fjallCredentialsPath,ie as fjallHomeDir,Ce as fjallLogDir,me as fjallStatePath,ke as formatAccountStageList,te as formatErrorString,p_ as generateTargetName,r as getDomainExportNames,T as getDomainStackName,A as getDomainUsEast1CertificatesStackName,Ze as getEnvironmentLabel,Ae as getErrorCode,re as getErrorMessage,Se as getErrorStack,RE as getExpectedDuration,IE as getFriendlyResourceType,LE as getRegionInfo,c as getSafeZoneName,U as hasAsciiStableConstructKey,Te as hasErrorCode,H_ as hasReservedAppNameSuffix,S as hostsExportPartName,n as imageTagParameterName,u_ as inferContainerFromCandidates,He as isAccountStage,ye as isAccountTier,Jr as isAddressAtDomain,rE as isBackupTier,tE as isCodemodStatementType,e_ as isComplianceIssueStatus,Vr as isFramework,Be as isGovernanceTier,F_ as isInfrastructureFile,XE as isManageablePath,a as isManagedDomainBinding,fr as isOpenNextPatternType,sr as isPatternType,g_ as isReservedAppName,xe as mapSettledWithConcurrency,Me as maskSensitiveOutput,h as mintedEc2KeyPairName,_e as normaliseError,DE as optInRegionWarning,mT as parseDeploymentFailure,bE as parseDotEnv,iE as parseGitRemoteUrl,BE as parseParameterPath,ce as parseShellArgs,Dr as patternConstructId,J as projectCapacityIdentityToTarget,yr as recommendPatternForFramework,ee as regionSuffixRejectionMessage,ME as regions,Br as requiredInputsForFramework,we as resolveSynthEnvironment,Nr as schemaGateExitKind,t as serialiseHostsChunks,Pe as singleton,le as sleep,Je as stageFromWireEnvironment,z as suffixedAccountName,fE as suggestRegionForTimezone,TE as tierDefault,DT as toDeploymentFailureAnalysis,s as toKebab,L as toPascalCase,D as toScreamingSnake,p as toValidDatabaseName,A_ as upgradeCommand};
+import{DNS_APEX as _,getDomainExportNames as r,getDomainStackName as T,getDomainUsEast1CertificatesStackName as S,hostsExportPartName as A,serialiseHostsChunks as t,HOSTS_OUTPUT_MAX_BYTES as o,isManagedDomainBinding as a,DOMAIN_DEPLOY_DEFAULT_PHASE as N}from"./infra/domainExports.js";import{BACKUP_VAULT_NAME as I,BACKUP_VAULT_CONTEXT_KEY as C,BackupVaultLockSchema as O,BackupVaultVerdictSchema as i,isReownedBackupVault as m}from"./infra/backupVault.js";import{APPROVAL_TOKEN_OUTPUT_PREFIX as n}from"./deploy/approvalTokenOutput.js";import{imageTagParameterName as p}from"./infra/imageTags.js";import{toPascalCase as c,toKebab as D,toValidDatabaseName as M,toScreamingSnake as U,capitalise as f,getSafeZoneName as l,accountConstructKey as F,hasAsciiStableConstructKey as u}from"./naming/caseConversion.js";import{albDnsExportName as d,albHostedZoneIdExportName as G,cdnDomainExportName as g,bucketWebsiteEndpointExportName as V,bucketWebsiteHostedZoneIdExportName as Y}from"./naming/targetExportNames.js";import{APPLICATION_STACKS as K,getApplicationStackName as h,isApplicationStack as y}from"./naming/applicationStackNames.js";import{stackScopedExportName as v,DEPLOYABLE_SERVICE_EXPORT_MARKER as X,DEPLOYABLE_CLUSTER_EXPORT_MARKER as b,CLUSTER_ARN_EXPORT_MARKER as k,VPC_CIDR_EXPORT_MARKER as W,deployableServiceExportName as J,legacyDeployableServiceExportName as j,isDeployableServiceExportName as w,deployableClusterExportName as Z,clusterArnExportName as q,defaultVpcConstructId as z,vpcCidrExportName as Q,legacyVpcCidrExportName as $,isVpcCidrExportName as EE}from"./naming/stackExportNames.js";import{ec2ServiceName as _E,mintedEc2KeyPairName as rE}from"./naming/ec2Naming.js";import{CAPACITY_SLOT_PATTERN as SE,CAPACITY_SLOT_MAX_LENGTH as AE,DEFAULT_CAPACITY_SLOT as tE,CAPACITY_ANCHOR_PATTERN as oE,CAPACITY_ANCHOR_MAX_LENGTH as aE,CAPACITY_IDENTITY_CONTEXT_KEY as NE,CapacityIdentityPinSchema as RE,CapacityIdentityWireSchema as IE,CapacityIdentityConfigSchema as CE,projectCapacityIdentityToTarget as OE}from"./capacityIdentity.js";import{findAccountNameCollision as mE}from"./naming/accountNameCollision.js";import{defaultConnectedAccountName as nE,suffixedAccountName as LE,REGION_SHORT_CODES as pE,findTrailingRegionShortCode as sE,regionSuffixRejectionMessage as cE}from"./naming/connectedAccountName.js";import{normaliseError as ME,getErrorMessage as UE,hasErrorCode as fE,getErrorCode as lE,getErrorStack as FE,formatErrorString as uE}from"./errorUtils.js";import{FJALL_CONFIG_DIR_ENV as dE,FJALL_CREDENTIALS_FILENAME as GE,FJALL_HOME_DIRNAME as gE,FJALL_LOG_DIR_ENV as VE,fjallCredentialsPath as YE,fjallHomeDir as HE,fjallLogDir as KE,fjallStatePath as hE}from"./fjallHome.js";import{singleton as BE}from"./async/singleton.js";import{DANGEROUS_ENV_VARS as XE,filterDangerousEnvVars as bE,MASKED_VALUE_MARKER as kE,maskSensitiveOutput as WE,parseShellArgs as JE,REDACTED_KEY_SENTINEL as jE,SCOPED_TOKEN_REGEX as wE}from"./securityHelpers.js";import{ARGV_ONLY_ENV_POLICY as qE,buildChildEnv as zE,CHILD_ENV_ALLOWED_NAMES as QE,CHILD_ENV_NEVER_NAMES as $E}from"./childEnvPolicy.js";import{sleep as ee}from"./async/sleep.js";import{mapSettledWithConcurrency as re}from"./async/concurrency.js";import{ACCOUNT_STAGES_WITH_ROOT as Se,STRUCTURAL_ENVIRONMENTS as Ae,ACCOUNT_STAGES as te,ACCOUNT_STAGE_LABELS as oe,isAccountStage as ae,ACCOUNT_TIERS as Ne,AccountTierSchema as Re,isAccountTier as Ie,GOVERNANCE_ACCOUNT_TIERS as Ce,isGovernanceTier as Oe,environmentToTier as ie,accountStageEffect as me,ACCOUNT_STAGE_EFFECTS as Pe,formatAccountStageList as ne,stageFromWireEnvironment as Le,accountTier as pe,resolveSynthEnvironment as se,getEnvironmentLabel as ce,ACCOUNT_ROLES as De}from"./environments.js";import{BACKUP_TIERS as Ue,BACKUP_TIER_DEFAULTS as fe,BACKUP_TIER_TAG_KEY as le,BACKUP_TIER_TAG_MAP as Fe,BackupTierSchema as ue,isBackupTier as xe,tierDefault as de}from"./backupTiers.js";import{CODEMOD_STATEMENT_TYPES as ge,isCodemodStatementType as Ve}from"./codemod/statementTypes.js";import{RESOURCE_CATEGORIES as He,categoriseResource as Ke,getExpectedDuration as he,getFriendlyResourceType as ye}from"./resourceCategorisation.js";import{parseGitRemoteUrl as ve}from"./repo/gitRemoteParser.js";import{abbreviateRegion as be,AWS_REGIONS_METADATA as ke,DEFAULT_REGION as We,getRegionInfo as Je,MAX_SECONDARY_REGIONS as je,OPT_IN_REGION_CODES as we,optInRegionWarning as Ze,regions as qe,RETIRED_REGION_ABBREVIATIONS as ze,suggestRegionForTimezone as Qe}from"./infra/regions.js";import{SCOPE_VALUES as E_,MACHINE_ONLY_SCOPES as e_,USER_GRANTABLE_SCOPES as __,GOVERNANCE_SCOPE_REQUIRED_CODE as r_,SESSION_ONLY_API_ROUTES as T_}from"./infra/tokenScopes.js";import{SECRET_NAME_PATTERN as A_,SECRET_NAME_ERROR as t_,SSM_COMPONENT_PATTERN as o_,SSM_COMPONENT_ERROR as a_,SSM_STANDARD_MAX_VALUE_BYTES as N_,SecretNamespaceSchema as R_,buildNamespaceParts as I_,buildParameterPath as C_,parseParameterPath as O_,isManageablePath as i_,parseDotEnv as m_,escapeDotEnvValue as P_}from"./secrets.js";import{ConnectionWireSchema as L_,ConnectionsListResponseSchema as p_,CONNECTION_PHASES as s_,CONNECTION_TERMINAL_FAILURE_PHASES as c_,CONNECTION_FAILURE_REASONS as D_,EXTERNAL_ID_PATTERN as M_}from"./infra/connectionsWire.js";import{COMPLIANCE_ISSUE_STATUSES as f_,isComplianceIssueStatus as l_,COMPLIANCE_ISSUE_SEVERITIES as F_}from"./complianceIssue.js";import{CI_PROVIDERS as x_,CI_SETUP_FIELDS as d_}from"./ciSetup.js";import{INFRASTRUCTURE_TIER_NAMES as g_,CUSTOM_APP_TYPE as V_,APP_TYPES as Y_}from"./appTypes.js";import{INSIGHT_TAB_VALUES as K_,INSIGHT_CATEGORIES as h_,INSIGHT_SEVERITIES as y_,INSIGHT_SORT_VALUES as B_}from"./insights/vocabulary.js";import{PUBLIC_PACKAGE_NAME as X_,INSTALL_SOURCES as b_,SETUP_COMMANDS as k_,upgradeCommand as W_,SETUP_MODES as J_,SETUP_STEP_IDS as j_,SETUP_STEPS as w_,AGENT_SETUP_PROMPTS as Z_,AGENT_INSTALL_COMMAND as q_,SKILL_INSTALL_SEGMENTS as z_,SKILL_INSTALL_FILENAME as Q_,SKILL_INSTALL_PATH as $_}from"./onboarding/index.js";import{deriveRegionsFromOrgConfig as er,deriveTargets as _r,deriveAllTargets as rr,environmentOrTier as Tr,explainRetiredTargetName as Sr,findTarget as Ar,generateTargetName as tr}from"./targets.js";import{buildAppConfigPath as ar}from"./repo/appPath.js";import{findInfrastructurePaths as Rr,findBoundaryPath as Ir,isInfrastructureFile as Cr}from"./repo/findInfrastructurePaths.js";import{inferContainerFromCandidates as ir}from"./repo/inferContainerFromCandidates.js";import{RESERVED_APP_NAMES as Pr,RESERVED_APP_NAME_MESSAGE as nr,isReservedAppName as Lr,RESERVED_APP_NAME_SUFFIX as pr,RESERVED_APP_NAME_SUFFIX_MESSAGE as sr,hasReservedAppNameSuffix as cr}from"./naming/reservedAppNames.js";import{deriveContentHashTag as Mr,CONTENT_HASH_TAG_PATTERN as Ur}from"./infra/deriveContentHashTag.js";import{DEPLOY_MODES as lr,DeployModeSchema as Fr,IMAGE_TAG_PATTERN as ur,ImageTagSchema as xr,ServiceArtefactSchema as dr,ServiceArtefactsSchema as Gr,ARTEFACT_OUTPUT_FIELDS as gr,artefactOutputKey as Vr}from"./infra/deployArtefacts.js";import{MIGRATION_SNAPSHOT_NAME_PREFIX as Hr,MIGRATION_SNAPSHOT_RETENTION_DAYS_ENV as Kr,MIGRATION_SNAPSHOT_KIND_TAG_KEY as hr,MIGRATION_SNAPSHOT_KIND_PREMIGRATE as yr,EXPECTED_SCHEMA_VERSION_ENV as Br,EXPECTED_SCHEMA_VERSION_TOOL_ENV as vr,EXPECTED_CH_SCHEMA_VERSION_ENV as Xr,SCHEMA_ADMIN_USER_ENV as br,SCHEMA_ADMIN_PASSWORD_ENV as kr,PRISMA_MIGRATION_DIR_RE as Wr,CLICKHOUSE_MIGRATION_SKIP_RE as Jr}from"./migration/constants.js";import{SCHEMA_GATE_EXIT as wr,SCHEMA_GATE_EXIT_HINTS as Zr,schemaGateExitKind as qr}from"./migration/schemaGateExit.js";import{FJALL_SCHEMA_GATE_USER as Qr,FJALL_MAINTENANCE_USER as $r,FJALL_CLICKHOUSE_USERS as ET}from"./migration/clickhouseFrameworkUsers.js";import{PHYSICAL_NAME_FALLBACK_PROPERTIES as _T}from"./cfn/physicalNameProperties.js";import{PATTERN_TYPE_VALUES as TT,PATTERN_TYPES as ST,isPatternType as AT,PATTERN_REGISTRY as tT,patternConstructId as oT,DEPLOYABLE_PATTERN_TYPES as aT,PATTERN_TIER_VALUES as NT,OPENNEXT_PATTERN_TYPES as RT,isOpenNextPatternType as IT,OPENNEXT_BUCKET_KEYS as CT,isOpenNextBucketKey as OT,patternBucketConstructId as iT,CLOUDFRONT_PRICE_CLASS_VALUES as mT,STATIC_SITE_CONFIG_KEYS as PT,STATIC_SITE_DEPLOY_INJECTED_KEYS as nT,STATIC_SITE_CDN_CONFIG_KEYS as LT,STATIC_SITE_ROUTING_VALUES as pT,STATIC_SITE_ROUTING_INFO as sT,PATTERN_CREATE_INPUT_VALUES as cT,PATTERN_CREATE_INPUT_FLAGS as DT}from"./patterns/patternTypes.js";import{FRAMEWORK_VALUES as UT,FRAMEWORKS as fT,isFramework as lT,FRAMEWORK_PATTERN_RECOMMENDATIONS as FT,recommendPatternForFramework as uT,CREATABLE_FRAMEWORKS as xT,requiredInputsForFramework as dT}from"./patterns/frameworkPatterns.js";import{DEFAULT_FORMS_FROM_LOCAL_PART as gT,defaultFormsFromAddress as VT,defaultFormsCorsOrigin as YT,isAddressAtDomain as HT}from"./patterns/staticSiteForms.js";import{DEV_SUBSTRATE_PARAMS_SCHEMA_VERSION as hT,DEV_SUBSTRATE_PARAMS_FILENAME as yT,DevSubstrateSynthPropsSchema as BT,DevSubstrateParamsSchema as vT}from"./devSubstrate/params.js";import{DEV_SUBSTRATE_ENTRYPOINT_SOURCE as bT}from"./devSubstrate/entrypoint.js";import{BLESSED_CDK_TOOLCHAIN as WT}from"./cdkToolchain.js";import{DEPLOYMENT_FAILURE_PHASES as jT,DeploymentFailurePhaseSchema as wT,DEPLOYMENT_FAULT_ATTRIBUTIONS as ZT,DeploymentFaultAttributionSchema as qT,DEPLOYMENT_FAILURE_PROVIDER_SOURCES as zT,DeploymentFailureProviderSourceSchema as QT,DEPLOYMENT_FAILURE_CODE_PATTERN as $T,DEPLOYMENT_FAILURE_SCHEMA_VERSION as ES,DEPLOYMENT_FAILURE_LIMITS as eS,DeploymentFailureAnalysisSchema as _S,DeploymentFailureProviderSchema as rS,DeploymentFailureResourceSchema as TS,DeploymentFailureSchema as SS,parseDeploymentFailure as AS,DEPLOYMENT_FAILURE_DOCS_BASE_URL as tS,deploymentFailureDocsUrl as oS,DEPLOYMENT_FAULT_COPY as aS,DEPLOYMENT_PROVIDER_LABELS as NS,deriveErrorMessageFromFailure as RS,toDeploymentFailureAnalysis as IS}from"./failure/deploymentFailure.js";import{extractErrorWindow as OS,ERROR_WINDOW_CONTEXT_LINES as iS}from"./failure/extractErrorWindow.js";import{FJALL_COMPONENT_GITIGNORE as PS,FJALL_PROJECT_GITIGNORE as nS,FJALL_STATE_GITIGNORE_ENTRIES as LS,FJALL_MANAGED_STATE_DIR_ENTRIES as pS,LOCAL_CONFIG_GITIGNORE_ENTRY as sS}from"./scaffold/gitignore.js";import{ensureGitignoreEntries as DS}from"./scaffold/ensureGitignore.js";export{De as ACCOUNT_ROLES,te as ACCOUNT_STAGES,Se as ACCOUNT_STAGES_WITH_ROOT,Pe as ACCOUNT_STAGE_EFFECTS,oe as ACCOUNT_STAGE_LABELS,Ne as ACCOUNT_TIERS,q_ as AGENT_INSTALL_COMMAND,Z_ as AGENT_SETUP_PROMPTS,K as APPLICATION_STACKS,n as APPROVAL_TOKEN_OUTPUT_PREFIX,Y_ as APP_TYPES,qE as ARGV_ONLY_ENV_POLICY,gr as ARTEFACT_OUTPUT_FIELDS,ke as AWS_REGIONS_METADATA,Re as AccountTierSchema,Ue as BACKUP_TIERS,fe as BACKUP_TIER_DEFAULTS,le as BACKUP_TIER_TAG_KEY,Fe as BACKUP_TIER_TAG_MAP,C as BACKUP_VAULT_CONTEXT_KEY,I as BACKUP_VAULT_NAME,WT as BLESSED_CDK_TOOLCHAIN,ue as BackupTierSchema,O as BackupVaultLockSchema,i as BackupVaultVerdictSchema,aE as CAPACITY_ANCHOR_MAX_LENGTH,oE as CAPACITY_ANCHOR_PATTERN,NE as CAPACITY_IDENTITY_CONTEXT_KEY,AE as CAPACITY_SLOT_MAX_LENGTH,SE as CAPACITY_SLOT_PATTERN,QE as CHILD_ENV_ALLOWED_NAMES,$E as CHILD_ENV_NEVER_NAMES,x_ as CI_PROVIDERS,d_ as CI_SETUP_FIELDS,Jr as CLICKHOUSE_MIGRATION_SKIP_RE,mT as CLOUDFRONT_PRICE_CLASS_VALUES,k as CLUSTER_ARN_EXPORT_MARKER,ge as CODEMOD_STATEMENT_TYPES,F_ as COMPLIANCE_ISSUE_SEVERITIES,f_ as COMPLIANCE_ISSUE_STATUSES,D_ as CONNECTION_FAILURE_REASONS,s_ as CONNECTION_PHASES,c_ as CONNECTION_TERMINAL_FAILURE_PHASES,Ur as CONTENT_HASH_TAG_PATTERN,xT as CREATABLE_FRAMEWORKS,V_ as CUSTOM_APP_TYPE,CE as CapacityIdentityConfigSchema,RE as CapacityIdentityPinSchema,IE as CapacityIdentityWireSchema,L_ as ConnectionWireSchema,p_ as ConnectionsListResponseSchema,XE as DANGEROUS_ENV_VARS,tE as DEFAULT_CAPACITY_SLOT,gT as DEFAULT_FORMS_FROM_LOCAL_PART,We as DEFAULT_REGION,b as DEPLOYABLE_CLUSTER_EXPORT_MARKER,aT as DEPLOYABLE_PATTERN_TYPES,X as DEPLOYABLE_SERVICE_EXPORT_MARKER,$T as DEPLOYMENT_FAILURE_CODE_PATTERN,tS as DEPLOYMENT_FAILURE_DOCS_BASE_URL,eS as DEPLOYMENT_FAILURE_LIMITS,jT as DEPLOYMENT_FAILURE_PHASES,zT as DEPLOYMENT_FAILURE_PROVIDER_SOURCES,ES as DEPLOYMENT_FAILURE_SCHEMA_VERSION,ZT as DEPLOYMENT_FAULT_ATTRIBUTIONS,aS as DEPLOYMENT_FAULT_COPY,NS as DEPLOYMENT_PROVIDER_LABELS,lr as DEPLOY_MODES,bT as DEV_SUBSTRATE_ENTRYPOINT_SOURCE,yT as DEV_SUBSTRATE_PARAMS_FILENAME,hT as DEV_SUBSTRATE_PARAMS_SCHEMA_VERSION,_ as DNS_APEX,N as DOMAIN_DEPLOY_DEFAULT_PHASE,Fr as DeployModeSchema,_S as DeploymentFailureAnalysisSchema,wT as DeploymentFailurePhaseSchema,rS as DeploymentFailureProviderSchema,QT as DeploymentFailureProviderSourceSchema,TS as DeploymentFailureResourceSchema,SS as DeploymentFailureSchema,qT as DeploymentFaultAttributionSchema,vT as DevSubstrateParamsSchema,BT as DevSubstrateSynthPropsSchema,iS as ERROR_WINDOW_CONTEXT_LINES,Xr as EXPECTED_CH_SCHEMA_VERSION_ENV,Br as EXPECTED_SCHEMA_VERSION_ENV,vr as EXPECTED_SCHEMA_VERSION_TOOL_ENV,M_ as EXTERNAL_ID_PATTERN,ET as FJALL_CLICKHOUSE_USERS,PS as FJALL_COMPONENT_GITIGNORE,dE as FJALL_CONFIG_DIR_ENV,GE as FJALL_CREDENTIALS_FILENAME,gE as FJALL_HOME_DIRNAME,VE as FJALL_LOG_DIR_ENV,$r as FJALL_MAINTENANCE_USER,pS as FJALL_MANAGED_STATE_DIR_ENTRIES,nS as FJALL_PROJECT_GITIGNORE,Qr as FJALL_SCHEMA_GATE_USER,LS as FJALL_STATE_GITIGNORE_ENTRIES,fT as FRAMEWORKS,FT as FRAMEWORK_PATTERN_RECOMMENDATIONS,UT as FRAMEWORK_VALUES,Ce as GOVERNANCE_ACCOUNT_TIERS,r_ as GOVERNANCE_SCOPE_REQUIRED_CODE,o as HOSTS_OUTPUT_MAX_BYTES,ur as IMAGE_TAG_PATTERN,g_ as INFRASTRUCTURE_TIER_NAMES,h_ as INSIGHT_CATEGORIES,y_ as INSIGHT_SEVERITIES,B_ as INSIGHT_SORT_VALUES,K_ as INSIGHT_TAB_VALUES,b_ as INSTALL_SOURCES,xr as ImageTagSchema,sS as LOCAL_CONFIG_GITIGNORE_ENTRY,e_ as MACHINE_ONLY_SCOPES,kE as MASKED_VALUE_MARKER,je as MAX_SECONDARY_REGIONS,yr as MIGRATION_SNAPSHOT_KIND_PREMIGRATE,hr as MIGRATION_SNAPSHOT_KIND_TAG_KEY,Hr as MIGRATION_SNAPSHOT_NAME_PREFIX,Kr as MIGRATION_SNAPSHOT_RETENTION_DAYS_ENV,CT as OPENNEXT_BUCKET_KEYS,RT as OPENNEXT_PATTERN_TYPES,we as OPT_IN_REGION_CODES,DT as PATTERN_CREATE_INPUT_FLAGS,cT as PATTERN_CREATE_INPUT_VALUES,tT as PATTERN_REGISTRY,NT as PATTERN_TIER_VALUES,ST as PATTERN_TYPES,TT as PATTERN_TYPE_VALUES,_T as PHYSICAL_NAME_FALLBACK_PROPERTIES,Wr as PRISMA_MIGRATION_DIR_RE,X_ as PUBLIC_PACKAGE_NAME,jE as REDACTED_KEY_SENTINEL,pE as REGION_SHORT_CODES,Pr as RESERVED_APP_NAMES,nr as RESERVED_APP_NAME_MESSAGE,pr as RESERVED_APP_NAME_SUFFIX,sr as RESERVED_APP_NAME_SUFFIX_MESSAGE,He as RESOURCE_CATEGORIES,ze as RETIRED_REGION_ABBREVIATIONS,kr as SCHEMA_ADMIN_PASSWORD_ENV,br as SCHEMA_ADMIN_USER_ENV,wr as SCHEMA_GATE_EXIT,Zr as SCHEMA_GATE_EXIT_HINTS,wE as SCOPED_TOKEN_REGEX,E_ as SCOPE_VALUES,t_ as SECRET_NAME_ERROR,A_ as SECRET_NAME_PATTERN,T_ as SESSION_ONLY_API_ROUTES,k_ as SETUP_COMMANDS,J_ as SETUP_MODES,w_ as SETUP_STEPS,j_ as SETUP_STEP_IDS,Q_ as SKILL_INSTALL_FILENAME,$_ as SKILL_INSTALL_PATH,z_ as SKILL_INSTALL_SEGMENTS,a_ as SSM_COMPONENT_ERROR,o_ as SSM_COMPONENT_PATTERN,N_ as SSM_STANDARD_MAX_VALUE_BYTES,LT as STATIC_SITE_CDN_CONFIG_KEYS,PT as STATIC_SITE_CONFIG_KEYS,nT as STATIC_SITE_DEPLOY_INJECTED_KEYS,sT as STATIC_SITE_ROUTING_INFO,pT as STATIC_SITE_ROUTING_VALUES,Ae as STRUCTURAL_ENVIRONMENTS,R_ as SecretNamespaceSchema,dr as ServiceArtefactSchema,Gr as ServiceArtefactsSchema,__ as USER_GRANTABLE_SCOPES,W as VPC_CIDR_EXPORT_MARKER,be as abbreviateRegion,F as accountConstructKey,me as accountStageEffect,pe as accountTier,d as albDnsExportName,G as albHostedZoneIdExportName,Vr as artefactOutputKey,V as bucketWebsiteEndpointExportName,Y as bucketWebsiteHostedZoneIdExportName,ar as buildAppConfigPath,zE as buildChildEnv,I_ as buildNamespaceParts,C_ as buildParameterPath,f as capitalise,Ke as categoriseResource,g as cdnDomainExportName,q as clusterArnExportName,nE as defaultConnectedAccountName,YT as defaultFormsCorsOrigin,VT as defaultFormsFromAddress,z as defaultVpcConstructId,Z as deployableClusterExportName,J as deployableServiceExportName,oS as deploymentFailureDocsUrl,rr as deriveAllTargets,Mr as deriveContentHashTag,RS as deriveErrorMessageFromFailure,er as deriveRegionsFromOrgConfig,_r as deriveTargets,_E as ec2ServiceName,DS as ensureGitignoreEntries,Tr as environmentOrTier,ie as environmentToTier,P_ as escapeDotEnvValue,Sr as explainRetiredTargetName,OS as extractErrorWindow,bE as filterDangerousEnvVars,mE as findAccountNameCollision,Ir as findBoundaryPath,Rr as findInfrastructurePaths,Ar as findTarget,sE as findTrailingRegionShortCode,YE as fjallCredentialsPath,HE as fjallHomeDir,KE as fjallLogDir,hE as fjallStatePath,ne as formatAccountStageList,uE as formatErrorString,tr as generateTargetName,h as getApplicationStackName,r as getDomainExportNames,T as getDomainStackName,S as getDomainUsEast1CertificatesStackName,ce as getEnvironmentLabel,lE as getErrorCode,UE as getErrorMessage,FE as getErrorStack,he as getExpectedDuration,ye as getFriendlyResourceType,Je as getRegionInfo,l as getSafeZoneName,u as hasAsciiStableConstructKey,fE as hasErrorCode,cr as hasReservedAppNameSuffix,A as hostsExportPartName,p as imageTagParameterName,ir as inferContainerFromCandidates,ae as isAccountStage,Ie as isAccountTier,HT as isAddressAtDomain,y as isApplicationStack,xe as isBackupTier,Ve as isCodemodStatementType,l_ as isComplianceIssueStatus,w as isDeployableServiceExportName,lT as isFramework,Oe as isGovernanceTier,Cr as isInfrastructureFile,i_ as isManageablePath,a as isManagedDomainBinding,OT as isOpenNextBucketKey,IT as isOpenNextPatternType,AT as isPatternType,m as isReownedBackupVault,Lr as isReservedAppName,EE as isVpcCidrExportName,j as legacyDeployableServiceExportName,$ as legacyVpcCidrExportName,re as mapSettledWithConcurrency,WE as maskSensitiveOutput,rE as mintedEc2KeyPairName,ME as normaliseError,Ze as optInRegionWarning,AS as parseDeploymentFailure,m_ as parseDotEnv,ve as parseGitRemoteUrl,O_ as parseParameterPath,JE as parseShellArgs,iT as patternBucketConstructId,oT as patternConstructId,OE as projectCapacityIdentityToTarget,uT as recommendPatternForFramework,cE as regionSuffixRejectionMessage,qe as regions,dT as requiredInputsForFramework,se as resolveSynthEnvironment,qr as schemaGateExitKind,t as serialiseHostsChunks,BE as singleton,ee as sleep,v as stackScopedExportName,Le as stageFromWireEnvironment,LE as suffixedAccountName,Qe as suggestRegionForTimezone,de as tierDefault,IS as toDeploymentFailureAnalysis,D as toKebab,c as toPascalCase,U as toScreamingSnake,M as toValidDatabaseName,W_ as upgradeCommand,Q as vpcCidrExportName};